From ffae7d47ad2a52daecb072eb381fa5deeac78abd Mon Sep 17 00:00:00 2001 From: Meysam Azad Date: Mon, 10 Jun 2024 13:52:31 +0700 Subject: [PATCH] chore: one last review --- .../codes/2024/0015/echo-server-rule/rule.yml | 2 - .../oathkeeper/oathkeeper-server-config.yml | 2 + docs/posts/2024/0015-ory-oathkeeper.md | 180 +++++++++++++----- .../2024/0015/jaeger-oathkeeper-kratos.webp | Bin 0 -> 47740 bytes 4 files changed, 137 insertions(+), 47 deletions(-) create mode 100644 docs/static/img/2024/0015/jaeger-oathkeeper-kratos.webp diff --git a/docs/codes/2024/0015/echo-server-rule/rule.yml b/docs/codes/2024/0015/echo-server-rule/rule.yml index 7aa7560..1f6a5dd 100644 --- a/docs/codes/2024/0015/echo-server-rule/rule.yml +++ b/docs/codes/2024/0015/echo-server-rule/rule.yml @@ -10,8 +10,6 @@ spec: force_method: GET only: - ory_kratos_session - preserve_path: true - preserve_query: true subject_from: identity.id handler: cookie_session - config: diff --git a/docs/codes/2024/0015/oathkeeper/oathkeeper-server-config.yml b/docs/codes/2024/0015/oathkeeper/oathkeeper-server-config.yml index c9cc6c1..8491ed7 100644 --- a/docs/codes/2024/0015/oathkeeper/oathkeeper-server-config.yml +++ b/docs/codes/2024/0015/oathkeeper/oathkeeper-server-config.yml @@ -6,6 +6,8 @@ authenticators: cookie_session: config: check_session_url: http://kratos-public.auth/sessions/whoami + preserve_path: true + preserve_query: true enabled: true jwt: config: diff --git a/docs/posts/2024/0015-ory-oathkeeper.md b/docs/posts/2024/0015-ory-oathkeeper.md index c9d4553..416105f 100644 --- a/docs/posts/2024/0015-ory-oathkeeper.md +++ b/docs/posts/2024/0015-ory-oathkeeper.md @@ -42,8 +42,8 @@ Chances are, your application needs protection from unauthorized access, whether deployed into the internet and exposed publicly, or gated behind private network and only accessible to a certain privileged users. -That is what Ory Oathkeeper is good at, making sure that requests won't make -it to the upstream server unless they are explicitly allowed. +That is what Ory Oathkeeper is good at, **making sure that requests won't make +it to the upstream server unless they are explicitly allowed**. It enforces protective measures to ensure unauthorized requests are denied. It does that by sitting at the frontier of your infrastructure, receiving @@ -53,8 +53,8 @@ on the rules you've previously defined and instructed it to. In this blog post, we will explore what Ory Oathkeeper can do, deploy and configure it in a way that will protect our upstream server. -This use-case is very common and you have likely encountered it or implemented -a custom solution for you application before. +This scenario is quite common, and you've probably come across it or developed +a custom solution for your application before. Hold your breath till the end to find out how to leverage this opensource solution to your advantage so that you won't ever have to reinvent the wheel @@ -65,13 +65,13 @@ again. There are numerous reasons why Oathkeeper is a good fit at what it does. Here are some of the highlights you should be aware of: -- [x] **Proxy Server**: One of the superpower of Oathkeeper is its ability to +- [x] **Proxy Server**: One of the superpowers of Oathkeeper is its ability to sit at the forefront of your infrastructure and denying unauthorized requests. :shield: - [x] **Decision Maker**: Another mode of running Ory Oathkeeper is to use it as a policy enforcer, making decisions on whether or not a request should be granted access based on the defined rules. :face_with_monocle: -- [x] **Open Source**: Ory Oathkeeper is open source with a permissive license, +- [x] **Open Source**: Ory Oathkeeper is opensource with a permissive license, meaning you can inspect the source code, contribute to it, and even fork it if you want to. :flag_white: - [x] **Stateless**: Ory Oathkeeper is stateless, meaning it doesn't store any @@ -96,8 +96,8 @@ that comes into play. !!! note "Disclaimer" - This blog post is not sponsored by Ory(1). I'm just a happy user of their - products and I want to share my experience with you. + This blog post is **NOT** sponsored by Ory(1). I'm just a happy user of + their products and I want to share my experience with you. { .annotate } 1. Though, I definitely wouldn't mind seeing some dollars. @@ -118,7 +118,7 @@ human-readable YAML format[^api-access-rules].(1) You can pass multiple rules to be applied for multiple upstream servers or backends. { .annotate } -1. Some will disgree with YAML files being _human-readable_ . Though we are +1. Some will disagree with YAML files being _human-readable_ . Though we are not in the business of picking sides, we are here to provide a technical guide. :shrug: @@ -133,9 +133,9 @@ deploy and make sure everything works perfectly, we picked our preferred stack as you see below: - [x] **Kubernetes**: Though you don't have to, this guide is built on top of - [Kubernetes], heavingly relying on the operator pattern and the CRDs used + [Kubernetes], heavily relying on the operator pattern and the CRDs used to deploy our infrastructure as well as the Oathkeeper rules. -- [x] **cert-manager**: We will need internet-accessible host to our cluster +- [x] **cert-manager**: We will need internet access to our cluster with TLS certificate from a trusted CA. That is where [cert-manager] and [Gateway API] are lending a generous hand. :handshake: Take a look at [cert-manager: All-in-One Kubernetes TLS Certificate Manager] if you @@ -153,7 +153,7 @@ as you see below: [Ory Kratos: Headless Authentication, Identity and User Management] - [ ] **FluxCD**: This is our technology of choice when it comes to Kubernetes deployments. You are free to pick simpler tools such as Helm CLI. FluxCD - is a great tool that requires a bit of learning. Check out our guide on + is a great tool that has a bit of learning curve. Check out our guide on [GitOps Demystified: Introduction to FluxCD for Kubernetes] if you need a starting point or [GitOps Continuous Deployment: FluxCD Advanced CRDs] if you are an @@ -210,6 +210,10 @@ You can customize each method further with specific values. However, we will leave the customization to the Oathkeeper rule later in this blog. The URLs, however, are a required field and must be specified at the configuration level. +There will be more blog posts including Ory [Oathkeeper] and other +authenticators and authorizers in the future. Stay tuned for more. +:fingers_crossed: + #### Tracing Endoints In all of the [Ory] products, you can specify where to ship your traces to. @@ -223,8 +227,8 @@ products as below: #### CORS Configuration -If you're access the Oathkeeper from the browser, you have to set the allowed -origin addresses in the configurations. +If you're accessing the Oathkeeper from the browser, you have to set the +allowed origin addresses in the configurations. Those "allowed" URLs are the hostnames that is in the address bar of a browser. If you specify a wildcard, Oathkeeper will intelligently allow the concrete @@ -263,7 +267,7 @@ new to them. Beware, the following Ory Oathkeeper deployment is using [Kustomization]. - That requires doing a lot of heavy liftings if you're used to simpler + That requires doing a lot of heavy lifting if you're used to simpler deployment tools such as Helm. However, the upstream Helm chart seems to be quite inflexible and due to @@ -319,6 +323,13 @@ Now let's put this all together into a Kustomization file. -8<- "docs/codes/2024/0015/oathkeeper/kustomization.yml" ``` +Notice the CRD installation in the Kustomization file. Without it, this stack +won't be deployed properly. + +```yaml title="oathkeeper/kustomization.yml" linenums="35" +-8<- "docs/codes/2024/0015/oathkeeper/kustomization.yml:35:36" +``` + ### FluxCD Deployment Kustomization To deploy the Oathkeeper, we need one last YAML file. @@ -414,7 +425,7 @@ so far was a preparation for this moment. ### Internet Accessible Endpoint -The first step is to route all the traffic targetting the upstream server to +The first step is to route all the traffic targeting the upstream server to the Oathkeeper proxy endpoint. Based on different types of deployments, you may end up executing this step differently. @@ -433,8 +444,9 @@ Notice that this HTTPRoute has to be in the same namespace as the Oathkeeper. The reason is that the Gateway will only route the traffics to the same namespace as the HTTPRoute[^httproute-doc]. -In short, we send the internet traffics to the Oathkeeper, and if all looks OK, -it will forward the request to the upstream server. +In short, we send the internet traffics to the Oathkeeper, and if all looks OK +(the request is authenticated and whatnot), it will forward the request to the +upstream server. Otherwise, the user will get the proper error message from Oathkeeper before even a single byte reaches the upstream server. That is the true power of @@ -470,11 +482,30 @@ the server without any authentication. The flow of the request is as follows[^oathkeeper-proxy-flow]: -1. Is the request authenticated? Yes, it is anonymous. -2. Is it authorized? Yes, the rule allows access to everyone. -3. Do we need to change anything in the request? Yes, add a single `x-user-id` +:one: Is the request authenticated? Yes, it is anonymous. + +```yaml title="echo-server-rule/rule.yml" linenums="6" +-8<- "docs/codes/2024/0015/junk/anon-rule.yml:6:7" +``` + +:two: Is it authorized? Yes, the rule allows access to everyone. + +```yaml title="echo-server-rule/rule.yml" linenums="8" +-8<- "docs/codes/2024/0015/junk/anon-rule.yml:8:9" +``` + +:three: Do we need to change anything in the request? Yes, add a single `x-user-id` header (`guest` for anonymous). -4. What if error happens before reaching upstream? Return the error as JSON. + +```yaml title="echo-server-rule/rule.yml" linenums="21" +-8<- "docs/codes/2024/0015/junk/anon-rule.yml:21:22" +``` + +:four: What if error happens before reaching upstream? Return the error as JSON. + +```yaml title="echo-server-rule/rule.yml" linenums="10" +-8<- "docs/codes/2024/0015/junk/anon-rule.yml:10:11" +``` The flow you see above is the most important part of how Ory Oathkeeper works. If you master this flow, you can create any kind of rule you want. @@ -501,23 +532,33 @@ curl https://echo.developer-friendly.blog The response is as below. -```json title="" hl_lines="33" +```json title="" hl_lines="30" -8<- "docs/codes/2024/0015/junk/anon-response.json" ``` +The user ID is coming from the following [Oathkeeper server configuration]. +:point_down: + +```yaml title="oathkeeper/oathkeeper-server-config.yml" linenums="15" hl_lines="3" +-8<- "docs/codes/2024/0015/oathkeeper/oathkeeper-server-config.yml:15:18" +``` ### Play 2: Authenticated by Ory Kratos At this stage, we should be able to use our [previously deployed Ory Kratos server]. -Let's modify this rule so that the authenticated users and the identities of -Kratos can send their request to this upstream server[^kratos-whoami]. +Let's modify the same rule so that the authenticated users and the identities +of Kratos can send their request to this upstream server[^kratos-whoami]. ```yaml title="echo-server-rule/rule.yml" hl_lines="7-14" -8<- "docs/codes/2024/0015/junk/kratos-rule.yml" ``` +Note that this will only work for browser users of Kratos. For mobile native +clients using the API flow of Kratos, you'd want to use the `X-Session-Token` +header instead of the cookie[^kratos-whoami]. + If we authenticate to Kratos first and send an HTTP request to the echo-server, this is what we get. @@ -536,21 +577,44 @@ information from the Kratos itself. ### Play 3: Azure VM Access The idea in this scenario is that the virtual machine in the [Azure] cloud with -system assigned identity can send authenticated requests to the echo-server, -while Oathkeeper verifying the authenticity of the request using the Azure AD -JWKs endpoint. +[system assigned identity][How to Access AWS From Azure VM Using OpenID Connect] +can send authenticated requests to the echo-server, while Oathkeeper verifies +the authenticity of the request using the Azure AD JWKs endpoint. -```yaml title="echo-server-rule/rule.yml" hl_lines="17-22" +```yaml title="echo-server-rule/rule.yml" hl_lines="15-20" -8<- "docs/codes/2024/0015/echo-server-rule/rule.yml" ``` +#### Azure AD JWT Audience + +The `target_audience` you see in this rule will be identical to the `aud` claim +in the JWT token of the Azure VM. To make sure you get it right, you can fetch +the access token from within the VM[^azcli-vm-access-token], decode its content +and check the `aud` claim. + +#### Azure AD JWKs Endpoint + +How to get the `jwks_url` one might ask!? The answer is simple. If you use the +same technique to decode the said token, you will see its `iss` claim. Using +that issuer, you can append `/.well-known/openid-configuration` to get the +[OpenID Connect] configuration of the server, and in the JSON payload response, +the JWKs URL will be present. + Using this Oathkeeper rule, if we spin up an Azure VM and enable its system identity, we can get a JWT token[^az-vm-token] from Azure AD and send it to Oathkeeper. ```bash title="" linenums="0" # From inside the Azure VM -token=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true -s) +token=$(curl \ + 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' \ + -H Metadata:true -s) + +# or +token=$(az account get-access-token \ + --resource https://management.azure.com \ + --query "accessToken" -o tsv) + curl https://echo.developer-friendly.blog -H "Authorization $token" ``` @@ -579,8 +643,11 @@ will be denied with a `401 Unauthorized` status code. That is to say, the order in which Oathkeeper processes the rules is important. It will start from the top, and any authenticator that **can** handle the -authentication process will be used and the rest are ignored, even if the -matched authentication denies the request! +authentication process will be the only one ever consulted and the rest of the +authenticators are comletely ignored, even if the matched authentication denies +the request! Yes, even if any of the subsequent authenticators would have +allowed the request. That's something to keep in mind when designing and +creating your rules. From the official documentation[^api-access-rules-order]: @@ -591,10 +658,28 @@ From the official documentation[^api-access-rules-order]: "falling back" to others, have that authenticator as the first item in the array. -All in all, these will help you sleep tight at night, knowing that your -application is safely guarded by a production grade and robust proxy server, -consulting the proper authentication server before handing it to the upstream -backend. +## Observing the Traces + +Remember we mentioned how use you can ship your traces with [Ory] products into +a backend? Among different available solutions, [Jaeger] is one of the easy +ones to set up and use. + +When we engage both [Oathkeeper] and [Kratos] in one HTTP request, this is what +we get in the Jaeger UI. + +
+ ![Jaeger UI: Oathkeeper & Kratos](/static/img/2024/0015/jaeger-oathkeeper-kratos.webp "Click to zoom in"){ align=left loading=lazy } +
Jaeger UI: Oathkeeper & Kratos
+
+ +Pretty neat! Wouldn't you say? :nerd_face: + +## Wrapping Up + +All in all, [Oathkeeper] design and secure implementation will help you sleep +tight at night, knowing that your application is safely guarded by a production +grade and robust proxy server, consulting the proper authentication server +before handing it to the upstream backend. These days, I use the Oathkeeper even for my admin pages; even the ones not publicly accessible and only exposed to the private network. This helps secure @@ -602,8 +687,10 @@ the backend from unauthorized access. There are other types of examples we can provide here, but with the ones you see here, you should have a good idea on what's possible and what you can do -more with Ory Oathkeeper. Even so, we will have more examples of this topic -in the future for other practical and production use-cases. +more with Ory Oathkeeper. + +Regardless, we will have more examples of this topic in the future for other +practical and production use-cases. ## Conclusion @@ -611,22 +698,21 @@ Based on my production experience over the years managing different types of applications and backends in various industries, there is the same pattern and approach for a desired authentication layer one might want to have. -It usually includes some sort of consulatation with the Identity Provider, +It usually includes some sort of cunsultation with the Identity Provider, making sure the identity is coming from a trusted source, and then tightening it further by making an API call to the authorization server, making sure the identity is indeed allowed and granted access to such resource. The plugin architecture of Ory makes this back and forth quite straightforward. -There is little you can't do with the provided services and with the right -configuration and architectural mindset, you can secure many of the knowingly -hard-to-protect applications. +There is little you can't do with the [Ory] suite and with the right +configuration and architectural mindset, you can secure many of the knowingly hard-to-protect applications. I can't recommend their products highly enough, being a happy customer and whatnot. But, even more so, knowing that it's easy to fall into the trap of thinking that one's security and authentication needs are beyond the common -pattern happening around the industry and customization and in-house -development is in order. +pattern happening around the industry +It's tempting to think that customization and in-house development is in order. That is wrong, in my humble opinion. You will lose countless engineering hours making something not nearly as secure as what is already available as an off-the-shelf and opensource solution. @@ -639,7 +725,7 @@ scratch, I highly recommend trying Ory's products in the tenth of that time. should have a basic understanding of what is already available to you around the industry before going all in on a custom solution. -Make your decisions wisely, do the right things before doing things right. +Make your decisions wisely, and do the right things before doing things right. Happy hacking and until next time :saluting_face:, _ciao_. :penguin: :crab: @@ -661,6 +747,9 @@ Happy hacking and until next time :saluting_face:, _ciao_. :penguin: :crab: [Gateway API]: /category/gateway-api/ [GitOps Continuous Deployment: FluxCD Advanced CRDs]: ./0011-fluxcd-advanced-topics.md [Oathkeeper server configuration]: #oathkeeper-server-configuration +[Oathkeeper]: /category/oathkeeper/ +[OpenID Connect]: /category/openid-connect/ +[Kratos]: /category/kratos/ [^grpc-middleware]: https://www.ory.sh/docs/oathkeeper/grpc-middleware [^websocket-support]: https://www.ory.sh/docs/oathkeeper/guides/proxy-websockets @@ -679,5 +768,6 @@ Happy hacking and until next time :saluting_face:, _ciao_. :penguin: :crab: [^httproute-doc]: https://gateway-api.sigs.k8s.io/api-types/httproute/ [^oathkeeper-proxy-flow]: https://www.ory.sh/docs/oathkeeper/#reverse-proxy [^kratos-whoami]: https://www.ory.sh/docs/kratos/reference/api#tag/frontend/operation/listMySessions +[^azcli-vm-access-token]: https://learn.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest#az-account-get-access-token [^az-vm-token]: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-curl [^api-access-rules-order]: https://www.ory.sh/docs/oathkeeper/api-access-rules#access-rule-format diff --git a/docs/static/img/2024/0015/jaeger-oathkeeper-kratos.webp b/docs/static/img/2024/0015/jaeger-oathkeeper-kratos.webp new file mode 100644 index 0000000000000000000000000000000000000000..f7d610096ea37e8c45a994bb6a1fadc32f16c5cf GIT binary patch literal 47740 zcmeFYV|Zpu*EJg3?ARUKwr$(CjgC9EZQHihNjgTywv(?ndhh+<9RB(Va*yj((gj}brE zFk_o{WiQ$9)>}&Xr2)|+$UQ8B>?MnDfvlM~!sBTsjZ|IvAEC0wiC)VemYcn8)0cRy zJ}=tU58$oNyzjobzWh5E6Cbxcdpza7?QaPWI3Mt@n>FaqnoB4}h1P zkGwC@i?kmfh`zVoHXk3aXdj@*fbW}6y5+QQv>)$#ywkk9AEysM?~t$gADfNUAG~YR zA0HHWJ0JHxS6;C1=e{5J03YQaKera}*NdNjUQC~(--%wqPdB?ZUU)9v8DE=UWZ8YO zpR&(CRzD_v+uz^Lh~8yG@I>Fi-yU+hN8dN!%U^jPKb}8!-;I2--^X8;&L7gcli$nV zA70`2hDT`kbSFLrKg>TMKhj^Phw%nKNFg z$|d)RgQi1_|5?5`91l2ed>{y9jOj{n%SqiW#xGSQi_8lyOa(d8K{K2z@AseZ?xVur zyS11RvV};x-~*#(=U)kIQ9^v3XGKmwNa%er%+S)Un~Ko_F9%^qumOe<_hTRW47p*6 z)4~8WD8B5`SLs|xpU;_x%lq*2=bffW1ge+}piUg*1k9d;>?sD+_`6zVaqizZ*Znv< zMDk_y>Xr1yIgs=5(LeD6%yL}`hs9j!ylddgny7$Glw+pcI-n6_XUBD~X>*h6Dlqf7 zWm!-U=f{{e-Vp#Y#&pZQLGOvp;T`+0Re-e+0dw>hT+gjsC`1?CKU+R;Jg@QzHb?j#O5X$v2M`!~=S=dU`ADOje}Fsy$`J@#c8u`RRetB zI>oYBW2q667D86q3P#qsv9_=JCIj?Te76ot%lV{g-62R6Seby)#8G;Qx=Dc4BveqHY7o%?H(oy>ztpn&{-Sc~;M*u-NF|H8$OI`!}Y@UikpcR8|O-`RXiGh}R>dvtd zhbn+fBi~CtnTk+U2y;pIxG>w_85`yIkwe*-DkgOoUKJlsn~R6d9)-al0dVBBC)vpR%xV zU8xDBW9-It}v~VBUL_G#Q@=(VSuyUByUJ^bj>jF{VW|Jlg^|e7N{<;MzHu;R^iFZuDHK{%9-_wP77q$z;M2x>)p1m=;Y0ayfe;LL$dbNLoaFL5L&e4xa#B| zAB01l@pkCol^WP@sG8=MW~WuOgeN(npZ25J-H?(}hdT}v1`ld!{J}%7e4_A-DpQ>k zB<6J}OLo8tb|@nbe4!)tP8ab7PaxLL(rqpEqMIs9=v2osHGP#i2x4JtOXWKTchG5= z!wgim#ONu}*m#nk(zD9%GgJ;RJy+*a_8n>U~fckT{nFiqL`hvp%qg2J5CH4!@Z#WPK2^x}*$X}cLEA3TH zQ5hm}GbX&VqQ7VwSxbvCUYL<1JLP)j#ELKQ*3L9G5ayF3Xt0J;1OyDE){rCQ)8a^e zDR6qczFMd%9Sm?0D|mT&r-FcZW^h%dZW?P3%1<(NW$+>t)?VFG>S4rit>p@kaY?1+ zgNlr2GXJ&}d!+vR_@-0cOZg#=Q}%xwCaIC+U&E9T0M?^!MXJ?KxBRQ`cjKrcCT-2A zeTI>RgIy{?0`zOxe1fHP7{XUnLGDsY^4?;DU5KO~WQy+_HQfOA6pt$9+F&4sVc)UG zISo6bXccQw6z{Pq(2pW7$U>9kxx@xL7WuT3CcbS{e}?m%ZtF1U>Vl7aJ0}ZGlI;cu z>`Vk>FHL+|r~cr##i~Fzj4-Ea(TB{PMFSn){_XL%9+dw))psBnLxBl4n0^ zpZFYOgiZ-|+cB%g-&pHLOjlzK6f?(&5n(k2Y3E+389Uoe>JoVz{C`)D>7yY-+w&y-;7dt-MZRd z;gabkHo5`+Lv&xXje`SaH$b$|=pMO_q;LDHCp@&nCKytfj{H!|_Ypg>+ls6{7ok=& zP+93kNHk0!KbYBWu&BUIjw~LcxjIkC??~HrJ%@|@5`r)w!}t{5l%zG8u{7u~*3e9l zQuy#FjFC8_!Wpp^sho0L;>GD#tk zaYpgvCUZ*)6(N_q(rD>(@ZK+G!yZ1ThK;b@+-M+3{3vf9jv*ZoV35ABfvNn3jZr@o`1jZy#G4BT;FG6o zKoXX~K8FPDkGoe+Ccwd)kdw)bBvS*FuF_lAaUN-qQbue4H@oNfk9hJwIRx;3IS|(f zY07M6EpI$t?`349qrQc#H{;WyM(+aZlOWV8&;f+rZ7vd0OX=aZLdC?q#Za2fkeIE3 zz(D5oi`yA$SM$TJHQ;doWHsdeiygUu&XfGBxlMO~1GdFFu-9WT82Fs1GtVpOV^3w!Ho&()DWuTcEz4gW zQ~F6bJQI%zGHk$pFmWzh_DxeS7(&i7c7(7Po=wyu%#eOgU2&@>^8YhB{v8VmcR`yF z{~0*{JOq15muN1ymJrtY&zRD)MI#xZ+oJPtqx>0`v16nMeJl7t!;B7-Ur22$qTvQ9 z!0ZthM<}X%oca1Ms|AVH-(U@0*7$S|STbJmW%9L9H0fLIw!s`Qpb3D}0tN@iVZ9`^HvH-P|M0@uwHbGo{{R4#Ik9{z z^wNKv_a}s;mOTK$(L?+JB^Q8yoxr9<^(9F|iYH_hU-= z#@PpM!cKnR$p0ApA8}83=v#z!-~k`*^z&4E4l#DBf$-x$apC;n%E|HI>g*^1)a z)Tzc;`$ce3LyUAXfOd)~J>EbyBd~rYqc~jA-IAea9t^qcI*}>V|G=h`rR&*gqEnKd5;R${JE& zb8sf#M$nyy8jb$;MZBlg)M*X+XBo5n@|@E8+$Z?&jgUwkb58@w3YmWG7(<(a-^C1 z1^VFU&ey1z*ts7#EwnDT_7ssLcZs1_eIuTtTp4%6$X7*RFoiaU6Gk&;+PdH||I1_k z0!tZiEzJLXXeoNW3T(xHVrtj;B+kuU9207PfNG3T1(`X-+m9Sk!ELJhzMeAlgnEWZ zKe?+hWF52?JBe$E#4oS}c&)g~bH^^Y*=l|Q^8lV1D;;4}+@o}X$NkG&`4NRvVQN-T zy^jekm`$s3NUo7`cjV^nolD0KhLwdQKDe!wd^-{;*m3}Bo5NF^3tS*~h42mvpKt%- ziYRlEvX>ER|4AZIrWmn`+=zas3I8&ueG`072*IWQ!Xu_Tz+PzQ*$@*kS|=TaaNSHr z5V9kYLO7rfL&(-37lieokbR zS+*cU_)AA9miiMse}XDU=3hFAoF{aD=`T^CSGMVUB1U~^J!;D%v-p@{C}URavA&1V ze1v~}h9uN1Kej{}au6JWl&zYEzNn4>L=64+g^B)OYD?+--!cqbvHdT72IU}PzU7x1 z6XD@Z>8Yws>W?8ICJeV#?H-}){>e>U2Df^L`u)Xro8yjFQS-;aJGx|M@#qN+g?UH- z0uAo_$8x&$C3w^VNp8{t{<;fCTcW!1v*hrKAK6?!sWB3alht4J|1VUIFZ|cM;Ew~M zJ^uuu-xG$P2k@2t_V!e+Hmq;x=l@Dz~WdLD$JK>;RpDeBUIlTV>PX3LIx4ddo z)W>2uBz%F$#-vuI2z9jml<@7#pShI5``q+@<`Tf(Zfai)|4hOD2^~~g<1$oZk!$;d zT|QXr*6&N0R7saHoK#7vjx&VW)2ux+3-v0LDW^pTE1LihvK>qqRF9`xuOmmQxDB-rl9J62ar{AA zk$=7dzH%}ZP;Js^BuxWVzwA3%53lRM-$=|$kmyiJ<{1~u`d5S{wEWinZ0#}dx88>V zhyF95O6F{tuA&JZgX(qm5zTEDV1UJ_B$Z{y{8Twz3ICQq>kAMwNwKR0QkDf31oJfK znyCyxdJsW8GEwsWNemNCHmL2R0vLZur9!xK3vaPU+%GQQp;PJhCYlKMP2Y2=Fr-cT z?hft%p+TEh((W{5e7BuiSG=<7c8XHm2!OUPF5bez#D@b5okmgvBc^>pU8-jM%-_jX zcBsM_1N$3SivE%-@#X*4G5HR?;C_;NxN4Bil5WJsuIFVUiPo+Y$gk^8k@SuK#gtk1 zwz$^ICy0uNy_&Q4GC$7uNm*hkQ;KNjk%k^Ll}3L_!NgF1D`;XkzwweC{$+jUpv|x9 zI$?rm58Pb`&1?5BS(}cl=bqlvwyl45y#pR%`p-^bSNWIVU~iB8@lQ8U{}xB-3(=ex zlTYNZo&b`~&UX*1lIWd>1+(PHHnbm25g#T-giaZjwRC?>JM90GaFg|z-;ifYdgagu*??wU0rSZ^o1`G0&_$N144*9T-q$KveMTp!G8{@h)W(I*Jc-( zF0ton<`=$uC>L-4yL#kVk3LNKH?Yyl;V8Yu20wbu2Pt>_=@2x(bBt|ZDmi{22vqei6hR7&o~+dmq-EJEv8kCizZ$ot>$3PXIx3B&hGVe z0u1m0ijcwhiZ4s?XJ;KH?0pAS#)jn30B=~ey`rn$&6*Mc@D~Y3ob_ng+K-bvxT2^ zkeLMa)N-1lKTAOP2Y>D2fztn7CQ|$rkCHyNLzXB2BD!$=G2^TNoVC}vJ~ZbM-D=YXc=maRW)Gqyy; zd=xSa;0Syc5agk5M%^w4$vZqr$(VRGOTgJw?E`b{i|(09SD_XUp`Gojy;d+_;+gmcirY&jy#KbAJ^^{er_DuHRN>mc>}W4XjJaRI9LQ7L=0)Tw_55+jV zj~b_gB&j&eDw`faSq)Sb9Dvz4p#Ib3r(yAtNDX-DMu|ik%lDE&2kthda@ho<5DVl$ zr8rlgW(qTbl%#F|f~Dwy;H)a)&aGr~;)69Pl!zv!r=Li!Rk|TUK@1bJO>)mM75x;I z2R2Jw$e!Q~2IVzD65-_wsL-D)z<0L9ed!VS-|X}csB$v|L9v|&fJi!h$8g!vxLPZ+ zC(21h(=PB0z}5*009>vZS(oQ?JOO@P%*<#9sVzllNy;g&Ttlnx+v;UafA{1{_rTG&H zOLxy0N5={$iIw~xaB=RdYM~DO7G*9QDL$ho$UD<`1uL*O+@Gsk$0PEb%X zcP!p1eM$7Q>P+TKYErufz64zTl7+&{{V`?yB8@PlOooON)PQdR>PFRAU_@@&^@y}E z7eJPH>4|pEwT4ddh5rhYxa-6@(6Vvs#!ugxhX5Kx$+WtcjHTH<)LR5pYz_LY zDj|>!Z|l^U ziginFdJ;+9+IG1{BuK(UUm6WJiA+v?mb*z7;ZIkzIkdr7GnIBJO=;{ zRljeQQ)C6BP_3KLQ49JTn;pp8%+Uu;U}}_`b(TMz&ouE`k%%+|$GEqazgK1)P~K@= z-jiOS>(SS%q-6)xw_;A@y`}yJJYXEzbp_oX&#x#=``U}g-jfB{^*_^frse%e(?E9Sa75z+%wRyrGRTYDS6ZbLX!6`rqTNu?cvSgy>}h2puX?fBJ_ zRuIpcKEgCR^1X;v;7)Q}%C0M^@Zl%2wdHhz*>$0M0dOcZzH6k?K&Q}oKjhfG%D(zQ zqQjU-pWpHrtgN_9x=%Q6L)3p=lFg?r(S1!w3hX?#GcW^nF|FTN+>i#$m(-RxuJ<22 z8A$|-0dIi%h+AlkRL;W4Vp|zd$e}aSa;m9dCAcebxnD$){-IjpjRZv4@Pq6dbUrs4 zTQ&6)iLi2V57cHqz37W-sF4T;T5~#Vl<-^V##GJjm5h$@+C6dLds>^^=adL zag*Cg4XdqLiXf{&#f+#nokYnx=sXwpW=G`2o!Cf0 z;=PM@zj~wnllVrGvibT!*mEY4%y1M<^Tu~a9N2e*NnCZ!I+3u@+@Z3z?R^fg{Cgpf zxVH|(cqRho`K%U#ZwDDl8&;IyR7Z;)lQe93$@NchvnEhcxTtuufL%zZtVDg{_Q+0v zL}(7^D+j13w}PF`kZ{u#6&0ffQ~V~!c;Rwpa~#iFyh18vJv4@CpZKEXvT_%}CB^tH zHa^ti+)qD~p}{G!sj}-SL+{g;Ck`uKoTEn3YQ5sTOg23|djXzvnSu;BHHXrE*d~UBcrnK!znT#VP=Qm7@Mxw;C-^-L3X}~JSntA* z+id1hm-wkkNX2pFmz%d9N`>iE$NNc?(c=p1l`#y$UiY1*Q6220N2E8&jR>UO%Y(vY z7;e;&4R_Jt6*rE!_D~?>DlA%Ngp)Whc@hD)+F2y`3=tLs=|j6sg7zFI8qS3&ekonU zHNNv3{-=+cMu{JW934GpbM}6+!UZ9YodVVbIM;BfieQ5so_1V9PWv17nbiyZU_==wwEYl`Q9|aA znw{meTsuWl;eB*du=0la95T=ftvqntskqGEWyBHF4UByhP|>lGD>L>+XT~M)ahU}H z2x33Xi_ipB)JD*b)F}QWmtn*G~UpyXb=NYf4m3Ld`FHAwzJk`TFZLD$NmZR#>u)H6}UsIU!I3v>Dd1I`tj8dT?Qx)OL)nt#+wx zj}>1VT+DI0goaraqT^by${s&>{3MlTZB)-Zw5e0)=q#+Xk~w7EL{rQpqWoZ0p3gU{ ztqlt@Fo9HSUTu`0BUwq1YwckWw)||Sk|kM$hatG`T}a}8EJ`G40AqkRVuo;A!n8gG zSn0wF6iO)S$yL$Cq}y-CU_N@_tl(-NJ*d#*M>l^e#q0f=YBYIk*>|{&Du+(PZpX6T z`(zJpmN^9Mujz6B3b5o^3~Vs40-A-g6X(1Mf2OU}g`e8F(U&C$uc`uv(aUjbkwHN) zMKgH+@HXYn1(e^wtSqI(u2Y*DWqDTh5R@P|Vu7j2tE#E^C?~8DLGeeysoL zLwjA&8n0SSN#9G&Wtm~?2!^m!5MtCaJD!k*D$e+1h%yg3ICU_)4yv21|D2*T0O&L8 zQ8xKQkLNJx`gIsB+FVGmHOmI>QTv#I zwQdAM>mfUZwU}G7O)2!V%WPKnymiyTF41TKq^oazuCBoKa$5)kPL#VN4u)4aL42i1 zrukkZi7>s3~vpBvCUp4{e4UUsg zIh5G!aG)W$n<=B3hT4%{TUMIp1{xf!dg$$L=#h8(vTR4p8$t1`-wvClm3tYDSs_^W=)55-KwbfBP*J z`D3GjI6yLW!eyn1$^ih*?e~kp2lRfIwBy_iQUYsLg;E*`PJ+^96+8_Kv(>2qmTl$) zmATgWc`2Z#B1MfsTu=4k3R%j!{S4J6gIE;@P61sfFJw!131$LWGoHNOk!&*LF-OA*$E9sL_f?vNy(IcGz>yFtVo(t55RLIvO(##SIB4=;WK}{;6dZ zbJf=E@F)++IVI#m`0M@#op(vnW8lN#aJYN0K^a`Z#pk61Qa_E_Y` z>kgG>agpT#w7Pu>@-*$uhf%O8BJ?FR4=PluuqkW^tXYjHA&{_lT}^=!y1kl=SZnbF zH?S8M{?wzlJU_+jL>9@Ap8q9RBQm2z#iA+Kp{XH?z`{r?5z=)$hTw^=ont5|l=rLj zI`fGV9%5G2PH9b~;zzRa_(hJm-U9F0*_N5R8?W&WUR1I-9uSivE`9*DMxV>AYn@}mN?B(_3`eiA+RQW+WuBbmIpZwmz-Ts5Px zR~`?$snf1EPxFAUeH)Gk+q#$_SqSL7(~aU0?%U_egwpfU^7p6N@s330NbKl2S-NGE+yt~ zWrX%P#Z`{HrqCz#%*ci~N{cdExZxSwOCu%_(W-9~NR$A!w`?K(T9aajbhmrOb?Q`k zO>=6vbtuRfd_cb6u4F>EO-L-IZjijMi}levkEsaB$DYXOVS~{v=k%n=9~TSg@~nGt zY?#S3E?q-p(b3y|RQ zX!pl$VeH|9z3$#VAqw^&_wLUVx07TL@H6jX2V`qg`5#*1W16~`TGY$-F9j{b*IBo^ zIU9Mp#8wEOP3tx`d3n$*IYU07Ftp(`YtdL_$N*DEsUL;DvSpC;8qmCK^7d^GMD3=I zx=)|kx=@|tT&{IV#CqY}PEki_AsH8;8Ek}!zJv&@cYHC4{H)s>zF&005jC|7f6DU7 zdVW8iWmt6FP$YvUI&+_^G3wgtE467PZm}ewgR*69M_6Qxf@@Vc+86%z8hwq8o&?@ z9V7A3o5AjperUpOd1l+ou{`c_?r?oQaTA*fDTHoruoOba^k@4{Fb`QE;^Y>_UhlI} zjgY*nfEe_)ZZ=0N`6VRrd~CoRju+E zOOm=~mVOd5Vf!oWleggah1|tz>%Jua@1vb>3OSGiO5U_Ac~5FzhH^nBD(EQpUN0wT zfbp-Y>8*Lfw+H5B7zU`(N$LUtIof6s8TYj^HP>IjeZi9ySKl`4B9SUimo4`M?sy`l zV-$u#Ez1>JnA=t(=T=0BhY8>E{1V9d7T2TEkYsJFxS)c^@7Bb^%4M0&x09U#x}Lyx zqoLIV5OYR)F^Hq`V~MUp#jcYsQ&^}uaju*S)lAzPvRd;WB&}QTc6zTN>8gR{B~f|+BWBQfg{OL*L8an@SCr@M#tjjOwUei$VdLeBTzT z5(}w|;lR~eFFj*OM7;|E_lK&E`A6w<9fNZet<@}bb+2_kH1zWaEo%h=E0-!UdiU+(hhw908dfAe}mvJJjpoR~04 zW`-p7e1vi@;EJFv3gX0z&datucWZQAgqNdZDG9){faHWlLJgCYKwpc+`>8k_WPy`> z0iy22;>>C+_v-`*5)Kh?1tjsYgox?!#jJJ#89?^>VH?>lKZCf#pkS(yl2qg=x4m4* z8>P{z8Nf!_j!{O?%Y@mi#~QOp#Hl2--;RZh@!*_nKT@riiS=uu{1wlGFhkOo)h5gR{!lb# zvGyAACy01I01#FsA&$t(Wcl|rbSbVmC3eR54l-1Hs%mZsQjIph$B_1p_2%iGAa)CX zMEJ7)t>}^nQ{v98Oq%UIsYd}Io4&FIeoOKJDc#JNF3Ou|5G{f4$cTP$`ruy*gaD@j zTxiYEE$UU$o^j4xa;=7>fkVQeoPcnz8}}dNaQ} z)D$0SX{GlKk3*fu=g({^zp+Q{$HbJ9uGv4Y!vNwTtO*8Z4fAAw3?s2uJrFhJ6`v%) z61CZ%O}TuZd0O_EJmk(W4=ZuXjJ z?`cI*;Kynu)uU3u88TEtC>hrl7m8KmWO5?ARjHU)tlF9-+n>$H{RCcU9=K=6l|1TL zL*vMYak;58C6^LJLP#;MTy(7+mXj zI1-}s{f81nOweqSZ504G6@nnSGXEq7p9xgPJ9C9VP-SIm1@yw5_O7%m-s zwdF!|vWUlO+yS59xCT~7Ax2p{Oa&G{e%Q^ewY=Cph!6>RrAVPL@b@zUT;6wfEN)B3 zfwe}giG&(ZcG;=2(|N5X<>L`cz^s+|p2|SC@Gulza!XH7@RJ6N2uz(P&H7Ev9=h7y zx5|+<6H7TkC0Twm;%bmLcF44A!n!o-{m>|d5~tx5m-}Pbuu$1|7YHo=B*Byxv5Ux}jk%C6hB;(+ z+J&f@VMDxGhFKg4lxk5~0Bt^PvDFKGd=w$w3V7%^#COJ!ulTT`u~D4DNeuQI^UFgvYx~ZTW~B<~8u0_g+1I|26k;cG8*9 z&o;TT>ND0n6?7oX?rS-0O!O{N!W`ipf@ax_d7XedP@nOtIe$G&T|dk8qlcQi*nEU) zbe@N-Pd}~FJR+VcG%~S49M;{>5B~{?n-oVLyhqTTnRcnj`+SaL_T8gfJv!t2Qb*n% zB8Ct6MGTEGd%z%}qI7{%2B}a$2$lg5`Sw|m;VZ*td>&^N&ruNU?S9rSV6-$CS2f7@ zrY>2YR@VW3;aev3IJMrCx)xyu%4U|JUJyaYyt`iHujN*v60qvQR(qKv z2Z$9^F`b{r0$rs#E?0paS3_0LO-egK5Z!c8xeZ)RB#FfR`p%r9rvOw}p?$VZzOqYn zLU=IfTc6C5uWzb&535FEf+XM!fxpf=m4uK}&wyu(f_!;nQz8MPL-F-#dI1W~SKkm& z(8$36Nw1z+uoFLP>bv~6;1#|wI?PNer16)-iBGs7^qCV$f`NHTG^t5(^~0i9`W`r` zLAc`Ro%V)`&{NC;;ys)si;QRY>76t(_TSkwUtW4HI__)+Q9D3TY72)_FErHjQycv| zE$~BAn;BVT3L>1czralUoo&I-xU!-$VBDbQYT0THpn1|&YSWO1XS>;L`)^5L$`{Zu=)&Ze5EhxSZy z30|f0Cvq3g=69(bp6zQkS`38evgM|PYw;U_zEqw9=03@(@djkpJQ?yPwVx;~elzwHr3%?(X`$XYO zyp>S+vTK*B0cv(n ztoAp;^e<^8zexd~eRIIJ=lwuj#dCrNaHv7nyK!cs(n-27#*00FYOCPV08}eldz@UR z5t#K_@KsjFR7SOdx(V2pLqUq?vA!QTpQqiagFe*!y7rx5F!kJe!NwqBAd^vqWqhdZ z!?u!ivk>}`w%-oq0RW`kkvLqes?aZ)daeRs6XK+#=FyCkxH3Nh>2Ksvi|eo+)y6%k z_;_Q~0N|mH0C*78;B{&Ui8$1ZKQ5nl9g~Y5J{u#v5ZT{@3Ord9U&P2Z9JZ|hTeQJQ zE|S36Wh1_n%RZ#Yg*SiUaJtVFAhxn!CWKuc2^(&DRq2dy;;mN!pGgI7;XQ<>d|oG8 zBRrzEUa>WQ$qB>&?B6Z7AQY@vYZqlWn!VHK?(72~x&A)mdkuC{?yni5@og*VA>k7c zlEk}4sKxR??Y!5#t8^zMB;|#=n^<0WH{%y4gzV4OmEZHyNh22vrN$?+(?!TV zE{16aj8XE|KWzH1`1KPqYLQQ>n6Hm4CK%0BjFgwi-2)@<*-H2+uIvD-3QTUVT?6SC zE!*0Qgm=kx8pOA;?HfzzdR!6H$J@oQS!*}H*O0lXRtVHIS8&YiFYn36g&}i7t~RM) z{FqJ_ixM+T^U6NxGCbWk?*69paWJ%}A=7VPoxTS?Fo^ zp-8_!=GDu9BD3wb^c?CiUIVZJU-WW0?MC}LJwDSWk@>xcjpCk}wF%MW_Wo&bsiAXa zw!JOSd`nt1L`{I@Mr2k23CJjDwZ|MQL5|tRx$%LHj2h#?j%RMX-u?jHnD!h^nwy7< z|A7{c+~iGC@=^>A(UtoQ*vrh=h(qfR_2k|)DbU(Rb&wo|VZ(9p$P+UCbUBu?yhHv} zs}P^M73-dFVpgwZu=V!+?r1eYwLg0NGuGhX#q|I*4)p2Zm*Vzru4(?)jjwD{C~urV zu1vl4bw01N2SGz74qn{(pz9W2*%8)tGlUe5$3jA6LR-YJ%$Q}G@pA}bT5K1XAK%29 zMJz**L%MVTuo^CBEhBEfX+<~>#SX18RmK8;gt}Fq)++7aVqqP9w5})#X$J=eMEH6| zdDX1;pO{Qg%~weik2(WDkUM(>%Trmk4uNg!J%flt;I^^xrG-t25?O{3KgbV{NGFbQ zMGv{Y>fOE=fIQLS76VJ3CUfZzx(UpH8Tc?*o1HGEXQz6L+OR^}gkPg!S{TPMAnw~T z>^u7Re`hD7J(0VGN*#qu$DqY*ouszWO6d53a%|)RG~HO`?8@T5Ibh!B2zFq!q1#t6 z`Wj~8R!a2i$Y}o84)DfM&;T1Sxp1~>vOJ{*8x#%wQ{#LJyPzc0P4k>G*541 z3?xlYV!N^RT{<#X<+FHwA_*-qip1|5mNc-ihZv4a+3u8d2WyK|BInr>t##`-YBbSJ z6-g86(xGHbcO8C9>j@bRyx?|KbB?LbTXF@VXK;vqb&Sr0?90(#DtAo(Q^glZV0=J>zWu0jF53Uv_+csVmcDe%u(&%b)zA+eVg^Q|y`zrzmaJ|G z8}`law3Cg74kcPCMs&p7<+BrbnJ1@N!h1w;?GT%Vn)`fTPUq$~p{y#S-cAP%Zj_oz z%Z9z$8!p|LMB>mp1G7z}w)=7DvlYpfrLqm9ZP6Ttz=#>DTTO8QJaJi|gBaupwVo-nXCdsyw-;#bG9 zr}?v6uv}mx*Gm)=J^_6gFBLdoY|_#MU!K-PmKsKUQ}1r5q(g!6+xD7GfC0ZtW#z7thtJNTHy9Uae%iQM&CcL*Q|79>y94fJIwG0xnD*3F z6aWge0Lv(x^xPm3fYiT;7D$5UpdQs@SR(WX#jW{p5*NNd4{a5beHsO0@!&ituwzdJ z2~G1P#Jn2pQ50rZEv9BEeq-827103UOo zdRXhe-k~5)g+Y4kJP2Fb@^@-?x^U%B5{HzWUR6EzfCuicl*f&#tbWhD07k*Q7;Ah= zRr>A)8o1j*Noq7}9ReRYI#n8n{Z@7vbNqi?4*T$-K1)|z*~ZrAr6g62(~;8%7<1Y zA*MjU#V}y8Pt|qJD4^jo%7IidlReL992mjr{mA>$0oPeB@=EYUsGvL3bY_88EG73T ze$(a^Ia<@Dgqr?t`>_rkiuW5`g;G_Z2Ww@W2VRO|=| zZb|t_)zP55prp24Y==Fax=fQ%cy7=Z_qf@g?>CMC07?o&vJ#?1B*-52x^4hYM!vA) zmZ8Cmpx1{twhs=joo}Wkt=NK0N@-E6(P9Jd6c>Ga*)t3|b1qp=+@68sxtL8$Aw^4a zqH&<9y2m!Kk?j9E9xh`r_3MuZ#U|O@Qq= zYK%!rPn60;FGq)&D`ik!0bZ4f(MMh}E1p`cN@qj1KbAG&x&lqemM4&g~nu zl)!BYYaO$W53+D@8e3iDH-%~tys}F{PN{xEq+`>WZt8OQGQP(L7Kb9-*$uGlMmVyK zaluMeetoS)R^p#ww`BZrS~NG@50;u4E4_0nHlS+PhicecUgqZqT&9m1UJ|0(m=dSa-F zQ;?kRhdr4F^kuvHQFxiPKm$7fdTXXFwlO!D`D%)dh9cc{=>Ptx%Qj)c_!vhKT5PS{ zt;B~*i?vB!gQz_KRntCgB)NB(y6d%U!{k^Q1fRC7x+@2v34N>T$R=39X;o9cKo;&3 zfNFVLB2`Q3t+ZQShXdv$_{a>4MML~*7-rJAY9xMzTTFNX(TP@4?;z9+vOiVmrxaDP}Zp&wl|qhu2oxLe8i%lr*=fBM6ZwJjmO-L?5-jvBb!Ey&_E5mWk8`Q7g9 zq0+2vwbpx6#zCw6Fg-+n7pJ>n4n6RhAPF`P`m^I|0?o2li=uFFe91vk4bxUqJ}FN2 zXMmAfpMXOQ7MIXPxr5W_zHLtIZ6}b_Vd2#oWJGmHvz-%CzM5dvq;ny6U0pO@U>`Sx z_@=(dD?z5-iWg-~Z6z_==|&32W~w0kWwZ&Itni-% zxY%qP!7jFINuIJdMMsgiL6Lb=tZNo5tRfHHWx>S88J-gU#9E}XP9e|4z#DqyQ!TJ1 z`-~?fkiZzz5aH0fTm==ktEoTM!Q{!4o`@zRay+7E05S>Tq-Y4Mx5B4fT9C$hs{aOc@Q_v$-6+U4g0-RB#5%sLVCUE#Mqco;L6)_=kQrs zGXp)xKGc%r2R}YDv}~URRiGR6-m@!?UTK%y{yhj& zZ1){H8FxsOtiGpb8^j$RinB2~^u!05A*a-oh>?m)L8Q50vJBSqf*v9b;rFPN;>h_e zG{f~}aOA=t)xzzF$2*l~5!ZpEO2RPbfd*~L=n0-e6b7kf&Z6&MR@a*Ovq zZMoC>*&*?wz>hZ4SqH&OpE24Hnvx<&b#YDwRks2mZ}-cJ?f{vanejWHLE#^Py&=Ip zh{%77);UfCBmz&bECbbJDLpdAVE~%!8N8l#b=?8Q^++b)9^e1;Fn4rDWka-sQOwYh z>3gsYX@|#1Q)Jh(uMg9@^fhyPe1L=5qcU&XZ|ud+UdM?(yj}Z@DVh$FSHT0068HZQ z_Kv}#L_NFUHqW+g+qP}nwr$(CZQJ{7+qP}q^W8f&^UmD)W>TrH>U64qtg6mRKkG@N zoOPU|DH<`-y!pu^p55Q80IcC4v13jP(xQh|sQyv8k!9ZT1{dK$mvcfR-FsnRV zgo4CO0%o?aH%)zI%!_+2c8z_L>-%W|1FTN>UPR#@$plL?%I>-*{D+IXsh^g-y_R;beoG%>0rzKO*!Wlnx5k&; zsR17aR6qZY55SvgjSMnb08;yS0*ptHBHCZnS8nic>P|=?6iaLowQ78Kv2lO8zZU1M zoYCKwDHR(I>l5#@AYVeNHlIyRGz>AstHN)-geJR0UcpqC*nec-pS0{h=IA&{)WNp3 zcB`~U$p4$5x?9L@P(-5;CF>{8?gvL#Rx+kq#HG|Mo*-4g)Gzd&>ePTitDJr7^D{vw8NG_ykwhy`E?TjwGr=p|WMgpJS zJ`MBC+`A{{IZiJE(8l3SYV+rV7ae#&r(`j$w4kF@Xf?Jr8fs%sA+=bZ z3!eq7L(Y)oEsL)5{F~a`DUaG;ShLi5%?_}#1GV%BeRFV|a4feD+Bpi>vzumt+T-G` z`8M(vLXMtak8v-SInZA{oWQf6C1V3wK%>TI;}LW!T(j_d1cp+Xkn`^DC}PbD1tmSo zv$V7w4Rxt7ksXRdf;<2VUECQ8kz9CxUzlG0U6u#B96>k|MAeOh;#&j!$=5mV8090} z9U{Q6KRNIu=mDcsr~Lsg^ z+y`LTDt*|=az*3SFJ`eVr2wr@!guE5aRV=xitGPS;yrC92g=S0oBW#F8est7@?8e* zd>q#mjSX^{A(>uJ*53n=p$x=_Wi6?hqJav0|9F0Jd}4S+2uNUvZ;+W+RAh2qlcwmnH_KSSXom6a`iuht^tm%&W=0TRW|4#Tej##>sCu`{aMJ| zS@PtJ6H_?5;K30qDt~gpjV+r0KTU;ZLP<5(&rj$*1Yi%0%N{)cFbxz!Wu8^DgE?UpVE2J$A^8E_ABIr45TVK(Hhj; z7)=@;%w|nb7W3vO%Xy2l<-*1JDv`1x)u{j5V*=po2jkWQQ%w+q9Xm`iS2a;V1oXq^*`visbR=k&LW+U+wz_wpDu)vYq6ybH&DI@Uz@;RX z1Q4|*1>U31<+*{!%Jy8xaG6gJ0tvu@msW-mSI}hEH^^B=;%R{k8`{5nn+eOm{qkVz z0$w0Ic}0@yIN+SEq>)`vB+A*E$~oU`D|T*Id*fOtc2+;~2cQxYTZuqZx)H>Z{GhyHf%f;~zKbg~Vdnpq2s8#{o+GtDg?J!G(f;2(j)Bbyn0;dA#j$TC zPo*s01S+hDol~bY!^{o?bB<2FNeoiz!t)Ofu#J_Xzk+eb7v#+SAMuU={I^xh5fh6g zC%T(q7O!!{FSDt%bi0Oe*^K0{PnjuEb$Ehj70Wx?#QGq#lJoHn1Qk8+NAqEX}k!+zS@3aU)c|t z<(FaNj8oVPbM%_J%7Zvk0U3T_)*cw{#i-litvYpmLdS5m#PUOb(A#ZBnXrt}N1I32 zS>U{?>D2{D?|Q)iRW_^vVg=M45V7MSwHJO09mw>f;>3@xr!%70>q+;V|IxY6mmoNm zosKLOxfPy*1IaQK0gzEDgF5&y7oUAa0Fbsz`(b(*nAoFN4BQa!D_#w!#f9coE8etFV#V_vnclK zl+yLVQpXtl$esE#cWhao&cv>>?E3}zmHXXaMXbhI1Uc9D#)-quA^zMeWp&)KvvEeP zc6GlA&pJ)C%G$+;1kQ__p9CB~h<_rEe*D}F2lbrpY}M}Ojc)`{N9?H@(H1=+uri4b zg1)wRD$zAnH;sWB@z5*`#7zu6V&LaBVyW|Qne1YD2f+`1&>$27QdI;p3 z=BGfWAPST(CisQ&;AYG#uEl3=5n&4*I3iv1` z>sY;Jbv+Kbs=JnJp2xlGdHy_(KLqNw`kj6(1`Ig*vxw6nUw0fI%c3=Zr)Yu!wVMUE zyn)x(Bo&kuL?7dY-z?B-hk1ox{rD-Y#D<(whv`AMc1s9*(lz$r`4CAeGgRHnv1@UXAfj-tiek; zx!vwmroBeUcNA_582)fx%I9btKbiQ^4XRQ9?ad*FGv}Bg2VsIQcG?9btqZq#v}z~a zxOf!(^+A{BKCyXmr%jUH<4u9B?7XD8tqVruoFDO|uE<5F9%+}QhMyYlWzO$N$xX>t zZUq&xkXLr1r}*v5wXv2K5ikgD@^2dfpgB85yJux zb#HswM0)F;or_I$K&qe-zsW@OQN^b{3u4+(S9%OO?rkot8dnAeeeZ)Dw~!$p@ifG?;m zaoi0cF9(1CmJ&GA`%R}_XC3`xVqMiKZJNZRqvIF{3wlpbF079y7l<;IU)Yr`@_jy- z48iFKeRVO}@Ej>Mr;-!Z003Hp!6;1b^HM5*g6)X7lp3}{=?!`f#Qo4b+BPETE=Dt> z3NwJIW}s4TySGz&TZ*p|C{Y6YF5dPCzq@a2h{lr!h;m0lWTF`3xpxFg@#8GH94GsX z%X8;eaKU2(1LWmLi7!SAJ55>7c#+}@`_{W=4_w+kAbHhZl0wsSuJNks1*Lp1O1&s_KW?Pcz)t55qW5|REA z+^%(L{GCX&QOpakzDJkoKI;Ld^Q72x?CvG3rUQh%<{E3GMg0pj`=thyigL zwD^9csG*VlG;!Ysfm+vM7{7h6sWoWG2v|?;cOMaU%H>{>QWyetC)rUjn{6fVv8cAH z16IA}q(9x(TL8}Ro#$T+0A2oK$->?kJ@F5(p3ftrBsdSl{vhyCnGWWqmW-H;|4R=P z=$vikRX#w#B;Fge;mHo0<9G2JO_bfEUK_o8IK{PR-eIbmR#TuZQqGY&opV|TCZ-ol z&<6i*`~~k_GE<|lbd;X?jUgxAhxWp9uM&QA`1bQDxrxRzuTRnr^dJQ48n4c+>;SnY z@;ozJ2Ok{#dtOsHc6DM1uC34 z`ZMpy!UmssmP6s?Ud_wkafHwio5eTmeq z7tNpWAOjHL8{)^Wrppw=S~qZga~vq|t>w^H0pN$R-1 z_(73=f9(PDAWy&Apr}Bt7gh@rA}@H`k6i0xL=`d=oV4xzkBPFc*-g+7|ixx`awMrO`ms5yH*Riem;O6_|3HK_Er!V zn8DBP7UHnGHP+;2$EP5PbaN9OKB-zqFFLPa6pCzrC9 zWg19>Nw4j^$Z1a@z{|jE+>jArx&N25XCDg<%`v7+0yhPpSI}0ZqZ^;z=w74UYTco| z2HWN8eLHp5^X1zXs?5jpmn}3|v3TM`4Ci<*a$e8CjS7d5-T%8E>9^+(8)!mc$rBj4 zzR#N*OtAYp2L9ce>HG$QaLKp3iM-xUs z-ay|Vm3Frk6iY)|f*p&$eHWHG1&;!7rPLdN+j1S~s%?I0tm8lV*Bk!9-r?TUjarLh zNLfo_)jG93Zd*;QXHsY|LXdaOSZr%5coKwo`3s-Ruci9rpO-=Nkg0zMG;m}+Mdb_@ zWI{GJZMM17d~%!W7CW7ncw;6vBV$O@bVM8U3w-?4c+!i@;U%to~p$_;_to=SrI)B&zMaIxf+u-u%u2KMqMSH!&xWM zV#)*`^MnfDX4+{j8xSe(ss`NvvT)G+mT;1kovOtaeo1S$e?K{|-GmCNAP~Q&gd`fz z%W;sf^*|lZkRaJmWecp@-2712oUYICm9sEvUZOwMW^gy)F4X{uQQ;ur*^{@r{c$56 zBEWeU>VE$2ytnPtkXhS*8mxdG>3BcDG^qHOpo`nswG~qyd&<2I#^l{&g}A;<&tW!d z=RZ(uU(b`#YxUp@u!4>MXu5TwHGYwx>GPG|+uQTjS&9?pIU^LwjX8%ion#z^R(qzg z$LC{{MAri!`O^{58tunK>(T)r^cS@&nVn>$_4!TRnI7b+zF7T@Q*6~b(3G`(b3evi z>0`Ti4L9M9#wUt*JCtlZC7e%&@QRv6@`B;e>b?^xM1vbYwd@7*B*l+gsWGVw3S@7E z@s9!Gh>|$a9vIA+D97D!>Ro_H1;z2@eeXh{z#h}Li;MWm32eJvQF(l1(cahiG8+jEi}LZ_1R+v&_`v*}W{J5G1L@P;#ly*GoIb>-JU@Qwy5X-^~}Rz`4njDd{tg{}7{=r>l|YRB@C{X5AU*HCRf3ftMmlQ7nt z1D$=}t_?iO@Vsv&o4rP$dkL72V6I~VzS#Hb2)Z}-@obFB+f8FzU`f)V_4z~QjMF4v z=i)yH(M;PIbiVu90d!~X z$JeBZUtcM8QDY&2=0bXwSR2wNdjDteRUftPxQCL-pt!BYx~S?JF`7spv`MoroNl2S zp+d+3X@lgnhT&tuh`slgqB&jQYP@K4d$8`sO64B(LnV-f+?LQwxCc>XuJvq(AYJzg zX!)zHMAVu&^`$1+#ivjq*czZUo8R>dwszx<(T~d_!o^faj3c?``?38&+1jNb37oJi z?9v(a$cC^e5KhEK&9Q-&Q#)wX*GG=yTgNHIw$_7|uu2jnJx$v&27eVLEShtmlLNo) zG;w(dm|Ok?rxx%TDB6AkVw?~Aq7ovVI}iJ&nwcQNr9yY1cNtN*c^A0LwZRWJ#h8)j z#8Cqkbe{(C)kK0rv-Br+{#e)sWGS<*zn09e)zqUqGGo!eaz)=~Be%dyTOL{S3|Qal zAymbmMa9dQTWWtA8I1Wjy&TABlO*raQy{?0oq`_h+kRHb|Hf$v>=s|ZSgxsnvzcNgpzT~!X7ZR zfZVL2(YnE3BvNhS&SOe$Lc*WkRq&qn48zPd1!HlDu#%RQr3^{)nGM|tzT@(t3i)BK zc<~X-5#}35Bj^z(@g2RkoG~hytAh}usVOUnwa5+HQMZUgDPrL^uwD1&#g@@XVx~%% zx8#q&9s@$|?v&xc=@Kn0cvwb%VODJ9<3%^W0I_`TQl^3X>SA}ZDI`ZW49h?f1lPv7 zsV*;$lcaCGBXC7QhLK|;&M1abLj*D7xZsA<_wcMx`~ByT3Avl&?q6o&tM95hm2o@x zQZX#tX1J8Tk7dmD?CdQRrfq+zlUlLX-` z*RGkG?KmALQK>n8@E)GlVgdE}kVcsgKbGqD=b{BE|5j^Ta);3M5OgA7f78-tX81U; zKqC!aAM^AONoKK8;AGXU%#4Q(GX;OT#W^yTd?pnr-at(j=nM_vdWOtg36$P(i!z94 z-a#%4bHY(W)ekuZa|{h=oB+>sETMb)_d|2AFItwV>k3+>UNq(`-Ko@TIaRhh4)Ee^aw@icJ+# zCzTYeW|{BRV>H#+-=fEIipO!r$m1JdX(g!p&Bvpt>O@^_^4_|7G)!oaeYMBoPTceA z=J~h_rDnq8elxc|Zez`4znQ)#hXBC${uRV(pwXOQp=(3Il;Z#ZfaIfn4W4%>sfhXv zC<6dMt2yWQvH=jK#t{{bgaH722|(p8)`__f7ZLYAbdI#|{wDFYKV}6#QK<3Lw+a~} z4oTioWY-7G52Or?31!MwdXtN3!#?rf1r1nM9o{5b#mwaaotMQdX0{*K#!3a-=^`4B zvd|V!C0cidnuS9^tOaa6HyVk@?O^CRlsZJxO@X9Ozn#a#b<8ISB z?L=$0Rk!%+X;JoXV1njY7SJSWQD@@{84}=T*#?q@`oDVBJLf8E#=FG>jLmMbt2SDm z6vD4fn*8h1lBYbBbBEap`A0*M8l@TJDV<2wuK*m!o)h2G5V9Y_^a3*;v@?vWzLp4^ zNDO^#c{R)v2shZ{u|Is869jBM7l4}q&Rc^3@~H~-RRJj+rX9unEA1)16&L&vg6w_@(7v=gx*J&$UURGF2olDP z1{5_s<;2Dm+SqOdCMdhLX(kZFFnHaJDZY7o7Bz%d7NsuKUYjvP5KzIx20~A057Evr z1ZX=>n7H~OW#NL<`J7d#q$=`UWvwdAlvePAchd*Po-VIo=uHE`#fzYG74(N2|F|DY ze5YT{#0mV9jg?>)Y_unTcWM}`IPR3NjaGW*O1#9f8`o7>oV*U*&m(8arDCX~f_3^m z&EZNPav}Uv6(kZ_BiT(f7pAm(0ms~C*7fw`AZa=Vy1N_<)qvDmRkqAm$RNRQR7MWn zxGIcUqK|!hUmKe6r+9Dj8JBVeB5w0NIXrY`zC+b^cZxFj~HAooM zkFH=w`!>|V-euiy4Y^|qKnGI|6HPw&Qpkw#yvVkfSFJ=C%d*_Z(?y=aRHTZi=u&wV z{mqmb{79@GM6ACtF>i)u<cgp{U|KGR7PY1O+&?cBYaXY1*orwI&DE*ER$F-+Muvc zKQ%{HY=v@$0YLubH!01wq&qd;Z#rI+`C-#-wBB(BN25SKYG(`$>am-fHPFAG-2IZm zwPLni8XpvNx!o{VE~{pmqM;!vkq#|@mL&`G);ZMn8dRo1Hn>$Tfd?M28FstMu`EhQ zQ}ss^S?Nh!>x#do@5@a2BsB0((mDjUDsimJM^g>dpQtGNwUVCMgV_HoBaW=^Sv+wle~ z+R9}*Usf2i?Hw*25O@>LP{PHe>JFaF*xja5kYyz zVHBv^Gzi38ziC8;u2o2i{cH4wYUP2;;h0Pim0iAjv~)iaq-g_tI`Y%19w$L$?HsJv zW3Tc}o2%u@PAd9eSGR+;l%dF(B7`bOwVi&^8sYJ^*%1RxFptK0T$T&lFTgGAS%sFw zq-e_Zdw8~O?oZcx(0P-q$wksy@TfxwA_CRcccILf)j`bV`~lh7Pobg zlcs_X(b>`d0E9*c$cCew^VciKX(o}gU&etBIS;}s63#QjK&08?-^xk_|51z$q0p*PT)>CAQKdJ4P* zU;M-+QF(#x$RF%EO0gGVEy9?GG7YBbPtu*F|EIx0OBNlluUm$Xu~oyY zN1$!j0oDj&RNWKjwg==)d)|0}K($k}NSu`_3)yG+8<6>o5{7Ur04*Lm-S)JV;L-M} zUygU=za$5_Jjm3y-QGWWyPVEF$G#-lPD8|}devh6NI{B>4he(yB5>t(m~xv+>~$fD zjMt03j0vc6^W5|_k{8B&KMxKkLw*j3nQV)Z>oa_i4am(E2(-xJi5oczTu+KrAqYg2 z%Z-l7K1tHgm4wPyAlK$j*j_EkAY*O0rRx+E?ddIDI1un9aTa3j%_be85@N_^LKH40 zbCW5e0k&DD>r3b7(rTREALe_uIN4Lzp4Rz!4@{50L6Zo3TPR4RyZ+0}uUc6nAceb@ zcE_nr%NQWQ3{w#reJG)4nJ)D<{jME2s;ek%(TE6Zj(%=vbP5k>X`c5g9M#=$J@5q< zUmqCiIwun05fuoMMSG1F)nN*kErwC4)s{^j9duQqMZ<2zIW- z^z3r^GK7kfrfq*QhFWu@2M|ZN*YI3Xt>}TX^OSO1`$1boH5sCF>$SOd<`rc=F8X?) z?tPGkN>hn%qHUjrEb-TME@uO<44;v!<6PpEnP7#7jk2~Sd2pc+-7Q14uE0SdLl^1P zUx&+^n0&|L)xncj%y22q=jN+*=o7!tj$WYC6+nwboJ^v1fF>~dn`y`Tx>7fl7S4K7 zt%fSMpXm5}Mi9aH`YgfL0II&wMDS*Pl?(UUPeEEY@6}z zUGmg~lDWkhys3B|ZLW{Biy8Zf1R$kAEg_S)C?cqTH#5cXdeg3EV%Ql|gb%0CqY}{z z@C?%%*r%VVoD$!~YRSogsT@hEgz=G1rbmVGHx%II5v_-M=W~`a(n!!YM(Avfe=Co^ z<|QWcOwQ9-YgB>A-dqYMT+I5IP=>Z}QtgO+vSBH}@)Rl~neocEt+9w|*;`38Ph51b zINX50v4VlkZ#I8^N?v41E0AO*B4Yi4wi&UY``Bz3fUM^}&oQ6nR3S^~Fz@vs;t=`C zIV9pxJz||4WxTR{*#rQF6{zG{iFwv8W+ZplB6AY9_T?<_?uyQC|KBYO#KjRp=5Xhd zZw?G-#Q4{h95k$on%RSjK>jD~oVA2)EwgAR1Qt#tvb~Q+F>}FCCCWUSnl!qCKT+QO z^#Da1g#*4h{7k;C#lE$8)eQWNQwRRr{dHV18k7Ahnnoh?XR5lpgA+f6;KDHEC&=ob z^>!c^uH9<1zf4rQRd=|CtVwIWZ%^+{8wamdMMt|rTUphzBHd{UBcj{fEwec`q#XG3 zJ4PgJLKn;M!#;R8XQ$;`mg9L&vC$4}SONki9|^NIsJUr~M2?|Yx+J`RIW-ois_h<% z_y2Z^%JQ-Ee`>P4NqJBv`}!L0HcfwNF+wzjwcjE?(6lu{eg2{jc~s6jNEd|dC&?&kk7`N zh3KbHY+rTpUO`48>}o`!Zw3@A!<2P9sn5?q*^bW$$%lbGmSLbw($|)by`u(N0MhAS z+x~dk-);Q_Ip5sC2HE)A)sfw)Kl1yp>yTf81J^07f(3Q(i|$4f`B6PYJ`w{I@Y8>x zFsWhOD`O0AkDq~-b_!?mKj%i_UH%AdXW20FWp%5J$t3N%rF< zzz#U=#T?R9ksr%4gRNkI!a3_=C~wmF;QXYg*i^q<{@licu@6P5%1|HxF8|0;Jz9!_ zG<{ea&!70JBl5h6m3k(i6Bn1+Rrbm+6~4=#_}+cPm=LJ|j62lMxcok|w$3o7Mm-K{ z-zmfg(P%%jx=(Uknnh z&k$mNA~~Btn|gcGNcXR;vG)20DBag0SYKOANMA=qw%m|bNk!9JT1rA}|9BD34tP+?Agc7*=at zLt;9N-il2ax8C)5&zzqcD#P*b2e;)3N55d6STxNKl;NfU*N$g;>G0hSAq`NP-+`zd zc%Z@5L|Z_r&5^rB&MYh!XGel)&?5o(LMENTM~-=xO)Eh)XSM_^jK%X zth_g~jMfk5L8*LRMMZCxq4Qqu%Sgdi1S`9=>1R30bVF(vBj_A|`TF*-X>-ZE#+X^U znE&36TPkmuHE(x!cZj`8o=cN^s3KRUaA;5yZtefuj0Kkin?~C+0+*~^e2*JPs8$P; z>(?DqwEum1hoVq??0l^$#CPFJ3XQ@#xu4_i@Jr@*`!NC0_gVKAMqq(TKRKRoymxp{ zwkAV_$((8o-b-N*jvE=TC_L~)p@rRSW+tEFknH5=%B922MI0m$5|g;Q$epw z7sf6%+sd(nDE=Q>b=yE?; zOLym|$NP1m;;;;>%PSxrGBDO7y0t&T4a@w8W`J=nr9r=g7iU?t+6&lgIa&6+=@=(# zjqEB@X0i`=(0HZm{B?wWm!2?i`aMtKLr0Vx`Ye6GL*0-e!7OqIRo}*&Tw0OeH3b`3 zFX=Tfp8zM#Lx^=RI@&}QYb)*3Lp)aY3~+%fU0#u=g2By%V;tv{Z7{al$75s0;TK+w z6u#t1bUPeAxN=imS0J`)KK%OcQN%(hw*f=gBq;cMhwp*}SijN#KeI_^x^Pc7|%Gv=7Fq5nGJCR4S|63i_2)4zm z16~$EoD)Q^$AvPS`TtM|`C?uR2+1W}5Pp#4bzq{H|4xBy)Dq^Sg8tI08zeSh#g|g= z{dXFhkDVl=+wQgyG zdwDK+RR{u=P%2V|dStnbV{*$lj+2Ab2H!ukzmhHc#Ff;XknhOiti^o%sQMfeOgR9U zp%GC+AUUd)S4K~)>52;8DE@{;^m`}%xZU0vW4Nm)*EiJHxikQ-AeV(Qq{ce3O^B7n z@q!jdJTf(wo2^{O$1?>9@fp*bNGJQ@J@Tc~B_WbarzHp3jALU`0@kz8O^QmGY15Ue=+VVPkcXzVdG!co%K1*(c*%E6Fy9Wc zm23`BM7P`NUMcr!!GtoUo_Wn6ts%1c-0-Jth~s&ueZ{_b4Ri zV#xtNJ2q$19HW-`z&1fuItj0v9&(LPf`D|WR}t;Cby}Tby(<>0KD7FA^6G;3;quK| z6FSim;MWDXE^bOno7?ppv`z9uU35Vv2>`6rL0QR5_^-dnWT=(EA94VA z5E2L_CnJw1glq?Ze==LX1mCE)Hf4YMfQ>Ke|FC`mUfGmaYkm55Sia_Et!V`3F+MJe z&j2l&tgYIh-wMrGMFz$!_ID|AA>7HR>aQ;ZgI@5*W-=xzzF6>m_6OP~(njIXH8WF| zC$N)6;Q*~G(>u)z@LL%+oVyjfP?B?81^t6v{zRr9_6aTwl+mn*+C8!844;#h}($v+S=|@iiQJ}?vxoP z6^y4$kFDMIq9z9i<-CdcwWf}q=p!(m@i#MuGff)cH>REAV<&Q}EilM(qTWkp*$?Cu zq7_dUu9er*x9CN7Q%nT0b{P`DeX*F4isVbS?H_z`Zqc5OY^hwhzWk zQlsdfA?@!<;r>uizX5u!QhM?aj4&2G@jYscsys^16hiE z0H2@4s9ZE^Y_-eJsKqyK)0AcJ8NTi=d2kxIs

GwT-S0N3(MkqX(Fm$Hfcg`Q&E= z!y=joV$_W&;-Ri(i>*1q>f8?Cd??Ak^+p7bn;faRq&L(7mvz}ROo@1*cr1r1DOcU& zo2Q1k|3O!-lL(WpDM=t2JrK|X zg^|z9GP8ZCZsO;oeyKZ5)luU-z0oCJ4ZntQb6@QR4NSPMQ{3Mg4nZ^nZmzR@n%VqW zku%XeUkAy;cfgBPv?a&wP&~YTXOS2o+Zmu;l$9-$XPC=CaGtpcEvYPB4__M&n|l$P zTPw7Wb1pd7DePe+BLX6C(Up$cj0BW>=6?ATWw?;n@Tw^|3`Sr@qM zp%At5I_V<-;F}pmfGP-0`ADv$A5hE|qwGh-+%`)FS3V_v6Abw6o8P4l39gC~$}-r= z^UPgtr&E$J6(B4VD`e`)BHv>)nT|2I)j?T;=M6SC4edL~N)v%>i@98J-_Wszib9eZ z_8@rRBVIJFkJdgaT-?E|Fffa z>7Tj9@{3G_l6R6{jS_={)L}fQbS~%TN|JZNc{wKpBNgG z59G-W4XsD!W@2pqiA4{k>NS_{h{9Mf#qrk{Y3ce?ic%h7W?8(34eNbPuhE|VIAvVJ zqjcX0BdH`7M`b}GJB%IrO|A=pF;c1MOeq#gtLVAovL;p}-#!s~XI267DA?|Fx^P+p zrlij)D11J*&6WBgatp+{bWL-gsA>wGlW(*^sJ$jC-2?Edm+-3K0-8_{f z=@%xsk*KRmh3*`=p+m6=4)^GWv>B}CMlj(b8+%x%eA!23Z5uKGw(uClR zhRqSWDd%aOp&uF#BEw#tB=wyx{+6Z%3bn2cJq})zZ+s7=NSJ8-ttx#(#<}Ls%uk&U zFIy1zwy8Z+f8kD3Q23DN#YtXpbAGP}2DMjj0g0n?!Fp$)QI=EgRHu1aSLHda1T1_! z(e0?B0hs&y6UMusarKhOz#P7gU9h=&)1!=VfB$bRH{=Y~@-iO7tByG{HHfhL0}URb zR6tHf-R{M_*(X|kLGf~Gjq*!i)u*vP1OJbr>2Y${m38bSe2pq(GQsO}ng&r0b4 z=pM!(>*6!-$j`&WrCL{~y=T0ozL`)GlO4zDW> zXNaF{FkLb;fB>2RLs`wAFh3DM!l@0~&!--FOL^^x9b3)`EEhHPzx^LyS=$kTvfsm;t$d|o(N&h08X z9MMDUvCoa%xq#f{sn^L%t8k>HtO2Gt?mi7Z#H(bcD5w0i{G*TbuKQ3WcI~3%6oMNK z>%Hb^=A*gL`NY**$ccS!rAzWvD!+4sNtG6p%%FhS{6`pKZJR{90caTD1op@UD*oFC z_*(+hBNUB~G|C-gYSRcad75lO)29&=7xkWe#N=*aGlthTnLMq`!-#!Z4jLgp2^PEh zH^2tXP8!E3BpR_oJ@DbKtGZ#t#j6d5k64(^x=+`OtJav-*23qvg|*?sp?q=T(iR7Y zQJczCxpDm?)T9A~wBpj1=c&ugj!uuX8XQ;_4&jly*{BBebp*)Zohyec

qEy91au zp>is+Tq_o0A4x02?6TrCRH$u7UWNw2ta$Sm#K7LR0Lc5 z>jEzV%K?o;ZRr6^R!(R^e1=eS*hxgtnT6`iqRk-TGVi~*9oDwxh_lZZAw7uLI8i?f zznBb${)Br@_r~1qO4c?VkcnYQC*J+-e(^_`w`wY#UBEx^jC@9kvZKmdeU)`C8-^qf z2XofdS=i;dVY~v*e6@(WZq$IX;n?tZMf1I9U6WOu4&?T+L%NFP_*ue#r8_T1O6Ado zyV9{H40;I;{2DZ7%gPEL0IX__Lf7*(O#iUO>V*v8aDk4s^Vfa9(KRicBTxA^6H;lN zDys(gN_7n|T|EkA*AOM5*z_BET~mG~N2t+fti8%ff9YHl4dm~}uw3U597{1YoUyuHcijh|Sy&ECjTq3|} z^SSQ@*oOW`QlyH-vAaUPxHPrfME&B9X;7v@@HH<=lB{gHc5@l{s{k`XMWi)J>@ut< z1tvdv`kc&)WufiS-TE&&ZH9Y!OB%;ghPESyAY}4XfkKS&BrB;v#+@P9C7oKK_c?Y6 z+kJ5|G;(0!ff{4QWANgDD?@o+Y}s|<@K9S8LU7x+DMK{$L3(lZ(--?^Lth&&q>0VC z7p-Bjk04VXtTRuJ9oS%|_##(}d+kEOf3mxP_K zGgjxF&}9_xgt~my_1g~li_uTeCsL-37449)frablUrk`pbcwVAwXxltm!P9Wn59|_ z>haLGe1ZFYn#Xs5$%r-$qk2>^hjbpeRZ-XYNHaN<|3zN20p1LTTI1{c8Xb5w)ZyG* z)><;EmXeC=(PwIa$``+1$?gJlZ2v)nI#&XtrS+&DioP!j-~P%CTcwHJKF>0PlQA=G zB99yH0_(ZZ$6gH6Bdb7WJFkl5Nk-^z=Hd&Y_oET$OuxuT#l3vqK)-I&pvgYvDD4{) z&BX~54;}z!`0gfE=qW>Me3*u?b&NIuTnpnm`;KF$)M`joZt7#YMDh_KyS;@{hHbow zW9eh^8wM>AJAi(~>FF5T(ieqSw{$Xt$>TNKUES6O^5A8v=!@*T-#-c2mpRaGS4~IW zD~mN`$Ivi%ig`Tqg6H(<3;LI)=9}O=gmn`VAcJ@z=IQ6fvk)U#r1dBe`>(I`Z1F*+ zKBE{0AajqQNh5$bLKcXq6{Mz-MYY>tLtam2=s6}0mbRDI<}>Q^q&>S20RSb!1X&hJ z(AQmkVTAMsn)glFC0)tvy($4bCpG5GoIAx#9Yg2Nts#%2=MD|nrJ4P7c#TVg;Lwn5 z{e3H2Hm+NgfQdV;*+D&!6eIfT)yZXEc>L|c4Lh+b;qDNBM6cIWWv;R3{WZ9r^b1tG zj0Zl}vXL;Oai%_EI<5VzIZjtd^^KpO8Uh9AFlg9?SGZ7vESVwX#>#61Hip#jp0GYg zPF;DNGkYiSp=TAUko>TIh$!sHy)MQA2`b>TZ@^$fl63}*`2$pvo*E!I&_x2( z44a97gWmX>7&(rgqbe+VA&SCk4JQ3dJ}60cQ(rOEN&7e%4f@hAE$#CTOC)i@l>-n9 z)irLR0r}TMJipc*e>0U`?Hh&1O8$VwTht#TjfO_a>dtWTF&0c1s1#F= zH`j@rRWl7`|7{ZjBemay^y0p0ka&ph&$N6&_p2+%6_x1^3ApI`&--QH8_%LH$>P8T zmBWtPUt4SuL3=xH;#vGud}pi5JeClU@!G54DHd~mKzO@=;))+DD98kzb;xv0fJxNj zYmY~DdFjZTap@t|PyhrtUU%eR-Tw#3-7XRvG{ok`aB}kJQS~3Xy&xsDM_?yFu--SY z{*Ei0LmiZ~qI*`e&uX{^<8iZ>Sp{7B`wAn=ZzXZxI7`0phx=bZ21z^xaWo{6Xg5|2 zXph}e#4be{@v$u3*8&D`U`-ve^19=fw2YiPSBXP$BoN4A&#c3;XS*HuZ?2kOmb|B; zutE}gNhMN!pM)n2Rwa?~0O%Lb2LSlvebXuxLv8(vDOZC>1o{3X@e7!JN_veH66dJR z;{EPC5S?d}kB^6VJ32enDlx`$!B%EZQR=2Hm-=nGf|_awNfKkq1PAk1nR>ekND*LC z4*Qlse$CufC<4ion*kLJi-C~m!$x{PcY>lacXIXPb|kLq+A){1qEMEi3JGsg+IwA#rr9;?JkyJJpt_|AcC%~wA zo!52~(Vq#j5|ay}u6`_lMXAsxuqw~_{xSr2wa!hx^$)`&`E>bEb9+UOA)bKDrAD)s z!&Aw)ZK|aFeRt!C^_WsASub3Dc>82_NNAM?Q0S7g9=0f_D<=1D6J@pbU{&)^PnC2B zyTTM`b#~N>deJ9qIN{sjN{{RdmcIKX^T z-D!to?jQ0R0S%k*nNT-8L53~Sgm(B3pgeb$2;|^x&Xl1J{K)-2g+b`(83>K2q!%ZH z)T|5( zX*_cCaau3uY=gA#s+}^89RUDoiFK87EPLar^5Zi+y`|z6+yBwpHwB3rG+DOo+qP}n zw!3fJxNY0EZQHhO-nMNU)4wJrb~g5D^W}?*`W~xJW#&1VnN}xnLy0hZm%jti73y`( zoZXp>PNa>fQQe_H5VpZL0fXqvrr{B+H-T^v|B-+)v-9;z%y&}q$;>_#-=hL#8eTTz zCKwhPiae^Zu4rLlB~ew?MB3cEn7;PEmmYH_1r$H5RPf`q<}^ODvHk!2Wqu^QzW0V= zkNF$?{f?02eO(e;vSUf>mDv0Z*E4kmIM_A+!zhM_w2*YjcO25Xb zDTDh%@RwF;^T0fh9tJ&m==*GL@q@`wmKV{fs*DDD@*8*1*taLwA2}S>BH>9+JLaw!;Uz-ErC|z#cS|IyIGh&gH}}% zvLV)#Im8~jU3-arSIZtfnOm|Hyp>ceuR(3=!J5O2tGw}i44sKa))8Dq27~*dL5W|m zc%BE7JU?i+9$X8HCjd<*WYkn_-OwuX40picPzd-0Xyq?l&bJP%L+xoNBeCY>M68)_ zoUn;yRwp}pDK{4Oe&z!d9yuq^Jj#i5@+c5%bzvcvtdd!Fo$s*pJ zyc;k!vYso?vzJ%jZu=fZq##9bCIiu7w%d&RVuB_?nZXyH8-*o4s|Pb?Be*XB$yPLZ z9oZYexE+A$dKlDKO^P5)SD`DvcO76OvT1ys_5-)>DGN5+$C@Qv!W7?-uX4YuBC%yTr@6Xe}WhmNWOZ zPYyw`o345^;Rrax`p8Gzd0lH%a_<24l!Zb*Ho*jyKUqCf$|=3}Lc{=+i|DW=+g-W)%5&W{eb||nyGpdoY!&8TAK7wgWxLJmEK|*2&E6hf<}+TSzOn-C z{qyDGxW?Lyfc{Rz-W1t_-N}Xgaa4%)&R`Rrz~oR^6Z8U88cQmfy=6eLOXjdq5b)tU zZ&@>hh~YXm97*Zq1`G?FqQ{^Tq;xryP(PVh)m!*?S~;{(SYo1^y~ZrxyL)5{PX^x( zLa`1M!AUO>_=HXv6X}$OA#}2A|8ck;q*j5UVGu17nlP*0z-3i+FCs7C-BFq13HaUu z=JZfpbo#xTLk&IvyE)pv8uxk@9{4jlF=2dHJ@Cm6Ziyi-N2JPIJ7ZY9gI4({>&>7wnSP|YtMe)Zt;$y1@YHZ4)B{#D}cGZVV z;@m?>)C0`8w(lta!EBYmDLf?wn@P_eVnu%cg$=VZ--4aqohMw=n^ObPqcXSBCl=KE z*~0DNz{@G3E|WTz0xTY{h5c_!5Iz#b6)0^`HDiGL-v*=O)f5{Fx6;Y5?wakd!aSYVlk53L{Ovn!Kde2ezV6=`KkIjz*F6ineQ<}P z&8qk2psp_6U`|#Is~aCeyDL8EiemZwvBTw|^s7WRhR8j0dz zrv|R5RT)kAaxO0!d^f2sU|^&Ao=&@98{nUYd|MT-|LokA8#}YhK z@GT+-|F}G#50K;2$wO`pF3JKAVY+pGyg)b=2a?^%^eNE4$qnH#3eeud$#vqPPtcWBI2yYDVPjBWBtenAIH+s)a#+ zFT0s`D#a#9Pr-zNk?%Cw?T9Y08<#dW4;hd=tBf=lINQGllQQ5dpb`U9BlDT#wB&KJh@1<>( z$WF(GeiS1Ei9_=IHO#sZ&ipQu!Mkkj>P{Z83f8(h&t1h3pvSqtPcN>#v7#6X@7wWcmY!aG zNke4;6amDwm0n`-@N_S}hpn?~w4vM2v%r~<$Db$n-jX=ha1EZdUjpp^xv&@HzEBke zNzXrv$|uvIIrdbcV-6c4$9AnLu!p}zsO_cH0|4N-e~FEJgFO$N6byJ=c*5z9l@+a0 zM51dQoeBm|s;1uCO>)@s+cgUuE3iZci#jlLB$BAp z2(FG$08CzQIti0Y$$fT!3jkdDQe}dI;yIV}H}yet}t7e@bm zKMI^~suY!}34Sx^VD_hps%3)mO!FBMIgDYR?g)&6TOp7BaUK9r?OLj9y7=UFh6{DzpiVk z-wVuf#5agyPK|{Z**)7Pm65ymn2ih$pJM8hMs2MjF|85>p9EToNATR+YLHx6hA3Oo zR$LZkrJ;#7%hU!R;KG%|K10LBl+L#QOz~kelAleYPQSfrWrQ@<+C+(O<%q#%u@hOB zl>wu_r%AVfYtyYBz&BznwGO4jDjxtCs|`{$`q4fF2#rV$%fL-&yIqb|Or4Z0l|d46xAu~ioC8JVMZQn~Q3Kg?7c)|`B{~k$Z>DfuLxuXBOCvGe zv7Duf@;k0V>uUW*7^uI&)E|u^F@02>SP&iXoT*W$hJOJ$`cW!eK^Y5)1O_j$Q2k+O zDkU-d%4MV@Di{A?$5aT|E9jd_U^v3@HaCFb;hdxMsAU;mzx&;oWdl`YtYt|^&GDoh zg#Sbg+UKBB7Y&hOOV%YvJm}j>t4(oKRCllU@)TZRHUYT(wMI-Ukf2a`3!43Biom)x z>uiEbR|#h052FYx7XQ;OP&54XH$$!0N{Vdrqv|92Inw<8wc4ky>(Zw_qlH(6qu_GQ zVA2RyC6ZE>op}fu3G`1j*hyCVl3xvgC3=Z_lQTqD-?M z%F3wHSvYHWfD^+K6E)A@^G1es>v~O&X$Kjf=qPS3xHw3EFvE9O=>iW~I^)B1gpEV= ze&9Mdm$`RbTjdr*>M~Pr(`C}PaJlU**(+CEeyz zs5Cp4R_p@tJ|a!z(*MUTN|pxqx}fANhoGrWWhKN*6|+kL*a0=$WI0&H zjt+E<#~>SK3Jt;}a7X7%-(qjLlcO532zxKj%ds*YFKC`q!QU@nqs~-xn?gg!_`LFR zhh{?Gcw3pSiFjajR_(4Q0Xt_Q8q2|Wh=<*sr}0T+cKn2B20Ao#!-)<1QesJ|W3hI{ya4EA?~y1B82|$g_aZPY&YAn(EdW$fg+FRH&^T z-KV3!YT9Chx$refUm|-TK1#dcjILn)Y|Iw%(4TYw5i{OX1SgSD*7ihdRyn+blH#&z z>@OxI58{j~D@>gwV0k*KvwvIDw%4v8P@^umBW9*mv~#fMA>2{qaR z!fCf&8>P(H2c9%m{}*FO*6CjI>R;eH>k5U>4Rl+r{oxa^x=Ij`iitQ^1-Upu=9JlA z3_Jh;;L!$u^Ac;_L`>mBVM&xQ&g7;i;dQRdijn|oGN}mr|5kDt<-n{W9^n>l4=x`S z8yL`#`iq`qs z!nF=!P1PIddZZzRkDzK z=-UAjN0n${6Tn95ds@hUe4-%P4vMT3&abvRa%$ueovQE)pAw+rnJJZ^g*$|*u$CK! z%M1V4h9Ko-bizh*;U3WTKl7TGU3y)fRa9k0?-H1LJo`Jd$JyYF+ zbb-1@i<45qs$mPasdL-&XUB4d13Vj{HJ~@rh0G*;zf}@^PJ;PsIcBEwjgSG=NezCD zBK}9hOD=J*i9NFaMs|Z@4Ow2xX>*H*&r(NALN-T1CX3Aete_5aykK!FFDx#-+-qAri4^irxLvTdE`m~(=ZRwsF zv=n){QWuh%cjPF})Sw(AndwkSqD+!3QY=$0SD`{+booj+0Bay6G(}_zO&gTnBena* z9+oM5Ri@>~IA&KAmAx4amdUg#!Xlsg<%fDK z|J`m(jrSg`M636-0&jEm=zEO15w<`=>0Q@vx`52G-ylc_L$YRtkIB~$$9imgmm)1u z&A4e=)yMF{Uk}Q&HhQHDH-e6t4Hr%VdY#8b$2b-$0bK1#ct#iT;S_#qws1+K#O7Xw zB;hd~uedyT08^`65|`k3L1@+GSu3cWSF+Sd66e8kEz<&(VMbNL7~2>LL8PKj(l*;_ zGyby*08V&Z+AElnt=MEt;GaSGXmo1q8;|-I0ir{K0drc~1Lv2qOojQ!=R2za+%wAoTlk6>Xl0lW&(8?=B?yTVXE_*86 z(|;~=Ai-c!n=69T4)NwNzwPqcQ@9DVKJn(TXeVi_7ctAzfZA1f;+Ig8ul zX2YPTD~xy=NPKJh1OTR`Lou*`Vjbqeq>_UQ0w*^|I_mW{UmkDW5fnCm6!x<%f%)xp4H#mt;ZEF@u#_Bp|<6zhy%h_|NVo1|v1LZSi=>xKI;J(oI!AZ#>LpfP~GDJreTWk@_Ba7;l~mkU2Ke zl<~wJUUkh(69$Tg!m#G~mW@jVmI*WC6dv_ViT%<9B?RlTw(t4oZ}Q~M@@V}srm^RX zGfsWn0EFnFY!tkWEn0TIsN-S$Yu+Tq2hB9yZ}#8QkO=8qrBcvH{)i=*oMIG1sx=&< zkUPX1-uh4rR{%sG@;j?-Ec>Xu2IIEU{TTAR2LU=m@Hq(Ok*)3M98{UoY?wXJ2JG3T?_#XxMu2# zOEKX{CiC*?*u;Q5L+oy;`VNBcB&IK((e}FF25u-1r6`>@CkJYPn9wP z8>Kd#4wP27jluTmL=Uc%q4}N1 zSl`6ExK8iUZk;blP+hyMxF-0a>cDlU5|(QV74H$k5I6x7Y=T*ep$ZoQJ->VSbTX>3 z&uZ?l{{YG)Hg25|DQpFSl_9tcbMA^m^pp1%i$a7Cp<`;#C*z2eTk}oQkhQk~G}4Md z?EO1+FB49MiL^dy9ZBe6Q}Y%`vuQAOzp&v6UYQpH`;tBw-Dd3pjjmTW<4Jng$NLYU zWCWoNt`_{Z2cbWJsn1x2>^m7EoL^W@?Sq#m(Yr*WhkQcV&e zuoEUOT{L6?OU8mZ>^DMlUgLU+48}Kmjcr3;Ub53N)M$L-l&m6;Olzn)-s6-Y&ca$Y z$36cYj?!;h4LtaiA1-5=h45^OGqelfXjRC;R6Bz$l0jX?g7{K;m3MVQ+Pp1-*^Sfy zw&Jj-QlR#W9Y|0eXL#tUDGOf;{x6){KahV1h8FCmkmYrALA+OQAioV6Roz6Q+< z0k(xmTXnOvx+6rL8|!p5&Mcm&L+zI;%5u~ot7!kLY8kl!PnHK>;iB#KeFWhwC`yJn z@f2EE9TYuh6Rz2S5KBu_CD{l4wTDT53Q*Jw3(|DM4_B*Ogq6F0s)rN32YCU+t9M6n za++uJVq*=GZNz$SvM(yt2z%KwrSJm%1S%cs895>ilmNa^W84dma7mKka*F#L@z#PN zyNQ0-v6Y<&@+&HSGs!UP7>_fSHcgN2IcbKDcZjuqpu_KjJcl8Wla={nQ`bn&FJ4;| zyPFm4Tn3^o78EIb!uwnB*n1OKR+@nmsku*sGB_OVC)$*9Yw=QjM7<~GM!8%vb99h; zOsu01f~N^Q?jcSt!aWa+gpLyF{76B8@1Bo6D$Ar!#NDN&J03%}iHf41WdV0i)CeSz z7Y+xaT`9{fH?c-JjlC8J2mB#T`SrHA=Q86d-DP)*1VNMh$k!uu6nqnJii?FHe!Z1_ zEbs`2-)4Hxv&(Qm+-&K{8)B$xBjKvw6mIFmnqjtD)zI_+AWQKnf=Q1@>-d}hD5))I z=LtbI!Q&$JevT_Ji2XTe9F;yREy3r7x3~FIigW)|xy&7^;ku`aQxkd5DtjxSMm!w=(MtAz#0^ehvzPLz%l7*uLEo$6DhZ)zo&cBG- zdqA1feNy0=7#2H=;bDxVkk)Q){wiKC=nFGCz^E9<^|Hw5T$v=5jv~NJ4wlG0>%3_s zCPsAQp!A(rH|vwHx$;2-0~GJ@xU`{cgNL!Yo}G{)4ltp`}j)Swn5=8Ie`$BSdmYv zvFk#&u6s+dCRFW8)C;SDA#{Yzj=BGEo8w!YEagSCvPs46h5pc??6;NjyiAiiO(Lq0J@v3dhvn6GVXKeB4`DZEmv*+7n*Q)2 z{;g{c!jT*n@29Z#OYEs;VUKQfcw}a-;r8H5G%tkyPV_B5)8+^TywK@CZ0R&Dbf?YZ zAAEBzK+v)>1lc& z)-*bzjXV~;NQc!u2SqNMNbDWNZ={o+Cic4i$P_fX{GuEUIEifLXB9WFpmneN9GK&| zz+&_?@_^hE?u8<=Ak^|qg<_IRx&L_OKm+sqJ&*P)d`Pu*2uKD!RYIfjpf`YWUe{~B$`BI<}8@rYVkWm&V zP5zxg5Ng?$VJ=Dl^}rXylO1ZC39!nTa(P*&`)`6NY=3TtH%e{Fa3@1R-}_}527TjM zRS1Nx#paB6Do+$fQ`fMcf04&^0))GOj7LjG> zRN9>}Y*YgSLQD8HY@|btMQX^F?O14?WN13IZ6Z{@pFDhiJ3khWd*gKrgak8xw+=TQ zyoCzm#V{OI*D(!@O=TFju`(Yz#%VIXY`0RWIaOahW!cQ7v3N?4SnMLQHw2i;m1YY> zH@{bWPf@LgLnBCzN*Y{LT!b>F-TaR(!~j74H>{wxMsyutF6v=k%hbcKu!!EFJ;J*A zbaR*r_rmXO*Ym{4(7?(fZ-k%!y@PfVag)^_q{vt43jja!Qfce%V?IC1!GrUpns6>Q z(V+M)!@3XeHi^;XhDsF29;QmF3Ub1019;4q_w>pRk6D+r%j*id(9$m$b(G_RR&d}< zBjK`jJz>dL4@G(pf>k2;Ku`4EHkw#3P`n=lwX{l0VocWkYM@;@EtUh=t`;nwPu8Cm zj{gEN3;3|)ABlgFXpaM&uQ~1{EKS~Ub%WuTn{QZH3cBa0X}P9NAkFdGo34Zw3SGC= zvgB^iqnojnaFZ+waF_ylrsIxC?r6vQFtqQUbi`txU$R%ase{ys>4EjqK!gZ6h(u3@ zQ3i$3v{fyj_T5B~W4O{Y6+U6%k>q)?qE&oI7p7w6;Z)uvyM0uy+ffa+91b(5+>at~ zF9^vksiHQ^3+W0;+jNJ?51SutjArBMFvabK=! z%Q#q|QDWxaBDEs*%-oGqPdS(cq6vnFYGx%9TMO&;E++pqZyHL7t|{UWum+{)2*eA8in? zuG)d5-FV5@k7ji=&pX8;~-lsmv0XyW$h07x?75gKg0l{vGN?)vP0U)7scrqWz2O(RVz%& zSZT|IkcP7}VxBM(2`jJwWFTKhQk^#{irG&99Ll1Y6jA8iA$gT#D9LWO!S>Bj960Jw zHOy5$Cnlx;RiF4Z3(vrhjVmCwp{4}omKq0YGxJAH*>hym$&0uIA*#8Sm`xsXHnaM5 z(;9LZdBAD|W`NM$6kHqxJWm(=5YDrW9L%hgr4jEv|0FrT5~7qi7`w0FaSB~*zBP^sQg`#gp-%$fY^i~> z3MwNtumc;-ou;8Ru;vS>%F_*Kz_qI=LAZj!8!hRVQFBD%4u(L6rphFYqIM$TtnqO8 zgyX3xhP%ttkn%?3G?gf1z(?&2o$<=FvUJ{)FFFfo-ad3;N>PuEc`ne95i%FijE7B< z?@q{@@C1nN7xbVjkn;lY+s0eqv*kB>DrAf^1+GfeAOGdq{;%xM%1pm63NH@6$|_D2 zks{<-CqDwMojIC6e=7jZ0bE~L8i<1xAd#lm^sqRA#Ad{3pQkeMN?%AW0P&|1oLP^% zM?Ph38!gc#f@$TbDqdG}TgNo4;TdRv!p%YPLD}h7OFjfeU``S#%ipIG!}HNVkmPum zu?5_QqY4#;HDo=f);Z!!yxTw6ij$Zfa_7VXEo{R;d$9=ulxM>)$Z+~;{q($Bzbn^% zBeZhp0_)HRRWR?c`32{{k+fXI;{j zfTk+F$tD;1Jw=+B9KHMNtcr;g4OtFZ=*p`~YCw#R&y!g)mbiVYPAI^0!jQoaDMV=Q z!v3v0O7!e})y|l-U|Xb^r)p^^QA8et^Al`w9s$TbcjuYW9zJ!56#AOTl@$MNy6@YW z@Kj*7p(CdwBoKP@L86CnDp(FPVjanXfP zjs09&6;3?-M%0vVmw2^Y`qrpw-I#w;AwXG)y`XF}f?%LV!G6Z#2cM8^=FJ+29MgcJ$}f?2_shHZw5A~7N5-keT&G&lLL ze9s&F4v;2YFjjiWSgMzWV7|0%ctEqs^E*!<|3;C$i-UQ5f+DhD^ka+C`}?#J;MDN#G2eDyMM7wUWTkp`0skUu z!$IND3~FS34@o0eg9^Lj_m%8@zkjpmRYv#3R*O_w6BWV?zI-U>OdVpqin8#6{*_>e z%>uCB^d9c&{S7I<%reQqANngu6a>wD+7eMUG@E~{r?OjAMa?-b-Q_>{jHY^LynA~D zZ!^W*r5RMJ6_~V0>om9!Y2tun9j@<&TrD}Mo09YJ61^bFdU8vh&d7u+PD`?d(Nd9w@PxU)OLH1+PFLW^5otThezwWr1qkn*rqpuT+ zi1Z9Krp@R2t?1mM0x20!$FdbGZmYSOE*8{Eh3%3#TAk-lo?Ibq>F}V3tio$m4!oUg z`}HSyvAFk@r@~h+Nbd2y9bKy&nMeLIOqPJPP~@dH4>dst3j}zInfY;PX};`1?Byzh zTBw2LxOeT%Y7@9_n1Z@j?n*)bn66SD-S5z66rA;zb@wh0)+t;8hd?(XfrQZe#WVSQhLVEO9iJsPHHG`xRT0rZbWX< zEbYP7X;*3WnP_}UD1xxP+mhQ0`)*bWHGhVmH_Z3znlW)IL~l#x5nFe^fn9-C@$V3dH?fJn>`EDfflE|HLQb%5yznOA zx;;eNZO+`B7-|5AB@qYm;WObCCJHkjA?cdN({TqSmH=&!(cq}VzSfTS> z>)oYR!(aFH?x+F0Yvf)iRVIdju>GwSgztX=3|lSH*o{e%)SUV zs9fWpGaC@HDOVjSC8>W5HndH6z~g$zaKGy4wmXMqMJi#?@BdAS{pheHYH=yTIp# zvb~j)Tx}#eGpe?6k8Slb%~N#me|Ky32^*q1bmcxGJ0$K!=OS=TafE5;kc>RtjZ;Cx z!dwWea?gll2-SLg%^n$}K~RlYWfv)WP_QCZNI_!VXj$CjvVd!yMO!S+hDTY!O2LRr3!r#@=-m(*G|5A~i7 zeV}aFEC`aOlueRdH*Q7v!hM!%LNsUj?`P8y3Q<;m)z;U^pkp8Xd7(|qEedPPo%NQa*& zE75Ko*HCrNz)hUoiT$-P(GYq^JW(~~J;QZ^Ql}ErvKIq_je|M7!|p^B7GCRY6W>EO zIlNF)gC2aZ%l$>Q($8oCl~bD!4vE8T&K~(U{&JCi8@z+r08)8d&gz-Cfe#@l5LoH! zgkP*8s2|!KR-ob1UrHmB$~gjTc-~M}DxgnM3gHUKfA;h4w0bl+JMK)8j-fd4>ylbi z;c8}{I&kfY?Uhn{FbL!Vn%h0EAPQZS3)Sk^y1XF|lhK4?K~Y_{Z~M4Ce^+3z@G+;3wTv$r zeHH#2mbI}DRH~jh(}ju;9;1+0%sDqI1C!lNME@JpH&Pk7t5t!i z_LTxW#AqQ#y}d0T1sFC5x72o9TS`w^W+h-K?183Yt0l4Ew=$-hsJ!apbzlzlwc@2f zB;>x=Nfi5_r0o|YI^6yH!grZ(Kp0i}KU@&oy=&}?+9b_FTEJ0u`z{qY`uXOkuDZ}1 zEOl%1#LH3qT%_wJMR13{3viXiGRQ=$d-ph?(7|rAdLVB-gYhqLE?1=l( zy3ckNK88Z%G~HT3XuljWLP0KjL@qVT^nOk%ARhd0O~G&$t$G0BzyZy6lSG}CSNf{K zY;X%=NMRdQecCXA!U0>xP)M-Lay%;t&_LRaI%xQ>wgCKLkaiNV1lZnjd}6HTQm;mQ zRD=$DlW#ksx)-V`O)PT2e1KupSUwH4rqCd6K zbxcG}Z4m^r!Zzy~wV0J8kI3b$ZB0YdBI4++igjW>+C&`#LTu=>K^5%S$%Wsg_|H*v Pb#s6E{(Z^*KYsoTn_;fC literal 0 HcmV?d00001