From 77ea1771c990289362b505306b08b7a5d2475de4 Mon Sep 17 00:00:00 2001 From: mfp19 Date: Wed, 19 Aug 2015 22:49:00 +0700 Subject: [PATCH 001/135] Update CNAME --- CNAME | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CNAME b/CNAME index 8da5337..9bf2c2c 100644 --- a/CNAME +++ b/CNAME @@ -1 +1 @@ -blog.invisiblethings.org +mfp19.meganetwork.org From 2ec0a50e9b59b9c42a19f93d7c01af50281add42 Mon Sep 17 00:00:00 2001 From: mfp19 Date: Wed, 19 Aug 2015 22:51:06 +0700 Subject: [PATCH 002/135] Update 2015-07-10-caspar.md --- _posts/2015-07-10-caspar.md | 79 ++----------------------------------- 1 file changed, 3 insertions(+), 76 deletions(-) diff --git a/_posts/2015-07-10-caspar.md b/_posts/2015-07-10-caspar.md index 75eb2b6..a8236e5 100644 --- a/_posts/2015-07-10-caspar.md +++ b/_posts/2015-07-10-caspar.md @@ -1,80 +1,7 @@ --- layout: post -title: Caspar -author: Joanna Rutkowska +title: Sah sah sah ... Test. +author: mfp19 --- - - -I met Caspar Bowden for the first time back in 2013 when he was visiting Warsaw -for a privacy conference. I was expecting to meet another boring policy/legal -person, but that expectation was quickly revisited. First, he surprised me by -pulling his laptop, which turned out to be running... yes, that's correct: Qubes -OS! And he actually turned out to just "get it" all, and so instead of dealing -with silly questions about security, which I'm so often exposed to, we had a -very interesting conversation, spanning both technology and politics. - -Of course this wouldn't be that surprising if I knew back then he actually -studied math and computer science on Cambridge back in the 80s, and then worked -as a programmer for some years, before he turned towards privacy advocacy and -politics. - -Caspar was a man with a strong moral fibre, not afraid to ask difficult -questions, even if this might be harming his career. He held certain beliefs -about how the world should be functioning (he was a supporter of civil society, -with a strong respect for privacy rights), and was ready to fight for them, no -matter what. At the same time he had little interest in honours for himself, -something that, ironically, might have been an obstacle for becoming more -successful in his fights (which so often is the case with Good People). - -He believed that the approach we took with Qubes OS was the right one and -essential for defense of privacy violations in the modern digital world. And so, -for the last 2+ years, Caspar was playing an active role of the project's -evangelist, tirelessly promoting Qubes to other members of the privacy -community, EU politicians, and many other people who he was dealing with during -his life's mission. As far as I can tell, Caspar was the first true Qubes -evangelist we have had. Last year he agreed to be officially listed as "Qubes -Policy Adviser", a position for which he requested no compensation. In fact he -has never received any compensation from ITL for his efforts to promote our -project... - -Caspar was also a board member for the Tor project. - -Caspar Bowden died yesterday, after an exhausting battle with cancer. -[[1]][^1][[2]][^2][[3]][^3][[4]][^4][[5]][^5][[6]][^6][[7]][^7][[8]][^8] - -It saddens me that Caspar passed away before having a chance to see a victory -for his efforts -- He died in very dark times. It saddens me we lost a great -ally in this war. It saddens me I lost a friend. - -In moments like this I also find it increasingly disturbing to realize how our -society promotes [dubious -individuals](https://www.psychologytoday.com/basics/psychopathy) to the top of its -ladder of success, people with whom Caspar often had to fight, while making the -life difficult and often discouraging for good people like Caspar. It's probably -worth to think about this, sometimes. - -To honor Caspar's work and to thank him, we decided to dedicate the upcoming -Qubes 3.0 release to him. - -It's been an honour working, discussing, and learning from you, Caspar. Among -other things, I'm also gonna miss our discussions about the nature of -consciousness. All the best with your new ventures, whatever and wherever these -might be! Thanks for everything. - -[^1]: http://www.bbc.com/news/technology-33473105 - -[^2]: http://www.theguardian.com/technology/2015/jul/10/outspoken-privacy-campaigner-caspar-bowden-dies-after-battle-with-cancer - -[^3]: http://boingboing.net/2015/07/09/rip-caspar-bowden-tireless.html - -[^4]: https://www.eff.org/deeplinks/2015/07/memoriam-caspar-bowden - -[^5]: http://arstechnica.co.uk/tech-policy/2015/07/caspar-bowden-tireless-defender-of-online-privacy-dies/ - -[^6]: http://www.theregister.co.uk/2015/07/09/caspar_bowden_dies_cancer_battle/ - -[^7]: http://paranoia.dubfire.net/2015/07/goodbye-caspar.html - -[^8]: http://www.independent.co.uk/news/people/caspar-bowden-dead-tireless-privacy-campaigner-dies-from-cancer-10380746.html +Hello World From 4e19ff80ad2a91e181f46de29299dc92039a91f6 Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Wed, 19 Aug 2015 22:54:30 +0700 Subject: [PATCH 003/135] Rooty's post removal --- ...006-05-12-svv-source-code-made-public.html | 12 -- ...006-05-17-confidence-2006-trip-report.html | 12 -- _posts/2006-06-22-introducing-blue-pill.html | 12 -- _posts/2006-07-01-blue-pill-hype.html | 12 -- _posts/2006-08-12-blue-pill-detection.html | 12 -- ...ista-rc1-still-vulnerable-to-pagefile.html | 12 -- ...vista-rc2-vs-pagefile-attack-and-some.html | 12 -- ...-introducing-stealth-malware-taxonomy.html | 12 -- ...-towards-verifiable-operating-systems.html | 12 -- ...eyond-cpu-cheating-hardware-based-ram.html | 13 -- .../2007-02-04-running-vista-every-day.html | 13 -- ...7-02-12-vista-security-model-big-joke.html | 12 -- _posts/2007-02-13-confiusion-about-joke.html | 12 -- ...03-05-handy-tool-to-play-with-windows.html | 12 -- _posts/2007-03-26-game-is-over.html | 13 -- _posts/2007-04-01-human-factor.html | 12 -- ...7-04-20-understanding-stealth-malware.html | 13 -- ...-18-invisible-things-lab-bitlockertpm.html | 12 -- ...6-28-were-ready-for-ptaceks-challenge.html | 12 -- ...virtualization-detection-vs-blue-pill.html | 12 -- _posts/2007-08-31-tricky-tricks.html | 12 -- ...07-10-17-thoughts-on-browser-rootkits.html | 12 -- _posts/2007-10-25-razor-thin-hypervisors.html | 12 -- ...008-03-31-kick-ass-hypervisor-nesting.html | 13 -- _posts/2008-04-09-rsa-absurd.html | 12 -- ...-04-12-most-stupid-security-news-ever.html | 12 -- _posts/2008-04-14-research-obfuscated.html | 13 -- _posts/2008-04-30-vegas-training-2008.html | 12 -- _posts/2008-05-20-1984.html | 12 -- ...rafal-wojtczuk-joins-invisible-things.html | 12 -- _posts/2008-07-07-0wning-xen-in-vegas.html | 16 -- ...-08-our-xen-0wning-trilogy-highlights.html | 16 -- ...2008-08-20-attacking-xen-domu-vs-dom0.html | 13 -- _posts/2008-08-26-intel-patches-q35-bug.html | 12 -- _posts/2008-08-31-teamwork-crediting.html | 13 -- ...three-approaches-to-computer-security.html | 13 -- ...xen-0wning-trilogy-code-demos-and-q35.html | 16 -- ...crosoft-executive-rebuts-our-research.html | 14 -- ...-05-attacking-intel-trusted-execution.html | 17 -- ...-21-why-do-i-miss-microsoft-bitlocker.html | 17 -- .../2009-01-26-closed-source-conspiracy.html | 13 -- _posts/2009-02-10-nesting-vmms-reloaded.html | 15 -- ...-attacking-intel-txt-paper-and-slides.html | 18 -- ...-03-13-independent-attack-discoveries.html | 12 -- ...19-attacking-smm-memory-via-intel-cpu.html | 15 -- _posts/2009-03-20-sky-is-falling.html | 14 -- _posts/2009-03-25-trusting-hardware.html | 15 -- ...5-28-thoughts-about-trusted-computing.html | 14 -- ...-06-02-more-thoughts-on-cpu-backdoors.html | 14 -- _posts/2009-06-09-quest-to-core.html | 14 -- ...virtualization-insecurity-training-in.html | 15 -- _posts/2009-07-17-interview.html | 13 -- _posts/2009-07-30-black-hat-2009-slides.html | 17 -- ...-08-25-vegas-toys-part-i-ring-3-tools.html | 16 -- _posts/2009-08-26-pdf-signing-and-beyond.html | 15 -- ...-about-apples-security-foundations-or.html | 15 -- ...09-09-22-intel-security-summit-slides.html | 16 -- ...-10-16-evil-maid-goes-after-truecrypt.html | 18 -- _posts/2009-12-21-another-txt-attack.html | 17 -- _posts/2010-01-16-priorities.html | 14 -- _posts/2010-04-07-introducing-qubes-os.html | 13 -- ...motely-attacking-network-cards-or-why.html | 17 -- _posts/2010-05-01-evolution.html | 13 -- ...on-formally-verified-microkernels-and.html | 16 -- _posts/2010-06-01-disposable-vms.html | 13 -- _posts/2010-07-01-qubes-alpha-2-released.html | 13 -- ...8-17-skeletons-hidden-in-linux-closet.html | 14 -- _posts/2010-08-19-ms-dos-security-model.html | 15 -- ...2010-09-02-qubes-qubes-pro-and-future.html | 15 -- ...0-09-09-untrusting-your-gui-subsystem.html | 16 -- .../2010-09-13-on-thin-clients-security.html | 14 -- _posts/2010-09-28-itl-is-hiring.html | 15 -- _posts/2010-10-06-qubes-alpha-3.html | 14 -- _posts/2010-12-06-update-on-qubes.html | 14 -- ...-my-documents-got-loststolen-offtopic.html | 13 -- ...-13-partitioning-my-digital-life-into.html | 16 -- ...-04-12-qubes-beta-1-has-been-released.html | 13 -- ...-why-us-password-revolution-wont-work.html | 15 -- ...inux-security-circus-on-gui-isolation.html | 14 -- ...llowing-white-rabbit-software-attacks.html | 16 -- ...pp-oriented-ui-model-and-its-security.html | 16 -- _posts/2011-05-28-untrusting-cloud.html | 16 -- .../2011-06-01-usb-security-challenges.html | 17 -- ...-03-from-slides-to-silicon-in-3-years.html | 15 -- _posts/2011-06-10-my-sstic-2011-slides.html | 13 -- .../2011-08-30-interview-about-qubes-os.html | 14 -- _posts/2011-09-07-anti-evil-maid.html | 17 -- _posts/2011-09-19-qubes-beta-2-released.html | 13 -- ...playing-with-qubes-networking-for-fun.html | 14 -- ...ploring-new-lands-on-intel-cpus-sinit.html | 12 -- ...-trusted-execution-in-untrusted-cloud.html | 15 -- _posts/2012-01-21-thoughts-on-deepsafe.html | 16 -- _posts/2012-02-06-qubes-beta-3.html | 13 -- ...03-03-windows-support-coming-to-qubes.html | 14 -- ...ome-comments-on-operation-high-roller.html | 12 -- ...12-07-21-qubes-10-release-candidate-1.html | 13 -- _posts/2012-09-03-introducing-qubes-10.html | 12 -- ...-09-12-how-is-qubes-os-different-from.html | 14 -- ...4-qubes-2-beta-1-with-initial-windows.html | 12 -- ...onverting-untrusted-pdfs-into-trusted.html | 13 -- ...2-28-qubes-2-beta-2-has-been-released.html | 13 -- ...1-introducing-qubes-odyssey-framework.html | 13 -- ...qubes-os-r3-alpha-preview-odyssey-hal.html | 13 -- ...-thoughts-on-intels-upcoming-software.html | 12 -- ...-thoughts-on-intels-upcoming-software.html | 12 -- ...26-windows-7-seamless-gui-integration.html | 13 -- ...-11-qubes-r2-beta-3-has-been-released.html | 12 -- ...-shattering-myths-of-windows-security.html | 12 -- ...-20-qubes-os-r2-rc1-has-been-released.html | 12 -- ...qubes-os-r2-rc2-debian-template-ssled.html | 16 -- ...08-26-physical-separation-vs-software.html | 12 -- ...4-09-26-announcing-qubes-os-release-2.html | 14 -- ...7-qubes-r3odyssey-initial-source-code.html | 15 -- _posts/2015-02-09-my-new-git-based-blog.md | 106 ----------- _posts/2015-04-23-qubes-30rc1-and-roadmap.md | 173 ------------------ _posts/2015-06-04-otf-funding-announcement.md | 117 ------------ ...-10-caspar.md => 2015-08-19-HelloWorld.md} | 0 117 files changed, 1948 deletions(-) delete mode 100644 _posts/2006-05-12-svv-source-code-made-public.html delete mode 100644 _posts/2006-05-17-confidence-2006-trip-report.html delete mode 100644 _posts/2006-06-22-introducing-blue-pill.html delete mode 100644 _posts/2006-07-01-blue-pill-hype.html delete mode 100644 _posts/2006-08-12-blue-pill-detection.html delete mode 100644 _posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html delete mode 100644 _posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html delete mode 100644 _posts/2006-11-24-introducing-stealth-malware-taxonomy.html delete mode 100644 _posts/2007-01-03-towards-verifiable-operating-systems.html delete mode 100644 _posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html delete mode 100644 _posts/2007-02-04-running-vista-every-day.html delete mode 100644 _posts/2007-02-12-vista-security-model-big-joke.html delete mode 100644 _posts/2007-02-13-confiusion-about-joke.html delete mode 100644 _posts/2007-03-05-handy-tool-to-play-with-windows.html delete mode 100644 _posts/2007-03-26-game-is-over.html delete mode 100644 _posts/2007-04-01-human-factor.html delete mode 100644 _posts/2007-04-20-understanding-stealth-malware.html delete mode 100644 _posts/2007-05-18-invisible-things-lab-bitlockertpm.html delete mode 100644 _posts/2007-06-28-were-ready-for-ptaceks-challenge.html delete mode 100644 _posts/2007-08-03-virtualization-detection-vs-blue-pill.html delete mode 100644 _posts/2007-08-31-tricky-tricks.html delete mode 100644 _posts/2007-10-17-thoughts-on-browser-rootkits.html delete mode 100644 _posts/2007-10-25-razor-thin-hypervisors.html delete mode 100644 _posts/2008-03-31-kick-ass-hypervisor-nesting.html delete mode 100644 _posts/2008-04-09-rsa-absurd.html delete mode 100644 _posts/2008-04-12-most-stupid-security-news-ever.html delete mode 100644 _posts/2008-04-14-research-obfuscated.html delete mode 100644 _posts/2008-04-30-vegas-training-2008.html delete mode 100644 _posts/2008-05-20-1984.html delete mode 100644 _posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html delete mode 100644 _posts/2008-07-07-0wning-xen-in-vegas.html delete mode 100644 _posts/2008-08-08-our-xen-0wning-trilogy-highlights.html delete mode 100644 _posts/2008-08-20-attacking-xen-domu-vs-dom0.html delete mode 100644 _posts/2008-08-26-intel-patches-q35-bug.html delete mode 100644 _posts/2008-08-31-teamwork-crediting.html delete mode 100644 _posts/2008-09-02-three-approaches-to-computer-security.html delete mode 100644 _posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html delete mode 100644 _posts/2008-09-07-microsoft-executive-rebuts-our-research.html delete mode 100644 _posts/2009-01-05-attacking-intel-trusted-execution.html delete mode 100644 _posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html delete mode 100644 _posts/2009-01-26-closed-source-conspiracy.html delete mode 100644 _posts/2009-02-10-nesting-vmms-reloaded.html delete mode 100644 _posts/2009-02-19-attacking-intel-txt-paper-and-slides.html delete mode 100644 _posts/2009-03-13-independent-attack-discoveries.html delete mode 100644 _posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html delete mode 100644 _posts/2009-03-20-sky-is-falling.html delete mode 100644 _posts/2009-03-25-trusting-hardware.html delete mode 100644 _posts/2009-05-28-thoughts-about-trusted-computing.html delete mode 100644 _posts/2009-06-02-more-thoughts-on-cpu-backdoors.html delete mode 100644 _posts/2009-06-09-quest-to-core.html delete mode 100644 _posts/2009-06-12-virtualization-insecurity-training-in.html delete mode 100644 _posts/2009-07-17-interview.html delete mode 100644 _posts/2009-07-30-black-hat-2009-slides.html delete mode 100644 _posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html delete mode 100644 _posts/2009-08-26-pdf-signing-and-beyond.html delete mode 100644 _posts/2009-09-02-about-apples-security-foundations-or.html delete mode 100644 _posts/2009-09-22-intel-security-summit-slides.html delete mode 100644 _posts/2009-10-16-evil-maid-goes-after-truecrypt.html delete mode 100644 _posts/2009-12-21-another-txt-attack.html delete mode 100644 _posts/2010-01-16-priorities.html delete mode 100644 _posts/2010-04-07-introducing-qubes-os.html delete mode 100644 _posts/2010-04-30-remotely-attacking-network-cards-or-why.html delete mode 100644 _posts/2010-05-01-evolution.html delete mode 100644 _posts/2010-05-03-on-formally-verified-microkernels-and.html delete mode 100644 _posts/2010-06-01-disposable-vms.html delete mode 100644 _posts/2010-07-01-qubes-alpha-2-released.html delete mode 100644 _posts/2010-08-17-skeletons-hidden-in-linux-closet.html delete mode 100644 _posts/2010-08-19-ms-dos-security-model.html delete mode 100644 _posts/2010-09-02-qubes-qubes-pro-and-future.html delete mode 100644 _posts/2010-09-09-untrusting-your-gui-subsystem.html delete mode 100644 _posts/2010-09-13-on-thin-clients-security.html delete mode 100644 _posts/2010-09-28-itl-is-hiring.html delete mode 100644 _posts/2010-10-06-qubes-alpha-3.html delete mode 100644 _posts/2010-12-06-update-on-qubes.html delete mode 100644 _posts/2011-03-08-my-documents-got-loststolen-offtopic.html delete mode 100644 _posts/2011-03-13-partitioning-my-digital-life-into.html delete mode 100644 _posts/2011-04-12-qubes-beta-1-has-been-released.html delete mode 100644 _posts/2011-04-16-why-us-password-revolution-wont-work.html delete mode 100644 _posts/2011-04-23-linux-security-circus-on-gui-isolation.html delete mode 100644 _posts/2011-05-13-following-white-rabbit-software-attacks.html delete mode 100644 _posts/2011-05-21-app-oriented-ui-model-and-its-security.html delete mode 100644 _posts/2011-05-28-untrusting-cloud.html delete mode 100644 _posts/2011-06-01-usb-security-challenges.html delete mode 100644 _posts/2011-06-03-from-slides-to-silicon-in-3-years.html delete mode 100644 _posts/2011-06-10-my-sstic-2011-slides.html delete mode 100644 _posts/2011-08-30-interview-about-qubes-os.html delete mode 100644 _posts/2011-09-07-anti-evil-maid.html delete mode 100644 _posts/2011-09-19-qubes-beta-2-released.html delete mode 100644 _posts/2011-09-28-playing-with-qubes-networking-for-fun.html delete mode 100644 _posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html delete mode 100644 _posts/2011-12-13-trusted-execution-in-untrusted-cloud.html delete mode 100644 _posts/2012-01-21-thoughts-on-deepsafe.html delete mode 100644 _posts/2012-02-06-qubes-beta-3.html delete mode 100644 _posts/2012-03-03-windows-support-coming-to-qubes.html delete mode 100644 _posts/2012-06-27-some-comments-on-operation-high-roller.html delete mode 100644 _posts/2012-07-21-qubes-10-release-candidate-1.html delete mode 100644 _posts/2012-09-03-introducing-qubes-10.html delete mode 100644 _posts/2012-09-12-how-is-qubes-os-different-from.html delete mode 100644 _posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html delete mode 100644 _posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html delete mode 100644 _posts/2013-02-28-qubes-2-beta-2-has-been-released.html delete mode 100644 _posts/2013-03-21-introducing-qubes-odyssey-framework.html delete mode 100644 _posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html delete mode 100644 _posts/2013-08-30-thoughts-on-intels-upcoming-software.html delete mode 100644 _posts/2013-09-23-thoughts-on-intels-upcoming-software.html delete mode 100644 _posts/2013-11-26-windows-7-seamless-gui-integration.html delete mode 100644 _posts/2013-12-11-qubes-r2-beta-3-has-been-released.html delete mode 100644 _posts/2014-01-16-shattering-myths-of-windows-security.html delete mode 100644 _posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html delete mode 100644 _posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html delete mode 100644 _posts/2014-08-26-physical-separation-vs-software.html delete mode 100644 _posts/2014-09-26-announcing-qubes-os-release-2.html delete mode 100644 _posts/2014-11-27-qubes-r3odyssey-initial-source-code.html delete mode 100644 _posts/2015-02-09-my-new-git-based-blog.md delete mode 100644 _posts/2015-04-23-qubes-30rc1-and-roadmap.md delete mode 100644 _posts/2015-06-04-otf-funding-announcement.md rename _posts/{2015-07-10-caspar.md => 2015-08-19-HelloWorld.md} (100%) diff --git a/_posts/2006-05-12-svv-source-code-made-public.html b/_posts/2006-05-12-svv-source-code-made-public.html deleted file mode 100644 index b573e6a..0000000 --- a/_posts/2006-05-12-svv-source-code-made-public.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: SVV Source Code Made Public! -date: '2006-05-12T09:13:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:18.060+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-114741804664138609 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/05/svv-source-code-made-public.html ---- - -I decided to publish the full source code of my System Virginity Verifier. The license grants you to do anything with the code, including using it in a commercial product.

Unfortunately I don't have time to further develop SVV, but I still believe that this is the right approach for system compromise detection (which still requires lots of work to be put into it though). It's actually very surprising for me to see only one another product which uses similar idea for detecting system compromises, that is Microsoft's Patch Guard.

I hope that publishing SVV source code might be useful in two situations:

First, it should help to reduce implementation specific attacks, as used by malware against rootkit detectors (remember holly_father's shop?). Having the sources allows anybody to compile his or her own private detector, a little bit different from the one which is targeted by malware's anti-detection engine. This might include changing I/O interface between usermode and kernel mode component of the detector, changing the order of certain actions, etc...

The above statement applies actually not only to SVV, but to any other rootkit/malware detector with open sources.

Second, I hope that having SVV sources opened can encourage people to extend the subset of the sensitive OS elements which are verified by SVV, thus minimizing the "hooking space" which can be used by malware. This should consequently eliminate simple, yet annoying malware from the market...

SVV sources and some presentations about its design can be found here. \ No newline at end of file diff --git a/_posts/2006-05-17-confidence-2006-trip-report.html b/_posts/2006-05-17-confidence-2006-trip-report.html deleted file mode 100644 index 46a8020..0000000 --- a/_posts/2006-05-17-confidence-2006-trip-report.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: CONFidence 2006 - trip report -date: '2006-05-17T11:36:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:32.382+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-114785969931002588 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/05/confidence-2006-trip-report.html ---- - -I've just come back from a small conference in Krakow, CONFidence 2006. It was the second edition of this security conference, which is organized by a non-profit organization, PROIDEA, whose primary goal is to promote education in computer science. Apart from CONFidence, they also organize conferences focused on BSD systems and various training courses.

Below I describe some of the talks that I found particularly interesting among those which I managed to see...

Pawel Pokrywka gave a very interesting talk about security issues with DSL infrastructure as used by one of the biggest polish ISP. He discovered the auto-configuration protocol which is used to setup every single DSL modem of that company. He then prepared modem-emulator script which allowed him to get the configuration data (including username and password) for any modem in Poland he wanted. This could allowed an attacker to actually 0wn all the DSL modems belonging to this operator! It was the best presentation in my opinion, not only it was technically interesting, but also was very well presented.

Lukasz Bromirski is a system engineer in Cisco Poland and is a very popular speaker at polish conferences. He gave three (!) lectures there, about BGP Blackholing, Dynamic Routing Protocols (OSPF and BGP) and one more about network attacks on L2 and L3 levels. Lukasz turned out as a very knowledgeable and experienced network engineer who is also a good presenter.

Przemyslaw Frasunek is another frequent speaker at Polish conferences. He is a well known BSD expert, but his talk was about Bluetooth security. Although it wasn't kind of an '0day talk', I think it was a good introduction to Blootooth stack and several basic attacks and was very professionally presented.

I also liked the two talks presented by the members of the Security Team of Supercomputer-Network Center in Poznan. Blazej Miga talked very deeply about Apache architecture and internals, while Jaroslaw Sajko demoed how to write extension modules for IPTables. This team got lots of media attention in Poland last year, after they found several critical bugs in Gadu-Gadu, the most popular Polish IM communicator.

Overall, level of the talks was pretty good. Similarly like on other small conferences, the atmosphere was very cozy and friendly. Organizers took very good care of the speakers, taking us to various nice restaurants and entertaining all the time (even the day after the conference). Krakow is actually a very nice city, probably one of the nicest in Poland. It is a little bit like Prague - it has a very large old town, with lots of nicely decorated restaurants (in an 'old polish' style) serving very tasty food :)

It was also very positive to see how enthusiastic those people are and it was clear to me that they really do this conference for fun and not for profit. I wish them success with the next edition in 2007! \ No newline at end of file diff --git a/_posts/2006-06-22-introducing-blue-pill.html b/_posts/2006-06-22-introducing-blue-pill.html deleted file mode 100644 index 80ae863..0000000 --- a/_posts/2006-06-22-introducing-blue-pill.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Blue Pill -date: '2006-06-22T13:05:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:43.337+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115089716989100803 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html ---- - -All the current rootkits and backdoors, which I am aware of, are based on a concept. For example: FU was based on an idea of unlinking EPROCESS blocks from the kernel list of active processes, Shadow Walker was based on a concept of hooking the page fault handler and marking some pages as invalid, deepdoor on changing some fields in NDIS data structure, etc... Once you know the concept you can (at least theoretically) detect the given rootkit.

Now, imagine a malware (e.g. a network backdoor, keylogger, etc...) whose capabilities to remain undetectable do not rely on obscurity of the concept. Malware, which could not be detected even though its algorithm (concept) is publicly known. Let's go further and imagine that even its code could be made public, but still there would be no way for detecting that this creature is running on our machines...

Over the past few months I have been working on a technology code-named Blue Pill, which is just about that - creating 100% undetectable malware, which is not based on an obscure concept.

The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices, like graphics card, are fully accessible to the operating system, which is now executing inside virtual machine. This is all possible thanks to the latest virtualization technology from AMD called SVM/Pacifica.

How does the Blue Pill-based malware relates to SubVirt rootkit, presented a few months ago by Microsoft Research and University of Michigan? Well, there are couple of important differences:
  1. SubVirt is a permanent (i.e. restart surviving) rootkit. And it has to be, because the SubVirt's installation process requires that it takes control before the original operating system boots. Consequently, in contrast to Blue Pill, SubVirt can not be installed 'on-the-fly'. It also means that SubVirt must introduce some modifications to hard disk, which allows for the 'off line' detection.

  2. SubVirt was implemented on x86 hardware, which doesn't allow to achieve 100% virtualization, because there are number of sensitive instructions, which are not privileged, like the famous SIDT/SGDT/SLDT. This allows for trivial detection of the virtual mode - see e.g. my little Red Pill program. This however, doesn't apply to Blue Pill, as it relies on AMD SVM technology.

  3. SubVirt is based on one of the commercial VMM: Virtual PC and/or VMWare. Both of these applications create virtual devices to be used by the operating system, which are different from the real underlying hardware (e.g. network cards, graphic cards, etc.), which allows for easy detection of the virtual machine.

I would like to make it clear, that the Blue Pill technology does not rely on any bug of the underlying operating system. I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform.

I will be talking about Blue Pill and demonstrating a working prototype for Vista x64 at the end of July at SyScan Conference in Singapore.

Also, I will present a generic method (i.e. not relaying on any implementation bug) of how to insert arbitrary code into the Vista Beta 2 kernel (x64 edition), thus effectively bypassing the (in)famous Vista policy for allowing only digitally singed code to be loaded into kernel. Of course, the presented attack does not require system reboot. \ No newline at end of file diff --git a/_posts/2006-07-01-blue-pill-hype.html b/_posts/2006-07-01-blue-pill-hype.html deleted file mode 100644 index e60e132..0000000 --- a/_posts/2006-07-01-blue-pill-hype.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Blue Pill Hype -date: '2006-07-01T12:27:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:23:20.664+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115175064263272833 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/07/blue-pill-hype.html ---- - -All the hype started from this article in eWeek by Ryan Naraine... The article is mostly accurate, despite one detail - the tile, which is a little misleading... It suggests that I already implemented "a prototype of Blue Pill which creates 100% undetectable malware", which is not true. Should this be true, I would not call my implementation "a prototype", which suggests some early stage of product.

That being said, I sincerely believe that Blue Pill technology will (very soon) allow for creating 100% undetectable malware, which is not based on obscurity of the concept. And I already stressed this in the description of my talk here and here. The working prototype I have (and which I will be demonstrating at SyScan and Black Hat) implements the most important step towards creating such malware, namely it allows to move the underlying operating system, on the fly, into a secure virtual machine.

The phrase "on the fly" is the most important thing about Blue Pill - it makes it possible to install a blue pill based malware without restarting the system and without any BIOS or boot sector modifications. I wish all those people who were posting about how easy it would be to detect Blue Pill by booting a system from a clean CD, spent more time on reading my original blog article, instead creating useless posts... (just a little wish).

The Blue Pill prototype I currently have is not yet complete, but this is not that important, because having successfully moved the OS into a virtual machine, implementing all the other features is just a matter of following the Pacifica specification. And I will repeat my statement again: I believe the malware based on a fully implemented Blue Pill will be 100% undetectable, provided that Pacifica is not "buggy". 100% undetectable in practice - I should add - as I'm aware of some theoretical brute force attacks, which I however do not consider as being practical and that they could be used in the future anywhere outside the lab. It should be undetectable, even if the malware code was made available to the opponent (e.g. AV company).

There are number of ways of how Blue Pill could be exploited to create the actual malware (Blue Pill itself is just a "hijacking technology", not a malware) and I will be showing a simple example of how it could be used to create a network backdoor on Vista x64.

What happens when you install Blue Pill on a machine which is already Blue Pilled? Should future OS come with own, preinstalled hypervisor to prevent Blue Pill installation? What about timing analysis? All those questions will be answered during my presentation - please do not send or post the same questions again and again...

That all being said, I don't think the title in the eWeek article was too much exaggerated, but I just wanted to clarify the things. After all, it was very positive, IMO, that the article attracted lots of attention, because I believe that hardware virtualization technology could become one of the biggest threat in the coming years (i.e. when more people will use processors with hardware virtualization support) and if we do not do anything about it. Can we do anything? I believe we can, but first we need to understand the threat.

One more thing should be commented. Some people suggested that my work is sponsored by Intel as I focused on AMD virtualization technolgy only. They should know then, that my work was sponsored exclusively by COSEINC Research and not by Intel. I implemented Blue Pill on AMD64 just because my previous research (also done for COSEINC) were focusing on Vista x64 and the natural choice of the processor for this was AMD64. And, although I wish I had more time to also try implementing Blue Pill on Intel VT, unfortunately I don't :( Accusing myslef of doing this on one processor only, instead on both AMD and Intel, is like saying that all vulnerability researches who find holes inside open source programs are paid by Microsoft ;) This is just ridicules! \ No newline at end of file diff --git a/_posts/2006-08-12-blue-pill-detection.html b/_posts/2006-08-12-blue-pill-detection.html deleted file mode 100644 index ff44054..0000000 --- a/_posts/2006-08-12-blue-pill-detection.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Blue Pill Detection! -date: '2006-08-12T17:40:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:56.432+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115539746366601437 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/08/blue-pill-detection.html ---- - -So, after I presented the idea behind Blue Pill at SyScan and Black Hat, some people started talking how *easy* it should be do detect Blue Pill using timing analysis. Interestingly they must have missed the fact that I already discussed this way of detection during my presentations and I also gave the reasons why I don't think it could be used in practice...

But anyway, let's look at the problem again...

Obviously, Blue Pill, like any other hardware based VMM, needs to intercept some events and instructions. One intercept which we need to take care of (in case of SVM technology), is the RDMSR EFER instruction - just because the bit 12th in EFER register signalizes weather processor works in SVM mode or not. So, we need to cheat about it to the guest.

Now, we can measure how many processor 'tics' the given instruction took to execute - all we need to do is to use a RDTSC instruction, which returns the processor's time stamp counter. So I did the measuring and it turned out that normally it takes around 90 ticks to execute RDMSR, while on a 'bluepilled' system it takes about 2100 tics. What a big difference you will say!

But SVM technology (and Intel VT-x also) offers a nice way to cheat the guest about those extra tics, by adjusting a special variable in VMCB, called TSC_OFFSET (in that case we would set this value to something around -2010, just before returning to the guest). As a result, guest can not realize that the RDMSR instruction took extra ticks, by using RDTSC instruction.

So, here's what we need to do: we need to prepare a test piece of code, which would involve calling e.g. RDMSR instruction something like a few millions of times and observer the timing using *external* clock (yes, VMM can also cheat about the internal real time clock). This external clock can also be a human being (=user). For example the detector could display a message to the user:

"Dear user, I'm going to run a test now; if this test took more then 1 minute, that would mean your computer is probably compromised with a VMM based malware. Press OK to continue..."

The first problem with this approach is how to generate a piece of code, which would execute for exactly 1 minute (or any other given amount of time) on a native machine, taking into account that we may have many different processor models, working with many different speeds, etc... One can say, that we can probe the processor speed, using some test instructions which we know for sure that are not intercepted (most of the instructions). But this is problematic, since the hypervisor can cheat as to how many tics those instructions took to execute (as RDTSC can be intercepted itself). Of course this is trivial, when we assume that we can run our detector before and after infection, but this is not the case in most practical scenarios. So, I don't know how to solve this problem (which doesn't mean it can't be solved though)... Any suggestions welcomed.

Without solving the above problem, we're facing a problem of false positives and negatives. Consider that the test above took 5 minutes (instead of one) - now does that mean that we took a too big testing code (because guest were cheated during calibration) and that the very processor just had to spent 5 minutes executing it or was this a sign of an infection - it's just that on a new processor model maybe the RDMSR interception slowdown would be of a factor of 5 instead of 20 as it's with the processor I have right now. And if it was 15 minutes?

Currently this is not a big problem, just because there are only two models of AMD processors supporting SVM on the market and each is available with few different clock speeds. So, we can probably hardcode the testing code into our detector (because the slowdown is so big). But how the situation will change during the next two years, when there will be much more processors supporting hardware virtualization on the market? We would have to have a database of processor models and how much test code we need to use on each of them. (oh btw, and how detector could detect on which model it's running? You bet, using a CPUID instruction, which can be intercepted...)

And still, even if we solved this problem, still this kind of detection would be annoying to users (imagine a user being forced to do this kind of "1-minute test", or even 10sec test, every 15 minutes or so) unless we used some kind of infrastructure providing external time measurement (can't be just public NTP, because NTP packets could be easily intercepted by the malware). So, we would need to setup encrypted NTP servers in each company... Ah great!

So, I find it quite surprising that some people diminish the threat introduced by hardware virtualization based malware. I would like to point out that it's somewhat ridicules situation, when the malware can be reliably written using perfectly documented features of the processor, while we need to do some timing based tricks to detect it :) Are we switching roles with malware writers?

What we need is a reliable detector, something which would return 0 or 1 depending whether we're inside a VM or not. And I really don't see how we can create such a program (i.e. a standalone generic detector).

For completeness, I should also mention, just as I did during my talks, that we're aware of another attack against Blue Pill which should be very reliable and that can be implemented as a standalone program, but unfortunately it seems to allow only for crashing the system when it's 'bluepilled'. This nice attack has been independently proposed by Alex Tereshkin and Oded Horowitz, BTW.

Some people talked about prevention... Can we disable virtualization in BIOS? I can't do it on my AMD machine - but I heard that vendors are going to release updates to allow for that. But, come on, this is not a good way to address this threat! It's better not to buy the processors supporting hardware virtualization!

One more thing - as I'm being continually asked about this - yes, it is possible to create a similar malware to Blue Pill using Intel VT-x, just like it was demonstrated by Dino Dai Zovi at Black Hat a week ago. \ No newline at end of file diff --git a/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html b/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html deleted file mode 100644 index d2dcb42..0000000 --- a/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista RC1 still vulnerable to the pagefile attack -date: '2006-09-13T18:21:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:46.939+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115816512027277537 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/09/vista-rc1-still-vulnerable-to-pagefile.html ---- - -Everybody talks now about the latest Vista RC1 and how ready it is for being shipped to customers. So, I downloaded Vista RC1, Build 5600, x64 edition from MSDN a couple of days ago and gave it a try... To my surprise, it turned out that it's still vulnerable to the signature check bypass attack which I demonstrated nearly 2 months ago at the SyScan conference...

This is not good, because, on the one hand, Vista requires all kernel drivers to be digitally signed (for security reasons), which, in turn requires that all driver developers get (read: buy) an appropriate signing certificate, but on the other hand, malware authors can load their code into kernel for free (without reboot, as I demoed during the talk).

The requirement for having all kernel drivers digitally signed raised a lot of controversy when it was announced by Microsoft in January. People argued not only about the fact that paying for a certificate might be unacceptable for e.g. students or open source authors, but also about more "philosophical" aspect that it should be the user's (administrator's) right to load whatever she wants on her own computer, regardless whether somebody has signed it or not.

Personally, I think that it's worth to sacrifice a little bit of "freedom" and to spend a few hundred bucks on a certificate in case you're a kernel developer, if this can stop kernel malware from loading. Even though kernel protection can be implemented without PKI, as we can see in case of BSD systems and their securelevel mechanism (although an attack has been presented against it a few months ago), I still think that a scheme based on digital signatures is the best solution for end-users. However, it's definitely not worth to sacrifice that all, if there is a known way for bypassing this mechanism... :(

It's quite surprising for me that MS still hasn't fixed that problem, especially that the best solution here is also the simplest one to implement. As I described during my talk, it's just enough to... disable kernel mode memory paging. Surly, it would cause a little waste of memory, but according to some Microsoft engineers I spoke to, it would be only around 80MB. This seems very little these days, doesn't it? After all, are people going to run Vista with 256MB or even 512MB of RAM? I'm not ;)

Another good solution (and I think it was Brad Spengler of grsecurity who pointed that out to me) would be to calculate a hash for each page which is going to be paged out and then check this hash again on each page which is about to be loaded into memory again. Not that simple as the previous solution, but at least we're saving those 80MB of physical memory :) \ No newline at end of file diff --git a/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html b/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html deleted file mode 100644 index 608f8be..0000000 --- a/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista RC2 vs. pagefile attack (and some thoughts about Patch Guard) -date: '2006-10-19T22:59:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:37.830+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-116129259996478986 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/10/vista-rc2-vs-pagefile-attack-and-some.html ---- - -Eventually, after I got back home from some traveling, I had a chance to download Vista RC2 x64 and test it against the pagefile attack...

It quickly turned out that our exploit doesn’t work anymore! The reason: Vista RC2 now blocks write-access to raw disk sectors for user mode applications, even if they are executed with elevated administrative rights.

In my Subverting Vista Kernel speech, which I gave at several major conferences over the past few months, I discussed three possible solutions to mitigate the pagefile attack. Just to remind you, the solutions mentioned were the following:
1. Block raw disk access from usermode.
2. Encrypt pagefile (alternatively, use hashing to ensure the integrity of paged out pages, as it was suggested by Elad Efrat from NetBSD).
3. Disable kernel mode paging (sacrificing probably around 80MB of memory in the worst case).

And I also made a clear statement that solution #1 is actually something which is a bad idea. I explained that if MS decided to disable write-access to raw disk sectors from usermode, not only that might cause some incompatibility problems (think about all those disk editors, un-deleters, etc…), but also that would not be a real solution to the problem…

Imagine a company wanting to release e.g. a disk editor. Now, with the blocked write access to raw disk sectors from usermode, the company would have to provide their own custom, but 100% legal, kernel driver for allowing their, again 100% legal, application (disk editor), to access those disk sectors, right? Of course, the disk editor's auxiliary driver would have to be signed – after all it’s a legal driver, designed for legal purposes and ideally having neither implementation nor design bugs! But, on the other hand, there is nothing which could stop an attacker from “borrowing” such a signed driver and using it to perform the pagefile attack. The point here is, again, there is no bug in the driver, so there is no reason for revoking a signature of the driver. Even if we discovered that such driver is actually used by some people to conduct the attack!

But it seems that MS actually decided to ignore those suggestions and implemented the easiest solution, ignoring the fact that it really doesn’t solve the problem…

Actually, if we weren't such nice guys, we could develop a disk editor together with a raw-disk-access kernel driver, then sign it and post it on COSEINC's website. But we're the good guys, so I guess somebody else will have to do that instead ;)

Kernel Protection vs. Kernel Patch Protection (Patch Guard)


Another thing - lots of people confuse kernel protection (i.e. the policy for allowing only digitally signed kernel drivers to be loaded) with Kernel Patch Protection, also known as Patch Guard.

In short, pagefile attack, which I demoed at SyScan/BackHat is a way to load unsigned code into kernel, thus it’s a way to bypass Vista kernel protection. Bypassing kernel patch protection (Patch Guard) is a different story. E.g. Blue Pill, a piece of malware which abuses AMD Pacifica hardware virtualization, which I also demoed during my talk, “bypasses” PG. The word “bypass” is a little bit misleading here though, as the BP does not make any special effort to disable or bypass PG explicitly, it simply doesn’t care about PG, because it’s located above (or below, depending on where your eyes are located) the whole operating system, including PG. Yes, it’s that simple :)

Also, almost any malware of type II (see my BH Federal talk for details about this malware classification) is capable of “bypassing” PG, simply because PG is not designed to detect changes introduced by type II malware. So, e.g. deepdoor, backdoor which I demonstrated in January at BH Federal, is undetectable by PG. Again, not a big deal – it’s just that PG was not designed to detect type II malware (nor type III, like BP). So, I'm a little bit surprised to hear people talking about "how hard would it be to bypass PG...", as that is something which has been done already (and I'm not referring to Metasploit's explicit technique here) - you just need to design your malware as type II or type III and your done!

But even that all being said, I still think that PG is actually a very good idea. PG should not be thought as of a direct security feature. PG's main task is to keep legal programs from acting like popular rootkits. Keeping malware away is not it's main task. However, by ensuring that legal applications do not introduce rootkit-like tricks, PG makes it easier and more effective to create robust malware detection tools.

I spent a few years developing various rootkit detection tools and one of the biggest problems I came across was how to distinguish between a hooking introduced by a real malware and... a hooking introduced by some A/V products like personal firewalls and Host IDS/IPS programs. Many of the well known A/V products do use exactly the same hooking techniques as some popular malware, like rootkits! This is not good, not only because it may have potential impact on system stability, but, and this is the most important thing IMO, it confuses malware detection tools.

Patch Guard, the technology introduced in 64 bit versions of Windows XP and 2003 (yes, PG is not a new thing in Vista!) is a radical, but probably the only one, way to force software vendors to not use undocumented hooking in their products. Needles to say, there are other, documented ways to implement e.g. a personal firewall or an A/V monitor, without using those undocumented hooking techniques.

Just my 2 cents to the ongoing battle for Vista kernel... \ No newline at end of file diff --git a/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html b/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html deleted file mode 100644 index 5558c3a..0000000 --- a/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Stealth Malware Taxonomy -date: '2006-11-24T13:18:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:27.755+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6550140885713843724 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/11/introducing-stealth-malware-taxonomy.html ---- - -

At the beginning of this year, at Black Hat Federal Conference, I proposed a simple taxonomy that could be used to classify stealth malware according to how it interacts with the operating system. Since that time I have often referred to this classification as I think it is very useful in designing system integrity verification tools and to talk about malware in general. Now I decided to explain this classification a bit more as well as extend it of a new type of malware - the type III malware.

The article is available as a PDF document here.



\ No newline at end of file diff --git a/_posts/2007-01-03-towards-verifiable-operating-systems.html b/_posts/2007-01-03-towards-verifiable-operating-systems.html deleted file mode 100644 index b8b0c60..0000000 --- a/_posts/2007-01-03-towards-verifiable-operating-systems.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Towards Verifiable Operating Systems -date: '2007-01-03T17:43:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:17.830+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-208658744926357906 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/01/towards-verifiable-operating-systems.html ---- - -Last week I gave a presentation at the 23rd Chaos Communication Congress in Berlin. Originally the presentation was supposed to be titled "Stealth malware - can good guys win?", but in the very last moment I decided to redesign it completely and gave it a new title: "Fighting Stealth Malware – Towards Verifiable OSes". You can download it from here.

The presentation first debunks The 4 Myths About Stealth Malware Fighting that surprisingly many people believe in. Then my stealth malware classification is briefly described, presenting the malware of type 0, I and II and challenges with their detection (mainly with type II). Finally I talk about what changes into the OS design are needed to make our systems verifiable. If the OS were designed in such a way, then detection of type I and type II malware would be a trivial task...

There are only four requirements that an OS must satisfy to become easily verifiable, these are:
  1. The underlying processors must support non-executable attribute on a per-page level,

  2. OS design must maintain strong code and data separation on a per-page level (this could be first only in kernel and later might be extended to include sensitive applications),

  3. All code sections should be verifiable on a per-page level (usually this means some signing or hashing scheme implemented),

  4. OS must allow to safely read physical memory by a 3rd party application (kernel driver/module) and for each page allow for reliable determination whether it is executable or not.

The first three requirements are becoming more and more popular these days in various operating systems, as a side effect of introducing anti-exploitation/anti-malware technologies (which is a good thing, BTW). However, the 4th requirement presents a big challenge and it is not clear now whether it would be feasible on some architectures.

Still, I think that it's possible to redesign our systems in order to make them verifiable. If we don't do that, then we will always have to rely on a bunch of "hacks" to check for some known rootktis and we will be taking part in endless arm race with the bad guys. On the other hand, such situation is very convenient for the security vendors, as they can always improve their "Advanced Rootkit Detection Technology" and sell some updates... ;)

Happy New Year! \ No newline at end of file diff --git a/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html b/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html deleted file mode 100644 index ed62758..0000000 --- a/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Beyond The CPU: Cheating Hardware Based RAM Forensics' -date: '2007-01-20T13:13:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:58.721+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/RbISDXtmzMI/AAAAAAAAAAk/TlmnJhxXJcs/s72-c/green-board-small.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1453328084371931288 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/01/beyond-cpu-cheating-hardware-based-ram.html ---- - -
We all know that any software-based system compromise detector can always be cheated if malware runs at the same privilege level as the detector (usually both run in kernel mode). This is what I call Implementation Specific Attacks (ISA). Because of that, mankind has tried to find some better, more reliable ways for analyzing systems, which would not be subject to interference from malware…

And we all know what we’ve come up with as a solution – hardware based devices for obtaining the image of volatile memory (RAM), usually in the form of a PCI card. As far as the PC architecture is concerned, probably the first two papers in this area are those about Tribble and CoPilot. As an alternative to expensive dedicated PCI cards, one can also use a FireWire bus, as it has been described by Maximillian Dornseif at el., and later by Adam Boileau.

The point is: once we get the memory image, we can analyze it for signs of compromises on a trusted machine or we can have the PCI device to do some checks itself (like e.g. CoPilot does).

The whole idea behind hardware based RAM acquisition is that the process of reading the memory is using Direct Memory Access (DMA) to read the physical memory. DMA, as the name suggests, does not involve CPU in the process of accessing memory. So, it seems to be a very reliable way for reading the physical memory…

But it is not! At least in some cases...

Next month, at Black Hat DC, I will be demonstrating how to cheat hardware based memory acquisition on AMD based systems. In other words, I will be showing that the image obtained using DMA, can be made different from the real contents of the physical memory as seen by the CPU. Even though the attack is AMD-specific, it does not rely on virtualization extensions. Also, the attack does not require system reboot. Nor does it require soldering ;)

I have tested my proof-of-concept code against a FireWire-based method of memory acquisition, using tools from Adam Boileau’s presentation.

I wanted to test it also against some PCI cards, but it turned out, that for an ordinary mortal person like myself, it is virtually impossible to buy a sample of a dedicated PCI card for memory acquisition… E.g. the Tribble card is still unavailable for sale, according to its author, even though the prototype has been build in 2003... BBN, the US company known for doing lots of project for the US government, apparently has a prototype (see page 45) of something similar to Tribble, but is not willing to discuss any details with somebody who is not involved in a project with the US government... Finally, Komoku Inc., whose main customers, according to the website, are also US government agencies, also rejected my inquiry for buying a sample of CoPilot, claiming that the device "is not generally available right now" ;)

Anyway, even though I was able to test the attack only against FireWire based method, I’m pretty confident that it will work against all other devices which use DMA to access the physical memory, as the attack itself is very generic.

See you in DC! \ No newline at end of file diff --git a/_posts/2007-02-04-running-vista-every-day.html b/_posts/2007-02-04-running-vista-every-day.html deleted file mode 100644 index e97ea65..0000000 --- a/_posts/2007-02-04-running-vista-every-day.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Running Vista Every Day! -date: '2007-02-04T13:36:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:47.393+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/RcUuTcXM6CI/AAAAAAAAAA4/HvaLpzY_qUA/s72-c/UAC+-+disable+installations+detection+.bmp -blogger_id: tag:blogger.com,1999:blog-24586388.post-6447067375460891914 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/running-vista-every-day.html ---- - -More then a month ago I have installed Vista RTM on my primary laptop (x86 machine) and have been running it since that time almost every day. Below are some of my reflections about the new security model introduced in Vista, its limitations, a few flaws and some practical info about how I configured my system.

UAC – The Good and The Bad

User Account Control (UAC) is a new security mechanism introduced in Vista, whose primary goal is to force users to work using restricted accounts, instead working as administrators. This is, in my opinion the most important security mechanism introduced in Vista. That doesn’t mean it can not be bypassed in many ways (due to implementation flaws), but just the fact that such a design change has been made into Windows is, without doubt, a great step towards securing consumer OSes.

When UAC is active (which is a default setting) even when user logs in as an administrator, most of her programs run as restricted processes, i.e. they have only some very limited subset of privileges in their process token. Also, they run at, so called, Medium integrity level, which, among other things, should prevent those applications from interacting with higher integrity level processes via Window messages. This mechanism also got a nice marketing acronym, UIPI, which stands for User Interface Privilege Isolation. Once the system determines that a given program (or a given action) requires administrative privileges, because e.g. the user wants to change system time, it displays a consent window to the user, asking her whether she really wants to proceed. In case the user logged in as a normal user (i.e. the account does not belong to the Administrators group), then the user is also asked to enter password for the one of the administrator's accounts. You can find more background information about UAC, e.g. at this page.

Many people complain about UAC, saying that it’s very annoying for them to see UAC consent dialog box to appear every few minutes or so, and claim that this will discourage users from using this mechanism at all (and yes, there’s an option to disable UAC). I strongly disagree with such opinion - I’ve been running Vista more then a month now and, besides the first few days when I was installing various applications, I now do not see UAC prompt more then 1-2 times per day. So, I really wonder what those people are doing that they see UAC constantly appearing every other minute…

One thing that I found particularly annoying though, is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges. So, when you try to run such a program, you get a UAC prompt and you have only two choices: either to agree to run this application as administrator or to disallow running it at all. That means that if you downloaded some freeware Tetris game, you will have to run its installer as administrator, giving it not only full access to all your file system and registry, but also allowing e.g. to load kernel drivers! Why Tetris installer should be allowed to load kernel drivers?

How Vista recognizes installer executables? It has a compatibility database as well as uses several heuristics to do that, e.g. if the file name contains the string “setup” (Really, I’m not kidding!). Finally it looks at the executable’s manifest and most of the modern installers are expected to have such manifest embedded, which may indicate that the executable should be run as administrator.

To get around this problem, e.g. on XP, I would normally just add appropriate permissions to my normal (restricted) user account, in such a way that this account would be ale to add new directories under C:\Program Files and to add new keys under HKLM\Software (in most cases this is just enough), but still would not be able to modify any global files nor registry keys nor, heaven forbid, to load drivers. More paranoid people could chose to create a separate account, called e.g. installer and use it to install most of the applications. Of course, the real life is not that beautiful and you sometimes need to play a bit with regmon to tweak the permissions, but, in general it works for majority of applications and I have been successfully using this approach for years now on my XP box.

That approach would not work on Vista, because every time Vista detects that an executable is a setup program (and believe me Vista is really good at doing this), it will only allow running it as administrator… Even though it’s possible to disable heuristics-based installer detection via local policy settings – see picture below:



that doesn’t seem to work for those installer executables which have embedded manifest saying that they should be run as administrator.

I see the above limitation as a very severe hole in the design of UAC. After all, I would like to be offered a choice whether to fully trust given installer executable (and run it as full administrator) or just allow it to add a folder in C:\Program Files and some keys under HKLM\Software and do nothing more. I could do that under XP, but apparently I can’t under Vista, which is a bit disturbing (unless I’m missing some secret option to change that behavior).

Integrity Levels – Protect the OS but not your data!

Integrity Levels (IL) mechanism has been introduced to help implementing UAC. This mechanism is very simple – every process can be assigned one of the four possible integrity levels:

• Low
• Medium
• High
• System

Similarly, every securable object in the system, like e.g. a directory, file or registry key, can also be assigned an integrity level. Integrity level is nothing else then just an ACE of a special type assigned to the SACL list. If there’s no such ACE at all, then the integrity level of the object is assumed to be Medium. You can use icacls command to see integrity levels on file system objects:
C:\>icacls \Users\joanna\AppData\LocalLow
\Users\joanna\AppData\LocalLow silverose\joanna:(F)
silverose\joanna:(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(F)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
Mandatory Label\Low Mandatory Level:(OI)(CI)(NW)
BTW, I don’t know any tool/command to see and modify integrity levels assigned to registry keys (I think I know how to do this in C though). Anybody?

Now, the whole concept behind IL is that a process can only get write-access to those objects which have the same or lower integrity level then the process itself.

Update (March 5th, 2007): This is the default behavior of IL and is indicated by the “(NW)” symbol on the picture above, which stands for NoWriteUp policy. I have just learned that one can use the chml tool by Mark Minasi to set also a different policy, i.e. NoReadUp (NR) or NoExecuteUp (NX), which would result that IL mechanism will not allow a lower integrity process to read or execute the objects marked with higher IL. See also my recent post about this tool.

UAC is implemented using IL – even if you log in as administrator, all your processes (like e.g. explorer.exe) run with Medium IL. Once you elevated to the “real admin” your process runs at High IL. System processes, like e.g. services, runs at System IL. From the security point of view High IL seems to be equivalent to System IL, because once you are allowed to execute code at High IL you can compromise the whole system.

Internet Explorer’s protected mode is implemented using the IL mechanism. The iexplore.exe process runs at Low IL and, in a system with default configuration, can only write to %USERPROFILE%\AppData\LocalLow and HKCU\Software\AppDataLow because all other objects have higher ILs (usually Medium).

If you don’t like surfing using IE, you can very easily setup your Firefox (or other browser of your choice) to run as Low integrity process (here we assume that Firefox user’s profile is in j:\config\firefox-profile):
C:\Program Files\Mozilla Firefox>icacls firefox.exe /setintegritylevel low
J:\config>icacls firefox-profile /setintegritylevel (OI)(CI)low
Because firefox.exe is now marked as a Low integrity file, Vista will also create a Low integrity process from this file, unless you are going to start this executable from a High integrity process (e.g. elevated command prompt). Also, if you, for some reason (see below), wanted to use runas or psexec to start a Low integrity process, it won’t work and will start the process as Medium, regardless that the executable is marked as Low integrity.

It should be stressed that IL, by default, protects only against modifications of higher integrity objects. It’s perfectly ok for the Low IL process to read e.g. files, even if they are marked as Medium or High IL. In other words, if somebody exploits IE running in Protected Mode (at Low IL), she will be able to read (i.e. steal) all user’s data.

This is not an implementation bug, this is a design decision and it’s cleverly called the “read-up policy”. If we think about it for a while, it should become clear why Microsoft decided to do it that way. First, we should observe, that what Microsoft is most concerned about, is malware which permanently installs itself in the system and that could later be detected by some anti-malware programs. Microsoft doesn’t like it, because it’s the source of all the complains about how insecure Windows is and also the A/V companies can publish their statistics about how many percent of computers is compromised, etc… All in all, a very uncomfortable situation, not only for Microsoft but also for all those poor users, who now need to try all the various methods (read buy A/V programs) to remove the malware, instead just focus on their work…

On the other hand, imagine a reliable exploit (i.e. not crashing a target too often) which, after exploiting e.g. IE Protected Mode process, steals all the user’s DOC and XLS files, sends them back somewhere and afterwards disappears in an elegant fashion. Our user, busy with his every day work, does not even notice anything, so he can continue working undisturbed and focus on his real job. The A/V programs do not detect the exploit (why should they? – after all there’s no signature for it nor the shellcode uses any suspicious API) so they do not report the machine as infected – because, after all it’s not infected. So, the statistics look better and everybody is generally happier. Including the competition, who now has access to stolen data ;)

User Interface Privilege Isolation and some little Fun

UAC and Integrity Levels mechanism makes it possible for processes running with different ILs to share the same desktop. This raises potential security problem, because Windows implements a mechanism to allow one process to send a “window message”, like e.g. WM_SETTEXT, to another process. Moreover, some messages, like e.g. the infamous WM_TIMER, could be used the redirect execution flow of the target thread. This has been popular a few years ago in so called “Shatter Attacks”.

UIPI, introduced in Vista, is for the rescue. UIPI basically enforces the obvious policy that lower integrity processes can not send messages to higher integrity processes.

Interestingly, UIPI implementation is a bit “unfinished” I would say… For example, in contrast to design assumption, on my system at least, it is possible for the Low integrity process to send e.g. WM_KEYDOWN to e.g. open Administrative shell (cmd.exe) running at High IL and gets arbitrary commands executed.

One simple scenario of the attack is that a malicious program, running at Low IL, can wait for the user to open elevated command prompt – it can e.g. poll the open window handles e.g. every second or so (Window enumeration is allowed even at Low IL). Once it finds the window, it can send commands to execute… Probably not that cool as the recent “Vista Speech Exploit”, but still something to play with ;)

It’s my feeling that there are more holes in UAC, but I will leave finding them all as an exercise for the readers...

Do-It-Yourself: Implementing Privilege Separation

Because of the limitations of the UAC and IL mentioned above (i.e. the read-up policy), I decided to implement a little privilege-separation policy in my system. The first thing we need, is to create a few more accounts, each for a specific type of applications or tasks. E.g. I decided that I want a separate account to run my web browser, a different one for running my email client as well as IM client (which I occasionally run) and a whole other account to deal with my super-secret projects. And, of course, I need a main account, that is, the one which I will use to log in to the system. All in all, here is the list of all the accounts on my Vista laptop:

admin
joanna
joanna.web
joanna.email
joanna.sensitive

So, joanna is used to log into system (this is, BTW, a truly limited account, i.e. it doesn’t belong to the Administrators group) and Explorer and all applications like e.g. Picassa are started using this account. Firefox and Thunderbird run as joanna.web and joanna.email respectively. However, a little trick is needed here, if we want to start those applications as Low IL processes (and we want to do this, because we want UIPI to protect, at least in theory, other applications from web and mail clients if they got compromised somehow). As it was mentioned above, if one uses runas or psexec the created process will run as Medium IL, regardless the integrity level assigned to the executable. We can get around this, buy using this simple trick (note the nested quotations):
runas /user:joanna.web "cmd /c start \"c:\Program Files\Mozilla Firefox\firefox.exe\""
c:\tools\psexec -d -e -u joanna.web -p l33tp4ssw0rd "cmd" "/c start "c:\Program Files\Mozilla Firefox\firefox.exe""
Obviously, we also need to set appropriate ACLs on the directories containing Firefox and Thunderbird user’s profiles, so that each of those two users get full access to the respective directories as well as to a \tmp folder, used to store email attachments and downloaded files. No other personal files should be accessible to joanna.web and joanna.email.

Finally, being a paranoid person as I am, I have also a special user joanna.sensitive, which is the only one granted access to my \projects directory. It may come as a surprise, but I decided to make joanna.sensitve a member of the Administrators group. The reason for that is that I need to make all the applications which run as joanna.sensitve (e.g. gvim, cmd, Visual Studio, KeePass, etc) to have their UI isolated from all other normal applications, which run as joanna at Medium IL. It seems like the only way to start a processes at High IL is to make it part of the Administrators group and then use ‘Run As Administrator’ or runas command to start it.

That way we have the highly dangerous applications, like web browser or email client, run at Low IL and as very limited users (joanna.web and joanna.email), who have access only to the necessary profile directories (the restriction, this time, applies both to read- and write- accesses, because it’s enforced by normal ACLs on file system objects and not by IL mechanism). Then we have all other applications, like Explorer, various Office applications, etc. running as joanna at Medium IL and finally the most critical programs, those running as joanna.sensitve, like KeePass and those which get access to my \projects directory, they all run at High IL.

Thunderbird, GPG and Smart Cards

Even though the above configuration might look good, there’s still a problem with it I haven’t solved yet. The problem is related to mail encryption and how to isolate email client from my PGP private keys. I use Thunderbird together with Enigmail’s OpenPGP extension. The extension is just a wrapper around gpg.exe, a GnuPG implementation of PGP. When I open encrypted email, my Thunderbird processes spawns a new gpg.exe process and passes the passphrase to it as an argument. There are two alarming things here – first Thunderbird process needs to know my passphrase (in fact I enter it into a dialog box displayed by the Enigmail’s extension) and second, the gpg.exe process runs as the same user and at the same IL level as the thunderbird.exe process. So, if thunderbird.exe gets compromised, the malicious code executing inside thunderbird.exe will not only be able to get to know my passphrase, but will also be free to read my private key from disk (because it has the same rights as gpg.exe).

Theoretically it should be possible to solve the problem with passphrase stealing by using GPG Agent, which could run in the background as a service and gpg.exe would ask the agent for the passphrase instead asking thunderbird.exe process, which will never be in possession of the passphrase. Ignoring the fact that there doesn’t seem to be a working GPG Agent implementation for Win32 environment, this still is not a good solution, because thunderbird.exe still gets access to gpg.exe process, which is its own child after all – so it’s possible for thunderbird.exe to read the contents of gpg.exe memory and to find a decrypted PGP private key there.

It would help if GPG was implemented as a service running in the background and thunderbird.exe would only communicate with it using some sort of LPC to send request to encrypt, decrypt, sign and verify buffers. Unfortunately I’m not aware of such implementation, especially for Win32.

The only practical solution seems to be to use a Smart Card, which would perform all the
necessary crypto operations using its own processor. Unfortunately, GnuPG supports only, a so called, OpenPGP smart cards, but it seems that the only two cards which implements this standard (i.e. Fellowship card and the g10 card) implement only 1024 bits RSA keys, which is definitely not enough for even a moderately paranoid person ;)

In the last hope, I turned to commercial PGP, downloaded the trial of PGP Desktop and… it turned out that it doesn’t support Vista yet (what a shame, BTW).

So, for the time being I’m defenseless like a baby against all those mean people who would try to exploit my thunderbird.exe and steal my private PGP key :(

The forgotten part: Detection

One might think that it’s a pretty secure system configuration… Well, more precisely, it could be considered as pretty secure, if UIPI was not buggy and UAC didn’t force me to run random setup programs with full administrator rights and if GPG supported Smart Cards with RSA keys > 1024 (or alternatively PGP Desktop supported Vista). But let’s not be that scrupulous and forgot about those minor problems…

Still, even though that might look like a secure configuration, this is all just an illusion of security! The whole security of the system can be compromised if attacker finds and exploits e.g. a bug in kernel driver.

It should be noted that Microsoft has also implemented several anti-exploitation techniques in Vista, the two most advertised are Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). However, ASLR does not protect against local kernel exploitation, because it’s possible, even for the Low IL process, to query system about the list of loaded kernel modules together with their base addresses (using ZwQuerySystemInformation function). Also, hardware DEP, which works only on 64-bit processors, is not applied to the whole non-paged pool (as well as some other areas, but non-paged pool is the biggest one). In other words, the hardware NX bit is not set on all pages comprising the non-paged pool. BTW, there is a reason for Microsoft doing this and this is not due to compatibility issues (at least I believe so). I wonder who else can guess... ;)

UPDATE (see above): David Solomon, pointed out, that Hardware DEP is also available on many modern 32-bit processors (as the NX bit is implemented in PAE mode).

It’s very good that Microsoft implemented those anti-exploitation technologies (besides ASLR and NX, there are also some others). However the point is, they could be bypassed by a clever attacker under some circumstances. Now think about how many 3rd party kernel drivers are typically present in an average Windows systems – all those graphics card drivers, audio drivers, SATA drivers, A/V drivers, etc... and try answering the question how many possible bugs could be there? (BTW, it should be mentioned that Microsoft did a clever step by moving some classes of kernel drivers into user mode, like e.g. USB drivers – this is called UMDF).

When attacker successfully exploits kernel bug, then all the security scheme implemented by the OS is just worth nothing. So, what can we do? Well, we need to complement all those cool prevention technologies with effective detection technology. But has Microsoft done anything to make systematic detection possible? This is a rhetoric question of course and the negative answer applies unfortunately not only to Microsoft products but also to all other general purpose operating systems I’m aware of :(

My favorite quote of all those people who negate the value of detection is this: “once the system is compromised we can’t do anything!”. BS! Even though it might be true today – because the Operating System are not designed to be verifiable, but that doesn’t mean we can’t change this!

Bottom Line

Microsoft did a good job with securing Vista. They could do better, of course, but remember that Windows is a system for masses and also that they need to take care about compatibility issues, which sometimes can be a real pain. If you want to run Microsoft OS, then I believe that Vista is definitely a better choice then XP from a security standpoint. It has bugs, but which OS doesn't? What I wish for, is that they paid more attention to make their system verifiable...

Acknowledgements

I would like to thank John Lambert and Andrew Roths, both of Microsoft, for answering my questions about UAC design. \ No newline at end of file diff --git a/_posts/2007-02-12-vista-security-model-big-joke.html b/_posts/2007-02-12-vista-security-model-big-joke.html deleted file mode 100644 index a48607b..0000000 --- a/_posts/2007-02-12-vista-security-model-big-joke.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista Security Model – A Big Joke? -date: '2007-02-12T18:23:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:37.607+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6414764407112152883 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/vista-security-model-big-joke.html ---- - -[Update: if you came here from ZDNet or Slashdot - see the post about confusion above!]

Today I saw a new post at Mark Russinovich’s blog which I take as a response to my recent musings about Vista security features, where I pointed out several problems with UAC, like e.g. the attack that allows for a low integrity process to hijack the high integrity level command prompt. Those who read the whole article undoubtedly noticed that my overall opinion of vista security changes was still very positive – after all everybody can do mistakes and the fact UAC is not perfect, doesn’t diminish the fact that it’s a step into the right direction, i.e. implementing least-privilege policy in Windows OS.

However, I now read this post by Mark Russinovich (a Microsoft employee), which says:
"It should be clear then, that neither UAC elevations nor Protected Mode IE define new Windows security boundaries. Microsoft has been communicating this but I want to make sure that the point is clearly heard. Further, as Jim Allchin pointed out in his blog post Security Features vs Convenience, Vista makes tradeoffs between security and convenience, and both UAC and Protected Mode IE have design choices that required paths to be opened in the IL wall for application compatibility and ease of use."

And then we read:
"Because elevations and ILs don’t define a security boundary, potential avenues of attack, regardless of ease or scope, are not security bugs. So if you aren’t guaranteed that your elevated processes aren’t susceptible to compromise by those running at a lower IL, why did Windows Vista go to the trouble of introducing elevations and ILs? To get us to a world where everyone runs as standard user by default and all software is written with that assumption."

Oh, excuse me, is this supposed be a joke? We all remember all those Microsoft’s statements about how serious Microsoft is about security in Vista and how all those new cool security features like UAC or Protected Mode IE will improve the world’s security. And now we hear what? That this flagship security technology (UAC) is in fact… not a security technology!

I understand that implementing UAC, UIPI and Integrity Levels mechanisms on top of the existing Windows OS infrastructure is a hard task and it would be much easier to design the whole new OS from scratch and that Microsoft can’t do this for various of reasons. I understand that all, but that doesn’t mean that once more people at Microsoft realized that too, they should turn everything into a big joke? Or maybe I’m too much of an idealist…

So, I will say this: If Microsoft won’t change their attitude soon, then in a couple of months the security of Vista (from the typical malware’s point of view) will be equal to the security of current XP systems (which means, not too impressive). \ No newline at end of file diff --git a/_posts/2007-02-13-confiusion-about-joke.html b/_posts/2007-02-13-confiusion-about-joke.html deleted file mode 100644 index 74260ea..0000000 --- a/_posts/2007-02-13-confiusion-about-joke.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Confusion About The "Joke Post" -date: '2007-02-13T23:10:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:28.222+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5717512390685272695 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/confiusion-about-joke.html ---- - -It seems that many people didn’t fully understand why I wrote the previous post – Vista Security Model – A Big Joke... There are two things which should be distinguished:

1) The fact that UAC design assumes that every setup executable should be run elevated (and that a user doesn't really have a choice to run it from a non-elevated account),

2) The fact that UAC implementation contains bug(s), like e.g. the bug I pointed out in my article, which allows a low integrity level process to send WM_KEYDOWN messages to a command prompt window running at high integrity level.

I was pissed off not because of #1, but because Microsoft employee - Mark Russinovich - declared that all implementation bugs in UAC are not to be considered as security bugs.

True, I also don't like the fact that UAC forces users to run every setup program with elevated privileges (fact #1), but I can understand such a design decision (as being a compromise between usability and security) and this was not the reason why I wrote "The Joke Post". \ No newline at end of file diff --git a/_posts/2007-03-05-handy-tool-to-play-with-windows.html b/_posts/2007-03-05-handy-tool-to-play-with-windows.html deleted file mode 100644 index f9c25aa..0000000 --- a/_posts/2007-03-05-handy-tool-to-play-with-windows.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Handy Tool To Play with Windows Integrity Levels -date: '2007-03-05T18:53:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:15.128+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1586021214114399750 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/03/handy-tool-to-play-with-windows.html ---- - -Mark Minasi wrote to me recently to point out that his new tool, chml, is capable of setting NoReadUp and NoExecuteUp policy on file objects, in addition to the standard NoWriteUp policy, which is used by default on Vista.

As I wrote before the default IL policy used on Vista assumes only the NoWriteUp policy. That means that all objects which do not have assigned any IL explicitly (and consequently are treated as if they were marked with Medium IL) can be read by low integrity processes (only writes are prevented). Also, the standard Windows icacls command, which allows to set IL for file objects, assumes always the NoWriteUp policy only (unless I’m missing some secret switch).

However, it’s possible, for each object, to define not only the integrity level but also the policy which will be used to access it. All this information is stored in the same SACE which also defines the IL.

There doesn’t seem to be too much documentation from Microsoft about how to set those permissions, except this paper about Protected Mode IE and the sddl.h file itself.

Anyway, it’s good to see a tool like chml as it allows to do some cool things in a very simple way. E.g. consider that you have some secret documents in the folder c:\secretes and that you don’t feel like sharing those files with anybody who can exploit your Protected Mode IE. As I pointed out in my previous article, by default all your personal files are accessible to your Protected Mode IE low integrity process, so in the event of successful exploitation the attacker is free to steal them all. However now, using Mark Minasi’s tool, you can just do this:
chml.exe c:\secrets -i:m -nr -nx
This should prevent all the low IL processes, like e.g. Protected Mode IE, from reading the contents of your secret directory.

BTW, you can use chml to also examine the SACE which was created:
chml.exe c:\secrets -showsddl
and you should get something like that as a result:
SDDL string for c:\secrets's integrity label=S:(ML;OICI;NRNX;;;ME)
Where S means that it’s an SACE (in contrast to e.g. DACE), ML says that this ACE defines mandatory label, OICI means “Object Inherit” and “Container Inherit”, NRNX defines that to access this object the NoReadUp and NoExecuteUp policies should be used (which also implies the NoWriteUp BTW) and finally the ME stands for Medium Integrity Level.

All credits go to Mark Minasi and the Windows IL team :)

As a side note: the updated slides for my recent Black Hat DC talk about cheating hardware based memory acquisition can be found here. You can also get the demo movies here. \ No newline at end of file diff --git a/_posts/2007-03-26-game-is-over.html b/_posts/2007-03-26-game-is-over.html deleted file mode 100644 index ac8c977..0000000 --- a/_posts/2007-03-26-game-is-over.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: The Game Is Over! -date: '2007-03-26T10:57:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:59.977+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/Rgfep4q7IGI/AAAAAAAAABQ/B0UGxc6ITz4/s72-c/gameover.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-6658513522828638474 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/03/game-is-over.html ---- - -People often say that once an attacker gets access to the kernel the game is over! That’s true indeed these days, and most of the research I have done over the past two years or so, was about proofing just that. Some people, however, go a bit further and say, that thus there is no point in researching ways to detect system compromises and, once an attacker got in, you should simply assume everything has been compromised and replace all the components, i.e. buy new machine (as the attacker might have modified the BIOS or re-flashed PCI EEPROMs), reinstall OS, all applications, etc.



However, they miss one little detail – how can they actually know that the attacker got access to the system and that the game is over indeed and we need to reinstall just now?

Well, we simply assume that the attacker had to make some mistake and that we, sooner or later, will find out. But what if she didn’t make a mistake?

There are several trends of how this problem should be addressed in a more general and elegant way though. Most of them are based on a proactive approach. Let’s have a quick look at them…
  1. One generic solution is to build in a prevention technology into the OS. That includes all the anti-exploitation mechanisms, like e.g. ASLR, Non Executable memory, Stack Guard/GS, and others, as well as some little design changes into OS, like e.g. implementation of least-privilege principle (think e.g. UAC in Vista) and some sort of kernel protection (e.g. securelevel in BSD, grsecurity on Linux, signed drivers in Vista, etc).

    This has been undoubtedly the most popular approach for the last couple of years and recently it gets even more popular, as Microsoft implemented most of those techniques in Vista.

    However, everybody who follows the security research for at least several years should know that all those clever mechanisms have all been bypassed at least once in their history. That includes attacks against Stack Guard protection presented back in 2000 by Bulba and Kil3r, several ways to bypass PaX ASLR, like those described by Nergal in 2001 and by others several months later as well as exploiting the privilege elevation bug in PaX discovered by its author in 2005. Also the Microsoft's Hardware DEP (AKA NX) has been demonstrated to be bypassable by skape and Skywing in 2005.

    Similarly, kernel protection mechanisms have also been bypassed over the past years, starting e.g. with this nice attack against grsecurity /dev/(k)mem protection presented by Guillaume Pelat in 2002. In 2006 Loic Duflot demonstrated that BSD's famous securelevel mechanism can also be bypassed. And, also last year, I showed that Vista x64 kernel protection is not foolproof either.

    The point is – all those hardening techniques are designed to make exploitation harder or to limit the damage after a successful exploitation, but not to be 100% foolproof. On the other hand, it must be said, that they probably represent the best prevention solutions available for us these days.

  2. Another approach is to dramatically redesign the whole OS in such a way that all components (like e.g. drivers and serves) are compartmentalized, e.g. run as separate processes in usermode, and consequently are isolated not only from each other but also from the OS kernel (micro kernel). The idea here is that the most critical components, i.e. the micro kernel, is very small and can be easily verified. Example of such OS is Minix3 which is still under development though.

    Undoubtedly this is a very good approach to minimize impact from system or driver faults, but does not protect us against malicious system compromises. After all if an attacker exploits a bug in a web browser, she may only be interested in modifying the browser’s code. Sure, she probably would not be able to get access to the micro kernel, but why would she really need it?

    Imagine, for example, the following common scenario: many online banking systems require users to use smart cards to sign all transaction requests (e.g. money transfers). This usually works by having a browser (more specifically an ActiveX control or Firefox’s plugin) to display a message to a user that he or she is about to make e.g. a wire transfer to a given account number for a given amount of money. If the user confirms that action, they should press an ‘Accept’ button, which instructs browser to send the message to the smart card for signing. The message itself is usually just some kind of formatted text message specifying the source and destination account numbers, amount of money, date and time stamp etc. Then the user is asked to insert the smart card, which contains his or her private key (issued by the bank) and to also enter the PIN code. The latter can be done either by using the same browser applet or, in slightly more secure implementations, by the smart card reader itself, if it has a pad for entering PINs.

    Obviously the point here is that malware should not be able to forge the digital signature and only the legitimate user has access to the smart card and also knows the card’s PIN, so nobody else will be able to sign that message with the user’s key.

    However, it’s just enough for the attacker to replace the message while it’s being send to the card, while displaying the original message in the browser’s window. This all can be done by just modifying (“hooking”) the browser’s in-memory code and/or data. No need for kernel malware, yet the system (the browser more specifically) is compromised!


    Still, one good thing about such a system design is that if we don’t allow an attacker to compromise the microkernel, then, at least in theory, we can write a detector capable of finding that some (malicious) changes to the browsers memory have been introduced indeed. However, in practice, we would have to know how exactly the browser’s memory should look like, e.g. which function pointers in Firefox’s code should be verified in order to find out whether such a compromise has indeed occurred. Unfortunately we can not do that today.

  3. Alternative approach to the above two, which does not require any dramatic changes into OS, is to make use of so called sound static code analyzers to verify all sensitive code in OS and applications. The soundness property assures that the analyzer has been mathematically proven not to miss even a single potential run time error, which includes e.g. unintentional execution flow modifications. The catch here is that soundness doesn’t mean that the analyzer doesn’t generate false positives. It’s actually mathematically proven that we can’t have such an ideal tool (i.e. with zero false positive rate), as the problem of analyzing all possible program execution paths is incomputable. Thus, the practical analyzers always consider some superset of all possible execution flows, which is easy to compute, yet may introduce some false alarms and the whole trick is how to choose that superset so that the number of false positives is minimal.

    ASTREE is an example of a sound static code analyzer for the C language (although it doesn’t support programs which make use of dynamic memory allocation) and it apparently has been used to verify the primary flight control software for Airbus A340 and A380. Unfortunately, there doesn’t seem to be any publicly available sound binary code static analyzers… (if anybody knows any links, you’re more then welcome to paste the links under this post – just please make sure you’re referring to sound analyzers).

    If we had such sound and precise (i.e. with minimal rate of false alarms) binary static code analyzer that could be a big breakthrough in the OS and application security.

    We could imagine, for example, a special authority for signing device drivers for various OSes and that they would first perform such a formal static validation on submitted drivers and, once passed the test, the drivers would be digitally signed. Plus, the OS kernel itself would be validated itself by the vendor and would accept only those drivers which were signed by the driver verification authority. The authority could be an OS vendor itself or a separate 3rd party organization. Additionally we could also require that the code of all security critical applications, like e.g. web browser be also signed by such an authority and set a special policy in our OS to allow e.g. only signed applications to access network.

    The only one week point here is, that if the private key used by the certification authority gets compromised, then the game is over and nobody really knows that… For this reason it would be good, to have more then one certification authority and require that each driver/application be signed by at least two independent authorities.

From the above three approaches only the last one can guarantee that our system will not get compromised ever. The only problem here is that… there are no tools today for static binary code analysis that would be proved to be sound and also precise enough to be used in practice…

So, today, as far as proactive solutions are considered, we’re left only with solutions #1 and #2, which, as discussed above, can not protect OS and applications from compromises in 100%. And, to make it worse, do not offer any clue, whether the compromise actually occurred.

That’s why I’m trying so much to promote the idea of Verifiable Operating Systems, which should allow to at least find out (in a systematic way) whether the system in question has been compromised or not (but, unfortunately not to find whether the single-shot incident occurred). The point is that the number of required design changes should be fairly small. There are some problems with it too, like e.g. verifying JIT-like code, but hopefully they can be solved in the near feature. Expect me to write more on this topic in the near feature.

Special thanks to Halvar Flake for eye-opening discussions about sound code analyzers and OS security in general. \ No newline at end of file diff --git a/_posts/2007-04-01-human-factor.html b/_posts/2007-04-01-human-factor.html deleted file mode 100644 index 2423c6e..0000000 --- a/_posts/2007-04-01-human-factor.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Human Factor -date: '2007-04-01T14:10:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:50.038+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4456022256785429816 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/04/human-factor.html ---- - -When you go to some security conferences, especially those targeted for management staff, you might get the impression that the only problem in the security field that mankind is facing today is… that we’re too stupid and we do not know how to use the technology properly. So, we, use those silly simple passwords, allow strangers to look at our laptop screens over our shoulders, happily provide our e-bank credentials or credit card numbers to whoever asks for them, etc… Sure, that’s true indeed – many people (both administrators and users) do silly mistakes and this is very bad and, of course, they should be trained not to do them.

However, we also face another problem these days… A problem of no less importance then “the human factor”. Namely, even if we were perfectly trained to use the technology and understood it very well, we would still be defenseless in many areas. Just because the technology is flawed!

Think about all those exploitable bugs in WiFi drivers in your laptop or email clients vulnerabilities (e.g. in your GPG/PGP software). The point is, you, as a user can not do anything to prevent exploitation of such bugs. And, of course, the worst thing is, that you don’t even have any reliable way to tell whether somebody actually successfully attacked you or not – see my previous post. None of the so called “industry best practices” can help – you just need to hope that your system hasn’t been 0wned. And this is really disturbing…

Of course, you can chose to believe in all this risk assessment pseudo-science, which can tell you that your system is “non-compromised with 98% probability” or you can try to comfort yourself because you know that your competition has no better security they you… ;) \ No newline at end of file diff --git a/_posts/2007-04-20-understanding-stealth-malware.html b/_posts/2007-04-20-understanding-stealth-malware.html deleted file mode 100644 index ec4e05b..0000000 --- a/_posts/2007-04-20-understanding-stealth-malware.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Understanding Stealth Malware -date: '2007-04-20T15:18:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:37.816+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/Rii9-r9A9MI/AAAAAAAAABc/GYvliLAxxhg/s72-c/matrixdojo6006ad.gif -blogger_id: tag:blogger.com,1999:blog-24586388.post-7539069698433794020 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/04/understanding-stealth-malware.html ---- - -

Ever wondered whether Blue Pill really works or was just a PR stunt? Ever wanted to see how practical are various timing attacks against it? (And can even those “unpractical” be cheated?) Or how many Blue Pills inside each other can you run and still be able to play your favorite 3D game smoothly? Or how deep Alex can hook into Windows NDIS to bypass your personal firewall? Do you want to see Patch Guard from a “bird’s eye view” perspective? Or do you simply want to find out how well the latest Vista x64 kernel is protected? Ever wondered how rootkits like Deepdoor and Firewalk really worked? You can’t sleep, because you’re thinking constantly about how Blue Pill-like malware can be prevented? Does Northbridge hacking sound sexy to you? :)

At the very end of July, during the Black Hat Briefings in Las Vegas, Alex Tereshkin and I will be running a training “Understanding Stealth Malware”, where you should be able to find answers to the above questions plus many more.

The training will feature many previously unpublished techniques, implementation details, and of course lots of brand new code, developed especially for the training. The code will include sample rootkits similar to Deepdoor, Firewalk, Blue Pill and Delusion (but redesigned and rewritten from scratch) as well as some more exotic things, like e.g. anti-hardware-forensic attacks.

As the training will be focused on Windows platform and Vista x64 specifically, we will also present some new kernel attacks against latest Vista x64 builds. These attacks, of course, work on the fly and do not require system reboot and are not afraid of the TPM/Bitlocker protection. (Although they could also be used to bypass Vista DRM protection, this subject will not be discussed during the training).

Attendees will mostly work with kernel debuggers in order to analyze and understand various techniques used in system compromises. The main goal of the training is to help students understand contemporary malware techniques, enable them to see the “bigger picture” over technical details and show possible approaches to compromise detection.

Thus the course is primarily targeted for developers of security products, forensic investigators, pen-testers and OS developers. It’s recommended that attendees have a basic knowledge of OS design and implementation (specifically Windows), C programming, at least basic experience with debugging and ability to understand fragments of assembler code (IA32 architecture).

For ethical reasons we want to limit the availability of this course to only "legitimate" companies, thus we require that you specify your official business email address and company's website when registering for the course.

Pre-configured workstations will be provided, so there is no need to prepare for the course in any specific way. You can find more information and register for the training on the blackhat website. Please note that there will be only 2 public classes of this training this year – both during the Black Hat Briefings (28/29 and 30/31 of July). More classes will be available only in the form of on-site trainings for corporate customers.

Please also note that the number of seats is hard-limited by the number of available workstations, so we encourage registering early.

As for the other news – I have just quit COSEINC last week and I’m in the process of establishing a new security consulting and research company. For now I can only betray the name: Invisible Things Lab - expect more details to be posted here in the coming weeks :) \ No newline at end of file diff --git a/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html b/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html deleted file mode 100644 index c354eb9..0000000 --- a/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Invisible Things Lab, Bitlocker/TPM bypassing and some conference thoughts -date: '2007-05-18T13:57:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:20.690+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1481677447138628382 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/05/invisible-things-lab-bitlockertpm.html ---- - -Invisible Things Lab’s website is now online! However, we still don’t have a cute logo because the company where I order the logo presented me with something completely unacceptable and disappointing after taking a week to prepare it :( Alex is really pissed of by this and I hope we will find something nice really soon...

Anyway, as you can see on the website, we don’t have any product and we focus on consulting and research-on-demand only. We mainly target three groups of customers:

First there are security vendors and OS vendors, to whom we offer our product assessment and advisory services. E.g. we can take a look at the design and implementation of a rootkit detector, host IPS or some custom hardened OS and point out all the weaknesses we see and also give advices what we think should be improved. We can advise about both the design and implementation side, sometimes without requiring all the product internal information being shared with us.

The other group is corporate customers interested in unbiased evaluation of security technology they're planning to deploy. Here we can look at the products they consider to deploy and point out pros and cons of each of them and suggest the best choice. So e.g. we can look at various “information leak protectors” and tell how sophisticated techniques are required to bypass each of them (because, of course, all such products are bypassable). We can also advise about various technical aspects of implementing corporate security policies.

Finally there are law enforcement customers and forensic investigators, whom we can help to stay up-to-date with current offensive technology as used e.g. by modern malware, by running various trainings and seminars. We can also share our experience with advanced stealth malware and covert channels to help investigate more sophisticated incidents.

Ok, so what we don’t do? Well, we do not do classic code auditing, understood as looking for implementation bugs like e.g. buffer overflows or race conditions. We still do implementation analysis, when e.g. assessing a product, but we look only at feature-specific parts of implementation – e.g. how the kernel protection or hooking has been implemented in a given host IDS.

We also don’t do web application security nor database security. There are people who have much more experience in this area then we have, so go to them!

Finally, we do not do penetration testing, simply because I don’t believe this is the best way of improving system security. I can run 101 exploits against your server and even though all of them fail, still it tells nothing about how secure is your system. Maybe there is some little detail I missed which caused all my exploits to fail just because I was tired that day? I would definately prefer to talk to the security team and also to the server admin and ask them what they have done to secure the server in the first place. If I though that their approach has some weakness then I would simply advise them what I think they should improve. Later I would kindly ask them to give me the root/admin access so that I could verify by myself whether the advices have been implemented... This approach has an advantage of being much more complete and usually taking much less time over the standard pen-testing. It has one disadvantage though – it’s not a good material for a Hollywood movie ;)

So, all in all, we focus on OS security in contrast to application security and network security (although we can be helpful with detecting covert channels in a corporate enviroment).

Speaking of OS security (and leaving the subject of my new company for a second) – I recently had a pleasure of giving a keynote speech at the NLUUG conference in the Netherlands, which this year was focused on virtualization technology. The conference was really nice (even though 2/3 of the talks were in Dutch) and there were couple of talks I liked in particular. First, there was a talk about Microhypervisor Verification by Hendrik Tews. Author presented the overview of the Nizza architecture (which was interesting, but in my opinion way too complicated and impractical for using it anywhere outside the lab). He also talked about challenges with formal verification of kernel and microkernel, which was very interesting. I talked to him later about feasibility of verifying the monolithic kernels, like those in Linux or Windows and, not surprisingly, he said it's not really possible these days and in the coming years, because of the cost (I need to mention that he does the verification "manually").

There was also a nice presentation about Kernel Virtual Machine Monitor (KVM) for Linux by one of its developer Avi Kivity. I think in the future it might be a strong competition to Xen, especially after they add support for IOMMU technology (which I think is expected to be introduced on AMD and Intel processors somewhere in 2008). I really like the design of KVM which takes advantage of many features already present in Linux kernel without implementing them from scratch.

Finally there was a presentation by another polish female researcher, Asia (Joanna) Slowinska. She talked about Prospector, a system built on top of a CPU emulator (based on Qemu) to automatically generate generic signatures for buffer overflow attacks (both heap and stack based). On a side note, Asia (which by the way is pronounced “Ashyia” and not like the continent!) is the short form of the name Joanna, so basically almost everybody in Poland calls me Asia as well ;)

There was also a talk by Anil Madhavapeddy of XenSource, but in my opinion it was a little bit too much of a “marketing” presentation rather then a technical one (even though Anil turned out as a very technical and knowledgeable guy).

I also had some meetings at the Vrije Universiteit in Amsterdam the following day, where I met with MINIX3 developers and prof. Andrew Tanenbaum (what a fool I was that I didn’t bring one of his famous books to get an autograph:/). I must say really like the design of MINIX3, which keeps all the drivers (and other system components) in usermode, in separated address spaces. This is, however, still problematic today, as without IOMMU we can’t really fully protect kernel from usermode drivers, because of the potential DMA attacks – i.e. a driver can setup a DMA write-transaction to overwrite some part of the micro kernel memory, thus owning the system completely. But I guess we will all have processors supporting IOMMU within the next 1-2 years.

Just two days ago I delivered another keynote presentation, this time at the InfoSecurity conference in Honk Kong, organized by Computer World. My speech was about “Human Factor vs. technology” and basically the message I tried to pass was that the technology is just as flawed as the so called “human factor”, understood here as an user’s unawareness and administrator’s incompetence. I guess this is something perfectly obvious for most of technical security people, who at least once wrote an exploit by themselves. But apparently not for the security management stuff... So, even though it was by far the least technical speech I have every gave in my life, it was received as way too technical for many attendees (who were like “OMG, that was a shock!”). And I didn’t even mention any specific research I’ve done – just some standard stuff about exploits etc...

I also took part in a discussion panel with several C-level executives, some of them being CIOs for some huge institutions, others being C-level marketing guys from several security vendors.

So, I must say I was really struck by the complete lack of understanding of even the basic technical concepts behind IT security shown by some of the management people who were there. I understand, of course, that typical CIO or CSO doesn’t need to know much about technical details about how exploits and malware work, but their naivety was really shocking!

Speaking of conferences, I own apologizes to the organizers of Confidence 2007 conference in Krakow, Poland. After spending several days in the Netherlands, experiencing their rainy weather and also because of the shortage of sleep in the recent weeks due to some traveling (especially lack of my afternoon naps), I got sick and couldn’t make it to the conference. I heard it was very good this year, featuring many international speakers and, of course, Krakow, which is one of the nicest cities in Poland.

Finally, I would like to explain a little confusion around our Black Hat training. Shortly after we announced the training, there appeared some press articles which incorrectly described the kernel attacks that we’re going to present in Vegas. In the original blog post I said that these attacks “work on the fly and do not require system reboot and are not afraid of the TPM/Bitlocker protection”, but some people understood that we were going to actually present ways to defeat Bitlocker Drive Encryption (BDE). This is quite a misunderstanding, because those attacks, which allow for inserting unsigned code into Vista x64 kernel, are “not afraid of TPM/Bitlocker” simply because they can be executed on the fly and thus do not require system reboot, while Bitlocker’s task is to secure the boot process, but not to prevent the kernel against compromises!

However I intentionally mentioned TPM and Bitlocker, just to stress that those technologies have simply nothing to do with stopping rootkits and kernel compromises, provided you’re using kernel attacks which do not require system reboot, even though they’re often advertised as if they had… So, basically, even if we could break the BDE, it still wouldn’t give us any benefit these days. The situation will change within 2-3 years or so, i.e. when Microsoft will eventually come up with their own hypervisor, but that’s a different story... \ No newline at end of file diff --git a/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html b/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html deleted file mode 100644 index 85d43f4..0000000 --- a/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: We're ready for the Ptacek's challenge! -date: '2007-06-28T13:23:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:10.364+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4491938186982426867 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/06/were-ready-for-ptaceks-challenge.html ---- - -Thomas Ptacek and company just came up with this funny challenge to test our Blue Pill rootkit. And, needles to say, the Invisible Things Lab team is ready to take their challenge, however with some additional requirements, that would assure the fairness of the contest.

First, we believe that 2 machines are definitely not enough, because the chance of correct guess, using a completely random (read: unreliable) detection method is 50%. Thus we think that the reasonable number is 5 machines. Each of them could be in a state 0 or 1 (i.e. infected or not). On each of this machines we install two files: bluepill.exe and bluepill.sys

The .sys file is digitally signed, so it loads without any problem (we could use one of our methods for loading unsigned code on vista that we're planning to demonstrate at BH, but this is not part of the challenge, so we will use the official way).

The bluepill.exe takes one argument which is 0 or 1. If it's 1 it loads the driver and infects the machines. If it's 0 it also loads the driver, but the driver does not infect the machine.

So, on each of the 5 machines we run bluepill.exe with randomly chosen argument, being 0 or 1. We make sure that at least one machine is not infected and that at least one machine is infected.

After that the detection team runs their detector.exe executable on each machine. This program can not take any arguments and must return only one value: 0 or 1. It must act autonomously -- no human assistance when interpreting the results.

The goal of the detection team is to correctly mark each machine as either being infected (1) or not (0). The chance of a blind guess is:

1/(2^5-2) = 3%

The detector can not cause system crash or halt the machine -- if it does they lose. The detector can not consume significant amount of CPU time (say > 90%) for more then, say 1 sec. If it does, then it's considered disturbing for the user and thus unpractical.

The source code of our rootkit as well as the detector should be provided to the judges at the beginning of the contests. The judges will compile the rootkit and the detector and will copy the resulting binaries to all test machines.

After the completion of the contest, regardless of who wins, the sources for both the rootkit and the detector will be published in the Internet -- for educational purpose to allow others to research this subject.

Our current Blue Pill has been in the development for only about 2 months (please note that we do not have rights to use the previous version developed for COSEINC) and it is more of a prototype, with primary use for our training in Vegas, rather then a "commercial grade rootkit". Obviously we will be discussing all the limitations of this prototype during our training. We believe that we would need about 6 months full-time work by 2 people to turn it into such a commercial grade creature that would win the contest described above. We're ready to do this, but we expect that somebody compensate us for the time spent on this work. We would expect an industry standard fee for this work, which we estimate to be $200 USD per hour per person.

If Thomas Ptacek and his colleges are so certain that they found a panacea for virtualization based malware, then I'm sure that they will be able to find sponsors willing to financially support this challenge.

As a side note, the description for our new talk for Black Hat Vegas has just been published yesterday. \ No newline at end of file diff --git a/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html b/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html deleted file mode 100644 index 902bd1d..0000000 --- a/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Virtualization Detection vs. Blue Pill Detection -date: '2007-08-03T06:01:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:46.916+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6894036738428375097 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/08/virtualization-detection-vs-blue-pill.html ---- - -So, it’s all over the press now, but, as usual, many people didn’t quite get the main points of our Black Hat talk. So, let’s clear things up... First, please note that the talk was divided into two separate, independent, parts – the first one about bypassing vista kernel protection and the second one about virtualization based malware.

The message of the first part was that we don’t believe it’s possible to implement effective kernel protection on any general purpose OS based on monolithic kernel design.

The second part, the one about virtualization, had several messages...
  1. The main point was that detecting virtualization is not the same as detecting virtualization based malware. As hardware virtualization technology gets more and more widespread, many machines will be running with virtualization mode enabled, no matter whether blue pilled or not. In that case blue pill-like malware doesn’t need to cheat that virtualization is not enabled, as it’s actually expected that virtualization is being used for some legitimate purposes. In that case using a "blue pill detector", that in fact is just a generic virtualization detector is completely pointless.

    Obviously in such scenarios blue pill-like malware must support nested hypervisors. And this is what we have implemented in our New Blue Pill. We can run tens of blue pills inside each other and they all work! You can try it by yourself, but you should disable comport debug output to do more then twenty nested pills. We still fail at running Virtual PC 2007 as a nested hypervisor (when it’s guest switches to protected mode), but we hope to have this fixed in the coming weeks (please note that VPC’s hypervisor doesn’t block blue pill from loading – see our slides for more info).

    In other words, if somebody announces to the world that they can fight virtualization based malware using generic virtualization detectors, it’s like if they said that they can detect e.g. a botnet agent, just by detecting that an executable is using networking!

  2. We have also decided to discuss how blue pill could potentially cheat those generic virtualization detectors, even though we don’t believe it would be necessary in the coming years, as everything will be virtualized anyways (see previous point). But, we still decided to look into some of the SVM detection methods. First, we found out that many methods that people described as a way to detect virtualization do not work in the simple form as they were described. We took a closer look e.g. at the TLB profiling methods that were suggested by several researchers as a reliable method for virtualization detection. However all the papers that were describing this method missed the fact that some of the caches are not fully associative and one needs to use special effort (which means additional complexity) to make sure to e.g. fill the whole TLB L2 buffer. Obviously we provided all the necessary details of how to write those detectors properly (we even posted one such detector).

    In other words - we believe that it will always be possible to detect virtualization mode using various tricks and hacks, but: 1) those hacks could be forced to be very complex and 2) in case virtualization is being used on the target computer for some legitimate purposes all those methods fail anyway (see point 1).

  3. Some people might argue that maybe then we should build these virtualization detectors into all the legitimate hypervisors (e.g. Virtual PC hypervisor), so that they know at least whether they are being run on a native machine or maybe inside blue pill. However this approach contradicts the rules we use to build secure and effective hypervisors. These rules say that hypervisors should be as small as possible and there should be no 3rd party code allowed there.

    Now imagine that A/V company try to insert their virtualization detectors (which BTW would have to be updated from time to time to support e.g. new processor models) into hypervisors – if that ever happened, it would be a failure of our industry. We need other methods to address this threat, methods that would be based on documented, robust and simple methods. Security should not be built on bugs, hacks and tricks!

We posted the full source code of out New Blue Pill here. We believe that it will help other researchers to to analyze this threat and hopefully we will find a good solution soon, before this ever become widespread.

Happy bluepilling!

On a side note: now I can also explain (if this is not clear already) how we were planning to beat our challengers. We would simply ask them to install Virtual Server 2005 R2 on all the test machines and we would install our New Blue Pill on just a few of them. Then their wonderful detectors would simply detect that all the machines have SVM mode enabled, but that would be a completely useless information. Yes, we still believe we would need a couple of months to get our proof-of-concept to the level we would be confident that we will win anyway (e.g. if they used memory scanning for some “signature).

BTW, you might be wondering why I introduced the “no CPU peek for more then 1s” requirement? I will leave finding an answer as an exercise from a psychology to my dear readers ;) \ No newline at end of file diff --git a/_posts/2007-08-31-tricky-tricks.html b/_posts/2007-08-31-tricky-tricks.html deleted file mode 100644 index 424d2d0..0000000 --- a/_posts/2007-08-31-tricky-tricks.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Tricky Tricks -date: '2007-08-31T20:25:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:37.514+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3681389965289346657 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/08/tricky-tricks.html ---- - -I want to make a short philosophical comment about how some approaches to building security are wrong.

Let’s move back in time to the last decade of the XX century, to the 90’s... Back in those days one of the most annoying problems in computer security was viruses, or, more precisely, executable file infectors. Many smart guys were working on both sides to create more stealthy infectors and also better detectors for those infectors…

Russian virus write Z0mbie with his Mistfall engine and Zmist virus went probably closest to the Holy Grail in this arm race – the creation of an undetectable virus. Peter Szor, a Symantec’s chief antivirus researcher, wrote about his work in 2001:

Many of us will not have seen a virus approaching this complexity for a few years. We could easily call Zmist one of the most complex binary viruses ever written.

But nothing is really undetectable if you have a sample of the malware in your lab and can spent XXX hours analyzing it – you will always come up with some tricks to detect it sooner or later. The question is – were any of the A/V scanners back then ready to detect such an infection if it was a 0day in the wild? Will any of the today’s scanners detect a modified/improved Zmist virus, or would they have to count on the virus author being nice enough to send them a sample for an analysis first?

Interestingly, file infectors stopped being a serious problem a few years ago. But this didn’t happen because the A/V industry discovered a miracle cure for viruses, but rather because the users’ habits changed. People do not exchange executables that often as 10 years ago. Today people rather download an executable from the Web (legal or not) rather then copy it from a friend’s computer.

But could the industry have solved the problem of file infectors in an elegant, definite way? The answer is yes and we all know the solution – digital signatures for executable files. Right now, most of the executables (but unfortunately still not all) on the laptop I’m writing this text on are digitally signed. This includes programs from Microsoft, Adobe, Mozilla and even some open source ones like e.g. True Crypt.

With digital signatures we can "detect" any kind of executable modifications, starting form the simplest and ending with those most complex, metamorphic EPO infectors as presented e.g. by Z0mbie. All we need to do (or more precisely the OS needs to do) is to verify the signature of an executable before executing it.

I hear all the counter arguments: that many programs out there are still not digitally signed, that users are too stupid to decide which certificates to trust, that sometimes the bad guys might be able to obtain a legitimate certificate, etc...

But all those minor problems can be solved and probably will eventually be solved in the coming years. Moreover, solving all those problems will probably cost much less then all the research on file infectors cost over the last 20 year. But that also means no money for the A/V vendors.

Does it mean we get a secure OS this way? Of course not! Digital signatures do not protect against malicious code execution, e.g. they can't stop an exploit from executing its shellcode. So why bother? Because certificates allow to verify that what we have is really what we should have (e.g. that nobody infected any of our executable files). It’s the first step in ensuring integrity of an OS.

The case of digital signatures vs. file infectors is a good example of how problems in security should be addressed. But we all know that the A/V industry took a different approach – they invested zillions of dollars into research on polymorphic virus detection, built advanced emulators for analysis of infected files, etc. The outcome – lots of complex heuristics that usually work quite well against known patterns of infection, but are often useless against new 0day engines and also are so complex that nobody really knows how many false positives they can produce and how buggy the code itself is. Tricks! Very complex and maybe even interesting (from a scientific point of view) tricks.

So, do I want to say that all those years of A/V research on detecting file infections was a waste time? I’m afraid that is exactly what I want to say here. This is an example of how the security industry took a wrong path, the path that never could lead to an effective and elegant solution. This is an example of how people decided to employ tricks, instead looking for generic, simple and robust solutions.

Security should not be built on tricks and hacks! Security should be built on simple and robust solutions. Oh, and we should always assume that the users are not stupid – building solutions to protect uneducated users will always fail. \ No newline at end of file diff --git a/_posts/2007-10-17-thoughts-on-browser-rootkits.html b/_posts/2007-10-17-thoughts-on-browser-rootkits.html deleted file mode 100644 index df2e147..0000000 --- a/_posts/2007-10-17-thoughts-on-browser-rootkits.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts On Browser Rootkits -date: '2007-10-17T13:41:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:28.276+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8414578753020362950 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/10/thoughts-on-browser-rootkits.html ---- - -Petko D. Petkov from GNUCITIZEN wrote a post about Browser Rootkits, which inspired me to give some more thoughts on this subject. Petko is an active researcher in the field of client-side exploits (e.g. recent Adobe Acrobat PDF flaw), so it’s not a surprise that he’s thinking about browsers as a natural environment for rootkits or malware. Also it’s quite common to hear an opinion these days that browsers become so complicated and so universal that they are almost like operating systems rather than just standard applications.

Petko in his post gives several ideas of how browser-based malware could be created and I’m sure that we will see more and more such malware in the near future (I would actually be surprised if it didn’t exist already). His main argument for creating “Browser Rootkits” is that they would be “closer to the data”, which is, of course, undisputable.

The other argument is the complexity of a typical browser like e.g. Firefox or Internet Explorer. It seems like we have a very similar situation here to what we have with "classic" operating systems like e.g. Windows. Windows is so complex that nobody (including Microsoft) can really spot all the sensitive places in the kernel where a rootkit might "hook" – thus it’s not possible to effectively monitor all those places. We have a similar problem with Firefox and IE because of their extensible architecture (think about all those plugins, add-ons, etc) – although we could examine the whole memory of firefox.exe process, we still would not be able to decide whether something bad is there or not.

I’m even quite sure that my little malware taxonomy could be used here to classify Firefox or IE infections. E.g. the browser malware of type 0, would be nothing else then just additional plugins, installed using official API and not trying to hide from browser reporting mechanisms (in other words they still will be visible to users when they will ask the browser to list all the installed plugins). And we will have type I and type II infections, the former would be simply modifying some code (be that a code of a browser or maybe of some other plugin) while the latter would be hooking some function pointers or changing some data only – this all to hide the offensive module.

BTW, there is a little problem with classifying JIT-generated code – should it be type I or type II infection? I don’t know the answer for now and I welcome all the feedback on this. And we can even imagine type III infections of browsers, but I will leave it as an exercise for my readers :)

So, should we expect the classic, OS-based rootkits to die and the efforts in the malware community to move towards creating Browser-based rootkits? I don’t think so. While the browser-based malware is and will definitely be more and more important problem, it has one disadvantage comparing to classic OS-based malware. Namely it’s quite easy to avoid, or at least minimize the impact from browser-based rootkits. It’s just enough to use two different browsers – one for sensitive and the other one for non-sensitive operations.

So, for example, I use IE to do all my sensitive browsing (e.g. online banking, blogger access, etc), while Firefox to do all the casual browsing, which includes morning press reading, google searching, etc. The reason I use Firefox for non-sensitive browsing doesn’t come from the fact that I think it’s more secure (or better written) then IE, but because I like using NoScript and there is no similar plugin for IE...

Of course, an attacker still might exploit my non-sensitive browser (Firefox) and then modify configuration or executable files that are being used by my sensitive browser (IE). However this would require write-access to those files. This is yet another reason why one should run the non-sensitive browser with limited privileges and technologies like UAC in Vista help to achieve it. I wrote an article some time ago about how one can configure Vista to implement almost-full privilege separation.

Of course, even if we decide to use 2 different browsers - one for sensitive and the other one for non-sensitive browsing, an attacker still might be able to break out from account protection via a kernel mode exploit (e.g. exploiting one of the bug that Alex and I presented in Vegas this year). However this would not be a browser malware anymore – this would be a good old kernel-mode malware :)

A solution to this problem will probably be the use of a Virtual Machine to run the non-sensitive browser. Even today one might download e.g. the Browser Appliance from VMWare and we will see more and more solutions like this in the coming years I think. This BTW, will probably stimulate more research into VM escaping and virtualization-based malware.

Of course, the very important and sometimes non-trivial question is how to decide which type of browsing is sensitive and which is non-sensitive. E.g. most people will agree the online banking is a sensitive browsing, but what about webmail? Should I use my sensitive or non-sensitive browser for accessing my mail via web? Using a sensitive browser for webmail is dangerous, as it’s quite possible that it could be infected via some malicious mail that would be in our inbox. While using the non-sensitive browser for webmail is also not a good solution, as most people would like to consider mail as sensitive and would not like to allow the possibly-compromised browser to learn the password for the mailbox.

I avoid this problem by not using a browser for webmail and by having a special account just for running a thunderbird application (see again my article on how to do this in Vista). It works well for me.

Of course, one could also do the same for browser – i.e. instead of having 2 browsers (i.e. sensitive and non-sensitive), one could have 3 or more (maybe even 3 different virtual machines). But the question is how many accounts should we use? One for email, one for sensitive browsing, one for non-sensitive, one for accessing personal data (e.g. pictures)...? I guess there is no good answer for this and it depends on the specific situation (i.e. different configuration for home user that uses computer mostly for "fun" and different for somebody using the same computer for both work and "fun", etc...)

On a side note – I really don’t like the idea of using a web browser to do "everything" – I like using browser to do browsing, while to do other things to use specialized applications. I like having my data on my local hard drive. It’s quite amazing that so many people these days use Google not only for searching, but also for email, calendaring and documents editing – it’s like giving all your life secretes on a plate! Google can now correlate all your web search queries with a specific email account and even see who are you meeting with next evening and also know what a new product your company will be presenting next week, as you prepared you presentation using Google Documents. I’m not sure whether it’s Google or the people’s naivety that disturbs me more... \ No newline at end of file diff --git a/_posts/2007-10-25-razor-thin-hypervisors.html b/_posts/2007-10-25-razor-thin-hypervisors.html deleted file mode 100644 index 06b79e5..0000000 --- a/_posts/2007-10-25-razor-thin-hypervisors.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Razor-Thin Hypervisors -date: '2007-10-25T19:55:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:17.923+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7805915543221342080 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/10/razor-thin-hypervisors.html ---- - -I just came back from Stockholm where I attended the Virtualization Forum, and saw several, quite interesting vendor presentations. One that caught my attention was a talk by VMware, and especially the part that talked about the new ESX 3i hypervisor and presented it as "razor-thin". This "razor-thin" hypervisor will have, according to VMWare, the footprint "of only 32MB".

My regular readers might sense that I’m a bit ironic here. Well, 32MB of code is definitely not a "razor-thin" hypervisor in my opinion and it’s not even close to a thin hypervisor... But why am I so picky about it? Is it really that important?

Yes, I think so, because the bigger the hypervisor the more chances that there is a bug somewhere out there. And one of the reasons for using virtual machines is to provide isolation. Even if we use virtualization because of business reasons (server consolidation), still we want each VM to be properly isolated, to make sure that if an attackers "gets into" one VM, she will not be able to 0wn all the other VMs on the same hardware… In other words, isolation of VMs, is an extremely important feature.

During my presentation I also talked about thin hypervisors. I first referenced a few bugs that were found in various VMMs in the recent months by other researchers (congrats to Rafal Wojtczuk of McAfee for some interestingly looking bugs in VMWare and Microsoft products). I used them as an argument that we should move towards very thin hypervisor architecture, exploiting hardware virtualization extension as much as possible (e.g. Nested Paging/EPT, IOMMU/DEV/NoDMA, etc) and avoiding doing things "in software".

Nobody should be really surprised seeing VMMs bugs – after all we have seen so many bugs in OS kernels over years, so no surprise we will see more and more bugs in VMMs, unless we switch to very thin hypervisors, so thin that it would be possible to understand and verify their code by one person. Only then we would be able to talk about security advantage (in terms of isolation) offered by VMMs comparing to traditional OSes.

I couldn’t refrain myself from mentioning that the existence of those bugs in popular VMMs clearly shows that having a VMM already installed doesn’t currently prevent from the "Blue Pill threat" – a point often expressed by some virtualization vendors, who notoriously try to diminish the importance of this problem (i.e. the problem of virtualization based malware).

I also announced that Invisible Things Lab has just started working with Phoenix Technologies. Phoenix is the world leader in system firmware, particularly known for providing BIOSes for PCs for almost 25 years, and currently is working on a new product called HyperCore that would be a very thin and lightweight hypervisor for consumer systems. ITL will be helping Phoenix to ensure the security of this product.

HyperCore hypervisor will use all the latest hardware virtualization extensions, like e.g. Nested Paging/EPT to minimize the unnecessary complexity and to provide negligible performance impact. For the same reasons, the I/O access will go through almost natively, just like in case of our Blue Pill...

Speaking about Blue Pill – Phoenix is also interested in further research on Blue Pill, which will be used as a test bed for trying various ideas – e.g. nested virtualization, which might be adopted in the future versions of HyperCore to allow users to use other commercial VMMs inside their already-virtualized OSes. Blue Pill’s small size and minimal functionality makes it a convenient tool for experimenting. Phoenix will also support The Blue Pill Project which means that some parts of our research will be available for other researchers (including code)!

In case you still feel like having a look into my slides, you can get them here. \ No newline at end of file diff --git a/_posts/2008-03-31-kick-ass-hypervisor-nesting.html b/_posts/2008-03-31-kick-ass-hypervisor-nesting.html deleted file mode 100644 index 3991e71..0000000 --- a/_posts/2008-03-31-kick-ass-hypervisor-nesting.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Kick Ass Hypervisor Nesting! -date: '2008-03-31T20:02:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:00.261+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/R_EoN9WFV3I/AAAAAAAAABk/3Zo6oMEO8eQ/s72-c/XP+inside+VPC+inside+NBP.bmp -blogger_id: tag:blogger.com,1999:blog-24586388.post-7426857732980068109 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/03/kick-ass-hypervisor-nesting.html ---- - -Remember how at the Black Hat Vegas 2007 I said that we still didn't support virtualization of full VMMs, like e.g. Virtual PC 2007 with hardware virtualization enabled, and that currently we could only run very simple hypervisors inside our New Blue Pill (like e.g. other NBPs inside NBP)? Remember how I said that we were working on this and should have a solution in about 2 months from then?

So, just about 2 weeks ago we did it! We can now virtualize complex hypervisors, like e.g. Virtual PC 2007 or Virtual Box with SVM turned on (BTW, we can also run VMWare Workstation, but that doesn't count, as on AMD processors it doesn't make use of SVM instructions). We also have a prototype code that allows to run nested hypervisors on VT-x but that code requires a bit of more polishing (oh, didn’t you know that our NBP also supports VT-x these days?).

I couldn't resist not to use my favorite Matrix analogy to describe what we do here: imagine Neo, who bravely followed The White Rabbit and finally decided to swallow The Red Pill, eventually awakes on The Nebuchadnezzar ship just to find out later that this whole "real world" is... just another Matrix...

I don't have a nice Matrix picture for that, so instead I will just show you a picture of a Virtual PC 2007 running inside an already bluepilled Vista and running Windows XP as its own guest. You can see that we use our "bpknock" testing program just to show we can intercept events in both the guest (i.e. the Vista that hosts the VPC hypervisor) as well as in the nested guest (the XP running inside the Virtual PC). This bpknock program simply executes CPUID instruction with some magic value in the RAX register and NBP intercepts that and answers with a magic RAX. BTW, there was no special reason to chose CPUID instruction for that, normally we don't need to intercept CPUID on AMD at all, so we could have chosen pretty much anything else, e.g. magic output to some magic I/O port.



It's worth mentioning that the only other working example of nested hardware virtualization I'm aware of is the IBM z/VM hypervisor for the IBM z series mainframe. If anybody knows any other example, please send me a link.

The research on nested virtualization has been supported by Phoenix Technologies, as the nested virtualization has also some positive applications. Phoenix is working on a cool product called HyperSpace. It consists of a hypervisor (called the "HyperCore") that allows running a few unmodified OSes inside hardware virtual machines so users can switch between them just like if they were virtual spaces on Mac or Linux. At the beginning there will be two virtual machines available: one running standard Vista and the other one based on Linux, that would contain some useful functionality like e.g. a Web browser, an email client and a multimedia suite, and also there would be something called the "ManageSpace" to manage this all.

So, how this is going to be different from e.g. XEN? The difference is that XEN is focused on server applications, while HyperSpace is intended for notebooks, which means it puts lots of efforts to offer comparable graphics (and other devices) performance as we have on normal non-virtualized laptops. This all will be possible because of the recent virtualization technology advances like e.g. VT-d/IOMMU.

At the RSA conference in San Francisco next week, I will be giving a speech that will discuss some technical problems we had to solve in order to get hardware nested hypervisoring working on AMD and also how the situation looks on Intel. I will also discuss how this changes the security battlefield and why virtualization vendors should care.

Back to Blue Pill -- the brand new source code with full virtualization support on AMD is now available on bluepillproject.org (you will need WDK6000 or newer to build it). Note that the (experimental) code for nested virtualization on Intel VT-x has been removed in this public version, leaving only the basic functionality if we run NBP on an Intel processor.

Also, please note that the code for AMD-v, even though it proved to be very stable, is still just a proof of concept. This means for example, that we don’t do any error-checks in the SVM instruction handlers, so it’s trivial for the nested hypervisor to simply crash the whole system if executing one of the SVM instructions with incorrect arguments or in an incorrect situation (e.g. CPL > 0). But that is hardly a problem for Blue Pill, as the guest isolation has never been a goal here. Of course, this could be simply addressed by adding a few more lines of code to each handler that would check for error conditions and inject #UD or #GP back to the nested hypervisor if it executed something incorrectly. Of course, we’re too lazy to code that ;)

So, what’s next? Well, we hope to show something even cooler at this year’s Black Hat Vegas, but I won’t say anything more now. \ No newline at end of file diff --git a/_posts/2008-04-09-rsa-absurd.html b/_posts/2008-04-09-rsa-absurd.html deleted file mode 100644 index 202a0b3..0000000 --- a/_posts/2008-04-09-rsa-absurd.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The RSA Absurd -date: '2008-04-09T08:43:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:44.478+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1108669651271949087 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/rsa-absurd.html ---- - -Today I was giving a speech at the RSA Conference in San Francisco. The RSA is a really big conference and also seems to me like a very well organized one – e.g. they have all those computers at the registration hall where you put your name and then it immediately says to which check-in counter you should proceed and then when you get there they already have a badge waiting for you. Pretty cool stuff.

So my speech turned out to be scheduled in a very small room, say with seats for 100-200 people only (I haven't counted exactly). But then it turned out that there are more people interested in seeing the speech, so, as it usually happens on conferences, people started seating on the floor and also standing at the back of the room. I would say there was about 30% overflow, but still they could fit ok in the room. And then came this guy from the conference and said that all people who don’t have a seat should leave the room! It turned out that this is a fire regulation.

Interestingly it was perfectly ok for the additional people to stay in the room, provided they arranged for additional chairs for themselves. In other words it was fine for people to sit and block the main aisle, provided they sit on chairs, but they couldn’t stay and sit on the same aisle without having a chair (maybe a "certificated" chair also), as that would be against the fire regulations!

Yes, I know there are more examples of stupid pseudo-security rules (think airports), but, come on, this is on of the most well known security conference...

That situation annoyed me so much (because, of course, it turned out to be impossible to arrange for the additional chairs, so all those people had to leave) that I decided to submit this story to my blog using the totally unsecured public WiFi in my hotel. It was really unwise for me to do that, as Google’s Blogger uses HTTPS only for authentication (i.e. the login screen) but then it switches back to the good old plain text HTTP, making it possible for some evil guy sitting in the lobby to hijack my session. Is it that I miss something here or Google simple forgot that it is 2008 and not the 90’s anymore? Anyway, I'm just taking this risk bravely, hoping that the potential attacker, seeing my determination here, would refrain themselves from compromising this blog.

I know, I know, instead of complaining about Google, I should just move my blog to some other place. One day that’s gonna happen for sure :) \ No newline at end of file diff --git a/_posts/2008-04-12-most-stupid-security-news-ever.html b/_posts/2008-04-12-most-stupid-security-news-ever.html deleted file mode 100644 index 448bee4..0000000 --- a/_posts/2008-04-12-most-stupid-security-news-ever.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Most Stupid Security News Ever -date: '2008-04-12T18:45:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:32.405+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6179059977710695477 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/most-stupid-security-news-ever.html ---- - -Seems like the BBC reporters have a shortage of subjects to write about these days… Maybe the next winter we will also be able to read about how many snowflakes fell during Christmas all over the world or something like that (which BTW, would still be way more interesting that the news quoted above).

I remember that some time ago, a group of researchers used automatic generators to create a few tens of thousands of variants of some malware, just to do some testing of A/V engines. And I remember how all the A/V people were complaining how irresponsible that was bla bla bla, as now they would have to work after hours to fight all this new malware. What a BS!

For any given class of a bug (think: exploits), or a file infection method (think: viruses), or a system compromise technique (think: rootkits, stealth malware), one can come up with pretty much infinite number of examples that would be exploiting the specific bug, the specific file infection method, or the specific system compromise technique. One virus would display you a “Hello, you’re being 0wned, sir.” Message, while the other one would just flash your keyboard leds. Sure, two different beings, but if exploiting the same mechanisms, also the protection against them is the same.

But, I know, it looks so cool in the news to read: “The number of viruses, worms and trojans in circulation has topped the one million mark”. It’s most definitely a good way to scare all the housewives and make them to rush to the computer shop at the coroner to buy the brand new A/V product that already can detect 99.9% out of all those scary things out there. \ No newline at end of file diff --git a/_posts/2008-04-14-research-obfuscated.html b/_posts/2008-04-14-research-obfuscated.html deleted file mode 100644 index 4d2cb51..0000000 --- a/_posts/2008-04-14-research-obfuscated.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Research Obfuscated -date: '2008-04-14T08:21:00.008+02:00' -author: Joanna Rutkowska -tags: -- bad guys attacking joanna -modified_time: '2009-03-25T16:04:23.036+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1897611147293282587 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/research-obfuscated.html ---- - -Update 07-Sept-2008: Four months later after writing his open letter to me (see below), Christofer Hoff experienced on his own difficult it is for one to control the press, making sure it correctly reports what you say. In this blog entry he describes how he was terribly misquoted by a report after his Black Hat presentation and he also explicitly admits that "[I] was essentially correct in [my] assertion during our last debate that you cannot control the press, despite best efforts." and that "[he] humbly submit[s] to [me] on that point." :)

This article has been brought to my attention recently. It’s an “Open Letter to Joanna Rutkowska”, by Christofer Hoff over at the “Rational Survivability” blog. I decided to spend time reading and answering this piece as 1) technorati.com reported the blog’s authority as above 100 which suggests it has a reasonable number of readers, and also 2) because I believe this is a good example of the social engineering techniques used by my opponents and I couldn’t refrain myself from not commenting about this. Besides I felt a bit flattered that some individual decided to write an “Open Letter” to me, sort of like if I was a prime minister or some other important person ;)

Let me now analyze the letter, point by point:
  1. Fire rules! The first thing that Hoff accuses me of in his letter is myself being an irresponsible individual, not caring about safety of my audience (not a joke!):
    “As the room filled to over capacity before your talk began, you were upset and couldn't seem to understand why the conference organizers would not let people spill over from seats and sit on the floor and in the aisles to hear you speak. The fact that fire and safety codes prohibit packing a room beyond capacity was something you attributed to people being "...crazy in America." Go figure.”
    Dear Christofer, if you only read my recent blog post about this very specific incident, read thoroughly shall I say, you would notice this paragraph undoubtedly:
    “Interestingly it was perfectly ok for the additional people to stay in the room, provided they arranged for additional chairs for themselves. In other words it was fine for people to sit and block the main aisle, provided they sit on chairs, but they couldn’t stay and sit on the same aisle without having a chair (maybe a "certificated" chair also), as that would be against the fire regulations!”
    Conclusion: I was not so much picking upon the fire regulations that forced people to leave the room, but rather on the idiotic rule, that allowed those same people to stay in this very same room, provided they also had additional chairs with them.

  2. Type I vs. Type II hypervisors confusion. Hoff then switches to the actual content of the presentation and writes this:
    “When I spoke to you at the end of your presentation and made sure that I understood correctly that you were referring specifically to type-2 hosted virtualization on specific Intel and AMD chipsets, you conceded that this was the case.”
    This simply is an incorrect statement! On the contrary, when describing the security implications of nested virtualization (which was the actual new thing I was presenting at the RSA), I explicitly gave an example of how this could be used to compromise type I hypervisors. Kindly refer to slides 85-90 of my presentation that can be downloaded here.

    I said that the code we posted on bluepillproject.org indeed targets type II hypervisors and the only reason for that being that it has been built on top of our New Blue Pill code that was designed as a Windows kernel driver.

  3. Shit not giving. Mr. Hoff goes even further:
    “When I attempted to suggest that while really interesting and intriguing, your presentation was not only confusing to many people but also excluded somewhere north of 80% of how most adopters have deployed virtualization (type-1 "bare-metal" vs. type-2 hosted) as well as excluding the market-leading virtualization platform, your response (and I quote directly) was: I don't give a shit, I'm a researcher.
    Now that was a hard blow! I understand that the usage of such a slang expression by an Eastern European female during an informal conversation with a native speaker must have made an impression on him! However, I couldn’t give such an answer to this very question, simply because of the reasons given in point #2 (see above).

    If I remember correctly, I indeed used this very American expression to answer somebody’s concern (undoubtedly our Christofer Hoff’s) that most of the type I hypervisors out there are based on monolithic hypervisor architecture, and not on the micro-hypervisor architecture (and that I should not try to convince people to switch to micro-hypervisor architecture). In that context it makes it more logical for me to use the “I’m a researcher” as an excuse for not caring so much that most people use monolithic based hypervisors. Obviously, the usage of micro-hypervisors would allow to better secure the whole VMM infrastructure. And I also said, that I don’t care what people are using today, because I try to help to build a product that would be secure in the future (Phoenix’s HyperCore).

  4. No obfuscation postulate. Hoff then comes up with some postulates that:
    “[I], as a researcher who is also actively courting publicity for commercial gain and speaking at conferences like RSA which are less technical and more "executive" in nature, you have a responsibility to clarify and not obfuscate (intentionally or otherwise) the facts surrounding your research.”
    This postulate is cleverly constructed because it also contains an embedded accusation of me being a commercially motivated researcher. Well, I never tried to hide that fact, and the reason for this is very simple: I consider security research as my job, and one of the primary goals of any job is to… bring commercial gain to the individual doing the job.

    Second, I really don’t understand what Hoff means by asking me to not obfuscate my research?! Maybe he was just disappointed that the presentation was too technical for an average CISSP to understand it? But, well, this presentation was classified as “Advanced Technical”, which was displayed in the conference program. I still did my best so that, say 70% of the material, was understandable to an average IT people, but, come on, there always must be some deep technical meat in any non-keynote-presentation, at least this is my idea for how a conference should look like.

  5. Commercially motivated. Hoff accuses me of presenting commercial product, i.e. the Phoenix’s HyperSpace, during my speech:
    “No less than five times during your presentation, you highlighted marketing material in the form of graphics from Phoenix, positioned their upcoming products and announced/credited both Phoenix and AMD as funding your research.”
    Well, let me tell you this – this was one of the main reasons why I decided to speak at the RSA – just to announce this very product that I try to help to secure. Why would that be wrong?

    BTW, I have no idea how Mr. Hoff concluded that AMD was founding my research. I never said that, nor did I have it in my slides. Needles to say, AMD has not been founding my research. NOTE: interestingly I consider this particular mistake by Hoff to be accidental – at least I don’t see how this could be connected to any PR campaign, in contrast to all the other incorrectness he made use of.

  6. Independence. Hoff, for some reason, apparently known only to him, tries to argue that I’m not an “independent researcher”:
    “I think it's only fair to point out that given your performance, you're not only an "independent researcher" but more so an "independent contractor." Using the "I'm a researcher" excuse doesn't cut it.”
    “I know it's subtle and lots of folks are funded by third parties, but they also do a much better job of drawing the line than you do.”
    Well, I found this one to be particularly amusing, as, for at least several years now, I have not claimed I have been an independent researcher.

  7. Final hit. You might have been wondering by now – why this gentleman, nah, I think “the guy” would fit better here, so why the guy decided to spent so much time to write all those points, all those quasi-arguments and why he made so many “mistakes”? Well he seems to give an answer right in this paragraph:
    “I care very much that your research as presented to the press and at conferences like RSA isn't only built to be understood by highly skilled technicians or researchers because the continued thrashing that they generate without recourse is doing more harm than good, quite frankly.”
    Aha, now all is clear. May I ask then, which virtualization vendor you write PR for? ;)

So, then Hoff quotes the Forbes article that was written after my presentation and accuses me that the article (written by some Forbes reporter) was too sensationalist. I definitely agree the article was very sensationalist (but correct) and when I saw the article I even got angry and even wanted to write a blog about it (but as the article was actually correct, I had no good arguments to use against it). And you know why I was so angry? Because I actually spent over 40 minutes with this very Forbes reporter in the RSA’s speaker’s lounge just after my speech, I spent that time on clarifying to that guy what my presentation was about and what it was not about and what was the main message of the presentation. Still, the reporter had his own vision of how to write about it (i.e. make it into a sensation) and I hardly, as it turned out, could do anything about it…

So, what was the main massage of my presentation? Interestingly Mr. Hoff forgot to mention that… Let me then remind it here (a curious reader might want to have a look at the the slide #96 in my presentation):
  • Virtualization technology could be used to improve security on desktop systems

  • However there are non-trivial challenges in making this all working well...

  • ... and not to introduce security problems instead...

Additionally, the message I was trying to pass during the whole presentation was:
“Keep hypervisors simple, do not put drivers there, as otherwise we would get to the same point where we are with current OSes these days, i.e. no kernel security at all!”
Now I wonder, maybe Christofer Hoff doesn’t do PR for any VMM vendor, maybe he just didn’t listen carefully to my presentation. Maybe he’s just one of those many guys who always know in advance what they want to hear and selectively pick up only those facts that match their state of mind? Otherwise, why would he not realize that my presentation was actually a pro-virtualization one and needed no (false) counter-arguments? \ No newline at end of file diff --git a/_posts/2008-04-30-vegas-training-2008.html b/_posts/2008-04-30-vegas-training-2008.html deleted file mode 100644 index ce24d30..0000000 --- a/_posts/2008-04-30-vegas-training-2008.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vegas Training 2008 -date: '2008-04-30T15:44:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:12.026+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3486345275075744973 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/vegas-training-2008.html ---- - -Last year we debuted with our Understanding Stealth Malware training at the Black Hat Vegas. We had about 70 participants and I think it was a reasonable success, especially that the training was announced very late. Since then we have done a couple of on-site classes and also have been continually updating the training.

During our 2nd public edition, at Black Hat Europe 2008 in March this year, we significantly extended the part about virtualization, e.g. by adding discussion of nested virtualization on AMD-v and showing and analyzing the actual code for implementing this. Also we have used the New Blue Pill code with VT-x support (previously it worked only on AMD-V), making it possible to use both AMD and Intel machines for the class. This allowed us to offer this training in a "Bring Your Own Laptop" fashion, that we know is much preferred by attendees, who simply feel better when using their own, known, work environment.

At the upcoming Black Hat Vegas 2008 we are also going to offer this class. That would be our 3rd public edition. Again, we hope to improve it even more beyond what we have presented at BH Europe 2008. Similarly as last time, we will not provide the computers, but rather expect the attendees to bring their own systems. At the end of this article are the requirements that should be met by your machine, if you would like to use it during the training and be able to do all the exercises. Of course, you should back up all your important data before coming to the class, as the computer might become corrupt after doing some of the exercises (although this has never happened so far).

There will be only one class offered on August 4/5 (the weekday class). You can view the detailed training agenda that we used for the BH Europe class in March here. Please note that the exact shape of the Vegas class is subject to be a bit different, as we are planning to add new material again.

This might be the very last chance for you to attended this specific training, as it's quite possible that next year we will be offering some other class, focused on Virtualization security entirely. Don't worry, however, if you don't get a seat in the Vegas class, there is still a chance to have that class presented on-site in your town.

You can register for the Vegas training here.

See you in Vegas!

Hardware Requirements
  1. 64-bit (x64) AMD or Intel processor with hardware virtualization support (AMD-v or VT-x)
  2. DVD-ROM
  3. 2GB RAM (for convenient work with VMWare)
Software Requirement
  1. 64-bit Vista OS (primary OS, non virtualized)
  2. Windows Driver Kit (WDK) 6000 or newer (available via MSDN subscription).
  3. VMWare Workstation 6.x or VMWare Player 2.x (the latter is free)
  4. Optionally: IDA Pro 5.x disassembler (for exercises that involve finding bugs in drivers)
AMD Processors
Most modern AMD mobile processors, like e.g. AMD Turion and Athlon, used in modern laptops support AMD-v technology. Unfortunately there is no single place on AMD website that would provide the complete description of all CPUs that support AMD-v technology or provide an answer whether a given model does support it. When in doubt use google and always verify with the CHKSVMX program described below.

Intel Processors
Most modern Intel processors used in notebooks support Intel VT-x virtualization technology, this include Core 2 Solo, Core 2 Duo (except T5500, T5550 and T5750 models) and Core 2 Extreme. You can check your own model starting at this website, then chose your processor family and chose "Specifications" tab. Make sure the processor supports "Intel® 64 architecture" and "Intel® Virtualization Technology".

Using Mac for the training
You can very easily use MacBook or MacBook Pro for this training. You can easily install Windows on a second partition using the Boot Camp program that ships with all the newer Macs. You simply start Boot Camp application when running Mac OS X and then it automatically shrinks your current Mac partition, creates a new one for Windows, and asks to insert the installation media and reboots the system and you then perform normal Windows setup (after installation is complete your Vista should find all the necessary drivers via Windows Update). You might also want to use the free AutoHotKey program for the right-click emulation on your newly installed Vista. Please don't worry that Boot Camp tells that you should install a 32-bit Vista - you can ignore this and insert a 64-bit Vista installation disk.

Testing your machine with CHKSVMX
We have prepared a special little program, CHKSVMX, to test whether a given machine indeed supports hardware virtualization technology. The CHKSVMX program can be downloaded from here

The program doesn't introduce any persistent changes to the OS and doesn't require any installation procedure. It checks for virtualization support (on both AMD and Intel processors) not only by reading the CPUID information but also by trying to actually enable virtualization mode and then disable it again. Although most of the laptops available these days support hardware virtualization, in many cases this feature is disabled or locked down in the BIOS. If the virtualization is reported as "locked", please try to enable it in the BIOS. Please note that in most cases you will have to fully power down your system for the BIOS changes to take effect (reboot is not enough)!

Additionally CHKSVMX checks whether a 64-bit edition of Windows is running, as such OS is required for the training.

DISCLAIMER: The test program is digitally signed with the Invisible Things Lab's certificate and we assure that the program does not perform any malicious actions. ITL is, however, not responsible for any accidental damage or system instability issues the test program might cause.
\ No newline at end of file diff --git a/_posts/2008-05-20-1984.html b/_posts/2008-05-20-1984.html deleted file mode 100644 index f89d621..0000000 --- a/_posts/2008-05-20-1984.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: 1984? -date: '2008-05-20T10:26:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:05.613+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7813731853415735079 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/05/1984.html ---- - -I can't believe this is happening for real...

So, how can we enforce Google to never do read() on a /var/users/john_smith/heath_records.db? How about a read() implemented from within a kernel-level via RAW-disk access that would never be logged?

I wonder when we would get another cool service from Google, e.g. "Google Thoughts", where people would be able to store their most private and personal thoughts, so that they could "access and managed them from all over the world", "in a secure fashion", of course. Right, add the Thought Police to this picture and welcome to Orwell's Oceania!

There is a difference between using the Web for blog writing vs. giving away all the private aspects of your life for free to some corporation in an unencrypted form. I wonder whether all the people who understands the notion of the local hard disk will be vaporized some time... \ No newline at end of file diff --git a/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html b/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html deleted file mode 100644 index dc14052..0000000 --- a/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Rafal Wojtczuk joins Invisible Things Lab -date: '2008-07-01T20:36:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:03:57.142+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8942209840459034399 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/07/rafal-wojtczuk-joins-invisible-things.html ---- - -I’m very happy to announce that a well known researcher, Rafal Wojtczuk, will join our team this month.

For anybody who is serious about OS security research it is hard not to know Rafal’s work. I remember reading his Defeating Solar Designer non-executable stack patch article somewhere around 1998, when I was still a Linux newbie, learning shell programming back at that time ;)

Since then Rafal published many other articles, advisories and exploits, mostly Linux-related. To mention just a few – the *BSD procfs vulnerability (2000), the Linux Ptrace vulnerability (2001), the famous Advanced return-into-lib(c) paper (2002), the vulnerability in the SELinux (2003), a tool for automatic integer overflow discovery in Win32 binaries (2005) and many others. He’s also known for his libnids project.

Recently Rafal has been doing a lot of research in the area of virtualization and VMM security. In the recent months he found vulnerabilities that potentially allowed to escape a VM jail in all the major virtualization software from Microsoft, VMWare and, of course, Xen.

I wrote “and, of course, Xen”, as Rafal will be presenting a talk at the upcoming Black Hat about Subverting the Xen hypervisor. His talk will be the first one in the series of 3 presentations about Xen (in)security that Invisible Things Lab prepared for this year’s Black Hat. Stay tuned for more details in the coming days.

Rafal has been with McAfee Avert Labs until this month. \ No newline at end of file diff --git a/_posts/2008-07-07-0wning-xen-in-vegas.html b/_posts/2008-07-07-0wning-xen-in-vegas.html deleted file mode 100644 index 54d62fd..0000000 --- a/_posts/2008-07-07-0wning-xen-in-vegas.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 0wning Xen in Vegas! -date: '2008-07-07T16:03:00.004+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- virtualization based rootkits -modified_time: '2009-03-25T16:03:47.633+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SHIrRRp7nYI/AAAAAAAAAB8/MCybwCZ2nuI/s72-c/Fotolia_1758548_XS.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-5820262464138516969 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/07/0wning-xen-in-vegas.html ---- - -At this year’s Black Hat conference in Las Vegas in August we will be presenting three talks about the Xen hypervisor (in)security. The three presentations have been designed in such a way that they complement each other and create one bigger entirety, thus they can be referred as “Xen 0wning Trilogy” for brevity.

In the first presentation, Subverting the Xen hypervisor, Rafal will discuss how to modify the Xen’s hypervisor memory and consequently how to use this ability to plant hypervisor rootkits inside Xen (everything on the fly, without rebooting Xen). Hypervisor rootkits are very different creatures from virtualization based rootkits (e.g. Bluepill). This will be the first public demonstration of practical VMM 0wning (proof of concept code will be released, of course).

In the second talk, Detecting and Preventing the Xen hypervisor subversions, Rafal and I will discuss various anti-subverting techniques (IOMMU, Xen’s driver- and stub- domains) and whether they really can protect the Xen (or similar) hypervisor from compromises. After demonstrating that those mechanisms can be bypassed, we will switch to discussing hypervisor integrity scanning and will present some prototype solutions to this problem.

Our trilogy wouldn’t be complete without discussing virtualization based malware in the context of bare-metal hypervisor compromises. Thus, in the third speech, Bluepilling the Xen hypervisor, Alex and I will discuss how to insert Bluepill on top of the running Xen hypervisor. We will show how to do that both with and without restart (i.e. on the fly). To make this possible, our Bluepill needs to support full nested virtualization, so that Xen can still function properly. We will also discuss how the “Bluepill detection” methods proposed over the last 2 years, as well as the integrity scanning methods discussed in the previous speech, fit into this new scenario and how far we are from the stealth malware’s Holy Grail ;)

Special thanks to Black Hat organizers for scheduling all the three presentations one after another in a dedicated Virtualization track on the 2nd day of the conference (August 7th).

It’s worth noting that we chose Xen as the target not because we think it’s insecure and worthless. On the contrary, we believe Xen is the most secure bare-metal hypervisor out there (especially with all the goodies in the upcoming Xen 3.3). Still we believe that it needs some improvements when it comes to security. We hope that our presentations will help making Xen (and similar hypervisors) more secure. \ No newline at end of file diff --git a/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html b/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html deleted file mode 100644 index afb64f8..0000000 --- a/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Our Xen 0wning Trilogy Highlights -date: '2008-08-08T09:42:00.002+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- xen heap exploiting -- virtualization based rootkits -modified_time: '2009-03-25T16:03:38.496+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1952716314561818264 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/our-xen-0wning-trilogy-highlights.html ---- - -Below you can find highlights of the three presentations, collectively referred to as "Xen 0wning Trilogy", that Alex, Rafal and I gave today at the Black Hat conference in Las Vegas.

Talk #1

1) Practical implementation of reliable and portable DMA attacks from Domain 0 to the Xen hypervisor memory.

2) Xen Loadable Modules :) A framework that allows to load arbitrary C code modules into the running Xen hypervisor. It uses DMA attack from the previous point to get access to Xen memory.

3) Two implementations of Xen Hypervisor Rootkits. This was the first time that working hypervisor rootkits have been presented (note the distinction between hypervisor rootkit vs. virtualization based rootkits).

Talk #2

1) Discussed how Xen 3.3 makes use of the Intel VT-d technology to protect the hypervisor.

2) Then we discussed how to bypass such VT-d protection on certain motherboards, like e.g. Intel DQ35 board.

3) An extra bonus: our attack from the previous point allows also to subvert the SMM handler and e.g. install an SMM rootkit in the system.

4) Discussed other Xen security mechanisms like driver domains, stub domains, PV GRUB and also attempted to quickly compare the state of Xen security design with the Hyper-V and ESX hypervisor.

5) Showed an exploitable heap overflow bug in the Xen hypervisor. The bug was in the FLASK module -- the NSA implementation of Xen Security Modules. FLASK, however, is not turned on by default, so even though we showed how to successfully exploit this heap overflow (which results in an escape from an unprivileged domain directly to the hypervisor), this is not a bug that can be used to 0wn The Planet. It shows, however, what happens when people start adding more and more code into the hypervisor.

6) Introduced HyperGuard -- a project done in cooperation with Phoenix Technologies. HyperGuard is going to be a SMM-based integrity scanner for Xen-like hypervisors. With HyperGuard we take a different approach then other integrity scanners do -- rather than ensuring the correctness of the code and data of the hypervisor, which might be very tricky, we instead ensure there is no untrusted code in the hypervisor, which is a much simpler task.

Talk #3

1) Provided detailed description of how to implement nested hardware based virtualization on AMD-V and VT-x (a copy of the slides from my RSA speech in April).

2) Showed how to use this nested virtualization to implement Blue Pill Boot, that can be used to virtualize the system right from the boot stage. We mentioned the best defend against this kind of system compromises is a trusted boot mechanism, either SRTM or DRTM, as implemented e.g. by Xen's tboot.

3) Consequently we showed Xen Blue Pill that is able to move a running Xen system into a virtual machine on the fly. This, on the other hand, cannot be prevented by neither the SRTM nor DRTM technology. XBP is a good example that running a legitimate hypervisor doesn't always prevent bluepill-like malware from being installed in the system.

4) Finally, discussed the XBP detection. First, we noted that all the "VMM detectors", proposed over the last years, that try to detect if there is a hypervisor running above, are useless in the case of a bluepilled Xen system. The only one approach that could be used is the direct timing analysis of the #VMEXIT times in order to distinguish between the native Xen case vs. bluepilled Xen case. We noted however, that direct timing analysis will not observe any differences when run from PV domains on AMD processors, and that it will observe little difference when run from HVM domains (7k vs. 5k cycles). The detection is easier on Intel processors, because of the unconditional #VMEXIT that we cannot get rid of.

All the three talks can be found here. \ No newline at end of file diff --git a/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html b/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html deleted file mode 100644 index 88fbc1b..0000000 --- a/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Attacking Xen: DomU vs. Dom0 consideration' -date: '2008-08-20T13:59:00.001+02:00' -author: Joanna Rutkowska -tags: -- xen hacking -modified_time: '2009-03-25T16:03:29.110+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5745634034617951424 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/attacking-xen-domu-vs-dom0.html ---- - -As it usually happens, there is some confusion regarding the attacks presented in our Xen 0wning Trilogy. Some people think they are possible only from Dom0 (the Xen's privileged, administrative domain) while some other people have the impression that all the attacks are possible from any unprivileged domain (DomU in Xen’s terminology). The truth is in the middle though.

Most of the attacks we presented do indeed require that the attacker first obtained access to Dom0 and only from there can launch further attacks. For example the DMA attacks that allow to overwrite hypervisor memory do indeed assume Dom0 access. The same applies to the Q35 exploit - this one is similar to the above mentioned DMA attacks in that it also requires access to certain hardware (that is possible from Dom0), but has an advantage that can bypass the hypervisor VT-d protection in the recent Xen 3.3.

There are several reasons why those attacks are still very important though:
1) First note, that the requirement for the attacker to have access to Dom0 in order to install e.g. hypervisor rootkits, is similar to the requirement that in order to install a Windows or Linux rootkit, one first needs to obtain administrator's privileges. Yet we know that Windows or Linux rootkits is a serious security problem.

2) Concerning the Xen-based systems specifically: over the last year several bugs have been discovered and published, that allowed an attacker to gain control of the Domain0 from an unprivileged domain (i.e. escape from the virtual machine). Rafal has discovered one such bug in December 2007.

3) Recent versions of Xen make deliberate effort to protect the hypervisor even from the Dom0. On systems that have IOMMU support (e.g. Intel's VT-d), the hypervisor memory is protected from tampering using both the processor's ring3/ring0 separation mechanism as well as the IOMMU protection. We showed that those protections can be bypassed.

The attempt to isolate hypervisor and protect it even from attacks originating from Dom0 is not surprising. After all if we would like to treat the hypervisor as a root of trust, then we should make sure that its code base is minimal. If we now allow Dom0 to effectively be the hypervisor (i.e. if we don't care about Dom0-to-hypervisor escalations) then we should include all the Dom0 code to the hypervisor code base, when evaluating hypervisor security. This would result in our "extended hypervisor" having not ~300k lines of code (like current Xen does), but millions of lines of code!

Having said that all about how important it is to prevent all the possible Dom0-to-hypervisor attacks, I should stress that we also presented an attack that does not require Dom0 access and that can be spawned from an unprivileged DomU domain. As far as I'm aware, Rafal's FLASK bug & exploit (presented in the 2nd presentation) was the first public example of a successful exploitation of an overflow in a bare-metal hypervisor. The bug was a heap overflow and Rafal presented some clever tricks of how to control the Xen's heap allocations in order to make this bug exploitable.

Please note that all the rootkit-like stuff that we also presented, i.e. Rafal's Xen Loadable Modules framework and his hypervisor rootkits, as well as Alex's and mine XenBluePill, can all be used with all the above mentioned attacks. So, e.g. if we are on a machine that has VT-d support and run Xen 3.3 we can still use the Q35 attack and get the XLM framework running and then use it to install e.g. XenBluePill on top of running Xen, as showed during the 3rd presentation. Similarly, we could use the FLASK exploit and get XLM running again and again used it for installation of the other stuff.

Hope this clears some confusion about our presentations. As already promised, the codes and demos and full version of the 2nd talk slides (with the Q35 attack details) will be posted after Intel release the patch for their motherboards. Stay tuned. \ No newline at end of file diff --git a/_posts/2008-08-26-intel-patches-q35-bug.html b/_posts/2008-08-26-intel-patches-q35-bug.html deleted file mode 100644 index 238ad62..0000000 --- a/_posts/2008-08-26-intel-patches-q35-bug.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Intel patches the Q35 bug -date: '2008-08-26T09:41:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:03:19.027+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2529149620297733085 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/intel-patches-q35-bug.html ---- - -Yesterday Intel has published an official advisory that addresses the Q35 bug and attack, that we used during Black Hat as one of the ways to subvert Xen 3.3 on a VT-d enabled system (the alternative way was to use the Xen-specific FLASK exploit, that worked even from an unprivileged domain).

One small clarification though: in the advisory they stated that: "Software running administrative (ring 0) privilege can under certain circumstances change code running in System Management Mode." But in fact an attacker might also use this bug to directly modify the hypervisor memory, without jumping into the SMM first, just as we did it with our exploit. Also, in case of e.g. Linux systems, the Ring0 access is not strictly required to perform the attack, as it's just enough for the attacker to get access to the PCI config space of the device 0:0:0, which e.g. on Linux can be granted to usermode applications via the iopl() system call.

You can download a new firmware for your motherboard from here.

Intel did a good job on handling this bug - not only they recognized the importance of the attack, but also released the patch promptly. Quite positively surprising as for such a big company.

So, now we're free to publish all the missing slides about how we exploit this vulnerability that we had to remove from our Black Hat presentation, as well as the exploit code. However, as I'm going to give 2 presentations at the upcoming ISF conference in Sweden early next week, I thought it would be logical to wait with disclosing this material and present it at this conference, during my technical speech (I will also deliver the keynote for this conference). Of course, as soon as I will get back home (Thursday next week), we will publish the full slides, exploit codes and all the demos, as promised earlier.

Speaking of speaking: also next month, Rafal will fly to Oregon, to Intel campus, for the Intel Virtualization Security Summit, where he will deliver a "compressed" version of our Xen 0wning Trilogy to the technical crowd of Intel employees. Rafal will provide some more details about the HyperGuard project that we do in cooperation with Phoenix Technologies. Also, in October, Alex will visit Kuala Lumpur and present an updated Bluepilling the Xen Hypervisor talk at the Hack In The Box conference. \ No newline at end of file diff --git a/_posts/2008-08-31-teamwork-crediting.html b/_posts/2008-08-31-teamwork-crediting.html deleted file mode 100644 index e55ad38..0000000 --- a/_posts/2008-08-31-teamwork-crediting.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Teamwork & Crediting -date: '2008-08-31T23:09:00.001+02:00' -author: Joanna Rutkowska -tags: -- company news -modified_time: '2009-03-25T16:02:48.376+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5145355901555942752 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/teamwork-crediting.html ---- - -As the technology is getting more and more complex, security research, especially offensive security research on a system level, becoming more and more difficult to be done by one person. NX/XD, ASLR, various StackGuard-like things, VT-d, TXT, etc... - all those technologies leave less and less space for the interesting system-level attacks. On the other hand, the widespread "deployment" of Web 2.0 creates a whole new area to explore, but that is a whole different world (plus there are still all those "human factor" attacks that exploit user stupidity, but again, this is a different area).

Our Xen 0wning Trilogy is a good example of how a team of researchers can still come up with interesting new system-level attacks against the very recent and securely design system. Take XenBluePill as an example.

It has first been months of research and coding done by Alex and myself to support nested hardware virtualization on AMD. Then there was months of Rafal's research about how to load code into the running Xen on the fly ("Xen Loadable Modules"). That required ability to access Xen's memory in the first place and Rafal's way for doing that was to use the DMA attack. But then it turned out that the Xen 3.3 uses VT-d protection to protect against this very kind of attacks. So then I came up with the "Q35 attack" that exploited a problem with recent Intel BIOSes on recent motherboards (details are coming this week). But I based my attack on a similar SMM attack that Rafal came up with a few months earlier on a different chipset, when he was looking into ways to compromise SMM handler, as we started thinking about HyperGuard project back then and Rafal was curious reliable the SMM protection is. In the meantime, Alex "converted" our working New Blue Pill that had full support for nested virtualization but was essentially a Windows driver, into a piece of code that was completely OS-independent (own memory management, etc.). Then I finally took Rafal's XLM framework, added a few minor things that were needed to load our "Windows-independent Windows driver" into Xen using XLM, fixed some minor stuff and... it finally worked! But that was possible only because of the joint work by all the three people together.

So, it is simply unfair to attribute all the glory and fame for our research to "Rutkowska" or "Rutkowska and team", as many news portals did. Please don't forget to credit all the co-authors! If you really would like to use a generic term, then "Invisible Things Lab team" would probably serve better.

Speaking of our team, I also have an announcement that starting this month our team has officially been extended by yet another person: Rong Fan from Beijing, China.

Rong is a software engineer, focusing on Intel's hardware virtualization technology (VT). A few months ago he wrote to me with some advanced questions regarding the implementation of our New BluePill that we published after the last year's Black Hat. Turned out that Rong, as part of his after-hour activity, is porting Bluepill to VT-x. After he succeeded, we decided to share our nested virtualization code for AMD with him so that he could investigate how to do it on VT-x. And about 2 months ago Rong succeeded with implementing full nested virtualization support for our NBP on Intel VT-x! During that time Rong has had an opportunity to find out that working with ITL is quite fun, so he decided to quit his job at Lenovo and joined ITL full time. Right now Rong is busy adding nested VT-x support to a normal Xen hypervisor.

So, Invisible Things Lab is all about the team work. The whole idea behind ITL is to gather together a bunch of smart people, so that we could all work on the most exciting problems together. Problems that might be too complex or time-consuming for just one person to solve. But it takes more then just money to get people to be creative and devote themselves to work. Getting recognition is one of the additional factors often needed. That's why ITL is not interested in "hiding" its employees, but rather in promoting their work and fairly crediting them. \ No newline at end of file diff --git a/_posts/2008-09-02-three-approaches-to-computer-security.html b/_posts/2008-09-02-three-approaches-to-computer-security.html deleted file mode 100644 index bc3b6b3..0000000 --- a/_posts/2008-09-02-three-approaches-to-computer-security.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: The three approaches to computer security -date: '2008-09-02T13:39:00.002+02:00' -author: Joanna Rutkowska -tags: -- philosophical -modified_time: '2009-03-25T16:02:02.252+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7438465495915995582 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/three-approaches-to-computer-security.html ---- - -If we looked at the computer systems and how they try to provide security, I think we could categorize those attempts into three broad categories:

1) Security by Correctness
2) Security by Isolation
3) Security by Obscurity

Let's discuss those categories in more detail below.

Security by Correctness

The assumption here is obvious: if we can produce software that doesn't have bugs (nor any maliciously behaving code), then we don't have security problems at all. The only problem is that we don't have any tools to make sure that a given code is correct (in terms of implementation, design and ethical behavior). But if we look at various efforts in computer science, we will notice a lot of effort has been made to achieve Security by Correctness: "safe" languages, code verifiers (although not sound ones, just heuristic based), developer's education, manual code audit, etc. Microsoft's famed Secure Development Life-cycle is all about Security by Correctness. The only problem is: all those approaches sometimes work and sometimes do not, sometimes they miss some bug and also there are problems that I simple don't believe can be addresses by automatic code verifiers or even safe languages, like e.g. logic/design bugs or deciding on wheatear a given code behaves maliciously or not (after all this is an ethical problem in many cases, not a computer science problem).

To sum it: I think that in some more or less distant future (some people think abuout a timeframe of 50 years or so), we would get rid of all the implementation bugs, thanks to safe languages and/or sound code verifiers. But I don't believe we could assure correctness of software on any higher level of abstraction then implementation level.

Security by Isolation

Because of the problems with effectively implementing Security by Correctness approach, people, from the very beginning, has also taken another approach, which is based on isolation. The idea is to split a computer system into smaller pieces and make sure that each piece is separated from the other ones, so that if it gets compromised/malfunctions, then it cannot affect the other entities in the system. Early UNIX's user accounts and separate process address spaces, things that are now present in every modern OS, are examples of Security by Isolation.

Simple as it sound, in practice the isolation approach turned out to be very tricky to implement. One problem is how to partition the system into meaningful pieces and how to set permissions for each piece. The other problem is implementation - e.g. if we take a contemporary consumer OS, like Vista, Linux or Mac OSX, all of them have monolithic kernels, meaning that a simple bug in any of the kernel components (think: hundreds of 3rd party drivers running there), allows to bypass of the isolation mechanisms provided by the kernel to the rest of the system (process separation, ACLs, etc).

Obviously the problem is because the kernels are monolithic. Why not implement Security by Isolation on a kernel level then? Well, I would personally love that approach, but the industry simply took another course and decided that monolithic kernels are better then micro-kernels, because it's easier to write the code for them and (arguably) they offer better performance.

Many believe, including myself, that this landscape can be changed by the virtualization technology. Thin bare-metal hypervisor, like e.g. Xen, can act like a micro kernel and enforce isolation between other components in the system - e.g. we can move drivers into a separate domain and isolate them from the rest of the system. But again there are challenges here on both the design- as well as the implementation-level. For example, we should not put all the drivers into the same domain, as this would provide little improvement in security. Also, how to make sure that the hypervisor itself is not buggy?

Security by Obscurity (or Security by Randomization)

Finally we have the Security by Obscurity approach that is based on the assumption that we cannot get rid of all the bugs (like in Security by Isolation approach), but at least we can make exploitation of those bugs very hard. So, it's all about making our system unfriendly to the attacker.

Examples of this approach include Address Space Layout Randomization (ASLR, present in all newer OSes, like Linux, Vista, OSX), StackGuard-like protections (again used by most contemporary OSes), pointer encryption (Windows and Linux) and probably some other mechanisms that I can't remember at the moment. Probably the most extreme example of Security by Obscurity would be to use a compiler that generates heavily obfuscated binaries from the source code and creates a unique (on a binary level) instances of the same system. Alex did his PhD on this topic and his an expert on compilers and obfuscators.

The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).

I wonder if the above categorization is complete and if I haven't forgotten about something. If you know an example of a security approach that doesn't fit here (besides blacklisiting), please let me know! \ No newline at end of file diff --git a/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html b/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html deleted file mode 100644 index 32ed18b..0000000 --- a/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Xen 0wning Trilogy: code, demos and q35 attack details posted' -date: '2008-09-06T13:59:00.001+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- xen heap exploiting -- virtualization based rootkits -modified_time: '2009-03-25T16:01:52.715+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7367970431147576824 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/xen-0wning-trilogy-code-demos-and-q35.html ---- - -We have posted all the code that we used last month during our Black Hat presentations about Xen security, and you can get it here. This includes the full source code for:
1) The generic Xen Loadable Modules framework
2) Implementation of the two Xen Hypervisor Rootkits
3) The Q35 exploit
4) The FLASK heap overflow exploit
5) The BluePillBoot (with nested virtualization support on SVM)
6) The XenBluePill (with nested virtualization support on SVM)

Beware the code is by far not user-friendly, it requires advanced Linux/Xen, C and system-level programming skills in order to tweak some constants and run it successfully on your system. Do not send us questions how to compile/run it, as we don’t have time to answer such questions. Also do not send questions how the code works – if you can’t figure it out by reading our slides and the source code, then it means you should probably spend more time on this yourself. On the other hand, we would appreciate any constructive feedback.

The code is our gift to the research community. There is no warranty and Invisible Things Lab takes no responsibility for any potential damage that this code might cause (e.g. by rebooting your machine) or any potential malicious usage of this code, or any other code built on top of this code. We believe that by publishing this code we help to create more secure systems in the future.

Additionally, we also posted the full version of our second Black Hat talk, which now includes all the slides about the Q35 bug and how we exploited it. Those slides had to be previously removed during our Black Hat presentation, as the patch was still unavailable during that time. \ No newline at end of file diff --git a/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html b/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html deleted file mode 100644 index 4c01adf..0000000 --- a/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Microsoft executive "rebuts" our research! -date: '2008-09-07T09:54:00.004+02:00' -author: Joanna Rutkowska -tags: -- bad guys attacking joanna -- fighting for a better world -modified_time: '2009-03-25T16:01:39.482+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-718012832586397028 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/microsoft-executive-rebuts-our-research.html ---- - -Ah, there is no feeling like seeing your name in the news when drinking your morning coffee... In this piece some Steve Riley, a senior security strategist at Microsoft, decided to "rebute" our recent Black Hat presentations research results.

Mr. Riley had been quoted by ZDnet as saying:

"Her [Joanna Rutkowska] insistence is that you can replace the hypervisor without anybody knowing... Our assertion is that this is incorrect," Riley told the audience. "First of all, to do these attacks you need to become administrator at the root. So that's going to be, on an appropriately configured machine, an exceedingly difficult thing to happen."

Apparently, Mr. Riley has never seen our Black Hat presentations (or slides at least) that he is referring to (oh, wait, that is the typical case with all our "refuters", how come?)...

First, we never said anything about replacing the hypervisor. I really have no idea how this idea was born in Mr. Riley's head? Replacing the hypervisor - that would indeed be insane for us to do!

Second, it is not true that the attacker needs to become an administrator "at the root" (he mean the root partition or administrative domain here I assume). The attack we presented in our second speech, that exploited a heap overflow in the Xen hypervisor FLASK module, could have been conducted from the unprivileged domain, as we demonstrated during the presentation.

Mr. Riley continues with his vision:

"Because you [the attacker] didn't subject your own replacement hypervisor through the thorough design review that ours did, I'll bet your hypervisor is probably not going to implement 100 percent of the functionality as the original one," Riley said. "There will be a gap or two and we will be able to detect that."

Well, if he only took the effort of looking into our slides, he would realize that, in case of XenBluePill, we were slipping it beneath (not replacing!) the original hypervisor, and then run the original one as nested. So, all the functionality of the original hypervisor was preserved.

Mr. Riley also shares some other ground breaking thoughts in this article, but I think we can leave them uncommented ;)

This situation is pretty funny actually - we have here the words and feelings of some Microsoft executive vs. our three technical presentations, all the code that we released for those presentations, and also a few of our demos. Yet, it's apparently still worth getting into the news and reporting what the feeling of Mr. Riley are...

Let me, however, write one more time, that I'm (still) not a Microsoft hater. There are many people at Microsoft that I respect: Brandon Baker, Neil Clift, the LSD guys, Mark Russinovich, and probably a few more that I just haven't had occasion to meet in person or maybe forgot about at the moment. It's thus even more sad that people like Mr. Riley are also associated with Microsoft, even more they are the face of Microsoft for the majority of people. Throwing a party in Vegas and Amsterdam once a year certainly is not enough to change the Microsoft's image in this case...

Interestingly, if Mr. Riley only attended our Xen 0wning Trilogy at Black Hat, then he would notice that we were actually very positive about Hyper-V. Of course, I pointed out that Xen 3.3 certainly has a more secure architecture right now, but I also said that I knew (from talking to some MS engineers from the virtualization group) that Hyper-V is going to implement similar features in the next version(s) and that this is very good. I also prized the fact it has only about 100k LOC (vs. about 300k LOC in Xen 3.3).

So, Mr. Senior Security Strategist, I suggest you do your homework more carefully next time before throwing mud at others and trying to negate the value of their work (and all the efforts of Microsoft's PR people).

On a separate note, I found it quite unprofessional that ZDNet's Liam Tung and Tom Espiner, the authors of the news, didn't ask me for a commentary before publishing this. Not to mention that they also misspelled Rafal's name and forgot to mention about Alex, the third co-author of the presentations. \ No newline at end of file diff --git a/_posts/2009-01-05-attacking-intel-trusted-execution.html b/_posts/2009-01-05-attacking-intel-trusted-execution.html deleted file mode 100644 index 63869e4..0000000 --- a/_posts/2009-01-05-attacking-intel-trusted-execution.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Attacking Intel® Trusted Execution Technology -date: '2009-01-05T16:30:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- trusted execution technology -- trusted computing -- exploit -modified_time: '2009-03-19T22:20:19.253+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SWI4MzG1jdI/AAAAAAAAADU/xaj6gqT72bQ/s72-c/processor+padlock.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1619925805743086461 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/attacking-intel-trusted-execution.html ---- - -

Press people: please read our press release first and also refer to the disclaimer at the end of this blog post. Thank you!

Update: 1/5/2009 19:21 CEST: minor typos/spelling corrections. Thanks to Jarred for point out some of the typos.

A word about Trusted Computing
The term Trusted Computing and related technologies, like Palladium, Trusted Platform Module, LaGrande, have always caused lots of controversy in the IT world. Most of the fear, however, has been a result of the lack of understanding of how a particular technology really works.

Nevertheless, Trusted Computing is becoming part of our lives, whether we want it or not. These days almost every new laptop comes with an on-board Trusted Platform Module (TPM). Microsoft's Palladium initiative have been renamed so many times in the recent years, that probably even people working at Microsoft are confused now. Nevertheless, some of the Palladium technologies made their way into Vista, and Microsoft BitLocker is, without doubt, the most successful, widely deployed product that is based on the idea of Trusted Computing. (In fact the Bitlocker is the only one thing that I really have been missing since I switched from Vista to Mac some time ago).

On the hardware side, besides the famed TPM, we also have had the LaGrande technology, that is often connected with things such as Remote Attestation, Protected Execution and other scary terms…

A word about Trusted Execution Technology
LaGrande, recently renamed Trusted Execution Technology (TXT), is Intel's response to the Trusted Computing trend. TXT is currently part of the vPro™ brand, and for about a year now users can buy a vPro/TXT compatible hardware in regular computer stores (the first one was the DQ35J desktop board with certain Core 2 Duo processors, which I was able to buy at the end of 2007 — remember that TXT requires support from both the CPU and the chipset).

TXT is not an alternative to TPM, in fact TXT heavily relies on the TPM to provide basic services like e.g. secure storage of measurements done by the TXT. Also, Palladium, or whatever it is called these days, is not a competition to TXT. Intel TXT can provide building blocks to e.g. Vista Bitlocker, arguably making it more secure then it is now (Current Bitlocker implementation, AFAIK, relies on a so called Static Root of Trust for Measurement, which requires TPM, but not TXT).

What kind of measurement would TXT like to store in our TPM? Well, the whole TXT is, in fact, all about making and storing software measurements, or, using a more familiar language, secure hashes of certain software components.

The sole purpose of Intel TXT technology is to provide a trusted way for loading and executing system software, e.g. Operating System kernel or Virtualization Machine Monitor. What is extraordinary here is that TXT doesn't make any assumptions about the state of the system before loading the software, thus making it possible for a user to ensure secure load of an OS or VMM, even in a potentially compromised machine.

In other words, our system can be all full of boot sector viruses and BIOS rootkits, and god-knows-what-else, and still TXT should allow to load a clean VMM (or OS kernel) in a secure way, immune to all those rootkits present in the system in a moment just before the load process. This TXT-supported load process is called Late Launch, and is implemented via a special new CPU instruction called SENTER.

It's a good place to mention that AMD has its own version of the late launch implemented via SKINIT instruction. We haven't looked at the AMD technology thoroughly yet, so I will refrain from commenting on this.

The late launch is a pretty amazing thing, when we think about. It promises to effectively provide all the benefits of a computer restart without actually restarting it.

It is hard to overemphasize the potential impact that a technology such as TXT could have on computer security. One can immediately see that it could eliminate all the system-level persistent malware — in other words we can easily build systems (VMMs or even standard OSes) that would be immune to attacks that try to compromise system binaries on disk, or attack the system right from the bootloader or BIOS. Combining this with VT-x and VT-d technologies, system developers (for the first time, at least as far as the "PC" platform is considered) have gotten extremely strong tools into their hands that should allow them to create really secure VMMs and OSes…

Hopefully by now, my Dear Reader, you should have the feeling what kind of an animal Intel TXT is and how desperately the world needs it...

And now, we are going to move on and show practical attacks on current TXT implementations... :)

Attacking Intel TXT!
Ok, not in this post today, but rather at the upcoming Black Hat conference in Washington, DC in February. Over the recent months, Rafal and I have been looking at the Intel TXT technology as part of a work done for a customer, to see if this could be used to improve security of a product, from a typical user's perspective. We figured out that it definitely could, but that there are also some issues…

And those "issues" gave us a starting point in developing a proof-of-concept (albeit very reliable) exploit that shows how we can bypass trusted boot process implemented by Intel's tboot.

Tboot, which is also part of (scroll down to the end of the page) the Xen hypervisor, can be though of as a reference implementation of TXT-based system loader, that could be used to securely load either the Xen hypervisor or the Linux kernel, when run on a vPro/TXT compatible hardware.

[copy-and-paste from the press release follows]

Our attack comprises two stages. The first stage requires an implementation flaw in a specific system software. The second stage of the attack is possible thanks to a certain design decision made in the current TXT release.

While evaluating the effectiveness of the Intel® TXT technology, as part of a work done for a customer, we have identified several implementation flaws in the Intel's system software, which allowed to conduct the above mentioned stage-one attack. We have provided Intel with extensive description of the flaws in December 2008, and Intel is currently working on fixing those vulnerabilities.


We have also been in touch with Intel about the possibility of conducting the second-stage attack since November 2008. In December, after providing Intel with the details about the first-stage attack, Intel promised to release, in the coming weeks, an updated TXT specification for developers that would explain how to design their TXT-based loaders in such a way that they are immune to our attack. Intel claims the current Intel® TXT release does contain the basic building blocks that could be used to prevent our second-stage attack and the release of the additional specification would make it feasible in practice.


More details in February in DC :)

TXT useless?
Some people are skeptical about the TXT technology, and not only because of the Irrational Fear of the Trusted Computing (IFTC), but rather because they point out to the complexity of the whole technology. The complexity is bad, because 1) it leaves more space for potential attacks, and 2) it discourages developers (ISVs) from using the technology in their products (e.g. neither Microsoft, nor VMWare make use of TXT in any of their bare-metal hypervisors, even though TXT is very well suited for this kind of software).

It is true that TXT is a very complex technology (the SENTER instruction is probably the masterpiece of the CISC architecture!), but I personally like it. In my opinion this is the first technology available for the PC platform that has the potential to really change something, much more then the NX-feature did a few years ago. Before people will run to the comment box — if you would like to argue about the usefulness/uselessness of Trusted Computing/TXT, please base your opinions on technical facts (read the spec!) and not on your feelings!

Disclaimer (for press)

Starting January 2009, we (at Invisible Things Lab), decided to issue press releases in addition to this blog. The general rule is: press releases are written for journalists, while the blog is mainly written for other researchers, security enthusiast, etc.

The wording of our press releases is carefully chosen to minimize the potential of a possible misinterpretation. The press releases carry less information, but, we think, are better suited for a more general public, that doesn't have background in computer science, programming and security.

The blog is written in a much more casual way, without thinking for half an hour on every sentence. The articles on this blog might present some facts as extremely exciting, because e.g. for me, a person deeply involved in a system-level security research, they indeed might be very exciting, which might not be the case for a general audience. I sometimes might also use shortcuts, metaphors, or irony, and other figures of speech, that might not necessarily be obvious for a more general public.

If you are a journalist and you think you just found something very sensational on my blog, I would suggest that you double-check with me, before writing about it.

Thank you for your cooperation.
Joanna Rutkowska,
Founder and CEO,
Invisible Things Lab. \ No newline at end of file diff --git a/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html b/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html deleted file mode 100644 index 2565217..0000000 --- a/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Why do I miss Microsoft BitLocker? -date: '2009-01-21T18:52:00.009+01:00' -author: Joanna Rutkowska -tags: -- bitlocker -- disk encryption -- tpm -- trusted computing -modified_time: '2009-03-19T22:20:07.269+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SXdjHwkIqMI/AAAAAAAAADo/l3tgqzzQ4Es/s72-c/evil+maid.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-104514077420707012 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/why-do-i-miss-microsoft-bitlocker.html ---- - -In the previous post, I wrote the only one thing I really miss after I've switched from Vista to Mac is the BitLocker Driver Encryption. I thought it might be interesting for others to understand my position, so below I describe why I think BitLocker is so cool, and why I think other system disk encryption software sucks.

So, it's all about the Trusted Boot. BitLocker does make use of a trusted boot process, while all the other system encryption software I'm aware of, does not. But why the trusted boot feature is so useful? Let's start with a quick digression about what the trusted boot process is…

Trusted boot can be implemented using either a Static Root of Trust or a Dynamic Root of Trust.

The Static Root of Trust approach (also known as Static Root of Trust Measurement or SRTM) is pretty straightforward — the system starts booting from some immutable piece of firmware code that we assume is always trusted (hence the static root) and that initiates the measurement process, in which each component measures the next one in a chain. So, e.g. this immutable piece of firmware will first calculate the hash of the BIOS and extend a TPM's PCR register with the value of this hash. Then the BIOS does the same with the PCI EEPROMs and the MBR, before handling execution to them. Then the bootloader measures the OS loader before executing it. And so on.

An alternative method to implementing trusted boot is to use Dynamic Root of Trust (often called Dynamic Root of Trust Measurement or DRTM). Intel's TXT technology, formerly LaGrande, is an example of a DRTM (more precisely: TXT is more than just DRTM, but DRTM is the central concept on which TXT is built). We will be talking a lot about TXT next month at Black Hat in DC :) This will include discussion of why DRTM might sometimes be preferred over SRTM and, of course, what are the challenges with both.

Essentially, both SRTM and DRTM, in the context of a trusted boot, are supposed to provide the same: assurance the system that just booted is actually the system that we wanted to boot (i.e. the trusted one) and not some modified system (e.g. compromised by an MBR virus).

BitLocker uses the Static Root of Trust Measurement. SRTM can really make sense when we combine it with either TPM sealing or attestation feature. BitLocker uses the former to make sure that only the trusted system can get access to the disk decryption key. In other words: BitLocker relies on the TPM that it will unseal (release) the decryption key (needed to decrypt the system partition) when and only when the state of chosen PCR registers is the same is it was when the decryption key was sealed into the TPM.

Ok, why is this trusted boot process so important for the system disk encryption software? Because it protects against a simple two-stage attack:
  1. You leave your laptop (can be even fully powered down) in a hotel room and go down for a breakfast… Meanwhile an Evil Maid enters your room. She holds an Evil USB stick in her hand and plugs it into your laptop and presses the power button. The system starts and boots from the USB. An Evil version of something similar to our BluePillBoot gets installed into the MBR (or to a PCI EEPROM). This Evil Program has only one task — to sniff out the encryption software's password/PIN and then report it back to the maid next time she comes...
  2. So, you come back to your room to brush your teeth after the breakfast. Obviously you cannot refrain from not turning on your laptop for a while. You just need to enter your disk encryption passphrase/PIN/whatever. Your encryption software happily displays the prompt, like if nothing happened. After all how could it possibly know the Evil Program, like BluePillBoot, has just been loaded a moment ago from the MBR or a PCI EEPROM? It can not! So, you enter the valid password, your system gets the decryption key and you can get access to your encrypted system...
  3. But then you have an appointment at the hotel SPA (at least this little fun you can have on a business trip, right?). Obviously you don't want to look so geeky and you won't take your laptop with you to the SPA, will you? The Evil Maid just waited for this occasion… She sneaks again into your room and powers up your laptop. She presses a magic key combo, which results in the Evil Program displaying the sniffed decryption password. Now, depending on their level of subtleness, she could either steal your whole laptop or only some more important data from the laptop. Your system disk encryption software is completely useless against her now.
(Yes, I know that's 3 bullets, but the Evil Maid had to sneak into your room only twice:)

So, why the BitLocker would not allow for this simple attack? Because the BitLocker software should actually be able to know that the system gets compromised (by the Evil Program) since the last boot. BitLocker should then refuse to display a password prompt. And even if it didn't and asked the user for the password, still it should not be able to get the actual decryption key out from the TPM, because the values in the certain PCR register(s) will be wrong (they will now account for the modified hashes of the MBR or PCI EEPROM or BIOS). The bottom line is: the maid is not getting the decryption key (just as the user now), which is what this is all about.

At least this is how the BitLocker should work. I shall add a disclaimer here, that neither myself, nor anybody from my team, have looked into the BitLocker implementation. We have not, because, as of yet, there have been no customers interested in this kind of BitLocker implementation evaluation. Also, I should add that Microsoft has not paid me to write this article. I simply hope this might positively stimulate other vendors, like e.g. TrueCrypt (Hi David!), or Apple, to add SRTM or, better yet, DRTM, to their system encryption products.

Of course, when we consider an idiot-attack, that involves simply garbbing somebody's laptop and running away with it (i.e. without any prior preparation like our Evil Maid did), then probably all system disk encryption software would be just good enough (assuming it doesn't have any bugs in the crypto code).

Some people might argue that using a BIOS password would be just as good as using trusted boot. After all, if we disable booting from alternate media in BIOS (e.g. from USB sticks) and lock down the BIOS using a password (i.e. using the Power-On password, not just the BIOS supervisor password), then the above two-stage attacks should not be feasible. Those people might argue, that even if the Evil Maid had cleared the CMOS memory (by removing the CMOS battery from the motherboard), still they would be able to notice that something is wrong — the BIOS would not longer be asking for the password, or the password would be different from what they used before.

That is a valid point, but relaying on the BIOS password to provide security for all your data might not be such a good idea. First problem is that all the BIOSes have had a long history of various default or "maintenance" passwords (I actually do not know how the situation looks today with those default passwords). Another problem is that the attacker might first clear the CMOS memory, and then modify her Evil MBR program to also display a fake BIOS password prompt, that would accept anything the user enters. This way the user will not be alerted that something is wrong and will be willing to provide the real password for drive decryption when prompted later by the actual drive encryption software.

One might ask why can't the attacker use the similar attack against BitLocker? Even if the real BitLocker uses trusted boot process, we can still infect the MBR, display the fake BitLocker PIN prompt and this way get into the possession of the user's PIN.

This attack, however, can be spotted by an inquisitive user — after all, if he or she knows they provided the correct PIN, then it would be suspicious not to see the system being booted (and it won't boot, because the fake BitLocker will not be able to retrieve the password from the TPM). If the fake BitLocker wanted to boot the OS (so that user didn't suspect anything), it would have to remove itself from the system and then reboot the system. Again this should alert the user that something wrong is going on.

There is also a much more elegant way of defending against the above attack (with fake BitLocker prompt) — but I'd rather let Microsoft to figure it out by themselves ;)

By the way, contrary to a popular belief the BitLocker doesn't protect your computer from boot-stage infections, e.g. MBR viruses or BIOS/PCI rootkits. As we have been pointing out since the first edition of our Understanding Stealth Malware training at Black Hat in August 2007, BitLocker should not be thought as of a system integrity protection. This is because it is trivial, for any malware that already got access to the running Vista, to re-seal the BitLocker key to arbitrary new system firmware/MBR configuration. Everybody can try it by going to Control Panel/BitLocker Driver Encryption, then clicking on the "Turn Off BitLocker" and choosing "Disable BitLocker Drive Encryption". This will simply save your disk decryption key in plaintext, allowing you to e.g. reflash your BIOS, boot Vista again and then to enable BitLocker again (this would generate a new key and seal it to the TPM with the new PCR values).


This functionality has been provided obviously to allow user to update his or her firmware. But what is important to keep in mind is that this process of disabling BitLocker doesn't involve entering any special password or PIN (e.g. the BitLocker's PIN). It just enough that you are the default user with admin rights or some malware running in this context. Pity they decided on the simplest solution here. But still BitLocker is simply the one coolest thing in Vista and something I really miss on all other OSes... \ No newline at end of file diff --git a/_posts/2009-01-26-closed-source-conspiracy.html b/_posts/2009-01-26-closed-source-conspiracy.html deleted file mode 100644 index cdc991b..0000000 --- a/_posts/2009-01-26-closed-source-conspiracy.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Closed Source Conspiracy -date: '2009-01-26T17:56:00.004+01:00' -author: Joanna Rutkowska -tags: -- philosophical -modified_time: '2009-03-19T22:19:30.493+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5520926602674392865 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/closed-source-conspiracy.html ---- - -Many people in the industry have an innate fear of closed source (AKA proprietary software), which especially applies to everything crypto-related.

The usual arguments go this way: this (proprietary) crypto software is bad, because the vendor might have put some backdoors in there. And: only the open source crypto software, which can be reviewed by anyone, can be trusted! So, after my recent post, quite a few people wrote to me and asked how I could defend such an evil thing as BitLocker, which is proprietary, and, even worse, comes from Microsoft?

I personally think this way of reasoning sucks. In majority of cases, the fact something is distributed without the accompanying source code does not prevent others from analyzing the code. We do have advanced disassemblers and debuggers, and it is really not that difficult to make use of them as many people think.

Of course, some heavily obfuscated programs can be extremely difficult to analyze. Also, analyzing a chipset's firmware, when you do not even know the underlying CPU architecture and the I/O map might be hard. But these are special cases and do not apply to majority of software, that usually is not obfuscated at all.

It seems like the argument of Backdoored Proprietary Software usually comes from the open-source people, who are used to unlimited accesses to the source code, and consequently do not usually have much experience with advanced reverse engineer techniques, simply because they do not need them in their happy "Open Source Life". It's all Darwinism, after all ;)

On the other hand, some things are hard to analyze, regardless of whether the source code is available or not, think: crypto. Also, how many of you who actively use open source crypto software, e.g. TrueCrypt or GnuPG, have actually reviewed the source code? Anyone?

You might be thinking — maybe I haven't looked at the source code myself, but because it is open source, zillions of other users already have reviewed it. And if there was some backdoor in there, they would undoubtedly have found it already! Well, for all those open source fetishists, who blindly negate the value of anything that is not open source, I have only one word to say: Debian.

Keep in mind: I do not say closed source is more secure than open source — I only resist the open-source fundamentalism, that defines every proprietary software as inherently insecure, and everything open source as ultimately secure.

So, how should one (e.g. a government institution) verify security-level of a given crypto software, e.g. to ensure there are no built-in backdoors in there? I personally doubt it could be performed by one team, as it just usually happens that the same people who might be exceptionally skilled in code review, system-level security, etc, at the same time are average cryptographers and vice-versa.

Imagine e.g. that you need to find out if there are any weaknesses in your system drive encryption software, something like BitLocker. Even if you get access to the source code, you still would have to analyze a lot of system-level details — how is the trusted boot implemented (SRTM? DRTM? TPM interaction?), which system software is trusted, how the implementation withstands various not-crypto-related attacks (e.g. some of the attacks I described in my previous post), etc…

But this all is just system-level evaluation. What should come later is to analyze the actual crypto algorithms and protocols. Those later tasks fall into cryptography field and not into system-level security discipline, and consequently should be performed by some other team, the crypto experts.

So, no doubt, it is not an easy task, and the fact if there is or there is not C/C++ source code available, is usually one of the minor headaches (a good example is our attack on TXT, where we were able to discover bugs in Intel's specific system software, which, of course, is not open source). \ No newline at end of file diff --git a/_posts/2009-02-10-nesting-vmms-reloaded.html b/_posts/2009-02-10-nesting-vmms-reloaded.html deleted file mode 100644 index 2eb5f40..0000000 --- a/_posts/2009-02-10-nesting-vmms-reloaded.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Nesting VMMs, Reloaded. -date: '2009-02-10T18:30:00.007+01:00' -author: Joanna Rutkowska -tags: -- xen hacking -- nested virtualization -modified_time: '2009-03-19T22:19:50.619+01:00' -thumbnail: http://3.bp.blogspot.com/_Ti3q3Hdvels/SZG7hylIacI/AAAAAAAAAD4/hjm246CQygk/s72-c/XP+inside+VPC+inside+Vista+inside+Xen.001.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-8942873381242351403 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/02/nesting-vmms-reloaded.html ---- - -Besides breaking the Intel's stuff, we have also been doing other things over at our lab. Thought I would share this cool screenshot of a Virtual PC running inside Xen. More precisely what you see on the pic is: Windows XP running inside Virtual PC, that runs inside Vista, which itself runs inside a Xen's HVM VM. Both the Virtual PC and Xen are using the Intel's hardware virtualization (VT-x is always used for HVM guests on Xen).

Our Nested Xen patch is part of a work done for a customer, so it is not going to be published. Besides it is currently a bit unstable ;) It's just a prototype that shows such a thing could be done.

\ No newline at end of file diff --git a/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html b/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html deleted file mode 100644 index 0c35932..0000000 --- a/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html +++ /dev/null @@ -1,18 +0,0 @@ ---- -layout: post -title: 'Attacking Intel TXT: paper and slides' -date: '2009-02-19T22:23:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- tpm -- trusted execution technology -- trusted computing -- smm -- exploit -modified_time: '2009-03-19T22:23:04.772+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6448095799043943721 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/02/attacking-intel-txt-paper-and-slides.html ---- - -The new press release covering the basic details about our TXT attack is here.

The paper is here.

The slides converted to a PDF format are here. There is also an original version of slides in the Keynote format here for the Mac people. And for all the other people who don't use Mac, but still value the aesthetics (?!), I have also generated a QuickTime clickable movie out from the Keynote slides -- it can be found here, but it weighs 80MB.

Enjoy. \ No newline at end of file diff --git a/_posts/2009-03-13-independent-attack-discoveries.html b/_posts/2009-03-13-independent-attack-discoveries.html deleted file mode 100644 index 0149202..0000000 --- a/_posts/2009-03-13-independent-attack-discoveries.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Independent Attack Discoveries -date: '2009-03-13T13:22:00.004+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:53.049+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8073648126971577076 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/independent-attack-discoveries.html ---- - -Next week's Thursday, March 19th, 1600 UTC, we will publish a paper (+ exploits) on exploiting Intel® CPU cache mechanisms.

The attack allows for privilege escalation from Ring 0 to the SMM on many recent motherboards with Intel CPUs. Interestingly, the very same attack will be presented by another researcher, Loic Duflot, at the CanSecWest conference in Vancouver, Canada, on... Thursday 19th, 1600 UTC. BTW, this is a different SMM-targeting attack than the one we mentioned during our recent TXT talk and that is scheduled to be presented later this year.

Here's the full story (there is also a moral at the end) …

Just after our presentation at the Black Hat last month, we (i.e. Rafal and I) have been independently approached by some person (or two different persons — we haven't figured that out actually — there were some ca. 30 people willing to ask us questions after the talk, so it's hard to remember all the faces), who was very curious about our SMM attacks (whose details we haven't discussed, of course, because Intel is still working on a fix). This person(s) started asking various questions about the attacks and one of the questions, that was asked to both me and Rafal, was if the attack used caching. Later that day, during a private ITL dinner, one of us brought this issue, and we started thinking if it was indeed possible to perform an SMM attack via CPU caching. By the end of the dinner we have sketched out the attack, and later when we got back to Poland, Rafal implemented a working exploit with code execution in SMM in a matter of just a few hours. (I think I used way too many parenthesis in this paragraph).

So, being the good and responsible guys that we are, we immediately reported the new bug to Intel (actually talking to Intel's PSIRT is getting more and more routined for us in the recent months ;). And this is how we learnt that Loic came up with the same attack (back then there was no talk description at the conference website) — apparently he approached Intel about this back in October 2008, so 3-4 months before us — and also that he's planning to present it at the CanSecWest conference in March. So, we contacted Loic and agreed to do coordinated disclosure next Thursday.

Interestingly, however, none of us was even close to being the first discoverer of the underlying problem that our attacks exploit. In fact, the first mention of the possible attack using caching for compromising SMM has been discussed in certain documents authored as early as the end of 2005 (!) by nobody else than... Intel's own employees. Stay tuned for the details in our upcoming paper.

Conclusion

If there is a bug somewhere and if it stays unpatched for enough time, it is almost guaranteed that various people will (re)discover and exploit it, sooner or later. So, don't blame researchers that they find and publish information about bugs — they actually do a favor to our society. Remember the guy who asked us if our attack used caching? I bet he (or his associates) also have had exploits for this caching bug, but apparently didn't notify the vendor. Hmm, what they might have been doing with the exploit? When was the last time you scanned your system for SMM rootkits? ;)

Anyways, congrats to Loic for being the first one who wrote exploits for this bug. Also congrats to Intel employees who originally noticed the problem back in 2005. \ No newline at end of file diff --git a/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html b/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html deleted file mode 100644 index d4080c9..0000000 --- a/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Attacking SMM Memory via Intel® CPU Cache Poisoning -date: '2009-03-19T17:02:00.001+01:00' -author: Joanna Rutkowska -tags: -- attack -- smm -- exploit -modified_time: '2009-03-25T15:08:59.440+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7397577755549629314 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/attacking-smm-memory-via-intel-cpu.html ---- - -As promised, the paper and the proof of concept code has just been posted on the ITL website here.

A quote from the paper:
In this paper we have described practical exploitation of the CPU cache poisoning in order to read or write into (otherwise protected) SMRAM memory. We have implemented two working exploits: one for dumping the content of SMRAM and the other one for arbitrary code execution in SMRAM. This is the third attack on SMM memory our team has found within the last 10 months, affecting Intel-based systems. It seems that current state of firmware security, even in case of such reputable vendors as Intel, is quite unsatisfying.

The potential consequence of attacks on SMM might include SMM rootkits [9], hypervisor compromises [8], or OS kernel protection bypassing [2].
Don't worry, the shellcode we use in the exploit is totally harmless (have really no idea how some people concluded we were going to release an SMM rootkit today?) — it only increases an internal counter on every SMI and jumps back to the original handler. If you want something more fancy, AKA SMM rootkits, you might want to re-read Sherri's and Shawn's last year's Black Hat paper and try writing something they describe there.

The attack presented in the paper has been fixed on some systems according to Intel. We have however found out that even the relatively new boards, like e.g. Intel DQ35 are still vulnerable (the very recent Intel DQ45 doesn't seem to be vulnerable though). The exploit attached is for DQ35 board — the offsets would have to be changed to work on other boards (please do not ask how to do this).

Keep in mind this is a different SMM attack than the one we mentioned during our last month's Black Hat presentation on TXT bypassing (the VU#127284). We are planning to present that other attack at the upcoming Black Hat Vegas. Hopefully this will not be the only one thing that ITL will entertain you with in Vegas — Alex and Rafal are already working now on something even cooler (and even lower level) for the show, so cross your fingers!

And good luck to Loic with his presentation that is about to start just now... \ No newline at end of file diff --git a/_posts/2009-03-20-sky-is-falling.html b/_posts/2009-03-20-sky-is-falling.html deleted file mode 100644 index 8cdec2b..0000000 --- a/_posts/2009-03-20-sky-is-falling.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: The Sky Is Falling? -date: '2009-03-20T17:20:00.003+01:00' -author: Joanna Rutkowska -tags: -- philosophical -- fighting for a better world -modified_time: '2009-06-05T12:18:45.340+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6224623698776609952 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/sky-is-falling.html ---- - -A few reporters asked me if our recent paper on SMM attacking via CPU cache poisoning means the sky is really falling now?

Interestingly, not many people seem to have noticed that this is the 3rd attack against SMM our team has found in the last 10 months. OMG :o

But anyway, does the fact we can easily compromise the SMM today, and write SMM-based malware, does that mean the sky is falling for the average computer user?

No! The sky has actually fallen many years ago… Default users with admin privileges, monolithic kernels everywhere, most software unsigned and downloadable over plaintext HTTP — these are the main reasons we cannot trust our systems today. And those pathetic attempts to fix it, e.g. via restricting admin users on Vista, but still requiring full admin rights to install any piece of stupid software. Or selling people illusion of security via A/V programs, that cannot even protect themselves properly…

It's also funny how so many people focus on solving the security problems by "Security by Correctness" or "Security by Obscurity" approaches — patches, patches, NX and ASLR — all good, but it is not gonna work as an ultimate protection (if it could, it would worked out already).

On the other hand, there are some emerging technologies out there that could allow us to implement effective "Security by Isolation" approach. Such technologies as VT-x/AMD-V, VT-d/IOMMU or Intel TXT and TPM.

So we, at ITL, focus on analyzing those new technologies, even though almost nobody uses them today. Because those technologies could actually make the difference. Unlike A/V programs or Patch Tuesdays, those technologies can change the level of sophistication required for the attacker dramatically.

The attacks we focus on are important for those new technologies — e.g. today Intel TXT is pretty much useless without protection from SMM attacks. And currently there is no such protection, which sucks. SMM rootkits sound sexy, but, frankly, the bad guys are doing just fine using traditional kernel mode malware (due to the fact that A/V is not effective). Of course, SMM rootkits are just yet another annoyance for the traditional A/V programs, which is good, but they might not be the most important consequence of SMM attacks.

So, should the average Joe Dow care about our SMM attacks? Absolutely not! \ No newline at end of file diff --git a/_posts/2009-03-25-trusting-hardware.html b/_posts/2009-03-25-trusting-hardware.html deleted file mode 100644 index 34aef64..0000000 --- a/_posts/2009-03-25-trusting-hardware.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Trusting Hardware -date: '2009-03-25T14:37:00.008+01:00' -author: Joanna Rutkowska -tags: -- trusted computing -- philosophical -- backdoors -modified_time: '2009-06-05T12:19:15.291+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2606319367477937236 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html ---- - -So, you're a decent paranoid person, running only open source software on your box: Linux, GNU, etc. You have the feeling you could, if you only wanted to, review every single line of code (of course you will probably never do this, but anyway). You might be even more paranoid and also try running an open source BIOS. You feel satisfied and cannot understand all those stupid people running closed source systems like e.g. Windows. Right?

But here's where you are stuck — you still must trust your hardware. Trust that your hardware vendor has not e.g. built in a backdoor into your network card micro-controller…

So, if we buy a laptop from vendor X, that might be based in some not-fully-democratic country, how do we know they didn't put backdoors there? And not only to spy on Americans, also to spy on their own citizens? When was the last time you reverse-engineered all the PCI devices on your motherboard?

Scared? Good!

Enters the game-changer: IOMMU (known as VT-d on Intel). With proper OS/VMM design, this technology can address the very problem of most of the hardware backdoors. A good example of a practical system that allows for that is Xen 3.3, which supports VT-d and allows you to move drivers into a separate, unprivileged driver domain(s). This way each PCI device can be limited to DMA only to the memory region occupied by its own driver.

The network card's microcontroller can still compromise the network card driver, but nothing else. Assuming we are using only encrypted communication, there is not much an attacker can gain by compromising this network card driver, besides doing a DoS. Similarly for the disk driver — if we use full disk encryption (which is a good idea anyway), there is not much an attacker can gain from compromising the low-level disk driver.

Obviously the design of such a system (especially used for desktop computing) is not trivial ans needs to be thoroughly thought out. But it is possible today(!), thanks to those new virtualization technologies.

It seems than, that we could protect ourselves against potentially malicious hardware. With one exception however… we still need to trust the CPU and also the memory controller (AKA northbridge AKA chipset), that implements that IOMMU.

On AMD systems, the memory controller has long been integrated into the processor. Also Intel's recent Nehalem processors integrate the memory controller on the same die.

This all means we need to trust only one vendor (Intel or AMD) and only one component, i.e. The Processor. But should we blindly trust them? After all it would be trivial for Intel or AMD to build in a backdoor into their processor. Even something as simple as:

if (rax == MAGIC_1 && rcx == MAGIC_2) jmp [rbx]

Just a few more gates in the CPU I guess (there are apparently already about 780 million gates on Core i7, so a few more should not make much difference), and no performance penalty. Exploitable remotely on most systems and any more complex program I guess. Yet, totally undetectable for anybody without an electron microscope (and tons of skills and knowledge).

And this is just the simplest example that comes to mind within just a few minutes. I'm sure one could come up with something even more universal and reliable. The fact is — if you are the CPU vendor, it is trivial for you to build in an effective backdoor.

It's funny how various people, e.g. European government institutions, are afraid of using closed source software, e.g. Windows, because they are afraid of Microsoft putting backdoors there. Yet, they are not concerned about using processors made by some other US companies. It is significantly more risky for Microsoft to put a backdoor into its software, where even a skilled teenager equipped with IDA Pro can find it, than it is for Intel or AMD, where effectively nobody can find it.

So, I wonder whether various government and large corporate customers from outside the US will start asking Intel and AMD to provide them with the exact blueprints of their processors. After all they already require Microsoft to provide them with the source code under an NDA, right? So, why not the "source code" for the processor?

Unfortunately there is nothing that could stop a processor vendor to provide its customers with a different blueprints than those that are used to actually "burn" the processors. So, the additional requirement would be needed that they also allow to audit their manufacturing process. Another solution would be to hire some group of independent researchers, equip them with an electron microscope and let them reverse engineer some randomly chosen processors… Hmmm, I even know a team that would love to do that ;)

A quick summary in case you get lost already:
  1. On most systems we are not protected against hardware backdoors, e.g. in the network card controller.
  2. New technologies, e.g. Intel VT-d, can allow to protect against potentially malicious hardware (requires specially designed OS, e.g. specially configured Xen)…
  3. … except for the potential backdoors in the processor.
  4. If we don't trust Microsoft, why should we trust Intel or AMD?
BTW, in May I will be speaking at the Confidence conference in Krakow, Poland. This is gonna be a keynote, so don't expect new attacks to be revealed, but rather some more philosophical stuff about trusted computing (why it is not evil) and problems like the one discussed today. See you there! \ No newline at end of file diff --git a/_posts/2009-05-28-thoughts-about-trusted-computing.html b/_posts/2009-05-28-thoughts-about-trusted-computing.html deleted file mode 100644 index 0047f30..0000000 --- a/_posts/2009-05-28-thoughts-about-trusted-computing.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Thoughts About Trusted Computing -date: '2009-05-28T00:58:00.004+02:00' -author: Joanna Rutkowska -tags: -- trusted computing -- philosophical -modified_time: '2009-08-01T19:36:41.267+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6453215149663280165 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/05/thoughts-about-trusted-computing.html ---- - -Here are the slides about Trusted Computing I used for my presentations at the EuSecWest today, and at the Confidence conference last week.

As this was supposed to be a keynote, the slides are much less technical then our other slides, and also there are no new attacks presented there. Still, I hope they might be useful as some sort of an "alternative" introduction to Trusted Computing :)

A cool presentation I saw today was about PCI-based backdoors by Christophe Devine and Guillaume Vissian. They basically took a general-purpose FPGA programmable PC-card (AKA PCMCIA), flashed it with an FPGA "program" that implemented a simple state machine. The purpose of the state machine was to wait until its DMA engine gets initialized and then to modify certain bytes in the host memory, that happened to be part of the winlogon.exe process (IIRC they changed XOR AL, AL into MOV AL, 1, or something like that, at the end of some password verification function inside the winlogon.exe process). The slides should be available soon on the conference website. I also hope they will publish all the source code needed to flash your own personal "winlogon unlocker".

The live demo was really impressive — they showed a winlogon screen, tried to login a few times with wrong passwords, of course all the attempts failed, then they inserted their magic, $300 worth, PC-card, and… 2 seconds later they could log in using any password they wanted.

While not necessary being a breakthrough, as everybody has known such things could be done for years, I think it is still important that somebody eventually implemented this, discussed the technical details (FPGA-related), and also showed how to implement it with a cheap generic "reflashable" hardware without using a soldering iron.

Of course I have also discussed in my presentation how to prevent PCI-based backdoors (like the one discussed here) using VT-d, but this defense is currently only available if you use Xen 3.3 or later, and also requires that you manually create driver domain partitions and come up with a reasonable scheme for assigning devices to driver domains. All in all 99.9% of users are not (and will not be anytime soon) protected against such attacks. Oh, wait, there is actually a relatively simple software-based workaround (besides putting a glue into your PC-card slot, which is not a very subtle one)… I wonder who else will find out :) \ No newline at end of file diff --git a/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html b/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html deleted file mode 100644 index 7f0569c..0000000 --- a/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: More Thoughts on CPU backdoors -date: '2009-06-02T00:16:00.003+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- backdoors -modified_time: '2009-08-25T11:58:39.136+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2058775943106512545 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/more-thoughts-on-cpu-backdoors.html ---- - -I've recently exchanged a few emails with Loic Duflot about CPU-based backdoors. It turned out that he recently wrote a paper about hypothetical CPU-backdoors and also implemented some proof-of-concept ones using QEMU (for he doesn't happen to own a private CPU production line). The paper can be bought here. (Loic is an academic, and so he must follow some of the strange customs in the academic world, one of them being that papers are not freely published, but rather being sold on a publisher website… Heck, even we, the ultimately commercialized researchers, still publish our papers and code for free).

Let me stress that what Loic writes about in the paper are only hypothetical backdoors, i.e. no actual backdoors have been found on any real CPU (ever, AFAIK!). What he does is he considers how Intel or AMD could implement a backdoor, and then he simulate this process by using QEMU and implementing those backdoors inside QEMU.

Loic also focuses on local privilege escalation backdoors only. You should however not underestimate a good local privilege escalation — such things could be used to break out of any virtual machine, like VMWare, or potentially even out of a software VMs like e.g. Java VM.

The backdoors Loic considers are somewhat similar in principle to the simple pseudo-code one-liner backdoor I used in my previous post about hardware backdoors, only more complicated in the actual implementation, as he took care about a few important details, that I naturally didn't concern. (BTW, the main message of my previous post about was how cool technology this VT-d is, being able to prevent PCI-based backdoors, and not about how doomed we are because of Intel- or AMD-induced potential backdoors).

Some people believe that processor backdoors do not exist in reality, because if they did, the competing CPU makers would be able to find them in each others' products, and later would likely cause a "leak" to the public about such backdoors (think: Black PR). Here people make an assumption that AMD or Intel is technically capable of reversing each others processors, which seems to be a natural consequence of them being able to produce them.

I don't think I fully agree with such an assumption though. Just the fact that you are capable of designing and producing a CPU, doesn't mean you can also reverse engineer it. Just the fact that Adobe can write a few hundred megabyte application, doesn't mean they are automatically capable of also reverse engineering similar applications of that size. Even if we assumed that it is technically feasible to use some electron microscope to scan and map all the electronic elements from the processor, there is still a problem of interpreting of how all those hundreds of millions of transistors actually work.

Anyway, a few more thoughts about properties of a hypothetical backdoors that Intel or AMD might use (be using).

First, I think that in such a backdoor scenario everything besides the "trigger" would be encrypted. The trigger is something that you must execute first, in order to activate the backdoor (e.g. the CMP instruction with particular, i.e. magic, values of some registers, say EAX, EBX, ECX, EDX). Only then the backdoor gets activated and e.g. the processor auto-magically escalates into Ring 0. Loic considers this in more detail in his paper. So, my point is that all the attacker's code that executes afterwards, think of it as of a shellcode for the backdoor, that is specific for the OS, is fetched by the processor in an encrypted form and decrypted only internally inside the CPU. That should be trivial to implement, while at the same time should complicate any potential forensic analysis afterwards — it would be highly non-trivial to understand what the backdoor actually have done.

Another crucial thing for a processor backdoor, I think, should be some sort of an anti-reply attack protection. Normally, if a smart admin had been recording all the network traffic, and also all the executables that ever got executed on the host, chances are that he or she would catch the triggering code and the shellcode (which might be encrypted, but still). So, no matter how subtle the trigger is, it is still quite possible that a curious admin will eventually find out that some tetris.exe somehow managed to breakout of a hardware VM and did something strange, e.g. installed a rootkit in a hypervisor (or some Java code somehow was able to send over all our DOCX files from our home directory).

Eventually the curious admin will find out that strange CPU instruction (the trigger) after which all the strange things had happened. Now, if the admin was able to take this code and replicate it, post it to Daily Dave, then, assuming his message would pass through the Moderator (Hi Dave), he would effectively compromise the processor vendor's reputation.

An anti-replay mechanism could ideally be some sort of a challenge-response protocol used in a trigger. So, instead having you always to put 0xdeadbeaf, 0xbabecafe, and 0x41414141 into EAX, EBX and EDX and execute some magic instruction (say CMP), you would have to put a magic that is a result of some crypto operation, taking current date and magic key as input:

Magic = MAGIC (Date, IntelSecretKey).

The obvious problem is how the processor can obtain current date? It would have to talk to the south-bridge at best, which is 1) nontrivial, and 2) observable on a bus, and 3) spoof'able.

A much better idea would be to equip a processor with some sort of an eeprom memory, say big enough to hold one 64-bit or maybe 128-bit value. Each processor would get a different value flashed there when leaving the factory. Now, in order to trigger the backdoor, the processor vendor (or backdoor operator, think: NSA) would have to do the following:

1) First execute some code that would read this unique value stored in eeprom for the particular target processor, and send this back to them,

2) Now, they could generate the actual magic for the trigger:

Magic = MAGIC (UniqeValueInEeprom, IntelSecretKey)

3) ...and send the actual code to execute the backdoor and shellcode, with the correct trigger embedded, based on the magic value.

Now, the point is that the processor will automatically increment the unique number stored in the eeprom, so the same backdoor-exploiting code would not work twice for the same processor (while at the same time it would be easy for NSA to send another exploit, as they know what the next value in the eeprom should be). Also, such a customized exploit would not work on any other CPU, as the assumption was that each CPU gets a different value at the factory, so again it would not be possible to replicate the attack and proved that the particular code has ever done something wrong.

So, the moment I learn that processors have built-in eeprom memory, I will start thinking seriously there are backdoors out there :)

One thing that bothers me with all those divagations about hypothetical backdoors in processors is that I find them pretty useless in at the end of the day. After all, by talking about those backdoors, and how they might be created, we do not make it any easier to protect against them, as there simply is no possible defense here. Also this doesn't make it any easier for us to build such backdoors (if we wanted to become the bad guys for a change). It might only be of an interest to Intel or AMD, or whatever else processor maker, but I somewhat feel they have already spent much more time thinking about it, and chances are they probably can only laugh at what we are saying here, seeing how unsophisticated our proposed backdoors are. So, my Dear Reader, I think you've been just wasting time reading this post ;) Sorry for tricking you into this and I hope to write something more practical next time :) \ No newline at end of file diff --git a/_posts/2009-06-09-quest-to-core.html b/_posts/2009-06-09-quest-to-core.html deleted file mode 100644 index 8f16b8b..0000000 --- a/_posts/2009-06-09-quest-to-core.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Quest to The Core -date: '2009-06-09T15:10:00.004+02:00' -author: Joanna Rutkowska -tags: -- company news -- attack -modified_time: '2009-08-25T11:58:49.731+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-360542347844086177 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/quest-to-core.html ---- - -If you think SMM rootkits or PCI backdoors is low-level, then you should certainly see our talks in Vegas — ITL is going to define what does the "low-level" adjective really mean at the end of the decade ;)

In case you haven't noticed it at the Black Hat website yet — Alex and Rafal will be giving two presentations in Vegas:

1) Introducing Ring -3 Rootkits (description)

2) Attacking Intel® BIOS (description)

Let me stress that we have been in touch with Intel for quite some time about the above attacks, and that Intel is planning to release appropriate fixes a few weeks before our presentations at Black Hat.

There is more than just this coming at this year's Black Hat — most notably we will also be debuting with our Virtualization (In)Security Training. I will write a separate post about this training (containing a detailed agenda) in the coming days, so stay tuned.

Quite exciting. \ No newline at end of file diff --git a/_posts/2009-06-12-virtualization-insecurity-training-in.html b/_posts/2009-06-12-virtualization-insecurity-training-in.html deleted file mode 100644 index 03a9b63..0000000 --- a/_posts/2009-06-12-virtualization-insecurity-training-in.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Virtualization (In)Security Training in Vegas -date: '2009-06-12T14:08:00.003+02:00' -author: Joanna Rutkowska -tags: -- xen hacking -- company news -modified_time: '2009-08-25T11:59:02.603+02:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SjJF-ePDEUI/AAAAAAAAAEo/5ealWjYcCn4/s72-c/neurons.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7377753647053577701 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/virtualization-insecurity-training-in.html ---- - -VM escapes, hypervisor compromises (via "classic" rootkits, as well as Bluepill-like rootkits), hypervisor protection strategies, SMM attacks, TXT bypassing, and more — these are some of the topics that will be covered by our brand new training on Virtualization (In)Security at the upcoming Black Hat USA.

The training offers quite a unique chance, I think, to absorb the results of 1+ year of the research done by our team within... just 2 days. This will be provided via detailed lectures and unique hands-on exercises.

Unlike our previous training on stealth malware (that will also be offered this year, BTW), this time we will offer attendees a bit of hope :) We will be stressing that some of the new hardware technologies (Intel TXT, VT, TPM), if used properly, have potential to dramatically increase security of our computer systems. Sure, we will be showing attacks against those technologies (e.g. TXT), but nevertheless we will be stressing that this is the proper way to go in the long run.

Interestingly, I'm not aware of any similar training of this kind, that would be covering the security issues related to virtualization systems and bare metal hypervisors. Hope we will not get into troubles with the Antitrust Commission for monopolizing this field ;)

The training brochure (something for your boss) is here.

The detailed agenda spanning 2 full days can be downloaded here.

The Black Hat signup page is here.

\ No newline at end of file diff --git a/_posts/2009-07-17-interview.html b/_posts/2009-07-17-interview.html deleted file mode 100644 index 97ac78f..0000000 --- a/_posts/2009-07-17-interview.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Interview -date: '2009-07-17T00:12:00.004+02:00' -author: Joanna Rutkowska -tags: -- general -modified_time: '2009-08-25T11:59:13.263+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4456369931211035223 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/07/interview.html ---- - -Alan Dang from Tom's Hardware did an interview with me. I talk there about quite a lot of things, many of which I would probably write about on this blog sooner or later (or already had), so I thought it might be of interest to the readers of this blog. \ No newline at end of file diff --git a/_posts/2009-07-30-black-hat-2009-slides.html b/_posts/2009-07-30-black-hat-2009-slides.html deleted file mode 100644 index bcad24b..0000000 --- a/_posts/2009-07-30-black-hat-2009-slides.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Black Hat 2009 Slides -date: '2009-07-30T23:18:00.006+02:00' -author: Joanna Rutkowska -tags: -- chipset -- BIOS -- attack -- smm -- exploit -modified_time: '2009-08-25T11:59:22.095+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-9064869513973571664 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/07/black-hat-2009-slides.html ---- - -The wait is over. The slides are here. The press release is here. Unless you're a chipset/BIOS engineer kind of person, I strongly recommend reading the press release first, before opening the slides.

So, the "Ring -3 Rootkit" presentation is about vPro/AMT chipset compromises. The "Attacking Intel BIOS" presentation is about exploiting a heap overflow in BIOS environment in order to bypass reflashing protection, that otherwise allows only Intel-signed updates to be flashed.

We will publish the code some time after get back from Vegas.

Enjoy.

ps. Let me remind my dear readers that all the files hosted on the ITL website are not digitally signed and are served over a plaintext connection (HTTP). In addition, the ITL's website is hosted on a 3rd party provider's server, on which we have totally no control (which is the reason why we don't buy an SSL certificate for the website). Never trust unsigned files that you download from the Internet. ITL cannot be liable for any damages caused by the files downloaded from our website, unless they are digitally signed. \ No newline at end of file diff --git a/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html b/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html deleted file mode 100644 index 77b4c28..0000000 --- a/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Vegas Toys (Part I): The Ring -3 Tools' -date: '2009-08-25T11:59:00.007+02:00' -author: Joanna Rutkowska -tags: -- rootkits -- chipset -- exploit -modified_time: '2009-10-15T22:00:04.114+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/SpO6Tov88rI/AAAAAAAAAFI/0RkGsL5rM28/s72-c/Ring+-3+Rootkit+White+Diagram.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-3052797530568154320 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/08/vegas-toys-part-i-ring-3-tools.html ---- - -We've just published the proof of concept code for the Alex's and Rafal's "Ring -3 Rootkits" talk, presented last month at the Black Hat conference in Vegas. You can download the code from our website here. It's highly recommended that one (re)reads the slides before playing with the code.

In short, the code demonstrates injection of an arbitrary ARC4 code into a vPro-compatible chipset AMT/ME memory using the chipset memory reclaiming attack. Check the README and the slides for more information.


The actual ARC4 code we distribute here is very simple: it sets a DMA write transaction to the host memory every ca. 15 seconds in order to write the "ITL" string at the predefined physical addresses (increased by 4 with every iteration). Of course one can do DMA read as well.


The ability to do DMA from the ARC4 code to/from the host memory is, in fact, all that is necessary to write a sophisticated rootkit or any sort of malware, from funny jokers to sophisticated secret sniffers. Your imagination (and good pattern searching) is the only limit here.

The OS, nor any software running on the host OS, cannot access our rootkit code, unless, of course, it used the same remapping attack we used to insert our code there :) But the rootkit might even cut off this way by locking down the remapping registers, so fixing the vulnerability on the fly, after exploiting it (of course it would be insane for any AV to use our remapping attack in order to scan ME space, but just for completeness;)

An OS might attempt to protect itself from DMA accesses from the rootkit in the chipset by carefully setting VT-d protections. Xen 3.3/3.4, for example, sets VT-d protections in such a way that our rootkit cannot access the Xen hypervisor memory. We can, however, access all the other parts of the system which includes all the domains memory (i.e. where all the interesting data are located). Still, it should be possible to modify Xen so that it set VT-d mappings in such a strict way, that the AMT code (and the AMT rootkit) could not access any useful information in any of the domains. This, in fact, would be a good idea anyway, as it would also prevent any sort of hardware-based backdoors (except for the backdoors in the CPU).

An AMT rootkit can, however, get around such a savvy OS because it can modify the OS's VT-d initialization code before it sets the VT-d protections. Alternatively, if the protections are set before the rootkit was activated, the rootkit can force the system to reboot and boot it from the AMT Virtual CDROM (In fact AMT has been designed to be able to do exactly that), which would contain rootkit agent code that would modify the OS/VMM to-be-loaded image, so that it doesn't setup VT-d properly.

Of course, the proper solution against such an attack would be to use e.g. Intel TXT to assure trusted boot of the system. In theory this should work. In practice, as you might recall, we have already shown how to bypass Intel TXT. This TXT bypass attack still works on most (all?) hardware, as there is still no STM available in the wild (all that is needed for the attack is to have a working SMM attack, and last month we showed 2 such attacks — see the slides for the BIOS talk).

Intel has released a patch a day before our presentation at Black Hat. This is a cumulative patch that is also targeting a few other, unrelated, problems, like e.g. the SMM caching attack (also reported by Loic), the SMM nvacpi attack, and the Q45 BIOS reflashing attack (for which the code will be also published shortly).

Some of you might remember that Intel has patched this very remapping bug last year, after our Xen 0wning Trilogy presentations, where we used the very same bug to get around Xen hypervisor protections. However, Intel forgot about one small detail — namely it was perfectly possible for malware to downgrade BIOS to the previous, pre-Black-Hat-2008 version, without any user consent (after all this old BIO file was also digitally signed by Intel). So, with just one additional reboot (but without a user intervention needed) malware could still use the old remapping bug, this time to get access to the AMT memory. The recent patch mentioned above solves this problem by displaying a prompt during reflash boot, if reflashing to an older version of BIOS. So now it requires user intervention (a physical presence). This "downgrade protection" works, however, only if we have administrator password enabled in BIOS.

We could get into the AMT memory on Q35, however, even if the downgrade attack was not possible. In that case we could use our BIOS reflashing exploit (the other Black Hat presentation).

However, this situation looks differently on Intel latest Q45 chipsets (that also have AMT). As explained in the presentation, we were unable to get access to the AMT memory on those chipsets, even though we can reflash the BIOS there, and consequently, even though we can get rid of all the chipset locks (e.g. the remapping locks). Still, the remapping doesn't seem to work for this one memory range, where the AMT code resides.

This suggest Intel added some additional hardware to the Q45 chipset (and other Series 4 chipsets) to prevent this very type of attacks. But we're not giving up on Q45 yet, and we will be trying other attacks, as soon as we recover from the holiday laziness ;)

Finally, the nice picture of the Q35 chipset (MCH), where our rootkit lives :) The ARC4 processor is somewhere inside...

\ No newline at end of file diff --git a/_posts/2009-08-26-pdf-signing-and-beyond.html b/_posts/2009-08-26-pdf-signing-and-beyond.html deleted file mode 100644 index ec24cad..0000000 --- a/_posts/2009-08-26-pdf-signing-and-beyond.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: PDF signing and beyond -date: '2009-08-26T21:48:00.004+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- general -- fighting for a better world -modified_time: '2009-10-15T21:59:53.837+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3613638502091357780 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/08/pdf-signing-and-beyond.html ---- - -Today I got an advertising email from GlobalSign (where I previously bought a code signing certificate for Vista kernel drivers some years ago) highlighting their new (?) type of certificates for signing of Adobe PDF files. It made me curious, because, frankly, I've been recently more and more missing this feature. After a quick online research it turned out that this whole Adobe Certified Documents Services (CDS) seem to be nothing new, as apparently even Adobe Reader 6.0 had support for verifying those CDS certificates. The certificates are also available from other popular certification authorities like e.g. Entrust and Verisign, and a couple of others.

So, I immediately felt stupid that I haven't been aware of such a great feature, which apparently is out there for a few years now. Why I thought it was so great a feature? Consider the following scenario…

At our Invisible Things Lab resources page we offer a handful of files to download — slides and some proof of concept code. The website is served over a plaintext HTTP. This means that if you're downloading anything over a public WiFi (hotel, airport lounge, etc) you never know if the PDF you actually get has not been infected somewhere in the middle, e.g. by a guy in the lobby that is messing with the hotel WiFi.

So, one might argue that I should have paid a few hundred bucks and get an SSL certificate for my website and start serving it over HTTPS. But here's the problem — I, as zillions of other small businesses and individuals, host my website on some 5-dollar-a-month one-of-the-thousands hosting provider. I have zero knowledge about what people work there and if they can be trusted, and I also know nothing (and have zero impact) on how secure (or not, for that matter) the server is. (Same applies to my cell phone carrier, ISP, etc, BTW).

Now, the SSL certificate for the website "knows" nothing about how the files on my website should look like, in particular if they are compromised or not. All the SSL certificate does is to give assurance to the remote client that he or she downloaded the actual files that were on the server in the moment of downloading — whether they were the original ones authored by me, or perhaps maliciously modified by somebody who got access to the server.

So, the solution with an SSL certificate would work only if I trusted my web server, which could be assumed only if I run my own dedicated server. That, however, would be an overkill for a small company like ITL, especially that our business is not based on our web presence — in fact the website is maintained mainly for other researchers and students, who can easily download our papers and code from there, and also for the reporters so they can e.g. download a press release from there.

Surprisingly, the website has never been compromised, probably because it doesn't present an interesting target for any skilled person (or maybe exceptionally skilled people work at the hosting provider?). But I cannot know for sure, as I don't constantly monitor all the hashes of all the files, as this would require… well a dedicated server that would be running an SHA1 calculating script in a loop for 24/7 :)

Of course, zillions of other websites works this very same way and present the very same problems.

Now, ability to sign PDFs would be just a great solution here, because I could sign all those files with my certificate, and then all the people downloading stuff from ITL could know they are getting original PDFs that were created on one of the ITL members desktop computers, no matter how compromised the web server or the network connection is.

For the same reasons, I would welcome if others started doing the same, as currently I simply must assume every PDF I download from the net (and PDFs account for the majority of file downloads I do) to be potentially malicious. So, I always open them in my Red or Yellow VM (depending on the source of the download), and only if it "looks good" (very fuzzy term, I know), I might decide to move it to my host desktop (it's easier to work with PDFs on your host, and actually you should use your host desktop for something).

(Yes, I know, Kostya Kortchinsky, or Rafal, can sometimes escape from VMWare, but still I believe that today the best isolation I can get on a desktop, without sacrificing much convince, is via a type II hypervisor. It's horribly inelegant, but well, that's life).

So, I read some more about this Adobe CDS, being all excited about it, and ready to spend a few hundred euros on a certificate, only to realize that it doesn't look as good as I thought.

First disappointment comes from the fact that you must create a PDF using Adobe Acrobat software (not the Reader, but the commercial one). I've created all my PDFs using either Office (in the past) or iWork (today), and none of them seem to offer a way to digitally sign the PDF. I would like to get a simple tool, say pdfsign.exe, that I could use to sign any PDF I have, no matter how I generated it. Also, not surprisingly, the Mac native PDF viewer (Preview) doesn't seem to recognize the digital signature, and I bet some Linux PDF viewers do not as well.

Worst of all, even the Acrobat Reader 9, that I tested under Windows, and that correctly displayed all the CDS information, does one unbelievably stupid thing — it parses and renders the whole PDF before displaying the signature info. So, if you downloaded a malicious PDF, Acrobat Reader will happily open it and parse, without asking you a question of whether you would like to open it (as it is perhaps unsigned). At least I was unable to find an option that would force it to do that. So, if this PDF contained an exploit for the reader, it surely would get executed. Compare this with the (correct) behavior of Vista UAC where it presents the executable signature details before executing it.

You can see how your software works with Adobe PDF signatures, e.g. by looking at this exemplary file signed by GlobalSign.

So, Adobe CDS, in the form they are today, seem to be pretty useless, as far as protection from potentially malicious PDFs is considered (they surely have other positive applications, e.g. to certify about authenticity of e.g. a diploma).

But wouldn't it be great to have such a file signing mechanism globally adopted and not only for PDFs, but for any sort of files, including ZIPs, tgz's, heck, even plain text files? And have our main OSes generically recognize those signatures and display unified prompts of whether we want to allow an application to to open the file or not? Perhaps, in some situations, we could even define policies for specific applications. This seems easy to do from the technical point of view — we just need to "hook" (oh, God, did I say "hook"?) high-level OS API's like e.g. open() or CreateFile().

What about PGP and possibility of using this for signing any sort of files? Well, we use PGP a lot at ITL, but mainly for securing peer-to-peer communication (e.g. between us and our clients). There really is no good way to publish one's PGP key — the concept of Web of Trust might be good for some closed groups of people, but not for publishing files "to the world". And, of course, the first thing that an attacker who subverted PDFs on our website will do is to also subvert the PGP key displayed on the website. I also tried once to publish a PGP key to a key server, but got discouraged immediately after I noticed it didn't use SSL for submission. BTW, anybody knows if the key servers today use SSL? If not, how the trust is established? Maybe email clients, e.g. Thunderbird, come with built in PGP keys for select key servers?

So, I guess that was the main point of writing this post — to express how madly I would welcome a generic, OS-based, non-obligatory, signature verification for files, based on PKI :)

Ah, before a dozen of people jumps to the comment box to tell me that digital signatures do not assure non-maliciousness of anything — please don't do that, because I actually know that. In fact, it is not possible to assure non-maliciousness of pretty much anything, especially without strictly defining an ethical system we would like to use first. What the signatures provide is the liability, so that I know who to sue, in case my naked holiday pictures got leaked to the public because of some malicious PDF exploiting my system. In that case I can sue either the actual person who signed the PDF (if this person is identifiable) or the certification authority who issued the certificate to a wrong (unidentifiable) person. \ No newline at end of file diff --git a/_posts/2009-09-02-about-apples-security-foundations-or.html b/_posts/2009-09-02-about-apples-security-foundations-or.html deleted file mode 100644 index ff6eb54..0000000 --- a/_posts/2009-09-02-about-apples-security-foundations-or.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: About Apple’s Security Foundations, Or Lack Of Thereof... -date: '2009-09-02T16:19:00.004+02:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2009-10-15T22:00:21.812+02:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/Sp5_8M68juI/AAAAAAAAAFQ/-_lxhA_Yg6o/s72-c/thunderbird+installer+on+vista.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-8958558851864832778 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/09/about-apples-security-foundations-or.html ---- - -Every once in a while it’s healthy to reinstall your system... I know, I know, it’s almost a heresy to say that, but that’s reality in the world where our systems are totally unverifiable. In fact I don’t even attempt to verify if my Mac laptop has been compromised in any way (most system files are not signed anyway). But sometimes, you got this feeling that something might be wrong and you decide to reinstall to start your (digital) life all over again :)

So, every time I (re)install a Mac-based system, I end up cursing horribly at Apple’s architects. Why? Because in the Apple World they seem to totally ignore the concept of files integrity, to such extent that it’s virtually impossible to get any assurance that the programs I install are in any way authentic (i.e. not tampered by some 3rd party, e.g. by somebody controlling my Internet connection).

Take any Apple installer package, e.g. Thunderbird. In most cases an installer package on Mac is a .dmg file, that represents an installation disk image. Now, when you open such a file under Mac, the OS will never display any information about if this file is somehow signed (e.g. by who) or not. In fact, I’m pretty sure it’s never signed. What you end up with, is a .dmg file that you just downloaded over plaintext HTTP and you have absolutely no way of verifying if it is the original file the vendor really published. And you’re just about to grant admin privileges to the installer program that is inside this file -- after all it’s an installer, so must got root privileges, right (well, not quite maybe)? Beautiful...

Interestingly, this very same Thunderbird installer, but for Windows, is correctly signed, and Windows, correctly, displays that information (together with the ability to examine the certificate) and allows the user to make a choice of whether to allow it to run or not.



Sure, the certificate doesn’t guarantee that Mozilla didn’t put a nasty backdoor in there, nor that the file was not compromised due to Mozilla’s internal server compromise. Or that the certificate (the private key) wasn’t somehow stolen from Mozilla, or that the issuing authority didn’t make a mistake and maybe issued this certificate to some random guy, who just happened to be named Mozilla.

But the certificate provides liability. If it indeed turns out that this very Thunderbird installer was somehow malicious, I could take this signed file to the court and sue either Mozilla, or the certification authority for all the damages it might have done to me. Without the certificate I cannot do that, because I (and nobody) cannot know if the file was tampered while being downloaded (e.g. malicious ISP) or maybe because my system was already compromised.

But in case of Apple, we have no such choice -- we need to take the risk every time we download a program from the Internet. We must bet the security of our whole system, that at this very moment nobody is tampering with out (unsecured) HTTP connection, and also that nobody compromised the vendor’s Web Server, and, of course, we hope that the vendor didn’t put any malicious code into its product (as we could not sue them for it).

So that sucks. That sucks terribly! Without ability to check the integrity of programs we want to install, we cannot build any solid foundations. It’s funny how people divagate whether Apple implemented ASLR correctly in Snow Leopard, or not? Or whether NX is bypassable. It’s meaningless to dive into such advanced topics, if we cannot even assure that at the day 0 our system is clean. We need to start building our systems from the ground up, and not starting from the roof! Ability to assure the software we install is not tampered seems like a reasonable very first step. (Sure it could be compromised 5 minutes later, and to protect against this we should have other mechanisms, like e.g. mentioned above ASLR and NX).

And Apple should not blame the vendors for such a situation (“Vendors would never pay $300 for a certificate”, blah, blah), as it is just enough to have a look at the Windows versions of the same products, and that most of them do have signed installers (gee, even open-source TrueCrypt, has a signed installer for Windows!).

One should say that a few vendors, seeing this problem on Mac, do publish PGP signatures for their installation files. This includes e.g. PGP Desktop for Mac, KeePassX, TrueCrypt for Mac, and a few others. But these are just exceptions and I wonder how many users will be disciplined (and savvy) enough to correctly verify those PGP signatures (in general it requires you to download the vendor keys many months before, keep it in your ring, to minimize possibility that somebody alters both the installer files and the keys you download). Some other vendors offer pseudo-integrity by displaying MD5/SHA1 sums on their websites. That would make some sense only if the website on which the hashes are displayed was itself SSL-protected (still the file signature is a better option), as otherwise we can be sure that the attacker that is tampering with the installer file, will also take care about adjusting the hash on the website... But of course this never is the case -- have a look e.g. at the VMWare download page for the Mac Fusion (one need to register first). Very smart, VMWare! (Needles to say, the VMWare Workstation installer for Windows is properly signed).

BTW, anybody checked if the Apple updates are digitally signed somehow?

All I wrote here in this post is just trivial. It should be just obvious for every decently educated software engineer. Believe me it’s really is much more fun for me to write about things like new attacks on chipsets or virtualization. But I have this little hope that maybe somebody at Apple will read this little post and fix their OS. Because I really like Apple products for their aesthetics... \ No newline at end of file diff --git a/_posts/2009-09-22-intel-security-summit-slides.html b/_posts/2009-09-22-intel-security-summit-slides.html deleted file mode 100644 index 214c769..0000000 --- a/_posts/2009-09-22-intel-security-summit-slides.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Intel Security Summit: the slides' -date: '2009-09-22T16:55:00.005+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- general -- conferences -modified_time: '2009-10-15T22:02:03.973+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/SrjsKTA0I0I/AAAAAAAAAFY/530BI2suM5Y/s72-c/Fotolia_6441375_XS.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7770784580268995591 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/09/intel-security-summit-slides.html ---- - -Last week I was invited to Hillsboro to speak at the Intel's internal conference on security. My presentation title was "A Quest To The Core: Thoughts on present and future attacks on system core technologies", and my goal was to somehow make a quick summary of the recent research our team has done over the last 12 months or so, and explain why we're so keen on hacking the low-level system components, while all the rest of the world is excited about browser and flash player bugs.

The slides (converted to PDF) can be found here. As you will see, I decided to remove most of the slides from the "Future" chapter. One reason for that was that we didn't want to hint Loic our competition as to some of our new toys we're working on;) The other reason was that, I think, the value of presenting only thoughts about attacks, i.e. unproven thoughts, or, should I even say, feelings about future attacks, has little research value, and while I can understand such information being important to Intel, I don't see how others could benefit from them.

I must say it was nice and interesting to meet in person with various Intel architects, i.e. the people that actually design and create our basic "universe" we all operate in. You can always change the OS (or even write your own!), but still you must stick to the rules, or "laws", of the platform (unless you can break them ;)

\ No newline at end of file diff --git a/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html b/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html deleted file mode 100644 index c26d3c0..0000000 --- a/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html +++ /dev/null @@ -1,18 +0,0 @@ ---- -layout: post -title: Evil Maid goes after TrueCrypt! -date: '2009-10-16T00:30:00.005+02:00' -author: Joanna Rutkowska -tags: -- disk encryption -- attack -- tpm -- trusted computing -- fighting for a better world -modified_time: '2009-11-03T01:02:54.209+01:00' -thumbnail: http://2.bp.blogspot.com/_Ti3q3Hdvels/Stdj6EwsmvI/AAAAAAAAAFg/eVbBLzSlq-E/s72-c/evil+maid.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1384385046456881063 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html ---- - -From time to time it’s good to take a break from all the ultra-low-level stuff, like e.g. chipset or TXT hacking, and do something simple, yet still important. Recently Alex Tereshkin and I got some spare time and we implemented the Evil Maid Attack against TrueCrypt system disk encryption in a form of a small bootable USB stick image that allows to perform the attack in an easy “plug-and-play” way. The whole infection process takes about 1 minute, and it’s well suited to be used by hotel maids.

The Attack
Let’s quickly recap the Evil Maid Attack. The scenario we consider is when somebody left an encrypted laptop e.g. in a hotel room. Let’s assume the laptop uses full disk encryption like e.g. this provided by TrueCrypt or PGP Whole Disk Encryption.

Many people believe, including some well known security experts, that it is advisable to fully power down your laptop when you use full disk encryption in order to prevent attacks via FireWire/PCMCIA or ”Coldboot” attacks.

So, let’s assume we have a reasonably paranoid user, that uses full disk encryption on his or her laptop, and also powers it down every time they leave it alone in a hotel room, or somewhere else.

Now, this is where our Evil Maid stick comes into play. All the attacker needs to do is to sneak into the user’s hotel room and boot the laptop from the Evil Maid USB Stick. After some 1-2 minutes, the target laptop’s gets infected with Evil Maid Sniffer that will record the disk encryption passphrase when the user enters it next time. As any smart user might have guessed already, this part is ideally suited to be performed by hotel maids, or people pretending to be them.

So, after our victim gets back to the hotel room and powers up his or her laptop, the passphrase will be recorded and e.g. stored somewhere on the disk, or maybe transmitted over the network (not implemented in current version).

Now we can safely steal/confiscate the user’s laptop, as we know how to decrypt it. End of story.

Quick Start
Download the USB image here. In order to “burn” the Evil Maid use the following commands on Linux (you need to be root to do dd):

dd if=evilmaidusb.img of=/dev/sdX

Where /dev/sdX should be replaced with the device representing your USB stick, e.g. /dev/sdb. Please be careful, as choosing a wrong device might result in damaging your hard disk or other media! Also, make sure to use the device representing the whole disk (e.g. /dev/sdb), rather than a disk partition (e.g. /dev/sdb1).

On Windows you would need to get a dd-like program, e.g. this one, and the command would look more or less like this one (depending on the actual dd implementation you use):

dd if=evilmaidusb.img of=\\?\Device\HarddiskX\Partition0 bs=1M

where HarddiskX should be replaced with the actual device the represents your stick.

After preparing the Evil Maid USB stick, you’re ready to test it against some TrueCrypt-encrypted laptop (more technically: a laptop that uses TrueCrypt system disk encryption). Just boot the laptop from the stick, confirm you want to run the tool (press ‘E’) and the TrueCrypt loader on your laptop should be infected.

Now, Evil Maid will be logging the passphrases provided during the boot time. To retrieve the recorded passphrase just boot again from the Evil Maid USB -- it should detect that the target is already infected and display the sniffed password.

The current implementation of Evil Maid always stores the last passphrase entered, assuming this is the correct one, in case the user entered the passphrase incorrectly at earlier attempts.

NOTE: It’s probably illegal to use Evil Maid to obtain password from other people without their consent. You should always obtain permission from other people before testing Evil Maid against their laptops!

CAUTION: The provided USB image and source code should be considered proof-of-concept only. Use this code at your own risk, and never run it against a production system. Invisible Things Lab cannot be held responsible for any potential damages this code or its derivates might cause.

How the Evil Maid USB works
The provided implementation is extremely simple. It first reads the first 63 sectors of the primary disk (/dev/sda) and checks (looking at the first sector) if the code there looks like a valid TrueCrypt loader. If it does, the rest of the code is unpacked (using gzip) and hooked. Evil Maid hooks the TC’s function that asks user for the passphrase, so that the hook records whatever passphrase is provided to this function. We also take care about adjusting some fields in the MBR, like the boot loader size and its checksum. After the hooking is done, the loader is packed again and written back to the disk.

You can get the source code for the Evil Maid infector here.

Possible Workarounds
So, how should we protect against such Evil Maid attacks? There are a few approaches...

1. Protect your laptop when you leave it alone
Several months ago I had a discussion with one of the TrueCrypt developers about possible means of preventing the Evil Maid Attack, perhaps using TPM (see below). Our dialog went like this (reproduced here with permission from the TrueCrypt developer):

TrueCrypt Developer: We generally disregard "janitor" attacks since they inherently make the machine untrusted. We never consider the feasibility of hardware attacks; we simply have to assume the worst. After an attacker has "worked" with your hardware, you have to stop using it for sensitive data. It is impossible for TPM to prevent hardware attacks (for example, using hardware key loggers, which are readily available to average Joe users in computer shops, etc.)

Joanna Rutkowska: And how can you determine that the attacker have or have not "worked" with your hardware? Do you carry your laptop with you all the time?

TrueCrypt Developer: Given the scope of our product, how the user ensures physical security is not our problem. Anyway, to answer your question (as a side note), you could use e.g. a proper safety case with a proper lock (or, when you cannot have it with you, store it in a good strongbox).

Joanna Rutkowska: If I could arrange for a proper lock or an impenetrable strongbox, then why in the world should I need encryption?

TrueCrypt Developer: Your question was: "And how can you determine that the attacker has or has not worked with your hardware?" My answer was a good safety case or strongbox with a good lock. If you use it, then you will notice that the attacker has accessed your notebook inside (as the case or strongbox will be damaged and it cannot be replaced because you had the correct key with you). If the safety case or strongbox can be opened without getting damaged & unusable, then it's not a good safety case or strongbox. ;-)

That's a fair point, but this means that for the security of our data we must relay on the infeasibility to open our strongbox lock in a "clean" way, i.e. without visually damaging it. Plus it means we need to carry a good strongbox with us to any travel we go. I think we need a better solution...

Note that TrueCrypt authors do mention the possibility of physical attacks in the documentation:
If an attacker can physically access the computer hardware and you use it after the attacker has physically accessed it, then TrueCrypt may become unable to secure data on the computer. This is because the attacker may modify the hardware or attach a malicious hardware component to it (such as a hardware keystroke logger) that will capture the password or encryption key (e.g. when you mount a TrueCrypt volume) or otherwise compromise the security of the computer.
However, they do not explicitly warn users of a possibility of something as simple and cheap as the Evil Maid Attack. Sure, they write "or otherwise compromise the security of the computer", which does indeed cover e.g. the Evil Maid Attack, but my bet is that very few users would realize what it really means. The examples of physical attacks given in the documentation, e.g. modifying the hardware or attaching a malicious hardware, is something that most users would disregard as too expensive an attack to be afraid of. But note that our Evil Maid attack is an example of a “physical” attack, that doesn’t require any hardware modification and is extremely cheap.

Of course it is a valid point, that if we allow a possibility of a physical attack, then the attacker can e.g. install a hardware keylogger. But doing that is really not so easy as we discuss in the next paragraph. On the other hand, spending two minutes to boot the machine from an Evil Maid USB stick is just trivial and is very cheap (the price of the USB stick, plus the tip for the maid).

2. The Trusted Computing Approach
As explained a few months ago on this blog, a reasonably good solution against Evil Maid attack seems to be to take advantage of either static or dynamic root of trust offered by TPM. The first approach (SRTM) is what has been implemented in Vista Bitlocker. However Bitlocker doesn’t try to authenticate to the user (e.g. via displaying a custom picture shot by the user, with the picture decrypted using a key unsealed from a TPM), so it’s still possible to create a similar attack against Bitlocker, but with a bit different user experience. Namely the Evil Maid for Bitlocker would have to display a fake Bitlocker prompt (that could be identical to the real Bitlocker prompt), but after obtaining a correct password from the user Evil Maid would not be able to pass the execution to the real Bitlocker code, as the SRTM chain will be broken. Instead, Evil Maid would have to pretend that the password was wrong, uninstall itself, and then reboot the platform. Thus, a Bitlocker user that is confident that he or she entered the correct password, but the OS didn’t boot correctly, should destroy the laptop.

The dynamic root of trust approach (DRTM) is possible thanks to Intel TXT technology, but currently there is no full disk encryption software that would make use of it. One can try to implement it using Intel’s tboot and some Linux disk encryption, e.g. LUKS.

Please also note that even if we assume somebody “cracked” the TPM chip (e.g. using an electron microscope, or NSA backdoor), that doesn’t mean this person can automatically get access to the encrypted disk contents. This is not the case, as the TPM is used only for ensuring trusted boot. After cracking the TPM, the attacker would still have to mount an Evil Maid attack in order to obtain the passphrase or key. Without TPM this attack is always possible.

Are those trusted computing-based approaches 100% foolproof? Of course not. As signalized in the previous paragraph, if an attacker was able to mount a hardware-based keylogger into your laptop (which is non-trivial, but possible), then the attacker would be able to capture your passphrase regardless of the trusted boot. A user can prevent such an attack by using two-factor authentication (RSA challenge-response implemented in a USB token) or e.g. one-time passwords, so that there is no benefit for the attacker to capture the keystrokes. But the attacker might go to the extreme and e.g. replace the DRAM, or even the CPU with malicious DRAM or CPU that would sniff and store the decryption key for later access. We’re talking here about attack that very few entities can probably afford (think NSA), but nevertheless they are theoretically possible. (Note that an attack with inserting a malicious PCI device that would try to sniff the key using DMA can be prevented using TXT+VT-d technology).

However, just because the NSA can theoretically replace your CPU with a malicious one, doesn’t mean TPM-based solutions are useless. As for the great majority of other people that do not happen to be on the Terrorist Top 10, these represent a reasonable solution that could prevent Evil Maid attacks, and, when combined with a proper two-factor authentication, also simple hardware based attacks, e.g. keylogger, cameras, remote keystroke sniffing using laser, etc. I really cannot think of a more reasonable solution here.

3. The Poor Man’s Solution
Personally I would love to see TrueCrypt implementing TPM-based trusted boot for its loader, but, well, what can I do? Keep bothering TrueCrypt developers with Evil Maid attacks and hope they will eventually consider implementing TPM support...

So, in the meantime we have come up with a temporary poor man’s solution that we use at our lab. We call it Disk Hasher. It’s a bootable Linux-based USB stick that can be configured in quite a flexible way to calculate hashes of selected disk sectors and partitions. The correct hashes are stored also on the stick (of course everything is encrypted with a custom laptop-specific passphrase). We use this stick to verify the unencrypted portions of our laptops (typically the first 63 sectors of sda, and also the whole /boot partition in case of Linux-based laptops where we use LUKS/dm-crypt).

Of course there are many problems with such a solution. E.g. somebody who can get access to my Disk Hasher USB (e.g. when I’m in a swimming pool), can infect it in such a way that it would report correct hashes, even though the disk of my laptop would be “evilmaided”...

Another problem with Disk Hasher solution is that it only looks at the disk, but cannot validate e.g. the BIOS. So if the attacker found a way to bypass the BIOS reflashing protection on my laptop, then he or she can install a rootkit there that would sniff my passphrase or the decryption key (in case I used one time passwords).

Nevertheless, our Disk Hasher stick seems like a reasonable solution and we use it often internally at ITL to validate our laptops. In fact this is the most we can do, if we want to use TrueCrypt, PGP WDE, or LUKS/dm-crypt.

FAQ

Q: Is this Evil Maid Attack some l33t new h4ck?
Nope, the concept behind the Evil Maid Attack is neither new, nor l33t in any way.

Q: So, why did you write it?
Because we believe it demonstrates an important problem, and we would like more attention to be paid in the industry to solving it.

Q: I’m using two-factor authentication, am I protected against EM?
While a two-factor authentication or one time passwords are generally a good idea (e.g. they can prevent various keylogger attacks), they alone do not provide protection from Evil Maid-like attacks, because the attacker might modify his or her sniffer to look for the final decryption key (that would be calculated after the 2-factor authentication completes).

Q: How is Evil Maid different from Stoned-Bootkit?
The Stoned Bootkit, released a few months ago by an individual describing himself as “Software Dev. Guru in Vienna”, is also claimed to be capable of "bypassing TrueCrypt", which we take to mean a capability to sniff TC's passphrases or keys. Still, the biggest difference between Stoned Bootkit and Evil Maid USB is that in case of our attack you don’t need to start the victim's OS in order to install Evil Maid, all you need to do is to boot from a USB stick, wait about 1 minute for the minimal Linux to start, and then press ‘E’, wait some 2 more seconds, and you’re done. With the Stoned Bootkit, according to the author’s description, you need to get admin access to the target OS in order to install it, so you either need to know the Windows admin password first, or use some exploit to get the installer executing on the target OS. Alternatively, you can install it from a bootable Windows CD, but this, according to the author, works only against unencrypted volumes, so no use in case of TrueCrypt compromise.

Q: I've disabled boot from USB in BIOS and my BIOS is password protected, am I protected against EM?
No. Taking out your HDD, hooking it up to a USB enclosure case and later installing it back to your laptop increases the attack time by some 5-15 minutes at most. A maid has to carry her own laptop to do this though.

Q: What about using a HDD with built-in hardware-based encryption?
We haven’t tested such encryption systems, so we don’t know. There are many open questions here: how is the passphrase obtained from the user? Using software stored on the disk or in the BIOS? If on the disk, is this portion of disk made read-only? If so, does it mean it is non-updatable? Even if it is truly read-only, if the attacker can reflash the BIOS, then he or she can install a passphrase sniffer there in the BIOS. Of course that would make the attack non-trivial and much more expensive than the original Evil Maid USB we presented here.

Q: Which TrueCrypt versions are supported by the current Evil Maid USB?
We have tested our Evil Maid USB against TrueCrypt versions 6.0a - 6.2a (the latest version currently available). Of course, if the “shape” of the TrueCrypt loader changed dramatically in the future, then Evil Maid USB would require updating.

Q: Why did you choose TrueCrypt and not some other product?
Because we believe TrueCrypt is a great product, we use it often in our lab, and we would love to see it getting some better protection against such attacks.

Q: Why there is no TPM support in TrueCrypt?
The TrueCrypt Foundation published official generalized response to TPM-related feature requests here.

Acknowledgments
Thanks to the ennead@truecrypt.org for all the polemics we had which allowed me to better gather my thoughts on the topic. The same thanks to Alex and Rafal, for all the polemics I have had with them (it's customary for ITL to spend a lot of time finding bugs in each other's reasoning). \ No newline at end of file diff --git a/_posts/2009-12-21-another-txt-attack.html b/_posts/2009-12-21-another-txt-attack.html deleted file mode 100644 index e712b5c..0000000 --- a/_posts/2009-12-21-another-txt-attack.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Another TXT Attack -date: '2009-12-21T19:11:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- trusted execution technology -- trusted computing -- exploit -modified_time: '2010-01-16T12:25:46.578+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/Sy-7Sx0fLlI/AAAAAAAAAGA/MvXTpW6ZTTQ/s72-c/broken+chain.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7396711639241642204 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/12/another-txt-attack.html ---- - -Earlier this year our team has presented an attack against Intel TXT that exploited a design problem with SMM mode being over privileged on PC platforms and able to interfere with the SENTER instruction. The Intel response was two-fold: to patch the SMM implementation bugs we used for the attack (this patch was for both the NVACPI SMM attacks, as well as for the SMM caching attack), and also to start (intensify?) working on STM specification, that is, we heard, planned to be published sometime in the near future. STM is a thin hypervisor concept that is supposed to provide protection against (potentially) malicious SMMs.

Today we present a totally different attack that allows an attacker to trick the SENTER instruction into misconfiguring the VT-d engine, so that it doesn’t protect the newly loaded hypervisor or kernel. This attack exploits an implementation flaw in a SINIT AC module. This new attack also allows for full TXT circumvention, using a software-only attack. This attack doesn't require any SMM bugs to succeed and is totally independent from the previous one.

The press release is here.

The full paper is here.

The advisory published by Intel today can be found here.

Enjoy. \ No newline at end of file diff --git a/_posts/2010-01-16-priorities.html b/_posts/2010-01-16-priorities.html deleted file mode 100644 index cb73e46..0000000 --- a/_posts/2010-01-16-priorities.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Priorities -date: '2010-01-16T12:25:00.004+01:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2010-01-19T12:00:41.155+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4462141036719440454 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/01/priorities.html ---- - -It’s interesting how many people don’t realize what are the priorities in computer security... There are many fields to secure: server security, web applications security, network security, and finally desktop security. Over the last years I met SO many people that always expressed surprise why I would like to focus on desktop systems security? They usually argue that today, as everybody knows, it is the Network that is what computing is all about and that we should focus on securing infrastructure, and forget about the desktops, which are always to be insecure. The network is the computer, as somebody said.

What those people forget about, is that it is always the desktop that ultimately gets access to all the user’s secretes -- all the passwords, all the keys, all the corporate documents, all the nude holiday pictures, all the secret love letters, all the credit card numbers, and many more.

However secure were all the services (remote servers and network protocols) that we use, if our desktop gets compromised it’s all lost. The recent incident with Google is just yet another example of that. Our desktop systems are the most crucial piece of the whole puzzle.

It’s funny how many people think that by using some thin client solution on their desktops they can solve the problem. Of course they cannot! Just the fact that your OS executes on a server, rather then on your hardware, doesn’t make it any less prone to all the attacks that were otherwise possible when the software executed on your system.

The attempts to secure desktops have been failing for so many years. While recently there is some attempt to minimize likelihood of remote attacks via Web browsers (or generally to focus on application security), this is still just the tip of the iceberg -- there are so many other attack avenue that none of the popular OSes even tries to address, that I consider myself a brave person (not to say stupid) that I actually use my laptop everyday and keep some sensitive information on it ;)

Ok, so that’s a nice piece of complaining you say, but what are we, at ITL, gonna do about it? Well, we just gonna sit and patiently wait for better OSes to appear some day... Oh, hell, we won’t!

Happy New Year :)

<please ignore>
9933 F096 8820 0E23 1AF4 078D 8BDB D97D BDEA 9E9D
</>
\ No newline at end of file diff --git a/_posts/2010-04-07-introducing-qubes-os.html b/_posts/2010-04-07-introducing-qubes-os.html deleted file mode 100644 index 8592242..0000000 --- a/_posts/2010-04-07-introducing-qubes-os.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Introducing Qubes OS -date: '2010-04-07T12:58:00.008+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-04-07T18:26:47.527+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2192095913677180808 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/04/introducing-qubes-os.html ---- - -For the last 6 months we have been busy with a new project: Qubes. Qubes is an open source OS based on Xen, X, and Linux, designed to provide strong isolation for desktop computing. The link to the project website is at the end of the post.

The system is currently in the alpha stage, but if you're determined it's actually usable. For example I have switched to Qubes around a month ago, and two weeks ago I even decided to wipe and reinstall my Mac Book, which used to be my primary laptop previously. Now I use my old Mac Book only for making the slides (Apple Keynote really has no competition) and Web page for Qubes :) And I use Qubes for pretty much all the other daily tasks, from work, shopping, banking, random browsing, to Qubes development itself (it takes part in the "qubes" AppVM).

Just remember to make backups regularly if you decided to use Qubes for anything else than testing and development.

So, enough of introduction, you will find lots of details (including a 40-page PDF describing the system architecture) at the Qubes project website. Enjoy!

Update 7-Apr-2010 15:56 CEST: The server seems to be overloaded a bit by the traffic... If you are planning to install the OS, I guess it would be wise to postpone downloading the installation packages until later this week, when the first wave of visitors goes away.

Update 7-Apr-2010 16:31 CEST: The Wiki doesn't work due to lack of free memory... Talking to my provider about buying some more RAM. Sorry for the inconvenience.

Update 7-Apr-2010 18:28 CEST: The server has been brought offline for RAM upgrade. Should be back online in some 15 minutes...

http://qubes-os.org

\ No newline at end of file diff --git a/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html b/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html deleted file mode 100644 index ccfc329..0000000 --- a/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Remotely Attacking Network Cards (or why we do need VT-d and TXT) -date: '2010-04-30T14:03:00.005+02:00' -author: Joanna Rutkowska -tags: -- attack -- tpm -- trusted execution technology -- trusted computing -- fighting for a better world -modified_time: '2010-05-13T14:26:11.485+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2572700386184621224 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/04/remotely-attacking-network-cards-or-why.html ---- - -I've finally found some time to study Loic Duflot's and Yves-Alexis Perez's recent presentation from the last month on remotely attacking network cards. You can get the slides here.

In short, they're exploiting a buffer overflow in the network card's firmware by sending malicious packets to the card, and then they gain full control over the card's firmware, so they can e.g. issue DMA to/from the host memory, effectively fully controlling the host (that's another example of "Ring -3 rootkit" I would say). The buffer overflow is in some exotic management protocol (that I think is disabled by default, but that's irrelevant) implemented by the NIC's firmware (the NIC has its own RISC processor, and memory, and stack, which they overflow, etc.).

I like this research very much, because it demonstrates several important things:

First, it shows that it is definitely a good idea to isolate/sandbox all the OS networking code using IOMMU/VT-d. And this is exactly what we do in Qubes.

Second, the attack provides a real-world example of why Static Root for Trust Measurement (SRTM) is inferior to Dynamic RTM (DRTM), e.g. Intel TXT. To understand why, let's make the following assumptions:
1) The OS/VMM properly uses IOMMU to isolate the network card(s), just like e.g. Qubes does.
2) Once the attacker got control over the NIC firmware, the attacker can also modify the persistent storage (EEPROM) where this firmware is kept. This has been confirmed by Loic in a private email exchange.
3) The system implements trusted boot via SRTM, i.e. using just BIOS and TPM, without Intel TXT.

Now, the attacker can modify the firmware in the EEPROM and this will allow the attacker to survive the platform reboot. The card's firmware will start executing early in the boot process, definitely before the OS/VMM gets loaded. Now, the compromised NIC, because it is capable of doing DMA to the host memory, can compromise the image of the VMM in a short time window between the time it got measured and loaded by the (trusted) OS loader, e.g. Trusted GRUB, but still before the time VMM had a chance to setup proper IOMMU/VT-d protections for itself.

Of course, in practice, it might be tricky for the compromised NIC firmware to precisely know this time window when it should send a compromising DMA write request. If the DMA was issued too early, then the trusted OS loader would calculate a wrong hash and put a wrong value into a PCR register, which would later prevent the system from completing the boot, and prevent the attack. If the DMA was issued too late, the IOMMU/VT-d protections would already be in-place, and the attack would again be unsuccessful. But, hey, much harder obstacles have been worked around by smart exploit writes in the past, so don't comfort yourself that the attack is hard. If it's possible, it means this technology is flawed, period.

And this is where DRTM, AKA Intel TXT, shows its advantage over simple SRTM. When you load a hypervisor using TXT, the SENTER instruction would first apply the VT-d protections around the hypervsior image, then do the measurements, and only then load it, with VT-d protections still in-place.

The above is the theory. A few months ago we demonstrated an attack against this scheme, but the attack was exploiting a flaw in the TXT implementation, not in its design, so it didn't render TXT useless as a technology.

A much bigger problem with Intel TXT is, that Intel still has done nothing to prevent SMM-based attacks against TXT. This is what we demonstrated about 1.5 years(!) ago. Our research stressed that TXT without protection from SMM is essentially useless. Intel then promised to come up with a spec on how to write an STM, and how TXT should work with STM (when to measure/load it, etc), but nothing has been released by Intel for all this time AFAIK...

Now, without STM (which is supposed to provide protection from potentially compromised SMM), the TXT cannot really prevent Loic and friends from owning the system, even if it uses such a securely designed OS as Qubes. This is because Loic would be able to modify e.g. the MBR while the system boots (thanks to DMA ability of the infected NIC firmware), and then attack an SMM from this MBR (I can bet lots of money Loic & co. would easily find a few other SMM exploits in any recent BIOS if they only wanted to), and then having infected the SMM, they will be able to compromise TXT-loaded hypervisor, and finally compromise the whole system.

I know there are some people from various governments reading this blog. If you really want to have secure systems, consider pushing on Intel to finally do something about the SMM-based attacks against TXT. Beware, Intel will try to tell you that, using TXT LCP you can seal your secrets to only "trusted" SMM images and would try to convince you it's a way to prevent SMM attacks on TXT. It is not. Only true SMM sandboxing is a proper way to address this problem.

Anyway, congrats to Loic and colleagues for yet another very interesting and meaningful system-level research! \ No newline at end of file diff --git a/_posts/2010-05-01-evolution.html b/_posts/2010-05-01-evolution.html deleted file mode 100644 index cf77a7b..0000000 --- a/_posts/2010-05-01-evolution.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Evolution -date: '2010-05-01T15:45:00.005+02:00' -author: Joanna Rutkowska -tags: -- company news -modified_time: '2010-05-13T14:26:25.690+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4492075276448270781 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/05/evolution.html ---- - -If you have been following my research over the last several years (even in the days before ITL), you will undoubtedly notice how much I have changed the profile over that time...

Several years ago, myself and Alex Tereshkin (who later became ITL employee #1), were known mostly as rootkit researchers. It was back in the days when the word "rootkit" was not as much well known as it is today (It became well known sometime in the late 2005, and I remember when I was applying for a US Visa that year, the immigration officer in the Warsaw embassy asked me what I did professionally and when I replied that I was a security researcher specializing in rootkits, he was very happy to tell me that he just read about those "rootkits" somewhere, although he was not very much worried about them, because he was a Mac user...)

But then, in the coming years, we decided to explore other areas, like virtualization, trusted computing, chipset security, and even touched on the CPU security briefly. Many valuable contributions in those areas have come from Rafal Wojtczuk, who joined our team some two years ago.

And then, finally, we became ready to actually build something meaningful. Not just yet another nonsense trivial-to-break "security product", but something that have had a potential to really improve user's security. And so, the Qubes project idea has been born, and soon it became ITL's highest priority project.

So, these days we don't do any reverse engineering or malware analysis any more. We'd rather design systems so they be immune to rootkits by design (e.g. by significant TCB reduction), rather then analyze each and every new rootkit sample caught in the wild and try to come up with a detector for it.

Of course, this all doesn't mean we're giving up on our offensive research. There is still a chance you will hear about some new attacks from us. But this would surely be limited only to the attacks that we consider relevant in an environment that is already designed with security in mind, like Qubes :) So, e.g. an attack against VT-d, or some CPU exploit, or a Xen exploit, might be extremely interesting. But don't expect to see any research on how to e.g. compromise Windows 7 or Mac kernel or break out of their primitive sandboxes -- these systems are so badly designed from a security standpoint, that coming up with a yet-another attack against them makes little sense from a scientific point of view.

Naturally, I'm all excited about this all: that I've been exploring new areas, and that my work has eventually started becoming meaningful. But that is, of course, only mine subjective opinion. Specifically, this turned out not be the case for Alex, who simply enjoys reverse engineering and compiler hacking just for the sake of doing it (Alex did some excellent job on metamorphic code generators, that are years ahead of what you can read at public conferences). Unfortunately, with the current new course we took at ITL, Alex started getting less and less chances to apply his skills, and faced a decision whether to stay at ITL and do other things, i.e. other than reversing or compiler hacking, or to quit and continue doing what he has always liked to do.

The reader has probably figured out by now that Alex decided to quit ITL. I fully understand his decision and wish him all the best in his new adventures!

You should still be able to reach Alex using his old ITL's email address (alex@), or directly via his new email: alex.tereshkin at gmail.com. \ No newline at end of file diff --git a/_posts/2010-05-03-on-formally-verified-microkernels-and.html b/_posts/2010-05-03-on-formally-verified-microkernels-and.html deleted file mode 100644 index 8a0598e..0000000 --- a/_posts/2010-05-03-on-formally-verified-microkernels-and.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: On Formally Verified Microkernels (and on attacking them) -date: '2010-05-03T16:11:00.005+02:00' -author: Joanna Rutkowska -tags: -- formal verification -- attack -- trusted computing -- philosophical -modified_time: '2010-06-02T00:16:33.712+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3538836128867543324 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/05/on-formally-verified-microkernels-and.html ---- - -Update May 14th, 2010: Gerwin Klein, a project lead for L4.verified, has posted some insightful comments. Also it's worth reading their website here that clearly explains what assumptions they make, and what they really prove, and what they don't.

You must have heard about it before: formally verified microkernels that offer 100% security... Why don't we use such a microkernel in Qubes then? (The difference between a micro-kernel and a type I hypervisor is blurry. Especially in case of a type I hypervisor used for running para-virtualized VMs, such as Xen used in Qubes. So I would call Xen a micro-kernel in this case, although it can also run fully-virtualized VMs, in which case it should be called a hypervisor I think.)

In order to formally prove some property of any piece of code, you need to first assume certain things. One such thing is the correctness of a compiler, so that you can be sure that all the properties you proved for the source code, still hold true for the binary generated from this source code. But let's say it's a feasible assumption -- we do have mature compilers indeed.

Another important assumption you need, and this is especially important in proving kernels/microkernels/hypervisors, is the model of the hardware your kernel interacts with. Not necessarily all the hardware, but at least the CPU (e.g. MMU, mode transitions, etc) and the Chipset.

While the CPUs are rather well understood today, and their architecture (we're talking IA32 here) doesn't change so dramatically from season to season. The chipsets, however, are a whole different story. If you take a spec for any modern chipset, let's say only the MCH part, the one closer to the processor (on Core i5/i7 even integrated on the same die), there are virtually hundreds of configuration registers there. Those registers are used for all sorts of different purposes -- they configure DRAM parameters, PCIe bridges, various system memory map characteristics (e.g. the memory reclaiming feature), access to the infamous SMM memory, and finally VT-d and TXT configuration.

So, how are all those details modeled in microkernels formal verification process? Well, as far as I'm aware, they are not! They are simply ignored. The nice way of saying this in academic papers is to say that "we trust the hardware". This, however, might be incorrectly understood by readers to mean "we don't consider physical attacks". But this is not equal! And I will give a practical example in a moment.

I can bet that even the chipset manufactures (think e.g. Intel) do not have formal models for their chipsets (again, I will give a good example to support this thesis below).

But why are the chipsets so important? Perhaps they are configured "safe by default" on power on, so even if we don't model all the configuration registers, and their effects on the system, and if we won't be playing with them, maybe it's safe to assume all will be fine then?

Well, it might be that way, if we could have secure microkernels without IOMMU/VT-d and without some trusted boot mechanism.

But we need IOMMU. Without IOMMU there is no security benefit of having a microkernel vs. having a good-old monolithic kernel. Let me repeat this statement again: there is no point in building a microkernel-based system, if we don't correctly use IOMMU to sandbox all the drivers.

Now, setting up IOMMU/VT-d permissions require programming the chipset's registers, and is by no means a trivial task (see the the Intel VT-d spec to get an impression, if you don't believe me). Correctly setting up IOMMU is one of the most security-critical tasks to be done by a hypervisor/microkernel, and so it would be logical to expect that they also formally prove that this part is done flawlessly...

The next thing is the trusted boot. I will argue that without proper trusted boot implementation, the system cannot be made secure. And I'm not talking about physical attacks, like Evil Maid. I'm talking about true, remote, software attacks. If you haven't read it already, please go back and read my very recent post on "Remotely Attacking Network Cards". Building on Loic's and Yves-Alexis' recent research, I describe there a scenario how we could take their attack further to compromise even such a securely designed system as Qubes. And this could be possible, because of a flaw in TXT implementation. And, indeed, we demonstrated an attack on Intel Trusted Execution Technology that exploits one such flaw before.

Let's quickly sketch the whole attack in points:

  1. The attacker attacks a flaw in the network card processing code (Loic and Yves-Alexis)

  2. The attacker replaces the NIC's firmware in EEPROM to survive the reboot (Loic and Yves-Alexis)

  3. The new firmware attacks the system trusted boot via a flaw in Intel TXT (ITL)

    • If the system uses SRTM instead, it's even easier -- see the previous post (ITL)

    • If you have new SINIT module that patched our attack, there is still an avenue to attack TXT via SMM (ITL)

  4. The microkernel/hypervisor gets compromised with a rootkit and the attacker gets full control over the system:o

And this is the practical example I mentioned above. I'm sure readers understand that this is just one example, of what could go wrong on the hardware level (and be reachable to a software-only attacker). Don't ignore hardware security! Even for software attacks!

A good question to ask is: would a system with a formally verified microkernel also be vulnerable to such an attack? And the answer is yes! Yes, unless we could model and prove correctness of the whole chipset and the CPU. But nobody can do that today, because it is impossible to build such a model. If it was, I'm pretty sure Intel would already have such a model and they would not release an SINIT module with this stupid implementation bug we found and exploited in our attack.

So, we see an example of a practical attack that could be used to fully compromise a well designed system, even if it had a formally verified microkernel/hypervisor. Compromise it remotely, over the network!

So, are all those whole microkernel/hypervisor formal verification attempts just a waste of time? Are they only good for academics so that they could write more papers for conferences? Or for some companies to use them in marketing?

Perhaps the formal verification of system software will never be able to catch up with the pace of hardware development... By the time people will learn how to build models (and how to solve them) for hardware used today, the hardware manufactures, in the meantime, will present a few new generations of the hardware. For which the academics will need another 5 years to catch up, and so on.

Perhaps the industry will take a different approach. Perhaps in the coming years we will get hardware that would allow us to create untrusted hypervisors/kernels that would not be able to read/write usermode pages (Hey Howard;)? This is currently not possible with the hardware we have, but, hey, why would a hypervisor need access to the Firefox pages?

And how this all will affect Qubes? Well, the Qubes project is not about building a hypervisor or a microkernel. Qubes is about how to take a secure hypervisor/microkernel, and how to build the rest of the system in a secure, and easy to use, way, using the isolation properties that this hypervisor/microkernel is expected to provide. So, whatever kernels we will have in the future (better formally verified, e.g. including the hardware in the model), or based on some exciting new hardware features, still Qubes architecture would make perfect sense, I think. \ No newline at end of file diff --git a/_posts/2010-06-01-disposable-vms.html b/_posts/2010-06-01-disposable-vms.html deleted file mode 100644 index 566f537..0000000 --- a/_posts/2010-06-01-disposable-vms.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Disposable VMs -date: '2010-06-01T23:41:00.004+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-06-18T15:41:16.836+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7974469624652215569 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/06/disposable-vms.html ---- - -While we're still busy with some last few tickets left for Qubes Alpha 2 milestone, Rafal has already started working on a new feature for Qubes Beta 1: on Disposable VMs. I think this is really gonna be a killer feature, and I wanted to say a few words about it.

Disposable VMs will be very lightweight VMs that can be created and booted in a very short time, say < 1s, with a sole purpose of hosting only one application, e.g. a PDF viewer, or a Media Player.

To understand why Disposable VMs are important, imagine the following situation -- you receive an email from a customer that contains a PDF attachment, say an invoice or a contract. Obviously you're opening and reading the message in an email client running in your "work" AppVM (or "work-email" AppVM, if you're paranoid), just because it is a work-related correspondence, arriving at your professional email address (for many reasons it is good to use different email addresses for job-related activities and for personal life).

However, chances of somebody compromising your email client by just sending you a maliciously crafted message that would exploit your body or subject parsers are very small, if you have disabled full HTML parser for message bodies (which I think most security-concious people do anyway). Perhaps a more effective attack vector would be for somebody to 0wn your email server first, and then try to exploit IMAP/POP/SMTP protocol parser in your email client. But hey, in that case, they already would get access to all your emails on the corporate server, without exploiting your email client (well, they could however gain access to your PGP keys this way -- if this bothers you, you might want to use smartcards for PGP keys). There is also a possibility to do a Man-In-The-Middle attack and try to exploit SSL protocol early parsers, but this could be prevented using a separate VPN AppVM in Qubes.

But now you would like to open this PDF that a customer just sent you. It's quite reasonable to be afraid that the PDF might be malicious and might try to exploit your PDF viewer, and then try to steal your emails or other things you keep in the "work" AppVM (or "work-email" AppVM). It doesn't matter if you trust the sender, as the sender's OS might very well be compromised by some malware and might be infecting all outgoing PDFs without the user consent.

You could try opening the PDF in one of your non-sensitive VMs, e.g. the "random" VM that you use for causal Web browsing, to make sure that even if the PDF is malicious, that it won't get access to any sensitive data. But what if the PDF is not malicious, and what if it contains some confidential data? In that case you might throw the baby out with the bath water (your "random" VM might have been already compromised and now it would be able to steal the secrets from your PDF file).

A disposable VM is an ideal solution here. You create a clean, disposable VM, just for the purpose of viewing the PDF. Then, once you're done, you just throw it away. If the PDF was malicious it could done harm only to its own disposable VM, that doesn't contain anything except... this very PDF. At the same time, the disposable VM is always started in a clean state, so there is no way somebody could steal the document. Only the document can steal itself :)

That all sounds easy, but to make it practical we need a very efficient implementation of disposable VMs, and a good system integration, so the experience was seamless to the user. E.g. the user should only be required to right-click on a file and choose "Open in a Disposable VM", and Qubes should take care about everything else: creating the VM, starting it, copying the file to the VM, and starting a MIME-associated application for this type of file (e.g. PDF) in the VM. And this all in time below 1s!

Basic support for Disposable VMs is planned for Beta 1, which is scheduled sometime at the end of the summer holidays. But I can tell that's just the beginning. The ultimate goal, from the user's point of view, would be to make Qubes OS to look and behave just like a regular mainstream OS like Linux, or Windows, or even Mac, but still with all the strong security that Qubes architecture provides, deployed behind the scene. Seamless support for Disposable VM is one of the first steps to achieve this goal.

Special credits go to Matt Piotrowski, who just left Berkeley University, and whose recently published thesis was a direct inspiration to implement disposable VMs in Qubes. While we did mention "one-time" VMs in our architecture document back in January (see chapter 4.6), it really was Matt's paper that convinced me we should really have them in Qubes. Virtics, a proof-of-concept implementation written by Matt, shares lots of similarities with Qubes, like e.g. architecture and implementation of the GUI virtualiztion. There are also differences though, and I refer readers to the Matt's paper for more details. \ No newline at end of file diff --git a/_posts/2010-07-01-qubes-alpha-2-released.html b/_posts/2010-07-01-qubes-alpha-2-released.html deleted file mode 100644 index fdcc091..0000000 --- a/_posts/2010-07-01-qubes-alpha-2-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Alpha 2 released! -date: '2010-07-01T16:16:00.004+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-07-09T18:20:27.132+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3468198659527144871 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/07/qubes-alpha-2-released.html ---- - -The Alpha 2 is out!
New screenshots are here :) \ No newline at end of file diff --git a/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html b/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html deleted file mode 100644 index 8ebfb9c..0000000 --- a/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: 'Skeletons Hidden in the Linux Closet: r00ting your Linux Desktop for Fun and - Profit' -date: '2010-08-17T17:18:00.005+02:00' -author: Joanna Rutkowska -tags: -- attack -modified_time: '2010-09-02T10:37:50.107+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2413818648032561083 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/08/skeletons-hidden-in-linux-closet.html ---- - -A couple of months ago, while working on Qubes GUI virtualization, Rafal has come up with an interesting privilege escalation attack on Linux (a user-to-root escalation), that exploits a bug in... well, actually it doesn't exploit any concrete bug, which makes it so much more interesting.

The attack allows a (unpriviliged) user process that has access to the X server (so, any GUI application) to unconditionally escalate to root (but again, it doesn't take advantage of any bug in the X server!). In other words: any GUI application (think e.g. sandboxed PDF viewer), if compromised (e.g. via malicious PDF document) can bypass all the Linux fancy security mechanisms, and escalate to root, and compromise the whole system. The attack allows even to escape from the SELinux's "sandbox -X" jail. To make it worse, the attack has been possible for at least several years, most likely since the introduction of kernel 2.6.

You can find the details of the attack, as well as the discussion of possible solutions, including the one that has eventually been implemented, in the Rafal's paper.

One important aspect the attack demonstrates, is how difficult it is to bring security to a desktop platform, where one of the biggest challenges is to let applications talk to the GUI layer (e.g. X server in case of Linux), which usually involves a very fat GUI protocol (think X protocol, or Win32 GUI API) and a very complex GUI server, but at the same time keep things secure. This was one of the key priories for us when designing Qubes OS architecture. (So, we believe Qubes is much more secure than other sandboxing mechanisms, such as BSD jails, or SELinux-based sandboxes, because it not only eliminates kernel-level exploits, but also dramatically slims down GUI-level attacks).

The kernel-level "patch" has been implemented last week by Linus Torvalds, and pushed upstream into recent stable kernels. RedHat has also released an advisory for this attack, where they rated its severity as "high".

ps. Congrats to Brad Spengler for some good guessing :) \ No newline at end of file diff --git a/_posts/2010-08-19-ms-dos-security-model.html b/_posts/2010-08-19-ms-dos-security-model.html deleted file mode 100644 index 784a509..0000000 --- a/_posts/2010-08-19-ms-dos-security-model.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: The MS-DOS Security Model -date: '2010-08-19T21:55:00.004+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -- fighting for a better world -modified_time: '2010-09-02T10:38:00.774+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-787574069472938268 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/08/ms-dos-security-model.html ---- - -Back in the '80s, there was an operating system called MS-DOS. This ancient OS, some readers might not even remember it today, had a very simple security model: every application had access to all the user files and other applications.

Today, over two decades later, overwhelming majority of people still use the very same security model... Why? Because on any modern, mainstream OS, be that Linux, Mac, or Windows, all the user applications still have full access to all the user's files, and can manipulate all the other user's applications.

Does it mean we haven't progressed anywhere from the MS-DOS age? Not quite. Modern OSes do have various anti-exploitation mechanisms, such as ASLR, NX, guard pages (well, Linux has it since last week at least), and even some more.

But in my opinion there has been too much focus on anti-exploitation, and on bug finding, (and on patching, of course), while almost nothing has been done on the OS architecture level.

Does anybody know why Linux Desktops offer ability to create different user accounts? What a stupid question, I hear you saying - different accounts allow to run some applications isolated from user's other applications! Really? No! The X server, by design, allows any GUI application to mess with all the other GUI applications being displayed by the same X server (on the same desktop). So, what good it is to have a "random_web_browsing" user, if the Firefox run under this user account would still be able to sniff or inject keystrokes to all my other GUI applications, take screenshots of them, etc...?

[Yes, I know, the user accounts allows also to theoretically share a single desktop computer among more than one physical users (also known as: people), but, come on, these days it's that a single person has many computers, and not the other way around.]

One might argue that the progress in the anti-exploitation, and also safe languages, would make it nearly impossible to e.g. exploit a Web browser in the next few years, so there would be no need to have a "random_web_browsing" user in the first place. But, we need isolation not only to protect ourselves when somebody exploits one of our application (e.g. a Web Browser, or a PDF viewer), but also, and perhaps most importantly, to protect from maliciously written applications.

Take summer holiday example: imagine you're a scuba diver - now, being also a decently geeky person, no doubt you will want to have some dive log manager application to store the history of your dives on a computer. There are a dozen of such applications on the web, so all you need to do is to pick one (you know, the one with the nicest screenshots), and... well you need to install it on your laptop now. But, hey, why this little, made by nobody-knows-who, dive application should be given unlimited access to all your personal files, work email, bank account, and god-know-what-else-you-keep-on-your-laptop? Anti-exploitation technology would do exactly nothing to prevent your files in this case.

Aha, it would be so nice if we could just create a user "diving", and run the app under this account. In the future, you could throw in some advanced deco planning application into the same account, still separated from all the other applications.

But, sorry, that would not work, because the X server doesn't provide isolation on the GUI-level. So, again, why should anybody bother creating any additional user accounts on a Linux Desktop?

Windows Vista made a little step forward in this area by introducing integrity levels, that, at least theoretically, were supposed to prevent GUI applications from messing with each other. But they didn't scale well (IIRC there were just 3 or 4 integrity levels available), and it still isn't really clear if Microsoft treats them seriously.

So, why do we have user accounts on Linux Desktops and Macs is beyond me (I guess Mac's X server doesn't implement any GUI-level isolation either - if I'm wrong, please point me out to the appropriate reference)?

And we haven't even touched the problems that might arise from the attacker exploiting a bug in the (over-complex) GUI server/API, or in the (big fat) kernel (with hundreds of drivers). In order for those attacks to become really interesting (like the Rafal's attack we presented yesterday), the user would have to already be using e.g. different X servers (and switch between them using Ctrl-Shift-Fn), or some sandboxing mechanisms, such as SELinux sandbox, or, in case of Vista, a scheme similar to this one. \ No newline at end of file diff --git a/_posts/2010-09-02-qubes-qubes-pro-and-future.html b/_posts/2010-09-02-qubes-qubes-pro-and-future.html deleted file mode 100644 index 00b3710..0000000 --- a/_posts/2010-09-02-qubes-qubes-pro-and-future.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Qubes, Qubes Pro, and the Future... -date: '2010-09-02T10:38:00.005+02:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -- conferences -modified_time: '2010-09-02T12:28:46.891+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8797973337920093538 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/qubes-qubes-pro-and-future.html ---- - -The work on Qubes OS has been extremely exciting and also very challenging for us. While most of the work we have been doing so far relates to solving various technical, under-the-hood challenges, the more important goals in the long-term are related more to mitigating the so called "human factor", i.e. making the system not only easy to use, but tolerant to user absentmindedness. This includes e.g. ensuring the user uses a correct AppVM (e.g. do the banking in the "banking" AppVM, and not in the "random web browsing" AppVM, and also not the other way around: don't do random surfing in the "banking" AppVM), and generally making the whole isolation between AppVMs as seamless as possible, but without sacrificing the security at the same time.

This is becoming very important, as the technical level of security in Qubes is already very high, and so the "human factor" might easily become a low hanging fruit for the attacker. (In contrast to other OSes)

But for Qubes to become something more than just an interesting OS for Linux geeks and security enthusiasts, it is also critical to have better application support. Right now Qubes lets users run Linux apps, because each AppVM is Linux-based. But, and let's not be afraid to admit this: Linux sucks when it comes to application support! (Take Open Office as an example - it not only looks like MS Office 97, but is also terribly user-unfriendly, especially their presentation program, the Impress. Why is it so difficult to make it look and behave more like Apple Keynote?)

There is only one way to provide better application support to Qubes: make it support Windows-based, or Mac-based, AppVMs. Just imagine that: being able to run most of your Windows (or Mac) applications, but at the same time benefit from the Qubes strong isolation and seamless integration on one common desktop...

In order to implement support for Windows-based AppVMs (or alternatively Mac-based AppVM) we would need to engage significant resources (5+ very skilled developers, working full time for 1+ year), and so we're currently looking for an investor that would be able to provide funding for such an endeavor. The idea is to create a dedicated spin-off company that would focus entirely on Qubes and Qubes Pro, and in the future will make a profit from selling Qubes Pro licenses. Qubes Pro will become a commercial product, still based on the open source Qubes, but adding support for Windows-based or Mac-based AppVMs. I would be happy to discuss the details and business plan via email with interested potential investors.

Speaking about the future of Qubes: next week I will speak at the European Trusted Infrastructure Summer School, where I will talk about some general stuff like why we need secure desktop systems and why trusted computing might be a way to go, but will also dive a little bit into some new things we plan for Qubes 2.0, such as storage domain and split I/O graphics model. The conference features some very reputable speakers in system-level security field, such as David Grawrock (the father of Intel TXT and TPM), and Loic Duflot (our venerable competitor in the filed of offensive system-level research), so I consider a honour to deliver an opening keynote there (Check the agenda here).

I will have my Qubes laptop with me, of course, so if anybody is interested to see Qubes OS live (including Disposable VMs!), I would be happy to do a quick demo on the spot. \ No newline at end of file diff --git a/_posts/2010-09-09-untrusting-your-gui-subsystem.html b/_posts/2010-09-09-untrusting-your-gui-subsystem.html deleted file mode 100644 index a05c95c..0000000 --- a/_posts/2010-09-09-untrusting-your-gui-subsystem.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: (Un)Trusting your GUI Subsystem -date: '2010-09-09T18:21:00.002+02:00' -author: Joanna Rutkowska -tags: -- os security -- trusted computing -- general -- qubes -modified_time: '2010-09-09T18:37:57.159+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1857218549417302829 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/untrusting-your-gui-subsystem.html ---- - -Why do we need secure desktop systems? Why support from hardware is necessary to build secure desktop OSes? Does virtualization make things more, or less complex? Why Dynamic RTM (Intel TXT) is better than Static RTM? Can we have untrusted GUI domain/subsystem?

I tried to cover those questions in my recent keynote at ETISS, and you can grab the slides here.

Particularly, the slide #18 presents the idealistic view of an OS that could be achieved through the use of hardware virtualization and trusted boot technologies. It might look very similar to many other pictures of virtualized systems one can see these days, but what makes it special is that all the dark gray boxes represent untrusted domains (so, their compromise is not security-critical, except for the potential of a denial-of-service).

No OS currently implements this architecture, even Qubes. We still have Storage and GUI subsystem in Dom0 (so they are both trusted), although we already know (we think) how to implement the untrusted storage domain (this is described in detail in the arch spec), and the main reason we don't have it now is that TXT market adoption is so poor, that very few people could make use of it.

The GUI subsystem is, however, a much bigger challenge. When we think about, it should really feel impossible to have an untrusted GUI subsystem, because the GUI subsystem really "sees" all the pixmaps that are to be displayed to the user, so also all the confidential emails, documents, etc. The GUI is different in nature than the networking subsystem, where we can use encrypted protocols to prevent the netvm from sniffing or meaningfully intercepting the application-generated traffic, or the storage subsystem, where we can use fs-encryption and trusted boot technologies to keep the storage domain off from reading or modifying the files used by apps in a meaningful ways. We cannot really encrypt the pixmaps (in the apps, or AppVMs), because for this to work we would need to have graphics cards that would be able to do the decryption and key exchange (note how this is different from the case of an untrusted storage domain, where there is no need for internal hardware encryption!), and the idea of putting, essentially an HTTPS webserver on your GPU is doubtful at best, because it would essentially move the target from the GUI domain to the GPU, and there is really no reason why lots-of-code in the GPU were any harder to attack than lots-of-code in the GUI domain...

So we came out recently with an idea of a Split I/O model that is also presented in my slides, where we separate the user input (keyboard, mouse), and keep it still in dom0 (trusted domain), from the output (GUI, audio), which is moved into an untrusted GUI domain. We obviously need to make sure that the GUI domain cannot "talk" to other domains, to make sure it cannot "leak out" the secrets that it "sees" while processing the various pixmaps. For this we need to have the hypervisor ensure that all the inter-domain shared pages mapped into the GUI domain are read-only for the GUI domain, and this would imply that we need the GUI protocol, exposed by the GUI domain to other AppVMs, to be unidirectional.

There are more challenges though, e.g. how to keep the bandwith of timing covert channels, such as those through the CPU caches, between the GUI domain and other AppVMs on a reasonably low level (please note the distinction between a covert channel, which require cooperation of two domains, and a side-channel, which requires just one domain to be malicious - the latter are much more of a theoretical problem, and are of a concern only in some very high security military systems, while the former are easy to implement in practice usually, and present a practical problem in this very scenario).

Another problem, that was immediately pointed out by the ETISS audience, is that an attacker, who compromised the GUI domain, can manipulate the pixmaps that are being processed in the GUI subsystem to present false picture to the user (remember, the attacker should have no way to send them out anywhere). This includes attacks such as button relabeling ("OK" becomes "Cancel" and the other way around), content manipulation ("$1,000,000" instead of "$100", and vice-versa), security labels spoofing ("red"-labeled windows becoming "green"-labeled), and so on. It's an open question how practical these attacks are, at least when we consider automated attacks, as they require ability to extract some semantics from the pixmaps (where is the button, where is the decoration), as well as understanding the user's actions, intentions, and behavior (just automatically relabeling my Friefox label to "green" would be a poor attack, as I would immediately realize something is going wrong). Nevertheless this is a problem, and I'm not sure how this could be solved with the current hardware architecture.

But do we really need untrusted GUI domain? That depends. Currently in Qubes the GUI subsystem is located in dom0, and thus it is fully trusted, and this also means that a potential compromise of the GUI subsystem is considered fatal. We try to make an attack on GUI as hard as possible, and this is the reason we have designed and implemented special, very simple GUI protocol that is exposed to other AppVMs (instead of e.g. using the X protocol or VNC). But if we wanted to add some more "features", such as 3D hardware acceleration for the apps (3D acceleration is already available to the Window Manager in Qubes, but not for the apps), then we would not be able to keep the GUI protocol so simple anymore, and this might result in introducing exploitable fatal bugs. So, in that case it would be great to have untrusted GUI domain, because we would be able to provide feature-rich GUI protocols, with all the OpenGL-ish like things, without worrying that somebody might exploit the GUI backend. We would also not need to worry about putting all the various 3rd party software in the GUI domain, such as KDE, Xorg, and various 3rd party GPU drivers, like e.g. NVIDIA's closed source ones, and that some of it might be malicious.

So, generally, yes, we would like to have untrusted GUI domain - we can live without it, but then we will not have all the fancy 3D acceleration for games, and also need to carefully choose and verify the GUI-related software (which is lots of software).

But perhaps in the next 5 years everybody will have a computer with a few dozens of cores, and also the CPU-to-DRAM bandwidth will be orders of magnitude faster than today, and so there will be no longer a need to offload graphic intensive work to a specialized GPU, because one of our 64 cores will happily do the work? Wouldn't that be a nicer architecture, also for many other reasons (e.g. better utilization of power/circuit real estate)? In that case nobody will need OpenGL, and so there will be no need for a richer GUI protocol than what is already implemented in Qubes...

It's quite exciting to see what will happen (and what we will come up for Qubes) :)

BTW, some people might confuse X server de-privileging efforts, i.e. making the X server run without root privileges, which is being done in some Linux distros and BSDs, with what had been described in this article, namely making the GUI subsystem untrusted. Please note that a de-priviliged X server doesn't really solve any major security problems related to GUI subsystem, as whoever controls ("0wns") the X server (depriviliged or not) can steal or manipulate all the data that this X server is processing/displaying. Apparently there are some reasons why people want to run Xorg as non-root, but in case of typical desktop OSes this provides little security benefit (unless you want to run a few X servers with different user accounts, and on different vt's, which most people would never do anyway). \ No newline at end of file diff --git a/_posts/2010-09-13-on-thin-clients-security.html b/_posts/2010-09-13-on-thin-clients-security.html deleted file mode 100644 index 745ce9b..0000000 --- a/_posts/2010-09-13-on-thin-clients-security.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: On Thin Clients Security -date: '2010-09-13T16:35:00.006+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -modified_time: '2010-12-06T18:23:25.754+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1723680013954760533 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/on-thin-clients-security.html ---- - -I'm constantly being asked about it, and so I thought I would write a handy blog post, so I could just referrer to it in the future, when yet anther person asks me if I think the use of Thin Clients is a game-changer to desktop security...

It is not! Thin Clients do not improve your desktop security in any way, and that's because:

  1. You still run a regular full-blown OS, such as Widows and all the regular applications, such as those buggy PDF readers, Web browsers, etc - it's just you run them all on some corporate server, rather on your laptop. The fact that you run the OS on the corporate server, doesn't make it any less prone to compromises, compared to if you run it locally on your laptop.


  2. A compromise of your laptop, even if it's just a dump terminal, is still fatal! This is because if your laptop's kernel (or MBR, or BIOS, or some PCI device's firmware, or GPU) is compromised, the attacker can intercept/steal/spoof all the data that you work on remotely, because it is still your laptop that processes the input (keystrokes, mouse events) and output (pixels). So, an Evil Maid attack on your laptop when you use it as a Thin Client, would be just as devastating, as it is otherwise (and don't fool yourselves that crypto tokens can help)

We really need secure end-user systems, even if we just want to use them as dump terminals only! There is really no way we could skip this step (and e.g. focus only on infrastructure, or services security). \ No newline at end of file diff --git a/_posts/2010-09-28-itl-is-hiring.html b/_posts/2010-09-28-itl-is-hiring.html deleted file mode 100644 index 1e3d8f1..0000000 --- a/_posts/2010-09-28-itl-is-hiring.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: ITL is hiring! -date: '2010-09-28T13:55:00.007+02:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -modified_time: '2010-09-28T14:55:22.519+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/TKHbgfsTIKI/AAAAAAAAAGY/x5QFRMysCTE/s72-c/academia_vs_business.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7242870861005515935 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/itl-is-hiring.html ---- - -We're looking to hire one or two full time developers, who will be working on the open source version of Qubes OS, with the primary task of advancing it from Alpha to Beta stage, and then finally to a production quality version.

We're looking to hire developers, not necessarily security researchers! Specifically we expect the following from candidates:
  • Many years of experience with Linux/GNU development, including system-level and kernel-level Linux development, documented by the actual projects,
  • Familiarity with virtualization technologies, and specifically with Xen hypervisor,
  • Basic understanding of the Qubes architecture and excitement about the project :)
  • Product-oriented approach (polishing, testing, packaging, understanding of user needs),
  • Good communication skills in written English
In return we offer the following benefits:
  • Decent, full-time salary,
  • Opportunity to be part of a renown security team,
  • Opportunity to work on an exciting product,
  • Work on a GPLed project with all the benefits it gives to the developer (visibility, rights to the code)
If you're interested in joining our team, please send a message to joanna at invisiblethingslab.com.

Please do not send typical resumes: don't write about schools you finished, certificates you obtained, driving license, scuba trainings, etc. We are only interested in a short bio (keep it below 100 words please), and links to your past or current projects. Include your geographic location.

While it would be great if you were based in Warsaw (or somewhere in Poland), as it would allow for regular face-to-face meetings, this is not a critical factor. ITL doesn't have a physical office, and everybody work from their apartments, so there is no need to relocate to Warsaw, in case you happened to be based somewhere else.

\ No newline at end of file diff --git a/_posts/2010-10-06-qubes-alpha-3.html b/_posts/2010-10-06-qubes-alpha-3.html deleted file mode 100644 index 5b2296a..0000000 --- a/_posts/2010-10-06-qubes-alpha-3.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Qubes Alpha 3! -date: '2010-10-06T16:00:00.003+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-10-06T16:29:07.797+02:00' -thumbnail: http://3.bp.blogspot.com/_Ti3q3Hdvels/TKpR7rgoq4I/AAAAAAAAAGw/ARa_TKsWL1E/s72-c/disposablevm.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-9214464405081236892 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/10/qubes-alpha-3.html ---- - -We have just uploaded the new packages for the Qubes Alpha 3 milestone. A lot of under the hood work went into this release, including:
  • Redesigned networking and NetVM support (for VT-d system)
  • Reasonably stable S3 sleep support (suspend-to-RAM), that works even with a NetVM!
  • Improved GUI virtualization (all known bugs fixed finally!)
Disposable VMs are really a killer feature IMO. The screenshot below shows the user's experience:

The user righ-clicks on a PDF file, chooses "Open in Disposable VM", and then waits 1... 2... 3... 4 seconds (assuming a reasonably modern laptop) and the document automagically opens in a fresh new Disposable VM. If you make some changes to the document (e.g. if it was a PDF form, and you edited it), those changes will propagate back to the original file in the original AppVM.

So, within 4-5 seconds, Qubes creates a new VM, boots it up (actually refreshes from a savefile), copies the file in question to the VM, and finally opens the application that is a registered MIME handler for this type of documents, e.g. a PDF viewer. We're pretty confident this time could be further decreased down to some 2 seconds, or maybe even less. This is planned for some later Beta release.

Dynamic memory balancing allows to better utilize system physical memory by moving it between running AppVMs in realtime, according to the VM's real needs. This allows to run more VMs, compared to a scheme with static memory allocation, and also dramatically eliminates system hiccups, that otherwise occur often in a static scheme when one of the VMs is short of memory and initiates swapping.

The screenshot above shows the memory usage on my 6GB laptop when writing this blog post. As you can see I can easily run a dozen of AppVMs (most users will not need that many, but I'm a bit more paranoid I guess ;) and could probably even start a few more if there was such a need (e.g. open some Disposable VMs). Of course, this all depends on the actual type of workload the user runs in each VM - most of my AppVMs run just one or two applications, usually a Web browser (Firefox), but some, e.g. the work, and personal AppVMs run much more memory-hungry applications such as Open Office, or Picasa Photo Browser. I very rarely see more than 1 GB of memory allocated to a single VM, though. Generally speaking, the new memory management in Qubes works pretty nice.

Currently, the biggest slow-down factor for Qubes is somehow poor disk performance, most likely caused by the joint impact of the Xen backend, Linux dm, and kcryptd (we use the simplest possible Xen block backend for security reasons, will move to more sophisticated backends when we introduce untrusted storage domain in Qubes 2.0).

Now, most of the under-the-hood work for Qubes 1.0 seems to be complete, and now it time for all the polishing of the user experience, which will be the main focus of the upcoming Beta development. Just reminding that we're currently looking to hire developers for this effort.

The Installation instructions can be found here. Enjoy! \ No newline at end of file diff --git a/_posts/2010-12-06-update-on-qubes.html b/_posts/2010-12-06-update-on-qubes.html deleted file mode 100644 index a9b5271..0000000 --- a/_posts/2010-12-06-update-on-qubes.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Update on Qubes -date: '2010-12-06T18:23:00.004+01:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -modified_time: '2011-01-04T22:52:31.593+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1897900981379908689 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/12/update-on-qubes.html ---- - -It's been a bit quiet on the Qubes development front for the last 2 months. The reason for this was that Rafal and myself got fully engaged in a new commercial research project. After all, we do need to make money somehow, so that we could later spend them on funding Qubes development :)

But this new engagement is actually closely related to what we do with Qubes (i.e. how new hardware technologies allow to build more secure OSes), so it's not like we're abandoning Qubes, as the experience we get with this research project will surely be useful for us when designing and implementing the Qubes 2.0 architecture.

In order to continue with Qubes, we've decided to hire some Linux programmers, while Rafal and I will continue with our research project over the coming months. We've decided to start a cooperation with another Polish computer outfit, TLS Technologies, who specializes in advanced systems design and implementation.

There are a couple of people people from TLS engaged in Qubes, and you will soon "meet" them on qubes-devel, in our wiki, and of course, you will see their contributions in our git repos.

The plan is to have Beta 1 released sometime in January 20102011. The two important features that will be implemented first, and that will make it into Beta 1 (apart for the long-awaited installer) are: Firewall VMs, and support for templates for service VMs. Stay tuned for more details soon!

If everything goes smoothly, then we should expect Qubes 1.0 sometime at the end of Q1 2011... \ No newline at end of file diff --git a/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html b/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html deleted file mode 100644 index 0b24ece..0000000 --- a/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: My documents got lost/stolen [offtopic] -date: '2011-03-08T14:40:00.007+01:00' -author: Joanna Rutkowska -tags: -- personal -modified_time: '2011-03-13T12:11:55.942+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3724428542352438428 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/03/my-documents-got-loststolen-offtopic.html ---- - -I just realized yesterday that my wallet has disappeared, with all my credit cards, Polish ID card, and driver's license inside. Most likely somebody stole it. No strange transactions have been observed on my credit card accounts yet, but these are generally not much of a concern, thanks to credit card insurance. What is more troubling, is that perhaps some other woman is currently using my stolen ID and the driver's license doing nasty things on my account.

Apparently there is little one can do in Poland (EU?) in order to invalidate a stolen ID card. While there is an inter-bank Polish-wide database of stolen ID cards, it is being used only by banks, so it can only prevent other people from applying for small loans (for bigger loans, one would need more documents). But there are so many other things one could do, such as renting a car (and then committing a crime with it), signing up a deal with a mobile carrier (and then committing a cyber crime using this phone, or just making a really huge bill), or perhaps buying an SSL cert...

With apparently no better option left, I decided to write this blog post -- hopefully somebody will find it, e.g. before issuing a Class 2 SSL cert to the fake Joanna Rutkowska.

Here are the numbers of my lost/stolen documents:
  • AFS739530
  • **********5058
Luckily I have had my ID details written down somewhere, and the driver's license number I extracted from my Hertz profile.

A scene at a police department in Warsaw:
  • Hi, I would like to report my wallet being lost or stolen...
  • Madam, was your wallet stolen, or have you lost it?
  • Officer, how could I possibly know this...? If I lost it, do you really think I would remember the very moment of losing it?
  • Madam, you must be sure whether it was a crime or not!
  • ...
A scene on the hotline, calling my mobile provider (note that I decided to use the word stolen this time):
  • Hi, my documents have been stolen -- I would like that you indicate my ID card as invalid in your system (that you hopefully share with other telcom operators)..
  • You should report such an incident to the police, Madam...
  • Right, but I guess that neither you, nor any other mobile provides in Poland will consult a Police database before signing up a contract with a strange person who might be using my stolen documents, correct?
  • Oh, but we will not sign a contract with a strange person who uses your documents! Only with you!
  • And how would you know it was not me, if that person was similarly aged and looking, and was using my stolen ID and driver's license?
  • ...
\ No newline at end of file diff --git a/_posts/2011-03-13-partitioning-my-digital-life-into.html b/_posts/2011-03-13-partitioning-my-digital-life-into.html deleted file mode 100644 index 66cddc9..0000000 --- a/_posts/2011-03-13-partitioning-my-digital-life-into.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Partitioning my digital life into security domains -date: '2011-03-13T12:11:00.007+01:00' -author: Joanna Rutkowska -tags: -- os security -- general -- qubes -modified_time: '2013-02-21T15:44:07.572+01:00' -thumbnail: http://1.bp.blogspot.com/-IJVsMCGYQak/TXypnudUSjI/AAAAAAAAAHQ/o0OUQhixsPs/s72-c/qubes%2Bpartitioning%2B-%2Bno%2Bflows.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-6127135461889249331 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/03/partitioning-my-digital-life-into.html ---- - -The diagram below illustrates how I have decomposed my digital life into security domains. This is a quite sophisticated scheme and most users would probably want something simpler, but I think it's still interesting to discuss it. The domains are implemented as lightweight AppVMs on Qubes OS. The diagram also shows what type of networking connectivity each domain is allowed.



Let's discuss this diagram bit by bit. The three basic domains are work (the green label), personal (the yellow label), and red (for doing all the untrusted, insensitive things) – these are marked on the diagram with bold frames.

A quick digression on domain labels (colors) – in Qubes OS each domain, apart form having a distinct name, is also assigned a label, which basically is one of the several per-defined colors. These colors, which are used for drawing window decorations by the trusted Window Manager (color frames), are supposed to be user friendly, easy noticeable, indicators of how trusted a given window is. It's totally up to the user how he or she interprets these colors. For me, it has been somehow obvious to associate the red color with something that is untrusted and dangerous (the “red light” -- stop! danger!), green with something that is safe and trusted, while yellow and orange with something in the middle. I have also extended this scheme, to also include blue, and black, which I interpret as indicating progressively more trusted domains than green, with black being something ultimately trusted.

Back to my domains: the work domain is where I have access to my work email, where I keep my work PGP keys, where I prepare reports, slides, papers, etc. I also keep various contracts and NDAs here (yes, these are PDFs, but received from trusted parties via encrypted and signed email – otherwise I open them in Disposable VMs). The work domain has only network access to my work email server (SMTP/IMAP4 over SSL), and nothing more.

For other work-related tasks that require some Web access, such as editing Qubes Wiki, or accepting LinkedIn invites, or downloading cool pictures from fotolia.com for my presentations, or specs and manuals from intel.com, for all this I use work-pub domain, which I have assigned the yellow label, meaning I consider it only somehow trusted, and I would certainly never put my PGP keys there, or any work-related confidential information.

The personal domain is where all my non-work related stuff, such as personal email and calendar, holiday photos, videos, etc, are held. It doesn't really have access to the Web, but if I was into social networking I would then probably allow HTTPS to something like Facebook.
Being somehow on the paranoid side, I also have a special very-personal domain, which I use for the communication with my partner when I'm away from home. We use PGP, of course, and I have a separate PGP keys for this purpose. While we don't discuss any secret and sensitive stuff there, we still prefer to keep our intimate conversations private.

I use shopping for accessing all the internet e-commerce sites. Basically what defines this domain is access to my credit card numbers and my personal address (for shipping). Because I don't really have a dedicated “corporate” credit card, I do all the shopping in this domain, from groceries, through sports equipment, on hotel/plane reservations ending. If I had separate business credit cards, then I would probably split my shopping domain into personal-shopping and work-shopping. I also have banking domain, which I use only for managing my bank account (which again combines both my personal and company accounts).

I also have a few specialized work-related domains, that I rarely use. The work-admin domain is used to manage almost all of the ITL servers, such as our webserver, Qubes repo & wiki servers, email server and DNS management, etc. This domain is allowed only SSH traffic to those server, and HTTPS to a few Web-based management servers. The work-blog is used to manage this very blog you're reading now. The reason why it is separate from work-admin or work, is because I'm over paranoid, and because I fear that if somebody compromises the blogger service, and subsequently exploits a bug in my browser that I use for editing my blog, than I don't want this person to be able to also get admin access to all the ITL servers. 

Similarly, if somebody somehow compromised e.g. the Amazon Web Management Console, and then exploited my browser in work-admin, then I would like at least to retain access to my blog. If I used twitter, I would probably also manage it from this work-blog domain, unless it was a personal twitter account, in which case I would run it from personal.

The qubes-dev domain is used for all the Qubes development, merging other developers' branches (after I verify signatures on their tags, of course!), building RPMs/ISOs (yes, Qubes Beta 1 will ship as a DVD ISO!), and finally signing them. Because the signing keys are there, this domain is very sensitive. This domain is allowed only SSH network access to our Qubes git server. Again, even if somebody compromised this Git server, it still would not be a big problem for us, because we sign and verify all the tags in each others repos (unless somebody could also modify the SSH/Git daemons running there so that they subsequently exploit a hypothetical bug in my git client software when I connect to the server).

I also decided to keep all the accounting-related stuff in a separate domain – whenever I get an invoice I copy it to the accounting domain. The rationale for this is that I trust those PDFs much less than I trust the PDFs I keep in my work domain.

Once a year I move the old stuff from my work domain, such as old email spools, old contracts and NDAs, to the work-archives domain. This is to minimize the potential impact of the potential attack on my work domain (my work domain could be attacked e.g. by exploiting a hypothetical bug in Thunderbird's protocol handshake using a MITM attack, or a hypothetical bug in GPG).

The vault domain is an ultimately trusted one where I generate and keep all my passwords (using keepass) and master GPG keys. Of course, this vault domain has no networking access. Most of those passwords, such as the email server access password is also kept in the specific domains which uses them, such as the work domain, and more specifically in the Thunderbird client (there is absolutely no point in not allowing e.g. Thunderbird to remember the password – if it got compromised it would just steal it the next time I manually enter it)

And finally, there is the previously mentioned red domain (I have tried to call it junk or random in the past, but I think red is still a better name after all). The red domain is totally untrusted – if it gets compromised, I don't care – I would just recreate it within seconds. I don't even back it up! Basically I do there everything that doesn't fit into other domains, and which doesn't require me to provide any sensitive information. I don't differentiate between work-related and personal-related surfing even – I don't care about anonymity for all those tasks I do there. If I was concerned about anonymity, I would create a separate anonymous domain, and proxy all the traffic through a tor proxy from there.

Now, this all looks nice and easy ;) but there is one thing that complicates the above picture...

Data flows between the domains

The diagram below shows the same domains, but additionally with arrows symbolizing typical data flows between them.


You can see that most of the usual data flows are from more trusted domains to less trusted domains – e.g. copy and pasting a URL that I receive via email in my work domain, so that I could open it in my untrusted browser in red, or moving invoices from my work domain (where I receive them via email) to the accounting domain.

But there are, unfortunately, also some transfers from less trusted domains to more trusted ones. One example is copy and pasting an interesting URL that I just stumbled upon when surfing in the red domain, and that I would like to share with a college at work, or a friend, and so I need to copy and paste it to my email client in either work (colleague) or personal (friend) domain.

Now, copying data from less trusted domains to more trusted ones presents a significant problem. While one could think that pasting an URL into Thunderbird email editor is a pretty harmless operation, it's still is an untrusted input – and we don't really know what the red domain really pasted into its local clipboard, and so what we will paste into the work domain's Thunderbird email editor (perhaps 64kB of some junk that will overflow some undo buffer in the editor?). And even more scary is the example with copying the cool-looking graphics file from the Web into my work domain so that I could use it in my presentation slides (e.g. an xkcd . Attacks originating through malicious JPEGs or other graphics format, and exploiting bugs in rendering code have been known for more than a decade.

But this problem – how to handle data flows from less trusted systems to more trusted ones – is not easily solvable in practice, unfortunately...
Some people who design and build high-security systems for use by military and government takes a somehow opposite approach – they say they are not concerned about less-trusted-to-more-trusted data transfers as long as they could assure there is no way to perform a transfer in the opposite direction. 

So, if we could build a system that guarantees that a more trusted domain can never transfer data to a less trusted domain (even if both of those domains are compromised!), then they are happy to allow one-way “up transfers”. In practice this means we need to eliminate all the covert channels between two cooperating domains. The word cooperating is a key word here, and which makes this whole idea not practical at all, IMHO.

Elimination of the covert channels between cooperating domains is indeed required in this scheme, because the assumption is that the data transfer from the less trusted domain could have indeed compromised the more trusted domain. But this, at least, should not result in any data leak back to the originating domain, and later to the less-classified network, which this less-trusted domain is presumably connected to. One of the assumptions here is that the user of such a system is connected to more than one, isolated networks. Even in that case, elimination of all the covert channels between domains (or at least minimizing their bandwith to something unusable – what is unusable, really?) is a big challenge, and can probably only could be done when we're ready to significantly sacrifice the system's performance (smart scheduling tricks are needed to minimize temporal covert channels).

I would like to make it clear that we are not interested in eliminating cooperative covert channels between domains in Qubes any time in the near future, and perhaps in the long term as well. I just don't believe into such approach, and I also don't like that this approach does nothing to preserve the integrity of the more-trusted domain – it only focuses on the isolation aspect. So, perhaps the attacker might not be able to leak secrets back to the less trusted domain, but he or she can do everything else in this more trusted domain. What good is isolation, if we don't maintain integrity?

An alternative solution to handling the less-trusted-to-more-trusted data transfers, is to have trusted “converters” or “verifiers” that could handle specific file types, such as JPEGs, and ensure we get a non-malicious file in the destination domain. While this might remind the bad-old A/V technology, it is something different. Here, the trusted converters would likely be some programs written in a safe language, running in another trusted domain, rather than a big ugly A/V with a huge database of signatures of “bad” patterns of what might appear in a JPEG file. The obvious problem with such an approach is that somebody must write those converters, and write them for all file types that we wish to allow to be transferred to more trusted domains. Perhaps doable in the longer-term, and perhaps we will do it in some future version of Qubes...

Right now we are ignoring this problem, and we say that all less-trusted-to-more-trusted transfers are to be done on the user's own risk :) You're welcome to submit trusted converters for your favorite file type(s) in the meantime!


Copying files between domains


Speaking of copying files between domains, there is another security catch here. If we imagined two physically separated machines that share no common network resources, the only way to move files between those two air-gaped machines would be via something like a USB stick or a CDROM or DVD disc. But inserting a USB drive or CDROM into a machine triggers a whole lot of actions: from parsing device-provided information, loading required drivers (for USB), parsing the driver's partition table, mounting and finally parsing the filesystem. Each of this stage requires the machine's OS to perform a lot of untrusted input processing, and the potential attack space here is quite large. So, even if we could limit ourselves to copy only harmless files between machines/domains (perhaps they were somehow verified by a trusted party in-between, as discussed above), still there is a huge opportunity that the originating domain could compromise the target domain.

In Qubes Alpha we have been using a similar file copy mechanism, using a virtual stick for file copy between domains. In Qubes Beta 1 we will provide a new scheme based on same shared memory channel that we use for GUI virtualization – the technical details of this solution will be available soon in our wiki. The most sensitive element in this new scheme is the un-cpio-like utility that runs in the target domain and unpacks the incoming blob into the pre-defined directory tree (e.g. /home/user/incoming/from-{domainname}/). We believe we can write pretty safe un-cpio-like utility, in contrast to secure all the previously mentioned elements (USB device parsing, partition parsing, fs parsing). The Qubes Beta 1 is planned to be released at the end of March, BTW.

Partitioning enforcement and easy of use

For any security partitioning scheme to make sense in real life, it is necessary to have some enforcement mechanism that would ensure that the user doesn't mistakenly bypass it. Specifically for this purpose we have come up with special, previously-mentioned firewalling support in Qubes Beta 1, that I will cover in a separate article soon.

Anther thing is to make the partitioning easy to use. For instance, I would like to be able to setup a hint in the policy, that when I click on an URL in an email I received in my work domain that it should be automatically opened in the red domain's default Web browser. Currently we don't do that in Qubes, but we're thinking about doing it in the near future.

Summary

Partitioning one's digital life into security domains is certainly not an easy process and requires some thinking. This process is also very user-specific. The partitioning scheme that I've come up for myself is quite sophisticated, and most people would probably want something much simpler. In case of corporate deployments, the scheme would be designed by CIO or IT admins, and enforced on users automatically. Much bigger problem are home and small business users, who would need to come up with the partitioning themselves. Perhaps in future versions of Qubes we will provide some ready to use templates for select "typical" groups of users. \ No newline at end of file diff --git a/_posts/2011-04-12-qubes-beta-1-has-been-released.html b/_posts/2011-04-12-qubes-beta-1-has-been-released.html deleted file mode 100644 index 8673820..0000000 --- a/_posts/2011-04-12-qubes-beta-1-has-been-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 1 has been released! -date: '2011-04-12T08:49:00.001+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2011-04-25T23:05:12.416+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1742367838131028779 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/qubes-beta-1-has-been-released.html ---- - -I'm very proud to announce that we have just released Qubes Beta 1! Some new features that have come into this release include:
  • Installer (finally!),
  • Improved template sharing mechanism: service VMs can now be based on a common template, and you can now easily create many net- and proxy- VMs; template upgrades now don't require shutting down all the VMs;
  • Standalone VMs, convenient for development, as well as for installing the least trusted software,
  • Built in, easy to use firewall VM(s),
  • Seamless integration of virtualized tray icons (check the screen shots!)
  • Redesigned file-copy between domains (easier, more secure),
  • Default template based on Fedora 14 (x64)
... and many other improvements and bug fixes!

To download the installation ISO go to this page.

You can also install Qubes on an external USB disk - this might be a convenient option if you want to just try it out, without the need to "sacrifice" your laptop.

This release is very stable, but we feel that it still requires some more polish, mostly with regards to user interface. We're planning to release at least one more beta, in about 2 months, where we will focus mostly on UI improvements, and also on upgrading Xen and kernel in Dom0 to allow for better hardware support.

The final Qubes 1.0 is planned after the summer holidays. Once we reach this milestone, further work will likely fork into two branches:
  • The "commercial branch" which will focus on adding various extensions on top of Qubes 1. One specific commercial extension that we think would be a killer is support for Windows-based domains (AppVMs),
  • The "open source branch" that will continue on implementing even more revolutionary architecture and features, such as untrusted storage domains, safe GPU multiplexing, trusted boot, etc. In the end this should lead to Qubes 2.0 sometime in 2012 or 2013.
Cross your fingers! \ No newline at end of file diff --git a/_posts/2011-04-16-why-us-password-revolution-wont-work.html b/_posts/2011-04-16-why-us-password-revolution-wont-work.html deleted file mode 100644 index e9cc2b8..0000000 --- a/_posts/2011-04-16-why-us-password-revolution-wont-work.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Why the US "password revolution" won't work -date: '2011-04-16T14:29:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- trusted computing -- general -modified_time: '2011-07-24T12:07:34.903+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3884781202259282494 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/why-us-password-revolution-wont-work.html ---- - -So, I've been reading this article this morning on how the US "private and public" institutions are going to revolutionize the way we authenticate on the web. The "ground breaking" idea, also illustrated on this NIST animation, is to use 3rd party authorities that would first verify your identity somehow ("Can we see your id?", "What is your Mam's maiden name?", etc), and then would issue you some kind of a token that you would later use for authentication on the web. A token would be e.g. a smart card, or a USB stick (probably they just mean a smart card with USB connector, whatever), or even a "phone application".

The idea is that the user will not have to "remember" all those passwords for all the various websites, which apparently is a problem in practice, because most users never heard about password manager apps, and so they actually try to remember all those passwords, or even try to use the same one all over the place. Using one password for more than one website is obviously wrong and people should be told not to do that. But an easy way to solve this is to just get people to use password managers.

But the key problem that they try to solve, which is identity theft, is just not gonna be solved by this "password revolution". This is because if somebody has compromised my laptop, then it really doesn't matter if I use passwords, or smart cards, or whatever other multi-factor authentication mechanism -- none of them will help if the attacker controls my operating system.

Most people cannot just get it -- this is because they lack understanding of how computers and operating systems work. They don't understand that the operating system can impersonate the user at will! This is because the operating system fully controls the keyboard, the mouse, and the screen.

So, imagine you use your super-secure smart card token for authentication to your bank. So, before you log into your bank account, and perhaps before you make any transaction on the banking website, you must insert your smart card somewhere (e.g. into smart card reader, or into USB port, etc). Before you insert your token, no one can impersonate you on the bank website. So far, so good! But then, once you inserted your token, it's all lost! The compromised OS could have saved your PIN to this card when you used it previously (even if you configured it not to do so!) and now,  immediately, it could use the inserted card to authenticate as you to the bank and start issuing transactions on your behalf. And you won't even notice this all, because in the meantime it will show you a faked screen of your banking account. After all, it fully controls the screen.

The bottom line is that we cannot secure our digital lives, if our client operating systems could not be secured first. And today, the operating systems we use on our laptops, such as Windows, or Mac, or Ubuntu, are just trivial to be compromised by the attackers. After all, if that wasn't true we wouldn't have all those problems with identity theft. But introduction of tokens won't make our operating systems any more secure!

What we need instead are technologies that allow to build next-generation trusted operating systems. Technologies such as Intel TXT or VT-d. And we need OS vendors to actually start using them.

You can say I'm biased, because of our work on Qubes OS. But then, consider this -- perhaps we would never invest so much money and resources into this project, if we believed there are other ways to bring security to our digital life. \ No newline at end of file diff --git a/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html b/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html deleted file mode 100644 index cabed3a..0000000 --- a/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: 'The Linux Security Circus: On GUI isolation' -date: '2011-04-23T16:52:00.008+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -modified_time: '2011-04-25T23:04:59.505+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1548152289459004392 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-on-gui-isolation.html ---- - -
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and how it essentially nullifies all the desktop security. I wrote about it a few times, I spoke about it a few times, yet I still come across people who don't realize it all the time.

So, let me stress this one more time: if you have two GUI applications, e.g. an OpenOffice Word Processor, and a stupid Tetris game, both of which granted access to your screen (your X server), then there is no isolation between those two apps. Even if they run as different user accounts! Even if they are somehow sandboxed by SELinux or whatever! None, zero, null, nil!

The X server architecture, designed long time ago by some happy hippies who just thought all the people apps are good and non-malicious, simply allows any GUI application to control any other one. No bugs, no exploits, no tricks, are required. This is all by design. One application can sniff or inject keystrokes to another one, can take snapshots of the screen occupied by windows belonging to another one, etc.

If you don't believe me, I suggest you do a simple experiment. Open a terminal window, as normal user, and run xinput list, which is a standard diagnostic program for Xorg (on Fedora you will likely need to install it first: yum install xorg-x11-apps):

$ xinput list

It will show you all the pointer and keyboard devices that your Xorg knows about. Note the ID of the device listed as “AT keyboard” and then run (as normal user!):

$ xinput test id

It should now start displaying the scancodes for all the keys you press on the keyboard. If it doesn't, it means you used a wrong device ID.

Now, for the best, start another terminal window, and switch to root (e.g. using su, or sudo). Notice how the xinput running as user is able to sniff all your keystrokes, including root password (for su), and then all the keystrokes you enter in your root session. Start some GUI app as root, or as different user, again notice how your xinput can sniff all the keystrokes you enter to this other app!

Yes, I can understand what is happening in your mind and heart right now... Don't worry, others have also passed through it. Feel free to hate me, throw out insults at me, etc. I don't mind, really (I just won't moderate them). When you calm down, continue reading.

In Qubes the above problem doesn't exist, because each domain (each AppVM) has it own local, isolated, dummy X server. The main X server, that runs in Dom0 and that handles the real display is never exposed to any of the AppVMs directly (AppVMs cannot connect to it via the X protocol). For details see this technical overview.

You can repeat the same experiment in Qubes. You just need to use the ID of the “qubesdev” device, as shown by xinput list (should be 7). Run the xinput in one of your domains, e.g. in the “red” one. Because we actually use the same device for both mouse and keystrokes, you should now see both the key scancodes, as well as all the mouse events. Notice how your xinput is able to sniff all the events that are destined for other apps belonging to the same domain where you run xinput, and how it is unable to sniff anything targeted to other domains, or Dom0.

BTW, Windows is the only one mainstream OS I'm aware of, that actually attempts to implement some form of GUI-level isolation, starting from Windows Vista. See e.g. this ancient article I wrote in the days when I used Vista at my primary laptop. Of course, it's still easy to bypass this isolation, because of the huge interface that is exposed to each GUI client (that also includes GPU API). Nevertheless, they at least attempt to prevent this at the architecture level.
\ No newline at end of file diff --git a/_posts/2011-05-13-following-white-rabbit-software-attacks.html b/_posts/2011-05-13-following-white-rabbit-software-attacks.html deleted file mode 100644 index de66f50..0000000 --- a/_posts/2011-05-13-following-white-rabbit-software-attacks.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Following the White Rabbit: Software Attacks Against Intel VT-d' -date: '2011-05-13T19:04:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- attack -- trusted computing -- exploit -modified_time: '2011-07-24T12:08:06.132+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5608264528014721919 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html ---- - -Today we publish a new paper which is a result of our several month long in-depth evaluation of Intel VT-d technology. To quote the abstract:
We discuss three software attacks that might allow for escaping from a VT-d-protected driver domain in a virtualization system. We then focus on one of those attacks, and demonstrate practical and reliable code execution exploit against a Xen system. Finally, we discuss how new hardware from Intel offers a potential for protection against our attacks in the form of Interrupt Remapping (for client systems available only on the very latest Sandy Bridge processors). But we also discuss how this protection could be circumvented on a Xen system under certain circumstances...

I think the attack is likely the most complex and surprising out of all the things we have presented so far. Parts of it are even funny (if you share our weird sense of humor), such as the use of ICMP ping to generate MSIs. The paper also covers the vendors' response. You can download the paper here. \ No newline at end of file diff --git a/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html b/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html deleted file mode 100644 index c537648..0000000 --- a/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: The App-oriented UI Model and its Security Implications -date: '2011-05-21T20:17:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- philosophical -- general -- qubes -modified_time: '2011-07-24T12:08:19.636+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7354555212668635236 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/app-oriented-ui-model-and-its-security.html ---- - -
Most of the desktop OSes today, such as Windows or Mac, expose and encourage a File-oriented UI model. You pick a file in the file manager, click it, and then the file manager automagically determines the best app to handle the file, starts the app, and passes the file to it.

Back in the MS-DOS days we used a different model: an app-oriented model – you started an app first, e.g. Word Perfect, or Lotus 1-2-3, and then you opened a file from within the app (Norton Commander and similar programs somehow changed that later).

Interestingly this very same app-oriented model is now becoming popular again thanks to systems such as iOS and Android. There is no such thing as a global File Explorer or Finder on an iPad. Only the apps. One must first pick an app, and then it's the application's responsibility to expose an option for opening one of your “files”, if the app supports it (e.g. the calendar or task list apps would always open your default calendar or task list without asking for anything).

I actually like this app-oriented model a lot! It's much less confusing to the user. Just think about all those attacks in the past where an attacker could prepare a file with some innocently-looking extension but which in fact was an MZ executable. Or how many times people are not even aware which app they use! One might argue that user should not be distracted by such “unimportant” things as what app he or she uses for her work, but I disagree. Apparently Apple, and millions of iPhone and iPad users, disagree too.

But the main reason why I like this app-oriented model is because it just fits greatly into the Security by Isolation philosophy.

Just think about it: if it's possible to get users to consciously select an app, and we now know it is possible thanks to the millions of app-oriented devices sold, then it should be not much more difficult to get them to also consciously select the domain or area, such as “work”, or “personal”, which they wish to use. Just imagine that instead of one “Mail” app, you would have two apps (and two icons): “Mail Work”, and “Mail Personal”.

There are some technicalities here – such as e.g. how to isolate apps between each other? Do we need to build another layer of isolation in a form of VMs to isolate “Mail Work” from “Mail Personal”, or should the (new) OSes and the (new) APIs be designed in such a way, that they were thin and secure, and allow for very good isolation between processes without using virtualization?

In Qubes we must use this additional layer of abstraction (virtualization), because we want to use Linux apps (and in the future also Windows apps), and they require huge POSIX/X API (and Win32 API) to work correctly. And those APIs are not easily isolate-able. So we use VMs as “API providers”. Same with isolating networking drivers and stacks – we need Linux kernel API to get those drivers and stacks running, so that's why we use a Linux-based “NetVM” for isolating networking. For this reason we expect users to explicitly define domains, such as “work”, “personal”, etc. This is because we cannot afford to run every single app in a separate AppVM (more precisely we cannot afford to create a working copy of this huge POSIX/X API for each app).

But we could very well imagine a well constructed API for apps that would just be easily isolate-able (I'm not saying iOS or Android has such an API), and so there would be no need to define domains explicitly. Still, we would need a possibility to define more than one instance of each app – such as the previously mentioned “Mail Work” and “Mail Personal”.


The app-oriented model seems to be the future. And so seems the Security by Isolation philosophy!
\ No newline at end of file diff --git a/_posts/2011-05-28-untrusting-cloud.html b/_posts/2011-05-28-untrusting-cloud.html deleted file mode 100644 index e738f2c..0000000 --- a/_posts/2011-05-28-untrusting-cloud.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: (Un)Trusting the Cloud -date: '2011-05-28T14:56:00.003+02:00' -author: Joanna Rutkowska -tags: -- cloud -- philosophical -- general -- fighting for a better world -modified_time: '2011-07-24T12:08:31.948+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2297606500415169677 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/untrusting-cloud.html ---- - -
Everybody loves The Cloud these days, and it is not hard to understand why. When every person owns computers (devices), the cloud is really hard to beat when it comes to syncing all your digital life back and forth between all those devices, and also sharing with your family members, friends, and colleagues at work. From task lists, through calendars, through health & fitness data, to work-related documents. And I'm not even mentioning all the unencrypted email that is out there.

One doesn't need to be especially smart or security conscious to realize how much this might be a threat to security and privacy. How much easier would it be to attack somebody's laptop if I knew precisely in which hotel and when he or she is planning to stay? How much more expensive would my health and life insurance be, if they could get a look at my health and fitness progress? Etc.

But we're willing to sacrifice our privacy and security in exchange for easy of syncing and sharing of our data. We decide to trust The Cloud. What specifically does that mean?

First, it means we trust the particular cloud-based service vendor, such as the provides of our training monitoring app and service. We trust that this vendor is: 1) non-malicious and ethical, and so is not going to sell our private data to some other entity, e.g. insurance company, and 2) that the software written by this vendor is somehow secure, so it would not be easy for an attacker to break into their cloud service and download all the user's data (and then sell to health insurance companies).

Next, we trust the cloud infrastructure provider, such as Amazon EC2. We trust that the cloud provider is 1) non-malicious and ethical, and that they won't really read the memory of the virtual machine on which the previously mentioned cloud-service is running (and won't make it available to a local government officials, e.g. in China), and 2) that they secured their infrastructure properly (e.g. it wouldn't be easy for one customer to “escape” from a VM and read all the memory of the VMs belonging to other customers).

Finally we trust all the infrastructure that is in the middle between us and the service provider, such as e.g. the networking protocols, are safe to use (e.g. we trust all the engineers working in any of the ISP we use won't sniff/spoof our communication, e.g. by using some fake or quasi-fake SSL certs).

So, that's a hell of a lot of trusting! And the stake is high. Do we really need to make such a sacrifice? Do we really need to hand in all our private data to all those organizations? Of course we don't!

First, notice that in majority of cases, the cloud is only used basically as a on-line storage. No processing, just dump storage. Indeed, what kind of server-side processing does your task list or calender require? Or your freestyle swimming results? Or your conference slides? None.

And we know for very long how to safely keep secrets on untrusted storage, don't we? This is achieved via encryption (and digital signatures for integrity/authenticity). So, the idea is very simple: let's encrypt all the data before we send them to the cloud. The point here is, the encryption must be done by the app that is running on our client device. Not in the cloud, of course.

Ok, so let's say I have my calendar records encrypted in the cloud, how do I share it with my other devices and other people, such as my partner and colleagues at work? Very simple – you encrypt each record with a random symmetric key and then, for every other device or person who you want to grant access to your calendar you make the symmetric key available to this person, by encrypting it with their public key (if you're paranoid, you can even verify fingerprints using some out-band communication channel, such as phone, to ensure the cloud/service provider didn't do MITM attack on you). What if you want to share only some events (or some details) with some group of people (e.g. only your availability info)? Very simple – just encrypt those records you want to share in non-full access with some other symmetric key and publish only this key to those people/devices you want to grant such non-full access.

Implementing the above would require writing new end-user apps, or plugins for existing apps (such as Outlook), so that they do encryption/decryption/signing/verification before sending the data out to the cloud. But what stops the malicious vendor from offering apps that would be leaking out our secrets, e.g. the keys? Well, nothing actually. But this time, the vendor would need to explicitly build in some kind of backdoor into the app. The same could be done with any other vendor, and any other, non-cloud-based app. After all, how do we know that MS Word, which is not cloud-based yet, is not sending out fragments of our texts to Agent Smith? Note how different this is from a situation when the vendor already owns all our data, unencrypted, brought legitimately to their servers, and all they need to do is to read them from their own disks. No need to plant and distribute any backdoors!

In practice few vendors would be risking their reputation and would be willing to build in a backdoor into an app that is then made available to customers. Because every backdoor in such client-exposed code will sooner or later be found (You would really not believe what great lengths all those young people aimed with disassembler and debugger would go to, to win an economy class ticket to the middle of desert in the hottest summer season, just to be able to deliver a presentation on how evil/stupid a company X is ;).

One problem is, however, with accessing our encrypted cloud over a Web Browser. In contrast to apps, the web browser content is much less identifiable. An app can have a digital signature – everybody know its an App v 1.1, published by X. As explained above it would be rather stupid for X to plant a backdoor into such an app. But a Web-delivered Javascript is much more tentative, and it's very possible for X to e.g. deliver various versions of scripts to different customers. Digital signature on client-side scripts, paired with ability to whitelist allowed client-side-scripts, would likely solve this problem.

So, why we still haven't got client-side-encrypted cloud-services? The question is rhetorical, of course. Most vendors actually loves the idea of having unlimited access to their customers data. Do you think Google would be happy to give up an opportunity to data mine all your data? This might affect their ad business, health research, or just Secret Plan To 0wn The World. After our dead body, I can almost hear them yelling! After all they have just came up with Chrome OS to bring even more data into their data mining machine...

To sum it up, there is no technical reason we must entrust all those people with our most private data. Sooner or later somebody will start selling client-side-encrypted cloud services, and I would be the first person to sign up for it. Hopefully it will happen sooner than later (to late?).

This post also hopefully shows, again, one more aspect – that we can, relatively easy, move most of the IT infrastructure out of the “TCB” (Trusted Computing Base, used as metaphor here). In other words, we can design our systems and services so that we don't need to trust a whole lot of things, including servers and the networking infrastructure (except for its reliability, but not for its security). But, there always remains one element that we must trust – these are our client devices. If they are compromised, the attacker can steal everything.

Strangely most people still don't get it, or get it backwards. Just the fact that “information is not stored on the iPad but kept safe on the corporate network”, doesn't change anything! Really. If the attacker owns your iPad, then she also can do anything that the legitimate user could do from this iPad. So if you could get to the company's secret trade data from your iPad's Receiver, so would be able to do the malware/attacker.
\ No newline at end of file diff --git a/_posts/2011-06-01-usb-security-challenges.html b/_posts/2011-06-01-usb-security-challenges.html deleted file mode 100644 index 3eb31f0..0000000 --- a/_posts/2011-06-01-usb-security-challenges.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: USB Security Challenges -date: '2011-06-01T01:25:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- challanges -- secure architecture -- usb -- qubes -modified_time: '2011-07-24T12:08:42.903+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8736093765434856111 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/usb-security-challenges.html ---- - -
When we think about “USB Security” there are lots of things that come to mind...

First there are all the physical attacks that could be conducted with the help of USB devices. These are generally not so interesting, because if one includes physical attacks in the threat model, then it really opens up lots of possibilities of various attacks, and generally a physical attacker always wins. Still, there are a few very cheap and easy physical attacks that one would like to avoid, or make harder, such as the Evil Maid Attacks or the Cold Boot Attacks. Strictly speaking these are not problems inherent to USB itself, but rather with lack of Trusted Boot, or OS not cleaning properly secrets from memory upon shutdown. They are just made simple thanks to bootable USB sticks.

Much more interesting USB-related physical attacks are those that take advantage of the specifics of the USB standard. One example here would be a malicious USB device that exposes intentionally malformed info about itself in order to exploit a potential flaw in a USB Host Controller driver that processes this info upon each new USB device connect. Or a malicious USB device that would trick the OS (Windows at least) into downloading a known buggy USB driver (or even an intentionally malicious driver, legally submitted to WHQL by the attacker) and then exploit the driver.

Another class of physical attacks made possible by the USB specification are malicious USB devices that pretend to be a keyboard or mouse. The input devices, such as keyboard, are actually the most security sensitive devices, because an attacker who controls the keyboard can do everything the user can do, which basically means: can do everything, at least with regards to the user's data.

Finally, the USB, as the names stands, is a bus interconnect, which means all the USB devices sharing the same USB controller are capable of sniffing and spoofing signals on the bus. This is one of the key differences between USB and PCI Express standards, where the latter uses a peer-to-peer interconnect architecture.

Ok, so these all above were physical attacks. Let's now look at, much more fatal, software attacks.

The infamous class of attacks exploiting various autorun or auto-preview behaviors is the most known example, but also the easiest, at least in theory, to protect against.

Much more interesting are software attacks that attempt to exploit potential flaws in the USB stacks – similarly like the physical attacks mentioned above, just that this time not requiring any hardware-level modifications to the USB device. Exposing a malformed partition table is a great example of such an attack. Even if we have all the autorun mechanisms disabled, still, when we're inserting a storage medium the OS always attempts to parse the partition table in order to e.g. create devices symbolizing each partition/volume (e.g. /dev/sdbX devices).

Now, this is really a problematic attack, because the malformed partition table can be written onto a fully legitimate USB stick by malware. Imagine e.g. you have two physically separated machines (air-gapped), belonging to two different security domains, and you want to transfer files from one to another. You insert the USB stick into the first machine, copy files, and then insert the stick to the second machine. If the first machine was compromised, it could have altered the partition table on the USB stick, and now when this stick is inserted into the other machine its malformed partition table might exploit a buffer overflow in the code used by the second OS to parse the stick's partition information. Air-gapped systems, huh? We avoid this attack vector in Qubes by using a special inter-domain file copy mechanism that doesn't require any metadata parsing.

A variation of the above attack would be to expose a malicious file system metadata, but this time the target OS would have to actually mount the partition for the attack to work (and, of course, there would have to be bugs in the OS file system parsing code, although these  seem to be quite common on most OSes).

Having quickly summarized the USB security-related threats, let's now think about how we could design an OS to mitigate most of those attacks, and at the very least the software-based attacks. This is, in fact, precisely the challenge we've been facing in Qubes, so the divagations below necessarily focus mostly on the Qubes architecture.

First we should realize that USB devices, unlike PCI Express devices, cannot be independently delegated to different domains (VMs). This is because IOMMU technologies, such as Intel VT-d, operate only on PCIe device granularity. This means we can only delegate a whole USB controller to a domain, including all of the USB devices connected to this controller/hub.

Imagine now two internal devices, both connected via internal USB bus: a keyboard, and a 3G wireless modem. Chances are high that you will have those two devices connected to the same USB controller – usually one controller is used for all the internal devices, like those I just mentioned, plus camera, fingerprint reader, etc, and the other controller is used for all the externally visible USB connectors (at least this is true for modern systems: Intel Series 5 chipsets and newer).

We would like to be able to delegate the 3G modem to the NetVM (an untrusted domain on Qubes where all the networking drivers and stacks are kept; it's considered untrusted because its compromise is equivalent to a compromise of a WiFi network or home router, or some other router, and any reasonable person always assumes that the network is compromised, and deals with that using crypto, such as SSL or SSH). But assigning the USB controller, to which the 3G modem is connected to, to the NetVM, would also assign the USB keyboard to the NetVM! And this is precisely what we don't want to do, because control over the keyboard is equivalent to the control over the whole system!

Currently, in Qubes Beta 1, we keep all the USB controllers assigned to Dom0. This, however, causes two annoyances:

First, the user cannot use any of the USB-connected networking devices, such as 3G modems (because there is no networking in Dom0).

Second, if somebody connects a USB disk and later delegates it to some domain (this could easily be done via block-attach mechanism, supported by the same backend that handles storage virtualization for domains), and this domain turns out to be compromised, it might alter e.g. the stick's partition table and later attack Dom0 as explained above.

We can eliminate the second problem by modifying the Dom0's kernel to not parse the partition table of any removable devices automatically, and instead expect some kind of explicit consent from user to actually do that (we still must allow to mount USB disks in Dom0 to allow easy backups of all domains at once).

To allow the use of USB-connected networking devices in NetVM, we could use a PVUSB backend that can virtualize single USB devices without moving the whole USB controller to the domain. But that would require introducing a whole lot of new code to Dom0 – code that would be directly reachable from VMs (in other words that would be processing lots of untrusted input coming from untrusted domains).

So another option is to delegate all the non-security-critical USB controllers, i.e. those controllers that don't have any security-sensitive USB devices connected, such as keyboard, to a dedicated “USB” domain, and later share the USB devices via PVUSB backend from this USB domain. This time, the extra PVUSB backend runs in the USB domain, not in Dom0, so we don't worry that much about potential bugs in this backend. Of course, this way you cannot delegate the USB controller to which the keyboard, and potentially also other security-critical devices, such as camera, are connected to, which in practice rules out the integrated3G modem. Fortunately many modern laptops do not use USB-connected keyboard and touchpad (they use PS/2-connected keyboards instead), and the face camera can be easily disabled with a piece of sticker (although that sucks, because it means we cannot really use the camera).

With this approach (a dedicated USB domain) you can now delegate your 3G modem to the NetVM, and other USB devices, such as removable disks to other domains, e.g. for file exchange. This seems the most reasonable setup, although it requires that either 1) your laptop doesn't have USB-connected keyboard, or 2) you don't use internal USB devices connected to the same controller that your USB keyboard/touchpad from other domains than Dom0 (in practice: no 3G modem in NetVM).

As we can see proper handling of USB devices is quite a challenge for OS architects. It might have been much less of a challenge if the engineers designing the USB, chipsets, and motherboards were a bit more security-conscious. Even such simple practice as never mixing security critical devices (keyboard, touchpad, camera, fingerprint reader), with non-security ones (3G modem), onto the same USB controller, would help tremendously. Or ability to somehow dynamically configure their connectivity, e.g. in BIOS?
\ No newline at end of file diff --git a/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html b/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html deleted file mode 100644 index af87804..0000000 --- a/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: From Slides to Silicon in 3 years! -date: '2011-06-03T17:16:00.003+02:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2011-07-24T12:08:54.874+02:00' -thumbnail: http://2.bp.blogspot.com/-UUqClGOWD3w/Tej5DuLF_GI/AAAAAAAAAIE/qBrKYYHJi8M/s72-c/slide97 -blogger_id: tag:blogger.com,1999:blog-24586388.post-3206816702689101078 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/from-slides-to-silicon-in-3-years.html ---- - -
Remember our Xen 0wning Trilogy at Black Hat in summer 2008, specifically the presentation on Detecting & Preventing the Xen Hypervisor Subversions?

One of the things we were discussing there was a proposal to include an additional restriction to Intel processors that would disallow execution of usermode pages from within supervisor mode (ring0). Such a feature, we argued, apart from obviously making many ring3-to-ring0 exploits much harder, including the very Xen heap overflow exploit we presented in the slides, would also bring us closer to efficient runtime code integrity checkers for kernels and hypervisors, as discussed in the slides.


Slide #97, Detecting and Preventing Xen Hypervisor Subversions, Black Hat USA, July, 2008

Fast forward 3 years. On June 1st, 2011, an Intel engineer is submitting a patch for Xen to support a mysterious new processor feature called SMEP (Supervisor Mode Execution Protection). He writes the feature is not yet documented in SDM, but soon will be. In fact, the May 2011 update of Intel SDM already contains the details:

Intel SDM, vol. 3a, May 2011, source: intel.com

Some other people spotted this feature earlier, because of another patch submitted by another Intel engineer to Linux kernel a few weeks ago. Here's a good write up by Dan Rosenberg discussing how this patch makes writing Linux kernel exploits harder, and how it's still possible to write them.

The SMEP feature still doesn't seem to be present in the processors available on the market, including the latest Sand Bridge processors, but there's no question it's coming, now that the feature made it into SDM.

It is quite rewarding to see your idea implemented in a processor... I guess this is how physicists feel when they introduce a new particle as part of a new quantum model, and later discover evidences to support the existence of this very particle in the wild...
\ No newline at end of file diff --git a/_posts/2011-06-10-my-sstic-2011-slides.html b/_posts/2011-06-10-my-sstic-2011-slides.html deleted file mode 100644 index fd9a757..0000000 --- a/_posts/2011-06-10-my-sstic-2011-slides.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: My SSTIC 2011 slides -date: '2011-06-10T15:02:00.002+02:00' -author: Joanna Rutkowska -tags: -- conferences -modified_time: '2011-07-24T12:09:17.985+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7155368799305734593 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/my-sstic-2011-slides.html ---- - -A few days ago I had a privilege to give an opening keynote at the SSTIC conference in Rennes, France, which is believed by many to be the most important security conference in France. You can find my slides here.

SSTIC seems to be a very interesting conference indeed, with a strong emphasis on system-level security, which is quite unusual these days where most conferences focus on networking, apps, and web-apps. What a pity all those interestingly-looking talks have been encoded in an obscure language used only by some 3% of the population of the planet...

Anyway, it was a pleasure to talk to some ANSSI people I met before the conference (one of the organizers of the event) who really seemed to understand well the challenges we face with building secure operating systems, and generally seemed well versed in the topic. Perhaps some other nations should learn from France, instead of proposing ridiculous and superficial means that can't really solve any real problem. \ No newline at end of file diff --git a/_posts/2011-08-30-interview-about-qubes-os.html b/_posts/2011-08-30-interview-about-qubes-os.html deleted file mode 100644 index d0b58c8..0000000 --- a/_posts/2011-08-30-interview-about-qubes-os.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Interview about Qubes OS -date: '2011-08-30T23:06:00.001+02:00' -author: Joanna Rutkowska -tags: -- general -- qubes -modified_time: '2011-09-28T16:37:08.233+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6490495664553004297 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/08/interview-about-qubes-os.html ---- - -Here is a recent interview with me for Tom's Hardware, where I talk about Qubes, why virtualization alone does not automatically bring much security, and why we need it for secure systems anyway, and all that kind of stuff. Nothing really new, but still might be of interest to some readers.

As for Qubes Beta 2 release -- it really is coming, but we've faced recently some very nasty, race-condition-related problems with new Xen (we bravely switched to Xen 4.1 in Beta 2) that seem to occur on machines with very fast SSDs and we're currently trying to see if we can solve them, or should we instead revert back to Xen 3.4 that we used previously in Beta 1. Except for that, Beta 2 is mostly ready, so we should be releasing it within coming weeks. \ No newline at end of file diff --git a/_posts/2011-09-07-anti-evil-maid.html b/_posts/2011-09-07-anti-evil-maid.html deleted file mode 100644 index bdbe54c..0000000 --- a/_posts/2011-09-07-anti-evil-maid.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Anti Evil Maid -date: '2011-09-07T23:56:00.004+02:00' -author: Joanna Rutkowska -tags: -- saving-the-world-afterhours -- disk encryption -- tpm -- trusted execution technology -- trusted computing -modified_time: '2012-03-28T11:09:32.908+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5170759851138703204 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html ---- - -
Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks.

The adjective trusted, in trusted boot, means that the goal of the mechanism is to somehow attest to a user that only desired (trusted) components have been loaded and executed during the system boot. It's a common mistake to confuse it with what is sometimes called secure boot, whose purpure is to prevent any unauthorized component from executing. Secure boot is problematic to implement in practice, because there must be a way to tell which components are authorized for execution. This might be done using digital signatures and some kind of CA infrastructure, but this gets us into problems such as who should run the CA, what should be the policy for issuing certificates, etc.

The adjective static means that the whole chain of trust is anchored in a special code that executes before all other code on the platform, and which is kept in a non re-flashable memory, whose sole purpure is to make the initial measurement of the next component that is going to be executed, which is the BIOS code. This special code, also known as Core Root of Trust for Measurement (CRTM), might be part of the BIOS (but kept on a special read-only memory, or implemented by some other entity that executes before the BIOS reset vector, such as e.g. Intel ME or the processor microcode even. Once measured, the BIOS code is executed, and it is now its turn to measures the platform configuration, Option ROM code, and MBR. Then the loader (stored in the MBR), such as Trusted GRUB, takes over and measures its own next stages (other than the MBR sector), and the hypervisor, kernel, and initramfs images that are to be loaded, together with their configuration (e.g. kernel arguments).

As explained above, trusted boot can only retrospectively tell the user whether correct (trusted) software has booted or not, but cannot prevent any software from executing. But how can it communicate anything reliably to the user, if it might have just been compromised? This is possible thanks to the TPM unseal operation that releases secrets to software only if correct software has booted (as indicated by correct hashes in select PCR registers).

So the idea is that if a user can see correct secret message (or perhaps a photo) being displayed on the screen, then it means that correct software must have booted, or otherwise the TPM would not release (unseal) the secret. Of course we assume the adversary had no other way to sniff this secret and couldn't simply hardcode it into the Evil Maid – more on this later.

Another way to look at it is to realize that Anti Evil Maid is all about authenticating machine to the user, as opposed to the usual case of authenticating the user to the machine/OS (login and password, decryption key, token, etc). We proceed with booting the machine and entering sensitive information, only after we get confidence it is still our trusted machine and not some compromised one.

Installing Anti Evil Maid

Anti Evil Maid should work for any Linux system that uses dracut/initramfs, which includes Qubes, Fedora and probably many other distros. You can find the Anti Evil Maid source code in a git repository here. You can also download a tarball with sources and prebuilt rpm packages from here (they all should be signed with the Qubes signing key). Qubes Beta 2, that is coming soon, will have those RPMs already per-installed.

To install Anti Evil Maid, follow the instructions in the README file.

Some Practical considerations

If you decided to use no password for your TPM SRK key (so, you passed '-z' to tpm_takeownership, see the README), then you should definitely install Anti Evil Maid on a removable USB stick. Otherwise, if you installed it on your disk boot partition, the attacker would be able to just boot your computer and note down the secret passphrase that will be displayed on the screen. Then the attacker can compromise your BIOS/MBR/kernel images however she likes, and just hardcode the secret passphrase to make it look like if your system was fine.

If you decided to use custom TPM SRK password (so, you did not pass -z to tpm_takeownership), then you can install Anti Evil Maid onto your regular boot partition. The attacker would not be able to see your secret passphrase without knowing the SRK password. Now, the attacker can try another Evil Maid attack to steal this password, but this attack is easy to spot and prevent (see the discussion in the next section).

However, there is still a good argument to install Anti Evil Maid on a separate USB stick rather than on your built-in disk boot partition. This is because you can use Anti Evil Maid as a provider of a keyfile to your LUKS disk encryption (as an additional file unsealable by the TPM). This way you could also stop adversary that is able to sniff your keystrokes (e.g. using hidden camera, or electromagnetic leak), and capture your disk decryption passphrase (see the discussion in the next section).

In any case it probably would be a good idea to make a backup stick that you might want to use in case you lose or somehow damage your primary stick. In that case you should have a way to figure out if your system has been compromised in the meantime or not. Use another stick, with another passphrase, and keep it in a vault for this occasion.

Finally, be aware that, depending on which PCRs you decided to seal your secrets to, you might be unable to see the secret even after you changed some minor thing in your BIOS config, such as e.g. the order of boot devices. Every time you change something in your system that affects the boot process, you would need to reseal your secrets to new PCR values as described in the installation instructions.

Attacks prevented by Anti Evil Maid

The classic Evil Maid attack is fully prevented.

If the attacker is able to steal your Anti Evil Maid stick, and the attacker gets access to your computer, then the attacker would be able to learn your secret passphrase by just booting from the stolen stick. This is not fatal, because user should get alarmed seeing that the stick has been stolen, and use the backup stick to verify the system (with a different secret messages, of course), and later create a new stick for every day use with a new secret message.

A variation of the above attack is when the attacker silently copies the content of the stick, so that the user cannot realize that someone got access to the stick. Attacker then uses the copied stick to boot the user's computer and this way can learn the secret passphrase. Now, the attacker can infect the computer with Evil Maid, and can also bypass Anti Evil Maid verification by just hardcoding the secret message into Evil Maid. So, even though TPM would know that incorrect software has booted, and even though it would not unseal the secret, the user would have no way of knowing this (as the secret would still be displayed on screen).

In order to protect against this attack, one might want to use a non-default SRK password – see the installation instructions. Now an extra SRK password would be needed to unseal any secret from the TPM (in addition to PCRs being correct). So the attacker, who doesn't know the SRK password, is now not able to see the secret message and cannot prepare the Evil Maid Attack (doesn't know what secret passphrase to hardcode there).

The attacker might want to perform an additional Evil Maid attack targeted at capturing this SRK password, e.g. by infecting the user's stick. This, however, could be immediately detected by the user, because the user would see that after entering the correct SRK password, there was no correct secret passphrase displayed. The user should then assume the stick got compromised together with the SRK password, and should start the machine from the backup stick, verify that the backup secret is correct, and then create new AEM stick for daily usage.

If an attacker is able to capture the user's keystrokes (hidden camera, electromagnetic leaks), the attacker doesn't need Evil Maid attack anymore, and so doesn't need to bother with compromising the system boot anymore. This is because the attacker can just sniff the disk decryption password, and then steal the laptop and will get full access to all user data.

In order to prevent such a “keystroke sniffing” attack, one can use an additional sealed secret on the Anti Evil Maid stick that would be used as a keyfile for LUKS (in addition to passphrase). In this case the knowledge of the sniffed LUKS passphrase would not be enough for the attacker to decrypt the disk. This has not been implemented, although would be a simple modification to dracut-antievilmaid module. If you decided to use this approach, don't forget to also create a backup passphrase that doesn't need a keyfile, so that you don't lock yourself from access to your data in case you lose your stick, or upgrade your BIOS, or something! You have been warned, anyway.

Attacks that are still possible

An adversary that is able to both: sniff your keystrokes (hidden camera, electromagnetic leak) and is also able to copy/steal/seize your Anti Evil Maid stick, can not be stopped. If a non-democratic government is your adversary, perhaps because you're a freedom fighter in one of those dark countries, then you likely cannot ignore this type of attacks. The only thing you can do, I think, is to use some kind of easy-to-destroy USB stick for keeping Anti Evil Maid. A digestible USB stick, anyone?

Another type of attack that is not addressed by Anti Evil Maid is an attack that works by removing the “gears” from your laptop (the motherboard and disk at the very least), putting there a fake board with a transmitter that connects back to the attacker's system via some radio link and proxies all the keyboard/screen events and USB ports back to the original “gears” that execute now under supervision of the attacker. Another way of thinking about this attack is as if we took the motherboard and disk away, but kept all the cables connecting them with the laptop's keyboard, screen, and other ports, such as USB (yes, very long cables). The attacker then waits until the user boots the machine, passes the machine-to-user authentications (however sophisticated it was), and finally enters the disk decryption key. In practice I wouldn't worry that much about such an attack, but just mentioning it here for completeness.

Finally, if our adversary is able to extract secret keys from the TPM somehow, e.g. using electron microscope, or via some secret backdoor in the TPM, or alternatively is able to install some hardware device on the motherboard that would be performing TPM reset without resetting the platform, then such an attacker would be able to install Evil Maid program and avoid its detection by SRTM. Still, this doesn't automatically give access to the user data, as the attacker would need to obtain the decryption key first (e.g. using Evil Maid attack).

Implementation Specific Attacks

In the discussion above we assumed that the trusted boot has been correctly implemented. This might not be true, especially in case of the BIOS. In that case we would be talking about attacks against a particular implementation of your BIOS (or TrustedGRUB), and not against Anti Evil Maid approach.

One typical problem might be related to how CRTM is implemented – if it is kept in a regular BIOS reflashable memory, than the attacker who can find a way to reflash the BIOS (which might be trivial in case your BIOS doesn't check digital signatures on updates) would be able to install Evil Maid in the BIOS but pretend that all hashes are correct, because the attacker controls the root of trust.

Another possible implementation problem might be similar to the attack we used some years ago to reflash a secure Intel BIOS (that verified digital signatures on updates) by presenting a malformed input to the BIOS that caused a buffer overflow and allowed to execute arbitrary code within the BIOS. For such an attack to work, however, the BIOS should not measure the input that is used as an attack vector. I think this was the situation with the logo picture that was used in our attack. Otherwise, even if there was a buffer overflow, the chain of trust would be broken and thus the attack detected. In other words, the possibility of such an attack seems to be rather slim in practice.

What about Intel TXT?

Intel TXT takes an alternative approach to trusted boot. It relies on a Dynamic instead of Static Root of Trust for Measurement (DRTM vs. SRTM), which is implemented by the SENTER instruction and special dynamic PCR registers that can be set to zero only by SENTER. Intel TXT doesn't rely anymore on the BIOS or CRTM. This offers a huge advantage that one doesn't need to trust the BIOS, nor the boot loader, and yet can still perform a trusted boot. Amazing, huh?

Unfortunately, this amazing property doesn't hold in practice. As we have demonstrated almost 3 years ago (!), it is not really true that Intel TXT can remove the BIOS away from the chain of trust. This is because Intel TXT is prone to attacks through a compromised SMM, and anybody who managed to compromise the BIOS would be trivially able to also compromise the SMM (because it is the BIOS that is supposed to provide the SMI handler).

Thus, if one compares SRTM with Intel TXT, then the conclusion is that Intel TXT cannot be more secure than SRTM. This is because if an attacker can compromise the BIOS, then the attacker can also bypass Intel TXT (via a SMM attack). On the other hand, a BIOS compromise alone doesn't automatically allow to bypass SRTM, as it has been discussed in a paragraph above.

It really is a pity, because otherwise Intel TXT would be just a great technology. Shame on you Intel, really!

Alternative approaches to mitigate Evil Maid Attacks

Various people suggested other methods to prevent Evil Maid attacks, so lets quickly recap and discuss some of them...

The most straight forward approach suggested by most people, has been to disable booting from external devices in BIOS, together with locking the BIOS setup with an admin password.

There are two problems with such an approach. First, all the BIOSes have a long history of so called default passwords (AKA maintenance passwords). You don't want to rely on the lack of BIOS default passwords when protecting your sensitive data, do you?

Second, even if your BIOS doesn't have a backdoor (maintenance password), it is still possible to just take your disk away and connect to another laptop and infect its boot partition.

Another suggested approach has been to keep your boot partition on a separate USB stick. This solution obviously doesn't take into account the fact that the attacker might install Evil Maid into your BIOS. Many consumer laptop BIOSes do not require digital signatures on BIOS firmware updates (my Sony Vaio Z, a rather high-end machine, is among them), making it simple to install Evil Maid there (the most trivial attack is to make the BIOS always boot from the HDD instead of whatever other device the user wanted to boot from).

Finally, some people pointed out that many modern laptops comes with SATA disks that offer ability to “lock” the disk so that it could only be used with a specific SATA controller. Using this, combined with setting your BIOS to only boot from your internal disk, plus locking access to BIOS setup, should provide reasonable protection. This solution, of course, doesn't solve the problem of a potential maintenance password in your BIOS. Also being skeptical and paranoid as I am, I would not trust this mechanism to be really robust – I would expect it would be fairly simple to unlock the disk so that it could be paired with another, unauthorized controller, and that this probably is a matter of NOP-ing a few instructions in the controller firmware... In fact it seems like you can buy software to unlock this mechanism for some $50... And apparently (and not very surprisingly) some drives seems to continue on the 'default passwords' tradition.

FAQ 

Q: Bitlocker implemented this already several years ago, right?
A: No.

Q: But, two-factor authentication can also be used to prevent Evil Maid, right?
A: No.

Q: Does it make any sense to use Anti Evil Maid without a full disk encryption?
A: No.

Q: Are you going to answer 'no' for each question I ask?
A: No.

Q: Why there are no negative indicators (e.g. a big scary warning) when the unseal process fails?
A: The lack of negative indicators is intentional. The user should keep in mind that if somebody compromised their computer, then the attacker would be able to display whatever she wants on the screen, and especially to skip displaying of any warning messages. The only thing the attacker would not be able to display would be the secret message. Thus, it would make no sense to use negative indicators, as they would likely not work in case of a real attack. One solution here would be to use the unsealed secret as a keyfile for disk encryption (as discussed above), which would make it impossible to decrypt the user disk (and so generally proceed with the boot) without successfully unsealing the secret from the TPM. \ No newline at end of file diff --git a/_posts/2011-09-19-qubes-beta-2-released.html b/_posts/2011-09-19-qubes-beta-2-released.html deleted file mode 100644 index ef4c3e2..0000000 --- a/_posts/2011-09-19-qubes-beta-2-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 2 Released! -date: '2011-09-19T12:52:00.000+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-03-28T11:09:04.941+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8898720712342300501 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/qubes-beta-2-released.html ---- - -I'm proud to announce that we have just released Qubes Beta 2! You can view installation instructions and download the ISO here.

We faced quite a few serious problems with this release that were caused by an upgrade to Xen 4.1 (from Xen 3.4) that we used in Beta 1. But finally we managed to solve all those problems and all in all I'm very happy with this release. It includes many performance optimizations compared to Beta 1 (CPU- and memory-wise) and also many bugfixes.

We also introduced a couple of new features:
  • Generic mechanism for inter-domain services with a centralized policy enforcement (more)
  • Network-less update mechanism for Dom0 (more)
  • VM management improvements: easy device assignment for driver domains, dynamic netvm switching, flexible VM kernel configuration, etc (see the new qvm-prefs utility)
  • Easy management of appmenus (shortcuts in the Start Menu)
  • Update to Xen 4.1 that offers, among other things, better VT-d support and more lightweight management stack (we have ported Qubes to use the new xl now, instead of the slow and heavy xend), and also to 2.6.38-xenlinux kernel for Dom0, and to 3.0.4 pvops kernel for VMs (better hardware compatibility, better power management)
I will write some more posts shortly that would present in detail some of the new features and what cool things one could do with them.

We have also created a dedicated wiki page that enumerates all the security-critical code for Qubes OS. We hope this page would be useful for security researchers that might attempt to find weaknesses in Qubes OS either in our code or in the 3rd party code that we rely on (Xen hypervisor, select Xen backends). Whether your motives are noble (gaining immortal fame, helping create a secure client OS), or not (proving ITL wrong), we would appreciate your efforts! And you might even get a job at ITL.

Speaking of which, I'm happy to announce that Marek Marczykowski, who has effectively become the key Qubes developer over the past few months, has now officially joined ITL :) \ No newline at end of file diff --git a/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html b/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html deleted file mode 100644 index 2eb4b51..0000000 --- a/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Playing with Qubes Networking for Fun and Profit -date: '2011-09-28T16:36:00.002+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2013-02-21T15:48:49.775+01:00' -thumbnail: http://3.bp.blogspot.com/-HGvCszJ422w/ToMeJm16CMI/AAAAAAAAAJA/CdX1Y-Ct_uc/s72-c/qubes-default-net-config.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-2682693250711953422 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/playing-with-qubes-networking-for-fun.html ---- - -Today, I would like to showcase some of the cool things that one can do with the Qubes networking infrastructure, specifically with all the new features that have been brought by the just released Qubes Beta 2. This will cover the use of multiple Net VMs for creating isolated networks, the use of a Proxy VM for creating a transparent Tor Proxy VM, as well as demonstration of how to use a Standalone VM with manually assigned devices, to create a “WiFi pen-testing” VM, which surely represents the “for fun” aspect of this post.

Qubes Networking Intro

From the networking point of view there are three types of VMs in Qubes:

  • Net VMs, that have networking devices assigned to them, such as e.g. a WiFi or Ethernet card. Each Net VM contains a Xen network backend that is used to provide networking to all VMs that are connected to this Net VM.
  • Regular VMs (AppVMs) that use the networking provided by Net VMs (so they have Xen network frontends that provide virtual interfaces that are backed by the backend in the corresponding Net VM.
  • Proxy VMs that combine both of the above: to Net VMs they look like regular AppVMs, because they are consumers of the networking they provide, but to other AppVMs they act as if they were Net VMs themselves, allowing other VMs to connect to them. Of course the Proxy VMs do not have directly assigned networking devices – they use the networking provided by the Net VM that they connect to. One can chain many Proxy VMs, as we will see below.

The virtual interfaces in client VMs are called ethX, and are provided by the xen_netfront kernel module, and the corresponding interfaces in the Net/Proxy VM are called vifX.Y and are created by the xen_netback module.

Each Net and Proxy VM implements NAT, specifically masquerading, for all the connected VMs. Additionally to this SNAT, each Net or Proxy VM provides also DNAT redirection for DNS resolutions, so that each VM behind a Proxy or Net VM thinks that it uses a DNS in the Net/Proxy VM, but in fact all the DNS request are DNAT-ed by all the Proxy and Net VMs down the original DNS that is provided to the final Net VM. This smart trick allows us to avoid running a DNS caching server in Proxy/Net VMs.

Also, any VM-to-VM traffic, among the VMs connected to the same Net/Proxy VM is blocked by default.

Additionally, each Proxy VM enforces system-wide firewaling rules, specifically the rules for all the directly connected VMs. Those firewalling rules are centrally managed in Dom0 and exposed to each Proxy VM through Xen store. One useful application of this firewalling mechanism is to limit certain VMs to only specific type of white-listed traffic to minimize likelihood of user mistakes. A good example could be a work VM that might be limited to network connectivity only with the select corporate servers and denied all other traffic. This way, when the user receives an email message with an embedded http link (possibly leading to a malicious website) and accidentally clicks on it, nothing wrong happens.

The current infrastructure doesn't support IPv6 routing, but we will likely add this support in the upcoming Beta 3.

The default networking topology in Qubes OS

When you proceed with the default installation of Qubes Beta 2, then your initial networking topology looks like on the diagram below:
The default network configuration in Qubes.
So, by default there is one Net VM, called 'netvm', that is automatically assigned all the networking devices in the system. There is also one Proxy VM, called 'firewallvm' that is directly connected to the default Net VM, and which provides networking to all other VMs in the system. This Proxy VM is used for firewall rules enforcement. Each such service VM consumes 200MB of RAM by default.

Network-isolated VMs

For some VMs it might be desirable to completely disconnect them from any kind of networking access. This can be easy done using the following command (issued from Dom0's konsole):

[dom0]$ qvm-prefs -s netvm none

For example I have a 'vault' VM that I use for keeping my master PGP keys, and other secrets, and this machine is not connected to any network.

Using multiple Net VMs for physically isolated networks 

In some scenarios the machine might be connected to two or more physically separate networks (e.g. safe corporate intranet, reachable via ethernet cable on the user's desk, and the unsafe and evil Internet, reachable via WiFi card).

It is easy to use more than one Net VMs in Qubes, and assign different networking devices to different Net VMs, and also decide which VMs are connected to which Net VMs. The diagram below presents an exemplary such setup:
A simple setup with two isolated networks, and one fully isolated domain ('vault').
 
We could created such a setup using the following commands (issued in Dom0):

[dom0]$ qvm-create netvm1 --net --label red
[dom0]$ qvm-create netvm2 --net --label yellow

Currently qvm-create when used with the --net option automatically assigns all networking devices to the just created VM, so in the example above you would want to remove extra devices from each Net VM using qvm-pci -d, leaving only those you really want, e.g.: 

[dom0]$ qvm-pci -l netvm1 # to get a list of currently assigned devices

[dom0]$ qvm-pci -d netvm1 02:00.0

Now we should create the Firewall VMs:

[dom0]$ qvm-create firewallvm1 --proxy --label green
[dom0]$ qvm-create firewallvm2 --proxy --label green

... and connect them to proper Net VMs:

[dom0]$ qvm-prefs -s firewallvm1 netvm netvm1
[dom0]$ qvm-prefs -s firewallvm2 netvm netvm2

And now, for any other VM, just set the appropriate Net VM (either firewallvm1 or firewallvm2, or 'none), to get it assigned to either of the isolated networks, e.g.:

[dom0]$ qvm-prefs -s banking netvm firewallvm1
[dom0]$ qvm-prefs -s xfiles netvm firewallvm2
[dom0]$ qvm-prefs -s vault netvm none
...

This configuration provides very strong isolation between the VMs belonging to network #1, and the VMs belonging to network #2. Specifically, this becomes significant if we fear about potential remotely exploitable bugs in the client code of the core TCP/IP stack (in this case the Net VM could potentially compromise all the connected VMs -- but the same problem applies to even physically separated machines that use the same network).

Setting up Tor Proxy using a Proxy VM

Let's now play a bit with Proxy VMs and see how we can use it to create a simple Tor proxy VM. Such a VM would provide anonymized networking to all its clients, so would allow to easily create VMs for anonymous Internet access. The simple setup we would like to prepare is depicted on the figure below:

The 'torvm' Proxy VM provides anonymized networking to 'anon-web' and 'anon-bitcoin' VMs. All the traffic generated by the VMs behind 'torvm' is either fed into the Tor network, or discarded. Furthermore, any app running in those VMs is not able to read any global system identifiers, such as the external IP, external MAC address, etc.

Our Tor proxy would forward only the Tor traffic, so we don't have to fear about some Tor-not-aware applications, or even intentionally malicious ones to compromise the privacy of our connection. This is because such applications have no way to generate traffic to the outside world without going through our Tor proxy (unless they could exploit a hypothetical vulnerability in the Tor process running in the Tor VM). Also, the applications running in any VM behind the Tor proxy are not able to determine any globally identifiable IDs, such as the user's external IP address, the real MAC address used by real NICs, etc.

Interestingly just after writing the above paragraph, I discovered that one of our xenstore keys had wrong permissions and, as a result, any VM could read it and get to know the actual external IP (the key is used by a Net VM to communicate the external IP configuration to the connected Proxy VMs, so they could know when to update the firewall configuration). The fix for this problem is here, and the update (qubes-core-dom0-1.6.32) is now available for Dom0 (just do qvm-dom0-updateto get it installed).

 
So, this represents a rather strong setup for use with Tor. Let's now have a look at how to practically create such a configuration, step by step.

First, let's create the VM that will become our Tor proxy:

[dom0]$ qvm-create torvm --proxy --label green

This will create a Proxy VM named 'torvm', based on the default template. We will need to now start the template VM and install the Tor client there:

[dom0]$ qvm-run -a fedora-14-x64 gnome-terminal

Alternatively, if we didn't trust the Tor client rpm package to be non-malicious, specifically for its installation scripts to be non malicious, we could have based this on a different template, e.g. one used for less trusted VMs, or we could installed the Tor client in /usr/local, that is backed by the VM's private storage, but this would require compiling Tor from sources.

Now, in the just started template VM, lets install the Tor client and (optionally) the Vidalia graphical frontend:

[fedora-14-x64]$ sudo yum install tor vidalia

And then power off the template VM. Now, every VM based on this template, started after the template shutdown, will also see the Tor binary in its filesystem.

Let's now configure our torvm to properly start Tor proxying at boot:

[dom0]$ qvm-run -a torvm gnome-terminal

Now, we will create the following script for starting up the Tor transparent proxy and setting up traffic redirection using iptables:

[torvm]$ vim /rw/config/start_tor_proxy.sh

...and now paste the following into this file:
#!/bin/sh
killall tor
QUBES_IP=$(xenstore-read qubes_ip)
TOR_TRANS_PORT=9040

if [ X$QUBES_IP == X ]; then
echo "Error getting QUBES IP!"
echo "Not starting Tor, but setting the traffic redirection anyway to prevent leaks."
QUBES_IP="127.0.0.1"
else
/usr/bin/tor \
--SocksPort 0 \
--TransListenAddress $QUBES_IP --TransPort $TOR_TRANS_PORT \
--DNSListenAddress $QUBES_IP --DNSPort 53 \
--RunAsDaemon 1 --ControlPort 9051 \
|| echo "Error starting Tor!"

fi

echo “0” > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -t nat -F
/sbin/iptables -t nat -A PREROUTING -i vif+ -p udp --dport 53 -j DNAT --to-destination $QUBES_IP:53
/sbin/iptables -t nat -A PREROUTING -i vif+ -p tcp -j DNAT --to-destination $QUBES_IP:$TOR_TRANS_PORT
/sbin/iptables -I INPUT 1 -i vif+ -p udp --dport 53 -j ACCEPT
/sbin/iptables -I INPUT 2 -i vif+ -p tcp --dport 9040 -j ACCEPT
/sbin/iptables -F FORWARD

echo “1” > /proc/sys/net/ipv4/ip_forward

Except for the “QUBES_IP=$(xenstore-read qubes_ip)” line that reads the torvm's IP address, there is nothing Qubes-specific in the above listing. It's just a standard way of setting up transparent Tor proxy.

It is important that this file be located in the /rwdirectory, as this directory is backed by the VM's private storage and will survive VM reboots. The VM's root file-system is read-only and all the changes to it are lost on VM shutdown (VM gets an illusion of the root fs being writeable thanks to Copy-On-Write mechanism, but the actual COW backing device is cleared upon each VM shutdown).

We should also modify the /rw/config/rc.localscript, to ensure that our Tor proxy is automatically started -- just paste the following into this script:
#!/bin/sh

# Uncomment this if you would like to use a custom torrc file:
#rm -f /rw/config/log
#ln -sf /rw/config/torrc /etc/tor/torrc

chkconfig qubes_netwatcher off
chkconfig qubes_firewall off
/rw/config/start_tor_proxy.sh
Finally we should also provide a script that would restart our proxy in case the user dynamically switched the NetVM, which would result in the completely different routing. This could be done by creating a script with predefined name qubes_ip_change_hookwithin /rw/config/directory:
#!/bin/sh
/rw/config/start_tor_proxy.sh
Make sure that all the scripts are executable (chmod +x). And that's all. Now, shutdown the torvm:

[dom0]$ qvm-run --shutdown --wait torvm

From now on, every time you start the torvm (or when Qubes starts it in response to start of some other VM that uses torvm as its Net VM), the Tor transparent proxy should be automatically started.

Let's test this by creating a VM that would be using the just created Tor proxy:

[dom0]$ qvm-create anon-web --label black
[dom0]$ qvm-prefs -s anon-web netvm torvm

Now, every time you start the anon-web VM (e.g. by clicking on the Web browser icon in the anon-web's start menu), Qubes will also ensure that torvm is up and running, and this in turn would configure all the Tor proxying for this VM.

Fo additional control one might want to use Vidalia, the graphical front end for Tor (this should be installed within the template VM that has been used for torvm). We could easily start Vidalia by just typing:

[dom0]$ qvm-run -a torvm vidalia

We should however make sure to disable "Start the Tor software when vidalia starts" option in Settings/General in Vidalia. Otherwise, Vidalia might kill your original Tor (that has transparent proxy open) and start own without transparent proxy enabled.

The web browser runs in the 'anon-web' VM that uses 'torvm' for networking access, and thus all the traffic generated by 'anon-web' is routed through the Tor network, or discarded if it's a different traffic than TCP or DNS.


Of course one case easily create more VMs that would be using torvm as their Net VM, as so would have anonymized network access. The beauty of this solution is that in case one of my anonymized VM gets compromised, others do not. Plus, the already mentioned benefit, that no matter whether apps in those VMs are buggy, or even intentionally malicious, they would not be able to leak out the user's external IP address.

Creating a WiFi pen-testing VM

Finally let's have some fun and create a WiFi pen-testing VM. The desired config is depicted below:

Because we would like to use all sorts of l33t h4x0r t00lzpen-testing security software in this VM, it would make sense to create it as a Standalone VM, which means that it would get its own copy of the whole file-system (as opposed to just the home directory, /rwand /usr/local, as it is the case with regular Qubes VMs). This would ease the installation of all the extra software we would need there, and also ensure that even if the install/build scripts were malicious, the damages would be contained only to this very VM and nothing else. Also, for some reason the standard Linux WiFi stack and drivers still don't support injection on (all?) most of the WiFi cards out of the box, so we would need to patch the actual kernel drivers -- yet another reason to use a Standalone VM in this case.

So, let's create the VM first, and assign a WiFi card to it:

[dom0]$ qvm-create wififun --standalone --label yellow
[dom0]$ qvm-prefs -s wififun memory 800 # ensure at least this mem at startup
[dom0]$ qvm-prefs -s wififun kernel none # use own copy of kernel and modules
[dom0]$ qvm-pci -a wififun

You can easily find the BDF address of any device using the lspcicommand in Dom0 -- this would be something like e.g. “02:00.0”. You should make sure that this WiFi card is not used by any other VM, specifically by your default Net VM (called 'netvm' in a standard Qubes installation). Ideally you could just use a dedicated Express Card-based WiFi card, leaving the built in WiFi assigned to your default Net VM.

Because it's a Standalone VM, Qubes will make a copy of the whole root filesystem, and thus it would eat about 5GB of your disk (normal VMs would take only as much space as their private fs takes up).

Let's now start the VM...

[dom0]$ qvm-run -a wififun gnome-terminal

... and then install the prerequisite software there, starting with downloading the reasonably new compat-wireless sources, together with the required injection patches, and then building and installing the new kernel modules. All actions below are now executed within the VM. This stuff here is really nothing Qubes- or Xen-specific -- one would do more or less the same on any Linux in order to get injection working (so, treat this as a free bonus WiFi hacking tutorial on Linux).

[wififun]$ wget http://linuxwireless.org/download/compat-wireless-2.6/compat-wireless-2011-07-14.tar.bz2

[wififun]$ wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
[wififun]$ wget http://patches.aircrack-ng.org/mac80211-2.6.29-fix-tx-ctl-no-ack-retry-count.patch
[wififun]$ wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch

[wififun]$ sudo yum install kernel-devel patch gcc

[wififun]$ tar xjf compat-wireless-2011-07-14.tar.bz2
[wififun]$ cd compat-wireless-2011-07-14
[wififun]$ patch -p1 < ../channel-negative-one-maxim.patch
[wififun]$ patch -p1 < ../mac80211-2.6.29-fix-tx-ctl-no-ack-retry-count.patch
[wififun]$ patch -p1 < ../mac80211.compat08082009.wl_frag+ack_v1.patch

[wififun]$ make
[wififun]$ sudo make unload
[wififun]$ sudo make install

Now, lets reboot the VM to ensure that all the patched drivers will get properly loaded on each VM boot:

[dom0]$ qvm-run --shutdown --wait wififun
[dom0]$ qvm-run -a wififun gnome-terminal

Let's first see if the WiFi driver got properly loaded and if the interface has been created (look for wlanXinterface):

[wififun]$ ifconfig -a

If yes, then proceed with the steps below (if not, then have a look into dmesg and see what was the problem):

[wififun]$ sudo bash
[wififun]# yum install aircrack-ng dnsmasq
[wififun]# airmon-ng start wlan0
[wififun]# iptables -F INPUT
[wififun]# iptables -F FORWARD
[wififun]# echo “1” > /proc/sys/net/ipv4/ip_forward

Note that you don't need to add any explicit masquerading rules, as they are applied by default on Qubes VMs (you can take a look at the nat table in the VM if you want to see by yourself).

Edit the /etc/dnsmasq.conf, so that it contains at least the following:

interface=at0
dhcp-range=192.168.0.50,192.168.0.150,12h

and then start the dnsmasq daemon -- we will use it for providing DHCP to our fake AP (the at0 interface will be created by airbase-ng and emulates the “uplink” of a traditional AP):

[wififun]# /etc/init.d/dnsmasq start

And finally the fake AP:

[wififun]# airbase-ng -e free_wifi mon0

and on another console (before any client connects, but after airbase-nggot started), configure the at0interface (make sure it matches what you wrote into dnsmasq.conf):

[wififun]# ifconfig at0 192.168.0.1 up

(you can also add an udev rule to that automatically).

and just to verify it really is working:

[wififun]# tcpdump -i at0

... and now, just wait for a client to connect to your AP. What you do next is only limited by your imagination... But hey, this article is about Qubes networking and not about 0wning client systems ;)

Here's an innocent example using Moxie's sslstrip (amazing this attack still works so well at the end of 2011...):

My 'wififun' VM in action using a simple sslstrip attack, that surprisingly still works pretty nice...
Please note that as your wififun VM is a regular Qubes VM, it is automatically connected to the default Net VM, which in turn provides networking to it. That's why it is so easy to create a fully functioning fake AP.

When using custom driver domains, there are currently some catches you should be aware:

Catch #1: When you start a driver domain lateafter system boot, so after some days of uptime and extensive use of VMs, Xen might not be able to allocate enough continues (in terms of MFNs) memory for a driver domain. And PV driver domains, unlike normal domains or HVM driver domains, do require MFN-continuous memory for their DMA buffers (HVM domains do not need that, because IOMMU can create an illusion of this; even though IOMMU is also used for PV driver domains, for protection, it doesn't actively translate bus addresses into GMFNs).

This is usually not a big problem in practice, because in most cases all the driver domains are started early at system boot, when there is still plenty of non-fragmented memory available. However it might become a problem when one wishes to start e.g. the WiFi pen-testing at some later time. The work around is to close as many VMs as possible before starting such driver domain, and then also reducing, for a moment, the amount of memory assigned to Dom0:

[dom0]$ xm mem-set 0 1600m

and then starting the driver domain should be fine. Now we can start all other domains, and that should no longer be problematic for the already running driver domain.

Catch #2: Some network cards, notably Express Cards, might not work well with the 3.0.4 pvops kernel that we use in all VMs by default. In that case you might want to try to use the 2.6.38.3 xenlinux kernel in your WiFi fun VM -- to do that, follow these steps:

[dom0]$ sudo qvm-dom0-update kernel-qubes-vm-2.6.38.3-10.xenlinux.qubes
[dom0]$ cp /var/lib/qubes/vm-kernels/2.6.38.3/* /var/lib/qubes/appvms/wififun/kernels/
[dom0]$ qvm-prefs wififun -s kernelopts "swiotlb=force"

And then, in the VM:

[wififun]$ sudo yum install kernel-devel-2.6.38.3-10.xenlinux.qubes

And rebuild the compat-wireless, unload, install modules, and then load drivers again.

Summary

As you can see, Qubes Beta 2 now offers a very advanced networking infrastructure that allows more advanced users to create very sophisticated configurations, allowing for pretty good isolation between various domains and networks. Qubes leaves it up to the user (or admin) to figure out what would be the best configuration -- most users would be happy with the default simple setup with just one Net VM and one Firewall VM, while others would go for much more advanced setups.

A bit more advanced networking setup. The usbvm has a 3G modem assigned, and it is possible to dynamically switch between the Net VMs without restarting any other VMs.

\ No newline at end of file diff --git a/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html b/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html deleted file mode 100644 index 9a04a5a..0000000 --- a/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Exploring new lands on Intel CPUs (SINIT code execution hijacking) -date: '2011-12-06T10:48:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-03-28T11:10:07.825+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7845092546778053242 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/12/exploring-new-lands-on-intel-cpus-sinit.html ---- - -Today we're releasing a new paper where we describe exploiting a bug in Intel SINIT authenticated code module that allows for arbitrary code execution in what we call an “SINIT mode”. So, to the already pretty-well explored “lands” on Intel processors, that include ring 3 (usermode), ring 0 (kernelmode), ring “-1” (VT-x root), and ring “-2” (SMM), we're now adding a new “island”, the SINIT mode, a previously unexplored territory inhabited so far only by the Intel-blessed opcodes.

What is really interesting about the attack are the consequences of SINIT mode hijacking, which include ability to bypass Intel TXT, LCP, and also compromise system SMRAM.

It's also interesting how difficult was this vulnerability for Intel to patch, as they had to release not only updated SINIT modules, but also updated microcode for all the affected processors, and also work with the BIOS vendors so they release updated BIOSes that would be unconditionally loading this updated microcode (plus provide anti-rollback mechanisms for both the BIOS and microcode). Quite an undertaking...

You can get the paper here.

Intel also published an advisory yesterday, which can be downloaded from their website here. The advisory is peculiar in a few ways, however...

First, the advisory (I'm referring to the revision 1.0) never explicitly mentions that the attack allows to bypass TXT launch itself, only that the attack “may compromise certain SINIT ACM functionality, including launch control policy and additionally lead to compromise of System Management Mode (SMM). Intel also recommend to disable TXT altogether in the BIOS, as a preventive measure, in case the user doesn't “actively running Intel® TXT”... This reminds me how various vendors started actively disabling Intel VT-x after certain virtualization rootkits have been demonstrated some 5 years ago, and how many laptops still ship with this technology disabled today (or VT-d at least) to the questionable delight of many users.

Second, the advisory assigns only an “Important” rating to this vulnerability, even though another Intel advisory, published some two years ago for a problem also reported by us, and which which was strictly a subset of the current vulnerability in terms of powers that it gave to the attacker (in other words the current vulnerability provides the attacker with everything that the previous one did, plus much more), was given a “Critical” rating... This is called evolution, I guess, and I wonder what would be considered critical by Intel these days?

UPDATE (Dec 7th, 2011): Intel has just released an updated advisory (release 1.1) that now explicitly states that the vulnerability also bypasses Intel TXT.

This is the last paper co-authored with Rafal Wojtczuk, who recently decided to try some new things and to leave ITL. Rafal has been the most talented exploit writer I have worked with, and I will surely miss his ingenious insights, such as e.g. how to practically win an absolutely hopeless race condition with ICMP-delivered MSI! But then again, how many times can one break Intel technologies, before getting bored? At the same time ITL is really transforming now into a development company, with all our efforts around Qubes and architecting, rather than on breaking. I wish Rafal all the best with his new endeavors, and thank him for all the excellent contributions he made while working for ITL over the past 3+ years. \ No newline at end of file diff --git a/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html b/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html deleted file mode 100644 index cd2fc39..0000000 --- a/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Trusted Execution In Untrusted Cloud -date: '2011-12-13T20:25:00.000+01:00' -author: Joanna Rutkowska -tags: -- cloud -- trusted execution technology -- general -modified_time: '2012-03-28T11:10:17.874+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6975144072797589166 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/12/trusted-execution-in-untrusted-cloud.html ---- - -
Wouldn't it be nice if we could actually own our data and programs in the cloud? By “owning” here I mean to have control over their confidentiality and integrity. When it comes to confidentiality and integrity for the data,it's not much of a rocket since, as the classic crypto (and secure client systems) is all that we need. I have already wrote about it in an earlier post.
But it would also be nice, if we could somehow get the same confidentiality and integrity assurance for our programsthat we upload for the execution in the cloud...

For example, a company might want take their database application, that deal with all sorts of corporate critical sensitive data, and then upload and safely run this application on e.g. Amazon's EC2, or maybe even to some China-based EC2-clone. Currently there is really nothing that could stop the provider, who has a full control over the kernel or the hypervisor under which our application (or our VM) executes, from reading the contents of our process' memory and stealing the secrets from there. This is all easy stuff to do from the technical point of view, and this is also not just my own paranoia...


Plus, there are the usual concerns, such as: is the infrastructure of the cloud provider really that safe and secure, as it is advertised? How do we know nobody found an exploitable bug in the hypervisor and was not able to compromise other customer's VMs from within the attacker-hired VM? Perhaps the same question applies if we didn't decided to outsource the apps to a 3rdparty cloud, but in case of a 3rdparty clouds we really don't know about what measures have been applied. E.g. does the physical server on which my VMs are hosted also used to host some foreign customers? From China maybe? You get the point.

Sometimes all we really need is just integrity, e.g. if we wanted to host an open source code revision system, e.g. a git repository or a file server. Remember the kernel.org incident? On a side note, I find the Jonathan Corbet's self-comforting remarks on how there was really nothing to worry about, to be strikingly naive... I could easily think of a few examples of how the attacker(s) could have exploited this incident, so that Linus & co. would never (not soon) find out. But that's another story...

But, how can one protect a running process, or a VM, from a potentially compromised OS, or a hypervisor/VMM?

To some extent, at least theoretically, Intel Trusted Execution Technology (TXT), could be used to implement such protection. Intel TXT can attest to a remote entity, in that case this would be the cloud customer, about the hash of the hypervisor (or kernel) that has been loaded on the platform. This means it should be possible for the user to know that the cloud provider uses the unmodified Xen 4.1.1 binary as the hypervisor and not some modified version, with a built-in FBI backdoor for memory inspection. Ok, it's a poor example, because the Xen architecture (and any other commercially used VMM) allow the administrator who controls Dom0 (or equivalent) to essentially inspect and modify all the memory in the system, also that belonging to other VMs, and no special backdoors in the hypervisor are needed for this.

But let's assume hypothetically that Xen 5.0 would change that architecture, and so the Dom0 would not be able to access any other VM's memory anymore. Additionally, if we also assumed that the Xen hypervisor was secure, so that it was not possible to exploit any flaw in the hypervior, then we should be fine. Of course, assuming also there were also no flaws in the TXT implementation, and that the SMM was properly sandboxed, or that we trusted (some parts of) the BIOS (these are really complex problems to solve in practice, but I know there is some work going on in this area, so there is some hope).

Such a TXT-bases solution, although a step forward, still requires us to trust the cloud provider a bit... First, TXT doesn't protect against bus-level physical attacks – think of an attacker who replaces the DRAM dies with some kind of DRAM emulator – a device that looks like DRAM to the host, but on the other end allows full inspection/modification of its contents (well, ok, this is still a bit tricky, because of the lack of synchronization, but doable).

Additionally for Remote Attestation to make any sense, we must somehow know that we “talk to” a real TPM, and not to some software-emulated TPM. The idea here is that only a “real” TPM would have access to a private key, called Endorsement Key, used for signing during Remote Attestation procedure (or used during the generation of the AIK key, that can be used alternatively for Remote Attestation). But then again who generates (and so: owns) the private endorsement keys? Well, the TPM manufacturer, that can be... some Asian company that we not necessarily want to trust that much...

Now we see it would really be advantageous for customers, if Intel decided to return to the practice of implementing TPM internally inside the chipset, as they did in the past for their Series 4 chipsets (e.g. Q45). This would also protect against the LCP bus-level attacks against TPM (although somebody told me recently that TPM in current systems cannot be so easily attacked from LCP bus, because of some authentication protocol being used there – I really don't know, as physical attacks have not been the area we ever looked at extensively; any comments on that?).

But then again, the problem of DRAM content sniffing always remains, although I would consider this to be a complex and expensive attack. So, it seems to me that most governments would be able to bypass such TXT-ensured guarantees in order to “tap” the user's programs executing in the cloud provides that operate within their jurisdictions. But at least this could stop malicious companies from staring up fake cloud services with an intent to easily harvest some sensitive data from unsuspecting users.

It seems that the only way to solve the above problem of DRAM sniffing attacks is to add some protection at the processor level. We can imagine two solutions that processor vendors could implement:

First, they could opt for adding an in-processor hardware mechanism for encrypting all the data that leave the processor, to ensure that everything the is kept in the DRAM is encrypted (and, of course, also integrity-protected), with some private key that never leave the processor. This could be seen as an  extension to the Intel TXT.

This would mean, however, we still needed to relay on: 1) the hypervisor to not contain bugs, 2) the whole VMM architecture to properly protect VM's memory, specifically against the Dom0, 3) Intel TXT to not be buggy either, 4) SMM being properly sandboxed, or alternatively to trust (some parts of) the BIOS and SMI handler, 5) TPM's EK key to be non-compromised and verifiable as genuine, and 6) TPM bus attacks made impossible (those two could be achieved by moving the TPM back onto the chipset, as mentioned above), and finally, 7) on the encryption key used by the processor for data encryption to be safely kept in the processor.

That's still quite a lot of things to trust, and it requires quite a lot of work to make it practically really secure...

The other option is a bit more crazy, but also more powerful. The idea is that the processor might allow to create untrusted supervisors (or hypervisors). Bringing this down to x86 nomenclature, it would mean that kernel mode (or VT-x root) code cannot sniff or inject code into (crypto-protected) memory of the usermode processes (or VT-x guests). This idea is not as crazy as you might think, and there has even been some academic work done in this area. Of course, there are many catches here, as this would require specifically written and designed applications. And if we ever considered to use this technology also for client systems (how nice it would be if we could just get rid of some 200-300 kLOC of the Xen hypervisor from the TCB in Qubes OS!), the challenges are even bigger, mostly relating to safe and secure trusted output (screen) and, especially, input (keyboard, mouse).

If this worked out, then we would need to trust just one element: the processor. But we need to trust it anyway. Of course, we also need to trust some software stack, e.g. the compilers we use at home to build our application, and the libraries it uses, but that's somehow an unrelated issue. What is important is that we now would be able to choose that (important) software stack ourselves, and don't care about all the other software used by the cloud provider.

As I wrote above, the processor is this final element we always need to rust. In practice this comes down to also trusting the US government :) But we might imagine users consciously choosing e.g. China-based, or Russia-based cloud providers and require (cryptographically) to run their hosted programs on US-made processors. I guess this could provide reasonable politically-based safety. And there is also ARM, with its licensable processor cores, where, I can imagine, the licensee (e.g. an EU state) would be able to put their own private key, not known to any other government (here I assume the licensee also audits the processor RTL for any signs of backdoors). I'm not sure if it would be possible to hide such a private key from a foundry in Hong Kong, or somewhere, but luckily there are also some foundries within the EU.

In any case, it seems like we could make our cloud computing orders of magnitude safer and more secure than what is now. Let's see whether the industry will follow this path...
\ No newline at end of file diff --git a/_posts/2012-01-21-thoughts-on-deepsafe.html b/_posts/2012-01-21-thoughts-on-deepsafe.html deleted file mode 100644 index 583ec62..0000000 --- a/_posts/2012-01-21-thoughts-on-deepsafe.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Thoughts on DeepSafe -date: '2012-01-21T18:01:00.002+01:00' -author: Joanna Rutkowska -tags: -- rootkits -- chipset -- attack -- exploit -modified_time: '2012-03-28T11:10:27.715+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6804689402512253967 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/01/thoughts-on-deepsafe.html ---- - -
Several people asked me recently what I though about DeepSafe. So, below I present my opinion...

First, for any AV system (or Host IPS, or Personal Firewall, etc) to work effectively, there are three problems that must be addressed:
  1. How to protect the AV agent (code and data) from tampering (from the rest of the OS)?
  2. How can the AV agent get reliable access to (sensitive pieces of) the system memory and registers, and/or provide reliable memory protection for the (sensitive pieces of) the OS.
  3. What are those "sensitive pieces of” memory that should be monitored or protected?
From reading various PR materials, it seems like the #1 above is the primary differentiation factor for DeepSafe (DS). So, let's consider this problem in the context of e.g. a Windows OS. In order to protect its code and data, DS uses, as it is heavily advertised, Intel VT-x virtualization technology. Now, that sounds really secure -- after all what can be more secure than a hardware virtualization, right? ;)

But VT-x (including EPT) is only about CPU virtualization, which in our case translates to protecting the DS memory and registers from CPU-originating accesses. But, as every regular to this blog knows, there is also another method of accessing memory on any PC system, and this is through DMA transactions from devices. The OS (so also the kernel malware) is free to program one of the many devices in the system to issue DMA reads or writes to any physical memory it wants...

Now, in order to protect some portion of the system memory (DRAM, cache) against DMA accesses, we have the Intel VT-d technology... So, one would think that DS must be also using VT-d in order to protect itself.

Very well, let's assume then that the DeepSafe is not a total ripoff, and that it implements also VT-d protection for its agent, although I haven't found this mentioned in any of the public papers or press materials I found on the web...

This, however, would be a bit complex to do correctly, because the OS (so, also the kernel malware) still has a full control over the chipset (MCH), which is the entity... that controls the VT-d.

Now, in order to prevent the OS (or the kernel malware) from playing with the chipset for fun and profit, and e.g. disabling VT-d protection, DS would have to virtualize the chipset.

If you look at some consumer VMMs, such as VMware or Xen/Qemu, you would see that they all virtualize the chipset for their guests (of course), but that the chipset they provide this way is some kind of an ancient Pentium MCH. I don't think any of the consumers would be especially happy if they found out that after installing DS on their brand new 2012 laptop, Windows suddenly see a Pentium-era chipset... And this is not without a reason – chipsets, specifically MCHs, are one of the most complex devices, perhaps only beaten by GPUs in this category. There are virtually hundreds of configuration registers exposed by the chipset, some of them control the VT-d, some other control system memory maps and permissions, PCIe configuration, and many other things that I even have no idea about, and this all makes virtualizing the chipset a very challenging task.

So, it's either that McAfee and Intel found some interesting way of how to securely virtualize the chipset while preserving all of its (very rich) functionality, or that they... don't bother with VT-d protection and chipset virtualization at all, assuming that even without VT-d, DeepSafe is good enough and “rises the bar” anyway (sarcasm intended).

(Can somebody from McAfee or Intel confirm in the comments below what does DP really do?)

Anyway, let's assume they dohave VT-d protection and they do virtualize the chipset somehow...

Now, we're moving on to the #2 point from the list of tasks above -- about the reliable
memory access or reliable protection.

So, let say that the DS agent decided that some part of the system memory, e.g. the IDT table, is sensitiveand should be monitored/protected. So it sets up EPT traps to trigger an VT-x/EPT intercept on any access to that memory (or IDT base register), in order to find kernel malware that tried to modify IDT. That sounds really nice, but what if the malware uses DMA to modify IDT? DS would not be able to catch such access! (So far we considered the, hypothetical, use of VT-d only to protect the DS agent code).

One might think that DS is programming VT-d to sandbox each and every device in the system (so including GPU, USB controllers, NICs, SATA, etc) so they never be allowed to touch any of those sensitive parts of the system, such as IDT. Let's assume they do it this way...

And here we've arrived to the last point from the list at the beginning: which of the system memory constitutes those "sensitive pieces" that should be protected/monitored? IDT? Sure. What about all the code sections of the all the kernel modules? Yes. Are we fine now? Well, no, because the malware can hook some pointers other than the well known IDT. Some public NDIS data structure? Ok, we can add those to the protected areas. But, what about some undocumented NDIS structures? And this is just NDIS subsystem, one of the many subsystems in the Windows kernel... When we think about it, it should be intuitively obvious that in a general purpose Operating System like Windows, it is not possible (at least for 3rd party) to make a satisfactory list of all the sensitive pieces of memory that should be monitored/protected, in order to detect all the system compromises.

Greg Hoglund, Jamie Butler, Alex Tereshkin, and myself, have been researching this area actively in the early years of this millennium. In addition to the Alex's paper linked above, you might also check out one of my last slides from this period.

I don't think anything has changed since that time. It was also the reason why I gave up on writing Windows compromise detectors, or forensic tools, and moved on to researching other ways to secure OSes, which finally gave birth to Qubes OS, many years later.

So, back to DS -- in order to provide a somehow satisfactory protection level for your general purpose OS, such as Windows, it would need to:
  1. Use VT-d to protect its own memory,
  1. Virtualize the chipset, at least some (sensitive) parts of it,
  1. Program VT-d permissions for each device to exclude all the sensitive areas in the system that should be protected, and also protect one device from DMAing into/from another device memory (e.g. NIC stealing GPU framebuffer, or inserting instructions to the GPU instruction buffer, or keystrokes to USB controller buffer). Ideally, this could be done by programming VT-d to grant each device only access to its own DMA buffer, but as far as I know, this would be very hard to implement, if not impossible for a 3rd party, on a Windows OS (in contrast to Linux, which mostly support this model). Please correct me, if the recent Windows version allows for such use of VT-d.
  1. Finally, and the most hard thing to solve, how to define all the "sensitive pieces of memory" in the system that should be protected and/or monitored? Although this is a somehow more generic problem, not specific to DS, but applying to any A/V, HIPS, or forensic tool.
So, is DeepSafe another piece of crap not worth any special attention, or has McAfee and Intel came up with some novel methods, e.g. for chipset virtualization, and other problems? Unless I see some technical info to backup the latter, I would have to assume, unfortunately, the former. But I would like to be mistaken – after all DeepSafe seems to be just a new incarnation of my Bluepill ;)
\ No newline at end of file diff --git a/_posts/2012-02-06-qubes-beta-3.html b/_posts/2012-02-06-qubes-beta-3.html deleted file mode 100644 index 5449396..0000000 --- a/_posts/2012-02-06-qubes-beta-3.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 3! -date: '2012-02-06T11:45:00.002+01:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-11-02T18:06:34.499+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7272088205765369134 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/02/qubes-beta-3.html ---- - - -->
A new ISO with the just released Qubes Beta 3 is now available for download here.

Beta 3 fixes lots of annoying problems discovered in Beta 2 and earlier releases, and also implements a bunch of useful feature:

This includes the qvm-block tool and infrastructure for easy attachment of block devices to any AppVM, no matter which system VM is handling the actual USB controller. So, this allows to have untrusted USB domain(s), almost seamlessly integrated in the desktop system. One can consider to use it in order to prevent various USB attacks. The next release (the 1.0) will bring this feature to the Qubes GUI manager as well, making it easy to use for non-command-line users too.

Also, we have now introduced fully automatic Qubes build system, that allows to build all the Qubes packages, and also create the installation ISO, with just one command. More information on this system and on how to use it can be found in the wiki.

We have also updated to Fedora 15-based template as a default. Unfortunately F16-based template would require too much work to get all the Gnome 3 stuff working correctly. (The challenge here, is that we don't run a normal Windows and Desktop manager in every domain, in order to make the VMs light weight, and so we need to sometimes work around various problems this causes...).

Finally, we have added two new Qubes-specific applications:
  • A plugin for Thunderbird (it is automatically installed in the template), that allows for one click opening of attachments in Disposable VMs, as well as one-click saving of the attachment to select VM.
  • And something we call “split GPG”, that I will describe in a separate article later.
Those Qubes-specific applications are based on our Qubes RPC, introduced in Beta 2.

This is likely the last release before the “final 1.0”, that is scheduled to follow soon(TM). The only major work for 1.0 is GUI manager improvements to expose most of the Qubes functionality via clickable GUI, and command line tools cleanup and documentation. Plus testing and bugfixing :)

And then, the next thing we will be working on will be support for HVM domains, e.g. Windows. This work is starting actually just about now, but code will be released only after Qubes 1.0.
\ No newline at end of file diff --git a/_posts/2012-03-03-windows-support-coming-to-qubes.html b/_posts/2012-03-03-windows-support-coming-to-qubes.html deleted file mode 100644 index 0d939bc..0000000 --- a/_posts/2012-03-03-windows-support-coming-to-qubes.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Windows support coming to Qubes! -date: '2012-03-03T12:43:00.000+01:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-12-15T12:48:18.912+01:00' -thumbnail: http://3.bp.blogspot.com/-UFnn-9m1pO0/T1IBP9dvJ8I/AAAAAAAAAJs/E41NvH8MQKM/s72-c/qubes-hvm-windows.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-2536319280775711164 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/03/windows-support-coming-to-qubes.html ---- - -Ok, let's start with a screenshot :)


While the “Qubes 1.0” branch is currently in the final development and testing, we have already started working on the Next Big Feature, which is a support for HVM domains (hardware, or VT-x virtualized domains). This allows to run e.g. Windows VMs under Qubes. You might be wondering what so special about this, if Xen has been supporting HVM domains, and specifically Windows VMs for a long time, and Qubes uses Xen hypervisor, so why haven't we had Windows support since day one?

The are a couple of things that we don't like about HVM support in Xen (and also in other VMMs), which include: the need to run device emulator (AKA qemu) in Dom0, the need to use crappy VNC, or a similar protocol to access the VM's framebuffer, or alternatively, the crazy idea (from security point of view, that is) of using a pass-through graphics for a VM, the lack of support for disaggregated architecture where backends, e.g. network backends, run in other domains than Dom0. In fact even the Xen “stubdomain” feature, introduced a few years ago, that was supposed to be a solution allowing to move the qemu out of Dom0, in practice turned out to be quite disappointing, as the qemu in the stub domain still requires an accompanying process of another qemu in Dom0, somehow negating all the security benefits this architecture is supposed to bring... And not to mention the omni present assumption that backends run always in Dom0, hardcoded in a few places in the stubdomain code.

So, we didn't like it and that's why Qubes had no Windows support for long time. But this has now changed, as we have just finished the 1st stage implementation of HVM support in Qubes, the way we like it, without any security compromises. In our implementation we've completely eliminated all the qemu remains from Dom0 (it's running in a micro stub domain), the graphics virtualization fully integrates with our very slim GUI daemon (we didn't have to modify our GUI daemon at all!), using our Xen-optimized, zero-copy, minimalist GUI protocol, and the networking is also fully integrated with the Qubes diaggregated networking architecturethat uses isolated domains for all the networking stacks and drivers. Of course, there are still some rough edges, such as no clipboard support, and the virtualization is currently in a “per-desktop” mode, rather than in a “per-window” mode, which is used for PV domains. But, rest assured, we are working on those things right now...

This code is currently not public, and the plan is to release it only after Qubes 1.0 release, either as an upgrade, or as Qubes 2.0. All the dom0 code for HVM support will likely remain GPL, while any Windows-specific code (agent code) will likely be proprietary. \ No newline at end of file diff --git a/_posts/2012-06-27-some-comments-on-operation-high-roller.html b/_posts/2012-06-27-some-comments-on-operation-high-roller.html deleted file mode 100644 index 4f26f55..0000000 --- a/_posts/2012-06-27-some-comments-on-operation-high-roller.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Some comments on "Operation High Roller" -date: '2012-06-27T16:00:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:06:08.839+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7366669906499592065 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/06/some-comments-on-operation-high-roller.html ---- - -About a year ago I wrote about Why the US "password revolution" won't work, where I pointed out that a massive move towards two-factor authentication will not solve any of the identity theft problems that users experience today. Specifically, I wrote:
[People] don't understand that the [compromised] operating system can impersonate the user at will!
The compromised OS could have saved your PIN to this [smart] card when you used it previously (even if you configured it not to do so!) and now,  immediately, it could use the inserted card to authenticate as you to the bank and start issuing transactions on your behalf. And you won't even notice this all, because in the meantime it will show you a faked screen of your banking account. After all, it fully controls the screen.
The bottom line is that we cannot secure our digital lives, if our client operating systems could not be secured first.
But introduction of tokens won't make our operating systems any more secure!

This article sparked lots of controversy with many people, who considered it a fallacy to criticize two factor authentication...

Today, I came across the news about Operation High Roller, discovered recently by McAfee and Guardian Analytics. They released a paper with some details about the attacks and the malware deployed. Some interesting quotes:
All of the instances that involved High Roller malware could bypass complex multi-stage authentication. Unlike recent attacks that collect simple form authentication data—a security challenge question, a one-time token, or PIN—this attack can get past the extensive physical (“something you have”) authentication required by swiping a card in a reader and typing the input into a field (see Two-factor Authentication sidebar).
The attack asks the victim to supply the information required to get around the physical controls of smartcard reader plus pin pad entry to generate a one-time password (or digital token).
Having collected all the information it requires for the entire transfer, the malware stalls the user and executes its transaction in the background using the legitimate digital token.
Multiple after-the-theft behaviors hide evidence of the transaction from the user. For example, the client-side malware kills the links to printable statements. It also searches for and erases confirmation
emails and email copies of the statement. Finally, it also changes the transactions, transaction values, and account balance in the statement displayed on the victim’s screen so the amounts are what the account holder expects to see.

Defensive security is a difficult game, because one doesn't immediately see whether a given solution works or not. This is in stark contrast to other engineering disciplines (and to offensive security) where one usually have immediate feedback on whether something works well or not.

Say you want to build a redundant long-range video downlink for your unmanned, remotely operated helicopter -- you can throw in lots of money buying various high-gain antennas, circular antennas, antenna trackers, diversity systems, etc., but then ultimately you can verify your creation immediately by going into a field and trying to fly a few miles away, and see whether you loose the vision (usually in the middle of some life-threatening manoeuvre) or not. At least you can draw some lines of how good your solution is ("I can fly up to one mile away, but not more, unless there aren't that many trees around and the air is dry enough").

With security, especially with computer security, it is so different, because there is no immediate feedback. This results in various vendors pitching their products as wonderful solutions that just solve all the worlds problems, even though what they're saying in those marketing materials might be pure nonsense... (BTW, congrats to Simon Crosby for apparently creating a Windows-hosted VMM in below 10k LOC! ;)

The often made mistake is to say: "Perhaps there is a way to attack this solution, but then again, how much of the malware in the wild implements such attacks?" This is a classical thinking in our industry, and in my opinion, an inexcusable mistake! Let me say it clearly:

It doesn't matter whether what the malware in the wild does -- it matters what it could potentially do!

So, if we can do a quick brainstorming session and point out potential attacks within 1 hour against some technology/product X, then, if we don't see a solution how to prevent them generically, we should not bother and implement product X, because it will be defeated, sooner or later. Let's not waste time on useless solutions, life's too short! \ No newline at end of file diff --git a/_posts/2012-07-21-qubes-10-release-candidate-1.html b/_posts/2012-07-21-qubes-10-release-candidate-1.html deleted file mode 100644 index eb1b798..0000000 --- a/_posts/2012-07-21-qubes-10-release-candidate-1.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes 1.0 Release Candidate 1! -date: '2012-07-21T16:12:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:27:23.368+01:00' -thumbnail: http://2.bp.blogspot.com/-zJFn81JdryI/UAqu7H9KSHI/AAAAAAAAAJ0/q_vVqkoEDTY/s72-c/snapshot9.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-8104324851973297050 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/07/qubes-10-release-candidate-1.html ---- - -
I would like to announce the release of Qubes RC1. The installation ISO and instructions can be found here.



This release is expected to essentially be identical to the final 1.0 release, which will likely follow in the coming weeks, except for some minor, cosmetic fixes.

Comparing to the previous Beta 3 release, the major changes and improvements in this version include:
  • A much improved Qubes Manager, that now allows to configure and manage almost every aspect of the Qubes system using a simple and intuitive GUI.
  • All the VMs are now based on Fedora 17 template.
  • Cleaned up and improved command lines tools for both Dom0 and for the VMs.
  • Updated Dom0 and VM kernels are now based on 3.2.7-pvops kernel, which offer better hardware and power management support.
  • Convenient menu improvements, that include e.g. a handy icon for launching a Disposable Web browser in a Disposable VM.
  • Support for “yum proxy”, which smartly allows to update packages in a template VM (or other updateable VM), without requiring to grant general HTTP access for this VM. This has been a problem before, as the Fedora repos use hundreds of mirrored yum servers, and it wasn't possible to setup a single rule in the firewall VM to allow only access to the yum servers, and nothing else. Now, this is possible, and the primary application is to prevent user mistakes, e.g. against using the temaplate VM for Web Browsing.
  • We also added support for an opt-in fullscreen mode for select VMs.
  • ...plus lots of other improvements and fixes under the hood. As can be seen in the wiki, there has been over 200 tickets closed as part of the work on this release!
So, again, this is almost the final release, please test it and report any problems to the mailing list, so that we could fix them before Qubes 1.0 comes out officially.
\ No newline at end of file diff --git a/_posts/2012-09-03-introducing-qubes-10.html b/_posts/2012-09-03-introducing-qubes-10.html deleted file mode 100644 index 457f67d..0000000 --- a/_posts/2012-09-03-introducing-qubes-10.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Qubes 1.0! -date: '2012-09-03T11:28:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:27:09.610+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7517388891109415425 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/09/introducing-qubes-10.html ---- - -After nearly three years of work, I have a pleasure to announce that Qubes 1.0 has finally been released! To see the installation instructions and to get an ISO, please go to this page.

I would like to thank all the developers who have worked on this project. Creating Qubes OS has been a great challenge, especially for such a small team as ours, but ultimately, I'm very glad with the final outcome – it really is a stable and reasonably secure desktop OS. In fact I cannot think of any more secure alternative...

I use the term “reasonably secure”, because when it comes to defensive security it's difficult to use definite statements (“secure”, “unbreakable”, etc), unless one can formally prove the whole design and implementation to be 100% secure.

Unfortunately, contrary to common belief, there are no general purpose, desktop OSes, that would be formally proven to be secure. At the very best, there are some partsthat are formally verified, such as some microkernels, but not whole OSes. And what good is saying that our microkernel is formally verified, if we continue to use a bloated and buggy X server as our GUI subsystem? After all, a GUI subsystem has access to all the user inputs and output, thus it is as much security sensitive, as is the the microkernel! Or power management subsystem, or filesystem server, or trusted boot scheme, or ... a dozens of other elements, which just cannot be forgotten if one wants to talk about a truly secure OS. As said before, I know of no general-purpose desktop OS that would be formally proven, and thus that could be called “secure”. You can also read more about challenges with formal verification microkernels in this article, and especially in this comment from the seL4 project leader.

In Qubes OS we took a practical approach and we have tried to focus on all those sensitive parts of the OS, and to make them reasonably secure. And, of course, in the first place, we tried to minimize the amount of those trusted parts, in which Qubes really stands out, I think.

So, we believe Qubes OS represents a reasonably secure OS. In fact I'm not aware of any other solution currently on the market that would come close when it comes to secure desktop environment. But then again, I'm biased, of course ;)

I wouldn't call Qubes OS “safe”, however, at least not at this stage. By “safe” I mean a product that is “safe to use”, which also implies “easy to use”, “not requiring special skills”, and thus harmless in the hands of an inexperienced user. I think that Apple iOS is a good example of such a “safe” OS – it automatically puts each application into its own sandbox, essentially not relaying on the user to make any security decisions. However, the isolation that each such sandbox provides is far from being secure, as various practical attacks have proven, and which is mostly a result of exposing too fat APIs to each sandbox, as I understand. In Qubes OS, it's the user that is responsible for making all the security decisions – how to partition her digital life into security domains, what networkand other permissions each domain might have, whether to open a given document in a Disposable VM, etc. This provides for great flexibility for more advanced users, but the price to pay is that Qubes OS requires some skills and thinking to actually make the user's data more secure.

Generally Qubes OS is an advanced tool for implementing Security by Isolation approach on your desktop, using domains implemented as lightweight Xen VMs. It tries to marry two contradictory goals: how to make the isolation between domains as strong as possible, mainly due to clever architecture that minimizes the amount of trusted code, and how to make this isolation as seamless and easy as possible. Again, how the user is going to take advantage of this isolation is totally left up to the user. I realize this might be a tricky part for some users and some usage scenarios, yet, on the other hand, this seems to be the most flexible and powerful approach we could provide.

Thus people should realize that by mere fact of using Qubes OS they won't become automatically more secure – it's how they are going to use it might make them significantly more secure. A hypothetical exploit for your favourite web browser would work against Firefox running inside one of the Qubes VMs just as well as it worked for the same browser running on normal Linux. The difference that Qubes makes, is that this attacked browser might be just your for-personal-use-only browser which is isolated from your for-work-use-only-browser, and for-banking-use-only-browser.

Finally, even though Qubes has been created by a reasonably skilled team of people, it should not be considered bug free. In fact, over the last 3 years we already found 3 serious bugs/attacks affecting Qubes OS – one of them in the very code we created, and two other in Intel hardware. Again, we tried as much as possible to limit the amount of code that is security sensitive in the first place, yet we are just humans ;) So, I'm very curious to see others' attempts to break Qubes – I think it might make for a very interesting research. A good starting point for such research might be this page. And I know there are individuals out there who apparently only been waiting for Qubes 1.0 to come out, to get some glory(yet, it's not clear to me why to attack qemu, which is not part of the TCB in Qubes, but I guess great minds have their own mysteries ;)

In other words, please enjoy Qubes OS 1.0, hopefully it could make your digital life safer!

Please send all the technical questions regarding Qubes to the qubes-devel mailing list. Do not send them to me directly, nor post them in this blog's comments.
\ No newline at end of file diff --git a/_posts/2012-09-12-how-is-qubes-os-different-from.html b/_posts/2012-09-12-how-is-qubes-os-different-from.html deleted file mode 100644 index a3bdc37..0000000 --- a/_posts/2012-09-12-how-is-qubes-os-different-from.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: How is Qubes OS different from... -date: '2012-09-12T19:02:00.000+02:00' -author: Joanna Rutkowska -tags: -- os security -- qubes -modified_time: '2012-11-02T18:35:40.451+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3647954972953346145 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-different-from.html ---- - -Many people ask how does Qubes OS differ from other approaches to desktop security. Today I'm trying to answer the most popular questions.
  • Why bother with Qubes OS, if any Linux/BSD already allows to setup different user accounts, or some form of light-weight containers or sandboxes, such as chroot, LXC, SELinux?
First, if you use Xorg or similar X-based server as your GUI server, and this is what nearly all Linux, and most of the other non-Windows OSes use, then you don't have any form of GUI-level isolation, which is essential for a desktop system. I wrote more about this surprising problem some time ago. Proper GUI-level isolation was one of the main goals for Qubes.

Second, all mainstream desktop OSes, such as Windows, Linux, BSD, even OSX, are all based on a monolithic kernels, which present a significant security problem. This is because a typical monolithic kernel of a contemporary desktop OS contains tens of millions of lines of code, and to make it worse, most of this code is reachable from (untrusted) applications via all sorts of APIs, making the attack surface on the kernel huge. And it requires just one successful kernel exploit to own the whole system, bypassing any security mechanisms that might have been built on top of it, such as SELinux, LXC, etc.

Additionally, all the various drivers, networking and USB stacks, are also hosted in the kernel, making attacks via buggy networking (e.g. via buggy 802.11 stacksor buggy firmware) or USB stacks a practical possibility. And there is essentially nothing one can do about it, when using an OS based on a monolithic kernel.

In Qubes, on the other hand, we use Xen hypervisor to provide security isolation between domains, and Xen is just a few hundred of thousands lines of code. It also doesn't need to provide all sorts of APIs to applications, because the Xen hypervisor is essentially only interested in CPU scheduling, memory management and power management, and very few things beyond that. Most notably, the Xen hypervisor knows nothing about networking, disk storage, filesystems, USB stacks, etc, as all those tasks are delegated to (often untrusted) service VMs.
  • How is Qubes better than just running a bunch of VMs in VMWare or Virtual Box?

First, products such as VMWare Workstation or Fusion, or Virtual Box, are all examples of type II hypervisors (sometimes called “hosted VMMs”), which means that they run inside a normal OS, such as Windows, as ordinary processes and/or kernel modules. This means that they use the OS-provided services for all sorts of things, from networking, USB stacks, to graphics output and keyboard and mouse input, which in turn implies they can be only as secure as the hosting OS is. If the hosting OS got compromised, perhaps via a bug in its DHCP client, or USB driver, then it is a game over, also for all your VMs.

Second, those popular consumer type II VMM systems have not been designed with security as a primary goal. Instead, their main focus has been on easy of use, performance, and providing seamless integration of the guest OS(es) with the host OS. Especially the latter, which involves lack of good method to identify which domain a given application belongs to (so, lack of trusted Window Manager), support for shared clipboards which every other VM can steal, insecure file sharing methods, and others, all make it not a very desirable solution when strong domain isolation is important. (This is not to imply that Qubes doesn't support clipboard or file sharing between domains, it does – it's just that we do it in a secure way, at least so we believe). On the other hand, there are many usability improvements in Qubes that are specific to multi-domain system, and which you won't find in the above mentioned products, such as trusted Window Manager that, while maintaining great seamless integration of all the applications onto a common desktop, still allows the user to always know which domain owns which window, support for advanced networking setups, per-domain policies, the just mentioned secure mechanisms for clipboard and filesystem sharing, and many other. Qubes also focuses on making the VMs light-weight so that it was possible to run really a lot of them at the same time, and also on mechanism to allow for secure filesystem sharing between domains (templates).

Finally, the commercial hosted VMMs are really bloated pieces of code. They support everything and the kitchen sink (e.g. Open GL exposed to VMs, and various additional interfaces to allow e.g. drag and drop of files to/from the VM), and so, the attack surface on such a VMM system is orders of magnitude bigger than in case of Qubes OS.
  • How does Qubes compare to [your favourite academic microkernel]? 
While the Xen hypervisor can indeed be considered a microkernel if you're not a strict terminology freak, Qubes itself is much more than just the hypervisor. Qubes is everything that is needed to build a reasonably secure desktop OS on top ofa baremetal hypervisor (or microkernel). Theoretically, with just a few cosmetic changes (at least architecture-wise), Qubes could perhaps swap the Xen hypervisor for some other hypervisor or microkernel, such as perhaps Hyper-V, KVM, or some more exotic one. Thus, it makes little sense to compare Qubes with a hypervisor or microkernel project. What makes sense is to compare the Xen hypervisor, as used in Qubes, with some other hypervisor or microkernel.

Ok, so how does Xen compare with other hypervisors or microkernels out there? We think Xen is unique because it combines an elegant architecture (type I, baremetal, hypervisor) with a number of practical features, such as power management, support for Intel VT-d and driver domains, support for both para-virtualizaed, and fully-virtualized VMs, and many more, not found in e.g. academic microkernels/hypervisor projects, that otherwise seem attractive from the architecture point of view.
  • How is Qubes better than Google Chrome OS?
 First, Chrome OS is not a general purpose OS. Second, it's based on Linux with all its security limitation that are a result of using a monolithic kernel described above (e.g. all the networking and USB stacks in the kernel without a possibility to deprivilige them). Not being a traditional general purpose OS, Chrome is able to avoid many of the challenges of desktop computing, such as the need to define security domains, inter-domain file exchange (as there is essentially no filesystem visible to the user), and others, which is good, of course. But then again, Chrome OS is essentially just an environment to run the Chrome Browser, so the comparison to Qubes is a bit of a misunderstanding.

Technical aspects aside, there is always the privacy concern associated with running everything in a browser – why would all my private data be managed and accessible to some 3rd party organizations and their administrators?
  • How is Qubes better than [your favorite commercial military-grade certified secure OS]?
You must have heard about the super secure military-grade, formally verified, 100% certified, and generally “unbreakable” operating systems made by companies such as Green Hills, Lynx Works, and others. How do they compare to Qubes OS?

Really, I have no idea. For a mere mortal like myself (and perhaps not a US citizen), it seems impossible to get any more technical documentation of those systems (anything beyond the marketing pseudo-technical gibberish), not to mention a trial copy to play with...

Thus, from my point of view, those systems are just a vaporware. If you, my dear reader, are privileged enough to have access to such system, then good for you, but don't expect me to treat seriously a security product that is not available for a wider audience to touch and play with... (And the Chineese surely have the copies already to play with ;)
  • How is Qubes different than Bromium's “micro virtualization” solution?
Many people asked recently about the Bromium's upcoming product and how it differs from Qubes OS. Unfortunately there are few public information available on this product – essentially there is one not-very-technical whitepaperand there are Ian Pratt's presentation slides from the recent XenSummit about u-Xen, apparently a hypervisor that is to be ultimately used in their upcoming product.

The whitepaper suggests that Bromium is based on a hosted (type II) hypervisor running within a normal Window OS, and that this hypervisor is used to spawn a new “micro VM” for each new “task”, where apparently the task might be something as granular as opening a new tab in a Web browser, which makes it somehow similar to Google Chrome's approach. Clearly, the Bromium's main goal seem to be to automate the process of creating separation domains, which is in contrast with what we do on Qubes OS, where the user is required to define the domains explicitly.

The Pratt's slides provide also some technical insight into how Bromium intends to secure their hypervisor. As just discussed above, a hosted hypervisor must normally trust the hosting OS, in this case Windows, which, for obvious reasons, is not a good idea from the security standpoint. Pratt, however, clearly states that “host (...) can not interfere with the privacy or integrity of the hypervisor or other guests” (slide #8). This is a strong statement, so let's take a closer look at their approach to this problem.

The Bromium's idea of how to make their hypervisor (and the VMs) protected from a potentially malicious host OS is not really breakthrough: the slides suggest to “deprivilege the host into a VT-container” (I think the verb to bluepillis now an accepted term for such action ;), and to remove the host's access to the hypervisor pages (via EPT), as well as protect DMA access from devices via VT-d, plus to make this all sensible, use DRTM scheme such as Intel TXT, to load such a hypervisor from within a potentially untrusted OS.

So, what's wrong with the idea of a load-on-the-fly-secure-VMM-system? Isn't Ian Pratt correct that one could protect its memory and execution from the interference of the host? Actually that is possible – Intel TXT, VT-x, VT-d, and EPT give us means to achieve that (although there are a number of catches here). But he's missing one important point: it's the untrusted OS that still owns and manages the input devices (e.g. via USB stacks and drivers) and, most importantly, the output (via the GUI subsystem and drivers). Ensuring that the host OS cannot interfere (e.g. sniff the screen of trusted applications) might be very difficult, or even impossible, in practice.

If I ever was to break the security of such a system, I would just follow the simple way:
1) Infect the host e.g. via one of the many USB attacks (remember they cannot have sandboxed USB driver domain, as they have only a type II hosted hypervisor),
2) Hook somewhere into the GUI subsystem and keep recoding all the interesting data from the screen...
... or something like that ;)

There are also many other things that needs to be answered and which the publicly available documents are silent about, such as e.g. how does the system handle installation of new applications? How is clipboard and file exchange between (micro)VMs handled? How large are the interfaces exposed to each (micro)VM? For now, without a solid documentation available, and without any code to play with, it is just another vaporware for me. (Interestingly there seem to be Bromium's Beta program, which however doesn't seem to be working, at least not for me -- I tried to signup twice, but never got any confirmation or response...?)
  • How is Qubes different from Xen Client?
In many aspects, Xen Clientmight be the most similar product to Qubes OS. Like Qubes, it is based on the Xen hypervisor and so it is also a standalone OS, that one must install instead of one's favorite system, and also, like Qubes, it is targeted for desktop systems, and also offers a possibility to run a few VMs at a time.

However, XenClient has been designed with a different goal in mind, namely as a “Virtual Desktops To Go” solution, while Qubes has been designed to provide seamless experience for secure multi-domain desktop system. As a result, lots of focus in Qubes has been put on creating trusted GUI subsystem, support for advanced networking configurations, secure inter-VM clipboard and file sharing, secure method to reuse the same filesystem as a basis for the AppVMs, and also to optimize the AppVMs so they start almost instantly and take little memory, so that one could easily run many of them at the same time. All those things seem to be missing from Xen Client (as well as solid technical documentation about its design).

***
I surely have missed a few other products or approaches -- feel free to point them out in the comments, and I might write a continuation post one day.
\ No newline at end of file diff --git a/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html b/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html deleted file mode 100644 index aa50324..0000000 --- a/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes 2 Beta 1 with initial Windows support has been released! -date: '2012-12-14T13:42:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-12-15T12:46:38.198+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4370938576459656069 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/12/qubes-2-beta-1-with-initial-windows.html ---- - -
It's my pleasure to announce the first Beta for Qubes Release 2 is now available for download.

This release introduces generic support for fully virtualized AppVMs (called HVMs in Xen parlance), and specifically initial support for Windows-based AppVMs integration. It's been quite a challenge to add support for secure HVMs to Qubes without breaking its security architecture, and I already wrote about it in the past.

Generic support for HVMs means you can now install many different OSes as Qubes VMs, such as various Linux distros, BSD systems, and, of course, Windows. Essentially all you need is an installation ISO and the whole process is similar to creating a VM in a program like Virtual Box or VMWare Workstation (although we believe the underlying architecture for this is more secure in Qubes).

Additionally we provide a set of tools for Windows-based AppVMs (Windows 7 specifically) which allow for tight integration with the rest of the Qubes system. This currently includes support for secure (and policy controllable) clipboard and file exchanges between the Windows-based AppVMs and other AppVMs, integration with Qubes advanced networking infrastructure, and PV drivers for faster operation. As of now there is still no seamless app integration for Windows applications, so Windows VMs are presented as full-desktop-within-a-window, but we're aiming to add support for this in the next Betas.

Unlike the rest of Qubes, which is distributed under a GPL v2 license, the Qubes Windows Support Tools are not open sourced and are distributed as binaries only, under a proprietary license. They are free to use for any Qubes 2 user. The tools are not part of the Qubes 2 installation ISO (which is GPL), and are down loadable on demand.

More information about creating and using HVM domains, including Windows-based AppVMs, can be found in the wiki here.

To summary, here's a quick list of some of the exciting new features that toady's release brings in:
  • Support for generic fully virtualized VMs (without qemu in the TCB!)
  • Support for Windows-based AppVMs integration (clipboard, file exchange, qrexec, pv drivers)
  • Secure audio input to select AppVMs (Hello Skype users!)
  • Clipboard is now also controlled by central policies, unified with other qrexec policies.
  • Out of the box TorVM support
  • Experimental support for PVUSB
  • Updated Xorg packages in Dom0 to support new GPUs
  • DisposableVM customization support
  • ... and, as usual, various fixes and other improvements :)
Existing users of Qubes R1 can upgrade without needing to reinstall – the upgrade procedure is described here. Standard installation is described here.

Enjoy!

PS. Please send all the technical questions to the qubes-devel mailing list, instead posting them as comments to this blog. Keep the comments here for more generic discussions.

PS2. As usual, I would like to remind that we have little control over the servers that are used for Qubes ISO distributions and that the downloads should be verified according to the procedure described here. We always assume that even our own servers (git, wiki, yum) could be compromised, and yet this should not affect Qubes security in any way, because of the extensive use of digital signatures everywhere in the development and distribution process.
\ No newline at end of file diff --git a/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html b/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html deleted file mode 100644 index e1d283a..0000000 --- a/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Converting untrusted PDFs into trusted ones: The Qubes Way' -date: '2013-02-21T20:07:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-02-21T20:07:29.049+01:00' -thumbnail: http://1.bp.blogspot.com/-dno9bFVAjPk/USY0jfl3-WI/AAAAAAAAAKE/4WzqMREkWSc/s72-c/r2b2-converting-pdf-2.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-6301918961626950395 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/02/converting-untrusted-pdfs-into-trusted.html ---- - -
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchanged by people, or downloaded from the Web, and that often provide a way for the attacker to compromise the user's desktop system.

Today I would like to discuss a recent innovation we created for Qubes OS that allows to securely convert those pesky PDFs (as well as essentially any graphics files) into trusted PDFs. Here by a “trusted PDF” I mean a file that should be harmlessto the user's system, so, a non-malicious PDF.


A few years ago, we have already introduced a mechanism in Qubes OS called Disposable VMs, that can be used to safelyopen any file, including PDFs, DOCs, etc. The file is being opened in a... well a dedicated disposable VM that is created within seconds (typically below 5 seconds) and all the file processing and rendering happens inside this VM. Once the document is closed, the disposable VM is automatically destroyed, and any changes to the file (e.g. if the was an editable DOC file) are automatically propagated back into the original file. This mechanism is very powerful, and I often use it for my daily work. However, it surely is a bit cumbersome – who wants to wait 5 seconds for the PDF to open, especially if I have a dozen of invoices to look through! So, today I present an alternative approach...
 
Approaches to converting PDFs

The problem of converting a potentially untrusted PDF into a harmless one is certainly not a new one. Some tools have already be created for this task.

The typical approach is to parse the original PDF, look for “potentially dangerous things” there, and remove them. As simple as that! This is, of course, a typical AntiVirus approach to the problem. And, typically as it is for most AV approaches, it's completely useless against any more skilled and determined attacker (and these are the ones we fear the most, don't we?).

A somehow better approach is to parse the original PDF, disassemble it into pieces, and then reassemble them into a new PDF only using the “trusted” pieces – this, I think, could be called a whitelisting approach.

Anyway, the fundamental problem with the approaches mentioned above, is that all of them require parsingof the original PDF file. And parsing is where the “big bang” usually happens. Parsing is where our, normally pretty decent, code, comes in close, intimate contact with some unknown complex input data, which often leads to a successful abuse or exploitation.

Parsing PDFs safely

So, how to perform parsing safely? Of course, that's simple! Let's run the parser in an isolated container – in case of Qubes we already have an ideal such container: it's the Disposable VMs.

But, before we get too excited, let's think more about it – say we run the parser safely isolated in a Disposable VM, meaning it couldn't harm any of the rest of the system, except for the Disposable VM itself, which we however won't worry much about, because it is disposable... But then what?

We want our PDF back in our original VM, to actually use it, right? But we cannot just copy the result from the Disposable VM, because if it got compromised, as a result of parsing of the malicious PDF, then we would like get... a compromised converted PDF. So, this approach gives us nothing!

(Even though our “solution” incorporates all the obligatory buzzwords: “Disposable VMs” (“Micro Disposable VMs”?), “VMs isolated using hardware Intel vPRO technology” and, of course, the “hypervisor”! Sometime just the mere fact we use “hardware virtualization” buys us nothing... People seem to forget about this sometimes.)

So, the trick to make this approach meaningful is to introduce what I will call a “Simple Representation” of the input file. More on this, straightforward concept, below. The idea is that our parser (that runs in a Disposable VM) will be expectedto return the Simple Representation of the original PDF. Of course, it might very well go wild (as a result of exploitation by the PDF it parses), and don't obey our expectations, and instead return something totally different and potentially malicious. But that doesn't matter! The whole point of the Simple Representation is that it should be, well... simple to parse it safely and discard in case what we're getting doesn't look like the Simple Representation.

Ok, so what's the simplest possible representation of an arbitrary PDF file? Yes, it's the RGB format, which is essentially just a raw array of RGB values for each pixel. In fact, I'm not sure there could be anything simpler in the Known Universe to represent a PDF file...

Now this is all becoming simple: we would expect our parser to send us just two things: the dimensions (W x H) of the bitmap representation of each of the page of the PDF in question, and each of the PDF page itself converted into a raw RGB format. If the parser didn't obey, we would still interpret whatever stream of bytes we get as a RGB bitmap – in the worst case the PDF we create would look like un-tuned analog TV screen.

The diagram below summaries this idea:



Implementing this all on Qubes

Now I would like to show how easy it is to implement such PDF converter service using the Qubes advanced infrastructure that we call qrexec, and which is part of Qubes core for quite some time now.

First, let's choose the PDF and image conversion tools. The choice of PDF converter is not security critical, because it will run in an isolated Disposable VM. Here I decided to use pdftocairo converter, which is part of the poppler-utils package on Fedora. We will also use ImageMagick's “convert” command to convert the PNG files (produced by pdftocairo, one for each PDF page) to the raw RGB format. Incidentally ImageMagick supports RGB format natively. As mentioned above, in addition to sending the raw RGB file, we would also need to send the width and height of the pixmap – those can easily be obtained using ImageMagick's “identify” command. Again, all those programs discussed so far are not security critical – they might get exploited during the processing of the untrusted input PDF file, and we don't worry about that at all.

On the receiving side, however, we need to use a foolproof parser for the RGB format. Again, this is what we gain in this whole process – instead of requiring a foolproof-and-also-being-able-to-produce-non-malicious-PDFs parser, we only require a foolproof RGB parses, and that's quite a gain! The ImageMagick's convert comes to mind again here, and one might want to use it like this:

convert page.rgb page.pdf

Unfortunately this would be wrong, because the convert program would still try to detect the “real” format of the page.rgb file, and, if it looked more like, say, JPEG or PDF, it would parse it accordingly, compromising all our careful plan! What we really need is to tell our convert program to always treat the input as raw RGB file, instead of trying to be (too) smart and trying to guess the format by itself. This can be achieved by adding the “rgb:” prefix in front of the input argument, which provides explicit input format specification:

convert -size ${IMG_WIDTH}x${IMG_HEIGHT} -depth ${IMG_DEPTH} rgb:$RGB_FILE pdf:$PDF_FILE

Now also needed to add size and depth explicitly, because the raw RGB format doesn't convey such information (well, it has no header of any sort at all!). Of course we need to obtain the width and height from the parser, but we can validate such input rather easily. In addition we make sure that the received RGB file has exactly the size as indicated by width and height. With those precautions in place, there would have to be really a gappinghole in the ImageMagic's RGB parsing code for the attacker to exploit this. Perhaps instead of using the ImageMagick's convert I should have written a small script in python that would parse the received RGB file (and save it into a... RGB file, for later processing by ImageMagick), but I sincerely think this would be an overkill here. 
 
Finally we can write the following two simple bash scripts, one for client: qpdf-convert-client, and the other one, qpdf-convert-server, for the server (which runs in a Disposable VM).

Additionally we also need to create a policy file in Dom0 in /etc/qubes_rpc/policy/to allow to use this service. The policy file content for this service should look like this:

$anyvm $dispvm allow

... which is pretty self explanatory. When I do development I also add another line to the policy file like this:

$anyvm devel-vm ask

... to allow me to run the server inside my 'devel-vm' VM, instead of running it in Disposable VM every time, which would be very inconvenient for development, as it would require me to update the Disposable VM template each time I wanted to test a new version of qpdf-convert-server.

The policy file should be placed in Dom0 in /etc/qubes_rpc/policy/qubes.PdfConvertfile – here the name of the file must be the same as the name of the service, as invoked via qrexec_client_vmcommand, discussed below.

And, one last thing, in the destination VM we must also create a file that will map the service name (so, the qubes.PdfConvert in our example) to the actual binary that should be called in the VM when the service is invoked. So, the file should be named: /etc/qubes_rpc/qubes.PdfConvert(again, this is now in a VM, not in Dom0, also note the lack of policy/ subdir), and it is another one-liner with the following content:

/usr/lib/qubes/qpdf-convert-server

The full source code of qpdf-converter can be seen and downloaded from this git repo.

We're ready now to test our qubes.PdfConvert service: in the requesting VM, i.e. the one from which we want to initiate the conversion process we do:

[user@work Downloads]$ /usr/lib/qubes/qrexec_client_vm '$dispvm' qubes.PdfConvert /usr/lib/qubes/qpdf-convert-client ITLquote.pdf
-> Sending file to remote VM...
-> Waiting for converted samples...
-> Receving page 2 out of 2...
-> Merging pages into a single PDF document...
-> Converted PDF saved as: ITLquote.trusted.pdf
-> Original file saved as .ITLquote.pdf

Again, for development process I would replace '$dispvm' with something like 'devel-vm'.

The qrexec_client_vmcommand, used above, is not actually intended to be used by user directly (that's why it's installed in /usr/lib/qubes instead of /usr/bin/), and so when one creates a Qubes qrexec service, it's customary to create also a small wrapper around qrexec, like this one, that makes using the service simple.

The presented converter saves the original file as .${original_pdf}making it a hidden file to help the user avoid accidental opening. The new, converted file gets .trusted.pdfsuffix appended to the base name of the original file. I discuss more issues regarding the human factor and avoiding accidental opening in one of the next paragraphs below. The converter can also be used to convert essentially any image file, such as JPEG, PNG, etc, into a PDF, using the same method.

As you can see creating client-server services in Qubes is very simple – in fact it took me just one afternoon to get the inital working version of the converter (with subsequent "polishing" over the next 2 days).

The qrexec infrastructure takes care about all the under-the-hood tasks, such as starting the necessary VMs, e.g. creating Disposable VM to handle the service request,establishing communication channels between VMs (which are ultimately implemented on top of Xen's shared memory), redirecting client and server's stdin and stdout to each other, so that writing services is very simple, even in shell, and, of course, obeying policies defined centrally in Dom0.

Most “inter-VM” features in Qubes, such as secure file copy between domains, opening files in Disposable VMs, time synchronization, appmenus synchronization, etc, are all implemented on top of qrexec. A notable exception is clipboard exchange, which is implemented as part of the GUI protocol, but still uses the same common qrexec code for policy processing (e.g. I use this policy to block clipboard and file exchanges between my work and personal domains).

Limitations, other Simple Representations

The obvious disadvantage of converting a PDF to an RGB representation is that one looses text search, as well as copy and edit capabilities (e.g. in case of PDF forms). So, converting Intel's IA32 Software Developer's Manual this way would certainly not be a good idea... But, hey, such large PDFs can always be opened in a Disposable VM – they would be fully functional then, only that you would need to wait a few seconds for the PDF window to pop up. Or, better yet, why not keep all such PDFs in a dedicated domain? E.g. I have a VM called “work-pub” where I keep tons of various, publicly available PDFs, such as the mentioned Intel's SDM, as well as various chipset docs, conferences papers and slides, and generally lots of stuff. The key point is that all in this VM is public material (and also all is related to my work), so that I don't really care if any of those PDFs compromises my work-pub domain. In the worst case, I will revert the VM from backup and download any missing PDFs again from the web. They are public after all. 
 
But the PDF conversion described above comes extremely useful in case of all the various invoices, Purchase Orders, NDAs, contracts, and god-knows-what-else PDF documents, which I'm forced to deal with in my “work” domain (where my email client runs). Most of those are one pagers, or maximum a few pages long documents, so the fact that they got converted to a bitmap provides me with very little discomfort. At the same time I gain incredible freedom in opening all those documents natively in my work VM, without fearing that one of those invoices will comrpomise my work domain (which would be a rather sad thing for me, although the really sensitive stuff is still in some other domains ;)

An interesting question is, however, can we come up with another form of Simple Representation that would allow e.g. to preserve the text searching ability of the converted PDFs (and DOCs, PPTs)? Probably... yes. The choice of the Simple Representation should be thought of as of a trade-off between security and document's features preservation. I'm not an expert on PDF and DOC formats (and I'm not sure I want to be) but it seems plausible that one could disassemble PDF into simple pieces, select the really simple ones, send those pieces as a Simple Representation back to client, and have them reassembled back into a almost-fully-functional PDF. Here, again, the point is that the PDF parsing is done in isolated Disposable VM, while the reassembly in the trusted VM. Anyway, let me leave it as a exercise for the reader :)
 
Preventing user mistakes

Being able to right-click on a PDF file and have it converted into a trusted PDF is one thing. Having this mechanism adopted by users and actually making their daily computing safer, is another story.
Users will likely have hundreds of PDF spread over their home directories, and the real challenge is how to make sure that the user never accidentally opens the unconverted, untrusted PDF. We can think of several approaches to this problem:
  • We modify the Thunderbird, Firefox, etc, e.g. by providing specific plugins, to always perform PDF conversion on each file that we got via email or downloaded from the Web. Additionally we convert all the already present PDFs in the user's home directory (file system?). And, additionally, we modify Qubes file copy operation to also always do automatic PDF conversion whenever one transfers files from other domains (if Qubes qrexec policy allows for such transfer in the first place, of course).

This approach would not be optimal, because some PDFs, as we discussed above, might not be well suited for conversion-through-bitmap process – they might be large PDFs where text search is crucial, some conference papers for review, where text copy is crucial, or some editable forms. That's why it seems better to take a slightly different approach:
  • We modify mime handlers for PDF files (as well as any other files that our converter supports) and then upon every opening of the file (e.g. via mouse click in a file manager) our program gets to run and its job is to determine whether the file should be opened natively, converted to a trusted PDF, or perhaps opened in a Disposable VM. Of course, upon “first” opening we should probably ask the user about the decision, if this cannot be determined automatically. E.g. if we can reliably determine the file is already converted, we can safely open it without prompting the user, but if it's not, we should ask – perhaps the user would like to open it in a Disposable VM instead of converting, or perhaps the file should be considered trusted anyway, because it was created by the user herself.

This second approach seems like a way to go, and we will likely implement it sooner or later (probably sooner, but after the upcoming R2 Beta2). It should also be noted, that typically user would need such mechanism only in some domains – e.g. I really feel the need for such protection in my “work” domain, but not in any other. But that, of course, depends on how one partitions their digital life into security domains.

One important detail worth mentioning here, is that we should unconditionally disable “Thumbnail View” in whatever file manager we use (which itself is really a stupid feature – can people not read filenames anymore or something?).

Qubes: from containers isolation down to apps protection

The mechanism introduced today, in addition to the Disposable VMs mechanism introduced earlier, represents a trend in Qubes development of “stepping down” into AppVMs in order to also make the VMs themselves somehow more secure (in addition to the isolation between the VMs).

Originally Qubes aimed at containers isolation only. This included protecting the system TCB where techniques such as deprivileged networking stacks (and optionally also deprivileged USB stacks) have been deployed, as well as custom GUI virtualization, and generally somehow “hardened” Xen configuration. This also included protecting the VMs from each other, where techniques such as secure clipboard, secure file copy and generally secure qrexec infrastructure have been introduced, as well as trusted GUI subsystem with explicit domain decorations.

But now, Qubes is stepping down into the AppVMs in order to make the VMs themselves also less prone to compromise. We surely will be working on more such mechanisms in the future. We still are only at the beginning of the quest to create a Reasonably Secure Desktop OS!

PS. The presenetd converter will be part of the Qubes R2 Beta 2, that is expected to be released... in the comming days. Experienced users of Qubes R1 and R2 Beta 1 can install the converter immediately by building the rpms from the git repo.


PS. WTF is happening with the Blogger web interface? Seriously, I don't remember being so frustrated using any software in the recent years that I am right now, when editing this post (as well as the last several ones). It sometimes honours the line breaks, sometimes do not, sometimes inserts a couple of new lines, sometime removes them, sometime mysterious spaces appear at the end of lines, sometime those cannot be removed... It doesn't allow to paste pre-formatted code-listing (at least I couldn't figure out how to make it honour tabs). And yes, I'm using the "Compose mode", because when I try to switch to the HTML mode, not only I'm overwhelmed with tons of HTML markups, nobody knows what for, but also when I switch back to the Compose mode, my article tends to get even more fucked up! Really, a shame. I wish I could go away to some other blogging service, but I'm afraid that converting all my posts would be even a bigger PITA... Sigh.
\ No newline at end of file diff --git a/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html b/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html deleted file mode 100644 index efa579f..0000000 --- a/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes 2 Beta 2 has been released! -date: '2013-02-28T19:26:00.002+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-02-28T19:26:09.671+01:00' -thumbnail: http://4.bp.blogspot.com/-0JE2dw3GsfA/US-a83j442I/AAAAAAAAAKc/peSktYNQeec/s72-c/r2b2-kde-start-menu.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7559919355447471448 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/02/qubes-2-beta-2-has-been-released.html ---- - -
Qubes R2 Beta 2 with KDE 4.9 environment (click for more screenshots)


We're progressing fast and today I would like to announce the release of Qubes R2 Beta 2 ISO. The installation and upgrade instructions, as well as the ISO itself, can be found via the our wiki page. As usual, please remember to verify the digital signature of the downloaded ISO.

The major changes in this beta release include:
  • Upgraded Dom0 distribution to the latest Fedora 18 (all previous releases used Fedora 13 for Dom0!)
  • Upgraded default VM template also to Fedora 18
  • Upgraded Dom0 kernel to 3.7.6
  • Upgraded KDE environment in Dom0 (KDE 4.9)
  • Introduced Xfce 4.10 environment for Dom0 as an alternative to KDE
  • A few other fixes and improvements, including the recently discussed Disposable VM-based PDF converter

The upgrade of the Dom0 distribution and kernel should significantly improve hardware compatibility – one of the major problems with Qubes adoption so far, as we hear. Now, with the latest GPU drivers and Xorg packages, I hope we will be able to cover a much boarder range of hardware (especially all the newer GPUs).

The upgrade of KDE in Dom0 is mostly an eye-candy type of improvement (but then, who doesn't like eye candies!), as is the introduction of the Xfce4 as its alternative, although, arguably, Xfce4 is considered faster and lighter than KDE. In Qubes the choice of an actual desktop environment that runs in Dom0 is not as important as it is on traditional Linux systems, I think, simply because most of the functionality, typically provided by such environments, such as apps and file management, is simply... disabled, because on Qubes there are no user apps or files in Dom0.

Nevertheless people love and hate particular window managers and environments, and we hope that now, by supporting alternative environments, we could appeal to even more users.

I'm glad that we just completed this difficult phase of upgrading Qubes Dom0 distribution (for the first time since Qubes R1 Beta 1!) -- this forced us to clean up the code and prepare for some even bigger and bolder changes in the near future. But those will come only in Release 3. As far as Release 2 is considered, we do have quite a few more tickets scheduled for R2 Beta 3 milestone, but most of those represent various addons, rather than modifications to Qubes core software.

So what are those brave changes that are to happen in Release 3? That I will write about in a separate blog post... Stay tuned!

So, please enjoy this latest Qubes R2 beta release, and be sure to send all your questions and comments, as well as the HCL info, to the qubes-devel mailing list. I have already upgraded my primary laptop to this release a few days ago and everything seems to be working fine, so fear not!
\ No newline at end of file diff --git a/_posts/2013-03-21-introducing-qubes-odyssey-framework.html b/_posts/2013-03-21-introducing-qubes-odyssey-framework.html deleted file mode 100644 index 1203949..0000000 --- a/_posts/2013-03-21-introducing-qubes-odyssey-framework.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Introducing Qubes Odyssey Framework -date: '2013-03-21T17:47:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:26:11.508+01:00' -thumbnail: http://3.bp.blogspot.com/-x0nnYdPBMWY/UUsxEwJCxhI/AAAAAAAAAKs/_jpzGFGXT4k/s72-c/Qubes+Odyssey+Diagrams+1.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7660168967011899954 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/03/introducing-qubes-odyssey-framework.html ---- - -
Qubes OS is becoming more and more advanced, polished, and user friendly OS.
But Qubes OS, even as advanced as it is now, surely have its limitations. Limitations, that for some users might be difficult to accept, and might discourage them from even trying out the OS. One such limitation is lack of 3D graphics support for applications running in AppVMs. Another one is still-far-from-ideal hardware compatibility – a somehow inherent problem for most (all?) Linux-based systems.
There is also one more “limitation” of Qubes OS, particularly difficult to overcome... Namely that it is a standalone Operating System, not an application that could be installed inside the user's existing OS. While installing a new application that increases system's security is a no-brianer for most people, switching to a new, exotic OS, is quite a different story...
Before I discuss how we plan to address those limitations, let's first make a quick digression about what Qubes reallyis, as many people often get that wrong...
What Qubes IS, and what Qubes IS NOT?
Qubes surely is not Xen! Qubes only usesXen to create isolatedcontainers – security domains (or zones). Qubes also is not a Linux distribution! Sure, we currently use Fedora 18 as the default template for AppVMs, but at the same time we also support Windows VMs. And while we also use Linux as GUI and admin domain, we could really use something different – e.g. Windows as GUI domain.
So, what is Qubes then? Qubes (note how I've suddenly dropped the OS suffix) is several things:
  • The way how to configure, harden, and use the VMM (e.g. Xen) to create isolated security domains, and to minimize overall system TCB.
  • Secure GUI virtualization that provides strong gui isolation, while at the same time, provides also seamless integration of all applications running in different VMs onto one common desktop. Plus a customized GUI environment, including trusted Window Manager that provides unspoofable decorations for the applications' windows.
  • Secure inter-domain communication and services infrastructure with centrally enforced policy engine. Plus some “core” services built on top of this, such as secure file exchange between domains.
  • Various additional services, or “addons”, built on top of Qubes infrastructure, such as Disposable VMs, Split GPG, TorVM, Trusted PDF converter, etc. These are just few examples, as basically the sky is the limit here.
  • Various additional customizations to all the guest OSes that run in various domains: GUI, Admin, ServiceVMs, and AppVMs.
Introducing Qubes HAL: Hypervisor Abstraction Layer
Because Qubes is a bunch of technologies and approaches that are mostly independent from the underlying hypervisor, as discussed above, it's quite natural to consider if we could easily build an abstraction layer to allow the use of different VMMs with Qubes, instead of just Xen? Turns out this is not as difficult as we originally thought, and this is exactly the direction we're taking right now with Qubes Odyssey! To make this possible we're going to use the libvirt project.
So, we might imagine Qubes that is based on Hyper-V or even Virtual Box or VMWare Workstation. In the case of the last two Qubes would no longer be a standalone OS, but rather an “application” that one installs on top of an existing OS, such as Windows. The obvious advantage we're gaining here is improved hardware compatibility, and ease of deployment.
And we can go even further and ask: why not use Windows Native Isolation, i.e. mechanisms such as user account separation, process isolation, and ACLs, to implement domain isolation? In other words why not use Windows OS as a kind of “VMM”? This would further dramatically improve then lightness of the system...
Of course the price we pay for all this is progressively degraded security, as e.g. Virtual Box cannot be a match to Xen in terms of security, both architecturally and implementation-wise, and not to mention the quality of isolation provided by the Windows kernel, which is even less.

 
But on the other hand, it's still better than using “just Windows” which offers essentially only one “zone”, so no domain isolation at all! And if we can get, with minimal effort, most of our Qubes code to work with all those various isolation providers then... why not?
Being able to seamlessly switch between various hypervisors is only part of the story, of course. The remaining part is the support for different OSes used for various Qubes domains. Currently we use Linux, specifically Fedora 18, in our GUI & Admin domain, but there is no fundamental reason why we couldn't use Windows there instead. We discuss this more in-depth in one of the paragraphs below.
The diagram below tries to illustrate the trade-offs between hardware compatibility and ease of deployment vs. security when using different isolation backends with Qubes. Some variants might also offer additional benefits, such as “super-lightness” in terms of CPU and memory resources required, as is the case with Windows Native Isolation.

 
Some example configurations
Let's now discuss two extreme variants of Qubes – one based on the baremetal Xen hypervisor and the other one based on Windows Native Isolation, so a variant from the opposite endof the spectrum (as shown on the illustration above).
The diagram below shows a configuration that uses a decent baremetal hypervisor, such as Xen, with abilities to securely assign devices to untrusted service domains(NetVM, UsbVM). So, this is very similar to the current Qubes OS.

 
Additionally weseeseparate GUI and Admin domains:the GUI domain might perhaps be based on Windows, to provide users with a familiar UI, while the Admin domain, tasked with domain management and policy enforcement,might be based on some minimal Linux distribution.
In the current Qubes OS there is no distinction between a GUI and an Admin domain --both are hosted within one domain called “dom0”. But in some cases there are benefits of separating the GUI domain from the Admin domain. In a corporate scenario, for example, the Admin domain might be accessible only to the IT department and not to the end user. This way the user wouldhave no way of modifying system-wide policies, and e.g. allowing their “work” domain to suddenly talk to the wild open Internet, or to copy workproject files from “work” to “personal” domains(save for the exotic, low-bandwidthcovert channels, such as through CPU cache).
The ability to deprivilege networking and USB stacks by assigning corresponding devices (NICs, and USB controllers) to untrusted, or semi-trused, domains provides great security benefits. This automatically prevents various attacks against the bugs in WiFi stacks or USB stacks.
What is not seen on the diagram, but what is typical for baremetal hypervisors is that they are usually much smaller than hosted hypervisors, implementing less services, and delegating most tasks, such as the infamous I/O emulation to (often)unprivileged VMs.
Let's now look at the other extreme example of using Qubes – the diagram below shows an architecture of a “Qubized” Windows system that uses either a hosted VMM, such as Virtual Box or VMWare Workstation, or even the previously mentioned Windows Native Isolation mechanisms, as an isolation provider for domains.
 

Of course this architecture lacks many benefits discussed above, such as untrusted domains for networking and USB stacks, small hypervisors, etc. But it still can be used to implement multiple security domains, at amuch lower “price”: better hardware compatibility, easier deployment, and in case of Windows Native Isolation – excellent performance.
And it really can be made reasonable, although it might require more effort  than it might seem at first sight. Take Windows Native Isolation – of course just creating different user accounts to represent different domains is not enough, because Windows still doesn't implement true GUI-level isolation. Nor network isolation. So, there is a challenge to do it right, and “right” in this case means to make the isolation as good as the Windows kernel can isolate processes from different users from each other.
Sure, a single kernel exploit destroys this all, but it's still better than “one application can (legally) read all my files” policy that 99% of all desktop OSes out there essentially implement today.
Now, probably the best thing with all this is that once we implement a product based on, say, Qubes for Windows, together with various cool “addons” that will take advantage of the Qubes services infrastructure, and which shall be product-specific, it should then be really easy to upgrade to another VMM, say Hyper-V to boost security. And the users shall not even notice a change in the UI, save for the performance degradation perhaps (well, clearly automatic creation of VMs to handle various users tasks would be more costly on Hyper-V than with Windows Native Isolation, where “VMs” are just... processes).
Qubes building blocks – implementation details
Let's have a look now at the repository layout for the latest Qubes OSsources – every name listed below represents a separate code repository that corresponds to a logical module, or a building block of a Qubes system:
core-admin
core-admin-linux
core-agent-linux
core-agent-windows
core-vchan-xen
desktop-linux-kde
desktop-linux-xfce4
gui-agent-linux
gui-agent-windows
gui-agent-xen-hvm-stubdom
gui-common
gui-daemon
linux-dom0-updates
linux-installer-qubes-os
linux-kernel
linux-template-builder
linux-utils
linux-yum
qubes-app-linux-pdf-converter
qubes-app-linux-split-gpg
qubes-app-linux-tor
qubes-app-thunderbird
qubes-builder
qubes-manager
vmm-xen
vmm-xen-windows-pvdrivers

Because current Qubes R2 still doesn't use HAL layer to support different hypervisors, it can currently be used with only one hypervisor, namely Xen, whose code is provided by the vmm-xenrepository (in an ideal world we would be just using vanilla Xen instead of buildingour own from sources, but in reality we like the ability to build it ourselves, slightly modifying some things).
Once we move towards the Qubes Odyssey architecture (essentially by replacing thehardcoded calls to Xen's management stack, in the core-adminmodule, with libvirt calls), we could then easily switch Xen for other hypervisors, such as Hyper-V or Virtual Box. In case of Hyper-V we would not have access to the sources of the VMM, of course, so would just be using the stock binaries, although we still might want to maintain thevmm-hyperv repository that could contain various hardening scripts and configuration files for this VMM. Or might not. Also, chances are high that we would be just able to use the stock libvirt driversfor Hyper-V or Virtual Box,so no need for creating core-libvirt-hypervor core-libvirt-virtualboxbackends.
What we will need to provide, is ourcustom inter-domaincommunication library for each hypervisor supported.This means we will need to write core-vchan-hypervor core-vchan-virtualbox. Most (all?) VMMs do provide some kind of API for inter-VM communication (or at least VM-host communication), so the main task of such component is to wrap the VMM-custom mechanism with Qubes-standarizedAPI for vchan (and this standardization is one thing we're currently working on). All in all, in most cases this will be asimple task.
If we, on the other hand, wanted to support an “exotic” VMM, such as the previously mentioned Windows Native Isolation, which is not really a true VMM, then we will need to write our own libvirt backend to support is:
core-libvirt-windows
... as well as the corresponding vchan module (which should be especially trivial to write in this case):
core-vchan-windows
Additionally, if we're building a system where the Admin domain is not based on Linux, which would likely be the case if we used Hyper-V, or Virtual Box for Windows, or, especially, Windows Native Isolation, then we should also provide core-admin-windowsmodule, that, among other things, should provide Qubes qrexecimplementation, something that is highly OS-dependent.
As can be seen above, we currently only have core-admin-linux, which is understandable as we currently use Linux in Dom0. But the good news is that we only need to write core-admin-XXXonce for each OS that is to be supported as an Admin domain, asthis code should not be depend on the actual VMM used (thanks to our smart HAL).
Similarly, we also need to assure that our gui-daemoncan run on the OS that is to be used as a GUI domain (again, in most cases GUI domain would be the same as Admin domain, but not always). Here the situation is generally much easier because “with just a few #ifdefs” our current GUIdaemon should compile and run on most OSes, from Linux/Xorg to Windows and Macs (which is the reason we only have one gui-daemonrepository, instead of several gui-daemon-XXX).
Finally we should provide some code that will gather all the components neededfor our specific product and package this all into either an installable ISO, if Qubes is to be a standalone OS, like current Qubes,or into an executable, in case Qubes is to be an “application”. The installer, depending on the product, might do some cool things, such as e.g. take current user system and automatically move it into one of Qubes domains.
To summary, these would be the components needed to build “Qubes for Windows” product:
core-admin
core-admin-windows
core-agent-windows
core-vchan-windows
core-libvirt-windows
desktop-windows
gui-agent-windows
gui-common
gui-daemon
windows-installer-qubes-for-windows
qubes-builder
qubes-manager

Additionally we will likely need a few qubes-app-*modules that would implement some "addons", such as perhaps automatic links and documents opening in specific VMs, e.g.:
qubes-app-windows-mime-handlers
Here, again, the sky's the limit and this is specifically the area where each vendor can go to great lenghts and build killer apps using our Qubes framework.
Now, if we wanted to create "Qubes for Hyper-V" we would need the following components:
core-admin
core-admin-windows
core-agent-linux
core-agent-windows
core-vchan-hyperv
desktop-windows
gui-agent-linux
gui-agent-windows
gui-common
gui-daemon
windows-installer-qubes-hyperv
qubes-app-XXX
qubes-builder
qubes-manager
vmm-hyperv

Here, as an example, I also left optional core-agent-linux and gui-agent-linux components (the same that are to be used with Xen-based Qubes OS) to allow support for also Linux-based VMs – if we can get those “for free”, then why not!
It should be striking how many of those components are the same in both of those two cases – essentially the only differences are made by the use of different vmm-* components and, of course, the different installer
It should be also clear now how this framework now enables seamless upgrades from one product (say Qubes for Windows) to another (say Qubes for Hyper-V).
Licensing
Our business model assumes working with vendors, as opposed to end users, and licensing to them various code modules needed to create products based on Qubes.
All the code that comprises the base foundation needed for creation of any Qubes variant (so core-admin, gui-common, gui-daemon, qubes-builderand qubes-manager) will be kept open source, GPL specifically. Additionally all the code needed for building of Xen-based Qubes OS with Linux-based AppVMs and Linux-based GUI and Admin domains, will continue to be available as open source. This is to ensure Qubes OS R3 that will be based on this framework, can remain fully open source (GPL).
Additionally we plan to double-license this core open source code to vendors who would like to use it in proprietary products and who would not like to be forced, by the GPL license, to share the (modified) sources.
All the other modules, especially those developed to support other VMMs (Hyper-V, Virtual Box, Windows Native Isolation), as well as those to support Windows OS (gui-agent-windows, core-agent-windows, core-admin-windows, etc) will most likely be proprietary and will be available only to vendors who decide to work with us and buy a license.
So, if you want to develop an open source product that uses Qubes framework, then you can freely do that as all the required core components for this will be open sourced. But if you would like to make a proprietary product, then you should buy a license from us. I think this is a pretty fair deal.
Current status and roadmap
We're currently working on two fronts: one is rewriting current Qubes code to support Qubes HAL, while the other one is adding a backend for Windows Native Isolation (which also involves doing things such as GUI isolation right on Windows).
We believe that by implementing two such extreme backends: Xen and Windows Native Isolation we can best show the flexibility of the framework (plus our customer is especially interested in this backend;)
We should be able to publish some code, i.e. the framework together with early Qubes OS R3 that will be based on it, sometime in fall or maybe earlier.
We obviously are determined to further develop Xen-based Qubes OS, because we believe this is the most practically secure OS available today, and we believe such OS should be open source.
Qubes R2 will still be based on the Xen-hardcoded code, because it's close to the final release and we don't want to introduce such drastic changes at this stage. The only thing that Qubes R2 will get in common with Qubes Odyssey is this new source code layout as presented above (but still with hardcoded xl calls and xen-vchan).
So, this is all really exciting and a big thing, let's see if we can change the industry with this :)
Oh, and BTW, some readers might be wondering why the framework was codenamed “Odyssey” -- this is obviously because of the “HAL” which plays a central role here, and which, of course, also brings to mind the famous Kubrick's movie.
\ No newline at end of file diff --git a/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html b/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html deleted file mode 100644 index 0cbeb9d..0000000 --- a/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Qubes OS R3 Alpha preview: Odyssey HAL in action!' -date: '2013-06-21T12:15:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-06-22T10:56:16.820+02:00' -thumbnail: http://3.bp.blogspot.com/--nDYFJy9De8/UcMVFM2mygI/AAAAAAAAALg/EJORWNCQNTI/s72-c/r3a1-konsoles.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-5526599582625415637 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/06/qubes-os-r3-alpha-preview-odyssey-hal.html ---- - -
In a previous postI have outlined a new direction we're aiming with the Qubes project, which is a departure from using a “hardcoded” hypervisor with Qubes (as well as “hardcoded” Linux as Dom0, GUI domain, etc).

Today I'm happy to announce that we've already completed initial porting of the current Qubes OS into this Hypervisor-Abstraction-Layer-based framework. The new version of Qubes, that we call “R3 Alpha” for now, builds fine, installs fine, and even (mostly) works(!), as can be admired on the screenshot below :) It still uses Xen, of course, but this time in a non-hardcoded way, which allows to replace it easily with another hypervisor, as I discuss below.


Our Qubes Odyssey backendneeded to support a specific hypervisor comprises essentially three parts:
  1. A libvirt driver to support a given VMM. In our case we got it (almost) for free, because Xen 4.2 is well supported by libvirt. I wrote “almost” for free, because some patches to libvirt were still needed, mostly to get rid of some unjustified simplifying assumptions, such as that all the backends are always in Dom0, which is not the case for Qubes OS, of course. Some of those patches were accepted into upstream libvirt, some (still) not, so we had to fork libvirt.
  2. A VMM-specific implementation of our vchan – a simple, socket-like, VMM shared memory-based communication stack between the VMs. Again, in case of Xen 4.2 we got that (almost) for free, because Xen 4.2 has now included a libxenvchan component, which is modified (improved and cleaned up) version of our original vchan (written in early Qubes days for older Xen versions) contributed and maintained by Daniel De Graff from the NSA.
  3. Some minor configuration files, e.g. to tell libvirt which hypervisor protocol to use (in our case: xen:///), and VM configuration template files.
Now, if one wanted to switch Xen for some other hypervisor, such as e.g. the KVM, we would need to write a KVM Odyssey backend in a form of providing the above mentioned three elements. Again, libvirt driver we would get for free, configuration files would be trivial to write, and the only task which would require some coding would be the vchan for KVM.

Ok, one thing that is left out (non-HAL'ified) for now, is the xc_map_foreign_pages() Xen-specific function call within our GUI daemon.

Ideally such call could also be handled by the libvirt API, however it's not clear to us whether true zero-copy page access is really supported (and intended). If it is not, we will try to contribute a patch to libvirt to add such functionality, as it is generally useful for many things that involve high-speed inter-VM communication, of which our GUI virtualization is just one example. So, at this moment, one would need to add an ugly #if (BACKEND_VMM == ...) to the code above and use another VMM's function(s), equivalent to the xc_map_foreign_pages() on Xen.

But besides the above, essentially everything else should Just Work (TM). And that's pretty amazing, I think :) While I personally can't immediately see any security benefit of switching from Xen to KVM, it might appeal to some people for other reasons (Performance? Better hardware support?). The point is: this should be now easy to do.

If one wanted to support some Windows-based hypervisor, on the other hand, such as MS Hyper-V, or Virtual Box on top of Windows, then two more things will need to be taken care of:

  1. Our core management stack (the core-admin repository), the core RPC services (mostly the qrexec daemon, currently part of core-admin-linux repo), and the libvirt code (core-libvirt, a forked original libvirt with some custom patches I mentioned above), all would need to build and run fine on Windows. While this is not a big problem for core-admin (it's all python) and core-libvirt (it is supposed to build and run on Windows fine), the qrexec daemon would need to be rewritten with Windows OS in mind. We're currently working on this step, BTW.
  2. The GUI daemon would also need to be ported to run on Windows, instead of on top of X Server. This is somehow orthogonal to the need to get rid of the hardcoded xc_map_foreign_pages() function as mentioned above. This step might be optional, however, if we wanted to use a Linux-based (and so Xorg-based GUI server) as a GUI domain.

Once the above two pieces are made Windows-ready (note how I wrote Windows-ready, and not specific-VMM-ready), we can then use any Windows-based hypervisor we want (i.e. for which we have libvirt driver, and can write vchan).

This is again pretty amazing, because it means we don't need N*M variations of each component (where N is the number of VMMs, and M the number of host/GUI OSes to support) – but only N+M! This is similar to how modern compilers are designed using a language-specific frontends (C, C++, Pascal, C#, etc), and architecture-specific backends (x86, x64, ARM, etc), and an Intermediate Language for internal “grinding”, again achieving this N+M number of needed variants instead of N*M, which otherwise would be just totally impractical.

One other detail I would like to point out, and which is also visible on the screenshot above, is that we also got rid of using the Xen-specific Xenstore infrastructure (a registry-like tree-based infrastructure for inter-VM configuration and status exchange), and we replaced it with our own, vchan-based Qubes DB (core-qubesdb).

One interesting thing about Qubes DB is that it get rids of the (overly complex and unnecessary) permission system that is used by xenstore, and instead uses the most simple approach: each VM has its separate Qubes DB daemon, and so a totally separate configuration/state namespace. This is inline with the rest of the Qubes philosophy, which basically says that: permissions is dead, long live separation!

So, in Qubes OS we just isolate everything by default, unless a user/configuration specifically allows an exception – e.g. no file copy operation between domains is possible, unless the user expresses an explicit consent for it.

Many old-school security people can't imagine a system without permissions, but if wethink about it more, we might get to a conclusion that: 1) permissions are complex and so often difficult to understand and set correctly, 2) require often complex code to parse and make security decisions, and 3) often are absolutely unneeded.

As a practical example of how permissions schemes might sometime trick even (otherwise somehow smart) developersinto making a mistake consider this bug in Qubes we made a long time ago when setting permissions on some xenstore key, which resulted in some information leak (not much of a security problem in general, but still). And just today, Xen.org has published this advisory, that sounds pretty serious, again caused by bad permissions on some xenstore keys. (Yes, we do have updated Xen packages to fix that, of course).

Back to Qubes R3 Alpha, the first successful Qubes based on Odyssey HAL framework. As previously mentioned, we plan to make most of the framework open sourced, specifically all the non-Windows code. However, we're not publishing this Odyssey/R3 code at this moment, mainly for two reasons: 1) we don't want people to immediately start building other backends, such as to support KVM, right at this stage, because we still might want/need to modify some interfaces slightly, e.g. for our vchan, and we don't want to tide our hands now, and 2) the other reason is that we're still in the middle of “Beta” releases for Qubes R2, and we want people to rather focus on testing that, rather stable release, than jumping onto Qubes R3 alpha.

In other news: everybody seems to be genuinely surprised that unencrypted information can be intercepted and analyzed without user consent... Can it be that people will "discover" cryptography now? How many of you use PGP everyday? And how long will it take then to understand that cryptography without secure client devices is useless?
\ No newline at end of file diff --git a/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html b/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html deleted file mode 100644 index bc9a155..0000000 --- a/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts on Intel's upcoming Software Guard Extensions (Part 1) -date: '2013-08-30T14:14:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-08-30T14:14:10.001+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8440793216705036426 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-intels-upcoming-software.html ---- - -
Intel Software Guard Extensions (SGX) might very well be The Next Big Thing coming to our industry, since the introduction of Intel VT-d, VT-x, and TXT technologies in the previous decade. It apparently seem to promise what so far has never been possible – an ability to create a secure enclavewithin a potentially compromised OS. It sounds just too great, so I decided to take a closer look and share some early thoughts on this technology.

Intel SGX – secure enclaves within untrustedworld!

Intel SGX is an upcoming technology, and there is very little public documents about it at the moment. In fact the only public papers and presentations about SGX can be found in the agenda of one security workshop that took place some two months ago. The three papers from Intel engineers presented there provide a reasonably good technical introduction to those new processor extensions.

You might think about SGX as of a next generation of Intel TXT – a technology that has never really took off, and which has had a long history of security problems disclosed by certain team of researchers ;) Intel TXT has also been perhaps the most misunderstood technology from Intel – in fact many people thought about TXT as if it already could provide security enclaves within untrusted OS – this however was not really true (even ignoring for our multiple attacks) and I have spoke and wrote many times about that in the past years.

It's not clear to me when SGX will make it to the CPUs that we could buy in local shops around the corner. I would be assuming we're talking about 3-5 years from now, because the SGX is not even described in the Intel SDM at this moment.

Intel SGX is essentially a new mode of execution on the CPU, a new memory protection semantic, plus a couple of new instructions to manage this all. So, you create an enclave by filling its protected pages with desired code, then you lock it down, measure the code there, and if everything's fine, you ask the processor to start executing the code inside the enclave. Since now on, no entity, including the kernel (ring 0) or hypervisor (ring “-1”), or SMM (ring “-2”) or AMT (ring “-3”), has no right to read nor write the memory pages belonging to the enclave. Simple as that!

Why have we had to wait so long for such technology? Ok, it's not really that simple, because we need some form of attestation or sealing to make sure that the enclave was really loaded with good code.

The cool thing about an SGX enclave is that it can coexist (and so, co-execute) together with other code, such all the untrusted OS code. There is no need to stop or pause the main OS, and boot into a new stub mini-OS, like it was with the TXT (this is what e.g. Flicker tried to do, and which was very clumsy). Additionally, there can be multiple enclaves, mutually untrusted, all executing at the same time.

No more stinkin' TPMs nor BIOSes to trust!

A nice surprise is that SGX infrastructure no longer depends on the TPM to do measurements, sealing and attestation. Instead Intel has a special enclave that essentially emulates the TPM. This is a smart move, and doesn't decrease security in my opinion. It surely makes us now trust only Intel vs. trusting Intel plus some-asian-TPM-vendor. While it might sound like a good idea to spread the trust between two or more vendors, this only really makes sense if the relation between trusting those vendors is expressed as “AND”, while in this case the relation is, unfortunately of “OR” type – if the private EK key gets leaked from the TPM manufacture, we can bypass any remote attestation, and no longer we need any failure on the Intel's side. Similarly, if Intel was to have a backdoor in their processors, this would be just enough to sabotage all our security, even if the TPM manufacture was decent and played fair.

Because of this, it's generally good that SGX allows us to shrink the number of entities we need to trust down to just one: Intel processor (which, these days include the CPUs as well as the memory controller, and, often, also a GPU). Just to remind – today, even with a sophisticated operating system architecture like those we use in Qubes OS, which is designed with decomposition and minimizing trust in mind, we still need to trust the BIOS and the TPM, in addition to the processor.

And, of course, because SGX enclaves memories are protected against any other processor mode's access, so SMM backdoor no longer can compromise our protected code (in contrast to TXT, where SMM can subvert a TXT-loaded hypervisor), nor any other entity, such as the infamous AMT, or malicious GPU, should be able to do that.

So, this is all very good. However...

Secure Input and Output (for Humans)

For any piece of code to be somehow useful, there must be a secure way to interact with it. In case of servers, this could be implemented by e.g. including the SSL endpoint inside the protected enclave. However for most applications that run on a client system, ability to interact with the user via screen and keyboard is a must. So, one of the most important questions is how does Intel SGX secures output to the screen from an SGX enclave, as well as how does it ensure that the input the enclave gets is indeed the input the user intended?

Interestingly, this subject is not very thoroughly discussed in the Intel papers mentioned above. In fact only one paper briefly mentions Intel Protected Audio Video Path (PVAP) technology that apparently could be used to provide secured output to the screen. The paper then references... a consumer FAQ onBlueRay Disc Playback using Intel HD graphics. There is no further technical details and I was also unable to find any technical document from Intel about this technology. Additionally this same paper admits that, as of now, there is no protected inputtechnology available, even on prototype level, although they promise to work on that in the future.

This might not sound very surprising – after all one doesn't need to be a genius to figure out that the main driving force behind this whole SGX thing is the DRM, and specifically protecting Holywwod media against the pirate industry. This would be nothing wrong in itself, assuming, however, the technology could also have some other usages, that could really improve security of the user (in contrast to the security of the media companies).

We shall remember that all the secrets, keys, tokens, and smart-cards, are ultimately to allow the user to access some information. And how does people access information? By viewing in on a computer screen. I know, I know, this so retro, but until we have direct PC-brain interfaces, I'm afraid that's the only way. Without properly securing the graphics output, all the secrets can be ultimately leaked out.

Also, how people command their computers and applications? Well, again using this retro thing called keyboard and mouse (touchpad). However secure our enclave might be, without secured input, the app would not be able to distinguish intended user input from simulated input crafted by malware. Not to mention about such obvious attacks as sniffing of the user input.

Without protected input and output, SGX might be able to stop the malware from stealing the user's private keys for email encryption or issuing bank transactions, yet the malware will still be able to command this super-secured software to e.g. decrypt all the user emails and later steal the screenshots of all the plaintext messages (with a bit of simple programming, the screenshot's could be turned back into nice ASCII text for saving on bandwidth when leaking them out to a server in Hong Kong), or better yet, perhaps just forward them to an email address that the attacker controls (perhaps still encrypted, but using the attackers key).

But, let's ignore for a moment this “little issue” of lack of protected input, and lack of technical documentation on how secure graphics output is really implemented. Surely it is thinkable that protected input and output could be implemented in a number of ways, and so let's hope Intel will do it, and will do right. We should remember here, that whatever mechanism Intel is going to use to secure the graphics and audio output, it surely will be an attractive target of attacks, as there is probably a huge money incentive for such attacks in the film illegal copying business.

Securing mainstream client OSes and why this is not so simple?

As mentioned above, for SGX enclaves to be truly meaningful on client systems we need protected input and output, to and from the secured enclaves. Anyway, lets assume for now that Intel has come up with robust mechanisms to provide these. Let's now consider further, how SGX could be used to turn our current mainstream desktop systems into reasonably secure bastions.

We start with a simple scenario – a dedicated application for viewing of incoming encrypted files, say PDFs, performing their decryption and signature verification., and displaying of the final outcome to the user (via protected graphics path). The application takes care about all the key management too. All this happens, of coruse, inside an SGX enclave(s).

Now, this sounds all attractive and surely could be implemented using the SGX. But what about if we wanted our secure document viewer to become a bit more than just a viewer? What if we wanted a secure version of MS Word or Excel, with its full ability to open complex documents and edit them?

Well it's obviously not enough to just put the proverbial msword.exe into a SGXenclave. It is not, because the msword.exe makes use of million of other things that are provided by the OS and 3rdlibraries, in order to perform all sorts of tasks it is supposed to do. It is not a straightforward decision to draw a line between those parts that are security sensitive and those that are not. Is font parsing security critical? Is drawing proper labels on GUI buttons and menu lists security critical? Is rendering of various objects that are part of the (decrypted) document, such as pictures, security critical? Is spellchecking security critical? Even if the function of some of a subsystem seem not security critical (i.e. not allows to easily leakthe plaintext document out of the enclave), let's not forget that all this 3rdparty code would be interacting very closely with the enclave-contained code. This means the attack surface exposed to all those untrusted 3rdparty modules will be rather huge. And we already know it is rather not possible to write a rendererfor such complex documents as PDFs, DOCs, XLS, etc, without introducing tons of exploitable bugs.And these attack are not coming now from the potentially malicious documents (against thosewe protect, somehow, by parsing only signed document from trusted peers), but are coming from the compromised OS.

Perhaps it would be possible to take Adobe Reader, MS Word, Powerpoint, Excel etc, and just rewrite every of those apps from scratch in a way that they wereproperly decomposed into sensitive parts that execute within SGC enclave(s), and those that are not-sensitive and make use of all the OS-providedfunctionality, and further define clean and simple interfaces between those parts, ensuring the “dirty” code cannot exploit the sensitive code. Somehow attractive, but somehow I don't see this happening anytime soon.

But, perhaps, it would be easier to do something different – just take the whole msword.exe, all the DLLs it depends on, as well as all the OS subsystems it depends on, such as the GUI subsystem, and put all of this into an enclave. This sounds like a more rational approach, and also more secure.

Only notice one thing – we just created... a Virtual Machine with Windows OS inside and the msword.exe that uses this Windows OS.. Sure, it is not a VT-x-based VM, it is an SGX-based VM now, but it is largely the same animal!

Again, we came to the conclusion why the use of VMs is suddenly perceived as such an increase in security (which some people cannot get, claiming that introducing VM-layer only increases complexity) – the use of VMs is profitable because of one of thing: it suddenly packs all the fat libraries- and OS-exposed APIs and subsystems into one security domain, reducing all the interfaces between this code in the VM and the outside world. Reducing of the interfaces between two security domains is ALWAYS desirable.

But our SGX-isolated VMs have one significant advantage over the other VM technologies we got used to in the last decade or so – namely those VMs can now be impenetrable to any other entity outside of the VM. No kernel or hypervisor can peek into its memory. Neither can the SMM, AMT, or even a determined physical attacker with DRAM emulator, because SGX automatically encrypts any data that leave the processor, so everything that is in the DRAM is encrypted and useless to the physical attacker.

This is a significant achievement. Of course SGX, strictly speaking, is not a (full) virtualization technology, it's not going to replace VT-x.. But remember we don't always need full virtualization, like VT-x, often we can use paravirtualization and all we need in that case is a good isolation technology. For examaple, Xen usesparavirtualizationfor Linux-based PV VMs, and usesgood-old ring3/ring0 separation mechanism to implement this, and the level of isolation of such PV domains on Xen is comparable to the isolation of HVMs, which are virtualized using VT-x.

To Be Continued

In the next part of this article, we will look into some interesting unconventional uses of SGX, such as creating malware that cannot be reversed engineered, or TOR nodes or Bitcoin mixers that should be reasonably trusted, even if we don't trust theiroperators. Then we will discuss how SGX might profoundly change the architecture of the future operating systems, and virtualization systems, in a way that we will no longer need to trust (large portions of) their kernels or hypervisors, or system admins (Anti Snowden Protection?) And, of course, how our Qubes OS might embrace this technology in the future.

Finally, we should discuss the important issue of whether this whole SGX, while providing many great benefits for system architects, should really be blindly trusted? What are the chances of Intel building in backdoors there and exposing those to the NSA? Is there any difference in trusting Intel processors today vs. trusting the SGX as a basis of security model of all software in the future?

\ No newline at end of file diff --git a/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html b/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html deleted file mode 100644 index 4cac8be..0000000 --- a/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts on Intel's upcoming Software Guard Extensions (Part 2) -date: '2013-09-23T19:35:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:25:17.519+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7969805790285882812 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-intels-upcoming-software.html ---- - -
In the first part of this article published a few weeks ago, I have discussed the basics of Intel SGX technology, and also discussed challenges with using SGX for securing desktop systems, specifically focusing on the problem of trusted input and output. In this part we will look at some other aspects of Intel SGX, and we will start with a discussion of how it could be used to create a truly irreversible software.

SGX Blackboxing – Apps and malware that cannot be reverse engineered?

A nice feature of Intel SGX is that the processor automatically encrypts the content of SGX-protected memory pages whenever it leaves the processor caches and is stored in DRAM. In other words the code and data used by SGX enclaves never leave the processor in plaintext.

This feature, no doubt influenced by the DRM industry, might profoundly change our approach as to who controls our computers really. This is because it will now be easy to create an application, or malware for that matter, that just cannot be reversed engineered in any way. No more IDA, no more debuggers, not even kernel debuggers, could reveal the actual intentions of the EXE file we're about to run.

Consider the following scenario, where a user downloads an executable, say blackpill.exe, which in fact logically consists of three parts:

  1. A 1st stage loader (SGX loader) which is unencrypted, and which task is to setup an SGX enclave, copy the rest of the code there, specifically the 2nd stage loader, and then start executing the 2nd stage loader...
  2. The 2nd stage loader, which starts executing within the enclave, performs remote attestation with an external server and, in case the remote attestation completes successfully, obtains a secret key from the remote server. This code is also delivered in plaintext too.
  3. Finally the encrypted blob which can only be decrypted using the key obtained by the 2nd stage loader from the remote server, and which contains the actual logic of the application (or malware).

We can easily see that there is no way for the user to figure out what the code from the encrypted blob is going to do on her computer. This is because the key will be released by the remote server only if the 2ndstage loader can prove via remote attestation that it indeed executes within a protect SGX enclave and that it is the original unmodified loader code that the application's author created. Should one bit of this loader be modified, or should it be attempted to run outside of an SGX enclave, or within a somehow misconfigured SGX enclave, then the remote attestation wouldfail and the key will not be obtained.

And once the key is obtained, it is available only within the SGX enclave. It cannot be found in DRAM or on the memory bus, even if the user had access to expensive DRAM emulators or bus sniffers. And the key cannot also be mishandled by the code that runs in the SGX enclave, because remote attestation also proved that the loader code has not been modified, and the author wrote the loader specifically not to mishandle the key in any way (e.g. not to write it out somewhere to unprotected memory, or store on the disk). Now, the loader uses the key to decrypt the payload, and this decrypted payload remains within secure enclave, never leaving it, just like the key. It's data never leaves the enclave either...

One little catch is how the key is actually sent to the SGX-protected enclave so that it could not be spoofed in the middle? Of course it must be encrypted, but to which key? Well, we can have our 2ndstage loader generate a new key pair and send the public key to the remote server – the server will then use this public key to send the actual decryption key encrypted with this loader's public key. This is almost good, except for the fact that this scheme is not immune to a classic main in the middle attack. The solution to this is easy, though – if I understand correctly the description of the new Quoting and Sealing operations performed by the Quoting Enclave – we can include the generated public key hash as part of the data that will be signed and put into the Quote message, so the remote sever can be assured also that the public key originates from the actual code running in the SGX enclave and not from Mallory somewhere in the middle.

So, what does the application really do? Does it do exactly what has been advertised by its author? Or does it also “accidentally” sniffs some system memory or even reads out disk sectors and sends the gathered data to a remote server, encrypted, of course? We cannot know this. And that's quite worrying, I think.

One might say that we do accept all the proprietary software blindly anyway – after all who fires up IDA to review MS Office before use? Or MS Windows? Or any other application? Probably very few people indeed. But the point is: this could be done, and actually some brave souls do that. This could be done even if the author used some advanced form of obfuscation. Can be done, even if taking lots of time. Now, with Intel SGX it suddenly cannot be done anymore. That's quite a revolution, complete change of the rules. We're no longer masters of our little universe – the computer system – and now somebody else is.

Unless there was a way for “Certified Antivirus companies” to get around SGX protection.... (see below for more discussion on this).

...And some good applications of SGX

The SGX blackboxing has, however, some good usages too, beyond protecting the Hollywood productions, and making malware un-analyzable...

One particularly attractive possibility is the “trusted cloud” where VMs offered to users could not be eavesdropped or tampered by the cloud provider admins. I wrote about such possibility two years ago, but with Intel SGX this could be done much, much better. This will, of course, require a specially written hypervisor which would be setting up SGX containers for each of the VM, and then the VM could authenticate to the user and prove, via remote attestation, that it is executing inside a protected and properly set SGX enclave. Note how this time we do not require the hypervisor to authenticate to the users – we just don't care, if our code correctly attests that it is in a correct SGX, it's all fine.

Suddenly Google could no longer collect and process your calendar, email, documents, and medial records! Or how about a tor node that could prove to users that it is not backdoored by its own admin and does not keep a log of how connections were routed? Or a safe bitcoin web-based wallet? It's hard to overestimate how good such a technology might be for bringing privacy to the wide society of users...

Assuming, of course, there was no backdoor for the NSA to get around the SGX protection and ruin this all goodness...(see below for more discussion on this).

New OS and VMM architectures

In the paragraph above I mentioned that we will need specially written hypervisors (VMMs) that will be making use of SGX in order to protect the user's VMs against themselves (i.e. against the hypervisor). We could go further and put other components of a VMM into protected SGX enclaves, things that we currently, in Qubes OS, keep in separate Service VMs, such as networking stacks, USB stacks, etc. Remember that Intel SGX provides convenient mechanism to build inter-enclave secure communication channels.

We could also take the “GUI domain” (currently this is just Dom0 in Qubes OS) and move it into a separate SGX enclave. If only Intel came up with solid protected input and output technologies that would work well with SGX, then this would suddenly make whole lots of sense (unlike currently where it is very challenging). What we win this way is that no longer a bug in the hypervisor should be critical, as it would be now a long way for the attacker who compromised the hypervisor to steal any real secret of the user, because there are no secrets in the hypervisor itself.

In this setup the two most critical enclaves are: 1) the GUI enclave, of course, and 2) the admin enclave, although it is thinkable that the latter could be made reasonably deprivileged in that it might only be allowed to create/remove VMs, setup networking and other policies for them, but no longer be able to read and write memory of the VMs (Anti Snowden Protection, ASP?).

And... why use hypervisors? Why not use the same approach to compartmentalize ordinary operating systems? Well, this could be done, of course, but it would require considerable rewrite of the systems, essentially turning them into microkernels (except for the fact that the microkernel would no longer need to be trusted), as well as the applications and drivers, and we know that this will never happen. Again, let me repeat one more time: the whole point of using virtualization for security is that it wraps up all the huge APIs of an ordinary OS, like Win32 or POSIX, or OSX, into a virtual machine that itself requires orders of magnitude simpler interface to/from the outside world (especially true for paravirtualized VMs), and all this without the need to rewrite the applications.

Trusting Intel – Next Generation of Backdooring?

We have seen that SGX offers a number of attractive functionality that could potentially make our digital systems more secure and 3rdparty servers more trusted. But does it really?

The obvious question, especially in the light of recent revelations about NSA backdooring everything and the kitchen sink, is whether Intel will have backdoors allowing “privileged entities” to bypass SGX protections?

Traditional CPU backdooring

Of course they could, no question about it. But one can say that Intel (as well as AMD) might have been having backdoors in their processors for a long time, not necessarily in anything related to SGX, TPM, TXT, AMT, etc. Intel could have built backdoors into simple MOV or ADD instructions, in such a way that they would automatically disable ring/page protections whenever executed with some magic arguments. I wrote more about this many years ago.

The problem with those “traditional” backdoors is that Intel (or a certain agency) could be caught using it, and this might have catastrophic consequences for Intel. Just imagine somebody discovered (during a forensic analysis of an incident) that doing:

MOV eax, $deadbeef
MOV ebx, $babecafe
ADD eax, ebx

...causes ring elevation for the next 1000 cycles. All the processors affected would suddenly became equivalents of the old 8086 and would have to be replaced. Quite a marketing nightmare I think, no?

Next-generation CPU backdooring

But as more and more crypto and security mechanisms got delegated from software to the processor, the more likely it becomes for Intel (or AMD) to insert really “plausibly deniable” backdoors into processors.

Consider e.g. the recent paper on how to plant a backdoor into the Intel's Ivy Bridge's random number generator (usable via the new RDRAND instruction). The backdoor reduces the actual entropy of the generator making it feasible to later brute-force any crypto which uses keys generated via the weakened generator. The paper goes into great lengths describing how this backdoor could be injected by a malicious foundry (e.g. one in China), behind the Intel's back, which is achieved by implementing the backdoor entirely below the HDL level. The paper takes a “classic” view on the threat model with Good Americans (Intel engineers) and the Bad Chinese (foundry operators/employees). Nevertheless, it should be obvious that Intel could have planted such a backdoor without any effort or challenge described in the paper, because they could do so at any level, not necessarily below HDL.

But backdooring an RNG is still something that leaves traces. Even though the backdoored processor can apparently pass all external “randomness” testes, such as the NIST testsuite, they still might be caught. Perhaps because somebody will buy 1000 processors and will run them for a year and will note down all the numbers generated and then conclude that the distribution is quite not right. Or something like that. Or perhaps because somebody will reverse-engineer the processor and specifically the RNG circuitry and notice some gates are shorted to GND. Or perhaps because somebody at this “Bad Chinese” foundry will notice that.

Let's now get back to Intel SGX -- what is the actual Root of Trust for this technology? Of course, the processor, just like for the old ring3/ring0 separation. But for SGX there is additional Root of Trust which is used for remote attestation, and this is the private key(s) used for signing the Quote Messages.

If the signing private key somehow got into the hands of an adversary, the remote attestation breaks down completely. Suddenly the “SGX Blackboxed” apps and malware can readily be decrypted, disassembled and reverse engineered, because the adversary can now emulate their execution step by step under a debugger and still pass the remote attestation. We might say this is good, as we don't want irreversible malware and apps. But then, suddenly, we also loose our attractive “trusted cloud” too – now there is nothing that could stop the adversary, who has the private signing key, to run our trusted VM outside of SGX, yet still reporting to us that it is SGX-protected. And so, while we believe that our trusted VM should be trusted and unsniffable, and while we devote all our deepest secrets to it, the adversary can read them all like on a plate.

And the worst thing is – even if somebody took such a processor, disassembled it into pieces, analyzed transitor-by-transitor, recreated HDL, analyzed it all, then still it all would look good. Because the backdoor is... the leaked private key that is now also in the hands of the adversary, and there is no way to prove it by looking at the processor alone.

As I understand, the whole idea of having a separate TPM chip, was exactly to make such backdoor-by-leaking-keys more difficult, because, while we're all forced to use Intel or AMD processors today, it is possible that e.g. every country can produce their own TPM, as it's million times less complex than a modern processor. So, perhaps Russia could use their own TPMs, which they might be reasonably sure they use private keys which have not be handed over to the NSA.

However, as I mentioned in the first part of this article, sadly, this scheme doesn't work that well. The processor can still cheat the external TPM module. For example, in case of an Intel TXT and TPM – the processor can produce incorrect PCR values in response to certain trigger – in that case it no longer matters that the TPM is trusted and keys not leaked, because the TPM will sign wrong values. On the other hand we go back now to using “traditional” backdoors in the processors, whose main disadvantage is that people might got cought using them (e.g. somebody analyzed an exploit which turns out to be triggering correct Quote message despite incorrect PCRs).

So, perhaps, the idea of separate TPM actually does make some sense after all?

What about just accidental bugs in Intel products?

Conspiracy theories aside, what about accidental bugs? What are the chances of SGX being really foolproof, at least against those unlucky adversaries who didn't get access to the private signing keys? The Intel's processor have become quite a complex beasts these days. And if you also thrown in the Memory Controller Hub, it's unimaginably complex beast.

Let's take a quick tour back discussing some spectacular attacks against Intel “hardware” security mechanisms. I wrote “hardware” in quotation marks, because really most of these technologies is software, like most of the things in electronics these days. Nevertheless the “hardware enforced security” does have a special appeal to lots of people, often creating an impression that these must be some ultimate unbreakable technologies....

I think it all started with our exploit against Intel Q35 chipset (slides 15+) demonstrated back in 2008 which was the first attack allowing to compromise, otherwise hardware-protected, SMM memory on Intel platforms (some other attacks against SMM shown before assumed the SMM was not protected, which was the case on many older platforms).

This was then shortly followed by another paper from us about attacking Intel Trusted Execution Technology (TXT), which found out and exploited a fact that TXT-loaded code was not protected against code running in the SMM mode. We used our previous attack on Q35 against SMM, as well as found a couple of new ones, in order to compromise SMM, plant a backdoor there, and then compromise TXT-loaded code from there. The issue highlighted in the paper has never really been correctly patched. Intel has spent years developing something they called STM, which was supposed to be a thin hypervisor for SMM code sandboxing. I don't know if the Intel STM specification has eventually been made public, and how many bugs it might be introducing on systems using it, or how much inaccurate it might be.

In the following years we presented two more devastating attacks against Intel TXT (none of which depending on compromised SMM): onewhich exploited a subtle bug in the processor SINIT module allowing to misconfigure VT-d protections for TXT-loaded code, and another one exploiting a classic buffer overflow bug also in the processor's SINIT module, allowing this time not only to fully bypass TXT, but also fully bypass Intel Launch Control Policy and hijack SMM (several years after our original papers on attacking SMM the old bugs got patched and so this was also attractive as yet another way to compromise SMM for whatever other reason).

Invisible Things Lab has also presented first, and as far as I'm aware still the only one, attack on Intel BIOS that allowed to reflash the BIOS despite Intel's strong “hardware” protection mechanism to allow only digitally signed code to be flashed. We also found outabout secret processor in the chipset used for execution of Intel AMT code and we found a way to inject our custom code into this special AMT environment and have it executed in parallel with the main system, unconstrained by any other entity.

This is quite a list of Intel significant security failures, which I think gives something to think about. At the very least that just because something is “hardware enforced” or “hardware protected” doesn't mean it is foolproof against software exploits. Because, it should be clearly said, all our exploits mentioned above were pure software attacks.

But, to be fair, we have never been able to break Intel core memory protection (ring separation, page protection) or Intel VT-x. Rafal Wojtczuk has probably came closest with his SYSRET attackin an attempt to break the ring separation, but ultimately the Intel's excuse was that the problem was on the side of the OS developers who didn't notice subtle differences in the behavior of SYSRET between AMD and Intel processors, and didn't make their kernel code defensive enough against Intel processor's odd behavior.

We have also demonstrated rather impressive attacks bypassing Intel VT-d, but, again, to be fair, we should mention that the attacks were possible only on those platforms which Intel didn't equip with so called Interrupt Remapping hardware, and that Intel knew that such hardware was indeed needed and was planning it a few years before our attacks were published.

So, is Intel SGX gonna be as insecure as Intel TXT, or as secure as Intel VT-x....?

The bottom line

Intel SGX promises some incredible functionality – to create protected execution environments (called enclaves) within untrusted (compromised) Operating System. However, for SGX to be of any use on a client OS, it is important that we also have technologies to implement trusted output and input from/to the SGX enclave. Intel currently provides little details about the former and openly admits it doesn't have the later.

Still, even without trusted input and output technologies, SGX might be very useful in bringing trust to the cloud, by allowing users to create trusted VMs inside untrusted provider infrastructure. However, at the same time, it could allow to create applications and malware that could not be reversed engineered. It's quote ironic that those two applications (trusted cloud and irreversible malware) are mutually bound together, so that if one wanted to add a backdoor to allow A/V industry to be able to analyze SGX-protected malware, then this very same backdoor could be used to weaken the guarantees of the trustworthiness of the user VMs in the cloud.

Finally, a problem that is hard to ignore today, in the post-Snowden world, is the ease of backdooring this technology by Intel itself. In fact Intel doesn't need to add anything to their processors – all they need to do is to give away the private signing keys used by SGX for remote attestation. This makes for a perfectly deniable backdoor – nobody could catch Intel on this, even if the processor was analyzed transistor-by-transistor, HDL line-by-line.

As a system architect I would love to have Intel SGX, and I would love to believe it is secure. It would allow to further decompose Qubes OS, specifically get rid of the hypervisor from the TCB, and probably even more.

Special thanks to Oded Horowitz for turning my attention towards Intel SGX.
\ No newline at end of file diff --git a/_posts/2013-11-26-windows-7-seamless-gui-integration.html b/_posts/2013-11-26-windows-7-seamless-gui-integration.html deleted file mode 100644 index 3ba119b..0000000 --- a/_posts/2013-11-26-windows-7-seamless-gui-integration.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Windows 7 seamless GUI integration coming to Qubes OS! -date: '2013-11-26T18:04:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:25:04.398+01:00' -thumbnail: http://1.bp.blogspot.com/-PJN1_VDD1NQ/UpTN4lE_xdI/AAAAAAAAAME/KmnnAnNmMGo/s72-c/windows-seamless-1.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-3852916224574976224 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/11/windows-7-seamless-gui-integration.html ---- - -
Finally, after months of hard work, seamless mode for Windows 7 AppVMs is coming to Qubes OS! The new Windows Support Tools will be released together with the Qubes OS R2 Beta 3, which we plan to release in the next 1-2 weeks. Here is an obligatory screenshot showing a few Windows apps running in seamless mode integrated onto Qubes trusted desktop (note the usual Qubes trusted decorations around each of the Win7 windows):



The seamless mode for Windows AppVMs is not yet as polishedas the one we have for Linux AppVMs, because, unlike what we do for Xorg, the Windows GUI agent is not based on composition buffers extraction. This causes some, ratherminor, cosmetic problems. For example, when we have two overlapping windows from a Win7 AppVM, and move the top window away, its remaining "shadow" will be visible on the underlying window for the duration of the operation. But generally this all works reasonably good, and you should not really feel any slowness or heaviness compared to Linux AppVMs virtualization. It should be noted that we managed to add this seamless support for Windows AppVMs without any changes to our secure GUI virtualization protocol.

Of course, the usual Qubes integration features, such as secure inter-VM clipboard and file copy also work for Windows AppVMs with the tools installed.

The Qubes Windows Support Tools are proprietary, but they are supposed to be installed only in the Windows 7 VMs, which themselves contain millions of lines of proprietary code already. Besides that, the tools do not introduce any other modifications to the system.

As a special bonus we have also added (and releasing also in R2B3) the support for template-based HVMs. So it will now be possible to do something like this:


qvm-create --hvm work-win7 --template win7-x64 --label green
qvm-create --hvm personal-win7 --template win7-x64 --label purple
qvm-create--hvm testing-win7 --template win7-x64 --label red


... tellingQubes to createthree HVM AppVMs based on the same template.

All such template-based AppVMs use the root filesystem from the Template VM, which is shared in a read-only manner, of course, but Qubes makes it look for the AppVMs as if the root filesystem was writable.Just like in case of Linux AppVMs, the actual writes are stored in COW buffersbacked by files stored in each of the AppVMs directories. Upon AppVM's reboot, thosefilesarediscarded, which reverts the VMs' root filesystems back to that of the template (the “golden image”).

For the above mechanism to make any sense we should configure the OS in the Template VMto usea separate disk for the user's home directory(ies) (e.g. C:\Users in case of Windows). Qubes automatically exposes an additional private disk to each of the AppVMs exactly for this very purpose. Again, just like it has been done for Linux AppVMs for years.

The above feature allows to create lots of Windows AppVMs quickly and with minimal use of disk space, and with an ability to centrally update all the system software in all the AppVMs all at once. Just like for Linux AppVMs.

Users should, however, ensure that their license allows for such instantiating of the OS they use in the template. Note that from the technical point of view the OS is installed, and, in case of Windows, also activated, only once: in the template VM. The installed files are never copied, they are only shared with the running instances of AppVMs. Consult your software licensing lawyer.
\ No newline at end of file diff --git a/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html b/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html deleted file mode 100644 index 07064dd..0000000 --- a/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes R2 Beta 3 has been released! -date: '2013-12-11T00:14:00.000+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:51.677+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3957611366610637891 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/12/qubes-r2-beta-3-has-been-released.html ---- - -
Today we're releasing Qubes R2 Beta 3, one of the latest milestones on our roadmap for Qubes R2. Even though it is still called a “beta”, most users should install it, because, we believe, it is the most polished and stable Qubes edition. Looking back, I think it was a mistake to use this alpha/beta/rc nomenclature to mark Qubes releases, and so, starting with Qubes R3 we will be just using version numbers: 3.0, 3.1, etc.

Anyway, back to the R2 Beta 3 – below I discuss some of the highlights of the today's release:
  • The seamless GUI virtualization for Windows 7-based AppVMs, and support for HVM-based templates (e.g. Windows-based templates) is one of the most spectacular feature of this release, I think. It has already been discussed in an earlier blog post, and now instructions have also been added to the wiki for how to install and use such Windows AppVMs.

  • We've also introduced a much more advanced infrastructure for system backups, so it is now possible to make and restore backups to/from untrusted VMs, which allows e.g. to backup easily the whole system to a NAS, or just to an USB device, not worrying that somebody might exploit the NAS client over the network, or that plugging of the USB disk with malformed partition table or filesystem might compromise the system. The whole point here is that the VM that handles the backup storage (and which might be directing it to a NAS, or somewhere) might be compromised, and it still cannot do anything that could compromise (or even DoS) the system, neither can it sniff the data in the backup. I will write more about the challenges we had to solve and how we did it in a separate blog post. I'm very proud to note that majority of the implementation for this has been contributed by the community, specifically Oliver Medoc. Thanks!
  • A very simple feature, trivial almost, yet very important from the security point of view – it is now possible to set 'autostart' property on select VMs. Why is this so important for security? Because I can create e.g. UsbVM, assign all my USB controllers to it, and then once I set it as autostarting, I can have assurance that all my USB controllers will be delegated to such AppVM immediately upon each system boot. Having such a UsbVM is a very good idea, if one is afraid of physical attacks coming though USB devices. And it now could double as a BackupVM with this new backup system mentioned above!
  • To improve hardware compatibility we now ship the installer with multiple kernel versions (3.7, 3.9, and 3.11) allowing to run the installation using any of those, e.g. if it turned out that one kernel doesn't support the graphics card correctly -- a typical problem many users faced in the past. All the kernels are also installed in the final system, allowing the user to easily boot with a select Dom0 kernel later, choosing the one which supports their hardware best.

  • Another popular problem of the past now was the lack of support for dynamically changing resolution/screen layout in the AppVMs when a seccond monitor or a projector was hot-plugged in (which changed only the resolution layout in Dom0). Now this problem has been solved and the new monitor layout is dynamically propagated to the AppVMs, allowing to use all the screen real estate by the apps running there.
  • There has also been a significant amount of cleanups and fixes. This includes the unification of paths and command names (“The Underscore Revolution” as we call it), as well as refactoring of all the source code components (which now closely matches what we have on Qubes Odyssey/R3), and lots of various bugfixes.
We're planning one more release (Qubes R2 RC1) before the final R2, which will bring improvements mostly in the area of more polished UI, such as allowing some of the tasks that currently require commandline to be done from the Qubes Manager. So, this would mostly be a minor cosmetic upgrade, plus bugfixes. And probably we will also upgrade the default Linux template to Fedora 20.

Installation and upgrade instructions can be found here.
\ No newline at end of file diff --git a/_posts/2014-01-16-shattering-myths-of-windows-security.html b/_posts/2014-01-16-shattering-myths-of-windows-security.html deleted file mode 100644 index df39fe7..0000000 --- a/_posts/2014-01-16-shattering-myths-of-windows-security.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Shattering the myths of Windows security -date: '2014-01-16T00:32:00.000+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:38.464+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-366066024465255660 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/01/shattering-myths-of-windows-security.html ---- - -When I originally described the flexible Qubes Odyssey framework several months ago, I mentioned that we would even consider to use “Windows Native Isolation” mechanisms as a primitive type of isolation provider (“hypervisor”) for some basic edition of Qubes for Windows. The idea has been very attractive indeed, because with minimal effort we could allow people to install and run such Qubes WNI on their normal, consumer Windows laptops.

Sure, the inter-process isolation provided by a monolithic kernel such as Windows or Linux could never be compared to the inter-VM isolation offered even by the most lousy hypervisors. This is simply because the sizes of the interfaces exposed to untrusted entities (processes in case of a monolithic kernel; VMs in case of a hypervisor) are just incomparable. Just think about all those Windows system calls and GDI calls which any process can call and which contains probably thousands of bugs still waiting to be discovered by some kid with IDA. And think about those tens of thousands of drivers, which also expose (often unsecured) IOCTLs, as well as parsing the incoming packets, USB devices infos, filesystem metadata, etc. And then think about various additional services exposed by system processes, which are not part of the kernel, but which are still trusted and privileged. And now think about the typical interface that needs to be exposed to a typical VM: it's “just” the virtualized CPU, some emulated devices (some old-fashined Pentium-era chipset, SVGA graphics adapter, etc) and virtualized memory.

Anyway, knowing all this, I still believed that Qubes WNI would make a whole lot of sense. This is because Qubes WNI would still offer a significant boost over the “Just Windows” default security, which is (still) essentially equivalent to the MS-DOS security model.  And this is a real pity, because Windows OS has long implemented very sophisticated security mechanisms, such as complex ACLs applicable to nearly any object, as well as recent mechanisms such as UIPI/UAC, etc. So, why not use all those sophisticated security to bring some real-world security to Windows desktops!

And, best of all, once people start using Qubes WNI, and they liked it, they could then pretty seamlessly upgrade to Xen-based Qubes OS, or perhaps Hyper-V-based Qubes OS (when we implement it) and their system would look and behave very similarly. Albeit with orders of magnitude stronger security. Finally, if we could get our Odyssey Framework to be flexible enough to support both Qubes WNI, as well as Xen-based Qubes OS, we should then be able to support any hypervisor or other isolation mechanism in the future.

And so we decided to build the Qubes WNI. Lots of work we invested in building Qubes WNI was actually WNI-independent, because it e.g. covered adjusting the core Odyssey framework to be more flexible (after all “WNI” is quite a non-standard hypervisor) as well as some components that were Windows-specific, but not WNI-specific (e.g. could very well be used on Hyper-V based Qubes OS in the future). But we also invested lots of time into evaluating all those Windows security mechanisms in order to achieve our specific goals (e.g. proper GUI isolation, networking isolation, kernel object spaces isolation, etc)...

Sadly this all has turned out to be a story without a happy end, as we have finally came to the conclusion that consumer Windows OS, with all those one-would-think sophisticated security mechanisms, is just not usable for any real-world domain isolation.

And today we publish a technical paper about our findings on Windows security model and mechanisms and why we concluded they are inadequate in practice. The paper has been written by Rafał Wojdyła who joined ITL a few months ago with the main task of implementing Qubes WNI. I think most people will be able to learn a thing or two about Windows security model by reading this paper.

Also, we still do have this little hope that somebody will read the paper and then write to us: “Oh, you're guys so dumb, you could just use this and that mechanism, to solve all your problems with WNI!” :)

The paper can be downloaded from here. \ No newline at end of file diff --git a/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html b/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html deleted file mode 100644 index 0b86483..0000000 --- a/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes OS R2 rc1 has been released! -date: '2014-04-20T20:40:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:27.320+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7571053820604404319 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/04/qubes-os-r2-rc1-has-been-released.html ---- - -Today we're releasing Qubes OS R2 rc1 (release candidate), which is expected to be the last milestone before the final Qubes OS R2 release. As mentioned previously today's release is bringing mainly UI improvements and polishing and lots of bugfixes, as well as some last new features: 
  • Both Dom0 and VMs have been upgraded to Fedora 20.
  • Support for full templates download via two new repo definitions: templates-itl and templates-community. With a bit of imagination we could call it Qubes “AppStore” for VMs :) Currently we have only published one template there – the new default fc20-based template, but we plan to upload more templates in the coming weeks (such as the community-produced Arch Linux and Debian templates). Even though we have a separate repo for community contributed templates, we still plan on building those templates ourselves, from (contributed) sources.
  • Support for running Windows AppVMs in “full desktop” mode with support for arbitrary window resizing (which automatically adjusts the resolution in the VMs).
  • Support for on-the-fly switching between the “full desktop” and “seamless” modes for Windows AppVMs.
The last two features require, of course, our proprietary Qubes Windows Tools to be installed in the Windows AppVMs to work, which new version we have also published to the new repositories for R2rc1.

We support smooth upgrading for current Qubes R2 Beta 3 users – the procedure is very simple, yet it will take some hours because of the Dom0 distro upgrading.

As can be seen in our ticketing system, there really are only few minor cosmetic tasks left before the final Qubes R2 release. It is expected that upgrade from today's release to the final R2 will be very simple and quick – just standard updates installation.

As usual, the detailed installation and upgrade instructions, as well as the HCL, can be found here. Note however, that the HCL for the today's release will take some days/weeks to compile, as we need to wait for reports from the community, and so for this time the HCL for the previous release (R2 Beta 3) should be used instead. It is reasonable to expect that the new HCL will be a subset of the previous one.

Also, as usual, please keep in mind that we don't control the servers from which the ISO is being served and so please always make sure to verify the digital signature on the downloaded ISO before installing it.

Please direct all the technical questions or comments regarding Qubes OS to our mailing lists.

Enjoy!

\ No newline at end of file diff --git a/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html b/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html deleted file mode 100644 index 639bd53..0000000 --- a/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Qubes OS R2 rc2, Debian template, SSLed Wiki, BadUSB, and more... -date: '2014-08-06T13:02:00.000+02:00' -author: Joanna Rutkowska -tags: -- os security -- usb -- qubes -modified_time: '2014-11-27T13:24:15.997+01:00' -thumbnail: http://1.bp.blogspot.com/-FZ0wECOfuPs/U-FSwDST6UI/AAAAAAAAAO0/kJUqXKYkqlU/s72-c/qubes-logo-blue.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7667743056108682405 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/08/qubes-os-r2-rc2-debian-template-ssled.html ---- - -Today we're release the second release candidate (rc2) for Qubes OS R2. There are currently no more open tickets for the final R2 release, and we hope that what we release today is stable enough and so will be identical, or nearly identical, to the final R2 ISO, which we plan to release after the summer holidays. Download and installation instructions are here.

After Qubes rc1 release a few months ago we have been hit by a number of problems related to unreliable VM start-ups. The most prevalent problem has been traced down to an upstream bug in systemd, which just happened to be manifesting on Qubes OS due to specific conditions imposed by our startup scripts.

Actually, it has not been the first time when some things related to VM bootup or initialization didn't work quite well on Qubes, a side effect of heavy optimizations and stripping down we do in order to make the VMs as light weight as possible. E.g. we don't start most of the Desktop Environment which otherwise is assumed to be running by various desktop-related applications and services. In most cases these are really NOTOURBUG kind of problems, yet we just happen to be unlucky they manifest on Qubes. We do need more help from the community with testing, debugging and patching such NOTOURBUG problems in the upstream. The more people use Qubes OS, the higher the chances such problems will be addressed much quicker. Ideally, in the future, we could partner with a Linux distro that would include Qubes AppVM as one of the test cases.

Speaking of different Linux distros --  we have also recently built and released an experimental (“beta”) Debian template for Qubes AppVMs, a popular request expressed by our users for quite some time. It can be readily installed with just one command, as described in the wiki. It is supposed to behave as a first class Qubes AppVM with all the Qubes signature VM integration features, such as seamless GUI virtualization, secure clipboard, secure file copy, and other integration, all working out of the box. Special thanks to our community contributors for providing most of the patches required for porting of our agents and other scripts to Debian. This template is currently provided via our templates-community repo, but it nevertheless has been built and signed by ITL, and is also configured to fetch updates (for Qubes tools) from our server, but we look forward for somebody from the community to take over from us the maintenance (building, testing) of the updates for this template.

Also in our "Templates Appstore" you can find now an experimental “minimal” fedora-based template, which might be used by more advanced users to build customized special-purpose VMs and templates.

We have also moved our Wiki server to a bigger EC2 instance so it could better handle the increased traffic and also added a real CA-signed SSL certificate! But I encourage people to read why this is mostly irrelevant from the security standpoint and why they should still be checking signatures on the ISOs.

We also got a new logo (actually we never really had our own logo before). This also means Qubes now got its own distinct set of themes for installer, plymouth and, of course, a bunch of cool wallpapers with Qubes logo nicely engraved on them. However, it turned out that convincing KDE to set our wallpaper as a default one exceeds the collective mental abilities of ITL, and so one needs to right-click on the desktop and choose one of the Qubes-branded wallpapers manually after install or upgrade.

Every once in a while people (re-)discover that monolithic kernel-based desktop operating systems are not the best solution whenever the user even remotely cares about security...

Yes, USB inherent insecurity, as well as widespread GUI insecurity, or networking stack insecurity, trivial physical insecurities, or sick permissions model as used in most desktop systems, have all been known facts for years. The recognition of these problems has been the primary motivator for us to start the work on Qubes OS back in 2009/2010.

And yes, Qubes running on an appropriate hardware (specifically with Intel VT-d) can solve most of these problems. Correction: Qubes OS can allow the user or administrator to solve these problems, as unfortunately this still requires some configuration decisions made by the human operator. So today Qubes R2 is like a sports manual transmission, which requires a bit of skill to get most out of it. In the near future I see no reason why we should not be offering the "automatic 8-speed transmission" edition of Qubes OS. We just need more time to get there. The R3 release (Odyssey-based), whose early code is planned to be released just after the "final" R2, so sometime in September, is all about bringing us closer to that "automatic transmission" version.

With my 10+ years of experience as a system-level security researcher, I believe there is no other way to go. Don't get deluded that safe languages or formally verified microkernels could solve these problems. Security by Isolation, done sensibly, is the only way to go (of course it doesn't preclude making use of some formally verified components, like e.g. microkernel in place of Xen, at least in some editions of Qubes).

Finally one more announcement for today: after writing this blog for 8 years, I've suddenly felt like I might need to try also some new form of expression... And so, for a few days, I now have a twitter account (@rootkovska), which I hope to use for updates on Qubes, as well as more general commentary on various things happening in IT security.

\ No newline at end of file diff --git a/_posts/2014-08-26-physical-separation-vs-software.html b/_posts/2014-08-26-physical-separation-vs-software.html deleted file mode 100644 index 2ef9f24..0000000 --- a/_posts/2014-08-26-physical-separation-vs-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Physical separation vs. Software compartmentalization -date: '2014-08-26T19:15:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-08-26T19:15:58.669+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2261156925386470515 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/08/physical-separation-vs-software.html ---- - -Many people believe the Holy Grail of secure isolation is to use two or more physically separate machines. This belief seems so natural, that we often don't give it much thought. After all, what better isolation could we possible get than physical "airgap"?

I argue with this point of view in this new paper.

I think a good place for in-depth technical discussions around the topics discussed in the paper would be our qubes-devel mailing list. \ No newline at end of file diff --git a/_posts/2014-09-26-announcing-qubes-os-release-2.html b/_posts/2014-09-26-announcing-qubes-os-release-2.html deleted file mode 100644 index 66415f8..0000000 --- a/_posts/2014-09-26-announcing-qubes-os-release-2.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Announcing Qubes OS Release 2! -date: '2014-09-26T20:28:00.000+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2014-11-27T13:23:40.232+01:00' -thumbnail: http://3.bp.blogspot.com/-0yOLNM-YXqs/VCWk3PrvYgI/AAAAAAAAAPE/AnXQpgxmjLY/s72-c/qubes-logo-blue.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-4366442760226795341 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/09/announcing-qubes-os-release-2.html ---- - -
Today we're releasing Qubes OS R2! I'm not gonna write about all the cool features in this release because you can find all this in our wiki and previous announcements (R2-beta1, R2-beta2, R2-beta3, R2-rc1, and R2-rc2). Suffice to say that we've come a long way over those 4+ years from a primitive proof of concept to a powerful desktop OS which, I believe, it is today.

One of the biggest difficulties we have been facing with Qubes since the very beginning, has been the amount of this extra, not-so-exciting, not directly security-related work, but so much needed to ensure things actually work. Yet, the line between what is, and what is not-security related, is sometimes very thin and one can easily cross it if not being careful.

It's great that we're receiving more and more community contributions. This includes not only bug fixes, but also invaluable efforts related to documentation, HCL maintenance, as well as some really non-trivial new features (advanced backups support, Debian and Arch templates, TorVM, Whonix port, etc). Thanks!

I'm also happy to announce that Caspar Bowden, a well known privacy advocate, expert on EU data protection law, member of the board of Tor, former Microsoft Chief Privacy Adviser, etc, will be taking a role as Qubes Policy Adviser, helping us to make Qubes OS more suitable for a wider audience of people interested in privacy, and be liaising  with other projects that would like to build privacy services with Qubes as a base.

And there is still a lot in front of us. Using the obligatory car analogy, I would say Qubes OS is currently like a racing car that just went into production as a road vehicle: one hell of an engine under-the-hood, and powerful new technologies until now unavailable even for professional use, yet lacking leather interior with 12-speaker audio system, and still with a manual transmission... This is just the beginning for making security by isolation on the desktop as "driveable" as a [insert your fav make of German fine cars] :)

Exciting stuff is coming next: the Release 3 (“Odyssey”) and more, stay tuned!

Thanks to everyone who has made Qubes OS possible, as well as all the upstream projects without which we would probably never even try this journey: Xen, Linux, Xorg, and many others!


\ No newline at end of file diff --git a/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html b/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html deleted file mode 100644 index e673088..0000000 --- a/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Qubes R3/Odyssey initial source code release -date: '2014-11-27T14:57:00.001+01:00' -author: Joanna Rutkowska -tags: -- qubes -- r3 -- odyssey -modified_time: '2014-11-27T14:57:55.459+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2049939853263374613 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/11/qubes-r3odyssey-initial-source-code.html ---- - -Back in 2013 we've started the work on generalizing Qubes architecture, which we code-named “Odyssey”, to allow for use of multiple hypervisors instead of just Xen via Hypervisor Abstraction Layer (“HAL” -> “Space Odyssey”, get it? ;). The concept has been described in this post, which I recommend to re-read if you're more interested in understanding our goals.

We have been wandering here and there since that time. Lots of work has been invested in the light-weight Qubes edition for Windows, which, sadly, turned out to be a failure.

We have also done a lot of work in the meantime to polish Qubes R2 and bring it to the state of the final release, which happened earlier this fall.

We have also been heavily researching possibilities of other cool projects based on this flexible new architecture. Some of which you might hear about in the coming months, others turned out to be dead ends.

Today we're finally releasing the Qubes R3 source code to the public. The code builds fine (see here for building instruction), produces install-able ISO, and, if that was not enough, even seems to be working, mostly fine, when installed :)

However, we don't recommend users to switch to it, and we intend this release for developers only, specifically those who would like to start working towards porting of other hypervisors, or other containerization technologies, like LXC, to Qubes R3. I highly recommend these devlopers to discuss what they try to achieve on the qubes-devel mailing list, before they start the actual coding.

Currently the only implemented and supported backend is Xen, of course, specifically the Xen 4.4, currently the latest version. It should be now trivial to switch to future versions as they become available, although, a decision to rush with that might not be such a no-brainer from the security point of view. We should remember that the hypervisor, unlike Linux kernel, is not someting you would like to change every month or so. Ideally we should aim for having a stable version of Xen for desktops that would work for years without needing any updates.

But use of other hypervisors might open up lots of interesting possibilities: imagine e.g. Qubes Live USB edition that has backends for 1) Xen, 2) KVM, and 3) LXC, and choose automatically the most secure one which is still supported on the given laptop.

Major features of the current release, compared to Qubes R2:
  • Hypervisor Abstraction Layer for all the core management stack (but still missing for the GUI daemon, see below)
  • New implementation of vchan and qrexec. As you might know our original vchan has been rewritten and improved (better performance and flexibility) and included in the upstream Xen starting from v4.2. Now we're switching to this upstream libvchan. Also, qrexec has been slightly rewritten to utilize some new features of this libvchan, which results in much better performance for inter-VM traffic (like a few orders of magnitude better!) Especially important for things such as USB virtualization that we're testing right now (not to be confused with USB controller pass-though).
There is still some work going on which we would like to complete before we officially decide to release Qubes OS 3.0-rc1 ISO, and this includes:
  • Rewrite of some internal code for the core management stack, which includes internal API of the python classes. This should mostly be of no interest to users, and even most developers working on Qubes.
Further down the road (Qubes OS 3.1) we plan to work on some really exciting things:
  • More flexibility to qrexec policy (more on that in a separate post)
  • More flexibility to Qubes Admin API (expose it to slelect other VMs)
  • Split of Dom0 into (semi-depriviliged) GUI domain and minimal Admin domain. This would be great opportunity to also add the missing HAL support for the GUI daemon.
One of the immediate application of these features above would be to introduce support for remote management of Qubes installations, an absolutely necessary feature for corporate adoption of Qubes.

Also note how all these tasks are independent of the actual hypervisor support, meaning it's perfectly possible for other developers to work on porting other hypervisors to Qubes in the meantime.

The possibilities seems to be endless now. Join us and help us with The Revolution! :)

\ No newline at end of file diff --git a/_posts/2015-02-09-my-new-git-based-blog.md b/_posts/2015-02-09-my-new-git-based-blog.md deleted file mode 100644 index 3d3b295..0000000 --- a/_posts/2015-02-09-my-new-git-based-blog.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -layout: post -title: My New Git-based Blog -author: Joanna Rutkowska ---- - -After using Google Blogger for nearly 9 years to [host my -blog](http://theinvisiblethings.blogspot.com/), I decided to migrate to a -Git-based blog. My blog is now primarily [hosted on -GitHub](https://github.com/rootkovska/rootkovska.github.io) using [GitHub -Pages](https://pages.github.com/) for ease of viewing via a Web browser. I -shall stress, however, the blog is Git-based, not necessarily GitHub-based! - -This move offers several important advantages: - -1. Independence on the underlying hosting company -2. Flexibility of distribution -3. Integrity protection -4. Easily accessible edits history - -The statement about independence on hosting might sound a bit surprising, -because one could point out that I still depend on GitHub to host my blog repo. -However, this is really just a technicality. I might trivially (via `git push`) -move to another Git hosting platform, shall there be any problems with GitHub -(e.g. censorship). - -While the use of [Markdown](http://en.wikipedia.org/wiki/Markdown) and -[Jekyll](http://jekyllrb.com/), which is natively used by GitHub Pages to -render nicely looking static HTML, makes this repo somehow GitHub-specific, -special care has been taken to make all the content human readable even without -Jekyll pre-processing and when viewed using standard plaintext editors. - -Moreover, it's not just *me* who can move this blog to some other hosting -platform, but this could be *anybody*, thanks to the ease of Git repo cloning -(irrelevant whether through GitHub web interface or just using `git -clone`/`pull` manually). This, combined with integrity protection discussed -below, allows anybody to create mirrors offering this blog to different groups -of people, without losing ability to prove its authenticity, which no longer -needs to be implied by DNS record ownership. - -Somebody [suggested](https://twitter.com/_ta0/status/562632421305507840) -recently that I should be distributing my blog as a bunch of text files over a -Tor Hidden service. Of course I don't have time and enough incentive to do that -myself. However, thanks to git-based nature of this blog, it is easy for -somebody else to setup a script that would be regularly pull'ing my blog, -verifying authenticity, and then e.g. publishing it as a Tor Hidden Service. - -Or somebody might not like the blog is served over plaintext HTTP connections -when accessible via the blog.invisiblethings.org DNS (which sadly is a -[limitation](https://konklone.com/post/github-pages-now-sorta-supports-https-so-use-it) -of GitHub pages) and might want to setup own server with proper SSL certificate -to serve it. Again, no problem, and there is no action required on my side! -That's the beauty of maintaining this as an easily clone-able git repo. - -And, no, realistically, I don't think I am, or this blog is, that important or -controversial, that the US or other government, or whoever, will likely want to -block, censor or tamper with it in any way. This is more about principles. -About the feeling that even if They wanted, they could not. It's a nice -feeling. - - -Integrity protection of this blog ----------------------------------- - -End-to-end integrity protection of any distributed information (code, -documents, etc) is an extremely important aspect in the digital world, -unfortunately way too often ignored by the industry today. - -End-to-end integrity protection (as well as end-to-end encryption) is the only -solution that allows to keep the infrastructure (servers, admins, networks) out -of the trust base. Sadly most of the Internet and its services have been -designed with the assumption that integrity and confidentiality is to be -provided by the infrastructure (e.g. via SSL, VPNs, etc). Such approach -necessarily puts individuals, who often are not able to fully control the -infrastructure, out of control with regards to who they trust. Lots of problems -arises from lack of end-to-end integrity and confidentiality guarantees. - -This blog is integrity protected. The integrity protection utilizes Git signed -tags on the underlying repo commits. These are signed with by [Blog Signing -Key](/keys/). - -It's worth noting, however, for the record, that the 2006-2014 posts have been -automatically downloaded from my Google Blogger account and have been included -in this repo as HTML files (as generated by [Jekyll -Importer](http://import.jekyllrb.com/docs/blogger/)) without a thorough manual -inspection after the conversion. My Git tags still cover them, of course. - - -Distribution, Hosting, Notifications -------------------------------------- - -This blog is now available for traditional Web-based viewing via the following URL: - -* http://blog.invisiblethings.org/ - -One can get notifications about new posts/updates via: - -* The blog's [RSS feed](/feed.xml) -* [My Twitter Account](https://twitter.com/rootkovska/) -* [My GitHub Account] (https://github.com/rootkovska/) - - -The source of this repo is currently available via my GitHub account -[here](https://github.com/rootkovska/rootkovska.github.io) - - diff --git a/_posts/2015-04-23-qubes-30rc1-and-roadmap.md b/_posts/2015-04-23-qubes-30rc1-and-roadmap.md deleted file mode 100644 index 2f73bfb..0000000 --- a/_posts/2015-04-23-qubes-30rc1-and-roadmap.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -layout: post -title: Qubes 3.0-rc1 ISO and roadmap for 2015 -author: Joanna Rutkowska ---- - -A lot of important news today. - -Finally, we're releasing the first installable ISO for Qubes 3.0, the Release -Candidate 1 (3.0-rc1)! - -Compared to Qubes R2, which we -[released](http://blog.invisiblethings.org/2014/09/26/announcing-qubes-os-release-2.html) -last year, Qubes OS 3.0 brings major improvements in two distinct areas: - -* It implements the new hypervisor-abstracted architecture (which we call: - [HAL](http://blog.invisiblethings.org/2013/03/21/introducing-qubes-odyssey-framework.html)), - and introduces a load of new features: Xen 4.4, [new - qrexec](https://www.qubes-os.org/doc/Qrexec3Implementation/), and brings lots - of new VM templates with full Qubes integration: Debian 7 and 8, Whonix 9, and - [many more](https://www.qubes-os.org/doc/Templates/). - -* It also provides important modifications and improvements to our build system. - -Let me spend a while discussing these build system improvements now, as these -are quite important for the future of the project, I think: - -As Qubes is becoming more popular, and we get more contributions from the -community, the obvious problem we're starting to face is how to verify all the -contributions in terms of them being both of proper quality (i.e. not -introducing bugs to the system), as well as being non-malicious (i.e. not -introducing backdoors or compromising developer's systems). - -Another problem we're facing is how to avoid potential targeted attacks on us -when we're building Qubes binaries, such as ISOs or updates. E.g. we trust -Fedora and Debian Projects to produce un-backdoored (but not necessarily -flawless!) RPM and DEB binary packages, which we subsequently use to build Qubes -templates and Dom0/installation images. I believe it is reasonable for us to -make such a trust decision, because these projects are widespread and if they -decided to publish (and sign) backdoored binaries, they would be risking getting -caught red-handed. However, given Qubes extreme focus on security and its -attractiveness for various "interesting targets", it's absolutely thinkable that -an adversary, who somehow got access to Fedora or Debian projects binary singing -keys, might be able to target the Qubes developers who are responsible for -building the ISOs and/or the updates, and provide them with backdoored packages, -still correctly signed by the distro key. - -Finally, there is a problem of trusting us, the Qubes developers, that we really -are not malicious and produce and distribute un-backdoored binaries and ISOs, -matching indeed the source code we publish. Or that our build systems/VMs are -not compromised. Or that our singing keys are not stolen (e.g. through EM leaks). - -We believe we can address most of these concerns with the following mechanisms: - -1. By making Qubes building process more defensive, better sandboxed, so that it - is safe for the builder (i.e. preventing the building system's compromises). - This especially applies to building Qubes templates. - -2. By making the build process difficult to target. E.g. to be fed with - backdoored Fedora or Debian packages, even if they were correctly signed with - (a stolen) distro signing key. - -3. By making the templates distribution/installation mechanisms more defensive. - So that even if the user decided to install a 3rd-party-provided template, - that turned out to be malicious, that this would not affect other parts of - the user's Qubes system. - -4. By distributing the "trust base" for Qubes binary packages and ISOs using a - multi-signature signing scheme in which the Qubes Updater checks whether each - downloaded binary update package has at least M signatures made by one of the - N trusted, pre-selected parties. This, of course, requires deterministic - builds. - -We have already implemented #1 (sandboxed builds) by introducing support for -building templates in Disposable VMs (see -[here](https://github.com/QubesOS/qubes-builder/blob/master/doc/TemplateDispVMBuild.md) -for details). This will now allow to maintain separate repos for different -templates (Fedora, Debian, Whonix, etc.) with different people responsible for -each, and without the need to trust all of them (or carefully look at their -hands!). - -We have also implemented #2 from the list above by using TorVM as a default -netvm for all the VMs used for the 3.0 rc1 ISO build (as per #1 there are now -more than one involved). As an alternative/additional way to prevent developer -targeted attacks, we have considered to implement a variation of a scheme -[proposed by](https://www.whonix.org/wiki/Verifiable_Builds) Patrick Schleizer -of Whonix, but modified in such a way that our builder produces a list of hashes -of all the downloaded components used for the build (rpm/deb packages, tgz -sources, etc.), but ultimately didn't implement it due to other things getting -higher priorities (but still would welcome patches to enable such functionality). - -Finally, we have also made quite some progress in implementing #3 from the list -above. This was done by simplifying the template packaging (i.e. getting rid of -all the auxiliary files, such as icon or appmenus, that we can create later, -using the trusted code). This way it is now possible for a user, who is about to -install a potentially untrusted, community-contributed template package in Dom0, -to verify it won't compromise the system (by simply reviewing its metadata and -simple install scripts). In the near future we plan on moving to a better -packaging for the templates (and also unify them with VM backups packaging, and -make these also more suitable for VM migration/sharing) and to automate this -process even more, so that all the template packages were ultimately treated as -untrusted by default, always, without any user action required. - -The #4 would be most challenging to get, as currently most projects, including -all Linux distributions, do not build deterministically (i.e. various people -building from the same source code are getting different binaries). -Deterministic builds are, of course, a pre-requisite for this multi signature -scheme for use on ISOs and updates. However, all the work we have made to -sandbox the build process for (untrusted) components, such as the templates, is -also crucial here, as we want to make it safe for many parties to be able to -build Qubes and provide hashes for the binaries independently. - -Speaking of our plans, the diagram below shows the roadmap for the rest of the -year for Qubes 3.x and beyond (click -[here](https://raw.githubusercontent.com/rootkovska/rootkovska.github.io/master/resources/roadmap-2015-apr.png) -for a full size image): - -![Qubes Roadmap for 2015]({{ site.url }}/resources/roadmap-2015-apr.png) - -The major new feature coming in the next release (Qubes 3.1) is the management -and pre-configuration infrastructure. This is gonna be a basis for both remote -management (e.g. for corporate Qubes editions) and also for preparing customized -Qubes editions/configurations for specific users/use cases. More on this -important topic in an upcoming article. - -We have also invested a lot of work into what we call "core3", our next -generation Qubes management stack, mostly rewritten from scratch by Wojtek -Porczyk and Marek Marczykowski-Górecki. We have originally planned to base Qubes -3.0 on this new core3 stack, but the changes turned out to be too intrusive and -we decided to release Qubes 3.0 using the previous core2 (which is essentially a -Marek's rewrite of the original core I did for Qubes R1, and which we used -throughout Qubes R2), and delay the introduction of core3 until... Qubes 4.0, -planned sometime at the end of the year). In the meantime 3.1, and 3.2 releases -will bring additional features on top of the 3.0 we're releasing today, such as -the management and preconfiguration support mentioned above. - -We now also have a [qubes-roadmap](https://github.com/rootkovska/qubes-roadmap) -repo which tracks the high-level release roadmap for 3.x and 4.x, and the -diagram above was generated out of this repo. We're also planning to introduce -qubes-architecture repo with a collection of current documents about Qubes OS -architecture, both implemented, as well as planned for upcoming releases. Stay -tuned! - -Speaking of releases and roadmap, it's worth mentioning we have decided to -slightly change the release cycle for Qubes. The new scheme is modeled after the -Linux Kernel release cycle. More on this can be read -[here](http://www.qubes-os.org/doc/VersionScheme/). - -One important improvement that hasn't been illustrated in the roadmap diagram is -the introduction of many automatic tests into our build system. We hope that in -the near future this will result in Qubes 3.x releases reaching production -quality much quicker than the earlier R1s and R2s did. - -Finally, as many of you has undoubtedly seen, over the last weeks we have -decided to migrate our servers infrastructure out of our private servers (hosted -at AWS) to public services: GitHub.com and SF.net. This is part of a larger plan -to decentralize our project (see above), as well as provide better integrity -protection for some additional resources, such as the documentation (the Trac -wiki we used previously could not provide any form of integrity protection, -which we can now achieve thanks to git signed tags). This is for similar reasons -I decided to move my blog to git/GitHub.com (See my [previous -post](http://blog.invisiblethings.org/2015/02/09/my-new-git-based-blog.html) for -more explanations). - -The new Qubes 3.0 ISO can be downloaded from -[here](https://www.qubes-os.org/doc/QubesDownloads/). This is the first official -Qubes OS ISO built and signed by Marek Marczykowski-Górecki, instead of by -myself. As I have recently been involved in a New Project, I decided to hand off -the signing keys for Qubes Release 2 and 3 to Marek. Everybody who has been -following Qubes development in the recent years know Marek very well, I'm sure, -and realize he has been the lead developer of Qubes OS for a while now. For the -record, I still plan on playing a role of Qubes long-term architect/milestones -planner. And I also still keep the Qubes Master Key ;) diff --git a/_posts/2015-06-04-otf-funding-announcement.md b/_posts/2015-06-04-otf-funding-announcement.md deleted file mode 100644 index 96e88d2..0000000 --- a/_posts/2015-06-04-otf-funding-announcement.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -layout: post -title: Qubes OS Project gets OTF funding to integrate Whonix, improve usability -author: Joanna Rutkowska ---- - -It's my pleasure to announce that Qubes OS Project has got funding from the -[Open Technology Fund](https://www.opentechfund.org/), and this way joined a -number of other high-profile, open-source -[projects](https://www.opentechfund.org/projects), such as the Tor Project, or -Open Whisper Systems, who also have received substantial funding from the OTF -lately. - -OTF does not provide generic funding to projects, but rather sponsors -development of a set of specific features. In our case, OTF agreed to support -the efforts of porting [Whonix](https://www.whonix.org/) (which is a -compartmentalization-aware alternative to -[Tails](https://www.accessnow.org/about/staff)) to Qubes OS, as well as some -more generic work needed to make Qubes OS more usable, both in the context of -hardware compatibility and better UX. - -Lots of this work has started many months ago, in fact, as many of you might -have noticed. Majority of the Whonix and Qubes integration has then been -performed by Jason Mehring, a well known Qubes community contributor. This work, -of course, would not be possible, if not for Patrick Schleizer, who founded and -has been maintaining Whonix, in the first place. We thus decided to split the -funding among Jason, Patrick and the ITL (to account for the open source work -done by Marek Marczykowski-Górecki and Wojtek Porczyk on core Qubes components). - -The funding we got is pretty modest to be frank: it's $160,000 USD with the -intention to cover a year of development by, essentially, 3-4 skilled developers -working full time, and some even more than full time ;) Even by open source -standards this is very symbolic, as other projects, such as e.g. the Tor -Project, -[pay](https://www.torproject.org/about/findoc/2013-TorProject-Form990.pdf) not -not much less than this amount to _each_ of their core developers. And this is -understandable -- after all nobody wants crappy-paid developers to work on -software onto which people sometimes virtually entrust their lives. But that's -just the first step, and it's still important because it shows how Qubes is -going more mainstream now :) - -This funding is to cover the development efforts carried between October 2014 -and September 2015 (we have submitted our original proposal back in September -2014). Of course, a large part of this time period has already passed and the -development efforts during that time have been either (1) graciously donated by -the above mentioned developers, (2) partly funded by ITL, and/or (3) funded by -other means (i.e. donations to Whonix project). Now the above mentioned $160k -amount will be partly paied directly to the developers mentioned above as a -(partial) compensation for their work, and partly to ITL as a reimbursement of -the costs it carried while supporting this work over the past months. - -Critics might say that these are the US Government money we're taking, and this -might negatively impact credibility of the project... Well, it surely is true -these are the US Government money indeed. The OTF makes this perfectly clear on -their [own website](https://www.opentechfund.org/about/program). Shall we then -really worry about it? Shall our users worry? - -I don't think so, and here is why: - -1. Being funded by US Government does not necessarily imply maliciousness. - Occasionally the USG funds something meaningful, such as e.g. NASA or DARPA. - -2. Almost always there is _somebody_ (often powerful and of doubtful ethics) - behind any larger money... Somehow most people are not concerned about how - ITL managed to keep Qubes development over the last 5 years... Whose money - have these been, really? And those who think donations or some form of - crowdfunding could sustain a project like Qubes are advised to look into the - total amount of [Bitcoins we have - accumulated](https://blockexplorer.com/address/14zockMSKKp5MK6X2cHJ3mQwm9MwYsJ39j) - from donations over the course of nearly 2 years (yes, that's around $800, - for which we could probably afford to pay for... 1-2 days of work a skilled - system developer ;) - -3. Last but not least: we have been trying to keep Qubes development process as - transparent and infrastructure-independent as technically possible with the - goal of reducing the amount of trust our users needs to put into... us. This - includes, e.g. introduction of our [qubes-secpack repo with - canaries](https://github.com/QubesOS/qubes-secpack), the build process - improvements I wrote more about in [the previous - post](http://blog.invisiblethings.org/2015/04/23/qubes-30rc1-and-roadmap.html), - and also [recently - discussed](https://groups.google.com/d/msg/qubes-devel/BSz1c8Te7B8/A2UBFh_siTMJ) - on the mailing list. - -In other words: the mere introduction of US government-originating money does -not change much in terms of how trusted the Qubes OS project should be, in my -opinion. Admittedly, the binary distribution process currently remains the -weakest link here (because it's possible our signing keys could be stolen -somehow, or that one of us could be bribed or tortured or blackmailed to give -them away) and this is the case regardless of whether we signed a contract with -the OTF or not. Currently the only way to eliminate this weakness is to build -everything from sources, which actually is quite nicely supported by our -automatic Qubes builder system. - -In the future, when deterministic builds become reality, the multi-signature -scheme on binaries would become possible, reducing the problem of -single-point-of-failure with regards of binaries build and distribution process. - -Those who still felt uncomfortable about Qubes getting this kind of funding from -the USG are always welcomed to help us on getting other sources. There is, of -course, nothing that could prevent us from receiving funding from other -organizations at the same time. - -Finally, I would like to end this post by giving a big Thank You to a person who -is directly responsible for making this OTF funding contract a reality: Michael -Carbone. Michael approached me with the idea of submitting a proposal to OTF for -Qubes and Whonix integration back in mid-2014 and offered help with preparation -of the submission and managing of the overall process. Michael's dayjob is at -[Access](https://www.accessnow.org/about/staff), where he helps civil society -and human rights organizations around the world defend themselves against cyber -threats. Naturally this makes Qubes, especially Qubes with Whonix, an attractive -tool for him and his partners. For the conspiracy theorists: yes, Michael used -to work for the US Department of State as he clearly notes in his biographical -note linked above. He also studied in China ;) - -You can also read the annoucement by the Whonix Project -[here](https://www.whonix.org/blog/host-and-sponsorship-by-otf). diff --git a/_posts/2015-07-10-caspar.md b/_posts/2015-08-19-HelloWorld.md similarity index 100% rename from _posts/2015-07-10-caspar.md rename to _posts/2015-08-19-HelloWorld.md From ccc9f124181d8465d1b93e7ce7b768375ad9bd60 Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Wed, 19 Aug 2015 22:56:55 +0700 Subject: [PATCH 004/135] remove CNAME --- CNAME => CNAME.old | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename CNAME => CNAME.old (100%) diff --git a/CNAME b/CNAME.old similarity index 100% rename from CNAME rename to CNAME.old From c4380cfc0d879c941d16cc80be740b9c756b7d9c Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Wed, 19 Aug 2015 22:58:00 +0700 Subject: [PATCH 005/135] remove cname --- CNAME.old | 1 - 1 file changed, 1 deletion(-) delete mode 100644 CNAME.old diff --git a/CNAME.old b/CNAME.old deleted file mode 100644 index 9bf2c2c..0000000 --- a/CNAME.old +++ /dev/null @@ -1 +0,0 @@ -mfp19.meganetwork.org From 3a3816583709b5086765aa94eee955617802e588 Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Thu, 20 Aug 2015 01:23:14 +0700 Subject: [PATCH 006/135] changing ID --- _config.yml | 4 +- about.md | 35 +----------- contact.md | 63 +++++++++++---------- keys.md | 82 ++++++++++++++------------- keys/joanna-blog-key.asc | 39 ------------- keys/joanna-email-itl.asc | 64 --------------------- keys/joanna-master-key.asc | 28 ---------- keys/qubes-master-key.asc | 28 ---------- keys/qubes-sec-team-email-key.asc | 73 ------------------------ papers.md | 53 +++--------------- resources/caspar.jpg | Bin 748511 -> 0 bytes resources/joanna.jpg | Bin 248522 -> 0 bytes resources/roadmap-2015-apr.png | Bin 186274 -> 0 bytes speaking.md | 90 ++++++++++++++---------------- 14 files changed, 130 insertions(+), 429 deletions(-) delete mode 100644 keys/joanna-blog-key.asc delete mode 100644 keys/joanna-email-itl.asc delete mode 100644 keys/joanna-master-key.asc delete mode 100644 keys/qubes-master-key.asc delete mode 100644 keys/qubes-sec-team-email-key.asc delete mode 100644 resources/caspar.jpg delete mode 100644 resources/joanna.jpg delete mode 100644 resources/roadmap-2015-apr.png diff --git a/_config.yml b/_config.yml index 9da3cca..0354d82 100644 --- a/_config.yml +++ b/_config.yml @@ -1,6 +1,6 @@ # Site settings -title: The Invisible Things -url: "http://blog.invisiblethings.org" +title: mfp19 +url: "http://mfp19.github.io" # Build settings markdown: redcarpet diff --git a/about.md b/about.md index 49c7e9c..a401b23 100644 --- a/about.md +++ b/about.md @@ -4,38 +4,5 @@ title: About Me permalink: /about/ --- - + -My name is Joanna Rutkowska (pronounced: _root-kov-ska_). I've been -contributing to several fields of computer security engineering over the past -10+ years. Chances are quite high you might have come across some of my -[projects or work](/papers/). These include: my work on desktop systems -security, especially the work on [Qubes OS](https://qubes-os.org/), my work on -virtualization (in)security, and other hardware-enforced security mechanisms, -such as Intel vPro technologies, their vulnerabilities, as well as how they -could be used to build more secure systems. Before that, my primary focus was -on kernel-mode rootkits and stealth malware (e.g. Blue Pill), including both -offensive as well as defensive research. - -On a more personal note: - -I strongly believe that freedom of individuals is the most important value. -This implies e.g. ability for individuals to make choices as to whom they want -to entrust with various aspects of their lives. - -I'm a human, although I can greatly separate emotions from work. This means I -can appreciate ideas and work of people who I might be otherwise despising as -human beings. Ideas, science and technology have no morality. It's annoying so -many people don't seem to understand that. - -I'm comfortable and happy being a woman, although I do realize the absurd of -the rigid classification of human beings into two simple subsets: males and -females, and always surprised how deeply this influences people. - -I'm also a feminist. I wish there were more women in science and technology. I -also wish more women had more self confidence. At the same time [I'm -concerned](https://twitter.com/rootkovska/status/530109601254223872) about -superficial promotion of females just because they are females... - -I've been lucky to be born and to live in a civilized part of the world, in a -big capital city in Europe: [Warsaw](https://vimeo.com/86112812). diff --git a/contact.md b/contact.md index b132e20..5ec6e6b 100644 --- a/contact.md +++ b/contact.md @@ -9,8 +9,15 @@ Email I can be contacted via email using the following addresses: -* `joanna@invisiblethingslab.com` for ITL- and Qubes-related matters -* `joanna@invisiblethings.org` for other matters +* `mfp19@` for IT matters. +* `mfp19@` for Weed&Beer matters. +* `mfp19@` for other matters. + +Note: I've spent 20 of my 35 years advocating for bugs free IT tools and privacy. +After being investigated 3 times, and stalked, and ruined, I had to give up +my personal mail server and create my fake identity (see 'Public conversations'). +As a result I don't have an email address. +I'm Defective by Design. Note on confidentiality ------------------------ @@ -19,10 +26,10 @@ Please note that, as most other people and organizations, I use a 3rd party Mail Service Provider. The stuff who work at the provider is (technically-wise) able to read all my incoming and outgoing mail. This is by definition of how email infrastructure work, and it is irrelevant whether SSL or other encryption -is used between email clients and corresponding email servers. If you have -something confidential, please use PGP/GPG encryption to secure our -communication (see [keys.md](/keys/) for info how to obtain and verify my GPG -keys). +is used between email clients and corresponding email servers. +Please use PGP/GPG encryption to secure our communication (see [keys.md](/keys/) +for info how to obtain and verify my GPG keys), whether or not you have +something to hide. Note on integrity of my emails ------------------------------- @@ -30,8 +37,7 @@ Note on integrity of my emails All email sent by me from the above-mentioned email addresses should be digitally signed with my email [keys](/keys/). -A notable exception is Qubes and other mailing lists hosted on Google Groups -- -recently Google has implemented logic that rewrites parts of the messages by +A notable exception are mailing lists. Some majordomos rewrite parts of the messages by adding info on how to unsubscribe from a given ML. That, unfortunately, breaks any attached digital signatures to the messages, of course. @@ -44,11 +50,8 @@ email. In some cases, although rarely, I might not read through the whole message. Please understand that I would also like to have life outside of my email VM... -* Please do not write to me personally asking questions about Qubes OS -- -instead, please write to one of [our mailing -lists](https://wiki.qubes-os.org/wiki/QubesLists). - -* I can only read email in English or Polish. +* I can only read email in English, Italian, Spanish, French and ... well ... +Thai, but it takes me 1 day to translate 1 page, please don't :) * Please don't write asking me for advise about how to become a "hacker", or "security researcher". @@ -65,25 +68,23 @@ Phone, Skype, etc. I don't believe phone (or similar means of communication) are that great for technical discussions. My experience shows that phone-based conversations lack technical depth, and are prone to misunderstandings, especially pronounced when -talking over VoIP connection across the Atlantic. Additionally, they require +talking over VoIP connection across the oceans. Additionally, they require fixed time slots allocations, suitable for both parties, which is generally a PITA. In most cases discussions are clearer, faster, and more comfortable using email! Not to mention they could be much more secure if GPG is used also. -That being said, I'm available for scheduled phone or conference calls. Please -notice that I live in Warsaw, Poland, which is in UTC +1 (Winter) and UTC +2 -(Summer) Time Zone. I'm a late sleeper, and usually cannot do a phone call -before 1100 hrs of my local time. +That being said, I'm available for scheduled phone or conference calls. +I'm a late sleeper, and usually cannot do a phone call before 1100 hrs of my local time. Note on Skype -------------- -As a matter of principle I don't use Skype. It's not because Skype does not -offer any meaningful security or privacy (which I believe it indeed does not -offer) -- I have no illusions that other global PSTN or cellular telephony does -not offer it either. It's rather because Skype is a closed communication system -based on [proprietary protocol](http://en.wikipedia.org/wiki/Skype_protocol). +As a matter of principle I don't use Skype. Skype does not offer any meaningful +security or privacy and I have no illusions that other global PSTN or cellular telephony does +not offer it either. +Moreover Skype is a closed communication system +based on [proprietary protocol](http://en.wikipedia.org/wiki/Skype_protocol). We should be discouraging businesses and governments from forcing us into closed systems. Imagine a road system that allowed only one select make of cars to be driven -- would that be fun? @@ -92,17 +93,21 @@ to be driven -- would that be fun? Public conversations ===================== -It is also possible to engage with me in public conversations via: +It is also possible to engage with me in public conversations via my puppet identity: + +* [Gmail](michele.favarapedarsi@gmail.com) +* [Skype](michele.favarapedarsi) -* [My Twitter account](https://twitter.com/rootkovska/) -* [Qubes Mailing Lists](https://wiki.qubes-os.org/wiki/QubesLists) (especially on `qubes-devel` ML) +Note: I disregard language control. So, if you want to talk to my puppet, +just be prepared to get a 'bullshit' here and a 'fuck off' there. Policy on LinkedIn =================== -I don't use LinkedIn anymore, I have deleted my account some time ago. The -stream of invites from total strangers, inability to verify trust, all makes -LinkedIn and similar platforms rather meaningless, IMO. +I don't use LinkedIn. I my account exists for couriosity sake only. The +stream of invites from total strangers, inability to verify trust, +some wierd community work under the hoods, all makes +LinkedIn and similar platforms rather meaningless, and mildly dangerous. Please do not send me LinkedIn or similar invites. These will be reported as spam. diff --git a/keys.md b/keys.md index bf3fd75..6961dc2 100644 --- a/keys.md +++ b/keys.md @@ -4,74 +4,80 @@ title: My Keys permalink: /keys/ --- -I use [GnuPG](https://gnupg.org/) for email encryption and signing. I also use -it to sign various other things, such as documents, code, and this blog. - -I use different keys for different things (e.g. different keys for my personal -email and work email, different one for signing Qubes commits, and yet another -for signing of this blog). Typically these keys are kept in different VMs, and -often still separate from the VMs where they are actually being used thanks to -[Qubes Split GPG](https://wiki.qubes-os.org/wiki/UserDoc/SplitGpg) feature. +I would like to use [GnuPG](https://gnupg.org/) for email encryption and signing. +I would like to use it to sign various other things, such as documents, code, and this blog. +I would like to use different keys for different things (e.g. different keys for my personal +email and work email, different one for signing code commits, and yet another +for signing of this blog). + +But I can't. + +I start to use GPG back in 1996 and I quit in 2000, started and quit again +a few more times in the past 20 years. I quit every time I figure out that +my systems might be compromised. +And because cops can sieze my hw, robbers can rob it, and my government +is not supportive to create an universal security buddy... +... well ... there's no chance for me to use it. +I'd better get a gun, but I'm too scared. The Master Key =============== -All my keys are signed by the following Master Signing Key: +All my keys should be signed by the following Master Signing Key: - pub 4096R/D9AFBB99 2015-02-07 - Key fingerprint = ED72 7C30 6E76 6BC8 5E62 1AA6 5FA6 C3E4 D9AF BB99 - uid Joanna Rutkowska (Master Signing Key) + pub 4096R/12345678 0000-00-00 + Key fingerprint = 123... + uid mfp (Master Signing Key) This key is also attached to this repo in the [key/](/keys/) directory. You should verify the fingerprint of this master key using some other channel than -just this blog (e.g. [my Twitter account](https://twitter.com/rootkovska/), or -a [Qubes Mailing List](https://groups.google.com/forum/#!forum/qubes-devel)) as -in case somebody was providing you with a falsified repo, they would be sure to -also feed you with a falsified master key. +just this blog (e.g. [my Email or Skype account) as in case somebody was providing +you with a falsified repo, they would be sure to also feed you with a falsified master key. -* This key is attached here: [keys/joanna-master-key.asc](/keys/joanna-master-key.asc). +* This key is attached here: [keys/mfp-master-key.asc](/keys/mfp-master-key.asc). Email encryption keys ====================== The following is my GPG key for work-related email communication: - pub 4096R/0DDC6718 created: 2015-02-07 expires: 2016-02-07 usage: SC + pub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: SC trust: ultimate validity: ultimate - sub 4096R/0E467029 created: 2015-02-07 expires: 2016-02-07 usage: E - [ultimate] (1). Joanna Rutkowska (ITL Email Key) + sub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: E + [ultimate] (1). mfp (Email Key) gpg> check - uid Joanna Rutkowska (ITL Email Key) - sig!3 0DDC6718 2015-02-07 [self-signature] - sig! D9AFBB99 2015-02-07 Joanna Rutkowska (Master Signing Key) + uid mfp (Email Key) + sig!3 12345678 0000-00-00 [self-signature] + sig! 12345678 0000-00-00 mfp (Master Signing Key) -* This key is attached here: [keys/joanna-email-itl.asc](/keys/joanna-email-itl.asc). +* This key is attached here: [keys/mfp-email.asc](/keys/mfp-email.asc). Blog signing key ================= The following key is used to sign this blog repo: - pub 4096R/FF112935 created: 2015-02-07 expires: never usage: SC + pub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: SC trust: ultimate validity: ultimate - [ultimate] (1). Joanna Rutkowska (Blog Signing Key) + sub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: E + [ultimate] (1). mfp (Email Key) gpg> check - uid Joanna Rutkowska (Blog Signing Key) - sig!3 FF112935 2015-02-07 [self-signature] - sig! D9AFBB99 2015-02-07 Joanna Rutkowska (Master Signing Key) + uid mfp (Email Key) + sig!3 12345678 0000-00-00 [self-signature] + sig! 12345678 0000-00-00 mfp (Master Signing Key) -* This key is attached here: [keys/joanna-blog-key.asc](/keys/joanna-blog-key.asc). +* This key is attached here: [keys/mfp-blog-key.asc](/keys/mfp-blog-key.asc). Note on lack of expiration date on code-signing keys ===================================================== -My signing keys (e.g. blog or Qubes code signing keys) do not have expiration +My signing keys (e.g. blog or code signing keys) do not have expiration dates. This is not laziness. There is a fundamental problem with using an -expiration date on keys used for code signing (e.g. `git tag -s`), because it -is unclear what the outcome should be when one verifies some old code (written +expiration date on keys used for code signing (e.g. `git tag -s`), because +I don't know what the outcome should be when one verifies some old code (written and signed when the key was still valid) in the future when the key has already expired? @@ -85,7 +91,7 @@ Other keys =========== There is a bunch of other keys in the -[keys/](https://github.com/rootkovska/rootkovska.github.io/tree/master/keys/) +[keys/](https://github.com/mfp19/mfp19.github.io/tree/master/keys/) directory -- these are implicitly signed by my master key by being part of this (tag-signed) repo. @@ -100,9 +106,5 @@ passphrase I used to protect it. Passphrases on private keys are classic example of [Security Theater](http://en.wikipedia.org/wiki/Security_theater) in my opinion. -* I have included also the [Qubes Master Signing -Key](https://wiki.qubes-os.org/wiki/VerifyingSignatures) in this repo [here](). -I don't consider it proper to sign it with my personal Master Key, or, -especially, the other way around. It is signed implicitly by being part of this -(signed) repo though. - +* I don't know how to secure my keys because currently I don't have home +and peers to physically secure my keys. diff --git a/keys/joanna-blog-key.asc b/keys/joanna-blog-key.asc deleted file mode 100644 index 6009e35..0000000 --- a/keys/joanna-blog-key.asc +++ /dev/null @@ -1,39 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWbWEBEADbaAHjo2TDnUDO1cKk7mEN9hFC7bA4sHlhEYmNk2FKsbpX0sJA -ibxP92GxRMHoFiJwJQ923wXjkjJAOwb5b3IRYdwPYLZhpZbBuYPh8yCdKLifBpL7 -HsqwhB8UJQ4h96uIEvpbOKYAzj1qAJ5EP2DlgKuHexaWQx03cxRWbS73erZeIfkf -zRY6E80EE+kFqvnLnTpF9GgS4ukIcJn6qQACtiS5jBR02Y9ly+0A/FjkNgdXh2Gt -yJnuFc1lxLwzBVD65TITFGW/nkpiguSwKr7ubH6K1hNoNLUo/TcP0Wre5mEE5+pa -/DK3COak0zVJBWzw+QUZgPTYxKVwrJ4k0Cpi5v7lbCkypjeuyZVVVYrXStKO47xF -Ti2/fFmLAJSgTiwmCVo+/3elVQ9tQs9DTR+7MfpuueNYI4qK+l3f0DMOIitYgfp+ -4Xzg82DpfE8yGgiciCOe43vN/DkP84GVuZ9NqbsWLe686x5huDRg72LPN75uh9EM -ej8oeerv8YVuIBEOvDvTdYvm3/D5rjehToqyVHmQL4gMx8MXkW8pO+cfRGFzlher -KkM932oK0f6v8wzANrQdVhmVWRfuhJJjrUl20L4NtsvgHZD50RCbZmmRkheqSQox -OZcXsQSosQ+QyyNjutAY+6OBtx/hy4Q4KDZCD8d128M0RGXH7axOGgziCQARAQAB -tCNKb2FubmEgUnV0a293c2thIChCbG9nIFNpZ25pbmcgS2V5KYkCOAQTAQIAIgUC -VNZtYQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQocNBuP8RKTUgEhAA -g0oXo8RKRzWvNMBz9Y+vUGOzHbZ814IFz169KaAzx6zrI5910/vKfLtcYzkbxrZd -bBtCY0Z2gj/kbF6yt3hmgqWZGqjRW1On6bg31l+PgHsNaHsqm6qTfDqcGnDv9H43 -/Hlj1I89xRO9x2eTYUwSlJheWc1Yi/8M9iMATQkMPrdw/+iy6JYFIcI5SjVv1JiK -uRHDcRniUktHAIZBWm2UiJZmIZd8NvP0BFmdtc3SZ9tVpvuTkKFYU4mNo+4WslL2 -Vbg+ktps3s3izFkO0V5KL0pJin0/9mGYPrf0vNMTTZT1/9yxVmG+iAgwMl9dmmjN -N6nGrT+/NsKWHVQItkz6tymnveeSjzQFUckr6ba8y8lb2p/JLaWvmDoxK+rCgpKw -z6t0oCgLTOW3DWvNKySxmOuJditPMQlVZD0BV5nRr17uH7Rbd0AFjyAYFfpQchIp -wAC0DnARk1IMdPosDqDMY0ZPypCvAkSiIc6z0j72IjaOGZTDQb7Vg8E83nWymJes -LNKmvTkI2trBC6xV9dd3RpLq53sJNVw6jKqpx0FdtOU6d0L6KwbRn0I5Q4/UpAvj -lBdmzOUPC7Zm7SbI8UH21Y9PhpcAVWO1uJTx3Jkk6eCXv/cwoMj86Xr+a4Wx5Zqq -0qqpXL9KHkVI64+14EZo2iM+XTnLjifWrOvfAkcIzDmJAhwEEAECAAYFAlTWh8cA -CgkQX6bD5Nmvu5mHUhAAhU15uEkSXTjDKNGcHTlYREU7fe1Ov7IfRjPrbiXG092T -wDw0T9c3gXXoGZI7sNaFYQ/jv4aqTHtpoNPbrntREMY2F4tBG0mKlK4NBxuF5i0k -GaxJlgVIcRbHO2cAOGhpJqQNODkn0B/gBk3Lv/WDlKdq5B7MrSh7+aM5Mz+AtQj2 -9ZSSX1Gljfct9Dx9f9pMMm7mPg7fnszXOt96ZkOvv5qdrmQ2fVsiFcZ2WZddpdOk -MsNuNgBzniWluK9sG/E4WDFAIivNW2yZ78pAqTqLKmhxq4SwtAAgyQBdw7eqRxqy -PoMAhgvctX5M3f4hjHEN9aAi7OKBJ8zUsO/CChB8Z/5CtKx9x0T2+PZSst7T/amy -kv43gJQ75A4SzkUgrBqc1e/cvlv4PfOyUhEIdoH1QGjUNcHbQsr49wNPYNy+Mf0g -z8j99lqDdaokcpkNAFc7fhmlYz8/irQFDeAgfKxQjhu54I0yZqBl2zZtZGVSrQ8O -zNtMNiUhVgvH0KuaoRC4v1yHoIdsbtROSs//6Tkh+Yk94kNUayvWYYanGPOCg8nm -EPLqLMa6iPEMPkqUnW9UYKc/DhZpq9Cj3qadCxeS2wfQ1n79q/pYBmZAgMTbjOZV -PyeAjHE0SK8yBe1SZryI0eFC7P7LQYxmQZEFeHJdUVHpL8vaTmnvVffYKsedOBQ= -=uMXO ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/joanna-email-itl.asc b/keys/joanna-email-itl.asc deleted file mode 100644 index ac0f13d..0000000 --- a/keys/joanna-email-itl.asc +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWcsgBEADceXJTZFAYUQAnoi8FXjZssvSgIulGOjnQRPwgkjfr7NtsnFx7 -XUO+1Owu3f5LHvIQ0TyLxbKWRuELNNTJoGNjUaLS1Cn2m3hEbV0bem3AOkBcu79k -7E9YXCqzT4jAk8Cwk8M3wJ38x8wD1vat/5T2DxjCPiYFEO+/XXcwoMpmvtQuGiFs -4FOY+5zIj1xvaXFwSl8yJ3Cmpq7dTDL4if+wgiUPZus71Ve0vMaXfS+3S8YNbcyA -jp3DLocJMqf1xAvKtKGomu/PBp0VJW1oFyJZ1niWdB5JuvtQAv0uoCFMvAo110cw -ZMUtxjYTlCpg4GPa9OQauIOyFkXxJSf5Qx/G8qN1TTCB0G0AnF0YDkPPT8DaASYN -Rk7wNM5V3rFU9CmZ9m6JGBAadwA3uUGLMfEVCXsm1pOWq9I0T57sv1HWQuxA4sRH -gnSkuMLgA7SRNdGMaCNQPP7LZnDSDYZNSTB/4SBTRmevZsKE8ASj55JL8VRWDcPS -la6JuKuOvYdOZX925HtMRA21Zu8vEQInu5Cjx3asfZBA28tApnWyfGCApXpo0PZ9 -k5iUDkbpnkUOBQQ7+eAoxk0DFQsHfevMP2Xo3aUwBBsml1cPf4H+5ZKNREnkOXh0 -TFSq1SNUkKyasmlSjoLmShUNXeBPKJjtHTTWSNKQgx4uNPXFwH49hIEPcQARAQAB -tEBKb2FubmEgUnV0a293c2thIChJVEwgRW1haWwgS2V5KSA8am9hbm5hQGludmlz -aWJsZXRoaW5nc2xhYi5jb20+iQI+BBMBAgAoBQJU1nLIAhsDBQkB4TOABgsJCAcD -AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAzk9i/DdxnGAlqD/wKXauSsXj+4Tn0dpui -cok7YSQPfjPh+t1zyB1iFjQtrJmzbg2Qeki2BBlG62N9oCaXSdUn0gENZzpJS40b -BWjD2JrRRFLyUy9C0dyAZJjYBM4AUhLvRAxpBalKt0TwQbOCz/6gc4Ks/JdXaGG+ -rNx0LhinajdXov4H3rBIzoE2v1SJcq3cn2HV66JzPMvDzQf7hrdm5ZhKE4lNIdlI -xPKkDKIWaVGMkFkiQSqczFD0ruk2cygf2JmH6H+wieI2jD9sC+j90RiJ/zpYAU3t -poxEGG3avxcwd78CAm4mE/x5F/bkuZ9Yh6qQQSFZAuJYAmwPm0yvQS2C5s7ohKOp -gdpN7ZFzPF5wDY5t22AbLUxCOyhaJZn/fZY7j+/CYZzpmjNuOAeLn1S4LZtWIhRv -O69nVNsX5SEqvfoO48lHoX8OxjcenZ+9Esxhw1hUcdSc3qLBn4TOJywMDORH2EjJ -3ABKxYvYFnhHr7YvVjEAOJ1t8Eufq6EH7GPzSlUTvWBmurZpJTSRnDmnLyMgiOtO -mLpFtiFeNa/HeHq7Nv07asvSJ84RpPlOhdb4E2RletR/DKWd7U/wyon5MdnE2QD0 -WuQI89BRvAp1qYCamjYK5NPgmRf/5i226QTxeVfsMWcGpz3BnkrTtjXdLBSVuSb1 -9zj7NlKhI93jqFu863aCsaDNQ4kCHAQQAQIABgUCVNaC4gAKCRBfpsPk2a+7mUf9 -D/9+O9570fcOBW1/10/2+9Q+RnY0RmBsWUwEgYIyKHaqJzOVlvZXkExVKXOtbA9c -Z866kE63JJxm+QlzeQnl/xXDuF2uiVsLqWNRkuJLW8SCj85nnETE7UEldZ0aKvqq -VNUsiDoUvRpzb9k/Ou0nNYFnloG+EtLfUm6l+jmUI40LBmmKN6mhlxz18KCJCWSw -TRgkFrmJoiSaLQVIxHKPFiQG9WkRoD/mb7MWyJv34wStC6n5mfj5qnkHxSXEcx2p -2kr9UK9ayBkU7xJ/53un4sKb7nK4w1sbvTrCBrftsPlBJmpGMrpKlOE67WqucC/e -AfOsDxwJCryDgBkaRA4ASBfKy+3KAjIi3Vje1WQih3ND6f3HaLvkBxKfp2hz4fkr -ZrjBRGBbPvYAU2gxISIAgYwT1TnaZUa4CiO1YJzyCaVtf5M+7jO7h6hmeFWaJ5g8 -Ni0NkjuPKXeo99+UhpPmlzAceYVFvlNs68+r9NN/rVufvmJYFwq84S21kwFLdhWR -8u0tVTTABSJvRdFguE51jQPq7uyCAY8kxPnzfciYziyLNuGJX1mhpyksRv3XZRT3 -qgxbRzuk1AtXpHcY+TcSpTr6eYG2jQ7CeEo9CdQJy0J9tzly9jXukKyRYXBumq74 -SwW43nollUyojainPnqIP5vfoJhQAu8VCT2DKzPPMNfTAohGBBARAgAGBQJU20BV -AAoJEDkXZKLXxFvOe7oAn0mxLnjmlNxaDtUjDTBBq1CxFYdpAKCKVM5CsFkN4fS0 -ZNIoCB2ioC4KWbkCDQRU1nLIARAA+cHu4KUVE7zxqlnjJ6nOjrLM5HyUwo6RhNXO -Lj9o5+B+VOUJKCvG1XDFyx97R8VrV8Vq3YrPrPBcIhCqN77Hi0PNFhdoac1ITwd6 -LVt2Kyte6H/thASVUByxIvn2f0wdFD9nwF/UWE8HZywzgZH4O5ziiQ5cswZ7/AvC -bLiqrnbVH7E4DCugHjnXx2wfJkAvI6qgujs0Chjyzx8Eeed1DcE4ZuF1KejOxoez -Y2/P9iw1xaLAaE5Yb2n9QBtUAHoANXDO8FEpwUA9vpre8rCqaBa4m7zF3SzU86xp -+n95PytzjWOBlw2hvVJHyISzLs+Ff80WEKiErHnpGtwxCEZyiYGuFxAYnSjsiVvG -3drWbW4U0RhMAOxwL3SrZ4acANFV5dcx++Q+8l/H5m6GQUHNjLYGNFatgkLVpjQS -KQMQkM9ah0gF93eh9tLFVnpg/bu4xNpbbj2oAqRBoPakxoyJ7UUeYYOxbTHagOAy -SXCPrEBPk0waxBFkthdjxUlv0gO+7Ptpn2MI8Ok8xuDMWgaNwC4LzDToWBKKODE5 -zurZJjKY+Nhc5SXdAeb4UwdyqTJjpdJTsgqHMQW+VFMeXOPLSLNrJq2UJ6z6QF+J -SaDTE3jZq4SLahLoswnRjVZ5GwvsOzP3axZmrJ1lUK8bXFpGnL/ENYZvpmmjzIBe -JX8MQQkAEQEAAYkCJQQYAQIADwUCVNZyyAIbDAUJAeEzgAAKCRAzk9i/DdxnGFvy -EADNrgKDrm6W215HSAlAmtz4/PImQhKbACcqd12OGT4FeAdqtKXLXdyLnC7ionUP -5T9VOb/Q0ZkS5vUyZlnlapPWLgp6ZLi5N64YpC/GPIwxVon2x8cn+u6eF0UaGbix -ZFtAxWGeSTEiD+odXxKIip4HdJxK6ECcUoRSsEK1j5uKycxAQ76hqOcZYYs45djX -vzvq9CewuX6s3S5H4F6sfEtusIPZKE+0y5oLmUn5WwHoZc0Z0uYAlUqDx5DPcCiO -nAECTRWTNY/tUxOYniIOGjMaXLPdwjFBoiCyEGpBrTH4wx0xxJ3so+Yteef6/nb4 -oPkjkz4pKOtxnrxK4hXShbIMktRzKYROy7Y6SiGH2Eq0YSzYeuAUMjmP3QRXWXp6 -dZPIoviG4r7YgKEhH4ZvnzAhyJjaGZgCR7SM7yFdIP3mlh/O7qjMF/Me3g1tAeMV -Qvc3CdFYo2qMpzEQxL8lmfrAFqcrSy5O6VkZFA05XOmEtaTQs/f0GXXu03zPgGmg -xZ6VuDAF+WztQktUFu1wvmXW0QZcqxM/sN+gzWV05M6b4mZvqlLsUqjSdPEvVADq -RTmDMfARDVyOCInrNJMizdSrh/Cz257JNxf+chBydlfdu4m2TiRIbZbi4+dFFZms -A0Dhz0MR/QZBdyAqBAE53kTm1JSd6nyNN98fPygDeOE+Dw== -=LeGt ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/joanna-master-key.asc b/keys/joanna-master-key.asc deleted file mode 100644 index cf9e8f1..0000000 --- a/keys/joanna-master-key.asc +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWbPQBEADKJFbpEXvbwyU0vZXtLXfS5OsKV7gxQWr2G+GaUEqSv5Czv2DA -GgjmPIVdujEnnJizzr36FDGBCTCphYlqf3AuqLDwK8hukqlh7REOTbyE2h0J9RsS -PDYEi7uz7GQ00ylv8VpPTHgCVsRerGKQV4OCkb1ih56sZju5JiD1xExWtziYTg5V -yLR99UVbPVUNLva8nCXVZSKxM7112M/3bCWs960Mz3f1URYYuNPhuZ8Tt7mjwzv4 -GYllixumjzZwWBh+uEtD05XY4YXZiZX2CyPDoriDYB18Ocl7oB/xN/ZoAwPP16X9 -S+Q5zNQMdkrYq1i4kkMuyPteyoek6e2WmXFjISbjDiHKZo4DWYBEYsVziEDAeNk6 -crPxBx9SCgVxFa6wqF/Oqm2rBbFeeKrZ0+uR9xZhT0lxE5WmBUmmkgCRSujJTE2T -gy+EaO6CMqluoy5zid3408N03TKgK2twt07R28FObsoaKwOxCiaw1WfdnLzqS0sU -z7jq/dHrx3JnAUmICw/4kiqJtw6zutpEVAZfePd49zJDaStZ4dwtmcrGvuBMr/a1 -cGnd7dok1P1TM67LZhE2ODzkmr8ic4TRnq6kHunYCWlCPY6Ayav0uJ95CaaqX4G+ -AWFQZ15HCg/Q3WBOKYAQyagC5zOeilBGQs7oOqbcQ0WtcfX/T9Lnr++s3QARAQAB -tCVKb2FubmEgUnV0a293c2thIChNYXN0ZXIgU2lnbmluZyBLZXkpiQI4BBMBAgAi -BQJU1mz0AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRBfpsPk2a+7mc0T -D/47oIsbhKsvvCTrISyJobQo2A5BTwhUqDJzFRq1PVX4LcH4BtfR+L6/vQ7sB3lt -2QD/CdCCQbXBFdzR5nc+8AzjUect+9Kk2oCaYA6dC59c2zcG0rEWOUl75jpfuFQL -ntKBv1ZZXJ+iv/EDEyt+4kdcByIAWnh3o1jXhcvFcifI8a6yA+WDp6XtOGHyebbB -MK4cIuDPFA/x/iBEp8yI6cMO/LNpIKtFiTp/vDhrR5g6umAVvb6HMX/qSC1jfufa -Y+sfEgcYcIw3mSTxeJxIzrv+cIfwK3P7/zPfbtwxlq8xSQNP5JB70JHBWg74rGkc -rl+M4OM0YfaaMNG7iFzYM2qFownMtWrmB+J9GswIAwFIonUtBhac0+eVCguKc5zN -pFkxrUdqdF3ijolaN4wybu/KEg+7YjAh83Ql1Eh1EfeyKOr4eYt6SlR/RLrig+IX -oHVBo/ryGH4F1MDNCoB3txYU7+hMndnDY3lozcPfXL2jYp/ePTVdAAK2Uk3qXqQj -Rxt3a2O30elp5BsaKJs4A5/HPpGILdk5EZZ+EE4XFIo/S/2NX5xRaNyBcqGzEnxC -1iQZG95WZx2aTSA7XMsfSGDtAqWG27fpm3YWw+t0bt0pTwFOxtQRhBkpXdFVLLLQ -kGVQ5BTPIsLw5h0XWGeD8PQsnNVRwEP2eblIyrMPM0fsLQ== -=P6Mq ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/qubes-master-key.asc b/keys/qubes-master-key.asc deleted file mode 100644 index f47ff8c..0000000 --- a/keys/qubes-master-key.asc +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBEu0kPkBEADHOaL53AVx8ECt+vsTFpNv/oyDXXs8dNmMsQhaCQ7BxTu95QKD -j5S0TiFoXegBwE8YhRg/8sBHOUbmdD1iQHxJSlJc8NYJkctq4KjiyeshquT1mIYx -wTGSuagX2PbM+Sv6Cuyo/DyhmzIH5dssFH25qnQ/RwednxWMG9qBW2JujDdwlMjB -1p6u5lzkwECO0Kk8w7rvSMJwPo2FPTpSTcdN7+Yc1i7WEv1fOpNYBfEn76Eck3LP -dndceRxnErvkEH7K95R1wEOqXxOEjE3BoUqh7q40GDW6bBMV5EauLBgMX4DQRIDE -uU0NW5Kk29/8RZaZrRXmpVmof1dMYVBWu4wM+Khm3IZ30pUR188jZz+eUhPDieJL -lN3iRKikSv7Rm9SETmwvvVOpP+RfkfaS6XGu3XfSv1diLy00p6Eh9J6LsfiCRuCI -svADNHsyFxJkIwEGVkUgvPFCRDY73LQuV5Bt5gutPFVnVS5nM9pwQEBFAha8wB5N -L+0fq47a1NJFbmKQ5PzOom3qQjee/3ic4wPcf9YtmLOdxukIEXvrGtcMt2kQHC9a -YypW/AYQB/TxpLP/aXSHiO9bR4hA4au26d6ytsgCZpPVQ5WchYetTVXfcjv6mbCS -g/QFYx1Ss/lZ2Uao/w7eYdAlvvJ1JBYotuMLuiONReRHGY5I94H8RRju8wARAQAB -tBhRdWJlcyBNYXN0ZXIgU2lnbmluZyBLZXmJAjgEEwECACIFAku0kPkCGwMGCwkI -BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEN36Gj42h5SU17kP/2sF0pzYETEJykY8 -MTfHpey+eAjP6Ejt2mkasiFMEIZ0mjFt9A/7I4gYgiI1pNRat2icbjK0HmUDSHzo -LRjCcuP39D5LRdoFMzMzXusHx7pCKkx9rvitOq/p4LN+O6orCJYhHN7Si3LXWYv6 -5HG9iGbeE262myPb43KTBbNF5recwkHZTufNMISGQiSkwFOPRbBX7q2c3/qHjmiw -RZ16DRSY1xHaV1HVplaDSCIXYcDhWsywB+5iuUFDsZGmfCncR7SZ00eSWpKVB5mp -P9vlk0Tri28dQWqfd63rDU9ZwxFpZfL+hlhA0W07np6L3yyai+jzaWFY7VsqdOnp -zBJe8sveMr8SP0QhrGEL0aj/R9XPKgfYm5wlf1qJ/Z/10jJm8D0MTMUxPUI07Hja -u5lIW7GZKFdI5DWt/JTvy3FJp0yDajaUOc84l5wJKl7cNCmeZH1/oNYkAb+JqqGX -/VPWEot7fOaqUrHswsE/YKK+9fv/aMY6qjF7qVGAfbd04kAZuPha7/s3USbdiRA7 -aJapZ/mtaUY+P9k1j/dI8sOPpxgl4c6esIBhwe5Sv3HUZc5SZhW3h1ISScvoeYTV -KLRIi9ELMmsqfESjDhnDbVsqIjL8+kKxegaRXwNxeZoe7EfiL8PKSJMSbaIhXLFC -QUkIyUJmS9aV8bQN8vheR4JNciA0 -=5mf9 ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/qubes-sec-team-email-key.asc b/keys/qubes-sec-team-email-key.asc deleted file mode 100644 index dac5789..0000000 --- a/keys/qubes-sec-team-email-key.asc +++ /dev/null @@ -1,73 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFClORYBEAC05wuebboLRM/crcJXyXJsoSNtCmNQsYMrj+p8LFs2s5+dw4E5 -9ZAU5RDRuUWWE5YDCrHKXb2EFb6iENLm30Z2/zcZhrWKolzm0N5zPML/+MxrDu/5 -xabgwMQPA6TvDIxawqbJbn/pz+IvnQTK56GwP7HFo4EbKbpzwYqRz4Zo9n/3RSkC -xS/8fuFFHLgNVGWYlgE/vTZmShi15LoH4leoRRfjneSHWv1nWL0syJK1n6c1CVQc -5X5l8aw+LwWQPv1y6keQuYZfhXqQ0bATTfoGEFyEXl2JwcsfCYIAayJhaTB84GAC -Yxj7dG2zI654IO1IkX/tvfFpYc9Kh2JHVCQU5STihn847tMBoN5/hQFCTAKV7kzh -S+bO39CTB+T/JqSWJ9t2V9HuAZyM6HyP40lYgkXudT+mP7+C3wiw2VlCbKfVHABh -MiXY3kJkbCOnL3J67ZYhv6RLD2INedYluvVFS7la35gGAH+MMtwdcECxIK/bUXHS -T3uY0mexOeySIhlvx1+vhUNCZRHx2jeifjdU9WG2pZAaZIAc2oZMRLRMwEOrC11H -t2dUELffEY6NeaYb/km9lM1fGjT2EO/LOlYTRf0ywfc/zNmVwaaknsUxBqffxwyr -3o4ntqWUs8SuAFiQ4rpwibqe2Ax66UZXmzbKKVvUKHNTWpfO3iHvnQym0wARAQAB -tC5RdWJlcyBPUyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBxdWJlcy1vcy5vcmc+ -iQI4BBMBAgAiBQJQpTkWAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCs -wmAvP0jLIQhZD/9QwDLuRJufNyoioCjL5UeoYVT7Kg8rYt/rAso7qxXhEynVAoGz -fKnGcAOuTG12PsaFMtxY2KHx18Ns0OsAiVm47eNzCWZgyRzbGI+bsDmRQZ/W8g8x -uwEXni1YdDJckJ9y2zbdTzyHfEuhLt8kVGzHnBw2MdKkYrvlZpWv2BwCTj85lhnf -W4LDEGtubRcDYmfLkNreSimeVIvlx5f1YXWQ8ImtmFeFqhHX9nXPSKn5idfj6DJI -aWJ5A8lw1JSMAW6zYukjN7Pz+PMBVTYBFcCaEf/8MlgV9qV3k4VUj/hqvt0IM/Qm -caWbDYJRskYQiPboRbYJHk0fhjsNuMnXpX7jl44Mn9y5yPPCep9cpWDG1WgQtHXJ -uwdwQkSZLnjleKa4743PguZZzgSFaI3Z/p3RjQLhDXPb/7Pp569FFyT3WuzjAOc1 -pu+vHMtDPKeV6nx9p1OK23RfLZwP9NmV2pJ1ZPo3NptkSqOf6GznF7+JaHcjqUnU -EAiaTGE30dcleNGF/xMF59ZlQm8rnZV83maDfWQgXHl29pSesm7DIs14DVtRavAw -vLfgHS6uiR0UK68tA+UJx3o9YeYaX867s9GqAmZi6qPry9VJ3Jgz/k+/pAVM2mkV -FgbiP7BbFdUj3+MsitW7PN3GOmn9CEpnu/Pxq5AOigIBiTWQno7yqrhcJ4kCHAQQ -AQIABgUCUKU/AAAKCRDd+ho+NoeUlPqwD/9IcdNOnI2shbSD48ly0oQwUOq9S6p2 -aVrlK5beiVtYuYBFj3tgZDq8/g/RiQIK+ya9kHnrGTw1QScPKqjj1jgSwdbyHZZv -Joiz9h0xAjqp7TYFcB4ZUNdLR9OBUJVXV7DNvn6QxrU5UFSLhscqTx3HSi/fGrVK -m6DhpMZ8DZprT7GySZaSFhAALvwCicvBSdw3g+Gg2bUFJgrKFUBeJ96qU/1IHFzi -AGQCyI8hCIFGvmLufd5aVgA0CUE8r3FvYY7k1Ffdo6iySQzBCnEkug1QezmxCg07 -SgWPge9UtQLQC2dZE22VALGgdweOBwVe1SL6UX6Rt+w3bmvNuoxjoxbNMORZBpz5 -GWfIFPA/9DtzH7+c4aH76sgtj4GmcRHXAhkaEdBSiKuu5xJrwDKvtNAQIPGZJTUx -TmZQzd8Xk6yI4Y7Nfryj11hEvrU0Z+dF9cas5rR2dewgTu6cpmKtTKw7g2wLzyF7 -iYVWdZknUX4IX8E+5TvIluL7w34CN1ag/bA6igXk1to8v7wP9aN09XKUwO5Gz92P -py8PgJZ5NY5kZfrmNMUVTPqdudH1sF+EDSI+yACDJrKtQFtVY1FkhnVhJ+GovKmC -vnUr8Lo/79oewHEFB3jIXyqCTEV5qMDyY+BHMDquasdfEGA6I0IEZ2ndoZO+ic95 -Z8IRlwwccs4G+IkCHAQQAQIABgUCVNaR6AAKCRBfpsPk2a+7mdHTD/9Vow8dtQGB -wr9xFVsAqYSfT4vvTpPb9cPIBBPdVcuEaBjHiu4jcgtv4Z8HYQpk7aYvOHWCRln0 -Lqeei955tCBqustYvSv5sGDdygGehdOx9xNUBPBRzPjP7ULfSGRpMwgaabfXExrp -gWxv7AxGOFe0bhPDh2vKds/atHHmYi67c/12o7s6SB7PnruiaSGNHQeQ3fq7XXAb -mCY+hFlWlD5iY56N5GTX6ZpogHGPSvHxQbB0CA1WtpbXaPQc4jqM9yBTLkQHVhgK -ys+ob7gX61R3Vj1SwwjvNi6gZFExNV9p3MUI00Jj4LnCsOL6NS8rpW9x4A1t1EDO -KW3qa2ExvfV5fK7pxA95048tkMTDWaD5PG2c/62RUCOQP90fZk3FbKOhB0sE6kXb -9cRz+BRchCo/QwOglFHVclDqkwYDLXPG+q4KjxwMRCdRIUlNErkHEfiF3t5p+5gr -eUda4KMCSApmGVloHTg03gH7waar5GtnAmg2G7Q1y2FzvTMSMPnvYBetaKAJB0RI -J5TRsMqF/PigX3pEKlnmlzSZme+PlLRyPRgN1WDsVxBI6fqxduDciZDpJNs6Dv5u -I3Po4IXAfLJrmtBp1byZY69NZ2tcFsSGgkflefxVoRb2YT8rnghkwEPMoUSmihs8 -5IaiN9IjdBgrhkOkITw/lMvaZykGh3l7y7kCDQRQpTkWARAA0u0oYVVsWmxZKcdS -w2CNZ7H9gDByGysQ5NEanVPJCNQr7XY29yqug7pHQ8eIx3JXQWlXFu4rCP3lYXDv -1Uq0n4m/ksI2qX3fwKFAN7a+FBjaesKZTjE6kcgu+DISAOEaDRmso34tQohSzw8V -co+XC+iBbZ7TD5zw5f5JSxT9+eEI+eWcbWr7QzPhtjL4KyCXx6AGmnZo4kpF1AoR -j+TXLheLN2i9/FB1kiViEeCeFyI3tlPCyeJW6tVBEI7260wMwlUV80conm2WkTPG -S8v341eXgg5Y/Sh5+inI8JzsEUTjcddIqFOMi7buo0CVKIprHZFHn3gZyHHG45mI -CgRsoHb8QN2xuX4Gx2/Xlz6xKGjwY1OWymXOFoxtEigeON9HGsVF6qF+dGhFDBK6 -V5zMvoyqkyGi/ffvKyIqbbSGt9NTCKXHrdjpQ7r0kFjKhdIZHbJXkwQTS/xo+VJG -1pg7EzdH/lCPjTGCLnmudV7pj4QPqjnhtQSi3T+0LDNLnNeLPdiKS1fQEklhJ7+f -rLFnKLcxaOyIvlRivuEFV4ZqcOHH47zXRMrd0xz45XWumu7BlKoix/WOeCLkRYvb -Bzy3xDIHC2cMKzZ0eBQ4cT9L1ddd9Yt0DY4H76kiWmmWNEXws/jXgWy4FtYAnYc9 -JUXVbphmQIcbU8/IL8wGj9ZtL4kAEQEAAYkCHwQYAQIACQUCUKU5FgIbDAAKCRCs -wmAvP0jLIQoHEACbXjjr2FUOAOIu53zVnyz5di8LkDiX38iAUOy1MvChyxvXaHy9 -XkL/TBmYrEhYtoo87jWkMBHiRuiZX+rrUfarDFFMQMVQvynzwqL1TfhzDSljknm2 -FtAYhAscglvo8L56eo4UJrcCvhOsPPjdl0riCA9eYq11LcPAd5cHlHeZLMHHQEhU -ibS+G8JKNNBvQ8uRH9Y8Egn/PV1Lg9aJOqXOrzygzx2lD5WTwuejLoDa2pl015PF -RTmvWZKE2j4HoDwlaxfOdvzlbl8/zWNUQ/Vx8nd7q59J0oVEJxCnZaAlHXwUI1ZN -epHbIoQi/IQ0hrDFHZ6vxVGvyJYEj2IXo5JTrShLvdjNSPVFsciLvaMYS0Se5lSX -OqbzWmXQJodHWxUSVyN8pJv7aERFGAFul6Zxe5CmSq6OkH3z6I8RyJcnVIOuvQnv -ARH6ztvK7tBNfVHxolwRdX5yKAaBXBrKxQ2mSkC80BAP/RCRWd7pIMQXdcu7lO3D -R/kD19hlgIToDDc55vTbgmogBNiWslr0TY1ftdNOCSbINMlhULLaeTTexYMN1TUr -8nqI4ETgWSY+6Fu1XIlVGBKRBcRHKgvAKNhCA7dGMM2t6BDNvBKkvXE0rkGv4I5H -sTbcQt0slItCwzKfXq2kmSk3OzD0w1bqC7Y75FpW3pNYJ1EFq4gk2dGnSQ== -=n4dg ------END PGP PUBLIC KEY BLOCK----- diff --git a/papers.md b/papers.md index 52f0546..7ed1cb1 100644 --- a/papers.md +++ b/papers.md @@ -4,50 +4,13 @@ title: Papers & Projects permalink: /papers/ --- -Below is a list of select papers and projects I have authored (or co-authored) -over the past ~10 years, sorted by topic, and in inverse chronoloigical order. +I don't have a list of select papers and projects I have authored (or co-authored) +over the past ~20 years, sorted by topic, and in inverse chronoloigical order. -Qubes OS and Security through Compartmentalization (defensive work) --------------------------------------------------------------------- +The reason is that when I was at high school I red that all the science +is evolved by the 1% of the people that knows about it, and they have no time +to decently document their works. +Another 25% can understand those works and spend their time to write documents. +Another 70% take advantage of those documents to actually do something useful. +The remaining 104% destroys science. -* _Qubes OS_ (generally), 2010-2015, [website](https://www.qubes-os.org/) -* _Software compartmentalization vs. physical separation_, 2014, [paper](http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) -* _Converting untrusted PDFs into trusted ones: The Qubes Way_, 2013, [post](http://blog.invisiblethings.org/2013/02/21/converting-untrusted-pdfs-into-trusted.html) -* _Playing with Qubes Networking for Fun and Profit_, 2011, [post](http://blog.invisiblethings.org/2011/09/28/playing-with-qubes-networking-for-fun.html) -* _Anti Evil Maid_, 2011, [post](http://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html), [code](https://github.com/QubesOS/qubes-antievilmaid) -* _USB Security Challenges_, 2011, [post](http://blog.invisiblethings.org/2011/05/31/usb-security-challenges.html) -* _Disposable VMs_, 2010, [post](http://blog.invisiblethings.org/2010/06/01/disposable-vms.html) -* _Qubes OS Architecture_, 2010, [paper](http://files.qubes-os.org/files/doc/arch-spec-0.3.pdf) -* _Running Vista Every Day! (Poorman's compartmentalization on MS Windows)_, - 2006, [article](http://blog.invisiblethings.org/2007/02/04/running-vista-every-day.html) - - -Trusted Computing & Virtualization (attacks mostly) ----------------------------------------------------- - -* _Exploring new lands on Intel CPUs (SINIT code execution hijacking)_, 2011, [post](http://blog.invisiblethings.org/2011/12/06/exploring-new-lands-on-intel-cpus-sinit.html), [paper](http://www.invisiblethingslab.com/resources/2011/Attacking_Intel_TXT_via_SINIT_hijacking.pdf) -* _Following the White Rabbit: Software Attacks Against Intel VT-d_, 2011, [paper](http://blog.invisiblethings.org/2011/05/13/following-white-rabbit-software-attacks.html) -* _Another Way to Circumvent Intel® Trusted Execution Technology_, 2009, [paper](http://invisiblethingslab.com/resources/misc09/Another%20TXT%20Attack.pdf) -* _Virtualization (In)Security Traning at Black Hat_, 2009, [agenda](http://invisiblethingslab.com/resources/training_virtsec/VirtSecTraining-Agenda-0.9.pdf) -* _Attacking Intel® Trusted Execution Technology_, 2009, [paper](http://invisiblethingslab.com/resources/bh09dc/Attacking%20Intel%20TXT%20-%20paper.pdf), [post](http://blog.invisiblethings.org/2009/01/05/attacking-intel-trusted-execution.html) -* _Bluepilling the Xen Hypervisor_, 2008, [slides](http://invisiblethingslab.com/resources/bh08/part3.pdf), [post](http://blog.invisiblethings.org/2008/08/08/our-xen-0wning-trilogy-highlights.html) -* _Detecting & Preventing the Xen Hypervisor Subversions_, 2008, [slides](http://invisiblethingslab.com/resources/bh08/part2-full.pdf) [post](http://blog.invisiblethings.org/2008/08/08/our-xen-0wning-trilogy-highlights.html) -* _Security Challenges in Virtualized Environments_, 2008, [slides](http://www.invisiblethingslab.com/resources/rsa08/Security%20Challanges%20in%20Virtualized%20Enviroments%20-%20RSA2008.pdf) - - -Rootkits and Stealth Malware (offensive and defensive work) ------------------------------------------------------------ - -* _Evil Maid goes after TrueCrypt!_, 2009, [post](http://blog.invisiblethings.org/2009/10/15/evil-maid-goes-after-truecrypt.html), [poc](http://invisiblethingslab.com/resources/evilmaid/evilmaidusb-1.01.img) -* _Attacking SMM Memory via Intel® CPU Cache Poisoning_, 2009, [paper](http://invisiblethingslab.com/resources/misc09/smm_cache_fun.pdf), -* _Understanding Stealth Malware Training at Black Hat_, 2007, [post](http://blog.invisiblethings.org/2007/04/20/understanding-stealth-malware.html) -* _Beyond The CPU: Cheating Hardware Based RAM Forensics_, 2007, [paper](TODO), [post](http://blog.invisiblethings.org/2007/01/20/beyond-cpu-cheating-hardware-based-ram.html) -* _IsGameOver() Anyone?_, 2007, [slides](http://invisiblethingslab.com/resources/bh07/IsGameOver.pdf) -* _Subverting Vista Kernel for Fun and Profit (incl. introduction of Blue Pill)_, [post](http://blog.invisiblethings.org/2006/06/22/introducing-blue-pill.html), [slides](http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Rutkowska.pdf) -* _Introducing Stealth Malware Taxonomy_, 2006, [post](http://blog.invisiblethings.org/2006/11/24/introducing-stealth-malware-taxonomy.html), [paper](TODO) -* _Rootkit Hunting vs. Compromise Detection_, 2006, [slides](TODO) -* _System Virginity Verifier_, 2005, [slides](TODO) -* _Cross-view detection thoughts_, 2005, [article](TODO) -* _Implementation of Passive Covert Channels in the Linux Kernel (NUSHU)_, 2004, [paper](TODO), [slides](TODO) -* _redpill... or how to detect VMM using (almost) one CPU instruction_, 2004, [paper](TODO) -* _Concepts for the Stealth Windows Rootkit (The Chameleon Project)_, 2003, [paper](TODO) diff --git a/resources/caspar.jpg b/resources/caspar.jpg deleted file mode 100644 index 971a644aea320af92001def989ce9706c3ef5d9f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 748511 zcmb5ViC0qF8#j)KibE!dQ+f>%j1#7!W_ry6MMS`2Fmo)yA@!OmbsKCFQUk<7L`Ab3 z4v?Bwnwr|A1}0{uW?d`lmQgnwytl!+%`e~gx86VCw^@tDVy|=dIs5FhpXW0?KWBbE z2H8=`(PWT`i3#X`AJESSpa_sD_ZRnnIw)1MRFWt&RWw|7<@8K`^K-U|C>l zf&zhICZ;fxpBj)m2xMx!*#Fx=|6c=}Ld?u9OrVxl#{Ttop#O~whM1aJfFWik;Kg8& zDI9|GH?t3Cam_t>0tEn!r@~F z4A~!Osuv!Ng?ZdCab;)vQ8#sKa~{G58(T20F+fI^`gmWv`EF#_8yX7iOkVznQskLW z+8=$`V~)1=hMzoCs)ZiL6Xb8i39wnwLmSp!R!PP+aqi(B`qt6gi)zNJQ$1}M9y|Wd zaf5V?{I;xtw%xS^SM!B&@CHmesO1*m?Wyb|8<#tXqT^c5lV@d2X!U_~qOpH-q! zq;i{3{$lg4<;OL0;wqSf3H1p<-Vr;?G7B1>Lg%$S>~BQHCpqBfG0|>$hEf4uq8W=m znHzh}&EAQ!{O)2_!j3V3bU`-u`fjPuTiTXZyvg5MAbpk2bWgHb%<$8|)Qw&r8?Ucs zBzQjfh$$a+b@2as+orfv=4WUyI~v<4I+(86w?-SvxA!&{byKHT*;Tc8 z*dzWLXSmOzZTeLwo(q6`2=fS}46;?rG7-d+qz9UFty^LIn3V#4RMp%uT)P%<&~vNf zl-4--)#heJp4*$4+e=$bdbXi=A@@g@HGpruryVrZEtQ3N6`}lZ_>K4xEw6=mxfS&9 z7?~6PY7US={^)g+4qrOgk4NF8Gtx(?EMmq_P!41)uEo*)A{%BAUjOALum_HuoTn}I zAEvKqUL1u{n1xfHpd81tU*UkjRMy(57Bs#HnE{ubz?HB3wZX#fOGSD+4JCbtnEEE$ z5}Vtpr5{Ica#k0~kL&`hHW`AZ&+1%`VC5@nk)9J}{VH#+SLs{66%v*rvuQVA-KwCnt2o$W`idf9G zz7(;;@}sAm2qwDNozbwm@aI}r$Ov*V&}S%mn#1}Il;S0HG}xA{Dp4 z98@ga;D>Ss^y%{Eu0jS1@Pe(%T^XtxS^h`%W-WYcgO=Vj9NzJ$Iv}ZIs5D-M{99(8 z;!n$;?eACY9YXEvWVhCMCZftxG1*IRUOp3RHCa^kyg`%jRed`dXl zoZX);mkbXQ(+ZbtI|nCyZIm3I5RGr^apqj8gIrZXqFjpZE9leSj;oXh49)vn>Y3)g z{kUQhUQ+28lvrajOTC-mwpYqt@Ur)Ru4pDH*YETMgJW>45racL!zrH(sev2#8-D>E znGI$7>Q;1lLaqike?*+|md5eW4ka!~@h;^i{~yswI9e;C?7n()A@X4(cKAi2NDIV= zq$^S1j(0}Bt(T45;S_hslF&7Xs|Cq?DqPqWBtPR3^Gz4e`FbZ9+Z*?|J|A5b?OoO*oMyM=Bp@2Z%4^+aDn~EuQjGu!A2Fm9 zAvv(>0>o{AAh@$8MJE&%h>#pVIRV~3hjDR+D<5)O>emTABnlU+AO+qG!&cVtk$8;f zkpwRf$dyF%L;VF&&4#-FRK0QHj#rM!wC^n_e{TkfHDngxTq~;xeh4(0y`;x4AP;;X z97bDyM4myzcHt2DrhzI6GoAV4(o54-`fOon>`#!^wW%l?{H}}CLiAaM+#+lwCrelA zFB?=Dwa7D6B5odS4R^g`{tq?5O&KjFrtYU88cC7Ud~4YwtlM^i#;+T6iE=m*&FlfQ zZ-5sz334KIE052mM`eti4VnOrMU(d!s&_>uM)Wq5P8J~7&HMq>ztnnn+(_Ed40E{w zxM@0i@OH*IM03#`{gJtbp~^~xlfKC3&RP~%B!NhYFn$U;(>6#+c~+vKn~=0&#y+G<~?jO&>^lc!US%Vt*dVoV?R^kr?WUO>MbvB{Q5v zqLQUdVb$E>hlnoxkoR@8;}}UEaTL9H`pSm1mH#DdlDE585M6ZMi`U>1A?mP}B12hd ziN&`GQvqk8VRVW4-LG~` z=7v(Nm9bE6^T{{-M&Cx1Jd)EKh$j?$%Jx`L-UCWC>&JGFQV-idamnH!Jzd+R$LD?A99tn-G5*xzIl zDHwa$aAn1-&7FQ1%}mdXj!n>Zf5Oz7V}UKtt3NxmxIab@XB0F1BxbA5zaf;5+Fw8{ z;-dnz_TQ$yNEuNBhK|vRW&W2|xyvB}ra>N2tK15BjkX6aI;w&QU>*bhR4+k2j~*p# z6*vDn4LT}S=VdZ+OmWiqfHcq~P$^&EE|c!MFQ}=A#!C5!$%8%g=6!an0HSwP;LPJJ zpmygedygl)_@AKP!$acbX#&fNYhnzle)52cIG2GZqfU-(zF}I&an2{K)3Y5X3+2y~ zJE`P~sT(*(#7ojGJEBW%cveyH0`M-zt?35^Zimh*{URmQ4f|BgQJD)UK22qYPFHle zGEALS9`Kt6ho&4%E(|;~XyQJjEcglHDJA_%&z#zwUeEb`!p5RL@>{X8RUcQ!>8{S= z@DWqx8abtzjFLC+b1XyTo4G_xANvuOery4`Y3&DNiiIThi7h;-apJtn%-xdqh<|=1&F}l%VYlhW zWES+49e+`&KSOZhJ>i|0bC#xu9~USwyzCC8J;y8gWd`U&;lbH3|2dektS{Ia~* zd=KWyrH4D|B zOBx%Bk~GUHow33K05iZei9Li!%ZuLfS#8fJ`eJ{AR{nACbP z>nEtWFOqTGHuL0Y14i-C42Z;z1-C(~nN*?(p6eMk`)|zB^Bs#8Fxw}33pWXZ??XLa z$2enhkLtU&#G@>Q)R`p-JJmpjuyx(BEGUl_+96{W6*6(T5pnl>_r>b_O6;-vnlJU2 zT81kSX9CYxL^4OsIx+ar240IK;VdTfG(vwG5#pmtJno$rIgHM1nIW8%u|m94?V)O< zeb=l*Fhqs;vm%i%hV>c-t5-oA%~8sLBDrc>e)<`Y<^D<X zHM4u1Kr}FhlRMYH@@=R0!GY}i=j;#3HpQXhp3D>Ey8$NcC2b3}sW|iG7DI>mQMBqs zjEf_X2kwXbjlh z`BJ$FRes01$M0Dkb4?Wyc#7MQzJz<0M-T9SL+c5xgg!LprhkX|r2(bU$3W%PO37%k zoqzl}I17%dgg)=9{i6hID4Az=aQ_B@VH^OWtmTv zf5`8V0U5b=#NRJUov2x;s@5o_^?gO%b88+U2-zi7FTE5qJD@FtL`m%YMZgjN+U1Bw z+{#~B@?7eg>6ps3#^CJbJ)N3QoDuhr4g^#4Sg37yOmNzk6 zjwnfo9nG6nMAa3MouXksUbrTmO}k%v`8vZpI`EB{^~dAJjfBaJVzHJ;!`AQ;bf(a8 zYBm#l|D>m$gk=me^n02&mwaj))VCX-(I9;MnO&@RVVv;ZbRDdG^p?u8pr5b>HZ^<;U4;bXS+1CTMz!(L?;B+>^+o6asn zBp%9i^78o>s}Vnvt7NrrtSmKKE#X-L$P*nvAPJj0`^=xj4xXk4SwZJFh#~)&n1v2K zv8P8q;GL+;5Kr7hP_K&dF6xpgx@TS%g4SF!`+e!9z>ZEk=FS&9I@|RLk5$zwTyZJW z?3SP@)kS4@7;)p_4#)Kbp+@ZFW#4MLC+Po!O46{q5Qh63BR&^xM~L3;4TkALz4g$4K8m! z^dq|yP9=^(dt7U%sQplTp|U#F4D1r)ePw{-Uqh{`hT)nOoeL-i(M}=Rkn?-s^1X~Y zEh<%TF?D%H2u}=om*SXZSv5sXIgBCNjZdum*gCZIWoGMGPTsmWWLZnx;_2E#whbe4 zC{KA;h3t+7$7wo9%^_YT`gvj`y{l_}`s$~4>#^|-=3eR`c;M*BVAjsy*EM^;r+VR%zcIXaVtwaKfyQpYVnqDeOp)jxgs&c zS)Kd%5!OdDEW}oPRQXO7&m>IqsliP?ySzNE$ygFKKQjyK!a*Y>>S}ZM<~*-Bt^hHK zP6HZB=FwXQE1OYB96me^dWBMMeInL$swpDG__kJ8lr}OR2@c7S{E_`SIA{YS-EUWlLV;J zZdE3Wig6nXEH{ICZo}XYdslp^v{^4OhLYB62)hSdH(aikka-K6tY)qXu~L?tgV^y# ztAESyLaV0DujIX;5WHwjX2+MO?b(vkkR;fIF@abmkQfFNSJkvIWBOdgI#i86;psFV zQ1geDvg#ps+-l{B?|t-gn#SiM~1+c1UavK5Tj&j<{ET zbsNjv)dJDGJ@BA-nbxtXnCyA~q&o?El2 zKSkUaGa!zi7sQXM732r<&n=5wWzvVHm=__WY%P)h94nVcEA5RVXrDYs&@<7skW%7{p+OvuWV(6_7Pyl|&*5M%_j!5;@*4Zz>Pqwo}OG%X}K2@i{>!eQ*llX0| z*cvW6Y}6Kf#c9qh`2NwKpv2-QsXY6-ENEkTm~K0!GsL;^FPX2H`-0XTg*`Q~YnDjd6g<~zAoweDn0I!kT4hE}3GIfp?m#3$Gya1xana{(T1?kH^&Q?djb?mA+YI6AWI>$(7!;xbS zkRo$f2M>MeS)B{z* zmG5p&+hpvkT=Z0yKyP$Za&rDz&$7}J0lF2I_h5oGDyq<*d>Ck%>`&bYAI}48O&=X| z69A;9oHT^aF{;%`xPYYYwz`{juHSF)jl*Z%0qQHJvh;9vIkr8p&TwzES#o>PA64Ynmw7V9Fi>19N;nn7s3_N+(XBr( zT22}){TjP|t3B$2l4SlY{JeGS^|l-{=--0hn(F1(a1OrTsy=k?n&zMAU-4BW%#*gP z6Ic(3AbxHrO8wVZ17*naiI|H$;{JpU4_WTGTIx3(WF@kE7C7_B^72h;PgZXlE)u_K zqgQcgq`iOnScF3#P~#pg+@rc8lUrxxbLB=FrliYI`hBb@F0uN*HpgsIFf1}oFz6oL z%$%o&n}?{~(lAPw$I%V&n-qy%q>q&;RMQ+K!+gdRk@2*`9?k^~x(+^C9D5B;IFVSA zwe~sR!{#<6Bt1IHRqOnHR;oJQR^ns1TQ3B-eCu>YX_~%zF1a1z*tpvuKpi!bW_uX{ zMai(Gud6>tGlT{|Gn0c*3ah-e3^#S{{e~jv1>m_~%or4BwcxFJZGvNjrSUjJbm23z ztw5yj`;j|DYw4z9`?b$&FGPEvjxD(xX=d)UynyOytKwKb&+-aVSL{$fv$XP--LN0L za$nv#M}Okh&c=O?45XKJ(s{M}m)El-pT&2dTo^W_N0(~DPBn*kh@sW?F~y{EZzy$| zoRBC9s84N)AHoWke2=_B0-YtA4U3$jW=;a{Jjn4k6Ir9|T?M4w(aziklvj9N*rVn~ zfwYi0z}2pTF$YrGq|am>%>6A@Q^;6n&47H2Ih4f-@j6knM}KlH-Wbxu54|KDZ*e9Q z(reT^m6`wGZX?1+;jCAXVe@}h)`9t-FwYgaKCQ@hRMqu}f_bJJ72Ue6ZF$-*>*~~a zcr)7HAiwaR8s57-A?!R1<;%;a1>Q^%#8Wo-EylrY4IPKW^IDZ$v(?6gRRuV;f(XK5 z_F^K2SD*!-$2FG@KVU&(}*c;B=tliOm(jCZ?4)_0zsxU)VMlD?PZsgcs+1kqT-xP`Um$kJ$S*(gb4Sn7)|3mCgv8E87v0cs~3H)0%Y; zyTmGc?`Lm#GaTiM_L9ry!Z)1 z+_YHDlA3Q;nc;iD|75AoepV(LGRv<*>pN&;hN~jGjHzSOr8b9Eb}#x@%(nd1M#&P| zsdE=$kL!;4%beHhoVLfTK8&#OL#K|OrAHd0?FZG`=WT`Yxud1g+rCvEJjrDhZwz@8 z{C!rHzdQj(yCaJtp9GA69M3G#wCE2B)L_?4IqxMsVizl+Fr8mEq24T1oGEXmY(iqXwWmJiWlM&bFNc`Z( zbvL8QUz>R8pj#cRn=0q}vvGrG3B&W0+M@CnyWZ%dpOxmoVPI5F+IM{ewCTT-ACz1q zb)#4JPGn|jOU3^>63gy)ug!l>3i`vKx=BP zW+AAr7CCQXh*{q#bq$DjT7WPhw;Xd;J4YeHBPB8;#J+nS;TQ+DKxlcrv+27yyrh0L zu$^|#p>BAVS{y7D``Av?#CJqHRi4mmh-=@bhJU$^H}{Uj>hPNY+TCu5#eC#j*GhVE z>|#=id%rdyFr5 zw-Kjc)(pm?dh@B69dW6wtj|k({7PCI)BC#_ zt4r^IxlEwV;hRiqDeqH1O`R>ne$p|*<4CgJy3O~%^00?GO2@21rg@6C_LL6!{b<%& zvwBepN^e`EvY}`7S3Q;&pw}sWg6dfE!b-~|glgN$%<_BjlncU!%W}Kxb$I`P3NOhy z@-z)k_zRtPOs%=J(f7_5)IOi2HekOl_uHK^J>Tw@!;wO!Pr70|?WGx6NB?-1eUz#w z!i9hzpWGH8j-pP;x9q5bas>GJ=bSZYdHXqZ5*Blm&^Ge;$&G-U6^J9VB%2VcxWR!i zU1|AD6II%n9+;(Yu9h4lk@r{qY}KYx1av03_L96|q&L2!BF9c*As3 zrq8qR=&Qb^^BdhZ%DVQ|+i!6~^0D%<-P`-|8D@&BMg=2}g=6?@{qE_TS3KdmxfF=M z8|q8B{Nxi4*N>0BN)&m=HlRy3}5Y`B@T zkbN_{SZMy??0xqZWnN!3a_Yxi@|y7~iymM7>eJ*WyRUsl7IlrXZSvU_RD2I2_Y#ob zX}S$gXS^USn}OmiA)a;CI6GYFPQixov4xP7RAp8T0(#w#>R*%7tQKTAa3lrnq7jac zL7f>gMLcyzZY>w)cYbxSm=Fj^X}M&8G%lXRG53^seqV8rCt0$+a~!<#7EU zLt%fU<=nw~c~uP_-cjMasp@8fS+&$|LFLsCPN>y$6-Vx1!LNh8;PwEIUGo!!UevF2 z^OxmGW3m4NfLxUWA{8|llibKcPIu-mKswsdy&=o@Wz4p~VK+~-%4LNO>R=|tn;g`L znWM%bQcj^ z;?g&l@cXZ?G(+~|)69a$yZZf%w~OhxUC8jylA@B?Fb`x1XA%vb)d|Xwd;TLKhBxlo)pw@$2Mb zRxM&Iyyf2ZM83%w8oSugYAX3V2eZc_Z}`Fgyot zh!SFSzXfV{>*WG4AFw;@5MCUYmSDKWb7-Fn|10jvX|Y$<*l^%gkb}8g_$%A;K|M>f zmu+_#PWD>2P!Ks;D}$b%tzMO!(+z%U-9@qMt8{3}?y!d60MhC>a{zLH=qUSMb8n(0 z{uA)Vd|&k}q{J5U4E?BiuxTejA@H>8Hw}R^$9{8c{s{`CG|FQj@lD>G+C-pq=<;;X zgbCdrt=ail1op4_?B%S2cN0w|g4y|`Q-RBLko}^}JvDQ&y#Xbs?D^L+J;e!bEJ^-K zT5$W_7qiPVz_9?g+69QWHwM}@mW>G*`+&H=@g?^CE55N2;BaV3Zw1WLda(}t%P`O@ z1`5u;Bk;QIlGSx_t;1%hepl6K#g=|=pG%H9=gd*i1(`u!Y8%Zc=$$3M+zp3*f$gcr zQ=f0<`XMSt{5F?;+?&e7Tr^lf`@&#>Be_}0rK8PZl&XhVXm#eXKhaH98b#wq zF^Ig%3-=G<|~xuL|5k$(F~AsLl)yN85d6zWNRnpLWM~ zk6gE3`aWupK_Qr@co7oDrkma6H+R-CLr*)Tmh`JouZV~~&#I4YupJoB zr9AF6Z$=!(v&tZsJk0{uS;FpPYr+$XPZK^iEo~kB0#IsXesAgX|8C5=Zud_1 zo34LP`$2Jk+zt=Vsx6k4J1{JrRyH-li#M`VlPrO|AtQ=p9$`{tL#a-gVj$EbxH1Lm8<0nO}L4e%NGjomoqpx)@Vjx zco>W6@q$RZ`9TYJ)?sVYWX(1{2}O42TLa7P3qsOiY`5z4cFpdlojZrjf^|5atu<&f z54u|yxHvGPA4D+rpFwE1&hn^+FB?+1;K$k9#IC{51;IQzktBYFl6;Ro`B_OgZI@_c zp0jJG*Bjz4*($3C2`+y`Q;^I5I93w4uiwJK#@DSfQ@-tzQ_AmSLoS&jw_K7sSnYf* zbbx^^W%o0Wp{eOx=3{momdL^Tx1japaJgW0&EM#}`UA}mI=e@JEjyZW{GB^EX*{E@ zcJ}Q{wosIKdRbiZf2g=N*e;BnCyH^%5lFrktp4T`O#!F0z3qd19`!>K zvE6SSz6Y`~A!iG|7%s8JUPTnML`Op~`At}5UZg_eM;nw04Mzq^OT5t4kyjlkOCc)k z^D@7haF#vcJCK~z(05;0voch;HO_?`FFQ`;Oe;v?9~M7S9C9`EhUPh0H;Sm=7zAO2 zz!?*`ipwpMH)7`m*sCJ?1Vj2r-tqk8zQ*&B-agIi-xEH4$4b4-?S;?zBXDX8tbdVY zdKR)4P1g);uzKdNDXK2wcvpk~pKO8R`QbYtk>Z205SFV}(1*aoPM9mLwh)gW6*RQ?TuqJ@Ifdd@$OtG6gE8$P+SHkxg6Dj7!5rZ!+A&y% zeF};9G&r}4;3^q4Ayo(_ufo8AR6&os98~pZVtd#gt6N52!DzdNae%k+aWzUoc2RNy zuNI`MJ^spB2G-_TFMiajZwgq0?g-tp+^7_VXNksu)JeoO^u!5_eHRvQB&DxIdV2%` zu12`xa!&leeX+?DHxb#BC0=C}C51!E0m>+a4NDTXq}I4ofPbTPv3om-K{xJg61gU) z^Izy7zhJvW*Tqnu7_cM+(-+kWVvmsICvkU>kZ4LepM<1V*MttR=@Q`D&FC9fG9?>+7afOim zKc?4(3ygaMb1YpT;JIA_l4V?&?3iK*Joey5prph*6RRjXwP<8{hR2}O>kEGxtnUkW z-=xf!vD6eOqH~D)sDu?-F(cTH#5okJfxW5nEk;!;^XqNPe<5A9xS;86x=ewG>l?O< zrISaT(ZmGom~HkwiSai&z3k41%HLx+naGp1$qHkZ{&m9am6-E_QlCrc=w{X5Ufcj? z05|+9k~512E1m2e{C)lPd%Qf3zrY5i@v@1yG)p7AmKEKT`$xWeLk(-IIoi5`)2Fx@ zQOI50r$Pk|zo_a=L2xc+`pc{#r(sE3Tiia5D zt`5)_pO_(VfHuf;`ozU`j%=NC0bOr%WuE$+!4C5??#;ZHiIdKp3Sx|A^!4_p-b{D;OTJhzHfJWRYZkBuF3 zZd+f^l2fM=7b#t36*h&^xY?ZT^J4S7AKAjfsgYL>Xm^8E@GRxJoI#Eprg*$cD3U{C zz-(C_z`?3bI{%1M){A#y;RG|hmn?D0O4rN8R z)PJ>!lh>#Hr}BXV7^OcoPR6w^f$-?o+Y)o5#7sq1YvZz;IHG{{wbF_Hqd7dH4qC%W zJO+t)N3_)CiR6;XbqSc_vcU8Cu}j!dIM&w#nya5Ye-GEN5xS_miZsm|c4>>}pJFc$ zeKlJfG+jzQI~ev-0XGLr`gEQ>OVAr*AebD;b-$R5+a;>N+L_9&=V1&Pt`U%u`&aqwD zTLk(=2V+{gUgZ%gY_pDHikuriZx$yR&7J* zUtx4P)l0LD5ldcUxPl%&u!W)I2HP&*xy6C&eg`kQr*ni1M1ps!V2?XonPwgzWj=Fa zR_!M*qtmRG$hecO!1*CS%o>5pGW#)XPgx78Uf+>u+uIKZ0$Mpj1w=w zW;P`G$a{Qbv434)W=eFitwH5BwDPSxcHC^yX+tJ<0Swu#gF_luR|UBG8}(sfSLD!+ zicA-Ae9^3ePQE%SJ4!s2Pz=4UV!N8qb7OFOV`uZH6dz>u>(?&y_&uDbZnXK89TRZ) z_nO5y*+$L!Fd}?kO^|h0UG@V+^K>3!(QLVJ(lr;-upNq>rm=3Fz>gC%mI+*)+=dql(_)MR+ffjorZeLJ=iMaCk z6HSQ8P_`2Tc?4!l%|#T#+@Ho&>1EYSS*qJ_YQy=lakj&M89MA>+-$yPXJee6(nSHd zb%S_`8MdDKjZOZgl~UZ9c<(qqv;ed1rH|^r`X-#EbNzlDX})_y18hzfFX0jP9+(b~ z!#um;_pGGF8q!X>_7lVkAp#KJq*G=iP~Nm{yqCAK(=2!IR>E;jRcBB$3q6H>d=3<{ zIj6zpYwXhyg0O<{3 z*eJn6w!mVqIjeXdEElhBjcaijb%Cl+Ox55!xi(>B`OzNJY=_okhRkzuEOAn^;>dgj z5hA{QUPZMcrKUtvd9kpMs=;=&H8#O)O->E173O}WC$7CWRS;~$tuw`~n~p+H&+gy+ zGA9lEMBHrxTgtoZBvH%B8!Ob_+t8O<^sHpc^waOsIB~*LG?Ug5Xw$Dunx= zt)S=X$lt}~C*t+z<2GeCeV?kC^~#mM;C!86ep+s8nY+3&V%4jtJ%W05`J-nIhjGPR zc>{WVONIU5kvpbu58ToNVwhz5NmcKMHqDdLw`9|7W%?rh702~d^y&I4>r=Y|8{;0y zjm*?>yfHY$%_`1N<7#rS&3KX!h5tRIc@aOmbaiX4I9>TTQ<}6+Ovu9pN6^ zatR#t1>r}#9NoP84Z8OUZcFf^oHSgO>xf~|oEZltK|HXx z+;NIl)M6E;Ig${KFO&)OZJtEey>d!kPvWDTj6AQNbHCO?7YDcA`>b}=xf1LAI$w}% zXy}K}`C}gz$&dvGMZ>6UIGlgX-AamXLeRc8<&*DFZ0`}Ko(oU(M1aOiHLw$jD|$`Q zc0&1EIH9)|8U6ybwiekL2iRmrQ}$r&R!f>&uVDrr0?y`GXX`y)KJBvSodPG{J6~ZQ z^n2QiJ_#L@2cm`IuuXD0o$(k#b^@5>VOMtHJKDS$`a~C}Yz}ML2D==6xw}^r6UgYC ztse9?Zk4HZ0lGji{O=qV%%I>n$Cx1|u8IieYgBm4O^1C+|H&p!yUTzHIgGg|zp*~HCU(-<|n0c|Ei z7U!FYR}lt%)=-cx3Hd4y-yBXgw87&s_J*Bf85)7+D^sAxwQ!hc|Hxj26>JJH2#VX~ ztOsH}qaVL`AFJ9gCO1vTwIXn%i@#6-$_fJC5(zC1(LwBPkz64L)+R`<-rC@5|l4BO4~s!FcyOp@gj!9_osM zelWAgS-IB?!9f8OE|C0M%W{0zPhK7O!t^tyLPXNy5q?zkzG_qXeX2wgvPGT~9gU8u&+xB1W6Z%=bLm-5QUP-jfu>)R=F z4uay<#Z#KzQ7LA;5@GFvvxiIH#pP0$r_Crb(;Q6FmW6JBz(tDunAF8QtHm8oGUmnY zQCW4S5KG#$!2QFjJgoEKX+Od}G4ml##{v~d4!35SxX3J~6_WHIcq#{EJoSw`!xdvv?&?hmciza^>NYcctpoE1-GtV^5QvBPtEn6ydm(*sb_jIml)Zvye9 z8S`)P1J*5=VA=w;S~fO)6NKpsQCcNW%__E>FIcQ{^xV-k0v!FU@(qV58IZKM2d;lb z?UR+?Yn+~4p6-XsBdB>ZQV}Y@DTgzrNyx5a;r*pxe0Z%yR*@W}My)Ahov(Vvv)YBJ zxsr>^v<(& zrY`jr^Iz?}FE?+(mfur(5+)T5{bM1Rhe*1=^>e;(jl3y!!HV;pBAJNk|H^hK(H|25 z60ycHw=B1>aX(nDc0?IBH?!dTte6X5Sd#Bp{&xyEkoFbRw-rU#{{)>fYGDue85Cs_ zmN138<%~p|Y35U`S>_|ZnD(tQ^Do}a3wvOvQ49aKpfhNHYnb<WcjS&f#RGal{_u|1~}M*kNBm>4*`|NLJvOHL7jx-mnK+@62i)Qf+p>5@sUYDu!mp zfmh&rR`l`W>%sQG5@_DVtz=W9wC_$C$^>upLW#EU6vG=;z%OqTP6dvSI5!NRZ(X5F z_>2fM)Tp> zb_j_p@MWF7y_OfOmp4aX^%7z1vZ&pAWy1F>qYwVR_GOB=cgevzbL8;@cKoVIMpyX^ zviJ&uf%?bSxc6{Hn&o`QK0p4~rdiX_ai(H8Gwa12xV5FV2|67GD;MpXye;u_<3y^T~eRr=Ud zY?ac_?apJnUZU2#*SV@)u8UdF8YqPgCS)MI$bo;0S;)9ll9CW~Im#}vAPCI>8HfM8ep(WPJ4%&}e zn@Y>!f8J3~hsNiQi>Dp5d$fM{S?p(l3+BekD(xQG$=Px~jCsL9QDWIpC88WJKZ&?n z=YN$7z><&6VbOUKnCUkLi7DX7_g0uZlUWY-9oIE|{9PHY ze?$07>!R{)^&9_(Y&3;fZ>UQSm5t5IwV%#te*5=u1>E}0+!rZk>!`hVqhQOo+qPH$ zBY9eA-sKtSq~}YzHn)NIga;W!OAE8!8!hyLvx^6?7p-v{tesm2RpaLfOBl5#_ z=8ofyqB{-Dsp72%pEqnDu?^4x3HeC63aZBGb|vz#Lq-8#45@L?u}i40q`iysK23ds z#N6fgZ6_`|M<^!0l7caEHq2yaQ*Sn{0bDV@opv~IW-*HeGFG&V9x-U^{)hu-K6kb< zf62aBVp6d@$Wa%&6Rb&>=K^9YUiS+6nzFdk`B?j2Lr2vlM0K}e;Os*_P?3`33ihZ$ zXt=8C1=g-FzaaJP}i0e}x@1oVPjPdoTHzNuAY!I})%TIvFEyaK+>7 z=ttrTsO;I6_(y`@251F+NpE8I=%Xp~7^2Tit72ps$Qv#kKVuZ5a0SH8_q%}|o`0e* ze`Qq^xFB=?OBO7gnLdK_{x(%}5`A~%&VQ>J{?Yj+vB2Kg5h}=E&JublK4@`!_P2FI z_IVgx$O7#;x5_xxRL_dXt1GFmDtCS8unK-89IP12g3Te;IX8R4*)T)>P->>BSk`Ov7I(l+V^P+3$WR$$IZu3Kv z^z=AY)x%2^qkxAyi?BkY6I3r>68}fdX8IGZhHSDFp4K{vlA*ovjb>fiRsXd<`@K!p zd!3nG;rtVHpD#a6UqM%`^beSY6OHk2JykJ#N^9}>qr)g%zzl7Gs?QqzwMLI~=J?>5 z5Krr_hyvVaWalR8F0uLa%-)ItW8tr^7|9|%ORp@rk>||xu5=8x>Br;;3$0E~DxVEv)xnej;vh_O!aD<998`cwUdC+#`$^z!a zoMi>fHy#wqm=0wIpRL=7k-`#C80G(}IVB=s<@836{?hPvJD&@cc0WN%kxKEUa{c?{ zg{dyiK;qM@!zbgHHx>+V7T^|gwz1kb zF*~#1in#vZ%J9%wL)hrmo#`jx@VGoQo{iI)7#(O!TfxZ$xSUG?2gv+!QyM>=p8{+Z z;u3GU|F0aTdusJBnM%gGnTkl5-3{+>j9W$iOh@0g$QIvAD^%HSmVCKGi)vpac$p55 zU{%xVM?hUC5K}!tc=qm_L0XFISWYo-_*u}PurQj1mWW@#MG5Gpiu5{117FTWlA2R+ z3kMF$eCIZZk7x?veQ`}Ud@L!5?hHQWLXA%^JL|s9)`!R2#Jw!) z$rVpGL#zZl_3BL}{Nm}+uWZ7IVO<&`JnaQN%*6|M(<-dcrPuwF$8r)9>rzkC#cm=K{D#G zwCDVT`g2L8NcN}_I8!yZ>8Qy@SR2ca2Bz&w(G?5D=D+P{m$+K3Z8h_;6#9_XH#l!* zS%qV`0d5So;T*VPmR~GHmeHCkDN%yzoD3N^z}tF`n3AuyujM$Xn`RVI4G6P7}OKjSHRY8oB;MBhRgh^jJB1j(YHhYwu&ZIt|qycb<%g zq4#w4b-bZLtE$!8-r}XLcbC8(%X!0h!h@>>HS%{3r*Ji?csR`_kIsI1US+z?`TtOK z?(t0b?;mGIGl#Yr5ovbNW=_NHaCf*jHfBaU$SK4^EQGo%?hdxlw&t)kj8tM<6y=yh zxf7e5DoNcXb(f|)7581Y>hAdceSZJ?$2@%YdB3mgdcK}l%gh?0p{*1pd>w{Hgs;j= zm>zP}AC#bRP8UU2eMMTjEJ58O6KRCa5 zO&%g>4&5zG6@J%W2j4koydSD_x*dA-j{(n#a|Bb&uM{tHcjVn4qnW)3s5bd>RYuVr zW5-v{nIbbuAtXNVl=P_F``Y}8#)7uE12oba1M-lcIly~axpstMDnwuaIcS6zRV6_u z#(bN>8-`%_X|7pfn@>e_1`7gB-Zq}(TreAEbe~>5juJfD9Xk;6$7wn zqYJeja)Z_zRJy8*4AnPQs|{;UzwZL3Uz_AFM(C#hGq}%WQ3smp%mP9||1%iw1Aa19 zaFk<{wD$*}XKWwpIqv<_*RiOUB5&I{fe>%cU~|SGpnHI#|zqt@@FRqAwpWBU-8)C>-;%Ni0i$rlI^)nZz+l( zpyoSQf8@&Y!q?y0nHy@SnWrkqKUW0y%-YsByt|S?&DUTm+hYv<)5O2ALL?^d$qz;{ zj?Yx#p=m=f=QWT|{aO(alkQrt$g+FCt?>Gc zA{D8PPOOa@3fnF&*U+V7K3{IwE$}_tod&j6LFN6XjZgTHD*w5vP4i6v2pCTT4f>~? zkQT5#_`5C1r8DoA!-&~nT|TZ?XS>p{tFg(pA3~s$@_s8Yp&t|C`<;!(f*~Ly^l^;En zMTev)%GMX9BU>fgC|~83suuhRLy6bw&wfeod5%~GE)WpN3{WR4*?W;&<6;Vq)NisW z@t9E*-P_LB%s}&4O-r_MwRgtATnevM<9LECdZvh&LCy<$vIfxKQ5dAnCYE=8ypn<+ z@$#`)Ajwf$j4j~_j#90LAOFC@3q~tgl}*3L)@y8T8JapvOAG`Ovujn)V)miGos8|t zrd#1#py<@RwD-#)SKo$JnF#7C_Hr#3on=V}>l=2a!x}w@jNDZnHRxzmJ|+^+&^JEj zbLO!%o&ESpUyL^;p&)uAP?T5OHHQD0$u8ei@f4zWLYf2$jKKFc1-O_W_klXEBh;ZP zO9`V??&`;-7k$8MoJC<^(~>kq&}sjVt%g3UcxZnpd#U1r-!FMvcjHH}sM=S0Mavjm z*@VnS&}5>+E(ak)`f2}XUfb81z#z>}9bnY>OO&v4`_2r#A0qUH2t7 z@s&dg$y*zg){l{qN+K@^IU|f4;yA(I49doPj9B@ku?)-98UJ@sulQ}`e(OC;tN>s~ z{Q*Fju%eB6Elp5W_h*Ra0~M_U)D^-#9U-MQI?ne4u5M4vX;$t4*n5erHF*aRo7-q< zksKiDH&MG`3XW_D5-JRTC-2wTG(5SPi*v}abH-f3;yYIUXK+qUaDhEZ#x0FmHL5;4 zSEm#c;G&NWQSXB-IX^NO&%?iygzUEVZSdA%i( z&}IE2uhZcllKQ+$;5X8anY|Crmw=Ny+NVS@ci%m@#l9#tav*0v+zmDN?7E z$%x9)Ifn*gEb_LtQ3|7EM$Id(x<;{Nm^Q-~aw{={2q1sVDoQtVpeC=(VNq1G9&|loHftiOB z;@C_ym60;j$*HH=N~dBjKm6!1w8c=D5Gc)c>Ra=HTEHIPmB;&fUtHREu5$sef#WML zq@9B%5M=5ccX@n+OB1Y};Y4u8JOe3GXkcjgI-vN^(Xlkf@RPokLQ`t-Eyt!uG(K@0qA1<>B3VkxJQ_Ao)3S zAcy3K_Hz?!7xT>nXRbyEA$6YU{y^ZtS@?bYr$!!6(Bl+ls4$R;LnOD1j&!MT?lZvK zsMqDL7v36Rgk-P5LwShyy@7}Nxk!q)`#(-HRPcPQX;ngV8^vJ4=g|k32a9y~a;(a< z&KFWm0epQl$7ysM^!We~;2$3-+DnSa#}L^XPFI<) z>y#>mHr;HbSLD|GK=XiEY$q4>uUnYu=)F7%bS6sk5@RG$R_wp9<~0{(J0~%+giQ9+ zY^D1P{hku=*0*EnyUX$fyw8+48jV1pWA5s#Fwvz6pteFvR9Eh(pxhuP9g_5hD zJ<;Jv17q`q6V?{@EQGbxgy!UhTZCW7^*gCwUm&kcU_0lPWkC`@@G;SE6;D|VZZ&`R z&ngKw{lyI4BZ81^c+2NbcZ~mRH7U||Hs$y_qZ_oMiN6`!+2P6h^9M2`QGZHs61G+d zJqBq2AG}yrCAJI=PI8gC_F!0l1BCW(X_^r@r15BF(II zK=?5QxWnjX1gAXIMwPF52Y?eGQN+rvlWk0u;oRHpxt9KD?U(z;TWfihJ@q_dXSZ=? zHd#7$r2d;-SO97lUg(TqhVVyEBR>N7#noLWcj&ALyeT`Ke3n4HGc7Dff2_}xS4d@tcqGZjD(y4WA@1QCgo(D( zG%xhD!7SGb2x%rZ6SKIO#TY}#b4jP?C!D^ z8h>+6SgIIfUhY9!2nBKj;igLWJ94vSigDwZQ9-!t7oF#Ke2-5WQhI~c2(Q6CL8Bd2 zWNhc!v}cF7Hf-`83FIDdt(JRu4LDYW2YhU`AW&ggj?=v2h<>>8?)DSl1kw88MMfZv z51Gv5ihRBRwuPaDW^vQaK0=I3lmj2EOt!<>Uu_WGN+6@st@`ya@Kw$;eH#5VDN(B1 zie8R9-W5s0ef=f|2V=z!d$*la1^dlb{ql(509~2>B4BXCeSo*(h9aVS(+ESd2LKQx7)2` z^OGhF$PRVcvFUxJcFDcjWz8Z3M`ErYGvblBRRCVH#0WsSck!-URXnM6CkjB%eAOLX z&yN}m7vqBjPIMCTy6WmlbLpP$@CgZ?fR>^KoydlW6^)DmvD_R=Yl>Iy6gz7Vw%%71 zpaD@A+h^Bo(@!0PDMI^JMl8l!3(Cd*x%lwBJ5X)(Gulr+>We>*vTR^349`|e_>n+4 zdb!}Nb+SLS;u`FU5 z;?C@EST8Sc5=Tbhb(kyg<*3qAu*6(AcV^KQ(!8%f|)~pN_Q_B{)DOt<>2_7 zt3H1Kqg(mz&5R>|x5wnR8>|Oz6mZFQf6Y~}jcjD1Vv9o3bGiru8sX8cssTW2XR_L+ zymoS}$(s~$Dx^uecj0yTp~#-C?kmSKQnBV(aV|Jn1Ub>{cug+-l114uS9o;`K{VVr zr}1_6_)nU2(a7|je0%=k#bER)$%EG^sd%-F0j&X&Hll=SDJj)GP;jhoE!br9D6E?t zy_sHAbV-t8`p?&GEe)PXow+gCaGA=q;hQNc?ZW`7JN=hs&f5RfcYJg(d-$OgL6|Li zEMg6Az*7rYUfO8;ZemSkIpEt!G)RE=jj@g*zT*c892PMkU z|Kl#0tOC95U-U;KEvMbX?&eJM$2{(F{Y8++v={t_w~#cl`2rRvnL6O?kjWs~hq~$kR!wRR4gj+9 zm7`XDCMDx{&xA@2M>R`%Esu&K4N{_WgU$lnM(#@erDviDAYQHs;kPqa{S>gZasb~o z{(Q{Cb}f%6e?+{W9yN47xhv@xPTd!-DXc8xTqi*Tw^b~0uMObg-r6dOwak-%QB7?i z!O@IozapUUggFHhK*~kI-%ch8tHPX+J#a#GT;ndoTV&R^t?fU(bI03{XtlpJbY}pA zbJy82Kj*?PY}-o7KSq^T>QAQDMLu`B`N1{9^-&li5)%u&3Y&i6gk;^E&x4oFD~~dE z;NQZwlZsCu5S>^{nkR+H(B8FA>r*v;sxO<-8rj3#82?J9Y_@RRUqXc-TaCTRXX40< zfWxm8WrdHpPGS6MjO`P_Fk5lyrZVIL>#TPBEy7Fo+H9WlgIEE$PwN&Ma#kx!&kF+3TPGi zHtcKQVEt>y2qIY}P{|LQG6;3(Dx3PFAL)C$!GB@N>H^5s>4~qXRIj!+rZfCCHVx;s z9o{lM@ji@DDsC6$0^_@8XU7E!LQ;q3gzt-VT@#q}BQzO5*SvmNIylQ){o{WIYOph2 z+E_3bg$#_E%#O4jhvo{C>!NJCoV`NFj+i2W4gqJ5ttJA7v(ZozGk>;YC^a`s5)=G6 zt{LNc!=vH8c}MDqak`pNIs9eY&xIUmLo2SDg4%-!U%xCEf!IWi=sWN?kq^%L#GG(7 zBcM9MXN6b&C8of!k3V?5ZnNAo-39iJVj(q3` z-Sn||w5Il|zde*ZLKz4*`6q`;RF8uuQjw?#6hHfvyM)Mi5~+F6M_P&?MfL`*d=O z=H+HW(QU6Y#9gXq70#LS)L^eA3UwLX7m>5f(z(6%07Olpo_e8UOvB`(xatdUSabdj zR4}96xY{~^!dZb8sdmQ}YxiUZmfqTfTC3Z6ViYr#nZLVWna6 z^s0HzN?hqMBWPOS_?UeUtO}NL+rBsbD=&ZAL{3N6yERMaTQHdxp+--SuZ0X|VNK_1 zHxNQW+8cI|Noz1UA9eg968ekU#xM~O;fd|i3SS$O&UypJ7*3B5lx9xhlKSs^Ii8EO zI^97DAosz}-N{qA>u6&jXz*hgHuMxtjs-F_tX;^}!E}rShivn);6tCrk?>ZiPPq|_P30FiRbZ@%;qDx||Jq~m`76OcXa z*Rj@>k7^8}n-oa2&A20}S?zOgDJV}L=1fY3`Sivh;=m}c+R{fCO%@-|DlTKqE6hm# zoVVeHk5<$GcA-~<;SqJbV<6%<{tB0ToDJoz5VFzHF2N6>@y14y>kpdR#4wl{d;C~`BxUn$NYIYxWRXP zW{8AsE3Id=`OJsrx$ASKca0pZVBq=$#(w&nWLjkoInoY9A_GxCRsnd@48E5 z%!Dmc2UB`%*iRHXAKZT$!Bw!%i(7~`a%hbmPsQ_^5$@^sVL!eVrbj%`Gm>O7?bQZ*dZRcrroC(?mDOn!qWS<%%m|+mvr}v z;pKUpja(agn?J^CiE8OPd+J-{=Xwq>iGKO7kB$$>3wZ zle#OQ<@P(!W>D2XuG>fs%iIrZXIqA=(g)yIAYCCp8H%v}s9Heb8#GNvxUXmMyou5% zzFGGkKJ*?VE!?D>4m#qOE{7ljkC@VpRU+T7QholIYgGT;I}kQ zVDr8`VAVPo?Kr8H&7|eUCK$yEdMArvrogH4ZeCDZaj&Q_D|m6-50P~-Pj1{)#s->n zLr;jUOhAJe8&mG{Hg2d2LvYzA1iN2DR3LeRMzAjRod?6@?lJ}5G6*yUHAcLs=YX`- z-E2DmDp*wW96El4w!Q2L2lA^%6rRAfYAXXgWeQ{r2_r*H|J!~zO8!$@wfo)h!dq^@ z`|D9%s&r%EEN5l5`6e9aW#7=JvSh&{(Px`MzT?ls5I}mb>9hqt?ick>8o|iF68~rY zuBxaC+SVr@FIWZ;9@o~?8HUx?98vRbFs~}!oIx^XB7mHX2L4kkh>KL`qL0MIs}Dt` z^Ew7MMp8{^`32j|e5Op(y1>5m5}V4=-g|4F3UUBCtTFFgBEAQ3R-w+O*XQb3?fuUg z8*)aVA@kp^&nPus4BV}l?}6W*1e*Ehv=#sVNB8(9!^mCxWZRKXYEaS_K7OuZSoF`M z=o6b6C*|Vp%d`_%x&!B?{mFo;bfJu##q}6oj;a$A_P37k4_Lf%{8kYC`uiQ@5*zZt zI6^CcSZF)XkhZsyc1{acP;`~Bu0=8!V|&3j3DCTzX_++RmTCgdi9`vG)%>Uv$4!#P zJk%a`DC!@ZBb331?qfD!oOBT;w!k^R=lg|*Ujwb|a731$Iiljs%bBrom2a*ruJZPf zd~+yWT6I1cT@_6sMY!bl+4Ag=?Z_cdWXGnXjAXJJc5Pm0P+ASxQ#X%x4B={{y=+~W z;X@ELimU=tudjJ~9ji(|7WSTcUdI#$`6LQXnN}3dA2+cHCxosKH0Y2(_3BURYJCq4 zXU_6VuqJtJfu6~D+U9GFol^(ktokhJ-kF@y zIDJ3`K0ax!Y+Rp*GS9DXr3A<5?CLXCZyV=X0r$Nkitk}n;r|CGteYhqA&1yTp?t^Z zw33TBebuw2(`67MM_hWh8_Jzo3?+HE~~FEPl@<7wFYSM%qLQASJQ zxqs?lmL1_Yj3R;@INFqQ-2!rG>Q_X~D}sXubAu~o&Azy@DeFS*CE`gkXNi%}gfLEm zg&S1%K|ZY|~K?*7>AuOs1bY@=kOMUVwiBd9?(@&RLYNsPpG z*ng!V>K0x+=DO8%%qSK+oO+JW?m9GA5p9_pCHTVq?TEHB_VSlt#sR9^oyr;Zdm zTD+CNth&8(wBnK7d&wO8xZ)k#eq-fkLP}mAcSC)!l3qlo&f}egoSvUdEpcnIf$ERr z6jYpN5SU+IM(EG(BQUFylDDWrTJeuED|}yG3^GpMog)APX-q&a3rurYT> z-L??^k$n{)h-l0QI4s&-0d@umEAQm*;nby_p8@Y3gyQX?Gdhv_Ea%CpND>#Iaddcb z;S)(6MRZfF9`-@{ul4MTy0CHU{h~E_o=aqmLtBLg{SgSu6*W|Eyub5TCICFyO4wgd2K46_Df$%IZ9_B2)E_gQl3ifv z3lDy)32mAn+B~H3s#GaE7Ud7-4_4=ycu~M7z*Dfe}8hZevx<9bu3h4B~SaY0)fYyijo2_Nc3@a_#os@4_3pjBKV;;vN;dnz8)|f z81$es4tk%PW!kGQO-=hz<8h3*|;`QkXyTyvgj>4nmf zr}{?g@JoS0neF>XcwzGu#uV&F>jh9n2{{@ko$`~OwDi*#UK@GQ8@Uib-{zDh+3@YY zxOzr$dMWabkJ?dTPAYH4Pt25u(mX5gjsdJQS*84~P=52Pb7i|Ooku_lj5f)i5>y*` zf}+1Fo2nL5YJDHcp*yW>A+|`#!WM47OA(iWvp?8uk%asUJCqbHq0aBW2s!Jhm{va2 zVDgN->R?VYwOE`(^j{xrn6JKF6|$dfDo1L)T>;z$-g*xLM1zGG2~Xtw1crDW)gT+e zF9d`#FN>ksO83xV;BMRKE|x~}Y=5Z8l*kAYkECa0ue%aY5CutGKM`YUM&4GiovtFY zzYl;l!J1L;s-*KyFI|d-by}*Xo&;zp%Lu`Gb+uCzK4@X`Gky{PXhz8kd^g1)%t#KQ z7|oanwc&>MEJGXjfC`PeSn4CX%VH0uK_J9MJjj&;Oh~bVC{~X?;r+#7G2moT% zY5=OxY7dcu*HRu7wPR6jRZ|ZM2j{Eux+SzafGSiS-`M`O-+F-+eyiMPj2QJVP z-p0Fv2^5d$$zD36qj8=i3xzPR@Pp6!;4P|qSMYQAIi-3j#A(d)`>V#hAvEyNMxX_# z#aI!Gr=dAQ<*yiipWI?#-Gsy-1TL(I^OUFgEoH^z$c)Npkz7u|VdQ)UYmUKhUbP&F zy!29;itN(>I=VtZ=;pu1^}2_gI3TD9@s;dEM-q`^j~h-z&<-$udG0>*Agr5kc(l+L zo<~6*4lU|c7eYasGct8Pr)Tp4sX=5Kob$3^{Vc`v1=r4Z^5c8_i@i;UyY7O5+ z4=bp!`%?n^*I}ZOgt1`GQgCvS)J)9{pt;}g(+n1f*FusJV@6LEo#8;xAol8UYyb!@ zWdGtpl#Q&I1PNp7ib_>OLDC8g0&PUT4Y7+L^bQ77tJv^bo~%-2JvfhdxbIFn>#p8( zSE(rMka#xw?joOVFmeuT5tvSP?zc~ws{cJX`mut$zE=#wnzL|x?H|1+3rapK3b>wkY2 zHrwPk#|bmATZ1)&g_!}ttPi-H2LG19p;TM-3y_?>F_e@Fk27pzzYc~>U=2oqH;1z1 zO*R!gGAYA2z(`D8#OE-zkF*c%t1UHxKf#(WVf!%Byx`ZmeDm9Mt9~7+E_KWy>UEW? z{NoV5#=KzLDmy_7b7VvMY&yQ^&@?5~pmPr&x;fCwZO$vw4g&CeNNn?nHyQG4 z{Q%v*uhEiMSj1Swl?NsR#FHz_D0i!xcvd8?kfhZD^Ku@B-uof4jCMB=5Vv_T~3d9WU{2WX=SPE3SRG z)SKxY2ABMDuid9Lc-7Ax3~vuc`uBl!_rOYM#OdauKC!-Py`1#H z7rj33Y|7$^KIYa25|d4qzTa52s1}P9*+6RAnIJ}8=V(B0Lgw`+Fg(tP&HxZ{HDNLp z+Mkyri6+AouTKq0`!!bm+J>B~5`!|vF$@C-ubHpu{U-{rm*B8uF?$d)A!mP`F(}AK zl`Jc!ml(0UlMiFp$0hgpY;D9^598;0xEi!_mM-{BUgj0vAMm46YE)5V%5ee|TLg-a zT3B2KM=&@qn<$wJe6}gk%Jwg0?jprJp#GBN7A04!Ix*jrfRUrvb=%&$d6{R)V;s&S z->jT=h%7GO$6~#adtn0>%wO;)Bi5{_t(HGIqfZ`C!+N?iN?yogJ~?~z!LE4GHptB? zG?Z0=kjK~uLNkIy`82k{KyE@-Gz7RL&k6n?!>eYgmD(2OtkFypD)&~zfy7pPK?VG{ z**5UB0+JcLMV00n;=j_^gCmXT=u)-4Oru~-vOY%DZji*rod9H;mm-~PpQdLn=}6RK zur`>BkmC;U(+y&5G@Xr$EI^IGEPowoUy=Cm!p9087x3>AQ)n}a7JFmwl$5#K_noLo zE-5gAp@v{Qcaq*He7Ix~POOPL(aNL-K2v?{8l3<%5C_l*4^HDrdCY3lf+$pv99*&} z49H_RUo=|1$V}h{Cp70%=o_+KN^c5qu+q;i+YzG193=DVNq;Yb@dY&4Pvin`G^g0l zXa{j#1OyNNFN0MoX~;49fJipm%kVTCGv@8yr-r}oUN<^1t=ywm2iq#=H6g=qnF$Da z4I~U1K}b0`<_h_Yej94^r{oH#A}xbQI<1w8skh%w=$7AVrS>0lgQk)qpC_D7vTkV}`zFzp^&%~?mh$H1Dyjj-+O{Ghl&YcsG7NeA9(Zymxg zQd|mCh`rNrnU|Ks(jWh%ESxI~k(d#!a=Rn;PDV-6*k%B4DTxi5QIrM!)c*u*GszLz zmK~XycDr^m#J*}Rcp-C2pHg)LA<`^!ZkQGD1l~?Nu0{X#Wxx9gM1^*GBtE4!9|_}h zRWV=h3-ETlZ}a4|tUKL(PBA_a`NB+idU}8ZM8rEV_*RPyt%dv4u^KT!Tz`IW%Cq>7 zd2x;*wKt`SWGJgOhGFb9uq7tP~n9soCo_Ne}ufM z-lD%3E&@W@$FbLEB0sq%eXK>Mr3de(7}x@Wrmk%e`n;lrHM5X+F80BBBYmja3hl}IX-HcnTiiEOCNurg@i?fB{0ARrFTgN!_8@3M}2!pyAva75o1Qqy21R)#JVxeizFo#$^`lxsf%}ZGS=SZNE z-3t^LtIr|2WFOxJBRiP07@vJB^<7kILG@qA;!h3V#Azi&2AbaPS@k#HP4e)qm0nSn zsPHqix8Tm2Zgy4ghwR1EJOBVIG%!cCZcz=g#f|20mC!4$3$Ih0l_A&$n?_ITk2Jyo ziTd4QaDG!pF1&lI;(9F)ZBGh2j-8!0wKw`>8j8BHIr56tpwtPF{1#6Zv#S} zrbo*j6=Pro8Ymi#_?;lR?GKM-~SBe1XfDkC6{7l4zQ9|Mk7Kuk5IFWW?C=|^{pJ#_u& zUp-o+E_co;dJbBQop3h|`{g<4)*^Y|98f=4>pQn=_ShBTfyB+Z zRSY)-XXwezWu~`YN&Z(j!r?#0vdpnfa{+UL<9ObQ z-VLF^%Sm_=C9Sk4Jl)Bc=PHugemYybdvFi;=3FtT^g;xiyXS$jTy4XtYh^y047n)h z?0>TjprvPpo?z+%VYVqC+y{s^Wv`JUD!|!<{q+feY<(OuG&nCz#{_r)pWngeCZ$N~ zK3_R8uGQs8ILgZUHZTI&=>1Vc$f3TNy$Fku%C+o`1t(X%-v$gxf{;V2rmIro!)BCe zLAApc>z4tba_jevR;#Jp>Bx-9b6|h5Av9*f*sx)z9f+g7dJ-w_rETTo3(-;1@1uFU z(idig6Fx)1#=lG#5;MC!zmGANbIFrYyv8=qO}7aQgV+WZKF^)N^U{aKrSz0DxB0I$ zSKNR>=g%&ZYi@!YuwIMd_Nlt~{cRhF*-Y}(6F_EivyYTpqx$H~4Rc&{Sxxk0EHo0D z0(X6zqHMHE0aOR}@!LcqWgfNvmL;(3MG$}UZO{P;c-;3p-T_$5W1(QIX#WmO^d!#< zhtP|r!YR*B_)cj@c=hULV+X}9dyaTAN5OjZGwtTI;1o?**uGrN=O`~A)$T6t;ZZ$Y z53S6(;vF+2>vhg%+phD=ZKRvhW7 z%*7nS<{1d!iUlNO4Yh)N?&p9AFGtnAI_bRx+jn6pRW~z@_VdrqYXV;en-f)2w3RZk(!rQAGvGXfz+wLaOwNshgIIAqJy$72Eh%=`D{Toe;3AK=Iu9G zf2RF1cLQ_GMivb_)aDtED4?!8tHWD*q>+v)gk`>l zW4~&ntT*QL6yuk?U7ItgSrv`YqPsr;XW!4N(6GyrBcbd)6BE-Xa7Z1>!99%70DYbl zZl^Aza8RkL4Zwh*G3& z27u5!&bVn&T4zv7*JJSitNeeKS+C#^%_^rKjK2Qy7C-% z(jOlmqIRbN2KUunumn2tcYTlM$?Q}NeJxv~dfFy_J)u32ELgW8maDjQvD*Ag1 z@g27Gr-2~A^>w=1R#LN*mpryUjoKCQ!WR9mo0V*j07O(d2vw3dSx2(_cfQbpYcV%} zenWv96PU_t@Z~S7tMK^oB;jzWI3+0x_w}HrpKf^V5?E)e9#tus|KEM;bbue_ut6J~ z@e89Y*5#1Y=3s0rdU;3Q6N{sI(duUW1xquK=pQCpyd7-*HPS@-uAkrt_UL=7fK6hnUiH}tvrk{{~Y{@Pz^ zM z9MWwx9-5EDZc+GUR`{GxX%OC6_YWn;+d2u2S34Al!5OqbWE}tpa*}_45q<-BgYB^w zu(lqbty<1FW$X%fEHVYkoatIHy!OE>yRU4a$;705Xs6*%xj(B<+;Tv>90Y3nU^GVp z1{yp+$p-K>5JeHE3M(EBK7cUUbGh037%= zW$1s}0pFaIX7K0(uer?S(A8~_FEHPfnrjXFo25%K;+odDNpeu;?+S9NoI3BvSgtQb_?}GT)-4JSJU>fzB4(isEH%0wuT$t{52g0>R^CYfb4{r%yOCv4W@F)aEClD z;dBkO{%Lem-zS$rl@WH}9>uWAv?w@WP6;47SY1v7%MO(rXM?-td-pgN*dNCU761X} zWVFLQn8n>Mk^emvoamHqcpxzPfTBEQ_mS&g)S4W8M~&br8$3Jw+{%tw6wd%M>SE?j zTr$LbvNigmWBSvo7k#XvKt=y3DQN8y;Eg-RBO5WJS{v0zb=aEXU)T>G_M%p@~ zN&1q%B`M~D?dEP6ki-ow*$3XeHRAkAre%Nz4?4b4H@qO>e zu)(Yldzp8o@HjRWllxyqqe$W@y5$gROZ(ylB%*h;)L`55$l=&57mpGc9LCel1ksHohu-9zdTOIjV2ozLk^!pj z^K;bSb>KWfL)CPB`Z$~V8#Vdi}VJ=Z79osPJwPWjj%vwewjyqL zRs~*%_kXX}pGP~QrCA|g_G3(VVmr+qS6D2H-P-^-6BVVT^@m5Ffc(;$Ht^3f+z~gB z$z$LH9y7~S8jM}XO-cw9$iWfB9M4B190nDOCX{@&g1m#rAS1BK!~5%nuORhQatnq2 z#6aStbG2lg$W4VW1D6j+ReKlNi#8Z7)IPh8O>FYNgZr=3_AKs;lUc6@1#{H5uDs*8 zWk&8L`fEJ;2#NSP60AU8t#-F{cJB+dH8~I`J0f1|uq7vIjr;BoM{-{WNZTH@!4kV8t3eTC|(;I zk2;NYk^-$!2ka+4W@C_LWLikiHPIx$Mm z1}sdM-m~OJqPcLCUFCH6K`GNKc&(Q-i~Qac^^4r(9sVNNNS<5{JUI4N`A32s@kF?ab|LsRQs36GOhZL9}JoDp(6NC z#-Ivfn+(1Scc0nrS{=e9&@Sq$K8HzocDZuS8-aVUWt1geInJv#n{pQ;iygERd9ZLh zIh0U*KJ1@M+e)XUvem%8+uHhC{>jo#irq~KX5W9!+LN%|^T6;y2roSY2*M7w8ta4^ zXQ!3a(Y;+PRP=U!$+Magva*b~nQ%B39UX%8y!U~If2NeYF?MUOh`;i)&mSX$l9-W& zFe#lJIevF!p&+A#hVFKIUa)D((Tgmo%71|pKJVXSh$AN=IkV8gP7`4qy65{AvFBV<4ni!gyAZWPLM>s)~|7RiP;$eh1LGcB?~XPhs1?-D9FJ#>AgcTN)390$Y^MpT0=h z$9Yn50Xd`19&HfTrJTP-+EJvKz*<0TLbLr`u{XZSWjXVugMplWeemKt+O*<(bJ%jQ z?IrE>yS_D|=04A^q6$x~yebOw{kJIqdEEfSmO_J9rU2{S(hX06a*{qU+I29lro$40 zv~cVi-jbe^Zw+L9pVD2u%q)DgqX(OMFp2ELnk3?!P#Ts%1;0Bj70w7 zrZP{TY0RD3o(EBUCESL;J@W!k&2nBKED$&A>-XdAgF<`OEgq|(in%d8PI*HnvbE>R>xH@SsUNH^&w3PmT8?!Vvn{0Hgr z`0n%hyx*_a^J&PL^A+Sh^GeKR>w4g~jbGUqL9P4`Qm)fuO3s{e#y&Fg?#wGP^fh1d z!LHkS@R@|$(H(`G|H(0LAeX5{ogvY-Og`$n`V{Bt^oix?**tKTIm4u%yS zcAM<}2XYr{_&fuEgPYPdj>nW4>v%Fu;R>OYCoWxw>QAsT+F9Y|?po8LVL|~rzBM9( zQxE;?QZotO>mrY611I^yt~(94Au8?ak67{rA0Z->$C%=2L|)I!-st} zPe<|)`TDr_7q?`}6WsAY!z^$Y$k${?yjK!IEvMVySO*f__eJ>?4wfw!SeD_^x=KccBoWpaC&m7J!J~+Y>PL79kad zmH><``^s7GJ>kYcMK;gXZ8E_`X(H+YuH>darFo_o(r#);ELm;=_M2l(dc;c)CU=#L z3uLM@wY&X*bc@^bHLf%Wv>8pp9utU6rc;LRFbdX?Q4oAwq5{*A@mt1)TZ z5H03HPnU6gQPUv5qR;#W=eS_6@_TUS!eMze6T{T|XrQWR&?iX{#jumnArM)(Qc`iE3d( zjlpM(Aa-GNXc}j000NAS4~<5z%Z*)www++PjN_@`OWp!6{T&zW@hRA??@JUUp&bb| zq1dKt2zjC5eU;-2{p^nb14a>C&Nb=Qkx%($v3;reqPP4YK<;goe1&#O#Qo{JBH5Q_ zJgDaKKec8ql2@@qQEjm&k9cC8&wqt!&z_Z~6F8hhHXv{6_aqD->r>DF*W+78waGg$ zBs6Uj=uU%xeHD-!yMpJ50H{tUkVgEEpE%TxSCIt4UWSmGeD%cB@xA(^d|^bcOQlSm z(LFCNpFfTDqHEsbm~y+pIm(k?tktcuYF9$H#crIuV&$85Yq0`q%jhu?hZfbime(^}YpIb3`po3{&q4s>%NIYwF}kN|MY0n2 z6TtJ2b^{Jmg~YG1(FeSvCbSntPf!=gs{jMk4nF5bz-Rc{^Gbtw_Xyzn3T{)Ye-c-v zD;#k@9IC?nV_mLlc#MjUkEK~h+QqBcHyT4fs8(#0 zcBd8uA+lj_V1b~kd&qe&?U#|FM0gV5D)ET!lwCIIag4ZsR=k2RM{Yp=Pc0h@>=@7k zQAJ%h|8eRj;RiMB7%L2bk2Inok#;|R*Y6P^ew+Ws>-Iv(Kdx`eb@0;XKm@{wVYmr^ zF}$4qJXx0VTADVPmN%#wT^pI}b;~Wgq$~VX?~KZ#H%ca)(Zck6|*=EL|r>mRRuFT#u4lLxjq~AN0HY4e>bq>GX zgj~`Ge(V8kqWjoI|Bz!CmHPwysn3)sXB)EFQ2}R>56rOnjmwg^@&3aHxdLvu{V4kPjOhotdGruXX-UD}j8i++~_uQ=s6yFiD zV>Ov8Fwo>R!>)Wa3(P7*Rwykl9Pr1oPBnv9-!-BKOLxpdf175zivu*Oux_ZgSl811 z0V;w^P2Z1DISHcAh*I11$nZvmtkK^j${ohC+Nf*6*m9js4wpREiUlN(hxDf6 zZJmG>Dn2h6ko9Pz4TSfDyZ{hP&33c)zA+gk-thD{x2xMOKyX%k`-dooD-6q!du)Sc5)yr7L!Mpm`urYHK(Ma*7IM`=yEan; z9$3p1*k&0Uk-WE9AJnF3 z=r))bL|Am^?}PpZUIT^Ydd!-)xtlJg#JA;8F3)?97G8P7 zWzl#pwoF)IU*Xfr(~Ow6eM3%ZE7aFAAl(yDxm+L-MVrZZ5hLRr&4K3aK*qz{z81|F`O{xft&Uj9L%zv)5o1iv&~})LV>1~N3S5p z0@IZ^B~IXE^fS0U>gNoak1MwUKV-ZnqmB2&4~cnFPL`9NGZ0<~{3;C#RNaQFA6ICj zn{fhaI;=#|cLk>e0MuiI=y)zf>hws!E4jizJKT5#UHYe5e{yAIX{hYF^xiMx9cCBc zysXepKP=CQg|uSdl=X*|oW1uKXZ4els@rVLlD9nGXNY!S`?498*vo3}E!n)ZJg z&m|uFDWMhyX$uVJgO;|!enNy51k7pI`9fY&_0e&CiB4<-R6ibmog?bPTuPd(2kn6D z5mQBrpcUiS5NVN5&Y1aqNHMm&y-u<|2*1#5KPkJls2)_rkiPBT_CK{GmOY9*WXCVH zUS+}Z(ASQZxluQHth3U2a2{dWtmn0zH@<7s)p zGGmE;pJym;Xanjhq3%3E$T0B09~+7n4g2ySuc06x8HP~R;;9iRK;yoIZBvf3R}f4}f6jjETR}jJN^NVrKoIE&swbf1?EDmzviPkM({03?eR#)-nzdG% zu#LQu=)r)xdS{E+UVNj8TEFuwQ(GphNQJe;?L*BnsQgAetY5>JFgiEL77xp$vaJf8 z=QY_KfNZjiheMNEVc2&k;0+6(D6oDfeO$v)Ls*UUb>Rt zXYs55IIK&mgV`u|x0SVo$2QP*Fo1G|c0b^$t}-Cs3{cLOfz`TOD>h&8H(`u8RoW^k z5_W(yE;J4O_M0U%)5|Q0;mn|5TXAg4n!VM~&Phc;C}DL(QJ^yM63gYD`KV&0Itw%r zk~5r^)1Uahj6ETG=@|Ilu5kL7t0fHgoNrc6b2cEt%4v%uA6F^$!!{2j7D}7jd?wcEN|t{N5S>bU6lI{N?KCkErVPGEzt_!rk<*jP|0Qu~St2&fRp?NEN%}u0|W) z)1?-Au;zt@G_R9lM6tK zSpK6E9YJ3|-D`^Ff9YhFFP?Pyq}(K%r}l9lMDqodR$hD}(hkSLy~#G^0aC6|>3vjb z$LD-3vN>?Ki~KTzRp4ff{o|E^XmXHpZR4&W1UP|dikR5s*h@ckP#Al9=U7!APbf^0 zOHf7Vq#jM2eDiG{%)kx(nDUt=lh^>|y_2r>PrZp4F929vJXyk+l28?zu@zX`$8M_} zF&?kZ`15pQrdldysJ_vIHXY5;nZvX=CeD&@2zmB>EXasdWTINTei54X63cl8Nia1a z60G2D@(Y8pysME?gs!rO6=SBb&MA+QJAYRphP9(g$Y||~I}mNl>lc7ZMLz8p2NXHO zLWBB&cizJiV#l*FS4)d*gWZQbSnZYy5Y%)H$8hotsgurpYT(~Ma}bAM9a*ke++Cwq zy$mbNgihjg;K>w0VNL3Fwxe#g{p+z)xW8*T=*3F#0VL9)ANOavX(St71=l?XG?H06 zyo~pb*?OJDo$VBA4F2;wkNZY~Tb{hFD@~GIX1vkol5YZ(+ONLLD5Tkhu#{IqAsow2 zzuBk0=(SzvpKgF?3h7%2kpoi00zKPV#zy6g-+jmZ)9zUtVJMkl(mWd&;wkriCf~g@ z74t(MH>e5nKBSMQ0ho>&QSP`E=6Arm7znY-L>|$L6c{i(62JJBq}_*W{qvkP`a|y3 zSO2buw3gA(G}ml6t;hCVltyUd)M=YvdhJ`=tO;zL*Oi$x-rQzBxf5T`!{JPm>l2J~ zX7+k?oQ`i+H{IWiPqFrSRcPx~eq2_0tosxY+tN#`fB~CQEKDk#GiDhF^7S*t9U^#@0XmXMn^= zcQ$@S>II|P=pr2a#IO60k!BoFkKOe-DxCWBvDPGQSb&-!tXvJTX}ARRVil}obhgtE z)WHMDLt?JpC34R+roz|~Rus+GB9UE3iq?1J|GhaQ-!z$qHaEo%LJc}>yb)~HUIK+J znr8)e_WwSr>I&s6Ou=Nh6{BI!5sz*`4bgKB9uQY&y(?@AK8tB#t_)W zZ8eTO5MIogW4XMl-397J+ruk2(w(38>lX@#?iduMsM6U11X1ss;?bfnrhrcNMYb>Oj?*KC`=MY#?=RWF7fFFLZVEd{ zD}FIl6cC>6bwwP}`Vk4DDC5klGY;V)#Mo+cEyZYd-g%GCYS`01CtaadDz2E`3ECoA-%XQkz81xY=iA*vw8vm8hc2 zN)KMzZvv9YA;8kjd)Ipfegmioe3(~q6Nk%M7nt7r#a1?+#CSb|&xD2iQ}<*o9zTHn zOBdb2ry3kldl2+uq$uJJOb}Q?b0eeq>8o&9WZO34Ubs=4)RxpFR!jSr;Q+X#)MtIK z6~DU3hPV!Fu9oeire&B#7}a*XO?cUlPrbxi|E%a8O@+>qM3&XeOs3yGQ5yxQbiMh{zTzI?iC? z(Q3ePNbnl{gDdT>Z&n{TjLoM#rXOcSMH7r76Gwif8Y~ol_1*$wco>D~=zIOZ-db-- z=+~UJ2s}%CCsWYHpN2g4a2(A>?RlFDoY432MQOq?&u?=d7*7fwaUY11n7qCDdM9Bsv#Har01 zyl(NpO-4Jqm#m$hh_`4x&;!ykm+5mc39F6i`jNJHQTM-KrK8aSw&AslBLdwkOxT-K zonOJ{x|jf;AYctKtvip#_a;rV)0u=JbV@AYQa19ExPC40N=lz9*Go8dHFjpl z`m@A!WZ<&MXGUM?=QLag)G-rRiAMm5`;lz>4iDTjh6b7C_g444b$TpHGlKqNFHo6) zqV5lPWl=6aKUn|d<02Jn*ldEmpPJ_x|Ngy>!3@QNbxIgPdLg>#4-)lBvq3gQ>8IuD zIPthQm`~B{Ln8g*tkwxZFEAdIAB#5?G!`8EDQ?;Wo zbzZR(JzYWs8x6PSYo%A*=ENCIB1Zw=YwRCup>wi48zh42SfTEK_xET>wF{r{&ZwTF zL3pVnxpOTe;u9Ef(C#B@BQlA{yJ>Oa$;xF5`GxV43-D+9{z}lmBD*hK;4xBOu-*fO z)$U^029w~fveWSA?`6Ui@3@RT^FUI|{*A0~LJ-}T7Z6hnym!6!_|^>DOW;$hF~Y3{1kxc43ql22V^l>2&1QDC`feA5>g1wQ-`xu5V;& zM1&hVGb&v20@kBQJB%`R+42VW-Y;~ra(7%7{CVNDSsgrrX;Q1LkNbn`2?R>C(sKat zf58{nd26Bj*R z;^V(S?gkKYh*UO)!vMU*Cc)a+{i;}E-W!mB=B9yx?I-8y3?eL9IjTV13UxAqBk`Uc@8_h(H#x9*! zLV2P#A+UZs_&4s%y4EIM4dfucH~{lJN1O=uA1l&2c#fVq+NBMDl7Vn&=I-y{6oY#p zRo>mq>VlPngWwYk%~y~0G^Bgxsa_;1z=LmG8_!L4FZJ*pm!%z&KL5mh*iS?T9P^sk z>{SfviSkjqu+PH%Tzbz5B>J|;ak2+kVnHAaLONEjOTk6>J|G7q@@s^0p z?r(-BI*KDVYceV%g<9pg6QZ7dSDg(F#SXtMyfuIkn9W+Z_oK%se5);w-F}U z!mXabaSikHeC|hY$t4fP=7G_m{Zeka^cu>~Odf=fTI4uEc9iLuJ#sr*6i=b<-I@JO z;Xu*Ojd$yKx3}+pf%6M-srEhKt)l@4pzajRDu&kD;Fy7tKlsQ$`2w=x^O&3`*z5IN zXsa}@_qYGFKM+ObiS)b*RTLa&zvjakR9KPfUyy6r(PKE1% zjs-Tnh3Px^S~&EROhRONG>WuUV%S1*#EkEuMwfvTL=z39RKI@xWG4LD-DazX^`k#7 zKcIh_pr5EFkTm<6yidFbI7_UTBR6Ap!s)c7ZAY)m=43^cEkZ16ceo~vEh+3h z<3u=L;4WN3LSS4%u5}_2kh>hTykmmgBI}yc4m^Eu zOqLs&s%b!K)07O6Sd-V;J|3pn^L8UZD)9xzvz!yT33fQBA8db`vFFDC4!z1@aoGHJ zBlvg}m~P*v^@G0CyR%?NoEYefit(qigC#fsrN9n1QSSLs#=GH}P3$&lWabS*?YP{$ zpMDv6xj^+EssW(w+~I@eSt`gC2~TwW@&DAmvD|dOte6Cl#3b3^da7(&@eH{eO)$tQ zuH2ZW4S0k_Hse5MW4oIp! zggIO5J5U$ct9MGzMQ<$FmZy!yCpG&c8(r~jGk!?>#hQFm3Dv(zbJ*8psTLpydTN#w zo=N8cSDbrb2AUW1hv8qDG>s={r^;S@(u{?`^EBZKHRH)L0G^F^waG1VLo$K@uOsG4 zzRzwbM4>qMkO4k2DagYV1)vK{YKKOqF%Ymy=o$<$)n~dJW#0^}S&&7Jl|&B-(&rgI zgZCaW7sz*=^j__Z=k=v>Pm@&-r5Yo$%2^NKs0jRqY(5jeUsOr3;$yh2bL7fCRrNDq zq_-lIDlj+mXT>Ub&H%j%q=``c_sXlYad1&(RGgkYV3~+Ls%S~oy~^!}zH=JN`N9bD zvI(kQDd|?>&xra?aCKtVBi+z(^(*H%xYFcW&oRkexM5#qYG9W*_Dt&ojR8l zz~CY{8G~zVT`KJ>tg@wcMsE6*%!m)t7NK@-fMvpPzs8eDxY08J&$h!Yo5glVNW%Yq6jm2aV`$zRP}p!hWg(#6ub9BJg+sP2lu*n^!4B7GOI+HTH)3zVHjZU zcGs)`;+`4Xz5|39fG_b*Ty6odf@0=OOR;>gqx60dQzq;EWf+YK)eZd@0tMuZ>qce_ zJb5OZH2Bb4*>Zk)EM=^053y}M(wb&k8H}`>X++;CAU|4zQ#O~C0uKx zTzwijnqowFS zBZbSgE5#w3tMff?waK8dG`^13kXX{ooFtDFkFlqUqt7W$b6ze&D7^rMqn_CTB{ zq0ugN_q!25NY|?BlWQ~0E|E*q1`)N|(3MY-EocAJT6C+MPDr4?3-p=*H)Ss7ptT;u zeVrOijgYU_+J@!3h~+tLlKi+LwwP$gP*Uzk?D16kgl7+thw@%x4O%Mz7AfbtR#axy z(F;y+5s;Dm$k@uL&au~}z^~<7!`*@GOUvVUHqBMKvk66Emg4hsVcdILp|@%1ey%;7 zzN>e%f-kj5p#!nB8Reh+8D`!x7Dlpt3@~*Hm3*DaRj+FPwoH`qc=m(>AFR`jL`+xe z6O)8DMg8G5x_sY`JT~w6B?Y8BNg6oDk!n$n4wvxO{>4WE%BHL~kO8e^uPIsjH=hD4 z>GYRV2Yj6p)aPc%ube%IfW2tO1LPoKTd7mj`x2zFJ1}k-TIQn=!bpCPh90n3^Q;{v z7XRkN7!hlK4}rhCOef4u0M_g5>cPpzMPEWL zw0YQfi8%)M3m`9`;ts~g!WE{V!0|H@@{s+DVhr%rDq=7$fa@Tk{8aOGo4xnf5&&h|GDSKtT*=sU``89OHXn zh5FgfvR!6T_0hThmL-`dl(;2ep%k`Qn>@}0R}KljG6?dQxG~z6VSg2j_c39yo;C8M z`*>L4$hZ3YkB{bi*KWLCX!f+({f1u1qWJ5Tjgfy|R+s!wt#3ff@*lrTRoFTFQ9{_G?k%39 z*NoGf85b66O$^K(f<9|678fWhYpW8%2`g!50%utG$(tu%89$Yzv?w1LFqw*gndmh? zH{{QYU&royap?BT=A2c(3(hkhcq4+G+?ccANBW|<4PjFcYn8ED2d>t;yjD$}`}ZOJ z==}G077X_k=Cgp<4g2fohc=+cnDQ zgI5~^3^QHl^|!{mk|*n?@Q@D{97(S)w{+Sq+Ja>nDchrPe%E&0^b)Kzzmw9B>WT>lpWfgAl5plE>Evq zC(mED-1;7%gjYMv1)O5Z{l%P;BikJb{dms{04{Z70qiAUiYrs>4ZUykJ_y|~Jbv4# z;omF3Q*T1pP-&usqFYzT?!E$d*4`>=)AA??$ggZqJ074^tz?W#otFYe>d!srMq~mPtr)?0ue$VX(y- z01FZd*5nS;o$e>9OZTnkN_p4K+GW{dZO!W#h|eorIRMyc$93#w9!~z1*O?b8gusV( zOrw|4>M3SXg1o?}Q_0P1+pj|#Ro>4gl#G~nRI%8(w8n2_?y_;TPZg`<7Xzc1k(HQal|PmOtR z2Dn8izvuN8>`i(%e#*FTh=Jrb6nM((eN7o7LBern4Q={WS&Syk6+3`dZF5>K?ccEGzi{5wsNzkJv=fQG z(3p4$0})`O7eGsDwowX0GbdS^YLo*vq9a@buZ^#)cv2D zts6dl0U+PuEpH3}hjAi!Wrl;cht1Q#60d{_FVIHC>V986eJ;nO7M873@(Hhd#c(36 zoLK`}VJ6Dg{w7tujrtI5JU?t<(zfy?gBQBJ@`+9qR!W3?Q{o5yWj!ymeIv5{#|ugt z1jjL~2G#%gJpOqb6SzPDIjX&KUIPIIDbXb&OUdW*{5ZQ2dzNqEFe89LF#?`kmWCD* z2sft%OKdOFf#w(Uqb>iZ_BU*bqoLcQp}UjI+p=}e*Ki8RR<1U9pS{GOR*B=j$s?x8 zJ;c82oaPY@#qBN_S`-(aQoF0KptgP^HOUXBc269FK2DEuXiKQ_Tib=knszt%oqu2C z=v(J~UnR)0ZzCO>;q96U2In_?~XlfWTzMpRqsgDw)!> zsUn@Eb<7+*bEJ;7_nK5^`oZY%dwhE?#1eaF-JL-qSUfsjPhK5}J^M^)NW%KWs@vzg z&royBW$p_h!s243lLzbg)X(Zon4sEFSR-p+k8_QCa?kvKIy~8jj!lBKGNq9E^e^NAMur`? zxzgq3Dy1)B9{z;381@;k_+*+QCCBIy2^`<7W`t_3+j&$uuS6AP-$PmzY=0w0oBAMd zOz^3P*qx_O{oj{T zN4+fK{6>z+dqJ@ur(OQeZh?6YBlji_vRSHH{o}-}ynMU3ir?5Lvxv22VLEHX))Rp7;VezwLb-=b{ z^jiBPHw?9U$|f2Q8#N2KRrhZ}aOgH>)xuA@_h;SF?arvxik;l4H&0`;ZJV5uVSlTabcSp=?W8po*J`3(MchufeCFfpRdU~vDO)$@gPU&y zJg(^cB-zdve$x>c#5w?!?H0LHvIbbt5X@z3vG|2#VQzC~;$eW-5g zkve#!D>%1^`tho=B~bb`nvh9owlV&GcHvj?hgpB6+YBv5tgBaQ--jTP0+1H(qg%1c)=_@pf+B%T(ZQpzY;_ z6h^5PAtNP)I={2vNe#R@TeJ|9WUhF6S0XLg$<;&ybTIT_^B$UwwRtUIwQvM94Xddj~(R zFf^w}{wcIFz$x)-G@(FZq~Cb~(^6^ghN>!20RRJ8B_d-@%v&SM4e7PSZ?!8HC=u#! z;>(l7XJTmdqVT;na#1h4kL~{&b9+)5*OwbA^J3VGhi6-53 zTBDt}LmI~ID{w`b<7t!`wn=M8{*3p=#A3dUY*dTbB-Xtsh0y*xxiz#y1pw7!2RWPe zjJmx}anu#bI6NWDE3C+V8IB*FO(!7|n1?OrdY~5fZ(b~|h$h;wNSroy(yhmP0wok% z_f)R=N46tKsFk;O?9dkq)1DEQ-U@jE05;U;DP%3JQ$V8LV{xjct{gh`Lngi77;F*=WOQAbm?t_qK?^~^ zdR$Q{jT@^<-rwdFDE?<4Qr`k6Pe)5Rke{;5mt}y|-1`J0meL&j(#Psm`gKJ{-JXZ% z=!}u}w-h~^S$=dC9(AwSL{3eklT5m!xV~tCmwJLGQJR0^0>sjw@R>@&pf#%PBHA$C zmZ=Wm+j!18CkBr%>@1jTHka`d%-9|d6i>i7)#9c7627tzrxS4-kK_zYc&9j0UFe$8 z9m126|EV!T{?uef;X^^263FBAf9P3wzB>eRu)4EN7)+1ZM`Od}_*a z?i{jQ!k>GgBwnF}m0XcpNqdde&rxe2dh(|H9b(;skc)b6N{Xy`zL?O129WfC0>raI*l+;y}MaJBCJ zG;S^)P_(*H1!o{T)=~a2qVt513BrMx{Ue1}+KeY}AF6X-&JWF{Qutu>VPRazhdQ`X|4aK&p9$9TS{Z{`b=^9a2DB`$4N!x14LP zB?U>fY-Ov)&pZjh-d0})ER`3b2j!_z)t)mH7cY+8r|O-VoBV(Z5&mz{q~N>(GtOBI zM){X%0WWAK$_cvv7p!btt@$NCA}!c0TTVsQIy85&envD3{jLYoE@m=wv<9^%B7W(y&P7d2BLh)MjZ zW{v0K^Fcc9@j;Pq>7Sb!G4_f8h{`mJAHv%8lXHT~5kt$Ptm3(M!P=6NX*^~K6 zM&<+j=OeF^fti9$*V~_R*hc0klM}ygRqiA8#fzNj$4iyp6`K`R(Ii7+{d8`r*Gt&q zWe??ddToV)bp>q4O1n1lMeu>xA8nAy*5_kaFFtb(yW`m2<98F&cC~%^tj1dY!rrI1 z9&eX(jM}w zpZN#QeKDv`$$9HKzdl+#y9s`Pb*dsM^qO{U=B~uLX!e|oXkdh%bMS7^UCM8xsXW{=tNz;h+z57GNnPb0i735@8Y%1b*)aO6eiQklqTMHMa06;a#%oOt zyVS!j*f#bd@zTk{>;3|mM|{(Bx8bX0!g^x8W)S7`T*?v18rpZSB zp$62(6uZ|dEnb?gM#Jkaj;tlE*|E_ts+yp7B)$0bm#j_|ZtE{kX1=2t{n)9%f7z$M zz^_(#lxG|s8xVifoqTPObW3W~{GrUJtFZOr!8>6i$Ng?R*}8b)re)4ApAp-_CGXvo zH7{y{VMT7t!Ka7lBL(#vTRvtM;O{7dY2yT;8+M2m1*7bl&CR>MeY~gehQx;WONPOy|0HRkdlJZqiKH@g{dm zh2Q*q>h^%b&N%z8_03Pt#6Eb_mcTELM^3*SZ))=)JE&i4KCo=!rKe*V$J=~@H{^bO z);Fmd2i!8J%nE^Q_d%55WXndf={?MiR>I2JB%A)u$L*^(!^E+?tQA$5q}EH^H8hzx zj%tZ1315vw+-USerHQn$NY_=ECll^QfcOzQhAX_;XCaB;bF*~m_KvwPK)$AlCbcPR z&_fC^1(ATMI2QX-fJMXlj56me+RUAxI_HSz>tpVGXPKW^A2bE)CKv-aeT_L+9-DHWMTb3qc zTV0Ug0^`^U|9gv-S8(v?J6!))#V@{L*D`cjUImQDFmdBCfW)BajKoyhv{{;ut^|7c z!7C85kb(HzZS@It!=}4t;5#u5-4v2-+}(*IXkcYzB{n;cjZyziX(pVFOMIW%6JtLF zpq7g`6g6nAzQZib5HGFdKNNGWfxC`tT~o@gb03W7c_v5lIq~zO-{6FMN=cO-6QR@Uh$v`q7WlWlSbe; zD4`fLoUI42T}mnulM+o=biUf8U?9Atj)`6RbrMLig{{H>o#9;Ta^7KlUS96;$2Ftx=9u}GX3+$0QBZKb zSl=I9`~f4)1!Bd5tS>fx>2%x)%*v6Fip~`Iwjw;8z)Na&3c7W5#ISINYQr>zPc|I? z;$?L(K4Ru0RnJ3xPkj#;W;Pmf$NoH55Mg={OCa`x+-;@ahYD-owM=ZjhT8OVyIm0^ zr!Q_lVp2vkraKe7Nh}%&(%ttXs?6=+0>f8A2S43Hum?rJyEJTNjV-ao&xcBI&dOMc;bJgbL!}yB9$RfTWInu=l!idI?J#Y!q_okv|W5m@5e7YZxlSkX+tHTw=8U2uqvpQ zxv;KPeMw$FXopvwXZMH4=`ltfP-hk^=Cy#1j3lj*>O&1>(+<~a!};P;$)4m=Cy+gL z?;UPmF}ED)YEa1IL2u%rbo+&}0O4Ce?sRe#Bg!{=R$&>+LF8u|4kR&;hNCf!&CUq_ zH(|~w|2sZV`~r2Eu^SmK5Dwn45d zmT+0BNOu5?HUjaJNf)`#W7p&KN)W{>oezX&WD9L<>IB9rUI!wP4uD0+=u~D#_ch8! zK-PXc;vgNHo^8Kwqn(OSs0Xn^ESGdkPK^la zw{mr!<2y3!e;U>Evc;t^E$#FVQeE6&RBzg4xZXRV7NdASInYf;PGkjbvtanXQ9aW= z^k-&Q@_n{%4j@d#bp}@Z=!rl0jo)jwZ?^m6)lt}BG~-Denyf#E-%}_up`L_F1NXWb z_}zd=CEwABO49@XwYd2+3{Sp^E32Q7#h2d|S@KCx=rSsw00TaZ(mRuGRa<0~dr}sO z0zNE7|B%O(g-l^7kOc-cRu@o6-*$Lk9lD1Mr=b1-WlYUN(Hb>>rG)XAH}<>lu{o?zgb+`Nb+O@l_Rg^!P%{jU*`WQB&WG$S_@90+I_aO0SxVHVLh5ck z?9`%)(0gA-n_@BIiy&gQQ;;cAdA1J-cx-4r%wYZG%H<$L~dskE43 zOpO~t7Pi-RUMtcThy9|NCwu@Y2b&)P*%QloUCMiR87 zA!ZvRAxiBMbl76_m>n8DZAx2|bE?&O+RyL){{8@$>$-E3_xtsFJ|B+_;vVJ^g0wgb zdLm|mFoIIyG4JE&!^(t9ZFALyy%Q{wIi|ulBx(i{)hcE}te#ziq>uaNHZQZUeU|VT zE#^PP!iK8`E2jl(L5v-rd&FG2L=r>G4t1JG5o6w(QYsG)=0QIU`x; zc;M5Zb%0p@AYEFN8p`h0XPU#Mfsb4&vv!-6Id!+w&YtW8CqW5nFuWP20 z!Fd;3J`qip%FOPkx(6VWR=8sVeqwOYGp2%p6A?)~1x zF6=qId!}7Sv6wVinx@C^4}S&7v~RXP=$OT%lUr6~FayWmk@l+X7YlIf@hd)oj$seS z9PVQp`Pgf9Or=1zM(UU4^7nlj2GF!-EeV8n6N-(;?8t<}4q*8?>1#QCsbsQqn`I*| zjnO?EfqLo_*KYdcgUExsv#Vxu!@eB%7_i*>E_S1k600Ghtu}e!hDxUpzOuel<9B@6 z6DB3oq;xi*a{{saS%!;-c3?-(tRpyCYH3rLL>t^`uK^<&(%Nef-|V_kh@JpXz|01! zTxQ--B$1g>IXz2#1xZepl$zT^Tg?bn#4|e0V!MpSsP1u=Cukp-pXj%bPq%a6&iXx$?kvvgSX+q-3JFEaW~=TZ}~3KUpSp zPe&R`APhL@*;7l^gf|e4TKZ1TBDG2|%h9l^_&Op@V8*qc>ppa4<~lMBQB$B<=tf(X z4WUSeNWsjQ_wfpLs3=#LX-}JAFZJd|@qKr#6BBOar7w*01R?8i66=6zzyT3TraNsM zlD{zQEdl{+S9YuY%Mn>oqhZ>Vjx3bKycn39Q7r3upEm7e!yYOYK?DEWMTNtd$K3eG zD2)6bK)$@@q zZDwfsQg#JF%kH!e;;-D!PU*$c=aqSlE4oqQ$`PS7rsfxh3yAP4lM(YqpXtO0s4=?c zM`F>IYq}+`Se8J{vZS^m?5xno1&4WI%_ke2bl}L_TS|HmVu;-k`Dp2%A7H(l35;>@Nb1v>ZArT0MP$ zKsk-~ADQVj`>o^ki1DyVPqjm68;`_(d3LzQbTmVO@-!$KB=MM3d<)_od=do9;Uv5H z%HFnbuz>h5PL}`WSyPqH$j%X#im86W)(gD0^NQB}rB$ij$q*?r{oW+o?Zy{~mX;kf zH>1A(cBko!3fDw83jpurJ{e9G{(V$6yIqubce~scCgMp?T*vRq2FRXXH%Ur1BmqL!~vA{kaE=~QUMUBg<*fAByw7G>g zE%!^n4ApW`s(9pc_MYiL=p)aoq+oV#E969*r5{+dUOtL^tx`ruh6;tWFyLQQtWpHsRey0pcC$6?^*uVkhiL{m$))O`_ zX!+Uhc*+AIL--lAESjPLe()#t{jPJ>93nuR>cg(A#bmANV!J^TG-aLlJVlDG+cVjS^8| zXghi(u4f*NbzLw}_--iE!qWPP%Y?=$L7q*D(maGJqU=i^dl|dgI*b^ol^Sb0DWBf9 zUGp-P&GnySl&p$6qhy~u0*ER67eE@L$<=udq>%>@RotXD@LCH`>%4+_l7T6oZB&8H zDd85P_wCdcTHI7%IJ@u_}vh5+oPtTLF1b6t4(X09;c;`V!e=Lf^65hMR|dzVF!N3Fag)(^zd# zN5{075A8KTcD6l&E_sbu;_xorelfr)#y792ux(Jpdj}AKmseYaT=Fboy{ijbfhXDx3U_u~?1S{a8DRb{GdH=a$ zcPXlSB{u6ECg|P|N=(}J+jh;HxZk7W598_Y3Yj4Hk`dsT_1KrVIFOotmVS*Q3dZk$9;se1ahi}n42 z_bT#RoPFq~>aOZt7lTuuL^8i__r+hhId}YTPQ2>R?-So#NA}z^_)RQ*YAX*rHX)($G`u(>j=;3dOiEFP$rdH@4nKYu)u7s$qk>t*w@t~XKd_y?#pK-LR>H0UQDvMzkHzE9CTw#Zsi>t>;224 zH>hs*$yS;NsZ51b+IFBiP&2;VtkxZ1bR+HUKS$yV^tA-h6_kt!*hhWu#lPe4e!ucU z=b34$4`_kv_NMM_)9kPAV@{}}^_U4qtK$=vvuyXl!nH@58$k5(ob&0v*jde>Acs2s zQD^US@5JK%Exmy%K$}K(8L%(8dwB?zdC{DghJVLU6Hl1Q(G&bw^up@@vi`lQy|mt( zOcL@$(?x4b8dQph{GPY!=%7Bl-fcSJ_t$|tsGwn?*zfMmTcH7OCMhA(2iO#-%3(KM zMxek&dTOaM1Z(+|%IG~d?fptQoMOD^hS#hrF3(4aP8iA0#9hKcQnL9yj#4WX@aQ{B z1@G15t-dGAFg2q>kWo=K$a^1fP;y`!pjj(*W{XJM%F9><=SI`x5a(glOlCNrB*t>- zevZ$L%k{@}V4cVd&VUIJw&R70<|;@0TB41Pd+Geg8;_njmnNO1)~o^N1CPIs1u6$l@D~o$+{8O2Nfrf zS3bxaxqp^d6AYYjOc02uv~476C9F&jK7&X^(YoA>!ButZI-2hxNymUz`DT=-Ggk=H zo{#(%*jyG?9mOJ)w+I2qk@i7sMl|SYC8Mbb0MxCp5YjpRr>OIavWJGt)yfWIiy~or z-Y|jkGJ@J8YE9wE8oYH>Wn+Kcx{H?44(8FIsGMD(3#7XX{ii9Qim7ktE2yPlH~3wy zHi@=K13XV5?3#ysFXb7@+OV7=WaTfyebMNP6Nb6ro#9+z%oN*5(OfcsYr5B)xaZp= z@e-i~+Y8VImo%_!C1pd$Ln>jXs#sOokBLri^5!P_ZWgX?XXV^r_#lcW%a`b8lgH98 z&ek~vNUJlFhWM*y^NRTNS<|II(*xLZvb9fq8O71c zF1H+;u^HMu4LTA9vcQbVV7v=xqAC)w+MZ+S;2{Vn*|}cY;Ah`T>=}Bhrf(NPBVJ5LE~t?b zK82<`*4$+~eL~pn*#3mTE}@gUPzA)?2-BvFC^Fh=!c;t8cJRx1dSgB2itFhg%nRxZ zXOe-drogUq8Og%8`U>E6z_ z!l7?P!V!;tgsImGP<%v#>mqN8@U5~j#d zmc3Sd*A?CL$&|o#IYXy^-sJ)ULO+8!(HHi30-`RUzA}Bu2cZ0yIYD70p%u|c>bWBHE%6{;^F>C4%to>^ zXdotA>!bIKIl}G5p=rfwh6B?xW#shlON*82nwpr6YD26=kXjid_ss*ON;q(%m!m?} z!2@`ezX8%zoMX$sn2lny2Ebx6-hBXuK}AfZ9TQyD6P=>twRYh#mD!E(MnekYP6Z~% zG@e+Y*c!e>yW|7vs_tu6YcyTlG^REagJ;#ekJn@iIpr}{*Ti~88Ct$^Mz3+v zOm~035*9k<`0o*X|B!bC*B}$uWCpw%23S4Pr;uaSk(<-odODx*7FAh|H#+%?f8H&8 zczG_?b@B&t_2Q?e4Xb)5pMOGdS5fdcQtn_0eW{oISRBp6YYtb$@oov{=*;(j$MBvWf8+yzafWtO(7ilAug!SXVu9em+J^EI{}X6w z+`Id6jAGj47>gkcj|g91UK=b~T7|d>JYZ8QG$gGSowgAEUQ?RS9ILpvZ}{!^f{QAFB3S&m2o_g!|&X z&E(DV@-x&J67I|Q10)v$&p&w?cbIT#^4!UnMNVT1;B)cj`~C-q3}Q)RTcNFYaH@E2 z^h(QfD>qWb@A1kDUp5)9;(-z1@u8hy;064j|o+kWDS#En6P zAO&e|BO?ES*$XhJh=l_0{2rPwoRj%bTi6%gVogdf+}84PN_?LWu^cA^NkUOY>_XtsP_f<^2B~Uw>ue-Un(JP!B#4pQViQ zLK03qxl@+nt=gzsa_?bz{!G@InE2XZy$e(LKU#l@Pt#jZ85B}Kq5qgKhcp{hnr%3; z>g1|AuJG;R@16#p+^~ev{+=R!JGA;Q|4;imlh}m_ZhzB-Eb|0QAN9LFqK!C)~675l@w7;qmAOm2t3V4 z%~0y`Moz(1TJ$Q!YMf8nuX~^?@~D)RHL~p`_t_923cV8Vsy^q~XQZqvJI_JcmPYsO zVVww-8#zY-G;vcDg=>wdFqwA}Og=?$MX(Rn_(5%BUSz{po5MM(1$ zb`FFo*od)&X(_{O76~mMrGGGyn?zQo!c1n+37-Vhd$tABjFfpbuYLdzVFV`Rqz?L6 zA9C-}k1JIPta@nSh`La|UAjpT2!FCMCJ*CRWQ37<_pOr-KT^8|af>jY@Cd+tsUJS? z2c{hTyGsTV_!Wv{l;^dk zOs%<9HRG2Yy+wD;a&DXOfx#=(*SUOj$cZkWyRsi}Dvc%Nj&05bc_eWH87X}$1i%O+ zKs=hmY2p$xBKHBOFmuq;3F7gAG03PI$%lR$NC(EtIyZd}ape9{H z+Ld*Kqh9Ax%f0}a{1n;PO8cfg^qga!E#U>ANF?h@F>fji3Ux9;(#1fzJy5F46csrW z*M*{z(phUrtnU~0ijegq9?gkgEp8>Lr_4Sy2}@_BKpKB~9lBi}xNi8$1v#S`PdFNz zcTd=-)uNH=U->E)@R5p3)o~dpgDP$HM6lOQL5}d>)N$1)$M|})#AZ1!^>z{af%DuX z3wf0g6S%ZK#fA!B%w|t2YP-LT7Y(yg4Kg^7p+Ptw z%?%^a+HFT|%_rn{>1?EJr!B9?Ga}E^d6N`HpD`YS2T@iluRlQI3^CWU9o@M}4iwSk zxgOAf?%68jA8EneW<)k zq*6I5M;r(rMp&jmnxePelIR&6iSz#xXmTNpNzfvyU-ug0gbx!UiqHFYnP9c$_H1v$ zgHYWVNIm@Nm*9#s>)uu zUSAkUnG|ni%L>3J%E=6ZPDu-ll6_B|j~sHXR_ZOaq?&iJ zh!kx(tnX(BoLog*v;?#%_a8`j-VoTD@RL9%b|QxA4X?qQV%2`@bA=*Px#%&dV^04;JDM8fmel1(uu}a1@g826<*)(?%J(yc4tpN`Ko(Y6F>>~x3 zp!bFl&Io0$?HPhGR|qk>k?Bj~)C3XqHB%Ww%&t@AgZOBjwTrC) zKP9V7#DD`tMHcVBb<^MqD)VxUjX8S%?b#_~O>C!YDROq=FB92k({*(8fT*jUAg-D~ z$CP?DkFLo0u}R8A)3IVtBUyyp(4Q5jmqf=8s;|GLK_f(HRQk4^ham)__CJALFKAt3 zyv0QcUL{HV0w*S)oZDEanI~7g?-Y$_du#&sjuM!@r$G#|^?Z@8nU5|tp+k1|5ga2Y zc80Yhm}8L18khp;z$_;L?AS4^Zgi%TZpn+wzQ^2vAS}8$1$66l`aafN(Pdcy2Ci>PJ1fBS zdCezq1caC3P$1OnI-=h zGr!7fEvDP8eRo)9_@((Bk@S`iBF|v@`x9rE;sUwPTtC_|~B59dN zyBm@^{JecFXVKG(7nFyiJN$R&*8sLzqI@*LJSNM( zm)pg+2wMA(d(StV41IXg#_1-`%7Xw#yh_rH%Px}~YhGG8ZX^s=SYa;LrM3ydD(pGL zP|aQb+k$%L`em7cWtvU9RA98c*>Ph80h4kfA?9?=4`Bc zPwN+3suL2+l!$*_jQV%{#IHF*5n@Qq_u7BPyZFl!X!5|l)tKC=IjfZPyI1!*7)jnq zx2~4oxhj?XBy#p<;f_Bqc59uEm;4a-Gj8uP$4p@@smJfnqe{mWq|50)@nD}&e>#$1 z$Gs5W+Y@g-P1o;n`O%>9X4*9in-RB70ey7M($zTJi`KVXFy{eLrOw-K>kTpSuHMU6kxZM&V>j#w_7cngT z>B|>Vy|P4YeHE-X1^IsQk!;+PUS3?%QG49`pXKU2O$n)@9fc?Pb`XGY^C|0ou8)F< zr%{q$)I+-1G5)7a^^<=e*7har9w#EW#Ns2v`ugRsGV3`FXg{+aqb%(Qcq4;bvy*RD z4IRSQI1LL)At?r~?c(DM3xkt?V|R`W%*UwkjcM=}cX8=@VtA?pjXLZxl=3U0-Ncft zDg}nQ_ZmGgfDoadPA9n7P8ei1vc?a|7r&;*zkrs2uK2euG&yG@z}W|K;Zn^%@rPa5 zlJ;@o(njty;L06`YMs@Xmk}3?%Do}ZZv#0mu>5WyYXE8516aK!>G!}|g;FY|UIXj9 z5&PIK1FK%P5sL&2Y6pUuZeWdh(>;n*ze2dHhnz~zgl9bvBLlrjcP(m3%GF9;fNR1J z8G}aSTmI31d|yV&08K=G@biSqtK!Xg z%eN3|=W#-r(;M4q99;G=$3J{HtJE&>IaAKKA2Jay(5Rf>l=Ew8CU|eln-7myIHDxi z{<6&r`3EhjwUqZY7Sn;S3K8;=l zwytm#qVs_A0MuFS6k*HXA1c$^Sbgr4sr}CC;g$SJXmzwsiY?uqU#B-}p~;Dcj9I~c z*ti8d{^Qmy3Z);;gr?5$?m!pXFcBA;G+1nK&9wD(@HWowLXRGV7^ zrrIWU0!`6TzPcGMb1nXfQJ~sEi-T?cQ+_3hxmMmO&bt3fr+WsJV^#hEh*LDVK#JB_ zb~CF!I?~-foe&~ziH7O&*1SLJrILn(ly|FphFm86dbpBhr^fn=lJ;G@(kG5_eth}N z4{i1HZbmYjZ8}9=N{Nn>m{?%)>tt`tjgfev%uLn?C_YeFHUfG-hB+v<1(`TN04Hc! zq5G#UPy9N%0T!1O9YHCcOKl3Ckf$Zuu2)AKEv9uc<6MllfZ=1ka>ed=`G`aeKIn*r z06EzkiBO&q|DS*Y)`BSN6aZ}p3rw-)hak3Vc`RRcvHP5S))Uu6Ye7Nvj<1aKeP(5k zD5Ad>kp7-zgYmD}|ETZ7U-Giijv&E)UPUsBXs6+UGpY<%2HG~<)2WM@8cop`g36>HsGfRvq+N z&J7_)7OJy5t2u&HzsTz5_vuG3^@*xEjk^tM@mw@GB3h`o@#z0^J|oH6(_JJcv@AGQ zD5DU5_*MB_!4Cd|twKeL`=p`Q0k1_nTd^G&WQjB=xCEVrFJzYjTGx`%k{?{ddGw>f z|L9qUdje#b66_2W0VXp*G6Aht#n5u9kovBjV~o&(GBg~$>;OR8D{yw#HgW|80Sg=L zou{YC2L444JEZgWcw`}{#9EdtrH`-_Vds) z!+x*x*^EdCM0s+&yAD{;*rh4AJIaXU%au0SH^%Tr+0KWwWfBvX-I%Hr?+YYbL+WOdKr;j9K=aydkO(+RG!F^Kvt@D#gPPS78<;cd&>?|5t9pM75 zZ0$;_Bt$xk_I_Ctc%&9(=taA2u7`;?>LTKG@1YzqI5>p*-$t$N0(vsQ(EwczR3SG3 z{255B-GUeaYDxw?1Cw#s0Jw+dI1S{X1%F=7ghLw5{Ka2RxM76&pim2Kxwj%MDvjk_ z$}E)^m6NCMPWP&cppBoYWu+b@E%tTonnk~9u`+NGg&a#W%M)^opSZ-&z$^-kA=4P0tvVk3Q!EiZu zhf$(WbMHD9h*(IvlQxn+w!}K?RNs2@zae|r;F^v6AUSJ*Iy$cd2JC=e0#DI=DVvvY zec_GYG-hZI!|S)eh=$uY>Ys^z^nEwdJngzjMiAK)n5JqG{r07F(&W3?k$M9QgdCIf z!#R0B_|dCdS(->JA9wd+!;K1h91D?6ReWh z#xQ}5kP80xqu2|tcLGe=r#*JPa)n_ELuqWcQJk0AA+JC3_V5stkyk>(a$ML8)3acO zC1Nk~B{U4=OnqJA#drbv?Xc3#3Ebism9M+*Nb=iWZZ6gMcz{o0h9J$h%SN#qxF`Lx zfDL|2XDhZodow$Degj z7PjKDVogm_^9q}Mr|zT!d>!-Wn~3A8UsV$v7hqrR-AY>UHue~W5BI2kU3%5i_CJB) zkSpEk4O+bJp1_?3cj1TSbkDeDm?DXk<=ZaivT`P&K`oK&62&?9VnV-k#plq8eyqcU ziRryntMC1CQXcJPNz;XWX}uLEMxb(hM==a1{J*!c2!8k;~dc77dk4Q(M7JTAT+x-oSX#tAt ze+oHnPcGksXk5;?ugMcTJ6JFyi6wXgIHJZwqw3G6`W=~v z)#lwp`LQlK|MUU9{)XON-lK`@?YflI`kd3~FZ-bxme)?dni+t5)_u` zdP$5O`!xZu@lYn`bAdtub3eKt?^t*n4+GB^y^u*KR0b)ehRXzuR~_WkU~)*E@cR z%EzV!*kWjact=`WoPzWT=rSRAuwAux>fZv#72Gr2*ybAblfK~< zU6?*;68BuOzzwpV*1;ym_fmPVcsQyrGW60oN3YPI>pq*T=I5|+zekQ*L-VMKiZTjf zUvS#DrAe^~pjC2KPP`N#O;Pjz4@+vlx@}7mk4=P?4FC5!*d4x$E z*yvpbPap$n?Qh`H4aJ5pQxN)J4)Fo+5S{}1>F#P%HX@AM#+-sTn7q!J^#56k1h0{= zx^BLDgbTYr!Xt5gs;F3U{afU0VK9+?%G@E>tc&5h+AqOZkIGKQI=M*8_ zn2an&q$8ONii{?{mV(ntRA{-~ZcxKBaYhW*f*jl{k>`8*oFPe!E#tJ}_Ls8cDXy)U z4i?!EVaU&&&MFOXG2Zj3&pSSW%7&UVNaJC#TFMjH6!XQt1hR;X_@kBH$A(`I5GBjb zept35}yDWs`INw4v=NZTLI*% zrHV5Vj4wJjLa_5W>@dyuTwU>cfNv1YRb=MES%3}V5#^jfN33r?$r+h}EG5d9wtDbo zbZ8$#v^pCnr@sO1t*cG;7?)&#x~{98c3hvTJ_NF`WS)A*%+~_aq_2bTc|G)>@N`l+ z)Y>&59)V#Y()QgvX!R2yVLAehv`$UpT-D}3Qd8*DY8Wt|OM;KxkZ79_;dQJj`i>%q zlKWjsUtB?+3UfwB)@QCUMdTH%#003&u;K|+Qe~N|kz5;~OROgrQ?R#COrn2CY`fHm z{C^9+{uLSo6Ug~3--HLPT2T(v&c8E*djc0v=|@y1O;IW*&1ZBbxsI_BKg;4GDWWS2 z_i?6<)47Bl@4=4|4FNIL-G2<2I$!3EltA|C6_@8`Y0*K*@0ih^ayD9<`T3#t6*So^o=CcR!UC84xoo)&4 zy-+Jxb>@EyPNA=8AWVnjsF6H1+$xJOp7m!!N-1b1cOGQEPX$|QZe!OsDr2rp%L~Hs zon2;yVLWWI0kMc?q>(Nzl*e|FNS0cM?HRbGAH+)< zky{0xf$At7Xm6gtuLWoq7<(SJ7k#f_q%1OXDa7|~60-M5tk;?;P%?7{F+X6wIjtyA zgdX#Aj`k)&n-P`o$ra*S)^?`C)dcy}2IY3cl-^}4_+PK6{z{lU5o@uC5=US*E*q za%C)fs~Kg`1=PUhZ}O5dU)0y6j!LCttI|K1uFUpcbF?=19I65sxMe_b2J7V z=it{Z|3{!&REg0|JkTy;H4CnSMz4^aGO6b-q6KX!3tmW-3|(6UTzZ3X)wwIA^Zu&! zlom%Q1Es-!DNxP_PV_pifMx?J;~GV<^8oZ6IyZEMNPrQp)SQuTIH4FmOemi~du2iX z`oZ|WxbwAn!#QVl`g@2SXj<(IdD`kXIas)NPN5&pEO~}3RRo;Q8x}3$DVX>1|KDMP zDh0tR+q`9Coi3Bzx;qtmq^v5CILO~SuSlQ{)3`|TzB{iH`}}HC!$&CzsGnSMr#rg6 z&n*$DmAd$@f}465M&u>eQRBs{i5|ei;!ka_=)U{@?`WsAYF3%LZ0MVJAwh z&QQ*pKWZx0j~f_qwXT3Qb{)Ot%oI-k((nn>qIF{5i_9vegPOtt>6MB3uYAn)mQ{e+ zdw3-W1NF4zTKshQvuYeKlGWJRoVZs@2<7*?h+@ZC?EWM8gSLjzc9Tt(5*ElL6xsF=ppAk*6cWx5Qq zal|OtoKo8W1F^B<`uA^PtaD@J6#inyJ4WmgUOYh+Kam-$v6B_Q$xNu1GbX9~>6b6S z-W~(x*R*{axMfMS!6M-sn zEV|uikUl@yEBGBpb=IM2+v7o`%oNfQ*!7z|t%9{!Hw@B#lJSIrr(4n&JFM9k3)s&z zv6x`RspvF@ZASYP$4ElO`P@<0-s-^XQFX22Hx*Q8vSS+-A^GQe(*v{jCuhk{cRa2< zJ0=7lJ9d7ZlPaG;BOUAIx>3a+PZl0NqW$Pd zzqz#91v#Mih=qM<>G9aX8(RMK4i>B+AcHx9`;Yn$Ju$=LOUcOpZsBLNwgckU6^r5t zoFq+h(sV?(-XrE|^{FvbwMn1jxh5Q{IwVo2xc!^{ve^yN4|i9OhSr9b0{i}R8XCud z6Tin1N7Ne?6r_9T-uJ zcJ*&2B?^$QQC>eY%5ckay)@NZonBSTTpQkFEcAXdi~Z#nzi;^xICIw}kkHWlKbM#I^BjwZJyWG@?flU3fm$R|%Q_+_R@3SP~ z>@b=_517bT<5y!WqL3tkT7GWsj;}VMc&TjG%o%z)0%&Z_i*$9$?FJX|bGygDHeJBDfd|Ao;E>a~lGsSoaNGhLTx^WB z$5*ZI;SBb!A84jRZ|t}uk34H%h^Rb|+Nf;EIXPh~d$U?(*Bwm%xsOY2(kWk`5fK$r zlaEFdWt67tprL3(Sb;skP#vi8w`1M2f+?QQ)Ul-yDrmk2$F zcug(W<_+3FMQouH^MJU`D-gk>g^A>f!97Tzdwu$Txe@6vX}kRN)(JJ*A(0g!Qt<`1 z=is1~zH%XBFh&}GGnR3aQ4v4qDA-S}Z7k)Qb#u_ffd{$)*>2yNJ-~|9^Wht>Ep*(bU7-8PGaJO8Z1g`aX{-AFIm3Cv9#ql(YpOu3$Gt zuR!T)hXUs|w6weNWQ|`yp?BV`q4B9#u8nqOyE69>ODCI6xH7=3%sqebkDU{*Jl6O? zSA5MFXPE&_`Q>E?-p1Mjxy8?v-*06(SV`E)O;->w;k`GCB<<}v(%kM*(Iq5UKLe#9fia;Vd$@eX>a#POxf-+Qe&%XLX zFX6t%fu~a>JgJ)BEt!j19oYkXV40HQn=`1i64360nUwOGD90phuC`yqt>bFaWWC=X z4sVcU&r-th!hk(eQ^>tHWuN*ue>A{GpuOaSGE4Kei&_-J1BgV1=Rh0P7G5|jH>{9u zU}z-#baBd-?c>IkcF}~#-&x%uu1<4=vbjbOgnx_j8+FN5e!3!-Id6fcxsW=b?#LMW zyzvdAK&8}(oI7x)-t-1(pWkCoYp8S=K2Id%b#Y9M0F%JJ#tQA~#<<`JKxDR>b~Fk9 zNg$8qMx1ObGg(Sf;iB8U9y>SD3{m5WVRpWTEn**39BkFMjJWd6rrt)eqEAX}{xL)-_ovVj;obdnoy=DDsFoxmeR0}6QY+mb z!7ma~ey*E&2J))7^!Y)9WJs6}nsQ(-D75W`N&-|1&vQ@CmK{aPTJnmP%|A?_f659I zWBVXI8pLptquBOu@QfG{0YiDoSY9g6#w=r3#5IC}f}^M5ri@M%_KUpM8vvw1Yzkr9mag0wTkwhF zO8%QeVKT5$lA}jXv88p2@44YODPrYY(So~6v$9<*{hcr1t66Ddpe=w)uV_-dYaIP@5Lhu2|a71T40~@E_)TVQjqh3T2pR29K z;8hNNWdNwbb@f|7u?g2D;75&BW@_CwZ$QjdoHHHQSoQkIF;6d<{dDe3`ism=IpKggerD6fFQN3DGv6JHYR;i|p3q zKeFtYk~{&cc2K)ztKDJ;Q$h5}b7EujpYd6?q%ztqTTjDY0_Um$HyDp}v{2W#Z4|Ma z0!FbGes{}tX%kI0P;FRO6e@>ac247_t_AJO#rz;#J*yyc~ef2w1h zQmF5{^?T=@ww|%*OCCJdjJ@IUqn@r%PY)4e`DLK_iKfqs9ErELswba@)OT2&(IDL4 z9TT~cU!Up>z$x`imm};49(dmZCyG}^FR`())=Fg zI6QN3*Kv=07|UDt3dF%zK(#?Fsn0@^J_r8}$cdauhrcJ(YNt&QTN}C?R|bLdA^vmj zulB&6<)uoQU-p;>N`+@y+LQB_NuT_ucit?lo+@lqWG8O-Wl|X}t+3}(gY>3VjiFf8 z-b{U$XAhT&M}xhsKVjZAnVpdSraNiy8w`f{a$4&9mBKjg&nagW zOnazPNj49bmsQ?srrU6S<9TZSL+0qGuA;ug%;_|u`Px+=?XjNT( zg4+!Of4H{y%2g?cW&HORlEUG=EC+|8w2OD>(#D2fx& zz0U9Z`+E=jXSVO>^LoGD&*yxgp4USh;%wzDrkh&+6N1Fm3rB=XwlB5?w!oKYL^I(3H)S>Kp8|CpINr4zd&#xH16Zr?<)r% zAln!V_pj#=+g(cmVPz1%++wd9#u*>n%$qX+dr`K4tj74pOS1A?3+3i$M@5M!P-jtB zQQGV9SNfg?##A!6=_VX@CEBCnl4>8d~dt2hzT8^kK zGV#Am(W zLX3EC6Lj|^EM>_Sjo-GoUl*Iv5?@sCqSZ9AVj{(R;*Ie9KK;R>TzXj_Q-psgvoLOv z_BM#ya=F$QD>0$VsC=|tettf#E6M~z2%GHO!`n5|*Efu4->|UL39LNO^VCir041vd zL~iz~ul*T->!rJ~#5s+amI52s!13WZw!g zcLYwN&!&m-9jsGT`jlZ15U>8K-vSUzXdo}u5lybHwTV^=w!t^^%vN!_F7giSqXKa? z9cZ_RC15E}(;}V410kgNLZc}=>qO?rl{y1oEqmk<^d;pD`$q4aum2aiN<&}~RG@As zAxU`o)9YLhoQPRMnz`E=T$BdK6v1Ku9O_rc6F!N4ToAkgGtuM?w+bc_$I`Q0#giC^pgFz4Xp*ai^$9Aj@_4eu>?``o z(e?($OZ%Ub96q~RmM*1*5xVyq8ce?(BAY{%TxL0Tu3>OW_t#KD?2YrDRw3!TjQymx zy4F`+bTmA{B4^ySnN65fNO-ZsA0#dKs_2gHnKpPVDvbs7NpLz`-wT1m@7mHJJ(1c{ zuK4>;-BxJHF$_Nhr+K?ZjlF+R2|WEq#9B9_5!*3tHzW!(TDi95?N@w3c?Vteqk@c9 zsW;ts45ritWdv%;kR?-x&OxQ>w%EpOrQp3XKeUH3oUfoo;sg@e?)F<_t~lu)b9Im4 z7p)RdA^wD>aIwqHTZ{5=p+t~6S1SOmNpbQCzJ5j7m)OX|ZayI|>K25RuYDS1-N;>c zyoR5W^ZaS8(ZzpIyY}~ENe<~JFK6T{urrt9491+qZsD!m~OzrjL$`KYSQB#8WimBmv=;Uhl@ul*ui?I1QOv% z$zG|U2wOD6$Z@r+QAqI;8|dSmi6t$#`Rc@4I;x^`t|-|vsN4YftyJ#eAp$x;CRD0A zLM_gn{@W1)Hhd(mfZfYHsgpE$4Nbag%`9#Wc+}A4EzE#7iIML@4$3+!;P#>kuj#=r$!q$3&VcpF9ZbLE};$-b5Hm%*5$0yhtmd2IX!vv86NM)r5BPp zLl=2IeU~Wr&q&d+sYu%Km4muw`yH18QFMB{J0!ymIgf0Tdo@>-XpLMf%jiKjNxr3x zhVKajS~@>?+K5V9VR3ZJN#gLAZ1*7R1;E(&$Vgm051l9{Xl^}wt1};VhUw(eQ^2o5 ztuNVgt^to8v(|3avXmU@Qe1{CCS8YQV!DATyAuA;y(}7mL8O({_FEVUXz|r#zCjIz z^oAj8gs4{c-q9i04Z)oiWQP>3qU!)@nX!CS64iuc{VWO1mMpu9wEPiJ!fya)hCk53 zzLOVL6|B?+LI~PO`@+1HVjPq(J6M*#I}RlZhEEwxDfrXa72vmv>#)WI8l-$|NHtUG|mz!EO9mS~5iWMj@8%5G2(ZngG-~pQPKKq$8sS_MPV2B?#DzMtC zc3hwU3hovM=o!{b8JKUzIiyD7Dz zeB#IYFX+$|tdDZts^WCgEC;tSJ-M6U{`X`o2ytG>aTQmcE50_Jre+|*4BkdE`b~;7 z+zwQs)5~hmOnf3=EBHyy@Z||6d4y+DFzJ7bIl*A+98uBLaV%cCi`w3!ld#H&ZZX!U zB>Of4&6Ihv#<;F_w^$+zWrsCl-%pa-7(Fl8+j z&Q_4`M!Tb(J&~sg*nRA!$e|OF9OgE7fr5;iB?BmrfH;q#PR?);$Btm#ZQ)d}aT=|a zyO4H<;3Vep2L)9`a&@r>@u(hzyT_S-$r(&soS)253)e7u@O8rp2NC+!ZXcVny5GNwpB>T|wrc|f>U zb|GA|oK?mNbf%#^6elJMxhIqZ)vuA++fouMc_eRs+2J;)lmsMm$^fCfT=eqZ@h#|GJwydAd=qJQ^8~>Nx39 z>H3(yj?Bz?bx?(Lh0>XHxzZ4DWUN9OXhAv`(tacxHvsjA=EweRyWks`sbOTNF=5el z%A?seIA_x3s&AQow5QFoI|p0jj^CYsDr+XA4X-?NFy)G$>(%%|rOcW&0P>Y#|BBkN zPwR)%P#gWjaXrd@LEXbFJ=zV!PHMJu3da#1#3;V(O|!GpO>G(0XRkE+v!SRRqYI91 zu<}H21DiG_to_SE{R_dvFN&%og3=WH*8-!BSM>e4n})5?3R~>2T$eC?*b?FsQKGQX z_!-kO>hvozTb>b^vI{k?^BglU*;aR^I<%eQLtw!%#V& zoM#EnEU)Zj-ygLh9!nwX2)Q|1xNUf{|o?AN$gg zAJ9Dom1X_?U;c#{-{}=xf00Z0*m(V83!`~P&e7236>yM^k6GW?n6vNjIAq?YY(xLN z)%Umv*8ezg;3KI14gB7<`>1ulKqAkf`gbQ)cjnRUx)l~SnsKGN-F4)j-jDLp`mS?0 zd;PnMimusxFDzFBRcyQ+fDPi1g$MgJvznR7J{-roUq#f+@|ui{CFDZOgYo5TuS!u< zRUykd`J)HJIXDaTLU!P7-q)H_@&^a(@3$+hSW&qPsP0!%?13G9b@o!Dhx|qucX-(_ zgaSDz9koWGmf?Cjr%Skj6YayuKCj~iVr?(aKPSAxO|`y@`sI<5l=JISuHYJRYiJMI zc(;eeD+P!Oa-4TQ2_%E;Jm1s9+D)tLB1Ft-2IkG6z~y537Z9krxwnvIngj9Y&@jXQ2F7R+IWgbx{^BQusRdH^Am8EdDvlnYexD*ggbtOweuiqjXx-eD2pp+mQCP0Jpx;OrzUvpf!wz&2r=#}{^p8CK$O&tITX1__>Bc^I_yl|N z(EH2`iSC3+==PoCyAG!uIa>P8kM@1h9S8Eief^#N1SHEiFpv=9wru0QoBk!C$3^jS z+s5&5_U|W#Vg1uxFILEHu?u1gfrLR<2U%}J!N1{;63+jErN8ExaUcA^a@(*Smlm3= zO9#R8bak<%bclgs@E9cZn3f5Fd|iqfFs3FS+4B!VWzF%AGv6!K9{4*Hw1EX<@Am>N zIb+jIu>ZJaLTE_nusmAH}c6PKF?%HH}hGHf>xlShvG*J z_S|Qe!>0%3DU$V&nVm$t(vZT|PY5QW)ei*H5gE`r%(Ui(|MC`$Ou1=to0G9TG=Mm)|QA1vi)vg0bO#M*mR z#g285A3N)85OlJY;GxKACh07jY9Ytp&DYOxqDw#{o!AO+thtS&aU@%txI}?T*`VM@ zgqU|nC({`6&Sf(7&<|}E(Ph;13vY@;N-B8jPpO;;L`)q{JiUCtt3Xg216FLU;9)|= z=W316jn9&FQKd-*3!eKGfwFCwewO|8MBpQJoY(?NC6;mD_J-1|CCzz0peFQdE7M+<8H7 zEbj~3ZmBFKnk~^j+}&nTi7>HK5h3_+IKn0s-PL%W@pO|~c%|Jxv|DBmr#Z*|HbgEa z`{eQ!s^Z?%9i?YCw}^!!1(FPvdgZ0sBN_crOn)#^{WGZdNS3bZF1~sNPT2o5Py6{g z_7EgfU-}bkdG92jbhXJczz`EcKWUCh8*HN-)zvu=7O)~Rc;)o2W$RIlUTh{2lxQp|3vqra(TO!oE1_EG%`GXp2p1MGCG&X zGi1#cNE8mVa6Av#gc8EuQGs0WXTG0zl?luo@uXg!;H%|SP39@`Hi{RteNJ=>#fc@#$>h+>(XxUj<}V%@1|Dl_Njq9R3G0v;yE2@J9LoD=Eb~pogY=PDunV1bTc2Qzw5|qGnR@XFPoFBwtxs0*&%a` zYl~J{Z`ttKvwa*6#thI%>-7+G>vD|Vr@M;qNCA3O>kjl`0&uW>6% zQYeF8oD38tuDn*$>VPt8jQJt)R;TIIKYAe?cX=yewm2J@M{**x832_bkS3{MrnXQp zq$V9~2F<9>VikOC99YeWegx5Ab4Jf#M}fNKL`B!+cFi12_QDXn#Gjd|tl}SAQ-&?j z0i;-*YVd-@cdE0_*2J(>z(I&V4Hd^nC;4$_XT6cy7OrW7Qb@?Yddq`&^o6y`*om_R z^#O|gAQfqCs9#T?a|a8h^rF%#zQ(ABEpB8+z@nKwfa+V}K$ko|+Co7p)($VmxiD1r z4hB=ix*0b?`!(|13WmnS=t#h{1l}Z>iay#CV~s~GGf$pfy4Ei$s-F(nA%p4CE5fv{ zE9yK{mM@KLuH>Zsf^(F;$9O6Ih-yWxI;GINX3=)H6+)PqmV>CxUfR z3bXgct~)MVb8KyYhZyVIGV@c7Udbig2n*KpN61Wxf34}QH(?-SH`!vJ*PZUbCf_jT zsUjDo*@>@^5UJw`u!uZ1l^#dXrqw#@_8w@z_q9gV&v4Jp9kVuCZ6v8Wv_%fqdZ&Xd z8u+#7XwYE@&c~NEC01=x^&)Paz8_Wd^>IOYVb04M)h4;t2+e}=Dut7~={cOi z$b7LWQ%CF4W_xg>cwI8YA2m033bTRMc@#X(;~DrptUtA=n`zTv*b(AtKhET-dwP0` z$yqqg(B4PIHxfN<(TBF9{T>s{@}M8&3x7G-*7ec-)NAvt7T^bs+~*tP-;YmCrMXOQ zE%DpZje$<{xA>-9g~#7UTA(bW8TrgTF7iJH&t`(E??0bfm7gkHl^cmae-A$7ZX5Ig zLJFJIi?@h4?uPl;Y3_f!+InZM=2r@48W-S|82<=YkumuBW!HZqJ=~yDr!VpyM$qMU zLs4*B>{82QO6-U;mE#mId`~FHn8&nlavUtfpoE5U426y;l=4bJ>dbYCzJ~#bN z^gBjelQ$gVO$>c^qzE&iylRXw>dSbK+Vq*9tG#7pI|&pvPwmN<4b-&n`g(QZZFzFd zj>;mV1nb0Le~J{YhvcPUlZ&oS(K13h{4-9@MBRBIB{!jIWo(SV9=WN++i_8zfa+IR zGl3O2gVG2=&6 zWEh$ARpCCHs;=BJWgqSzwp2WQ9vL zWhJ}M4$=M5obo97XbVdE;?}KwJuE1tqSh#G2lcf8i{)3(7`o-(g&-~CKftcccNW=k zml!#HGtVX~v21U`yYfG^-}(QN zkIcMEDfGu})&3#YZCb37+UsY)9Sehq*~MdLww7~_mT2dFZB9+gTc!;@{woAi_0OD% z$IW|rZMK(s-aL7s=e}n3GdK5XYn@zPd{(AJOF~sv68he_4TGgZ>AV!THFwO9Je5{6 zAc}a>iR}y2Qkt%Mk{c{Nz9}M`m`SjGGH=^CD7O|nuWq#6937_ECUKIY^nuYwK<=ZB zj~$+GcYp1vw$Hfyg&T-j=Eq!qR8a`Gyi@IUHW}!tv|rNRYF7RL{pdRXad-LJjXh#{ z3~Z6{HwTYuLxsiZ$2>Ccn$T!ov*3C2=QkZ*>91M`dyASb)jt1EBtE9l^3KtvJ5mS8 zu8wUR%%AU)WhEt;rCf7~_M=8dPOF~&bNlDNZqZ}ow*D$#zd7(2{`rFAUiZtbWcKD` zt%(d@dRY%r=}*bhoy@`8?tC{xs`>Hfk5QlVu7r$vh+4WBkDvYPaU34OzqoJhCh1{L zRPkT4zb6}O6VeRF1L%oi%x|v|lkdoG6LE0ev6a zf#~WgBmy#cHw{IJV`8tjK_#56rBL4hj9cnXYoVb%Xm7DvqG4E_sai=)`5`q4ya zzp9}IbZ8l+%V0?(0S!P%ybd#bU32=bg1V@fZYxMTVHMY{l?8_)@fg;j;-|KR^j#X0 zMX$M^>ZREf%3KFy=$1B6>m3JH&8I`oV9)DKG+mLT=dN^6ml z0h2BaOGQU$!+M+-(6R?BTy^HIg1!R*`RmMdQ=1G*k>l`XYKcbKzzof$Tl=vJQlWf} zwL#P=)PdQZb2PlkJ`&>(jl%#ibpHn zrWWH+>e_rXu+?gDsROK>JUn4gp@+22YXXU`B5$bRLle_SS?4zGR9f>b!wKmCOue|) zz+K)KYE-a^X*qa_??%`=q<OL@N#A)hfr`|n#MeMZ zc$B@;7fY)jD*IgIfVFDSP1!9zsjk~Pn|RV?zJ)wW*>-6E2?Ut2^M|3{^v797rvzE- zcya#46Rq6Yl(-GpEiPusdip$)S?4$ImtQ2opYMC;A4rh+<+5TYUV-smDo6>m<}_}-W@;WOJx5jp~stx7&=zeMcIQU%4_ zTqVY_EAqkw@ZFPr!K(G`4v0PumS^Ep3_lTawnqO9lk#}m6;>lIW&Dh|T?z6+UZ>zx zbK6Kj=p4$5+4W?LWL6k?dczKUp|}y2T9J8B_f(vkG{s0iUSanil)^iN-0NzmFD@|E z9Xv#bT|Dbm6U)@Qd;+zMt~km*?S?-y-UVp(Ogpw)_$q`?Ubjd`Z`1tqw2I@35Wbm0 z%x)QXa9`MTT9#Gvf{a0mJIS0wnV*5ZAnc??SU;QeU|eZomtm%ebGO2`wN4;)pqL^H zn7mLt&$Jt7MZy#SQ!O1@<3}uRLI4Wsn~@e@cLzp6(r(~`e=>{Yy(&`gvn4^cLo(4% z5DK!*Blb2%ZQ~?~I)PI0NYD$_wA%-a0>^lC9_1yZhRBfoCukC%sxTZSB0FwR60jGoJ zc&$YFMaHs{3`g4_YXLQJlPr1b)gH5isk|cCodYseN|Vjn1@EB1Q&{&Q!3_Ql{qm9z zZR-3agyY@%`IjT%?IAh;VdBj0N6m?r?LPuXgH9 zP5mO@peYXoV%MYN^LgJiq z?Pxl`j65jc67Yjg>vHf6@^{ca4O~^?X_ZsMt$`3oU``5l(jr2=)@1K9VvCa#(X*zz zfzcPLXHhaZkf5hGxK?J9#Wz3_{(TE8YMf#2xtt?@FDnpPP=2W8ucIdKRd33mW?|}b zhgW}mWpT;O{T{`kM?S(&e`5Rli=F=oU>|lD^k1GeWO&& zQpo?5+UaJmVr0Ijt}NuN{zqrhUidnDE$Szd{G(0mLDWyXjTj-kQ*Oq_@$4i^`io1r z<_)8$|3q#Z9w|H}|FO~$`C=+*@vOZBB%nxN@AlAxa_u#xxyi_nKBtZ!PAO9V`t!H) z&0n@NU^!G4c_=I8wA_qW$B`)MAAfV*bl>FIEj(u3YC8tWX*O0`q8|AA`=l^r&TZ<4 z8H2qrW=WhJiR}}v zy>@Y^HQB)52Lqa1qJ=J+%bm?$^%h|z0Q;*Jk_#la02VAYBsn&}Hck3Sdw=QKy zY70o%-kO7LvKm#)m6v4M(B4EQhB{jy=*N9S3Db67{r?SqymstYruzgEbgcLI=oIKkPqK_!<1RaEe zeV^P_P*2eGJ=JcLSskYIZd&Bi&MXuwFuEZfle+IGuJ|fYl_Uw%+xdns*3uC{oIa`= z$78v#8d%&gxG^0CwK=F~sVuMnF{*D#WdV9P((}L5LE@2q9Q)N0t;mu@HhFmG7_itb zObd&{P_n@(1v2WB_Y83Xc_ufh8eOa-sdiLEQ&?XInK1AY# z{yBlmkWjA|Dj-$Gx`byfGj-G{0Qgl@Nbwt$OC6CZOtUGZt17kM-t94Q+jpV9Fp=q% zlIIOmupk}u<1hvd+?5?b)w`zCLj#$i9|l3aNjx;p)J@khCUS!tY`UnJn;^%( zdStsnYIl9uw+qa4YRF`h>iD8l3ESKBmsjEp&(yyG+GbpD@U9TeXlgq!&Wn-`UKY30 zM5?o*IC5vgf&Cz3BbjgP--?>K^!sv&ZZ1b=4mY{{#H)rsFA3!aBkpamOH|L`KET^O zrNxJ_g}pH$fbYz=Q5;caQ$csgplo=kDoa%+z852!YBal;NlEdbX(zbqiH;@&Cj<#; zgb!P%h;@RQa0t#G;{vc&btZ31$Uxd14LYO&&Th@=9kjIY`a8@Zmudl-k8ze9J+$tj zAU3p)w0vsa=Wf3o{79=fM9Fr7?@>V=G6@sK{h``+xl3x6@vp`0_ z2L;1eFA(y6QnEKvwVE)Cb?SKWLa8bPQ8A(ST>Zu`^38hF5bBudJ|JMtbcV2{^}N7M z#X`=tIwO)6lq>zQk|F-0V6-F8jY&}tV>iX5cb!AGJ3V#3$mv6JXJ8nh2TeSv)e&Bs z=tMI+q&j!`Z{$8oq}Tz|e_bx3osBs8Veu1(eByKn2XS#EGQcfCc)_m$C|D|LyPn08 z%V4;5Y#{Fc9^XHi4wKj<_)?2c!60~_;9o38FO*=WP26qjkPyD5&jPsDL;F1PN~Tma z^*7CaFHdIgo4z;Wj7QCRrJqu|FMcWc^a>ugMbN^$h5c#R6Lo=bC4rGWnHRrsUyUg> z4?xATuwfbbDPF}bd&-yfqg{$$rwxpHtqtpFlPJIth_?NDd90XxH~3AZ*za0@$uQFkTVjo&iV??s!Qw@=lcOz7rr`vn^6J4R+D z7|9s~Y6CQ<9blX=(AQ^aIR)Y0_N*U>0q>sFcSw%;WcL#5#4@V6u_vf><*#`eCB%8v zuHw959ZfHOB|>Ony5Xna=JauGS0sEcJh6UWF)PMMIk6#Ok3Z)1$7+Nxdi9XMXMw%k z0YOA#gSPR3d9N|6fIW#Lw3jf_$)>Q4RzPDh`AWHdz$jQ7NvI9X!Y>ru1Uh~1vGYa<{5~=HYSu<0&H)@@MH#F4u0N$eyMq~~T+um}K zFK6zz3Pkmv+VrZMafeRI|Nm!;;L2m>BKDza%&= zv{@co^K_ZYnLzrz{ZAys{ML)kE7o~iaH8kiOS<8v>p|TuG!9npaEmW6qyOC_rn=2C zvN4(|KeumTRMb*zA7M5~^SpCl7I>RE;P-rFI%eI^R-b&f`{f{Q0ykFkME0>kU1N?7 z<$-C?#e%tH`ren+x6p}Z+J28WZJo#wg}GSA7ga`;?$=vvRKNKd+S!DmrQ!nD?Xzl~ zmWMJz4-=6qzs+xzV*?Ww9}NGHGP>Jo$9q8n-%xIER`%97{j~Noe=2X<=KDonM?;tD z>E&7Nd8M(LE{{Lwz~cVVxsZTw4+GUm8ARq6KONJZuEU= z$96a_Ja(uar=DT#7}uR8p(9uOau)6c1^HxUU-(CP;?vI>=C6u(bbd-^-^BpZF65Vg zIXz06bjpKXNIf=PS)cBB-KEg^v5|AcG+P`(Gst&p^t`EMt z&;c;oDoqp4B;m-1vrh5Km~e7X3TdN*Bn)YMwrYvFKn&5<@;0#8ceNJ@X=NR3dlGmlY`;!F=w2apwE;o){DP?3GH3CJT2#JZSD6sv>o_mQv7N z#~Q`3%lnNW%$e2+-`2G2`VMiBj^!4glD-t8eteYyf|+xm7Pl(v)f4Za1U1XP2K$xJ zNPTds_g8xuGW^3+;^)f7{qwZo!~i_K`CwXXjNsGL2g?VZFS9B-r#u(!}X+AHT6S(htfZoQD zeINg3=}N@A2YZ%eo-TxD)BWmw7=5gMk2tjpPd?P>UwMDL5{{&oh;9&>(-7nP8wC3X zn{)4x&ttL62L#jgee>udUg8bfYGWIx@*_e^=Ek#+RMRiVp;6+VgfB{>r(7;c{+&23 zzt*}=UdJ(k<;gbM9j}ayDC)S0<6ZAs{aVg`FWPDj(vO{sI{O{h z$3vc!{J`{e`kYA&*kAp2JQ8}9ZuF+c1=e&>pU@9v`V5de@#Mockl9Llh)oA24;)%* zipds${uAl9IEr{Nk|piEcUM3w+_nxDioXLqu2yk$Ok!yIAWt3{+xK0|TkMsV(_Epq z79pvkDifmv;s>46${quYuB#VhxSF%CQANkxizw1DNxB>E3bNKU*{3aF`;!P?fJvj^ z*!)-BPZqGQe@SqVUWn;3t>Tv(iZwh_L72BA*;T6d0L~plq=?QZoQ8tADaj#nk=_^s zxd?c9eUo%sw*+|8tRWr6_70Y2pKKgk1`dJyJ#~Zi=6s0p){4pN*G-t7f^e1``(4j) zFd6wUSm===-a5KuH{@;?z%J5`(%@re@ITCG>Y4wC&Mu7#ov@&6Y+?lb`~tAe;6 zqnQDW(0lt~AYC6n4xL#8nCFtx8(mdX&*ThsT2#~fsP)Bf_;;;dL^;d5FXd7y2AjOH zvNBGjD=>C+WF0Nfp<`gwb6VWhc6ZsBRRS5R%0=0);z8O7oCF(ycxmXzVX`-|n0qb* zD)<;@@RB(blu<>eJhYH?35iufv9%J1^1OT$95NtGln;ur$G0R7rgYglAk8@>l-+J} zFRJtpo^GH-ler4(x&`YU#sNtmsvZM)htsc25%wq1z)DTP0+kbD@r%nssv_UN_K&FJ zeHNxLO@fOOd^RJI*`+5A?s3lnQaO$onlkPm=uWS5n)`>7OwONlBV-@hxas} zsE^H)8*n>J7P%hf@I%k3MeLO(zI~1hX))aLtuQzdbxpOR(mriiO*d1a4RWP_yCS0s z0^9e+>#p}3G$By$@)Xjn$h!VUn$C4IW|RQ!3y{X5FkX=eGQlbLhc0{&)>2|<_e3DU z0nkyu=vV;CBcd-UnKtAh+#A)BtzbUMkt5m9IPGQOXAUl&@VhPYE>J?7fQvN9hvrqC z_@-O_0L0oihAJP=sXOZZX=V`ivDUM&b%F`Yr(wSrS-skE-OkT^DeEGRvCq7X8vEd4WU5*+M86`f zI4B#UCOhsUIC{5k*tF>mE^w8CnN;5nzNM-(dapG1yQk}~6n!ElXfHy_5 zgWSy&Rxy3mD!&iV9)<7z!$Mjhnz*M49p-((AflGY z6We$GN_}GvL(y!=>s@TsH$7Q91%o^v=1MP-g@kqp<;iw9H{WZ};xY3}6l(h^!feU# ze5coCRsh#dJx}X=B{~4;WJ+|xNsgfSEu@v%BR|oErJ}_1?((L>C$QZD*S>q;?TS<( zS5#e~c4xXckR5;JM3v(Ll=CiDm$9SuNcygU?!v|nn)A$BPvNt;onz#2iuS2$4s)K& z(lTW9i~lFGaH6zTQm9boCh@I4Z?pw&r}i_?%+4;?USn8A%SB}+twjU2f@d_1GAMc3 z&A6qK9EN@sLMqhv~XvuXb^yThrBA} zJ}2ug%C&11&muU$BCOu!oTb9QmW@yQ+!4=`U@UbyAE0{>#;b$5pq~@1P*&BCcQkWZ ztx_AxKfru1W9e3bt?jL$A8uYQ!T*)-yRZJ%uIy!0w zg5RH-$Z9u~>uYMF}vbg|*~ z%cylZ8$=9;;dt&3wSEy-fe~|HZbYScCZ7*XTw3C{#shwi0FuoPy7=YoYx*|7;fZ%+DP|S3HEotr`^e~i>Z(g=ugtyd(z|chZ&2wvyOHtq-R~e3Y6@< zQ1+`^j}1M}uVz=a|Kx?aS;dD<*VnwbVr%=XnKhODbz6zs*;b?=>s)kmW}kVo#rs^k zMnmLA0Y8*~z^{UnR+VMsRdf+$`H}KCaD=-{oaF$A0{H!-W=} zIyU*7A@{Nf$X=ZOrNiX{knR;9vM*WptDpZCjeIt~v+0yP<90Un%0f{JvFgXI>l4te z=+6C;xPt+Y)85Vmxyt*zK3@}kFn_--hyBPg2C({WQX?>>8}T;Xl39Gt2GAMh5g^Y{WVdmLDXl=|n&WUbusPIB>7Q^7mDx zaMx89_qprzzno4lCLKyQP6O{qdtaiJ0eGZ8x4(^QU!S|5L-}(vHAZ2CeK$@OIGH81 zCT0IBk1@BLj`30nQ)M*dQ zVcZ$35SA4~_jUf2;Us*11@Lh|E6v*4zmCjkM_%k{bE_Yamp!%k_XmdE+Rxq*{%p8V%b;Fd{@Zw-^7*9S z>uYWxGt~B-FUOaXG8?*Vmk2d`RTpW0ZjS$c-Z}U&YW?@WziU@#-UzQ>v|hUyWQ?lk zivoJhA%bL$(Djq|KNpXLU<$DisJog}Xq~MTK)3LEpCP;*LHHxg|0KLmGRb+!4s6CJ zg_04+lxmbl@cOYbQ*f)GY_w>6K%wav#XAHRY(+7LV)Bb^`^-8E!tqmof5~T9Q6m z*2_D{(Iyue%D~5J6zmB!@-Y4Kn@`olU_XMb;Hny%e7|8idP*wrY&~E8L(Og> z_ej8-CVbw|*$U!4bY{4%AmE|Ivk=h}N_=er(c;mRo!T5-wcgGd?ga%;DP2kT-j$(% zDtO!q);Pr`=PjXbPG{pgM&DBB3N2;|Gb}H;hCkU6n z8Fb@DtLrFCufD`(RW_2A2m6)brXA(_)`)P0p7VAA1#4;{HLKlL;RY1a1!BWV{bYr_ zc^X-MTMjJmd<{sYtb8XM;nIBr0=1eed|j<0d}&EXKzEd$D5?v8pv;!puv2=V1v2bi zC{_N#mh|bD-{mx!(;KQoHTi}dqUx1llRZ>*1p8KJ3&ZP>^Gb2AQY+JJ@}+w0+Ti5A z$|mB$aFH5^Q%{%Dk!D7E3gKI89{Z!S(r@?-xhF3pMFT`!!YOQU%!BFilasfx!*=CE z_q@`pFLju_Db~dtSt2TaZBVH}q_IBxDIa}hFfbFjP!u`HmEtUy<=NDi!I@yww1E3| z5yD!rLNk}RpZUktr?UzJ(G{j}rzV5%sX$ZI`9$5~3%EIee^~YrOHF2-+fAdO6}XZV zKY7!?_(q_>RQTKN;^r~n5dF++p}6pb$;B-STHvq2Da`Fw&C;L%O{nV5&}(_dUtlmKVu4b$kZzKnPr_K) zDPIKcL23T-Gj`i}S2rV`9mh>v3T{~?=3>rXlzG)}>20T|jTu_-7&FPR9ZCy7Tk}L! zAgX7ff|+^~766Lj$wRx^Jz|meCcqa) zQU4viv?TCA@NfX7&=;8PIl&%^aQfYU<`Zyfr*aXbPFr-XHbFaH;9&B)jGdK@SLiUu z%<8@4G3bPUnoMCf?2(!Y9O=Y^Ks>Qpan}|>mr6X43M|EaTS^;_V3N&E*ZmgIi2{qJ z4L}rE#a8wG|1QI;fBH3rCyIpWz$zs*7*#=0d&BTgz7=HVUSw}20x;VH$dDZ^?02zD zu`JxSj2l{4vDG<0;-X$3ZmAH>G+QJ2;`PKWx;hHL!lIL$W=#KK%AzI@zg-d02Pu|O z#iPPkGVD_;WC;j;G9TJZT7926XC?e$sNr_n z7eKoZyDy>{HGzmi+av>OKEPh}_?&1+y~l8_dFa;G@#fj|-gV8w&?DaUDUyM~w-ngI zRW0pfp#^0?UV%Gl%3Y@v9E64Ctj)MSgLf}Z-d$a{`J?Sudg2@69AaS48n|t%Qod&) zD~#@Ms^R&NVB@d3Jh>;?tNxPAsJ4)QEc)v?tNKvkZua&Z>U_C%OHy0hNF=RkEpULw zoj)~dgj8Ku%(Xj4Ue0q`Xq?ARlT?AoHc)*fjB}Nj#B43T=Cgw;elhya>y|?8sh-Jz za{KJXTDVDWU3Dk4lqwbyIj5gn=Y4gAPt?zcetweHpdhvMNNdJb%Sov>`MOcedU(e) ze5z^mKM@FRb+h?F?w#`m-kTy=+mUg(3(EBYi;gI#2gL3dlz$%yLv2U+Zx5Z3!?)C- z3dJg){U;LFxun!e#cjL-&*>czzjNr1;js8&ujl*Rq$aZ&Vg2WB%1+CdyLkX{%tNDs z0}bI+_sy_<0$b&Dpbwn1tZd2XEIQNwKZ?#ho~i$j<8sSAo4G|UvuSg`Un;rH*oJH_ zb4}(FLM&7&Wx339ow-IaHkVv-%_WgrhRU^sZW_77w?y~!JHLPJ4?8?|_BrqO>-Bsd zP{+&|ukKz9`J&LGRIHQdr>QfA|4B}34~)uBt-B4C@NB~1P|lP2Rgq$Kr9zFT z&)KprA4y{xeGaPt`5sPl&R>q7)|qSdY|Fl)~bA#E~cB5>yh~1MLS!JC@KT(~WOUL5N%;k>}K1gq#&}DiYvpI_o zeZ6t|boh{kuSt686%84<)NvO5+vy`b<)GLFM)T?G7?uo8y%(LgI%_iJZ9(uqdb@h< z1P;}^TChGV_RPlb-ZZ}Zj2S4QFn=ce#Cwnekv;SFsC_v2w32hBGV9BKhVl|KaUcbh zU8u5ARM**vA+)I7^1{2_=?U&8UPV}lb@*oPrwV?wV--u~Fx z4M|8hn%{18`qm&mF^Z0_vSY^KH+AjM`=DM3DR*A}(y5Gz*7^NHqbS{u+#9g|VWqtqp1h#jx&;NfA5c-qGgk$vdX>f#v2%kj zG6uN>)4Ws1z}4jO$~+&u{R?UY&gzFzHBJn)%4b&O=V%l;7LDmmmf#Pq0&mkl-G7FC%6Yq{Ww zpjuwLMOe!|r`IY;eoqCQkzG<=)=VoU^PtzU22Zu#hlgU{IA}$qA>F}beo464bQfb1 zq-QlwIroe3U05YRwEVV`2nm~+^Fdh6Xxd!;|3p>k+S>|eVPVuQt8pXNmQ%lrs~kPx zFUIG7kGs~o&z7jbY*@2m6juG}oRA>Yw@_cf&<&(W_^s`v`>C!4=<{T01d+F_%0{&~ z;Rh?k-_m^+jAqOc2lz#1P`rlzx4zQ^V)34Uur7DsEq*S0jhwnRB zRX^v8x0oOjgV)Rf0crzhJIycFcfNa|6ACs}!*OG2ZTyxDqMVVPKW<*Fk0L8+$nk zrSl9!g)y+3!!D>7L+7GRy8|UVb6iBz9V4~ULy=$7ML1in(hr9;Pu#9?&>JYS_ml^v%ks2l6cFbF=sU zvpGJtQWVh8E@`Nff4r&|fOgy;-0Z~X#siGpp{J!mjmM%W$&ENkgQtdc^^fMrbP1t; zc&xh`K&02sIe_6q`X-$TB8n6rt~fHkpb;n`Y9xQ*6bF`Srj}V%g_NFzJ<8s3QymG9 zIRX61?wjpcC69feGRd%q<@EvqR#A}35>f$_ts4GRTyCl85m)@1hSyK6tf3!YX#c0w zW+RdtU^Z{CH$82rX|w6xjI;&?roe`)%Exc&4}Y??n$So0%c!UJDkSd}`{wt{+k_?s z!&nB$!%sc8EW?Gi?S>QlO%0Vc3SC|B7KPbk@{ zN}Ym`aDb)?A-=ZD_|GP70I`eE4|HBr-x6N|$EFop`QoLL`<3*7hYeT*ByY%wT9BPp z2be38Uu4HHtZzDGF$d%BaI%y>VoAz9&V!j?pp ztMOrdx?&u*Iz<*!mtCK0hSYchdc+XT=z%4+KelRO9QKHnq5F$u;HKQAMKMDaZkRfJ ze3Q`t0?=LH@p!~Q?#Mhw$IhJn%nuXaonsooWh5V)N{?shb_pB}^R6^k`+`OWg8Oq^ z9&rK5<)I}?FaMMOQ05|fkM$wLyoD96nH&_BNGhsUkW8$~#UhiRndWnPcB~fd6zCo3 zDWDv0BvSGWjXuNlE#QV7g#`cM4MaRmFg1D}V2Il>qrA2PKBs zz_QVBMxzx|gkldqkPZ&}d5wcMaFOr1fJ%^D^?i_Oa4F^4lRzRkW`=%AT*44 zRjdJ8U|Xh@<~Q54MYyUrN|ok<=^_SJji<;ql=PtV#gi7JiY;~wEBGba!9r|+zBxQ) zOzK8rm5@rk680LL-j1*mbirCfK(E6IuTL;F&bCdgDT4FYQ}Ic@1^;-+O93G^MI>KW zvCAyQD;_BuMGJ-bm2gM2B7w#Sz9HeDi3RSH!G9<9ioaS*VlmZG$n)z~Ge)P)C4A}c zO2Ar^#_tgFccIpfg2>ys=}rgaJ;6G&SUw3%J90dkxlwC!P?<5 zBCQyya(*JuR(CpSTDtFBIc>HfS0yZt)la5J>>$b`G$oN=RAIhqNTwmfNmA!wj!R4l z0a}Q~%YmbaK=<*1qr>&3n)eQjgS5X7OUDA+=}AikOC@TG_6lb;vnR_tc*<=(@63x6h2#ts1G5Z|t_P;}I4s8> zq-A%3QxV1yeKhMq%(RXaV0L}aD_*b|i$ul=zXbx8NGtJ{xarez50+PUq?>zDHv$f* z`i8^`NYyQb3NHJldMX#Hjm!<6{ZgF{o?W>XX&#B4y_mIVROYjC8p$a1`TpMBEe3R2 zhgmy)<)U;zJv9raVd0)#Zs9W1#*!ty7uo5)*_3IQwfrC~Si@pR)5H5_bz*sdc6*UW zORI`=3+$X(ZrdsW{-%OeDRS9njb?x0|z7obRVch*J z?pQt#C3#eIe@9OapK_@;xf2cT+M0EsW)Y;D?EJ!MzZyEbJ!lAEc6TAW_QF_HOD%im z&bu4!x`cF2TtXzgt^vQ+teOpQ<+3GadT`E0+{82Abw%HQkJk_dZJi!JHOFJWdPF!r zUH4$Fp)QgCRO@Wm)=Aydq|+;#MhmI6qYf|AW;PQ;?RMnGsZDk^XWiaQp`mKCkBHj- z6<;>9D_mdPhrTibpdXdE2G$w-xK|+E;>jL2zS&-xEa&bI7x;b^7A(bFFMRc-N&oY& zINdLN-LfL{pXCl=SJtYWTqnkCI?O(e`LiyoLzP{#+eluuKU+HOLbd1T1DBffs=E%= zUPw@BgwPb4v$5rKd?=^@Tvkly$RfQ(70lDg&|NsPajgGAF4-@jMlN#@zPj$I5*6gR z+-B%vvohBAExjz^sZQ;S)=r{rtZ2#msUGzqChh_huQrCeSRYfAUKVRoX0|2Js~J-9 z?U-APxOvC#^D1lFa|!R9!#q zGq|tvHhZFryjM|2IClJc5Ei%o#ar9yCHF+5=x2ZR?o21*Q~r2`bJJbM_0}z~q~}0K z)|E5>*U1s#w|w~hN0(XreycZE+~RQD5$CSGd?VAG*0Iv{XfN$9O3K6KR%!W$*ob; zbYWliS3s#z-xwxkXjb$J0B*_EzYP;htM&h+ldsVxyCs_Q&if`<_W{&Zfu>pLlTkE# z`j1)JJ`ScCITNYzol6D|H_AfhN`L!k)BD|FWcx)O#vyO{4SNDsG@>H*2NTH0w5xjFP*t_J2N3F|ie$-`n%8RA+{#MjsNoYF~ur3YK!o2J49&0sN zW#cs@$3LeaGDKFy2KreGMHprj&+T@tU-@m$oBAkI?AdUS?OdVqYAPp0V4=s@dK-6% zP8b_jr2>UILhHIyPh`1)Yw?$!T0S$RJu`HSYr8{~p#trP)4NkzQ`xnq^4i5OP66`U z{ZeSbpd8k2I(7JhgY5Mxhv>8_pdwdA3BOeLruhu^GQ;I4*^}XFyH1chMdcO`>d{=a z&SUMuC!!ds7r{mQaN3L9;4R$TaJXK)bWJqYRo>2+ZQ+o_t0!Ry1DplYGzaAe5D7S0 z6~+=;wZXP`9)IlAuhy$qisu`88kU|}tUh{{rkGTS{nJw+_ebkK&|3^Uexr z=0Uw-f~G8l9sm3D`!Au0e za}O_R=4OS%U}`EJ04%V91oI0;+;|pV5WqRB`T-{53KJi&D)E2C%hPHF@86Ne@SF}} z*dkbJ-r7iEJHGQ`ZX=in0pl?KZJ?GUx~DGxI=nrz5yfzlaMI^Ndm)0pK|@w*RwC;H z>E(+NtfdO53*6=_`a_q~{m#l=HdIw%jx^?az-s7%ZO)!bOu9CN3k%h5Wdy*>mL|)OlwDsLx#>SmB@C$A>y^= zz|aaX-QZiliwOPUl-w>WU?ZQ@@-La^7sE3G%{A1))IEgg$RD>4TF!GM36Gj33w`&b zE8L=tO0c7?Y8Uj?dZ&%hnNYcs3jQ5PXXZWQ^q-yVtzrH(?+lJZn2=;0h$U051{;=R z82B7XYT4oF{8tzTk2(;^xvyzf#~-=>AmfiM`s5hA0H5!|8ifjK5A4KuwI}8 z0E8Jq7-TbLZ)A3%Lnr_X!kW~{0!_5`!|I@RdH5&E?@(oeh-7*&kZN_kOGv~%S((mJ z%s;q|Jvz9Bp4u@MpTVv;^hdz}54PIvXb&bsO4JuTq?X;~a+P_1k{@M|!bx6LJ5I>! zMLfMQs}Snq&q{3K$Ouc_Qt%z6cLKi@iDdjx?+2p){pM_)W>+X;kv@C)vDJvz6&Fh^ z)T^A|9x#0Kvy0Bok@1ZCR*=gW$Kctb>9ZF@s{GJ~DApMh* zn4aAwhkwei2N{adgp6-kP0Gzve&xIpA@Qtr@egI_xq(*MYO!+`Z%L+(da%mx@N9B< zafx1)toj~J2g(u9B2neRp?-9JeMdi$Ikw^zLRQ%A^^(vwSz$z2a<`xZ;2%B@8}J)9 zl7|SnN*BOEB}Ab#R_M78q!4a+V%wnF&@w{1odcrM6z;b3qbs_@6iGx36!%<7qLP%I>@0lJGNYAX>4rJ#Kd zHW*~D#2vbZs9yd96{F0a4JSxtX|yFajVcCVt|8NBsk0j~km)T{BajU;dZCUc|vjUyWym8O3W8LHlVXD%{A4@yYaZg0+;HY zt9TKW$O?E7_L}-!TGvjdhDQ-9zK6UV~1?q|~u2DA` zJIT#@L=4-%6VfS?^ilnVpD*!5iALt2!M7&&Wp>H+Q{);)%%w7k=9l3jcX*r4&1?R2 z@h~7hKU1rMpxtv2cUu=5r^t-_x*DFE(SCg{GRM5Fe7)tgn>)hBSiv4F9jU{(dp;Z= zo#2s><~O}5da(e;Oi(H+k*SU1K77;c=44{ky%1I7P5slw=fUmVhn_L*;7LxoaObwu zCGTqQqqINy#jIjs@!q;)EZMQyQyB$yhDVz3N+;}2AA4!#Ept1syxYyVt!-L45RiKU3YO{D85Mx=Q;08F|#A^E)#5O9y9rW`A9X8-J<@?G68<_wJ7=G zgrw?YF%QS5drIVQONcVbTfT=6QyMf6BsA#cvy;mXj6+W=*zW=@z`ZNj!>Nzl;%RHk z?f9NJ&l(YSI`2sb_K?g~>TaN{ z24J}4A>0(s`JB8F{Av_-{%V(l4Rn@fx7u6IBcJg&bE zypzAv;G*RRrvBKq{)v>~L{3Sd?X#a0iPAzsYHc;DBraxT8O#X<%R9q59xXOJXbhZN zce6Z~g)N?Yaqu>G&{I#``N@-*KWcWx6$Ede~zP8yp`f=wGL-5C{%AQFZh7vn2u4TB*JuKwM5zcwO@7?T>4>^xAB=+_pon zzaevtbyiwIi1eXRRC1H&xx=?%dYmZDC~4EQaW#jnfv?%we@=h?dy@4&q3)8Ol>f@} zA#t_u_UW3nfuPrjroF)tF~06=E{YDAR?hXp>utsgZixmpg8ZnUOHGs4M84g6YDxHW z_UC!UQ_{M>)5fr7<$zdL=R~d`DHRSrPTC_V4q!^9Whjz@05yfKgns)kP z_@Z)PW6YXxMU8M&0yG0TyoRtABnhxDL|&}3i5y+d@4Eh-V|0R}B7%2RXH;ysNqw>! zfNw*Fz}qm#aZ!wn_`R5LaaIW8d5OoCTh8vaTSfS>At5sIO0MpwqEx@SHl+9qWCpiJ zg|gRRjpg+?Y!P;TjegEtl&g0dO{L?$$3_o3OyRqjmWsWX+Mvq6bg6ZJ;JszXqQpPtKWeJ{WjVVjb!5_A=BNB%+6b5wh(74>M= z>b|h47X2F=nugW#QN5woaS;hXQzwekx}InC0ocuRBA)Na*wNf53MFYlCFk2SV ztE@))amTEXce>oz?4iq*#^}*TC5@+p4Ni|(==YPY-fTRj^7x}UkQ(sQoDsp6djevX z1ZUiCnOu&YW7@jg4L=a=j>zB}rmd#Ldn=}_XOcc$bTUa;`0zvsu(=)9Iihh>v7l|y zPe`T9_)D{9kX?`qub$I3E&|V+!GAOZuyY8<=nq9O}NWqY4f}#{7mxtVoc(&Y)=_8!0l+e`E zx$06BDM!EiXpUL?V<|jX3Td5KPwnTbWh+(P2cn16^5zM8=6q0_z67xrc=WeH234zq zlUo61?sji@deIH91%@Dm>0UIm; zlAgqNnuwYbw;#7-jf*G`>$au&=s^0#mrZ`>oh>N_4Y`^cPDFYuL|p&o;GcJXzi`9m zbyVMZ*d$HRip~AUv!~&bE(`>e=y-$G+OzF8pp{GBw+-4&VUpAsYcmOzV3-QI0MlS# zb*dX16-TKEjvz2DsrV9dcezEKPmw;VRwC!B3O+9vCGK@wUOuV>Txp#N8J<)f0UT7; zjp09z#s)p`xd+0?nHCj>6Ztz23wqVL+)oA50v^-~$gvetFLVI`_^5miHi}NtX*(2I zcVBx+A8Q$-A^BCnTo6y2tJdtns}Ac2lN1l>JaeEFV1OLCuLr!9Up(e?fx5?z-K+g7 zlKB!P2o6JSZ97^6!eC|YEgk*>;^_=ryF^SDqD-m-i5}mv78up-k|P}de{9)mV*GOs zVMIuXCn)spD&?-X;M9gsQZyX*T-x&dLQ&RS63v8-;7R8omTQC14v@s%c^L=YUdMVZ z7s5ry8T6})=919I^63xEWi*z6&Gk$(Uq(GpEnUS63c%CB5a7vy1n zfcd;r;&nFyNRB*440wRUtOcUylUiHA*2Y?q*jKrkb-?*tfV%bfJMulLS)i(5KEqC) zV(QI69i-oXlkejQRm}Mqf{o^47(A%TOX?uG=PU_lWFUtxW|-HYOZ>)NBMFO9Il#16 zoSA;cTwOl8ozFzSGYdtLxE{b#Y;}vi+9uUv$Zs`R!mpiFq6iZ`+hv5&Bqh#SmqveA zi}}%~?kAjFPOwcSDBx375A;vn3Bzv3I4+n9EZcJ8jqVP~(?3vUPY`X&{xanjGOl1R z21u7Xrhe!o9>vtX&L|8Rr-9m|%s+@eE5(}RYLVt9jhXlV@vQqu=RdgmI0vM4u7+ze zWHl$eNK)PQU8w#>`_$v=IxC+MMdOrt7)#q10Z<0X0}2PoAHm6m1jg#q)JmcU%}cI8 zv%P#e$^A0BGqO9<*MqhZ+HU(*re_@4{hXR1TNmiZF)hs ze!G#`IDH$bC+5mf2HV^fW~<*&P>&OM9Fx-(Vu<=6WZZS)}VBC=EZKy@yo$?c2v zOlHU$b(G;dm)@Y&n3D~5Ggw<``+{1oZo=oEEpZ3wWdb`i(T9Zoz88O0A=i&ZR4z4RCf&g`CJT0C-LEwcYH4R zdG+*bHKE4#U~_j9ogr!pVtUI2Mwaf}#AJ*dTf3E0YDXxWUd(?pcbFpUV2jxC3zs<@ z*9@dd$MdS0x5DZb8vV1e-%FfpaX73|`OE$MmC(U6XGCjR)7^ilWeEBX*>-VIZ6%SC1{|N|88}2W$$6w%Z};YK6;cS zxB%AXc5KrY)B&f3dsqI%%f9Y%8mlarEKM$?d<79-zDxfWhqQj_BL$*uxNeW0(j;0s zu^JY07c|RH<#{w3F0RLTUsUb%Gerx8E5=XB(Tiq*WA-&0=GTu<#=T*V z@UokElQlQ)-kkgRLe?AV`Xp<%gE+pg{61ybA_j!p6`i;YUSt8X4S(Y4}?0 zrk^M;$^ziw)#u?~8vt|T>rTncsNvXBbzVJldsc$kPm4sQ;~qUlyH0b27nv3C$?EC1 z0bQbfYnsE;b5atRO4@&|^=^64#q3G!qH{kHCjp_4#mUAwfsW&G*x(ue>i`(bMb4{+`|aBZ)js2_@y!9sEf@Rl-Ze z4ryxHCqC^d{1AZ11q=26b&$RE*okTCryim)sh=SrFgMCT-H5Tx0!Un3qF6KS=*q-% zxcLNE9gp>Gq>s*Dz8t)AHG=PVV|jm6y6)G5->8TF@mx_-`au83bLwFjcxFjyZvWi= z3`ALX*F!P&v@7chkX0%DwFgdYXT|5BHN&Wy1*7v!PT%OtM zSAz^#E@F!4Z+2+V+nj~unt;5*7$$KMsH4=zD|&>Fy?Q-e{CM3p{a(NlOHh799f^ZI zok-_DfQ(ZEMl*Ljy=&m$0h^4mVehcu2yyYzF*Q1gk9Py>6KWze{&!a+CI!3PkX$g)%?Y z+sHsf0aebYiimMk@r|?^@pHJKJG@I}3Yr`)AFvn;HXC&nA53Tvmn=Y0+LDjLDyJzo z8UzaM5DYB32&alwzlh*FBcG%W*N1{Bp~?ny!4?l>MpcF|FI?-c#V18d|LHkz<=>}m8Y)uROdF{)g13Q_dfpuzBCE7lJ$vh zHU5X?)-;lUfm#N%t48t)y+cSL!rDI`ahRaFjaP*!f3?~TqMB#~p@X3c?gu;Oeo;Kd z@+8dE0Yu#)&LZt7M+>-Ni0?Bb`UH2E@X#!w1B||f+p`Spa!EwNnnhoDz+XfkMC=1? zBrNre0Y&hSi>X+Qwa{pYN&N^_2$C0sQ0`5vRleV0gODujl96P~-{5$(;&^!-^|FX? zDX0?mW`-Jh?o9Fs=GJ7^H~?64Y%x>P~x&ASh!*mOQRj{}8|U!$$Pl zV`rjgQFgPIR%vbmX&9C1bAaP`-s8#gAJC@ThS7Z?W^`qk4@V+)xd^4xi-cgO+Z8Ot zF4w-=vPS^dGNjT94k&m{)9+rv09Zuw)bZ|V#)P{X_!0LIqMXVQmfa7diY`&w4~+cD zf$=A;+rO7Cr`&`>9%REr9|#v9*=FSc-vTBUR6IcK=hMLku32Mz)A$M@UZas)R{1X| z_dy32X#u4X))4Tsli{UeR^eoG4F{nh3Qy)pb3k(mi7J7N#-`HlBm3d>9<;wde2LQe$f68)xfTFzc%q000OfJDXkgd z?KjQSN73;)>gOjZN+EvJj8j8ek=I6qcndxHb!pmu$&NgW7Ey;lvrWm z)a$rvkxeyTL+o`g-%ROlzwL?nqo*kBEjb zUqolkttyY?A60?^CW)dzRi1{A$Jrh@Bz*(to+KD zrrYi}ss{hEO#^n=I%nCb5#XLVgDTto>b#TAX%)IU)mJj8>6ha-`BQcBs~&`1IF=N8 zN{6L&W$c<=HR_RXm9{tg=_S78nZ|UT<4<-#-~&B0ftfe535CeDdeiVZW+Y=pu2Edv z{kXdnA6WXHubKh4Jv#89XefC&aLV(_*s)X%r6bjsb{pQP)W>C>u=11PRJ33A7yUE1 z9pS8_YkkkpFyGyF8`6jj>V7-WSCy~H_9y08 zQeSQZPV?8QPvX{8o>P;aU2K z9kA=Yz03c2N-gddhF0OSYYtp}mmFkA{^Xiso_qXI__&ul?yJ)cJrnvBnW~BT&_A?C#QTqduu4?lEU;5Gr~hr;ez6USr(86Q%8NrI1|kAoOavZaCpg z%3afOX_Jr1FpGOnIgwX7e<#omvyVifXK}SrmGyw@!srUnaxlfP-(9+Avguqf8T9a5 z!jH;_2~O~Zqj@_XJ#J@0_m%OIug!9(TU~Z7NvA;cDHnBZ`t4|w zUkQcgnWga!6_eF<<~H$7*0$d3b~U3{3JXJO+4Z97acv7}D8L1?TkSPclrHH&|9A$& z`@>t)CB0isA*j;;oURE~i6aZDe z)nG2!SZRDfj)Z!+c)Y<})lcK1<5pb!hqf_ujU{)gBaf{I}nuaY92eUQ5UVJMg*}=V#`o z!W^qBzxMt**71SaS{mVYc7LDr1>d^3=_2uQ+gR!6nU$Pi)7{NxW$l3X%3SG%~|1njAv$2GqS9cw*96AF)&r%Z#CG}Z6)=`bGp zzhk0;OFBN;*CM884!-jZ6rz;U+87ZaTabyseoOT%kl@qH-xMr1WKzlIYHB^ z&)@zv|5^im=-_IyK3YwixA;b_DZoOzeqX*^eOAeSI8%P+p}ZLJ=ab*~ga3FQW(luo z+FfUzMpP^3Me{Dx{_&Vy4`=h7aIn*PSUCSn*SGV}-Jh2Kc*golmqu;rf4F_P*d;oD zV=nD)Z2W#S0kLoquI6ZG#QNUQ&pa{XY(iJ-He;#2C+DyVgmT7f6{mk$`@~sij=@wK z%GTt@1Yx!dG^g={#vsuyAab?@FU=KDl~?13kQmK!9LaNBU~TY}PZG(cAb;V{wB*zs zvbh~%P^_+&>zUN_Ctpy%d7j1Camwkp3laQ%sZM+z`9Q5*FR9IAq3E#3YovOqJ%5!z z0XCCyP+F5OK2!%dG4KN?8(*35Xr|rkPz=xDUql&ag4EDXRAWctp;mH@$vAm59_2d;D3 zuJqQM2jr1Cj0h`Ga=9Sm#`Hg)hWT<9P&oBCH2O_deTazoNE~)mOe4zgUq>@%4 zA3(;htaA9@LD|=zx-<^W{a7v}wos!AKn*Xr-M;`YSxT(&Q6RfL zpDv2j6r82LfSjt8NeoNop@ruhpuKdoYj!l3Ub7tf?J7In>iNgN^a^pqM&3(0Zz0B7 zCs~H*jXAH3y?n7gKxpVgcxY)iVW@k5=(M7HXap9?id$1m$lY)fGX=UsinC92Fpc>) zurCM~Gp=zO-^2W;DSS_{vFP9gFFy%{64y~=MSrS1B%U5HqEg_eQv5L5Cw(Audb!qe znn77HzntS!Tpm zP`G|B$EEKOj0uJW_>A)>G%si9*+2MX^>9XVgi}tH^rNx#u#QV2!fl_uSJK5V z2QQSHij4{>qOHM?l01UarwWZ&lJANNm-TKxh-bg1ggOL^xh-4Bs*pap_DmO9(haRz zCEcVt@a_0WJnob=$Z|{$ZbJYv>_HP(`xHpwI-{&U%p47R-R_@gY?l3LszOB4Vrp);Arg7;X zZHc3oE1~k`-B5(wL9*Z=s0-;Y&jxoXJX|0CcG%DuH5Su zdlTy`=~t6YKJHQfrV0{soX$>ep{1^ugS(t9#*&2{0w{WtLIt787(QjP<-g#r)ph9DZt{YT}gP;X?>Z#Ui3NqIvF1iX0@ zog>=#VjM8V>xOaJ$>`&=#I%5Z*exskLRc| zZP)#9VVR!LP^9$WXPvU1>fG%iV8kiy_WP8yxdXKsZaqmeN+9_P2@#nRBGx%-=HCe1@&C9TQ8%6@I;e<8R*HX^d9c8ob`^vL7A0cn5 zqFH!!I79rJuv4uRHiT@PE$b}q=9=3sZwH)t^JD8oh^Q7n!HZ}ohuc1FFT_$F>qFBK z-{_OGuNO|wrb!Q1H-#!{Ty)p0Gtm&Tmwr;WfQ%u2iXr&iQ$C0bpTB2_tlh27-W>4up! z8UMcW<6buF(s?eT=EKRA7Z==m#=bR)I)4&*iB*dw+7!kvz0S2~UFr(hdw8+2x{fc} zG3&jb`aO-qTc9E0T~^J`5J^qCtK??fIQL<}HJy`hDoQ5RhiBp~YJQH~O;A}Ij`4wZ zjJu~)duvZA5br!EDp^Pw_sF(c66SsnO;mT=E_7O+{B%ZVsl%mUGYDnSMJ|5X*r%Xt zjdPR8Mrue^Bb_y~Px;*UY8*adHFvq^{}bR|5-GOIV?-3GNc++FU~FZC*l6ME{AXlx zf%*5?G|2-{hGbeTXx4KSY)_ufPt7>v<+Icc;U2w-sRQ9^3PV%dk3r+T8^lF+L`J`O6JGH70F6+|fU9;SBD5B@;m7ekXi?faD zRtvy5jbu(2e7dGFF@0m?{HXiT!jaxe10STH=|3J;_?oHnPqA+e8=mX&wMz;wJ;Td7 z4ur3JUMMSG=s$~#)iqbw;4|AUy;6u}lr28uJ~#TQv){Ziws28yv79AV2jBJn9=SNI^Cw?`3Ci_lpC#V8iyZ&0X%Y|YBmVK& zxK+zb;KB?o1(=5TnmWW2>B6`vcuNIE{cG0+ySjA8tT!vN-_o2dz3#cZU8s2{7BOCn zE)62`=PUB2J96uK(GPudf1Uu=wmjj8C8_mM;?MEl-mdMxzsB0Yp}D%dS3H#gIs)Qc(T?KTvVz)&FXPOw!);Z(Z-w%tYn$m*Z@nf5oEDxbit(f2xC! ze!OnP1Us(6!LFbV?g5d2m)X(~Y3x{pYz%&+NowGMd?8BoUFffcu?tll!Z zOcQ)&;J74iJf(w>Z|lk*!JsN1yO3;8xOk7!NGCz<=xZW5Z2-d3B&4VtGX9UJGhJU8 zFfhpoK}{6%JZ-^k-8tr-8DBX1W(wP#c`?YtZjivGwxQ8&nvfZQN-f56pU%^GCFOk! zpw}=o%w>BTz&j(^uw718P3AC<;0YBcbAHhoX|SdHZU{~Ybpn@x5qN{4>iFMsag1@a zN*eoYwWvz;cux{K(!lX8qHqt{yviipxyv%7K=ERP%nuP&6uyk7sNGVn22EEnvCAT* zBJ0Z(gNy<_Nbq#lZ5K$^EP@AUql(I{sw5-H3AY3eE5Df%`Q}EK07z~J>xaxxY=rs9aZ8RgJ0;?2 zBv8r=?;87X#ciAfg`j1E9>RLDilRsunr2|fJ0%b1Ix6RlAp<|!=m!Zq22ZGPm|fIt z>M}ipv5cLF)UTBDT6%~$Dif;aNP0yfWr58VQ zzy{9B!K2LBT2sM=HsvKgHuLPZ6e${Zc1i&B8xZx0@k(jV1aJ`Z4)U+38_-YnoG$%A{ zekLg=3lscz`tDadjhrh2S`9_z4!sUC7NM$gPYKb>m4*gSHmm@iukO0FZ~AC7>hN}Q zU#);y?P&L;3t>#C(56`Ug0(deIdz2L)4V-Pb9mKD{?Okcn`q6>ND@fNA?oo6Cauc~ zkNE7iZ8bvPI8%JJnt3l=>cPAweuP&8N)InXZ$cN*tg+|X;NLW)bs<$ z4@(ps*zNY9Z@jOw&%?arDTI^CB!c-e`?#3vxb#V6a(4=%Y^avkV?;>G&?)Frd5jc# zO$)e7{sqjz7exyz%Fnz0=TMWiSQ<-KB|sm7`wbs$a+0{vexT63mPB}pM|=?aog*hcDnEj` zJpzYZZ%W_;tcY4a>dY^(l#=h8B7Wow1rc^can@`yZD~e8V!ddO$C&qYZ1PDGcOeB- zX11r3c-MK;U3N+1Y<0ND>B{e6$DMV!nuYjNf85Zx>99S*+0cU#fn@yj>to|2+mhna zxO!akJ92#KBO)?RXQa83IQ`=4doeF4w~{@bk2G2186~#WtIiquy>xU)CJL85YW?x* zer9^Yi=t1#X+M>v>&|$Nm2882TT%EVW$0#rwE#RQOXNYP`EwT7J#> z5+ldmxlp8I@`H8c>Xvnnye5J5rHO`(Yv_6Z5a+CykpOGNdp`91W_v!5{%ln|>a_pb z^GMZEh1*?UPqpZFe-l&0wn>>A5u{TR=|msavCFSIQr}(z#;)yWwFRU-b7Eu{27gx* zgk8~H=~;MyehPpE3iP3cCkmf=%^$)TwLC*;#bd9zcaFcsM&K6;=1 z%dPQrd&*5nC43yD%}T`p2Y6!PAwxZo64CFp;hf&4DT6dZPG#hzmnwVPuX&-CYf91li z$;a>r#1sXEMRs;EH?5~GkVJ9}FsCDW$8XO`>Je2tFuII=d2^?XWI%6geN{$wL3;=a zMg~7DKHqdJ8S2(_*4?k!W6k0;%yLTne)8UEKPOD1#8jV~^P{ z4p_#Sr58f(`p@~Q2dF7hStlPJ)^$7gO|i-6EAs2M*LL|sPOxi{4l|&YD%m-zf4tp^ zUe`WQ({RdR)*#wgEB~0YcP`3ZymhlHxW^^pP?xHdk6Y`>2J^IH2iYAtOxMtPN+y5J z+y zc$e3)I=gecJ)f+d*He9=Do;3%*1~Vx2RLoGbj#;rb1202yW0z` zD~($2%%F&Rl__DLykTHV@Z8>YnpDtvUbM>7tKBe=K0JQJOCLTbA0WL8TlpTnRyed7Gv)UTm_ zp?)1D<%9p*D+{wPI1>w|pE_;4lSe{zk*l zC?u&{WGW<(kx?oEuz^e(rp_OQ8R?*Nxdr|VKs!g=u_p>;&JM!kg|eNb3Kx&~(RRdV z9KfP9{!2>iy1Td4NV>}xL*JH*z$Ga>(df?hi%3Kh#MKB1R zK<(zC^x5!f)?3=4vPAj{Oi00cwy;MU(Rx=v4xUj?313P!9}j9_hk(%~LftBCvO5p_ zu8-^c>T@??Rf03LYt}kNm%5!u4$t7m-pDemEuS6aoY3)fDbs0)Ob6yuBY2wx4L z3vu04niZi)8$^qyecC$;>4+KNTi~nY}X zXgrlx3!SDa#xVp5_$aYHY~XOLI^c@JT^VV_Bfu@jJj@z7_3xtsIXIx%wg>4}PZ_>M zV0|YJ*jMrq9f^IsaCl(caC!GUa{=R}`hu7{Cmrfmhv zIV8*J!Weh+@TSA=Z}2I#@(ZobC@B}JvHX(f#VrAalYh&dyTMF2ds z7cy#5Vo#k#e-x|5fD~Hz18d9#4746iQ$h6-QTmJtN$omAVH_+S%IOI-jjNW!a~!&b zHGC*{+#2VQJdh?IqVw?75b~7jJzzpg{}G-R8dmHV`C(Qc#{P?g_9#v?hQY$j ziOQ8lcvhTSbgS2o=o~`w@6sgd4Ru?j6BGF_;$xM&iH9?HoV$XPA~P$=g{56Xo=?B7 zS98UJ5i()eNCq)c%-Z=^Y;n<1^gXPINvZ3uN3LYjQ_3w>T*`j(j&|B>-nTT)sAp0jHE`OXUIIcCYId!+!a<#5Lpl@ zPLo;ZFATZweQPn*^cT=^kPOU#Bt`*tkT$yv#MrFxf~V$p56!8Sq{4UnN1QMpCM3K8 zt$6-M8!`cPxku=i%X)Z6Mlq3(g&VMt7r_*qDHid?4q%SX78~{nL{X715NLqVcA>Oj8@H7gjW1D1vBu{ILs)A5_o6`dKvTv*XOL}qJmf`@SAhi)vACq3Sa2! zGRl@F1jdAuurG`;L}mgkDdr2^o2>??@g;|svKM{o;(b6pxxVwLY!5y zkYqH&pnFNmX1b$T`angr$u2m~T8BE$@j5h#kjdsP#Di2gNDm+$9DAa0uGZqIHBw$+ zS}#)#BJIR$?+6K1wdbxu`ei)nBwfb5y46DR0?3}bx^}8ST`d~nMmu6>yI-L;NYfR+ zAH=R4ldbqLp_BQutVXe-8SG8P0?I@xTO!>wKG$m3BRP|;_RBe>)^ItXX2VJP4JrAd zuJt+*0=Q@z3`C5Ii^RLtpLJ`N4q~PM?4gU8ncPAf?!aUc&XC>7T25C**hvf9fYI!H z8a>#kav_;n^Nh`dOrK18GM#Y-CT2vFV-mlP8Y%2x1PxUVgWIr5?LLZ=?sS0@4FFXq z@Du+==lddSNfYRqC0-#RK#tm}*x*7dWI_hDFweJALP#3XIu6=o{;AX!t^hf(Jy-_5 zUi=;{e0d>5D{JHd2aKh zf81|V7ZVy)EvcrM7j1NNS|iSaMQcer63zj_D+6GjnPF;HDRl;@W zopkUHI}u~N*duW};eMsZGFaF7f?-N1V_E~xS=?qi|9<&d$1?{wtD%$TC$@w# z$7fqN8Z2iGc6Z)@r52_a!e1S}nFGh25`64ZGZ?`bKkKw(ni`x+c>pxW$Ami#GZRoD zcU)8*SI+_%uzTgNK4;Hab!)Y33OaP5AE1hhwkR(Rzj;d$!|!8RUJoW_B5LGLa1;gRvxnb4%?GcXR8Q{K&CNSX_C%M)k9p>o2Dp3ApXEl0a-iso{5(w;&w2 zLR^&QFwsXA79=nf6Sa%N6#Sei_ ztm0+bIF}6;M2M>D)K18ocNyYm@h&@+luiAzJL02ngk^}k;q4FkVlZ9*X(c&bT#Gu; zhAjtvUP;%=am*mW9?o7k*#YCNHV{yFq1*0G%#=T@J%S#M zTF5&p^*VGSlnjM3YmX@;YQon!<=ZO_1*z3la1Pk7(pJ#u4j4>do8GM6Hd3B0^r~lH ziaAFAaQnxKE56^N$tr&Yf2?S@5RtVrFWE#pE<&>Kz9IILQ3TJbj zBP3_sVL10Hr#rMVs7QXp*aFnH_Ts#x{ATN~u;9@O*{`FXU8g=c)E=B@@ARZ>IJXnK zesJ5=JaselpislNTV6#eshF_A6nA1a6^*IVxDTeaW6qb`@Dh?YBr$4C=6+$oC!lwy zgwEFUyL(zQ>#FAH$p>_mZTG|x_xA}o-3Xc%?X;QgU#alt6sRv0di><2ab1P%YX(Os zV6V4jZzDf+U*<2;!ku)@v{aMRwmyH*-&;??eTC45y|Z1R zo3d=E>W)9#V}8*ROgNq}-lX64Gpz+m1z=N1QwH_Pkh7;lGZS#JjnSN5Pcr{G zNr6B2e|v;YkiE<;vK@k^pVTQX=`EdLJ-cBNHtYKDSi?IdGwYbW#*=Fek7Z_&ii>Xd z|J^?Z3{6{!bZa(zzhC^96B^|I{A&2g_W7IkT)){CvB6z? zPd{dmg08Qk&cFtakU!D}7cd1PV1bp9L zAr#U%NTKmMBSlbgk%;jdMws9-`CR5Rm|e;X9oYNgXhwOAFri=Dg zs!hB=u;(nYsKi3iqrg143qv$5W@pn@#u^?(=)d#in8A&!iiZnBmm1!G3G+nAv<~ zqs;M*I!G=UJ4g!L^<)GF+jxo?ufi%XMm5i6-oVq2cI#r(cnb9G-6&|`pCkloNHfta z9~zB5>P0l83$c7s`OVU}k=1YT3(OisGJ6m)yqxb9Zo}iTSb8HmkFD}Q9v@ioK)iFT z1z&8PfEHT?{0ZktflU9&a(IfwI_VV3GQuG(RwT5s3Uy7kV(jAAjrvl?p{J zRYPBEwn<<#CA1%b6vjiHyVj=bdZ19j3QOxn4Nh0t7^0-vR*4z^mDo&NcSa}10Bgd$ zC`JpLxohu!1iO%#DWOg(7tW1cskXRs<-UoqgZ1;2K0c46;lT%;3b`i!6rh23JqsyS zN7Zvy_Py^G$lvdPxyA5~pR_blc@SG2=>vH-Sx55=JE5MSaVy&$L3;+U*L>-`dC$|3 zKKuZsgjwzJ)k1e{-^4^+u^a5^iy$>1*8VRW>7a1iaxqt*LKnTC3uj7#yo&`QJ)u!3 z^AYe7EY+5cu8D)I9kC10lftf&S{@9~4gywB?NR>FK0cw$D46A<6O53ohdx@torcOP zO93rD^ve^u1~mIt2i`S?pOa_l%EU7;CgPDWFX2D~guXNyP{J*YpU$i(L_gqhFQ;Ek zhZs76VGn5PP*FD(pI8zzvnBI3h^ITm9GNmqL<7>2w|Iu9uO3k4JK42JoKafS6TR4N zumcApxgeLa4@GY>UB(FZo;ZIZ0X$)O$Pa2pd`TBtQpOQ=nI zB)mIC2>=C_zg)`W5b)X7$=}2y9A_bbr`Id*e9eKXqwo9F2|?{HCrtRYRf@>hZvXnB z*JTl{1`)7FdBVeR6?*`7CURBf;sZ!X+6y;%V*WD}fu{#X%_Mjn=7(fS{+ZrgO09kB zgTq2)tR*E8dpI3%@{-tV+#3y?fGB{_#b}K>wf`diY#T)sDc3pwaWTRx?-r|07SEi> zwIJ&Zz^ob(Tx15+EEl{|pqRI1ZzR0Ab+Pz)E8x31DwHH9ezAUA0IW?UvJ|hX zr!aCQvd`;Umkdt>>!uxxD@VI|ea;YP3vFw`-P6f>di!j(JZQ{KcDG6h-z+PuNCn+$ zb0`+&v^2DV{<}d-!n(aDQVWn+Zmm_gHzb4i=yY~?N|07nXff{!q?2Sv6;1YAp&Q{0 zGo5eJiC4C5W`%t+iOV8Ua+fv42Z}|oVg%LE8_nZqPDTtVJX5Yi^71F%mLcgpY(aIS zj(XiwnA3W@Qf4s1phB9u4a!M^FJ{G5cQBz_z^6}>i#Kp$Bh;TP)NEsfR;4PYWSQXn zBH&MO1pM(jziY!$FH*0xSfo9^`?L+iOT@jW&%Q_gCeoPA#`Qv&09f+( z+ORc}JB+w#%P*Dei&#QDHz^BF%DXZoqx^S_gHGe4_&L#mQBrjARHTrGFWzO3IoUJt1PE{Q`k_0{^}bXU!%_ek2R-C-bkC zjz;fS@0XEM*rSNCDTemCP`X8#$TZGUU`RV0Tmz!2=~Nv?&_(#>VEuy0VNY9ZSR9eO zT{@w?r{I0KEM3K?64Hso6xt|qTZm4weITV2Pq^g+`eLL^)q9S&}cXIlr~d7u8+U>hA~V*kH^nx|ipuZ&)=M$^ZS+ ztq)&|O4|gSXef-FN;j5YM~HMvS+CHwER z{~!o}ua;~vkF;Yp7LB!=2+TOf$E$_$#`oO~b8N!+tItW5?!fCHT2k|DJ~{k7DN-0U%BTABJd|`rDK>}< zr|$WRH%>iJ!V?5{s`R8R$ON%?7t%#ZEyup;5dr;E`DjQi4#g&*BQr6imVcX8Dx4rdeTf8qALkZ^J_wO+Gb zRhDUe;apkFlO18z@1tK0k}TUza4}pfh4g2X6!r#{IhyI9r7w!waH#3<4 z7(R}nrKWtQ=Ki{sPhgLH(Q_U>wT;JIH$q#7#@8Fy{&{-)>S$10nTZbywHP!dO(p-< zpmuBE+-X|Et{7@$j#PP1zxv?eEkawyix&^Q*{W_bzBFZccIi|mcE)&P0Ug|9_UZxp zu|@tMZI?dmn#hasNd7n%SDZ`@*=}|BOwYMHxz7vJe7*uT$A7#D5lLE7s-q{9KWzC{ z>|JwR@dm%8|F}7P6msf!BtiGA>|6N4z5Er_?;F>iKbpUN=Iu}AmC$6t`yO$HF&HYf z;xXQ{?Di1}S!U8ri}Tiwmj#e^aZBNJ@lLVTMg0EbGv*a2@E`yDA#ly`fLAS zQ~KRRKF1|}r&)R{RmVSD!WiY=>bgI2z;Rzt8yg2Sbf>3T26>t(;iG*(YURQJAc_Y z7jhf&lB2^>h3V&9gg?*~L;A}yNMOYqMXG&iG9rX@(F8k}50_xeu`vV{FeZH#b<%o) zRd@2%1&~r0vA^pOxlFV;uR6f4ft#IoQ&UVul#3&MfUBN^~^RtcDizy%pA+~CX(+zy@jc1M0 zz%$g~*v=wBP-Pc=6DCF?jGkC>P5PNufH2Ak z?U3yyKsv?*lYiX?3B4~jF5;0x7KCRUAp1Wx+VIL=!el^RNbCXe-$Nn-a-#y-V3!k2 z+@^glVpQ)80HwR4cGBh-#qEL~A%Y!l%jeoi+`eFON*2IesBSuh7Iw4Zuy*jvGV8G^8a2Y(?=zL|(=v4n2-2e~iNb(Sl+~{_~=ZQ=J41`huMWJa8sA)7El8!S6O^8KOa)oQ=|Nj`!;gO%!Inm zvswLg9l-hxkizsPbUmm}^w~;^0+I`c%}^N=VnzYU-)t3KhNdzdc+Y`d?+awnu$>VO zvfl_=_bZB*_+{WIJ$l*dEE4}fiaPm@=&h!ND4jr!7i?jh0HQu+Tt3z#)XeO!ksaYj1-eba4 zXOqSVK@qrxfk%=l$$WTC;LP>*F`r44T0s-Zkh)ubA=J&8wB&;bXisA*1T?)8P&E;LXB8`S$qsmeLRtlU7ekAw$( zKd4s0j|3$5`vfpE65&kni*pn~l@38>0DtkH49M%4vcO&YH)rAI(*_BLv|@<1MMx)k#XIGDd(SQum_Rl@!T@>%a%7;k0w zo3SoAoL>i?WdPHQ)cWQ-UD-p;mDf$nL~4wD$!~b_wA>#>zgqCO>U-arHx6mI-dmG= zooBb|TV#))$5HtA#>4&l@>UV;b13h;E>_XZ7M~5^3d|uco{@^76D8^sS>!+e-FbN< zeBsZTx&-abM@n%0dG(ub--Z8^shp*cxuwuT_uL0UZk<)BL3-7ExJg@~7!~iYQqp0fLNiwg)Axw{Z!!F zJDgfBvJs7CLT~r}6C6 zze~9vezbMeEt&V$;4kJjYvXYn|Vu?JqAzt`Fz}hBsUgj-qnfxQsSmQnZ3;7jxXqUvxK5kaxS} zVb@qAxZT5;nY-SLX<{s{x_ykLtj@|wS+1I!?qMR$Q;#{H?SMIsq%)RURdes2ADr4c zqvcPx#7{YG^@ZhP;|m-(4?J^#i^Dv9g+BWll(nvlce-GD$sN(A(~i@`%^98 zz>U7-EmY+pNBhf%kjXCpy32JpeBbp8F^Q+NBQhytC6;fXIxp~-GC}#PWRAJ1_ciNi zK;2tZT0jg;Ep{ta@S;x|L{qcw*WoeqyqpLnt|jWmVvpOGmuGE4pjPzRB?%fRf3U}; z{k_@^4Q+#YE}v2zvR7Tr+tH!qLJj-Q4T7*&PX5nW74mG;O#29Zz_;$CBj%@~bxh-B z1=H*#w<$iIzg0I~vxU@#DVx9CCzyj}Vj6syVdq z$gq9z?f0+Wu1c+zq#vYeXUEX27s|oDTW4f8qn8f<9sgl?Z@7nzbXfS$FNdIguKbUe zi29ZKdiq;7e7VG}^5eUa#((GjHu#}td=*MFbKg#HO_M2CGax$}A4Nav|;KOSU zXI9nOxc9fDEdADIH2)gq6tw+&R6n=y-irS5&y4L~*DuG6R({S(l)AD}Y4|ClJ*}*% z#5v$qblcm%=*|B~x3SuEoom$9HaI+sAKCI#rAbIWX88HL?H$u}hJAiH(gtGe9W1LY zfzMw*H_Xk}{D=8TP#*TjXiMjt-Z~z^?a*KK^7z@*y#7BP$+%^{R@|m!DVw}9`J>Za zqg*5%r?%K}{d!DIssGHc-wu0xuKcF9U8uT;J!1oC-XvhjJIJbU(x@c4L%e%_cmn(AWzI{l-W7 zI2)Irmge0CU%hUzVpv$SB(w5Ze_0?vXqKc5_1`_U(SPzk%?Uji@2Ur^8z|QhYk0xRL_*x=-WTywU7TZH z_Uvs)Jn_Yq`gzg8faK950`oE)q#gOtVIuL!K3f+Q8BikyQB$#H^G;n>UpZF<-m11Krc=V+iD`Qj;s zpXx`s)hZazdLeJp(<_1+w@#PC9tgcJYC$iyVbndXH3yQle=%R4_sCW&F6<$UN_4Uj zFF^uS-D9;f5xrUq=dECo z8+s+l<@{6=1*sN$M<>@@*umL?dP7pBtL&&^lO|WH^Nv-tpNJ@8Kg-OA&sQ%#Ea>E~ z@8*fggwysbJ`6BC z{*f(`LYNIoSOiWI{)_hNeO6}`_X$?SP5sy#Z?aBBtOw0EUTDk>E;mBW4`V+|f-5n) z`N-i`rGr)cu_8onvI$tYnX>8WZI)j7$sv}1Q0Fl+L~-_cfR7+x8hZwt4~6T23N)O2 z(!dr88z?I;08A zv#0!>4IT?f)}j0SMF?H-D)=_xaY3sJ;``q6mX;4l@`bL;138t@ShA6G-X)75AV>Pw zzo0nnP{HdJs(lcI0$|f7b#0K?rqnv%Xoa)VbuGU(od=4kZU?{iaZA>*S3OdJ7j47Y zLKSko4o@Iu$6&R_Nand@p0s6bYDaMK9{wg#KrK6*Z6NeJRYK@LmH)#LKm$?>kuk0Q zkKDOqz9U)|Lt);4v5=Jg)aurJn7UQWPjyAc8eN;4)Tq}dpbM$Mq6j_SV)0I@2k^gG zBwb$QGui*E%j!wpLwYs{wF}irMd0vzkV>Q)$>0^wS2x+j<$_>R%``{}& z(ONpdLUqeSrgli@9#I$Ns>W~O&1|$90-<)%FLv2_yNtw%e^o=03f71PWLh7GcL@j{ zLzbCszfVcnhmJ#}3e>fG!GD0prrD(NYt|I-^F6a>OiUnO(W58U-RIW^d>MvKedM*ojz?F0nz1-;DD5~hz&>Z~U}dU#uSgpkh9v#)_! zjrZ2tLccH~B}J_#jqMNpLlpA7PpX`ft?oNZ7ZTBjTKwMESgAPkcb(jSdUvgmmtP{2 zpzzQ+G_g)nu5cA1HE3Sfs5fDxB_zs|&PH0%Nspokav%A{<4F>t&q138Pk?lBk55HS zeqx<*))u9Qr$I5wRyI+kxdVR?aDohY+ z#V9&Q=PyfEGnFt9OZ!cv!c|qXHh)w`pZxW)QQ&mgKXz?ces8T}gTq1%bS0B8*s_Hl z*|8oX9i97Wny*GCjPfp;kEVSns(3nN(0HJt;?s&r6cIulh6$xOooGrdOPLdb>_BZ+ z3N!a0N37y?6?^MKD7!Xt{SQS650#J^Wb;vMD~HFHq9umObz|8=Zqw5$uVF4R924b@@LP zAEuVpD&x-JIH|37F!2S^YD}rRUBsw$?$X(1j!EVr>)YG*w(CN47tf9qbDTCvA#Z^b zwj^IWU00RP})V}q%@xy*}M!&y-+)Gvj;e~Kbr zhBy2$@X_nGPcNL>EmM&J|7-Z-$k>+m4&LdvqW=JBnE*}k{`Y&UO4^V9K07=lm1JAJ zb1Is1J=UrIIGHXZtR1n3C&U~aMm}xiK5`I8_Pl>h@KZ7_-u?IPakC6NfjvF#ah(() zCzNBS9nSvI={NoTJL(unX{|3LLVW&v`Bo+{;}}w}s?SJoes320<0@_&L9e*I$e!&D zn%nOw8?Jbxy>{imHmttWD>rw=60j-XRG4$`@=2^ z!KU}y9}BzP#DUA4RH+ZPo`z3Plk2!p8`#5W${CaOA4N)Y*^4)G1@D5TOQjYlNy#-O z3FEDv78jq3U707Sh`pHGsoMUgIHmV7AJsI?6mg99H{Y{z<>mUGf9~(tfH3-F68!ku z3fUc&6q)ps*+Bh?( z3XY((Dx?UBC}K#bh>V_ zUDUR_$Nfr^^V`k68;Gvi&7WH4Xl6$x0I1u#rKhx;KM|k*1{7Rcw5$b({!+@#+HIm;{Og6fv8^f5Kccz{+ ztb2OxD=}|vR{g_je1`98@vmrg0LwdfGvvP?Y9kG&8-co?#F z(Q^){iB-pezzY12ytVh?V9`;up@c$}G7gO025a%+ILm)8mWUvzoe0R{Q*;nBDbl&e@T! z(W_tg&U4zr?k(;xzH%LVjO2`~UA|~eogp90WIvhdi@f%3ZLv0CD(W7eLIHT*_m7%0 z^m=-D^DI5#E9J;c)_scN-;dw7jQkx9zDah)HKir{pIYBOyTii0|I=_W+oMr@OO2gb z`Ug{NKdjZknki~LZ^wSuc!QwC1~xa-4_!sval32Z%!7t5%V%8UQ_Uf0iNAf4=PxD!o$g;+UH)+V}5keQn6A@kP7>>1X~R#_s#J z+w^~&hw;@1s|o%3gWX#5+1pJ+Gsp3Zk8a$R$Z9*#wyT;y^Am%rysI+lm3o|OJkzDBZ!0$tPHWspYsxo+aZ<5;ub|3`G`H6KWHoEfCg zefVSHH(%oDoHf2^Hgf=J5yjVC&spJXjJr`#QTK}`V~1F6uphj6VSW9el=b`uJZ`z3 z&a6aTP=$Xv7UZrmmRwul<6gTLQs=oMl3rhm_};93a7bu(X}`I5Xh<$Uef3}Y+FAH| zNIXlh{MBf`FbJG+=>!`-dC8kSbFOEQy-;&@weeJGUs?fwuYZWY@~-o5vFW+fYVA`X zJpDlaYzk*AS|fd9>0;@))}1{yJa|c5#hZI)$X`*TzWwV=SfTXDle+1)xE=l6@k`UK zJs*GE8u}C-DJ6)Jv!#FOVP)J1qhAmPQG9&yge#n9$JCAswLv}bpZ)%6X}sG1X?EA4 z`_x~=0U89#9rkf~du2nyiv{iF<#8+i3~D}|tgPol9Ge~D;UE=tx-WkA@UYXNsw2NS zf9gJTbQIAK)3epWrr-_G(M_Ysr3sJOMOhY3rE)BsMBo@)-LK3_>6GUG#aOq)H##|f z5)L@r!QK9H0ge%ycttNuKd{EwXxs+4z)33MfSw_TOl)d_ z7)5KD_7QC%4?fC{8vNj9AX2`$prVn;cRLR4iMt@{)?J(}7+oQ*{i*mRj`({@`BM_L za*#P<)u`*^Sw|~=z0*_nS|{217c3Tg+yCc@2y|gUwIBDzRY0%?^LZiv&$6&>2q{n0 z%Uz@)Z>S75T8K~aI`BY*d@0BA2uMH%ytw=@o1d3}Km~jrlFZGo)uNX5@RKqJ(CCZ2 zFg6sZPs+%CFAGXeOB#M-Eq#qat46E~NuQfc?mh9`MC9WBu#9GQ0g-kjRs|sE4Q)89 zB7+!%vOu|uZkTP?d}tF^d+75JDkQkj23s_yD%&UmRkvfmrH6#T%^0(wJS(Z`Q=aDx zcLkKzEF^KnOvuadqUkJdcKEbyVQnB*(C$i_n+ko!fzeWRoC-hT?2iH{Bzov*W|Q+8 z`7qq&$cQX zF!3cdL>7%xx)D@7+o|b&`Vm-hIjT&yI&*gTKT&$s3tdshaUM*7Gagl)#L{Dt`3Kl; zyzYLDLOum6U8%f+SGB@Umd7FUd>4zOq5%11%v*SX3c6@amJZ)_KJMtQb`o#-%|Rt= z)D{W34Z2+E+=jJ3{yJS0ks`v^(@^eZOx+1EV9Iva(AJg~avM7x3Y{`BBnVTBtzPavHVD9dE;V5IdO z+I354(qnJv$DhGKDw3#N3uPSXlSRCQ<{x5rL|sY^M5=oct8U_PXX$&jbkj<~9_P>r z8xWp`aXqomRuJY{T9m}e!4-lF%Ym5G#|fPSCA$mCl<-S*BYU-X08|p8a$yHhiJ!zC zq6JfZ)o_N8IeobPjB*Jv#G_uuQph5}ZQ+Q}6GmBj^_(6Ol9^8$&sN>VpRRhvf>cg( zc=vk39;FdDvSY$gtsyycKio5iWI_rbA2bdQ@?10!`z2Xb6vWV}GOMDAgk5GM@O6CB zB8IlzPT2rU$heH~0OBbtuO8rw&7VZ$%TGii8HcrMD@|->1;e9Y0~ZZ$vfrp2R+Oft z*ysXl{%ZM*2=tr(;1WV>6p`p&aN#mmHWX10`U0%VCBLG-@u)61{9=xyS{;V_e02kE za3@VX>4dyrVMR~54LqJX6y zD)+eFrqpd8U1Mq7Ev5vZ3sHEoDkUfb@kQAaP9t`#c=B6eL)$pr=hJz1vZ9+7Ryqt7 zYc-roVv#I2Xdg5MlQ8t`MY1B+PUK_~N#9w&>lbU}r0su)cbrqjE)imNIrpp?ni zgOqN*TO)skU6I#3rDRk*1!;NH(fG^fCGg^&_YvNi%#z7g;13BIYn#FJCK!Q>b@ZGnXMT1 zxwjQ$(VU>_4GjvKp5Hb4{!8zrQ{0xoqlp>_R3c z4fXAw+oNZ2|Cuv`#-!_4JNN&&?{#Fkx~_=al5V@i=(zVmq%6b&58a~w`j6HwulA}W z202*ai(=PoP6#db@7Wf4mfZL}vUguG`d(-MRy)f>#t02Of&6vbcF6O>|Kc0ED@U%+ z%&M-?^*{EiJ#;fzi<2X@S)+OJ)y|%YafEWy-6Q4G!XAz6ZLQ50!W_z!YjqLxFhlOk zUSTG;S;^6k{-?L&RwKvjdFPlllT|jgjos!?oq8+vE#AXPf`gR79r!6<7yqEMOylZ{Kp9O=ehgg*h>f`sQXlYp%{qCnui;`<`w(?5Ll`uavt4f4L_hxnH3*tOnmu ztP$^vSyP&;bgCrRm)s!172Qow?OoQ@mZ_S~>;C4Bv5T+XIvw7%JLo3ETabKjj3z@~ zn%adZu`1;H4(7f1g9>w40T!n~< zrLLbzR>JPl%u5*Iikubeu+WKPwP3gJw6*e$_Vz$K&R=wodL0=PI()D=I42p*#0y zaPGgZHlBB0@mr}}@fb<=4(>X+tl3-(U1(TTVy}@^A|aO6u>L9WzWt^>kMz5LSohwx zoH`%~+mFz!`!q&=y30^rI!>8htG2}SKs050^JFMB#n*m@Djz*fQ00VGeqlQ|1sFAZ z+DuBuim}O?PSgG6ZMyB(n11uk{XrRiu z%^}itfj+}bmQT8dW3LUXeCp@TSr*v$;v$nD=C3Wg=aV4aJ1N(*vGCAg?o`l^HpbVl z_Ewuw(FH6=_Iq8wf&Lrv?8Z2JX1BJ!<&itNoCN&SUsi3w)CfN%Z~OV1Z+GGzxwdm3 zm%qO$I^8OB!^I~eVZeGijGh_rl=L|E{d`Bq+EBtBtMK%osl; zpCC;Rx_`U4BVgh3v|I4e=0U{; z#n+$QS`1IrHl$s>2O)o~5koG7C!BYhKJC^$MmYoyYxO_5x1ROH6`&dZ)jkYQxJUc? zV@LV-^%}S4hPh?wta4>+!)|ye?)j72-tQS7{EOo(>VY^9el?5VfE;avvF_jWd-71a zgmyh6%IjXqAG2eoR*03J>^T3Ao_7d7)3Jrt<RAuG zhhlzWjzDYG&HC&srwb43wqY-b=E3i+-BTv&@H&hLABPP zjPFQ4^VC#UEjWjxE8kLIl=GYU1zDlXL5F;D1Jes%=-R72pFH^nFyJmDZHR6xF9E~| zDg2Hywqoi7nZKzMA}xmrK+=hXq9DZg`(mpxb|FS0!~!hkN@3xsQ>7O7p-tq~dJl!+ zX@z_dwo8a)63S8ck0%y@U82O^wy&^i7^NY#nnxCUGfd=;%4rDWGxPKr zuk^+6230)57a$-B5y9s{VP%#|`MOXSNkmzs8#}e`&ZFBVG_MTD5XBWc+__+a^6ni4 zEtp05MWV-1GGUyfixHVZcUW&vKFoZATE3d-zN>U>{KsrS3G?e|9`N;?gas`y+_uT#9aYM z6|dT2tsAwrTR2GSP-K2rHE5TkJdzijfR#-Ho6uxqDkK;7ut}kHE>It~;sxjqetcK`eJl*Je-o$qD<1J1+U1wRsh{ zp<`>O*TNuW8d@Y!K+rcW%Q%_WYQ7XMsG3^$q_*5xP0u-XEX7kL%I3HbtIj};MCv9Q9-t)u zV&hC0B%W*|_#-b9h&yv+ZbStquH4() zgB)e%$^p0$#Z|dbF?a4&xkr|}GPP7J$5+d;GP8a!??1qC!0`c|`?;^{JUNfG=%GBi zC3O>Mn|y31OV94UE37YMF;}{Z4ibsNg$PjYy0SGgnMC7&j4hxfnG~H>5Ux&sq7KZzO7O(^koLs)LT1088E&?QS?sM$}+c3 z_{-+eTDPx9VOv+b(XWc;4C`e=79%o=U6(d{fRo>|@K6%RS35E-YdD`wQ67fTTmJlv z$YiM#A{*s}{I{(lKk?-rreY!(tG^BQ`s*amoWv$(?P?+Ho*W4=0Nhx}jr0GOav@Ch zg<4n}(;W9`&W$;-LKehfDyEzH^FGost$vL~L(WSC!b{80C3!-3urmK)x?D9I+(fAS z(%ozg8lv4ucTzhD*aqxob)RcL!xTY+0(pXbjSmrwBpYaskPMm6DESRBeG}2Ny-K=Q zaLEi&*gEVm9*Dxs0z_nFGPLuc^yUEZELnkiT5+y42)n;mB|^t*PNBaTljw5zgc|G+ zqR0g1jZ+>oe?Y;Ew9g-*_w*y^W!Rf_ppVJv$5T#iTy}^*{3w>jn;D%}MbMBVyD6gx zp*SZ#!M7DvG1VlS^mCi(WdmVfIy7DrQJ@hqidG5VZ%FHarF#8S#6Gz;8CS^ii} z#_??1zPeF(r{yK;k2Ujh1W}t8Vwhz|g9@AeTg#6xXc6L4$gi` z4BRNe&I*$1tMkNGaaB5B;R!|J=Bbg@{}|q94Pmm#XWSnjKKQzeTQh{8e>rurvk2lQ zfm8+m&VT*X9cvu&>$c$U$BlGE@8i9{R_BHqV;zZuCe{^t8@X0b2y3%YwT=I1Xj>BE z&^Ct@wneu7$Jj$WZCm=X_b11!Y@#u~Cwg=aAZ7`Fe%hBq=B;s5nfQB2&zU zC9-~XV3wyQgzl}8a(T28KR6GRA`33sOgQ1kbqvc#Jul&o-NWiX0Hr34<8D0(Jn$JU zax)}3lT5t_e$}84?{vK`lAsg%_bnz-@cq%#vQQlNlbt?OPWu!eDJl1cqQM0$_|DeA zZQ(!hcJJQCR14ME2-vaRN6F_WTRLKi?@p^#SU=OUv+na~7C%Iiu3VaWQrMOK9%WcB z6|}ToB`d-UneLoOyrr`*jSpqWYj(1}uBw3;gwNS=jeGk(?X`{+#oCAXn!gM#o#96Q ztZ^s34piX#2b`OHL}M$e-Sd;mH(Bbv_iFp$>G8K`!hwl$$DytR*fVsdGkKDGRcRH`s zIt!V^;-i|f3k5YZn}?*=A>Yqtod;689zw{cXO;L8)BZwZ8QXx;p`O>-QCF_@mOZ2T z-P^DP$g{mSjp4TwsF#PZ|JUM_NO zeeBG4x9FoS$kBjB_4Rw%$_w8@_k<8l?!^R?XdUcHJi)J75vqt_riM&eygpxMJa!0tc7&nT|)fM z{}{@);=)rTJ(3)X4B>n9WZh+oRGEz%VOAdIx_Tjbh(;%N@sgJYp3Vj*sGhC4+T-5d z3*}BvMU0Z?2lVW@+j`?Cj2amL04=4+nw60dPRM84>Ccv#I&i3mOMlXe3qCkc^tL{_T71viw^ptqT;ye|kxz`>1BZZ_W*Yg#$S@ ziFzF2AMH3c4HkWq?kl@kQ@crjCjpyc5*Bg1)$~d2a7^JJ2@5h_Cp_O^chv%NY#AWw zhz|uRBYLY~(wNzM1ZAQq=PMK~=da~TLZq7xkH6Mk++m# zYE6-PMfj8o-}G|ZoN^nqPb!du<0t^A*A2PzREt@Jn)8Kk%yx;Cxmpj+n(2j?RCy3N z-oMe&=d)G(s{e9Ig~`(evP$xq!wv62+8wq!Bx2O5f7ZUX%Fc!v1 z@eBDELKv+P`!{ClTr1UwW_pR}BX8YV=OUg>Lm%+CP0G(_2rS6Yad!rVdF`eF_0kLaTdgY-0zD0y7s$9Ne}0@sdAT@XSE{f9hm~VKb7k3 zPLXP&BfHH)i6Kp6VWwdYGFw?7&*IEpPnOCT%!xrt=Xt8X5q4{o zE`K4};Comc2wuXsh&Jbz%LZeNaGPvNE;!R`Lh%m7 zP??OnIoXKVqcbD75XDK`;^-g3rln2>wzx5vIXhzsgzOx)^Ly;#7n|zriu7$5Q3}+? zS{?F2{!o8=4{=D)Ks;D0Mh1w5=%>At=90ubr7w1rg@&)CQ*_q#xOzH8v z^kU0{tzvU?V)rR-$m|Nt@TzLpQtw&b`hF_wi<=Iw-ujkt;-UGV#M00IPrf=v6EWKM z3c^&iQGO8$Fg2a+2T?YL(?Wt)YohIkeVU&uB2T-q@)98&{v+e>BoC-lS@c+%}tn^m#3jgU@dWB>b!b;Z3_xawHMV66A%!qDft}Mak105yh}K{_&s2dB;_IYTbO+r7KbJtk(q;n??St+sV(*|MyuP{pxg8Hf8SDWixGi zn?>vmyZHwYW#Z$M{o?xNs{1!v0=E<(bpd8`0e++8=fBQ923i~vuN@2EVKv_9JT&+Fk*h@=zx+Kj6B^2;wKIsq zi86*ByOamuOs3r@%j0vLUu_p%58IsxKm{K?W{#J#k(nHaf7TUUw8AWjdR|bKC;#Xk z(c?)tSagvNf`}EZuKR4?J%7~sBbVH8cco)c+zs@s;Ge8Re{-c>@VA`3vc;ucc0^xM z%rAqn6J7?SX`WOgPjJYo^H>QiO=@0u)!R;dV0t_jq z(Ah>a5-+Uijv0M%r&sp){)fxjZ!lTrW&C1fn{IO?4{>{8S+oiy-G#2y&<|%<0{{GV zhPKWxi6Jb1w@@?#a6YmbwYF!86|Cu*t-YeVb{$~=WodQ@xh#LDG4%J~XuV|~9&yPe z@W;ckAy=L)PJ9&AIp6}PZh_bpI%DY0O&~zMI(84eqTv+qMeLZu9FhFa_-d(4Sb+hl7L82fAM0DtI#hsC?6{UV3RwvGCjDOYv%ypq0yK#`h0) zZowuxvC-MQ2_F`^%HM3Cl0`Ntb&&JvUn9Z2X4VNjZhf z>tvf%1mTD6H0^Ol899Yi-V#nb^GHSH0Z-@l1jV>ZoO>KJ|J#QDFpk~~6I90abt4Gj$k`vf6 zLeYfjDIcGahtoUr|6QtZQAG5F{Co8(8~La67_hxGl=}IL9PG-a{m)B5?lKLLZR;|L zYXv*LxBLb!yT^dU&Jx)$yK2&wbF9^@)fV$tqF<=ZsZA zesdt2A|sP%Rd5!hHo@LlJhFQ#QM?uxw`rnMJ?vd=wC2&(E%QL7_?o5e`@hrnoC zK-Bsd!S6p;RU+eNP$^|nZ=N} zM|Y4*_wURJuAvmV_5^T_-wr%L`$G5653LAYWyG3i(Li?0Ch4+0S9kl zcC$#6Sc?d*G=&;WFSFGXusIIX6A7+ylnhR7MH$C}N3r6xb}f4InX*9U;=4IQy!iFI zf$E8Cafkp{^2PJzbm3YW$z%wI*g~;_5Vm$lX;Wbb=3pqJ@}9-NZuCh7a)AzTHsz#b z*_!%IDalvWtGg#xhQZRM=rLQ@2~G#k@O=|vAaWZ`vJx~@$+Alma{idy5yHZ0AOeyo zt`JjU6sWkrK@ zfhbXL((_mw19?WXEUwc_i@PlC2V+d}dCU-lr0z8mYKh&&Q-0pxzj5t(v(sp9+D2i8 z>8xo8&R$X{7M3d*7$sTG&;rNwsMAoXm?J^$=e~|HO*v)MUg)RlK1X1s!1!|rQ1e|- zwYg3JNRtu{UqqPn3j0qM2oOI=DJ^7fuO(+Z6IiRmQAe6EKmjMh!XdaO76R0DwG~=R zDmGTmHMFtNu7apBy z5Q_84P@`lm@;R~?9#6r-lJMggyBwJyY=5V+vn`syu@b^b%*D=e)!3knUohP_8-zy& zzNVNDqS8Y5ytGN%<>R%GNUZtWuVc(2g4AC2%LQDv1dOOJ4Ck*!5y4d>nX>Yy1GcA_ z4h07dOC1wCnfzw?lB1q*$zYLtC47b(l(T0(fAi!y_biyD5YO66M3O5Q?iu?8LVf|WMic) zl3}b5&2XOdYv&iN^2?0^%|w6mUM5GLd2`)D-8tb97!$|B`d09F!e7y+w)L=RZ&-g) zlL4EI5;VjfkUeVJpJx&jU?!i~PPw!Ikfw`|4ZXxu$0R>hUN26bViB7hq*7wBvTulM zHg~2SW%#WCRQm@!lyN`kQAF_ogCa;ljQ|i)@jVx!n zh3G0()Ot5CFaeQ0r{(rTM!KiTR*WL>%Dpm8IxUHV*kL#B6(tA>sYnu?P#b&eKzU7N zW>?5bDS{zPu35e$zBJrGGu)iSqSUj~Kz7m@tm3xz$)=xQXmlT1lw!(jy^EQ0we8-E z2pFh{h*!X=suf21Lt((4!+>E}4Z!%hs=xq1GvJYnHLgUOVKrq! zjc&@7rwcp_Gl*WQoGgnPB5on1k4&aeRg{SUdojBtVlF}H-N;gATWX<}tEzrCyA@Gy ziceZtTKJp(u%mC0qf9$0GUckkDlMfXqSN}8sI?nQz|xm-XbEd-jt!@^Q4B`^O}@0E zhKx9k;%^efu0o;MW?-5{|T>fTC=*QUm7lNtG5T4Go{tnv4{U~BJ;<5%5WYjb;bPp7<= zL*AsgcSAE#13qHp7iY7whhxvI|9(ErxUuqPEBF0wX=vc?h74dmE0g$#PGNi!SarJ( z{`=P!L~qK@_DyFXS_ymhdH6A4ab@?gHEa$2z3WG#&sqHIX9DheR?OS4nH~n`IPDSt z-9GLfDgCQRoruA?z-vIydI#)lE_@tflp@eue^B9u$~zJiV8@}$_H7G=HzTj7On0(d zW=?-}N%%CNZ+jm$0Z5ryMXv!8lR;Jt*@JM$q?7LG!^l<{!j^}jlIrO{JI9=-!3mEY zPL)1hjJ{lZuwVLZ_<(#;c)Ka!dH~4>(20$|xVbss(RJR`PB_*R9>7Lf6tePnN4l4n zIqHRvhMs?bOK&dueK;y~#UnoMunr z$kiL-=*SLKLa-&R@I^5mNeevb6dhCTa10!0UD;9rI$f>1A|os2tok+%c~h`zaG9q$ zY_aPqoeaNvpNrr@jj7+wexmS8G3NBmvz#`?l`?B18`&TY);Q>cYJVO0%enbOEk!yF zs=vdDrJtPh7m41D{2}USRy1UHi;+xqn#O7L>3WZESN$`|G3$6isM$4BPMO3>yOOBWvd-28aN2SzNpbVqlgekNQ&_7b^fro0Dq?SSa>bYXtyTdKtlch_UQYK$&-3T!xIaA74LiAf zC+$g9y(8CDC0(%fNIc+?taJZD>r&u*heH6^MR1C^)r(rWhY`&F!aJvnK&X&WNBles zc;hO_!`Cl{;ogy-JN-UJD_xl595pNP_`ipc7euC9GK7@5H zbUvI&z5;A5>#QP_#c}>Ah{Eo>_cgRDj7rCf*;FqqJN9y?NV$eyy_)yKM4~aIbvKT! z&-zjgde>Pz#ek2|xr4qTGFAx!p*MEVG&?{CT@#So6TkE%-lu))$kxb+*IkBkn_c^% z_^DzW@#<~vLfiiJVr5Zz7xBW+<;zz*>-r%ZG6RWOH%P}{Uh95ev|YBG&&Sev@=Y=I zrlVDTyg}KH**}Tj!^xIu^=*p&r<5SSnr{BIsztAXu(5{HiIW7h;9r25{tB|oH zHfSMbB~0$9{ zL=+EwTsr1O$$^B`5?=h(F!6xLhu?*YW#m}MHtl6#ETM~9msp*~X?FXUapfwAM9$68 z3D0esI+zi4{Ql)IV2+#;%z^#(=C_BF&S&Y+nZK@o>n{g>V0nYs-U0rP0rrET(Do7K z>~U4%&nDjC#3F==ti->zjMzp~yw#w}U1M*h?99VwlA0gQLXE$b_@?9p4X*{{nQ4gH znT|9um!DRTDz;U7aPdP1seIpjU3q>C9MDh7AE0Q^}7Rrn-n08NAyKmx60OmTA zASpOMSAo7BR$9wD7o+pR`}u52upYQ64Ialr+~u*njg50b)k3%Cap3bS@5d} zZ&9!Re{pmU)K2RWuoYmq?Ucm?u$a)c+YBk-MWS4itctx!IL=-*4rL}ZUv_Gjwso-^ z1M2F5UCF}+U!A*h28+*esfKdW(JA$AU=9{j0s>t2HGL-U<4*`**Inso zUUVh>tL2*lgDMt_KLHfJe((qxvrJ{y)=Yuy6EM>D_!qjcOq{XOxz8Gv zSj0Ui4$xoUvwgU}POq>Ab@tq1=-DDgn9GVdo0;s{H>j|Y!S@nIyJ)b~$RbqgmW(o3 z-*C+Euooy~9L7$vw#njil5Pl+Q8P#QsX3*14FwSbc$6KKBrMgtqxhpCQmUwCw5ErgGXaMZBXjYnXKBk zf`WNoAY?#@0D3R^skP)4rc{F^7>66%NktN^R7F&65Qq(p8OV+X^M;+8KQ zq>}CuDt7$Ml5wA`&1JDV0iqD!A`J=Zgy<0p!u0?=y2sSX$Q0FR!1x0qf>s6C@iB{X zpm9z`T9R!q)Lx5WaO;9LmxcbR99e)E_bvFi<_tMTW6dXRxmqn|7=@`M2oo`HBw!8Z zIsrl%0H@Ziz08^eu%6XZbCW+u1WK z6gwU_0JZqni$XN-)AiuI>w7x&7DO@ZbY*%y zOvB7oe{eh>+12lS4<5mCz7b$ZwP#`YYlbwWJ4jMe9HV8z;)%Fupwg82&rX$)Y@nnF z7iO}V==A7g76{JF+q|?AP5*(C#J>pGD2*rf#3C@b?=Dwb$3V{rHv6>FThUXIFv7E& zH{lEKhRx{awFgYaSl30|=tR9uAq9f2R->!3ykh!Luqt0ew%07?r;^@y0TtUWM>7_a zAWVLd+%_deyt>o8&EaKOC-iL!M0z{u++GRe{>n5ZpQWjj`+p42D_OKe*lWupk(+)| zo+;udqjXzoc|J<;FQQi8DJ9&}G~{zWi0g*GDM(5RT$3!`!DTXM8V)OE8);(RH85Z} zK!@MRbI;5}Kt=xnj!-s}v=m*_Jd^}2iH~PbvJpJung0z@afALV_!oMJK=f85Q5bp| z)V=B2fE@N({ih<7>`_-+Hat&&A|$JTZTPG6!l6tL5(xGXDYY46%A#PscJ;FtKn7;4 zEO)7sTz$40im{SIC*0$aBEM+At}J zqWTy5@V#r{MCeFdj$v7w(szLo`u@YSh)Phu!S`M8QiWS@0KCL{+$IQ+Y8DojW4zSX zHGhOKTI*Z#^fcl}oA)1&Aj=TDJ&Gs9f4Ec8#(pbTh4@hvdaDCu@(8~Bi1A`T=LNTb zNpJV%&F@sP0f&s;gfyB}_Rh+Ox}T1?j@%CkA|zj%(r@%-|2gUi-=Kjytbwn^Uu_9? zoF9L7qx-8oO;wCxtILyu|ti*|HJt$XIE z_tCS#39l0bVg{$<>H2w~1R$NmiJyWa^e2P==C zo(@jnp8b(Ej$8|!N)$Rr9UI%&&b70WBYOoa=+5FE((z zBmNrue+8=moC>e z`1^c{g=IR+dVSaO_TX;(`c;iq<0v2PY=i_!Vb9b%Ym8sA-~D;gromo6(;Ej5w18b| z377qo_ZBF{JsM9HyVGK0Q&WysT+RyMPWf)i9`mbc;*xTA%~<35w0nq|+Lk$RKkX_&z(ZV%EI52-(Wz7S zQfPHR2Jq1Bf~BvN1jR=#T{)}2h~VgzZ|bO(6`N`Prd!|8htd2cgXcx;G$dv>k5JJU zDNUoi$+_kg1?h9*XkEVWHnj#V9!dt;$PZA_#LriizX;-^74v3;=qfKE#qZ)6^PR*Q zT&6xM;ltBl;E7$QHS|SPSp!}mi<}v57vnMV543yL{Ws!aN6~$9_2Hm?e=KCKF8a5* zqI*KovzcKu9j?=7Xe$x)S?uohOr6@4(*hsR4<+;WO`eQW?w1O`)`f)Q6$=#yc6&QX z_Ozpc?<2oty$&uE*4a%bX|A?o_J?g;hNf4xqwEog9v8xo^4r%Ggs+4d#`3^t2WyrY zg{&|?X$L%iOI+LdxdDQwR2n{atNFS^B1t#crpDo#{n9%H)=kIYaj!s*GiJ3A?Y~ma zL+dJ!+j`XCv(DelL)8DrkVVstHTk;pW`jRw(|ytGYmzmm_lO}Kjk6GV!n7C(Q{1@* zSGb!o7I&woDe(Obv44(@KDj2f|8YGA*fch+wj!5TmK#bhY%M=YQg~>Ts^>Sem^g7< zttoRi@f#M*w0LAOjB7Hc%n#}6o9Q6)`EYnM|MlCJzNvIPFg950*4<)S?)mNa8C082 zlK>aUr|1h0VS+$-E~Ve@OMgUYmNI4Z@v!*+$bSs5Wd)3i_=U|hOLFdjOMwJ zg6j{n#`mvRYysRe&03V{I|zru4C75YSZyTq`h3`A(VN8o$`+n#p2<9J5Y*COoPiv6 ztX4Gul-g||-`2$|7ejo9GB@|@HGpGovf+TgL$^xC#2?LHdD3J(sv(45qQ;0l7CgEB zIbphJ5@AZtSaFIlO-e2Lj_EwF_$m|bVfH)mTEepZr#C6V18;Ly|Hq)X&voVQ@DAi( zM#8Fnr`?cfJ*9+=Oz*B}yI$yKBk$>EPY7<7C5DeAlFVNh3jQ_py)qSYUdU!Nw5)Bp z^V6e5QD>_Cq;lAHq}N$M8bCkpvk+`7l#Y^B8B>z@))$H{xUEkS9H`HCN;~Vd{A(S} zR9t4wDND&X78bjiliIC1;Z>Z(!A9zCZKmLE)4sf)hN7 zxXTWkju{K6{ZGXL?qBC?EN|MomXd1dmo^;(_$6ml4W5(0vgNV#%4wVy-@_C+5HAG4 zMl%6>=!f%YNhyo|o#$ctPZ{YYBYMeKsfkCRwWDYv6gTJaa|-6{Fr~&0^KBggxG|0? z59@$QDAiuT`P@Q}%IFlG@?KV6>m_AwwA1A6$M7jRHH3u+R(bN|jX9vd6Oh9Ot1w*i z?rn9|WT58!*TQL^nH6da!*b>+m!48S)A7ls{#14Rv*^9)oCd9-Y=#mM7vR41@a?w$vptEHx^k*{t&RlF-zN zfkmV^iO+<9$#Y_Hke7W)YgFB{2~i--ZDp|>88*)A;wfsD(%xRyX`ROc;7N#LK z85s5%f=g1!U$drsmm?%cXK^{msezkT`0|#N5=x}Qhp<8|aV@r7>Za#WdM_lCutXh{ zw<{y?JWmWwxcK#q_&)}M7nFX%FBWDX5SI^9WJkkieaGeR57-LSl+vSB6c7x?9TL`? z5Xx~ra91*C&nzS+84BSeR3h4pKPpdoPpI*g=h5Zrkp`m7rD8KM84y1#$+cDwA167? zJgat?ZkY1e8S>oT)7=56XGT9_^tgz?xLkT(Esgx3Ya2=fQFEPkmj6$gx5kh$l>7{E zcRt+4G*=j8v}bVBiF!vMmGbvpIjrj<{Y8!b-R~tU$8A2!o8F9S;3{O-sUzM;#0Nv3|# z=F(jZ1Jff|BYmMnDSVSGuYY7Vm5@ikqgS)WST~G`fqzIJfrobTA)S|9AR*SD??T}H zHf)}z>{%IviZRP6X{K@o{o$+TAVW83N9IzdQR!7XP>!kCJ>tt6v$FhKgmtGfW&^=_ zTB!ulk$#ap9LJ&~BqNH!Uv4P(ehVll0ERx<9he}{p>*;K&!AZqd3-~Q!YqJm0 zW}@@jv4FtyFar@@ls8}2Jg4>M?+EKl?|t!!QB6O@Q91f;!c|dhFPl_Q`kIvFV~+uw z+{w{O77AAZJ0H*~(U*JN+E$v#q5n1o!(SB8w$H*9VeUW?<+E-Q)WjOE&3)d}7tp-S zA-!gHTR*!UY2_I{#ljFEaw1(=UtrQ~)@r_{1u0yCOFTJ29xQCR7RrJdzHKFQKE+ia zH+D?FUA1P+inF16&k~eow#)NWw1Y&UMeHb4iu!cG<&*YKdfQ2@=003m`5pa|nqNvl z{l=od8#PHJZ`Qh6bWZwEP~*aG2`sGG^so&kz^7SJi}tA%jvS}OZjo?FnDxhyxOJ5) zlZB(XrzZp(5q4j>NHhE~cofMdDJfp#>QqVsB)p;t-K?_J=M$+G53B{^C_4`uI$#3Y z#Jn{+%}dJPR2~7rdcR=dq*_eIVe<0V)T=b2n)CrjL@&CtY#s+u%matjADbc>Bfi=8 zH!SE+LgFyH#*B=>S&U~)GRbZt8=uk1$HMa0Ec1&=HMqwg#Y9)HD4{rL-g09~L`kVB zv0G!zF>EY+5*V>uwSh>*mTLV!d+oo zce6XcWF!`nBDlGeFJe`8z$5$CoYf0O7YnPJL_<&rUkyo{7ec*Q*`KwZI_H}uO^z-@YWw9AnY7q`+(Lzz+z^xD>L@Y6atCa!XSJ|d+ zQL6Z1baHofg|@elV%S<_a~E+0DXmTJp&!C$7H~OW2;@^#-_^jjapQ%-Yi!t7zlxPZA4{+2T=*m%5QRjPH*)%y)bM?nOiy&tN^qhuGgVsO@hG=?@x>CEDD% zIL7U;fIA;8%M$veTlwN=uXpej^x22G^AEp=6#Q>}Ynl0!Ao+DCG3^I?-%^>pch!2} zbwkHkrNN+8i1?tT;en&cp2xM7fr~b1JA||p9l82>yIHqeNzHxme83`x8j-Qtvdf#I zl-YNmtn^s|sPQk0IesLKTS# zY@zi1!`8*LAK{$)mYBRtYjmH-v&C%8Gt1vLL9Kp4r%Iz=GOowsV;@qg*NRkZ!=(>j z`H$o-oCle(+(Vi_OAS0&uV`2=LAjxi=pRSeHF2ZnB7LDq*T?(`ude?**4Cd_-w4)A zOArr!B-Fg#7^9Fq@0PHm<&zjTaL(_1J~ZDPGz;Ktmx8Q(J?gn;w;et6xi8Ib?~8Wz zRKV9qT}+#5{~WF2ui3SdF2H-O>I-TV(2A4{>&zN!`@!He z*_FtN(E5Kc0DGk1d92w#+HZ*-YA)5ppC z)DlV*r$ElScjPQzbd|z~pt<+87NeKXil%ebhgAe0ZmScl0j{+w8~N(WeZsguMJZ9~ z$JYwG$EB~CF@7Ut+{6cjE_TQUt;y&syT-UlMkF2YyNEW9LO>_=G59wqhqpx!o8I8h zQF7V?zTm>r=j>J|)wMGfU`#TtY7;q+m#_JqH;Ix{`++pRh@7VpaO3Ggmnm`4j6gTk z_0`z$)iZKQy;iT5bKh#%+~{5D`QV9`KXDD$Yg2s_QA->3p6&*G-3tSMb(i1Jx@|k= z#vK*!?6m$6=uG#~$~TLKxk)|~{Ja}<8MvDEq!aDDSfya8;-u3cd!->RIiM0wcIrOw zUv~v0Wf%WY;Chp>Y3_h9SMSFEjuCAHi2a?hy~f{zS{{j9^8-p?g0N9r?|Je$cJ3BO z|7faqFM9YthE_-S!v8Ux623>>W}AU*R7>OV*N$AaSN$Wu5A-2)xcSs}#xFftzM{!x z>|6Ic`$?onvk>`Tb4&GsNK3NX`~PORtsgv#Xu5tIq@vSCj%b;V!T%TOoXVcuX$*4f zReJOO!Ae>?pbtJBWTA;L{wd%)c=h#ftm_rCl?z*t8@&hL4nH2sid*d8-q;bW2x6?= zW}E1|wbChbS=0>x8oNXP4z@-V7p~U~sOT+zvA9JX9Ax$HTC@ki9UQNrZsyTfZlgsM zdk<>^n1aRP%BWki0>N1?=#R>u7&-WAc~%XYXIH3<5%Q>Y`q3k#hN5;{Wf;O2)a3&Z zb2)b>6wa-Ic<3@WNifav@!~%CU1D!E_23E@3bN3L*nS=Na`2jHrRB#|ohJ*{LxzTi z#)6wJ@h^RS9hz6jR67w~DFOV?Zp+&fhwdLt7K06?6;YR$6|{!}kceLA(8OZU&E`XE z6&ow54szVT==dkcuP>@O>xJ*=t#)r#+-VuUW*uOf>I*-A@ zS8-m1zB8iAiIP&uzjglD#cS)a-=WV4<)$uF5b^A>>F1MyuP@JstbS``xQ7XU3%)Y4 zsUgZYe+%)z+#$^q&R*)5zivN=Xr`{hFS6` z4e!kPK9gb)(l?U@NF(7)QxSj}$mvt-b2vLJfi$*@QYrlAd`YrYoqnj!2N~Cir=j)K z*vAwPC(~G}XKkLM^e|q3O`%%RGT-lE^3v-2b)k&q1?t``r0^{&dxZ66V;J7d_8q;e zWN%u$5vl;WOyVI2V0VRq?YM$l4TCJTY>5o7Z_oRs7qd6MA5c<}dpU47Zxu~f<|JL6W;0y)& z@Qw5WM|IbJ_RdxGx>{J?6qNM4aU7;8U{ewe5wEE+hQcgMdM7C-RT0na{^R1Wmgvs$ zBMYhy{V<$RtBE)gEL~R&pjRb1=6h{(F+JIyl3fe7ytHB~s?xQgyr+>+v!Hv%})gsEDPGb^F>x%}WQ z{u|#MLS#^^W%PC)j{^%PySN1OucyL$C+@X&IBONlAuU+@#oQAna_tTl{YOGI^Bb>A)(N+eoHA^NOi8yTbH2 zWuVyss%i)7Qh@*-c^3P6n=MB52%)@MF{A=@ALwOa`mwNj@&!h^ToEmNugIA_i`h%R zfNzA9CJ)wdC9hG^MKe3>IoqJq(0tZyLL)=+pM24$c9VWn76BfytC`1K_X>oJsjd@; z)|Vp1X|5bz=lKa3eW4|}6#d7sKJ=?cFm=*vKQGi0Tlb@i8HlI{bi^Ipqk_LRMVtJ}JY<*pQ zYo32FyWE;|u@@=iUaxrUQd^ve`u`UA2-6Q4DDu5`v6r_BU4k)uW8ocPoJl1ck87ga zZ1+$q$dB+-0UJVKh5+AVWrv!b7p$7K^2kv)LCs5EqP~Sw$aw@_=wGmG1rMwah@uB5 zyi+53{VN7nsNY%(MU{i*g4b#>vjHx&V(-iyPl{OMFNL`=MT+)l0l>T!Wi;!l_%fMU zoWvdlI-eD-RXX*;KHN(^JVG=b8QK0deb`;g-^&X295O5$f*HRr{P{EMU?- zRu+?mZkGm+e1bCg>7lt}gIBtfWGWGtPiRd|=U^HEupr;&z*0F>vhpJ+e8e!nx(s#mfY!I$5LU2N+>ksrJ83QaTPeb?0~zEWa!{trVflc zJ##;5qD`D^Cvs>R`(Ka}t15~R*-GC+q|C5ZlvfqG84>6i`mg%_rV%|C%-c`{dm^`)m+JHdj~TOfUOzKlSP7&qYGu5h=X09HS5hUooB6s@dyW6p!B z!gZvk70z0DXXK>9Z_iwT%l9r&QYYZ@jVUG}k05V&2zp;XuHY`xNcyjtYnI*i?}|1o zt!{$oMf3vXf;rY{QtVRCwTy*wfaV)losyAe1eH`plzSLdR7IPVE@G_0RV|ICE43X& zS-h?FlcxX6k2hn`vQWSCuwEEo051Z{WB1L$@x)x$0wE{)aV!74Gt8f%CH1RgS5tgM z1!}68%u)?u{MjR{Uacn-VL%kYTbwLwA3qK?%TKOVjHJ973Bum>*$gd z1;gJ2_61wwUZ$Ewp2Xc@TOIU+8{QDQ*g|NyitbG2*j4pkfdFh*yGcD2vB-tKomUG# zR<6j!)vabW(Fs^e_3>KAQ**`{Zv8#vDI|5J9P~(&kgY`E$!YcHR>w@Er)Xc_JkEXd z^UpKX*~4=l3;e;ae;+o)`H%JY&AUJ20ZL|0b=RDyOv&GQM?A!xK?nb1I3u5!WcHCs@BIFR?Xkzs zdB5JT*YjBiZvPN6yl!DMLn?kg$+OO%WuJs?=jjelyY@n4`l&5xkI>dVd5h)|Rpn=FLJ(88Ze6a7hB&0oy0sA6mV86p?KtuQNK`7ToL{i>~A2UefeU585Z z?n&(mFkWaQ^qEtLkd_sf89dzAY3{r;=3cy^Q3-fq_L<(Pz?%>lLF;S)k;)0&k9z{^)TP z(0uXrd!O{7h}rq2{WaSs>*0+gPrTDB9>0TE)-N?lK*l4QJSRf#asK*1=h;c)$$Jr> z;o^IqF4SYv6^SZ;5B`n6SDA&)(YVhSaW4&+I;~G>E`g3_+iuV8zP-FLpOLhs$Xw%- zZPoCQzqD`c*)D%CGriWwAHUbw=Gz$ z3_GI+KvikbOVYDJaA_<(S0`KTjWde++EsI{AKzp(xZSIiNH4ZQq|(h?P-rG zUa;%hN}FcD7Ha!{48lEXOD&sM#-m@fr!77R@3@fZxF=0H`fI=4v41At!wNGK(8nqz z2gCPtq>~PZ)`W3B)_5X38% z)m=Q}pLuf+l4WWy24yH<3F2|S1;Z5w>fwZ;j67H+-JOM89p6M}>}p&z5@Xtn`G@GJ zlW9S7aeQ7$GgK?R=NeKxLG?6ODvRXx-V_olOUJs6A6mYU!^KLsFYwbT`f&9sB<2a2 zq;1-!sqfR_T@h zaC1}uy-}RP`W^BRX~#_X|$wYjSF*EMJH52|V|wZcn|b1jQ%>IYwBCixZS* zl7b6tzU9~Z3cpRrF-iY+wosVu|Ce$DWA3_cHX!D;Zz^T| z&Ehw4*1PLP$>JG!$Kk_x9;IgfW=tsw3kOg#?eu~KHYNlzU?p}%n@;hXtaDgnVg*Rd zRm!4^plzT$0q?xo$V$@^cd$28uk;M$Ph?Bx>aaXR0#;;wkD_rQ`+F5~fw0nAeU;Rj zrh>E?@27rW2%J3^R`MR_@!lqMva#;0nF#~Ec#0IKpr8m?gW!rm;=Wb}@Uaa*?MaN&axi1t2>F*o0jWMr9$M z_n_RAY#&zqo*6T4*dQ2cb6h80<(dVP!LbCpr+`&*e2$^q%IP6R%>{vYQ;o7

=n+ zaU_YkU%m&N@G(hpF79g=$jD|Z7A-lMDMeNgk$B=6LuqPLdIW3cK_2P35NK9m>#Bik z1#hMh%Sh5+6&oKOuHVu;5&&E!V0)oz(zL}gV^HH~g;c(t`Ga^q)3hyz#+@JMAOpMx z(V=>b-18POHW#q2zrr|tStH@u^M=6KTuU>BH%FE1t_2G#LOLnKz>W~3U24=3A1$!s zW~r1=tOR-}$hZWR_wUI?H}E9+Q~`a6UKf^o?fRSAlVPZgRdy)kjbn>bW%)BE4Nt8a z$ibW1oxn#M^$Zqb?^}y}#zJ{bRhW!6=#)PC&^5p4s$xLjk#pc1e*;;<7Zaf8Jf$I$ zaV=kd>Ea~>Pe$pjIDagU9p_F;=5=L6_XBRVdfoZhup0K29G=cB{jW1jAj1NVH68_e zLHMDrC&iluHvdf2YTR%akANvGKW!y%Z4*@{9iG)hxT1Q;EW9zIUz~GDD)rFsB4`7nyA^Mk-j`zdXO|Ch+sc zd`uBY7^>8Hnyf4?v_OJ@m0ZA^iBBQu1(v88 zrI?g-@?Y275rCdLSin#(nqmAl#8=nqQwYboBXr5G?uTIng1jGPG^vN~>kcsqNO39aMPs&Ab-iOxitj-BJ~T1ky=ZwX(KM#?UWWpz zKhR?zCSWgTk2&=+W8%w`GpYMXY0qHo=@XV0)3a3aCAq78Yepv)sWK7q##|D=qWEk+=5VSp8~+*<~uqR9iDQ@OZ7Y`YqD;jWPAnm%vuq zhQt#EKA-1FWhD3)ZO+;~3co@3Z~tWWhP^iozYZ&X-*L}U0$oSNf4g2e8 zX>27g(tZL~JeR*c0>Au9aW(qf-sO#sRr>Q`*LP-LQmr-IM*dCAM+7#mR0-~jWq*6b z^{e9(turrKu_oe{Z9ZEozUx86X74S9f6-rDuzzf#qDiIJR+=WkPL%?Q8_wJUt!71~ zSCfrx`23WeWGWx0Ma#?|e~*euhM*0DPdF|V`U9$pHl`{+w3lBhxBr@?dQ${(q;e_L zRqD{22suFqVAm2Jd~mwmzC}m<_kjn&@Of;h6y}uMe==O;`-ur{xz#JCz4CtL_j_xU z{j%HKhwx{rVTHS0_fusoeV2wmlYjq1f=YzedZo#`ZNf==F1b%CdptR|D0L1jbE~m0 zgX+2EBV*BlynBvM@BW*HqMpM`b@&}7N?rz|RNLBB!{299D)TYDvZ+PwTNUj|n1)t= zt&`VFhdd5WHoSM=p+|EghZE-VJ#kN}@OiyAt6E>$ZgZPU@aCRJ)E?@3AUxstoU&_@wZ@3_%@D7Xt> zqEaPCy>_jO_GBcxUJ`G1uiXEn@N97`kU1969<8l8Ai-R(#`rGvTBAxKM@8!>1NC}h zG8Z~G>-XH2A^hcyg(85fRP8x5@rqwY{Y%w};3Ua>>>lE-P>_qlvnsvjKEt&RRfn(f z8tyQ_v3n^*Y`41-d)1uunXo9hvi4Ijb^b%RzDV=FbH#cGRYS*7E&1Nlx=c@;$NAiU z`hNt^KdWNZP@rlZq~RJaRooH_3`8^xdZcwJ(xCiP3n&js+lSRP!Kp*I*c#hbn?#&e z&a;@{_6``%S|&k2daS!TYSRexua2wWdVJvn@gyQlY-{jDby-Fe2pI1%C!^L9A2>%(o~3u5=ueQT`=Bh^7BKgwD) z>otEZ#k`Bn*;Kgy9xfaV-gkPXI1lx8&8?!=JjwM$wV8i8NXeagf5@=n9;xv0=~hjs zSCfW2j&iv20ohh|d@Asy`VxxvXrV8*{7YE*R5@z<_{x*>?^MXg3+fv)LvPLH%bv?{ zM|#NpyqEysbQaqHB&LY<#cR6HC9w`IM(-H-Uw54@-b~Cn%nWu`%=sUK4^=8nMH~=_ z?3+*%iw>d9Tx?IMT6YywGKwY+#M|yhEd9kqT+|9MwH^F+qPX&_H^|m?tnUT*e+;VR z+y7&r`-uD5{Kk0ZHu4ZQdM^}m{v~$;n-Jd5NO*F-3uaxg)e<)3G((tx322tY&60`= z8I?i3Sg(~7fPsNNFni{UL(*fiXH0EN=lhV4=9?G{7+VS4+rbrq^yQx%Ou=FRVTLf0 zT3w3Y*VEGj!Y_>)c2JP+93$}=24N)O>vboDjif1fhp&0lBc}6Zz^wL@H5n zPSzthyqMzwyWCJGI$I)S-|!jL0kF-PG5&hw?(4Wl)qK9SuI@I{g#@3w5W?!IT4s<=Ta;Sm#Xe?qC>3da885E*K$R`{N6hUG$0nV+d=GmEKWk3jpm8NXU9Y zmL<}`y5Jk2Y4A!Jaq98|o+^bQ_AtrU+VQ2auhyDxIac&-<5W#0B3MQ&b$)}rXJfb#Ij{4V;)Qb>vo4W2Zb&Lfzsd7 z;vsENL+BXDj-HqHx#FwE*uILUOPtn`9tW_EfSEk0w}rklH$kIGe+hi}9)ZvH@fjM~ zOC-rLrs(97L;zl@1Q%G82iukui#nUG0p%fq(J75`_a;Ag=doh&Gufb`v7{b|#M_uv zl9cu#0fn8$#yRmYU1O6g_Kl}k(0M@fhSTrq_M-CvZ0GTWqIUV=jaNrlJwG?TXU^^O4|^x8$u4>acUexZmX z2v>QdGWyU897BEGXbL2g0@C2ga!Ps?--Y+-SoBRtgK7(pDa63FQU6Xk{io$<3}5>u z8FXnh*i-|2@rK#lP+1(SdzH<1tiepzHs5onES?k#DPIYrduQ1t9{yLdAX3rQiT(XZ zHGC#?h@@HSdPg5GX=-yTgryO`BJ~J1*8!r6MarjTsZ#mcMG24y_>WSrA@}MyX*AIx zw%{D%e+*=~@_Rhh8Edj}N(Q;7nOC0Xn*y~M;ugiZqsv=KcS5R7X`}>^JqMem5cvdd zN$YF7mxWbSGs>kZa9X%HBZ)F`u6LGWwZfKT8z^wUf2V?9iKkXOA*{%-3h>9cm!NW1 zrnmvLJ$ywunTE)G&aW?(hPkd;PE#XBnpiaL>nWdqeBc8OnLkn1Qjz9Q&g- zxi^}U%?u(u%D^8o0Wx3|SHPY**<{5>F07|lT~CsL1VTK*02LaO(l*(VCRA=%O2_DWNicdrB0*ap>Rg{l}RznyYsx`*m0-PthF1V)t60(V06 zXybqXkiD;PA{5;2B|XJ^qNJC?0P7+a?5wti{4v(Q(9 zH47jfj2rkWChaP8&&TaDomM8DxYbnpn}2cddAq;6(dvCoDobEwinOtpy~E4S^Hbg- z*05Q++;XeuUvL&R@{dVSYwz9oAAP=~$)m~Ph-KF5;Y}GWxzhl-LOxm;k;_q1Xr;6F z!QCa>CV^6v7uQNkfE}&uZog(~Pp+=Ry`Y;B)%kDdH}V<=-$!T+(a`joB8rw`*8{*( z<*Ky$O1Tprj{E&Eb++vO;%RQrx9h}#xa!`YMmn{&>0_Hujplbw(<>ssn~+={x~{B< z^(;8b&yr89%@d-9b!NG8zyFu;z{~ufT=H6!?VPsiHizXC^OwJq}Pqde|6nf zdsi6sA0#3tr@63zuhW?Sa6N)+^f|jCuPa!#rtQ|n$_GTR(cGHK2H78I?B|9@;{2Uw zE*DhEnXa^v^~bckFS^QJc54LFJG&q2&pLp*#l-8FGPZE{dLE3mI$Rc;OU!xq-yd6d z%DT|w5=o~kwx(=mB^29`qB&w7y>or_C|tPvImyxoR0$U_g-Swg_%^TF%HQ2eymyHw zWEZi=s=ro>(&HZDfDIjWYg6vyW;1rOYz|_G_>C zl@xttdOj*#DRPLPN|GY&X=pfgqI19(u1?Xygjo~%A2&JOZBdr4D!#k=5vrdUmc#x^ zZ4^gp{5$-~Z+Y6T;#sf9(<5<31lZ8e(>aADFfh9mss(AW2~3lcK-t`%khhx(+Phel zX;ww@HhYV{gCKoXnIUFe9nEn_%=5Eov%X!MOv{%q`EHI?0D~bWw<@c^@|8vgG(VxI zkB3a0OmS_u-tLqZrmdF0~sM+|UbyZ?=& zI;YE7Zv9q}=L8Qg*XKNc*?S*;- zGD|Jh=cR8K)x!Uk_w3)=a=-(}x-ZJdwPB^!=k=AH>U4lvhO6jXQbBvV(btXu_^xo} zy2#)z&Ompbdo8aP!Opu+8`%|6%zpFcXTUCR29;kS}LfhOr-a&sj6z-dj8)Bl1e&r z#jnyBdqJbBXcgx>|6^c>Ty%u}_n)MA$S;?YGMm{2KJ$ZS{Vpob?oVb|QBcI#{pzjY zH$y#t-$(zCA$WD)`opDyv#dYynhjTe4i^Q#Ex)l!dq59s7WPCs&Ew7%-=2w!?;k}z zESVDLJ+;0t;#XrU<$!zZb6vPKzWIaSFQz7yB=BCJRFaDgvh*A}? zh|^p($G#5>T)&Eoz;}Vkhk|}DYi_;T=g~{|;D7(yyyl9ZgG!?}ekxY`oW7aFx9f6# zItq$a{c@fFTEFjfy9Nmxr>g< zk407v;NL|#$}gsY`0O8Rx+=~hxdb=?@1&_kB9S&4(u39g|W&8Da7mN8Y1lvOfLg9 zYw#*5P>afAdb!w*h8MJ}(8$3S67oa=xuS(8xLxNm+!#LaZIij#!ppZHIp-H`@Q~~J9YgqE&LZUPw zn_YYc|Zx2^SO*6 zmcyOR=qvf%fmuG=k#744iafwf_R)V|&hy&nONO~kzfyc+h_PDvrM)IrprnH~RBzhT zAN_2cBU_~Enmmq1g&{$aD;0WkL~?P=cXcRib_8$LR&6Z%oxUu^KqrQFGo zx6Q2SG+U%K8K*{VBT3lPERyOJm>Jb>Yl%MLS5XGdr}{+qbl?IVDu+>+aOt=^nz zifMpA(B#*X-gpw|>I{>oO`Lm&b_Rj54e?&nsYTb=-(u|)9EPWi6y)rs1#4#*!LE%N zcV=iO!QA411NGe_tZs;qd#%h8N2z+J-I-_gFaZ)giqBw>2U8&*`?k1;f?Eau^q9zavjymb|$sLxgmIFvRwEE?!uT)iO?9h z{iX|@eFfiz1Z}%B0fj03|Hm)UKtZUbn{1;;dKcM9b}QMF{-%M#O{W%^&XF#@&m&zp z(525X=yW-hVSNCR;t^H8m1CIqBAi7$#KjpSMGpLLp@Tr(NvMK;zhWqt(qe=Y!k?!L zsOa$+(Mx$@%n|>RNhX5yY0R2MQAf3D9g5Gvmxu$iOK~TB7NVNIBXS=(mgYP(DYwMk zqUW;U@S3q?pMmf2t8`g%jt}G&*6phi3s}#1t&%UMPA-e>LK`9-Q{3xWZ6w5s#PMnt z_Z?!*v#1bIT`xG88M@Ps&M`=!oCJ=0cxSqs>waKnF!p3=vWoIqpX%iHA)30%?27G%EQ8c6)31A>0h63V#@x(>vKWUZ2u4BHzY%ugZVcc zHKqaLle`e(6dx&#%G}r05`*Sw8?wOlIu>I5**a;aRD>-1bA9|@eNE4p&TA&cKH}Aa z=@4eO1#JFzbU+W-Hyy$Vxk|vKHZjo@J;}Le2fA-h$-_H;Xb&f^_F@>vk&UKMm@0uN zsOYC^M*Jz++Oavt9C%y3>D}AUMNPOhT}sNn^$TT&aowDov467I(t_9;UuWL^R*h?HB~d= zF}c89Q@wD!t#xb*#55SD8z^U?49~iV&~V@kl?%{F9jo#kQDK)icY3evsNSCx{#h}4 zqub%}t#E)qNcZu%R28Jlw5wR+6Gpv(Roegu2fw<#RoD_b-K}rNIBqYiTE<+L%u_e{ zSv}^%)D@W2u1$8M7Opy|<5Jnq@h@-rZ_`%W*kz*eT!p;hSho#u+M03kHLWMH$L&Mm zpIUX2E=dc2rMQ9Nei57rA4e9F^5XBbT8w_zrd(5=8@$$^)e&Vwx@Ri()CiB=xL3P> zux58$Hajwr9$fnCeFqNllGi_?!ME}+;hz74^(K*F)V6$nE4&+@YXT2`8&#*UGw}YJ z{MB@-Yt8pV+a;OGA2Km#in|XH)PG|yuE6LwRp@=jhuec!exy2CTj}pwEPU|$E%vl( zX~s$eXt?Wd8)}(6G6hOIeYuAsdjAHu7{_4K-e?;*Ms0YYuEsL2)thu+3_ho}1|D;#OZ=NA75-FcIllqS+Kq?t2*-{qFx zqi~8Yu-fGZ6wbV@#CRNedrauZocCR{U{omufZEm6-Z3k9m&~tJVU7-b&=JoP?w&fR>+W%M!hmBvZmw)$C9QzrcpU;MT z>R@a4VwUjwX{Mn?rSPiX_|()kX<^m;sh1m1g-PSIa#;OXs9%9pM6tkWu7@A^0HQgM zz9xGV3ZK3uNEdI4y;iXs2 z_+LE7?jt)qpYA)dHdg!lF4t$yZF>iI6;#@V&b_p{YxHN3FIiFN-QQWS;QB>w1k1r# zS7}jP}T$-!fkz;MPR9qj{lmb$F#lMFBjvYmK>qvetx}5t_Odz>7 zx4d$;+962SVWQfDIyaT1;mm0mUNya$yU_h^vkksB|3FdCo<};~p8s+v zrr$@~Vk;7L*K9ylwgzb8+ajfM+(!6-?fx@>KCwV&V@0(w#j^AD6 z7K(23KFB>aJbY?fN&Qx2^rh)&>QTOq#G_B@*vd~xP0zkJbM8w|O<$>=5&Y)&4{byv z)~c1nvbA`kEbPXjS6+$YQ|{=2jC_7dm?}XSjw?bm3nah<6j;+z(;aA0I}it9jqG-8 zG*+w^lNkzsFuV;3lu6<>7R}XZc)-sKSwCm6@iF33Y+F2K(s%l5I+>?QO-eBoKaIfca;SFs- z$UU&=77q6-8ZcZ-ksmg}1U`rB6_)!*e&)3PV-R*;g&xb!{mJk4!l;T!t~#d_dqpgf zsOF0%S;{3`mSUhMFO0hzJj6&Odlp>6>w%IK{T3ks9}Bc6U}bZDS>3W9!?;hg*v@sy zrP+-k`DfS_+%T9RxL(FPEeUipPK287$7vp3ojE>Wn2EYJDpVFm&GE$~63G6<1VGNp zX&Lw7ANkygv_QcdUYtk+jW2Eh_&^zO-Znl;rlG{AAJ9v_y}}%}P=lL>HpNrhNNQ?F zzKML3A@HoY2@NscyazpCFQnYeTQg?`ER!kO=R_9P*glNm_#}{#wvx?VKwwpN9wAih z6_+<{LYnIpr`P4#nO2xYOTW@moI^#F=|PO$XqThwz6;K5XpBStuwkgvnn1IBt5g?wiyvJo~RJPL5jl85L z7Ovt{bHmvm(#f95g^i}tBDwSyhHH^1Q#169@<3CG5XVazy1;fddkam8`?^)|YdOVy zQ=!B`B-uN=r*A=v7kOlKbA@?)i|{*`w{uLL7U%ezUCPLYtIkwjz%aynyWg@i)(HW% zdoPH{?X;=F;;t^)kAXJ*WWtWnm_IKwmHG3gSbkO?w(+RS@klOFEBHQfW}=cGmQOJ2 z4g{w(8IlVDBUsv^Te&tLXGJss>tV>aD-p|#{X*`flst#M1xHzcg}rk;g50Y#X@=A2 zC)_J0EuxnHlnZ{i#10N)wIGxJHDsJ0T7nKI0`I>_1lGgguGoyKAZeM`29epJvaBV|^rQi>lpdNK&Q@!h&^5k!S+$PFWSwWQ-;=G^dO3jH6$LUn7TLyka6 zbNfk_kWk2RsXPu!#xookBiv;PG4;Y!RN`6|B#1L}-w@)-5|vNKrU@=o=qn#sgNsFG zt|y0B_LO_a@k#dEBuWW9VS=^%kKrBEW|;HDT=LX4O71T?W5vWsImIS!LzMCX#^cI=*xI%2_S4N$# z7R9?jY9UPvE>v8TX`&i>p1u}n<-5NnM9#srMu7O;D`d@~h_rD0U2+!-wRCwhcqY1V7n8uk+#u-p#HICjmh?lu zGI#m^F?9Lg!PV6?RW$Fq>du`B_AP2I-j->W%6gD>+hO|g=EsMwIB?|XA@<1dlk5lk za{r!x7vhWN^M8{_C1Njf>%S$>TH9Xc6NKVEMlJQa)@aFK;-k>HgxB3Uw4nGW5|~=_ z*RBwk=%`1SYZY^g7Fh=Kq~GuBbgfR%8ivt)gD2b8=IXX@ZiC zZ0}vMqV9qwJ^>}X>#5cD2`(*csd|nKE{_MJ)@@Sl*1fKlzhh?~vOQllY|F@&i(NF| zO$o477D&n4oo-S5qImvG)V-nS+^Htp_2FEVFC;RS#Athp(ZYV|TAiiu=Jh z(yogxvd}N3c3cGht48z`$mCvy%H86ci_o3}gFv8+UuuWQvf8+e#i0_#sBhYAB$s68 z9wd>z5V}EAe{-|FXUBJzJyVcF{fm9|ohMesMjBT;_?IhXJbV=uv6lWfG8Jf?XE)dR zGiR0S8{a@#p1n+FkT>ggj2xxxv0ADykzN{aeY#}cIM=P`Psa|;SIVHR)+(h7_fO=x zbB`bMgWpcv>wWP|Iv~)&mUm`(;mVo`61D`N?no-1$KBmE(s#x!s4$D@MMeuy3c&dd*2b3RGwXi4w2|kE&*`D)=>bJ6 z9(qfcgR~U5%cqum?x@Lrtk}os(7B~2^55o2?T4BwggZ*x*>6C_p{6ECC$yiW#Lc|A1M0Bc2 z2eY5Di0y1)nG!FeKH8e~tM@{Jl|#fQm-~3dqci72nZ$HV4OD=tIM?%XVe_>+?i4lR z!YSjsRwY1^A^-aFjK5Z+6qsgHqjeOa?Jssd#JT@S=;1Un??OP5sL_M{tsnW#)@&LI zf4SoRtu4PfZm5W`@vyiC!%e)=`BC`qO4QUtv3UoE-!A$+sa!va4EyAhl{QK_U<#N5 z-eU$C#qo!Z+pfm_JvR9l63!M}B;>CSv~jz`l+*EN%vD;Q#%w^1Zk2gxwT-!)ldf;i zaYhJwDY*MEd*n;Mz}bf+0A_cj^Iv}UKO?A?UF?6x)l9c{7k~df&#VX0ms*QEmM}61 zcv16Y-(Yzqe=^7tIczV%=aqurxGc?ssM3{C?l&#Bt%pZXhuI_;a)t4nm>=GB#O?nC*hTE=(`D>N22GseoNqU zvBk?8z^f()-H1iYM3}@i>aROVUV-OeAGZpP={E|V?)RgzF=M@p^zZcT#`>;38DV&y-sihc5>b+ruo4+ovJ->}+A~zd2eu(yrF8i- z+mNO~26-P~YoTP89Y3f$VudqBo*>n(0SyBnNFdG9*Fx~0Ya~M2OnR3hh-V^G;t^hg z3r_Mi(8ebVjb6zN^M0XEA#H#znn0EkaIsP~k^U_75Yhh)i+%&QTAf-snGTU zx_-|J)w8e^MUm7J8lkGa-e>F*gy5H17CJ-{g*nRZ9a{1wgT+jqs)`CI(KtQ)8WWnd zkR1}p8ZfAGj45;9p(TSo7;em&$(w&wxv{U@^!Q26O64Al{uf+GA|xuJq>CMsq4~j2 zwVyvRX^s-ZdWMi>9NNNU8eKxn$HmH21w0?Mv; zR$>vPz(ti2P}*t@yJ#KOI9QYgQ4=`AMs9=ZYr&=R-SbBez}3e?RuTh28O8oT;m;TH zFuk}iW$s2$7sZ=`Ng}y*6xy&5jS(e{z=+S4DmPKbd|pNOLrMl*Va`;Qzgq~{wZ5<9 zO*UWj9)5RYrGRaP;%_DHkbh&XQCWO0mX6_VKSX=mQfz$OrP|+w+_w5?8(z98Y!+Yu z*#_gT7Zwvsr1mQnjRAuY@h%qDiA(_BXtb8Gp$|)a?VK-7 ziGaVkP%XYyOH*m&mrLD~{F{NNSSjo47HUf6u$O@XMf&J-blJcw_&DIV9EhOl2*Sbb z7Nm2ce9n-eO`xO4BHqDd7G1)kESmG+FH-MnAPCY$k_IPNfOT3MSzQ*&_m`!&8P&>_ zCaoBvHlP@&91X-Gd|Y;y5qVya!%_le$(vg3!PslOp&WXu=G^{gImiRx4ZzrjHVn zxvLOD$8~(2;~Q2ygdSz|r_ACKdon0KM0X^R&c?*@vUFiEVrUw%vqOb;kS8G$fFPPZ z$I`XO_EX2c1CobpE?L5aC14bBh>*5T?SN!obnYm_J?Hps&N;s+E`>aS5IsQ~q+3{d+%p2%$JcQefDBQ*;O4a2 zd9Y{*E?KJGr_atIRsByg@mF-RktmG^ipsgkfsgZk{g`Z5n4!YXl)=A4QzCK~&$Y>4 zvi69Zhm>y$f?d(yTwmW1|MfayNv*lk+m(1yBlE2A(YUkk;KLi+7oN5+6uLYeIAc82 zAj!surON-Ljv6igLl&P+_c4Dnkl%Zzy|f(JFPs%Z^IPoGj*uEKJ^TF4C}S{A>h=`r z$aS1fZx6P9ujxA?5*aDZb~f3M>!|uQ&}#1)C>`wb!r`!TP@Hl0@2iC4k2SI&4@p<} zp)t)>;8#s?Ur6ult+OXyeuwI;Upj8=*}C$+C3eXD)mj~;UcYGYHll3Hyk*N_U_H#y zpEN6m8eIa5_ACNmQUY>SB)7Y@PDf0ub#+HDz01+8;Yw8EWI)%gDxc9N(i68<0tFN7 z7;p5dT>D(ZgF&b~q|8^bOl9QF+&9u$z_0sTcxr@04*FH8_EkG|s{qO{thYxv?^`5T z^g)sKbCR}ZfL7nzIn;P3xb?MXAFalMxwaEe$(_7A1ue}fPCpG9i|F|veqFZjzxfAW zT-V~e98l!9bBBMl)R)d!0(V1DnN{n00kj9XmKzS_<%$p3Qd-rzXAGJLc8JpWOKwtxJWkG_L2^!h@1IgjJK7WVK6a zw*pK5ySym4J14LDZCNr<+3vl#%5vSn{Zd`{K0NnkM}yyc>Um15eyCU+?{Qr!1!JV| zLcK_Im-IudFd~JcZ0HA9Xj>l6H5Zc%M|FXVjAN_7wB^jTp4FQoA(UK$8x7(EsQYC1 zn?IAPsNr_8PVIbsF0=J!*E~TUq_RacUZOL{bh~i6U0a?%=ANPACU+U&Aon+09kX~m z308Ib7~JNNGK~&jr`^@K=NMamTavdCw^9qhJdx-oOg?dV%H2kQ$vzrosbk9J*+LXC zqj%jM@!bvuRj#V9YBb;AoB1!UhHT8o$Vt1tcpapO2S}%X@WbemI#x>2cLpCZ6ycuJmd$I*1ALV!L z4QDxF%}WV3UUNcx^L#Ly>&i5@iz|s`LNsM-zA|B2K!b4F$$}%L)O^UZ+iYlf&~BK5 zsk?i(s=uNIKHc)K+d<|yZ*_bzVO+*byWTlH+jmxq=`?3}g}O=^#s#EqZ-1D7Y+0Ti ztuxyu3Ew89Zn- z+~N6STRszZ%M->FzScWjZC^@gcTL!L>b_=droq-fD{g}P)4ujkGxXO7;v!H^r$wyn zmAK`Sf;-4RvK_6hc19x_GXA=}J*W3=%JLwCf=6n%@Tad%jEsqDKb$+0`A1d%@BK3+ z>G+{`YO-QVmkNC4(5UL5uFlG~8|_$c7L1WcdcN}L2Lg8SG|lbfvpXLn`F29zz|LqJ zw$v1MWMHvzrc*Ci^Sdu;V(#F%1II4oR(9vs3p2but1~t-brV8EZ2RT&(u7Re0!$6T zLdbT;x3IV4?-6mGXs2L8E6q{aexiw4@a77o7M*4b;5caXdaC z&|@j+(Zn2U{XA}gD6!s>;E-s66Lc5Tuuw%ONXI0Uf)svrsVJP59j z9)e6Uv8W@+M2_QZ*#34E;8nqG%n>y3I#D)xhI>0mmWw?6WuCq8CEkNkf_IqCMZKCC zDdBl(+%Yj!)aolE9og_H#BrN;k*!qIMDan904LUp5st#Y{-z}@-X&7L(VG>@&|NEN z9-y-3KnIH<#OHFpW?YYALB#{NUgMU{vsMZzRsbA45!kTe;kdD~|lrqsCb z)6geR)HR?i5Z|a+%a#M&u_o-RALnRc_QOCWWt1tqu=0ZXMlv%JZ< z)cCw6w4kWOWMq&wtAvtx@ay`C@8lmlEi=*N}_6<1Iy zVY6%>F>7G45YzSe9PO0Z1N#cbt3*DwXWl|o#j_1i@W+DwZe|pZ41~+nA6Ni}l4qJ> zilaXySvG$oGfqqMdVLh0Vf9ag&D?%af0TYduzewSBVo+A&7uzL8ZsoUVz})WXaO2> zhQ>)L7`@`lv87U4bmx`QVI3^AG4-{Xou+P#h#L2AxcAl#v7z(uKp*igWd zAeuH~ZPF|Oc~hVUhmk#sE0XD%D7!j9y!<#oF%vAcpfN{!w_mXnb`m0%+Psg8wWDCn zX(j-YM_aW^@ge5*{r{urtpA$&+c-=rC7puAV8|FDAt9gx#uytQ8{INOLO_sikQk%K z2tg$`I;BIUOOzG~m68$!1V!rm?D+%s!#UgQ?0oL~eZ4QUv)*V*Yj=ig@MRe-LPG=Q zX(=E^P=|A(Rjl16865B%l8jr?her2sJ5Y9vLZ9C?>Vf*(aEfZ5kT!VmBoaJoF`j`J^TJg+x+R_bCZ@pp`C|6^cusrr0Lf zV8)2jlLH_p4W$3Q!bq_`juHJQCQsVdfSF%NFZB!~9IRsaJ2IZ8Q~~b7UIZ-VX-pb_ zFV|!26<4x(d%@(^D1cL5&c4t6vl8r4!qVivU zFPF9rL7!CKSO}ZhA5cu2$?DCp$5VY_(*fDfNTzHokyfL0&xz4UPW|M<7<`QvZ-*R0 z2P}>BVHaiG;gW2~Eso|p78PU1ygNx&kWB7)##QySeBiehE*)YQ7eg0>k^a9$MSyevcQ4}=!P4Y{z&*BdMG$U1+27iTAb z*bQkeah(PJN0DpLZ~j$X^jvo9wZP-QW&H-0(IW3$kON~se0)wg-dw%Loqlf7KViS} zo(u!m1*NQ%O*Vbrq3h5IAAA2FMWbDXwc*!_wHrD$N;&fE669go=HRb*a)9@RwA%X+ ze}!4&4wJfA zaPK_AUCI&9dz-Y&rq^8SHd`ettF9S#7_vD*k!A%D!&K^p%Gc7$o=2PBfaT5p&V@2u zm*y%iCem!CAgD7D9Dx1eo8-5KP--#dYdj8_Ia>ZPM-Vl>a55DWuxG5& z`lhNY2txt{kQ+U@;_Ki_5xZJpWa}(A<1Wip0?t;x`NO4&qu30WNblJP*tfYPPSul= zO!l}S9qM|K&@i>n(F#6%mQpKQf1rCPaxQi zB?=(0?~ptFuE{CGMJzU}=@rsH z`@^0fajCY%z4f6mB_S?sInR1Q$lc>j!Q#L0A1ze^RHz`Ab&76e^BPVzefA|*r|~T~ z({TSnUu&zbVQ6H}u0ZfO?;{^xgx3&Eg#Bwm<2N(7zfx6nHgf=utKU7T?uHdqsm&(J zHil`O7MVh{NxP4Kb2{@U;jSXfa@)jiyU7}q&80U2s3q!nWXWV9@N4(rgW@jJgDUOA zaoJz*uDw<3Ri>*;n+vixned=bK}XNQJ=>MzFWl;aTq^Qv?sYFBoR(_r?WV4jg200} zu69qKm(aD@U&$?Xy%~xSN=xukvrf3|+YEv8L&?SjvLnhA*6*T(`|5Bx>093c)+3-GqH@(L6#@#m?Y9o#t z&GGuZ`n@*DSTGSbzBVI7=rvbFSV{r^P$uFbIEKGOff%N27U zZ(wBhK}#(DlLrY3mJj6r#aF|5!r#&hoN8906$zl_`cxL+D=JYl?aCj04|&gfDF^eq zD}I_?7BN3o>>N!m1HP-p%TwY0uP8v7$Gulp{-@Gz5l6I+Um?q02EnQ8+s7=m7-h~J zbjrUp#D<0j+s$9{hE2c`*@lD=wl>Fk;QMaX!+N1-q3i zkzb`@o^sp*lq_Nw{F!qkQ*)?1Xj*K|*$mL=MUH(AY8}d=F>)vEqfq3Jep_7ZSu+oq zxcU&fIzUZjT*)7rlQHvFV^VSD?n5i3b$R=tyM`B(ci=sqqJ;{0iP>GXHdp)%;tl$DsRaSFF03ZmU{-L<` zo&{KsdM?e#hFrA4nLwBtrJm7C^0@Rws4T#_X$3IZC_*OJ1-^H8LdK%7UYE$Kz~4iy zOc>*AMfCS76@S-+>EGj`d4#4VYg=zvVWJyB;%sX1^ibCI_^*gL8u-(8BghA5v6>fa zV)Xii+niS~@yXZ*O?t9vCy*R}4|QmDa7Td%klKAntR9VM0kGj_b6v+QpPFA*P4ZNR zEzm5g=6wQZvGSvGIh>3f@B_%1&Uq>thatb2(jmS8{9II$jjg7z1TTGY@%U>4a*mW| z_>@>J60C|B1L&bLw{gmcu~ujU4a6w0p-a+b*~28r?# z*XeX;kONN*vppE6y%x+h;@d@!>eL0BEZtF;hHpE2%OGNO0mgiKa{5Deb0xkki}ho4 zoJTS0252e)Giqj#i}s*aehm72_WQN-=|?0GcJ4M4nE)|n8|)`ibF#E$uizM4wQ;v6 zKDUEzl(R*RKQ7I+k zZKf;8mOhNR)G=vnhCBil#bUZoL^jLLL+SJ<<#HsCC@1lD&sWHT-3jD&ZiH2-9F7kvEPN;s{(l( z2iILJ3cXJ{x%6j7EvlFpvxddx$a7BN>?!a7hsH;O60>rzT%<@nu%+1A+(16lV*7Q5lHNb8RryEmkbH13nep{?>Ddt_O#P}0K zsfKoDB>85u#}bwllI6u-Ou(q3RSvaYs!%Mo+~X9@ohQLNbCz;Lm^U1B$h%uPmM7@3 zBh(aS2>d) z#!e2LMe|6~_dg0WD{Q4+40&EcK4&El{x<4Oj=pm_EP=BtG~*|yL=DF7s`RR78X5{S z&Xto%F1B&1BGkMuds9Z#JX)tAQ9OF(O0wA^mykf~0>LJ1EC7JVED7&uE*#c2`R_?y zciWEKRgvSmyis@oJheVZdw9!u(DbK?sT>E0v)0b=p%S5$sFq`K=s9!b&weTtbww4l zJ9PKPMQxtR@y4ZYLd;d{!MC6PQ5;OKgvyq9|o{kNg(xNKe;{w?v>V)JK8#+9`4Xpb3=%N%w{sruRhT3jD56Ko8e0Mbfak1VW(NACj$ZP zR(Q=a<9vs^W>gQ^dlJ8#A>>;Zq)V(i`t67aqXePTlgGHW^Cxf7)2xe3y_s>lt0Pgb z!}ZCUBTebI0e6_G#Lj(0p)GZrk69(r&r2lP1V$(UHor2jvp5gzd%%-eTykr!@i)Xn}tI`{|X*0y=mlYSZZje8{VuRk5R3XuK_6)e6xPt=a~=?68C zgpZvljq3wvEtwWT($2#cEpuqj=Pu=Q?bF`pUay-LXFz9mTnEazl4u!oKmp3X3^3hN zE12~k#fksxdkXgOHX(HYs}F-wsDkD?s>PgnCZ z%M;9AAO25XMDxQg1GR+57 zgU9x1D`#7Ont`h)vdkX$Z1QRf!yETq~{Bl0~zEO44K&1Br+5EA!!G*My?1fCsPvEvmnTnEqY0eo>RhY=>-Ren| zU;8+hy^*%G)4Gj^so$8xRKMeX^!0rlX+`p3x=m85trVJ1BTecuPYqmdlYMF#`y2wdUBb}GDZw>@=TzdNu<%JzC0NJ2PxgA!v&*Hv*F`ow&70dc3vN@b(h0 zu9kyV56F*$EBXs{gMTJBc$&S6PQ6#oe4aPm;88bs4TDXiqlUXB31_5#`Zd6>(s0kq z)$aQLD89dAL8*$D-^_8XWPU}8`e#xsXJA{&a%tmf)9|@`fsdmzw(T3fLFMs2Z9i{) z5ihvNnpm$hCj-E@D_z{e1`g;rW&)1T@>4S%ndEqmkX^X&?=f+INm3?*E2)w(+^aQ@ z$SmcJEgpu2Smh0CrIi@+RL(@8z2NoI{d81VM?42iTYAAkf&(jh6Wm z2;^Ufku%m7OEH4*by*<<4TloVPb0(kwe4KDC>d)NnQhCP61gMbZ&AGDCQg z>@K5f6U+4(;G2)BhkX&Y#&#G%d~(Sz)sC#V@|O%6{V}3Qa-KenUXfN7k)QjcBI^gq zQku~xl^*t*oMtAweE|wWnVn*!3OXL&0y64?Q6hOgIM{(CXWDY!yw2qi*sSxi(Tw$1 zv(^llI6y^+L=-uyJ7M*!*NZn+YuGn@(HjFa(BO(Ru%}6K`v4ogUA4Y$$E@Ld;}@gC zNyK53YwuB%e}QWh29No(+((zj6q=1kvz3ZPIGIjsXk*RTG30)F`N5gb{pslN7UJOV zb{-ugh+|L%>c8XE`gTHoBqi<`Ijy8_U`D_0&Q?~bf07D5;E$rx>xzV3MWj37s2qSo0 z?3kFX2RrKGV57?h`ev_`Jn`jHC3J%dZGH3?QS4d67-xF@Xd23K#j~D=8Fu6|_n8S2 z%q5`ii$mY79$LLf6mL!Yn(|c+H}3B98W9sMn2-N9mB$$mR1Gy&3K-Fk?di?cGjfOp z=oS9C#N{v}!ppH^;Otg1*@^TuPGc_p0(`ZURo>5C)Ol?hZ@H9UBWyL&)2vULc-)geeC;$^L$^{?3cujsye;gKxy--uBVClZ=4xn}DH?z5~&N z?w?@{4<3v4$-Hx~hlu5^$jsOa6sOLrl(5p2;XFjiYAl}NV4&~n%Pf}JGZD|q@TE-p z1=QV70tcSgfhuI$c3_SWaXiQ~o}B4LE*F+Vd{6vZ#ci1Z1hhTj48i|LQ5Vv`lR*uh zK)=^}n8y~s!Hjq+XD~X6b4^7)H8jJcY5F;U58ePQZiyJ`wL%gjgfCvI5DR|fzAYuD zV432>(sevr>J~fLRnM~GA(6m;BN5C9Ka0X-n48x)mF;NM{a7-Z@UdUF#_(F&54YGN z&nd*F5Sb9W1&ZQxD%XI4JSm$MyE^Bt2yc21O&E>n|>dQ#tI}-DeK*M0k3Oqf0o-Xp+SQcbj5~d!k?l!JDzj; zMTssYQt}Ypd&uaWRF;SzzTLl+w`!ijco%`@)URCy=^45DicLj>J|t4PD9MC8XEUI= zCKe+v(xadJ90-VE2)uI3?*VD!XwwwLO3f`QqWy@%IY2AQEkz<8b3c~&w}t_gk|W%P zWBjEP3uo4I-h*m^;w^;fX{mIE#e@=1H{Ej!rt%!0_>%qTiWn?S`U8YACx07otohCw z20hM+InQ_!xeyau3{UBnV8WdnDMfC>f=L86iqtT6^2Id0{R-dkIY;HW{)HPWb9Evo zo2Bi_-TZdU-38R4I+2=Ta+fa_{98^w3CxDosQl{$de3ydyfRf0eY>&!{d=p_$-(Kn z=V8>VLO18aUT2azHjOiy%#W30$ww>Y_nc35AF#T|4HYy0Z0E&o1(mGXM@8^Xv=^QN zQnPlV>k~7YBUMkQS9P%$-WH}-*~R-yHC|?Qw}rkPl|8QP7RVgx;WOO$>wPO?#>y)J z_T%|?jk_eMPmm7zQ_ly^zTqTa*36#p*!fIl^|$RaZ$reO6-Z5^f1b3eAvy07hRRrc zZgq9N{JXJ(dTOYBh1OrBf{IcBw(Z9B4sMycrf#wR83@_Cy)w_($6ym`ZtXk!Y0h4u z=->y@G!9&>(c3Maf3V+Jyqa=}{CU$mPH6E(lTuAziQ>d}wWPG=Z*gb$tv)?>^P9Rg z%`UQUx2ri>ab?@MyS>_eUzjLqwX#e%MhvN=|7qT$*zlX%E^wv6B5^Q&t5{pEwcLyZ zzbVn|CiC}7ki$ipZv9PK!cBTxkc{BikfM8J(=Y^c+yoQg4@XG&_dDS-UXZ^KeR(UnZ6A;-xS9p zMi`FMQ1`dqm-vnyy#qgqN3@{i>SVrVHlqOUQzn%dgS|V0-_CO|h0ONr1Ss6$Zl}2R z$ee4`uCw^{8n4MP)zY1U-nTqD0fMf!yhpUJ@|3rBX#dn$D%|;yeam>ol-kbYT2oNq zk1kaUY3jEY0d+RxsE*+*%_VS7Ikn-)1aF29ysLj(WAHw4<<;ZOtuOv1!{#9z$)(`+ zE0)R`K8&{Bywh1e^Nmi42dq@BHl;&+6cK_KOs&refeRZK#-qDwPK0#-r z*SF}ZEsq!ey6w^w12mAoUq57mZhUJw=qm6YEnwLiXD*bia4~;suXb9og7SZtM{I5O zR~M}dd*AZDpe?6yw*2O-;*{IuQghgFYt0YQ<4fhW5Z&`g$)tB8rp<}6da$8iH$%yO z+?%dI;*OyZ%Bf`K74lJHRnA1>i@JvyA%RI65Kqn^95zw$JAux;a>2bBzuc5_cT}l9 zHYqtrO}=J9!zkGicg%cmQrXM4YUrY>nk)BD?Vo%TX(&99--hI~K*m#~9U)%O&-d#g zK}$H zl5@w8-^En=VQg|5Yl#kjMyZhRclGJIP%4!#yPSH%K|v=?8nZ$}X?!S!Ca(3a|0uBP z&#F(0R;1A-KEbGf2-7NK#Un2*w5gR@!N6wO4V6udTnB}d7!-#KCcuzj%>L>&J!1)Q z`d_!t{dY``NH0wM^1@Tk8uBt?iZJ$7B!yKnNZ+wo%Hc@|V(|7Rbn^mr!Zu$T{w0Wgf`L;Z1<3q_pd-cd- zyroTdYl7cgl+JVp&uK-H{-8?u*OTvqiAT@I*?DWI=C%g8>%uEs$4wj`a&0b6>69fF z{gnyjJPi#B_8)R$f?H**fB>J`%m_bsS&+0H91DvQ$2a}eIB1=n&p+zirdLWfyQH$B&xjvth~CMP)Kfu zax^+17lQnMwBu=N(h?&&3ZBd|7rI-t;613XCZuGCw|a0mF0Gz8g{{l|9Q4eZSScQF zjX~amC06&toovlz-eGP%SobwvId)G=9A}JcHW4d-z#~MNq$A|}FDZh3R#Gs7*(N7c z??8bhr!n=XwrMr~+vrB_hmcPf&XpcO26MP>b7&gfX-H*vHhIyb=M%>BU3q(?@t;N7 z)4EpId)k~$HBrr{$RUp_ySCrN4eX`!@Sx7Ma zd!fxf;$B;Md*`+PXL3$}{1<##AjB24%au0$uRs>q?yX$#1sO`KL8($v zS8fdm^QRWCK;c{Uat8b+2wT@aHX<+Hy4XzEDZ1S$>&^fOVO!-#d66Z%ZOjK&&i0_p zCGkr^2#3(N!onAMMUJch6ss9qE4iJhjV!o&QIGwQA`z=gFU~3_vSVD0di(B3-Iml9SZx9!l-DkaedzcPWZ+G)+jl6350Nt2RRR;0vF`( z=GK2T$K<|Z;@JeAYU3v82!-W9din*D4zp4r^y9Htwh#G)afdKmbcP=Wf>F!_n1r|m zPM{4#QZP_U!b`w-qJe8Y3b{-4&`!1v8i>rRk^Ftc=A#lyHendw$I{M1SBVbem`zPDU2FTQ9^nRF(+DJmFf}NdrolYx)7CR5)8>p0t5uSk;t2pSJQ* zfbL_d0NQ>N>>cdTpRp)GqqcP6M=Cldu;+evw8J;?Qmcuh!xfYilu$j^i}dvrUZ%;m z7ZwuyBZ}JIStGg=$sneg|0ocp-=R*42s2y@MnR>}C#KBTT<+Y=11Tp){0m@}A$%jc zzNVha4M!tqD%758!gQ-^Owj_f#3z(4(y;Rwt-M>3?){oA+9L=b_AwA}xH!+Of>0|A zb8ImsOE7mK*M|`5{ zV-C%fIT^@0I)IbkCM?02Dty8^KD( z2J}&CJyKMXG1@)WeoX)HGVOQz+Vzu4fbK@{n6Dssye%m9aJ|f_mJc*BmGzy_MiPno zg0nx;d&PA7L>PKB5}{i^3uU&gNbLPKlfb-OTRPdwn6BwfbmZVJRw^vk9z{HNUCN#W zM`XRZ*>w8Fm$VJLCLuG!Io^cpr^~qRhhO2ZHRC&8O}Mvb5o?!D7*~uV7bauaETiM* znc1N*V|@i2YPb>2Gbz>|(5vUg2CdQjHxTg&Pd5s3*w@tD(HS(uVACMo{xg|4s7ZVaq&aRj|wuT$uhSSY{Lt6Zb6qASy6hLPBcyU5; z82SUCTH!??sO|O`=LFM)D%m6Z^8_f>k;MQ&rBpa+2w@Z;=SCZA0w^#(!=}dSu^itj z!DSX(z**`8ldu5pA;cnPCORMZGWgb)N^B^W5FU&5vPxyRLm6=>-SFX8<)FbC&J>9? zjLLeMHfL-d4PBrxe7Qb}>!DSF8-wjUu}znpZmf{_lqg-EkH0T(z`Nq^TA+aA{+=7< zr9aK~8WKZ)fJfIGbHsImh$64`ur<&gM~Vfb;dE7doCYN37sPkuVO9k;frh+2n_CIi zW0#qEq%uHWoj*#MJ3``$EXw@S*>({sl7T?lISylX@n-#{zTL#=Lf z??PfsvDXOcMi}9yk%80=oM|*#mZOz=CD{1&QK~Emv!hX@b*0wNOx8=iC!Hcl1^)DD z*3seOwPvB!wBC+DQA#p><;hF(IwGUf5sZh|aaHlpVbcZW1@KkU=Ni!`^NCIC>gUpY z1lp>cnYRKL*AHb=zPeP*F=Qv#EnC*WW+Mq=^sdOw1c*u(cThil|C<6Nsj z2WBU58ZfsgZ6!-b_MZRidTlPNc=mM2{@eC;*)5gbz2TFOs0+zc7E*dZYeR`)b}Q(~dnQc}jt7E{3J<-L!Ev8^iJJwo{XQWnvMaQ~Z6bC)f@YPghucH{ zz6OlH)2N#j75S~wah^TW3tX5CyHUOKk%eH;5|$X=r+4bMvO~%K&vr;HforGYc!vSS z9aqHtIe6pb)R%~f%v?WX>B-S|w)h#U6UrczaL*r{LV(#K7qk|w(h&7cT6e&N^TqQg zQzBy}2j7!o>`crZIvC7oipe!pf%;Oc?Bo%%apjueMju_Wv-EN!r7H%0lUkm`Kd!wa zpkjSejqB#nE(=GqU+ODC`++=BQ4%e5vu z54(+ujz2frD^(HFOrJg&J4f-cCF>G>69=2+&tXdlATYkf-5Nq8y3jMQFrYgfav%86;N;*f0YX1efdkU-|ndVGEjX|0~CQmlYffAAT z-N<%R(i}xPtMyWS#yub}`*uA^jw1aFmxKGOspo}opAz;ACSxVcG#)@OIqwzE6!{U$ z*N8@_Sz|1b$FO&=NV}HN0Dt&8xqpKIyVd3Mccy;!ad3mfbFF&>lD}u zrQLLo^j#CJNw`gNT;SoJTzIT~n)_dq6AF_JA3dEPH6X6#(eVirr*F-G_2KML=y`?qtf&D*zsz7-DANU=&8vT}7&9tl&bBs6tH@&>_YR;iUaCM72f zr@#7T89NPsXBD!st(FaKJe2qAW@Bb)4io`U6+4SYHwaD*TeLnGr0L7VhGNvh&z&MKP$dHUJ}?r?K|HD-61y=&lOS@FY_C_ zouHq&`&i$_iRWc%0r_NPM?1uE{*Vt!?o9tp;YbKgd{X9CjRE_hlB!cB-N%sccQ_4`VkzuaY>vJywH@x;y)l`5 zRrd7Nu%6EjNT+JV%ap?{J|qOIO2swdd~{tcB+kK;^a_AwpG8da!GLT)1(ot9WH-{Z zNz7^6(f#;lXy?9@mYA}vxSvMv>c8WT`o|+|JlGWK^o`{*d~CusOW5-b5Xi?Lt!ay29jF0i zW+R&4?KKxzett1uNe&fAk58~F$zOseIShFBo2bOHTB2-{3dKk&zCK&2_JR4KNWWV5 zt!f#!UeEnK&YX#t(|P_c;=ySsi2B@u2LCS>4pbRU*IZlme-y$3dm3=NO&CorE?h@P$ zo6#K}aBwLYYbtIxrxw1* zn$<45`X9xje0ko%c}x#yAWvP-e-yuF4 zs2CH#Zo^n^tRkA{urtET$j=%6S5n37y|l4#JJr#83^`o_)Rh(B42SbmLe>=9i@ItR zIfqGZMgFB_GS5xo+J!}_OjuDIRGf#|y1N8C>j4G0WOQ0g(Yix=B!cob!t z7fSZi^={dKpdW00n?^ml@x5B<8^6i3201+qGqWL4dhx9GLMOM#0f>e64ECC?yN8z; zTjKf~>!?sU#0ou;FVQL&VVNA~!KA~Rjv>^wB^nj6VXa6;*0p~~5iH@*uL3l9MBRqvpmXe9@=_U06*_UlEqMyOTrE)V2329_OPiRC*RkvIC#7l}&06p$R7Z89S|ON~TS*`vw*oY>Lz;y{aG2D zAU#tbH@pN=Bx@%EzKCejzbbO4F>qb(ucmj~5xjKfYc>b!%H^5i5tjDLTSE01`Mr@@L^fWFXN)ik4A;?{Dx@ z#TpdkFG=y^M~&e|6#(O71p9D$bRohw5w@Y1PS-=5wME_^iV=l;8O4|`hdId?F3Nwcj#iCNfl>})oD9D9;dN^n_;oGK2A64lqRdm?i&NOC*BLV(#or*-~Z7kKyN0?Gv zZ!Qm8J9`dG1vkIzOW194j`DfId<=6W#!EvFo)z<(>%LZ4CSx;|JT(rTVT15d@lpkH zEbx{58eRW_>tmF01<;g81r_&LSAw`E_012FPe?KC7)mlCSxUP{c7(8TODt1S>^JN+Nuz97AI0>vFl1Pxf@G)T3R`K zt8aK+d!%ZUxzv8-kUPFVd(KCvACrXI?<5~_(ug5uj?1jRH%&tg{b~~u!c@yod@Acr%{rWz2;kJWWh*^oq4T^F4zNjS+)>L_`SPJvBa8_P8(Y^9tE7 zbXh=JM>i#gFI1rp?0az!mR_?=EmYRBrEXsKcL)j}W}c8$wj#uYvFS86I}`1IwKDdn z?d<ST0PExO+FSIR6XJ} zD4%#ko$TH;S*Hw#R552ya&EG3o5k_pNG5!G0y2*Ed{ALn&N8+j>srxn1z4eg$H|T> zPD0y#IQ0W2Mp#wjmY2*{YTPQAq3wstUWvk1o&FP+wHdZvE=6TFzcKO#w#}dSEG#|z zNY@2tAK&zYCr1_M8TiQm3t;dX9JmGX`+u6mHBgj*GMVV~sebZ_KGYPraeS$FDQhCa z6q++p?h$DHWMn>(DJS|+=i2mhQv}v^O+Kli;mL0+K~5S?i*@;ETSO$(APda@Qz;uvHFSU zT;5ZCt5yb`SU^R_S^Jx8H)V|E$ z{U3P%KP&cZXx5Kd{wU+67Bw&Rs+jY&poQqdCV21Hta;Dsw~yWu`lXG(iitJw4(TGc z()%fN@!KYDZ@m3Kd+r(kE7!P#o0qwm7IR+%CWmH%Xa#$xs(teen$G6$^;qiIk^TJX5gWTz8AMwC*_>T zL7eVBLXC%XBH8K^y!Sh`%Ov>lo{VeD5spsvJDgNo1Zv=d=xrO%TaIhZDW0m#S?;zK^okcb zp?1?T1e~-N!|w;NP--{!<7x4`y&)HNc?sqLFJqy9J~vK=!Kmi3OFBz$F(Z8Kq1rOU z`H}!R_2Ty5X5x3&Hby=#G<93p@;$7NvnsBrDs!#N-Rc;t;hv~7vdVaS-wQdSm>aS? zZmnqc#8mI8N1j_uI;BkJr*zgRPVz%5>=y4m-pa2HW~s++rQ+IG$O&a5AMO}%|8%GF zHH$QmtR~WGi#1hZQ^Rt*LUZye{Vc~aFPa(O>~s7V8m|Db9kinRKR0ymBr-c>$jZ;l z&KvDkbRp7;KS@*UBQ}X?wRI3F1L0<>`i`S5gVV8rOrH_)>;yR(#9a!lV`XTv?O4P7k7AOSWaQYwRFp}JlU$wb<@{$$u10HR>Ve#yaxT`67cVwPs~jyMz<+F*w+8iz715cj5!QGx4e4 zrFDSt&YsfGV(SV%8NtR~a$}a>B1TmrgVB)Q!1-SSw06MQuYmW1*@vCewOgYhe^NS; z+o%xia(AIkcA!-ndLQ+cU%~&`H`fu9{$9UglU1!pt>ig|+yXwypHPar>zWGTu3hqx z-{WV)ztT1#hIv`K^Oi9-aFzEvE1a2Gjm2y8R^|0~+Zd~*N)NR7`l%>U=B@9EHS4g5g8Z|6^S-9B(~}Wy z2C-jsMI%|$2#a|n`4&}2DuV3&hu<9;3~nQvrPl_uXj};KyT&{-G3OJqe(cH4xWWZ; z?nP(7!X}WaQxFA1d4XDXENq1pJj%^*$_ z^An0u7Pc0PiDD4jnx~K$n~Cz?H)9j!EY7mMwzXo=!FNR^G+12*&ZWJkfzOg&ug%bQ;t1-L$nM&NlDb_cJ zD&ZUnj2W^&%K$A}t=5&Sh9A&vpS4?s%fxPcu65z87NKTL*I{OeiEx0JtlVbpT`myo zsx{SX3NE3E4Z^?t6ffET*$+=JA`eujRqzbEI?BAsrq7f0X=Teexm`CrdkZB}VXlCd z9%N)Qhx!B$?7;ZhFB8$%49?TER?GU0F*I6Y(Te?#`F*T<#blI8PBJnQGKZQfHw#zG zWPj!&;EGDlY+P=Ike54@=OFxkLgEwNK@EB@lhIfL$j?aYGvTmh!Vitw zH)eYwNk266hCiyUM~2%f=>y4`&BWU^t32tCuSh)nsTklTpArnFx@GsYU(@@9h&cEtPZH{v9uHL>@M8S6QT zPrsL`6~8gX8R`f_j`GlcunSE5NAr(JM^bd+s0z-U>-up;dd9j%&D@8r5srm)D%5$V zK0lsH{-@^l8 z`!MQg;H~+r(U@>}7ws%3TejX~0CXQGLGMrEg{c&W=}{?s$0|nC2c(rolnSG=mWSEW z348iFOzb&Cm||COSYlct>BFF4ZaiLjz6Y9hr5`DB4kcen9!x z@QQj(ExuF~WEH+9yPm7RhFP*;ZTXqW#u@8_fI99#+u2hIbo($pCxGz?2m6OT_@3xz zJ|JL#_Zh+n&}>(xFQV2)+~80%jx?N=2c2b_(A@Jupb4f8#x2U?v@Git$?=%%XU)vI z%t)HybJqK@--sX!OTg3mcG{f`abEI>^F^z;3mB;fJm5fghr4!rIHznoCp=*OQC3P2(w>%EmbXl1ROois{b#$ zg?i`ft^+`tl1}osrFxNE6PPo2dTzAgIAxanck9{kQ9;zlT=JA|-f16Gm-mLp$249| z9DnwRE<;Y#*@D6OYB7R`8g^+Q!A$?=ba*31sh&iCJ%M;$18&c=Y@qu1!fel^H> z;HUp^CZZXv-5qeyo^~fW#gDp7fD`Yhai6NrX=QhwJXQW0iDVk_{)wWuln69E-SrNh zpLSQ(Gz}B121&&AxqhtSkHhPL@4>k%<%1goDtHz84);5peCL)q9kZ^360Ho&a*>>{ z-S)Wsqg>l5!w=pnY&=Qc1)C=^gL z)$%aH^)05M(5cDF^A3c>;tWU|Qr5NVnQU0luyd<+yUfx9j0S&O4Bt7OPL_ z&1?E5azmM(w6pO1D|!|t>ir?-*_2DutI^ZBWeVmYtDWa;HC13aX?UCiYlW;tMOilc zMYirMoT(eL1*K%qqkA z5^2|6a6wf~l8~I`XdRlU-xWr4aGah{n=xUPqPpE4eGV?(9x(g|M9`~oYI38L+Q-KY z+K1MA3cpLKY2juZ@HWXVl z^13p24HlUtyv#v_S#t_gO8pZ&Y+X=YoXpOS?R=|m|4gLbZQ;x13nA{}X0y#T0zaNs zONsK)#>vf|Glc@-W;I8h_o#W~cLzaIb!IA^8lKn_^VL#pr9b~CrQ%&{=z^-`pU{o9 zg`9Jn9D(+3 z+d0DD%>7NQ@z;#r;8wSjC!G|g_DIbI;48i2Lm8n?)UmJoF;{mMxI5uiGS{*Mp7hk9 zLRz+0ZwiSERvx2M(o#&G>{>vY&r_J|*7n|+xpSHy?9#q&&<21Jk(n)SvMc;dBjm|$@OcoV;YxTGD`?0=i*R>fJ zn!&%D{ZXF;{k2-kZp8k&O)uJs-%%$9rPm*0ik(s7W+q!6%J;v79zHa5{^i(Ooe#~r z{j=111e}FlKS_ZD?uS>I`qDK5vM1nO^HY4?0a5RN;p!`JEeI@l;e~aT8Ove9}80s6K^oz1Fx?vyDA&BoFcE+&qTYS zWj_xNZ`?37-YLTHI+hnV$OlIdRWIJK@3Ce5M%lb#Ys0P_JZw1+TH6?`1jtgKfM_G3 z3PZdq^x@#{sW<3tm)wR*V({9wttcV-R<84soHuVG&adY7_$cEpt~ze2(ZVXHBw$Q5 z+T{9rcX_gh{^Nhpxhqv#l5W@OhX&eJQz30AX7p}sJ5}Np;a$OOmea;y^RHo~q|)&m zOV~O_QT6)AN_USEr)`G$EALRAq16`PDI?Pzw&7%|L4JzaeiIDSkfD!OHbfM^@n>7AqoHB$yNC*yxRfcDlfbJ=`i9Jwwaq!!( zur^(E5Zumq8kS(#|6n)Yh9noXjG~)+L;||*RNX7jY#9A8_*Uq*cCH7Tad6gjx0VY1 zMytY1&6nt)+h#V)?$s`J<^KWQ%5%Pnr#!e$Shm#<%fj4X4fEA)$a`Kl8_bpA(v@?E z;J$cKdyghOQx~-xlid7X&vI0>$l9v!UDkyV=BGOh^1uW|Trd5o1KxbXO?c<}J-KG7 zuIE2rt-;Fq_d;2sqqY06*#27De=2#HTP4b9Qz3chZRlIkuZ#1D-w&%*aY@dkjutrX zH*qLJCcPnxO*rtLH#F4S1Eg*$Q!ZlBCK*ZoY(a6Vb++ zSB6K`by(>RRsHlJY*n?p!5}V0^k2}w`J8cs7*cM<&Aw8tzjOO0{Z;|d{9c`*fWSS^ zjZb|+cYgjPRx^~RmET>b9rt7nUK!W^YqB4+{?Rw;WG()>@A@ZX@-wOAN*J&2iDjQe5*<&nE^mjiNjd zki?G3uWI;F)kZZ&#y6F>8Vn~ND^3_!%CS!mdI4Q zcCDD4Fr}F0Mi?+&P?}#th>N8e7LBImSLI5aLzlhc+)0EVNNgi zuti=Lkq0xQg&dWT4dxl^JwE2FpC@NN7bQO2evN{(by1!;f(tj z&tY*^M7r}$GUT8`+?*HPo{g0!HC;n7E8KQ1tFX*VWBqIcb7ljxr8A)U{S0RRLupQO z<9{p%7-_M%7QfWqh7Vb8=(Lb(L24+&@~CWN@c^R+$^(DxiX|g{0^>EJPgV920gcx>W*eI-T8&{A~7L zx(;DnjBCV!1dJhNyU1B$GT4U6Hh=%{Xm?7Krnxj^|XHK2B^mm2^FSqvPd92i(7V40K zPK|Te5cOoWm_v{u&TcvR#a$8c+cq1k-`F8=;d$FMGmnd6O7ZxWV2jxtBSA+{*9qft z?U8<$W%Pf3SuN=rI}AnCzFi};_WOgc2p;kr0l%ih?{}N&1SJ6E|9<=!cV)1XOBB@8%CRFyJb+x-hK?0F3-8kU}d%(xB&}@ zUJ}<^`We31PTSBbqC4o#73laG{${Ilvrj3NtEq&Uh@#pJklE7I^N($I($7+>5=L|s zU*Yq*>>V`?HByNPd#Uy=bb23A%;^Z5c~e@L3+81=SBw~$HA37w3ldyVgT)=1_U6>_ zVWcd9<)6g^ZOqjtEPT-RHB2Tl!KCiu4CBV%p#Ga&qa_yDhfP+5FHgASAI_Jza6D3- z&Wj>l5>^D757}hLN0stM18-L9uHevTV7GEyedR1=4MITzATHK{P^9B;+Yg#1OSM<9 z7XnIu(VIbWLsr&FYgb@t(O$Cph$$IhBS557{d0CV*I!^AFQ1?dQf&i|?UK%Pc4BWY zPh%(rb=$r)PQ}HnKkLXT)&wD==)Qhrrl;vWJsAI7)R@@-Hyiu>uLM2HU>@~s6G}xQ zeJ&fU#Kt?8XZ)dLZCmO@XXvU}jez~D$b2uRJ0t;oGyh}3F~{XB6Jnn;uKrD|zE!L% zk%mL>G7;izc)!7}g|uzxlUZ4*5K)cYb_`$rIuiR0*Eq$ukCOP3vXOJ? zOGJHi{2Gp_B4kIK=D%rS_mak@FqKNte~0hkoofW%7*x3uEp*y;VJ&{^M*iTx=^9<4 z3)2te>ULC&GYO@0qDTDaKKnJ;i{F0h6K!_`eDf&p-3Xj72|(Ej_;-G`X2>{`N^-CH zjp=>K@xsukbr)m2!gFl*PjuR!$0huXvB^UDJvEZ$%Yrb^xB~fxlw*Eg@1^b^Dc^-H zDgak!fOs8?htW@H-$N|d@b5pzc8CY1;Ww@XPMo)FAW*Y@-De(U+*k@%%HgfX9a>a50kDJ_a4^uND zA8ldVgJ$B$I#^m$1ofqOsP!hHz3sGQSm}j-g>RQ*<6o5rPs+kcnSa|61}TTjZVLrn`>pJr)=30 z+{WtfAhvz^Lf{K}b5eDs+pACpEO(aP?poAye_z<*thY0p(5|O-$i)cPQp!P(ns-Fv z7qSYe^K^6lM4-FE|B?Mq^N>K%{|M*BMut_XCtAy?-rkWwPrGFnK&!>D(+_ujvek3{ zJFFc}Oi375CEdR-A|=S2RUSx5TJIE2!CsOSda{F-Q}3|KiZuIC?*P1gH%@u359@oA zR=OoJdzenfw%+q3smrOX^O~nNA4B^rapBbZZ0a&)^|Xqw2o2s$Jn+BiE3~!k_Io?2 zO?HxAE{%6`_1_RSL>G3KCsx3bo9MpuJu`JWCqd4tEuc z@ru&1{kv7xyv5%Kozi~I_he%~=J9onWwE1oICcW()UM})I|1|Xg-+BKGckSf`aU3l z@K>Yt7Ic0Pa(>qNa&%Hc*)_`PvkRYFF^%5%quT}7b@qieB5c4k-T z!^%U%a%G?_YTM<$l|$8K;Fgv= z!=GMv)-`E!7=NsMwaq$o7zIA>(x4QbOurBHFHC-#+d7W1rpJu8bY`W^R>oCuZNVen zHHyEf8R11yv$Q)2Ku7+Xnz5D1PBb*cJ<0P@C}9vhDx^S?J)<&LQczViVw|SMnDrS# z@nUrSf+kQBbHRN%7ek>MX8~dJM-J1uWT~DzfITaQoWu~S!yi8ZeD+jBZkfZQaaTNB zORr_t_il%#BL4Q;i^;jbFHcOl*+cQs_SFR z?OEo9f#3`P|IbX9WYd!D5erhwkg2lCdhpHXDJ9y&VYPY-<7}oGcuSSoa1>o>q2-cF z*_#=oM_b&Nvj@3b89JUeuX@9XxS8X@p9y}dFV33C35nmVnCCgT)jJc=Ia+d* zc;D)rj-cgY#aQVW8L#X`#De*Jy+2=**${#dNqdd zNx?PuKn67x@K27-&-nIN*C$hYs?Ym39JRjn;0n~49-OR5|8mY3h2P9A{RC1+3Uyt< zp%0xE3m{oh2ccUjc84nZb{7OP7e zT)7xsxY%^Ka-qof0%~J1WEoPgKWD`oISWsG5VLk^pi`A|^P6VBP5WUfz`h@K*L7aL z?diy&V!v~D#mZ_7?rn-lt!+oq7USRDRzafbY7QwroY_%r5R1xr*?+!wfquUXzU4jr z;*=ifz4X#~v>z40LPgHmVfZ%^ zY%Jr&S><1d%7XM#t8V(oA1KOtZ{HY}^X9nCp^my4X~E_`)Y~D*d34hqkpQn7S7Ptz z%e;9TTcMJ8^3rTC)CFjcm!DTG#e)D_u5k}7%sghrEN;zKWw#VT0@I2i1aZ(C&TF$; zUMwm+sR`e*7;s;(QA-84e7Hr7uQ3aG7Rias8~}6}*g3J&2uUU^%<(3l?1v~V9zBN4 zdMF&E21`KVTuDCi3e*wjYT+{P={P;UP!qWKgI$yt5BrFL1=3i<^@6&QqB)%-hy9Cg z5h29&N{XU5q8tjhvey1Vm*TwUFld~)XKje&dRT?TTWWW3ub1DqCZ?G|gtCk3fUJ7p zp-f1>IFi$UgPqQ9w)?@YMcq;#gIt=XcF=*XbD>w4&xDs%g+1gBBz(e4XRG*SnkoT+ zS-%g=L)N+0#vSDOi~=d62k>DwjeZm>vurH=W_{wk6V`?(>vd)|yG;9h;4it}&Jg<@ zD7>LvQ12!p&$s`=7rL&r>?S7fJ_Zm+_7yQ7HDkR_eK)e&!Jq7g;Yzrl5%87_5Mpa$ zQ)|f>WjGY^zYsKeTXlw+P)_U==J8vm&{Wt1fF=P+|q3j@e~%vZz~vgI2Sk{HnOl%K0Z;QvFvR)!3{X8~x7U z?rlXRE?<5Op^_}TrFUUsy2ET@A9?p5Wk@HjvvPDRKB(WYT;~an&gjhlvRdp(DJ)sH zHqEnBD`DZFV2{Ad3SH^uT>&JPiacO0sGSJz(Z&xumEF{-+I3e-L~B=lM#FmVg^`rm zc2QSSzr+tx*c@SkM!;>5PS*Q)-7Gv0x3PoJRWmkPbL-Lk1_$p&y0|dKD12g8Kt1RE zE{m1efWIP9wwou8iA2k}^f9r0iGz>Bl0IE&5L*tv3D5SrzXyA}l*`;N?>N0$edd!w zuD65<<#0%MW#n(wQ>WxM{|H(JJ|`LWqjj7t++bynFi`Gn7E=~uuqlxg%14u*urQyj zToUNx(I9eH^Rd|Nu~}Z4!!0?QwI!8 zBuI-S5xJS>$MSgnJ18|$XIzKea0XJ*cM7k7j~@pJj&LWx!(j(iyrSM?M<^p7@*P#xOLk zveykvLbunU49D5dN|ua9x~K|0D;NBoE-zgV>;0W>tS4*U3Ch*C<&b$sx^2;=fx5Vt z9qsU0Riks=Wa)ANwONH`lq)GzJ{yeGA$h4VSW=&J81?yNno{I{gje!sa%TG$g6hT& z8OlYD7IxN3y`X?qE#IoV2$RQ&?M_Pm zKG=VL?UPEsv-3}22rCS>fv@=2u6LSCkFKsxWfM}+?sb=5%gD}+Xm;Li z+9v%=pZs?&3LiJH96`-XgESP`Ziczs^*#tQ9{TObz40upKq)mw_ax@W{rTHN?hTb6 z?v(4ORz<~pE=+1^UHmm7SINZdScdL1*GWm0+c|WlR^qgf^A!z8e)E-w0>{=ou#p3Yg zXt#t&`Wn!5>aYf|Rs(^8<_WuCYTQ|hi| z);xE0KjKx2-8r}Of1z15Bx=JNb%5rPxXmEVUoNPe?2+c0?}R$1rP~wG16L?VQ3&jb z$-=W&Hy2MKixhj68zWaavQWlrK)C?IA7k@@@89h!hcT9s1(eBX9?Fk;SM z)2dI$r#V{Wj`i6P=siW6M2os^zf1mdeB8pdr}mmtZ9P)}i1hg{=dTjsb=xLkMYiW= znQfq+Z#nXJ@FSNF8sHPmwMw@1#=)MYnQ`U&xifEIeLl5zWt)4%=tLofIvu3^Z2c`q zC;$7Azw4sA9Bf%Dvm$}6xqwQaa`^M7){Lcvl&jbv2CG6oxH*9hqeafwa{+2NRD>@# z=Q86S+>so`oIbNb9x)#DU)4I-Dznhr+QBVjZ9|!k)v}ARrj*v6%P^Nagd{nsW>2@` zu02i!CyoH!qOUOSo9>8Dfp@M-6EP;h@KkTh!d8beM{7OkB!M+&s7YXGEaGB;n3 z=0h?sKR%ICJkQY^3}~HsvA>6@oOTgsk9Qxn+53VgIg(3ks5ZyG^qYL8%r^iR z8YedNM!B|bFKb0Q%VfR($E{AZ=ABwKV(b&|UD!M$BpdE%^3%jLpzBLG=NzI@&z zbMhq1V>;k%7^1W-<)Q=&`<}TrtR~tOjNB@53-fywT`AY92s?2C#||=rR@LgeW=>k63mKu zvLb-GrF=G(6BH2wC3FWU)Alf?4!2Pfs=Sb6|T+YsqZ4`sNmeY9`}4E&rU6>@`SJu zPKh`J{^F0q7BQ*V#0NE@K0Yt)dq}=@0$|8@7EvcDNn&{+^+Dl<&L6TqB_kfaeuFapCeCadXkXM$TotE$f`K zWl&~*LGYTY9r&f$Y(%sD+Ckv&j!!8I+A^kDPG`B+!a}WDW_HJtJ{G%0UI=p&R3mMp z=UKSYM0ZQaAE|mKcueBYCfUOl4>#J^*f^kq?OXRvsT%<|?idgrNJ|?-{xW?K4mc-R{K4KWVdGK@=dSFeQk4?i;HP=Mwcjolu z%FbooDI$Pn1Q|G8urV!KT~Nv06iaGJVCGlw!=%wNmr2{US%cAVfyy1zD6*+(XT;;b z&6ai*e^sZ;qnhSlyj+~LozD=Rc=9Pga-kZ6Ecd&?+#$vYL>l z0{!)_?_$fXWKBOWGoQmHENbn#?#c10r%<~UdRA2bQh#*Rqrz*2>NBJ34{s%tx~)I_ z<=;oG{mUvrw-4moABu929S;msuKCtP)pu+!Ba29;X#lsJadc}Xq59$_u1=zN`k^Q0 zao^hhKe=CNI@{NJ+mGyiYT_s{;CAJ&j|BdYWms*QS%Thg^r?Lhr<#xKi5e-A6VLcU zZ7#7jX(ciIDR#?*uv>xjyO4yWiLk+-+iVenuhQ^;WAFk%IoDLc(jx4t66cS9s* zur?jCnr&v0#Bo|GLoGE#D~Vv4bM3(-u4Kv;$v9b_6()Xbv6~I#Q6>lr1{uMT8aeX4 zU<8$^2nEi(={IUA9)_gOXil*5_lDUBNR!qmPQkP|5=fwL4ev!8l4lX18=v_~adO|X zOJHJzoZ#v513T&3S@_0@Y0#yzfxPFMW*_1`ieOZ8kVQq%Yfy86HwjBoU8FS|Y3P@6 z6Pon;)y7E2x*|k3pW6QENDIiC05TqX*_Tx`Gq!BDN#u>2(9<^4i&aSen+JB!tKf-{ zBS4W?dwHBxk$<7paBx=@i^J#KzxQW{?kOnQ6Y-u2G3X*J(pM6~%Fzfal{B*HQb)qs zOVWV2ebGJvt-&A3@^D?>L@DMrSO`& zd~A2ybiWW(!Xb5?22A`-$tXdugcPNOd9i}dT1ZmU&DcNDAx9FI1&6%B;m+_c7F`)a zsg=;cJW4cKBpZQcia&H{KdSi<$W>A9N!>4**r=+EY$x4vKrje_*`pMW z^AAh{aT_#y^Ef#9UvyE14LB4sO!#b3vCDXDTqf_nL)z<}UaAdDBTgX$8$WQY+_$!C zdN9uJpGJ4(+gO@35!!~|%mrpsSYSdw#x*a!woG~;Owaj`UoCZ7#Ec7|f(Jc$Y;dKE z

gkC4!qZ$>I+65>D<$_Mez-iqNjs+z&Z6qBwhWx~x3WLNVqi0P3VjLC5g~3LT$M zQ1FaK=V6fR{n9ER;oyjJ=m>^5ziE;q z&GHrRu!?4cS{p_+3?uNQ;&am#YOjppmrJxv6?vm9ptph*%Oho*9JqUPr2C@iYdKu; zYR++pA|lh1G(s_zc=8byeoxj5 zth-dD8=d)?OTXTTUDZ5VE*STi&sPoBrIC!xlOuN{RQs}*;@_`U?P%Jvnz83Oy>KTf>?)^eHII6*?n0+2k8R8B z!%^+0hBIr|FPw1PKz{unOW>20P*3>OKk*Y>%J-I}9@=J4c;()cYnh&(Xz^cW9JxVb zV>|WcM_aaAvm*Sj&IdF*?Oe{jt+Q?bY-c3f{9+P5!I3lIU+4i1kf;TQA%w>~x%oEsD|2g)elpB`)wr3^qr%;| zC3qlOl<>0p8%UZddB)|BPXV*=vlEk^zfHB^W^hh*t-^pANrr8k%w>)Of3Cm_Ep*OY z84FkOzS;=mY}mF;+*SEq=aK^3HVDtinl1jOBPX!a#jITVX6zK;P+f(jEx&mR7>A#;k8!%~tDq8?4bGbd2TzXip^7L=}JUS5g*jA)= zR?rD%TqG77VrRfK&Q!;;||EwH?ftY{HrQ@#PHCK z;As04^3>>tA|9L-Fkc|gnY>UkP8_uDv{49JuW;+Fnw17W)sd2e7)Gqi?ArTj5Yq>!18Rv!r5#HEYYs z4ZGKG16=i0EWcg7pXh@ort7G4LmjvP z<~U$ZK|zr^TUyoaS|8D#L$H-9+CUW@%t*1Q@F}tGbr=F_+T9JItKhu*dtEpy>?Jj6u=26-AoTWx}nSB#KiC8e*9Wuw6(1- zcj`Y=p1n%YH0|_W=vZ4B`5#N;gLg=j$#rRU#Xz=dQEa4%|eNTQy_-iN9SK>&whELg9rcoc6NLAPV0vO z^Z@kNSG(yUw@WTKTaTKR|FNXF(?dHQ$8zNu56-D3E&u*k*tq}eHty(OLB+4=q&3m6 z53E*J>MG=Jo^KDP6efqSR0g`pdlcmeuY#ao|1c{`H6PM849`c|F9X{NF0H7sHrjeb z!}cA?D3wCHVmv=LK=q5KcohC+uYG^#yR2F0yS0O{fg7W=_Lm_H$vpy@7^sl&P1YkK z+4+!N2Mh03d$QSw_ZXSzdAOt17Vyhf(0N;PC5!4oZ;YEK_yEzSO)r40`gaQlR|b6# zZZ@aae<`%AyGHL?l&5i1!9NriOkmp_`Lbq;Zj z2L@M_K)HkOpOyo?l1gY*9>!4KR6#v$l}uEVjsA;7b1xsvCDF$9bjgkx8I(zo;9wSV zY2(_+0H|_Yab$(`0{=7Nk%Kkw%QBiYT@4aLn*7Xbd4S@7e^lG7aHv#|X*6~>8TP(w zT?t)icf+(1>fm_t+b)YW9AI#Q?}TR;qV^2*joSKVVlbHa+z~|^_|bQ z21|MB{ovP3g9EG257DIPa%;eClc#)pyYA{EOG$n;k?PKm{9S+tC5_t)KXOYkPmhnS zbb@MDd#;}RCyw5vY+VxfkdZpD_8uJnf=T{`+W83F&wN@u*YgP)Fr?gLG)Jv;gWhHze;0d%xUkF)9YB z!7t=brk3Y2#;_|~}F`yv>P}dUA zWynT!unusulw%qekKP#892BBv_&)EptXspCW(bru%Cs1Jv%Xg9vgd*$=QLi}2({P2 zK}?uzukWVRHBn9rGw?WDT*@~)36{_0dY8>~c{o$sO5B8qt|4xf3(I_JwBh7E*iRp_ z2Bel>lAknna6oyh&dX+NS2$aYb5hQ5D^Y3L!6(l?YlhI}zS)xt#=t@I<$y1yB2CF1 z>|n|ADNLm6`Wz$md$eXv#ih zp-Cd|x3J)19%bw-J9I#V{CzdYMxh^K$Bk^rd*tcAnT0^~Q0?a%xq| z9@25OhOJ|VQh1LEYyh#9Ur#JLMR(5Xnt(o3y@#-ZdVk6qX{s3cy@ChZ0U+a+_vhq} zYG0deNX@{b|INArn83AU8M?gQh4)L;HtP-SAL>$}n~k+;yc7AU+1`31(fV>DhpOFE zzCl`Lauhvq56Z2kxfWgYDYVG?y$G5-jNoxJTYqCKQev>>6=s9Jh4V@%M|%4_`iVB)D(fXMF(Lm@4kbXECf|lWQD*U}@wH|bHkBQ8yRgh` z-?aSSX>X~-bL*9|dc6w-c2gCh^!28sWe)WWaS_-r`F{pJb-o+;GC2FqEJ%8_ci^mS z-I}C={7#GA+8DQ5#(i4sO_1>!949tzl%XzeJkFArbj-Atyb8`KA}8%60=1loPVrCf z63RnhJd1Wnj+{j?j`x+?iiCx#TkFN=&#E#Y?@h7148@4_Qus*;EQ*Ic8W2U{fEpkG zN|TNUBD;1RLb|L5DSHAPfBUciV(9oyYEq3xBvz3a*)iujpb49_X)~@6dSYM4 zX5nJLI5k;hCcXT_H*~_^PgUHlL@tTi0Y$eg4cO43NSQh#Y<>#?(v|fZ)*PM9;v;(V zm`okZ23w6zXRd*G%%Os&fDX0yt1^2=5>G6O0I(m@XaY5w7@VX?jVfP=w;fou%gbc3 zgatCRt-+7W-K!tt*dlM{c1YjM=@oKl1P7+0VFM89<}_R`%s|KpfrQ03COp0WsDDi8 zdL&RT4~RHUtwO}6(A|xfL9mS+b`55VU0%|y79LB~!~%2Jsjw0%9?#F>)Ue6pb{+!DeUt+e}9XqJ(m5F-3bPX zIml;1M7$~TbH|rqSO-PoLhPMxXA>!3YigKRc05FUI2`N z;w^cK>j_0cj8vLU7Q5v9*COc__IZ$~5tpVA_#<;9t#Uh!>oN1W^aI~l_fDjkaR{Io zr6-P#bJBM<{FfDmO65e4QqQg2=GR?3?zwr?P~!hPNQD9v`HvT?yU_me(6BGpd+5ac za|(-zZS7xRPj|`5UDUMmdwM`IKpNZr?Y6>Ps-0WKpN~Bz;=8uj4;B_YDystE@Dk>b ztjH&o*E-jjBUpx?=IXd54OQl}!;!xSWmU4uFB^cn&LNI%8TYOGyvfw1S&R7%R+Wum z;V`L`raeqW<%Lx-x@h!>K6w@}L%`B<93u^-eNgrg+aN+dY>1Kyxr2BxRL9(h-YeO0 zUOb~A6#Ki=Veq`X6bO{$)Do2ibgNzRr`P_%6X}(g#=%@CIznpaR&boF65L|E_WBr~TLDn*UWarteb~vx ze}Hq!t-|W=N3ThtZ_cI_gZmG9HWor$&Z^4+WRO0SJs;7>kZ1Gvul;h_NCq4$Q<-&d z0FhQ%Jp*$~U!pZeXfuyGj^#d@qDlkS&$!Rwzs%WowaEk9I>I?V@bMm1&8tay-`aK$ zE6Co$wdN-0fNHw|Q=079%P>l0`GWU2et zJ%;Uwb6W)B^WO!0W8hXpM^kME04@qXOBTgKruy(3MvF-Xs9PhkI!R7T9U5bS!^JL= z%MmjSwdrSlLk80h?-w$(j+N(c^WPd%+vu0PjOp1VpW8C^g;p#tl`LAPmiwSYXS^JH zjE!dBJ5BWo)9* zT~qPmN%FYsZ8SJ>{3kL<(^iF6)rGKLv9xb!@o<1rCo**Np$xl?uw+JfZe(~*5M@0z z>YLTvQbhyHo$pB?(yjD857(3n-f)jQ_}N3((#|O^%9lBPTQYsi6n@)YB4&e$qMa3F z11w_=9O^Gz@HK&}>HF%7!t;jDubBGN`W86u9jW7`K$X6pvHk)|4o}e97tK z!yg5)e3a(DFxo3nrvN73`*FWlG}#F+^-BSG-*$u)FYPU=y|WEI^P`e!yV8lM5tV9c zonA#|sHcdPc?VvnSLGzT1JVgUmFl*_1==nl*R^}=;E_m_zE8yD_ZIh$RQkc{@@tVd zbMTj9&|K$3w5;lE#=`#Q3*l;;fJea6>SejW3mq{JALz~cA3x;J3K+%D{kwJA4|}1$ z&FpCz`o*08wxzsPpOrm1u(8cV$LSvY5_xtKW2T4HQ>s@Vfktem6NfDk-at>Y=MDVW zvHw~^cik24XF9WTn{T;DUPlb?PTx|DTdF)3wzt~7szDjG-rm#>xRMa|>rUErL7S+! zHtzD0uk;wzQ^d)YD*uGFmKL~G8lvGFwj<=!bS0YKk2X*(A+#*2uGQkx*}v+zQi28t-cR;m|4<_x-@WZ`o*%c*WyyoaOp|%7fC_3maM}rDuey&7^bUDbn}|w z+T}W}Z&}qX(OF+#6pAmNymVeY_&c=lviN$~_g3iZQ~3AN^UJ(X9-EL_(^lteT!Vwj zSw+FsPrBPPd|rf#tvwXbhnu}jIkhU&FU6hHoD`=z)Om>R-`V$6b=vJ7-7OTkei7X> zN^5CpZlQ~wGKsdur}>U6TS}04|IHc^w51l zhh4ySy_+V}+;7BX5k?$LqcnB!ebc<3ct%m#lA-X$S7q9rmGg2p)+?pKGFvLM3p&5B)BHi_gw=G;MbC}YfS@VPVF`rRo=Ike9VYTf*ux9PBmamymuPzb!w# zTkl6sGNp-80Y8;n9Etmp1K+r#LXe`yhmQ%QlRKoB{^NJip#v?Xm@J>Bj_CFW_dSme z?#XzHUmW}KkNoZ$s%VqCXJ_x&^5LAMYVyhAkNAKRd{*!4OKMBt{R^&r3lpvThMpc< zsLCvn{H{|bCuAQg-1;Ecv&v=B<lyv!A*>VF z9SZO$x%%K&%R;NP2-QHLp{3WRK{;c;}1=(sFR! z8I3j(Cu3TNsqnVjxDsD55@sYs!7BcgrAsN>3n!)U&L*qps0ystds7Z!;OG9V@XpTGWDqAMSgPdk z+3ydB<{OJUr;}Gwch2yw*F94t60ntvFK>!VrE3Q5S?W14Ni+ujteflPF6xSosLJ+F z`OrW8_D%XFnU3L?#o*qMeN&NSCXLif$`=G!j6gm}f@)&oc}$7eY&xN2v+hZs&wuqy zl$Qm&!h@$=u`x@}=ZzO7J;55g%%_(iud>l}a+)a8Kcok4Kigp_$|YxQYvtz~3Qnv_ z&|OcR&UA2zmt6}`Q0nQ|h|LI>7n96hqLxeavoR4a(uGnPH{DwoZPc%8fYl}VPoMJD zs~9uScBls!fEe^A>HU9??mwD!m04dB`bY1K)&8C#*Sj;!9$>a(f$)Nc8u4-Z=*V^X zB=c4yTE6ycdv7sSL}1()zrO7bMo3~}!${sGUy);;&g2p(`3_qf3|Vf5u=JrsxZvp2 z0&4$4U82Gh#8I^g<(auWq;`G<>F2J1C)&2x(WZGa?U8FSH?N+9% zqR}t>;_n*boI@>5=gSR4Wxc4j*PA=8fJK(-Nj%!{7B1K8DE$~BW$I!m*frVOj2ZTp z7;JwEPdd)_@(tS2Pm-?Na{vwzty#S9RbheVka5L_mlGu;sIQWPtwuMdkTLq8B zTY4f{e1Sk%A>N=efpaNcQ$YtTBr%k3y+~qL-nQXBs^%j^V=K6_aP0TX;$F^uEK@LM z`5#Npvq;%)|21&X>)3?=)SjKR1?0!_wwVHqIk~Dth$?zw8nb0ZIOgFdCWTrRg0y{S z@Vt$aik1ctsp$-s@|T+Y7yl{3@7rA3w$$cf!Ac-3Y+n>>GQSw_LjPnqv7e6ZI>dz% zYQJ}aakptTmJWxO8o-I!@oa!wfSVqQq&DHr0xwdG#+cN;6BOIxCkSp^g1H3{iUS)> zlZC&37M1DJfnRZ4X{2TLT_PU!2!J$3x7TlhJa=8#UXoPVMrPq_3s2NF&xQ!0BUY>c zN*0Pvh7~^F~h%B8iD8d5W?ko1uR^zP-)8S%_H$?9oz}~=k9!D}PgH$$*{!B`EB=sx$4%;@eN(DO?Np~e`%42iyd1Mp% zM}u8NdRE}f$oC$1&=VopR3`7SY<^RRbE8HY+SxZSIDVHIy!0#k-ZF#ESuQ%U{e2*A zQ4&;OtyUq-GW7R#liLN43f*Vx>O+1x_NT-M$Fl5&|#!bdI@MG=uM-`{@!d+g!C z#{0a^InSduDz3H7P{^IYxsrJw)QZAA(1sqswYGuvczfe?JdWB$5z*dKICC_9|Q|C6`hNXVL z8CRk0p!xcR+cYD*sUYG#pNkt8T+J>5LVcSRdCup?ge1_pJi7)_#Ek&!auZ@nAOECI z_2t3Mtm-~+5hNjXPyjii@_f_P9Q8 zwDuX_e8c_t(vjeTemYJRxe^MzYOCd|8Xed>ALUinv@-W}8 ztYr*8?eWKodvvykQRH#md2I&nK8bDUd=Doz#=c|!hAnpf5j4pou{6P^FR3^;&0-t3 zM||VVbas_IBELH}AH_-{X!W+G+h+)5ei=;5b+`Q;yHZ+|wIkT?{ZjRGPrFO-Jon{7 z2Sv|d;40{iJD2zzO1g?Qk6Q)XBIR0LjHPI`dL}k;#MY)~)#1+`YFeQ2^ZZ(C^8eff zLsftqzU@CR1op@xK1df;)V)*L^o6|S`N`0NKRyXGM2u;q*o_@|8V;yawITMI$Zpnj zrHxb*+W^el9~>MwC=p+?tP)-m@^X}*m0@FMW}UISk>xDdXJKE++I_BGTYP`*@-Sc?+jgdc>nFeET=>(1_J}n`DZ$a^()ZLL(bI^FZdVx$HtchBpeE_)=RCbzZTYL0^TqmJy$Z6o}ri(cyB#`C)qh0CkeXw_~P{3Re&TUyAXecvE<=(dd( zoqs)Ax<0ZrE{k5Qa4xClg_M@vMXw}8qRlTqV26>e%38Mp(}_1GWjIbg4nrt5L&lEY z9C%ywLno&jjH_t81YSU3-Olkx%(p!A|J-H82R9orjD2t0>wB+15-Rs@kP+HZ316-Q z13DKP+NR|t^n3?ITN#F5?^Lu2BbkYHg~3TwRnCZcXuXQ(G7| zGqSW=%vdJJp5<_v6FWRbo@qX3d;e}YNAqm_Cz$NQ*-vF|CJ-iN7M1-^j$DgFeEaJV zcQjRfqw^qGV$&Bnra7r*_B`P8r>y-jrluJyV7QsjMva)t4ltgemBgntuyQ{rEU5dEq-L8r$hK6Z{3^; zp3wU`oh3cWxD{6t7u2cn>5GDx%wuP_eJ3IN8^Zqr4`2N@DYA5n^f{?ft_3?9H8hrs zthC2)L*q3{zJMn?N|Vh;F~Pml|CAbk-Lfq&gW{wgUYv?s46UFE7TzxU+q!deIf1gm zN>t}uVEhRy99@C>;B@n4QZ;+K-MZc5K>NYl`cB6ZDkVnrB@5mpH(#YY?);gRS%ksb?L;W&59v{^0DbOHua!;i=YFV9Mv9XH2nA?A})cjV|kgM`?eo z4g*#Kgo|w4l^URSfVIxMpQOinB^6IlHx&{`IItB}#bO`V_}XKjX`dZJ@{_OdC-=~^ zOt-bMq#7n=tljB?e_EFJE?m@Xv~h`MdR_QO!h;X|53Mhq7mBhq`D&WsgrS{5wMoyVOb-5%r**~DpPP(S`^of$g z-k({MaX~nW14BJacPoH<$Fn~`>UvuJAmZ7Kul5GP=h>&c=SqccXSXypLjPK=JU6Y6 zxD5Z1%h~^UbmzngCEHI|3)g;?KmD<=cBe+7E`CxqZU|3a@pgvVTYv56Nz``jH>X_N z4Wz_E$m@_MKL2Sz#;nBL#<{R>y7^%H{rL`4oz_!yW06c~rr-do-!cW0+d>rVQt<9;<|GLO zeiuxnDp$dV^(p?v@5GNup~0ufy|M7Zgji0hzGzncrTAiy5)vXxD_sG-tezc)jHsty z9w)O7>n#!69GsF~KEQ3I7_iP+H94U{4#owYeQzK(>YZ^-YppsTj6A+aR|{tkH96Yq zc5qCa7Dp9D7Y%0+4>?5r-Vg15bY-dDJuWM=(KyFgN8_+!ad|aBS0nQhcHQ<9RQx7+ z;0>Zz8_kuy>4vRb)v~Cu5>&b*JQGAN5}ENQHx;f})meFz^5{u)>rm_&DWiP-F*%^F z6r2-)f;h%EQL2~Z{C70g2}pJg7~NxN%nUj>zK|4g<&4{;6^Exc^Sa4H?YKx_&I{(y zs#w~a0oeyLsXQkTI#wWR^DF)9iq(ttA;4!>FrmonWa#l{Ez8t!spz>njO0mn!W~YLs9D@P0Whfg0 zvC;esS#YstXs906kgt-ivWZYbJw#e$kGI7~Vwyo&UnmrpPUN_7|aCm`KulvH5} zf898QO1eU;u?<05Zt}_6t3_4nrj-cU7eM8Uh1@j+*5k;1TI4nhf2!>qLn%<&_KlH( zm}piv8pYzP*4}Q^U5y+Q1q0on{jfmpp#mq2K3H>-yh-U1-TAsOTIUH^kaL*8)FXDbk-&TeYQGLkbxeO!B=Cj3%3~@28)d7iL?SpA zh6^ix>6fg;r#y48y-n|roIED zU8}*CrS1a;>TxF%8ec7gPyt`kHg0#dm1W4=UaygCe^gMZW~OVM5#7N6@bv4Xj=Tce z+#|-quDL0vED3{;!wdz;6N-(<{CfQm5o;_feMZF@8N*mSDgf!WYN&axKvJ^)*q~}u zseRE%Rc-?qkTo( zM*73v%;8+C>`sxJ;|DOqEwDCZjKs&G&xvXh+ZId4jHg$Dw#BE>)oDRM0)bebXVR3H zR&W{=1PTY5UP^<8G?0(|7T>+~Q34B@Yny1gb&_#cc72XtK?!mtRDujF1bbI^7hXhS_@zt7cb>gBEzLGAJAB=a^q6~QRWgt@f0J$#71R|n4tK<0ay8(-5~F|X8nXh+ zv&W#&u8<99VXPD~z7}hF?n`wt9hO}_pfOj_LEG69f0?~Ny~CH%q{Vn!r%xx?;88Af_0^ zh4ztWgg=h7NgHr($9h4_8{%S_xS7GIqat}-&Z2`+BgdoHBCSf#Mb8Gu;W4bw@ ztzHYoBQi{dG=MTjoiMfJ{C`3xc!a?A}>0#ofr+>sXfWD(uBb1M;gd@+7{B?O;=f<@Z#>4jLnAQ z!AN=L9ha(;)pqW(+A?LQ(VIe(Y@1r!6+aY17w0X!Dfa$O`a8{RN6GgOICHEadwrvu zPR_kjTlcI<3yy~JfKk%Os?*6vKcuZ^X+*6t_Gf)zd+3e7NEasae_Xo5HUkR4AJH4$ zwA&u4@)D0PS$tZ_LI0_f3{i=Yc;j?#!hb`&hBbTg3_lHP!K>1LZOM3EPU?A)-eTO- z2KnCn}LUxJec+2>(CGxfGwOt_9s`1Ufb&j1zSHc=r8c~>aU!>qIh|E;sg^N<|Xg<@)$^OtTr#Dp=6 za|d(d3dK$&kt2R~e0Z`2?_ym)fc9;spH|o7mH=3un`-(8!1Tj0wY7?(+3m#*xQ=0;^S7+zsVz#H;=+hXQ!SANp`K%` zPpwU-8#)!>G-!ld$mKgkg)1(LSEFj&o9pO4NL^|{5y8%z`yn4UsKA@#Jd=U zCNQ$jsDzcx+}e-U_G6^X6;MO^DRrZrt(qJ5=r(`c)MG(Os$(0nB{lD%Xe z)O6A|GQW9xF05e!>i2Z?a(^6T@rRzPuAbdRm(eyiztW_;7=dAA&;(38HAhr4z$fDrK5`Cfxak&jMPH?{xzpZ`we4?nu2{b>1?=e@p8 z*Qxc}r*|l0f-l>)F=N(O{Hi&Kij1*|jL~)0r;KE$??Q#T1Tf#5L}A_V3vt#JW;)p=5EA$%brx@A~e^(t9kt*gnt2gnrQ{HQhIKxqgXy*uy!^U-N(uG5Z-l0C&Lr0FuPZu| zK#HGK@~rs&e*NKbuIqS>%}enNH>DL#aQA3(`LKM~gtdqCh(u{1R|kh1+?og(1D7~?7SP?HC1v^p;S zt%JfCe9|*S!6w3vCfaXc-$SLtsRt5e zh`6@1Z>25G>o01d+{C|j*5jt-h;l{s_V`Q(+hH8?_}cgw#lxY}$|jCHxDONZ9gd7W z8wAaSsGbi?D-cV`luB_-LJ!I>l=O1{adDg@_zN=$g^QeB#>zB%fMD-Flvhue#lA@= zzmQOJ7um3&qo5(hy|BqGj7fta;vH~`tkf~#XsxoAz1_{r!CYHZpLeIJTm}QQ(N#kI zJiqAPzg^>xsW{F7EzBU?;yJ50?>iwquC3x638WPKr%=CWj@By&C9mY@TA=h1D)D{U zy9Km3+5d4}S3qlV$aoqIk}n?16yq_f&H-;D%y@CYSr5od%kVY(L48NHGjUr8Cud-4 zwF(ui=q?bXrzfpu?+KiWltabC@?IlGDVz81k#x&*`ulo9IghUV$@JQ# zhy40*E>jZ0Hz;gb!V#;`b79?bVASoeyt37LP2B>B${^wKLiSp2^1?c^qkN7l7W`6x z@4o?ongh#{x}#FfN(gqhY-IRitL1iGMUpFAg*kS=l<-jTi1Y__?D4Rtt z$gUHG@4O2UJ!-`;aLH{ zX}+y2X+05ll_(4M7FzOknuOL8xfjqfNtsN$E4M1uY94uPh7e=>xf^;>YVL(79e1qK&pHoZipm_t0m;Fn%BB2KTP(kIk7t&SOmrlI$)}+cFXtV|W{A2;) z6Dg>jmP!;_)U1Rh70S(>t&yw#gJOYSqVqQ`Ui!A90)=&?iD@qVa4RdSCGT;ox_~7A zmu~XFm#gvhw(Ooue6Esi1GbTUTR=C-ltRWRmy_TeEeR_!l))#V;#88buco@;5)?yF z87j|(a^_paul)w3Am&a%?KPRkhcyuK$~Qo364(%VxZ|qqQO?5$fhxJ^18fGV)m(48 z`47}yIfp70xrgQ;u8k7I{tA-$c@i4-Q|On0V7>E2ntH=ft%%9|Cf!73x(w|f9UWwr zeL%WC1{FoDS?}AoxhVp+ev3oyfT}5ABpf|NZ{!KNHH_b8@~M&nf0KE`-{yCpRHlZ? zA=t82yrNG0fnGvkRvu}A-Ckj%sp_$5C?R3R2k~`sx5<4QCmRy?ZFI#Rms3pb!}k>g z&QGp!!hCX!z)_l?qi1S-6q{v5D2^Ug4P^V5A>EqO=ca

1wbW}AN|VoDggt&VoU&(Axk+aLILS`k_+Nu9-&a1h}%MIHw=|B6NuT-6SM z9wbP~-)vs4+{Mc6KQ3CUq~iu~(dLCX?PMa=E8OYor}%X3Oj!YC+Mbz@Hbs$#^FI!q zlc2-V^WCc*k{RH(*VXSgoTcu-d1u;X!<|l>UwkNET$m_O`8 z1NOr5uf5(|+k;HE>!MYO8GeF?DT80%>V=)}_ zUZ*c;WOj@PZ@r`!kaXfgg{6O7FbNr)agwKRtC~2*pZ3E-D8^+hz=?FaS`+^e8p^*| zh;5vXkJB$MYNwuA^UoC%$LLlsLYZ+?M2@DjV#`h7EI4M8d)*nZDwz5Hu$X6jw#QJ( zHw%1<#uM}l9mwe{o9;`}7QIpfFtcD!iOSvDx?%9di&P(zv1yP57{%eJY(^+dDq}0w z92ExA5qHbWqjsziv-EJ!TJe)&bg@@MBCR4T_t>?BNLbnpHNbDj;4AZ0XEKuldp&V* zUek*asjn4!DeU}an|Hc<$}9OG9{wQe*ylHWD)CY8XsJFHL#*i{mbK7)c^b((>HJQpnc7-8hm~3(Tc<{fc*)qv=v1Wksib|kbVi5!g!7@pfyy;Z*kT6t1V3)sX_Si-2wRBNJc0E?y5$weoXk{=;(xG0<~lGYL*>fMw4n}VJKcOcZLem7i^XO6mHb}pAnS`tIOM@gCK@4O79GgNPf@xNOdNWQE z_++=7^F)3s)0WxR8WTofX7P{XxWbHt?2$B2!8(opqOryfL-~9CtT^t>i(rLkHVL#& z)Lr$yK}}r>ry{33k_huwmc547ehD^xvqHIRgB;HfJ_;89+GwYl6QcOK5DCqnDwR-r zV7d^Sc2wREy}_27{MG>rMV9Dxc(rTTBHiWv5w!WS)zpyAE3L{)lbV<~?=DA?l&84l z6?A+Mr2OKxnO3L9gkg2=hU;jHV8~+L72q@Qzn*_#gWSTJJp5uw&_9F5fwJk^QHx2} zc?LB_kYQ+(jd}hd^nGP|GIiWhadoAgyP+4Bd=siTWOKC<`GOBDrARRQ45vk#wl zv2hOkMWX>627|b-_d!|)*E*do^ZqUO+)}F0*0j69I7s07iiTL4jCT5{5TmM}519L( zLWjeY0HRWIRa>}NVW4S7IO_g3CPt2G ziL^`S(X$^VI}qei9IY)r6sWx8oE~dG?PKK~bjvL`RQ}wTs`i?sCO#gr3qv|MDdH3K z(s~H$Aqk=^#R&GAuzZIO>oV?H$O}HRmLYb7I{PlazivxXBttFrRf=?Q3-+l^qzY$= zGQXvFu2QabRH1b*OM#uZldj++cEQ7;wg(BvWx}=6*;9lAZxDk6y2s8Tg!rwC*^-_0 z6vcufFqEhokyQbKNN5;qQRa@yz`wrPMl0m{^L*d~=4v9N*y?MNIi`F^=dLTVIa|ig zH#yhDLNIV;*Go@MX{0To5kUL@qHP(n;8r8Yxxhvl&o;Qe*!$M9HoM~qJFs31hl-Eo zR26U4D=A5*(flgCJ$r7nI-lPkakj3GvMyp%l9Y%!%UP~JY9srm+Pu&;tWOnyB8voZ zI%!%WP!Kou2#;jHVhVS15%6Q7jTNoV(_a4hFH>D zZ9PyCGNmEIBs(j(4C+x9mN1orBl@Hu&a7@JeXN{&Rg?9 z`K*BCWAj8Pt_xi!u}k1RU^5!2A7^-WQztO$%Mrcv;TFx-`o?JF@%vHo zQzMz370j8d@{}k>YR*c>wtUneSD2AEGN*6mvf|li=)mHv_G3Af?`*b)Yw2BM3j2c> zLv1RLjWFGS`}QHN=4)DjL2k6>o@oJezPXx&Dp7s0I#t4*`_Z%XgAR)OY_uCLTGMjBjnRn;tY_Jj5{3U^o>dOc zx;X916gZhQ8HERj_`*0pEnuFg>DUeVLC4@Gu=@_?;RgXsyC;bE01tQ1h&m4Z_3F^V ztAki3_(CFLcs9Sv4;9>r$i6%J?x1K(Dd$N$dR3wYZ9vvtO}@dN&ke?@lG-w5%J$|YC*okOgEee#yG$K1?1b+MfbrEfvPoi`U-hCZhj zmB>{FG_xaafx*@``eR$(fgLSEE{;NVC!%v+5-5YE=4`T=?M;Pof1n+v%TX(x&WKoO zGxy0hSPEp+9Y%dNI6%lP5<)gE>}qu5pTf+fzBIv<=t2-hp(dj=f8s;y-L>Ux#x(v>@KjX1!kO z5$u<&$FsGo8vE2Y?8;^!fLosldD2|o8tw(z&#|(%b1_Rw5BBS9I0x9Xgkb8bboJ#q zwraAl4q8QhFgdt~S7oJyz})N=`=wC(qG|7(-WlaEfvEaH8C39*6h;bBOQcsS#hXq9 zFvTux+6w^iw1Cn@bH~cGh+OlOlE_Yb=wj!GDTi)zeTnj%F{6fc$>bbYB!3BX>QZ)T z2gxH)SKoOCDbL6CnN;E|(B$sod9MBI&+S(bwikhCMS=8MH843>JY|o- z@IW-4ze3WxI6hmAM#)%{ykAxO>J3F505?Gwr9|zM%O8$~YpNA1GitL8c8or_-0sxj zyaM)>*qP5|zA@&^II+@G+*QaJusg;L~;m!DZerBHTq79WNq z!!}M4K3>HDy)$!32b=LjVsWysyv!P+avcMwRc*rmz4yC>SGbA}fYru?+%}$HnvF2J znHEI9m57%JgBdP%AN#I9P$y?F6v$UE84F{cqdfftr`02P}*vjnH9&5toXc; zBG<;yt*!*`)whgtoMbgk;AL}M335uqli+PnSw@-^n~xFyqX;ZoR5KMEdEhK;R%=}X z8mCieRZ;cdb!g3GNbC74B{$ewfxaWvk~wK()HIv2 z;n{usS4jilmuq4%o|X?f(wil=+UrV*uz!T?x%gPNtM(VFNOy)=FxDCQ;o*1|LeNo??Pp(v0jA|^${h9ZBOmXb7`sQ8>?-QnQs;{vP*B?KB zvlA}u&Th~w$vn#cd8cOb*IP@r0^6sOop?Du@iRHQ|8LpNS0My}GQs##IBL5coZb+) zQ`7hOm)nqwkPJ3}Y61B0G$}G!GCgI!-nAA-!Y}V3yym<-j5K+_b&LGE`V?C$1ji~& zlfLnDWclU8})jGcHMq8rAXiUUy>m9XY)Tdf|cA&=0BlwQv;PAaTe9iO z4Zl7pt9hyicx1C<;pJKOoKqnOlekLf@|jtNN{ny3u*y&euK5y>UoXd7DtQFZ=x~Hx zYvhR9jDoQ8g&vOI&fB`y&oge{%5K$67wQBDZCf3JUy=l}6EcG-pEFN^Kb%`>IvU{` zQt<;K=zcw&w%xSjNDHcmRLP4B6t!Ps19>T@A2I;lGVNDKKPgN=hB=FJt`&>^o#O)( zvM2&Hl!Sn#vg*Xk$Fp%GwHA6g0v%%j)9We%BUhYysgGx9yw?C*w4!mCm{@t-5b6M$z|#6rCkB2D$7TQYj*AcDi7Hlj zVbdflDu7AGeK4`E{0utO;yh&&kK{?N&s35kAxoVEi}Ub`PaQwnI*RsdMVaSC{ifnN)i}QZXAshqvO+hGXuc$i;k`*sBv^35>pr5#<#tFCTYGCCCi@ z!D^b4@9jd$^&_Zlc~l@Z-)|o(|M`b}$h}lFtIe-D%^So=>YJ68`sT?Om&OKZOC75Zkq^ zb+ue!JAKP(w*;`wx_NSU+rrUi6xo0Rg&HfubK<^q?~S(d2tY+wQbr; zsxw{hwoabD&NFaT);Y1c6y~j%TuSj~e;@jX>0GJjf66yVrhBJ`#6xO0G&iYy5*}iU z&s5k_xn_wv+konHb~<$4!3=3MsA&OcRZe+RffyM0*d$3!`Hy2W3T_d^(uc+qp|-Z3 z8eP;9Q%l7RaG#9xh?Uf0v5xI{1&sWFRe2kQGYwDC=z2T&wo3#*O52i%jv1WJUKK5D&X|87~vTsJEvr&{9V!lK`+9kH4>!jidtWCO7 zZZ4;Dn>Kf+J&?&Cze*H{$ESun$I^T1&6_#o^HN`zawwj%xy0RT9r8A^`eHax@IQ{H z32^_#){f#njqECU5!o%Y=}opFLI6G|{&JH4!Htq@CMg=3{N}j)i&R|dg*pQTmU05i zPW@|zlK0f?VqwOS^5hE`bu$L1dCJ?xPCjQvU@ z<&A%xaNKY@cW?{1vBm6cHQe7a?`fuFL{-TC3SV`W)rR6PQH zGiWEwCq1R2K$Me;+p~ha)Ui*U{xn-@54A@^xIP@H!x&o|e?fD@7NKX5W73YdooWYAMX;?c@yb*vs#`S~89Yu3u=1Yz|@Z^&B0*y#l?gsieoq*(6Y`Jef|$2}xb654 zR0lRMHiIInyR75_|f2Te-;$(FegLr>o?e*sGwJBEkdW47MTXn8#$INOHH zb}Z z4|y3%6vXWob!E~Gke9Y0EqXH^SxDp^Owia&7Af{*bwEVQ#ZYNl9Bae%FiP0IU=@++ zeCT>2-t^8`!2C=`6nZV3J$wsT2cQ<~teE}bdhz8<XrN0Q4bTVUX)a(k(A-BrUWwu@&dp5O43=ft5?dBzQc&Fyr z4cnqhfHVcz@3{U1V!zOs^@m$C3g@v{7x9LYAyV~d29SC`GBxjz{UInN&uBDFqf_*45PS9k#ecS)z7&;D*6l^4F{PR#{`306* z9)?*?+hNgnEKcKOs)YKMPM4>f8H!jZ&6YW3eop;btT!yyRnCK4KmOVr@RUd${%f%K zMF3AiUXIM(Tse02N9_S`i-DR8=mbD~2;7+MOueLqSFCs$++>Qn0DS$n5dd3+OQy3! z?}>ASYg}r@C(_w|2@Dv@q&^;c& z-JMe{b`bkQGs_%nMkU-ea;r;~ErU2$H& z_Uoq#TE32)Kw}{`G(B;2%RrrvA{7O4gj>p`#q&Yci@g|*G9A_n+mo{z+U zbflAQy3y=|);q_G^(Zf(tf%ifkq$FMNO+xB(BA3fmT$TBSIdCl&YQQ8^}as8NYT){QAFB)~WRd7j;n! z!i>0#an$B8sfG2Fn)|H*4eWkDaG3hJ-39y9fc!i6;>d7F32(}nE15jR@`$wkV$_O&!jeeTMk>HJ#crseuCm``wdlm@eW81%hc--ubL$!$Q1(tPL*1fjIe2b z8Xb~M`{vHxZk!X}czpij!nOZ6#z9+Mxr6_41ev(k{5^wVl9c2AIQ|=dGk7|wS36k! z)QXaNr%iBFmyYk6HVpn&{!)BUd%&65=vT3J-cRwg zz`v4~#)j|Du8Ml)(A<8#`ZQ@+r#?70d(lC%`|`iGU%hDIFS-_jZMnbR?kuM;PLe(E z-FMAO>fs}*?;PCBm#gcNbG;$=*9ZRC{EKYpV1(@T2tPB@Pb+(Eqd6 z1SYUt@W`mYgWhO_yLOaoAx;P)$%1xOCBXeWFcSUqHk;%Z_^Kva|nX}Xu>DIR^-7i(G&PcT4J8yleV;mX&YBW`I zCf@g0!K|!GSr1{pod)F}GBh{#8xrQN12lZpiH$2y12ZxnMO9~1$b3bc%cGZd4cOr( z@XNpH9)Sck&pwL1Q*ye84Ue310k)AV;{h&sAqfn-7!kkgdS8Uhs&%=kNa!Q;mQc}q4yqgCeK96`rN9~gpX(TE*`B22WMdl&5+Bq+Fo$U?1q=bZp3 zCr4*V)B(U!4D!4p*cc<$r+_FQ&`asTsedB9i|a6i-do74RL3cDIToEtc03cBf)FzG!!}N>=;7s?byw z^WC_Dcr64?_zO@_-IMnd!3Q_0U#+}v}%7ARYT=3%NaJW7Q6st2!grS7FGuse{0A;gBUu z3HHBC2bxmVvUYKy3Q~DmTgRdtYf#)3F@+C7Zguirw2@SYfXXy<&F)z$tJNeYa4m%A zp>VQIm@dsMGpL~_;|y=*LaEzgexM{5mOEvrmB~JL22f%mkR;^C!83IJaaxv8)jc}% zqbYj`)Xt^L4DJ3XRgk)49lz#hpd?}afTxX*AI{6+Ax1>M5o-`+zwuUIN`O5&Cf0wh z#OikxG!$Vcl-H{&j1_wkb-eJn39K|;L~>E(_BEuiqE;(_{H`44t_=J@^CP4@mdOtG zc>yaMyE})m$OlXKv~VW}R9Ia{D*z{X?t%A2*?Y8KJ#5rsmzHx;2VI`3nnGUW0h$hZ zXS~(X<33fMnhcY^)VEk~IYp~5&kG9;wG=-pSIUSexy0K;7pLz9-dvy@EVnvMJ_v&0^QWKeAJv!j=23%Fq*;t&wZKBqlHANsIY2 z!J+`D__xIvUOv{KPV|hxad#$S!6=tX=Dq&Rku95a@kLA53YlrRBZ{!Z ziFPs*W4o*mp{M`O>BTz`kfjz-O~HDdeknUy>H$nSpLhs7E?<8fx5CH0DeL3e! zvw6>Any-@&Efl=3Xsf0c^(umwI4BZWwUq62N^DwZ_?yW0xiBcHDqjYl+~keNA5U4D zKx{eF@4TiBZ+N$Dq>(n_@G3?r$@inJJJuIib~CNhV9-<*qq0)!cD3@%ypXXXUlXY4 zv)S}t91tQc!!Syn1{E`41AfHpMOSf8qq`(fRkyPjShJHum&>HP{0fV?NT~*{K6BYa z$}14Q2%3v6TZJIPjjFy*Y#DtNF~XdyooDPD6O2Muq zn)K<90q5u{^P1xMS36Z)`SU0mUjuVNkBa3C0Rrq_cqJ8#$Yvbq;TW`qD-j#|Nu8*k zyu}OwtJxO*o!=CXt|toYdyF*)zO^8e-Y9qX!_-_)Z7G34ATXKyn%&zjKvA%f}!Yej?nzPq@odV zMiI~`y7ZEXKCGA3T{e-X;KAqzh3G0JBNObHS8pd(w!#bKQ0$p7R4$DM#(2Ei_p5AE zh=_Leq`DSKiCyQosb<%03wmW$?bs$qyfpPYJMCnRBj0Dz=dVUk4oP;hF6 zQMUqrjI9*pmcE8q4H+&9fA!@7Er}iojwnZg7ODtE(5h?0Kr2}Pkd%8 zIiF%hU7g3~EzGn>=bB}SCz@(`yt~bY?LlYj@;}csI;z{u)7SAOuVqq#M1yP3px;30`@>o)T3{nfu-U%w2x{ zgd_kx3A0AVBRdv5ja`}~jZkx>X{=+^#7I)+WT>T{5S#-UKteo(Uj30Y#tD9&3muZv zS5o>`ZiCHv9MUT_8emx?1A(keD6YE`P6rR%Cz#+|Z&rF{)j0=LEQ!`9KM(Ld01eyU zbkp(U9dPzx6lJOtUaxYO?_d;8sRY_@TKw`^HCM~RN`c0m&V**R^;;?`0@85n*y)0D zHCwC2`zC7G!Uw_e%v>z9Uwj+vD$PkIGm#IfEhyfPGBrEhr)fU}e6rIV8FHPr0VZ&N z+SijGjeJ&z=c@4`y#R$Y*7`b!npy!$>S1%cT>j1mE<$_y&rWOl%HuH&Uc;19h zk-O|%@+>8|GIEOXF#DX?3H%70mujAi|iUI*%g?eQ-CFo9wz39PH5Mf#p^z&uP zQf3G%y&=3xXQnP?^FfuP&er*VRg|LJl|!B$8%CE?bg;hMv-wIYk17+P=?&{IMMBDU z>pj1`B^=$_N#Mk7@LULt9G~g^i@jUs6JU9>>REp4=YW>-2F2-9&}-Dpv}_qKzA5JF(;WS~x9Mm<;IsXi@Mvf6LhEqo;ICU%e~+>p zK99}4V-R?7x_g(R!oQT;-tMgHawdwEx9NRp%^zD^Ke2i$+j8KJjQoVUCOrH-aT}AfIMgSYi`}TSMhZ}l_pQRLBGgXN zB5GCN%{3d-yron6Vo|MxDCzTqBf}6^BUO?21U(~RTtV$366;h}98$_wS{Wi%FGY&C zZSiJrp=+Y&o3NMuV6HvqdZ&-LJZC?KgS*B`5YCIcDXhVIyYm5)%y{%_zTh@Gd8*40a2GUwaMxNKWbTm_B#h==Emii ze|bCpr!^~|9-|1T?>_kPZtAY@Ah)wYD-7}1r>lm%(32Ou!s9e%K>ecSzR($Q3CDD; zFK)rLNHFVfOu5*hxq#HI;DhZk5eh<3FM~K3*|I11Qf1kBxT^B{nqV-JoO1KuEo9wH z4PVV=FkZ=CUGIyhdjkq@hOJs(WkQw@k3x}_<8MB`gBc@o;|a%W94ad{q^!Wc7rx&m zUtuk1D%Ashb$>b06Z|KqbL>EUnBNxtzcFHBpJc*(#h=DJZr;3u*@#@;DNF6q`t$1R zt54Ue=>MjjwliYHwl0avA(2ovcF4zL3+SuIQGc3dH4XHPmv=<{|g!?1cb-J0@=G;2DPJDYE_eWybj;H4K z`Mo+_Fu?c4d7()E>8BT7m_s~(M`N#)U+732Ub0Q7JBa*Il zttG$rZ|_G7mT1tz&>w{f8@-(8&;eZFg6>&5t6hZeXr-L%tdp<_%zB1Xlns&dt0aEN zewWRL&FGc}ialx7Syu6n=BR*@1gFxl#c@8ff&owL5-34aRR%B2W8+K2Y*{}mLf5P% zLnmBh41ZLQ=<^ZcER;Dt`+*t;p)70sj00fdN;R1Qu37w0I|VvGp-2%(RM)kes!mSU%{zaL1B{VGTx@_6;(0xxf)V} zaJHPX&*f9iDIb7Zi2d}shd+tf+o}oJ5i3i!;d*Wm5NG(B{D1?FJCN45Q;nO`hl0#F zU!VhNSoDccN3#Q`eE(H@X)nhX)|=81w{h>Gegf$`PU7|OX#)kl)lvIXm(H!)q|@TC zXzjD)jKnsR>Y!~~q|cmIp`&f;3LOzbK5nj@Ft0Mz7U@k%nO}(mpzU{%!XT? za7-t=u{E62|6q;Pcx{owROdQ$)8nZmk?$C!I4(Hv{3ln?Ba06%+X{bOww|{ zoYaWzuta4(6ypzTVLIngs_B8n)g;@S^x!^THAJlK(vIF*u z#Z>xb*uyNXWf})%{f+((qNYfe1GV;rjn1GwZ*3vtG!B#ffq#Va`Fd1UBM zrHPADP#N{*ykryQI5Lwr{}}ia#P_J(FNrCl(F%b0XF|kFCdvhaS}Ezm;g}5Xg7r-I zh=2y(X97qb>xNDVE(NZKyIz_l&G1iKW-&iGpz;rG!HLhywG7x{Po*x}h&7*5l{_im z7n@sc|FdpjxQtq<${MoZJWs-q$t z2~l>d0};~A_UYy4umsR32ip^!WECT0g^)STCNKzo}ty?l-I+AvXBZt3DuV6^=E;lG>4GRu85>{Eb;%! zIKv`aOXGf*;1>Vugd*4Be=aGxD^Tt|QER-+1exX#>PaI$T!hmt6*}R$s(w@C0C=ON zIj>S(=CDIZME8aG+hw_gDf!LXkzYF=Z}x5`=MoYs6xT}kTUOTFOa^m07or|ahM-bzE@&pjBXU{H$rOuHjmW@DMU~b?B9aGcw3apf37V^%G&xn% zAgidFkgphO4#B`v^E$QI4&w@2IjM(icr$XnX=q2M|N4mkpst|~+oHs9Hpj`tH)Xot zcl!jjeKesBRA5(>n-K*T!y6tR3;|QikG2p*8|2GB>yCsN}g${dDG1E(927p zvd>_sf>RA6MnfhemsP7HJnOwZ>t@o-b+u?o>LjRUt*DI!dh{Z1%2wz3``@^ZOYTOR zo&rDgzAc5n$n$>y&X;tBXKbZ#93K za=l&9q>dq`JnN0nM9WNvv1HY}j*uAFyLHuw1N&IpK5)C}ek%aTp9`VP%>#(Vu^mZG zs(!6bIsFCoEfAP@3k0RJr03SH)C8xQJP@)OYd6YBr?7=>ie82RtW-6oBg<)Omg0N^9%5IWxJ^ z-4tw_94+zOYE>}j&Ka9sq9H0GHLvgUq?COz%I@o>fdpZli`ZLDr^;U%aROR$2pefd zp{dA+YsFf!UD<8PLl?fa1}bVdzVTXYQcDgZQC@j1DgSXhRm_#WoQI0$TOb&wv(X=p zW!fa<_J@7Oqb$v2()-hW>9vt!MCOMfixUZin}+`iQpueSTkr;)IVvSQ0#1$tbC_r_KeK7CPO^COE7GgJ|-vYq^l-i5IF zI-tYo*lG5^er&X*WmRwNUCfWo% zKigD2A03si^i3wql~+0065OJtv(xgd<}ub@<}IDA10MPujji&-M#d`B0$L5e5<_AS z5SR5$V3@fMp;jgr4@(zmQ})}h z3GvgH_+l@NG(fxHrQqiPA1%C{$vwdV>l{2;BzX*8Vn2OK$sFz%SzqR-@DE{7tDBAF z<>aPLz0TDi4NU5aSF`S-xF&BC6G>@q=uaDBkm0x_jg zmU;~q(1BXukwy`b#H2;OX z`Js@o$FuN2*}&E-bQF^sO9W44MAbPfoKdpFA7N4otSna7CVtd!06l`gsL+|Z$ffa) zJ#5g}Zyc+|%P%OjBlG@(yEmh5aUmknM9Zt%_i`v@3ZO8G8VkSvAIIPThP|4hha`># zku=^LV;0!NxJ5n6WYtRJ2A51cht_`W*X}>Ob5Q1D)WeYZGMW>h<;y4V0d!__k|k2r z(v>-<+w!5vxC!hzgtuXdM-@Zh`G{6va2&)t*Sx9pZQ|-^_?wd-J!`DkRxkea?Fc(8W`VdiEpfT5SOPlmVi4G??046XnEA8cd6~HUn%7T7$&g*D zgX6EAt|qEy6AFtG`kI@oZw6c(2ThjB_=I-T>gJ3UV3{gKk@KH(>46J+1z8ntsz0)a zET*+x*u4J}V;I2~tzgdO&ixADE){O^AY&Km8Sf>5CxM~YK_!#w<45v!SP49#*jgx* z*j+NMM7c1I9)#QbL><5hLQW53gumvVeY{ZhR4o@ebp=N#?G3gxfj@fG%=DD7M9$PN zww-luq~O`^Vk+*PglC6qZ{^+ULZl7es{5B>ZEDdchF3!4Im|!c6odDlNiMQU#CPrV zedPYL=+vsEJ>J2i)Z5y#<~{viAFDO`j5#c?zU*!YI77f?9s~Vio}J76+DAeGQTwsm6t9A+@mBU&qUDp+cO-wiP~~_H)8=N>PyZGx zfKS%*-bZ_7wW`qzeN^)my4)ISnmXFd(psL0Ns-h_#PpGBe4A9b3KIh9lyw!E4X3iy=iHOAh7B#2og_|3}ez#7*$#;Myy)3I_*&{5!xCZMq8AY($bda&HFh%EeFHP>| za`w~uo0dO5hUmbj!`w|6QBa-RQt`N^!BZJ(^>7>nf=NHxkBRP@?m0MCG|RLZZJxGs zBqyytn>m+~$j8z1G1lTgrePVxueR01&yNSApVz|wxc%}wB83U>iXDUQ@M&pZBLrOE z*xBp7{apch`vdO@^)i2=X4VA_vHcZrPSeqqF){^1)eDE8B%U-~hKxS>6bIjQW{#?= znELnNsKBV({>R+{e$s*Ex8eVo!u1_wGYfZ~MvVKCjci&z7W-sEqn2`oHwi8lFBwc` zq0caHNW&2KiTu?lL27E?b2`cr1GxlhH)4N+5}6|B8=jvvlaYe(rOUaN>DRW2j!xNF zrmTDC9+6~^D=SOQ*(f5E2cPk=l_9wZ`|vlQ(YH+jC=tt~XUo~yB7X`dc~XA^nL_2L z;VWFQeFiV1j|pKZ{YsAC{<*DgI2S0&T#ft6<$_4ydLS!P8pf5ft0uvEb)lozVP>!(}DE!fFc zi?K_WxKRj7whUn8^xENBx8!_Ux~4_Rrm#5olpZ$QG=LqrA5B^jZ;`@W9q0JIYf4hy zL%%aVv_6&ND)H);XeA+FNd-`taBx092X|~G%%{K|1v@O@kzB}ND?*u1j)GH4eF`l-pb?sdnG^&R4!v2N@fy$BcU7D{5U64l zFnDtz<4=6^w@K#~QKY@5N$E+$#U}{%akzP3K${(o)>|A$aBLF3w__I-QYL*NDC}b? zdY8_h)~xFghyWAw?ck#{D+3BlSYO^PW$kmRrN10t6C}LcbjJ1*q@xT9$65Wybb&r( zN!|l_mD%bRH=Nb1^xx9P9Mp{wv06U73}>CRmA`*|kl-Zf-}*C)_e%w*?O!0T_(jH5 zkefG11?4T>itF+@FS7+*tEAOvS|e<-a1ObPPJ1{qtlN@-X3j)(s}#tTa+|G!YHu>LVI}e}4MT#=qq7;H zl{jeL=O#C5tZTLwMdAi2-}+$A{%3-jULy)wZdm3%X9Y-cHv3ngMXK#zFb`Ec9ueqc zb9{YJeXA*|-y*JU5PBsLJfY|lKF#v=F3w8eHRx%s9E)xZOa`_#BDYi)s$wI8JaR9V zEzegyW5=H>_fSJ{6BRaTky)i+X~8n}x5}0yJrEX?Oc^K(LitJ-`)jWzfh9}<+i2_> zWGIeJAo6d%^FBm)Rgx0SE^1D(xe9u=dXJVf=PALzp4lzoAK3fn>M}vDqI2TX-7f@} z@~9DnXO{XSMqkkf2eSM%!kXZpoRwVnC#z7Et6FH$qE7evgYNJiY&nO(^v9gPnF2QSy{zfTaiHp9A&^=!J>ZIAeR+s zDfc}F$+t!k>k;7Y_`M_;Jm=mQ-3pH}y8^iDw)n_ypx@JO?@%H4-4@+dwKdoGOW)Zb zKD7^VLExg5dam?Y21X@N9R8$1OWDRD+%1r*G3y?ISE7hozrndm06)(mr5T!o`{k~Y z0*SiF1}inK4d~3VW5q)z3caHb?RUd;%Q4UKRt=}3u7zr`5Wq2fc7<`q$BXK?Sm5lV z*)~x(7qZ-UtfB;4$GWe9h0@YE^lPhkY5?FZ=yM>vWTFr)u;1f6S_S= zwMdLOLERV-EG_YFf=#yvy`5^Xvm3CUjd+>WZyJf~x=QGjaf=j{`JMXM;hV0vZX8S| zd{EZ4w?94Mc*h-6W%kXyXt}nm$EQp>X8Jg11!I@CZTX_1agHuLHKw!)1(1mZ=m?5U z1isR9C^v6oTT;db-E|WWYIz}SW^D>D3sb1IUsGByz3a$;CJk7t@|s>>Zi#urHBI>{ z;f=DW3N*zn*F>YtShoZfer1T|REDBFq?B!^uGgAz0^Q_G$*o|(C`M#fw@=$myr2*v zFEnSu>CwwLPuUqC6_H%!**|Q0NTmD3Kj4Hw1s8OUA>Kfs$QU7umP%2Qf8~IS4zqM% ztndvkYw%nwgVX%nmbD&DwHpCDb-GvSMHS6Cvru1p3zH_SYLsBNLimauK)NJl zm82V0egUbMbD3RYk2y&LOS}eoQQsmopflp)GCHIhi@(x z0z)*9R!94N&RU^W|Ev*FyNnZzD5}>Odo2p=z4*V*;n!Z;r3*eJgJ;}GI@ z@8)e!jaIk39c>>o4>(2MCIGte8|Pj|NOXRE+sVJHnLw>M#u=1?KR(_jZ-5nPU=21XMGc8{|I1_3vASN0Y|vzxIFf2y79%1#f*n_lTgPlZe** zIx;orf$77zP{xgK7p=Pm*PNgK+O;UBIdD`lz7m@uURWPHzbUsEeHW-zpsZ=805So3 z)NOjyi*{`)VVBNx%4=k$FEH3P@}u}(Yq12b0s^wov;yI)I!V6t_>)tk1a#?u5{FKPRXIJFFe1_yZH6PqYw$agm2{fm9`#~dbEnGah1?drsWh}+pKddUN zVDIhkw+fa$v$#r^6Vv$YJSMmvgVuPoEKa#l^c^lDc`at9x8EsyzKOw~m3fp+FZ~ih zyrX;c6LaigQwLDOjOQau-s#H(Nn_C)@rxf%DSI8kNX&<^70-}SYoVKz9ke-fX^J>& zo&^~Cvc&^&HY3$@=R)Pwj)brAv-YP#M|r<e!UzDX&-nf-4I}?4c9a8SJCu+Y^Sq{5$*BNyj;^A z*uWCgAv$rbMyRYS+_fAi)iG=Ka+_C?AH-qYefcWjvFSBj(aInmlt0aGdbobny9UBTGH3sBz|{&306Hve-za3X1}j(=57%!9@Lb!(sxa!0@zET z-G7)tB_w(j94Bz&OhpB3rTUQRdk|hT1eok#jwWo~J7l(Bsstlo6L;cnze@bHr7v19 z5Q|h?f0ky}SeJ!l{PTdG1pQUoo_4_gYhJZdTE4D7zR@~=av7HW9W!ye&2A`f(C}pH z@Cr%ogmCTOynWtrY&-4hZ^@_Yg4u^A0a0Zgzr3Fn{KpikC`xVPdL!N! zMml|b16T|{?)gOH!zEi?v; zEZi5#8hL3N?Eg_((sR)j@N1*0%xjgcOrlRQy`Rk#&p@0Ch>tCITY88OdQ8qCh&%J3 zPEkcy&nFJG3lXoUNRFG%!YUJ2>Fh}gsLZ}A5acKZ2I&9WlVQ{*yeVxXczhP(+$u+R zh`(+VRRxw~1TS@u?zB15<^|cc1$;OC;am295HvcU-)e+F53*#V??}5y{_y_tp(+Y^iY+cy0d6vyWkK}E*iX~it6;yd&mG;@qwnOXABb&; zchy;S%zeT~dOo|Du~3nDPIgOhqv@n>b}OSJy$89DaLtD9e@N0-@f*3oTSeuJ<6dAY zp*yu2h)f*cT)KVz;R w-yXAhEjZ?ZuzA4!d@6`zz?i=6{7}c_OOBx|efr(?r-5A!>o z!;3sO{XKzutTArLjal~xfC^(}i*aLfB#g+TBU#RJCI>=(XQ(NA(jcv!l%y>B5>&u-Tbqw-N zj=D)OLY5ck`CXQFDgD3K_d)OOAbN%6@|gsyz?*Jxj&2dX}Wf^m;ADmw!%Y|jaj@_6o$wJS~Y6S zBHYfU5q1pDX$yga@hi8}t`<6yK?r&|o`5(XwxU_>L>kE+f_4eT} z@}Row^#dw`K7Wf>(+AhD1#9~g%h4t=O-2K=1le6PFiJdv8`I5t62vw9ofL?}0PvF7 zjt$gZuMs&C5BPFEg3A@=r-D`?1!iol6Zp5s8ri_C-ZHQ;TIn^2fGGbEXav-X8l{f#aVK-1Z7c7!PZVmIN8^fI|sv@yFH z>Z=TKP0@EPV-RC0FW5fosn|;~_Jk$I%6W_cy|oO(Yn1of5_ya3zMh;9=85$?8JunD zY8JA;$WI_&IHHgJppMb(;#UMn;@zDXih!&og?#IB8(;}n3t!R(6u^}8MqYC! zUbl@&>qhytq$Z7ds_7+os}W#hHtxV#yH4L(88Y^dAq2LncQsN$G!+DwR0Y~+qKeCsUP zYHq1;t1->zW`PgM1%D1V?OP~~HbLxqwa2wcS)eY-S*azC$c@;brQ=Qc?PtHDu}Ub@ zd$HSiz*%AF%X~YQ9pvV{mE|3Kg}SDZgiAFA<`1{1y@}2 z0W|C{TKCJ&$(;&7>(_|RI$Kj!`>y$ z%!?PwY&Gz)919Z<%5L=5$TrpSrn>vAhnjxAeT_9)HPR;^h%C4(L z;qOxt<_Y-hYiq;F;z{P>M4Ae0BX@Tkk{;$8-m+-m2G=qGbS?OeCmcP%1d1J{j(!JuvEKLy#UWWhN3CW3b4qD3fA5#oER@1%R z(lV=(cOl-u=$P788dD`D*zyK5l<3m+PP|3g<}F)7kr^ zbPWP=AK4F5C6CuA$wwbVq~@yv!$PC7vQ{n>m?ECoeC@lLcEd4K{sHw`u;~T4Ye97r zGy_$NOBn(DaIv>fuKnAq@ou>ay_F`L&G6Fcy0lD+YYrZu^CD-(qDlYuEc}VQo2ts_ z25XBuhp|QD7iGP34)!3|;Y9oKj|RW0o0g0WuE4FKqbRXI$qL9~rwZ?3S7}m>nonmx z8)~WF{;Hq|&q8 z2br@aR^R(wQ$K04+*uT++baBHLu$R=TQ$e73(UyYLl*CMJ@C2g zF%t>{06Oe&zcC18e%ZcdAND3(jyH$Gz-R0~nz;1vYgXxi)DCo#aV6IG>%39o$HOZ>dq@xp2$m=kcH*ucDq!f{n0dL2AkJn!fFU!c3RI! zvetC@A*6Pl-IzFKb&KxZY+=xwg3P;aYIu9g7wOcD zyDLRaa`WOy1Zf`IeGy!(cranU;k6_XxDH3qWL-0!R&senN4fQQ+E5*}&d9HEotTtj)^78Stdx z|Nf{j9Yn0Le0%TD>TlnRVIlJEm$X{Hj0e5SXqKo-K~0l>O$Fbq=!sx|5;STMdey7En6EY zD=?e@E0XgU`PD-IY@Hp8mx&*#Zl??h=v~@T+qv&|m6qa5#Jnyr4UAflz7)JMeOw*$ zwRE|xAtyAlOz0mKmlve~?e6t-5~NZqxhrZ2qe}hk0^$zCn>oe2zIT+Bczm~QOC~2> z-0L>%+IP_JN{fa~piSfOR~d(0tJ2F2iaKCV8-fHy+VRU#^PJv1P1qEuH@ zsrdd}Rp9-Phrls2t1zO!M{WP&ErB}KqM8waUf-Y2v(F?;Hr=s4GeE|Mmh?UNIU^DY zRz`m$rwaR0+uzGS6M5aB=DYIZpjAAz%T{V6l-{(ZSslLE*Q#^6e5`aR+htmBHDPxu zi{1(9a|!Xi)LO_U7rDge zGwTohY>7P?Kf7=bD;W&Y!%+UNqkPZiPng{=eh@yptZZvLmlq!e#Gcn#kXopczYctA zTr^cK;z84s3&$@sP9nhS#pLYxxaS#gMOZ8>@V9x)2W1+@Y25Y{aMv6vwAI4T)a|mm z&I)vYbH47^j&_3ec%p+`Fi`?{39qmoe)pP`8_YGs9PEaC>E~c-=y2A#nKHg;(CAuK zS0R^I>|Pwlwx$B(I;f-S;DXCyXwq?8b~QX1$`Tf#vSZgnV2Ui#3J|z(>y2R<&5}}g z)5w@D9UK3Ow8U1={;E2S$+y3iE>t1sx;A+6?y+|(ZuSh5TXd~0&1|>4*xxkXcCv{# zn)+R)n#xL8S1!N!WqBnRpRxnL zVj0QH(>EeA`+scq*QhY?ukevVLto97vKyaFZB`5cuD0C_^03|Cnj!Tym%2wcSc&1# zx5sfFuL;LqFCKtyAJ>GX6t5>Jw`r)eD)@(NxCLn|9UQ;C7JBMMEKWw~rs>xXp=V6r z;M^oMmxoxQk`Fr^>>mqTF7vF z)T~zbEw&=2%9ZDA&oVqfEjVnURx(b@14f1RdGqJtzT|$*FLlMlO<#DmUB3gW=6N>{ z;93S-WLq^0Yod)IWe?oFmlqd*1Lg6*zZaP5RfU`#T}J&I`Stx>=I|ZmR&7Jm&=xQD z8rJ2-zFX3t&inOy5gR^~6n`(mEnev?QDaO*C;XJy=$#UqCZ3I>7{;A6%_Xio#;HT6 zY2@#lPh86Le=mM}CL{-e$ulnfYkOR>O5Wc~vHd%HXT70xu(#gVmtAGT8q(_hRC#YT z@5@b9=lPyTA>T%RD;NLsrf5csRWXfQ*|nXozPJ`alsj88>OgN@RW1>HPd&PhajE_H zxqK7AKkjHiBvl?IH-s;JX=}PESV=qFxg4|wH^YuvgkQOm8GgsrX;J^;>-7=S^G3G) z5Xd|Q+H|vQW8~Jo)!#!`@~I~qhF}jQe68EQmhZUo$!!DK<+iTJ_k?mXa?}_ewzfvW z)PAcZP6bC-F-9xWu%r^;Lt6F>o?TI7OWlfF$VBiUSZ7fuN5Qo|*ffuF zvu7wQzWB+5B1((Q=7`wuQ^_A2ysx`GZ8u5BmmfPm`Q@Z4TwaoSgg5oPAW0Pt6LrJ= z>`Dw$`x$<(*2yBgf!=hOI7p>aH6@@`rKz`8;9r02ZTQ`>zMlUdlle0r1F?T^(%;cm z8VV4hPQNP4)2!|k-)T3-rrxPP9l9&|=Ze2#Ad**fCv8_3+TS?O;| zOJ@E=@HxL6-#jym_q?z^#Qb=I|B*~4;;)^f&-wTC;q#krdH*rpWC+Z91jShLM+Cs2 zq08y)+g7|xUA_(aSWAe7*%YMCF4w>RWBt88Z}6)oQs?c9jcU8e{(b4n!@UB6X)+>> zMXfPV;9XFGR=chgoM%I?wFz(I!By?G5?m-Uf#7>GflAV|NIizUsz-uT9v8^1!|wG~ zO138|6JODLsJLkb+^ENRkQuO#{Se|H5!x-P+L-sgOjaCCzq(~)!5=8x2#*6+t}WM$ zid55|XEE(;*_A7TObC~zS&D75D9@5)z0wzJSyN4oBlx%1)}oy zZ7ZzV$O8iCuP@Gqg-ts?e3XgHy}4umIqUBYa(ZtR+GAXDw*;qHj1qbwVhsyjEdzU! zYb6{y&%F1LpB{YIytd^kisw;pVzJT&mY&Gx43Eb*gp2qn)e67A$7prmLJbz2Q`h8f zm3y?IB*$<4&F15Q%y?Ei2;_iYW-SYNwGN0h$#546r0l(t&mku${4S!VF36jv?b<85 zW{savNhQ2R^X*!;opgp)omOYFo;-SZkLT{3Pb{)%0KI1}VW-7oSGPfjxhHuCAs;;) zL2w$hi$FuAN+2UzpKD$^v=zrz68&99)b4aBgFLS;C)debVq^z-A|vU_EP5eu*JG0DdM{G4L2I{WVcJzj1Io{U_ zH>#zeXpA}CaP5qp@D|#I`uq{M$-jaN_bt*!HP%z0;H$rDN`OX2a%<|YER)X-|L{wK z^^nOIY+ZRRJFO5POB?5pIfF$#>&Z%0_T#>ejlXKxcDJllw)%ue*gS+ynHjF>zlAYk zZaM6b^YPH484}N4moG~6MzQa-z7)YzWxW*n^O7Y(*PdY*SUlTq+?>=$z>E2+>+2U) zO82SHCR4<}8xCI5wqP5t!&>Tb;;@(dWcq0&=Ali{vqn~Uj`~N{%lQlm0XdQM_x8Mz zlzx;UNZOx79Q@H|lL3}2HdqlSa9@WkM~o<2ZBnASW@Z=*JArZEGPa;=H^Eh=A_e@b zC^Cm6?AZv5p?tTN*5cjH0Qj}8K25J@M1l1xF9&`r}4{A!LphRxiaa~z# zvuhkZKY={0vV@MX2ag)?lb}#^I(Ac%rFO9IpCv^7$S|!mf^AWg-8P@U6dYXW&3GR z;M`HcWrZ_=FT+R7T5~|vKGEsXcPY_mUm&9>0S@bP@1O4aYtnrRSD3Rog}xA^-{t(I zO*{|GtwM!}^xG(H+XL4cKv5 z4O;}L@-m#`;YPcTk&AIZ(pubm(y0hQuv-OH$+7<;4F-I>8D2NKiDKwz>C0)pbkl@i zF~N1&z>B!IuWC7<0bUe0M!InEoLrg9_{hQMBnW&bg$tYQ-z&OdbR>9gv$ zSynF5B27GqVED6KtiP{j5ev1=W;Cq3FvUxMO+I%)TCkpUUlpK>Ud^L8&Ebf^EQ@Ol z2^X7%E14=**m{@$k7EjjXYfAVyw7+xfK0se8B*%Hh_hZzq1?(IS#tEMh{MUyi>MEm z4F*i7CXpe!dH9kkJl_hM{>2E^|Ls--j_d)xRTY?)fO9~oyxXkKsX^eE!9|l;-W~8J zw*Jy)!2$r8#q0u3vPxj${!JSYrFm}FiQgN?Xf8!c+o%kyHk?8sQ zE~Up>WXJl(@yMR#&TLcb57YeSw9Y4$2)jzst-| zEP5KOxTAypMLj#W2McRlzz%e7=(Ng;F>GXW6hJgu4-HW?j|JbI#06raq00~7*z;N* zyWl*)k!CfMKXJS6zvUl9cV;zrzZyu=cZyS3-Q=uNm$WXEG$l;-=*!#i~fvi*cTNXyfqV@H{&biW8ptg-D#^u4(XqOT^-VTW(~ zZ*YBEpj#@^cC{M-AinI_b#|d4-6hh}16zf6LN?Z=C#*YesAeJ+mu!$2MWtE6qpE(V zps{IgplEf>au|sy-FaJgkXdMLxj|;8kJCtQM(2gAF%pJvyM)|WF3@^ZpWM>E$dTcJ z(M_>B6KASuXDW(%G9@0cIca_fUkI_kvS(dAU$k}?6J3)to@lt7xrr4XA4T-^g`6kE zA=!+Yo?vR1euyNObmIcy>UhE5=TO5eq-L=>;`_SO+`z>7^UIQ*TL908Q+XaMy;#G+jI2B)zA@?v`WdZX)ZkhlZ5~*Q5yf&JSIHf;m|W?4&%TK~Jn5vXxmCcg>R$Pg zL)9!yQN=5DUh8^GWW&Sx7KH0X7zc3-JX2`rkCVlqf$heED5@C`-aZ4h*CjCn2m#w- z(TRSvd+WsUikqiJ=tPbbbG5K!aW_rSJ?HmQ7oYPc$WR%<;Wxf=z(tY4x9hEpN1EKC z{{~c4KfS&uFvO_f)E5nHFf_*YbT;3OLEBZ##J0Uj1C4Iizo6((ef+euE@J5Tc6&|G zV2E7vRfYIA)3%`SSvrI5_puiW_MCj(nSL7C{Q5^P)tFs{goPJn1*kYR-_rf~9}|%k zGcQ^nJq11SFlqkYq4ZG2>&2h5HGcrx=!ArYFV5^Ml%$TYWj%a0CX+DbP@Hw%oh?ka-c6?2(}qrif>m7kZv2qS&B zNQ1^}Fd;L9NAT+)(-PBaxPQw}Brebxfjzjo*k!kk}l?;FTbfNLfjX3mc8yQxy8#YrdtbR|C=<{%S6}E5y zUlT3V5BvC;)!z{lUSHW<1F>+Zx1jYUOS}?SNV?#qc65);`QlIobk5l z4Q4OtlLs;RZ9k^9au$Y5-Z*uT_B`*m&HjC}8hMIR5PFE`-L-zkyX!cOeEP}oR0ghx`h2xg+Pz0$TJX#+@|xLT!U_og8gUw z@?6O9iTFF5+lgN?;o{WlLTM%F$gQ8h9?t|h?-lw>0iqd2_@jvDq4Aj(p)m7TfYrzE zt!iQp;&;5dALswcxaavM=ccMoCNk^Z05#~Rq#pcAln?!iCBBhNRvA&_tB?c*g~dzpjOHjbYD znF3Avld-{D%IosYfcm^pr{1Gub5R0`Zg?whT>sIDdo4L2I~<*>yO{hq}~s*Nc1hbzXJAs#y@ZJdHf6R zE2w`JbN{8tPgju^(C+uCn3y)y7)_u3DE-5^n<(10zwtXQu;;4RH>aTr=a?%DItx23 zRQPD%;~&Kq*W5<@8F#_c-rKJeC!CJ-bDe~qx5?_&MA5WboPT9)9MZp>U~iRZ$Cm@LL2yPQO#}A5+)0 z6oVgc2=eej-{>8JMRdfSudbxOE@uMz(4OwZg7m0$Y-JjEgu^|Z9}m6RR&{>8bo6`F{%m^# zzW^5R`?wJRP~QB$DE@KjDX)KU1wu9x`fmywqVHgU1@t=+2DO;jOYFeXNhv5Q zZ6Mz(al19K^e*2+(=Usqwa#faD#Lv+Uw>h+;nyKSEq3tFC{ zH3sG;K-YW}v!2)T@qJN&RGXIwqF&bF4k~k5MOxe6mY&Mu!tK_RiTMby`HBsV`%y^hE)w{LcVTd&6fl~^o|5%!>` zWY>gS7K9P4=iv}*E)Noy^{k~Ki-mh8ErV0(}Qv%jgzMF{? zN$VxVJEVa9J{0dRCfd7kOkL|thha@bqret#k<=hsTHAy0m`_rIPi<5cBP#qi-%2PX z8peH5Q2QMhRj{3KuYgGJG&0j0f2svdCh^?lb5yG~N%{BZ&G!}&((KVQo&)}+IEa~J z3RAOV#A3DV+b#{Ex5k~O_r?UxzJZ6y!$sn-Twz#v13C4HbsVy{ZoC>b%uqI3632@q z{*sTDQ{w(w!1%_0-$F&!IbFD16c~PqG3Fh#rxryXqSCS9Bh7BZa z43Q{^_RgKvBDtk}WBl~Y6sh*p2u!dSda;+B3K{liCAk?u&e>yo75)`6W?ZyvEUc4s z3F({4=mGlO6u3g>XQyk`G>Qtor6f(#!^KXUY%Wf)CxDkNL~Mr(H5qgJ)nCyv4O+`7I+V>X}kvEOIZwa8B6J;!>U(|LZbY9+S|5tqIlGA7~^h=$ftr7g(F| zBpp^KT4y~Nx(a0)F~ZW01=Jzx1(oaptk-$rYD$Q!#Xt}*+}E)hN1XXUVbzulbb}<$ z!fzB>8|To9dfkif*oKU;AZ3*(uFoMiTQL!AL(3VHmmQOgm+)+o7XBU@mEqIuy38=K zkbdCn#;X+Hs}ghP+8|LW&ZogPbsvI(e{a(z%fC#{Vxm6iIy4^;obi(yt) zoIZ+U$iZs~jzHGvR6#NaQmxdmHM^ zkpb4oYAsB(>WnV&v!c{Dz_NQ3N6eTuKK9+1yybqe5Fu)QsPIf_xHb0ENNhJam~2`l zH{lnSeAyVIj-^57T8F<7w(N+U(<<%PC;(w)!49hN+XGVYTSiTPt?%kS5kJfLvay!B zZcCaqp1GHzv{;)phQTP-efCCz``xN-1%6fKCE; z9PpiHkm+-+{O0Coh+I0>dHY}$?5nBZnrnY)`vXI@yV$orZ+B=SVcr)QAwDSovTH0F~7B*_Gh&EwX zO|7ozQ~R3V9Q~&tTxc732oslx#!QzoRtZW4G3Rh!791q%#W55`_&}|Uw~0cllR#6f z1SK%d<4mHXPF^XQ>1O-7oUkDepT4nt=mI$l6-HXJpL+Hilqz`+r+vfNpFR zLG8M&?kjV$Js#>a!pL_y3x{xOR5|ro)}lUxMmpdiY;EC2;Yk65^KcKlK)*8Jkt6KX z*(?O!ALIDu51tt_ui)r-`ws4m4iauxWSt6DN?&FG4#>fpLGSkSwp=zBW1&A;BW&L; z8GlP6825t?K$X(-bM%76avg#z4v>G95b$*+cr^1+X=w4fAa+%H+$Q|to^Di-pV95qbpXIL%Te1I`N>`-v^Psfz)#0)XGR{ir?mSu#T(@!yRy=2A zfjqd2FCJYK5EaK1+M8UlF}kQ2n^8`@*?1=7li+Kai!p=wW_lK?DvNj>%iI|h2CuL) z*QK1$wO5R(l1aZ;CUwv-?jf~tifTD)qlVPAGQCPKJ&u3T7^9S$F0`9JT%ys@^_+05 znc^z2qtNo^d8Lt*2TOBJEIDbXJ8C&5^ST^Grc^g*OOpoF zPBn14N+kg|if-8yShCd=P1V}^$5N@(G;e^^u6u9Swtv7(VFfitY+Cyf#1!Z*wqpak z+V#z0Er!~+V8HFya4RWX5!vGGPIom>s{k^5h0XNRB8Gl*^gkx(1#0xNBokP0nHID% z{`Mdb{WH2dEyB_&aa!4)3gDL#*<*kyh;wvM7;&NgY^8!kpXr$`(!&~PW6$PQo+MEv zOLg6W_M%~JxYi~hjD1i(^j~w z1w+S4z1vo2d^O>lQ6ir^WR%eCKvxZFT2>NUdbDUPc~petB%fX_cMf!zx1+k0XRn?+ zuJ4YaTnkVBDNb|>`J$&!$(gK2Wu^TdaP(Ij-~j!#$#1Tqw_0QyW`^oGfQe(@j75$4oMX#|k z?t#jj3&ID0yC(B|c6h)f9r>%WAoZ<9pui=?x5Fj+_nV^Y;Eg}MF1k>7qV-&t&LIm%$S;{JF-PEgwa_U~$Tu%A$c|UUiSPEyE6#zf=U{7kS2D zE5Q(GBA|SHQc*Z)z7vXy!KDxNdQQ9CDw<5wYrE_k~ zL%&|WNY$;|dfCrr5;N-(pKUfpNzjwMdNONbBaQv&*}9 z=BU?dU#qCdu@j@7#A#{jZe5fycqw;Nq1AC^gR?I%sv#>w{to18@ivxFVwq7LOl^Pk zBAWnLR21~?6Shoq3b`U3=pWbsmIAYiS_FV)Mc>y4`UaGxH7rgk!S5T{A6pWz>vhK8 zI#1-+dQdwj-GAZRU{|;3N*v*|nBQyoPRH%O?gl}QuNw%jCCmImzq3V~tEKVB9~!*U z)o7A2qXDdcJT-!Qe!H=0{slhM&) z<8wJCz&x9_i1A*HBi;!dqs$L)sW`0)FL#&-gK>$SmK<{u_)FZ5ug8U-!R}j!?F`wy3`P{>PB0{5j+7gr;-L zjjvw6g8z8vU~zF5j~{&f)6xKUV*J|0^Zwg5*|ioxi<@~v;Ha&LvSX)%n);bSGpe-9 z`B8(Zi^L0p4L|C0l}gARN6IeL*(RQZ+NsA}a1vX5 zew(a1SpNcH@z$+7;SoEK5wri71V0q;?|Ti#O!GRNW!nXMy?+3JvpgF-WH~;Ait-w| zEg7tnj^ua;|8exWXlJlJcxgX!{PF}Bu@Ag2cPI~f(%85t>)w8YFRtq%w_}Lnt8%tt zj~hd~o6!A3V`CHA(~2LhOeR;jN|ZKeN8O)>bS^#!s>*7;9@=rVy<<^&ocRI`6@e9H zn;II8`(m`CCt?L8yJ6?sE$sk|WA0skj$m7fHIiaZLn$LAsJ_fYKSy2XigwLfBo2NF zQshhKS|VjVKe5R0LW?{sVMiG@!|j)NBLJ4rAnxXc2c#xHdbQNx`ZQh`UDU{3f(|-C zNiIk$ z^~%9j#`1n&4N3Pd~CyGc7+*zu0V!-;v}(%fo_B!q~oiR@L4%#eSo0RVPh5xB{{h=Ty;cKg8VtkbiX|RQURgz zkRloooXa%@VPDlqv3=axr~X&~q;;;(cn+XcZYMZ&!Q$Ciqr$+g$u8m3K!MWt#DeI` zGL|RSszz>*8f}<$cHvo-^^*UX7Lv7^d{C`hhU=x4T6qk{LA87)n;74qjh<#|bO*Ir zK&BSHQ|4JdGnbX#Y8wB6W0Qh0e%ZL^WkXvG@wb@E=~0R;UU00rnD38da#x~sP&*XH z=~L6i^bEN8(r25=%TDStYM&fFmy$`He1joDfyb!;e06cs3RU1ZD-Wl6W?I)IYH9KA z+Ng|PlMlQ8Cv^nTNuQeaq9CR|j*}uT&|ItA!8a>jVp~y{7GHv!GC{`yx+8F3HIduB zu5vHc6}9+Y6ezO15PXKf&DKA(;#-5Z_sht$Wi4jkrWR$p!J}gR!yuT1JfVeN#0$sH>w2M zM_{7St9gMn>@bdZI>xqV*ZGWm5wPlNhKQ@BF|iNopVYRP*BHS8*QfxFa>TOy&6#blI10 z|L^DYXku*U{049<`~Kf75xe#c^)b{0Gc5Kyr`OVXgUQ?rF40s$(YxW9rP8#bvdFC0 z;1jsX^H3GTS#p1g9`6Q1iyyjyucvt5wvPYQ?4E%!@0L0YEo_8WTSjSY|Qo zQ5n2(r6jl}O5@-D#VhE0H`qQymJ^~N;YHKcfRMm@Fn_q6l-4A~gjQt2; zWq3@@*gNWMUsWjylFJd)ZP!K)*a-@3?@w-+`kgsu2XDHVbv+PqIK$XLY+jz-bvme(sLi zk)8A(ZvOflU~D>a{r$oURjv>#STwniYt#>yICw1t*5rAOwXttmWP^*}+p(CvvqW#F z2N&5csw@k3g%}0To4reD$DXVOg?ASt+n-R?Sd7DveF`xSEjJ&t?I=;+KNPoZqsU%v za=OijaGk^-HP<+#x2JRrR_LvpBX8SS*nTrQ>dZTZ}mY`DSWeV5TOw65qA0M zJ1*1foqqMkMCGgWv(0MI&zH(kxS{~lFQ6pW9~7A%`N4ANeQ_YHbkgg$|XuD zmHK?&-#=hK?fux^=bYE;`D6m6SAijuRdsBoSqzeqHM_+Gi)DnZ@>@MMCDTQv_e$pc zm$9>>X2chBKZ<`>=dWoexuppRO}7PJ=L%O8wk{yooiV5Q`V~iCw!9u&dMcOqv|FQX z*<4b3&Tn+Dw>aDSWPzu1H!|$hZ*#4lIdzR_(_3c9492N$PmHSvDX1>JI^3K%Z4H4o zzR;n*_$4*L`|TY<&$iV>#RI13{Hr`rxSkqG-GP=}8|zHFW}7RrfD~ji2;$U&K7JiR z+A1v)6vi{Q`TY?2L!>>FAaGp{Bb0!unT2 zAm$}maJx%Wvc9O9UvyK*z_+xu#csx@9aBbI=Ykn{w$k1pe^c`(c0@_F0G5rU8{d1f z<(ZJf>u1e$kLEHhyez|urNxqiT28b7RJDO-eS6OCzlTkH&-OuG#$%T`y8KViz>XQ9 zs;h@#>&E0-rdrs3S{vk{YU5tVmoKGLZ(_X}RnmZPUUK8D1e#ih7f9{$uM%mO3r&kf z*k{&SBo&V5aX)a2o5eu{nhec0f3@%-OpQV38$DuE*i62p(&YfAEB&y&o*i4eWmAVP z6OYd9vzXqNo)G!|ib3^=)7lWPPS2`6|N9p21UtSbU%Qxt)d2w^m!%}(#W>6bktrET z{sJDayQ++aj6qy}`tVlm%?occR2@T7io;@Xa!+@8J>w|+S@%q9Jk&U6yptf9 zr!F!`&d*byY^L&UYHu=MTpTC7bh1Mp=PttAweNfxYy`J>tEkXp$MA&ZfGdBU6bn09 zrg9GR{>2?rD%z~-_;*in=n+YW+En;oSTYza>UV{duwRfEOVJyoqoISAF{{0MwFS>+ zw@y|}PZ#}F^vxZf!P@wm#o5s0%Ww;BUDal+Ai?e1sPLv?5&L%C1x;Kn$I*tMB5lQ^}2y>lP>WX@eiFYd89`4*}rn%u-7I7 zBRA%znoe9@7jE@t?QS2k7*g-6Es<6aFBx($|5RhtZSgnHuxbc8CjXRGb`lnBK!u+# zS}Jvx@;LWlsU6ewGM!X^=3A3jM5;?%XcW1vFo;n6sc}#zr!Y)4B`V)qZ z*HC-z2f3_P^6$-k*}#Qg&Y_)%@Xu={^R+#xqy3rU=GjfhLG?kiJcdYm&x4^`i`(Zw z3}=49F9L9~)t{S~TJkUSUFxv9*K30-&14FrR2?Kjf_ys6rcb{-5P!#XRdisyp8CFS3lYz02W4dg*xy6!iX;D&=IY>Nseb z*Q~PEJVJXYvR8Pm(aUWA2dT&2mgkszu-|awKc=5P!GG>&53V)dQh0axACs4+ZVj#V z2UgOgo8|2AiOMXqj32u!EIksI z_(dCs*Hh?BQw;!vg8-QQCbNjFl+Vt2q~hDU;N=dQ9I61)pfh**c`|3^Fi(m z2^{-PEUrxb$He7v`gG#72}|fXZ?&)IGQIw4UorhSCJZ|P^*Bjw<$75CGITqZ-RFOC zG&ub9BW)}q_&+8^#}yfge~Z0RPT!j~5Mhv`W`1V3{?svU0D|?*yk@2cY18I}+_{Gq zJo?K0Sg`xDma2BM%AcP3mzUfAy&vyhJ7eW>01~$h{|eay>d>q;JG0FB3u=7p`s4i; z%ztB3@TRRyW@f*l1O^$pY%ImogYxoZ|kZWWiK2(ZNIe9+8g;=8# zZnWr7nh&|oZB)3CC>{DeF5rz-Q-bK*|6S9LzFs z0V4eo}9>)NewYj^5Se|K$|nUJgbkm~{hcE1lUpoq#&5?u*7ng19A(UgOGb-6vb zeizrqBV(HZ4mTa?h8AA-iT{|;gA?9n`Y}p^nVD7F4x+Mu@67pf>10&bTp%{t+*dbB zz3UiH5d{ho=j5cW=brkHiP5S(O9#wv=rD}F#f^Bq{I70Lh^(qHlZqZ5$?EsUi$NJ2 zEF6T1%aB4#Omc!^P9fK%OBK|{`pLGyROqj}%SDMj3#xfB z3*4aoMo{~C`b?eiX^_3*1(1jv`J*jH>FUL#YSP?O_{bg#W{H}3Hl!naSU=TE*oU75 zPQ}#$XWdgolaq=bUxr9NbQBj53AG3KEG~iKx#L=HRS}7o;oR0ebT`v2mk0i;>PCem zmMT8gS<7>jNEcWY>lGy3=E5gSyisRksMwA3yGHL9iDs^DMdPgDH(Bpddje{}mKA70 zTGk6q=#6Ux)ze8T0v7muL>nanktqH+%w|EL8nph@Az9XF0%*#{O7o$I*Z?H2sdgme0Z*2GtFU3^JkGt;J=2*mBp7Cy;Hbe0dxt)L{z zoMlzl4K|d6EULCDdSCTUu>h3^5j<`~RFgvnH==-7Nz1)Wv}}T@fcG!82|y^x-g%~t z*^3?#@{9qXc%US((OL5(I=e`QPrl~5M~)MM%f;G&tmezYi-&&FTg+X)G;ZS z7XJ7N60TnC9lx9gA<1&^O+>zseJNv&m_MZC58N<)ZW!d(-l!-swOW|Ys2zI^ED+#{ zps^Up*E|JqF~GRPG%$o#1tt&AqlXs=Yy+c#75nUJK_8Yy0kf~nwx^d(tu8G=obv=sI77snYDMTB#{z6nv;(v1WYhZ@mcgMepV`mV>4-jgT>-~=IOKKkK?!XKOhvLdTh~)ZX*^I#yC9Wtoa(>O=xta}f!ILa)VMeE+l4_qKvARc~ z_3DlUP0#0d(DC({`) z@vI^pp(fQlch36gFFlxOY|wma6q(Oey$)`4>dCUmZwv}QQkjk3yIig7+f9EWndkbB zUKYG>2KOik*7|JOxRf?L_zUuucJB>fd%QxbZm7_WwwUmf>yky9$+n8)j-tGmX@U1W z5@i?L1y-d^WmJ*xr9*^E_y9dA=@VxtpsY`uOCbAPWCC?S^2gjNZ!)@V(fzh>!hH4C^rKe zGM{#_d%A68h>SpEYvdXT?6LY(seEa=f`+qAN1P9J7v&Qg?22`^EPnM%3rgc+uf8g~ z*d!}xroGXQc2`6)`?jc3%z~_!q?EAZm48~ruCewNw2F3E&PZumq~_Gzu07y`HW*%T zq!i|N*6YxOmaw_17NbRPt)u&!B-h`t>!ks`+1DF)fSDtgecw$Ht6( z*E=wH$3z<8Q{51|OC)qjarlE6U41HlN=u(tH(Z5joC=F#1pzmOJLr=KyO$v6yPb^+ zh243#+-cTn3HVg-n3b_Ey>XCv8x=~5?5$~m&?+AY{l~=azwNeCILJ~ipPbRfp)$at zoms7|eE97uIXatBg|g=%<%e@>%uL(w2A_7|I44-zCT!fL2howbn>tyF5qlLoblsV? z|2BWKHH`zOVjlD)*)i?*Z$gdY_`Xk9)Z#NaTL39Eh>O}PzgGp0%qS%x*S7^tu8ir! z9{%|gcvEn^iGhuJX1M2+XT3vl+ziRzhm8NK0A<`8Cmp2h!fobR9P}My*i%+Vn$*cp zsDFFTNSbu@_u}z3Q-7hfyL~|W<@JLqW<8R%EJdlF<%_z^2RMx6gyMkXlTcX4O$#Px z{hX+o;nh7?P~%H(Bi`3B(1)z{7cz_0u?j8}xk7 zJg-vI=C-}{D6{R^YBHdq)aTc%ru$rUq(m~|u`+}*6?@*SEukwpZ|U70Y+oGTgk&w( zV6Sp6qA(HUvKi49$tFh7A5hBdxG(V;08?tchEygIO_v&Vv0Y0I8-@k8May(S-B|Fw ziCtAC4OdJIXSoB3>QWY1(n_!j4^l5M{89JN6vm^z>$p%@pe_RfC->&%hg^ZPjQBH( z>m-N@s)bodLl|=F+=LreX+eVY*|^@0VzXT-Q+PVlUtiDk0yGa}EfyvNDQqzR)Nz-N zf7KQV-7Y4Ysc(Dyk%(9w!d11sE`kpCIM$e5Y6|T%m7s?c#@vzwrw?bi520l?UYS7$;TR|9= zI%Y3owv8D9@nuqTRuzUR%4Tv(noTc?gjYE$ovf3p4yh7K!p5m2?+!Qh(kGC~nUlF; z6BDb3Nj*5)_{mk}4*;;Ih5p#&)5)&;dA^1C3^KKro^bgSK5s2>MnPOWYPra4h0%Kd zI@v!Ay$M)Z&ZbgO#W8LN@Im4m>&BMk&p4JOv#l7Jmf+uA=LBYX5*)b}vnee6Ff3o5 zZkWqX(2W*h0pDLRIOEQr!%CzOjzc;*=#3L)}RTRT*MdHVf4_^U~2K}mcueA ztjk-a3Y@^3rvsSC@!2w}6sfX6cUkCQfwLU`DE>pB&@Q}MtE$?*aSsLuzY6r{pq)@g%_W39k;jC7Ey#P z+EWETeeYa7+G=ebdPL9CwBdfG2>Jdr+A|+?m!{}mr{FI)6LaCTC+Ew)0F030@V@J4 zybgPNHOw?%D<_vQb>I;8joi%@*{{0u@HD`R22bUaA+wOlP~y-?>-N$z?87G??3fuL zrA!^as9!IkpA~`yVL1k`ZVlb^)b0R_T1rrLDN&%FTZ>k(aEgo=KIaH_DYPdD#Az7a zx;ZhDCcMj2lTAA-maJlGqJ2qN?a=*06ZPPqFa@kAG^KWMzaSwcy&4gB^ZrEafzvYy z|Ae>*ZPnIaY5&R%?%w+a7XG*jV|?dR5D()X89;7!G%#D% zd~M^WpVgY7pyt}uQksqr77Tmoa&mN3ziNIa+Ylh~qFhwB?b(ut=kNS{*speVcy>K- zng2$Xvx?wi8o(pSh;?3EUAyaPh0M<$9gu+)eC3&Db@C12MOwX?@P~rZ7PwI&Ik#IsTMh}(%jY4&`nDpieq%jU0@3;F`9O8O^2Wz8D6@Jjyv?mt9a*TZjr{u$03 z`=-zNcujddmBPPg^h%jbd$@b6&i;JSqjggMM{ApSXyWE>o~E{4V>Qn2)%M%@%FS

VNz|Xe)*5OG})75 z(&pHP0b40c6Z`0eI62BsTH!PwC=UUIAtI|`nwFQ|$IAZA!@pv*+R`!!l@E5$mQ&V` zzNQ%P&X>s7AByR)q16rWOPekqOIk+)2e-ynZmzgwFH%6)ej% zrHS|$S!>y}dLU`YDjxrk>j@n4RVawYkva()Q99q{wnAT%^DJTc%4EgK!q`u7B3&kO&(Un z%UQW6^D;Z~ot8qn9Nw?yF8D|BtSfxUTYgQXa)6{+Z5AyZ=2}x&cI89DGXz2Pr2vl( zAz$J?k1Hj2k^LD|B*GX-8rNP!abD*TaLrvW`RyNZmO+9UqWQ(nNUqcIE2NpkPL#AY zdqbWN&o5|3nQFd?h?|1yM#~JR3*Ms;xpAe>qMzz{RL_EjH6qb4S-@5>h5>4%H~oIN zeCxJMQ6IM8PcT;b{sQw<09?2)Kt46LZrhWhyO<>@w%Uza8f{uhiXPJ0VMy;Jr#mkyLX<-sVHZZN%k-{W+b%Cw z8ePv!j;*w{gj+oBQrA;YU|+-w4eMAc>Ro45^zu1NW?Z)w?XU}DA;&;OM`|*@A+{*z zkdTng&`TQvfDXhXa)?v*26Y@rwC=1X$mU7=ZzD?l83_fSaX#P-*3cn?eVCM@-)X#je1(=gA>3jTetEPgy?C)Ifk%P`E?Fcl0u|9HoE{!`qp}_i@r4l)pk8x+q|_x6WaF z8ZYHUD_pHnnB#oFw=2N(i5h;jHdXFrm?l#^k|X6S4waBstDM6u$&wH=fiyWE;N1~4 z%7IZKcs1`r`cXj*mRiE2F&f#r$Xs{J9O9-goD@mIl}l9o$29Y-g}fQX?T|5u?(28lst@GGUd ziLxuPpD?gmb{{R0LLpt1gn3|U;O@;6%=SH% zzx{>3(p1vuv$Q8IwbucyKt3SYl}^fe$CG=XH;?f)%}pq$zP>t2qlkP+oL~CdxuY5{qD`YXF^>P?`rsN@0r+|m|42(6B@E|g25tdF^MzXz3oQIUp zq;e&E3;X9$^^Q>3x<$IwY)o@cnTJzb{JJ%{RxS{ zFLqUt#2r_H1H;qe^2`Q)|06ysnvrY0^p(Wqy7l_e^)ehxOLHfk;~N{G-vuelL5qfkirR>w;IecNI$XPK9J(ufWKlJ&SQJz{ z5`Wr&Y)b4w2xS1yI(e$bbX+T5gBL#?*K6Z=BNHoazsZBWBsQ1ZSun0QKSy~Lr#R}rW1FzKjAbsvseM&N~ z%P->9$kA2bHfz_nva+2h6d9-7{E<160&baiF6?V%?bN4TpA+fyz}&IYr*wA{N`pRx zW?dl_MQE(r=G4Z#W>$nM7@mNS#A@LT+~~oksSP~7}?K53%t47>g%0q z&aMA39a+FJ&M+W@gA(vbie{ z22hZd=|d8>b@#B*%{FIqnA@$7qWZvWDy>arWT|*Z^6}@bZd1&IO7I@mymcF!*9u&c zbr6oSfkW43rJ_s2@I;42{%h%s;$N}k$N1!%?xYDMi0}Vrzt8q2tTNjOwGz;k0<9^^ zTj*XRBLtNTY7@*amU;IKU_7Ela)=01r7d*JCv9&v^iBvbZ;q4IQda}LM|7eGvmGsQ zqJZr<$!+8jZ{#{P&8G}JOrU(idsXzHWm~|2&R~cD@UmS(7aEHaR&^EsE*tfIcMpq9 z45~qn_Yd7zqAkZ>kjxuY)ORIb3_$5vt#HKB< zTRTlzi>Dv_G-8ALFls-k(NR-_-qd-4@D(+s$(^-D*qFk%eu{wZV-;BE-SOug5s&fH z9-9{+B7poXHW}ps%8ii0BDdY@el=xu!%2@C-h&_5fH>>QbiEl$N#^3Q$>BI90B{A1 zuC%w-xr5sEC|e+o3(oav#6|)&|6Ib-NWr%pVw!i=;tRUqVl74dwo1_}1(WPZ%GI1B z`P8yY!c?v_O^i>&xI2YDLkXu-YiIdQoJXS+*HLxL;suxyH@~~}X_4YgGS|t_HYM0- zWfwKp@;cqxOOz$q`-Yf?#M@UHK+c@^#q@8|rOdK`sH~^q3Tn}CePlB7%XP!RCJylm z^cmkhM-_C1?-~C^YJKA@qjec$jn4+&gCdo-WlNkDRRjIy=Zr zKicpO??xtW@h(I>*8TnIO66Wt~hAGM! zvduVE58v2!VOUmz6-TukZ1@eF2Ec9lb{f!z|Cm%&&aD#DsiGOJDw@K&Gn?F(1LRPy z3uIbtXh5*9YWaeRb``?-MN7^i`EBdhRR;W_Z794&up$wzp50{_+j#Bv{9>rEaKt)* zF0~|sfYErVj&ir;#4E5trR~(B=FOt{+@`v^rN^?s(6TRUrSw;8Ac)G_{M1i(UrG^bj%3?IM(*mes;5Q4F4>rES^6Eq*Bmr=L(9O zrKsz#S?eW?7LB@jqLj5bITude{jm*-)A|@Y03sDwoy>mg6L0fWjYuHBQ~5*gpH<6t zl+yZG{QT88`|#ahTkdDHu5Nt)u=}=Ig-|U+3Wk7 z%k$gUX1aE_Dxo>K!jOZz<*{$p_7JqtygjWBLzhTMi zf8U(k&9?j~B^Vr=?>xqE0`aJOzH^+_>_0c1k7;%SZGb)P23PnDd4#`)=r{)67O;#n zJTWg)~QJ#Q;~^4wCqw@pL*Y;HY1y07*QuxD^o+&^j&D}laQY5Wlvcj)@=QfFKE zXe>w6R%KNO2FDF^PxF7Cd6AI&XkhYc!RDR<4c5C&% zJSx*Ubvyn)rY(Rvq4ZDTRzP|7u;6ofFGBxZv#_R?nAP)pu#-2(8^8_mc=ai)tm}4{ zXO_XiUjv7RK;Y?`Zvnsadi775qU83uSR;R4?JK97TTJA<2q-6~dF@epvCdu?pVO%n zcqvcm(WBw_wQr*TIF8rNo^7;S?72jm36wP#HD=v0;w=wIxM(a`cO+dE6Huovs19&V zStz5dZ0n)F(%{ldtQX!|s1&}*^X~M|g{GNyIph<>X}rbaT-9-CS34fX6!X01AWdE- zP8PccORcn&@ym+#?Id;2$#VgP~}Iem#}Wr zoz4?{0hqHiU*6vkDm|gn>MxXAwh=+0By?2*AN+XLqDXAg)jjeh6kyU)S+A}pW_Mj>t;pOLFnJel z<@d*-aX5&hLR1lN-E@f%6e&N{%a2k|mPsZ@?3ppkVYiH3m)a8jgT9-iC^>-Ko$r)f zXo4{ZMR8Q!F7&%8Qr+k;JYxvvPkNhDk_(@CmvPS$&oXQYkG}<6-LfglHCG(0GodT? zZKt2p;p!KR&vTx(MDF18abxyp(K+z&Hr5=%`AhF2e3f19{m1LK>@< zK9`Kq0jcVfn6^^n`XEyvNWh5G%9OiT1;d+bb4`>f!v=T#?6z^hn7rNYkz3SGZy1WHjLQNO@hWf1!#5(G^f~XM!=q10SA4?PiQa-Ctg}NpF#-dU zZs@eCfJj@Vf+G$^yzTKl#ftOODc9vOguh;yud&p=f`;eS38|U_LlccQAv7b6AC%mi zjxq^R5XHy}@5m>siOSXJEu=PBLPwefwzI#|BYTl+&`P$-CFFG4GrSC8bDo3uho|?Rn^mr8dk76r})8SMR?owx$G$pw5 zW+__i+P}zRBBtY$N6tIkuVzunrDkp<(-Qe5bCDXWxX0EF5z~%OE)q}|cZ|m5s+CQ) za``+s?X3|S0)o{U(;AW*rX*J=p#DAV5Mci?Dpuu#>aAKzZ%TlW+L-+ZECeEQpLZ)m7Lp7@;+3~B1@ljBprBEccFt2=fnU=`+0>gTpDZ-fLucBumF(5&e zgZ!XXc5B-z*Che`{9!C6`@K4+gKCnrGT+NBYvVUxG{ehiauF>7Y)gCaq|`hQR%Tfs zh#CawUEU1GRXQNeg9h z;Na!+$*3fJDuu%Z&x&BT97CG7wDNvPp8KX1`sBw>LmbcL80ES9Z5x}B^V_8oHF(mq zZ?Exm+p{gXYEG^nf9s2tnw9#}ahh&tDTL{_^yiB*X&jt~#2WO08SJ5z9baymmmiA`dd0O-i%YmWjms z7)aso0$QxIudtu&B7tJVmZESZ|Eu;!p!#3r9eXIeeYV5Q6ae;s_bZ>q6vDePG3_1A zgPn~gn-3wt9(wEm5mYz~E2CtJnzG27vH-xWSYncVTG1*NfT zGVT;aM+VRci{$HfFk~6w-v8V4CQeFB6w)GTbMOg`f1i{GDoV4_pJz3{L>I$IK?7$~ zqm?3CpQ;ruOU@Sfd$?iB&J9Ixw6t@~Jg=JRkpkMp0sv~4;@Zs?->9w@QRWT{(cJNy z`vQ;6>i}$HnJ*bi`2z0iHfH)Lm+e|xz}Ls+v;}GuJeNZh>tPUs7jeI9*zb^ZK8a;4 zNA^*1ZOE8cJ}yVVwzCv>({cHF0vVdC8WK&l9W;S24jfcWgVI-f|FzX?K{q7x+_mOj zg;p(&h6&BCr$CNyu#0DNaKPPel5+jo2oEO= zf78o+bnlp4*H>M>kpk!X=WG6>)MbTnd^WNnPzVoU%H^wKu%bRC*GFA8(ZH=@#O}?2 zG8`LU{Nl_Ucw%)qsLjUmJ;`&G1VCXl!FR|#8ONB4l6v&yJ&6~;dak{1kvDZ{P1)xx6ybFvR-BMTAhv? zNIfu}@w9zs|G-U#533-N;IaAFs{F_}RJa(uDoa@SLcgS9c-V9&6B`K79%wA4P*OyC ze$y^7!}8|v57+c3-&@uMeJ)*Wdkls!x|HX;5v{D_RITW*f6*QIrWTh1>!9e~H=4s6 z6@?U>LEuQYvq8C^M&vy(yp;0iweCZvCo7=FhF|Z!FJ*W*sEc=lMUtLalF#`>8Ycr9%hy!=|I(hZw zw78O~dDnyNVa%X0{#p30d#N#dP3C zA#%-{%*SR1c@Ff|=M&>w2(ww!MEh5HjX?w=z9QsYon`1Xo9K(n@^jk%u3A9}+uVU> zw)>K>qKg+WTce3Z{gCdm`4_zg`EL}0Vidr95L$U<9nm_y%`%U%Y%dPnQXsT4ntSzW zXH^d7rcQYlXVo^2c%4rpX`$V|Hvz-0N#u_oc^lirrbQc-a|Tx+kPPhI^uUpjE!T@R zf(1%xEyUEeXvLr)<4#==sy0$RGDav>f}$Q@Y8etBqZ~y%tWE0iBfmY>bsqB~aMh#W zmL`i?1lU31bv>x*bWmrDqH3_}Gk?wm!ZL6)@@B7FF|pm)bt}rq@Rer1m5M_!x?(r< z+~xMMOoAG*cU!Gn@k2<5cisEaF^AZ%d z;ZJxB`xqzMs(bGRt+sYSrnHAto0{jlA13!tjnFqmUJxNpU}y;mzJkPVf81ejcKcn4 zeXp_3WvIkUAol#Dr2g5CY^w|5pZGV`C%W3L;}se`dH)8!HRA)fq3%%`W#_AVOJ@t8 z&c9GEJjzDanSWvf6Cx;pN_HJve>Tc?)@9p8&vre!y7z$II^2%IEPWoQk67MxkFHz7 zXWX;$)^+kkr7VP7FT+~87Wn2BGXnin7p2fG=mfvrQA@IS$?J{MvhV9rEQCnKZE7Ii z1n8wB35&HBWJy;a7(t86B5tXh*)agjz^7bRX$~pG`^xGMC^%0&JF}e`^z2eqMiRE= zmN1Ktd3Y?z_jw!eU9S>!D?28bx+2&1Mq3T(UwQfu+}t6GZr$hmtVU0C8h*Xurgs}2 zCdW>YYMy)>^xbFos+y{sk+<-Qh}5JhQGP-`WoAvQbzQrmvgd{u@Hp$ZrvCj=h9k4n z$KS&bz}HE~ul944H2d*lRqhm-dvWdW`Kb4O&Fg^psPg-hR3_1p+mdmI4)}Bu2y$#5FDQpqZ&74 zDi#|f;-j9XmihJPUBX;8b?xTlj{0B2vK8p;CA!gNf5_aoe-97bk}vff`x%2h^2kxO z1WeP<)E%tur^T@=i2Ef4_iok3*^#73YIa*@cMU&so?{!yOjPMjhnyT>?X0Y5msD6% ztX3|2ISz4fW4_>TtCeiq&g!|K)~)tS?^sRN-1n;8DZXeRR(eT5yU|T?XXg;#W94Xb zI21S)88XdJi=-?yHllZ3TVSNB;QO^7J+Ihw>BGd8yGhwv+hd0L`iL36F?jFhSX~EF zHI{@LlZlMm7_pkESs~do-&6D-aYSsrI`O*pA5-lw&;9{y2wTUx5_Pl^lxDZmPY+vA z7=HBZM9r4Im-T`0ACvl)O-)G(!{WBu_SXf&RZ}tTO1o;^Fa8Wm&)aKlAyVhw{CcMH zQ%zLuu(D_PCekbR^D#haajXpacA0~7O9ugGxbxLYxR1KViil;=b^}~hucBX z^;{E}+j0J8)~h`Zt!@H}oZboCqeysBe^(@aFjXw4p~u}-j1f0^jTSg@)9rz~pvEXF z_xntrPkt5QuVqgRI&3EGN2=N&cj#7gtn;tbKMv>~MNP ziasHwm(;}&S9^QEeYMNH`ybPDij(Jp=1E%T`m-~CY;WDI(~{pV_L*6Kw*NstHr}$E zIVV@`;vaONq29;16`6;~OX}ObgZpoO$MJU}V8-yQjcfh9l)NG%5_N3~a1kOunrvF2 zNf96;3ya5&u$xw=ItV^#t8xh?ui7p=I@hL%yudP92+YOz*rA+ffJE!YP^bONZ0wAy=`@U6Nm)lif0sWzPXhisB|++*ZPb zk;GF%$64g4;@w1=9;o%YX;~dOH3E3)g{Rh7`cKT3=H`C_ELTZcmJ_O{%|1u4*Pz;= zAi-d0X;WU%#I>_|_?Vh@57brPIg>ga7s_A6pR-TpOp-4MaIMLiga#mUL{>5fehi}D zZxgO_?wc{=pp$<`ku%ckDa)-17oHQo6DEua>Z>&fNzP;*MWm9+Pf?i`WohB@Rv z{no_B%OW3${qv!Ro~)!+)I!ANkN%C; z+4|6qv5SuMMI;u_`_+2g7{dx~yRcU-N3`%?D(SP}TtA0nWAoZGV;AF>tR{OHRC9Ou zJR&?UH#e5yHT?I@C6#f4S}fxmEZQ47J%(Q zT4YtYu@o*~FRyS3Wg}JRRJRm1YHP+q)vLC&h;K1^BI-dsrksM50uilUY^G5BHmwAd zx1lfd_FGtzlGb)*Ja7ADwO+t8=B8b~3^N4bIGl@TfJ0nRJLM17iO(FV@js^VT{={=Y?t8s?PIK{Nr_Hiak^gf8N zZ0Bj)Cwj;J00AmwZ-@+G)weJ7vDiF3%_ozyN|K5$)y*%WhBKG3$M`egpD;f&c@g&m&?!dH1S>j`-9$J_g}@G*C*>2}M>D!?V=#ar@_G=76g1_6!azr!JUPZnSTU z*fyR0Ko3`URZq(*DPedioW*TLsSJ729XFntD*E;A>Id%eKmI;+jiJ>JwjE4ueJBiS zM*LZ*>@6d<5YktqFTI#ck?U14>$FYd_qeUBB`FihruWQep?Xw3I|$`fQ<7wK+-^0w zJ!@O8I?_#I-L>H8dcC&(xU2r1j_tHX^~>^B++q)TW$uebH%a0%R;KecV#Z28pvrcK zK29IH7R$Eu&pQS`^vcH0fNt}v1q>Ogs{`{%U%6F*FKeAt)ZFX{wsLJ~a+EM;FZCf7 zUK*+d*ts?3Q9X7aRuSZVukr;zwfoG%Ls0sucFn8eclODCc?35x4GV()DDa)^Fgk$` zms>T~9N+t0D}Srm$c-CuP&lbeNS?<;?{fb!V8;qS)2Nwn)olm@N)!U(-5lGa#(-4V!B&h*ayK#ITA{4DRJhz zCQ%h_a6R`857j+;9GCARH9ER(>sv0S6crT#F8DK;y4FM~ z^nO$(h~XI{EV$XGG)#7gq>SF)|0lCG*oeh~HPnR_C&0limGnKL!mjHm)g`*o&E2l` zu$`hxjOg<$D$^}Z3fQv5)zY7Ncyuq#>vyNRiHi|7?HQuKstt{Z)-M(Qq%9rvzAuzhRtm}`GRCEawZagj21KWMq#8?2p7%2z^`%|v zyx1|*;97d;PCj+0@#C3LSJ!xLxS3})qs@eeT@SqHP#2x#mU}9}(yf#A_bm@~NlIpS z8jt6OIjvY-Mj^yqq64xKT)fB^6WIsMx)ct9w5T@O?;|0EwY`U!?^vZ8orF2UIEJ7h z@j}4_u|yRe!2_AW*7?=L23sw5QQo3fIsJMna>v62{+Qm)Dt+GBCo7*^+Yd&6DvZ~4 zH)D|1FS7Kzzjm3+}b|F>v!vl3S@#LXYaMM~5Poa3DMnyVbDE70adT-C`LmwV|sw=cSc$a~z)=zZ4*6?2P#u_Hni1GdR>n~TA11Sa*#J$dQRfhw6+z>1SximSj6Y?rKF(`V-PIMzM#OVe$UWD{&X zkZUood%LtPqY86UxkUeId1Grwg4p2)Yt`)`PYysJ>4b?^ejD+JIIHT>XY}yJjyjTj z*0Zu1FyCL7rYhB>lyf6Jxn>U#$5nhNCGE1@$6xMQReun#3gRNE`34dKF3TNmNl@)5 z{hiJhPD)Viq)h^I^w;gu`deA8(hz@}vXky44pimZ-^0)2n6pymI7ZmA6Oq$*N(;5kwpT>hx8i786IxYiusIYrcel`yVBKtMG>go!U z(!aVcz1npP;jKwKHw9}*4La$Zz3~+J; zE?FTqYX334uZ+QI|hwOi5&KpO^C$TraxqbVU>3uS5tO*h)w+9~b zY{kaUUeMuNr>8eDta8=DKYE>=-nnR>+IwtvH>@%ODOwt5icB>pF)^u(;hCw{U5HTWrpSi#{QeXbZ(Yd%Y{l9-)LI{~d z$axI2OwQ+WnA3(B=6pUMV@}ZtIc#&DF^OUfb0){>q@1OkPf>`md_1c3+xU~KJQC=J`v*{I}VUO`0AANpMRFW-q$DuTWkwRcsL(5kWc?(c-#5( zuCH`oA93)$Ano(>=de*^hl64xU52Aj@vABEzClx;%qr0BA_3*IvZ!#q@afd);mnoA z+6Wz@ZVzhA=5tYP#0l0%N?kUBl z$PC9S_^?Qdpjpp1I$xAYr#8aEyBaJ5);nFQF0CgI^nD_*mSASDaXiF(37+7yaBsLu zCvnVZAf30$H+VizhDX^+rLjn_#Xx(ytk~zZIoK2ge)2Guki9c4FtwPo-y;q9^%o!& zhkGJTVJo0@WSTh1&s1YZ1b`sC_YDeX4pGXCu86;54Ajln^!M@2i|5#d(apN58k+s* zubV%pi}H5AGN8*hvaP=8LaHfydv+p!N53DvPLDU;!mdrVEnNE$hii z33+{n<|IEaCv;iXTYlxFC`;aRV;*hQ7Rq@yrN>63tAINu!4I?Hb|u=|xJR6C3~4fu zNnP4L6nsjBHF`c<1WR|)5%$5|eZG0vtV)J!Zu6BSgTrkqe)6=HdrI8Lb7IQ+o zB$c#4#9iLxo<8c2X26L;Zf3krr-at1ml0Kuy=aaHBltMHP>p1LO647?6l}HVcM7pxkL&3x=K#}#V=}+Rw z_us@2Hp2QgV4jh~K&gvj<}klF>Hf?t(cds8lcfn70@rC)qM<7O+bFHrV1l1R1AtvB z%J!Qk7$WF)rKCvPt|@LV4+lr>}Y636tS-gN447~kAhRX6yWmcmvgcQ~Ag8St@DWjgLDJiW5Gy7kVvP(BCdSkOr z5#-D; zcy4ThI%5@iMM$(fZwPDI!M2#~Uf>lp=aOrNRgtwGe>b>P9>%3=M=}W?m~K;iOfDdG z|8#hKz&O=7l;B{UO#qv4a_7mp`Dx?IlmXFZFXX~%ozojeyZuC`qJkl1%h2)DK31PT zLXYZ2djP$0hC&S(%Ni>6hljtI$B5}Ep+ZeaCYG%IzJH3a1Sf@s^Qgae!Qd?oneaSz z+C|IrcPxFY)^4_M2o2eJ*Ij>gwSGpMIW#pia?VXsZvx*u)%HDeQSty>a8Bf<+h>ZB z3p?@=_3K0%^HPt8ypp)CZ&!51o-y@!2Z3Aoz2BH)F4xztJE4kV#TQWxm%b7C33V{m zy9<_%H^1WEVx#MN%VJ;g6$5SLtCCTpmH6o}+hZe}LWJyX=(a;v7*Mr4HgQn2v} z4Q8Twk305pvb!@D+$O>in((5!$ zqa2+=Z@_X^nlceh-%S|TtkSC@Wl4xO%{+>Kz`9X|h3BMGBitI8}R0jTNxWRE^U~$Q6gG zedgtg!3W|JZ?`iSmGI69vd+Mu8vKSz{ZK?;^kD&& zp6{O!Bm;-ym(3?*R+>|Tr|$bigz@lfx=z+E-^M7p;jW~0tp9L`9cwYYa;3VXnulkV zO7Q&7HDTJ88W7g#CD>RXIP{FispioXFV`ppRplI0p39dmM+PXNBRgE}MQUP_o}$z# zn1MB;nH}o;X>W6iTXgzAS2HRqc3JLq_NqR0yJBiMMD#)}gYb(a{F|FkEaQXwczu00 zzjgmfTVQR2bp)`iG~FwIZQfrxW0xjU3BOm^K=E-Yfh2g@ODM{D=#vCuW|FL z8bIR5LJU-2E4x?5)d{^eqMl4Y-eX@T!`I&vtEl*P7Uu*MAN zN}4PWx6BDv#oI zO&x#udREIPkP55?+Wo>Q$ryuZiZgq;6r-@M$TufuAi)#3bE_(kDHF+57N5xU%OSlwwpQtb%% zJ=s~elbZ!Iy9X(Dsd7lVgr0%VOttq}ID5@rIf?BaU8HQ>_Ydh}rC;dsC8Ml-$DxFe6`#ppW@EdlS6X_%~zDUVK^ht3A^zUBsG_6KbP)1lv52 zM^Ae_04+7N?dBgY5qF4luM(~)UBvVl-`$E#SlGrc{?%rhNJ$JYL};PzQg}@!na_^4 z0c8FhS^i^KCt$ERu89{9qjr29+FIbvbU%Rn@QN0Tecm- zcVLYfYV@FiBFtNPJ>J~tjLns;I2|7_w6(6i+xH*C&GlCo=VpVV*RO=M09`$V?*FN+ z5eWG#n}O3+-@gAYiQ>i|=3GlEAFDP20xJgBMt5TWp!YsBH9jxZI)BshUj7QFy@IjP zbmg>JBmU^jSngte`c>l8Oa4u}wsym7UER?C7;M)5{!^=ix-0zqtQO`l)oy8e=-xbR z+XKLbd7TOOMN9p*XIy(YfJk2p#^^5V_xVDet`u80CHT_V;Fp`;pd;qep8Utqx$|J~ ze(5dBnaT608@S?I>4K!&r9tI6=yDWwpiDsshTz|D3o!Z#~fIg?Fn5oevZ}SBuU@QV%Iu z%X@K2?qDq`oY&u(-2=@6VI5mG!7>9S=DOO5S875oc(#3gAZf*oId2h1$5ec*jpeDh z-5WR|X_KIoe72f5WPGcQE6l(dIRH7j`Daf_RILlGNPZA&ucp4V-}L3d$C}|k3tkie z{Njg@xOCZHbH8(X?@4(+nW=@?IA&>u=j6yjQLODEZ;6d785AMnc(Z>^YILdWjvj2gi6wZC`q6|LGdn0OIFB5wxfW$JNNi1KB<3bi4op*nE z{1wy9Nb3r*4XYqRk`jRXjc+x$aALg}6p>k(9d-h_A&!Y6Cjm$ULb!%ldBYrsSBL(PdO_4n+>{ zTCZk6w5&}uy@h^C26SH=u})kn@A3lB*M+iwR*SMsOyiJB25n|qG2lY!i6!Zx$UKQV z{0&M>+ycyIXQjb@tjmElh7r;1Q;;sQMB2r}EsuPVm$y?{^2c7)+gEH#;-#*2Fk>L` zi|L9`!)o6=2nUmWip908Q60Zo0Dr9@eQM321PaD1R(-Ct*R0_H;hpd-PGyaBVGA#$ z38bvGkE=qN2PF9P3MIXTYp^RpY`OHLvqX6Egfe}CLnaa$F3z(({we)74juSZ6PJrf zvC)A~>ZeYX@@mj@W9;{#vYHDd=G+01mN)P1It z$iP?o=1e8ZCD$ zZji6``#;20cpZSKV2o@uu)PaeV$Y<|qOfP71bpFN^LES4QWl}TIPg{y==#T*QSM!% zhs7^0tUy}%Y`Skk;Z5^LgU^5Eq(3w%zg(J;9Rpo^EAuTUlo02A?Yvx_h5EO1K5{xuH>eP`Bb z@@eM%_&}|OGe`O)A}Z%}%IB_WyI(~ad-*aWHqzLLtL@V`UtR-~2}qM}?=lrIOJs*A zKpHsGe3e{;7jk0c*Iu4Hca9yznhNQ`c14rXDGRgg+DjxM4l&w33XqYoO34A zz8{)IfuZ-jdID`r?iAv*7i*CjtpwCxSr>Lf>J#baX=IA$_KUtw4ST@yH7xX=U;NCa zTky|;sw!4G5f>uY+iV9)!h0r3qp&USb9jfu-mx-8|jDw;TC*>kIdPR_}%v$&;pGq+m#HHm6pyq*sOJf)$oIJkiU(4?To?Ga|a>HWq$$H{ih z?Qy|r-*(;$f!m5^+H3^NzxV25pct+fqLfQWLhSE-sz?f5@`Kw%ewRKDV@1>u@BGJb zk!mB8=#mZTuB7qXktD(Zk-3yd0|}!KO;_Y`4zf3KKdiqOp3dmQAyeugE2aA-6^m5D zivAX;O)LQYG{~V|D_RoH`Dq-RU|(`971=C9>LHw1YCVI>gQ{(Ra-8>#=gA2Qjef5k zNWcK~`WkK`+F(CS+|1^|Fh4Q!cxY0ZF)8p4)_>Fq{w&(x60RF*vz(*MPofird_@YC zIVVTlYSdKhlnEP~D4AmQbs73hM+;p3;u2JwcqNOici(E?~Q)wW== z^J=H9RyH@?9UP-8tuc*-<@REc_}>R9TRQ+(8#kbmvvY)onbqaS4Ng5>Q{3uQpH!%M zT+MQ=I*hX%H=vIEkKvuZDE;c?J2=QuXJFFxvh%|?GV~gLbCK!DDDG*XC`(X4D)}EG zV5i5|(-1*VMC?jxz-OKvX4&2DchA!t|5QjbA;qqtA>c6XwiFwL^G}Jkp2FnXhboe` zDh*AcZTtMjuVYUNSPB-xi~|Gg6uR?`0o%6d=VslP$X0LtWo+t6l7b^Z$koNb*sKXj zRLwN}i*RaWNT)@m0sax~!{wTW5SDCMx0=;(uVkS*+AjyRHNb2m-pEeY}%F2_-Kw<~wLMXO~*)rDcCi zp{9l>syfgGR}eKrDUAp4il_45>4aUon~3mZWVHV{Zhn-xLpjj27NWr6bEowXTA-)J zhBzCs(GwVnCek># zEulKlS8%#~A0Hc*eIht=A|woZ}dYzxidLiAAVDq%YN>>U(&JXw)y} zXe`bq;1>x&w3@Ll+?mD{JW&x|4txR8{#T$^R5KqdNj2gx-3BeUUVFf&Vh8H-mzG*0 z)D8Y>gwZIp%`1ZIEz_db1^Zi3;ZO9H4&|opgj?B6)_ul~lFAnH+cq{mIFHEXr$1_e zHa-W6-)pNwL_;ZKNfEb)@6HVrBbp|kOZUI1BP-JOz9~J+*>C_V7rFHNM65eO|GcO= zeOdO~Is@J8!2Ff;qP;XLs%Us{;<~`*Q$@RvE-gSPJzZBZqt^PdL9JVI_<`WjO&fVm zC!)n^x9h7`-Sc%5sPFq5R)*^?!;#<49&|ce^t+RYfrGy)f;HeMQA!$g{Q>-O%J}7R z=2my(zM%R%ONuGkvibM(I^Uv9^A;t1#{1Xx!!gkZME$zOpkDIbO5@3N&SYWd6XH|( z>bNT8(tbnM%nj@7fy3yw?sq=*W4DG71&3e{1Ef;RbVbH6~8x%`+4{3V+f0 zI^jPC{O*)SAENs~g}eBJuc{qZt`5gJUp&6(dR5H`xBTvZQ2FHigRgB@;`|^E)ws#E z5AKKi`zeH%>wTBWSBY^%@fx$Dm+ML=xvAPP*8!Q;M?T)=t^_K;ef+JXm=pUyjk8YG zw9;Q;#x^Mx=zk*({SU7Go3|s|e@Xa$PM`q2h?0pcSU7r6aB}~J``h>D?NjDQ0q#AP zcjbkbW34ou0E&zf=Uvwy;&*IkwWmG(05tbc*EKOq3PEx0xI4xZZKmXaidn0qfzM>k z+{3GisMA3p7RcZuR!}m7&Ai3;erv+!sMBt`HbuUcdElh-Wy2SIAd{Ph?@O^UhtW)f z^3Vk0-M)t`l(r@GIE>x( zz4VCfA*y}pF60lNvfrSa8Db_{MF(s1NYCxPYA1-d_&u?%whZMF`DxW&XnSj zrL~0Su{eu;Z?&|tHxQ$=mT3jdKt&I;|7R}phxpGF)33m1Gh(}4Kh=MXuQ+#KoxO~7 zVX26T!o7nkJ8p@}b<;fF{KwE5ohws(>!S9;>yvfgh-ii>^Ff#M& zaAp@aIMNW*PPM>7!5AYkxNp?eIaqSL+#!j16V7^Nhpk(}YO-}5kprR%W?o=6`FQ}w zyq*RW>tf+{CwOGs-JdO%VD$s_aUm_%dvvV;Oua*H~HqZGf<~1dFu@@*TO@ zOA;Ww=*qU5>f)*$Ihx1f}xd$lio-)cob&!f$Ilg^A@XCl9qAGL)pgDHMZxr z?c{z56NaELf=PVU<($lXXVA4aYh_4fqfWTYH>Wb+^EqTCKh~GbjRrzWSyb{K}a`4a2`mljJ1Dx?O+Q<%lK?C+_bc|ZzKSu%M^gF zx-C&JVhw98W<7t^o(Y=E210+#J+I}P%mxyQ8L~!h8mRmWg8x(E>xTxxPtOUZg<=Ck zS+%Zik651}OeL}A98Rr53g_e03OZ60AqB!uZRA1>TmmUwyl7qg(3>|*3&fig#xA{4 zEsum}iQewy8)&xeXji(W2bJ{2D=2CsGWZThOySHnh(tCVcBj_c$iQcgrwA6!c!a>Pt-u-gpP z_v=iKC)s;sLJ`T{t4|hOEz;Mk$xZJDo1?mEW&`FJ7O7yVKQUz%ATfF8kl1x|6E}D^ ze+RAn z{avIab;clX_4@i{-gZa|XbJDOweNP0@EYZLk$!T2L$gRbNhGqCHJyvLMxpg{3`3Qi zIez8hT$0z>Zc0NS`iiyo`zwX|OOj07gBR z+JQCD??^k|cB=;nrD=Jq9-p~Z4r>&uXPzAH%EBI zt~Y9L?K}nES+K}7SyrTFs?$Wo4_`f!Z`?M)zOZMNiD8Ao z;(11_3Uu-piRf=ixHnyDoZNlBu8pXKXE7~|Z3WB?v+G7YPB6xAUUH2AZR+ad)cMj% zM2wE5&_ye(8QO7wJ~vN<$wt<>M%LgXDmb#WyX;i*;_XJ4Ob%~xN???o1|snJ;6c^ z1|91DQ8z}GeL#OS#JbvUr^>SKeC|(qM~aZ}-8UAhJ8drA zrsSx8JFD7)mLSp}{D%wS(ZvTm74NCOuq_)J9GX6wYXxh2f*Um!J=>+*#&k$dqm#)$ zgRgI-mAxmJ^^v4Io$BmSx3bbBc3rhA;v&*w|B!2Hj^l-}^!1!}wPm@0J{`kiUe&zG z6Z~6$8S7Gg09ikuW$pr;lp$tG&4Je||+oRE$bAfg;Wp4PsWSs<_Nb?fc+b*ZnJ zckJbL)$ArXbbH-vpPFH?MT3(?f$~KOKC;XfA6e@WBU7{)!;Mv&{l){XlBtI5ZE!+5 zh(4GZOo|r=rZ~ixauHI@EK=QW$rtzOA{IeVOKl{LzSZ5=aIPktzTcR>W0F6+3x(LI zZtFE)jhA~-w2=i)a%Xb0aT`;sO55^n?UaSDVWDKjVb%iybn4AW%=6h}li2cNb|?My z>jh<$@W)pDHhD^rql#;N(r^73F_?O(ni*C?qN_7RG#a;;TYujM_TCWg?;jw^8<;A$ z^)Kjy9;S~NM6D|IR|@Q+S3$?-*lNsB)!_beDS$oTT8Qnmg;_E8N#TtG0Jxn97rr;q z%>HS^#KZG}$gGoDemkdzc%LHj+a@xO9sx5Xbr5dU0bKQv&F23@^`pGnX&M|!c%HTl z+{O#fJfm=6>vVAT;{|73qI!>=BoF8ArhQgh_eoOPuEC@ver-;blkGB%dk-%*?JRp0 zM6_H#FXt# zH@Nd{OtxWn+jZL%gNQ@uGw2X$9ADzEfy{iC7YA+Eu?a`Jp6QKyV&oGs*yt3Rg$WY3 zN~V1AlVf9T00fHgu(TqoPV1U@9r0xSi&m`dQRqz<%D|grBqofze2k(G;+x)9HR7Bn z%Wzp&-$%MAHPirtHL}6(!Gtugz(VtMtLQ_HS`4+&p*Xh0oK)iiA6W>#ZeE{FH}BSZ zkpyct1-eYB9?10<*0az&$beU^e5J8)I>jU>*7}K?x%qO{4>oyZ$xr&F)j>!*qU!Oh zx&9cDYEPD9Hd8FrP4uV9E{{tstFur>>o&-~p3912{nrQ}hq;9O-Og{-6Z8=@J0p+j zWOzUG)qPn*$2Y33!W-7W^R z>$9W#hAZMEvsz-x zyBbmDbcO&{oyrx27G6ALlglpI)`G8!RbI}zPInaZxPZrIaYojt7@h%{qimiXyW{fQ z$K~h^uf4Hff)e+Fz#rNDrjfHF3VyC8oHI)~&|eG{g4GKUV|^U4%l5m4+GA zQtxn9Phkn|zC1QjoQ9am$RBVilFK7939CSnUBc>9TIgmyR zvOvco=$)#Y2Fa3utNC|V+HTBqtP|>XcsMgVVCAPOD*TgunLvquPgX=Q zrozPEf5*af^-K} zh~$mFK{Z1UY#!xupaF%5RG(zCz$)Dv36C;h}@;g7?d#KhktK za~m^n)6w;wjXfDQdnr-M^=D1HO?K5XYVfk)6#-UMt%I}r-Opr~J_6ZzmAy(<{8|b= z!>;V}<2d+<>OZA_OO0L?QW3EX#IlNUGm8HXtSdSu%a$-O-&j$6V9+Tngw z#n{w>S=Z28$jN`}wZ}MX(U*va)tmaa;>koXv;akVOF~A&rLa7wgHPY;7XDm0`Aj-K zeZs$%kGqpT(e}cx!GvJ-6uir!nU<+J^QxHlh_<)y$1%+)NzhAD&CzUUV@f`;EKBwvjc7bmOztX`SY9|M5Tg zSp1DC`o}tTOQeKvz5Y;9$KE|mMTO9eTirC_&&p*Tx>KNQY`>AITrlBEwUw%lc#ohR z6%4Nb$1to#mym=@fxevT&yCFR0qLl(g}+Ki4WGGg7ZaB0|Ety>mv%4zZSUW3fjG=u zzkGy#{;|3tWK^>I9+!K5h}U)K|DR;L@1f0e{Ui%6WB95qr>| zeUK3Apmc0mdlsW$oB`8_bYQ;@B=M!Yl4^stHg5OBk(7VEJ0P8T7?qR&Qu1%t#BC3v^P$i{xg@y}=4t82Tli|M*O+eO8Be_lEo0X(QObDT z#vW@6sy#cSMsg9>)3GWs6~mXYn50GUBw!+q-$vXga5(9QTS!Dg__qJDn^2yJBO44% z^uTaUMh#CxU~sBPH`pm$X$Q6zI$5}5j?Nrc_d`En#+Uoafr+0I!)a*ge$VyC=b8z3 zFaS+&6`+trR%25zi>tv^pIG^MruzhbO4BKx@EcSt8+YFJYL7h#hynGR6|ELCqd{-L z)v@qqQ+hS{WQYFbvrh1CV-!%}%zCwB8#2eUB{vKaGjf|TjmVG_C*%sf|8kQinll;m8@ zEqG2w7;~%JKec4r4$B6538Ms27!DGL)h3ITnt3mw8`xJY@?FHhaOL8Vzv0e|FGrEN z^iu3YoGaX1>!OlSim7zJ;2>Ws^)3=SRBxRs%y99&*KGoiAm@;pGlq5r;O?^Bq)rhKp9plVoL zl~lnScAo)(J_>Df|*ja+HsFChf8CP7Cz~bYOg5 zx00c5B{5wMei>Srar5`hi!Kg4Ut8xM5r`eXtTKHM#{e!+SXbww*zdRd2FCD@Mv@?! z-0S7M9{$1VB4-6?z8WXPAf9;MPT&zs1r*_@30G#$CKNA8W%dwlhz5rj$iDkDrx;c0 zIdR?0R=2eKZcQ5W0^sU|1~>iWEgy*t$>~PN)K2gJC0Uh_p|18N!KF2im%NYZIc_aJ)XM#*f@}gv4Y%0WS+(}O*vY9RO&vtJb$Iiz z;is9pn}G%`Dw%mUU-N_%dPl>-Zlw;XSKV*i0X)JSDx@lj%a@r4pfe!dk)YbF z1`@ytPph+;?4aqNzFf7m=G*tRv~nB9SXQ(90udJ*Vs0C~qlv>>ARt<-*M{Zj$S=2%?0CTUJm<6vc1lh*w z2b|M9%B1vcOTjteEgLeW(@nIM22!qw*~_T7CD?d4q|KWS#Wu#z#sfBNF<9u=r}~~MiGOV`TD9#8 zrjzx^*_PL{?B-S*71rr!6El&3><&cNAn2Ya(lEC3$N?CJ2xbB;L4+S3Ig_Y{R3l^f zloIbB{9BXWpO=b3=%04n0CjG&tdNVU<)NZ^(G6D2_7HF13DYWh;2nG8z3Kyn_rcPP zK%@({ZK1bOSwvyK(Gs=QsP0nPGm|})pW;QN1SAwxd+P(cPs*R9=4|eqNw@1BCl1De zQaeWo@KICj)q^YZLfoY!NEPHtotg<{1Uht29^?f7zDRTVf1jq&$A%ja2Mz1`*eB8x zm*D~J)W!UIKF=TbMnBBj>!b05HjVaT@mJSsk&pBTK%2JC?>8--9D%^C3jA;F{&?+Q zr(H1f7_|$FGNVK@+)9BC|K(LT=@)8AW4ALBT!}aAnsNs;6r5Z51rMW}plj`yx_kKg zoNBBpl8l4>xiCY1ORZB>WkI%kh?bjQGo{4gBpsXlE2ujO4)Aol3*I^o&>-Yva%u$~ zO^0G~6|GX(Ko4&_T{4?j{r-(djBMga_5E1|DID&RW3E{0ux;B>7Kd*Hg^;brA5NBF z19L|hC!n`?21CT*(^gagjs_$xccP6Ec_DVK--e3uhP515*>YsyMQWp&I?ck);A@@g z)$*l`|1lJSq3-2&M?MjS@Kif}DT(f=;97YWhs7GN_(ND3?F{nRCM3msd$_JNe}bnI z_x`Fjmk|x$L3`Z2(uGa1RI6$LvOyK}&NnV8@$i4I3Hp;_JWqKvtNqwAbV(|BZIkPv zaq%{s9?_>6v)ei0$_K8+KIK+hR$V#`rjs3<3c?#2ZYM;ptmRMN8=tA!wJfS& z+56kMGW(6t0?v|jzmsD@?Ne3ZI30ffu_hugZ~%VKGaI*IZ!+Iz1L;=a61M8oXFiZr@lX>0Kby*2_xTXX)uf=R z$3jD91gF^YYD|M9|73N&1}wlznrzXLkt{(oS9vF}`nYklJ^V7ok7}swv{}3iZu?=w z`%zEN*w)GqL>cp&y*Ng7lMfvi>afw$Y}w>%Y!9-{CETv?R%>|?5O>mYs33m5mv8Jd zC1N3P?T+z|GuVQ)!kVd5IQuPd{J2btZ;t*bZu;Y{)CQY8+YoNyPCjQe*f~x`x>3ij z_wodIiW>cgkbklA43<4p54OKa%^ZC6}^ zo5l&rh-O!FB`S~40qTE~&rL~e##XakjZ^C(#PAb&cp9v~uva1JmQGDt5TN+TU~rN2 zef35Vx@d6pt{<7Y^W>Mknq;-cCIKqK+Ps^DkX& zP?PzOVKYwAl)0zRB~0s5ao4z;uS3}{g*$dvp2_^E0DW8H!Maime~!$m>)*!j`xM^4 zxqXXk^UY4-n2}YUmN3!fYw9PB1Y**Wi{06My3gL4`0`jjBaH5I!SA{&``@T;TI7?w z7HYvI|4^YDu|x=z2VL+JoAI6;^#4KBey`#++WZL!1Ud`HOaK;hcb%{6!_p5F2s>?b zt?6i{y}XPh!MP!(C$nOSauYs9=KR>LFq8e0e#60^O^m+ym5uCJQ(EUk;9CXi`>s3u zarp7H_SW~S?Ti3n<_Ch^E?Q1Pksh<+t(Fgd-MNs9AB2Wic+8zYlmV%~_mS>DRP-5c znmLjw0AHDP96X&yTbKqvWr}(<#b*cKqMMGYkR~!;no3TcNmo8|%&JWv21KO_^!fJw*N2 zOuOx!B}928%{wf^0B{JZ4?)rmFy*o!@7;KjXw1j!)!3gZ1@Xm$A>e^94x;Vbla~~j zq3`6O7~2u^+Ee~6#Z)cWu3%H0!0WfaW;EODrm$K|uT(bTpWn4Vn)~@OY2WHWebh~H z(LJBD=O2;}1VYq@6rivd1C?W;{O;#@7`FY z58+&Qt*1i3%b1^iIJeO=*CUUHw9b`c?S|!H)r<65+aSl|a{Ggl8zZ+X(l9_-0&|_S z#$}|D__BjXWr-J!fowPnr0z9ijCWx-pZ28hAV*2-|iJ@q=S^WxTC=~_4vR83c;Ya*z4Sm-4$y~l_C6z zwK`V9Mp4-Z7a-Z8i_GDbejhoMSM0*p(M=rpOJK&Kiwg9@!cgj>x4g+6M zocWuqNXX0SKaz~8OqU(60R{Fmjodh~6%ceTMuRDf%*F2<-)qPurk@%MW_5$EqFQyB z^s8=!Zt&ln#N?beN!kaMu=J69nfZLNlW(Mo6@KWic{{L(ZG;M!W1PY9m*7Dhp79__ z&^faUDR=^dca3AeT;hl^o_UO!L1f~@Zg8^x+A1NZ{W9pOqm-J-yWzlaphNxY-uqv66j1?v}_5hYAdOX19}(igC7kTd{%qrzKC@&%Jw7NnFdWfgV}kEHI&Rm2Fi z=2vE`%iD=y3}7wE9dfd7w=GNoHq`l4%Cla5E#I1@h(};-Aw1cZ(5nBI2_DzasDFN` z=>9%anR&bq+CjP3+9yvcqJP@#(mHm5l@u^5SGh#wy9Aj+{P+&j0*Yts()bMOyCG~A zp6S~05~v^H>&3`~NRt}EHe!5ItR@OgP( z6=+c1O*15NvBh(=*kh3Ht8kT}G3$Fs*emLI>lbjvG2RtXLyyDrQ3-4XT|m?Vo>gbM z&&r91V z!%H&rK{HiL&+YN+w%C`a(Rd`I$w5;4WiX2hP&o{`3Ho2qx}_~w;(WqQ%U;$5YxASZ zAJ)CeUeI!cX4WB(S4jY_Me9Md%x~^wG>y?h^AiEnY&j78hB#?{OKH=><7@Q;qzdO! z^2<+hQtg7f__QQoCa*u?*83TArZ8y^312;_Y0TSh3yaeAqDV-tYO;pRT2M`P@WW}= zbHM$≥35Wmuz2!<><&Cq0|o)N&W5ZJEHm>)ZxqaL@GKVMPYfI?MW#}MyjR%7L9_nJIg&hhXKhp#&CJ1z z>XIV4!~elP^T#B$|IH4p{nn^^qXYN1YD1t9gERyiAaNB$q{rA=J{U-=}1+XfL`R%YJ)xqe5OmmZ2vC=3hP*V>4 z4eVADZs9%$w3BuIKaS2loaz7lndN{kgw(?YiFEUia&MJ|B;-NC~*VApMgi%qiNk zH#&Dds8$gu@=MJwX_yNSg*`k^Gai$av&%alHQ8hqPnK}J$NizRMAXJ5B*A^EmVKqt z!rb4}UJy0vEu8Bdvk!7+m#yqyh;P3uI7*h|fV~b)6umDY+F|oZH*Fo?VX3A9bP}z) z7ze}stc|`!_D|Z@qf@O|Q8Hz_GX3qIQ)*9O_r{H>F zZL&{FL$5E`Rc!L^0Udp4pF?nsgl`$Xi3YQr+t%IVxaU?tsf0{Zk7CM>78WBJpyZNE zsF`K|2pqytWnTpPnA%Gv7Ip3@Or|ezp)EHB%FH=?RE`*=l)s=ZrP_G2=D#4BzkG$! zZBm2arh8W{XQ^=GDC0M%B_k`fb76W0C-xUM?kdRGBh9KV=6palW!O@_tMeEq$a2jS z?9^O=TU!pl;Dq~h71HDsrog9MjXeu&{i(*5iSc&q`#w}gu~x#9R|fhunrbS77sGrp z1O(RlWM(+RT7%Ch9P!CW`cfA?Xou~ayxr0wxkw>~T3%7nxm%T+%Az_*A%4$0Uw^z@Q4B6!Mk$vIO4Bzd@Q>T8*_w|KtJZMiB;&cJ9^zqB$*n%caLkB}zrf+T%pSPo z8*bnpW_kTe2G?BxEX^=v1lhfr5ao}wwY5~;qk-ESjvvKM9?5B@B30UGd{vgasYrqG z;AOJ0$7H+mZRg-<_9}H+lckR_B~xiEU3#MHcU5S{SH#x~K%}9We=23>6VD1VtMbZN zDt*I@g5S$GHC^d*Gxz9df`t)2{+S>fM;GHS09{(ETJq)@9B60mQZ#@puE$$qruu0G zi~EEI&83n0+^_pibgJCCn-ff@K;~z~Rz{KhoD#^keiWK$S_T_fte<&2W1f(+V;xXZ z)UJK+m2NCh( zfci(oE!GL|+W_!Lbyb`p+^RiPD0GXwgk=b;Zt`QUK1};~zZP%=-0|Hp?i>fuY0$5y z>c^dh!+}dc%(v$ae%?6aV1eRX#jv*=ylDkCA;X_Dggq%lPct`;3zp^gkxG}ks)&aI zES8t-l+|y0DZB?4MZGncA*|I*OmjSJTHkeMcUs713+)2L?8fC$`gEBtUJcZvVd!24hEIOg_)f(RSk-TaT zE2hJ)T|m{>7U$JGUvKd!Pf6YWPRY{ktDevNo*^8vBq2T+408OX2M?of95EMy?n(e@ zhO6!6QJC+V_x&!-$|onf8w0nZXJXe$)&FPt&@ zD64GThYSF?*y*5y48s*{Nlo(SS;{BL9&4Qq_b}5KO=dxMy$PL}Y+P@=KuN}YrODKy zfTCuByuK0sj8vR7 ztxXE-rvuG?l1VC8Pz4^gV%BBrlLGC-Q=o*MT?b!u_{pB(wsR`pjY<~as~N)>0DViP z2V+BWLhI7=8b$5%9`uo=*^s)nHvaLbluEy!bLKHcAgLDX9=F(V%UW&qw{-59B)uxI z+gnU2mvksi|Ko9Ls14P@MQvcmzV`o2GMH~T+heSV-g8z=7>IZ|__hRXf?=G3CSz}; zBCAl}lQY7xtP|lt0B~KZUn$*ib5CLg3Q@ES#5Q?m3>(f=*Wl1;S~LZ z&g3#5!Mz!S#Vb}o6VCIH7JOBtGAD?l8evMuEwU6ec?CnY4Pl*MCiC+$%8+>n=3jux z*iT5C?=g)o`QN|(eir?S&wS}@eeWLwE?44~-hnRBe!h9bb_R4k+&pYCn@()W8!goFuzP zv%mk_`-D3+oQ|qJn0-zv0tEM5V{}9PC0B4Ee-}F#`Mh~hm)){m4jM;OyB42JxqJ(m zw%N@lIM$tS>GS!3 z6z(?V}ax;euHgygPLLq3TPY z?6c321I>>kr~YDpTa-RP6u$fZGGz*`<#-YKHB#(~s!9*wRAuCE!BcrwJHqmFX9t_3 zL~di_jGIc#&CSkVZD5?I3RL+B`^o>d3Qt1?{xK9@%AKUI@{D-s6q~G+tg82 zzvivOGUn;94cV(4rC~6+!=uAyJ)QsLjO|BPevu=|zhKULt}`TW@E2cn^>MV16JZB4 zA5U@3v}J)CB-lU9)wHYt%`aXiZJheOZ|2wH;d%Ah++ye0LMwhIGwD`V){oCP*#hdd zf%Yd%NsT4-F$fK8i&V@q_R4kIsY||#>Yq0-1zab+ zB0Z|+Y(AlGc2V!mxW%U{eSx#T?J@~f@Kt?as>1qb&a>^%p3iJJI&-F*_kE=wg9%a5x7Azd(yNFZefmxM>etg| z!zWNXu@NX2Vk`dAtu$2sA@UCx^sOd4Un*OdSwQy>)dB&?%_Hs$6g^!dpHhFd-MA26 z!8kLR;MpDcTYxzn{L_L@Q4`zzI2m;hQ(xoEcU@#;-G6HE)U!y;?Oo_7Z@@#gH+^sL zB8ooCa#ZCNpS<~?Mz@_`1bS^TZY%1||9niM{}_DPVxEFA>A2%pS1Sh`3qJll=8B!b zrd8LjkYOFEB-nLRBmPjAXOv#H?>`LAsH9)gd^+!$34W8f5u!DFX!SVz0`~QN32VR1 z=nf{jl~$PEASNgC*L-+_Mm!((VVqBv8gsvSQ;Aflb(r>t`pNMI9#%g=?rno-E+C@)L8gicsp5*e4l%ndeFQB0M5S?jJV0L0G+q@z-kMn?R+k9M27Mz&qPW5d?CrubnT|E*Iq~p4769GWHP~Qk zD7>eWThHA~$zZM3BPIjP#BWeP-a*JDOZDhN6%puH%-j(fr1^67MfdCo&sWU+CCP}F z2K^AiZArp%<{hm%_423@4Ir*i=9M;XMV4i7OkXDL_L+%s${!!)PY&iLeIe1bR76n+VYq@mtvaI)PMF6V8B7+iG!$ABII zraC{A79QaDH=3Tr@#OjloreT}06c!JqrVSd!5=OX695$NelHF7a-!k1*4qFAr@NwU z0*hg};gg}Z;-SN|l;GIj%x`Uyz|INDEu9NnrY?TSVB+{yY&AEy5BLlG=D>`ZaGPtU zTt_uiHr89G+yQd&QbdX!u_QBWj>AO*I7h?Kzlf4}@TGDN+;3;F$+$j~&Y~S}dG7<# zYm#^U#5T+O-@$8HVGF5GFsgkZ}N!S2C1F zmg1B28D>}L64f(MF(t4?8}SR!42PJC0bdy{`Q0nDv54iH7_#u59b^AjosWrwqSpKe z&zLjTD&~xd{o3~`OD6M<%mx*0#V$Pj;-p=L3K481`~C_%4}C$3>(dI^VKE4=G&{gE zz_@>=U;Lf5GSVDU;dIR}+z_=wHk^o^86kzq^lY!vkVub~ey58u?i6B;5Qi}EJ)-wg z4tlW_)dRoLfe-2^mjOxmE~1S=bAIiBSK0>ayE)2|^GGi5KW$vsb^TeY!64C{6>{8$$!dhnadAe@|q#@^Ji#XOTf~^e&2K@M)lzBY?+3XYO zOp1(3+uJ*kqP9$nhHcJ+UQJ&7$#eRu%!*%qyy?q&fYnOpsF?M4?R#r_F7~%WQ+*6? zOBqmKrsRj_h48#%D@gW*HH$Wg6+!PeWw9kSW>z2oS(fD$6=YGTkOpf&LPYtI(L4xv zAd1E~%@Fd-9^HF4v8BSpT_y#hT)5ZQA}$X%G5w%(><(HvR@BSyuxsrIto&nm zoNk~90givfnJi|B1!&u9>zhv{a1T)I!NIe%WuQ-utAByXE0bB{fGxDq4SmE^u`E&;2Rv&_8dKa7a>mL%7?crXgOB#m1W9U`(`j+=gf$gRw zrgCHqRC-{Fgc^5e+)R6-=Hv0EaCOSp(fa7Pdxq+X!Z)%)%9Ajuv+Kz zt2;D-k%}4J$$0?Cak0+FWnK|uAnwjj-Po3+ca(dLSyfBA+*eX(J8ARF4f0mS%-N{ zQA^&}AiN|l#X)reO|I7Z;S!EMXx;#MFKUzdEAa!^O37;_Ip-P4OZ%4Hvu?i#~;P+m;3d0b$dLt0cvFA$+);-y~(6=mrwV7=A$f z3~eJcsR_v6hy!H8+co9#h8;}v+$FEf0GUjZ&~L}{az!Nxr3xr<%Z zwW}_CgpG8#;0qYCy>#McfGT6E9DcfsRru!khurp%%21K=>i{Y1CLPHGhQ?Xm;c

h3dN6qf~q$GR6-TUjt_+nz_aM+D*@UBa1 z0$XVrJ_G_!fLk1hQ$7ovD#Yl!)DRDE-xaWIv+od?Uy8zUHEgw; z4M+RLAfym^4w;(R5a)vce;+;)Q3r=4VKShl?3`m}DiZOiT>+ugZAz+`gAsDfE1@2lo8xsDD}Ghx~xWFx*zs-ck&%Z$yb zCFxd$RvhnN&KRFMGU4}-pn+pQX0@Gvxw~F!L5}x)P+{7yY-_7*E80C*BZ9UD$}buO zFZ=w`v>O&1hoqzUT}%zo@;dWp89nF`F6?G&8*%#zUl10k8_BusX}q+JmbEvozGQ$2 z48f5s>4_r?8^w-!1hu1fkrh+cq;XL4qo6iiz86Lrj4y)T(BNO6Z+d9-*BS2@l2dSh zE1Rsy#_p`h*3TKD?iJzedzDn^hSpaR3Ja@a-Z7S8HS#|<=j)ei# z{q@haE%D3J(q&31LyrxMf2%4K+~~-nzVYrdDcP%UGUZ*+ctqT2&KYt%oIL^SecxPA zq&b2A&WOpqiM~78bWx)Y?Qxk)DE^t_Q-tRhdQKMKyAp$mT*H6x*LhYBUr9To=^tM; zjvVDT_%JK7R2t;b7cztSy6;km0H4{OEsAhhKA7l2Vw@X0NRgTo6xsk?nKkd$8hh?b zHpAk^ilD%0;nydytiZ66BK9|ZA%)PL+1A&|1Fcfu^(()MNz9-0|5^u9khJ-hX&7PE z{JB10=)rs>ukXB1yv<&^OIF6-uU`G?(qql=j}++Y{rSby!u0Lm)H>Fumo56(-cw2! z3_zE%%75QmA)rNyOim;oHlAdSZEkT^m0YLT0~8$fkxg@Rt(jQGOH(aRPLi!iVZ{a3 z#$t^!0xfkVH+CX%r#H=0cvF&)-y&ImHs29Bw@Z&DJ57j9C};81y-O(RywS~bqj3EK z>F^)JzH4CVXZ5S#)2tQx8#ry1%D(WN5XQ^>W4Q2G-?3uriqv+?*Kq#F@I3?36OumM z6AWTc7Fd0JtEQn0!}G@69nPjvM_Eu~_b)hmo>-1Pm< z+{lEPuCILesvoZRdVG=^!kf1FxaK_tFD5C-0iL|&P?|1y!_UqS!PUzm}lYx`=9~+Kh zcXi2+krD!1@hU&wd}{5D?Cex9WHXSjPy0hT%UN|>PNm1VN1nO~ep=6sw3s@>O1L?)Rj|Zk-<<>CsMVUI)()DATuQ+&zd%fRVX6gCX5Wy^#!qI-HXzl7QKPz&)1Z<-SOoaj!f9TyPuGp)pP1tYyIK{CL#Ic-f8sT z5-9EH3NAOjMyw_7w%;NW|9nalf+uW?HF1bV5c~`3bF$AjW z$zmyeda!H8&Eqk4q)YCC(yMZoASvx@I;BtWF}nx{Sv3~!>meDXVVwTC0jESZiC?np zLuT!TrnWi55}5kekdRjaf3=4_EwR1q{3H&jW0|2tg0)A#3}D!opbz9{ouH+$u)|A; zUUECTHsAZOFP|lx@VQNrMQcpq58nku1$JFae2rLIedZI#NAO`?jLQ8bUPAoGkb7ra zK*IkEd+gkNZt!ZFBRXO^N&-aV7Yyyen-<~tz0-yAdFEWp)D6MUoLAjBJ?-Qy{o435 zSO%EdYj`wfdGF zpX-xj(F~2H7s`7_QYurIF!w@wq=}`;2fNi|IpovjJ);2dB5*rM1_V)WvuPqHSJ6ot2-~6h|t= zDF<0*1rmy>F<9hZ>uqGX`|fYLc_+vkf&0!TN#Dp zswBy1X<aQ|63jSu5lsewzdO`Uk~3Cjt1sa;tbN;5XJZr8Euz{{#pjSq{W zN-+#3EULqFRCn*nvu&_LGus)$>p@SrbkNH6mnQs0i}v5+Aa@vv6F#61c5nbMGL8M} z3w|BB*Uicsfe5Sq-tK=4*!o&M^iAS>4e>guh8U}C`EJB~LS#EDj;7&Eoy3>{=>iUq}v0U~zN9YPMP|nf_^h^O)$$foM z%JG;aezR;8?}=)*i|c6M<8T4*=zJbxebR_xgb<1n485?pRf6xK=PUilS7>%rM=_Vt z4*hX;5$KZjx+`J$g@P_4#>w!dd?K(JVHFimtUYlrCh=y>>`P~Bb7gC94Da^Z-41M( zfF}@u^ew#AHID!ZAn;X^ySGw9h}TwJdl z;uqs?Wqlo=GvGwjQw#}kt~4peN*f3yzGi=)wrSPe5u_p^FbZ3TGPh_Wtx!AgjkK|m zl5t#aJw++TurGani^lau9;Z)jw!#q!aLImTp*fqE@1M+fii}a0aQ2YIkdh4B^OP@5 z6YG6`V|t^Onxz%9Wo2^(*>7U>Wc9$Ne zvsv4dJijYv2XkS%uYmVz9Y-#grqtTU|Sp63{E* zq$96~sTa3fYK^yGss7Au`wlMEVft77!B+~IR|OIRs%AdZdA#yNa&`BT_u1*K!ieW; zu9AWQD-B%^G<7`#@Vx;<@y|l}Pev_B(X32+*u7~$>yh+l!G$<@Oh4pcMTx7+m|P_Z zqCaTE>vDmq20X))*Y^hqps}LV4)3kPkMXW{E_P}KA%n5;MwJHj(E@4CrT3F}vxr_& z)aKgw?ApgIjqF9}Bo-uEY&ha44q;cr^9J#~&P7m6eIRX2p#vIETS=IGxbd^jcN$Rj zWHOFsfHj%*@*Sa8YbMPSzk3qG@~Txug(zkt?WV5=33?~%iT)aA5dXted1lKA7l4s= zguH?yTPHaH4VrPPknkx7w%;no4}5hQIZ2`g~lpdt;Q}8tt;5T!a30;SNOdT z$0>h^BQ_O_2|Lz5iybd`j@6#egiF%wOyo$sAg5% z?+t9yNbE#q;g&+%gat-M<6n0>RP5##aXq<>pRM*TCjYn8W_7T;YJ(NnSjaOaq6zV1 z>2G3aCfavuOEYu=d8Y=uWS={1>oW~uokM48u7evI&lxRH8~j;aAN4TME}*DRgY)!+ z1-#wM(9^kOE9csFV=KQHBPev_%2hU`W%uR^3#dKh@Y~e$Clk&bCuGAL^ww9(ru8f( zOb1R$wfs}|qkor_L`35moaJhrD>s)C;?_&`z5ffMgS@iz?d1+B_jgm3H|MqC6r1lV z@J0D7f$Kuox6XBgq^B1HtVu;F_{4@4#IzZI`NOb1YrYUs8TtlpTk>*+t@HEw_U~IU zQ@!-2-!G`W<|ZB~@UHqvv1iQzS6T%v`%{(u6lFB7bH{GN{hqw7b!)I=e+50-xp*Vv zk*p-Ay>`=87_nC|kQEc$8uA9

ajc-*PUe6V(BQV5)y?g;V3DD@5r9hA6`A zhD7eE)4G+>5JrYovaG7vfvso^6BbO5)}CEfq#$3~>`TOU zjp*{T2_>Uc@1iB@?xoWay~I}^2!fE;>I-8t(L`-aB2v=eWW%_)cSt@Ve!@qh>PM&f0z)sKp&ZYacG36StE2C^{l0vmD#kSD9 zX=}@HyBbCBdCq4CdJ||ib14vWAnLt26N(uqFj-9U!8!5Lo3#J=Dz8gi1EIg6BhQE( znPS>C<-urg2aqTlZ*YG=qu_c#%CJ$EKvl*hNaC-eqx0k3AhWqP2N#MH+W+R)z$yF% z%zHZ__QZ)J&at0UWqP)PfvDQ>+lQ=jdQ#uF3GulT>K+N@n)%Hql_U%E)T>aITDIMqPMKDg^u95ISMwSI$u zuS&LJhzyYL6~ZDpTEI5JbMB3}m^Juk%%;^eUm1$&@@|Iab|T${#ceH^yFB4EKc>QD za38hH-@BRP;(jwjWW(1%$M@5zLl&xMPVj@Nu}c=X-icfhpj8-fQ+Md@^&L;{xgvIZ5&?YP8_kz z+AkV1J=cP)RhsdjLRKZ2+C9jje@7b8@|Ge>DN*wct>$6b9YK56iZ%GTw}#tYs9iLt z#`AD3AbldvS^|oPCX<{>Du&*?m9VOQXR~9tX4)50@sEM~@h9#E*QYO~f8_1A3T#5Q zZZt~AP4-%IY$@si7rW`at%9q@x$5b+GqwoN8kuR1h$cF?@G^BqQy(tszR5$H%q%EA z2X5LtvGF|;DNbOLt1+l#Z~c}y;;604as1MDC|?i>qQk1qv?KEsAprWyeoar$%#ev( z_dV%-w56oSTDh$NgA#~n&11KHf5-96ymQB z@t)Y+F8pI)>M6XaA}p@Nj2&P1ZON*JeCb|UgWHU&IzvtI!{QXe8G6q^L$UJ4)sw8( z&nB|R5J$D5LEQK!@4p0;D9HxVo#Z_~K&f!LEEu>o?G#WiZ%y=cl7jH#={A1{+er*=m z59=fQL+vNJSzgX2R_-UGC?D7Eo0=(}(Qj@4G5ov-o^MjOn{PYeYMlJErikWR&ponp zQ~j*T373hnHu_TzU^QmWesy6n`d;z1XAHU!raJ!EAym5K)-CRg_){B~Q>Ba%mFzQ) zzi;T)ra!C$@Kqpv@29meU6m`N>?yhBwmG|VjM(lL#!5gN-8RfFzp(Vrurl(0_>hv2 zwb`B5_n%$=k!%!1w9Iw=W$Evd{iOd;_S_=!)v+Gl{@N4`1=TLqq`h%cQ79p9XfEYv zoz0Sms3c{RPQm%+yA+b&HsrXaX4VZaS#CYX{<-;Cq2jUj@8`N-&8%{hb1&6`{|c4mHq!=6}ko^#-Q< zr)c@|%qk2&@kn~Gb1`}0g#7zs#*M}MeI~yj?O0V|B{uStL5Z?t`yS0&d^9t}ttqFlFLzwN#}Rbevg1~C#i_?$utw-g5m z4c(o-@x+GaujL$wIH=kF@c3{(q>N0+Z%Y1|bnEg{>Qvfig&m7et@dK7n!XebXY5(M z*MusZl6Cy?hkYMecLkwZB_@-q8(H*HxEk}u%a{dCAzQQ(i6L#6^Q-E5VU!nslPckXQ zx@IQJQRatOYe|YYJ0vHRlPrUi!L!)1oanMj^!qgG-9kAsL}aijy{AT9wzSEwLmqLK z-d4|LPR5Y>7Y(PCj^?wUt~Y2lvw-Xg_XgT!vTtWM60NPvp(S}3uV>i0`y9tx9$dg-%C889tt-50GjWL3gq<5 zvc(Ncvj52_{hJv!2z~(N>N0bR?s|i<2TSQk0rT=oo_R^ip;CUBd9^~?=c0{`IhAz! zHPR%;OafS)7`ul|P=DIlA-F5ob)rX9iaQcA*g$kiu?$SDf`>y8y({pc%<8j)m6fT@9CUO@g}y;Wy}#p%f8WlU5Wi*m>0Gm2bYt!%$@QR8rUvDjEoW7{BSKxs zL_R+f<$ZRjbD<8LDw1!$iVe1tL!~liG&aLz9awfLlcrWT%wU4_#gch1m->BV_?7mj zbrV~C4Ct-kYmF;rH#<|AwwsyuI<2zHvoa-yEKXB|vMj4OjQv>}*JM(U#C`H>b;ahu z(BZ==q26)%v@QkDDgIk!Sbp{kH&SGJ>}7Q%?|>zC+adfM!UWzIPVAE{_koE+aX#Zl zVTw|(J2<3aYb{1;3^h_c55)robQJ*-YtP&^(YGqO4jxl@tC>LqgdDdt(mQPan?~j< z2ww(%ek6T-mgm3HX}@-7*I?bN!Bm(1LrIjbDS{!IVr3?jFe2sXEFm>j)Q-oe0JP=xxa z!B%gXwgm1mkf%eH>NZMJ)Wp2F1Q>;00s~%39@4L#@*F~9yy2UxTQ=m-387)6mXA0>GtQ#c58(eDSVN=?2>>a|h{u_~7vMCVP`SxaoW{HXlRW9eg|q9;HIj!T>5y z7c|tPX?OmdP%V!a;N~I;(^USgMCuj+4%N!wH&1Bwnr}>$*QaY5)rMF+&77Jae4{do zF4QP1re!zVpu!X{PokMf8C}}YVlr(Em*BpE5&80ufnS65)r~5A4|`Voqq_9apY9=z zu<86J|4;tPOdHtb2c98&B>xv6M+6b^JB9Ew_G?eb?T2B-|8dyweDJt}s>sghwAh_B zy)7txEL$F9Dgtm#D}8@tQ+f|BmF+WBoDcvbIgBl;&K*aKO$g`}`Nn-4Hwjl2zxJ5b z($`?&wxj@`&+{2q@5;CsXSqjqYOIs>iaV~urH04x^DQ^*P?N01U9ZyQfgc_gW+Z+C zg3WN;Nzi(yz?@r?FCdQ_uLJCNID;^`K5?_bRsk>dm6!w;$y2`Q`xh|Hb_w2+O}Q_) zedxdF7xiRhoua)bnj^e7`wP0s{D^$hYTz$<{KPsU(^H-g-l9g<3YaeG7^QjA_q?igO^e@U>qt|=5VdH%H4vFVhA0Bc_B3*`;pB8BU60Ss)V6pypGu*ozR~=Ocf5; ziLk$u%hn2OK|}S4-dAFFmSmQf9~+EkZuZGEd8^^G6w#wEOpETwRGwBu8#C<^l^lHM zm0AGKq9i~7i#vt?#E~NPV8|!Xe7}E45S%-pY`EZ*Qjw?;aDj+y8wKP?ftsypyWlJ7bE`MiLW^?4F;{(P!s-SuQ7+%OSj?P4t!brQEI43MC zwppIJWzQZ^J^0{f$O|U`GXNh_8#TdYn$o1`8a=E*EMVdvrPbVYHUsv4fL|MLUc+Tn zx&rSE&3CYtcNl%cJ0I5GtoY54LJ1BIsq>vttEydUioH`YErNFdwTF%!dtUzq6SLLj z$=f@U$?a{ZqSP;e)>gi3WjL4IFgb6R!WUznD)*;pLw*7hktwTr7xY<}{>S*-YF_9U zG$7u<)7{17dQe4>&RaO%vtOmSK0PuvIHdg8vdI*&4An(Z1LB8)HCGRv15 zen}ObC0bc}Zhpc#1!;d&MQzyxSK#{iMV~Ax3Y2b$_{0SNtgct+ORNlE)4v1t3|q2t zeaBN$N*^J)%7w#a)y#Wu>tp*@ZA$6F-Bkly1Fg~|Bv%HLdhiN?{8kQ-TzMZO%YBXU zB(oS1wInC0GCmoiDh92>H(Z7ihO}(->4#9qvTSqkt!v+M;ekL`VS zG{4LU^;+Pu4qrpctpuv77*tmm8(TIn6{$g08sn;N*y~cFl>iqi=!S6Bc%Nq=3N>UO zJ5#1)TNPHZ3iUov+}`J;4_H@7UOQ)Oz-^Xb7EcDe@R)Hpa~ zu2Dl15iI(!^@dib#iX4jP<;j;t2nO&EaO%RW57XjB^v$ee6w}apJ%flxI6HQj5}|+ z5t14vSjSQb$FM62u`?gG)8|?~{yLPwgD;h{R7K})N{%5kP6e1yc9YarmAk;JC>$yW zk{0`R~6sHf+UD*N~>f3tVTHRQI(y*;Tii_(^7T6avM6zz0BUWnmP_wq?!IWE{s7WzS-Zwr>6X|IeVIE0C6e8W%IQ# zj1%xGLHPuvPB%4h2;!%y-;W4w@QoE^=LUfn+ndb*+TmYo->F=T6u1*y3^AUDNlP3= z3I#k5WX~QToITt-f>_T6WGu9%on`NN=kG55uG?_K(O2u#8~+^+2++P9&)g5UA6sO1 zy*KgTa_45V_r5Ujpq69Twbcif=S0%Dfco!xL$c%_X5Ffankh$#HE5BId8P*)^1v|t zcqZu+4sQ@~Rg6!92_PI&$8A(M(hPERymv3E&#~=!R#czbNaBJad05(=;1m3(1T=nP z{kVe!DQq_yPI#wylh#LqHB7W5mYlj#yAywy*BkW{tFbWTdVM68<-5rf{V!;tD+v&E zNN3+{^08!QSlyxidx?JxpZwkn)%Hpf)_!}kE6?aRhsTz z$d}DF-e&1$ye-hbm;b(&;VkW`(|`4MAY8Q8^SK z5ynNe{vBMCs#LWAj;ohZZfCsJN#51IviH|RaV?Zl1e;Ce2&=ga*n9Zf%`Twp#qjjd zjM(kVk{odSeVR|zE7@~*DizEkuYUZN+q=41$k#1Zn7C<>SPHtAs*t&(31((JOjPT! zwKbzlYc?>L9A3rGfTs>}|%R>CQ_`+&m#HA|1f35R! zR?%r~k)#8BYzDfdTS~szh^tFJlBrWZLH?qbV#8W5E#!&_&q98YHB7>rTAiqI%d$@e zexNUs%+2$@`kG5oGKfu->%CJ}z*T`Cfdhy$tkHDr(N2~rRxI&uAeU+?w`K22#`N|!u2&0xAnrN zv^wNXg-{wD``CS9OTXf`H}JfKxf=XH=}(*E`tQ z-miCH95Md;&nDL5NzvfIVc;OKl_8%i&Hdnh3Q1CCIrancO!#9X#nB(tyj@dY%OF;7);Sd9WrXz4MUbHT58%GIbz%N{KzB zl1pati+qA1o|&w(n6k|)PGBqwm?bp@jfxf$#jo}$-`x^W#094n4ep|7uES`brF;al z)C8rsjQvyod4vWDyGJv%OtzA|h0&nF{kzvl!C?gV5bg*|H9{$pj`0QJLdt;%58`dOSyM)7YOcMth_>Ai_bi-4?(#5Ebk+vFg+=t-){xD0EZR$5V0N{ z{eodtJk4D=)A$87-Z96J^EpIrb%H=0yAIBlQzI13eMVSagNj$qliKpq5_b4a@tu6U zddmaa9NnIgVCCZ%U=v&dhlgcb_^qai^`{-u+HH{P?O zZxmcsh{bZe0^X7E&7|@Y*Ob5?YsE$JF-&n%$Qf$K#~8Nts|#?AXb7Pcf*?9IRj-C;RJ@fyM)!x3L7g@@sBTv!=elm#%8)kwbCajaj zeh*{~x4Vga0TYC>1Sx!P2@w}Gm=T-NN+_d80)lieH0y`(1A-GK*#9xuUQ3BuekF8z z!kZovVaBDG8foW~C6|6tTQAe@OZ0tFL#b@TIT1PjTCpw}rc5750WS5RStjFC(Vdhk zZw;{IrkKhhDt{%{j=01Z{`BNA4Cy`Eed zDqKnjUrV%BVtqgK!uQb@xnY^Anb6?sBd7ZvF_OVNKPyfv{ri4M4^lFR!$)UZHvs5! zMUIOIkMh+lqvFw_9g{H8A4kxdR05<+P=+62{hWLMi@Ur%?o_xDgjq+X7TJgu(ByT6#s^}0s?N<}()7rN3qwFPdNd5(G=}=X1KHp?g>3+WDNHfDHQ)AEEHrm?esgglkC^wyV ziBVQukWtnb_>P}rCj>5y-dv^)%ku3g6t1C7^O ztR^(KJ@v+W9|8~iil_k&qKQeey>FWqxmAr4UzJ~c5gS}0$c0M=H)cjxm4B0lPCVT% z0UcNbzu9+sp-T>JLnRGyZv4kFP!RZjT?miAXe&tC- zje=T@f*nFys^sSJ!7|lL29pb*wJxw>npXN!8tHNx^$mxg zE7&f24sVGTLOWLlkv`QDeaNz^KpujTu&fIhLP7b9%cT~D`~g@`fA5dLz{O@o)bA0SDde;qq!shCR9fOv@M@73Elh9pa*Q4h@X zaUi{hctB9?5EGS=(U?78rN!4@GdP9kmDWoe|Fj*e1W~^E5rTz3uBXjF6qiSUxIvsA z%3CnA=}84|nJQN+FYmm9a^9_83W;MTK!&0Ei7NhuCKAI?eFN?4oVrcD>p5Z9H7(rRMh)7 zdqwvDn8-A9Fea(LQnPK6VlZAx`uaqwstcqE$KafUBxx@51L(1@8JRWan!1ohgUR;h zqz)nT>1oP)o9$X6(|@S`FH{7)MW@W3B%b%kB_blzUGlYMqHfAum+H%@q8nxHlqXRA z%b+g1ms3_(vf3VU$TU$bj9busQa#7YpZv9Cj$rA;VA1C^m)zm7mObzY&;2cxaIPIY3ZK>pVa}Kf6zM%i3=-lI( ze!M>}A(XPYliQfgnA~rCiQjyEtuQT@;b6GCA+oY?zlzZh;AJ;;Z zN*BfV_x}Co@$iS+ydOK~yk5`eV#LrNj~?~Ebq*DSOC8wknmJps0Q79L?X!#5#yy@; zVK&F~`Rcnp!sOZ-r>tzp0sr)|mAqBXo>An%K+h3mrb6{XQ*@hEFAbTu=jDgh0`8_X3k!i*xI4ZrE6y z=vjJLRBBhWV?V;e2Yxnm*s0kZ0`fCg?SM=z^NFex`gIwEYOOf^*u*i-%2D_S3U90P zL_NPl>&ZnkyG*3BO230`f4$3i?gQ;3RSBfinp}O*eM-*iU)&?%r=FsKt7DI;UGYnS zRQ1$14^Gf$=Myuj5p2OF^yn%#WwuHni&Eh{)tP8@*Ct<*>^3%Rnf>nh0)ms4!^b0a z*A4cvmZgWGbYjB*dNqGbhc%ZA_BeF@S+hBkhI`=3#q|di(L6ZUwml;{(Wp#!!k<0e ztckh*_iJWwea~!z+kfurF!<2RwTAZ%p9&#mzp76^cUWgWF}91|8)mvy%#+E-SL*eh z;bw{lvj?j_2K&9SN~fEIO^M%q{;e%fV`@hXBzWa(=H0dhZ1tBo8-C;$Px13*=Qe%L za`Z^Dqz8t!)r|VMr%?eXMWme2*EYftw zg|2P<3*H5_Rn-~=uD54&z@Gu+vgI3ruikGoj>QqkW)MPS_F{{n(VxN-!J!q)BW5_l z!dqBZ{*{KPm53BWNS!a=RRwMjpm~WqtbdBj$tn@Jmf7O1D%)%I449V1Shv;vR){UI zFK6w6f(`1DKD*ns3k!X=cMlNKsjvUX))BNelfJ7>@)~|s@@`JXkL;s#uh6kMw8}dU zhd16VY_cdU^uXsSGGmq!<-@UYH;Drmv3K&9q+j0YTI2e1@0z3(B;5PO@k#N8Z-2sw zTdH5aEco1o-_pU_eObv}eNymGVuitnD10EDJJ8IGxy5?<_hd|vKN{?~7}wYGK- z?aM~bKQ7Pvc6_zr&oKI23GWM6EXMQ#Q5+0-HdKiHcf*ov@>EYfaDL*oIj`mc6X;W& zz2OGQj*kr5rVIj`3Ag@V_abzsDdu|vF~3wbs(%MAhqF>mGMG1qm5OVsg=Ngl01ses zX6okVg@OXlW)7f19^>g0P5j~vO@3st*VBM^I*kM4{Xps{#^M>z)@X!vES|knOOHSLyO1q zDj*&~`A1~dU##xPP3M`%!rO)7ZMTvg2A{*7Q}fI018!*8J8GEV;&rBLs# zgWFqbqgZNQPaL}W;)?XSHr2+f;?)H4l#0#X1>rv*h5~wS!9D-Swmy32p0T9(pF8A* z7Y>=;(Bq?9=xfn04m=*Ud#{|^MWF?s2z8OO?W{v?Yb_dG_U6uO>grQITNv^K8letH)oJB)_6M|^o21n9-Md|F2sf1w!JK-WMOE1S$7G><(l<$7#@)aWXY+`QB363uuZ!9L6C(p{K35J*qf?2$nAEYE&gNf@X$5{B&Jk`%> zH-OFDZJ)L5GHA>A!!9TZ3j)TX%@#0?bKtA~ZJP|RY9c?eKhaiutJXIUy zV?CTXt0w;_pg3Jlv2p#qIzEfTkO$eE6l&wy7)sg9goVqFaz;1`ZK0PY^-Tr-s@v!k zUL|p7)s4{Zp3g<#EOq;%^c5-f6^Sl9ZLxd z#<)-i3twZ>wY4}7*@#^W;(}{AaH4OGtNI_?FHu+#F8$;IY*o*rG~gsrC*0KFe{5Q6 zeR{lYUby^g(7C0|`519MsaKNQd>YM7#NKW@aUWQs}0bnvsG_) z3vrn>CvC@OYoQY-a)?zQ7O2@IAPum9m8GKD5|;`WMXfnV@_f|6lXgmeG2i3`{nR*+ zX8UUcxym#L6F^K>Y}Myi#Ly2t@D_duzm zg*Vzv9<}S1{z!YI&E>X-j>1Wj6mM3ah1cBpyri&*N%~clE*;6pH;-z_X+9l!cuk!= ztKM|tt-4Q29#Nlft?`BYzw~w4&d3!A(tiKk8L;{3uQRTi7Q{@u=?tK+IyqB|(X*Yj z>pTVy52ugMPtbteun?o7CL)$Q2c57DbGsI7#kG#tG$_U}{c9?hlE&t)GU%WY3a5Bf zkE(l_PpH2%ZcOX$%)LH4OtT%ni|=Kke8;>*RYe43c4MK-k#(ZvF992rCa@Zg6?aPu z1xQWg7U4uWul(fstnu2ufgO{#B_5dJ$qEb51rc0j*Hmz{TNk=nbj!)u-tL_sciIiV zo#ukhKO(rS8_oLWg_OoIh+G6#PtLxE@m_=|*Uie&oWW|B9u{EBu+M^H({F_O+`%n7 zX5eo=cIe9iyOl*rf9G?1$h7}w8ltsn9V~V?bI>Mg*`o1oldL!?jdym#pvmzmaA5}L z=5bp9%<0gQGm=8ha24YocJ$9dz0-C}=zFZ4+=#XYoN`(kDgrJURnf=R;=1%tcX$~ZSAHYt#|ljUFA%y%r%2X=E~-4+^0XLZ zhiHBiqz3_zTh<$)TsnJMvxO&SQd{uJ1+ENL`pIvhJ)%6|AzRIJ0?yp&YeDz{E9rCk ze*~H>l;r4hj^krT@aFni1LS|Z2C~pkir3!Cs#XLdpN#rjcfJ_wz9_qFJl#OB0C}po zGI+CIQ@X-kr^!;d{GNYVVw3rW{Jl7`Hv_H;RtKO8%)Ap0PaL5Qj~vvzMK%FooPqa1CG zoJake7A~jeg98G_ba4;@GoFY2&lb^*HT{llLvzL&dXFIh*l2rMF+y|J(a_ie9GTH70p7CQC# zaz^Curclx1O!nEJwB_pi(89EO%i2OB_sfjKpdgpXX>g@dP3OyNet<)6-H?&I;iraP z$#t8Jw?@73R($Ex)i#5IX__lqMS9yNwD$YC z6bScMs71frb=N9?uzU^R1YW7RgVF%~cLnX~s#&9bTSo7o4Wl&T3Lpj%e4_O4 zF1gv&kZzS(cS>s2vEk$im3q<|c@ExR)Kj+kW zmS-If&$$b7C3d&x;zN;~q07u3D7~M#GFc8H!J;}Lv1 z!i3E_ozPVq#dZWjAN!!D(eaMtIU}KyeZzFVT`LqVlTz8>Q{}^ER7ext<$hV@E6{X# zSsFIo1FbCg=0PUWyfzp$8#YL@YE=6IiB0`LLB&$MA?l->bP%+Gs~rRZyn`hrR_xHF zlKz?t3cJhlEj6NfCu5M7`NQAs@4W$kGK{BDir7Z#50s{ek~lEi&-_WJUE>XYt3GGr zjg9A!1fohF$>V0gi?FHb5`n(|u{jI2Y7HiW4-mJvQm_zZ{B55q?#yIIPuV{yNi||5 zETdH*?X)xaV}B!_?Ips+q8+LZ9+j}XTpF!FPFcbaN2$A7boYcsRVb!!InEbsbYeZV zGPO8a5Uw{&;*3eDSYgem#;ZPNr}LRMci70!(R#Noo1v^(XxJ{&vN2NOcfaA^RC>6p zFkQ7yzDFG#hH8ukPdEigZtiTC2DqDV=29NQ?9ag?|sIrmVQSGAXRb zX1F6r3C|}g$X-?E@k{(lj<$PZaW=y%aMZVHc(-SvP7a$b)sLQO0Tq}bJ*cm4`J+#w z%`Pam))Vh(`>O$U&+^|-2ZGS9h)&xl8NkAlz{jW;7p5`&9K;YG$;SWw`$$?Nb3RM| ziR?A1_)6%n>oQ$dOg}CUcue)X&b%Y}TWIDQA*9LxlYU(K^~ga;LT$^-8^Y8-2!AzX zsAW<6*=Gj3=NMYGEL+eM(eTPS+*1WXN$g*wRvHBV=uiQDm|H5UPDvOK*>g{;y7n~* z*FBZ{Z-CQH)at{D;spM|c;BDb1)_%%XR1kmp1{dg)HlWfMOhytY{WZb;q`=&kG|3$ z#3e5&zS~OwtbH1hFa50Js?a3ASI?{B=V{>DCs0jc?vuwvzeIz)QHbVkm~NxM>!T1f zvGA2yN9n9($d17q-f`&H`wJKU$9D9Fp&`8mK318D+?~Je^k%^4Nw;y}5cwb66&QEY z?v!aBPMEWjQMzuBm8C~Uk#%_w|K3M`4cheb`A|P|dLZHlhs7K|eth`%+He8`OObw+ zTLeLkk|L`#>X(y(weeQZ&zm`Ce>bNn-nQ8aU++DZc>^bsyPL1hGL`#+Vb7+8 zL`oU5vTq?mk#$2a23?vj$WF+8mp?mROMM4uk{WpOs+vJ0g2!Xbx6rk3`{`44JE~h+ ziDrcH^dCo$+lKaC(=u*(9X+d0=Zwc1SeyhaQ@<~tZT_CkXZ+Hi-0UQ!KKDq=;r&dz6y))#x!W1T zYu_#3=1|}LkL~>7@}FC=J(mv7eG0Mu*(NibfB5V3j?0@b5U%uT?=d5h{g21cdYL9h z8ef}t+|m7iwx%^Pd}SR`&98sbIqY*y?8we*s#mc*M-G{_!We$~>}YDA=Py zp~1T*c$gk35qZaQmAbFj^epX4j1BKxZ$|pC!|wRxko#Ty=yz^N@cyL5(iT|+tMRUs&?7e<}ccr!qv-Yfki-v+4m3-ZLlI1O` z$9Y44i++C6++fnI5IGE;NVoh;Q-3B^`{HubyvvS`qE@UlO_;xr@$}~c z%O-wT54hPd45B@uJ!`R{y`c!u@nvi@;01ieqpA+P@}7h$oBW6{)mBG&u;UtD+GvO?3cnS1%LH7KYj+K%Y7we#o4HKc5ACJ?-FXHJ$f5YwV%j zu_C1be74L1sctKzjbd>!%bwVB$MGfbw@U7+Z@!hp-RJ&cs{X;>_GO$^Q@7c+$$6K&m!4Sf-=ulK+ z?-ep*UXGk!{xN}JaXvp+>Kbxvr3mJ4pzkO&7z@jKH0iFE2J1HbbeF-+^G=ZMjy#$p zQy|ttcd1GvYE)BRK4naADI-IW?WYXQS63n7o0+niwGYX5LU}^qZu|3f!F@I6$yl%A zly}ymgd@c~OuG9akK0o*Q;v_DvOv^2ngg_ua6Ol%@f?TmIpbgwZ?&YD$3`0sNC00D zI1}rZ4vR&FS*y?!t2Sbxv?A*+bl>1@Bu^vg<}?4W+I?hyA83{W_mihYxxy!$^krgBoem8d?NV~Kr* z6z~}j7V{>lNK_?+ek5{SiSZ~-#Of*Bz56!tX3L#vGxx*XyK-zfxRN*l{&N4p+a!W9 z7bsgX=cmnuD3A^AxfO)4%9Es@r+c8lazGl(y?tWUBFNVcvJK}?SDwfm8{B&YujMAs z=>tcGSVL{WW=yeszmx z?2rr5Sh$8Aml?bN0j%=vI}3Tf3|rAOk~?f`#6rW>mCpZsk3JdDc(>1y^x;=3T7f_5{Jz0085Luh4&M6Yq>W?D!E{L&b7C614a66&g6X zEh$YzvgZ!(jFDrlT|~ZHI3r57Pv|wN9i^t*EPj(_=dwFE7~ZM1tvS!&={vR5&12%* z71s1aUG#$(+)x&rzF7fJoM|^g7yj_`y?A?XE`>CnKdD(OofN*s6x_MZmbGITd5flz z1As{n*x%3mvX(Z$C<;T8?35==?j8fx(OE6KvY1g76&2XoPXiccpb{jPT%0eU|NNaq zd!bdDi(7QqmFuL6h)+YH9B}#^y^mM{3G3E$P>1$LkuTRdM1Bgfic59~OqedOIdq!p zb>^yal?gnijFK2VF$r(;xAD?rZ>RQnpUc?wXZp3e(8ZExj2mq~+VDaeP)BTC*iu=w zE!lM?^ib0TR&(6PS7COnt=65ry@f?J;!)J1=(oW^r=iaNqs84H zoT)wNz)(6vLtQ7{U){XQIK>UXuInma*fIN9W`;@#+`Y98X=dom)?f-6SX+=g$D1O> z;T57UHa3>px?h+X(20|a=PHm%%?HY?waph{f%2Z{p8o4!&L572>(tHkL^PMi!#bBL zC~rrv%#2jXYIH?OTtIebZ}~KKxTdNM+t!zBupjWg#`4m@Bgv7B?z=6DEumFA*miHU z+?@;B4HFB^_4Z55xB~~r4z6s&k*3zS-|q;_KB{D{>Iu)!T3vSsHCHZGn0v(6^XecZ zEn4wA`B77A(EGUAM&8=}4)I=f^B+i96F&KI<$13q8dv?Obbw=a8}RPnc- z@muvbCMIz@teY6or|W4E5<@Glfk?L;#KyEz3o4qlkR6ZrQ$ZV!)CVHcczCNN?0T_G zH%hBImzorv7CilDx}191D(bU~MP;Z+Dg1^CUyn#FUj61(+32{ZJyfESxNfFj_oXmt zML)Ev{#K?jdTdOKa^H>fUPP4wPAFhOmy(yxWoy-*zmr|2AUUbbYgXJK8TlyO9cJ@$ zk4J5g?4hkQB=V}yo#4xj?l~bx}WqhX!;9=lm5)2 z8A|klhKpU=c{Dtyk??FwU*3G7M}R!bFXo5ZMlZV82%L4P6A(dqx|Mtnv(Zw!{4o0i zdKqK#JGU<)*(DGmLG>w0hsYpCC`uOu=pv@i()iPN`GN$( zeVX-Od;HlGTwWWD^~7~eLHMKQ-nTHs<45?$N8g;JZ{{6R=FVJq0%gOw=XeTj$QkrN zc#32C82+(eJv4YO6-M$zgG78;yb-&6b*6is7H;(*u)txSN@26bB%Cm0`bW?$x3S|= z;}|9q@wo%&n{@~YBnNv2wz;3$%xa4W`9W*gO);XkXU+4p@#hXW&I>iX>ei53OBair zr^$DP81yP|KoN9{PXptDz&7XM^j@2j*#ASW>>8}xMMshxg-f3b>VyJfA(|>xG!JE( zEjlt%G2)EP?f%&eeJ$3xV&&J3D`?5oZOkrwYc_Qz;X!ZuYu2X^!T4<*x8Zy`yru8X zSlSt<3+Afh+9_7c0%75OKNxy#vJ0}Ia$yIG1(sr*?S#PCui$n})i@Ruu}p2eF?2rz z@B+~;etYzR^f5D-d^(wxstj5HLlBs=M}bUX+G-oozRR~61<_(vu`GV{+@_lbii_=y zzM@yK#@jNB5>rOS%CJ)T?vmopWa6p%hWrA%&bO>7H^VVGhfAJ7eTP-VC{IdG!WFj8 zima_(a@Zg^f`mtyidp6~=9q%*}vTdx^)7zHG5shP(Tb6sfqfDE<)#v(NRz zwQ0da+)Omm-GtqIZq#vIyG&NN1z`m=NRr1bcG`kvym2F=knrsLc9B!UnMdOepN3AJ z=n4$ZxRKkEbWGQn3JM#xix|1C*isYWjTnsu4h&G{L$2N-R~4HwTv}%Gjh}_~p@wkN zh=m`S1cr`{RqY&&m899SzyTmBt6mjg7CQXfbYENS*k^9q{-uW99jbKy=JD<8_m+j3 zRg7UISM5x!6-uz$ME!WfcxY}PhQz(c`{>dzgd;Q?Q$BOjia4VljTmC|yA6+>S{xVeAIV+5J zkMg-DX~@6})UYsD!oyui1qPBIQw`IuQA;7vf6=s}`Kov42$;jaE7`Oc$I|s;R!PoM zk^8UuBc&?r;s@Z>-!?ha$UuFO&)iJjz&Tp^K*(0}W9e3$b9P)r<%G-BkYgUSKECvs-m7MiW5e80h?c{ft+}k2`|{6#sOF`1lg8&uPVN1dw1ukNsx0LQ}dt zW&0x9y|=FpZW{T%=mG}8Ld-wrek$4cMoa;&=1+KTZ?tvnBbKGAu+gunf9YSp*&Q!E z5hirm+kXSlVvxrGx>mGz;~R9l>%#JUBs=UjOch1{r%7jkFDyV*8*i1Ael@m@%~6P6 z17JwhElt`^k`vhdJS~1ox*)Jz3hVV^NJ@nE^}CO)W5Ko5l@I(6!*Xi4bAuNp9K41TXbymlh zS-sO19?m_f3v$x>K05E?t~AX_Hso<5ouSV{F^r5 zmFJ@VCarq-b!ybjJn=;W5CTQVo~}N{2RE8_(#N}+E(2YwpjBgmmwctEg9Zb(>RQOeX?{ZJP+|EHF9<8fzIz%CScy4oV#UKeKI1+?@0wQ zWlFdPF}GuMZpXOqR!Ci+!=H1NCl0B=-!R9%&warlzS3L!e{B2LU-V;+s=fw&*-~an z!l!ho3y-9q$6NlQrfhAW1P4RyHmb@qRn&hKZa?T9;$}pqe=xtGkYTJ6B zS%i5uq%EJvk5=2-dJwieAE_b}`SY?lJd0mN9k;t?54{0270u zb(Jk4Jj!2(={C>`;k#;i3 z>a2Cy@MkAf)h~f9+mJ_&x+c&o^mPU4Mu8M*e6r|LCdtBA^Rht2RuxIieG3B*Ltlu- zy>v^O8;r=$|Z#Q4&BpTU!t zf6y%Cn>fJ_fz(|fPvP30#ctaPQ+4pC{D0mZn#dcb7SA`TA17#)W2%Y4N&MLE>eA{v zP0dHvsCQop5>~b(*N{xX-5tE50TgT`rZP#FB0)veit~LQ|7dZMQ*1T~I2A71SmfE5 zE<377nSm#}C|vj-+X>q~jyO}0Q0c_U_l;ZL)X3JU^JpwoMT5jzbSm4?x@3?S?bcAv zhfoX-flreQ3v_-pyZRm#pce&%2^Q8?r#s`7fZw?rE=5cRt(cp@pMH@qFRB=!wU@2g}UgRW(x81fCOXgPfEeST@R^krK@wD@9vK}F*>E!t#n546n;{N#8jEi zwi4ysJ{dIzOCja_Zp^EbR&0T~!H%4ZpL-{YXG zgD2-RXLw?%w`<$;tfr|gvp$#d>h24f8U$lAGir;*w8=~SiP~~rFP=qU!#po`QYVw# zz#y;a=d?-nrPM92ViTmFyfXkI>`?I@(KTgmaG{^e%C0K;+Cz%ACsp+I48VK1uChRm z00bizSA^g#y8-E=LL0kNv`OoA)5uj-V}$`L%&ZwDe_$Bc2~B?Yo|foGCe}xl2k7u_ z7`7N(mASJY?pC|g^qjp5oBERPC4f>Prrh-)cbc_XbzJ__{XqLu$lj7!gXTBzLzGQ% zn#-3iP!O@cd7vc+?b^9(ik_oTt?OytxSom7LP-#UX4XD+k;n9%l0ZiR{QwcN^4dF0A3y+v6jNY`%_V2{%1AeR6c zP9bn}AXn&p`i-G^;j$`sdRY2$ecyKi+IZJvL1fEzMeGlWg_(2gqVHw^)nzDlx*1{X zixoZD-Um(2yZ1s7{D~-GUo>-;@`#|jt7||9I}qF$I#Hk1+!S9vYm;kOLd<2~kX5Gp zOsd>^;PYuI<9(YBJeqiEhVr&0^()F=I~}_1p?0}~v0P#u!I2~}lEkvY#_|>JQ4cVF?dvMjWwZU-mp@nq8;dnWE;Iz-SU`!0*Zf8E}0rmAE>4XF35Ckv`|@ z&13nG5QT=ad~nvqMab1qqxlcx#RCNO2&^99y9eFJ~EA9I(*$G;(nk1{fUSwf}; zsR;h~19B^&KAQ#&6ag#TOAF)ylEw9yjei9-utIWgv!I+4lRY;FyzTn#${UY@mcLZf zyr_zj4Ej~va)3VHbTQvkc~3JMzJ_@Ly?(ZKOZx%{Dps(LG?m7c>{jN_YWi_rStxBF ziu+mIo+G+dfdsVa+bBY3d=IKop^pNn;nd@^-lKs*3v+=14r;pmgnQPoDt=d96bQ6`NGr0DaN4 ze;WTK1lz})lP8MP^-iZ;I8YU6aMD!O4be9!cXnyQR4nsd^C*xhcm7 zP4fu6;}}xY09iimOiZpTy*j~~a}*B>{O?nS2~O6NJy3feoIj3+04*4#_7euCQuza7 za&wa0EQKZiQhZ*8OjkFTb+B_$Dt)VITF!a$a_(uQ`g#v;@9v*!qT9WCn2X$W{rT0% z*CL)g9Aicl5y=Frap@@4TOFJ~qNGc4G-Lv=JAtZe}>wmYyU?gx#(K1*R`x9^6LHAz*7yO z_bM>i2abJ3oQR4 zXU8(A`|Q(WMa~$@A-(!9bd#e)0KX`gjguevyJ-&3XuO(PE)z(@I2lMEn0alqROJNL zB9;bS6bmZMqbekumw1KInf&v79R6*90S z%g&<17uU{g(08@fqV~+{Mp#k==xmn&^L(fq=Uw4-Xs_qkHBbBy(&+a&OPe?Qv?Vx!XS1B&m< z6xd2(oWz7oxkoY@inKosa9hu@Dw^xLprBpX^e7|G>b{6Rr?TbK3GaA^mQ8)sZ4{2z zIXFX2-o6~4km+e8hCGOMCk;9AvF-93APQeJ*UU~&znRq}2rZ)ro1VZ^NlMp)0(^sbhc?R`&RR+Kb%_Y4 z5nJX>594cy@|aYYIVtzHANd{AO9=^aY2gRFI(92+poxI4B4%|^A1@N~;&-n0`N9!D z_^h*#xpxLcs@lumt+lgmHg&oszajG$bQ zr_nb3kQ(es*$mfs>%gsF?%?udVuLUjbi_IFW>oR>_W2og?X)Ygw57_=mbKP_aW&&| z%ehT=jJs~n_JS8)2~i%^l|5R2Qv1YDKX&_^zR20tWB;be=05SB*(Z!AzWS~i+51bL zTNlUY6VQ)G(b)$5`a|Zk7!f#-nKPO476q-Br%bgBBbWRL%J<<=4{rBFsuCIXesH(I|dqCVr zdlkN-f40;vPoPHV^MgyyEit3*`ZI;jn#qh4y|-Sep~D7uXMW(ntz~2=+~l2Qd+|5CnvrgO(7@$iz7wo$Zk#g~1Bruz7Xcc65)I1)ra#&b;E z@y_+A6`>jeu@EzM;%95k@NiDnwTY6z4}nNz=`Yy!u<+<25@k`*s{R~;@~!E%;UA$a zJj}X6pC^_+@^t6wUuX#jX2fkB@@cSpN(Cco-9JK_fSLQji#^Ua(OV)E*WM*6)JMl|J zu!S|}Ku+?2?zdWJ82;QWsR5k8We4|5zs7Tij-V2}N!MYm>v!J1@z8HQJu{u>AvgP^ zx$L3yO#RSfWt$gxc_jmIcwp#?ja<~VDakeveUrKo&~5qMRutT1r_ny3+YCA$t1J{O z49eX2rQG#mBY(cbNpOJj*PQrAdSJV?U~;>n+%ovh@0`Ern9PGOY2x>o+^k#FzgmB- z2$dE8#hd=jRs%lmyMGdAh#8>FWm5)LTGRrm7&o1%jl)_cUA`(bp)C=#z%9!4ymn;gvP@*=zwA=sg;TLalMjZ&_hzbY#$gUNSKnXz&H*(6A|Y=p55 zS*2C#K%l_7ioX*38Q*gkn)4G`KQx6RFBNV16kEmA$+}Cb-&C!IDBaM2oK>R6*YKm| zf})kJL(cl4{lfzquQK^hoJW}OgxQ#8hL{Y~*)Ma3S}obsL5Zq^4tLiJn?$SARuV55 z1@#j~FLp(Mk{@B%kpNk_0Bbztxn#L=hTThfVd9DTx zFlj5zxbs)2Dty4fwXKwA8oh*auwg%Veew*qKNP$xWMe+DLhf@ir7mLsa7V?b%?yH}`6)tmRogv+37l7T`GPTkhG~=jBOQ8I$N_>~@em8_e zP?U|v?o4tl95K(ostk2o=I}V7D*t9^pvSK(WtqQQsjR(I#qoPs;uRn`?$7}m8XzTJ zPZxjH0@8-m6o>PssFZ&grKeZ|xR~EXkjW!LWakMZs|C86Hr@B@p0niSmIcgd> zNO%b}#+}^L$SZrDU6Ax=)dV@HsGfayUlQUK$GUr+FUFyjZB=a~hd zrJ{J=r-qx9XPdB`KXke1RKWmak*)I%z|A&m#v-A&j#X-4=5!L0zVU7_`jXL`eRhlV z?E7X@3lR`@6v(q$hs5K;WL;|mc`|Mg~|@|IRmc+~3D#HX0ujmYfcl5^YCYHHWr&%ca^<^BpQi>` zjls}{8WDH?Ab)x@v5M@UI6GoGF$F=;N9W}@;b-rKEug>RHP>ycyCR#ENU{J1$Lo~s zXb7gZ=(VlQqw3{os*sMjD8)p-+q2uCZAqEJTNw3O0zI3bdSQ!~gO8pgA<< z{@Ao(2%R*u`tFSULXgX_u>W210ISH2LDHqPd-B$apLhkF3Z0Pu4I~e?G@Ee=hg)oA zJyd2Yug^K6fKXp~z=twf92K3lP;(>VHvLn>as~-@)48Oc5$Gk%Iqj8SQP+I02Ua}w zsk6WSU9X(rYi!1zNEvu{wchUU>PV7>aig@RtBJ+N-Rqb?ZcS-}Zv$x6)sL*)g{bz+ zkmUrz;ET>^fj09H&CgNkn2Qme9rd|;nf>U6 z>Ws%u%9cw^$dRKN3Z!_TP~S?dvZ^3L+PczGO^ZrJm!paA%sY|pHRJT~;RzC-f$(r4 z)va6!=2}v@A|e<o1kHX%%fcEGzEHo?F|7~u0KVwb^IHtO9qg8DCm*1wZzB!?}f4+GaYp8Az z99|Pa9vH;Y3f<`Z02_F^n`0rkSCcX-56T0LMyTcHTx<>`^kq(Q5w5zWE99rPL)yY8p^$N5xa}aLRe9o zEw6Y6wiDrabz?cBi%o|lBwnRBX0!oj2*buB8-77l`8|EA5JU>edL}Sw!mh^MH!SBt zZp$^wu0D#jCB%sHi+JZ?D<;ra0|ffqT0t?%^`TOQ#DyAs=Z5Hb*7)Guwa`7#h#!j} zw5#G))GnhI35b8RnYEp>6?l`2GPRBtjkwB80y^lVsIbb~_go!LU+VH-xOR`eW&3Si_yklz{d?4ZojiqpBGKTr=Gi6jnvnq(A;s;s z9BZ~OS>t-1PUmGKIxTBo@wp+$Dc!E|dms{(D8$HatjVz35WKWEleg-5$&tsyEA(TR zT{LaFKCs6v0_kkToQi*5lIhfzdv=OP`8tm~_k*D+qW+ECUBNhKmkQZX&>__*`He|; z1<`YqaX)v=g)#d&;7@hXYwanU&8f_+MdwS5o+X*Ufi%<$1+qnW5vELS`g)6(+p7(f z$!LR>6Kt8yFP+c?i9E;bB&9`EyAZ`a-HH+RdK$DQ(D{ zg&`(;+1%n|nP`r+!k?(L(Ip7RG0TP(+N%w}^`I8Vmf=5Z71CrP3GzG$H>V{vIz_Q;08a|d$3tiikMp=KSa?S~P#h6qU z2}(m+6S^;m8+k}d*e}&MJlj16$y{?|hxvFu@Hbf9c`iYt1<23431_t`4n~y81wC7U zAm;2TePepjO2HxgCC8Msx%17oPeLBK3=k#&AMNTpCsr*o!FHw&B`bIA!DMZUgu z&hUZvk9HC8`<|UB5X?G|LEI~Du?@FeoW{g^y6$kPKb~9thkP^M?vX^TYiTMTjClfb z&U4(g$>@U5Xnpe*z-;pFINzrpul9?io%>Cz#JtW071qJ$yxs>@*x32?M*~-}^{zVP zK4pBk*BG}$YTW4$s1C&E(}ewGWiZ^YyY3 z*Nuanf1dgrpjM-*qys*-_OH%bebV{FuPC`$s85cxGyJ__<5+b^VNGyL%)o+JoPKaA zXCU?8oZ+ZP`fNvE`s>rJgd2NU_@G4V++Q{8!Q0Z`-7{fAV~F^1q%l;7jl=Pj2>x1B z#ZzUUC$FU!c{3Zd>Xzvs5$<;HPiqq=v_I1C2pqo^_f*uKFvX>D7tROVV)_0VURl0F z{*+WP%itM{ITi!zrg?%$Ndd|P{@2mTVH^GhqV)D+LBBZVSv{w{s;yi#f@;Ua3G zH_q+v&flAl;=-N3_l$2GzDe!;aHf6pMLUA>-%`Zc>K8hGs6%Jp!G)T`3CEo2$7axh zv{<#EDH6LMYN>z8NN2G%^!$78{wLC@Xn(OZtDAY~FB5o6K)U{rucF>$xRF>x--KQ# z{Ur2$o!Io`^_)*?kw78qeiw9s9U)1Nih=JD;bEXXnDu}6p)k1F-`vvc0k3QzituN=j` zvD~m(1G6@cj?8b!X&na~zlb}~+u^kD18;e61yp`+bXVJQvM1+kt#{gYA6Lk>Irww{ zSYhpGx4wDstRc4|9dLS)lLybjUVld(&Z>a_7J5iH(T`@AXef;b0nD@_c&d6IO z(R<}i8hhLzmO^J?juRj2#e`k5{O@pEef?SM*Q;wHsUN<6%<8h$o6KI^RD$zANqZL~ zfEE2q;hrXYLWwZ`Rf@yo0|S070Igg1e;l26JX?+1hgDG&mDn{(h>8(=cNh^QR$|9! z%^IZ@tEI!1#E#gsgdj0$#R%0>d$dN-27OvZ(b86FpU&sa@BKIV=X~-xIp^Hx{(i5^ zzo@-W`xJr)=prVGq&i&%C3k?$#f)zfYW*U%lVs|;gqB~~9c++aI(~8GpI&PAk#T~~ zFwp-@6dH&VABG4ha+dNS&2UyhQv7Y@WmP;ONfWo_2|>(y_QN$=gC{9C0E-&eH=X7K zJ?nCKyO~^bUeOfA8?OkOg;+PYn7#g|9m31c`%{=5GHT$5DL$}~=giKxfV-1lHZKeO ztDMGj2d~mEW2H786G&myNOF4M*FySJ!spHIDy8rVT|xUj@TiVd0thRpNU_SE_A4m$ zO^EOw5x6t2h|Yh2ouA~EKX82<7GrZ)sd&?K!ubn&*s|~5dG@?2)~0m&fhy?yq*KEE zQNvf0ZXCfrlQw>SM0UC86TsXTp&g{aVOF)Gd}~IX<*dLy1*0sWP3SyGHGa+IP^DH7 ze}AnW#81rM@TF)EP9#bnQ)wuK~!;R3=cd&y?md=SA!JCsg2`e@Vx z#cg;B&+p&mH_9ouDH1ti-J)l1m%DjZS~{_)W$cyu#o$b66mpR-6GADNV!jkd zn!#Wj)lV)zm3+qm$tO zK}leX;4f2bx8trL<&FQck(Kfcew%83RjFAK8WvO{I$JvR*6cKD(*`?1sJ9^1-6;qv zJx~<@u5lVnpkMklvdQAt7q2DoD0Mnf*h@PP0m4xmgkSSN4rCPO^kqHXv+RW+vcsGg zzG^F#Zim_?C3Q?V>8Nv`EluHlW6WySA!Oqs(i>-myYS*;02s1NzC~^WUNn|=`M~^C z2}gFp_SjA}f-6ZFE-sHH_>&k#A*j=Jm#GG@OpYxhD^3ZBi11szXCdPX_JER~hlsa{ z`Py|;b3^WJ_`IYlG@TP9VAm?oE?W>-V^8IiKb(!&&DL8cmLzi zEVD&DJB83N0lfm|1qId~ZqF5DS&H@BpDCA~fUBA2*dTr+xXoTlsg3l=!)AQ&LnR3y zs%@eHs2}drf4!B|q9eo>LLMV>80x&UfzJ(0qjz^`X=&d|P~Dl=W<%hLI%2f!FQ)!2 zP9M&t*(a75@B4PVE7DLq5KITTB|7}TV7~_XQkE$czu&i-8L6TN*=OU}{=(9)n&?m6 zUM+|VB^N@{S3sPWVy_#k<0>0QAp%~SYGS^hCwJe!u9m-*8MkDTLF4Y{y+@%ng?K+- zlGzVa0*@5GiMZHg^%bvaZ}EX$-cZX#ESU+wxU4DhdN*|;F2cXu3}q37min=T! zBEvEY>m}olgW1!PL0e#P8?x?bKx1PF{|l^vqUSMRq*YTPYS4is+m#;eO$&p4fLXHB zt;)3pf?{=y^MVpdg*n&csg~AOAyg~fBK-%>@O2ASISUl-5vU>et z+Ai?@UT%7yEjp%a-^5?(b}Z1pL01I;>vx6ttjji~d+zAz3TvWN^&f8egk)HW^@os^ z!BHxBJ=A1Ku#&|o@C)A3q71)Mn?C-wvhNA#LVG<+9lHH^Tv}e-Qo$lwX*W{bmo$5@ z$#jLhh)E+XRbvb76Y+}eMy3v?1ATnT4TjhWSHo?^{@BUEs}}DvnY5Zg|H=bp4Vg4I z+FbVvBJ%h+r3%TBi%&EAVk$UIZoxsS z`kk*TYh%iKl`b|J(VcV}6jZjr@V#1jWAKk*O%*FYS!H`uX;*4!SjMoBr>#n13-4OD z&PRA8qensn*LzKaTyVyzI;H8x6sH{JT9t%%s>3)%-?a5OYNQB~>zFLSu4*tM`#5D> z)l@k;`PB9P z=+j*$de=se*OGQqvs$? zR?$=(Z*Se0@_DKF=TxrUE}eA@Pcir^tFu?0o7dI>Vt$vE3p}c}ZOl%xu|;*u#(&1a z)h>;iNk|fUcXV^-WB=B*baA0@#EMy-SBQtv3#G`=c6kPZe)`_NI7K8R|6BRuK06!% zoD^Uvqxfvm)jqthL69cgvV@8tc_z)RessC)oPp0|R-E=^2%rM1P@o=p{;LrEoPJot zBU+eOO&G4BXr(v#g;(>4G3MNG4~?}lzG@V zMM(@NIE<;t^E1KL>;OG)3gJNZp~*$dl@+b|#I4=qW750Odz7{&`+p1?>slUkw9D`( zQn36qRHxilB`xW5UY}i6VX90fQU9VD>%=s8^cJ|_c6d-g^$lSYcj(1fC%yG#fOBmg zO_F|Jj`HSskE{)n_w7W}bgwtlZ>@(e%K|5meXjms@jIU|aW_Qykwmz~n=}ce+sPj( zzfSIX_wXnN;^T8GKabv5E7VDZT_7MY@0z7~pF4CLKgt{`xe}Lm)h1F7x%Wbg37-^o ze|C@eLpC>j=r8d~Ld@oiUnN<@c5xpA)$L9MkGrYd(p*GSVEewek}}!{9(q5s_@ixf zZ4<=A>MEX>@OS$U(c{eT%MLelYS`?vg`yV05!jP~%Yi@Rt%r}u_V87Ahf4+1Ux

3j`+V zi2KCQN!jQ8Q^z8|hyt$C@}V7a$i>jx9d3<{!jJ=8Bfg>z74w)DX}+2i6c*-gn<9M* ze6ku^WtwOX$Uk(BL`#`Mmx5V89vQs+R?iCIk@C4-0=upZc8r0;F1Ws;dUN2rrSf9b~Uyp_{jk*b8K35zBP_}6qr{1k{0~2L05f%=tIZ z;Ufsey;+L8*bw`HYmuGCt!H&!ZKZY@80N95uv=1+n|xT^~RKA;Z|T6Mqx_ zbyBPHw6x2}{upzSuH}Ka%Vs*4PU-5ypRw9Ry60VPKqvr4wB34Is#WGJP~|D}y4&B% zu`R~By2h+i;*gz#xGEALHk-u8Dw+MU>6&on{cMFBvVSUtP->w|-=g-0oH*?==I%?~ z{yNf2!Jpz1cvVLFq1>sjeVM9PZ&L;2K&g%mUf73_iu|U*GC384>lxwl$FgwGBB&-ZK#?)~~^bVGErM6E~R2rr|6tk&JKv9pQvt=CrbIQyrt!=HnnN@yxdxj*+)PpTteS*hiynEaE#S?+n!#ox@$Q)vYZ-gjzj4)h|Q-IFy^W`W|Vo0P57 z#B6~g#n`l#-ZBqu4upLGa8euLV;gh>p{>*LOldiywwL&Vpa6gVvb-(5$@CV!#VyeZ zHGuf#Dvg+iTUamP*aJ#UxRJGbF*Z&$1>4T0Q1V0mx%(G{&ILiw3F31f9B0{ASmYkU ziPM^FbJ-a;5$!xcFjN)nmZHr)BY15l54tN$!#ytH)~ zbJW;TtlEzEuBuxuNcUSkfPscR)`stoBv%56E@JQEnOPv5rdkniTBfwi#O-0*ddpoi z0Wv;%v)qjW5RH6t>(Q%I6!piiNt6{Oy@eh*D;9%OFwnXV2kn%{M~Uhhj10YJpqtEFKV6@)nved(OPJmqR08m)NR z`N|4dXHr}VW>jrm_K2Bgh-nh`!;}84Kaa$*NU#)`wNkLp zrW{FB7!E*q9IK9zYKb*Lp%9z^x!DPj!wywtlp!@gTsPYXu4^AJi?dgoV!$#kfANfF&Znquzxo1 z8U1GHUN;#ex3zWy70ZgsM=ZVXVn7a0NlJGUKcE-bG1yvgo^6BS?-fTmP`}GZz98{Y zo8fm2u&oR*bSu~=ETIkL{ZCMvnA#d>>ERP3~oZH_K+=Tw8>aPoqc<)fC<5HvK1OH`BQMh?5g56 z1^$8j2EWSeJ7Sn8I}#pWx3ie(!m70&_(WWM={ybs&juGOnR)lw#!z?TK=-vnqX_t_ z7_aS81;CvHAA|`e-hZcGvQ>@QV)A)31_D>?!uDC&;xe7`rj;pBN+osuKaRTkbx0wR zlv$6wnbmRutf2hUbtX(I6k~wv@S*9jfHC~OWQ0>}-$%i9)f_s)e#|Rq5?eYt66(tw zyox9LFKm)$FRC|_(0$5j77KDqhZ|OZ49lvF~on49uM@|f87u?8I=^Lac9uG=t*pQhlV$6-eJkv($He7y&~g7 z7FAgvUQ-8||pFX(N zT9?tHLw0E+KxLiP*J=WKd$OTdaiK}zdgMUkNA2_ChE31OuobasrrI}x1sdqxLob2B zFd>*| z4H1%?8w=u%B#lffb{p)jhrR8mM8!^}<|o@G)aZmA6m8#enK!Z6!Ca&@@s`hY&Myg* z+{keO(RCs&CC?g6mOv|7Zbslp@Wg1Gl@NreLIhLAM{hf56=CtI(TSWApk6l5SHLp^V zr&N~lCI<@V(DNrt%IAK$cr^;aJvK;H8j~_Dqb@P9cQ@&Ho#+21@;j-j0s~ zMyi=V*|pZJOPqv&(RC3HIn`)St9f+|!XD}er9dEK!;XI)!e{=qFGeaPEgqxbEP;`H zejuTI-Y!tu?OSV{gFdQkYFP3+kZx`w7s61KE6T0(P$)rA;-^0jqYe<%^k;Ei)mGT| zdqPZU>_jGU&LK;tPA#v|)dXf~dNc6eke!9Mzy>t*`{tVTz38YVY*a%`fNUpQA zznayxJVD5z2vZJ=h54j@w;4YI`%zg=bx!e|${-nm32zrUr^QB3RsV>)=O1{nskqxj zg<;_vl9kHr;l<+$YvhWCzD}zLc8fF|zB{Srj(Ek$37#7;zj;(o5wE%qi|}4iJ+V?9 z`EH`bwj_=m;os@pA|~3ME!)!vi=(_RWtV>!Ys=11wdT9rxy|Yvx=rk;yZ$f_$~l#I zwt_Pa-Mcgov}896Hc`9ouC@J6ABux^F}k~saaTX!d?M0W$%S{V3L0bywG`-J%{L=HKBf)-WALc%yvAy6;g@~{P&l1n+Y(%HX9{bO)7QP2Wb zvHYnUGWSPesi99G3m`Cj{e-l?julMtBxbtr6VKAtHgIFFND9WI#8^6m>-MU>f&NM_ zD1h~dzLUA=ktU_w?t8{f&EKI!&An?`V8o^eW=*+O6|y}kezA#u^_Gv>dnZqILnJkl z$?xdhx3x;#*$P|>yYrZu!R?2))ppR{Lrw&TWX@j#EbBWq8!R>et}wF)^^W#SSUSYN z#-9`a<4|kXan4x*{vG~I4PC-WYgUlAx*uJ>knp_U8Pp_Z-Y*iG7q+7tfK_+#ZVasf zh48#4>Cz%Q*N;^xuCfz$;-_-wCWx$PCb9U;>W=^f~-Ko^?)LcYiRX#yG zSnM%E{ij8(CDmf+ z644^bTj49aFEp64SC8|$;yC)gq0q5!{Ng3|%Xv5CzK-8t(5UDDB%cls(6DI^NlPfy ziR=%d-@v|v+4I5D6Me52@@Cns$FQTj4L6HDTC7|RHmrA@DR&!ulLTNc1&h*5o=ewl z1?Nt;%(#;?c19KjO$CKlm11tkr;v;7`3m^AnWF4hvfq|S8^3M|B$Sl3RvT32r&NX$ z?QO85x)m*k_mrrvJZZ4QV^u!q!5M#;C6k#muvG?(N%O;KKU$c<{|Mh2oB_C(kF&79M`1OPBVY%{NZT8g7#(bYJ z<|g=bG4^zVDe6Ae@A}|xCb_t7%SWX^w9gzDQJ)|xtKX~COOgf5 zWD!CCalGa!e+3q1#4E-;TOsDAHei>0jH4yfl|tzfNN4Nv*!UM>i|jMD^Uw9H=sbKj-E;8 zADYeLS4YF7xr3xM1lP2cM6Zt-sqs1-1CG=TS)C_NU)R?u%QpJ1DzQLne~i?Z(LfDa zbR`Zh0gn~USXrQAA3oS~L>rptF4Z4vRy2vrwappjv5Hd-R5DVQsnuH)y0_GQP`g^-MdyFAbM1OfA$35 z7;=u!WS94}+ap6uY6MJn%GnchSs61rV3E#-10vYTQeHS#gCLn>MT)t07l`_>kBs#a|U93xAVijOkF6 z1>Ib=blPNr=O`hVVE9U(UjwC)6K^Xf=4$qO2yZP=1l0g8p`3tU;RlqWXAQ9(>2>u` zhUgXp40H}!1eNJ4h?$h_+ell02i-lf*LXBuqreh_J}(Pf*UG+QBuf;;9HLh<-d511 z(U>xct*(!3Lhk!~4&u^p8D!i;c6)m_gwtKW1l-n09ev!mK2n?!mu9uTkcV|wrO_Uw z!k7V*7W7$Gh+MK1k{%0rYDFvsUdfMb-mqeJ_PNB=fg}=&-Rw_B=d$|{Wu16C1X4E0 zY|IP*PA{j8d&{oE+~JR7rR=Q5W|{Qua*$+!aI0)E)oC$N&{VpeIIcQwga1kowy5oi z+P`jN)tF!ZXaBHkbLXHyf=xp24!~iygt~^#yMf5E+wA}hDG}0T~zF1 zW>L9T%6`M@7=lc_4=KA05UB4bC6V)saG;Os2R^l7pcI~8D(nF`o{s&X_B|rz-2p5-Ypq+r9ULRT|h z7r2X+VjmRJ6hr%}7QD|+HIcc&bF`RmZz4xZG@fq95kKVMM&LDb(u)YYq9+Jx@l16_ zp-upB-E)ru85Vq_vsq4VERST}wz_uvTY0f>(PZP&g^6TQ+iQ_=8H7xBH1YY8p=?9f zQ+AN3IpmaPSXN|#aOKoRHT05?>*e9`0^rubZ5f`6b#xb(o48Rw);jhzqR1m;aU@KJ zEgmgtUc`hp1!3PVET*eu!#8|_F}+v!Dv-4U)&?8U>^^mO?=j5HX) zSTZTi4huZ^YO%1<_w%a&%uZt;OslLas?+xVN7%*W25epWx|giT+07gyJ@kaTZQ;fC zFd&eP|5}$uuJt%4{}tb1HF>ij2qAw9_Cbl>=6|kks$R=#Hv9O57h$aKrrnFyG-Nfu zIxe<3#M!Ki*17D%GA!kaj9~BTrn`Ox1maxwvIR2Yrg6;?OnqtB3O?*~f%4g!2tL7= zO?*OY4L1;5Ow60?xfvv9AF4IgKazB-HC4~`WVHS5@Z4z%B$>q!Tw%=R+tjieq-DD? z^A_&Vbm`V)o3s**j?(9Ep<8o7uVAfeQ7+xX{xu8hBE8NAu`sZ9ehy9J;5&ctck@9@ zFqeb6-tmc$GG1Ebk01sYLhl#=G_y_T~5$}ZRbtx!hOh;09E3C$p&u*i6)jrZPhTM28eMQxhp~P?l zTziPkx>sEV%yvf=m-CDmMtgYsEvm8M@NFJh{{B1DeXf2eA6;exK!Xf6*pt0lbI2xo zB9a@GZ%fpXrtj8t1$HFF3}@ASr~-9G4m~D|$ngepRQ#2{i-@&C*v|+Z7%E-Y>bFd_ z4tqIW&n;sW6}%%s+9`2r5m<6X$|SJmPRmn-pYGl)Y7q zgtr8{WN=!D@fINYs~A(CbrWV8shaYkg}3POWcs3M#@686d5dSiMs}vQs6(+0m&Fmp zyY=rw8jBL^-*oA*e>&Oo($o>$RSQE6Zb!!svz6kG*_QTov5TMcpOQf>xv4rK5uAC{ z5Kw7;e(r@5^|0;=HJx2>n7jR2lKVwWg#*LKl2vc7w{(DKTWR{pQbLI5T0%L)rN+>c zLZhpjNa-BYJ_8{Oh9i1kIMqt27U{B>Q)tg;z!u6!uTk!P=kZtaX`(nl7qadATZGpN zv@9Cki#jB~HH~ceFJ2)8VVSQFqzpQGf0-+HKq+$#A>UxnK%0GbVfET@8?#5DVHG^u z$@~>D_pYhC%GD}J-nF2kjK<`j(XHeR*!W%@sgn*Z&+U^7Q2>v7F_;3lZ=K9z^OfCK zzd;~h-%b<{MQfTGuixS%faCb(Ub4j3lnp}pfV8l&{M8EOhm6`f3pfm>Hs>m19SJ7xz$jI>81q)mnh3H@PY|;TGX%(*B zk-kn#);3yu(s)UHCC4rI<=_wDqoYS#ZimT_p4?GjmY$6>d-zeo`^US_OJ8OZFU@>* z&U~w{G_yF_UIzD3gSd!Uhm4DM_1A%Tc6pB;$zGF<-RW9R-KIVjvQi-a#{s{@F>^-~ zsreK6`~92`xq(SV=oGSrF-OsFnrhg`8#)rj68k5wC$A*_id)Hdv!bR;dw%NGkA;xz zdIY=5X$+Px(7+F$mwF}bTKi{70Wj)>kyDF-S!`9`5N-dvllR?ImwZFu%dW@tftSqq zzQ-CgO@Q_0-zl7GS9u1`=#iPxo4%i0M>o!dIYw4Sb>Gi_(lv&Yll!;s*nKM7re4Q4 z;vp{99HG~Y9V z6T&yH6!7MZ46Y;JTvVW;b!B%2ewLK%{^Ndlse+FG9du-T=Zy58uED@Pr@!YCk#R-i zr?w{i+Xn=t!4N(P@V7JBXTjoyRFSS0>)1QRjmnyy(j~{|PR-=0Wf))Xd3)iJ_#I!* zcMlf}UG&~uocG)b%l4I4vJK;IN(qG3PoosHFSz&n#@9v6=a(@q(r%diwU_Znmbkhk zYGjY0oNu5NCHwQj@RhRL6SI#O3V<(M=FX86j@6Io4*L_X+>1P)1o}yPQQNV!n+=f3 zsNHaZwLI`%Q+lSC#+=wTB6VvI>`2J6gX~>^#$I_W)!3ktpYP2^2fe!C+t~d1v9znh zM0ySPU$1|!Pj~~R*g^kq@gE<43Ezt4IWqYU3(Cgdd8o4}k!3w{(f5K?Q`qz$o*T8q z&Nx;d!#>fqD}r$zLfF*_0sc)b2L^J+^9EL<4?Jd<`MHNgY^8vR?TLgCell<%aL@1Wj5=rV*IIr&1Rz@ zNht)RHVmB>F{xGdkODiZ6kOAS$DIJ3B>0JwUfuGk>Bib!#`>EQ*%Y{tQX~cHy{Vci zU6%ztK>%wH!c(3wv$)a}|Kp%aij7c>e7`$K=5dL=3z~}h2v>o5rd(5(As(=)HM{Vg z?$^V}SOV`| zShhOIv$}s$|9!c z(k2IOOARa8%-BC8R8nxX3#v+5(@G&K(|srXQF1m_3vOqvl_sO# zP>TkN!((ds%nIuOe6U4F!m^~_ywZrZXn%XBlEAuXFz+dW{0mOXlKkYE(8yeXSxr{vJ*P_cbC~-ka^T4Oh#<4s7$<51ez?X`K%iAthH> zX+waid1PfO#W}>1n3bZli{Z@AJ}KJ68S)fsE(|x8=lQ#2{%g`fN3ICIEjz6zwF*W= z10aWDz@sLgaGZ0`&E;e(xQahfyW zW$NYg{0b$9}>FO7sW7YBz`i{yBM?-<8z2(WQ4!oua5~Ty=-c^}A#CwSi2e^Jb zCVg!@rwU_;c2RJqVnemexHOm!+wdB*yNxbpmrmH~R>%Z3=zI{1QGVCea*J;yp+v&5 z`9~HAxe&VXl+UWMwkaTQ@L6>D40v2(J+7^)kuxu>yY5+y2%j~xJsT5wN{tv`v)e|8 z+`adp@#Yn$Eer8zJ19IU%U# z4^*PIh#m~}CeZ|MjVUv0M+3x-Md}bx=@w(oE~Hqeq+hIHU~QMWRiDc5-%^L=ggJFb zqXMu>YLsvuC3?A|ugU!lm+zMNhxMxnm;(~80UJ9AZn3WG+P$%lq3f=iM*g0|^IFqv zJ!AG{R59^)r|FLH5yHce1Fx<>BFF|%WxxW>Bw)6OGB`K603>#@Jj!4;1aJ3x4Iq96 zhlx`h4f!*nM=_{cgBA^bW(>^ArFyBf0YN@5@|$Y`;b8~vfeaV_eTZX-O;%&Oy{AW% z;sreHbx`zbg~Qw@3|k$r&62Q*qmD#QQ-gw*vra`~q?aVC71nX%jU-S)oOIX&Qk1B% z%kqoqq;)3p`O2-S;+lz!x$m~v@Bt_0{mhuVQ^Csa-aUtj!7r1t>f^y0*Fp$I^Vubt z=VVHq*{RPyeK{4Q!Y6t@w2e}`<#T4VCF+iJ1x(3$t(WersM;VO1=te%>f=1>koEAZ zbP78@{BM^BNMpq<{?GZapGEN2xqtdWp7+0ad6*oiZRz{!oC*Y?Jy*YkqaY)$qyCX&dRLF#0O4@$a|$&0?_dYYlbS zw)?!`Rd8j~J#YWLH^r^SQyUxPZEEQG=7!g@1j5k0$+f<%{=O5Qub2%ao8pXc$d+0< zQlC~#5*YZ3YdM2%chC)8s+wx4Szi}>v812>TmCXuiOwTk%;-NWSNW@hW?E9UxO;_` z7^n76Xbs&#%V?F$BbZdHQFGI+e)ri8wqlq%QLc~*vz#bWwihkeK5BeWLA+5~W*KHt ze$~QE1J+C96Ag|#=69P2;*^{whLyfLr;}(UHojtz{9^d%k!zRCIe_mqZ_d~9#j5Ql zTb(OF4ELfA2o-F=*r%-=*g2@NL*4udR8g}fnMUn`AvVM5G>!-H48_ngi2_)K1z=#8 zBIaFy;qpLamm!?lYF-Z)8Yxh_?T`y_33|!LHBxdpcHw4Zw^6-#^-O)rbJJ}zo`brU z#bnX`X%^;!mjr#rnOS!ps`I+Ak-u_qp=15GyQtd zm**a>r*AMUC1H%>`t`=_VRwkvye?+WGX{VCY*KC<@vC~-NKX*Eu~gzOed zv*Ii%UoJH&g`LLQXdkXt3>l}!P~QRC@OIzI_L+dQHNO=UHW6Srw9j~QkR&vh_ghI- z(bq488sQgwl#xa_lzU0}GsCg@J!o&Ec^wr9*YV*A*XV^kMn=t-Y;HJ*aVycYFI{I@ zfEX4r|LW7_mL7D5N8Uc8;OHS2`|fT->m-}84Zk%R%LPFypmp-e)4gKT!!# zu8Qr@mCS1bS7O#TEa*mtw;gbk=t|of1@^|gcV7Ui&zWrF+PG&x;0(W6I<=jaNp}zp z>Vz2 z!H)Uw3DOP9X=I@HJ3rl3jrR~1V%XF^JH=-jb=qx~42h}75;U^fajoS!0oQEKPSvz! z_QhY0=hiS9^Ga!-%VNV{xLIRa#%HiO*T1Peo58Vxf6la1m;wg&sKwIdX@MP=+u3oe z)ugSk(Q${nR#zACLdeWUR{26cwQJwo_RIFgVv>MlArB0zIJ*S*F6e_K5vsxCT zFYmQ)wqo@t@Y% zRtvheAvUf46UrugeUr&<1EJ)l;9HF?V!)H6nF#nyXcR=V`HpnUnb)&jAJD)j;KPDx z?oWef_bw~Y3~o*>l^k^bo%e0H!aV61Qt96~ZP}-TS_~_VBl(<<$b~$)mGOl)U{UOC z?UJ_6$B?Tlp9oQ1b#F9}kZ)cTy=6H)JSzFI@^OZXVyy5_<9jD;2(?M zC7UUc0o)k?aQm?5g!r6CWJGkVUzOT}BBn4sp!J0Egd5c4e&v(yxa=kPW5g~lf1=~c z^MhMzaGv;k?h8*kE{A_Q{i)}x#|Zmly#y^&%fve5;T6wc1=AuThkyV4$1yH*PxE|o z==(ayzi$tHERlcaomN{+KHf#{_=>IQ5n3+kfAPK|7OIY!m&u~vy68cVkm}&~y#A=n z=l!GAuEETe!PJda;+0^@yg`j zxt7K|xGP2zEyUx8`Y6O^`5g-DvCMxQh&S)++`pge`Re)g{O<3sa*vT8u84H4BV8I) zf6|gw{)t4srDyoVf_q%=z?RAze_&`0-jPN`e7K3vEf&-J;0ooZfY<28uM35bp8rV* z-@@MgtFk*@$mLN0tSC6qfq0=eR}djV4@j_#@>+O;`gCR%^sa?HdD*Jq@{fk#HNUeU zU=h~f6+{-IDo1}giA|-BILW@oF$bFT|4qF@jU(W`SuN1M<%tciwUXX_!*t}uRaOPf z({JvwXfZaqsL^<-&wn5LzL*JRr_R3BFCNJTWnS_fteV$Ee0fnZs{3H>c;)H)hXiEb z=ilX_8v$Fao0Mtd&&-UyC$aw$N?gJoZmmgZ5We2y`z-ee@p;eOK^qEQ7)*9r;&#@$ ztTEO*dM8h9wgJ2iG0nS?w}HLsfE~Z_=~L=G`9I&^{)~@@;nIvX>*>V5@IOU&0<9b{ zmaWsFYbD32ku$LLyXVBeBwWAbs2>ddV6fk)=;0OX*%OFdmmT=fAWaJ9v;CJHeW~~P zz~0c7KZkBK!g+Az@1Tur;DD+75B7A(oT{|;rYM}~B5eJohdKPm!T)9&|LD+>JvXM3 z6OPrqI@C%|-v_he3eGM5{&TaR8SrPRQksY>AT*$}x3H#)qA#h1J@T4)VKGhLE(PsK zCN6O)k)rLi3H(>m(w)1P0P^ZXs9ufbovo<){v>bwNTevAO@gz%UaxZZ++&p?E^8Ha z|MkXqqjnA_d0Etvq)6wBj1o?Up)%yNDEZWZ*>ri*oMJQ=#h`c6sm>}=HGnj=6!lWq zT>k$f+N1;>(gOR2E(zn0odQC zJH852eXt3<4Ms>4au z{#xt-+)vD4SW@+L-CVvGmLlfxc1X8GbfZM>v~#u3`hjJ!KW^3EU*+l}mt0R}`R>J0 zXy_wpMzNzG3~DbaDxW<~;r_02`es~py=6>bx%s>jpJNI)u=}&9O<<#Wj6Vr+z~pLB z;ji33*mJqLX+Q<>I!|g#Ns@HT9UzD`VHGwR8(L&RqKrDuV_P^f(deB&w)h3uYzXR- zA`xAX?N6O@LO_ew+(JszsgXO@zk^t%2qP>e^^A9M#+ULJ9B$X~!GZ$iH4ZPwRJ9-o zfZGeOnhFVLGv|#L5^T$%#icnxEOeaJ#Wabf`2eg{11E??woN-#R$b>?V=W0f;h8=m zg?I~#wEstsBm0X3X$vR4L&gxIHr>bpsRD*C~B#pq#tckl((=7aVj{tYT+T9UmGH^gyomoC@~t_LOMLN zA|VG6IZ0!8`bls1UGV#4{`0%A1Yx)PyRb~!63S>@;|nbK^5+d)EM?51Bhe3GG%AcY zH>Ol zingg2@?lD=5hEKiDO(n85kH;Qe}F5tBwx5?ov_U6f5N{OAyoSJw+%Joja*C_nVmaI_0?9Yb%82BME+@^|R1sT1n9O z8|_R&MW7POo`aaYqi1M=@_Db(ce_e(P9g*Q?GcJkEHiA^6Wb+KCio8I67iCS0+`|H zFTlW)1)^Kvgvs5x>(4DLB?(7oef%oo1xm_-hq9Fz<)QR&v-{NOPG53y*K@KKu64_F z+wy&xrlP~n$-)qu5;iH=-_V*GMGsnjWDmDLVP+ps{jg4HXd@t}7W*ZWWblzc#;w0Z zu4 zs2JPc6Kg6Fb2D&Q{ep?8(vo_-wOAP8QE7s`H+VF9@0?<`eT|$&w-ZCd04@2mc;2ID z_9Ul#01&ag*fI?gCGVJQ3UC#tggm`d&pp!b2``CByFB?nN{`H63jDi;L)C@57hEgC z?|w+fj*W!ItV@Q;0JXns6fuPsaaln6^`M^^F(<=OH-+%gs%Uyz|KtV2w_B)@>CTfa!o zKmKjnpQiTCq-R8UO>+ah2=tBY+|X_DP_{bo`gR@HWj+1##3vl7i){A6vTto*|61Pe z2XByS&Gk$m@$cQ%FM}-}Fd!Z4yFx#k_aDbuh40WOVJ#JG1_XBLl6<;aKL0<_fdl*T zBRxKCVJ*j+#GD`$;B;#NKU$aTm+QLqTFHXkm$%X@rUyW0wskxuUg+nK4>~bfU}~F! zjFq>W!rV&;ss@iv&$Z#9w8j^g@y^0+^R;#;` zW(yErD}KA|b8dK4`&RN|hoSmq<(-}YD=6ts)0aN7=!65(JbWqrI*)1)?ULp0C=3&4 zr40eA-fIJ4s<#_ISShlPeI(XnRm@~aau^7nO)&GIO&It%{zkg8Aep``oMlj(@7xoS z8v}(34;FTfX;Q{o_P?fTUL(s5i&dY!EE8D4Jama|mC%@7=?}HPIj#Wqr{$0MtLg~G zHqkBAxL*NZI6#+-KoNj=XrhM6hXPY~#^A~`0f&0%xeFw7~(m_rUjNe6O1n=!|78gm#qn`1fUR5{F{ zp@Tz(_@yLDzW@Di?#}1V_I~XBxvtmi`3x&oXAXS=7`>)4pR{5E0zS7W2PF{CJ7;*F zL}V^W1*~aZ6$CyX6bJ?gS3mT0znPDP7L&7PM-s2)u4FtI51Ut4CTF9Dj`n7CxZ=9q z{B<4qM^FF)#f3FvMM$$niFgHrTMMEns1RVK1%{JSU}={UEmIH@JW)$li>OWv5wVy( zb#>Ty+I8(dp1UAER&!iR*0lg5G8J+q402=FRGWv;VNj?Zt^?t5^OI9^dMDN`%WdLk z_=)ELTquw9PtnZ_lRU5sr55|G6&_NA!@bl5I^+wVtxwzrX<=Elg16BOnxCNIP;khj z)gG%omx+kcx{PUdIPF`cAjEQ$?Q7Z^d|P8V4w{^S4)+ciFYPyOSD)|9X&mc_UEC#J z4~uHh)awlPp0L4osxz&+C``iIWby!4|e3qiCE=E&el??zA7ew?@fNwXQJXtx}L5GL4RELSJoMqMa+Tev0PD?jwu# z-e{>HWHQb#fWL}ybjtWQrp(QZeLhar>i{70Oh5J*D<7qO(+O0AR8xPkyx_Uju#h{4 zuZnC3OP+Z6k%{314>j>IPJ^2N_D`+FZ0d ziT}2b_7A4di7SKbV(NZM)H6)9jQCm;Bc$qEzZN-my3qX!Lon89Y70iuoUC}fiQu;+ z0LN>WD7G!VJEZWJch)op)A&Xs-d9P1w`@FYq>e&HyK+Zd&V+X(Fv@XS9stCy{TP?*)(3H2JZS+Nq?Th_Q;+7k(Qd-(k zLd(-=furO}6_wsfwUyOtq4J~lgdg+R!%JUK6hy+?JdHV5`Er$MKXXPG5<8z=xp9-(osT33CPugjvLcUdJ-F)lI*9{kxBx-X7 zpSQE1q=Y+oL+HN1usOzMzgXynvOTD5PmkdXH0ph0BC8Ko0|d+w;m_{5$?+&@SY>$c zfaj{{0fR$gkxICB>*s4P!CGC$`Zq~EwYGuY(i+D9lizbKcFw(5gpx!I~GOpJT-{oA?O-t>Dsf#uS_kd-tn<=vWpmUm4qcY{8 zS-z`13W;BHF&DDoujLcrG+&T>rVXC{TJbMPDHXd*6E;svb0Y)D&eX6rK)MXY-smyS!7yF;}*Jl34 z5WUfLxBqcH?r224*?qD)*f$`$5IYb*p1LC7G4v4V@3v6)Mm?2T^;N0&Z=V-9X)Mk=fo`SqzhYlv2bnK`k744qYGX}bhEcvoR<*QF%NxbL5`490qMaYc-l-CXGgKwkz?yO&o4}Tg*P6_we{<5b~okjYDd5HtdO%qQxkW~S=5bb&U zs{D}w{)Ha{{RYn&8kFe|bVg5!9FM zj{SBhJB#r^w(zUwJD(Z(Xm|eRD{FOu3RuN@*^m|B(}MiPdMzIW`9NdW$5_pN-U(aT z(&K0hawWDs$(x%UtlgqET(ijjHmJJwHVRSVAO-1fSPI0rsSvGI+QW(1gPwd7(y8g} z=);m%ec^VVC)WOjZAAMMi5=xqb`&vu%GqfPcJ3@#D~WCv>o@3<-5z1Qw=(o4?Gh7 zYSk)zSlRlUWdM@dI<#TmG0>~cygZZZ4c@tQ>^|SVk1ja?^*}bx01FTe>}N(K8It&* zr)^}xgL)RwtW*X5dD`Uee%aU-J?LR1bf1(DMw<8BG9T;8RtrFn|{-e|o>Ri-S zAg90om7RLl2R;+5SMX3Cql3>90)ij0ybW!B{||KMNM=8F>iZyy;yvEyxPCF2MzINi z-B#ebi8BKqN#2YJ0sW5wuL#LPK#Eg-HIh8$0`+_>O`gAVC0nONxO%)-%bfIfvhG&w zXjwtGpUSVQZF?|!68|wFcYcx&67`kFqe$5Qn4E7|xeH@l#@w`25AGa&J;-yHJ}yF9 zzs!wo5jER(mD8t4ZhMfk_f7{6yRO+O+#-K@U#my7#HlvXI>YScBN!p%;Vl7Mw~c8xGI0WE;e{GE3_6_enS+0NMpAPY zh<8-$1tPUysKKgDa!5Jn#q*U{k`yWsD(0=`10a2Qp`u7->y*TCp=3d*uD~=j4J!)H z8M83mzfiMvR~S*J#A9BbIS==JJj!~FVKyPj&ZhDn;TwZ+=MUtPFWR4i5I02>us-ba zDF~_>CfBdxSRFL9V4NKQh6p)BMqN!CtC@G82yKwy4nq5uqV1g@aF9=&I!iGqY)6>O zF@Lc6#^Z;Y*7{NG+xb_+>O2paIG-|NzobF&M}4i>v87h-=UzSAsv$ZcS9FQF0KXc z5$+|Q^G=q_F;}><_NHNB+QZF($VWA1J#}A?zeOUQUp^uI4jdeg6 z@i75=B`+OtNNmoP+3;yhpZz7);Zzn!?)ZWoUp_8bGY(EgVVf?J4Z+H}d=TXXP!tI- zTq}?tWjB@&0>nZAxSF`wnNQdN9+(EjBs5#xUaFE!Wx=1%N4{(>jr}$RhgANG9hHBNG+loZj}#B$lmi%$u9n`l5H018 zuRWDnEk=(m7(|lSG#RT&m%$2Yp2=#4ed+i+cj$$;XOh8^8py(u+al7e0>mfWh3g3aaLBxxS8b74C+H}9BLpqk zj|Dt7@5#f&g29DpC={CxvRv!T zvM{|guj60GESd}4CTVW4UD&t;tdM@Q5U4cR3XtqNs}!O^Yokx3C=Bp#$YI^urTzvr zc7x9ZW0@E(vzH?&Mw z=&gQV@tR$&gkBW6U6Y$6-n4CLhI=BbbsT07Nn;j7e~D{NH3RLq$WP3Ni#CF2cgh+Z zZW`Zw)1u0hM~6vQyzjlD;uPq(b>HI$P^wKxM+_WO1(DNI$>oet zBA!Pux*h91nR@_4)CW`?wSO@I(~WK}lq->8an)Zku3U1oC>lweCsM<3i=RIz7xkRm z!;}Pm79WR(17DrITsXKKopT{iq}Oc@aCJwk95v7_`C@QXdA4+?iBK3lwDJEO%xcmn*qbHfJ^$Ffe@y}XM$aG|IhGZc0fs{HkLyK+t* z;@zXs2PRFa!K(aj^*3Q+n4W`!zp+%z+^^!LjA~gK0x_3%y=QWcx{M#P9w+5S%ICR| zKyK?T9tlA;Kfmam05ChqteVo0L0E-Vz^&2`{dkXAPtTl&XToexB^YTJ4;8CXPr~Uwr5{kxhW|6A> z+u<0d3quwEhLkE5AAB+h@p${~7+tR}S2fp*d6XbQE`R~HJswtkPkLglHN$BJ3d4!b z9n$YUUl8KWCi(pEs!Eq+lVs@-FN{r}>$>)RZ(bUwk&K{0_W4n>9RmKWW^;|ox=6(^ z5MvVjT>iE%Q=z&ENO zFw6MOrl|Pp4o*&<7YnSG>#SAQV6m5x?R5R6gehPNZ_47{Wr9R#v}5-iT_A-y<&Zpc z{P1y!;CVQV)?@$2Da3g+bhF*%(^6LVj^^xMMu_x8kRQ1?sITI;Qt*&fztZ!EudTNUqL)=0fSziBnXCBp4kQDy zjXXta-Cb>0(9>b6*Yxza0jjU9j@o9tk_Lc_8?TiZzyIn+FT`?G%3S`03`)3zyAXeY zB6S&pp{<@gN~;Ps(?Un>r!cH!yQo>X9+CkO%hQe_Fv1a$UKFAU!M4Z(ygcx3xDeR{fHk#Rc0#kDU-Y|SLAvk5fXMz#}h#t5W zXD;t2&viQ9{AXmbf)+g2sbv9_0OswdMl}fNdMx~yYkkS=swF2_lBnk3?8p9sRQwgy z4mIgvy-8^Aagr|6Ds$WH2^k0nH#+B6(mOOUFlpFIH=e)>)s**vFL*~4n6^Sp9nk2i;^ zX4F&bbyaBJ39Hy7)m_=aO%a{8caQZl=7piIblr%f#}f*oMt?MJ-9fFoSn2fmsGD3j zyb~E!AJPTT07_B`NY zyJ3Ik7!6AK;~-9wXx-Yg-_n=AzPU?$%&~=^`DLHtrK2?1^ZCuU1XSn9YMgLy!N@1{ zC!MYyLx_o-83UxHxm%QN!!zl^sEvr#0IraT$BN~B3-l^}7)X$P`~>xFsZkvN~LxF-AHdBJXyFs#87 z>*;SXMTjxq=DiP{{)pUmT`D_?Pw}~7r~Qpl&EEu35H>$qW&LDU8|dbxyw7P#rd=0i z?eeVnr`^*MR$^d7`O;xexqm~tXDF8 zFOcsWpY>nI+!QF-K;RZ+F~un znLn8)aCs9DlGEc=SNOJ_EgTz>9)GLds?G(QGVc1A-sN_Q%SJYT96S+tOXPCG2%mc&Uou=p*D^0~Ai) zMRFK;y7W<3`rnp~1BlQB@R*}1vFUUBNts}GUrOxUbKglKk3)y!{}<4cdv0iU67pg@ zrep>gPT0C_Z`|kHsl5pcqdOfOePj`uWUzPQ11{O2yV|6clBDU5latSN$ zA1tQYAFDUBBfotXxfDDOb*!D-{3}d99W40H@bW}O>oRuZwTEU&|1sUZbN;x?LSo6> zUD`wP_|sqQg}eNSn1T4J&#ZSDpzGtcbptj>^#utdA&?RF&r!vC^M6d7m-!XbCY`w{ zKinUk-+6DtR(bCx_|wm`vf-(KUpt;>*gnB~FCktC2PNe-j+|zTgL4+xC!-F8%EjgM z&L;W!>FQaFho5!44%1)loyf2MD!s2P;!O7mz%XzQe{VlN{J=d}v%h%me&RjBv*Z@8Na)=yR);8^ELJ&mKj1(jf3m?PDnY_A~qk$!7X9fI-yPxv0nIFC{p> zJ?szrv!vx0wv+bzz2-cY$J_(^p7EytX!tLsd)`R?usLyfqSSym_4S|WYV7H}JO6yg zr~jA$J(0X|k8@I8q5WN1Hy$BuK82rX!JS6$s(aQmr(72i$vpr%z=DmC;?+u7pvu0m zw^Kp}wUUUtr`K{<2TuN8SkUv>@FFW<2Iuz}h}gJ0bA!_c%deCDPi>90c!+<(s{dm; z>Cf8%{`KH{BsqF~NAb~*ci7CI3L0(c)<1zW!TxgbkTs!f;iI3;*L6(5#4Y;gox_n~ zvmrzYvi559FgVP=z&p+A(%@%V#f<%qRLX~*?fKXe;q^RisQ2eVu|7D4|H*EH1SGNY z`q{-(uLIRH`GZ9gITsN*M}5@xp~DX9&P+?J^>Se!9DXLm+0o!|9znu?0_4@V`|hf^ z#7*2zoTzqAQ^9wkrc!zE0HC^-4XU3RO%8 z+ihV3vtIJpO5+mp18RgG6Li1=Pw&>KBy_DS+N-Hl>-cWqa+WW1gib4EIJ^oN`ZHk* z;Ga;1u;~*s1v3wjklac3+U?I}*GVl;g-zq!7X}9zhk57JhGUItPc{q#?Tu*%fcU z66QJ1$d{Jhhsu3)3-=UYjLYK1Ok)AP;{pn|7_&y`^m9YH+Gd;!v}fM%V7*|h=~9lh zW({NCW(i)wqJ*T4w5KfqqBR*2aI-lAChrMa9bTdw7ch5hL8{bE6;mb2vbELS2`RmOyV!YzMj@sTTS7j`BS*zI8B(XTj zN)Cefcn$3BC4X(yNva6wsL_+tKY}y$jSAlYe1>Y&|4%)m zLr}sKy8N0(cO`n6;QK<^@~Q%l?TfWjAsxPi?lFaa^P$v#iWv!juflT-C!%<2fw|~Y zpZK*+f{)G*m~aa3v|Y%`8EpjXD{D;%CvF>w!jLWE&1pr}=qgs|t2#}Ycn)*+!$+vy z9Ko}RE<~~Fc87wo{x}P>I@~Z;$YjS#UgG5MiYB*O@RXtn%;DkSLZTePXrgp?ZXg*G!LK_wk5gme;HIM=6aSs+>IHAxEO zUSbh7`}0A=WSfG@XZ-)lgf?^Ml~v8Bt3niNai-=1^gG=-%N8yrX2sszDGmy!l}HiO z&(--|mX{I=ravCqcd%Lwsk_NdHUxQR*WK%JyyXn-bqs%6el!wH4FC8)2|a>0b6Kk! z`_MgJ(i~Nz=@*n})CFBp5VnBjXY$OS#A{FCY4-b1e7SQbnA&J+RzI!6qyet~JR3o5 zR4rJDZ)!?WDKrN4x;Eq%1D{NrU)HDUvbd98EjTUM97jR(xhmU1=n?yOxPYId-n8ph z6*89!JTvnh@{Ly+L_WmyqGJ!ZJzNl&)#m(QPI6sl-!*2>;yoDbM6Q0Z08!Ll?NkSvxb!oQ)8`K`)9`JuM@E>=%zJ;`*ZB8|2raj{9OG>Ne_39aBri)sQ@EN^(VW zaTFH{$9RHI-kjPqY~7r|D5eU*?WSdJPJq|VN8n;RD$S5W>Rr^Z5@;c99MwL}#P$j> zX#4fVih)v5)_Ee50aJ5);iX0mND7X}B}^lBFeUyMAsAwvrv!3d{^6w-j5q}+BdNyk zjJpzK4z=GEEzFuHsVwCGuaqpdu0DFrw|&zs_F=V;wOaQ>PxIid)wb?gp{I5(!A*&F z&mn5gt~l_i$-t~LAS+jQa!Y|Zq(@!Q*_{p&)qr*aO&oZ0GVtl_%30fwn+h``unM>A zh#jH7_Sn+?XvNLvxm$ES-?BsVUhC!kO;*)r>jDE=+NeuhsLQLd)> zS@810up8Rg7wKYqFuBmEq;hjFn+(UBtbQKj=e+GWqT81q#{3KRZmA18$ ztOwSdrUEK_M|? z#nOKI(N((G^GLTx-2M`m&M%UG-eY{B|MR!wz1xUsOEbc=dK(eB% ziZ#t^Rk)Q+s#%nU*mm5qb37|ljH%Zjv%`d>-Atnu=;S-9*p#gK*=$|_Ko^QfC3Q7V;J@zfAd7my3=&y<0be_K zjj=+GqzuaU4Z%157xz%na^p&yHZQZ`izJJrvWiV~T`r(ae^zkY?qb@Dc3~x?P1yIi z6m`YL|8@|^HBPQJjZkULx)2qMBIVkIvJs-U4aFZWZW0Z?$uN&A?{Uil&mGo~$~~8K ziHI$$xe+gCWu94$8T_+*cH#u9>wZv#-s^KPf67~AZ@1QZ8&xev4qJI$<^IUbgzw#W z5F;t&--u&h@&@cUk7ICN>@ur8BVLub(VnkwKleBIid&EQIVvf&&)ksOegJ8o67G#M z0P3(+z(a*1)G?L98}eSQtui^fFj_lD&k2k)F+mQr6n|~^xj2&~i9!dg1#}yx0f6+0mT^QZFDXema<5<;e4D$-F!dG75jQnUJ>JI5rZ9yw|$+4??t`tJ{=d5T%y1k3Ar{fYgLibAjDT7jlHzSEN~;|n##EO^x`L6 zVhezqsPe`264A3bJ$8|DxmuaO_;|APrhl3iA7XTb3;D<5f!-_LtI$u}$fxQaI*Q@v zIhft_!h988iO1l-_{dToR0QQ|foLJyXC?6htKp6>5Ytq5J>ZPf5vdSP9TAfQ)Q^;}m!S>PJ7-Gwxahs5Sc{ z9750(22C&U4Z{j9z&7WTDo52OI+@!wX68aTFTV6Y3rPMS{7N`!C&AoEEUl{WU!8Ez z!k0b=#LtWOUrs_!C;nA4TG|nJx4+V@2}^$x8~FD0GU4jLv#7IoPcLV6zrNLuV(d|0 ze)+yslH~Q!^UqsGU{@v9rY`J*$J=1qBl}5c9n$u?Wo|DZZR$c?!4!i(IJy9tE(w21 z;MzLjyNEgZm7VvE65vM22Gd52Wc2oLf%RIv!cxeKg89I(lK)OES_gJhbH z+#Q43?;pmjz-xM=*%E%%`0t0l*0M%oBEWyJzoxNQXx90A_ma9&8&V%Byt9VU2Ez{D z-2HM8c=fcF)-Chosn?*;_g@#?ZmdeIQ0W8x-+zz(kt^810SP{`=&7{hrYGy_^R7ZC zVWIblO{9a%1-q|l-0lqf^us&pm#yT8*@WYP;M2fh-+#R8R;pG@8m+pH(3GS(53PCs zbHgLw#ik<7h8`-P)DBqDD}ut(7B<+k7>KTm(V;QKjeD{8?;ib)`2H{X$-|ou4SGEa z9^6d*XJ`L2VEtXVS;kEoeDn*$Z5;5IC;VUgJ9ic9fhhBCIUXI zyo+v!Xv9PtlCb}}=1x<-Y;2$I?wo;7J>(X;hAHu0xGLG2Cuf1X18Cr@jW-ra2X+Ef ze^D7RbC8>2h~-Ff2R5R@_b#K{%%6BRNBcW)jz$_~=!u#$<1d4nE+ylLe<^=q0?*zmZqb21(^JoN%7F@dAI(b1Z27O#+-Vr5wFZ>eew7(#rS&r63YV z8bm9cN3Tv;THjOTU0t*>RIXFxhXy01EUyGlGMZLYwOh4Ch#Uy#3O(NYI4?<|lC7xn zu=>UVdkK=JQYem5!4!Ipp(C!`txE%w#}lSf zU3HwOm#AXVY-HS5k%nrAGZ0yvt}53$gwOX_r1x7#tQSp~4m)Sez4uMKgOWl{u-y({ zOr5a2=TtawSk=R7qQE69@FJ!+k5AJpYu2C+Bz4e<4Uz14*gS=h<-MBHJbG+!Pi`=! z@nvD~a(M-Lt!fL)pWvLkW3H;+qND0p*D|Gi2nhT@golshe8ANP0k$pEiggkmSs!m*Ea11M4Q!kvCMYhlo+GYm<30lpcC6%k0Ev&|m zna0Z>;8CTwN7b}GCzbyg9p(6$1sQWPF~tVU^RuU#5UU)I@n}nTNXz{ zJK_7)HPZXSvq$CUAu5bSL5*Bp&gVv@YORWvJbzI*2)D6FyR_4*uCU7*BRDxHos|iGyxRI-^&@2c#!FirZMG$i>b3L=_ zQtS+<@T#C2WF^nGg{5bo0K7R*Bn3^2%S)wvA49~1^ayvZn(VoV<796T<(}5-S9jVi zu#$jdGqp9oKLT1H4n;U$8IYiB6t-rqi)(qR8hQ-?eB&)5)C{w6<_>dyA01sJFyVPp z`)KQ<<_9nwr8e%nN}cwuw(b=UHY(vs=^+Lp>NQIgIs#N4;^&*Qwi&?HZ$8Rlu1gYC zuDko)NRDh209ZROWM}s+&oz#=O^g{1?r_ z<2%(hQ|YzaZwinA;9^Kw9Y;HYye8JG`e_6vsW^{Rax^cygZ%!vAHnj|`eweTe?4fP z5!r4>+oSd^DhOsEr-0oLiYdHRDhiFr9mV*LIe_$fTkC?pg7us#e67Xa3#tBFKA-9H zZi}=lL;l3L#Y+x}HXa7)h6pnakY*$*LZq~!l{VaWVF2-D()HY+49wHawILB}{f1jD z@P!kR@K*@?-Tjc<`;Le$%hXnJhI(y|;z^b(E1;zmpx@Lx-FNgamQsjI`2$1tr*iP# zgb~l$-Crj;E7}PAN(Eb@ownDXFEU zU`@kH>(o52cB47vs`h&v4g8bsdd7MWNrh{^XHxrDCZP;TmzWsah@;%SKVcDdkbGkn zO^zc{A}!- z=?K6;PMTj8a|T?@d+inw=0S6?|1IRyoPX-{{V$Lw-$BpVIvl+H@tMU$_+~2cC3K1! zr4e(EavuvZ7#Fe$cEcY%m7KRoiuNpk%-@H~<*F1sGt_9W;z`7b`-53FYbG||t@aqJ z`yBu`p02&yrf1v7I0oROWDOyC9e|FN81zm|y4NET0>ed)d-={q z81^nk^c1xkQ8-jUOHv2EUQoQKexbTk$97ixTKDs`Vb_Hb;G5UE%(*;G;OE{- zdxw=zOEpbBr5SW+BRavW&Z!6$$Fl{1+lOV*()1yAGAz=`#8D?$gC!rznc~ZsP^9MI z850Y(m*L;I?RvcFWcz4Cuj1A401OU}{6jP*W_IBy2{Rh{V0z^T0*dXm73(}Kv;zo_ z%B+wU5lM35=i7fOX2&{cwTFBRYbtEARV;Don$pIlU;g9o&Y&_}c>>L55svkbH58 zd~eaii)Ds-DZ2S>S3|V;QJ&3MTbwemdmE5(-#QKe|A0ad*;s`{Y(+@p zeCJyFTYj=w%IOAaYW>&~DG4y01FA(OF@V3q;L z(noO9HUza@=-EROizz9+xp^zkubcT7;isID?Z!wV_RHyT%|}A(zUgkwXWwm?1l$g9 ztf`;cp7WIbIYD`TY6Mox_ZWUnzfcrP!h5^0{fSAIWm3j(YuU5d-kRvWr^0=|=GPP8 zbJ+Wk)s}*WM%7-yC@&;qmFu=D6}8RaGx(f`bd&QaLOB_}_?__#oOmNCpil^^=(7iD zO(=*ut(A(rKorDqm2yrio7!09D<#Cfiz(QNiN*w_dm)M~Eqy@%U{C2Y_AwQLqwGR? z@i{;zw9_u#D5A3M^lzn_W-;}((9xtT7}6Ob)$`uk5{F^%W+7$QjlT@Ln1G;B zJ2F|LqrGn+ReE$y}P;>+Dqs#R{-ctYStr6L-W2`zHqOEaWECR)AB{+F1E* zXqppcdOla6F!MdBz>zl>Tt`jy#a^#_j(ZBoK3km> zuOQy5kglW9ADY6}P@_is{iv&Deg6Ae6oRDfqLoiuq15RJ(cW(YvE3Um^om0N{U_2&jqmD*LQx zV~yqQz0%cOA;7;I9;xz!$&e7ndfz|A-VAv7I_5D~=ENpstJ-hDlVbzirX!k0SN(oO zcP`BM0p1~h{+fD__B}=)scQ@l|6Lq7U|#>vO9C5}8Yyt|J@=H%nv$Qvzf?um z_d?Rzj+vB)3XBn7LoMI0-8{dfI=pf0cr?B|9!q;X@u@qB`@>z$s@P5ms^+s#6peRz zRg4k74Q~g`h@$=#YDRsaa`&j#W*xXi*~|IUH9W{Rzu<5u@AB5KOf6LOaDHZo8Pr-+ zlm7ge_m6Fb?*UeSs>RuT0bQ=F0YZUKE;|qE*RCA?Ep^Dg43g6&@~_{{mS~)HCy^_0 zKC?c9$&q7&e^KR_Q~i055AGV@w^XRL`O5ar;hH%=Jf*Aqf?U)e` z{L_5!AJetuSETNHwUXSsPbHe+AJUrB+InuHVP}lB8pcvbWMqkvGYe_1?)$j(+_GDT zQ$>t(AGoBtv~@?^{nLp#ePxh1@I9-}I;K3uZQ_Bq?Fr_!{`1H=x$%%a5AN?Ny?; z6StRRtF4^zeQcT3{wMr#mC%B|E~u0CFYw1iez(lp5xLKi;Sz-> zgty#|88y54$$5uwS@|Vnl0!H8K>Y4reakUe@INNr*t;ja>+toR*rmUbe{Jp0xu2so zWfve$4Gx}^|1Skn2FNZ%7~HKZZP&im0j&ih7{u0=4q&;dNin;33-p*{T;ZDgyF~u?CPOUL5Q$1>_$E%a~n3#GODrZ*mSq@Z*`&N@hYKQ6L#$Z3d33CJ8Cr{ zF`31YxP1qLWbzARF@l;`h2K`X{0w!v*=DvGY*xjnuo70!8;w#%rMF(wc)ZXtNY7L; zK`(*KB2b!E##`Y&Z#_Fs!)8`(5p%dXbLMkXYj5G_H>FAd1DoebtU`UfYNCfR$gv+# zxm8)aBYM0}*dIHWOZ$j8864x$dt1Nj8E9^WH{L8TdE@gV)iqXvo-*9pH3P;emf`Un ztT5Eo9!1{=%T=LO?+$B^D|3Q~*NI5JVW>lMtfeM=X|!3UJlSW6@Z=MQG^) z8gcj)ydD9x&Bb#k{k7B1?>;Q&VlDWO>9uXuWe{Otlk18Cv=SZ$spf3Vc&q~bM`jU^ zKte(>99Q1J!z8**&1Ix4wO{1O@NtGZkQI0Ul5G?%4W|x_C!6V9s$~en1~{Zyg<&1j zD(_{6cpuh#t}2Sx+O{ zy+pSd^-|@3RiZx@!UGKr!UL&vB8%14FKLf8&BDuzSSfI@3MVOC%P?g;RqODZ-77*K z$4M0aYFC^)hxF&dmR_*>+8<=M=j7pHDv!ONZwUMefkqzvN@d%IyR<$Nu5`mDvTLsv zQeIm7LPG52Ki0Q$uEn_9T~}w$udzsTQhD5I%XVBZt4%6(RM`Dw7>;)V(+ack+~RCr zaOvSR9S-2Qf()}mieLeU2^k8Spnvog{_73ytJ8v&QW#o7JJbM1hYDxxkXwb%>Jx;LOwyKyyCT?*Z;chSKGtj zb{TBf|N66klD*&tO&W8r9xm_~N;{wS4+5XHyxHN|A60d7!CaJBca;E^!Y2|Q_vX2? zFb;?sd^3I?dI2_XT2@}J(&FxXfE@eUZ)GBD1^)Bb zrkso`KssbS6u<2ZJrrM)J4&f^t5>m%DH!|l%(jl|d8>}Od&{8CKj@7|8q&$-CpziY zInFxq#MuC938T#4S}>p{i0hv!aLP!dtybtLjP1_Eo-n&YAr6o&+s)hfpA?#Tx%EU; z`w}K6P7gS_kQ{?p3D7&Fq?YzKG%oAeqk7y)$!40B%RHrNM;JGVGnSJY7s~^7@+6|V-^AMxgwBlb*3f9m zOO#82MHN*B%nE6yB*K-iA}RcZbe{W;axImL8B55$@^ED+TK7rk-}DY#>YQGLYv7dB zrQF)bnT81pmwP5vb?p|X)4AaBU{w8fCh z*0U|T=#vUTq|Yvd=Hq=2lSB__XbMe?RM_6$xkUFzbQiqRxD}8~Uc;x9f+DACZ>3IX zsJXE_J(vUNxQxMH_t1jc@1yH=$Fw!ng>5e)R~Hw7gMM!TBJb|Ai#)~?l{#q%B z&Q%uvV=12AD*sDPSu;PrkdssJ&C2EHW2W0T^sE379W(pC>Kv*3K(jREGsgH~HMw3= zbBgh~=6SwE3vM4M`H}V3w%J^*{VjDNJp?r(NL~KGrS2&mqM7!Ywev4wv{`l1KfTVX zCq2b5iIL@W=#jk&4!c;iZ7Ht0ofVEp@BXcR-nTbHFe4CL)C3DfygskG*i-yhq(<-Q z->b!v8TBS5ix{piSQe|;{xw9p?VTPyQ#8Z3n|Jf|(+x>!nubtiV^N1{_ztS*iE@Vb zm~20~13Cj8d%E?Co^wLsn20KQJz$v>6IH#*lTPo6H&A)q0)A%YS+2D2W?U&c3@&Vp z_#ND%Nc)cS4noIOGIu{>WHBoQb5e*v(GvCk-*x$R)$SoT93XXc{!W&?DIOWmgx>rS zZ%`z;?8knpJe7~|<~lrxj({XbA^gG&YgH``S-B`NoGsozB$Xe#Y;3r8fPb@`khX3m)4m!wEi_V41FH(rt0qr5S{5YH{e6AR z^SxTMO<$&hWdw!aYA{{HmZPKDj!FeZOmBGA#otJw9Fku2+~b;&^HWp9zjg4RHnflc zMGDq4kE^4D3d!oo;;G+&E)GXu_Zj_;vGuLFF5U-C zoC*C9?(7a*St(i!!P46+(rU3%UHY)@bhy7-G5i+$0kO{J;j`6T-A3%4OX#GJULOR3 zna{3Im30?<-u6;o%Wx19MWyE6b5!cEw9EV<3Ex&=$n||dut!U4)o8RtD05JeYoFW=pF z;4|NjghIo+(MbV;3L)bNF=bc}t&+j@*BUoPm%p;%A0qo#GYZ{M*{hrqbcA1uF6Rw2E;_?xa=iJjY|IAEBNIsjaws_?3i!4FjZ zgnNB=v$WHyf=*zSH0F}OqBtbYosNpu*jasNHmcf~?tB5$lGd)iWU(ROq z5X?gCRv?jkx==y+-(YfNtr=U{>tvr@zElzHmjyA62@A&tr^vJl&u`-h(!DZxTh#I2 z0*Y~E-R~<59@qxWUKh;h-!xpQ)gQ*9%0{Zha&^x|qb^@a{XdS*!mG*0?ZXJDq_V*X z>A{dOx{H)Zc}?N) z%^f6Wa5Mn&ELBiAR^z}Ce0LQ99rCDVuAWVj6GTs~vlGEE4UOjHEPbyQwtbNyzekcj%#n|c}~P-AKl%eOnKX+e$3J8l zqV^pr)`yH#bfV4QXIUKvh$+H|+4f+7J$=sLZsfmL_|P-hq0!$Lzfdy0UKv|2IyDCa z;x7Mh9#Jr6`oyxp5`aGs2Gwq9@sOj#2bAI<7m~z}>Wj5Q?TxU%?`HK}y2^OY z7JpYUE$_V>Bu#y&KijCm{4ZC~u-39I zA%E;V6s)eB3JtgUi5Hb~^kjV^HY(!n)}yIWN|h?^*!PA0d3V7Wxo;b-wV>Hs_IqD& z=or%{=wBM*Ce;Wl|EqTxkhgZdFd3uL8I&ddS3}(qoww<8#SHWWw6btZ(T-Qzk`>Cj zFcytndGyF(A!GUA&q=!$*W13#cY|FS9IBJID-eq1ny^)c^^2QEWjBPQs(DiboZt5G zAMz~Du>$16fuNOnMZiix#iStmZQu==+j9lUkKUaw6rA6hetzT(?Bl(jZhIdyV+2pZ z|MOhDC19s?f9{y>zCNw<2Lb-Mnwnek@-jOYu+x$?SCCy*6Xu+Y1vmc9nkugpJS)Da z9^Nc|mz1sE^J)ivHV%w&Rc>i6;%}Kp3(Y?Iz!=il96i)0UrlPL znJx)43ovm*p04g#qO$m#`K+9u+*S{N?F=CMFwTgr#&~sGZ$;+}Idc`RSndi2?poY- zW{tSnetx+R#F|o;irJ)f3V+r0e(#x}M~x#fp6fySWd&za0Unz^W*EW5}={3!l)hWX-pT_v^9+v;OR%)<~+b3H8saU(}NwMVOp^nr}S^@j_ zH~tAOD5)O&Z)IUFE0J`)oAB;q+w|!=cOHtorXP~c<-&9rw_?R5Xv^D{4dN2c|iOxC6LFXp=>5VGXdk$b3;vK^I?vuxF@*M_;nA_f{}+Vx#nYjN0(Y9*HB~hUXRB&V=E24g#yG$qk$LVf~GY^a;}j@ z4FWlanv8cnd2Wbv^jis$yv3yBE4)hYJ-=&g9}=(;E0ng)_Bbc^h$Qm^ z^jtpd9p;Ia^CN$qC9iZ1MM;vT=;e{&l7#nkk@lkvw#h>xD|tDi zlISe@`i=YnKnOnNFdKM(7!SnTzTB!7YN5L;-h1UnE_OuEKIj!fo*UZaE|@z%tbYdtmw+ z%9kvgP^)`VY8H0Gn=KD*b;@Bb+b>H6l*?4kUSBCy2u@ol)eR^4xd+4UY8uf_(BF;I zB8&g7r8!wCJnHH0$}|k^6t~5HBv!C*q@<)0GW9QCm7ak=1}2xf9>5uw#l_aI8GR;V zVOd@G#^`qU;$60g=gg0ek7WX+D@Y{WG7B=G+Yw` zH{DQ3E)68y<4!vSiVliAhTXGIey>~byo2yt4EUHTzm`Leq4lOuAV)Q<-0AWb!ivk) ztD>q`1$5)WhpAl(PMkx26F`*YEp#t|jD(fPN_)YEY$X5AnxJv177@O(QVC=9m-#Z) zz}6hZSVF=NQz0-y3#;`-dX9Dcl2?_R9itHriAQCS6e8Rq_mDE^=NDsYGAm5~kYKQV zX}Y@r6j!M^+QLjYpSqTqwEOsAN-GIh&xqYhbvOPm0Ltk zhXuW6yF`{bcnr9PHf)}I%d;euPAI&RL-xR$hzV4Zg0F+<$W>juc{h$Q-}%e2P6kD9 zf|Pa@!?z|Exv)Fz$!ew6v7!_l`Lt@oh!M>sGg!fZFH;9n@g>=%z)T57 z`XGz?{_hjACLiJ(5jsJWk`ckCX5kb7GhCLtey%kh;P6v9aez@m`5fI7gHGOGxG8Az zBfSzRKsrvl{tl34IMc`bh2Kbjn~h;C>Pi3E^0j3%z=6|kyYNP5P`S?;m3+#bb{^j@ zKh0Xh*Oi)Sd?C%aF^$6^jETv7A!Fba&43o3f`J z`L_@K<2P=xB-T*}N4=S*scy{P>@ZSauhneOE;GZYI7y588dyx?LC5QRVae6YJXu^o z+nvE;Y`|!TLyg^ivy8PNL^&8h;yF;1&Eq8wI$vcFlHZ5Skg7>O=nj3GTE&G1FA;$< zeP7vx0o-Y5a-aD;u8YPM)t z1t@Kp`z8+Vh75js4N7Gk#fyULM%BN;rFI=@X|D=V5rk?HcK|M}(x&0-Mr*ptWlcWH z^j7^|=|A`vQNQmh?NWGrdY~%HKv>gLh?~-*B|$?>QhN zW>5a*Y_5M)5;-=)VMp!KaOWiN^oUTBdcV--i1#o1moH`%B3^wJSKSk-% zxHDqaV*oQOYX9dS=|<8kUM>^-ZBiaLm6)jOvGNizqE@UhZ;epHq9oD>RTm(tc<@xR zQ3Bc}n2RdLg(y3&ZlFxoO}W-8yz9TD4J_g3nQG|xFb4ErA)e_a+;GfEJrHOh{yr-+ zo(ZP+g!@05PM?|Wb|YK{zStFhP4|m5OfLU9&fcer3p(@W%51Vkz+CVp$YiLG`)}8H z(iqE}dY}{D+6^Lv%K%vY-= zZ{?yz)TEwyr)0`QiVWo0=?4eb_0=xdJG8S~Y>76fp#6-?J34_Lucr>Iwu|*>(5qS| z=+|@seu>FW^uzimC=yh#iFao-u=6|a1 zb)Gxy$jEwVvdpphU`hPcCimM0tmOI1ufu>304}i2*rL&cJfC-#sD4q+3BgHqGk=7< zWnFFEYJ~qQ^7tI9`HIK{zF$dqzEg7T-|UcFOU|C1z??HlJT?`bhSG|lL+#k^#+G+9 zSyX$cy_1-Cb&Z$ngYjr=apeGa^x-6yUYKfkIF#uozu4-N@Y&G_Nw>T1-h&TOzXTi! zHbcL%_$OB z!zl>DT^$R*3X>~v3gR9 z`cZv3HQsucV4YCYf%xrXqip55LB9@*N41rkLq0G3{2h6qCPyT32i*frU3|5jj5z-Y zVbx58cb%^s`PAWJs6`|X6tSR`w`sHyBP*(jP-0;>%{XNuX`I91dvINcJf+?7BnJ^@ z_=CD_uT`H9(D&|MRJ*oa)CZG!5p$r=gs~;&1=0H2991;0oKUkWFrWDBS!rX~C+xQT zAYTV!CBQPwWRGk%w~|Ix#V0Pghy>1bO3rraicODNTio&fjSR2En5^?Y_0n%vMRw|M zrEaoiU@YSWcOgFEVMR|UH`|7)*aO3I3NGmfhf0i7`r{KthQgI-*#pPr@L%S%gM2nS z>h^4+?>+XM^bze0&0&SNQRJy`ZtE+1!BkRkL(N`uI#^R;YJhB|@r#~5?4-drClSk# z9E|wUWkw~8b-GF|#P`(Hn!HWIsoW~%K8Eh!o;JB=3=a?i3+I8FpBdOLrBaAxU>-YI z9mbzKeQKjxPuqR8p89RT05;HDf3}V^DOS3M;eLQU1saz4%TYo-iV}R)*ejxRS-2(H z#H^i<^BX`#2mYA#^%83*%o5!vs+-ekKo7I`60n;52^m-{TqTJ(mUp;nk<6OPKg6bQ zlI_*r_fbkzFRp$6U@09$zZ361_MpSx6?=U6cDVD++TbiIYXc^!Ei;-U zEx*sfUIoN#pn99Zj54KRo?ak+o|-L5``d@tWQoZ)SgWw;u>hk6Wo z7-h=Y2D|bEt!CSoTR?vwsU4k`jE2x##gf8Q(qWw_1MM%gSBN5Ul)-*^hun=hYrFLF zJx+D}{Z1twhh|UA5wZ0$FZDhwef+xmHnL{9W2Nv-DE$Q4-1MH`V4WSWsVgR?`R#A? z^N%o%8CyX8aJZC{%$kCrT-iK*Or`HKn~cW#6_t?1L_SM9^`RNh5C0VZhD`a8qai-L zbb@jb7q>Gobw4TmP%P*~W=YR1EN=~>S2gF3KQ&q`h7E*E!`4p$3V~z4A2};L#lQ4v zE3$pb+~s0#9oERT#&p$70%u%9I9p8I8*c7w!V#N6-6H}FvyV(9)9CD_ulrDk@X;65c~m8EgJmX*KQ~_Yqc3VG{-f z=6>g`S7Cmfm(zo?Al^~uVV(wF73W{vhwa(d&Vu_(mi!8q6nCK=+USDXs#($ z;u5S-U7J8sb=2_Ey=BChOz{}UX8UU5kDs3sT{C{mpne>MEUC1=EyBG-oHz-c*6SB9 z6fT1%emqNd)-hWqA!hq;B}Dqz4Yvy!fWbC|&5iKC)@IC6JFPDRrA>YIy(_1_H$M3@ z;WXzZL4i7E5^-F=l{3x@U))L4R!Wz19)H<#C8@$Yav-Or<+nN_I(7`OdA7WHaF$lp z$4b7QI6Jmd2tII3(?U`{a<_V8?G%4{f9m&wTbGhlU(n+4|MG@pzEUl)Te;hEh-Ga7 zw*XWPMXI0HX81XD5chXzQp(1MFJsqo5&&^Fn%b72v=G8mBV>x^6fu25t6qm#v{QxY z;Y62H;U-i`SkgGc5kyJz95j90+S~O-&qa~zeg-1D@-IYrTj`;-7jXs5{$o9&ID@0x^Hm;WF(!cDnaAR>5=+l{F@t z7rBqq-(z}|dn3tBv`sU@tur)5ky83%P5ufbP_5p+(m}~F6(tw? zO2dVufX9jO9VFymaEC&c1a8PmtgY?E2apQw@@4hE>ugGR8O0AjkgBCxgy#c1b~U$K zQjU8{OVKJ4x*O#d`w*S)+LQU~9FdslTC3P$S^N4~U2CA3@i?kUG98@`-Di?Bp_+_& z5y5(dPS|7T&m#{OWxdXTNTt zwF5&Sg|U-EUSG`dbE-SNs-t)PtqM@nls!Q1q%=bukA9rXDEAnPmTDxkx1l=GZ*k-^ ztDB~+c&1Z#7qmjlRe?E^a?}`ywP-L8wQ?+9a1CI^LvIFze-=k9n?DV6s_d!Pzf=Gk zD`IdRf^tWizhAP}zr=uTg@%@|bF_m)jal@02&j=xT6f;HDo<0WHrlXB4YJ`V?$tlo z58wrM=sz<~bR%o`ZOXUAryNnZR&uXc3o-mmqqvB=tBR$Kr5tECDLTTY3;}6_i12Zv z1SW38CO7;=D-WS+zFjC?MQmNDlb$XRtYiDgrB14;7kXXs1O6)S6g99s5G_=rNk)ph z#2WbzO9cJR!Jl&&Wl)SR0d*M1H!42XSl>R69=hRP12g-%OPda~St|(l(&Y%$)Hnng z%bNg0%NcSVr@Y@~+pn7IG-;tlhoPAA=fYzws zAo;(q@T}hb3)`2>VW?DID%Uh96EdLHqt-p>)da*h0TU#v$4{EY*|vm|uPd5yGkKwV zS#iT2Nf2SfzPVSGqWWr8kCU*aan`BoRQOt6W1)xNiE_|g%i{u%LY&A!0 zQ}4%N+vOkg2||VuVtLC`b<_fM!nv$2OZnBg+^89o_x5<|S6^5`bwMt&wbx@rBQrOo z`gD`0bdA>JbuKSBrtRG{1^NGI?AaM!4|=B6NG5IsKxGdcC;5M9 zcyxdt8HvJ3)F+sl%L{?BOz@yvov9wsc6(RUV#tTTZf-Ay_sNz+zN3NwxaLSj^zyM- z0IdR!FvMN_bNFtR!Br1%5Pz_I=%yVX_x>;!xmg*`QtXsH&{}Un9501;G=$^whh}TFDij^{DU{&QSpZ~5 z@vJH}X%Z-i{_`pExUCrQ%N?}evg%$JH?!l!QrH`O~ z8N@jQg#Y&i03FgI74_sv>lPPD%2JQoznIlsx-7wvy85V>5|8nhm*P&%yH(ss2{NPq zT#wn;czQ?>b7fM3b1|bpxuttX_43KVpsAXWYs$v1665vX^IDtuj6t?an$VPJ@6#tM z)f9}s!lqFrQk%-iu0jV9_wXf~=LweX_Ph-&kH)y&tm-c#KriP3R$Qht&AGaoNWBn{ zC7mzI>Zw8X9mK4ju$ojR`+qda(0}`<;qETig9Ohev^BROp z!pFcpjMbch6#c_IF3h9)r_B&4{F|l)#i?;om2hdBC%T)2n_T8zJFC3=R&F*vqsXNy zPotf8zw|r&?T|3Vh64^N6Wsjwm-kakodHT+)&|aKKXt=^hgm)|9Z|4shX`I%LsFzC z)Z}VNfDB@IQ^T4uJ~^ zNnRdXJdSd^vLS}5z?BTRjX40Mz)eY53N~}28@`uq@fiNmDg*oWGkqc!qB)cKYTss; zBFMa?iXThmr}eIQZQ7soFK5F2SLo}j&f@s_AdhbeUN7RYe_@e?yrn|qZrRJ`(!y`ZYCFJ1=oFASOeZUM`}CPuI`H+`04@t-Mx4D%rp&pZrdH& zyVX3IV@jHnnYl)ZX{BQ456zd&)`KH+daCHL1Q)MWnV~#VK%KnkcJ7WHOwWbpjhNDUUka@KTHBR_ zRSzh1Nf=bzUkwJAw9;{p@{h@z3&dCCVYhn4s5M>4^I|z+E;ErinAAN*QSeQ$BaF4~ zitmj}1s1Dmwc0Q5Tv+u^6n>$8eqCiiF5If2qgv0LLgE}vf|T5$l%}qR+V?f8bV>JNzS;qvO9Z#b59#UoT4M>k zQHu_bAD`uxQNoJi0XDo>jRIXn%a`e;L5I}JTH z6A$BcALpEqn7`Rulx*gqL){)fC<}Lx@6akg&32GACMbRIMfVHD z5Q5|$b1nL-0*~Ufbb>yN{%cN_8#vE9nHepPPvy4FXLx)`%H&l%u8=S% zspu}Oq+1a(uKP_NW5$dc#Ovw_uTeqg|Ix_mh7lL}?4rtsopRpKZqRiz=bE;fjf|)0 zzSnN*v~9aoz6usw7JzAles2ZMxS#O<4WqB@*b{rf^71x~+!|tT|B|wG`E#gqkWQnN zl*c~Im7SYl-6pqS$*Km5cSL5R>~2yaEOWcX8pU#8hbZ(*?UO(%M zQy^xQM`tDjLAu`*@Tjs=#*)1uq8Sv-T?8)?YB|`o{TJqj&Le}atVD?>4w3J+sw&^8 zNoigY$Z0A>=d@)Yd>$Y#Io3-P@i&j~$vY_SR*jd^W7igt2DyLe76_{?0~IZM&S$xJ zN7g65;L3|IJ(BQ(dm`m2wU|35rAKFmq6Oz6#zidQEAj#o#MVvkjpp7i6W3>l=^Lz4 zYB*&yU@VMspBuA4sTVPKln{-Q?lm+Lrur*n%cxn-9#1Ss)61d60WmY z;f06qdIW!YgsN)!)7dqZW$+=`8B*u#-Ou3AciP|`BRi1Q&ii_^-HKAeH&bRVidG=wnDZgFCssW-#zOR3s>cjf*3y0d$7C`nZf?e zl^-Aeqv0D}lSgR|a}*WF)CfMmP6dbzrfa zNBN101Zc;Jk*S?O$cJo~%gmfcvwV4}#_NpJ8v16CAa-~0T3LCQa-DxGmo&4r_pp|l zlU$hR8)U=0IVcdinXr_RufVX8sPq+K~swy!h4=`k3Ib{;c2{&e-{uV z(&`&3usL=}XWv4dGWP&CCdgOzVNaG4UrstN*}uN=_QksK4##=HPv^I{m4D>E_+m|e zd;{%gWc@p7c+^`!-lH^5qp~L>?bg+b2YWg)C6|E0?XA)FyVRQ+)!MvamCXyhxH|hc z^4H;c;Ko1GKljZH4y}~H8K5J76*T)oflIj*j_{83hbncrx~Pdner5fPknwI6>`iQm zk2fNDHF7EKjrkWmB=7xo-MmQt@mFyv4U%1Rue|j^Oe(9_l8zdNV@+NF*8j(PExSuj z1tDth>Sp}#4yXTv#ewrWc%^dV6Q6&bw*`HO?Hs1HniHoPm<6-u(hB_c18bddr<*i) z{5r-W4WfCh{|+SlYyxcPHud~R^N*|Uy@=RHKAiR9=Z*S3t-zzxm5(YA52-P=db`{g z4G*Xpz!!=a1F^~hly=BPD;9wTWpQjE2ex778TU(-G?HfwuR@; z)w##*eO93tQlE>>!mgV$>tqAeD? zQnKdGvmIyAblL6H0|4h!7(JD%*O(Ho<1=^su$AK{uOTVOr#N%}#*SuH{X5?rn$;n1 znTQ|!XW{>Z%oB7NS(=<7k)?4$u$e~+jWx49-ql^R-EL;7d2he2o&1UPjd&B&T5|2) z|D4=mPXL#9)f(x3IQ97c6*Ty^DHfmCmpXAV0oAziMXB&_>;Zy`f_jcYAR8)}e3RCg z8uKb5KF%+}7SsMDIL%*4!R!S4-**)86x^ixOw8{9{{1{uP`n$H0CRhZcN(An-MI8? zFy`fLQ7f7*I2ifa{Wm4Kzz=?4?67CCAu;H{fk5NuYn-ttUNo@@BY>-A5+j#TBcwD= zjFBe9&!q_qFqMx`d!cPp?5lpAnb;7cN(pzu3l|y%;~funaq7(rWFm<$)Szd;Tn>n0 z5Fz;C0y|{~@@p@@f+pUYH98#@pT|cb~D%F*U_NG3dm>AE^4fJL?n)gkG z-(+&}ReO=oECS-o8Iv1~iuET(&Cx`4OFjTZ6?rQwksbNZh?h|zi#JJ{=n;Edz7tYz zpbWQ^;U29_5g+J;x_fe{Uduv+Q5j-NMiKWF4bRCPH>E{yWpgAEE+;HTi3_Wa0%T$D zgfXL$=B8uol9*wt1d4C&ydEwt7R6{3dl?J9HD&Vn-3-nJk)Y5jL#9Dr+SMK%Aqi9% z@UhWxSAnVPiKRG=NW$-gnoI49sA4&C3q3i%~kRHdNd}au_LliD+g5I$#zrU9I z(=>E2Hj&MalU5lZlnCwA9+Dc8o@2R*Z)ref9^2J1NUrujrG>l3>`?FZWgP`G)Cly#uzlZ@UHcW{ZnDD*Q(8Xb%dl8LfxC}y zaA9ujwIepZhZe#6@Q3@_FG+jJXuT^oTZj7XX?4kO}O&nHbOxGmM#$=EDr7DF2A~aM1n4JFoZ0{;V+BM z$O=?ehTkpJ_dDQVy_YQJ3j%07H(4f0TH<5O69M?A1yRYkbYlekh3*Fd=)*%ei(7sG z?_2`7n{1BQNggERE_Rx}D1Z;q0ccC((K%1B^zRy+Dw%ZT#y41-bZFAX?uKRFX!FT) zor~jp+>E#x!YCJA>BXjhxML#QwMRJY$W+{K+XxMXuyx9Xh%?>11j8lB<_{kdcz57e z>#gYiX&q%2njRN&rvB_YD!&C160#uyi5;a<*U|YG&}P$10&}_#)cnfx^?G?S505Cy zDtGa(-sclhqa*_TLH`Emz!7j@5G#_i6W^?nxzhHzkaH#2K84FetlrE30u@gqtw77h zeUd0MK4}Zrrr;V%z7To@kkp&|YhIcVq}uGcim2$V~5Wp{pf(5dxM3aSh!j zeKMKZTUvhJJ3*@MoBgi63Rw#&EcJ46g?y|IS^X8(HWV~8xc8oO)|5EvI%s_>R2vvu z1b;wo+kP4xMs{EIa>%^$`8TvhxnV%*V2&$u+K}vpE&k;ZnBTqwnGEP%c)E1={(y!5U!<))4;7Z`m^Sk+j|{K6>4mw%OK#jzI3&kNwJ`~vie zQ+}GQ4Q^^$diZ^RsM@8V-E3zL)QjZT)NAZ9W!B57EklwP=hS3bB8hEN5)$#YY{0CL zhL|_E_hvcquo<;D>i%Pq8 z_#}p6!qoCny?*_2H)gkXY$n-A-%~8{*&c@Sa)0Kg&f$`GIV5dTa_n`OoPcf%dQN@& zR7VC;>8M2=l{{W+WemX56z3jK2!LPY_-)L=4ap(59mytf@E24e)noivvAbJcfjWxV z3$I&cOTJ4zxumtWe5DR=mgwj5VwH%{!io@gjHaAJlulZlIF-0nX=#=@Y7#sY?8`5P z%LrQ=wY1`~iEy;DPaq;e8^^;5heC3^*3akpfqed;wd0ELpkg_~z76qCpoq;Y7Q-+k zBV1I}R%$-}$`}6n2H)w-?r>6=jzbjL001fO=VRuu4 zdtkF1THfO>I%MwYY6vNuKw9#p;sbDbh>F>Lo1N85GAa;H26w!#1to-PT8XqI8x^PM z_@rb?(yhb-X}R4h_`yosJhGfvSb{t0ukRq|0W6D9@~2_#`{N$SuUfQL`H% zcYq<)QC9xiKFr*N)nAiGj5@M;Rkrp`?aS}$r2WbBkziPQ9$-OQO@~8$Q{FrVepRTS z`TGi~Vg7z*v~<5GSML3Wyf77)_RGL!&T7G4Q-vAR#NRkq-!cdv5w`Hq2#WK1V#Q)? z|E%p%P4|OgaC5IWyJ|J(n=VSqkV6wGPXeg% zvGLETxSjEj8&*w|3kn^W(c%fP$sr)E3_F6d^XHs{8zVx=ujM)>mdcf$>T&De!}hrs zuS!T;n)rtp&NYbKn6@OlO>t0{P>c6D`~e@~^m$wg)_cs#|FjOQZo0C!)Z0$@Sg#TB zpTyl-Our7zvyu~`&BQ2v-ofi>grpjdq!%p{g2;uM)6hYyEiV<@$5NOx zIhvmi$BwG?J0P>sCli1Rr1o^zfQSq^k}1;Kj=OBD-30(J)k|u{?77W0<3Av){S|`n zbBYJ!G~Fya*Pe<%o@68SRb(?rAx|r=-9_8;RGd2KZW^;iOO1V}d-`*2cJL~G8#UXq zja!G9R*8snbPUPHwxE;d+Vwb#0eXtvwnOH))pZ`2GLTmbpn2DH1W}UA7)A^MlTwOC~CpVVD^-XfB&KZ|uH*``j zl%->jS+1=K3vWyiDIB^4Xyz-%YOw?Jk3VaVU5aqDkp$^ioAn?0DM;= zGj3_s@%+`T0lgePBohB?I?1kF%4@*S>NY5Ovf9YF0&iDF9Y}Y$NS<|KqaS+2EcGGj zoil@uc6_XfkCq-qNK4(X0-;Eau^jTK`)})1ymuf=$ zfegQ;Po8P8rZw+7T&RS8#5$Ihhg{JOBe?p`eHN*%d*JpuG9ln%z)Vjf+^y69V5V2N zwa417c!qXdv~?ydn%lRg*sB5v*ar>OT#3`ml0jM8nGwb0HlFtyfY4qylBM1@jk~yR zZrLu?fLD35Zw=6l?%O%!*6SHjybzbDjLZoAnCraJ6+E)B`0L`ny%{_Ol-llo8{BJ%S8PAp?O)|< za*&H9oZQN*8(i~$S{(y=|Ko4W19_dfPB~e~!jC_1J2L@1#%%x5SiQWLOXY)JYu;Zp zK%U2D{TzxB{5PZ?IR3{Vp26@(Y|K3shK7)0v0p;5Ch-e#2~C6M+5pJ3^uxzK?st5) z*^P}*9qTdDwDdP~kYn6_l1d9Et5>u3Q>u zqTRLU>9Ml4Shm29*>rIj9$?t*9y{Wd=#-H&HQH5QMv*h^R}UNa-T9TvOHkKD`}C^* zOs}Goy!dfn2ixE@tY)T5;!WU}=2$DxQQb?VI0O1;K!H2parzM&)qE6jaj2ma+e z3p%y=y!CbCc>O~(p1Ah8#P{7D)OtqZ68Cg=3&+}W)~NO9kuxr&4>O}rB@(9(Sy4PL)#hG&`>^2(}Uad3#SA7C>(%X706Y(WV z5*F%zp;m_f+nznJ5v4WyO#R)!$!#r_w2eR053S^#`4@UP4&pxUedBzCh1|KcJ)hH+ z_oJRsW$7j9md@uJS{&XaLyXIE%F`c>UtoP~^SC|!8;M3F@wMKSXw%aN{`O|b&r8|s zKZn+oA-`hS9?2Z$xI$2di0w9!Y?qfse}gGLXUe5pd37_HnVh087p^$|_+=L%%c}Ip z_wVUNlcGPQ5x^S7hRb;!2>JbTWPgMUZx!bLv#<8MkLi{?L7BNfLjm3;TV2%y!2AB-O>E{FsOTv#o?Tb=eLVn}x6a=IG<2t?qkf zhTV6l&doW^bGof@XW&(CvYr3;A|uO|V!WnK;S=$Fj>YoGoQ34^AYi(L-yf&7ny`;K zw~u-@kd-qoO8-iu$D(2Ufv?UYm^<2NUzQ~uI1j}i4TeG?180kH>T)#U(+!<6VTn42o*HA5}%tVUxo2#Tsly6AaE^KgbD8H;%rx% zKW{!HC=FqQ#VPG>N9v10fMof9r^+gA0n*r|R9QWnmgC(j~m2~p| zK&UwxUGINM@GU+%7BZ5Hv%SVZn~FsUXVN#^kv@t;b+R!q_#5cC+zVU2flwii(YA}4 zeY0RC7>`~3Do!m-uU3ikHL8h;Z;8bkAsopFIn26`eeg!C@dvoUT)Av6yijf{pR`a* z`&k*{hgh@X9)bL+ym_<_wixxuH(SdWYI@El$$~v01zkgFSRj8=1yfD(simS%FQmp` zu`@PPXGqoHRs@>@25|1!(+jb7_Z6+%U|g>3`34Zb^$8CIc8Lz)P(3pu-Py0*(4fYnG5xw!ZHcOUK} zuf4!uXz>L$e zdcmakzM9v?pk5_{Ozcdc*h!{}R=;P+I^H#7W+DDanO!=rf@U#{iGOmTZm|x42DzWbU8#0f z4=hHqDqIXe3(c1t{t~WX0naEx=URz@cR*qsyqoWv{+oFvu%O!%; zOwpgIxpK0X&3`m*0}npuI)9KQqViGKj!ozTMM=ag5rZ1(BZsQ5YeM%;3}WGHh$1&@ zA#9Na+v-eQbbvXA&)o15fWH6g+!IUQhGf>gIqz!mm7WyOEvMcq85rQwt?Uo^-`UG` zb;Ev3Hn77tN#W=w8eTU87kOI*SaUQ@PXDka`BrnBh&;n&Xhlfz~^g-J6QQJjh%%m-{u% ziOHD-brEldhT#&F`Swr3WD@d@-8U-zN98{nxlWF`u5MFhDY#L$HFb&{8GcaDp^ns} z9znht%Z*E=&EJ^VWMlX(SwB5z-2tD7g2%Ttr} zFBL5ryqAcN@i4uqu-kq_pSH($=^)wMlSFUhGN_Un-3+{oHk8&P^lt}#?Ma`(#NNJh4&*)*M=r<7D>k|?5w@2@am7u3;Z`QCkT$zvTqPF-SD zCHm?GTyc#-k6<{u6S~kx^*Yby>DT-bdUG#2ZT2yRVe`*Q<6SxHZAZ4Q*&AZt1SqP~ za23N{hde2iiW=+yRJhAJ?6(iCvC*2GHyQeDe%7kQe4FEjmN9VOqQJ;_x|?( zcPs)@-&$lzSu2TU?3jp{>q(+T>{FHKT4bF9&0)w%L7!s~W$&N~`R$OE71Trvn0qH^=5~tX2yZFfx6&8C-G_#MFeW zh=5P({GYb7enMA~q}GzhVGMl_GfSxIs}IkBM8lP8+MEiXIjR;nLg>+4{_i1anu8vMHsK6Z*oXfwfT9ubvCkJeeih9j#30SE_Hao*2zqQ z3?GVhrB1het3ph+Y_nhipoC1}p35NxA>-SF#1WGZ`ni-VKWI%pb91aiYTD{2mWW0w zOcB!4+`};=0cPExoY8LBqVa2i*x!<^9Hlmy6swK~b$?CHVtlc_CA>_AsQgbZ_soML;;GhA0=4+ywNPSHn#4N_YA|$@c zvVe{j4B*CdQ#*M>%iTEz)zYR&5|pkXOV?@B$Eswd_dgn++z|thkz3UIR|82?@2gw= zfki;XD}SpB+7&7vU;=b4$M(7ETcGrsUYb$64_(0gg2%HWxie#faw0z%X4vYXB0NSS z-E?ZHU+XTB-eJHIlRYa)OOoBxMk{{rRsCQkMFbFLonPZCt!cC*)oC_AQzMY)PEC{4 zw8M zq-S1ib%RkCo0b4tps=kn&ZAX%&n%g)o(*rcgI!Y1Koo1#^ABI%v3jtx{-+55vw{{? z54t$QN-*cuvrAoOifHkdGKjVLfagD27CSW&13Upmq&#c%?J(D^Wc`q8Urc#F{xYn_v zW+Zsrj`gV>0KC!Zj__AgW--cnM)4Ykhz()KX4U*OeCqGC!gZW$cAv5Y`O)t#cHV2VY-hPUEam=}L^0}hDDv9q40y2#v z37#N8!?7j}yDML$en52vg-CCq&?3#C2-$afa)*u<7*;Z|?_@cmKfBE>HW=@sN0{G~ zUH90|P90^5kF*-;GqD%Cn-r8M^(ET2K6zNt2W023@A`I!BVcywU^3C^eo(wdN|yMX z;2U;VhE$Bbi}H#rvg?W-V`e(qkqh09wCoV0mvg)qxm998kQBaj0*eSVBSIYRlulOkMGtnl2rjE~Z-Vb%bmkZYxQ4DQX2uE0} z`QFcFJy6=4M~eX(mijKdfQ-UFv!*vF(ehsYM~(SCQ%F+OFNf(qFQe4>@>|v;e|4&I zq^P?fzk1NZi;t@JO-%OUAS{kl*D_Udvs6?eBOBlpL)%S`3}nJ-)LOK9jZHc7HT`=P zJ@S?MmQu`UAkqRm%PLH<{-yPevN-Wa<&MwvPulqlj^$pV&IP`Uha+fhD$hsyA!MPA zvG%=LINpO8%g!jqJA$7EvRU9l>funMyX^*C&;gP=HV=sXrReKu~Ko>gajv7s$&qnO1&E0?gi;n^hnRPd59=D0OSN3^6U2~o&s@VG@a7QrB z_PnHhs>k@y?4@Z<-HgpGKf$Xl%rJ;!L;vv7r5(GV))c4 zTW68da~r;AgIg2rtN-zJy`iGohb0B>Iv<8yYfZhH(4&`BNz{Wd&-3t?3#Z>l_+l2npZq(ZP-pNj;}UA!6qe#ax0kumst>kG zhI8&{=->ATH9HI6w`yF;w^Vo96fCCXJ^N;VEd9ys>^j%%>FrHVhrcBhY=lEhfUSeq zn)V}%Jt_Jl5@QE`_6^r5J#;;ZS_i!M0TAqr{ax?6Ge5C|IUAj_XwMw9-so%Gq(;8?ktc%d9|c*zKEnM+ zvv?MgV*KN6c7w7K#{bqzGi3L+@Pq3Eh3yIBwZ_%nc_PC2)3@YCuO-s0#BwFNx%LO) z4)gpKr&oO#3Q}DmhtRDEzyvbDb^F3%d5-K9iTa`l{7bFwKp??4HOfm{8~dBYOU$dpgA}>=%uSl}jmu z0m9dvlhjL#HPb?)QtPSrk&e;|*IRktkAVzHcK3!n@GRld5TmQuw;w`l8N%%fCly_6 zmx%CL`(&!J_7kGDkeXMKeRF?EeDt)IF*PzzL$Sx$Y)6cp#~83yb|p}-RkC}7XjF-2 zwqU_xn$8G$b}f$+UCJHZNY{t{=n%X)JYsY8@uXOsZ3gMG&=6bKnvM&OE=;>XyohP; z;eoC?El`xx${{5_^9zzr|0xWY_w^X4HbS_^TWNHO9SHrGBhS53=SVj2oOz);%!dk4 zz~5u87=kJy|Bs^c4omWV`>^}#PE>N6;z-1uBQ?tb4p0-sJ#(d$mgLA)X%57VAnuKd zEBCfx?okdjb2J9>& z&(x&X4EquhzT;ldJ9!Kq>diRKurYZzjLbDo+siJd}JrY>K_u?<91b#%@oQX zY++vV2GrSQ)XQB!mA`ub-HxRcjs==dSXV%1ZN}N)dqm5#Az&cf2|T*Rz21gCx0SbC zBPPS4wT~9+ngNq%U$vZwaic&!@5Zr2S4B=PbR4?+8W~ zDDxh;rHS7CrJ(f9+8p`9W?Jwjs|y{EB1_tHrs9f6E#<_ZSoeiTgMp&MeS|*?oLR!& zcU8qe|BCEA$urt~H!`Y(7t&GRvkpzn<#_BgNF$nv+ZBd6SDH;(|Hdo`qegx5gWDBc zh2!cVz7rZL(WuEGS4BIZ<%X|Pc{B87acTh1l^qGy4pq)EG79%0ANpDv9FnerY8z#Q z;!jEEPN)oiw@gpDb#KBA90Sjyf6v(45hlpHkv9u=uQQur>6RwGGLEyl@tzJH^-$iV z;HI=&KZiN6l^a>XPq%O?&#i>?MTB2+$s`LFvK(B)-uP-SxWNI>|B+oDXc-LDEd39E zYyJ5M%hhe}(wY1tYNmz)LSJq^RRzXfba6?^gnX}8kj!rR4|Ao-ag8mI{L@+sZYRNn zOcK(UV-aKIppVA6rdzE)Sn<8nLW}Z!vRqUBiNC3kx{|=Khwm+IWQH_uzeO!+?;Aab*2%EvsHqYDwifPj_JbIYZF9FA z_t4533+}}3Am`T;Xs)3Gn?QrQj8H^5;cS#-jirm8eOaGMGTq`Jv&i`lzE|ay12N%M-MaO7 zkA^17t{de)4|VLOk+Na5x)LHMY$RL>Qza%k)*FR=I4$B4admq>q`nj+2yz!b9;rLI zhR@5ac;hK20Qd-UceStmbf1i(^990X)s~xn<}FFpU#iyx39tW-X6%2llDNOl}D?XJNohfO@RYVm5_1;;2l!zDqYZ3a}d5)4Go#}n2IP> zWqPq7s7A_|bWYV~G$}ecAMtA{$lV)VTs6Vw_Z{#L$AKe~-ry!-YT%>SZ@eb z9QT#CTB$Aqkci$>+&SqK{cb&Ouz!ts0adr(zABNp*TW07;up{itAt(&aeZpCJn;q^ zgMMH(En5IkF_XwTAT{Se_=GCLB4WUJ?rf6`5Zuais((NHYNcoeSFlxR$}YM+U-x?I zF*aUV$oac-&%U`OZ&IZzcsPED)#WWlj;WXNqtNGw33j$~25m+v-0=RxmW0VCW&cvF zJ50X!3%qPC))F{&D<~u+&quehFX{*3i#<_4gD%ylxD3U0<<-2H6%7Trv9H*LC|~&1SxFIdy}yQ?ex7noEQ($`3&D;jDJ%`_RhBj!YkMH{EQ~> zEg)16@qbKFsQitYKv33sx54<`8B$E;z)|!P-};aX zfcpH$rxPzSRr7)5#YoJk?PJOV_Z-D)6ystrL&q-Lr=`b#9EQ2OqABzr@^G_D-(%$7 z3v++KmFyoT;8FQ5`_7Oz7}~m0Fm82Sp>;v?1vYJ}s1mB2KBvg6OIcf?l#!#(wSP*v~!sovAx`PB)8aVH9ldDpY)SxuaAazJteK~gNyJ+i%a-+J2aWV?|8Af3C zM<<*|%@l~a9B7JqZ&A30HN8JCQYy?vg2Mx0|EfQo-M?SK3CLPvn-boXNzmi=nb7 zGG2J#HEIE6ACF}Ve5lMyKgl%0uZK&r`GchyoFBO@7F$-yx|9X}uz{o`n`@N>Hp*KP{`bul=d7({xe*S=s_C=old;0nd*jE;_~`W?N$VIW5O+Gcr(!nYISri-mz3A2J?=LDV3r-GXnI(j1^sD)|DU25CH zmQll?=>jruaZ<`B)F2ugc)JU3kS)dwHJWPtpwoSoGEpD?9V^3v2*3Q}xbRl_TT#M~ zzQ^U~tp_2?XzhO!jKStmCnG8`BoP+gNSV3lq4+^lZE-W!qb3Q-CHmcS3LWSQ&@BNl z5;LH%QMr+@#@-npFZE`MZn3N(Ec#CJQOrNZD({txY{eH25gzb`=BO^hu@_Gu<7hmB zj&rLx@X!%*PWdx&sy}~5P6~XPH>=*O^)-w<{Ew^jO)@>Y>qVSvUfW#3TER1Zk&^aV zt=+Y$AFX%ah7CLJMxN#_iT#hM+s=0ThK4ij-F8KHuw_YzLw%G?>%P5^P4602L8Z}N z#u~~A$@aa=@2GO1-F^9dU3R6*@Kxe@O-2Hd^tu)>a-<+It4(YEm%84eQ0#EHV`#-FFC_9>XnDd9C#CI>jS5VO7O4Qp9L+EYa z$A_m-Il`Bq$~n&QamL2rQK4*#j?J}C%oEV6i5SUNT3uxzv`SE(_V6Y7BX5$kt*>Yd z>8VrL!vouAT`FkC)zi!~_{Uw>V0);BYUjJ#<>P7QHCyW;bSvvuSq9552&`fd9{!^H zs)&Kmxr&p z3VH?nzV&f38kgJA1{!yoIg^8boz|jjUynFeAF$g~wF|5|4BMD0LHu~{ad1WmRsrB;3H%E0jk4WW=BkV4mAzNuwD#$TQEpJN)B+FrM z{e?hBvAvqM;KXUcO*Nu(AGqf|mQhlae<>Z9kUAz{<98F!q16eNY&ZYd1ejsZ#6(UW z2c>AE{1@=m3r?;AzaORz-;1&^zl$nF2tjrJ^F65}C6`>E`8$>%0ICS&19? zqC_^kbC~J_LQ(G8h;wnsfeG&@JP)QW7N#orbrlEoVz^=vR zak)ILgzk@N^<$+yGfS{{oY1z&(?J|8WE0sA(ZjUs~32zc5cELu!|GnhQ*b7nJRA@buxl-OLIdyow z+tM>W?9x%satyF8MhzajPM9V+0R9VdQ2;oswd?6whQzpJ|7?2crIzDfqqEX>5NSeYeKpuP&b7Js16!JFA-~PAj>MC{~;_#z{t%p=*gAqEAY8 zI-%!`@$a_j993Zf@({%w?lkBi`IQD#6Qn@xO8qWZ8x$pOWwzRfxBAy|%0t zV}Wb*Me9k}004ru*?b?Mm2VB`t~*`I7b~cr>g)e|u;f3C>NXEmeKVeyynHEy4QsrR z3%f7uNG*018flEq)p}XuWa&8iz*FH82(3J?Dd$rr4Q)1nD;PhY_>m)+9#OoG!;w*U zO6nMBsKY-n6uPZIxOc>F+Oj=hj&DY|-!UG9DfXGgWhuNCFApo%n!?jBA%3uc_I}o7 zE@p2HdgXehVlmP9in|eoSrpg$1bkkl&)0e@H^pv+KF>wp@^zTw1kW=nL?w1OopC{Y zc}dEI#|;UzsF%?YA`qJll#wzQs-4ccKQX|jq5o~SbX(V`^280d?oMm(`Rhe;1;>O8 zoWs?3@9H*nD|~XV{2>n-44}Ygg|bqcgC(Wz!d3?n%`Y?srx3NGdb(8XR>8i0`R$VR zR1qM(=ma-vCcRkNZiT66(~pMvfOJE@m5FNaISjM#yl#8L(zU&RCA?NjHB{1)To6*M z5Z6G7L60&g3v@Dm>S+aCkH*4m!IfB$VzozuNo#*5#6g0MO*bRWP)=})fd$*q`T~by zk1E5dEkuf}wJPI6h7IHYDT{=`MD+VhBhp`qE~~N|eGCn&zl8SlOwyD864A2_#OP*W z&AHLb+a|?umXFFjUW*#)m;gE*+Nh3c_klt79h1bK#MK;vq~V#4n(cbA6TS+`74J0g zlh+>+EjLOV0`CW5D1Wt(E0;P993#v6F-QeXzWLJqL3n{thd>{j-UCV|wbnX~&{2sT zPoY}hvgGC;`?u)46slUGNKq&*iGXT~HUZBiCIcWn)Sh55YkvjNG?%2AcdD*RSg6re zg4t@5$i`Hs{jKl;cJDF0nVCk1WMX^9THa)Y_?exUAf2Ilz0Y7THzoBvQp)c$ z^>Z^(m=)(J0R}j)bWB3r^m#iz+3>0n+7-V}3-5a<28x5kuymV4R@Nj0GP#yOlR~;}|9c|1Cn3$9ZPj7nCjzDNU1-kRq&7PKC49l+zJ{sgwo$)z zCscK$!7@*L^9OtR6fIA8x>_FWc4lS3zUy|Wu~EY3EoV9bM-#K80Nd)QlQOylieZ!a zr|$Cxng>a3B378Y377fSPy;&!W`U%l6$sC<@>}SzWk^Xm<Kj$??x3lje^?8PmWB7zc6IGPiQ?oB5tMSx$*%)C>i%6@VFLZB^Y zNt<~t+%Yw4<4Ih_4zXr6Y?a)vVpRBmT54FPJbkCkpLf;uIAEd6*GD){DzGp7B%rlrgj8GLq zB2OlN7Kv?usnhSl`CK5a^9w;%^I#vNsU}2CTBqnK(QPHL96eo|Zk0G~HoTitC#!*(+vtf-xgZ<8Z<;;~ zzqT=uSq^0SjH#FNypHPKZ*c1S4XKp6iKnhhbd>X6#j;h^z079 zhhIHHbqDOX|0Trghy;a+-yQbhd3VXvn<;z8QkaUG{9!!eulL^yu&X-f8-!FPp7G9&y#{~T zmjo3Dhe*97oOs#&*grbZ-);*YJgNQk1Hb6ptSUPN|AltzN8$ z;i8?6oH7O=O?&btlm&7fdGz=zE2a?UJ^v;#(#mP!Y3FsVR>lf<(97wM&Vc&ng*0;Q zBJ-qLx>KNYV_kr^m|9KIH!}J`;w}2Rh(tQM^4niYxAXPXkXzI^(I3C}&u(^qt{v;V z=ezx4{(;o*6ep?KTE($m@!FTKfpmYt^6-!Qy>V$TqklB_tV^K#OG!s#onv9aMujUG zVwJLt8#>6RlWR_8=jXnj#+|z`bh>yZdv?p^qnD6`VMY0y;0`^224W)D?Ye*u;xG62 z|1!fe>|fl`zA9N0yy3HP{>`^*c(BJU*E*x7{tU0wW9P$P&k|p!T(Jjs?`P!IGo?@> zJGxj*>AXo;y7T&NkBgQF#$T3FLR(8J2fuF*$4*=YHc1Hlap0{**3IDb|Osa3~}A_=K{-K$xzQz-Gzo7uz6mw-?gol z-y)8UltnShvf%n%Ezf5c67-`$?|Wk1emuBzVc{>!--4s{CSYMxrC7N7j-tra1NIix z`vE1hJU%?THcwXPL8S2qjtljdH6$D(uNBTB@sq#Ss575p1OLY~wbRL;9;)z9>ECi; zxzm{~ja9XlH`wdT*a-Jr)wia5pF-2jpS`@6<=VT;Xd-vQ6aL5a1V3|@W*vO%Ga(Uw=}FmqaNK;r14o+=ictXVSYPextjMWr)q+Jbx+usoegMDxv`6$!5=l+wAk z=5fcM*Knm_#}SoDBl$dyr$K4LA;Q*GTGl3a333>=6Rb-k3skVcO63<~J`01?3JZ2! z*Yr=D*QZIk4^V7$*Lpr5LAs1k$B z{w0Hp|4S&a63rAu%RX9;RA{-EBgh1+5EFvJlD<2ZUnhDf;n-^1LYovTtlydps zGt@r(lMChCR;qQjXlRb2N)At>wX9~2%&l}(s+(jE=tKG_NV&x>*N7TW4_dyxz+KSBP*%9oGXPUI zovkj)ODYh}#{wc?_bZT!XDH-0!tArL4QkesSDgZtEaHmP`K|htv zjPbThBNw)alms8)+l1aw8DFx3N$NcX(A_h_uv({GGJA;9Yi(|`z?w&#zZBZQm72ZI z#fnCj5`uY-u4x&pz+d3?ZlCf*w*%ucXIKDx!4|m2+?kr~7r(2cx&T-!^xiq5sAX1n zeRGo%4|xuEbdR5e$yfQ|e%JfV%1PiXiBk}Pw;qZl$+3N_{hs_~`@$P}SYf`+wFI>h zUeqfkiDbIMQxFSdHHy)LeNgI?x4^4qq*k(q9y+)n1LlRIq`as+<*zl;^})m{pYjQ? zwJMNPDW{(QGDY%^_1je}i#=RUc<7SKM&aQUuyCD)!wDh0a7lu2n)92I15hkvv(d&S zx?Vv|t>r&5sD!&oH5|!9?%DWZ3GRak$4gszB7RhvBZ7u-0WIH}sa#L3i|i&M2XIGf zGKf5o59fFRxvNX|eON*Kk?@`I0H_w-GbCd!^7f1Hx^a0eovxINHML=xpor$j!BKtz zx_`)5%eJS@by(>haJw7xS<;Btnwdxbs(N8HKAJAOV5pm7A?Gi3OYM%$jLC4}$~Q-p zwaSYUL9w6OO6AQ>p}k)P;Kpo&0Ues^&(p2$zN0`g<@-*}NcnG*<@MCEJGU|+5Ffhm z`7ClI6C^2Q$hYewrS|Rnuteh9@QVBR2VOv_N^r1dAhB3b;B<*#~+z{jR>E~S%h%)wH8;DUawJqGybLp38rJEat8^zeT z5c|leNJ?KhNzJ-Z{2~XF8?opFwQ# zsU_}?3d{a~9%s&`h1z4=gC?AaiRh!;xcM`sV|QvDY8uDsr}X5V_9Zv-y{pCm+1G`d zhY8>yub_%_AGu+N;wH}Qj@hQF3}O`}ErFjPT^r~L8EjA@7Uhcp!Yattcta>coTel2 zPpTZCMxo|^2aCXmHbrbSolkDC-&5~z4Le8 zM(@U*@p2lB&p*T7)=X`?uQ=u2%;jP98iq|PEY&`ORP%{R39|?Yf2O2*;NJInV}h?b zrPGShqy{L2*4MfnCc3FX)APsDX!#KpL!j)Rgy0L7ELeZwd~;R*OawHK)X>-ofs7`2 zyD|_Qi`sN9C|9@`ML7YWP8EMFVZHLj@f04;VD(EQnRETjB2nL-*mr~ks6J`9UtdzY z_@2+Cuf$8-?hK^s8g`A_t@1@Q zc2Gdlr3e!T9$4UnP_l?^aiZB#bM05fE~u=ad){z*nl~U(%dmPZRAE z3yl4>-!L~*m)09H!vo}_5k?IN33V-wHMjf!*kx0n>~GZ1CZV#8?1o`2nt|F|MtM-T zTx#tV0%pf*D{O5s-ENE+zgPojWkozIVUck#G=OknRt}h_ixvd?2?JTX2tUaF3A*!8I%v ziz8tW7G2R)rTHXqZ-E7YzR#i64Ob(6mqvMDq7Ci>di>|>Hiaeb2{+AWXYN1;Cy%WL z=Cq-~SOh$TW_d14z8THHFa!1(xFpGl?}7&-*n%Z%KVOOE;f*Q_V{^B*iIBQ*e58uL zqF*xT9WL!P2}{07_L;AF1LjCI9mH+;j8=q9f#~9 zu@!&Yw&H`RLgk(m@kf}-rE0mA9Pybz%K8I(2v?{F1__CccMe>B3=#xKG-ZX%;riwT z{^V^^f}1kW70e@yIyN;xSrp$|T73y5(f=R9KK!#Nn!SOCxlTDXF1gWxzvEhx`cH}| z;JTR7z+R1~o!f-uW^2n|dxBvKfzHR;s3nWTzrK#%Gh^0=7o@Zfn?D zU=G(|`6r8OlHgw;4sAWLHRT^Nst+%1VL(o=Xo?9+TpauU5KiY)@|%SlAs|IH-_Kna z&L8z_?_v8gu!jEUttJxfWRg7<2BIPnwxJvhA8#Mpza~7L=UA;uo6p_5eV$(K&sroL{S)IuW(fWD$r<-=I`EHgRxv z+j>C8c2}xXzGDwub(-!=-HxxR^q3mi1#ZzTjU9&fx;pgHrm)yJM3#e_9%s6}KC(Y} zs`SUx@MI{XX?5$Ri6JC;jt&%z&=QE;MXzfClCAs{?YFvFbveF7sU;T~$K=Ed91*ma z_?C~=t!h%Wzjc@$)fGYcYsfXj3}LM51sjgKk$H&IMGJ-oH)1?Q)-$K?M^L`u^$YNV ze9}@`n#5v_zaRu=?Ya&#vo?TwN2(kc9#+X}xvvJ=_Hb1&kmv-pK6$6?)Ns|I(@xY6 zxY>k%{dz`){Oz!GM&vz(@w6&ubv@B>aBYKoof&HYY0}C~+pt7ePBJxEV9NaEGYt*d zpUt@;`yz!tjju{tJ)1^VrMH3psDP*?@N>bZ)pnXR8`~JByFsiTYR%90(K&Un|6?+}=KDV;_I||2mFW6<=Nw+r zu=VKW!<7rO#3PPH!{AVWeJJjU&7lu#!YBhJs751;W<<4N=r4hq7YVUu95)Qn*}~c~7%;P|+doi7nwL`fEJzqpd#ceub@_TdE=Q{pdSoAeTQw(UFOy z#5YFdU^fYUl~S@)Qz0Shp`QRKRP+JduOn^%HONDXK5q2w0>jxF&6X-{1OO%sAj09Z zOmsg3)Ff>fOFnt?@z4L5vcLN~07juFP^Ukz@6qH>R}9fw9Ywtl$zM?=7l!LUL-$2q zPkBk~Ng^MfpVK&fZ@OJ7eZTPEds^XDvaxI6Qa@a4#p~7om_)&@wD6CC;;W3NpBIYq z-NSCS+xF##ndsI)S-SSu_pAPJt!O9Mga7DfZ@!-l))+jPnxI5A=nNbbeLNsjTBgE) zohZSPIIFV94+IyfmQ+jF&_t|lCK)+vY1>9jYV|Vz_8Je_Ef86*Qye=ZKl^%!U0umt z*f=?=&C>Mpr0jHDd;H>K6XFxqHRxj={GpJNa%Q3{h6umnge@D>*%air?n$10A>PtQB= z#USi)ieQL4yF~&FASV7aH!ANt)adi02l9rLlXHv02!NN*Lafd8hB=bilMbz2g|h~v z?E*i5wdZK7ztHAEwdOy~dFcXm^6Smv>jSa>7GIBjb$-3@2V(VvIcm(AIjXa?-Lbrp zrWeuWE|~6A@a;jBr+BP41I3j(;NVcR%f_K8P1?#-Dk#7mc)FfQzG-B{p07&xkG<%x zP3s7~n}R?2A5%i$@x?O-Qyt+ARBWi)mdLQkt<@8wiXA*7dN5MY_+0JCvUh`lzpj!- zq`x!Hk7bjE-+%x7_ns~?|dgm<~Q)wsXJ6ypVJ)h5m7#r^lY~SK>z~%_q?g zNZL#+Z*E7sVVeT3GEnumWGTPT*@dsc5=I`TTmwLs7q7U~Idv-a(MKLW@#?C@U%Pjo zqi5nYqWszDAo6{Febn3*B1f}s>PYJ0%tDwQ8 zd23w+Rb-4&s*GlC$$?n6+6ym@LgOnwc~Yme+slMGf0$UV-*C)WY$oez5GJ(BhZBF9Clg=9MJeqFHXKj#*<GDT0r+n+GPak71;?jDwo;Ek=^o}_vlE$^89hosH#5@(D%fl-p%ZMXOH9>y z)H=v_R6@Ne2<`Ukuq$W9yN}X@hhfqm&FP4UtHhaCdR0WIfC2#Z{P+;4DJLOc=R6JH zmZ%CI*Vbd&A_G9X_P06J(V$<-w!mkmJ~;~8@}{fJF7@E+L=-7s(1&H3@lvHRL##yZ zjc6Q_<*TJQd5qvOgW#SGqK{r!{RnyWry}u=iGdazwM)p+n$RFs6CVpEposU3b=`Py^kYIB}6One4R8pvE3XhZ9WTR_Z#a?jemYCSDmJ6^&{kZ@-o#u?^PWtf*+; z#QWrN1m5Z74=pTl{=%+b>_eS=EB7aodrm~=3T^mck~VyeYAY#^(*r-$9)_B&kXprj zs4QwUZdrNDP@DU_S`1LthKZ&YX~2Q=W?(UTOR&wVNIrxr#Lxp^ouM(=7L4%jRg&wC zJ7>A)u&4q-pFDYrae{oo0qwG>GnjOieSVTAFu7&iM)g;OQI@T@WqrH+PZgSi7nu_s8 z{Y7Dy93VBZ=>QQC#a)#HIIuCjEQ7-}3Yo->OE@M^!?eoiHn`XLM=mFd1IW>j@-DCO z?0rhI-3{}}LmMg<6tFRp1vaAzpl;-c%$(N*!CDhh#6Lz>i7)XSqDSsv%gG(dBsO{f z084>AZDtX_B(WI6im6k%WlD9nwy#gnR&9j6&5mQMraAqAFmh7RCf1kMF7ybI?!e)J zxewgPH+3hrOf%HC&eZ3RNSu@*P@1jWa-vBy!IYDfpu??B}64FvWL0lKg{!aLZ-ME87?v7ka`9pjiL>qqvPl$6YuN?!}thJ2YLxk;f zxy|>}KF!`#*a~|SQ9Kxpxo^1AbV>AB+_3V&yk{k`P*bX+_r8bG-^%_}bqC5431)n( zrW@8c=pbsV!IM{8$Geu>%~?l3w&8aqeAQA#>uLq2hK^imrdB-e877xC&Php#vv?WP z>IwrBhuNO3w34nI6!$wqH{$|clm8t&fO5zyXV5!YH2NTG4nbI~8TQqy>@R+1ghAq% z^cAm(M@0MvBowWxUy-?E6+PLcUqcbdXpqnr66+U!8-hsIzM;~J4t>1(=v;5)f3|^D z!FAa9x54(EJ?-96Sc>iwIpe1`BEWYHpIa)>3KD zX!_gI;d99oSHidu|JDZ<73ja5MU8>S!7_5Pv#6o{oeX4XowK@jQkb%GVUu6wPP9`2 zC8FdFZsjkd{l;g!63qFt5jX$dfWq@MROe6LhM?9i9lu2~6aLu`Qlpq3%gGkOfDS2! z2I#LPhIhjfW2}_+WP6!-qqw(n+jFKV^X=Wp4*RkWha&z?^Xk(lysAKxh~lxCoCw00 zcnUNk@jqH4`d}Yd;9e2KPf|7C$+h8s>)l2J`U0f}QI1t75!~|o>!7^eSqxMYm2<{G zSuWy^7za2$jpelF^_AZJB?CHeNO{NtDN~$ei;vxgIO@Q))U5CwGlbl>{f)LXC@n8y z{1;9NY=x@P5r4s*>Vb8Qb}WTGJJ`T2UhwhK?WFQ!n6$tFM_4!NPn=b)t9#)#3GJq?6dhu}K;QZ((RG@)o0V-4f1dQzA>ld6 zQB3m@)gmNVG#fAG-PA^F)#glrTJz$11@E zk8{HV+Ccv1^y}D2tFWXe>b?H8|75@F%4k1Aqy?9l(rUbh`QW{E3&!b%2AEa&RV?e~uwv3)oF(OUzP(;^SHGLVYn) z$UYWi1lS0)P>%s_xBsT>ds?8Hgrwe>uL)sDU;F*`8QIt-yyHY7C}W;}V-FKl1~5soQ$iy1)Q;+JF9l$8u|txtEZ0!%~| zPQI}k$`*$CQqaxyD^hj9wLC#adzcxij^Y?txuC7J>%NkKm@b{22vNJ~R=f^qU8*cB z`3_oH&xvT%J~lp0G;$}~+mxpfIH{#`Muy@s)h~Ty8Q8Z2?;ShgK$>tO#JKfj1Mh`yVYP$_k$=W zVNEq8%ko$y9L?Sf=4)VNp8dt0puuA2P#qYM0%yHl--08J%?j1B-a`#FpZ>C$RR>>9 zR#@vj;C$>CK+D57y^G?Wl=oBULz((Yx=tFnzBtTO3nP433S4BdXU=}&e$0dx$+?3{ zMJ?JNc7`?fe0(7G8&frWRi$DfzZUev?5@wV#jM1u0=HiNlc@C;&&uQZ{racHHxI}5 z4O1FMDS7@;FYq5esN;r(`6`np?#WGIhpoY9>P|+J&V}g!X^1an_ zDO}2z{H(l>(4C0#89Q}@32E;>^!C*t0v(V!ODJzt?N86E0P|a>)n~`+lvcO>+Y3+4 z250|&gOa?~7GwYX%o^j$=P=-OQrj4);&}guU9GxG>S6E0+6w|Q2U*A~KF=nfrLP=^ zWPAtpFg9J!beEr$9G|=OZKd__^nz8H+n3m<`Cj~(4$OrTO4CKvk?Su(Cm6GS069)^7=-48lY5;+_kV-*voTrKaSKJxJBE9md5TSxz6iY|RmeAX~vRTX5A zSE$Oxb=h>FIqM^t?tT)Hj`MqJ`0-j6n}c<0T_5a!O!?5KZ$Fkv2Zd99Fr(+Vc=r`n zN-ti_7}30cAbqYb3V5gw0em|KK3dACB2NoBZ#^T&x@@}sIVUF6ck9p({xJ`+^Iqht zOo9Db5<4{Yo#|7>8GS>$&8@|eadIvFOv0;oLcG})^ZmgU)SsHP`iGlMT~bwP#pGMV z?>WVdRO-Py8_01B;OBoLyM+;tsk-~YQ(w=;n$7O*Sk*l8GhKgOy3 z3-~em>XBYlq=tRXfYAAX)+G(=zOU}VT&vn|cX!~TSZ#{Rl~V=2u$ z;ehn>PRcd@J)P*#dQFLD&kJ=YS7L$tzy9TXcsRLLcK__g9*@gHN6D4?M{QmgzAN^g zo}xqFz(KIUC)E4>FM#OVJqvAsSBu{UeKH$t8WnN-B+5$fefPE4oX+U0-AAPt&gV?L zltRo0HKEe-R*+uqzol8O>Q-Iii4++*(zBEl0%bpW607;-YCr))s=kP*PryXQ+LQwpM`bloV;ze6-`)7?wbQQ zWdYmW<1kg2jG;2%!f}1(`_Hfc$Ar8irirM^%dy>mwFNmFiCWMCA9}s@`fGdzEnb_> z5nrV)gZH956z%zH+_?N~s8%t8+XMeF07@N`Z|@8&`RK!8mDWi3S0Lk~HeMrLp`$HK z!SINvRrd}9Vskn3vBpCR!b6;rG1+ojF7YYP2-V)oK8p+1TF+_tb8AJCnOoJYYlRUF zna{PdFn8i6{j=m}Qsjl@c6y?eZSQmA7#L3g0}kt)<;o%N#J~(0&u3H`cXFg_jIc4w zvQ^zs4olDzl1=r=H>2{KyOd+i6%8Hn~c8JMO?aO&d4vl?ej;v0E>xQ(}+DaLk#UN{@gp5n9N3rVQ%NRi%k9 zJk(&V88vn}wk4^3IoQ8yk?25IVxdyGyhYXtNRPV|oYK5yQo-^Zha!gV+Whg$6N1dD z?2ia`eb15U7cjme-{ha2ojqcWUjuRs&75ZrS9$(y8a)+>Z&m8ubuCd^(PMEYv`V#4 zb=uNyK&vn=?j;WdRv4}wHcyJ?>B6D${%YZ@+%;6jd@4lOLtjbUfI*Ws+Vzc66w3Z! znkLHNMcv(ch5`=E^`(m3=>;v%VF7deX&a$zQbwK;O^@Q4yaP zQ^kJ;{#f7H@?r>N7Fu{o^gmj@Szt_VSk0p>a74NLf+rw#C6&_$0C!%-X^&&kk?NP-%{dD`)Ol9(FU8t1pAm+Tj8Mb`dpePew3Tnni^Amv zO2k=CTQ`c~Z&hkp+pBT=d%qNh=U(2%pw6t^<6G{)P7+l1zV~xj-I*4;E+!)zmgAi< zB22l%X0`_LZQ=68O3LjRPuK-_On9nPJrs`S%(XSL^7emW7bH}LW!uoy_DT=6mhVZD zQ%kUU!8&PP&@;tmcFgsKE-W)7PkcaJVi3WcAbgpYa*zG67vL@_SZ*!jrZOfiN75kJ zThi_#X4*8tM0#u3PLhy@gy_pO&tNuNmZ$A6Yl_+^F#toV02#;8Mbkh70WYc`NLEbd z^4N)@5a%zMxIm@JS;AU~FrIZSeN>(_&WyD-x>ZQ51xZfL59;RHLC50>hlflOZ_E(& zGIx#P@Yc)6`2x@1xY;xrL~_UvoQ4qn@#_{2snYOZuGFyw?RnBChL%v=I`a}2=aYh+ zOs{pG-CVDo%inw0V@;(!TswYp$*?E1x8df0{@Z>nlUp=N$7z;h)9 zQ7&?2;U_+`31PcXYG)PD?R8CAwX#i5jby|eoSqS_c=S>6mp20&K3cMRrqsPsGab6~ zVPQxFIJK4-NH%QI>;{WSvAmvwn3{z)I|QiI}_x*3q)G62&oZwir@TWB44{kTH)r zdW1=wFL9-=2UQk`0T93(@xE6EEC+Mv3OjiE+sc45jdhn(Q@2NzgAYCgIH?|!ZX2X8 zb@tepNt5bsi4&PPoz#lO`E&ZImq_R@`cb*~fOZbEp5>xy3t6S__II6$CA^NV9{x2& zxg4rfb$L<<^o`}5k_jm(1KMX}t>vCRC*8KLx?NSyM(yy&*-hsROs{Qp-E@<(?V}l5 zL>Zu@G1zibe>^J{%sgG({iLK?v;w-!o5eD0~e?X4&3G{#Zi)@oM{elizv=i6a`$lS6R7o zWI0gF(QqZ2mZeSW|MGs~BRtQ+@f^?ZzOU;%H~)}$bMCBl>AFpU1iHHxKD3J%{)?tv zzCuOdy-CsNHIiK4DDrqLGNjwS$O1ZB@D;QfdKpx|%wQ%d&G8BWyn)}8md8EiVLCM) z`Y%}zef=fV2E^#E&E8`goKv5c>F)dqP!@ii}29*XX7Q#}Ajc0xCKk!HS8~ zFCRT+=d;oPxsASwogQLjdQ*5t1ng^duUR!-BnXGw#MSqQ-qN4r+CYULb|)B5{Hj~a zo8vi=BdZsT9w43VK6sH0?B{W1&d}3_;unLi8Smj8Z|fgSR3R#b|Fz94J_x>z!L;z# zIRMyfN``CR33myWAQ-?TCkZYvcTO7TO1J(95h$%dK+M4!B@EnRmGrN6A=5G`I{L%! zzHIN@BOrDWg%R9~EzQRp5&b)9iLmBX^YEvly?CTZl`CV1eU~v?y_3=?yZaaBh{Xql z1fZ45Ig_Tt&8~YhhuJYJmXU(r7ABDZQ3(&lk)|P|ia+e84i(h<9sJzjBG$OwWZ{Jv zC|E)TSyi>ZRZyUja6i zf!}9O;?32WL{z<_!!7DW@=+wGE;HcvTEFZchyHoQWB z*40qna{<45qnbB;WWS_zhr}wEV!W)nw5(!9BuVg|+@^DL9?F6{RzxF*lGzLCFhO2b zAtlcCuBtxAY1d&O82rp}wh(U_Q8RjA4Ck|Fhf&&cZr1U@M(}g)`NX<5 zC(h-JA`~_K4T~A$fOsPKzPrni9>dM$;%KN5J?oQHdjtS;Dzws?6}m-kOu|dq)RWFOhQ(o=oalAX z4$dw8*$1!OoDw6*<)F%M-MG|- zI6(ZJ81fr+n5u7@`}%S(2$}cg{+XBK(#V1<5i8(fY$vPDj7` zU>_477HqSszTvTTP;(n6507MZYS)J!9=ZMVGR3TSd*o4GKeZuJxLBbhL?;G5=EL5( zeHL>F{J`g4t+0tEgJiMi#5K}5NXyNJTwYyl>~k`59@T?siuklRFEqOBq(Pi*xZ%O| z*=0*@#WC>UDIXHbSY#zDgKjhVTw)Z0r>|?AdfEulp4|A4iRH@XRdGa73uCUtBVLrJ zJ6GKcPSR-mbn%Vnhnk=NxICeyyZry*AQTjAr|bgF2<#>0MCbQ52` z?l+!|_9AQ0E|omdr>u$?5SQ(>$qi_jjA&HA(^f-!wq~|j7Oy(g$pbybKr@ZKxV1OR z7XNSa4s%>C&O9^~1RIt9&3b-HTT3;BY>u2l6n3K-mcNE4lTY%Qxlc`-nf845N94sY`TvcaM1lfrmJ=DSHSvT2f{8uErpv+3p@BLa~e8UEm^MLCSey^+j7UJXQ(gqf=#Qh!+g|0@~Nh_fIT};ccH4iikZ{% zsBzgYByzeV2X;`HpY`WPCW>+_ z3Mc0vQzE!fslU`!y`u;nGzm?{ELfFyEb{B+>~Gg!jVxce`r#;a-)2TH%S3v2k?3p% zgm}X~M*DJyoO(LCNUE#k3%5G7H0-&!u>54dV2#-t@ZqG=D0>yZT4wq!<9`zG5LKQV z5BU~uAaT_<4bcf^?=`>7=}OV{L6dQ68C%Q$WNU-5wJJ~h2;`%Zl0!=U>6pIP{4bw; zp99s0lMx36Lqbt&L+|cyT~&=w82OdI{IBA>fn10L>@Vu4|Gw|fnCf7X+_QK&^y38N z_t+!7&&izgGjI6K5^F25Nz|4-sBPNJTh_&hMJEQ_9t*XW4BKf+bkg)HjZ*3 zD0Kip)S<5)5DIbC z`^i;A2s>81B=i;oqi*y|$zfju>Wf%n{(~Elz4{QV{#L7-r|Q9$uDO>iw8G*Apr8wM z%`00S{|62jzO+Ree?7?p0r|gR{aN6Z%AM@bb{F9LGm7E&L5OdZ``$2ji<)%GNyf20 zy`4qc2285@(B`*xUk~T#HsM@IR8Oygzfm8=}6Z3cCl39b^h6$8~|ZH zmCoX4GkWg5X`!H8xgZ0V;t(5EQ|pealtzadQ?g!uFzrxfuVDAq?qQwpK8x=#t(U#% zz-&`I%qS=j#%<9rY#bGNcYJ7iK>ncc$+S8JQK{CbaYe7`Pxk5>GYW;9ED`t`i)&sb z3)^V_o-zHk92QG(q~%9{4%3p|XUqjLb;0LOorKI0oG#Z8s@a9fJLQ5T!VeF*_nxwP z$J7`~{@c`HYjJ^!vjT#PX|GsIm30NE_qPQ#Wjg>PvKQlu8@AWUU~8|Cs# zKRzfml&Ql^7>b67b>cY8LYVbuSQUL`IW%@C6(JE%WigfEM#aH?-6C5l&-)cG*|sc- zVHq)h=jS=Bj;SC9HK{?W^mXy%aYJF5TWNdhn4AF*&h2TDm55Z9H@Q;L%K&H^6jWb& z^97>dX@(#%cNZ60_e`N6A6$UM$@9yc@G2Ja!wtUIPHf^7hHs0}CM+cD3ryWbL)pWk z*f02}V5~{ZvjcED&F7ewvbkTX$9Y01{~wmx%m_r4gTGKisgNX^O?7-xuG64_YKT|Z4=E;hHmm@*X`B^Kuz?mbm zFa71}7?O3NwTzeM-Zl?DBc#}v@eLKl!}+Epwf?ibnI3Qhh#VZooTo^1Z4qTbZz)Bb zApue#nsy(4fS2f2N6ul>l3$(D`{UtJ;bXV8#}s99X5q?3&?LMcgzffk7Y*s5x5Ywd z93%J4>i!wCq>Cg+Neyq^Ycmu7sdR(C?jfA>I=RwDSjnd`qt64F8eC`q*bCMNy{&qgnoUX76dij4^S^| zvha(#1|!rhn)OwU4l;jAuD77|iZ?czr_TjjT|u09m=L*m)?~y9_Z#KS=;y#KR)1;` zzfu5RJB8rpA<|WQc!hUJNC=OCByep zI$iiRD0a^trj9-@i3&gs&zw19U7$J=rsME>!X~g}z|Klz5a;@i84$f3bP4RQ5tI5j z(%@`wPKhQdahY}Q|NZ6Ky_r>p2CcZfWnOV}t^bcXE7(d0(2eLQ@d=)ShCN+-@fcjA z{ry)5FWrfJdpD{?PudxMfUC=x&6`!a{A@6uLwU}GZY2~Acz4&c+VK<67p%}A0qy-# z{&h_E;i82dhPD23CT@G7c(84eV`U_ocB|p-{=cB6if^eZ1=^Rk%^7~xsn`oh@g@n) zugn^@IZhP$?MMiWBKd5h7ghfe^>Jaz!~9SE2f3Tu9su<$2+A0AeO*cs!)VC{-*jzx znK-Q{!1iEM$jA2_bR(c0=KKrx%Qt{IKo+zqXx4vV^ z=xX29Y5|{zFUKU#BKV@`Rp-1jB|@)r>Ga4<5X#~`LmH;HT2*OvtuBV^UkAwqfx&c- zS$!=s-Zd^4PPuCe-}6eY4EA~yME7{m91!R&P`DCJA=qqbe)a@yO5MH4t&x1Wr-zJ z#n9h}v~lY4Ue7vi2qP;qiuQ$w-Vz*Z$X!|lGC%^ek|U3Zie>)E>1ycx zR@HdgIbI`(6DN)xK4;aBVR_mA%vLky0(3!s9GcwDRSYll5!rMjn4X?9h( z(z+0syS_AzxJ0s+nzPPFm2BhX?OW-pi53t#uXZe2L}kp^YBYUz0DN)AX%NHqLuGU{ z)F_;;D`NU@Q;EUVm^Uhx`xu;m)frND{9rHO<+s*xt$b(4_l4JeDFL@u zm{ag2T=-_5l6}%mUW@Vg2w`!5qC*PXfjEL@;udH;?XUe{jREC!cs;2VRj*gtl^d-)6KD;%B{T@K({oZ_o z!0n- zFD2WDL(FOm7$;2b!wJZgH!Mkb8qW2sLovN3hjbHF5vHSHNaqD~hMPT0fzhb(G2c`1 zSt^hcYFsR&Ey_~m>HD$)rFR+*L5Wmj-p}9*RzLxEFTM3!sR5U4lR`3{a2(QRmb6uE zzB&aD1B0$lyj)9UJYuEApkOYeu2vfRy1-rq2h(+5wJ6uQfp3F{Y3Y#A7e0cRi6B~w z*MhyirzEsO#YoZU>Y*F`(`)CCKYLpE2U~3JS%Jo^KQg6xNaa%mt`-pRce!P<)^9IX zMrT4D%JeQNCgi?Sd`Gzv(M}$&VGX$Z8}aBuecQFAsVQolt5={h#(L?{dGYh=@$KmtW>l1;E{TCfHPwvkPoWuX+Y#YLUckSUp$6UEFhM`_X@Js z&sCf5_mHW89gShO zb-3}jCGZ>ua>H4>ByKyaH&*&95Y;Kd| zzP4CoOl|E6;L8;r6WN8`;cw387V_DxK}W{7Hym2rjsp$^5)xuM)7}Cj|Js>I&50@q z1ZijYqi!PVG*qbLn0VV{$@#svN(t#JiQJ@#;~vQ48)*r5JcNFv;L5*JV93%b5dh+4z#oJ?9`~mI<3O!6WWzQtvfb&mSW-lJuCInO0_~6fJ^oe> za$-0yVV%ypJgqvXNmuXQ9hjn0(RrT+OGI0)2XMn;>Sqnt8)H%LPakE?x>*N5@~qn# z6!B`9G1-0TvrQyc2gl?DcEP(jKcG}ZT}@(Y2aJhpz#j0QZ{J;hdMsx?GMR}#CaM`~ z7OL$?rX-zB9{15~BpbRrJv2pR{l{c|s#2#>7h*TxHJjV?X2b^b=GMoqL6!H4IC&pJ zDaIkal;uf;Z9$P}L+m+}>}=NZ_rF;V%sT|*9Tiaej!E%~RH1U~d8EM5LvqjMKe?v( z06=>*RrJ7ZjZKgpbHHmfAiH9u#?I-n0uLAEBD1!Wbm48 zCESwrus1c|5cp^RZ$b3-lYcx)`N95>CrkMvkmKcgFXS)eA4jJmpUZcT6eEhKGYc2x zk{f%+{$0&l*j;oW;3HkBjMA>yKn|i|Fj1SEjSt0pD6ft{<@LbVptk$TX|@`{GE%|FZvM znTTKhBd#rwku%VpUFaJAmzGdlGb4R%_d7cD4&zh7?pN1;YJ>J^0gw( z2d~tH&l&JX`rH`vFm=)Vw!s3q?DF%H<(>YHpfCSA-&+@LzF0DmT$F78oU6C%S!0-8 zuHf~gg95dmxCr_e_;1Sa+i&aaA-hNIQT=MiO%|~`WY4I(+_2w5nZZvauYO3nnSc56 z(33{Ts-nAXAFEdeN5g}Y&e9~A|E1(0kI$A|BqekId-qo1@ACVVtXr`!V)OgsRW2%f z=x;2jeQg_a@il63F|qz@?xo4Y+VSvZ?Z;{pNPCI*6j42|sJF~kVf^z?TW(%k=1|Cl zA&;y)jcgs}Y?IA@;RA_pkbh1RaeXvVf!h)9Qt^pB4i7nWmh{lFR{+$cl)2-oI`*8m zL&ijdA*~>*No$j>VeyX#X7;b~JhGPoxoZNfHDKA6YeA7)wnQtSt>@)b#SH12&@?)x z<d5zWbW%Z1y;PBvJu>_ zJS5&Sa}CCoK82Gug@F^(q_fE=IgLYiit@oT1w7>5;UNrMgS9JZwD-%it*4=#9!nHh zv1c$eL0!ZYNiACHJud~(pQBs~Wzb{(7HQc)_ZqgRSU${aA6n;c#P4=f_J(ckIpIm= zR?~X4s)lLGH>fFK3v1>kE|OJthV`jz#fcoBW^dLDUMYo1?G`hB+Gw0@aL7rPFBH+w zb6NnX#H6r+m0{q1sk$I;qAOpY^J>0;8TUh6ieEKqR(%qZe4&W#F4~gp@J$`AAiV77KSe5ZmjhD@WzSZ~;)ttq z0zc$LezLIXob;(5?kW6_1zW?fsSq#vk-wv z$XyP`M&FVde7m1@mJsuLjCEP|g652R!8gV}{lIyX$&_S5n|U*C16G4tMLu)$*VN>H zl&;~UCBlIafyf^^iYAvM)bUR@Dwy|R@5aswQJmHqpRw57=fA?Jc+;JMy&?)d*P1M) zvGy7~mMW!@P!*L6^1P3nf)W^cQ6ZUA=W~QNv&AzMj&nzk9#bCPR-=2YFaQio5Da?HjyIg>7aeg1_Uo_%uS53Pm&V*)YA zE7O0ZP3EL;TY&yXnikK(rqxg^M;pzE^WgeYD}d#C4C&*{83Q4-8omL4qd$mxUrO0E z81ZRRmmVzxEK~AJoh6pmMeM0@cEEr;ogx|1yJKhb^caiY29xdfRR#-WwGJhHE1y4L zrPo`Vzm6p`l~E$7XK}T*w=)MB0MUJ{8p35#HoU4CxWk2!E2Ov&g?h@?lsg{iZ)t}< z9qB(%B5B*K?S|VoOlw8FRcS3x09}D4pDg&H0Op)QCwJbwr6QjjGFp9%=V>M~N{Qo~ z$@az%$Y`sF;{KUD2r;y^Q0ro&9{F@3K>9Z_07iWsmQ8^EdYez>u?F~zz?v&=|L_2( zjjPK0%tp({SV3hR_gi6TnU#K!&wk5jxa-36s8+D^z>-9x#ywu%SUCnWc&npt|Lk9P z!0UAvMLni71k~1>-FK=kfQK7pk5%5-c(48d>pE0kW9%`Z*(2nlIl=6;{=I-++lP(9 z)6!dDOG_8k^~2V1)9?!t8UWA?ttaKlSYfnEw%^{`_g-tLMhJTC$kNexTYGV>!)u=E zSNk6mVNDV3wnxpWzc$+o+#Cx{^c!?u+z-7>jJ>pq6t|gr{*K?+F>w6{ud25rO_j|YZTmQ1t!EmiRm18DWH z&-+TUV%QsjkplKq^f$Y$!uj8R_pR?<@+v-ux1D5tOY&=6kMneGxaEx(?Q-e&;1#@h z%d!?j0Ik%LczE%c5<>>ADFRRMc+gFaEX90p8CN#6HGDrnpYDzzN#Yd8$dpd%ncg7F zbtPbYn?sPm_*B+DnQ?L#VsZ7YCMUtixZzOMEl9WioQ{KA!?YYwc=sbv(Q3=paKu7H zU>yqF_ncL{=#7Bik@Yu#O0DKS4_oA zAcdm+SHHP=7IGdrT<2I;wr_ zHsmUL0$&W-yP%4B5AYO;V!M85tQ06lnzv13k%?VaQvP{N`Q^ouNG3N1w=qi} zSc+Nn?-W9u_3Vty;w=D&?mh;OcLq^!9A~knR*QncXO`u$93`L5U0Vn`gA;3P9vudH z!-9-OA{-*K*m`6U-*I$4KyF52o&Wqa*|i~*wYF?}rT??D$xU}aK@%TQyF*j)qCn@W zy^GICog&Y7a>p-2cqL>2*W=k+n&nRp$@pGJfPTDBx$0p4<=I@m4epqK+i~&o3l>84 z{EJv+lx|D0z?ZOl*_U8^H!J-Xl|U|nd6ttp`Yz&jGvwa{T^EP`LFQGDGOENgp+Jo- z7^O8$Q!9$J0IHf~EPHwRU%F^>txJY@^_{rU197`>Gei`n^1b!8NZ?pc?u@^rghu} z_F7iL)+&g8Lb}e6>lQ|}X;Gb-a>}ou$o11+RnW&vm>T3o#QP=Ji8K^oU%O?6kDBrXJ`>t7!%O#PG z%9*DnQ?5Ccd5~JSbqg!6@x@)mU{TCC&=_n|;jqh{v`E)3zq=B(h1hE8n-RHQ^C#lL)S+@bciTjHiQwaJod3 z;+;_N`e5|@F=bu`e(OD4rtc1J`qZhHi<%l6QT&!<-9%q`DSMgNp7XUODxf_dB=}CZ zlHolA{dP@h@tflb=3HxDHRFwbJz9VrD?5iR>sDwTFBfZPhYXY$BF+jkWPxUy)t8C~ z)??45svI5`H$D5gFuqB`hJ@RA`4o+cP7mmoY}Ui`(LXQsw;8pfUK;+#)Me=c)~&wo zgVvZ_%&K#4ja*;|QyRYbW^`pC_4euGHG}Dqo+u>7e;{}MXDSt+Z5zy%*&la3dN{PR zZTDtIm#Ae>fJ(xkXP||&@A6xrzZFBmr)IO3xt_LlcQ9ya-|hdH(*DWq8=CPs4Ed^q zIFZL6KW+Z;xbwG#L2Bei&S{^BKN`rc2NM6$8crEXqIX)WZxTZP;-jCu`Hia^f5Lfc z;RL&?c*UY$TH05#_9&urQwdI9+;U-7U-MmgpnKH#Pvy%X?d0$?yIywo&$g>aKQd1Z z+EAASXk8iD_85D84KGDP+wkVfyGf#n&w?ddBxF|DP%j#2f5mN^QG+TT9xzuO0M2PE zAvN+sY2?PnmZaKp4vlXT3aW&|x#BzmDe>(4C-@7>OaYITojp7G)nnQob ze-HV2$3%Sg4V4@mTh&K6b_!$x0v}0cKp)({8gwtWj+IW{hor|}kBQu>2;1*TKj&M} z#BLkWx#UZkmq+q7ut>AFBmr#xg$%uWEP3N?!`vtQ1iy`7Y5wmdr~`9_)rFfnp!B_4 z+~AfT;s^P{>LQF(!fMAIRDny5YJ?hMDXw@ z2@`_E(aqC>Z50(4WJQyq3wG`Qp`D=bv|( zI|zKfSgO{QMzcK+hBqsd`BrwJ>e7Q}ONg9|x7%anr1l>zjYXlf5TjZL*;r5Xrtb5( znVf2Zkn8*eYyy)tE_XQTG$3RJrjU`DFL=t|(~#Q>vK5~~tMrrB8`~HKm>GP`>ym)*9*x}#|pF`f|^r)}D6sI?z|G1d`d=nk{ z*XrgsPvdSd@lS=-9DiJi1R~`qJ~lWlu%&T`)m^#%dL+}2NY4|{!;Y@|26a0L_5k>WpJ`R$icMUd^ zZ&rQ09e3n2cjdyrv&*7$LsFUt;4PKU8&4KKXTb+o;O^{T~kna^y#6q^k=xjIHxOI zlA_$|4CbFYzQEXRE8zQU(zbD-m_!9Zq(^yjxu=<<*%^@r5kEBiq{%x|mg~k&*+Whu zK1^)kA}ZtB5TaZCUW&csR_PU7ORx|`fWsiw$KtwD+3{}|*Z8p%=^OwCQsBCcy1xE( z8uyfaO&4rko;x=pEA+PZ+@pynlNz2_3bwQ)hRVZRV$UR4?Hw&mHdxMKtu5YH%(x&A}z4j5#GtI*l`JGWmE9g?F>ujcvJl^rQR4;~XPEt6z< z-H_>p8^LLDI8M|zz;lW*)3gTlSOK^B+DT@}7PD*dXqVkJOwMg9nxp4qn6|>Pr84Q6 zqv_)btk=1&8@WqT5CMald@&9Mk)h(6aFF01mx`q*I={lSs_S0nZ6K<%ry zEcjpAaa&Yo?%lls_BJbIYbk*C`jH3dc!f>Q=wkur%mR6tM;3 zp?c=qX8IQ+fm2p~bZda!_HOY*ezQ0i*&BiW4RY`y+AxR)?GC#2fmgOZvE!I}-9j1& z-3rPoxoS&ztZ-aj%i44V_!}lKr9G53vZNsS*iG!=fa3>A`=%dRryY9DjE1Jd_PhdND^>gYc`3S^2LAUS zXSr9_biWvh3o*S`O2pg1-QZ_UlnTy>x6(}sHdIp?)C&~Qb<8p6xpp19+@O}nLp|x? z(mb23iaeWp8o84#($6mX02|c#p{bv{75;%Hv$Z+hg=Bq7{Y&w0rXa|uCOg^A_yu@Z zkh+MR40qZXyH|s6y_1{!v$0+60qh%{k2d$(Dv>bzn0;ElGw6&fAegAfF%7*P#^7Yk z0>xWEaKn4ro4p#ctz5k}#jFi=(`zldX*SooR4d$~4%yZoUoUE7;2$ zrI*#v?f;lE-^I*DJqC6@t|@T))G?W;$dEYQO7p-*b5y()Id6kGJOn{cGG8V~t_r4G zP5~L*0>WT_qEyuN@`6p!Btr&5m0DEJBo~Jodr7Ef5sm8MKw;(IC4>RrQ6n|P2`x^- zX;Tl9InM|+W%PP6^v8{B_m>~tHS|`g>8I#>E9p2l$Xb6r@--)Yc|V`~@e--pd3GfR z!ac6|Lz-`4XG;h2!C~IsaiOl_$!|h~iu6(?nt#h%laV10nN@Js5s9H@LmJ-i(^h8#bL~V)AFY|Lzx_H0TvZe1}<8?@5UT?TOB{H z1;_{bZZyn2;X?65zZ>hF&!Deor+#`oZK;rZMNtTSL!z=4jir~MSBX62DJ0st^_Oe? z91m7`ApNe>RFVh7tU_YgQj9>6qPY>x(f0r$DrzmA~tSR1v*vBqBV4G{%Ks9X2)wJ;cm|2E5XPY6+Dwigb_IBkNkN7VYOZ zZCdcn{DGDzRF*mr5FA*jzw?E$);iZdoW$$nGNVmC5F~+44xo5$yyaW{w(_4C=B&Dq z=6HgSQSi6V+WQEeF|g)ZYVQn_pp1yO02w7(aG>N6VfoXd)&M+#~EJ}05W{4%mP(X?sCXE^Ew|& zrdNm0Hb!N9L)kvih@K3Xu^+e%$bp*F>obE=d$ld+4VzTGGqxw&&?8Wjm`?%!7HRRp zt1{~XrPG>=F1I-D{7~re*YBb$^nI>kc+6q74T}y=xlI*1wF50w^cnw!J+Jv_3SYxH ziZ>Z!ut@h>3LRUP?t&je3}4)b7!l27^>duPLa2>W2uYMlu<*?(&b}JIN%Sk!Z9UGSHJ z=cHTF@-J*+>Md!_Cw_&H2q4|-M>Uq8L#eLYvfYnLe$%tzhSG_Q89`an%88Fmyvp?t zg-(QIt7OE?l{PfW{i!^_0{%ppgr!qsuzxYV8V=Lcbw6sHznAC8{aDX~Tno6U3eC3>mmm(F67o8Z10>9r?)}Ha6Cf~6 zj=nEB=Go0LyegHvpI^QiCImkkvFD0u*6j z8I!lzJdhI971Ju=w4stSwT)`AiouMb-wJuhaY0J@-2K08NDc6J@$d>Kf{nS1>Lk|U z8Bz*}gSp>{;yih7*2F>2PtDBw!$)t$d!yLkgVbo&}TT8QA+)Knrm5X%3{`8>-_%G&iafrYvc= zIKbtD=G*%$#YnsiF#IzY&*%(U&=jo5`KO`pyaIX8;a7o(;+!^j3Ej{YH<7Ep>Z>7h zugAFlVKFb%R8wG}w$XM&P=b;AJ}io5!SV(BHP$2y3|dBIln_-?atP+RDZMj;q^NUv z^_zjq(|vyZRLoSycg8WPhl$qway>D_3h)a=d751Il&Q;egWI}A<{2=(y1 zaNMKc!ZoDhp!s?7;iS$4(!DC|#PDD9&5d*yt32x`MRz8Xm47xNlb$?(X=04zC!m_f zTDz^=9X_?>!LFq3iqg6-mQqm=dZ4?iOY@SZ)8z+q1%Kr4UpvH2(mWsrs^95QKH+@y z=3D`sK@>X!c3gM5T7co@OdpHHEH}i*kXL@Kd_cK-JgGGiV^qB7I>apckSjws7&q?e zq6?fxEmz2s9V%Gmrq|2d%KHB0==bTPwIbMp^!Hq$(V9Tb7}%STxJ`#~R@A@5+C|CG z@{<)w%z8oLK%}?Hy3gJ6S0kVCaYa@Js&zU@wc_1>3g>UfX!tZ;U3yxF{+Roq&gV@p zWIXgFlCsaJv2hKe$d$L3@M_Q0PDIoe2S#eyJZeg=yuzKDzqtN{F=f{jaNbX}zr7Z6 zL+Q?uw>+!m(~VC1+Y^BNwI2P&sd%I^D)Qf?7i(Qs_WA@N|LFe1g}29Tj9uV&ax>{a zrg6`{f|szrCX6$CxV1C#m+v2E?TDWfX@6)dS40?|=bKo!3KK0jC1DxQqQRg_s&U=7 zcfDH+MhX%fg0s}IF>PiwbbX z(-&1|!qVahS8P!=d*`ETg

jM~O(8RRu8Y~!xb>lex1zkRb&KH*Q4wXbN81wy;h z`vX9GI?%sa0NswPZ_4y2{?8HFt$puLK+ROWgu3X2m$1Nq6WaUi6&1;Py0_uXuo{_A zv7}TTOq^45x3>DVP{{Ttj!?F!3_NcN!Rmi?@OS}v_5Jf5orShqX{z+C^a$$wI3AOd zDuQ-DJqtVEa_JAUW6{KAiJ^#p88XxM{lmzZkIiyXZRpR2AK``Z$boRmT(%2$9(a0T zPRxb*&^}MoyRGW$pMJov1X{((#p<0OlMBy&-g_PDEX`@a9{4>4D zIbpQ^Z__F)=&>*Go0d-g!m}4!M9cF6HJWL(HL+ra`n}S>6Zxx4sWGv@(U(f`jp>t5 zCKY*Wg8$m4Z830D)AOl+3Umq&?cU(youP>wBeSV9Zxuw&rZ#ZAhDddu<-bSb&GJ(< zhX&yn*uPuaZ~`~T(!2^FUUuLc(;3(1i+glC-AMcE{%)ipB%shtD<7&liW?>A_~qOL zmAi7l!F>%~ncad`CmL$?MV=YTj=CI(hgQF&vNW=m)txr8*c^~Nb+`M4H|}ld+A=!8 zhsVH(4Pd9Bf7yDLxU{qxZ+aRVeq5L_33w5}s#haH%^m$TrpP2Buve7Qac@SEYoXf_ zvLz#1@2CtP2tN4(XLoZ4RSlQV14?WYDQm^k6s@{AQ`v@bY86Ih%-zYnBb zM60(N9mv+*+UB>rC1pA~cAfPJ#R2Jqda3xGnzxW4HmAi7l`Vy30Rbhj3l4Xv*9iDH z9_g@psyr7MW`<(S0ZN? zVoit^m_E>%Nt_)jsR1mEMp}-@Rx^FK=qOZs(pq@__achV#YHwZ2+Hp^YB)6*6HYN z`3g=$`SP>4$xn9S;Kefie$bWqluBpmJ?-TwnKRz0 zB6lD9_}WtYJTxccjV|EAtI?)QQQX^9n!L@_}l0jBN6Yw64pzg@(l&fmjT z6yYkk_&-0zXnJ!<*e*MpIEULP*w7a3J@O>4| z+gf-uXlH12zgzCoH~Yu^E{3vR5Ts4W@H+*lH*Avrd)*lM-q3u2cH&a=e(cS~NQH=j ztMJKbCeI(B*Vja_Wnj*poIKYfS5djDi1<3XXVbFElTih2AS3GIFz(PbSgp$ZU9d%9 zSpKRp#iL#H1O2d@my;1qlvMiDQjl$bA&wxAB6|TEyR1Pgbt>O)M%7KYT8E+c6m8ZR z;9-prCOho;ONHK6z)8Mm+mA5-NMEp z2b!g#H`oh$I{U)e3e;)YRHd~Bpsz;rER3Ps>Mf?~@S88Gun`d7%Zps<*E~o$%T?6b zXlqDzVYCul9lR5-?B3ZrA1u+PCuoL@KgORyIab>+cj4jYUm{=7uYJ``NzVV1r&;1X|98TIYS zzavKf{L?c& zf8K^=l94pZG1LPo|GYo!Zq4e~%r$U&gHuStN7xq~6~5GnE>(SF*qT;1WZK_YLHbub z_r^wlx626^1f8d3^mjV+O=#2ld(Ny6&dvtie7M)E0w={n6NybVZ_C34Y3$B1bir}a zL}d?=#Uy!3jP}YcW|H{d;PX2J#E!YJWusi3MsJZpX^P!)z%7A zjc;K$K~)(?%SeZn$n}H) zqRL*R;XUPh%3rxq1uOyunDtwAHa*Hq`n$HcH+X$~2A$sl z?(yTJx!~l(mvh~>{zuW7I5PS8aa@jaL^kG(7{eTM-$#xaHe_?(a)m;cJMpa?+mQRF z7-Qzj%^a2cNV!QUSD^?|D(Sc1|M2YD^Z9(<@7F6pm8V{zGxUkhtrlJkg`89W9`tFq zMoflS?dT4^`vSR{{jA$^+NPkz41W|_4wOfJwc37@o?O14;n}$JJJ7nG1=kQ_R9R$! z6Lgz))K!vn@Y@z`-$Kgt7?Jinloa^oY>t`ITZOllX0|UXhuQ>WmlGw33*&zhqAhgv z%uSif04UN_k!VO}({}g+nUSo@DbPIWzT1P!kGv*$ zSRih}2tyXRn-mW3IC1JhyqTox<)pOcd0XzmP;ZOA1*MXvWqegv7k6ScS-Or#{e0Oq zWqV}ukcfpdOAKVT>}C?e#9t0K%PHy@LKhk@wc~lCDuA11rga)rh%ksf9oPI~Tj1BP?=o zV6FC^B-gf=-DUqhc;HF`wLS5vG{FfgjoksQ?Sz$BTVOr^5XF|M4;rEt^Z07*kCGNB zDs9!H{fW9VPwmtN?uwqsUqc-VI=)}h=+K3eSKDj9$TOcfDY`28AAJ^{FOHTlUI<`H zByJ?{UE?^@*aKaguxsUalNml!KJ}t#JFNKD-3fBPyBLsd{IInV)L%H|H)4BRvpx`h zq3Ocayxvp!gBqK|#EKQ`ue{@UC-i8@nc!MpjBUMg<@8KerWEk}=+yb(Q(hmHUEAme zkY^yol0)+x)h_wh<$?U#2~S34Go1ZOwvPRE%t4?gYAikV%a=6&{;T%7djej|J=rbr zuiYzp^5`{Wh`f|%b9+@xr@;dw%)weVf$hz#-xPMrQQ6<-cYku#FQ&{BCrh#jSUj>p z*|v&P!|o@!?N7@V=U=3+gvmn7iepW*eMNZ#SL%GjlO3%!>!BDLZ{Xx(XyS=7PvYm= z+uJXHPeXq2o*73`gsfZvJ>h~BChOUaY(!i6`SnbLd!6*w&VX7i&V=%xU;iw8J2DZE zYgnw;Voh(d0i(e#``o=JT<0`fQ{|d>W5|-XmBT8uhI`aJK2ywWXEVlu(I)7MRm0KG zA8nT$4j*y{Qf2;{A6ms-{7j0=k8AyIb*Rww#W8sOr*lE^(TEa;oyMY5Q~ED3a|gI_xSYd_V!8~M~WID*PU7Qh-qOoRez4*0^wMiQdb zb@bgO)nH&y$ur!XB@IJw30@9_$|sDX%)O2N+UJ*k39*L`;Z5g!DSy{puzspn(M)XJ1nPHQ;GRBn$0$c-Yex#@%IxVuU}3@ z6dH!KMzikrDMH`Fa$GX@4vtLD_4FoOYo=SQm;iGEVVR)>U1DQ9e5P)6ru{5W(rymw zbZ>L#tt|d-JLCQf<*lfY+Z#`QG>}q5%uYLDsJcH#Deoi_rbHp1!rpSI+I*N$yj`M; z63#Mq5*M>#x(e=TAw5w4@k{Xb`@h;tLwO|X;w)w_xgY~}JICgjXwEcvHJ7j!>i46O zaHyKIIWq{meG<1(+}7g!#C_r)-P;(A4Z=P9PqD77!%oZmWAGO>FFbpko<42-bmg3K zu6YYxV6gZn?>OmeR&4?=4*y^H^1|*OAmGRO&Anf-H@?a*-5b0>I@7L?jXRe+pF0;h zt^P+>vLGX!{JXxO;l%65@?qTAnS4|wrEPR7q2?^FK0J&AfQ76RwvM0Oc5cHwPq&tt zbjM(_%T=e$(vLGmSdu5JqUoNaA`CsZQF?#UV~;F#cVnU?_VxQBT=J_%rg0;|Hk=n) zCV`3oyB$@<<4R5g)D@r&pI1P#Cq44QcKBV&DAiW+5R>-)btz;00P5)88H#TZaZw);}T=>e(>vU5Tn9b>mXoq7F zQBH}UI|r>AWJ8?dmm6igqjHFk@Vv;%x6$gC(TdN0LHLI}S&$ff>5bWDZbs8YL#VG? zjsXi6X?Rh+aMDAq6dB3NT)2&t$A36j1N8bfdp&H{kI zRb>`VFky|Ko%jfhJCOixv8AK6QyIt5k8VminF{upLZi`i4`B=h^l-J6W%!8QFmn1I zouauFT#E&Yv}4TWnre6>l`V^OiL8uI02Z+P?Wjy^8zP95oOeYr=N_1i8 zd-k1sP?V33s9=E9B(g2%9?&2lwA!6m zOEpM>)+{H`pi7E>xc73#;{8#=6`rumV`ioZus=aU0maWDC8hB31(3aMy{Kc9!O(aK zUu1d=eVs;7=K<#*6PW}pF1Lo7#-oEn#8~y>nOQDR>Qojy7lzj=-xTcy7hYenq$Mlt zCW2%UTYpAH3JP2bUb0|aCRsNt==}+O2KvR~zPZbcljzTbQvLTjRXYvXRW{YYnCFv< zc)qeGpiG97gfqS!X-0SlXS$K|f#fR%*dJ(u%L!Ky5s)Ra#%havL*}IyyG9v&ONlES ztWAQCI~lpU*%j$sOqgWN11D6XR0>{4N#XerCr*!V^=;B3=?^u{)EK<8oJr}!+(gf- zT+ERCq%#(?O1|*wRFe3B-BMoY#@*!<;Gbwt3E(S+^l@$;jP0YT0t<7TkLSgZOh@xt zjNmm4M%f~-k%w~ya?@nr2FMah#;q)oHF-=0mWSr_tQq?QDon~~omdt2691$_5wBp3 zUp&pO4Hh>#GDqj&1m$cqd5$HXd6WgEcrTFgaz{2ja%%-d?%->!e546-uP}1=y_}3D4YX})Q5c{zG@aGDHWHpl=4r= z{gu8*;gTpmZtyX>FpGOy*IHIBLM{3p>ZdHU2DL5*YB}@a45(0useYD$o)K(H6o=BX7 zl~Ttf6sMa`mSAKs*m6^Md`Cboa#meC{0~0HGPinCP;TFKPokH+CuwSYuN6!Shvnoy z*sz#)Al<{u8ynS3Q;l0c@gh&36uAX*xBsKV{48Ym`ZoA3uuUhAf1_6Jcr0R98W$1M zI5an1UX}Vmp}T~m`G%!7;%g78)ag6s4*d>{U#7O_-kax>IF?|}&AiVRhf99OO}j4k zt%j^o)2+fpm#MkeF5d%sbF}5oT#+Nsjk>HbJB~XiCWeNSQaOmi?W|^S8fN^vagLt! zHiZfTwOaPjhr+$d?<<%j16XdAS5YXU#Ryaxnv`s)y$R31k5~@_5!qjrW`s$UH+Z;w zAC=Q?F*IVxpnY^tf&JjN8v?~-|7j_N4lOV0Kl9u)dAeOqm0dj)?^H663ntM{Kr#R5 zoXROF7plBFzWK}Vy^bHC+Rv&o@H(G~_C)odP!zo3+ST-;jgfYPqaP&(YH&^2uqVmJ zEw+qnSXb7)`ED|5`gv}uvy-92FfB{`Ziu`WzT7Ou;RE+qSy>XZl zB<~)7&N-~JXBeI}`@DS+>sG1ru91AK_ zRf{JD!C(oNDMOVrkh-jl0?M=o`34s=LTT)%tOi_yE*YO1_LNdeA}#qhC}-Oj)raoJ zKdkbU@n~_5^>ZDy7>X}W33AkJz8dcIph~`jn)5U+K$6}mdCZ#>5<;sl2)1J}=H>_-x(c#%Ikk$-+oD>Ckq)=2eCX^ldb_v2#1qb0L4lU-rE449e5u4BbkM* zRIc{i;Ia^8K`=#b^&Ma&$fhbB5>vihD>75=k&;^_;K$EvN_3T$P{9v{2v(S6PU?%V z>aB^to*FOdf#;Tbs!_#tQMWI(fMKmYz;GH>DMSn`q5uGP-V6Va*7Fyy0tZ-!_Q*gf zMQ|+;RksxWQMV@Anw+O_~{D*V;9{!-Q5H4{-ZU*+&_ke2B)MI!vab? zA5;>CgB(`tGNMY2S0KZG*C%-}uq|M%BuW%7JuIWmWF>lPd#xIKo5DeOetF@EGx8)Fl-1L>j!|Qy)9||4@J?o6te)Ihl<^36pH#O zc5b$+RPNPLIZUR6L<>fj)6zH=HObZYEqE<(DgWu#aO71`0b*kg4S}RaOF5jNkqBsf zrP;;D_vsV$F$`f>8SxU2&?DD2FjxStitRXjX&oXD7}Hwn9rzqxm$qV@5YX*9W{yLA zQp->=p~fe?NtI`8)v&uR?7nmSjNOQ>YVPx~>&XEdJ+}0Xi-bV41w(Xa2%`LJ*w>7~ zCLh~;fLVk}G^^;?v}5SfeZ=&MyhYVy%qxRZZW@#_urMfhG8Qz@!=+Nc*S0gWq!WT7 z?F0=r4|d|lcaGTSC;%kmm=W405^QzihrZ(TkogE z*wVV0#QUT@$Xn^urAI5k6SIg`3zzV4A{_Om+jsAMqxd@>u-C)k+0Ir#hP$ZE5?{LB z=~71+h+{uiw#e9y_2hw(9nPuF=mj)K<3u*}nE2(9iS3^2(9(bJ{aMK+fseg!{k`Bs zUIVfPqN~cuVLL@`JFwE}>6s?AU&&tW8apLJ1T+w`tuiHz28jHWRXJ|xy6tXNKPN?% zef6GLX05ddd!6J5gBX$(@A)kOB;HbxydZa~~oz~fwkyt~_aWt#)2A3ldaQ#1UB>30aOT6n+JAiID0J8(J4Q&=K zBl>H7%(As$dprYLKQlhK_DWdv&MlLpO^x&v`zgTy_6)eUi+6VF{B>Mt<9fZk>gnB+ zq#;^}xj;u0@o77&-UQE`hfG>)dtBNrimFoWT$b6US>0c-O2_p-E8Ic2WCr`+f!nX8 zS&(9Lp7jBQrE@rnHZ8RNU(lM|_a2uq1d%T9DLju5b zl^%!`g9Jrx^i*9)5$XQx`&g1Wp0`7EWY)zq2A%c(Q`pmMnm7ETem8KK69#{%-ohy7@7g(nmMllHGG-s9i#69K&T7jtWpAhT8Bvv{1(?XTM`RaRVfd1u$> ze48P^6HZODD_WpP8O;Y{1L5SHFA|~fOq`kD5bA??ev>`OGA!F42_Lm=e z*L1zo4)?y1cgZqrp>znDwDrK!pb!4?^5wfH767)6G~~NltuUL7nEKrtjAgM`6V)zx^bB`DjVlIz@ZBPd+ZHa*-s=wf{=0!EN8{`t-5aj>$TYB<8gX6H z!yfCfs;tu}EOT5Ohy0lK^h3YS+oKoC&vFCZi0%#t&z`u>yZw^fI|2S?(nxOP0}s?`I+GLrV>fqARmgG(-rCeVg3is_PT{B<%Y0 zbdh|*Vs*c8ML-FWHY7nKB#O}c`m3`mM@UIRY5#O;zY==aMrPDJ$?u-|sv3~*A~qhx zST9Ae+e+W8l?+8?CU9HsL*wiEbItBT5Pt#OjJ|dv@kg7q6gx&4%rEmrh1UdRFm$4L zTgscPLB8zpO6tub*lpH4dX~Vv67BAEakE}U-)Phdqo9<68ELc-em*FBL$sCQvJYc_ zrpsyNNZkm!gSC&k*~pf~OMx2K_=JeDB{8~qJ)mTyAD=+e^DgMa;h5~#4TEaiOr*@K z(6nm7heM49rdCQR8m0fy-NY)-Hhp}gpR$FOZ(&S_1vv+J#+TCNH|-;pvbO>*LVbyt zw6p7&#tU}`0pJrbR{?DV)XCriiijb^O$8PITT1?I^)9UPZo;$}0GCHIawqQmC-K?? zk#8x+LXu+TgK(g9nC%`74G=~7y-@+gf%0X1-fU4$_tdRV)hsDd)guf{p3i-+Rm){O zA3`z?e9mN5gd?pUT{jacd8tgBk9+hVf>Zx{h&r=hkJYAlGjpgB(EHrYdeHcD(oG~9 zmA(eF@Nmoh+EH4Xvsh;o zfFiFZ2`I~nrba>ABQtBcMRGQ&ddVq169Ai9g*JQ zpicTW2EKG-L4Dp~adlzKKWHn)kPI9uzfoxAN`g)%kL{WYD9Ob5u> zgb5mPhTQ~T#fm!v*L9`kSnc_Jte}%ZvGF*t7;i(;fSLI>9Zx)^i_$f9^2AxRjR>u^jx8!96JAH|~SpE`b`nCxp1nf0cEhtp)5#fO2I(7v5InLvLeBay0(d zeYYySWTeO-8BrSA9xm=u zhYmKFc8W&Jz4>bI-@$diz6*esT)Os>AC&=ZAt`A&(U7ul$%hwO#AQ{n+koU3$w0^5 zYJZ>MrRG(uPpP)H)|naH9i`Q#@De;;j&VI+9c1WwH9* zNffYIFziHrO{Ijg(f#puLZ3A++ZgVc@D62* zWR%28iwOvpR?%mb(PGbSsg%g+>CtWSY=DIg=X+3mYAH6*Yb5*ihAt`R^M_v#!)BnN z6t%ww|LDeBu>pydY9-wj#1*@lN9>n6J$uS1H#R*mJ9hHVv_nXl?b6PvNN{=lV(o#vtxmt`Ps4gs`F+uTQhr zXbp2#qV7;3ZkVuioR_g6;DAr#vN!3OKyo!L4CPJonGnbkLg(-3!BVG2opKo<2X=C|!!uf@;kYGQ{~-$%n0X=)lmVk{6 zg~R3tr!O>y;zXPc04~4efI9$%5;-B+U;wCQt53U>kDSh=u?DM_4HFo*smlmTBi*aH zb#!{~!~#RfwYtz6S%Px;^+@h}>f&*IW%as3SbLQ}FY-Vu$4U>5aU&3K3CO4-o*2Ti zeKI#@ZM9(BNO04vmP5k0PD%JHsZm+@7vmE<`2X|NmsdLjru?KeIkO&&&-+L7&$|Ur=pQFpC zb<$@?Zkq4+)JduiC69!`eH+o-2j zCd&lebS}~RnEjn>t1bQZRs^y@&~g1U=5x0;DJr`Q^Sm2`sCs@MizB#ag}dFs*&7r} zx(il-6LS-bEk!ImQKX}CpiTzLAgq;9k2J|ss=lmSv-M*?l=_#uBgzj?^p{}1;*{d*JoSS{Mj(M@H#6HI}2xvqRU}uA@~BAP@dC3 z)dsfu8rEpcp=_17*m8G?V&1N8GEc^xjke5`3!4qyVHTV;tDGlRG2~Z_mQC=c3B*LY z+C2+&36$dQ;V9-uKxO`@n9R5u1mEzv`JaydD<^1@ATusc{!<}XrX1q?Wm7RechJ`{ za~soYYiqS4bs0bX==|f~qI14hqF?R8oZ@HB*94i5|LB?<`UoGmZ(sgWn5t8~Brkl-8Q?ryg1Ycco{D(ZHv4ZnVT!JY94t@5t)uOTPiw9qjC z`We#EyV-cYqpY+N^?Qs?k1g{@QBITFtD&k_H_0U79Ge20(8E@NJ1D;Dwy6v9<|o`+ zo_$-;3o<(yd?i=o6T+)Mv~7*@J(?W7MFWx9Ij)Y23r7s{qB~q`&L;jg zLY?Xk74}DvC+9hl4>%X|iZt_~V5Nv>FZW#Rj7jeAR4l4T_y#2xO z@T^zhdrVk^a@m$)gA5N>X^|##l=%Dzv8Uw&aQI}|C#MJj{C8G z`glMk+UQN76D)^VUQrTDey0aw;&j)pZy+BE*Dk`_HhWLjo?W5NKlzYuF%X!(*;|#h z@sDnJBlXGFK`j0R`M`d>8}p0S4?lBrYqp5kTvZ=wbO+5#J^uOl4bI6}(S6#fGIwga zL-iv1YMndaP!(2k!)C+A`n~`C-qf}qKVp?>2|(YR&5iMx;D2<3oA8YsVv-Q)eGAN{ zRx9FOcDBF2VQHe}(hFm*w9V%Cvyqao1oCjw2}|MK&pYGH{b0GNWoHio>O32n2QOGp zcG)E@0x5RlhKgXyUf8tt+%5Koa8w{S{#Vq3>gVkflLShH+nr>o z2Cu`v+_313u^G*|&9Z2CLzW6Hbs#Vy6vnx77AyNi!(nE9Dc4>$9<}b5VgrnPjX6=wZ$>xWzFdKoK?8Dpb}iF zn!HGQueX^F@wM4G@=sWbq#{IaGWG!lE3(ZQS{+agnRJNR%Uk^EnKxl{xHNjiPMMx~ z;h3-GC6aFq)=!_+ryR@2X=BxNT89Q9W&A0gn_{YO_BVUD3yhhRICB> zu!@o|lfUcqLofOsEAL1FM=gwg=9N__v!*bVuxbwhD>riA1fqgfOiwo-DGf|2dfmaK zBnghp{bNwjWQS1oA?1c zxtL<*m#+Ov^-ts=+)|hFSn5RT0{5P_C()k5jTv3GGJf4V+bkd8Io=68u3`OPc!w1l z&#Gk2)i!WhVMjbp3EuZU-O(9B$E6oust<wpM03e@|@o+R=y7x0j#^UzHEj= z=#C=b_N=#G)~Y%*z9XPz2wvRodj`x-RZI$kvtvq)Ru8AskeI*HR*af1wT2!_S8awx zM{F5?!sEy0T3N4S?{t#5M6Svi0E)tayX~JLn2gT>c5iFM0rB?Q`j|iI7FTbLN@awx z2A>YMA{ipir9D%yNVShpliK-qct^u{^ui8eT?tp+=kv(iGg~Hez@$^CpK!Bx&}=#< zk0!c;-bW`fdiwbLh|{(vnp~*MzRXg3c2QEf0ST!UIW3npa`1>{$iBH50%1?Sz|Tjy zvYLHA%X|**QNTV!r@w43k^L2^m_a{z#q(xLg&)^XR<`$`j%H`!O%@u0?$&v>8Uxsz z)zN&$w3&NwhUu5^phj_Q>N=j89iPNK`QOXo zqBXKj=M@I&1TSZZ2(D+>3vw~P_uToy481xQ(&_kIhsFE}gjt3K)L!pVeAWDO`Euc8 z?%p)gIP{foty=Xe>s=fzf>3=~Nhei>E_?rKx_Cfqhd-QV)bfuyuxXj$bN03xtI%{G+AXtqNLeO#*ss}YNH37$BM9fT)<|EHDln<)bm9^L z++)Mb^vhy8rb3`Vv~o5({Fqb((0L<0Aa_aA%nO!JgB8-b94idLf%=d2?HRLJS_NSz z&`z1ML5~&zTr$Q9`WpG#PNR$eBD8v9WiSf>YYpQkD`Ekzth_-&?@U^K%KS!RK2(Pa zlKdJ9c##G5RNMKgSxYuU9YWEtzj z4ZDo$rdt+g{*&j?%BoO9bt;Eh=3bD;Y~k)3E=Vj63>XKM9m?4dhlNr7xH+W05omg5 zg(uN70&AVRP=DY4!Tf$`@^ZP6yHzk}4%}Y;GhH>UfRh~d=LTCHYPRV%XBG9=j9PFw z8Z<6!_KJr(TC8i#(l?K>B^tk-iDo< z%A#K`*{5Z5WU#(*+HiRLddDrS{e!lUT%-BBMoYNYDP9qX-&y3m{Yl+5e0jZ{r*^x& zWjI$CMUV(er+R~BYzle4Lh=_=1FA}_6Rd(VP}P1xJ*8MWG{D-ID4Pvl&gF4p?<)We zj#`Io3&&cF-Iki8Q$L@r>yj8PbJ)FXc%;c|TJdASNhvr~Txp;pXM)^k54*2LB1-zv zgu|>2s#E{yW~+b&Hd@|>mZQo(R$m?|;7(xajmWuImPz1Q*Nth~$CMMzO@_E7kC~&+ z!7IFt2^$$NY{Xjq#P93t_*+|wTkJnSwAO~@D z&h^XiCM`Lbh1UsU>-6{p_TZ*LlYc277d2@UD0m+YmDhGufM&SL+L1O-s#UoX)Hyo(b>RNs@5`a!tcfmRr5UUT->!`J zwD_Wk@1-fYA(5BEnSF;X^GbPGe?D~D?j7FDbZWdj8esyrct@qs%(!6R?OH)}l=c_}RK zocXa1BO1v4x$6Fr5XZslClRm=zL6F~MNXi@XBPN+JD16*#hB~i^MNRe*Ha5_1WtZfA~=6~WhO=VK;q_UsEAd93@Nrc4o4tjf1Xfgn*tE7D|^e>0p$dGuK zO$&SA>z8)BT9;ln1Q>SBQrYTL$^bj)+sK})T24^z4an+DC}&Lk2EaAo0hfQ{qpwzz zT4F6~KVf#=TA1`VtB>y<|Ad`z{J( z*^!xL*OA*<70y1(P5UihpD1O1?-iNrwI2h>UaH0Q8zGVFS5J%tqI53LWp z2k-Z44b8q`ah%ArL=Ib{4?v-{<}?;rs?V_{om$!t#*19typ0*UGLxVwh^A&R;bYDN zgYgMbC+TZp3&jBWYHUEscb3`*PzUhcHv!)s8Y26CnZ$5>T<@e&wr5F1iqZhlh1e!3 zSYzG0GxEWYbk(~nTVlKIy8Q3VrdI<_sVk`J8~T^oJY$-WuSYArFD!_B^`;t`w7g>^ ziPuj3w+s+}W4%CA%s}=nyu*E+6hwt;?6KKzgGLDbM(7rc$7`7@Xkes4inZC-dO^hI z74bNZDL1SgkBD;>zihqAlmL9R?N+V-kHd7v;2`(`DdqyD|mTxexUGLfSvmaRBmEY%gv98NK&5B)h1c$`Ta%d+G^T$-ehgHMFWiA=jlB! zsk-9<7dNH6yCtM1r|z}m(w^cIA8*aV*0iFOhrt6>#J#{k1W)7qBSki|=!S%I_J+eG zTmgv(SCDQNC8U?zZa2q2Q*9J7j0Cu^erSI73K_??BfG1beMFYoL`@BH*lnKdUUN8g z|G4DN;um`SRRwG)O89Ar5{$JPU;q)_Gmkai1{!+c<9q-R168fpXka4Lvw3^hP8>&Ic6W0l*b0^TSN|-iktL`Jk+mdC z-|A+KweBglrxn)Occ`d}6J8~BP)a-rTkBiUTHS<>x4l%2P%P`_d8nFlBeOiHW>K)~WiD#>TXE(#&s@Ihl=n zK6Q#OW`55My73?M=+y~{R#KoVdv3f#*BE02DVR>Dmv?4)0q%0My&7LU)-XG=T5Cx9 z-i(7y9gEuO^B;%ozKbP?5Isrm(`Qv<|L8=H8csMITE8iSPUEhh7OlZZ6}uBNXWa#o z_7wTYRETiV_o8;h)=8RBlSHR5?{iO;jir{z_v=CzQ%2F~M#;w+>@|a@Cd0OA^X#yS`;S}_qSJW& zRDP$j3Xil4SxSc)O~z+%*^Gh_`G05 z^}1bsnxYF038Y6d)Nbm8G7C$Anqg4*)ZNR#;X;vx0#EXX9i$ld!bfI4xQ~al>E-*` z14eZUf4_tTxPa9pWGlr0D6sy|TJB!M>Z_elTs$>L@;YX;gzk+!Jx$AmuxD$uNo)1E zW0Fp!1^$#<(%chK=|=J z(HMlH6cACBY12;%9a7*`d&so{X=XU)t++q@2A3UR8>!S$QKV>ay|sqKT_NmJ`e-~u z8jzn#<~AvGtFItN816_UDamBKWv9Q84}G(2E8*|?fY}2Kvj=nWdp6T3xBPYG$S z=EA*XVf=blZ)U=mDcycZ z({!@iS(jOw+MooDE$%kHAv05Egbq4!q|54K!lYny_IMi7QyK7xoD!596Nf3_Oi55= z{GGiH%$0Gt>6gZR^O5{M+}mCRvu6!X&8P4>-bIycODX|+bXRVFXM2Hk+vEdZ0ki+8Xt z?mTQ#6bFr@R{Q)2mF5=wHp-+dyPnL#{vXqf)w1e5?JevK$pG&sqZ0)c8M#MkvF-?I zX5_XA<379;>Vo5ZMQ<;?+UTjvEV=_ZEjHXI$vz#^-633rHvAy*yO?GvVWntG9cH2{ z6v5A4jib&F>&xP%+cVq>#rTOP`RVl;O9MXnl{8Kq1WeVZF}!5i;cxKiEey*KyD=Ge z-Mj51A%E`Pvk94}ZHV%DMiA@5$a@(+0by=+eJm`#kG>$?qx~*Hl(j}n%yG{_1`6%f zQcLi}y%*w77H@uegn^<6cSZpZWro(hXgiFnCre36jWm5LA2U*!yH9u5Q*XJT%9ce~cW6p!jV8HV$T2cy8Y&4q#NA+HrkU_Z?a z1wPLfP3alI@tDdIp{5!qQuo*w$tKIvUIfn}aLtlqLJ9$EGZ2LQ5H6kYk8bs1Mc>P} zGU@KeSzgOY@}lcy<%Ej9N$%(E;_4T!X84NAV=iK4)|02xS-5|rwQd6OSEpc)jJ!={ zpWFYQ#_G7%85Q{s{YXZwHJ8b>f}X@jj-3LK#@wVbuKQu~tXf(vNEhr9n3r)&nPzCDM$4Xsd7W%C?7X4vX~0t9rya;62; zN-{F>dzKHFGfcfsfQ#<^=})%PNIvp;K>Uc;ban~grJ0fXyXn9MBj&tn>(FMM`*s5M zpFWEMoG+>}aNe*MVpVs#_}9fYVNp4K?9*FX!m>_|Hl(hRhJx{xv;Lyrz z`AMgvdUoKpt+oD?c}ZG8+Qem?iFiFG$D|M$*fIm6x038KmXNTS9JicRvroqzK@9vW zn>!Nxe904?$pC&4O8sLCm&W{Z5yWCKqp_8#09YzBApBYQlr^@D;Dqn>Hky{MDi??^ z357c`|ISSk@UK}>q~U{T57u?XQ#Xg>+LQP{jcPc8v^}6cD+~_fg+d~)?>HeyGkg>K_a~-JVC{5h_!`+hbcd+~&QD)HryJ(W{N1*5iWb=gZwh(Y3KylYJ6*YGHsFb<+c<^56pS_XX z34_B7#*1@WiX9&FsM^r6E}P%?TDiAwvL5J(9|Yd#(6pIB2ha9)mQQIJiJs}1weCTd zD43h|hMg9lBwcS`%lg%lcKa>~`?<&Fi=~@d9%x(VCh2LO!-*yfO%c{zXT2W59Gw@W znLN~AJY=cGPMu1@H_Sc?#W&@{{N_A8!wIu1ky_#kps9@M)Qk)4H3pmqY`N%ASGzl# zihiaxtx9KRIG3D>dlaH`c@SuiGhSW*zEE`K_c@I zYmLIE{-aWtifsRz=}Xkdmh9@BY&p0QKRz`Iprj^Ov$5GO*@^*dX3&|U5g3Lzh{CtyPii2 z(2{z^G+0>Yj?grOd-`BN8BO;!kzQ{dmFIGcRN7)OGoF&?^aNj7exXx+eEcBK>qhC( z;7`QdW$x#sAcPns2@@Nkl82#qz?)zhH0|k7#~1c&ohJRI%5tlhxl?&#Sh*IQryuB;cNRgK7^Y0@4fcn zuDL$UqH2eckGlx8(^7az|JL0>Y-`ynxGCU)0P%6WJ@zTP^*esZ2XgLABW&FoOG&ywey-q|D`Dv9|j!|!0H(5`}!|tkGX9%Wy6y7jrXi65~+q$Ha7v%WFh_Yg-r zUFCHWm3aV7nDK9d)n*TDLoL0c0Dv&)p75G>z?fxv&&3j(zw3LiTJ%Vv0#C`eg98AW z{b(z(pvh4``5cPSe98N}cItGauPcxTa_n9f06rC}dpE6MLmoM;y)G@MhG0~3$!rJ> zP)ie@cDz1_rW zatp6q-^^ttXA_zh?jY`Ebl#J0_ylwkS&UpK82jE5?YcsY9e=^}Y_8S!3{6o$XD?-* zA5Cvxd{peeM2D-t)=#q^qa)pot4LKI&Y}P}3IOtr0Jq&Nc=zF*sVDwCU_j4l%nk_3 z_v1Q|W|3VFue{c2sak5GK*sYj8H8_{4@Q#QGtV;QN12PAXoEJWXO#Eja$&?X z$lk7%Hxc$NbyaTmX-Gq1meOD(^^GFY@71ymQOSLWA0L>~8SZdh1@L{hj5FPy10T)2GxM4J0r9jz{%4 zZo~n)EN$5BvS?m{hRkM)wt;I((TTik@SlCexlm;&#)xax$n0r`&WL*`sMc53S$|8}cTWoNl;e{7O?!qfVV zqfOh{ryX>pr6w>7F9{8D8-GcC-*N?XAwN0B`|0^Vx|FBxX?w#wY56gvGsqijo*XU+oN2Qopu;0Z^hJuhx30-EYM)|ywZ5iDAWAS-TDUB@z z`Q!iqnb4hr#_Y=62Q3+7vmAew)BmFjpflIvLK=xNDRtnj3}+4CNLMKtRI4JR&6wJW zh%=5bfD9i5;!OwDBG*%1f{Riqp2n{f@;X6}XCJ2A)Blj^_%e{0m?92*Gdu6mjA!hg zvI+j0^q0JXdFP$$&BOsM9{!4k=9g6pHjXO#c;>IG!*k?lAI%9@8;v_@5a8-`fp?tud}%RSP>Rk_MpX!>T^9`DEZC+Dwoox^p` zd7k^ee|L@3ddYV0LKbF9-H3G>XcgF#IVl1VIHRI-&b*_5({+5EM#RDIV#y+-t+=!J zWQFu(7XogxCSJwRSa&xCfM4W!8iqOD#wx!A!Kc*Cx#e1fgW77$zJR4UD7*}WUS&}+ zKpxL`6_Cf}ZVo~#9b3wTVx_g#ZB?PkmiS(;`s;VWxs~E2ub!Vw`HGzM1ppyN?6~Ed zGlJ#)pT}HepAuNG1_G0#s+RAz#w>3+lOjNJ(Unhj`O4D1R6-`SO!72xDsQ#f-w60- zp#=8gie(|)1_(?#tzKj)`2pU^^O_E_<=P(8O4B(5c|N@~J5vOAIHx*zR$WwP>KFQi z*$5yrXbyk~PL8QnEM>4OkpCT1H}^_@!XVwY>8dI6Rv`=>Zf4E+;I+$)EzE%MVO{Vs zz@9&Ik<*pwfVG4(qYnu5?`wo=6&N&x%#pN^Sy&kYHZGYB6Ivsc=xj!lOz2-LEAtIT zr)3^anICuYyPaKtxLw;*fLP{pOq4iJVtD=!C1KeMkZuteAfD5(Z(a(!!m0a1b@`W` zOJ7@!&R3?PC$LtQqhYc-=-j1yWTPqAtw9|T*(fvVSf9EWt@SumP8DgA34Q&t{)kJY z5<#y3hnx*};!3@wu$|`nj2#lA^wa}}hCjGx;o8;epwPgjHhD(-Kb8^{bLNxXrg~=w zsxJRf>FN&WR7qJQzj`Qj`oZ``Kv?IC&t{Mke*?mYbeNESQIhwSyq#j%^YtW&9Nq5} z9xn|HkfXK&U^p^;dSMg$v~G+|Si0^uxx;-bjH+w7#Kn`>E1lR7c0R&Vrhn?Jj+IlzsA z+u|y)ZSa)Z3!IleSU6T}1#;OmxS2Gx&!ipa?Pj}BFW0DWa>66CR=#ECxOD0LTgciQ z=O~4|KgHksFpPk^K^#;QK+TiD30#(yE=IrHr2dWV%&kw|FK{rd%^`xKMgL(fSD*SikR*{dn4eg>7Ns? z#qMCUZ-J%qKzJAI7oeY$P7`0w7ZshRhIX0^K-iP1)ac-pwPXd;3JB#PRtsMnb>9DL zh?W)4%1>Ez?pIkR?vwVqf7+UWl1m&Ro{=G(T+M+E-%Q_y^*6X!2|wlq#G#2$(i_L1 zIoG4RZgKGN;^l5#d%GWe$D?N0rdDp!+Zh2Jmifs&aA@5I-g?P$O{gxhatEa3KuX42 zZ_=IN_1S;DIwS3^@kw4FEPPm9>B!FahlUl)Zc5!MEhe%dr`XAQqRS!L#y8^Gs!)rA zA92mPa*@wKPMsqgrEGk|OEwo+u+s6`dS!l`UVy};(p~1me-hxN=*MdrtOBWPB?vwcgm0zu;U@p>+T+=G6sW!OXjwP&L z@Etj2fyqgSzKyHKg+E*HzUu>7_3txM&q}m=^rKmtr63Cvf;(Th^s)~7pmi3F&tGC5 zz+m1H3a?^ft=U$W_Fi}ZamxtC<-O2&`(Gx_HyK(zE<$7Vxqt|F(2eqLp)V?7IJ$W5 zD((yZNDaj7s^x#JnVt39^5cWn1)?qcNZjAMOB5XnXAAL9`F7e+Y=_;BNY45Y;jcn$ z_=c?0UAmM~dd%C$wbyGl6Y(G=r9T`l^5U6%q(W{eU=l2PA2kH|BR2q< z)29=>H1|)xK^|+v_k?er2p^<&j22=n<^x^ofc0dc%H9Daa@96M2s=&}yteQPUk)!f zz!5tPqEizUpJQRhK62fBm^PC=bNh!?pdxC}yQ{e&=z=m9pQD)@M|{I{lww+PZeaZs z`eE`e5QAHxT;Forz~aNVns2npbQs&+FEwtLdL*Q^`K+d!5#T1Mk7@| z#kB={+FJ2FV^r>N6y)Lbm;7Q`dtyVWeHS(`8%>JQ@}q?>$nF`Cqnj@qnmcO0^S|o? z>m0NVBe)36F3=bp5;aKbP5#vsI?d5-Q2r6g;+X~~Q!}S0T$2VJp%5lP-^9Z3%9w6t zZRR)Ho!GP$(SS&=(ZCZA$|Km1=y#dDl)#_C+n33Oh+~cM_ZhYKmZw97zT3fuwfgNy zayLAd*KgU8)&N;Lp z$KsVnsdSU%aLhwrQpZ3Nmi-N4_m~FP^#nPu3kPA{3Go<>_g!$C-1Ei__vZb@Vx*&Z z7jgmcD20HM7@;Bb#;4m6Hv`_{(^rI;8hD6FkTo;#?XFZFVK^FJfRmIbRc*_sD*r(a znyM~jEs|O;%ZI-ROR0K!iQ6piJ&LY%_>x8wsH9Kp$0)Pc9%mB(U^Z()WOw&88~Okh zT3xUNb2RF#CrN3^Www@x8~HGyLgQu8mq1{@=MAGa(IyKWD_R0O_zddJkn&3gX4+0y zWy2PhIM#r>ode?xzB8-sogP{{UGIJBwNI26)%yj$SktW zE(?>}vA-N-1SI&b7OD4nezGATv!e(Si2-f=+_;EQU1*FLxPkijTgvkp6}6*Nexw(u)ZL{--paYA~DWO;xD1^YhLB> zqXqw_1Q@uAS&1uYsbinT#eRRX4zK?DdGoVoR%I8fdKOe)J7V$gkpF)yan~0={KsC)X%y=PR=&2b1pAxndOo!`>0lM*&>R$WH5CaQ0Mdv9h|7t|73{>gt#} zd;J^VZ}59zbBNoy@_c>3N&>MI#S}^1FmNs8FLJwO*0M$vd-_sM@RcFC4mreVbknW{ zwi%-oPnUOH%``(^C)c%{7U|FA5 zii#2Z>-9UfS*%sWUdtpMvR&TU`p5G+{h%a(gj}-C)Hj=zpCHH5Vhr7|szyks_Z(^S zguAL$=8r@fhYxF0Q_nO%%LdOZYwg!;z_=oK13z#29*cn#;2^?BC^pV zCaq^bWH24xT^m}IvSa7axZgpu*E|s)k64xhy`l-i<9|UYLH0YtyznPgo*^Ht*d1Q8 z`G!IF|6>smt6Mmb*!bIgc<|@ie=KDaUw^+VSO2E|duQ7sEP`n}zpHAo9aLK$2U3^u z@SQ1q@<0yNOPi`S4Sq?_y=H#%2~%fJFt`|^kV=nWWR^&dBm~x0#lAX1?82Sse88$ ztQKT(XoWl#W*E#QBEs@ABBH-RA#=uUBtL3&KAWxO%=DVQbhu%)L>@ui4)6$pE(?Vh zsCV&UaFwO)h6Uzj{sZYw5$%8jEnz?No8~+jY%Nke_L_)2I$R`tNKTl{>M)v@L&&kd zR6L2fp`Um2ENdUzm1q1Zi=vg-?G!z-tmY{RFKs9XpR$=26^iaKOZOPg@d^kR%W*g-^f~q%&$4SKtfI{u_bRa_RhLW zmTVw8yK(w>k zGza{NFx5|ln2CR~IwQwh-=;UWWqB#cb?0F{WZe7#&mTyQ2327a6Hy_^OJ^7s^G)Oh zOrLP0CwY09S-yuqR9>v4s#hE$-u3DJ{6?n1_#JMRs#IH7X*je^$lW+LOfR-JS6GY8 zQ8z;V$0EmUt){Xi`)XVMsJtcjvYzd7GxFZPxipiPEbTQ!WtEr6!wNI4mNR#O&0&Sa zhIY~O<`=gRCK_l`pN5R)nC63!F|F?>0({v@wkioZW~&7f`4=G4#lBv@JyYRFhNpZW z7Ge)Y#}!uV3`0c{muaUZR)Lc)tcAZE!`r(fJRHp^tMvf(1GXO5A}BnG7Q^ND6dyX- zr>H?cT3z7s4Y@~Ti+oI9i?r{~(%9%zu2pjt{Vncz1*1UyB7d7_S{+9oM*;hwN%u%D zscu00g#*+1Vrw5n)?IX2UJrFyg2R)?j1O#PW!;r4R`UR+!ONjW?-c|SNp85@PU7WIZuakL! z*vK1dZTAYrbDPbF1-#V7Z|F@Ov&eGQim#ET=U!+CtE(QBbWwP}p?{XwO%h7}MNIbz!uTQ6A zw_8J{R2G_u1Zi7>5vI<9gOJi655|!-%34C&qQG;HD{n>at$}+>k=F^!A3-WaGw6oS zmU27X``6Lyz52y2X+5qRZN*(LN^dn-R&0p2jS?oOUb0tn0vQ@C^XXCx&`Z<_q|PF> ztD44owIT4;tJ@Z9{SFjI#1Z9wM7iltiCU)DE9*o1 zBu8Zx^Jno~h;vjK&jUaN29XfV*pQAo!$maOB$;FDmSDc#;n4-(x@C@Td0w|G=>fvu zVC4|5nc6k$S7F$ec62(v$83Rg*@XK>7;y~Xsr|iuE6&}_CXT`e13jr(7Xxi@J4o@V zt&kCz0GKznu_^Ais^{>}hstn4(?w=efa|g~zHspxC_uI@*oGxJWSSNBkfqtD-JE(wyel zLQlAA&3gR{cY{v$);kwJ`}64*aejd=0cHWRf=^CujuBLl?c^!?F2Ma!G{V@ha6`i$_za97u&vJ%|u|p-5td7-_b-~^ zv-p5J)uCCQNI?xYI(qR)ap1PD_K(8km9%ttYZ|C$x|ha2Rei5n_8|Ldf*XF>5Q7vVkj4l?TU2_(6Idl8VUF`hH@s| z-T-91aqI$luTv(ulD4Y>s197kCx=K%XB|F_(I5fV0%ZdS&40(){)gh z$suG?eXDYnLs)k1nYhAA`ul4Rs$J@Z=$ri5#l_{orC+w99J^iU*@aSa41$hw2`iwR zx+~%tHNVTde5eRbYr30E#Gx&<3rvF+NFOPaV&vmdP_vk2pmT#u!|T31Z2)svF3GoY zvFMiHpo+HKtBm3SaM#MoE_7Tvmr2hd?7Az?shwNT0v@>;L~KMDMjW{)Rz!*?6$A~Y z24x3s2WfnP^#10$>_HfQmR)KK^B_O2T1oN|zJPcW;L+SKvk~B9+`eL-i+P>s) z8S1l&@A-7O;Q4_-=mHQ@G|>RD*J9JuzfWcFTGU-f&Mg@jo=D)p*p|TbmnL=z6Cbmd zU-&hw;QS+r%2B0%2}AN=g%fx0+HsSv4Giq+)yDTyoPQ;jV?U2tw#@@Hz#7=r((f@N zCAEXiXhvKhf9fGgZfN1(*Dv1A3O|T6h@+&*o$z3>j`tM4mKPS5=6RnqZYHRIlvGXa za*4Yg0IQDpX7UZnZFn}IHhaJSMOa)>t|Bv&Q6l@y%~ZqR&X}(r^3N;eWx^pE{p+PZ zHa9!KNa;Gb;c3o#oz#au?8qlWT+Mwgo_VGFG}%9kK-nM7+ejK0EldP2;PwbD5#=u{o?p!iG7`fNfpt0b^UA!k3_5$=_DMF=CaWat$vcjK z%<(GCJV%an|2I_l1OnsS!Til!x*ok^_D#A6*7w<=aWDK1O^8CTki6a}J~##(N|X?m za%oz|3{EsIx$iyz;tdefibQimsCS!MiPABsOkE zx)%njCW43O4|HvE@1XCl_We82s+Mx9aBb|SE|@FaPw&}Zik zG$UPAxQ@~PuLpxCL-61+Il7>HhA=1q~?%)Vir0xLWI zx~Q4g3EC&71IsES@ZPI4lfQioe!kIZCuQ`EC92k$dU_W8eCRh&K17Im`d4No)lp90 zW_9pVxvrewmLqabIog=7bmXyl_G>L(NwZ~9^fSlNC|Tuvj#5} ztEuHo?-?D-k*;z!@etCwxJIbJRI>)<8jlu>>N6?qqs>;=XI0o^YXLo4&OPybPN(E_ z_Qkv^FKMz-@AzrWor~t8(|6_h#qrJNWdOcMcKN)!DHE4-&^a3sH8wX8+q;AwU$z!Y zBsWoLr_nj=3VopX|MWZx77Ue zI*?I3ji?%=X4rYnG+ApTYBXbn&(MELWIdy!%l6%Rk_ZhE4mu_G3jQM+0b{*rB0$z7 zG7w%VAI4bpUe#OE7?v4J)&1O9e#7$9>PV8KncT~YAhyeJ_5zM)kvFhKc#KW8pav^+ zUU;IhPp5f>l)w zDtg#Q(b1`#mxp@=auPow7BGWYJt{teotWx)cjlJ+1JY zsfk?ky2a4e#XaSP^wVl_3`dejsYaU@-um8+yeg?;O@!gyTF99ALz*T6d@F*xl20c- z*R<#kLf;0bi7*R6=>?PZ$RMUok8UNhukch2C&!+`SxK0t8;;;uY`W#LZNU$xS_tzH zDMOI#%deIA@1QGv(&!wx*0!eA@h>}s0;`HCgdBuQXKt+wYaCXK5KFIlqzQOfh@)f= z+l%Be{+`}k&YsKYac?&CgMe9~iOi`R{x`u8WCK6NOGnzrM2>f|tIfFy*cED}(iNVX zb9K1J^`}?exF2>c&hJ-l;Om8l!3OLc>N!&idu*f8UmJ3xyqeElJRJ!gEs$eXe4s$$ zC$2QwP%WEe+V7pf%WVE*@hX*hW_fRSG@uP5ac+0mEF^DQc)j!*7hjFW6~grB*!3Wo z;Or9u>^uByW-W6^J`d0u_F-pAbKEsdD3g%qi5*t**-yew#DyP~OqafJlPxGAuMmb} z?>*v&-6(pHoQGBuVA+H`>a*79(;mq}tSp-{w02)o77rfyn1YN4g2DTKgE|H8L-EAE zRms{7QA1@TJJHctatMqz2qQjY?Q*C3=JVG^fZjes^;k*(x2r`yTk&0)iufW{7ak>x zM`O>nKRU4UC9OZVzcIJ_qAXuWPOj;*BfwWsXKuS~5N#Dj$?NjrOw&N|vw~!pj=(QE z4|{Bjc=NM^K46k2PC^-i?`FQo$N}9E!sf^2jV}W1tgohJ`GwA*vO(_hhhC=~J_8w1 zt<1OxlQ?R-Y+&twaZmBBxqdPXz?6H!0>AIoSq!jXeys}GzrRW^S{Is{=T zE6Mj5(N zJzXD@rSvZKjG73&QD)z_ap!L7U#aJyX$y+BXkpN}^!W|dAk7u0T~o9)p&j==Q0oG1 zAA#?BTDXN=pe=>pY|k;>4Q?jWISS^@tEXbFxz`p?!|szKUdJTBp4Btu$@#iyD{L1K z=Yf&=othCg2&to@Ra&|v?uXY`*-E&)0d zeWuwXtKDU&da_c%zyGmtioHGm@_D=i#q*+_fN?{Wy}HIey)L6JjLwlAbgY?e)!PES zr%?$xOMQM^{z#H&~#kve=J-YK#xlv z70(5GDNRD(Cn`Vo*Lr~#zF3DH%`W!EUgtcJV;4$6dwhDFLaDDYlKQ3+gO??1Z7Bai zP2IO)l09`Tsw+ca=iKSekvb*hIzF9t_oK?_ugxG#TRb9#4zoPBL?yzlZG+{O*$%C+ zp8#%o^}Xh4FpERQ>MCoq*>$2ghaTh9nAK^=G2hw_9ZpnKlaa-C|m`ba?N_~!K1Uc_yyj=FQPqcY?pBDGh(^Qf}VKW zQG#o=sP+5iaT{y#(t#Sqn2&u?(E3_Tus~NNo15SVna5el-)2O4T09QT=tY6uC%MWO z#p$UH z^?6#{YQ5Zp9E^>X*}U{Ef~2oLAx`*paV|syvcYMc&IvtilGtpp-06Y6J@?st;!K8p z6KyfCm(<>8dj#`AAH%PnvA>#-(EtkX=b^5)ujEh_X0XjAiJ}DSVuO3qX`eG; zw!g&J4^i2PfBP!4U2sgXwnV1m>hy!A-whrPEwJ%^dqKPH7bVC%ODzWfkw}Y`DM>ra zd|Gy)ezRs7s#Z~eEgG+b?%a9~BTS%xQrDlm(Pj~kJO8?cVSMQU$bGI|@A-tWE6AWV zN1^gJ+guUQ4rkZa8|!-qF6SDOduIgfOfO%sH?0Uz0UkKH1qW3`Z-KVkiMCH1Ed1+R zp)R1YTTPv!o6$b5eUZ%qH%u`-RNf-KX>OCb2Uc10?iV3|hE7Ru*A`CEak<_vhARm) z2g-CcNLt*RNjntWI8UROUORu8$dy$n0*irVy`ebu_GOZ#GSr5|69YQyLZxn zy+e)-u|x8gTJ-G59-bO_f&HQ=BYIEb5$^BD1sN;rH7geo^zC&{PZGUrH4X&;08)Ml zp6>>T7j_I<+rR6wdguE=Jd%IrgGX%C0ZNp=`q=Gft2pDi>u0M(WOR(EcJcRkUb^Xf z)pOSjNRb0|@Ss~`k^9$il9W{0q;jC;TtdIO(^?b1 zgIJPwR5`k)Mqj$(4CY5h;brc`_P;^grxniY^?bW2se$ICjy_k;`(wTl1OJq~#(P?2 zUk)iiCoqpXM|hS{tz|09`?dHRMGYi_^{=l}E{l~>e%c`@d)fQf(dfu?yI+#q$_0rB zq`c`p^ql<=;#r$}8R1*Pvz?{3KBpTH)9Pl2%+cR=)1+lWMfoD;jnrwMX{Kv!t#w&} zuHs-r%)8lu&KG-O(CP0b1Lw;Ip;Wuy;voL*C%3kl_S=x8SCqrx^laA@QC^`j?)O@nt~9;%b*;u+4^I z;z|k=#6_0AovwVDjO5ek>TQjYI3!lh$KQ`|$Z29051S=eIC%=+HZn^&tRI~|*}F)n zVUgARY5Tcta#s-)-{RBWJWG2o*vqT{TG9q=BhyqSTcHKhx+Xsxn=aVGb&jT??OP>u zt}61CxI*?$UDu)$S1o!%MpQNK^A9)AJ6XX}8b7aFe)1lD*Q$DYdQpS^B(Ot0GMt(~ zeQThYLL428rg~Det_70?_k$korX zywvqkXShl6GN?AaTjD~~3*dv&plYNDzjFjC*!1ubud*g~ncK?Ef!XJ_%(*fVKwfP> zn9FY_L>#yc@+e9!rD=dbU3NZiwirWy^Ej23yqBlcB}`ArUT8wgL<5Uv-@OP= z@`0JwnJ6iSl}c&{pj~N1!WPws1RGymYMyha6jo{q-sHCXTAkQXi`3E@SuaBVZBYzu zMC?gd2&`mQ67I5w>49eTd1$D60kY9*1e8oS3@eo}u9(B10yy#lA{)ZeR`=xe;6N%H z!%L@D)kPH((vqrT2Gn3X4=YtKE`y^Q($f)Z`8wgVygLg;r07+=Wy^C6hja+^1pau5 zB{zJ`>Z!!jOm*{*R0wz7v$M{_9t6Ps4>>w-3Cw=RWb9o<+jevE$ z@>qggf$x07?b~_9h@ETZLNGW)9x^`aDuLm-D*X83GP7l&ilQ0Qu)neHT(e`j!&E;ATxVp3XG8r3!qX5j29fVr1Au zmAvoEwRQXE)ha06=wurmcOuCpY?nxKf6mLv;aMPJzroMSh_?s^u-|@LD|>9VyF0f4@TO`+(J53XrO-dGjWDj)fUQ7#v2*k3Tfwp%GNy#oc+>U)$pRAzK+q4&$So#e&2*@iVi zMoxO9=O*d1{4xl6z@WNi2(G@2TRaW}SmUucdn*Dx!`@84zhClko8UjUGzM`pe}bfXaa|ll^ZoufIC!@|8m|($wPClG}$+ea1=mVfwi?XkS&x z%`o||Fc6KG#>=|}?p)}aQ@1s_Yk^LE;;}fT8CKdnWtHmR#U=XCnafG)?wlqrIeeje1uh1n)pQ&xf4m?GIzd(cB3t z-;^yEY44x5UzAIUqIi@#UN%*{37UVWE7*e=#k;!}yUhp_wbCfz~Q zL0IPEa$CJhMhD;squE^jcotfzyb;5kWNti9g&i{t+vW@APxh8*0?nAD^qkNy%Gi}= z#OOcYQ*tAliM(1S`lgCLNBTKQT-9M+;Q@i)I77aI9M_$i1)BM*0YS!!VQN{?o1-`W#=5qUXNYh^RDQ# zZKEw(jaM=^d3OiBzdx!OK}*Q>UkDZDEG%Na)dDF0O!Kx2Se||&ec&jGYD|yp`e_^a zDBF$@b*8SazPPYh$##A2Bh3wUcZD`;5DGcJJQu}9M?AIHznklxH$E%=wS2h0BrxZ~ z@42CbYyT5u+5d``B}mhbpMGmfFV-7{W!_kv~N!oVdX_%`jn4#6B7 zfeD7o`i84ZU63VxCy=E7A{X!NFD4ivzr(;w&<09^qL}>OAcA?zZ*^uT;1KNf*$)P< z@8jNmgT}s!ydC+5U7Ngo>$t$7wLXAmSPJ^p^2_m(4Y^LA|1Hb}cWU>=j}Y9=o9qVwi-MKBquq$80L9J+SJxT?-$l6WX*Ig;=>8-CW{< zS0Rj>tQO#(1kP58s@~ih1aHhV%M9Lmr zoCRHlICFXB=a)>&E@lhp#ay>PsFjj}Lliix(T+k^Ev(B~8w+2jG&kRN@6BikD!JJ7 z=`CG2LbN)Xq~48Ky;pK%WS$0H2>hvz81A9knacaS86@(3lQv;i<6VEa8rb)oywET3 zQ(O6}Uhcz@DTolAZ!tNp;8jz5PaP`EXuV+kbiV|G3yL7mQC?mq*3NIL%qa`wrm z?Y$sNM@`5vIHQ1B4cqFX>LGCjfTh4_ixtW_lzSs*l=$+~i>ta06HqaEzh(4~Kc*eh zr%!@pl?sLJPEfb_?V>z9(cXzw$Bo(mpiB_yc){7sL+8Ky zT+^=^yHh~NMmY^`ea0?IA3|Ui`#ie*fBDrv)MYN#!-! z1a*bNh`FzwG<^<2ho@%!2}(RhARg|0YcvXGLSt}MP?ejjzy91iU-MqiBebu%;+nc_ zSA(AQgQJ@jm8fwmN?~_!1=EhX#jZ-nz*nkZ0^&)nrOFe z>ZpwKy1KXd#3Ka5ap#F4L4+izic@S3@zB!y(Uyu zZLnI)SnW&P**eCqq|6;wF5wu!9~I2lcr?TJ^M&0(ovIU6lS;Dk>Ub%W0JV%|rtBm7 zf1ZV(e0Fht&~K;nP5#9H$aBl{4E^_bLnC%AU4h_mngtZJkN9Pulz~a z;5H?NviwDOQw0PMXv96AtBt!~xv9wfFpyrUwzGR81rj>Rb!lS^buow2?H`pZlfL7~ z-wdF%3UaXe`-n50BtW%>#Zsu=QBmFZDj2odC*PdCuB+RFPn9q2d>HF9K&ue{hJ3f# zDOOvH{Ml{dQ}}Y=@`(v@S?90A0PK+r5cPOSvBLS!_4!*De%}o0zVunB5T#lbaG#Ii ziM_Qt^kPtTg4oRWY=Nnq`I3LzFDq<&F<=hyW)qC@^{9al*XOyUM9||CyEOdwss~Va z&yk;=6OPdnQU9@o6gH8+A0n+^{n%4Qzv*&}&QA8_G_CJ-@(J|9z_Q-0|~V;m$Axklz71_8>hPM*%)ZxPFtFj@=)+(0RUd zjJ+}Sj^L-Szis`26$h^3FMG^RycuARdG9wuE&urBxa8!l4mceubNp3puzCSVI**Lz ziDz9hp+GOMwvCH7ju#Bj-Tdm9*# zdBKU`LoP}nuFKH(ievFD=cK2(zjiMyJ)RHlb;&S>Gv!fjh!b>XDOgz`9^KRUzyvZC zHvG6Ks9Bs;Yrh3NbKns*i$F<(b+t`PL`q(F8Ov)gEmNfm>j*C=e@8V^KSlj>x;`k3 zrS805J@^A<#_^mU9MXbnqa{{UTmAz3;yif4BLuQEnm^5>ADR@H`{7c zvkaVCBuxZPK&w3s5nqdYg0a}xt45?v=`&O*MMgI`0Jq$z{pnxxBrMGyvLWm|ynGt_ zL|d0JBUHHyYjL>E9a3{2J^wL@@V%+UKxI|ftzQoWrmfGtim(bX`@5_jaI7gAk%vS*s*%Y$A@22m=wYnm$;7*V`A2J`v32W}HsQ*~@w_h{S zv0b+|460RW^Z0bVugYt)@9tn$);)WcB)DAMg`;XyasMw8p>X}VI-X8q=1BHFC{ht| z%@@8qnwl&PWHmVRDj%(|VNJI^T~na6--0CXHP7cyu8|iT#%8?Ufj@ogcU-&@OMmkD z#bY$Hcl=Ws)3mxexI$P4e&{8bnho#WJagCwVFp*ZVJ)Yv%ioPyQ@vLUmy-DUgh2O8 z&MlqcAPrmPos(8G9JbAo2W~~?NOPu1gv#+|T{^Oq4fzoxZEmbn`$a72LKQP$c(F(^ zqVO}kgqakp{A1yrE5??=#yNp%Qtko3Y zym9hqruXfaqm?Pex_M=Fx8z1+3|DqoX0_`gilr2Qemf#!^Ks#phJG7q1pp%5Lgm!; zV=5^*dE5~+cgiVxAxIkW{3R;FhY$5d+K`|1&BdA?p0uD;TM2@9$VzS8MM9^v z+~RwL30qjx+LOJT6Mg<+GU3gtDcH5 z<;8vV5)YkPnOv9!A5DRKcv2cBR}`XB1Bh0f_wcuV#b)G?CR3=F=b?9Ldq}m5(8PDYCKM)*9?iF$S%4t_g{_+0 zV6`m)M>tzg%8Ltnvt*ky<&Y0d(OnvsQ9hO2=Mtl6H80VD@spjbDMsENyZu}PGw_qh zMb9AvWoLO5rV$U$?iW0RKQ*sZwwjW^J;~0`irB5rV<+%An!+-6mI`)_Y7A|sSQ8Q6 z^9@O3XL+|Bxg18xtO$9TXSU{+wh*mHdc#W_?FwWmV|J;~1~+{nb-7m`zk!+e{qd!U zkSSJ2r_w9ACGuB=<=g%!hDqN?bQjUsE%85UWi{I1N@35~xdDR!p53%xEmmg=gQoCK z&%G`MRjwt~j~^=AC4WM55Nc9><_n8(q4}l*L}Hm22DWz>OdNQ~UlG*yM)l3tDkZbl z5602uz7j+Zyb4Ylz9=Vbk*BU7Autl5rqpa?YA*6*ca$v=63>cA0e+Fj;<*&_naHOU z&T2x00KfQ8BKQD^0ELgSMws3RIm>F*vznaEHf$E@u-&fF)zQZqSgm15oy=MqVVUeO zoJ7h=eMS-&oJIu5<&zPn8Y!sD?N$L0z72dwFlt-^IQua8slT)HMc z-XND^#zI7y>^=9!i_0rs^)`6#bgsvYipvg`!D8(7gy;D%@{OkLh@qH^3O~{XE=4@g zrKl8pAYO38G}Q?XaWUqI^Qi^HiPb>fMj}tVBiH-}InsNbfNxfS5k@%|z;pf%hnNg@ z8D@Oq{8^*e%#BHMfSkJeMWhM-Z1ZL~Smafi0M(QY%!Dd9+o^<=!NVC&lFvRn#=6w0 z1Iw^>J5A9HG_zMwy*s#48DOf{q}77uz?;hA=qRVdW~|ooAi^o zNhpz67a({<7*H#J&FT>M23<+}(Duy&eqgY`)OEwi)%)+cbBi;h}H^u9a)vBV$aS++ZK$_)$V1?-ubGkL7V zB1GZw1_{I;zCuyw1k#c4sbBpLwZm8hi^sB92CM@BE_$)4G;>T{cy-!D&A(^mB3A%9 z^k&VYf9fa6$(~X!HLN%=T*zVUs2H?Awp!@X?KpU3F+HhNaxKwfAPux=qOzy=t|j5d z>`F_bX}6Uw6)A;MUbbs}f+jYWq7Yig?ox=5WA&ME3T`@cfk`er3cR(jkkfTE+P-2h zw2|qeH-@o@*)L1_r?+Ie` z-f7nQpJ)P5l;T3L4N(mcwTR90=dBXK`_!z2^S*2eUZ?6QYw7-fv`{1wI|_rAtzUjI zpBg5T(&}s%TNVn8*W(I5*-T7xDaJig6boYb3^g}mv0m_7=B@kpSGkgO+#<#L`#gm| zr~jqLt`3#Hi>hf_>u%Zuf++>WmtM-80N_tekKws{P`E0D$4Q6E}U||aO12Dm_jOyK6F%mCKIQ!ZGnH|rxE#$<7soDoTHs2 z%uwvs+rjYCo!$=9DvCI(d*jqW$!xc14DeO? zcfXRhr|WkXar<}|&?R{I;T5AcxEQuY*$g{Povi|WQR!1mf63h0kk82Q6zI4&Et$LA zFwbBwv{;Bzc77IAhJYSC7XA3OoTQ;b1J-A`Ly66T{sRqfE4cG{GpJkpB7dM8d}Z6d6bXd*u9<18<{7mzo%A-Nd{&~t}2%{>ADlL6t* zxMJ*`&Fbie8A+G=)3yK-Yp@Z9s7f%w9iUdw3)v?k1(2-hVst?YVP`BxA<&dyv3CF1 z%@O)OMJ2g@C6-iBo_F;Xwyvqpy%~vC9<0rRrhV<~vNfpkaCA5^vA24c4c?8qAb8fA zgPVMi$B@8WXX=2aEh~W=;u#l_h4$NTh`=9?=7n>cCxNB z8~z~Y{{Bcv+x}VLsMv!T#`V^WL~X`9g8VLbfUj?+o(=l^>v&op@S!%F9*5nfrpBde(SwvE^9-g+kRyr0=KTs=oIHs(`rq zmI;&SD27Rn5K>KwpakTtZOfz74aZ**o=FQCS9nGHC!6W?rSG}-%prqL#=||K?XToNpY%}ojY$Mi4x zI6JE-g~DHxAn$K=PF?n;n5lwQuiCK<)^+~*E;i&~i^<*#SY>RH4!oLZn$8q_Eb2sAn4{A*fSELgSCYF&W>B!>-eX3RCw){Pm z!WOxzc<&x#W&a=3dj{?VNm_c@_^oXCRPbs47s<6L`6qjVS%n#I!GDfEGzXAalmAxU zp3Z{}tV~j0bMHROAulE`-?L-lNrLL$T&%oYsZgus7>*6pio%VFWe_~rhQid zMjSScpt+W{K>CkquXH+qah^;{`|P2}b!Om~i7jeRv^#;JWuz-c>c?c7YY8Ygz0fGn zsv*5WUM=&T7Q3$qNOEKJh(?a%B_B1{CN{0e_8Ut$4EL+0vcdi$)dyeNN9#o|J6;PM z35Aj|E3%Jbi;2h8iakp6pmI%sTT5$M57K1AADqd3lQuqkcU&!oVJ+MCXgnuMC7iTw|A-*08swQ&z5GgxkBT49JCbtd`Q zKy23+H3(n;rTFqVmo!J(o7{I%FaO{^M#(Qx6>K?XnN3gCy zCT4%r{;{jCt!cnjj5e=;xA{w5<>j`O5A@E3{{uDC7Fy(Om@a9flo~v#e>8jDw&Y57 zlz_z7cUukHl4O$M0A&dtqh+|prCPRUTJ80XfBBGYP zyrRk4*th&Cq(R2LojssapMgP&4ZH@si+1f5+aZ47MIv(!Z+_= zeD}fz$fHO1a|U~ix?lwuQyfQvS^VkLy$i}#GOMavyGF~*;37{^`XZ$2sN(3u}x9W>c>^X6UyYO@#|+l`~v{Uh=&nziz&x z`s$fu?tT;Tyn<4T>icSbJo=!AAhC?I#3n+DZ}v(RSqU*ThUprn$kI4=teGiH0lIBw zq!fb}ObesJ(v(zLgOi)%81hG_Aghzu)S{P@VHJ~+<> z9}YrHFZAx>j&;@>lQT(|Dd$qo@)U2Gb2}tW?lxRYm=$+RI$)mSe^MyFY?n%Xk~K|{ zI75$Z{*S4_3?Ef4*?I1uX>UbSFBwNdph1v&LH7nf{SVw7HFZZ~^dAc@7gL1b7J% zufxz9j@@v6s-~5a^_&Jbt8WG*EE_;zH-_j7xJ-jcKo08%P3IyzjwvOnV*W~>yLWvr zw6I_{U?w#idR+Y22FPX8L6tBUwE3CTWL2}EHmO(36@H$B=Tfq9U&yDK@I44vAO*#K zX@8k^nJXJAGX%A|IrR>Ukm^ll$J``RnmG#`yZ!U~>E%WSk6)yTeWNzC}czU8}iqjdc-gr)9%} zG70UUA$rF378xcFYloL_Ou zUlJz}leG?2WZ@{zD(5#8s@FF^n^kYF(2#rP40B2*Cmeh|XEjNhs|Sld^GiC(h|Wdk z$dF1_G9&fL64qEu-EShwQ!o9i4iNO3pX6_hC5M+_<_Z6@Y-yeX+0$O)AycRCltlM_~Lwf z{4)dXEdJss^ii#O$&?Tz08> z@Zp$u(iSV(EhS%ig#m=VF*WJI;`F|Ry<`M+_Wm3VF>dcf35J<%0|gWkuG50v7*d}w zC?4@A@?FyI3JB2D^*%9rBYFz((3w=Ew2wqoC*mFgRC+Eh>3 zRBp2PRt;}Ge)2QP`4JH(a(!oK!PI1t?DTsn<8lTni;G8;5@$TnF&xTrHC4XrDlx#I8VO;h9zW(4g#3r(}lc zJakV9pa3oZ^};2P_v6E(T$v1y!VgrdF(racedK=y7lO{Z2VebAxQhfBOR%-e|?p*0w|VTmDa zjO{YIL2EgxrV9Hz`5A`?rl<9Na&-jp4Z&z^(<-3iCn(lPQ}*4I zkU4Tq9=zw8BFbC7rv`m`E6n$|#9963fWfW}7q5!qsw(jmV|;T{ZMRn&|39@yUrXDk zygJbt2enaOT^U=gwqggT5WT$(*HOWzPv+*YnwOKU?FdwNx-ewO*&p*Q_o1$H$HKJ@ z8U^uQN|_;2^AHS<#{`qXn?DH-LRmM%V=n(`H?F|GSQKGUj!5mrKr*i&J}&aP3b?y` zM)0PLU`id>dnz0mU24cFkioirXpiMEDoqpE$EjK}LAN?T2It^eb?XNsLi z^5eI!q`+^hZMww7#-?=1PVR+tHcqY4G+d(IUedM4F1K1ASksEv5{5@L5aLqn06yQ< z#)-E0fc^lCsYAa>yMD!b`D?+bF7POK+3ma6TgH*kZCq5Vvh=z78^T5I^_FhMU()i< zYJwg6Zm@mzCr$P0N5BdH*KYf#an zNB)LA0S%Tb)xxkg^79#O-wn72si(i+Fho zq5uz{@?D$sjk66nC1*Xdj%=r-yewD#gT^=>ObNF8e1CPhgKwLCIslmR+`0D>aZi$MAyI!;-hBKguHYlP5~CBMZHLH?VT~Nce{#HM?wRfz z`_T)xEPc-^I%$Jmaf^-X1=L-&k-$25WvYxoZ{uiH5)fQokQC3|Kuro+uo4EW)g>|K ze}%F1DLEyTVFEnR3W(ruZO8h)pH$c62Pay1lGI*FPBwRl?^*ir{L;cM*4~?Jg$r0~ z`Pub^{NS?oJ&fNV_@_yZH{oCV^gK!jgr`+H)Lb>eYa3I7Oztj_Y9W&6Hq(lQ@78DZ zU2D+@t@OrJu)pqw)O-<&D{D{h&040&9F{BkVL<2r?_(Ujrfx;;?L z$PRL<9946~ZwtAVN+=U*ekC3}4MBXRoDtvyXDZpx`We&c7jIytcN{zH3Rvwvsfxu5 z4j-(b_N%!vYAAMHjz>jc*!4Z zyz`LhHi>PArN1SSGVAYrFD^~}$=vykCM;-YZW|xnJ8k(fXVp!t`-N=s_hh&m({{hM zT)x>{jQ@wp|5RXpcQ$>y&O3eLH0kXeyFMs!tK%z1RxIU(XnBg7qVGS``}u|;oQHC0 zko38RzXhLrQUxn7VG6g2?ESeCLlMQ8CdCycD&rm>%!m(f=3|-Qhw{JC_fFT_ohTV6 zHZM&TIP3N9IkXly;I;K&lV$0_^U_$xhhH*}T z#8tgzMDVHkIlV=D5b`ATWAZ=Q;5$EED;_Ky7cPIwc)S;4S3Mz`@h@lZ?o-t(w3(Dj zmOMa1WPYQ#1yaDR;}LSD7BJH;Z?mb8krgl1kyW(8n?+jwZQKrPoygn{yKBGv`#+{m zWpBNQa{H|(j3CXETNCXD$6RD=*U@(`(3`QrE2&8j1H0AoUS{&JD+6TK&w`uLBiRL ziEE=NPla1;`y5Xq$I{+)*jQYuJE(0AzuXxj_#wH~A7DDVkrMHeO2V)Qk`leN6Z|A#fIcYR7>Ywn#cL`?!Lt3 zy0p0b`XL|Z=cz11fBx>D#^32ZtLZ66_0-`n_m|v$J3M|mxV!c3cs7v!uf&Ta0!hMu zT$Ys8Q5(KaZ|8in(w&hb{2VMM5NYVWv2<_kJak_8;MvD{MoIQB-#{7I?Xei!9_8VG zOv@KE0$R)}&n&9O#KVexSB~pxhf${8WxCEbGIOD6FOO$=8*9zNc7Hkb;%9CKCjEg? zu2Dg*H|1w}_g!Jfq!Vjj3wHh0MCdpAHPACfPq7=H2Z~wui66Q76wR#If{Usrv#zQ>u4EM`M6kKV;<`0a;!0giruvOe$Kl~=FAo;>pXnNN@2{} zFWYT01}Q`sX1A15ZsBGKbUO`L-LjSH&PocGBvyDJaQ6e<1UcWCO>c;4(g$DLf`<2uM&EMXRf|z5E-!;@Ep`< zknVx%)ANn=RJQlQQ99+sZI?-S=A0;KP@H-e-u*h^KPHA|!8rjEDsK@hX&&yC4G^X$ z8LQr@QYh&T?>+k%5}KTC@>(;^W%c@eSc6J80Kf(}qr`|8#H@Mc6pPZ^Z~J0MIbuj>7SWP zjy@DOd)gv*71Vj{Szj0*HqhCM=fQwA8=-3!=(HNaT4X{3FeT1jeD=6xhE85QD!9Xy z!q{@(0&WsZVz$pB)bA3jyhv5;qxu7u7Ke{e>*hYlGU79~J?kWd5edIQD!9{YhT~>9 z7vodv8h8`9RWJ2oL82rJjY=Pr%N24UNM5@i5-;9$-odR(ht)#~UrcysVds(TK$JO@ zP94=Ug}SR5b21k|EF^o4wCPontqd3#X-L``&YVSuWs9%(P4>$7^oC0EaQhd1kdfi) z(_pY{o&9VoEsk-BF*6Mw6wrJN{UjjAOTB`;kYk}U!2OaXK+v`T`-VH1LHh*zLIlq* zjp+@cB+MVrEietCgfiA_<9yz^6*H68S_-}Pa@lvR=DrPD#>o~1dA?zh;V=Cag@^Tl zAcUb+1Kbyx1!f=g^{Y$y6r&kOud26@503_`G zKBI?f8BQt6z6R1xu&+%W1OM)20f(~1d)VTo^&!%JLk17b zL#xPvqO|B=P^OhIo=<7sFVw~3P1~xaxVb=U&qsv0#IYM-{je0Cvy*Hv?U4l=?P3V; z620ut*aQ#sIkIn(6J%v1+aQ>?xNYDQT6hm2%wTr;g6Fbc4TTpJn)H1qE@c~lS-PyG zSk_Q4WFP=@?$&oLq9r_h{>=b!Z3|g!8_7lz+Fb7SeDSETOGP+CoonArv*;B^-$7GI zsf;LA4@aG5B~?ioZ|bW`reugKy?_*&9Pb-JOz79lG%jYC9m{egPi7Ac6HyviqxFa7 z13fzkgV0h?E8A-+v?p5xA))e+HBM6wo%G=Z@8kT|2Ie;Kl>y9BGxLz-uaLJ$h(JF{ zzA4q^1%}9VyR4XMTHzPq{k)yKf1}B?dvDZ>lx^408DC;GJU7hfBKMILuAg$}B;p5p z)u+0-%>Dcu%!i(auHdRV%kPZFl}UVsV5Mkl=Ou?*9KJur)jZ&@R*~a@rI7XWYh0#= z7io9cE-oU@`B!kKrp>YTfYqpp)SL0{{8dGx(Np9K@3JdR=gJ32H&AmP`Q?6YFysSy zYgHZDh(`qzS_Xh7@U2`BD1Q+utu`@Rm>thzQll{Ssf?*9g{=N^NJ9CjCR1@BOfP5~ zrBpq0CqMBycXJ*__QqHl0qZRIuyqMVoH8<$Ia?fnW+)GIz&bv&ugX~S!ar$Yy(D<4)E!!{G+lzCc)iw-@0m&EAY;D8n&Twx@?tkTkVCpl*W?T^B zW!vfyT$4Ddun0Jm3l7al>J4Vu82a=V5oG3Ry{>bHJtE2P;e-T`fhy{~Lv{Drcv2an zFk!u){WT0yGBjPL-jd>0{`JPzgFGi^2FKW2cp%T|;_Hz7(p;#GpN7Du(uG~m?4dQ(IxFzf*Do=G_~ zo4#T13!2K1u;17k7=TYSH8>2--3Ln7NLcBVx^pa|t}U55*HY$bJ&)|v`hCTKIdFKk zh#M@Dcq4$O>3D0{cj}5Gds^iI#Sio~vXd)Gradg09l{54*k;?V8(_OU+-jf$YEoHi zQX&`=aKl3A^JY(%>7!pYg6Wd(H8)A52R2+MJLFP1%5XzUHmB42^r< zXl5vtL51WKC6jV8hw-t?^TkUZ%OSfrP{+ zxUdOU{PT=oc9h}jJGaRa1ZikBdRY}fM*pl+udEF&YVGRW0o-uYkqsG99b;oJl5)5R z6}k98FqTW4xP1J)Yuk54)@uH~F@WA??Qf9h+KRODhn4+9NPkLqh`j1Jdhg&{9mIVd~Gfl@Y;8WKGbFUa?$r4J{{UithC~t=z-qUSm3T z;agHgXIqWy&GK3aQKe1inTBxs_oN87It4qL&gbcnBir(!DP6ghkr5BNF-={NDzxf0?(*7E!lqkD68B*>X z;3KGECYZUwkmnM!^^)W5{9EFqsrC3zH-72^9vkRXrXfXJ`i%^v{**vpTI&IxIkp5x zENW)FV~u|(vzc4aiUKksSkE8 zd;qe{I}x70$VkQF_gl+wuGI4TF+(~aWUiWx4PWbq;w>?;Dvy@WnWs;K zesJ9g;LC-B(~92A48(KlR5F&omF%_Od#{bl2H78D>=%bg=&wE zr_`&b6gdX;5D?SDd+w@{EiY9H^#{~obbdotL*LS#O;Q!%(V+Z&pJuuAv_h1b#&{77 zWY6+b(ig>1RV;QEzcix81e#cD)-u1!BWSQ(fiT|6yI>{mo1E;bH90*}E?MKnqpp!v zLT{k!qGG$8qdPM+&yvwO0B*izy>ZL7m=VpUcXWhB;l&LccrCj6YVq0b!t07b6l!=tgr{St#$qq z@M2(|cP;GwX{Po>ksZy{D38T|Frw1#lIjLdN0VzMo%5#mX(t$G^rFKH-`r4;5GbV-oOD*oc_2x||X@ z?mC(B$FfW|Oi(7HZ|cvlJuB<7sRlO&N!tlD7;#;Cp13mX{rcUJ07VE{ZpFoT%PpZn z8XO=%BD5=3V2KTXsL8s-T6`%RSM%$sk3~_ri7{_? z+1X%n$F7c0(U&%62NeS4&iDAZC#I6y4dF*-BIQBHrV)w&o6Ez0^2c3l3&)Depk&tV z2i%vnmd%~FWYs0F%tL85#zL+vk@4@)h{F zcbIZUtx9D$nws=xy8WwyWN)zQX;~Nx7C^(<)t7m1KAU5BDcglzY>qp`3ikiK>>l|k z(xGmVY2gHsY2Pp&aW$K4zhG>sV67^o#{R8!n(U+po7m=UPv$++j#kh6x%KAl)wL+y ze~Qs%SNDvr`dO)u-9YuACvvz)`^Ous*__x-qb~M!xTvACr`bI%BfH)7#^h)!+3Zv3 zv~8IIcmPO}pK(>pOitPMzK%xE+*0lU%1d&{JmCSYCJ3&Ei~e6(PYl7)F#z^ zeIM_}D5Q!}(4^)nF5-DlZ=zFtn-zyti#<0alpY|$%aOMckpJh+@> zCzp7;CCtbG3pO7G2ZR<5?y@N^A%D@%@uQ{cV?pQPf@741HxInFo*yo&`bx%Opv}3uQaIWTk_7B(XLI( zdxA#^)o57-q;|;wlnG3ZDa;r?2&tH0WE$U?Tmj$~00l2SCoSZnNnRwpTVjRB9aY|J zezuEw>{7i;_-m_ftV{vm}YYG~A&=8+vl zJQr|Ql80+oZ~nch+zwqPXPu&maH6ouatTmyrnWLoD+1D73@R?(`C_LThXW(mgvq_5 zRfqUA3>Fv1qgg(PS(uuv@^H(rNlOSgqIsgr+*p`u@~OQ-8S(-~ha}_N$oaxUJuPgISx`dxPlLS%u`N-oO`N-mBEk-wGsw7>QzXK~%{a8) zm^|w>Z}MkUR~cptN~;rvrCWhkf|7W>Va{oFMD0719htyIkiKfLL{V0vJ4nl$4Xf#Q z!lEy?sN5AUX*mC^$hHXG1JDX;aVm{dxL%w=wC$|%O_*z0Ih!al2y+kQX}ZD|KR~}| zc$pv64Qf&1kYq+&Q{IsBU{Dp|-y-fZ72_`kaq-&I{vJ_b?y4GGq?&C6n7s}x_s*hi z+d4zYolPd`%xPw5u|AgotEq5cFITKRsp9}1D?k8mB%0PVoFknRNdLU4IO~|8L^Fy1 zOKpfT*rHd6FGIqI85+s%Gq!bMnu@)@cM!_XnTdxKD22gRmLw4(QHh7rS16(cgpM;~ zMu^fkU@yY`G*d`(W<1%++1v)RCyrZ*q20LIM`XutVbOyuOi_pzw%Q~nlfF;%Y!4ZL zghHX2%0clxSv{P`6{5Wsw7FCm#p7}L_Lx0X!*OZ8x*_-cMF`N2ReEwcF;DCIL> z=wwjFIAZOec@AES{U&o%3Lr`d(PM-sEYJweh|Ehk_H&kjVhC4#Sq^s}c}63cZkjku zA+pv81udt3HkCU_;24z*F3Hu?T~#7q@AZ-}5cp}8UUBVROGfdeeZ@r$50sh26gE%Z zdf>HQ&3P#qP-{>BpYh@93(J3@-^~>=kSe4kp`@%{W+QMeYwOJBwLHq7DfS(Bah$OD zplwn%8iA&J%g=JSnP%fYpOkWw3?Tk3*H%Z;I8^l7tXX|pZ7C06BuSc z4-b>U{NO~4fdN!6FFw3#*>>qlK^h=YhHyT1Ikl@IGBn2ecxN9Wg-+rf(#c9z*JF_w zr)gTM$Gog~VC2+u73{N%&w|~v%aWgQ1d?#W)m z%t37hqvD!VgX2E|Qg$roG&E4-QcY-r{|dl4*YQbm-1eeWtNHjOf1}-H#7IcLrEkSt znuP*I$9ua^`Je{MNDg=D6Sq{v1J)~)?urHb39!jpP5NDjhha7J7jp4JJ{1T9Xco21 zf$RY?ka8(>5;%D}`(|v%c{)rl>@HvjBd^^AOAj?@IWJBr3%~~BnhV_Q6F*ltET4}@ zz(pZ0R7yx)(r@@#t7l#w;5lf)`SqqYTsoRQHg(qG7H>;mey9Ses4`-D{iG8JamEah zcG_%kBskAOH8*iE1mBn+JLhdYN12H(1r!t5`U9XPyqBzApU(v}xJML-2$+!7`eC^E zTbnSy25VnKYfI%{kj!10g7Yu7Sy$p~iPe8{N&b)ADL;35OgNRyZX7s>hk?5vjxU=! z{l_#CN`E%lN?PM2a6RJ~3>F9}tltMGWL$M~2VgE)Q3ILFNFlr%ns$0B;ULGtmz{+;B!!YZtG&&82BLo3v=FYz)k0T%lwe8^9dG* z)T+m~;6+{3yt1ju)+e_Z!ZDDNiyi!Nfr(?*8_*lcL?cEm^`rlbytzKXJHua)?^e`(Jph3&Zw(;yeBMj!|!7$>oba4NErvopcP`&GPv z#HTP=Ym$AFY%dX2f)|CJktss2I?Zs!GNr(EdkWjE2V9CnQli()@IA1_p)aWrB;FuU zwG#ojh1f^aJ?b4{es%}%Z!C<>h%uEK{KDnE(Iq3EoOa941>Vi_zFy5@J0`15<0I! zY0zT?BU0ahI%0PN-z~Auw1Ympt~yRr^m87dOSk_GIp0_EQ%}mAX3QYQ>Xgk-eNLMq zOTR=eW?0_@EQ4r~Z@A4*^ue#cdkYHi)*JdMwMYuUJt+2$oqNs_0DOAdj|R{c60) z`q(EHw~V~UeG&h@1N|#TBy8lw$?j#W=*DkSy0Z0_yBzd&r(-WP<_ z)%Sb{V7o56IsV8za_XLO*Iz61f1npB33YEU{@-u$R_>qp2w&h;+R3QtqmxZ6u*Z8klq!n?nog1{b|}0h1UsJGwFFA629Xi++kgkwx4w`8_9!4Fy#F5_7iA$v}=nK@+vzR7g%Yn@g}iKg7C zG;L%)5FzfSoICo3rr?-bh%W=-_RS+rRd1Ul^rZGZ@*FZzoUCB4X?R?i#14Z?(rl_z zu2V>(hQfrT=F!WLi#hSE*@??=#*;lQY~;MsccZZ&@GJX7KADVn6zvRSp^;l@ve}Ce zNcuvhu_4@jP4--oGQib#cTvll_NGV^c=8`p!n%ep3(fG(`ZP{ZF z%Z8|JT5jzh-dKW`X26pVCkPBOnyY=(1Sq4TO8rsL=0&&?2jYo%5D| zpE4Yrt-fCuQla-Q@RY2XFIeHo%zviV;j3er{<^zp7JWY1&~4rO(5Tn4mBqoi`2lRi z71>4q9Z3k>I2w^J3WhC9f_G?S7+z`%Q|}5L4-qWefR9Q5cEIHg=4c!)_c6SO-2Xdj z<#1~4SLOE0*4}BO0tw%K%vW=v9-bOYn;WA9EdHb;eeZ%bC4D5IS(13#A9L>ybopsw z!Pe0du-Vj3IPWqFqkZ$bDQ_sov%J_8>rcvAOS7`N@ zR4w!ba)?iAks_eD${00?UAp;z`@?vWItaOQ|0GkLL6h1KdG3OB)hrGRg--Ycv_7^q zfDUgISnr>OT*e+aBHJw3i^hPbN;k}%C}fR*Mh=l=r8_>9RIzC zX&PP#e{Nki>GE(6n;hxZ{(OWntCgShkLJ`S&WMrE@DoqlBT@YVmw7(4Z^OCu=%$`E zw*|{&cq?D+wi;fl;6s1ig85s$BNwKht<5z%YD#va5qLx6XcB;h?=k{sm4@Ka2 zaS#(Phq-c?1_06*R&mF~eMI)+Z3jF`Mx6C8H9Mms>z6baS&Dr_P5-c>`ED$}ApRns z_#NxFd6x5rgeVB^#yNYhE_-^iu__xEqbwK;Fk5b!V*}2;0H*2 zC*+obR1%A{X0A&{uG{YnDN%Yru8vQXH`dEg1^HAJ_25B;iko4gR8mR}ORV6?=pxUyG8u-uL!FaH2Ta_rsz&D-yj5mymsza zK~e6Rg=~EpRtUGyFb}7?V@}n!71ZXo-#OFk@2m73;XLm~-k(S64c=uOMl{N z_{p20BzCO0nKpUvr0Mxyc~0g;Tw4dAUQ&!)z$=p;Yo(NM+;6Yi=Y*~>sSsj4C^%xoU;_zX=0`XqmxW>!gTKZ_fpcWQL~tmW#}%-l zH-BGR#q3(vj4a1;sk#$OKsHwcg2u%U_T#)RYY|Fu(t%tT`;RGH!YZ(Vo$G^xsp1mvv@DQF!hRv|UdG~`Ij^!dhH3DqNo`~d2JODNfC3hIV)8|7>lFG|6Nsazb zGNZ-X^W;d2QT`88>akd?ZkC)tVDqjqCk~6i?>JO;9@%@f>rBxd)wWoeO zK9Tb@8z1KA`&HZ8Yz2b|D!-~dpAc|jTivl^&_X*cXw}u*;RCni4)W!Wr+Zs8MOKhZ z(#Dp{)e0>b^{;IQMBy|GX7Q+s^5>x${U!xA<0R6ScJn7`?+h*-J2cD{aNE=yk)L$_ zdz%%{;{C>43Emggj(G`jz#V$qS(mXU&03B9>HxOP66F199PWwvqiopMR~worYe^4A zzST3J@`FUHsl!?2MdhSmipbFmnuk=~#GPpmGkie2lPDTh?o+`zZQ59AB(*-zFuCNA zGbV8a!4KBo_(NP0=ROJ7Y$GkVsy)ew2Hld$(1i3L*-!VNBLPioBvY8rr?L*Lgl&2G zg$0@NCd5|ps|}mC`;W<1a<14?qS3C`;zdQFkRv08tyJti44MaSqCCe0RC{~0i?S=q zd=(juPjjkm@4N}YCV{OWxP8_%1Tt4v766;fzF{R>xG0{|T$A|Qx;iC5YU{Vz2bGK@ z03UB!!CWhgvTb-@0j`G++%*SE{SXE!3aO8e%h~{LKHk4w?Y8WE<(HY!`Kno7O|zk$ zNolnO!Jh{tyUe|Fw%<$L!Jo>j&kDp`fxh3gVcKvF3UUz9{1&l)ngwkjddHa7yPi2F zeEFO~#Zt2>P3rLfh>t{9S3_zqJ>G}3DogZ+Ez=M3Gl`%*;y?c}hMC3Msif0C-KMhT zcY%GN8vwlB;ESRJ^~KAR{GIs(TQ$QJ#vZ;-+3Qgr-_SA}NJADP)p2@@O)YY4h3&Wm zGt3zf|6JoEPt0ai?de;@s7-=IZ0>U725qE{_*%^(f1=mxMw`>FpC=?lZk1}aqbDNL zHHh6(Gaq|TnS&A!jSsP+6v)gY%WCOo_kZ;~@@Q9RS=JZ`Wte-gU=gPt?o9JbJ?+0U z%faKMr&^{i)W-#-TWtvoMatS4D=1s8oLTV9jTvp0_4_O(UJi^rW~=Ksaq3p#lrH*a zsjSzSnDn)J&S5cM+Cw)CbWG(d(&Je2OY|yM$4{4}S>^e}>0&P6R-l zk@p%O_)b--mu%If2PukSDsKFa=XP#QHKJB5-+1cJkcRb+uO~$l4`Ci|A)EUsK6$V8T$xEB#R%8GIzGBNyBnbcG2=ChT@p zl%X0wZ7cfRsv4i<=pEzz_KRGW4!SnEGd;vfQv!bqpyC`7;M%Q4uQJ=}1hGJ~6^k|x zg+saNo}Qw^b3!%dPu=I`7*^kHO@RQmeSMz~|Ky4%%U!!uKP;G5=f%(avY>s;ha6={ zxe_2cO*w$Ry$E^n7|rF2+BElYyz?U6yhxdwJ-H-HP4Tj&t%_hGOCmHx$hxM9!_-$+ zI#(dFC&K2psZV5Wj~J`AVr8R|>Lbs&4vppX7^hpB`ovjqPeTpoUQb%8 z9%r=j!L6~5Hv?1<-N#RR#W)Y6xJTwPB?ljhkyD8+(U?fYEvXD`Yg7b^)rslb<#=-KNm@{RKlIgyMFIZ5G zlU?t4;`roK#z_H7H2MRFclr6&c(bVhuT`4AyxHR@RsINo2knFtQQS%-xwU$CK@p~nX;9>Ab z@pOt~(cTm01%CP4@-+#{+$px5?C6YsQnvRn&EKm6 z8pvDe?S7vg=WUiaRSBbtGky>ZD7Ka33rgxZ>f}-U7{}`Uqf&}DRoK6F&+%Mk!5!YY z-6ir*n~@ln8vTPnreklBVli373-vPJ*teO$BqYGqWcLFZi7Xy0m`_8l{!^u%EZ+H= zeU7)wzcC_Ez?fmsHm4*v?BK|z3OCc#%mr!BPgv*2UmeH9BYlbqis}a|QH#iG$u|!V z`BV)3Im%>;Q)~o=01YATR`M4&)OB5=(fx?gFRcc%Y1eBEg`NVTc82EVz6LDJEe$M> z5_;8Nw%)o7&YXYC^YQhjAS-~Yr;o9bj<`RmBbcb6Wg6LUS{wSr?+6!O>tDh^^A#~m zZW2!-X^q>i)ZLZ}0QphT?kaR&FalHWEco%VucL_Zhw*3XnsXiby9dGeF}{0HWtZZf z7km>Tf_%FA)ypfqUu)GmzE$<#vdgFM?e5W!nmTWaJ>D<8qLzDNG@r~ndR(Vp?3){9 z`2EIw8Xw}Mf-gb{IM*=#lrs0)$(Y~O-J@Z z>h&o_>zV0}OMi63>}teb-e#*8+f+Cz-2EL|;98t?y`y5ctXpxTCSYcgwKw#o?4B#x zB|zZi%4Lm}z{DrTD8j_6QCylq2Nbh>qgt?trzWeO5Tdvlm@FzWe%2hDS2+hvk#`+< zEIy}!zaT^0US4{5??lsLuP5;RbzQj`YQuB=eTl3t;ixkkoRe> z3i8|rDEga)U|h;mt$lOSIDFm{gfA`Fs+WkPK(={c@Zg(aTK2P%%?J!MFe{aWmcA=N z@BP(-zsk7M$Bv&ztnNUybu35!V;XK-Fo1R)zhiQ`&vengMs2nFo5a$B9d6!8_d&Uq z#ucC@aLV#*Gg86#ZWEBqAkg#Zx$ByU|6m9&P0*Yr1|YPVD;6d24bK!MQ+EZoMmW3I zVrhOW?vA!4+Mrxn0am1uRjD^uC4Af4qrk2x^h=JxtPD@Rt*pkG72glw(drj&1tPzs zoBIqH4{N>GvObwIlg7I_Egt=w;8$IQ@Q4Om6Yh}MfbVU z3=EAkqb?C^YW}XlOVFif;dU&|Drm!T(PB_~)mLdnic#nb8ZWxmBLQfY+0=z33!RfQ zH#-=Eq<$e8%FS0)V>`{B zu|_^;fLkv8BK{1STXJEN^tdF#{H!JyG|1|GE#j+qz@d1-k-XtuaDIE8Ba4A+JWOU0 z)i!l)I88>R7GeLJBv_pG0--GWJd0J{Dh*@OW3q!BVc`ptUbYo?IhF@KT90q)awst~VQnt1W{%-p2^A5LjNf026Te?Y6Ix&%|NB-AHa% z_^C!3@kNO_K|>}WIdq2f!2c*Z^LVBoKaNY1T$%fb7{kmFIg4Byv$;0+otw$EkVHj} zZSEOE6l2U>k#nMQpXDY|xhg~vMc4PY-~an-kL~mLyx;HF>-mhZEgux&_c^_VoMG!X z1EP#7rkW zpvY&MCWA1fo)*+VtiB~wLc{GKgaHCs6 z-e(q!k_Q*7N)9x84KQKOo6|;9oqPwsb59ddmo&Lmxa&dIKqcSL2oP&$02e~`HdQ9) zu<8i3l{C4)QiY9_ti^+!nMr>3wL=t*v+3MJM<9M> zfwW)+1i+SlVXmNkOwu8m#2pFZG3zJ=hF=}>yHM( z-3UI8g-=4q&hi2W^K+<4thxZ9$ns!_dTCT|sR|iQ&B?^cJkn9(hNCm6L=t;{Wj8zF zLTrP?t^Cw(`E13-wyS=xu4WW92?UoDo(}RBeC~Hd#XwATGUmp8i!6?L(m-b0-0V@9VoDdnlxBWW50!qrs=qUtjX3v@4eMYVL+6^+gG__RpNcCFr3H-L|i(M96lgfbZ zu4DN@Nw$d;doh@&9~1iGxgfy$Qo&k;ib=HYUI|S ztapC_;og5N5TGr7cS&i!R3^D%xw-Q@FX>jK8e;5^Da_k7^FfSi)|Lo%**HVR7Lt*Sr22i)@}}RytLB4CZ8O+c-RCWx#X_0pN|)mA z%il3T*?uRn&$xw3Do^8(<9F9i`W*&Y^|3oTuOk6Vx)9EA7$7HdiaU(52Wi>mYS@5q}k14{x}XO%f3Sz`zTPONR0$EeIa`Qgt4= zORlTl!^&X3=H_=U>J54wJu2XAJ9D!jB|VAfTzuP5xWe!J-1CTDI?bF4vTMRF_6^F; zcJ4l;K5mVc&`xX;MRt(p1?rlEkoluoLeKkVe&fwYF%-WTS~sorrfF6PrtCXEFs7_w z*V1PC$?$L`$|ZiOSE6kIHF~MqFLOFK(sgsjH0;lMge;-lR&x?>E`^kOXe)2R!gVug z2d#jdhRC+<#cOK(W|ft|L+(qvwepU&dRNnPjcaiQU-RP!{pKiDcW$;^PH&t8aJ05T zAW543vOon9H*Fp~X| zUg!7E2($?CviUD}U(m*9{H+R*YrHB`NODBe)g@pzmlLLN{&Mftb#Z5E8=9{~J*+e6 z5Rn_7Pe)_!Zjv+8uin2cIb|gwRhQ`35m!(jY}X=OGY`088~ircrgBzfy~PClB#mdJ zxK%~s)BQ#d)75R2*T2awrC0JPichBa>VD_of23sw_T@V`Llclq$kjMbRCvO)!WAc4 zATr^27yZi#oAx5EJNR548#9H`F6$%j=}; zd$|T$O9N!u+u)%Dyx^MbFVgSPzuq5%;xALT-rfe1QkcL5%a9f zqOHkPza@XSdGWGh;p;Od$QQ@ot?KKiwo}TMBboqSCe=Y1_51)>Ovy`~Wsln6;1%m5 z^}o+^;|-Z2dEWS7n?^34Jkmf&nA&F>k-KktG>-FD+x}?LuUf7sw(=CXzLlE$ev$B) zH)Q4Z_AmK*U`~b;Q%FFVc_d$&7wLI&)Z=>1zc(Z(V~9RmT55c4l7zQx6^Jga4wHfu zyrK!2@`3p_iYYX+7nr@d1~J3dhZ1$c*5y+jY!#r)(INQt*%Zul6r&zN3*PFB>_r)v zwJ9h_J$QLV22-4;Vm&pIuuTrJriNC@0^A>;ITq9mHOSKzKS>hHRkQz5Fr_Vhydt#u z$f9dTsL=ODPjIiaXhZ5_L?1P(8_D(f<>G=hqczNBeHW0q-H7TSrs{V zUaM&aS9%&K3AP4^Z4fWP_uvy-Mr`3R+i{>Vp=4bV-=nncuYUI|) zcM79UcWmWDg=5IrAag#@+j-g5F%&?6sp6;r zLQ`x3VSjjD{6@X5!_dxhQeh&oR2hVuKmyOm;MUE zI}V)R(Hr08_iAi=4%fim?agIXATjFl-L;R9&Ov{Sc6Eo}MM(k*!llb+tiSyXrzzaVi ztf*xC?Tg~^8qzU|j;yl%xpBDPuYah!vq)wGWN96^67)@)L*$xr?)y`m9W zz;G%OiQ&SO`7S+gQz{fs9hR&XVQXe;svM6ER{!33L_dk-XWE(Jo9{Q$(T3aq0xK?- z0GH0GJ&jkNR#Ys?hv|0gW3wRT=HFr-!07^~6v^lxOEzhrHRu0%mg30hu_cvn^y!d* zdb;h6>p;k3m&&kC^&q%K3@7P+a$71mK=vn!CL;mz(BXr@nKzgA zh%e7aG{oj}=}uFLm{9UFy~`}53DNc#(qxXckWW5DDfE{&;Y6F})3?Xo@pQ~a;vguN6e zWk`p@a3CzWYIQc9@E#+qab5RWrj`ljlB_MyJYx^|Wq3kboVL3Ss z$j3aIm~!yexCqVeYt^#dFY^8yJBI8%A^w;O7LwDEeA72KtEgLdjjMjcZZjGaNlfVK zSnAU7r^;6fyKlZpE-oR$uk?)2;<;n8nLkQS2+`}D7oPnyGYT>#TsPRh>!x+Eud(d~ zKlZK659$3}ff9Cp@%#Q=RP)Z*?0VnM`NUa1 zyz14wjd~PHLEh(SZt1d9b5pirvwMC~Hxx>h6>2VUcY-kll`T`k3j6Qxx&&`Z*y-Ad zGKcrXn2`GNsW9e^_2!RfBSoq|h-w*DRiyFtMv?CcEYGgZ{E9t@XdoljIx8Gdr13$Z z2eOs2Fi3KZVS+bitC>Jyeu1dbx$oUokJYC3r=R6Iry*bVK&VqC{!8V{fMLI$qYv+K zS3(mEzqRagWBI+#hQH+P(U@_KnXPMD^I&U;o@cg81c&OoS9d>sd%m$B=jt`%@Cfwx z;0>x(m?_&CJu-v*QERkZQ78fy!ESr;?!-~e%Epg?5c0ehVM6?|smRU>e{9MfpZ8d8 zucGHE%pXWG*kvVXI=Yw#d83#HkQsIyO>Je=@D}{8Zy!!3kN+`TJBz8k;9bQ6MS^ze z`fk6oZ4~ZCKs%P7m9#&55Bc`@yhygSl*;q5-al|(m$GmSy=H-f;OVVa-2L5b#ESM) z&3`R4thQe*elFB@$uS%Kz4a9nE-AA0?5D&<-MZf$wI*ji_XMx9XEb=3efyfERNvU{XST}kW%%uHh_UdI+0awz}7NmLdRcC!?dt}!sXZ`M}0rJ*{d@w6Bt4&N*O-5<(1#*`zOPi5YlH6Th(&! z;lR}_aOwqOE-%-k%bchJfSh+y(8@HaxsW*PO_)k@Pm>^$-_f*nmY+HoGPmeB>Sm;% z9nX&}#UZYI^Xsa)`~=7SXH!6+RRGqRb=TMgE(*db3YMk}M3hb-hh~C^=iZVh0)*=X# z=5}BgVRmt>II+yP*Mdqw3FH?Lyjclnn15Q}Y`2o1zHll=k{as~H0;j*%l_RnT)Ogb z4m8oSvKR_Yue_iAcD`UrkzOf^HHx`kB|zX@p8ga(sluSn zMk9hK-lNdk01(H`jEJZsRr*G^_vq!vpyg43$?>I2Hp0|F`$eYkzj}bNk|zmity7X ze5RjsO^VdWDFRs7F*~!Q%u9O(NUh@NlbfcR);d@#Z~)R3rSTIY_^k!KFGcDHiCKl| zoGlxgCApF^m`$2Ej#1_^D@DQpeiLGKS^$5}J?U9F!6!}Ai%{XCZZUE*%uo-SwBf8# z?9)Na>67z@Z)k%uCZVi_z7x(e{1cGEjij+w zkQ`K&a7DEGliaIMjFyWh&Dihp#W_{Y!0+Ey(?Ll2k?UqmZcK#Q84PM`pt15u->|;q z6mJMFj4(OYWrCy&D%V*>EOXwWh*-lT-+U*Opxi^Z3TZo`1EJ0Yv8gPgDvl^&*C9T6(^V`wYgkf ze*l+*47ZuMMG7sJN5!U$M!!?=sPed`qe_)DEO19ocl^4|2ZpF}~}*BI-_| zX9So4Ymn9~%bS?R4V?cFEzgcI6rseH4$D#TtZ9>iiug+QgZz9O0CvZI5m72!8ys0W!O4AZc5b z;!$&oZv(aE;M#j*a^2)~Xg?`LiS-g@%8u4}DNs864_Pi6sKDWesM~U)DIjW|{i9}4 z^2@}o_^Qr{UwNQ}-NZBjo=d5_KTOOiT)l{{NDBNo771-jZj71prU^g1uL-;0Xb$gp zU&$!5a5-p93gmbU**&Cnc6IV`Il6i%&1!w0pw;&tKZt>*&pvsIP_SW`i!LX{?ABA8 zW}?fBt1T<72bql7n$5*Ya-=F(K}J7ysRfS%h+6I z`^#z$@gOpasFWx``{iVajt~A4Tw^Xb8|}b$Ew~>^C~gb6EWUG(cWzu02yL<3E2%`g zW9zBDkP?^wSQ1{Yu>gt9vL2jiP^rWccjw`eY58OzJkPq5adOA8YHf=<%Rniz+hHiO z8p?2U1w%PkYE<%H$V#TC6F=_tnt-sBJ6hLYz>^jm;4SPQNGZ{0CvZKxqv7Z$XY`48 zOqJK5e2B|glgo87Ew=jkB_X#aWQV9{)zCpa9gjf=hB$FKXsLHCG8^$*xcp;AXg2zQ z@v%g8szaNMSUU2v3hKDd^UQQS*Q2qK0Av$NaP!y{=2RUWyRN~V#H8cE>J;_>)5^M9a-2UUPZ_@^_n&@-Q z=|T)y#A-4mr(@D6gzcu!I^CxF9Mh|HaW0500qJ`yXRk}b z(a}3s{I#=0g;J!96m_EddZk-+2l9!76_?*Ul8i#yhlM3W9Wd>6QAL+n#gNnB5)q4{ zp=~+TJ}W6v0%=xW~H;)OMSonrMO2Rwi!oRbyxSo)CI`~AjM8M zt)$S`zI&yNhn$>uJT_me*G%6G8cvRLDpfmwT*j$7>2Ur(77FNZhYC7Zc!&Q;xwSZ^ zU?*m(bxXz*_i5qbm)Af3A-{d?3l|7^tvz{ZN2LJj*w_=VcWi94x-U+z5aA+`tHf=o z-=SxxA=k>+lBfXT^e{dC%{x23sWLl|Yly^L^&o_7xX?zlm0fgi^a8Bsjhe!m4L&ZW zST0%!4fK-OSLjDfxR!qgp%^^*GhWwxj2_ zIYy?1$8Zf?emk48`D0C{RlRaMsGLUVyv(clf_l}Av6cV5EkixzQm zWT2}-m6~i_nB)%Q8QxStfNurAvdiV)4Zh;_DyJou_&P|dAS-cUkmnRE;qr^;=W9IF ziW^U1mo0+6y-&X8xE|#$wYdwvmy&MD3?DpJDUS{dL{fudYIXsrxa?of%*XW&szN`- zc+YYb*9~lg}rXP=_E@%@>m<`|XmctLot>Vh5)>>`VBD zBZ>zlRK#s?z4_1AF5bFXO*j<1t2Di$cm|5BiM^7^UsKId(_gXNxi;Vc_8+T>DxAAB zw#zfm15;#ZopYmWw7hyZ?WHB@KQAV^l;#6*xQH*tTnpxD>V)o(U-m-y@l5y5g%h_j z$eGlAQ={dcTT6`DYl>9e_aFh$p;*_b@2(O-{V6lQ99`pn(330gAy&+0%Fru0*+Q3f zWo_AE{1~LZ5%OExNE~aFksmi-ofg~6oY%`u^H*=es$tFjc{^L}DIzN7w4e$MT$oWNXd?!-fv+VxXy+79*MuGyGYPgGk<>t+NI!dg2 za7ms62GO!Y%da-s)g- zJsr#+sIULR8zoh4Rq(4%>}(-uwr=Flvy5@%^3!>g)AVri21GXnX4`*uDW$l!72%j% zi`*jF!zESuvH+AV*IPQM1yCPG9w#PU#$1I*; z@xLeq>K@=LMH%t$(Q_+T5;1Ha8p~s?X^NUF-xae@n2caT;*wH1O&ABmRP39=Y!0ZH zt_5ESb7cSAdfm2N2RZRLv#Mv1sP1D5`XWZBRDbt~2Z5%;QQwXd^t3!fb>Caax$SI0?o$u*hZ#*9hv0zT{ zUy4)ly<4CIk>d0LZnT20Wl%*(RO*RZ^eQTNTKtZg+%wNdZq^(x?@S1az7=uB3)*{C zBOC)Fcjz?5Ef)a+e${d}eZv~mq`rdfY|8DaD}+Rx80R+nb8&e_JG4`c=XXN5#M|tT zUSZ$59j?~nrqfNJ5Nczr)(X0$R0$RLrXP0O@bskQRUmIyhbQ$fVD$=$R(``$4%K;k z>uKQJ_h+@SJ^EPltv}PR(=L8Ha(X?pH4x4(wE4$jEz=wwTg;h|E8+9JrS&|Ut)sS4 zs229vaNz6NEpa!$xvN$>%iV%?Gn@O*?p^D#TAPvVTfcje))<8YzcQFc(y!Ww!xrG( z!x5$yooUz&2qb#fQKa}xNB4ybsNH3QyXLvOE+Z#lf!~gapP1^)Gcqz^`c6g}r<$7Q z251Q@z0JU$-Mbgbn~#I1X8{Nv?i8L$u1eMZ{0h~i^DkRQo?g9(vvcN9Moz2u9{;e3=B=i-Bz=p$2NWnMs^WS9%t3U z{%Q@o_vj=JY;8Ece!h9&_|AZGQD}i%2lq14oz&!3tHcYF7D}dqBfV;~9zQ7T#lO94 zaa|ghU;*#2a7DIg6o3&!0@RHM-x>#$eed&Eo-Rg@_Op5)s=b07#!n^ZT&!_sraG$@ zH#nyT6-Dp#TBM>A|0*6ygR=+Tys;Igb!o@J4AxD)149?ES%*I@|CSLG#~L zTZy?K)fO%(aLK3&=mrvBRwp9`7iLdvPb&ATkO+r53nk-=HqOHJ=Yf- z&`J!pbh1_5ePs)(no;lYWkucH0DNODw!8x%m}M}`2k4)UL&5h5g=;9QbNtdQZ^D-F zFSoTMn5csMk@Rv=HDZyc1x|7;2tUAz`wKP~f}0YHOivqCo&|4^EPn|I#??a=mJ%Nx z)^p=8VsPVUFk!w$Bc_qYQk;b(vpMym{A5p3-{oEO^_BZ8MAR73=Z`+=rYK#LdJ62Z z4Xucu(Yp{JSKuuw%hh#QwW*(@!pW8#mm*P?EpQbDt}47^KL%DBJm+34GjEcm*sO17 z(#!_?m{c~nQIRl+vXWq0hgiNNJo|+Wca738v`j(%0kB9>68md}%m~~KnKDxLRn7xq z3w3XX3MN0bir{3+)XZWoQd$=Srjhi_cHqg zvYY=bnn{sHJsW*`JOx#v=8$~tR0DX4wd8ymF2Yz-1~UCC)3H$If?Q(nmpgfGqM-Xn zmDb|Q1?Q4?|6{?rRS?*A-M*B0_yiRZyz#gr`TMzE06PQRPo`zdvA_Z@EKL;y`p6YW zjfhEEf0Ltb_Ktz$NexJf9>{lMwVuZVyapQy|rj6Cx#kQv0j9t$(`4?oPIOe*Gt~V`3uM&P zXQScG%dI8?vaPn(vsCUtx#mlbtiOo4gBH~?O=?}cW~M^2Ip5;Zk>$P861sI-ypI*I zLN!CyAkf6^6SE_MSTdsOT@A|GNvO8GdVAvwt{St^!6Srs@t)_v*}uj-dRN0}zS{3+ zFp}IU)Z5t-o?dZg8ZxMFuP5s9dBl~CXLZl68kcJ-WRa7hunY5r8JLzCbdR-GGv>Oe zyZr6|jTX5UjW0-U(t5qrXz6^-nh*c32SNP1@&;slYF4XF;nYC1;&7>i${s4vD=5zF zeeiU*EtF@>S7?G7l+mD8!;BwyX$@pfOiy%A2POLu;#|6UrlsaOizD7jF8JxGSpM6? zKzAq*(yO-S3e7q#fHnm-V%>$jj_=e20+VK8Z$)!CjzDo`+icLWNI|NBilGEFmhjqn z4gxh3Cb}?0mkP?-9)g8NyBUKHkK<*1+IA?1#&3O^XO`Z5@sDnHBajS*G04mBc8U;k zjLeq7#iC0ZpaN3WC(;&jx=qjKW;8ojr8PZWrwg(hPRrBz)Zu1Q1)VwvuS6&_0+x-J z5$ZytuQIJ&oi=K$k39e&9kA&>0&VIa(fj_VitJOsRq%_HAmOv&Q7dFj+hiVgDWe`0 zVadrmZ0mdSK!M||)a=A`9`*7yh=U}AxAQjijuZM(K3-QL%F+Br(V)1iW3gD_up>=t zY4Napv`X~mb%c`-gIE2zwVXF#+conh>@BWlX&F?pAxR6rOMj1@U2!<0xNDbDa!9>R zr>FOgF$3{mFg`v5*JeyK978G59gN*E)m?+r4?f~W5QPgT16|pem8h%%2Sqr(mIU_@ z#ffpn7f=RG08$$bc17)*d{s&fp{DFRNu-uH`Dw((O?|i4_m>SrS^yA}mk)oT!k?0Fyd zbF(o}5ZxD}reIDyUoH|@ zJlE~=ZjOXpSQ;8g&lVc0qn{+U0Ndu5qVhX=PK^zZEhB z-SThaeb;iG+b8FXGF1c*3p4ziFjA@kVu}UpEo3ggyKL`jM@*NNcXa=RUY-!mJ@@=b z`37zes^Z}tBpDvWs}#EqUkt3njrLrLobfV>^|-Hq0O^pyN{ttvx8ueqYI3wKZj!ERxZSTiJf!>)DD=gQHaq z{DaYB6Ka-@x3qHE`;#^&8WvLK;VXQigptBDS4PH;h8V*X*l!=ws$>^-r|G8}c}MCJ zbsBl=qa1o5)=(fGIom1$_K+XE6{M6b{J-FtU8Z34PkfpuxP{pCf!BN+3FE81JJHO?Z4(3Ad zCL->vKSKrTk=d%= zU)iEDXIBxzW;GJ`n&%k4{qThTLPiQ$;Q=`>i!6WcV5`sq)mZDvt@v!HG#1#D4IGIE zMpq`Ikh8h_Aj|C&Gt7Llyg6zYB`u$nfZb zQpg^v=-^}e%dVUO*kH=y{R0nU8a1kH%M1~Qo^CO*xbLP3cQKDBf8s2nz(+%_ubAlXk*}QSk}T%ie*-i0Ys$`s^JByr1Nf>QuLb2WtaE;< zIaD7H8#l{<&qadP+^4t^FLN3^{0;8FHZ6TR-p;u>Ei=Dm{)r;DTY?UbQjtRY#TNnF zBx`LsY-pU4m$)VqD4XkEE%WGgIclD*l8w2&q8iv<12NQ9sjE?c<47edK^rjQ)@8aS zfuAt@I-ChZ-y?;#=kiMca*7@q*4&?AyrrK+GW;r^qDJl)7d^UnRZbwvP7f;tkS(k}N zcSgFv%BuUBdNE$RDJZ@!&PlSDb{1$&x;fxCcv(WqP&s*tALwb_x!A2j8^Wu>H$y1n z<)ERum;zcu@OhUAPx@(mC{Hc9{tDZ2@016f;F$J}y5$+zZ*tZKuT=T7AqKx3xkCd- zBe2wjsbA#8g=aht)^d9}|JF-2Je$v_6Y(&Yc7Jclu_noD=WC@J&Gyx8!|>-kup0$W zYqTP+eVy%TTHob9*IW<4^LmVJw(@X{zU+((F8HhGrUSGKcb{dBxtd>RX|As-ndv&v zM6Az8b%f4MV%)+n?3-wb1uYZo66GS+XHLrk`N`u~f$-p7zPFFR=FtOxo8mf}n$`i+ zU}Zba_+p|H%|B+2@bf^<1h;s)S2kHZrIz@P#I)Qp$!II(_zB((`3}KJx zB#A(v=k!yzGAb3wdci47-26i5`=Vduhv7=^L$Z&bFzs)u4-sZN$BiG~XNZ5>&gaz> zVqr?cr}Q1_GVNYVZD|{feK6#MEYfHSey9+TUC>6mjrsW$FNySbf$f?5XY4G|yYU0d zP8VTx**h`lY(WOq&f!SHG#uj?{Ljb?+VeQm@^jV-O7!?a4Ph^^*%O`yYswZ>AdBIa}Jv#kAP_R8+mhpUe@tW%fm{|Qb1`D647XwsAMDGlWO z)=CTjaDRUJ=wiLy;O6hkYR^CXm0Es=nlNn7pVQ)-apBYBTW5;g5LK<_XNPl+IRBLe zerRQ{q2iw-G@`IxhI2i9=hNtACMZ>u*Tav$7A|Tr$XkEZsK1zqr=4@l>X^&c^1rA9?b1&HP(^|C+wY^shjb+bV9RV@KkDAL%t7 zp70p=y0t5Bo|aJAb%mTCcL@OMENqoHx|Gx_T?miesMf_>Xr}5)hm39-4_>mn@s~bXIBu($^MM7?r(Yq* zx1=bxKXBSvM>+s}JwaB;xM+=j#cf|dRi|`C$^WyZEvX=T?zbu%IGI%&8EF|HT-t1G zEUUU|FVI4I+vd3OkatVfZc(*TYlMx~2Y5e*W;AJ`b`Mhs_HMF}ndf%By*v_$}rvyu3ft?S7J zASu24#t&tgMGK#)0w>UxtmZ_k49V|_`fX>B>R!-h066|#I*JkSBC}bF#F6D>!Se&? zVU(#{pGX;r1_A`BU!czOPzuRx>WQt!F5%LJDOunvu%DHPZ7o7&NeBGu?Sa`AJW*@2 zNIFd{Blo2>vq)0tbyf4Z&@G0V*kWnwJ(1V4878E?M^)0?_|f>Zpg`HNN3+x8K%KF;F_ z;QHQNx9ijk;cSuHMr4{}lLqh{iz~^eM&K19a^t>Cu2r3_T=74aB&i^=R_{aQ-CvGL z0x~3fmGTaj3C;0XaNArvou?1rk_aW(B38vB1s7{NLqD|Gy!`>XS+Cj2>2mY0VqzCj zC)9Fffs~+_Cdds7>Scb9Ql!3Y3y{QbhamK=ly><)sHCFvvJ!dc%;Z7XDdUn*OS?mA z$DJIIMyC;{ZZa-keO%DY=;JxuYa*>AtT6L55Md&0-^x>;0rb7c0fQ3RR*R#EwZdEEkR{=LuBKx+HEV91^ValBg4$ouR56gUm zOGm=^vxST~gwo|Tg_*hkG-cvXI>#^j`^aoT>M3UPYWNHB%u^ge&V0h|TeA0vnV!*H z>bhTLp&`-n!-c;i-4IR9DzF8`m|I26LL?&`P5aDe6i0k7(F8Ktfu>%9VPei!+7GK1 z(gDl`1M^IsO+9`69hru;)RyK16XX@;>t%_adMa5tp3XjLR{$E!#loD9otV7DjlXd4 zdA53@`tNGeJ6C*^XMkA-QOhF<}HE7O1nH%9x5CC zWcvd^RL!u8u`o9N{x8xO#E`RMOTmsr;f5kh;qS3PXls1uXc(z`Y^-_b!%>>hqIk6j zfQ1xCa((hT@HVmf;s8+eu*&}jj&fG$C9~$pcJAQ+mLXTnz6MB4WeD!N*OGsM8kB6k zAUj)7QnhR(+*nBUE@YT^<`)hLJ<*7*YjK>Q07@(6@`qm3SM#)zFr}=3B4u~8F8f_g zR=Mk@%Qf~;A8n4I8t(uai{H-knj30sIBSXYNR;TSH!Se%!&j@m#S8buR%rIrxjbpqEkyYRVy9B9^UJFt~#gv!dWH{3LCj`LT~|a zp>`ddAbR(dX1ua(oun}}CPt@#_I0wE1^7ri|Egk%UTABkeaps9CRyn78G6h^;8N~+ z&`{_;v*pj7zznb4ya}``!?KUFqxYOgd7NWLP}?v0pI8Knz@}x>I(>m!;)%?y-m3YQ zdt8l#-vxY3EwA#4i9tUyb(Mk6Stq#61N~nw0U`piTU>5+?}PbY+t@fb*vhuz{kmDE z3f|2Q0;{gT9vPx%uD=m7KJn|Z**|R@6!nuQm7wqUybPk*hJUUz4tia2912@M%b7SG z;|`O3r28KW_&93q!}Hwy>hb5ek(FxPS;C>XDisI!dtTn7dUrUQ;c@Y+3O5&4Lq^7H zLQC9?y1HvTs`O2MIf#N5+FCt0e)f3Ppj*G^tWM@iMKxmvQ}!WO&7*2A>>ZO!Y9Li6 z3CJItwe7mvjEV_d`N*u#YLIFFXr~YH1d99Jr2}?;bYRa(|s38{t;6nzk%M~Uii`|b~ z=->V|!~yn@2}6Dgb7X7@?^Lexx9W;PjT$`hYjp}s9wxJN2&UvpnnkZF)tGvc#qT(M z=u3}aN@Pe^v{V%FgHQuxw7SH>K~x;bv{JUEYxWlx5BI5BvRhCo_JylhwG8$a0A|xt zq$(Luin4wOfoN9BCal!XIG`LIB4mI+Rm8(nlxjW2T1=z+O`25z2ei7e@u$X+WGBXC zy!4#IRn>=0pm!DDKITG4xLUfHsZ3ikCX?=1(K3nq(cr$2?nH&j3(x#9sMa!j%Q`vC z#8s3^Q-uo#gUthCvk{nh$^zn(BzR1T2kxGSdh4NN8}pIU3Y)Lll-;#5wcUGT$>vX- zK>MgGA~qVtcKg{1XsrVjp!v9__LaGnnq5eJA&de9LNdtZca~E;08bu`*LE$d^BtK?7;?sJK z19vuN%JnRo#`;>-qUpQ^~DEjaI# z(7Tftb>XMT=ue&IAB7G;ku&xF69M-nv1S^(E<2hCl@W&A;*W->%J!N+v7yK)^KU(s zEu*1o8b2}-%>32=7e6zlZ?i|n7?4?wnTA;(hLF8!o3u}rtowUV!?y);SBuHB-Dohn zV3HT|MQAC+8gHp%fPB5}3W8AFTAKFUT({SkymTt&l)&yq2|(taYt5y7bb~=o#<>Bh z41?NickOoOga>}xkNfP;V`<`Xy_w5oi&DS-CPy1F# zH6S9L7_jqkaaT-d8=e`ma@liccW+QJ7B)YeL6}?LiZ*w>c#;I_`niwou<$Q`?NNXH z^kW)%nX)>yo1ciyew7)blQVq9=~@Mf{aJZ+S_15J5B&8`o7CeMsfWv`xR-nJ{zlS_S6Q<4Z}=9O%4qYeTpo8OZ^UlGOC zima$X*_yn9)~rs;(le)l&hF2`h*K3gTDBl%{O!)W>OZcP0)AqCe@cw%4n)cDojI!4 z>3!T;B8i|S?jE+;UIvmlV3; zCBoc~!6UPznr;N@MmWH0B+jkXKH4hJR5VAeE0{sOTSI9R$ZX1K?EM>(dTrz8y?bhJ z{u&mvt^L;ikEOBi*Ui3rLZ2neLu(Q5@-Om*EP3JFRNm>Rr5@X$LoE1XdMGCPapb&X z{64j@@Fsi``j8=q_9|Tc6_`6RR&wur?a0T7$jI>B`Q!VVN3MB^P^@sL+Q)n85>{M& zU64+-=dqS6bIgTSX}!TG$!#x@<0)#Zf|9uC3gK_sbV!&~(AwjfwZDj|d*Y#n?Ju`A zUP2pOl~VuM-&>cO`)zqwd^oqLA6Rf!Ro%Ylb255=%bu8%l%)=@ zWlag%d^dV^DhIy|zt}0z0z(_VVa?ny;q1Gl2*!EHfUIl$5|e-9)nmZfP={o1LGCy5 zBBq3rXJZIOKH#nkJ!}3bd)v~H6D=xe>p^g2OI7dBvBkXzLzr@<*m@^7I7wE*L)U1Y zDS$1l;ES%QpL1|8wZ&>kaXGMvaXD&P@+OO=F+m>PQjf%A?S)?csKUl0Hrz#IGw17u z3@q;+zTa9bY9cFA00Y7Iq3Ifyhmjei!QLK=5=aD^^4(58$=$C;PuobEWS&&{K}^c$ zk;j%QYwoh5Z0dzv1fLBzk#tP5u=LPV(!C6^wFXUGO16Veh_2mNG}E^qQWj#fX37Uf zO>EcjlSV#pe%TAQ+ME@){jrxS4NOc5bYkebKJFxVI^e3UZK>{3l|gW4v~&UouVWb% z;#2$qf+i|Am`!frL~lYrVZ!>L+y42VjW3>WvUV~85QLpaz(Q^Q(~0e~I3xcNwq=Rb zY1l^~&3wEbVS;XD?YITv*WfoTe5p7fQFUPw6bahIx@F`)nNDl9Yyc$w3Xg1rPSpQMQAEXKr{;QP3x`E(PH)`x^g$)y* zmfRgy>^&o=NtwM3x_Pnba+*GA^!HR!zek@SFN)~RI_h{>rhID8sGqob%v4q(!`_P_1!P!cPYXE;La3YN!Viq zIt*px`$Pz9Ad6gs!~e|aXbyroc;3j%=KQD``z`+;3lfV~T>PsP#xq|fp(Y48RS{7s zBiJoZyClQdo7M5VK@eq2Cvc3PyDI`Zey1aoS~SAuF#>xx+bgx{+)H)_-6%Cgl$&`l z@q0jO0JH3Eae6ZKM4IC`0SC!3m7|7nZkLFB0JN&QERiyp*=dgQ#F0TCG%_lHwsE#N z%YfF$O@Ss7-Eaiw#`jya^Wf`2?Q->n*NcYl*z&aK@jLc&g!2>GQ5}<@m%`phW$DYL zrfo~v3wl6q-O+P_tlO4M2>-qM#fqqk+W;8rS3&p&ZaIU8@dXZt*-fWIZPh32&Dz}SmBu%vDi@fI z@(FbdVUBD<&{8_A%cttHp3305vFlPH{%GUjsaG0EMb191R#g<#GK?tapE*KsPE`^O zjufrQ-8h2@`YsrkC{Z)a7S<_NC7tVuJH?A=N&$=Z5zqsdChjI+%sx8RO=Es0&1 zOt4qcM%}opL>9!5BmLgnf86R8VqIGwTsEc)PkDwi8fR{`f@X;;WG0rI)1!Nbs17qy-J!0PL<6Z%VPj9ujkWp zu*RzyAC{FlEp3z^2Ic-EO=Gb~9>!to9i%O-)Vgk%vrqaZq{(Yw>~^JJ;oYy*j9Mq`fi@&?5CWB+?hv4$ayh(AA*YK_7`5^&M(XBewS5HEH@cMA|jBuvpa0KO_H~ zg`d^ee65Cz-NMU)8)F9HGGlve$tRHY4=pnybE;`-EQcosW|`qN4t#Al%LQk2TW{1i z2GXo(!Wp?TGBWsjNfR+VSwSL|^xG^eLMu`c)}fO5-d(pKl8aBf%%JBG-**K?LYCWB zVwOK^#ZT+QlK1CA>Yw^&8r{a(TZ@2(GR0rbx4pW<_--AuEkAo^?CDoi+E-JhXBNyt zT6H{m_4grTCp4m%37(Mg@#n3 zua3{&|MoOHFnD#M$5skqKV-jjS(Bkazha!@B{bad@Rpf9d*u;@BNM4MdP}kWIx5oh^k_cmG}4d5I=XuADvKg-pW-0gcilC8%1E39UXQJUvN)XR;{`To2Qm-+|S9cEvCVo2oSw{d@?bhq~j zV2<&)euTY_Po@C_1&f_y_!&RsV_bc`M|x()eKuB zNAEIPSTmq4N7W1mpcP%OL#`!Bbi&x$6u~o=sQ5CH9Qy<&*UThM z_cg|#scL?NXrO`LLi2f#@H9E$s+Gx3D+XW(SgILNkqg*^N~oPr9cj_Kb|lW;I+G=g%CjQ$nWpQyOL#tVtk_81}@3$ z)g{>W{2v+Ai4&b(5>z1$B1pGN)Aw(D$?&j;2S#sd?)Z}?$N92Wj#62HW>twFR5Vm#PLbUlYVwT3CNt8YQgjfB`?lbf_B7rUK$iyW z!G6!5AC8%Id_9MVuTRN}K>b)Zv>Z4TvKvFr5?bZSpGYbvy7@*}J)ceD_WNF1!V*T! z^ns_{mXClJbR{zsvdPpv)gf*27>qliTKi1xf&Sh!Q;O;*<+&IMAU%;@OHWE zL>V9e^vydMQ!Eh+0~dcxp;^$FUgm$5Gdd+%+xHc@1Ejt?n+KYm1>1(;30xfP8$tgf z&4Rn^2Z9rtUNvStE*mhb@I(**%MzK8cwG?#UK`PKbN0sOAlkkT>$#4X6EH{PM`#J7 za#8F0Of3T&f|$ueQT$(Zt3FK96ptK)JPm6xD7r+j#GUF|Zobp^dXSr2MmOMV((8M+ z=b4ZKxg8H}bj-(5-5;jQ$lG>7S5GbmVMEG0E)t(fJYlo%v~>14TsxOQ&cOgUUiC$x z!$Q#Ubq#q6k*$^v^@fm+nvbH0?+DcgW{-S zAqYI{dlCY+LAM5LvTHiMxhuuwzp`V0-41OrY?J)ZtomNNlZX}iFXK<@uF~dduB9!! zdc}efPKjZ@knhv~k%Z<4JO`O6c}7tt)Ut~LCOH?n#1s5U3>6dj(R~u=26Q2F=49|@ zSSH7|Q^Lt0cbeARN1^G+fGA@_?h*RPJe9K;-n|nU{c3h;sFPzvMSj}8F}C|8%_ptJ zH^Xf6=q`t%_NqEl(#=K}WEhoiy!}Yj$3Z-G-_q-rMyIeVgi=z?``J7Dj-)|sGLH?i zs#3c`b>x0+&bv2|+bM1YRlqgQu`1t68QI7@jf7pR7eEKiO6SaWdu)t*E9!-!b^hwq zsBYJI?^NrfS95&omTpJ49ii~0uqW@Wo?YrpXDWA_z53}`*vEd{zshWZi#^$;o)h;v{B3y*hpdD9&b46mb zMP3Dv&2+=x-wCzzbo}Q`oNHayxwtEfb7yn0BzQF7=0(`f#T$gWS@zTAF8dr!X)thM z9H8oG)8qM`+xcmEj^Q{!lRxLkDWWv*PfSX=MrlvO(}!IOWXAYInc*Vm<%opX5?~58 zdE2ynYTnvL#oWw}jmDRirHwr5nhO)nsg~9u9g@HQ$DN&8U)h%a+{zoe`zROu?@f-( zds0P9$cd>110qut=-f=p zAHL`pzT-mNr~?9XQik|Oku6Mepi}e2R&G6e^4w=nW#0vaNjd}qi2%n1zUZ7@K(Kk{ zfQx8PQ-E{W-rlXUDD4IDs$E_mvpV2$PR%AnefMNWh-4?tq<;QDM7Q1hxQn3LpXbaZ z`P;xsCD}g2#p3LV?c}yA7xRIO^w~FUCN;_=c-HAFs-VSsNsPd3cf;PzU5ZVO1bG$^ zKL^{;i<%=fm4Tw;t8n5CY^Rh5`ZMAzBY#i_^UvoHrB1yXR~+rKev{gJE@ zx?oc?d5Cc-Qv2hyaXs(@SdP=dgM6#;I{}S1u-!()&54VFGi*n_lFrX|f}(JsU;*8zcS9bA0g0bP<*YSR=KdrM5db+Ir636) ztz9hxYPs|F$_SN&qiD{UmEcV`T-iNL;Yg^ivU{wSV+IpfRjyv}=ra+5n$+Mo32HO% z%C8vYHWUc9)wC_O(KUtzb_3KdGCd|_<3K{pF@I5Xw{9e{CS^eJ>p|l=yd9SJc@a3h z_-wZE`vd0WMR_v2Eqm{(Vz)BA5$KT_+ zZH$xCW}m>%j>y^OdJMZ4OVE>RyY9sAs)Xhv?XrBrcZHlc5(XLoaXTS4|0+N7rqDj6 zypoj$o~h5A84MDN4HbPIE-FZRfCa0$S1ng8|I-|KGrC@}-5`Sm{mUB9j*OmdN)eM! z(HwCc`)NwmvWd2VfaSFb(qoUwf;|&c&az2>9Z~95+{5Fa+8+a~=qR1WtP8gdrL5>i zg-N+74Uq5lPYFry$C7WMo?+)l9 zBf2XJJE}7A4Q!_|100SM5(e^lt+H4SG?Fr}>XD8|2ps@;T%4ZxDfSh0EcX76DLos0 zOhVNE=cqWP@HSknUrmx3ib1V=fhqooaus6v*DRkO3p&-1a(Gf26w8ErXXz#$s4xzf zp%Ejp!>sg1p0|(#-#VmqoKYKbCnc}>(ZBnkq^o}5-J)IHB5#AnjO#GOPs```wDp%O znMpTnAHuxt@qT(mRg`~w<_y*-D_Qf9#qSI|xp06L?*YX+1asEwlz}^T3Hw!KtP=61FUI2iGlA~9MDuHwFGfr}L*v&LzAJLNd?JUh+gc`X^3 zWOX=n5gCk)dYRv9&1^uxU#+(}IE#BWXyWv4$V! zCaI0~{Oxh=qAGN0OM3|4L6w}*0bmBTzFX=f?%A9!D`gSvv+nu&bmuQ!4+ z)a0zBM0Dhta@!Jn6Mj5F*Lic|qe4prxu*rZ!e<1(#I~Wpxkzv)OL5C~>S!uC`zn4- zR(wD)xg~Ssx&+JXmwM0on>?ZYmmei{Tjd`nXTQ+*l&Td#mtj-{c`ZNs*KbPe0JIAS zLb=GS&Tfuu!pfIz_GSN;(}A*$&T$h3{29uOH`=sC0HiM%(?;`*mDb4N?r>uR~>!V z5NV6>ZwLHGu@Hofunr_vc6mWdn>u#OH*hvC7@9;Q;{%HYWRabB$!)BN6R@s}gt}?` zXlpUnOnwJcS~6c{;D*Wd37H)Ij{;q&#%d*yCbwtv`N!y?uM z$Il^tR-Vu|MwMdZ@(mhi9gi)%6M>9$40$PEUHN~;Sx|k8KIx}nt5=ElQVccJx{_G@ zb$tL`S*iJ^^pSTlXPv%*>-c(>y~QG!Dgb4vZk9G%8v7!MJJ~TQh^I0rzVP|p=-de5 z5N8NC0N#yE~`xTvyipIQuuyX{}d)6Lx%!+#vst;;9@q>wCu(Yj)5krg%Kn&uh;dQfhw#ew!z|vU5?wd)r0LzrX=S zluYQZAaIt+YHY<|4YYCuzL-CM$CqNGwD)x&`0SL}wq;ZzpCmE2USj3Eov{XOZVNWc zIphkeQ8BdGjk`w)Bry&?9rZc54N+Ipq@BU2-N>|80B_VT7XpIK26?jykh$AAygF=-k$Re$aOKAC+M?NgM$e0uut?!#|q z2djY>9aLt>*tJCQ=#MS_13|9{i=-(OAnV}5eD7pE+wK1MUBw60JfbNEB5w=+qwtc6 zH$_|4+f2`#KMl*kT{U3vWl=j>U_5m^19`me+#wYh)iH1+o&1ACKjH4yvatmC7+AeHYQ;qxX9|u;v1cx^j)Z6HG*xIS`Azv`oZ%J*;^{sH`Bgs{*(B< z-|PeT&z-+8vOYwrUa_)j)C%vM1jj^GHIll+q4R-1#ZpV zIb1(tXK{|rgWV~`INOhZdGH|Gfqby-@b=*Ql#YJ6DC^fTZ~8}+SQ{L-!uwbfg5LD4 zH)$pa+&#$a%T8YlZ=<1tC{%CQTNzSY;PwyHpyac2~=CwT_w!x@Hgr|EVb^kg{q`~JE$jyO)(i8jc zBh{t;u_}uPy1F!Z>;tterQ7;m{;%H>FdwZ*)?Juf>t?#~XPx6lRuV2jzrmId$V+nV z1bZQUL%3R3CvX5wXkZ-fHwu?pm&a&W(dNuN8f}vlu9$GOuc-+Q<)-a!V()v9i+2W! zLe{#{krSPK<(>74P(A!JhXMnI&WhJt{fjBLaZZ5J%oYSHMsXu)Ik&>x3#KQuj#=Sy zoG~cul~rSD7PgRA9VV5=(J$Y|=f% z9aAg5YiQHtvLvauGM9$v*8fWep~eoiPcuWn(z3g(b(Y8LcybN=5!>Hq*8o{Nh&jdG zki2b^6B=o~EHPKugFyA82INd~v=`Z)kahyLqVXE)jAWQlDi&9C{Z{Xj9}JDBECNMO z{_qaV-w~}EJrqE0=1@8Gn;MukgxeLz!ylLO&-K+#p3<3CL32%Zc=IjlD*dN2>c8hz zv6{ZC+d}}PgxJ%F%JHRvKtrSFd8PkR^beWYK)b9*1#ZveB#4N>`<6YtVY;;wJe@1s z`ny~DRwR_yo+ZZ+HtYA#9V^TA@56~?WuTTYZCMx4f|wE^7O&j@5tP&Jbe?P!pGaW4 zD6`U|TOoVGKi&M}v0SI1y8NLE@HW44LMh0e#c`U@1rkt-%MjSHOVfJ&GpY|dF|Mdt z^I^wciRQy=mOTghKOVWT+`Y^KqhuVh&8$BC_Gt!2%$~EJ(Sxe|fTu)g#|3$=E@mg( zqK`oY7__42mC+1Oes7ys|JNKSCt4d41oHzuR%pE%&+GX$grj5!k*OMx%A1BAJFSaSv zl4z(paw}UFLka}M%X#xen|%UOi*dv~(vBrM#uYfz2!VS*nqj)YZQOwpJ5!oG>H#tK zeL<3s0L)`i#c(u4i?Dtr=;eWcL1Nc2g_=>nRcp}fKM>{&PsInU+<4Mc7Zm-B%Txz2 zJC!35(wJAlAGGVTHf9z1316KfJ0Z3epitP9a(Y(9erpYtbx_yhJh$6@*M-}u_!>_h%wSOc;EU@=0-9ft z(&P2H97d&~I!bO%Lun0-nBF0lu9A24+kSVPf45M|<4*I zzZT_&dvCKY?VCr@{C?(Bq_~yr#?@~l+WelM|93}jzrozObZ!W;C*y`dxLpJAJvm5B{e{ioyYZy7zScUU*;U1X-&#K` z%h|m6b+-IZ2B!wT!!lReYB96aC?WImG9aY*i#rUFx**dWrd&|yG2|k2+>m@VNhN(x z4?8O7{2v9C^oBunQNmH(U01iiQNg=7?NEtMrsQl_e6ve=w4eN?9L#VIlZ3Ll$V6SD&Q~E+Jj4V=qQt{y&G05n+DO9_u|T2MvKWtabaCqnn+4CPdn}bu z#sSPCk0ASQ&tT0X7y2B!Ih!-43i3UF&t36TT8F+r8TZ0NqS$1eUp$)*`#q78X2+7Z z8TJFM{46$+p5eZDsKoeK6_uKMirfPtl1CnO3Df}`unX1Re1AJND-$IAGBn8;9D<`= zp^&1(FaHw2$cs$TZ3ap*$l~r(&`z-oh%YAf{YPOcbVq0dPbfg$9M)%pq>1w+tZQc! zDbklR3a?`9$hJ?^t@@4fW^0DtZT+l9Ip)FNxYSaFy|~klVL{o zMAHTUTnxn*Y#;sJ>59TIC(^9#|9VS*EH`4mctqIhkLVx)Bsz`;M$4SUu8u9{5 zbyFlM_U`o0Y`_{d-gAtte<~711<;Gn%5H9?)CP%sUM`nir$Ax)dja~N!PJeV)yLs_goLKzbVtpY?t$rXB?hc4s^wd6s{ngU5F!D)|~`f+cpK}(nF_6{uZnz zs}6LI_!8cIlwhm-2V(ydWM$VLc~F19=Li{>L0yqDK$DNu5)#tUO(cltA`Qvd@T;8r zwW&C_)T9EYEd4XHS?Ui6H)@suA;$~Y1Kw9X7++U_HfS9{fvnJ_739K^ck`Pe$ zn0WF1G-M}75w$JoW;UH;>buVlDP*&n-cHsFlN(jC!U2aI zz21tCWzMJ&YFmYg+<(IE8bIx~m{vtESh8nPaNA%FB;SJ4rk&;B0VE9%XKJa5ZqgM$ zB~TyO6TkcGcrNDAR3|LdDe`xjb14f;p)?@-P8XTvZ1$|t=+QvXkcM0JwwJYCKOrbj z=On+ zdxDEJMX!Flen9Q74Ug{5uIU1N;vcwCueF_7pemfarV9~1EJ1I36D+r(X{)H@paPz@ zLbAmZOJ3Hk9_@6+LNo-xZq62W3JjUZ)qK-?&tQKdQzSoF@47m_w;>tB9i+?N?Uu)Y4jMYHVR9==QTxA&s2&(5SLaoYLLr zUT^_|>1gUQtq4Ab6A}2Y^f@#>*VdwZ>P9KtN*dLQyl#&@02L0lFLk?$;2tev{g)+y zGs1ck9ub2RQU$Nmgh%`X29dI0{1+8%qv1C|k`hToI%ywoEMfgjwLkxllofsYdzcb*i0H~CBK zTQ1b?t%tus;jc}p>d4J+*F1BAmn7XfNcc{XqV638S-ID!ylD{%8L&|FONw!P-EQXD z!4%)gU~XJn2m8sjNcR`N#5axqBa+ib>+E$-MktqTvy)ETg1Gglfgu1H6&X<2x}S_o z`uf-W$KKq172CllCr{zfDOJOMo8!FRCyAzE;koGQ=PX2_jwF?sE8eLsMZfGif6FJc zxCd7zQLD##<_duAupF*8z!aWbAW-r%F z{lION4>|S(`Jxw# z-%h?+`8PQO2jM05e>tlvx@D&BdtiTO&$ZhLb9(+(Je1Ca3oZVz7ei~(?+dc+{@ume z5!CHVs8~iGC$H9*Z&^lll{?i8pRF65Gg{OEj_dfTW?^|2tSsq)knZL^=U3>Vx`Tfn ztB69??DD(FKWvfI!^=>on)NHLT9s`F^+!3M8i-ykC-pO_3x>Ggf!5wUGA5@}#G6BM z8TB_()cf3j*6p)z@fJ6DVN;V>K3M+kbekrPZ`&~8L4`Bq94UIPxW^g)WOHa1jNA0O ze6Q_f&J6GtDM&cNX>?- zo20pBIrfroUQ3)Lt!c|2^^ZMR8R<>h=DCq8;@5^BgKO6X6roego%M)4w#D{VkC*eV zeQ7uJr}--VwjD15h+=ZM+2#BQ)=UlnteFoe^lsnInfuYZH75yYwDc#q>ZlW}WiT}V zx?|Hcum6a{M)k9|;_-M#uY90jN4AP|SE22gLI#N@bh=&P43jz%@4YTz>~)R{i8uHR z1gylo+k_Bal@eEc{X4xd1{!W7CSJqIJO~8fW*0(&OdqK_GV~qCT2+hpB82f|MAu|{ zU__=J&A%gyyYXaKJnHMipsSn-qI6|j%ymCobV*8lB!ZQ5E2_^_RSvysw^PVBafq#b zD{GeXjKy|`GYVUZ`2#F{z$Y3kW>P1PTUO8M@hJms8VOLwxfH}Y@2w0kN74qPL!*fJ zt~?!58Ove3en3!ee$WGdGN*fsU58?z456vk#iTx`-5+BEX^Km}osH`9T@m6h@1HTt z*n4cuS2@o)q*qDw*Y3C&N@UPGZJ9nvO`1N+s8)5ETXX^j+Q}58VfTNZBlfK&k=MWr zZQ0iYQMIIJnpArO32kH3O`Z-7lqYxUJA?zUCGXXd&yNqCt0o}U`$?gY$JW?${5NPN zNBxcbR14dg@~;Fo(u$icNuPg{dz1=Y$|}S%j5wq<%~W)QyW_S!Az!h(;_>#f87C||-aX>y z74VR0Uh9zI)CgmH>&4Dis}ob($zk_aANy^mDoz7VmID-(h$shKmB>6K9Dz; zdlVH^5TbejBE^5V@T%trKbqax`m)gJUl9?`QYmKenPFoAK@NX}jdez*=TxSiGkn`g zrC^IKvBeE``z+di+t=+-&r4jP1X8rOK4$hdsOn&a7ujhe0w`|GR?En~wT<#`N;>5a ztPBKwTol4sh&TAvcn{uU)14bSCl^BB0Pb)ng5HXkKhVlS*HnF{)FPCO3VGp{ay9K2 zRZ2uh{0w7flg}z?^*|p3L~O~Hk>b10^LA{%U}5s)5cr^*?M~bcdcy!Lb-eYD_~GVO zw=m)SN)1Zwu6#R^eC%U*oKOJS&GggzV8eO#`TU)fOsXQ>8-qkEKofYhX+dHn!jvCd z&BIzrGo2|r5t%Ax9b9?cbwLxpyLc@42`icn;Kg4wCF_cGXqJl5Re0T6B-X0 z!J)pWtLJLpK`wDFy4l$DlUuIQJxTL*~9D+(~;6;A>LLw+Q9uY4I>h9C24 zMB}mPGaKO=&5@Bl3*L&!4?uq6`1aR>lFJS8vj!1LK+@$5@<^%_LC zCw7f7jC1~#BxUM?v1eG-$qP$$%2k<>FMn2R?L9aD-YPyjK8hm!wpL2-lPf0N=9Fiz zv8}GX7QmhH2XZGNh@F!0T7=EL!mqxtk}4S$oAW0R54v62wK9LNw!2t3qt?11-4yfX ztE9PdC-{<;*1I>i^M!KZPuCLSrq7)>mxeZud$i2YIi8uz^tRZ1=S!#Feye1#UJPEn z+oD9(645da1d)B2XD*gvX6t&KhwNl!!6GiUcqxioC=qnpQ}l6rQ{VISKZ?8I%OQUs zT@{ThN5kA{Yb}mzH}M;9?JqA+oo%alYU3?gG`UMi-4LFTmK>uFnmAveDkI z-?kJMutd?(VF#8v8H%K&wR`VFHu@j{c?4zkE2Hr3sQ0+U&%5+>u1^q)4p)b{9Y(S3~5D&fVpk0;? z5ZdHM#moWD5Z;3((w9v)s?$z2i&YITCh%e`_ucPf8 zw)NS!={?aYI2467cv2yw4<{cf1(Wc+w(*?MVW5le(q}>B-(h9^QUcSJ@1(?UJnyO( znPM}nb0CwKF?vrY)ZxQ^a&`%o^bB^6+6=uRWW{&^ic|l>`l|%F1+Lm+_9P!D_F)t5 zMoHZUdxx8_dx;OsDpPYUU4B<*%`5@q-xT)(3|MGWzQ@g7Ma63;O-|vv;OWw zhi}}lE?)2)pi#|9g4QRp(FF@qr!4_%4X=^5#orA#nKj@3$I5??cudpSfpbJ+M`+6- zT*ZYVGrKzatj}IxE5N^CHUZjw(?)&trv#a4qE-uGl%Z6qqws3Z97eW*x#pMuz;~2% z;q=h=g@EF0kB#Fa%U?@`it^CNDc!*zS^ebdO?uKv9jXtZkrN?=2TM)9A>e3`%AfFc zJ@iBcS2^-yH)GwRY3?rCF4HqBdLq&`sR+Zu;m_mr^I}hP;U=OCwD* zT<*cchT{rgI;HlS1zmB%?(Ea<1Gs|FamhOhNQtShZ=3kC;eQmjMV*cV+T8Ph2#< z>W!o>nF6Sg8$H{YM#n7AyB1sd9h%D19mrNnBjHZ8yGdd7jOV&y=`~KF_bSGU{j?{H z@9#N`P)1tgoE7xR4~ACGr=8}_02Aa8IWqPKq?@yrjr%7>{%J$YuDTKG&zFKw^kdY0 z*SIh+5IR9r|2nf-fuAW;t32MM5Rn zm-I&!R7`=PW;yR(M1)JJWC8-$h`&kl_=2o4lDqhJ(i?n5DGFc>9u>p9aGNfk94`mA z!gP4af9c~93qHnCrCQc&Pwm^J#l`mw1|~83{rZ@lawcY4SQ{(x&9w-wkg9c|IHV8< zHQqUByfYHt`l)Q1uNI3?G*_FJ%wapRfArGI6iTuTdcushH@vJVUCy>fLw2lO6#sUm zae(rdWk+qL5lkJmKZgqY+vr*clwtx~>aCgSzQkwgF6vb87(_I$V{p@h1Nia#oVp+foV>n(PEG)p&yof*&~QPnFMmtDF|+dp7~2F^LtD;fJO zWKLc}nfHPLQ_l2&1(6au(|AHpZXl}bg6^dxgE;ua9@4YCO6U#J4#~e^*lHLe9Dc)X z78enLbxKFm;;cvE!Q{_9$SLX8bK7O&5!0-yhT8zTtQb85IIe$+XH7Db6ct5yDz-EQ zzg1kjyFo^JOR0%x9j9H-1qy{?HfJg5!wGw~`R&ML?XUQ$TbR#gGTCvA_OH|GDP+li z7_G3Gz}NSngb_Yqv-F%PE6w+{##wdYGwZBY?d&pPAP@u~c&*C<_w@jk_dcw5EmvAV z3R6-4z`@pqwEaKQ*$dFm>JgAkJ;p;T2VwcsswPHchrY$W6WHK<)|NM1ywhxdBMCY$ z*r#cwx_4{#Wiau}-l#CSw=idDV3tNHJPUUXwztQH(~*=fti-*3kRRE75I9QMY)ZSk zcdaFQzd8uo&mf5(UD1@j^95QEU}NM?srw&Ai@w>byiNG;QYUCTy%K-v4k|6bS7y&% z2Vk=KFiW>Tkpz~uFkTB@Fr1d`qx4^}w(5Diefxw3?9Z|Ts(wXO-oJ~G^3b-TzT0Xs@Wd$W*6IXDyto71z9tVgk2rbBQF%sYaFyPpPR!cU2&Kc9zZLr)-u|PFEJuHG z{EI5Fuc1!(?XS}hpWn5a1GepXBn;MUJt&0*O^>u~W9@q$hpP|Gw%oyoKIk&dz#S>J zHm?G*c2y9do%Mp$s9(Zq)7#0VF0Pk>oi}p@o+sJEJv6lo%ijRxyhg(IhS1R#&4NT7 zznb6Df91?pcI#Xfc%>CcKjsx_PM?&O2!Sr&{xyhFBUJm=d~#jwfnU5ieKHU44?EKF zv7B-Co^PiGS5p70=^xr#eARt&l6P=7>BC>Rmb6khfMHP+cjS$T~WwX-{^9GKQ6W zzZMI~DQ!iYrRuqnrVPla(?@$exB9~`S%)@0Uw%CB(V+kaR}lDf4p)>GaiP-Eoif`p zSo>S!3gp>@QJGi64<}^OKlRu7Aq(m@)8ASa-}ET0&;PweCUMW&Yiee%kW};^*Ss&^ z({tbdX>(ZAxALI6@cUwcAwFDYM}}rj%TlHSqcQXIFh;C%0n0W};rC4PTFkvaIyVqoTND10=VX(}&Y z0C}Moyr(`+Uz*PTW0y!-)hpyxZ`q#b_f4`;;JK9dP>@y0U% zU#s#KY&>I~r^mb4fa(km9gSU}MgOYON)`nG zaIL#**1;^?)IN5lLl?1c6K?|Vc9H3jmCu?x-0uMjhBU~Kwlcm7IZfO}ioWcuVu&@Y zTDd=bXcC z_LQU>IEd*j>npId2jI0uFyYh8PCnRBL}QDjPm*WXeBx7+Y;I|}&Y6e4KUYNAIETiO zfBI9kt!x`JVeskH7xUkPfkE})Jl#BJW$En=-R_PTvdZe>5*cG5NIm|;gcixFk)vx8 zZkV#j{m&%1JkYn#b=8&r6nk&LRpzxXO@^!QB30&gcw-o!9oG`*lE!u%Gv^n##7|h} z%x(KNwEW7OLhO{Dqbt2UFfBO5u%$DlkWgiifjFUhk&{IB>MplVq$8)r3$FyL_IDho zitiaP-T`iJyiw9Cy(IW}ES9SKf%Qln#@CC8#YraIEqO(=#Fa06lkG&CrfTo$!-Q2W zn2h)92j9}GfJ){?^Qa!Vd)K!u-T8QKVvR8DUup?nJG4SU+3eEbrUHGNDus0U@AZ4& z%oob!l{EO1|Mj5Uh`O5$P-?SVnD6t*RIsb5do#O3-?G=m@GNux`r?~M5o2s+fr{1* zaqV`_ec9dmAyt>AmLk%;%lkmvu8p2ni+|Gh_OaNJfD?vC%gx*D-?yV2LMAEdnVMZ`U9R`*pd0cMe+Aj*fCIA6ZZ1`N=E+V2f`84O*&|VG2+Me4lnZ!w-F!b>z32+ zE3qD+0b=p(ml;YDGEQsSd?QN0eMkAu4(&Xn0?hNF!hehV0jCXOYcWK0;b395&$j7I zg6Pgck5*;sjW`v3C+RkYx~S;lZ>!FY_;P(Y_G%)9qeRAlTbO*@iBCeMyc(eP;g#58 ztIOzI;m>;eR71*EUjn$H)gzt4o@ihljdz=}$lUA8`m@MWVs4;162^TyF#w*?5M0qk z>+qbh4|jYZ`XQr7``ZiNXHT@FxDI~wNh`H29!N{vm~apug}yD)uSn^xl2lQSFYJK9 zI?tl_9(!1}^j-X2GfavC)o$%SSsgv7qG6+!We(?$Yxv_V;fc!X4ILi8wj`?K?Iv6u{4KB+MNP z6NeIxet!6U-g~cSW zt|6s=V=LcGkbm#q3SJwvMW@kWM;&eS^vcMByQ|Wppx|FS@k)k5nP%`M@A{TGsU`^g z{Lfse4?cb7FZm|Seb(|HMfO9xG2@f56Hjeq*6Rmi6cM)g#)^LdB1j zdkkD%ooe3qJ+Z$S`+JMeXKcf?8R*PkY+T(d)8FZKAgp7hYaqm#S~KZGbr_7e=BODU zStCADQT*w21HKiw*!)t)7 z?Ho|>_D|U$%C3WA0HjUxlXkYc4U~S9j@Qztae{sy`&soe)=h*#IRZtWj#Se%#{Fd! zYd4Wiym+$wJdNYMi7tp=t9-d(z~uOSm+GMITaK-a=XiOx4{U3Vl=r8hvh)h)T{^<}6()r*#zQ@r zb-2c=(5V#TqqDv8m;)i0oP1JYRi`#HwZ*qQ9z=`XhLQNNzxKd=h9s94d`e80G1ni-0ZN5j z<8Vjsh8;NFaTS})8#9gw#Qi@k)MaQD6Xa=C;-RHXL_wUjeF|V0;N_8Z|4v24dUFd6 zvke5r+G!Qdd@T8n0DLd;*a#dZ7*Wx}iGfD-%mS9PcXiG~1v{j49E22HW{`hjDi%q`Jp)hu~ZsC5jso zSRq`&gGSn%HV}kZaV!juu^PIMn|?3Ts?=-5%JN~(hw_2=IKmTI+~O1t35h8a+J}Cu zJOK*ErC2@_k{T3e`R4T~M48a(8}f`giDm}|qV9(_+(#=f0D~ztHp#O#JxE3_rBlsI zvDdn8`CKXW12o|*yM{E|=kFCLmI*d#Jj>T@?adJyw4g~6>kiB& zHOmBOyYciS`k+w?GNE{J&6;wZUH;ca_T$fF+?uikgX}dEA&n-(a%Ly@*e4^rWtTJb z>7CT~B$r})yA(Tq{SP{+U_YmBSz0*yY8Q-7X&dRW zy)F{z7F}?+@Q?aV$sr#Q#cVm_rQGGdvF?E4$}RK$i4d+ zsY&lHziqPe#}RCS*c71;Tzmc&Mtyxb<(+KKM%6IM(k*B%;eq(i0Kk!`n>ScMwJfqm1->HX zAp`#HIs&cKx^6ct3_>O#9syFXCOGW|SaNA|5$}}-$%=YioGE-d?s>&ZtRuc>!;G^q z+s#YgJnoJaZ+Gp01Are(5Pb`)aL)}8FMdu&PiD#rY2=AKmUr5_y;ax?mks4n*iJ!a zra^195gAgy3^x6P465b}U(-BV23#xbnJZcE(7Ut_CzP%Z0yEZaQH**-wrm zpYurg6SJ72L)fZLJ0OJc(YMem9s(hhw3~rl6`xOT z`h{`4ywS)$Rx2x}29Ta(8XdA`@m_Gmm%;<_X(zCVP!Avww~I)^rf_#vxmDhu9KIqn z6)q+0!#pc(Tnif@!Awak{4uI`3_$G4_A9*e30oASSE_Y-;18s&L0Hg5;D(M@-7PB1 zcFy4pG5c-$7inMFwI*v7xxHSKh0p5Wyypj@dgRz%#dSb-;jpBQ3nu_-1sbXJE)kNK z2Rf+S`}P6&8N??_bX)=J+YJ&IxyAwqa(sgMz>H4-x2lk(Z_)4Nfwp9c#r(cF?&XIJ zx|h~}q@B5jT&lxDov`TuP;oWit=={3KM=2x1+|DA75n1heF!02&LvmLO3r_~-_lFB z3_;{(UPUrG}u*In$y_}Ac@;ZINv>6dr%wzOUxcO6|h zHf9_PT#vpkJL9`^C77Jf1_KQ|KB$A_nR$6{Fa94OdSedtddx56&^h^Fbng7hAO7et za{MiPXn(K*ilD6Ad%OPoYaVXvuU>YUsfMx!0W>bCuh zh6UKVRV|}M&U?|*63gJRZoyrZMPSd=!Hm(ZJWN>#IqR#?*kz!Sl8F1;L-Qj$+2j0e z-ONJ%!@Kf_>U|cKVLElaWJv1xUFMejYA55q$CU>9nKHY$3U0KnUMTX+We_Kc;J76N zyKvSRw>$rU?jLI3JN!z&&;_@Z&4ph?uI`uFTh=8v47I_}WlZb1?Mqtfq-<8S_|I}p zniy{pZT!Q2q1NA45cO9I7huL{`YP>3=TPGVo=tO3BmLkWv}w{E-@N>`bQ>q}J$ki% zo5DGXs2_rRgpp9}v+1V*s=lyaVCQ%hER9)RONm_f z^01uWxVg9E9G7!p<2vPTG}rQ=$I&eJl^OE^;u2*S0JlU>@jK~~OkO%Xl4F6)4V+6> z+t5_w0{=)aHTvoo1JYqD9=Vvj@3_Ns%>BuGpZ2tLkr()F_uV*!fAHdiY->06R=v^P ze5FV;GTAGS{o{GWqV?rzd|vTftJ`(u1Sqf*f{wrPgLdWolyvnNzz{e2h`6bv5`M|0 zmaeG~c?hAjs@kbY9CBRsnHN({na2*Z@4MH;#ll-j;Ig%m5{A;Q-riTmy?7BnzFTXL zSMY*&{Ewn@@n`z+{eYCA7LesK{f;p`Am#`KGvcl@z_Vj9)B zJddDR^I19bO*m=EisrLEcvw`#qta!PfaWTtV4=dhimM zENWmSs7H#*6yQ!q8JXwz>B4q0$R3KL24mWvLuJj8WVQ?_w$s2A5aGr5Fud`HG#i;|?^vXTXs48$7U0M)F?`!84uDUoAY|QiXTK$XQKZmw=avPLX zh$2GpDnq#z&dnD71E8nQ&;#vJBNS(Z+{R-2p+KpD@?Y4K?>Jqa^fR;c&i4a#`ZuSV z|MLTHQ#;~Il6+54d;E1JoTTVQ698#$EJdvd<6umhikaKG_q)IVl8^0N%{lx^41QUC z#lw$J+Uo3QXF_5XB5f_)GlTi~l|Bb^qaOJvp$WDXE#x_Mi zJ?ZZ4)-z=}?%Atcq?PG+V!z`QgWesE!F*eKfgMVOt@POf_K#1VzAn@A0dF> zs=YaMPAts14j6;T>V_EjwI|(1spq$+p!r5duEHM_1wKa)A%)-}`L6P3b#ntgJ?0PS zC0J|_g@}t#`mf**k2XK6)tQmS^)%`WLWefBb6!}@LZ8l$<4^hxXX?hjW6lo~FJ%oW zbvf`|dtXmYb#gR9K3Hi&nRjBzpc`e3s!qr!`P~$w@<2^$)&MZ`A|7Mocy~3&h_p3l zDLw%6FCo64imK+a42Ga?wm=4il~QnotawTc_feKx4PS$Sll8GVXA=i_-2dikmM3P< za#Cf+ZNC@+RA3r1lkNa(3;;)cr2U)iWHKs54$WVXpX#eQ{6f##HZ+u`d--ZY@o3Hy#fJ~S!GhP z*}%i8Iqum;2-K$VcggxfnD1Vwy(B>{`|Q&G<4XPAXOYo~OD_nScOP%sZ^u_B-tuT_ z*Pp^HkiuK8@gQV8L3>BYjS{F~+U>v99dcHF~+onIj+Q-C&gJw>}uU}&U-XMw5YJih9 z?XiOO(6G$x82W*$;HMdPQYAsje$dJoZsU>go8~(KR=h)lCb$8^zRkQwDL5Cm*MKib zUzaI(lzzu|HFmgz?Shi;MgKspLeLM)ps?pqyNZN01p0VdUdB~USqI#($D)ddsDQOnc-n2we%ia{>!1CCZ8*>hCU z5S9OBPF86*lWLENZc$`(py&Q>T}_K63m(J$bC|HVkehbJZi-gkg|B|DuUXNP1U?|@Z@`~o%<48da@w3!{%GH$|XQU9{al$$~-3VeYn zlSX1sbfugTSua>Olds2BcwN`PwVZ<9W@Xch#NnJ!HX^~Fz~n(GPd7j9njk1KD}9k_m^`#0a+fgIbYH0`r!}q-U7aYV4|7S%CI$O0?j{@X1;fFw1hbW zV72O6zD%aua0~6tVwngcSLtK`*W_h7ScZv4R7^)3n)J+#QPLhao$jFN7*hnv$dtL} zqZps-yM=Kbl5!mL#JS~ogw}Bt0pQUvCBEW-4-P?PnJfZFI@v1-gC@~YeYT-+@JAJ3 zY{g9vWFd)P-CXhwZ^b~dkyxvN?L(~^TCqy6FBm_@MC%di%SwMr0kGOQn zWff10Bwc|#Ms3hpzCIUU{0h#Myqg${$c@Ov@h;MkH1C(2;;Ddm^kXL2O{S77qbQly zpc2^;WZ}bYDQt4m->Q;xFej>?X>4S``l{__rBd3TZ2AP7VrScm;aJ2a{E8y)8W&Ax z{vkEAJro7hmmMb$?XX5AN&4?|Vi;~Mh z>P{>S&_X6>q+GcsZSR`h$Stu{dt^+;tx3nyjpBpMG-TOxmbf0h=JvqVl4(-M^(H7> z6L3`#MaZ?O%08!tp|kE4pfIUx%#EH5h3k2?&#TJc(DsC2lN(rV2xXz(gWpKDQ6(9R zov@bCEDYXFuBEgorz%lvDmh%vXPQG&JRy7`hYmAkKF~C*nw*@^C*WwQY-b@jPJv4_ z&hxU?wm=dAd+^H6U~?9lsE5cC_OQDs{^&w+ykb5sStzoD2UykgY@i-o(rNj2vE$K0 zb53eqGNrb;_0xOSRTEg&K%>+44lDirrXJW60t{5~@P^>rE_CcmmDh7UO9ikin%2RN zolCFZ_ke~zEB{G|P}|Ul0u5@oo?08yj1Sv< zR^vMSt4b%1&y;y~PbGg^>Bb`V56ZpfleN{YU6YD9f{J;o#ckA3l+|uHCmu9YyygI& z@JX(5cMD0+yME-r@DHG4n2n7`uqs@E284>xB%JR}m;7MX- zrFY>)42K-3k>Vqx>ZxT!B7i>xZWo-}%PYQebh*KpKK>te`l(2{7p3l*WpZa}?|((7lFMbM zLhO@&MZXZXR-gX2TCL5NAz^>aGu0bejoP5a*4?w9u{^}Cci(BLzI!a74?Z7lIoG@$ zRhgE03!6OL`Qu-EFfeBfgcyy4->W_{q_S7#`&17YbmAh%zuB8T%+$c21f22*{v53N zxm4@op4t&yT53jT0IX|^i-pM<{q?2pp7%eU{hXWO#1fVO?Qd2)totP7$$n1KG3gm{ zf%7Z)<0GGicgGE2$G55w6bdSg!vJ?wujU8&^ETYIzJ$yO7?=hN$d_>EB?n7+uUsiC zg#;?HC^<$%^#7~cnkED9tA<^#ArDp`FUqzbDz`}H?^zDH95_1{*{tv;z^mXc_}zZR zYaz7@yY@kPilzs)1Lg374;Dr9k{Bpt#wSW%cs}j%=+T=L+Q+-~L7TmF=1`gRaqzFl z$%Z@Le)NQQyYDKbwjUr|9`5E8wO$UNUo!&R?%(k0E@MZYM-P0sML?E>@e`(dv({MZ zP3cQJF6Ihh2awMe8P_*^3*}V{qx^h0HU4Q+B*$W3$F9pkcD}IgUoFU6>9mtq{>hxU z6%67gq94=m#ltP;1AyPVBgcY{hX38(yjw{wr1pYyJ0kEl_SJp{;I*gXvM9z^qN7iS z&YroN_dYc=zr9;&^dY5%U`%QX-Ww2i1! zD|T8^Rs?>NT)9gSpvt3Xd~SFZ{|9jHx;MMR93b=xE^F7;x2-xiCj~3X4Du6k4o(kZ z1^`lOX1!Zd--I(}5+CFY>H>`Y)}`IrzoN%KG)<~(@5JE@Ung%d%vVoUGc<`;gCLB% zQ66KZNNX%M*FOqAvGR0ckYJ@&Dn|GJ2RrfF!a@9T#0z$^VgmdjaoF#6ieJw$_tGF@ z?2~=_g#L6>8z`(ir*Vp7anB;}TMN+IXnRa_x?{`YPusHegtdSk>Iq7b^7I{#TN~rS zHJzp}x>#K1iKeZJcg8RN8mY#%kSg5EVV5h z24s!)9DDBc;Hw1a$-c(re%MUN?CT;5MkKvrMZ)123hlC%GN0xf?|6iH_2>(SC5cK+ z<4Pzj!5DyG%c6`dNu({w&M*0NA&?xa>yMf;OVp*dEku@1NUOJvFbixYTavZkALouv z;;%&_ZrxA^R=Zmu070U=mZacV$xa)vBre>BJpkm(X4W~=U~3c9pfj&{v~I+4(g0d2 zp5n^S{H}B$H*z2tIWCQ2L%_tp{vChmIE&i!{wV|x%*W=Ar1>{mN*9v?$I#M8K;`79 z$lHMs;}@10zBvb0U8uy^Vn1xHoa)y5QfbH2(pRKK$W`a9Md`C=P}VW{cv~msfl#JX zb?CdfvuZjyy$t?}ch%RAO%JT3k3&XG{L%a(Pewwf)}guRLZ1R0PXm?lHc+DErwtFB zEkkV4mFji-s2X%Ece!}K7I+|-v#SZJ&aP{cEg>L}Z{;NWrTth32aiu`nGcCO&l)az zpSiLiWfis*(+WR@c~lMdv)H6j5=wJ)TmE0hrShTaN=Mj=1DuF9+&2gw==_v{;6Imj z|Jornq-F8BeK*;ZDWt`WH)U8Y0i;oX!}`k14>NJ`8+dIfJWnQKo8%7L&_iVQeN0y$ zF~9`lk3>Y)ZR;DC3hU&RNl_xVL#qNuu;0KPUp;I_%A3!T1+q>Y6HZ3xaVzcdVBL?z zKs4((9iGy>#OKlK-OBw9r95Dx4_ABUVLYl()Fa+Cz$Vj zf-72^0uO&t_4R zqoeYXMn`WX#oReuM1S*f&DYO;fkdN2Aiuiqnd- zOO!?x;(j-bNAMhK6#Lm+lZu{p1W{G4mV9F;tm5}c>LJ9mU#6Ol#_uKLC+)AkXEVj@ zT4lW!^WxY5y57WNM*>mXNp!4=W--tJOOXylWA<{+j(2)7Y+9(CYf^-TaxwNm@&C`S zOc53qB105b@SSY&mxMo-aENvl?9ZeU2lel5LhK?fIZ!_@vMTXA%n)#B>upjZuo-jP z9b?D0N-{*}A_W=^oj|zp{4zIM8;@qFKX0+AsGmte8q`GcqLi$x$!YRRGWqHurQMk} zw*5(lCr9hPapntyS+V7((;W;sk_F0j)7qOF)xavpJ(hHN|55`k0GKL-DvPeN%V_m>;9Cu_BK*=doLB}jZpBwQ z{CS~q#dpd=!vE{2RP?WyY5+I0R*4wPwWbc`uuQ@6WQ6i5V+~E-tDCU}RP*l`a!`?B zgp2A94jVIp8W$XxB}mgwd;{gi(C-KXV0O}PcSq`4Oe2}P8FAx|`{p%j9fKJ{QMSd}yZ_Ugpgt_WC^ilgtd$x?kb~gA%V{o4w`B({GcrZZ<1G zUW5)ZWYYh+E=2tO#^_MYw9Nmet)RvHvrJbh)|7hbMtxxrFSQVW3J2kw?c zShpr>SuLf}TFJQOGveKv1+s=HeUV$>9`!508I^uIz8G;4-Y)^*XU}jyEwxGWDPJ=S ze68eF;+kL%wntWRtCCjfB08yVl~h`KA*hL)D8++*4a~Kda!0#D+_|VeEj7DHT-?Q| zaEa!?R4|!qSY#g&5?%I`RowI$Cwcz zJl*t^YA{*Lr{0yS`BJE@r>E|Ur(enFh_eS~j5y|>5od&ZmDaxWeu6gSvIgZ6?&rj? zmGEB^?QKQ^Hqsx%7Lxr(Nvwsi4?Gj$x`0$j`39$-nF=T$#6+c5@@{hIav8XQZCl`qZ@C$BXm+n&tO{?hnCBR=d! zn`HZrZ{Kw0cK6g_NE+r*vkbRx&7?6n#FuY%al9DG7s7z?N=#34QD z(Y59L+nuNcZ}?AF|5|d388U;#*)^DhXb@>xc3mUQMEcUMx&50Z1u;W-b?9iZU6pR3 z`WU&|Iw!v01hV2U_5L`BO#`Nkgvf_nR1S1mSSS7!NyBWXSWu{HAIggU75}JmiHdim z;Hma9`RPW=9j=Yg+=RXSE63q75joAoN!DL}LSk@nx5nll0dsQ&wU2Vqsag(>+D`_8 zIs-jGZa+gZk1xLB3ad%->9@m@vx5Hep7K|G__2Zcd3+v~krnwr8qQti(HG;#Qavs; z`*OBa=#N-$%a6o9n*9%j?#K-4SzkW>pK#O($#*)vNmKr{*M%}ai%gO(zz6uF`=e5L z&A!dP*4>I3{2gK2Nw56UO748GfYFeu!LmaU=X?E~FB)2JSBe04@7$+7ashow={h(8 zH3L$!EzZ^5y6;q#(bWS~GtaUfsG{DMmN``%z_Dj_-$U8M$~U{O5%}5k1PL?bh~p(r zrIs*zJPo=zM4kFQOkU_77Lrot*!NDs{rlWkg!seQ+U5a&q6+wPi;zzA@ggc^$eS4M z@Ztj&AxEj^x3>EqE?%QJYSd<%@zU-jt&93r%Rv)d+)m6Os^P!CqnFzKVOedAD~?X~ zSz-v_z91j}`X0YOi-%u<4M8ICcK-_n9b?;nuOa|K`H#d&4++ zPX0FAdx{lH|8ys%fda?L$;$q6RCMxHt15vE>D8o80W!ZnEG{Dj&)4@qUI(AaX$#ar zVG#Z7V!G+Bxri12H_??7|CFp$_@CsMJf-)0aP5!H>>X9~(wqLv0cfYq_|Ch;Wxg@U ziHq6DMwIaW@hhm&$;7G(-F?r&z*AZdkLN!=p*x=OzV!u<*H+S1VnjeL20tLn`{$MG zo>D392{r(3_~4F*DTsoiE#D}1dl6vIj-q2ivR+Trke@n`j!7g`}nhWZ~r+SPu0 zQ{GKSdU@iT&OLuYn3i-&;DKlUmhbNz4)LZ!%$hnPYfOR|eOt-@DutX2+y3=FtYQ8^`V z_^yRpP&p0t=(PUX`>dd|%-?3Rg;_bc>1xmT=q%#7o{qsb#ME4)_EUNeg(o5rwd#g& zoFX!r#zOPnU48i)Deh{2W*^nG!$|GHPg?Hj(JBEl)k4ciwL3F=A|61LQ7o`cd64j!Inm}1wcTa8C10NKkoc|a+Y08|nHm8(d%aAj(h7d=ChT4>?p>3hQyWplGXEajX!vKFIr?P+T z`uiNG>Hiv9A#ROQ6Q`$j!gej&BKLxu0U;lzha z`#cBoWW*d{?JAs_e8r9&f>(otflLD{RCQR#6WHDBh`H-60HIe~LtzJiy3r7+D5trB z8Y<&@#1jjWRMF2o?cFI7SfU+KnEFSj){WQh3*x*ll3j8A+z? zH+dqE5k6xSH9Q9RH{Ls@ zhK|{Bi{fL~mfKsb^?y4UU}oXgFpwsbfuGWpY}UaoM}oaLt!Quu$JWdo`ELB7L+?|@ z`*sqw0Qj9~IoTDAizVCRdD2^l=Mk3n_B-&!Ci!}jVyeADj z>#mCfRHXI6hh56!CM5O1PZ)_3_5LDZyJ2>trbXf*;BiVALHJjw)FC)9=vKTGOJn}G zjT@312X2!FfuFO=(34P19;w?^4As;gunjLE9yr`|Tpo!DQu(9Qj!4~V6auv&;`@0o za`^qzC+NHQoirbtbEol^dF@!nfeZ*}q9xm{Ws{}$I@4!C11Kfp%lPOHQ*(L2RwwR) zMNz7mqRNL>lnjNxwAR_Zw(|_f4t|wWHJ9X7u08%~_-O!H+g;U=Z5!!Sccb!)zfL#? zyt%s~VL0QQWK>OB=6+TV>U`2)fO-(Hf5+J4b{ofcFS2Ws`NZsS8A(t$%hcETxo%kl z1)5*!J~|kF-d%r3V}UUFQ|sDe&}VX@gl#R6T@vJ+-TzoO)PdCMIT{Ups{Z$7b+@-I znA&;VhW2)>%Rh_a`f;_WSLCaj+Gv#fhl_YODicb0=~uMwg(>FT>c>IHU1eeUjW5i< zZET9`U)Ei30*^-K{NQz_V0H8ojf+=-U2q zMRrQwd=R5r!dU`*^9_H^7dEl{0z-B7j)=9NKIWf*8n^Vcj63A%e&W95PcH|tr;IP0 z>^uB3i~REJe>9St8(%M?C6=Pa_6A%uzE%aUV;ov;(pLK)3gkFyLoPh;CSA^kT{d$3 zneK3fT8k@nbF5bJ7pd?>N!1d>h+)ggoV@ddYhE%D$dtiM=ASM_Gx;KuxdA$T=vaC> ze8B|Dtxox@EZEQ$Qtq5J)yYe0efl5RRgv`_8|`%QQf%%@jI_%h{(}m;op=_8zHXRE z5A{^Q&sa%>#VX5C(=3P>UEbnFFxqS6LB*O7h`Tt#%=CmSPM=~dILmSfv%IZ{kI#Ph ziUzwx-`~Y+NNLN%fK3Jkc(X}Qf^cR{3K+RXSiGjppz`60e+Buw%14?!_z5u%np50A z5-)Se#kyWall)fOSmL1q6w~Ph%4@>i^j%G&^ZW%m7yq_isgc9D!VqqtfVycG)`1-!c?`KO5nv*j`=5%V7@6Ml5kgr6=4A5n0_ElS+k{>$ z`mDGTf(Ys+*1i2wa$_JsC<{moh?Gj8(Kf!%^FYnMLZ8;GMKR-=WX4#aKBr7=hr+-S zY}F~iG1oKIxjax&lDf7md&V5ac0b)p}V7|vHRI~;<&|NWYZ%qV4O)3-!sz3V|x}QC^d?lbCoLh zWEHbb+_UH7%q}giUU-YqEosJ?#+qR1lT;PsJZN5~jL{DN0b@R+`&I)*^iwr=9OnRQ)E|B z;y76r4#{`C*#vP8MJaIhiZlb*in5PB>Qmn!m<;`GIPdkqzyqxYHId>LT^g8NG zNl+mx1+~=pcc7O*9+wfGVg`-Cxh5BMalI;-@u$;zk`wl0*FliQm7#WwuD4w0DMUw*cFW3Wl-L)^* zZhb=+l8peC%GVS1;l)9G93;23JtwSST>cf_I@1=im?4M$^cAw9Ui*HX>*VzAUZKcJ z))O0tEnB5FIj8ZL#5wNycwK`ad{w1!N@)jrAYVkeCur!+gE;O1x$-n{KP6I@E> zP>1 zmLAx^6ccOKqC$uyIstM0tbPkpN~f&4>AgoUczw7dh_9dtzoOrWu-b1|Q9FeoyZjK~ zWcw=|%8FuYHujL@InU|V5Qe4bMA}SpzL%$kr`+tggzqyh6EDoRZ>wY0#b^yMoV=M2 zuIfx&=~*zMwD(4q^Y9>dyzA~zVTz+}l_DiODsafhPIvKg*eur}d3(P;h8_5ErHez# z!$e!D@pE3=UYv(*b<~j*t35(mB=k2PkHuF`SSZ{@}=IjKuuQuww9-FLoTslv^Ua*?9Ja5dL zt=vmd5%nD$42<$Z3#Lvnp2`-+%n*nV!tK4~5 zgqd}!NRfpk-hs3Uvo(8;U1sBkk6nhCr*Bwzn@ov-oSoy#LKGm`cjRurS$}su2(xM8 zWo!?4*(CYXrToY4{_xC?XyS{Dt4~ zDQ=lcfBgL4?0hlzqLLJB>(|F?d$PAia=QZ9!IxcYzdWs$3`PhiiLv&?kiyr(iX)XO zZog%DaJawPGf_`K4o41r_s=e=8*bMJ&!{Y>pX;rbmv3>Z1Y&q)g{hmIWv4mdWot#H zmzV*%&>uj^`euyDv=6Bh7|20AnY$NIgVvjz$(f>V^x`3vVQj>3dDoh&gIXj10k`*x zl>B6Azm4_B-u(8o_Jzi~Z-*2i2x&!1Wn}?WoR5tGjs?#MJ*rmHxPDTf@S@7Ed%nPk zgrlFi*6}|Y%!89{u&2%-NSvw2g;4I-n2TcocYm~GBnjzSggnFv))#;z`57)0fPbfVV= zVAt9~Puue-zuJ;dh)N5tw(4I@Mt2sB-qlmPSf zGhY^QFKaq#!aR?{3ek#?(sorY2AG_wTPJi+oO<(2MAd?LDcnx*MX!tFVo`NtW1C^` zV4nHGh!6icVn=7v>qC>E=t$zP5Ap*aI7Kg^Hr}0or&_7;Q=u0w_pHq&G|n2F$_@_= zO4A#(CZ2Yoe#(2uXBd0vADWKq{0Wuu?ev9GTd@2;GIT&N(-)fMuRX+2>9wl)4qTUW z-;228DoRg%to3B+kcJWC_*2Q2=SZRK(fXDh@)Q%sx$#5Hqco1UPy)j!1GPq`g+R?t zer$tw<`u$3)pA>rCv2WHf*aYw^u*sY#`aDokEzRL-(JgxZU`C#qS+Q4xpCm|l}bes zF6<|%Li^I!EMq=G-*WI_EduqYa*`Al>N*1khOjK>F@J7c=ARiE2Nt*Jh7^&y2=vvg zj1MrdEelnV^;{Jnpd}!E02km`0DCCbvRDQMUH#tT%40A$w$2w|D!?$UD5;7*cS+;t zAY~ZaOf#OnJSvC0{k@}Axa0@!jvgKRGI$(Ox+14nq0b?&26vxm;e7>{p;P_#N%kQ~ zBn!oZhmd}K>R*lz*6ctB8ypxe@>UY6UG!DJhr2q_Q!X}iz(s{uc_PgR!HC!3WxKOV4m zAh!tAUNHzI69(r~s81jA`_v1>U+Ib&+j&zIc=aT5F_EE!7Bn$?Ko-7+>O2lM5_dS< z?EXi+<1PSSsKtc={di?j40dYIeP31}Cv==RKp_28AGqb@5&9(^i@%JX z)i|%r^c`OD{40Mckd{Vx-ykoxRk9I`FRKjnn%Ekpr(aqkq9vn)sK<|uBUGd;r^3%S5>|h$_?aRIaOCt@+C6D}jqiGo z^__gMom!lSmVwb=))TVW+n@$3%-=VOW82ux`lv4wGa)sqY?DD)B6{j4CtPXLdBqC~ zwSgP`IR1tfI1r3835VD;<9er;o(*4~V_L+0H|Iy67Nehno zr?_(}_h@7jfZsuxQfzA>7r}Rgx1;WD6*ne>%5HuXo8TJPsG6snt{dS3;}r*^ zFfOI;vlu#@y`(Uj-h)7ZUG2{-CM^_flCLSyvxH??SI#l{n8{Wlcq-74Bls1NutA7rx1n&pn9T@%0AQm$99~25?V#UOjxzy#6uL1pZXBDE@ z;~2N7y&V+xUx}r(7kckviou_Jf=8-SCm<4Iqzm6od6T9Tw$C^ zXKhy%%{={MU8CDLa}Rw+1LcsLF4ZO#x~}5sCT4xP7pP(HLD{V!w6Bc0N^%V(2?nF(2Xlk+*@GN5G%<3!*$MeZQW%)-#|+SaB~cCU$nK+3 z=8C)4H7eo7l|rC|@hV8pg{7S~*Z*JWpFL#3aT};-^TlRm^+*{fAM2Xp7=9Jgm+cx9 zWg_zn5~pkF#WgF0)^vs4OhSuE)kb*KcF1C_!fuB^5~B`=x0uSARP0?Jw9wnS$`j;{ zNB$90#+R_GDuJ+gg;w8rW_Ky+``M%1w6*GWlFtlJ^zjI4yTbfXD(-DFO!UxH?7M)~ zM;{qaKfRbm+BjBZG7)4(ja%k6oRsv@0u@IpV)K9%4OZo)+N3-;P*$CpSDWalikxRw z#(d7MxQHNSj~<>Ut#fW*`ovoFe>9`U$lHlTi&B)>W&zZlQh(cz>op8yC*DIpWyopK zmvMG8>O|*27qG;Rp?SifXunL^I_EDQM76=h#MQ(FWZ>5d5RCrz-bsQS^3#8&a}a-F zY$_LxFw`$_%GmQ94*NbFG1t$S({R^}mdBa-XFKzFX?CwAlXwh4r7it!o#VV+NCgKk z@n*_f>=NL@LS3#zX8`#{Y%a>{uFWp6b%^S4HlZ$6&PDyN3%)iRa?IFH!9S)qG=#O_ z&Gixn{=J`k?~$`>>m3_6`GCVzEoBr=fr65ck-QD9OfQ8P)2NWwO#~n4{f`wz2y(z( ztls6JSRb^8llqTQkK7~au;&hmjwma%llmf;p&JT%mOX`k96F!%fQQ2i1HD4i!Bg0c zyoj+iTrksDX=7q;6$NupgTbB*zA~DQu`L4w-!<_zw6^&)#Ob8+T<9}QrY~vPOI*2g z^AlTlX1n`?i< z6`7on*h2_KT>+bUd`mL7Lt(W?^a(KpHscK$a6`#71nWV`8avlFz=iMjRk@97%Q%(B zW_cK9q?iW1ZpLAN>ZvT5xt9x$&D}J%vh+3qK%Nq*!oIc}q7@i`5(10kC`$xAi+!1S zfokTIp^Ox-yS*;YeV)fr>mHJ`lLB2CZi#g7S52`-G>HcJc07%GB@o-2vc}&)sJspk z$hl|ssgv}>hyOK>1wow#Nx$z^!AzZ&dkBfa5@i`_Zv*8$n@*; ziKHKsk^(EU{26jB)&f=rEpT(il$ts1Ep<@!F!dZ}S$j)qksJViNd@}S=bzWsiP)m! z7aY9mH-@)H?13KxN+HPyyADJj8M5zf$(Kz|3EuNU9(RcR2%-;!YM4Nm-Oi~)M`vf1 zNTzWh!aNb3>dcgR@)WBg{EC;!Cw;IeBwqWL8+|- zmo9qOhSjCa%^LZj?+^tTA7PT|-Knb7v5n>|dl7I|Q_v8-+No?ZmH&)(8r7~B6}(Ur zR^))-f?s;=3A`kFomBXy%x9?$Dk3{)lvSl!8x8fZgdD^S0+ z_g?D(7xQIP8H{PAJHy9xoq)~&7u1jFc;VUVm!bnE;aX|p-N6SZ-BC<0!lL`Zq#o{A zJ+<}T!iq~xx0IaGv(n9g^`2kPF9Eu`=Hg~5dNvIvBt%OyckXcJ@93k)-g*DNJi&t+ zfw{k*_Vj?O<#!#WgE??I^i)@DVz*{`R*vI#=x{#iY+2gmX@H)_-{J6|$b z`JMmhN-Bv`nMTuIQj5(XEgN*vZz`0Q0J*n*V%8e4Q|hrYTIJe7o`bxE+n!&eY_=hD zX5X?DOiYwbJ3S=PFYuDV%Q>$KV!GDbEIZ{|LBg;Hi{b^@)pbAvUqwEtnMN{Ll*0;B zT3|?rDNEsHa)zW?csw?AK+FFg(r*Js_Bteb;lGz#UoBOO+n9bmlQa3j>#^7R4S3rA z4e|C93V*VLQw6KjmEiDOx3AJsy0T8=MCn>Um=Uu2%T0!9$Pb^P*>sl*MN!erZ7XZW z4)Rra?Ppi=deYPWxfCDhoT9DtsoG1Ko|+rC%bG;B2&&uI&vFKft)H60+NHP;BJ~H0 zq!s>9J(>4lYt~`Q5AO9#JV^R8))OH4zP{^T_Hy%_Bu*qZsh+{q-@ zvp%H_9yT8E9fKD+5ifg+#d=+SS~`Tnr$?@pQR{F1)8cNjcjdHt329zW2}AZJ=+DyO zGcPhE@!!14w$}BW#`}Ih3`NvNlzcKSM`ltf)+gkHWEuyMOVwJr0qAb!@!jg9C*j=K z5UC-MC@{5(1b}V9?9bZb3LysQ>gr+=-^{Yp*k9LUXCq{3@Deo)4B7l24M0otQWNSX z`m{s71X#NLc??7poZ%5 z&-aA;=D2*jz^Cjq``K3O<8MfWDBEAy+`n3vDEymZN!#GX@Egre(zg)YP}+58n|pI; zX?mlli7gSba#izL`QVMuKX+bD&5>>>aVi6By*CGRVnQISdsi1UfukfIC(`2(=UH1L zy{hTRrrljff?EE2p7L`h%d9c6?!ONTcH1pNpmhjE$q&y3eQkY6;-B|*g|<36ZQdr1 zW!m?N3y2qzscJG&k-72h+chFFTABPh=xxFD$fW>fcM=T;3|Gx{!B54qWK8M_w6>z&shdK9qL0Z;mS9ESlv#R7C zU}!*&qoPg8Jr5^Tb~*JpOgD5qW90ANt4FpV@F)8AGqq`aGO2mrhRjs<{jb(Lhg!`% z8~bD&3883jv33%K%6zsJTY^#xg-l8BncrrJN5o7%GUn%tAYh7VmSu}u0?}35o14zr zRsW-DE;_n?XuJhQJw*k6@%KErx>m!*uE#bFo03CSUY|uH6Wvq_c#ik#y5~%by z#&;#{mRhq=lNrHA;{xbJx6^}{9PP~7@FGO1K;2h>^H{a3_zfl=^!A*p_*fsuffGdL z)fde*;n$N~NeUk*mIQhA<}9 z#UBsoTw`Qg8Bbkcxo7YhQa;r2eq+YsQ!gc&N)+nv6|W^qso2TCY9?V9nB=yLY;T7f zwP5lGn$l{$qa^Dh`&Rgv57ld1_;NX@?GJk-hwJoN{ZE@Y7XSE~>{21T(?KsfheZ8x zkbOU$(JWqn((oT~4-E2(OR#P5CVnDwZCo0DsS4C4-b$I2P z)Mz&trE`ErA)>Mo0P*hqtS6?KeM_a^N_>|IrL&TYL2ff`9LJBnRP~=+8;La0R(EZB zRfRL81)-|7Wd5^h@gK|SiIx4L&_0NK)l0f6H(nC>Ni!uluX2S?C2vegX~4idhkWhJ zPlsNwD@|VcQgRuJ(g*MAi9%ml$S5W63q-Exa@Qy{V1J=@o?FLJUEmo$cZUqs0@(OUkp`AleK8SC`#sTGZr7;Pr zMs0p{&bWn*^4;j<3f7e@aDxwB>humZI^zjH>2Ekc9(pJ4DQ9B*9pSa_q8(nsXJ(qu zIO2OM8z&AewN%9Q&F;J^5d8HY33UtW7c5tDb?3b1h4l#H(K=Ml*=O4Oak4w;z&W_F zBShs>NExMdbl6?Ur$lec*tFixd%%V7R%oysQNTg}zA@?+)VzuGx&3r6UJVIE)(A`gJ{-aIadMl=%GUSAYxp2dkti z%>T<$hDY!1wNSkrrL%^rFpoB$s$cMQ`Tt&UocvgH{d)tk_RDA2F6yAYUO1WDN;-*_ zE)~;1X=n`NF>!0_t9?^oA~L4 zw4~pe&6}?tEmEC+r}7DRM73clt=HB!;j6*UH`xq6e6q&{HMsuxAI*?K`J6iJZUXGG z;hOx0nftbI`-Sj1ySy+366Fx3cK)x3Vzy^R4my6}kkJunGV=+4R;p!_SJ}XZ$dEAh zjPuMqbLN>bsgBMCDD47&N2^Js{C$};x{-U9_waGw6~oax_XaR7AKwV8wvxAT9 zQ{4zjEk?UR(?^YhHb2>iK3<=-*_%MFE46B~%>L8dxRdf^o!A!Su4z_(jd-xOP@?4ksi=A$}SjU3J|yIddRTH*)8s*qbU3 zHpM$yK8W*U><8=qp^Pc+nQCL*`qV?JHL0g(PqBBG88CCb+<+c|UP?cRk5B4VItcw- zay99_M>KU@g}AA>Q(jKT`mFyG4Es2#Wn$DjsR+?F=eW%yBzvt}5 z$C^cA3W$AhxE(vBkG^X64CD_@Q&r5$#@6k^gC4NB6IThF|3}f8I5PeJaokxbvboO~ zlbLJoBXZ2OIp>&LIf~_6M52&uGuN6k$~8ug9CK5-&tgU;Drb%;qLaSA{r-mcKKp!L z@7MGBcp$&yPZKkjVsk;41yy?+*i6iPrK8fY*OHsYS$^19HwjCEC~jVuGeT|{N{MYz zOIvI#`ZM_V)$^(JR$a?{I}FT1`W!Lyw->*sD~nWIqV1XG?qNf>>Q*wK$hD9~UJz0b z)+fgdt7Ba&1%@#kCNlK=@Cc1hj%i(?EL(#D22cIQRrl9jt2^qDs7F{5H_SgxFM%}5 zFPQ8!aV^;~v;c8-I(M<@I4Q0=Y1bw){Et0?k1U_L4NtX9KJ~Jcf@aY*)i^&TvXXeU zwGwqIxkcOqrMJe}83Nh#vy%&&Rm$q1#Jo2kH zy_=1qCY@Mz6Gf47*C|{3vi$yvfEe88_M` z*WEIdO-tk`vt8w%&M6C3OM2yX*_p#c3mpEM$SyJhL+anny96-SIHOY`GFD0e?>n_? zSBF$cEBZpe<1b8ASt{~*rIXC$kEDv23y<(;;&_d&7e)|fqI>oIt9xE~eiZn8#FwkQ zMjUe4;aYPPNyHQ2l6^qci&`|toV<66j~67P-ozm3t)2A!|Cj_UBo>85AD{LqfFk|E zuR2^Nc|tB=TSxAeB9uKH&!G_mv*CL5zebKi_mDb0AO`~}-Jf7+Dx|3ZW7e&L4B{}^ z_|oP+80e97aC8+V;@KA<<`6nYw7#i%e1T`@vGw_h)zv<#ScBNz2Fr}Dxa>h{*{spT z{8x?cL216gg2yL!^m$I=op(4EL5s3F^H7_OF2x?SL`&r3BH@P2Jwt7MY=OCZBDB52 z>uIr#UZ~*C7bm?Lf;3Rlq^nA~2h?VUsL;HUCsu!~FsUOd-6NPWS;Zkgu*NRZsKQ=J%f{ubqWz676=eVx+88T=6vQ;;RGnZ{Lojm)5@9( zg2Fep9Sm~cH`s2ckJX*|0QJ*6YJZ}RZ$ z(U948yQwK7-Ss{Ozqa#1W-hWj;?hU4ZmYPTLm&AN`l24_t7gQv^&eOA3!iR@rnXko z2z5}=;LfoYPxovI$5BiIm~PT9L&3}+HzF!1J?OiGnpuSzC~EMxDf8V9_T8ZIw3fPg zi3Sw|+ATUlDd$nqu+0lrVNoj7WLrhzW7$galwY|iVw=A_40S9TFR5gqOnzcEhc8R1 z$Hm`#X~=QAPV?BBXQ`||Oyx2Pd(X!)WAxF9PQS=EkK=uA(|Y**@%TqC{)v-mW41z( zIgQmBWiy&$N_*Z##V&=?as?wB8`OV3cBy%5gu-Zw7a8-|fYHOY`(7c%s=UGAg0kUv zanZHATzR=?8i{Mfqs52+G5O@zKy0dSGZ{>d{>m5}c+vTbtpvO;Z}kSAHILX+`T0=x z5;nbUbb}|dXsshGXZzTEZir3i&?~dLG%PCk&1IFtMw_Opd{I@sZ23WISXk6`B_IFo z9SNcIn8pWr`!vE-s+aufVle-!*&R;dKzOuEy`khSeY2dzbZ_*i8p*nfh@S zRhsr=-Eg!@B15U55WBLx-oID2W3nf9x5^CD6nZc@UO)PxZqEFZcuzr5J#D8rJnIVL z_?58UN{9d@mSo(!-U0gZsdsK;&5gMYK@)$--J!viM|wU4psJuMbva2^5pB`g<$o4N zre_Eyh-7#KqevnHXtRIc;a$PtlZ5iSmsUo`&42_%Q;W;qATUuhqxMC z)5n~zM|*J_)V6CgN@_>;w<0qGXfN=xH=BRB_n7(KI@QH~h!zZ(B}E7{OlW-!y@J`m z6)eUy`1Ibd>UNnex{+3p_3`+Y<^^uY{&#Tn_xpS7pB5j?dB4p$8ouxR%(UGjWBrMk z0tIq}PEU@O2`=yv_0=^XUo8EPNx0zf!h^_=nvA##(-E|a!y$iz;NF1DQfIe;BiVlC zG2Bf_lp123lOTE;&10r{@_p*0>&upanV8)LbS-9X$1rF>5D$Wm(Dkluj^$4axkY*> z@ZuDTM)9$C@f8xp3FP=MVj`Xatx4J^Z;9WoU5wC1g0pIIs7?p@1A)g=_0Nmqyetm? zP)>-zIwsf$owwAo$gvgF+nw^NC-X4~NQJC<1Q zq*Nw25WIFGQ_CIz4H4*Z!5`Br5h_M_Q+n^c-0nTMUH8XzQPn49+3d+)-K$-Z;%6%0 z!j1PQrmAK3Jz%ODe22k|Ut;FiSOw~+VV*zYM)mx7@Q^GB>!_~!?hF01lU5{UUc)Z) zC1BrOtRz65m}#7w_p7eHe4O$5F`2p~7+ZHGFF4%}ybwB|=;A(5n7_qHwcVYZ>axA@ zs6#p4kA=m}$7U3Z2;^&^-2 z%gz6y&&YO?{f1S&S6c|n7v=q-Y0j0-nwv$`ZT?_eSgZ5lUb>b2&6|kj+6yRDg{sQm zydoiYVfM;JYN=XRk1c##lQ`(+^nx%2>K5?m^~$cr-V{~OT{jyKZIz66q9<4Bqob6$ z&6E@^32NRIbvW8X4^!Y!fn1O6?a~&|1?Ay`(H5t46<%|%HM#HjsQ?uCW0tb-DxVJ)fbs)7t zLq@f;pp5#44ZgSSeaWVdMY~kS_)xX*7AN=)ShY?y@QaYELhZQSb509}GU~a4xY@^W%C`t9 zi2P%^yGvmWq>!Tklj+zvc`kq`eh$tcba7bi%|->5GU~*=_A`D|O{I5h`%UP4JB+ zAp%o++b07&I8QKYg%&h6l4~ZSRT%#3*{r#`)u_VHE!&Cb5#Hp_C!W8%7x(W0+yy`5 zzZ=TO&$Yt@XwNcCCmxouIJzx82e@-#U!ZauUn{Hk`pN*ius7NCgsx4VWd@JeGcJ!p zp{}FKd5bjo#c*>do}nxF8u(-M#AQ(oT~VJqw8ZJZ}!kKQ#cV?EaWTU6^t6%&Q*m-*^2H!legtyGcPtG%?i+IvZ5| zE3)2zHLL9nsn>_lMuTB%%SQ3XKFT*D7>rc7vrUe*zm(^&RK+?_WN6WXtdetkCMyGmUsmdLManj%NP@ zKOO(-lXfVfV^prw~GkLg>RGyIHLt}=4gekW7UCgHpV6)hWbvEthu zIi-u+r_7%OQ(HHh9JJC-)?FlK2}=da6tr&ESSRby}Mi*neTi zp<-CMG)`|!UlK2`rQ@qX(c4w+Qhe14L#{?9W`^ix+}ZK!z8`oIvc%F=U^ zof#joNMwXF-4_LfH+INc-5hlPr$%gBc2q=xz$ae~Yv+()iAIfmLeRb!wND$;I-WM+(p~!PpPlba=g5sZJZt_oT zNPS^RFK_wdcwQ+{dQgVpU+V2~T56?HqzhzQek#nW$y^RWnE2L;HSiBB`&L<-_Q9@a ztyf+3yKdR?XIPouCD+>u2I}Lv=IYEjL$?XUi4W`31^K9PVYX0`V4|ua7f1$@Tvb0k z%qLv-EZ2OUdwEPM<+t1#h6(?6*k;(uz1n57OmTmhCkm`sKdiFjoRmovlO{6gz^}`aQ#PZ#xAF3?j;3)8P}DQeBPCjI1LE6Djh|M^w+~&H)bFPeIm=h1 zWsS7{5t3w- zk(|X@sUH+V{)q;bgrNk5;HaF7CcaPDc)SqJojObMp{y@88l;feIVY(U26 zMFyW|<@k^}yDBfwyIB+S$6h^crtsdnx405gXIKOebWk;{0u;+_#lOga68~e$Mue&w zjjbm(d%&-{Sh2HYg9NNNHxD7;JnP%+~iRl!+srq5ft*=R! z7BcKGvW{JXn_MZys07{*xS`cMwzKdFuiBD5s&!{7;;ruwaz{1eA*WA%HAbqRL!}#~ za^9HXdN8!-_Moe3ba}CR$N=aTsg=;EUx1*5t_d_R3VVu>s@0Hftp72Q16vrCU<(mo zO6wPqE=A%)_)Pw6JmP_nxsiX~NcvdCm%FHEy6YAUV z0aO+H#6G{{g@_$c^zHqwvrqOj-)kObOxwEf{JPhLQC(r9Z7v3tT{H;rVSs3&z9k=O zKID!=51n#!`_m2Z>%)#S8|tECdv8N%ls%{L0mca~wa(2WC#cZu7wJl*2us3sIb|wD zMCpP{+nleGz)}HtbYfL!96G;uE}T)O#D`w*{dtAIWmrI<2Aa0*9Y@{a!lrJ!cj%+hM@u6rqJhtGqchuX>{3ntd&7-dVhwfg8Obb-Kw6@nJ zet(Y`f1Dooq62^BjCuF4?{khlLeeV3B~>hOP1F9pr`4^cKyxdKbulG4xsmut|G=7d z`=WKZ!7Sf;H%XDNk%MdFS8(c6MRfa2U`k!Bo|+_d<9l$}pZKpAi;h&7e}!wg)zt+u zh!)!`f8^EP+b|8Gr{c7oq$Z<>&~q9F@E|x=483`h_4{Jefs#79Dxlo24UKrRv9_7_ z6hFzZEnV(=T8``qOgKeOVkX}qhT?iizB3$!EHk$IBte&*iX|q$J*UvgENw`~h@Q*x zmma#NOFGkdEQ0ru+IsKfjLlwj07c+rVie8eR`kdO3CWGjnMMAu!sdqcV8S6bI_P1aDv z(1}J2Ud(@sH$5BiJ@#IeM~;Z{v7h;={-X}A18Po19Ul;no3x$W`IYPOX5pUqVSc;y zfEn2Q<042gy}RJaEaqaJG=pqfS3~>VzgJZ~YY_YILujbNL2IUCwWFGo!bm^uFk!5~ zh$6oj8p8GZu%6kDXrpwogZlw$ULTqT9zrvkzsms4b?^HdONEUKxo$8KA*%Boy`ftX zUv57Ckr6>0{gHqJSb5sMw?a@r!1ZqHzvhFZmW3txm>^DPp%9&boTZZk39JB`CdWDiCuRj@C?v6Ni*@@BTi_7cB zl-6o6rEyk-zJhX!;LOj(lOq61D9UYV?ApS)w*70wx0=o-FjxTwMG?8v1$jKBd1Zx= zOu7kKBy2)!Ee@-6EGwQZa1Sx>;bGGWnkDJ^?q6SSd*Nd_Nm<@`X|83F;=Gck_+6*@ z&!PI|_(z#%ez2&yi(mT|s!Bj>6vtsyZo}LC1hjCGDdpLuEdqmCpb_!Fc8T)d=h!NM zeldlJlPR%He4_7Cr+s~+OWBpK;di$M&rS<^nHaJ>e5t)pCUyVQ12YhKu~OUp#_8nf z%)It@7Tazl9W`&$X^RkPq(WItl|I%gnL3{hna!-~+I!PIiduTrBKWWzBzx*tZ>#B$ zT_EHoOLf}s_O?fMIkbEn0JUj_3l~+2|4EgFExNt0fni|+TWpXqIDS5>f@E76Rq3Wq zsE^LpuhrNpSmBIPy#F#dryItYNJ}gcHg^l2H2OtPEdJzbK-cRktIqlW0j`)@_xREp zBj4^6qc68J-`~y0mN66R&LD8EO}IQ(ATHtvn?7Ckm&@3LAC zIX3f(Q{shU)E;fa{Yf-%|v)I*EF=s0<3{j-D>}#3NTJ9r`oyo9cE3@td7*5=8 zEMIRL4hArT!0)UZonTH!DU?xRN|(`GN81-9IrMs6x*JY2+P=1hf4`4cr}ikZG=~Bd zy`9W>*b^%SlQZ90q3ZG$&V)!zMxATSkYN<4cRy%*->V~WcX^sI{B8|!i(EP@cnZ5P>0rkxqCN$}-CJ-&JRs&O?0gD#w+vpW7c$6F<;zV#p_G zAnE45)ek$OYC%s(IC?=8w3tu1sD%u16atTmV~R$Ei7BHt0~VdG_;=>&^348S zRGzk3BQ~6Se)CM`*c(ibO+_7T>33PK1@YIthUeAu{46q1|L2t&rz)Fm2lpZ8GpI4o z#bUS{PoGc$KbbOjBJ0i#W&fy zWLpzkK?lz#z&N$KZ+VUZ&bI>aYd^Pd%pP=x2;mtQqoae2uiV?S`*h8lKk>(Ti(_vl z0073`113lD2wVho2y9c1@GO-@dTP;K_v|KCvpoL#{k@1g7WosM>20tJJNTIKx{#qW z|Ly<$@y+w;8TfxCzsQyPlE>5xOLc>nvH4=$n`24_@y9kI{(V}b30lu+RcKVE>t zuzmmfGl+kO=hUSUt8Q!328%VEStMy@h;0w=r|TzR{yL`!h$`uVxPB$z6we=~*9l=! z$xX6+ZC3XFF`^#l^2V=)A|vhl(2%tegugwYOSQxd6ZwYdw)9A+IM9ke>=%;COKL=z z3VzX*@{{+kQW1ZMFb(7P!?^amFo#C6ZIM%cRr9K#uC;>iwaB>$Y+B;hLA6(=A>#F@ zCB@gumfh-j4i>d;FG>;b$lITgYqvg8EToGcz4OQxt`>_&JgiumhKN2Z8aV?Aem}C& zOe-3DU2bp5Gt>*r%pcgW8Wzv+xTZ*2>a3@#Uqubb%U`G!b`a)r;Ayo<)3s7Mbjw-d zVP8l>N$%#!8RNxSCuNWGBp$O91b6`aLV z@z|0J<=mDrfYS>jCQV}IanFF+;n_l7!AbYmN-4q5>19v(s)eu|V2~k$nccufreoS> zT&fitHF)1cYKJU}M<6)cz)LYa47E_cNR<5fOXqX(93g!G`6+TIvN9JJ;KDu|w*|=KrP{xlH4mdy#b#4xoy*N&`stBUReo40 zn1D1QfR@-j#PPGtavv>GZ{*0CUhzVV_Tqem(YqfN-+=s;OKJR4WR^AAjuc$FHQd)t zs!~|ek_T-iLiC3HvwWs%Y|KIQwkKX1hUVrR8XF^Z)-yW6(mk5K#C%TtwIETKRn9)S zGVa{cq%GbU%^R40trLqhjnpCBg*{9#y zKR1-e`WrmXdgpdy^Wym{wd&Eg_&cSLm0*QAK})F(enHdNn=L7nfx~gf-@w8FL~ar2 zh|`0|GW5C|*R_OvP}cWh;|gsgnT1ud0{)vt<~HW7_cxnSoRq~Yp}EMCRgaNVgMKn`u`r3=Hxgk~`4cREH^+ntp1&{Kz|?H5 zGa;V?Pa`@I)wz7El+GV;Ol+tzWjiRK3dioqcvo6Qk0*nmjxPY>`SAvnjuQX+6;i4; zqd43!fYj9orT-(niW^zSnV$~mRIIg)f!4ty(wpfPCph+Bg}m9d5P(GT7qoy~@V>bt zSV&ZOO37WEnUJvF+DBM#*T1P>c#2p1>Mq_t<2EL>?%%;SA!5uHpX;O;A|UJ+dvz=5 z_j#dea%UK`_YJ$`7VqNHS*=yX>@^&}Es|QcBaJY*4wL~8hhLT9v$5R{ zVcp-}Gs5rP{M5#Wr7{BRM+G*sykb>7?|a~&JIaFfJ*d}Kh+U5u{*2li_0cj=-%hgY zHt+im{z0eNx4Tat>rqxNvdSMTBlFA!SkCNFo$p!$tQg5wJKnjBB#@e&oAsjfb_RM; znmH%?x8k3)^tXZL&MdO=(3cA_SrojIZ|AY|*GCUzi1A%^OKF|;2YE`m0z+O;Gbk}* zUSSh~44T|npObCZwIawX6GxrK=F#NEfR?A|x;oHzgaH(q){|=GHxmuXBR|9bG)7_Ss_9kAT<&-GB4LQhbcsm+hBnXM96zmt7Ad+J|zZ?7{Jw+Mwv~q^? zd)uJ^I`V^4&|RBcF|-Bvdwgu>LLKL!3c_ad)~Uf##GZ&U^%et$GP2dAWm_;6A|A5d z)pRq9*44(7GfBu7Jm!nq`z|d^v^iR>nm_(}VeV`Dk}r}L%x5CY4Bk9pbyb;bXU3_- zIF)&##a=O1rpgv)p6zh>&b*(1zM?x&`#?a@zW4Z^c21K@qsE>tKab)3tJV*UgzqGu zE>CLKUmJmv&ZcWMIrt9&M$T_IVnpJu_{R+JKgy{FI7-x;!E$bU?JsDGdm z>jTNWjp#)``->W(jBAYTlUfV;rjmK*5R7D~31VyW?`X>MrR}TAt9|M*A8x+*XlzUBV$Z$FT1oR;ttMJSFxLF zaJ8>{b|~EA2|lVW@6CSqysesyW zliz^#>N2j;o30U>G^EsWauxMWb_cGjDd$m&568+-%6S)8m2j)nT+!BI?=LlB4Nw5CrB==^x3#q2o((!p{mE0vtQPu0?P9OC%D_? z`|!PM(B`bUA){AJH!fc+vhoWlzo2k$qr6Y|<8Y!`SpCDf`susoYHCLf{KtFD+${o| zOEPD*8u!50eka_DBn!M6eDAQ6d4I2?)r6?&=Sl8u{_oXiG4TDk7;pui3G1EmUrqYe`*^C|Ks z*BeCwcS~+^cY)HVb$U_>NQ42_(C@fL9`utap}6N$puHlE+xDC>$@%Z-%m0% zu0P%0G4v{5+5x}Mn&WXfo{qD)KecBKy1t&MMK*RYKavnjxe>5T69e^KZ19^2x{6)H z?rYJNWT~``H=3j1e>S~^MIs;-e8^3X9PQIwbEV!=bJ4X%i z)puv}B@>vJm;70bI+K%sdWnc;0b&HS>-5*`)`PLUwu4Bw5-!V0WV6#Yn~AS1)v-G? zeGR)he`S-C&IuH&3#xd$9qRxS-FMPhSYo7gKJOND@^eSBA4ENe(7lq&iqXz!fOp+NZ;czac)xh#0G zUDw{B-C^IpL$jm=#88G2rr_?KXz(-j*uSB}(U4U?DzJl?Lgi>vQAkx`~?#1CQdc$Zh(0>wM)ncB9I>ufG8I z`tq&pYtCzkWib~~FO^r9BJh8;lmCe@(4Vswo(DI{oiZ@s5c>Q6BiB7><~*!Mz;tjp z7L%R%L9MdpbU`#i?So*`SrvXX-dCn8{ytxR*d(8NVfGNW-h+YSc{2eBZ;MWojGa&a zr#*cY#Aw4!z31t>+BX+(n-TKAa?kMD-sx<*c$V$&`tyimJ7wsnsi_k!H0op+qUjV6 z-n987T~a*Sd|q5qm+K#;E~wTcTiQqD*Lc;*oS*lC(s`k+UzcdUGC%&AZcZJ#U-}a# z-lFKA@909gsCGHU{A=x9Z}-I_Fe}`dq4WP5a z)uFUr@;36Sph9K|C;OSn&gx74CM;YbKNYYg_AFkU<#b4+xTCiEzWs%ex+E_=tPACr z;9s9b=VJjitCG%AExJ@mtpeSxd{r=!GRvy;*YrZ8sYWXN#{))}*W@x61R=PTISa(C zBP7g)%ExkDwWSEFAm3^?FOkSPL}tnxUsCFqGmuAWS@KX7nDefb2zwF)-dBYiY9N;L z7H)PWSXWe=MP8@acyQuz>~kgYj5p3=5}&o44Axgy0U)BM<6g`wmIx6llw~R;M^tdZ z@&ID;J(! zM{n8EjA8ye<3e~Tlo1H*5Ky8Kxo+d2LZ17Mx!<~krQ-M}7bzATiDYQWwz*xv6AM~l zsxGjK=@vp&TOAJu8diPG7>9^wh@}XQ3}5Z+s|~q=D!=&WKc+>JWkoA|ZR7MO$XpPC zD6&Ki1rXovg$@6ngdxmPG7u7RRVFfj>l(DNOIQfwHV!OcPuKD%wJ28&#Q9gaVci;L z%trai5mKR}_;ZSa&stW-`A+8G>ciF#`qW@>3jH$12WP?xoMOdHwk#Et;n3wh@k5@?sf_Po)&iIQx_3qzOm{CZH3qzGs9R#++YC$bzR1R^>=Z zt`EZUD1zIrwXEs6L=Sk)xa#Rv{ly!ygIC|<*;>RI137m^CWL9^Ru@FWbNXJ5S?)b7 zK8S}S!HU=Skf<`-QA)W*OYCv@*S=cR1%4^U_W(+4w=8_(0Gbh@*h@oXU{v;SGRcC> z^3W^^b;*1()TwCQKc7$KCy1}eOBLRb3c;@?1)la{hT?BJpR)izHaK_vNs!dB=v{}J zcC0muC5OF^q*5@ko}^!y^V9^J`HCtH&Kn3-UGOKC-)RU_Ja4FJx%gP5i&Zp zIYp#9plx1ask@5E8C^wk_IjtL&Mtx@S1mX{~Cq3kW^Esbb?+|A75g%Tc3JbUIsld#Usu z!$x1H4(#8U4%fDX%R&q46|M)+DD!o794U)Qe+mpnm(@V(pe|@8Z{ChFZ|EJDr$b)~ z>mg(5ITmj)B~wkSMXTo=gu7k;jmI)4Kr(*{x!oq6j)PfE)`~Av(5uopb*$^O|rigO-olM*!nE1=H z*U@S`Z70q)us7JSZ-ucr+`E@|oGFA_tPHknBow@ibRVnQzZEz5uIk+3{?+SP*6>KDg2k zn(KESfJq`>^_tJRvw`|HyDUzO_3g2_Dl&B%C>dVBvGP)6Mx4Ic=0*EoXs5I7x&Rfb z){KDRmr$SSD;JKN%jj%2A7%kQvy0sKU(FH-egdyf?t~p>+%GdyOQ-I8#@{p-@&KhG zXLN7oC+8>Ch*q!qR`mMJHRu{#@;NuJ(MqlhZ_iLHa5P&mC*3$7;oUQ|$m25F75CM? zj8X|{%sYPV`a3?9CvYP@2b_8`-G6@Thd$5EJm4{myJ} zaggJqU$-AC*d30(tBnFgws@VD;0qmIi8K7|p$1Z}V36hhW0Jc`Se(=OcI#m7cB5of zfbCJjzK6zQMI_t~Jbl2w3^@=Z9l4JbU)0#3HO~FkS!|9C*1gXMW%R}fQ^~&1GovoO ztvg^hZ7@gS|CRk(X$pynAK>I@+PKJ*;Y?+Vw#;DMbac=_VLg9J?%mqe&Qj*g-uqJ2 z6bKnQAJb^#?5x{I@428luMZQ$L$iL&*&6-E`jGD%6ya_ipY{^8 zWe2s*HB4RXNXL)X*)(+OOS?k`H@3%@EV~Qj%1R^CH;$EW&5`d#RpeK&S>!5GKdMF- zF6Nh%`~gUgYs1E1k&@dZP`-1!GQL0W@sop! zS-=Hrl%9*JgNxVZq8IcDMc>vR4D+ay=X|Hn0^IS8mRC;X?{Q`rODDbwlNN_>P)e=` zLH64i>0uhHvX^F^aJO9x-)PH&}Sbypyw-OhS2=cw|&L$Kt`67;qKB~ zsqIN+5j_;ry=yqQ#FBR;f>I?FvF9LK^EMYSgu3gGmK=X3@iL|F=`E$uysRbY%eh^Z z4BCY{a`^&GVu?T%LQiq6@-B}0{X1of9m&Od51zZa>4i;~^GQmyul6J%9IuF1RZ9d`Em;K;<3qrTC}4 zHjZuT>IIB6t^1rA6aNQly@rN|>90dsY9<^J(@2J(60Ji)<4QLsdZ1^(^y<6T3ju3U z*GuDb`7Wbh#aSvj_S$feGUF3!-8Th~RiLYx+;tgA`7X->w1*37OWw0Nzb@c4n(KfG z=hM-zb|}kbF)8sGL+%lp_MaRdRQ2C&uop(w#$r}3W=}q_MM>v24(snHa^w#8=Y1aY zsv)t5mN$TaLMDi2yK5FcLTtsF+w!}XskS)`Xy4;g<&S_{$hxfzJ?%G;4 z`vObl01!YMjjI6#ZHXT7M>TMI2JCxog7}Yl?De)er;tl+_cm2)7|m4F#>_%d7dOo- z>`B}i6JHYrJ*eSxW<!LUNIG$1DISJc5oz2TlAa?R)#j1*_l)Ist(k)So``D~Qr3 z3hi%uo%v}QN1vk6aMnZd5Zs$J9i9)Y80oC?Z&TJTKE*<}epJ^7vW2#9q~uFns*kip zyY6-GXdnKKPFbGF?9m!h%EpWsQ-cyM^V1sqy#hgAPa~#FHzhuFK1WrOs@Zut`JIBi zqJDC*Vq5cUPc|1WTfwNL`}ja#wUBWov8p}!wl8>vSHj)j5~KV+bekf0I)Katn6d5H zgV+affBO;S15Y|z@_Dm(R;RKWOi2U&+cBvE>vdCa^i|Z(S>pl77`g~+pubnwlse89^qjNH8_qB$Yz9>awAkduS0p^F{^Y79G^ald3-n8zm}8d4Y}$>HPklSDJ+QB1gT3KD#g*+Lcmnr&W9`?*Y~1={A|6;&&W#3qJzf zg0?2?RTR;dM!qsIFyGAaV-?F4LVI#S?zazHU4p4dx{kj0%_;;a>b3qb8-rb# zj(_dSExZhrb;9I`2`Np(C1PdwCMzoo+`Qd2um3fH?b%fQnzW*O^ETZKZg!ey@~TmK zT98SZi&D6RTU4syLg81&Em}u63VVZ33>GL(whJ7zwEPZj#C+9^1qCf+OlhdA$uyI1 z|8(e;$eq~PvhUfcW4QF!aFqV;47Y*D9tLu zc&&6wJKL_A1BgG+HJiU>{4S0$4sG7_0S{6V1>P}~V!*WPFY7aIiRB#BvY>DHnxr5X z<;lD@qk$Gn1t-qzGDUW>yaPvqK><-?!eQckT0q&3gfi<>3hTchMvzKgrAtGJ_X;gR zY=77__&HcjtlouJsf~LK%Rl@d6R9R!WAG=1OYP{X5gGh@_#R>HD%4f@pv&Imom7Ze zifVyFdi~6Bk0hx9H>qJwCSE(PEu6VsohYPFB(a4f)$;Hj)gTdLMWczp4eSklXPC~& zD+u19aH%jD-uZqH?Vu)1s4A8PNE>_0V||foOlF{Q4U1a&0ee{;@#n*qD0cIacX%~n z&%|bzgh~;tgAA*fTdSOHLM>Sg+i&xFK29(o^dh`OGn|&Yw+C0qdx|ZhPVA3&I{~ty?}8FmB2RVjDi@ z@(93l`N=Y6n@F*~REd$3AwKK>+6)QcxBG5EW|9#o?@wfh$$SP_YiA3v8WCdi*xz0N zIs|`GbrLR$mO|+_Bc*n&&9ANlyA~78y@^JXw2TL8*7wtXJZ18=@=%>t9jn)9NQPHu zzRbN|8$;&pA;a9!qD!a%L#yQLuw1UQx$6ayL+Q!@$BHC%ta$80qvWd!epe5V8Rtrq zaZGr~>$RAuKD3`DF9m{fy9jg1ZEBSf)>ZMIBWlKqzQYl|1-c+JS?}ojmq77QhT^`0 zPjX!#g>~GLYuAh&&_e`sye%|RHY251%9!3363a1`HhQa5xA5sdCL|Uae5Wjl4X({q z)&o#k0ZXxD$3aJ6fHtV`!^F=1HT@Yq-EF;?fHg7DdEYwt%U)G!xYs36gDpYlq zWJCr)ow;6$0Y8d`IG1~fjBCWs7`6!_jkFX(I5~>`qVjc?5{u-oi!xAF5ccupSLnqI z|EHq9q^oWq)}U$B%1imfe56=HmTxtTG#8s=8eG+QgJ0{fJx-K=_p$oQu*PRhVK<;l zV?T#$A>RUA77KF}Dg02Yv)am%<8?Vl*H|3CUSV*~jB5oiHgQxT{#))prfKu-V{ zr=-6*<`^n&(;=r}F>KWb==lrovUgeTQ-jC6+C9r0D&~em-7nZ}tFo z_aWc{ojTRo#m^rujgX7C3_kz>?vLZE$b~*=%xBHY(Qc-0l^HZ)qT(t29jQl$*Xe z^i!ltkDZe&bjO=-zT-Ww%uf}eJe$n;E38lUURfXgS$OCS1M)#4n<`^Mei}D#EcRCd~SH}8W7+YI>?znnKB&^^=ufqNpFZJPgg;Y(O4dSot2glJ~F+ndT zpkG97oFJQfRnS#Ne*Nd}dx{gcK5r36HvdPd*$b;=##(@pNpmfne(y46)-NHm2$OE;%pR+L>^JgL*hm`~|;>5uqZLai*R~7>`S=Y6^Gf-!3y4t=JJfu@_?|?s& z|FYX%N4|dJ2?h+?fp4lmdki(SSe<}fjkZ+Y_E9;|L{H%K%);@1Ei%qVW3TpmtWJwm z)PM--7Wlnkm`_3b^=8W_+bfYid~uCc@5=%@z^7IWn#9nQOVD0=w;K4wvCjG4e!Ubg z0a+XWVC5pAt~kBOL)xpiQL(9YQv6XE`gl-|4kx5;G#8hVqy<*DjyFqd#8Mey@%m@m zCRk~2g{h%+y;z%nULiq=|KsS~!gN+RAeo%64t`gl@t8yjQo4G^|#IkI8ordMXd$T>yTQRPqV z*CDLw1C`b${hPf9HPmkpuU+GPaQi5+aUSa+$JP`643uv=e`7ez0iP5XpkP^@!0`Cm zbu(wv5ADQTnon7MJbo@e#=Gv1d8T=I5jX|F+v=a-T4yZ^fgQ2~=14o>C~iwiXwv}y zph-7>VmrIhUCL!>px{CAqMJywag za?KsS74!j3G!ul(;)g-$3A37PEO^Tz90qcTkMonbeP#4aGRHY|ey68Z?-F28!c;UE zZUb%e-jN~v$Xz7X`zztI8?U|%-kDSKw<|BYTE0=_?mMi^#(-Y-`%5>Sz%KzQ5vxPC zTIb;2>~ku+9dpzNGq-r`j#g!h*ckE8_6K^4C;X~8v`0Y{@qvwy$abW~Ho6D=Xl84b z>AEAbgP=X!65Duzgf3ifs&>UUcjf8W;OfsM|JZc!?Hn(e^ytpI1c%ZN)$`JlaAVV& z_aNn!k?wMl)X(Hi*x~8kd9F^U2#_D8~=XzF%~UiaVVW`(9tRUy@@uKrBSu zhf16)fxoOO*FS2dzHDdDUp4-7q;H`hyiZeK6OJoPfEAm&9<)3mTDA3m9->#7h)i1b znyxaViyXPL#lOln7#BSR?E1+?RNj}lFsZ?4sJwpPZ_aT~nImu6^Hstt;W7B})ZC-x z&r>-W^DTaZfdut4%WA=B7PP1Hlkv2{H}h*K34Wz3U2)zQC?NLz#vD6yQNLW6J3zU! zpl(>HB#`Rq)90uvQO}5s3Ic(b=OZ-aVv*%d42a_V;61S6ZECC2nZr)uzAWWbx28=kdVt5IGq2Bq0mjJ9eAR= z=DeNq31XF&MQ#=jj7;(}5=dCM_wWp8AMX)dp@RP7^}B>&`g%!jj=;Y<!dEW|+kN5nY!j`;TvKz&Cy zu~C1`igS)OP+wfGC#*3iI)F%p+qP)o^Oz3yuksS(v;bPB#5DZ_Ko3u^H3o3iCjq^6 z8($B8o3?I2^571{#ZPXlF!6+x3&Jn(xouniECvuDVoV8#McX!E07-Q8 zu?lEsxa8iak?~fWio}o%YH@)yp9rx7tEektoyQjtlCR`@wt1{Bq*v*A7kcu>EQlQA zwHbNlVh#nlg(-5%FAsSqj`~5-^da~|ls=t``BDgEen-dV5*H)|L$v9D%TI2e4IglK zeB4ED3slB|w*qGrq}9RJ-%l<=Kf;7&%MbT{dRCO{jSsJj0r%5tSAJ+%NJ)eBN2P-R zt`aT11v+a2h4Mufl_tu6?HUSPZiJ1KM^=ZCb0vytH7|HvVq9gi5SEefICwTU)qJy= zd|Qkox))J9*Zg+B%jpC(!xg~cqtU4wIO=kNloP5)d`LzKxb=Is7rDxyp{{`C3cxTT z$d>CKGW~1^T|16Hs9;$ds82hgzK(yX%St<6L&OxYLd1}HWA+FEoMLX#O)|e0yua{t zdwxVzGI$(&n>^`J?XaHHkvD-D7ii?%JBv~#Tn@t zM5yoWwjMF-7A{DFYFWI^rH4K1xpWn8k_1OBU`YK*->5D}!IT))a56Gp*P2;BFzP~- z2FqUJEMMl~kYA@JE@cZ;il~Va{E8>*Qyw&?+UQy$Z zCBcmY8}uu(;tSz-Jyc`&h*uC`XvkbMXK9wrHAZrAU4srG4*bf6|IMMQx@*(`e=6G2g4TpthqpdrZba6;>N)PO}e&A(QS`VDeXkF#lO zXVPOL6Z*B*e$s&%)dc@AqMwS#a$lQsX}45kp}p36X?s7Dsw9!2z#Y3f7LN(EwVF;E)pc|meMLy z30}rarAX=OYnf-W%)-(N-lT2X$+*Uqk$5)BY2%q%gD2PLZ?n?i&#M~l-)M{~kyL%y zJ8BV$)B!vBPlklOR9}JduhFy56lR^y*Y~9_ zK|i)oc+0QQq&TOAK8|qo$akCIvOYm7^S{o+=_<3oIe$tY-tdTWy>kcJW{q=qu?=QJXj0)|dbr-St z8pv+0?xX)wr*W_$&oFfrV4Syz6QHI^EoJA9lgOc@I?mBzI zj9?2qvDc^02;t)8C?c*~7;IcuR^rt(vh8kCR%pTMHk3q0${CNThKl#vDjPRFzYuf4 zi>MI~t|v!zalIZzKU>59Dw1v}vM_l**U_t(xaT7)(UQ}n*@|m(vZi9=a3bnI)q8PI z4gIaieHIi0JH(68iI>o>)fMcf-|c=+;A$UVf>KXnC2(`oHDdIifAXi`grC!rm}6q% zNhmh`r9=E*wajVBqZ?~a ze@*CiA7{OdC;cj+u!P>^wC3i}Zy9{KsiZabb0rY@?R|$v)=EP>^^uVg0g)eee6#22 z=Nu>0f92*bMRz)PSwGy?6=0x8cD36t5H{%qN$`K2rg!2m#uNgNJGzczIS z;0|felel*a)sJ(Cd$s)F3i+tLBfMS5_(A#W$XA`;irT?H^MT38ygg;Z_R;G-KHt1V zUvixQ>;_t?X>9+G1JvCyI>eH?HA&9tOVt+GGC1VXAc#!PdZUH~UH3rjRn}%i<1N0H z-WK9W|8q^}ogewa+bX}cI_;!#gX>wynfjWPw`0nrou^CW(iuPQ{@}s) z^i}{se+K_EzV*lTme@a*=+3E3*g3Y|_0|74x_g44bwd;)6cyFu4^6dCmODR~;|AR5 z?~grn8?95Azc2XWpPS80?{o2ktwg~L_$j48qoY9glNAYzt$;w}Ww*0Rw|!8rZnkd9 z7#P@Sf9okF9)BRJPt2*NufkB9#hkNqg{3!8!`ts{^4d22dw)6D4$A0<*t!Vh^m@|f zHtpZshZUC;*Q)V{^rHH#H$-FEo-40SIdia__BR%;sL-{+_$K7HN7lCgTS8~skffj1 zVsFC_+}q3bCViVQRD+@!SjVqFv3!;EX1ojmgDn&ndn6c@hrz-!FGp?V4y2Y48#~|f z`JkXG$vA&G4>cd)BY1XROCM4Xo$_{_%?w)(U&_&SDfCBgkFvCLtin+b5a+gR)CQNp@(rq@c9Vnj5$eS&cH;1a#jl3`hBagazUF`(qg`NJHuxpZtD6;?iLi|`oOcZASLf4qjo@PZoBR15URqC#qX281mU|` zJg4?1@q8FDS5Cu}D)F_aFDCTe6(~ihJgae%`|D7X%j-McyuV9KJ^cS0y|io-7inZa zJb07FOgKHTfn11SB-SdMk<8*_CvR)W?)n7+!nI`B(yk$uC$imM%?VacWIg{Pq#H&td&%z>7a2BcaK*8h_=2~=(n z4WGb^kRl}QUstm`EI%4)1-%wCzRSIbVz*#MSpMa%C3-_WK%ySE9ey|fS8@pvUwxZc zjruz^7mnSgDkecnpBuH$AF7*t>WcVsecJ{k;8{Umk=pmaWHG60@JizCccD0sTF_lR z;-`Yjfs!3V>K6xipS|;gNs-pDiFy^inf^xasHu2 zez=Gp|JZU4AaVbn`rI_*#!t9s15hnM4c_W~Sa%*rE@$+!Er_{H*=0pDxF_r(46IGx?st`mZ_j$Y7Wz;6t%BZlPg?Cz?`X=Bbj6#A)E4u4$3EVr9G`nHH{R5@ zk#wY5!wo=qZu@xk@$Qf*I*-icRnm&>Q$E0m2SC^CwY6jYStSBMy@MX~KD42umr+KQUldlTMu}~&Z`KL3 z<$|d9?#^do*^8d2Hq*toCzg;f1DTImo1?E)FExMn+6S@)NB8cXVueBmsDqczd487* z@pXp-0$;z^q`#k!&{TK^{!_u?*DhwtOW^`un&dt&DmNqiTP6W|Gwu3ZEHz_#U%N@* z9PjJX0KEV&UAZIyc%)o#p!ue zVmJ!60X>^_aotXA*b)L6dC@@%QshQJiOh$8iU23}Z0<3g$f?RI&whdr*|+DppLg5= z4E;N7g{Vw!s=ap4S4&%F=@XiyHd|N0(aYz6Q^s)K<{h6g6t7c{g-?j+soQfn5rF)| zqufm7$3Do7FOW}b+*VvE_7FfuiZa8a`H8}Jq*4N*O$wWXX!R197hcYJR?Zu9Uo3`9 zn++}-pk0E%KPx$`XU6CopU4*nPI13`eCa(x3Sl3qZ=@q51kKdz(v=0P(0|tQyWZt5 zDt(gYkT)mmYVmTTG@U@k8&}h#MBZA|-KCN)UOs(KIW7i=2KDhshv0Z&J3dkuC8i}= z>0|Rv{s*F#tLF=p_sq?egmd2o~K zEl+%;oaU>YfQ5kEb2Z0F1t|UD5Ov<_W>%+jI(o1eW5q){De58G1$W|Xm~dzz3Z*Bq zKoHt>PGpGKup`Ghye5=D*Su=UuEJ0g_t?O9t1)k-m+JU2fslvK)Yri0{3^{G>#qBw zmK#kYQTnxJnVdE|7VC&w-T`0%Xnj;3TOU_%nen@2(~WXkBYG`ZK(-aJX&QbDOEdqH z*IqS&^(&Yc85uxJ(`5(TVWd0US`(7D-;`3ls&5I?3avut#Q?wUMYkM>uSg}5w)vPOB`jkK9 z%da8;rOQHI*2VBs@$*y*f=)rf8nJs7LGy1=`l%dtN?#CFu6qFiI(w*k8_}mBW)bDG z?36gF5u7G?4A!hCwFKQ-gE7ZNPm{Iyjl?V#R4yk%?Bv(yLE;>{j@z!8i`Y`D_ZvYK zy1*fqx)@O!2IR{2pBio1ejy__ETL|;7y>`-l(?W#!(74L^=DfSE+k%Fad^a&@;WQe z#@t|n{}N3ze~5qXe4CY;7t+?FxB-iQpAp=EK4+_ewUJ-A)NIR-{X(bwk3(!k(Rw+T z2h<;NC&fDge*hIkmz(%C>YeC@T$Lt(*W#MXMk~I`HamFc)sYdraVWDG7QL>}1~$XH z6z6yo@mQYjp24}r{t{>9)kr6CZ63{7j05-_I?Jn06tEWYN!8n%sJEf=GJ)N)y_gnt zs0unwo)H|La~tQBeEF;!sW7eSJH8%VKnM%iXg*bIoXSt9omL7xJB`B;CQTz^6eEl+l8D zarr7JU+i`CB!7kuhztMA4I$8KJ*S~YkGLYiM5MF4kr)`g@rkA&x0@f=G|oS?YHAU8 z*mCz2{j!pYAMcQ>GeaXO3moxVG9y95=U3wH8u2Kvz5K`fQ;Rn}s>4I#aNuVXtRD}Y zlhUSt94r5#EJ>fOhjhtxeLZK^yrgxViAa7R>U;wllLx066C-?TYg2=<(6zw)n}N-H z*Yi;c+KN;7@$^<+T->pgV+`_cCc z!VBMy#k;Oi4zupFBqPcy>U6yhqf;xTwHCe&X|qb@>b~B9cSd{=@p@O(^%!})H=6SA z?ZiZY@sIo2AtUdVBdUf~YnA-UFAz^5*A?P}A4Rg9Wpbz=1s;(Cq0M`8Xb*uJH`Iq` z2mj-^HTkM);*cNyDgIyY)#uEFgX4en(S@#{>xjz`{(o`wy%M_9o1ODk=Fo;$`3BZf zW-b96@2?BS<{Ne&C7g@B_P~Ts_&4R%mdgAy;l@ zQY0R@%3Wx@@JHPxLjSvIt09?kvUardzo88?+`p8Vo{?0Y9Pt)YT^1@q7{6`*v=I31 z*688Of0FXHH}BuP;#Qs1HzK&jKSp_Z;Pdn*Y_|~jOZD!TijWJ9j*q2A{vLHk82H3S z_u9m1XZ#6kp;u$WeRS36#NR*h8tM0)W6J|4FNijMV0KYg!h(%Qul=id{`1P&zvrD7 z26I{X4-{?7_$nnG-Urp;nx-(mSK$4X^N%->ieRNcr*FRxd7R$ukFy8j3rg1^*`D?>V4(B`5?OsK32Y*iUS`wf|u&A&s_+6KtAI6&Im0? zXlVmHZ@dv{lN2;mmo*m<;4`+pBInUs(%8^1xD$;%=b5)~Cb9Z5i1cH@-EAPL6Apbf z)E0jMGv4_O1d@-bG?XsGqUcsf2*j@2-x=}1g?HfgY|AiSAJYfOYe=or1&_nhGKVIy zj$-*rZr4y@rzSz5T|dehRhnK=6;#h}1u4a|uy&3LMLOi3aTfta3eODwm z)njDs-r&n>N0~x=!Q@8&-G=CP^GO5dK&v-^6ya~OGGL4LmFrI^?Q;ES<><6fQk<1h zeR`yraprar+S`||3(zf0((?4qY^YtAXZbDqBz@u+vX5Xg`#7X4p`u$=&(d_}i zptGJXt`%|M2`x~lV)r@ssJ7>+)e2D|ltu$HtN-kQvuN5Kx{mpy8k93!h);IbdyyDh z<|px^HB-y|{0}A-C0G@)CPgH8=+DOFVC;9K4jfCzX`QZ2L7Fk?``2y78#Hei-Q3km z>q*XBO`PcI4Ivk?9z@19kLUL^jy>OLFJwljr~ik7|)?VYge>q1#K{lr|@)B6z^Y>i;coE3fZw`a@v>?cZRSCqz9k zm7Kv&W!fj+qf4Cn*6z2IRsP4txOLX_v$?5TLbcGcjXZs+rX}Lt->H{#Gci2_Cc?;> zDflb`EMEG&HDSDb=&MhS8#@UIsj1CfF)V`u}K+JfK)__#ETRGD?7F zriW@qBUYdUDlnhTeiyw=E4GWCxLhCBy}<`0m~QrUZe!%jv|c=la$T9i)1$DfVmR+G z*ZV&zdGS`@IsAooJMdh?JkiP(;JpP>?zAX1i2+ExwD)Dud*#GlMhDM`)Gb9u^;lr7 z8auqQCX=vd!#^|>3A8Rb?P->r@zQ?<^;l)BTyoopeHYshoL6WHzeIJDbh=q1HoaIn z#2Mi~+;ht*+IOj2*|$~8wtU-07i>g~Dv&;H0_(`$=)1-2O>p;xTUn_*kUD-vXb@s# z3!b4MzjZAZPi+T)B;@F^+(^`h>BE%F)NSvS9fg9q=|-{rfF@MKah#$K2pHgLU$4Fl z?S20z1KWr;{c`RLAO%%pg}HP%RWE?J{o1~QJDFXl)pD`~WpDZKNC=4$H=c#&>qIS! zzpoABfUn{{o43p~G{i51fL)=nt3X+IqwDS6o7nae>rcPkoTFWkp*j=j3Ot=OseRj< zkF65#|M;S1)4MfA`^IXAaPfF%yljiaJ;;jqv$>U%jUP|QwD{X@zF1aXlOmA+O)gY(J3O2I;?7Z%B=#SiX2X}8*mN|;FOjDH< zmTLJhUxuw;au?0xJmSEQ`H!bGp0?gZ*N4AGP5<(={KOGHvbPIHFIBQx+Q_p?#F-1( zl5qB?^wCoU^&&SSnxwl~Bs+9tXP@aE+oJ-~ztE$ax<4g-=#x~vu3IkdC#wEX#{TJt zJwqc+DXJ|{od1#9Aa4CnlfvdVzd4+{VopY#%_nW&EOIThz^b$z{(V8TK55^_1SyH^=x{NX*`oUsAkjo+k_@v%6$=69SjLJ zJh0-YD#I5;c>v`4f~M2PqgGD=inyE}FsPp|M}8xSF!K>@DJ`-`M287pnb66|l689( zWT|_CB9KZN2`^Qp>J%kmaju?aOII8PU`J9&-ud3(r@$9E>AQ$2j#WGkDI zx{mKiUeAhY^jCr_^og@&K2+;ZA>xs>;|0Tb)9VYGzeAN=h1bbUkqU0T;H_~ zP7|*0;!%_v@2F}-#E8ulS`*o8zcjj{<_3_A-}CM7dK4i&K%QI>*ZUtRQ8M-klq6a-PtY^Mu@*{%-TCtW7%ju%T+g`~ezmQG&|{MCTKS@&tL?Jb2!7dv^26l~d+pdju`2Vi z&%*Ty0d`3-M%5N4{ah@g8E-00r*)l~kPyusw3A6e z#XK3gJSuUDdl_JA{A51ZuyH&^RffCpHhxNfrILJQ*-dJ~!wAW)VpikZa$Q!J(;(ve zm}iC{a}#mW!*Gq8^^j(10TJzb_=zgtpe z@e34-b^z--%HRMtPfYA1?hm>>oYs{z&@EZz3$EeF0HvK?A32Nsq|0+rhJ672j$BzU zKZp^_+T;&+W~NR4b~WU{O;{@wesxx@J&h8*C?u)yNtIY2E-( zlyQW3xj3xMwfXY93L}HcywZ0`9idC-Yf?RX?{3dZ^wja=q0QN7Vjb$Wv+qg`E8}sH|aefjG!MVz> ziDiJ_?%aa|%cHI0(|#_jbQO3o$hNeV=*^4Z(_!6) z*l>GP;|aahwsRIjN1XqK(E$12&+j@Z)HyG%nBcJNh*{YZpL7`adD_dAKC&AkXxb;F zeT)Y(;n0KiT22F*fYqG2jDNX7^h71k<~Q1`feP8A96X;b+z(NLJFA=P)D(uL7&Uic?a2dP^VZsnq}w)lviefaoeI6O=elvH&L#oFC;wqoot!xHpXr!&{c64 zY`X(-lGuh{>4O2NEoPb-rZv6vI@uf8u{ecd-;rvoH!1QRF#Ey)t% zJC`tOJPr0&f1?#d296E8t`$WT7az7kQYo-6@AAQ$P3q_U3yo|SK5Y@5#Nx!~y0Y)4 zbmcM#)bXOTtdr$`T=N@)S`)R%EfDQfERE+@wUfrgA8~Ou{{ozx*=5jYJ4?}_<{`mf z24EXAa=9yg*Nuk%X)&s=2JIK!7-bg<^B)*A>baQFdaow`Si2v!>32RMY-XYPP4N@P)bAfWTAp3EC@NcQO4~T^M~E@&~D9cT@u) z{yMw*O6^&G;ncZXJ)K9HYuco_<&(KstLv2S=Nkk5UK`o22Y~`AM&GO6!ZfJnu8FU0 z;h*3DftQE(YO~6I-%Og`kDiVSx$+N}BuKb%_1U*G5;!1W^m-yCVd-hwu0QctH__eB z$ppZ=j+%`alpl)p=-ljAK`Rlz$8coy!MbVlt>Znf)h2;CbvEL~ct>i0^QhBqhm_wr z%Ke%3guHv6u$~;jBwh zCqP-$FMmLZx|EWjEndHWE&Pwh;b}}~^oIPxXfu^g5G&Ylw?veK1`e7N1l>(BYFKj> z6!}NNl*QMJUrQ!aT~D2B%3+{nE@~NC&0t%c;4=j$Y@(b@wrkMetyW$x_g$--&+G^K z$}r+Lv~`1;8?>HsC}7?>`!wt<&PPfSd{tVdm~MhpP{-zOC4x7&Y^)XJ+k$@h=}UZH z9~gk7ZXl;0Y6(uf>-R{aJ00{M)Qm5f%%Qy{CPvh}<9v$yqDE-NpBN{e_6MxfezVx) zKP_?S>K5cp_|B{Vd2^{sANhuP@X75!Z;K@oh3-X zJ9Y1U72@&o5t_+1JW3pgalHI-UG+!9rKOvQ$ZK znG&>xZg|P8rRi%eW5lZ-q&`2D@EU27NY_xUk{O0xW%hW@^48TRFya&w9>i(szPfBL zEn0J>F}~pq!Jp*u=e21en*A78BO1(M74?oEM65XXJH823n(Dh6_T__S*1{L{&FLDv zy3|j9;2*G_pcB9!Nz_bD(KHa-a5`H+!D&e)DgIV>tLD@@t^AuhL;0f+`4Z8?J*__{Y zN>DA`ad}EDswK7Avcgy>GuVK%Eye@isTU7IUT#;DJ5k2_;;1fq>GnhCgXXXOdH~L@ znEJ?gJUhqWaIh&_7yF?ei%pV5(zV<&uv-=LiHa#&VqZljFXG#>8a9$Z6F$|M@3amf zdC)d+)pP%mAzHVZID9$0jvg_&2k)*0UwZo5W=aK8t@l0J+x&ra2n885CPMPbfjh*A z8;*m}$i5dr6)mdwmH=e-V%~9)1thKILF?8tUL$;TV!rlM9Guz~-A#cdR)fD6oGNJ; z`QjM{Pz}#Zk?)HUSuNu?RO`pSe=0pzV}-}^JR zUFN!G6);~6Pg;kG;F~);A5;X#6arv(VsZk|nhPVWP!}P9FiUg&8vWv^Ph%tg-LCfp zp7(Z{J;E>N?^H|O+!*X0l;U(2r}mHCRXwQR|E8BqKx`Ur+nz`N%1nT4DV(&GE}pwR z7B@i0y=5HxvLCZEHH;OqJ+AcWOl^dOUqTlBdQzkx#lxyP((JZ% z039`8``r%_H<3vD=j6QRZ`s12hV6JEz!TSm@jkknsn3c82+7A8glp7<;hLB8q#&Jq zT>BH^IY8XA+*qb(%@_VDK)%YdDwl!B)@375>NJ z69f_evZ6zoXExqm3cqBS&OhSPZjFmHXN2SFA{HY_!XQ@h)PFh-n1XWNM>NrH7dMI9 zbWvBi*(X>?#$rU8u&sTFUV7wr5E4_|Sgo8>;Aj?0tZa1%cpSk@?|ut@(JbI9SJ}U)N_fK3u-2? z`TJXNmPQ^YPr?^~arHGGuAAyXcK^UqAUzOKS<=+SCNc3x&27X(6=RHovx+1ft-Z;w zYgP-g_^?!3t_uX&)EQP+?GMr#KIYnJ^72yC<5L0sn9AT1JE$w-6eo!{%LHC%GlEym zcYm*XfV{f&L&Bxz4_%jmBf-tO#cM#znt@Zy3QB~> zrCD$m zp8V887N!HQE=?WPw{GM99F=J>>xgY9mN|JZHE{{Dawepx=;^3~6P2_uNZDnT;lwv& z;s!@0KLj_pATyFr0xtq>H$yqc*2UIT0J$x84YPMtzfW*;YUPVPOXp{bvNu|AIDr#x z1GFf-mt3tJ{YBK$&v41!)@I8h6+Om8@`@e;IX^mz>Q1ZQPN+Q{F`U~9O)cHX zKwp9empW|d`=l(VlU`V6u!w;l1j(r7xDUOb*?ILvGO_LbZu}89Ce! zu&N%-GZq`?(0ZJ9RQn^w;^wLNV-0MbUO`p54mPD{^wZzV7n zuCy^6Io&;bf{)x9P~3%P?DH zZlS)-T>IcvQ2OWAwliJ?!CIhLtMtcG1ft(vki%EEZpm2>g70drY5U5AZi!7`j1^Hab$Q&9JGE(AS+m9wqd>uU-^UNEuTejT%1Ei~T z&@cp}Plm|IsXD#7FxNqO-{6VG)~$0>!`P|pyApMPj4KeZyg7t8M*;e#Aq4FjIpr_e z(_`P1E4GC$30|^C^fFHEBdt!_%r$c<4V}Fd5~XKRycn`vY8!(EJ#cLiEV~FGy;;t% zwPN+0&PLOYfb*r9A4>hE_V<3MNj_q*Aa>;jt()tUMVeM)3^jXhxMyn$yHu;sG;Tv9bjJy>7OFK z;K41P)Ynt{CJE#uD>Qid+kb?>x%YrX_p~Ip%e1$dy7A4U#~x| z8PsmQJ|Ddj&i}*ViQz{*`Gr64R__BA!^MS45f!qTH=YeY0tXKjCVk4tAnLN2GkY!1 z&(D7Q9iT>$Ei5vBG`;Hc6Yeb%exu^)?m+Lmx_|!A;}6e%eViSH^?%K-Lv7y!>}5(U z@30RKkIgpr-X;8!mv^j#Kc?!Zw!Fzz7JH=s?eKgHZE(J~V0|zke@_?@-go^;emv=@ zX-$Kc3rH~H?6I(8xNreU(%;DrZ(Swbkgb$Frt*!9=tug$;`q9l>RcFtWpc>_BDncT}k6Z4R>V$Wr z2JVrqxfZX@Crm$~Ha&FrK7Bvi`Z^=5>So8MY=S@dU_!uw-9DTf6wVH^UFM~OH!GUC z0BlQ#y?RGN1S5+uz8p}jORtY`Di~XK8>2eeDj?~Xi=CX7ZN$$soljz=pNb?J-Rd&R zy!^dX?3%}o@DHpO8H(%ET8*5YfO6x@$-htCfuD)GySs4UsPIV+_Y@RxVYo9|$oPZ$ z`lGzsfzJ243nS2p3AydpJBw$kHO|P~LQeG`5fJtxbJ;=P0aH>Li^T$LYACx zDv`L?XM3;a{eYVzE@65mmMxK;2x>Jx%O5vzsLE(gXgbN-LdU)KzvLo)3fyMeBR8p$ zV?RgQ)SGY15c6)98$RV3RKBED$SK}7_k$hXf;8F-?I1(gtP8h~a85nHeTey4<0+z@ zLrjC{+dp0tSHo8l$@uaxL?PM-x5S@|LxMRocD8&PHv99@jQG~bP5&)jp{luF%E^-M zyOr>lUs^Zh=}wNhf-&noXx-{0`>Eks?}+=o-M4R`2G=^BW=m$_1D*;$ueKJ7l@y-& zL=dF|eY2|a24_~(=O_`hpSDj%9h{`5T%L@b0D=5|5xD?^Cs7ZVkr+Lo_`SyY#Fysd zkuMkZ9ffMdGuzEqMgO8^&%w&zqgS`eYbR#kf%z91sl!ru)BfD8=T3%f@D_b3F9Yqb zY8Ms??34Ox#BfqWlY-wQvIe?>LR%JB1&VHpQUpuZdmMh0pZ-x7omcm99z(26px(;4 zf_(FCwcFQQtMP2Ub`x68g7R&9k{RCRD0Ufq5N*Y|91Zj{&69~ojA6iYy@Xxe{Tsn0 zHQ71wJSj_SAwcOQ?b_r!wuvQ9h4#tj_Gw1^uW*}keXpFP4Um3RKMzdUi78PJt{t(b zvr4SKmj2y!|H#->@+-$A$V$8n=;nXOS*KgNm%e7xuf9#Z7J_G3+{R~QK@H?vpUmAh zHm39?LROZrEo?7_nH3xiUJPAXT#HkA346$#SW!D}&ET%s&*s0Ogzz2orPTb%*6Ct^EJcVc_0=l0SoUNI1}$J)-I#&ez*K#>`N`2>4H(saDVh* zP)m2-Za5a+7hh|Ne=dvd=RtZ}JfcS*W|=as`6V%qVM3uS8$ef*2H~AG1zExD00O1R z9^0zAtc1&O$k&PFpJx)AFcP%@P@u)4`qajxwUYSSLF!q?A~#1Ua5TQ9)?jQ_7{0;f zcF=uXIEKnPm>yOoT+{M?K)EF2X_HbBn}I|b^5TotFDr~n!{|`q$&0ntHdiX5DB&gD z89tcaFE3vBez*575FMaBq8UCdD*3kM!<$I82%!07npZxb>q`(9jkQQ-xVedl5cbh& z06r{Xk#Xi~Lo5~;K&>nfOKkUBQOQ!?;3a)^gKHW$w3lEl#&inRivnS*Vll3C(>!)1 zwcFk7!l(enl+fW8EtZb)B{r^9;AwuIVi9M;XkcPZgyjoXtC|S&-9vR#Y`<7)t%IOt z3WY(#gbmI4$i(jywRxGldr)EXJHdV>rdJiE(*VNuFo%`k?`F3qqC&q38)A{>z7H&3 zq_tIMhSfKpxEc|#G5Yri`<5#pvoZqzzHs0Qra3DW#dL!|&u5@aT=OhO#y!xtKFK`9 zlSg0sTxD}n?oB=)|7Vn}pZMIZel3XqNM>4U(3+tA^?_*Ei{xy()RJoBDYpCYx_iw4 zZ7UzsubZarEZ6m%)FJUBKf6lt4#`b{?Pc&QFp`Ye{S?gSCq@59pUk)<$H3iFmovuO zV$iG8F2TWReW75>-{cX8uLg($vfD|ieG}C*>U+K{d$}ILHxer9qG5DyzU*_JTg$q~ z&|o7C-gnHpx7S=n*}!G*t&6eaM|Fc}AarJE|MWm=y`2;T;ILcu{o)KYj~yM$v@5Sb|xK z#Ol`)P()fdemn{__S;poP3DBAMF&Zpsyo2G@#Y2rP*E)wi<2Ybbgs_+0*_H1BSh|9 z#4?vO04#Fus4l}7@0UI{Y^O)wNaa06M&l2G+W#69%cKt(f-U+~RWR?h0ZNHQ!J zTL~^{#SoR3vc~iSpWEt(Hkx(i69E9EDz~~=9YQsi$6(K9c7pR4X)KxH!0ITR@QS96 z+n-HdhNp?<_RIlp|m4pc1YTvNhjs|Gz3}+_Km6Jk z&jh82^PV)}*OiTe+2cW=Y(q8?8zI)49%BV6t$hj&f%dzcb}}Sl25}B> zrD=z{0J7JW79*EoMA}FwF)+S3OmQZ$8o_~_P*txgp^FIP!npYjp<>al*?g+fxwl6n zPAFO-#tRjuc@)htsPSg&pifwPq8&6CWf1y!-%a+`4pNVxcmqPcEA<@Y3gkodD$-?G zl;TO3m}BZb^8ZnE9`0JFFDsNlVh=?K*F{-tK zn5BskbXYZ8yK1y*v_@$u-R){7;N_1A4yWUUu6et%FBn@o%Q zrL4D$a6SEqF9BxIZ=3jBC>szGJ)P$N=YsS1#3Oq!@5?!dv|+wzh2KsRMk+#zVxf}g zB3G4Bp)nu;!71oQ1tWe3?Rb_Z1dH*G)NxTM zHZ37yxB&r2#W|ag*nsAwTz92q2+fEOQ$OF3}^#w0YlJk$_KbxrY3ACePreG5r8ktoW2xQ(5 zuAt~dd++#<)UDtKjDr(};h3VVH0lu2DWJ9j(?CU;0CYZMX@)?}&B6M0yQ{ zK3aF`_VffV9RT({GY{O2vT>8)ojc1-)IOW_LP zfNCFEwJ`J6(WJ?<_SX|Lms>ysv#i-TEcwh?WK(QHJT3{Lk-IPSW*HK^7KRe z$|77axniv()aCXnoDCz7q&o~(h3RZP+eBat7y@vZFj4+dh$Un6l>`B9bK`o|R$H5X zKF%8fv8TD`&UvY^NCbjSe-+-#H9kP)VObcF5a=H!?8DQu-mh}P0jg2mv9gC6)*@=- zbG>|K?9w1f8=I@HE&9)GV_PYse#_h9@*pa16M45WF+~n*@3qwX`yLbf)ft+A5cWDJ zmfUD^Cgt{wTC?F`=x&xK%%#;=oAO|xBsc5X zp3D}mNi#oHyEF0k`)Vo?@-IG7i-&AWVTOZX2#AZ zQH)^~#=dgX#9uG6V#8HR6pHy1M}ymMyV<@bm)4sDimKe!1+%E%oa!ULgNdEgSjpbnq$ZPu%a1@WlE( zmg6nGCAa2@@5YmB35b7lKeB6o+!!|c|L?%6!Vy_#v$QG@xxKIK@k-@&)W?`?ti3kYxx zL)7xt6UB;Hd4*p&jJ03-f7~1(@zg^@Ge1KBH~~V*2)*~l2ekO|6PqTyEO2xPPOb@5|rWXs7#N2lDsCTiV&i2d4x1WkyU?opcG zzDMNwgBDCdA_Y|#;6;tbubf0)fXZ}O4Piavsxd~jnDQyD#pNN)_{GYp$X3lP00d#i z*=IuQbNshTC5~HvwRS0h8MZAqr+l#WQdZKmUMj6TRLVy9)KiyqAMs)OonmUMRBm6R z1!Gm52Hh;4GcCjw3JZKK0SuntH@q)|JgYve_iU8A6O@R1%ZTJ7cg8n3o1fy=mD%~!Z&)#VCj;OAu_9vG3uY4wq>ei5qM^gED1I$Bi1!+Haq^Bg%*b_>xuc1^qZA&e6I9r(_K zjca9tDpCQvd60d=%POQ+8>P1Zj%ysWx(B{;SMz>{+>PYJy_0IWj-l_(>d+I3dwP3b zfr{d=VqYp48D|HZjbMQmPs#9MGWr??(tV?q51d5rzGR7CT=-ZAFs}iMP`jsJVFzU1GCQ)p+z$*M&^&jsG3>`*O%3Ed~NKg55+kBVWa+mrg@YA4&j;7d0 z&w`YRBe@R0p4_$$0K{!5fiYSDK6-``~Y( zn#bMBqvgVlL_*+J5X<64I&w+xx5GPK$UJ;4*ywHq>vXEfGuW+_`})b$;_c0$E0Ocu zE`W0jX6#)mzd-2iqf4(!^2%}43&-G)I zTRa=xXiz8CRp1C}ID>UYf}a z*ETd?+`!{&Y~JR3rQcxffWGNga|mzQnJM(5D!Jd5oi_OEZ@Qh|m|fgRep)yc?u-ty z`A6RHuG22aemrc?00tDy>Cr*@z{FJmBx)P*?G~r(4>V1w>!JVxE3=Ep=P$@ zm^ckjrpDY-kLx;iJ|Mv%BT26H@+^K|7e%f!KHVQX|CMXUgSh=7`p(%S?i+TFkV81R%O@ne4p^OQQ##jgmRgKHG5+iB=;1(8b-c^u4*5I@;=;4QA z3?_j5d~1fT{m0anlf);Q|50o}`VQWhRRwG_n1JR3(33*jRyu@3vk#ac{ms>zQjh85Bng=HhFuLb#+BCt~Y+_U`LOH6NyUg|MX4TvC8fP|!crr&&C166esQsPI3T_J4gJS0-bVSrA zkVA7ai@UOREn*c@G8a!zNv>p$1;!Tg{ze_(Dm=W?#=!U$4ABF-S#hT1EVl)Pp;mH2 z{cON)ChLUYgPLuEamiB}SqZ>?IH^6~JGJ<&RKrw%^x8dIwPq&RdpO*yLA(I38s?31 z5;ZwporZoa0vB)ReXHK@1R)Fa5-XuP-LBlx6^?d_+hB6TUCl0ujzlq77*i~i zU8BX&U*VrR&|5hQZG1H?UB$h^x)s>Y6tP1Kw@ILR&unLO$fz1kO9}i`boYt@FLCNS zpAgX9)1cC{+}F=h6qX^(V^zp}iLT3D5@Sx{2VPsku_I1Ad9h*xku^mzohQnWbx&}Q z0Rp6tP{j6c4&8)ns2GNb6d&TRUpAynxa6k#ag1=m1iZ%uKtG??xCW|68!v%Nln zDux-2i08;&Q7Jm0^R6n{U!HV|HJ%2-Hw6UUD>C2MT2!&G+zZRe?VuGw-IQqLAD(IQ zr!zvAZ2reaNG`A?L>o{`1GsqO0MV8#nL)IysNh94HO_Db61B+!KykJM1I0hYe))Rp zxYYxJ!m#}Fu2snz14=2HTUQ4_6ym9giGi!XCgHG-k z@UzYP5sI;AKfqXQcwSGaz`_#?7OpR{d9x!aBQ)}aY!(3fhZr=f?|MxsZw!bTKkfb( zA1{^(5*xgO_K-yEe5$yND7iIOkUwcqr8|ZYV(`~+0QIezCWPjazq*n70eb*Fl_ zO1weL9E2Umk4QpDkhY{V7b;de!6ggO@OO~8hJ}c8S*Ahfic6_UHGfN2$KFHCVCGi_Aw@XhGEbrR|0wC1! zIlgb1{+eB_P%VQqC$MYv@#JNhP&diY`~T$)&B1rhZ~shx;^$N6%sHfzeQRTo^d!b$ z)|J^S$bjxS2y?n_h;Og=b}xM{o^uo?KbJam-vzG$l)}FWIvNBkCrs>k|H@T_wvHw& z-mI%DSLwh7ghwHxDgOJKnXp*5OI0M+J@ciS#p@5{A0f7WGz;tAm=u>hdQ>zRI`-i_ zp6gbBaa#P5otCL|gGGEMip|Gf8@U=C0n=iaP4iBsJerOzDp%qV*H29SbV+_&ry)Y_ z9P_63lh8}&6ew+#tVGH9i$~87S26=J)rZ?S2!N08N<{Ry_cp^Y?$Q-^w_*q^%AB^cCef z|Nf0t%flX;-h$?c?;1?Uz3Wd9pBZV~F2zvcQ@KYmNj$c7aOjhSy425S8;n{bEd}Wl z#)t#t=%~~Q>Y!I|8}(Sn#5P&wq_i@~e6^F2*msWO0l5p|GhSgxk^HGvJbwkV`)V)p zY56^!x&ZKP(zlYIaI3TviK*7hG+F2UG2P1Z@yo95y}wJncbkTiwa@G@I3;TAf4SJV6(vW4?q1mUv7rMOG2`9X?aiqd zYDb>5d?KxA$?*dq?$gOq)z;{fGZ->e^RVWMIKz&0t+)GBS3MrL9lnBQR}(u;cr zP*VDFnwh{yDjHsj#VFybZq-G*I@?9Eet>XkJ{VQ9Jit-M=d?tr(jRmLOqDV8fph45 z_MlBsE&R;j%eT~w4av9dpV8NNOEGL{Vum5#zKL}9S+SbnZs{?k7Ua{lSQq0F@3cK1 z8Jr5rLQa5Cw!FrJ)k{0V=0P3jKTn8_gY;4a zWAem8YF9dqvfpUkb3{cROt=Bd$>xW|xi2FD-10k`_p)-cugpXMV<3PSpNtRr7j zn%K>@Vl=Dvx+DO7oTS*AH?kcqexnBQ0T+=fhJ+w{cALzLV?(~fYdFfzs6!Pcv?>G& z8pXcN;Zgx0&E!588wb*3@Y7EnS&yf;X;S?^ZBW3x49Cl@uHufKiCy?!8T4FY3q#K8 z;}5j(fp656xv)XltZx~zA#9m&DTex=0yAKJcbFJu@4o5IJ$6*lH zEKeGBemQ))VSy0LU-Njj=%*OFKB=WAEI%*0Su7SRb&fjZb30CE{t67KRCFQ3h+$nj z2)`esNJ?KiS1n$|q%968xz-sDca$lHMuH|I>%wesHZ@54*SdB+jU-n+rH=PbIkPAx z?8iC_T2XR0Q0N!Mu#33@pPy0bZDTXbb};#!&}=`?U11d!K4s6xCuQKvO1{R!`lVaQ z7sE`=&_gc45eJUWrck)lp?6=P17{r|t}zJ~m%UW`K-(aj5x!CMz^X8vX7pc2BQ(^e zp_J)Iz3Dle_W{Rqzv=>Ix`B-bzwFqmK{MFta*^|PU6)tsaWKtUL+yCKBga*Of4em` zTwI3L6So!&Z=}c{kY9U$(EYI6IB{PnHd4Hec(tq(FycIp6iJef6PcR4DC_H3fUH$N z#tpOXmy8DMmc^?YNJh)DFm!oUSb+*5hX&iNx^5yw9C{HPLI7F{L#nJu+)9d`Y8G|y z1n-XX^Ho@i6m7VzW7=>Gig;+~I9s59G|tkw=Y0U_WXCr#CeEl0Vv3!U!Q6KWQ&?t*urHIeof;kh6xyqu-N3;L z(@LfC)LLs3;Ut4T!@`U~rUNwa@+a0CL-x~F_z{!L>D(eTwzb!wZp?yTcSpw|JZ{#q zx-FT5fs?su7MH_ucPpIITh=>;z9=47Z>>2ECZXFJIHpQsv=MDO+eQwDJ5E8r&F0V5 z|4h{YAehqL#rH0BwG7{NIQX!g8rhVTY`#aV*JG{OLM_LVGY}!sQ|f6OJ3Ah4^WiGM zi^yQd$TQ!XAi}wmK1=BiRhttyp6Pv$6?T4zCv9mpu@kZGnv}L^26Uo0&ep7^U8)3; znYV*tK#P$T?6LtD)pgFDlBX6d_Agt3=}7B{mK`tIx=^qF&3Q=zdmhzQX;QH#wB6oe zmg7Apw*kUm1@ccOt1ZP%%N}gDMV`594hwSO;o71e*Gg3AkZvJjm>g0qF{Z1Spx*ux z1hm89^KUoJ5asLb!2Z2<@L5`HFm zYxJLSXbP8M+SGULoP1~{3$}bHi~PIw{p{5%j=JbH8gPw`i) zn__9;%)u%y*d_8dg7~M9FM7S`KYuKb^&q*d#PuSuLJ z3XGmiwH6!XF{WzR>Icu&^mne*Tf$Oks~XSUYu%dW*B)U3M4cWydi;~KR5M(~5iseP zd;mPJ9PZz~O>=gTU?X`J1l8-Wl`4YBBdd1l!E?pw8xhVUf1ZbP@7n8~Xbp>Di2=u> z9HBd46;-yZBxM6W0VWGql82p_6lO@CL+6fGhjVN2iHOP`+4p zKU501(@uNx+SuCNo!D{JvV{`YJ zE9t=DCrB%LoA(k=!-mw}x^dL(m(V7r286sVC8*hP>fSJ7iGs9J)wzPmFChMX$S>zK1n zFXS|mj3M$0!UA|EPmn@jC_Lma5NE-OceV`gI0j z1}7F&#$o4l4{4`1#_ESoD=VeeMw^Pi&kz>ex^mp%M|IGZP77P+cfAtM9UhgiSjSFp zGe7v+RGdA{wFsy4GoEkq_~;YN;Oh(_F2}$DbsRfEp(H^{{+oYFVnR8c{1SWM-#wMIMEyB{O6E{->(COm5HdWb~ z(XcHn_Y+rqjp=%77L_~f8i>7$dnIpHj5@5A+lckb&}@ZuR|UTYtDK8=%VaGTXGbh?{%1#2h9{C)BJ_>(jtPl&eAM(r~nLK;_7q5HzFl=LvFOYD@6%GjYCM0 z=N7dh%*_^wX>Y6;0?PyxDZl=vJ|r+J-b{POvnf6xHfR*~J%6RoN=aDgf?N4)Kg6g{ zXtc7Iw}x8EmD8fUQhPEqQ+xPei$&=_oM_=tTBjB)4GF2SC_&jan_*@3slG3=^g%$JmRIO!GD_V9s1X5e)Avh@-&#KIdhTP40MI3- zlQN+Am704tMP`1Rb=o>mtGW8kPT*ylV@k09%DvK@qM^6887*6IPgS@OK)gN_mmZ)e zUvuL@F|0aU=r{2&r2z6cDH6q}$(R$I&0k87-^y2a%7&}lp7*C-9Nk!A@XO&h9!<_n zM7v_r0`)yh(6!!H(wl+37%nY-Mcz@5Xl;wg!{gg#|VK;2Q2U$8Sb+-q4|8=|+ zUQr9Zs4>1*8dkjT4ec}ZHw14&+q)g7$!!`gF)vjY{PgRqcpmg(P)e(G@WHO{TJQO| z&%(1aOE55Gxa`aR?3gZS_Q3KQ{@S{NeiZyRJ>Bv?&Nb_j?CW^}+M)(!$>1I587>=l zX>F*fmvhtDjMMk8Yrp;eUHOpkL~swXVp-+K+mL3yBb48|{gJ&wq!%OpF;2ZU9T^IQ zULf{%M9e6CNqUt9Lg>XU;s;pkFf|&6tsp_WA`xHt+E=@626x=5;rQvt>0{W3K<|~d ztDr5O3vM-2+vOah**-%zw!>hrTf%-#cAGZAW_^p|99NdA0c<6z}uD-y3 zF@P)!8-AioPF70aLNe~}N&Pa)+~e5HIpi1LmTg{Du}T;xxfM)5D7mV(^*NTl^YC55z7hjl{KBRexfGUE^t(`5Br?3d zS<-i(B{x9TRSUCbfnYyMsWmvZQd+;&1u-{h&JPrW^|R-&0)>yW3qPavbP*fh{UCG7 zkIx>S6)I~7we8*rBT6*0z>Iqq*>+GHVt3O-fD}IS%(C4|qt zF>6ODglTShaCAXk8=L?m&7&TBn)`J0gG8VxO zX0ILyHIqr6#<~i0vsexRZ!E4Qrdj<*7GBc)^Nis6tEf_0q_}ofMAjVLF77ZgRG){= z-m$l|G%iR&ccUDjtUIjwZV`DZoBV->L16T-SB3D2iuy41wtAd^>E1vrG|71veA_vg z+$|FN=8A8?7VD3&X~+bycNJ_u0qjxGVZREsfknhGo5$3qWU$(mS2eCl+fg8oZ+(a4 zH~bAOd$6{Za4tLe=S^egWojJGeOVFLv_3a1EG$ntXPWtt1p@XiW?~R%C6>P%f8g$`XgPut;sir~ADZ$4kFbze*3u%E6hWke^;dNx2t%uBKB# zo3XzZi(bd0e5>xY(Y)P6UP1S|9e&8BUvGBUYfB|j1j5xyG4YN1zSCnyqlmVJcd?(= zJDeT>{HQm=EMCJc@GO`0853o`vvx)Pa>n*mL6LdRMKTRWXTO}C>k!=+jbR_M?+-;p z3e+_Ex5>PpcY1iG16i~s+e2iXbRTW59XkC~jUTBN_L6HJl}W1xpIK-=^P0Jb%~-X? zVYi;!zh{d;=7lfB&W(SS*KjOZ=J@3%L0-u8w#5X6bHS!V(_wbQ5?THo<>3z}M@U}R zZ=3UCDrc`vI#U~t*4RI2{@p0LujhTxfxKRR)K9F42e11+#Fs!3_SB>E<|Bl;|M z+r^1FYs9OmjM$dgAy*H%@9Lx2m+mvs|I`MT@S6ucz2;_EA9c}KEqxKVwSE7<87CY& zsTymf_2}}*r%5z;zDvA>*n7?5#xS(LH3V-UF zGNzaITLmxctl235=ij_7SNHRs5U(}B4?F8A9AUncZB2`K`O@gA%&@b|mA<8Bml{*& zpifl*=ERd(C^P{1u)zh>VTCJ#c28Ex95Sp$G&U`f{Nz*Jw>5%c7vympbLtRu%1TFb z|LlrcwYE*8sQHfF)(%X{syJK3Eu}ok1Qz>%fT5nHNS~eS<32kfl&28>aeC*rS8@$Z zX(;Km#M3NA@v)gQ@v$56-|YjjlzYG)P9*Aa+_=Wwk&9z-1v0~{X3f0$h6z-RO73)b zL|rpadXC!v2XUQ-tVigDL-GWt{acY;cW+L;`v8slHPPN76!WG&8!x_oze#iU8T3re zYQWaEh$mWe^cay-*!4Q+O|r>D zL%6#>fpWE;D>EoF%rn$^;gmr=fYlEu;%07Zo3E;s1-K>H1~yRHqBC6^7o|LmT6i)% zN>ewKAX^eU*OJ1Mob)=jUVgKx`08h9X)iZuHS?76=T^06rl%25cQirXl6gqtq1dd^1qeiW27 z{N#}4Ft#@#y%G~k9LYC2?Hy$hP>@oQYqSH8A)@qOs+CK8wYpVbT;59@oQCIl0<5CM z?Cy=Ih(coE>w4X~3O3agTb0LL;Q?;3RS6;iBEq{!LD!XR4vETV21CIeAO&Lvo2qcH zBZ{7?3yqBbjPM8?!knbyYCK?S6WO}F@T;Lg`(V#DW~EIxZ3D}-Y2sPj0@#7qfyEmS zZ$o(tv1$6;?|uVU!H9n7nos=@=-V+kzhsqbKu_cz_=dO^i>m2&=u8o-;g89<-z;M1 zzT{5L?NW5PV*WHe=vs^=9-!#Ywv6-Kf7#bUp${ai&qaoJmgq=o!cx#1LDdGO|p*5fX z6!LmuY&4?S%tvBwal=jxqFlP9o97A4uIb=PmJWdQ}Mx{1$?k zC0v!pIvN=1Fl|Y1J{wx<@=x84@hckURn{afj{`AccsVtxqyizx<|E}DhO3l+I$2hP zP+Pm=!gWu>`Sg007?u4oJ^&IxDQ=#!YItwK6*Y9bb!A+7^>1^Eca>=D zG*W1MQ!(?sNfm1kCixpBNY8l+)+!Bdc_H74T=AF<$d}%aW)Tiej?(-g@30f3D*=~+ zGUxh>{8l+lfbnF=9>Vo3&9H7R>ufzneEO=tn9V5@#il;Zk+J`Z0#zA2?}_M3g9B3E zLF6g1;bJ(@#}=c>bJEi{mAH%OH&$O{QtmB3xf91Q@W`WqGe>ovssj@x!D%X;xEx?lK z0Ax_eO;)(f)O>mN5+d-XZz)U`{VO-LA_Zws;}&jGXZgF}g+$Oi}vcJg}=EHjb+w9!$H7ix51I@ACatPda zRpNJ-$w&zxuy;R@6QFk<&zxwuE_4JzKUlBMRbT;xpR?ciI}YaWDK0p@y%C6_2#-jb z`{+sM~!{L4wH9(a{};d5Z1FR~Q~$@9*ke&m)o=DwYd$ z0p3ducll(Sc?*Ji59W)EAJ(sc1xV{=!FsIhd-lXiIbl|8ppGjl_7*hv!OD!>Qnrt{ zg>ZL8-B(kJ1=CaaUlVnPNs2^&p{_t`?BWONrk_{>V8Xt5a+M^POjokAM_6t8)2xwZ zud>q>QL$P;=eVPN6y4>_&yGCofDgmLNYpAGh&<2y(e6;#b;ug-RV85lBFh=_@AfI4 zb77t$Ja}!}#BwiZu&{YiZlGJXm}i$;NyDvQD=&=$m@(*g-;j9?&ZaxUEk0%r%;WYb z;*OiCS(!!jiOS6O$XgNLQj;r~%(9xy#6Zl-bZ_f@_=DB$CQw)tuY zRPay6zX|AB^6IhQ`c?F6fEv7C(x6Z*B&?Cx7%pDB!$${b+_h?8{~y~{%PeM=IWpKO zX_AX!=*5%nSt7N}709nz85C-4#wpFt%S_1vA_0&F#~k zaTD1hwmEH&)ye6yjq%sb7l4IV#|~BjYL!u+Atx6(Ygf4b_IH}pKGMv#%YI4DEw@>$ z!x>_u9!mS7yz*a#IfZkwlN%=J)~}Y@JH4*N@BDHdlc5c32_zLkucPWEaz~Er0m4!R zS_JxRi|rzX8eTt}+Sq32rNs}o^o?+Gv8@uK_mE4fIT0FBw1`jeO1XuMo-^0# z0QJ$iZ#4pAlkG=Y{Q@o{66db>H!nHxSLb!hX~uE$TuT80By|YNEk)DoupL}Z;)qZz znlTLk>2b=gf<=ab0bd>ah$V(*lT?(< zeXK{=8~(>i;%`Gp0zT0cnB_Qsoesh@WY4mO)>nSy=l(Zq#|y0C?{Ko9hcYh9+qWXLA@XmlW)9uIA;)kt6eBw&)2njfVAcyP^0I2RQaZp!97|} z4IOOip~>d|eA{Mz#+W{}(%ToT(QGUXhPL^c&(X{ic$X-MLuR!D-3KhH^U4Dox?@2z zJ@9tjb^59*3^;Cj;?!Z6HCKNL4oB8Fw9QFc{JiO=1+~-~@~?ZaSl*8e)Lkwh;9@*S zJ{j!@%FoRjdl!_CyJ*1oXp?Y(~!ii zdEYm}o{ev`FQXjH((TRU=O3JX!Dmg}F+pq#JIudIv~4x8$*Ol@->nRP$O0}OJpnev zs*M4a4}7!74r5#DR!+1f*Iz6>Z?x%Zw5LX~&wO5pTI~W6e{-tpN(J>^>0dp6FLz@X zbo_i4Uf#oXAJBK>1!6Gi#c%9Kl#*Pf5^7Gj_ca1)jQ_A8ih2r~h`yfU36@$N-kPk} zk4>rw&GPZ7Uo;on7>dQlEYEfZY?J$d9VUop1u@6?H&;Yu<)j*%9fi*?KPHguHk$oE zB5i+W8Jh!GbGfw2h3_FiOB1bk>gI=*^OePLp#pIBydBg;8EJaQ0JB;4Jw~c?#2P=h zCOiV455LKkGN#@L4wi8Xa2%&X>*WX&pdGJ_w~7JC=*9E4NW%}yGiz)2b=MK^)Fo2r z%mI$*8etJnS+>F9`3LPUm;mIfy=j(I zJWy*I*I4uGkI{8esek${*TdEYHO{j%7m3TrGuoc@RB55?px(trM?cHQZLPpz&5NNA zKU6`Xh`X8+ZSY^O}S5h$Rhz%drrk{+ob9iPC-(vsS?tlY{YfX z(6JR%MoqR)n(91OjW;z2W&c06O(Fq=)l%BA&@1Jx|5mGH&@b_h2pIIcyJx2yBMnlp z)IW{-u2M4O7}JX;Z48N_&sRXHIm;-@HT&cgvrXEbj4V-yB3FdxNEzGKT9+>m`g!2*#c?I&fD4dA4F860x z1q6ifjIwTPUSSM$kWumbMSS;DT|!4(S4y&!VSfAg34QPr{~zb011NhQ8l4hDRQ?uA zG^q%APl7lr9t}Q+;_M>FX{es=rsv@|I<{<5LryEwZ31d^xz2mmZl%{-Ll8IgW%D)s z#i;Y6(kzB0G_qH`*@EquDw0R#R6zJTaS6D&6JS~&P{7w?YAZS~)zrRrYyNVCX%+>- zj_eaWi~o*hY0h=8for?6{?ZVZKD6{eW!I|!vzRu>O%;kK7iYejW9|%{G~ValbWAH? zA4>qRl|Lf#SSZWeL|~jX;G9J6o>DD5kM5XlwCkz?@1gy$F{p%uB7Z=LaV1xgsJqVP zHEF3ILGI;evWLU)r)0%OLiDch0DaEwqx;vv&4ii5=LV7R9k}kO+OQ9zoEm}{`-dP5@>m04l3lk+-Yim?iI1N1q${_Y&}ul)CLQhpy8MC8@~LI&KHhOk zNvkNi!ChK@yY;y~3s1>ahsT(xJn9eC$ms@OX>#I)88W#9FV;&V#U@9B`0{?%);FgQ zuUT-}>THlQI0C$b3QgGw=~ajV6Y*5`B233nPavfduC)cMXqu}Ej@@kI5wbI0D!Q;qP*!%7QM}*?lJytk^DZ_oS6iZk zVd$%18!mn^3FF53q8r-%=GiMADw^=QJJfE?#TC)iBo`jDFvR6~WKb=j6UIujt2AvL zLO?`+{Q}JgbJqmel8fSBqT<|{wpZx(7)}7VqW!t(1)<|jV0X95-G8CrVU8RjwTzl( zMRuX_Zo8P&{2?8}sBFu(!qAqA)m`sf1`uK9MP!ZTo@M(EJu77*7_3>NueI18#@I+~Y2}n_BmXIk^H&z_tzCiI%MQhq|-qp=z}gl|0=cIdjsjP(##xZ}A;4G(LFr zCi5o$-4VAc>K_w4ov%a!Nv+GB>MBa|!XHYtqN=uYo#FiCT1j_UDO)`*66)HzqIfA{ z>@9h>K6biJ=@IK4x})p}#f&d?Ef>T!T?pOQvYuqmO8`w(PS-CD)iNnHH!P%ipD!m- zEGhQXx;#?XE0rGCdp`1IS2`0%km55T4@iSn;Tjc(bPh#>qhng$gtU!Jo=sC5UcZ(h zf**I0$dV#1E}yKu<I&~47ieFr+_;50boMT-TPe>t#7JFB|21l|i&Z6EB z){&`u$=CPMP$ei6em%b82m4J__l+PPwBdaJWG;C+j}{SO&XXWA?f^~TTcHc*lfO%% zYYg9 z>35*MITTkhKd_Q>LhRUgYI`bAo~xF$YY9!ZDU!S3lfZ9XL)KO9YV?&gY?IH`#ioa^84|meV;Wu_m zPt5EJEux$8d#d#da>;`{3u^`mwu#Ki5ZaNlF-!T-(j52wKDm9pdvp4Z4aTSOh0w;u zrmrpe2Tbg7%PkkHv=#Vg^t_~x^ou3(q-H}_>>YGR*D-x_Z$_6yX_!9V2+fLX$~Ml5 zy_S$ZcHfrqiFO z-H~W0|CuGXx{qru7>FAmx~0F4y6ob;0q?#2u;yIGqHXezUxb@=41**N07;AGkDChR zTP+By5b?ffM9BQ{f|{Irrar%5#ivnAqv@hkfEE1m3E=VcNcMo~K|Le6D?} z%z>l|KsCN_x?2A9`f-z?Of)y^HqkAdP#)IXY&HMWj?0=Bc>lGp&scJm2ZYSep_P4P zmHXf9j4%Tef~yYdYv5fB4f2%02z%D=v2xd7S<2_kM>{{;NtMa|FV?^Ls7 z7Kz?q#W(<&W|}vK%h~}lWU?-#))5u|nMg5#r zVhD<&grsdy4mw?W#DzZ2s9EOX|JaCQUkn^1OH-AE@3U~;V-IhQ(vgu`_sYOa>!(7G zK;4gGb3#w6oBC+;*~U>H84co!jGZdalC_O|=jNBXnU=~4+#&x>4+fFP*eMC&CT?u*2M_Ch*UH8Q457-J_&!{KHF^FNUSa` zbZ*a^Yd5=bKMOVHNM_0A0xGD28u#AT@71WB5^w8s{PwLh9@=0Qf|xsg9DOA$JSqE) zO&f|j=R=YUz17(ChT&{{KdA-XsZw6SQ9?+cKbKMf*YnXPhk7ZWf^U&`!5?De=Nb1H z52jvDqIA&t-%nR8aJGn6=z9OSTLYk97+3>vj$WY`FIqV4CAXv(xs`@jIpTg5HN?bK zs@wxbHkLX5q{9O0@9TN2%!~|&Y!ABX)?Fe`{j9##W!};b&b(hLt@Yr|MHAMLMA~`| ziqs0$vfvZ-qsFSsG@l>b_ZX|*8ov$(#+NMKEVsaCR$(%cc`gtw_yx+Ndg0jG?IjJ0 z2OY3!;Ua2OlE@sU`DjAiy{koW0Z4}XGw%RwGzGMgeX||lr7x0uWplX5A$5cdUVZqU zy8*c0HyRe+fu9mrkE10l6)1pq=ZY{tbt`iVKGs@m4}2N?;`Z0tC&Ku*-ywWvBe7? zb_V$zDyM|go#BRE=oeK z$8p_awf?PbFS<3? z`+xxx$;1AF1*;((GBrl_2siIZ%=HwlA8z>0tj51z@A|AzA{k6P5kF(K{>W6_A*l*&bCIo~L;daVVks4hZ8VpfyYgI*EK_LOfgOt=m z&Z_+z0sgX-Cv$Q-kab6t;-LBG~j$)XL+Vf&wm^?mMO5^5AXebO>5}0%KiAxyTcz1j>1dZ=9cf zT5=uU9R75ng^EZvs~o-gy=Hb=XEa$I@0k{qS^*IM@Xz9PxHb_wsP9=HI{EFxly@Ju zoGg8xFxZC-q14PWEEkc?tvRY}wR95cW75cd`^N#K;DY#COkY+cJ6PQW!S!BD)Nv>F z_pEZaYlEt@`l+ z4~neaX;<#LjZ57ScgPThI5g036&PE67oW@rkj%DOX5=}i|C5^$T}CUE457~-Uj2vZPWQu zv!J-8j^SxZwcOz`>!0Yd`#kziq8DV_k(Hy3E_&>#p;vXAkP6JAjPTXV0yX9(exc^o zh|*^r;2$;R>%{w}TtZVNP?XxMllS<)wmz=0O~q{Kw9=q>8;E{|gYV ze4eg|dkTa(b3f`ts6W`X2aD!vBlD!hyAR#RV2H~Fs! zqK0^q>nat;)D2L#{>*T;<}zpdGR~d;1e4U_hix`Zl2);#ha*V_b^eiXT^M!`zGuHP z%o>qpZ5=p?#Cx|&a!>(ona?-dqTQ#FXcPx%!!0eSjH9%BGFZtvDGY^BQ5xmNG9B+S zctAin>*dy8_4Ke%tg!GFk(N<&LERU^nFH7)cOE)=y&~t)f`THTOd6KU=8i*#vr^ii z2@TJ&T1pR%OrP_PoilE?E(sK~gMM}rpOK|-`*RKN=!q34){`@?{VYy<+^_Fwa@^E| zEet6O`R6~SU7gGq;9CwFv4bLEy_^g^Qsi0HXidvkwqRmuu5;eqZUU5wJUhfF$5cNcxtNt~61$CZjBnuwH`A267_St%SFdgC6#yMn(QZ zcQKWQ&%Prg8 z*3oP3TS~xUTQvuSPOW~Qi`S0Q3cg7-aA!)VBw@XQlZvU;bga5NNSlbk$tJE_%!pI~ zV&i-(L{^(hS^CUCM}cKMoTHnGIH+scn4```#tq`-35wNojT2rZ1eJ6Zy;Q0@V1l=* zYyjlJ=FkCEX{f&b8^}Jw>AZ%AzU#4Cu>hN{bJb{&YQ`_QD)xnu*%H_A+F}Ic!et`m zY?$I29QX<`Avh)J#J2=H2z7 zythW@5|shksQ++@OwJkRZMP>l%b3FwP9z}UPULh?fvcV6f>2L}gA0A5W0;f8=Fk%A zw~p9+1V%o{CN9M@JD?fum&A47Em6;Vs;UvRrYqH6%d(kk(r7niq}duiU%o^+n!H01 z`wN_$MW@LvC~koKe%5nUP97Ek)Uo%;joR9uLzoOMy`r)`^C#!|wM1z8#Y?t_>^34* zmKj296z@r0ejruEF_wV$2jzkv9kz}%s3d#VH`2`yg1fZ8Hs+0*+d6FuPtLo#hahZl z)Z~$hd4^GN#-R^)h%0Ga*~!F;=NYXOerg8Ny#xmPABYg1#WRI6ZwHU42;7*NWmnj| z!6hdlueCJYRV30h@PZJ-*TY$ubm-G`>!Q}!^LT$=+*(?g?s?3ie(j~6`GuJ#U*#_v$pLp6 zH>D1~X*(e8ET0iXXBe8A(sbQBua;Z3tKQuIIABL4988D1HkRD9w zSHXvPszdgZs{v#)V;dqiqy^fdof(k^HA~dI+NtFFNUwyV9{-t{g}V(NlA*v)^o6LM z|HS;1jdz}()GvBT3-@$H%m}-6>s?4B9?@I>k$53pnA-{bm{oPh&(Vj{4DRHffAs3n z56T-J;Fo{Jqy)9h2I4+LK0R`1=9`We+XEh5lE$zF{`Itd{~LSa!PM`;+ZWXplUx*a z$kdDZioxEB0SV6&w7)jHOim*7PPAe3=JQ|6FAu$$S6mxREVs?&T?j~W;Ltk{C4FVp z{x-RP>Au{s~GSwaOrcj$+v%QgwNQ(5h4~|pKbbGMJ^6*|Eu-oTDj9( zur-BPHj8&pjBub)TkByT^iNZQ^lO@w57K1ddi)qpZS6-^60!x@ z_uAWbv($c#G`$6nC(Qh5u??(9tY^1kzoezvSE?m8F3FbF3%x4Qx@~hNql1~$+!XxB zuN^qke2*68)v_d;xPjv<`)%#7Zu}bBDNlK@6RXIGt`?`%f(~7APh%OvRtDCbIO_HH zF`^s2w79)U*rS(i{+x0z*9aO>fl?fK4-hY`L-vGo3KSxG?L+#{MIDajUizV$Gpn}# z<3?|P2-GCIR3{hxPucCoyLHxTrMK&|lzAfKJ>=RutgKHAM zT6v}ZdCwm@WLu4=-sf&*9nhMq%CuY+y&_*1!RFth0k;=ZIo9jV0&7NW6#MSMGTOd2 z-+JUbxKP;G`;NS$MZQmM%cXy){mahP`CPAqj77w}rp9i4Ih)*Oy9DAq8dHDZ9e9?{ zFMZYh*Qr?8L#9Xn_6})vRn8_D{0C9Xa18bk{2zxl*}*GH$rgBa&!O=#xU>iC&F|#U zEa*%C%;Fs))EgXwr<^u%=2c)Z@BeY|A#nr`ZwmtyU1oKAAa`ML$PB();HquryjSE) zTvy&T*EBdpgjcU8r=^7%>|ozMT0*Ju4AX&bA0X0K}r;(JT}%lz1?6l-g#sX!Hfw$gK8InMwE{^<}XXNC)vY8`b7^7B+W zXrX!_Bl*^lD|faD5+X=Vbn!obwZ%>}^D8>P{3M#Pk{4RGinYY$Kj2s+!^Pj zv3`|EXMtucAHFU4-6tPoNfzb4g`R(muR}sQpro+<+Vr~rBXsiQ#%0aP&;D~3HThzs zF9w^wqsBk0W;QqAa%!EfXWM%rsaSetNjf*`UGt&N|aED^phxWTds0?}rWcgLr3Cym!J{k}>R0 zU5~!c@A~jag+~5`LwTq)kBhtQ%b=FiHKE@UxBGo!>tJBe)J^njQ&dr9T|X#xU^o8<0G3EAuP4F%f=>aQpmBDUe$oLRA)F)Aq}5NvDn z-d#!mM3pdsG}d=l`3tpNN;6WhWa19*I*xz>?mA(LtL$f|EtGo9tXXufrO>l%;@PGl zv9VHzApEt%ay8}*870-8!rK0j9y_fb-s4eOtg!yIEw35;48i-+7FV$b$U11b>$RKn z!XA|zRb@xNk^@5Qq&NmBlC}puRCuc2wN3)aA`8Hai+!y&RfdPl#zN?x4&3IZ0RDrfp=t$X6eC~OMHeFS#H;2vg3cRw-b-;;L5zTqmjjHE1rS%S z%)wxa@0Lai8r2rr!k58z(bjT?E_g>VlnL`>Mxf~@;0<7g>mg8&m9|O`-Ick|kcSpyqh=#T1*w16PsH78=UdJV+zqV{3&r#UXu3BfxC*F!3u8c*jlH-_$Z^tB4 z>ufV98e^)H@DFZ$8#kwr!a9z+W?hz#qZK54cqr5LtE#%YOfFv8L${(WX@S~6J>pbl zES0k8sH>&cM%huSaUt^~g>SsUIw`!5qs6**?;|YlP{0|onVOyM=b=nTB2P?90{fZl zLg8-PM=0|^d68c&a(oMhadDZ==|-=y6_=FOVcgG#3yI$Uge<6@K+eT;?O?SzO4;+# z*bPcg{n<80uVJHF@yA!wFS6#S+;!*)B>~%Oe;Q-2rm0df)u)SzYLd&W;(%=$epIQ9 zhg=+C{)#_k&Tx|)6s%S_7G>}ZJiIM>GVVW>eWG|leT97In4h~R_x4n|0qvrauEzoQ z{Aq0^XXDe0X{y4FJzF|Z@`ob(c`rOcSw=Crf>ZbQv~Q+p5kM5|&!3^J^I);w?x%x9 z-6)Ad<+XpBt|1|KQ?1Bap)8)n`|Go>96RR7D&`Hv2KBPY_W0^4*K`0oo1Us}@4mB= ztI_5pEu4)${s*sp7}S$J1X5_^>XRdox)Z=nXGA|Vo<-Haou|2 z1%FXig6Bmy^Ji3rrH{lTX}ZWb)MEk9HgUdD3I2H_zxp@!l#ES>6bhkF(^t0e1r_A9 zjCGZVB{oWY{nHe)^R31vx9HH4|2#uPxN!rl@!87M6Fj4r#C`!MR>fDiz(QJFxMM1o z_^lDa#HvlYMxQdMgf^lFJAm(&6ksEs2z^uMpSGr+_a)#cDO+9O z3Pgq&A;`PRW<3p-O8qe?>FI5+9W&IXcg=r~K0ASCi%eW)>KrmMwz<#JS*eCcc5zx! z@E*Uf7+Mt~&l38sww~nRlJeP7a-GuaPe20gGO$;24A3^r_4Hq4wmoLsMrkYuoc^yg zBz7S^TA~*wT*H2oUG658hV_`j>lO88Gf}$l$b)<#4VYR-5GKG#`EfYD$`Z0zZFyJb z5TVy^QV-&XiG6;j-f7vDexDtlGzv+ZjNsnv)vgSDvSj+T`G<-;DIg;TVPwFnA6BkI7+4NV9Ucfhc=OjhyUs(E)>u% zvr~03_Z>o6TnKk%YxV1iXo77-95?R>`|^JTvA*dm(Jp(BUu0)Hox`UhR8@7_Xak5z zJq2=8(DAS+LC-H*vCp~x9@iJ%$4D^LQi}x_BHMo?u08qyW>Kpa*_~ZXG-#cM>*XCg z{&b4|gSjIS${O;SDl{?oWIYmW7J@tRwacFT)?F(2aj^|PX49IxZ!vQnhl1wsWMw@v z8msZiVk|zcfxer#9FkZGuUNAE-o+Mw3tZX%gKXS7`r@h8RmIs=Xm3x^EUs<_MHfWL zQ>Jc|t&8zet!suVqCqlDEhpQE^1D|FXAr$I*7K&}Y2*ITa&MQ=opY-@!6JD%PxqZ! zrtiFt+bQI3*7?nINBtuWJ=Q2~#GwUSn)s-_?*~IchoJ3bhV7oAe3F<}ABO3jXVu$* z6%DINYJx6||$F+vC_VNC6NJq%%T0Z)UKT?ja(0g%(=wa9eTsqg$Tp zfZXt2z%RR7KGBI8LzH*FRp7#?u4m(}0n^15B~04UkAd#jmpAi*+tWmr#11vk=(W~c z8C%zqfUnr|`NLE@Mnr6`aNm>bZe=svx~FEE64ZWIKizkg400K_aJZjvSH?kfea@xg z(E}G9h;6&+D!#^|-!1NW${?Z_ zGtKVt;yp3<$FI?g&&7k|6QvjTh2Ta<=#t9NxY?Nv;$dW~EL^cyX?AZ;2YgdfP1Aix zQenwkH6g#aA#$OSZJA5SI}5pN;=lMPg8s|aJjJtl;lr#q;A)n?QrF_Z<;``=!(&hn zw90P#@jiPN`r53n)kwb4a^dn$!Fd*Q)Ul^SrQMX18C^5vxw-#5aZ-^j1$X{z#lXo; zkiP$qBTxO(-5VDYw0_@qmhJg)UUNnL(l5)Z8>HPxLubl2ZKE&$j*0S&L3Rz2_7!-6GBGx_P|7y)I5T7;_PE6+(*POnr zKu}w;i#|?q9#l`uwIdzq?T)k0aEy50h+e+T)e}vjVpczT0*O*I3;3-CUEseek`#QaXi&i!A%gxJd{6_2v2I7%b)<)(9U#=h&pcPzP>5 z67gYZ(&fN%qe|xUPs=5!Fd-cjXqSj|zM0j9eD^BnqpuH8A1TEIJTde_3-uc*ep~ z=BOX6CU;@>!~FiaD4?zMDAn*ly6XH`LA2+MCfl`~ASLs<23Ht1%XP{(AnXA$s&>7{ zqCvFh66(XP7AMh+t$lb^V0YfwVvku~n0fp2&+<`Sz?upI8}9eCF2;v)ar$$z0X`vv z>ctrRUdpC^lopa<*KGR4@*G$ULdLC)({@DL*sDfegmLENTw-}6t|M`A4}Fc@oqZNV zSkFLb?N<-K^?pcEZ?gB5r;W9n*;_)^k$qdg29f1n96?UPbOrQ!9y8`7F-;v-sQmRTD>;1JED z1v9oIK824s??m5oU$FKNwkLmp%Duo|2qo?r!&l5YA#=}p>YI?DI9u2+qSj0jlpq7ePz@(ertCqf=^tprN$48{CcbmCYnL%Jaq~>wg?Cb{jD@>*vfo z1Zsk>I$UQ*dEbgbJ*|dwg1An})1>N&i5XclH?{5>I`IwLUW1I)HU_rzj{B=c8QT8^ zZnRu)lW#6&bWpX84r%$d?nRdV0SRRj{%V|s1&C)abo+cC7S@fE@ks(9;5{iy3)S0& zmp#RKziJk|wVE44oNx(3+vCYWWde;>GpT4|@~_q&X#O@nctDHQy_SOlIZ~o6IQGZR z@3ApyZB!eV<_q6N<_Se4Ctd_u_Qv$1HLQOWqnz+ey}ky%VjufRxJyyBwe8s@wQ07x z+A8u6c|xruRja%X?)($ASXwGtG;L0r1zRg(%M~oyl(TU34WZM$6n2JDF~m*$UtLi} zy2~4@*@HbtT&war;X}KVi#`;Ah+-8h3wheAtTvJ<{j-jF;=#Qqfmn1CPkhry zaJ)R5;b3{K#LVuuo3OjU7xy2=7`|Ig0_(4G6{XqopjZ{}ME=E+t+oEV1sJRoQr(}N z9Dn!piQ1#Xy)*XBDAvw9KGOm2?*_9^;(b-kl>>pS5bG+$j{L~xKhkn4Q8Fc;uc&D} zyn_Bd7wQ(rw>E_G)=oN~aFh8DDIH#3R~I%ISE8|36ga>wK43rFHQm1#8obh{D=*M z$8fcZG-HJ+$DkX{-hi@MgWlBFQZ&ZP=bs?IO!Cqh2tBz-#PE(5s}~-Y_4yF~Mh3x^ zZdN47RH#+u>YEC>)kzHcqYC~6a8wl8xhGXq#5RqumvlW8Rj^QpP1@%e%rRyc03Uvd z3o~mFmU_fMDFyb_<%xyw;rkRaMoQMnskDpaI+*1Aa#_UVpn9(@G4~S);k+68;p@)@ zSa5s^F~YK%BzvE)4wmoPEMi3DZYa}~2}=+CrY=zw+=P@;EXpv2-FCPPa)ik1A#c^? zhoe5b~3PtJD>>)fm>7cgWEDcdY>=V_F

w0O=ezmEWlQ0HgrlWq$yLJ{ZRxe(GazuUhA*ts!lj)k5caO2SIt$^gv{ANoZL~ z#)T>U>y!^VE-`aF%VVdc|5;Cmwr`gyd%nunwzA|0Fzo{@)H3EB8ua#HhznH@${=fL zb1t{}1C5n(bdKj#$@~T!T5fFHOIA_Bln$9mqxAALWt`LPVp#=A3It;8Mf-JOPq{gr z(eaL!H=n5P+@8+NYk+WtMAmX67VPBf1U64Maa)IC6)sXROF}{Ds(6KLrZEP^M-Im_ z0%Lfr2sE*M3E|T8EOIL}-VsgweTBLKDKeSkf`_h^{T7?w-mvCn%+}_L^L>E@ikAI$ zx#WvW(&p!@kAD$#36WC_>{YJFh$g5%MjpXNxL-XY|3F~S3jA%kqtCXuxgek~+Ec29 zT)f&$$C`-g?J@qu6Yyy%Th&~ILq?VTClbfd_8j}LS_*8wey>>8MYVLw@aOhzP7K>Uwq6MQ^?2JtH9Lx zD{HHvYwiN)()ZX``5%V}$y#IIdL2NXj@Z$Dm#!$U)+JBLk2mEGCstJmN~`rAIx0XC zp@uZs{(Bw6sy=Et63-GlUM5Svr*WTME9;gBQWa;aPU<;Y+D@xAElHed(%AN_il5WT zPF|6`pim;T%eT&hfIu;xAKRNNT>V zJ_4R*PM(Ijc~ob#IhiGr-~Xtme)Fny%qFb+BUoQ4&sC}IJ2e$TQ(?M$2G5RQJ(P-Z z7uRaOE)Wi#jemR_sZu?Ye5(y{krB@El%a|jZN!aE#vCAYrxn*4VYb)gS+^b?kc&D^ z1H1eE)wTGMb;W6%F9$WgR*0ziQ)&&�eJZ0oAB(T~- z2a+)F`yQ9#+V73;oxx0N#P%tLOSdn0k$r45`0}2^u#l3ETfJ)ZZWrKi<2I&hYIq3w+VhmK{=3RCoag*W`e}@8K6KEJ89FD$FNt8S ze;s|({Sp%PQD!b#{Yx+EaSpqIVoioCK{&?_dqi&l?1=@mjGQL??n$AC&UL#KXAXmmu646_3PG$-4&H(yK{-e{d`1` zB+UQRA4GykdGCP+cirjSI$k?0WDS$PW*iBlu$F@n|xo}P3V9)zHMlb zq3MkKuCzZuJRsZ;$J51`xU&Zx^3#;+P;7HI5D}$!h;6aZX1y{YeJ9)s>_W5R=BerT zA?863e-FCt5b!6q3FENH$fuE0*49Xx^HO_{nNtYebuU`T=~+=SHL|DP%>6(xNG(5+ z9mH{J=+IybTf({{>;kK?ibYyx23?Kf`e5Sn0KW}nK3p74to_ltcH-A$=e|%dlLj|0 zPTa_V)i8`S0Z!EbDx#9=Re>uHe12==g}{l=`AN6&Fui~~+0M9Z)vu((2-7GhcQzFV zVN+!ALH+z9e95}5pU?XZX^sld#vlA{tAbDW-D?pqOn(qrQSa_3VXB{3+^f?pvZv16 zirZa$#*{~X^f|HoSXjvKGoTMA#cFkDZ_3Z=0-5F2- ztWt9-1UmTkC$XSRre}hY93vM+0iDbNQ+dBO06#Wb-@jjR>y=5zgWVu8>54(*28y9P zn&n%>wzz5aWK%w8TAI23g~|zTf>$}N7D&YAS1Ip78szFn@uRfG2d$3B$7I8^lOj8d z*rtu5hxh?%<&uAdz4IM5X!vFQY%P>((4TJo@ha=K`s`xq2A)=XyCs?#(TGF-mv7O0 z(m!uj^=9_>P#xfIonldfD&@jB4BdL-{NH)ZhMUbL?Lkp`U60XH)pj@)`2I!00^QkG zgKAawW&Mjkh|+9;Y3FLl8%40wj6{R48A0a3V?cee z6A|=c1&jls8dF~h;{1QE4Cj;bUk%h{-TB^#vkd^RFra*Sfjz@Pq_m-K+($JGUm~jFlBJnL$g5y18|w z)Vb=-EQcjk(arjkyxenOrS1oHhNyiT<|(}*v0d}safMwxX=`aIjrkqf_)=yQBt^xR zjrOicZGym`p?B1v)O-Ur1O_3uqd;9g2Y?wyWhWG z0xqZv9#S_)J(y3OG7PqEVZHXt#6zk)&wy=WOYJWgK=K=BiB1l(pL3i3`Z;VYUn*PE zHoyJ!m33Rz<&JpDar-4WaA z^~r5dV%w~0cie@vZg7}pMSB++wZSP9p;MUj(d=$5YJNz}oqAGvLtHLvk% zv-bW#j70#sH3Qb~a#EZ%n#qt`lH|+RJ<&@2-BP1s-q)(7BQt81M1v)c2|OB&69djA zx6G=ZXD0C9)djFK)-L(#?9xvSyZkL2D-4mg>NwhB<9u=UzFvwznTzgv_@sW}J{PNik z+`g(Ab&S3*3^o_EC-(Vgw{xYHffz_0xw~w=*JF8A>CsTtvIfE$nNT3;vhWFE(l|Kq zcnkQUVsY-koh-ia9*nUD-O8@F`9mE%igfR_ zkxzuA=0jkm(~G#aKL~>Z4&$Jw-d{NMW|$6udhOB5I-9ZcCR$`}uytpyvC0Lp4Lj%M z3FrVC793s$-|bZ!Ek@}#0>lyzX)DP&-?3n>0WrwT>RMc?mSbpWXK`lrd4pf~Ob#w` zxN7Z?!xXQQjQAJJJ3T&#biVK_q10tr?pIXk9=bMSAdzg1Kx3II&v5s$zSM$;Gx!A} zfHD=cZTV zKtp{ieQV&l9T->@ab882O;c-%a?I6=^}qF3_lfII;%l;{O@up@Ox6PR7Go=F2F1zO z&x65b51dp&L$aCT`A!zHGN}@FOz&>CAa7mH7#B=0!39Oc>Wb~T8sou+Q$Ik>AwiO2 zB@1@bYXgiVKF(?|LQ`7gqb8(m5c{>vWJ;&>ZU~p|q5m0@$f@&K*{e^wNUb4Xzn>Xb zPfcWY?(JXEROs_u8qz@x{8~jMj@=p?$2+8$y#H^aoccp8+C`b){*6&OH?P}vo4WBg zD1h76Sy~~UGO2p80~2|?R<8msqcJ&ZW{td+#+D2o@;xQR>XRBja+TO;6TL3e-9-QM zdtW7i*fs_{v=ZMM<4W>@U`AzryVwXm9wmrNhh*z*c3bM}IilXFg^uY4bEyd|ySHU1 zVk6@~Ho>zb%7#6IS9jdMuHN%&jSk4lPISs6w9N05dn&BT9$=5mqP?q$DszrEo#e?QTr%Wd@r()XIu~~_ohO<_gF^c8N+S|AuE$kGtc?I%&ZNpo zBi$iOuUo=pvdS2e_s|{x8OjuJ1&o|1@ZLb!|65p}4=0BndNgu(W{$l)R<5Tvg%Aj%^hVUf?^d zQ8^=8gu4i5!ZE(U(ziA_~tl6il!~p8h%u7Rk*we3eodhqKOtO<8AaI z)_wh`r?Zb-;iIAP5Lt1AB1zBVK=J61u02^Mz6Ot{Ho95zXq~#+%x@;oDq#r`^wSD3 z_xBJl35FAu&6ciIY!x}BINpq+Y%diE*0ar?ll~7LK=!V9@W;J|jr|7Z#v-#$g5IdVGqhDCg@fd`X*ZMI{3j0GszZEl(4-ODz|1nfzjZ7r%OHow|8Yp$4)+?? zWE5N{E$pdUCcd+~hNvB7A?zevvZ<<&>tc-P@h%l_jGP$V7FL;xM=aZm0>3F@Y|}S) zbHe;IoxpnXtfA;ub_M+~$=FI7uFsUYJrx78;z+~QI($N?#Fx$k?}-V3E!tm)_DU-s1Gi~HXBp%6QF(nW--3p%xIjM zdl%(B=HwNyvBC6-Bz)bopaJ(kjvoTY0WvtBMoCMtr4_9XM#SOXKup0O$U5Z`Cm_Ic z}Re4X(F*103KUbHiE8|3JQ~ms`YIaY|Dz81pMU z^Xoa9Xarnw>h>u+Q*3mM*x?nG{|GWi``2OiivE8M=FUQ?f z@Q++z)KFd8&bSH@nnKqpeSS+$u*~bFD}lZ=&bYiqZN&P^<6r4Zj*?A*#Y-s--zx^t zSy4%d89S!L$+@VS?{kYech?8p4Yy#vRi|R1Q+w~Uw)^w?xh?=7p;G)3zX|QX`(r-5 z{4SwMl>7kf-q3n4(Fdwkw|h4haCY^ZSi!3X`AcZg{!ney_l`03bl$OQT>#{hdFbY# z8Ip^)1(qWwt)2P3do*_cQ-bkWvPq=AX+V(TrC7lzX6=KDjV^@%oIg(Bh2OwA=+Mu2SL&o`oY$xaYv+?W=ol#*N8niL$b3CfL{DAu~Pc@$S*!(BNuYuub%8*|340i zoiUC#G98HBcIq@S<2D!c-{J98 zrMXPiUL9N(QmQ+cd_-xfdSUPkFSW)zu9M05_^8X*JR6pu6fZ#-Bl|=?r;&E`VMZk- z_||AVXDHaW9HY%&l!8*UaTi%KfuWPpXPTE+4Mp{-4&0yGknNrFJlNR#`#8} zz_8c2@;x7;vVaU|LYQCGt3nw z;{YPJ&F6T3<5o+}=hq^*+hLg6z){pD8)bFKT#9@&1v{RD^^U_Xp~gQC#Fw;>spim< z*oAGpS)ho~8*TW>l}GEhW|1t0ey)NNUHH=Af4hn&6Sw6N(Rrnl;RKJoHalwub zNkPE|)^6K$^eKG|GWTfd$+tQ~3#`T^34*TC63RhfhIE0tdt4kI>*sH^(V(rM)!1>< z|5WH>-nyZG{AtVL`Ql6@2^OW&E7IJkF3*k)5YB#p}fZ8mVbrL$o_zyH#x>_G7vQ0`)0-SfLO;4mBDUbZW5xfJ$_;Znj`IVqWe5Xe|k zxk`{u<2n_)rJI|A@tIptCITQe75?CvwMX;i&7%1W^ou(y;qJWm545)ND^ZOuoL|_T z@D>-Fp}aBJ?)=xI471m(QE?=BmIaTDAH2=$iry`CqgcJ-XXn zEc=7KeyAL@q4zY_>0C=?1-ZvmO={9H1WIdI>PMwxQVhpS8U1;I*0 ze7EVPo3eMDUWk6vfLIKVg~ts=9z2_pOtV78w|u&9~2#F5`swPElbw)U2`zPhqsXCix&zr5bFd?xU<}3p+k~8o|&0^YRSpN=wtazjJmYvVl)=wJQvIMB^-09gTm-UW4Z>)phs*G)-RFO0a}71_@e5T-EO~xdP}ZgBt()HHll#4O%Y#cy zGDtn)^6(PmDfZ#z(=bm*u;HpA#+%(Hk9wMH%ee$recPQ14Jt?26L%px-}Z?{@wosP^Endi0xCmB-UN3(8{L!&tZM z?b1%^ki2D`H)W@KsEGo3C1qI>Vb&MaVT#x*4gdxCg)#yDuj)QFd`-R7wQ^~B`@N=K zGLR3B-ei-MwYT5k#}s7>b#`ISTb2VtOpOuYa5GY$Yaj1UH1E3mC$OW-{ISrPepP5J zncb@9nU>QFF)4rq0ze~c8u5+q!7o%lmBd`K3}k_|hl^t+g&zLiC+HyUL8Bo&EpDhZJ&3(~itHb%Pdm0-z# z$MgzC(}T45byK%d2J7tzmF1s>c6yyx6<4VJn9|VWrpFo4QbYyEB7Tt@pOO1k-s^c! z`my-aOtHVa3MNm*5a55p?4R`CtXEXD{8p7+0$x(Zl6XJ&uxyCFI}*-P*6Vd?f>*7Z z^!~@es&~5>@mK*+1S!l?%Q(1#zZCtu5M`OWBq}w^K<4c}qO0EHWzZB)>1a*k zB~My-NS-glG6Kt#+KQ_RlyXwDTg+Q5@|AZ8kG0qKn7S$SgzXX4+73*Q2#G{~k{EHC zjCWK4Ko22+^VqYM()Qu_}!%JOR3NAFx+IGB)-QD}3KOvA6zjeFF> zaV{2nfs`5Lg#IYL`dm_BiEv}z=b0u%W?wxWenITC*x;$Ssc2j!8!SDpD$5x?O;Qng z>+ZPw?-9b^9`e20>$fVBY5H4=l3|}pT&7;a{JD~OYLI7KS4rT-4iECu5B4@uL#aN+ zQqroyl%ikMG*aQAnGfaaLBA_rl0bYERl(_6AvK9X$B>D#Kj`&4)*qkwvyZ7voj-eW z54&_ULRuB|tbjd`((}NWXYY}XZ_)-w$IPe~DpBz!tAwp>g+KiwooQTW;=>~5NrX!WK>`Zk|*y==GTl@jGN#C6Nc$-W#& z$tAZU$9`09M#rxh$9K<_#?q)z6eW`cF}R!>&*p+HAE0E(ZI)@J0zs-|bTDV=Vvb3T zXIKeM9;(P_m}aHiVe$X5-y-$p3bL77$2MYBsZ`S{4_m=df!B9bixK3jsZ%?nED7|qfmA~7 zw1Pi&cIj8utd`w$u&-WgsN5wxEP}IvdYlB=!#y-eM@y;3D&E#bhU^;upKaPaBJXvU z>RscYy~rOz!q;CuBrZRzol%k-A6_7|ujFVxNrO?(-UmRQ)n3x=mUeI-FQDHDs9vCn z{dUl{RrA|}d1n6C^ur7_VAA1o;&KYiC8oMP6!ZP)sYe*3rmKnVuF0ka#;ouRt6=xM zFi`);8=wMIxuM8QE_Quhh3`W{N5Mp-hWmQ6X?kIiz|;OD5p}R@;SS`^(JUqoKmKK) z>H2=9Ogj{7leGua^{aGU%_*W&eZIc8Fuy`0OYS}v0C{5gx=T^-IS>{{(!dvkp4ar z*Yf&CSaVgy*|Nd{)K4SofXqf=2W9Vs%6A&^)kiMnSK_4Yjcez=qBer})_k3$3TA^@ z1CGBR{c{*_$%$p@y@8u7ezL5Dez^~MKR&QLhZ=X2!3LZe_4R#8-#YY1G!LusyW1o2 z?ec9N(dRG$H1`K?koT|F5-pP?vD1zm!g&C#y9RZ!uo|UaeI(*ZDA?WP*q{#bF3p!U za4yA3HYd=zdXXGYy#Jwn{h4GVC6X=srN1w8mALho4imPoow{z{>nHczz7377O22Q` zQWD;r#};%RDeM6O%W}HxL6EXV#`-Cec8380E$$5w z*Bbj$sOM4azVY3;>7Xx}c!GM_+z_y!BQoKmp|r;t=DBa9=LL6j|HmQYHOAzl%>1CD zzgM<+m|Ri!RfGnUju<`^kCf2^w{5mQHaPudx5lp`&)1A=Yl6-})#LQyI&(kLk5BlE zdN-)<@#8}nMHckkw#}T(BM{`3Nz?fTvm?iTpiiDhjOVP!MQ1=LcK+?pU#Mb5Alrdi z-(MU4m5<0K3xh{$O`l{?W$_0AIm5>Tj8oDY-4Q=0GOZT~TVpAk&5?N*uPzTlN598b z)|Ucg@YMFWbLaH7RQhBKN-BMlsgfTylv@kX%pe+{fj9{nPqME*gU^oi>;0 zvu_3%O@(OyZa5-V0=d}m#X}e%!~+dGGwIBBx=$xJ7V#Ca>0Mg$y+Y!&nYD?n(4?RE zr~~{AY(0%RidfD@B|LwzsW`1Z=CZPip9*f=ANN+8S6LGespP{KImAX^0e!L0Ky@Ry zCQD>%lONKZb7_$pyR4){A{V>Qpt{#`{9`dT3ZplPBrP!d*Yg@lvu>>~YnILR3fRud zYFuKf#8fTsgi@`Vcf1Rit*AH%!irg8ClCCnMwDtvyyM}XZ_`HVDwpmQ(w}&< zut<1%c!>eDp&PRmN$?oN64SeE)&2h{I?u2q8@CU;whm zOG7PNY7W2&f-_4|T#4lt%$6fZn&PM&m8PYZ_Eg$@dj2o(XTHF3+y}>fUBByhp2$&~ zq<*W9EU|wdhweI^c`?Xz|1ee;F&cf2;2NQ|$MT-#ZYWew1gAlIctPaz=DVhc*U2x(OOR--Wqg*Dw% z@|F+6M^M}!T6XuAlmxSpz;|*z8$u|V3fGn;TSbc|)IzI^uUe8uqqEzshO6At;N^yU zpWN!%NBlV+is(hhUqUQOvRnd>i|-ILAEi|S4Ees>CfxVK8F{>d(N2iJrE|N#5fy#G zy;(~^Wh4dR+S1qE?E}{4{l?lQl^Csx*66=W^FH6zGIB5MLW5%SAcp9fm%EnyQ1gm- zCd#{0PXtrFvfpFO!~1%%?n#qwcxi3c9J`mOxbdHs4z%E`ZAQf*M*d!WWojoskdoq_ zg$8OS{U#y$%0>H}_wJN~W;@Dn!v`n1L9A5e%%XSuAvU|Br(3jpf_FpDyip930TwEh z(0>v4@T7}&POcWjzJlaS>W&3h>SE3-fFE?S;yNa=yy0(nciEWpeMf$nIn*+VVW^e2Dg{jC^M;<~PzyYlGb@`d)?- z)#@?Z3%c3ZYkSnerBzn&O2>X!f%}W<=0al5z+C~IrQoi;U{#hTam>@(jO6^FxA~(j z>sP-bFq8%VLLj}VtoSeJm$b&fww&d=708a+-;6h-S|LL*sY`Yd2k3lPkvZ~vwxz4< zvhN|7#=pU5O3|882a>WW%`myti+nD)sDc$nBf3E@+BZ z+oA}h=NCY)H=hAys#PQxK2BH+JsKSwk!q;O!H-|R-e8y1VI)W^aR z^e;aQh9Mu{{b#7Cn?9!}y-|q;jzwNF9G!y|yAk(#d{!t;4>L6z5?%2vnhxY!p94ZF zyU2O#IkURDhHSkm$t%9fvE4z#^0^DemUXr3TjZMa-(D;l; zc&p!3+OxaZS0(5qQ?L2+VM3bu2vs=p1T9QSs{Ea7Wj4O>ygQ%TV{Bc(%5vomah~$} z5ga^y%h*8;J*wrpkD4jUgrYYFHY!m96s1?AM!DTWY+mUPkmmW<9b}~0+Gwwnf4omE(>%cW zM^L-SlCMr>#MjwJTLrG;bVZ!9YafT}@Z!d*AhNNjAn$qr<{Xn^`YqYvcWI;gMAT=W zvQt#P9FURMe~phlnP8`{_LtZKflmBvv(7&!(UL6L?C3eF*NHA~=s#eF{`?*E4pZ-t zdh@57*#@`>{uL~ z?~#6Vc`PrQY2>LO8rv<1Wa8U)&Ftyr>UnaF)ha9bw~wX7RxTN*^_v$*AHjKR9ZfN6 ze2C;cEwV*AC{Yv~p`(O2_8dLNt%f@GYw*Xo)0_cB)!PvRWhw0KMrY^Tbt;6h*6* zj~JS8*>@jI-9gS8{GPj{^XMK`Xgv9^tDNJe<8c{X1kX+vcF3PUgiBjSLyWe-Ped|d zUy*gM(YZgEnqrSb2uj#U%?YFDBxs+uGNH{idbwXUZ&?fK4*egWx!cO92Ly_U2P*Lf z@e|2%t4WxIaMB`cgvEY?~mjkftiAU+ln$3l9`{nE#=U?NYA$dHm4ux6bIL%kvIbpE>*r@n;8Ni;F z{gbI_K-|Z!GO|UHNuvVvT(HL#?hkb?cJ-n@X>1!XK#r<@G!4s9LpBx|na2yLE7fr> z*40gV{_V5%3tY|NM9iPz168|ATRp0#55pzV+SF(QM zOo_d@0?EO{1$3M?Qk~jaHEPs58!c}zY{jpJhKbwXHaHJWy^_S*D6S z_Rr|^C&yAOQC>G=IGAUJm%j zi=Cs4`0PdO;xhOYhJ0Z6mtt)u+&3C=3vFchI9G?eX zV#>T(?!$a#FbGnA51OLoZO3sr=Z5j+yxo%{X83o^?TWWdtYFCh5FQ|1qtkhyz2&yd zgiw=y@_K9r^ypQmu$ZkQj)OidWdMNRP_b!u+RV|50z8n~Mbwz+PCTH51vU=f8R{_x z*+#K{->`Qd&HPRA*dCN6kZ_&L$x63(P*0QedVn{Wz&$^O2Y7phQTN>@$X4WPpUL)l zRXlTG*b8l}_)90cso}bT-(FqZ;Fpje>LNsPT8Z4pKSowd^L9Lz*N?&=fFv1%=-dd> z=Lf9~xKMvR82W;^xoOrx%Nby?;MeoThawK(7+ie$k5CeU`p*Nd@m$p{yJ|IeDH*gYul<++ z>5mmnAg$+qilJj-pL4vAuGW|g^6nNeRRktYZFsePollXbK{qjsAJelacFX&MHX?id z;Zd!xObO*)J}Tbheq0Bl>R;BZ{=($6<3F`BWsyK?!Hjd8Zp<;{KT~}BFAJD}znG=t z^A65$dlT0$weLfIQ0C>E z$wd)r!s#uKq|o6YPT9P&nF9h17CCoxs$^mCn7)XKY-vk3(tfiM7F04}gDt!|hkmK* zCqL3JhjdL(3OoZk@Od`UtWpCK`6O>CRbX3AHc>kG&TPvnC9TL?FEz_C74mD>U|z@g zVE%UZzU4zY-xt=DxgeNyKV8|>2@gyp{twDjHKRP^y53za>gvivqwzJ3#fx>{8kEH3 z=*mVbnz<8UaZNP^|d)CwBZdH=lDMvtUB z(lu$%Z+F3FYV+l z)$~q4n0A@ReZV@O+2b(*lQxs6t7pu_D*Gd78Gg95`)Wjr3=2yM!S%BvQ@Z0lg~m9A z3pR3{1bpRL$D83hyhO4WYZG?1QG12kBYV*F%6!y#J~*!{>&Nj|5<7s|M56cV{bxIC zdPT2k)||PZWOwA)ps$?3-;w>*iyfh7ZqBk3&=*IMp>6yFM7lCzJaHn#gFS-3uImZ< zK(qK7vYbbBMh?o$H_eWO(z-(Yo0Fd}y8+st-d>c5yc7yvNQq!8)1S0@j_qG$$sJrt z0atH+40LNCsX>-|JPVqTIP&TtKr*ril5DVrc0aN}^!bosy5Mx4yn$$J@Y%LHoj-bv`yVe{PT625sfd36VefjG6#2_PU94~}>|S@yk?sZF z5-U_xwY)8_&encMk$EA6AXFDo4z**qza#|#OVF>Jh1p8WFiAv#KcJLEVA1|5%wurb zQH1GKU38i_f^PdyLc-{!)0G@}$|h&|@;v~3V(6Xv^gk305R&6_cg$+}{vUI9TTeLO z@{nLMM^R#Oy!XPMujM7@^CkGff8Mg{uHJGOR>x(jSftWucy1XQlbCA zlHMD}SqK8#pL&1oK3z7aHkuA^xf_;4Ug;?>O2Y z>0i@C`yBeP!j*>+N%t|U52r7ME%9Wd`OId;FiR!+52tMAzXTA(PM4I z51Ly_AUdpK$h)|ma3w^pMtK^C@HMn8L)7tBu+uqtV=Jp9PaEyQ(fW;UqB2Rc$?pj4 z{@RF>Si89s2DFw2Zav~kLT~g2%@?vtz_amt4HO6|QZmD5nxTM?oB@ad_i=MVE+kaU z{Pu~6hfe^>>3Ou}l{G?gNRPR+9lVc5N>hz}sT9RF+p~%O*%d5tFSD-zl3JcI z9x>QwL8brX`E~-aGFqYUCZK2t6RjsH;E*^;F!Oi_xZRtkI#;W;ybSZ|?s_+HWb))j z7L!F_32!UUhJtz-!L0}LXTR9zg3eD|N{h9eip@5jAV3L249c$?+`%_s+uJ!{j+6ak zv0IA|n4NLCzlWbL#f3-4hVVKH0)88q7uGJA{>;&6KyxgaKgGSt+qA^?tLiD~a-P@a z)0I~2Ks$$?J9sjFb18nmz}9gGdAWS)^61lZ@81;XU4H;KME}w~RGj{E?Z*%&Qsj#tWxm(RmS9d}Zi;vtGL#}*zat~`EU0|O5kAb(? zv%5mk%Qg2sw%~IDwv0;GoJ6YFbA;=ShV&i3`s6b$Z?w@TlQk1c9g?zB_OX`GGJjVO z{pmtcvqiDXD5D;YMrOK~&RUkezp;r@Ik*K0`1%lsv!efG%CG@;<&P!|QZ(7IeaLvz z+_rapm5$ec=qy`3HbiW4l~$WFBzG~lg+{~Q(uiBSz$#1WET!nV1c{&1f06S*klg}3_qnZK(TCJiFK?LiHjn(G!F)7U{IIWc- z|MnKH(rf(`jclr29Pvhi2LLBlRrFQPUgV!%0}k5FIS|O#p^BuadSk~{ea7MU_mLm% zw+cN^GqIt)-UgfCLgbD3U&{sBrVbfV*{YsUIWN;;a$xFZPaS8yZkNUhY%^jjVN6{= zDbg(JyH~yu7;U{uDpq$jtq}mvH~&iK&j2@L?$!%pfR)A*~u8wCt|99T@jk?yg|fl^nkJb z8&K{QSoDNcyy-1ZBHhWo)*1ok&*l*xHA8_ee>?>Max$UD*w9N5Q0dEdv*!YAp$OQ; z`g=TljpFO9oK0FCkAwN!S3+N*vS_~7a&Qm5O5RlX#1xW_*(CA*rjnkUb$w?LK7M(G z)S7hFHh!!mGS{_vTKOh*QlgB$%P{vn#)L*zM|4gBDrvcAz5hDaP(^qtp1k-lKq?V4 zXu?*KVXC$J4PS2vg(e7$dbaO_8`PxFWIkY8yE5X4*`bbkdvu;GQ~F8<1%x?a6O!5mj(|aUGw%nv9-R!OLpN;R>n*o~)q*0lH=rlc2WEl}Yjj2Uts3_4 zIqF<(2_$1X?~5y)UZ^AoO5kAOObPL9Relq1z#i6wPE>wU)E52Ghep;RhUke5x0I!H zEnIKLi=D*r@vb(Zzp2leI3dTZ;0mU(jk7-lNF0N9qe$XMe?g9&Vhd^WvQ{GlfR$L1 zUKA}e3XBJ5n@*ZwEkn{u&?=BQLaD=%Wb7LlZS2b~Y6pGLy^VbvDd??b9Yvg%D&BIn zk1Nkl_I9p z$_^w{n7Pi2D>oSr+}W)7LAs^2A22y`{~lH~ucxp~+IQsM+HA|ol<*LsLdY1Dx)V-DA{#QC*c?jCx=c!ISuS*| z4?FAs*G@k5LFAN7;gEibAaB=3Ihvvj6i^PH#I#H?5=$V)Dlcl=<9@g_R#3jkqPm=q zd>y@9(Tl0ysM{19zg*N6z*jDwjcC zJHai{unO}U)tj4`&gMP&H_QuFFER-GxCeY793V9QDtfLm7&4j=)U%<@<;ZO;y{X1q zB4k%s(XY?+t$)KL>CYG?^>gO?I^6xb8@YYQSs~TWiOZo%Z2hdBMEU2C`G{@tCZ!Z# z5y$d7Ve^$|e(+B1n*)A6K~$6qBPw|u&5LhvcQ4k)ag##)p2{=JGDgnsRX2}VD1i#P zG&aJH`u(gA*ni9Yx_Mt|iS9X5|0-3YW<GdF+sSckkHR5eD>}s_}ks zd#o0*7|QDT>IDQ%cvk1Q%Gz(;yxJBisAVdQ9}9$*c|O8d^G_9eT|x`A5_yas)8rM< z=-E`Xb-{4_@8%mjK`K1Ga~kG7=j@T18>v&f8pqCVz0$Zve|qb>V%Uk-A2H%$#6PIu zAa$~$j&1BeACGeEv{zd<^5d50R|V{zAedW?nBMDUA5L1i`v7i6^Je69hdFJ?X58}G z_XPyDp)dMcKuy@zylhOk$1RYZIQgTH2xKB6@kQL{!d%aI^%i1JGPsJ%@-P~9vMQ`F z>yJY9aIn2w<-30N?&~59Hg>mDB~9Jdo)PL6BCAqRj9M5RMk?@1edHovxJGyig4yyy z{YhGw?_?3j(UuW~37@r9w$F{x_vTj}M+FtGbZe!xL(>>F4|o!!P;Q-sdGXja$Afg_kpvChLb1ZHuLF~PnikL z{Hw~)9%w74sS(Z>a=Zdf|MD*m75$zo2~fx*5&tUTjbjIMuTfQnCO<6X~@ zi_~Fto+jj%PW+`~=pt;q=Ifp6`b3{2pP1($x3`{6M$65}GER7kqkyYZe&d4VUbrH0T>p=iJXh=hpHV1efp_hD=5`~+PP5vvn}N|Cj0;Zs3K+dH0k2+a#O$V zh0Y(2dDb1~aWG0yCZNZ%-S(gvc^{!4(QxTI>61O%tGuf_ zv+*$#@~#Z3OPvccw@CO-GI}&AfCK;k!L*QwW0Pj^4auP?@1kRWp&35?vTe=j2|0@3 zN`gedA);T8GO8-A)@0(VekbfqXNM!E1owD9P=31??F~w9s_em#H~T$;M>UHc;#eNm z=0e*%rtw1F8v-(unBNCWjdVy5UFf_Yp(Q)wt@d6=r8U}1NzH|w6hlyzspyUPSLci< z6^i;!z5oh9o}G)^l1hYZLnoH=MY;ED)%!UZcH@%rDg;cJ>0N4x%^D!OR#-;->&gl} zTC1B_m<#o;qGf`JPZfQ*$cA1(?jDHTOe{UX zYzPpL_SM9qF385ANG0L!$V2q+52T(x_DGI#n8M)jm}<$tLk!Nyu5N#RTU`$Mw*2!9 zkTEYO>@a=xm4%>x2#cG)K&uF1%#Jz3Pm^nMKIOi)gL&tt?&+110MQT+Z|>zL)N0Es z1>TtfS-a=$3dk=(_=g3>tQ=ColYh&LJoqPZ)|{BXzly8}jt9ZbZHZvr~n`|=A7 zTt2+WT<`>H!<9rMR3FK|in%{ijZ){9Qu}T*vn)k&P=o^awAzQ}D?TGlNf z**+zY=mZ?K#jJlnhvbtF%^rs+-bzRO^V(! zdgmAwl>G0*cTWh1yR4Oh)JwO2^2*kyRAp|lJ-sPOcP)^T+ar-^ z?Sa3`#81g}?_mSp*8ylG)0ARk%sHW>EMd`odx~&m;`sl6RgDCHMoPU6a3HpDI2xPb z6x%@P7ZCaW_Dr><97VFzS&_;dynuFE%GUN*X913+OU%Cd6=m!-C?r)NS6tRKvnh@& zXe)F$yFfdSMB{wP1~Y+fM^0zz42U?F+h1e0R?QmqDW_mv z0BD_nY#j8}gp;(j{LiKyG874C3x$PN@sg@{KVm)WEj{~RIseBTr;X~3%A8PWA6XyL zX|Xzl7QWkYH{>B>V>T;*C2}cP%W{P}TqO$UEwAuw>lzHz*(JMo5vf$}nm`m6loK}k!JCaeDJH0vfEDuX2r|AWDvLy$b-yPADlGF5Ua0KK zp*;nAWE&Zv^k{TRRT*Oq$(TMJ#}u~FOFiuYTm^!j^{@&`aW~tvgSy6K_tL_x?~Z)0 ze2gsy5iRwY+7kwkMm+R5{_V5ez9}lLl-Hg^y9fk{Uyr)qjrFqsyRAqT-FJtT;&>?3 zz}12+IV{SEQq7mKD5?Z4ck7muOG?N0d2X2oI3IT1QoR9Aa2`sP5~l=#QYx=vq{T1c z`5a*_x{t(@ngvbi_x;i3b)?5ey(wdl=@T`C&EqZ$jLQjx?{Xb$(ZdUaKB>V@0O5_e z!wN@xXXDUGm9;q_?JBJ34&tElvd(TtP1hi~(^o?){%zOiik}bY+~)Kt*)?iD>P~H} zki#7H>+jBj4*MX$LB|-=XHL2a7v{(Q`aYno-D)`?jIU?2!SiE)pckZe_YMo@Gd}%V zIVDt0x9dKlg(&v*FZ#Ld=GYc*`+!AxDlQIwVAvIuz_wkT%2(amo2Ia%AV+!Xha`GDm6?rO`ekEd}PFRr+@!<6DK zrmKTvW)@Gz-Qs?Z*DzUpGuC?kb$jYcaSM?YeW6~O{$isIq;-Oe*BcXsm{_y5dyV;& z(P0#Dir;iXgB3e{Csb5D^QA%uEUC;RYS8D9?@y#zBrFpjAk#YXLnIPX|B1Yz<(&Y| z3IUX6Nknuij{B-s$?rNAHU_t73cl}=bjG7>%hOe$1gZ!?=~Xh!;t_Ft48`p#%CY?8 zm-k-4#V}qZZ+3ZVK(Jr$(tG5%wU4Ht2}Q{;I=;dfQc` zIck&Oa(imc)){_&_UZ#;#=)ut6_~L+m@o&r(wFU+Rp22dF2$K|ACH9Gj{PCod%id5 zle|+$pXCa-y!Lxe)7}WX`|2Hm^`I(A#a+n(Hryyz@ZwCFIyMgOy=EYs3Y=a%4hSJN5>)i4W{arR<4g-ILip3j`QkQB5p z&*G>Ee|_(%XIu~oyTL+_s41V&-U&(j_+|xKG%yi-ilto|Vj1Pgc=jqoR9zv@`BMSg zeTWM*7B1?FMW$nRgL7BT%<18#?`_M_hAd%{edXKlxSecW=gV!+azr-aa3`Pnfxlkp zFFi;*jBN$6XO?Fb4o{SM{tWUw+E}HV@Fqosx|;ZG znHJqJA!@j`mA{h8xvC#EXS1O%w0sQ4#6F^itcz1 zdkXW5XZS5axYO?Q`Wn=Y_bwPjD>PB1r~WmS)=y6IWXB{ly*Kgs{Ek~$ z=VDN@DBSPz(L60Hn;`t5ViD{+cM zmH0c83VFq9!hMFaHr`C!XRQYq+&Wgj^v;$ISMjLz*(UA<4apz5k<9Ns;&&N&rNm~f zSh^9@iNWZVa}O3CNL%gqoSlt(AWsM^6{8@o9coyV(};Mpjlt@q>_45Uv&6fhr`DfW z7@D_CG1H(29KZJ5Nu6)nH<&-Ko&I&D{HflE#5OIVH?1bT)$LK*32w;m?6MrVxfbdv z_EYhkdws8GF}74`+_!a^|DxZMSm7?6yfAy0m9@Db(%0ek~IT0Q?;5&`L(%cJ_Yc&i>nThAJ7avk%nB-ff>rbI~R z{EYvtSJ&thEo}zV++*m@b2XQn&$lCzIKj@ve%)5RgQPJ_MA*Pwuk*TDI^xC*-L}*) z{%OdWkBFpq^4#vi>v})O#mpypkK)Pe=!4fb|Kt0%Ls>G?Fuh$NSP}c1t7j z3QCE2{$ZniR;iR`cW|96UsG!@Y+UaB@oT&yWg?93GqS46@`-}PfcwRR94oO6tNk_$ z&r#>ClhL}V15Jp^agu?Hlux(2)(+Z%@RJJS^Ae=mrZ^vUW71#ffIcHx_HuSDGCL^B zW4+tjW=V26&u{lC3YU`W-huBoiGstF9Fdio(cJQ6H0p#HmnOtWm%x)GY8(CW=+fVw z(5n+f?$Zj0iFh$mpOHNN0zHgfS4tjaVv%&=juf^XlM|ce$_Ac})qz$%yU4>YE!-P@ z-E4||OUBuz*pC76s6}6!#RLM>6nOgS1PI%`% zx$$?^F}hF@Xf&)yrjmBf$bIm{f>;Rc0nO=q=q~HEKIr&jULa#hjc)fQzTkRF-3(e- zhy~6#;?^!DeTpAMwFIR6XHiF9Nj%h{w_b2oLcg50+`%m3b=BxMy1}m`y#9c_$q}io z&JwEiH6{*1o~sZLPzz(YU#K?|hzfip-N`|^U771N)13&K>OHbBGVg`lTLw4Q3oMKl z`$J?7sHW?BtUz+O9`v?Z|Kx`ARdn;c{-?supX?7-tBpp_Xd*c*^wvwDP5{;JVLX0X zn}3(;C2L>e6;ke!F0ZNC&(y0pg05+p)~oK3WM7?VFrI)v;ZZbEAm_I!o8qAMk#>TqMdqEkZP{+- zA91W0a0sZI2`NjSfdA4#eDn*i`-}Niuddt zFLRBqoqRGTm=P`4Sg!ZWX?b9qPGXGPQr{ z9dyruf5x@qyVDIs>`kPPfOJYBZJoZGl@E!WG1#0lJtq|`AV3kysOyi^vz|AnGI zqRcWy4)`ONX=Fie`8U;hxuW1yV@)0zW@gR@+WMQ4`{;7nb=Ck=SqEWRcY4#clo8@Y z)&5%w|5prOVDI&^67OiQCl^^AOZMttc<6bJW(@*m+v3Kql$zz@#((I&ZP5lxnfO$t zG7Du+^r)llkk!w4Gf7OCNIOA{*SkoZ+yvaDUQQZ{w3+gFdGQC_$@i3=U_;86z1s_| zoNc+LZl&)6qW#dRUV`2m8LcXp-isMmarcc{f|Xy?#tjaiFF$pb^px9rSe^~~boCAs z(`Kx7qw#_N|M*DEGOvTS>l=7Uov=k&_j5fDYFpxIZ$Th`;J1w2SPqz<`t^T&KMNx# zF|g&;f0PXl%dyXR^&?!VN|m2X(P;bz{i*{+i8|@)LMUgyyZ^pp7LNS0P<6^ zC(&o~Ge?u!U@{Bu8G9}p6ukxB|KgPhE9Nqx07PWro?KAv@K&B;3sx|p@+~@Vn-a#a z>Zy+Xq0&bQrANh*k=m-%-xJ2-&aqjlRN7Oa%T&sSsq@=Ifme=yx{5mGb8ghfHuOHD z6jM&gJ<(RG)H(l%c&grFoBkN=2$F%`j2!ij{9Ok|&+v_*MqyVX^}e@{#^o{!I}d>Y zlAWOMEDz*DxLw>wXpG8vny-*n_!D$CSh(0VaVdvr4fkUl{E&NHTc@bgk`^Fzx!hk< z07U#wTNS5&XZa*z^O-R^jiDgU@>zEUOiVL+NQ8V6@$HP@pv<#dJCa2u~ke9 za{pB@Wcot9=V;Un*~Hct-i9V5&KDa)k}ccd)U*$a99qF_-4~zcP?5aI@`c#z<1&ZtIMxVidBv z>ZWSbCnP@sYA@nM-ReS&MQV`{y{Zg@NiG8Ibo`UZV`Wfrorw1qxp9P*w&9aR&oUe( zL4$p*HoW^Vbt{7%PKEyPa^mazjdrlQmj%cG;;8Zkm$)tiH{{tX>PVR+DWQ_L!SdmvJ3l6SB%7#kWgqm*onG`@%W`+tWoc!>tQ5Ykqr0w%&~k%hcs*+f2>WQ zj#$fgZnm4hM`}xziJR@n%q*H3>%TaD?gEiDy%-r^?=>gXuuu`1{twYvVw-g;R^8A{ zI~^BvgBi}DE{LzBOnHh3^>Le?x6OshSw9{lM7 z$Ur~x{2=+={GyGJmt+Qy6q)_LZr*yZ|AG_bX~xZT;v*4E`?};0z~}|HxmfbAbOdEy zyZ`ng6m3E>wDsya>ZE$fFtJVK59qjyJntp&Kh4Z7`K5cNb7l7HifNenI8I@t@v+wA zS4<``lUR}rUtlb~y@5h7rzc~=GE*u14^HAb{kad-n~`ppe(#3f!EOv}offsI20~=H z3{cp_SY->4?_|o8L)f0{@INmgwP#xEbHroeDMFwf={02cDK~Tb2Z@v@Sn;9PJ!4yc z+?~M4n6m_AMQsO*d2)BcX9)tw?z-D-Mx@8%)6zUZ7|DpAF?vm!D(P@Ac?4k9i-Hc` zXgdiJnGA$4yyI9@QVb5qK%Rob%+Sj*J)NaFE~%^ma!`tH*tkot2cs=bfQ(SX6N z71`p_dufjs?_Fsci2(-gq(>o&CKu&BYH|d$6={TcNn-QgUuN&4Fl-O!Z4v;D!KW@oY6ra5scs%(0#i#WNQ1zjTgwE-M^yZ9 z2!Unc=mP0px&2w=^yuP-T!+ly1t)`wub;{0$6ni%Jss4d-}!i3-n^4}M*1WG27+x| z*X1C$@k45@Y)AV1GnC;+Bz7cygcg#ez6~MsF8hn#qnaXm%nj`$5p*S_Mo`L zC(rqRAH4)9Bi`SB`#-))owt9dUc^37j3ehgep%t!S}<~@O;_XGsd?mv=qbb&w|Vx; zx^X;i(s5{ZdpTG^(o2oWt>Oe-Le&E`woE5Xb^z@*M{}W%hqyfjOs@K@Z3?ho{7)^e&w*-}e2E?Kt_4C*w03v7cPWG1fTa#nlKHP5p*KbARAL56E z9)zc#((1(a<(u-3Y>MwEm8@U(`5)iKWhaWF9BB;suI12It=VInz1+1Zi<2F2DJ8!r z6~Cnkcd0e@#>?C9SP;Hw$#>geN3znN>B)EX2AqBRj~J;pC-hgAwkat(zGj9Jd}!c{ zhm^CI&$qys2+YxGo3v#Rxy=h$wXD-gvN2Z<(r<3Q9+2KTLaLpwh-C>Q_w1jgXfV9z zqdpoD^11yc^X-63eXS`ka5^(vpGjm70=TT0) z*B0F4JI^ZYcE5uhKmH)JYqRdn-w;jQ3HkdjwWl)uW~@}B(n0IMMv??O(*i5@5SP%(uea6=F zP4%aICJZh_noEOl%WNk0mYP#vj&%6_y7~)mHzhVc;wrI^E?O$yMD%!vG^O6+)HW4} z12=bNB`igi2`t}56uWW~QxoWO8KO;%zjO5cNur>7N}UiS4Kw*2b@>!=<@Ce0`i1+k zMK27Qr#8Mm+rfwK4jcE0p8=su)f!udQ?Pb9&14CDp;_kSsH02?T1bfHEU4W6$O5S? zG=fq!#%d+DI$xPUKRcNctME!HdNnI=jSbPVK24T5N;Ag9;1cVL-LB&X_N;^&Dq&#| z2$1t1x-9E-O742NNwvrZTbR~qKeBaAFT(B4ptp2(WkI$Wi&)=E-z+d1@Wx~^weroA z=OryKGJdu>FEq?HWjNj_9H-JZvXu&@xP83yUAQBkRVgGhRjerilCbZ6%a2?NcxNUD z;`O#}AzQp^#tvk}-vV}#5~e}`MW$-&m>|71XVcCVsPr;RwlHtgOe*^7xYp5Dg>Ons zRkTb+ikb7Oj1Ito|CpI|!4TNANooQ%*6W6W7_oD&e zJA?1|oQVNKt}%^TIw$u0pp}^HfE7B2J&_}% zLGTBZE$?uaiYw%l!cyL|N?U&W>gbXsO>HxLhZObti}fk_kV?G(2x8UqM32-+6f=&- zN2TqJTy;&^a4>&{;OV)=AbV(J-hW$XTC;;s^%@kgq<_!l^#$rcg{j`t=3IO356ui} ziU(rZi$=3_@bF)TMob+rQa}!lFWZKNqCzL~W?W@>gTsRZ;;4=zPJ`~C)|4&uGE7a@ z-cd`g1CuQgU0o%9%&J|=5wHoa256yAjLeh5?+Pj|l#AX5Gqu6}hZ7zmw{f@=wAH%! zb57(1=%@iROJ`>XDddGWeRv2lWDCoMs-}2mg2d|q_JtxnBr)P(2Znrr?lHH&frV*VDmvS`eb+eWT9ElRDGn1IF=J_Mu+@u@y z@fAJU3~kGnQC;|KJS22Ml?4f?H~f@q``fb{Y=BwZaR+Xaz7t1*Y~1;yEK9itie?Hp zB8QkH?+7i?@&0anuXg0kWQQzH0|#3A`4o*<7_ONeDxW`%+k@kyp5G@Eb`FiGd)JNXm(wSE&& zsZk|OH4-+D=g00h8&!JmdJ~J3MYVrD)a=|xTfUcg*CdCzEB|ZaTIr)Yp{B4NsnZz& z%K>B@=#iV^T8hA14ZV_}2q-yXR0wG!4u28$|4M+o&7eqY(EEagnqu??ZKO(6CHeF| z2Ka3DbcVol+%>4dh8|nc^0#lz_C~`ih{MiC;i5z$M4JsHh(n|DS|EvIEe^5N$_llz z5LCKcTutR_tBDCk!s|YUN7akcQ*wP2BQ*Wmf~gkOnt3NE3I)MV=xw?&!f{eQryOzy zHd-s&e|$xfVdf%ZA!W$OYT?;pJ=jy>>F~Uj;xO7hEwu@wLH?|4yK>fJ6JBIVZ!oiR zP$I4tTeJADPM$Y-vM^$`T8_j!SRJrDl!}dsdNgJZPe3Prv=xwN4Q$;*sa`@UPP$Gj z)5K`He9Vld&2?f1naUpeIVM|5bwLK?tzrr{YGK3M zymrFOOWAcPoAC5l3U1OKW=t&eD_kqOql{hM4ZcZ0!!%I;ZGoNnzo9KUmTFEFzA!J( z#)VEQ(-O(A_EIxg3N*B-z-jb9AKeAv#oS-TW#5jJJ{$L+J8rSfS6HCtUsE1dJ^aFA z(axZ5cH-h~(4_pt~7*Ykf;oILMv2-Fxx-d2g@Mz zn9YQnT}WiFtdo)xgi%~H3!R*EXuFkYdIX&+@>r_jeJWfa5;kMvblK}0HX*R}DdfEX zo9rSIrw+drIQ8mS|bY=mT$G2{I#TfYX%)4=9kIjvwo#sMX|z~&&EF*(7d(F zpOPH2^vB(Zrv2T=*k@m+;K#GuQ=D(OnVyGQUa%$!kpu2fB@uX)O_j8@FECko^$U#=QJ~_Q=h1O>)(GUT4MQyd6`{F;a|Ynv+XW+v?ZO2PFIHz zT)cGWrW_uOAj`Hl5Vl`AM!1@Ge&1i3vj&FuW$R7Kr4KJ>Ph}O z_b@2TC`N%_2%UV_KW8}^WwKx%i&Wha6og_%4DclEcMUvVTt1_8xpe=Y z&7{7D7sCDaQKrPfar@AimEw;`ZXG7@+P&u20MO5v(xvACdEN;XZKlB8@cS^hW58+F z>iAh+QQ=pS_0##&*J`ak3-uJ%L-)=xOU{+~9{*GFFl=X=?enG5cjK==0l>eyWsHno z-UxL)LcKQe5txmUI!vxLyN9TSqXy7dBd_BB)Jn~%d9mZ)9e>yehyQWhFTED=W2%$$ zVuW#EtU>(OPcKph--UGFMCIEU%ryEpmFA_TPyc>En(p8_W3iK z6O{bVUP|0bQk4~=(|HGZF|p)+ZBv+!dQsC;w{CeH`8?|~VA1!b3?Czrh%h;~<9Oo< zK+<{9XMfk^2Tth<)w8_m+Ms($LwnEpKhU`lHd7Jr?a^3qiO(%Q&>bx&b?q*{z{K@? z7Xz0oIuu8#EV}FVuI{Os>+}4wQAmR$UXl{1^Vw%$Y(?okKZsPt4B*p`*)C59(9Cl~ z>5G|Bb8bydtV<@(OF})55&&0&=k6><1j`?$Rm3K3?3a5bN>b9?b%>vjS6xOH=JNGxHXpCU(NUMT zE0Zp~4h`F5)ZJNhD{SM>BOm4l96f&FSn*1%o9giBcw|A*Ph$CX_X_*?>L`QlJ)eRm z-UNb|wWbd63{QD=VkNwy4$@J$4#R@)^g3<5M=o^SnwreIIX~Cm?h@U*zAkLlbnE5_ zVc>+X+Oe8EQtxDrcK$@PMpR*|OW=`>h4I8WsyEnkYb7gR$t@|<_mB>VQnq-B)qkLu zTg+~MvkaC@R5v*z&uewjWyQ9^-Mw7@KK?A)&~8CqyIWehMBjf6IGRV%Jk*~^$ix1Q z`==wh?+>t$aHeqK&MAEsFTbwBKu`k&JvnC%l0~HN&fDqK^D*Is38i1+sy% z6Y3B^xlsQYLeE1>Uf6K@r8Zz2OH>g|H4hT3dn^aOMY4%v78L-;oujkdusD{#Wr%te zJZ%gDP?Su;lRZztt>NbnKBfj}Uf8u|tf}Nm7@TiA8A!Sd*7Dl`vi&xp)ifGne;@y+`*f`%{n}`F_HvzE}_*{QaAD z?#%?KtUm0hzXUO_e%)a~xl70y`Nc&|$pMjxa2m$RNfro#We(1!pbAngepc5is*Ni< zd92HMM&@CO4yCLzu(*vYF4GQuBTkqt zN3Pt(Ps3Jt%rcW58AC6V`!r!$G3lm(oO4m@#|I;1V8589mi^4@Wzhc#czmVbv0ag? z{Q<12hRLHoTh`9OwAvklTC5IC2(CE`TalI~v4K&u{Nk8GHQ2*?P4doKspAe!4>w-j zWvPA$f?}WH7SFpV{&Aref8bA=YtH@f;PSAH8#`nZlsGs=MT|yNVVEW@Xz=@I0gTLh zPIe`h_t=;N;pNH(=2izq)VX!qtV!%mLF}^lXUrz{a--!B4S?jMBcHG+e^RTYCBQ16 z-T={ohk_A|78%KC%VqV0Ud87a_))=0xNX6NK>^?6VMFT?G!NDyJ~2qGIb5R9IOG=4 zMO8>bc^OldGlGIPcV0Em`AW zxE1`cmqg<%O}3$6EmIrLX0+Zrc)7AWNtfOt%V zQt|_$es2lUdx|5JGe+tg_rLa<1UT|w8wiSsHN6ohquTjMOF;Y*uowo*mYXD3Pz|R9 zA=U-u9zW36+ZUg;)Fms_%TQRViuS}AK33oP8(My&)Jyb1ud=mDvW+>jI%Sh94`EhRq+FYBR!GKR|}k8&U9q*1=u$N?zt zAyMAp(Cz?d7uk_$h4A61e!V2Q<$Hqehq0`q|LkD#)p_hAI5_g6+0DbtdHl>R9>4zo zO0Z0R9g>69+J zo^ikW8`Dm0IP+_och0JCXANaUoaqM}0>a9!ZK@8$I&8y%=gIlT7SBFlt%3O(yX8cF z|M>(?;tzd1xIAD7C%{No*bHyuIZx3x9bTf)i3%;WNxYnSWa4c>R1TkE(SDy{u29CaSHjNWp2Sgqen&&m*r zD}HB{*t$&8V??^02wCZwfE$Hn5b+^K#9S`_@kijONYHeHKzN5Q*2fkk`!cYhWoEcl zh4seU~%W^Bom?R9*>;gYC=82@UISQwjMG{p)otA+j0x%G3YzPyP? zTK_g#4Q8DP&OmHj2VeTxl9ryxRx<0WycpN-T)fKy&4k?fp%zKKxCEn~hj2G$P1Ofk zt}NtNjYZ2X0Fq<=#x$ruP8U#GG*#yionNZV8gbCDIk~&EGB+T3|DnFs)L-`#pJ<{Asfl^Az7hv>j{ZBwcgjo8=Ww{-ou#0jw@ep`2x)j$^_2L-;$4>{Z z)uGe{Br@}xPKNv`Sn2H#`$aea$6#Zt<|dcS!}gjbtb;dr_3zI4+=Lqcu$s`!EjczQ z$rbGq807f#PLPnjb6F{!52DcJnYPmvMLG@k8)*j}A(~HJ4^0ipC$yZoTN!s@!XTH^ zsb-2ttybJ61&3exH z=)?F&;5h!#rEcP8TN3?BP@H?VSG2~ZgqFcN?Y9&0DkSZPwJLmbF(Iz2KWH(SM7R%4 zAguNnoR`{;9|`(j#0+n@!;Xpi&dp|wrtNaFQum_8`>-u`1Ndgp2tdL+|t=|E==$&X!5bs z4l8L?|B!eBRTE$tX>@ssk}7q_F$n#mR` z)lfzgOFzhrmYQyfzs2^=g*Ki>_gE18eP^JKA(*)y$OOyazPeFm;ETo^W_H?=Xr|2zgkWnb*UJ{OS)oi>;US(Wn_oMmg^h~9q!7DZ;9-EUPo=BBy=Py|* zEN%<4HGBw>)mNfXLy<3sLJ4}JV`u!S7*zj2krEp5UvuNf%Sdhi0i?_-t~Es2$Ey_? z)Oq)zb51kMWh;H>^hX!h;mxNy$+;0BRe!8h4PY%u^9j#;3i}eW_QHS=|K_w15gZ&ic&q!%mV@ni@4Fg~{EEdXo6eP!Q%WV+j0#>i z|Hl8Gz9lQO?{%*IOY2h!D-vU0Sj#?UG%6{eWn8Ha`B_edR>i4_cF?>!e0Q#db#dur z?@yf5?Lxkurqn-v=0RL7cR*@EF(0nU_29~fQfxMo#5E_19HHmX$!nyBP+?TZn zWmkP0A2jc{f}|_j&d;bAE(n&O6Q4&>+TR}?DzZtppeC$Re#Nd=WCuo)JFz);Ol%<2 zTtj1Re9p=9Mw^K*{`pY*9tHDKFcNbnxPg^4@Tn;&w1DAf8DEfDrbTIYAgNYMMjK^3 zjy@QAe5kM37RwIVK_|@)Yz_mvupd_+k)m%`;k1#Q;z_f|FL`42aqRta8u?~}4t8UH zb|7}xm0BZ6pgs4jB+Pehc}ci6iC`RX>=;7B@<1 zY>saoaC*+ty~SLA6b>65yFjpQHZ;wr?GYFCIyI1c_Lskh+k`mstNUnkG|;$-A0eJQ zvhPT83386Z`0y_&Hw49Lk%PqjC{b!d`OQHqcwTzB_C1lm>o%5Yc75Sbq=gG&m>y*O98{5DM zzD@0b0dB@^py!x-ON(|bC$youFkKDIFUB21&Z$jh7rzTIGA4fw@|~)lAdVfNpSftJ z63$Z}wvVo@ZU7W>2a7cV6<=O@dK^J}F-^G5un7;yWUm@?AT68$=y37sc2}fWc8=|& zNl%)#uL$o{f#`_jjAbXs(a^wA?WxT&$BEO8@}Sp2paO2Jh9+>I#r<_n%4ic=KZ{Am zf9n|^r$&cj)B$mJK^D#~PO`1}gTLL9CPVbzUythr&rHIbPPl;8p?zUT!ym~g0(+-2 z|0e*V_}9)e-AA#!>MWO_&Ckb4n-WghnOh$FAAgxBtWfe>Ti&sZ{x*MBn>_<`wJq=k zz2kSyI7#it&CWb%5+SM~N=jtZ2BF{BpYx90k25B_=~&+i1b_SN26cD{K6Q|vq=H&} zDXlNMBWNS{CS}zAmUJ~g8EEI4?S_c&d*?tg^lCc``otI2-;nTJUy#cG|A*? zER7C9?Xm|L!4WMJdCvEJgN6H-9F0)uWMI zQ59r)tM$!GKxaneL2`0Ht})vaqrm+1P-bax+JrFS;wUUDeJkH%LeTx(C5_3siJ;sN6Fq`G_nEwgPHF%y%m3>bN_hQgCeNuWk;TZsh7cejmC{4B;9Kh)XC_|{n z9!1jWV4nqB{3Frg@BqH2h@;=Rb`lCr$^rI>q+kN$*)0H{7p2({s(ezz;I6YOQY2@F zNIN*zul>F}WcattP)R$lv^@_fCzs^Dtp~24(5K2pGu*&u%0*W4pP=#C3$$52y)CU( z%Skx<4bigTTRk{M<`75FN}+5-kQ&4PbQfY!;pZnc7yW##nceXvaZQPFOZ;LK1E0 z2XDnf*I%7pkA%^pX6VGz_G$i)gm7sWtwi)kVDBoNarcgh2s&9w-TAAJ2kSHD^1m7h z@GC@ko2ce}*)(OQeN9}!gzl3l<%0AQ-wDdY5d;PCvo@YjFY-(y<_wvNR%g7R^=(;S z(ojwQ0yXtLxT6tk_BUJC)E<^RB_>{nF)sJ-;jPCT+uNJFS*-dmZ;xBy!?;VA{^Wp zX(|5HuG7~pvTa(ay3E`bLaoBA z?$^l$SwXt?!SN@>L6B3&13=*|Yp4`i{eGQ&0~d82?4lS@ziS_wXEmWawB?mtp^b-Q z^-}%CawrE3=n=Vp3qsejFG5R2#@pmxG6N4_-Lg9^zr!Wehu|zl>opcv@D?`(Gc;|8 z)~X4(GgaOyPV7}+7X)b*%M^TLXXD#Is%5}K3OWnFIDqbjfZ@YcaMa@(qVVK`i8KJz zHFIK}A&iL4mi1PmFOk#U0P^g0p5i_Q?peM|?Eww5X6*Y|Y6YrpQ*CRe*VSnHyXfr$ z|9Vy%M!6#=S=pfED9eKJd|mvRB;iO$NY+}`yE*E0?8DRDqKZHXj_z8u;0f3SVNe)B z7RKyZPM7rS@p%@t$DR}hxJ|-3cjIgC^N$O*s)kG_n7URq!@$9`dDU!QTe!#q1d`R$AlXjlraFCB&hO*tfp9$<$f(8N< z7;l==SK2WRNS-#f0cqiJso_WcGc@!dorA)$^Kk&c`URFj49)!nlJOYH5kF`JNc9xZ zsN_E-P_eo!I2WXNW4v{fJ~PMvPW1@Iai1*;M$UH9~>_ z6twnL2p*80!yf7U^l;~WJ6*Z*gmo|~&HgjFXF36_*TjWh-MTQlq zc*&d870k&iVa)rjNs05;i*Okhl13v@4UO$zysEQZ{jnJIGz)fuJ|&}X?hM@OkHrz11aIBHjn)N z?_g(k2Y&q;p;K=pw4pU6v2DD#w`a@yz<44wiY+Eo2VL&^_bqH}y1^xCu@ab}&ds%Y z?{#F=>IFh6>KH17pu(D~G;euQKG=V8SrAxy&^FuYyThax)u9#)a88^no=FT=Dx!5P zmT4xUsF;Huk`$THBdQQf`FKrzRG=(^&QrN;oxf*yW{<=&7{BiSY*YvTibI17|MOfO|LNodxZXB`~^yq39 zN;>)-bf9RSWOIp)_n>0)YdvhAAF zia>l2{*f^y37Z*?Z%Zy=$LxzIIbY7>la||D%@qN5cRmy&TTtJJtivKReP1p|8?0Da}>UOq!v8yuHe&RR4-^L1cW|oj2n5BT3yuX zJi_?BVM`$|+-H#+kf=1z+Y}`hcAguLC#&gErspeZY zUV={9>G4V}4Tyw7rI4lsN@us*$D({nuG$Fs+*MShd3qSD6=5e@*JS2{F>~3KMT13u zKwFwf>gzsTT=xN~>EOn=ZRWw|rKDf&BfBA-CIFK}h^xb`e~U6Y_XI!evv+=`{73qx zh2_%)j1BG6K*`XFttD`E?nWYVIf0rTyVk;s|LSg`)|~fQ?sLo)`{39np1W{^ml|?? zU;Bjpq8EVG&V=RkHAfuPO|x$z>X72rzrWT#`uM;gefDgV5mj`2prqxBJu822o|4CM zcqZ*6XJ5|(;W_>ruNoC47wdglYNP8s9f?_mWmH#5MtUkB{G~nq8?p20%T~jc6!0Eq z(+kiaeZeYjxV(3{TRJrmpvG}*hgOyZUjQ{#-QIwbwh2F-D3`nvULk7E)^G`OPsTGj zq-(+Nedb>0@^6ARm>p|vGj41D6{#~0;j=NmeZ>B{M~}kmJ6CD@nYT4X^n}^>6naKx z&ajh2{%WGWf52L#M`~;FVm#89?L$ge=Q+4u~5WBFZh?(9}kcFSPJWgERmrvYGz1+U&c%9vVDCLHhKJv zja_hqFIkA`#1$4x}m&iKC6dAq(`+ACFHoEf%9zcV{hYB>0~*8D$$LR&gATYvA} zme10Tj*5el8?+(tXSVyyp~u>0?%kR<-;S0m?26WX$RLZUq==5H*()+Voi1YZA0e3dCh3X6K!F$YS~bwBHO4KbZbL~4756Y+c>ym@zpDGcv^!1Ewm_ctRb_jeWxJ_W>S{fX+8bgb=N)k2*MG} z$B!hwqQ*XU{TH%Y}fIpT1@`im?b}Jo31(4mz#t0#JAwfV16Bn3QLahIc?D z9lv>%AE)1jYp8Tf8k_PO&xI!uCp{aS&OoEXp|7gsJ;ZQ`fGlI~fA*~ao>Dq&T_5k@ zZBfLP%DK3_J6OvQr%8A_7;g(Cf^C#i?XwaL%Ej&As9=)m z>P5(7NoO%%UM?z-cGM&)o1m7H%J455_9+ylZouk3K80s0&*f_sX`eP{aG~u4HuX+1-n~jXcj9+ z(ve`4hL!mSJJT@hi~PBqc`{Nn`arzq5d*A8t?YmBiw;E_*q}r3&z7$`e-oE}HA(oS zqgYxXzwp2jL70_4DXww6KJ{}zVp+YEP;~kN``rcgJaam(e8z2A4zV| zy4Sd3o*Ayy<}z(9duAh7dA<&uPC3GVQ-luSw4mU1uB1)Vx|c$0x69tZ@JO_%B7Gs{ z13d!YPLI|_SH^lLe`DS3>}EEu{VcBvjAe5bvSZb-PH(b^uXl+G7&m)8L;Vgs*#%+S z@8YP{Cbg&`D=7oz!f_wHPocq_UN+`K3__NTu0p3DJ6ibD3H@cnlac=90cR=@Tv>gYEBT6f48illoc z1AF_mm?mlWV0!>7fXsLYQ6X4`8ybqN>*5FX0^9;pIspB~;g?^*A7I4_^52pC%U*fZ z-=%5f>bV{0Eo$u4x8%%{tF!YBZe)@@usen46ro^6n53Hddopnc4^d$>{N+PFeyH7@I%BS;n`~<=+x>o2?%CqT~01I+>4XZX{??CpWMTi_>Tx+ zQc80u0L61`QF)RW<6&KCojdb02gZo?tR5_eT^Lwf6lD#TEZ6CoD_v&JE3B4M?EEcU zetEcq1%}C{8sOW8QGo_DQ8k*DsP_#yeyB}MT8uTr@k@drzWZ)Lm8Xpg(n>6GA2zXX zpGi=KPf{{qlb@V}w)|pCAYFgwPlh5GQy-lkT0LpCU9IJ&tdo0IuUUsBC$BZW879-I z=eIBizSV0vsmD`PmEHV^3gU!Gu{u(qDJaWoilh5`?z4kAGkL=3MJ(1Ch(SZ69_7C& z4uxsP;H1e;k4=7Pig}l(Hm;>U*6L#&Hz|OE2Oe{rl4cB5-Bru=QRf+@1XZJ3eXyRzv*1g<%G`KuGnf>&ooSHozD;oXpB)j*_KY05~ zOI%nxp1!p>n$|vijK&`ZJk`ij+eI9!D#x= zkLkW)DrsQfsSj1h8V@Zg2O-AR{ylivdpLT*>6e~DApMuh9qE7H)zX=`9Z-4k2qJBs z2mpQg{mz6`5jVLyx&D}T>_KXv6JZb}3UBOfb;vcDH6!iiC3L>!&oMWR@H+iTW-h`p>%D(CHTF`xYReAOC{BZ6Gye zM?)YC;EOePgKS7{!}wlD!Y=l+LQW@g3EFVITKBiRL!k51WT{qjnYI3XDUnYFFG-um zK`6}DSP#}naMudJL-XqAO0&t^$;MGIc8?n1@E0!?{bgkw|4Se7Jwp>bZ_qrH)%_1LNg<@y$&dF3SI}NoBUelF8>G_6@F}Zn-vIqOx*=1&gbT+9Rs1W5-n>1|NTD3zr z@Wozotj>7kTw6uj}4dvN0&%;F_B-`TsO}oJ%nZW9+z=UZskr1IK3QPuGLSv%&gX zp69NkyAMG9CHw+`v=h6J&5MMde#CC{A=l%sxO+#m1mJEpo5{Tsp->7JPPeemerYWL zV6UP2;z9M&a+E9{ffix5oe{l z7@eMaO>vEuBpHKfv2>j8J%l+0Pq9Oey7B5?+((MyQ8-wu z)BwucX&>Rdd%;T`xqh^<$H?z>`JH=C^MV-LEno3faat^p_BCm~)(UfWz-@Ggegi)4 z_V~8%YG*av`973~jk|Brc$zP$KE805KyYQBbU=ACPBpU|cDPLS?n}Ur$_be|cmEjQ zUZuG&A1^0?eM;&Zn&u*usi?F*`cLzu!NDtoJri+_e}i@$C6DzxVs|dzE_uN@d+6s4 zA^>pY*2PA5mD;ygrxJ>Lz!oU-x!?yXMtooFeb$G&=I=DcpJy;`Yd>9o8Zxu<^Oe5J zS)Wh7*N$0s&qQBBBFa@7XLdnw+wAmf>`GgliKyrgF;WvL`DJ7)0NOF3OMN%?(7x%r zXfJO>_xXVQnmYZD2CI52p1)Z!;^AoLgc>w{U(>v|em+{|_}N7gAHBDmNBm&Ya>wBp z|F31+^)hHST2cw+i^%G7$nUUQ;itcA#vAx#ddBQ_vu+a1zF+cf#0^2?V$B_4F z6`hI*=kDEkAgs;3yKC;)Xng4R)nAhLJhj?Mkf=$*J~AS&n@cH&7S}BKj?tbaUTD!~ zN9erK`4xb;>DzpIC&&*?3Qhlkebn23d_c1)^HavFB7zx}l6k7o>*&Z%p>~Ll8n}G}!UJCG=-1Vc{9kO8}zKG`_0j|tLD(RPR zO2I1P1bvR(Vl$DK*_do!8}1R8B5zTh6-;Tj+!wh2Y6q>dq=h8N5)#mA9cQ~c?@XFS z2!dw~f!mf_alqo4DNcfLePyKG;*FvdOHkw>*c+oRzzJ-rHuX4<`t=4ZRzWxjZlOahFl$S!SB`SPykhT5Rs!=y*g8pKTJaCH+l`t*&y03pNc z-%dW{<7Shv3q^QC&ymh^H;C=L7;0^P<93lvpY`9iEuWGBvAIDIzI2#m6dOmWiP4rS zs607%pg(q*1t$N9-twgpBSNP~g0JAH_#EBsAuBFlm#XoQUp?iq{g#0AX(`=46eMf?TGORTfkst8kEVA99IE6T z{fP$gg)w_A3Zv=j-{b4Y=9*5(h(LLzmI3Z-#eC~04ZqWP0tE(O(XbJxG^=42GX1EA zXAm1fEV*u-?!tCJ$s+HK`A{lmBhaqCoeN z(QImCjy*;U^WH#C1`X)#*XWXv4*t%%Bl2zM^CP^YTrIM$cO0`O_t0srPkWz`)QL;{ z>Y_}{-}gDynEDDGTd%UNC%PnTU&0oAt<`3AaCF_e1K4xQZUvDbCg!La045Jum*!$` zd@do~v}GMB(8%>=-*9U7Q{Tec&WHk6Q~7ES!6WQq({ZP_6@2R08J1#tWLuhB#?W5T zkvGCdn91n4TCYq6fJV+DD_UjUO1Z8x)J;35gHGiCtT}I8VffHPKG9%rU`-~w-yZgI z8T+ET+OiQDVQ|u{${vC@^OrJTNKRn3bF=I>j%u=|5^RbNiMT>r$5K3q$w&V5lG@^&0_(2?&| zRR@$u@aZ>i5ID$lIAyT^HiwAT0%WM-_VDk+;N$&XEuModYo$0iJ7>tZ5&R}mYjJyq z^5`t^{uzs##erg9kzc+8(d0QE3=nHZ=~^GqxY zD7DEh*&bFs5i3_DI*gn+f*GO{dktlC7FDpNycFp~@I{4y9PaYnB;x8Tu{6oimsCXQ z3nFdWpQ#j3(zzzJRP%JbCIFqJ{x20%sdhFOw(RI+IhcUhzb>jSNo34r2NBUDJj%a_ zxa;jNKjC0Uh?cj@bUl=$Np!((G(L&hsG5A-`VPbPV6EyK#-O0x6T;m#2LPZ8Jb~`a z#ilxsNIBWo=mjtwU%^x>cl4NVY=ZT>Qx6>VWO7eqK|ZQ=H*zjJp|8`j5)k* zBxCrA1X~atbJQ<{uewOQqygw|vn*;d)ZTDoI6E5i=c#q;DNYyxjJMGt`iRMzdegM6 zRJPPr!foSXF$t^PZ~(wxj-2-ur43fm47%J}N^xvNzx>UZ6fOY2vxTt(KVLs`nlYDV zulou`uu{@K2zp_b3IOwYAqVJ!>gBuPA0PC95jWxT{Plj@!*p+>Ol->5UCSRIx8!sJDE=c_>WL_X3OX1}<8q2?j81c>O$= znI|Y3809-<6QZie1D8O}60%1~ik$M16p~PYFcX{-)Oap0j7^mrxZ;v$RWq>niSqe; z*ryL(4WW~aG3e(9QYl52*q@y&Ooq&M&*x74ISvQC=&jYM&UPyYqs5(HhPM%zwASx z!k1?Li8ChRQ!eZJ#an34N#|uaudB}-Es@2mN9eYPq+CkXl%C6(vRFCLwT1m`-W#hG z!g2bTg0BTNvHzn=SOI+oOcEY|mJ0}kZtE*3T!2vy3B~JX(%{c}Ir5vhN|JY`h(<-+Gz&fx(1bs2O{}S{o1zX6iMiXVfNQv8j(zZuBFo zX78XJc^u;%)S8+as1N0jVfd2usfVF`R~tE}hM9gJl8+A3W~P-|CEGwLHz*{Cfc1;| z#<=Oq8R43qdT&>c&rp-2eig}fx6q4EA}Qv8^pOb#4IbdQB-dE zlz85j&nY`zoYvL<5OpqSW#ks9qBIVJ(YHNwIXEV#MmdPNZdE!l%JD2xFZWrKdt(#YL!KIjMn^1CPT7gy@GGFKI(E>Ja z2bf(inrQ$;e9FM?XqOHBEl9y$UuePz8uRKkqKiL_+w+;PPZoz)<8$6N!p{SgN)9w6R(kroBt;;61;UbJThTzL1otpH3^;THxd-kEAzqC;oZAW{)baElHoww3{EOprjQg*&Gwuc~XU-MmDtQK1g^~^hh2@K@&=zCC&3=T+K^_#WM8L_!VkW zlnEicDe+QE;@n4M$cciTL_r+Pwrxz_hytbHJC?~Nk4*IB&U1%={>v4_Pqal^r&tSbi^4`Cf# zyau@O>$o1j{~l9yDs!&c*!Z_{2d3^alB}8YhnvFhYc?)Z7vxwINwgbE0|~b}L7%?I zk6BGGQ{!%ZwqaU(jPVU+(K=i4>;GOS)jZF6ZD@CIs`@qcCi%xC`&?gX+L152X8%lPZZC+qYELqHn=r5TyWm8jW9E-huuW@2r`ZViY z&X1CoruH)>S+?+?u9-#D1wKAH)S*G42>p1(2+3|RPaJ^wq@RLHv#bnvmh6frujyQ` zii!{DdvG@_Ev-%ux?@;LWQ5y-o`DRqzulLIW!2A&aR<3c5(4J@9mt3`u3a6drW6eH zMwG{`YS~5wIf74k!CtUfmwm%)fS{R1{o+lOEp2UP*40e?{+5`I?^!Dx!A6#EwPWW* zep{bgoYYX&2hC_SAy6GaenK}Qpf+IES2O7=$*Nm@8ApHDnT75-7d6xyzTbL!NsRWc zFXXHo7R%WCAZ;GO-^3SLp`X1S#`Us7vuST3va25J+y>pgAda3#22Gb`F}kOD;rIj> zi-SGj&o>2!!Dy?$Z}O?jy)JvAhWNd-=zAD}Aj{C$!_bVhrt%<<(m%zmnHSRv38x(U zIgbR7l=o%jw{RTH943Wl2A&bPGLwROtM#fU2Nu{(iAfo^`>QSZROihx{jG`k3X#gh zae=HRU;i)ykxzvsZ-y|n!c3jEp%alio0R6QW(RAgz~nNn)H(A&fy+CAidgO0$S?dH8S)UDQli zh(6^eboehS1CENeeCnyLR1d+G2FPxN)AVH58e)OrOQLLW%)FRbF*ZFeYs>TNw;!5v zwQ3MT;(2;K7@J5F#n&cn?U=IVY2n@^b#o2aU5G}lU=9lse>Bx zbNdQZZ>r!F`S*=Kgi&RBu6@G-S=SNDWn4h~Pk>k_kqJ_iHQ_Mr*XqG4bwde5Dr?a#Z?Ov&B3#xIT|$8Z^HZX& z(#rTNP{X8L_~nP7RG~2_=7|L4?m)p{RO2Bijc}MHiwM$lsN7r@Vm#8jHi4PjwGy2q zDd_y2#|Ot&M}Mz&ZDAFMsrKmiOCOu19s2aua{Ao_B7?BChgXjukBREAmQ}pgProy2 z43*)hko;c2&d9%6Qpf7+U~7b%?r49py{tA-jS4j73*W{Ei3I?Fm4Tlk*u*N@L>8!3 zXsW<-*8r#2r&7fO3O35RsH#?4s=m!KHJ0Lj#qZD=C+o9i;0O35U*WoXQ~*)fiebwN z5xCBX&W=LY*F%-Avzql3Sz0ZS5xF}G-&%$Rclf|&j!@Vz@!?{|yW?vqbfPX*tt-D# z?!G52+S48p7{6M1XbU%I7vlv>9uX%egm&=D??&VsC08ix+m@Ae_7}Z4;&a(q z{jys)u*%wyPr7@ZFfgBQSIRE{z;o7@8`pX^YV4-|sA*-^?pjZa>u*{n;|%?XsJ(k} zWI(^u^?i$&K4;03ye_K@!Lm;EQSMw$1@TFYl1s0+=eh8PA$Y#8=tCjoN2Isi+QI1B7ssog%9yYAAaIsj2(J%#CK-UY+<}dR0 zf={=Oo_Y|VI!isE>1C}dBq!T9FAqWSkc>L=TF%_$OW;d6xfr^*9w$V%qi6X3#}21t zOR_Uy)9Zi%#!mg@XjtSZOakSy;fXf5ILLyp!d7%3hvD_dy`cXU z9Wl-0U!A|O0vZmUQ&%g2`VUq%UQjMHJ%f#_xtS(#152bIx;x{(N`d7p*R|+_5dp>j z7#*4B{i^<9LGEa2G22N5K`fj83gSDdbn|ciYry%6lC`}N1=d`N+`Q;3xHs_Sw4Nv? z#*!IQdQDW8qdR5f)mhStN)2jpibz%NCKGB;3ju!9S0M9}bJX7f9J8o4dpnHpazO@~ zX;s5n&3y->+5{lnvu!w;)$;1~;FnTVP|6mbLJj+HgwJ`A;9Jm-*)cXcO~qzO;;_PZw1#UISVn|2R@&8TS&wa`1rQX{_G9F1xr{;i{AcM^el*}F1#4sbUPY3>D##8dQ%xkpINf>xwE_0F+TtT zNU>$&kvAicpi8jSUDpzveK=EN`YWQut9k9o#UEs!@-v!W^!OFqUwhGf!Wgz}D`|Pf z0!#j(Ej55yIsm%s255Cj43QUK7vlD6WdC`tp~e2r(~2HdKO&35_zx zVcKg=CnQOY8lrXj(5fM7-dxd^nUhfW=w?k%dK=`_6y9MK9tt|fj0?gV2@~#_Gh56% zdKR8}l-~Kk+#x!AX)8m|z8eXPn%7qlv7maKFR;8{#L1Rr1%^fQkwLc7s{%%I4QhHh z%u~bt9Jw!7CRclSpxt>uvTeT?;~k)4kYP6^%HCCG=}*3OTDc@P6JF-yYh6EKKY`JV z%&K2`;|`6T3*W)aZF%PwB{>*3RVb$g4G8{E;E8GX7U~*qvgcQtef2&vU819~ZJdE$ zjq*s)JjR0^yoQ4f4(RWBoNE^Z>*9@4gH(fJx6XzI#ckRh^pg_(p%M9Jy#yJB4lD3+ z`&~Tgl_3y4;#@!A=z3b}drO<6{)r$&ys6=ig}aVZQ+B4>Hp({gPXoO4Pg0?j<$$9E z6O0pGkZbu}2tvb5Pb~ol>O-Ymon}RcHd|WLJBwH&(pLxD0EU}hwZ`dp7k^I$#1BA# zdTJ^R4j&()RboUJ&8qtq)MFD@A3dt60Tza@#Mk6!-^00m$ei|EN{xF=I`Jf&HJJca6yVg^6I#Q#7Kf*bRDZZo#o;MaBGAmum{P z&yc4BX8EO@&_;m1SH+2hQDw$*7@j(A}537@@)v=%!JCnu5S`f8^ZS z4l5S9&tSe2oEgsBa*6b!8s(U|T07^lOr{2)|3}ez_$ArDZP;0AR)U(E69fYX z=HBMO1!{tOD~^<$@u6l_N_L&2UtXN=u)#Y}fDQ{R@B(_YL3s zy3X@BuJtO-J7cF%ziDTk=vxM~>UF#hBHSGLG40;GVNL)NdoFu;Hp6Q?^M=44rXX}mV*X?Agpoxp`-iFCQN1M+C$MJ zR~>tG*u>3iPhX$asz9}0h5dOqmDu5{!yM9U*FOTFNy+}|zbJ`MUVr;_;h(}uq!s?48d`IiN!%!KI)xj#hHln}CQQeaEl(Kv zkNl5g|7&`zG%KY7IpEq>)fD3y_I`&(_%VE@Q!I@Y=iR)hv3UiFyoEPvrf#~ji}bT& zzrNV%y_;nXPPBAO*vrFnW;gZElGN85)vsty?R8_J=diBLt(DZva>F3`o zSwT0%#C|mVkAuD9ss@&LGOGs9UO#pK*q)R@$@>zYLxw&kcD`H5MK-Ma71(1i3sMED zPOG&+r;0WKYCtdVOW2Urw1=K04I#780)6CommUhUE}7AY&6RT}J>R*`@if-|d|hfo zTz<@wp&hIh1aEu69^3a&=BWLY%#sa8Q<*||v3{P7;_4t`JMYNGL z1;iA1sYrrx9|~efaTWedn4n_avN2tjTt-7$#K898cE!cWyY|g^GrRMxAHBuB7E<3| z0lM9?WnGJ52kzF+Hv+dlp4k^o#v+uo2JiDRh0QiTP-nB8F$2$;;})1v*yCpzYaK)3 zl2K{Yu(~T!-lmIJ32JPKW!^-}`uy~lE#^o`gC!Dt3-{A^lH=n1)6mxwf1FoI22W*d z?)P5#^6~CFU}j*WgDa4D{NTo9=k@i8TdVWrf3>5QspU96iOc|Y85Nmxaxa=xoM%=W zUOHV7QFit(OadT>N)iT`f&F?{UT!vD>%%_&M-lV5jOPYP+=E-wldBz-_zF#k{%q0{ z*gO=OkCD8~%R$WRhkJ)n>IK(-RHg>Si?o)X6d5as1(Rf__01631;CHLT|Mql9+moP zD;B{0QYYEj#K5~i;waW+9n#Uwje`NC{6)=Vy4AYcBor>aOR)rFmGZaw!pNbS|IS%U zh|{oXDMY?!Lh8_*ydHf#}K zf;^O|hyy3pVOXBL0Tqu1Ke@=x^~Zi!c&N=n#R+AeOgsh9t3y0bfTm?JlJCA;BU-mW z1RYP4A1--_(L~m8DMAJX98(DAR;IQ8sCDO&?RIUEyXiH5|F}?Vw8+a@bz3Ohb~81e zZ84~&m#~c)>^b>YL8@O()Bq|_d&)u2r&N2TyRZ1UZcR>QBk-L~5I$X`MUp%&FCt`{ z4|e0yu~eI4i(PPE;j=KsNiLvz2fK&e(W^9oebc21p2PH_g&o;1yS|lpN@oQ%S2C4B zD)R&7%q&ihbEjf}vPUSFKzu6L4JZYeGbu4sbCeMO)+D-}+T|An@;LFBp1>+@K^YOy z1L`t#pSk(h2{t?~8~iP~V(=Lrk^{;W&JL8Lb9hWyokEzBGx#(kPQ1l0!v}T|_4fiu z{&?<$x^chaL}4esghtw?7^=Qe6?TYCzV!L|j+q)l&2fuad}E;xtJb9=i>m*VIBkp6 zUp##$f7+#;PR%5}?b(h$G%uz&;~vjoKqmhb+$!tE={XDy()6xA-z3rb5k9KTdLE>g4vgpZU&t_v1>8U|`wIH1GAwumcmi)Rw4OhwUBu#oN%+ zW42oWDh-D-QT`~JY$4vg9gjVleemz zr2MG;?0kASpjg0PL)}(QkW-~~|v_R9U1+cH3Tw$#*Dy4-vE+ua2vOk$ATllwtn#Z919%agNx((2?iX@2o{` z?O3l-!hsg+ANWRpR{F)&{f{FL?{Wl_tIRIsd#V8u+>$rQ*9lH(&A(?uOkEYy7Qv;; zFnPzV;ggD~7P6zgja+5{B+j8*%(?r2o%kL{{&H}%+%02E!%f`iVg33g56|N7nDIpP ztDQ5Wm~Hmm6%Q?MMd|bzT4=qRVTwdKr(`Nuj4}Z~<5pRz29emc%QU!LM)$2F-%j$y zGiv0@SAOvI$HG4GKt+8W$yT%huJqiYV^?7ILKKki*BNWrq$#1It;l#sfjV}N6Np;h zNvyd8oU{Ek#x9qeB5X2%`?hcP-J;3Zb_Y10c+TOzDb8A!&ZFkCZvRGH>8zy4)IW;$ ze@)DQ`Ox3BYg{}1?Y(nee-)ZOnjO&RN4&`Tfs+*56Q8UdJ$6y*2PhQ)g-yT+GdacT zxq!*+_XltzQP+T=qc)esHO53WNR^Ih)?PT``{l?t-q!CBAeFyW9SBy8PSgPYj|0;B zTD(c;EP*HRce=prt$5W3A)4X523I7lphvgQbln&Y$Rqq(&V4K`{;Y!4xtUi8^22$f--Cbr87u1-gYFwT{8bXnf5A{1?eE%+$ef7IWDR(n1A*b3 z;}-5cxq8+PFDM$I0)@cdcw^jx6s~)kK|fbI;41LJaapp~B-pH96Zbff9T4Z!w9qb{ z_Kap$-EZ!X2(Rk|lio23v~p(Y0}=y_?NCxhHIP_fMOWi?q8Gi#2T!~_6erDVIuv+V zuV-kDsmZia@7ZUR2JCxVC9}d>*;H0Bi&wv$v?>Pb1I<*}bL9ouE-6i?kk8n-s?!cxbS*bc$4BiT~%^2 z-e_qfA(Y$dG`3uBr&qaT+(6{upf^K=Zofc$B}2de;>1*G7dGc=wFBQ4`G&rux8;Xq z&!g;eQ5-HhSAN3kvUxB_d`ShS!h1gI z4&HdF^6F{EU8}c;UIi4Aozf|j>lEiR6DrQ)KifvYM(W-QY@aM5WPH%I@LcKtIF9Zx z2Skh=Q~i9X8m|BkoG+s<)R~JmPLkBP!CnK2Pc5EYFd;fCc9*vHbulf`>LPnOJA(2+ zyFt*Th3JdL*Kv)Tulr-l(jvMtM8V)IL+SwFu4l;?A63PL@uE13>fuEoXi~{M*6fL` zcpoO*-gv&Z`z(8{f&6f)us?=(eE|$3xpGK{CGY1!>|-BDHY6?56Ff^tUq2IihFbdA z3=@B)(wrH+QS;NqnxzMb_6A?Pw-H9n{8S4r`;p+H}G8Z~(KFBYSe^1ryF%J)$mK zy*O4(AbsgBPv7~Zg^vP7U67$}@3p`z;#%rLg?2t69~d}H<-Y>ie)-*oOkY5;FUuq6 zhI{qrOODEiY6nXbx_g1$3E%wtZ>~4DtacE!!d%ogf-BEwhMyvP!o5%Wh_{`VkkB(m z54|cxLc7!*URGBrkQkf8@fqgt(IN1OiOrbr2_$izdPE`a=pBLJU7qR z-xbr0pjTs;X=N5*#L`Cn5==U}*KQ%()vT}dr(Sn=v`7EkzU*167UL_J&;N~S?Q~;I z7SKwrv}I$?kXRmj#%zz$-sMw+MSQ=V)0#LeUemyPqST$6t zy&;JU4?S|W08XOWMiAkb#RTPqirHRSXwdV}kfe?0!L*`NFI|$955o-~C4=*z(@mcv ziEu(?oKFd&%xSyt(QmTAaZ|H>6aKwNOaQBTi+A1(bl8UCI(~tGmDTB%~IJ-gyW$ZIW-_cl@?@bNZ%V()FMH14|}7N_4BO zsedXMvBsqE(t4yH`%*tP+i-{f)^uH?t)JY~((RESjCZ0+{va+J9Fc#Zscl(Np-kp+ zZWs1KguAgO8vN^Da^xn&+TY21Npz*^@Hf)4ZRzy->`!KF{Nrn+8vSmkNALJ<&Rp6W zPtpnct8#g3&oL^Q&zcJV6S#yq^Ra`y;Cr|H$JB|LEv@9TcS-b7%7FP=UD6Fy-_P)~ zd##toRfLN6t@<)O?vKY*ZVT2vDh>JL?+iNq-P)=@u~lcH_CvPxuS}~~-QLFAk189J z?Ckd|_nXZVD+ksd*Fr`#s(+;Xss}|fhb?6K{QXxU2ZiK@F7&F7XE%m5kj>`L`D}ZL+%JpKclLO3=KGnKnq~O4QhFRZUbQVV6y!>-RDmnc8lGIoMDer z@5Y=I?O@C(WYL+$mgWpt*hA;Q-SXp2>PV+~217AtT?T!x#{jm2lhP&Qo5)@?4pWW$xCasVKH;tH-680!r<ZJ))2?84IXw+*e5rrHs%1>?)aF7Tr5<`{!s^L-KelIDbl)I4`gHn0ebu<6NNL{?+|qL%q0dbS0*nWc{Vj>>^@ zox+H} zR#hWhH)t9mU#b@Jjq6+jS%{aKY3Z$9nZw0a zI+mV<=&@4ciFN;x4w*h z+-gdUtad4EX2}=iM-$@Aj{2p)q!Wibkecr;6Q^>tN($s|eXTwBT+!ssRB*~)m@XU+e9x?bJKRat}MC z=zkdRbmaW+d(auvwwK8MY>Kz6jY6-Sh+w}LWl%_K+^DfiLVBaN<(KG*!(9`dUyjkR z(u#$LZ|x3D#^ohYShP67F7TRZv~rQ3?sn;q9TB?UTY{X+_h{SGm*#l>^YAAI!&}sM zMZrO_Yxxf2BNUN7==0-J@ibo8ogvW^>LqO9^6AO{8im1*N?DSQ{5aXoEG`~+tsxgO zwU`dvBJqM9!RhicR96D_5vx-;)$t*Jg5?hS8cKswRE*6IraI&vEE%@*TmB) z1n5?I=ioBh58kHS3?&-ZBGX6R?^Kx`$U|ArtmdHacW2(FvYF){C9pq0TMAw48H6p#Y7=3;pv_DCtuyrNGC1W3F_Q2YC6DK!6+wXC&i??jEomi|{ zY0w+j5__hwR?hlo2HV=QUu^`$)ueE zRwFj;u5P3E9%{RF*>o^qtV5`=0bk>*{e=_fG-gFOij}g7gLuHuDlO)AmJ_ zoqr6c=(@YltX(17U9K+s8u?Rwq!(t!F?ljOl!o=V>f@FAMWW{2~y?Ls{2OC;V5X{Da8Qd&drr=a_z*2;;dt7wq- zP5;uhjq1k$el0MjVM+Q_DVy9%xh;eP!_uZ|WtRG$mr6FptCMQeGQ??M49lqFh`cXo zefl*jp#0m)R9fFe1pQAWj3#L90nR46n&te;K-$!Y+j{$dD2opr+S#-FB3Y|WT-s7)R+#tYBh=Bp6&&gO2mEb~#79PN;5Zh|0Pu`hwXo z#gok>QYS)lc~dgQ$Hh_Hxl9{sVBTRi}AYpLDOT*1;dBO3eF2Mk^7YJSk2KD_fO zQKe;>k0ZQ;LuU+w7){qdM$%9$U#FTMGz`dy(c7P>c$#Gbt~5bJPIRL;!mPLMW# z6P&&)(onN2`d1F5fYd#7+o++(piCf5sv(4K#ebelBb=c()a%!QyP{(aKX^V_?btCy z|9Uxf)gd%ZUgF<(q8=A$O56O81AHJGAv^s)j(?n5Lf3oPOp5;4*SteksO|H3tnbQw zkWL40)f}+mrH=QBtj3t!8)pC3eaDVv1q?B0d3|u6Q<1B&?De}@Gv#f&zN@9_8K%?6)@{Jxj=26+JN>!!b4#oQjFkXjcY@Y|x zP*1HszqX7&^pII;yMLtg_rj;KAD?1Mzjfjl_E9^$m~8E=UEi0^ulc_Q-^-m}XOV8F z4S+=Es`9LBe`@6|-e2kbDHSu2VfD``ZJ@eAUkmA{EZVR7@yU09+)s^(9(3A0T`(nrlC8@&ELd>oIwyoG$;t6`!NjSo|@$*Ct{1j@d^x@6^ zBm|X|Y1e2G3tNwEK8Q^HWq$vxVrf|AGTXAX@wu>7?_?l!I*Yk*oo+e9sQ->y@4mu$B6W@hCzFCc{k6{bXB=ul*y)h z$arl-C&ddgv+o5WXfBuhS%OXTFXYuIk zgFd_~K!4w;W{rKDTr@^}bpM^`TAwkfOISTj`ZQQz3`P+?LPo`GZpd8oRGPa;JhUzk zII!Ft2g-hzi)Sm~QSMEG3+Y3{Y)1rL@*48d!!#HOvS55y{S$APvPBUlAHGqX%PT?h zPYcYMH^WG7mvrO-Nr(?lk_pq|Sg!2RZ9iQL_fffs1xKkX)4_;#e|`aMrvbL0_zQa( z;YNpo_RvW;^4E7FMMJd;)&`c8ck-WYm;MZn#b#&$mIcwH;3^)Vn2K_Xk7-vpp$w>SwTa*KrmQzS~Qd5H)fOrtE6@ zBB4Wgn>zdGYr}&2jDNJE`4KwmTc!1L#7vW2;f%E7CKw(*#@5RoIl{%EqW- zd84Ml4z}Cb86?c_MVpqByOw+LlhNo~u8Qc)%8_mV$Y+_hxvvSe!IU1l#9HPU;F%Lr zP*lgi)cX}lTxzIJ1&QJFf{p0VUx<2)38mzQ`bFR0vr}rb?e5EA|Lx$iqu}x-3Sk$( z4&(m;N__;<7Os%*;YTU*vC|RMzNSDO7A1Q?#iUlc0Ofi{;BL-t7>WPsp4k;h%|`Ne z3uuv)4MCff<6y8AlN&B|EUrP(a_@{7Y8pvh(q*fT5=ecVhYh{Vq|UD9q26UHk@rnG z4=1?4%Tqs$+0vEs-^_~K08?sxs2K5fup6~0O%GS3TRv|wYEub(3#pDbIY6mVI2=Vg z(v=)5lT##Ztn0is8!qPbD=#a^VZqrp4jl)kV0KKSSqd{_Q%21DUC4ifq9Y8cc6Cdg zzPLWB@j@dngXy5t7d-fx;)a5|rmn3S>+|XxkKY>GUTaOM4$m`iCY# zL2|xVhkhMXWai`gW~qN3L~wX2Bub6Mhth${4?+M_9q#F=`IFot!8Tr!k>uci)Rv1= z*F@FJqezkQD_I?e&VHE56TaA!QVS)fDqHyZT4aLvT7%o0`ZLrJS+IMxx?W7P;BaH4 z`mlqgSZY4OoJ=L9^5(aEpDMtMw6ej>7vRs$T0oI_&r48`ii=yK>N5OwxLiGjcD{1d zYT^3)BUOWF(}1AyTHe9keUxdgO(mvOUIxE8um;HAq$KyVccu)H8e?^my%~iFQoj9A z1f>4SJcwt$-?pkB$k!}Vo+)ey{AH)+d3W~W#q2CCYj1M#ShY=>rB3OyqD_?<3w5x| z8=87o7Nf=YvxHp){M^0>0m6u}qE2^6zyU&br#i`1x9Do@Ky5<~PlP3OLM>b(9-49j zZK5Y~T4ez);4c#r;lEZ17r)PIK*v?_S4>B85vv6)!0C{bM`UF(-++)xZ>#{WN5QOK zJkx$#xHi1{iI6v;I7PGp^dFls)_zVG9(`G!I;9+i6bYKonkvvx!X&>U>!A5WiOP{C zCAkSetR{wyzGE}oc1l5l{6bKk2{r|-kU!e;!q z6C&AW=*)4GzZPd?t>oYUaf{%A8WzZeqONDsB~s*!tYy{`9rb?1d(`Q^B5*e_W{*sz zd%SGWRYC|oPZ69vWZ@6vY3n&?3@1-?1d}gc;KF!5?AHNmXZgHa3{d@D>xn>;ck{f% z$~q1BrG}b3!19`&C^n!;2rjxy2+cBz&1cb(|EO&)X;C}-wi~;YtX(ICx?)TD1YE1G z=i>o~mFZ_o^6Kq{XBN$`gR3>$#5qwq0`srR>$DqLE``=%$zC%{Gl`C@>o=<|@bJ}+ zbW{!g;p;y7akM>h`Ryrd51=2>d%@ZH zUo7obfcqXNGxg1L)oth4G6N|+#C6K6(0N%!GbIZnIA6YgV9Um?-VRF1@y@XV+dciN zW}OYNv>1!6SM?SkB=NNZ9UDTV-}Dbyg@qO0nMe>R%HYesosoSTi>c=4e@0Anc^A@< z`jd}+?CXB<2UG%JLzP6bYF+jw^)x?au!Gc#ZT-AO1(x0yCB2E2&9+|a++Y)mWSYo$ zZ&I~*qrKLxuVR)LQLDB4%cSQ{`;NJv`k}zWBI%}PftX&8P;%D8uXXEEXwkIVpcr0_ zaD$mm&yXUkh|U|HmzJQGD@oN?#DCE=V}(O3swABoKia)=-*ae*P+2aQW&nVml5qfT z@+hJ!JhK}NM~gOR5M>r}yze(O%Z) zu^{U3v`<&yRSUf?7yAVy{0LhweBn0s9rIMzQHduD-C+Oxv0-1EOv?%RD@B=6v5}fX z%~_1T-Y!r3RRo&uWuK=@o-wHNZtm^k8=vS)$-2vIc`-Y9?NFA{@RbA2_7`09`@#=j zm=_Yys-|s^1b}R3Tf?WoMyOn4rX^ynnRP-3#>rN2=Fi$su{TcBVdsXyUR3ys(34k+ zVfG4`(7AaDF@TeVM9jCksHwmpd{$)c4xO+QtfgVUYfY?G9Dl48Wo=eg?xQ7n;lD6DdB%jl(MO%re^{%2O{i?XFs|=ea>55b~jKV%bMG|{G?T7|tB|LwKUg z6MEV0@qh_i`@+>i3~B<|noTpVvGM;lT?yUZv^l#3IuSeaNa-B{xSCGB8bo})G*8NM&(k~a3f=HvU z@{NADv@Kn86-nKhPBh4;b;mpv-+x%1tUDc1g}8m-Rm6Tv15Ce@gF>HdUh z*+Ah&vvc&*?UMa-SNWvm3zuU z_&u+81>+?AMM1hKCt=&1 zhtQtJ{KYi;-NJo8@6#X&memS{4_P>CJgCxe-p(uCFhYwjY4w?WtcgdxU0Blmu<>Dw zM29GzhomQSQaozD+c3=uyRfvKVh`%?=fUW4~ zRG%84p0YbfGM^xPY<`Wyx_iCMj?^Jc2dHf@8$Gny-Y^wu|~nqp+;db#Xh z8uvenKX<9oDXt+qJDx;))=@=z;cYS=AMg$uInK1)3ce!g=#0;C=G&KUPW;Dw*K7Il z@|i`KV+1{x)1aQ1&*mp5CN5_q{gCEUMfF-ju@%k3=&Xu&K@-s_fIIbM*jJXiO1-J* z$@hW?QM>13 z%d$qYXDf6I?!kTN3SgWXz^B>i0Ucj-E)R7yK)qqP^17$#f~OjAb8m^u%=MeawfNw< zpKM)#vm^4oE8#h!E5a;*^-$hR1vF4^i;J5j?_v%|eT~ zAXN=ks+_)KHx=RKdg7q%t+%3kc!908(_*}|PD|L0xk$F9y8NGN_^n?cuBUL-58#Fr zzzLhSS=^jrW!k~MD=7V9Ubd8I9|#P5FdZ!GQ3W7ae;O03-X0?sK!y9I zP`LI9-gSlv5hdkxApTewCE*S6Cvr=$N>^5{L(h>6!L%IWZj+_Cx)vbKkx%IK&=Q}Y z5i-ZFbFk475-rXuayXX1XlCOnM*$;?Zv%q}YD)Ve*Vv<4j2?w2Ff|3h`P)&aK*des z7r8*tufdHDkSQQNa*JRiTIcem>v$T>wRHc-5qO;T_5s;lsu1AmSBcZ%v>v2fMoVSF z0Xq{KxtVUEC09$6s}1W?fux%Jy}s)W1+45RO06greVw{z4vy4!jdvklp*4T=x4DJ7 zIbnHh)D%zcO`cM9P`@z!5&MD3JoGlHj{UHOxZBA{E{o@pSrT9V<@m}a0kz_ab$GOry@g26(Xzx2zRAo>{2gaXEoa9x9Z}O$m zyk`Os^auyd4ykv^%4x#5%-bd54T&aBC#c2SjgD*Blp&&sz@pso4i8^p5acn zLH&N_)S<5S9Xcp3aOs|QH7{A9HXrqskq34}bh-E20&{*Unyt|PK!nAv5NZ`zSW<)@ ztJ&cMxa9d0l##na$>b6!3bNR*GU>|Wp#84tf(s6|s*0DG%H(CG7$mx+_iEPOJXe`K z#~Y7N`|yaFt-6^$KJU0IUR8bbI{kuQ>5uPF#60=pvMj`sAGukUD<&UR6N&fdHY^~% zh17JpdV#ZfUY4+-bM*wiXNTxaL23&i?MA-N5t@Z6dLtl&mCsc-+0d=@Q#YAqB(p0* zT+>*L5~Cn((79LO;zx8SFyzZ-RzStnXy$52lXbsGy-L*+9jWcgbKHe?F_bHD0%PCh zVt)(eVgLBjKlF20g$j;P&YDj1oW!3Jjh=Uf;EV2#v$J4AvBl(M)Gf;C9SJ(@vy?N> zsP0+{>d7>$+=^M6AaVZ0rQpDG_o7+I`Ewvi_GF|EzMVOC zQN$-eT?qaP6YR&!DoO@GB$(}rtTF%Cn!0}ZMHjy9V$mpoGdS**-Na-a!P^-RfWxf6Y1OF>v16C{whk+ z*ERM{d5moQfp!4)vhKXWLb`PYd$BrNAO;z%cBvyKKeOMF>bG#K3ShvICO0zSK0560 zQr(2kX)1>EajR49=b5yKhm5|&$c35WQm#R&`2Zigxx)&Al%i~Pr(u70)778DxJrC^ zIzBlS5c4^q13JJple}+s{&JSMEWsjA#FmkotlY@Ci4OCfT`R3O8!h_N_h>`%vcsD2Y6fq=}FAr&Q4EqMD4cB zpFFZl@ydEQ0rxJQ-Y*XRS7i&Gv$cJq^%vkaN@e?o#8b$@n?M=#u~-_MRrJR~XSvuz z2rkbpFA)G)vrd4%&@zMu77XAxVacUfSX`ZiC8L`+j~?8pF29Ax^wlAW&($Do>8NB3 zou5@dt0(6d1X<37oq8OkNe3L50>-OTxN@e>jZMSYHZMGm!|v! z$Vj4~04+n`A4<}w|Cv=g&(^zy)>u((q#WZ?=WbA| zN*(niER7VSUx2Dg@5~|=TtFwSKw(8#Jb?ABB$Dfiuqa#Q3_y2l;sL-?RmmOaZp-6TR4)P zeI-0Kdncw}fn7t{MPKXA7;4yg`DI)n8u{)0UJer|FUjOBDk-QSrUBL(B7 zW2gSnr`u|@1UYsjRP6FO-6g~bZ>Ny0eHrZZT8l=MUo>Eol*pCu&xUMA5Od!22RMDI z1(No#-MQ4x+^&4d|s}ASDn2n~OMC zkze#Dt3O7f0Tgw&68a>#fzHu4jBdQ__CYWihrUU-yUhLWy~ES|Mh2tkP-2TD)e^h% zkKRG^z^_bY29HHwsi6D!5x4udHN*riHR9#gfjZuRJW+M+((Y<8QB{Fg`NSu$>1xIw zv6t$sh1EgHGv11-n)~aJW~r9o^$X~^Uo=k}?GszFF*F`~-dTEBeLUXFReRianAgIQ zQ@97x?XWzvAi?)Q2Xn#F(vtP6o`M?f!d#9vcZa1J&DJ7!MXMo0bCUa-Dml*)J4PXr zsa(j+E^XbHG)_q>d|mc`9O46Tuh^!%J+{=!s^i@{SX2*Y_uiBNnlyA#U(fc|V*I?e z+GV+vUPa0@W5}QeV_M6l6Nydm=?0Y9i0UTk!mX&Z(ynOVq?T$OODQYT&qukMrst-L zcbEgwKJdZcmsM_V`F|dEI~kP$6n(!zM7hVR+O=we-=Y}XL%&lYZmOOyq}6+Pka8CI zgU~BVwt?-Pmt!U&1I%y^@BeXhxMw8_V2G=PPYyqQNnos3h2i7$V5~RZ<4%tr01;7e z{;QL*OzTpkO_PI!<$|x$VSKWoGkwoKVjdvanlt-L@^QG$qvE7m^dkN=X2bx=%2F zdxE9z#?@bP55C!d8`A4wrpEJJ-!xyf8}HlMLq{PsBmPr8)taPu7*UEu?7mo?vVt;H z&`IcW7yqrv>ZEZCyqM|QL&v81V-yzDwCEdoceHa~=rbGpSRSTW@6lcDQO2wYK|WcU zUYCPK+v!;d*bZ|i9$&R6r#adkQp0t}vuOqE$?O~Lqo8MTIb{y#t?lcw@Fyl*WIbN= zL*t)>!5z(gMmcTV^H#K)5)GAy;rQ2R?W*^-rAIaILyqcXI*v_mc=M0CQGaM&hsAI1 zK>vKH`$1hU7dIdsd-!Heg~jY3c1HiWe|~iRW+(a(ZhXjDZpFJSZJqh#PVX)1k-kyF zVzw26%33_eXZXl!GxmHET4t|?+;sfj*+!ckd|FT53+?9kd1iNuIi#X;)l)tp!f#M; zxtRF)z*$;N7mq7wB5C3j2$8?lSPmJ(x zD3D9;dNaNJLVX?mQ0YPbRJt*JIdY;^6T=09ep$F3Ix6AG>Kty!FOX$CyxOvI^M)PU zJ7mN!Xa$|W=30N^{RqSxg5J~|pgZ`8BIT#URBrr;7V}<1(1oAYcSVd${65S>d>f%# zX<1f8T~5M{D0&^xoSe%IrtfHWJy z`@rxBcCuZI4`uvO7*DCD5s*k#;RgTL z)Tmr}7W!w#rtshhxM>II%cLR~7(@0YxJT5aaNtYD9+EtCm2~NX@$Kw{LvFT?PRd?= znkxvvVKUaVvzPFAW@WtaG*RZFlaQvHP`@LC;t%BF5e%wmj?t;b2lTiaKPP^EQ>IJT2+g5y0@9k$l&(4H@29hQo`L`QfxMTnpqBOlh# z`S#IQxY3i_%ad-6_gKEn76lXdP3t^Mw3sy4MfFJtr3JZ9u6+EvD1d(gbiOJEo*&n0 zEu*fvGD|LI>wj@GAr(BAP>>UAAOa@lsmOTHfpfM!l2_cL#Y_T;eY%!ePH7nmM`=hd ziX^9{vHRywvkQ0!tjDbyvBE$}BDp7ymBVp;@D@J%GM7(7?RpTw;YQoK3^n8lt zk*)3%cr0h#_nV}4<$-A)OL&%K>v}F07;>xhFV5k?`2&Vp_+9S4`IyTdwk9!clD( z788G0^wWoUalI7R2~`uKY!_F0Ew#|4=md8eT(O5dZ2Dr?r)rZ<2bV4Q zJvcGlMJ{|t^jGbze86uf>%J#Cf%)n*>G&Bqc$iws_8$&Wrwd#5Zat z<-|*Q^ix6D)DoGsd4Vi<&Xo?fYKAOyv(Kw3(Gy%2FCd~d730n98ur`C9X0mCqB7H) z)m`i_1j>$Z66)2G7(^)EJ>3txIClMO9sIp!pA{XD{lGGZLH$t|^**^V|1q*qFgu#u z5%TnxJG?KTALpO{7Sbj-tJ`oI_`zz>X;ZP*O>dXQR%4WkG5U zBTP^CNk4wB)C26qI5p?N&((hHcO=tfR%yt*_NW@Ar`h9VV6e zhbH$-7bjqcJ!ZunCaonAX4*||;?S^ySEPZK+hFYWeQNC^jPBnI$c+)IZZ0yg476)0 z3F#MM*S^m16-=T3IPfr0YNkT_b@J86aTT%5dDB2fk2=nw`j3=22|pnhEu`ke%|jb9s$?cyGqdLi3cd{E7Mp( z3|hv9_=8msa!w%z8mXa;^;9>MKHGmx-+p{0r!hexdnd`sx>EamfwhbPGp|w9^ z6t(QTl1xW&IJ+`eENBKiaQph*JkY8eFMQHU%4I8U5@w$)l*LKlL(=j7LS18!1s0gw ziIu($y>6ZF+wchG=IwWj9?1qu>V9lI_`K^9X7^gt<1Y#)&p=V$bHOAUiD?&q0Xx3$s?;A|arcCU`)CZfH!RE2UG>7H=SEW3+Q0mdL#UZ^8OIxSxaV^& zO<}usn3mVmxH~RSK1xhNjl%hww)UDkTkGyrLoBg0?An{DyNo<~P~iD4wkX_y6At-S zygP6Yxpul4TiBLnVyb3W_sOM3q364|q0`p6`jG4}@ma9wLr;tDr;WDwR5d=2UZoM;82y12b6e!EQl&!hh8pQ^gY!uT-BZ!K?t2Og<_NM&_;O9i zTD^ng^QFS`?=^@$3;Ju;D0Ak+Vf&=?9Y*9bb*3pAX0_J2Eb3kaJSw4%qbR=$tAsCZ zb{Q`6utQ^PM+cqwg8ZsHHg{FBNnJvMI7=#V?f!wC_6My;TmYfF0n)DEjsiBTtuWzB-KA}^t4kmFpXh?%Y*-6;c zO|))G;YzF1*Q4P77!7MdNtqF+1*eed1h!t~`$Px8)>$TyFJKqFBWPO$(0_jHY?4pR zuI|DRJ$7@}if(?uahOW}%CbP3-yv(5S3#)8W03(?XW zJLPw)z-Q2H(27o#{_~p3sxZrQAz{PCp|R#!F=g*I|MA#Zxh4Anq~8E zbDgT^*}kfnYBjLxq3uUWpN#_Y`P4sfiIVJDBsscBSkg(H;IH2T$jhd^K z+XoaJ&YeIzRMgrN3t|N(RofSY?Yz{dBUGx0g2Vw=y^3r13dG`l3V3TsE7R$3vTHkr zJk0@kBWrpw<=IQ^@vZJJWf*SB07_BaaX>Z~2ILbvQeM`AjMsf8)Q2p}0 zHdyBjx_uqvEHt-jMLN=q{qnGUB2M$mz!!KdP<~magm&F*rA5n9vgmjIYPA{^YmyGnDa(N2h>vC5u#lI~sT0WRcC;rFGn?)ewtE}$*Bj0kC|>0p0iS8ti)jiS99;EeFAAtZDtcL0 zlm?t0E^G|>w7ywC>lEePuvmIPe4yHzB>8#Rp@7Pvjp@FLmxX*@QQK_a6RrE54+2U# zTkOmB8fJXSZTt+cS<_bsgEqlK##Ntdoc@oZ^KfUgfBUfAC{>A3yM&MkF>6$Zkq`+g zu~%&+MoEoU$AcP4>^1^d}a;+EPHVP@Yy1Do)-$Fd);Kdjf2KuYq{Bhu>y!jV#?=y7iI^}@u3CiEO zPe)P?Dp7qA$m{g%#fMVcFX^Q-0S$oFS z6!O0PJZM2M&0_0+e8fZUWzyhVun-Z!{2WK%uuZ+&vzYO9yStX@-_U5+pH^+ZM(7)! z-K!W6UyX+uPQOHSd&3O3WPX2H{}a06O(XrJ&l<1cJ^{Z38So~l+M(SJJp*~Y27rBQ zJjounR|B)Zc2*02!bjnDq93D=){zq4*7JmCZ`|ap*FBr!IlE#p5_cRvwi!`~5p;_dA!ZYzg4dZ=6U zMV-bAYd|DH(o?s6hQeg&8rD;VWyE~KswLkmmEuZjz{QkRcqqvQgg$yi7aVIzUC{y)ACF94N)3xCl+KcXCCEY*vVfqK07cwWhu z2L*f7zdkQ2OR7G7)4Py=dj0wDnm^`D3gqhnWbOC-KZ8BVuM!m1Xfog=E2pt_BIHj2 zuC2Sa)Y4GJK9~^rtHAlvKC+p7yazhjqhBztvlDei8lZF^YgC9?cUT3`z{$qh9XgZM zLMMVsgLB+QqaMFfCswV*JFCYBN_VCPmEh9?Y>a^b$#FP+s9L%eEDt=vw5*oH$g4{; zEIbZ1wX8ikF}(4kE6*Ndr?K{(Sv>DLW0K<{)jwTVH6V)d5`h~S$>G4XF)7;^Meoflf4mJ(3eY!-)n9=D->8@e+JN7jWz$D*tpgrU4j1VF<6^00~a zt^YdYdGhpB^G3LmdV^E|YCxb{)pK|OQkVo87mSPN@L$YM6^3ELCA*+stIo_E zRP{1SQ%v@R4Zf-33=GLRZbG3qqNN!^#JkYASB0boG4dsiX`T(5xa~ql{=bzBEr;>2 zw$Gw}X9E5E-2)yi^PnH*YgZv4vNvZ$i#j9aGH|T2hZ<9CUQyL0TRWP+K&P3j20y0% z2QkaqjWdLe8>_lkI9tupp`RQ)X?xVu0pv|*%N#v?T_udK%+{VEU=oxw5zeIu41rHl zfzZi(X$JpXX^0p1j&L{(2?*o-e=gBYXyXB&|DR1*x-Jc0)Yp$XHsLaiu0GagNxIpi zHhL9O8cZ=o4k|fsMyr7}rk@vVu-5&;pb@^%j~xcE0^d3{HMd6D1eAU{mJCr8brEnp zin{!(u;5h$7SV!<;G5)ND-MT5nX66y zV8sfOIB&S+in6ovSFmEq1)g7<_?}C^?B`1aN|0HI$IcQqO#&wGG-`~LB;A8j&c9{z zs##&FiGqNm!WnhxS;jB(F}{)lqFGD4VM}AMFwW}dBO+q6hSxZ%9v4=Wm)R!Q2y`x( zNI^ea$t*q`m3VPLl(mtvg*Iq%Op^nyXkbGF>NZsm9r{TJQ9JP&&BZJr-GcPy=VcE?JLVKY~^>|2_$6{}5J8j85I#T;3OSZ&R* zoZs8$=s*0orAxtvqcn2(5M(uz}1hp6F@WTMCf(gDfi<{a*i6lgi5XUeN z4ISlJmR6;Nl%my@@Wo>S_k@hpF|VbGn3t2Mg6AS`8urAeA2n%4l<*j10w9@J(J#eS zn`G05gp&J;HFj&%ESxo>Jv~tR<%SedQtoE?)sd|;cEV>@TAUZ}s)Kf}S+!8rd@A1ms$MO1kvuR+FSEMe>IyB{yud4?^= zKY=-H`$zPhjs5{8R4W(qzCXc9^=sVT#V~q8TIne@AN$|l2j$moqsfJne;OK%nTX=S znkMzm*>8x!1my1Rab1OqqBBn_`&y+9mu7E43l726449ngO>C&5tqt!GvdYYr{$Sts z#cnRYSg})JeaD;g{@K~H_7!_$*L2H<+dAiK@w{*liHmP{&rEDOL)Nt#3yDSs$I}%N zt&BV#kf2xll%v?mbi6mmK_~!5;2>A}_f;^8guxO-MHBRZvUuTwcrz}JmAYOU=X%0# zrI4$=F$*0h#NLj1os;ZwjY!%)9R+-w!8N2@Tx>gHpF&Kfv7xJa6sKL z35c&nE_pV?iv^ra%mIj+Fbm!NF&;&A&B3p(8}N0K>0QaTUq3rXQG}7jN4BcFhD^BO zgFOkSE-7%;xIoDN_XRer>)tNZ#uU&oFR@t7cSLe-g=>PsyDm16Mr!imc$YAGA*SJZt*+32;3knA6e+`a4Kq+6tj^rkX!!H_kgIHSl7c> zxFTJPn$%!8Qoop;4%82w4=F7QXF2pv(Uyt)ZKL-)RKHtz_?`{4Rj zLEsq{o_B|7K9offs*D&%#bhSu&FQe(IuWHmtbpES^+nXg_3dq56+SXH?VYfRqG#zP zc8N%w&13w-t+^B4In&i&>w3N~4?BECZs@$xu|H|-DE>pWJmqmM#==cTP%~u!x-iUb zKBDHXU7rG!|5cLtKDWB}?wn%b=k@Q5;RY5sy76FtK>`Hc@u^q@2u1aAbS-cLv(TEY zqz~d)>bq^7x#H{11yhrA6ry7mn>(O5Q$xrw3krMcu_No~kTx7?%E6gxb zZO5hH4tD3{_Z0iqe8d^L&4oq4D4TOtA(whprwrF%s z#>0*mViP&;phfP>lcw9QKSpW{d(jDh%zxI{zTaOE_;Dc{s`}=3``Owv^cQe=gx_Ve zmLnSziO24hOBTHD#fNFh7`3*Lb{6<%r4`h`UJ;J7azlOewuN(kOG9JnzADUjyU^pr ze|3|=3A$WtbMMFYdH2uMpC-3azY!neE}pQd;mtGnxSK90+0xln)95Z{?52a0*G@nD z;-G8r5p;4!vi9keRq*Ks`t%LGdgEio<|6+l;SXJ#vun8hUl#9{56quR!SN-c<|y@y zgpo1clYNiM`JIPB;6>hhwi>AyMMgyM`s_!VvHAh<-M5Oa>xl@)wm4hZs1oqwqf6T8C%k85Tc8z_~y4Qvz zHnN10NVZsISPV_1uE|gPwBgO|qMAH#*XdF3LAuu$*L^XM=-!TFe7A!wcs`qLf)@ZV zp$)#?029O()chHNGrm(UM!Jf{KQlcD{izdU_yz{Q53ApkmrXCuM?XbtY3G1N8larA~i zUx?6hI$+pvd8~u0H`%tD3ut=rLcbbF%WCeR`R>fW9^~2A^Mm?&ghQI%ehKQJ<-8Zt zwOMxFvjkhsUIYO4$5GWraz9JbtaVB4x0pLH>!6F_lawE~==D;_mx2v1BYr;IjUH;2 zF)&+8XjYhJfV>|ioqQ%q!#RCe4V^Ow?YKtAh~4*P*LeEODkL(H1_zv;^~A0!Vcw6> zk5@jKmDlAZ><}JtJh(3DU;4Ad<6^%XhAxp2ejb?@VuFHfw*AoyoF_k7Z<2`K6a1(D zdFrQL63}k*CgGJ#{gI5>$Q8)+|M&(GslcamJN~Y9>|;;EGp*s!ZB?8uLruqJf5PHM zUV~LawK{i;3cGP`J7@B@$MW5eZ*YntA8Jc#kW41fh;WYfi<&&S)$~2K{4#q1`e$Z) zc^(xJ-@px5H*_UI(!cT2t8@A)CE@qaGduq>%u=aN^EXFNVn z$KMKQ-W<4PeC9XLs#t-okqLV&ex3HoF`t?2>k8ykES#9aPef!AJ7fdfi$p7^L?@%E z7-^@{hll7my#IqFHl#d)q7}ucJ5SV88ipwy)%FA=XP7F@czj0v&hT@;jIX*2R+DZb zVTg_r71Sm1Pm(Wrdd{w#09w*Dg}{k9-waj7r0ecCez3q_^sJ6|@To18zdoS&0*F># z`<539Dl*`qOXb!O0K?K#fVEvQB5J!LESy7~@C9d2dIj)MdT%IWO}Z+-gh0H;hmI^30Tb&s?zSLZXc~m;U{`krw3BP zGgxJ9UGfk(u?HJxYJ_S{wTFq%${p2zkQ&5^sIsils8v_v(MW4*WNHxhmxfIj?5|8K zh(KZ9X@nKbCc|k&vr1Srr1a9nI>u95LVsto(Ky7+mraSR31q5w{-RzNH`^i#RUv7X z$u8HO1p(_a=e#x=&u#}M5(LQTVhu3N_UYg%nJS{L)&bp0grP&_wE>}XDRAC#^R1V6 z`44Y&oK)ItrMaoJgCRb71rLBawNZbyP{p?RzGU~)O@~~A%t=aTX*$7Z0~epX<>HA^oy9hzIfhCxUzi zyNiXKFrfq;aZ*S&<>2^^>qDqkM`Ab}vQXM6|JfyHR`?|T{xdJw=-#e_n!vV|)x;-9 zcpsj8SXC8DFmja#`cVQ0pcAI7QGVNUQ*D66QDTRFYCh3aT+>GHo2JwU?6`n!rs7}V zp6$X=kbCv$O&(Cxr{3WBww2PD4V!b~i`+N8m1HUIk#*r^A8z^CtJOV6dYqZjlrUol zjD5vD4orBw8KJ>EUB)L=3(J@>=rKS~I8`uM&V?wYskIE6TXi1REMv*HUAnv%@1cC! z-Gz9o*h~`rTn2j-X^$2$bUE93-60ImGw6au*6+KVupSBY-Inh2@C5-KY~riZ3_v6d zw04!--i&;tYLx){S4r~L+R`J#anoP;;x|NLRiW-M*uWzK{@1K9d}0^hHA_9ewCZxK zQ@S{>r0DFE%>hX|J=WKkUN%3WVXlXMw%rxL%}c`dGmv%vHX*&w@ipncQ=>=|{;G<+ z!oot6yQaiLh=}5|YrmhuV;8fOAku?09u%20-0)6@aII+Y1|60Y&;EQpUpQ;BA92S^ zkAqw475|s`<8l_dQu9dzR^}jDD>4MbU?BTf=UY7fTr?eZv%UZrioWRown}}>gZ1f+ zLySq3FE2j?cims!Yl!^qR4HPq9EAn>H5rq$GG14T{3gbwcJ@qQ}WThJGeqq(9$KrlOv+1}1EsNcV=3CKoWYka-^}fKJTT zR#y-?1}H!mY*vCEE>;loIL}@cU()6)>sjmT{_IPe<&z!iZrpr-`fDg?<3TR&MDeg! zZ*`<9h@$7<`T#*|b{YNIS2;1XT`=Y^cTm^U(FGd@$CYGy=R?E9%D=RxLi`3+WWPMjw(Wb`v!6N2jo4Szs6~ZB4_Hp`qdyw{_AT+w6u(;_tGyy1;YUyc znqa>FbPq~+UM~oSRiLiCf{xihmf{$Cqqne%IrzzmLX_qyKl5g6%n$o3zUqZiwf^`$ zcYrOwn(qt2gt6l)%vL#r&SQ#0juLRo1z^|JwQ-|dF(lYv;8OA^fW&BqH{P8ct1$ri zl!Yshn|+2f56b;S#-_W48Mz5}BC1Y$$mB8ZP2JtLW1@PS`H7dy0R?^3RQnDn8FB*S zEcp!rVs2WaxSi3){{b2l6q^!Q!wh+QyBlL!6I~tQ%TiGRW{tlt#y11uZjpuxBEqX@ zSMi-b9^Q>QwjR9Z%#RQ?J^TfS(vjrRFrSt_>e~lSGqUe3Al-FG>n{H+GGY!+SPW>p z?CM;0lUN?9H4pL9gk5#p?x zO!Wf=q9jlc2X&bjl_tFd^R^il3~O7Y#zp4V_FDXet|Sl8F=!MX3I^`swsrCp`Da_D#1Er})*n5m*Rupk(*b+_#Wah`}2yVHnob;F8hF>w#fI&J^!;t-TA z657_vQfp{Id7m#Mn}y-3JiwZi)^YX6 zFW?K$IR7IZyH+8DutO@|ChLu(9z(m5h-3j_=RCh|$PHz3_`l zd@<{E;`)xtiSU(JwsiKA??%wS643AU^%}=>vZbfKr|a^Eqv8&a^18?CzTY5V3%dWs zj+WS01MLuCq2y*$&F(W^x+t58VDR)h59@-#1^JLA<^pM@LKvH{SN19Lk+Go~oX%@t z^{<CDW@UItK+8zImYPGj+ZCdj7*IhIYJL*JgG4wv= zZ02L9h5$c&;%7Pdp<7qnF1KNPF+ybiuJh0Fjk|&MVV0TB`*zx{AzW7Xd_q64QuD7(-i^9D%pu6w^yL!3oFsBh;_hjq4 z+!9MKUo1}l7rx&^rKILYIv1Re-!b_?OP{_nj0_HrZ!RJlP#308OqoWkEVRwtX;rJN zUqIa5`d&{S4!k&H7lQ+N`plq5R)U9skxGhKP*cFD;atoa=KFKy*p^{`(kK$?!#qJ3cwvHmZWX^MyaQ5ZULx zlV%jc=+-cZeHdizHy)9Gre*kcMEhzg$@Bh9+2n|@yyaMAB6mgrsguN>ojr~@#t*ydQGC71+s}xdyTHG@5PJNubBmVqv{3y3*IjHdEWsYEup^T{l`4W+>STYo;k9i-5 z!4(3I3jLCjhLrhHn=--`hjq-=p7Qle*(4eaUpZwe)~f#|V6)^CG%XNOZA)@UE-s4~ z{ORjDbp20#(r4cMAcsK_N%Z8P?FzDBj*tkN{9#C4aoQ*dX~Jy3wp!|tO`Q(Ynq&$a zItujYtxIT^`dd;1)2Z}ziq1w0SJsopEMV=JYl}O$M&<67#|M|G=RsAw1Hx0O`pwn` z!!Wc(apnmiXKTmmyl)X8sYWa$^Xaakd+>O@WGW5|m9R@rPjCk-I%dc)& zL`VY`8f6YCOx5<1iJmJaMO~-ne#LAK?m9m{N&d=XBXmnXEH}7#2-+moX*zCT zjfQf_v9|BKSl0P-oRj;sEV^`15(em~l0LVYL%G^G)9pvC+F(<|p1pq(8D~vH8CRJx zB>|tU_-p}B)OW2gW)NU5`=?7NeIZ-G+Ge#h04<44n@*X@s3B^4Qo<)e$fF*tl$_fd zUD8Fz9f0XQphClnVB@FCXsKV(t;YZ3Gj`JI;AS}1>r&$!@7^v3n#g$LX4QP+B<6p4bFd&sSgioRmqN)LA;%u zv)?sU%<9l}XV?j0!v{Ssv?l_}=#-Z$bF9tKAQlvQxSBf@z&}Pl_E~VF&g!{F&v6I0 zV5!(JKaTB7N4&|zg40<>JHlp_cHgo19mPXjR|PF4^F~Ihn93$# zCwXM1PJ2+3Y0rRP+g_Kf<6=i7p---8Z4W0S=fU`2YCghqhB*UMAwiLN$hnO0Et8 zWe${pY)G2A0BUXk6AJ)Jx4OPrU>knrkcFD5oyKt^Xq{NgwW}MntWv0VaEw1bg15hf z#In?lkilsJN&ZkKEQ=V3Fu-0x(Q3&vcJZ!5`%o^76tj<&3#BwVgF6?b&z?oAj%cQe zVnQhewH`?Pv(R#Lh)M-c;0>%QyT<@~a)DiD<+;Z0RsFci^Wgp9(P2jCpL(SoxFUY2 zj{^;ws};P&m|T{YsX>Ry!qFiICu1?||19uynqlz(G)4_nt_=<~N}O}A{S1FJ9?t%a zPW@Hlmv`HT^H|~0Z@MDp4ZHv2ieq%{@Xp0uN47x}RxO8o^`ykA?udI!G^_V_EVSha zq;Hhfx^(8BeC0};0F!S=w`NGnXGdcbAzBL&)0c&ym9FXTk=aNVPT~;CR${#3qd61hs@qQ)w8IDwwdmVa0Q~sW}LjvKL`zLpNGrM1x3xBa0}|` zY%tgh+7Z}$cgA+yUdJzTf;&l_xrmcI1wvMXj3zl}12fp+kLp1x_PmrA(0y%fT@N$q zyM0U6aHC7wJL$2;CFUYI#OWuiO{LJgC-B zY$)tu+|hi!9`7UF*8H;L;b9eiCykqAriL^tlx=W*?SO*CG*ptRV~M<<`S* zmXG=1b_(nCy8ROM-JZTg@V?itCzWpuqZ}yfJ;8N#VB!^8ulu`7f=Al3N%zMo9yofz z;cFHpgtBP&|yg%AxSaM-InPHo%g zOp(srDfRFi(oMKc(2U8s2;a6M*@9GL3B{WTNd3IolTn22!<0hkQyNcx=)p)27s}C#X`bMZFNn!_~E@e`XTDJTlfWRN;My|9;%5+M5VV zFgu*;3;)q}60?JUqzLJm>u)&av`5*A*eCU`I=$L@7VHMB8RnW!;rDxOAg{OID^%70 zAO&G}+|uVi46i2Brw&K`2%Mc*{+#aSiZ}x~d~ zI2HpbsnuHPzlpVKslWODwCtfC?!tHK(KN`HffKGj@NyQ^ujSVt02A0AcT`BFrK6o} zQ(OA2YM{4PQCES*>#Z#Lb*2tc|&G|Sm%>Me$j%Fn^8qh2;u>Q4NHUNlV z7IG8bVc(iUcs-Q?6wvz|lQ1C|Znrg6qEPkEWu<89p1TDvKIV6W;U?52(dc-#>;(Q} zjkD`ks%V1dpEqtjAx&-upmPP@FD=L@)93BGPqlD8tNrqk3I6baqqFRt&A2)q*nrrN zJ+-G)7q1NvUU6rbTH3DnajpSh+R9QkDSbKd#Q*8Zgr+2B9eptyuAM9*x&gf-jw&-qDG?!Z&ZlOsO;N3A^@LuN*h zk&!Ei+1?qzYH!YtgH-g7hUwoNi(593h56;k*wEql;I)X;HI~aAh8; zUcJ;q*|{z)|7cV5WhKnD9l9Pm%43l2&WmDBK*=$WN_Ksr7-QS6Cqeil;3>p#$0aY1 z^?tz&2X>FzJd3lN#4q%0)JIPUgcd` zq5fMAQ7t&s>2roVWF#oco(tl$kx^iy>hoX*>G72oC`AS8=zWy4ja&=L`VZ{2X_8KI z=FFM()DYHClG#&N$5VP=Io&g2aWb|$BKy_YFE;YMhIEMT&`4!fnC1OkXz$jG>mK$K zto)BBbaw{Xv8|A(;036eIEqMU-?`>6v0vQQhrg5VOP76s)8~~3+b&6+D!Xyv%>xE_ zg`e_0@*eSL)(EC1$x{{bMP=*Y`y1^~pA!O>OQ}_*#Bs;TW-*uJ`1aDu4kIwqkm^Go zt3OtCGP@E}5x@o)vk6lHnxy6mXPlz*reT^0WC7W(Ps7A&R& zLEzD@6_-(@H-GIhPcbfFS`#uRjsICsJ$eHc1Z=Hk>PX^);i)j?nT@=%O;SG3E@+z? z|Au(!98HvzPn-d!sPdc>|Jf0=tmFcTN2EoWe_7#G?*1Bsx$6-`+Xb;{^3j?~bqdTt zALI0Ffyviu6g$kfRWpL_^<)Ik^H5oJ1vZNBk_fn8MNZ3{g6HPo1nk5%Jaf>>c8sUROhIP=p;ei3s!I2Ij@_e6Y?+EP6JfT&(SE&^3pYKTvX5*|@y}=|{Q2ui;zy zj+{*2R>v~+ID`IX3o2b>_?ne*5K@W?ZF*|TEf?nTxCQ`WA%1no7f95ga8q3krU8!x z9T+SPl!&zoj-%ieGdu&!H0df(xr3@qFI68>o1+D_fUh%kWZpSt>(gCK1+kCm*t+kS zDl^eKZ$pR35gkm%7_??+NaI~+!M z$a98f@NvA(jF5Uk)x#~%+d)RyUg6jr+z_7b52=E#jmtr#c3kCU!?ld~w;i;iH_>Ck ziW!2?uZ=UZqR1&1PnhjK!RA<6-sa$P-t&cQLBt&wr}vDjpB&VuU2RjJyzeoHE8`s; zKiI==Zl?`LQ-9)Vrx*6OzG-_UfzTDg+sI50T84qcksjlpX>)F=jbfwQF1n3_8qbvP zi%L>($5uk+ngi5-7OXlAF|NpID%GYHs%*l>pS7#zY@$K0%N_Y>nV8Vxok2-OrbwIR z%0lLp!7%=*OnLfH4@ukqg>=m~7E$#bv7k0gH1kZWtsErhffdTsU>xsG67UqPF;`VQ ziHH+$lt`C&UyuSRD~xZ*D>*t3ecOQjg>W97wX&l?U6A*&o(+o?s>qZ&g> zJS$R~shA-3qIY#7n zlA0P&zSm<*DVredOQP0NbJM(NaJzwn%VvbFudc&-K|T&b%iEspFrG3GAwTD}s6wgfa^42= z5>Os4JP&4@q&;h;E?t{AdBFIrnCcKBWM|>pW%)0+^frmrYa~>wL2*Er!{>p|GX^-m zod+>A9A7@~EBGRO;pVt+qB}2AUpa(|M>#jYW&NwV(ZC-P<)YYj%0Y-aTG%9xRJ@6~ z)#vOCbb-&{+P<8qn)mCJ>bUkPU(zr7)UQV?8X+SCg0Y>u?rDiDf~ya5z78$wfI;1E zb}=sZJ3nB6AP~l8?3#KpT{R@q8xXcSwFu+#N)pzLw@AK=i;NN=P~Df+yK6UdM$dI- zKHItQ=vP|D9h)1$bNv@?dq-aD+l0S=I)BWlS638B^gmzpW5B?S*L~KmJYCIAoZaY2 zju1+J5j=v@egZ&-Qr^sxL_-Fo{~{9ajlW_CvTcbl-GzhB;;+q)XOXsoafo6?hI{l0 z;=7>xtGYnCtJ@vL^fn;IX(~#tDThQFm1zjQYMD(@1RvjNFq=8;+@4&LoY)Lar+LLG z>>9c81BV?loh%s-viI9@>Alq7f95rLW`gB-VOF{Bj2=FF2n6Ko@#^~KGopPPBLiH^ z9l)f&FBHCh9wq3?K*qUhqJq%qC{8nE-G5{ zQH+>X!J}s9;+C>aqYr&MBWj%rjlm{|2*rSX%??9nf-s!_OwSa_YB8@0AoAS6J&ARgb2-W)upPC7?G3kpvtjpz8%IN1Rv-}>1koolO z;(8+1!NlBE1UxI0?53zmvP)%7q6Pf({opM5dm+Jo?5ctvJ`E5RlP|bweI;()T>%s}IlA z^tn+|pESn#adi4W+1HCWKG{%}#o%G!r`LpJ}ufec_;3OInL71 z$%!3J;7EfX@Y>%oW%OUJKOY|!mscTgxz|j2Z6B65booIKT27y`>j%q&W=`48JXHz! zymP@bW`Lh?F=SK)4*|8Pv(?CUyuRK}%8Kqhj|$jfNKuMW#c71@a{F`xH`C~1;QL;MWP~gL=q#&4D^LT$#1Ls@VBo?$SipbDe zo0>SsRB0O7AttaULaa;uM16VckO|UabewnkPus-~-WAz%m1^?Uc(ACyT~Jsi{=!;a zaZ7EZrz3N_=b!cZ5GRgx$oxyYG*;CvbHciJ!*3uZzdbK057hK6CRC^AKr$xo{y#1@6mL zsfQM3VyAZ&ZNckO-4w#K^D`@GKK}Lhw2u0lkewPGREWzhc_W!z`rz+t7Zbb(N3i2L z;&dC&dhPmm%BDnEqX}joyR&3yuwM3ZVNnq)r2@O}JqWBn?n@o(jYj^D?^L;1w>%2} z18l=%EMbnoSPvYxPHN14=z!8s1zCjgLrQ!TOQ*IVR;l9GU^!d2v~P3S?tvq7cJOiN z2rr-Bo8h95&Kx>Em)bEoyV@`(Zi3P&RAPjKdeK{<^>XS0X#ng!=_PbJ1xC>{DK9jf zxZxtRQKB452pn+sr2BJof(6HMlfetLCN+z~ZY6@cIJGlosL3&5JXC3G4?kmQTzf`c z`na`{(FQhdOs0o|PcR-8=q}i_Nt>}m+aAbdM32S5*fW&8DTo2Ja&B+i_1?|#P&h7B z^`5AzcOj~V64agS`Wm$Pzy_fFG$Ljsk)=w-mA-8No|V1{axiBI)p@8$pwm|> z$b*?ND@hRnd$5k6-})0Ee`Y6K@M6ziK{M9ihqpfU$VOT@kQ|u9!X**dg_c9|qOP%* z^uTvc;lV1!Girl;!dTQNrx4t|6yTwrrBd7U%5y?HgT_<&8RAoax&XGMs6OXUIT_O2 zMkA%n16a;(-Y;qyE8%ZL`$dbpj3T|CeSU_XVO^Kk3#~H zj{K!9yzle?;Ywv;6`~(IfU1wE$X(%YzT_-5GDLk3^()d%86X{2ibOIOQhybEnhNAc zY!X7=W9BvHe=iJKfH{%{yu}n&v8BT^42H}~cS+i0X28(R4$BtuLjZiiH1yji%VD}h zu@HJvqfJmp(!H4ShM86>{YInqh>ncdQvPKw`RNp2tj*PFysxNnb9*iJ6b9f!yi>_R z&BK(6h2C-_6D%&I0ip}4pQ@<|`BO_|5vk&sMeF$J+&b{ELmZ;kDVKKxfqta|2th=| z!tngC!wp9JxbZuZbn$(eS=V%Pdk1S2Ji|Hj#L+2X>f;O-@V*N;x4%Fu;ccz)KW%~g z7}R6n&da$x;n4 za9}|(XCd+Bz&$;Eq`*9efUCaBMq{55z zlbAnN-%V9@K)xZS(;<5fwO4#26G0|1+-1G+ysywgdCuzP8 z#U4m{v|4+Sua_n$qxGQ5M?bxoVsIZ%D?kBvER!8g5lnMzTKnl3OQygRfz*iQXR@rA z&!wDWA^3u?^}uI%ei<{FHjmsVH?o+{L2R)$SJ<&47Z$(3K^1X8$davo2*Vc&!idt? zYC(z@HceGjt^`)oYhXZ5fRPU10Hr{9VXH!r1=0}r2Ua7{y;)kbkFT9nLSSq!E)2`Z zGlT^EpqlpRn0qqT6udSB{Jbs=(sY7)L4*piYlLyF4nA=k)}QZ02{VHiAv-j zaIoGSRMXjWjN{S8C+2dZtxyt99?XgY{S@*=Y~o#y#Ks`r)|}(Vg$sw}`#xXKIrD^f z;Y+z~Gqf^LIypQRZQ$mKst){sBn@DqDw#02D3Mgpi;?*}aAodL$f9L&YP>cFQ$;)M z)SQ;euctN6+s7xWQJRdU@Iuyo9~Jc~`TtNgKkkLPdmr&k_r^UC-N z(r}W3JOWX^cW$#%v6me4DK&*4B>kCG!h3Iz=yG;+m%CiRgC9j%=T zNil|C1Y;QYxQ}1}tZ>xzt8KwEPDC0n;1XX z9}5Z6XsDi+Est+Bqt0yUDCR`F6bcSS8yjG8uD>&pW}Ljt(-VfKBAP76bB}5Jd*1R* z|Ed9wHMk5}5g4mYo~zs+X{D4_{RKP1mRmGKTIUi-W>Tf z@H<|vc`*GyeP8Zq03_;q@vc%5vw(}yEiC@rgL?x5ieM$SS9xBASF3xvgRVYLHL#%w zMv^4|(Ju^Jl+-XGbd4cfu7{tZMZR!;(FaZaWvFHDP0-MJv#B@=|wje8Q~B&-b!5Zw0a8n!IEEt!SVa%4YP#u zCw%Fo;*Mj-v32a!`BWfr+aES}!&|y{fdYj5CpOHRBa9OF4R8@1=T6v@qiR0FZP$PfuQ!fv{n6ig(yPX#xdCr2v>3xWCbG_WfXEepcX z3|st0kHtZ>#F9pzLc}xuZhKpG*(wt6eSR>nxlOfKOflC{0Rs$Uyj zXtHrd^zOP7>Ll^RwN3vNXguWJlG!d&h6$2K-1L}i|38Y(#hvN?|KrX%C7U@;#SU!FlN?hH+pr-U z=3F_39G64sghtyCW^-0Eh6&|->gd!QIyk1GA__&fqVBq@?{B}qVAu7z_SxR=*X#Lw zJkZy?Sm^liq|Wl{>2@oAiBvmL7dH*@YBWu$;p^k!oZEQT+Amg^(*2(4{zxbO^JV>9A^F3q4D`_h$@Z zVzlD*&=MJ#Bt)BbCsgaW?L}pftl?Q@muxgJXupJ`_7dhc!_cP4 z&a$b(wV^wGUL5r7edvEO0Lr(5wAIXmV`x6{<(t zJLV2Q!o+E*o4(@mTyq{lO8h;$|#MNKP` zE|=TWv2a^tKHTN@NtYR7GjA=u#hDzMIa>x#aMUsj?&FyAUKf<{y=4R4ko)SK#nub8 zIF4d&k-OadADB9)1bS4WN#~Kmg2#o2w;S(OB9(iD19;3kIH-B-2y9lZwjNw9{X-AG zv5B*fX@Mh~VJoH4`G*z}k(*(14c1n=Qr3Iko?|CY z4=E#eI_>Gn*Tjw=J$JRXb&Jkk%9Q#$>#J*-Ml1-Z8oi~SM^7~DFV-4d8b(wN!?BM; zP4pQfWFu#lhzps)YnO>E;jZd`A^_%$#bF-&&$OcS8;O!VNJcDn18$_t&=Ds?!XUU# zk#Zzd(gEkO(isu6HGHJ_UA@6sxQhfQgM5goJekGAgO%ie3aVrZ0wQq5{_tqxkx$sL zYLObC4I`)h5x`4P-Hy>SeQM3W-5)cmqV`s}W-1`ika0Oqpe`1>*t}8Rd{RR~_H(o2 z_2=l4XTn`st&G|!xKgLPRD;9k?9~GylG-P@;(Iz;-8Re-@sU*(fWZoD^bE2>OkdPp z(twqIvTfDMifp%bh1ctw8LG(QQ4R=l?1a7b4E#1;Y_UYy#SQqout#FV6DE8v!4SLr zWPWhX@tLW0Ibu%Gq}_<^crsQS8TSMkj&eOB>T0oC@5zqqL&StfAk@%pbcz39MH-RF zI2qh(H$V^67s7exWQ9D6e=o?_vqZiHco`^%$^jfIU1ZX=Z%321A+2WrGKk8}9U5mT zN+}va^SO!^5jP{A4b^JHu6fpasyGlj9Uhm8EEb<$@+cSE*kbq!&%BFfiDs6G6Q--Q zYhkndCD8V-@!Gz%%Q3p!c7hLN&>Z%S{?5LQgAIT#J29qXC-J44(7>Wpc9IdijPPjL}?bf zwjHk>$aOBz9pW@01`~?>)Ssvc<70{XGuo!m?t?Ot(7c&d_POxW#%@PR+w*SR5xVJ0J*!R)r_%>c5xxIqyF=(3H z7A1^!Exc9m#70o+`VHqq8$eR|-y|=np`{agB}{uVfF_z@8J`KZk_T4H25E4J<-$`& z@RwotEar}@`8y<4L~0fVfl!n@f(3FROsv|$2BcWMrt(m94d(>}uf3<|FIF;DqY`kS z!DpF#x)!S!zSs(V;3_mMMUEZwOnc?KWm%EJI7|Nw$uS+41R8Nm2WTL|#rd2>&_&1R zYg*bJF`ejI1wAYgZj&d*Y?JpmQjBsn-O~XUjG#z5L{dF!k$}{Y8nFLtHod>~p?>hu z{tTnzH@6}E7?TasY8gtj@NlP@4NTuIW9TdpM=DHIwhrSskk$M<2s9jg4@sl>3$2Y4 z&B~5~3*L3qfDGU-Xo%6|GWqA-tW?bMb>F*p2(#Ay0k<59@NYjuWA>)3Uyc4gbNCON zXwcdjT5|vvo=;qQAMxlv$D|NguUXs-+WV<@Z1rMIbbMR}aM!h;0O&)Vx`x*cfya(_ zyuRKl)PNebaMiAJ`+Rw`o-`cLANg4JHrKW5<|ND|I&B;gs~gKchJDq*Z*9 zMy{z)JG^)X^F*H(Gh)s!L}#y6y1hC@eHs^7c^MfVCk)?*cAu7L~- z6Y(An)2Qg}waU|C&t7ZYw4e&Q(Qm|cR{auvmw^z2;-?2KV)HodBU8s+s_{wLB2lNf z2XApvSEhO#1r6?xx=n%LVsvzJ$=Y{L2QjP1#qH_Xr!c%Xcz5Ns(j#17!>~#Gx#&qZ z_m^M_LEACeeFQBXzay7g;-degx=p9D!bdM|#tRe+@JC`A9&h8`NpzJn-lMMD%~-$O z0UVyGTl1{-kaO-Y&R%W@9yJfmm4f89G~@jVf|P*DkWyOxna-^@L9OhBK>NP67YFUTA zU;2*MIYZoIa2mQ8iB9|q{B1xE9M1Zm zh(Q>Mt49N<;7*t*iwg;b>E`@$Z4fxSA!R7dC;BEpEpL4M<)e;w+Zl>??eV83|4P(a z!GnvY?-{x*Lwky1HF4|;9oZcV+`U7uR4_&#N1)^u7J@l;=r z0(u*N!&gkrf7xId{i&q$;B$2EQP;R)Abr=-zHiZpF}4OmX?lm8I$mAJ8y=6_V64m? zcQ5&KXYw4gUEk%RfPSUAFkm|<`eS4$1O>*fKI>1?B|l%LF;~&$l@m1G+WwiAen51h z@`jnc0<2C~W6N#3t?GO11#e;glCh@`!^F>iKS8c^h-kDP=>(*roQ>jG|ye z-idelHs%#Fh`PL#Uk)Kd*l zAGM%E^pd?eU+OzUE3W(1O_u>ydLQ*>!aj2zIL=hJD+#~T`=9-jI8q%C+BjnUvFB-t zi47+4Q~B5L)L6K%osaYr$f0{$+}SgSlveJ{Z+&<@^=>%;qzoF_$;a(FgeSxvi2m3! z*w!&V#qD|bikSbGl_lK%eeKz8**hNqtU&k1S-X!mEOzOtJ=Y3B14_shc}D@lak`;{ zjkr~SriYugs{jD}gKsIc96?WZt1%{pY~0sa;Jp7U1N zWqf-7+3&^efA243*~H<@-!W@TvHJ60GZ_)WoE_kYUZS0)?%;-3?3+S*U|P}sn#86j zF5`-$NXfZ6pzsr&YfIJ6s_PWnx`h5In5QmkGPCtV4GOG$8|<}>n6;8mz}Xa>J>4S0 zb~HkBcHbdZqTrvCbRD6nyucCoEW)bPJ+;oL&9lV5ala5G+S>%+_Y-EMA;_TkXyO5$ zh|^2vO_Fx64j@v>&v0fv8U5BB8;qdU3HF`;AchNdvD2& zSLYUF1SD{Qy%9}*MhFD^Mma$g03D939e}99A${Wn)|4F+2Sjg#|I|BK1`ISBHF-R? zO1PrKbcQDemgYCfA}BdBvJL<%T0vNWmVwY)o1>tIttn&6kkN z9DG(A2=5s_Cw?<@<-kR%izT^F6sdXq$M$63fQv33526A)s=)=Wd3WqE5>Yt@u;PPV zO|x~T$MT53VZ}$hN+}_oGPJ?}i4d($nc9{03riKf>=+tSZ8xwq^#4^N_q;Q3p#_0A zWKjh=P;^clx^&5vBY`0QekKvfDaIhNc;Dc4`YB{(zi@_51Yh!S8+S3FTw=+Ay6Ivm zBLG)RF1iOOYa!2SdB@QfH0ju?BK#=tvv}G6dAvcHxWatomC^5V(uoL0$Ps<#RiRM) z@!8R%k{wocipQq?ec@!BL!o*^20}K@JS-8ENipett%Ws za?Dq|td-oL;9jkVOnI5MR*!u`b>7TS=pqjVFIS=`_JY~y2GWo`h*~f>ReI&r4F0RV zU4k7j;G%5E{W!dSLZ^t6Jn@5xtKi&~2l{7QQSG@!@;46bxP|p<#c%p%T=+#$gPP_R zIDup_HYbQCFfKs9)$K1r0VYlk7(H^inxQS9A+mNo3dEq@T6(QxP}o19w?JFe1H-&8;y=%?M4x6g*rNPoR^-Oebr>a959^b9gm-0*D{cu1m zsV2d-4TtTK%IxA#O&GD%nrTDU1g`A1~;h96xYVn=fH9_;qL{Dhm%@kbnZLna#?i3 zc6>@kjsx2Vf4}>!qJ*&r;sVqmVCm<9#0P2V8D%)pxR?k4HxElSo){zc=% zHnUH`LK}-O#J`oy7<8XJK-|1gcK7eg1d)f_o4H#Vlw!`?QCwOYFOEX>Au|uZ1|&_r zEd4wo;@n4C$E{=abrQJTzLIlmLmE~Aqx;j%R-q6=L}gpZiobd#eSvwdQzM(Tb8t#D zpC`Ewmx?U34lxgD;*a)LQZMkz=0IJU(3xhn_O-*Co|SyGNa$!JI6>XN4yx?uUa6N; zDx}pw_7uM=GpkJWm-@MpF^|b7qMsQe?<*?wJ-3z{8BO#dIU#7NoYwV6VV zV%5w^^M|ZT->d9U;59!4G^5NJ?Lzv2JnPV8z~xt2L*UMAJ3(3xV=vymaxd(M>RN>^k^ zSHH7T@_4EoZ7$}CdP+}OijJvTK&A^x9_yz#%7%D=Cr|1n0 zitPZDTZhkTG3}m15FKx%sE-7CCyabRA$rdNBU%WE z@L7?RkBFcS^8qmC;3u0u_E2nrqq571>sagh0W4dOT&j=Og8uS~Zq1E_O;ivH4=#@6zeWqxYb>taiEOE{akIG8E&E}bauMGd7pB2<4maW^s*T%#P%39MdkynC{+^9& zxnk1}P|B+rPU6{pv$z7e<9V>&S659jFbJRTJM9#;Dm;RoHh~&*&o6T7qm~ublSae7 zH*Adl^s#Tvt3~LYe@&x=Gq$bpQJN$R4bvEO;%cMKx#3St`J*TMW`&!;qCkgYmwLQDd zHel37(542_-1&P=95HaaAun`>lABenP5=122SjNJXv~jh-#~oD@jE_EnE?EhaxNY` zhc#TWPP^pDSn0L*g4^;A@U9TsGAj|zY}<1sPI#Pa{y!^d66?<0Hp2tA@{mV0v+=$4 z{c4X@ISv1Ob1z{IeE9n*nPZHg>mOeu?!Hl<@sApP81k^JdT#pR(slB`&Bjb0|A%?Y zOCJ8=#ociR59D4%ey>Vh>Gu7VT>%7CbQ@!^v2xctK4)F{qrPC44&zpheSP|z^>iq>tycD3j z;Zu6Ab26pw6^0~sdTM^3@W1%Nf-&p+cRIFI6|SmL@y2_}xsfZ5G`Lw7b@n`wh1O+^ z>|N$lG}M~&CKZFC5*QT%6rX<1vw-B!Z3ycY9*frIJTpdHDqT{uY4rj3-va^}p-}@$ za`;}|wtFAi23<{0MXB1w)dr z>kF?;H>1uMzhpWwM!afrTb-+HPX&#MZTIRYwUl9(l?8gKsnVhibRxGQY9J|A?W>Pc z?$d)~sY6ZROGT!$!Z^Xv8Eq)5JBdpcB&It*8a~zf;%9dDy;Of@uTl0VJM?s5PfOfJ z9_AhD&`hUt9=I6eIx(>MC2Gz6Q&vCulWA;FXXFoK8*ZNj2>|j*OJXmCZ4~Qy|2J|2 z>1*@r0yoFaWr1|YvtIR?@$GI8#Z%QkYj5e@@Mr`!(I%#f#42lBG%`@Sw8_p3NV0Dz`1ww(=NtliwOx=_*?lh;$IXBrdlzM)F=sWKc8 zsuWm(_!s|D<&%Eh2v?*34SIFkB3ZZU2)|_a$B-eW@x*}{B|of%@mkuaTjVSF*(WYWQR(JAGuTSLF520uniN!&57rFS}~Ktre+8 z-X!JDgeKY(C2aX>iO&#gv7>Ev83&X_v#+2V;FF2S{7tVLb^`j%TzlAL*Y1PH;-W-M zokdy^?lZ8<9wE;%_&pn~%XZqp|M|l&nabT6#+yykWUvm*D#Ul*M0!`BHw5d`G^`4E zW`T?2vs-uT>g7+x(&5KUaZaMpRo*dAdDk-)Vr~&gJismFI;i%FbIh-oSTPHKSZg@6 zZOpZj{xXFMC##Yq({vHZsu9MY=UI zPJ?UW99-(P{pd&u+z?m%UKVlc&}!@NIX1_}PbY6mo}f@IWb2Bf(O&!!AK{RD>;4Ke za~_Ke;Hm|Q+g*bx2F#Qg5xfQuB+^6VxKVIG22||6heEhPp_uvP-|mnM%h3o!)Yoi9 z`>VBqp;qw2z0nDSpYWEcIzI%(Dy)Xb4sbO=xzL|T+J2^Ac=XIeXRTxI&M^-fZ{i@) zXRCo-(>PD&hqA%SIDF>g{qL{vDmw6t((gJ;y}nSh)*o6Aq=6Djg`*~KH}SKguJAa# zi3gq%(xe?DG@_N_C2P91iHIYBo>?v8Z{LRJFqoq;xf(RiC0Tevk%7$XT#pjX3rt^wD7%2OZq0{=Sxw11;rXW9IXJf^7EWB8T(rg!? zE?}Nu)U)(w_$zvYf#DMK2Pzn(=bwtKuCUV+&~y*CUrauqBSYQpDGo_U+<@KFay4}S zXY?x1ENdjHhyAh3L`J^F-dgC&r5n&qviJ{uwbHaxiPAl*cf@jd*?X4H2ou4%MdARF zcQR*m8KmJ!qgi*nZmsTtsS4Dvq7niUVMTw;(fuA)S}o*R-FA0zId*68yrTkiZTqqHA#!IL!b{?4w7qzz=_PDF=zNRt&ty*#}cmr40(T!C!lg|^v zXFq!!NwJv8g_X!FOQAEIdOfht2^V>b)jc6T z%(>6JE+b!3G{7qF$(HMpbB)gN#;qPy55#w%1$KD@=TjWjYp){VbeuUT4&qqAjUU7$ z?Gq6P$!9OymEmSMP<@sz{&KT0BiB#&8+*;wlHUg}Qj5+~KMUNzhu-Hf-GoNyvcaxN z&n4D9uP-=9qBOLXGqPSmPpAk4gxBOGZ~eH=oh(9d1u11W0=DVa0meK zaIJY7G{)GP|6kz>(}u3^((ge>C+29IDvqUAcM8?ZQG@Qq;U zo1t_wD*pG&X-75-=CtMf2us9jTq`#ga=Bd4{RJNJB(3d!E*ksU$ZJ?!c#TGX8%3Uu zKsEuWTDC6Lhf3>uDki*sIviTvpDok2r-c?W&bSmpUo8iI!h0=}n}(4gjd7Zpz9Z?+S065TL{AS{^p&)50k74s=s$hQ)I8Oe zwWBicPNsS`zL$$rQ+KaT6qJ`)mr@)Pk zZ-9{!SM)cSDHUf?0La)?vy}@{7qZ=MYV2-sSwnE##uV6h7e)E zufS*}(T{n`)tOqd#s&=KOe<^XBij918Mq)^%qJh0qNVqTR$s`V%hfNDE=pRyrMD*w z=~5ke2GT3Mi_R8gk_vKcly`q!?vk5YNuuEs^Qa(QQ+g|52J2pR-juWi`Xs9;DxbmycblxbexOM9gV>P7HmE5eT3j%m;LM~_)9V6O5ai& zt+)$SlPjgoR*rM7-E-nIc0)_+ec$N${ zTu2Skd#i)>S*gM9$G&H59Km5dDzogBvb4J7B_0X7O%=+_(KF$UktJJ4VBWa5&D~$r z9v;csEz90ns8CZaSDbhn-y0Xf&M58c?RrE2Lh^AZaZR|H&z>FTfwnHuBIaZN`FKzy zTMt$Pw0%!Sv+nxvNQ22wf0FhO*uFLKJmw}cq|wjwTPakTK^I%xHmAo`-r(Zu!>isM zL3Ebj&LX3s5N&3nSM2=FbyO6*u_@_>^nZm#3+3()XNUI?EKlwq$ezBf$)g=>1}iKv zGIXlV1{d2Awm4w{8Y8FY7yB7ze(@b*-2VhF1m|=n{WZ8*`qw*Cb4^*b9B{BMD_Pn< zsyFcXZ0=1o8cJ>yX!xf<3z@94gZ0{soNFdu%C~Bs(mO3LmW1@3(`B#OiCS72gnL=W z3Y$ERpVb5qTYZ~YnO{uTXhNxI;Ou=*nfOAPTyz@i(18+wdZ0_dK~CRV-fUJ~>7l#0 z+M)l6$P)dAYkH?`oao&XN0Y+ff-Y!)ZMWx7cNtCRlC)cF|CpPm#yh9H`|8n@dYaL! zO|=KfMra4$kf6#NHJ8_#;s|=~DZq+CPQ_(EicF!d9`oVUUrVlP z!9}2+y&&htS_TMVbmQQwEY?77s@E(Kr)ARxuH*C>977&)b=bmF)3r< z5b@Ljx0LGY=Wq01MJ2nLnOcPZU3)Ir*fNf->DM6NLt`RqW`xKtcLId|ZsTbBdXHm1 zd40dGOA$NTai$IkGm za#oR6V@LBL{nTgHniy!?gqh*-AueGn2rDp+xv6T<@#WrzD-~U0*O-@$mMFgDXsBRy z@EqDvbWe7~P+h)?SrRoE`7^L}M%>P(7R}R;V#h|kHArKgtEx|Oip)CO@GbBw{nT3V zaX*>xsl29;+>zzg_DxVnvtpl=DJi1ZwWx*ZW8N?UkFZ5NEV^_Ctb3OJfpx|P@qUIU zeEdes1w$o=KHN|fvW?X@zshLt;Es|Cokx7?G|05Luek4@+yt85q@xcDKF$J)D0ZZ# zyJ+kaV1QoIqAl_x`)vHB&$=0Do!A{OX!Zu0cJM=Z_*yj@S$o*;!O7bHOE)v04D=HjXTbdXO2g%qK9dOPhb~&5*0XFfX&-JdZ+5bVDxKMvccZxNB z!9Ty+uv(seijqWu!{o7}b&81L=pnWT zW>v^EDeK^F+gl2mSh$d4@dUcA7`R9=6)0K2cAuicOX((>b7$gAq3TKOtGm-*ca%{_ z+1e7dTcec{_eArF^IMit&&P$>nmq=4sHgdP#}N8#2s>}u-q#o7;jobXhWq@i>)8Zh z3`R1%30P4Q8ae8OU8C#hT3b5un!AB6vpW})iwi?cd zb%UzfMiHH2UfR<0#itoBYe`S82F*PRjvW$q;6W|jjGE{x?{ZA7TqLs=5=k);?OiE% zWYpfV{cX=MGdz$HMj|rajN#8{GZ4S2W4fq>J0u1+(JvVG4|Eco%t6bNiq^eiWAMA zhdQt7&A11~VivEiw*B3xj|a)A6#}3Nkx;kJCjqfBv&K?*EK_)F&}%Z3u+Q)2`wl zT>Y=MSe%iK@Ckyz+A;zWx79BZP@nAF!`1YzX?q^(aP1M`<}^)_OEue+6L3oSFWev7`H^}Lb8HTWNC4jNT9^X zdGV|0?7Xfkdaf#0BhfC>LwGO-@rMu5Y}-O-`(k{dF~h*$G~kvtXz&oXRPHgyk~>iZ z${vI@mnv8R&s6);9Kk|>x<`;KCi}m-8^#dN`1?gN;etD0Zh>+-Q;5tec*lC|KhQlF zMU~h`Cy1l&6?Rw)#_pO$4i^-pg0po@WTO^$}ta<@2hnfz!S00!~*{e^o@)!XTJb4LSQ1-;P#mnRWcR%WGOJJSHgS=CQn`| z*KD!7D`6l+Qqkq+O5?E`^&oARf{!gfk;vG{H(^h7o1C7|%U~eJEK|{a1lw zDlUq7$pzfd1+%J~XtD>;rN>B+TmnuP=;}aN$rND?lC@frMRi`7$@nw5`h*bk`Fh25 zdl|_^&j9_{J&5cn%Kl1EyD@JjiOjbKK3OlvmSvb(mvj%FU_sWvKE-dXKlwd2&@3$01<24vUj0B~vQ*r=KYST*E*Ll4K=?OOIMh@}{zBW0Lg!DcG?~j^kZ=5TLq7+4^C# zPt8<`HnfKMyA(S3Yh`J!$4(h@Vnr{BI%gqtzXv#&2L7nZki#fXU68UgFfvmZv(j%W z0?7YAVgDMVCh3x+Nly+Vm+esqNNSev!zhY+-@Mx1Gl^3eKiJb!GJ$Tgp`EQyO}YzE z4vq|J$hgXS{!)k^dLBqE@vodW0%))F7+J^ezYcUeN$}c`hrwq!)`8duN)=8}@m_3I zU3r2#`8*@%gxR#keU-s9E!q~xnu^C7oW_Kbit6jBHdkOb z&s*31+u<-tVf1{iJ%b{AO+R0FAUbCj4gJ?I*^rZ1b1mcPrYA)4ymV8XjdnT(&lu79 zq8>1sl+=9iV^vas8i+eoOk6Vkh7KLm*N-nbY*Jip6JNq5$Lzl3(=1Jur~ZP<+GfYU zQnQ4U8t1~1wK?naw+5Nq-o8YmQr?4;-Uzc-y)og9JQ-hHmUm~|48Awu=x`3_;|>ts zfTlz^K;agRv;|N3ua1bFea2+TOo|C_khMOye>QUd zHeq7w3v$Pn1B>#?S?5IE2^|mcW1IQHtHw^;VxUX%t;SF?JpR9uj2#~;a&)DpzRMQQ z*l?ab_Lm(No<2$r?81h1D79495_`iN)Kv*dEzfmg-=rEcgCDM%27dR4LP|?I)9xPF z2=@4Ap6F7U=NHt>hBed)YKovK6lN`dy(wy*E) zUh)qz@r>v1h_qPjv1oo>`5m?)V{`;Q^DxgV zR#N||Cg$=;^~*QsXZof)Ua#{$$yX?r(swo7E~4$mg2o@WdnbQ-;MizK(eO4a!!KBd ztmm)^{$P}<#I^kw{~W)c0|hECYSh*0e0KIh=AQ1bp6UO-WfLF0>(#&8L{**&v^_4| zK}ksXM6)Il{MufDs#44M3g2~0h(pkwmmZq|gfqOKVZ9w&sJ5ja(k;W%>K3~GflJWt zi{*6beBz?r6LYk}aN@?hkcECCW40lX|5~|l8l@8DAI%B)dI+D4(f`jh>UDrki9+SU zH&Di=>6V@1szawx4J4fU!En!&NsCp?o;wyM2u&CNp7N;v!3T*aJ9;}YotOE=K6(o8 zZqMK`-gd_=hl3MeUOwX|+mIW@3u+M4jTK@I%j4X0Ys)JoIXztXSq*XW)7aHMbTlFE zfp8Ns0^uxo-Vd;ko;MQ*X7DjaFa04xXb+Dc-WZ)HxN!Y6@#6#T)U8FwiB0A8TkMMK zYnNR7`ph$)6hO@ng>`hN8jEUgdmV(={AG>5QZ__(kDz<+qB=YdbJbO7iBAV-0w`hP zH(~8Jiw94F{6#g)DCEVL3-v$u)w*g3fn3N zleT-4z>&6uO}{N&3SQYW=xn>U^mZFwKT~8`#^niXywPx})wL79Ntg49hBXj%fBlbf>Q23v4p6-v2~Ee`4wvY=T=;kK z!D1roqHddzFXR>L+Lm4iIMEIdsjMyM(+NE-5`zdqj%0!Wd84)!C*-V#Gjt_0kisPY z2y_&A%1?)xfK{V}YfIDjL4cqE&u0<`EnFh>tdaYQ^{!7w89&$KsJvJ1iUeB)P30UA zQb>cNYy0i(tmNZB+;z8#BEaEjDZk3v4ChOp%Fmvl)Fq2>c1}tw?Vefj2<>s4y1o)N z^tb~DO}szt8!=Qkl#L9~Hj>~Szvt$MZk4nUuZO!}*M1u9WoU)}%WEnj2g{Jhc}O>o z)@rvM)D+1*pOol&gqeprJ?7Ba2S>aqSNMhp$m3?(p`$L>#b}xE6f^>X=b>CCHv*c` z>0f*L3*~Xq!>Cr*D5O+B144l4m&coIvL*e63^CBE;O)<1FB9a&Yf+ z7y2=kYT%Mh_UeGPezr3WJMBmYZrgE9@jymL9PUJ#lr}}kg5~$YNA)iT=1ofDR2ULl z4~04o^;F2a4e#um!i1T~6L8x{(8KknTTEFic>7}Uj!{ePoX9*6qn#gpF8p%gk$mF5 zZFnhTfn3?*YKJo79+QbqdQ*U5j390yaZio0hVu>clxp$~c*+O1FZS4~OLHzBW`Wve zSOLb?N;~**rEtwO@3viD!GgN}5XgDWa@6qkSG&PxiW_$r4-v zd)gTn(AsI3mDfPs`$JWssU7%Pr)b8V!WBJbG|5_>$`}cFII}b)8*U^=ipo&1NY?JT zMC@`(zD*_lX4< zRq1(WaN%hfXQr*wEJp-AQ_b4pWy6`aC3xBv%$GY@TDv@KoVOh z3E>^dCzmp@p9*wEA1DSRa1j|BVy+H4wmj^M=n*GVl1%l=Qq zQ*{Ob*-);gP--QZ<$W{q1H%rf6ff~;@xG{VGI-mP$Alkp7NQSE_w(922#7RdvAI?x zM(OudE;Zf_5t0%AyMR{mN8CZuu$p|L4wv#3TtHG@DQ!~@t}z=H1v6gkLBzsgBD;+# z_K3Gxyvl;SGTl!k;wL=fG-y~Ta3}k~j?L(Ts5VJn{0o74dGj~q6?V_W^j{eZPvr^Q zfJ6w{uJwi$0P^zCs?5ns1~Z*v-9}ne$C=k5sv4+hHZ!E%6?HVmjxiufK6mlTy3uTt z!HP5G?yxZbknMs;y1!wSw_DnGM>gbLH+3uXMPzk1+Xu&~0!wLW-v8Djl7}Vua>dAY zO~%h&ovb#xXe;J+IYF)$vZDV)#0i26>V|9eA@Vp!)EKf5VZqYW9s65@#fx3LL=I#bckbi?l9xTh)@fEpHm zX^LIRdwUI6zaqdL@Aux<9CuGqEI1#`;D=syq4bG4)SVTZhcD8`ncmVv^iN*zATI0} zC~GLEw+_&4Hl!j%Z*jiF@+*hPu1B=h!)MChVVKz#@EgIhvN{gAbTv-W9QJpC6Kb`N zAcS@ot~9+Q0cs^G++_vE$i3PMs+o(=yWTGeV-2Noi$bH$yXWf^r5{qu*@f zE&bdPNcvC{Dhg}*tCcRQqZ@`ghHab0PPHfJv$Rr{4KNpj_Fqq` z$OsTTV7GQ+-^I%JmC$#J@-b6RN%i&sZ z*TAJvzR&U2pM}!l@Tmrs+z>}1Tv-?#| zIr?yn>IVta@lMx9(N|Ks^eVe2{ieP{`148WS-=geeIYhJ5uEoYv)5YpfTT@$q&mD| zDTi_y4}{%X@cnM!jQtqKdWx0;LQ0fx-Aq;h;bwc^1y{cS2JU#yyl1T0Z7WK%?z@~! zo>EI6L3i7J-R?C(rWL1Z^jtUMc2brOvm&J%bzpd-b-`pf>_z-GKtm|b=+Qb%>^PgY z%S@DtlQds~G^D$Pb1iV%eSQ0A&A$9$N?4Rl=xA1;a^24J3AT)i3e!?QjS&Ngx~Js#Q;LO|CzHRgA4M%9`-D zS;w~t${{J34$Ps_rj^~FH)K~t#L&zkyt$fjpQQ_?s2UL8oJ`U+;Tti*o) z^%m(hH49uX9uq?#2Z|9^`@pAsI|98%>&k&Le5REZSLMdJUpMy*IFsUq8~(R$3h7&G zmDh!-m(&@(1v);@GKgPX=U#Ouw-&E&_FESKlQDauifl=_esI%&?%ptAY%uvj-A#1w zuF05VqG7%ozxrHe?`rvn%@;G5d$A5d_>aHRX+2mh?4wsn?T*S_kD1basj&M&=O2tu zKlP)|tm{x0)HQGL+`2M7i}mszqUSqOsLfu@W)1{@R!7(Is2BQ&@UNpntOM;ZXaCtQ zaKsr8ZUi|GPvEC;vHEwvrj*?U2T_Qd6`gKH^#v=vTZ<-zPTaWI`e=0l&E?|9aDjEg zo5=4GPO5U;P{riQhm(88=rz@n50tdx6AX2g^&!0S)V&+|GaZXv*~FEHryGem-dXYR z?_+ddrijmtSH~=qSauQ&< zTOP;joa&$0%p)-eW|sq!{Nrm&9BvS_#%9f%j)d>+Klq0O6b>-FYx^YLY)DJrE#9!6 z2vJzHy(5T9TlSxGYf)+HKJ~MY4UAjaI#qKr`PIDgN|K;4HDzc?$kBBRl``xw1p)#S z7j7oMsa}#^0Qld@O_gvSfwgaJkGV-UvX}~jb#Ht}kyM)X>C#4oqY$J}6~d7Mz-Az^ z(n3K)uBW$k{DY)gBnt(7Lzg^^{yH%b=!Qh_V=bACr!+`OXRsBsT+ z4x2$Yg6MU~_a8d+%inp@0#c)2=X$ww<~xiIRBXc()gPdS+6am4NatKe+oxL716-w> z>9nnZi`spu7bDk0Z`K68acGz z4@+e&SwKG=L>Fg=of}32b zFgx}$PmlpX2)Y!(Vzy%(lMYj+3;*c0-(vLEWI;ZWxMbaO+eN1#soVS^$3HhZZSFmQ z#Jy}Nrrnva*+`YT)JD%aia{EsVr?_Lj;1fbvl|-CKSrZ1^+8-fmqx*Ei}~*nt&4xKFW``er=}5B7o`yBVWEYdXmNEi0@!h*64BWhxq?&7w*RaF)^Z)5iUC#(!cwuS zPKo-WbL0;faYPLu*Ta?@tzoo94@m`k;a^49|JyXYfj1^X$ob@`u?TkX z@fT#v5@N&`&6hTI`bkRNJY%E|kT11-nzpt7>4s)V@lT;Xuxki#*dAC`70gb=Z#ucU zp!V7GWZl{1HL}rqrwKnB*J({SZfbw3d{UEG)P0&>B)cpTk}*QCKkNYhZ!#MwK5BT2 zId?U(yV^Hk;x2wHI_nI#yNolkeprpmqyyYyV%)|wi=+2H&6Ltba^rBBM}Umtq0P{| zjeBkv(>xXJ!c^!c?b2Tvw-Kz-?Eg5Ayw9XOPH*N<6%>HpH5dt(TB~jA!_Hs`AhS%u z*e$Fcgp+7872M>oEi|(^MKR_~kvZlr=TnL~R1O`4P;@69@9O*e{QiMm*XOhC zy58^C>-l^0n?2hppRzL2$|lSl`nq(nqk*{#5rxt_0{^FJYw zq+r}zTM|jNsL}m<$5zaG-0erbyIwo*W;CdI8yoALk%v4#_Jw8Xf77=@Y}(^JqH5Dc zEx`t4RkCPEa1<1ugAKb3NQ;ZG*A2SJPn$gO*I;4n7Ms3Dc(tK`>08t3jvtY@-PeU4 ztHliQ5cMc#x1q_fai1f5wK%+AJUbRTZjvsztrPpi9f`lGPzpnFHuVHw8!oZWDf^c4 zjlRHUCAj#)%Pe`YpHtYM7(Frl;}}+o?10DZkJKw+_p-?*Ur`1 zkd>NgBd;IDBB0$$49Zy^iY_;7efk2475j>$rFJ`$D-Tx>e2n5uJ3AzU?z!9R#yT3j z^b0F)#*i2XTwjR$L#rcUM%{)1h-FVYO(mknN8xJ&ehLj;JD70HFinvx8I}Qa*XlU# z%0Y)l5C+6CtsV(~{hkSEI`|9Fpr?8+-$rxed&S+nu^FA2?1hZolWPa}Y{q8fVX-!$ z3_qKP%f*TK^bG`goI1PG^OC57J?G#4`Px9FwU~rv$%tgB_J6t>^+aC5f z^HXqX-I3a=UuY;b*b4YXw(6HY!@ids%PDL=sa+W8bfzUg`jD7jA;!VNRFCb^=f+nm z9xKdtQ_tuxy{(CHS_>0E6w9NxNAKAt3o#udi*<`h|X zbOsi*fmfRcrlk9u2-ZXoLHl!+o(uj~(JNITz-G z&xRYpSh*g%Ie0P0I`*=*+eB`kQ;o>sD)3LHi!xm}5IM$n5-{nZbDi=nJMlK!M|3Ft=X*6wB;@dK%7t9-4t zK}u{$M~CtL3IQ?Omfq7TwWIjPY4|v!#%x3vEVqa4<~uv|<{i7KFs>e5KA>NGv_4s< z(P6>qZjnYXwY4_Iu*1klwe6BeRF&S`z;qe+KFtgCIDQ!QkQ4{hB(gj9U zQcKobr6PsniJw6@d;NN9jI^T$jgdX{7M6w$uoGRb{blcPAj3h>ZuX-@j>B8z8@+FX zIZ%yKLnChYEiYtmHV6@xuCulza#BLzPQgjJKxH7}!GCEXeiGoY?*C*z;vW}9J<6vT zdBmr|at;vYMh!J`em!A7)NfxKZ|bUi6nT3DMd7L*JG2#l7~X7+~@SNR)`g* zB1okm21dm7svNB)Kz2SeGHUI~=8%&w?r>Vr7#r`BJ>($RZ?q&>8J&OL73fJR-mdx3 zt!pkn;1Jh*O6Q~TvG%(rq_nq!9`DB^M_%7b5Gvwb>`AT3>mD)cg#@=%)_E}bY@h2h z{LQnCo{hoFUGa zEY?M4^$+zH#=i_1YY%-B_P&?Npj=MNO5!&wuV}T7`~^XDhiRGXJN&JUE(1Wjdy&_9 zmv#<$!eWk+e_RR&%a;W99k^B3Gh=2G29W6ZR|<%CrTkZJ{^!#*^WI-;tTrY3$6wdq zA35KD{^bduX_L|s`UAb-03u&)G3(icmFrllcf%B+jRD^g1Sj9Vl-ncAoa80zpr;n7 z7DWl`s&`Mf72aFX2$E!6$2UV1#%KJ?as8KkF7_lW>;E24%3J#2@4poCtBBy)(t$gh z@u~QPi^(%&o2a`bw%3VT^Z4iewntoRV&SstrFmw?5wBDcFPytG7(eT~Yxk1(Xi)?f@*IqP?;Jx3R(=(Kr5S;RE;^pnR!&QkH z2ce0hH8JAPXr=1Atcj(ABrmu|;Bi&#*xh97fgYJ>H{2vj2y18gB*(+JJ+N+8qC-V~ z5F9#R`r6aDU3NGzxZ$*hRmJIpoi9mxJZ?(3f<#>2$>ZVUhJhY!QHS8%f= zZ7&^(wAy>CZFxKQOdZi-D^G^ROr*eI&Z^Sj(wvDi`2UDmI#^9xx$ zT6r(+Fttbb!Z+ae|Ga|5(UyVyx@GAZqwcE-!K3*)$Q{XA}v%Po{w=OEP{@#r;$&64Ex0LZ#ED4DPs(8vy7O zm2Fmq90i+!SSUo}L(CW=#?bR3CtjS_inH4D%blAr0!y>HQUZ$|`TCwylpMpMd?jGo z-m83l+w)wqF(A$;V%9Uuhw3HR%(or^+}Nk+syrv!Rd(y9e;I0{DL5*XT*O_g(pY7X zMHgye`IrKm&Rb!c#IE5V3(xs?$ya$=Pi@vvUEB?CcrNHZ`Vm#=~Sfd6W? zzwo^Hie&rTj}-VXraSwG#-JXj!NX!0EkXjuqosM+v~>w2I&|28HZf-*yzMUB*3Va+ zCTKiTkQ^8nvKU9@|L3kY$&1z8{rF&6ZFz5oR3f2)PfoYWiTy9 z2!Wc^$>=m?1dxb>&SsMWK)v+!kv;0Uu z@fCb#8;c@!PK>y->9o}o{1Wx3;#ML0VjZPO=r#Q+A>p=Dg`G9g{!}&!r3GsmmQ#Al zdg$wiz1FgJ*jv3xSI**Pt$P&iUxEibztK!p17RV8%wXR8#l&8AFf=ig7i)N1VPlEZ z_m2dBLUcNWjp%Zo@vGExaef?(jdUP*$6Juu|^1=z@sG`p|!te zj!QM0P>fk-Oa}p~(lWSktY+jnZ{&N0?-leJBQ%>^YM;cKxKfus$~*SkiSee@4Ll_d z(P-B5lCDCUg?M@_IaM z?H=aV<5v3&6*_rxmg=XsWzqK&tKAVd#CQxzMPFHTwPp&Ui$MYfjf-bi0F@?8fuei| zBAqS~hB57lc>2L`zlOszX}ZZ5lX5{jUl#}7{Bs+cArk+kO2)d96|e$xCNt^MV$~@5 zv>gx%+9z775tEC0H8C&HK3q{0jE>z;+te~kD^1O^t-vD z z2khD9Nc9;r&0Zzo!q7VX17ba+v9m8zzJTtd3-n9Mo&S7gzQEkumj@f4KQTWF_ z+$hnb=e-}`IO{hj>}hnLS+sOM!srm!c1aw0A8zHWEP38U_ajSrN)0v?`!HUG}~4cNlRBun6@I9EECc48|z)oB!J%;uNA(K)h5F3 zElkk<29gkYRsx3iGCD%EfantREr8<0!!;6CS~pzZ_Z0e%n>-&;s}8+AW&g!Z%9Yma zY6|MV%X8@Tul;-){zd2V|AY$N0o5GN$kuw^uC z!Ondlp|u!Qx5PR!@_cw8-Epz7^11Qpz;=r*sf7`XpR5A8{2km&yie`nNhIvT~a7UB#$%j@)gi>E!5U~lV*TQ>H_?L?mOG3nDc2~}wnD?7X!HOLD?-fJWM zNC}T5U@A!jYL}K65X%a-_1n;)&pi%B&CG!Vy_-dOI~IDG)o6!j;W62SoCT}zuD!^a z@;Zdw8}Kp#vBjnhi+jScfvkLj`C_d?@TA-K!Nnf-7kBi2OXP^Xczvr;?vPH2b&t!O zL>{FE7ve63?bcmAh;9}O&23SvPwX!%%|kdO+!90&jukdfN52_Aqi2fyvSiNG6qV@Ko<2`CCYR ba;2Yhm+kA zigrjid;4oSd?k{nk`=9L5>(5Xf2ma z)+ja!K?KGgFRl`p@JE-LgH%EJ2xt5F;W~csJW+PL5- z;q!2WOi_=(KO_*q00R1x-Fa{>4)b_=L2>d2InKwPSew+T8YRdN!>D2oVND!8?KZQ9 zNC7GWf3Q*sk+reKKQNoWq7h)KGf_8wjrF`N@LAxM0AhnSZTN-pa?O<0s%CqF8sXK+ z-?rEh`|;?iBr!&UZ~eC6WCG_|*cQbPHAgOdyo$g~D>zu~Fv}Y;)EV)Xn{%{hHxk&T zaUE$i&!x~$Cz{%jyJ`&rO`%1_<31-V&@0OA(@lAgFZTGO?i(0F2W>^l-``tD@m-%& zu$+#Hld&&(zD0Umwr#8FR9#Z~B)*7yVF;+CAh)f5-W;Yi6%Vy`{^NQTjj^EKxa7LD z+%BU(nLCMNg9Iz3`c(-;TK+C#NY4k9jUz@gyK!O%t^p zq{}Ob|2A*?zHC4NMe$7w4;J0z(IFCMR0|fKuod-svkNO48H&t(bfBwICPd-nbcrO# z8>XUfzytD1bm=!xqpe#7MsR4$NwIwwF4(IPgQR70%A#GRClEy&qC$LA%qlf_7Zcj4 zyvfIHn$P~hy!q=eMm5F#MlD>W=p|ofHmrOV^W)B{IBD+e({N=<@2AnVcazlCHA2Gn zeodN*X1tT!KM4*qw~2yPzaMwDOqSet9h31&@d&7#;S}T-Q;S5eY`blf&Pz$48vSv? z{h7!A?u!)uE1K#suA3@svg60S78OiVuua$fL)zTME`#+&Dg)(;|msciE_}&(v3GC!pkuLw)iX^4*ZQRwixCSz= zTZsYBI%KcSgml>=KrCI2dsKT{Kx7P+0@X7wIT?nA=#D@u4m&fKDh27Hh6JNg#sgOr z0&-8npnT$LWQrufrbHW_PN^~STSlGNdK|*;TF!>LlH7*X*ELyHS$ZS~?T@U;ktaZw zrjeAy72UO2zRw_of!1v5^vO2dn=*Nbt&O8{3c4HZAHH0iVLdi&F7v&DW^*M74>{om zwU|~+s4GjHiKa|`AUMhzAuazz)zo7`B+k*%oT}(ZXaq0)$rq!On$Y1*fcd(PR;O6S z5=Ef6NJz)JR~q2_f~&1MlayAS&as#S39z|||7xQn|3qDh4^TDJmdW&x=IQCAIEmjx z_C%H~Gss^w+25=F*{m^86gc7g4FhW&r4FYtg78@#iy6i$^6>*}lHR#AO=GCyav`Z- zgvs51CL)P7;*2Txy}Zy2>Ff@NWe<4gpH4`xI2UtM7 zkZ8Q)?YxyG7#2Sl$HQD4Ha-&r0%tAWi3X*`dcrLRqLEvSr2AUx8e@VyOCCCvTPb3o z+q~s@9ci`>FR!mQWHiYDq~6ZBVdX_s?(~-bed(X#;BL{E#d!!ox5$-y%dnaT?@PmY`_SXp$XH@K=%VC4@#E=SW2o_K|u(Gp~AmQ(*%|{6nG>1j9&HN ziN6WvLdD}M<9`3phS4Ts_0>Z zlm|(l(O~hGKM`;OaWJQthk6V1Anp-1yer5IsrIlsbrGEu!oG}JW_Ru;jIs7`EI;IC zH6`c3+9`~LK4uRq-0^wbybfMyr_>;`GIYaDpF*)*&7l3v@0D^F{Z@0`Ydl2AL%}JK zruZjPvtt_jZrIS(T>Z2>D&#-1Wlnib`Pvs+vSc{=u|R4Cb_ znl{YyPU8D4an7`cOOzApdMeClqfzwlyQ#)Xa775!+Iph3i<}dJhqa6w3~O}POO(XZQlA6wNn6Aurom|G+3t!^SjJXZ;SbID z#hEd4_=T3W*!E{7RY^R?K6EW?Wy^E%NcBe%g|^HG;}e+Mlo^ zGR1*?NO!{RpvIeT@@s{aL6g-*O)cEeZxA}PpkRpUDJNNaQs>b z2J{Hu5>US=s`X?&QBd1SC>$%s^O!ByB4QP4f;l6d;&?c?L(X^d#!82031hOp6nz4eL7$kcY3{KM%O z-MEw@q+w1AKT?sJmeofP@_Y-qsm9BR0z~MB$j0cMr51mQ#bo7`x)Z71uP44Jo1CPc zXd#t5zA-Q>BF~V#2w0n~fMNGW-@Iu8p{OrZ<&V!N`#3tO?MKGv*ez0=^Ftc#X90Bx ze@2ayn#~oyslix(c6?ziB~+olMCHL!s?SL-JEi8Lp0^a=m749 z{}cM;Otzx(-J>4e;!J4sXDG&XHzEEK&uIXtrLbI|G6RX$@ zhW7-oufMQr;U{NzKv&h_?~>SUXMzsc_;;-m^sLN5t&nZsKUeBrp^-;w%Ev&ohXnLO z)sJ{Ic(t%M5~f+YzFT15bAU6o$bGul=@)(fnWx9Upq79Ymt*tncW`aMMwTluqD^3U zzSWH2Sgy{wzv8iY_EI#Ltlr*Rkc@TE?E%b#v96n)wFa9Keq6ovOTrBrLK74ZqeCHFXc#^HpmWg3ZiwxDi!$Z z8(g6+-g!&au>8Y)<9OOwcKD9X{Bcc)%rGt#9V^GqZ!`*%9yt7ywObM_sCu-S_W{A3 z#Km6=28x6tOslA;bN3%?j;M=an%2=fpL**PUviUnhAv&isI(@f@#3-U@#mHoH+p0Z zL51^^rC*eLJPgo?{TJm)Cf|azL9(R4zSJe${KD*nh#lrmlWC884tsv&(#4)5-g#Wt zMa)8!Nt4nKENLsSCpEbgRS0NdHfQJj#pC*u<`-16e{q$TgC?5^-<5_$7rUG0P3&`s zj2SyD)mh{X;6h$m;1%%Yx|)ZRO8!7;GKnvmBg>A$5gqbeDi}uwwsE?{u&8HC@D=ac zs0v_=mvttBzfdN3!t0iH3MeaacG1Om;lFF^lJ{C&XA=#eL$j@lSj}b5Mmgy z7u@AyTGJIm+P`~{SnoxJ+7!)T>N=w)&(|?x4-NV|I4D!^S(P`eembgmYJBesiNP2} zOatq?$Im?G$ldVBqW$~}FuWPwAH@3iq}IPSJ(Jh=zR4Q;1pB|>SN}tv3W=djSUY9C zv}#jms2Vi&k14O?bu!)!Y)NOG&-){NXGxYvm~Cc#J`a5@X4l8YuV2Wy(4xk(5qkk0 z!(U+R_+j_gX3OHnQ)Bi1sc`D$8ZtgxIP#NFudHysHM}p!v>LxBuS9aOecpxdTZU&X z!Lpc*RF{kL$8uJKFiVl=Hvkv+XnkB?&{2XQ$gt|oPEfO6hY=G{;pOt4b--dPLa4xJ zYxU)_ESBvf@1EG-Qng|mFKat3g-3so_<;;ztWVFIP?jIX2Gw>jZo6Qs@B6eUrP0{V z_^_t&%!=?`?*vXI6+u)HuDxqSr`&&DBAAD{zWN@9xzpoA?fHw$Bh69e((vAj_1j{+ z7*gx3)hrxttg++#_KVH)_SsgwHNK28t>0xtmAU^-)3mPqa=_=H;m}0C%M%B`K%(-c zof0D)yR51fn=PJCMNAiT)cx5@#{Q+RxBgVo6+3Hlzt8hM*DIyLVb?4yRXy!RX-_s%)DvsHRbfz6c02 zwu$amc8(gJ+769k@qXVH(Frcs%}6OpHMl1G_9u48<-!=LLh%VsfNLjb!mxE#=2Ppu zxhgzC#9WWrKI^&anl@AzUn>eX@X1{Wnoa7%*lXcP*9GmDyM%rgZp%gc93WD9)~zjn zRvsUQ<(0Rp`0Tx6=t%RU>4A2{pNXpq7q(I{PnNp810NQCvH#I9dS@HC{bp;FlNpCi z$0P?jWq%r&fALr@@P>tx9uhGCL03@cq!G6k(m_zVxLE0cRn+yf6*NGo#;BNh?N>=e z3@WYGy~bjDSe+tD%4kXTFhYjn-+VV##YXO6sdK2a%3BR|n<5j^n0Ie}_r< zJ0dOf|MQXrcOtV3$(@WyU~W>x(Th0AoW6pehQYJ_-N_1pul-2nBr(qn)(e5v0?NfL}y@{+&YxlECN=} zsz3dVCARhu7ypO@w@(#&jEm&%J)k2i~fa@ArHt($Caub z&mo#0F%tOl9q8)~C@6J3`qX8h$Oi4MIuwI#`|PL+%@cAS zsEN4%4HN4Nk6CAI$fIA>fmRDk-ky*$?(+13ml%NaVReg@3@P=3!svsH+rF6|$@OBu zk>v|~P&XcnGamO&e{cn*E6C}}h`Fxf5pYdK#-wK&d6OL2N*S zsNBPC4{AWhfsQO2xK*5o=O#owndXbf@u=p~^As7OH8@^*qMxtCUPt0S{pZ~&CCZ+d zlS>cGL&h+36emso=DmOm-Y_Kl6{OG-LKWfcSX+Pe4V8tptcQDc>ei6~@6iMFq~-J- z5BLdTcl_8x3B&AfK&8eqnKx7^20rrQ16p;gB)2|0Vb=w+?LLKeo`B~~(nV$xoXPzG z1b6UtIKe)a2Fcg4jN{Ihb5)(PafssBSly?<{%FcoDU_~W3zKjwBxDK04k7)kCwGbJ z;zafswvQ-Eh_{t*<8*4ms%zdwai#yB5(W)^(P(=w<{L^$;~4_v5_~G1yr)Y6gegM% zRi=&y=8fJ;du6?a0ZzGHM>TfqZM;&7=UY=Rj3`3Pa$G-^_uCTvtpaHxF>LTv|M^$V zq=KHutU^3G&#dM*{*iVbOA(U=%c0&sN$CxZ(Q46;b!s?-7Y`VHdrK?uwzvhbC1QiHzz;qb5=>qf_=9 z4im1abz`WSpcG;~*}AwUE_>SK0XSp&3sR$eB>h2wh5S*%l*}lqo@rk`9!BmrzUcfn zIr>p~r&h5eUA?rJr`61C{wia<%BJPCIwSDv@4h0Eg&|Y=P9wW>#KnyEa4Szy4fVBJ z6kPCVn#>Sas+`P@)L=f2#a2a&Yf3{#jwTgI8xew|;7O-okddhDIqFI_zW)rF_J?C9 z&0ZBR<7BVPqSA>7flMFINE0txfuV*U4_H+~Tg*)ViQgt1$F_ zJR)h5c;*Yzs>nZgW;rIcNKY<~SbyH6>)I^CEezN9HAAmgDbTuc)+b7jBUJz&Ekcg} zyOrao(cZ1M!LRFqhN)kaC5}gZ47#IV7d6wQq16ltidZp-xm*cf?LIFHjN@I$svX87 zYpD(>zlGrs@SyTu#LUPA{B$Qu3+=;|8%>c@rPQ%p)8tYdCNa ztn2={rFgg!n6}*4qNQ9+s+&)p>{3@>UcO>f=p2J<5$Dyvi*GyfismJ^0_*b5p$ zJyZ=ktA8YzhY?{pR&Jzt0Eo4;Cf~{thyH7*S8bu!?lIQm zT?44k2he@1XR0SCFAaA|aUwp);qcPd&%hj5p(u3Yz#ftx!Femyac$f8Eq|S`8YIJw zjHTG6{d_03-b~#Au-%8#g6m#xNl?c{<_EUGl$>D@!nnl0X2mBS5?wJG zxB1jR`+oaCE!hEbqTr$6Qo?|Gb#SnY7a z*;0*!)lOb;PIE!EgEsj=!o86f1KR0_?Mgeth^UKAa0SYJEVyq)>n^cgJ zjduNMQHz%*=n{ZO-b>zL<43+qfq8?t*XmpgDcfpj=oTc(fG!=D+?4bs9ULNwj=+8m z|DsiJB#2U(T^G0;_)v1&oB0nw^YAYk&h_#n-+*@H-!r&W* z6`LL-kwd&xl@EKSk3m7gta8h;CVmqC0P@aU_r1kb9lk8z`ckun6*;(f@Mmw0CR%24 zu+2pxuy-*wL@GljV2*eGihq%J6J@D z&(rrXMN&RZNw@Fd1ZN*DDLU2dt}A?K|6S|%%TMy(zIax7?KAo3Pl zN`R65aVt)%c{@nq@H3fJdf;D#8@o59i~P3TwY6}DeuUe%eg9*x`UYO^_|K7_u*9UQ zP=lhgxd?bd;J4DV>;Iw;5qLvbi!WHp8ymfK1zd8u(j28uV~inK<(m!K8G}~Fm8}g6 zWDdO%?{kXU-#%5W`nkPuq9Te55rH`>Jgu#}@{Gn)TI~?L%e@)Z-YMz;+4VlAi`rVM zGsp6V9l8M=e=&iRw+#2DH(B!_RnZP}_xcE)yN>myULM@nI|R%z2alH3c;qedh_F{$ z(;OZgX*Zi~u%ayU9(IZQnhth|No{*0yw;-a!#E+@reP^p$J{Zta(96?!&xxi`A>h~ zMALe@OaGSttvXCBt*(;?5ISY&9qU(Msy=>ff3-uaUoKwVi8}=7Fn)abI5a{0@JdP5 ztV9l|R(|i6m>B->_K!aDzcN>!z``r&>wU^lAJ5{@ey}kjlx2-V8Fo#-IN~?NfvIoW z$PL!J2ic}DNWwX};^z47#SB>+!bSgLUMBPKWVid({kD}nvxbNY@t+=M!lhzjt=$G} zNuBLwQA;iLd_Nd@IW&s*fD*`lN*wgVv=Y%ZoM$|3Dp=Te;~w3glAe@{$tzh@swrOO z%^l*dwSAytpsftLo!N4}#SM|X1e-{#}>ZY8yH(2UO)DEFepOc=ib~ zqcVQ@Aow;)$w4Hq7)%o&8uiW<8)Pv@G{HMn2J;TE8+0IV3Q@e>JrF+;S! z9sf94_6&j>dX9YBGUxSm%@|=Nl`bADkao`55vYFb_-!Zyss-$YN$3C`yz-jegwlj+ zaJuSgh4S_#5Lhv;3X{akS^U1h>$^8yxG;>fKzi3_8k4j~l z=e$L5$(UggO8_-M)p9srpE*j0%kN-qq)cm$P`Gc-LuxUC8$PJhDG{1stkKdAF*et? zVVaj`uHFRh)`x;cBFSv(uo8qaTJQ2Wq8(z=mS>YLOLB=hXLHDZ`h`FD@gc@NPPGBh zIeqeewZ0v=cO{V0WJ(|hKYDW?z_2=@=i(Zmk{+z`{PsEZp%mnVxz+?qBNE(oqR9=~ zN{7bVh681IlhckL-G;9oHj~aDIW;cayJLTae)^P>;a>sUjm<;16CuiR&VI;5OBqr z*J0!*L1Rb4CkzSeTiBe~49zdR%q28GSy+~#^U7+-O^ zfq~pqrl1){TP_Dg!5$bdnuY7SqER}8En@t-ZskvPmGFHQHL~u5Tu>?*7ILA%657i5 zZo*p06)mE?T2hPGiksV8u&X5EZ`b)LhD1IT=uChnY4vnDR>aRglTJboNv(+L2tO@& zNl4Bo8;QhW<5|?eTnm28o@c1qYQsGkUFpxcf0oT2+tuh6SGmt7=MF+l21UABJW!{_ zWaJ>*wn`JIHk4XHXSe?ZZu1IrwYc;e9DjYT@UoL;$Loanjx`=6w;Ek0|DIqD%>^4~ z2oD<`w;k3URdIJ+S-h`A`ck6~`k&BZZM4OHy)gWH6&QB`(y@A}#>_#S)8?su-K0ux z7kBtd6uuik`FDd$h4L;?YV+M#wb3Q1at6iYq6WIt=&IjLXC73r_vd~7(J2x0ko3$v zO=*sp9zi0T3}ars+iyjCyI(`!g|=c_wrqcv>x#{WUj}fw>@|AejnIVCu&@I+Oq_8M zwG;mpfV0Jl?RMvEZ)H+IZN8L3bN}KT(Tp^Fs-U168GW$Qgg{sT<+QBT90Lc}X=vQv z!gfijb5#i$njKEqY^UrQO@*g+G@G!f@T6G@dN3jUq?C80_{lz^k3-I2+}kJb;i^xAtPpD$RZTuAdCs& z^lRKiEQe9(BEr4T5}gboHyW>l_kpv__iJ#hwXpw2c)}*>PBG^8b0I)P5u~F8yM`=n z7~Bk2M0YGB`VP0c+S&oD`HK%FdyWPD^hpf7oR?Gc!KZNM$MI*K=?yE%bvXxSyw6PO z0*#PIW3_RNdDmH2PCnSF?EJz=P^Yp#pVVWdTB%V;M1yWnW_?>YQbO~ijJ4Y6^4X|f zS0c~ta=6BJVCuzKwg_1d6B_p3{$NnIcJ;!MOn>uA2(lupBBrASRWImK_tDrMX&H|= z{x;OB93(bSQ8ssGW+tM?RF&u8^A( zy6txca%?FpLPJqUH78WBTE_EJv{|FsF(oEHniNTuXwFT)eahgS#!Y0!se(B3SZMPM zjK>auJ~5d#3-Ezp7qzi3C4HZWt2sTqo>ThE^l7e55$cPMIb6d$TrEEcV^9{UTDj5o zU=Gh9AeZ{y(E4WBuW2;GEzOfP7PvHiTJUGh08WBl^i~Ptu zo!OOp*uDwsNgzKPuWdR7FwWT`B;Vz1Jmq;lD6?wZ@n@(JL*f-jY1nO};)Srnq>+Mm z`ayhV_OY*x_{7+tN z?(i#F~bkst56Tj`~mvuk4bknwKLOVr!;yxQc6ZpcR0tPdW! zd|z4B68^sBfyb~T87(dJ|0!}l1P({FTpBs>M(H{~lqA4ae#<`Gx!kKDBX2L9kJ^gM z4@EU|6l9KqiU@U^7k@T*7%`Q;>6+%vNnbDru-qiOaFU7tNWvz>iJ%$YREx znOGGW9wmHi32yuGheyC6L&oD@@(h^?!Ga#nESwggN4(+X7=`dho@9OIhMYJ&k$52U z@?Bnd)7hwgAs5&GDphCM-W{514SDTcOUIm|I>CGCrE8t~lBV`xVbopQ>iLvIQBH~N z$74>GRP?xD@izp0Ue@+&?uwW8f{!{i)S8XRj%8lB>sS3y<8$aalAdNa(aRqTr{;rR zK!P@2nfuADfP(|0wYB|&a!n*Y#bh>fhLOfflRbl;>WGCox^p=wXJ^MZT4pAdOxL0I z`0@2PtuKPJ>?<`o)i8IC8stc)7CCkGAkM_=hCM6!P7I>JNev<5t;WI--?PF%`9~zD z$A{8dlbshp4m8hBh`ctbP%wKu{;S?1TE}C!-n4heUoBEq&(0ci`?XNM-0mXL!@97o zAEiW3Zu-!!ajB&!q180XDz0hg&cA;=PLbWPNy|&C@rPRjbUMmo>{+inW;^XC2}^vk zUhtZI;uI{{eU)fI8@j1ao>=#?{S5Rw&o9FfoI*zzhgMS5h!df_`QxvDcsHjY1@-k| z7onWvj;>V$)A!5hw;3t2r z{=4);JLW?D=x1Bi@yh)cy75H-fIkdG*iB}NEGo#d>$dDzpp&@=U1maz?g23b^HM3a zmJ)Lr1?`nFxSp!Z`JWI^{PdYqAgARB=|o)7$9G*NC>M>DRLFzH^_jCBR=46U0poUu3=}F({&tvK_3y$-=s+{PDT5 z=CZk^qCY$$s3QGd{&BH`={321sIeQ#AQWyephn_Pq@3af-jh{ZDN+Z~lPqVeqU-kC zBtv)#mMy2mzJUNeawi$KqSa2g4}wxEY}QS`-`0S@|B5bD{A09(UCG@*pdELKED^Er z2%Q=EcL}gfV*(IHwaLK+JS5z@h%Y!K$bQ=`CM>5O4x4@xFXe6%VNRi!2;NX)uG5{s z>TjbDEaxiu;$8{Z&N)5q8-8r2Iis%pfJFG$B&}`fEC_7~&g()-lgEat>C#m(tZrpZ z(M<4^=-)^fPuzBovEKT;lGvdWCQ(ZT#T?rTNQ3lPN=iju;3X_WCYGVuFe!v31O^z` z25fZ|nvF*G1$hz#GV9nzy!$n9Dcy~!V_{(P18a@a9sv_~B-c zKhc>%65(ToSy|OLCQfkEud5U|{#T(1%UI`@JuOCcLip}jv2OSr4A1J;^~y#LixEu= z1O|mpacUf{NyZrS8Jr|meK@jj}g7M`wfYvLB;mIaIUSB8ph zc&VY{dq5|KOe)kV&*vLSxg9dzM+-ji-k+X{AB-Duh#&xX1

+Y1VxPpL88g)#ZG zjfWQznwG%1dMCdEkgRQu2pz8P3g-EvCH4rXQpKj-+u*hgGize&rKEcTv@ZGf`ETjY0+9m_Pr!&ZHhS={<5f+CZ0UTFN%&hd=QsXH!bu5IYYl(z&1l?u{ zj9_2&KuK)zIYiav>g>m*7&-U0R&$K!sIHuL3PMIxq}AOOU_k-U)y!sF+sycG%yM%6 zd%lU5pE?NyV#|4Jee+N67L|a;LkDW$_=#nALr0!_yfRYhEfSw5IVFjVrNMXkS3luh zmxRdoC6sG=?1a+qXJ(;;?f>X(E0qHO83SOS6FNte!w7?h!JSg>$bQ%Zhj@u|cE5{n z(eY!eDomvCO#~D$#bv+Afqo-Quc9e_V8FUTT}tqinN={%sGhLk7Ibk-wI3l+#e0~1 z<{}BZok&k`>7n4!=aF!cacQ%QXl72UXL%R;$pl!-^( zW^-%oSfu*bz#`5g`j;AAKwvPiLm=6P3p;BsrlIAkPgPx5OCJ@34wkOi?F<~i+(ENm z*sJ!JR2goe2WC)CNp*XrqeM5Yp|rK0xnl>`q>z$L*0ott;qK3mHV|hnWRwxuSuL1? zH-Ej^7K=r`HyvG+F}q++`O0KA~>$L)Rz=%d(eWL1t0bouQ0$z9gmSi7c5m7wjC zcQau#)8;}8&)P;FNVj)L6~JOUh~dZNj-TXB!c_Z^7BeQA2iLa(vbaWV2+Y*he)Vi& zU~f*(dpk?H2G68v&)u|wPDehr82$@=2sr7HQc9n7Q(r|M2(XX79u)r~WMHMShjUBO ze^8=Af716N$J`HF?S&8-?=WVT$&TPmjO4LhJ>avO{G+S>{mIh8u3A>8}k!s}+G z`k0&KC#Et4kvaCuXrJR^9oh%7-(P-GeSZb6j{3?PdD|?F#jWF3Zsce5pRWCJ9Ykf^ zniBfiYJYPm6T8Y8P!3Asc;iw^Z(Th{zOOz#;>xN#K4?ciZ%pNT-P{h!97$2ISRZ%2 zgjJ^kme)teB3Iv*A zGzV+0iZZrH^Cl_9D;a|%!kN4vc=k{!H6eGb(bQ8V%;f;K`=eF6u^CUHF$cS54bWNK zjPfP1ZwtHEH}b8L5(7(XRP*H=mwWRZDz^fE4n|IZSzFC{%Y|1dWvvkBPra~FJ)(Ws ztb@@{ckFEQ;{=jCW7Pb7CHuhuRK8-TVlLLRju&|_DPhM$AKg8I;ROgZaX$jL52PhB zW=>F&_nTI?Mv)!@&zK`olZ)N1mCu|8)O0ex!$OsHS4B}*h}ISUoY}$uqv%}xneN{| z?i@lka|*?5Y{ndONaV214#+m=Q#l`Eu^dV#Thj>jXf*>DKw3fL54@D;Zzi(oJsAjqvr z+|nLLkA?B{;tkCvW*=OAQtoQv=Pl!Kgn0u$i_c4u?x#0RVQt@3y%q1IEIRmqy|}S*fHMR0M;+ZnZNyxWq6$@-uLKR#Q1@UF{0{ zHN}cN1yL5*2J`MGhv{(p#bIWf1wy#6rnzdOX+F`Q`Qb6!rsCP+Lg<7}Z8G!|LM2kw zfa8C(iA=Y%LUu0%*fv<4npRwhUC1+LeO()DQS3=J@QuCFzW89?bWX>3w_!w|9@@+Q z6Z_5q{AlWq&-#z{fN|x;*Qu>CNsZfhc6T?V@96ag-6&!IM}5Vj>#3KoO>|ZFxgsS; z{k8qVw+#h`l#!;}mGEaV^efNJyXqSJm>IQ-@2_IFof=GpLbO)`lT&KXa`5&S9 zwnRJa_=SJ3;4Y`^h%Y8fF3S$@x7cSv0==$g#wSYqJd7OmBy)#8te-3?0izuE8SfwQ zrPudk39jIRfatvwi$1cyoElTKANZ=5EO$By4oFQ2D3_4S*|GPp;m~s;o$)>ec`IKB zQ|c$imUzQg@WXE)3jGIt$`i5=ugVlj$G84iPz);>&cL%2b5)bx(qe&T08KP_xWRlkX&mDKf}GN zW~}@&2HdceeafjZL@6iEF@c_tb57zA`O+aHPV zt%-;PvQhi*_~b5KL)M7%i9K!zJbuUTSR{=G`a_87?#ow9q*z{%`Be3Y?ut@kY(dGOM)}5FKLuTu|95 zXYiK}>326HZH2Y0Q#{~TnEeyiYH~eXD}#E)NJCzy-J22_UK+~54v0{&!_M9O)!?WW z^Xk9V;(Zi47&mPHogkk4?N)W;%b`-z-fpPdTJMTx@&@8Ig6hw*eAR!zWL_$YN!i;v z`^f9v&)LF&YZE?oKzO2_9ccFe@&Bazqv7vWwSTdPkk01SQQ2DV6pUWnT7&6o?o&%& zI(;=S0Gsb%G!5KwSIJX`)Bf`~R9ny>YvinJYYeqicJ@%K%)pjJkDLn4r$XV*1xsR= z4TR|UL6@}9G%JuL&#>PeQ}3?TiI3u_BMB8ju;np)jtXd&ogxpR0>_NcCLxS1B~;{a z_^_*J5h&t1dm&4tEGk?beSPojP2f9lS-J+o#W`?w4e+Zf)PmP|{fjf>OSz@gN@UTPHWI);~jyb4UJLY=v5n0)vwG$A$K(CC& zLws}qS(mEY2Iec2l5yr+Ur`t<9@QYcYbwO9&sGdlv690cabjHfccMoj?TN_~(yB#h zV`z&StCYi!d{_}^k{*=ZXhv=GbeKsS!CjUiqXs^a-mS9VJN276^^i=|-9H@06Ftvm zHhhRF!ctHljI=HFR;x>3P$MVg}VQ18j`|Ag3*TAj?U#hUv3T}SQBuu3qjN-Qd3p{zz#aVRa# zC!g9J^e{FL27YMGUV3=AP|ASP4AvcgPk4(c(0UoIF1+RT#NL+MimSO#v0HH{%V`lC z>QTjD;Ul3^yb<&2D$#K4+vdFhOu#npHnQa#q>ATKDRnC*OG;6LgVSG)- zxi^#sfJ4)|5I0CQk|Lz%zH_SKNlkLb&N?E*bno$h)X*XYevpArEvJelleoIic$hIK zXhmkmh|NIhOGw9eT~Zf{V+n=rYr4LwuKkGG1b+a{m=X-@8%4Lre42vEAj)mPfer-# z7b!o4gSmlIhaR(QS(20vQAQK`PC z&d==Fb2x83oqo}%-GmicdZx=6FV>)o#CJ)gK7*Q!47qMf*x;J;d(50&m5x@wUSOxA zvi{?8Pb>bkiHO_hX=Pk+QZMWlOGi0IOBjE|YnnJahzJN*fRS$v82ynGeh+W3V)ia$1 zL;zAM=NW=5QYwZBKEZM->=66i}_$XK!T28zcZ)oS|sdsUArfoh9)!R zji!jsx(UJTGrjNa*rqILS8Q3Zl%K(Dmw3=wwE~|<6tPyR+$XT(JwPoL{pr{vF5~Ia zA*W~xGK7jkT%q)x7Nb&!U>XPzj8R@K9@A0h;4bJ|dp>ix{kF|mUNu6|V8W4pxtK z`m=-CB0M6Bf)r~Z9Uvo1Wnb)HJY)Nn8q@$p9<2mWw2(x#xPMRt?tlaa2g+y-gCgLR zu^nE6#qyWxQzA~TQ%P3;d8DFRd-=8Oc9&;7q{gU}e;E$;y$4rJUi*m-n1 zlH2u8wTdTCY#P^ew53QxUjS8?PHoXdt&Nbzv>J#nz4+#mo3a`wAhG z&iTs7#fb579~|OBr>oLDmr&EG`Qidp<@MIEZggh*asnDvrBXQM(CaaIBFB5rJNjt! z>)SJrICfR+@tx0 z2dY=cn(dlFYp4;U%^iXTLc&18DeXH^jS)LTb6OE%`r1^w|G4K1hOau?|2zl zZZ_So+3k)>_31=9FB2(2iV8kiAHu9XbK5-Sjlm|&OO10wYL8dl;}_#%Fo7%VK2WIe zEbF61+jDAEfbjqKFZ~`zicETtYY3x{su67eT-ZuT&uj%Mi4jnZSXQ;v+rJp7i=|Dy z4pF?VtECXhAT)fnqqq`xe1^o-nXTlShLEfoNyhetAzY1?7PO?QLH2$0Yw4s)HFP^v z+dz#w$cmmh#%pgsA=>K&r+3Z`!%FcpoluoNwRp0R=itF5vrb-iMk^NS`! zlH9}j4dlG{zF>U+8vP}m5C2G?tX=Hc-;wWjP{pO>Vo}(TpI*>$(?czi2YU4B$v$Fa zQ5$2MxX>3V$`#z64>>V>Q?l*HCj0UIL56Mz&olP&vVL*t%K=|DpbJr2 z#W&joRrRDaH6;&S<@o>1dWd=$%h*xiVjdxDTEaw8o6AwW$HfL$^9BXqP!3_aG5aeogbuV3TjnWiR#mI}&#brOeJYUb!c?An~F? zgs}cI;OdInD&lQaN}pq5n}4hv|BA$Udrl`7mk57rz)HySr$GNsSSGQ%MfPQ0&i2Vi zLI}5klx<@w_Wc*dw zee6-@7h})M*#RkUskfeNI|8ED+fJT|L6XZKc#d{>k5rDh9V0Z@ZJ8sN1%l^l%}{3{ z4nlt96_a)bye1I)XbIMbb0U2^`L#N&Oz*NoYtz+ zA;akIt)sb)vM0aIaUBBi>DCVBQm_sSY#wmO6Y;DLA#0j96nv`m&KJ$Jt4T08;d-QAPkKmK8Nk@ zi47fs+G9e?>;b=K)GvGo%lz#>C!0OA<`+koSK)P@uhM9~={>RrcPhHR=Twp~&y zjQS!bHRLAHLR}qOZ59bnI!ZDXIP*Zm@H0!P3L+pbNgoWq4?RWb5*LF;hBj!&P3dVD z=h%%{=s&d=taX-(AFor^MpmJ@bSHj;gNx!Y)at;Omz9sj=}DM$Ss(ztme1W%x*OTC zqi#zNrF@xANAO}h_VVzaf0G(qD}YG8q)@f%8(FyXm?vyXS~-w0@`jHow^uEI`6fZi)6#KvaqLP=DPev7?uZCpeNtQW^YN2MF7 zq9dBie&hc1xUSnHpTeP9pGiR>(GpgLzp=%Qc=WK0=o^5ulNO!ft=wgyI$B822-!ma=Zi zpx8^N8;X?RC>ciBel1Ah7=)dzpjLF4TwF-j%7)b@1|^t(9@F1p=y<34(-u)lwZeGg zF=O!uUoehHwvs8USt;V5cXsuF;*v&s!eT|(0x#N1Wus0vX3qIT>aad{2~3ki6+?gX z$Ni`H-k0uDm__mVd(L)#*BZ~+&P(V5b{!tf9Y1hmL}>MX!N_@Essns>*0$xlDv{I_ zWD1CYG1nxPF;)tc$A6dw#OtU~UB0hVg?Mbb!sl<*t}3OC;?!oJ%;|i*muNND2A&a4 z&mCl(tEBy7PZ>YGmSb0xP*~|%e;8=*ibc*kzY1U(^=#y%C?qCArw-)GNL3FwQ=Uzz zAC;_;H^ujFJnPX%-oMTrWJh8Elv-BJAsi0w;8|gqyKS7A zrcnz1qM}0y3Z04k0=?_{2bVFq1w@ zRnub2?6}BK(6_lD{bmTEOC7j^j>Ji%(a!-0+Qp+Wu8@k;ukC^?m0$=SKWo6MB3PkU z<*u|XcTlU#^qkLAgUo{Aa0zvWG8n9F_WYH(vcSO$mui%L%b9oK6g-tLs4JHoauYAb zi?u>JOyOrh0SIDm_2@mwG#w`@`*__NdV|k2TO&grg`405vfx?qAd1ol&>-L#mU_+# zjTF(zQkzXH`W8MdC|3gK9o8c+( z_UiwLJ83id)2{K5xlI^L@{%<1aDg%44)yS{bq81+o|qS@T&fuEG;fT*%rh>duKC zfaJGU4Qtn-Ahl9oW`)S2e(9;$03DQb+rtLWr;$ncZO;_492&6Wr?Dx@~9~3_jv9fndbcHcPZch9PiCjUUsSCY%~Cx5?8+93GHf z-gGc<-7Thf_IaSDEwzOi8~l?qJ;EnSYL;ig72^{a*CThdJV$qC>u;oDR`5fj|8^bH zQq1f~^VWM|zp%Dh@T@2NuCxbe!yHTKauZA}bav&jVy17@%uN)yanC^vBA~Iq0cl6A z@Fo3H7wZhdl5B9{V&>(3!{N-&q$SrWus``~dCX*RS+%F|L?`>tx!rSu`#mx<%ypBG zTPn#`Spe^_s$gD*+@U$!lhc8v%kXt$B$w&@An_=FP_a=v2 zcp_4E;DN9C2EItto%dc`ZovqClu3F#puzxXPY__2*2;zIErcahQc!v z*8APItV~P0LgKh@eNzJ=LaoyR9mliyeG6zgPFnk$x?G;{W(}0Ad0G~kN#8L6~ zE#EZFgjTS#9YBRe1d60xAzyYd0sG~MOn=5s%{wGW4QLKuTv<*W6>c)8bO|D+Pp1tL zx*=n(4qH@cesV&FMj@)yp=t)mv^Y%HFPq^MR}U|FZftC4n7jde^m%Ra2Any;9Zee% zSMxvzs~;FkuIH1&g9N-8cuoRW==yul*xEPU?cTi|#UB(bSyO(_HVAAV*@hjTPxAD& z@c)1E?Bs_4VJpc|yv&V0Oz|$3wIQI3D2PBY>b17FApQ(l^=8YbJrKcU>${T*v75 z3vOo91?9A{BtqT^KjPO|GPQb9@Xy@AN7vU_ds>KuXeW|lkD%Z8j?IIry6M-*==oE3 zN)>4N_hT{MQB@ZmRt;kex)B z@$gK0sO!xd_%`?WyolgHt4rKA)NP2mfqad5uSN+>+&PI>c*eUXU2TD?b8wvPKA9=% zd|h6zx$dNZ59U3WnYP!CT>tQ~K{PH8v2}D_|IPB+qvvR`cJY^l^W#0Pr(&VTk;4O> zUIHws6sSUL$3LYZ%?``$DyCCvlHPz33y~Y!&df5!`m*Ixzql<2K&$FURE{+6 zHoVR40q!rlTqpt0ph{mP^fsTfT@AeJ(wviw^zPo;DL18G<`P;k;l#%dXL*-Xl7r6l z&CmAoPZs(jlGIvj`5(H;V6obEodTH3GRxt9;40(lY)Ac}CjXm<6@q8d3^u~1rGmBb{b^j>bFeyy^ znC?;v@N3dTre@x?iBmPv1kh#2OdAd^?*UaME4j_DO2(v?8eEh$wLmZA=7K{G^z(9@ zyvJWD8+AoAMM?@#yFG$VL{IEM-9hbK;zZp+-lbfru`$&lFS}ON{R91&xu;K!bBB86 z$U7ErfXw4!%R1w0bzJ$g7XOy}Zo5OR@xQ!gZ}XB+pR}QSr*kl$urgl)EdOi2VCD5J zn)XmS+)BT#`<^HD6FUg_{Mwxp0 zEkEr>du7gpzxkh#2x!2OAsLDV+6BCB1J8;t;5L}wDp4n7X#{PX* z$2g=yfKw!X*U@I@63hmzvvB>GI-Pj7;-x0~FmQ@V2GvF_7LS44M#X2xLchT~9ZV{S zl{a?XUv#-@A#2Fh)Xg&K!&`QPR*Pv9Qabhaep9HN$1{a>1(h*p?Fv!{l4|36-g)V$GV~*xQDZ8R$t*R?129?8;cQqI2@Q3SED%k) z&OT>e5j3)osW)XvheUvsW4Lr>NKkj?Ujoh{LEG=gB> z%v|!;>lC?`3{@w~^b#$Zo|!P7+UKF-)1WJ)q091&G?O-?5eq>W#qCExX=4u-MmH%HN`tdix=X|Vx6cY1+bkAis8h#U#5~zqRZC-h3p%GLsa}Lt_JOr zV|Jmj_eM*Gg6HC-y@KmZfQ3UP*;(2lO_uE8;JAQz!ENnFPw=73!_FB{`4cj(9}vY^ zg7-r8JH+z2V}*}RrpK4&+u27=lK;QSD1(LxoGED-P8Ib4QxAa^K??dAmZXqf}~ z!ZXMGt%`?mgcf6srY;AgwLEi{1!e{ApB->lUpOr<^3Js}dnLjNsX07UrZANgo5+${ zfjyPO>fhK!)dw-o;va0nHSy5QMh;~NQv6gH@m$8ay1{ZCB>w>$G zlY?KD{l+Ljt!6EnBA%OjSG$U`3(q@#1;PF&^wV8$I%nTmGM*9m6@m>@VFf2l384++ z#>6iNL59Qur^qU#bjlBSPvYn*n5)YEf}wU1A3BPF0E@(*9uMvA2$ADkFS@`b$5;3u z#fE`n-t;(oj2j+$SY&O;go+m%#dvbYB&Cg=9g`$)S_tdU$g_v|&-CY{92~{vs+$?* zfN@iI80IUv0BkRn58{aGOXFE4Yw07GIPoUGa4e$Hex0W6S&}5g3K8VLuPq{IWJLX8 zo7;cHyi)@f3d$3c#$?UnHHKV@`>277T6MZqGFYKUTx=@73u#dyWN-B5Bi{2YWFQj6 z*v{0LVFmw&<3rLVo?@VDB8jOx=Q=+K-+@kScu$vm)dzdH7BYN|JMDV@n1b4%Ys zJFy{Yw~S2IA;Stl!O7y#)S6XTskAsi{usyQG(YRVG&!-7^9k}!+C4DA8p{A|LWbj` z>dG=k)-bPm#S2Gyk9ov7X{Q)jL!QD{01&($_I##zOL(85n0p5|RCTJS?^Vr4o>4M=G67gGu>ObrU~6HQX(^ znroT?#)VNu0N`v$EsNJiIQ?8yd8roguE7Tf`=B5u`_#>SO-L`@4r_gs@bJhFLy!7V zZB_qAxAP0`h4GjlOc^>;iaEr0 z#w!}Uj4p0@GerntqNh-8(`xNt<~78*5t3k5rhl4OtKSBe;>*QGA8~+dowCFmpBWOI zP;-jzYD1-y`R*ywi|BtMv2>rEhQio@*^0`eCJLvi8I#-AWuvuF4NgLxHXtCoOeP~% z@rCZyi4mKLn8k((KL>;jxh5H&2)zGSGFb6swZdbd+k>R%)mrXHzsjsZ4qKV+YDWjv z-?|KZ)j1Gu9DZJ+W*{h6^eKQv7YBqJKOjC)KGZ1R=W==8u-31q9wfXSfKD58P0cS1Ys@RS|bv;um?5M^%KGr4A*?+z+gGbMx{tRg5k2f~})a z=M{HfpU5Qm*5si`u!-PYz&n3I-%F=zTKS#{`10AGau?jMcDlv3ZCI^O)Qe{WO#$}OPEe$#?ew24W3wfTaVW@wZ*h74F zs_*039m2#zo=&{wvW5MG-28NX&!blVg@7T7;&hB)mx=4N&pk#CjG372wD5?@yojq0 zNcm9ktu@n9sNF!qW;{5tZ8j4>*RD<0X!#_A@=RfTx1%>=op`<(`1?GlvggS`qU+oh z4#Wi1vY=}25VD@{R?}-<1>YM5}P%kTIt)e`ffP6n?%;Mm-)acY>yhS1i!luC&Y z&JN~|C-h!y2?uy>} z3po5;KM}BW#|!^48q{n?W|jaWh2JlpM{;K}n9OtCy8oID=0Z1?7kfYYFCI-lR6lm5<=7+1 zuuo@=mB(*a*AJC8Pah;{C!oVP7kxAyx6~Kz&;{D+#(h!}<=>C_O||tB?Nu+AVr#ymgBmpMio9RzH+GA$8qH}8YOakO zO^)4fZ7HW;KADZHDWeXDG$d334*3cc(#2w9_j#&Pz=;6v{MG(y<6{VI?j-6_Y@9fG zi0^f(LE{)OAHQ>I$p4Qf7@w)pwb)!SbSgHfl0rXwU}zYCHij;zn_=1WHR`y;Tm0-$W_w_=i!rToEdWsyugEptZ&uRVLuB6VE0W5h ztPw0bKgC%0NO$B~w_}1&lMI8D^U~_|flJWh@o6iU*@q0$?e#PyhfJyBTuk`GPDJD$ z`XDH_c_!yHB>hIzxNZLGrY-h_T7ROkc><41WXQ$m`W#06VpR7ImLBuNh*p>fOJP*K zKDjxRt(fQe41yKzZx%p-Pk4Z8KL$j=w}!Yg1b%my%+_OO+jQd|?H8%( ztE3|xxdiy3U6S%_GH|ymB5i!nSN&0Fowwon7qvg5!i3i$wX+R2qcbMPte~_5c=1-& zz?itCbEXl~2A@nYaaW05OZ)52@5XF(Ru1Qs0_aSas6w@asqlejxJd1}WQ2Lztz(fF zz`|ql#*Rr=u;!=sVl$fvqT!gqk1wR7{tB)kDqznKTI9~_E7+sqN!1RUG#+KOv$&Q0 z^Rjk=%uOLeoK?ET<)b7`lRHp7H`K}Cdh3|ZBH7{e8mhI2u0r9n6ZX#(Etz4AAVY2; zI&L=$ens|}I|tQZa0CY;iYxqSI*;wg!iGiJZg4cGUxbRDg$rI=swT@2Bqgs{#?uXB z=`U<#YsM>>N&N`L#Y|$*deo!8=9*1`lD0zoG}S z;|svjPHI}9px~%6@d_d5?$tE8Mj-JMo0!lY=x^OAVJ zWJpXAh_M2zgriWwxJqm4n4x-b@qo!whcsWoy?U}TPaTCb8bFKqX;iyvg8)h*b)M`Q zlkSpLKG^nFfn!X|K2L3$_|aMHMsK-DluVEbD1L{OYTTtXzHbrJOTMmmA5haB!BUG9 zA+Mz^s>l1(bpK5yvd^Vix3P2r0M6cV8I<(0JEw}(O|%v(i0#9Tvm3aK0XIR57DsGT z)gO^~(xda(Sdj4nn3`mS^18hX*&bp!B6feEsc8iP43+AGr*OMZ&aVhva;kA2_c^pD zI8iMX#-Y#7b|e-XbZ-n+yuheYKWz4p0Axt0{WHYs7P{5x763^Pfy+Cr=%vd8Q?C?m ztN|F+<&p*988ybR!zRNgU!ApEihrD@unE#xKF=-aAk#+M%7>LDLT}~HqPy$v^RAn) zYWzZX$@$+s*19U#VO5PejmCDn>FT0##j>t5)WIINtZm@lQ@8vsPdY8BItwa*7R5sV z!zZHHHyKD)b*Z=&kpJ%Z{!&Fy3CS_sQb$WuZI`t~q{6GYo*JXnqyY!S!9~hnlHtY# zHH!0kdb)KG%cz4MnvZ~R6%atSmA1arj2X5~@O3C2NN>S*h;*`Olg(Xll{G=(g3}fJ z4)U-R3`#o0&zmfOdz&BiKh)^$`UzP4Te9*DNcmE&t?kP>IKFdYBV6aky72GFuq!su^h33lJHsw2JG9i5Y%}vaEKeNGYyNu7nhU!QkV}|$Rb>s0U zT0M*IN904HG5Z6g1Fi0Ym8jTUh7kGiNMNzeo9d)GL3XIu zD`Yl(F!CK7OLd841c~Hr`Rk>ZSS{6GIN>0*Vm^jba%i7+wo$1o?v}ol6`^ueq97Pj zf(DG3+K82Ow`-7+e+NOrSm_}i%Rt25xj3`@4!&GK zAvtuq4OYIdeFE#)qaQ{^+De5{%>YMDpPOb5V8I(gY1mT}MUnx*r%Sx_Ol{BIY~;R( z^J<-q;G+-%j@HqNBS}Asbk9!ii{(PN<0XVo6r<^f53lv93xY zJl;QM3ma5>F9~w0)XupDtcujoAL7~|8s5A^r}@`hj7iMcq5R55} zj7?HbwYN+Ti@n{3HwuS=)1XIhMwJ!dWNCesr3TxI9=36D8P}R(hjPAPbGo7pvPXS~ z(7t)8;Ingz3X6qtqY^)0b9{HT!o{3x6Wn!}dN>fdZeN{XsO7h9uyCWY;OUtJ*{3Sk z@cE=tb@m(Hk9cjZ9?DqLDgI%r6!&O-%ET47l^;^a0iL?vfSVkX9iN;9B}`!C_zJH9 zWxf%_C@UxgV8G3999({&qaQhci#l*hv8Y1#?L6CK3IyQK(5;lx3FR6c9j*?h%aB&U;gVyB>WNiom*H&tBZHIQfdOFS z?r=)%;Ncuz$XDE!3d)JGX|XOjWZ=2ndjokFTN#pS9V4+zsKFZ?Vh25IjQAm@5i->EExxZzJ zEb`oEZOQE}g#ge#K{{CTxpQPbw%F{9Qv*@(`T4rydPN;A3pY=O#fL%j; zt?A0m)y?55Do51aMg~&t{XvpH%r|2C0ixh$XvinaC<6 z^?^a$*drAmC+d6UW{Xgc$xvmDs78q`K)iEGltinJ#(S_J$=2<@(x3@Wy3Qi%)h38G!N?9H6u2!i+u8`e>1~D$>+W+xc+btY_C2Nc#f)dmC1V)R@>* z1YN#RDExx>LZhWcR6&J>;mFv3 z7T{9N`!NbTVHQ8CMHAL~h2W?kx zI7HcMCON2a`Y+mQ9ddeJFCZu7{(B>^zCmYW^8tGJnsCJ{la-mV%LZr9me!TzTp*F3kA;I#UMn5{I=r2*)Fu4!$mKJdPSr zssL+wZZjkvU7*kJq=R|)z#vh9jjB75?|_t>)}zn) zCtYonES>EIRf}2l1{Rl|kM;x+UB%{xD0Bg_GT*-b*4f!#_5mN0C%=uTtUYQ``v>k2 zFfkKlILb-ZG0!K~F9<2V2L?3xa+V5&QKeP2izjKSbaaYzQnu9?wRgj~r?(#OAO?P5 zVpz6YxCrhs`#WxAolm)|`eqgZEI(96?#1e*T$WN9@=R%}_q})`ua=agy&*u9Ed*;I z5Ye(HGC2rDUgu!QDHh+;8iDj)NqDR7>AW5Bpe{OdCT$I26Y_w~*fsX?Z;s+D>Su;D zH;>JMLDbGeO*QAa_dDFwGK@!iS@dFic{~a4V*fO%MvL*Pl0Y7m`S6ka<0{>2>f)xtCIh{iuO?lDRLB z`CNM00<9XTWXwRFL_%ikBmMi4Cne6oGq{j=%uc_6sPYVC_IwQk`;AJ2frQOakX+Gc zj3}{tPG3RzweXgl%hdtBdxVeOMJa`KV`5?=6~trgX%RqW$%i;DS;fU@uxd2_8_Gby zr#7qe&z@z|+5|lE?b-39Vdro9T5^%v0#QI3CK#)l7YX7hr-Ix}Xm6t<$A<nk8hgk#J)pVBOSKZp#qv2&|m<75b{YS1rQoBdMQnag&3h%HFQKcQVtn^0S zU&DfpKOR8UzI4f9v=NyEnbV|TkzzWkI~7HidD7H)|2C-J|3$F$N5R2baZk8<4?*xD>ZFO%-gP04#3wD->9k?hm_+WSO$PR)7B` zfWe4&j#;RPsB1Dc*%6b4Lg7}yWvC9w5U~q9DM007_U*oEcNQsMh8J%;i&l%LmBJ!==EST2mKQ z9}$8EC(S=~OmqR0zK!?FO--w_LL=h7RY$0k=pd{|hqRA(S{a*L#+&^MbmHHD#&D{8 z#~xwFQ~4M1Fb`^PwABT7FjXti*R&bC(xdZ%;U{kzd`)^F88ff6+;_rW$Udk{y5?HB zf1QPQBiuU@9H1(#F8OfS9EybFx11C!B&I#ROVyu?E}SJ562Rcg`8x>YZiK-iop}|ZHnjtJ0l0t3852$jvM9cvMp3v)y>5@BD zL&ZI*%h5q9DJdS2k9$naw7q#M|zTMG7i%Uz*&(#_~i=0Mp6 zAX!zWN|4_PQ@pzHSK8p^hG0uvi9q#fC^yd$? z^dol~o=WLxsfOdQ(&j)?LM;-zRbA7y#38?c3}Hf+1b)HbVB_(1ESt(8-FJgXR;uQ% z(p^Y{k8)k7^=D|4j7ieqW1I1e8?g(}(Q|1SBA5&(bdiieykpT%>|?jW78>jT723jf z=PY?o>Tdpt3cb!1Jk&tDDQ{MAhfGm2P`uq+&%`NrKrckqPO;pYb8{wgw*aFB7Hr9z zlyVX>xQ`yQ1momB$mrDA#f61qi&<^8F<5BNY{&MQ-pwJxA}*mKT?Ce&UJKpc*+EU)w&36SrWLod~nKD+hWX~zn1?pqo)(I2LZc!``o(5jU> zm-qNSAL7sC_R27`zCA8xUOyX->II!17#b>74>-qtLK|&?Vnzjq((cvfuXV8pu=Z&w znRcjxN=wXgLQ7go!3hZwG8j2;!7(l<<#W#dP?~_gCISrn-faOWLpal$1c0=lUWycO zmy+WguD1Ig`{lAcyU$=nVS$RgtNNeIb>Uh(Ttey5c?K;;U1UuTV@C7j=A zN*O^|ot|6=@ppH7v`*X}L?sghJi+n(4|HTv?B!%k0IKfmPLS#m((6wbqej9i-2)dz z4C=CoV+pE8RIy4=(N=OUGg4n8^<7uj018>vy5Y;|$FfT1!x8)xwnx z+`BL+Q^|%Nf-o>LH0_Z6z$($Bc{EY1&cV9PR}H>sf?R(VDx+`G6BG7TE&P^LVul2i zd4-+qs|>!>%>AYBXd9(i*-lLK)L^7EC1b+?s>s?K5D}7osm^WY5UNVeGc9W)6x`+` zJ6)|sOGA0t_SDt(PWwJ^9=+OprNlQIT{9KXz>JU=>GaKQXZ<}dRp?3#keGUFCRXsl z@u6|&#UAj99yvmKJgl+Dm8dGq8%q>hlvB$&Jc4=;knL|`X6rODaT5@t|6(1DcY)vc zB9J^HFk^1gN(B3+=*m*V^&|#msRAs9v4b@=nGE%hHI6bvy_*%Z(@>YSdgFx)SrIbK z7DjcKOaRb_cAE(?R)g3yW=QF+p?GlaC9{p~&Y52)riOfUZ)*hxbq&-wLkIbv-k;9wO7Lqn? zBf~M%tvELgE2Yix0K|;j3~s;@;M8akWG1e>yWd2c9}Yg2RC?p$`XJbl7nyR~M5Mda z+m~0e18?YlB03Z{TG+c9m)|T@D;8v0ulutMhe3Y&6?j-GP4`7%Y-H7+Z?;^V2owRiq zyTZQiDXMMo%-YKfVSAzF#NNRh6u-3UrCFN!nymECOxsd)!%O8!v(mtSo{Nf{)e~fP zDvNxcm7F(?`1+jeI@|3~T#Chq9$vnbGvKggxdR{N!S1Q~)b-)N&CpZ4E_V{bALP$X zU%EgPPC@n^+cIp5x~^HTGa?RNeGG(b{=fhNYX^V+H6}?f9_ar1<-e;IIjr-lhMO0T zY!Bj}_fS~}6@jgaT%GBV*~e-%|K{Df0KZcD=%4=y(IoYG^h87Th4XtmsuxQ648byf z1+U+?VYjPt&vuG?=7FgtWB!cqoGU>~(fb}YMf$WEE#yJ14+^atkL0yyHF9bTWHKX~ zubUt;aO9#A7r(FxRnq)P@^OB@xV74cp({n6YR+z*A6et?cd&;P?Gx*Rg`mh*cyubnae@(LW647yOFlsr zPu4Lxn#KVmi;~O#X0*?f%dZ=7+Qug0vnoR4!Q_Z9C$H(vI|LJ>QS}5AX|;uLb&yyx z{pM#$^6`XQQ?~5+f^#*(K7K{_d}jm~5_$I@`e-Fw8zQ{>pAg`$Uu!Ouam43}(uvub z!jq>-e{Ou4>pKvnI7;uO`y;<_1vpB6&Y2!#@$tCc*}zg$`DZ=O*VpZTvhut*hsQ|A zStR4)hN@RMrJ!-Wo8Ni*MMr$VGJ%~_>i6+Z)^_0XN=}X_mD{QkoX*BeVVnww)fiGz zAQAq6x(+)yjTx+}l@+IB>Lm6&Th!U{jh5RvL4&Z0j`2ntmD5TbA;cQ>LYUIAwSiFM zvN6P~Q9#ivM6H7RV!8B`4#uIu3o{f&GwE^WeRL+VFY(GSze?&|-hx{3v&D_s$JVYq zo==Ioj8heG-&8cKf&QBeczVHfP1y9EzM7 zbyq?Tkz)tZK_iFgrqo^C_5JPlH|(>=b-l0m>-BsRTMOQmSbHpJrRLM+$eTA&d)LfC zhU`W=5yPG#)}*om{EfuQ1LU`VDTBH2QGoKET!gcmi&VUniB$>DHAk?Vma4$6m(!nS zVeZX>W0mZ0x-KwD846LXoA9$i4OoZ8AUe*=yG(E6e`3@#l_lG6BQsRtTN~8A6-PO& zuE@W9>Nf&;D)QNpKZNU|WP@>+*QxqBQ8n(!cfA~GDp6KWs*)k~o%b}(`6{<26lx5s zBVcs$I5H0i^K8VPgI$al^GQ%Gwj%ImRW+KIF+6s1E7Y*Ss#Y~noWs77Lpq2;~TN;NA1t)PIqU(4E zA|-I3ZeewKY}XN8C0o1V#a-ezp+UM{`d1xk4Drnk>DRymXo{|fMt?ShLNOb>fpIOgOBMU<8Y>XS2(p|H3Al+Y-piZe`$%W|!jvaXfYWJQP-Oyq&1kY_k~K zWqKo$j1gJF(!`c(=gI^J8YSl>BZI~qavqwmmWQP@UOwGuJYZ_-ko9R||KZc?HmNHt zGIK&fk9^NPW7(pSQQhvdWIViBS85k}V=gV9CxL}WjH>g^Q-4twCI8HUM<*8D^?{6C zkIvUtI|O^wC4PR{sL27`ZBFV-nT4PnW2y)-UjFa5JK&{T@@^xd5nOv2NqF=~Ttd8R z+Ic@-EjrJsmm6m?$ST+a@iJgy^@q{YOp=|~!X3-EEVA+;;b4l4o&{7*Cu?%K9q9;j zVYjy(-K{L3bV(V)a*%%5IQvu$y5121HgB!zA!)hz*@OxFo*cH*0@hLR1l;l8lzqZe zVd~N$8FXidhEJ)e0WN{j@JX)>iU=LHfMUj`ZN}I?91Q$8>;Dr2g`aRJe!}WsxXM#( zlzYG4q59FVBr=wYd4%3%UZGWjIs*UrEj5dh zA1Q)?qZj@Cip`fIruWeEGW2fWmXQ>KR<2u;8c2kac`9-VX`rv5M@PDtuViw@u!7Cz zpo4lF<>EQQx2`R<@YzH2AJ^AcuAQLxZxImY zBV|}Q^E+>LnpFlq)t}CXHFwU1;b`QhG6gFm?AliG8ou}wx+Nv-B-IX5dyE?&F6O%p zpNjRlW*)p)tN7y1Xf$8hv|%d<#$9>in&vwie!qSnNLPjP_~Ipp!;Q4E=i(MIOA;Qc z^v{_ipv0Q%_nmm*^zy-tkRMnY_3c$@2^z@FARY-Gar+YhGqJu>1aDh-I)^=*)Y$u9 z2U124SXxk^kX(E*3oaUlg5A^^M0nK`d?iv=!Tr+0l?)wVi=n6Vl7W|hW|4kxKR@P$rk`;0;MC_jg; z_>v!UnKQt5=@J~C>4s9b^g13MXcQ8ozD$8qa#37BFKnI8o> z%wv@<9KR((q19|a@xU^NHxxrFz7=z|m$@=W8GWST*cbq@rd(-D9rCW?_j`CaKD|E! z^v$}J{6s>PIhB*lZR$v z8^)3m7jW3w!ukF6zj>dKZyV@4+kO{9lkGc~P~^0JSZyb$`y{)QFMg$Ehv3qMA`l`Q zauCl4yK7ad-bG>)fj~6JLe3rQ)pX)KG&5vRqIE%&8!(g&@%J%CV*fTvYGN8)$rEgiW^GVEbH!QO-uD`5=E zY}gt*cg8B-(;QW)n)e=Feb3g_&Kc|n5%%R@I?5dOYpM@tOwNDYG>iOgR=X<7py2M?9yFTQpHhC)X41p6Fd}Yw7I% zyOIAq+ih74(D0%9uk6@-$``Z5<*C9lr-3J330lp^xLR8qDjzGb>YvSj`5FUz*^3N? zK|K93%2XmM=EDqUWUxDb!_$f5{$x&p2~ignXcVKVTQM1)-j7Yy)qkTDaVOXDkEor) zg00lqo-CpU^}pFn6J4MnCKjEh&Khvfz}o5_ny)x;(lWVAz3(59rQ_N2h-rk4XKO>a zKXBN8yo7vOda;T(*LCTi#JQGnbvi4|r+Z5O1gg1#torUpfBG3-=#LZzR>m_~z>dtV ziP4WsYUwz7cZ)vK;#U~XgzckEn=UF9${LnF|7G9%hO4VuRgXmPDcVbnOhWFRk3NP= zX!hSYT$zvokje10ChGUZc307+d}aBXAwd>sr2O~GZQCl7FUJeR>_ zVppJQyLM1tdbHBy#fyd)+>fdOFm5lq9cSi^*ykqkp_@}GPK)@+9KLm-5Dr*!y? zvbE8P$B^HsA3a0+w>J))Mjlyv29~t9d-sg_CwfPxA%Zfm!GV2iQCLK-|m z`2Oc#3gtJjE_h{I4YBIL3AJ6D)M0#^q)eznk!)gh`X(ASh0XvplU}NswQ+7Wn&nFA zNW(;zY|_tJISUdd4|)9uGP@3PN54PJe+&$mRRB#|IQZA4C5Z|Ow~jkWtrmO2N9yO& zeia@ItmH=cO<44A5#?)#z?2V*4VZjd4#q>P*04aEzgF|KpK2wa%wmUzHe8qaj&~JC zGku}u)e9H^2#=-Z8Dxsy9Cc_mwd|a_@>!%PGQX&+KI+6UdEN!W>y7@S@(g>5?sw;o%5H^2#LtZHGJ3$1@)*PUHP*qgY~hC5QZAcUHX&K z=?N>i#$b^7-Fb2cEJi;Iuk-E_zqgK^^1SBy_V8S{3g3x~wO6L12(WJJz>FZWE~5Hw zw+V?lzK48eIIoN8wu3ah1zNkhN_+rcoV2T!6hn!l@?I-Y&Eqs!6mhc{)g7=x&b>K* zrkpS+w@|F{BNXXmoIzoa^ThP*V?|_iCb@tG1>P%o8)@OZz!}bOG{G5uSh%h0leXqI@ou5hM}Dziua|cOS%=Q05gU{&7w`~6x6g+A z=fuwp8OFE)^Fru=!ccX>e}!oYwd_97n8%&Dr-2#Er7o|t2oQ@ia9cKSD3a+}kU>?e z5%umI(tFJ0Y<2B}!ahb)bU-)lN{LC{PLg4+%GCJJ&RPXFVN|9L*V92bG4i|7VMag! z4bokuB=SW#Papxa?f~-6Hl~k@Fw45LG>VRHWx-2_bvB#9Ss8TSH=%w5tTg$qXqQN>!c!kF3?NJ2sGz})GSdf1>=8-ytPt=gXX+|W@};L-0hmk5+m94=y=jw$_( z%>2Og*u6=}6I1_VG!|WuyTiO;s?swm5gD@P@MzEAFOqw3knx#>I0D8Q6+=Kj2N#7)5$_#Xm-&bzFoIPp&rrohX_0;G$H zts1U@5o-pxHrc6XcgrhAchn<{ivw+-*^dJWDDCG+^|wbTWZ>RKXu?v|g&rONdWcgF z?kkdkcgmv*`zRDm$_i|e5J%S74!Q#Y>KtvG85fPfGU@0K-{Bg!OnkY6Q%}sA^ZV!0 zAwZF}?Ug2WIiUv_)Sw?F$*P>BO1MQ`?GJ|ggs1&<0t7<@Nbs?``X_>;4l(--DY+S* zqsFBLUs*aBIQ{TbGQ>87%~ZvSp9KMSiOTOI_kDI1XI~JlZ5l?_3)RGUxC17_wT! z@P`LQqnbTmg2R{y?jX7D;wbS~dgZn^76KEnBcmAPs{Sie*{okQ@ewM1KVEWWc0gfk$%entallB7?Rw|W_`$R!Bvxn) zDxo}faF(Zu3lfq3*QavF*~12R{khwnPqE9$tIlE}=V-C=3k`pMsk2`lyn>6L zzc(JQ1{06mqV$L7tBhYrIF#+UXY{m!YXYIXpyXBiu=lan<+;Jb#PpNV56|<6m^|D9 zcl<>VI|PCOp^0t8&Z$32tmWAoEc3z4ghr<+bPZgyDvB0*NvbJUW`yo~WJmO_Jw0|#<3l*3vferO0ZR!22v3Hc~#!5q^Gi5gZotK!+S)y>0 z!!G?D-({xLFQkKBQLB7@@rI@n$dq09_ms~T{-7?MUa;%eW6+XY7r<#7!(3F(k2CzA z=+uIa^t%hrTb-P()6oU_{Y=w|?f0nHG`I+WUx2e8fPUQ&kQUC~(X5n@B|)4bEwDX~ z<0XVJQmZ(F#yo^s+-(Nuy`228-3Ns*^y(A1Hu|*s@luO$Sy`HW;A#LlKXRRnSMTXh z;51B3tCQG%`$CR8@*+d{t|rXqo78j%2;h?=-{6$NwBkxWp*Gc}TW8MUcyZQ(n3f#z z=HpfoOO&>`i7=<|o{`h1=Dm2WK>BuYQ*5d)SG z`X2l3NN0rEqj^&`k(F64g?<8|2nIdF({NY+(f!?!PREsNhd-?pLYXV~j3|Oal_g@G z+v@xPGd}C44+1?74yCS17Uj88LI6ng-9m z<7!H1t7}I|*vki;j^O&u-%W+IKs`;0FCDah{3g!k6ye>A@Hf6U$+B`kLve=k7k_4# zG@0$6dH53KZkl`Z!x_bSvu?&f&p&t}m9Uz}c? zbo0I8f?A2bIa}C=nu_Sk2n8mTSkZ44KRMlV>4KmB`geb8&*b86mza@^WNgXk*D9~I zvW0}^iR4`U!Fal(%E|*(m;Q4;zf^Czy%_Jg%7}@Zx#pUa;dy;_uUNvm9pwLhUQ_pA zJ=Teq$NX<|D*9-H zd9Q(60j$R91pYLgb!hft1b%nR?d9gmhi{C3)8f|2bLFW!Us>CV8rL)FPneGzsXsCi z;{uJlkT1^4gL9Ye+;u&LsLaSrKE1>ZaVbFDn=}0x($W%t?8}4xDhZu#e`HcO{ca(; z_Dw`+?45p_7$3|b9v*%3?CAt{8|!QCjq(49dB9aZdW+RJ6gpu0d~p$UAlikq^)e*w zJ3vo_SznFwI|j^yv(}Ddr=F6htAky9Dd15Y`;2Sa_9 zEz$ARiXATkH(v=*N}Nb^|K|Rr8R#`{*OD0pu!%8p{5MPRb z8aq|`vrts}*4oD|uzVwuli?@V`0b`l>DNCCl~AzU>8nweHSO<*l*Cp!_h=3pkA}#d z-MJ5IFN4Ic-v`7o4C3j6E%)ZTKvaZfN+V z8GoeJq>P!5^xk3}o_j93ijBQlv1R#A8Ct<>iYxc{>}iF#R-twCRD~lD>!sN&(@Mj*6n-RSEK;UU8UG2 zN@!)7kUTimU5r97xj!j9p6P33s!$yH6nk}>MOHcqw3YeA(Ia;e|nB!ai2dH!fETrd~K4QeC!Tve(WDn ze!dpScKZcOvlJ4%PB!qgF4*5};4A%-{!{>c0`s%FhAz&r9>k$BmpVUkxGlc5J;)G`$pcQ#fmCc+2W$oBO7$7!!F`K_&H?N(RyR zv~If23-?hbJiSaDG&O__DP9lWw!d+xZoid|yp|NH%~m5Qg1BJ=p0a;l@%kHgvQEzA z;gmVe=9ZUUZih`PW|jUYB4bw7>bBUk{WtOd6C<{hPSK1w1NGv6t(Mvext=zu^MEmr z%-dr6pa)>$FFkbakYWM$j!lQ<*Cv^ZJoVRrX$VZwM1K0;meb$^$aH`nbx1YpOFvKI zq8z1?+W?P|Np*QFUnn6_uB#w!$n@i;Wg~B`+a^{s*N4ou?qOV2cS%?>(3+J)xre); zYhy4nWn?x&)7#Ir%TDo7iW5FaC{8)3-YA%d2VPLYK%cXh{UF1ihfbXu_z#y^oLN)a6_?aJCy>poUH49W62n0?n^|MmiZc3~ z>08;o-_gDh7-kvOFmb}xRJ#I=D%&VKHU;Klz4&U;1BjU7O*^~e1uLh@4)2I$i}NW4 zBAk?U)$NnhTdyJ+)C$kSMWUYB@WdCOPGvTaTy#;{>rZfah$qNngPx7Zhfla%kCQ+) z-qY3IhGU>8yZ0N^qG~_))6uo|3DmH4S>$~pX80wa){xnj24)kw8?r>`2_E&e)|`V; zApr+JMoZ)}@EIP<5if>uQ3bD^4>X>+qw};(Y-CG$$hgnC0L()SuiaS*ZR_Re`y0du ztKsRKdLcc>Q+4N(%cdiEAVgJNDgWQ*p<|gYn7pk;&LLjJZAUa`BFsppjLis-X}{pl z{Ai+7r6RWJAywDjz7?)k5Ato2ZMp$yFIlH9WXYQpF64BXdUa)5G_-EJpD?W z#2X&M?y9btldM;c*`2su{U+BTR0mTMx!fM=`dW8mC)%&cS~m8DqUbo> z6Fcmcb}Ba?%!FK$q;s{z%X|Iim_K0CoR2;tzX(Qg}#JqUX$a=!Ol_AYGB2-reho z=t~91-VKKIDfa2T?6j%(W|{-kK;2T9uF&XLWBbNSz;&Bl+MXIY)ccMa;BAn~Vr|p; z3y7i1#}58})Mv7M|EPLbx9fi{6l(j++$4mLvc^~dCvq6+bZ=RZu$MKTt`DDy`zNt& zNu0&ldJa{XP_H_^3mkF`hgvqXkLNBrGV^NOFbfe}m9F9|vD=RY_xAL@&w{PeIpUc$>G(yMv{xDY-18|W(b>jz}zLbb~F*`RLl6MTpi4nr(wH*CIOaTpjv&XeICF(q^1Bd1WMP z8`iO52Rk0pbyvv|ui8^_x6J`8QC zPSA#|Q|l8NM?Bk~cNS`CO7!q9fA9Q|yX^6;r3=^9BvQm>v_>EIO70Gui%!b{`|-FD zEKXfJN6J-&r>k;1(h8{72#G6QnTwEE>$M>l`m}QPjS^PYPWo4?D`b?M6mVrvFXVo` zVHPeuV}Z?Pu3@mVvDPKWn`8oF-UEe%w`TSzVZHA`#L|`OciFZPMmV2!1(@Kg5VlgI zb&1u=0LuEWy8|)&)%QotxWwue$6_5AR?wUZRG2iepS*5oqn6OTS2z{=yagnS?A^2@ zM}&r53H}3V&`)eux)Wx8p>t{vB%HT)-7L=F-=ODkXUTB8tLqME`go&X5;hn~8k0gA zxou&I*EY$0Qx;GSC&!CB3NFw&LY#TY#2@(8-r150`rXX?@tHEXl;CB!$0kSZNMWJ6 z+VAnVL;nT%KD(5iUOfI_v238c>v2v1tNK&uhs0 z@4GW;mwjY2&BhI#5M^I%@z?ONeGExRpHRS(izZ0t%Z`^VOc91Zk&dUC`gw7Xj`i@weSq@L`Y&Mm`09J$VZ}nDqKEt#r~;qIv+q9?$K8I9MK;|5a(L#sgvun@LcN zC}=Wd$oHz@L&b&=mDvJA3<oi4bAG(i_61g=e?ANFYz{|eXXp88gsh}q*S^(`|gGAbj;#DyFwk^i>U zxlf{$Kx-H7`{~Q_dIETHjzxZ8P3}D>ZIKAqP!*^7F11=VVJre^#L9ZKTJj zM#Cy@Na{~yo_b*dS1bwaDDWjC_t63ymf2}_byEjotLykwg7Kg`z!rJ*@PO+gS`u6v z2dW-3#mZQUTBkj-P?L2mj51`Rv?S#NZX=eMd27v*_EmZ?N}APz%`72ax^0`bwjfsP zLe^8LnMLfL;qZI9?rK9Z#*MCF3m|u<&*vy7ILweRoF8z|Pghg+uKTB@{iov_jbD|* zp#tOYLZ-{(EtsA2Gv470JXAriT5=XubOvM#Fvh*oxha)6n67L6Zcg=oe!iMGEc6Qr+O||>=#ZfVCXDe2n)M0`_z@HEltRnpC$yjzU-1rdc8}$%nW<_ zLA~Y?BN$$O$GGrt*ZwP@95RX#`6y|z#9ALjGUoK?+~8xdX=TuM4=x01D&Oxq@i?Il zpZ*#FhkA7U;f$s1z{TSYIdH=~gV;SM<7dhO@dz~(aO~lzImCk>g&mjjQav}~`l|3H z!>>FA<>93r;#4m#N)OQsHMA+i+XSTxyKd?Z0J#up$x+kr1`+3VqYEHD0T4&#&mbKr z4mZT)CSFr=)3Ys(IqkReWB7oz05PMcrOb-Jq&OA349*<|EMbw=EiIKn1^`oj8p$M=u95ncB^}4ocRnyG3;XB;JU!jP($?J+pm9L~ z{)DMO_8pP)0vVQm3vi{tc;Lh+K0mjCJ{JDCG3>e)iIb7~4|TAgdb%cD^Z^Qv4DNJC z#A_fFK7zRzkb>JvWZ3SgM;1_^v@&F(b`qh1k9OaZr_Y66Jk3)~l_?bU;=%6#gv6q$ z$7anVPs|37PeWeQ7s?B8C`#d;Ui%wt8d{sp`1SXk+BF1%@K9hV#Ea*?@Oc0_{Dt(E z=M~_ow`DWzRo#q~kS!=b6RrpOjue55jrR*@lsaeVL2Me#r`X{uFR_|zOKM*(R(@LG z8jS>DkRsIrOM1ZOv1~xOg|pOUxu~e4XO)p6ab9n|*~K{LBONt1Xa6__{wy#ZXZ8=h?LLz3#HT0LcyK zScPK(2mlws4O10&k}_geWXbPbTfj2&9x@sWj)evec@bX9__4DVIZ;PX8aqr6hceHZ zbilYCgF>EkNphL*BfvhxEvyj|rJOmEze?X*s7I>eHB+qg#w|xtp^4u_h}+jNWvFf& z;!P=?PRT=vgIL;al9vrG4oSqF;i)pAqo);0Hsm_u!umD6N(HBO{F1Nsmt1i)1=+p{ z`QsNQYc!WaJSc>!FZNJouea?Z7)0G@nSL~ryNpb{TbeZ6&vSG-tlxR*c4WHN^{8k+ zlSJApMXu4bAg2B}USg$${(9S^9?IUPY;2k$2F}-w+g^xVna#mFCssTeJ7S_27x%h` z@W{;)I(Vt2a{wxxr6cI%J3A)Lx7L|pju76P54ks0HKjalK_eMy7`hpx-o?lVdlA%n zb6Tk%v<`dz^sE8I{7H{WM%LP4mG)XU)ru$Z;+xg}xzl^F1-Qap*}}6<*WB!uhY}43 z4<1^n^!dW57D>l8EtmZ~D8ND`e0D)gA+`9dIkO_a@~pUuhrjlZ$}4@YukU6ZCM-@^ z^#!n7yo7{#)ZAcIUs98~Gk`F2sD%Sc6<7fe=u)E=APlzq%w$Ya#%%NCc?5lgaSoaK z5(io?>#n(8ch_%A9(>@R7V1K8eK=q1(;!FB^5zMmW@&1ty;iosxHV))$Ei#;{c!D~i73;;JQ26YWs~cvQr9QxIu{fzaw6#M|EJgE zhJhwfwHyR;#BVLsnG0LknUqqggS;le3-QJ2n*h7bzpV)PFn*Q(P{CLAlefVkMcch>%^j}`& z*jMKBOcj+Oy2EiN=Z6uEAb@}PMV}sqo-$Na8%cqjv*|xgT+Q=G-b}3j&=2$;ZIJzc z+3_80r&_>}-%tZYLWZN5|L^1-q?A zvxdd~Fl3Ui$$z%mC9YM4_9Ya?dfejs#)T!s7%Dhg;Q?JfnZ15?e?Y&K%bT3ROIbQ4V0~RGpQ4-Gkq4t*ku9Kz8t=t@{tZiF zsLOg9n*8L>P2>j2NLn_&>3#`E|EfTN_$Uy!uYMjMbVzBjt`TvQjJgS+On67jbTx?iMYV3EJ3%fIV@)s+7`NWvv z-_ceO5QH<(sidXIDMNOL;neJe33*Rf+^u@9kPoc@gK`(E5MTKX#fv(y_UzO2F+f0_ z+sFg2i{Ha)?MoFy87Vs-2|+C zVzR^eFy}`zJ**X0^A+Z?*EK)M?yjc=|F$vT^_nk)r6p5$3YIEN?bSj|ImSs zyx`zAS6!fW?F_M`(HgUx_l7fb#4LMN=EiyEGk?Myb^x;_f@#((_DSrMp^tFAn%t5>DVQPM91Vz=Eu>bxLJ7>bL z;62R;H{(OYyR`3*qjCw=j90)o548#YipzZMT&uusvrdo67|ya!vYii#WO_7u>n!zI z>4o5>W5=0KZXdHft>7Mn{`c+RfLxOB6dn7w$3J6#h;ObE5~}VPwg*TJ6r*0B&bb`@ zU-lou)fRht$F4ufy!PV1)lA_4wUbivrbm23%C<)&SK6G{H}sI!;2-*hGeol@603ty zG@Cz~Wd^a{HD#M{;*fJ|_dF>c-aP&PL2}*p;>%EzO88=$0+|^Y&MzHTXWbN4?>@US zGfQT&2bpuBhYY3#VfAqMFT^{BIGCS@B1zDYIAsB;d9@kYji^3xSueJE8+JgWx`kzd zr9)&O``;7eKopSnuJ1v;D`vx<$Y0SLq!X9nmGrx;rHG2o_5z+xUp#pB8xsKYFw7e$ zHXk*Op}(FfjcRk*S4>o91zG)rRXBnFY$X?T7=77EoiaT1Z$TWA6=SuSiafw`jUu8h zh%Sn2j<`>pQRY=j!Na=J5PMxuPf9_VYJ^jZHb-0dSEC`|i691cFEomkA9uxF&IIXu zh+|pS67g8RUVEm951&w76uWacD@&gmjRH-r1zyH;wxEv!UTU-Ex1B%2NRxBIByC?_L86aZHTzZgCe5~^Yw2{pE6I~;$W zW}IVFXyfw{_TU_Bh(-C0GLcf2b+~jJNI0=r90z38_;jiVGNooVnBIQ$rE7>*J*@X) z{g`mj82OMYD=ti{_>AD+GaW*dmhQnJ1>a!_`v9c=A`1qx+6F#T^s;+>ST00O@r91V z9I&9lMN_<7`w6Tz&#BgMIyL2@UhFX^(siChC`h8${f;Pm+a zL4?2#ET)@23K{Mp*p3NBgqL$LpoVBpRa~U1%f+Sgqgqy-9Fck}Ik<2=kmzjlZwkH) zG*BgI)jVG5iVQS#G7)o-$+-hKtJ@dp$HDJE^Bq23Za6WC(5h4V={C}mqYNB=*)*tb zV~cb_-q*<)GE+7i)UIaJ?#c8Q*aY47t*+m|4hj}I?MYru3K{(NE9BbnG8P2^iqJ@? zdD_ZMRay6wkN;L3;;r{dRwrK||LyZnY{ua-rHqtD`qQZ6Z2aFXB6^p=M;w1*eCHZ) zF!?@0sW2clY6ZDiTJ>I=lFI{F+VHQ4WC4NJu?(FW;Cr(J~CN2O>!7xA86vvFHa$p zkK8vo92uTCcz@i>3vl7Lh^*=|WcLY~#A`P_Dlhc}xJ`zf7#I^icQl*nQmQ#CYK2()&+?=(qf)EF2X^ZgN+Ut+lWNo-%b_AeKN5| zT@p)%)N`E1m>gJX>eDNQrP5!AI2%Dyy6M%!FseYa&VI4n_7J;gkgPy@0#ndWuydlX znxNd4ZJFnJW`NWA;K!FCfv88uzY*Xlh+9v|8+P8C6^ycOStVP}ack4TVgRrF3ES-O zp727?iw6>zW_a2yQ)6TvTN=ae37U>yn=@Z~Vy38$TZ=eUvAPaC`r(p~7GEz7r_>VI7lYA_|@D*=LZarJ}7S z-=q(&k9ZM`a+l=-Q~k33H*@S<1ye~n9*29r6<-I|rnKdxlJh*l@(Z3zKEllHD>GCtktGOP;X`dyYA zpAVRNxneo!UpgWpA{}ZN!Zzj3K!gnw_BH=uL%Jclnr+wMS!o3$L^w!1X1OY)IK=0PRc?bWczfstcIvSiae2boY zym_Mwo7cwG_%J4g4sfP8l$3aHN`k=)ed>s zZK8(`6}c#~Nf{i22D%o|BBZ_D0Ro$Chm7Fc+%%hRU}IE9NikBcgy2IfxgQdr?=q5F zuIKe7J!J&OEpaoucYLS9{1aZMl@Uv5zBzZKIAdIKLkBFU$A7t7pYn2by?APYkO*#z z38iVI{ID6GUZ>tks{TtJT=pmjAG2_PmTNO7d9`+I#bKe(+sVkbSQOr6teZboxB&Tj z=d+g0q8PnMd7s91xqcZ(dpTjHd@1?~)8kQfvQ0>rx!$@AU6d6ID8kh)T-b5g z=FMnx9bm+w`o1X{QF3Y9C#&hEcOm+s-^F8VGA=W^Dl;M9xcmE2(SB#j)qK^p=}t$j zKYzxijAu-u^$!le^X!69W1q!0hDI;^yt)tG*mqG>0>~q8_@j>9KcLl86e2e72H0|I1fmxr^N z_C1Z*h2L87(%%mImdVh3)v;r=Y&(bt-m@Z%QG2OMW;8h; z4E*no52o^ONW_#j?gAqZ8&dp>7!kc$L;>~^U*8Ob|w{*zKcRl~^E zI`X{1K~by^;!j8xb=XD4fiFL!V>VeR&-k$>_18hi9PzztK$0Ss{^2sHBcT;?2$o)Z z?Kn5DEu8&crW84Uuno~nn!Rp^DO4jHCO$e@h^~ttwm^C<8ddAd7lNL7*D2a3iR^zx zN$h*my&@;r0%M2SP?~l6w7fg7Z|)ww#R!LTCIkiWzH+5+aoWGOplj;PHvh_i^owG` znm_L25V9&WtHo7sUgrNe;_Y2$HdSO>LizI9_2jg@N{41;WKCk@>Dymhx^KBT1CLrA zIjJjt3)Xpe9*}X%tNz|>BwXVUZ}EZ~Cf2s5>(YJny@yxd);A{0rI2fNQ@7|}TRb3f z8x_rwmAF}kT4cri{=NXJ2;rR9g3&)~*^;T%-PEyzFg5^DUoX2E$F&ec^8PQi%Ly6Gdp+}NCXD@oFD1o-%DRv=y(H~K25k>iFbqnr6CghaUmAF z=7aQ0!s*p65`(4<^C~i@RdIE7YvPWPC&sNgs&vJ{MvV3Vp}aOxg)&4-+(_Tdz1^0& zUAA!Ve`3tT^>S7+3LO5-zi0AMwhJGRPmgZ|m>&e(SIapVu|ysa2WlKSW+y+3k8O`p zxIBt@b#}3|gJ7;k+iWzhbTS$X@to4dICf|x0=T0-!Xp1pPMasiFBGaaZ?A%O}HgV{?G$L zV)L%e5jJVgCm(^lPuy0pzeqTN|A6H6GMAZ^#)IM;)CVSACXRsppPV969q$`2g&{9} zAuQ6dBO@Nqq9~hGS{M52)O#?$)nX4+j17fs5l)PyuYvJW%8dMLNV#uLTnBnPOnPV*uYvN$=$BXbEqi!yU<+Xyr z3D7E^Tx>$p6Av#0wZ7m?)2ko+N>wry9I4nMo8&&0d2Q7wI7Q>_et_{T-$as}CsS=Q z24kGBz4xj=Iqx-8aZBL*$QHQ&B7CorG}*YCCF=kZxlNrvJ;1vGpGoVnfSi zJ}jnYm>h}pO_Q_|sbYQ2nt!JyM8inIUTaqS@z5uqE5oNY;x@uzcit<*Ae1EbSSE{Gbb< zgFX#$E{Q-jkY%0BLl{|y8__S2+?j7A8ePC{%Xj? zv5|BZ$=|oYvkWZdp@!5%z8-b(BVWZ!aRP18QbYWqtSfU)JcQGG1I#PNtDn6LnR{60 z#n1?! z;=}7&48=5J9XV1->Fp?~FV}nI@KKPMz@xfWVaMYGts+d!WTeQy$Cx5s(q*`J{6yhhv+l#3j}jqAPD`HhBIenrG$C%*zkZjA$o6=C~y4&Sy-f?6FM zNU!*x*pCMnW->LdIb;A}80W*E*yl>CNgWGJ9gxR1nq#Z`bixE{DCMKK>VYh#Fx$ki ztnMidzdFUGF(>AIO_9L@nMZ>V`N(;Gz%K(Lg@?;*7#t>BY9u zjRI**Plc86g}iWNuvDqq#dPVNQ9~NGH~sAS)Obht8R}q+8&pyY;{z=t8Ih>qI%poO z{E#2bw+7pWJvN;u#%AJ>%!ff9)uAW`(kIPor%OtDAQevMRgGqSRWQk~L5H$@A*Fcv z&H@vaHXXP8F2r)FjiT6MU4wUH;ZjJ!37U6W8$*v^QNRk4K%R*V*9Eqjh`%0ls?eh3 zSeW{BVB1$_vPHzzH6BXtQI}G9v{%XJVd0=Zwq$ll(&k5#!iPU|bz$L|Usx03QZGUn zV~~=+kphykJ-EQ8_&vJL&pf?&O)neWBE&vI%8t0;H3+T_>Mbh}vJ%6eR*&2zogwRZ zRnqIy#=FQ5hesMqM02#)%hF&C!ivc!fyR4gv)ucIvJT)DOFK;_+m7#SkD**w8ImBD zB|;9fN()E0CLZcFDpp{TIrcbs?CO)nv@8o}?DeN0(Qa0Jn*d9z?7YHW!I11Xh(MdO z-g*UljlaF3aCl9PD)j^O_)I`ep@A3u(}Z)HP>#B7YQ+($YbGt3;D z`zrSpVveE`LfahKY;Iz+IYNkH(!ty*$EeskM5RzVl&~jnfN9tG-ZZ`RKv?{?BPfLh~y$${;C-7=1h)YgkH96&+stU=i;gBC%@ zC!143g^r;5j@!GMTX#-k?!=CLS)U(3^RZ@Wz)GQ6Z*Rd5+qT|jx59ma!HxL69{76Y zJ0k|Jt(z-xk6|7s*?jD4MO?R`+Y24QmMzA4FdOM|34-yva-e1DxtX;OR;*5iFy>@n zx||rs$t+8d?p{9m7j^*)ccmR_)&C?<^Av4-n=L|%aNwZy7Y2d46$6R*+itza=`VLM zfR{;iJo2np4}pbK1eWc~0>})2A8T5O`BZht^d{%c-*!dqNzI+HmpeBEO1&YS4b(E( zZ8M&gMCm1>rGy0R9FlQ96x3G|*scAE*<17~xCOFKlGESzI*RLxU`{tVq^v_8wRfcS zE7GnCiE52Pd*8c2cge*zDiZ8zJ}zg2bs8E3%;vgyCUbkVxC85M8%h-OFFwsN)g)yF z7OA{oi`Ob}XuAGQAL1Pdu-a#y&P|5UY7eFj2=X|D$!K6YmIZ5gS;`w9|A02#6b#t( z&U=82uybmujf~)fR#YT99(BWhB(7CnoWJ64ATxJ#mc5tSKJKb7NRS9RM!tJjf1fyE1ht~*wN-=B8m1Dq(BhbjSyg< zIn(NQZogtB(->f#2tFyb5-mxO5DLSWX_{-VqlL(ULg@H9&FG_ACo-&Yd0(zOgW8wS&1jm>*EZIIvr9PcnRJl$o8o>NmULbPo3ZJJ9Zo(rt= zo=180wtFQgr#qze4#69j#v<$!QOgD8vkL^kv@AF2d8S}OY0ru5T#P<4;0MP!0x4R$h zJ{Bg;;2+mgK~b6`?aiUhN8;9xj@tyv#Wn`Z`ag|R?HBC<{;H^JZ%J$9Z$rLIP0>%C z9aDTeyGPSfbI1s|be@+IyF@dZOzV3W(AK7rPIJlqe%#<>^^yaZ<&fT9^)$A6Ipy#V zc)seUun`Xkr>_)g%CP3+Zl%4Me`jw3kWBRJrphBcNPNB>2fuh==IBXD*n+KGpW)`3ry{Ak|6T-=^k z^4UrOz?Xt;yF11vhj=RvIDgB4P|b}1u?BYMXewb?D_HLeU|R9b#Zd2qzUI}XH@&_x z3HJP{Cl=@R_#r11j)%klhgFD&@B000?&v z+5Az_?uw!@A1tcOrLaatRZk!YkGfqVItL6Vq?%A!1? zvV?13^8%{Y3Bw>&Z=rSeNu6J<8YE(EZDT!Xdf~}3!_Kv(axL*lL1E3(Q8|@}ikXjn zLO`%te7g>9RLURBS-eKd!wC3%&gJ-ti`?7$h4?a%uX$nB<(N`Ag1d!+$HeM5aE zp%L>dU(`sQ7NBw`aofIP68ge-Ial5xr!t`0dpwdPvEywI z&DlKR=sLG5>}f=6=>sP&O*U$N#a`pK=>VHLa)XfHtt#}rA!fG{5}Q?-I9C{^%3+@X z)XZ4E+!+BvT@m~a`G;uJ@xvZz@$h9^HXu;jAiQJU4G*m(CRFP5Fr4FtXfPbN($?H} z16y&P=JVx;-eRsQc`EWeUqvOtN_I^~)B7ny5>ORD2`V@EsX;(^hLoC;J9uuutlQRV z*w~VJq*Y(YIlrA0NdavC#=xKJ1%&C~bmT$sd0RkuOq)Hquw2UUg70ejV-R)PBMZC^ zoHPo?YXg4puaS>6bwnf<`6QbFy;Q|AGz<5K>1(1OiRMh;hGO;bmlOA1CY6qZLL0>T7i4QZajO z;qbiEmIDw3Tae>=6t^NeABxzCg8J0nrjFD{!M-mp4+m8ltaC@C~R{IiRMknl)dF z9gY)L$GApAjLQXDUSdEC&|n2ghrtE8)WBs5GyJ@U7^Jc-5Fp^G#(#8+eKbZX5b!gc zP4*Pd20w`!JGKtj!=)01mD}VH8A`ayTnmS><5T25*8z4ncqFs6*wE#-rstW>_aZv& z-N3(4d0}NPR9ApU6nPy>q`2E)j!euVIq`kMI+@gvuyo~rO+9aOYdsTelCcM(e5FE# z^>g_m0W=sm>8E-!E?PiffZKc-h;~?NfZLTjfPDWi*!9M6G^zjx?4JbQe%4Urgr}=>WL$`)BYnfpF8XpFK>T4& zb;{XRk*Q!P%#x{gQ_)tic&VXoPF2qSSyh+FFn`q(NFeaD^j?5L<<=4l2ch5(J1Br! zsG0d1pJR^$#}4l4ekWNe0|auhrjHf-Cv^|C*}&=D?nMs`ALaW9FgfIM!vT+Wbq4Tc zYh2POpB7fwA)Lg3uVF4hcmLu?T_*vjN<8NX3m=H$DjIoCiG4zws<{>})?H*V;B_dY#VRzJ-OY&`Nj02>4Jugqw5+o_j zci73IKD8p4$wU67h4a)l6~ImJ#_su30cJ$c+eX*0%#!T|T#QIl^9`?~8xmAn|MDT& zzF5P<^P*?VR3sk|uyw7^iM-xW<)GsebYrj#zBgH&y3`13l;B@EyDiv4#phX+RmZ=9 z6!$p7*y|SPYn&>DVdM!g0v%>ULZuNliEH!&oJp1erOBRe6?Czp@P*1B?L&()q#CwN zv5Lw|Iqhl8RarT*N}Cqk?zqc!Z@vw|1OjZyzXI~6w+9ds6(H(P5u?vln+D=ZWuv&+ zC$Py=#fq|~a~kO2B*)ZbzP9V?4+)IBS74rPD$dh{Fdq6)5Fima8jhn}%kx${H_g*^ zVMJ%PtXjL3?zY!IyFO`iccFq|zJTGUKBk^sCPxc|vsvZrkYTTe$g_$Tx?$M$1r7_% z;uO>i-{D-XR*^INZlLy5_qF;7#`TaQ+8mE_=a`a0XJ7Q)q~m>6QmuLCRU{bf##FDd zC%;SGsq+AQM=W85IML==_zC|e?n$Uj$$IF;fT)GRKB1x5;3WP?j~=y2B0-HBF_G$Dy~lxzU%EGB}|3agIp{hN#i@OT-TE!fG0X`8tIMK#AZ0tGBxi2xG}1ygwe-Fxq?OS1GK-K*{Cw0u3wZ)VZ8d?IaFc zk~tw!pgkmhmHqIc;kTP7c%v!yx<}Gp51Bo6xDQ)UoH8hD%iJN7@+iX z#`VTNlBJ&M^63gWVbFJeQQ3QfI>1Ul_^%b9EyobIaPG9yY1h-yQVE%}uyQIVUa(x@ zQk?wG*B!_!r?ni#*U$d)mX|k>8GM^z(~9xh*#BB7?(vLwQ-lc2hI2F=*1^XB4579> zD0vJ%um7O^ju!Q9MVlOy!W(3yq-h>`9{uf2}G8XN?u<@t7Y&hIiTBGqA! zIi6h1nGN5rgT+s6ZlVjbrf5;>EjK2cC1~aKee?V~?aov2X*!cLPf?5W%{Q&m$+ZO^ z+mBTBKVxkTA*y@YD765gJFUpt4W2GKc@&YouOY8UB%IhDk9G+U8G9_M&Zr0p7X$&| zh-Qy}vkwybB6$}6e(1O~*Q3DYAHaA03!VMXdeb|E5OBFEtp!M9d7dit;4);iJ$4Cy z75c5^mb;kKgp^C8$I|bG+)x#B8wW`8QN){)lkAhS&mH{V1s|BqS*K3cgxGFyb>r^K zCGIj?>*{ZG==(ZXxIQb;Qme3-l3CUT(y2lRdLxxv@oe^)NSnPYZXw^{C9^QK4RwHsKzvAN)(^Z@*1qCL`nPWS%VFS;Bre?r#hwj(cq4ZC|!} z&cL1!r`8hlCqHW9ubK=pookE)d76pWd4*+M~NcgS8eTIb5T1INq1zI_^L2XN&Wa~6>4)wxGyZfHjGRxhy2F*GRpOYc1 zT<|n;aXTO=HQnpRX2k5cz9og<2ANMrGR)!=m`%q0zE^hEf9DDxSRJ}jV8eR@RA2vk z8SmYsu&v<2xpQrBwd2oeRn8r|#wXa}poD<7lX69m*Qt*OZZ_n18125m{KjC`!?cx05U`U!13AZrxhqtWCG z6kDSgNh^dliHA@p^QI*z*rLdoQT;*@Sy1tVO1F=|^7pdLoHMnhX1o}nX>zr%G~+;+ zW%N0Qk^_2Be&2g)j&4J!x;)XGPidnN-;Y5_q{t&E4Mw?SvuYHd<)6s^d(_}=*0&LP zUAr~86qvKn%lgF$c{~$nqGp787d_8l#Sp8`Q9Ogm{ya`AGLJ3{p3{dbG+h$NO)WK2 zLnM+br`ATO{XeudL=v0Fb+wg|hn(Y!dlaM*YNQz#d%ln0FwWn7K35#=aNrEN-(h;g zwca^M6?uTH(G;odpeyGn!oGNd-6Qb^>|awGu4pVY=G^gG7i64>^KNDDHXWm?^md|5 ztc|zPo-rL}$|DD26W&(lhIy_wpUs>_JnHE)WdWpdD1Tg^2>SuIPyL2xf>;zK7e{ED zW&EH;l^;f(vGXwycyTIL&+R}<1vd0#tFT-Kjx63O6=`)!vcSF^X4W5ODYN5QTXT1{ zMt@Y~Ku2ic_ttVBsZh~hIf)-n)3c(#HP{asu4qV?$8qHHn|zpnDjQqZ!O57!Cm-15 z`Rp=4AUF3Tx#r3g*5isKAJBGWK(_L$4L$-034tQqEI^Uj+^Xp@J7tE_`DBkS_-B}d z0aLHWABQ@P(~$zTLf=xlQ97Er9ayrkE&~=(F#L=dIwsNteR(mW^7bv%D{%&Nnzk4_ zasUeZOiyls>N4JK7{!(4o8b0u+5&`t`rZ;f5=9>NX?z}QgWd{Z>^&rdrgjn) zHdsr#3^qEJGGO?t18t{SRBCivE6#9fEd#uEA7yNleGMn%p|C$hdrV72wyD9*SHrmx z$^$PQ8jbTogLCtM3XZ?&LIe8(b6^4#0}(a^hJAvkFS{7RE;Lr^DNZ7WEnI~*ri659 z<>eXL@n6VAB2uW~OR+glot4^kx5Egv@gnpeKq@8pBcd=jRG^3eEqvd~V4b5iF zKeo7v4VKJL9h| zH;9rUg5COK{>)npAvWE*)E?S^XAy*g5^WT+L!6_R0A5M!_yDHP+jCl`GrUB-JOsdH z@TubQXAzx81ISexL$OXslTlqY1AZD0x%eCY{pb2m%`Sn_kg!c5l+Qo7a}8f7R;{5! zo-9t(`D?|{-6vAnvsQV3AHumLrih<76iqGRJOvzi0SmnL$k6ssi|W@=w|`;<3W!e6 zx~V*?)8Ou1TIwlh9A(sSg!l(}AF`)K4izA!GPdN10yvnF>yb^0+cV~t%}njj8|PM; zJVO6l<^@^c<5e3Ha@t#5S$Aix%j}E7aQHGa_*hxSDYDPW%Psev3YT-No$jMFjmY|l z2t%)lP;w>pE>*d$Q7!75t+iDC)T%j9e>OLXf@%>WVASaEDVWT{z%aD0(sSB zwM|Ev9wMAu6+x&1)v_VW_47)<(hqZrwvbyB+IgF!PMC3qFnCz=4)92;P#7pDs1}Dg z;xIKTs5|n(^O3Un~O=@p;fWEQ9LE(q;1XJ78M1$Nf-`0R~x31n0xMBPiGkV4iGha>0Y z4A889lV;1s&nr0=qebx9!&Y>&I`h?4cB zD_>_MMzsm2@uur1mJI`mwc&8PW)+h{MdVgC$1DA6bg^H|_9NvHhEd-2T^wqAX&9b1)Q#p@RXM@o*Z{FBsR&yGsdj$EM^hyj?s6!lbL&xlJdW6U z<9xdr29Q&~cD^;LKVoBBLFz=)up7$`0O~WLG;ASu@!t8(_MZu=n<|n;68EuD%jbZw z3uOVbW2+Ek01u!ABAZCrX_6+qeoPde0elFk;0XbAkB2M=c|4i*XtHz+UYno-WayHtjA70mEyF&w4hF>v@FS>=Et&cm z4+miJA7@oV(f|JIoD)5%!8xFAv_$?4YG0H!*$>Su%f*=fK53}%X6w{}L6`Kc2HjNhZ?Se+Q?A>_5esjWnJj4xVY$rmiJXD~ z_m0~n$n|DO(W646PB1>edXM^^(n-fVWl`UyA#c|oYM^*OajidQ0Hd7+JO;6ZJ_hEx z9z8*QH-?3M*$7ZIZvIGa3ct(cCAy6T!|YRLaDkkw)0N9C*AJ9^r8(ovwArzTCXxx( zrK?pHJe~Gw@?&qbAfKaW;PuMRx@q%*Be|+hRkBrf%qnbPTLGo{ZO5mjZ5b!_wBIN5 zA@8moOs8)g-E;iYaOrpWmFPZ{J@i{Ucn%RtW*~OQGGOg!?PwQP*!PFAP>yQDYeg%V zMX&64=kT@`Ah4LRTwKE834z2T;Z4phMK%m>d0nF>aE!B9g2(4c5E4917<(y&F*e0$L0PWv^X>c{x~poV%=D^-B_KoC}g80RDlg=LUkmM z`a&{WCK9Y1Oh7?A^edEy;Hc45lx973E{2H(&wQwmdq5)wT$;~Sqidb#GX#w~iWiM; z9V;iE3rJ;lQLWoU>`;_9g1P~;bn!Fk`cvU?RYyNI@ozvp2vrkQq7RRE$ypjhl zsN>3p^2#?NS}-6Kh9V~9ijArBWBgyfMChIU-@pYyecI_7zJ{YxNE2=_9HqG z^U?KLcE1zNuW|Y}Nn^|y97>eD)}~v)4l$M{2p=mo=jBK(ar%7}n)a!9h@q^csLc%IMFxur<>2q{cNhEO4^ccdj;U;d) zqSqfzEnvq?8xgeE{_3j1k}lUl2V&~=GRk8P+rfnb z7)L47=~jFk&R?jqvtVxqGcm;27=(JQj@@m&qhB;@y8T_3!hq#_@^-c5ix)_sWb@(Y zu0qid4c8pmWsx%qs$;kT*AdMh+W6vJ%FS+h0-snT?+E8eXao5emjPL{{W)PTjUq2T z!3T8CW+Go%1P+}P)zEjDud&XXwQv?btvutFGyKQ88rzN>hD2Wq@Z3GfU}dN5Cwl|WJ5Gq#6%&n z>egVNux@~p@&&4x<)my@lfJi>H7HlJ2tc@P*bNvQFi$2*z-=S~kCCrA2QRni2tpyy zw^GrJ%E)=@bPvh_=#oKM5{QI0v_sQUnex9dW5eD#T{gAj{05CP60<^%@zojC-&R>} zaa_UGgP0(<>iu`! zDTv50XB*}{enubNg~G~E#gbjfy2ig3WcoGQ)eKw*wb|VWri1jNm{G-s%iB_Rj^VI} z;DB81A){|hz_AkNT5@F-DJom7dD1YOKiJXKhkKQBHN}%(B_9 zJZ!kD(k)1*_&g-S*uUNM(uCYsFvY!6&uxCKNkm0$+q0^sGK>%`>`DqqrzedR^&sx| z#O&~G$R4v8m%|>+sS%W;`WlA5o7T_{w#W!-v7d|U8n}j%=q#FlKD7pr=}@f9H&%9A zUCogryMH+HeB9dW4g#Vn+y^5Ax<%gab3T6qlNG|cj{*$-CqT*Du2v>m~WKucChRU0~$93SR{0Bre)urH01kX~& zTK16v=yYS25_pUMyA&SH^02{vaQ#CteA{WA%8pW-eU`t(SVLX;8POBX2Y1@XG`M#h zUINoAmYY0WSZm=^>vcEB1EfLTHx7-EYe)buHA>JQgHqpLwwSxl&dPsOh*}d1N~@4$;V}Q@@;A33(PX^oq>@t!jW?!6)ZuRH}%O`09Z5|bxK2H9|P`kI- zeNeS{@_w_a5|`5DA2KSWzRi)C2(e+le7S`_j9<;R5gH}|#Z?^K$@G^6x9lEok}AnQ zNnU){Lezf(GVPv~Tcj<6eOYq9e0=^BkdSV*PA^sU zN_n#OKwsB!-Ix2^_sF`+yxc?!=E=9syWv}o;4!RC72xuKQ5f?H_lASSu=$L^o}T#Y zzeIyKy9TlmUSAYu{;pB)IjIg<+)&^*m(oYN6J@J2xI<~m%W&cs)+v{#9{(hm+B0?< zqOd0Cz^-;<`&v(nij@yRQAS6wUkq{WSLIC3NeCQ?Xo@y?9{PPSCsi%09nNk3b&JwoNDXnZE*z zx>ldFVZuqkkUwYR<{ZnWp8$aU8*!Pm*um=cNsk-wVbs}{J3sSoEOye*{uv49G<&#O z|MXAO-^|i^R$%;#8WP-kZFPLU9V7q(VI6@eE2(Gi9mZ|=i=*_GA+MjSi%nI3oTK%f z4}r|=vQ|!z5D%FXT4d$P$dq684E_2g`F&db$0synuJT#qd+tBOH~f_+hEU&S9}S9k z;cv(@`MA0JXWvM@I9-6MZAUdPL${ppKBrBI=XZ&r4~2imrM6b-I1wk)J4)gu9^}H{ z*MAQ8TK#n>nL8-TBuqb^+xF6kGnbTWz4f!?@}B9)&xqSynIqPT1+OKG@A?dKOXdhMYi?fQVE>iOqE^}t!8j$Siv}=wLTQr}V z7rFVLz;yesv#*s}?aRLxddUZdfxzH_vnWj6jgH;_1TZPVqoW~F2Xb=czJO4#B>5%; zWM+$H~HY2m7lGlx11%sWt2E~k0KMsFsDuC z@4p?rWP2dS z9*&|e-@T;w{T3%K(Q_H8q<_TAdf+GKHjJ^0^XHEs%iUujR!76-_T!>95{nqiy&nJe z51=o<9hx>938;!~d2`$HhP11xmJ-r|OZ`va?j@MyrD6KYUD!$!{ECA~I<_z6`*;8$ z60p|(|5rZckL^!*rf5Ns=bf+CAjlSeyDaCcck5r| z6KsFcp*9PL6?}Hy1*-Z*H#^~NzxS6VsI_lCxS}7sX}{@?&lbo}nW#%m$4kLlPUC6* zKy)1Kt0<%WK$8*M2iKw#G(ih?`r!Y9pRINsBWz{(O2xI^H0X{gu%C2&GIBWJiEr7N z+U3Xt`6_AL>@^pkO(*m^gp#%PIOJt(aHQokq}VeOyS#WM$!~>Ct^9McJAOILY`)7P zm`mCh`_vleex3`N1`4?2o-(5% zRdqBlFH|?#=O69*%6|fesP4+*@a77Dw34x^V*0As6vd23KVssUYrd3`>%TJP|pcV<|meOAiFFX`D*Px zR(w^8|3#1+(o=50?{ma8D!&GzPM>e=_3H^LQ;K(x`3Ks67$@|^7yHL$G)w%8jgq3f zg@D=5`|g^ER|h)#C$S!i=3l)IvmF$i3f6l1Q6jYiI)_J)tL6ahcp2onI-+BDeG3s9 zxhE832Ks<{2{!qe*Lh>a67#C~d4OcljN5f^H&G(+yoS@!1hik{rvdv)tzTZ#y<6xP zl9mlE!{*$aG4}lhA2sRuLborseIZFGBh(AKmeaW~#HQfgSz9GBF!SAOa#!28Y&2b9 zKMuR!z~V6OB(nh)laxVijr~u6dp~$m{@VPqpuDItUkVq-f2jW0c^7$v=;EEeh|ov< zdazt~V15e^1j`F__~p;1B9YzK38N1Ri)4ZZrl#FOInPTIjE>$}p4?*TKW zjOyT(gkI-;m)@s*Uh3Uv!M&<~c$eOKnB&2x9Oh!W@SX0HS$7Dq!~;6ID7#iUqaoE_dyUB0tDk%h z<0`&W1IM@cW}#sRh5kE{Q?&%)pWtHXG^a3tPnq|b9ts@uBTu+OZ)M^NM5w-eVpM7CEe&h@Ny{M~SY z2$g}};liqltDv`AmNg{RZhBGMBFQJKG-7k!k+JJ$#(&aKS*R6x2G0;CQu?|L=Rdve zyn#YJA0&biCIa>^3o4BiL?3vV4mLqkG*91OP_X}8XY7zm$y#;F{X)1rfc1s^v)@4b z5oZE$RgT~p67ut?^fFib9&nx(Ult*U|Nv3zlShYaSJIJaCl-c#uXC2Re>a{QDN2_;$hdA@=RlV{3J zA?01a}PtcL;95b+JW)EbbB#2(|(Qmms?Y zOIT#F%kQhN?*F$>)zr)!>8?|CX1brJ`(f!}6F{M*rl|(N!omXluK^xb04e|+?ElIC zt~if^i;w$1A;ibW!zUsnCMF^zA|n2e{6At6G7=&pQc6-XataDc3gZ8$sHrHZAMYvt zw+Pn%X5!!yK2D?{AtHHv`~N5pLjX!bJY$^CI9N{s*pyf}lvodA02TlM3m50n+W#xK z*f@CjSOkOsqQ`C^1>k>*vGM-DhKq$wkA;mx3BcvRqY}YaBA|Y1_|7|$kVZ74oU?^i zd3gR5xJ5+A_416~j$2H{C#vF!k$vU}53l%ZRo_|K?FX8mj=vQ@C6YF~ zQYc5;i1fTy+^|df(>V43K#L_@&>k2EV9b82?0D3#zrRy(KsUGl_(A#r01dWoI}V=y zf&<^NzUa`wB5u{E;T()S?mt~L?O61C-rcd#2o31=c(Sw|zucQI^b;BdT#h(0JztkY zu^*)$vnkzh|4=B9=&u;u#qvTt05&^oKk4=d8nvQURc3brS zUFB5vRPpiScBlpj{_s>sjSXav2G%W?Nv(-H8fQm7xvF-Nb%$G?G7|h&s8wV6-7cQu z{%O2)f+Rk;`BZ6JzN1&08XnBotKzkDO=Qk&S10%GisY;lX!?Qc^EH+SIn;K<=8 z!@WslUYzUKLQMSnXQ?5m$n~M{Z&rg-v$<@JcA}BX1%89yEaPE5yM01)*m<{c8X2Kr{wkCCTzoO#%q2jMyP&z?|z-~eQeGa+`axwgG1`^ z@*AtSHpEkN-@bjnIKus>hIGADz$#6wl0>#5$A8=j4DM`aHV+MMJ7cLzo5q1cDh<-k zo2%Y!>;10X@BgSLHDFpf5q!OJ`>~NsXjuW!OsZ=?>9~1vlQ%7?fNPsL`_iY!Q#aU` zZCmQziFc47JaG?eZLYE2ghR)L@ch=-Rxi4FEZ&%Rudl{B`cCy8%{fspS@Es3_s)>i zC}eEoZlmWqcz;XfOvb~3mD#EZ-*mkq|E|^~jA@YiB2nW3@O#J7babeH^B#@n>$~1U zCp-Z58AnRG8U8K!J^)NK&MvC{Q7a%7E;$*$+>9yEhaK)FoNAvb|KNQ9WX)7y$>Of@ z?F9`thyV4ys%#~;z_5YmvVX_)wO!DnRVB?-ZXW>Mps;|G+h)Fyi|Wpa<_Cc6vs?1J z?|K!SKUMB4Z-ldxk(od6yGz(wn zUpHs?H#0h&i+=PO4aa~n!uD0jx$fSSd+oT4tEsbYVguLuQ82!uNl|z|o9ET$S<^2L zO%#c!QWT5*RTGMpImqSYeqZT8YYmgorY`ol*_;F9tJvT)QZZVO{Re(-Fy_S4nayhXUod-e%*KJh(bsp*Pf zlXI?cmZTk9&j%jfh%$Fk9X4A*6uE+-&=W>Y!LIfeSnx9)&mcg?wyY27VAkB?%;tM63iy}H=%3W%Jpi_I=rINU$u@b?a>qxzhh`USg0-9y`-#3^UY9M)3#9m=PAvJ!+n9c{8=@> zpRAIvo8BGFe)F_!bBm|it!|Iu@^sjy=qkYiw}vwYhk@OWz9L;6R{0g+ZT_1%8ggm) z6|&N|Bs2cBTvF-fl);D=;@$Yx`{G z-P?;sU+?mJd&>_fG`E&9cFub)oM}&8*K$u!h-HeICE`g(n}=y!W?4u`mPNGXV0$Y< zIHE^o%9Me#t8S5;JuYqdqm$;BtTjdSa7Ra%JD=4bPdI?N2qD*d_bQ6HtBVw8qR(h~ z#DAu8@ks0g3tcmc{G)r+-4LeTG*ZY*&(rqE$AnqDfr?AG; zEX#iAm)o|Xj)+V;$^&-7q=o~9`1Ju4$!~M#fN?Z6o{iQf(VhnQrBjbtMr&ZwbxwC> zyuq2y&atiX`N_E1)=iz?uBFS`JJ0ur5#>XFjkBX!J{y$oe15>L~doiQ%R zwz3i4^+Qwa58%zre7GQ@)UyE?zwNSBxfy%J!$_iI9iDKoS*QyRGu2q5fjSlf-z#RdcOgh2e zpz+z%VC7GXe)nJBY5XvB_#Jcm`9o3r;Vd&njO=j`oU6cFyO}0e4kS13XRi)|1W-;@Nl;gqa z_fv42#azntUYG_dl*FdXx+BYXuPap%KuG%n90+>=z%_1?uEEVg$=mxX8#1-$rAD&L z*bbUbICs~zhYH^uQ~yh;N9_~OajORWEicV5_X#3xT`3EY-wh+$&F?K(VGG81G5Oo6 zILgfk;z7zZl_Q!9Q^H=|dc3WA0PN|$8pjI*eSM+elHGnA9`rp;rE^(k=+t=JH1PDs z@J%4{riS4?GbEHuCh0wo<7Xp5;GFvTkD~3ar?U?LiZq%)kT9}<^9*xA3gMc#XJ2#C z+sD{y_$xAKnUQGP?EDZ3vMpi34VJT&8h=vxJFu|ayDU6d(cKz`=N`k)*BUritJiPai6|h)$@QRC{y>mb%!&K zGuCj|PQmx&GJOYFr`%wV7F+{`E%HuS5AN}6z}-#2T8WZvxl>*Ls;HkO-+GcsyKcF0 z&iAsBcK*(J%W^qxrK!rKchXRXSsg_kA+TGID(3gf6aza9Z0YAYT2P%cU7q`? zAm-^?9(?t2niE_g{IgwB$=7GkxHk3JQ+=(mHeHq>U2ARu(jxpKKOO+V`$v?$BvTQv z#Xn+IrCKy!GefprKb`YK{RDH1Vd84V&m;S7TpS24o5c}+!TFW<+L{9E1#05!HGs|! z4Lj0PtZFUqoNLAO5RzU{lQd^>MfffKDeC%PU=`10wZ}C%vY95Lxm?6Zl5tYWXk;sA zGLqG@{Ppd)y7ghFrohu_!~}9#iKnmKf~=dQ@pEV>sZeAcjM6fG8%&=Y8am&(u&=oY zgCCbY05p4l$1POd=xVj>l$6%=2}wTyDj|ABA%LFTsRsQn&LsT%2Y_{NH^ij6s7jid zP(2@+4~`CFyee<9$o0oVezugw?&#U{F=9oO^Q4+}K)h_{D8dK3pGuA~Ycmt9C%}4Y z)E1WLgL&%QgMXyW9T49{E2HEzUE)ZD2j)m{1=+_KiELxsd44Ak-cI{gZ6wHt##boJ z-6JR)f}FQ`wc58dWtC6vW9+#%ltDe!Qg5H;AF$Dg z<8=Riv&3PQBO^d7WWQOw`-^RdMceCCBP#CQ({@{O;lfZjYuWvQ+c6nZh5Y{8UHJ~@{ zxBk7~tR-Tjw)DDsYGzoXg~1MgXX6>|)t!fl8 zDXG2nc3GeoY@NqEpN=;G2!`%H!(jnuNwd`!!+IjC*L;|OS{iGgztqjrh;2@9A%v9s z3NzW05NRU?Z+?>&D&!%x@)yEIla^SNuD+keTX?&#pnf8MNIhMnq;2w_eS$f$<({^! z7bi*CsN?>daX#+4&nA>xd{Qq6B-;92zIi{ z`f1lF&wTJ1tzgh;@1^0+1{c5)eMxKbVSHZ?%1%K*+bhe4+&kA5J*hom=F`wzvcD}e z)L2^D(9&N2`%EZhq2#GQugU>Y$LWdj-=;rNDycCu8z7~@tEe-N(JELin!u!38F_xJ z`0S}sDafdY$*coqQw|sM$Td#Rp#^}RtQ_gNhRTIEySg2i<_bSw8`Ms6XU(n=#d8b= z?XGCOfwg=~pkJ-PD12+C3obRbps#o4cOY3MS@xkZmiYmOH1$@Y<@w=dDe>DIr|;2=hi7Y?h1P#2y|z5{Ms9t3>43+JLEC^ z)y217k}4Ra@i`VPoUyvBAIH*n+7M4`MDJr$kWJ>_6WybELE}tbsS9zK^m-8<_$O|; zbN3JSp~MHkmW9hsHKeHu#Zm5u$lE(%DXzt5*JUmEFgDsXcWG?rTJ_OYxf$tT7OLdz z2AvE5`>_u(u$@?fwbiowtq0Gls`!bPClkM0V?iGPal+KnAwYdYe{oPUDL{_neRg6I zyriY2g?}E?ZM}+yk_weL(O%&JrIBXh!O3KNa6%v)OhqRdT{(Oq!e%S^Td}Gon!P^ zAFURmWBLv}g54c58Qm()JL50B$drE@c4#M`Isvc>=l*-CeEP4!e?NUa1B!{>g+aJp z02MMUscXWC?q9kdb88}huZWr8O_I0Vp`0 z3QnU26AR)W08v8(J2!%#kp&;@nosWXh!5Bz2Jer{11F{#F;^A6zIZ zTRM2D_hd*%f@&ndqICrj;LaWZI{CD#&!8aIn(mcO^yI1;_xnX!LHR|Z{&Pc@#l8?t z3^Y^o=lg($m~sMdO%Zdg34V2GgpBv7DW&`r7MUQIs^E{ItnrW9UYP`Ub-+G6LHy+F zQBLA#wPZ~lzy{c-n8_o$JlqgntvA+B@29~T_kK7@VS8)6)kV(3UC&;J*7rk&ulc&6 zMa36~PYM6H+w* z!r4o2;s2gCC>|>h^{Sx~RaZbNTe&Qdaz&wXLo@TmLI_#EFHOiq6!SA@twUxlzs8B1 zmMmrUyuK*tNdX>h>o(;=YVJXH_11n1^=~{b{tkDf=lJBzJniR=b!4`47z|Y-sd&u)K80Mg-9Cg?oqS+P{-Y zSrp#3HD5k03IFb+j?WX_E$QmCFn2%i$f2|1CX-#3bdD`aX=keN);7N?9j!Ze8g%E-9Dwn6r z@|>QsCXav;qgutE>K!Xz4>^8HvE3dx$U#{x^kAX&eg3iQsK_xVTl1fW$?X?>&n%o6 zLmYk5YiPnv(bPRv7Oh`D$o8rkGAsM)LPUN-u3|wYh@~qnI*3M zqs_jZped_(iVL$^yRBm8`5sAxtslIbHs+~y$aWpKg3;=uk4W|p|H8+rP=Lx2a7>g( zH+)h#IC8ARWNG?WCqg=G&=fklZhnn!1mbaL^~t2LOwG<%xj=wVcLIRPJf~;B`IgH;Ay2Kcu>`?iFm!0X78<&RyeqPVq(M0l?4G^Ij_V&Is2` z@@lQVb+6L9(dCBL^DQ)evdoi5s@Zny6}R8@PR|Ugi5!-GZ`yO%RM`=zX5Hr5)yc?Y zTG7XrR-<4vzG3`EH)y&ji1zR2%0JrTA{7q*OkO_1wh%*9rYvnF%Q?S=wG*_tC zywu*K-EGJC%qgm)!-3(~|0>#QaO-rAlohFo3y^pAW#{r$r$^E`<4b`Co$lQH#H-4c za%WaALu;+tnqPXs#)LrRWX2)a_2IiR-~f0m*dH{^@RZl>X3hq0 zWu+VD`Qp6xSw@R>%v=d4GR?_@)4+k9u1LF~D|}LEdq55${_GV)7bDyKAseb;U2-o~5<+87DLYE*9;6-^91OgB8+H=Gi@$5Ir!-mrPR!ImZ2)Hd?PPm>*_(UR)b(LDOZl!nE1ajs=We>N zL1;UW>$8a}iz>YMS-ZJ^XnueD6SYdWs8IPsjeGQmmflwQ(fE3C00Kt9RdYLNXtlJP zvhqcfScMTvMAVeO&}8x!Y_~-wS`j7J226D^W2@8m;vrm&wF2^G~u(n94;doJ0=>Aq3>wbZ)MTh!CPrP|2d2LYEh5p31WEJO%mBzVsvM8EgG zlEfR!(l~?&yrPS5`3J9wsc8KxO}ye2<#MAFIxSa;(z{CUEvbz1 zqC%oDMf*T5G_U5(FR|&}5mUgAK>693~yJ~-Vs6bLEijsJpfWA71fklUOd%DWYrn|Vq1gO=9&D)bZ!O)*Gx z?xW)%l$~+I*pu8|0w}?Sky$75C^ld%Kr+ra%!ae>cCJd-TvrB1F1Hr;vsYPL=)^9W)g&^oWS?T{OOX+`3p{vYy3eLzu+E;$U|141cGF zp{}O_B_>hGlE3+9RK^$1vVe z_%^x7w!Hl1vfr#JsNv`u~{kN&|}8g05TgI@}_zOQKr zeqZ(J%+^5~H8X3Clv$B8(ex(A{$lW?xs+A-Ty?Lop;)upy|~SyL&asOOg`tRPrV+F zWaLUY@7s$q_y16wQ!o4KmK)jc?s3zMP8pA)___qN#APdj6FfSgalPc^Y(|8K8MS=( z+1Kv`_g+$4-jrcdQiO8PbKfYv5dh|bUf

    u*iq9>Hl13+Brmg?b38245S=nxObv zt^JQpL)%DafBX)fxX+Q3WBx6xhZ!{z1w>#C9{m2c^JF>+|)|``9Xsd~p zVr!^3jtn)RrgN_)xF!U~-E(DSQN64&A$3``=C3|v(-sEOC`WzFPhtr)&oeRX`g|MJ z_@8`$1>N94JH1Ck%;woET2{X?598tJ@6~?cR2aK6Sj{SZW7FhhKn8#QB{=jVHYnLU zEG{YE982I!k*_gJHDdHkB5D&O6H?#n4)F+h7NOuGs6GdIUe_lrso$P=QcN)A8pM>g zUeF7DenPymw4=>Fabl99@CJdgtu5$l`MBrt#ES)K3MCZt8gX#;)l+VxiI83gp@m0g zw|!t1rk(yIA6Q@b7J5?>dTwm{#oDl0yfv9Aqwhh+2kIR8OeE2~TTxdZIe&;rP? z;*n8B1z`6Bzye9mB&|E$)0EfvMhQ*rRhuvoUXb(v_!-7$F=By04`B_H*JFWg4g61x zT=iw{c|YCk_~A-FI!9qHSiy}eQ8a&}^xa`Ly}Gqu+8OL!biS$uiQnBKE=N*Z5BoJx z(t4d>RI>JG+Kw7qZY4z@Qe&I5n(^u9*DE1mor{**u0X2H+bXOV0-mERO7jT1pHkO< zH?%UiKFHOxJ@T`s#})k$i}xI8^?#2DjUuD32-P>z+f2qqHI0<-h2dl2DW7r62YMEW zG`2=LZ;S%N6K3f>DLR_bH#M1FS`ng-1yTPx!;dMxu#bx#jT&eYW~IuQbe&_^y(!ot z?vv}#XPnPI8KY#FhJ#~cd!+s`uJUwho@v)gXN{^$mui2QziH&O6E^qHuH_ef8)<Q>BoY6@gzv3PTh4#YOs3lv z`;{2)wGj;?TqA;UcdSLizSB!Zep7`ix}30oifDChtAn21_1wEGT~MAeMcFHz?PTcr zdbT&Ar^&p*9*o$6h~%ydjAKH=&?~@FlMyq|d7{wcpGGB38*)2KE;RBv%Dl%yZ^LcD zY@vivzIFdzquZHBj<4Tf0-_C>v&O4kxy~gqusJbwOVA3x{!uIEI=ax_Ubpj}xsyU= z`nP)LxKOdW)}=cg`A_Z+UKyrA(UMM7DRESl-yYcQEfZn3U<8!<)wovp9KZ>PRq?d>$AhVV|*>ht&pXZ8?B6Kul-W)zou$- zdZ;=Jh3K9oEgwzwYghFo&E*jqSnAm5<#Za%|B{lpd{k})mWW5Y$bV;vo_Q4sK*IzrdCqdaiY^w&ZI+L+s%xLa#m zo+qQq6|+$k`Ofb~50B7@D;DcwyF;9X7Uon+V(TzkV#+Lfmut8GUvop)bMF0f&(j5) zM+i}oLq%$0q3d$Yk!4OewsC}xCbrtRxtL+bD+9+a@VpZ zIFEQcSyOkOIH`Z2O9K8bmi4_WN%fVBnpkIm)TQYR=p^7T;(Tyu&C2?~ZH3g?Gqznq z(o5+L#&lkYpIc%64d(zhl@3iZ|H-24!LSipc_3A7eV)e(QJj&ovrhN~X^7 zjR5k|rt($}G0oxU0RhpqAad^qTQM?U&%P#(slF9r|L~p+Jw#V}6&dsss%2}h-uLun zdm^p)qcfD?m_W#XyQqF}9CKf5h`S*80Eq9`>;r_I-PDkJF~_dfFOx6I+GT1QQ)RK< z4M4sHlwKvGw6x+Xx5f)miE+nv0(PU1+{GQs8@Q~9f7Q`%Yiu6y;83V}#YK#YHCy;W z&(Avf#;SCwiD1M09GuI0^iR46z*THe@F{=S0gF* zqbrHT4}j@K{*ra22Y^fM1Axds;8By7aL4#vEL4EUPA#NB51%ItonZKzt;nowm;qBT zN^5HB!2L10`!R-Z^%6OuNymBx;;{5`WI2e|{8N^+6{L?!xTqf=CD1}$94AG%Tz`$` zg>{85H;n%u#E=eni(hK}qQ9pK{>O`_4EDuQ^1GeXH z1{+1yK~#!$mL$!y78Sd)LY%nJruIW!-S}rGZ?tRQq}0>;s>zIa|{*cD$mh4I%I;=6-*N%;SvH5`ML@3t%^_Sjy4f^`uO+rYf}Lp`w~D zR9RLPM*p`UfoZ`xQD$%08D>kcQ9ssa$KTU{ML*s^agr_qOo7SEFeD#f5N)zjFP)Wrw^SG~Pf&^A? z;YE_eYs##|a#_Al^}`p|%i6CyjO1=iD#s343X+kExY@Ozf8H((p8g2WLp*Otiiwvb zooHWtJYxxrp*``-m)2yur+D4&3W@^kB`;i5A-qiC?+m4bHKLo+gK37$R?g=vi;s~p^mdskw-HwjgBvq|o*BFr|Qv6NBz5Z4bk$Luua zxc}A#_j$Len<3!Tsy>)sFNn#Z=c^^Qw{`E1nHgt|H1IdaCYyzpCGH1ZFZ-iMkg40|l(9R0a*w`me}WsD2zc$dlQFJj`Q zVW5RJagT;Fz87!H1-SokDEIuu{dD>GX48O4s>X}b)@+onldU{xi? zalo~*?^&l_az$Iv1E4Ioh2>CtiNCxt<|C2Kq86DH`t`z}Zl7P$+>l;pfSTf%s^x;- z{#U#YA8b| zjBj9jO~At1oB%-0Sz7SRHhx-Av+vMrrUxWMUPkvjO}T1u7P2NG(GBbR-E3I{JA%ba z?fUaZ3)@;C>80^7sW-fOu4y7dzuFDQM}>YlJq5%J^94tkK%%JQUkVoZTlk0kM_#*$u?_1{bD(8jI4D zWvmR!3h{3c8_$9CNm#ML4Tr894hr%N{lp>tx!oO?T0x}E5Sc>iRWmT^>jY1Jub{sG zqx8A&encQl-rn%;s+RCL8POP}Du{!D?E?t4vv5-l8x8s*k-2AL#N4Jt`* zo<1GVfRabYL&&{+*yr-|8k5(o>A-G(MY5DRhbXUjEks7$LtMf=;L8S{2u6ur*Z%=v zX=Pb#2fcG5RQ}yVo8G-$yJoV*roN6Et!)sGg6&!^KtER%V93(Ikx$4k-arp5t^=2U zvC^EQJN5iv#3~>g7b;p#h~>thJD{wAD$Eh$>T1&hnLqDn-^|=D$Tu!ZODM}*=t+TB z>bCUwzkXYuLwR0sMvdHq>+DO-3EC-Wl+jJue2uwpzoQ*jUH2Did%3p?V)w>(DO-r# z4j62a2$n&r%M{zdBZ0Z{xafiEM$ETXM1}q}m3CZtv6#<}Q}XxUk(UiFEZ)^^3Jd0@ z93m#VX5-uv#T`k`+)A2yf-cS*ardPfBnUJU7>ZlVKb=@EeNy&`2gzF0?cXn{M^7qI zkq{C*Qd#1vty>oDwW=^U%>fhJeC0c9a5#%P>G+PNw^}FE!K1cwpWn27s!;O`V_DYl ztO!CXw3i9OeGHhkN{Rn494b)$S<%#d#6dU7kqpDl6$Nr_xfUV1vdeUFj1=t&IJ6l0 z5e(sZuxWQigD~lW|MQF+TBC7y>tcy<(}2}KMa*XwBr2!>G|r4{KQ?}>VQXoBOd4K` z3T-iMW(*!CwXz!69SPtN_`b#NMe6mTWycKo26efy*@H&s^fvLizZ;QE6yN&<6qmC! z{EeK(e*lDwH_zKMIt5+|_5>G>dJ^=o)p)GK{N!HPfIzr;9@x1WENxb*waaqhjq4jC zZU%XeM4ShJW#CJtG(nx!!g5#Ff;gzxD@QB*#TIW`K?c01u)4ilp}^UrDctbnRB%$Y z8sWrj$LTFFXaw(ZJgU&|p*JIhH9YAy;^-J!5s;Fqb8Ti6Ke8;dL8|3LB+hp891$G? z{R?@Y(d4g%fiTLrA`0b}2Y`t2OcD&jq+QBu(B>~OTNQ4oLVb@IEJLP*yl(TMdgog4 zxyz?qNT>)Z-WzIhfgt0k=^N)zA&_0vT0JZXG&TwAWfceumq?_f@GW8N|SMF4=Z(5@PCx{4Og(4Xa^Z42aY;12O}iJ@^jO=Y z?QYi}q8_)J_aV?$=Uf`p<)$MCtIjW1-^4*>p39@)qv77jfSH zou`x6%+FEXWkF%bTB@qzGOuyL-s^g22Bd+&e)6lkLPPp%3jdKrkGU}6jS5!Ciq_6d%-67)PY+|q#2v^dnqWFmbM{$U`y=JaMOUWZir zr&Gm=p0lNKVbmj^b$9sQnS}u=ClN7|4C^o*;i6l{Zs9(g$^xMefuXsuVctzH*}BdKF~6#L$SGe*nak(iOFF)`=JMKd-f)%KCC5yXZ`Nq=5~T zq7WRb-O~xcE%;Y(!m3+O^9>7AaU(0Pl$>aNE9@7j?MhlXK9Jw5n>87O3bu@alwzRx zQjI6j@Ysz}bWR~-YJ7!AeY+9gM^}=Gm86wCiH^mN!?uA=)$!iMrH%zIKGW{r1Dmn~ zrW)}F0I9W6Zj#Kgn4`(To6mpbQVaqU&=wbNq7-4ER}o@Hq+zj7cRD$J~n8q&USz=&LS&6`VJ}75fUKI>FNT>Skk97 z$2e8PH8`DnO+e{lJSWt`m!ZID=vHfL`A9p){kT%P&?@lFpb6Lv*P^{FfthcS z=Uy;^Z)>qsB+NyB6CbVvilJEmSU{xw@npWcQ z>ASZHPX#9qf@dnN5izZ$n&MeWHU*?oiBUXwcDK@KVSSf%+7)ZR`|9X`II8Cs8;9HKz`#n(;X#r>+s{h6J1HWwj_R* zaw_0(ZlBB;+>|e$XT{IS&m=+S8&|e|c~k^B9>#PE2IF26(b7`z;Njl*?5d8~IK&sq zo__uK;Iv}sM&D^`Puv$`4u1k&moR3(2Y{Z9NK?~e9mi`rW@o`td;I!-A6YR}>3_wH zAF^PR@aX6d->BjZQr3F+sy@9rP1b|{f}#aq7sjB7NxQWA$Nm}g>(5y$z?`6dcRatw ztgP$g-wG53iYHuerz&xI%5>lVZE$7~#G@Vf#B^FYYOP)NEUWp-vwXdW3DDPTVA|lL zYta-=E)TFt=sC?&5lIKmz-GtwfVKq@Act>8(l5= zpQXn(P00R7eU$?iRv<2o>xH`oj(};D^4+!d|A~_ZUOl@Nv1X9N@tPM62Yo{M-Ygs% zu>2URUQE~8$7unzjfEPP{&&o#PKlwJyG&&cr!Dgc$5x0Zh>E6T+#UEs*vBL9^7Jv2 zo_qsmjcWxhY_yy;gD6+IriF&Xep0dyEof?y8NEC)&EH;cqo*sk$K}Y}|HJ(G^cGG<#yv&%{hri+GM9!uN|zf5 zhc`#gi{) z{K>~Zl~?j}c)QfOSUksW`pL^4K0CN%&@zQbN;jQ}N~L&6o_h(5(g~I0vgM)QzTFUJ z+WH4Psq*$e>S@y)ztqyhDts$GM`K06YtrqeFqZ{MzMLno3i>X7zIXj1$PbfF@Kv1L z4*wS0yFI>l+(gxy6GfFB87)<&KzyN(vSID3YWU-T;7yDo!mk;m>zIOj2)kM4@T*c# zW<3C2fo-=)s!Z(X%G-+J_bco)ts+C={LHh$2(fB){_Zu0-FSV}j{yYfWTchXSU;vG6 zXY|MS8VVM6xTpHGBL$lwH6qS7Wxwp<$;z2kjPnwdpQ+xI8etP}9($xGl*Fg4|u`t?Ge*!G+VBB0{9?u$R~HE7R1 zsJBDUGf9AT>^ywA-#eYES84eXf|!NiClFD zsh{hSfDXz8t;T)X?R?1NU-w01E89S-w z^jqx-{zWv=eLEnFg$6^>bc=yVyH)qK68(kFnY_*YcvF;fvB1pEKb>@i7qCgzrf+rD zl+fke{Ho;*t2Pe{4Glw$XjVjj!&-Z1hjT!J7O+Wzr)V4OERA;)`oTfP>AS-PD*U$&J|QW@i%War^A4%>id(ri9YtO594d9NA8!` zHX{i%7qMkQx~?@mC)WM2{4O_&7OzuWhW&!Y;+U@#^)K4l%zi`uS?e7|?Q3ftKU*CE z*2(<$FDcVGjncou3Wj+M-i3Uqwh=^}>ou78Zwgq!K8O`nS5wbPErMO4OUiR`L)aiy zrv+Vh3#`YU5mLde`*9{0P9SR(7lT@2X;XNP`ZUXTe`SM8Bg0IC1q0EGOU|vR_Z_Xq z8Ap_6jpV176>BTvfpspIfg1i;A519-ljbmk+nwM~s;V=|_q6Y7zNTusthbl^QqY21 zo9#Fz=yVl7qU5h!NL#bhb2BR`Ep!ipe=IXH+1j4BvpHeG3Go6W4%i5Llw?k*Ys3t= z>TV(`?@+vkXS2g(nOa{U3r8##>W?XL;{Q4>8~oi>aW`B71G&{SEgwq}XjbSipNleE zanhU?!L7x2Pj%dN;I$r%lFZ`3kaEhC5avu0H~og)r#j)@zV^I4(TM`^<)xl@m&H0VhRl=^w5 z=A>P(pv~g1`EvqO#7L5sF@9*QSLv30-4gQX9ay`!sx`jjhgYP)&JFQ~jYv?2XN|Lf zyJQMK9-iiMJvt>PC3-&gca?o{ZH*A#RsI=+>9Xs^Ga;p^%<3PSXl66URogt<^*Y5L z2`5LEykq@=2B_y{w_EPo4y~^R4~-wob|t5@6Wfe9q-MPYvH8AC(3fbPr}RgbtA&NV z$fN&9!g&LP1%PT*92D&lT+t^$UFU+(ddV+_Iyyx7+0W1Ss490e6(0aK3KpdzO@W}Q z+NG0!jFt)&+4nVD)u6X4KGi@i?E5_zM@{%bNtDClTuzu7QzUEFqn|~)Mb@;2$gQ($ zS2i66L{dEE53_7M&q4P#VP`i~VOnPIzzX&;F_c;ja4Zr_8*6KSPb0C`3Kr!AB}3No zKMF4Ep;*4*Z~qYun%`&WP<~buEbu^+^vb>C`5sZ7!@n|1J3l~oUSorn|5EI;JWVg5 zJLFX!Rz~oMOs+Q^R(TY>U{&Qv;+;K>m0Qeh6mM+vb<1(@VuH5@i5OstE7hiaw(PJX z9FOi$mi5O}9ZRmxz?BzeP0HYnEcybU^!cn#u0-)oOmqiIQZm*#Bb~2aYYvvAzq@Sk z2W!STwG2@T6Eop}5_`8(GdvdLnuf@6oOv-wtVC%fo*1VwG%?uCOC&l7NkK@F1Q8k2 zw#by5*F{^#3w>e$6HjHtrwMq>ULaM@!v1OWh`Ov*ci69DUAhD}mGt)S7+v2y9h*^nS8wwZ7r6uk?H({k-^@raCdU>pfu8x z_{f8)Ymu!RUaW){vc}GLGj2ow_<3KW4X+B1b!xnS-N)n)s`2r8Vb^TUfLK^Fe@k?3 zEye-oQyys7H(d@3RQXiS)iZ(4z!4SPy;BFHdHN;>acsN`!;#ed(PB`FFNKx4}#H z-_md#@!q6LM={MqUT@L$rmtF$BKU^gp396HIsYx;iB-V0s6Z~S7Jy;$7XtL6x)ibQTHnr*{{{V~VkDW7IW>nS7 zA~*ai-l|?3^)9=j^}GEu*7mL0+`f>MJHj6$yw>DK2|u0rrmXxQmI z=``a5+q%~2(0NSXCnY?Tp*j929eG-6w6}(-X2runC1nnzC{{Hdq0uyU%JmIe(XE*v zxtizC96WTi7Rt2geR|R7SN$^BR2ceIK8fMUr+(>%(5*UgxHYO1uRKQS?zw61lz> z+FgT?!jLw&l9Sr8W8%Hr9Wigy4_r9A+b0v{KA;Lzp4HC6^78)xRcleWWFh4_ou)yO zYV4LSuP>NkrdCNxR+0`$740=0CNT$=?9lG1YLAyF*jG&W_kDMF;KTP9kQU{jK_j`0 z8sv`&w6zUZ*4RLH=H@578sDBEb&Zy{;SlN9map*!8$wHJ1uIrPyVj8CRH0hC7c9D4 zRfFkKBiKeiy;age?JrM~KXj?&^9w@hKOQv$)4d_2dJwnS2*SG%D_`^@citoQcAs-} z&eX6I3GMAi{vq|&x{s&yHmw{EI^-2WlOR?1@b%&C-G+qDwR!zA@G9I-s2^(cvxez( zd)@I8N8GN(>LQl$VJukNHEAFQz)0L<=}sj@N4!t(LZaV#ik@{&9!Bmai2WiH^dDOA z(>bNamEhV7B&dwZ&+$plNhD4=uO&*DBoCisN!^&|?cS@|QnSR$r1p$gj2`EV(`sA{ z$)Atru%eyVF}eiM7XYLJlt>~0C$!8~K};S@b0@S@TfiRTd(&%q2~Opy3GFk;rH#bk zBBcKGq;Q<)oYFV^3I*HyWGX!L5=P@5#+hEPZWKU6ijLt1i*+IlwXvJi^rlEsEZQm@ zDPm%Y^AeCey@-RtQ53+K&uZ{7`h?<`-6MG?`Y$>`cf@TxryMJuT_vuCr0&0_&%3=qFt$B`wuhA2a=J+ zdJQIuO=B8Z3TbdL?I$5>UmRMrXQ^JhzS>X|x+lN2OMVi%rOkHNRJIA&!%K#QVzj4@ z9YNF@$5z}X@le{>lpqL$CpEUe1=>yJzfQe#aKQy@SqfLS?mm_5x|3Z8Pisl4r4hG& z=bvS@wekKHtlM91DNVh=-SV2)EjZJNONkPdCvY`R>)kj!(%k|)*2w<=?5c00@0--L z3s=GQAs$)!it#$=gW4W4jpuU#Q$&I=kHRi&SAdPyUKXB-Mbmm(%U^qk^V zkx)e<4NfUd!P-VCg)anS>0VSM%mFmZiyKTvC`}V-jcV5(Fxshlb2m*%Az6yPej6{1 z{{T+CW#%DjLS<oRfAJtL7ueg5>bxm|e zE8${w=!>JUwpWSv?Z2k1tqBDH`e(gzhg~c38m*P_L6j^Ap5$>|mDiSA^yiWqK?igc zjPqQ7;>EIsv#JAOZCjGBVhvsK?wibDcv0cWw%b<7(Jr^xv9OFJWFGZkW$mfTw?u;m zPu8{HM(PQFN4Hoc%0Vh7JAd)3m8HQgl?;#$LHV!GQ=O8Ky|K$}SeZ~FK{3EIYbr`m zVQM_`AXFPS$_WE-$GsSf@R&lfB$E_Pl~!|9m_DLLXEfk&4&eNEnu%TL02I$LlQ^XQ za#i|-a7i?KiA(a-vhLCcqyb4ciTxzOKRBp$-VDaysaU2Rze;3p1Q{tt0$OF9nYUiuDd8X(V`fjD8 zG|HCV)Hnw?=B`>Nhq}d=P@O-gEJmUjTpv(Mf__ax`0b>1O_r&owW?`qVI-(+NstG= zD}PVB?IJezRYXQOchb}LRtV4)e|n{aIN?!D`;k!nCusQBQFC9j-Zf ztaVL?PZgz>E-n(%o>E|QU3uZxLU?Q8`Lekn`l|kquh|}z8e>Rx#|WLMK_KJlQ#w1nb*Sk8X?-_z>rJGm%-sSjWNMx<_yf}x z>aiOBnUFwk)u682Vzr_CO=*2IV|%9QdK;Ivw*^jHI!QnYC%84>+XR}5Bwy3}D_O5& zEPzMX3WBdYUe({y^_vG8xZmX{lO1!tDGM!a2v5>}^~^2! zh{mSn?frx8+FgaI;6n0~AMjSb*FO|KCfq1#uJv}HmQqRz7+6S1A2sT<`bo>!e6Zj< z6Je4NU*b*1E30b@}_K9sp^B7QOWGE^-P&5WU_zJTuyF9ITw##>xT_IQzGCs8@ zc(!bGKsl(f9Xc86hW`#cjPKqAVI{trm=+hyfsDo@!McG>_2J0DGA=QT$z(e+!!C>s?LrDGE`?wR5DSL&`7 zta@hkWBjTJ0VKtAvwABwE}$o-7NHU$1e5oxc9qmA(3?YP)19;l7#>NFrbT5<;-4<| z0IoAZT(;LZ=pTh26?&33X}0=q;WKoyaqn9vLH_{5{{UIKOKR#~tG5l~av5lLt<9zQ z!DNe%CgSC>03;Pi39W;p^?MhsA@n+xA!0#Fq({AC>bzOh96bkU`B(a<7({pt0R0xG z>5swx073Ku4gIC3xP}8V+IaKu!wm?Z4Uoq|NNY`6p z;iWA_$Obu{)$}{?e$i{EuPm=^188unK_48~DD+>4O=_J~mu?f~tqLpKwDmpm4w-uzkS<~(8{6%`w$!GGqWbUo?K3SGgEp!v+vk6v;t6nzt+5-qGKd&Au@1U zG#jex6q1#?%7+QGfm)YB{9u#}nP3|C8aHN$#ti1~R&E2=tksI=~}(i44X;zyW>aTEGYa+3{~qiaOSgyS{8yd2Yowuq~bEQKm2L`eSt zg1%GKh~G=mX`AW7o#>~PXy&EUZ{^Du%ZcYf-zVz5I%;J<|y(xq?MC6r4eWYO35kUcA$03 zB;V;b3<7+_qjP3>P~eI$eqsdkG?gfx6F%9dux&=rK?ET*Jw;dAOAf4`G$&(&{{Wmh zqrA>Is{MnfOxLb7#fWb9U1UZlxT(R!5KrEwM(s9@%>bvtoX5pv80}5ACqCaa@&xvX zp|Q$Q!c%F^JJD#dH%+MpG6;x{)Qe`6vH;CWHiF7Fr7}%!^d6jblY`hQbIY@iR;Xj7 zEp;7lQRyr6hAuI4VE8alshFZ|yhYZSFZ2geFqX9|C_-IAzxUdXe`+_yuU9GkJ4-C9YSNFh-sn(Io7jt2wxp8X{qQX>El>5LG=Z2c@fz-ZYUc7YbED#)F z;|6`i*2Zn{m}~%1#6@_ibwj7>K_l;5F@`)*%HZy*>)n6zS1(-Jsn*?5Bg`a`Kjn_! z_pMkQcUZk$^Y)>)COC@fkHoJ)25!;RdS04Z7fJ!r*yH5aJ6>t`c7UtPD=JYE2hDvW zr%p8x2e5LT{FwMm+PC>v666sWB4)NfMcoDUHj#FVaHIzk7L|Keq+Yb3>YGxqKfPJ> z{d(@&+S>ln;@gb4f=?ug;-9O9?})d8R!>k3YlMMs&l+@leFn_xzm#puci1c5I~bbg zu9xclHIL4zn`N)_YKGPhQ(Hg94-@qsr|7GFExYqrX%>o?TuD-p zk@`W$?_H$QkFsr>vcx*8m(Z>HD}6z$U)n0-`ERrx2yGZPJzvyRt$A z6pTby6?i|UF{n9g-}rz->2eZ+Kqk9iOVc$wT_V+ksI8EOfe?<^=Du;_sr`OX6<*k0 zk3!5@Q@fxOB!TnoO|IppkXE;w!Hlal9-TZWjrT6NObI3d`&LDTrs7Si6iLSF`T3Ep zG_^L5bn5kM6o5;`M3?~ynnJZSoHoO&J&)-W;#+9|d2FF1cSwrNDM^)re)JxDdw+k5 zouDB_&Z4;pwrRYasYIIaMf;Fda@u5MY@gbRNl7MCBj?(b0!9FU1_db1c~e8#2#Xh0 zxo+P)NyK6}tSd^jSEB{O?;yDDxD<3E5X|FH|1w%BnoyVHr+I`oZBi%S)@tVPq zU=QBB4{vHw+DwV!D8QhBcu6n^9~GUX#z8+gtO+9uic(YESrlv=oCgR=P}=&QeX(U~ zvJ|oEAi)B(y^fZ>C$3y&-AUVvE0YqnewFtXyDWk(H3uGXK|w0on9g`LsQRZzVg9PW z((d0=4VC%LEjZhbe|q;F8&cM{%A`+V{1&e9E2QkTj;Xr6xxFkUfKZ*M{IgqY@ZEW# zo}5*lov0ydZAwUy1m~L4{atY8mv-wncP8P32nr)An&__xdQ+$LK9{t+()94kpKKLo zb6Wl))G%oq9sx_!hkA>+?5*8LW-j#O!6=nxt6mx2?Kk>Kf*D@)3E)rr)ydY&$Wu#5 z+TwPa*19{$(R@N(o2u9@6R@5EIjBg4yShyN5urY&R`s4G|{_SkEnt1LgM0>BcyVi3KCBg z!_NW2jRNJud6H-66vf5dBYYA#l^7FBvN36`j*}fop>?G`!A{^)1bbGx@Mh_HS6!*L zU`%6lWMXRbb$S%To1IEhXA?4FwLeW?FGukqm{AB@pwAKs;=ZZ;I@Ii#v)yEMh{K{? zebnwhb7_m20_JgZ;RGP^0&cg03uZi_7&Jmi`^Z!wk1hZQX;vF#%nZ}FB9bv zxGQvwSJC`gr}K1sioxh^4VZ4@Y6|= zq3HK|p%V)y%So%S^yf>M+kZe$=7a4HBhwi_QUa2;@VCT`VE+L0LgL>}K?D5z*Hij` zfG+vTe^csP+l3BNkd!95`>8)3om%=9j-Bc4Hqa~dscsc052b3Jr~FoUv(!sabE|Hx zkOBUkv>;F0n%2{F4P%@LZGA}om---d($-5`^cKE@U3BM1X&Pu_R=KccDIk|F9!g4x zs&8EN?}uGIp>DI(ZLStQAX^Y;wQw&_YTZfKy6Z<+)%6S3&`EJmI-{SpPxYTrDa~h2 z>1{dShFKwRDYJg72YPh1}+oZIM zEjgA}+oTBz6|JD@F~I)-KF;M+SE>F`6_T~riMo@G^#iGGt-F>KdqA2SKYCd(Z?$#N&1w&Ab8B#;CKK~i+a7_{ddsRjyEayvOnHuho--e6 z*|%Ko8rMpVe9pHWGb57Sd0_?4G(0*Osp?;@C6eVRa ze^3ek0KIE{bZpfwkd*|fEAJED#BO)Ctt;yWrJze@^E=T|cXMk1B|Fi-T-hg3&mlNDfAiJ;q*qfoeM zL}6P}Ngu@~;l7_}l(6pc$E(sg_N@UVZpPA63q8#!rfxN76a||KS1|)WO5Qy?(w$qS z^m*5>nn*%gk`pCB{VJ2tT4m+tuGP)EcIMTd)9O;9w#Qibhj{ISeJ^IgQi@^XgNTmx zUQ)s~xv8uf0l8H^oa+b5UT=GeLxhd1NdQ$_sR6vcUEo^rAa)gJYVoZxw4qEiR|Qa0 zBz#qaO7M5Byg+08LqyXUUAoB$T9uEJ0<-0nv1RU{uENo0YSWFOw=Pn!**2eXhoVGLS4W52xwhvAI7Q8TLYu6VpUOtm6ZNdpw zD!cmDjxsAK9j0+5&nuJsGe)GXbA8ZoB^y!|w;ii<>l$fVs( zev`6QuA88=!>A-BXOx;xNG*%&6L{F#Ytqyb=ZIG2dTHJ6_B$4x1+jX4@X2tO=DtxsVG!@ILxqEq1RFVk&Ihm~4 z<(!?(;Hv?xDz9(TEulqavY{9Q6mvQP3U@Nk>CY8oZKC25mMx|^BkNNZ8hhwxHb4W3 zKGl~#rS0V9SPch&s&<_!+HkgDnEwDKb5pi`DWmTH0My#b!o36tBkfZmH!UnB_T?DJ zGHO`@)U*($bHYhI>n43$oN}Djk%aC$c!<%>p8u4NgYkBX8-o|xeB zu5`v9K}7u!VaqGv-zHr)`ineaMQ{>dkWe*W&O6Gkmb9mA@)-$n3r^hExav>{z{P?U01HaLbvBFA zy?1Ku)}?K37UD?rN%bSn&9d|FPcq1s*{ zjZxNA!67LQVM&}-`|!8oF%ZJ{Vmt5R-&gv z2`VZ1AXg$^>F%`Ri-3q$(h6cL+VmY{bHQyn?!30YMJAc|$UV~C>D(hc)z?ec zH4Ql^b(@kP7#~Wh+IdaJB%gd#<%Ns7gUM>yC2pvO(3$r>-+H&J+V6{mjWyoElDf0P zq}_EsgJE*x!PgyJD1#&c^Icie_KVZBb}ij00Dwj^D@*Qc~+F z7$SZC#<$3CViJJ>BtZI2d~>VG8|QI|*tP4l@fg`oTBMgSxRkhV&d2T0I&Z5IIO#C zfG3q`WxGdgt3jT?*N*L{6ZfUcW(1kVB}(HT6;I3;L2^h2erqIRWDdfcSu+L)dcas8 zsd6iv{ACq)QJq6-ypjj$X*|ON(j8b(CMXLsl(}e*j2lXliIAtx8RRJPO zh^kh(safj#?451Glwc5WqhDCi>7eNPP46M6=kBsv!#tFtI)d)ss)P2oHy|>wq!fc9 zD?;8{b&rM`*n$JzR?&4YnMWlTzez#)UQdGl8K**Tn)>{G#ZlE~Qfk|yyNt*LB z^)_k2l2>mhzwEZ-h)`e@0@6KNtrq_3$HY$$UQkmc8@3RjWdpGTAlBOH{ciKAG?q0x zM%rmEp(X{0GRv;@ABXoNO}zw{toF+~at%Z}K*@jA1eGiB zs7rOr?N#NL%2G)HBx0`i3^t7?WP%BjBZ#VQo*lHiF21l(r4l4SkD9tzIER@mGy?mK zNQ(56JdP5&i+`77aHOs@xAh%8rxcQuw4KV%4l_Y?)|qL0e&CcSw4|jV_diN2t9rq` zCqipZv`Rvj*iX*yYKQQV#?`K-^H5rV3o9#(%-~fnpyz#&&lsiWG%a_UNf=w(q5Lz_ zb$w>gB~Mv8qLJrYovKW8$JV#4)u&nXO{+IHU1I*TVAqt97vK6sbE@Is4bedWTn*NsMnc7qp5XS`(Ue`&ylY8jB=td=mh0 zW{KS=Xv{#Wk43!gny+*vx|Mk=Qrl0#Gm5dh<|!j|jyV3+=e1*FkFv1Agz{EFfS>@! z6r$n+Vh;vskJ6apDJ9sA(y5p+F?#+oQdEc$})FFn7ul#PD-=L5gPj=knHXTorzl6VJt9IXoZUp?bpX+w}X!KUoM6 zea%^gmT(k?WFoqGxU~;Vmle35dZT!+rZ4s_beuTW{%-8pMuhF5KJ(g0H`8H1Uxn60My?-R89tMIbx*WqdkGbHdoy?rm!^yaR* zdr!R6;j6}41uF(O9lh&+#nA}Z#*vZ{X=7`mS90kS0zIo+_?c>}4O>j=2GJwVM)D5? zRhviZKk+cDYleeY%m{I^sh^QT^@X6;v@5GsB&|)S%s?H8uL-1c!JaemRSuTa)c%8Pg*XbCNo_##4Df1ASBY$Hz&sIDwQMbvgiVgr zs;@^NOj8QGStb_%8j4=1*hvydKWY)}Q3)!@FefUi!*h)U-GQoQcO!zbNv3}`l!BuN z+N+QC3rGZqfFlM7nuovZ8#a_jo{1QVrU+ysgkGCh7j*!H#^PW|%?|FW1T2)t)~GA$ zo9pEkw96~2l>q=U(v&ExUXt-QUE1ZQh*?6S6>`0>DUH&(=7CdtMVx(btT%l`$^qKw z3ge7a9rsyVu!H6-L==fQpL&_oyaMW7MSfNrk{{VWp%@OWD6;=AUMhpJ{46QwT*R3oBA;7W;03;Lrs-JzVEjsO;>cWt;I+8+? zN2l*yHs-nDUqUoZ&adkQ|Q|Vkm!)gLW+Axtt;bgrBAnU3*R z?*O%7t8^15c2Euh$j22G-EZJWhs~D1#kzA&N?f~Wn_04r%Q!q zJ!Uy7Gn#aM6M{U*;_tq{KoY@={EZ)eS3-49;{(PWes=Y7vSf^lR`%oDiq^W%iG5G6 zthuP`8jZ@GAFbDkAGJ}--~f`~6Z7*;s{NsdA1g2-Oy;#9=sH-4EsS5{e-$TDv{1sE zUafde(D(x!iJ{!Sb=OY!3g^?Bj5ljgA(Twxj?~`krK}d)IpBA#5uyy>Qc;=52z-kzQqLalqM9jQ;@BlT9N}y?G>UQ20HJRlA`24c$XfP0iBEnP=9hFeDsPfQlh* zDN;!0w#vKoqV4)4r5)676p-t?h+44k?v z5Tc+YCJ4{>qJ^ZpX;fula1K!3AX{2o>#V710WY=`nSqGnpXi?sZ7y}xEscN>qC!_E zKm00dQR#c`r2LX>SaHjQ1SS$BaoVokBjG2AIzFb2PV+=tHtPq}RY;z58;cs{r2}3e z;a@aPpGKjgzoqCQyDP>UGU3TFTDJMqq3VC&+OZD0R(CiA4aD(R7v0q~=N05!Ic&5_ zTmZr5iO@8jo$71i{MK}+RuV={ zZmWGQN=KQ%AE<+YP7OV< z1i;?_?)z0!R`B0g(h|FuudUxw6+Xm>t)6`3OKx4E3sAwI^{V$)*lJexADVjUr8Kmj zNOL;)S_3lqO2_!)D}*^c3ew}N?-z!kG*s!;nS`yY&4~5mv61LG)~jV{i{Rk z4+kDr*hvN_88v3;4PE^v?YXvf#5#FE5TA2bdXxiE6*#3wDRviIxz+kCe_7TR1i?5e z_^9iPy&n0MDT{#1@M1kb^R-d*@u%wcio0~ocP29*?N#k*cJ?Y-tZ#{RJjt&w7fdof zhEv@rVC6C54yNPD^4?i_C{zU#CMk^zQZ}uj>ujY7A_;*W^#Q2sUzu2K?7)I!1kmWd z3}K~`2Ox13?R5Ge$U__!WRq?-71{ge^<<67ln-%4*(%+pN?$Ofm;mOZv>i&#cBu>zjm>Or+q+ie(oKHsY3|Wm!4z6^W?n210VJHg=9y_tZL*NNU_V+Jc0Wk_|yC zukAt=<=OxTd=py6+g&L^Y4?dnVtM*dx~{cvX0lOolB1XhF%>}cXET)6&e~fN=fxIM z=JLToMoN-{{{VXRw~99R3QE%X1c==RwKx8AUAQZ5-7az^ z%a~X3NB;owk9&4Et7sx*fz4KTMVN7rnAt^8Tllf4=+CC}NY&ABfO3*}`Ky;t_=eTl z7I(`^Ur*{IA8O>^{!{fkMTUdRZL^t~Ni`*5;#j!eS8_L`gUlXkoZS*;`kK_wG(1^d zrEjX*T!4pOZ#f%O44UUJ#D0pai`N%!3X-&AA9{r8zZo2{dBj~my&JHid(qu-;trFk zTCHesI#!sHOvF{ri=}>(Pz-@m)tYU!a}J@PD$eCQu=JRI_ZLPDnFE-&@At~Jkc#ie3Z2G5L)*Z65*R0oS;|oesr6Xw{ zTvw^;GP*%c!1hUlcHdb0)tASOI{W-Z%}s|lY1b-BGJDhy;la1`UlEXo+1`g!xDY>4 zt%0syY1;0QZPHyysj+NbAhUFH-yi8!6=+>c;IC3xbvxGMRnl2dNq*Zq)AJQaQK@dD zM0Dex%EV1@eivw86x?a=H+0%dOKKFA{+#nQ^N;Zzq3HU5SKYg!`CdzotQML$N#=i= z?@Ruuvg&SubE$N@lGAS65L4YGjv&|09~5;D%JmKHo6Gam=I0W;`f7)TBbCz<(SWo1 zq5fXbs@4|BQ)yF+LS*EXexG{VUx$wm^?tbPJ8SJe%s*wPyp_DZ&<<-w*tdCic2ZXW zoDL?wgnkNin{5ZfH|}3y2!7$?>H{hs)#$uSsQU(u#2-_zsq~E}t9yo5M*@}_Zr!A$ zA+&^n^cbuaBmznQ07{Ha^46`4u(t^lJON7GsV^vLhQ0SHO?*yiEbc4Qc{_PV`M{7r zNIu4^{avT3;@;a;v`SNTr#a@J&nfOdYLNW3%jrI4$%u$Zit;q8X-Ie#jL!8O(i<>q zv%y9f*5=o(I*U%dvtsS1w<*+uQjkn5+xyp*sJh_(m8+zC)HaUT&~Z@OEbM#)9lB{xVztnDdqNP|b-ukvz+^5z+o-wWY?I`(!H7 z!VsknQ`)Sq3pT8re*6-cINcbprFdhcv4hW$)vR4yg|98;X@02dPNGeVpOd+TrAPW^ zQmLeLrnHSkq>INLL%~2OIx=cM#eHhZ)D_v?)%T9yYFFmX zZ8+g&Y{FI{Mg-Sbc&68#(buSXmY3)|Hx3MQTo10>P20__#34<(eJ6vO`nQBz9-~SD zX5Z`eSla0BO1oCuzO=d4*iDB~Y7gFqAT+0*B>ie0;>m@vxwNd$bs73pHKn^QxZ0lt z!5Nsu=C1dQ=m^u;b5FW;ZaD!-B6j8@73{XLtySTYSdP)3lC0Qi4c`*l(;)B$38~!^ zO;(KKu0DuMX@Mqj9qGGUUnTUGWdJCC(^joursGD~*44NG8-@%;RBNR&SNT=0p{rz? zeWRbvY8`#&HC;i=phB4>hSCoLYX1P?hfru%mhR~Kri?D!b^=wm^nA@!zrw|{PB`Ly zD3K}Sn!I=qpxa;T&b_F#Kdz+&@8h3M7gpFbh0e8sqc;2%*WMH=#B_rxvmhv_ouiNl z;;u?rXdZHsL8>oCshufT770Q?LO_sxJk^EWL<|!$BOfBaJauM<>WOOh`h2r04({o_ zGpw!NONYvRK3d87_WRYfPJ=2&P)P&nTJx-*Z7Q|A1eGChJ;hlpb#&cZH0yFpjmm*O z)f(9M#Mgw@;nb$h#@O`&OmR%E^+4d@j>ojrSLa>iCNbR2Bl_e*QcU-ZR#1krRe;MJ zDN}pt1g-!$6aJLjm+hfhQ7}j&w9N*MFIBn&%d~Y<5O&1T&Gde-w3WEp8w8KkxW!10 zJLL)5&xnu32CY~H1n!O47^an~C}6C8YDVKg>FqHg&0}A-w@Nd#tW|GS@e9FjoCP<1 zPRpu^*cBpb+&V|<4MQ89^ay;&{n2aGU09R?x&Hv8+LVOfs7P&aPqD3ktbQ!~FVa$^ zX<9M9aRvcwVyX9^jom>Hl8X8J)HWSIrnP+GGrkNO)O~y7o{qaj>GsT$ps-AwVE+IV-{ME8 z9MklBJ1bR^wGq50u{r+L&lZ1~)tORn0YN$S7?L~9eQ!P%}{^{K^P0iXnErqSww{(9! zXyIz@fE3!(fN{a3X?;-D`TVu`^6tbo>Obo~;)J*9pAxmOO}>r!M3a>|vLsQicqP;; zN!4%qg@!JfA#K7vyA#Y;gX!9LK2RJDeHM(;v7(EG{ZwD)+R$|iyKAJa2wC%xpmvX? z4F3RH+sX0+mkKffLQ09I?)42R>$acP-nO{7)7RxZ)PNR_=BKYbdhjoyZ30(rTXiS| zp%&RcdfV$=7#E2nIQFA|lBou(XxiqIeo6+{{{TAcPDY#4cWMPf7U%TDed=PAk0>Q4>?>6DSL46L?NlkfHFkPx7ulBO zK>cQ_>HI%C{uUGYez{FLiI2k8x9V*EORQ~t0JQSK>JFp0ct8tEVF;qvqIeC_Y2T_} z=?$%+1iboIukSVUtEjwx@jIz~I;UD{uOlHyO~FcI?Npo1Zua$RarYLvAE{20KUp=i z4}~T_9S_CdvRkB)*nFq|07wCSAlH8t-T-uZ6yA|?bp@c|7K}hA>ss5X{{Zm@uw<#e zm*{s00s`(_$LuSHS9td6LxfK;lS$r8DNd6-?>*wSVeq^_e=)@VU#5RGU-<#q7xgx} zORB#dek*G!b*nqZH0IO{CfT@Be&)3oQTW%_-AuKePpY+d%Ayjhq7(ZHqd4P4lsgIo zI6vz{E%uQlsKm$hMd)Ti$}y8M!Woi)tzJ$k}fY$k*DPr>6a=g={nmOzR$X+wuF>%yygskptsUH(H zukX5hSF^Gjo7Ux4=15-ZpX$v>bsnd2c3TN9D5^o36Ep*tI;*yc)2=U8<+^Z|%tS?H zh6u*iQruxL_^?zplh+Rr5Ymj8`$b6$E7i;>jsX+%M%y`R!v$j5JCXq2WM|&8{=U-H z32~sj4X6O9pSEca^DhE|wHraewh0FZC6#$>Cdi9L<0sM@%LqX`ux@N&g`)T z#gofpc75?%i>CTps}s^o{{RE&%k4)|eE=jhgOeGq>tn%h26`t=by`0`>5Qx<0+i4s z zDkm!&0r#5BJ~7ly=!j7M{`AI}He11t+dXcu~QbSOq9&Yit0XzbMoCAWKyBHwJFAHMtJe7Uas*^YE}SwC?%(p zgB5F{buC2tpXNIWT9$e?fqIwMLNZX?@gs(xo0g0IkQZw{xoM4e9MI0kH!f z(UJStGIYMXe9ir~r(<@u4`|8HYTV3SYfoD@s*b2r54I;L1R7^n)5!V!#+tP{c>rJq zR=j8Et8E=aQD}sh0R286#Q4{p`t(n%^&b6#tIE(A%uORXfl6~t`KV=G5 z3SjVSYo-YU0eMw54BS(Cj_`caB;-q zf_m+i75d2k0OMC?giCkbE+%X%dFlOD&FzzWE}SQ9ZC)v>y=m)UcLap2V4PN%vg*&u z`b**_d7`d5!TYoni9M4(0NFt3}#hF{CB8njvnb^{H$C!=73c zBm|sR80sdj(tO;NVC+|V)N0n8N(gP>U<~_F+D@wQWlLML5Uifm8cv)db&!H*7dDo~ zyL}2#C?pPIXhhwuwUr(t(mwT1YpTbZQ|5LfClxH-po@k;^JI_t6}HAuG!-Wo3@aVJ zxp2aiTg;sHqcr>GZXX5Z1#g(nDvYg1$Rw>~gV=WyPHDQJBg#XQ85FYtIizAr!q_i5 zgcIc}1okx#e|VxLxfzU9P}JOUFq1G~5@Mum0v~U4s)AreCCqF?aS4IMn*|En*N-b} za$x;CQC3|scdNL6t11Arz&IP;H#v#?d%CMgXc)iCis#SdKu$ zl1K0*PR<=>c^6&TS{>UIr~+VbtmRfQsu(iSittCUk*OO zHoB8xU-X|$ny4d{m~)Z&mz7j=K~|oirwU#M2q0tWPPd@+{;MfbU9+YET1FL*cnrxx|T!VrG==B;$uUh}q4 zKdL7-#SpAM6?JZ(rgbwqmDoh?g%jI3t-s>Vx20>XTHfiYXst*erU!0uT%dsCPAN?- zMo%5;)ziIbTR)V(-lU*LaZJ{9qa(zuajxM-Q*0|PrpuS=Yx7qQ?qYTTqHCah8tQE? zsCs!_CDbj4RJ830S>+&CK3wWn*Ov|6*tn395{=p7t(_Zfb#U;x(q3B^Y1&YrtZuA+ zrw^GG3=o0>cV`Qty8NS}{4v!V)9i)2NNB04IGW(zwOiVivwF3|WUb_rxMLArOV)jH ztaZmiz0x-__M^{?FoFS#Wa3@HG55^Zk@Ezp6eiF z%17I^Wkn;{%`&4o1b?MqsRQ)DjzxGk>L}!^n{u56JjgR%TE}A)&hhMXn!=nLcod^E zc?A$=P+HZBZ|waFA@+Stk;qWum!#^S;#OsD9j`L4Db%0(hkAR>k5D{RCZ^-MMdEda z6D+tkT($;274@ewZ#A@wW+_jp#QV?QvV|a#0E0p|a^1seb(aA`;Zshf$l!C{YNOrR zPTV6<0Pb^AmMjc7XYbmhERtPPeMSd0E~gU9Ma<6L3oiP{8*Foa)Z3WlR464YhSdl)`{iMN~t?0z!^^sOGhN zN7tOn(rHasC0XhE8y;kXl@-<+UZ<_xHmeUQeoT$4RBp!K}Z`$M9pV^@piS^Z?ij(b$9Fx2X!eR@&W#sf!pG}=B32| zrvM5dPa>j!H*}>CrWZW=zO}FV@2$1X4fCdj3v@b8*FnW(^xZGpbs?_r%6p@DZ=@hR zdFqE5(^aO~T>`R_Kc?p+yo%(T=I(V1@*lM-aG8vAJl5aVw7pkRy>n2$zfH;tiETjS z4{RC@o^!udfEKT~*D3R2CB(LP#XjMybV@yCVS?Q()v!RsHG_Uqp4X;lCVIn^WhIm z>H3zNcW0?;cI-G4>q^W>_swQ%I>G6t+m%~cqmNQ^j4coT3vH+^&p8P~7Olax`}`Q!kH|%6P46QUOtUG#5Z&sJCv=agoQSD3@H0mqgK>3+bs#VEZA7O5VWs% zrC8%XHR$Ja_1YppD_MaTSczPb#b*QY)au-0*vX@^cAjyZ*{5lODH>GNmGCj zeYvhs>8}-hKJy>UDQ*9Jz5#i4dibWFB!^5cno}S~Szk zRh(z`OFI3}AanA^>ua|)ZyCG`>9j2_>j=A3SRpE$`&B1a{9^PCiTuA$^zxoq6S+eb z#%V!bLN`zSS+541I0%w~kAYhHf8qZCON%o(&-$P5^-%pwkH6ke{uf1S-;G|hye=`K z=*(LnU=kpK?kisFpNMZ0_2?H}LiAXAAw15bqZawq*+5se|{4w|=0QEo$zqLN8>J3<=Uh8+SfKC?a;^%}A1Jp395PuPFGSevSJ z?ws0^Rxl5kAD1bgW}U*`E9$iRE%E3P1~{UU)B8k~3hHi}`~!8R@=(2hUQ#*qw4I;H zt%+s-0Eh2RBHbeUQ@VBU^C;XA{i_dALvnKJi`xJvo%^ z8Tun9V7FuHr<~Rq2!f&rF%&9wwpDb5d8Z~1xD=**B)md=&Z+BWZBPc{8*wO%d(ao` z_#4wfYP{-4bqmmfjm_MZnU9Lq>G~5K%`!K?_mA{dWu1kjHP(JWm8-m1>J2kk>J>Cx zL#ehftomoQYmHY@v48qVw?Z2LBy7Q^`nN)JQM|r;rM2sKO59S~ZsFaoD0_WkwcXXv zQgrL2>kO?bH~=7#A6oj{63gX^Z>RBIPI&3ZD`#|F)y{{h+qrS5g2I#%l`E8|>rx+x zu7tGGk*4*QiKwFGyVNJn+M((1#cHcwuuFh6>m+PF&+|*_4Q~5gwr0@WIHp>NK~#j- zO9<4_XCX`zxr1p4o|D(zv3)Kw{y`8X6U}tfUy8PTJ?T4Tz0-|cxTJ!Wsm-W3u1mJ* z^#trXy|YSjLu8!poCic3CBs(_1-hTaKNK$xrPke3bZxFc@)_N+Ja8f_hY~AT>+@Erd%fG_e5~5v@4Q11NN)^FT?s6q~7M)9^{l-`JEIu4FmLBSFC(E zx#_0v)p@9`b4W_+k$ZjkQX)ib;UoAza+*)S?Wi z5%0uO7LZ^apnLYKH(PXt{-3BDi)LI6ElMRIdQ+IHx^#={g$?Qn91$@Xsf_78_B zYKCy4jq=_FEVNH~h|PH{YLAc=6N+H#0@RcFmQWWG1XD)$ zWvs8N0Y{9Wo6+uF65@&{vWFDvv<6#F<+=$xjlklIvPQG4Dm1MpQNC1x{R?HN6F*AW z9Xa@K@zbmp(9!w^<+fJ?&%ATWAIPEe9yxdcSZpsNac|>~)oXvsY0MYp42a{{Rm^67@B<=TvomouZ@s?K0n-sQ5Lt`d|M54-X1-y|49WRO-6o z#!F>EvHt+t)hW8Jh5=GO{`9iOH2Rze($DC)0n4NZ3R1Sw$O%ak{`7X0(!EEo+=OTy zGpXOY;KEtAQOE6HQ+jLg+u&D7Z8|@PI&#*G2Om$EN%!?t{=-Glw7hAW4TY3&Sz#&1 zwPerZJq#F&DP^$pllTwyUoU!Z@SXUC>a-zteFpBHl^@r9@0SU!wbLK?cXjp9Li($$ zEVR~&KvQfd%wO(ny~>yDyVa__?*q8`@D!o|NUPt&Z}K;SgWPz68cJK01YYanL4U`UUpWJ|Bq&Hf|G zNy*A=%8Z=NC22`ASHPzXfAP%)s@@{j(Ml=;1b&#$wN;FloRn+@!~mdmm4AwAEa}Km zErTkK^xWywmP3U}H8t($*(S{M@*raGqK7rK&``hYDJZN!2905MwKD@t7ZM;u}? zxU1JpJ#%lPFx&2-4W%Had95Sk#rrzY7HmF~sxed> zE5%z9r7ll@n$6z2PjQS2-Je8db=DPl-?3e;x`RiwWoaYMkr^9nR_gsi7UIy!AP?_D z>e|DO@T>#-imO~+sS8n2^%6h;{8h~+iP4J(3Lfy{j=a^JA{4oq9QLTIi=y%hNtrp% z6(4tdy+o;F1~73^_gbVUY9vNYX?Z!y3q{;tr2#-GNh1k7VuV(%u_Z2?i2Bqe=B(*K zPd@RVy+f~6+(0rxGfw+BEyzW_m8H#bMMNpXiT&s|HISfGRV3i%s?Of1B&iFDGc?2Z z%2EOrqD*r==!TV`QlBweUe!qlYK1m6bioQHM{!j#ex%3*$;ADuE4$o8nIeGc8W%Qx z;al0%ikGRq3K^{IV7sTAL&JIr!EYJlzOY0aC+dZG&9Fb_OUA}d^k zHNwj+zDsizS7*L<)iz=};qUP4|2~ZxSsbCqXZA$UQ6)NGhsRsaqJF)FZ zgGLzt07y@4)-Zw6mfNrFxIhXr0XzdzI-gG^2YWjnl!LiE0BAcK1Yf)Z3qV&X3NfE* zd7J0-yN@pJUTiCj3Zcrg8h#^Q3yvTHZ8SxF~T3 zVE4^ZwcSF}_=j!41KSl2)}-aD>0hV-WUJfatIwovvNK|wr*ltb)E3&S&)uV4vOq); z<|1&RTeqg}x__xO_AVUJtrk(tqy+^JrE4qj_025MlNc0MgdU)`{*`{yfHSxV0U!?1+NB&JI4S^5RUh&c+ZvvobLKYY zM$w9uwY@303VkGV2a3*;N;V4M z#7Cd=O{w5a^FldxkZ>|_KNQlg6rxBHJ%=;~SGh5qbKuEyY0DUVnmJs?F0juH~|S%75vp&&{m~ z3Mmj`Gc)m0bwcmCpM2l%Uz&dqzl z9QRc|)eDIc`iSflmXa3ZA=MzGa1sw{i|P$V;pUBvhTyY;t+P_D>UORrmUQ;kOZW*+ zNX1%o&YoqvWGTyeaakpJuW8hJ;OLqW29$cp?6PN`I34E7KIN#<(=WO=yxCIK`js5f zjP#>`31L`)n%i#awoD0qcFo8AMJcFlN2$6CNZtAVp|fd85>kf+eBL(^9B(jg~d27hYS(sT~Btv-m|_XGOiCjGNq@rKveAL_UEhv6^ywYu&Vt0j%N z2=Zk8^Hn{2!%mpi*|^d5yJjCk3YsnyfJe~%YnwH1$M0Rb3UnJFi3AXxQ&ZP#WLLP%PODfg{kt992{>jaHQsV|-c z3>C!w)f(2jt+bGj@f(K*@AIl)dsn^DblKv7Gf?1MJLmlshw5BS{%d;buW1d~tN#F2 zL?&fsWY)ZAt@JA`Nh~N@tc{o`7Vz01i}}rZMCgrQuk%QQ3Q)iUAXHCIwR3Z1i(9r~O&y6!kU%1;7&P&l6n?8Hx?O~- z&C8b-%DmScQB$Z)lB1F*6=KpgEn8jaRxWM=0Yv2ft+UL~9Z{m+IloJ?XobFTNXH-d zt)bzMf_+)5^!s`f`X%e-#KIkH>_`*uTAI$Gr_pJ5%HYxc@U!%AK6xyKpfv{{eMKpg zz@KW5@=_EMwT;Bg8ttx|{{X|@*5n6zk5|+RR;|UCUI8QGMQwhW{1bRdpd=S`yLXg0 zDjs3|&3Nrk@dKslhS-DNeodkHk{6&a(7@V~Ve}dO7Y2A<*j?y(32{UnkP={2p10wj zh<#VByylD1SGO&!ovs*4JM&*bI*-AB54v|pF6o+T8gV29fZ9Z#u&s~Nx*m(CX{-xv zBHg2~OeAv^<+VS=QY9|a!~y>Rh~0nEkae0k8YXBjyn8R3{W01fH;{P=N)aCu&38C-Ck>=0*Z~!VI;8{aC*o_*>i+5AjSAgG zF%Z&4Y;u#%@;)Y#0LE*|YkWo2HBSC?j(63^`ckhaSl3O1C4DF;+a8zcZ7o0g9TwFD zf7IPbp)52ZhFWNQAu&qZ?^qxVRy>-y+%ACozp9}5A0}jRKT?!lSN%u#q>`ilV_uYw z!o9oL)pt(!=11BJ3y`%x#eSt~lW(B(rk$rYWF>B_5}%j?wYOIODEiXrE;D!5O1GRA z?Ai$gPtv)S-BVJ2Ma9$01k5Q!Q`%mT{;1&c$=k}z7y`dv#o^67c_SY(wKqHBztL<9 zuN1Z3roKhGU(|0@r7Bl+`BFBH_@OnPv|fhDX4Qs;;)E;H=}97>bzN@5rI=&?N5s`8?_D=8scMo=Opf)X4@!xr`D~z|xH#mgd#z(uzIiu4n|wLEulh?VBCa|g zi@il*XmrhH+SgLE#?)M*RG+x5U~eCJvX&BZIf5xkv%R^AB_#X%)|_y*A%jRHXqZtJ zwu{|Y;ijau4MV3cEfldO%Xj1zee+gci?Zo`T{li?w`*Hyl7!q0ryk<8gL(zV;pVv| zKcvlUZ5qWrJ<>N97H%jyv`HyE$*#7C0@GzvngGVwwNvpgUTo{8&q-Mbw@{FUa-shK z4MI6}sob}@PC9pT36W6Ft>x;N4T`G#3byOPn)Nq{QE@ex}YWjjvR zhJaLkzLk363Mf<)Ja(<+_+i)YI!CQtwDSU*zhy`$3K2X_X|!t2-V~zG&AU?Y5W-5- zejp0io)dIWijMUzovdj+0j;@i!@#N4+bJNA+LsxTj=3BFRwdIqXv{tvwoO`J-Jz{j0vT~;3Wv2w>;4DzPm6s;eW%$ay#nRN z&|F>9Mls*!tX(bmY}GtEyl8a>wPk;EXrD2skdlC)I|``XObw9ka5wW+1P*Ls#W{NO z!7B}N^;SJt)5x=0N>g)c=}yzyx!=Yg!^c*12B_uFNxOa2np*fvXbwD+>~`~Ad9CWV zpOkR7aF)~(VIzqGwT-`tTK@n~Yi)G~oUrI+adm90g$d@DKDG${2Jo!u{ z(|!Q>=hkaNbdL>nCWDv`UVlX++nU>5JO2QO*Npnk)pZ8HqUed4QbF^{72Z7;)^@#P z)7HAao}?qrKvIyO@}Fv$B&?F6O?gdkjEpYX3qQZj6Xo*UK#T+Pv->Ve>Hh%yIXWKG z%6qGN=TX$wnBLP+hR^L=Q>Om_2>$?w{+4MC+4MEL?;;PH`ijbrzH4zN0Kkum$xQzM z*w>uZc&}ZkI5ZHQOyBQU(t?W7`d6j8dfgWKH%{4Fwu}IVk}6QF@Y)jC%h)MVkZ^iW3V;C{g*5#{A1>^@x^CvYDpRX_1q##j`K-4`LAtB z?rR|l=O^z(ElNU^KoA7{)laEz)p>t!q_m<+oEzhat3&T4rdH&MN=X^2#){Cq)vh&H zu#~_;h^tY>VOrCTw)5Feu+nWU(!v!9N_gY7M`{|8LW^n7(y^#(2rDeH3xgju8Goo- zS+ZZaaLOl)3bPyq&cIe9h>u&=H4RqU*41|xB?N?$l#>Q)pSq`7aouV6ZNW=U;UFF= z*VX#_w<&YVSlDIO&69uOEO7HKI>6Rj?^dsa4IV6 zP(xss7G&d@%|Tu3!6g3xP$eT1F~wDNezCM^23*{rV8PA}X^5`@E6k;9yw;l`ezHi% z^Zx*9gS*u?twgyP;(k5qp?THe#FQ`$#YYR>R^XRXHiLj^?9&>)6bD}l(SNQWr)p$R z@l~6xXenhRu6{qYIxR2VSXILCbCXXUIk!&$s3s(g(*R>ma)@psltY(`cwr<1Cp0l( z#kna~+3!`#q)_E42QUY(CC7rJ48m;O1mnLH*mx~?82Zz0DYVApA9_H2u&4wdXrgEXB`m+@ zr7hRE`A+_mhz2U#XKm(KEqlmIY2I;yIEtv*1w2Fp&m??RhT`#78Z!Mr0ydF7=*YAi zfXG$tLi86-)e=WJsCO@vT_mi?j2QN$++7zpEMjLI)Jm>OiGqH#<}lV3XS{=Iaf`jV zBnmwm;@kZMz%hgT)n%v1Om02@0O#{hGT>UbPaI7%Wgrjk6~fb4TClYd+)?S)_auVg z5!^*nlXO$*NuQag8g<7wk)L`K5M1w4xVNm83E#&UqW=KJK}hn_Oh#gAzhKR~NDka6 zsFZ*bBi^J2qh`qkE$-XN=Ag#Iic-=;fK!Y=b8r%-!hi&1aUJONTqq(G;DPRHs;zzK zCA1|V`v{@l)n0Idx1b)>m&IHwLdHtDesKu&s^AV|=}H=#LO^qLcdBRjkxGAABNdPF zAv2N8d{uWs91|HK92Ia~=y61X1deG6e4k2O9R1>Irj1Qops2~rjADsKr`!-v6F<#W zbOi9OG3s$oTp>h-kbWx$>g1A=qCx%YEjoyZB$@URMGNNA-cKO?W-6=nz~qH#vf`2U z_v>a=l#$;w>-UaaAbF&ek8_HORpV|MNCuF*q7qZOJ?g9Uqji+#N{MyVv_{2)7|sM! ztgKv4N#G@7pKruYjnWFu_3H=-?xzF_`P;PfIoo4lC+M9c_BPrrNin26 z>4FNRMg>f1{UGasC23L-3b#S?X zxg-j|2Zp-NuMCCN^r89E&X#Rk#R_lV`!1=m==%$FgK$!yJ%{TDlsLh$Sx9V^7{nlgj zFPQ%THf#C?^t)8+o{Q2FMee_BHjXz6(taxV$>E-~mh}5QV&C(KU-aBg#O+QtDJxjNl5aYX1O?{{Ru4X>IAGp#?E6JZI|^ z2Um4IjNQHNlc^UTV&#pEA|!4c8qn^vlH!K+`fvosE7n2b-j}F1G+T)G;aP@fy|zW4 zqS*TP;tRy?pi%tSQo7Pt1SP2vRNLOD>J3pu>Ke`Kq=N*yV4t-_vfrHGX@olR&k1d{ zDE%>3eHX*dzSnjqOX&Sg#4ib2+Ss4xHLTq)PwB1nv5W)g)oaSsP1vXvD7ou()hSWT zlbEDN@f%pdM>%|4@TJq490Vrh& zLVujrWd17X`eU@t(tVriKl^P9;Sigd?QhhD$<8vT2v|`<5_8&Vt?dQ*Nw}Yc`lt4< zpq(}N1n6BnAOl>y06`@jlh7(yjj~;1b#1KgDs0<(b zzhzb0-k%r6EuUtK{L1-#r*wx^Yi=ZH{WqyzB#GRH6bJ5V?V^4g{AAaBv@z3d+M&#a zzOo1(NUx}t9S_mkP)cm{Rsl~EnH4b8c6P&UwX1CpWT01{)qfE6oJ7dk^(Dvhq4}z= z>v~pyg%Nku*XX`?bnoCV#4S`Mdd9vPN#t9!69ejNX>{-47e~>;F0XZKtEZA=7o8aT zMRpi*XEPqriWd1!ZAwAhRC${7x~~~^Y1mx(&3iO8qxzLu-FkPOtYca}m-?+er+yTC zK52xi`LsCrM$ojkBz@|qtn?3unk9~<(7jI6cGsv%+|%yJ+qe-T55L89pQ$Mc2OnD0 z{{VQ}`PnD+Kcyhk^(p3%vS(O4Py)XI zxVrC2Yfg6J{`vjMwBHIHql)Oy!k>$6b$?4aq%FX!n+Mc@qY^Nj-F8T(aA zTy!ZU10K^`AMh1vc-^JV%$F2g-m~m;UsUmyjjrfUpLG#cUo_1W9$tK=~=i{t(tt> zyS5omyN&=qlU0pl#a|4xB&_OvW2YdXWhrxU{{Zc1qv=|gyJ-UbuRn)Bl5BCwH~38_ z=m}PONv$oe{xQ50(bA!1sX3`QoCLIp&(^hfQGen9(>`NeInn7!AEkE=l0LYttv7>u zmacdrfd?)u5zso3c<6!>)^}@b$^;hF>#hqnJ zO`fdQp4#vd!(bHs>ssD;{{Z4G?ZU1f>f7?Qa~C9k73nm;!wp--%R}np`T_k)vN}Nn z`I3S31pc(B9XHc@p0xU(x@3S0a-L;5y#HbDVtn0mLVBk7# zocl;aVhChp?fOt!c8k@$OzK$a{+8AC1)tJdv{6s*75Y!?v&!qL31Xfs1qeEHljdDM z-+B64S{i?yuE+ywN&0#7?YQ8R?FT)pY{12`RTIO#Mi$z|Vr- zCun^n4WzIe5S4yaB}4BOW@#y5J1wo7X%WHz zO(>D|iudXhFhzXwezC2bo$o4}i=FWs`lNXl-fy0pMuVULRuVTKy=vbYH5(gety@xp zR-mFtJSUI!t*i(Dh{=I9%U(R#YdTL-xqEiy%Ius;OGOAON@ulQ=`%UfTaA@xM<1B_ zC00(b?cSzs?Jis`A#!BMh^OrOcS*X{nrTQS=hQ$S^?S`x^lqTitkmdvH+$EFlFI)8 zSJt<;;pGhLx}EjbrC?rdl#eCil6L!y*50S67#TvWtz#L1ra}z`x%xXm({wEw-q%jI z7U|jwl0D-!JwH5Gkc1^62pFvG1b?M?twf${i-N(C=0_J5?a>6p)_2Ij`K%QG0647q zb2y|@3@=FM`LAw_nm|s~6rTK2jCV0np21EQK~KG5OOC|NV{&5#Ya$A<8Kwpr%8I4o z>dJ(CQiOX%*NOH#V-<-pir~;WUCPNYaaaOPVoAj(a)IDfkQY)~h~OGd;h&DwlBxdy zBvuJNz)2Mp5dgADJP4$$?MXYU3g5s3-M0G}``5iTD7*hQM z;}svKI7XJ+Xjkh=QjG=G4*vj(yxo&d5)i2|$I_B+&8@g#05&EhbN>K2t%gK4g{K=f zuqZ@H~4)g3_NYFG};_n(^e zeH*122y>EWny{ogqpQPc^3bI2%ugn@X0fX(?bU@ib0p@KtZQiUl($^RVoX&JSL%ya z$wN*ORXH3C*U)sDF{f@8Owtz`3R?S6V%?%kfT(+()j`+#sHCZ;lvF=@P3rZ1P>;&O zn^5L|NSX~DFyksO-7RHPxb8Ur0GO=+*0U~34G!e0z3tAms)c@CY5>TeZ-HKCrCm`5 z^~I|LGm?F(*ssdj11bO@-~mw@pHj4q#R(=SJPL7_aHa}fTTP%2k!ff_$&r~=VcY9F zQc{&bA2nXo`hoYBy@)XoDiPgE=IuMBclx0u6mF77BZ&5(U)LA9Qe+qu z1A1GLD@i1Fr-q)SK~TpL72Z^A;cvxRI38?Do$v$eD`bLq(Lc>M9|- zcNU$yWWb5-X&+%f=_HxAExdCbaMc$3Dg38AP5;Vnz!_Kh}yn|bQ-q1S{X6uo@-sO z^KOC)=NydDjk2c%vhFa}Q*v@QG=>Q16z7dkeWJk?B>B_p0I#%d0aq`Pd? z(b(WE1~v0xYfHU6I_Kss+7JPf2YMAOyoU)hp7Dz4o|*h6c%P_*w|3>T2{KQX*nWSj@^Y|_-c(#QPHRK?e z!j%#xh+%_r;6;t4<zr;O$4wccDr*QzO z@#Vn#*4gMk06a@(+3Q=aIh%WnwGS_3sEF=s=uNhVp;;s**GXXkBLtvO*MuEr%`GJ< z^3t^!5s0rh)Vy=9^8GDiK|QxP{w9auslTjgq$EcP`_JsS=HKvHd)7LmZFMd6(+aj} zDj_G!O1`zRx^M6?;f9b>?ft7)OB|O}T>kaEdZ$*k>Eho}y>NibC(F2nkJ54b$*Idr zt9?q%tNS-Yth$i2tZ+fBXZVAwYFcBGSAaVMv=R3U{L*FXI<~MnDq~Nu@AWpQx(|SU z7-$WI+GrMlj_6?{`KxuGOmx{-sk`%vsKrQE5~nA!lEiC~&S)-|S&$rBs}ltV?O8DL47fssRBTrg|!qC6! zqq0*ICbup1=96UF{{Y0bTWfSiLym#|wZ>jAbvH`d^|q~RZnWx5xZI)CdXg4F^osTV z7wGMqR?_eQ9@KwM75xBc-7A5|9?OqBdFlhNby)HoA+74%*f9wtMk}tr@cOg2f2Z|J zRkA~^DJ}yUBh~)^YU6IFw*2o<-Rc*K4f$%?*f={ut)<{MjU7qQ4?T6#mzx10r%<6N zSR7)$%i@g-_5CC4(2r$q2}^^R(?qYSI%{iPxC(5Iq>TM)H>|q9Lg;N0<5<@(Q*O&B zCn^$tmBl)jj@~kBx3;Ua>NjmH@03f4WJb~PHLQG0>Ro$T)KO!1)K{0yM7oz;!82bc z>D~m?TVFK++})q0Q2kJjpAdb?CH#Q?r}kTN^QrB+?)LMm8UamQI-~-louHVj*G&E^ z^q&uO1Zeu-PrY_6QwVvtB1f?iT;I{!gRE&USzCaXfGQ){fmJ@Oxz#@`tE)G+ft9xB zX%+AFT?a|5ia0Cb!Z2Gbg|drpxBeGQ^#}eSdW!cq)BP=NZjwq;0 zbx^chbptkNREcFE5nRgtsd}fDl_(9lgwsj5xOHHZyhZ^Lj(_b}pzwE3j*Hp5{$gGF znpfH6L;f6XA9wZTY|VGYzPH!hTe{a*-(Bv`-!P58wN-9w=~p%ZU* zvAM?30VHKv6tQF>AH2}V7wKB4_DNEsOeGy~d= z+R{p#C1=|ms}4QW?4XC;b!&{mz!N~Ps5I25wP|YO(3mPRWA>}@KtIag$sou{t4l(z zA0HD?Mq$o5%KYFs;cs1j#^C`Ku>34z`*-jb$ z)iO;KCZ&SmPgdx`p#lF&F$r5|6dDJ_CW$GD`VDkKvEvX!4{r56&E zZ?bqN(lCCtRPjyV-$QDJP!HwSay}~0<`6i?#Z$aqxKmyqYUKhHt95~lQld)L!XbImMYG-6M|iUf0DshRDW7(ZED^7P-zgEm(q*Q;*`5 z436fJ044=x7!a!Y@dvW6NpXl7ntdluI)AmkpKu{}bKkY#1I%SrP)Hn8aHjJ>_h)aPDBmtSJ zE||GX`ZcQeNC?~Xj71Ejr5$8eRy|h99|tCB(n{xdPTulg8;LmgDtdbXipW46qwiSU zp28>FiucUosZh05c|<0gFA#b9Qq%`?P2;sqA^wzXpgrmB!ZY@aRuq{}AGLLa zZ8Vum^X>6OB|5cN*MLbT z2i~h4L94jSE^G!84ng>$HC<^1)Vp~?&Yh^dSkUe)H=bqeZ-)XpJU9`R_&F( zqNR};SY>-HKm1ptl13YC1-b5rW}T$BKw z(VEv9r&nLzDMQUzNi)ojY8hIM^Q6OvJV~pJ(z*VpD(;v!g?-dD=3VseAkJgjp&!4t zc6UOj9qIuh;qU#$kOvf`+q|Vf$oCaz%4;hs1I(P-HPu@!M4PXui zhq$f{BfThbAYmrv;j!pUbMHaBc8=s{*itSnpGt~|CL)1TN>)sdt}4WA?nwQ$=?1u7%nDa)&OGXg-s{po~QJhgI1e9%Tm#ENEn1ubo>r4X4W1|p1W zs1(sDO5#pQ#%ck^S8kqtLQIMg<*7uS=P}-`Z4Xp-mYY{4>;7s8TYv%}fO({+TSo#U;=JnAu9UBUm6nRMUvnP~h6WP9Tmdw$hIAwIq}6^r<#2 zmgZD2L{eV}0a;`31xvWoPMzC_tC2Jd`g(xg+5z|(rx3K;fOnETr-Mp&Q?~%2GdSXq zcZ?^{JSfz+up|`;F`7Q8lz}+ z2~o~7F;t|e6A7Lp_@bD&ag_xXD;Nf1sOogWcG9y9#fK|=u-25jRBPHhrK|fwmB!)f z?On0>VDY1-`nyL)g?nLao7-UuQn@ES_47wX*Ii0Ve8J2U@mF4j>z!MpI+EX9(cdkp z3WpLE0YlopZ{lAIJE>`34)0j_PxSgNroKH?eoKxIb@nm0-C+PSs6?7to%}2x-m-D`_MsbbD^INPkD4RPl>V%JYW9~_XKhB?`jLO4qUP=8 zEiv9I4^q`^^vm0=LhVCkt-j?6&vR1?2w|l>wL(%RO>x(b-YQ?6TJ?<^Qd@SftMcpG zaG;v>Jtw8h)n#i7K--mTNef?Yallk>6g)z_)jF$Cb5Fl`X?HH2jg^oDA8Ov8h94Jg z?yZ0FezkuqCT&);gU_aGj_z;Wx>C^Y#iXm+2%@yDTT# z1XAflQBz#s)nAf-w0|l801En!xd(KDIhw#f6{Pr>Oc4i;Hc zo0BjOKGm~tI?d}=3+;5fs6fw|c=9dN{{Y(>@IUN5Q=}~ob>C*W-+>Jy@gZkBM>Act z3;Eas^D2EL`%O3-bwkoCo;v68d8PED>$64Hgr`xBtX_HKLF3bk(_K^e;Oa}VThlJo z+Eu|q0%PyZTZ6-T$vq5-=jsDT<7ECy+_fb;ZMIPs+tb-}O&P zXy_}{dX~+QIR(U%{p;p$Qhp|S^IBSz=BBwSfTg;n0zKlWnwN?FNvON#Tp78bQr# zUZnhQ^j4TkG`%o7vB7cE{eZ=M@wn=Hi-m4C4>(EgdHJaK^>>UqVI-;vAPm=|(|8qw z{8d z;qZ@7h}@0cU+)s(`Pyq=94|goLr2I9TVJEPhp9S^Yt;IKTDW*ADpW1gm>g2>?(FqD zTbI<9nsJpxB$8lGO+e{a4_ZDnYXl&|VM^^a2>t!_igjPh?R5*>QU@x;NAFsCZ6q3J z0TV#KU>1I+SIRdy+SVQ=>ZpF@%WG96FDX{u`Kj**^pDTlt+$q2Y?<98MOAO~H+46c za^gr+gs&s?$(q^y1FG4hO-`7LMw0tU30lIA?km#kHp8Y2t5oBCI|}{PI;+|bO|Xjx zLcnx17E_Q7Yio2}-M(&LbxSLfpn0vEs#zian?fO{Az@j`6;xYtl{ADR0gc28^4f{Z z2o+0CFM`r^-Er+53u&ge`JjR#aYozPGplLuI_qP4ksCM>o~Vtnp5@ruFSw(@54H(}kwznNdEJlR2ks71p}?gL)@S zT&W~Ra!GmJraqN9qkbB73%63< zx74l$1C-n5x*q1@@2K??=qm#l5CvH@ZlAZZM)j#O2I5clrA6XRez1nZ8sDH(CY~ty zTAQVR2;C5dlJ2_w&Esi>pD@JM!qdDN@aImrLmf5J_Q0fqw-nGb@tV9@*t~kW@h2qC3?-v*I%xe`jO2JGuRo!4ur=&cHx)?@DRf8wm|* zR*6wg0Bty{2ro7Q8rX!65|qFckfa3^6(tdjm=w?Wm78EByx7F#*MX9GC3TlA5%gB3 zSD#PQnk@tn1ezgY383wf`Ee* z;@;|u+KNdhxikAx)6Ze;O(Y)F=uRMlDU4{PUDOkaAYj!~#TJn7NnURfklMRXYP5hk zCy$!YAB(>bF1lx;ozwKipUm71i3#^Trnb5>3Dh=)plfZ*nD3l&@2f2?EiTzbowd;O z6EnC4SJ0k_a@OmmwD)YCLyeYFWhQ%9&u;`gJl4A7s6Qoir3-RUw>PIbHS`msx?4}_ zEg79NPg8*i7zEb;0Eu3};M(<8Q5J26iSDd22P5rS8)A5-!lcL|JJR=KkLMNQ)oNJ) z5rZ^~hWy4{YG-;*KGeL$Hm93P_NibK^G6n4=}-aep?W#Vw0VpVDdi$Pvr4+hS26&Z zwmJLpOz1mpwOvZol0kQPH0$tsxwODLSois-y6IXY`K0`m@ZIfRB+@+8{Nj`qyY%L& zIN4Qlyl^QXkVz4m!CZ5gq!${=Q37a4v&taUwJ&Uwh@=&ykJdkWLY`@3Vo5XKwKi0< z`WoXCQGha0hI^t1IL&0JrvyjVhVq|Sg0Ma5Ce;Q?)JgA}TcvAM?H$T}S1lwF<_R5! zX$Im0gQCFqF*dhS6Ow5C|$c`1dNo=deqvEwQ+Xx(n$&b0OuOcudXWL)e^a!OjUPN z)a~t9Tdph!iJo|`sc5v3>0$w+D-LOQ8d=pYki%+PmkI;ksJh=+{#~`D4*)>hIQOWI zuj|&*mm5Qqj1DVN>m5$*s8$&Slsfb`h%-peZ{xu6#{Zes%_2H z!_KKhlO{zlx7~eberMjDWwqi&_7$win;2A`Bcv6QI!=(KBYUU-g8%{Aq4Mp*mcmK35ouzj5r8=6taiF(vQPrkCOxr5r%q@9 zq=09b6!L9=+5+OLK1=ScwUiKVB@FslNC1xbp_G@G1xA1S7^xD=b1PUL#%H}W`XJX(}v;Z5hDg@*R?hpPDlVq5${l!+S(EnT2LeFnl|pe zw1vchWTRbWmXk6JcQqezc*0CX1oJ;yh`H9?c+Nn_H5~ops*+dFxtg-roKhV%DT|#& zlPOQ{_o(ZOhTP%+iT0?~ytNaOW=1Kc6}U)}J5!qx3cIH+?2KK&kJa%_eqk{(d5lo1 z^Z~kHe|kuCcS-oB2=65UmavUOvXk57nkL=d-v0m<9*obiqV1$804NRxBaPOj?Hdm{ z1aStf7B(lz1SE;~#MBO)!QHw*G3|=7SiKDZqZsCJD=$zlg|DV%d`XLjSZze8%mFjl z&`vxMU`YUC1wE*~lA?(O@jz}0RFlOv2JRV3)H$H0UkZInAQBH0D(uuw25Ma>X>bDK zeknzUN&u20m@(R}v=*uk4R>`7`DKHHKNMB9gSg(HBpe*EG^1mHluD)Q_ zS;};B2MTv7_8kaOLV<(sX;%#$rN-cZB=(_PDW6n@4r$wWk_OdqaX@gM4pT~fNXf<` zo^8~s2qPH#(|0VTVqixROeB`hNf3UO1)!r2%8-?A1uG&c=9T8B^-O-$3SLPvRAvN< zaW4=gL4(A0q`8z)@2n#2A9aU!6Cju(tonYVwC_}qP6Y8)L^_!Y2P6B@R<{l|uhl6z zgH*K;2}cUd5|(nezlQyPebTzKI;N3uwp~dDN!^9TeJSui#eFx#9-3wM^#)OLl#R$+ zfFIb`$BRu><~?n>@$sMj6@T#C#qCF;^`vSKTB7Z=ku5DmB0Y{pe9Of?2ya=bSU`Jw z`;TM7)6_aGWFA}2dmiiTCGSym#+<#En)Rqx{Rmd&e!{TUyLogs=shc}-=$xnWsfDb z4}Hrc708+|Xs~?nY{*`HH^%jXBa$-5JNvG&~JppsHmy!NzzsLZ9%eA5) z0MBc$%#wg;%}1QWJ< z4r-ePKP63XG!UH+*BwXG8jIiHn%(Z6^}$h$Wqw0NURazEc z++H|y^q8q@mI8vWY>v&ziAac4RW|2NQj}c1)fhsTleF$X#d%jfBJ0M1d-~M(yUR{+VnNk{V{)X zp&%CRl#%AYmFu4B!!au2{BTVY`5I;4d{{Rnd=$eO6T$=`q zt~Aco05DE!XQ|!0&@Xi(rD-qR-?*r4w%I$BYoeR*L&Gl%wxgpo*HeDs*j2iB51QFs z8`C;1wSd1mO}V=!RJAuM9^BSmv&2va2gK5Tzvz}U+n;YX7Z3PT;r{@Ocb!1?sjl?R z{i9b+sG&}x5`}g@v8!d*g`Gjtx`&slxYC%ta0b+@@iv+#kLmc z3_RgWmgKDpC%q>{)#U20^nl-x{>oOa7DnCFxqHNI3BHh9mhUC9x7E2jc=`%~@cPE# z{XuR>3VcMI00e*Di197k%l$+1H_w$O-9#dP%uP#vA8ncHeyVpye|cfFh$$oQn)N!D zIhuXXJS>=6B!8uBcWsi_PQKE>ByHO#lR2uISy5C(R>SIjDV+>nX{c>VEh}gRSx$f2 zwf+0WpU~I@lPBK1?xlg`5P4b=`dhU#b8_9YOKZwPoPv@_p4CTQp{VIPx^FEXHtrz$ z6pm`w`E^_@t<{hCYPr<*Ye|(fK_n1CrfHrpVM1HH?IB$C*Zu!81qDTPy z;&&rA41!EYc$(iG5qq~x33Ym_2;_05t%N4 zBf7hxdzf~1Q<`p?)q^|104D`Tr*zF8{{UHBB>*xzD;u#zXgxOV@{x0Vl7^?#>5yvj z!zf{|CAPo-Z2(|%SQ@UUx2-~E$4F4<|#N5Pd@at>2~o3)uS8} zM1cp;lO|+$r&8048-riPMF28{lifFFhsg;j2Lrj9o3vrc8;Bh7+JtRQTU`b%?%TO- zNeWAis1QX-H0k;t^I9@Q?KF;xPC}yh?{4O!8f+#c@x>I{QX>3LE@HG9s5xB_bgntUu9uQ80Wmxp=L5WccXJ18QS2g(r_!< z1!(^O#D7J9j@sMm4zw1{uu|3|{J>W1-zFeuwP`=aFNmykk3_v{P!#>bRD_SHt<+ZP>isajg76k4_u>Fos9TYw};86UN9*WfMH-RoNBqT-8-ecw?( z>DGj(}p4|QE9aYpXzUrE3WR)xIDxr6& zH)h)3xO5>!Jf3*3uIThJ>DU<r+&Y^QD=1wa!MT8FLr{cb5t+O9yx z74h#ubdjPficBS=^Z#$ zsas%yoc8(t^<+y8Spm0U+6=`aNt{h9QMX{Sg0awT*=u^z3C<7FoVtG6-3dwn1OrLB z)cnA&EbvbUj8qlX$pDgM=Mz=7m!4CtNH0?vjANP`^TaMgvPKA~NAF7IC{gx;Vxw;L zV#p;XR58sEiN=6SbeYPq-Rl9cWnwZid)0F9sT5AY2?_Va=As_eZY~K*LVz^xC%d|@p$j7^8OODI@`^bifN_k}>TDWlt9g(PDVK{4CO1rbPiJEgmzjYO@5B24j3 zxUG;BYU4>EXE+v>Je^E|g=C)RwG_?Jd~H}AhAOhl;H#O46(r5cObyvFIiPba;S(GV z6wtP9# z*&9wGz z+MkGJMBdw|PR`xw7P^X=T3gK=w1ondNGFM?i`!=#R^;HCu)-u8N~S~`ZrQjBc zFg~?}uV~#++HLaNPzqNEAmXMyE{(}hJ>siAGQ&yHP39t7c?uA&!~JOwLyGj2{_#wO z1gHbwwALPv)}PvxT5i>?)GC%?NpJvT-!o5_1Ox5PX@(RQpI7Rq0zm~N3HP4W1QNJ$ zXqMef0+AE*PA$kz2@&jQ1g&kV0K|LK$yVSqNOLJUvR)LWoyye^azMoVQDm*;ZWt-3 zCfzNrVB(~0t|a9~4@?DaVfCT!MD9I@y(3<@>NK=%v>h7a@oSV4+eLV**F<=4uXUB; z6=2c>7~Z3vPa?Xz!~XyeH2#Xy5o+bTYkmgj3S^TU&0x#anWTQ;&`-^1X|!OF`4~}0 zz%=4irT(>&ex`z77i&QNP!0M4{cUN6#?OJH@5<%wnEU~FVWvafMXTTHZU6xuU`kKK z3ff&a_;2u2rK9{eqU{_|7+dJxNAFuY0l>%FyZ{)b|!`6DN=Y6E#oP@157RVWrr#wYJiR?cxPX3HY6q zZ3gKZpy}$qeR{>)V9bOC36JwpL}zKJU25IC zJBIFVuQw2wjDGcHk94gq0Mg=H+^P32ZP`#RzJO1!nJK~u^iVF|5i;?GyI{*bRS%-XQ${{U2RU(IazdMRSn0_+7-TeQSNA^ zhMJ)3pqWBXXrTNS)h@b6T4nXN>klqlCV3OVqI!=()pWkT8iUuQ+T0E8xUbTr`+sV% z=*LGI%Qm`>)S%@z4W?5wUr*NJ4=fB7=U^Kjv~sqmS?YHSWMAx)aFh_DcWxf@TK4kk zS00xnf&J>s;vN40m!Yv>(!$omWQC{Lewv}!S!-@-N!A;67i^rU57v~|p4G)o7lpFe z9wXjA)kz_O;q`C~^GUzbe>lR5mPi6qF*xl>Vf4J(T?G1*pRG#SwA$^Kz0QikkcjA&XrxyUXMSsbCT6;MXd&;v2k6$xh-F0044k zyHCT%4bMqgys%1?1pH#Wmx$i*0Ug%1i~*WcsA(w>l;e&mX+aa1lOJkzDM=a3dz$oa zz>(XE@wtgWfSzt1WWnDL@)6%Z>@$ zakSLko$jM>33pHYwteK+mS^(v)oJjKQ2vP)tTv_NvUZEg;q*n+|{Q)1N!amm)94XS{6{%%7IuM zZkqZH`Cv#3Szi;H_1wmYc+AFaVt++WL_V}uPE7djnvKqQl zKy4n$NM)3Mmd1If0RUi4HWml}02)zPIm8O`8|>0S1oESGx4^dy&+8+fnm)z7mdQxq z3W&Med8oF4l0peT%}gXf5~u({6v7dR@9L z?3!$#k4|yly;n7@LCcP&vb7CvVG7F6{avcrDjuD|KznwkYqbTDhEnMPY;9>v7{z5? z(r4nDkx5eV8>L|Ua+<)!ax>N5Mp>Dr6(o|enK?D58 z1s;}RsCa7uC0dV4(a8wg-C4VIlC|xDAd^)6LtNbIoKuH55OGmmL$4;;^2N)fr1u#W zQr9|$(G0D|)hZyyc(17RPY+1?bDDCMH1WfLQ5|R1sZ(XYG)PGO>qm88QYqD`w%0t- zon6#VI0$V(%#WJaT85+?#d zwJ%=vYwne`ZnSJ7AtxMD{bANVW3D%DvJ#aLm_4gnUO#hxaCtI&*Q3*E!8?l2mQ%n% zDZ7iewuyyQ)rNri0uT>xrATQyAWLEAhDK^|INN@N00`m-HF8-CeJw#8SC=4cI(Z3N zQb1b0fbUkjEe)3TsHQz4L`G{GErQmeaOpS_MDbGhcL-pHq!MF46;bk$g=Lg5l2Dcs zLurW_ijBN+NCde8Pc*GVS#6|{2r>4mcB|AYa1xaPG>{(igl-|C)TQ>LY}BZMF$4;) zU0nIfP;F2Sd5VmB^~Z^o6Ze{FN^qzIf@c+FknPAR50TaBDa(Zsl*m_e%?xZ;a5oea z2a{43wu*2MG)X_jP1{&96Osqpy*#)uA#8V-C>tFGPO4ObW83LdLq%rTB`O3H2Q*5Y zMY=*zL7EZ!)hI@B?d?f2Ip>t<+qVHaJhlfQZJ{o;LU%SXo<}sp*9&l{1A!DXfgpn7 z=6>C%S}5|l&&45b?%q3sRIHzT3XNHH$(0gG_o-)>Xd6&&2_D~CjD6&Sc91=)%YKOt za5*StG^mL@Q(*uYA9_=cEmNPpHa85(`qOBR6=Uv}LPB9uV0Wg10Xz)Ino_c@(atNx z?TASdexis4$xR@EBR^`Dv1q7nm?i}A-lJ{CK*mi@*|RAGf<9`rui6!@J9iX)s#cXk zNjwTU`3MB|6CX6I3uuD`&L)+7k`u51XP$U^8nhsHX(U9gj3Kt^y#KoJ|n? zpGs8}3X(@TkG)@r60@f$XSW$SIL!dI*6G4$-0@O{Ln(r0vKwtOr2u}lY#PF#{HSLU zrY!^^iYr4a}3Q@}?G~1d@|6KwO|cf?5XyF-C+X zXevaJ83XA-yxNnvrblSvlmTL}4WNA2TOblZ9LT4`(*-IbPqiV?l9=3QgG{4v{UpGt zqTr(~D785=CS$y2X(@3kBq))H$fO~1VM&ZdCB)<$=i-)H6G2Wo$`k_AoDszVc*s&g z0PY-OpBE&0K_m~F^PZu&NS@UomZBqm6cxjJNFxS|({DmlP^dV9DQ~hBG2i>p8x+%p zNj!6kun3S*R9p;Bu%_lt={b`VN<*8ca3mTE-s5^ga8>n+DYLYKrF}rE&KpfDjF7*C zg%u%wfAYt;{VX4A%bu)VwS3@2hMJ%g`;IFi)6?3P|_Ge81=pxV!0XO`C?)VJ?E9 z@!q@l!T$gkG~HiJZR=~qAzMb|6?(sF`7eliJpDd@G9Q5P@>=jr*EYdhr=q%BMd^Jx z7MeA@dwTgpmOPbFYb=KkGsrX5Rz-94(aW6}lH{$p9ce&I$G8{Ar252b<){A*v-TI6SA|jw~dYa9psheiX(r^^M#-Z;ZELlLrhsIX85IQN!o_fDw>Ds zZBtrl$M0=4m)&vo?LwB1=AiYBQ7$;ut(~Jtf+T{eKNV!N*Se{jR0~%NO#}p$rJN6( z)tBkn7^aFq*&O~<$M}C-YZ!4zv_U(!0|b4lI^(8oS-%O_^;J4TeMf!?rCK9j*1_}o zmUf9LQ^6UpTHAExoztl5JxDs^UZ9n$bp7c<8JNOaKP1pwc}61VrYzq4riY?Ce)z&q z0)DkY@vlkLwa%OW01v)u-pD?ZgrG*?Vz!ovujpEvYHz2RJ6k(W)bpQu*4{a47K2Pr z<}Or%l@T)qB=$?uJpyAC?rC*Vsk*+=+-tZ zS|;Aug3@Oua}iOt8vXW@;%Z#doqtu+u234fXsSX%#MPI@OQtk?Munp)v`eVk(fwPi z>T<{CLz#Zwg8nnSEUg|zAkLxE}A2D>Y!Z8RM-OSieUxk2+=9;BJvKGn=V zIBBWSddYVvW#MOk%Y`H-eR)2U)l9RUJiPvEKUJd+8`wBh-9FW{1uQ5n!JMDkx^uxU zxc>kX(i5WJvO}#vZ9zDS=N%rwH_rJso0j6CDS^&^?_EXVPeos7np!UI9bpC2xgaMa z5mdZGBy4Wdqe#P6aIfi^^>_HJmm5j-C=Y^ZkIE302XCEOKHaHlvbBIqd*_|muLkKz z;D3LbzlDX~TP8|LSs(PInnLc@qYPR&ymv4u@EbyZrqU2T1Xg87AjJomPE?BaLJ_IB zsQ#M?Im+aU!mOQ9mo*7j!YG}fpHvy8Kpage&LfhGb${V%E~nA8Zk5(j+KSk?VP*D6 zF(PCETLSB>KlA31Wv_lkZQa?Y$++A>l>7emJ>x!rjYCIn>fsF|P_+UTF)8jowa(fn zQw=X$b*8UW8+aDnM40EA`>$2fKTc%Ozb!cn%;@B9pf+awL2jE{g(e4>04D?*nY6i4 zFkLEx5TR7fH&eEKDJLWe$;3rX*@~q5R+x zH4klclBpwc5!yRci%W4pLr3pbUoLr7p2Z~E)OM7PeYmYL_?_#GBd2;*UVCk>d~oK+;uZr zGp;7(N=3q38W%@y8i%*qTCDp7f*C2x|}IdA7Mzk>b|nODs9e+B}kk$?i7CY=OO9a&fy^b z{^SEp@O@vAS3NP23b|B*z9yZ$ya^wdVM$WdB4>)%cK#@`?by6pX}6t^E5YwR==rD$UUaX?PN&-2VW> zRu4T1K!Sd1qtsU~-CH!9He4zW0v4q06(rrJxZnln?X8o>;^4(&YqcU)2Y^lc0+{GG zG#8LQs$Ex{kU045OgVm(P^#9a;(vqs7+>Z!gxorx zcL5~*Dm++U~b#*^fCZQQ!mfO$*!Gqqfe;#gB3^TBlU} zRd{`+B#k?#o4F(OsTup#8(jQgYtMuJ52Oa0RD^OM{?&Reh1IonOriLGw4Ni|{!l)r z`UTQMPuA7{0K4U~pOZ{n+G!TUey`L>Y!1N46~{WKkG?2th$&98rcz|>NYB!0s_whh zdb_Jt{{T>3Ehb4$@Aa)Hyb-8=W|Q+L^sm(zKJTxf{-)PzU-id@x+034)l&O|Bo%X2 zElcqw(bh^V={ixkP?*{v{dlffYTft*q`0YqrKplVYQtx85ZX|r85rWWbp8y|LVuX+ zKSBL%L$-IfeM;TW{vkS(Qg8nNMPQa1UJ`^au%n zXL0TEMc7*0T3#V{JCu}=c#8I&3&Yw--U~&ldYwm<+G|68ihEYSQ_QHkxgbtYHLkVY zZEITEZFm^wGgF;gsbpb&w zjU=X=L2yC{0Dl51OHI-c516wv5%ldw*yyi7QEVKU#tlr{*rBOZaT|m{iK@<$unK!Y zOg^J#$!!jeq!452Rn0>9rcUyyna>n{uXaM?Xn~G!~X5(cM^aR!Y z>YkMQk^59j?S;SuAAZ!AuEUBkB%i%urk#9&2R~s~8p;?*bFATIEFmUy?L^z#%n&2w z=AQK#zJ7>ir6loPPBdyRveEW@OWw z1q>?kOfHm#&HC0LKogn`ZmG^xMGmLRu?9)!;<8>y7$BG;Y0YINZycv)22^>8_@-R} zSp@#nGOiW62{hsz-5|;K6ym~x(r)2-AjS;*8g!)~Wc!BX#eU#Y=#!z>H0LQgh>|K-(NHOzO=9WnWz##in z&Ytl|2~ZL5RcCFrT+@;bt6hj%P$YqwfM{)8M5<%oHJepP5MUf)h1FeLgpdsP0<$BG znHHfZ!zr zK<05n`Ocuq(<9oPV(l)dg@~T?>b$Dh;UQM)-be!k7^IehfJ%}=h9|X13G(0_(d|tv zNg#orYVFm^J*pl1RLpJ8Xk;l?%KDyaW!5ANOi(u#<7r62s_Pb2ZGtT`jm_2H7D}C)%VKa4Zr=N4fT>{{YahOb@Lsr_|b} zXP?@hM&OjgwMw?MMsR(p54Nw=m@;WCEiR{c83r?oC-tL%V>MOHEms&rutF6pEq_er zY1a^v1BuCw2fa0Lk?kirq_n*3Dlt*E)EDhLQEfU3c7FzmZCQiffFo+RB;a?a*mr&i znCJJUxv9;4a-dYZ!F!p)-!l>%|_L`b!{{SyKgn5a2<-#PO1GJjX zI%Y;JoT;*1V})x)z1`pc0KFPWSe>X;(DywQF0%fobt?Y==MVOwY(G3k-6N+ON^m!< z;Xc&+wp~D|I;OteqDlV%+e8YiM$=&b0Dqz);&>>3{Grp}u_Aq-%H5FRsHaD+LL_0E*8^t3=XtqjCARlf1_{B8YRYGohW`N8m#No0yfk5R8MlD7zPHov^v<^Hk6i^c>PbS1=OU;&?^NF_UP8$a zTa)F=M*_A7i#J#A>ED}gN^zyfp$a+9Yh3hZg?-d6Ce_A^G67ND>H@xl(!=D_v9aWp zR%&T4d0PvkI-g6^5N>qEB}D%K?x82Yw05my0D)dK(~?h?wSJ@;KcFpM)cSok58Wsf5|oLE z=Bpi1Z2pOV`BLOK(u^raaX=q~pnOl(uf?-EosxoH!%9%eIEuM=d2egiejnZ3-|M#a+MTp3 zY1)-64$x|rx@LI>QYdh}3`O7#)Vg=Tok_hr zevrRa?f$GTgKGYa97nZn@XA?jEVh)TC>V-!Xg%h6#d`y{?Nqg0Mr~WS%5s9%0!3hv z$UN7IvBqg8Ns|#&9W9~@*ch)91kZZTB4_xdECDj1kD5c~p@kuMg!BB?BjRZaeUXjF z9~9BOZ6-FT{KZvt^o%r~0zIvHSB$oeM^!g=<^e;^q>>}vw6BVtA#0^-%DmH>D7L#E zV=4k6UBy{?Z(g^)w+xqkaot$rr<`int~z$}rrx?w=PlA+wonqFM{50B*C0JcFEN=T zE5qpAbdTEZ7Nh8%q72`SI_Vy2P`!YtX14v4Oeb&jN`V-Y8TZHDxu*W*{W|^FC9BIP zHaL%&ScC0c#rTxgE;ZX!w_~U+ z#+Kkhn^D2Xdis}vI)0~jo?Bm4iPS?Q^lr-cgx9(~!}j{Ejjq;$fK-pxLb5Bd^vzKp zm2dKzACy#ts~`YzTnXWhr_^09r#GZJ+gla^O6PG3t>Js(-%@D0N=4qJR10HjcSmk2 z=ZShBQR)+t*HeA*$KIz;KAo-Fa=IS(Ub{i^7jlatyb`5gP)DdbXGv@S0HPgefIyX` zZI7Dc9dE?mr`7IM@zfn{3M0~2F;IV-zP&0pH_p0N4tJ9k=bhn6qydhSfcpOcLKWXS zASh$$U)I-QYo0LpM3gGqQBxYSSJ`Tj`&PcN@q%LEU6s&MKg4>8~1sW)9g)H;N&`&GDE zJe0UV{ip=kyK=Dg!V>Dhf~5(~TQvTL>fK2}tuv-CT%1dd5myZt@cH7Fuu{@A#;p+} z{{V7SK>G^Dm#TE#2c^$zepUj~@@A`fuc=zCHVm=|2@^QZK9rXbmO_aMLQXTEy>zCD z_&Dkt*jBf!yaE3JD@fQsoYuk7KL&jlXi(;)(YR7T1iI;0@l+k+eJisAA1C~+HTaqd z51UB{sb(K`R}!Y^JhZaIfUB@Zf3;lnK8ET`^rd$CO~Z*;^uuc8{Y7_Phu{~7+7c7_ zZ7SJ2f9Yv6R|{T}>8likv8A<-{$Q$eb**&Y;XoKa;&9L0EUHfHItYFZ&Od_Ty)(gX zy40IWTGQKUU#I$qinjFc;g77Hc)fXg-Y`;zi2bXw8?&@zZDPr$df|RsWRnq8 zU#sds68Qyuf&EYHtGmQIjYSaq&8}{?@K)Se1`~BNd64gY z1M*cX$JU^yl>{LEqMp^M`uD06XC*Hg1`pCI_10ZMZ>8C|(iA6bm2UnknYzbbb5*@@ zEj&(PP=9Lr%yAbSaJ=h@b(J5i>dtC+hJmS}Cd-%>+C98v&#zCx8SQs}75zx}C2$k%Y*a8${8Sb#j}R#H9vA z`}PEU3M2SyI%a=AUY-T;96!ic+FdcoeJ0*L3kpM1%IJO$(>o zyl^ShouG_xBi^sFF&MY-tCyJ#A+)VM*OnBtocoEZj+vq(Xfg&Q=A`X(CaqXXn`em3 zO(OZhXp(Rv{Il^&o^bC=Q<)j%CD$zNf1ss;5!h!Yp>-W$ly2H2kDfo|RDP?ewx<+A zfIY{}Rxh;^xWc5+#|d%CMCn?=K}ud~$ullNClOG0x|*I*l@s$r8--jGzJB~uD{Vzz zrxDoI#=-!~sQp8o!pVG0_cW5`az%T~fyQDz=_+e+gFm$$4#_8RDYabk5@rS`6ok5^ z7?MEvqEl*u52i`@;+<;9M&KZdo!|9mkB(^eT|cEn z<~ie<2eWaoiZ>8&oKOp&?MxJu%DDQPdD23qIRcWgy(bwMiKTs2lI$-bX+JX}k#gAN z4r#R|O(=qKCyIDDm7pd&RMjpH1X3NB&f=8``kHl01QLIW7^7pIx#pb?2$`AfP)Bg5 zbs9syfjgpo;6*Z91t+wQ)N75%3KD0U7^D(G`(~s#j1&c_cCRHekO(;Eijif|Aty6X z=}OYA=1ft{ySvmeHO~NrF}#CFm%s@m3?KKP)L_aZnl!J>ZV92(*aU+aG?tZM`jVM* zb9;O8NUs7~chlef=_vuV1z>^NX-iO0^zvlaP+e!bH7W{BBn;%%SX_`5f(B?ycZ_XV zi8P|=LWv+!+&d@6?{zb@6z%sFA9B))w}}yt`_WB4RNO!$4rw#E5Tt=TRc4)zRvbiv zf|uytro7O#Hf|YvVvw*wuc1GO&k%Gzw9+lDH7!sy>q*!_Ir<9un{u_=KOo2^wqJ!F zAwSc)n@_gs0V)8eamcSX;$DmP*nHT&AgyTU1o>{|eM{8rdP32^F{_s@N}xhS#5SLA5GP!qW#>Qr7c1t zzAvdJB3fIOy2jX|RmH2lTJgP#))3M_{VgC8ekkTN+h%}tvb&X#2vgarcAeEPc}W^R zoo>p2$zQ2dTAu2SSN{NU`;S_G$q55BpCEg?fIq)~*-qNP3e$6YsWc+dR!jqp%OC;s zRGzlKBGE%p>V!N`EisUx?KE?J9je^=pGr`Z$$4}4imi3NgK4EA*$!SaakS_YG)v|iK}htviEGn!PB>EQLcza&hJ&cXdksdZMRu613%<;!4# zJwMaiA2V9sYDxVX51ay98`cOu&WL4S@fQn zWHhTSF8c8<`d0HT5ZE7Dp3po!XJbs>DOV0i20#h^mH- z1L8Xhwz3TfDO;e`J4L%TDnI+8Ga*r1C&ab+?W;>&st~4?+Eq^)(+-ZA>Y=jUM6_J>p#=G0YcRxSU77jA;KrH~I?SnP)Pa0`p(>Q7)2RDCJ+KoG7 z8^X2@JAU-rkD(u_U~$DIR%jpliY`YIYrzOX^fHkjb6+@o=bk^m@4Bouq^jjAAU2gQ zPhpD2`;G$wJ;|Z~Q6d4)#0t-ok;MGfcWN_({r+lqGAHm#mpjneY{TS&&A zFa_9ui0+rNc~(9w^tnmW_0~t`i+`oJJ1hMwoS*SOsyZd({tx9Xvnn90r9-@m+CPWS z6KuMNrJnGUs~#`g-62B7YgFu67!g{luDUN$({;POGVQh-HtQ(fr2tfs!L14Ud@j_M zyn0>Os=94Mn#}SMt@!WaHogUwlZ$oL0(PLDY7bHC9}pdVcKXZrc5W<)LWW@bRd&we z>!h_tbv-Ti*6VBBkcDpCeWI<;YkK!x>$Vpcx=q5%L=&--w0xROeIG-oc=F?IeKYy3 z1FDtn#tv0>}y3qeXkfG5=>wQP$%on76V z4564?NWy>8Dzn$t?)2uL`MdY0Vh+ZE;w#eV%o> zwu$v*9`RLOZ&kU!bN>KP;Y(;3O1VyJc=#9KuUdGUqz!jfwq>m`^%S$U{i+EV$gS_w z--F(S(^MY3w6|NG)MaG+8Lt!9JY5rKFzMoamHz0*;%Eh<1bTfK{{ZHs0Q+)(CBfEK z7Z=WLwqoJJAj?gaO&oFM=Fa=_W;cs(cmD^qWNM`cf2bbn;%< zK!uJ-{i|;83wdiCC(}ae_Dj_CyPF2ru}?OnPt;ZYcAQNKV_xD~2pP^km1>M#V^!w| zx!j!LS9&4tj_N%r8jh1=YFq(6@x5@IJPdxj@baju3SC&nsJ$2GI+B*0*45Yr#)>0%^G!4*cnm*FjvB&(| zMt-CV2kV7*sdUXif0+xnwB!xee-2OFu8Q*xH<9!-l`<8Q3GdA_rRzF2y3e1Y>X!Ft zIrJ+(w<3%!sD7YFy=xs5dWP>5_WObe{6&T5oxUNLORUeKVo-->|?VtgSt4!e?x60Z_b0>UCWy#!|TkQ~v-z zde&C<>v`CTCqFY&I?L+1eM=-2Dtply1%P$Hw|z0(=Dkc!Y;9BzG>g+L1+yu1;Y#iI zsckPtRrK$AfC0i2=^rHgA@dvI;q zOc;)0GtGMX@vS=Ct!X7k1GOA&(#jU=gFAVM9M-k!y>U<67MohOj7K7?0A_VAy1wZe zp0cZ_RJSA~Vkfmzb<6(%FS+i*EAdr}j)vqMA6`g;m!@I`vdl4~Id%Zz!l7y(7z%xzL zL`b(GmO#t|P41?mRFt0aQQ$b^o773AH*Tj^6hSlG(de@?AaRPnLA)v^-;#!DqNNT5 z{{X!_ww9#A6DRqiQ*1#BpQsdLXi7*5j&ez)x=TjZ9u!-4Zo!!|@kAp{QjY-qRGD_& zkYQl`DTQAS0TJ#6FME&4G&DB_G5HYL6Q1!)ODwDt9DH+3yLX;xp>(r=35tT#$wUoy zMv~JhB!NIZauq2^5l!8=#DlN7i}Kd6vt#4?^c(#jAFoX5QjhzXTpdA051C+kMDaCZpB z26iN2Qh#cG*(Jqs%+iQy2;;$1I(hRJHYkugRQA-V96+2q=yxdH)bj&=2eoQN%s{$savT(sBzvZ8Pq5oEE(-qVsIkDsXJ)p z1G!DARoaZVzMs|-0D+7Mrk2L}3jO;~Zd<7)K{&@XakN6B=9c6IIGu|dl0^H8aVK!u zxM#gZTE3(hSurs)@lvdi;gpa_9`yv4VGCM$OuE96CPYOc4oL4Ky%e=33Kp53#)Vg; zzy>|2L9&=a754MEr<#tqX)E-MbKa*EM$(lC_Mo3(D^BFAiS0xQLRbh;Ng;)&dcM?J zN*qE|+VeRkn7d^{f_n}yHlM2YE z_N8f&$uy@k-B@F+ERp7an9VQ&X>dW$y=0+a;Zi}T@aTmC4`WaJns6UiX;!>vMb3wsVXeBG2 z3{%Vz7!edOoyrh0O%Txe_oKp9S+q+|0AXBAQk=oWd`&V`2hM5v^AHpOBnYLsqq2J) zLX$yhBW`n9-M95m(wb2yS96{z(4a&aRD9G@B1%fKcc&3f1r=n0fd-lpziInc3ZYRo z!~??Mq^%wRLCGhNwK|6fm~#Y}sOx6}T#`A!ijXi!R}<}3WMvg*CzF7eb#8~7AxSbP z_Nc~Odr!GS&|@>rN`-(3IVT@#2I-NKWaAYvxO^_k=>vzUxGSK11Mx-uFIKm;xqJTr zPDl|yIj;Wz>6Bv?@vouxDP}JDdZ9-C{Bm|AHK&@ZZJy`wAs%;ApXD8Zf8(r%A%k=}i1rfA_914iG zvD7s+6b@-$yVYrNt0Ud#$9b%cT8X3Ubq7xl|s)ct)r^Ei(56kwS)kYb6k`7iRycvr9*us zV&aQ;4-YqKCjjIc^d1G$ODp`>aH@3)+p|5^q|>|uz3V&n`rLJ5P}{^ihk{E3Xk^vjU z#y|Mi)4V|#o*@&D0aEGb8^6&X;x|L+df!Rv9bai}vEZ`fYBR*~T31QZP_|UEs8o%q z0(S#lchJvhTF-~~{Vk~4?^>Et0m+m1`HG;}eiwSNyM#WQ>lN57(xmNFEh#6xc&!&( zk3$=w)IO_@cwVbdGfZ^iwH}3|dD^|Dx>*ViI+RRsCcDF zY*(M@z8mV@Roh^U{Z0qwv!#+K1-;7JZj~ESnETNG0GVCGskgUnZ@8)2hW$kS0IEIL z;(ze-VQQysw4GmEag>w1tIBKlCbf>O{{V<3){}6y`Uk^(A4pSVggbV!`jnq}O?@M! z{{RQ(aSzw(8qwS~+@PUhDe!Zp8=;wPeBa+G#T+1tJq`XzOo#rjFN>u2`6+2_ltc!G;o1f|{CV8sW&s+3=L)eDwUupZ6 z#3W7(eQQ~2zAW{wv3k4aZ|v=xRub8I2p_e1tv^TB>utI=>|pMDuSD%b8ZH3zKnuS^ zmDL*6qZhYpFSerEaG~>DH{y5Zta|HGwrS!SE}g034}L4S^v}%d+No8nHXWF)~!8-{+hd-!`Xk5=|O*;VTim%tTgrMibz(QjDPboZj+g{5uDjDtUF z>~9bHU0y%gX}A4Nr`ubqHoUYde9w|k?OboB*rcHP0+Y1kzZLZ7@K@9J4tPOg<;|0B zI25l^gpg;oY5xEbHFD{+%{o(0CWrTxnWTF(aJqMkrCC3N?waXGzcr<4mX5SW?Zv&y zMO*q$!!HlC#O=PcbX)-kaM}s3gbcQn>?si(MM7(REv3I|?ce3VTWKUguZ+d1>k{f3 z`DNTMAd`>XL_K@WZ=^w{{Zl<)u;=d0{zar((Tses}GR+27M_cOjkO7D7-~`#7`}Ya6=8G zfRJ+&#eJ)#Y2T`;qji8XthwxtKpr_=oA_8uhr&%AOWHTI6hQ5hKh170yw;rjF}#F$ zTcfkS3T@IWaU;|q4o`en&9*tZm&aMMyw_GA{L|0PWhpVq6rdx4#Vsuoa0l;Crrl>7 zVt&=Tqv@KNhoy(`Dc8S{E@rFCM3azSmZ_=8h-<>uiO}rTw zHg0(?PyYa8%{JDT*4h{U07z>s>(;6N0O}VBN?wnJj(+ugMWwPMYbcN~NR#{1-%8Ze z_yeXw{{S_hwcX1txAg*n{1lFo5b1$_e;b zF;nc?xRE;>LHShCgrx#hLO}O1Q5wHeTIsDT^5Hj64EZQlNRNIie^1b~T0_39{OkGv zs=i+^(*+{07`-;mepczEIkfF6Mgi^KxL3xmwAOWgpt`WWyJ^vG;+vNERc_A_zZC3g z7Pop8w@O{x-nxY}9eLF4MB;H=iPYNCuHSa(kXEy~O7}C(FJ8zTKxZpcK*z$;=l9`M zdbeFtEuBer2uxOm>Rm}!FRe~GNGJTq=C%i2Yi;>TPV5FRIT`Uk}37%@i#j>7Ml>i4aIHH=dOKqj3AP@vd6&KWcn|fWU zl!yx{=6MlR-63(HjfV17f3A9g7LBQkQV1xBn5|U(!kuua;HdV^AE{lrsa~zcyhu@u z@m|yP^uGE;Zj5o>uEQ6WEd$SBo3pcWSGunhi9U)`XG-fkgE8O)wIN z7L#Y}2<%viO&5Qt9SPZJcG=OfbGqhL|`wx-sbZ?Zr!f$S?%^xu#l6W)vK zPOV+TiwIc<0yq&`-%!0>!Q`1dn(Z!~&UW_%6G|c!4puL3m2%+#^Ui4&_Uc;B1eoL4a_fJX7fMS|SIijL_x9 z9whwINp)i+h#Z_yWb#u6dncT6rJRBOl-WWS0*H@+flZc)GtYlXtS50uPGjb}tGX?{ zlge-)7{T_YS9DkDN_&W4*bfOenl45Ea^51rQjN+XENS&p_3OONUd-5sZ$WbVX`qGpAGGI)5{V0Zj zBw$JY^>ivbdleY{lG~D*BbWy?+c!_Js5ukN)qu0SM`8s7eWuT?1KtM|VnA?I7^q<( z4-1s?0UeDcdx(+%J*Wh&cI)Hd&(@7?)Lk|qKr6m@q9CgKvqdzrM(odO91^3m36tO2 zh*~oW_apxF(Lj#I1p|s@SW&O2DMhj;xS%c=QWhLcaop6M(g{M85&<3RJxkm@PFaXaqw+dY65$tJ10BJvRFp;)I9_DEdAuga4q;4IinzvjMm4F2EPN^XzsUX6l zpyPz=u!lehB`OEFr`sTq43WfB4jDiiD&xO2>Xj29(@HR*jGubo zqOCZ>k8%VWkwd3wAOjT^j1URu_B2`yAoCOwF)}w%N2O&+lL!9*jUmO7V~{DPm$&s~ z5frjS82gH?w<_6ngcGS)B}nG4eiZfN{VA@oeZ2Y((mp1r?gdE`0MjkH<+JHp3~`WX zby`^UusRtyDj}Eb(uek6UVJO-{V%S1a?SfkTl13G3WUafD_~vO+uX1gqrFHNF<&)* z4c<7v(K@SaUoLH&Sdv_Tn(n4NSJCxtB{v#dsZd)%LRB&E#eQJ%Z-(_fBUoAiEIbwM zG}5+qHOwkcRO+WRfwchyr6dwe5uPhq^=7+s)ORg1)8IU_fK(zVO?#;Bwfn`hY=W|* z>RL_)c&r@@{4IuVOIz+1PSU<(*i~+up=O+iOlYTSTx-x2jjn?Ix*Ki6UUkAaG6(Tn zFQfVywwm93q6*{~HSUb*_1duA{-WOH6ao{-6?tVBZyB|+d3eUwi2iDyTGnbcvW+f^ zGFm->RoXnUXOgS^F>7qcP~EoDi9!+p_r+U6*h2kDk?c)VbXSeGy{LY1#;wWY%~(nO zjb~HwC!=)7Jd3Smw;h-vxiR#txjZ@5bq{H5F8n`qx#Wzx%ZK8g>)Z5xK-w^!tAEh| z*EV>cVQtZ6I;Hy?oLSsV@IC8cbvKHdYPzP`cDCm3-GxroD`bk)ABZl#Ypg8|x~y8Z zNChDwM5v}K>;4q!TJ0EQQZkydHL}3*wWi9L=?=BF>%9#()~W$%-i0=kkOAb-X-ZnU z^3-7kKq!O4f8nlZ=svsEIwPu>ZrQ?Z2?=qTjo&}sx-Q3E(fXR%4{5IKan!*IRAlzA zVbt_)jO}+RT3J9ew&szz# zbL!jsy*kaoZ2UYE4T+yn9qUow-s;z6uTs_;K`PGGNgv+4%w7!8bw?R>R!XxrwrFtL zrPUhG;=^9l7Pk6pM6_)?hze5oEPaToZ&`TL);fiWaa!Hov#SStZ7*U?bG!Pjy@V%D z)l08ODFkQzY0HkK*0nYg&C1lUh!S#tdi8n_3v_;(%49?8RT(u}sZYm4ZCfR|CPDxzQ2SJdnbZAw)h{;A ziPQSk`B^(WyH)M`NQ%+}Por&+){nS;X_09s)Mc$DJ8~XUinm( zuHn@j{*j8=ojdqK{6KXgONr>E+aXH-0NlKLWuuhs>RT;2rE-=| z^#NGguNHJ&9r?P3-~2iM0QI#00QP&C{wtc_sUOjDs;?PQ+|vu^l7E_8diJ8pEwga6 z$Rlb**M8_<_;~nJVAN~9QL5?=;x;TK53sA=jrct9gG0`o%C`*ed4Rv<*O=D-02I0` zK(&o8`~dvT{z=h6qiOZde&(Oqe9N}!{-xI6^R2XBFZ@K8FMM6qitWovR?q}T z1KPfg={6?EO=j7U04M;CD~Z1r{T-_4{wKGs-f51pZ+_O>cS!WCj%!Q7GC7*p5)T}z z`soCXBG!qqXVfM(#4ENVn(rUNFN^JT-$*yo+Qy3Q!%Zxy7dEQ}Nd%wNlatSC;!Arp zAqxsjl8*KD1MubGcZNEjh58>*YTYGib$@qklH<-5NgmJ)SJkz?6K9Fw%eIk_XdL|t z^IENJT4=V;EvK;l!r0c`W6~Fv$-5f$s|g}XUUeu?`x8T5_<_(y*~@d)7E4lrOd(tT z-kGaLo#B6n+EJSxkJAuhJxm4v0Q}QZ@95eiHmaQ($IC$dKbJ&*YRHH9RU<6PJ3e&7 zpZ(wu!C;+!j5^xa{vdxsx#ys@o|L+X*(Dh3;U2-hbeQLG~lDGm$ucg`_N?BQTY1eI#mRok!TN^@PNk9B+N&Yr$-q$U9 zOQwjo4BqM?JJumdT9lOF_8I;@mF_$<;JqJ6k+$ON=J=&){b$dYXcP`^`>WrB9vXE= zOLS(LVW^!M1uP_=%edo_B0!h`^VrAMwre^S(n#H?Bzz^9AKsVJnj(5@ru6Lv7Y*^$&8GFw|>hXQ?HtLlH>U(^l1r58?P=E?+O5aY9Lr! zK$Iy_{{T{rKBc82a+ClZlZvnE-XZihgoQ6u>dh^JoD}|LDo{WDYDquEU1S<~1vQ|4 z0aM)fsnpwBBPq9SC)^+kaK&mZXYoJbcA32vcbB@F(lPmF2uVLxNA{>KOYtRnd!f6k z=o$-FsZR^LcYL3sVujk>JYx5L2*#dM*>9*3SW!v_?Cbj2Lek8hH-rZ{HMqJet+P0UJl7^yr9nb75hPsEuo0pWL zl9>_-QnClNJ<>f@sNdS$u$Pch1Qe#KKdZ|B0E7UoGp4npbB(U7y!>2Ugn4$IGi2Mc zM7wZQpR5SS-m3ba;#0&+^r+ivnr*vF?QGZzPu*FrP}Fs&{{T3)f&#s9lbrUW?DZ?w z(h?OACK5ALUDRfN9QAR%J{IuR(Jc72uj;p~yQu1Smw^hvb@D(zNzchqw|G$_Xk683Wi&U;0N*X5E2sNh?=kkZ?~GNzv^Us9&Ke3fee~35weKZkppZ z$p;u8NQwyvXu-;db4kaXZMIhWq8mvh_N_tU2DonS&9e@TfRJLZJ$0)cFHd#0oG2?! z!fQ&pyNkQ!IHjpYN+xMAN4?vejn>e!Y|59l2pf#{tH(=dCD**w2ts+GI#Z^UvKH}C zD&QU~X4=>_r`m+10lg4G$Nb`-sE{;JK)~W{%0EzBdSeJn4gjdk4)I#Qtop15*1}dn zG6&YI-D|F@$toUcBxC3+N^6>;uOCyYSTpQuyb*bh&j{ZAf|P!xc3oL3RLu994&8;^ zyo4n(3bRd=Dc3fqD#v)Meu1Qh7!Nqy$i#`wYx-hn0Z<{*y2|#MrXtJ4F8gwHEB51+>UWIHoX!1i$G3Vz-AVDrd#^N)Fh0 zRA-b|D^pDgcOgAzVA^<+KsooP3r+>?fVLbF4>X}KtAM-egw~U2*V{?;$prI5NeX~Sqt4e*3P>iS+yyJ- zVuh&OE7Xc%#ckT42%w)yO35RG??ffVBm$C8YHH?I0>ABC)g{&!nsDw4N@PZ9OCc+h z0!&Rb+-48OI=E72nZU<-=V41S6QG5U)ivNsRTJN_q_qhV$7;gVq@BZ_DPUz!$fYeO zD+Hf`#SV9sLWw=8{pCYF#wjaG6(&f;MNbMTAqQ_H7~+U*lM=6_Q1R)`e*LM&jsZzE z1X?!Zx_l`?QP_$tAu33TG2VmXI5bVVqr62S?E@;q9bB(EkWgk#18@%CK{);DU&~5{ zPd~K@a?%@E0U&}op^e}iqmnxo6Bp9$Dee2yfR_(PA4Idx^#rq3E+~Qn*f9kfER(1BRe&6`x`n}!j?}$EQ z-^MB@qcy!#s5P+0#~MIwM3ocB?V7K%d#LIiKDDsRR)wf31Og^8&Hk?X+_`;m zDa%R;KQ&Cu8rN=j=7_-Ug}_?5UMAw}TwTIce5-cCKVNgrKy|VjxVBsE61{+=l4lh^ za>}gkTx#5@$8KFIN>#~G#aOzFz>g4go``p-wJkQ#TPY>QDKC1GlbMLBjOu!AEUjej zqEt6cE8DrNm^94|>%Cv|1dV|A;%61Jv@!_6k%!r`u(4qp(JEV`}1N8F0U@jr`T>Ax7YZ$+f@EzdL;7mLvA17#=GdvJ!w)(&gxZH}F%XzZn( zH%GFzfy-(ZpW@`OpCd~UA6q~6{)JjPh&Iz>znMSKe(U4U zQuH@gcvI94^ygf3!xqiHGZx_*PD>8+(2b*om1Kp`k;l%xvh-@zF{@X-q@AtA?50UpXSYoppw zR0Svs{Kw;NrK*ps%?|TTCbPngT#^TE1l0uMT2CS8R7ivBfl4jF9-i@>(v!A0kD5^c z#7=)|@RCm>nZCn>Omfe{f(4U>Rl;*?SkFlk9S7?`D(1ImKpkQy|g(IbIM0Q>w` zv)I&UvWqKO^uJtm*14;v=6F6tdEwWS|Rsmi#4&3@{O!V&m+ zuh`&kjDO{4!`1%)+7Ab95V;-16kE7fP6h>idi*;uyKe^iS*H>bp<>(*iuoIK!_Ef~ z(m`KjlY(ZuuctpB9vXBHhI(F|ebPF~)pYw-?NesJL22bB86nA$-~6V%mqymZ2AsA> zQlZtD`C1y$YqRGyP3zwfx>u(3d(X~w7MP2+(;t;x%6!Ec<6t|d?O!x}PyA{4%i?aJ zFr4n*v_ovC#jG(qA z*UYT;bjLJqdHa`e>Yt0=i2RG1CYzyaOzSNpYf4H|8w&RdCP?_(-|t*=_=fSj#4fki zn!4&OMb<{1>J?@h32Zb{t-!$VJk$MA)<{;mo5IRlPnuAYIUx6~bK_p2Z*b+amac`N z&8l8MQTF+y>9umm;P)Oqm4@k9#|j*-(CI(MH;BpUCLYwRv`tR)WPWW)T6dpvln^GN zb#KL=iQ1A@(zWYdJt`bo+a^+dw=30L>Co$9OGrE*JXD*phf zO59?#fO6=7w;cf~=W?SI>vvWOR@GiNxnqQ?Pw`aUBjoo#-_2QOoulFYis5(Gw@M`* za6Z8)irL*Ms=uoEbo%8*VI~CgT0>3guBq29HgxAlYdWIL0pwaJB>w>RMk{@IZ{d%L zx-U;VZPZ;N{*>Lp+J#&!5Q8|Fpm=**kwG!>;9+Q+?MC2SILl;$6nH;0n|GetryU{& zW_wpfG58_X^_#PQt$2}bWp47f`BrS5z!UCj^`ZU_{29@k16O-i*A_olp8nJ*kBX%( zw@CoGrUT_^z*)!WxQ^>run(EJ1gOLy6@LP+ei=2X-&`nJX&Q>s;qTNfq3^ zKjBw|-70{M2gAJ~qBvWOg{%3g-Cg9hq`7ZtX>DxS1`^9bAXYrSB8*^orQpU*VTpw%h(S)OL&{018=eb#I#+ zmz7}JR<)4>8>x*+{{SY{PVY$D?rSyPC=PbWWBgT?>D=5C{r&4mbw@&I-6yA%HK{pp zv}1PI6{jzrQA9dSi-Jk|TGE){V3b;$DPJ+mL}TBlvQ{MFfN z-Zr2_Nj0+@0XC@%Xh1d>b93g&8>1bnRq*g@$WmYwl6z3r7SN!GB#0C9Rt7Zx0L)w= zw2aO%lkrxGzIZ}*xMV4B4>XrcyWIf*=>bRB zV!f>2w#!Z|9mxrpp4Bm~I2%Hc)F2c7wXOQER1Dd>FOW!qAKIxtfj<``Il6~rDS8-3>ET&Z_p5}?sw1V@YYC!-T#cRO96Ednx>vH!`^!atb z_>*t_oWiDlsdI#9}!6}Cn@Z2WGnBfcmn`aBmiYZA8f@u>W~Tc z6eEREBoGb;C`q$PpaIJB%Er_jMFj5Il1@maxc8MKa3{8C2cO)yl2gE^M#IWnj{}95 z&IwKl27*&XVD3?q-iRxe9LH)%oPo)}r?e{XA>5(SZJZEhe$?P+v_as}4Yop{#yO%A z$UdNfG+V&JhQ)jYGgjs>B2Rifi#Sw!#%V}olL=1{W@<{#&CW_^@9|aSnw6+wvq{@4 z2}ma}L}H}Trb0wF%=W1bI>ks3QzXQDaZ;^Ys6t9Xkt4lj%cwS1%sOvR3O`HHfg{s1 zgCY%DEi|}nK$HHoMw4KY2bvQbaX$56x6_i8b|d38jj7a2fRtrXcUp7TD` zOO`vh07!@#nwCYYX#;5!1M5o`r9>qOnH&(z#8mpU z?B0FuxL#z^T zqo4Py@wgsVT(O%^q>`u+CUeCNc9>j(GIpFsDev;g?@8OeInTCe#SEo`iYhVW04D}` z??UcOzymaU?S#mJNX14vPUr(8p49edg<4D=62g$4NIu}w(t$ph&S+Jqg@OsCG~p+{ zJ?O|KBZ8zG2r1gElS91HP_YU>YEPKv>D)jS=Sr38ngG%bCvQ?#DoUj)R~4J)Pz<9p znKc_|>e9IrtSGoZPef!g@6Cyu)9kNn! z%@&dr+?kokp(2yP1R>O|hcOg{tS&%3hs8STLX(mAp;Dlwl*UC6qAe-T%6|}2WcH+$ zgeU?ged{UXAYj%UPkG{m3q_JFC%5iyMt*5*x&$bnY7M3KAc4eE)F&DEpnCzrCcc!@ zOAADI=9{@dT4Hh!CWExNR_%*E*%WvIL~b%ORd(!l71q2++ELCWDg`AZ#s)jk?Wo(j z48&(94IgsO$9E)P@iZ;Va-G0Q1DbdsidE!kX|T3`hkD!1y3sd~_15xkh^wS2?J2T{`@ zcBf7(h3Yz4W}+)OBeIjyzXx6*^(4EhzoqF-uOVqyn4$KH*g6N`BcoVKUh1x~z0`Or zX@-*8C+%Gz+7g5!<%RBTKygPi>rM~WEAzg)_<_~jOhMaznEd(t(&pF74a5U};eVa2 zA$j;>@T;Npq+ayqhE}#tr%PpvoIDRE?1C7@dg9E{R*9cNdqm9LrPpP9eb)D29tL>%`LL$mZhMZ{hl zbS|scek!}=1SPv$rMTi0F%m$oqVfL#sC2H2@UH7hx`nv)sb#c#n8j;9!^NBz7zVg^@Ws|Ff9BifEgVr> zj(Iz0oc6Bz>CHWMx_EJDg}P+VHRb;Rhz58yWs-1_B%(bpIVkl{*R;e_D{v%|c-m%* zQavPqOi=GKOemAye`@($CB{+pS&VS*zG{9qLKEVnYc7%vvH(czVAhATDO1UGDpff> z&2O*AD?VR}cIrSNIKpB*g=i}Ppz=u>27W8{ABMmF4^RI9C|jDRA2q)~zK8w^5k4EG zXjs}^bZw0Oqg^D@IFU8Ze}Y9J&kh2}iFw2Pn&~FOU}j=#^Cyl+{{UK?pZAKTu60TH zFKj0TCb6_`g&){rpH3k0@9h!g0uJ1WCZsB#VH{qVIx0kQAD2O>BV3t zJpJl+i{VAuNx}J=!P$L3VeVHuj+db0{rR!9-rMQMJdNpD$FlwqKfRrRbL zD}76K&asq+Zk|XRK~&_)h^v1`T-?}dw%1`nB`N_~?f(GAm(V^Lb%$PEw`J2h1;x@y z2{#)yp+7QtuCM7|z}A_jTeGQk_fhI^t!dr)cECVNy`?icV3mD=2I2nt$Ol=e}I*S;k(Cdng={YMquIxj=?cSv5RPj5?Y`yid6SEx$L zdra1e{6cikhc?=>wM*?mgnDHRFalstu&n(bRMSa*QNN$<{{V%@Oz2!UehQ`G<*!p( zD%#EMCZxA?Is>Pk=%%&n z8^zwR`&--HlAmE)x2F8WY3(7&8zmqUn6EX|yk7krg|S8n_bWr}BWC-f{rjzNp#BT| z1<}GzwD!ByZUG86cSm79@GE3!9vApU(kM!LYs0M_g(N^)*$Y?mQ>hA^38idYkTaip z^E!_jbvgbQ29J=Wud}!O#Gk+RPp46K*}pEymMu^?OD%*5`&4&Pw{@%NS2pN%YH%Q_ zAgG**CB%gOwE;t_{?6I8t#5>qk_LG(RJ6TMSFM-{UP$_*5iz54LT9J1)v4(=?kOru z&8K6jIE4@X6(j+k2klgAYrRgz_qBT~wW) z&Jv{(0iDOSdFF?)`&=vPtVYmWGMTl#w{Fd}Z;}#5IsX8ds$YmbS#N1#Qp$)>pWs!M zYfY|{+oS}LG7q_}6XIsMz2!1C#z~W2qoQd9^Mc`o`G{jyx$1pc58Sxwls!t^W8eM? zqw6}7mcrX?$TB0mQ5yB(b?-`!4`Wr!+m9uprzUgWE9!8@7{JiH?xEYA%Axh1vbNe= zAvykPjF1uLElDLy$j=ow)eoDC)gL znHbOWR_zYWwOxdS0|sPfgVU{3ZE6G&GB~SGN@*%u({icWK<$odTu2sBjxAUeQ)6Si z9Bjg)8@;Pe_1?OxrLBaS84wOC{{YvztD1e8w=$3c<6D!~iJuPoY6@w;U*qdr_Nb98-i0jQdud>Wx6Ymr#R%PG_}Sx|>)_?H1DJJ*Ty6 z%ka0sX&^5K6>=B?UQzmaYjB4?ki31_CIvy|<~DxUQ? z%20;Nic)G%>eKrmpL9Mb|*xTGH3QzFDrvv_DXe}D&w}{ z+4O)!1Mf^dXi9h@f8YN=~FSz44JkV&l=CM~5xSb-*$AABT$OcU=)Y?&i)#sxcdXjpWhf<1|*e7^kF zkRXetl=c>yP2FxuoEaUeI^Y5%rb!hjwE2mJ2<#{)T1W&yH7qK-+Fg_e)SLsy%{RMZ zrf^Pa#ULe8M9HK$k;wztQ^l(LYn1ls_cfHk$tFeyX{MDTCSsld1p7##B9S!OY^a9@ zWRuNF*}hPM*^`QnT4d%usEcxB9EcG>@F_Mt6#d&E%En306cSWIi1y~B+#$xf5(IrH z1*8WIayg%^2)fE^=uug5GMt$_#UTn211E}oKBRt;^`X?1g=A*9UkFG%r6y4Z2{J_z z*)x)VwFnhIZYlOwk|gAc=USGzI#f6#=|VoA>XoDk6lvLo2s1;zji8;fCV+b`c)~&! zOagK#z_}qMLWe5aa4RT+Wd8tqJ-*ABYXGIL0T~B8aZ5tC3}&!W2%O?62>>cG1wjgO z3Vnt8vxq(D_MMUdP=F$%w&q4hy*}E42<9mgFcoGuQa#b;qIQ!Qpu(pRDApCZBt!#2 z-62f5><%WB$_A697A-J@{$2FAg=Tr0>JP)lw$;O^VQ-M)e@q!6QG;B-s3YiVBp$(pBs6sE1f4%{o;RXpLJh6gSGK{kI{2~j7?nlS>i+brHr9Es&@kzCbVyh8v7RAHF2n| zBhS5_9BHRbxJt<)BNf&j2Wk(eK>q*+yL1xDl#~O=0&Bqk01=-LP}DiYk%ewu zE567i_FE&A{Lt40NlDu(fkd6r7&ODl!SxLDn)wV&b7cW$$IAJq_~HJqidLyJxLSe- z&w9`{X+C%)0zR>d-`|bjIbJF-K-d#(C*LBpJ(54Hm2Ut+nXlJA88y)~2 z^b6=;;FNCg(Ip<02VEHd0PBr(gHnaYWQ+xxDYEnr*I61EQ3%F82C2JD{ z>-Deb$55C^NF9punig#!tvRUKg*s5!CPW%%pgaWDI_s=U+Lej_01rmlkJ7O@nv%Ox ze8@sdTpq44X1c?|jXjG_oVB?_DGRts&wB9vcdI|7$8qvktm*Ixvh1kKu9$nn{RIs4 ze#Ql|QWTUR07PcC??CkNQ zaAVrOczCC$YEAXKcDkF(buZpF$qN4fC{eGd-DP0a<%7D7vUjxmc_8ugUo|{@U-)l` zsCCD8C5O`H-pc_}CcOtpf!a1n3$jNFp7T4}@5Oarf=(~PjSkwgTiZFbzHw=B|!6$<@0_x7#R(@!w|iDvr+B@Q+W zkEM7Hu3ltwjuw=qt&YMlCh-3N^-w<4;;md<7hgX>DbQ479MgzNDv$}qd8a%cN~B(U zCPkwI{EATdIjZM~<&<>G_U)uL;*heH0l|v4Z6J_vd8po`>HA)z(~XnMQWTjeP&^vi z=z93Hx{zJMuOTlLYm)Sz6?JU|_xf@Bi9r2De$z#}*7mMi6|-=UJw%WKy*`}y5r@p(VP^f2 z;!JY3$AtbgY1)WKP3zaGOTrM_jw}rO8rr=|e7z-Zg(RT&21I+;Ej!=`P;2Zrf77ob z(_PZt1A%V@O6Q1Em zbq1`$bac3vCK5q2-no~=4QI``b$jLs9Os(c9c!wh&q#5CVMIVb70g{UQ|UEZ>Dxf-=glMps0phNR^OdJ zOxlMd%uK~sn1Crj#ulgR?Q8RwOF~o$3XiQvbS9AYp?H^GY!DTIK9v=#IsPGizhERe zfisz{!Qt0Vw`r#vm4Fmd7Lm;qU`EWQy2eVLx>_{dJIiG$K?q2}_|0pLZ&534$D|1* zBi?H1)mLgj@)88_WBXRC>MNxJTS4uSz@K`rVdvDPt)XNpX0v|c-col*sEQ8NmlwHe z$tU=%-Jy3EK`lWgQC1y0Nq5Q#LqNm|xHh$@3ybgy0h@OU(t;vj6Y(`Li$=?7LUyW0 z$dA1^h66-}BiF`h=55xc0$@SnX+_pOUnsK zNHRw-YBucbZ+i2%93IrI)MzKh!FE(eqjt3wB{&M_J*o=jMQSBVAWkNY)Nk2mcc>qV ztlsK@_b~ttBAXZ`8{}&TIYc{hhSW@gIryM1FMtFHKS~kT%E3nBN6!@65~4HOtcC`J zo$frRe=y^U;wKd9LVyI0Ijpg6CVQBpTeh5uB7fkhbDA(yV~mu;Z8*H7Nd$98+E_T@ zl@9z-)>Z_;h>^ulSn0_TDdMTWQL_PP#ij?;R9&u?;o%>8k!wp{Juy?ZnsRZq1`cBt zA~e(i=mf|(s&Y(E!mmXWLWZ@|LPYssnf9a8r>!XvkYs+4YFf(0GC&yOq(zzs`9YY9 zrumJghEY}KbmgppumU47^Hv={OhaH2i80R^qinSFDN>;zf4xlFY3(N@Ow35CI-N;A zl=#{jgtoE?1JVgR`_z@SvQSCL1V_wKjanoCAbn}%uvBvr1}iz%@|(O9MJCy;%HY(C zR;mJ0f;btaTU$q{C$>JdEW;}a{-Q{e9}!BxJ4%4!GJ<6gM5ajo^lDOIkG3iD%1R5O z2WanDKp&-2aTU#O-=ZgESV5EnFp>;=^GrO2DhL@JyHV~o6)_S%YaUb{0Pm4apc2h+ zp`UMQ0Wx5|U$>sK?nLkY-~BtTE)|6r$7JR<139DuPTOw9t=RgOq?z9@RN< zY@nqoCPoCniRPmoZdVurO=z*!5?tC*7k1@AM1lyB{8eXIZ9uDF&v@gSxW0p);Naq* z^&4~r6_lRi1DdfD&8n{et$V3iwzIjxDxA~{>=uut37++C)-Bf3l%OZL?N#f9C3D#P zR>V&=OEz|15KW*ua)I@sF71?$RN|x%g(tY~K5Gs_hpjWkI6Eqy(i=*;`UuF(@dBGt z0`UMx%}QNcg-VA5jL<7@Va_Sx>Z_SYC~qnii1{?|T2X?KX(~?cIqykQNHZhqDYt1q z2~N0w%mB=Ns|>t%W-;6TeQ9V;;gwTGupE#`iUV8}#+u5LX?uo9iWck;XApBrVR@2g z`%};DTXXRrN>DUYz95EWN&_PmmrxX`7+1|UfUp~;*%WBV3k1=1A{cK6RZ)! z5nrw#cACP;O8pu4`csalX(w!ZQZjo+25F#Jw65v-At2*4h2Vum`{t9s5$*F?+<$r< zsEI@c0tX~gB}Bl$q=iT7`%}Yc?LcTIw;>&B@GXRa!T$h;ox5Z@g1$-T6&};RpdbN` z^(vPSmNvlzXSG&!hg~aio$aL%kW!^2;yA@SYT~Wl4vuR#NLX;KIRt}Eq!lI%O)!Aw zr8jdP7iRtw{7Yrl)zdf5CR6}Pp2YKAq2aeuJEdQp4^ayi??SEAtOLz_lJMWEpXsf7 z-tC2yZE*nRF*WqB!~UgvtU5-^Rk3lW?ko^VoU8SAug<^3zYdKw=TgDxf8x-W5o?Up0Vgs0(S*8RX-qeUpTtkO>*O0MaqCbm0O?> z{%|qR+P;qT<3;YC)HH}V^XJCGES zGnf?1!T}{2{`8v{H`uhPR&W}8_6p1Rh_$xTcs-R z$i-;8M#QA@0$}_K-d~NS7W`anCPwBE4Dfw5qOF#)Nk9aFfyZk7ZQ-zg*t&8500>@( zP~+w|=oirc0Kq9jd@y7s2hz2kJ1NY**p5w~TSts0o+LEc~_N@KS zzZHT&6hM>Ra7YA+Gn#M`2NUxYj?iHJD;ONt3U4TmRA-M0)7jK4SxXUdbcHF^1IkAj z`ybx97sNNxtFo3N3dke>0GpcV@5GwkbE|AZNddcI!TB}KU09zo>NbtQ91;9i^g?Nb zuXPF*yw07QKq`fGY#wxE2~ZgruAA`RRoSB3Y1d7m4gt9Y94K}b&W~F?<_{$(QQQbZ zhEK(GhLzKe9+0)ww4kwa(_vdqI2>2aJZ&Qb8rR`^{*A?}qTWi8ut6i!&L*l|U((}K z)7-jZ1=A_sf(}Gf$4}oP`Hjm^E+Fk%eZFdR+qCf7lq4l$74z|5H->WygPLfCxZoRt z6nBQ*V4Z8FpV05J`w1vit210(uIzxnepmrr_xt- z^an}k8h?j2+Gd*K%Wt#k%nV{G_u;zSvD40xbt-b$?N0CddsQ=}Q1+XnY1VfVl$KKj zoJky2`J^V+^_#@NOUVf^aW&wl15nojaEKYCOSAfKf{A-&ShFo)DM?K4+Gn$>jcd$g!W^$-nf z&Y$qP-ht~U^}di?>6(xK08H5}P#aY8n%UupRfM)gj`g3)kUeWi?-gKmXEB=`{3(ua zD!}0ORsB~>Q%@sU(}$IE-0mqcxO*C}^%lGN>lOKl+UrBsC*~^ed>d(ndWxg46{@<) zPFpnf!czfYh=?3k-$>OnR{A`vQCy7O?6lvCI=~G&-rylSf9LO9>_W92QA(L^AOXzQ z#qm#GF!Bn4IRiPZd((}kJjWD7s7#n5zQNL<42&9CdZ%r*C8;5>(QS>!1Z38s>jzQ! z-GGw>Vtp?4t7>(9n!S6gNpdQQ=HyxlMG&j^?eY zp=n4Bq=g>9ir)z>X<9g8ApuE&ilq2?)8^f;&pN^gs*0YGtwli8R^d ztRr`*;a4?#^{vMiqDT-)_Xf4UQCt#SP)w2tKR_zqtz0RV)IaL?surbiZe9(g0FDpR zmk18ZJ=7`6D@U_&*VS|7nI{ug_7sNNlRKsacc_-smJo(ejGSYMsqHsUTGP4Fnf@uS zeTq=f94#fARotm636fwCagVJ&yJevV(U^lKrbV-MZAyRyW}`2zkU;>XLFf0Xu6>%M z(Pcs0I2kHZ$Q)*>dj7nW??_N5ft-D4{-M@T)V76z@GD+w7mi)LN{Bx_>eO-HsYB$U zK_>F`%a=b?jya(gw5yT8`cm+59_GA;%7_u)Caw*w2_dEH4YU_9Xy#ZMJ zDnX`)AWyX>N6_V6iZ06yFl22^Pk5E4_?OoI||C_n^JQ)Ndul_5tGBbco2Oc@X(0DURv(*#Kw?KI1Y zj^aJ1;=1&4qfFlQZ_IC7`5jGXoi>AKIdD05rypxk*1o3v|gQIUr!vP4hbmPQnxj?Nhf2 zLh+g6qHh~kO4T?J4P1s)r#HHXag{cJvj%7Pnu@thsx|@v`sSw;(%^#vawzoc;{|#b4YSfx%Q_Npz3GSITKg$$XSQe$UwSO42U4( znicWpAngQ@b2LTDRH+7kdKC&NJk2m)Ay;s-!Vr_3M10eH=W#Sm(g8bxiNp#P0G#oP zdvdG15S?kloJjl9*Pm3)3qG$=7{HN_I%eI3||hm>g*|>I#PA!0k*)OaUYk zPuhw}^uPd5`_m2s1|t~eiM&#Wj_E5RLWh3BysSwI=e;(90g?n7aVL2qMHkTu@KUzS zliq38-Q5#Ri9v-7rR#1biR0SCOSY zCxmm2Hsf*Jj%qv=Hn`g$V>Ke#;HY5s98mYnkawjb1to@!6!$l9u!lp+WyGyGBQx5% z-|)BMZnI-?{uyg_hhzd;S;5a0$qfKZ9DQp2;V)F4mg;*;vgX!;{Zq*mgW`Ue&ZnS! zWLcw2L!`>)Nkp%xz8`hs^qqh5H)vJ5FBSSv>D+63Tmye>5)}zjaH{9+0@p(E2cxaE zD>WfE?6#GmXu+SYY|jij(Vc3@==YAL8ikU)w-8QoFn?PhdnpBv{ zGJAHe!~8|tzSW+eb-ig)E;mXrcExfZi@IZawZl)SsZOMbaa_-8`p<$l?ia;nQPxT% zg|8zj3-I~V8vc>gmKV2I0@}{z;R#p@G4-#fmbUFP(@i$k&7l~~$giH-c}q=b?K^e( zaNCF~N_klLuK4L2%_8rlSYDf|ru8kew26fbRv+;m7SF9|XykmALm`?5IQDWEqGr9GiSM%;oU-niebH4@KMYRYOvTo4H4X09F>_|Md~ zxAyuC?b*4rd(aa3%6^8tB)%RVSe8E3^;fk$D&M{npJKU-@wl=)Txm)HKw2e9j7MtG zmPI8%9D-oQZhyw5(p~X|Fb>7pHnd5{6{Reae9*Sl>OP-}{SVM1G4yyEf87b%f_&zI z*e{~rf_VP`Pt){H0!9QGr4tx|_N1hw98Vpq(r26s@|G0}StQBt?}|*uBL`!w}rVQc7JD;d3u8jZcrP3nrhWuf_3;4k3Ss?pTG zgt*z<3PBKiRHsttw)c%K9$w}i8<4NJHAm1coYJqJ&~KJXn=;atIRx=v5Y<5K7NOdC zc?;G>DAdQia=qeKiZykHT3TZz$DSVqqtd9$+lr@=q1I8W2bD00X|bG z$mT%*0JT^&+ofG;ASIHbk5E*16%C^5?Q8uTXcqHpd9-KTiaSocxzkBuvP(|j2*Aa8 zEld*Vb^b{1uQlR$cPr+ZZFK#sZbCpQ5_fS&3n;?fGx1fu15tVA)XH2248=}wdv;bp z?_Oi6=(Ul~=958VO4n{QMI#c+NZ^8gY0&afoCqDL08hCwS??2?%o;}zjpot}cgaR6 z@O@i}rX7A#AsojvkYbx$0a4nW!-Q-~&)T(riTao1bf?OofP?8g zpPJaW3f}6sKu^}R2afvtcI`aCUebh-1G%qd&@|xA(9pFSJhG+%%0XU<=P` zsJkiys%{)+(M_sJIr@sB+M&XPjfAL1?9OWG)ovS?!cq>wh(AiJFxnAuv;t$1S`1Z- zFr_s8Ib}X}&;og%dbISemn z!~_>%MRk6ln>z;(f-o>Ukrk|T3p1(fDhdQb!72i+eRFo=t`%&vDG&mI_ow;`Mjmjx zDFlNu2ir6e-dveLHEatMBTdo63rb`FLiVMtQBo-R|k5(=Px^?lQ9kkz?d9tjcK7^wc8(2AS|U=)sb z82)NQRk~`)wKkHFI5EX^j|U2C)kQ{X_o*9!TmdFcQ}s<%Eg?=Qq~a^u=C&NTQ(;_V z9@S0P@7;AfcajHg(M23(&K9JT*+uI2=Jn;2D*(iH=Aw&a7z4jQYIsbOj{Nh@WPpEA z0Q=U70kjhG{u4e-5&O{%Gr<|2)#SEG1wvzp#T>=4CjdZ-OsCmfiZBLNQEFf+AYw&I z+Sw?iLuN(~@BY<`dttl+Byk^Vp0T$H0LC~X2&ytX($#_?-94t+Hb4vHfgaUAWo7G6 z2emV&+mZlC24ZnmOB*0n3c(|a&z1d^;0FlH8zBH}08DdJ*4BU|&wO{0NU*bjAWRI; z6)$gSsLygSRNP5GM&#YQ8(;*^ARhE$T2>OIllJ+do3$brwrJMb-jG(9jLjswZ^BfI z3M2AB`hmCmG?fpL??ok)$b%ySE2^8yD?{5`1ObRM%u!xJCv=D%zA5B12#jK$QX44r zlf+Vdx)us6?uHEw(0^~eI#2+>=i`G+XEGP7Yn6Mb_J@nt1lsPiNPXjJ)LWL4i-Ela#6rArAQb!_@p?D%*ADu!5PS>5xJ=?!9;?Q5;@2e^oW3Cypc?RC!f73Dh6^*RU(SA z3V1415_{rl#~X|eKWY=r3GWd{FtKvL-bhg5DhNEO-DM8y4=_*mrX(h1CW}}wWc?^r zWSk$~iKG?8Qt&ariROuIQZ~sGiWFf$%pYobD+y3PJ*pkbkV?w;Aw()q{{R|GgcO|r z02J!exP=_Z_M|NUq>A7|CkIubH+r+$oKDjO6OL(x?+Pj&^y3a>{{S>*l7qd|&KV$q z019D!j8EE#fi%n9oM6xcluqKpTQ2q!^F*OonfBsvZ%<`cn-& z3IGK5#X6-8lAuXA=A&45fECASqX8-fC+}38z%s9~_AM~4La2*pidL7BV4#X=)})n! zB>dA&D{6p(c&;EgQsz9h))#vI47^QU>IQ*#a|+xWN=m=VYk74Aj;+&OW;HD{avpQk z3Qzv$$Mat}ycp{@`YWrgH5T1c5J(P3wDVt19MqZXPKdGUjXBV(h8qhd7|-ABU!A;r z(m&ZfOYICEi8=PQ?sOCR@r&-A>Q1?~>j!k*A6KB_<9lW$PNgnRTb>eMIX)57|7Fx}Z5sW~;x6-l*wEI!?!4(l6L` z(x9EFf?_{|RJ<{%bUMbCgGUO!wg4mY+7~x!8nf>8E}N$@a#!SS!gC)LzVsb$SJSP~ z{+oSsXm%8<%TxpPtta?!>FXa5diBeGqA!-zqBpc*XfjAO*mr&d`N#6TH`K%-LyNZf z$8sxE#d^IfH9|T2eLJM++Sntf8vK7%r1hOb_fxtzH!cSjN{W@XHyNm=uT`d9Cs1qx zrb$*z1MyoMt-KxT{)n+wtABB2b#1#UWROxl>s4yVacr$5WX?`26H55CN6>674b5|R zw1e{tM|kzrgR46AtxWDmm28FzPGScYPSeOs=^z3D$tNE){{UZ;{{Wd?P)RVcf_n-U z(a$a>3_$j;vgu+B(J_tS1(76#&1HQV{1piB(XHTsrMO4#YoicG&=3Cr3gR!qN8%T! zIxD8z>8_~KE=wpXTP{q%O@Ki?mEl0h@xDPV#iibt&{ZrqF-P*H=9ekTDLs{0kNS9?{p&gTp>QXKE1$aQOS#ro;+r8$Dkf9& zTKiXm=}>V{6DpAh=~`Oz@x9_VoR!@TDdM68n{<^=?LplBIQq=I1KK8p^UZ*nRjNVT z`&aa1Nz+>lLOtJ-!_+o%`wXwWZPr*Sx(aRKJBAN>*sNPF&c@mFsEyMmU`$soBk`}R zxU#E`k@AbXQfX_S5_#?%^v*9)eFF6z5m;`?r?n^3k}xv`JDUy>UIi<8I-l06JGrZDZB_ zB@tEzzwrXr8$v?*a@|Qt+5Z5#Yshua1Ig6OWMrdo?_8}tHnH)(!z=Lp*G2UXv;Hm8 zj-~=$Lux~aQSLkb;iR}9Edormw))qx4yY@={+#RbCnM>6b7B* zzfJg)uOj{4m9}Q))BgagAt5TCwR#?f&?M=)Z!Pcje3eaJu$g!4HTN!w@bI~%SU07< z;?hvsRMOO`3X#FBz|#x6v1!Xz5Vh?k0cJ$~zLm?GcZll+#L7jbx1gw;qCRS0qCXVD z9Y)tl+uAvI<|vf76^Nb(+OqnehbPv|$y!F{l_{RiU!B=@z5Jq9MEqO z1`ld%aWQ+y{)hRe65OMUU5}eEocbeu)Z^yrd?xiaK00zCD z;YscOwIs*mv%)9U<)+%{1aef&3i8kJcT&FJ-`tkwKiPCxIic@eN*f^K=Cn&+jUNcF z41RjyqORUaKiZBTiGK|*l9$ncaN|nj`eYjBcsr^v-qHA?V=30w9ayH}rm~WaC;&mQ>;hJERz{K=Gqr7mvKOE<*SxAA0sa z8|ZqSEWy)-Vrkjs?FDPQ7o5A*fg8w5`}<98Mv7Bpjevu;4`Ib?UWI4#SHZ=mQ#_j4 znv-cwsuY<7BqZnKn)-MFxL$f=W`d(@R{^JrMo-N~S+bX1Dk5j*j@Htb6bfS?kWC`O z$;7mksFaXD=l7>HP~{Em6bdnxMxlPoC`Q1A4^3O0b#^Qy9Hj#T?@@gzWEXPn!61Qy zB0xU%E7U4W7AjDJNWni!OWaNZ5C?Uybug_$^zA~5w{6E8Yh!e-pZ*`F`HmPRAV8{i zi)gEx#Hb)DPpkK>gzAuO!zf4)BNZ-r4Wwl76dtJWn(P_L{{We&J#ppRS_T_Fr6x$@ zwI8TIwc?2e34t@3iqx5P zJw?Y>pv!Q5L!Np60OMAj8MbuW687|ki1hqZ8Y!eX741?tK2@7)CIA8;2+eEGs@DT) zTWK<44ExmIP;0AN6$F72V}V+~UDQ=|cBIKX3E)x14&!7l;31v6apwx8$?s8GlZjCY z3MK&O;+Fl#l;To_6F7B9CP$i-bP+rkl^=x`+Cu&0vPRP)=lDTYqaAp3pj##maS z5(X+9{3}sLN^PrfVnj_y+S~1j;&Nu2X`?Y58kVxP-T)*3Pqk2dgmSdth@KG^c7}Hp zgD@(?V`IJ!(T}%oDT^B^DG3sI1~K)kKAoqh)3{0Y?Nnr!8Cor7z=+eVl9bNCBZC~( zqQ_58#L7s4?fs}tKE+t{KoKC-qQcc93nxGARGe(Cd$5ylYLHVBV~Uuxv?~Dn3PruP z$6+vICPhnIG1@(bXh8=F7hEP=vcylf%{}>jp5zG3QR%fR?J?Svwn~%}wBSt(nUrAn zQOaN?9$+BOa4Fj~q1M!u{-fX6QLZo)pDr>9o=O40AH5~R*)yI}Jg|Yd{BSEC#0mF--k#V`5PQt=SO|l+ zdD&r z3a1}&QO+SLfgqkUQZh1%u!6X4PAkze3CQ9qIqjl%0grQ1i*-odvgzjs4XNS_*9t~_lgN;)S?8QJ}AUWfFe6h zF?55>{f88$3OOmJ$h5{!tK0Uh?wT1r5S{{R)}5sXhX z+eSu5G~~&F1K%{VX+5q4AnpK4^B+n=536!O6Y)=6qDJ`O8Wbq21pfe~Gz-eE{{TtK zEGi=;lkN4TERvi9L#1#)N%-cU3MvOA;(@}7HjqLUc*rN(mdcEPB=a@rHsGImB9hvn zSo>m#WMxPBk*%xRah@pV6bO=e=QS3E5=LV&M_Z^75qbt6hbl5;bR8WDSB z35XO(5}rwc6vOQu@-lg)Fl9WO$~#TDEv+OkYNrOf6LnG?8I!3$8e!{!6 zuP!b+UCW&|@sIs0lBB6dWPDdJc$d^|-d>AVRTk(owI%^I&|V?+KmPzI9Vu;pXyR6o z6bgs=a3Z;PtL)b0{3Zz!l_(A%``6F>C8KOWvQg>_Utb`T)E3+PCNxpktOhSdvYdcI zv$)BDUq|fh(93D{B}xM-0=`jrZK}W1+M5@4PAx97zcDIGyMim|uY-OkTlKz-+k28O z*@U`{(ofBJpW;q~P-Xi=a@AgTI%or!c;#8VP|}92(f78>8=FKi7H5)LUp{s?ZGmHaRUJjI-jo%~v6S`x!K<1vs za-UwU1E?0Gl3_FVsKqS_Axi|Nf7YbB^&uTX>URJ^9+RHj)NGiIfJYE3^p=obnSh4%8A8n-iYfBPo{2JzSHhpY@m(FLBfZ%b2o*p zy6cVtph6YxgPQ10lF}|UD~4>X&{pHB0tRBfW#WAt5lbfQgOh7#PU9m5j4ssCx|-{# zI!zkpp5aZ(Q7YZW@1<)t{{RwwL#ApkY1-FJ*<1!!u&>Q1S3cFVdKW+%FHEy&{FM|W zDL&Y)Z}ERZR*%;YxY;4Qw1tnTuab0qK8}4$;&VYAzVGx^G_dKWl1SXpYmfY`;iP^b zdIM2X8`N01(;QwVe8ko3N!Gf1UPkQ?U$eat`cUBA`x@hJm(#z;HG6F_`_Id_aOiBT zCQ5m&&2jj2xYKNtd(&NJ@8;W1 zKfk?i1+rOGI0{ItPsyzZ)BZ1YpG9Ad6RXg>wwu8Vl6KD`w?>uKT{*8qVvRq;YBmNGTK8ilyp7K4OT$@7lj~bje=rD@i$}gR3qQ zoRvf#7WigfKx?7w8zt1q*(r+KcE5+;1#fiASDx_ONm`sosD`$g_ll_6k#hS!QplGE zK6defd6_VQdIMworlftzD-62Rtjfyn9a6`m0}Q@VEDxJBVGsiCsp~hyVmCDGq<(xzY;|j~2R!C)~2xJXcS2f^|)L&AZJrOS-vf zcn%?`NA7V~Yfg>oM|Oua)|d+a05abOKFONDqi2mZbYqS5csZp@Rn&%=#jcURgFj`( z4gUb)zoOcZ^}mcd%A@p$tsDOUN}9I(8{IK(-Ice9KzU%Nakd9>`U>qP`U3fB+V-Pv z-~Rwug0uX^KF^2RRhue%P}Ob~v`KJmX(=DE{`Kqho*eO1z#U7&Pt1?#vgGjwoBZSx z@@W2mE(PkZ1@*5DZ4~wY08rZMEew?*qT0V|cce$eSI$jE$2ARM$5cYb@)oEP#Oc@;umT`$U(vGMsZgQTVn0Q zXi`W>Fl1&UinFjfjjnO^3RB%XYMXmlN=66-{iqJBUIQsyZB#4TrtQ*;YhNt_0D(1J zx@~ut>t#@2;0j4JaJYJnrRZ8~h_^2U2!Y>LY3A(v169;w-;wX(l*4J<3pn^yFhrCoSmZi3!mq98$ zAp3_nq2}W2NR5Lbhs_3a?XNjfWUF`+5mk)@kZqX9OL$(tl@5M%=QzClWm_dK%5Eh^rL&WoTft^ zl;aITWkM*Vpb`L9Pj9t&HRvBc$Ks!9vI+Fe3aKQES{VB$ZJNj>92lwF8*w2a8dewh$JWo7?3L0rq~psK;R9h;&`C6+aa_s zY>)M;HKS=lWB?#=aapnwcwA3p{gt|KNF;~^5ARkBW>644B1TD?jkZYJI0N2iy-Qj& zqmljoDjV*UMI)`4NgIrSG54db(GUoq{uIr-YuYzrITIb|`)1)>bB<`h1m!^;(QGzU zLH;6X?;#LK04ts-i*`T&4oyGhdN7>MX@p~i4K!3&l6>hIj1ljOEo`S?+B*RhqR{h1 z;FGitJJQtIZvu1g#Z`TT(Tt`Gd%!0huqm<<+lM58U}L|%8ib`hj1vHH+L~KnpGruP z{*_uvO>2ovC;De`5(qScR<)9x$GtkFVgbSLSV&e?-~RNIL?Z!UC0io~nsIQLi5bli z%))R#+L=%i0X&$XrqZ0DkE%E#kbSw4PP!AoIS?rc&&>d^>>~pU2$AnSsC%Z;5&BA$ zPc!_{PAAd?duQ)L+^9rH*qNy=vy?Q0LVzS6f2}a$!iL0&BtVWS$2}ygJ%G+Bw-LOg zlte^9p&)~VKv1*;q^NNObM>HIY;HZt9jZ;#?ZiybZYLjpYB$-UqO4ksTN?q7P&{UU zxNS~Pry$hI+bRl783Vr*8_f`sKmh*PrnJ#OqEg%$SHEFObqOK__7q~-Q3QkmIDt$g zs1v;-a5yz&JQ0Mc2Xz?w52%bqMqF)9NnL#1~E7hTH{-`EZjQO5s}*wTY5(VD5@Hk z{FP_S1C!o?ya`)pzcb$yOUnsWgvw49|j zQzLX^G)PpVwFHUtIf(e8(qt2!D4x=CrH% zm2e0kq*siTKqL04$p{UMB{My-H1dG}N@jlaA{J1tIinC%ruTNm0kljc;Wp|CZ0Dbd zpcIe}OlG9k2~RkPkG)4aVQ~OQdL|&5BuaT8&T&MrdjmqN1DxWlYX0qR-)UvSWxD?6ul^DwN86DIa`8fO3Er1NWO6w zN(on~3WWjK*5T+LzSO!l`rlR4Z&Zz>d5PR${2JE}bgQh~uJ+A>8o2e0MOr$0M0s}W zQ}+!dp+BKqnCvSrt91DFj4W`lwYq!jo)>6z@8XWa<3vI=%^5E^;s_60C=hCwbHg=$^D~?=I{A0HvO7TXw5I?_1ZXe+kyN zjjhg}>+6PET1iSSt-{CdE9I`!X*wRPwceZkKJ2RxZktB!qtm*J?D-*|b~*IhTMUt8Tg&c%mVNlH|e0!AvF!USX-4A0iS z-=UF`=-BwpiVGfg7EP75JO=2!YpeAGX{6e?vQ_GECQyOzKU(?;;ZK6vUqjkAdwh`f z@{&DMKVU0K{s;P}!&@$lI&Q0fWo4{3;>wHa+vX#2gEhVS=f5FAIWvkm?-XGH4 zy0@M^`&Ym`b*<`sL#V$;0|;O>^FK54S03q}1Uhz+e475NW32?B`bXIDS}*Y%qJK`q zTWkGSlRdwkCI`K9UMev4MtyCC;m;i29eJL`LvxoOm>{VTFMdhr^Ljca;?`r8skaWf78 z;YR7lY<8}p@GGd=)Vg@-F1l3prU;okdm7a7HkZtavX08fRgZLA$7PQiIu_qv(iN>* zHMZ{6r5R5u9@Wl>)i0P&l*^8`6M{D$d)H}PGS$;-wRIq+X(=H6E0TKu0Hxp3I;Qg3 zgsBa!UTQ@9(mXk>Y|Jo7c;Qbyk9v+f75o+dTk0P>W>~=A}{PuiV$v z8>t;vrZ_`Dm5&@pPpQ7kwYslCUWIViRp|^5DPVqSwD6?&G4Gm?{M#40Q+Et3kh9zU zsjiII&Eo^5HRpq`B?LC53_O?_`KN9=X8PY!W2f}SRO^?H1lyp0l=4aT012A;$A<2)>FH(wf!L5w%hJFUsk{y8<_gK6k4 zpy~UYn_Ez|+Fe>LBSs*pHf_>_3SITVGxP`*$-W}^)uQTZ zYgo9uYRI?hA#Q=kVLXYdmEVhZ9w%C}Vbc8t)V)SoBh0$ebf?zbPTa3<-@SVNgRSZh z&^5Y|>TWK-Rh!gw8hJGZ@b~3)My>d*>iu2!8)s8y&4mw2Et?4=x9T#gq-vfgYPyOX zRqg%L$yCpn@|7p`j#~k9R8e^Vrq8LCXQdNUBI#NS-4(iN+vVz(@F4CH@3nF)tPBDn6 z?z6s1ZTy6(5_pbtQuol`mZ$34!5QT+0amaj z^{N06XE*|@n&rBjUfd9q1jof#(4g8DRggzNGf+2*g0;zlPa}$qg%)ieU7g2e;Oo)>W~gA|PgnADUy0noxR$!j#~Y!5|p-6;$eNNeo*0 zRRqs|YEZmX>2XpZK*dsey5?Lh?##fe4Pfk{=7p77y}BZ@J%5YZD@0MBOaKVow09nK`4oc#XD_e6sUke_r*)w zT0j{4(^$jV3)~Rxu;$ze83upSieaZu=>QRdKT0vHa3ciKj9bYHQed2#X4*r)33e(i zrcQeqIH%U|NZJsYJ;=mXTVuRWw_{5-i&26m4NI@x2&5W`E8PHqL5j^4NFynG$cNwguDLjn!&MDD>0)FO2cz`44iciCWm22%o!f|8w;5)|T+Jj6j5IjGB)$t5Nux7MX!Nf1jw z0F=*a*V9R~g;G|B14U}BNxh0LClYEkQ72B)&5$H&b>C?PG8wAR}lU|PnW zI#Ji5P7pyNPih$`DfJV_6m7uV+;T=}Cd~Q>pZ+xVnhJpkd#%9WjGX+_3Q}VjqOKE| zB4dN^iVTgQgNXiV?HE;E%1ptW4`EL-qqtA^q2@`zi5)DZay+1zH645(==j~EWICjQrBn0q|7XyNt za4ep4kY^OzD^Z>g-icb1g#do^D1f{OnueMbra?ySWkFlLLUTEytyd{6{LrqbL4h%f za@Eij1bb$LfDFF&fh$d#T3WS5f_cetX6FC{ID9DI7sTPX}mJAu%aDC>aQ437LJ))vpc0kNV zDC<{X?I$1hq)HEEVkd<9$cU0Dm^=RfS7DlUWKRbIV~S*w57Lk@6L)(lJu>99_)<&| zaUWXR9Y1$>Nee_P zit_R_Io5kGMW-7Xjub7wjM{dUdM+*@IG45sGqO%SDy_!1HqD;yDq)xcC}SN47=wo3QYD) zRc@iD=@adCq8mRT7kLgM-fh1zf7MkyN%6m+JW%R~I;*JqYU!(oQh=ds_}dBk)qPz{ z;G?T0T2{K&@CXUG1P|h%JVWX3ini+eyKa}#+_lrZz#3)82~tPb>opeNOlhR2dKOa= z8{m9brqZ1pI%c*u(?GzWu{8{t^AWhMxzinK;O>frrr2vO0zvg1>8oQNFZfyy^lvpB z45+dvin#t8zXkpk_`T3gbx%-SYb;zXPByQ}zBYmnHM4Gi@YwKKNh!1IE~RU>)hQnT z0807iRqtij?1oy#cxv)pp5`aR7?D zcxmIWMs$|Eok2ZeVr|vvaUox+BiglJS^fchM(EcL-E~@>s6W%Vx3(%L>IF!2xBeeK zB6U5IZ<_0CT|GeVOIJ3qW9!g6zFFexe^CIhQPOb$3OlEC_q9bitKX}3;(W2# z39EAnKt|k8(t^>ON_4wmm;g2+DnPa(L`dylJ=VGMO|@zo7z&Z%zOIb}r0*U+SXpgJ z0YkYMHNw6Yhjq^xE?!9USGX!c`HJk%8Q1i(eCF70lt zT>k(I*K7)aQqj32!AX#R%4!=|(p|UJt+g#JWv3fEiAm)9RTIVjxa$s!e$%UMG{iPg zw1?Lcm4nRx0KFGQ)xTAycCH50t?oOjy4c#u10P#TwDtFhelhrh9q3(J`$y8)Xb|$5 z3UBjdalJ~A2Y3)GQ*=guULyLP>2TrN>XD2_ID$``2rJ8hj|yydCg6OxODRO1FEebsKT1>rcGG zR_kxNWh|ydq#!9Mk8o@1{R>k0^k-eK#SGti{FjyLT4re+1U>i)ztKO0j|2Q7(9cl# zv7u=lWz>#1l_uii%gjJf{V2C#WQ51RKQ*zM)I3Di8fM?6+py^U5uvrF8?-@pXSUed zkF_VJx=q{L_d2Jj+bg+wYF)DnSyFAAB*H*H5myNbAOxSad~?MA0K}f5t&!05)8#@q zBjR`DXnj8vO^!G|KU=g@YIiA zTr+cY?~qKbYBTrZn&}&N0@8t;fDgrfujyN((J`;~NY{UiO4u5L+q2RzvXW2%$MaN; zIg@#*o#%2!K{+#4KBIJtRJ4^04Y-ki#O&UrZYs&6#3;c2BmrCXAudU6Nx zSFItC8wLsZj@4Sx?PLQIaTRvc7=(ia5FmSe{{XFLNZ?&XIr+d+_9#rmfDCr;Q!KPM z1po~EaY5PNk%y^+y!*Nc92lO(>oYXBhUU?a)GJndW;}P`W}vPmRclOiq32 z?c}5=cRX|d06Wrfrq6f+2NbJw=0be1kVIml^GazvpIdqQ98v=^eMcPPpJ}C~GEX@B zQi4HOF+lN~To7-tHWLziW`ILVQBqcup67~|eL!R+{X0;vp(oUs`4wH@Cos~ExM-mI z0KoUmP~&n=cOKE~DC>kNNl8f}a7m^k(efnch^nM_3d>E5qzKz3!6F1t^G!IZ3g`RM z%W8=p-HkS+sF+Y0A6iSCi~yM_^9jH|Z;D|^lf=ap z1J#o=^rf3pGJz=yB>>G1q-+YoAW>>g!-LHwZG|MtkGJk9fwd$dl9ak2V?OiRn|Xje zQZO=RiwvZGj@hIwDNr&1?qZ(Pgajz}Q@JoZd{9>nl^x168L4HVBb3jC@Y3H$bckI6!ww|2Z2fw^h$^X zl%D?pYJk+)N|2;LB}3o5RhIFvJt8s0imz%-orJ6i;AXV6{N+`US1VZRY&4f1X=qfC zW9wCWkp(~#GsRpwkqTn@OBe||XPT(qAL>Gr1F^3|2N+m-kBI_6RG@NZXdsk_3S$H2 zi(jG1B+oga?h+8a!6bw4R@s2F+;WC?B!GKhP>$mf5OYO2$xw;^07_xhr9;(&{{U)p zEGn;U+8B(0e)Q@L8JVVc4cYC*IF(Eh`&05lt-(akrxEp}l>#&05ngRYBX2nVYcdFh zMI_KE!-OzcO3Y_Cnl+UvV0|WncnO#T=8Lvg;Q$;!o+?dMu8!`CBeZk#L%1?TPhcpL zp)im*rX2(x1uSx$;bAnR=;9Ck=?$!fMp95TFbRrr?T6HqxgWP*Y&! z#%ZU*PGrv&izfjEBQheC>Hh$!GgXK!D%c=^qizXFF`sPlLnzKjGyGAvND^_up-N|f zMOkC8smRhDgozyY;|7Ur`GAbj#y!5Y`%Wb)7_M+G3Rrs-wE>vP`NwKP!N>+F; zG5++~h?DI>keEdzAe4}k1bt|h)KYf?Gea&U5Ia)aR@8tLW^0aAubRcg7F@sc34my?8 zG;PY#tVAo1ty?u+SxhwBtt2Rkl>O_%>R@zp7TWeYCpGL-+In5SSLMTCBw;J|{wm{T zZp&I?+gcLqh)&S3l1YK@+Nio8S=s5$A%BuCtevm~*Ft_D`kL0qUbuPY*m}zCvXat} z6jG?KH`d=So(t`=D!E;{Q=MJuQsTqG4Jjs-`opQ>@R!VTPuR`PPTFdag_;Ki85PBqa zCZ(!smKV+~VLn5Epa6Z3&28(?!e!G?bPo_v>Oh2|^41LfMSOF_+TM*mx$#Lsz|pba z?z8x-_oV^{?u$Iyd4kpmh|XyMB4OZ`ZW2|%+5BS$jYL<#`{{X5Xl`MT_72|as z3#V$c6NUc(eX;#ef3tMc{{Vph0KkWSM=P|8cZ>;26fpt}ie+v%qbpIz#8)F|J}q^Z zPY|0PsklpNkLbFoAF{Js4@3M+>YkRh{+_bEkJR%D+OOM+%%8(rnDG&5@k^J%bt)14r1EclEo~vC&1s4hb0NQyYDK*cUw}2iY*xxyCVWqWyZVaLHtMvkV z{MPf)ylC+ATPZ^IH}t2K$}U?WBmV%htAiJseZxt5$6B#_M-R_|8z?pd7tNOT+vDr$sLIMRjTNz zh8Ez-2{l#f-i^AxyiZZ|%gMIZS?|JLPyH&aY29+htz!0@tTr_5WrXc=-QP~{l+PoY z@y>)#FPO!qb3}dWzt^oHT@R~Y6#%a#ayY~q@<9NomO*TCy+?`&UtP#hV(X`r1(hgvn3G{1wUHiLmXiwRvcO2FD15 znF9v3{1*$f`V#kln5;gk{{T8*&f#*krLE21SoFr5c=8&uS5fK4;bt}lk#Ln6A3xrXfH*Dkia6e4yckC_MUUn9!ex_J%UvK&g@8vzn$b$tT-87#lk z_pYhMEHI+eDpcXJqGL6uc^)4ka>LCE~aPwR0EaCsH=uI$BDGakXdbQu? zuaw%5L6eHLbaM%5MPL&H7^*RI&%Rouk5qj9Yh!eaWhp69J8(jeVHvO05VSHTwN=!T z_Y@~q-6W|EAe4lwbdTC7{RK(f+EO`CKVoVVs|ft;10#4aGv2Jd4{WC%3vdFI0Rx(N zt+`dUhP7M>Hug|5N=_%a9q2t9YNbmaqs}OuZQ$D}Z6qaqkKUWGLR)DoB#BAPQi-#b z4FER?y+Y($v_e!B5(FH@3t*D(n733m!H(a08TS^ugtUcBsz97YKdW3FKTjk#>Iozd zw-l~;QgAYvE~3@NJlG;QpY2dLSEBCjWDrPzFQ+XgkpY2rz?k90gOKNTfxUnS4x$VtEygf1%KEn~kHa*N7sdIx( zD*pgbUM!(W-v9^^TKepdH9($w#aw!o_R^9J$(R*Fed47koX>Gr^zH7dJ=wCJw)HMx z^HUmgK}$U1qqOvSh~jZmmJKKZ1dpyOrpI-50YcQHK_wBKPij(A1A=3{WhmN_n34Yg zF-k!@GbTk)d0KFbMB4zU0GU7ORvjg!DZrH=f~*r217wI%6El(RR_zsnrxU?}$l|C> zXe~BfD_)OmQ|k~%YPo5Q?g6N-S*Z9#-=_JS(mr!u5MV8F-7HJ)g?g6A7kHa5VJ z20`x?J!ftX&4%iCf&`J`86JgDarDxI+$=9_nn z&N1;uEhC?Kq1|t-(7-H6Z&N2%mg=0YW;G zauRtXA}YfTn*}N3*;ln|Whjt|3J2bxuMxV{VZrMJLHPEoZQEmljGWK0_Nv~f-qkD9 z&Uwcbp#$?uyR(9|k5;z>&4WJE^HiI{lj;H#F%yc|y-#i&X;P9@2L)498-xJbli!@0 z^m;-z7_f<%COV8CV|XB#VI6aCbB^WNC0=Nhy>snuDoC=BMIAA0vELZ z0D3jyDBZSVqf?(z6PV5@=H1+aAfDV(WUzQnjn*ipQnC*mMrfwi6m#3X2){{{4orQi zOuA5^xK3zGY+)N5T2;rS^>bx*l1z!>ed}u~<-6;2tto;=VD_yQX!&Wxu3{k8*XZp- z^VY~=MLUy$C$@juyw6zEP~JIStE6gku&cLE>FQH*mWd~f;*oCDk2U9@mDrfG_?7P&^*!O3Z3HZ)!wVs zD!jW|3*>sX=6>}+WS=zoN7W`L=~nKvYf=9I6$rn#S{_1D6^Qx@sa*$7{aDHaG87NRr1WrY0AHkYSeid6K5w=#SjtMo; z2o5L-`eMH-_{G5WiT?oRKdP^+Kh69+qlcZeg8Zyphmp7(; zpw`PyFbw@`B|Tvx2=r}+ZX89P@s1J>OiqxBu4@2+k3UND(u^cYwm zaW!EHC{(C_+M3jHWa$9RVtwnyXl8R~^sB_3z=hA=CiRu|pNHCqPiq=A#k!Enkc)tV zQs>{^xqtB0ess?nZPeLOO~Qgm10Q@NOJ-42|)KpTib~h1_a!9UB{Au+2T6a=vPqKoP zJ+Z`(s1qN0>>maijRxWQpE2L;1#>UsRnO1rD`n6UT487;2$9;ouTRp)2S$f(JFh1! zrcS9K`P#Hj)Mc^Y>*&>LwU;k|r>HtLDez?P^z6Je9bz3RJAC=ZgA4 ztE?j3(zOWNkZa~o;?GnUeOB(mm24^nN#Jvj=CynS7XGRn2fFm#EN#=sO6JQ)5ayr< zGsF(nv$SQQn?T?PAVK)8W2d+0UT#EzyAUEXTO!ADbjSuaCNtd4ewr=;pe)Iba-p?{ z1DEr-5TyYGRp+GGQ)~sGhzSJ2?Nl{emu`{*urni`Yhv{C1-o#O7yy0fNuiRfJJ~;| zwr=mx+R&nuCPAL`YySY#N*YKIgqS0}G{h?DPKAf%0msE%dVa-9 zz)Zm7?^V4b+&FzH1aNy+z|gE)0R{=d`&MqEOFKs@@braa(e0oo(ojSLjMckNwcK(y z&)T7Mn?0gZ39D_38wyksOo*z{jM@WXNLsX{fKr*qwMnwV)IljZ_@?a|0CAIu`_!XI zKu^zMR+T$a5eJ9{khkwc48D42?G?pva&h&pPH8taDajkkA&~^ zfjm&|1t^e|f!pgwtpJk%06u%uOGtx(NXAojR$i-Lk%3vr(;6j9-=9*RrDH26K=-VI+oc$?+sT>?+&=%(?x1`CEPCHEw z{3zr1q7}ID-|a)JK+bEcvJaXWVDS?@yHhGcxjl!q6ttyE$$|4ixa5sNq96cB;%13l1BCwoG&6vio=p$}&>j;GfI^8gK{|w)+W{x{qE}y?KG6LL05OO%Jv#nc&A$uE>9jjPtOt{U_E5RlV*PzkK zVP@*v+$y!gHab%TZBBK$r)&#XN1a6t9TXF{I;PHx#T2NO!eW=Da7y=?9Xyl_sE+ATIE#MSEPAC^r zcShcE%}Fh|01!X52XKfvQOM)916@h7GYA4qkrPND^O_+@$;dg1Y02Py4O(NYDo$$h zOhg_964KJFD2f>nlM^PMNl416ax^B!X*{&Zjj|0PMO}aqPNiv35#EsCgU>Xe;xL?B zc}PT`Njc_(|T2{H);{?#Os6tIw&a)J~-J5woeEOU|eqb?8%QhSOA za7xVg9fbo$jH7wlQEV)wLwBlUo+|Cq8lYwLq>@C$41KDM%7H&l^);j17A_L0BWdg^ zhPELjWEG*)<}t_|7ftkLrE6~EF5Dqy4!|J>x?8~A4@%edx14DWEHK3ETvt4JQPEn@ zS7?ntrnZ;VHlT_1Ptv;UMew56N9i_ots$p$eSL-`xZ21LDInmdgI@~qKT?7h9WZq` zmG5HpH+Ay4m+=Xv+c(y_qsWB$PLvRnfIzJ*7%Ft9dI409D{J_HcdBc5xAz*V!C;MRZnE4KwQ5~T_I*Fd29MAtZe z3$=@Pyf_vJ3kqSyrBmF=&2%De1cRTrugu;vYuVN2vHoJK>ljRj?nk9lj(gIHJOTVo z2AibL1X8~>oDMQf*OszXBN;_O_7h1VDLbJ3X@Pi8Y4@y~jorSHU3Z1s9G;%p6_Bz& z%zt_uJ?{hSSp3A~CXV*^U9hbKu8@wU)X;@M7YhTl3JtyCCwQLlJ-z6yal}2ZU%Z5% zwztVbhxxu~l&M=I${-SQ2k~FfXN<2d%b{vxqZFpK_M9jrC;>Aa>uMwnt~sq!(xuPw z)(Js83Hi-!WM|c!*TcMKKl$=kvCx0^?Mev>oP5xlmgHDIqLjc%KT0*SRAd4v8iQVS zgXn>j5Pp^8G*#whTMnWYnDPDOqryAD=>;i5!Hi1_FVeQY)4`3F(G)4P7^HZVTLIM|r^&_HKg4yF^;<3RI=SOAG67g$y>1 zh|}&62>i=_Z?S?*e-+Drj0;4))y~?P1M-2wJ?FpouC?eZRN3@yjclG9vS?@j0Ie0t zpN-qU%Jtro(@F_j+B*Ix`iifjYvN{`r^eQd3SK8mA(LL`dy=@rrS#GN0Lm7dVD-x_ zG^^yHZZCv`UHRZnn{Cq_M}O1pUfMbxw@uO&ZbsDtqmvw0&*h|9brqhisYtg&;cmde z0=h54KOOum=r0fvf2?coBF^_uOF*FtT3b*g%Da!+zHQ?@G1qi(*jc&la6do6dNxG) zoaot`99MPS7y@J;YDrr5#Eksbqq6*1eje}FwVx3!kWU3{xS#(3CagMtjvfIu?% z#f!Bb&9=YxuZc~i)-)Emg};~Tsh*dtVYfo>`buAkn$tQ@PTkxo&5KJ)+Z^tUSIR#d zdWGFbs4hyxD}GGii9M^o{CM#fr>=CT*k@4*!NHLxzH9iOel9ha9YGLQOwVbrrGE~3 zN0TR-@V2)7mr3QE6Uv3rP@=Ce36*<5`&H$el?w#6q0c?)pP+)K!l2_L+N@WPZD1s0 z9D!eGb%RS3`ngW&O|IhP?%H8SGb5V6X~|W!p5-Y!y8-p8Z%ed>(JEHrqGEmKYVC6B zQErf?&?EtYh?*Gz;3YbVOVgCKmmNw7f}{1N+$)rkBN^{AO|X2H0Bk@r`&J8~z@n%G z2+5^jVM72JKx((2l(b#}CjkBGyvqu4mo7>~6Yn0cYAdU6QW;IM6$)^KN4(OHm20D* zI^@ZOfHEqVh&GNlPB5-O?rx@JfQ6$fL(2$WDL;yNY z6@j!ABm;;X)=*(b0E3)SE}#Llr}X^L$@H!QX0ypQw_*SyTS-ve&vGh8)wmL1N3o$9 z2uOlJC$}{-r?a@E5sA#2sVn`J=$pA%bSq$?2mp!q?^_o`wNI3d$P>LlR}l3OR|W-$mDxfqQcCSB|ws|Y5poVOS3ytN#smTT5N50 zC~bnCJ*eW2f~@ClS+})-2uv7*QVF&tu&4q)Y3A+BWjs^5d&wOSmMJ*~>0V*TpMLOb=*(p>{zZAiEZpVCo6r;j1VR(;G zQQ%@JqaiWKCY^D{$e9HDed(>qjBpNVWG1xMP|nB)X@T)WteDSl_x}L368sIyoE|2E zTEU1jJ?g&FO{TQpDGsW50#CjuX9A}ZQc`(8H1f)G^UTo8UgNbYj@b64xEn`cA=i^U z6M`sJexjUaiE$BvVlzX!nD3F^q0OL-I~0S}78%-*W^uBZZV?2>0zmII+W}CUaDpIX zA8Hv$5g&1QJgZ+M^tAW+n)!Hiwvu^Blzm zbkra3MlRK7i^>VZ>D*++F|^3X{1jqfPE*64{`Kb}KnR+`Ntpzgr5vYl1K9m(Zvd3hmZn=))f|uo z5xh*n{itolB+uMY2-;ITllxJ)3Q*2bW7d&52AME$XB^g8aFY@7@7j{J5UIeW3@ZYN zOfE-kcA6^9W?=UCrqlw)*qQdFu#Jl3kL?vC`e_Ix8wl4`fdXT_2I&fu$pR?EfKvzS zOuCuGK%Qoj1t!~^GJsH$agp;B(&T*6jy8?hEbzZB=m1A=IRdfs$j2bt(}* zwKlZRI4Ab6B_IxcqMSe}0G5vg%txCq`VMSmKzDM zcE|<+9mP7+gAnsp=|JA2j}PzR1E4nmOf9HtvmU2oNr1joGw^AM>{euAF1StuD8 z07{)+m*tWx7S+L?x6kctG4QSYH1r}{vpqVx;@T^f6zMJ_)@o_R@TezefHMw(?1yfKXf9r3;g*6unoWF{tay*4>$MJix=&H$??3h^ zcDGF#+UU!x=DEqA#wSG=3orCXRe}VW)0a*k#y3C#xBmbmb#l81(_AB(=&#D@N>SgY z+L`xg8hA6Mp)fS7MEx2SjsDQ+Xa4~4kNso*#G|j#-e5oV70!)*FS-nlvjd@s;7=26`8*K_2>3kzE)QVKQ{vSpNX{La?v!{@Puv{In_#yP;SA0B(Qk{{Z?R zI_()h{ki`Dtgdx{{Refx)Xh`Z9dd{ z!$K?DtiR2t+7s{PCWq~v5B~u5&;3LG#UE_ZpZ@>>{{XD58KHQ8)ZKHdYVCBJb}uuh zKeKc1>?OsLxSoOabdRwflj-8+>6^Zx*y(_AcFq(r2^SHTtVUmvmvx{+iKynTP5Uf-dY%ciM?dn-k`{{W_+TVd9e zgvY2vReMC%OQ-UBf=d^T#^jNOe2Skzk~a_g*NB2Wroy)~3mmzF@f_{Lx^4GLB_#Qv zE@KhxTI0YTiMfBO(3aHUZKWkE1mbsb{MPRLOFyJoeq6LduWm-tlO3o}!ezC+ zB~Q6{H?A@vTvyn-NpINWWPFkpDP?hUobCX%-CA9`ZFKv4bchWgBoBZqhrb@TNw@Jc zruUdf_)7PmU|m&rQXnJ`fm{vv`?q^i@jFGcw<-!okLr#fx~lp|SsQe1ZC?wzlt4cD*{!M6Tg_ z9lCBxRCj>}cAS4T^Ixo$?T zf6Okv6}Dk9$7+ez^#O0|2>_r{22K#(6=PX_>%D2F0!qkHN}zF$ezhsA+?6SdTYo^5 ziH_T9xujnHZ&-fe$vY>Cond0~{{RTx5`D8zccHdaf=LLCV(2w$gdhwEs?Cdm%hhCv z{ZKwCOQ>H`5w%Lxn2kVJ7$)i|}ZnWJdmVK;V^q$ng3qD0UwZBwwMoKgCM(v*-f zJ?I;BsY?ou@t^#sCVGAEB=R&5QnNeR7jYo6Lcm- zVsSJUoEoJ=piCH(O)dCYP*nZCXa(KE$Ob!(^G*I`O8^oHHQUG)YBuFbo0OmxsEIt& zK6zS-l1vkkH5}{ZMIfFrPBiLLl0v?K)CYD&vVxdur~9P_?dm;}=AFH)4` zfd?6=TkTDhwoc**$)&l3aHo4w%DRtKe>6SK`edFAMn07U{<_k44d0{_$clu$*A!Gr z6bF2m?L+08xA6Tm_ z(Teph-Fz#R*HWQp{{VEEkZ4tF2w9NlJZ3Q!Q5t@!aq2^EN$oVHX?zLpCCu@OcxaSoGeW?YFxrmH?Dp}1DYeqtdIhgNJuV^lVB200Lvd=6L zl~P7Liz>N!w30z4MMAm?RklyID#fT;EtM21M186P{k4Y`#xYuP7S#oZsIX}vmlhSU zVsV;ArI(k`SRY z?T*yzh}<^_Bn~EqDg+4q0KHB zQF~O92?l2r)8r?Sed>a?_^NRmCN=8iy~JJ9Jf z1OuMNp4|iM?L#Gm$jGGf(v#SlXCZK`58|9@V8Am5y!&J*D=;Z7Ch0h~#e_ww_=r4l zL^zP4xQL*w)DmMKy%8Xc=7H?Zr$+2iNmwAne-)O~o!G`JDnVLz4%}8z08|``3PWtG zw?XP(lGSb8^L7NNNfq?dz-?IEFcF%X&{hCgBdLLB~=eM=@M! zqcG#WU8Owdrf$#|u+_`Nj}-coskD)#>UX8)T3J&_IE+A=sdOF6oY%DEyb`#%1z|_D z^EKo;PfveM>F&oM{)<333T53dq}me`qgbF4cDI60YLpB+9e|;FYTf5_OEsflL2O5@ zClOL*wIpFkTpX0F7_WkBbn-T564T1VnqTG+4|FnEa2)m!Db%)mfICy*gW4mtc!?4S zkBX^4nn*7vlrajB2YSg#QhR;r@Dn|ZR!T<$6~VMQQ@snY`^@*Hc_j9yibp*Cs~=cD zdVmLY+luC`OKVTKkjYe&03V;45e~0xsVYe_Gl-%u9P=J{wJHHej%Y=tVHhBs46Fkl z_51c4F^gC;59Sqd@YdV>M_*GezDE6_BazQFv2XO7y*BAhIGyQ}3y2>|(%Lw_Lf3Po zJF@MeDJfRdTNlGW9kfoOS?KQ(8#X$dQqo^>JABT=HRQUFhx8sGFNw!&qk^|0)=#93 zuL9ZK7pvF{(3cRh+sHD7q~?mzwTD?+Z8b@efUq!4PxU8Cy{80S>8^{LRg7)UJ?gIL zMZpaxIgh=3!&%VvT^fJ0>YI+ov0Kn;q1QufKj^d<;x|uPx`A4)$UaLgDM*}&Jer^U z1-gxH?RQCo{{X0YYCl4%seUXqGpBUAEm(1DdDR3X{-~or1bW7=pjlh=?@sA1Txzd4 zwFNKqr6kIUuc!1V9Ak@PYyvo0I-)j7nj}zPLoc-(EiTc^+xvtt!$~Sq)}R0YSIx3IJpK}-EkLX=7VYrSncaof~2b=5D6`;;dwZH7>O6W{7<=g;GL zI$ej0&s%7Wp_YHc8}r&ib|EeW9D($&Z`WTZmfJKvyRR$K*ug1pC*QKuT_M$O>K$>R zT6rKM=KLW+WAzNzX1U^_xbD*4ubZ%pM5$t`zX$^50)*Ppz=xTfPne zeuloK_-^wTS{1YH7)fLTK0!6}uN%Fr=)t|oUWKzeNbfO&g^vz;^3$z!uj-`R>Q>&1 zt7il$EBE?TuTxri+H1;6M5R0q^-t^0jlI$}B=zS)c=!4L0JU=^npOFy9NPdK8Tqf#UI>A)^ya(W zTI%Gv;1zV~+m)%%mcfw(#|ErVq&$)4C>T6{rB`}gX;Z|h0Lh$V9@TTPv==T7;{eyH zkd4bEV=h)b7SX#+A^-tpF$t)4(uG|uWnhA59gR!fT%y{|NoW8d)n?Y=a-yNk=4nnK zdXzTq=}k3orioEm_8qFT)i>!&4*HJZBuS~T@0o6*ktHC`f106nBirsnMbnc4J5;ce z?h!i~AvL2V=D~R>+vXTKjB{391qw@s#eaNAW?c;+5SC zsYU9Zv$jMD0)w;#D&jHiipHyUgs6!IOl1E6G{wE*WO|9Y-;z%b1bH!V98hbw95DF7sek_Z*BG_(aI z1gaol*1YN0(0sJWh^>L7y|gC?JpTZgW9?J}4;G=$vq4#H)>42bKr=_Q`6Kw^qEPZd z8z7D`#Xc?*24J4Vb{^H#1=8l4!jN6!)4B=v!0k+aX=*Ct*f z&IWPC4qL*o+U}oe_X@pB{%DjqK__%hW}}OV1V9JxOH=R%sziU)Lg43Ql*$E2xbPxD z5-00kOVXIc$1_pseg@GT9L$=^u1sMu-`a)5prOK$5BGp#d9NYG0q{@pQKj`5l#Y3& zHtK``qDReeBxMs?rUSsHCnUvTP7so%!1jaMXcW7*IT6~LcJ)eJ0&+84U3{(#B%?n# z6DNFq=sT@VLn$VB!J*x8Qv`qj??a#J5;sgAY7bM9wXJE&ExYBokW>hs)aiXIOhJ+D zKqV20CvU|#hdi^9Ble-P6gsa9&b*-{PAFt4M9DHwzA-fF-fz^U0CDL9v7vu7gpB9r zcs1SfhR8;42-rf$c>s@LOY_2k3Nt?uQ7&qTNGZqE8UpiPZKV2F9|ZhSHv1rTo>c4C z0VIMz1H9BV{-TtP#nJI5s~5do%WGEmV0((FYaMVFvY$B5Y}1U*~mb|`?NW=|Ddy12c$m~ff<8nn$BBHU0p`+Hip-gTiH ziCh3Z>I&zr9=I^t7O$Sw3eK5(a=2djJ^LD+)B0gcfTZ(-+ML*-izRbJl4FG(`HRg# zK&`WqL6e?pM#raKxnAc~ql|yOT6DgcZ6;Ka+C8e@rs!-ZZ=z%3l_skG1kWr1oT?KY z5?yQp(v>Imew_T&-ks46vVW+-nBs9)_B7NZ8vqC6;*D<6xDYt`z^Zae_jg1Is#P{R zU4*vw8p@_z=}2x+qz__wsC(N~pcF*= zRl8CN315~0p4`=6P#{e6F%@J($r@=c%~3!M?W<4WP!jZij##bHW!ZNB!TZu2}-f@GtATCWP&1l z(@vzMk|#V**0^w?z~d>@6Sp!xY3pSfDI~|w6gm~|uEP}S6}0_LB(Yd&x=uQPteM3! zAPlM_G(v>8GA4#4GwOlwn&#MC@QSutLSu2j;)(M&Ag4cC4U&*E5=JP7)wocW*+$n; zOgsW`WSVC%LWL0cP$c_fiXMIY)U+UfDT9S(f8nJmL0+NB#CESN0!f;}RUh}O0_j&Y z3U45c#A2OE#A2}GN4M-N$y6AF^sePV$0^p&aUu`WpH}531fQv)!h~l6okN(6A8K2N zaGt|KV`_(`BLI)DG(%FPO0gVLN>i|aME?Lameo8fi4-o#M$tt+2`M0weW|n{{M5xR_9^o~;XIfz73()8yMFTIuehZ%lVgFFfkY$!RJ8i1k%-LU&Nq?^(0b!hbO9 zfhgRl?@~y(wAA!_SC+STxR42qaY1zQ{{X{vc5fRab5013B7LjoG$Yf<0QC=b>F{3C z7ew0Vo;vj9lTGS6Z&0^uwoq*x^BV#=F)!U1A30t#5r)%!le7nZ0`-a zh0R~1bnDh#3*N#BC%KBYq2)Ot#+p$*$^_TIde2#cV)!J82YiKPcB`mcT?^y+d|%Rv z$tfmKqD3qmWP|ps6sjcNb$B+Ot=f8MbJ-ket+k%QWkwtI>(7`iKgT)n8=7VcaKNr@^dN%^6Jh;$`RpeSd9 zIi>1J*z&h5{-eeuO*3qSmLRyL?ZBAF#eVsU{Gn?OPgI7Lo1tv2Zf};rQCmwS5C&3W zqdM!L*Kw(`^GR4qIDG@u+5Z6JQ=S~Qgx)R0q+(Cb1XcO#M6Cd+Acz=%Yvg@rsms&) ztDMrkmWn3JrU0rhM);%D{v55n7pnsGJs_Qp+@DcM`K_UKYozrxhyGyci^kTHjoT8w z{=`*7Sm}l}7FOGACKi}mYCfOlwSKR4t9V=-S5N9sAiF9y%2bK?AA0p#KE0&tka-%$ z-|7}#qeUi>=3P0X`6>sG;WwJ|O4Ugzvs5Lrd(CZ6z_(NMt>0GP+a)P(^>*rMl1Cu^W!F?lPYF#E;2ytyqS-m9*xs#+#@zE+c`7o34lB}hc15D6 zf0Qayhw7N-yyS)UH=cXf&Ckd37`5@ul&8|WtqGS^J>hCk`U>0~G5Fut#)h3YR_JE# zwU!VO`LtbaVeEdQh?)D>EB+@uPQURx#1quo#hVt6Tj}VuLrlp^04h{T`7>Iba(J~6 zv@rKsy)#cFGm`Q0R1XcnxbXu)Xs8DN05}4(7}{&V79_uc)3EpR-HO0I3jQ!)CYw}X;|leipKx$$?Y8qj)9^5M&W%u05I9E{h+ zG}dQiYy_Xh7fF@z&NlFQ3*~Q*omRf0*I(2fZWOf?Ein+Z)~V8fQdFXndsWlMi{W|I z7eR}3u$8*Cd0^lIul_Ys(vYpG2L)L7#eSjaaebda&rM)qH>jP{9N}3s6s-vg2_Taa zIjx7Lwn7oLGb1PMRZR}uZEO_5F($SKkib$JN`UsO(vS_6o?A*kUWRQ-3<)v!s@fEk z5E3Mrk-MB!?^`-TkjPjPN&AYf+61lShX^JqKoX6hR#cm>MVjFtEG7nV&1UfoCK}6KZA@P`%(R93p#ogxPVehhsPi3K`VV=6iqvLR2Q8>-Bg){ zAMeE}=hGo5Q6NB?9^Y%ks2P=HkrbsQB&Yx}kFc^n*sw{Q!D?I#NUYUMcWMa|r;) z1XVvzwOjWI2uUZ3wl|_(7B_ih2*n(woH;j78_&X`Z*SDMOps*u98+!GM++I_Ijr7k z&LL-VRnBIBa?$DZgO2|I6uqrD3BU9|qMw@FG?=z|goj8`() z-(0p6wZZ}K!K*EXt#nFM9wPuuo+~;{7#Brfj$tNOOjz|@qp5@{6U5C+TWfajBy4w_ zMRSgw)ECWumja~sJVjXa?y9>A8?HzOF*vFcz~*qSHzSq3QK%r~D1P+wckQeZxMSY6 zhMCoCbfvdl0}u}tG|s#d0P{hR1l4nWliKde@@|n52>VdWzy793#}QTgZDcq zqLXrk08&PMjVp1wDeWqGtH4apH1T*Q2_TPyP)%GY7!!&$rwWI1f6}-+JSi=#sb{h{{1e+*D8J0R2K_K_4{3mj)z2IUG@fDMeb8a{MT5Dk4Nwb=~m- z61{-NMF!>I2Wr>x9jYq-08jxWkVpb>W|sF}Ekj#rH`=ULu%HrFS0ZkRCvT0GcxqJ(RTNTb#KnlRotmd3q3~L68O} ztLy5N6R|D=2c&HnpszKp(o%4ElN6B=-H@KZJC!u;{2@U~DpBr4P!HY(0yi1tfuFTP zFIU>BQi1l05n8ZtnO~^)IHrA{941igq;Bq8+a!sO)mhZtNdU+s^ZZeFH&Om>4`WdG zHv!TDlq7bi!x0D`&vg^1pg7uwNspycZ_%~Iryvton}P@l9{KjFp0dhN<~xJ?*3Oje z!o=zkk}Xyi0CR{Lkw48TvI6~F8uj3X@sZ3@caQ;1zdUY#6 zKKZ7ULP*#qJ?knmeX}%l3Qdq`CrQriidjllj7g65k4Z!rBvue$Z89e@KxsXqg_PPv z6VJ6fJ;>scOcF>0W9wN82NCy*;s6Q(BZO0AINvY^C}%(!Jn>3xaHyOdSD#NYIf@o? zjF%B*Ws*q)+v15xN_jlufo*CF5yct|q!=Q2p?heeW3ZIr1v9#YR7p@i!VfsB6sA||8Ie{E058r$f=L6PrBv3Bq^vmC94~UO4n?nl?lpnU{>%!DObE2+rLF)HOX3@|jke&goZ6pF| zTN}Hq=7RSIg{b<&@e8eV_PVZ~>Hh!^U)F9CeMTsUj39x7=9bc5DhoiRN z3{bc5w1B#_06yw{X#FesUu)Ku_L`^c4QB<#6ok%`IGY(WE6Yq=U2nARI-{H+u}#q{ zuF|_psn5~cZ`emim)hy_Y5M0uQ}BcOxHU?;ecS%Kzj_{K3!vsc&*h^xoS~M=G=Z=> zOgxf|g(kiZ^<$&ksPxj-YzqN+!=|{w*mObazx3ltqW*P-gk(fxkY9Qooj_+;^yT z-lb4B6S8|I3;ZmM`@EvOw@emf#)T~E!8B7E8Orq?R}6oil%42BV?93;O`o0}oi05; zXvvZi=QS4TJbV)JQzdX$-texiag~vLSK9FAT@E$A-G-ZYxTg>H1cIQx^j?$Spk8`^ zcMC5z1_WpL-yiE&Bgi2qX-b-eu-a+)eNFRsK}IvTb3ZhPsq)*O^(;I(1DoG`(Qrkw zS{k0*O=%6erMJ!ChV{d`-_rdS+e7jCO>d}^&+&ulX0J)*dbgJJnv?5C)0*xt%`1N; zX#UF#aTc|s@Gpj~gh=h&*KRu{;0=VbhfO_l5f;h~IsZ5xEfQ8aBP~6$gtsQe=XoxC z#&f>jRDXHE{GcRKY26t8OS9KuYJvx{Qm1|YmPJ#GrvJqP*d#U59rjN|LA*A^?7*9{ z-7e;&Zu;2WzXCGGF(#N)Y53}43yx13&84R8zG{05lN`$D>)~7H|LeQV{dJ3x1{N=p zxH)~!RH9YxE-Nr);FbUaGSIOzA*7CZ*79yp`9fAJ{Bg#A$#NTJuzoF^Kg@xm!?0jv_@T@qbkA{q_{qute5fJM&oropL zoj)yY;w@-(u!I>MTTId4{RfLnRJL_r?b2_$97BEF3=F!I|GDPQk;Pu%mRkeMo+1HC z=QT*yVrNr1F*)GE1h=TZv{j0e;z~*!sHF52B1wgZg*G>^yUZT z$Kr$RB8djkg<=}hdQc7ABNlSAH}6mypFSale|lER;-*~`Q8&JRy2 z>uHhM4Q?QcrG(Min#f>MuKJ1$l;Jf`C4WGlfd9o`qYpI4P>6Z^rR5jBzCn+2v zjEMxz=pn6Hq%XZ&$u!j^#OS6xH zK)EFBr0|WJc)&9#$?PLmzW?kX9RpvdT^X-`nQ*O@&?k*6k;vjshk_=*5dUd=P0G|> zJgq7hGb`ojH8dvf&;*;r$O=~nqP37P1e*x9sL2vZ1}k8^uE9n6vhm2&&8B4S$1&90 zLqGkNB{&UoK*-NiQZjbyG>B*hiG!vz-s2jyHM;gKwSXH~q{CQaYK2(!Ya zZHsf;EDi}i%Ju1+3xi~Oftmz1Gcl_PWB z8z}(zi|#VXkpQu?*yywZhrA#g`!-Q035IkZvl(=%MqM37Pecy(xXss;Mi`LTyd;{6 ztk{3FS63ep>ZXyEu4iY52vQGUMM<+l*E)%%CtuTN6!ZYJ|7&<6Str*&-T+>XrawFo z#|YQyl*Kz`3DxEBc!)8Q2nNJ2&w7ZvQQvz;d zvSzK^-X!b=Faei6o2HuL_DYX&F%iyh6gDrp{~w^}u6Fd~k0Lj$f57Q#b`UerfhnX6 z09nV1ealiE;wrwpE#Bm|V|s+%nR{$4;q0`TRt?+tM^cbPa0<?V+?q zdW&!QW*oWg1$BQCztQgK+6a`=tv)UI55WB38;ryPL2$J%a2It5d@bSf?19#No!lFq za6#PlLUni@zA2_tpsTwVc(|$S_9gUpi6jCTFL10+LP0N)?2LE9o2x$OZcG&^*A#_B z*XC-%?K{dfA*pq@{O77&se!+JmSa2xO4FaJ<4v+!rKo243YgjUTwV04ibyatl9=#5 zA%^(Umea?Y-ZYwjy&Rld!5LYy$JD`oA;ZoPGb+;@Nh^YNhr%+HAk`XWBB|&z249Vn zRsemJ8oe7ZrsxGK(z{B@#29B6q=qB|o1{f4th334ZISjv8Qh~fn;A5mr2o0w`2!c3 zw?^G4#xO+Me)6XdOtwXS@Ey#=N1d0_r?;$&17T+s?DrD})qM0_Gn4ZZ(y;uc`)tn* z%LU2=zM~bYiLAAKw5x%bz=BJM#8y>|Dx-w${Tl|ZrI~@<=@3o!FBL#W4c8178m#?v zg)Sr5l+R zQK*igy%y)aw^3Y`)Ef>O%>``A14`whT4zbqH_CxX($XAK$_q%*aErxLf5j#G{(T?tPfP!cdyzRc(}xeYQPbwrJq^dg~A=| z3{kge#o6}tETwy^B_Z*Nx)m()I^~)M$GqJ(96x58<957SvL{=d>i-gc#2kuQi^0oOIL($yk|wl8;`#DP`ACl zefZ*S%dd`;O4aZna_cBWlpXC7sW4@?XQg= z6LqI+*-$D$Mnz+eEq3fJ+CQ~g@-GCxxu$Zd-5qbAgSOvlts+=j_xwFH|Ngn?k*h7A z>*&eL>X267ipk$>5(x5U!6e)JJ47bLj-_per)QW$`4{>}(P_)AG*KP&hc+jtEiKzV zcPO6`i9pzv!lmEmyKdXRFvNhnLbJJNJA8aTZYd?R@-}k4mrHl{B_i~vyTS-iNl*CM zKeT35#IaFcb^Ukv_*@l{J+ApeYfwFPRB(=;x8mou$<`A!qOCm{9qgW2SnSNBfb91; zaG-g6p1zxjkkEsvqbu`;AMQgSNyfA;K+&vIU7x5OrYw#DQ8K5Nge&sRTrs`)jJCoD zNJzq{&F+a|BD>K+N%084Tw%&pBcTxBgY2OF^9=cXMlCZM%38~ly>oz%u$lI}FxGyA zJTN|mGeoALq=jb|@L{mPL+a@-?%=3y5khFUK+cT3{)a;Ri~{qeq<1udkut9#_fL@? zbJmp7M#ysZR=bR<^w`w3Qva*U)~CZl5MY}lsPBrPS5;T3`;$&@4J#-Z2S)p#V;`B6(^mn z&{Dv5VJ1%9sU56{+~;yTvlXw`)%s4Hom>6n`A`3Ui+bB+HjZuI|G9t%^nO8`PFRTE9&$wORD4W!u8$Crn7dWwQlWi@}7A zh8e%zUVb-mqIyeusrkLrf+9PSnG=$-knyO)@iW8GEkhm`DDUa53+4!ga*c+)Nhem? zJ@*TC2bB+{HsIgwl}3AjJCTNd_t$c)rUZZX*X^CE2AzZTE{x*X*RbF38{BxEdhcH! zPN@)y_rKZM=i{>GXog<=YY0H#IH)I+Kh;KXte$-D@tLf6TKSbanN&Mj5AM*!Ykj+x z4!9b;j$WU?5W;!ueO1;sWC$2b zG7>>+Of^|l@k?z@$l%q`DVy3^8jMN&E8SNEpJT)48v{x)Y6EE2jiKk@C0Rovw6xIB znGLV9kRZLss}-%hkGS=WL0-K>xjGalieu$aqBum{X}MG1Lq^WDLs69Y_9hB6cop|f z#iX}PPwO`sNXu-7rk5s$Sd^Ygasq;8zfO8$3FB5!W(0l0s=HZ$y(zH`LE&~U9PAyn z#md4OSSpQt>5l_qtS#8~+4DIwGpiRfGuZlMy-IO7ad2{(!kv8o(jhHc3lSx3({HQH zMj5>2Y6*Ro;QJcXxN3HYg^X!_qtX`n{gc;b^%c&I zP_30Cv({Xr-x-twOv?>C$9C0l63V~&TnJc$B2xO8Va@lR(A$Icow9<~-7P$$=#|Mc@h3tE)Ph*mSb*m{8Ty|1 z48e$y*PXk~+(cg&Iph+1!+jXzEQITnrN0nFm*EOHt zvsy(VDQ!D-u*K)YBL7YU-bfn3OYU066-f81U>9$LK4SFR-x|wJC%0EIvYpfcmkH0? zAJhn%A_I9whqI_YtI<2QySfh3UVMJivlNJ35toV|xiWm*T=$$Zvi$2Il&0~#PRPAR zb0d;3I&9~2MZnE9G6~Bj)fw&+cU@^H#`343@KI|^PgE4wX1%5FxhFFC&%c?{3;mjO zTe62ZEr8%=tDy0d(jRn4S`q%8gxAB}$R{q6+sHKCjkpG4wAe^*TDEO zQYbzhwGD7A3Nd9gyXBCUY*l%xCH`^TvacQG_2cFc+{vYrU}Pm8%#5MihoDEQT5$cr zU5V}so}v%EDy7{>7TWL8?8e*bH62y*>80#dbd-a5+Xe~CaxutIO-pepqL@u?!>o zB_C^d$0!SuE=rYUallee0!zFx=GD2(u$rao2{Rn4lUALyDr802o9w;z;`ZH1>g!{URSbN*~ zeRc{H&Zl4X(O(Q^ zIoc<&7apmJ+ki?R2GuU4r_r=LuLa^NF-E}(d8DSXD!|^GV_lKyXvZYPZgTJKfwOXg z{l5lNBL5>CFr%S7^Na|}5qZ?4bMEosdfkzey65W}_S+J`()&dVE*K)F*wA6hV1+x@* zs6W(<>_vsJl^Gs*%nmhR8!X}RrUGaUCaTx|#)P{u-E=cbRl`YBP^P%%L)xO$0xu`6 zwc%t&(6idNaVZa1ae&Pqva@r(^&MhxK^TB#VOODP|4CRRvAD!-rC_#Y8(8AI$VjW^ zf+ap%@YGhuWF8-K#NgwVPppPJ89wkrzuY10xQiQh)K{$Xun~lWEB!y!9Z^`db6T3$ z?i`>*>6odNYvSJ2YLJX?K?(ISzZy#A>tAo<8<PbXm z$1J}^Xv4?Y#++%^FZPc-8-6Fv4*%R2-bHnwzZgN<+PpLOjUHZMLsfLs>A-JOyKZ0W zen1>p>n)?0>h=|GI#zo&U+M>WdD&3il#f!y{~Y-7A3(SB*H(8ns+#{?!l}K4|Lh0Q z9Jd`oebUL)od2n5?)K75Ky>tr>=J$D9$w>T8Rla*uMDOM_1QC~v*tlOVZ-CAxA)SA zR9SjVQ?AUHi;OqkT)oKlZ~Ej=v%4#8jK3KAQjeRE-#wJ6B5dBLYEIJCn4zd&{^Rk+ z{71)wGFAcYmLjpea!tbHcE@s+rr&=S=YvD>pYF4loEA5wgw2rG=4em`+^PB9(4eM1 z74y~E>XZ_8ovf1ZLHjrW;?|)vhbae_3rgI^r7)?@(%ozVzzxsIZ5wcFY6QdG4*Os4+sHcf^$S#f!zE%dA4}nQ#QAZrVQ@M6UQW0c(9j~BCe+5xY z<0Yfq_c=K)LKd2}Q)a)!J!!s1f3LVZY&FbHZmt?wC6G4Fd3+ui#JR3A{2##DSF$@K z>xP9+RotC>s!u;oiM>KqQ%e$2)f8n^^&8%|R#R*5sKnIO*FMpIIXTfgq&~AxTA=*l z@8s!>3^8gXTL?TZ@AS@mQ}!QVL*aPt=$6wl|Dzqw$W-Ouz@)0tFvhE!^HT6D)swUA zM)ErSL4=?bNjLqCKe_)>$Vr8nMrtr1@BZiWx(jcyPY&Vo4Hi{@j;C)(&^-uL908S^ zs?uDJhN+tCO@6ZfC$kqJwD!u>s@$o>&`LAvKfrfZ1CxL)`{cj1_331pMd{NTJWbgb zW6<^h%!TJcbe9DU$Elvt?$XoG<;~ZR)rCG7+k9|lZ1trj7fI3M_UqJp*o(qrx~VH(hoxenx_gVHjLBQlLEu`Uj>kL&o>Cq98_)BP;8(XOxxc{lg^g=T z9lupcg3R7^ce8iG#DVFdtVYipN>b&v=AW;`RzoHAK3aV3>?cQVnZ5J+ojAMF1b6NH?E-zQwT<>KJb!hza0K7sT zoMFymxM5g9U~Tx4u|QFHWP(+tvZyvQz?0*akv1)o2!Wy^(k43Jv=t&2Mdkq=+)Z|NO?;dqY774z_jwvxZuC78Di;>Q#Z!DVFPpW^Z;I_s zys6Nx4QA_-M)K%~`!aI?E?-PxM{{XP-L!%+_GfFPu>;My~?o;Hrg8rs+mfpvPxntvjBo9^9+3(Z26W- zCl4d&lw`*^-g~x3fm@kBrc7~+b*Km8U8198ywP9$W}+$v;WOVm`&`gJ{L}3{ey%6! zJ(IHA<%iGCWU(ZLWMOeT{EuDlv)?xIku&qOs=ia7iOk9^uFY%v;4g}Ns?q$j8E_+n zPNi`2G3#5~0J#QWNhz5Kr3(jFM6cKN;M$?Nv{dQHADWJF1qQIc@tN#i-J4pvobZyoW zx)@P(>P9%$W(x|)I2{!*Iv9Iv5Uvh_@$W#EApZeC^0M)uP&2C(rAir4lGDuV#TnG> zROXr|Wge8>IX#h|3*(mmbkW?H{~a>W{6nDug_s8V!%wNk=JYy6PP+F_>0W2gu06JKruEMA8-n)_wyqs=}8enW=>Ro9iFc-j3Gs{1iE7%Xq`3 zAXn)xN430Jb!&{bk;`%eQQLgxi*a++3d>pT^@9iIk!~VVIC(w9F-%!@=r7(Tp7P4j z{UE9Hst+HU0PL!ZsZ9PtCajTF7$$z>rP*mZP|)C)*sB@rKWwC0LMj&X7WNRXH!vGF zi`fEFXv!mtv^SY-ISI45aZ+5|HHF240F0QAMTc8sIT%DSpIC)9+=q9_#w2#_JW z%p1HIYA=7$R^!h(A=Gra+^hKWbqw4tO>?=`e^kMZjd=nsu(8nw96G*tBn?w_^${A@&;kX9|G9&ys|`^Af}4&7b*^Yqaez3>_5_wOw0 z#xvI`xJOJm`S1Mom!{=58xai2Hd3vi_8fDzpUiKi5(SgnQCR7h&AwS+4okQ&Zy}5y zY8lZ{kVtvmIQ8mpi#PLMcC%1xG?NIR4C4vBKW%7Ab3H)hPEJhaP>n&PFlBt5dvQS4 z7pUH5gc-oBn#0qj*5kVeD3*z2O?b;bsw8T+BcI+1l-zpauhWVk725Wvqk6(N-|N?g zh?{LMoIm!7`|B6ycV0gdVcqT>WRR1QAVnYh-RWu4Gl0Up;)zvuV2(6PD&Lq;K z7K%3UnusUgtY1TUJSq3zDgIRLqU1xlqdr-A#TJuio{O{S+1hplZ$m93`}NpWYSl_2TlXza!AhEe6y@vO%4q^3i=Ou zADU8IriP36H7#$?V~`^Ylp%mT<+HK~ko7ZkJ}fmvzk(uGTZS5CduhyQc^hEF z+P8=AGbcaT|ACdg_q%9dv`k9640o; z82P1LC`3l7k9pYnJzvU9ek|z$rl9vXT(TW{lC*y#SGOdJS8@iRJ%GKggu=5KZma}6?VVdWax?wY5tQ)0oSh3)~k*FRU3k+%6 z-W2yRXshFKqc+~mv@KmXd?uP~-xih@E!;$#&hP@ke(*)05SZKG#g@^vD%A_GpzU)i zmuuTps;8tBSG(O(obGdFVw++x){KZZV*zr>LmwmJX}0#Yca5HE2c#@Uss^rRwu$@D z%$s`B%Ftd;^?~AjI&sSl9+Aaw=09gjX&X zbrX-Tm3#{6UQMSCd+3<>bYc(=DhKQ8X-rr5k`Nt2Foc|Zb2>6SxVkiw9S1h0?-yrp z9wDh|itGkwtFEy)zO8MO9x+za$xBq|(II9I`~nI12|% zhGj*j0C^XynMCqT@wX&UQ4hlVsneSL8Z828$}J<-u9#h+{yDv2iN@t`e#IH+GMdUu z+`s31qdNgahe+)}T-};X!PgRrEeVV@K)O>45C4cC!*k}l;hBUTPPHY;gMHx*+y#89 zdF9$&#kKXz_QQR>Y;}F3Kbk+*Le5dIKb*?nt`$N}-75n%N!lpaP4dQ5P?%B$T}>V&e6! zU~-L9&z_H#)4^Xqrg0lgs0g46x1D&Vf-yIxxFW0%s=7*dbbnnmJB&3S{50D@5bLtE zlGHk+ZYf{QWclRa;EwtuT^SsI78fwxp*oJA_1~)JBwoFaE$_wnk{c^{&V>B#@2wfI z-Y%?|tdB~SzLp)E7dSoo&gF08eoA$DQ$VI;z+gt(@g^guhCRPy6|Vr!<6|s!gQ#jH zX-B{MSGrjGo+F6D(!yqE!BA&c{-=sp~JbQw(Xot1pLqS(H>^M(r4vEGsE zMg2$gPL8?nxLewPfcfI5sr54NYen8Zej_pc>L)=n&O&&qzL~W#JxpwuA~KBr6A==}jjE(bk@E3K!a;Zy;QKmjvn}roQA&04ufkBHD zqc#2L!{c~~p(Uq5|NZ5=mK{ zys%u-|HNymYBw3+9$VcYEgcIW5qY8h4xskN1`{D+QbA_awgiuyOO`s`IX`y4q471`qN8G9ZXU`mc!vYky1A`o^?*2`%ul-M>mP4yR@eE@=a?@vdK7&)Y04nHOatI>N6!h=^# z-~>tDVpb9LPlP)+-P(TbbvhmKDV2W25nRIW>Z5zT)&UabMNd# z4k2o4%}GM4mA_$qBm1r)V8=9<4~u|=~{Cf zxJgSqiaPq4-Y3)i2lSib1ofu1EMd0ioTj%MV=KrZ;;F>ij{6n2Y#F7Ska7mw?Npy* zpI3RJU`OzW|`jz^7nbbrjm!%Y)z$zZqB~qr81++e&q%624*pC zDcpDV@XY!N<=RiIR{he*W_uRZEL}Oy=qUh)Yynbwq&(dooZzA%XLXQqQQKg!ESJG% zt3bL;F6eB4AT(c$w6eFX1ViAk>27}v-uX?B$-VqqYzYXNj(%gkkWqcZL>#x!IY0c_aFu0F6 zuQCek*CVgJUmYE|DJixQZI_uL7a3|%5_O76lX@mn7g^1v8D1@?`1I`ofM3>g2`-qhM78>=u5 zfiD`3NEJ@&K26gSNm1dFKw0n8!$JF8iF991s|lhHGxpD`K~|z@Nmj^#q0Hu+JLH*J z927)H_Uu9O!2WYo{u2Dq%^-KME0yrz&e>5P7;F_OFhw3tc=mDXz7h?5d1r7y+tNu8dp6$hN+-uFq-SrVa4Z=MusZ0 zZw9y)yDO9Ac?^bLO#N^5hcIOm5DS~Uga0IMD4yn&CGm0LXeJFGhb?E#G0jQ$fc@2U zR!83B$TUj&G@hU;9KcaVsWiEnO@B4+)|8#DAUCVF1NtB zD483{R(O(T<%>7oB_PF2b@=KXf8*82-+vSoo%}`_cs441ucS5i5ZPg0cGs{2IhhNe z5iVWe)rQBjS=9!v&`L={uUdIcatuAZ3n2HvZ$~KPzIO<|nA8%bFj9oETuvs$EUd{BL$y-+vvDz5Y)VP1A6%^`-6TbkG`$uXYAlIeW?J0X zuUhAq2p;~l$K`t~1Iuok1u4EvefP>fP%E*&8SXU*tlsb0#7aVBg*8s<`WcN>k)A(X zNe46cJ1O2GyU;@&OHT$I7!X4;S97G^PQy@Iq?aF%f~9F1wI)vX5>uFA?$mwgplqau z+dw>h*FYO?KTTFH(H%x6bRzSXA~i)vLfe#_(p;->@x@%E0fYrP31?ML&mVrM>u20b zf#qYAlfOhS0uFAnoa^=!(y@p~88=n!M;VsNYE17sUJsV@27%wxo#@TeOHC zGE6&rm(Sdt13OM%dK%JUTW#H8+hBpuxod%+`QOBtH96f%PCuJ=k2CkWMy|?>$9s*Sl<0 ze1%t}uy zW3R>6Cw*-0e*GG65kTC>c+KnNAf~vl?`FK*i77Q-w2v+$8@4N5X+_d5EyTlbzfkJf zUM}mH%MwrGb>*-F2y z(2LS^+L@Dd#9G4_%fH?hH!!#R;6$mPWN^`OoS1NSX6w_N?jn$^T3ZC$iBHX|Qwq{| z!p-ldHw>!~7eB`k_4q94{sG%nHvZKu4r`ys#ZbsC{Hb4^xs%Ppo5YvKtdaGlP@bcs z;amG4-SUqmaY1-pm0f77xZ9%R58o%KpB6-(9|0Q}9xm$NYv2pW#Z`l*yH=Q?lnL$!FAJ)M%^tQ8OGKATcGu zZPO*CRZ}$MUtTTECx2XvJX6N+Q}>7<+i%^XYEJkzHi)g=;e2xOtBsXXFa|m77jOiK zPP<3bU195KY*S_QZD`;~KQ{Zg+vv{Q^a}qbssvUV+}RfPby$^;(d`WG(r@01-_sFr zN1Dcx!ve791B}lYnvXC@#p3?Nz0&V1^i09BjS|9k8Hm3_5QVdhq@wFJqM7{o@kVTM zaC_H|`?JMK>p>hUOSx-#ha5M`0F|qZ-m(^|s!q&V?4-4OPgeEwXY^<3s%ZM}hT<}G ziP>-M8XNrfBsTYs0S1?5$rb4g2h;{+N;S5mtsg9@3?f*$vu#f$r6)qFqH?#1Ku2SK z2%4srTXcT5HvQ3jKmm*@Jh?u|{-AqKPQB_Pf79LTAj8lcl@MnAvdc83cmQ~;y&Rz4 zv8w~th80MhA4l<*XB@plmxhnzXMbaa97ktO=2BZOI$*E@7@P1* z&XH=MCWQelH=nEYi{j9 zkcTp!tnx$+ij$m0Mes1i6)m_yMjElY?b|2RY~)1j%X!-sX4;IzoT=LBQdT5PJPr1) z*))+F_J_NdRJKiUes|*`MkYA%FoANcB=dv5j(iNgMA2DUZp$&mmg(7M_V-h^C>i5@ zB&lU)Xd$J0R7s+F$2}6i$+y4!Ocaij2xh$!ND3Q1Q>PvC#R6<|rkZCg#U}=0W)Ca2K8-1UW@5)H5Lan*0 zcd8`0hg?ey+NXqer^h8NMY2nGd`Ql$1||s0Vw-=S1NWSVWXUDW<}VCD9E|HzXJ<8@ zy@M;VgcbKd#rK9tE%BZyG;=eM@|tc3GRXA0>e!1d#>U3 z;8|4Am3(+m%I5a2H zh?)c|#LC7=q$>@|lYplr_9gK(60pT$s6=Yj?!w>nHY=Q?92^?NB4Wl!Lte(dLZ;L4 z5mv)Da}uI21-LLE6+vjFL$TWF!olj-_#qJ)xzj3~RZeCpfLboay(_+pCB;p$r<6{- z!x`91CMYjND>f1Mn&{v{On4C;CLHBNT7qTTO(e4BuB5?3{m@f4W4kc#zq<86s5P<9 zZmR1AK1Slg>T#U(Jcc80Dw?Pdw)o81=~KLeYm-Pun(Df$yGx%Cut8!FzgRN4G{ zV)#6#vuYuEFNwVd{VwdDJ!0GzIJgefs}5-sRU@Q7UTr*dy6mAXWT^ z%{Bp2P;Ik{@zhBJ36j#9tZ)4h@oRZ!M4~Eo^?$#$9(~x_9edwgD@wBx?fzAF+?LJ? zh??Ae(sS7=_!qYRc-O#7Kask7V#k0_LLgkqufam`^M8QS?34vP(klR6{;sihjn98U zw!Lx6k-h};bGRi5meIRXc+cOq<9WlRb@Fz-`K7)=-{AMNLU->$OR5^9shmR8#qt4h zpKQTpe8<>dg2f2`x2C@+;4kLI8)CrVwf)U6Xp;A);^JCbc|&sYZ?8C==V+q%=2MA} z-7PZ?JvZ-W38wP)bP6cMl|ou1;L{IRLoKZSsQ$Q*RQREoT=VnG(}U%UA*R1FvZ-{z4sY1*m?+w)@}Ry{p4^gW%xu+3F6Eg{bA2;EoWlyaTzy|;x@)7^ ztG^V4yXbB%nfq>$Ue{Ut%hV=P3ofJ{>-R)M%@OsP-=|@R$M@qao=-m0fHxluhB(q@ z3Y~)QsFiH*lXvk++7?aTvJqUPPOe-OwMDdNuo9qOVqsm?G8)E z;?=mN-ynL)3w)3E5cP`7!mCg6teF6;1|#SONp0$auD_!v$pBS(MImQ|7nQb_NXS>m zZIiv* z5X{-m{DkCqFH`Fc8rR>pBh#uMe(PK%`o`WMJA`sSRran*Ir9tb6Q z&o9$9CD2;DId{~<@ZQ3RhXkllmZQOcL)3yUlG>>#kr<{i;X4ljT&=O82q{F)>{rsr z_VE1oGBkYCQ!2s2XoRWgHdm|6^~ENf&!w zIZ?qH29{4>MJ12&PfGITQ2vkOKT5|SxCkDFgP)%WelL7x0F~pG0vA9^TEj>+)`jyDF0A=^&6Fb z_E#c75zSMIEjsYk&~=AeQj4sI(K0Y>GuwKL8F@yfUZ%hsSgI>$;i(2K3Qk4i-Rfci zz6Sm1FHS#*ln+gLW9^%31FNMx0BmgM#RT0f!2Sr!e*jIaVlR|tU*QdD5~h!*ep6`q@Jxk+iAO6x&;n9rgwK9}i{m6XZq-E|}x0@wboDXGz@(eeLjW#&$b3~)F3xsD0 zJIYd)U&Y|1RhHSDxRu0D0r#L;q@C$%)%|raoDKo9+k9tvyY5jx`-8eoZD>(AI2|LC z8Iww2KLl}^`Cz$q8EC&s?z#MWsM8=a-V{x?8t*Q7CNQm{CA*mVtd4a^!qRk4P8YhD zse{#P8hn(uh6OX|no<@%Ji}R43)4GpGAW2HgnOg|;=5%R5~+t^Oi91qxemkoDMujH z*J{tv(3N;rM&UAPtOU{;7^$k)XFzf@X(Ppb3fA^@zumYQ2Y=K+AHIldp*?+p72>rP zUmz*U8I2(Jq+W{URQr!~=Od`>k!M+m9wl4-n|yqOtD$qr@oa!1j|r%&@%HumQbe4@ zFw*!Oui+WnAem{`1WoekQ}UQxKO9mYs#aKt3%tIx_?Yr7Eip#SsT zMO+y=s*#**hy_{kUH!-~yHXV*vYENHtgX_MbXB7bB{H0|f8U7xmq4*xp5YO(EpnLn z%g%}NXsBvw$s3($(*~sjz}C)cV=CBB?*ki76}64h*3Mt!$PY08=QF^v13@ z6oMhJ%p|S>1^Nrh!Hg?2njf5BcW#(amOre3^qSY~UW?wKe=Y$S@Hn!1V#@q2p&u9# zf(sCB3tyT}%M~H7cYEq*eXqEYI^8_)O{KlE0BIt?KoAs(>C<)7qZi$|)X~qG(_c{z z%BCisq^bO@b;IgJ7qf%1cOBY3g{of!0w87wju`PtJQE%g6y4&_xGupAd+m2saB@*n?D4zckBlZV?Y8 z=@-LqK5j-i4N)Ajqj6%Pzre`H;MxFt#uXtGk{$$}{#QsNFg*?`C`t^LU}-T(k-S~c zJ#7DCP+@&ti{jtu1}H=Ff*v6X#E2|x8}NbJSU2`7*@{AbL%Cw)(6nLUzMdmZZv9pkko{8fE3G`*%#;O7R&4B6mX`s5 zT#jSt-EWI<^Ol%!k0fTah-w)*GHVb7ChZ(|IYeB^lWG})s$Fs8@cB<1HqxI;n*?5n zjO4E5YMwPz{bQ7_bGO)T(e7E0qW7U71sbBOH3=`Oemb%5Bw^ar#BPSsT#2A__5(I! z+Jk{|xY)aE_|&IoBHk}5#*a`o)rUlk!Bkx6ZG0jT1hnE?vEGM9aQJJw6tx(`}E8{ zR@Jk0PdecZRz|DePmYf*KmR(N4ovoEEGqf_C_m_SPh@caoU@Kq>hn?0N*+RxV{bG< zRK|VWoT_%)i7{+O>|1lA>F{kF7rEVP$=!CN&&U}s+qM<~%RJhXDqPHA;#(__b1w`1 z8T-J-qTz8W{Qp=w&uF$Ew-3jjHA8JdtSGhjh@F@bM9pf^)~u~4HCxnPMQsT&f@)$@ zlqxMHW@A(-Es9d3rTm`!&v{Q8pEHByRC$tHnR zrt0tMmv-6tU9S<30z}OUdbmCdC%YB;)FQrboNH584SACBuKCc6F?a)mTwQ+xF zL0!OHw9rPTZ>CCP!H+)o^XB0SZPmlEgNb`5A_3PJo3nE~WuMHT#$O%YG-dzhII4)mLv8|0+oZ`rx0S2$heP43L*tP_l;0ld=#RNi;z(8|G z*LGE8ZNm~``h*TcY3ET*rZoLUedwE?-#5rokm^}2Hn27F7CK8BDzKqygplDqw`BNuMXIU zr5)x)0IX!p;{6*kBkK8QVZ!I(~ zQtW#r<#T1+=Sqs6^{oY|2lkjiEdvjhH3D&N(}w{W$XKm6->zHAxW_NeyM#yeIT?0r zJ3+_Reee8e!EmE-puHlxOz9cG79;d+F8jx&C;zno$jv-`bgdm0t{2>~l*QQ}IP+2TTf z=i8(&Q};gsm(Q+;e#@g#P_HN{_K)M>aOON%ZEFWm56TBx>NJ7D2jcoSO^k9ti5D}B zGi=1b?EBR5f;&UC1H=D#fMP$<45E6g($z1MbgLU*s6K#Gh(XGwlRgVz+o2z=?qOB~ zfF2UrPZ?7cNTQJ5Hp&MwH@rn?WntsgrxR>55J|sOx-{7y$E?yI6Vdnep8AuDqKz5@ zO!zf67~wbl@i3p_>gX(Gykdx{lDo45mRD$X*4Gd1Nf{kv{-KT2&|oBw-^hR6*uqIk zf^`_tzDFJBA&T+Ky=#}P2+ABP`M?N6hU+V4-Pd%)an zM-uXm2_3c2iN_pMd~A`<$4f{{L+?5gY0q#=1TMVVN&xdaD<~zmbd$?M;{cn6e(PAx zf+lqg{l}D&e&1~x2(O+K_KO04htZ@YR|P+o)Ia4U-*~glC{8O#zY_@5dS~L}xRu97 z&8`^hqxmhnQ;OUP6qDI2O8L&#yL=a@uK%R2 z9>!-7?GqF@N#5^fz_s-82Rhp@KMJ}W;Fw`Vx zo9XdcY3?-ERQ~4AO$@H}rNR9vBt#>t@S zg{nlKxg>M)tm_`zRg^7ju}-C5G=DkWt?K}nV}F@+8!gP{kg4J~yk*a%lc_kzWdU1Q<5 zy?ynDkPaqWk6h>lYHmkHAtYc2#=%)O*KqUYksNTECy(pLvDI(>-?vJBd~odq?ZX^d zSpBAa!4*WQ#%%UDONK5VHgZfF{H_9=` zEGeVLn+*mE*7a_yIEp{5%Vp80q~oof1)#(PW&q>nBeg{LY;2y@cYN$@ZVo7Oc^+!B z4>+GKf!??=xFV_3FSE=%`J~U2#)wxryZ(g5M9I*|izBFF0UR{Us4xJe*x;>lWcZ>% z_ooJAG8ZoFbG>xY!rc%Z)n=?-Dj8q8{!)~gH7YdzD#t~ty4zBwXp7ay25=Ozr1I?u z&Zcn7Mj$6m<~2M(hCy0A=d@`6Ok`VE1gH<^mk}=M-iKwpNVOF1ss6LmjyL}_~ z$S;qH^Fa1Gbvrgpl0QuQaDsEjC$sF|n-Y$VZF%Uyo`LT~Yab7P#4MpPzsbn*dL{0i z@^ib&xHb-bdHohW-a6T=BOBNIU-caS=+qqd=b?KZ&sWsH^i&I7*>UK47{9AkK<-}_ zWo37kUBc-hBVSd2**Et%an43pq&7o#p0M%%(AqDR`{CzP*quSVK6QwRp|^SI-(qBvdkv@ea3?Fi4!u(JuEhMO@dJQKo!vI&FI;%KV#bBs zt%5CpvvWO?6r?cut4QFiS>$l?eB}za@Og&79q^O$@tY6*<3l;GOz|OH)>!#xbih7d zZiA)&0MBHeyEQB*<2($4S62_Lytc%T3j!<*;)D)e{bHn+Uk~K^en0ry)A+F4xrzN@ z?b1@`-cYK4#~2Cs)|*njnKVbZLeCr%TvkGN8S>-Wh# zJLjP%xup_7UOPGSJH)QF4@Uj5P}8HCcn`{tzVvpr!nH_&6D2gxr$`!*7=l1lQm(H( zn&(%8<_B#3D#mG9bziFpq30fC66Tz0Rq`qSD4jxrzBI_fH?B#o6;9V4JC})dw9kVh zkycYdq(&-Fgr%<^!hV9++x7PY7bzKyQ(QtmMv9aVpp53#wpXkD$sfGelMIehSMiPX zyvH2Pr|~6wzS;veB=K2GUqMkTD=ll5PwNGP;Mn$j3*XEw5Qup^X9xBdBjBcxpCJ202RKVH69@vM3Qo*Enw)kl*6T>sj!(WGrPQQ(1F#GN_zzOI|mK0(32t|*1H%DrPlI)GOMwn z9McVr?@S$C&E}_CSI|+%T*41>v5-Lxu`M6u zV(C7IrTi3PxciEI%CIeth8zG>3ZY!bzm!}ZcD5TKVliD4&|}Kp(X$E|bVQ?HTV9NMB#uNDj#oF#8bnZBm z3WnvN`pg!KU5ZWw8vk!Z?knVb zF7>69nj$0Tj>92W9S=>&FSJuX!!1U{Ap3#sx&PKW05N(oCqA?hY{XeqQb=sc9F&IH z3{EKgqPzj-Onx1@@Tpc_ObIoiGhAV}?(4d()*!`6wG%z}#k7kxo;{sMdrpBfu>h_! z*FG%*FhgWp;d9{ZN zTR$v6HiU!jgJWm?+xU?{(i-Qg?t?^{P5nqlMYG_lPn>4RTqJiMgjQ_PCZcdq3Ig!h ziZd(7hNjsL(&oo^-g1;nHVB{ehJvHwXoHk9(2Wo2fIk3i1^0O>+w8J)7CCv}NjYRk zyx&VauHnuf#XvWJ{7K~CtGxRKqVK|vwo3RtyW|0oFOIRgO!1L~)cv@O;dsFenI~Ed`UvgtW-|{I+?>LKJ95wh;L3V ztKZZ=+eNe4bEH1kYXW$mx|$BO)xft$ zj$}l?Cil9-z6vvDHp?FVBH%`G@>ZsFd;0sNCUV?F?PL9m{IXUG?3qb~Kh?H#PA^+8 zdQW7wtuh&1PUpir9HDGrjegIwW@{xAIF|B`TpLS+dV&?fK%>lHpQ6lK!NxZOmP1t5 zDd^HqYfD<~4H$;}B`kP8O?YCU!`6b^mAQ)Wx+MxYs8}rX*i_nm`j!N(l4zdZX1p8d zbno}A__0x+wG@(g(xgT;&{Nn3~7 zmzJKh+xz%_{Aizi{xvDIlu%>~TiK{UL=%Ymn~AX;(i#Ygd->iG21pg`@2W15q|?5v zk3*_c0WUlOtiN;#pv3WO_`oc83aTKnEliVrmkZ~Tww<|D(R)rL_gx^DB>P~qY(J;7 zd!tn@`c2>xqrBPE8J?1J(?6oJEl8q&rC?f+fzA*^$zNRc`9nUt^1Ju79j2cQ_%`*; zI(c{pc}-+?Np>FPdt0Z|;n9=kHRI=0139FETS8xymojixBHn>$P_bZvgTW`O1#*P0 z;KSU`33{9R5{f|uepV_XY2wgn%& zE6>p3E6?OH)W>)H4P!PAk+g8CKj4cJOs1B_EAEyzpDbj7G_T&uXKM|#81o*}6i8v* z@X@%?U3*6|A}p)?nTcqRjY+2s@EnIB@+m zzi^|O_||GSx~GqCRvhGt$x;Th#&mtZSde}MdV2j&?)Hib9P%YB^dc2O=7?Mt{Qo3= z{jnQk+30GoW==#+j!3MmBr|<#$X;M)3$g#}v;d>JEbuVdY0mnw$FhynYxa*SnM!rd z_+a`Gk;!pacSL2pT-D;;sFogv}olas>cbX zzh1*;tV3Ei`_0pA=L7tLBvWa7f`4OGR-Xn;ugI+*G#rn<_r9UU(Cs&>>lyWIP?+m= z?Q1HyV@bMh!9B;{=GQqsycd`8pZ$sWb3SK?J4WADbizl9%zr9Mux3nWTz+v0pX#$3 z54}PYdWZ*HWiJXFy=K{eZmqmJyRi3g_%-U}wGmMxU3PCKoIJxOX>k@%c z{;5ik$g1Dr+kBQyUS9V+f4JSL_aWVqbym}Bro_CWsMml)pWl7ogp32G_Yg zorBn-1;WdHdYZQPU(M`G;VlNpaHudRZ`dTByIdc}>VFc<+KOFmpV|Msox2V{x?486nVS&&9SP*G6ER|ICR1Uf)@*geXLOH+3DLK21#NaFRoIlK2pnGDK7PB0&QsjzZZyL6 zq5r0N$v!1ZLjR^o#XS2v#L9UxdL~kq7TcfR2 zL>gWFd=t0^lw6Kn)`0T1$R;5qD!ZCxhB47-2SOTi%5^wgt->!=1IwoFD;;vF1U~*I zF5(-d!tQRaBTE?nYQ+_-;t!e`=F{``F4#rLaO z+%4aD)G=*_+}`$lZV#&PE)*;Qi6?g@rvC`>_ab60Fql z7Ltz-qYS_Jt&JdeT+-@AX&(CeDkQ37&q`TTx}nezIC<;9hV~!3-`q%4P98#=4M=48gVHG_s5uW^9Fqohr|z((g3dubb@KAfv%*yr=ZS%$MHy)znI- z>$f(YZWK$y1`?^bq&^q`;_d^*+khPT1MC&Ob}vEkj37&<92LB*=5u5q^9WTGBiw@B zmie3x%Om)mw)(_AOSy_&tQ6^$UPyc_r-jAxkBq5r@M6usC3qR!Q(Dz&xVufw#VHY_ zJ!`+~joPFdiuIL4%@ihD1y=6!8x@HvwTIa6S!Ps&0QZzsJR?Olgt=(2mHX7>&PzQm z%VR~#X#M?qr!?-*`6+Z=d-m7vP;*dcgN4y^2dFzZ}teLaHua`Z3hFeT=O24Wu#xWl=|+Nt!R-x zfNrlIA5IXv;>*85R;??MlA?&ttNG_ilhMYGo-f7?OUz!(ge6y^Ar|f|kb}yd?Le@2 zV5|nt?!~_ZtsvWT?q=RVE;d-a0#!*+ibhXKgEllgp3X-psTdI{3y#cibcELf0-6Y07dH7b!a$Ioi zhB9PL>bv9@U>gO5-cUU!kL^(cMCT-4B2e)jhI@@(DCa!bnu{~|jSYo?x~R0LjnR~u z;9R|ku}rQhJ}tdF{iE=M@4H5tP4M*Du$cx18)^aCCddRj$kX%IYgG$K=zYj3 zN_*Dpq%UG%ec(`~>Wvkk!8Xo~+mr8`%{w9xed_eImv402Y;@o0G_YJj9YznGT1%>P zKr7+(e4E&1n7~*`vt|w(oTsrFJ&wv_;DtAoUFbSxN_2#NVqu!_^{6(>G#Dp8=VzFF z43v%T&4e<#SU20#g4`eqtd&fkn>li%A|gJ4>5(wON?Q@r{%b%qC0zRZCDuMg5;{&8doNlZ$OfQGyOYGZ3c4_nzPhSrp5l=qq9U{mC|TmlznHee&#eRuz+Q#bUrb+Q5z#B&!Bxe zqRX34RvHq%$DabPYfU3tq&wX%`| z=nMsZm0UWonP{2iEETYO4i}}5*HAd%(u%HrK>toFnL+rpX73qYerXJrO&$mYO&8X> zTUiH6nM4}d=b7Kq|4l(l3x4b{Ej-}-;kM0ofFEp8Fu?YwlW2eB@f<*-2e4 z^P^(z39M^6s$nEqR!+5!+khCv&mvRNK4^c>U-6U753YNytP}Te5cB^HikSZ&6#pN> zDB?TkVRmjKmfn7Wk7`vw$#BnC1@IsZCcn(O8>70DA!awyUiH>mkjv`xP&)jxyUbPX zYqB6-CDGo08Zj!q-R;dKzg`c$#F@HG^%{rRw7U`r-Puo7v+<`_C;jszrqL~|5EJdf z)Om26h#O3i`Aj9&*0bk)Y;?5)dJV|!nUt5m5m-ZtG>N_K2vXoBjsz!6}hK za!yah@leL4W4k|d?&R6B)RDi-QYj~%NT60#@)4u%ME-@)pMG4Ij37B5ryq$)7^#ay_NS2sUcb>iVfR>zGQ~ARdu^RCZLL=luB%?>kV%4 zs5yWqkZd8SV}#Kqs-!lgPV1)KtGKmtdq_(9_S=mBwGFEz;*E*@4`G}SK>=E$eKEl9 zw!7yOs1^df!vl`IecgNgkypYGaiJCb%9i@4rH{lD3hF7t6RJwixwkNPml(V3$5laa zrJRGb#TngoKm+M1cmLcIo1F?opYhmGU>I=At5=Dcayf6x__F3Ozr=?mwQp?+sCom=$>V+#=Xn% zNOCK((JAKEOzvlXk1sN6_SJmVLZddq#$5;h{C3WYqD>==X9(bB5z7LM3?m@(?%hUG zOZvk0_I1q&yAE@;6u7=wpj}bJyRtdHYiUf^PrFyk!t$FMraC#SBQ0%JPVp)`chA4n z@1MA?p`SS;naF2>-Sc#>3lAO{bK}||emB%>vfxP{zq_Jk-`^JIC$bj6k-rb2CeQa= zf3jw~6)!M3K{I!b)e#)%`o1{UKR&|4H-DY%&W~CC^(SOE#2-4?nwY5IlqjDj z*+Q65K$fqokVpQ>j}p5}n+o?h9}{g;6%K4x0>5cvYMB9gcWn9Y8h_X;rym<8W3W5R z^6N`7GW0q2PHS#bGIF?18y$JP6fOWu|EK&!8uxUhtz+FpHxI!FcqB5SmXt?rm)US$ z+Od>tik`vTZ^?h0d(1;N=CIT_Xl5d%&BW8Y5M$mxR zV&_7G7+?ZLd1pAwHIvGht1n)Q598qeQg-2^T5~bln{X(AX*KgdNRk!BB9$q4dtS4Dn3Zn1Ma=82Paf| zTp$`mt)J8>*pUO^UQwz^2H{O`yDd@aJJM7^Syfe2%tn`g>IC4@IiqaXq!ZFwX~fk6 zDTzhAIHsrQIuT%7b?;UN+`vhwN`tPm z@_Hc1oku&(ZyCGpE?_i8IqlIc%9J4Sb;?B=y1}NiGd+XyVq1So-_Tz^-SZgu&I*pp zKrdlxITm5;Iq4HR=~c;Y76LWJ?h(`zJkKNO2SllD3k#Rx!S3!^CpG-9?c&&)V+kV3 zqsdDHFn5{`mQQs6V`CpnVdWxFP#%iTe}2a8-YVJtsNH%V!N#z5u>cp65>5R}aO&+i z31S!H;(YX(VKgM?5cLudZg;=ON?CdH)`~{9$>)l+$y^RaR1(sSvBjlb&xV?p&2#YV z>V%>}B7$n*PowO?@yirOs*4d+7+rk+TJ*e26UZYuT#bbDk@^fFF-Onoq4+x}vzgyP zKG&}RfLx_)pkclSpNAq3Y>->>%x4Why;)ju9m|m2rL@ZUPs$oggO?Y`13?Ch;W#5U zi3Ibnrh+w@8jW9@H?M1pi4mDc`;?E6=z6Jiqf-pVY>6%_%6|kT#2}%uUUVJ7YonQ9 za!0}_Vh{T2QEe$amp=XRY{9kyqp%GL(tb26G>}z{bCsR9hdUoRo7SHAq3IYk5=VU& z&#fxI#tBkyNUBsFYn@bc*xgUbO8eZWSI;Wj<)FlAsO*)w%ys?sia$;dAroh>lqjik zW8%GhK{)#a^0?=hd#=$aE#!l5;Ix?;9P(GW%@~QZt9^-({pcCA#FgBX$_v_1e#=rB z2j9>g)jcNM@SMCRz419vWyoJ@vF}gLZ!?5-ahDH(Oi>=$Nl*i#f5T(eOcv#7gMhh9 z(l65tv-!b!@5ELgM7XTPfsF(n&)Xe0P_xNP?pkR6%mj>W06RLmzmZlzY+^<6BPPrH zG6+aT9nkpgjv`y+6%FN4YUw+jAFOX-gCxWY9(Z2Ph*AGKI+cy}Ar9u+L<9VNj9o}U zVhn6o^Nj_hZO&NI-|3%XKaA{~XaFrgByko|Z6!$;<`)zXP6+smEcm7@6>tUvv+vO= z9b?V&`h2wGRivZ#H`%GJg{Bc_`mU+M!b%QzgM2vCu}g%yY`VywKD7Um0|q$DBkQAQ zn>fPrmJYbsLv1CXI?Y#A?5hbB zI;pP4ft1@$b<)j*=1u z*@5LGfx4~0Tm{PpVAGbU(ygybmYo(BWSuZDr{ousFO%I} zi4p(<^}oCnn*pjmO%933tkYVjrFM&%v7AK*E>OaAAJ%Q*5m_?^i_D>7@1Vg8fs7fa^3yIyBlpDfSEBNyI}55 z+&*!+jR7Zey0Buv(zD4RsQ^lrAZ>@>Se7WoPxal2<{iEG{{S;xp;;PwXe^6wZOBV! zdq*ie>D=?(t6Gz?{#*&}!mqsBwGT z(@J{M?~4Bbb5`D(v<1~7mfP)Bl{J#$rrVM#{^*1KV|(*Eo%wxEirAM@Fi&y&Wq7eG(eMLTY9Te4cy@&}zr zyC06K7-IRJ9iWusc$1rT{t5lb3;FsaQ__V%bn5Tu!T-Y$?XXTrLe^CCJKycw>E|CJ zR&Juj+Zm1b)&*dW@00#LIhi|pJJ9ZDzkd3{E3j?l^+J=#W=>K~EKQ8`VI6A5PfpVp z>g5qOR2EsyiWZ@yc|a-1L<2rCb$yB8v#ORoG3x#u2O5%Wod}6Yt@<97=qSAy|98Yl zXsPQ;CQ9ScQ`}rAxSjycIdEda3A;{Q?hUbQ>I6FI{C(e)S$~+2H_bq@Z~V1%KMeb5 zsiuv1D&Av!qcmK!JL^zpmhZc1=v<49_reIXO0b@Midl@{n9iSOkADgh(_aLX(YJRb zX8EsEfrKwd!3MtAH=H_}d*7e(&28LNZvX6A@2?w3rg7B1D{oh9Zc~kV#ac`lo2;G) zo1S#Qz12#rDm#{guV2bZ2I$wy_3E11d1v?tQq^eB4RJe%T{I5xA)hi!maMlhYu4Cr z$HcC_`+(iY$=(KYn{9F)tIYSaJbFIobWYIC`>}-439Eau!wp>WF_{zcG75g6thp6N zJ8wYumS3*RXf^Z&@|dQYAXooNzdh`ZoD2R(Am~EqFShy3c4nc~)72i#j#O9F#))cv z9FqQEHGQYKZ)YE~gZ~pf=g%MQ?7s4rjNBB~ab4YR_rcBSXkNZPsGdBe!8AN>ZKD^C zLN%xw`45JdQVe1yV#O7o>qO0+;+CA)*6jROGDD32)Ok+U5h+h_5Yn`GrP-8d(1_N0 zOvVNa&R_NVD-*kBK<1N@?vv}VSJ*#BldTVngKo4In*~9ZMnu*By&q$8B+?c-{XMDw z{8vrx1$SQSI|yWc4Y!`EPWI*9-F-Uk-Ox|8rwlo?ch#0v1IJ4%p9&k0AM&*E-s71M zw)Me)&pUvN+52wV9ffOVGX=pALyW^KADf)l3Wzeh7KM{RNwLnY`l;WMR(dqpJsRQj zyY_M9x7aA+2A5`Ij`8M$N%_OT?>rw*M~q2)j0f>-mEN|3>M}tjErRe(Ab=0)ncneI z>Ng`kjN_2-35PgBFRE)Pe4 z2-16m^-Nz_Q4EVS7@Y@-oxWxJ&peQgk#_GF12x;-$}s*Kr3?L<6Q%-6+`!!3tFOkv z_M=o=4ZZkHjHc>mm@~#VY2A8}XqXr{!6J}Kr8Cgf-n!lg`u@FlPI1SicX4l-_YK`%GXiu0HnfW_8KhH1QiuSYw!Q#q~G}62mOjrS| z=&4DUZ1PpxLDS62S3a$?i@|CND(YD}W6>`lZ)tk{tO6PT(|x)<6Wj@eg7~-v-)+Mw z;$1X@S0uPA$+^E4lr;@TS}Q26?m-%ZJDCz0YC<`{&Dy!*CGd1_lZ}^in>AyJ!O-#$ zTioAR#G=vOR)gw-H;gJUC$WT_W1tX)DewYMHM{IriNQe3%n#YJl~*~UJ{{rt?cXZn z@(xXwztj(xrS0V))H(wECBtK|5|4hCG0}gO-lSytx$%aJ3fr4h4=?%{Coe^CYtTUe z4(wN)PB^UgI^|>M+#H;PTTEtFDC%8@tC$3MB}w&8{guuf1+X=~oVgQ#8d$14L{G(d z=NbaUhN{wrr%!l{4}6z}B_rt^XCIHqiadg?#`hwrN7&kw= z9U!RPA8(OG{RN)gt?aDJTm_Vs`n68Mw4VXdCBUw35c6YVJR*H9gv)n~BvsEkl*c-0 zq<@C4KQP&*RXDAD+ps9&;!)z)Ygef@{M*b=P9n~x4{}IE=O{i}Z;XIgm%_;aL~&0i zqrWpfhn3iRHJ`^sGy}EOlka;D_`MsOsL~hGvdTCX8r5neqq#3eeL+kNbaCPD8wfRU z6GnhiTKNnLjim%p2wm=$U(R!UFj>as)vmI)f$}()2+qnM+K{>T~sw|L&5#{&o0GX$b>wCd`#buxbL;xLFD}q zmP;dM{(gy|fmXL^w*^X!dpU%>r&?W?`4wnxi&KP&4!b5^)DNAH^*qe zSw+gu^#(bu*m47p)tZWB(2aq!?|lmSoRFc+uG`gsTzTDu>iq~Vnb{C31$(KygKnu_+u869*#I`uyNrESxmvc7_JERLG8hu(h7=($)YZg3o~--(1;I| z9@q#!LY%=@t^VC#t=_LfQhev-QVK;DE9oh$R(&D8{;B9|ASuM{R=N1q(1n0M_mHT$ z`I725z7%%l<3o;}O7_!Z&q)5>;$}E?H_D+|wJ_pSIwjx{h<-9wnw7e0q9;`;3lqtR zGWuvg%CT7rAjge<05&?S>=WQ6Do|O;RAFWQI0jyFoW5w;-uvZC_z8=(HnK}yQ~@rJ z%}XZ|DXo-1G1B#7Qneq!_bj53Fo;GIn#>fxrsJ^qcQ@Z3bL$%Q9WXQR1>=Ln-bAY# zNo!Q6=qE3VBrvkOl<+M{g1CVMXx?-Tm|M@2qU_E$ZWD-Zhv{r=8>z;hcUX_Gd}iP< zW=qv(7AQ%uc`c%wpE+Qg43Wy?B)#1+w{&9^IrP4SJ=WKAcj}4aOZt9aVL&oENS%D8H%vHZyOVgz_!C1%pzr@3~ zZU3T^$eEdUGCy9dv3w>EA7++s*F%*bt{PFBc=!})+ zHNIV1=yqNpNA$ph8Mnhu8fzOjr*jDwUooysV+gKkguI>XLw1qR*ewon|5L=weR%O< zveIj=9eF6+_)uOnvOY%S(+$v#1U(zEROOiqR6!ySB|oq zN>>lQ|HWOA6Ne|3*Yb$3O5i^(YPA z6Ms@}P7^qN~x) zOVlR2xT8*+ZwR?xcDGCq`(@igC!j~ZZ5J*>YJtGlE`ppK>T|b_Ncpym1L-I|L}2ug zP%&pUA>bF~hSmLdW$Y^k%k}NW5V_>oEX1VD>wn0(<7-dQDzOzv^8+0}be&LkEKFsn zoa4pPp_r9rJ%x{#Gn(v52^60gfA=Rv@U?8l7}NwE^UIywv7QJERDYJ6cM|KxYmJ8kVZM%4N*G7b3bt-iI+c2P~B><-Hf?dPY1ELZMsv#zP>c_q)#x8$X8? zmNk+c+5s5L&B1OMqBqR8(|_Qyp=wt1ss(pjc`nf{C}y~ldeYc0i}l=CFnW!UY=Eti@muUvr_O~`<)i@DR?|!n!x0PZ<}09cx11;{-My5 ztR_-jVhT%^l?GENO5^K?+i#iG<(dxL%A4_V85`y1yMPnHyjMO;n4Ybr#yo~pNrLS% z{APlf1mrVDR&-XClT9P@7}+tC)cJ#py{Qtdo-d)#{%OL_O^CpwP|AvPKDkSv0S?C9 zYp~v&S!JP7vSQ%1(R!FPcsn%ZZ=XoydU$%$|Z6udt$W&`Kiw9Xuo!uV5ailL` z0vXPr>9VO)-f@noR-t*&FXFsR!}fLud7akw<3zZ4#=+K&5*q<@#Ghs%pF`9qr&ST@ z)nsv`&R}!rk21S2KU5De`p9_2=y{3yPG^reyISnlYy)d;kxI}b7%2Xd45R~dnzsGi(x=Ey?uQpdY`vT(k%dl|ctmGf^(<`KZlB=(y6 zUl`Q~@>BpxW0)KRRIDMsB~5V@hnXWEeUe1hWlTjAsbp$YqF49$mxt8b8+id2v`ENCj8#A@E$Wl3sbmM*s01lJEOa z_l@}9$n+ieTIz2sC$%qkkZ;M`Ai6}lRUF?<@|U3xLK?v#NL zYit-epMzdWqkOJ~ptXiFd!cA0`L}rn>KSg|>1JMe5OQtYDv_;gqDlCm$ZEG zl@m3fkk=BJH7rTKNXu^tV3D~id(+Fn)s>IpcH;Z8p7?d?q2G5ow*WDXuGM6{J}+|a zV*19;3#@Ln^+H}+V$Jn&?%mNq`|Xhqp7bJx%OAlT-VjJG-KbAo`$C2E;t$4mQut-u z8YRMrT!~^^wWwG=VO=C&(HZg)H4CG@2(QNZCz#nEpU;FB`smGqxp+rOn34xsMC$mn zb9*?riqP=ZvC~QRXfoztN75t!p6*D=P!ZB}X`&F}>CNgS)_APrF00 z`N^iMi9x1UHAZey;_?76?|OV_j#73I;Lu#zic$+6B zBz9oa+#?CTUx9)4jIa6A{*{KCp{hAdqcUQ^pj=U_kk#j1w_K9aKfRe?Iie-P)1kF^ z$2Ob5>SjG_?8hxS6^`?Fo)#%1uoeG2$x?w?=bfKL1L>J30TRNYa_TlM><;gws)P;fwYvXYZ= zGZtrbG506MvHNK<&o=mb=X%Wx{J5Q@a!3RJ_eB#j9c9a?vynODuqY$L9i=U`RM^T5 z%2Yov6i2iW^@v%hxf(x<7%WX$Vv>xdg%&3}=<#sZQLjkT?c3&sny#m3}<+yvfk)8o47k#Gfio03BeFdXN=0Xb_YcnKt$g+Qj)T z_L{N)(Us90YRaiTP>raf6jK&8qtHDzumF&2We>+y9Xt)}J9?)npp|jKMu>@wQL=&y z%Ad!c2Y>b1@j;k`oe~eY{CF3V4xsbn^BOaIO+Awiz@!hZm(nDa4Qr;oc#UxCyA7|m z%Vwu8W%l4=Cs#%r-S0D76Vr}Qp9=;=wGqSX{n-Q0jnZY_5Mm_$0k&~!&D$OC5s(}G z3{-4RD!(PoqWyPt^tR4MVg&wCg$Zv)y)d3}LBO9(m=6Dx1|t1^mwfUs+Hckbr8E&u z6@75CSCXN^CaX*=*d1p}l}(U(eyH;eC|beF!fPFSt9n9>%{ z)og6>dW62O?G@)7w?mN9H*Dhtsk2^M8Q7 zfPrNioswcnpp+CNp$ms5r zdmtyPMdk+WVkDH>d-t=S$jc(>y=X|cpQ7+#k8IFx-Vhv6%wED~5D z>TN!^oUf*qk`{MhzmMkyLa}4cFLg}MN)|a3+%n#ce~6ILp76arj9fKM)Uo-NVCVNf zTY~nhlCw+&2Km^V5d3?nyzx!}pa$b2RgqMQ{SQEyC)ExNdVJ^c-aqz7Hh0z|Y))*? z-W0i$AH^y-DgyXv&-sh%ukeei^Nb9~m!op*cmH&m*_TV*{-@L(sd}lkpkrcZy+ue` zivNjNtk{>S?6vi_l>MHaN=k4~%|Vgozt-@W?-+l~&nConJj!C*-y?i*R$MA9bh8~9 z_K4_ezPl?9Ty=Tc2ko`Z3iP8XbWNW%^(rR0oN(2LHH-Wr@8mH@vu+Ms$@j$ia zx7u~S#x}Z=oL9F)$GF~JUDNP?xc(o&GV(0ep*V2K%X0v_lBd(y^VnjcB}&W0itwQ4 z1;X`cKD*K&BI4@AbsD;&S7Krsx_uCKv*JxgKu#C&d`kT}2X9ZrM<&O8I<5~9?az(S zAatg24D;b{wCVF${=Rxg-MX-7h9H_-Ht8Q7D8qQW0uGM!lbH${$IR|BFQm?n$f$_I z{z#41*F5wh>LuM2Jm@yB343!*uGvgB0p*{V?TNLwA|3sm?7E}+g5^2pOR~8C)?e^7^R7Z|Sf%$kUY=+D&kTT3!0>WlvYnoOfe<;;In*82;Z8i#jr*AnXhEixZL z*D6koqp;`_2LdrMb2}r%iGkYdwsyokIfrSy=|3H-AhF`(|M_Sb zE1?zQ+|hhu+q~*}dnMAd*4e<>8lzIXkH2{K(C)1)&KP=?UoP?TMl$gs<7%PKD;p=t zQS;}~IByn30LU*RTU5rDcD5B0M5WTD?Lu5OUMQ+XC8WZ?T<)S&Jh$Ny-XvyDQmq>E zqLWB}jxqdr^0!yuH}KDl+GtLj^8xV@_2{CrJtQCG!;Su8_I9!Fq`2OYNw7314-uGK8%Wc6{@1Q?EcK|n=Cbq{6pg>1d36SN#|H^kW* zr9&_ZCag)_&M?Z5#k-aBz?pHF;CJ0aB+9epgR~MjXwPI{7Y+pk7d+1RVPi*m z&wTfV{+s3gm*zW6AR>bkGnBWFv3lB8=wB#}^?hOnx63 zR8VGd@8eM`fEUUqLa_LMGbeO2Nqk7Erh4-N?Ue>K7;HnKWZRmC&_@0msswa!pyC(T z7PR=ap0Duq=jXHCN=Zl#iHO}^g0c7vD^hx3GSt7qd83)PHYG!=I*={5V=By5dBbIKkHQk zIeLr7`cZ!(Qq+77O<>s&m-n2oi&^DruOAF#OdYN$L6*@XD|J`rc%G%3fGZvw&5V3w z=T8xRG;xD-(At|k#@JzVGQarv2E#KwmVlVr7*h_7lF0l3d5-@B^*{>006Bmub?T(T z@ks4D*zF5a06(@WdfB~+;0O{;M%i!J5M~5LOSDRo0SDTyM%-akbFAe)*pc<-l&d>? zuu$t@;~4p;m}Hy*H2P2z`cfoShTvqSla&K?(3(!5*+SA$B6kJB{wg8u4&y*^2F29| z(aK5x04-kFLW!K7)aA{BE)qdNGlMwoPG}AoLg}2*lVMeDwHF;k?#RKOsCg#|B24$JiwMkOOt&fYfFp{0 zA`I*jcr)=tGRn4)V+OJtB<|VAX{tr`uQv&7G`=7aBZJ@Gr0wT(Y6t{=nVt;_%RmjW zlgIq~QTFW}$sm#12iB73+2sStwKHa+5w<%4%}&~pBhe%f2Wo<2dUmLpFf&tj&V#jI z<{kS|iQ9!vQl*%4XpjLv%^ur;6O6_pqMA?xcfYj~hZKxVed<_3MhcYk#?j1?ky-Pk z93C(tqde6}GC)5uP78pMgFpOfgyls9Xm@Dj3C3u9gCy-g7~+~+?UhLG2=}D8=qdE1 z0%wn{3$i|IfkRvwK@}de3MNK>YBA+xgOk94LAaUWGZ@7qZ4_I*khca>LRHBeiV+R9 zyZXg&sK^mS+!UwORT0i87vCu`n8)o$v$`;BQV!{)wCPhsfKR??8`sn2ts9gG18kp~ zD(QRuN+WdksEfA;`J@gfwH#w8gGVI+a!Fd3iJ1QYpT$SGNs;Z(YBl&w=Q3y7KC}bb z5L65kFly{#)Eex7d|-kBlNg|1z$3BDijsJxKm=rrpK6V{8&f1?Rn`hspJhc|5R6W2W5)BGalBhF}y%}}25|R(M z^FS4i(kI@uV+O3OSvG@|JE`*2dwr-^kU1h|X!p;UnJJ*0GcY7omf7KF$^u~tfhL=I zGk|H-L;zrsNOcF8`KF8KQW|n~_O**Mo&8Kz)jESs-=6(Jv z$sk0*{wu{}xa}0Pl-kAGZFyI)7^TQca0fKeSt|D8E8Aj8x~XX%rQqV<``aRQ~`K>vgAaB$9pUE`pWB{{S?m5EQU6H0HPl zrB>%Ddu0_F%$x&KGDC2z?sGL#NBXT@YX}HEG=p@W zNZr_c*Ju70I*Hzt>J0~1N*`J*t`g#s-|A5YxWdWA+ux_N0&IwRedg z8{GJ{*B|+c+U(ouLfH(Z$6JlScZ0_@KhRw|&X=Xx-8p#W+S1qnyPv&YS9#{gpb{_u z#8T$!f>vx`t3eKg!tLCxebZh9^ahL@R-I@VFR}fK60~Quv)=GH6>U$xmwiEzsRSfBHAl8hz0}=UuW2 zzkX`9fB1Rub5=^fEz@Gb<;V4`-&<=RVoHCCwYKm$RLI2@XwbQND3T*2gIbX4oabes zP?8;k1cjq@zrzN*qov2XH>sP{8I=)fsJ0N`2Y{DTf_|V@udW~ zLoXpsDCIZ=5Hcbtp0evrAE9)g&uT6LavN`a6@S{f_WSXM>vxYgY{sAErBIOyBoE%N ze=Z|s)%TDOx4hPn-WByBn)`%9}tGfIqd#LYxEa{cE zd1@T|g}Qvl8!}r60w8yQD_}exQwt3_v2lfM-3RGh@%TyV(RtIh+86kcx+%3m+O-|c z?d(3rx-e(?t-UA9^5nTQM0EX_a%l!-0+7OWLovrRzC!aAA z7x&tKYUv*n?i;t!kW^AsSFj0!C%FBp(}`<=N3Q_NZCI^XI$nU)vXlw6vTa^tv@K&!v|`TE?$!H6 z0Hh0ow$%fGlU$?W+j^q<;>>9lj$T}}60|bfWS>`a^#0Y**VcN9t)J9&*Q_*cfqPQ> z;VM$S{9$AxGv5_a<_JSt_gVG`4DMm{E3Sj#$B55#BYi&pt*1F}WKzoP+EkS# zCQ3qvIH(UF{8df1fo0*JM(KApx9>R9FQ;HiSwIm3-md)%;#W>|--Yk$_ZKaTyL7th z*b0@YV*uAbX!e~&)!j(fTk3YV3q{TFxl)n}f?3^x@m`$2bZuihgt$FNd;2LnOH2Ni z(E=aSwC7)WvnhVxa)6#@v|m%+Y7Fa+UL{Ci?mm{20wOD@y87Pw>f+6fJ4t!;i+C$a z6|@QOT<6!;FWOxx*X{hW6mWBhtesPgPTTCaw2`sRy5(s902!QjQn38d+_MlT8Q|8K zZJ#NnB%_`Mbbnskqg2qml`_#GBn1RP2jBZvhP}5#MQHNK+GFC7$pf85Ut<7m0HW;J zNV0Lz0o+I?dy0r<1#c;(`k_k4#aXP`4QY=L@~KJ!GnlH~yM-EoO4~^Fexjp1)qvnh zM1F`yi}pHzf?(9UuNNHkD<{~~I=cy34y7F?m7sM}KuJ#Xu)%;TC!qBZ zy-^`RlCS_j_M^Iv4SssO|bC?3L;7UsSa%$S`8t>m6@BQ#1k+hKJ-#ng?x7URe6=~ zI8g*-)SaO!0CIWetJc)O&<83}3Is&^aZ(nEf(oKI=QSH{q5#}EKWV8uWexbuW8%5E z%2SWcOIjq6yk-;=%}rXhB<4F*ZGsO87(AMuwrWSD0tR^bt1((boB^ckEuPUuBHwTX z0CV1y!bUL>6lzi+Kow{VATF*GOxyc`KJ!E=nF0(?X{S(tB*#3_4K$UJ!R_%(Z^TD{PKkc2=GBjS==SZFN*03d(}fkvXlB#;D8%}JXV001UO zz^B`>2?0tADjvi5s=jgLBWVgGT5ZNYpwfk}r~nQ*JPD~sm_Z>y1OO#elrRcOOprc* z(w6B-3D>kCQ*K)YMg*Su6hkQ+<_VwLoG3AjlLifBAfU;D0r{Y7h&e(|5!S*;JC4)a zfl@5Gl%1f7A2KR7-Dm@8%zGLwDheP883T{`?MxX}U6n4%z~Ibd9@OufnNj9}Wn@56 zz{V-U=_K%GyC5W3_?sty#$va%tzL;T?#n|9Q|roM`Z@WDNY3*NcvL3 zqZ^69pm(dV{j0(CZ^0%oOjjK8ff7=GW6aYR1~VA=`qInTfRaynG&8DEDkU?>qNb3f zX9WiNk-7wv$9Smwg`_Bg1S|Nd2SAYs1GH3i&?Q4@^+CwMp>2fmTqwJR9mMV=0rj9B zf|6B`Iip_$Po(5?QP&D8k^CMxr?8XC;B5;2)gXcfNgT~bEuu+2)MKu0I{_X3kwQF5 zM%gnz#aR?ML6j4qq>&Mt3gJakPjMX7i;3JLCU}8Sw<|=DK@nEsB9fj67NV}V4Z%V; zO+#HNIR;FRYMQw-B1z}wp{`p1!R~89AT4KVEbyW)42UD2nvPLBqcPv!q;CHJSx6jI zdWWi0+O*@U!o$=69K5g!F$RQiOo}B0pGiMBrd%GXc(qN!!VzOKnfRK+h*Ho=pZ2F# z5(ppM))W?GQyOxrIkX5-hXke#Jjpx^!1t!y1T4oVw9}2Kg+TgDMOZlsi*W3x_JBK2 z){wb9#wkf7liS{uZVM1Xx0jXA(QsC2A&eBNVtLB*2kPN=7DXz&KT&1*e)% zDwFLLf*_eQG~iGPAQ+~|Q5hrbXhqs0C<;zAl25P{<6x6LgwtqH2^^E$Q-A{zii2dS zXcv?~B||gEG)2F(&OPXK?!XxOQ;crk1e!yQD=nb2a)G#0hy(;A)aROjZ z73*ZBE0CO?^}*n^ac`>Bnpd^IOq_EyY3Q9?jh}c*1^t51yP?(>QT&HS< zJ+37VOsPP7{p+lJ3_wn+rdzs*LZ5CsR&Q2tpsneK3zyN|8>@5;7o=@&b&K}x5{9xC zc@;(0KNNi%r#PlGYdeiqLPq2!5)Zy;UluHN_Oz`T&XUqx)bH9Ua9XyuY8@Hc8-IEMe~Qgs>=fzRHHEMv z1=k5w{EEC-c*$*|^ve31uk{wn0188PuvAn=5Rp~?0RCJ0O?wd_XmQHM#HO;p4tQ0i&hO^ z@qyHD-KkwMq+8ls1w&t)GUA85A)m%aiL8Q;@XaB`aVkMi@+(Gb{d(@BsXK9N(|UD{ zlfU~&N_|m0lR`JI>0qQ>Xz5a9Zt|Zg$KJdqqo{QTN_@G00gvjvb2ME&>>J`Ae=BPB zFOJ%WT3s&Vt1OhVun-$<=s+J6REKmviPcNGuQ?=VX*sHT1)G(MHrJtLyHE?DTZ zcKTK5{L6u0$HhB$_=oF|@lKV~`YnyH5SBs#kK&<|>SsIWm|xP+J_us;!yZ1h`YBCK z;^G^(Q-MfI(+L^xP3zy6{{R5GLeK&WL>%OpuU;umUbh4UHmt|JXRDAH=^aMluvW2Z zy{bxq+H2h~IM8bFyQ-IHeiyYpH>rFt(lvJaI?G46vTRv-tT2>$+Y$!({ag_<-}u`v zYPPo5sIs|OX>N&ZlZAWL6TvQmwdkJ?v`ZZ?RKGrTgAclw)|IEtQ(&lpw;45mU5&NE zTUFh=PdM0swIE16$o8$xvbD6@1!YQGywW5Y5;OB!_wfWL!G5p=#_cWP&&6yMr6@p3 zL;xTP*8c#A_tkCShgd$8gSSpr4|!5WHO<`GDq;Ts5x-T=U-*A`d97J#m)DfRt+VO5PQo8f;0)Hn>Z_M7t{0=+*jOR< zmR#Fx(o^XJ;;2oj+R(>m?@g71eie&B>MsTV03zFMb(c}u6vVFcr=3y|eyINdYICX? z9cs#d^52O17PV%;3tDa6HrFv2+}nU3ilcOMFDmItxxGG6iA<4-lIrj9)|8DU8f}rf zaN^|%32+|S9M)^jna=~uqw*yFsbPlltQ{rN+OJVNWuzAuvG+n;XbxKkn(N!f?fgFI zhS8?mvV_>Sgl#DhuZrg%!|k72=+|eeEwo0p{VvR#dyv!P^9-1hq#<9cpX2XaJ(APKLrr}QS87fqoBgCyn{{T_ezr(a1op)P(<(Xj&6{vjUidKu! zol$3ErS%6-TxbkTF%Q zOl&^DPdv?8?bN3k*tC&@@lZO`UP{6Qs2pdSbXU5Nax5kuLf^0s`9N*N#Q~)+%eu_q znf8U!sT34UoW)sgY$Uq}Dr;0gaipj%N3j)I)W|{Y{p#%V zDP4}}B!DyXRLx}|DMTcIC!A)N2gN}QjwPzN`chZgu*$*|B$FAXyr7~+&?0-&I{`bn zkLI+l#T8Q*VO@GdQT)EAZm_5UX;yf_;;%j=>FHZ7>UQD@1weuNL9JP&z8iU^9#Tbb zXKfqmKM$LAw#waYwNHPV%hiz^!-Ch+kl~eO@Rw0>?HRT%78X(j0qq>smsV&Lt8lGD z;fA*Lip`pk0>V-VJ)teRRv$m9v; zKYC8kT|)_OG%Z>*@Du^v^{M+bh#R=i_o!Vxr3C_J1PH0?U`zm<{MEKJ1BFzasS9@C zlkM|HASV+X(+nX)0E3PrJkf|@Uenu}XeutkS`tA#pQRMS0hq)eZ<=YeD0Vo<+K6pi z3=ZSkn#`oRI#8XwWc{c|!2(qg{L!0`QInHV+JeMJ4`6;j;G@TMEp4c4_YxI3$7#($ z+$+pkoB=UXcjO6$0(s~Ddzy_Y1#5qotJooDKmsvvrGPHkC*K3aZ^U$P!x$ft>#UHJvm8 zg6r}lqBmtURPN)Dk z9FKeoCYlLPI7cPIPj6_a1AwH;as*8XB>)-D4?U@9Sy+*hagSQLm%DOiJ9ot; zTcG^@)R7=}KJsa}FF{YKQYoF2)sd&|HxO zoDb%f_}GCGVw8jhF9!mXaFQ`UJkW!bL=f9T??^jHIsPd-K`|Usolr>J0VLKEqNQ%) zDd37!j!IfY4@Y>xuWb?DPc*y_f^k1;!c|KK%5dR%19F5D+MkdNC%Mfqf6e>L;sV}FX(|aSD&yv&ogkwh%`}x1tdxT> z%?n&AmpIYFwp*bH>O`Rqf&;P?41z1GJS;+OuQaR0INz4V!W6Ygje@xINp)YIY1tt_ zjP|YV)B3IBHm$UmK!m{{{8krSbEs`weLGGk_?OV`yzxh+bqie#^v{V6XxEIXC|%1d z^|G8vBmFAXt9~T9Ps9Bx+TTy{S$$`#TsAf~Ltp>~RI?tF{N}!CrNxCQ)HtH0b0(g( z)U0%r72LF#nI-`|`spOFb~S*Xsr?hRJrhkUgPu?1yXwQnpTxgk{$lr}7;XDj zi6Mcq&#&$gN@Hmr(ep)E1WM@kc|x)8Dq;?H z8e-R2co&lK5p z6CmL6iUE>H$1*!+Db4PTRs&D6(=2IQrRNak{?x50B$!vlJ8`C?QPOVh7D^QA6r3Cp z?@{fkw>1;wrU$F_b|loh*GOYaTHRPkYhffoz%}%k1rP@-=O+6u#r!s3c#(bKzMl6} zyJY>U0-Ca0g+cW+gS9glj2Q2V+t%v6Q6}lOP$L@_RDX~vr{Ok{d7|_-nPqbN7T=PW znLbl4EPJyD?AGUKSJV1`qtBm(I1TNsM9oG z0(y%{xVZxNS7jE~%_RDX^Ae(dkdsGZ=^mdlx9W!c4%({M@b{ss$aM+0cH!iyXpP{w zM2~(Vek$AJRjMq%!TP4+?6q%b@wI#r=mE|Ye&hM5ufhfGrRU+_qf=_~TsHP)m$sax zz~ZDIZfEW*VEBX6+J{s0)7n0r`BLKDZNi(G*sz6#ZN$eEa@$^g)X(af%8k~(Ep#VB z^b@IS>+|Ybzd*xALzpK`2{kDptYX1z)vZg6c&qS>9@QOM5C% zb~Yb#RAqB^faYKK@=ukm2FX>1ZJO!J2Q>@JRINoSNeNI^=i>X?z3%*6m=y0hm{k^8Iz9wjWA!X8ucSpIfcKDXltA;U4IOHWUV`;H4Cc_iPtrBD(z_e?VCwgnH`}-duKk>{{V}c=9Yw= zb57|lq|hF@L2CJ{s~;tY(<9gEByJx4>PzrUi@R?OFRX6RQns}xRUaz<0O4DA#O58k z=&ef8h6B#N-ozw;WY5id=~(w^_O#}eVCF|Pk;3IZkLxQAhy2d3V_@CI+klX?q!oMt zTGy)lY1O*JS9Og^$HKQ2d1VDCNcQ=wr&DytQFQB1r>Jx%wD%AG(STB+?g*`6Wz`nC zo!!lq^_weGDlLZ;k5R{CUOCTm-eQn(_b*Bu8qp(rs`pi;PqbYUN%-U9wRcckDfBK= zk;k=deyV+xk13B(1_YU{ajM`efK+fMpaXbKYstt}W)N-d6dXV>Iqx3TOw^lF?p9Nf zqrms8rOF*bS0E51NvH?H3*|63WPK{jG0JHer3>X21jG+`sEu)gy{mv_CyKOQTc{*K zk=(^bUfP1m21>KVIj%hRP-x**H1~X`c1eX`kBW8X0xreCNF;vI^G>eCX>~;+W11o6 z!?x*C3cUgh2+dn#_hclzcSKuU7wt&*WK$(2XOW+n3LMHC9y5JA0wLBei&;A)3xS&$lA3Do&c(Pwr^s; zqjWK1W2mQ?w+wK zkO=qps%?K_v?G0mTS`h%004QR9Jex}1_VqRaf7q~RB$Va##2eL zL0D|mRIrqvVOIShNJ>>LMPl+rkhpwVOUs8WC)%F;)p_sRDw+V(3Z;Y%mLpt z>YqqF#Cz0%N%)%Xrke4NQJ9||NKiLvSW=TS zIOd0C22a0W2WqlAWo+_yC1B6b#SAp1i6J3BN>O29OdCs67Vae|f;q&|tt=~yQ!BG| zpaei8lf^vSUQSk^Cp2w0ic2w$QK(m>`lKhCORGLvQVE0Y?Lge>cDAbj0Nz0Z262d} zEmNzl*+P&UNtuW}qPgw>S~h9RkEASXcZ{g13m`}!%~Wr0n@e7>6Dm-i{M0VH)xm0B z#fUz~zqM6vHRm2y!s3V|KqQ)>BMbNoRxKd|D%PjlT1uP9AMZ??gs9}q{jpVMb%NST zcfb<^wKz42Ns^O2!TGA+XLFI5NmfV71T88VqYA(|4C15FFL8`gEE~-otVoYL=x4MM@R+VQ0D}-crNi+p33dvEynD6gS z+lK-@U={p(PkIW`@Zw0%0DKBDlw?Fn#P*8k00LjhECNnI98D;1SuF&}IGXdDfQ%n( zNSbgdX@e3}GZ+&=ZK_Z*aG4Rfg{0ubkrm(yN|gc+9jWDnsBZa+ZA(f@Q!+Usm%Fku zX*RviWg=s>3wnhh?QlYmIido#aHW)~MrRZy-a%CH_pSk;+TrR^S4l}pKoU(uIZw)ScNdOpzz=#YEhxC^!U(inPOGlK~tABk`OAn4wfcqDTk#rMl; zlh4n^T4ZV;kzslGN+d}!`+e%QeRb>FosYs^iTNzCnYJ-mk>k7UHW& zLS@hwlkF2x@8Kj!z?>SBdAUH`o+>KoxsnJI`&GE}!l5z8rA6HzN|bpVe)SmipJ6;j zN!^3`N#p(MG2)O;B5*58E2W32C%R!UK7WeI_2hok*;ttQ{{T$V!j!Ne#8r~0jPjaN z1d;&x6vh%xX5YaLP;YXeN{aIX}-7kr?kheJR%yo#qJoQUD|s z2*y3Bw~9zD&8)PgVnkLSDmdi-0Ht{#1rPVEJbfe*OmR>f>QG%xLaPLm`%=*m3C|SF zm69fV`%{gB5$*F&JSwfp!gF{y<~gr!8+&4~Kms$GPSQCdDg|~#TtZNiN~B~{iJ1^_ z#Wn|SX~05p9?&QpQ8Zpt#0Y>+d)8Ror4uCPvX4@C5=CJfg0Tj86dCN9c58UrD5t7rOq7ar#MSk85dZZj^b2>Wu~& zaI0_x1;~$j`eUc{4zr~G9GE&?9nXK z-rTaHPyW@m)csB|SrT=vRPgy`5`Jr4y)BW+<^xMQH%oO^r*ru&E2MQ@LhR)X+S@6` zD1EA7{{RfUQfbYPcs183P#FV7bz|&6iZiCXK($(9)6Xx zEx!`pJXsFIJ$v z(epj|r1grB$4p#0q&5;6Awfq!QB^m*XX);ox?ZPu(o25X#07?Y=ve#HS3ilb3U!7Y zvAyul{H4Se)Y!cSBzyg9>iT^wn}dN1=W;Q_A-|&f7x-xEF0Q!fJugh^j-S-6?VGh} zRu_+?s5r?;*e8%8B71yR=?D0)o6Y|K;sDS7PPXWTbnV+Vtfdz1KEwMSLueRJ@y%Ge zJO2O>yI!8QPMA7Q_fczh>3-;WpCBrKy>Bsv#;krTIoerIs+Z6S=4(WLG5T8Hs5~FM zxJb8Z=FZ`l1;d~Xh@GcDd97&A{v=%t<5GM%*F%_)o0f`4-~QFAd}sVtY5pIyjYvc&M`59|6aqx>E88+{qz?wfFnl)QCB zo0O>wQj$@*P;n* ze4Z<0xBmc$=Yf7ma_2_s)`^q1{5cB$0R5Enq?DgXzr23vouQsr7c^Mit#G zoeOT|uA``0>8WXj-KC`+o6{t#Y~Y!kSIkXe+wD!apMAimuWp@vbAXbill`lG_=EW7 z@Z-dBXQlMVLu!6&7b$dKYRop$LI)^HLX=GZ0H+?>OQ}3Z@S$4Dp4IN}bjRIzx}=sr zqMvXp&uiHu06WTP1}5098%S)W;Pd&x}1Be4eH0T|&y-G3s0P-~f@toM*je>Ih*4kz?M~=(Io$ z<@IZReg`jg8=i&NQK>lc+-p-PNpS@vqyq;(O5fVehxqoLccr= zHN3BUU+KMB_w^gDtJALTE{O9TDnyb#1y)_U=xfJac(JEC`po&rJ5+J;UNN$21m)ga zsQi}WwCoWEZx~vesh?6Kb|fCt$f|y<;QeZxO@(f z@ru!4bFx)qO*Arvx@n=Nt=9;WcE^4yhWx7Ya8LlMuFkxb>BXak5ue_v1-A|QfNoM% z&)$wUxDrZpF0z-ZHl!nRFhJsIn`#X0BN>`#veJa( zg;dsT6KdhxAxZ6n}zY6!Ou%1{REz`=RhS*Lg11(?sWqzf{j;o)wKUQ}3Ot#sPlg(o z=PU)f(FEgH3Xb@6IS02FBfU6n^hT0nE-y(k1Sk*x1xQD z3wAqi=CnvhBLj?72B^acX;?eAVKL2G?VCwrIgfmrkJT(tpmu;yX~t_RPG}WkH(6Tt z`GAEDp;-G+3Ry~uP_7RKtryk~AgC!I<}pxL7R9$DfKS)8EVKZwwbl`OV$f6uJ7eCh z))%O436y|G5PmqSBQAMPNGBPoTU|^g#1*b`3>;#FhXRuJ?%`~`GWt>_c{qx(THT=| zZ1=5KWv{l#0Iw78nw@K@8(Ua(59Y1L1BI%=uDV+v{86S`f<%u002LW^)B(9EbL};+ z?)tBJ+2;rl1d?+>D_ZkRmjK5-sm_e@v^4OK^DCv_P&%S^t}~AG$M~w;AE+7oRZMCi zfOn+EaA>wJ_l@C0(m;XlQW#b81AY*!zHa2nImBj}L+{&eQeROfJIJW-@dczwfTM$m zni}s@T2qnwy@85gU}}IIPF0zXsJcg|%p{IG8ke=}hnR0;pb(%5^-XIvYAEA)3MPJn zhPl<0l$53Q6M+*`WSlATSo{#S()!7#rAlxNOce}$s=L%3dRiV!YXwC<{p(&_YmOup zC2(Rn_^2zbRc<=3F~C6}C*CMsX9=^)H=TH@}()|1MCdc9p=Axae_#kb5M%D z3Sa7AenfIo7Ay$0i=~)x56c1CMZ+usr*VazL zuSgj7sS-oYvpi*3sVfaYscBM@ub?%ot@T^yRuYtwka??i zgzL*GEB(p&s`F_>22i(BBBP!iGnucnx515 zC;+U_B#OwHpkWo-l|yP#m8TQPH0f-aP#*;Q)>~_8c0fEuJR4Nx6+rf?q!3hsg>Y<9 zM#%>U>quG?1zf=U)9$80CNr6uVN2VX9C1)_lw&A&RF;8(@82{7&w-U>PC)je9(Qm( zim(MnT)Yu7N3qRt8;URiLEM#ZBqsp(s9S=9rEcv~mscnVDFn|o0e14qi8(kiS0ZI) zFp$t0T$zId5&r-_wQMx3gLxCO)F0 z-)Kahew1^I^-NFO=7G3ZasbRlSd8B(F2^Vr@YxYjZ@@~R_NhCC%68-CeX1JiK$8`6 zC7q}{LW{aknFEssc&N9O4CHgcsSCx3IXL#Hm)1%4A2q8Jd#o)}ts(#zrM8>{Kj}zL z=@NP4H0Y2xnsLgY(y;UaAy7{=I)EYont9dxjyRfNoXGD`(0eG9+Cse~NI5ix41Hk1N@ie#xF+SA8@mPE3Dlbt%k}O*W8JW_b6f zrUduE#VOcLYI!pl?}}_D7EHua(J>-vFguepBGH`oM%x3nWc?{_VB@@IlWw>IM;ue~ z6p~2hlKyR3j<%r`Nl^weD=C~oIqgVv?NI<8!j-uu5A9NTL%~)qmTgX6woXRiG4-yU z=%-$_vSkdm0+J>`&PTm-M@Fe8{jySGM<%+Hqr+y&DMF=W2+Ux1ub%kAS245~vFIVY zEUBBT%f%;hkW{a7d7u`pL24v!1KJ{|(Ar89xTL|1C{_qy5;)*|eQW08UA?V(z1X0u zH!j>Xf~A6E*iL*zN4K%bUx#&B4NU0k}Z7l7Q+7j6d z0c6f5ud`9)usd#0UgMQjwdson9FJuODfHkS7(N9l0P zkygu_-!yD#U>JcTwKL`1D=N6p{{UVo(CefErO($W412P!jQ$%{)H;pEiFaVa{{SoL zBlBQled;%;KL*Nb%qOS1a^c62qbV1GLVtSSeJUC~Ypt@fy{+vjkAv@52MBFog0Uud z4{G-kb@?>p5ZhigohCPMf4{|QuM7VG0lp2+mDHXh>z->#X@8p27W$i0ZyX3I$sOeT zRg+Ns9{v{e-mX=fdPcE%q!!yz{I;%kwz6eY?jyD;-*lT~BYyItuSp6LX{IdMZeA=E zDP!#uR?mu@*u%WKKU-CQ*sgQPY_6myQ+@`&3oqX3TAiKM#fFl%$}U=KSS1P@4%kwO zDI0*?XTNIFpN!7~KM(#CczJ26_*Jiytgh`0r%r297ilbQJJ%9QAnnOHoN-&tI&F^f zzsjK|dndgA0NT0V@jS(Yctx8-(q<8pjz4<2q45CLxU@%I?#@2s6Lh!fXqlYvkpUOr zUxOcmUb*o0*HY?jN35CZaKJax^MM82;gE!s?ZDnA6XmYp z57RiGwIBFg+Ik6>mdOe!T%@FWWbs>@%poNx1~McVtZuF1ZDE&WXJ{VRpXjx8y*4o0 zaVO+xkI{3&zXok-_g|Z1#OLKOLPJ1q`r@iSBzQGytA_N=Q(aOWQnr3*H!x$EFnlc3*PwRLpT({|F%)eaSo^sbfFby}H!n&N)+uBE1qDEBmeL27=U@Ok@9 zCBByF&3@dtw#o&{+y4M6xiQ+JG>^mky#cEg>N@qNr*`gArjk++Cy6z%`YWt-t9>o| zhS+si2nuaD<~t76l)HVXKCAo8msJQ)f2D0ptD8-7x!mv;UX})GPS%g9T6e9y1M1GH z)rO$QQdw?$(%UKZZT1GOS|5O2VbfhWu9RM@r#W+efYUAoZ2*(rx1URBw$_0+mkp%c zsNfO6`_mn3sA;->v!^?$x`x?Gfm)}%VGggZoS52i{rr~P`aL{M0ENx>KY=eA9C624 z)Vh7w7weT=9zSY})ISCuJJ_}m>U1r!604j~*1D?m#cQS9CfA}g8@)mDBg}C{ErT7V zqwe~1#D1q=pVj?dyDK--Cc@D`C?BmGdfvB8f1NHqRF~y8K}=x${{VH&T|M}9>VBHJ z-`3jZlWeXMmR07+o&goLG=7lMG@C-rySEpq8QxC8^sT{f(cLGe*%Vr73%a`O<;wRN z_o$w!P-9DVMTVOq00~GKinFEbuGUMo?NytnJ&iAOzVGhJ(mLy<7X`N4grM+wimu-v zT&r`UVk&1-d2Zdjr1mf;nu&1>LvCC+NEu3F+ip#IHXCm%G3=#Yydb!yS`ZL1HC|dm zFHX`4nwu9O-I)Z&CZlXw7doMBWaqgODqBS5a3loAqNJ&@x&Rdi@hR|myD+7&1e}T`$bb+vnX1UVgc<}hTBqt z(4?3n=qkCX+xZs<(}Oe&KCC9U;liwH4V}ST1g8dgihAJ)U7|#t!#EUO+aYTpfK+(` zhbak1mOzt;oJBmlYK^Cosan$tK~YyEpZ*nAeFY9x>sw&BcEBKSgdn{U!Y{RydCcrA%19~BnTR3OBNj$)-O!6<_UD5L;{xXr1)om!J~w5w`V zWBIG6Pv3r5TVcd108|q{wNbS6?ND%t?^5mDtv4uf3Ni?f-l$5@4lA9Glf43(hQTBhojew8a? zamf`_)a|yfFbIm+H_RC$Xfuy`sp_`sT2G@jTXx))WrUKc&mFlCG3`tXun#AWY3uZs zfhz|YkBW%%RH8=Hk=*|P6v*wy?OEH5qMp^9ZC|XIkWA3$tNefxrw9P@F-va5+ybqt zKLGZuxzY-}1x2zz;~nCzG3@wCNuZS9P$KFU+rWX^X!~tZOTZwUiTJ2zI#E_`e?+Pz z89&;tJvq{>+_HSfKym?5R|2lGFEn~n8#ch2w$#IEAyEd2Z&YLvu|`iYVzYhIrI(b; zE`@PBTxcsV+m4i9^#YX=C z<@4q5Wzq>T10)ar6eIdo;Dm!Cjyd_Rd>{)>+S?nFZf}ZIr3LZWcc2`-SoIPJKK#*d zbp7+A%m9(ZZN*03X;}Po(T|Yb_%;dMHC#IA?9N&;L; z5t4ZfED(pw7^JD89^GIa>SjFE~m_B7b@*8fxGq6Nuzhw&O}=l@by&F+;l3 zAq8pVd;KfC{8Cf&Eg1z>?kpCN49WUbb2 zW~bQF(gI}|ImJk@&`uD5BR@1UYRD9+jUchLi)K6Ah>=Ckg=6b;G+BsP{3Nl)FEv)WArB zK&X4g2E@Q5;1k-C8}1X?lav+Rz}i>Xh$ooMM7-)xFn#{CW2#8TN@w0`HswK3k(u_* zJ*@y`GMa$8cm=5hXWn~MUBN3DQIBqW(O2u*eL$HoKiYv@%%F_+t88d!v_uL_xTpjG zbC4qx(v%c-$JUnOBipq>& z%@GML!a|5pz>+acEe1>;GZgtMCL)?pCyssVg(z^bl-ANr<3BW&jii$#Q-~oXf`0Uu z;G~`No&^$F048B1&k@>ace}^;r;NmdIiX(tN0B{^SdSP~<*G;k?&fLqBuvjV%11u^ zqMv686mOuH5bUzJh>`uNFg`QxX-*8m??@sHMg=Z`%43ZuQ@5}NpFj#9C)`sB7(CAa zMLx<@J}GXXn#`gQeK0dktU|kQV37DgTTcmOHPX-lzqsBXZECkAQJ=RQ@3eO;G#i_XaJ!`2`xn9MwN@D z+zs9|uVsI){p+RrQyP12nF=sRY(;YJfcKGdg%~*;n(AK{V~?s;BTDUAo7yY3+7e=GYmZhHt*v&g+KQrTwS4vWm4d8{+?C+9{_sE=Iptj113LamXl^ZF*u+*pzA7&tAVkfWl>&A+dVR!*%9?z zC9KDG<^MY$e`+v$Cw-^;m|R9Iy!7^0G`5wk4WLv}q6>{|VN?O!=<)ocZ==}z;z6dA zeu=LguDXmb(VDYkEjqP0Q@^L2*PKp(kNO*q{_5cC)q-`}&XT1U8m?%OD!nCFJiGSq zjvE@w+{ZSRVw|@KE&bcIvn*u)RitJhHeTU%YMwO`_JRCLj&;P?qcX9GGlBWdNclHR zeHEf-e10-OQ9Ko9S{D)JX60_yDBlYURT-|s3;`9vmthWkr zCExVyKGHEhAM#egC2U9PW5!l{Mc}&XVb)Iyt1BiK>c=3|XnMbUae?NYQ9*M-TSle4EebX(A zImTj&|Ge~SDrfR(>yuTmSpt1*C=riVB7rOP)(H|if(LD5JL?UpzKY+$MV}#s)o|<$ z_c#4FIuBUg80x0yk9H`hOJ=NR2-4DSOFVNo8WG6HyNXo19f#=CKt#vFi`Dn`7_>Mw z3JV!qDF5}ZBtHM&p>h;19`K@EfhJYJ&r?iH+Z!AI=b4T-eAsCe#1`; zU#jF`K|JxGM>0B$zx(iVo{vWBRJG!qi^cn>&Q@EyO92bZ#@ACL1@E72M$7t=B?BHAH9A}qO=;<-uW>XCZRKOeVasE+}??`p=zo;)fhoI}v zqe7%D`9l&GhGz9Eak-1+PmME8Cz-iJz9WPNi>J^c%?-K98Wzo}XdAS)H}Jpt^3&)m z|H4IT0hYF)$<|OlhQ4+61dCfO=WY@=nNN8Pjcgq`1%jP~qks*wqklGb0%(`Ds-x-E zI(i#uf^GtLk*U_-z5CQFf*jlnQ+)tHPj_l}&Qn=_QLB!uK^KFUT<6)F;Zso2oxd13 z2@FV!_A^f%yrvcqab+1-l;w&v@))lS*&izQ0RGDa5V3P=`*dO+{4f?kX#(r}4)WC+ zWKsIek-?99KRw`04du6cuR_Cna6N^zzFsiKQZ|_$K=-}wn@7OFnu#>sp=#0%*;R7!zbJ2#hJe2 zt%)&+T;m{x@17WvRMWUsqo9ur3*YzI_wQ{~1!znJ*S0nHEul12qojRA=w|E2mZ>@L z(0m{kZuMn&DVT^I({5fVo?#Pl&B!AuxGHQri!+K&V_khs=4zxxIjGPJx9vj+whTdw zC1k2hG(6K^4g$+qyqvbZ3#&ZmQ-Vg;lxYrjo(Bu5c=W3(#k~M#oWVpGm1k^LHyr=z zZJL>aEGWqR0`m8YU0Ji_{)HWi7%urY-03J(U2AQRiTRRLhxv&s*B}+9sw*A=^7I>E z8V@{PtdMF0z0=^?Jzn+A8D{V1#pX#eh2?60TcV5Os7gMw1U7~5xFip)|p82nJ`HP&% z8WR5Kpbw_uE?Nw;%V{e0|$bqqgB5UIk#G%H?fPw+OX_5;skNzrIaJ5 zYNs%>iG+aLn~qvtK3{23+$u#0ntlbxJ@+A{NxeGjtA}c}hA{~gO`F))bRTJ*2qlp8d8W=)n=$$2WWbvTmjxi4EeLO7~i*Ul9ACRj9u_x!{CPBX53 z)dSfE9FVpFOccHoTID&f+vk2DYTgZ*n-GJNB(AB$D9GWH;_F6s~5Zi3%#| zH^iL|o((L2zU__Q?))m!@FF4MNSZF7Swf>I z>CygFlervWw0IiTOs?YLRkQ+K&WTL~P67f5b;%hfv>H^OdwGIdQU{QUd{(bIz2xwK z3Mw}HRB?TFD(lu-)d!9#hN4D$tfu{Aee0n~be|wc56#FBRLDm39T!0X7pb@o+WQg; z=Go22kBqK?+`#PtZ!`8;SsRGWJtwjuU!!(?HZsbR*_&h5F9jmIm8C)D5HE`iSeza?j#jAeNS+hUW9|3f7U0#;2J?M1Hen!=8r5?9@V4`7M4=o;7#9 zfNT@n%G~smTyaViOv3E=celx?&Y}@gBvPoH)#BJIbU~^eTuob{YQWn6%V~10gW24Y z-4-dC0i$R1foO^Z5&+tY=0(@uN5-ZCse4v{}es9eN|3ZB_6<#t~*2CD^)V~tmU zm1P0BCwnRW2TXcDIt2={O71>+L{Y!1t9QJuWBaS2vnf@XK946HVJR|E<-k#RXcvM68j)KvIB<9#YfWIzl%nc_@|(8bk1 zlj$SgcKiDc=xkj6&HN~b;8E&vbL#`?Y}1aQ9U6Scdo1QJV(h@l^xwz3zvE5YOS9BDX7HUS%`Dq0FqoI zxHBz?bBa#2EZFLin6)%%p;tF!fnOW<@_~R#BmaNTp9(2Gt)etTuPuI7sB6bAnQgMZ z(v7CgTI+at+Vh*i%1X-RI${<`Ub z(k;)bq&;}H>#f@NU`-VtMj}Made~j#I1;&S{3xwqiUeo_zNrn6EkrQ%Z|DR8X#bqh2w$1GE8m%FCDHJw8YZGHcH|)VvqjS4ZzxoAraN zZ97vE*j`r`Plhj)m=;*gUq^S@ewVCSqFH{5Hd{m|7=qbrCpF8>IZMg|RtO9z#80Of ztF!X|G=24FcxGC4TzFjL`0qQBoD_buibsn^VNMSYdAr2$iMW>6xuH?mFv%L+2D-Kvs~=ed5HQA$ve>8H&($PDxggMhmq zY$pQ`VP*iEcyvw7-KztKJuaMg_b?LUuKjMfnrng!(=Z9te)`CBokL-dayMu0F4dEd z-xf9adR;2+E%^JrBc+H~YXn$x0#y8o4b0h@$(Bs6$m*X%^QNufpIlC-DmKjrC)id< z2(y-?G0X#QM?}o#U)9D$q57JaV0EGK6eozN+Zs4;5d6hMxwP|{JTa?kdtePJb#-!3 zXaCOF`+l2rBSk%(FQokzMtASj{^o|OBKlU~1$EZP$~Ai@)_2X_kR<^{FMXxe=g|!# zRGZS zAtr)R>?dlgfY(@(FO}ylcv2@OM(5bMFj;Ca37CX?E_9sDqfENfY$9&f)FWhxbkng! zw5kjB$HtF(Y8YE38(!svmiMh7R~~6{ED9 zz#KJeKvk6>EGd|!CG*jUhKwTG2?`~sMk&tX-%jgODxd$*U&+4PvS|CH*2Ec1Kl>@Q zCf&-AIw3L~u4AX%Ov1YSg#?_bd{NFl-ipW12B^RD`mJVCHA@M;toUrWdh&SIu(XvN z3Q3FMzRrDBlm}yZs7ut4)9m779dD+Tpb^DT<~7`qy3SFMDtfGy~@R=stVZPf!T*m3EXT?{6BF^~c2MBdX}67L1~6Sn zwO@5+2q?oo@C%q24BmS`m}7Yz3(YCO0FKoJErW*o$W9-j}g;P;HpxC_rIw05Op(!7PU)CEn9@Rb!IU zdOJiZS-Ah5TVKIEAO$OSy3XZ|PbdTJLOEsRuJp*syiSN#bYv8n93gML$SFyDV~`iD z-3FIjK&&`ro(>FJ+BGtL_gn3+vddKMSm!3BgrZji1C-s;rCuz(6KIg&?}5||3(G|+ zpMM%P_}k5G#uwsfx2s2WHl&-##Ekhwg7mJ(DdR@keMk}r$$OEvloZaX9YKWatVuS| z%YAgxc6wr+;pdL}Bi(9`vg0*$x@8)e!r?wl#zj)Sq(N^!K}x-g|_;n>yTaVGhIemrb5Z>zU|ZW zR*DFdfzqHVDTn^XUm#1c$2i6MKb%U!;GGt1fx+xJ)rUFOA+$y!QrD4h-=GaECzxap zz&>#MN8xR_d7qs1rSM#d#ym5~FzvhoI35hhx~c(ACyfM&xc#jZOXM&ta*$LDiTYA0 zHjT(i#498lxLz7S2n4#Sf^J~(ww5H%k9>gl16Xo~9m)UShv)=m^yY-QBs5qi!fG{v z4a((|t=cltcQ5`22+4ZR^jlATRi|PPdUu+!huJw}YQx7EYhR)d{=ET&nh~n_KG0A>M*iDSKTG@@<#Q{eBx+PYlb- z9PtZHM=GglOM~+~S*eT(;4ghib?4vFf`;vS@6tp9R&j*cn=7&9=V!Ld-K)fXtjs%< zW5z~Em{f_QSGosUWDJl{G{_vEy*mrv0kDuMn(+57Ltw(%GbbqL|Jb6pp$u#A$jBV~ z&zJ(ewFM*F)&2o$pUU@*u&@E`wj+%Y$elDuurf8wRIG_A)w7T)~V+-IAsBx?~SE=jZ{~h{e?>X;W6*234 zmpZg&R6LvT>ZUfR>B$Voi#t6h#)1xb|M3%D`MC)jKmWHD(+jy)DaR+)E}sSuhW-aY zb~bna7T3v`?kn!tY!MXG**8RTt6nN!d{BfN*UX-iD`vEz|GQ2@wfzrpTBl_HriJvF z`C71KeSJpLuVK$Hs1o%g`>Fv zb{dxF5OV#;BlFl>J(vw?W&?ihcwBEgE-KzPH4lV=xwnVPmm8u}bU*A+5 zzE6LK^R#UpO57y>tS+MEW4l6&9WQVbK)@9E^k_4KNq$M})oKzBsl&84Wh9${8v zYKABMWJgDa$EXss%_B>wZzRHvfA#UzbBgcZHP1bGF-9+QfI_HdpBkD!j!&oN71Hkv z^E~|$uxe{Wp)7i5joPmyzxO&K;no~u%w_a9a@}C58TVZB!}N1u#E62ArG{j~XBsS#DDc}DQhMYP4YV)SI#lJsYc2>rN!XfnX$oiIo zz8Iqa+VCLg$nny$*CEVa%(=MIZIADu^K9@HdBcdfHKb-Xr@&00v$Em-g11lAa02nJ z|8-4drRvakyq>8gQzU6eylFPcvslfi%qO_PVw6XuGETGnM(HKtiE4lP@7sq0q9a=4 zN~3At$k^_5$3G2&!XcuC1@pNcEozG=QRzuv-SuJo>(Q-R<$mThV&odwcVxHl+l^%^ zJ0-6UATHBH>vdlCSt1G2s5G3o8UISKDzHQd!P&3s9=@+Ei>ib+s18&bqQ69HGo5MS z@Mbr?pB-;zZEFu${Ic)aLD>*Pa4)IhH>#c_piO0XWB^QQ3lOJspwI;KDgtOR%r_QG zy)6bSuX81^ms}ub3!dyYimAy)+Wq@mSKi?;SM`%q4g^jhz896Y?*J)h)VnmdO7kt{ zDdh$n;CW4q%!afOKKzqm52V>Fd5D81`cVQ~SJljNuUOTpTWTwd!=j(4-N%B*hdMs1 zO+o`C2kbY~evEX}M{`|>lr&%c@5>E!c>F^VsVm;T#-6X#HNF^|0C1n=W7d5)D2To9 z_CRf;NlXaEK>>B1&NIA|y;(1HjV>Bn#alFu7*Wb+B4&+x!|jbA|3$D`(?PZ&iC;w4 zGGAtaS+mv*dZyA7B`a4cov(78!pp~~*TPv3U193{zL|oH^9e#?jkNiH>Yl1!K&LNQ z%cn^hgoDaM6~{zr!>C2;IlUAYVTM445X=T_8Mtj4sQC>s)K?V{$OFjeM`dcTuPEchRzzFPTS3P@R05H`yk~bFwlT%f- z<&!!lR$E%0e|Z2l@N~PfmQYd6WD)WzR%f_(Eio)J~6aONMH8iM(?=H8lEPqm|FwvO0U;hL`-QS9q?yuiRh6 z*Wm&Z^LA^lETPdy*^#L{vB6WXG71ah#SI&hs13Nu3>U=MAaM}n7rqdsi5KLqgSB2n ztfiTbH=}RSpw=n|uTs3?>?WIAi%tX$A)<_4EXz?xqte`ae*a_(P(lbob1=MRWo6-2 z`Ju+Dj5&MnT}7TZQZaSRz-Nv@BcK8LIr4Qo){iwUhf7IGYSF{ds#(M&s;e)7p5di& z?euqW2xk+{udeTd)GMX2~b4 z8-bd~Xg`8V3-9*gw($k4#}z#7-fFarbRxe$f>laZ<|6mSk5X}&H)h6_HSiQhx%7wz zl8iuDxc#xI*K$U~8#!UD1zHP@B=+Y@+1&M$jN{74H8`p%G9-w|6Q#I&ND`b&|JCB61N|1RBP@e=hKDReO0kHoFYR7Xod` zp#REETNpYF;>}O!OPfoFYay8?;GGI@J2DDYkj$)*t3u0dRUw;D^CSR(K&lcgSonJ` zF)~x`lB2PkwVOEPs2Cx!P7#x>Vl0Ug20>NrYLUyrO8fmS6I&f=lIJxfU+9hFkjzMy zvvK;vVG7lOfJ+>)6;+I5l4MbBnCZY0iZmsp>8CP%P9Xzd1Rk<+_8Zy6@BQpe+LaA1If#reI=f^04i;Y(Mhl*rNmE3+c94735 zxi8-wsb$UX=JtM~kWZOv?C^oG%f+y5{s0z8$-eFwNsKbH8rc!SHn-awNr_EgF*{*J z@7E)#6$8q|#ew;fq;l0QEd33T?l77B?g)$%S=#4)!}dVnDJ6 zB%gFOP@9IvlCZog>+3C-rD$kqQqTSeCx$_%2NRp5{3vr4E0Wi0eOP1B%*)&Xx=%g6 z+8$~wMcS?KxfXm+U3+WrFYc&FIpJ)CZ&u;b3o3InHVK14iCsfqo_7Xfk9Pn7x(7ef ze6^qgWS}-8;e-jY_BI6-AI3idP^SlN_g)Gmf>U zPV%@z$7U9h{AyMZ#~8I5K>smjWH=!)9TV+S1fUyHDcy7%O0&z#TzU=h0IVkktU^lu z)Cjzd?+OCv@9nzgj?teF{g%+aF&-(g;hVb!stuoYFK0;wPv-6n`zPy2yskC1wP4aH?F-7upb@;&vB4B5woL{eB= zLiK$raTb6xIe$yygv&CkMv_W6L=Ch?a)Qo{rK=8it|ZkRD~jml@vLB^ddOy`b@Et76iu71oii2=U0#e(!G3c5MbOHT+ZK@!-@f357)=q%-TL z+nkxT%u+aGn7XaSwjaf1=wcm8+P&}LVA@%Wv*DR_mFDd_%rB?BQ%s^g`jONlxR*(1 z(`rA`%$9|p_s{SBdiw_>Lob8l8Hckd9s2q`OidW}clz>w&s?^dG+FFC=k55@t^C{7Vg4aXy(prVqovdpLgIL+v-eaj{O-$$QyNTHXn&YdxA|ke z`D$W!7o&7*+4%O?!Y`${!behvjUNsbl;lSRa{lRmRCd;OsI<;AK77IW;#sRd`HWFy zZU9)*T)efU(t9?!IN%~2i%K5;hso`(eP_N8&in&B6449KTL*``oZaSr_56;L($V@k zJ=$LTjGxzGJM1v=1Je_GVvWxPxA8AFrimmU zpGo?Av2bf#>;K|uc!ZI+UEVY)ZEDT9)xP1f%>n6cbYel53aIrwuwcuLv%!auYQI(dYN?i+Ox3`ZW)>bqHRWgxo=6~%%(YSPN7AhFtZBb!5HChO4oBwfE5>!sfkMa>9bnQ0w zf?7Lz?Yb%+YY<6f68pEt^X>fq1B^eKt4)Ab2cAL3Xiom!3O=W6+yEt;k zxbUmv=I>iQ%agb&wOwozXN1YVRSYcDpi5K@tAd(4U{yLMOk)iVSv7`-LEnCo0RwZgP#0htFVUN&m{YqW026)%~r7#GzFPh=%w70P+pDimLh4F{NE2 z@hu+u%EbjS0M4uf8C%YPizoogxc0tNa2ak-Am!jD?j6n!YXV`hX5z%7)MUl1xbLsQ z^g7Bi9F)$8?w|&4cU_%f5pVse@VWZ)T)px2bKvlab=t>wF1WTORkMwJMvu=-EJO}PDU ziO0ISbHXi~Gd@pH4b^M-5bP|QD6qe>hlqjbNww>)73;}74*TJ5B5KeaaEc<)NSm{n zx}SR7R#}Yq@|_5-`c<-nq-Znd5T!~-zJ2~pWHXo-=UI#zpyeg-Mz)>GdP-FSeM^L zba3;lL>adS%3QrSP6Ud+cX@oIpTS9wkvxSKBMaQL1lyDjget7gbIAC1lHS=`k2*1t zLN@E@W!8hDDZUDFk8|sbQ$2IzEyLf76jUx#o=a6Fhkk)X>DagOH`jBpH$7#e2&f^R z7*ALY{Byo8rkKtwx~dh252w%XcZVfYNRDx+YpA77lUV5On` zYnstgD+$?%h_!Um8V+`*`Y*GG-gTWw8^;*S7@BSCqAcCb= zGUlZ4Y|8pNadAxKqhAxc_{bH+VCu%U%FQG(BPJmS5Js5C1_xa)_e)zBeygBS?(T_(vPN5tOQ7D-I(W@SAXS- zD{AE#3*@q_WS^+&4fdfosAjPS1!!Z_be*&Q-Ld%};J}ycNR2CdsHfq@KN4zwko-|w zF_A}053U};QbNo=JF2Relzrn#iH7cmctCg>a##wgf`K%~dtz2=QLS>iBt%kaT*s7- zvyRhPiM(`M-pr7o-GhhhWqC6%%LG(E6NYzl?ZK-smIjjsHcL@YRlEoSJ$J1U2r$4b zHu+sM>Tgf})ri2;?k4Y$He?Vkk5Dh2p2?0i*X&P6>awz=kw22Ek2snnq=8LyM%7}X zBu~z(upbfpY6@YSxsGu1-*w3|NUj87I{IG4VW3ke{oFHajZJxO7BzVc8nxBFl)ah1 z0N>l5hBWZr{)6RlEkzLPdmbLwBPPNm<;AV$x4;zSPnbqjc3)@?%MK1JDJY3Fc8d!E zNnRFa8Vd`0s$PyuZ3?JOd{VmQ_HZg4zs(H%TmU&m_*ok z0{v`&24AY4b_uAayAk)>X&oKlQk$q0Z*zOQCllzW9ct+juInb&ll=)9c7q}NNAD}y z!MoAMeOT2$lIDeDUUgko{r=|6tpEX7rB^1n3dqT^@D5}?NOd?BbHL8*)?kmfJVS@? zZgfawmiiiAnPc$~_N4K_O%x&{l=@Y7FBLJPR6_UU6_@3s2D7j33wcOO5x;yum~;7e ztE9vL_y6BCH z8!5{dHij%##-U~CEI;CTbUs;@S|^7IZ`gZi`yKUAq;S3sYp8zM!3QC05h?+vG|dOc zrlcA#2btGXZeAMpodmdaFv?ZYrhwlD87zVGNT>=VjTxl3muf6ZUtE;^WJhO{#=i`M zrWy@WTzbO58iUZ+UL(ixhZw>DM<{5_hewmiBQ9hf;9?w>@ z6!L&+$A+tmj8Ga0Tdgut9a%?8H8C6g#*=lRp*|6T@T%tbzJ()Nki?|^UqORZT0tW( z;896JvDv==&A^aGebs3iHx5-FchohVM5rqzlY(Q4s5##Bq0`^HUD6hX!91&~$S|ny zp5Gp$9DWM}GvunRkVF=VTXJ?rMIbj?l`HEv=PO+{PZnX^YyI6V_F=-g5L{lcFr(c7 z2M{Lri|_i;Pq70KO{`+Zd!{x+yUWTd04$4!G2Uig7>i9c5o$RN{!c63XPR$2^uG}W zn|RVJ$u!u|6MiR;#Bs52R7(f)=<$wBGVjmc+7I?q_sxC~48tZKW8f1z_i9-oOc%8$ zcKi}@$A3j_lL;N;L+b~z+Bj~riLcK+LsB#UaV|H?MS^tf2%mds=LYVE8{Pqn|xAWV$+}C>wweG_Gw|w~IKbuN3l$qmHAf#8mM4;BLErEf|6Ymt-ztxsx*OTuLXwArF>gnGRm~fFXBw>!k67`9`}K*& zrJt`Fic*CJ%K710$#6d4J2ymg<{*|!tb ztnAcN!go}F)CKhEH}oQ2Rn5J}NIf#+c=DU3%AcD0L#XFTg4OD#Syfi`H$V=fM7U`3e>QKNM+fH{8kVVC*Q91~ z5oaHky05Cc91Ztx0sPOca+I-KpT}7w2h4#%?Lp%oQtrdo)x?^ZBmUyfY^!l2wpS$m z6UF7x3r?=)VypXYiEbZTt4PC|DWw(H%H8o6HWk*%bJv1xz9`0f<`X`ausMPIMI{GVO>dl+5hs=XQzdyES$ zT!hZFBtv4Y@wl`DHN<4Ev|Cksb@QtLskiiqAhkCa^@@=nk;;}xBL8gc#=LNDxOb?- zy5RyaUv09M4UzZtL9#E+rk~il^(wg=w%^acRS}@0k4DKV#!5vE1B;Au7i0<@BTD`o ze|N;7x-7vku7%~3+W-!JWhjh2I1CkOiJ!`SYBdca(aBW)jv}k}JfbLEnz3uYV=QdW zbgFToTwPYF7q)QWB)f~t7J5iV{HLz=*CXOh?qZkY{Svns{z_N#M!Wo431ho2Cv}}> zT6J-#jYVIiAkycFYL#ndm>L zKg|zuN?N(o*09{7Q$|+-W9gnlybjASZxSB*QjQJRW^XX6uemigK_ks`V<@G=4vO_? z+gfCSCA6m|eM=rczrVLiurw41!fQ=GkNvuTr&h_>>$dmp&n3U?I7Z4|jq}tBi!KJm zNWhRcYVN+de?SGoEWB@_o=*(g)XsEfzTxKX26ulBb5^q2R$3pQ}KTzwgy;)#QeLk>@P)BdU;YO2K}^a1efWFpn?ODBxL-d z$O<+FH@g}Di@eb#{`^^|^^0X@BsH9}wEe1%yE#swVV-sT6Vh0vNYs^*&Bo`u@8|;% zH6-fD>~-!su!&TlZUQn6&1H|Ojl^qRbpF!csBmEy;I}_<4%kzgYewEGm_vRNS`T3GY6QXnb zMgVW?=hd>J6G}T+Pnx=(ho{QlEn6|)_C{>TT(hiW3}(5)07Qyre}`yw>tQkTX?LAJ zft7ct%kk4w=A+h7v)ADp%66oxgAVR~`fm3<)xLjq2bPhIth%cO952iD5oI_zM9|XP z_j;rJZidldO|gNI$7V$47E-XRb@9e1tsR~o;$1aHSLV2zyJ?~d&SIpHv~?v*Ai9Lw z`Xr360;rY|O!;6fxbvzHshSEII~xrq6Koec+u9Pvltt>wxg-ZocyICv!KD_B5aAm{ zv@C+5iJ2T_9{Sr8-_tOj-*BD86(t{&8JBh}uxc>Df=eT20$L^2<0yAoc~k(>pW)y( zNfs*;Cicitp@LV)`(8%#ZCn~h>!(^Y8Zp;F>%+ULAjD7L4H{wdF@a~lH5Tj%SGv(; zx>X!f&K7JdDenXuM6{ynkB(`l(xJeDtrAxxZkLpmXRc5swQQ1u(A`E%2hiGWN#FPT zNjMUIXmo`T0-hz5%vq_&xs|JQe4`c#zN|{-b@?D)LoQ)brpvx}Sua+Wq5DgOv`*$G zd*Nlaaqh5g3Y6P0ouA93xNOMj^4jEWMvlEYpKw&SdZ?~SCf{XQ2GHZ~NNlGTDrHy0 zS51z&e&DlfWh1u=kj=Sr+3JBwWs0}S+R}(?pYEgBI4BOw(5tl~I*)SV{fg#{={5#$ zHA^!d<{Rlc-u@ta6RYPY0u7C)&PFrvRI{k`{9XpaB&E(K%5tt_(_6J|dQkny6>`bQ zOXwj?)*wV*RZxzN&)X;8BvUdHCM)ZvJ3urtg`@yxTH&}DXHF$y&2hs!5m zMUpgkK8gfFoIpuQ;XA1Q9J!>gNsmm0^BLq#t{ZpreGzwcP@?Bk{iI8sZx~%5+D*zm>-I z8NY)8Zv4R}G4>+nMz!^UclJ{ayogDK+5<>Ff<@cQmoGkVcrpRado5D@sk!8j_oi($lY-!FfC`D1*J7R9Hl!{RPZSCSJpEgu3&bdDRD{s)cx-l_H$#>(#{Wl;UJQHr86daRWKKQc!4zn}B zVJ41Ip*MS9@QAW7j z*eD6Nft-4_0jkZ&W~KuhUMthR>X0|L^4m4-2yUiR;-uQv7&i}{1K97m_{9|N<(5P; zQ)qi(%(WMepYvpkX*u?~4C5y*ed-fGEw_$(U_!!<eD$N6x>UD6Xz^I7SK3)3S(GW z-EUu98vO(^`cl{_N$6->(n*DSs@bt-P%WRBHnIL(dul+F)3$fct7`y8)KR=zdfIG1 z=n12Xq~4_v{qkrO>eafmu_`t?D}`;hG{~JL6g2qS^#F`0h_) zxZe@~oy&cao47mEBw%K}yVE?6QUz7rs?jZ7*Xn7^RKx!RY?)F1w)^bYea6=rYJ&Fo zS&V*78S3JxPw((P@K4L;@k?}`b($1uNMz}n_9ot@u@WrXqm*f!&Ew!61~rx|IVy*DmP#sp&Y{ajjTCkuDY62 zGv{q%K($YlJj*ZmhsyUS{|s8XsK{Hu9Dl)Ef9ebjDwfVr1|>)k%1MhlbVfSsuh$pL zoJY`!Q`fpMQvvdAKHZAu-kC(Ut)VY|i%0CO_^l_iKRl~HJkEEoj_=h(KdfFPn@ALdUY@L9=?sC*w zs#&y&zmFsD0Fedq{l*l}g_#_>y6e2Lcy>`Fx4H4q_FexInc!BErSO&SthN3ekTdewnC?t^%;Sk zW-P`DYZ7I})O30BB?B{$e3OHx3Q~5JTf!T&-#Mui4+}^d^-ASEoyDfUl6+{zl>7p3 z?DxKw-(#YX&dNdx{Vs}~gN_qsZxX%T<$D?LqcYpjMt@mwGeKS1OnM({{~H44-F+Vp7T zzs%<(B+}Ml0AjK-0`sOh^7(wuCJSI(H8x#LC8lF$3ATu~u^q21u3>#$LB%@_l~q%I zbEJ*&i1DgWU>^iJ*iC4OdOljZTTnXvo0)Xom*v#>5rfea*QR)nVlXL)WqGaa%UJ08 z{KIcXOONMMS`>g_r?iA+bMrq>HX9n>E?IU2@I(THC9R{^ZtsebgX8F@98YY>aEG#1 zN;5B(m2og`Mu#rr{zbn*RKbkemQqjvH8ZNxTsNj9pc_Rc6!k z%thtVpBUZ}4kN6DfLBLG&lSL;l)ZOG|5==8W#!lL&*oZfd&AuzSAV6We^@9cmYaJ$ zDAQhx4Y-wOVZSl#LTM}xYdo=uT_=QUw`xAI6>(b@F6`+M-=l0_sxQO07&8 zzMg$Hv*kIHb&SN@*ckkM8~4Mptr&LAjE9n}ZX#O&7oYA?AB2 zR-2T()bv&VU2yMA5;Dru&gbTS6lASo=3N9zwSXJ zKMBEk2K2LGR0^7++_#fK>%sci5-K4p56 z%wRMg$?_Rv)YUQsFli|6PTf9JA)5mc5ihodlx{W|ycZ7z97{4^(z&revY;aEUHQNw{13JzTnO!7)aE zSlw}mSi6KP8Mu_1m#G6W_u@7r z4yq`b9fV;+LyN);XX;`o>t=xzH3V0Z+W@+D#)XP2M%)QB;rxy|Wynn*_X2{OHp$mb znLX>zUfK>!o6DUArn#(4-#z@8!aZ-CwwwM|?>g%vzk{BWT|&~Cb#_VcL)PX58`iV6 z$Xlb>HwOkE1`$gjmA`}?_Jm9}A?F+z0IN%DsF1Ah0-GUAnYt43TDQ|=Z6Q>V)nb)wz+stx;qb^^*OYznbE)nd6-%#`~)$nxc9mx5l6Wx)y3 z!%6gwqLXpx-`(6iLq;~1JL&v z%O66Fm~+^vk5sL(s^%>-$)eOkFv@+D*NCqzV1rflA+rh}MvZT=w-Ow%ZLBBuGqp+{ zG9RG!e-xdEJDcy@#)H_SMkuw3k*L-lwPHuCh}g7hCq|8;C^cKuOw3R-NUW+_HCogj zrB>~>iWUvu)@o_{d-MJSIi4fO{XEBYpVxVQ&h!dq&M-q*Xu@cIXO9`Zea)KcV7gXlz9xTN zel{a2Ra+F>9?l-$_5R*97mUnZ#bFz5wWYQB3pv~TWIT#eJTM@N@i5&xF zbhfWv6b`xP88Dfx?A3QziO69hbdxvSNn&dZ16nZfsL;Zr6ld>)ugHDlwR>0Z<=|rL zzmV@VSi=GWT;7Qq(1x<>I+n}5HKn=vF2J&SqG?|(65APm)gjfdkzcF-pTEl@0;IL#P&q~nWK>c|3{;$Nq&PNY1b8u z7Vrw%DiEULhkFdi#kiFj38#OpUCs&$9xpyuTajO=yzxO{#p4OL!>6P)TWNXahFmrZSiAt%eHin$9Gnp%Gf^duAh+B9}0=g78XQzZ`U+vYW? z`1T-9v%mHEEw6EC2rcUA-OkNe^$ zmX@$tD~t$Knfdu_jzgJ?&^D{VO4JG^t4{244D0(=R)Lv5!M z1GF^#N2g?pIDI^bjrnZI?)|rWEU8*$7}x7_JtE#zQ(Z$M`hhP>t;~!a{4_kKk zyA|#Viks1Owi{rA!wnD$5*G6Vw5v$fwe&Zyzblj`HhZ=$2!4Y+m}1@~_D=7}!V;-8 zy{AjU>>7Y#$<3G8O_+0F#jtR6P1IEDY6VaE@5_bej`3?)PLoA(MMeRM3jQdETj|PO zOrsb=%fX~G<$bR~0Sz#+!3CPw3=e6rJ5hNg)=K1#omr|Zh>!2GDT0XE75}IA7L-q` zpk?g96WFC$q$qQs^3GCr3|qBNelq@BY}k}yHdUsG>aGq8-r@s@6{TmQV#Oka53o0r zZ)%cNj?Gfki-B`!{PK?l#y0cpAy7fzfAB6okF)&eord^ae*+siexOGM_sS4GY zofI|F%kIL?zzbX+=>@$nmNp&W4=`IlZ_-6a5YL7a+Le4Myss##49&}iq}w0`)9BBv z<~6Ig3KLUNY{aDDpgUKz-QrdPF{|n00sX)RA$yaTb*g8(H}$Lb#oq>$HWvhbg8$b3 zgU)OiA1c0FG&EZ(?&}QNd6Lsoxnhg@?nbM>?)7jws&K^li~sD%fBpp-@wewT!pqm74`px^a{_5YSeiAv`q?bg!G)0KKx;J zj1Ch!->oX{Wne-MbDoYH8pCG#x&1nN@*wBs4pJu4G!-{QtrmGjbh02%pHeEei!wx` zX&kt#c%h6691^%s^NECop1SyQqW^vamMqnCu+#+vy)OeBD zU+i~e4Aget&_H7MCl!`!ym6ZcD0e{M+dA{rxm<`jl6MmR=Wn8;DwL8!T5@1MC>fTE zjH(a{_jk}~n2;$h9&M=|^!oI}es!Zk+RXJ&-bxPHwY=s*T@i4gCT}cF^$1z!eolzk zPKQ(hM`G+@{G)UfbDknSP!3vJq9;NrKE5}$N}>df?+l=4D*9E&T(%xrBgG>5p;)IO z&Fv+>IfmJW(+q%~E(y6X`a+pDT~)CL=3qmTr8;mxGtiSB6`pFp!@T5#>=5(Ssz}+Q zA)ma*=?k<*)7+=cW2MG)Eed7#Qm8z%eU_;iPph?p1$-CRdU2y}X8d@WvH?A(rc4`J zZ47BF0pQR|5EFt`qd4d3y*R^wvuX%vFt?QA#{(<>LaE2SIWR^I(y}YMkRj#D!%yMg zy#z>KZ9D7~82do(G7(`zvknaim#?@eJ=IV>chZE}xS_J#!*l#e_0tqc!st?Ri@wbU zw=w^*sn?i-PW^4>a8Sox5~}H^RTyZJI3+Z!VKs*?vsSivuBoX4Lw(6j&dYM2>GKWd z)NB+ZaeIU?w##~L8yy=VuiU>xWcdo&_VY5=uEDbFqN8E`)3O(MmmssV94(gOw$;bU zbP32bI z_|eUHP|#;@09X3`ie!A2q{?K7f={`lpr(Y@Fl)=JUa{M#95ScABFMNQ&7O%CUMq~h z7#Fj}*!U%C`BWvP(9;^c^-Y0-@?kliouJhc0RAX}Vo)=uuc#z}x&1Kqh564h`(#S6 zsY)v4*eGB81(e&5;kM4q%&P3{WsrKVGz3M<;x8h{I@!f+hERAQvT(Eb&AzXs@ZLQS zyH1L})J9z*_`KSaW}-=QOx2G_Hn12k8n46OaIc5|uFTp2-^54&jpZ5CxvTOc7)s!D z|CRo3l6$f@V*G5=i`*heNr;~rxi*Zsxw(7THTUR6>Af*tc z*M1)+((zC}M+^9H@XN*cMR(-RyFq;G*1CneU7`Zpt*{0oGk2}3$v6EESWpIC*29=U ziN(Y0B^Jt>@1?C&Xqo)X96)Az(7%9ZxsluSuT>9=2=R3VX4;#HbhSLb1L-f6GIq@AlyI*%>fr z*WDCL4J}p9N4t%i%j2 z;=`H zHKT%%3pJl2*hgqaC6Zo#XfEw^OKJkj@*@iLwe6Fmg|9zU0c+jSPJEib_phxtbmiXf zr_M(I$~+H{NezE?w#h&e6E)cC5ZK&KuhgKGqL!wR1V9+mMa9V{Ak?nrUKnL#Tl<$D zii;KYY&lE@RYrV15hLX?czrpr=L-^Yq)C}##vk!MS8393Xz;!jA@z&@i{j{!?L|Zd zaV7s14KhmA*`2z|_PzLaItqjUVfi*TQ$h-i|_i0>4 zK8Fk>DLn6tCLZYIzepGqBvE?Dj&0s##MVEF^ux!A6*15UG~E^sUj%@pdC(u4KqWP= zI)RBYyk?aH6YKZ1>;+!B><2=D@nTfuk=y-N`Nl-_i)8#MiCtDg%Hs-EHI$4y$Xp{y z8KsKtR&ED_H1H{`3s-%Ubys1m^S$1d@`xK?CbPKYX|AIVaL zVGOa4D@Qpa%ADZ?@EMBT?bbKT_O0>0qN0eFz4J%!S4*Qk(}o=`(l;E;9O{A@Dahrw zZe7wrBWRIlB>6RC#SxA2Equ+YMqy&QlAR1l>S^Q4nC&Jotw&6l!&5iO81~)?J!juN zf>&n8s%eqqg_X(*(>jq(g621g-I%2(){4EQ6o6g1KiEX+-_Ae_E`4)rdb`dqW~CMO z_W)AuztkUmoey-?Vl~d!Q4Da`M#!hGyX)qR&pKENMlIaE&;IhQeaI-Vq8^3s=dyLi z!((ib2Kt7+nx$j^AcuSh(4N$87V5a#*=o)_CJB`k8`c+xINLG!=qqn#QuWf#8+2yS z<-C5bW1F*k^lEw}1F;`j3jsdYCBi6eyn?r_@zJfoBpcQU28p`pRNBur+>DzIh}>Mw zEq_nzn5*TB>CrzooLe8%j!QXCYa1k55Pj1{#PU5%bWi@{g<+(EfkUJ1;3g=S5NfH^ zf|Fg%C@xoZ!fe73JTN{AI=<3WLz|x~GV-`|v=fU|9@je~8L@lGlV?R_-25gjnQAwGmf1GDT9%m>Ku#|`vV;et5SZ3C*dc~ z;G2+h%uPF?D&+G>=gX-Y4lx{amOtNy?N?avcY70K^v6DRc9>HT*Vwb9BU#%nbPQtN!olK%y5X_|jgL-I7(G<~B*EzMZu1 zE%Jmf*pndr)@RJ#2^Lz`v%uRH|A6;O2#Fh1oM^&JF?7Sy%%=opgizx*F@PLc#;{A4 z1S5;<(S6GFXXv^aH7iFK5_1u+tWj~}c}}|-IQHAs=eY{`rH@px8W<{z{F*{&X54pX zh->LNY3=Ebx9zItKR@;75$>|Z1EjA(d1UJ4bp*N{oc~PirGSy^CPZKZpPm)BhX7jO zFzxc@f1R?!K)0s8uC+8Y`aAPkye!Ey*5Z#1=EQRYhPnYShvL{ z9Vt2jP-ADHe322aYm_m|b2A%}xmdDRT`ps~YyT%(tj&~(r4@qCSn46a>NY1#L2f8l zxomTBTdswR$0(3yCt6>d>Bze6*$6;UtW~_PQcQBk^>Yh|y!?s4hCC1I6gh||k^e2|h zJ23||t*kyMTV!pzQ}Q%hR$nO0UTe5^WWcB&YzN6_ZD`jB+o!rYA4+^DTKxpDnYgs3qj1Y~#5iAjv@)bVeJZrb1spB{nu4ZRa)It_K$W7}C{oVDg_>Ob*%#GhFXA?~>Sxp{PM|!buZ$8VNFzN1(_3 zjO(@(B8i)gd8>keqOk^psVZ{cA<6@y;Mt{`(%|6*jUu?MdN)?;R)ktiTdfW{n+gA5 z+^lHII#2Z4ZER}IlR23>7ea0B4_Ic<7Qb?0-?sRJ)~a78oo&?~;k5CbOxddyOA%!Z zmSJ#WC?_on4R+@k$=grIXN(3xh*!{w%7_pbBQup7vNRQsLu~LkWl&;EGtfg?qmc|I zl2PtIgvmHbNO_H7JjyVQd8nIsp`UA=BJR1EP2iQ3Y&%x@Z#=E+3K#M}Er@5Tk;->D zEKH2UuV528L_@clz>iE4u1d|<7p&XGxnSSkj*%&UwN6dDQEv%yS+pSx8h;POSu6lv zA}6(!0Wmgwn#d0~OBUfE$Zp{)!Q>26jYg@D`?N5vurkPQ@v1w2f9RwR?T;35bz3BZKcD2{l8e7*nGe1CX$TCZz>a*VL zTTf_TZEM;SbWk!KM!jDQ!18^awlN%&nYHq5H_>X8bVM}`uHPLhL$eKA#HtCa83sZF z@6WrJLWKPr+pXX6t~AjPO1bO;7%H1p)x%Bsg7Vv!=4Bl`%bcYL9i&Y z46Eb(6ZDhf3WU6w+csJ}qv=esj=C|}va0#;e}EJFiu}sk`QWYCZ%-#1N^<1iC>1Q> z6Rl+q(8H%;vR!sPt)OCNq!mbaVfwiZ)fi_R^xDx82qp!tV_kI$qnn%-WA2Z;s3YJg znT144YHlY}&mn5f6#4j>`;IC2&ur>qP(jeOo>*d(*LT-`RNM*Fp>DsXe-V!fc?AuP z`kn4F2{)oSZ0W;X*Zl3C_VZH;a7?rI#;p|fPG$@rIdH_2Nf2?sF0A``(U~kc<2PVn z6tY^~ZiqddSLf^aT-E<>Q9uRQ{mRlGHa>ugZaVsvp9DAV8-AI@0#$$$o>y9R|A<)U zC8gSI7m?-tN#FkmxUsr|c$;ik(u!5v`Z---yqLA9QQZ!QCZU!zygmm9E!Qj!P1M5K^xrUEpWQ^9w!oG8_$zc2A?<@fIj;A=3wHOq=X4rcsX59p&!{&l4y!{x$cO$ z4CH>+udg`p9h>`fp^@1b6?AMVh_(Pya;&uMSk7!hc4$}_%S=^UZwlEKc>8C7zg`kP z+>?vlpR4@mS2R%1t-k2(mMmCB74%j!C#1bXV?MMy7zmj-a|?hhLLShl^^O5cNe ziI>b`7sEfW1oGs&#e@Wt$HeuH>~2?dsb6^-F>u-zBrndJ6HvEdK>0q%#4M#3U}r^{JD7tjbA9|5Nq$|uXy9F$%IVQ?5v6{`;K`58 zwv(pbxoUDw8@W$W_P*4MJqM2mgp#iR0p{9RbLl1L2-$N19j^H|LjhE;!?1iLYxvuM z?0t|BKI2il<9!d)`pmopZ^!#vb1LUdtJ(Sp{Ubv1>+S%RebDgX%IwoY?s)1*!=a?;I?AD%Sw(tBzXR{o0CYaBk??uw@pw$~K= zomO1_2S6iWz-{}{J+*So5^7E#@oq6bipw7C$1Vo_VfJbPoo(Y zw8V_0HBEBg;h+eO6!J6>MlI8@Dc+LEe367j9@*Vb710TjKj($+3t={GO77vZ7PqQ2kHnD>7lfWAGOx)lcMTZK| zdSjncC$WnRkoL^Nuzo_oepe|Zb5`bB^j77YzT&UTfQ~Zb$S0+jD70jfqB-@VFkps! zC!_sAmbhYc(V%@^wot_^bWR-j4r}hcL4VgqLUFaVSomEC?~Xyn)QH@;PG7w|oW;{* zU&quW5b%8iTdcRKsM;VHMOYOa^s%Jqah>D%aJGR;R4e~{hj zptGCJ$m$N7B4w2Q>MvULj8DwcX zl#0eF8m#-9WypHsRpEbj_8B6ZHESJ6ZU#78o+H~ccdg261?p;zh28J(RA^=~gxOtA z+nC!pI`=I2pIdji5zppR#;;Lhck#iV$J$M9O6PA1({a6$Pn_<_B}pqA_#->|?vT-Voq_{P z^>)~ASyR3mQJV`(j<4&(d|g{l?&sh+l>zB72r3Y|UKkY`hv`COuvx3@cY?-&GuV6B z1aJaq0Pzaa4z>!#qx-+!0IxCl^#xG2OYa&m~T5?j4Iiji2#K ziuRtEr3aWU=fT`>-_VWN_&VgLR~h6^Bpy!XawX3`1)X z+n~jR9fM}}hiRi#7stZA3Z-QToB=!h8iu{py)=(PQ6-W)!6-bE zsM*mEgL6`Ske_+lcu>&fihQBe(aox6dtAHFsOT^qeTi(T$tsigU<}@oF2mSE-zH6u z2VtgtcBb-^wvl_y;(C25Jscq`kfmsO>w9uu#8=gRoC4iW|wryDr`!5BF9?W(#!!K*~tgzKQtA$T#XSHkh!JHPBzF=SN z*+A2Ng!dxgY{LHl zU18jiGenNQGDBJDbf@4AUa!>3^=m~Y|Ha>s5(5sL4|A`6Xn_$m`Z3yck_^31X7iHC zw5HQ$TCI8g&OQ3m4pu?yP37if-1qE-IN3l`$IhOXKhq5Y^Ec7KoGY9`hR>{bE2Lr!D+cuTEc(dM-SyX#nQaFiz(+;4 zS1;_6nt7$*hF=uBp^EZ~K@aDu`0{Cq`4(v;|21iV@$CVj75AFSl1|vexV%x7)1HE> zlUJ=YYL`Cj0k-1ZR@+%qx<=*{BFg=?;@|Yz-UO-wDv@oY!(s7fZtYHGhU#g@Ma=9~ z2DQM{F_O%4+-fgH2kII}ycETz`=f2bZ@WBIawl3?vQZ}T@7E~RwC0y4AH&q?u=>D2 z7B>dUhd0_49VLVsVr19GPU@3C&*R&N@d)y^elT~r^xCP*1+5x4#--b@GvzJReZ5v zo4Se+khUP&8m1s!{k-o)8|?j;vX)$V*GMj8n;Jh=$;x`EF8oPv$DghwQGGN=Wr(@%m(+3s{BEzD#h1|LH(_6?-sURQm5YVU zC;7kax{dPUN=LALq@EW;ZOg1OZKGK59qFZEGbae@uh>~bOo*TB4c+Pg11R5z>rew>Gfj@sv5*d=OYW%9ITcfY-Fvr`QcM=ZvGi{A zuC!vVcRU*x$~r!RwQcbS>vl}=jE33F>?1Z_w3ER98An|!slOYs4W?MJJc(+sbgwZm z2LnnLjw*+n$YO9FyTTi8QP@qqWU;E+_bw(>Hqiuw*{O*IlVjlsl0sau9VX*$-UqM&`S2?6t1e?{T^Yz6EWlI zxYqU4`W5B2bt9Z-Sc4}K%+eBvEmkX5{CBbfqa+X@eq0(F|NO$Cv0_&qIQHBdW~rZU{wQ&V+<#%!G@yWRJ}WqCVQaUAyi^Mb)L9K!I*TtG&7ImX`N z9TSl*`=l`>O?9mEuI_4ubw`*{<)ZXm)3OC_G$2*N^ul&LOf2CYV>Io}-U5a zIQ3HM;c#qx4ie+WJ`32xRk^2bFAP8XWPwNn#jkVj8YTnZ0U-NkNQEc#C-jL;P~=IvD9Fw)$pb z_i$k}BbICjMA0UKx{xIDYh^z~e>l5X3`t8l_+6OEj*p>t_nKL;e* z0{%9V=^U&x0==9oEX?UjKncnj4rfmm&|0wiuVvqU~}NhZXdZLSKvP)OT}S zg$O6v7Dn@6SsXsK?%g6kWQ-__Xtk1^Tc;JaWt>;u#KFEMomPRU{I7Wg-8~}Ru@RG$ z>}M5N29wITL@4+#l%*9cssF-emCjo!)-+fsM1?42s(2)`TDX%#Dxy0whf^z8 z65+e4CHft>i1<>@xP?5pv>qW`mWu#~mkP~+q4yn&fMsh=V|j+5FF6v|*f97r-@w^&suz}db0(@S6&6KC0Mt-xu;`mdHX_SLj; z15K9-+j?lU@gI}l)!k3I-jUCw9fM|{tc3o2Y?h!}Qj%taL{E(oJl^NO2?lv({Tj0U z;^#Nfe4Y?r)7HQXDs-TcsElqvrW9PWNl0L9x8B^pzU<65_=*<1NN3Y!w>TbL{7x_W zC0*p35SEU5eL=M>gnb!b`!D%R`y}WCa(P|$aZb@nU?@u znUcPR?4Vd+l1+9*bfFfFjUtLLCmDYi6EKa;<$Hw7T?PHKqWWf=wonHOZi(MWKH?LB4vtoHv^41gV^G)aLWj>kR18=1BD1IO-~E6~hL%lECNZYdHFWs;rR_SeFV4J8?skq?ke z-B$89G?<4X8f(l=)P9VE_Fc_R$~ZKrvyyWv(3hdWO~OuZAYQJ?9L?o zDW>rkK6Y4D``P+7fQbFz@pqxA2H3Ttbp|73ynb~R9_X_!-Y@=^OQQPveC$0^TzE$w zv9Vl%+Z5ZP@vchHq<$D5q@u}~c4XkpNGAR2H~1ZKH~BW^o3oom&^lwE(!abFjB_=y zdu1~BpB;))9_0}KW{1yJmniO*R;xN{KfUG55zukp8={;wm@v9>>)gHKhIZ5At>t7Q zDb=i>)PWn_W$v*thazcQJyI8%OXh{`O0@VU&IV^*5p`m{HprbWg5%beuGuvaAL#DV zJokF~v{rs%MX)qb31#pt;#4b=ufdo0@h8~Y`e>ih&RkH_q%|;+4NN2acdz66Q9=G2 z|A3Z)p?jJZ?-$d>MGlPDoAMPL*}GgB8D!cGZwH87msvtThw3&tOOt}}Y*xH)cQ7*; zA~xKsQ*^Pe4a^O!lU}r_a%IHk6(MVx#sqWv-hCoRIL`~X_*yzI6rGyomMy9VG{kCO zeYyv=cNa)Xt6yx&+$_k4eu-YwB}@LPTTKo_S)R`1Y{mO_mExeK*)Ka=@59)fSJYOM z5Zqq0x+fcNn|o_CQaGtoyFEo{Z+3DGD8(i??t~)MLJz19!}ie zq&~Vf%n@wKcVnJKUW~TIHfw>mApp8)F@DUrcd-;nzOK)0L(Rv(y^+toFYEHOrb8H! zcKWY~OW(PJGFZh@5e&6E@OE`!WJ)fZC)hvrG44k^(2!QPg$LX9)CAy&;#)YJq>#sR z`-0jP%MFzZL>}#H;9`vBi=g+(ZZ(561B{zc=QaB_@2w}UT>p@aaVO;UYiriYSG8Ck zx%C*{3Vu-Gt#IXHsrEy-sOn;THH7D#W`m5wsi)P;-}dN;YFbap&Gv}uhLrARv3^nK zu>h->rl6MJiY~LO?U$1ephtk=9tP`sToxWPPz1~&R&)nRDIW} z{X^0j#72Nl)$#$3Jof8y@j244{Bvc@4j5h@P3~1k5R3TJ`5&)KEa(L@2k6Fm_Fbbz zXO7EsKq2`cQW(%!#8n(1ZOZG>Wc%j+>I8LKf7GP5YW1zW=&bJj0S}{UUR$I)mk?T_ zqB#6D_{wHZr8Gbz^{j5wY$&Nb1I3(>-Dd>?4pw=E{XsFm(+aVcW$zlO&9JZ#NYCIM zmW~wAK7S5MGy^qN{3|WmeF0z+-iL&5a(n1vW-Dnyad}H$${t~n5SiW&LXw_j(A;1J zn@Onb((R-_*Rl-b-F;i?ke?NYE|cIffli)#j^FR)@lJ(|H^`^_mv@LR$JF!O%<;^E zdb~xZfEyEN6;JD16*!+8%KI!0boL<8#PrhnQ;k9DnO$Ug_a`r?=-;XGz35k*9&A6R zZE<4%Jy&ya7%5;v7~mqy7IQ!e5@KFyc)Lq>ltiehUpm2q!oi7;4}}ZVTc>umhJjUa ztu0deo?sp>hQz2mSrQ#M#^#VA%?6RCkv44VS_3Pkwd7!gG{u3!C%w2)42*NtqDHuC z+ymf3)BAA9DZq?VE0Xj9n5vvWab4AvO-dU~kA-T3heBm#kZd&owsBraFdIT&4@A3? zW0s?@J-?P$N4G8xT1{0_Qj{nPQIMpi`9(1%%Z)*`&$ph0w7ByttIQTU>gR-dp4Arc zE*~G8GBAAyeu}KMUy2g>WAg+gRoj|`435-Zq6-^OhhXTG^;8D?6WO?B6JB#8{QZPH z@Ipn}9;FaQ?JG6nE(w`GC5mQ~ag3}qP%uDln1&j%gwnp~(Vm9y&?ikyzc zVx_b8@s(bUuCE`LtQU>0R@_v*qUaTsT;2?sHbf%kD)M1MaFP+Jdz%=RWG^7hO3ln> z&_4AHpBPKyz3W}u7&y4lR%)%nQTEp2WmmtR#ccOx73Uzn3(o)dAnEq`?B|;g{3A6@ z{8x*jjBE2Gc{%zwU%ZPV1O`E<9z(P0`@0VZX%pi84Uz+#nqz8XQ=nrIFC)*(S#>P4 zpxM_gq6ke#JikQcrj5&*6}5dPxoh>M3=t(U0EkYN2vtNG2bZREtVqf7Fs4TtMTN3) zfo_iPfZ`tSFy7aHclZZc$6!H-`epNVw+Mb{Gy@v>EMcHO_@9*N!Df1($VbqeAiXW< zCtGlNpBcTm;zTevbz!T!P-sD=PuZheh-D+P;ayfdfWH{e((3irVwsGHDuO-~a0M&S z*1wLnxO{(>$TX^iwoSk2OF?3T?wfU@_i2#a2B`qE{wlyGPQQqnw8kLqHe*B< zEJNyLU2n>baqw_hzh;+v7ybs0SIv9Y&r~+j+XC_$pHY3gOQg@75Tk9?eO1S~e1~{l zfVwTa{=12n8{am>foX3=8g!ivGX)zPd3&?-6}D|(Aq2OqJ&6mujp#S|X>@7qt!~7I z+~J8hcQfGJEbBB7K7P1E8;jE1X7RV~>zU_n)0WDgF!AKFaW+`?*fZ;Wg$&rH^~;;&CT!9wEJ*1)J1ZrWhA#ZF#2kX{wnM*Ok!5HE*$t>{Uz1 zd<4F$pEj$j1yh((pTmcff)IU*<*wEK6dB;|J~Vgp7TH*C-kHV42c`B&H2v#U(G-}(;aqoi{quW= zw%%TCzXJ^r_#qoNy}G`rM{+)9DM4k}*1^qrK4OzBPqw|K^F^eyyt6#Ug2YYb{Z@2N z2}#^oRp=1G9Y=@%Y(iyjItpkD2>eEbWo#sp^u2HgU&mvA6x+(r;164-BHVq25YH;m(iVsC`)O;Gh*z%>Y8eAOO-@zb0qZBZ!$2* z=8Gy75A&sqW`IkH@$WanTa2&7BCC@DAv!qfC<|+92#p55lfbyy__oir$s}cCXDnZH z=Bs@J^Rmv3YUfRvZb`^n_eu`2yIs}QBY_fwY@ohUma(*8V7wI_kJx;pEJ~> zskzK84OO?*rIKbOCOW>Br`55fFYa*}xHQrc6j?3c089Nr=((e7Jnih(UOmnJXa*k;_ZyqR8O_3Tmr55NA}u6C?3LLKK- zUW@hEyZ|w2+aWf#KtQ8~lB){(lEBCdyGR9_nm}BPT+_3&@1)dE%ty9-gyK{%=?bCB zc{2cMld#4s7f7ZTt}%iCt$$hk06OW_C^xU(pEVS!5MtG|v4=07vc@*JY(C24=h`H$ z_5Ba{vt7vuUNQVX9Q&i8B;!MgnkLpN>#!23Meai;CBl0c6%cY zUcbexKdUI+jWJbWZIS?w|7P5*5nhg!)X3gSj%q13?a*D+LP*?$ss^&-7-V=1x@QOD z`G;)osd*Ws@)+h(vzg>3SvRZC3_ccS%(bZ-IZRn69Q|W)bgQf)T%vU zX0flrDLT7+C^#BT>v~mvo?y$;?XyVIXNY}4Nb6f1oQ;G^rqdqo`R7t)q)^8?3wsLJax@$5F^Tw@@(Wr_k|`nRCWHTX=KaVT*?gjt{3FYevV`kXd~5dC-VAa`u5 z(CgXj*Hi#K`$;=b-#t@t1qtwfI^>4oygGLYYl@KyOLEZ&_7){3&w3_cE`GZ1R=fo{ z)SW|)2{<#5-oIX@sGJ_ooHVV~!5i}uGc?f8r9y)9<3&~G@1^?UOVryqC+4Z5s=+&?ynPlKk9@$RXv3x; zhdM}kG-5>TQ>krJn<+4N6XS##EG@k*H3QLg6q>WQuYti;4pNydpv=-QIwvjSWpZsI zQrrIPwQGxxl>ww1Y<~eS1#|rL@t?z`t?LsM4;`*}@6tfi5$4fo{C?3TD{JRea#zO^9R zjn72NAWZ-E7hu_9XSa++yGiLmbfRY{2u0%2U9h*L2R^3Hs*UaQd4B`*joCa3#c8dG zN9!0{v~VAAq}}?eUEJC0;w|AlttrKzk{28G z~mPA^`0+SzIT_XkIS(kNu5NuHSV5QJAoXvn z*4Ud*Qs|e0>r`X{zuQ-|6J;x5z&~eX`P*-guNh{SU-SdxPSLO8w#G}$6IZX4_SLeD z#4L@z2wJ5EA+_J`DS#N=JxJJP_msK5X1w7@TL&BgDTzIdvmi zQDB%R0r#O42IY{7NtkIjS^>$=zRJUIW~mjtcazfgb}QnzuHH)LuUTdZS9pv4c&`Id zVZD?vf0O$!PC$XqH&I#l)MxJg?jbUTc+tXKb{h7$@hfh=osp;>-BTz(JB#A1pgD38 zwRjP_u2fM4W(y&B)}8qKyX27rh)+V{_Smt*^6kD?5DCC4+wt;3(p~8zCU)!q98nUG z=ExW##PZy&@&`6xsM&~@CXMiB|ID(ldTldE+yF^@XI7uTIQ*2YGqmP-%wBDmG%@&P zkL6#1Wwkh3g~D6V>~{45YMfatCY>10)$Kuv*d|GtN(bx8VNT0YCzKIFQbn7dg5Eh3 zdROOPd&AMSYfVqjBO_(aNfw#4VcHI+0zpEciO=He4TS~PEwr7I9+!zwR@4JExS6Q4 z;&8W%IM%@r$c6l%@2}hJ+vl`8KjFy7DF<}||E<_6aVfFclkoeSNl7gg8m5bESEk!b z&tar74anokzFr0|CwL?5V|JzUBIPp9R1-^uKVns$TI8N46%&Ob)17q7D~81lxy=X) z@qY@CpRH)5W54x861RWoO9PMl>#iZqN^!=aSvHm4=F)5;kOc|0q$%W>tA0^>EGsx` zt2!^Rf=kwjij|aj(k-{qW|kfOpa}-2UXD|)?-(uI*x^9B^5EDZ)cOvKQEtdC6>2|~ z-SS+Tlf@$Ak*d0R$EvX9r=OC`bLJ>X3Cz(km-0u|6sB?Mp8Stsy#iR4zhY;+*xWi2 z7a2=#%lGo3kGLvB`{|Q~ZJJZsr?7N)Pcbe%>f%t0CavaGPcF02g1R`43z0^WF~HrYOXnnBT**@aybd@n)&P zJO?g2u==0m;Na38jP2%%QE&eAb1g4k+x%W*z}x@j2({Fmz{SBOT>m1Y!2;jf*&ggb z$D+IN>7m>k-aDSQED1TLp&=%n;R!h*1oP^N)(`Q-$#G~RtSCKjV-x~7(`#ob9EygW zpVw*sHp`Q;O{2Q%oPri&@Cc0gIC3P!LU;DJqA{5%(=cQw zAx9tOVx#lII!oe%J4!`mMTeJoYwj~&EdCJm z;M;n+p}eiK$-NdbJT$YE8AuOd?7LflOCDmbk;j;wTF=@!2)`R_=fBQpn`W?NknKV;(*;}+N#e*%GzaKZefxpUt+7 z!$FK_?NEveVkAoKQF|w`BKD}-v(zYxhng*^A`vU7(IB>}U0RgdEwL&##Y2myW?R+w z^&i|n+@Jfp?(;mp$9KlmRf{BV>Yq5`NGPx1%0`UU0FV+~_LgXK?#~_jhP!7g?$0E? z49XUl372+L@RYzdDD3`9+N{h>?(h=5R{vc=Xi&0L*uF z<-r$|$PsS%VvG(#=<@`~eH5cogVa`%oc2t#={@;lb!)w!slX$|bg7%qXd!LT2}XEQ6`5@`qqy#UCFU5E z7|&kZ$lm6{LnBG%o1Fq7++Yj1N$R>*1tgw#xQpH{URhMx8yQEx!5pVXgw^*{Y)IGkY z-UL~*Yi|Ril9Rp%jKSlxR0pqbB>zSzP~nbum`rL3zpW{m-_U}kCI0eLgKe~UT?ux7 z&EijKFkXl;*q>cFh2Ai%cdgv5H4ptQ0PYCkbeDoTzWRGgfSE%xWsl3`##_!#EHF57t=#?fs|9DLMOA^oR^{r%Hy^e9M?cu!2&^4_%zGHdq*P3kyASHV7pRWR%C+FFnIZoWF)YMf*Fek@{Z2r$`mX1@+?U7^CY2iYr z0yCkF2SUDWrOhOF)6`oFRYgrR6MKtJaN$;Cfthl}#oT>uHGe86+RacWOu(30uH52f zGThY)9K4**=h37G28SBD@BJS6v0VoXSY+fN1}`}GM4MEIKe7E{9tSJDyt!4*Gi?G> z1stZ;ABn)dC3+>>1M9b(LPZi_GsZsSPDsD znh4g+`jPcwdVlGLS1b7!LQYIu>$F|kX?k_{QZ^u^Dd z>#=a})6+-C?<{sW(QohznXM{H$RGeg0=@dg@&--t=08KfUPu_~wLWuF0b#B-4jgjm z`83Qer}*m0Cgf7NyZ_*n-GSo7U{^N(EQCXYbw=8^PE<9pHh}2Wnur-=D{Xtt|5T2T z%=l=`yHQB8O9z#hYW{OP>=;ArInHZCxh!LsfXM^bZ6dY@FPaiR9lc7+E}Fy{ccGOE z5iK@v&Rz6t9Q#d4*}e6dt{YU!A_}Yr_d$+kw`0{&XF(n@_~QH*V(#igWXQ zrjRUy>?N(-P*#arNz{fwZbP5EBfY14EJ_w)CVs#)1-_cGyD<}*U7#x%{9}9bQl9>< z8lE|1rTl*Y*xPYG-$WMZN8KS1Zo&grFP9?E-uwjJTl>s3NA1yb>k98M?JXg0>z1~t z*0R=yh`E)2i&+;({7(S&KSpCF)KcJj>QYKibAEXfW8HN|xbm^Mu8udylN9#W`p1Z6 z?r&9vJbNtfa(G7g<&^HvtYU~a=BmXa_D&_G6vxgH0M3d-8NzJsTxKiu)0DVweL#bM zM4eJtV0E=yOHvEd=qqkH^76O4z53(TM=imi#E^l=noLZEN^Y(HX|JGO0;f8*Zrib) z58_(G`LNi1YcU`^d67%uz`Oi3Z`LcA|BA=E<*rtJp($AS(eCTr_zhV?(lFWhWJf3p z@yJsk)Qm$k*$m)i0RN9Z8qdVXOT@m984rsX7ECc&{*pUGqJw&H(?4G9gyM}v;sZ5t zct53IDSKZRz~6y#B6?KO>;Yl2NocX6$f6xSd8KSUgNyF-5H#nT;KT zXD1Bx=rSc`7p9*lB_Zt9e_c-8mNDhvE|D7NVh{Cxm0`VrlmtYZUQ7p|F^_rwp6vDN zLDnuN_srLikDa^fRrn+%u=YmUl-x94+c-iwh<9x;q(3QngjX)%7@?J&KAi!-?y(6T zfvcWtlAr1&+9E$%P_vLi?a`lRV?27GRT7Nc0GV#FmZR*EG)0d{J@u?GEQ>VW^{grq zm|Aw5p6k|HaE9R*3#d;I=kiZe&6HXUt(=+N6WhNt=WP^a1+#sZBV(`F!c*luZW@5SR=QtgW_h8Ru)1+ z@rjo!xHO>nvDMudCskv+7-qD9>4Zg5s8^1R$(#e-Kufm$`qURkCBYi^nb z>70tEJ&@oxnsR{9?12XdM{nN3Yo=31?kIA70P2Sd2cV1$*dCYO@3K^P{pY4vWR1Ou zrvZ92#8AKEtV$lD1;NRb3ME&KCXTFlt6x#$a|!YEOzq0U`^aOju#P_P)c4w;b3=_* zRdT9ebq*)tKw=}yh11(FPY~*g`+>gM`5DC80d9QgrB$TVHWYcgbmzhuGoQvFcy%y z%H??L5;ceS4_!w3I2rt92zcBcIztQQgmPzkIrH8^lEJ+R7*~xuHVMN*Y(;2-dox#x zy`peRYjc~h%^n#@+ze~@x?FiP*V`sngFn;eFhfI*KXb0h>&|~D+L-s9U zRU{zA9_uxcE(5Mv>zHP-wX%~^0iP*PgR>Cl=it|Sa8`NjF)~dXRV?2F9;5wa3*PcTTo)L`{2Q&6Va3aY z3N(c|nI^|15FX(RRU*Sk`h zEvmej2LIiz7PI|~to`Qt@y^arwe6HAPX331qc1VVdRW^WT6($aJ!PUz!&t1P3eDFn zOp-_xwqe0PBE$KAfNyh^1(xHn+AFymKz)WgI zQxZWL(AvhDJsq(u+y3nDH{>zv>}aJbEqT7)X>X$b0cV9o+SOgtYsY@dE_iuVAoB5L zOo*J#;C;o#0~o8AJW^P7Fa*fedQDdt{>@D1wcgl7z1dN+l!TISx!7&h1t$aAf+Zt3 zJzM9a-*}2%`^%+E|GuE|%ch6IW}}Z^rBx(pQdZVth0Uecz-^NhFi(-|G53vs*qX%2lK8(Hb-@jkcf)p z8$>iZcE*^QbqQKxP_{{cowg2MZTZY{NN!Swvfmcoj*;kKxOI(pY3|0YMp4P|FXt+pA+0Rz*;WFU)r z+P$tp`Wt?JVZMT|Z&%O&khY-8g=>x=`{kCeRkTr91xNj|vt=vn-|ECpiEIN$Kbaf) zPD6Ew#mj%Gx(Bsg7vgpIY$%0sXmlnLp;7Wn(Y$jS9_ZWi+R=#(LJzGC7S}$+v@L72 zWjRTHDaX6J7Eu~dEA3`j1U(~#JUq@g0$-j@0VG!@y?! zXPsyJm;b(@`1|>HBI)xGaMR#8|Dh`Xdn&KGd*pV|t|;qQ!iwCDmb)riam68_$p&O; zRD2^AE&-=$wS7O=a!}Ou<%3qJAPuA%xS{rQBH&#YMZfL-#yfwm9sGM~=#?G1zv{F; zZencbQA={5LHv65q2qkD(n(8uAV>HPt#XwHT6MDJ=fXK8Ft9kV)#Xb(XF8|4cft(o zw%JIh(GeNKr!nQIAD#DgCh=fSumD34@gb(ZZEJ6PkC73ghkQNg<3dP8mDbDky3fRJ zZ8Cj9n{WPpAD!~fDX1}&i^g8jrS!77LEs84pp!h?NHkpZL*c%T&|di_)}jeV^pdC4 zs2X+9S$B?ueNT}8-vB3HYwbTNMPMyXM_@2wn@eiOH>H6+)G%yX!4I^ z1KFoZDG;z`H8e|V2pPzfxTr0B@4647>HiiufLknCe(k)&j9k=+c2(wyC4 zq?tTf=9_rrYkWAJxDLXW{2ed#_@NEmS-q4T58o!#*gZOZrRr*U`0fgB2#+Dw+0omPXeE z#_#E!?{KP9Wz)ez8uB*~b57elyytK)Zft_EZTioAVgxDuX0VugFre+020lK8&%bM{A@2p@x{{s~ArduThwp`z7A}!r(OJ~|luvEDrbNi#t8Hs6G92NHU zf!oc?|Kth0XXN?&R>|X+-$20t>r&%x3d8Je@>)c#w5ty@0iTysAj)4W)(c5e%z??q zYIc%HtjGIi{nxIEp)_h4H}JLqwK{UbnJlbR=#1=)N$itn`(ck6_r@dl(N#vTzfhR1klEmu!o9k`yK28HVu0*+mV7{RB7+na_k~%EiQ7|4<(Shsta?G^CnmZxI zRrk%FrP*#Jh-Ugr`yNeiL&v8LlevTV81u=2x9qHP9m4}od9SGc_v7pZLZ|3&7`-y! zKhwKR=$AVPg-ejj@Jrc;5)z{-o+(ddyD4lxfQrehCRxaCL_UTY)q z#E8xEGvRm0Fl7Em`p0G04E8x8S0{pXO&A^aG5LEIgDP!2t*R-*FH;#R5)HUo%sPQz zTCKQF(QGsr7~Z8|HlA+MM)AJ71M#Bq)eygl)@7ELkTrs>>BoDNU?=*Wj+LRq91J~8 z$*I`_Gn}l}EgXrjzb5V3UQIL@daaWn(`z|wx5v$;RuDiRx`GDQQc}Ftc)i?~xa$SQ z*)u2Ti$?Eh?Ss@LB0$vMbi~wrb1%OVzr?uF4taX}KkNe_+j04F~b1qsYI+^6%W)r&uX&1g{YOu9lG7@At0`|VwA zd-v>W{nPaAf*$I7KH&JFcW-&+U2=sl|W@Oeqel~ByG!oF_w;At+nG?J;<+R zbMZ9lqEVMM-(IRQ=QA!?+qZUx>qq>jJ(m|!>2mvfAl%tz`31}KF`IiZUq4Aa4a8dX zMc46Qp|>-^NM{EuqPOV`gE-d5IUdbUwy=ZqWex8Zt6<(DpZGxp2-|Fws)_eo%=be` z9X`T(zBa4x1f+bUkeb8zsGKxoeOp6lld=4$jSAH)8gYnnXu-PGVi;jd1 z6|O!rx3Lr#36Gl13+sgnes!{iY}{`!-&mU-e+POyiZ&4dcV{r8r- z(eBAkLVkUMTU6xqT+MU=0ue4tM#xL<54hbf?m*4|Zr*V)n$Hged48M`SGVSxH@yes zk;X}CwR%7KY8g}(sM^{7VqjSGN>FpAoF~g{FU$1TH~4@<`QpF2o8r%+|NZj= zsUJq;jYYWhXz|YI3{>=C+;)yvWjJ?RMj&PMPflGBe~2~%X?nVyXpVp3b&=5H z&V*^!+%wVP-I5`b)t3#c6wg~eR4H16bwYGTv`!s6?osOn{pN2brvt~Wh?R9)twTFJ zk)-jZpJ2v_-j0}=4r;@`H1SAlL6CW%n3-)+;VGySsgxss}2 zhysAs$l{0fz%vJ{NMTC-yW(mk&(@iT(sXvWp%thDn%`Ckpo8vHBD0C*8_&h4I|cSR zG$PNZr5$WqTR)_N5Tb1evQ+Y_%zqj!w+}{5J(CV?Szt47J>UB9hcNSU#fx+(hR!sz z!0K(jg@oowBWOg}t1pb;GDFCFW6vGzNNcRepD(Oy9xQaUqxy*=5&5?MCWt2K8Yi8j znd>75W(tA-KpkLR*lA@{u0>dJBgX1g{v zHfE*UP|lo@7D|{%#}3R$h(SrVWqV{V%^Nw(#-(cGRBeW*jVbD>w#nhcNFP%PyA=~-pGy;Ds{aoNx?%l>uo?^5zb&3aj!Oky%t-^p|6d$lIRx+(Tp3RfLdVufpwO(D{_|!Q|0u=6~!;%kOx@yAM|mI+o9s;u5AUgP+fm?=O~mQ*!6Y@?~@oT2GkX{v(af>xPG9AWV} zjpa-2xmQvNAU{6?bAvyaBy$ULmNwQZ2p?YnxeQqG9EMtWph^755J*g#<_{CSuSoDh z8mEGJzaCTirN194a04{(qz}P6tdzrPzHl**7v(_HCgwnR!DVm1WqfQR3=h{8h4587 z3*_6&6=4cdh!M@d0oUvTUum7ZzXM1e-Uw)VdrgQ>0SQg7QsBm$?q9ya>gXEO?qauY zd{5IOkeHx4<8yk6S7xFx)3$@F;p;o8PpY7=x(#YuT$U3{S=u&Hk?_RgRbKK2;!wfm znuNw6!^dnd*>N4x9>GVV$jY4a@p;{0k<>3zwUu1Dq0p3Mq07okxxpA;$%2u6vv~Cj zyY_fB@@Qra#!?zKS>Ar)HV{ z;2s4zFxzSU-F^*aXL~~IyRsDbz_eYYn!sTxxt9ijn3>{Na>Jq>WpxWzaOodwtTPot zlj(1op+WD@!-@*A5Ce(b`w13^s$J$P@wZAbk567L_S#J@^sg?;3-!2?5K@9ZE5x*mi>v$eN` z5TbH6xMrb+im^#fKQG_!|B24>bFqr*Wymr~7hw0Alc|p&qY_zAsR`dub7@3H8XS%|e#xlOOPb?G%(b1PJW~ejWK$xr*jv zh`H$$C_CwYgvlv>Lp=KUq2-num||NV@k6z0_MvtKYQVB6H2E6uHQ<{z;OB{`J75W4 zh`DN&VHaj)6Nvj9?FucAL^AS`fgCCHq|jnLf;Pt7;s-K3fbMn4N^=UN98;}8w?cG$ zy35%9BzpUqW8(Ka@>Mh^c+mMqDoQ}RQ32~$IZ9f)+%=G9KFLnMKE)m*=_h!>;aLsz??2zQq&h_^8U?bd7JMik|4iulN4K z4bk3#(S<*JG@hTY_{}d6nN!08TJGO_=+)J@UuWgXL(L6Bs^iOcvB~dR{KVLv@jKvl z3q&fEZY&0V%`G-b88~{?CsN*6U-TvfcH(>}DqTwf{i=0xl-DB*Jh=Av?`dJJ57&cb zN`Kar(3bTClZn{LFHS1*5~X1qGjkiM5YSO+%=P@qzuW!H!Lwj4)!d<560xKpMN$uKE(U3l-I5-cRr z^=)cYE1B$>G(uWfSbVo@!g8Af8Xcnaap+O6;qq-Kht+rQ$E%pqg`WH(609;EpXeg& zdtdfW-S$7Pb9nNsrjJne=9%a$m-b4*-Qw9zET&LLQa$#ErB60d??;reA4{F1b6emf zy4;q>+}q!%Kk(!flt&bEzm9zh>u9%%WT_j@PRi_2_p5eZ_IGh?gEX>VO#wE4Rk?26 zZhI#dbhH}F;?g+dWD2I0$h@$$l~FxCN*cB@g~`3VDijp*-N^b-jn29L_w`lwjb3DB z-Hx>-*E!3Yv)n&m38LEH;1PbNtg<(QGmbpk??nj^(O&l>6xL z(&M0vg0LOV0Dkf>oG;uBF# zu=1?-TaN5>q>+3jQ1E}ptVjXx#!IjDJj|oPS9W)cv+KoXQY1pnfwmq0NZxL%9=HN0 z*371KHr**Eq}p_5otzR%*r2QNZb^pk#N8#;-|XF$p}y7h)VP%i@uiN6__9aiYmi$Arn_TW6WZ-OZr_A}9Ovj%PKi@QLv3 znFvuHU8jyCGx~&A;P0$duE97afi5xjHIkjd%o}VTvym(VdYu0$Y(g~! zE?XXVGJKI=#c6SCRzfO!Hw4OV6#I>t8e7$>@*Px{@K$Kh5XM7z2Jwt#xtnvKkm*|q zg!XYQ649arBED0LtY(>7$BlB8jP)xo50j%x4ZJ8#F}22I*|oDHq zTrPd88kgUyQBg8n!2Iuix^6CIiLk6t2B}fYmyfrlQk%Q*Gu6NL?df%lFRObtBiLvO zH+nQ~?tQN!^fW^~Da=Rg7{kZhblGw)j)@7-ADGUoL&-YBxK-E$ka}MCFvnOi$1|T} zrIX17v+b^hGpiULh@6OmnwzicQoMbLd#zGJPq4ieyth8SW?V80 zm#lGN2+mg2zx_}YJmv>d1;@Y<2CUvunyrk0Fg;A(&p#>taV1+d+T6X0{#wRlzL+sSRNW4rRsLAc z#L81J8%J$Q?k{zZ!g}a6m~j(mI_M(@k!>q8^t1-YM9ziMDm_F&b)J z49xe9ue}R}%-Do8Bf+9Hx6|}w_{~4|qE+h{boevCYJkb0eqYd-lmQ=Rmg5k6l!a9P zTInf-jqL~qf|G|yTCbX#0kWZnq9HP*?||fRQroMR10-+K3L&=$6jF*JS z3$I?B!bzn@Rth0B(JElI`^ZdKr|xV3o8_o6%ZZz~UfG}PYJgc57O33U#0sdqRg+6H zPr|3g1Ft@v@rxkzXT`fYZ$Jv#3i?699O_oRH0n>H1Cggbr?+5;rK0^EHPWH=!9XU~ zo}N#W(iX^GiaZAsvQo@9BvxMf=^Aj)1+n8*0FeJ;|D_R-spa9s)Ez6V5IA!@Nj|SD z`E@Zzh<%GF6VQrvh!9Ff6+;Pt$r5m&;bBD+I9y>VqLgqDv7@^2ycL4eEZrm~h5Os< z!e)Eb6Ft%x6-CD|*rTNoIFsRnqZB;R!j*_4*XYuTl{Z?^)%|b5UT(u?f>H9}@1Q zOtNGBHhsL41A!S;fJ%r5U8QE=D@*S$6^qzIEx^>aGQ%EHU;LA~XTg>(yY=x*z@%Y@ z+^cvY*&-UVh{~9`6*A$um@G&_3T|WjHyFLz!k?mR6DQgzUsUhY?OWEb)C@FCwY0Uu zJ-T_T#{@M3*y7MImaCmhu}QqCwQ`mFhdXiRv)4>^9q0$7f-P&^zxdXu_`~MVg*k$T zCLmi3Ufa!}abo7C^0*@IwS=FZj&*Fz56gMmdAC#kDsVfFMjp9QFw=Tt>4c#>MMr3w z-*_&)=!=oU=(XRev4(IdD`$(}(~%9GkB(k;B#%H72Ie?IrBfX_w#mmG+daX}8)F%X z@vndT2sz5kK&lG$Rhj>qUfo91_?uQ8cN6ePl% z-@e~_@~tFfRw)TCuT%TkX|GE(x?G^i=!8&#qC43pQy0@@;On_um!|OyS_EjvAH)~U zDHS_v_%u`K+>|dg5G^D0aI?qldEwibWUXOoa ze6lH1x&v)}6L0h~uzoT2ZG|#V4hy-QI+dNw&@%c%ll`J}5MZ(PtHyT>J zS0eb?vw79P_sx8n{MQG>MEyZ%=$|Ru`8wz1eWRZoP~GjSn=Q{J?(0!jX0oAusT&31 zqe$pc`Q7&FCw{j=Oq?K&*(bBGpvORxEYg@?m25w{nPf+7LeDP79HD!UqyQHb2>fBJLM zk`K5U$t$Ys!s1-t>3s~N0#}56tzl5`rIFvH>_h%6)kC%W7Vp`$1pR)WCsE@X10JM2 z%SYirqc+%INsV9NAAc=IvX?qpGVZC{&6hAV)OTC|xw9zNn|B}`cqVDChbR6D-;^*@ zpDuQYb>DPC38BR$ly2g-CUos6lL7fL-1WiU+J{zm(fUI3A@T(q+9(9xy3*i5rB+*S(cZ+|-t!02vwL)wQ^VWsej{;0=VaQrk{<4d!Ii@z zKmj{6Tm>fUtan~%z^fQ~F!(`O3U8G@x%*zPUf-*%V>@7OUy{r&9)lSc5cOTjwKu7M zsG5ld+UH@hVeML{@YyMT6QNRPs3lL<07zEIdF4;J{XuE9krMwDkfDyiSw)bzFgk`JYm+@8qp6U- z-H8alBPH>ELKQC?RryKxGlf2iaXM`^)=fcQ);3-(a|;*lo$8blnMzC^TwKTYc4yn&&||fq)qLn&FhB(K8-x5@Y1|W?jZ@G^>9&-Mvvt%Nc|XC93VTST zW7_D3Cgrb|91LVcC2friu)l$fYFI zV{40<>9hwh7oynh2t>w`rL?2eBla)>HsbS&#fPxMN8izw2yp}Vl5Ph_z24OS0sLbt z*@#)BcUp zCLWn`<%5epq8$5EI}I{lgY%Rps%V@=ZZD_=m~|vaEIlT5eeoMq;4j6AJT>{G^cyLp zt!P;BGvIMJjh7w`dTl1x;iMX9i=L0D@$wUei5?EJR?Z{`!8coG5^YK9JzGIRIu}+d ze#l3KkMIloKhOfY0oMa`xlx*)lj{6zcRz3swO3E)u zs$34|CYE_To5RIRFVbe} z=Z>PXTQMR55`N~BkIx!!V1SVaaQbAU1hWomB!EzoU$vm~;J5kXl3%BdSEkx3zma`} z42*-3x#4Guum%;rJ`GUJ=P2>_fbLs+Y!~T|fU-vfZX%7K0>|7Ffuc=sep^cSN^mF< z+IJxPvW-{ReM@qQ?AQMod&F8{71by%5zU&Yb_#c20%Ng32YQh;M`})8J6p z<)CrMM>$2&MeALtduJ)vp5Aw$$&K-9=^wQe0DUZINx=)bIe;ztN1EiY;9&)#-`S*l?21-vv+T4nRAPuOYznQ zMMc@@oTI|G>yU3d?PCWDgoAyw579U4|C^C{KI}8ByDm!We;?BvJq3zhE9*bdL2i^; zR^D^&YK7~uc_bJ(Pu{MsUlLxmLV`??;#TAT`H9KETK>9)0aMd2eS6v-2nXg!b`^;$ z=-m~1D?AJ5#H}Q2M_#LzCnJS&89cpZ{a2@nUega=AfT0UZyyH zkE`tt7Q9M^Tc&IOAy);<#%uq?Jc^}XHo64G?k51Hd^ys#E5Gko%)n=d%3ID_jqHMc z>bv=#9G1-L@114vthV`i4a%Z)zFS;T{v}zzZ?;&`sZ?1OzIFq0EIcxyeL5&Umn#fPE7Vn6~~`c_ai8 z&R-QFo(Z843By?w~7{6a(wQQxEz_(-ZxXO!}ElHCs#|1QH!6t5ylv z9JN#oPBLrllZ@Sj`x(*3RyHWF&U;l6dJ&R<)FIwd^i#p5r-fJZ=dBmm25HO`6iCAm zu`OrD1Pa_TJ=uO9^tUum2ywka*x=I>e`9Q{{=;(L(YEPgJsys}ZC^p-YKFvk`hJa5 z5D0QsFSlWbS=zIsAHvh-s4f4Q7b33FFTih9E7`U3oY(s~CER;Ed+%Sro>3(4_M2ay zWvuItlPn{tX^+`)9D1-NakW0Sh&^Y=w*M@S?VDsowxq7YzDdWXe=9&EL;KuOyXM#@ zb}jcP>?kxI3GOvvA?2*R{~30=5p?_1g01l($m~O00Mq^d0aU%Ekbl)QRC{(`c1HY> zZIS)EtG!iFqmr;9?DErO{&(E_2i61!setU!>Hh&NDD4&--+r)6zmtAc=r{HIVazso zYf3)%^QF>52i}52@1j!If5Hyv7<2mB#E`+2-dC=(2ui|RQ4X`}auX{ zx*?5?oXU1+;|-)lREb{|f0P&y%7&NpU3${y=PD_>y2|}UgYd~##%?#c_wNbwlp5b> z4~wg*r4KkB9~^>(z{GYUVOfx`wsxKN49#UNy$VW62QijsCT3aQ+CS%LvW#M@{qu{M z`!OQMt?cWDj!q9%69G7kZQiGH0Q8@k`;#0NPIXDZW6OZ2%!NVwJFIq}u2V46_-5CGLJRQlkJnz_yY@ z8+Pj?yT~=>=GKCXPL2UKm}L6-Gk7w~NDDRvXOFEVFe72voZ8WPS;oKK;mpCk;@*X5 z;C9z;2zS3O0#HzbMHEntv|FXE#0@gBeIp$A`my$X=VukH3KOE2m(?p@`u&%kK1n~UZ0Azw zA{LOmgVG;=8r*!v5u|(TWfX0tbRcFlYj@P+ok&yV2fyP86cVc&#|OE(8%_XDMMawo zoRulXguCGU5-jHrQgapwfYdrkM)(r0M{<8H8_RB0D;nf-oNJI+R`(@T)3ZgYUR_GW z7f5Y~iy9}Jj?)=NJ?I)ng7hZk zOP}mSztD0Qkn}U44U+)p<%DlDv?abd)_+aHxQ2_)R%$H-?zpyui1yste+K4 zODYmsVJB7KslZ#MSAiwP51$_5-UNwgt)9JVdaU;#w0Y~tKL!Twu<~_>lTE&|jQtCC zns`raxafF1%@W*sa*zdDj;Y`Dj|2YTPT_8=kEhdCto0@&dVZZ=r@Lyawi%0ukI^(> zFenZ<-og!a%ii3`;yops0i?mIj=^3J`ludT`yw=-3y$RU_MDuIJV+&G`Mp>6)B%s; zT0a0bSbg=65dswR8`-(%oKTvTeA8+}gP{jg*OPO8_rZQvR1jeOM#gRi0vx>iieoYD z+%=l1RYXV6U)c$qFodrVLfc~>#j`kPv{vMr{o`ITl&7wusRM&VpH+0sQL=#-)4o=z zwi6_pCF|!VX8js1#mgNN`o((n?27XEO<2SiSWEx25X*oEa3fRKnc+Y$`WA6u-{rq5 z3nnrT(5d5CrsajO-dZMG6*h|Nb&en40Mm-uKp>)Q#VRnq(sVfK5NSA?O%F*jr}>2P z6P*4QSo)e*Ttb0(|CIlvZH=mmhc)9#ztSM&jOEt|wx&c(WqOkSYqR?K8DZQbLes7x z?!_p2&B)BEHB)@`H&2R`E~dv%0Nb>Bzo$mN5Zt_)Tk_X0+veNpozdG$LEP>1{|q`_ z4-2*NK~Gd#f0LX(>wdG7IjuEIA6~O^cNM?4E_tc>+9=BJ$l5vFu4cDq>w)y&Z;%{vn0%f~mB}#Uj(t;xqHu$BA!0D(dd02a zs=J}fBHwS5a2FOUZLFl<)Rr4*2q)i@Kss4^-4mmtyh*1JVQ0c0=yl@Dh;=rxXiR;t zCP6`Uo21^%((p4CO}jqWorlSaua=b;X%M^<)V`WWLw&=kmPY=@0#vmMazZE406ETU z>w9n%#ol9{w5UNEzEm!>i#cr`hjmhS(>;oS(J;n z&ENm?VWgwWd~QCgcu4fnW+LLJT13@;vylWL}ju`z}9pFf6YpRca8?o0B zSZJJkG?)E$Rs^|b`P=4lE^*2&+LgYS^>kQOku|&Gevf;-IrWR`Q`RlXGqBmW`McTm z?;jP~J{TC-@=bj9S!(El7~?~M zInvyzN<#z4p}1Uy3q#zl4vYHdqOpUg%GRcE{S_$L9 zvU|5Nn)?T>IyX^^AY3g4Sll33TclwH;`?CN%WiH!@)pm_>$5iRdZOnm8(MDI>({@P z;*@85e~b~diy}KW724D_x>A8>_2JQi?NMfR>=qAC${4{f>KO^N2V&n770fz2QA^ey z8%=BYsDcZ-(saZIi}b`nVMn?Ix&ScT2*+gaaUcvzC=CmBU8d1#3DoR%<-)k4N)(Q;q7Zv%mBLvgJ^ng5eYzJ0JvTG>>apSnTb6j|Hwe8j#bhORrwz5<0Qtb^ z-+VH~DB}p9v}Wv4?y4Cdvo;ORiQlBE<>>W1G>81{Gx|LkdVr>BbqT9Q7xR)doFA%} zI71|;75if#_Vp|SGXwc#H|Lq>V$IA5XnrD#1+M{v)r$(Ad74>TG?VQ0n-Q0U<^KU3 zs%h11WNEu6ZwQN)th|`j7MaNBIcSXPPv|WT28wj8TOUkfT16RUJyueTgb){xLvu^KXc~h|fl+8HwCqu7eGYeW7e*aO(%o z{C|MFcL7;b_DipJC9rz0@#b1Ee+0(}vCmY<8i(!_HoyUF8QGr@G1=Li60})j8U^Xt zt(k6Xi6pF}DGvHSK!s@c=B^3jB5@1SXdVDex$?IMK4+O$_0piFhy;b9L8PNSnN2nx;{C>> zicIQh%K!QiZqq`NM>FfaYvE5+-ptt!oci@peL9Izv8|D^2=^2B5du@};a^v5DzIwRL^Pz=Ep`fb3{mD%z49P5*h83*WmA($p?JM#3TWnhqL&zNx z6K}gkteFvF9>^!xPA~xW%@*%H=TCk|;e4$*NV{ELx&X3-tWElNs-5E1&A1FDn{3Jt z9o*MZ!B8>O8G!kPQA2!Ag^7A*h|PJ>oGkYcxW6R$T6kZrgV|GI`w+>&2tnJ8n*hn#sR}%Fr6Y+KIHI+^~TeQ9BuB6*1=s#oPwFodS6_xg7DK#sV)Hmo#{OwtKK>aqG{YQL&EVI+noXW;6>Ypa zU~eb1w4@;wuJ-nt)q0CL?nx<z&L(YP)PLnn0tt#cSt@$EC1<2} zRC{yJm(vD-@5x-YcKAIot*R(*l`Xiqsf=+u#SI}5GAuzQ5k0$#2biuh>Oqw`kZ0nr z+!Oe4i@WAst;(q=+RTq(=D!en5)nqO8*d)$adu*8-}Gr8uaNjLTnuZlrer1uwezYk zsQNT!OVnou`~}Da`=}Cn^}F(~e(0W^R8GXit%*Nk9p9Df0-c|$>oslMJ1*tm)FsE{ z>0_-Z1~1kBPtke!Q~mvM{Nfr{_8vF$;@&H=qa;_xy_d^%t*lb^xH7UMv$(`Hv-h~y zPA)PEB_m2!xkk3oQ41oS2-K7_vtw`1cnz_&v&X&%NVPX=L8+>UX>QpWL zm_cqvz@G&;$64tFA=Qc0>J|+zNulHQV|8kpCW^2kmQs;vr-h8veFF8GQvN#UvR0C# zW1ay+mUS>8sXJzel5^`)95Kdcq0W0Z%-ZPbtHvAfvv|Q9mFDu5-7gHU3e}zzcs@ui zuOvBGvnfzpglQpyh}c}KTbLI$VQ@vrSuAOxbL`p6_8h5mQbUic$Iq#=6#G$w3{leF z@Z2t%$;B|%wX+X#wB2?Mau+67&FwIl#&l3n_26Am4Wo~iR-CJj(Nq7cctI-cujDA*FakZT#|XPWfd0g9LbXn z8h`X*R)M_i_*506FvcJXJUk*T{PXns`_Q6@Ym%{U8*HTa?@Eo<93$w&2pgSW1GSp0 zZ>{BDH`mZK+NT7*8Kh4Mf>^uiUkG0~%nZN}F#QK0lk~~HbD~D;X~G6PHVGm$n}xPL z|2O`*5H3J+^YaJApX}jxY;Tkx1GT>SiJZ$+DQV343)rLM1rUtk^4a+C^@(5X7Z^n7 z{UX$zQ+Aw$J3B56fHo22#0xm~z&Hi_Jf@Zw6eO`;a0C6gjvIxYx9mGZYBh$M+H~JS z_u)G0bY+imsV*xoZ&jQS#P%0{-y~d(qQ-OG5TPwFI2aUxju?hpa@+5a@G~7Xnc_qM z-H?%TrK^HE z_AY7GbnJmpi+pY;BFztfTyFBuTRVEUq=Yx<-?=;c~WZK`8J1XqnqB1w_4y@MRN z-xS_y1L4=JXP-Z^6&c&)8nk<`^_Q>IQ$V7HRC9-JftKadskw7Ue(5!gg>7H~tK1E~ zeOMr09qe@>nT|jgs2cq{Q+#-6KcM648%87)lp{WzMQ{NkZ<>b@Pit!=O*k%-EjQ2@_x0h=pZ#uO3fByN|i#?Nm z?$vcaG4ZvXW^A8H`mR@*Hi`7A@)kaHD45Lo2(i!@;R^~UUwCgsy;R{cvcVmhVGpwW z7%BeBvPcwd0zsb53B5vKhaWX5WHH9n_F66$?t*jQC^D-B7n- zi&SW1m%@EoL9MBG0Y5hSQz|G)ilaE;BDpo%$%PAAqc6p#dQMJ)1V#OxVT>Y6>-F;v z$ILhgLGVc4lnPPXMb{4KyGKYQp!lbcpP&Z2GKl(|Mg0fn)nt#ko8dZzZv<%u;nLn} ztDRgqVw3G1;?{*JvBII=Z$a_;^r~E1VtWdpwSYgh?z08?xJr-ulAD5>1v<$k*6zJ*g`+u)g;)L^{E3 zSX~|c#YCpMpwq7r0ztf;5Sq)AwAAOtuA{x}ein{oU4OA$mmYU+aany>K)vwhjy+x} zyQ52&r#!=5MD>fyZzH#lt>@qB{3P*4a0H92Mv_BULJoM`l9jQ7OJ7y}SZ_9$hYMyz zkw*Zhq;F;TO_&Qb^6H4lZsmcGhTr0lQf`j~+VSgsA9kpmDONmtxxCPrU+9_fQc@el|3IMjCOqpb77|t|es4(`ngzK2tM>96X=W+6 z4KcB?EH8RC>Cbc61qgVp%Bfe{ZC{>K`V>XS(fNp?<#gTteEO&7Td@swfCqV!jS@y* z-(D`FLihqd7`avR?^t{#q*{*sh<0}>E1jintOsf)k7o~s$A-U+vZfYSk7{Rsq(I$p zS<7x7&o<2rQ0WNLV&W|`MA`3YGQvi?7GlN#j`uzhTRLmKcCU73&a3t&`r<1}$rIVv z6Cw`c`X|3?XZS$5CZ`ofDBC;>=dL^~BpblqCCPr4+jQm6t@%r;fLw{MKYjXY?mS8= zn@FQyX1^zpOUJdZXRgRBMJABk>KP5nxe2zPUw+XxoB~+dX{FCspcPAA5F{3?rG$zt z0e@y5Klkamd^7!k2bdr=>+K65a$fx{CFh{A?(=(9&&T*XqdD`f%kA$PzZ{xQbZaxi zi|0BpgA2#f?wZi$&VX;G=3QuGNFl9)-?@FMAurFW-brS5o6!}t*l5?nyq~t$K|=v^ zva(@kGx#cgpVU;lfq>%LU`cex(cg;d>n^m~w#9BMiVmNu%|`kQ^r97egLR_Pp!HrN z@ev^$2$S{(Ch!~iTn(a0YX8j|f!z>z{N3pi84uFm_-*5viGGjL70^%!gq;ga$GKzU zIb3khI7u~a+&=$UgWY~;Z~~cif0m)+#KBb1Np)i~6p())@V;4~Kx%YY!@uOgNM19R zV*|SJ18Y5bifCG!B*uHL6$JW(BFqvNsOiy(V>xLFA_QIzfyf?7pA~&4M8Hjrxk3HR zgTn0g@N&O#uIc4O9b4eX$Ou?Y7(nFrB)HOx%FC^IDEfhe{tVITC_#tS@UgPwO}(zA z`&477tDSLPQZ6TgvJ5wq<=EfsYgaz20~$`v`Z?LIBx8`Z1D!TfY(O_FE=lRHP$*4C zyYvXrzXA%xgO$IR|tc7fYR?h!A&I%GN8cOL)TtjDo=zNu==kRIcd))3DO~g z?Wax{4h1dY5~MymFz(w8P1(?O{Mx)*b>bL3lorfYlQ@QA2kNKUWrtrx7u*uhVC|jE zi@A{c-5xacFELSzkDMf#5&7^Ik{yNDPbnZxKAQ}?za;y*eWs@8a>UL50G5)1BBxHD zl@jZe_LUyNe0|oGc~A-u`A@b9X(6>!A2a&~0t%A&3)1B~E?a(iuy@r_EIq4yb1j=4 zo_#~pYB$wa{Gv|Ld&Lfkt}r-W9vwpo`KY|jo{AAP>6)4k&JlC++2prz8t zer-toaqACNb&C}L%gv!RTy7At#H*B{ZtJCbHoUj^#*q2M7m7^msU;dM7A^=8WIAn1 z`P6t@ZNWdjHJ5?4{T!a^>EXYBde!VFps8;<@2&${%q*wl9zZv&_A$*H<{xrm8&lHm zPu()Dk$XF!sG|K2wuGuxDwCNyRtV(??5@15JUMM-yi$PzAU0;0&JA*X{2VGwlavKE zT+^6Ly_WF-THnam4pDi2q}I(Yi(o2`f~mv%}VS3SXQEhf42h&8+2sSU4=^$}iq^?^~5Y ztrM=(oM+^0mD*yzsIe@{7yEx4Z^e}a2$nwicmatWK_RXw@;5nu5dIk8w4<3j6g=Gm{E;LS|>Bu>#^sLqe$h3?8m;ObPVIj6aG<*zrCF!~}oRlZpy9cehG z9vpF6^- z1H;uNe&cDkO=O5M*?;{}9wj(j)RLx&4Yrhitt7?Fb(C7Psg2Gtw-5yHP4gaV^gSC> z&@SD%e6^+}5b}|RQDmC_Glzm0PMNK^d^$nOK|#rx_E^|Qjm$V!0n+dDy(Z*pgi4Go zwJiV`b=oM;07C%N_!j0mk+o`|T>o8Iyza=UrpG<7m&Pi9Az^{g)Jp8s&+rktkI{o|<=7;a%0!c&CQ1fGO-(gbiOBaPz1gb9ZyAimPFPfcT-x{i6Qt-NBy^)= zFCSSq+Qb1bHD-6<=qqCpk-;wjF6O)x zula`P^>w_zl|Vz7j+YC`chJb6#-=Td@Iq_yfY|R zil0T@*@q1a^7e;I6>L4dkLnH-C(gr)e_N+&ArUGJyfmCpWNHU0uy(;<$`A_ET!dBX z-1K(1Tv(?1O&o5sb?d@Sp8#ojU@41__HEt1)pnvnY?RfdUm4dn1xtpRmTQx!-=nIO zm)r5|?mU&@*c+M`LV}ulf|-`9k2zKMFiHKv2jkYkWYZMb5*@H-I!N?_QkeOB=;^cM zw3EtIc`ZpgB+LB;FCYwT$K(TOAB(%S6eoE@FtOlhV`@g0UJ_*qO0sUQj^`*NjH$Ss z9-u|zV~*B2_T_`I6%o~4+45{_$((!)78)IoZ~F9W7b@9~xg`C}ra9T&Wyv#5$xr@O zmrpl!noe}YW-W?-P{nA`BlU$v&P#4|qfzh#%eoJDRDvdy8c1aAfW_k^81(fAWPg9= zPm|ft4Dt96uz3p1*R`Swm4fXRvFOM8w(5d?kxYX$;kV0W_^T}C3FLO7u>aa1O7*)> z%Ivb_ZplTGlO}1tdrIu~JP+cdw#H*rFU{ED`Ye-e*xjGjC|U4~T5Np9=vsA%h0^_f zyj$J2Cb-2ceP*}%@-{3tK_&QyMiQSYs{jS!;i-}QFB8p>uPv?fbu>|{apXfd+4+h? z#OJJMIY=IikQMlx^22-LnYKWA?unEuixV`hDrm}f$8ni-Pz5GYq6PK9u3-fy&Cr?K^M6I|Ju%*rSTJd{yez| z@AQj}K&lr?hwgfw83EIne&dwIE^!ze(yM2h*}>fR@=xMcqzZFq2>DvAA4tI_$TNfDWU z{&KlV zx7zv;v`Ids2uplNbbE$0wme+bT-!j9Ey$2=-)!c0l^eK!&6D1#w-D^Lm)^zIuW-Np z+~+yj8{^oz9+}{uL^SorW>i#VlJAi7N||Afd~PC;$;iKTfnom2PPyILFxGs+tF6o< z`|+>|TW6omqo&T=3{Z0jg1+#t$T`aPqav&``?KkCdUo&Ofur(bnKH1Sj>f_Lba)_C zotdt#$+#Ge%0I=O$<;gb8Y}|`Rt-FLZI^cza&EPwaav>r-gIA!9fIR2Ccf2dRX42Z zb=|^}f~iIEz=fytbks?)2p{;01lE{d?7SBjFtx~{uO^#ZA4>Yx@#-)i%f{l8_I9>^ z$F93vS>2DT-;gQ$2ln8>`sa^InfG^%&A($c+I1`#z+bH{lWyI77MTdkiOuPc2dp)m zz3VvKfAp=%9j_!STO548_tEQ$Lu5+lF{4S1hHdGaWNdV3Kj-V}YQiOOk`jQKO}PHm zPWJ<$FwPpOL5m5Lcaug>;$L?kM_;piU9szXCjNx11%$Mdz6$L8vY}1YZ~uI|I;n($ z38vfYNf2!7!$~E*RBmUPOeM!_F57 zDcgJcIuzHSa^3?o?bEC*0naZ+ES)nInHtuyUErEmEAYewvmmq66}y)ofhU@4EK;KX zlE24pMlu}m|G3Sr4+Nhy5(Tn=zwP3=rs$~XP^=I;&Qp_E=K2E-N_+dqRzDvL{tRP~ zJ=Tv)KWcyaj`=Ri@)$U*P;6@@hk~j32s1X7Xil4db+}H#|D{j#*#dI3Dal7aJF0vb z7SiU1rY}B!{tsnV`sC)RoSMR{nwxDc{v-U`#h;8%9?mcn8iN>T;~ev{Vk{cNOu|mk~jWDh-ZV}e4i`&g<3dDee6G;@T~sB0#_JsTG_5P$$cd9lyz!ijxIyEear-M5;+kD{szdtiTCzOB@&B z)A^oRLjv?>jP?+}0$(nxAtg0Ma>$*YuOA&ZH*AU70`hlhti-fWK}Z1x^YUyJ=!9=Z?V<@2OjJ!3l}w-R06&IIK%j4;tO zw6I;+!GU%J682r)fJ{;?{$o8IItdZYq?z6D^JMgD&awPn84Fc0*ULdW0oYX2L|UBG zsupfI;S2qhluPc2TBA()Ypm6*g4ady9)N*Hc{3~307uH4Ur|epS zcbV!B|C+>tr|+tTHkZ0Hy>?KX*{yL*dsg%2*k`bp_f{^{rl9`?ddQ@<3OfYvMBq(L zH=y^flizQb_6BB$YDt5&RW*yQ^!|<=+S|1P4cd&e6EwOHa%E_R-xthl*QGjk7FA`J z<7YIsl^JGejRY~#qaPYS7rmT|Jj)oDv`vY~wSwN4(d|X1in;JFihp`}b%&U@GTGZj z5wED*MAm1!syNz?>E|Y!Kv%a5X|=YNbgo2#^B8{dF<56?P&%-I^XmL%?`P@Kv(<9m zBEM(ye#@FG+T(xU`6sGKC~MCL%9V3AVc4}ZwdnlfdxcRX z#BnAR)(1bSe~DO_yu7F2oWTmKR*C7?Qrj;Kmc#zATxi=WifF7#GZS$~c;7j^9ddNF zK$$SiY(SP0p}1ICp%N&&9IJdFZpe@J-+70?JBh8A3VhKvC(m}+v}USf zRL)Wt;;zNf#;5PUgd_%H7P>l|mVrN`lv|>4+8KK<*yK4`OIyBp7Wz=iG%Qwe!$W?diY#dV^hsPKEk6jrrnIiUtf$SnPoj-GIlp`Gd^OA{* zP=F#+r{K!kMJ#SR;Kof07>pHI_RuD%A3wP;gsaX5trvdY7zS)z`^2eR z&9>;FAjn)^<-2p|*jaT#S7Y7RptCLrEv(_6(D1_ledAKOzf@wug!R#q{bj)WeGx|B zZ21ny9Y>7@*2y}d{Doe#bNY*`%X0M=!Bb_acG)3e*RJ9%$@Mxp^{LLl{a=(zz)T)4 z?}gytYUf{98%%+ruyJhR)3LI$_k4Uo3}>?@-YM^GT6F5g`}>D5D5H!_33n&X6MtYe@jIp6zH_ zl$9cvDnli%BHiQJPN1P5hiq9-c;`k^PV7B-uj|V`$yo}80Z?sXE}x(d#Ol7< zznL;;)g;KYnZ*00Fa#loXon<-qfS3+K1SUH61jdzq8%-yb8-b4ZAP}rDNC7_($c1X zNL0iP*>f1&FaILiE93AY@cj0R-pYslU;4R|GF{ARdM{BnF;KV#N$Q6t@`Kfbp_iRFZIJ_1A11u><%L{-s?_9xHtmg`h2Aj?}T9F;BlVVCajP73-#u+VK(mNis zwVi>Aywh%CYS{I8)%$0fFh0`o(dbwP+@Vz;zzm5Di<+%Xr2{x?UN%vlveqtv0?3GI z1>dObp5;oXZp3RF>I~nLM@Si zk*F*%(0w|i^>NATz)Zi~emT}mRm*QP?XT6=hH>WG;;}qBg-MS{{>@X5A1v7MR6`DK zPtlu8{bk;uI>cu8#=CybQXK0FIrAcL-t{3xuYaiF{TfrH^>UI&hBdgJH&fhlD$p0g z83nSU(&2T@A@4t%}_AfY?ZI{^n{8n zKm;=-Me9G~j?sKSX_w+)ptv%^)7j&Y8(muEiQqvGc=!4U-p48-G9!Z2pd|nfNS6KZ zpzB|G8{H4E)CojSfF(XfRDi#mFe(jK2^=0`dpJZiIW!dC&$}~!_p>QMQN7UDALcF} z=bSUYRRchjD zhiw+FT68_7nwO$ND(gc+Ek;G2TFxvKVb=&2-kEwwaMqTfkJ{N7e^Ds{*3zCY|CH1X zM=3DhxvIJaHceY3;SHjtL?E9We#C6%I##fMNntdj!?U_WmrlmGTcx6G-&jp>YEqCphPx0(fg3|1B|OAjXjb0Myv zcnTB@5~wAj2i~3}Bwz|q8G#lH)y(^Vb#+75fG4{dGm?wbW{?qcxE0#5f_NcYo6xLx zaI8;He__6j!3X0qeiah&EGWaL=v{M5P z6Fvz02Bw@B<-WyT$QF0Y`HiVV)*5?WMcO?d*PqKiLSMw!)wD?%^w&`k?h0fha5?US z{I5$Q1wt1%- z7vJ2GsL5s1sT_4KLLh~gwad6RPNFJ4Yp_{2;vJLGjJ-Iw6j z*d%-x=?GoGas7I|NrjkDIJe^EGu$OF82p)~|M;HM)VRROx+_14T-Roro=zhlx&Cyt zk9DP}hj>ljCvS~+W&u4EJMjZnwmc~guScR~+p(Rkt2vcyytpgMYMr|8wZ?ENhziLN zE{keDpoxHXyY#DFRl_)1!fo+9?tC{cbqh3*u5!=^lN~d@+Cd^f>JP@;`cIa#Us{D@ z+*+Yi;@d-Wd90!2aHl+s{8JG15G^`rb5=If)yklVEVCLd!pwB@X=@XqBN`lz6r%v%)Lu$DYyG z6*jZ5>3&m`W+wmAlIYF0OK@6F98p+K>$EFQUn%ubH7BtxTC{%(@9#B{QHK~^iM!=(*|PkINiZcZ-PhHo45Vg{p2o+@t@}zh+;BUfur^k{sKpnp;z?0M zTJ|TOR+b`xDNm~j_>PUY7St|nX}Wv}>=;#{_XhLQs2S0@vTz<~(Bly`dTJq31?>!c z%N=QU!dRx1=E2Y?^y7mk1=C#pDeXt8;$m`K7DJpV$ZWj$UYlV8i%j?DOTgr_du=QM zoZ*Z_wvWrbK><-S%%kr*YY-@i5!!z5iVy)kwF3m(~{{N9upRdD*UQk?u5) zdFdxAJqH;%D1}vPP%e?*WCdkGlVI$ zn@T5u@O%RVR`s8V8fxw(e;tbnj!q{e+e2P{AeT31L=wHAsf+*^2FAF^XYRU#&@;&} z)|5EQQ_icD13Z=mDTxk02*Sl9MCe{VJsAA5G~EBLh)w(LYAP(_i7uXl3?V4LxuxhC6-G;fEFw#rkcD+5@ z_XA*gMLYVlSvRYOjrE4ZqF8j_$?F=K53}t8YM*XdieUc(#346ua+*^c=(P1nsgH3)UUykWRngdlEKQ+#hIt0!SIm;e71`DQzSbdYSO0r__> z!%H`&lL~q(5?Z5{XP0M%+7%}$C>b3|#_^#>M`|C=ii#?nR(HqaJj=EV*Dg^L;~)tAFS#f-veq@A4Jk3y5Ynto*3XTUYNtO!hm0)QjK=chs9h??FJ3Xd}W zYw>yOdHXmi_-0p{;DCy_qU}8+s2X=C*wFH+8vnTweS_+B|Jq|#0l9gjo88PPb{TFk z!5(3^!wVLZ>fkHaXSqfgMOrfSS~9{gQSza#-lH{-4XkzxDjz9VD~u07T&(t0YP6o& zFiN?WdR^krov4vy)*}JAOa#uHx$4-cCKJ&18gvJd?wvruEXdd21seJ$>B`R;#9edO zAJ!P43$pr^Ia8s(vN(Rq7lw*&jGt&qofx31)mobt0vC-U(a8%L6delsZE)eZKuLwV zP9@V4U@T?`ZrY#A@RiWvEw)E7Zf7q!Ed$+t7cxTUpy~BoBnkg)*(E8<^8_t zGYHL?7#UG$x`@EIEH?PJRzqvt5~$H+DOYcubxpJH zE2$&)dgnfswNl1oPH{q zT;)qSEwsWw&$1Jc}c!;>PLq8#^{>Y+!uF@ARlN=zBe_1 zjECl0?tgpsRP|Q|%#rQfl3*V$BByeNoqeaaf5Y|sn<30B%TV-mjqvIMdeyLhD+%Xf zY?g6cC1R@ly>;o6JFaoOzwn{1BQ^xC^PQ9JCl;UsA-Ge%OQV5t`<(okL9de1WyUtklXPhx ztpkC?e+0Zu1Lx*y=gJ)iSUd$cv`R3nKbwea*SNeCluMvC^^@$66}BpK;`0uZYVh9r z)uSpgUY1-{k{JdzCQ0PSnF;3R=V#Cz zRUx_0?Ea$YI*8x;^lz~v-tqjJa{n!6!Mpk(3|~T=RA^lmvE}yiwW&txVkLOxo~Hm> z>5Xr~83tr^>(;#`iw(B~4SY@IMY%dR9@#>AB>gVJCpO-2q^i_A{-DSQ*R@ua3%FIS zF4R;_u1n)%LlzcHwLCFb@{RdAVKAl7Zng$B`HX)sh0YSW#V_qt$oW1;iN33xvQ}{W zA>gW;^m(2$?BTQf!Vjhl!oX}p7apuNqe5_=z$re2?P5+Q;pCrqgWQC7ie1j0OD3bjsSIm+-m60U`%U`QVuEer0!(j zqSuat+^{NFvC;L6M?q)UyTRa7?bjXV&tqcI?fn4W?gp*<_y?>!Y(S9)`36tFleD6q zATft%I6}275(LnOeTs~5IQy6Ty0;0SU$aPG7`)HaMZ4W=am=B(XWDMC@C5Mhus}!p zh@6I1gPYzwee~mc7i)zytFgZ!s1*1gpdRMH!w*3ID$iNm0;T=HjM-2D?N{E$bB9+e z_0`M797XNn-{MVOpkV@PbMYnBZenZIiE0(shiSJ(N;xL9aY^#5J}4v~Xgp9;n%%3U zFC7!Ef8L-*hb}Tk@jN0Flg*_S{#O0|#Gt~m;&T4Y?O~Rg)xeM>Lc5}^r|o2B+?*R? zwaOqn4V1ipO!tn1wEx03SouQbaNK<;Y>D@KB}^S;%nLUGD11OX};V8~o0_XIUnRJw}En632He4LZ8Ac|Y8%@oSmvcym{; zI^8G`U#q#DmEnDIFy=Rx9N;4PaQd@QhSwO*384nL7mL1`ao;bIEMNEiz^TiR`c*}U zjR7tzMQDN;|5FB@9ZUA!bQ~Jt109%NZaq6Sk;$LEp?mFaWQf~iB?29o1wiGm zYufxn+jRCTFTU)4LLIaCVw-ckE`6|~xxyT` z8dL4w@Yda>={faDcg$kt6Q#H3b*B&1)&N8h zBSX{6sk4#)09@{=!WZ#FRrg-+lr{OBiW=1tbq^gczp;jIvbSN%9hSsR>H(US zs7v-W?cSi7!sxl&&?k;vT-`gze%5iiGuO8Y_lYgna9FlLZ3ZjNh+ReeHB7ss@ObzA z_+)lQm*Lk3)(ZArFWqOCcY#1j1L1y&S?4-Y^9{QY{-Dm5)6@rzTH(l#{yx0#A1Rqb z;*qB`TtnbC181ZR0;Y4md-cFqzho7yrs6iuM4H5|y23A_tT#?;SF)MZ)C(WQY!>LA zvM%ezW9<7P!LfT>1y3=H`^3XcNy+4Yy{XGwf<;jxqD8lRE z2DKRVjO?2pPGDY-b(QDH$_6A10nfX|;qFji9U$GKO4?+E6w->*A1I@?R?D%e0rL}# zU^VHxnZGTeZT_qAYm3NRbZi=U1`mCOFuVdscVvUSESw+B=8*lo72UUE>W%alKw)*ovXkCA02JRtV33ajIdvZ(BqlJEMb1G%T4-%Q zv(?eRA{qx-u}w_{h4Citf~N2B%xWVt5fd8t zyhP^lhO|#j&^7}tChZ#KFE#yO@%T2WPtMQgZHLj?EtlwsT38tM6J9_zEo)eT%;(bIoSnLD8*Dg?C{&E~<8{n3)N1dN!jm$6i*S zyORoeSyzYks>PP81zUZunz(IEZ*YqwOf?C*`q{HEq{J;(i`fnoj1C`|M1R)2dR`H6 zx36F7E;{)Dd&+sGW=YPUvZX~a3Cbt?M#V3rnl>C==Kq5AUl9MN<6;CO2sX}ExP8HJ zQSid{F?BDnsvQquG_q^z zRmgr=f0m+nlmeViD(OMTe$@F@h3PUFqq7Gz-lu?^lmiJxgY0J7gYj{U{G)~HC`At% zg-tf>Y+4bwB#x3VeL-v@46t}V{Z+2LihoS`I6hywbV;sF|JbnbX)ibBWrv{j0DD=@ z&2Ojs_w@skfXN?x97)HD5SFCa6hEeayg21ey1?+f#_2R|l<4)UFEg^wB*}72RG<6U zZZ5>_c~QX&;S4yme!>L&+lGQRZ&t?i>Jd;*f_xTdtUO!$wil_8tSRpI%`FlE+>oU3 zb=n?~edJj+Y`hR46e0u*$ozr!u6z}n>{dN?^v*3S=t#K!-uRb_WX3_ z6Zlq!wN7snu^Q*C`&C?~zD}=8YiV{E! zfBTHiCAFw|(xDOo9CrJ+4G@r|QE!$1xF@)6t1YO|pM z49dm|)beGAtX*OSJtN0>Fxx9HD`nx`qGayW@^Dl|MfLz|L?52MD}3VPi~2Jsf$;js zl#Tgi&LkhWoV8-FLg7<A^Z|Ibk)~JCNSP#>8y@(ri84qn;z=GV=yu26Um4Qx`go0^jMYlSUUsYnZU(p%; zq#^+_m%cRy&GO+JkC}CnD2~b$>NSh)d3V~W7F~a{8MpLeAd~^=9u!*URnb1zbi#Kc z$il6PJ^S!7V8^D4#0(pZsD9bur)U}0TJCJSjl{|a;RS(K;^hcyk#y^Ef4+aN&wC9zeL*0u06ec!^g(YkY7g6`)Namy~xRg zsNN`M7|Lp$)(@E+_C8Kv7nE5e4vrDzg9!{l&n^(T)&&8%(rQ(*L9VPa#OJ;H2Y;+m zy|Ff|%S8t2T|aQz?an*$5ceAtIoGs63sSjT0E`06AI~n_b22!*7sX!~u4TxK)J@R% zqUR*AmC_ZWTmb>F?W;OfwVB&}%d#=AKqEm|HPs=F#nrpUM#!qspfA53gTeZQRBW8I z;l|-R@3)YuDZ>xy7^ZC96u_qwUy1`eSg)c$?^vq`RFWh+EvcC;f5DjJ6YSCzXb1($ zyK}9pPU%mBk#Mn>68mYhPvhNqK*qtGDg%Wk-MK|<=LV@-@`>n9e&FCj&tASKq{5mm0~e-n-uxu z&4@)Q6Ahz;Q#0~AF?-H>gIH~uc;k4OYD+!B-!%Elr1Vf|b@^-jSqi(%4MNNg{>v-L zP87s*1=qXPg8%bXRoa_oUBY|cm;HOtJf>0FZyzc?z7;$KXfVOK7-`qdJgexp;-?lb zubm^{8g+~_{{d3lvK&(^|33cC_2(SEIT^Y8{XS8gH5{vYeYaYPXEwIyaLPIW%jNTC zGGjsY;j5MT*%qHcYg{ORkVFd0_Uh z27+;V`Yt!ZXRX9E*@0^-apd3n*`?-+W{2KRYuyfO0Q)fg#F#6R7LoewZXC4YSlvFY zpAI?qk^8iZrI(u7D_`P&Fz@|1eM6C`YBB$y^-}%THnYx0O(8&QzC#ch?Zu4BmpIN< zVhn|Rn1qzV2U_f@T8Y2d9N0FpsSWjX8t3?*8OmUmb8Ii4jasF;fR%8R{m-emB!NS_o#Vr?(iQ#KYB^;qtBaf z)XLzAkU4zlbOfToJW=?jySuu|wFxy^XHMBT6mTup@c$Bw{_L$!LO(;CuPgr=RieR4 z7iWa(k1H?Ftr2S%0>-dW>~Rm9l_rwFezvv$0o2)VMs@rL5EKodsQoZC6ez`*r)KSW zECh0XSmAcHY+m@)^4DRBj7vUdpj*b|pFn%=a*4qh41{GkJ(ehr+RE0%N{+-o)~SA~ zE>oW#OwIMiYbTg>Pz^@9FR)P!%+?7j<@SR@G$T87A7^Y<Dr`tts_7nTt3>ISyikGUgf#oL zWNqM@;l0}LQd%&!>Wha&PL1b#ssojG0(~JOOtJ(o#jqM!{(+O;-5^sBgdrUya5(@3 z+$MNF$nFIGu?($uaAJ>d3>3+WTRd%fsk}VI+o34Qj*1?vz3;O~s#ZU6;*d(e{7YYrgsA<&+g)B?+R9U^{nL0^W zWFRZ+o(2M)-wAU7IPsMJ5qm#3Q6DOLqQM_kjD+!VUH`UcP0p>G5s1szJC?g(KnSyV zX}5DLE=z0R><|}PC^t0QvQ4AH@h>R8tOA(1Q@P;IN3{Tg&C{)_y6PRTmpCPVD>>DS zuLoHCU=vdAO1(EU^35Nk#2k$>gOya2<7D<695yJi2NP=StT9* zSYvJ)nwh>Nxs=f|;a($6WJIWs(|xv%4+J^%*HcJbLy1j^0%FAxjQZQ!wYXeiCPKDU zg0Y_G6a!;EIy5pllZmBV?;p!91uMV3rrfqHD;js<*|! z2|?-0*e%gP?<0t`93+<^n+kPrU-io^SgSUTK_@tVr}*LYhYIy0a49VJ z;ufGvL_eBgna`#0JTYE& z5{m#;DJwPpv0CB_QI=#CK_Ic0!W>9#6~eJq2gzrDkcY;y>3L5a##`{g81&a%f7=zI z%4#k_I2h7njz7~QC3N?jdiqSeY}&amqf1i2HCz@uDq-P-v<(k8YX5K)pOCFxDeiWk z;g&4HJ-b6Fn-=f&Zs9Vi37pRYoZRG zTn_svK<_$i6yBV|+5c*0F@K+eEg{;54dW?>lqCSO@+cS`NJw4aPX^KR{ebgqtn zb&^(qKsagP`08|$R)e19K;?F>(wNZxhEuteS`JM#?&7Y>qDuvePS!J;xg^yjY61B; zVdC`5(B! zbMEMNFJ_i`Ha6`_x6I7cKaGUAx$SjVwvh_cQJ6(MDva7YKo$R6i#WF*<6?3oeAIz~nm zLJ>YueShco2i*7lc#r#>`~7-d*Yh%W&D5b&oAa{I>hF*zb*}WeuF(1_I|h2Yc5#W9 zUjq%w7<~Jm`m@qU{8xIQXx=xz%&L?2Ys`?)7ifY1j*srDB9SC}jrMgc6|ZV>!P5t? z^TovxzYpp~s3~A8#6vl!g8kEV04#EO-~@RzjX2Se-WWT4VV7x6KD8i&En@S6?trZu zZApN2S}3vd4TI}^{H=ec@gV77IytEvT33Oi5;O&sWviqXAPVf{V%@PLPaP(mne-qb zod;&L??kwWgBtDL(pk3N~S6&BFHEz2Mbc_}{9=xCP+{Izw{>Xt;tP&Fj?0 z{G`m)EJ8*}o+at;o+O;=6z!45s5s~xOd7NnP){LV+4R=fr*9|B{>XRCo%&ZI(;B;) z93-`p9yVd}{UvVb>*ug#C%qVbY5xmkouWm?QW;WN8kc_T?oNqY2s@&zG!RC$G6nKX z3LiIN%ho;Rqb|*$pZZ?SQEcHaK9lt3>vWK?%HVN6@Ovt^J9)gTuQt3#kTon`$ZsQH!CfPQC;`$K=ZtW zE-CJ6?skMXyl6}`_p>HW zZ1}MJ^T&|3%J1)p{zP$9d?HBBgR-t#Nm+tA#DB^%&iF4#(VAv<$=cH!dhjm6%4;!A z{$R2v_dcJ}Kw-5dS#ReG0L@brARTxfY1quBJp>M`9A8RST!wg=gAYEws<@2Qf4q*U za#)4UN1mO0Iyd5hlQZu})IfY68$M<_k`8ZknWX*GmVYPeP@l@@u zmUL4vze-7}v$0mNUB+G-#u@DMHP3&D@8Rm2gfxwkl!BtpBkoTUmg+G00st_nMuz#M znJ(|am;zUB=E7Xivb@UzWaPin9$2&-q^YF2oFSdI5lQtilKOmNvd?W*C5_@j__WL3 z23#FWdC1)JqLSK?V8rYrx9}D-{^j*=1^EYQgV{5R%%g5D8K3$?^(#^N`~Fbdml73= z%Jgqv;tbC&*T|4aJd_xesXK8~JzL(^_g|R)8Myh}*=vY9VJ%%; z{0D`{(M!A1S!O9~u`})o?Z9M~cEi@?ojJnZQwZ8>6e|*Ip?Hy!z>KzQXnt8jH1W@< zo~yHsbRcztx$c~m5)H0YEV%`Ke}?_%cEw3}eqm^i)TCW_%k9&o`O*UE#z&u8X)s;? z>_d**mZ(Px+QrvC(uhsUM$f2N`@gG&5&tB8LtAb?EF3-0OBLGmcrFAHHfBT%>lPO_3ZWv=5Q=VII zTU*6RW|UD${}-3|r##I~lEn2QaT+BR;1mG0-&MbXhWp89>HkW-uyJ&GG|^ZdeFtM` znnjoJ|2_J`rqNipYD~ri>5=zD(H|yUxQwsnCXO7)dNr%DB9=Rz;WMu3VLM@KNyDXS z3Qg=qB&UXv_1XibC+$OOwGPz_hh}wO*Q5rAz7qgdT^T+>3>_ZY>^{5?@O%I`mWWiWDy&vIaF8(k*xJbWeh!9piE5r zH>+)EEYHwtB^i&E(flXh-`)*F<+A^Mhw!Y}3$%>M@}a#xriAQldQ-CCf9l;H^f^%p zzpgCHKXMIGwWyM5GQX4d?_|w#`U6=b{S{x{EE3OnJtbPdJ{h^ zWL7Pl51k4hFk+O8aEmcL%ae3;WD8=5dCZIZ3iuvJ6zcWf`T}XlJWpgQiw9Oy>YjS1 zh4V;^jH>`_WRQ$3!me2&N7xAB2&=^A+kJyt2%{@}XdiXZj4hF2IJ7xbAtwFvCcR-~ z$cvJognjY+>6B60(HS+9CK+t4)^lBRvPr9LU1nkHuB?I7+YY_|E>Li`kvCS?2Shh;0{F=7~>3QpO zU^k$N1$%D$6PwMH>EbhuZnXG|4ul{JgE-bzS#ME^i?^~Q2PvLO482je}wKBni9fR5w3IN%@Ba z?VVBmo~r$X@F#LXEB72*{@|QpA~1Ue2UhY~k;aSHJ%iJn8?vgCpzTUOG*8ZcF*~Yc zRQujPibmO1$6WH`_YOb44Eo*YZ>1Yejr{G<`S<5PZOf^9M`sIWHGdc z;OJ)WX}ye0$G2j!nQ^8;b3CfjQrQlC0wPh4G{6sWBY?$?_hXG(Nj+Ws0F8~)u@gQ9 ze3BM$ogfFXQCAE^hc;$On289MNH4KDnXSY9KWDXcn73GpUnOGzVdar|UybjsbM7Ee zi!Lhs67l;sH>gRr{-1-mhyp{AOcypcK2`|9?2>`8`mXiGbV1uTfyuQ%t%N7#MV)o^8bEC*Kte{c>j7 zpYW;+mbmkIuK2?}|U!TrG%WG^x$ViBAT$-14hBS*=AEYI|mR zLiM2P18qUr#To#%*XQC>g1VOi(!OvaZ{b}ti&NnM_{-$DMvFW6t4|&V`OjCTW^f~dmA*}WAmba@Gr-9DnufaD{97A;>B7a=F(vxI+EnVtZY2UZ*jP#!rvoUPRqX*IubnbHh1h zy5Xm4kFt{6Ot!V*Tf9D5YF@_xpbC(xoQBm)Ot9E?s`8HnQOy!r%8>?O`H$` zVdIfiHGlW)=!Ty8m)Z>dv`@5>2JJSpIvK|b*x2i>^iL^R9r1rJK1r@29={U*VKaYv zBm3L`0NhP*{yoRCU_e>Td9+Jc^4!$1!QdB&Fzxu;VH2QCg-9^+0lAaUk#GFRvoaP# z^$5PzWjj_XM>xA=*55Tx{kLh_B^5m=`(>Z)4}1ZVwWr~pgpXp-uocSf_81{~z$IKF z<;OZI*pkuETa?2^=uB7K7pO~b5SUMwmvbd4KFRw=KMkS6Cw5(t-HY1WdW}`) z!d=Qy_ThKxZo)2s*UWJ5ZacX}n7dCWVSgBL|Fn6jXst$AswaTf$l+3%K4BKOq{_#@ z3ZweVra+c`GlL_z<)k=sqg{av@jhC3R`l;T?Im_n<*|YptGX^_e;`32fK#`vUO$%` z<=Tm7iND@cK(X~2Op`mS%4a9Y$Xo_E@?=DB5DQCL_!A$ZA3TWps%!-{wEobBdInt; zb_x4=tiQ}$6k_a;S53#+auP&e#1!XNiIFCjl`FEI&gD9c?i&vD?^ z5Mi;Ak))~5_;*FDD5QX3y4*aK>E)`I6Pk^YKtlC}qrD{45$?(*O_KWK-{z420hWNr zKP{YZ9-l!QnnHz!fw=`yGvQ}DA6)pWA4)39-6uXcM%)P;hPT}FvsMtXv$b*z)%2jS zU3Ca5(QE)L>l)d4PYI#0i^zgcXT{k^bgP!bdL^L%^2y50A8b$J8_z)cY`vTMzA}}( zGQha>ewxWysUYNyWT}MrQ%a?nec!N)3&h+Rm-QiZaEqWF5XYbJqEBQ<9k|cmF%7Gg z;9sGx$rxRHGDzsckTlDrV^<5>4P9ZAS{aO>*=pF*q-!!nb4e?YYrhYwPXfNV`Sml`h*_oJWVk{>vLG zBEI(aIjgLtu$^jV&`oI7ZCzcI@5f?gmIadeqyy4}&Xts?HbDhMfph~G;^EN>l2wjo zC4IhsaBXPI<1vY)H~f{z{GE0Q#G{m$Ydja|nxzR8lV2e`?8S=Ao=LW%BM>vfq#|Fa zRU(aWMa$CBc_}~rRh^|UCiLL7f#F^H7={n3MqC8Zjto$C9{w4eY67{4y0?r#5!2~a zqGp;)6&pdH6d+W>*VOGAOBdJgN*SyYTs)7@DMkKtON;tS%UB?BggO0WyP(agA6U4O zDEiu~1GEArHOVNL6;wAdKN)d((xeI3SIvvr?OjvOBGt&;;pH}6ZlJ!p1}J;mZ5@Kl zZc&t(`UrR+mpX2KlT`nFE)n0n0+&_c{b>UF?DHsVGg2k<*>A4qScv?f6;;sOzOM9l zlXEHBeHeBJPz2T8o4XzC{JXm}WN%Y%k^EIj+#KhRkq`PstQ0uIT~QOMV_30VU0(Lj zVQ+l8>KFon$^D9Bk{8VpVhy97_CVdIWq>`gY8#k5iXy{&3vk)BH@{%}abAXH_0771 z{QQo3k3e|~c={od?t6z0AH&_omhI-hubkbUPwp%PYMg6@eJQu+RHG&k$q!7ICFk+8 z`+emTcZ6*L;!P&E16uNO?fZ5Spl)Fl>FFob@)?Tmd+z&B_CC8y9{&T3y-L1Cw$>yr z>{5%e`R;i$Z)KaXWKNF519h#VD3RKh(4GXPVYF=$SD9vf>XeJ`(v|G}<|VKuHgfd2 zY(-T#Mx`+1WTo_Wo@gjhLl z`g+0@2Le?8R+IK$eiV}IVeLmAl7s_gU$y)zsG%<}4zNLVvr5EL13Bb#ynKM^fSJk8 zSARNSce?06%A`(7)_dA9Y@nMYTfn_k8+I6?bXja+-|C;^bjC9?(f`Wp>Eo8SE;-U|^8B-)eo24MRO7i~GHb$#CwFUx6G=?t+q2g-By@fCI_XWklk zJZjWGcbz6$Zwf~0nQP;otD0NHH|Lwtd!qiz0=G-ewr6@|!02?fV`LV+5izU+`L6kL zknM~1S7~=UvcUAjKFe$V`c^Zd$EXkMQ7*sI zTS?Wg*{X;BI~^^yvAz5SKS3iA#`KGS_d@hu$;E z$hz^Tky1lKdp*`QpAgEZWMI)uaPTGgMm!vv4z_NB1TqL? zBN!zZ!LL&1wdqW*DU2$Ex1;wMZDP-A7;>PYuHsTMWK7$bMP}<( zh|A3!?*fl!&J(<=^R8PL5NKUp!Ev|RmCl{;lsYvQ=iH^Fvx-LO_SAXG=~#=O8a8oS z(jza;wnk}ktS#ePx7_E|r1$Nu#$Ufq#UO^kbjo_gk={F2H;qTUc}(sAK5;b=Do+xa4FC)UA^%P|9-3%Wu=L=Hu5c={ycl!# zHA;#tf|OC?M#H&ucTRr$0?KZ9=7L@#GJ(kqJ4m;ZNSqm>1&ueLX)c3%X`pkRC$`3B zqXyvQ%0-x)QI)eGFY>VopebgGo;7&@g68j5W|0UnQhPp^A);(TgLu3|;oO`hLiP>K zlPn}<*p`8@MiIUqwS8YKRbX5VH+YIuaUooZKJ=(4G5JXrTjh6YhHCrw5G+j-7LWp&e|4~Y2bYEN|f>RcV+PDxvQn@4#VZXTar}g?$5$-FI5bX~`qu#D}i&!7-rq z*mS7?(=tV!IaG>zDW(=Mq;*;?Iv4AY>6@dDzrSc2L4);2)}HZA%CxyHdj%?*+qKS$ z-*8l>i-DPZ8qg3;$j${wI#p-282$4eIccvimVqLd_4#bNnj%PAnBIH$Ld`sgb82A7w)K!yYPsuGOCyOoIh8ZI1Q z2Ejb&%!n`K2^r%55?S@-%S0!l)d@rJau{6|06FnX;d1u=dhtTHLd694eg8_6>ZhKIi~dagmimm?KBLZ4Sb*RHIv`8FhQ4-1snp4@8; z%fSo|aUGI;-LX2iQMnpd8~K<|E*}~Ym(cF*__CjNa_Ss6unan+_5?MXhhMXa9lbE} zm3@>OXAMXaMPspLEG3&`FY`z`i63th-J*`KG9_7nJ=6InI02}e43Z`;Qeu$LO|tNF zW5`983t2Mt0BAOXLuDk&H1bOG$is+4pigz@#k@UE9{PeXGu|dS0FEjBGoXSI#Z$9k zro8<&Vx*TY8=9rXEg>6W{b`pdS5OkVnMn`hT;--sRV`|>Gdp;7cUZt+lCAVcKAKjZ z2~gKmNclV6S%GIu8r}qLH3&WAAsL)X;WsXl)iwaE=JEK)IyEYc zl}jt-X=dKDvrH_u@6 z)wS-Coa9jU`8fucuIYIxYagp$uA_Egj=n3da=O0K#_P)Ik`2mx3s!=kcZHrEv(D0j zeqFd<`WIgyBeSvwOAfbd73XGO{WY4@o0Y39yRdEcNIUK^)Bm-tkvhj$=Rw^Goa!X< zBTILsSg(WJ>JAaQT~a?>A!F$6&omvlfvjqBnJ~Z5gQUn=kI)Ry7SUa8>-iH`^$t?w zh4<*&a&^K$$m({Uhc+C`1D4LnAEQ z-_?z>>ipzf-}Dv|BGOuM`t@(X^Zy_Q*OWX>`8-UWUOQ}pG;OX-w7zRI#g0W~ z&n&`3Y#FRYGYYg5Hbl)|BT)24sdGvKXySPRFr8sF;I_dhkJ)D>6dAb1$akpH>4K|A zN5FYYM1Zu|FS^w-O3x!J3m3pf_d^1aRe;#J2E+0A5c7J#Z~Qh_3;Zoet{|D-*Fp!N zQ^P9rl{WZr9Mtf*Vt4i`zy5-RKm}ox%{MTKy8wl6?kLd9l`IB>-GwtCH!Fcxq+ zE}EvjP-@i_{bG~aJUE?5VCzobA2;nn2e-tkHvUbVOX3);<=3wVJ?izH)}XPv`D5Nt zSfn?I81z_x_A{iG&Qv(uCZ_DJZgqun zMtwrXp>O6Qfp@e>#Qin;r~dfsxL{r#k$z)+w-<(3eU^{?IOs6xv-xW&P4ekF8#}Ov z2IX#`@)r)j5)X*m0Oc7qZu%Nm!ll>F%G8#K&K=i?wKZmPT=LAIN+Vf1fz2i;b?s(J zUyP^GA4g7=f_$Gv0MRukYGly zKz0*v?>tt-OPx&+k@!G`rTa~UQMZxVhNV6z_Li4Vbz;0HkDYhG!b)A+w3tJsj~$hO zCz4Z*?-0+QAt_v&bII(stV-O?!3xy>0UY;)vg&6rqih0jm>GZ@#u;HU6~)L+-n$~y zHIsA0r)uDp+*`e0?6_2@#f(291CjMP6;NVW9id1JBG0XH#w5 zen#yi;|>0+dkr(&QdBTXh?QG9goiX;(~dfJ!ZIGLNELF@!+0Xno;JEEf!2-9ziBwU zlr+E)6s2q#ig9mMo;O{-o^sL4#uJuNGr3ywtC~ITrEYo$CR!cb#6HB)r}!MF#rtzy zSOJf+hKwt%&W4*ezketR`SEYm<)7eFs`KkjGW^F13A0sBGL^# zt4LzI41NS!90xB2n+0Z}HB#_lD-L^*N5J@goCryB7#U+>Y3#DW=BYvA>gv?56h<^3 z%B31qQXz=p;K;|IN+B0k3DE@WpSDX1DW(v(|Gco0goQU&0cvB?%c5hf$KU+2)QETt zo-Xo&I_6?|%rXV}#*uW81hV!Hm5xdN`7*t$9qZYE4F5L$(#Yn%)o)fO2;hqJl8znk zL2G5rvX{b9F>)dB2Hd{|?u%M@Nkop6&QTWXUA>c(`mJhQvkcT?%TOxca0KlyC;wj+U$_~KfmZeih{)Qr(u=6l zRXy54JDl}}5^^n$E*&Ee2nU?b5GPs!curI3>c1XGwpK&OORQ$Mw#T^ydt=9Cb1>D~ zaXGID<`|6yY|J8o|aAvr}5(L0hF_o>;1s~9Ufn*no=hv$v14+BQpygdBa&7W;E zmmE6@MH~N&qe>?Dmh0(BOK&`_39-80%vYKu19|%3o!~Uy; zV|CgfBl?uW8{miap)^iPmQ)nLM!rn)(LKU+JUWz;tKX>E3cxHRQmS>Q2bo2SfckM6wN0b`w;hyn;v|^MH1!XG? z-z=D2`Q?_Ffj9HfS51wYjSFIj0}~-um2(H`m7Po4p<__1u%xA<0CIIpt%$9~RmOIf z46r?R1+{)*bN4waVdR7^(|+tsSU8{FofjB2?FLcRLDBCas6X82iAsE#Y4UOfk1EE@ z?8>Wzqn#)?gNaf$P70-CXOE^bG#XoG4)z`FJSCeacQ!b zn=D*^!{bM!jNzlZgAOLe!6&V4E^vrQaV6-8>te?|wuC`1!&b*eCMRP!+UNPlqyl8@ zeXH)>j5se?aDaqVClm;$0({!8TgW1(9~YwQD?WX+{_WwYiu00G5<$7A;KpPl==U_#Y8ll0>U#U zKKHDuBZ__BfibJ0M?ap&(^Snh9?6|xmD|+X`)hj%7-KQ$|C7v3Q_{NvAY81F$+<*( z>_DD*cEay9fHm`uM}3p+!4h`Gs;+jGz8&FV;Ast28vCmKZP8Nf)FayHJ ztt7j&_8#%ouI%(O?eP98@u&}i0Pfo86+h4yHN~p0un9puewFcRKfgYXs8dq*cE9s>B zPhLamKoP@^St9<%n}Bin7R$op`*o*lB@Ok0CMz?kQ>TcADC@}Y%OH1U5>pHp3-fB5 zS$Kf$jq|R;!R*589qK6wtnADp(GY37PwIu&{zxAs>|T-!$fi5nF3Z)Zq5T=+^1JUF zEbyw{LRi+{oi&@Sz0bXU6P8_&k#~jTKS?v~$4*_1n88Kw6;eu>YEf_O>k&ElfV zO?FFc3IS?m0F1I5lhLSob3E+q93x?D`1bM1^NQ7au1?w~8uT5wdq)E(R{#Ik);Q_R}|(`C&p`2_H0Jm_u_ ze^LaKee5{DSxNTB4KK50Nq?I^!@@DcYx8L(qz1)=NbBpCZi@2+yYpnZ7e>nrME-~K_Rysd z`HtH_tpj5xR|+~kAUnTUJ4Eh7KrH2h3MM5-J63lRYze6w_mtLRjl=5H))I672e<)R z9TEtJ3`9Qnnfbm#1ed-o0y}WdCv)<)u6g6C2~wjp(S#LP7674jEV-s-#B8jqWMv^` z{Jpl27+rGqZ8ZA%5x=IyS((4Q3Wto^w-y`Y-r$G=Td}Bvm&k-P)-N_;b5+qRE#|C1 zk;zDo{`QRX!=tBf>1A=12=sTsC0)y{{qrT*33A>6DWxVi}n4*8RQW1BF7 z@c*jLl}KO3QTYqR5z&!S{`QDj%*S-C?ox`1=P=(WXE4tUqoC?f)VV`mM6C3Dvqc2Pnm@-lbW z?g4)Z+r;L}JXP1-dnYC7!NZ(tY$notf^3Rcv^jy(;FaEnDS+W}rT6K9h`!o%vY`(l zp4z!?OJsyg(H3!`5e>C+xTLy<(HVFzneRwI1=KH7Y}g`&r64SnjV_u4sFb zB*(8KsKBe-F;cM^ERXg&CnmMmPlq7EOb=N)mX4cigj7KLHP;DQiF-A@9ch zr%3WXbOT9_JPK`CXca&|+ zGR{pu&@mQC@eTO0y68$0LuOqVInpayVWt?Z7{07(uEC7tW;H98EC*iqkrfnKXyJvE zU00qxJ|Nm+cDdLM{eJb&*;d^|XI5SXmjvI@tkNSXz8mHF*}qbvxgevDc&S!c(@viP z(~r04+|0&+7-4pg1!%Y^BhmmMfDI}-TRSM)2DeR|js-Dfk34k+($h)5-5^o@mu9Of z26@w@N}G7LI!GMy!vohan*rfmnI!P_svCMGS>BIpYX&;|isi|UvXC(m;?6f2g^>wcxYK|Kxb(eTF~qKDE2*Nih(Ei5fcc91j^ z?cSd2Z}Q#T@4M-8rP9Br<;nO^NQMO^s&;X4seOWMrvwZ#1LZg!#o%T)p=T_F`Sk6PtQc)yhy%E@QW+ zi2_g>8tpH`#_WG~R;lRmC-r?}sVNWW?yJ@a&JWwQ5)!YdP{_QOr7wuaqk<>A{X#?! z0>eofV@gZ->=74fRh#hpT)ljK0u=gmKs`a7F_K~yRHG1-DP+Z?f>&zIPF{3 zkqwd6{cmq{CK)={rkt_s(#-0qAM6W z-$Wh}K(k8p?%mP(u@EJB2#3JPIYqsi?3(bAyPxteKWuB{4-N<8dBt{HMgFwtTW}P_ z#JSmh-BuAlVi(o@QRwYXd&;@)=(9dHdVUSfGFd%U8yBH`%99mIRydfhT~lK6eCAZf zAxG((m5O7igyaKRJ%toI9y$`Zx{><%T9jqS*Gt3cHuu>RBrPjPSjaLV8Pv-uc&c3QmW#3$wxh(!xz4mgt3aN z)hF8F!9~3#Wcms2Q*>2DTmg#n*IE&yW=?^{RW4M~->L+a%B#~a6^$*6XIFK}SqsYF z{I^BGAdsf&&UlDBzBA)LSaxk41_+MlPE#0u|A?O!W%_hca&9yl{$)st^l(qXBq#;f z4vlDvM3!e=4iI;5Y*A7T>r2ph#|eCG_A+uWFoI2Abn4Ju`{7ZOY)~&(9DA(v3@*^T z!_VVcQp^4K3p{o}JaC(+w9xqWs8+4TVZYjwBC$(^3UcQ;I=$F^G`w4@7x)F){ z_35c`2AreTo2GKwn`?1IzmTaWYL35qkO}znwTlmFYS24{y|n7lzTYd3nMF7Zo~?0y zGId#e8nAK^m2$>4iZb^?^i)`Xy;l1HiYja#k>HX@f4PcndmlaL`qtc6@*SgTSGbST ziFk&%MT^%(*7Y#bbDr9gKXzL)SDM4jg@W=e81H&os}-sYQh#T}vY>2pd5Z%ErYPU{ zMO#{A!nP#j34;(TwFr|*2fo`#isC@=uh?tEe{Y`H-#;4dFt2M}V-p-HSN9?1WU}RI zS)7s+S5f)Ot*^N4i#9A7Ln`ke>n;(9Y*N#x#aGPD%9hI0;jax|Rc$#_Q@}dYBM%EI zsg=4JzlRO3Hw7@xq6HHtUM-kxahg%2u}gv9V+%H28C|`hm%A2iO#)fMsK*L zC{}>_X{++C{XdFuLWNK8bumh>I$$jS`5kUk2jz~ifveMf0jrG`$G^(OP!46y`HO?v zAvW^uhOfwdd`ZGx*tNWyGXh+1S!JwRrA@^bm51U{_CGF#Mnvh*WQhtUdVK>EwKBGWtl zufnoR!cz?f#H;{r^`mh=HsZWZ)n>+QcQ4Uh?|%l08$H0s1L@AKd95U$2g(9b30m|L>>?v%E0hahWw-e<~cu>&lB7p6kD7T zfw%Jqs~k-hf+DseN~~L&;Bf?SoUgM~d7XJ$tKB_ObGyc^OXs-%or9FdCA!qJeRKs5@C^(Az z-5a)HmKLp&Q9ZAQI9Xk?<7)p_NlB;kGE}QbzDRpuDdQUIt?k%?uj2lfH5>5MiwBe` z<85I&09N9hHdY}WoJ5I1T(^0mqU;*ET3fTQ@;wa7PYJOq+S9n$O|fGuYIBP_H!V%2 zfRT>;SLhS86|rm(6YO1c{}JCr0oH#9A>vD;<{utfFD@)N`zL=eBp>5Fn?udc$O?O# zPku*vG7HdaqZmeX6t4QwvFs(=4ot;>CkNC#;DhU@=QEgtN%HA{2C>&C{CAxqa|W^X zho&|C;zPmBMu+_$)fMOFuHRO|_Us-tdbmnCFOy@L8Ut>`XL1jiIR)l~DYnjFY9UTo zK*WGSGI0?l_Shg`2hwqSr#FfFWPlA1%7ij^+Rj7&^p0U8v`8-0D-wTutXtB<%=wUyUS_m2+9HR}(S{;?T4+*;2r&TjMN`3n5HW7ZJ$2f7(O@S306 z%BESz@y-Xl`V@iqYV_7VrnC8R?eY1viUBSOg?^^g*x6LErD@H5OI^2exvkQz+}5(h zRgO>u6?Zi)4tu1ra5S~PnLc@|OARt0*VyR#!E-Oik?~rY&f5do^xs(lVs~y9E_(E_ zpgwk=R)Ch~0k<%pSoAaGK+>y$L~$s+H?6y!&?s_-gllylPL z?Zlf&apHqpYSRWN5I-?a`^h}O%8?5jos;|5Pe#^EWO{+IOhhpw>7QRm7>$tF;$X}A zYp6@+gJO>PwGo4jz?w`1MDOa{Rx3qVpH-x%BI|#E8n`Ch`rI+SOMxRIK_w~;kY~JK zxm9;}b?s(csIk@VRtSI{;&AHM&Iu;dGs))LQgs*`pt5 z(8T{(VWjoQ123c7a>@4KyzmM~Lb8_G#`7QJyHb$KgVPeYgVMgAw`f%YS>S&xzMj*&H#3Q<>`>I zlrf{%-Q*x>hE|2*ffAZ?um}SCQQI}(nX&t)GVaeZw-lkz96c$!UdC#7DTHQ+ZXZ5K zpl9pBz$WLQ940Pl1O@H=fu(-QKw%Rji+6k@b1|9jhtnJ;vg!^E`?9K2-n= zE$_jm(DcszJ0Z<0%6bnx-k>gklgIKGO!yXG*y9S1f4L!$HTj`Kk2f|DA|`Dt5IsJ^ zguM41s`b^)FvV9vTNQT_8T)}x@>#!a*t>0gaLC_X=f;xyZ}M=>ctL?Tj#bmaq}EWe zak_b&n+z;!%B7%mmIjJuQkdN(+#qb;fO-@(6PA3y>o!HY-x$F_-errYv_Zh=MuYfT zcM#cT+zg;&D?Ts=FgXy}<(3p&*a1TgOG`W=PQ7^b=Y+ zGZFpS_`+QBS0#I#g5QVg zRdjh&u`#nQsa0(J<VFu8j`( zT#wJl&3KzRp+{xyUiYg?+%5;P>vYos&LU4DvDK}t)rCqQU9Jc7lzh$Q?FjP@2qgc? zXXoIYKAMe5%zlabE%*OJa)lp5cv-2SYxc@7ZkRPjPPn>`7&wcLs0&nwVau)dPc%6< zJ>J+B|BzfOoeg@v!iEmCnl)ndPHU%NW{41C+YSOi%UOMc`X6Ap;B%7VBQh=L(RVAu zKK&;${MrAnwAGqiM?#mb^aR6o+s`?Ez{1Y|0Y3k&p52wQn(f01R<#m!V8IZFamgk7 zn{T0MfwQ}b0PaTeQik~+T$Wk9iT=W$b(txIw$)l1%zvAE8OdCC=n~rbQq_<_mqeTR zmENQ_+n4oAwVJy<%dzqHV`DikArJ!qAS#Nss5T`$Xy>O;e4U~>^pUf}t`LF%*QGt& z&rpu_0?7hQ)-1;eBl0sfH`RAf7)Iy}d0s(X%@|Dp+)Rm1&;NWrmXnyTp6vNE=Esw$P>U#z|+3iI&2r>NrnDj0$Mzl!kL$eNI#c_~|3(Jd&8&k& zy0?ce4)AHj!Hj--yg`4r`mNPel||TNEF-%t%ygtKmm2#61S`bBdJf8P+Iljx)_S<$k{p5Xp`I%C z=lPEaG*67h@Egb1%<|TdvUk71m%_(Y@9rjrGyzKJl4)~AUh2`eMZjRgX}!;3lpHg7 z8g0;7beit2fxn9G7Csz>ty$2v0wc?o=9ilZkUNr64bu!SdXGhDKYNh(BP+uGuK810 z9G%<)d=;(EAC_a3>s4rXIDBZaR?&o&*Z$pDSSOd%y-m2Nb8}&D0X^yI5l5UvmVRc# ztK@l*Xpzs&ZJfOhizHI_T(`HXtcY;<`?JyCT_W95(k(5aBV8ih(miy;%su0K zzxVzF-&*&u7BdgboO7O?zrD}iPne35G#)l3HU5n3OG`l<2F7CyS?FsGkMx~6m=Ey@3Tyw&;4`nH;GYykH6Itrr_Gq> zkoRn_3C*9W*WG89|EiGEo0yL~<-K>?qC#A6W4_rs?i^s+>KFON6P5X@k?_V*_9?60cIw5uRoTz_U&(K`shJUTmDsCUe2%tc@J z1$#DQIGX+Z_`vt-lm|wF{+n^pejfvP{Vvr1zeW}f*Uin%HT+v&pdUj*(uD4!*TGkgxp=!U=NoSRc$d-JO}4 zn)3AW!lx4ze)g=W-IBV?e*Sx-a+WB!Wj{Hu-6UeJd4b$UMdkOOeE9_k!*VK*Ew4py ze7(0_=KkH=ul4oQt>N4pErxBT9pO!G+tbt2yw-orhcZQ|yAIMKvwm!BY&_SiJKmkC z_dHtjywq>;;)(0yXuB4N>Xw~`(D{XihqGj?|3|{|rQZG%z4@M-t1}_j4Njl)cmDqV zfv>&{zqK67G-&g?;kFul=`cIleJ4nKak9#c?742<$fg{mQa*|OWP8F9FuX*o%v49K zV5Cg9w%G6H5(}StW3-5P!E$@NOd=R}s?FcO!muTD5+#`E7j zUDog=YRQAl5D>8{byQK=}(r;LozRD6Rng;an* zb@qBr5?=I;`iPa4WA~VW-HJA(%|v-db8|DGOvM9YMg}IP7)l-%X6CnmB{!ER>dYkI zO)g)?YYvWzAu*KC#_wz%+wuOnY^mIf?TR*1cKvP+F5IKBH%5f9D$MDEZd?0{@FaEv z-F&%(Kfa0oUelamkL;wIJW z7#MqBfv^F+eDP1gjHguMfJtGS952($687ZsJY1P&r3j_~(iq32T<0)nQ{L`(b22eG zIeEQ$KNycHF*&)xyobmy)`T3AD&X?f1n~~=*Ji9((>RNmNhw~2Ay~3Zt8b{c-wdp- zTUG~jIhbd6x>lVfA&u9*cR{;i!XHfd0gHf_ir9j@AaKggy4L=zM->ON4aA&{0vswnnWxBPrCsDwybKWvi?Z?DQtE zLPrZ#bA`8UC(0F}NgPINWZadGib8DDJcPu&^-iGX%}cw<>_f{Lz2_`}GTc z+pDVypFZthtY?As`0S@g-^mC>>$UoLqL4Szk>n=!_V&zVeU5W2-Y_8T=3FTU^p-17 zD+`NVKo@@$^11G}$u|GCf&weBc$Szy5-71!hM)jH|4ZvXD^oRA*NE`3WNb<%OxjQJ z@$s|Lt(qlT2n3>WVr6AzpT1Gs>i1)M`dpXwK{~(l#ep=w^?|fE&F;I6F6(R7Bj7hM zldV1%e`Lh|vCmkxU)Yhn{WhTu7e+kASjn3txqPn{(IKx4B`bS-gBCA0zu1ZwHj}B| zu@yc0a00P(K-aSc|0Ed(EiEk$!|#8YzTLZb?{Gj6h|bztVrJ%`lYWMvTY7r>d4~Jm zyoji%sJ}5gJ9~L~IcDe1&Q7}bNT!IlzP^5_3>)cChR~aQH46V;V8PzbHSrK$TwIhH zwTYr!9DjegMffa14xU@a;nsF*2yak$zC z?yi&H8%Iy}6*+G~q&{)H_xESSO0%p4kO z&Na0;Qa}%ZgcbrFj39k3Cok{4|MwQ5+tz4LWmgU#`@3`o1_lz3SCQ%CKsw=weX@lXJ!{GEGJkE3D-)GD6F zv}$rKE@F8J4#6>|wD zATTgw6>u8C@bZc6Rp-XVyKact6ch5+ne+4WSM@{bx`W| zt~vv6^Ap1NXR@2W$Nv>}?(kdPI=e>u8D77tP^-$yS@xK$k-16}_$=#1DnXXdVGotW z?Etlae=zI2(5N{e7S7u8GBGi+8FP!xmyu0VGqa15^N63*)2XOz=@?ol8YTn;1OV@{ zaxr>+Jfa--7C0xhB3A%-6w`PIdV8zu>xULh0L#HFBY*xJmQK8Vd2n#x({uk$ib9>w z#bF2momRR2)WU*4_>Ppgo2zT7dck1w3p3>TG67_|%1k=*p3lM5Y_pQ0;!}vS^3Zil zM@NT%px_#sW^8>#u?Y!}+Rmq}vIq%{bORTFnwoDgC@)6LM&QD`&8ySXsr_QJ+WVB( zR&#eJtLWRT&k%ES&9EVZx05m+QY#OnSQ6GYKP@;qQBhGaT@c8aSPrIN3`^7DQN9c{ zVjHJm>j$2*!_?{ByLXx0Va!0)Hg5ju_A8xWG^w;JDS2$()=mQ>FT8DLX2wIQ2wZc- zOtwBd6MDb>{r$gxs~~kf?udrXHpBLSW2<*uKmt$%;Kg*cg*?(v^m2n9f{lyYUxNf_ z3OE=5y`Zi@>x5tka^A5b^>u)@psp+3u{j^7fo1DWa$mW6l9QZF4yQz}YnAD)?m-_v zTp5fc<6{t=d240$CO#nQ9N0)chgp8tjo;7Izh0j&$Ka5$r}Nm75(07EnW?V;*3gm6 z@EIqUQaBKE3DYVM0APZ7Is`ui5#GP6q@;8`YjQ`_YQRZ<`05`-52(gP1M*5^BfpEM zga?{Xmt}Q7pk8Za7x9U@W#DBq2h*|vLQfx72t*R7t7?%3@Nv9$UZ*=#z&eD!MP6S3 zF&Bd&X2Jct3C;oNlHQgD_SewV3qu2@+|d3kt{w9x%yK6Br{AOi;&%{H(}fENT|$mr#UN32?-Me1Ge zVui#A50i}i9^m5})>tZfc?l9`i2CXlj2sBm#>bPu?*J^o4_unVT$5&n;SKmCg`n$3 zxk0nvsMyw8=6F>LWV z0W<-!=y9-w+2#lI4=|25KET7wLrUo-U8c#N&-=-TRBdDX-^1tsW2_GO0d&eD0i+uM zaswos2ZSU5y^*fs9&!g=WOt+i)d1lAqG*XF!3HP>AW;XnE9bpfy87#HPXFN%fm~fW z$16{0LlWgH9U^M#o%QuIaL)(zGrj%&)LiB=0OEc4@Bz;r;LVvjd)8Q)R9<^8fF!_z zc;uYMV5c^it4rxm%nL~s_N-Pb5_VaOOiR;4EGSdc(4c@h4ud)ar=LSt z^;5~!!{a2A?mi$wI6|ZQ#gEomcjOZi*2taxV2N56=t*on~74!Qp z!(cP=6_2P{vfh5C4#?6CFuvFElYjVt-P5VDJg|5X8fu~A=(tDvTvww^cZ}^I{tbY~ zuV23gLdFGqjGhw1n5z(-)L8uma6%%7(O|V50L=g{n6_VSN-tn-* zV)fM<-FGPoK`P>>$|t_ZkBxyI0}I2sXvoq4!sm;l^(-M6zLEF8nd6zzF~zHk7bZVH ze);m{g;{4mfSo{z0QBd9K@%5S&gRoVpmqQU;ll+0rGSqQhXMHZUhc$G-}UW^rpc9x znr?I{05BTF#6Sjp_vTwNgka-^s&I|w!oM#m2Y`hF_|)L<&GElA+nuw~xf1XTefgb! z6rK7AfQ5kc$bZNG-+a&iPI@W3@eW4e?_=r$6>FDof@RU%Fg6S*luaIT%a(~W?4!kT zpO{6RR!Z*3#_>loyze-{(A!$3Pd{ld!=6OsPq>8R_VzHAjn8Jk>S*U=Ac=+kl*wDe zN2fOa8l8LJYsY;l=&Mo9#jBZ6+`slI>pfRbr`+E~<^!k1$uP;a=pg=RA})>LXT={~ zYqcu)VEiiO_jSexUhk|jIMtAGM>ggL=KOwptV*b_|1v36{QMzi%|mPoK7sAczJ{I$ zj?`csV=Xi?X35C(rl`0drvC013QI+*$l2B8K}yBaBZpI7H(%{4gPgccryE#Ipw~69& z9-JD+>_#muC<5bVcm{daH(P~4NVw_RB*b^Z@gZzqgdkoM{I?7-?&b?kZj=B9Cjc9y zL<2r|5Y7=OhAF?vZD7|H6zKvqL%xyymZ%Zn8={Hfv5oG)PP}UA@{C-*UCun|NiN5+xJS0nB~U=pry${=uOBJOa6c>C z*!s9h2pRvOA_z?KB_8B+Rn%O)5KiVSgl2$%3JOE23aMO;cO7^ik)&l0Z@w6y>AfFK zAEiV`l4gQ<#ln!GbawpY#W^mfJe<(_+vS&6E?sB~{Rk6%YpWLDA<`vXAL*Hs$b)Gm z^HO;ql&IMLjN?*mzuQX^y$s%QYveoOyzW*+aREG|YDvaMR4^g^(V1d%EgH>Kmb)NN zE%#BXfFMl$ucI1s1%GsPwc88EmJtnO5=&`uiW6bV4>hjVFE5i`%j~?D9BK2gL_9>_ zi}))b-B9RLR#k42UV&g7`F<`9u8uq+h5^e=_VzgbHb3J-tZ zr}5?Sop>DTMR&ALsT=}0%-J&WrfB)L3-daEG`A+KI`l(&S>+2{W3Mv0KfY*BW2?Qa}LJ(n=_qP%TNQiZw}1PZv{O zaC3I@KBIZW$n|n%GP8{7)c)+SWE!@iJ>rhsdEGw$ykyU?t(#Nf!`HHx0#mwW<1-ao zRz~NJjtcGc zJKZc)Zq_(Dz8@B50NYvFqVEdbh~O=ga=mHLoD*D&s_FPuRJJ{)BW$iByC+jH;eQN2 zcERx@)CMp~k6_ zI%T8kY^fG0EaY{I>sokg&{A~a=Xrxb4y-s_B39OI+B?D0A#E$zsl6gThdZ@b91mlg z>-YK>>d=c;=;2>zl{I>7b;Fx^A32c)^GAIzj0(B6Dpk_t#v4T^4^3D(TwTB~THAaL z9TOHw^cVW2jF5t+F-7utnaHYg$*gxCZnA{D}8~WgG^gZ1>U*$3RT-kO_Xy}rm zF=0x)`JatL_qWsVKRHTen)D&Wu@xnK?;TsEOwmVaER?{)^>^ypNkAdPZH>ag7HPht zP6vq}Qg?QY81Z|wO6DiwRc-bB&5byB#fvg-j`OK(NA2GhPx={FQ)-**`AhgV}`W9T&OQZ>EIAUk`?3<-d|$=^QCXSzuo0^!KdJJaYj##z3(NvU=8F zlO1a6h%4r01rL@1`M5Z4m;Qjr(Uqrq1e!%UF-cYyAg|ckU zt@;Zj+kDd2iJ+l2z@D+O;-H5FU!0K<#3qdWbs8xv?dUplU^PWGF26j?;ibJ7Pj!7) zlT~$I{&%S)1m0!|d$;zj$k!|3XLMagZRYY!YB5>v>;?yA*ODRNa;`~6|4&6 zdPsalKW)3x(oh*Y`y~!(v{PZb4V;QaL|nv7fT}tW1boE#a#R$tX>K2qW=8bwSovZ| z8P3df{?IGsh2DG$WfLG~>ydQvnW={egGNseLe;OgVO_lWM_s3qA#FRT-MdxLR4etH zv$XoH{UV(luAd+2i*XTy4BA@8^s$x}Ed4b111!8rD7D5$e8q=`GNq+5TD?&QP2qBK zNV~!Jzi{IW9+({Bqxbfh06=SI7u~wOCQD=tfrG&=pN}wMQG!kg%rQC&8;8J?z1D@C z*IFyzruKGuX0z{!Pn~W;VtS?fkCzZiK_nBTcjQln&A?33&^>)2x_7(R#d8JY{iuV* z-R=2=5;QSh!QTxK-73%3mlc5Bwanm%ab>+MI%@65ls@{%>-I^HW zKzZt0N?nq{Tj@BRu?aIK+m_Ed#G+E`{w`-4JtEi3EPyL3v*U_gfFqevmV8u)I;=cH zIW!7!Ft(2;ZzIE1iR&={^GSV!uvuqh0`iuIbn;stHr}-@A6`qZ!k;$n>DHl zbL0-)J&#LG3NGZjS5(^Sg0<^;iG2yF$D86r61q4Nx})9r#su3@0e@Gcl@jBkvbkx@ z5h-OOZEX!nfe){hX&V4kvrWPCI4p=)RFJZ4;p_v zqnbk71;^C-ZMAyUk)KUV{D}Q>#UDeoGIqN|G*h`_Z_h*M@b7b{_Xbg&QPDjJax?we z+qTF2cgqt}JXa|jsHgW0^%3=iRlUk;#PN3EtK8v_A;M=RS|tmWPIagFjMPdO${&qt zQ_onqUv4yPbSKg@t2?6d zs2B-(vx)Fr996U}lPTZS#QF0HdGV>GBzRu_MLcKqTO>Q`N(qVOJd{T0<$EEIYPa@A zuKP`ymE8>+gq;Tj-J&h$zf>@u>^vd4k8E;v+vwG7i=ohg&unMeBC#CLjkJaR`==Ki z?}}C+HZQh+JL*o9NI+9;PKqU@jXFET9^fR&=Jy2?l<#i4>~7Y;k@YdN-`y-Wf8J_i zCy0Fv{c%guo?_NLXW$`)E6oi8r+XzAB5ca-_4=S+vk3te~gG&CsZ|t zuKbG96D>4+E?r{av@dfwpW)8SyQ$NQ>3#Y@n^(HTmy%X>VhASHCVEOFi}an-Y586$ zcyBu>;kx6LA$bAod?_ClB<+>v=IiY~{^7zc_*C*H4iMUt69QvQc@^;tR?@B=h zWuE4aBU`;z>M?_3(_>%QZ%3z!8mflL#>&dFwo#oLuF664`UjEAzc!f`3Gs<~2G%*e zUOMtNo~<_u>GOGgRH_(q(Z&|O%~f=~Q5Haa3#NQ;7Eim@ZZvg)L)b@SWX5*6VfcjQ zqNPLTespvXol7>{Y^N}AcZSpnmt24Y=sQOKog?>Kz0^e+E&am+OBN3aov7;_h9eVc zL@C6)FTyjJ$b&De&HXL3EaS#$&X1$|r|gf9gK`TvzSYH&Ojg_MUM4BiDal5Pc^Xgb z_tf}nf8#yhguCH2Pvf2%pI==k#_XqF~vQokrBtyK3UoXbP85X?I;Mt*$EGg zMz&b=IUY$VWbk=i{#=Z+Bvw7E2&QYHN?F&SL~FF#Y>kdH(Q;0h3}VwPFG?;&;9$Gl zl&a@T)kv^nx`5|=aX`s>C&9+&{BF+0cfI})SKSO1X2Fx8!H<)LI9+G{FYNSl*X-{_ zCPN#gG=}ed`5BTG8<%W_K}K$cq))W^wBb6f+;(ocGt`EkCEV;3fs$92-4b{QjcUTf zi3l0lw(=L_e8%qnYt+*y2AM6tSD{Ws9GTTMns=U1!^nQMdDXMvYSjF~GFJ0u(Q=-H$`Sa|C_c=L|S*QIs{wf;Z zOtu5u>7s6S)FE5rr9~=_ALp#q+WH*+z%r`6YFokW*ke)(W@0E8@$!+|%Pf)hI}_$A z9*NZ9$jK3irfNpS7?$bU(Tc5&_daFob46OaheJl>m}fn29J^~kGE&Co#3?3 zQwJ`K=?Hmz4VF)q3Fh}^zK&JK2tClQ^M&6NV%L|GL7h=XbC5o7Av<(NOc=4#auw>; zFc$An2g#i*etf1@NQj34sPugp0zKkj{G-y75!Jo4{G@@Erd z8i6Capr8S|m&POKRWai5)=M`5LTk4s!y{4=pGQqjvl{@AQA{_&BgJ5}&5u4cOF(*o zIt$&l*3pS7(VTO+uu+if?Nql)^c6Cn7?p*+myjy+J$kB$$-=qzGq|h$)ILJ=9=6bb z^!Q#|G)BDS?QE4YHA2+V8{d;w&A89%%#p`>?#GlSEe*05 zI1K2@7UHRk^8>%rPmZ55KbLmP2pvwW4PD|ncF&+)+gX6ZsPXcV_&>8vU8t zMnKd9{8^566@^tE9YK~Hl)=T>{@8>H;vDP!ODgCLX-Pt;S+3f(57pNCo#%!{1{+Ea z{T-NFfGr7u$jQr2f3q9R&YDEveT@9B z>dPa-?%y;_VE7IH=vj@(UZ_asG1*HT`_MJOIfm9f5U$ly`Lv7WxeQeR9FLc_S|;(c z(vI-XmwI1;b=7z$C6sSVO=&<3h>(28W_$cJZT)ymolOpeTVUMu&rcS2ZA(z1@FcO* z{Zp5-)2J}!#}(#(|888bhK5bqxT*O>0@&hzed(ex+4p4GYX4CQCQ7k#&9MKdHGU>& z8AU=W6&Q;p(&)(F5tPAENy78JB@@{yc$V5k-?^r=7ri}fe-dlPN`ci(6mF-hh{n5|W3^JsPQS}VRdt3sF zQzs_ixK8mF=yMhg1fO56{|=5TXy&~E$KY9_LPb^t$S2WtsArGkk`ps?y7hfm&Xb3l z1}T0U**(2{q5gWd&24^B{0J+CjZ&Bs)r$RXb2Mc*%YD(G76cRF zAEdRYg{$rVGzbq^5^Qu$Jl3*xW^|aWUdfW6YNbmM%bO*rA`MHOC{GZJ49kL9=>&(~ zy*=JD$j-o+7&=ZZ;)g)O3)(6yDS|`q)j2Ye+&`E7?YSb#7DN-+afJ_-{0*Oa#xH0I zoHKM~dkd1(g8=y=Uwc&&a_&c5!l4^de~)rv&`=lS2%R|WAGUdE-4o_FW<#vHKY}Hy zSzIv#Ta1d~nm+XB@uUcjofgQ;zxM9hQXL^JO&4(*sTN35q9%XgmI<}#tM9on&Xzfz zN|LBAPbZ_ISldE80*WO!;MEbnTSh-b99DZS#%CTkEdUK^>mN&A&0Qq}VUabM#N^4) z5$wvT;+9TIIK999pqlyHmjZ$rb=swyNyA!@VkU7vFLgvn z4_x@EtWwtQS|~|AXmZ*zEIIG#BV<}xn}D{J7wK};0( z7XCSfqNu0F?@Ha=!h#_)NX$nX>N9xhM&Q^$8~W(}obdOs?gHmpDZ09YB7I-*Y5Zs< z$L}e6tv{~C>MJr?*>H0mIUM<2YUiPa;}BCg!}lilJP$w$;5Te;I`Be%Z&LRdZq)O{+smRaK(p<*!wT@k)?- zP|=|;2Hcm;*{oX1(+w6A9epKIxb;agAWfhIb^nagWVcbT$0xkN66JVjbg}xj7C^J~ zMl%>9!Mj{PjqhzheS`}lAvmqi_tc~&jH*r;ACHwYFGqM4h(1UNy`d9GOiW1t1rKh5 zkf!tf7lfWI^F=buYpn)&c7vZ_uW@w>m{|?H> zzVv&NzcVNqt9v^U1P)9sd|dN%PqK&-y;|5&x#9C%^#F(?>#j6FMo0WM9f~t=eG2Z4 zZ8u&d?QcufQzbHU&5>y{mc8A)GprHY78_TR9%=`UTO&d<=i5Y@l!ZWCc+-~gxbE4P zzz4Z3?~Eumi=gJ_Udx{zh#82u9A}A5JbJpr5gbKzbyQKZrZiveJYT1Y1AtEz3Pv1G zRUj+)O!d0I7bMCeznM@ZhAx@q;@X-IvO^haYrVT#)@hX_Da7`=8Q^Wazn5=`r5|6<#eM*0$J}>Yon@NWB5F6 zL8rFV;KLar===3X$mYyo=DOAA;4W0f=diTg$WUtR-YU|!s9Gvw(Yts7=%KkGXW5*Rx9hmnjSgzAnyBX z=3TeyZ#=BGRtGz>0bDp5NAXx7DO(KdU2Z<#PLs9Y6+GMUM|5Y}TE+NH*7fP_#V+%! zOCqJhziB{*h}A&`KCzPPkA-&}s%M_nx;FPk6?Jo;v6Zv>+v3 zJYn3LZZr#)=CK}Y-TPEEGr`vCa`XP6{5%UTVaPV;Zr**KWyv-(dX+YOy}H|B`dLX% zyjAQ1YUm&!Ftr}DOAl!+$Mm1zF*Mc3CFHr@H&}lR_$$?^>~|?{*++Rc z&JjM_%&L`sZ}XY#HmO3%$^4ZFR`lPA?_LMrDm~7Ns?TmX$R;&a^B6jbW8)&I+PalT z`g(fS$ZDt4b3WQLL=t&<2UdTn42<<}0STcbd$DPc!~P~Srh70J53Xk|gGzNpZ|dt} z>RFhqdXOK26$1%lx1%4WK6m>h7wn4IUvI>@sxaIezJ~uyeLh>$mRiuYc~JvXNcjSA z>h5`oTT2tv74p{~^IZ;6Txg+0Zg7y>=QJfyw}ATl#$K$qrTR_Z8vE%fm2!qwp$4WX z3(K>xP*J}&r@$u%_P8UuI4@mSDT7VUh3Yn4y&xdmzOflQ$3Llv@%QlgiL~X5gq=rA zx3_m2lQ;W)c-2ly&b{!peNlDx1zIMIr3!m6jCrSQ9uZm_TD=I}SUu{ZN*Wy0$Q#hD z&B(Hz{H7=k#K7P2^0~kZL<{3{dWjDoGKG`t%yEg{|B&kfbZGo}>Yx$p0G~=pwX^h0*}^A!e@Bqo&D=j(Es;9a-cZ+i z7RJnUB}Qx#DU~S!g`$wRI>mHqx#ZbmiDISV6v3%8JB;*C<@w)J%{{p>FI@6WlnN`? zpK7j0fdqFT5)$z#*br>5%l0Wv#L7})IyoKXajA2ZprpUM&$?%3{OiCgo0-~){5Y(N zEFq-2E{b$lOjc3pzTf5k!bmSu&G99Nw1N+E1Mz3mjMQ$jkL(9C+m4I$>3pkmom#D~ z(=Z`XQCUmBDq^#bjJVr{B`WfxuiiMxxGcpF&i;=Atd`LiHd~dMaK^#wN_(9qnE>E8$WcI_yqdk$)}Qj z7$ubpPE9rTAl1XCbr~-6HnC=g475G>yN8VYURU%rp)2!k_dm9llC`gIvjFC4RTwa z*bNJ_Ki^eS*`MDOTiN40Gx3BIc3+&$&>(5()r%lG)Meu;Qt-#DLTQd)*7;A}o`xK= zt&TqT50``_nqWsx!KZqyQ&z$HJA?bL`_mz9{K-5m>6lP6uL4&GjST3VLDWi1MjDmPcB=as7mE&hh0ZlR&t ziDmjVh@Kmv@+=`GsKC@#Q&cKK`)s?`rAtF6g^xYGvKB_p=Th|Q@ocl_Ne$Mm;!*{W zN^wk}^!cHv=N-}?c|6pH9M`oo6R!K2c_@PFL)jSt1yo2W`n_VV7h$hIClYlWm-zXc z)p9QgREpzMYPa~J!*GSF9EG}^Y!a%aT7s&n_BJIi`!rLd9bfLSRopPBejAnmtQc0avqFt4|W4 zV?22~d%rh@{*4k{tLx!kfN{Xi-F^0WK_J##Z-h|4I3J9nB2yyeCE|}}t&Ec!v!$Zz zap#37OB3r0Q<0<{bn>2Zbt#ElI(Z>R0}X`6*;{=Me|He007eZ_I-i=Gi3$BEuG(DQ z!o~eZ8L>b}d3+4wE%(#v7u=)|Bq8c}Oe`Detv<+?qKu!j_)_y#_?sF8n;HmXTl#xA zbHX15M2((4Hyn%}bO@e%L~aF$v*kubJ6}7z@BA*-n|8W!m{SIr&{Idf_0>0$v58)L zo%!4A(YyLrwl`;bqt>H&?H=iKv)lf^h1vM`yN&b)sV`>?*W!VVTc|FpDVZIBv%+@g zgeEw47V6m9_*GJh8vKuXYip!q0428Cm9kjImCY@Jn!gLeXE-+$g?AB-^{id4Jkg>;V;)TEUF^h?<%fgLkg|jv+CJ zaj(qO)iQQ>eGCjPPTBEKC$jG0Z%t+@a~zJ-2&JTF@4Gr5#x=9l)KrLi);aXc=uuS# zSTyrFl2VfSug!nJA)xhajLvHhN#rNKsa1@-Lav*Gs?kf*^Ub8sW)im$#S3&LOzFD5! zhQD*GY`a{UI7MOCzbWDp6<*nG(Zfni(Y&2@+574pLKYEbCMlVvef>Fb1E%+A?*MR}ypDjluk zi+kAcan92hO^yqqkgbt|A*z4%w9L5b@vJXzJ?0BG0p+nHpeXn!<*&SAL=a<=rOYcR zy%*BR^}H_^c4Sy-gfI|xdQAU3|0)R{8alEaN4!k8&{*X(l|DyCn;_0a8_m1-#+`Tm zD|7T*gqKUMnubXTG5LYDnWIaH%9D3h!%g1xiZfQxS~DwGvPf3H0g;q?L}(R=#!}6& z6q-3I`7!Yc)Ct{hX1leJNj;!EGu5XJ7;hD)zk*Ou=5~74nb7QKbUM+&bPa)518l8} zC)({V=_3ofjiF*`FX;AFujcF1*v1deUsi&pzrISQp>w>U>|0V|LSry5P*dB;o_x7ePH+-^+!M8*CE^)LaI5Vv(bWkf{toE;VDYqK6sg@0! z7i$nqtollDtF=91xxEaBGyK8K3H|c;X8YF&6zauQ7AAEN^O^p8B8V@f>{x$jxH+9$m6fp&FO>R6CE*FNK1oXCTm$c{$XV#0zGpdncblI4dsPzU2#u{6-J7VqdRgY##C&o*352rI>joq+c`FS1G=wnaRVVj3pKwG?S1fnwmhlP+2{AEA zmuVe|6>1cJ`}Pe~ID;Zl;$ct|4T@`{qN23f1~V=aWEgJGR^b84&EGw7zZJe4b>bdJ zGR60SSe}~!qsExx&?#~J%=c)(e178?{x%9fOIpP}?5@K4J;Sx=9Pz)OiQMYTQ-rWF z)E_UcS^RGcUde7*g9HQP2VYB zdFHS4V})5;5(vnZRgY4NSR%wzesM8y537XmnKGymVat~AfLh4CU<>joJ;MnI2{vf% z0pqB2!lsrbA$;hxSfe;HG7>COrX>#rc@I6knaN2R2BIR3-gTc2(}QMFbXO?z5vWaJ zCUn4Gntb_GF7wqzCs$-#nKhB2!|77!3R|2jrm-`%w8N=PY&>nJ;$TN7QAmZ%kIzoO z8hRCH@>Q6>)u2aTi(2k*;h4?88`fme^z!nuvttv3zhNLcm@*85{zMs@nSI!70Sm6; zqHB(R_Vq9_YFdL%QMreGp9*sEY;(j24R$-kgU2AC2WX#gS0?Z9Mc!-H}wMsTmjt#+`DetYKEOhEfmO!~q0MYwd z_E%x=YU-=1hzfZG73P8t<%U$B)_+fmXyv)pcit#x^ptu3b6|C_N%xQ>i}8z*vSUsM zL}V0Rfg155%`G-!c(q@GtZ^L`=lvjYtbYRzqTvb+mWz*$peII6P0ie#f$#-xoX`+! zf*cT-{ztsv9=~Iv>!I$#RYd4?+WX91ux_hBw1W@ceS2Y#`DY7p8r#!LT{ig9_x5-C zV3}WBV{^Onvm^?kCX-Egt}usGA^d>)rzF*5HpxPvC}SO7Wjv$k<#RcFpPzhBp1jUi zbE59zjEsuHGrE2aiJhFD28zxtg%8&4M3+OUt>E*ryDzOM@T@%%zkoj+J9YMOXO(CES^$@j0Y7Z8*z(zB)u(e{x#`t~oGCxDf7iyEx zt@G|*kP#!Bt!1_-C9SXKmdluTEN)4xFw_G5Oa=8^;bjvlu-)66-_Gx2%Kxm4jN{(k zwMFpH-|MUPM2vmaD#0t7KR@?KkduUpXa61_Pjs}lwT+-e-{x8n;Om3Wx;SEmTRz+j z574DpKR8#`O}E$8AXDtY8y|`XCo-9sU0kUdw*z%v;F_6r_^FIxy15So#mZss`4=|3 z(P+Ycm~yh2nbCW+QKW20eB!^J3p2BU)iEOV^&HYLppGq;0iZsaQbzK`UHuI`W@&5N7oS8ifMzll^6f2VJi}v9jkV8YN`uO58s~fy(&JMGz8LbvlLm*Hbx)07-mnZNSLwNP zX3pQH3PVJTS%3SrIY5K|>J~YZ)sL%z-h;@woNn%tB;^xJbMw4{0?-&>`x0a|falr; zV+Rz#P^+{6Dzr18t<}?LwURow6%JEwP?{L_Zo#nJ`ZsiSbrlqFyPU4$4O^o$bOYCfKrEL`3bY_! zn!$YgqT9zHk0Xbhh=c_K!B;0*DvaNiu+r0iv+xW+8N~Y~%!JFUcR-1U3_H%RC48 zsKSP>K;`wOQjN121a+3|iV3CNO6qGXZv`@F$x^i5;%?@rm8r=E?FT3x^xfC# zG-PwFe$+?vi>v6uF%UvhS=&Nw<1xu(SxC%1`bMVaB+HN6oTvEj83$y`{&aOY%RY$D99%VzQ?f!d$VsHju#H&% zy2L&($0I4-FN(@&mf9`rAx&+8V8K7V>YkJ#mzM6-9Bk+bdz37|(8uubKIpjs1DuNU z`^h=l*w{d!AEk0ZW0sGvq3Bp&^?5G<2<_zPnk@-7A`R!-vK5;_HrjX^&_yX~NKQwW z6-&rLl;6a-PKylHlFv6KiKh5rn z@Wy3kk?ibj(AvUdGg^7F&k1A8?=>tq0?!Z#4Gmqko12^S_4O?)?MLO)CqIO9qTPQ2 z=!<$7t5&2SFE6jG90TkN0l~WC1Y=we=)Y}g5m`F|MaC;3pjj^9;=$e9%IGl!pwGvT zA3=M_#>U$)=+f2}OH!Y`-KXClO~E04^6Fg`hj-LuKq<(`-sDQ*#b75+K7|Cn`U@Ik zHa98A$jHDB$;j40XYTT{82|-{-(R5n`BcIpB4ILRT2zPMLHjkRtznDhnMU2%u zT~2|4fuJWAv^cxFx$(gGE$JWL|Ni~^?A#pa&;hM(W~QdIv$NON*ZXr;7mTD4fIt^S zEjG1+JpTq8n?lJL@Lr-r+Z!9qq!9x&&w$$&0A373g;X~G4~u58M!CMg^XJb+MMYn} zJO)TGIyxG-B`}f`9!MF3u89lKdYLKen;ILdT45;C%4Ln&W#u6vB0@|=^b-!hbNlwE z#WMb1rd7bEgoI#qIf0(R(-5(opDQxZW@)u9+2jtZ#3ZOl*&gjHs)tb8~TlwxiH)VB4prbQt3nzXIZ`IH8}> zVSGzFan)+a(#neI=~K|h37$034IC|aH#bM)e=6aST#sYC>Fn$boocK7<~X=f{r0J z(unPeikK@a(u|Ull86X-(7^5C;o;-+9dI-&iw@to!<>0qrARFws14{U2IKed-=97` zEYjFoLXY=2nE+x7qaTXWUJV+G!O$qtdd|a>z|l=bLh_4j#m(8-l)Q8HmbmrE_6h$U zMk4d`=es>|OsA)(prNwkjcZ2-XCzpyxf$I(uC1*N9?Jpxdnzg_R6^TeEbO+nwn%(C zAB%a=UyH=SsM79d@&u0SAnXAM8t~h;LFqUaTi@XXl})W~s}>ye>Xnw3o^KP=P*eBQ zJdUTGmB(u*0tCancdx0TVYFBir{`;Zr?~jgaLC{;K&K&4t^IQC9~3M{S|wUh z6*dW zc^94ZcRDX&2al{MepBIq(C)qSALFsONJv3JK}$>f=+Wx>`ugHxV4i?Vd9fBySisO1 zFAe}nd=8U15P>>JAad0KT7bcv1(XXI3NXa8L&5L=!_<4nQ~CdYz$Yauk%SPDki9}? zoe~L|*?VMV?_C)ogpeJ=2iY0N9_iS!_sZUTulsfS{_e+ppFckJ=)-lc>-~PcU-S8V zUV(vlL`2R&2zGRIw6}kHtHJKyUXt9teYD)q3a%GU^;h9&I|*h|47Yi7RG5bcDD*Ml zv!Ym4qub`@LkU{(VF@RbF(u&x%%??usI{Y`qooCpHUqx+#=kFKI8Uw?4zvEAcY$*r z8#{L3$tT*gyB_Vt`S|hHx!0MS$6UaBT$gXDSXlT;cZ0knYJ={6^TGYd+#G`M@#xv( zPGjfF(YIx5`!XARFT$uhJljvtDFV|6oyyFZWOchh#=}e~(Y1>qR#xYz{iLyr`L7)c z>s?)6-ZD{x!Vh1Ah}w!M?5`B4myfR(78Yh_XZQ3drdT|X1N!`&-6QHy z2pCC8G+}5Z6_xaEQ{OxSe3+TeJ)Lk60xz|8aDve>iQ|uzAq$qsADrnRK_EzZj9?2j zk$H61j*ffn?Vq|9R@T?a0-u=_51W^y(phsqsnzz8eK%8HQzMq#rK+m>rg+$wBeNM? z=JByxK;yJi<><)Br{{($Dp6V-G5vfU!*<{xLcAb^aiM_FagR zB%gutX30(;-VElM`}!RJS^l8#qel-STiQ*E$F0yf8FuvWo8Cp3y7i^>h`cD)C#7GSAyq|I_Dh`aNmoIpQY0oBk`2_fK-?Aq?7`1k|`F9G#E8=N)l1V6h8Mi7^gPOn){1NQf zl7m6qL$!B`S#Vh4b1k6JtJWI?ZA?v@^|*#C`O~^T`d2}oco(x>k8$ZpC6@Leq;wUr zO@1ybD|6PoECH@6*K|kKI<}Qh>l$q7Mho;gp~is0J;*yC>+cpCFgnVKS4c z4)xWK>}|eaVtI37udjfY4{hJiC5ljB~j(KI4 z|Ao^2;o+8puf@ZbhhvI|T!8%Gf?_5#^m@2d-`Lovmneb&&^<9V1;6H4IS#h{QzKVJ zMa5L+3TvCJLc9#)nb!q~1I*4cP-{kou{w^l1<)18V09+vc?l^z^U@i;Nv<4Fh~%)fsY>7;+`9< z?&uoaG=IEoW-p%h9R$J>&*crcNJ*eh!z%PHUGqaih=dKWD$~sA-~OQV=X2Q~J*f6l zz{Y@xEtHs7Sa^f83u(e1AM$(#vyf9$;B#eVLm>UDU>>4&5K5HG%*o2yIyuwHFRQNB z&Qgy4@&$SzRZ5`t zQdCt9*fE+;GmA@BeXFPUEjO2topS0c1ax==CwDfo9T$;PE}h_}zczwjq|^WOUqU># zMS^uB(2RqI9FZ+Dva&}WHJzPu(0}8J{Q>?u=T=2s?)71g$J3iGB4=l3*8|cjDl`@~ zrYM@{wr|P_>YJEk)Yf{#`pIP$fB$}^TjWO)GUY!=b$Q|8~h1EdO-s%hAn1W>S1GfD#RE>?(P|(8h)5KFB)ff(NXu_9!jnAQrmOln*3G zy1NzN8TQ<|Q!j<8SW#HtCH|U_AYwQBQH`xsBlmj1QBl#P4k@5$~y}sT00_{VzASWONPl1w`zWcR6?A2;_&MXHLndLDs^g z81?g~GUk8*FWJ%!tOs$|8uSS?a`UpY@vnXmOSXpNwC1$3=LTLNm{{Oykv0Ox$%BJ~ z3p+=Yl$79t{>(k5*<`0Y^{O3Rn*jB&wmGB`5&8*7Or;h_W^aptxuDIIk4`=(D=S2A zWDIBn#Z$ml5Y47?*^?Jk= z)XhxL0^p;BK!0)qzQz0PTlNZ~dfRViBj9;0OXZpQ`1uFAyHgaiKy`(kjGzV^2jMg0 zgR!ZBU@3+oaGp62V`b!Cy>hRffWw!iY+k6g>Le^il8+-c+7$2<@dT3o&dyF#z7aT; zzkf&s>VM77X36Ovf#)3=S#}VDD#5nZZzc^4RO2lJ$!%KNjkUEqG&CIS?6Am(@5vB| zP&~}TsW~fV^-bFdQisB>?i_iDO%4rxMWz%CTfWXwp%2H^*4vsA4284fLyY;s#sH

    Z;fyq~ZUH%T%6gG9Yl+i7US)e;&CI1e9$cxu z%ix{Ek2)`u^b#y>RIH{{M;9p&J;b>qjLus*sdK|+&p8Q=FwL7;fBUGH9dl$bS^S^^ zHF&=kpg0)({*toz2G!SrQu_7Z56NiGn_)>4wiZHq1Psd5EafOZBx&FOY&qmtTtm1i zq_{InA2ipT!=Ep$Y9F-`%2d~#8PQBD=~-(1ACJH&l=gvV=v$~+OB);bC4VsoEMgMA8<)7c3ex|!E7{*iR*dlT;VH8zoTjm%nJ;A; z72e|*u;(2gj2GbLr77h1xgVwpBuB5IQ?^$0R?PniDL@D%GRgz#zjEbv2Rdb%kn*<_ z9E8Ff-U7L@9l2FDKmHYerQIKl!G>E5RXa;Jt7F+D5UcXps#{8y{2v0aGG-}BuOvzKvV2l?pX7R zsu(bKJF-L2g})uQ6nWQ6;LH+$PFdoOZ@{34$Wy5CRKe~Rkn)n*lkwJjJTb2L?E;~E zBTcRTx5$816oF)>sU)v*N~%Z0Jfu|sOi7tjxeljK52}Qu&&zFm&7`9P_1#HQD=ax$ z?H8F*IJjYJU4b}8MH1jS!t6T_fy|xxc)S$Brypyk!`gh`pC^FRa7v+e@IJ-osBt(2g zp{I$#M5$VBx&J=(jsmJ%$;5RPV!b#~#Uu?Z$yj-&>)#y-J_oIo#z=l}Psp2yiRgzx zQ`SYu4sqLxIijGw+KD>6Pbio6R)a+K408yT!GC=Zszt%b&hH{yHuL@A*71Aq0u8As zvx)|MC8|)QX_^j`aB#yhrO{p}RH8U!D$-AHV8Ov9dvHC2F((K$BbJ2)hkkH5;<<+B z3-WWnfys#`t_>aD1#`9Rr8@WVCOO~Ft@fS^w5M^Lo78Am-N2O`Feu9#bM4sV`gfNh z>`f&4K3`tF&hE!RtVHP)%~pTi4bx0MPkIk1Dk0;@rkks_;&d1r`yoD8F@M_rN*;A9 ztr;&b7jkEe;fnnFHhWerPVjTJ>GUUeMl)+D!m@>n^X}nSMVDpv4eg#JPi+{9!Q2>h zL1tMP@Q_U{1@`(DLQ2tY$NPRJ?QIAJ_16{w_fwrw91PjbV)-S|cLNQw2V_(-8)-z) z?_QS=>pTs8Q(#Ns|6SpiXTnUS`{8U^|1{CWS1#X;cKbpDj#0H{N*7Y>Ak_l!bYcA8 zZ$VXjgQJxB(*A?!Z3N;oVP_OkY6uSQ`xR^H=dVJ46pT#SR}wPT6Y?$>bSB=IcpCM? zvPzGm$k7rp_Fkq?c(XV;@m)zakH%@LKK@ zACxQ%F2*M4Xj4nU8HqOSE%v-g+ZT8LhM|qmC^^e0K91hQ{IUE(@vtf1vi(m;z#G_x ztbpzgGqewGb*=5=yG6k41&G%mL+XK1H0a=FQ zt7(-1HxI^g^{dRbr}M{+1lU0`sdW=IzcNB?Kw;@3M{A#VZkhgF zV!bkeGZV;nIy2%Sy4-Zxf)|T-77mL+%y>c@NX_SDOG z?K^jXHF#N|u?hn)q|YKK`JCAPJ+j>#^rb*gzdFc;dX)nR)Q=yv^|ZH|vpP0*4BEhKGNmf)$maEFMtp1 z1`2`Top#)?;NY^CDmoUQ{<-T8GcP7o`F+C49ZdzPG1CS;L6K;Zb}+wV`xk2&lO>o{g3K zo-E6RfmxDevD-x5{9*75&n3{zTmU`tZVh^L%0Yp1E3#0VH+a7sqTX3rsp>ct?R~cV z+VS(-Hcd>M^S43oqYCKi10<)QvNA3;0V%@LRL2dT0~i}tD-S`2VDD6M5EJ#+tl^-K7?Ww(8+`)vyaB@DYm8}P(-U7F6d z0THRDHUUj~$EhIz>$&eI`BgV;TkD<;C+x*>&<}pK)rvp2*L?0hzU;AZp4OrV5E7Wm zBiWuHUBAXdjE}y%9 z8qGKgU1{&rUfuGh=bvya*Wns%W#+nIq2-ONqf;*0x%N-7I5gzsO&83%W^VtFC9iEN3tT&xQb0-E`V-JE{5iH2tr-rsjD?`Xy7-6Rq91>Bl{F)3<3; zcj48GnWZSFFm={{mutjNZe&bTNL)#YvW&4~^Gf!FBz_BgKl$bo~yc`XbD5Hy`4mJZt@Z0QAA|sClk|{J@<N5zhc|=et_(DeI<#chL@z=ey40sR0Lw93%9~S5q zEe2H|cAcvjTNBIjEi+c>-i6WiO&p&+!jkc$Pf=v+za}58D z1*jS;Kmo8UYCzV-xBZZ`+~=hzOpv+}W#1Ko#~bT=> z`e%8MLTH1{&&(vRvdbQgyEN{TO6S-A34)LgVa@xh^5G5di)HfMSnvJh1z9bmXMy+1 zL-Ovyn_V%T;e6yzH~9Hh)mv-xrWwz6BYcq7S1-IaUIt@62|u6g6mW)rCkIjS%~@|U z7?I$LKoH++Tm_w;7xMCr%cMJ9(c%Da{JW+`b6>FQZj<#RVk!!ca$B!WO+ZH?CEmD_ zR_G_-61{=zZ=}JVAgx%FQJ29$Ka;I@@NHpK|sBGHwn@Y<`=+N zy2NYS5~*X{2@2GqEVaKFbx%X6iwx3!wJldoUt~Q~C5r&T@;OktaGAC5d?c_N3|na9 zUiyjXbl?f{oW28R=_iGE*4wZh>?m*~>uhpJi;Ap_dUV(b`!1O(%&o!Fb)^BOQ1?V& z)SPtQ!b&-s5R%85Pb}N>VxDmb?7-ZAegDJ*p=dAqi<_jTo|3V2{1H=DJkQUKf)a1A zuz`;C@NWY^XsGFW9l{Zk?z)6g1$YePfe**4M~o6ukprF~+(g7`D{*K$xb&1EkC*&p z?cJ^fX65ZIm2)_SNGSnIVh|fr|3kpy$uW$QOIOJ=57p?nv*w`NT%yiVQRrM7kiuNIaSY z;S7P1kVFQta8;&0a~Y;?1w6HS*>1qYgGigUre+% z49bP8qiXnM9zH&4bVUH_y2)y`sEw`2H~e^{URD%$`RAtt!(;87axFySmNj8{PluGn z-Tte?Bxn38{$7{Pvlr^qVMc=%IU6x~LUN5H$&Gy>kG_1*7|QEi-GDLj;O6tMbYiCZ zlV)tRt?q@UvNw>Z?&9Kbr5JdFOSba%zJfsu3~2o$S$$4> zU-0j?F;~w5fC8Qd1|_@;P_qXxBCY?y(UJEmqwcPI1Nh8P`fI_`c8~`K!VKtAIoCA+ zz8l8@HaZBsT@C)dxbvS^F5Rtzefu_?)u3fW-|)M36MzvLYjRpNWD&^WGx9M{WzyXd zIH90ifuw7DI()`r|6Z`DQUtyS=g)LFA*b%cuYhuni;K%rg+`)7Wqo~$^BfF$MoF{1 zs7%@iKbR9Roy48117ztbB{kly?mE5gui%@)yWJTZ2c03T4VhEOV~P9H#++0$K!_De z<XU8L+}NvyznA2c{Ow9u&OHYCBCF`S;5C$1OeahecGk0sQ9I(p;4yi6;gS#f61I zouh*T>ifZM358!gAyxGT!H6c1X#;$1rG^&(4VWaJ9*4{>EU=<~gUrb1a>57jC;ww``#Zb#JX$gEDJ%es0lew8gGV{&@>tU&jY!M@2H6L%() z0v%kd=@>E6&qi~>h;a&et^hbeIvbg&WY9Ij0pmI7G2eQ`!N=EgCetHPmzx`;L=@UC zOFIInwU@^=SIhBF0WwaD+azv`%*wsi_(6#DjgYTN5#H2;7>{^ouc#MvOlmLTine2J#3 z5|fUCuE+7_$YIWoI45c)be z=YOX3^^j)!Mun+UYFu7L#fT9H4U1I&^Z4k<4~eqfZ(gHzv}`M9}{8jl-T z&EGW?lr$zS^KxH?_O4Q42(stQ?SS2uAsZpCgwcR3+9a|i_XFG4=@gJ>7?c2?3eSS1 z`SoF$Htoy*yTr7Pl4IyX0Hy%~xa`EiY7vsUfFFbr#8$yDqSy4%(_XAb>sPx3}DlEw}h0I+7ghY^q;VyxmTMmdYgd1F=JC_ z4TQTEy;9HwK8&F)-UCg-DE}xFkZc82nLb+ce#IqwO-=9U@G-C=5JCsbO9#{=^f8EO zH3lZ-CCTne4zVW>Dt4%jEBZR_?z=ba)om5QqZl)>wZ4BjBnBOd@DgjMQ3555Lz;x! zwCbibfCH7`qsVuAW%@>aTV3x(IB?C3rJLLxX2hl*k1Fk3R41J=KLtQeG# z`1LvvI}&8Wf40YOTQLQGe@oxEzL@JikCx<@U$QSx8pk502qjl2ZNf9<=u&f-%bVn3 zkC<@+3J^y`NzF73JY1j%Embs_bgaqWbD9m8cbnw*S05HitXT?SM5lyYpFAeMVr}YW zreWfW((A!`)eZ5LZ?YT-lV8NjNE&JLELB}Ej=wE8w{pysuK}P6Gam&Ci9d43E7+wg`l16S%RuzuHIlig9)R*DJ>Vq8)WitIHy%ds;;D z!i*9?013Tgb8}%)&T4?R5JC$T&jh($Q%%j8PJttKkuHcHyd?7Vf1fyQj3P_7qw0%L z<0B&)dyou1IzC1gHg^OsfIyjkKD#!#_oYD_oe~TiDK%w&e+7ulDLf#)&N&*=>ch35 zluha`@0%vTtnKDE7jGQzr(S>j(~`jI8`ZeCahms;d7Sj&1mqS|YV|b>&h|}3P5H5N z2t{3n>_($$z5AO?i%_lxHw=yZr0k52q*p(xh;%P}#S;m*f2Ju_hPd>Ll}BQV7u&Wz z=Po|SE>b(?v`^2QAh?63yBDOBfIK=62+Xp~EIH~*c-}ypH~mD}+Bw){d6mY1V4v8g z=1qeUk9?G*e}hp&$nbn`+1X)ybv;e5eqT24szau0Ki9;p8=Rl>Zfj6p{q4aNQ{=Z_ zYJ*OkC#ZcvPINgz>N4AcYGi)g`?Ium<8uKnPaO!0fq@19_SynKeD?xyn;fhDXd}q1 zov#pS&}JSp2QGOeoehUYwlr%DA1~M;m$$4zh=`r^nF@@Ik2`mgx?D$n!_=)>h-XPx zoB!Vn!~XWd$<(U%6n#;aGnkZIboyL$x?Wru8bRF%m?0)JoxYufEeV0%|K0hr@!Wkx zM32;2J|`M!(2Tf9=*Ukc@kGlUc6-FICghY{sIr6&qb7d%0L-f32reOUJiR%#d7HbX z3kV=WuF}9fwtlO;7x3i(*Xf8C%~U)R-8hG?F0u)SY|cXA(cRGlEtbo(W2^4fn0h0$PyuiM>J9L28X6iv)XpWRepNf% z&mp5x`L&l+T?_STkth_tk137Z+|+fVlY*FND0ge1@?2%2CS?qi`;J`ykmOvn067{u zlJle0uhQL5eY>^y_|stpb0tE8#D{;0mm|@e(CoqIqv_98bRp16t%rS& zyG9vBz3x=vF$XYt{_Br6Pds69Vc)sqb3U_Ra_8s@`T;oC-#q)<8)zR(z5bB=6j|5N zhZw}Sevq*@5H6NAM1gYSo`|R-(E8!g067cHMsPefq4oTGef_irYJOy!1qvr#Ady_q zD;;}49a?5Db`MH^X+WnUr5Y_l;)1|&!vOkh_Bc}9LZ3WMe4rM^!p061`2?M6u}=y> z005V8e!N?k$eLsGFE3Pu^p&re_y_;4zwiNR_aG~7V#*a@3Z=pETy|3QnTU);*GM;1 zeORx4?(MznM4>~IJ&#S1Zr$J{11&a4*{KTNM^l5}funyUvaiM@cO)(B$XJ`tfp3!Z zwJnD^J<1Ks`=2| zu^;f(zUqGAEmEQS=g>15nYCxA-`NStew1s7Kjfb3~s)YHlLn>8TJmmYII8fNC01J zLt$y_F*7s28}0&!(1KLbA1^RXt=%k!u>x#A@{{J9D_+&V&1AY;-ms3`#_EV$ct4|xhq*(M_wFVtAb-hTWQ)Jz+|T&KXPSq^_X8GRGZ zG#TA9+;ik~;mEzgYWRjoSFXTeKFBAu#TL4aj*U5icA?LfAvy9md}YbSJ}5IE6-hId6 zVJ(BYJk~fJ-C-LxMQ_Ht*#{usN$bxKA@9FBIncPdS|q=Ev%LhHwH6LekKYVq}z6QLzuH7*6sFCLHv7=mvqyEa`&>Q6sXlvJgw~fg=q`E@Ul8 z16|}W2q`=rCAks|I|6p$RUl9OV!Wo!X_th61H}05ML$^ykM^Yl=*6jf|Acq)d$P%= z=^}n+8!2cxrHL$Lf#jD=3Isjxbs1fl`ME$W&DhbD)H?BONr zf?NXm+4rC{&pjz&9B*hYL3IfH2tn9V5Ri_U?)R$vO>cM_7QVu;)9F*-ZhKffKCB^L zr!j2yCG1&;Ya*`^ZP27%GNB0X4f1B}pyRTFGbo+!$-d3Jna z4@A3`k_GOC>dMHO{+sI~f2&hhKGG3l3BUt}lK}`^1U{Yff3J>_ZnsMj`}c|4H3%*? zY`(N7xK-F%jh8Hq3%-QTDHyOBTp;@dkolTmEki@W8RRZ)XGv{$D=MZeqo}Lv%F-!R z{{lH?Ld&rq=z=VDTjj{!U!q5a%@2YKo^HOPCA4!5&H4s{*=4IEhF|f5z6O5%XKZzw zDMpte|0)QRx`|gzRa4dOp50F6<9{QZl$l&G(^E5rqmQa~n*>Kj5= zKeTt;)l^i*jvJ4kP0@cqOQ)P;)X#$7@Tnp z?@IChnCfKqh64Ssl1G}fH)ro}Z@t%Rw8sY{CO$``0S4!~>)W0m6K}`he4Df|z9zw4_4UV2vO>-(VvVH(8H4s_H zt(ys&W$|tE7F@l&jCJY3kLJViMU8yq$RoT97F+JH!5{<{JKZDMX##{sTJaeM4A#1u#|(!G{~A329NC>&JTseoicFrsopQT+;R?*zkC9E- z?8||jZ!k>Xlnt?l60OHryQc(iIMsXwb`Y>@qE zhsvL`(Pf2N9pzXLohY)yyq0~F)@Z^W)`^^Q>>yfkvqMU^l6NkOi?sbHv`XCs4({!# zryc7b=`SeSRb5H%Y+chnzeX3MEvx)V!OYF=Yj(C6OM-5nyY%giZ4vB`^S|3&P0XGo zF3B19FmA^Y*Z?X5K-16is_Q2FhlKT=197PSE(_8S6^$-7V`rsb{*~mQykb6I7Bv2| zi?S8};{$F-V0+V4$NeL{!4B@3{A!thBv+A7zt+3UZ%m?gY@Gs2%7lzHUgEj;%mls(lRsc*;cii}XMRy`p9|TTf?y99%4E0(7C4Ov~zzm73$& zse(QN_d@}xWz@vc}RPk{TbqV~u^OR&Uc#1s_BUhVK&~#2&8AI3?xwg8o$0 zz|a{2adgd)<6fY?Y&=OUy6pFIn)au0=NMSWP5q z>zk~?LhuMRp1Ky6sQK-{)x?4eF-fbhpLXLSFmXdDrYCy(nw zdaF^6M&_+2m|95+ALCk0BQ&LRPSj}YA9c(&+UV>OVDM~(CpBkGjCi#etj{0o% z75slYDz2SSX;N$}mehE@w;5EjFTMx3MayGWJf@E8+3uM-yU}s-bM(cx6+-O~gWE3= zc$C6F2GcY&!`@hLQxI*-t37`9j5JIfc+s!!cXx-rMT%4%Nq^OG>Tj`_A;Xf{v1TK# zlooj>*wethEVKKBv<(H3JX5!wR9|M!xKcQ0G8qcDS&YY8&%L}a@kHdEV!@X6WWVT2 z=^g*|;Di09Z10qhJ-7AUMLrPH_~RtXI(N@V4)oe{yx;m0Ravk)n0miMqRREUP`-@) zg=LAtgpvu$OZEP$E!Q7Ky{nKvfyolcdBl7x#fIp5ikW%$6FQy4v+@_zhKVwoJzUZc zDBB3+8~GQ59c$ha>!oiEIm^vYeku8)7Qe}!c%wNvqx+!u9$6W-pE!Npmu#($-zHQJ zla}8uQrOs~qouBnS%<`OM;GyU;jyG%JvT_uH);raFfyMq{N2nrp+2m%oG0DQBpMFO z9Mx-+?~2b(64G-S=lgIw^r8=Sr9Y%@$GvU&0laOXB!Dqqu_2Qf?3|T+q4yrnu5J!b z{IOVtR4oFw_Kt2fXb7V#cD;%t@!<3|_^8^|!&X7pOw{}4B$(ZWI*Qi+*H}pJ4CCmn zDKv7lXuVD1$!lT$I8=Wwre0pG|IOU}(8i9RXY^KZx5NmsrvvUbyRMCXZpZ(P z1@JU7YO|<>QQHb%A8tVLV<7?Qtdp1#0TyOimZ1BphDBp%8Ws1iaZ=c}*BsQdPHW|> z{kDCpQV^@FUqYyjK5ZGs#Es*d5^Yg859CR!b%nQBL}=OmI7<2os1@<1QwpN&R zy=#5xyy+K-^GmDrM>9^Ui>@2l7!fs$qjW}za+)Pko1^O34BvKRc?axC;cvaQ)Xj;m zp21@31SX z(@&o$1NCd`>eziWup!1qMi2&as%=;>PX}jzbfgidUq#!%p#8S1JiczcMB?M_Y`pB? zCmwZ3NVYvRzy6vCtfg9-*<_2ycd%)P>mvo1gK_D-?dF^8-2{AC%p#6X#|3<Sd(&q6KvOt{LgiVQaFPjC8qJ_l0ZxN-4a>&-=*Vlicj?jd_n5@vsfgZ0NF1Y3i&)DJ?owi4PW~0v#+$PNka_+E}flq>*Y< z*E?g`1cM+v+%V)UlPi+7zGNX|L>B?U2ILU?^H`o@j3E~DJ8X`X>cz!H@U{nGK_?2a za00U=0_7=_!LC6|k0F7+D`}uuc?)Ns!Zx041lz!^fhOhLzHZ z;xvPUE5aP@K}-3ZP2M~SYw4KNrs$}GJOXB4VqILO_bJn&&C-u&xLChSQnhCX^yQ?g zO^m)2{;0)CqIKxr;Ez)=rKO1cX(``oY+pWR@kmHrRjGtO9+&Pz-V4(^8f=6hEe4Vh z$y@;J@{c?_nI)S?J5q}t_go+6xeVY(eo95 zNF7IonxpEcM3wMZnr4WY(DBJj_0&UL|Lu>lX-{2P@NOL*A8#Jk;L;pN&IFJM*${mE z9_*&mw9r&r+p}K}yfolJR!kXjEV@64{0@X}P@=rAj^WFH7wblYP6?17vz0&!4Sc`K z%N^2v1nIMZn!%C)YCG_2+iNeM&x_a)?4e}8hKk$9Mm~3BYTFsQkWQkAQXjf(P|JEF zB$PV>yjm$zd3zB#p!QP0s2IuXgds0AE|5#Tn|y$Mtn?YF#uNkPf1)hMgPa?IUSI$S zKM$So5Xr!8{3ikgZw&OU;J<2XGk3=YzNG*Lcu8R)NL2u<_7V=x5a9ljL5+o_UW^ zqqy4LfM^MjZKZr51;g6_NV+mZ{zEiG7rQXdg?H1;_R*;)Rx4HVK&}xj7qz39H z1|{%~2~ln$&^{FwTIuNtku=wpmm5^i?Czr}7`5FS1PznwY66<7V-(0a5T%dRL-#>F z1oLfVqJO^?ckk+CJ3WCku9p6UYRpd3MUXzgh93^^tHjok& zv)AdO1bqVTAP}^-=fF=k0m(sf5qMS$mf*p|gf!=VXm&+KjInxtE2!zx z1nPqpE%W_e(1(C-7U%|m0M)24N;3VnO zwZPxs+V5T0H#TnHb}lI{25U*UL;Is6{t`-1G6BU)SQd_s6{8?XxPsMN4yzP&S3Etn z3Y$Yw>Jb5Nk;3+iyRLvpo>t$M;{%*a8I zL<3M(_7@nI6&A{F*hv#0R|o|d>MFvu>gdR$FY?Nh4AudwWvLz!d2h%J@VD;#WcGny zK>Y$j?YA?j|AY{{TOe&}D2j!MMa>-g@Su6~_#6~yZ>=hm2(8=I&4Dr(u&FC5?mgei z4nUSZE1`W%;zs?{R-jtIKM1m%nGiaO;L?ViprHmzPXg(K|KQ}Hs#K`~+MZ0V~H%Kuwq)4h@i7 zRUDU^1U({n+>c{Q)tTZiSfely=k%%a5P?B%z7NYBlu`noj&nsx!VE+SsRjbEWpokB zG@gnnPnb-DwA}mfa8+exJp`-o3W$JobxCq0^1J@|2&y1_Box?N1ER9qKP9luxB%T$QBhF}y0!_qECPYXYH2?YS{A}M9PP*$ z(&2*l05CdFo~Xl#3NCz3Or`a?gL%=RnQJZXOk( zm)VDyhvX6K2ioLK&?kjE$sHjT@FX1jyMNF7ItmC{7cvhpqQ8ChMc>d~Cv)iCCp)o^ zwY5phH5m^+V`xg|j{G~%LC^wJ0m%A5ga^LjS?&llQoyJTDD&CjXb6fI|JiI1qx4?T z;KGR>tjFg1qxlUmPTr<46ST%ibAdhq4?DuW`Hw*Dgx{?WLQFe<3e0Qf-byGcpyL}fj5_( zjW*Ve;?T8u2+G%RGyw`CRsN9^Zz(?V2>*BjG`g^MxAtB8TLB^@eU{wG>{E8B;^8T*y)9lyKirPE`Ikb=_Wdy=b7#s=<3VPwg<>WxF1WqcB#4PMvAAf+< z6dVERgCHL_Gduf!lXRc_-TeAR8O~dXSm(6&L*4iRtb8w`6SO?~O`r?J5Y^2$ynX9#+BT z?HhjoNvV{TV@J`WM5)+0IjPY>bXqrfr5puu6kc-=z%<_wI=-aP%kxJ5G=f8UQxka* zKiW-X$ndR>>^4f2n&b_~yx|Awq`kdjJzuvT8^s`|9XniVPfy6iCJguEx{cuNLtqo* ze?DyjihCdurNsgoU@!BPVV58juwtdNd3{|R95`^$C%2EH`Hay^F~KYxs3DLYfFvQr zztJ*(nX<_s5 z%u_%*f6A(AW*Z+LKU;ktkgPzvN{EXi<#)vyYd}Fb$dEKYg}8OJr7n8|t@J_oG6{Cj z%r*-vD~Ln4-j!PvQ3FLwJxz|7(jw-8r(9fO^!>8mz^>KqFkRV*V+veg0Ys;+o;X_8 ztO)|E@ML#gmGWbU%$TAc3|Eyx5CrK+?qq0KMcRNUDJFQ%)YURh+H%j;0*Mnx0` z33T;LswDLn4Qn_woSa~-#PhKPL!k$o7LL!lx$ty!gzqy5C^XnVykPzaA|H_c*o)t8 z2H`j0>5r_#ZiO+dekL92zvZ$uKfP3+uPjXhtSEQbb0Pb`o8YSQpCh7WY2m>Cmy0i9 znFIJ3)I~RH_K*NuNLT(h6^R9q+1$uT1^601eq2#oYf(Kj#ON2jdVCHU3nx(#2t-?1 zfta$A#PzSx76!Rc8xTRmTMLM$8HfadGf2s`;I>(9ZEQMdye(n7Ky@=btfZ#)$cYJo z$Zj{O0PJ6IFor$C7PR4uQ+%TVc?=l|ENieF03DoS2S$#6H?yJxAs<%JTMDC){iJ@A zzE58!=(2%`MbZiIT`5u-dt6gV$GSOz^ay>zvOrKBZD-%th#iI?P(3pT3hC zyTvo_Ru(%9tnGtZs4M>fo2;SX!}74N_*gd}JMLV*dmX4mAO{3zoB>Nq7)UIG?#~Us ze}PhL!w!LvPJ(>_K7$}31&L2PbDZ>()PeSPu>g@F0O3|l!Pg$$LWU^Bxxeugte0{o z#{1Sn_VX#|L9LLYwCE}D>t)7vEZZaVEv67Q8p3tuKdMAW=DejzM;UC1dX-5y>gLH zW;QleQ&xncO0)l#ZDe!DQazws^!35^8eS}9>r+;$1!GDQ8hX*)D`29m&6406qr`A^ zH%vTgrhzb6^xNhkyzqZb6m1n1&}z5)UdI)_43&>t+Rn~S=foWZMaiTUHwfhk2!Oj- z$$#q0BGP8iit6m_+;;YWweK&Cx}|JVSggeYl=8x&A~Dr!ynl%`MHwU;<&bkECO$}8 zd))2@1usaJ@eS8^?88mekE|OJ(#8zqmodSC*e=VrB?$zAQ%{@fr-WDxc()+QtDXU2 z@KJkw-&aiByu5TV-7u+S^P@rtkqui^{-^E)IUh*cm_W)T!v1M=|It3IppJ> zJV#;*5acZ^rrpT||Np0{LD4Hbn%NvXUVcu_tRXYVi|kczASi6vv0m!x+LpZntRtWy zn6ZDPrljCqe*?r001_Zoq8yAO2O$W9W5YiI94J*_FQ0V$_vH;uOHI0_-3bs`qPAM9 z8SSICqK&~==T?Lb4pn1-$p2&SP26hU-}ljF*mfmZNF`E>&|E5&1`*OEWN6StbDE?< zkwSztkD5u7Ce8CelO}1>T$-d=p@{0-@8$EkzQ6Om&bhAh2b`{b?QQS9TI;>u@7L>j zJpfU@K2mq5@Ol4dp9B%RX@PNV4ac~3V32OoguG>R8U?I*4+DjQ;(=} zR$xxzD3Hj9O`hxDVjZa%GBvCeBcqer0v{)%!@_`_x5(4@UgRKa;73yvxi!d1xI75~ zuG4>aG^+RDXYO9Z`T9a%7NM=_(>fklYq;V573P4~{DOkKL3L1%l<{;fs~w$(`Wp!U zJ~df$xY67+a@+^H(U-==6D@_lBEN6OzMv0cf>_$S&+r5Zvw9(hq9kUqDclH!=i9f7 zGc#MP@`iuXkz&pY(YJp10Fiz)n>qv%0t>YT0%{SA_g%CgO`cVP1~lq=oUzTOn2E{M zO8sIVC`^6YbdS}Nw8d$|2WF$AqhTYW6bG$DL?X|sOna9zO5;#u=Ac1%#@D>87o~TU zs>aIC6Dn#!G#bEQbu_hqDab?7fkjQ4qO?m?>^!NXX*i zB9z}y+>dXs&De!VOk1ZFp{~+xy#Io$19lp|F+Ch>F;S*mCDegtzDxg#|u+T-+L?WP8 zgTzEC7gFDgzq9%uye;A=P~gnOzd97rQjq@T<}w`^rmUkL_xJL0CDJ))t~NiUii1bw zNLX`_^;sUODRGZVSW!dRE8IQPx>sm5Ldtb6Q|Vwuy^sp6Y624j#Be>%C$$xdipPO) zff5M87CSEKEiY?eOHvXyoFVdhP^A$aPm%-QGnFSno|#)W&H_Dw{@tv}1=2kZh*=?h zL57ENVCPP_l{A0vq^MJ49TyK@eHt=uhR=WSV+^56F zIa(;mkUQUuV$SNEtWIN+p(;ur>wjmJ9-x|lH>71Se1G^D8NRT9ornU*?2i=bsG{Qj z0KR&%H^pWgpof^jX1V; zyW_}vPd(x7`K#6xqs9UFhs|Dfa96p$5Iuev7;JYPpphGY+7lNDMvr9Vd;V@AdMqs8 zo)U#|J7<{JvU*|AMt{91>FA&^3q8Tv>(tcJ(fRRvS-Q!yt3Rg^Q3gl^-R#?boMqH7 zj^YBkwn!tv>KwPca*cXbf$j*w(M{sQ!kHO&B~Db0+9C}=K0d>B4(P4Io}i&soAoa* z)ioH^c{Oh3?q?s&tjrCWz7{4GVtioh9Li^0kL8amibGwK3%4bwZB=Xb40=s>ya+7p zoB90NxZzdtwW~7QfT}MoolRvS=|_K+_Hw7G@v}ehs-3kuVtVNDiHIfjEWW0Xxs$ z<=<}VxxDlAVBAp-NQHNNPTA*a($p<-;e-5`X5F^8>LvaBUiyYx^eqQxSu0gWjx&^vJwy4P~uu;}lxNA6l zFlFG%LC|FKM4Esl=cz5*ZDOf+?`lRUGR~qtxc8-Zh{Ie6`9_Su6b&_Vh%-V0n^l>n zQ0xdH#aYCJ#dNkWh2FAZ5#N~Pwp@NVJw6V_Z=R($L4jA)lwwtDV|?gVoVy`A6F)Bi>+ z*LP3q4yYHyV5n&ffF@r(!jGt!7*pegYL1}Og0<^AOaJyswA*M&zN;vhIy*x{OSZ4- zm`v`W-+3}%TzI?c_Ax=-7|)f?Y~EeU@t0qHkId=R)MLa>5)(sUK>>0070bNd|Fkm5 z2Xp|>4%Ebuay?qEHqIPlnv+=l&1^QcxwT(-`^C(=dkw!S*U&N4T)(O$PNor}hh#Gk z4^PUaNmZ%-2b1@H@6Bha%1S~)S^f`BP(Z??HV+i0J|Esuzl%#SIm>iR+Hc(@?c>hp zh?6uv9xXG7uM)69Olb2>6^UOwJ^i&8IuzJ8PHps(clgeB&p<0QibMKLiPcIFbEmSP ziKtf6-XgAALtCsmBm(yKL04E1nW))9+V8u)Z|7L>>DnxDjIoRxnd^lbFFGg1a#Pe+eXsSbIP1Q)zA3ejF7#hw6Ku8W1WDy;HH$PmN_E1l7l0>qO8vc$*U8z zzj{_5B_j9CHNc^yG7bd%naU+y-F|c@GBlJ-0tKc-sOR*jwf8dG#=C;<%6lfMaHG!n z?WHCOwAQu&Xe~7A2|SJQ5S1KJ37Sl`;T6&Rp_kc0Mn;*uE01KCUG1urZ{FR%P37*0 z!#~F`t2adMGZcnr43K6hxi=V#s1?5MpdK1-shsEkToWlZeBx?fcgyHhoNlVG zy;Sc5D(Go)^5g^RCmz1@m44IGV~Kw|{OV~vl{=Ju%>`$0cDx&QrKEu+t1XZZioJ<)%! zL2@gR@2j^nLy9P>)isz$$+%pov7<+X!=4;IL;!-nmVv&J89X$D0a@axW%7izxgr}| z;2!F&(?7q$mG_!;ultv_`KS$9ZG%SzP78P#_g(=>Bs=-Z$%CVt{*T59#30xhNJle( zYuh~{%dyCV(Z_LW!!Nko;6rHEqYcEl^$Lr8dPjI8YC28^ah_~A3_MN(4(s7({@IApAV`G_*=3A>lOspM&zE0YXD z`y*60j6WW}ao;*75T;65UA-SZ=nFp^u^nmU(EC&b4>wZRuUKu4x-D`%UK2{kuc#QV z>FGFUputetA|3fdK8)vwLZ1mR&^K?6!Dt;p?!j7n1u6?msCM;BsF2JXu{=e#jf|X1 zNdvRUnV7TuQSB;zmfy35>YT#rg-C26#v8KPhO$-qpX${RpX70^4a&O2A?ojmGrQ69b1vk}KXrfal^9=g#_ zL#f=R^y&P5cjz#~GRw27rK<~gJ+TU5ckNCVP#nHqZQ6aaX=374#o(i=tAT0{ub_%Zk=^YrD+a$}(u|X4Z3SY75u|O4i?tJ4QFc6UShz2cd` zQ{2FlFKcR|B1lP0^p!+{?zW6Aq7u)SbM0H8iagEWKUccOBf`V?!W&D(z`g^@+b~&y zm`!r~i-xstq#F-Z5f29IgWPcGlM+<@xHAg~top3}^g*i*G}?}jAD=890de~p`xl2IYY^}; zjWqZWf5V)}k$FF#hWGDhxGuc=zjwnz2}(7-ovGT zMg@^?z^PF8)^rY`et_}snRMudgy`KlOc}u_$WMr7>@ThMxjnKMJ;9+^LZJmfmI(cg zAMNV0%imkWe{f}@HqXWqXcVG6EuO0-gA0v6LAYOyUOXxG9IK6)T;I~BR zE0pHtEtcP1C;Pjr2?J!~5H#O~J`79-@ffW0R@*q>b^r-wIO{-4$3je*2$hP;s|z9H z11tWrj?Rdpi~%FLr_&fbFg^ z8;Q#BL7ShLbuI_L*%<`vC(6KBp*3|#RMZYaB$$2O;Z?0uc{Xh8<4U+{#ATxw{f803 zW7V=GHn4K0@LiL9_^=a+RC=?~l7s!h+cf#-pcri#b zGwoEyKPXpFFva^U*32v^OosjnJRIz=cgtXpAK63!EcZbhiDxQmM1i0YclQd*h{N+X zeFC;58E#RIA9HDT(i069!C3$-`qw%$+vm=RNF&R|ck)&C*Z;Xp$5If%#dzX5hdbQx z(98bt;R9xDu(fqCEd!4RKm$NNVcoSq;GEK7?*K_dHy3JS6W``(+=j8```=dd`ErU5 z_1d+b=Bp>{qlX$5IOn0jH23kcHQ{-(GID0c(A4x1dH(0HkB_%^p>`U<5${jg(e#ZN z8N|S0S7&E_cD5Znj({%1ffus@^Ta4KF%z@;JwY}#De187$U9g)K@!G?UDisJ6>GUg z#Yi%0j2Px32Iq-+xj15Q1ghDsn)%i;bVrO&Mk#Bd)Gc{=$%Mc%Qg;%B6TnwV;A^Y?%f_=WbM#0+dR{y>+8Hscm5MG?n;?!SS&!x&;>5&puRx`U|f zc^uTLFAGvyoIO&C4lQeXSdpyB-iiG4(_VAtswVu}vbvx>j(i}kc)pGhjzQUf_+|&H zn1Aw3(T4^%Xo3rSCM5WhL7Bw#pDMGl7W1ilUbGZwdk@b~OqhFC$#HLAKZyC{PbfCg0C3OU7bOC5 z zR~H~^YvIuPsQ6JI{-q}VTec*#7Wj~W}m zJRY&!uMX%tJ8SLws?5FVfgE<}>etPy9JzKyefTqQ$vb7yW53w!v&C+?<_@g6KjiRc zd5bpvhy&$cqNd>n+;cON~1c@pWS%?u1y4X4s?z3V7lI3$N%ntzkI z<~kvq1^QK1skNq0C43SPl=p?y(^7Cy7c`A+3rRoyDUGPF51(jY{mNAQywb^fq*y%D zK5Ne>+X7t(NCAqS`@|GOVDcE$DbOjb^`5_{Lz5xI8wZ6$_I>WRFDrXe95-hS`Az0+RrJ; zE*3OxA!N0L9hZNXtx8cwpiA^zYRc4dVa1|s-G-`71${CP!U&hn*9RoLxBcrzmLqi7 z+S_x|m~H#)C(~1VUObZ!neTQA?r8MUzH}*fA->j7OX|$K!s=_*!t@5h&xGT;KIZ&+ z?^uckzC(wOBec*sS-n{4A9|(RO&=$8kmMfS{BxY<92XbR?B7os`ah(k;ZL<-&>eoAdSFj55GdJ z^Qwk!P@z^cXSf7AAG~WDbizJ3O|wOL&27w35`(>qkfIsJIRv%-@$c-PSvor>J5xrr zdZwnyav*eqB~?w^SXrlxk8T{;^1wGP{g(AXyle zBQtl?OBS>wBTJE3IxyRC+eqv}KM(N?Kr$6Y?jlY*{gHY8FpHAd-aE`N+XIVl{HTTLhKYM6wlprg8@=SAdR-mKShwyeWcs0JMxnP#G4$abvyQZh39h>}UT35-4(3W}Mb)7KS@ zC3Z1cKbdYF&%PUO2lcX96Z*_6t>G$Rat)eJumgzAX!Gswuz+aE*( zYiaS=IN_DgE`_7`@NG7=J~lmyfGLut;cowa6uQu|S= zj=zw6mA_jhKt08lWNZ5%-1}cKPFCd7BzIJV@)#Ki6lZq&=iPDG$_o_l9**)Vx&H~j`Sh8idk za;n~Sspro#j6be9340U_KBxaoB;;|=$S#YzB*;?10V^xZ{( zR@B4L9+#<%8Y#P>$fz;?rn{N8z zy}nR>T~#5L+xRV?U5DX%F6i*$zjMdW+>=ZV4M%XxtxZi$Ei5d|&7BbtP;&Vfh!ZOT zQYM4ga4nNRU?>V5pHdqrCAttt1ELQoCR~h#h}ICpaKNn{K(!BzIQ>0-F@M842&tA? z>-NWYiwCKm_m16_cX8)CYw)JIA6|`+*3PD))k`{zqXej67Wqs^a~{fj9h(@>)UN$+ zw|;ya?FW#0IG&+DYbOb<8}Vx#x~}}*Ki6?xLdCOf+cpIkMuC-vYnbRI?TUf`^|4G8NP$#nr!3uQ#d^DS#p^$kynm zf-ix-3GuR{&X|40@P7mtIKW}tdU>PLq={diYFl$n6B8CqYqHwzj+BGVhstBqhU0L) z+zR>x`SFRFlEr?wy;3#c79jPdz_w+Iu4$Vbjpv{3M;%xQCLg$bunRk*qJsWO_q4;q zD^#Y01J{;>ISGT@5t|^%$QejZ)~T1y2klDR##z3Pma@JgZH*X}<^ljY7e_f9Y4#US6f%0$N$?+-&?72uzbOznT9f@%ReFVP;IFu6< z0y@Un)@^bMlBd@t;|ToqU`bt(z&4*&ot3527yOG(bO5Li;@zW7Y7KlcR$6n4^%uswUqoz8Ksl#}$D!JKdeKI-u1=EPJl55=&0 zn?Of0zUe1^@KeC?UB8y#rzi_dimWA-A2Hw?JrTQaF7&lTQ?5OEyEEI@f1fsU-s%Yw zWxbMZgzNK75F&W2q)d?z?$a1)eRLr7tNT_gk;A#HifTy)ojKGn3W_lLn7*AzW^dA0 zh=~zjkYDAg0^6n$ws;i}xdu`=W+3rCV)n1!bFLgLB$G`Cjn`f&ISM7xR$$irq!2OuV=t78>Vm`Y$r^f*WH{N7K_|Csy*w$J0BGUd?NZQ?qO4wkMMwtRE&= zC!f};Xc_6nRt+*N9@1}lwU+60Jd6wWJVpf^dt1avk1V~r3C>7HMsaYp6$+=rbsdEI zrOo_yRJWn@1+?@lh!x^8x@K#LL}`C?k@ zf3pxso$J;LO2j`Hr+xd)o&4q?e^&d}@6u~>scb${CljZ`#>kTi<|$mBoGl*Ve72fz z7(YW;P0DrUHc~JbmlA^C?k4)P&x4@z>u5q53XYRZ;t37xa-WX*a!*n4y_Gdd#(uxzn@Dm zQ5O>s%wM3Vh(-@-)@a8!g!S;ptS$QQL=C_|_@8T2Bbl%$>wbFW#G^N(oVDAAw}xab z2*kHX#Vxmh43csEaQB$Wt!gdB3d-Bp7JX}SV?DVp?(89zGyQEb^(nu+nX0yXxJB*X z%ybP(>SMuuqGC}O71)#=xOIIc-97zP6F`jsc^&4t#K;2Tf$!F9vhT#QX*|ER<*3}h zBRBqlecglmm`A?Ile<7VXL6W-6N%aVZ_cm#;Mj6aUpuA_In}sz$^GxR>WsQ-Jj??# zD^6=x>oaNp{$&;&wdtc+*Eh~6`@s2o+zCZn{)YpPbc*N#kw(_!gjt#$;GcFMGvidr z=TuC1-0z#ifByUd5ko1#M+?8Y`VEa$KBqXYDR&TJOep^J0_05$3>j!(hCk37`ZTEe z(4*AkV@fjM=J{{e9DKzfI(4J9+JXOb2z|1Xq@{!=l5vi-{j+$=<{;fo6>vUCZWrLo zhLgUbfnGIW4B}x&AU#B7ryjpbY;Dq~d(>M>>hwZMc~g4Ew%{ehONB?rpTh>w+B#j% zFX6#c>ajKdmxxCydfsdbVzaRc4&0V7B`ZO6RNyEFS`w}ly%GXI!VeccwG%^{QUfQ@ zDOP{qR5!-J-o1O&XgoPJWf(e@RZV@}e|R0FDSvGNS({I8Xy?=ntJSC_qOAbx58xbF z01{gSKa4;piC=O^&&`EhE7S-T*%St!2Z9)kx+XU-&vS1K^-c9p{pU-`JiLOv1_G22 zOCWrQKoZ-z^G1O-YErTA)Bibm>HM`PsBcdf-foT-AcIG2S()C12Hm=*Z9M zs4*4AQ1?+qFo7iwq33gJ(+!>}>bw=EpDx|F@eQ8e_!PvKwu})e?_rP=B)lPR1AlJB z=(8jfeK^2kMbtyT>=-fB+^M4<*T6afBLbEB3 zrI=2K6AfnfrSK z-mL*$Mo&*xR<`MS1THNWYYJ3gsLb~CB!lxq@Pcpvv-~|(eRqPqWLp4hXw`|M^WIH_ zYozcq70kRqhk$z4V8DU%KkvLL*a$p8$n1);21y1>4=t_s6n*=d`0DrS@Ys8m;99Y+ z15#ufg`-D3?O1|651;!w?qr4h#(v>%w|FeZx?c|9> zayAFq-HA=+R>fb@SXg9nu_mYWb{4&&f~`pHd9pJb5USZ)|ilC^*=gUG~WS{qoa<2W0t&6PDOiF+N_qWx(qm9jfv)|M#3n#o)Wz zS_rfh%-8Ym-Lt378;3TDUbBr@%S)l@>DEv`x^m@tpOv~){ZY8P0z(9RaXwy!mX`LM z6ygX;DDdw^+}bPu)R%Mo?SqZx|L!;om;kWu>n;o8r8G2W|Gu>HKQD#a6k8I{#bP}Jf$7#8FoB~xJldtGMU_fM=&m|=$=2LIM4U}+Dc>K>p+x7P* z=*7x=fpm$RVE*s82p-wkSV&;tQ#>*O0oA{cOz0%_k-0iKIql=*WW?Ntg;-A3_ciD_ z2LznIc<~S<1u;%_-s{^f^w*%L8P)cWItGZRnC|oOX$s^%fBW|B3$(E!x@*a9?Kg`Qb`&7xSKbBy3=msn!*|+-KU$R zZivWsbACQPq9e?i)Teykq%W;?oDUuda_=(1q9M#Gw{1JGp#h&(DdPr~oK_-?n)-AL zAhfRHSwqa~I)9txBD(mmwNme2+13MYeRBJ&Km3>=H0I^zCLV{J+`Ym#_&t){6ZVgI zgYSZos(7Xy8LuXVS#pgqv&Sr;ZQAo9r5}6{jJTP{5m)$W!{4VbZr+x7eYo1b*Y_9= z4#N!z8?&xcZPER#7wUSCJy;h8|q1>);8Pch<$ZVyHouqq>& zY>YJ1l9M4p*jt`J{fynz&sei{>sDLzUT!%#vv!egYH@-OO zNk>mn7ug1Hbh{x%G&(uilUt1M`(h|67o$kU#l^!fboM=eqaO+jXaKUQ@}l@H(#)4O zYEUWuxwNE<4i6AbpiN3AF9sWVR&6DdW0az-OMk^1#9m7FLVv;2^V^RfY(K#PA(0C2 z6F0j2C~9qJGNC1eDLqCx1%DXQzf`j9unEEpBF%yAWpis_9J4imK*EvzH`2!BqK)PU2lztf(<;^Z5=_sY@EI88VV5RwK_{ ziTXG&P=BDeL+kuSlg#m*8zg*?n}j#Arskg9Y50xK+-5@HQn!2Jc=ESJr`50x$&E9C zoLi>G*tVzmZ2Ix-$JOfx@!k&wsn5^c{D+vtA<5K~w^?m#*RI{K5~?5Yy{4&S)1UTR zDom*i31qq8lR5#ZX|)c84ZGMsiwjhLiXHw{PF$V$OYf!=8=QF#95`^~NWZ>NBHMbB zkX@UYR`SjigV_6$rJ|;b8ZoYA3yX6tVnC)Xyq!H$|ac+;Gc&yMb3dw$3-~JhvTYkc`bKBeHzY#2v z`lwk>2sd>Ef7Eg(vwDdhrf`b2otZwtQY`8pXi9%U3I`)8hLyNS`mZH!G^a2+xY&gy z#a3wk%|fiGq3QnHs-@2&%#Ct1k@AHOD(-KZl&4SN7fC{iX4Hkq;ZD}oI_;LOy7g*Z z;)fN1DKH6((GN_%lseIoOwYSNKyjL8wcX-In|N27D)G#}OHn`bEY0Tc&kpxXxLBMB zJT@>B=OeoU#QmZ_r=mYx=m)M_$jd*RpCCjne}28P$Xr)nf4RVR6v$ACQGIaQk_zmF zx-yM)N|p$k$V77b3OXL!cJ55pUPPyN_H*Z(rsY2SY~#i-RLKt?JlLcmxAHsQ z?70h*fkuB5iDge>OR(^X`ZF?pYRyqve5`YRgsuAqT_G5-Zs?IPCSpTn)`C{_id zOrtg{e|~|hj%$!I5IkQK;WFdz*x{#}4)b-$<4u-bkg+|f@}bJvvyZ}j>5%sm`asT{ zb;QG2erS&cQEu=uF0MB758&fm%U<{(6M(aBbk@t4hA3))r}j+=D*BU$R+r0G$F!1` zAiX*Agg5Pry_?m9+57%;lQT=cJ|SWPZF)4#c=BRee^=%Ay~L9*H)x2Km8DPy;q+va zx;3ZE;?}~{GjVI(q9{C5wS_0!H6dKq^-h9;k*02*RUfR_TK6djqm{3)3cH&>!~M5r zk({Nbq(tCVXU~4f>Cg?2j7)thdE;{fj$PuO|Fe;)A?(oPNNoVy4F~)C3?9Sa#K0eB z?_2hX9VXfzgLsrF$XFnh0R{Thhn-o3}W?1l=)qI!xPXOU4i8h=Cn`)z(cFbcne z;pqJVNv9k;y1T>t{WJC7to5j%)X&3};sKfc_Sd`D=G9X)&S_};1j-Hvhy1|}n!%B( zCJ7z(61z;^M{JQ>|L?!EU0GvzOSwmIs{z3Sr`-=^%5smecX(q9B^A|Yz4_`@6aLIS z_SdO-vN<}*u5}a3JSK`U-_uUSqopl5I^Wk|VY;n}X*-A+#6Qc+!$U(*Uf`?8HA3~y z)+DFTfq$BzugxJSC(+8hNa-nt3Ne4^o)1;TzzNHm46GkN&RX-Fx=bj$P~1b0xD?K} zfS91;1QGUTQ)tj!Vj!A}jp5?;nIL^_-L?%Sdcxtp-k41G>!(k9*>;XImB8d-qPdTI za|~QtvRi75vr5pxusoob^hAWq`Oi$y`M)wAZ@yY#jD!a*SG({szclO6MVHr zNPnW-Z|0X)kS1g(%XrwDkgsawQD%0 zTY6i(?oH$c3+O;Ccj?EZxK(ey-FVB2N=HAGkJHg(>9!9=iE=@jke^lkExYn_I2{U^ zSbQP;mlq&LFO4IG@VwcVZVPFB+HLze_wAE`W^modO(97c85yr%zecug89QlaCNMLr z+GRB~)s^LPr*B1~HZ-xEd#_wg4Xd*qKd!7ii+V=xKAJSjy^6Xs45^^s-cvXLpv@4( zVC!LDR#*2SIM_NmJ}%|Sbm!^j#+(eW6w6?d0dj^8KY|MM5FkFPQ}w>K_7_eu?B6WN zoWoi2L~^_CJP)qKpOY|!8j{VMdeSFmvS=qZ}NxHC6b7ahB7qTgXDgRN|jLeTpI7eG9msSFc{}9xWc(gtmrJQ?Jvv z&q%&yaD6C?2r>qu30%A85!-)!nF$uuTOqhrXrvM1&u74+1h|Fr626TU_GL(wasTCL zvbs`43k%ZxKU{o#iLMT3LY<`1=tYl;=k4Z2J9gtnv3M^TY}2C`msZ|H`f#m=?v*1O zZ@+y?=jmv4rH*##{ea)vib=G~{`$<;ahxWleO4hxzff1zhX|^dcJk>KOCa{`K$S^& zl>PqoO9%8T6#N7el?nF;Rxx9rKd;O)BDdC387||dxYa07{}p#`;2h1fPfe^uU3-*UrjSZL&KhQUE~Ls^Q`RorCgxb ziU@}sCVkft*l{pejsN7ou6P)12yf6;vm)t2j(GbrlZ?qt}G)?=VXZ##r zb4xg8^XmiaNHHC(VV6@K63Ba`Kb#`)j2ADi;uK|vb(o9GGV0?!d-uZBG%_sg72bIH zRpA@+jP3_y+QAiblQkDAqQLZ_cbX!2t8I*li*y&Hj?2RQ1!wLBsVX7+=Y{9GYMv1( zD(Runf+6wI#81<40&$@JNN*;BBZ-~~=brf~;y+1K3*Aq1?;{R>Lo<7P*hdx+YY@`v zm&?Bw9jAi*{GJy(gE6q{$nAW`4rdgq?C@|4w<;Wm#4j?f8#!gj-?6oWInCa>(=vHh zwXZK5N<-?t-#KuLz&R_eRKcc2V{gmWMyd!*z5KX!IyhPZ1=RHnTeGgj1-^) zEhzVDNVpZ~;1QTv!8SrQ;XKXr*74nNyTuwu2>Pxgk4w`}^fT1FB(+XjS5;LNbG4XC zm!cu*cOvInh8cq+cn(G-s1f~N?hrA)joJWjg-Dnd#Vn{xcz<3;rVVsb*L77b+-N=l^{+uFZ3ODnjaxV*>OJcaB##V zBuMINoWIn;=N@{?UYk8(y|l;wUc-G@3TIopY`>|SB$rBFZuiW9t08tOj)}ClX?w62 zf=98zGc1RZM7e@X3WgZvJ$M<4{=bh9ncjs9ZHSGNS~n&}NB6nMyzV)V2MzM4-E6Ki z3bNBQi)UySXTM#*ohkoxj96xgNzV&%3g2k;=}%X6>J&M!focIVmu}Gl@QeeToW&@9 zK+sV_Zr20g3B`hdlWIV1wnbMa;g1YItx%a;3t&CQM2vuAsFi8>xaulMk9wJgwf_5* ziGxGtxSid1SgJxD1h%tQ;f)TpyqK?f4`96N$#z&#zyJo3o58~X**^-cu){avTTTU! zB4t@d@~nfm^zrfe&K}8NeaqIP;yUzTva_>sas&qjHHIDHrBI#&56j4ydu9>^b7vSf zOr+-ZhebwChb0E_s^jD+LD(+CnGp?p8Gv*fDPor0BZV)zEOd(;QYT+qcI#@-fH6~s zTNwBUVC?jM;IRGz2Mghbd6B{MZtn`^!1Aud$_sHkeuOGrv>=z z6n}r3v!k{n_3{CCsMW80NGplO!Hpa-p_RLSo*>3Nc|xZdd=2yYx|4+4pQ$L&#Y{fy z-u!bkeo;{~#`%z%P)3c7mOJ_XF+)G{-weIhDz6E_1e?oNViy$=lV2VVe&T>HO_JdF2^oz|z-t@hD zw9VnvQ6j^67`6_Du zv;fDfTuANB<_|MaDrfqNjPi2&U^+{w#Ayi~k4u+=(eZegSMm|YZJdf2dC%lizi@$u z5`QLo#`vaGU1$}99%*>L=LpZc&o$J=vJtiXZ@!huwF2W(RLj!kqW=KWIutAVw_tutQJ~Nn-fLf5U zl9IzzClKhzU^k>W=LY%tQQT?h>Fsj3iuMq}H=&DD(HY|+>6lD8>B)q~W5M{Zkg`8j z0|T-$GRttLHfeXL;*@Z_6ii+1oiXk<;*PUk5ri%=qZ)04k zcSd;-SUPdQQcm>z`$5O{#-M7E{Wn|GwSMHQ4WS38H{@=I>#94Kpx~@3K{D0Pf1Zm* zN!!TqkLf%=RRH~Gi(sD7lh6ga{$?%hzGdU%N zdk7(YOoE_W8Ga5R6}m-BFo5d6^V`y+Vh&RSj?SM!7RS~$N9aI8e|yC5RA8!E(c$7q z>@b9-_GI-UE!!J6#4S2wrpjaZ5-uXxTk^e>&yaY6%wW#@OBDUxZM@boMDzDxN`RPXD|5x zjdyf@i?h@eCowUGQ02)S6pTkg+*ja9Wk1gx%0h{nEIpl;mXCpg)|Qsu-YV<^s4}^e zaayX|*nEAoWv@HA?lfEud0YsKNFs{ka0)nc1ezN*&`#PKpFB9Nk$Q>Z-nTMM-xMw` z$jvB_1Zw8mAU|$X?KyMH5Lj6jnXW1=U{u6FYv0jn;_8}uSFT|c18I&QiE5K zYj&qY+d^N6YjYLE^-dLMvqoMDV`1OAZK$I)19%8ge1bS9>ipf5Qc2j*V#;U&a1aKh zAQy;63W}h$< zj8s)IXyd^SQ_`X?3(RnxLh}q`KJl&Nmr}Jbi}@UVFgv0u3C5@5mQ%s%Q0V5TF zo$Yjg4_ghLxjAc!vvs6TNbc`gx92tHIbn^TiPqbFJld5#8Lm47^r#8e?b(Gr>q(z% zdmVZ#hpWAA;pw2gSe9$m2knN`lvOlr@X5ayXJKP+U6ht9OIXVwsp7e#6CrLL1#d2b ziafJ9$ugVm$a!venvLHJ1h|L%m+w*<428EdGoOi&I5*9K6uyke&q-hP(GK~HLjsv? zJNlTH(zFX~2Hzsya(l3P?H3TR0@zw-K1!K__n0(p3e3n0Wlt~-U8v2wEaY==!@?ON z{nmdSLj+3c&}LI2;yF7PX8O(e+F`<$dg=s?h1O=?2J8XPQ9C3o%PwZ4PpooTW@NE# z5M_uEbMM~0LfKb|naze7w3MeCTuzXSPGaHfKZ>Qka}PR@QE;oqI(WtQvJC0dD1mH$ zOucMy^(v-|s-+NJ!NWv}2a2S{s*WgvILP$Ut}DgltH0())5czIdJ4@4*y9z0ZOXQI z!XdWsP1t4gt#YQKE$$MzPmqe2f2g^G=ED>ygI_K?c%-x{nJ2g%Ff%oiiO_4Gu%V;u z-{;Qh{yRC6<}CYfw3mfOG6-fHy?|KJH_z7X3H2&}7ESE*lKaMO>f|0(z9Z2QJu;U4 zL>tHL&8Wr|uPSp{^?sX_m}+CkS8V@AQAEqf>fAqlAus>z)c*^*uRD?8fM0T3HOM~r z!O$#6Dq{3U;~}q)*PD;+eY=j+!L&TC(&JZ+M+TMTQb9ws7Rx_v-7#`&xsyhgJ(B#Q zeWrmsP1g6a?uA1!P4jQ{jU6SN^oc`)LxbQ#Zg_sQq$6dn+M0*8G|ALPVsw9UNu34T zjx8TDOf(}$ue#i*S?DB}CF;v8duX^89fw9#c*?@K;+89Gj&n;S>&7XSA@*W!ht}0YDe{jq>ovT?f)pzB1tZQ7-18S9al*pLrb)BuJ zkqM4y+}E$r!F=-e0mJdzd!`Dn6eg#r?sd9lcK>$Cz3;lH0P#_62WlC zh(F%kO`z`7pa1{G|6lILDeCeh*(G7`f*fV(*=6Cd47$Ii5X%N>g304{>@IP4%Rkwp z^zvjzj|8dm_2tyoaZDR7t=UX;*7VQnQvruJyy%CMPde-+k(ka9T!7>dPDQ%So7vw9 z5szfUcIv~quMXT)wd2?3R6|Ygr%!i%lBWL8&42$VegjZB>*)gnU3QW>IMB;a5mmL2 z!e9148!!gI;zjaa@&=-;`xMpo5s;tT8#n4j#sHEBS)lt6B=N+k5W>U5f8SOIuu;*z z!XrnHfF5H`WljsR{C&$Qyrq$*1Dle+p(yLc24YL-3sEDWQ0G7E*MIrp-0_^R-r^l` zmDG=M``7gMh$sN++1Yd}0zf0ZqK36kYqWcW75s62#W{e-M~P5(I2 zX(z2dKQD!UurMl_^Zz)Vd<>+>@mBEFQ9U1zf^GtXj!3*N}BH(fUh+W})y~xGS zpD$6vmp+aE$m;JRdv%Y?7dU}~%BA^&boH_D6r`0$1>ee7B$WCKFq_3LwB`nO}7la@9Tv5iG{fj~IUa z#<1z@7SJZRQY`*VSmZR$T#zD`-a`iB+0ip+@Ip+UxpEsn9c?|WYko%8=Wj;_oPOqZ7de$Z|Fe(ZMTRDxe=0E=;E=i9Zn+uq|_ zyHV~DO-B0bnS8cSCWG|c&ZyGR&MjU#Ocv4}7v1`R0JOeSsNeJYSn|%s##FgSU-Vrp z692=QA-Pby+sCzI($!_!pb`(X08<^`Z4IaTgLvddzO?|8&7S;-sHIxPK#I2iw0CV{8R}d z%Oy0wP9auxNd@sHB>k9Qzn!^VMSG?u_TzTBjlCd_aJ=3crc)J{*)j_i@vol>sHb9o za$@35WL@g1TJ7V5uUiHdb@lWH&X_EiMoIDek1PdHBenD2qB6M3yzFeB-SfiQtM-er zv&6K=mMvTSIn8pqk@7*Qb&&v``SW`HeSJ9;TOMp=E@TZ23CRPh2~^=0QV+JxMb@+Z zC1@g0F+TvtPJkHTb=8gpZUM+I_&tkXE|`yh?@u@#o{K!AUiyZza{a4|$*AxP(f#mF zkB3dwsZ+}S&|dufJ`$w$Dd2wZ(MbQjFrE3wmFJ<$)_7(HHc2~J9pY8ZrfOMpsp2#Z&cSW3|^$;)*(?C|I3+_jFh>513B@qqx0_PeuSRvT{O ztC*ZaRx~AE_N%cw=Nj5CV0AfPe_wwNG_+PqWPcGDg_|~&GzgWJmSV2=D2kre@u{B^ zFgdiDXyc}wfTKNfH^NsDR);E~LW5|ZYM0${iS`(O02zWS_~z6e<7{8iB5b*Fxtmc{ z;tnpL3-)~}dnO_7cXvsLi?A|Y$;-u+-!KFuoAiN=TD8(_-pnj#n$w-@#p?ALN#Z6N z8XJ)hXxuhlSwwP6OF@Lz4q1WAs0|7Qka-E{9V{Tngy{!w-@YZ38cJ9?=lY4B7IB&L zd&hq)y?ggAP4}X?A8TWt-UQx&(1)1#K@{u@r$TkVE-o@#9?=1Kj|+s3$uee;Zyrvt zm*wwko-3IN(0uavF|~uL_t^;->ZVLx!;&G-o;d-NfZAlv+7qWv5q%(3{b-~|Z}|KK zjTfvd2-vfR*8kX+dTA$_40#&l?{Qo9%F|FFUVfqBgX?ULts{!CV#6kPn^pYvwOn_F zc?Pt7v^d{HHrxv5Qun=89N&N1D#0q@6WZuycv7|4WPly|>ESNFfSy z%q0=My}mQHuV1c(I?u`fE?vL_d83KZ53^usF)56En@X{}B-@x%nj8ZXYcpfrhm{~GhX*rsS) z&copkO`G4qRBbNaEec~=jBZht-EBEAsXCCUYM^bq_5m3;{`=hA_aPFJ73GlXD0?syFxk z0mn0V6g}^a6rv5K`Wp)#Og-M6r&F{GG7}R`7iaq99syU+_H4#9BpMS_*gby`1opjxSlOlZac#@jYdlbnV4d=y>SXp4*sH= z*`|Kb-8A|ID6H<`2CH}hE-q6%9*8wG0VCMGYge&Z>wY7#?gx-hnXxV#?z2C%S;plC zpw=lutMvy0-nOk2tJqbnvd8#?e53vCW~GI8@6&wY7GqCBFyn6qu@r zSqtZ=4fq(A$;MQE0g6;$4rnc;>_VMti#^dt`{9zdwl?w|zIu#HPHDLH=UfY!CuaeI z;9a&9>j8YA3rX;cuA0FFf?4=aLaUi5Ye@;*O8o)@Io%VJlCI}KYk@ah+&b8(YtV*s z|NaTPLRITyni46ykQ91W?Wwl~qeVrf0eJ~}cD=pL@J^+;OE}FN7O_~xTcNH+3_!;P z2Z1KQ_Pjht6u{{Dvs5onJK8(4jXh7WP6L5N9IPI+3Za8wEh+PDezg7p8O3~BMxE9t zkhTh9|ObFwENbXxeV8SYFR_UfjCBI4yoHi^5;xf*so`JC1Ue&(MulQ)_X- z!TD?qEwQqt_H=;q-`mcgsj94;8YnAE*!(K9%L0!DGpTXpp)bv`AhaSDn0J@}p^I0C9U~D|PVa9;K-bXIv(C{9Vxtvs zq9r;}8ijUd@D~Me5R_1DAM_QYkYu^1J4E7j=*8j9li4_lTAb+YMMM;XfAHuLjnUhl z>F0x=7m5mtyuW>D6?epQ#e$pZ?4N1av15naqw?~j>i-%AxI?6f8SN)K@bUm16?~Z* zZa&vzc75A%?TK%gdI3s(r&b>uwtUo}j7VAdWZ6^aU+RW=b)AfF@Pk?p|Jm4o>T zK+i#sGCteT*w`WHtY%mt9++}eE-yA1qa04RMLT_;nY3_gD{)yKIwPl)%*UxO^7A!l z{QUig?r0S*1v>ngJG(M7QR1*IR?2Y>qErb|efXYk^>O_UWEM#x*_4j#vS5-!o7!>d zRi=dlfEcufoIpwojBWz#UE@%sqj^ITs9Bsz(eaa3R%zs`I6JJ?+U>eI)tP~fc75cX zA86G|p6%ur7u1QqX8{^p+j%bm&<1f7Ru#U!WJ)Cv(_-9)n%%c7aKAwi(D@N!q}f$^ z)QK~MuO1u{Ihy2lo_bq5yKLQb_|;s{Wd#&Yh7(Ntc0Nu{h{Bf8K`ZS zfV3~cq~pxA7hvSqDqqC7leq&@0S!@oPn0VZ0}wMu*Y+ZfhELJQrw$S?^~3(Dk*G=yfd-~!`qXc(S( zcE#&xe+HmphPh6sLrfXFoC}>%yXrQgZCGY@Axj7ts%Q~{+(~G6zz80MZbC(^9#TQ5 z=2X0|?;~V7u^_=@aWkfgD)-ViN|CDpFLN7WGGtYRVGw*#tN@+75+_kh4Cz*&*eFA6l9SmRENb?*iVo@&dSW}s1RNOAC8|k;3gL_J=-p&J`@r0 zUd754D?n$~AO_rD8P$s~8eM!627b;(Pw%j9(nMXz4NPC9W}f&P?W%LMDLySWhbbApMk@o{qLzodT63lX(n&lq0UW zb0~Ur_vGs#?26g-Bw7|A_<>puA$S*?EkYOupTSx?9}cGp2Z}?%U^3vfe;F717iQ?l z=qPp=Y$aOiw>uLBmHo1K%ze!0^&TFbXuVR}+S3zMXjSs|u$vmS(#))#0IQNNyqjEH zrbjxhZEUKrbqj^U>84Gm^pk9_Ld1Tgr+VwFKBU&n%s9H?m#Dro62>3zuO~Z(yQFu1 zqK`CqK%N0m6!aSSfJPTuRQ_G)Vt>ay)XO&i^l1@RANb$VpN1f$rpR0wD>=v6S9Cmz0VZt zW>K#wsiXT`os66mi!-_tLDP#!su~rd?i-Y*Uf@HNW;^fqU&vY3)TEVYs-le{bs2DE zOMD3zwp+0E-6s!Z@iQ-$7LBI|sI8CU&PgkSilDr#JjACqx>lI}ITXS&)dx->SkXRt zV%sAQ2^t&V)`ZEtXVe-4@l1Pj+*~g{oC-VCiX}BByw1fvzSR#EvzCLyg#scW9e28f zW3Y25f6LxmS1K&760%)OX%>y~fS&&$eM+;9&BkrD(ZsM5w8q6|l0{GFIF;VUX}mU3 zBHfb3G=)+CO~W8{CKZt*My>xc>w(pT9tP!}U8t%p=zaG6N462)G1FEz;xJt>Z8#rZ zm^sPsQ_rSYEW2J^p#0KcwV@?>67nU$oEdsF zD;@|?0X1o%Hd~nu5-}y*@Ina}WqB@Q3ZVXB)}-CM=LhnnnqP;axW$4h|E}iH@^y|P z&#DM3^;@sGL#9wHYW-Q{U4yj_4R=?rQh7U-Q0q&mX4ogHbEK&F<@bJH@~L}2E>FL_ z_L`6%8xu)jpYF28=NI5yRh&tfg9q;L7=~t zmB*1Dr{2MBbE&aJz$e##qEZtP*W41Nx<=?^%z5$6L4@HaNEnV?3LGphBDLe+p~&XF u=Ck-qf8M@9+3_K{pIqD2qW`mSKC>`hxS%*^zlCT`w4I-^eacut$$tZsH<5M# diff --git a/speaking.md b/speaking.md index 7662cbe..caf1759 100644 --- a/speaking.md +++ b/speaking.md @@ -12,85 +12,81 @@ requirements/constrains for travel and food. Bio ---- -Joanna Rutkowska is a founder of Invisible Things Lab and the Qubes OS project, -which she has been leading since its inception in 2010. Prior to that she has -been focusing on system-level offensive security research. Together with her -team at ITL, she has presented numerous attacks on virtualization systems and -Intel security technologies, including the famous series of exploits against the -Intel Trusted Execution Technology (TXT), the still-only-one software attack -demonstrating Intel VT-d escape, and also supervised her team with the -pioneering research on breaking into the Intel vPro BIOS and AMT/MT technology. -She is also known for writing Blue Pill, the first hardware virtualization-based -rootkit, introducing Evil Maid attack, and for her prior work on kernel-mode -malware for Windows and Linux in the first half of the 2000s. +mfp is ... + Photo ------ -Feel free to use this [photo](/resources/joanna.jpg). +Feel free to use this [photo](/resources/mfp.jpg). Travel requirements -------------------- -1. For any segment that requires more than 4 hours on a plane, I would require a - business class ticket. There is absolutely no exception from this rule, - sorry. +1. You pay (from my seat inside my house, to the average middle class + vehicle in the place of arrival). + +2. A/R tickets only. + Dietary constrains ------------------- -1. I'm a vegetarian, and more recently, an aspiring vegan. Occasionally I might - eat egg-based products (i.e. bakery or pasta) if no viable vegan options - available. +1. Overal Rule: I eat everything that is clean and doesn't make me sick. + +2. Animals: I didn't enjoy grasshoppers and larvae, rats, cats and dogs. + I hated to eat animals bigger than a cow. + I hated to shoot a wild animal for food. + I have no problems to kill home grown chickens, turkeys, etc, and + turn them into a good soup or BBQ. -2. I enjoy mostly European cuisines (mostly southern). +3. Flavours: I'm curious about strong flavours but I can't eat a full meal of those. + I love wasabi. + +4. Comfort: I need western food. After a few days without, I become a zombie. -3. I don't tolerate anything spicy, sour, and generally don't like anything - exotic (in the meaning: different than European food) Other constrains ----------------- -1. As a matter of principle, I don't travel to countries whose official laws are +1. As a matter of principle, I shouldn't travel to countries whose official laws are in stark contrast with my personal believes and values. This includes e.g. - all the countries that discriminate women's rights _by law_ (such as most of - the Arabic countries), de-legalize love (such as, incredible and sad to - believe, Russia today), or otherwise limit people's freedom in some - unacceptable way. To be clear: it is absolutely irrelevant whether I - personally would be subject to any risk by such discriminatory laws or not. + all the countries that infringe constitutional rights I was born with, + But in practice I care only about not being personally subject to any risk by local laws. Tips & Tricks -------------- -1. Please don't ask me "how did you start with computers and security" -- as you - might imagine I have been asked this question about 1 million of times - already, and so I hardly enjoy repeating the answer yet one more time. There - are certainly more interesting topics to discuss! - -2. Please don't ask me how do I like the place I'm just visiting -- if I liked - it I would sure to mention it by myself. Most of the time though, when - traveling for business, I don't have enough time to get any opinion, and I'm - not quite the kind of person who would say "Oh, it's great!" just to please - you, sorry. +1. Please don't ask me "how did you start with computers and security": it has + always been a part of my life. The other kids on the beach were making sand + castels, I was explainind sandboxing to the life guard under his umbrella. + Then it became a job. Then I made 15 exams at uni, because couldn't proceed further + without solid math and physics principles. + BTW, no kidding here: I can make you laugh about it. My story is all upside down. -3. Don't ask me to help with your IT security career or to scan your laptop for - malware, or how to implement advanced OpSec ;) +2. Please don't ask me how do I like the place I'm just visiting: I've been enjoing + any luxury and shithole I found myself in, because of my perverse tendancy to + appreciate every little good thing I can find in any context. + And complain about all the rest of it. A warning about local taboos would be + appreciated, because I've the perverse tendancy to notice and talk about + any wierd thing I see, and laugh about it; and sometimes it causes death. -4. I won't take an insult if you don't express excitement about my presentation, - last paper, or current project ;) +3. Don't ask me to help with your laptop, career or to give you one of my fish. + The only thing I'm willing to do it to teach you how to fish yourself. -5. Don't make it look like I'm being invited to speak because I'm a women. In - that case I will likely turn down your invitation. +4. Don't abduct me somewhere: it already happened and this caused to me to be scared + to move from my actual geographic position unless I have some well known host, + or a good amount of peanuts/money, on arrival. -6. My name is pronounced: root-kov-skea +5. My name is pronounced as you wish to pronounce it but ... I don't guarrantee + that I will turn to you if I can't recognise the sound of my name. Thanks for your understanding! Upcoming events ---------------- -* "Security through compartmentalization" @ [Android Security Symposium](https://usmile.at/symposium/program), Sep 10, 2015, Vienna, Austria -* "Trust as the no. 1 enemy of security: the client systems study" @ [Next Generation Threat](http://techworld.event.idg.se/event/ngt15/), Sep 22, 2015, Stockholm, Sweden -* "Trust as the no. 1 enemy of security: the client systems study" @ [Next Generation Threat](http://techworld.event.idg.se/event/ngt15/), Sep 23, 2015, Goteborg, Sweden +* Apocalypse Was. + From 1ff88facbc66312ce55f2e2558f42b2b6fcbae5d Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Thu, 20 Aug 2015 01:54:29 +0700 Subject: [PATCH 007/135] README --- README.md | 48 +++++++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index cc7ab44..e6510d8 100644 --- a/README.md +++ b/README.md @@ -1,29 +1,37 @@ -Welcome to my git-based (not necessarily GitHub-based!), decentralization-friendly, +Welcome to my n-test for a decentralization-friendly, liberated, and integrity-protected blog and website! +Waiting for a decentralized Internet to come back, +it is worth to give a try to a git-based gpg-signed +content repo. About Me ========= -My name is Joanna Rutkowska, I lead the [Qubes OS](https://qubes-os.org) -project and [Invisible Things Lab](http://invisiblethingslab.com) (see -[about.md](/about/) and [contact.md](/contact/) for more info). +My name is mfp, I lead my feet and a limited amount of air over my head +(see [about.md](/about.md) and [contact.md](/contact.md) for more info). +As soon as I can get a clean terminal to access the net I'll be in charge +of my words again too. About this Website/Blog/Repo ============================= -This blog is a continuation of my "Invisible Things Lab Blog", [previously -hosted](http://theinvisiblethings.blogspot.com/) on Google's Blogger platform -for 8 years between 2006 until the end of 2014. Read [this -post]({% post_url 2015-02-09-my-new-git-based-blog %}) to understand why I decided -to migrate away from Blogger, and why I consider it important to have this blog -distributed as a git-repo. +I've never had a blog before. I hate blogs. To expose what we already +do everyday, in every and each human context, since the first monkey +learned how to talk, is ... wasteful. +In other words: to turn the human chatting into a show is +a dangerous and insignificant waste of energy until we don't get +rules that guarrantee no actions can be taken upon someone that had a speech. +I had some sort of blog a bit before Google popped up in 2001: +the reason was that I need to practice some advanced Perl programming +so I packed togeter an opinion-spitting tool. After 6 months was down again. + Content of this repo --------------------- -* All the Invisible Things blog posts (in the [_posts/](/blog/) directory) -* [Contact info](/contact/) and my [GPG keys](/keys/) +* My experiments. +* [Contact info](/contact.md) and my [GPG keys](/keys/) * Other info about myself and my work Distribution and hosting @@ -32,23 +40,17 @@ Distribution and hosting This blog/website is distributed as a git-repo, and is primarily hosted on my GitHub account. You should be able to clone it using the following command: - git clone https://github.com/rootkovska/rootkovska.github.io + git clone https://github.com/mfp19/mfp19.github.io You can also view the sources at GitHub online -[here](https://github.com/rootkovska/rootkovska.github.io). - -This blog is also available for traditional Web-based viewing via the following -URL (which is likely how you're reading it now): - -* http://blog.invisiblethings.org/ +[here](https://github.com/mfp19/mfp19.github.io). -That URL might change in the future, as well as alternative ones might be added. +As soon as I can figure out how to decentralise the whole thing, alternative URLs might be added. One can get notifications about new posts/updates via: * The blog's [RSS feed](/feed.xml) -* [My Twitter Account](https://twitter.com/rootkovska/) -* [My GitHub Account] (https://github.com/rootkovska/) +* [My GitHub Account] (https://github.com/mfp19/) Integrity protection @@ -89,7 +91,7 @@ git-based software project. Thanks! License/Copyrights ------------------- -This Blog and Website by Joanna Rutkowska is licensed under a [Creative Commons +This Blog and Website by mfp is licensed under a [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-nc-sa/4.0/). From a1ebd32bb0095b43a986fb762a07f8dc15a69566 Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Thu, 20 Aug 2015 02:48:14 +0700 Subject: [PATCH 008/135] README again --- README.md | 36 +++++++++++++++++++++++++++++------- 1 file changed, 29 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index e6510d8..66f5d2d 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,7 @@ Waiting for a decentralized Internet to come back, it is worth to give a try to a git-based gpg-signed content repo. + About Me ========= @@ -18,13 +19,31 @@ About this Website/Blog/Repo I've never had a blog before. I hate blogs. To expose what we already do everyday, in every and each human context, since the first monkey -learned how to talk, is ... wasteful. +learned how to talk, is ... wasteful. A potential of 8 billion times +redundant bullshit. +
    In other words: to turn the human chatting into a show is a dangerous and insignificant waste of energy until we don't get rules that guarrantee no actions can be taken upon someone that had a speech. -I had some sort of blog a bit before Google popped up in 2001: +Any speech. About anything. +
    +To be clear: if YOU point YOUR terminal (computer, phone or washing machine) +to access the bullshit that is supposed to be mine ... don't complain then +because YOU don't like it. A solo job is a ... wanker. +
    +To be completely honest with you all: we're didn't finish yet to discuss with big +weaponized guys commonly called 'green berrets', 'marines', 'MiBs', etc ... to let us +keeping our cryptotoys so that we can digitally sign our graffiti ... +and you get upset with ... well ... whatever you see on your monitor? +Are you stupid or ... what? Don't get me wrong: I get upset too but ... +I don't go around yelling against the pedoterrosatanists inside my computer. +I just suffer two times: one to get upset, one to get calm again. +I'm an idiot. But I know it. What about you? +
    +To tell you the whole truth I had some sort of blog a bit before Google popped up (2001): the reason was that I need to practice some advanced Perl programming -so I packed togeter an opinion-spitting tool. After 6 months was down again. +so I packed togeter an opinion-spitting tool. +And after 6 months was down again: do the world really needs my opinions? No. Content of this repo @@ -34,6 +53,7 @@ Content of this repo * [Contact info](/contact.md) and my [GPG keys](/keys/) * Other info about myself and my work + Distribution and hosting ------------------------- @@ -56,7 +76,7 @@ One can get notifications about new posts/updates via: Integrity protection --------------------- -This blog/repo is integrity protected using [git +(WiP) This blog/repo is integrity protected using [git tags](https://www.kernel.org/pub/software/scm/git/docs/git-tag.html) digitially signed with [my blog-signing key](/keys/). In order to verify the authenticity of all or any of the posts, you can use the following command: @@ -65,10 +85,11 @@ authenticity of all or any of the posts, you can use the following command: $ git tag -v + (In)dependency on GitHub ------------------------- -While this repo is hosted on GitHub, and some GitHub-specific features are +(WiP) While this repo is hosted on GitHub, and some GitHub-specific features are exploited in order to make this more available to a wider audience, specifically GitHub's support for [Static Web Hosting](https://pages.github.com/), it should be stressed that neither @@ -77,10 +98,10 @@ If, for some reason, GitHub, or an ISP, or whoever in between, decided to block, falsify, or censor this blog, there are dozens of alternative ways of how this repo (blog) could be delivered, e.g. via Tor or other transports, and thanks to using git signed tags, its integrity could be always verified. All -the documents contained in this repo (apart from the old Blogger posts which -have been converted automatically) have been created with an assumption to be +the documents contained in this repo have been created with an assumption to be easily readable using just a standard text editor or viewer. + Patches or pull requests welcome! ---------------------------------- @@ -88,6 +109,7 @@ If you find spelling, grammar or other errors in my blog posts, and feel like correcting them, please send me a patch like you would do for any other git-based software project. Thanks! + License/Copyrights ------------------- From 55c60274dd64dee679a55db0d81d3a6bf135dcab Mon Sep 17 00:00:00 2001 From: Michele Favara Pedarsi Date: Fri, 21 Aug 2015 23:09:00 +0700 Subject: [PATCH 009/135] footer fix --- _includes/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_includes/footer.html b/_includes/footer.html index 7fbdcb3..1d96377 100644 --- a/_includes/footer.html +++ b/_includes/footer.html @@ -5,7 +5,7 @@

    I~V`5@LqtWo+m(tR$t*xIo z!P((s4wH|bX&g8xlj2AJzY`3*$P;VHPsL#?dL8VSUyYe`d39AeOIcP{w){}fqG)st zk^$N}i?Y$2?Ceb$pAtQa40yt68<*;d@bDX9XmA?b{$M20A26ok%R~~m3K@h|Sd)QQ z?c~M*Jp2ESZt*af2dp9`=4*P|+hv@c%j)$^O-<`otXQF7gcJzQi=N(HV%)xgf#p57 zl;HOrA*sx8t>WP-osG@Sg25FD%mGj%!Pp4%U3|ZWC2)zIDAXeew_7gIzyQw=#-+wa zfmibVGR}4I@nWi}W^oxy`}{xu`0dM=FaIxj;%@celYPSzdvpK|im|t`GX9q2dh89;HrCeGhK6a1S?%MHbaHcX zP1y)$=j34jAjA(*W`Q`feS*0N)MH>yaPh@dz1}plk!hPvLzg2CLMa#UF*p|#5R<1< z%|;-MhWwUcZ0xES7$0XR2?U4IZ{CDsk~D0Y6dyk$Xw@(_r96hhJu zZ2fI^1OI>k$>-0(*45Qx|MWkhD^g?gz?pa&aQzYW^_Vul=sN{Y;7{;2KxgRiuzYaE zQ794Op03Mfge4|SBJ^$&2R;M2B=Zu+$QQ8Ddv0KINB&iCKw<5)zkQZr?1lLC_vAqk zoW~tWO02rVxY$^{fJR@;|C*Sn0p$iTp!`A2|D||&*YRW2*d|KfQhATR;G+1EpO3zh z@|pZvqq4FxI086y_4W0Tf5)^L^HKWcK{UGZ&*J!RW+`hxVfXqqS;%uwF^mjQbMr?K zrJ>pmYWf>>kzhP5#gN)<%AYY3LKoQroi08~Z5wg4ty87;=Lkg5?>~QtB@}=IP7MlO z*Fk)x#Rz0M{28!cf2jQh{kqKD+zv>Vz6s2N7X_uqa zs5_k}l1jvOn50N!F=L4(bCLzmQ6?3z#mi-a;+9Utn)(1a0b|TG!$bsYf76DfztMz{`G0Wd?l^U0v_xtW5aH zn@Dgm2QYE$?Y)V6g^Uw64UZ0DFPJ>RJnd*-yUEUby_gKM;HLNLuMweCXj{k?353+` zsmX(zDk>{uR%{3hC?pi%5P*Y)UR-W&F7$Mfs#hc=(z;iN3eyS;xk>Rse$EKMIA|7t`5<{U->bbAOK7Bg$s5yE;h_+>GgVqyj-0IRwJ2{x{sBlm!S1@Ir z280qwD4Py;JS#v<4-&+By`jyDZxmlU=HYbr@SU~1@*+vArQ2X2c>!%^2vzFQ&? zk_H9_?laLrREE&iIrKjL-6Oo zVLviFeGmj5&b(xOqPj9Y9rpEJzh6lj^Kyv5gbPR|!3XNVc>x)mW`dwp>g(tiOo`tW zv!DS41G?xcYA7f8g)v#4{Ha=WVqBbtz8)#scFW}y1ZLvh^nzQA{vO;Qyp0Ieqz9>` zuaHj=*+4*Vn-iM*qGS%^7{g@=W@b15pxl#Tb_~A-**h}kvV;_UIHXGa4 z34vTds9O^&bnIj@W^4i))eU}HwerU$d@`i)zn35-ixa^MUxj2jwI_d(S&n)XAs3ES zN$EMXuz<5>&KK9y)ARSM#SQ#eh!|#Oww2Hr8;6t|lFrMGbQ@5A%4JgBzP+@uad71E z)sPVJ?JMc>sHabA^c)XwVAf-Ep}0^RqoqgXDSxDH$I2OSwX)egKP+pYo<;&3>d_q; zY&8$=0{mD~$u=^t*Yj!(g~2*L)LX~ZbWJ9AM4BibA)DoYzFI_nlPB#%1rs-P_@TCL zSb-XWA#$+j=O-EC`&utpQra1rvpz;jGnYJvbI{z)2PF=~O2}~Tg-bydl;VU9X~gGU2Y$(z5?c#^oA?xEtU<*Uw4~CH3Dm7 z)E^jMu`r>O=?IkwP#k8EVD=CwkfwilU(q_ydz-=J`69`;0@6-YaPaft_3ND*>89p^ z`6~F&J?R@Jr~Y#Dh}2b_JO~c4vdsAN`O-jazqv}5GTb3pUoUYkEuR3Llsw4f4iOLfU#slHQh^qGV29RIP< zUnBl*@@2|v2j7ccAaUPoBh(1%yR>~fibS=CW0Ds#&V1P(>eR?@rQ0c;ueNm+i)#Be zIg%9Ae3705J+MCWJy7ke(#eMs!8VmSyQ<0qoE@aW>@JWCXaZn3elQc+Sa zFD^=@D}twmY7nyKx(dTb1EPa7Az=jCxU)AU%U$?K?wE(Y5lA(jb!Zr*U7jyz6PvkI zr(wB?3XUguqvILq`@v}EQ@=J@TeuC^PHXTOb&cT%M`+Cs3=J(FoPfCJjf#4q6z0|? z2hjNfTlra9+S#s0_8Q{Zzb~W;+Qp8%l#=6fIwQ!@m~n#Ce&FO8VB5i%DM|lfapn@j zwNQV7gCy+Dq({hilKB7d8e0XU?=2bacMM92a5%8bpF*62Y5{UikgMdQyj4NXtN}X> znqOqW>5zD3W-`S~?A(U$y9y6@9QQHwYGmB>K zvkS5gLu_D_Kgg{;44yL4U zDoeQ`WJwXw*bNH;!1v+dz+Z#|MB?=tN=i46d7&;NgM@QHBD&3GW=3kR^vg4T8mW2v zYlF`m7{V+rBh(Zpy0jDCB*X`kUWofpqb1T3a1vwmW*`{CeL+lxoL8CUzQZH=_D|1e z0CgiluK;+FUA{a8$WKf$*KU$A$UYPwXuu-fV%i>vXKTu6$huoY12-FkS##ezG;HTj zDn)_{?pdV-`{ZJhoiP+|WDB*B12YX+{&iAb$o)J|oPwKr`uiX9yuSoFj~@Z%c;J4| z=)ULJHZ8>`8q=wCFI3)~pL69BLNKT*sZxrk-tWC;y3!@IZ9U=zqhH?TQZmrS1Y;>w z!{|CgVT0Mp=L*Ug^vl~d5Lks#17qZk3VO&MAfNF$HGIS$7it;ORZ<|&@T!<37rpu% zw8vWp;jqO{XiQq#`NqeRRNxNTJ)>8!w=b4XH@CJ8McJl8@88@&Sbh>osw_tlr<6%aUPa>4@ile$`Eg*C();T} zvIfrk&6~{04RSa|b{e@(;4iN={wyi+LsCF$EUyN(FsmEav`VH)`m*rIZMT;?Ndi&u zWZPw(KJbcuSVHs+1vJ`%9@+nFm>yj=*}t*}*`iqTD@Y6wQ z(Y6&*!M4g9-4iIg-67X;ewNR9dainqcM>fa(b1dM^)}opN`i%CqFnWUCj$Llk7)3B zVn*~Aw7n{SWywf~J$1mLoO~Zett&q3bUqhR?tHPwT`7F+e+?8259LL z<7p!vD+nEB;oPt!TX2-vJodcT;LT40P`u=lo7nt_WUbEHAa-4hkJtFJG z%6+Q8wsyjCvsr91$2Hr7F4~y(bo`!o^+sR|x3zKZ&gsj}vnlkXq{2nT#DMstz4@2! zlP>!CT{D#nv6Jj5|AE2lUV9hX+42vhTUQlPKUeh1p3&!-We1}F&a8ug?3v}lO~xGC z#APPmYkP#^9tVbDr{`Ni%iEkDGxjTGDP@+X|J9oe*G?S#5>Ik58xc3OSG%tmnEuPM zF!nNUz4hr~Psk4jPO*bza>5A%s3iaQj(~L$h26x z@qe#j;m+{JB%CZJ;o#DR21RJnqLwnmb-i~k*H)cvX(ovr4hf69ESsC8L`mIW(01r- zu48V?o8g+Ks`YLQ-%om_V>6HLIvJ|FaiBteK4pC%9(9u2WaZTrFnJcnq;m}?CNbmD zjaREeZ_)PJufz^pX*WFA<&Yn%$GkS|oyAUwzW+zV8*=XA* zeb{>YhJB}BGWF^mgJSefwn)aA_T25Mx|O%ir+?S&IYd?jmme__&{Q^UpPS~**>Ka( z+s7n%pQ#AQesb9^2`pj$+uIi*XFamNu%YET;XWygt8aQ-b&%9Kc`*@vlYzclKz!?h zrgpy4mB>l+1gFNii*~1y;qf#xDEQ~+L(>dxDm{d7s;q`Vvbj05CM>kY17VP24)KZj zQ|Gt)zJJ`6Q=v z7Db!q%zYFgoz5wG5>zKMbv&w&at~!+{d@A>YuEuHpt06&UjDP z8e9cmE4|3G3sg=OSROEAC7|BBHno1|y#BuU`F>XoUG&GWwC{#I7loQ^8)5S!L@@*3 zsy8)t4}Tv`hDyYE6%;i%a)!q#g&Mg~CqfAgsS-4ao4WM40Nm-@I1Mq!L5SVq5sbPpqo0PJ z!Qn|e#o~HP;tFCU?v{H7kioo(?h7A@GA&;l$!f_m)MzoI6`Y%OPA(s_7I&?`V6~5; z@eVwiIXJBKS{Jy?`y_=xJvWoa!_7!;@ z{fvicwN7U)&UYn$UVTfW>Q22~<9wu{zgD`em^m|V;a%(%-<;p@W4XNLende2akMmJ z<=@asCKHo`gT0IO*aa{97S(Ngdu0zE4PTpp zRJ=r^8pA5ITm4menze8J?wf%tdA)`kP-i3hoe#pq%egf$c zFT0%v`rg?2NIAibvxt@$io*CtA{9-$H#3F5US1q*TXfY<-#JKf?tV1ry`dUS0#~VK zjFK5YP16)6a!^%{(msi|&~lUuow;7-RJ}R-l2dH2OE|fF?agFGjpyX_c6L$z#iE7q ztKk}#w6qU~!3Sq8ILS^2*K_!?lf8D1bG(jnZ_&KR+8UYEW%B)*@N<*4!7Jdj(e?jUg4T0x`_&rpS2|?l`jR<()q3))b6(y=U4BaQss+Y z{66D6o6b}{H<)D2?Tibe9XqXF_GjU5tJ&-m*L6Q9?E1LS$z-j$X(MvBSuBqFyO3qH z9FbFdJe;4{_VMc*+LM!#7@dPNs@juo`*Vw}b*8_8k{d^DQ#Z<_)0R!wJT?MeU96@r zbn{iucFS9+u#)oEMr@p)wl?KwoamHi?v;E%wc0-{cMq_xnxF5yJl;>3hlwI@g{fkM zd2*HV^Us&c8gA>oQ%!cS&P+QPy>M?jjj%dAmmMt?_}&|f35muBlebu!D0Mx3KVyfD z|CJ7P1L>b5UQFP4NfUd&t#f8tXs((`*SkMo%)SMcE{C>zm|qb1UR0L-NR9JA`Nrp7 z^XjcO-NSA6vc!vEs)fH>wWm|=b}gg7IVDK~HP4S{zYPvP5=m8Ju`b_y|Mu40tM&1V z-Sf*`tKtP0(NrAg9oD**8~?F7j=3J)m+cI?UuL%w`6~G=ulHwb8tuD&PCWSn8Ad4a zl~h&9>Apj$w`ljR`2lGVv@&2U3K>nw&!5dktkr8U7IDN(h_I+`Q;feAds}w&Q;B-x z(ZX)mb!yw2NWsvPN$ZR4Gg|izB5%*Vc4+; zYPSQslDXI7=Lc^F{}MZ?=WMxE^fDi{7<7SJ^|rd0w($0zIX%!NP9O}rpNd{TTbccO za6#iX|5DZK{LaRs7YsMN&&I6xoC!VFPIS+v*;Nl53AN7V(sXA>Yc_0HVvm=dIodaF zs9C*9=Xuea_q+CDj`pc%qjc2v#KQWrmGJhSeQn7?Q?+>Q36ry!tL8yU5>-Abmbjr% zi<#JM_8{z4s4H#7N_UsG)48*^?VQczro{RBQ zCkGpZ*YEj$QU3Cypxv%32okitfEZ#s8G_^^6fd>4O1d&@SM6ahik3=aIm!L>=)uPB z%)$9yYqHjPv9R~pxYKN=Dx8Is+sCuL&KHwUyV~V&no|R28sB&?_Ub;0C*EEss*b$D z?fZHD<|~&4oLAaBLmehXs$Tn*o{49Ja4J~yD^EY|i0{WIpYB8EqC0K+Lw@K~nrC?R zuWF<+W1_BWrxKCqS!{4u^(qeep2M!^k|BB6_0U`!qt{2fn$y<`hU~qMaOl3THdsYLE&hq_m6H0&y()xpGHsJ>6@ z?QZKAr#kekJ}HBY_UBv@)BBTCoXHE_O6Qt^{u zqwc+Xe6nW?2l<5Pzrr~=G;T*K0Fq1WIzRL0^qxN7&>9{Qx7o^dW<#9|xV!OM?tiZs zNqb#%eE$-D0yO@hT`{?VUeq2!fc!o*;|vN9LDYTgFk=<(DxzRmAEsn=EZJ?eqdN#X z=snEbyE%!PI`RFy?-`KnbvT?!>*aJFfpb8O-|4?!-E&;mcCZ~294&Mw{Z^>L0R`PG zk-&vnpQzLPLgy4Y|JPmJs=xN)rz5Y{E7#t&dAS63=-+V+OFSA5v)GM`obaTln>`Kg zN->QiM)LlAojeYalAKRNGNYgl-vj$({@WZzk<(uM) zq{a^lzglK=*B5eXyI!LE_1gU5S3=1V_xX)(yUvs4Oq%kU=@ajhsfPldVZ__J_qx1J ztHL-?vmczriVl)bFsmrr>-#w@aYz68uT??g6FbQnSfQ;VTAd=K{v(pW@}plj$!g=u z(??!-?^TjZGZ-M{z_AEudG1u#)@;PZ*ObkMtFH=nB7*N&ttp!+?+9=U-@?UdAUa*2 z#^iUY8`{iK(gWwqGr6Zj9c5$OTGP#J9KvA%!PY*#`z9v~oVumzoA~j}L%n?pL>f=H z|Lf-oJRE!_;<)ZEXKkx8zwSLF)#b@q<1rb`*`<3}lD8g~@N?9PZ}*i;p4b8#QVKO} z)W39nmxxVgr+sW}yz6Wxw2ec|oG?e1L{Eu};u@qh&`^ZQiz;Uo7s1`yf3@Qdj9H29 z2m#{ahcb&_9xg)90uV3q%%=Vv&QXbbO}uz?uw`0~odLR)-t|0_HB;tDT-y7a%*VQ- zmx$JcWpHD?``1F1%5EY@4jkvndKWK5gU@1zvnZ=1JN#X@H>Zq}@8_`ug^lw+l~$+c?2uNF=Q}+-sX?k> zH>fMwPVJS#kKHO7PZMDcUD~8+Yhe9aOB0mZr_sOKw;BIE`u+lid9 zZ!@6e(y=*ubENC}_sgp;-3ae@YSL_{Vf2NIwc=+t?ARm?pXd`f>v!jvwY1*17QHpO zqnkNtv)6Gp{!-*tj6L-mpC%IzUdENt=TE#gVkRs0EyPh^sUkbg_LJw6tWoC16FQ#O zx-Rwi8XzQ;MsW)Hv#M$BzsDZ1EAP{|MQ8N8cGu9ePxdoXRQAr^w_Bl_=lfrj>1!5( zAYRngp0;yZkARmzm0rvByi7P}e5Y)@>M)*_usyoIuYNWIMF?Be37{!)-!R^6y~)TC@x+i z*R_Kk)=W8ATE2=+@MF$q>joX#mUXaTNlr;p)D-*gQR!3f@#2H%e4WD<=cMDT-bq&@ zhts8pw|cIq!kdr6s}7=1><%E8 zqOCaTE|SKfGwOQjPJV$WPSpijX?P`CV4BG{;WX)H%-F9mj_OePJ}3+Ps-m#jRJ*7+ zYnBdVv=2K7>}I}?yl%g#S}@BPJvuxy`b^G-{~7ME<8o+It%m-j{fC)>tZWgt4M{n1 z{ex1;b=NUo&L6Ys5m`_`_*0)0)9W5)O0yj0-;V6f;!~IKC>?rV7*wjb5+Ht*95#6} z7_jcOTHB>vL3f$%yS}?9-RwHmhVf*pkBDL9h0EWj66%n&>z2CjoEs!@AFZ8j+?5pO zk@P&ywYjR+ZuGFzkA7$4=q!Jo-8pJ}f2d<{+?GAw*!p5Pk?Kf9_lP3T#)vGYTF=ko zk=FDSHQg_xhk05%8N#yc&VTTwFMJn@MmJ7(ob$c}HTiyy=d6&=RG!%H>+LF~nI(t* zOh~5Up!jjjSTgnPJC$o$nX0vc&AK$w;(IRZwIhl+bPQ*GGu6)L7Cp5x{FSY+I}eJ7 zwKO$_VPwPa^krQWVS(mq$74#ULstg=D(bC9t+(d3*L|YNGqtuC9m&Uk;ruKa#Z`%F;^8#*PAu(v-hqZti_H>_fQ z^rY*|!)9|+J51DL(2!{2sJW}wzLAP^_2@w77l|)%sJ4nFnlr)UB{J;o&$32# z5+e<|y$P>OIh)u2L5+o-=vX-pC?`N&gZhvV91=b19N8~8m$<${sfNnN0?OhEyZx8d@O)Ksc zvVf^d8~f+x-&k3(QK~(K7n>X2d+3SI^F=MbC}|6a<)cLI+y1Uy0k4uNwyKVLCOq?h zYP@8dJZchnC=@bmHQ_kY`EI=)XWe5K8dO=lixFGDvNpt^7K^{BKFN;)DD3l8v>)&0$)*eif%x zaS<2%RDGcuke^e`?;Y%hbx?`(--bDegc)Fp{I)igQgDVNU0SIoQ>+anu$iw zZYi0(&uz1cX~s*_*1n%bIoHm5^EWnDR>OSLT8yOgKC9muxaH*JWWEn&{-45HUa}B@ zjR}4szVl|$Fu)Up{VrQGb@_XK;l97MfJbNNSCyK9WQ-AoZf45x=V6ngn9-YCv-JWa zc@@*6_~`})zw8ePy%&Xs?%+u(Q>sWf`sMaj%+_e$892)?ZJjN;Iay+X$__o={Txi{ zw#2RFS)0%@)QuiAB^(J$K2U%jZ0&(HoZ`?ow4Ucnl1Wjm-zN{d)6?Z}=$N4=iQ&fy#FKn2_@YjaCm|1%MaaUbTT z?83aCkm-kD%?GdKpa@xWPwzK+=y7mtZT@rlR_O0WXYu{9nJ!NCp-|_a6ztDyA~Li` zA*K9V_-n)4apSbrqD-aB?_QV4@juoO_w z=y8^?n=ug3iaw~MYRdT*`WnE3aR64CS*Cr%jCH=zvD1>~XYT4hK)5|g6fEs_ zo=+lqMD1crNseaw_}pvrPjG+`HRDV^=W)@K+<$#zk0TW%u52%RUhAaj&X{3-?GxM= z-xW8;2AEC0&Xu~4Ds{E{E_m6jXCBfLUB51kA#8ZKbjgBqz4tDsLDz#o(_hEjA!}uzCh2moHMM6- zE>og(^1(U5`Qbt3yf@yZHq@$;>TBf~UDxqBB)MXFjqOAkp~)Fk7S@LRs&_N9?$51^ zMTwS&#cLVdb-j_cdfjB<1yc1=JjsR0_H+R4#MchOYu9AtyEJ{W~hUqPh0oe`3 z9ewzJ>FL;89EiFKFs(hg;SPa^l@&5IehfTD3mD49>o4I-VVi&W07~5P68&6ec6|hVb zl)dER^KV+Hnxzcz5Wv(ddLs(>0WJ(vEt0_9e@#ThWA3M=1fRW6Wuy!A4Z086#Vewc z?=MxbdQTKy6!3u<_k=w67{FR-o&&>RVtMGy)%KK7QZdqGFAT+n&{deI~4lp6LAq28vFSCYT{r+tDgfJhrr za08}S21K+5=m5M*$m|vQv~`{cyd|%=KJ6a+5}(&J)wU`N1k79iK>FK*wK)#o3|{dg}y>w9Zk_80nF zBRq(@-_0|q;GX5?=s4a0;|GM4O?C4C;8|H&0eGk=P1v83y67nfA%LL)$3ldLyn+nj zV*rRcJ?%vXw=4FV0E#mY7vjw6k#=xZCqmRI%x#TH-2UV{A#KfR7RU3|mji3c1!k;p zLqL>!eD|&cd%^v_{(g965`chZ81MbNL1WhHqpL%Y-LeAjX=aSxh2A$z_V02lD0_A0 zP!@{m=3pVzo_GN$!i3p<>2;vN&~PU<`uh|*=!6)B|gsGg>Emuuyv zq|otQzJzFwq4ypoyn8qC*SBa>?sdDiZ`9Inyat=)KRs0lWggW{apL?48KH2$92r#lMH2ueDTkCu3`q(3VuaF^iAhW zWVm#`UmheHXhaU(O@HC)Hq<7}mk?^K7>IyWYjgI)y({%v3Te27&1)vHZxaV})3ai@ z6ocfi6z^PmeE#DA6`c3qcUG;Y+Z&3c+S945e_Zi`f_j(W4Q0?dSaJa9|F=W#YrSy1 z1Ox>B4OjuVP6LyWy>v2*HWdz7w)1Ohl2ZQzCPNCrJN748%7Fa5PDEt*QxH){ zN%sJ-92H(vDa^>X^JR&ovdlqwlh4am8Fx)4 zZus0X;XSsProNj98@6qyb!i5YcV$LAxBZX`ii!q>YNYs0 zcHT(Uenm!tQP+D(cbW zf){+MM5Xj|XI2NqQy8AOmz(;^^Gy%Uu$s)kpK8)ssTRvwf0x-V6%-vG9}f(?E*pij z&yIor$Y2om>nkgx)$V0dzCKupsjt(0cm>_F^b#c*bWIt^tYMS`b6luVIiKbst!)`g zT&k%w!<$)_!so2q%mPk7)*~o_Y?)bCgNkf~D5S5xx34#1hz&I<<_>MM31Ydy{6#cyvJ3F({tn- z>a7aD1zXGYe0F5*-l=m?)5o@N`BfEvQj6^PI52af5X4A-BfVSE?Xq!+l91=Qz$N*i z?}}zXZ~*c(AdM+QVC7+GlVJjHG6e1d0o4f%ZdovcTYul^ug3hv?GP*rj*NSb&h{_G7UGKf(uBfSu84G_+k5#A6s+Fo=PV1Acyf z-sF;nk8Hq9xfDY~vfBH4J)y)5GXSeoUAqbpzuu)^2DUo<&z5#AuF2dC{1p!CY(2@* zYrdmMf?(4t(Et$3QOcJix3$Y`l5AuUerO-r{j%g=aai=ajIgl;UyQKC0(!ZC574qh ziRmL-ermjRbS!zEroa+~Bri|L#=2BCdMD)hTmJaoC3s6WQWbRk%mk^)D)5J{0Kj)_ zOly6t!CUqF>zuaMR=~(>)ALt0Uravz|cc9FL|BA&dCWnG!)O2aDjL@x(1{{n2N&t z`&be_YcodPC&2^fhII?p(C}hrOHe`qwmYXEh+4pxQ`zsj^;(enb(XSUtng)0!f+{N zC8geBcn7=2o*N(2J4dv$2@qE}S)T^mBYX@onAvYW1#GacM|g{A-OLgSfcLj5vnbIh z(dfXCQW|O*B3u5!=yMdappS>Yb__1DwaAh&vOa;~@dRapuz&!0Ajpi!Ge+uDJWp4Q zm0^TE>Ngh{-(eud*B5g1A=Klew2#!9mc{)c@DEGRFCqf`JAo$h5Cj6-AhJ3N2f-|D zZ*TAMz3reYs>KM-U}`Edf6%(3J$=!*SUn64#P0?oQy_~VRexT|QkKSj!9co ze-%J_!2YDaA=V!9jDFZMIu)ARfV0)&hyjCv*Qg%^4FY64xCuCNfBb+n*Wcd{Y)hc- z0EdbMQ(FVt9GE0)P7p?5?u@9*c-IW<2MVwcVqAE|?xsB%fN>J#RJFC=a#0-WS>?2t z6jPUtJlHUcn>cJMgm*VH$r!4arltb<{@A}9AvoyySHb-v;vd8%ZE@5OiQY zuC!k?b6soXIt@dez!JeW8-%R!t>57u`>ADxIcnr7;lC= zH!M`+qnz8(0unrzYVK=t-LI981*w5t?8jwBS4XB_JnSI`p#Mq0kOuAj!t!g>v_pt(keK(bJ2TQKgZz*82@?ZAEM^ai6n_4>oJ(F3iPh3KGV2!0&)B4{mZ0(gs$VbovNs2oJ=aqVd0HKZ_@|y_w_(E0>YTUFPHPT=V)O4hdhT1)JoRFGG5#E1}@k$`spwqm+-Mf zEE@bQGTNN`Fwe1{56>(ZoyE3fX2lWyn^~! zJ6AKaB_K0389dlzRsDtwDL_uY5Fa0~qwq^FZUL|7F;Fc(zu9t02yyM^sA=ak`J$$QF7u{g8C7m9pGwdtWzS>_&`-@W!?SgLHTI zrwk)7M!DlVd_V7s01Jt>yL~bgJ%bu0;O7?KoC{-sZuh>>T&-djtWh31j!yUR$=oR` zH&BFUwoLh2nNS`dupwRzt{h1@TQH)60sLsm9}M$vs{E>|1ZyE(B_&ApTZXKYN$^}Gzy8V*SR?E)I#F*q9o z&D8oi9pvtspz;HZUO?{vx66gF!7WmX0SG=04t-W-1Y#msh;MZmZjV}|gAlOUfi(#+ zCb$W@e{*&qK@(C%As#b3&+#|3$-v`NTRfludz=K1g#dvId^@c@K`&ooo9hD6VFw|8v=l?|OE`3kWtCgN zh=9crR_c0XcZBmLl^L#9%RqSb>H1vYtK1xLJ-~STqk^zh0A}CJ*0pQb0Dc6AfwUHQ zhL|060XmW|W;ecJo_GR*9%{lM>t)sF;S(Qhdo+r|F+N{(iSPJ58Qo$OpHAgij~~zor*V-5 zQJS~Byj)sZ8XJ2X0vra22^QZtO+iJ)`rtu*%r^vr6>}hLEP<#CVED<6E|X#pPHm{P z^1^SUZU0FEwL=4=qXR4x`-PROD+-zNIKtfnGzvC1H$l<>eyPL)$Xz5A^vKr&=P}8r z?BwU28(7pK&y})B>5TOB?g~)R(D~|rZQ`wEf5bE~@ae9qX;wY0rdUe{J7>5Q&`RLQ zX9@yh{8Usii!>QIc$qfM5C-c$aA@ES@s;C1_^~*Dd5J3P=T8SvwXm}z(RRLsc#R3* zdMZ6jKS2(_t-9M(IYk~!0a%A=I&R(`f}z3B(>x;DGApRj+}D5;2#!%*{dUAyl~iUg z&`)W?fIJS3<+l}dQV=Ds70+tfz$9Qs$8|2s-~Vc&T-n|H*`3K-89w)X|L|4cT{EWe zzYxD*J-=EkH7&xf4t7@Tfz>(LIo>?30}zKK{8uURn=d$$Cm`jYrKEyPRDm@8bq=IN zdM^R;4{;Za92k61y){EntsL(p8fQ-s0F0;~K;fYW01GV(R90EpZa&DpKpA95OhTA; zzLPcXq&zfFp7=}Mu)PJ!Q=6N?o}9N{V~ zc9swpCRPk{g`(4tqkHccfc=un42PsJ2UQo7Od6W8bR?elN%!kaIpiZb_VpoJ_dTrI zII9G6J99sGeFGqOUU(rgMU5*cwpPKTE2x8m`Z{RUeG0rv9IeGsrjZNZP8N*4@IuWR zA}P4El|9JAFu~&SI}D+{fG^tkjfn|Rz<_TCIXOy;Kb}1-773aT@Ej1U@WHGK*oETbxgIs#1NY2i^1E@ zlxvB#q4TNHpktC|MNi&6Z{9Wzq7kPA4CG`xDE8zBJKbyVxtq`xALLEB!YLoW`|rR1 zhJXg%wea-9Ld_b2l6eWJ^xVTZq3dF^Ac68lE)$r9KqO;~1g{QMyDrr@xFXUT)B}Bq z!BcmeLOvzVL$1GG0W>Qh$AR1kkbV<89nG^81R=I97mv?8R_L>3Xh5I?Fzm?p(ZL8m zP)venf>aWy>SY`S6TqkfD&^|x4-9)8dP7LxE<*(3f-DT$N9bxD&PFb9need)yMR=N zqYKUfsRSra<-P`ja(3@hv_&-j(L(`&1*ggn_20TpF|-qUtvyy_; z^McoBKy~4ngao!Y(YtXg=tD8vo%*H&rV<(*h-gffDMN-W2h2+-L#}qv3n=o$Qs2J4&g zSr4M5RdjW&`QyVj?n#4+z!fZLA3@tIvW4p!$XNjA`5zfpVyv%3&$xK_e+0z9XP~uE zhMl<+EuEgF95f^7vFuMzd_7=CEbKnwhlH!^(d_K^$&JbP7Yz+pc_~AHO=o9U^iMef zfxy2GgvFr>FoDIz{{~m0+U9@}jNWPirpeV0^^hbA3sZ%mZ~KF&CxD_ed-c`c`3Q!B zn}N!Y8vQ6yE}*gSVX>o^uOUzDmlh-Fa}~T!k#Amdz}Ln`oW_H=280aED(hb!TH6QZ zgqXIHhm(Dm5I=x>g|L(WX#pc6BLf3C4M3dNWQ#UD-htk&SP!8elC6z}6hE@%```+< zSQ#;7;lMzJ3<@NBGJ8=`Z;t=o(>AJX346AEc6ohTG;;J!opCYtX#A`{VTr z$QbSJ?iSWqLvi7zd2o{xVW|!x5ODLppP?brFA(@LT@fm_jS8@CNE|@u*D0t zyA9I?qifgwkN`Ds+ct)SX{J#{rP6HAle|<<=p_r%}1=-G!=e%NKp_b$W@z3bF zDMNJf$uXV`3ye#T0M8EzTby4MhhWC(&3a;s8_)<=mzZ`5Umg;>@OzSfx5_bg4ra_BpIcmf^A$hB z2OBc(y6DdxCISBb;BBs5g~$8=j>~l#=q?~S10Na2G-Vb@?m=q|zU&($=luM?%LYv? zE&1X*kgCdRVCKKqkT>A_FuYV2gdQIJ2@-4~Nx)=Cv3N)ShKmB^@g_I&|NHOXiN$&k zXD3J(82xK&AW8xVMyEmGE^0abc8SBZ$`$on*MOF`)5{$VT( z6~14}?2Qc%=e7uNKuqBSEjg#3Kc28e`=da*;scCeg0MLdRc~%;@*uuvhKGkkyQ)yF z%AhGIaE}b+j366=Wv8J5izf+W06kx*zEk9?@<2})TRD9AESVi54o*A zg@@@SV6xij_i#Lp=ru2aDCSkG%SLAZe@`{KcJ;%%6)0j`uu8NMQcoeL{eRec?|7=; z@PAwyW=JQLT|{M-nOPzvJIUT7GkZI>$QDP$2_eZWdlfRWLiWx|_MXT2T}SWF_w)FE zAHUZh?|OLWHShbnuKT*5!&(5=8c^|d^K}$|YMX_nJPgq^W!anYbF;IMJR!2@$JM_* zgMSKSL~vRTn!rec)Hx8U8VoJTK=>bDB7za$iWw;$wb0{K|na5#a zr?1Zl+Y)$>@7Yk}^$@oe1FZ))`AmD?D$awX*_bVPkR)+XdSM|Cs9U(MXTvHGm>-}- zg6`tx=0+Rd5KW}Ctcw2I)ZBb6=H!DpbW7(ej|828M2+uf;N*mWhw)|q<#LM2yO3j~ zr{~Uz$Ok3inNr)azq^MSpPgX9OPQaOCE{oUg`v+wbfHqvRE6oS(5n;jNDSZ4w|N?R zOOn7y2TdN*h8B}M`HrU^-=ZNUJAWQD4J&jyr`Mr#agXV%;0xaw;9!IJ4Ya#LZd2F+ zgAicC@80?1-mBax+ymr>)*xb4&M(1p|vx* zC%vV^u7Ci`-@jLAX?rdBpt+Iw$(3Ts#Zz9ML|O$QT?AFx(s5J|U&NKmET2QyTZ=!9 zEJu<}b843op20uq;r#TZW_k{dY1oj0;m2-Yycz-Su+50#i4{k19~56 z%Hffb=`dgKDZ@VI>x-dMpmqWEYQxmz<~{^mxD0@^ii;h3O!5_y1ujTJ72j*o)`3Idfuw$e0j$4%>ZT}L`&#aswus~^S!K$C^2jZ2E@y& zMW$EMLUg4g%b<$_npZdDK>`SR#29`k+i*Jv=^sED&-l8=9au+v9Jl8k)~|Bmto;=|1M*1_3D|7jvs=#oh*!;d9Vd&o zPJuCXm~M*DAqZtX;ggnoY=cTsyEB!nIcbB}{wzv9fde!>r-X50R%v1N* z=y1XKa#SJaDi9-?X>Uv>1_{!bLY+x5IjhOx<{+nL=H+3h2A)qS1x0D`T3EG zq;Sq>ip)gYySt2od!WDaV|D{}IKsn86;(OUK^IR@5X9LG((gS~K|K8s@S2J06zT7dKH%z7;RQiuvnT--aoQSKmSEDz{J3 z^#Nl84}@yaum{2YZ+8t>KxPL-7RW|BdBR~`Y$!Mm&jy|I-3kBDJb~_I#v?Xw_9|f1hTLBG)Z{MKjc!lr`)NI`r?VX*e z`WrD~8c2EiIi` zNvi=Xt&Hx$Wfw`p@%?)r6F)4gB0x4UGHM-9H4@i8NU^9OS%)2(QCq=*8+dp^!Ei;E z*8_{oi;KYBzZwWDIu6ZZlUhe%h=?Ft1dT5*{CY{~?=&?v!FK5L2v12_C&;+aE`es& z^|&;XIJ}^spl+l+Jjh21;-K!5U#}mriZ`8>m41|2Tu>0Th=@L(aoBHZA^hJfLdEh2 zu1HT0ZDLS()yhlgLhqI_C741(;$cSUqOK1I?fUK77c7m1kB>TI^M#YEYV=m6s!Woy zzN^NtJh++=CQTXh?B+1mnUO?MZ!A$}eecV?`Z(n$ck+{8#~KGHA#Mh>O{KGZx)xo( ziZl`tfb|!2tt`+h%F*>r6p5xF_N41H~WbLiBq0nPGuW<1mBobI+@Y14J1|;iopi{3z!hGXrR!>)An) zw0`jLwzXTMo$HwpF=j#eEE@y~uc4eTG077?&MXV&wC{-T*@Q#{EpEQy7bRcXDTbsG z#xqCf1P*B$osar`ETjH0Dngd3jYK)XT7OGg_Iay-fZ6xRszGrQk)K@$)jH;KteWYh z&jT;4jKvG1(;FGlO0yOV)si=5kqc;44xt` zP&ZDpk;p$&vKYPSuMWhj(!?bFLq+iq90 z9=fzV>_*Vabr&_fiS-RxBy44)Gb1>c=yQuT=BIkeYXQ{aJ-ps@_M6wPHB5h#FnP%h zyHF|!s7DH0GFwH&@MLd7Ix8rEcHRYO((B&8|LyoyDkC50_c>I6{tC6v2Ta6S8P8GO zDOvVQ^Tt`X1r8(<2CKarj=xE2%4I31Op?;jw%)jI3}q@!MAKl%t1zCJoqpMY+CMXo z5H8GSg8+`$-hV@{{lWUYZp~ZCyQgF0pWKwTq5d6_^*ly)X8U(14c@a~xX||u20Oel z$N|tbG~k(;o7-@!enwwiSEqk79=3KA_y1%mBtu=`#r9iMOiX~W|3KD~!|*|j0oa$Z zwGNmgt}j)?-9+UU-F{`@J9Nyyc;y;La7XN1D?^8=%QJvj~sVy z2FZDy>{E#x&1a4};GZAWo6=-UXEYIPBKWZ(23XjV2M4i5Q*5O9{59r8(CaBw6 zQ!u)qBZGFjQdz*mj5iwdA-1knypu1b`DE$LzjiAO%g@UH_Mi%nc=9^2=r##DYN+^4 zV1PwE9#K7|^VcFL%vDDF)(w&>mSAUjRMwPgEt0B$4l;EQyUZlgqdR&@nf{F{Jk45x=Oqif-RB z>r(8WHPWP7iZANOsd!lKsBf{{LVBq?6J3F9IW^JSuY}PiKC`tVVOdp4c2LG+;Fm zmX7a-H*g;^O~blF4_@@q)fidWdF;>AhDWxwT}k4%f(-~t%|X_{@-bToNIGkIS){b3 z`v=bu2C9tmFFOXB3#XpZQy5>fX}7nArFdK`BAIt*w`kfnoL=@^OzB{_rEenSoo@!w zFkR+g-<0qSMCh+Z!R}RfJe&!pP}dJxlZ7V`aBK1 zLO0y!Q+t`806HqC{d^U(d1**>)SWW`?C=<0$iIR8>-!7+7w96@F=WQqYTCsG0M*fL z5&kU)->3iX!)K%nvQ#nOPE~#gTtwgnE)5X!f7|u^X4Ejh*)Wwj)^-*z+5s1LT4B8f zI*1di0}D=&;#=1i-PjRH&g1!GwouvgzK~pl1@K3C3}^_aQOj@ZCSEz@;O{>_W(C2?!us$6uGEA1`^t^W|`5nfx9F+ zWTUobnpkyPHfPHO}f_d zA;JQw#x*F7uW^1iv2O2Nl`*7_C8llkmyG6M4})215lFn=G`|TA<&*LuV3_Nx(Y%u| zXqUo(R8&+1*oRbXI7wlpkX8 zt>dUy-Sxe&y`J2^D2C^TAWWk>kFU5|x_DIo2&egEOhojZ#c1YqJ5INf=Q?xe&$v_n zUK15}!GM)OGKgP4$^?lURBLS6jFid~mOJv>He`9c<^^@u80$llD7(?4DUHDBgOau( z!bOH%lX(+*`}*PDPH}0L)EsTPi)N{Z^TFKX6V>LPy#gcDYAcT8MAUggUslS>bj7V= zD-1MuI_4+#m&Ur}Q3;7IWmG6?U5{SrwrO3O9<4YwM}^=OiD$hACZ`X|AGOMb2)M zyDsagJoOk;^6~1wU^Q*ObKKo6QMb3z=}mw4&5xM%_1R2TiU=-nfPkH-sRoGRlUlL2TE3qVsF)<~T{9__e>6CLvT zY^&s2YH*8GuMJlFk0NW1U2&bAp`&jayAvBfd6CHDV{@#kEl2W7g{b)IJT+!3Cj=eJ z(_0(T+VcVNhF5_r6{V5tf#DV$-#yA!Qh$Pq8kSMY7xT9G>a(hbOm&#QzZm@#eKA+9 z>s@*Miw=5?+O3&f$DzB1IaFLhO%F9dHFfrQ*#>29W(r8Yv7u^nt6rxd-SCKV;l-CF zZ2jC_!i#ScQpc?rksD|Yy(?or*18Is`T0u&C{agD-=%%~oQl_n->?u+AB@_KneB^(xdc#F6PgQ z2qCj=9afNB%%jDwV8U%PLPG0v5=C);`PTOdee{0sXL+Z}-IeMHiaSDJZd*gn;4&7m zI^lkJq3>bax7@Ce$ze10kpm49yRSA2&X?dfN43M?t|8iy045(s4Ak z=DvA7UmH8~!Rn|dPRV+86}#)nc=Wqqx2mR=L{TWRYkF+0x0l;}ugKE}lWUZcu$YLq z2`dy9VAPVVj-SJeuB56g6~cR;@Iq*`udl>rq!fez0j~fXwMs`H5WF*Y%U5Q3;;pTa+;h5X-0`??zUk)QD()H? z!q$GX3zEOCln85=Y=5>W9ub+)*{tWiH`>-E zzCF(-gC#i#XvX~cbHlZ1P!=x;z)g3nf9y3LGTI*fZVO#@*VGK8c;H3s@|a~Kmw-V_ zH5xmwpVF4`T=J!FSJm|BXYw2l39Mg;Ip=U#kiT{29fogr8jU1hDz9~H;lFw2HBitQ zTDT-JemwEs+pXHpN1@NmOx$g~;DO;>t%e>+pd{PG0XA4SpL?aMD*ubna8XFs2YtF4 z+i6DIt%Gcg`Cw14=P`yHyBtdrbo4%X$lx;F6_?7?+T*|SNVlESz(wX#q^#`GMr91%raJm{3DQbQ^B>TFx_(_FBH$OAlq0S}!+3p3w52ON5&LM%_plkWC;_>2?<0>V9FnFyQ)_h@N6wqp&32@B1*<)ye?73{g`zC9mMif zqu6<*Yl>pL`@%KspVIRW%Lw;GC1u|}icmuC$$ic=SKT}nmd^?WGG;;U}c~pmPC408%I9B`@P3JTCS}Ce<$$eMCX`DQ= zHMY(8wQ$10!-p$1Ye%7V3>q5AdCFVlQID;2ZV0@d`|GpY*sJsY^fQW44ss$M)QSxh z=Nt=W00n)w<-)>~>N~%qAslF3t zKairJdAGh!V9QxsL`!(~(SC`mo_Z-@1m^PvHcunHELIiOhI(SHR?3SlgKpPLiTfOW z?qKxkvs=)|_8SLAr*@8qth%);>+xC8(|sY+Meg#?HuZE(j8yM86bK;q`W(?PNEcUz zcJ|30xObx&DxYHml*(5+CtS*s8OvwW!af!Y>buROG~RkoZBx^gk7#q(j`W!&+%Q4b z9*;|mx;8jXdFx@bSFML3vz3aEaC2eyYXrp-<4}&x8A#G|{^VoFf5ua?(tG?zj*pvT zADwP1RuD;&@LB9t8b7wiBu9;TH`I8R@?T1z((yjLbc-xcgy*ZDhL(!DK=YH^9^1cf z5j8g*mwFZRvni?R7z(YWeHRsgR{NN({^b2RR*gK5soeoa*Isnz@ggR91+(eLs#`XJ zU0bws9zM65#QEm(bshbR(?#HeMv@u}Vm|3=V za=8k2Lw6-A*F&?@ktu_9nc2IQ+t{K0aXsB9POCw6TIwp|y1)K(4&);pOx-nk=zP{n z1Z4!oZ=o9w-g0{%vog;Rv{{)CntL9KOSVj@%TElI#!)yV+HW{Zrxfk{yirzH<9wLk znIFPkV__uELsvVWsc{%AQ+z4R5S1&Hjah9*uedLzb#!D2){gJYCFG$eTzBv8iW-!j zUv`^0mFA0_+!k<2w)6U(6XhzH>d^9oEx%$T6{R<}w?8N1v;WF5>aJxlcZ?v#-aysr zYRMLRW)EkcjfA+<_O^tWcb@&i`>)?#?ETD~sA`(l;HW#$$JVZdGse&SH9PjeXSu`> z6_QTdNb3Qdk*gt4RX^`saDu+`m$EW*Q&V~f0p|jkXNjup57WrEe7E2if9+u8Ekv?JW2+r_D! zdPy<`;tsPSw8w(NOD|U(w}%9mVEF$|khk^To7U&h7w8BVN~OcoyGp@}o94%IvYq!~N}&x~qXEvmY`{ zix=u&HP-+2m?kLj{xxRX8EqR!Oh~_QEQ-RRTdrB@%L{ec%z?K)!+!L-*u!=6fzOaPfNw@q;?tdj~6 zv&3PW_j&ph*SDTK`rJaRzxr~${3f0B!|w5vmy}@g@y3sfSI?6NAOu>2(-g);L|So^>%75$48sDf--V5oo*Xfxl4Ry@=#cDaGp9QYc@V z^UG&CH+}4}((@BFQ?sSwR*8mzUdIQ!<7K2nXw2T{WTa2O{jI-eyvAP-XscPf%_dB6 z-)NbzDm8i8xa^H#9Ch~mQYbQpVsGb>sMzH8tgIZs?racn)lLqu(YbE+cGbcRdjCbg z*{3L z5fsG$F&;;5K2Va_SYpJw#EEWt?&6~zhq`VgT@U;zs+FU<<+QDeh>t_X<+ZIWEY+-4 zZW1w9dgW$22!aclh0$k$!}eSq4-KUOc(d)WKg%R=zMp8szz$(LFgdX8Jn zfzfZP-->_UuFmab4t(+?K8N43H$TB*@>-;RZm*SRr3d$6!*~2NUy3`zOKy`1A?U;A zSAr62RdVK{YmesRE$7_r^nONL4VyK{VPUo{O3RE8g$cKsA|OgKA%7UvK$5LmaF zKhj~LppZODn=FZva9_PufOZ}2?v*Zyx+~K>7FE69c_}-^;qWe&jfyzyP&oY1YjxSW zd^LU`(93T@A1P>&Z6Q3`Ex{zdoNbiGB$IRWEo`<JKf_Dv07jt7&E-PYxrQHz`DQHr~kD~qdGi-FWRq&TJ6Dol*vu4#G| zn^9yLPs7nvj`^|uY-Y%lr%QEWGMOxa*0us;ZgZC%>t5h>ru{ib zlAHOyr_g@Wv3Hr{s5IUFmz)f41Rg$435=GLPT=i4EE<{hnOcvSR&-^jF{+<%${0Zk zhNaIu8v5Yv^y4$%vPJCywcx1J>b6X(TO+GP?Z!~E9tH7P)Ywt-8*Y=}wK&R0?$vSuyrrb$lUzepy-M-4h$ zXN<3%Vh__oZeQ}`6r&bhTkEWo;3@K!@oa`AXj3zT@Y)S|5|YS|IeOS}g1Wo=XWD*J zTr`w??ADOgL7n1sXbWcB8vfiAexEQ)ti*+Zz7)mNc*G;^jBSlgb7~R|d zsdi_bExEFTR|<1DTerUrGIV9ft@GkzTWhS;H?pvNT-rI++td==Ke~0cer605AT6gm z1bYZxr`_7v?!bDP^fdkO!enLD*m(D!&Zg=5I!Du+qka+TjhyF_l+_$}RhZvpoa$C; z`L$tJE5)nB&1_=oK6G9}40J?m4*r-ofma7n%tKTKwQeAa8+y;&hu4LS0e zn?X}|yUmzQu%)xT<)vPW^#G7X!1Ij+vgi9`*vo=N3uw3pd@FRA{lUk+^za6PIJ@_5 z1DQ*eSpH(3%|taX9Wmo(gEOu$v??LptDex_XRCi~-)8tUGKnI++mvzdXFjKAr|{9+ z`dI&0cIEf(sB;Htig^r3q-1m+l-vrG{06CzDX{urLeR{+f3%@Xe(OqR@r_4!9V>c- zG9QJr(9vELcUzvmp`nsY+4Rt;g*6s+{33&!=4iGCnLPMs=dh#neiYUd)#~MWZPQdj zw4!LF8q!t`cil0Hq*Da*lOOAYeW0dfXBc^X+L!fv`pqqO!{CJxJF)x^ekwBT?Z2p~ zy97%Gc;hHyQJJaCf0g;|Le zX{O6(OF(}?fpe3%D`NrE9PVra#XFxsw(vqbw?d$)2!Zw4AJg@~Bx zF{gV|79%*dze|3jpHKCke9--uSDxqgdE9HSB`DGL-MTFx0Ghd-fFZW98uRz}*R<_e+)eC#qWO(|DKzyXG%SemS6XF0~BS@G^Qh1FyYp@IxGh zDsph+G-J}#qv@2Jr(zwgrQF48p?>Gr{X9lQL%U9uclyqu^IILQXNAXQC_BsH!?6T^ zFMS@j)wTi!>*os#-b>4_8Ax&G?T<%GpF~n8CeQCh1f8Wudr3Z!nU4pJqJMRwVN`r+-$*e6y=9IrqTuPKVnfEyMM|x6kT~fX(B1$4fP91){_7}Qn9aWEaMct|QT`c3=mm97Q4jp<3g?Aq)Idy#(|H8KkYKvC7$Z*0gu#9 z?nf!BX1yrxN-1r2imQQAiG&@8`TnBo12)MnG(TSX*e`UEA6@wuUPVrdOcKmD{l=V%!ZN7!AI4n6UwE40`TWf^DXL|XMKC;|HT~lvGm%G-4{<2u5i>8&` z#LkX4t!*Xq0Xw?6>QCdeo#)DTT_iG^!okE@UAk6}E57|FYSMg>3<;|h2Jgib#=N^G z=}%jVm!R2K@}+Qc)Xr{Skc#Tdw&tpb{j_^C{pS4!F4VvS!u@xKyY_8X8C{p@U2|ve zB$#4%4z!y&3osz6M9ACjq{8Td$s<`29sqz^is&sY|pVp)De4Uq4AJSahU@{x*@|gh!KM z$Z%7W%a_%Wy%1U=X2#`VN0^N%MJ@_oEa^fEZJy?;CfU37368miq;N^L7&c}0*8Ike z*FvFn+p1-Od|tfwi6eG(n0DSS@U;6a4BL#bBLdRj!^1$lGd0Zw#57@+Zq@b7Za%9K(gHz;edGXYAg+-z_?%3f+5nPAy*%NC#WsQs`LOSBHq<=C9Lb8#cH(4&wx zm9F$!_S5hkA?It=Lk>ML+g1;Vj#sYj(B0W+e=|Rgb^UdmbIP zF?xFGBeB|LW1m!RW>nFus*GC*)E&$wK$=6PI`l+(r^r0jm^C+7pIgigBTixH+C+OF zOFOm^oUf918V=#Ah?eQ)m8x0DG1oiZxP=-x{EO0l;xIH_S0njmy#{5Vt$nDk@8PUr zj_RET2IX-3;|SFpm7AOVL$neTM}JZJZLG0`wEMlhU90@NLN(*}*k1$G6qPxSWzr*ECTq-K5lspQMv#Xi%IPL_R6xZBmoZq(NGp-?Ff zEsrEyG_v~tbuvDxoA#sP755PpQVw$$LbjvASN<*?xG7~QW_rvNPkb;bh82lY&30#` zpWm(vpA^;;IiF8|D17X=tbQ>iMjz|Z<|%UJ*#0}~&HbgC*ahO(zG@Bf+%-~!cQ@O4 zE66BiT&hwiVg)$sneMvR=mEr#ho+niP>1I^*ok=T5Yje-g;SqCcftgP-DW^rk~Ywg z1_J{42I`R#8z5h(UdX^9s1d-5!YclM=c4?A?xQh zR%JUAu2TiLR|bb1u9QLmR1(ZFBI!k7n-d%=Vp-*3PkSJZQVP&mh_F8$-d`(1%?fk~ z{NBe=8aLRM*$saQT|^K$%s!W>UajAJ9wxqAT2(t}m4qQ$kWGHG-_s$eS9dHIHG!PW z=svDXv(s3Uzu6ztT_sq3bgWy(Ib11J^Zb&ElxCAUvYRkhgYJMnDU`HR$1 zV7>-CBp!mz9nag3Z4^nNpSrdjHEh!m7+sZrXf?faovfj8#`OE(%lIu?TF1KzS38Rh z>M-j$S@J&);=IfxWJa5!_R2wiU%GRi& zW3t9##Cby}%WlYC!57Ewsa24ja`gA9!n^GU|0!%yDEcIT$8rg0jtYiuK)Js4^b;6j z>9GBdy~ot@;|KU}2)!K6kEZ&5jq-)O)GKNqitvape4B#+#w^O=m(2`R4g^$btADJ? z3wqrB<53bowG}%I_&%^c0rNm`3RD@40M8|`CSBZC9Ik!doApL}JGyZuD=b$O z)&r|)UYp*2f{dZ~A1r`CkJ2ZY2kfTTL!~HRT=l)1cH^encV|M}1!U=9Coc9069v$S z0jUR=qrQ*oxXlB$M^u21=b+jJz+$5#Z_v%KcNYwk-Vw&%2-hS!ZG0`I(Z#ymfy%dXg?z~URtrrKz0 zd%fwQaOm=2;w2mQ``YJZi4h9amo730x8v@Y<0>E%SYE;I73^F6{CTf;>qq=8uweuz z+T?REd2!+a@uu^F-LY4n+<$2QR`tIBB{M{G;Vbzds8zBcNla$EO_{|46!-}D=yff{vJ z8pv^Xe?b!No)#PMd$^5>wXOQD=yh*>A;= z{N7tVYkbZ5yQg(~m;hHsv7@qnKw!E>{d{lk0OhI5+qnDYc!>LgSK5lZ7b?Nx60mdd zLYRRg0HFWg1<{xDX0J-VZxDkGn;fsSGD7-N+pXg7!)|CI<7<6%?YPzeYaZ! zKM(wA7^w_|5ejmw)eTYU?=S1foJ>U9$#XA!1EEd>{sco*_PclQK71g|72pK^A^0o- zq`WPG6QEEa8o@%@fmyIrDSgTI_eBZMg%hiZ6UuT;&~|7sXFos4^<;30p2W))l8*{y;n-1DUT zf&xJrQud`LDMQ04po;@_1Gw`QI-A}e=k)b5wPHB?RReL)x-X@VvMwrpRC3iYXpB8P zf~9#1rhu;2H*HTukeLVt8$#iXWTn|z@;u;*;^9$=wU3;YJp5KK03}~*KS#3878Px$h4T=yp)J&ZKfLd7rr(bYF z1QirL`qKuHfKE7U%TA@CezL=ZCHZQm8O+i{I|mr;LoyR5`#;t@WjMEDSjP$@sPNT{)rf ztK9A6(ia%ev9dSf!+I=o=s45XZBC|bt=}-$Jvty>LT3VqZzipjc>*gW_c*mqCwn%@nRq6^$>FClAoM^}3n0cEQQ^U&zPK(=ZQfF*D13XTKs9%yO&Cz$_=PW-h9W%geqBOnz5C}top`H&a@AfH?*?tLkde{AmtL ze7|?V^UcfS1lA0o7wHM8&H_TSuMafi_^)&no3^cWD}MZG!3SIB)BopgAoUh9fsR3L zuKWpkG9#aJskF~XW*W>I{PLe51A!@iGve=1L zJ1Z-oW<$^fd>BI7KEj8$yC(@hi|!) zH7mRuBHW3B!CJM#F_5$Aqf0x;LSgM8eDZ8*LjVV7>LUAh1G ze;8r_Yy~`=A|=7Ub4*e^V!+!3vs;&?K^1*{2?2qpDk^^IhIb$_kedLfVna7QcNrpu{0I4w*NXsd(14tOGe(yvQhl;R-)x|~UCY>nqGsFeU?(V0$G zjF5Abu@0O6-PRvJZnCrE z2-uIWKhQQwr2Y?IXhw6Ln;UqQFPo?B=}$VofL-;(y%lNj^92N-YR;$pe4x?kH2dw} z;NpVf9h4=%hh6d#ubuw3^#2ZFqnY=tuwJ?IW@okcq>%}5z%`#s23p??3QyeqJ^@Dx zM}l@$hBTD6=fFuN@}s$tuVxPA8Iqx(Jq zipAGmFp36mI&@bVE&x7lbEZoS0n*jwh^B?>zrnv5>Z0y$W*Ck))%`!;cYwqQuhF*b zR{Rfe0|WZT{|rK3cZl$lBES-Zu>$1}T(10@2nIn-O@QwQ+7R%s+dFh-s`c!Yl)7N& zPlu}@C+B_zOv zB_}04{q*eiVrO&$#2BD|4_Q-&ngoZA|2q+0D>*=je>({S%bk!JIJLm&f%h4}hw6U= zkusu5x5@=tm;HTx0JJ=FCV=GvaS-^Tg5=UYCUy{xT5#G!{5K_3uUJ+U4ubONtM9S# z@#-)g9!(g5SR~M)z@+!H=kChzuof`3ov*$WIpIQjdU&vh-Ju}`hv}^6`49dLXFLwT z)EBw|xfNKWAq^@zIy%bAUtt2!r71sCQ^TDmD+|ZR{k7Fg(^d?)9%}(!(l``KGg85e<2i)g7(95{Z-tp_w-2iI_c`BNTy8+ld*uj4M-h>R+=k>DKL#kN7)501e*?} zr7;5%hV5t~Eq0_M6m4HXgStb7&t!Ka|1u3l1BwmMct zox98m3HJXkEi%}{7L{?20SDc^5|W;a4LtBoflmSSpR;Gr!VHmm+1joUmJTvOU|B39 z6Vf~lL@Jpv9(Nwn-ie8c-d+&h{AK`ZG<*@AlK;+h0>XaYvh0%lI7^mARa^VjT=ENw zEsq*t^1pcu&;Rk`BN%j$5{)(c%|3&VaIhi31)*HW0khKno#ccBb+R=F9`HeuMNSK# zD$oM+Lmi65{Crzj`hdf4J|OdDS#;R6-v7U`I=$|{cz+Ku&ivrurPNhm!vP};M9{u` zL6r40;DdDTrCU#z#;VGIoC%I~A|jqx82~VgGIT+GP##uB^M92cr^WO9Xdv-J2kK!) z42~^~I|v}G$X*mj7l6b91tBPpDSZ5PijEKFFpMS8L>nEg#+si4li#v36i)pzwZ2|5 z-#Clq#Dvko!2zC|%nNi3oK6g*BOZRX9=g+>9GnQ$VrY{A2>s+B@gL@T9{_?D5Gz3H zO~+5|3e8L_v!CYvqhHQCxP!0uqs-p|%>Q29y+@FLRO6echpJq; z+lt}$*Kf_=Cx+JIm5A&4*#V=YOi%wiLpya+oMf1xW+^PKGc#G)*s@DYse*J93xO|L-Z?@K_N?^uDHfkSL7@Z@ zD)pP1sSg;VpyF|(&X-RC{%n-_?_NX6LT1Y}awCdpPcS z+^f@-JrA6AcqNcyM86{ZIJAfr%Ob}B_LgK5HWIycxv*hA>Iqc(0FwfiT+aDl>btkPMB z;9vR{a&tqI%5fry!Cp)#rIS@Y!JM4IGFLq0b+5=OL zwKHbzy*=r_QWG!wDh$4v*>$&_m9e&BYsmCET=Vewd4#k@`=12#84Zb;3AV@*MZ(rh z`Shu(Omd>wGTno2i)i_-lkXFp^Ts?%`^c2>tntA#iI5vGelogW{GU_}r)I%@(w-iW z?fjo{{XVZ~(juzr79CNCXFk^p=HbC_m*_@lhchqE&psltAb#av57IEuJBj(}V%M`CFLm z-}u23hVoC;c?{ zzhC5#1O%B}WvcTw+WoRMk zfaZUaOEO4Cu9Yp@_RbMlqMF~3z zC0Zyh-LQHt7T*qYco>~*U$+H&*R;NK?J7_l{A1|he(M>TjWl<#pIzteBVRioe?@;Bb)8>QbUmo`^r$osHVi&> zS^3P2s`6dYrzX@-Uf5pUKh}?{?M*qX zje3MRW^ZX+NfnQKBD`O%U+t!#eluPv_OH{npprMbH(N=p%*7kN3JPJd#IrJyNl%&-c31+tBs@9uV&x0(eS~SYY8D9uCb}D45f}alO_PPW~-||5`HP z$L|{O0D!~yrk{P4GI6)X*53LwXpcPo-j6euRmx7{=+(y1iy%lfQR@vf<5eN$BACrmSMMG! z(+ZmGebeyqs+}z%h@c)_@2^rkGHoeYIzV|!Ab+}jyFYz)cYLGBxQl*Xz;j=T?Re+M zZmN|>$Aew(+i{&oleZ*lmy<;F2Ark+Qk!qt)*h9HtYZH@UA;sc$av5~UAJDbD(W;r zjWcyhkh}6C4}Qdly9GfoZ_sSC;Dg#&gI$W8 zg57HM;IOQ2dIvW6bv=c5(1I2p1-)m|$o0KuRU})2Q2H;{_zB88Ix7sYeS&)SeGzu$ zyXaM_ut34_gM@|9Hymn{Md=n?8+CTgQMsHbItEE1+~zu68dY#I|D5uG9%7 zQ+pg2^yd43{-&1g`d``t1DZKna&OO$2o&`a*iEvzCOPyrQm&f`+_Jy<-#zGp$`Cto zup!Xl}{`{tnP4sRnx^Z3V)z@F~1BsxO)Dz@bAhWyqBJQ1OWli ztaANVFZ6O!uvPb~h*B z({%Se=!Q>TS2qR!XWG3)(;;&o zOmo*Lra)uKJFaUQyVkKwZ&S0SiyE_}M_&&#d9!4PKEkkJk9*5>9l>nt@9XWzvTSMuTKy*ux`FMc@H zWp4!@6=ijMH3Tb1?Gx3IVRFfUQP+(2EXf1KZDD|S2|XI0xm z())_BcE7g3>tI5{{_ymw`}AS9qNX64_#IPh>w6$>i~QI5jD%j}S*nPKN^gZgJ`kAAOnra-SvW9A3qApSB>M&3wd`cwmOwYeRcyF-PRV-UMom6a-Ov;Fd%09 z+scIKx^`K^X5%h$Crt_4Ac5ReGiGa&I85uhAZc;Rd+*OTeenY;bh8rS!f@|;5aW@& zmBuS)FRiTT4()j?CX`#(dHRZ4S&2&-rKFzMT;}MNG+9|f%`uX_)fFE>W+}TK@2$;U z3dv^)7+h>=)gho5y;$G@$N+1P6LLPLm{trN~41Vka{i4N1JyX`PrbL7>V*T}ssY%N!I z1d#?STStFCxYl4&d$T_wvFp3u8}f|F!lsx(Pw|TVC)!>T|3%50R1kM$ed@3?t#L+0 zZXmesQ1NzE2yf&*$)8(xZl~i6Qx94T9vuIycAomWf5=s{vn^h>Iy50##`8I`)#Qpc zXYT4=ZPcjNgoQXZcJr6k_TEnx<{3|N>{-l5unfLVJ}1(c66L0aWuO?{rr^8hrR;r>kvJ<{XS#tX8-1d&%emceKf_2Zblw; zu{}?kOU>#0AhKE#VoCcLE^lMI053}|=c&u`!q3aj@TDuLm+RZOK3IKV4IEwX-lY>N zUOjJDvE;ow)?|{1i&p#@wTFzy!BrU#bM+E6N4-97qe;GAhc4MGuF99I|1C;IuFi(?1LdafClD(3wGLyYG z&vChb-{*Nf{c*qUhU@x__xpUG=W!nAam`HG5-2Yc)Gg6(zTW6o|v`yd&j_U3X>EVJ#Xjmub(yk_q^ zPJbo-IztVMu&z@cCO6=Z`0r;S$9eDKeiUrpv zD;|db;xmEvQ74q{(4cz${7qKYrBqD5ritxS;w}YZOsK0PIliHG8()V128;5 z-r;upvaVB&;l@;7!{%&cq=8#C*Wx*FxIdR0HDolgf>)fZlijA!VdZG|U9;0@C1p_> zXjVgh$A|Ua*H(Q!{n6cB zGwsRa&-Z!lFaCXc(#rCddxNAG@0G8w-QpZt?IsQ|N+1tO=+x zU2zr)KL~b(*hcVSKdd?=9h?(CzXI|H#Izj?WgIu0P7eF);OI z*yeNtP5Ii_FIorJQ~adGB&BBAH&-(D7Qh3J6#UnR_Zn;rwZ~h>beVVLPkg`0xeQlq zqEk!lKvz=l#)#&*OxmfPdpL%lS9r}U({wHGmsMjb-5__#(?gA8p^j}UQ>{uLzREzO zdZg>Fsc17H!7`D1`6UCZWtbccQL{zJ4sug7#A=eRlWBP~00pNQA5SbDj#`G`@^rEqq` z+tn_+zrT*UqncPB$3v?-P8@OJh$58f+$avB&20b!@fSVWsD-RTM0NB1Q^8Ml-KV2&9FMJ=EL`W3 zRp5;KDrq9CK%@=ud2#Lpb%RQsyey2e()#-=#XfOe!2^4r2_>>Hf>Uu!o$1c|ds#xr z2pUH|tS|O9IPLn8(Ko#`HFX^64t!8?d6!J_x>A9rjW*UwAD_gHg-$;EK^8K!MOP}NY;x^iH z#X>XPY}@}1TuFJuz7pfry8rIxTHR&4mb{FMNiC&wRX5b5=DH{wppe02=;C1ExqRYs z#Z+HzmF1}N=2D|y+iA=A&c%!q?zTA6wS}Z^-){K$W_)^5>O+o|1WRvj#o}=A+KdO{_MB_a+a$-MR77j7#E+Q$U}N!CUF&uUCxy|9q@5Y{~QU+r?vhW+vZd z^yA6Jc*V`e<#%)*F|T8KNytBIp9&Yd+t|tS2lP#?tr`*s*$*5T5GU8jF%oc|8K{P7 zj7DdCGEm~Vo8IFP)Mx83U6`N@7-zQoQB;b^G{hZJ~|i-Q|BBonh&=+*m2|47ftYLBL_ut8h?p+KadK|0oxqCP7T`rHu zNCqc;&#fO+{^yN_Se8)%tNz}x?JQU5Z}FWPqW5HE$geX$oIFGzti5M{|CR><+SvFb zTCNKVeZkj%JpTO7XOdi%la34@@k}QJ_B8!S@nn4WQTPH@%Z7xQEVMZL#L*s>Ml~o5 z9d$@}t$S|1e@~z&QO%EY8QNdai7M~tHXh|Yic!0rKhSA%Y0PZZkmMZaiS)*#TT*Ue z=Ab6Dp@IKH=2$p1^a85-(NaS{nUuR|9sd4e->ol6M8%^T|5cw`KbgZ9IKxjLqi{qq zB+`tak~YY;G|t9E7Tzjbt1gwaNq;sv!Z6{`f| znk7m#A|({IY44MTt6BjPkU4#>LSHl;^@5n#vCwMBd=?$NKp3?8^gW6tTa)j}%V#$& zW@JWyK8Hn-o+N>g_5O&KD$CZ7e)`3w9Rp_?78YpKvi;ydXfUFqt7 z_MR!^R0$>zR>il;i4cX+08fa<7z23%U{d0~`yK^1W1!tLGMP5n4r)yuJv}I?K=crW9P!@SK?}`yS9~f% z^j%mOj&thNI#K*M{r@KCGK1h!Rv!^FK5K_Y(|OJhq&4k{WZmp7pWDjZ2&fj&;LXn$ zF7GGM`<_2EuDVEj|F6wp0{O}6+6xwJy=RR?fXQNexP$kR>dvgX=P00Di1&(#Z`AvTs{t;L2+uUeR9Ou)*o-I zQUqvO^A$2Q7w6|mD=$68w>W z%m7@kOWj=#bmt0Q87fe!GIqrhWfjU^q{(&MbE3_M%L=+rBy>bW3K4-W!GfiilYqx< zUGVd0Xmu#}WmCZ@5K90Zp>`Z+Wo4!GmDMc{luiAaBx&>n^dwo2+lvWAS)TI&J<<2X zu5ItVj#p?T`D}nf@fCkOFPpeO!co*5oI1|OaUX9;jP>GN{D zd0+Y{e-lo6XTu}RuDG)>oUd3Y>}bFX?TB!Sm!?H>+#mkE1bjswBIzfo(0ra6-bEh{ zia>=vAyp-HTr*4Ih@gZ7U%29bI6tWXyMi@lnJ4CjZYR`$4+e9GC@3U1BRPsv${+GD zk#+Ga77170d8Hg4Qp)mzR$?`#m*@@%%Uq#X-ea;YO8w>cfA3Oo{7l6g9AhcEkcudv z25&ux@sgg_6d|ws7z4E*euXQVczIRG9Qq|rEkib-V+NO`Ee$p3P-`56RT+eSPL;j< z^6m#Qu zW_Ksmy!E+B?P`O9&breEG8dUhU;PHFPU+6hFI*uCATgmWuj-3$KeR*#e6JY zHW8}Yq(3B{Zgoum(%08lTdSn2t9#?d;ofV6eE1|3>G5a2M8HBH8($5)T%2?-1S^?D zRS>c@jvZwTT&~|1u7vT<1Jn^FO>VS=*A$i|SFfX*v9L%>Pp`2Op2clZ!ZNC6und;68Dx%%KXBXpDidx>8mkUE2?;EpH5bp=SD^IHiUl`qT6j=Mrg2 zkNheg`Axo>px|J)vYw3%PjF_izxKk7C#!uFXqr^K%pvq*QG%i27s_Nk0x9l1`N-&~?(77@oDXfDj&-)SW-klrU9)oRSgqQ~-u%`n z4JrO`J^tYHoLetkGo6ikcQ2apiWGU>-yqxu?KotjzkVI!SGbo0nN#>k)eItdpFVvW zTsCZmL$u&KG6o)ndcl9ayfG-(LMrqBJ`U_R1a0tN#Gx1LuL{eiSTYKzG}F+~K;Id# zRjt@nDwx5p{7Dk&y1l*ktYf+oS3i2HD%|ZV?Rfchrcp|jPNXiFck}Q6B|l*>8j$i_ zTPhlk3zWW`kjngUxg~zXr`nW|@Y<-$Ci!AY3tC%LpU_Qvp}ouGXiVM8x+lJG+SxoB zBKIIrKT{{2MG1W{9*BO0&L3%EV5~h+6^wk+f##Z!ud4>Hv#BWotsjtMcCR9HmV?B% zD0*UtV^wYmMWg!&=d|&jE&kNo64bn^L<}R562fZ@ z`aIiSDF>$ecisy;f`GUvNF*qbpmYl=%7N#&AOds;)US)3CX!`nLbVsrur}Wi>Cy4v zdcc49+}H?dCLGI4Y`aP+{XT&SHFzhRFTH&f=zgOcX$d7nJ@5 z%DEOeq@a`8|G!V#gLev1aD^jaxHTwp9~v6S z+y?KQLE7dDabgT_j4xOT;|W3B8*}2liKM$qa0gj7rKQ@5BGnyS;4O(6(k-#zmUPi# zf+Z4=5wnJa(XW<+uIT&7{(dadm~@ptJZy?bxXKTQg+bOaJ|12obpAe*e5$`euBhrqpP!Uy$}}bBm+(TN7sPY) zaM4Dfcf2$SsI3e_+TwC)O+p|wB4Q}F;J?gNkT<`TRkrZ+R@R_63+YK@I!qJ|&#)!F zY_&Wsrv}o6xey}zvF9MUb&fA_k`Z2$S(cPsK17QKZrg|h^f!Tyv!$@;JOB1|mnWv( z7PTS;ivpajC_r=fn{9=)w^y+X(lp>yM#^cRYN|?{bCv+e>~4lo#NX=Zv_HPV>2E8~ zgAa`@Ee}2-acv((w|HiC9fGyFxw+_*_kSj>L!(Z}nI5A3h5TG9-~}Q==lBK4<{dkT ztMaev-_OpD;|DU-NHC`bsQPg^!n&Lxh>8etkhGoLBD}mE#YXyJmH)pZfT7-8C{FAy z#co!D1_-WBdtr_TiC5tmyj;?H;5`_8;`nj9ZXfvId@)A#^?yr`LJhk>?Z5E}YzhpG zkL=iXuYD9I9a}fXiO<>{-yk9-WdL#~?g~jAsA>F>mpDU&L`3j_5^3YNdgrPNct9DN zkR&2KAoFOLqCoN(q_tG5)b6oudcoa4fBr-d51VD@%(6QrB_)`(TZtXmZ{_<)Pe$g; z>$J4rnRMHU!lBhd5H8NABB*w#b{=;kJqr-}mY0`ri@s?xN9GPLRN=_JfzOZ-%a+q!{AssO#*ct@_^B>mfyu_|VHI`A`6ZrOT;P3AZrT1H?7y%pEgtctiHqiO+B)eH1r ztLJ}=PfQ?mj=55O;)BBhAKzQPTiM#!X+E+-H}D#~757o?I(fvn080+{i4roUWf~hO z9)zRL@hyH1eoIK0QtjgrFFIHP;vDs$)?GL}tF@7?%=-?szi~3Ok3#bnp)lXk)3axC zvEO;ScYu%VWtX$pnJDgGe+Kr5%^yYhk$f>edvz*cBqk-0Lx>?61K?da~7@b?I-y8T_p};3Xk-~ zvM-jYRmb6iOMI}B;SxwtKiTtqez#wb&4J6_+1Li&gU@&^(Yu=Al^2`Rjz3KNT^#^a%jFo7C4 zZqZlvI@l>4Rzu=yNAV2tShv<=N{aQ5B9glqQ!Q%#RVQ9Fn%O45D ztz-{!(L1ry@I;EJWbK+qOP9A33R&`vWw*&^Bmr!9a<6Z%I8z!0sHczNwDu5f&bz;kH9QL^@|+c!I=1FzSv-#_TTq5K{Io zV+2_^ebr9@zDDi`XIPX4 zVjJ&=Faw(27Oj{JP$N1f1~wkO{>RQ9p@Yskjt^Lyr4R#5IzR%sQ5Ce8ii#Ni?e2tv zn#Q?vpFVzs7VH;tM)Dmn6o786nHe{Sk4XpYWAIP0wdG+4(C0q>YF%BmRUgufT`f=N#4jBFlMm=+V%A6Ec4(}33YpIKGT9uB=%Jrgq?2EvZ`(4rZ|ms^N;f1U zBpg7gfw{Dsg8q|ii94`e;E>h<_K*I5Pjv3)FL@yrpehJ(xIXN0E~FXzxK(g%-&lwU)_4u?puK_lLdv$HrA}^8w`XUEK}MH? zHvh9P#;{#NQCP$e=c@;_PkHBAs2)yCOyn}CZ@(vldS=Vk7i3y!@6wXL2|Y{fYSr?F zoTstzi=?CnZe#`YX%eur$~^dOucg8I*={V(dYVJZEu(xxmyXcEhY?Ic(EIRj({t_5 z#ldlSZLJhLr)OuPDzY#bycMFmd%E{fWX)B~Da^e_jo8Ir3tPIPA{PgTumyC6K)o!=M<)YL#eslvP9zFFUBAUf|OHH;T0>rM0TfnWDbPk>HaF70I}ic z_QfS7ff`D0RFHSWLbIItEz(VRd6_60fLHbkR=3whs;q=@pnv%yXA{CJUSC%?_^ol* zgWpz%t+CuTsxaZW+`eSnxwPbr*O6K9DS|T`KHpCjj!^CTB*qHg;QMRLDA0iwcD>L{ zN0Fn)hSD{gFNQZ{pDdzLPRH28s)3ImKa%`#r>45Py8fy_$X5MWcztc{m;`2Q-&4cb zC(q;;kl4U2R(WCl&Z`7M3AL+Wm<~W%7M7=q$pC_JCJ2ARQ0V2$SU)W-;9b=?J*OC$ zcin?qGX3IeVGa+A?i{w%67l^N@Ddu&x>n}qu$KWh9}Liv z5?!uPlq4$pf@U^0nPp`j!|TzK2QMF?`(1p&irFGo>*>~!Kf8?V6=#P|1{mQfDcmu2 zxNVe4;Ip>0e3D#0Zmsm)^)Si?%z-#d;A}&;78NI0k-t8`g{yJI;qUy)X}{0#uPk#y zNI&cYVm$mPi}d2~7OHQ`%U7)^OK9qP{DRqWo{qACN8oIh+TaG8|M~A7*SSIw&oM1Z zPqDndfjJ$_BH-7WH4;h?6}9;UqpU7j;5etidGRLE|9OZogUB%_)J*K%CUV9k{ z@A>clG`dkW-1&QTz;?JV z$LZm4)7Jj6{C20!o4r~!Jp#>QSubS{siInnUG92=u0}?`N@wf) z7fwL{-B=M^%DNoBT^Gp+GH39bIYTgoHjP7A?%X-ZSV|Z?-%U`}W-ibbtGOdp+_no&TM?@AitP!vFC$Z*Iq%HcNeN z?bP&iOld(S+$&e+Py#0NM;y39k)H#1aH^_HvJk5wI2B7No`g%XvQcMUGuFsGr?X88vz(pjSZZZd{N zk>DPnw!P7BBv82WnA}$ub0Hk;fFyFK0Xf z7^KzMD-8cjGqaMCk|MhjvsLBn>*H}aR?v=?Lz2>xf`e#wx4C`ykvr!qu!5b>tA%a( z_kzoW1ot(PYK$aU3+n=X=Bgm`rtto0;}3!wRx$ie1O(nz7x^bxVp<7%DN(i1tRb#W z?;4Hxkq`x>Mm0IS_2WpYlhtE3@71*t=UvN4W_?M&Z;NW}(@V_F1sn()=bwXj?m9TU zx%Q<$dKa>3hW&*`yqSZ;7j8w@4WTYY6(A|u-O^&8pNb=iNDnF5L{-s~Cx1JLIjNJX zg2+~AgP5O@ zP6((Y4dE@cMOu;(#xDG+R;3tma5XpomqdBKclSaw+3oRXm*b`Mb#>jQew{@{eU3je zm#?PIARJt&Y`&7Vg|vaTvmuCR*PmgoSNeSf?Z@y2i zrs)=iz9=yk%IsdmbUl7_+m2)j|I$V>jHv3petSQz2>^86{xYp@hzB-V+{W zSdjrLX+BQ?-2gPvFTk7`5=qY}9CAP&ls$jmRwam|`ZQ0{url|8(;YR|j<9zjk`m&FL@AU1!% zr)O>zQ@nc!gl~S;H+7mM_avmET!F>=D|VEVSm<^pg8OYM8U%v-rrk0la{bUi7OPRKYlD5fgaesUhXy<+QGFocZq|;nIE`)mfXwrc@~ z+u2!jbrTacXy&rBH%JyY3`5@1Y*gEfBvZUwJ$ zEsuCG_a(9Q!j!m*x-(M^<1+%_j$Kqd+nlZvFEu{9e1z^I4BoqK8ccxn0LxsK+^<=2 z7NHON2dopZb*8|wA6>YSc|yRCm9jK>x&qas+*KIz;GI-7?I0er`7_bgb$|r+J1XAZ zTwk>H90gcB)&A?%Nvcy~V#xBr6D~0Qy$dZdZM0_F;B$u73%vLm>*JYpG8`=|co+jw z=m)?J=ZwdSgT%q!5+~ct-~gSBpbJSDVPU4i*cbK}2IG*OMAk4+$YJ_cEEXe3lZ%&< zn*p9et&ucs=YRg=@GQy+|MSfq9o2bau~AVle5U$@8KV$|*6!{y(;J4ErP0-e_c^fF zs{Y>>7;$OBDCoq7oteq$opdVF!=P4K*}By^ahM%7H$Sa2#jC>i;Rx5Mdid$L z!VzQP82gJTHv9UFkI-FbzHo@PQOF~|yjUeA7fqIuDX&ioW^PBZ6EOUPhA#7k3{4EA z+SCeu5;ztPoAKL`mN1S&uS}qJZEcN91SL&+FL}TVMkXf7gESmIqZYihWjG z5BM7p>ZhH%BDoJxqpZ2zQi7ypaB%Rp=-6#h45K5bohZLmezuD|4CxRa6ZsBQvykvzc`rcY;|cb^)O9%}_|%a7y8jI@&S9rp5w zyfyza#jd@tCI_W5lo`NE?mBeZn*rXDb8|v+YM99q4IE_qBmi9#{H$Jl7Ye796<3GK zA1`4Qh=AAB^udYtM;OwQ3D%wE4**H13ov6?a%^%EG0h6A6@Jn3K?gpxwx|jsJ47;q z?2y#o_<_zOks`tb{H6yVe)W{Osr~S6+hV^=eg5q8!AR8M4=qK>Ae3DGGsKzYa;c0F&#wEg6P500u|^0%qpugbLS}orGV|diNEPlpJ>uLo`7F z0eo)oC^J?0T=OM7JwQv(PGwjD^*`rFjczVnzhk95TwPqE;L(MI+1$e7L(SEC?TEW# zu_zUnbF+~ggaxBMMT7nEg=Ok(S6^ac{$Q|ptP1H#TkR9u&+r3P31<9J?-_tWK^Yce zB@9RuErdDObzCh4uZhYQk_q@?mhEOF$gJjH4eE&jxVkR9j~hO)+{VEDVUL>zE~p&?VfV5&1+ zxAjZ9dpbIboF)yZ+DRB4K|3DsHe8K=(HupUeO|2gM))1a8U5>-Bc{KB8U@@f`hr~{24}1>TTh6Ms8?NenJ9u0F)Swf9}aNVh9z# zR)WO|-hzHbt@*X%jzEwmdI7YAC}73~atw2;S+bzVY&EFIItzkd5N%B0LG%1M#`=H& z{s-+5tdM$RTRN7Yr~~NuS^>BTMh?*?B{gL+#F9_wcPxNf(cp>VZX3kKwl*;Negz`> zIZOCFxh+~+Sg0WI-(@Dy;@{N_%FbRPqQ(BRv$NaAiL{g{3GW%v-8hZ5|0c-3(3t^Y?%M--p1n31JJ#uGaHA+v#;7&mhEdSMkoUgqh`C$uA=zy?$Mi-em*JHO}<`~2) zC)!kgG?=Y~8)|D4j*=6`7*oe>KH!mc*t{SrCaPlYBV3SXij$Tc&4ae1un)lZ+btmB zfY6{lC@NX)=o64?6%`n=*5n{1+PWV4R!5P*^sbD|KWg+xLlj^L+i+$Wo9@#kVPe#l zX>@-5F1%0kI_yc(MWA)^pZQxoF1*M6=1M$tFU3 zV7@W&9JW@SRH^E9925YUI(~Yp(TA&~oGc`L9>HiBEf+ohs*clP1}HTYlfTu)?Iozz zt9EwtAyZiukyG0mFPyCx&&tjYc{MGl>5G&NMEliMPu3hC8@zlNEO2W zqi~8+njzh+yu3V-{^Ltag6f7(sia^{PBziM>LQo&H_w@t+noEU!Qdv1rRrv>iHzLk zyysnb;1*INe{ETwtLG09t(%prb2@hHtGRiKs%9$Iq+OvhR5SfFa{a$Wd^G{d#*bAp znu!dSI|~HE_B{ER*UhB5jpKM2#emS&AVUs;Yr@YJQciVHU73*nLh$nCW_MtoFe3oaOzX z5?!snRf5CE<_4SN_ff9e%w@MWuB)_(K5yS}gjy6t$a-u~IsMUP|@_p}LRB^?6%HNQrTtu~E=F4%fLh{5;8$dG1nNig{(5k0XQ!Jws_!{wiII-W|J zn;7r;?WNGmOO)Mja(8})i|lGKr9>2;_&Aj=+i$)Le`N=s2JDdB%Mz$!@NKtAQpi}^ z_3z_+gAcY5;+I6Z-(c`n^DU5N>DS@xE$NqVt-;OkFwGhTCHzq?ziwf`HvEbBXFB znr~9bkN%_ZW!ps_-Un|bscOKDdwOx8pvh>@Xh7!!9xuOQtz%EZ4_!DC;$rc0pK|7b z0u{CM9RGa#{P9lVGd3ei?Wf;v9g_VX?_2QZbuf-qG{n-X;6dALc&GE$lmn54@VId?Dp5 z%J!UES#Zpdp`TthTun3mpHUzBO8+sg{lfc{mb>iCg!a{EC<*%ezgH+J);-!xKi?$z zd!Xi2kI<}EUJ8qE;ge3c`JO7ASnZ#UGxrQ}s%8p2dTKbIHNeB!jJqo5 zdv%45TuWHdy?mi7u97@8`{~Jy#GNI%ccc;k{9?S)&Mv#WJnnVry|b!4FV!tDJw7-0 z4xP|r)4m4?VX?*wHx-UX4aZ+kYC3hxoUHr%StkdrPNffTZba>8T~3dnr#~+0{7kTo zVdS3&Jev;YoL(ih9X zWb=V6KjVUq&``AcBc@%%y<9bMjy|S(Ayx~uiJ4ExPy7*P$SRFtlZw-S-e7oc|E&?p z?aZHdtA0@QQqjKJ7@C*^ppePHIT5f;etrbnBac<$B&r2!?`_{b1#j6fRuVLhG~_Q* zNFUae*eA)xVpbic7O~618q16Sb7^f!oDxw)aTGMQh%>Vp7Y_|){c}t1UEwbprhpW~ z9M>7vG2#96c>1k^O6pV$zORT66m_z~-44UoBAli{D0E&vbg!7p$@*WpEmu0CTFfGL zZu?OFz@g!wqTUkwO#+eqs1)}bVekm(DWa6P${)z6k^6phmVg*RQv{haoD7iJ@dW(T zklaB?@CmqTYVt5R*VEP}MDROBeMRc)D$YGS=6cp0CVNiR`JUQ8^dtV_9g|aCY>H+r z-y6?IcntO#2dFa2UCPagt;{P6zyIowsY!`klWdt-k#2;^n?!#HVf`Pw6<Ch7`4Ob+`W|2;LxV0h%T(4^rof9EH$h}_T{W)Z01LMYQ* zFMVJqCwx;&tKUO*>@uncKE_$sGFDp(RdZ+$pv~avDaDvR!P7^UutuNUQ^nso!+kmF zQQm#~U?WZ=S#m6|#Yyqp1Hq?~&iQ)$>-$ydnA_0(buJU#j5pG&Or)TGbqX zl~awsyv}ZX^Ca!%*b$lH0<})l*K-FuROfxRt*DlK2-E7(pZOB8zEkqS<>Y6-`^`+R z(gp664^odd&bvzHJ)?2oUe@~?9{LC_Q2s0E%}Zs z?|!}KPz++{_qNn%#bqg?W5oY2vOK!C_s?8#^Y`+A})E?^gg+c z47)_|zm3teS&foz#PO&zbvgY>FKK&Mvwid*)ebR+bB4<`<;-@=p2;QZguOU*!@|0$ zXl>72{$rEsv@fSjjAPZiTD&vWRporP{WXe-^UPaU;H=Y*{e6EdYVXe6K>H%OVl$d# z5yqPhgtx2=BhP6Q?n80{zrfjjEV7e`0=wtuPcab@CTgak0a~O)6#AWYH*<2opK`Mu zP5pbY#O$1!!={W4-ziq=?4ZHe$8J6{hfiTjwye*#3t1`E?4_+toVU_P(r&X)km;zxN&_9MiKS ztukHUlmg6DJ188>Sl&l~s_^*2sgozc2^Q&LAtWqO=ylfdcPenre!G8OvA~JJag*VJ zdV6EUt1jaWflTY!BYH(%tS|HKaJ>F|^(?=}pJcP42Mb3iZl4)`Arignlw_cGm}$~I zo=~D9AFIPjcYCv5z>2JR;?>hPpW<|1tS->i-r1u%AAplWwFATPDk+~D^?#|M4RkF0 z<5_Zo$&2@1S99u1D|BLX1iXHVrG5|Us<;;Hce8oas+8klollF|PnD>fL$PCf9V6EY z#Gg|O^5xc7vMQdsc6q7R!962y=_%oL*ppY$vpv?YMQfYyuq&O(E|Myx=d+}uj)Og}Bz5s15YW{l_XjouxONOir$;bdS( z43Ab%GrVS$`=-5QVuW^>F4EgR8M?B9fa%KOU+| zgs&DD@N`sX5*)?DHNtMyyuaC@eaCEg!X`^&ghE&IIrSbQjE#>!K)?SO);hoFVMf!p*Ifj4EIo*>-U67JeH9G%ueBp7y zE&?(7{&&aOk_Y|*%gvRJ`5`L) zK2>gR$CGJYIzs&mZ_+zU!aHMmT--fD+D<{(S(TL+-~s>m!q(aqrRcIycs(}O`prtqH%pdb7~v&+u+moP*X<=H*vPQ@=PO&{d^@0JpGRMA;o-9yb${>ItT zWJ!r~@yz4ir-a*%zH4vDQW;T<-4v{=ug_UZBilex3o>vJt#rd~^* z*z2V?-J@SkqR-_ZwqDfWG4ZD<335bluT!&2VN!3=sy_(9p?A67$)@o4LyX)EWSL!C z=t!dJ{|0(m+(?tP)cee?Xt(;S1~p#ziGU_Iz`B?jN5v-;R@|{ zH{3E@{Rw`uIWT-JJ-aXMb&k0z=?%N}h6dSd)2)s(N|Z}Mv!m@5 z8}r8tx;~aI6*UaFd#$v@7wX!UjOP!>dzH`asrlU68YXjSY2>n(>tMK+I=x)WTyms= z>)f9v++XQx_oS3v-;Q3g_WZtm!M*+YZ-dLr8Xj}5V;tx&NJM~W^!S;8g1M^Ew{>=c z4-QrUiImnB&>aAf62Ef0qxJKX<6ZBso|v7X93AuHT?fG|OS_`9REhi=pnt}q(OZ~o zoGG}@JoGv}Ge;*QrXwLO&7YR;@rCwBzez1};3ZwgoFPlUc1tUeFMnhzf2*>jtTXKU ztz(ThKXIh-Gv=iVH{JI%i0Sq?^?LX`q4D^GdGmGyx8ocGCB5r58)%kHZhAsy(S9@N zi!p%gborWxnMFg<4W0|Roh4Zf!-stwoSa~0@ax`g&|EyE*bC0u+s{_4cUHt&)5N$u zpzsy{rS($3CI8AYU0fHL09*8r9u?6lQ;7;^mylK44klf*OB3IcAjxMFa{U>1yn7Dd zzT{*R)KRB`=ku~WloM57wpdj3dUfAzFPr)pa z7ZenPKG=PUMlr?Po(6@5f|^pd;aymD;)U6Ac}fA z`c~#Ok5Ofj?jxbFa+-E_=f3V3*;dtzgmrVJy&}$}1MN*OF33b0EEcz;0gZO>t5zP7 zoRxi9&Q;^lic?o|lN%o2-=rW`+AcheJx)LM{B1Pk1%UCEUy(^uR#I9UJmFPsnu`kY z^^k+u=9Hf_oTq{D$(-&>iF&1RtZrQz1UgP1sKDI`-1XodEg+bgf<%jz^3@4wQpI$5 zuWm=nG;9Ak$QO0m2h#ZuB>Ei$QVj~Nmea!8*RioN(pF-dc&Q+@_M4{WW={Ot05{dF zqSp7z?tS}wp0Ka|+Pxejx!7etiEvWr1!b&>44yafn`^^*i7u>#I`-x0sPATXpDLU5 zIN=09U3OIwl{~gI zC;S>$;^TcOa{JP(SECrG*oN5_zr~{+bXjt~72V!hThI!n;)8kPt!MIH6ViKaB22v2 z`q?YSt!)qc+?I|hI&}|_habDAXsn9#T;sXq;NtSOc;{pZn@h7>@8#nL-pgd8{-WFd z1hLa1BHW=Dl}vZ80nGxYWNd7F%4-K1fnL)^IqdVgb^Z&@l8;MEOB?H}_Vc}Ms9{__ z>|}bA`(cGFOmUE!wFc2IJ*&LfDrRNWp?Ea2#Kyv61Yu`yfho{`os0#98c6+iL7))I z@pqP{u5TE_o*`HQ?~1=@;AvNMd)dTY!1%hoE8hc-*Uauc)}YY|-T)r_2UP0~UK_Kl zHWJd(m%}~Un|QNIXPPgaknGGT==F3%Q=Dh^x$-qOS-HJeG#lPIPZW>xN0_jCF8y8$ z?_H`Cv8h;hEa#jyt}9rDObXihww|*w?WJh!pW=W!dn9MC=G2nER-E+do$hA?rgzlL z%5C>Nb9&N5P7mdR~0{^45IP9EUIjyUvySBKtA-Cpz|zkdB1 z>(o;;?&my~T?M2L5%Q@nXrYr>48iULhY>{C)|KOP=6aQjg zPrH_3#iRD=hn5Db>qOCJLr<)H!JP=delIhjpC;D=k6w#d^e~)wDmhS-RW}%xY+?R~ zgEoRzwk2ZMwjDW*pEOm-pFd%gy(SyF@Z=Tc+(D zyvgR;)z$vG*mQ-6Os0+-x(&lL?2m<5Bxmc*C0vJMhu7I;Qvp1By+UZ_D>bU`+l!v^ z#x(opbiMeb#NEHG@f#!YPY?A^FJWHPes#RS(5d^bG&Uc2gPFyDUn9v!`gY2!9swdw z$|G7Mu#$Nb2jkKJw{*wPpMP(Q_AKNVpdd)czs3>tQ?M0_N!PY){=;te(*7WE60@G} zw{Vge9my>w`jyvgOz)HG<5~m5(wobO3ZV)|z8>qfZ@>iQ8|V5NaXMLZ^cQNQPSHrO zO(76oZgCJ|IsT(0&TRs$H+ePsk@z6mm4$+e<8=Pzi)EAH0U6%1iAKz?TEBe*neY6a zcaDjD7kDeqI%P8iJm?S{;{914&1hx!F8x6>hr?(_fv|{(G;)VE=~%Q^*Jc|kFpEu$ zD=JLPEG$pXC$C%@HQZbo$FfK20IKO@p&v`!BY6k}(L>^| zf2pRqmMlF!%}W_~;u+tNV@XY|DhO>AKS6BsWcx=JOCKZl?-8VX;8%1ZsmXn@q}SwH zL@8RrXl6+*7Bz%i%xdpMQvdxsBh{{&QVr8_3UYN@rW?;|2C-h4A95Ub!4e9c%dEbM zm%-f6YFlcDT7UES%cG=V0Ys1#_Q?}5Q%x3W^8!$K#RESe`vDi@J?^~Vuz|>kKGsda9!U_9kqIw$h!{1CXoBn|KpoYlY4-I_~CDCbGPgTr&cxc|yZbZMVyxah! zc;1Y!3|cVB2=5I6`TwpMTiRR4n&Sn|Wd?fhoILtjdu7Pi$IPS;hvN3Iq*fVjbZ#7D zFVZ)!xxib=E`27b^NS|YJXQT9Q$tb9=`XfjeI-)F@H9rzQ{J)X=Q_@R){V$ z(wno=6$^P;zcV)S7(`kb3Ut!)*HgS!xT9aKdrDV6(;ya4mapDEx-hFwS=85FYGj{F z;?Hl4R&4NA6yg0rkfnEW6Im)ck6>w83wI*O%a&`Ba`P;&_0f`vVrVj2&FaS2nc^W1 zky7pFbWhUHN-tMmUdVY6-eFtwPNK4~tW44?Fti#y-O~F_<{Ce2>lT7pmpR5A^uMv& zD;~G5G3Cq62xPThWi?)PW1;ywuDPSNGs6^<>Ie^DlgRGg_BytA(rfw)y70k`_Xvd7 zU;p_!K9dVsMaL3br0Dm%_@zMu0`H0yaoDh1#ik%B>4u4k2?7IH!WF}DZb#^Bd@AgZnOyx$rD^6C{Q>oeoqX z%Vd`&U;iU7jg*nM-tTF|5otH=2n^laDLN2o&H2a<^y}V@169D@kZ@dPeAkSvj_sRS zzVbIE&ec*pU2kduYx|!vyW1S47e*;HQ5dgSe(BgT1eSz2Zma(3zs3X0S5 z6t6G!2j}vMpE+~U^9++!p@Ud=YwKKoLD^#^skNz3!wvBj##Wt%gNF+!tvk%WPz1$` zcT?=#d-d2*-x;UkS3Ac`M<1y3Y#VZX@Bvjh#6FK`A@^H071X>rU6HT8_o}JKrLw`} zwk{YGzbOq0^q*#ioPe?6lGSJ?s|hAUceON)q2TXdPAGDPB7H&h>0TrE8@QDR1n&!h zf)t;~6FWNEX;Pw;hDh^NJGQxXeE2q2V4`!7$$EON`aT0+t_jVMZti;j1v`aK!^rUi z_5qQaulHZF9_=%+@j5rww@EqR$h+-MN!z3TLe!4o6|c5=dxMulI*ZF5DL_L(Tz%$3 z|2h;+?e<6O@nZn}QW^AFS5{V5CrYwfB>-Qir;ko`ALbL)ZzY2UzEBlV$Bj z0uoEV9w3*YkWB?;BtELEY-zQ3Gp;MCZ19r!ibJCNukGy4b4~IUo9mOH>pLO%(#v_E zsPrTah`G;@My}!8$fjE!_()v71&BB(JmiUj%09H;vi{1bVPK4-LW|OX6HK3VthAvJ z`Gd z+!qQu&&d($wK44FiRWzXLNjEzId2F#PtqSj`V?HF$eMBD>rW>_t1)o|PW8J`hK`|! z#2+E$>nKpC9_RdTiMZYH(l8Vr)jCbzy-(2tA1j*FG*7n4~3r~q{swUqH zT6HrKCJ;|IkZ_d%6sT4UYmLeL>RDcr<#Nvq$76)94G(ihI_8}n9rK+{XYx4Dr9{wx zxhCR;d4_$1ZOahXcxiBDr_Wotah&T+G}plKnRE46 z7Ac>NoopSQfBAYS;uI1?_Kr(NUh`UBzO*Z-nFIJ^)3V;YnaX;~@e{4?n$mZXm!$vDrd5`jBg^M{7R#A99O_QDLpFc&uU3WY%1Fw^!&dS;JMZ-uqCf^Wg(R~DHe-tI zB!*tdF%!M9e`e_+s||6pQkxIMnMxF*Qwvh`+pBqOT}+n|9)JQoVKu5=f4!Tr?E}X8 zm~uM!_79n_^5&FWEl1JAuU9z5?KQ&;&r1HI#;>>kFMub48tdj20d%RNqHg zcK_&DFSX|DL8rf>9=8-TE}766C+E)_92oKHBOK7bkd%!vDhrE?e`I9xl8BZ@M&3wQ zPDpIW$lRWYPD#7I&w#Q%RP=y*vJ6C}xX5us5bvYRN z$WvPUX^WAf*OZ>;D(K)zWw z0NsfOrydt>$T8tjH6Tu@oOR788eX;YlBe5?p+%a z0S3lble6Y+u@h@Y8Z|E|oy6(9X^-r3Vr5@}#Lxkp@G+0`J(3xpc`@_tv)|u&tz{d7 z1aXh=8=hq(Q1b{8>v`=4nBnKvdfTX}To5>Pd>+Ec8JeSb$5mM#zCk`f>*7@R>RM(ywNxn@$>tany!t9qQ#q^$wdExae~&^8UJlEGME>r zsF23gNoFPm8zmuuVl4Ikxt*iqpiBaY0F}P2?dl`20ypNfyueyezOcyk_0Kpq=dvxx zo$*Vbxk>Qe^+y0jWK+}9(ppo10dn|&0UVJ9R=tlZ>cRa%+i#R&91iJk;Fmsxe1;nb zf~znM&BsV-=re&zy=-G;G`GVlDpH`*H1`^RAjA444-asN}1$6pBU;!pJnP|GBxDPPxT!r8#oR%<<>frRK9~pj~WM|NpZ9 zzYoYM-~8nN{>~_HawS3I+lThfql*Worb91jO0SPxUf%ze?2Ol+um8&eC=Hin-P~45 zAjKQA3 zk<&*4gLQjm(0j=rWqb4MU%$X0jbxpJH!#Oqpy9xsqW@oV z@W9GTKi|HV$3Q2|6q6#lHveCKfaH-pwSZEf5~GT!)mgj-$Yf+N)p??P=>>d<#b^od zPjYJ`(~|(_54ksq;sx4aUS1grDJa7a8F~OB?SZ&x=ne;1Jw=@|BjLwAw?FM2cvU*- zxmZHV4-9F?@9jRw4AQXS5?mGMa7sj%uEZ^t`aN=bPJ$OmWs$sTAqKh|o}aOAyQ&2) zBdJuYm*&CP+hVWRW}Qgynm;fvkK8Q#Cz(bw~^AdL0y?2UHp|xI6=QP zP+Kii)#TiK(wjy^pGMRsJn;>S@3+%D zsjfmAiNpjJ6eYN%uiR2dZ^#n?L#aP_4Rn(7=731H_S%md!TN=_?@2V+b&*~uGWmXh zcEvbhwkl?^blx8_$j5P3H(BO!g^o;=OmbB)OCD_CmR`Q-^W;3|GB)@+Wc8jpBo^Zg z!7v7pCS|(Kq+lt<4c*YsT~6h*Z1D}lv&#ojgQ^mJP8#Uxts(t(6PzU>*BDsN+FZ#3 zV0-iC0Mh=INUvq43{AJ8T1=xC#HK0&+@HX#o>Klc**`cK5YlSJd!~c%v9UPkcEq>v zfvQDU zSPs|6c7BOww4K&J5JnN?woENruo?;|6S);?3Ts=pPGDNBk4{$E74*3BRzJo}Sm^aE zT3OP;RI$&dLzPt7*1WMrRfZ@H0fhgDt@n<{y6@w^kCIU&WM+h9g(PJpqU;e8$}Uur ztdO0N>`k&lcFCxah-}J8qRfntO@k8m>*)Ml_v5}F_kI3xJ+7;>%klL+KI1)J@8?U0 z15@WP#U0%>KUKB%U^V#!5y}t(sluI`MgKxwsc|ehNspgGTe<)mj4{1dF(tn3R*I19 z?fpQ8zrRsFq;F;hcP81TJA05*u55_76t7NoGO;a({2CAwMll}u(d!Et+Qzqf&od!> z_;QyOUv>oQ*ehRx_KTRxXVe@!A#F!5-h$KP#blGR-6dIDhnXF#7`9iM_#V;Xjl~{#|NHk#wPVk+iYo5D{TI#7ilrrmSpFhyzl+@Yu3*P98bRQvI>=N#9@d|8M{}8ApiYg zBdc9}Ij zFt8tes4yh1D49gij7fG(I{qcb*Vro?-mkkd*qypo&Qo_}9^z)BK9Smi`GX9SZQCKs zfp18~?{9_cW5)>;f#Vgy!8;?yQ3*5;+CiAxi*S)RqCKj;j<>#sO%bVgS(&0+9K)1u zsPkjQhJv-fgj^T|0fsXnC#2Y@@ly%i;wME#quyEHIG)^9LLfv4x6E^}>J49>{>4Yo z4UP|c%pI^1t`(nhoz?s-T}W3I4S&X^ktYX6aZa!+OcPmj2c3^JAp!7Osv{>x>=f*u zkNo!`7-a*B_~XZqfUn?Z`##d0sjWRF$}GgJ%7MAd?957&yOkRibJ~r*wd?+er^<&r zg7eywV;Tod8A)9P8AH9$A>ysy?}boz{qLfW&(e{Jo8LE5Ett+Y57#u*)i~2o*Nf~> zYjsGBt)i+fpIFG)I=t?W{c&^a=go9v4G@SUqg{S6V0Xf2a|6Y|o}nRO=c~l#9@49l*TlkX;7m^Vv=_oOF#-IV`8uaHw)(T<~@LiqXv} zX0^9+9rpRvLc8YT)Utmgj{c3^alV#$MZ$fvqnMKJtD~JnwDqr2{$kA_3#RSaJns|t ziqKh~J^!9RINYSd(pJv_Dq80H!-P*&UsyW-PWHj^3Rms$-R}^ zL~u*mxpN!g3*&4Tzvhif<2m}XYT&RmM5#B1FX z5A_&f2{nB9hSh)JJaB$Hr)0DWOg!S+Cm-t{`p!>I&{NBHstSLX*e({}*FRn`w-Om? zn_!eOo}1V7wfeB`;iD^&Cxf4}IS)Od7V5YiGrM8AX;*wb{AK%V!KvzQ4Qj0ur;a%W z#bm5ajwvt>r4^)d2ITEKcE0eo*Y?XDvenI`+X)f=UXsM;fNlp9NK^%6)O#>8DlU#H z_nb@Bzik?>q29k6D8nQyh&{y27@;)mJsjS2gXRNv&t z0>49F-a1@ZF+3Ce?GZ!E{P8{kmhM^dAlry!C*_|t8iWYOg!&iHMdhv)#2?CLVD^f$ zo1NHyx$iUU!W%MzUiROA4}*0%H~0O|-#e#HO&b#2Qg!p$n3*wlg(9Fr^LBzHwP4DC zB1N~C|Gk=L{g!^oNsrf**>3euO|IuF+kZtkt680IL6i`ohaCVH_J7Ilk3td#_Uhwl2Ih{C;v zx$HPW@0hX+Qq67No?X%YS+qZ&k7Uhdv#}_4pT3+}CAG*Bm}h=QRFzaKfFzxuC~za{hUg4w7uE5CV~20xJ6xyLNt*G?_=@&8+|&VO5~M{N()Irr06 za@k781CMQ{_>LNX=6JB{ieLO+dd|lx$1V3(|n@6WL6K`^y zweB~VV;vTyzd~sKlyX9BhGJ#waRc{nXJz&SnQb-Knx{7{3Kkr%+0HqXyxx+F)6oA3 zvQ^N>x|F@!2`k8K)w18OuiwU{Ho6<9__2NAy*8R}@;M3Sx!T4+qt7|Y|#DEE#Vh$GTJ2^SSPK^GIw${I2g-tBrYYM|M^&- zt97D6d+dk%LpG%aZSL6dXM(}^itJxd5-bAuep+o$zJ8}YpD`p;%k{&xIEFt8CQ3Tb zTEnUr+8bSZu60bFxwJF8Xz~yyQ6e(@PeM3}Vi{d9b2tOD0VA6n091Mf(A;B=QBN?C zn%uWfhaSUqm~yN(ecEc7`Gt%clM3?&c1&Dn1mg6bkll0>F`&~pSmMNRaIZ?nqes0* zbk7`be-EmH>s^I%-y=2o*1Jh zkiARn6@g7+d+J_&oK}7-mSPvAQ%%jxKtPI;CkZ0g?14)Z=KE+Uz?Iy!c>oiH_uiby zk44{wmgsOa;6oV^@X5)Czos{?K${VXYLT=l$fz}TDW4_mod#xk8F;% zd|OS2ONJ>JdOu2q3cIhqwFakbXt;BazGunIbM3lrzZ`zAaJ{T3{zu$o9g%g>ezYAE z6^4T4ESgMAF$wBta!-8w;J94V9Nk{BcdEG0WbM@%wO*F|&llAM6~)=|wn@IBZk77t z06h!rY!eO#)?4KENJ&b%)pFfAz?0aXdeTGxX&($>C{fM0NfX)3$IA;sijU9he;31j zug-by0Bz~Ui-#{oUca&^9RUq6$G(#-?l#@F{j^4ECE8U}716;H?+SkE9&?e3SY7wT zU=aN-@CMKTF*7s!7SwfoJ!?ilSv0L<-inLB=KW*ex^}FRpln{4VAJ3j@b;AT`P;P5 zQ*Wj$xnXc0S;lopOHfl?aNSvHQp}E;KSuXqew*x?wcXwv_yu5sQHjJj)xT$qA!)@k z(!BBBFL5+Dt5ZPdTtMX zE&v38v3>k_Q7EC>d3;jTbokyok4&kAs+BDp9^-YVvFyw>64_Hz=@!m&UBr9-gQ&@zZ6zM4OllV(vpl)|hw^uv- zo%1=$7>Wy*B%7`N&V;}FK=%F1$(NSgm8RCXm08@I%R}I0iJxLF%AeSdUkFLRtCvV} zs{^%j1AW^EE((33Jql3?ZIuy!0hKXi%g-$64Cz=iDcx5IE*>+&_%!n}xvX2CgbQJ4R_xE4uBAD@{yA zLM0>|#KU4#Q`$3A8|-Zcu76;CuEbb8UVXxz(S3!(n_I0x`w~l* z_K{<{-KIgeF!zZcXZqAYh*9F$v3Uo!U^i)|uq&CZw!F=gk}dpqvH}$74`kBQ2-9vgzaF%nvZPYa{1jEqqN0Bc8oRp|G!rg$T8}ZUC@h>Reaj~Dd^@3k zk4WNmZ*Kr)0MpPxJVQ|SJymH!@U<690usWx(wM3qC71i}teL|Y2pO1+$B-YK;+BbC zSRhmD?cxF`0qsHF!scNY!uPf|HSEVaLcEcDFM6}blf!dnz!iFa zaW}Td0pzr&C@>MVlbwQKgh@WkvjU9+(xyQgD?xjRvz+o&{MgY~P?ZC)0>BzOEuopM z*#XM=XqBa;L7*WV*c9$rFvry5;~~5uLJ@XVOmBa2&B4I|+sxixJGY0pO34B51E&Cn zlQ7dgca8)f?gc@Xr{}AGuu|dyVq}Qfb<8!-&ic2P6MR>QAATM)%McfW<&@ilf{=Q) z_BI;dHgqFB4UA)&hDuL6of(V$pB4bXL>R+fT8;?4N)pv+SANsh76W~Gy*5}*rwAav z!j~E&3^_CC?qt+&Q*MG%4-%wX-{@0F{OhlIdk@dMpp1k8ny3MQ&g>;+BqS2Ga)C%< z-M23QH`@WS%PA^6D<>vERY|a-b#5UgCnc7}KxR==R?cwY$s@4imhj}p`y4}>&3h7J)QBWnNB(7e9bESy=9z5Iyyrt8%EWt`5IaU?6E|BSzo_oV7nb?ApUlt zR-Z8Ais3^sF-+1U;vm>poU&sgXx|%`gseBT5xh&TYRZU%@43o3W0PAgX%ryTU=vAi zg+>i~W;$wHf03TxtuJp#0~L;li|_Dil|TQ*31LQf`0lEqq8?)NbM3GK`pdkreoYkA z`ED{b#l>B4mhGDjj3D)W0&WHzzFRFJsd^Z@jnK?mFRGU9_-FMro}!pEVjR6Iph?l& z{L*A<{~?;Xa^uvMiEYge)9-yW-!mjWE#h>3g=7H3>G$vFJ$VB6MBkD>r+&0_&S$D; z6{3iRGRyn$p&949^%nA%cLW*0Jvz4sC$+si6Wc}Rarh=Xq+EP*7w+em!!q+g`e1*% zhxi327$%(b*_6@j!AwZkDkU2ikrNl9{%zuGJ-Z(F@HlL4i*+#9KUK{od63693A8#HjCTsg&5L1 zjcMsGkq~Ud!}44 z!OVRB!GlZ8WNHz91=-sCIPx+3iO}I;oFIQ>&I~dp)ZnU&MVRmHVY>)u?e5)(q_7@o z-($C+mrd}E0m8$~EWOtTzY$I^g&>jw6OqL6srV6vqJydJ&@zTa4OP`%<43uKL(-Lq$5V#sp@fTWVfH4oq_mjxwEZR7KZ>?We>01L6G#u$w#R0!z#iN zbo8jx%7iMYht86t%-ok#mrWeTm)*pYcqT_-vXCEjU6ffR)tGsf%9kA)I?ROgRO63u zS`jRwWLhenri?`ryRSaZ&!?5XMtAF$*HXC3qc!U9aKe77DLP*HB9=jO&;sl z-m1E~8etTUmJlQDO{f}+k*?e@yn=;;6)wIHpe1d7kg*X`N}Cc2)G=vtJQ>!aIDP}`CG#%Q zD@NPd;ioQ{5UirAJ~A>f!GSj*Vv@gg(vgZp^)5+c-*D>v`^@|HNv9atpUbCr9w(S@ z)mq?uFo95DW0a0waVI-94c!P=V&{ZHkTHQ;DkPJPj7+634QKA!CBFjF5z=CIq`)w} z#hDFk%@6mCdMQbWTW{S$LaD|RV|%<%Hy?KoOdhkS*R8yhMdpkv*3K;q={;uOw#x_7}2ysiGHK^ z>-}8MN=tFnU;}3WG>*fT2Jirkc=Hr%^FRAXM;2mKS5_upkG{3JaXVb8XLz_K{I2}8 zuDh$d`|q*FP>`7oj3+M%Huu*ha7-p6$gZxaWTU1VH@hlP6FhmHIQ5wrS$On!7v?Il|bD;R*n0g4xJ_8Fz{Bgp;aTo(pmgJGsT zJid&O2D1h+i6};)hL2+HMod=sG{6%{Ecylp==k6gV7ZG$fhgdU?F)_Qm!M_2RN*)h z2*H6$9dtTh4^?UI0CY+b?u{(MvEB3c`K)e`L7|tyb?XhvwPo^9de4k_Yix|qGO`&k zD$LD6XT32s-vEBYg?!+|U8*o*fKtOd>s1B=Gr@Q`!h?k6=fNr3gvcJIww5uO{4umS z{KRt(bi1r966#k3J;bBi2q#VzMM17H?Too8A0dmdy&#FQCdyb}V8jj#gC>aG5iXnm zfLC4qtiD+QS-^Ull1W4Zp2cBdwT;Z$&s%6#Cv=-Z&5XBPsMSJJ93C0j+1Uw21_gV2 zO+9mGM+f$2O%=bQ4j!h&Ff5Kk#OEUvKWDh{b{O`AQITIfcdp)5B!j;I-v>t|NHCDR zhCGr7N=D({*&q0YetiE9A%&PadK6%)3dScq5RO-SQdER)WK1L+k!_EIVF0%;;ir+r zyXOVo6XHoEl@PQ{Bw+;M^~mB6cdYw$SFk2gkl&cJb=vp_3kkHRrKQ^>)XmI@2(Dh6 z`Ptd_MGqryE_`ROB+vk`4t6WWMa9*)Vjwp3aQ zP|EOA?IH9h<>c^Y>q-%k4pM095OiYDgxOLvRLoXFc$h7nw4CwT(x>NJ5tMdR5CH zeac=El2bgnfxdprkoP)HSq}BEC$Gr_SNkxSrC}^+9M+OE5&rn2v+qT|P?G6znP^j}Ru^b#Y3IY6qfrx`cw8qLR zP$!Tf{qse@;%MnI6>2Yf@+5lT4eqSzX-2JUOkld+7od6OQ z{HI^tLxqg#nHe3y_N}6t%b-0JrqR0-#+ATJQo=r zV{48!UX9RCht?AjjtmE!4*-e!Voz-IKYKROnbk9cYWBae-P=iu+Xydq5(6-H%&y=b zz>0RS=4d;{p=J5_s8|DwRJ}TH>?0!|!OHWCL3i(tzUSrt`1$ibDl+J1(ONt*d>TkP6&^v^@!V6#MTxO!{O=sa4^6;A0`(7Aqu2qf=Upn3;I*|T2+s`z^5K}5cb=1xGATl zfwqTDMu8N%)xp>SeKD1LFy8=E8j?94(Ex4ekzu6{V45VGtm}d?#w>^d?>ul-qD=;K z!s=v}?VSNJKLr*-Lui09r{Icd|9VXv>h01>)M+hwpg$i+IP?7C6Bv?%ikZm|wlR>P zoo998^a}y<;<^D&)6o+r+Djj|Pkx)8Ms$Hsz~^AIKGIIZTMIS`(3U@NMT|vPu5R&H zY{v^6E?5zhho_MWM2zD&bA9<+CZbtJiAC7n|!m57w_6KanW zBe`PYu@4(%fRyBt2nt;6j+A1R6MA7e*WT|mc-j~1S)`ERtEEaHK+OoB9nG_6k!*X{ z?nSycLgZ7eD)Ma`#Q@vLh#Wu{NO~w6#{qX}dpx;)689UH&$@)&e$Ac<5%D)LD|r4Hn*om>A0K~;Q&dvY z@RjaAKKs-aJ#~RwpI=!iW+BHB)sX)hm&p(Gv$HgQ>?d0-9=d(uO#tl3aJ(LQs+%v` zMCxU*>XeVlGj}vktm^y4^GMowVy=o`+?e@dUr`Y)%-H_>w{*QITQm3)qExYF<{8XQ zZm0v~<_1|-yFUBf$b1)(AQk|kb<|Ge%GK3UR=tY05j_57%y#$AWJW|#Bb7LwOj)Gm z@1-a`u|kp>O+K+Blvwoua&=drpPm5?qQu&aoW5BPcXx!IEO!M&tSCq!%R%PqTBlN8m zxv#;SV1;ely4Hsrz}Fm331`nnzO%;g3S+3^w0&*HWl?5eoQCZ94#@9h*P29*j6#@J zF6Bqi|INcf+lNePRVfe+CRicZZZBQuE942b6=jAc5%#kvbISeu(+dkC9GzJpZLv|~ zZ1HOe)2Oih(+DC<$yADtT;N@mFMTT&LefD0a;HKw#YA{?e*txPjc4 zyN&uSks->)HgfxuxhU2lY%^q^v+oMz5Ba>}ldUHx+)Mi$#m9Z&fR8N+XuVH7Tgt$udwuryyGOg#;Tltj`_Vxfv)j{v`*id#g~jQZ6)uNFHTJQl_^mTV^V2+qDIV zncSQyLQtp#Oie$|{%Bs@;c5n_6Rb8fJ|>fIQQ(_ngMPB*?REU}3bm;bBuj<~*grVZ z*GXJRv~S=K5O(8jv9MH*Nvc2m+$BB)g*%EFIGV-{s_L(bOQ&|=r1GO=MG}L(ezsDO zh%GL8`SK!IWE4A8Vnk>tmI95}$9Cc``~z#o#+1Tb23)to-Wb8%H~=g;;L^Yt8m=@B zPGSOkCd=KK#YNE25sG?-02GYOgqTHCptH|2KMdig>`595tZxvwQ(yQ4u_m1g6fz1< z|8+#?T_nWCVOWr01(X?T2?>fjp_B!wTE6oFPFEozp^4lln!G5|y-y%zQ5m7GiLjUd znIbOPDyz;D<1Eb{+K6&7Zo7OXUUg=6c3fDf10z=zo<#wK8ky8_XW!5_BPiU|IlJ9VCm! zOPJ9=li6#d$c-Q|L@A3Sve{A$9b~&ow!0RuOo6Kx7(Q}_8*v?io(Ye7db!iZLbJ$B zZ|=Bjf#Yig(s&(uJR>H~lO`mQ4C!-6M_r<~^k9$>Q`FJQjWr|M`bn}ObM3Qv?m2>Y zBnBFs1~19&%x+?*jK$;0+iyV%T)90gp^Yj^$vM}=R+2lXVD0n|kOPt{Ac;(mb4C{T z?AVU$%RY?sVLwCXl@J{x{Qv=&HE;)*=j|q(k`?=1hvcTZC;CR@L9vf4BMcG3LLaEXi0TXl^HDVRg(%?{M>@j$<%a8@-o02x0W-sChoii!CF-kpHJ9dm$G< zpT_~P9y1kOZoaJz88;F`r;8>g2X8qFGg8i!2{;=o*JD`USOjjF^wLo=*xyM>JA>+h z?E)b?PZUxa)k#ViAP0RSK64#>gw3BKW<*(RV7}J7ux~*C)Yk`}6)b1e_**#z33^=rWH`<^BruSUYAL@A=`QF0GTx33>OFfX z+0_FvOpc}eAO{x3{2@rCqWXtwAeP0f=SE#KH7kCCq@*N(l+Q1s7COxorKZ+w-W-mKRQ9|QYZ>fb-o(z}$8 zYCp&D7O@BRU0$(R?Nur?0JdSxmR6$`nme*FHi86z^ zIcz0Ls;d5UeQjvHWn5`&SM~`{wQUj3YM;N@qnX0?`RBG#eq!zJ;r56NeM4i^mCJ4^ zaT~e(@V&#L4_87WgOV>I%X51PwGImZtIMdm|LSs)-ERI`AifP}9T2*@`MAnZr(`37 z?7-i)v(tK_Pw95^&n7Hu#F?o$BCp_C2mQ!K{N@oyK?RT5&w+Z#8mn5~hcS$#r1 z(0^S!3@$E6*!|7U67(2}^$Z64M^y_6Gg0lLRQY)*{n2Z}fzE_9YQo2b6RKcQWB*p4_>Zbb391Y_bN z_>34#Wwdhf)$JKoW>eHbQugPs09J*Y>MF?f4aRkZ49!LS$DB`71J9JP5nw+DV|q%3*6eA!XBz|n%52AVUd^!+QqVxWu+t%y^Npwp(E zaJ54c1^1hc+^PScdl_~x=ue5Lkq~NK(9??<#@1y)GvvDYL+NPl52%@;+GTGam6-?d z`q87Y@2ugfG_hEag58d?aavkYem;U95QweIfJ{cCJPQrb$nbDPkCN z6ERfK3qzVXx?WXyX1sWP&wmaUXJ*up^2(vgvzPTptz{bzCZW+u4cO2~Df_)!=txu8e4Vkwr4v zrjqJaH6#mae0O)WoUDsXMrbno@_JYy3Y>&afl! z&5n*L=>VllA%pY6keU|}{E2)Gbv1yf|A9{r{(HVB`mW&C1JN$VvO?A5=HwJ>b%9@H zH#$^rzAS-R+;l%B=e;<}R@*8~?De#XSQ4Xi=gNwUq1r&{nm+_RNSo&50zk`>pDyf0xboTd zc!}ZQ=g)$~hk_pz$T`RXw~*aHAwxx$k-0sn0dEGUt_!#3gw{L%% z{lOSV9K%K{T9;1(fjTZ>q6Vi7mC}4Y;^|DF&Oiky!3swVyhlF_k@Q|hPu#-7qCHXN z0$IfP!wR2X$ZPqhOWL!peV+ZHV8_HJ^=L;pQ0A{6DC&HGv5bCUU_Cn_XgBd(KW+maEe%)m;?{*ZJY84grT_Co#8PXFImQUEL{5-MC<9Tz>WPB^oqHjO)mOha$zHr-uS~Nonbrj`E(w|7ihM*HzLl z{Ii^8aH_I=T=wsZzkGp_m=zE!i2tGT5lf1uNF&BnM;U{y8TCsDI=mV%7+;3+xd`8)Z!2)>=EPn zPe$X(F3X^RAcSV7(y9$1)rCzjiq0%86ecaOyaMIx0yor-HVKIy3V=W~l87 zalsjjfSi3&T>M$pfGk1M5eo6?>AZn?-bvSWZ#**AE%T+kHq=@$$%i675ck-7{{j)zFXzYb%U`eU{2?1OwiUVNYOAU}_57!V+5jcs>}dI!=8B8yr~}I*RtE zu=@22vF|dp@5%gg+4Ohfs1?-!-~^=xEbIN|@1|Dk)?!EVV1kCsl_Td1Ps`R-m7a(Zx04SVya8_ol#6D6yjf(!hA4t+cy=}!L0C!(8w(3& zuN9Pc)NTX$8@loO!}^Td00if*}*eLBJrKbg(oJwd6loz+cs;-In$RaP1qvG zZ;=l#jj9;-`!f-m12nW)HT3)g3yyLJh{Dgv!^-MlVtahsH#(GHe$PIAI@)UhD?~ZD zJ*P=FU;inbSoAgyI^^RMG_llK= zjvwi;Ze-<9nc1$bn$I(3EZ@NZY@i2u!d?L+c|+wnx(su-;0FlLTl1^t_zH&6l4E0= z=s{3AK;nBqO)wtOG8}=idsKLI-&LB-4Lo%IExc+aNngA0LwNY|i-%7_ZtYKA&!+fs z;90ARes;*So2M+<89!5cD<+yP%<+Nganjoh68n8AGG#UQXPt8?$=_6GXpC6EIY|uX@VvC!WTmZaBvf^)MYa<(V-- zsmA#Xfepnrld{;0ztKE9rkQ?qf~U71&HJDT*~IQCF$LvqG#%E5&)N(9tT2oW zea||5$D%+Wp7{n zfr?>Wm}J;@yyC*4^3pSQ4UfbxcK_HqJAI$PzwL6|yHP_ba*2}Wz|-<8;zRG1_C#M);w!8WGWD^TdEqQY%F$rULW@NbeyMNh0XOrP*0DpLb-L>4X z9~ADl3B}6y>ywiQKMT4%HCtfnbeL<9WDo5=`Io3Ij$e_Wa%4+P|Mp}p{24loxS#Hv zsx|jj_=C&kEm~p_P#_#eMuXm1MFDy3k;K;G@uy?H=^8pOrC;78mpijf@+y5GkFFYD zwzK<(?(oy{Sis#BLqk4Y(U$M$D&@vTSwpw0TRA%&>g`g=x1pBiu)l9ILtgW+?oR#K zDW@v8`ua2vhA*$AsT>3Id??xi3ED^KHG5gk+#(z7ZPz?|DLv6A(5N`eIfO$tTJD5q z52E^G$Nt>f4%Y-+*2trATM!7nz8^TC4!Dnlh=b$qcM(D}gH}UjpK0B)qymMiRpusF zL59xsLqh*HwJZh`j{{l_dtL@z;C;8bxn;VwK=bUL-QuGY9@KqHcB4`KU-o!vr%sdn z;bGfZ#?{w8Aq%XTK~1A;q_s7f`}QgJ4c}W46t@4#GUvc< z32S!Q#C8-q{5ObZw%g&QgMJKrs;tZEo}VN{9PFMJP%~3z3Cp}b5-{Ni-OT7!bH2{; zQC>M!7LCkVyUaKS*7kjD9zkEoWhDcs`ODic9?rB}S;?i2ct4*?zS>RDlPb_Z^ztV( z{KwwhPnC%jBbU&BiYiI_B;pQ(G?W2q9RQ#~?-vcTAv-3bu2eQk1uyBa^zGeY{<~|B zTl8Jr9K9A-$0O|}?CD>twR4kXKbr!1^gv^B%|<(gvj@}ApgSR*lEBFysO!A4?~K{+ znk!{+){rNICjfeK@lzyNkkB1|L!t{0T{$`AfdpT#Q$6-fypng{3)rp5MCkv{ISn_g z+;su9^9S~w2Dbgj!Y|>61fF>xIoy z`u04Y=IKb>AOj*RItbsScmyhlD{+ljSjZCvqy*nXwabPJjb=_Ay&F7AiuR#S{7G(J zevI9@Me>&%tmL-qFt3g+T<&%tPAw3M$#!Df>gw4&IbL@3T<95(R7U-ApY+n4k76A{WDQ6 zLv7GrG9ZFzSh2SCscLaasldr%^vVZe^-@dK1WWY=$D2m|3Vg*h6bE?*SzE~OWRuc; zey^ag>xV+=wwSI9+XIH8XhgP&aP8inoIO|CIF#_`bIcR#Pc|=pzxDJ zU|@0a(-pwH9^B3~e6afMtw&7oi~IcJ-Oj?XVv+k<4bu*rpV!O2-fFISx#-TGQq8+g zRbNC;PTtd^wG#E-N6_Go6I9^Y?A)Q)?J`jM16$)-}#T%j4zH8F4*$6S=cw z!qC-$KsbF*;l}qPllP5Z{J=m7lq0L_jQ`fK4I1i@t0*fep)~ZyiG)x}HD9bOyT;o4 zNv*R(6k^&W#XL${g?rpH*P0bpb9{4V@-M$D>i^12XpYP$lWh@X>6mwq>~-XwXbUT% zBt-2}D3Uz>#iYh&770b;rQ0$y9QKUZENwb^dU`rKMm& z>6bLK;x<|_DetI+y8Npnb0wRvJvU2C69|t;&h7S$Ixl7%Tem3plUeo+p=Ems(_ZJ= zbjuF$r-__!;U!+6=HYO_M7oJP)Wzd>Q{Fa$5XqL$LJjvBQ8IeN$%xd6Yn3yiyoa_2 zn?$*299xptZ?#QjlBSE0<*gX}_tbPEi~ZyFZky}x&vHj=oIQJZY9H3AWkzYK*n=Ec z%~1Gh3x25)A?V+|EL_zes!Gs5C=yxiy?4wpT9o~@WrL;SXearj{Z4q=lVXE6C0>ll z%3Hda5QGjVzaxfWAf(khX<0w*f88+2z85usw;dfynWq~t+iFoR-HLf%ZOv- zluc$|_{`OhPwpR@I_OaK<;65Z1Sf?iZ3aJQz#DO)8@usgDOc$J`>d1!&3Bj~b_9Em zc1PW%k{34yTtL~d8+!QztWOm4FH1kGod5iM7Ua@pfCp=C&FcHt72jU{3Or0`zWIF< z4}BC$)&QRj-haitoSEt_IfvUQ=y*fb9Pp0TxdnGgi=^!TI1rytQN}qkd z_`-S|ny2J0)cxCO~Ay3l)W^P=? zv$Jx4>0i5J>KAOcD-;A(YLUl2MK6l-t_4a3!_3tIHm5(FBAzi4o6L z4A8qbv%6Yey5(@Ghmz$MSg;tiJtxG76x6Ozd&d}#r|m@M0YEztBJw{48xwN ze0%+h+Mqt)=PK7l{3TZa5=L9c2Zbq#vZS9S%^b-$#p11Ue$_firVyv)iSzWxmtH0$ zxgbmCq&d}Uf@AJJW)k@6(UIvIA@@B$1B%s2`_bC8lOAJf>8owG>)IE^+Xk)HH6@1N z0H&!#-qFU}{?T@$9_$)`wse>kf*6LUkW)?RGTVOd}8rc+2hA^7>eEk3(IMt za!Pjf?a{S$kR-Srt^vWRr=>-$Fb!x1Se|=n71Z6@LzbQZ)G{6^r$hm%-LT8Rjqa&V z>DkA?5pi&R2i9p5XiI%w{UJ2;`}@%^{JA)?1#XKKUKJWsP?jKtTxXSH>j0@?u%{C6s@g;f23?}s9kjj0Siey`t*+`Td_ldhLv;LMM1J#0QOLS!vritj_Om1T` zG=I*YKdPBCe(foM&^yx46>eefv zo9FLttxRbI(dWY67uDz_gIy>kTu1f4r)L#!(L;tK=km5gY0zza`=%yVe`!FBQ~#M& z;%_67iqY+M@pMg(U_Z?Vp-jzrO@Rf@z@5R1+H2f&wDqIFxT|Wb2O)MTSY0 zOJm37-|5H9%zQ6-707@zr$mu2!WtQG$Ge*hCR(OiuP9NZI<^T= zWDwCN-F#rlDDX2=S#!Tq;X!x6{=F)nmwk{_xB=Co5n@u`%q5Gz**1>}ZDbNjS zb>>_~X_De@!33P2h~!oXUc(-z3Q*b|Q`8~ync<4p#|bHUV*|#NJxlnQ8(Hn z4@YpF`||s7;wVE6{mPZ8w{NL>z7Pms8{hX8OQbgpd+LU)qGGA1uTR8(!JT-~XUii- zDzPlQ?D)XB_IwD3ot?k4j;xWTHSCTB6fPt}faEukg!}pWQ>&7ixX=pVHm*J(qH@^( zOi&(vWj`J+(NSLXzw@Qn<_Dy7`{#=xFQiqFF;!}^@Bl6hsV9+S-OsnvuQs&{*rZ8~ z$IkLZ&A2e@gZKJp(-0R($38T#4%9hXXfXn=qgIC`A`MYIdf0?&he! zP;_yE`;Q z{53}3mp{`g@TfLD@!H86pI2V~3k$X87g$2z)G~%n{&1h7Ov{=1`{&mPzD&FYrL1M_ zN2ptdo?Yvy@%j_e-yfjxs(f4%m=fwmdDa6IB|q3 zs(O#24h)YuCp>a05tIh*34jw7*Lre*tHe=J)+u}9@ZrUPy;{@r^Wh@G>#aT=Qd4uE zpI?V&zeHYS53!ea<`Sg}?mEM93O@ksu*}i+Un1Rh>LYgpor2CO{$08$TX6oZ#3};t zdS8-8!Yh{xW0S69lXjPm%IEe}1C*{>w3^tJ=Dt|{3kUvAzqQu0-hNCg_}!tv0B6La zBQM65I0k~d3q7};d?{U^xzc>b6^z4Go(AMc3J#++aHtTf1A?Qr;&M*VBdemq4d#)n zr0M;(8n!z!8pXSEa&xDQw-4um(rO?WKL-D{uTC9Oxmj7`0JJuDM)9lza6~^*UPD_fE&*>{AL$5f{{@8#luxXQu~y8^w2M^P*5rM)y)*Ww2fJf9OF43EL+{y+hCSX(BmvsMd#0hp zx=v)QKT@?4W!4>Jt>_jvTMAB2>ZiD9OLC*bnqDopbm&2jm#mq*d>t@wH)M>U=bVf?xAe8Sd-ezD$-#%Cd0MAd(Z5PdIm+d` zf4rI)xozQtJaPEK$vv`p7EC+3Z+=9}a276N>(SCo_}e4Rlfm?friQj!*REYB{`Iiy z4smgDGB~PBf)2DJhufQgms{mnb^jD6zlcZ;(8XvtFB3JgTo~95~!jrzsFCn}}-~oIl^_?OdQI$Pvke_1a6=Y~=k- z#qowN@eQ25DKdnOUW_J=)tF!68$TYEGXq@J0u0I?UVFgP3egsIP}%6`$SYZwFn1Nu z1ty<-jOCRpe47myMAxqV*l*mqiMvL9MR!Ge?=Pj5K|57dRZ~;bxuXu`2U}lsR+cyv zCNCQDbR@akNr=3uP<^7$T2+n_PYvGsNG6$eR0?Snu+E1)t3s`RXKgKgsqdD%fk2iM z`a?D;M@y`Js9|OdYeRNa4$UnC_oo4C%tA5 zys&b66v@3Rajk&W7OTuaE)i$H?;cMpG*c*)ZN&82Fi`C1e*BAMj|`2;8_)S1#rg1c zzq5mH8B~t0cFWWgnr@a$e9LXVCl3-+a9mNOkVq>i;D|y<@fCb%S!l0;Wv3|R8Bqe{7Ls!jIk-E3VGkNM}s zJQXuRnmq`Ob-vduu7B1H{mhCBxgsez{9)tquCKOAfYx7UGI7?iUDkeOV=U~9vj=S= zbgVA!azlQ1JXtj+%p;9QHMEgV z_-P3zToU$s{+%^brnrSyLtIWe@cX49f;UT>6jPt&Z|!W(W=cpncX94BUOv=&$P@!+ zt>=cTPyE*XDX}DfyrpQ+E(G0K*vjlnz_-<~^2JH5Pszlw^&r{_@Xh!d zeLz_Y_*1x~T+_LESV-uM*=Cr!r$F@|@UHp18M67~!%g0lw50Ix$=!WAFnvE_=@S{6 zx5x<~aKuZZ@SC2VrUIQG$XyA-IPW`B$`l7QLroS_>iE=bcL=|@lTd-n_InfS zO`?lV@KGWrU+B;w4}{gk3k*dE+18c`WapIfG(>v~I2aINhi@eY=!P9r!i|+MDu4n* z&*HCU>Z16KxQdyaWQZ%M*`>dS5`m7d*BarO5ssIJDJ5JA4L|l16F(?LgXO9Xg%W_i zeE+_*zj!(6oT1@;o)4sZ$QQVN5t)@2x-+#tf7pr}drx_-RUo_OCk${Xyei8K{`=k% z1{X3rK0uQ3dW3l8$o$p-V-e)qc*&`za8_CcVEjdEc9L?5OH2R8Z+9kiQh7=|NrV5n z?2FcDo=-zVUhs!cJ>gn|?SaE;Px8B_!(U#vp5pZ7TRz*idSeYq+)h79Bt>0JKC9hQ zQ-9t`nXvv?s^0_L77l??gs%rw>6pgPo^;#zaf6CBu+$uW4Muvlm@Y{)=fPW42k&(Qkbm| z=gyjV{pekN$9O|R*rnQuESQXO=e9K3&~V1YgguR`WchhO`P;sQcEOT?K%~;3^{Er@ z5ij0W0SBDNHqSq!x^@!~=9-#KFp1HbZy~ZEiAAf`C*P5%9#^1Xx)mPyr*P~g&DA42 zw|Ra|L2jq2V6tRyjB1t93tLd(t`PU*FI`TW+TJ~k#G4@(0fvgYmcWnakObw*$pj-U=^36^Au%y@0out7p}A_mwBA{6d5Gs)WG9}E1`aX3DLBQp9gR1u|Zu}K5*>;uPXiu z3ZKVrFIBw4fJfa;AEca+|1O>4U#*Ul`Or{JTi)w{d^v(<#Z6|FJ&tEUcB-lAiCxX* zJ3cOl1O)2J8a10#9Y?P|Xc~z|?Z=JI-~jAF+~^i*Ua=xrS?<41^two~Fn^mcz7q`f zUki=LHW3>8O2Ntp&j#lxNtefZgcyJKs!!;=n-MFUd((-^e;NfuhWpdPsvIM#^|byU z5sMzYQYbU=c3T^MinM)GKw#`ibKgfYDr(1jG5@lVnJ=W?M-v`1q5<%q#o z@e?PYP=5*+kcLEiu|qFSQ*<|8BipSo*>~doSGr-bD^-Vs>D$M1xPQ1;ISeq|Lcu`s zoCIZB2=*nXJk44?lyL|JuyW;E)l_4QUwi*WR!4in8`5PA4xwF>Z+X=I?+#<5gv>m| z#tv8?JgU4qkHyz_kBpc>kE5se9d+*U&^z!Ufk%Pa|3%fAhg02eVSkf3nPmtenUX09 znL`vp2$@CZkR&8yL?JShsZi!*9x`M~iX>!+Bnd@Pn%{eS-g8~=>z{MZ^Bnfxzx^H7 zy4Srv>umOgSMA}Hi;+yc$MyNUwl0-pmsbF1maqv}-1~cM;cGU8AT&x`Sgz{*OQEdY zl&p~Q8WLgL6)_B!L&qS)~7?=Ps;;tuf) zjR2@4LL|-#+7m$)wmEPv7+qHIM&iZ4&u{>hOIx_;2CPw4BnBGZ&k zUxwh(by&!A<@i|fIK4s{(BAp^(Z9dQF)vPz{sLy!TaIfeb2JzRe7sq4|1T=gdc}4U zNl2}as1&v<|5Sn2{rEU4Is{%*nU>7727)a*;Rl3$D(U0Jlh547)rO~~nrE<;%sl^x zBeT1}g_>g*s9S`gGuA>z& zvV(Ys^(}e>%)j#Hk;}WK6bNqRGTjC`P zeN@jJQPacLK|27Z58)2RF9gFofB48pA&(fHJN4_NExlPU>_`6=?Ea$-w=7G{1V-}! zOMFbxY+rsT{R=mcslu$EPR-XRHK3i&JNUr{uSa@Y{P@x##*F-zqc!R)lmCfEOrB$S5)O#S&&Ip#i#kk59QbF)cZEHvnTllAbbO z`ds$G;o0c>mQ(xAgI@d?MPJAHFBP09{?IT{ks)${E`fy}WFkTm?b9>`r(Ry3T`R}V zi4>Bm{QZZu%6U#Dp~pY?&rgV)-Es1@?kj=`{1`VUqq)418F$|Bp<|f4QuOX3$I$c{ zpg&REfr77HGJ+nCX)IoJG5-nM^Q_F&JlWce5d}8u?bgo)o}>gcm2@J3^Xg(fWqD~n z**~$%-lgU>kr|(#A2!}*+CtPVu^q#!_I&^RMnzI`6(Q#V?p{(`Ik*}L_ZX`SEs4(AgZa9PPy0afaVxtptlW^vX?fdSA(z8=G zO!;)@ zi&rqsZKC?@2|K%4k)kXdl&PR@e;ThYLQuIlC~c2fEl^{+S>IGV`umfJ%ui00zH{&1 zB0$u{H1$AB{xS<))Wy%!e;}Ce56ZM#w&6eWy$-w0OOCc62NnfwO?`c=f$BG(qhLXy zRe1H_^tORUU11Rsv`?UI8GG4Cm}O`o_0bfWk(w|Kl_m+F{!#t?wFAi;SCkL?Eu&^Z z41;9c$LTT z)OO;(u2-k3P+;ue>P-8_(kQ&s^EQWZB_}&0q$(&lBEW=(%}O(`1&*|BFL6-ae-y>Z zsY+FKLg|1KwFKc6#p@M*l^;|pf?E-r;M4f$GCt(VR(+FD`GA36il6Ft z+P4Az;%1T;qPsXZL%caYZSW=^-Th*ij;zjhTbs;lr)$cBXTAuWcY@BV$V0!C$n4a_ zyFPRXr6TRmq?Ny;e@i@}@>jY}LE3h#(}_8;`JZB;%adonsjO@d_FW}@=U0ENynoNs zkpEBDfW?t>;KN4(p>Ifew~|Y&J`=fXAwMG(8PWDksD$8;DPuz`evsreS$A$Da8+b+ znR;ydweC^+T61zQ4MEk$({IRO53LrdY5KCu%r+;-W($tIeb_r*Yg0H%MMz^-TFKqdJfvgVaJ$|1zq-#}v~A)t z#HEZsiB1Ep_3Ky+S~t;lah&SB!(rpZ7OQB1;U=0&3P+P|yCwI1Euj6nDRx=UH->Z9 zwG}Bkf|+0*!^k*iHvb*z{OCTld>B%)^+hrlZg;Bn>#kYmG9RbXz8bP(@(*Qtd`E1(2O>*@Lqn;ogsLd{)Iuv?vQzn zlV_IH0{p(IB$2h>Kj$RFE5Jadok-ic8H2x^LLAE@BLgUsI(9grZLJ_cVNry#W6C|U zV_iI}m$mANXk1yp+%azMW1mIaI1?`uAJKg83jfa7kujz+iEw_#FN49vwV647Hn2}p~nbL7i_L{cI{ZFulUOjl{$H@Qgn5jd5mCK{}-^*_vPBkjJ zQQEH1Q1ouw-DA2W^p3{VV^27v-PTe{*a@>GYNQ}mI8!O8l2kUU^LH@B0-p=-N24Dv?>HT25@3(Lf-W^z_zeL$ z0-2_^_LaLV>}LmvpP8z4PZ}o=?`iscgXl#sf*Jq)>SRtHRVuzP+e2kSUs%&mv++H3 ztauXYFzCPin=_(etita_=WRh@EHUPj%mS)1Wdeu(9+TmN}@Po32+HYbehLA z2A_$18Ez5tkTNvYiQbz|M<`X?cL%r5!_o#T4TjR6f&xsJ7hA&(qNRNe|0rp+h9x{n zkW8HsJ7-KNrDM^d41YMGcX(Nt<$B;v1DCP=y9{OjczZWYGWf3HktGPiWMtilIgJh9!Ga?iE?udfugG|p7)5uKJPZ>Sx2kOxHOzH7 zrH|Hu z?+U-RE8_k(9}izb+<=qGt4h)JaX;_2xwZfHx(qSF;|p&OVF<$|(jUTbe5~lU&J9|l z&TY{Gi{s`pE=SML`?-9TV?D_$9b;0w_hqD{%F{<&Ux#ImpVlpwIWJb!Dzesh9bZUR zlD<&W;SUl$I)O@(%Zg^IwX%3aX?<(VK6`(?JaBKw&b5-B;uQIKh(I)BaJe8C!_AV9 z5dt(d%daT}dhHYv0-XCF zb3H%)<-M+c+i%G$TJN7H4Wv&vQrNUjSEl>v8ntA*^et#n*~fI!GiiADK3bjRjg6%4 z=wL1GRO8X>YPmIlwa@$h=ecULQXeIJi1h9c-g}hh9L1OtI3+TNpFj6l3zRGI=6cT1 zp5a)f;3Hrk^D^RhjCPvpzDoxh6jKTlghloU7!@8#XM0IJ-4m#XUN=#_Xd;MZa`Bb8 zaPwG`hb$*2h&XWN89X@ggT~|F$!^1dCsh$tA`w|!(*jWo?^YS~_VtbocEm7f1jgM_ zklTmO+zO+2XRFFA|H_@njgA<}3yFv+jmExUP?HcmaaKB=L0utRe8qdPy1MtEW}uQV zOMafvIa8mT#&r_)ngTPW)3^T}5OAbBD%dHI%1cwftj?2K7gn3x#b0lEYoFkkI}yey ze-1gLKMv&|gljh!Rq>Qd)%}`UDk@HZhZb;g1*N(F#gWpZDI|mtndpecdm^uww1QQ* zsS6@~4&oK)lad&vb%&W`n?m|cea4sPsSkGY%Ure<9OQj>d|a&1!H(j_Ad8N9$DPAm zjPvhUTx&#YGP*1Z0v*cCR|5nMYhPLk`kXiP^sHUTeXw09G~^0jx!t25Dz<;qKJ_8yfsFdd%iIS1E9zzGY!y;f=`sPP8eohIj5Y z{`i9?Qv=sb6TlY}fBxcE#l(#7kGO`aRw_z~Gbd`~1gRSvSAG4OP8TUf^vAJ||7LVxzkO?;IUp+~HT3G0VDd2#x4fxU z62#GcTDSJ9qA&at*eRy?y>xfQGm|ER1yQ6al_Ru~(eGXJ9hJ&(~jn03Go6A3Gxrx+Hkb zDwdPs0y4$>9*1&yWh+65YshD@KYgj z(r-P?2j-IOzH(f+Vx63>K3@Q-XiNI)^tI#-oPYlw?1Nh=DR2LtMGt4m2;e&9H=j-M zqH|U4zH^3kb++G}R|CXiBNVC*p#KXnFp#-=SH)@2BS#g6h?VH!s}v-r9R$@{G#=Dv zfm!*^OU|dExw+X=FiDD=?JHGSNN^J|Tf%jwknM?Qh<>ZiHM8K z5{-}O;!jxgQq91wDLjHte``?Y#_5}Yolx;LSWXWPR(?FHeOjz{r7-UK!YN~87B)8Y zWP~Ri;h?@h!%Y@17a+J zruyWqg`x4plf55wXxL!TDOx{zVIwqWjD%qB>F4(fimZFBmmKW38v!loKNe59maEo6 zHgxzpPzXQ@VQ9RL&Nb|W?1qo~KQU_%w@C(VBg;T*kg$xN|G&vk=hpDZ z(T)5laqqH?#l+ zv#^LM`4uXUGH;?ldK{j6TL$y#K(?*LB^^=dlG+b^G6-6X>iEj<-J^c8SV-m5)Dzw_ zXJTrK=Kz3Oc)O&Ol%b&^%vfo0+s}{@SJzDVK~2=yfORS^1}Jg|Ep3`^Ar{(QqdvS{ z`~`fTG}5huD1Gkh53iL-17Yx2@cy^c(2Tju4ttle4_1loCnHtEZq+XWD$mo+4Y+lz zu|d0_jnGMPGqO#8J?_;0{Sp$`B1hwSU{y%&JHyIK%(`@YlC6jxuY?e_{}Kah?;1Ar zb>KVs^65C?Ajb=BVHR0gS^X`n9G8MGM(~p8%wm=|w?D&%4XRSQI7=*rYxR?ENXV4`dlmFz&lQfVu z32n#Te*J;@7Xwb)$w&`S+9C?FPg6O8L zl0G`5(Vq;U5Iy~byKIZK1kQH4m`h&P*wMCGS_NR3!C)_=2i5%mVo*YeJKHslt#dgO zJN)YptemY^lQ2e`dKN%DfXo5M{;ro14n#}Kr!a5FZ5QJPWSYONXUV%GCy(=nle04z zvt`(=I3xG}E8hNxC|{hphO;}2mzH9iP9l(=2)Oaj?$y8E4!Q?2gh3EW+qx_fg2`v)(Z)(NjT|JcF}HPSO+0N zX?3&;IiX7%cxgbY)-vi7#tU$&F#xBUXMpDFhcz{rB@7|1X7Y#oyv3y) z4crfNYm(eu7PtraZ$|f>u~$eKDX6UUa&^6rftQC4oys#PZGUc%^ZaO{K$bB+fpkpg z>`Z>+b_AtjJ4@>7*!cdtR|Rw+b)f4wzNd5HD{Krn*j{h%Cn%)s-xaC~BK#RZ$fBaG z#7{voM=^I;Ews!0QiD}|54J(>*a0*0F?T;THNbs{y@R_EOw8l`Eas-{`pu5z%v;bg zi?OBpQgyKmz#@YdL+sepLm${#84OJznD;Mj;KiG!^oJj+=LzrMj~$^)S#z~*|LuO= zGE;DmkoUnUixV>S)-Bb5%jCotk4P{OM!&l5(W>_e0&t4hK0m7t5f3BUQM+!X_Fb8L z%}hmxX0-o4dC!X9ub@`Vmc1$}yNfQ0#DMb{TDt?+EVqEp>lMH1agb#9u+TvHeCc`+ z2Z%!XK}w&detbmaxMS|MSl>m%<{)!hy*w3Dlc-MGgVDlHbg^CcOG_U=O5|4XExvyr ztM>r+OP>%4cYLgI5fzn3ki5{$XDf;EDHXv=b z+oD3Ijp_{Ij$y{oNW=^w?l*IC9@%wXh4PA~W^CmzU%nhP3&piY=w(7mj83kSlI_G( zuQCQ*L+Fu5d)N55`J~~gf}zsv!y?r?gI1(*W|W_<^F+Xb5fItWuqm|l&d6`J;cN|V z>JI^bY-B_aempulfLIVIzyeYj{)AWV9$w~5HEv9JT){wuT@yuC#8+tJBM@FtTzrX8 z0b81d<-=0=CN7oEpaF= z;X4|hJ;Si|-8|sZ|J-OPZW)}qwF|f^4201nO~<1+_WHHLfdePa%^ToVxPM<%d)aAM z?}{|0gO%Alf{m@NrUoQ8XFrdu!#kP3C5&?ZqDhJ_y_uELC%J4%&#@ z**Kqfk|nzsC}UkU=zX zunX>t^$w^*PcD>XlfN_YPnQ6={b1bPsal?a3LqeK9T?r4iE0$1Jjn5Y5-Y2`JVjdo z?H{P!pv1bmkmSL8iqweQN{l1)To^omIJU520GwQmP61aQni8UJ*rDj6H2Dp6bo#=C zSoMZ+ry}NnPY~tc0ZZFF11gp7Iibh%Ul7c0Zpz&zc|MLF|Kwu}mhkd%b8w(E2%M{U zYHD&aQfv7I>}Q~dVLuXP`RJ;iB6Ufm=DYE8is}U-;3R-Lw>S z?&BQ`Uzy)5ef@!R5e?5s6~x8kGOt^8p>hU?-?)3BFr=f|7CRZv0jC4%+V_kRB`zBgQmn+B*sA#=c@e>ah+rQ=sH;tHh2v%WrH`lZvw{H|lXGQyCeqN4Ej znZ^rC_H3AN0$w>wws8p_*NBYXZlwTR<<8HhwiC>@qyPNmNoM`exInk`ss~(p!{Vvi zFM>AIfO`TvruCC_2{>TYXuO892+T7sXW}{$dm_4ZoKK3M^tyZ%zLakp8z3P$GkK7M z6$#koptH=3hf zyOoK6#-zSgMbna+M~@zrm(vODzzu?t7ND`655-rGs2)(k0jEq|LHJx~B4J-=THxa3 z1X=)3NIB=ZeHF?>rY0u176kG@hyuVejQ6GM2K-DZs3e2)eE0;>TUo;!scxsKN&f7) zpuQGZp6R-#hKA^>xvu4aKK=5;gsX*R|MLO>?sFtBp>wwP`SWS1qL&Dy*Xq-=xj|NVQ<4Qkclhf|&s z`}TDv`P=UJ4IVE7Ds)S!9vxw`_yS@MqH}bUx6`v<&hE0i^c}HhcE%o*m**I`kIQR@!+zmn(-eZIs^=J0cE{)) z9})aZt9K;PVTE<&XbvbFc`ogTe;Gc?5brx53J!Vck>jI6BXK zo&?t+;_;`LZGZf#PwMMG!?uB+^LlxT2{Bb}QK!8*3z<;bpKD5RFLaI|E41wXT_ioO*Ixvgx}1OgZ1M0fyYRN2)W9jvqLN z-*~UD+n#i+{5&cPx7te1qak5m8iRrNg7;F34o_Te@*4SsaR z-+!|$bQ?u@=ztTraqi;}?thX50UhdqI zU(?zd=oZM$8T(|cD)K}iwBxJaXAzto^x`bFD!wWrC&7UEC%ZecS-?T z3xK7=*d&CgqJgZ0O3~SMPmCVKYQVkr<;^rPPN8c3`_N2Gzvv_{gL92VjYW1|;NP|{ z;gg=P_^BYHr#xRkWyn@CZOn#7?7#=&Qr}%_9tO+R!GlOdrl+R?l`rfxPkX-LP(6Na z#To-u7|2>%xJMm(o?{j?2z#5mnnqkl7JU((Z_#UaeCOfj;zD+Yn+D4O)p;-JS`UjchG(2*wSeF{@56k)m5UAzub)B6ia=w+lTvS4j?pSXo2v*_f)08VVCn#d z{R}x@r&CMGnpgpc{NY32XQz-dFsjR?aAH4H}%ZbgmP$*Hik zv=o#`KR?-x7nE=iRkd8dYa|lilbMmx(b*HZ3nMM#=bVK#N>>eDz&a?1cP=EPJGwu2q_e;r5{-!%+))Kv(ei->*i? zo{yz^1jE)i(wcMR^!H&_kjMA~a*4CPzAx>o9zWZ2QyX3*N^(MF%KW=`GKUU9OZh-l znEEAHXuywyHLaPLdw>K{2dfDbK<(vnPGru%l2cPby^gzn{c)Ve4tA11TX~vW3NMv< z#b~TXK1g0U&rbmne0Jrf7;u3}zRocz;#QTM?k+AO!HN0B7+g~@RBT$}A$!`A+$^;p z&=9Oy0Va;!yTSGwI#d|fW#9G67$K8%x;uXC?d_3Q1OznV7yGny?i%G8Afmtyfd|4| zEXAVi_Bp4F!gwAf5cQO79wFhupJV#>GeUh9-7F!g(2pSat$wYV568BB7@_V1${So> z-#YhF0p6OfE0{Te(;Q7jTl0r-hJyI0!Jkn$_p`kFy%Ch5_#Wtia!LDuE>fJ%s?nJA zy!h68-CxnCA?x`9aMn;u=%ScU+wvJsdS+F8S`EAOCn161X;hDMP5j_I#GXIZ zNJ4Nk#|{CE4I2ZktB7@I*^%G$gH4CzDyp-6-p54L#LkY7#o8Jw4Fi zPuWC)0rQdreV}s|2?J2_0u7*m4I$+iqpS1=CF%sxk zbf$MX)=eOfnw*7}2_&X{6&C8`T_ir>ewB>CW}o<&YloO$A`;$D54{t)jy6ZgQ!2$W z*X=5xJk+?fns7AsNi%L(Kr!my$i@oQ^>7w%bBGh&!VDl>`qcNW}cT<{_3s9)cF<9ii?> zDqS-4xrAxY_M{BErnIzNe#ZFF>zl0iqf3fB z8HL{8Po(ysOzn)t(Co1>cKu8Y^~y7lQ&RG%u^2Y_B;V()Yxvglv1XFPfyzx6`>rABfn{b^7OP>*|j7&*50rW~&&T0Pc0Bjig`*ftjr5B<4cr8;kNqlBuR3 zL_Fu}3T`+I`Z{Y`ItkW@l4A)rIp+VRoN=AA&@3DmF29v?NRzwD%JW35oI!0pleg~_ zss4-kg$2Y3G5MHDwZ1p!dDPMb8dzaPf|>&WT2Ni^TTGOJQg)-HFoppY3%t4ddUn3Y zvtGD6?Y~~HuT_mnZuTl3Qm6F(@dThrxbY7gk7gZBz~!S{Bm(pIQL0&zL8GS$kV%ie zVWRvFa#Pn3tdJNa9F%3%RZz88KJH%H`9p7;tA`h_D=+#qP=#qfwGm<@@)->*X?E@2 zE<8^`i0<0*UqjU+?gpt{P>1eN(a#2=cN*UIoaaTOOX$D0FfoZds!vhEvp!*Ej+_NZ zZ}{=yES^?fF0bSX=Xk(==N2le4_6 z?ECM(yp>2I2G`fo;;EGJhA64@odFOk&j4Tb^&2-fzJH%s`G!mcX8u{rcSz%S#tUqBgW`0V=_Gk_ zeld_RH5OK8X3-2#V&PUY_Z5>U8opMY&TPZZ#r0VJl^k+ibU6CCb;ZvqG-_c$1hOx` zCO}5%ph5wS{F`-Gs#4ECyssZWm1hR9+i(1AU@_t|6_O|t;;T zI&pif)e}n^fB5amd5(s?S~Ibs1XO0wWaF;l{o81{12anSHG7@%+#33F>zLzYaYenv zYCe&q`-(Jc8h~OTp?Tt?h>C$NdFQs(Pj86l53%!etkMoW)tom3Go#o^(m}FI-i!T< zNvTU4eitqbjGB^jbhKiAcUqjC_v*a#!;(}u@Nw;L@|;ibfEC^79@^*7%wQ>gvDL64 zjX$Xmrw)#Az~iU@0>H70JolQ0u_)`akC-w8XDCpJbrV*`#&C7+Nj`=#U*ppMv5{55w-mpuZ)icvS&Oe7fq8!KcZN&b4_Ulw`;wrVc)k?NjxrwfKO z`ey=KrlJ4e(8BqO(KVRm_~vs?-0Vhxo2x6+94aBQnR@7>d`kdK*I5SE=L7+rVHxbT zr6W(~)+Rmcdgg%tLVSyV|M@$Z$XK1YfS0y2lQCusP~q0h&(F7iMk|*&fJSPIGTDqD zdO;L>bkJOhY21kdpr!TCqjCXn0xzJ$u&C^ zclWeEHU6#%xK0Sm)#J+>0XV?7DuzSfp$efv@!}p7EUV1?-__wkquTQwPS;e6GBkR| zO~50DIMfQlYYi)?^xnYM^vszX*ZsNM{-z5F1^AoxRqUdTXZW0t5)uZq6Hz-vV2Xdt zqKR@DX8u5PuD5aZz*Ec@cI9YoRpVUy5tObgtE`N)orZ=c_u|Y8vDw!b<~MwLtRB8q zFbZ`X92r4Ii4OL3Ix+zV>2wqkkKyO|@$|U)IvgTZE^jQ)3(!$_&gZphyHor)3zx+ zb9f54nrsyq2&&(P%}Z&x@vhf)5nBgb6DV?3<`gjDf)R0Q<@O!b?cntG!NuJ77Ii z<;fr48zP6p9t=r;|N8s)X&%h#Qd5LO3_+_Q9SMO~K8zRd6wv~tb79wKr1OwJQ-1sj zM&-B00%&)XwhsSj%i^tT@&RNR;w2E8m?(lxV4`!)g!+N#mQWbhJO2g$4!SC|O~gQ@ z$247PEYOQzW3guDio~LRT3lNkALHS}m+rEi*>|qzy1aI()}$QYMhGEC8OcX33ub>1 z^~zdMh;ZZ38>WluMD@s09Ge}Pg6qM_REqax<88_M{5R3uh!pzU_wR^%B)Ol7QUaAn zwYt_AhMr+GGvh5FCB@q*{m9e5@D&=g&-wE}GT2Aek@g{kR<%zRfz-;zc7U6lU>hm2 ze?RJ5D3{6Tb$;h2*zU(gimT0C7Le-69ps{k;qMUNiSpjm2G9=;{cHR6bfc;>91R;O z&&U_|RlY^94o1x2CBaW5R!>T-aGs)owWY?IN@eT!I8{?pQXa`OfJ{xq614dsGhk+B z_G`)>a6-KntVsr{G&-76T70AAfHvaWJ8^;@1F*K|Jw=&In>DDiTthvNq39x(6nYM; zKgJayzcXpMhTAhl7v=#RBeu2#KC&`SLK~-A;+-i^4EsX?8gpTD>PdLVVVUW^! z1Z*m-6Qt)obL}3w9HiG+w;ml6%-48ys1;2HraoUdz&&&Yb7i)aUbF2ooEXdVX=!PX zjuCOi;|n^&z#}wZUxfh+sr@DQ?*m+lB1ST$t8^*RHPmkFb9-D45_t|BP=Ji@>Mg&BvSD|-TjxQr&1dtEKfKg*Yh{@GLgddAwa{s?O!F9J7 z$2-4M9H2|mM1q}gN%6L>po2oz2*sysgnMC=pJKY_)_^ib9EqL#=JQzvu83SgRMSEZ zYKf=q^Z zu-8n;kh8Hc3kW2huC6E)4eq7lQu$EVB#NQcxC*dV-Fvl51^JWIO$@F`IEMWh40X<`L?Oi(9r>!KdQ`D-QyiPY1>W8+6qKua)mQ>YN;Mn86x z(qSzngGNwMfeB4mP&c(B7QIaA|8Gt*5{gKE-7_%oaP_0)NOe9W@woYSVAujQeH`?V z^#>~v!t+AW0onwL4mOB-p4SvqhtY~rXBn}b0y|ZIs(D^Cv9BJ7R4$-{WW9|~pKX(h z;$GOJMiUGY0FxQ$0vs5H0iR#UU~K7sCaxNk)KPIzW}$&IP%2mmX_c5Wifq-@UuW9G z>7t0pg8md@KM98NEY`Q(C+F@r1-o-}Yz)N_kR$NDB!~Q0{k1yiOaa+H>3N8FNW4;r$wy5ALh#m#3$dq>L%BdCh?@EiLqM3Y-riY5a?RbsCp1)77f*&6vHZRk5|bMeM*34jQ`OKo$X-p% zICPLH(LE$W;Li6mfjPf^&2^lalpe?5N&NL^bv7v-0_*$f1K+3R&wrL@xUF)9hX8pD zWt#}15I*k{syZ`2A2}?641>0CG%PU&`KVP(07P9Bm&c|!?IhEtqqPcf;h`Rf(KTvn zYAD3XWr=s+n7P!{5)lzWhS=J`Kr(34tGRsCv+^99Lo$S9ROO_;16qoo+($s%CKOw zlaYD3wjFjRT8iNnUMhZh`38)g;lH_#76C=Y$*s3&9f5PZyd0Yv?J<{su3v-7!n5=G zE-B6%t8~s6L|y}TA9;%DyCRYx9i4`tA3m_wV|jbCPEdYZu`gv}XLo)(ahH#(1ChsJ zzd%|X?+q8x=Zv8`Y7Dr$9UUFX)KKTdJ*F@(3P&~s#|tk6RWO)QG3+rOp6vv zGFonh;x+_K0)fg7|DmgU{Ri)JI)qVw&|EdZ-9)Cg`ST|Q8JV1L&b5jD-Qn%T1T;D} z7O@rpL9mA@D^E{-gywkrnnf8Vqv7YSu&985fV})TsAE&d>;evxsbSVq)t%6_uV0sr zU6!=ER#$h?$jHdfF0Z2EoQ4M3lX>8NO+;D0t-Mx0@ofdQ9=^{{!2lEE!R1aM;ENX# z5qbXzwjf{CW5;4NKcA4ed2R;|{{8DcUp!KQ*GNoCij9d8j>)G#z)p*J?R{$H3FVX0 zJ0c{-#h-cq(4DmYi$xROK6doX8E}qUg8wvP+{f7pe3y^05<^2ntxD+&_fgZ)#of5EUtHYuo-s60=OWm*gjwW9PDc4Y z`tTBmJRt<*4=?U}u@5(Ts)UW~xDEr^&&H*l$&%%rwvz7_7LYSIRjV>!tQn{DndrGM zA~Bet{7@(J2tx#rI?;@KxKbgw;El-xr}f~04;ptrncg`Mff4r-dcQCLnv1;OeC9iq zZbcVL?xUk%M4&hp5)u*}O~n;VG8g(`<7f5R=N6V9I5;^oZrysfvrN+Js&&PqpdSyk z3i7@)kTEhdJ1Dc3o^|LMV~uB#a^L*%11*tB*$f?(m6CNI!o9ii&0=!g1;eHIgoR;aCKsgtsaY;&Qj{)!N0J+m0pn@u0|>`CpHuxdQ>B14U8$mcZe z;jy~d#gM^4gQVKzp1Jf0tuEh-v=p6pkEh-`cDL)=Z{dQBli;#nOM9=u5D_1L0%yp{ z2uz2<$&dt!Ji3)o=0+}$6p^?(+2ack#=;SJ*9e1Q(|(ijxqEuH25fx9cnmag**iE8 zp-b4bkQAFVO=!EdIyyTC-sm7b^;27SM=Dcc*^ocH_|(k?#ljKSI_HraZLL*=!JdUJcQ2as>1wcGX% z3^=BzM&VfC!#ct~JaS~|<40G8vPkO+5WE$y{0)Lhf?$iUpM!$~f}vcwc;RUVE-rVb zYgAnkk7ut1NWw2xT1u<#>~WvtcH;z}((0PCyZd7Y8=<$DTuIv>vQ2tjTRV{pXUJgQ zk+MtvA~DFEynd_WeKnwv5!n3}#3RUxlV#-C9JT?xxSD$t_@G9gV#Skfc6B5d^q4gkoXg;YZ`RQ}0l=_|}CMNc$N}zIv&Md#r;N58V4)$u-QK59zrJFhMaP{I${US6bFn1c zdq1u-JZIc!Fy)Tl2XN({@yGfg6%`c$Q(lG{`by%8ZyzJYku2k!fO8Ayg_~PR(+IZe zr_g-iYZ^wUPrJ4Hj62H+3JB2dR#sG0gKfdYhKY-o0ICrVe$hVH(@ex<8d2{95?q^<3{B?*>T)#>qcZ*YPLB zcKFSF{v7`oNAQwVwl6Bp#>TgrYTEF$bWdFEoV`<6i21=gSy-?Qn}{27c!d2%Hz-AJ z@hWNzfHYW@GEvO&qq;jNL=%(08kB1tiFvy~w+slazOAHPUT^dN7^m{XHT>B9bA}&S zISZbsF5VcV7P-@SSj%RQ!M3^AJ&en6hckSEUk6&N6)eBV2owtlX zzHCYsagEDL$uR-CCnx8wTcKrSJ$yH{sQA!zRLpiD7+)MIO_tgQ;9g{R7*d)irVHfqJZ zc2F+;pBG@);5MOviBLvPV~X%6x$duInL-!>$s@P#X=zaY^rGjk-|;V0YAikM8XrFj z7sN^bN$w8jU&ybc8WUL$5pMAC5E!aL!s+_aROybQjJ3L}d{(OI`xR#@V zv1mWbPivLEBQ$qH7`naXr*FSB@~2>EGxa!GQY+HCPvD7AdF;ZfU;30!L`0=TPcg5y z#8HnB-q7cS+u=!9vf~1mZg#6KWS@vQo1S28ZU1YVi3eJ@)MtX1t;S66)e zO>!z0wYYh3^VZ32~n(f1aI=a*k)!kCqZ*pn7sfjB2H~BFQ_7eu5=D7vj zBFo0MJ<|$gZktPDyc|8&8qqs&AUm&gM@p*Ug@dXU=QZd^RA~vJ0^hH;9o6&6xOHE$ zWHo-#-4op-VbJN-#=!QIJ^-LA()Ch*(Fo+$@KB??B>iUg=|L64UfiGa*xQQ zR4TWNFYIiZ-&9yAs4J59OZW9wdZ9|#_3~iNeNhZYuyVfs(RIE|!NeruqH%F0{m?vf zKOTa`q-S87=P_tQs1+hmg5g3>Z{AC>{`|^cnZBCHWDlPk(^E0F0edV9P}I1oNTsdn zBODg~H-t<1bxArD37VEtlV9%`ct3D{a_*nE$2FG@L(l@2wl* z`HK}=JBt0941cvOon;F~4O!=N^RqrMcj=%?uYTx5uHmj&8e6?&X3d{QSMyxW_u3Tm zHw_q2ioRR5;4|^b*45>o`$;moP$y8@wX|kt@G==+Taoqw^&|I|8+9cdKM4@{-o|$Q zR^45`J7=zI?aWb@ZfYfQ|n{`wMWW4#8e_f?&g~bLw^-rqK2XIfDN$2FvCI&N+4#@)}Ozq>gTi+~JJh+7X&w zSFaPSY%v*9>N|hwq0=T$zw@iBQ{PmX-TNV|q2v=eC#`B(SlRx{yL~eCl4=R}!h6k5 zpBJ!w<0+JzyVm$HBt7^^?4IbadaLuZLEqD!k&w6>jGFE{CuMbjaoX^5vqM(!e)qca zf_+OjTkVq{G^_oo6Hhq)r6clYdzb-TXjFhz6eDMb%#I5mUAJx2v4t4eY1}%Iwe+gj zVOLvy|F-~ErD+Hu2ne8JVT3SZqQ8Irr|V1lpT9#;Thf~i0pFCVr6o_dekcR9^H2BxPeEH~QVsY>HRZEG2LzgcF z|IxfhDt>!8WKo8UH|SDuuws?*n`2Yy!FLDyo8?H)l_w4Fv2VJ-9rw}!Vn0S)UsG7H zJLLV5F@%a$Yn^$=>fDbc4f=og7hMv_7W=<$XN)imu@63M$jPGRyuLtL|Dkb=Lh{pt z7VAh13GX|DY!io4B%H&XoCs;)Z-?LSa--tm^B40vzf)xhHhk+CaEg(l7931f;a8TE zecTfpJ8EPrIYl8ME~G0)`;|>pCLn-LnOw~yQ(Zkh_};{q@|Dj_v?y>DMM#i$-@n&kpNqC-@r3ne5u^B&%q-Z5bjYJDQ&>ILDpxGFdLAWTwsf9a~Xke_K#RPH)lGni=~ zY;fgYsGQ2dZbm#foxd)Mi6=fc+^u)v=^A0Iobn_2Hd3G~c%&k>cKFV{vkDt>WJNi` zBCm@iZr@+jk|R6xy69Zk73u1ooG)u`WGI}nq?>>vFxG>9cn_ZrN>lQRip_9`U|i+Y zN8fYC7M=4CoZf%zZp~{gU^?=rWi5Am_+rXt;MY%|cE481zsy4sv1;T}tv;8iXl3m9 z;|&)i@w1Pu&V1xmv|^isSLu4(d|X33L)~-w5SoUy7xKfxB>E)kbMsuq33WC$@1D0T zSW7F^rUqO{U-idt>32^(rOXk1q%$RYp=%@{_gvi(-&^ITBe!dxXD$toN{~ndKHPTC z`1P8ac*=~Szc(3m{+WPU?g-<^{HNv}fw!juO8?Y9d(n_p~D66ASOVW)U6NK)p@+u`=dZ-i#n}K#ffe4Fnp*_O4RVn!*3pWhZa70YY5X7#4oBh zlVvq^Gt6H8z+KsJP4vmdpBIGtOvYZSo@1K5EO#+}oBFBlD<3==+Vipu9YQNF-#uvJ z&nkOJ;g7n~VBKNQ$@&C_T3X+cCq4n~2jk!EjZV~|KYsG0jmn&V%>S%<|d}axTwdKX+teD5VeOuo|t4r?QQa{V_*I+>yAnBb(R$$_BEji~frlE;9VC`bPY)X!rxo35|1F0X@=e zHi4u)@w;~``g`f>J_Rg=SgKDFIswVM@b29|0Q$%tQ+45Awgt2f)myjGawRBp8X6Ip zB_$t{@*9s8X#)F=Li2Esi2nJ%3o8Fa#Kaz+4ijSj!1^>R=u}zre7)}0^Q!jJRO07+ zd62V!^N${ZfBIYq!%^LDiU{1AZLS2kHoq!%8BD_{BsTYL>^m)81JkV4&CJY@SOb-c z2D0{SXxw(fN!Y;o(a(Swlo+8{^VJ$ECDZQ-Y4x0B1T$FiF&Z*C5%SQ0Z zbxIQ@0$HlW17hK}5i>lP9nyzMI~it{{e>QY4+jK6xI(=^5T_$ z7GFLER7~KOE`+Mgo8Vs_T3S~R_5rKgo+UsU8ge<{LfzH$NlORgelBZ6w}L7AU*6*S z6-Nmnp)U?NxJ6KPY6ex!*-MqHK4y!enqV6oxqqMb*0gsO)(rPs{)x_YQKW!ZX*u#u ziN3+Zx*DN*H;r``f4fWvdAhQA=18USXuIAT%e)eJjg~y`&J&&4cwdYAo1870-QCQ5 z+(LRCww6>mC+Ik}&b8N?nt3c}h%?(>*n57bq`WixOyH|KIw!)ZsP{O`E$ZR72IbHD zziJ9f5;K<}&e%CP%)KAT96y0fJ44}ut3yF{`(e}~^XcAto-rD`wDq;P z!eLg1_ z=pMwjudB)l+~gYJNzb#s@Au@T)%~|Sb5oD4Zl1AEoRgMfr{p6Izou-sE@)!0%u;1+ z9%yzY{{#yo`%@oD3bk)1JimwRqBXudY)TP6{eHsaBP)e}Q_Xy$B7K(Vg)i?g%bqj( z0D65W2w8I8q=ZUPUBY-1nDqpcS^$k&e_xanj21`O6H~;@?G0OvMXg$ce%v=H0W&Zq zIk^VjSU6q?ZIJl!f5xU@k;d_9|=JQn3Xzhy? zqqLK5jtWt4U&B>47Cg4`uroNzEI!&vuPOZS9#!J1!t`Lv# zotAdkWzngrqg!%|9b_7Kxtm7Td__+i`|95%><+GHKTFhf#2D@ELQedW>HN4ec~08S zq^antE_+Ckl)WOEv`CE-XNWG%d|Y?hRUeL9(;UVOWa+m)=C)0f#ves&bgunAjnET8 zUSA(;?Nj0Eep*K-4h-E>vpRjRnR{7&a9@3e&6TsR?`a|FQH41>SFX~qadGJ;3jDlh z^C%dNBfe8ohoJaN+7dJKr^IL-94i%YuW%TV6X2}7&ZG3&R?@OH2nF`)9Jjx2Mn*5d zfjL!S-QqP1jiLin)zO0c^X0vh3>}zzv4!K-(IJGu4T=H+Je4>P=X4W~tTE>rxhMt;wNvZ(2_r1;YW^*jm4m{>#`^sj+UCAG&TJOSmaoVgjt=Zm8Iq69i1f7ZQG#3 zk`d(2zkiBSEIQq;JB8y;g^Pk@K&VEL4}i6`w_WF&*RJXpO+0jAZn~|ktW300nV5`h zuFai&mbI83hi(TFDyLV03g;5J|Gy{OF?ieNS^QE|cEA)VUHit|&!Nnx#~yCOy)ofk zj_dURTEy?%(a_L9@d>ivg&_5c$J%P?KWiOQ3A|5tpLpGcGK$?_b%l>Hx@Cuq;`9RC z+~V_&l2JJHh<6w8cJP0AWakze{sNQfUvnf%ad*!B*&j?^Fy)mnJwI`mt#%v1pH8>+ zJU6i@fqz>?EnFsR6b{ z)dAf^pZu1-H4+-MPNc@fhx9LeE3XrvEoAFhNK_7+uo>qgqq%WpE=btTWCpPv7_miS$V=m@aIo_U}m zB-CRoiJ(d;j_PReL%6vEPMDdo6WZRqdGlJt5BLMDZ76Ezg_Im_k>AnHQNFD3GAX|p zx+^HHAXrT%om5G>{@DK3HVMPpiT$;^PmRUz-@s510VbWOeA-H-VWphMP)T<@ePVB# z&y5?xmqzF{55+b@bX*)7e9PdJMLRBgR)SoyP~L%u^mP$I&BdhQi>#8n{j&4s4$;Z3 zH-3B6;;q4U{j8d#JJUz53wf$mO*PD8uMcmpe#}+Ao%6){xo=J>5;itD)tt-B*6!oDL6*!-))%&Hf4!RF_<9 zegbrr{~hiPz`lI_`Hh@j+|l9w*no?Z`Hz!_{|yQ{Df6pQMOLkz|DsWryr!6-ib$p<(YCkwg-y zWM@Q4W$!YQgzQzeBw1ORNzwB<-S_?fKhJZn>-W35ZsnZw{eD01`5FS&LcV)^DmRy> zy5_py`j_3`Yz`UvY@ojVy>}P;%b~?z_l_j%*eQw(a<{u{X$d)WF5E3w-;tB=d3Uyz zIiycce!|as{<>fc7G}#LvyLHERe!)m1H+}@LOu2EGy;K6xe}6ORrnuP9aHYw_~L{B z#M^!Q_RaU^Z!L}kGYxJ=*npwF#r9s}@bbh@c7*2vL))`vgo*wfV?hS^NsE zIeD6Qz4;e*9gw?<)O?cl3Mq>?2nGP@GqbGXNmfq~4Q0DE)s=A#lJ`ZuOvfBSt;QOu zpQGaFSaTNNA%Tl?Z@luLqz0-g6~_A_B73HO;vY)Pe@hxAM#|&YcF%_T zlD9%tVekPPCP&Cs78#ap-`B_bRDX1OTH1Y5GmtIEFHtQ;Q$#i@a*b zaX82U6^hTUukdwR8XFmfE#KjeVUKP1iz5Zn0$FC2QbIz`sDC^Y=R8fGT+3h$Y3&#r z$~vewK`|L~l8?SE{%HNe1l_rqYIF1bksg;GejYL4qu9q-VT@J%W0gCWe{z~XCG`c4 zrdyq9gRAY?WSMw2@<>jAVCo@*X#3$AOpLxXMjv@YYc^ux^%z*qw6wRc-JBY8OzmZE zYyy&>m>EY43mHEM>|VwvvFpx)M*7FapQT!qRjbT+j zhg=TECVaW}(9q=htk{M{UJ~g;A&WPTh1&krpNlv#uz(`B(9-Hi5VJ!maiRip^BsB#4${X$EVq>sZo)f{#Zdp69IFOm99OxM3(2QquFu zn?VVnEr+P0w;B6!2>S1g? zWpVDsz=Bx@K?JBT6Wm0GJ0bzTBAd?msK>6qzdpP(B+fb7$e3-z~=f;()-pv}^lL_w`#1 zlrzvnYo1uAv_Cv>_51a^cki0z!aALZW;&J8e;%`9y;p>ea;A8SOpGN zTn%+1nfK72lDJ8YMYRUz082MRz^H4-JRul6q5s(#e%NVj_F{^^UbXSiwk`IHW( ztL1UY*U{ZEOnea-o(tHrwQN2w`R0ZIAN7>x43Kp4^MEuXKy4*lg=VdF8v^h|%R{R# zz3DtJuKn3W>T}5m8qjWaT$oLpIT^azoyvmZqNvw#0xnC!wGwK_w4_+}QjOy= zO32FM3k$Y+-9^n#Z?}Zp1OV8$TG?`+@a_nh+LO!-6l0$N9UKfJz=L%w6)+9bxmw;n zE>PzQT*j{-^G@}l>RHA9&;liTfGIg8@KjxDioxKXOwfU{L^O`YQ*kCPoRrmfMtJGR z65bKIGmkso>t+>J?)i035uVGzZ=u^#?)0R57fJd3O?-HT@~qaqaiub?EWN!89PQFm z32DydPF_epSgxYDYo_nzm~&9ThGqHlS?)mefWbm~|Y|N3P@qR1mxn%EKU_t-FiKl-CKaM!1g*hLi_n3{MHgB-R55Zn!_hund&-( zo~;i?1K zdKZZ60o4cGp|zG7CLObUre$=5JQOf^o};6p2!xj=bI8vptY)_0zuW=l>NP~&-6mRD zjyal`nI$V<=qGtk`BL=3T+Opjn=#S@3V=AZG3bz#k-)x4LK%#h)F;jKU#N8Iq% zL`h6gunXasdvn!HYNjB2N4~)s#|#}kE0>p!4sjN<)fSeY79Z7)tMfHBU`x^54B#{l zGeEBZct9%WQ@NL*klmm)Fv_^bwU!I$yTCEvi@C`!^_as5%p{m0tU$;6_{s+z6mLoo zjyMRC(Qg=jm~8(bef3sWrE|Qw*-d)E4ajN(NFK-rUEebwTn+#mQ`QGTWHy4T(h1#w zwux(qoAgaBv}@=hz`86muMR}ghACG4SADx7!;DWpQXfrvGcqLKKau57@X5IR(}zTY zd+XEkfD0naJ7w509Jj`Le>*{*kN$wH58c?^Z#}ug=)GaT1RyD7stgTj6ku}&DPf>5 z32%^vyit-FfBlk{g( zd2AQIHcY;5zJ`Jyj~&buE?EWp+N*CTA3@Wg^-c&UV`ubUiuetjvA#UPZ~ zW{{%^1fSsCD_S@=hK5tq(-5q{;Ni-ZpO82wC%lA}f|gd{Ls3&p`UAIb-rOEGmI!q= zSR!7O`~GGtUx$W^`t}T5=H5UPf#bfb_8J-yYGds$F7B#N7vBFlY4uK}#dR-^A`z}Q zdy!qvdMQn5GEH2}2mISD<9o!M?zG&^f4VoQ-SUX793UQ>XdciJG3--VLoMExEIVMC z-S_E;A+zf(r8FEiqCq0G=VJ}{KEYJeO*psq7lbX)v>;R{pGn3yv4GEs5ejPYYrXFTS9 z@Q7a48f*={X8Xr*@F$k0Mjc*t53BW>GvHVg>)VU26u~6>Z`4}wpO!S}8cty3d)oTp z&KP@v-VOH|vCFB#P4~t+kLc%+654lrfYD>s9A}XqV>5^w2icbDz-^QBNE!PH&SQ;x z*Y#uOvI?DKOOEaHoD3xpIJvnQcizO30pv0PaK_l!9u*bQZG5YX+eu6)FDYgQX7_ss zI_*=qB?oMnKcGuXJt%sCTJ@pj&-q|mZ0&~jj}U+=xZ^mKk{_pNW}MT}QA`PY{R4dr zv%<5Fw&2uEt)0l!&&6aGjz%pNLP)6oYY4&w0{21hn7KO}L%pO?x@QpaUwENn|Ts!<}F9e7y z{Zi1k0Z@NoA@ug`&M9}Aw>UdUT)nEpju}BhdjWL@9-del{g_QVk=J1ju>(4a;2GtP zs%zKQ)992@_=816ZV|$L=E&vQ)I5XM_m`?*)eE-+0GRBYOlW?2CXoW%dP^^}60I<* zg~_K+CpyGln+6r%+?G&0GENdtCXv~8Nh>*hn_Ktyny+QuMi<6~`HT$hm0M1doce>Y z=?&@m38Gg(#DU|EW^8#!DZU1;55q7`OS1({sII_gM*k?Ps_LL^IH{tkZAU%=|0n{X zXui45u7mBG9|Tt_Lu_^?9VQD~H40DQIEK+m?Oq+wFqUavXUHtapxpl-v1%<#+?r!wA<90uwj&`^H z=y7ixX5b^|KUHExLp<}mmu#q+B@mf*dHebf92&f^JB;Y(g8Vf-P&(gNXr=Ydp_u^E&85GpsZJEszH-;A8fUkSXoj@2k)8DVSg)e#uZn}O~uOg@%6%he0_7rEq zSe-C~KGe-ZcJAN9%nUr80RpX~hYX`}8G{`arI1}siv{cFEVl4WVW3~8-vcIWPLccq4Uyni;y*1@gv ze(_>H`GUHAk<{u)S%c7xvFa(h8Q0FPF8v%6(Cm(0d`~lONY8XkP*8BWK72o{gWR9+ zG36@X2uu+fy>V2q=ecX%v#MepDNzqvmgWN-tBj)8ujuf_Qd3eIzjPi!#D+)*dk{QI zCg6>^%grV^KqJE!r5Mqc#F98)wl3~R<5K|U9m|_fNggkl3MyaaDV}BgDh*yezT7(U zbI1CQ(ypz3<*3Juvb%?jfO0nr0=;S1#+2Fm^3>K%x#UMDSggPvt0d#fSp4zh)&r2junWl+apDuzi!tC$sK5!vti+7Q#^M_ zOI3(TlO2!Y9(3X1IzxC9;1ImL|88)2e9Ozl7B$NX!d&!H?CQCg>6%1-=cS8X?r5yo zTP(3hUS_#n5yiDEOp`DKPx1N2OJ85cU%96#I8J8q{lS0^JL8J;MV>ETzU)mP&cS|x zYXQp;`d`Ia)qK~a*ICB@2}4zjjYo(M7lGR-HPt&|M6!fo>+B4_wDPHa7s5VzNSIiC z$*PYxrB>F$SOHBQN`{xSulGF>7vYz72VHAB;nDuSoOaBuSrW>`CPSX-h`kTm=(O&i z$Mq1z1 z=dn^_v69p}@{7)y0}@$eyI8Lxh74tH-`>TJ?Zo(jWf?M2K89nCi9gRyJ{C^+93byj zJZVFXh6xYCZ)7W&iX4f0Pf55J8Hx38{0)y#CE_r4`PB-pxcFgl^g3XGL%edl6_d31 zXFe#fA#AmZt29~o2Xn4>mJ9fQ|IMFP?r*S=pdh?&Y%EZGY4v4d;s?yCAWY$N_8;Kv zPwQU#@iwBO%Wb{z?ZteXj4|qJlP1g8EG@rae+B^^Q0jnsXx~!u@_Hgiken;VLP?GH zJD;Z!ye`x9T6T7`QiPEapGFLDi9=#c!r(ZXltXi4frjJY!LH6uh;yMCj-%Rr^XZXt z2CJ1<uLZF%sJ*0;^uOQ80<4Cq)MN6p56b2Mcviyu`H2<=Ddidwl=KlT1q6 z7i0a^sqpTe$CAn9>nEIVZ+2@;wSUMyaa<|s#R=}2*oe^3c=V%lFyENzUBE5$e0JAZ zi17|Q=uum5)(%Qyj)*xve*W10z^aE;Yc0L(39C;!gM=AJcLt{)s6@Ce{H*PFy5D+w z5`7%zDwi$-4~B*u9C*+v?_04;OZ#FV$xL0}@i0HgDEkvu$i&ne`DE4#p0#Hlis#!! z-@k7mOm<&~&U}LC@has$iN9oB{|?oBt3M3oe!^#rYLj*A`#R%C9k#{jd6-2mo&lsPJ{DfljC z5q5oex!>kV0E&|kppYv6(0Zm5RZdZ8j6WD+Mf>;dBO^SjDNB_<{&$NGZb?w*=%a)1 zP+eDju8W!w9P!TL-`FS-J)oAi&=7T5BRR1QI6IFIX)XH!c1y3|gpK|fa!4SS(3OKM z^cCa#bI*0F{%lGo%xP(BTQ0D2?b(sib^zZRqwssZ2#qWA!zue6pF2GkJU zo;@T43D8nNA_x_hC&w%s@?b~r?SFuw>E#>pXSts4x)mNyN{HjM6yddy4tg}AYhuEz zlVy}`R$||W#?3zGP$b)fhRKI%l=Vhh@9OGE2%02h<0(z^*2Iq!9GYQ_w6ryY4V{6Kc5BsOp{{ht^-<+pU;1?0hM~{fT{O=6(^5gp;-~H^=6l$#;R!LXRyYqx+nDg<=$!%64ArU8Ng7z1?Z2ESBf*Wa zojA39YqIPw7{aC=_J&W5YUGm|gNM3$+S+?w(r%4Sdxql=O-$NLN_h)L>YAim@1H8d z_!1opF2g zE1OEphK~*Zc}I)xp*zQvaz5yIN%#LI{rA@2vxjo|b7Lf8`yHf~XT?QD+egaITQBRBC6>!sPmK$4h)EwCP6NJ`%Kh_OwGD z;D1NJ7UeW{?)!!vL$q$*wM_K& zf4rp>BoM&BLG^(sx=)m91XfrO!$|81t$^<%%9!u1Z!AGI!k_ShSJq`@IOwgHIw{v{&&4scxnTMlqxo82nQnR5P9$Y>7DKVE7MnC0yy)pmtUEZ?!}{^`0GKyA zF|m)9b_pIscd#wR@(t;OX=pS-)4*U2^)U`eU2W~k?0^@F8+E~-2=JkD9mLU7QH}7S zLu7tyTL?vqM%3lvadm>%5pKtnUQyxdcT}BZ zq@+7pW!AnnJiuDu1lS+4KL!AS?0>}WQR5T1QJ2K8boQLTp0=9k#Rxa z^I24eJrRZ=g11o-1M!h|0S1+jf)$TiBO!c;LnW}bcHDl*<$r!p9G`rT(I<9damVSp zS)~Z_09wEvZWZ`D;#lMTv5UKB20SQwOYM&RCEb-Cx}@(GwNQ$He+seER9S-+MIn`^%GK zn`+Z(Ze)LliHYe<8N1yv$IjbOOR_t-B>^8jS=P53me9Uj5YKc?C9cMkC&aK^!xsw= z56AidlaYsgGX~|u5VAzg7#tD;rg!VZW00f%W2f1<74n1>0!Cm_uG8(TdUyDgQddws2 zTfU4^x7kbe+i3*_olg)+mN6M}3bWf*R#W<`<=Ai#W>REi@FRcl>JOYll??^9kyK-{ zm%1_sEBO9Z$7eb%!7M(wNt-|(Dl4EW@fdl#ZM?dq%Bbvp>1p}1$-4GCMEzJ^)kvRy z{@W+BWd8=s{4usSO|GZ1Fn32Y+a9)!{6D}{`#37s!h!-;pUG78spUD#SUAkwa~d}E z3CG(228E?Gxs`%1y*LqEN1Nk0B5$&5m2X zBY$OL26@X6r<0%uwrW|gW+mLlfIt$w|g^n!s|H>Ch)@AHFlUW_uoodv05s(dr? zm;AurJsm5sjesekj?NN74~(WEzV}M^eR{!ofA_!+{g5A2x5;Vx{V402B=brbH(Ee0 zR8s2ar?_x1xqIBbQVw1RSRw#=$KA)mZ@IQ0z3wy@6(3>J6Po73o>$WEElIXiccMIQ|-)B5o!&bXc9#zI)d$8?VF>FX57Az{h&@GAy#F32&@L{V}Uv8gF3& zXsp=Hkj|NAdDa~>Yed5%yu4co(DcL7MS&cF}wP9&WWZiEcbn&J(pWqU|+{|z?$X(E0*!#Ke?LDmk{r$UI!XcRP zJOyb+Ecfr3-scP@sf;%k6Ux+!$!PFwno4@4pfV*!B$nQAxd*gACf%pgiG$F*uQ}Dr zuHV1cR7x0ZI%d5F;9x7E#Bu0$!anj5kc5dA-l%RW!h%5yf0iSAXu>L1R*49|mT)## zPp#XbqGpBdU!uG2A(zPPzjWP}jc(Z(HIoh8Zd_62~!40L}tKgJBu+ zt;E~JBclmvS!_)C%$6|$z}g$XqB#kU-G0BQF*19+(L<-a|4toXuQegNhz_J%wrl|k zaW3l~Yq*I3)E9qXU;?&3>J8`~c)`vA(@vcC{9g7JJoQ(nI@77}IDV?Qf|(0!Ez-^b zXY|0fcvaM+(N%_mgl2h|=Hek_dXzQ7Y~R^dom;W155_>7yUqUt_)YTt1s)c!D2;B3Hv zy!D--#a^p^sS?k6XGhcaNSQ-Yp?4(coqnifu6h8#gJSro#e8GUfjd2+jrvPY+q+mVA#F8qrV?+M8~mM#;9##Y>bLglsxHU)wMrB z!jg{wOwz%u%?+318Z`VJ!q}ei1T*^a-%+_?NnU~N3c{)>P+8ah{5nt0Zgeih@!eMw z`fch>c|}p1d&F!ypP;#isj?_Wd5pwhn!>@U(X|#qB07%Ff9N zS4$fNVVL`xfZc6xKZ6!B+pxIdqhT_)XOjzu#?E_2sW1DUJwJJ^eyuKq{B6>s19dB+ zw%-oZrBBY&oG=K_-3a@YM`bP*OzV()?8fM<)crYD|JX6vG}Rng{lQzC)Qd}u(F~pG z2~ZgEa$Z%rP^b{L`TB@3XK$M*P0Fn1&sVz2`_~^bO9X|_PLpm3F<7N`F-B~-|8kN` zc_>-C+v4W=YozM~8tjha7vGfrsh$efELD3RD6@QQe^;zJlcj$+%Y~j#VotG&MZ>wf zwIe8%Tu!M*D!m?}zI%wl>`EZpJ4@lk2k6yE3BU)Kb71}Q?^K%3o2Qgps%|hlAH7pw0Z|MP$rQ)11+!$cTgfw$e(Uap zfLi8DN>;CJIJvmQ#KjZZj{L>xvq58S>H&+8IUz_hTW=UzLO6I&CT@GG-I7%4Wjz+7 z*n1$cb;@(V5Sv^gMt14(k4NtrCT~0ulYY|o$}Iy544$5z*lTM)rwdi$({qq6F^;$) zk;%G+AX88|(8VC_C@jPpSl4c5_z&DSP6I%o8uLVw^~U75I0HRBZumlK-@3|PRT-vl zz0>gn>5Xdl{S*$rYFh0{XHL9-U-R^yG$#chuJ_>&20(I|rwrZ9$L+hLu_C4V2?@I$B?D*@|l! zHz&C?iZuu#wX)AqF0L_DOa#Jj1c5@H12#?W2m9+`MN3Io!x2|seN4(G&Q0c~d8_qV z`k(PgnV5rpF6BdM(#knkNk#b4I2&uEh}m^VAJLyf(#46p!z$~8To++bES7jla{TW_ z`82pH@x#@${w`CU;=SpCBVmT2o&gSoE?(46Ab*G6y2Sum4-{C=QdCX1Ot`)u=prxj zd2BMuyM-AblCXPr%SIcs`)H_Dy?rI4tdhUmT{{}sa);XHX0-%U@8E~mBUW9;GECPB zSGi-h3Xcn&4tK5)m}|!@dk@rQ9~k~ted8^t{mo&$!u(`2g=l3I>r`6&s~Ok!pgt_R z68=Q}9aj$fO!NEPRpP)nJA^;sk%!d-?la%MpQ7K!{0^l)7U@>oCGLiW!Og62+y#0F z+y8dm^dsAEd^FrESh z|KM@en~Y*4X^GhmtTfDtXQ6GS@^~Ry-^`-a_HuFmCNbRG*Vp-Eq4dJqL^DC~tkTJ5 zU8Zxkj~fkrEKSG?pOVY3Ei!)#$fq*5uYXk%QZ2EM&Oesz7OI+u8CtUuG^FH~eDygF zwWp7Oq(!|XylZjERdmqNoaSX=|DMK6nvS}$33C5o0s0PJuYS4BpldTnZM!t1`z`ZR z=4y5B?}r)50yzU`?*6bQiVMJI!M4~a?D$XDfr;e?D%XQE-j#b3jI3Fmwn+Zc@mY+d@rqJ_K_XrHuk)-d}jAR+)e*r`lP-HxS@-8pYxJiO9g3AHG zp`byY`Jc@V4E7Am+^4`d*+Q5UZ(*^p4x(ZoEc1Xu_IR3d*rZ*DoZ15vU6XmYdR0%I zT0@&K-kNm!r1%;TMSu@rztSKRo?Q47{R=wXRQtO;{=&08M_&a)2m^IpMTJaQ&&tvg z#JBUR%^3je#2#ykp&mm-66}iWJGioHyYjSdDL*M&Jw>gMb4<1OPgWoCR(5>;AFQya zRLv(;2-gs+iALgYB3TmhkV}aAL~n@OX&8|(F*R9!7uf4OgfbiMPRyH|Q2)me5YjlwMzfPeN>oTl2nz08MN@M@ze=xF zSAKjVsyW1W1R{$0EL*oZi4_ZST$J1Nd^@`P#B6RzUe-IU>kQ!!0`9EL-lshkNlxXa z$+n-ddy`9%J><>`HN}jqknwg72?l2tBl_l`LeE(vtA=lk_qGOK5?({&jhu|4z4_Xg z$U!}a2O}kRJ6%TJsf4t=M90B>;ngBlQXU zQS5lg2r$vWFscg47#x>%G?l38*W;~{kuZrjAA9d>7#snG12f;quORnek?R2*rh7N8 zTpKpi#GN>LYa)`***Q-wJwen)8{nd=SAWCp8k{?{+8tQ`$R0lY4c+UH#YG=jIJYZ9 z^AQH_YOYv&az?AcRQnnho%mpN_4P;-Ni`!F9}?ZVu|CDFsD5+72=9q@QaixfV*2ksH-);26Lfr!9>7N+fgh%jt`2Pc~2Yv?*N&ZfM4DFH1G z08KD02f76tFZ5;XhYp=Q91Q_1aG;Q>whaYB(_U2-)k_EQvI38TMcEICD&g~Cl@jJ@{T4+oaTyV> zzKWYeN=kb5_d-32TGW9;`L=ZV$9Q;d8D?YqU9=`j1!fbbY4rT{uP#|$kmZ>0ICZK% zMP4<~{^L+<^HUL?jh|btM$U6y5^g92jG*FFJxSY5%S@e>t#VEARXF($H<>)%?V~(2+Oe%$hi0elDk*X9-#hwD zoqAv6rCFB?=?)j|nJ3kKo_yL7Ror3tfj~%nqWkvj#f4MSbvZ#S!eoP#r~QqMpXuo9 zA8~5q`@CoH!y5~ex2bQW7|2xB)XMxfd`b%yJ^vX4ERVklurOl|`9zgBl+d*;W^~zy zlps$CGg_MT=zc9zwPn+Wy7Ar1i0RI&wMp_k3K3qeZ_K6A0*C(P4CeM&p3JdOw}O-w zCUZ1zv5LR{elhI!q4p8qcPmDQF0-@25}c~xr>U1*_(%_Jzp)@6WmJP^{#)zd?|0-K z0pwPqCNzv^H%5vahaEGo4GfBkAfWY4v_TL3US#I6^oGrsK8W)R|y2vvj^ve~G#zUEZd>;p9D9uU#}; zax6f3xfN!=3zAxxfdHAiw6M_7(xSZC<*23*mvZl#?>l9!@8DEd-gnJaW7t{uiXr^F zrOnaV-o4)?c35Z_(W=sb9_~X~BCgXzk#unXjeN@9PIXhKV+tbNt-M6075n0$3tuMB zd^2L#V1G~Tk$ul|hJ^6`tLTLP+LXs@Q-OxC?-6Oom_B-lm_B4$sct_J0wJ8PXSy*{ z;a)K^1dhf-tuFDsjx8?5V=vQKcl*m+6RwiA_Ngp;s(M3_?h5mngmoVes!HB*vQTeJ zs~z>?0T$Ki$gVG`{|aw(13QXt8-0TmoBxkM#XSx8XXh&^?u@7zo^CTTy;;3%%SIa8 zlrZ*fRcV-4Ym+(Tv2Z)h33erK->Bm+isD}Ic*QvHe5xZK-RV8W{AliK>eq$$o4guP zXIIZ|sgNGAWWQ9Axb>V`_fa1~U1iC0M(RXD`7N45^%T?idIWi>rXAfnjy=z05;d$c2GgMx0as4^AR{kQDkW7@d`fSc-zpL={-mlu}61j{| zGp~2*jrKhVNG4aNNjyNKnxtuf+`XnO)XI@fXr|VZxq?Al}z8-6-BtM-z74=%C;PZ~e zYvS*p>6rFjsO>E$L?2<;OC4VIwBFJ5&iWUBrt<*{&Qk?vuTDvFkT33e{W$DEze=NT ziE6LVGdC3(&s&@_@-@30M|{aB@&#?|*TgQ|<)ORnApI()q}fiFRx3(_#rMpFU%Gbw zkHx(w>kJeJ&Mo|GyXMbt$d@#;G%$YZar+DJV!_pKXDK-L%64o^>SX&7Mry!s^*&j` z`e~pJbzI4_pI0|UZn_$iDoflAzpXzVeKURXr?8iTLOZRo<`QGlo`v;JgWF~GzpZ|| zq*MeQG;x}J%6RU?_%?<81jGAHX2pgzCN+5)YUuz9hH6Vefsi7YkDjtEwl-G}7r~ji z$GWrSO3k8qx$ubuPcr3Dqn!x~N`Zt&&Pt)wZ2|}4jc(Vqg_P}N9IM?BPfufu<<@vS zW_!lHTea1LK26d1DfvTaPBUDLlx5>=>TZG;*=k^wdWM-as84@cp%@i#;P2O?DPU$dd zFu_-Khw1IIZHGTR3!gl?EpyMFz|qaZ# z>9A{9vA9<&dnb2&YY*ACs2cgq_XMLHf0B$^;PrQ2Yp>6Q>iphI($lNXlb*c9qIZht zRK_72p*OtIiF&casx^(KeB6>&PiRj*3Dx3AyrvoOO!xMXucYw>fdM>I#cK5z&3RIf zRyX|oZvRDrE7!KOxZ942jybt3aBom;`&Dmon?0P#I?D`X>b9q^d){_^=*1;@x8N27 ztEn8z-h--5l5cJ3jEWT={1{=A=hhZJtYT@Y%NnToRLlC8?Xi6sIx>y&dk;S-(B~53 zRZpgJU*H2L?IkBk?mRGOe;s{lKel7lqhDGBNPS4Bkh%Xm| zq@LDZ2x6a`v!W$8OQyGn&&r`0 zz^Vt%%k@+OO5-!vL!Uf665*^8-SFsz){@bnZjGJRb&B2WGk1TzwRAN;-(t6JOBN<1 z!_hcfHnt>_Ead@@4AG*x(34z;TZ5C_EXdO1UZgKeyzO&8!@nM3smBqug^la5??*!Z zkn3k>2`tV)^2ciSNo2-HfwJP2-7Y^l4$XejR5y_1B}55ls|oko+GZY^d#|6ybBF5m zg&G@6Gs3nSLxkz%Q~#$eAE`6bA4NRBEZT3WE4YA&<-6j?%a5sxmV}0sNb^K+poh@%e&R$=ER5y*O<_6KBk2~0d-bpx`=yWmMHF)RUPx_O?Innre35Cn0 z=Vh&kH|_77J|*~i4XyMBX5!<&3+zlM;$i@ryCuw=n|HKhc=(_j1bQ;os5;3 zZGw7Pj8tX8n${3$VycSENUbQtlL#BB<0oVN$QQ>g&C)%e7nKK2mPKvNjwls#<S!P7$eNrJr|+KD708y>+*6P z{i6GiqSVs5oyF=_+M;d=@9z#fbL!(0yF0h<2YkLu&VIelMTaW4mRBP9X3u2QI%D*6 zW))?nSEdgNr0=SFNAw&CTUgs3#UHhW(0dP}E;v&d1G-_+1!xJ$N-qyj1kDWxYPtCT&+QMt&HS{7_ap&K^o(^4jw6)oK(-@kd#UAeIu`29S`}3O~=y6+9>YS7{vo{E;`VD;9UMa&rFPKJfna7r(pPdkf(OGi9@u zTIL}I{SHo5#sdeuU_3goZ6IonT+FcIto~^%Q(^y2o#*m)U*mS zp3-eg>8+F(m3U!v3YWRuo>F*QTIRd1C0`1LsJgD@NND|Nrs<`vb)HAz#_l>?R#fQ& z?P?e>v2*H}cw1Opr%CIu?p$rHSv$dg&^@f}h{U_wV1ayDKj%Gcq<_ z>Rj1=7QWxQ%<36>tuX0)`!ZI-T$5FZ>8gwf;|6dgV&)&g##ug0j;&M~64=eu_wiRv(TTAmHE< zLNnrW;gzHTQKEh>uV5eSG8C46UM(yv#L|VqwQy%>8f;oei1zW*Z{7sJ#>FGTtY+4; zt)->7v{c`+YDnz!VS%_7AFtBV(pV`FV+aJzIryIpIb!^7_xvb{9UXND{DGi4KW?y< z@a(XE)gRCl_nEri*URMhF#9a_wZo&y)A=`umk@n2^X$8HZqL9_z+YQ$SO#1GXAU53 zkMbdmlt7+SgR(IKZ1muZEd<@8;*57WRq>1@)|X97F-M5}sXiCU88P}Iqd1^ffcRMm zQDT`NZSxIgJbz)S44ldN^C|Gx^mvK~HNe0;=S#BK@EaM{w(sAuti&TW)@Q2Ejn!2u zkB7i*vVV^ckC#lF7ud97VrSIVp{W7mWOpyG*pJQpuRgc`}1eEu@|i|SOTy&KD}8u>p5NfaRJ z|MyJ@jY+kZ#8n0iCleC-0eXbT90u@xt&i0Eb%~Aw->Oa~_Xw+znHqSfl5#p+oeC>GnU-s;$na(3(?HN(W}isF`6K1TO>F=6*25!zK1MZYNhh78oKTZ(Rm~3pw(`PM0P~ zZKrCkp|bx6SV@--oKE^1@p!xzyemE!25^i>x78XoB0gk?0_zD+b8$QCL-!9A{{^hm8($dm$ayi=1OPq!s#UGwd zN?K8<8gjJ~!I{x{4kjG&HP&P;3R7-vHLwoo_w55H6qF)~h)jIW>}>pIc-iLm9Q;5@ z&@7RNP^=nKpbSB%u8~WDiCa2cU((8_8^0{Pgwi-3yo|;FZpf?85=c&XIhvcZF;l~0 z5DH9H!|>f~`m)U^TQ9d~+Ffe3O64({U2=f7qP8YabU2kd^Q4334|_>?c7SaQnDGb6 zMyBNf#7n$-t=*;IN@Ztl%@(Ao2HzM7X1M;PYQCTU0rkHVGzMxg+wHJ6NYn?A@~`u* zUS{6`dmj)actpb+G$mlM00M2Q<})Cp3Jcv1`W0)bDQhX&!)pRB^O`Rbtwd(>&3D1@ zkOJoHamOjnx0_%ILbnJ1Wg*o(UArN$B3v7~M$wB0LIuM%^9clTI{a=ZBb>o7w7D79 z1an~Sj{gaspAA@UcfdteZ-b2a`6CJ4c%OtOzN=iDS1GU7zvHE-ku3`xxb* zhF8+(=znqr<*ns1lW6!gbVur+?Psj%Zd}Hjg z-7yT0tlOQA-6cH%23JZ_5`4B1d~A!$K1d#pvKCb%?|XAV=-ghvd7N3i=rkhOKNo#v z%Vnm#d~kcD+m?6lV)=TjIRg01)XBjQwt2u+dw`NI!X&%%X295u?MKvPbX5HsBqN#@ z1$U2kM(Aade!U zoz1?P>JKOSa~}O%w}{T~c9w;%DR^YTXXNtdMYujAn`Q8g_O#uN=5Wu(SN|isvv; zVY>j?eYpGp3o^W-64lZ{(A9bB1r{)T+Ju+3=3Qp4hc^Bz>EtMRI%T-0Fa7+=e$qhD zySr^4i|-MLGu*DV9C3d6VgGZPKsI>kY0-gEs+S47b7V)oHMz#e)}pul%L$qEckAJf zW|k}Hq4M|5KA%HnHTg! z@+;m17p;fqvVD(bKAqM1OCQQs{kCQChS80G(>$J;-G8BJ zsOx#sLBwz@9hhE082K*a1owIRFqrT#-bru0Ts$g4oj)}5b_A7IUfTrBcBba$^mypf zTeU)!Id&^x9{%s=BQPDPcd;Mbu5e0}5!D~kC?wcMM@JDlS&OzLT{%s1LF6L4YUlDY zjMICjS3p^Pb9T2n=bjM>>I)+O{Sw`McT~EFTo>6=zI9`rvCnbR`<)@L4<#7rr0A_EH3Yw1tlpoJFS9ci=)W8QU1E z;lcZx#kFXH($l$02V`MUA|+)j65o8;O@jF{%jqRBEMP^55jEhmm(*zPs34WX4^fnH z2te?JX)x;V3MZpKEG@eIm-^i?Z9er9r}R}`vD4JDXa_wPqXW&1ZC)+X8j zjksIVFTR%mG)Gx3u|b{Eg>FIYSF zJ-%hXquvFzj`+h_EIJ=4;}bczC+Vy`o_jh{(q8_lHjXt=g2D@$cC#kzWB&b zY-dBQ3-kJ{w%V-cFSMqX`Mn6e=wxYnTY|KWk~Tbd6Dtp%c*t;=3-xw)#}rk7*37W8 z;MeuYyn)$#19j?|M#v40F1&=*s$idKH!RGrxF~{V9bSH}h|y+vfZOBg1AsGDNejROrv3XZcDOq6!rSFxiyjq=tDA1i1rZeI zc;Q0BypmGjy4yGr zA4-NG>4qEtx8&jZ;}F`FVCD`2g1*hmVOinF?v@W9bH@&zp)X86-l^Q!SmUFLq#|LTK@Ko8LTvaD_B zq)5tN;Vq4_ODO8I-n5+{o)y|VDmqU34AE*tkHq27t#nUba|XG4c;p91a^8Vf-`TT7 z2sVc9P0?}9(<>O0AeE4VDz6R-NrmN{ce0h2TsR`L0Uw%V>JX@NbdE0A50!~^g>VGL zwOp<=tAe6E#x>|*magjPbV>caOE-02@pC0l^u4poH)tMnZNad|G9L!08C|cgEaBEA z7U{{bqS6D~xa-Ag@yI!gDgY8CL`1$U{S>n5XM~*7;hCb-G=C2Y`(O8Lo^;j6FSOJy zc8bX*W;dP-t^~PT=ka1YBt}TOOIGSH~|4NEjr+w zEy;`($fwuL3;S?1FXbEj_WuJpxXxC^w{xmrnRXg}=?X;dod0piKW28I^nsh=X!b2C z@z~Sn;|Bj;f0cs!Mru$!D)*e_2;!jwCkb|u&*tWEv)tGaHgkt4^r+4fGtLsEC)m(KvA&9K zi^joTvP)Q*%{~xa2103u2{U5(6 zMI?#HCS`SR%U?K18t0-Yiqgy?gwfK@<|@j z(n3TGq?wsyUkIDCO;Fmf<2~A0AVXt*=Mp(B%Vj- zv-L0+yQUuH#Iq6prXBArZ0Dh&H!YpxtT^Z(8892PI4}9xWy+Hn1`zRx1zvvk^IQ3^FwDr4cMfk?)e zx@b3P#8C*W~=bkj34ZfWGCq^rCGR@}CuGssfh7nI23qouQ-_JEi<6iV0SqrO$pYaE5RodHGXJWY9H@b7cfo77=OLPHJ<2VPs7@m~C-FV#y+pi! z4=p&*c{x5hviY&_NSX>75C&zppKwUA{3mP^{L8$o0YU2E08X|*FqNga0iWKitS=)~ zqzWBU_+e#chDDqv;05-@09}SN*Mc)iX|4Fjig#W1Kvyl8(>;4;T|IN?ehIP|Vd94Q zj$cr~Fj+)$j7+l)Sv~cDd*wRNqPMn~{!>@>$d6UULXFdIfDzOR`44O{*l2Jh0|J4# z?(g1>U)7t=b+ByFgdv554Vs@OFd+uE^-g@+PV!me|E?bS7!Y(mV8sUQvw{Lkd;1~C zi-AUE#tGLrZB=#qF_ksdeT<^--gVGy^Yolubxz1uu-=z_TYJf=~|E3iTHF$H6huL6}ELf_>9ZcwCJK*<^>!y*gwLmjXMJem~)wG*Ed` zK73Fp7$eZK6NUs79>A{3zNp3Z|EWTKLtqQRqXCy_Xmche>R;mmDMl!1ODp-6&N+_pzn6QfW4|6!iYY5N!WQkIPICrNc38Qvk;`d6fR`O1Omfce zXMg!pHYY>@c+iEBk(je_&<*eELhrPPp$3dT+6OhcVC}=Njm?VHMqBXydt>kqBLkQb zm^f17+Vhe?&H_KsyNBCM3|y+5f$EUoy1txRnL$NcJGFCJYU7IxI#^1;d#3(MU;@uVLp4 zrww3va=5O}utcgn%*vVxk%6 zG}slws5cv1C~Zm;m7`|H18{k#Jr7W?*Cc~LWgWlzRi_LZRqUghByTB51i|*l(veDf9aJru?lU?RQ$)>dLo?;w_J0oqAl@?5 zWjohB>#bYGnU5p?vc_9{a%b+PG?2a@go#&>T$hR-#-2ckEj!mi#_|7sJb7d+35;;N zQbP2g>ds{Css^@~V`F7~aLN$4?Z5)kDd9O>hQ027&yfVw8X+o#rm#m!MXwyX7pcPZ zNy+_#%ZTm{KV(2FdC7P{Wc*-&f2fz;2>gYVrnU{Je1q-o<+3_=Vh4-sG*6$JTU+bs&+z zkh*2W!orl|xzQ~bC6r$*!5z?3^!Rgrmd9_YPw&p1=((`B3!V$v`Qu2_cit7@ROY~V ztB7Yo-9izPvLN>}C!kfVPdy4yI~sEDD^sR=xVY^*rj<;8aRD|NvT#9!@)Ovy41*{2 zKF;(hwVrC#l~Wnd-LqKb-PIF{Of2i3$hSfw|A8 zHzAZ#oTYtZIZYWMK{`@(T5kP^WASNc3GHj?RD91CCfh2j9Dgd^v|O?`_Y_S^qb{>b z)nrsNWtx2u(Za6{QY)&Jg&D#}bKsQpL3p{UnYT+dZ@sCXbUx5vlO5_Gi~rOiFj3%dvgYcJ{z{ z!K_U+n4}ksTm))ZBhNZtr+l7xu{)u86sb;UTfg;`W+j*onQ#zsd9oW$R19}*aYo{V zR9<1X)6>YbOe(QCcYK|-8MC!uH;*NhEg4o|kb5E7YKs1;ho>>|&$}Vh%B_d~k#>?v zB#&a2Q>MP%v0i4%e)mU7n$&ssAUKR@>{)~oSGEP!7>W2z<%KHq3Tcc zIWis9`#jgArDvAzHc%7MC{`%CTdbiSy0t&NSre@2-Fq~wJU9V{q7c#{g;D<@EpSL_ zg@9tf%+|JZ)Za~%KJgX$s9D_Y%IQ%T#?>jEtcA&S`cLe_x5NV)#WQoTYVk;u{_rM< zY}uj>s)rF(=oG0iZdh`<%O#O>Fs|~#>m+#W^>u7hG($99;E7s+TG{6!J|1&%H-VQC z2a-)`0G)q>=F_$v5i(rhVj+zt_+4wpx?oZDRO`$C$qMCiM(1@{QcJn9Hq>L~$ugOA zq}~~vvlJISlqgJ| zU+Fe`Pg5Sj*C>k)mvi>*JDFn;8bPgSw$f4!LSbW-`d6Hp0Dd7Wo~G-He7uY5ufhpA zd%T{9U07)DB2?%J@zb8I4u8h?lIu_nC2Pe)wc?KrbGxZPDjLieFOunarJzjVZ%6Xg z=p&_d7B6O-vy2E4dDK7(^_IBiryox}PKwDgMiTgRLme)g5j=N#;e|`zy856}Zqmyiq8Re28&|0b7eO}xsT;_O3 zG2dZIY2L674rKXUN2mf$r}e~Ip%h-F!Mk@9QF|H1OG%AO;PvUmf_N9P+Ds5KHTQ|x z`e()^xBhoJ){TN{!cqQ=T10^2g?s9CC*sc`Z`b$=1Gz)JJq6e}s`)1kM3PHU6&O-^ zspMXit7*N&geMo2_uIm5+&!Q&jin|lrt_U@=N)W()27!0^kf2mlJbXRr5kM{cQz

EocIRa+N-Vz@TT4-`8_h7lj zbMc0 zSrJI!rYnin8=Pxda=XY_I9L?*!}-Z!r@E0#3}%j882kRjNI~&7J8SY8|4G~baRC8D zVams{{0-MIgHSQrX|$cgz*|aqnYNMjLgoND7Anzu@gbtO7W8`BKuhK`oIz~L4C#=B z2MfWHOQPR`%Zbj8GTAHs5jWj({>SwM9?7>&Vpxm8>D#xEp)mL%9!p3BH`jLPQgFsf zb5B&n2`3I|;A~43M-_oj1Zdkgsu^S;l~HH3tfDpjwvLgt(hg35vC(&bYgU-jY8wD4 zznXZ;9NRQ?&#rEKYoEEK%dwM|7P;i(A@`b2(s_V2TKFL&klAoEGs`FEz?Lf*H0@Sn zJ_*!fJV1sEZG08%U`;F9>adp99UqHenR4Rd3$%TU+%)VkEcK&wzf`py>)p92x>;YI z*T9eMRKM6Ko7Q>TohoM+irdJ2orxiso_2jCYwXRgjY+&hu8Z%WqQ}Tdo9d863=BOR z9%j9M4itbGwPQ?QLKTqm-kGs7d}WQTUrQUqUV@ys2?>TAC(`;&FY3?r#+SJdxt#bKN>}>)7JK3PyI%qQk-_csnW#!g$WI=VfeUxB+ zeekvQ{+{EAGd1v4OPQ_Th@7d^%ed^gM%l6_xGGnwbhfvoL@T;5x9dPTQizrly(vZi zYcW{wg^lXG)u|d}s5cLDhIbp5UU4Qn)s$bQQ(U~_@OV|}jDZS?iaw~B=I(#^|3nP7 zFcjDx3x%yrvPqU6jQ_@eg$Fy_7EbvYHg2ktV66pws-1s9A^g571LqXY4$~5BUP$gX z34$3ve)C87@X1C0r5VN*YVPQkTl^l=t%;3h*=Ts~oF<$%YdVCXaf&pcM;Gk#Y0-bC zG8Hb1T2JAQ%jN$r3{3Q>1>xRqa;{u&&h>V%#tB-dvQ~1>_}3~loohg^Jh5>G&Arg| zKR4RZTZXcOE zG-312LL|E*Sm{%TPjA9xQpf&Q((j;tb7U&e)1pj;*=QSL{mnYsWw5 z?A)Epx9_tFQH$|A5G4=vF20nTU>G^=JVn=s!n+z8)n5PR?)+G>#4xVv0!}YF5R2*q zAp6P*3P70(&%EoX+QsL(;IMf>D;prN@JaeX+`;(;55v~B$chhfn7j$?uP0KOtM%a; zHO>Kpfk>dz>BQLHyPmk*!)<=DC+O48JTze|21BJh}Y6gp$K$ z91$$N_wd}Wzh~FP6-QxHM%x|>OtXvgZ3BEvO|jB<&R0s+ZWje6@M;ys&V54{jnYS3 zyJI3Yn+uz(4NoIdXQF;-iXCWZumC<8OBvL~@K%irbfIDXgGQLP`N~Cs&$rbW>KLSR z#4D}oKc99)eg+7uXBl1SENOot>-((~f1hl9J?z2VF=x_@Nc zSRI8fZtg3NPp4bKS$$+_cQ-H#xJTKa?Yo+x5I}_b#n)tXX6~p2ygfIYv9B%CAt##0k)Cz4m zMv`gt&8AL8O5_qTQ2t}Fsyxq`=*@OMMU-1^cSv>7ODI0byPi8ZdW6I2*>Z&X>1hcn zY|BHJ>XSLWkbW<%F+Pbm9}sBAg&@mezLk>@Wl6-^MDkS&#!}9Ar*A)N%40oL1!;ig zvTmMBh+~_7u}gI0K((hF4zuh(#9Ti50nAC~rR^TqP}{Ie&Jd}SR~x}hPZ@z`>TM#< z_MBQ9oA;PcQOnQd@Lpn8@{*^Ho6)*gs@waxA0b3?_;r=K7^j%I8pu?&Onp!f&^jr+ zuvj>KxcPHUZYRm>e_SC`9Rd98>N3(!zqyUr~~RQqd*+{1=}Y~D0a0SqEtM=qok z7+UVeI7?mN@8^y6mvCZ}vs>sy9#yitu%9rSrY~37*tRAaQ?+69fn%DHe7kQA5x)8f zl}D;xptn3==&XW$3NE~Z7E~-kR8vnN)P#K*ufz}3VlEMGJrfL{7knu(ls4fcpO4_n zDgkCJjIil;Ig*#tOvR#I30>FIZJBi-Bu>`6=FIinjqGiB*O<6AB31W7iJGd$ z9fa`Q0S;mL_N#@IrEOxo`kfxL2Gua7qRN?7zGyolI^UpwE)^clS$B~uMLoUhxLDUw zH8@VS*iFM9tTf%~^y!qTI$0;lrC7wLU}&uAO6ciIXk0IPg=<6a*XT;@4Ld&H4{CL` zfoO`{K}0p0x}Ztn@zrs?cR&-J{HBKuqOD|F4&-R1&hxlKG;9hnr%c(GwpHCg*h%#3 z3Kgr*ptwnwxx{r8FM>qhrmb*mV4YIIU-^2qJZNFM#(cZ_jz&M2{QGM8;Mj=(#d)I0pfI=r`hx9}bD+SH1)mMK1)WXPgTEn0kRL zwU$W~P}*`8|HK(9ed2y44)DekQuw#iD~pR!QJ4Npjq3du>PM>bO%qf@x|Jt^93ClN zN-b}8)LoPCP76&^ED%=WP!SR9Rh3XYXw7l*H8{Us*P^R{Cal{ft(wDL)>V`iFb+uz zm5&X;&(dcr>uXyF19nx>po8!|m z$q1f0SKa%d+G6{Xn;wI~2gJW;F2@C>ttGn+%BvIMpjk>J`iZ2)67_~xqsE^X`=!3s zTI3%6*FiOyyTo!4*=zc6qBSmjOwkgI=ammh8y3&vYwcD{6YypfQkbr7P^2L%^4idA zi9(-JKBzsC8uUSq= z4f|n$E&A?ci`^ga{0q;oEA}UnU1fk!2c3+EL55vtj;~GXTMEYT;ky0h!qzp4o~Z-% zyRJ7l&-L539+naRC{y=1OHDy7Jbq%R5+u=MHznkmY}Ov2;X3B_1jlOdT5#=UA(&YSnC;acv$qJ&Yzz;228Q`M65dQ~c|k18G^cqnA{F<8zY=Rjcd+-0=~~Gsw(9E3yWXO9YJr%<*Dc5b8z`U zuf9IwW|}mznv0AielqJ`oWxdfR*OkqQ!Mmzb)a4@1M83;W~HpBwO*Qo`edPqAI3Q> z(l(_ZyD-~yc=noM`P70T&hyhb%qddt;-peE27yl2O)%EhubDCY>w%}x7|D_H?e@-tKEM0)uRNQ7;nA75)tL^zT{6biv`odLLeZ$x8Rnx~;&5M=IHk;4@AS zW5IR}qCsGle6WPhf@&dz>Gs*!i{DuV`w7i7v+-EYvmU-2Mk@xML9khbNJeU*MYS}w zfn_xXH)bZf)P&Y_@|h#v0K;?_xwT3(9k&1h5yxR?m{;hFFpo0+#Cqc)>}cEwI6`<7 z!S*}TgBfl8!MjcnwX46DH~%BvG1^4ohLJk(rJFRTzY1PpL%3&##|`^y<7djDcZkE~ z9`Q}=J-U|Ay`L26I-mK%)ZuGO>?oyHjsG8@R#T zBaOPt`U2-QT0Inf(}hu8WWVr^t%M8f&s+ZUS`3t_SZWtG8;V(6fd%RWUU##B#jRm2 z79}>p*;DA(!5^EZ7UfPpG&R7M-A9oeIbT$paZ7%-LZ7G@LEBo#C>j8p+PJaMR%89J~hT-yl05MHU~(TFuXyLC!d z<9}Q|sdqd#9DVdZ+}=oX2)xli#AO~1byek_axqz#Yz0^1f%Sd%>x?pevG z4KCwPdRvcf@56`#Ij4Jyb|he^TqDD)G%hrHD0EUU#Zay(@7#ouRfrR5Vk|15sri)>U}cwGOa$wv zO@|pdiIGZO^z%g?v6{|~ASXEn_Sp_(*y%&W!vQOVW_fu#ha~9Ta8j=@Wnj9ZRZ`nv z+cz@@@je8DFcdSixslt)6h73QdNj@+Kd3Xwq!{ z;h7clKb9YoJdwaC&xvvd^-&YDzdFEVeG}5X>+Q$L&7QpQ5-FX#c|oV&<;PV6+hPC! za~T>9&K(ejWCOLRnmN;n8XFc5f&QllmjoHJb$-g>p-PmeV6#e%X1^x; z7anmdAMe9%y8n^fQSD(KdAqr|i^5|ek5V>YZkhH?PiU?GqbA!P2Gm}sWxQ2=ll$=S z^y-xU0ay>Nd~f4Fe;KdU)~?zqX+4E9VME z;IJ3`W*t*U*MEJJ%J=$}bn)1@oBLU9mP|2cWO;ch_Yb5X>r~Os9iGGMc;8w;(afW- zC(@sDHPEK|X9tYtpJ(O%a(w;ozw#fyzFZwR(>Ze6_}rGXNHkx%L-HMm}bEwbjBXBY)zT#~)S4 zP{Tuu7ASM-=O-lxREcY|5ml%X%sgu{(EQ4O>wm5^ha37}0u6q{L0ybM$JxCzeOHea zd91rIfdL}Z5aFVp@B!GgFTBg=p7-GSU`5h@rIkG#qF76jvf%z&Q?PYKgYJ>*<){Mv zTlGW$!b3JvaP6#5E_>|~{sGWUwUg-aa+{D0nK(7DwKFJQ*IJ?w=IK%1ip?# zeLNVj77s{_t42`DVe9W14q+8pN;f37cdTG(+OnU4Tbw(`Im79KpY zDja?uy%G^T2W`<9ce&=w7zy5MI1Z8Tc5p2%3ytNeH4xQxf>nXaDPOTY_6s_NHIE<7 z7t02OHwgB8aG_~Wj53TShUKJJQq!$WhGk=5Xo9$mObxlL2b3Dxo(ekdGOTndc34Wu z{2vr4KM$m)1e?s)o4BtYnclN|1QG?ukQBUEZb6%Y9FHV!bsjG8m@AWkEdvKWUN(Y;haeHU`TN?1`?&52e6SDGeBa0b?HD^Q$^We7`b1 zI8u-|l_72r=%*?n=a&jY1Z7L)bP76Npo?`c5bWWAzDA332j1f-R}~()2JCyt!o4^S zP;3ZFXXCngLgNaddwm{nEs+4$8vPc|(wc~R>SnS`i39^jpxLmXT8`URm!pIH4ejFM zIU{Y)(RseGVrmII(}?6h;nps~uUA4c__E)2BQ*ioS4Pb3+TKtG;<{ZzwdgdVYcMAtwkp>) zh#oF3?;y$g;J3w{dhE}X5TngiiCo!xiY&W8PH7vKCA9$3FP%w5@U55)S1XNsNO5{N zZzHgjI1>fFUuuwB4wo#k2sf;rLEkBV1kl?Hkp}nHDk?Arz}!Ln!|=8(N8O9zV&MnM z6_P8dLQ9t53rnz4k?r5EqW8p)`2<>szvfK-F54Ng%Gx+pZq6q|w9PV9PQzketB!tAXB*-ArjP5u=Jai2Fl_3$j*CLT zWh<%GUnJ>ERo;^GQY}rY&9njX?Jt>Klqk3H#vCZZhT4*n7A_b@$0f(BVO9S5N zP~#!^({46inM!o1ZqpQi=F$OmF%vNZHwdMph8^>>=BQV_?i^_O0k+1+3_vVqT-!eraVTf^P1B(5b@DPlGL|c!H{aZ?~r~o zh*GNK$m!S!WrB)_1_Wi<35*!KREJaTeOzg{-${}umR`s%uY;*_tts=A4xFVtN4cdS z&;(6Bjt%4(N)%x#G5(B0Ufwggj21*-hV5w>L_a55Hb<6v|9jd5ax5s^R~-3{82F6$ z5@cj8G*a7_cK1NJ878qP)ywJ6S)_6bQ?dOnEl$qtA1;e=1{DUI_vKff=Q1YHQnIT~Xr_#$iZ7w0hi4vZN<9I{I@Jqftb?%uuq}^JJb{k^&TI)- z36?(hdAW-QJ={c^-bGO~O6MW3(GB>Q@0X`~1zIs2Ab*txzUj#GpTG z2IjJcyzsy*Z5o|wWHHr7K`&3cxS>o~(>*Yz?XSDDdCU9i9;S9~I`K4ONh9Lp)Ctoc zwJvkT<4scg8K-+x@&VTD_9ofyG$uM#F2Cs1y1h5+``MQcm+R&V`l^AOzQXsn#&!R{ zKf<>&%9QqwhhWsoC3#2;cZ>ay$CDE*(L9IpMegj@Zuyiet1{rLxC+a5Yk5Ctkn*Qe z2{&AM#cAk6k5zB)c$x;DywDKoB5#CwcrC6;@E_o&hfj@yEdOG?nvtnbW=qdNg$j7Q zmR+G#0rcCcj+prbl$A6_j2BH3aMHO$@mX%XpAykmALz@=zh`%AMer8L3ne_%M>yl} zGWiHYt}cybw_Q8qwJ@5uEC4}fJ**<1a4vl6Xm_AG%2-+OnEFFOZVuwj#;u92Sgm_hWrbxLH|XP|i=IPx+S^KPY3;jLF_ zSbYr6=Qdj_qm`OPs4WM&jCHE~V8Da) zn81&$O-pqGQsJbwUtC+K|Hma=ICZAOhcF6FR7a<!#rQ^SHH#!avu) z_<%KCilFVFccK3;Wn4eF+eimbA7M1gifD_YM@h72^-|4R>u+z`|NX2dKv#b_Y*3Nq z_~8Ao%N)8_+EY(dozWJ|`Ek2nxAsQvG0W*!tztHZgB+tJ;=<|3+^yLNc#`L}^?6Fs zskLX%*ER}EN0E%lY@PYScnK8VOrVLQ42S4^MUP?mq!sGZUUw5ABP&Gi)V&p}@kX$V zCO~eD8t*hQA0902E0Xsb9Wiv0PPXvT=1^#D56KliLRH)nu;RWeVG{zidFw0nbp|2B ziWV^Fxz7dZHrTL-@zjMjQ`>`PCoyi;4j`yQTnuV~Fzb2zbj#Y=0t9mKXWW{QID?VO zyQg2Z3V9a`dF<;JD)tD+mswtIqAr~*peU>9mhf-jFDcnAULhg^Tl88A7ckue3D{-7nG5_u37cbu}%b#4-SUs5y8*_>$J5-VO zzm(lY*+gjFBzJ2&{*c+%xQgPI=qkV1c>X>6X|b^!aW5Yw+TyiD8{sY@G{)M{)*9dS z5yF$oQ(9bQs$PX880fon8oTc`+viUCD1vjS`-chjo9Bva{`(&nK??>xe#I60;OMfH zn=LEt>sL1kA;IRG*afCgBeh3W2KU7wd2r>Rr%83-2=>|>0YWivolSLmNnIRvoYa&z zKmPRm#p>Llbhxzn1j$O^NAt&4kBzl>0?vNSRr8T1v`IUWV!!X-cwVT zKxfk)BhFVtZtGmX?En3CH;U%jZl!4&5ifk`_fKQTw{GM2Y2HoUG5aPC@+)IUpl-YF zXTM3GecNUL{P5~B`qn^C73~ZIc0=2A*<2utz_dJ;7z76Yz486q%V?J<{N$n{;p}1b z^^rekhCdSj$E8iN{*d2`NNA9+tE>GV*WQ(*D|VAT`4>5>Uy7dhzTeN$jP9>1*!BPY zy*@g?GqVUkbUUDQ>dII10?vNhNH!d#M*;sC7_EjmYiU2fJ*$Af-#7-zf@*)7_q4ti z-YY#?oDj1@=^Fn}xAx>aKUU9I&Y>!+dd6TwFvpXw%q4%0Q|$34F8S2|%p+re*5F>t z7%eKxbDfABf45DxcxKPJ%B-CaA^SvvFa0hiX2UPmN}rW_ysuf^E_LU*5GZ28 zg3*UkY+T9vJS@8yPK%kM4hV;Y_(=-d82dUflxzS zqj9GNj`aDT*mwyd)2WVYey9g%oz8qTe`5*|N{ih>DLrzhrJtN3mSBQf1Nt4a9!PsF zKu<6s!{{9ZX2La7CPXjKel?z+nojD@rDz6)9NVa&C%14-V8lO1zf9nZ{> z^VUR-mxVH%9~Yyn`I(I&6#zi>;7mU$@QeG++KXUxS`6$mSEzQt4X zQH@%|4|%`onzXWIyQ062<1D1Z#BU*VwCm;C!{{$!TKT2Dpos>Kf~42@Act$Mv5DQtf?cEkGJK6B!Y|2Hyg0JPP(koW(_-!{7{C(e(1|m}nNX>-;5~%B z+^`N5P-7P|+1KXi-TEOiNUN)^kVA{s(tQqdp&v;UE)uEllAqP5k8=v0rT+hbgczkaD)(_*+`l|Fc%3uAVi#KRm|wJ(NHb%x%)4|_P5Kph2AiaTH5caSgNXIzQH?^ za!6W=ufZ`Fb)h`vYSSWJCa(+z^2gskV`5kb-^U;=cmcE-IyvM2;lgv=$I-meE7f-? z{b(IH$2%X+;ji>&w5`H9`k?s)|Hw^e&bURlOh_I(fgaa$utvTmR2?f<*{m`BCGLa+ zL#2yG&HTDjyzCVbgz;1(#Q()V0aY(Ob}~3}8*(h*;X6=%U3iC7&?3%yB5G#4*iT8(u-bG^#fb za_I&T2W^_L?OE%;Y631HB;CWY)>GC>CA9SHU%32@D*jwm= zLNR)G`&Y|WT|JDzyof!g!d%Rnky)I-8c~ypJZW9&v@|*4;%g&NQLwL}&EF|KEZLmr z4fqDIwVp(T-kKrAHJsPPN*^RJ!hm||^afQ+#3hf?iK0TeeMrtcjLV)78C@yxNy2;c z-A2(?T|p5|J#LxJ80-$e(Of~>mtdN4BW}_V!E`kZgAH2{OoScHE&F|Uuen!4(b>BY z2exDw+c){@H|fU$% zKZ?%9pQ-!j{gyimWg#ioT<1P>jbaRwOYTgi}RDPBq4j7NP! zNZrW6#(zezCU-10Gt{=c%LorVYvW>k)?6~fS-l4_5r}oa6OA}~eXih~dN@sq@77Fa zG%0WhyfoMGkk9;QOa9lUgXSfb^3F{EDRpKHoFfu-!vc4gf@p>-c|@ot%4P&C=dk|c zK;>DfnbTdk!Vz*^*CyG>^hI+G4+qNiO1~Y5#oWdM+%0ap&%mBcb_GY8HTs7ST$mS*D zUq>RSW(WqpcG`QB)Tq(a+-BEndPvheaEh(0q4grs=VeXa8#2r_=BN&$1x;RB-Lp0* zqRlZkC6yX^GTP?kk>jbn3QiGD1svjiaHRa5=G-m*5^x1Uh%WQ2uXNl(;?=)EC0GTEfpkx|Ynm>|w$@xD$*JB0r5 zPqTQ)gas25eXrihIirB@)i(=k+inA&`ubl#RLmt88)nUtGkXuvo7wY5M)TZz5-EYR zm1eM->#V50wHhtR8jC`ZUJ?Q1SEZl=jA=nxIN5Qr9Q%-&%%Mx|IkL_-YLnx2wDn=S zCfj;oAYh#)-~Qnd`XfmRuJ7`q#rLOD+AxmX;YhXyz6;RR=GGM1B@ho$Q^p@z zklp!Naiub(saJPwP59n`R4ZP8Pt=T?uh}f`s=9owPiJK77Y)>6aUVK}#Tk^#(;Y48 zxcT!Ndj@CNbA`o4{+OB{AJRgs77Qp~(Lh?8Jc zT=k-r@D@#IZF^;ue`N1a$`>pmK8)Xf2RHZa=e0Ew(#L&Qot@7%b-|G8=6Gej$whX^ zfY+j1I(~!?-5}l7E*%ejpkMb>LwjdvraQ624-S$cK!?AN*T}HDCu{$4ux7veYAVeB z`#S9=xqIrdnZD-77hNysAW7esxi~X5JPIU#U4OqhAU7cOE8+9o_mZ^tZt2j=+qd4s zO1|o*{?*$v1aAKp>Wb^Y{dBBxbk=v-?R+uTC+>XjKv`b?vnSNxA04UwAIGlSIR9&?B)$mJ%@u!@~R9^EMase);#i4RfaIhn+C1QvseI z{Pbnud-sAxD?n>H9rrWt_~n+8_wKBLD&xy9(=RH?*+=ap{EDcc4piJS#((T4t)8xJ z|N3@ZyEE`&PE}HtdcVFVe&uHU<#r`6?`Qj&H;}$MtVet^oh$!dwTd%+w(eKka{Vck zhuN3%WGQ*DJZCyGH3~0<2}m!oI!*~x8TL3yRc89rUHgaFgiGvUZG=#mgOP^1NKF`b z(^vAuH>TL{%ut!m*Y3nhd+u&qutdYHfz@Lv4ZGW3jlrM~_N|+bZrVgA_iYNZcTFD~ zcM{kQgpz0Rsxc5<`PNH(p1?;H4(AT1yo`fckAdsH6hG+~ZuA_gQW{K6DLXUzhLfgQ z86PsRG$6@8<6Gm%yU-1vIx)_tT<~6M`53wAeRK9g!naR0_q2r>039p6YytT3>D9Dn zlTcC6L*|nWW%Ck=l*}fh_Ht;sXrSTF% z#G5%u;Pb+^Q#w^tUK#3ZuM7bIEIe5{n=(ENPxjqHWygywBSX+8=d9lyLD5)~cE)-j zG|-HGa-5rA!I54kNpe2|mYVqYSjg)2Hki3eL!MR5^TjlYi)Pd*Zdn3~#$W>6{H)|` zT*)Ps3XFha5PbaX6x`UE+EcDuXR8?@z&2)!Y-OdVnYaN@Z5|<@rBUpZLfY z1k8Y1IF|@2#0O4xCPh7sI+oAzV<(e+lwGRcvsIBNH4e!YW)3ncVtUWOZkgL~p&}}W zb3?{U?d3wZ%f_IG)u7={Pbo4J2TdIeq`As4V4nkH3i8iIQ~QBbP*4NbYQA=;_I|b01ecajy^rH08;^9JO$y~|TM$gFHdE*0QaK7qE z_IN3ZXFE6u3T%`T|B6IKgqv(GpQ=+RJEW(}UsWrOgj7Id_p!=i5SD7H^dwm7SP?b* zbT#;{6mrA#LA$BQxXa)50ikWo7HAOne&6Ke8+s`VnIxc++E;bQPl0&FUIl_cAlI9d zh{*Tp|74aMbV>*n;S+NU$IcUYxzwgjL%ecphPk-3xb0=yxKFQUSjcu))%T2>MJABX z0CvoYq|+ZAUF|g5Q=Z_q>Na^LfyGbJs5XWys z?P~MJyen$kBh?g=up`$6FKe5ZtqNd(=@#>JDr=Be+jIhRKi->e|#S^_N zE>W_(hqA@_GH8R$uJh}xV=|`PmVE+O{^lnpk?#EsSZ*-o9Jg+#NRWt0{*;!lRV07J z4X`qD8+F4U8oFbOcD2wBAfD}|99Jh>zsnB8ttZ!%{K4gWBv&*;>SQMA96Fzo0X{0q zeOx{owLC5PEOg~|*t2h{{LhN+M`2%y?nv0oNd1}reL8@%qX!JdtAfN-(lWD$Z zOc0vBJ3i~hP2%4Oak~=@(xF{#8NOD!aEvDo)dMi)s60U9w(VTQxgJ)jMklExjjZzv z7eA2ri+i#bgDTXEAXSY0Qf&MynR?Z^YFR~$oN`Yb+JFK zy4w@l%B2+J`Z23Wc_~zA(F&@e>ed8@IWa3+4l=ZIgt=W~IFp~<;s8w&8JRcxfR6TioU3XG%ZJYx^TigGm{;X)*@NELgREcSjF;Vg2Q{JMGedh7Er|umoN8IPzDv zf73>a&Jwd@4zIoVl{Akvc>R$k!}GpFs@50Ft2bks{?z>v zRybVPar3-ii=f5^d9$9E@;^^ApOvV7#71OkkR{A$Aq$_3+V)(RX`FyxvBLtH3wcF8 zOO>njhX=rIH>g`=+A2^(b)H9ArVZp^WL&P7?G!uuJ>$B+5fIpO?&^3Q)rfvsI*M)N z5M1|G@K*cCRxuhnHR3uodK~~6|7a<}RC^)ZoIvMAhpp`g`+BpMHxZeGNucrl+d#!(Ak4+Y&71xd zm*&4`Oc=GdBcXme<W`N+_3*H-u<5Y1cQdRx(;6~-Z`Ee2V9d}rRT(CvGe@6~9LKKzbXMT41FRXae z^SaD1aVg}B^oj)1rOD^LR%DHYZGqm5%WjSOjDuM4#A#}?BV*4fH4it6!P@g)GxHpx z-o)EBS#t`T23MXEhGXJm~S7Rc}dkt0|ke)ceNgVm2` zWVJyp{BDLYVSrQX|8W53oLWvaukz77RGsaf!=!2(qUv{;*HN3qt zrT{0d+6aVq5qAVQr2zZb1_H(7uPf~GT^*5CuMOX-xS5rdIMr}#dF2!bv2V6LKL>t0 z5<1`Zqk!QQXR`|FdTE9~CW~=tW4|S_G;Dvuv+?|Wr;94fP*y+v8YXgt$BJ~nN{Cr! zBfq&z1Axyh6~YQAe&V(j7n+LX`O@Igh zH1xcz*|JHC!;49d+AfD_0WV*3i2~N?-`AAG;tbytP($mm2LnkT1yebya%dOs%quIalh8;NLpqev5@%S21P_FSnyxoWkeJvx}6E7ImG}NxGGkFi&Vg)R%-DdHt%- zS5kJ*pPESWcOxLEetvR#YeC*0685_OSpEDmcvt({v%AL+xI3wft9q<|MvE6U|6&fj z|KqrOD}+9Wf$BXFL9X?YuKp3K(`G#`${+y2L~_v7X3D{DO& z7bI2%<7Ba|x^zz%Dl?(s&G7@BJF7=>B_^zblM?@=yZ7P?@GB0;UH=)>P3LbtA3y!^ zoR7h~&pt$Mi-oy>!Rv?Ta*f_I3qnVKSPp$kFTb7g*#Ls1=09kyh$Z%Mi^~n6DN6}qC6ghav zD(dal-Fu^twLX8?-&vJRp<>1;iA~_|Ar7>r;3=8-@N|FAEkf31`-m2&1V%IvL0Jv!JKBq~O17reVy>UCQ zPg6$mFYd^!lvbc8#xt**kB*FpSIbu#~P>|o;RXob^i>kC@@o#{Anp|-58`yWKQK(SuUw+(zcBLZXshZVXMd%xxu5H1YwlwR7wOm;z! zaXTiVp7lY+CqcviaR_TTJkZ2JBgD1L6NxWi;di5}pE2H`IOS7bfkTh$MvCxUismX4 zZta5~W9j-Q^B&_FOprUDo%&6#mYO69@CSOtx54miH#4cEC4CZ7_Q&;&g=u`u2qh0@>j65N1SSz@C|4&!KE}YU3#3WY)Y~C z7mPb8)KqP6Sms@(f$|AR@^>4Tc$#d@7G8|3US-!L!KdipAf1HdF{5*+NnVcfQG`F` zlB@~}PS$*iE>un&Q3ZLDUQ;mQwSLmcN|n#s9Tc^m;()diC5j0DCdk`~IpHidd()`8 zvNB4(^bb{G27WA-{q%DVU7Hs_NML0Hv;_oQg5}N0^HQH5@OZhB?s_)95-tu_CLZPa zTG{@r>pgZ}Q6zQQA=V-MTlMn}1gAFjx+K~!j5JJ{m~$cO3u2YfUY%k{SM|HY8G}%S zdLF2aLtJMI#VF>4tg$=o!)ii_R>8r4$kmfZR_qpNG#$sm1}70yOF$kLl?_TgLiTUG3El6qk?*>=7m}oG z2E~WOq)BN~OW$dg3%v9+>>~|nQNAbk&UOEBxJS5-p#*s0kN^#eDE8d0H87YVs*_-KN7)b92WRpiiP_d@m9sxui>rd$An&he?8j%+^u6~62!IsFPpYvqZd^7|9 zQbKm1H=TU5ACSZK#(5!QQpmKAAc>7^{8)BOooJc$!aH2$0x*7V7RpXVJ%cpyZlisk zivG9`F0-U_Y9T*5oP0ycYU40I+9cdQ2kImF6q_ZACAoA45HkwCHVTyBR1F+*Rj=hd zfhcJso@pUV+bQ|lSCh|kEM7mpquE;wzfZTIF}TsSW1&#uUnzwOeS3G(lpxpxPptO zc|0XDnQx@1ikU^T*5D^IR{7Gj_3~}-P$uUs-1`@2`-!;USl%^)vPQ_Ap*D;LMA}c` z2N>!p?10_^1IIZO#^F4ZVEDzMx4UnW>bY{5)}9S1S9=SFT1k8gkGPd(aoGa)VGr!N zp}^PP<8Tk1bxQABqM)uKgm-c#xO3ASvfLYa39;_{VAf5t3}9&G>2o3#;;slQG0Qed z=~L6*lNOHvFVu(3D2XTm_Z-h90=EcI_sfwjqT_@cbT_B_A(8#9vCd#8`P-IE)~N_7 z@2|r*kE;|l_m5?ylfJ};hD;U+expR;SI36$_wke0f?`SZ|2Tg3?KNqjDr8VKl;UQy zhPB+cguxdUL)R$IcPH+WtT`yZp!3>@SHGOTspnpN+6^A}i*1Z|FadRVe5+)*iVyAW zo66egefY*3?61Hj#wx+J2~T`K^|htI087bEL=CZtSa~j2I}=l51=FZt*|6cOm&?U^ z1w9+r>iYJIcV}U#(e#zS@W^I~aizo;;mjw8iObEUpBz$_#a6nmLtT_(JjFa>0Wx0m zlhYyVdr!NRBu1w9oLxf3XKvFp(UndW(>+F1aED#}y*r!|gd}Cy#Qdmho^nI*Q2b>N zMzLf_bPLPt>5~-=1WX^daw$`#-QdQ;SgrFgEa=z;W-r6p9aojBCe`311*udLjWn8Z z#+cLO!gLRKNHwI7VqIJpO*3PyZm?YWGYW1N?}z}eW~|$MZ|H2>mYL^w6;UdHVf$@= zdBHWRJ-+Wi5l9~P6@BNYQav+XSc%TCuNS>fIJ#0aIoKE*(?!_m{o|fMil1YIv6*gy znU(-{6ftwuP1Yrw9kkqS116U;!Z&$TpW(ezINBI%3kEj&Ln-*z2C>wK{7yNhHOtB= z8O4AV!V&d5wWcS8;Rb*D^LwLYad__TiEK;K`yQ8@ixpOpWsPEh;M{e)rmkD5CO!Tr z3!jFNmAxvOs63|6vcDU1ui>I=r#Cv1H3^wU+xDZCm#G_SH&bHRVKiRZ?20|}sikoz zGb%hx_w$%e25K0ty;U@Vj*YMBf-b`>ES#T<t(8NA%NMZp2;vWQw=w*J}g(jD!Vt5%#E05#N8== zS`t!~@F0*@VA$ALII2SU)f1{Md6^x+De1cQdgTldVT`NW7Vt|x3F^vF zc4P~0*s<;68tLlIomgJ|gf=LG%352;s(5WPs zl8NkRpg}{Mf&wB^zia4bvbuOy->oaFG<7_wYbL*IJdQ+fEsa5;;a=B=-<}^-g64= z1Ek}v|EA(zBbp_SLTC27jVAy8`Kj4-Fa4qYq(jyf^1tuXgvXa{!d|1z9^KL@%Z|B0 zResM@m>U4U83;I9-1)9o5&v}}Aox|%pZ(QNtk4(ok%yaTFn=C7ncEwY(fZ}se;f^#dxEh!rZFcGt%ooF1+rn2-#+X) z9+X}XdiQ&z^8@03W$4p3QSWuR=q4}lL4Z@ongj66N=1d2?3ayAt zZ~S(9)wQ`H*PjhAnP&5f78i~~vTAKtA4UE>Sj3q>Vc4c=4}do=xOfbxZ^T(nl>V7HILVwH`h2u2{ZHcao&xEw!m4WQ7b@Mq zJfWYLU4Icf;QX2QOnbi{2uVXc4qCJ0jtN-s_?1=~TKl;Avn7T`V*pkpt7B~SjAe$|1~-7nr6hAWs~#v^Z!?>szD*8@Ejx)9ct5QAe@ zRPAj3oO~Z&xteqSi3%Uqo7M$<`4UHb`K6`CCe!vkG_p>z8UQPqeS9W{uV>Kl<=H(L zRX@|>)?A%bi9BuNq5s;WFsaJ4MkisuNypPlPlLh^8N65Mu&K=T2+?hiKsdAM8|Se$ z@{~1aF~Ge!dRmi+Q%P+*O>JpuJ5_09G~MO;&Zk<0l8NKd{=VAYdtxk*d*8k3S`^x; zQTD3b#&Cl1U)#^UUG{6u?80DyHuS9~(aMlt@HF4Wn%)W;9Wd2IVSXG}L`P^7-5~5C-(8+H!j;NM38b|H3mnvMjo^%=) zM$0B>y~R+_2wf4NP34xETBq^y+qdnY?K`m-A?#qX6&{(n0$FWf=b|irp9A!T`s*I= z;(TPCCSPQ>Msz--F<)x!6Q`JaHX{>A9M&=ChuS7pMEu54{uJEK*9M$^fJ`2XsWRU| z>jx34J#>IWb!W#led=V6Z&GqMqJ)$ULB(f)_|E+!v|rJVNH8iE_l8?qh2dQNRDfRq zI4RqLwl5mbK(Q%|PDSh4Z8b!fWS&h=$U3&q%{1~ESj$FV5cg-=R!)HGk#EGqFPcu| zl3Z_C9(=W2qg5=~czpe~gOQjU4^SV{6YbKdZGMcX9ZFu6uZL!K@__SD z0kX^qaICLk81A;fe;gaY{eu?0ikx zJ<}))?k&?;5#G3Ql&S95J&bIuJH5e!f|*!rF)Xjb4}VegHwvQ-CiTmI+vm-xt!Ip+VP58z>}bYgHVa>5aCzI(RCuOCx~wY})`eY(ESR z8vX&D*j~MF?maGmiFOdRxuG6jryn>Vwa=Z*{_6EUl~xKR|K7)I(rgilJ?x%Sp-I4U zF(>RehkhU>*}wd00qtAS82_ZQwZ5fz^g1OMqAf7gfkeksUaenOtO+l)2>w^3PpQM1 zOj%_pI;YrcGfeHx{4~(lNUzOpqfYYkqcIWKrNBayD~xj#=a%{!oive2x`XBPa~T<7 ztLyYF-uo*Im{CPwRBkaP5s|yW3`hz_9e|N6#`m^ihhUpNMhDC7Lm$Ip4#td$za9N0 z8q}-3$Ejx?wL$*IGBlaa^reM&8R>Nagcv0^%2lt1oBl3QFXRSX2T!ZJ*4??PFxrW? zBYZDD)p$GPleYRdwHhrLen+*u@mf?h`>hyJmV|N^G7tQsZmZ2<7Cmn9pl}vo(~sYJ z66VH(d@XKu?P*|$XJj*1Ki#ddIIb4*77oaS^kDJZXq}cegNE#Y2AbA$wCAMkT-EeH z@e0qE7e+;0#^jcPQ8W4XXP(|j_t*Q4wViDiA64`3x^U4yyO!cM8ay6`%8u^r&a7TJ z<8RiF|CS%?5BG{ssajcQWS6=}ND=NBIQi^$vXY|u5=R@HQB~?=Eb?JwcxlJkM(|bx zp$Bopvd{8ingGZ zUrFIQ6oxadO0FQ{+FaZ7JRljdM)Mg46nKH)?hQkydNy^|8B5I^-P_tgRb!YPetivy zF;i|kx3s2t=%)R8Uvd|V`P1|S(c|kyn+`0lZj75ISg`sSLu<|y8`h8$yoNJ|eIv{; z2b=}di*u{$!?Mow=vBCH-ai$-Ek%c&Pu}(piEccx)pKLwf|JVwgcts1ac;+@8R12Z zw&^!YjD52now<;Ykxp8&SrP`XDlEEFsZuE7jvHTf!w3*$r0OT*4s@5{7taQ%&|{|+ z{p{pkwP11#cuc~{+ajobCxa^fB_&X&mVpiVSM(GZ9sk?hPa$?c~zin>;jGBxUC zj!0~WUgZTjQS}+{show12PJ03dBJEc#wzF~u1w_D08PfIV^6~3!X`{z-LM+FS^iOP zVOE(dk9O^i)-r@Dd-|{5xZNddzfOx~V0mTpOxsd%b7LLwn(WPD%dpJR3l02&+kVWB z9Q|-_B~R6fA1i==%B;2y{733Xr>^^#5P_nw8(_tdR}^2>VaylqF#B=q&YpFUT~05h zKvlv>bCRV+8niLz=qw^tPUlPD@``!_OaY41FGMQ8kKHWdO%J$?^Z0Jk$Jm)OG#3-3 zhUN!1swM?0qm_4DhHLVa+)tlbkyYiVxJDg>K3uv@S`L3O7fy+FN?W-ciWppfe7Qv= zD!T3zPIk-)^kA6o7Cdnf;K~-*aKivFwpKzkn*WJeBLC&oajqI8+XHy0?s`rKNm_sKxV4VCSfLL80 z795UM;SbC3Xxg|97?-W}BQ1L%wQ>yi#A~6C+4;J^lsCRzZ-;y8U=}bg<;?;szaVO% z*^CJP1eCs~l<(hZRhLdGWt=Fu;dDUK-rPX33~tF^D{^krwlR-BkT`aG^ilE{GU*$Htk;}g; z<4-Q9O__s#4aZ4k5beg*4z0Dw&753+?IH^lK9-By#M7+FiK%}SJ|_KH;4>4+dGb(m zSRuo}F6ow`Vn;w>_2L?rKTixH9>k z*>>>n?bv|A0O9z})ss2*mf~DEW6ab{h-R=qtXKa86 zV|>H*Dj!$g+V}1_E!nen((`?^YGp%M-NRAAnZCHJ!QY;i>372ioFfsIwJqKPvr#?4 z@=_rynI}Lnrv6&9J03u2Z>X7t;om;JdtLR~Lgl}=Gu}V98%OU{QCrz32+h_Qsb}}V zW^Wo|vum|_OAc)B+&``_kcnWV#$`Q80Cd?EopQeHslsaC_!8gx^-o01n}^>22KK%^ zE_&(Ztpc0;6KA+upGl%>hXGKrR&igx`?b;s1MSt?9`QORVO1}MWnBlx_0m6CavFa_ggBYQQxAgE7ttNpm-CGO@`JQ6KB$de&t$(CA zsmP~?Fp}eX0X~y-2t%}Yz1QDSI((?#Y2w=TbNUue)eE8`qKOR;7q;?gp*=_ix{Dh; z-@^ZU(=EHz(d5+cZ(3^z? zLSl0MSxD*l4NdFHm;y~AzfS^)t(2|_Q~b5Q0X;8ki*_Ms*+qtwNhoQ?kQN)ts~t$GNfvnhOGUIyG3|Oa zZ^zU4(Kf3)VpT_>axh1r9MM5m0Otc;6F**dsWfPu%h{WFIq@ciqxqYt4>V99MQAw} zYeJ2HSp)~dA0ABrRm$0}5=mb%Aekqe;#(d)tl>E(DY;&1%j8CD$+)nq1`VBqk-8C5 zXdVv06>d{Ar*WfN=CVa4wL!PxHKb1Ti=hMl4to}bEQe&w9G&*3aaaS>Mqd#6l3GU6K<5860yXdWs<)#Z@)Z75NU!JEj4?&Hmpjj2Z_8{gk@2_eapU zkmvP0v>#x_P05-U+16M;Ei(Vu-UZ7H8g#@*{6%VyqDLEYI*`tZ5%^x^`nk8@tgI5T z7J=k)2KPY5#S&YkMep94Hj6-;a5S5V$*^w{xwMWTsXa8v578tk;lzSS2fge3bxJ+F zZYe>bJixT)Cs|2~*~$dmc<||Bt1EryA5KBh9wIW?mS7+0)qIMVwR_+3pT1^&MnGga2|ZImE?9=+ zmGj>eAM86O1st&#;7p3Lo+9chPPpCrjXepQc@j-4*f*&)qNAUFt;tUvTjL&=t@6|x zkzXI=l_h8TMu29^JV*e*W>z2VD&i{U>hVq0HoYLeX!^38>J&R@h}E1ceI~%iLCOB9 z(rq*zQ^)0B!a@yv!9VtFL~KNIir%B?UKgi`boe2Jl zH1u%%RE^IS@!{Ypwm?^+z}f~gSH;Z*C{sCt;_@j)%|2hjNjVb%P}B3vr1?^rNghvl zFZmf|8mm;!^IW{1Cs}_OmZW5|k`D}eAzhl@Gu(5pnkj50=l7?$wGb&YqPn$4vl}xu9T?3-6ks?jV7sWPNXv#@Y||U|Q}`7|kZJ zcga@yUO+=0#MHpiXG(r^ot@qpXM>i9A^_)&udov3hY&*AJ|V!<_U-_Ts2164{Jy(1 znZpuDKGwkek$h}AIT<{-v2#He;hv0OzMJl1Y;?EYpfW!?WQt(=@X=+R<_q=@kS_sl zI?BnTNZS!$x5M4};p^y^E^H!}OsQ~-sK=2Ro!T9srGAOx27V#-zJfgQrd>jKdEW?j+#+Uj zLLU$X8Ae>Lw&T>qy|V4pK!f@^>mRRlm(U}5p7<_0gC(2J`#jbevxtI@*JD06@3?F| z{oY)fLEb)oan|pQKd6@l4vi84W?3jH%r#B!X^)!-VuyoIIaRXRl$SKbGL}da^hr5H zHp+$y*zx#1>Q+L*beb|i^E7$dSszRF?mYhh4AERrj*$$YS-L9aU|ciMt3<-S*5bGPxQ+^ zZvKh@Hx0}Ty=>aHl5I(olIs_)#LkCtpkh->s8_CU4DqvXx89F*)9X{GwItru9|+vJ z8VT}rX)0ZKZr$y4qs1;HD7^TScFi_=vtfa4$8#rc+t^`|To+^CJ+BygQ*{PCib%Nu zEKW=$MRerf$BWrgws%fx5()4qYQ6v>UuWh@!gEjF>0jwC^{f>s!&IMwv7BXwgTDQ= zfDN^K7vH6O|9HKzpjQzitvj)uyw>OPtmTF&@zpEgFhGBPO(4*nKjjTXfkvp&$yKxw zcRCeawJ|mH2zF8i;(j)GYYzsf)$dbl0#w12^XmK@zn)!p&$H=k!X z=;CMaC%3J`I|}V?$2U=sl=c-Ri7i#&t};XG2$uFC|Ghcg4|pCKD3$4(ULzyhrxHFn z=3BN#Q<;pSOR>Xf;qcyhz3hL4jmigdgT4L5$+v(ez>DwEj$SThGg%SqIj;9gL`Bb_ z-xM*4?UbeP3Qy>D4NMfJo(VH@bWnhE>PM1m8AY}X^>-K{tzeIHMPt8y47X)wJL#Th z_iUh2%-ZpAX~W12i<4(TW+psr`I7tmROM3wQ=Zm-&$WBjJ?C5TC`Wl96D~pVOp^R5 z9*4Sy@2n+?cdps)?XNLAOP|{RF*B?R5I>$!qG(J!f9zGrJ=MEgEuI(Tu4VyT8}Ii5 zH9EAk9kQy{lQ&MeskHxUrG+Z8WNgjn>TY^THev_oQ#UhbGR|w_=4>ee0^qCHU4eY; z-u#*RyaPvWN5;);1FfzE=q_cC-HniUsJ$43{`X`a8h^=8*7=Lw$R1CyDv4f~rB+gt zeDJs>`k&Fona=~m*3R3J@AeQCfNz>Lmhl?vp7(!Ud3P_%j6y1I_{Bl`N15GyQYLn~ zW}dt;zAH6m6DE^8tdDfEP&hkXG)h?ObF=M}8KRNqmJr@q#B!Ld>V3%M=kh%C)cJO4 zUcCafb$_rN)kzYxj9Bejj2-%bM_>71}*hI4OxfKb=QT37EPB#rS_FXG?9@K6n zJ~ttu{g2I)r%mP`T)@9E3{)c6h0Kjm+@O`?Y3e7hprNr#k`4l+Tyn;8X?==flfR70HGtUi8Az#RNlGwHEz>*o(y(DB11e-iA& zAIB3V<;>USj)$!RjQwRtrvum5#GValHhAZPa&uQpNa(yaF29BK@9I(cKc%+&+iKId z<|=~yi2w5V@A%@n;=BwI3&u;su>%OJvq!rJ@kGyy_Ea4B=YZc)KKBo*@#}ack;tsC z@n122fTOQhezcAXa%)g_^X?N~U|IfkLB|w^Pb@g<*x;52k`uxOJ#i(^y13?H2z3qyHb)O0YV6bBu|8PbrxM}<57xJTll)7 zUfJlDbT#KzU2&K$K(Ez`wmmN){-?XB&&twRoH*L_=+^1(_xl5yJ9)R`Pb&asavaTV zMEYY|e&jr4(=5_1)4!o{OL>4@Z^NI**09s=r`%W#+2P)ZgVC&zZv~R&(PjZ5n(Q3h z@I8f{o0Z1iFJ4|bv;Ah7{AckAn~+eu8@fGjJ3K`NAHiumx7}V*_PsxN-~OiBc--u6 zb&Znu!o3rJ2}c%&VR*wcJTa}T7ruVpx7Rb8LN9KeA)J<*Nyn{k$5vf@HAY1+lD*L% zb|${FZJe!XZg$z)i>DfCq8gxqlz*^W%5x6^biJ(y7Pb~}@V_#Ir!@K3e;h-t>5=j< z=9}PcL`FL8+GY!bd9?PIZHXw}T1gUg(N?E~tSw`0vC$jo5M`HqwRI^)PTUM{X1^HwZf4A_L<;Oy;>1l#B+u`#Hr8T2n#8-*>R;y`0QDf#(y1Fv!4QMM<2N6JQFzS z;mE@fA8w`bQk1}I_Bn7l>Lq<>R+WV`EPM#dz!?^z%`YJ+g(U$E)w2FLp!Y-PcLnc4 z(4vX#DFV4Z6b3+olFt565zXVl1{Ih>g~QiN+uOKw5gI$D#%@(h$56Wp^n@W5S%HA6~0=BmoTA!02S7y0rmo>~&ZN*v2K*Ivx1 z!e%$yq>yuQHX+5qz%!dLv|xk`_z5FbHit(}myPThPwxVJbZvr~Uqp4Vt2#V@)vOz$ zbDYt;eqdd#-hB1z9_if8vei$rt^Mm(eM{dH%h>JjOPMriE`iJ~Pj<-sop0UVc0PSr z`;tC5Z?g%?pZ}GdE(0s>FV_ly$^-oXZ62OWd}s zsx5`e=C3OU(-d&NB5vXV>{ZMKT!Bd;DkH*V!3Xp#o6K@jkxdhE>L7|*Ta=)2LgCr@ zW=j54>eGx7WdTtSo{aIcPb@Te9PBF~*&XLG98DM@|G>)7=+So>NPmj80r|<3aBFOK zk)RIu7(@E3{|R3ZxUsg{W(a+L|}n~co!pRFAC z)hZSR;Ah*(_y`SM`f^%hS>S*NuK!@ScD;?0kw{t@!id9&^MpwV@I zv_Sg&RT(MmecC6m|Nqxlgqr>tj~B`KQvf9gFTwI56;@gxEo%)D*RhJ(n;?ocwKNcm ze1E6&3jg;y8Gwysrl$-$Sx1WWA?;J9yH_2a<9g2!R?bJ}1`ycpsEt6Y#&bc2YeYdT z414RUNs8dN7X~gvfu$&GG|r^r7b{sPHq|4N;CtaIRCv~hS+9W#mO(>XS1mw753!p2 z+1!fjB^R14Mo>^Ij<*_=T8l)Ud{dC{GiI{x$W;>0BYHj1)FlySC05{{*P~>Sx?|E) z!?R{CKsDT8-mSyUQZByk_;f`tb$Raf3ef zIZhPiU$BNyE&5FN?t*Tk(DCPRY>>zC-Cvrjj++|%GGh+Moy)+zk8UEPo^WN^4LR4& z5O|qVR&N_hCS4o9uxYO)4WC!y_e{o6{dktrW9IJ-0o@Z$QOn~+`_O5?6hhCSGQ!NCT`e0A4Sf~zsA0Lia5dZv>rr1_Ia0gM`r%e%|IBF+ zD__($7#VhX$Dzb!0&~9Y^&LV5@(|D!q;jgjJUG3<%6%gc6m}M7sP1l54cr4Q2s$a_ zRn!Hd5GB;WlDJ1Rm%_F^B;BsVPtu~w5;oi+WdcZEa3uG_L-=a9SSNLCzeyQ;HQ(?G z&L<)A$`?t-{2XmIct`V?72zhPKKLQ6IOVzJL~tC=O*U%L|4JtR0SP9(D;@PJ(Ni83 zp0tquLdGhzjVdAv5Oo{KfQzuy+t>Tt9*oL$r+5_b4tBBe^!WA2O*3N}fq0iohjyd6 z4(+R}_VlHk|4Iz9iYBofwBa2T9U(uzv6F`7=wzgdHG~YjUs3Xy7vwyS zKNdGBG=CU_pzq7CW14`oHT*YIEy{J01`Sh+u>i?`mk_B_Ma;18*@%mmXcP0j4cW&N zCqUaUhX;$#!iwT!}=*vE?%cVawDN zn7cm_sy2?2SAwcsMe1@wbD-&WxWLu_qv+h@ng0JM?w)Je%>5E$Z03H+J-4~dC7Zik za*esfa*2fGGIO7~MhRo)7P-zXau>ObZwZx4-w;JA6@7pE{kcE3$77#;K99X$uXE1x zw5>l)Texnf(!(pvkx%d~=u%g6&$27Cye3A(K-YH*BVC()u*7=?jXLO#D;5eaD5`8` z`|%*D!aX=6wNk3n;i2||kUEn#DI6yP#O0jN)P8)?JnBBhyfsJv=iofLs#Y!c$t$>yy;i%ac2>E0;@B|#yI@phkniCeuEyWbhU4FMb|{pY zBjCRb$B6U-qy(cA-P*z3ugY#osQR3cO%sS%Nn>$=`cJ8e+>o9>(Tac-UaAH5Gnc3> zu0Y|WWwGOmAFbo!QY|6?^Ubdd`g$=-OR#LzIc9d@ZcGJ)|CXduP!f9X!%(ju3V7(g zNOM_sbp3<~81o~?kh!M8_%%rcy2H0_M`tFgQfLYpxWHPY8r}AeKID#X1##8Zm~)4l zs9mRsV~W}zSOIF?WtJ#_ad2<^17^BuPClvMJE}E$QKC%o!4CH*`#o#vZfAja$+)xr z)Ltmg(B4Jw7IJMT)K}D*+_kb_co|DmF9LY@5a>cRMyY&V{K=zvg3o9Q%H~1GTQZ}l z*+pSp=gyCU$h?_{PQc#bT~CZd%_R-)w8wGY00nEyqSwJDO1n z++kF8wQ>eb%^0K;pNGz1o1Az0=yV&iq^b>p<<;emE)2tt6zgA)uJFbFnGY}yyAAlC zhd*u|O@>?*4=h?NOp%1Y8;+aIJl8*4P}TjjN%zBOaThB4&7nXu-~JyrO12!b{^E@@ zwEkj~TIYQuXHwe!aK2Tq**@WY)-T?cXA{&-Uq;nbL7}d>J-Ux>Ycb>N=0C_^@5Wwn zE$weyrjVi=EU!UM4w|by&O>ZPrd>o-iyE85crC7def1;xD}0das51cCDX<>nJLqEn z4?%@)7#tc3f0Y_I-@D0qg*`L7+jxevpqQwiMjCwA0_2WA|A&YlBDuc2xjs8uO?OxQ3QGRcIjT-L(iJhaz zyiSe`xi3gcPi)`o{;uo%XhY%L^a?p8cKmr6bCNVU)LMJ(+UM4bxd(~{_PS{Agj4Gl z4NYddT@O#|_ka1Ku37s(#~yeaeH|qIp|mEAR1zSN!w#!-j57(#8Jg zP8=o+V2^I0)rejtk`pX=ITuYG)`}k4tWhmY<>5SbZ|nJvnh2;Vh-&HNNy{$2x1jZ; z6X={(^Dz@TP92#y|J34DE81o3)*W|9q&i)>|9Xx^zr_6oT>I2}Y?hl|i-sRi5 z{qV@eqVu$^12DePHm6A-%zQ5Q<`5Bh zKZB*#-g)GCOMVs3fnyz@F#;BoNl7|HNIJ{@$B^AeC@_^_bay8A-g`=Tq6c>zwHYAK z+D=I##gS=*vP%jDb$pp7+w3+ZjhaukYfvE{v7!rKP(ojAq%Q`+MEjiBhNo;yOyd-J z#8s3xhU{#V|fooPvNAN3`i}Ilb3Gg7&PF9Gk^UHakb-RtUdg_8bR#1XVc7${u&e z!&6?1!_r>m9F~5hWGS8hQ&u9CuWt#oAck8)T<9VG3myXbpZEgbJCne@D*5@t*Hop( zfG!Lq9a)gN4v@XplibM$%s`{n&ye&?tSh7Mw0bUrg3tCCJRCtwST2oGIgsQVMCB53sIp;RWUSk)5pB{wYHK z#gGG|8ZrN}@%jUV6yJ8r_nJuU^MT;hgB}#US18h)EAHN>+g;n;6PIbkcz&Cp;QS*( z)fO1(f>)B*kt|^m_{V9I&-l_}lX`?6;E^*aG?fj^4hu|q>)DQy?x7ZG6M1af2bj64 zT z@{7{RUY&Y1`UOgx1Qo0jI7Ma8i2i55!$RL+aw%=Q>nmLwyYN1B6u0>D0JQP0Gx6B? zmvCU|T~+IZP#d{0oG9b2 z&zis!p*7sEe9=PQYb*o$&Ow|rz?>S8mtfr&!aT1TGZTnItkqboIn`dFhXgl}ufU>u z1w5v=ug{mF==q{#*&hufkl0-t$z;i106T%rimrVsI zEc;GHzUHItyNRP+u|VI{yP2$_I@~UP7B|ErT=IPze zS*Sy$nc`nb7u7aTK%QEM$f3URP2!wg*k1;k)KJYr?~y4ZdAvmhIT zD(jxf;=GJmX2apQr?qyUgqpD~I@_^MPDB(2%3drS^e=}~&FpTJm$rLA!O|P*6Ma{dfaQw?WD9Io<|-+hB2@~wWZ%3T z(tOS9aKmp8LT;iUb^*jHE@=4Xhu!BKFgExGhNG z0o6c2l%mJ#UYt%DH`PVfBD7io`HB4pi3Sz9@^N(Nz(&E*VIrtj`Yq&9?>|<(bBnv3 z&fjxxzr8Wq6ysIYR#pOp#&$c|nt zcH)}j(he9;(`b%fv%XpDZu70PZ$+551i5Sf&*1#<+X0iFKm0Cyb`xtI4*v|&Yh`#P z-+$+XZ#vdf{L2M0JI7l1f)8F>b*9>hP@WovCP~1d zMSL|{VPLmuvN(Lzfy@zm$-e5d+Cmve!Z2?h|6+Y`m9hq84L-N@@WA}|0MgsuJZH*} zjHPS(w!*SC2|wBN&|Wt`!q>4tPd0BdlThYeGvPdAvXd@=H#^?H-oiB@)dghNcqjX1 z&8{aSg*n`nP$)p5bxH88XGQ{0=bO7pj>YcybaAMFNqhf(?Nt*sKXJyU*wAE8NG_$F zeEkd!c?G^#51C@6(3_8xAU%i>V<$afag!0f*51FnaKV{x&_BiQ@#zg-QtP;%3gWOr z+XF5;Is!4_Oqf@0+9T61zQgm@^bcaO%jM+JW5>yZmHOtWX|}VzqRd5}S66n%YNEDn z!w^0B$Ig)(-Ii9)?ejFv-&uBv1_NsDSAC!S!}fiKM6QqCT-T3NA{jX8)$C|Ok3H(U zCXhN#D7&kuNh%#>M;Z7tdlTFE@`2ZmIVRgf2mr#mH^=JigW01pvAP?V?{Mu=82`xBvNZ)NLlNkfuf{F*tkQr<-<=I!Xf z%;N^st@ii4$mOS&vs1idnm*UX%;j%(z1%u|ww0y!n#J+9SRbMNQwQWSMl_0J#Bz7Zp#XktA>F|qK`6LFBbnA^@ObrULFExne=(_EsHPo8(Vurb3geGh^arz)jxUY^p~{j zWa@@^TjhPH`SGo_{tF}Cz|NLCiIodFR&Cx!UZ>gg#O>e{j)3z5<69sDWg ztpCXs#1YhxfbfN2C+y_P{ChScR60RZHRp>B9x*vaQ#U2mh$|CJCe=GxzLB?uPV)`` zUw@a3dGR%oeno&~OHP-Lm`CX8(3@kc#rd|p2RZ=4e++T`D0BYu>$AMu@UzVG&VGTb zVn^SKwyXvA;@FS9axcIU;X}oHb&!vn2J&Icem>?pa2Mni?qX;Ea1T{4@@{UL!JSl> zrmuhaMQXb$h1oZ)$MVI(0E8c27s$c&TnW{v>(z;pOO?KQ-GZ3B2gd&-m|5FN6()oG z9?3>m!!lQU2YC!y`Gf1Ul7RpGQkd&>Y#Qq87kqCJ(8|3?(_H{v_mq!!aV7Jm`VLiH z75St=ef4718yfKR^5&rRmLkhZ`M(W^qRn2&m%sno4tV|f(2AR@93NXc;Qz_A`i};o zUN1GB>({jx(T9uuZ|);yhN|_sT5m0N$Ax{QX-;=e4)_+=m@i9IMOO<7 zL6tRDmb*I>MSs*_pZ>>Sq0e=cVR@veC%bH4psPJ~*Vb<*`ap9W=TAqQzx#SATho@U zjY@Huw8)=Ix|yJON>~{nb;%yQUh6~4`UyVc+gJW*nCHb9Vtm9`l(Jy92rrq8No&GF z&ddIo-HC_}lcAJ`L=ICu;irGw@iOmA|CBr=$QBY#B44@goDG$Fg=S*v)!4QQF3B`6 zrD-3g%xf|!6bNNPTSL0)jMaql*MB>u)<|_NKmI7|0020yKTN!{MqP2;Ii*)~)x&s3 zhe{J=gP&Y$(7z!;I=6M4r(H2|ZB04zTJ#i{u5t%bH$7o-Kk|P3JIl9s8YjqVP*se{ zWn@kz2G9mBsxp7xCI)~vOJImpOLTq(YF>L+Pz;zSB?BmVjZ!7}9D;7s&fod6?b`U_ z?#ZVx&w|iGzwJ#|il(eP#oDKwlLt7lKjqDLv@7bv8tvO+Vflw&ZQc~eK^}k18J%9F zhvrKhtz7#K93mjuDD5&K07UAL5R_73!AGq3jR`cCj1 zl*qe`Gf_uDBY=4JVctGC%D7$iyL8MhFDLsb2YPY@D(k}OJjdi5SwN!?A4m=6$DQa$Y#gVY; z(`ifiFImat?}{i(g!!Vwl&jH?&!WUhaX?4$gw5z@wPz5^V+|5fM!rD8I?~-u5Fq0@ zb7=N3_5SpC1%YxeXEPO|KQYD3hn^|}6HPoPhqBF7GUDay2@VEu4e47YP}I+{K$96<&gQWe7M**d!|3c$vnJR7Kxp}^~LGF zN4|949|uqktv(4oPbz1F=3yalDU7=9w0{YX3Tomcb_g*h`^zk!Sw8#DN{%I zt-M~=pH()}?G`T`Q6X0bwS{wY7--{;hHM*IAp1Al~u zU7l6=5aeNn_%#iySK8)bw7z`!u(a-_Q(FF4(2501wb~1OFz@Sb=bPGfN-0)Ti8^2* zk*QsE-KRgMp`*lc)n1LNClBQKFO)!!P*Q!GmH;@X-HQ}XtE_3EZ7b_TYX$Zbu!>RI zl;wKSY0I4l9)8Sb&x>Q}2Dd(D!g6Ugxc&zB_Cq>P&5xG+(;ruExYQ;zL69=uWvOLh z)&LaXS;DB+*OPCF)mpwpNdTNln2HT4N>p0Ukp%L{X46ENT;g6EKdi75M1GXAUhdP~ zn^+r>>$2I#$v(?0^txJZG0nH+yCjajy~c;XuuIANP$!yibanak!AX^j@dQ5jqCT1q zd7#d#jNXwP+^z`^Qf^={4ZaNAEH^B_@&J}!m9n-#Wld}y(Z7KkwH&t1;X5#?JpbfM z!qruq$d{au6mFO_vkD6l*i`o{f~w3d*%Pg@L^b4Z)Ihyy<)5m2v?BP^reHJ9Vb98KkXuwKJmEI#(J&vKD0&0v$HflNu43-HOve6+aHvs4hj?x;g8#M)H zFw5rh3r`sRsRh%twT0;!dzI1KoxGVbt;^1c%wc}2u81cib@K-ZtkLuw+)K3;dVtL? zvB!a>_?=Q;`Ap^i%U=;zw3n;Lj$?95ek)ca$4695NBVPAh=yyEd+v;d{&-D1!MbPU~;=|hm>e2MLgOPua z`(gf?({)>1s`(mm?AwbN>&N!{?Ugk&aJ8nJo5aq?*v2N!k9Nq{_)6zm8U0jhNoD+C z719`g!4V^K@o{IMu3x_{u5?tqI}>*Halb&zZ>^`(ourR&2M|Vf5}wM8y6toPMoHbb z%v7j$wqERy!^kXLdU#URS@QG3X^K@2!hGP_gurJhi8o4$X2HzG+-bM1UBFZ8W4Sdh zUx3%#Jfglh>?s}k(TmmiO`7g=@LI)1u6Q#QQQi%uPR!CheYfa+(x2I$+CKEO*{E@3 zruEOn&%(6!x2ZfU`CT$B(){W|A!|X0%W<)V#m8RNxdZEc+-Y+kye^n6zY8*F?Oh!R zEFpi%&uoi~L>YAML8Iksgs4D%6H3s=Dm;MJzJQx-lDdqp$=0-gpVcyHc6(*zx@dKb zn(r>wfm{`o&a(JSF(DtPf$-Y7yrF5UBj+h{RR4$FG9Z*GQ)m%V0>*D2IaSy#-SIf33=|wx4 zf4I17k!=;#fXQP7TO{<|njh(@vwlePqC4@HYB=yYsJFaVtsRKm8f(utJxY`s zqpRmkY4FHwC1I{oZYqK1<&3@l@P;@Q1@pCrzpXyvo>+usZycHb^p_6$>dAjuCVU)3GYw7RnOlxVDcVExF z>f?ILlph7i&7-PE-9E}gPI$T>ZijXHR%>btPc6onlzOfTv4?YxI60xAy7Dhq2ALE5 zy9OxB`RL~Epp0JSNnT`OmhCx1vN5N__V)0f{x#6jvNj4Ee!T`S*A2P8z-8`H zB%ilqaTKuUv4W8oCj-Ixzl;5DH%CeQN)Q1hAr7?F291K)R)hz}qs#F*~UtX}oi0kf(=2!vzGy~eUCKebxlDV+}Pmn|pf zMKmR8*x~L|;i9R#08zVD$Y`-o?(^NKW}ao%JyQ(}yKVET7LS5NvL(Xr7WR|6lfB}v zj%w7QE8?Y|xAOI8X9kYCxt2;jbGl?sm1BJnq)N|9r^9y{60u?}ACx`5H=#Q2=`x{*?Wtdp8vLUFr6fLiwlr8IE2~`eqj$EuR1#{e>jnVQAaj zW;Tdvx3N|wKbaaigqIZUS)sO6Wr%r zUg7kkf7IZr-2LsiF8rO7hc^E)*w0M~Z}|3!T;IIp2J{Rw{BR4mmmX~!+O3TJ>25gE zth|HZ-rf!`asQQQ@lV37%cpbyG3@?Pu1iY3=kjW(d4KmmhVHb;oCQAlykOv)>fP`@ zPrGwP9gyWk>nEGn(#vzRw~8G5a<%AY$dKpp0|ty*7G9%wxJxd2x2~M2PrVSO6R^(D z2bTY1VEA~XPyX;t7Mm!0_41zFXZm-WO)#jbkEx01V!7D<_P`@)YIhZkZ^5|B# z;l%g9?_P!$FK}NV{O(TvUKsoV@2=@wK-OMr<{cd*z5Y5Iw?yMs^L8Nk9z8w# zSG?}>f_;ed;#7Tje(Q(Ft0BXePVagsqAOb!7kjFQp7qN$BwbXrx?{L1`aJ3{^y|85 zA6iP-(nWYGJ6@Xn>h0;}Ys za;e<-O%I*EXPvq^w=qz85h-3B&IxTcbEmd>Bgs8a2*-&^Rlo3pOaP#0 z5hm=?wx`ttOvA8hrj<|HLivdVl=PbRNP^&@bGhLzT;#Z(!L%Y7{rH<%3Rxj+NCt%S z!-O!=vA*t-)%vy$ESaZo@J&%8*;_ILN4-F9h)m?%j_V6k_#tWs8|-c|1rwB>y5W;q z9BJDj;OQ7&MqhIx?s5a{ zf=Lxoac40{aTA%d6VxzS$o;gJ+3lCS*1pUv4tX*=>Yp5{Kb*Gc9C2x}=4!!D`Ad;g zM(Q7l_ZE;+(f9{%u}@b(@kQ*qz&uBpQd8vs#ScgWaQKq#FQHN2ArVU3mK;cgRUp=84L@1e!6gzr zp!ou#M59JHhT?mF`esD+65zo0z}Up?kG);$txl$56#`l`E>`MU36^v70P$%M{4moJ z_}f_HgAdjW6mKfi!anU5E6ZEvip%9g2#oB20CiA{^C^#9OS%6TIATZ&0We@y_62Uj z0jD}2{kD%&Ud(X!IF&Z$D1bcGa}eC919Q%!ds*jGa%G4E>_Ucwr{f0Jdf3V0CvZOv zPmVJx47oPjA%MvJ75d0o0C-oCrf_;`>f_(TUFv}(#qGW~K z2GN<1F4Zi4i{+nHk*3il^5z>fh72^@$aV?wv`(4<#y`n%WR#C3c<{3X8ccVn9P6h^ zyz69E5jwJwRqZLBuwCqeRrE<2?a)#_Z9a4Las~$ZmipHj$5^u}=|oF<>X_UCzku`c zW?Ok_vBgQvl3##oa_IrG(q*RcVFF601nFxS41tP|_Err|=F4Emn0aAkkjh1;oMn0p z(T~r8SMA!E<2d<2Zg9(c4&O*y{To6p!DAOh)0o-Uh`z)cB{HR{RF)OXk}tPfE=_B+ zwP_IzGuxWdFq9$Xl+Y_P&0fhMH?D5?N6g^S2MAI9W~09aNbL=>%5&!%kgHJm;TWGx zv}BO4?*Hm;5QJs&5Lw5$q8{_gMyh9@(@pH&2QDJB44^PX258jKJ}3u^|PmVsQ)t z!7Yt7k~Es{^N+F`BOBH6WQ3y{0Z$ zA416iZ1@cHh~SeUV*}wGQ~L6eNGi{)w97h_xtmD4p=KR}bPeAG%_WLc)E{FEKS=C^ zE!hxoVucsAB~z&bjgfTA;$6byZ#FK(NKh>;bhEAJ@e`F97GGlXu-LRc;ldZ0D|}F( zZ*tKC5W`N2*ykw?B|@1Xi>tyd2hjw=BKGmbisy zQ38cSwPISj^33;Je1cl;LBo5bwOidRkf7$dSb0kHeBc6rg+$fz#0FaWNeNK^NNLTW z(MgfbSOsMe=Q}Lz1dM{21yDDoKpK2~y^ws%2P6w&37PtD7ZzYrSpaqphSa{|$bw?4 zjHm-C{BAInCm@c?Rs#VEt?u0gw8UwcU%9;4iJEu3YNF>B)f!iOrmC9Nd5FuiZ1t=^ zO)^~^A6Lpn)*W#_f|lfb{f{B}G8sUo2<0KaGuO3|a+kQdEqbFUn&lDUOeVI;Bg-H6 zJEfy~*;~}(ijIzE6UFhdCI{p$m}LsOA~Wtkh7G$1SIQKI2KEg1N_x$T_D=ZuO_j%7 z*CsJHrVM)$j#O6Jv$^Ny%WeGaOcP*a0isNng3%f?bZqPil zsdos0(XhX~0N^Vp#D2$zgShrFzxXO~sryppKaqR8FH=V>6Zk~7+-h($#mzt-wE+N;hmpE!N?GPk(wB)nd zEptsJte<>i+2s{QqvGl~ZTV23ag4N^k%^b1m3z+O+rQ#(Vgaz?LaB$I@NyeRReO7; z&X5>!3Z*fIQr>$Tv8vSs21*!Mi$@16!TrWG4MKz;%UDP9T@UCZWQ8wIi<)?E*P|Rq zv2;A!w2ac+2Fc%?%8Xp-H7x0b)BXiMo7n?3?-7rw-pEfnt_xW{0H9kf;syTWJjfj7 zp4OPqSWoNFrcL7CD15OI171K>_h$d$Z?>vp%xf^Ovf-K)EwOrb!TN|!hS7Z0v0RS= zA6&=(EK%%Ye7DPSsUbA5nB2-HVv9Uw^Vfo4$&ejK`el2a9hJG{$e3w6A9PRVS(l!j zFF;An;w8%vuERQ0(S|x!3zpyNxMp`Rg6pSc7>ZQS5Q;Z}2iV*DM+20sx#l{OZWTl& zp}P%NG!Qm5)Omuu2t)V_{_GGFR7Pj$uip`Xd`9;t<>Lz6NPihO7|mgBH#3&==Hq&B ze$JYs)eojEq2JE_@^@9T+UOd3hnk+VlA9CH-1Hl`7P;dKkrBY(_ExTol2?jBfMpP_ zjShWImq&0vn*2~X3&1^hVaoBA9@WgELA(#t>4fgEa_fHSZ}*twCzA5^vPNoAL#$ObNX_qwjLl~ls0ctkcET&SI_l{{YCmXnHegN-ZjyMFMHrd z;~msL;tmuviT+>otwL*phT96x<*~7X2i(+*O%Fe1bf==>OZ7O#Yr!}6@7Bqn9G6~; z&(=)fUpcJOC$!ZIbz<>_j*PxiDW44Nd}aL6KOrK&BkEJxTq)=N)pxPGdzJOi6%TE8 zwx|L#5Zw$U!oz|TBv5{@^uGCWQL0)2FJedNyP~P1@-t@oVL0OkDZl2evtFs4;_ydw|hkzkXMrDt%=prp#Dg|iplO9OG`o}SG&U)<8z zZ3%gsH;;VR-K0%59h1?0!c!w8BgDn+?olV^>>HnHrQX3rFErJT|1%-R{ZPh=p zYurq8Xx31~5vT5myM}0VrxVT92Cctcc0E>{n$`CvCshxfzT5Rk)LQbJ8Zd+>*v0&` z3lqKD@$aFlhsX*(OalxrF(ohauxECl_uLzzd)mEKsb;(0k2~%fl8++e=SB^jQL+Ww7i8KV6h9KJx7RZj`b#>gZW1|HNqd``zO(Z`q^A*jFgc;S`^0lQ8>yduZuPS~K4uKWY8aF8zAzoL#ODKQnp~WRz-kM1O5FczNl8 z#O3-7Wq0L?G(22;0%wfd+4s*1NB zsVd2o##!_xYn zix$;I(7x&0em1eCeeQ$hQ$pA}{baXV5@b6(NNaT%3bI>v$_T3DxzAS!?hIIgnYR~B zO)q#diUxW&T+;l;-K*Lq-}Z`N@OU~2(6LBriLZKIix`YYpr1j0Udt+X``q&ddz!W3 zY&4J%v)aGpmN_2Fp01B0j{76Wlt}uK&OUKGxQSe=bXBA8o6zA%fnduT%*~5$ukAU& zE&!ce!%M@8@BzR!m7fs!u~U-*!XLV`+He_*?#H^O{zC8?f0vAex|hFxof60YDUFgU z_IC{UCm&A8Ap?%LeXSM&01&Ur^QTDZ=*c`3g`)~p(Im4GEMVoQ!2cA)1Ke)-;fqu( z@tl4UQN?m^`f)9BD|(1zALsFmY23dFyjOAK;aZ1V+ow(z34aFSWOK#5+U)IRi@+V> zI_PgJ7~Q_FCP)t%EQ?OdSnkC67PG-fs!j$>a`21vqAb*QIpF!gw0~>>HWeoQLaCM) zc~)JYgslI-ov*A!>z{e-rDmeVDP`nzQ9sAz}5)b01>^Ps1nG>nlzqqH|QEY)B5WO#xg5sJOcB^Y1z=lOOj!pYTa zrqD65rZJ7ld1lD(p$G>_?R5+*-~jK#MJ;5{kf|XWize4{m`6JH(58`3pQ{njGeXtB zys}>5i{+%n(C_67%F$x^FfW6v#9A-}Bcm-Mrk6o@T5FVm&fB$dAQ-&!Rp;>!?Pbcm z?#uRhK{4lis%29ei)&_DZgZo|%jxm)q!^i$njaF!GO;N+&g#X^lSB{EB6b@*GTfsx zt=$=N8%jV;a|}&6GnnWTi04*W8eGkm2*+;j^)q{8D$Ez{C`894O0rc42?wS~SheFC z`ILKI@Rr6emsRXRMpLR@_G4o41%JDJlk>3G2T;zVp;8V+#c@x#k--blY?Uv}0tR0$ zpNBH3J}(F+E>7P$vaAGQCAAt#$c5J`>^*(CcyT9Y8cFT7oQV7CyPYhXSVvwPBb_-_ z-wxbPuv}D^8NILsQP-8#syi^soFTBhKCzP~S^a7gGP{G0TA43EB5x%0tt*1k-5E zi&a|6Z@EijnBT(q>G_3KF#)f%ZNmLjFFflt%g4B_mX*X*JT#SZGmvk~{SKp=odTu2 zW=tu~^-`-$5{)GfNX_cto^<$nkY)~_G*uYu@lo?u!W_xbv07$t-NFf4(SqNZe{ijv zm_Z5;%Wwy_FV6*MHT8j%vZ_B+4wA?Z9@>q%T*;dhZ+?s4FFsfRyjX)jVm_@;+L`;{ zhLL|eDT4WWLn;|fdoo}0&|(mRzw?9|%w8UqTwN%x`K?p_!EZr`KYR~pd>@DfUi zOiD&~e_TU!@+~PkH`wjZCl;&jK#GmSY0h}O4zc}XgWbGkoONelr*8ZcfZ}|Qz(-6& zjK47$bw{KgYUFTb$*!9bLmQE{{??3qE^HOeSslwd^D2Mg=?69~rTovKlm4DC00lMS zf6`K7Q#@QP7d+Zr;#ea4gc2d8v(`McJrR}W6rwUyPu6r?deGqup~1z?zmPLAWIeyz zsl6?_w)(PI`a8G4fwmo=1E^q6dD=-!+H;e-_gOW5tg+Z-IvZ16or5zw)cr<_#>MgQ zH8(hWmWfJ?s@q#GJVS@tLPaH4k>iTUZ2iov>H!{A&(_QYLDrRD&|m2*j(rS-i{NWt z1xC1r$b}m-+u_#p&*AzQarip$G7V>lOiR1(ZyA<% zII+c5hkR{0uvUYMAD=@5eok$|t$S6nYR&lg<7YLs!wWd5-R!yx92fYB?)U21R%#ZT zG@XRP7%w4xt0Q}->kr^`sdj&zi~XO+;Z>`5X94^xH_`R7@54Y@`AyL)6PL@(xndrf zwVPi6dY}?>s^M8{)YSx@-Z_(ASwHb<7t1#pFCi347a!OaVZ%9+8B>+S8zAF%we}ao zb9Y>;^rrl!$|v!*JR<|ePpG~o%t|}|eox0g%5EwEYW;29dUrWEsV|z6{v;Tb>Qd(4 zRZ&VuFgh=Fb(&BldrIbR6}S(k`FSV{>;A1ey|lSX`Hfl%2+C>v&1K7p6&|uTJ@lsc zow6s`A3ki*LfYkb(RINWzjNRnVXt1o!wE;16#C0ktS=;abU2w-M>Ihd+%E2SnU`+?1f1k1fec|k-a z{5BXrZZj(Fdf;ULM#?St(_^NBoSCY1Gw7%}+H`IRZlWqyyxAd8xpO!MI()idG-|zA zckN-*iv%1!C;BUAP}jB@U@PNllm{7 zaK*XcdiyCBUueL6lK7JXdGrc$5kju4&zX=qm=eCZG{`%j_ySli`B z&4SBCr06!KCti)$meTGQc58QPS=&u~(2)LrL?PPZdiAR*n7p72&It^A zlW$(6E33I;n(tpY=Kor$A+I5hd1f7hc-t;j!hgoU|Ey&Wv z&ts|K_3hwl;$3H51J>1rZ=SMa33qnB|4N*LeF;66u04&Xmompj;nxr)3!-c(_q$Rz zRlU42M!aQAzRVSHp7?Ju{PUW2z(0L9xRhV|0dH<9n1X=?C)_i)>kB_q^4=A^zb6uF zR==tf=SQF3l)rOURWCQ}2fODz)KNa+`*HV3DC7}eje3k(H}?GIe4O+@%YPH;0PAZP z{mT0nzW)BYog%(4poR7MQ?dt+KJ%7P9+MEnJUdO#c*#Gpuo{#3A^5G!q8Nizw%}u$ z#*kVVlg%#Q{@0n!X5pOMrjhmT#I&S`L!$b;UmhfQ{8&N-9D@N6x&gFJ{$7m){8z@0 zrc+Y#?)c0om|eh) z{E0^Xf6HI$DS)s0GN|UkU_JBG-+F`Y_yBU&2sDRP$T%#Q7{D7`x5f0`O4Fzy*NZm$ zeEL1Kjw0OUVo_(sms_}`sP_yYPM(lira!dyz2^23hfmxvmvQ+l*5snm{fhCcH;?pU z8n4}+7NV=6`)+<|_u9Q_8}cL!CFfwCn1TNras**qaMl+!k%sJkI8>efmdllliIp(L z)TCoGkYx-4T1qW}c~+#`3iFa^q3j}d>0GF+`H=N*jw4N9RQ4^ z>CH~zD$~cSF zn3u)2G3&g+il)}akP2ql@l^+iHoCl`c3^!Idy|bxP6K2LX=Kjj@W^>8bJ1mrHBrs| zK8)b|se|~hu&j`O%S{2P5vx>ff}8o4E$pK8!-zoVDV6lyczehq3^7v;9p+=2Vq$UO zX+VCqRrmL~33-C(>YXf5*@i{ZOVXl>;?txAk*;-cx;1a*rHUrI4Kje&_I1f1RCpZ} z&RAL<(P3|HqNYOd<+_O%LRDD70%XiTFI_Q>0IJkV0XU|FWCeYR?GmK6rKqtRvoe3Mp^H7$~>r7#K&O40sGSa4TzWyLsXZW0YJ#tko;q(6vD?u zT3eZ|eY|!}9`Z)nWsJ`lEC94o)Oaz5B$j!FsW?K+VS|}}8>&!flL?D53#?~>5Fl7- zOb|D<&{YcDbBKfh22^dVIXGE{7wCTdS?Kf64shhIJoiu4F)c`Zd$x`wm4(+kbIb4+quEkt_sSrrLRon{&3BvAbaZ4(s~*JcF#4$#5Ohogs#%2^h%XkYQKC_iqJ(0YB}@2rc_e>z zK(3&?x5TzZ^TqglJAoMxyP&$!w2F5HQO=J3%NM*L+~m0Sd9--93c1Z;c_S8hVWpVm z=>nrM%k)XNmF9E}31oal=KeI$w9K^@UIMI;^rSrasZ29wKfRY}`FxCtU9!uPzb}iQ zw&bei;Tk;R4<5Kuh+HyNpW@hU`yWf^9hLO|{%l_}sx6lb|`?{I6wJzDM}Z8*x2zH>FK{QUTy^ZTDaI2>N^yr1{uab0cVyBrP4 zg2N;%Bl`DhoyPm5vgyWD6nU$MGWEG1p5Kv`xRN=dxgoMee)&-rs=c}=s}Nw({@6c;VLiAZ zvRGB_JM$C%;BxYF>gtpmi3yO57!9l!_-2g@qF6t_((q_FgXM#3Bq=EF5#`2JGBdtkiJaRk^eO{nMk*TFrkd0nA^{?V?#7 zo~z#oznU{=N@#bnyI##9E|&)3nNGG7A^)at#m0oX)&?kX z_v5#+q=g1nzL)64zYd8cEaf+R-_O%sKR=!B{rO9xm7T&9!iFASMyi5B&++`K{S`KP z@yL^)AIXuYA=XOr%pT>u(R`oidu9YR7T2rwY6L&uvyM4v(QRMPp zFe9vjD<_9&DWc=Jgk78w4pV*Z@i6W|yA<+HtN|%;;5>l5>?}Zu3EcIHdeXKd1Prhl z2ODcisWzf(m^O$C-n%{;@L3z}@08>Z`5F9uSJ(N7q4<*s7QK@Kmz_H1R-jRD$8MxJ z@*nKx!*^qpXDJ``PF%JuqqjnKAdU_VAwSz7L=Usn71bi< zYJ2C;u%HJ|$3y*luoi=Ho9Zp0Vfo4M@H#hYagEcraBk0S7olKj#RnBPV<{uPA*#r` z91;gk;hm{PV#xYv@~bs-h?#=7^3V)dM*9|K7amP6s6Q0tR|y>TtvmGcly0iUJ;$No zPOKjy219@J;V3nVpgHqxj|Lu{y??04K)bp7{Q%}f=j<%A@&~!)Oq#squC#F#h0JM5 zducES=C!hT?-X(@>5_tyh*CX=bLwQn08U&i%vIs~E|={DowSf}6c_}$kGz4MaoWL_ zMyw{a*1l(2iop+x`g~H1rjZUdDXN{B<_u`(&E>$rE}~lRR5I{E!N`g`rR#t+WKZ`wZxJ>n}eQjw)6JKyV+Qg z9)4JF?gKdxEr}{ixIR9*u|E?J%Rsl=cXsQf8Z|ybM+j^oqtZ6kg85waGi;~iownRh zQ5lK+Ut%JgU+kW_ZiJA$X%%51G9fro4eHg-;Bd(Etb(t4r@ zbN72f21Cke6>~u&PJ65hq1mbG}&CwS2fJu+0~(Q%F!d3 zYh}!#bH?Ny?{n_uah|z|UY?_mgT?PMAq@1Skl?PnznpSh)*hvDbIkIneqhV+jup|S z+onb|8)b0aV#nlS63^J$PvP@&d){mzOBR8_O|1@E{t={Ftq|LHcUn*U`sR;?&R6LJ z*Rtj?zwZ)5Yg+~B4}!X`Yf90gP8w~Hk)_vz(O)j)?8~`%;mrHy+IMZy7!V`og-8Z0 z$Z+Ni5@Vpt&FARkAoV2Jy1%DUAE{`8m6HO>duB8*X84ByUmtk3@>7BHT6|c_SEy`R zNG;6}gPG|%AF{WBN@aPUn?E|6+z^>k5fP;-87JVQ{>?A5Xvy)pLH6E9pu;>zH9T=L zq3VLb&e&7a+GsCiLW#UHYQdpzzFCF(^V+xnR?mGn6{BfJV?)KR7?<7|$jo+qJC}BV z4h<@beRwtDWqgDW?T&&+&*p=lVCKl?cp99jPoU@96uvGG zsEzPo8fHHTjln+X!KQx=Q5v+C`YLlT3bpl}VzNK^kjU{B+b*Qf(YzDPxRfbV`fahW z`9#a*^viyrL;v*vw^kwd)dnSZz!?ckX6fdCEUghIzhzz@{m0CC{edN{uqQ)Dts-}nr2yWYT>%FOz~0p937-Fq-;UWc=i=(;f2q2|$3FTs9sl9BTi-bUCH}ea z63QY{4eg;xSx3%WnjriJ9*x)wXtxA+@{3O`Z2zjR3s#m;%n*LDTKV>WEU;5m=A6s< ztD`)6pc`d2Fb#iZq3QGXQK!-rBdamCa7lGNiSUa}UFr>p5LI41$|e@YgZYzR za$F7vW^cRHW=?68w%V-pmWPzmM%}x^F#oJe4E=?JAWApzXZK7kQ>_C>CA;g-yh)~> z>8{Js=sPZ2>}DAzRZ%l@9fA6Og?>0~(`SOrCI`;_caAptym)d^_>?T&!DJ&GQZ}c7 z7NB#zFP0VlwOSx%t^G>^Y1=;tksR*eN*ud(RKrNqFhwiyC<1JBR)o1TT7?B;ppnnM zhImkC38gn|z`US(aV$%h7`V%4&o)WXVmuJUMZ!b}N+=3S1SCn_&85k2{ez}`KkT(J z*^_rlJU`|NVtEUmR3~3?E588&J@+0`4h;TMA6NMwJNggIjyeF}wS? z8i}{`(rki~fN{OFzkJ?s&GrZ4DX1^s?W(YLzr~yUsKP zZez+u2X;fF8_ zwP|c?po00TQX+g&w+8xML|N3z>b~%h88WTcLdu89F-(%}d^isfKn2_qu2Nwk3esjq zAj+8-q{Tj%)4I5R8=VD551vb_wX!gldv8 zh52Jir8!!=WF}kofHK~E#_pTZ6nUDA*;!3b*W%Mx8~qd6-l;zR?M062YQe23>wZ@I zmp>sa%NQq^@YgxApTKK;8#5}iEvG$*Na5`aUCkf`)eC7~LUG`9c}%CEDH;}+swuQk zkv1B|^(*+7D-{plbi7!eG^LPC_v7w8w1wq!6OMr@mmCF|C`U$evIzk-a?WHmX+xVe zW!1HYfO6$A7RD|!)0@!m+NK$IDfhTbat=Hj*~J3tRyy=)LQJ8=&}!S6dlR5E_G>qU z1;2~r=R~|xpx8I7XLf9%x0$^(j+@|#>f$|Cg|?F%wJnr9&UYZ4#?EpEm%@5cMbP|1 z!6#b@ZrP&PJ(O<#7U2wyja|IF$ZBfTbRZ1n4ibwbar7Y-Dv?ozRT6lUahhAmM4opy zfd-P67v_Gb4`J~`;aR0MZPoUegf%Ab-;s~m@PS0Qgq!2|oqUy;#Px8gm!JFVrey9|sjJU;#7^R^9Jpwsk69g+BrF+Jp>Y`cOd;7rpK6 z-vrYcKC6{>Dkt~*ZF4%stDNRjN)=PkH)s*pFDUuvw8S6O?UqfY#XNS$J*qRj$_&v} zE2}y7m(9307ZwGs0H@VZB?VbX{Nuw$1Yg3lt^KOd$|T|_ZXgM zU@EwmBhvWhqKWJ>NAs(V@?cq=TqJH;=LlCJK^KEp8ALgnDfnr6D@SvAOd0!3T0!KuC95_y*xXpC{^ExQay zp=v*e5MQ~dS<&L)*n*IjPE~)qoXL7I?1J59`iP%~SAhrPFq#I>4?E1s@njS(-Ns4E zuw9`^lDt1^+4!NUw>spatxL~(gqm1YdpV6;+4i|R#jEr`2p8q@5{wb9vNO|_zBgTA zH(mhWTh4pyvJp(jGI3Adz$Xe;RkV*%9U>hM3-(~y^d{l1pxx<$AEk3G_TQ(q=j%So zC316v(>)`Yep%d>Xi@ldp0mYi1W=}~#T$91KOjJ6W0SxTs}#szv2N^QExCX5_Glz= z;S%g6Ullh{Ld;?+ae`WTCzUukrVI~x&-92~$#ra#vK8e^RRW282yD;sI~Ao4N<(@`2O--6;KyCoZh-7ewlFSs;5E1<&h3D&$1r=213&Vf-ug+v#Y- z`>awlM*D&lY01tAR())4*4rtPY4GW{S@)uNnVua|T0|NLQW~d0o&x1rx(%JCF=AF( zfIYX?5Vw$@7BM`v(+|Nhc$b~H0ZBOTG9v zzC*eNqr5aaAxPAzWe8oY5n_GbYCC;CCjWL~Zfw4Et8x-h=Rr@Cnp2qYE(qkABNeqW zT_wKWF^F*pcYBkQ4Qb|ZV_#`TJoZ{@w9_e@%qes4s~@~d7$&M_{Er2oIv3J@)WRDj zuxFEDfv$TuFZe%}7kmZ9^J|W=oSQkMc|%)GSx(qP#5a5}5x!vBqYga>UwAD(e{4>3 zQ1#H0*JsZ*#-m9+S>M!-Y0^}8YoBpC$yxHm4zChy`oUhSRKF=3UCtl0V%gY~ZcyHOQ zoMtHl;|+K-nBTGG^|cFey?P^ayx#w|b%pq!g4!}bxStR9YtN2dhSg+{aNPe`R)Yw; zfxHjw9gK#a=Es?$B0FDmZ-D>hu38kwXMU+-*1jBnJ*btEd_257c*UsZ8sN3i(#h@K zNO*Tzlx6TSrxjQt0zA#=<;$UeIz9*fR!GdiFa1y&?jCz;A39ZOw!5<qFhmF&T997GOZepR-`oK`{kRd)75?=6TVn)Hv*-82t3BP(vdw?1=IIN~D ze8x%WUUDG|GtTS?qaZfNFmQ_Fj1-5aCb--u8sT70W?nffD|Puhyt>$DG%ex8M+gMv zPt)u`HWQ4W@Vl89^`kO<^38`BHx@oNdGNn>$~($^?M%K z=jOknW6Q{=!a_j8Baz78L#JIC)Su=5wwlP9y#4gB{(0r;x8DW0nY74+m!LQQH*2}k zR0JXaw#fNCiWg81aHRz5>R+{92@*Z|4^_#dcBSg3tGC}gTPV3G)7$6Ef4hMuyBCN& zn@Tr>TDI+BV;IPm4?vj3dO1Iql z#}uxT;!eK*cG+(>LT{UYRyBCI=7(7ycuLaVHsbg)mgpZDb|q;rYCMGbLe=(l*xLVC zfUxH)ZXUi1zm3n1b?Yi^d_P?}#T=vV$q)Z&*Vw(0z59coqxGYfzekiOS!8-YmGB1B z+X=NmbjGQkJze4G576MFUiYbt?#rLTLnb2zEYGPNe?Pe*mTzzPEGzg?@zboRuO`~4 zBzX`~&G);~2>jQzRmGBe-aqlTlg${WS3b6c*Iqpz=M!WSCs>gVzk&2NAY6A1Gh&a{C5Y1dg9Ina|; zrn&tE?}<0_+_miN`djmEX@cUmE!VuBSU|_fZTL8WVhLc6{3_!3K@l=SWl3fF8j?w5ezbTB(Ny@B8gu_HQ zKab7dvdOs5GOE1^>bix}k)@UHps85euaVt=k#ojYIWUrl&v~NQf69J=iSNN?Jrye0 z>*|V@n(Z1q*lD&O>NVEa z))0?oA`(hDB!owyVuCPcqm`j-Jb&Rw)0lY5dQw}<2~!ZKz`t4zwa{eef0vOPeo=wz zS&sVH7CFSz*Q4^{dff*%Wdbv|DR}vTUI5b{AR&OY@d%I$+YY>guyz03b^Veh^MS=7 zdVpM((B*XSauQC#y3Pg@cLVXlsvJVR=^?6X%aLECC=027n?%@i3J(lWJ%$pLH5J)2 z#|Ylg#&aTojQrHM6(mHUaI0seBVak1(rW1PVzub7AL!WO&Zu)Y6Rqz#10j7$nL22j zebFnN&we)?9b_ep+ERo{DzGGtLtz3>IpZ{Ktgre8IHI@Owx&8RV&qUQfZYUuI80BVz3 zcGg`LFRz&89m`nXF`4rSK`-DbPy@VNJ)QfWineXO2uTh#UGx z6@~bg!+sM^`M95rcayG(ksZXbz>_?zK!$0;mE5IF)^%Kt9a3RUS^f^} zs*!SBm=jRjgSWCq$A?_uzD$XLiKdE=txw`ZF%Nkb&nmbfW7R1bwQseommxsC@(SVV zh%V&_J?xqM5lGTGoS%%lY?#OMJuOhc1GX~da7&Vr7!cFb)*J2q7-fNPo3msT7_XQK z9W#n&`qnL*jOy_Btdv4>if8mhm<;98CJCTl8%^s>Dl6H2e-i2)8*H{NT*{8rZU_Ji zugrCF7|obu{K3B7vRTHnGtC5TKfveKlj!~+myR)x*eX0x*3W%8InAAixTPmI$sQD- z%Sa}1893GXt|)YL0*KrwYm)M6q+N_(F;YR;D#B6Li96mJ#i`D%D431s^22g)N&5lF z?6Gf@a90jZnv?cKHha)oLw@W9lg#giKeX}#*L^oxiz^h~4KFY9pZJltQyL`C$DS2~ zeiQ=pA3w|5AOB1M>ieb`Tm+W?*2$XKEF31);){EAVKPR`z%lAGpeMIoa@T=w440$# z7hgzYtLxtJQ0-i1CJP^oRtPm`ph-sp*x5F)y&V8xfBW+C<1Vcu;XgJ4Z;$GFub6?) zbZTJxDGKfLtRqcosIN6=A1PUp-kn2@IYepiCla`oFWPy=bb?bXGzXc`!d4|8sm#8kAi4D(QOQHttT zR|rsp1bF4wF%*lkg^6RmM<;G`Jqltx^PlKfTxRDDu@a{gA=_}P0PjYJjeLMMB(ov% zsO7&XZoj^4#270WXAoUXJlMi$G^)bv(kQCP;5yk0FlH~Q#P>cluS$j{`J7d?f>{VE z@PBmpM~u!%!DYt=#22=tO=|sm_RNahTfOoNxh-N%7k*?^$Z|Iy`gfVpi964~gs>4; zI!lX$9x?6}?jq7ie4qtLj~w01yPotgy2u*$Ta#_2%Z#qMIf0xJKUN%SH}Fso8Jj51 z6~k`oz3IaM05bEs7<4a3Wqws;xsvD-jQM8ec<}1ey%u#1bz^3_s)%Rz!EN!4RCvW< z)KKus=&fTaYHD8lT+ZZdFD}n=!(bj=R}ibm^2`GD@_x;y=kKC;`i7M{rD?jBktSYQ z%yun@!;eMz+5Uxv3u^YPtRl~q(_%Q0y)yalWg8tM!?fPnR)9oa*WF9J^^#4b{w22b zJtOkRYH#%pP))}SouB_!d1ZF{Mhzr1actU>7I-HKbU*@cyL7DW)+)X5=E*= zJilT#u-O;h-Ra;ei|bOwtscV~?)lC((IUO_EalMl?h@R&=-$A!Sa%`DD?a(6Zb+mG59~N39)_d*RMnZ!wkk|J;0yS^;n!~aB%e?<=M{iix`lW)T zNRQEsUTY2U?;%0Y#w@;77^_0V`#vm!=)CQCDRXdp2OHs;i#;wg)gYQw)-KutX7&Wq z>Rik3ZagR7$3PeZe_l~vAX1fsG}`q#`Sl8O#YNqf1v_s_O!r>2dl7N4=u^xBJqxd} z2?#AH=hPSdh+WU6RNN$gyR@~tMxLf$MMU)X;v5x=MWg~X_f+C}vK-)6&Bk;2 zkR_cOvqqX!$YMz$p$8rPa4Vdz3jF%e19o2ggzE92QmLK7g!s!8<*wWSz-~7zOh!*bfAi7Ij z%Q74!GL6@Oa11s^)6~_BMY1@}Eav^ZFwVc0&bj;rrd7n9UF|9el!tkV{Nr!bQkX=5 zzM_7sjf9UTV$tgAID^ZM;v%RjKd{s+P?pbh5Yis6Uz&o zelv&XEYB*f?c7Lv%bg4<+_zB*^=p5#m|hh;da7AM;J-gq(>~S3kqgluTvaAR8FG{V zRuzolZ&v1E64)aBKIE=ITQj_q~?a8rBFq!(H(3p&X2-GR#lAGe2@`vsQ(8ZQ(j)#T4qf|Ab@GPR~co z(wlk{9^JsHghbtU0&iqte73IbmQ{&dOFBLW0~EF%9DkOaxl@s=W^80X#T%*^A(hK21ZsLqYh83h;LZGLs=eJGXHSd@729?;)QW{V`FTHN zSi&m)@%Gd85B7`yi5`UQ?_a1rqJI0@yvgVl$gIC3pV&HhyYaJ28JdaOSG{YmD-qUu z_}@^xeCwO2nr-o@Ma%jGbnsJ&?ejCphLeBK0bNM){vBhRqV=Cmq3G>@@_*ANKJC}& z{l2(#JgAo-beRqFtNH1p@`Rv@#si;MeYL~8*DU5Qqc^-kAOG+P2n%y6BK4 zE)s{dYvsa#o(Ltu(COJ@)*kBSrQp`{L7mxYhsKR}EayOQzfI9~zuj4bGuTs2!F3|23OK%li*c0uZAKO6CP2>HnGD z+q^J{y-E8iPm*WyhpevfuBJV3TcUfUmRbv1nrqly2A)n#ywW=X?A0vgW=GI zW-ue5EO_5TT7wM)0%w$!1h8R>59>>Z6MFq)ZMkjm-loBlL;z&z4Ac1ACGWf|a64zD zR%CQRvLx^_y3X4V;LSEbWw8Rf;APu@X?umX^jamXl&m5;}|Ne=n2x>}>t zO$Ct1R#^H#gTMYBgzY(-L%WvTbEfX~OfIZ;7XzJiBYhLLSboEy4+e47sLfIW^ksdy z0w|9WHEyef_kNoGHj3;`ikH|Y5ut+)v7?ez(PZZ3Kh8fJTNO_UmvnfhP)Jz2S)bqi zQYU`hH}y^;!dX7_CI1Um6815vvrgX!ADMhcLN@$MPo2ewYSjGVIfXWyPGiz<=h@wo_`fMgukrqY1e9v0zSi0|Kf{9S(MI$$#&p2Snmj6t)2~u zb-9ar;f~bs8G|AW=D3fcb_EV}TQ-G)=?dYuJmTyxfEiPoG`ydf-IJ!L@gFHH7@1K!2kvo?36Vz5%642{Xr4lLQ2Yy+QIYS=Gy`Xld7vV zGA&jTvi9w)MT!}fUfA3dNB+!rxV|nWUc=P+YBLZ1`od>E-z97zIo8ZHpy1aZRl-6bu<6Au z%%OR&dxxyBsC2uB!pzN4WY37BJE1Nd+7H*Mk?*xJt$H?RqR=Reh27{xRBhRO!Duk^ zd=_$=unw~uF>h;JMX#Ilbs*p`uw$Ewf=O2zJyX?sRe#jLXP65ikgfV`e<%Ml(wfP* zmS8rp^SW^U+vPNsCy-ZGuxXCIHqA>|0^)|kFbgbCbP4}l?_50xaNAapY22=3NefZt z-}VcNsgb%aO`Bw*N+PWytZV*stSzMaX5z0Ah zAu+jvD_h|v?4nGAOJ`&G1FM)rN!)b!9!g1p2DL$&-&`C?33r4EapjLu+9$=UF4Yjd z88u)&%+!8Hj)STFiioA~XOb?BmbRhcrr9Y z6QvZ*-OMH@>>HfCf=T}ioUke{5Pi!f#L~9Nl3qQ-THp$LjpOknK4&w7o2j?0Ym$Oy zqM@ED`OTJG!|E6)#}qY(1{pO2NbE%^%Jr&`S*ODxiVD7D-a4_>o2OR12d2W`Z65}2 zkT`Q=fb1rFrqZ`htIriD1xC*c@nBdrotRF;WgWLlM+Ls|(*-l=HQc*03==>Ep0B+o zMLx>)=&dk2Qq2BBWwUWPS1(1AO{5urNuRDx!RAiOnxn@xO+Jo_p@mKM+Va~fgEE-k zO}?}BQbcC>BG&Iuu5T73NivnS=N>c=ADlzMHnPTFz+<|5ax-U5igNM^#$un*_53Re zfRWrjw}Oz=dGANUZGDgsBJ3V#@o$qg+`HPDeveQ0ZLM<63X&ML95rd+<7}>9*3ICq zkIk$fwq3p_+>bXc*x62D3i;$lV{wEDGYwK^*~sGEVLjjLwqmnwy&AWmsu^vZt{Eg9 z8b1HMjZ>@pcx0*=bkNQ&*ApPZ2ugaJUJKk6sjGwj7^#Snb8KjQHMdpHagnt*k~wd6 z{q!flIToB+cA0WHpP8y50~KnfUmGrVvN>~KF6W_jx?Sa`8780Jddk(NMI>nR0Q|lij4!}=v*#0uH z0Op^#(*Y5V?W6o)o_yJ>Gv_@cySc6+V6HC^SHTysuIvn8B42^d=t;6{Tsoss;(XE6 zQoMh#6}r z$IOfamp$1hKZ+Lj;z@j7&m&c?J7H7(PSuW`a}5CMfH|Mn-{ZBo`{0y$6rT~@@}?sz znWLXnc{4z$D2%yd6KWP7(Q9yW5tyLwm|@ynwy$+xE?e3{+{huloo+V3DmL4^cd~mN zjoC)(Ic5;17BYqg7FZDiW+<@9oi_GQM>M=A89;us;_H~j6BYUtKHu8SEDuSY(V=ab zETy;FtQ~{z)HF!T`z~YU9sT2f2OA56j7EC@$6_$H{uz*8-LcIXxsj39d+W-*D!H}! z!ikL7R9qs;Y;)AT%o0SY97uT8H+LTh?uoK^&|~0tne5JJ|Io4+A8hfQ^mV{i%UDCT z!|Q3;nY=Dx;yHtPd=6D)epIF*>itjTsAP;A+o4Sg6<%4#x+=?cVhxL0$FoMd!eFuE zXon_FnS(O&>%&^8A;@v%4801h0ie`8UbLuet?jHln7nXmmA37^9Fk`F5))p4hHpH~fVqWU^)p}Y5-JC*1S6`($pcPyg=K7?urm3+b#!D6 zZ5tC*Uy-XiU#q0o!sE}(8V*);!YCFy8axr%*aZhaZFbCwBlqk2$fhi}wm*Q3uq`ky zh7s99Y4^~U3%+r6YGX8v(GXL4-a5qQ)!>=ebkz(-e?79O4{`On6xc%m@TidbrJt`FZ0~&1FiV1%}i74C5InPoMwu^Jy(}{d!{4BHlDUgFLq^wqM}=k?e_lM z&&jU8%OiAsVzUW@=GsjK5hvGixQ{vGY~LJbUoe1KhUuTzXEXkQU7C|C(0RfVF)DhD5~)` zVc$6;u!S?l>R?ag)89L&1!pO;j81E%lVxbT68CMUk-~AZTLTKA#|T}hyykylvhPqz zGVlHrI%}hGInJV-$J;8ygV5*FD)1?zO8aQXP;%{JUQ!3q4z_dQ>|fJ^llzhX6@1zk zIk>AUR{q`Sj>Gl&y}jKPk%3(LkSf67ba4ikG4>7_E1;XveC68n;|%AJZ+%Ljy%)xH>D)%_`#q1c9!{iB=-}wqG5Z%E?Knj)p3lg?|Nj^TfJj z<~~tqqr7PMwl$9QgywX$OTKdIHepcl)sn%foSN$}^Vex^xz^VjB5jb1iD6x^h&+Qg zpZa$71)+0&xAPi}UpQ&oIY!IRDu?y4ekBU`7wBX<{U*2i)*fx;p2uA&6cA*Crm$^=~Q9M89m=l&CJ?Mnq)9Ki_yWb2%i{I8O3Xsg!sCBu<>jl0-~TwCTQ2af zPy0_HJgOEeD}cK{OX(PtIDZ+vKmGjkYBu*0rqFAL^Xd3Ukzj2Z;C^aF#e(+vG_JF~ z2|dLdEQ{El8NTYLFCV@4|7^S$#>8`oIA}`^Of(aga32>}j4AQX*`>fWFfLUxip=O! z=v8wOB(g|b``5-M=p`zV>&H{`} z1qNeX1Y&Y-bmK#n##XVs%PZ)Qw_Um(4QItI=!NT-O?`m>qBU=8wW_P-$qUi%sGX_V ziDL6alC;xC-m7M7qQ7_)G=1HgD+qb1p}(vXr?l_+MCR86^M>%8(V51LnP%YSBjoFoWDpo9_&kXi2_#g4_Rmtw;;1KV4#CsDB?|L;cRRiMbqlKOCL4|hn zVjl*@4-rhy`2SeseA17e99x5g-u(u@H2Vnt_4%{%y}PCjITMu_pD%lZmd@3`$d#Gz zxQOD22MNuR8!WEOY9L>;&)3(x`k!oL3JiLk^zJ+6?BnSVKo@E8NkF4t~_py!Y^;mEsx7|l;l7{*~d2?Q6 zsOQooYtN9XfLhX~iz9vaP|oY^vPqW`S7zMD)#wZnVKpZ%wXdu+ew#%%vphqEq_dmE`ccw4Bi(~A+vX39v3^_!lPVovIYg1kjvKr=*rB(_@&fEh zR_l%=>~uX=_ewIrWyJ!hhT<}CK(eKP($y^_KRJbNkkb7yMDpWkikXIKP>_ByeH2+j z;u+#TuWKGb;v&G4E6!21HODzP6+hdmCPT}WMs1&chLALjb=<%*d(}fe$Kfc9$%yMY zRM5d6;jwF5E`s!c2xNh)sW=q_-YA<)-*a|jm5ya9k~0o$l*Y;Ptgy$(9$EZj1wm0o z9E&2b@3W0}Vyytp3`kNzce0yAn?f&0D27Xv`<;Q$_Z&?MeIo^nUCKuUW0;r#8~@CP zTe7P})@(de4Nv4|6bMupOle|%89jB$^)DDbx~A%Y6@!F!J;7Go)z#SGt&|olAGaRegjvShUzj; zPOTMG!};A9Sl!vNc0;dF&cZvxy3^08Uv>rF{deIO_Dxtmcy>fWcq za*mr5Im-&oflrX57YipIum`K$F#Yx5H>+6+YjKeq>J{^fp>4NU6#Ec$GxrMGxFq(;$UAbdcWDkHFu4MytGLBf<6y^*oQ`;9wi)4ZtMuj`wGf~-q9;andob2v<@{02w?z{B|=q)miJ#mptcnLQ8y1^_4W2^)+g zv;yF!jftwLA1c7riU-xkebvIc$xujF!UN~n4UbYfqI9YL3;iHx(-|4IovN(gY+YKBwoCt5&w-0B2g%3OJE-hFO$x&QdNPWk{8amK18)z8}R8uEt9NS`82G@*g82yiQVC(!QsnXPngeeRBiav#1U` zvwBS>xIwStn^6@|ya>+2L35xIN&04lQuVO4%DY&5z6J|$uW+vg0Jyn&V2+_$y294s zwKQ6Az?Sy}5nHukTR2x(U$o%j6-$bBJhZB`3Q8R9JyVIb#Q<-6sNuS&X1~2?;PF;Q z#G5dr%6ii3-E2mS7?t}Ygc=MSX80<_PXW7yVDKILcZkzL|EEIBV%D*Gh5uB4pPKQM zC>O%puVyr;zMSna15fHKO&3VOhqbD@`H+y!S5FXET~6|Ge@+YC&lN*YATD~hYJiyfSko_Xw+|DrOnixbIA#Z!kG~IA^)^aViq__Z^ z*lt?C?{nmjk!pyO>QYc1tvBp4T-EvG;t}Jag9rqo9o)Ua4KPN|6O3$caA0}lEn*D( zc4wbAh|b4=gfom#O4VyYbDp^qe)T}nwV1w*vhJ{h78hXT7#s9_y(z5xTP13K*K{(8 z(Q_<V- znu~JZ&!&18h_Gv{cFdoDvr3RM*C2n{YROreziJyE>s)`#{Kf3-9*wZ*zRqnO3B4{^ z_cuZgj)p1rrOerNnf9Mh)qEGzBS$Nl-7Y&ryEo5JSg(`&+$LkTCsZ?eZ_b?;mbe*c zfYtB&Vl9faQ}jazIdNt#WWliobq28K*pi>-|8*s%3lg!ksxFs}FT4EaG2K@9aW6aD zzog)!x`(q1b~|g4qf&OqfOGhgc!wNo_*S?@AhXyknOaecGbS}3Y=rQe+wrWwuK9i1P*eMhY2S?2Lcg1Fw-%bt$ z=YPt}lc&~St80x%iurj@>n$4Jr^!uOEr;L0xiZDSwRKk&=Bs<2Y6Uq;rFVvgzW6as zdSH0pNtHkA#O2Eh?VYT8F7Pm{Z$>Bx4}P=4_E&B+z)o`^Eu=emjd?0yW<; zI>l&{zVbJkqwE0aP?sqq$KY}}fv9L!4B3QD zRk8t()vVEIhq?Ic7_VX@F!mWLEpBWz^dV73I3TbwvSMBRbs!r+6K+?|$`_;ASzeN+N zx{a7Vekb0Z(Q7xG9m75IG_!G=U$eJg-@mNNGbI_Tk5XNIvP*kaQ9?3m{MG&GzjRBB z#nk*IKkzgy!81&%wpqL^^QUK(MLZ)-alp51Ae|Aw2}3zc;?Pec3R z!_tgug!yc*kb$cTp7~rKJ3iHx(eOs4UVh%kjzCM>+~h4-Q|^SGS=Thi%{%Q6>8dpU zeeO3yjBZAv{w8n{(i95E9_Ll{n8X05F&80@N${L>GX+oAYj~GHhxaAsK&Av@&4}0W z#;;^Kk+yi#iUF_;rE;$QfhiZMB$GX0KGdo-ywk`DAddH1Ifx_yJ1xJmc{=1ODlvFz zK&RP7X9=z!6>awx_fGO<;$B!xg7VY6ZzlGtj6JFNW4QgOe;~wObLs{41X}S##N#?V z8}&aHjlaAei^Nrw?$1@TP40W>f0Dmqd=5|e4J(LTt@hGuuV1=9n%vH*XO^b!O+QYp zEi8X>^sd@sJVcaRh?f1svHZfIL;MDqS@Y4gd&(uY4R~4frAFatNdhjLv$Oe^U0XCe zNdbLwbsv0qA)R5~M@_>O3sOq7JBymW!CUv0MuzrE8k{if>A~f_M|ay-BoNe&U++vL zFJx;gdlPc{aff}+$oIF`&8}A9fZcV zGfq0D@J?UF+d6r9$YglMLLqMajvv*Dri3y*M&6pXjq}XIh#$4)y>@F{8NcZ7bZ&oS z(|dgwdO|!$>G68!i$mOT99;fv^<^_8NNP1GMI71&~2?dunX^=UXYYsVq zSsSBI#3D+VdmW^IOrfaXn%!1QhZf5IpNHh6@Bun9RJ=-n!fh3XEP5_nt$5z3K1Kgu zefo9is1%V{G9bTPNN7V}q~rn8uzhW`n?Dr?p;t6`F_E!E6^LCu)vG#5fXP`11G5DN zuNJS$tRwD#Z}K=&XCF(|Ku@sK2R3>?WqS@hGIhSCOSXhaNo2n;sfV#M?c88#ZJyVXV2!Jenr&H%Y3u}LY)h%Rhfl-|( zLZ8g3l&EYK-mzY3v?NA7wDyd;tWSfYLb|ey>OfR&KAWaN$cs_k zjT6kxTP7`6tmL})1FQ*SMu^&LG&eWt@JThPyzoCns8>?Su9G-NUaxI$!nTu8e?4as zgzvX9w^S8(edd}b2kP#varQwD6B$>tk}(qw1R%lf7EC9}4A^ zRZDs#qk#F~zy(;+43$gX1A0yJ-to)4;+9jU0{xkYNL56v7)mqnqCB=;(Uex_oR)h# zpu!?Dllo?h;E-xl5Ij)T&T^>5yO(@OotYP=d?l_8Z zUZ<0=wjWR2q78Iqgd}GP+*7*RO*gc4@jHQ?K*3Hdr|nuiP)ASshdQ1oUED%D4pX^L z<1YR^TLyWO5mj-oiuczG^BkYR>W)DNF0;#M%iw+~Z(3!p7=T?OvyM;ZbU1M$OMu37 z;$N&Wrz{EEbVdRnqFpNnnnuClOk9R1+sus?h>uSoBz44Fu$i=i5#qyQO)bnUPy-U<8!RBhGni8BhiGcGWtyo&t#73(#~sJXIBKpv5Z-j;!H?Zn zPCjm9iG5@(#dVzjxswO`u_M7oMU{ZEq$Svdq$RLZ(JLMl?)#ug;Duy0Go+<=x`mGA zockF=p9k#g!Zb&-SUGCaFQPvU4aQ++!jBueqb1cx9I>n6(HVl*sEQ%-g-q5M1St@Y z)(0y7n+ultHmYY%GuJOJ*H`1THYhzedvcMCXYW?dN?DTpyP=QHD$&%qrovL@Y)cG6E3$;vsrJI{Z;i$RaLdYi zYt<)YzUjAXcyLNz6Kmy}rtTh!X~#cKZH{Q^npyw?k&}_5C1p}R`q$OCD|Lj4nfn$f zQ*-bfdm!+4{;((=VSN)N>e>IuO?<|@?tHGKDScKY^wAV8kZ|cr$I@xEkuGl5m`2=o zRe7z?vO%%<0)*54)fi6#1YmgsI=JTp_=f=98;f<$KHmIRvmIN1w_t*H{xh?6SjMRj zvAS&)PipOJ#-v(Eh}Fr;sH(9@A?sT%H8txKQDksVYR#&3@hMu~;IPdzN0}@ce{$v) zZccOe?iECKauh>RsSeVBi;sB_@oY@7f{+S=8LsdS&a&%BsZWs8yNI(+`u>kX%UcYD zq+%8s#!dx$mWs^jky|;jwP(EGV03~#B13ogQ`nDMT_I<@h=TQNd!-#I@tLwMkbc$Q zj+XTk9n`$-nWu==4U7vzjLbi92OjyTwpFbDiDu*?lO184&QUx?pO?S=AY%MlYtU7m z7*GSvf~vm6+JK=?C+UDo#`r7QCq0@|rRtS?om2u1-ArDCP)BJU4?OK2e( zEsgPN68WL4WTS-rm+GhXg_ahe#(WJ(1NPkD2QB;w(uOp=(MzYDnRU>(%-@-HztG%--)n;3zmlxqJ>M4WinSFa=^%>|l;V$J7eTbF-H9kBB zrT)F%_j)I?N}8+jSDkGO*92-BK|ePh(S22pD1(J5cgpu%UZ6%v|Mm8({Ulbd5yHwP zOHB--g9j z?dOo%?_;+-2&r$DF_(JzbN|(-S$qUuCTy>=j6y99zJ=)^*B8ssmP8`ugiWXd;TwD* zyQmoPFdQYFU3ToaJp3B5z?J`mlXgm@I$;XxJnao+M=%G21nt$VAM^20+>89L1^?|q zw;HqEX$qOADnlw2prhT>9pmm{LZ2k-!z||PkobD^BCiPn`f_uefX*0@HazpQI* z$(f0k{&h{u*H9pM#Wl5?x))kw=-7NGI#?^}9NkcLol#nnSevkD6BKH@@-=BTPBaJn zlg&?Un;I2co5!UtvAkcwmNey;F^%3N<%k{kpMSeN)2c%)vt~YbYZSjPxp6{sFvjp# z94+KB`Pdemy;P^>A5Zkd!w-9gY4xp)vjJy28iGy_8IYb9b>(_iws7EOlDCq*4GDvuO;^d%P_KKcJ?J0};%c9u(oER7Nn$aUnc+*~{p#}Cb>i^g39%clXxU@`9@CWsR~hkP7` zkwZBqQ)yt6F@Vp2W_K#NR9LnfmtT=fLUi+ic!!m%6Ik;TodF{|bn0cvJZm`(S@Q z#B4DXG3T7RBiq;-gT?%zgCS+)e8&FMaA}8wZ)gvt^J}yo+@zAG)}PEY$Y7>RB8@3} zl63O0guh7R-{=E4Fl{mRPtImgv3rC5@`i8zjL+rPX!B>J$RWDr_a6+*-z)!`o*H;M z3|KubypDELPg(D|V6>R8&`xgHxbk+>>`*N@Ql>$Kw~^lo-LJ&nop)&6e`mC}JE->O_EsA|8cI0u0WhxH*I!~3mf9Kc zLi=}|cri65T!2vWgiYx8H^iBV4T-VJGoHT-yY=Z6Svw~W?*H)kmF2M9bBslCwi$X5 zT;5asfcGfihz*hiE`9%*bj&RBjn<*HO$2%N~=JojWxXcT4|o&~X*3idr1x=@Vv(TuOqu=lhNgYd{f_iDq(|HBJpgY!G0 zbANY!QWJjc#`39*V0R@y`wlg5=EgsDag6wi${oG7`iuN{W(I?NaW2}p1gMwpQmm