From 9761f752e827e4ca972c777a483a2c0849abab2a Mon Sep 17 00:00:00 2001 From: Kalyanasundaram Somasundaram Date: Mon, 9 Nov 2020 18:30:04 +0550 Subject: [PATCH] Deployed f078658 with MkDocs version: 1.0.4 --- 404.html | 29 ++ big_data/architecture/index.html | 29 ++ big_data/evolution/index.html | 29 ++ big_data/intro/index.html | 29 ++ big_data/overview/index.html | 29 ++ big_data/tasks/index.html | 29 ++ big_data/usage/index.html | 29 ++ git/branches/index.html | 29 ++ git/git-basics/index.html | 29 ++ git/github-hooks/index.html | 31 +- index.html | 31 +- linux_networking/dns/index.html | 422 ++++++++++++++++++ linux_networking/http/index.html | 427 +++++++++++++++++++ linux_networking/images/arp.gif | Bin 0 -> 859682 bytes linux_networking/images/closed.png | Bin 0 -> 18898 bytes linux_networking/images/established.png | Bin 0 -> 11999 bytes linux_networking/images/pcap.png | Bin 0 -> 404662 bytes linux_networking/intro/index.html | 325 ++++++++++++++ linux_networking/ipr/index.html | 348 +++++++++++++++ linux_networking/tcp/index.html | 337 +++++++++++++++ linux_networking/udp/index.html | 321 ++++++++++++++ python_web/intro/index.html | 31 +- python_web/python-concepts/index.html | 29 ++ python_web/python-web-flask/index.html | 29 ++ python_web/sre-conclusion/index.html | 29 ++ python_web/url-shorten-app/index.html | 29 ++ search/search_index.json | 2 +- security/fundamentals/index.html | 29 ++ security/intro/index.html | 37 +- security/network_security/index.html | 29 ++ security/threats_attacks_defences/index.html | 29 ++ security/writing_secure_code/index.html | 29 ++ sitemap.xml | 30 ++ sitemap.xml.gz | Bin 210 -> 213 bytes systems_design/availability/index.html | 29 ++ systems_design/conclusion/index.html | 29 ++ systems_design/fault-tolerance/index.html | 29 ++ systems_design/intro/index.html | 29 ++ systems_design/scalability/index.html | 29 ++ 39 files changed, 2974 insertions(+), 6 deletions(-) create mode 100644 linux_networking/dns/index.html create mode 100644 linux_networking/http/index.html create mode 100644 linux_networking/images/arp.gif create mode 100644 linux_networking/images/closed.png create mode 100644 linux_networking/images/established.png create mode 100644 linux_networking/images/pcap.png create mode 100644 linux_networking/intro/index.html create mode 100644 linux_networking/ipr/index.html create mode 100644 linux_networking/tcp/index.html create mode 100644 linux_networking/udp/index.html diff --git a/404.html b/404.html index b06b650..e25e08a 100644 --- a/404.html +++ b/404.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/architecture/index.html b/big_data/architecture/index.html index e0f4765..01fe721 100644 --- a/big_data/architecture/index.html +++ b/big_data/architecture/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/evolution/index.html b/big_data/evolution/index.html index 8fed653..4fa5737 100644 --- a/big_data/evolution/index.html +++ b/big_data/evolution/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/intro/index.html b/big_data/intro/index.html index 1f75afa..395b8a3 100644 --- a/big_data/intro/index.html +++ b/big_data/intro/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/overview/index.html b/big_data/overview/index.html index aa42919..2df0992 100644 --- a/big_data/overview/index.html +++ b/big_data/overview/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/tasks/index.html b/big_data/tasks/index.html index 872894c..c9c6413 100644 --- a/big_data/tasks/index.html +++ b/big_data/tasks/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/big_data/usage/index.html b/big_data/usage/index.html index f1bac32..88755c7 100644 --- a/big_data/usage/index.html +++ b/big_data/usage/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/git/branches/index.html b/git/branches/index.html index d8efcfe..bbe3c46 100644 --- a/git/branches/index.html +++ b/git/branches/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/git/git-basics/index.html b/git/git-basics/index.html index 4ebd90b..550dc09 100644 --- a/git/git-basics/index.html +++ b/git/git-basics/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/git/github-hooks/index.html b/git/github-hooks/index.html index 4e5da3f..c63502f 100644 --- a/git/github-hooks/index.html +++ b/git/github-hooks/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • @@ -184,7 +213,7 @@
  • -
    • diff --git a/index.html b/index.html index 296c37d..85200ef 100644 --- a/index.html +++ b/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • @@ -283,5 +312,5 @@ diff --git a/linux_networking/dns/index.html b/linux_networking/dns/index.html new file mode 100644 index 0000000..d8951fe --- /dev/null +++ b/linux_networking/dns/index.html @@ -0,0 +1,422 @@ + + + + + + + + + + + DNS - school_of_sre + + + + + + + + + + + + + + + + + +
    +
    +
    + +

    DNS

    +

    Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this

    +
    ip, err = getIPAddress(domainName)
+if err:
+  print(“unknown Host Exception while trying to resolve:%s”.format(domainName))
+
    + +

    Now let’s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName

    +
    def getIPAddress(domainName):
+    resp, fail = lookupCache(domainName)
+    If not fail:
+       return resp
+    else:
+       resp, err = gethostbyname(domainName)
+       if err:
+         return null, err
+       else:
+          return resp
+
    + +

    Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line

    +
    hosts:      files dns
+
    + +

    This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts.

    +

    The file /etc/hosts is of format

    +

    IPAddress FQDN [FQDN].*

    +
    127.0.0.1 localhost.localdomain localhost
+::1 localhost.localdomain localhost
+
    + +

    If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file

    +
    127.0.0.1 test.linkedin.com
+
    + +

    And then do ping test.linkedin.com

    +
    ping test.linkedin.com -n
+
    + +
    PING test.linkedin.com (127.0.0.1) 56(84) bytes of data.
+64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms
+64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms
+64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms
+
+
    + +

    As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. +Dig is a userspace DNS system which creates and sends requests to DNS resolvers and prints the response it receives to the console.

    +
    #run this command in one shell to capture all DNS requests
+sudo tcpdump -s 0 -A -i any port 53
+#make a dig request from another shell
+dig linkedin.com
+
    + +
    13:19:54.432507 IP 172.19.209.122.56497 > 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41)
+....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........
+13:19:54.485131 IP 172.23.195.101.53 > 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57)
+....E..U..@.|.  ....e...z.5...A...............linkedin.com..............3..l.
+
+..)........
+
    + +

    The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10

    +

    Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks “linkedin.com” to “.”, “com.” and “linkedin.com.” and starts DNS resolution from “.”. The “.” is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for "com.". The address of the authoritative nameserver of “com.” is returned. Now the DNS resolution service contacts the authoritative nameserver for “com.” to fetch the authoritative nameserver for “linkedin.com”. Once an authoritative nameserver of “linkedin.com” is known, the resolver contacts Linkedin’s nameserver to provide the IP address of “linkedin.com”. This whole process can be visualized by running

    +
    dig +trace linkedin.com
+
    + +
    linkedin.com.       3600    IN  A   108.174.10.10
+
    + +

    This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. +The 4th field says the type of DNS response/request. Some of the various DNS query types are +A, AAAA, NS, TXT, PTR, MX and CNAME. +- A record returns IPV4 address of the domain name +- AAAA record returns the IPV6 address of the domain Name +- NS record returns the authoritative nameserver for the domain name +- CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com’s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. +- For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here.

    +
    dig A linkedin.com +short
+108.174.10.10
+
+
+dig AAAA linkedin.com +short
+2620:109:c002::6cae:a0a
+
+
+dig NS linkedin.com +short
+dns3.p09.nsone.net.
+dns4.p09.nsone.net.
+dns2.p09.nsone.net.
+ns4.p43.dynect.net.
+ns1.p43.dynect.net.
+ns2.p43.dynect.net.
+ns3.p43.dynect.net.
+dns1.p09.nsone.net.
+
+dig www.linkedin.com CNAME +short
+2-01-2c3e-005a.cdx.cedexis.net.
+
    + +

    Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs.

    +

    Applications in SRE role

    +

    This section covers some of the common solutions SRE can derive from DNS +1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn’t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. +2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery(example) +3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. +4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. +5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. +6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. +7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.

    +
    + + + + + + + + + + diff --git a/linux_networking/http/index.html b/linux_networking/http/index.html new file mode 100644 index 0000000..9163381 --- /dev/null +++ b/linux_networking/http/index.html @@ -0,0 +1,427 @@ + + + + + + + + + + + HTTP - school_of_sre + + + + + + + + + + + + + + + + + +
    +
    +
    + +

    HTTP

    +

    Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. +Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT)

    +
    # Eg run the following in your container and have a look at the headers 
+curl linkedin.com -v
+
    + +
    * Connected to linkedin.com (108.174.10.10) port 80 (#0)
+> GET / HTTP/1.1
+> Host: linkedin.com
+> User-Agent: curl/7.64.1
+> Accept: */*
+> 
+< HTTP/1.1 301 Moved Permanently
+< Date: Mon, 09 Nov 2020 10:39:43 GMT
+< X-Li-Pop: prod-esv5
+< X-LI-Proto: http/1.1
+< Location: https://www.linkedin.com/
+< Content-Length: 0
+< 
+* Connection #0 to host linkedin.com left intact
+* Closing connection 0
+
    + +

    Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message. Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors.

    +

    We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1.

    +
    #On the terminal type
+telnet  www.linkedin.com 80
+#Copy and paste the following with an empty new line at last in the telnet STDIN
+GET / HTTP/1.1
+HOST:linkedin.com
+USER-AGENT: curl
+
+
    + +

    This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course.

    +

    HTTP is called stateless protocol. This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE. A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here. Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin’s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated.

    +

    HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric.

    +
    #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date
+curl https://www.linkedin.com -v 
+
    + +
    * Connected to www.linkedin.com (13.107.42.14) port 443 (#0)
+* ALPN, offering h2
+* ALPN, offering http/1.1
+* successfully set certificate verify locations:
+*   CAfile: /etc/ssl/cert.pem
+  CApath: none
+* TLSv1.2 (OUT), TLS handshake, Client hello (1):
+} [230 bytes data]
+* TLSv1.2 (IN), TLS handshake, Server hello (2):
+{ [90 bytes data]
+* TLSv1.2 (IN), TLS handshake, Certificate (11):
+{ [3171 bytes data]
+* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
+{ [365 bytes data]
+* TLSv1.2 (IN), TLS handshake, Server finished (14):
+{ [4 bytes data]
+* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
+} [102 bytes data]
+* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
+} [1 bytes data]
+* TLSv1.2 (OUT), TLS handshake, Finished (20):
+} [16 bytes data]
+* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
+{ [1 bytes data]
+* TLSv1.2 (IN), TLS handshake, Finished (20):
+{ [16 bytes data]
+* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
+* ALPN, server accepted to use h2
+* Server certificate:
+*  subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com
+*  start date: Oct  2 00:00:00 2020 GMT
+*  expire date: Apr  2 12:00:00 2021 GMT
+*  subjectAltName: host "www.linkedin.com" matched cert's "www.linkedin.com"
+*  issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA
+*  SSL certificate verify ok.
+* Using HTTP2, server supports multi-use
+* Connection state changed (HTTP/2 confirmed)
+* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
+* Using Stream ID: 1 (easy handle 0x7fb055808200)
+* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
+  0 82117    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+* Connection #0 to host www.linkedin.com left intact
+HTTP/2 200 
+cache-control: no-cache, no-store
+pragma: no-cache
+content-length: 82117
+content-type: text/html; charset=utf-8
+expires: Thu, 01 Jan 1970 00:00:00 GMT
+set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure
+set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure
+set-cookie: bcookie="v=2&70bd59e3-5a51-406c-8e0d-dd70befa8890"; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None
+set-cookie: bscookie="v=1&202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J"; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None
+set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None
+set-cookie: lidc="b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R"; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
+x-fs-txn-id: 2b8d5409ba70
+x-fs-uuid: 61bbf94956d14516302567fc882b0000
+expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
+x-xss-protection: 1; mode=block
+content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g
+content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
+x-frame-options: sameorigin
+x-content-type-options: nosniff
+strict-transport-security: max-age=2592000
+x-li-fabric: prod-lva1
+x-li-pop: afd-prod-lva1
+x-li-proto: http/2
+x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA==
+x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z
+date: Mon, 09 Nov 2020 10:50:10 GMT
+
+* Closing connection 0
+
    + +

    Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.

    +
    + + + + + + + + + + diff --git a/linux_networking/images/arp.gif b/linux_networking/images/arp.gif new file mode 100644 index 0000000000000000000000000000000000000000..3395030f785c69f36a2d1072000a98db73e730d0 GIT binary patch literal 859682 zcmW)mbyO72*Tz?A1O!2(b4ls$l2{NBfu%zM0dWcGMv%^>yL)L^Qo0-IrKP(Y7WVzV zzyIdUnVILFd+wb3%;$`fvZ9FSR{(Af#w{%`0000203ZMW0sue(05|}E005Bxn*{;^ zARqt&1VDiRI1qpU0+9b(3IqW_AOHjefPw&U5C8!JApf@?2myc~00;yCg#h3X00II) z{_jvA6aaz(AW#4l3V=fa2q*ygKP4a>0D=P`Z~znzfWrX@H~{%Sc_0D+LI5BL02Bd$ zBLD~l0QtX|fJguc34kC0P$U431R#(A1_Hn!02l%QLjhno0E_^DkpM6N2nGVd zARrh51Ve#fI1r2gf{{Ql00ahtz#tG90s=!pU^obj0D+MpFaQDuLckyh7yR0-L!n?e6pVm^kx(!I4hF)(AUGHT2SedtI2??CgOPAB009Of zz#s$|f&fDiU^oJdK!A}5FaQY#BEcXe7=i>tkzhCyj6i~sNH72Z0|H;v0 z0EPg-kN_9}2m=CPARr6^gh7EYI1q*a!jM2100aYqU?30-0)jz7FgOT?0Kt$T7ytqT zLSP^W3<7~cAuu=uhJe735EuXo143aSC=3FHL7^}>6o!DpkWd%^4gm zI2?w6!;o+o009FcU?2nxf`CC0FgOB+K){d)7ytGV015&?K>;W@0EGackN^|_hynspARr0?L_vWlI1q&ZqL4ro0E7a9P#_Qr0zyGS zC^!g(0HKf|6aaz(LQo(G3IahvAt*Qmg@B-t5EKB40zy$BC<+2aL7^x(6or7IkWdr= zjsn6_AUFyFM?v8zI2?t5qmXbE0D%G`P#^>ffi9bwZZcs+LDi@`jjO9-LYUehQquv z11Fw&C{4uvz`J?6a3Vq4@Fg`nyks;(A|6w6F`iYcP~BEeklp3`Yze5svTrfrK&Q$$ z+Xmn3?U8nk(L|EM57+X=D#&JK=Bs3`g%D(6rI$1uP1Vb--o#i^%gH?E zebL8qLL44Hw+BNxt@@W!E-WW9X@3y-kY8C$W_(IkwDp7^Oq82fW#Oj_?JqXjANsZ} z)t}CE7^1N(4(rHmqQ}0I9+&XA+#b*WkX_mO;B+`uqt!7k>2-U&+VdMlTh)eiyWE(J zm!6RFdAvT^?8&ZbfA)I3IG^sAkoH48J!4@1`}OelF5CYl1L&VW9y8)!0D&U*dLXXO zT~5#&Gthbvl_g?5m?ju|BXpQa+eo~BAz&knt+K={f~S^sGlIXx+B{NV$K5zrN_5KJ-gCx$zL4Vc9P9KzgwnQ z6nR*tT341@raRQK?WQ}me7DMQ-tn-?bU!Jz%Kml1wwL|;!DEw|nHjd1hh85K&4)@Y zsuV=2+k7ufFi87e5N+mJT9oa`zF(B%xyV*h9By+^lA9FHURK(If*q8V&8Zw#)a|ez zRu}b-{`8I_mNsfp7&F@jh+wCgy3BaG9;^B3^5l+UJSE0j$Vv#4d7jl^3AJW zjtT8XUXF|1j$TekVc}o>m3yalHL1uFbv30TJa#p$&Y~6^R-@>3Cy5hc8A-v+Xgc`eD^No<)k6^ z$hwOOr}Z`843-|h+ltdAVB887_Z8hvH*9a(P4ip5-^)v;dDxGQkM`UtO<#RDNEsM! zJ}jT-65p%ZwR=3OzN~yahM`U#Pnw8nThHNW*~qiuTNCfgZs`f+)s(KE#MPjkQ zw0mSe&0&g?)X90Y-w`9-6KGJDLK7N_SHSR!O(9J1A|l$`9LRYy$gb{amI&Wq!tfYU zm%E5hLN8=iNFCBN8BIu#C}h_fQcR~EnF``%sH*|~ek~ox z8kRB$FOWRW)9{j>We=~vbF%%e`*CR=HRsyUFve-;_I_!#=%%p(!wwSkYH4G2uCYt) z#3AvA(F%iG^Iuyo`!Fw~1F`v*>2G!}^lNG{rz58K5A*G)75iV;AO9gKQrfZlxdYyn|HHg}*GWj~5csNm zDK2`ZfULbbm~(VJ-mHmvU9paZ@t^H=S(l?$Vy6oeKK=YTSe$!u zsD;1&4f!O4odf7(mE#qlm$Gj(sN{t?rYfr8MX$&9<-OAWW@26!3riko#2d_%NY%sC z#tyhVQ-4)Of04FQJ2Y5&m}?rZuXGzbl(!{MFUYwNX=_zCyL~_msyEaoj~!W_*7ZxS z^1?k-kG~rlE+V2E8p`m^*x>FeGT0=Aykd5C_K%CZ;|*0Ow<;K97$!PndTdH9`(PuaN)Hm72PU$IpVqmsbgOXL^`u&b@Ud{^57HcL`QH zL|bKS&^5Xb@=E=TP0!e(L2-)?E4BYja$DY}mG&4>QxE5a$iZ>xd&bICzh!DI>`V$w zGB*%He(z=Mk-un3!pUW}T-bd+*e{dyIKyU8cuK>`8M!OzBEp6|?vpC{1`yi$7l{g!t?l zc6iPYJm1tc`kefj@LI@Uy@g>(?KVOK(cy^CnxM`+YG#ZL%C&o2MItsJ6rD|gR$=H< zH!1Eea#K95?@gyK>SbJ~wV^=AL(mU}o5q-ZS8vnk=}!UZWJ1pSA=!PKEbWDH9muuK zRn#9A?-s0I=w#j~t6wkNf5BOPwH5zD3;l)B^os!T3rEkN=u~1Z-J%&A?)A6BELoTev2S}i|zfExce% z>K+FDfjaKb1jR(LgfQ$i~uAHq7#ePJ-O`1bL4HmDB|BZKvC5g6^Uq&3jf5R^pEo zLg9Jb?m1kLu2XThOMHN{eyWpEn1S%^4?{9F{pQ3Z$8W^+NyyEFG zY3jY{m@m-d<2Ey-L-&HOi% zNskio-wey#P|n)>p0(zYb)cU`my&gw>Qz(pO-MKUgIhN0!&d^KFE}?}-rQtA>}S6i z&c7bR zWSfoeb^X%_#lOcTvSLkBPYxoN#iV3Uo78ruQ%U+Ml0)>6^G2oM zt!DvAc!6q5fjVxkvQ2^JL5{XT0hpptcdBO&Lqw5%Yoh3#X|FkLNfzK`GI^f zB}V*a47){ddzJL}W@#)JX^2Lj)gp!>(KL=)jJ=fN$54iJx)*2*mVGY(o5c(jze;5O zd)fhh6%Qmc^s+G~G?a+OdB@l=#tQjz96$}oV;6;svmY4db&HBTi!8!nmT9o^7FeaH z##IB62t}C)%xK)TtSPOmrKPO3<&(5nz*3+y&Lk#_n4sZ8Vn1fmx8@)t#iZ`=M91$g z2H%r94P3$*lB*KG87c?6mnQZtmi?os+z_kWGN`QDHrq=RJ4mZMYNwF0sr$hO!H${oL-oYVZEMsy>3~( z{>OTw$9faW2E+Fa#^Me9?m_OLU|sSUA&LXRK$zb1htqX9+cu#V>DD_)co+(lp!n~NfbOxPZCSRi-*Pv33?bL zHHZ`9@CYUvKt`&$7sEbGkF=e`X^2d^*vrxv|U`k zed9;_+N=1zSM6I~?I-E&f;b)P?>mk^b{v+q)8EJ6<#&`Tq*(U5y0f@Duynd8b-qBl zVNIcM^=B~ zTPmasx<}G9pW_LY-11~ty5&R4A=Zx1?^A+@dVVeRh*R~-Nc2h@5vu-ygS>lHGI~{8 zd)1eFHITiURDIg2@Cq59L7c?C+v*6NnkMq^m4<|yEHCC8OZVLB`rQ7Yv6UpY^xe+) zl@9qXG(sz6GEUs8R`k5_ocg{a`|qu42t|DxzE}U&>I;_W3-ulhM`a8~whl%w4?@c; z)xGR5*&IbYiTu2VYKH?-%Nx@phcc*!b0mhdjfQ>S4;LK`6?hMql@FJe50xW_v#3Vk zN5l1aBMliNO|2t!`Ly@EX9AmSp zW0|U>6Ogfm(cfvvu}Zx0zZ~Q9%cINQw9Z)rm`qv0J0@ zi`I#o(TTgGiHGHhmroOD)PK?ONAeDvaaWr0s9Rng|HaSztM?{c-4S~H81Yt6gr&Q6 z=kf0w{7Jf}NrvM|AoZk@Tv=u0R1>6non|C0A)Nab1?9RLp)^ znf*F8Ywm$UY9Qsw=TUqTEfCxelxn%`?S>Nv)o6$ zJZQT-B)L5Lv^>1BOeC>FcC*)U#Rwq0GNUfpe5 z-EUg~7nSV4TRW3ngUYQ1d9PgxAm-uYK3wn5jkZP2N2(E4sLm~5~|Z!l+VaI|l5 z(QI-`ZStsZa{F%bnQV$hZwh5?O0;iE(QHXdZON!_Nk4CBXR2+rZZ(Zwx>zHio`EDCzZ5y?3o2+hsdEPdo*|Ct?u{7DS_T90`+JUt1*sbn3JnuNt>^e*B zx|-~|`|f&X?RvNG`mXN&YTuzZp89P!6>PE>ijtZNsoV=w--~?Si>BF+;M$KOC}JPm z7R}sGYv0dU-Oqa7&!IWUlR7v}Fbh%@Db89esjMtjUn@Hisi<75q7khzIV|@*td2f} zS02`_9>SgvD+!KjxsDpL4*S~=2Tl&V+K+n1kNTpI{#G81NgYpc9nY#CwMHKgRUS`{ zAJ1hSj}x5CaGlK4oGjU$tVExz`JQZ!pKPz5>=T?G(wv@}oNoD^oajAQzolV+bE;QggAoxqAZr!@Ub zZF)|RI%k|XXL@}>Q*{CCxM1PFU_)Inqi8P$PA>%4E<|E3ggP!oUtda8T}nz{N}pcJ zPF%?NUCGB>$(dg9*YDZ$dHM{f2^(eBe2GuMA)-Ow^&68|$h(OruO}G$J)e;^FQa1U zI~JRxrgKK6FdDUR33APE$_bphn$ANPOrTW3uj4?EX=b%dNss4I9OtdS3F5zLm?)-M zrt&_hmYR%(OH%6CE<_oE>OCpnoftK{?620R zzdJQ)^SOV%rX)N2(iMb5E0jTYZq^q?F6~N1eqk|`$Y$D*L4IjDmMQ9YLq&0AJz1!n zEtE-dZ8KY;-{DG4d1J$7jZ%2-$uzvRTW#|}VbU1gIc)Sr(JEyb-8=4#WlD$87(X~4 z%vP8VWEnrYo~*R_VbPi(-7mJsvX!z;o;+`kS2{vyO`p9Vu8-FSvQ1IG&liRZwOBGQ z(13)U&jj*3vKa3ys%5cg19{|dSPH7;UUB#Ge83mps{Zg=8l6|3h#Fq}*2}ksMS96!Qt^)ptU;znMHY;-)cAJc(`pjywwWmq|F*N%r>EX4Em?XD@U*75 zBv@PVGqvE1wyEvxjGn$R7_4bkKMOYcT9G(!=(QrK_a)@1Ue7p8a!yY_)>ud1AaksK z!J;^^VbQ9zZEn%JZrjz+-ltD!k;#eiTj$$XKnHo3`EQNJZfilpCLX(mjV4~FeZru zHCy0JJ?(N{t1O#Es6oyvGIb2}$Fn%&Ky?1``E?-)Nz~8yT&=}w4h~_oqtQA6O5Bm}3@GMLr~E=DoV+-i3cDhV z%X`?BFox<^b4L{Mm1rU0pL|{oDXD=&eP-Lz;%BS58$?fA+wIDCl=1EI&tysW4G-bf z+x0|l-}|j>H>ro6VkMJ@gHo*3hohQzS&y5I9a7$B1E(g)iy_pr_w}?@w#VgC$g0=v zWVYYa!}|Q{^W9nptv14s9wXeBJ}9+*ofB`wa8+}T3WLJR27d^mU`kx(f1JK(a(1CbvTgM0xb|PEXUluUNS@7Y zn$~mXriA1fNGC&;@ia7u$!KOaU zX#yzM8!FQU0rwUpja5G#qf|YyJL^#P*^;BxoR3D=xMG&g~vHk%yN8d1} z-IaZBrn6D#)-o7k8Uds;IZLq&Z`Vj0-%Xb1GKzoO=Li+mdsC@Ka-6Q9ZpVc7w&T^kVK5l`mf^`!(gqpO;gZnhwM*-_ZaXxJ6W! zGxlkZ0}@XBiv8fqJn!E*P~==R*;j$$tE0~ZFaC-wLp}>zRGaTJ2x}vU?ES99%bqWE zb)E|oE3A!wpqAO^o5p7=UHZ!OFBj+9y1`X`+wZ?TQRsCO%vIaGdN*-97T`lQnIgoOuR*w*97Q{fgf_hwc? zU8J9sURH;Teqpc+DqF$Fnhq6t_41u?dr-yxU|-|nT~wO!>?VmlYfs0R?e|}gSg-Z5 z)r8(uSmR_+=-9q^w`<~*k`nRNf%u)k4}&q%HzaHTlm5QnbMx)DefGZBe@vfm<~tZv zN(3;d8Zj&Rh5gVhHO4>!qUJ+V10FAbhC&8#W8DSHR zV!msKKyh6;Ox?Ovk^-x+x*siVOaRAI)$g88`LjT5UKzgx2M6IU#^wJ^xKx5UAqw@! zf?0TB=u@y`LZQU=ljYRUXmQS2i9M~dr{9G}>cz>nR9_c8^^+KTEA0N1uVYCIr}yC1 zxhWI9!ws(N`zn>j-Y64Hl{G%t)Ri%LQDl6usM9VqN~vAEuuW8FOH8tr9%CyT?oU@a z+Npe%!cs1)pt&%ejpvscT@@o(c8&^u+07F^tj+InOl zo7ed+_avw@5!g@Zp16(yN*%>cuh5V1X~A6U#tkdiRUtk{-=w`3=V@$NfsNCx&FOL`D9J*;Q_r8A znd);xix)&QS8o$Pxv%yn-A!)YJCtS4oZ^n&zf4cVsJ~wx7OeL7H>n&|()FPwAa(>_ z+Wpio?y@(CTJX5EyZcUgw@TF}EM4$iXxriUe7lB1VRZsXI*|@6-xr%PZR)8#1iF5t zQiO@IK?4nJ;;|w-i4S8_&A8Zd*bl@rndpnn!WrZA>BAXP4Tjrjel|1Gcd7lO>R{|5 z(uDg}V~{zLkKkT2B|dPW_wX9^p!gs?0(d>b0zIM$ zJ!0}7#9BXyYxhWO^+;azh#Y;8LH4kh!YDrHyzk*J-U?zal;x3=hSyp#ejiSjx0t?>}r z7I3eVQOkP@d|@DvWvE@JQ?iwpTV;(!X++baMW3@P`Lhk2Pf5GsCA8G!+a>h-Yz_Ec z4fvrC{(^Huwj>8?h%<)!}T&a3R%jzV>i&fl8_KFpa2ur9pfA)^O$3a25JUHOWYg5kb?E z3L0<(u02w3G1A~X(&*hryaj417-@lz{OKKOo%yIFHvhBbX1}btC4g43tq=6}@fu*1UP}9IR z{)1`rnS-H)A+csA_!!h?(Gyk(-gy7O&fSW*AKc&Btg{%zDz)i(<@<+cC>xC(zXK^ zpT@+2P5Zt%Hw8t89z#%Rtk7(HY<{=m_}9;_u8R_@wE)2zB6~J;@tS(c3)ds8P)MvI|LX7kjX)nr# zKDUvlcG;RyW_*@Qd80!X30`&QHcL#OWRxgv$>;bAwv?NQpOT=FU<-nka{RdwBUGyAzdkHXzQMvK-0Uko(-SRRYsm49H!ZkCl16ndl3o~8> zG_$2x)b`0alD(7od@2WwE$qu!r;MK!zzfg+=2>lZsaJO1uq>lZb{+NYCH)aahGln& z8~b9%WXFX#wK-#^S+CH)zrC!55+DBakF$#v+l!TN1%dTyTE;LO!$J_S@he^px$06> zqAcqeBbO$>IXp)nS;!*UXjaF8!2RZO`Do3c0 zPF#iiG;TJ3L$V1#Pq)PQNAbB{Ga;vsKj>$kz<*Ir5qDGC8clF;F9j&=^ z6u2xOoXB>&_1CW3`aiUgEfZnG3>?2stU9zv+lX=-uUvuGuD`9_NK$Tkt5bRWQS2ci zFkm6^=XsQ*u<$Z8eq?=hS-<-vc$-0N_9*zSyWd}?;mbC@i&F$Cu$$0phTTFlx~&0M z4EFAYI7G0DA{U+)&OUjadM}Z{x<&M(yCXCR@m2~EV*B;2?^n`(-QSt(!HHk}qt>Y^ zzrI`jN_MhNS@f0a`71T)1_QwcBSGP5AwsAIv4Z%rp+KLcBC9qVwJ^NGP6BT-t`vr? ztPyf86iV#%88~f9CE0Wom&u_>d$=I^^hs&j;ujk?Z~hFjt+f1^A=hSN(_^l6T9dlj zl*ZhWseA`i7^%(_|NC1sr%fCC)uO)BH1msY8|!=?&h?+aAwgDSMDXu`YKQrN75cl-to_wvYfBpQnJMGp*f?+n?G7$~eP zONrw06va0;VHTuvk_&H@%&&~;wzoYScD?#{y-%Vwqf8r8iKV;M`&NiLe26mI)H_!2 zf40T;-K(2i8$k$oTN5==BuC9c{+eBrI-!^pVKjW^5TS6#3?*CEhdzA@IcsuwK7N7` zi#$8Qlt82%dnQGG$wn{hecewFEvG-~z@4v*4PO~{zSG|9XA#)YJ@3;i9^{f9)7No+Z0v}KOD=FDZB_?U8ZBgV8SFxopdQ4XlvuvFargiXV(bDF4 zaG!T|(893ZmJN1{>OHR+ipcL&+;mQpz-gKklCdpt076Ddy=Jsf8&iNiM&->XKrc@@f782*ZHUa%$7n=yX$t{CaL6HS9PN zFFI9raIqZpob_?b-E3`7>s;szP3a6>c&a`YR8ui*Rm6l}dq8h_R+x0~D&_#M(E&f? z0RQ%k0PDQ$*@5WwPgwsMk?>Cfmh-otev)LLy{oeMO*!$C%>kqFoO0ltYW}>2_v35! zEo!U_x_1}!ERJEZA764`0Cg{ztS*>up-ao6?_$o0xqp%sJCZg!zO_GR&vxXTaAfPa z;2gN%!gAtfaYAvuzT{SN;{SBXk18j>)nG}!6fM3KYrMQYvu|D+7T>*;y1kUfa^Auo zrz$;{5x)AMbS1xb?rZrs_?cR1;=|@&tpSxn9gRy~`%6`;OEvCGbyKHL1J3HGtIw}p zG~QimbvSFgIf3W@<0;p=ELTiAYBJ)dhcbgY?(o{VV zQvTU5btqTW{O}xtdqO~J0g8!Q2~@0h1!gwx zkpKKKyNb>J@>!5SZ*r+&E9I-(Rbn()sL^Bm#`pHt56j(~{?vU@@^nv(HbQhRT<})? zgxyyAASDe&7$EEBXn6DTkkm7G^VlMLEF;o>caL=~1uZY;^TeXdSh~&NrRcOCKv&`!2+3Pa2l53pBFR?HauMP}S&J!Qxf5=2@-uSR?#c+i_JMd>Q`qmo4sB zhJQL|wXB(D>G@lxaphm<-?|(R()+p!yN?;t_L)NVHzE=D#4tmFePykS9d)(?Vm+-?__| z#3p>R2-IaaThs=kIIdw%-7Q9}5=v1@l1ZiRyRbUXX5b@a(Z;6NVs!A*m+ai+rw`9a zWp{X<(SadLktfTvE}PG&VHx}F&a9$AlC5FU(~TSIHpK6Q&VD`e@rz~Jj0)Fau+%1n zG#VPVmnH!5V0A|KixU&ejxR+fSJn#!dI5FR*pSA-VPppUJ@_Z>WdVS`@TfK)f>KLU z%wSKhszfppgXrVYWnRV$D?j~U2`cW@0Z32)XNfjsvQQ2GdcSMz^+UO27wcw+E&HIH zFIWq)JGVMw0dc=15$rGYVGVW-we@VdoRQylrz(Eja;>&{-d-FZ-g5uz48S7hg52?J zpnAjK@!K8U@oo*qv1nC7?)i2`(}bN)j_&#Q{^lvgbJ;!!9L&IU>+Fsfc|TS=TG1k} zxf{AnKNKRyeJFngE|PFQ6Zkr~+y53mW@^O$5^q~X=r1GiYPo>3*wT*~b(^Gp>$mV? z(C7V->rF#=gf-pmVgrnXqhfIwMB@E)b!y1(^TeFh3WhH&~KP+mA^?HvP%dAP|eQowT0EJ|b* zdox<}LL@In_C^E%iGQ-((-!jvE6=yfg<3hA3+y6$CH778u)G9ZO=3zH4 zfL)9wFNy+}Ek8kweLvsTlA^RQ-X@%_B-74dzc?@0fE|`mqymFg)IJ;(77e%9l*2s_ zY$}>oaSt<3$U{Fn37c(|$$s#${%eTuUtnCz{Jof7_Dd{WL;H2AK!&m$ksFa7BhjPb z%L*t1msaohvP1|PQ#B5`X1OzAa0fV<1a$NHkFt^`NMJ_GT=Ws#md+zMSJR-{q@Xmg zT4?yvk@I85AA$}c-oCen-n{+fKU#SQsJ)Q9gY*#+d_zp>-h9JsWvzT8D9-tyr78nu zj#wi$&R5mSstZOOAs^NLKqjy_St@GLWUuO6mTnBGjo17!-g=+Sz60wslF!>upc@Et zf5xH*Eq7`U%vVjJoM+%23N9pq9^Qf<6VZj4=>7k6vK{iRdK|V1ulYPa3IFqdB_*;R zMCmKC5%#{l=|?Z0+k7?iLJzl|>WXo>XOj354+xDd11gWkG^x_6Y?bb6yeg&U06y-$ zj*v%;_a&*z?$=8`d19^I#~O8;wHntE$5L>hxQ9f{fxAMY?80v zDRT73Mmx>qQ7u?2NpAd%@j&L&qAd)_2AoIhy?hN;B;j!OdH+K8cTNpMUTlIYmw~2i znyd(R?#l%QS2|f7xGO1XWx}>Gb-2neh|rMg!z)IOT=GVV{Y2D#21a6z5e;XE+>k$E z2tz+*p=XX`1}H$DL*&qCzLO8C#g6AQ?#(Qa&o=g5vo39}m075+bj;Rqnv3T*b>o+X zc7j>OFCU1=oS`@wEk7NJ+?4sEtkC2{xU1q5Un|upo#*sSeNgita8Trd`!>W(9<&|AVq*frG84 z(c&zR*n=JKJ=W|GN$^YB*oe>2huP&Lf?sPCMc1xM@nJ9&eyQW++*NlF*Ruq;604>U zkpJnHZNr5)~qnSfma7ha+nd9A^P|lYNCBOEZzrCG*9&lZ@if~)F64MRG-iI zhEUI7Ct*P~N=KzIDpt~9y+v6P1ZuFxN-+4bI2#OV2zxNqS{WRWJJD(U1uU?~7+P8* z&~56%u%nLsF}O*p+uWvR=afIPyf2sBGE%|iT2;2PYnR+Kx6S3=mcDXE;nuowZ09j~ zxO^Gs*0yh3g6)6|J6#S=hW{ttt{sf&P% zN~Di`980UIo3x!Ln7@1-->IpG=HzVisN1wVvWWx5L@*k59=9RSY}t2&78xPUu}MDN z)GyS|8|_rSNnNJcofvfLc6hi-KcL&DfLZGuMzwX%r$3}DRSV5swqW~D@na=lTm^FL zy;k#x(ep)8Px&^lRrBa)O#ajf4om(|2w%> zo~f*5E}Q=bO9|u=SL`Y9w@k93Sv`6m{nyq4@DkhMh5VBHYECWFSLPS(~ zX#|Y{$Gc#x#fcJM!E$rXL;dNNxdwu@nC*=nu}gy{r-kbT1o->cs+K9IB>s#TTdOZD ze-_*nZ|aiOtiIhYE{sOI*4L;V+ZuW;t^}iQ>U)lDZT$=v|IsuyO;p%9)rl|d+X*)g zQP(kXUd(tiul%~*umZpGT=Q!a>_p=_^Cxcohbi4;!5}dYN-lcK4gB!A<^z2vLJs%m zhgW8xb2(Ij*qQ~uGWx=HwUf(5E)C1*GuISmWH}Xgif?lf5!YqvbnA{#hv+z^u}uqt zlJ__-!oZEO*+0>i`z$OS-BUgJT>f~C_-m=LWhg+aHOyRqP09Qyx^6lTF<(IAyFc zy#5u-Nuoa3ZFJ|fjRofJ91*)$7ZTN=_-UQolb2TZo{=q*v=8nbhF2NMZu`owAEt}j zFJZK8hvqR4v+3bAB+X^cybBfn|-PZWx3B2 z>m992(L||Dj_^$az=H`u?g(9}=Gj(+kOvrLVPN9<&ack&FT_t8xyg;XpYC|(`hE4_ zYgFYk&dKp7LhU_L7w|0tP^1-dG>tklo#X6fydF`4ydX^Iy}f=bPX5pKY)vl*qyImD z5UkYK6^}tc2u#F3PUs^Y93zEhU{lO0eE%p8!B*48ZpWF~hDI|k% zT_}hgme$$FhjtBk#$N@J`P4b57FVm@qu9NYR{N@L5Nj4Rb})Pb^^ zlH=US7)^m0cGw2ivAo;p3QJ-9I2pQ2#`vs8Lal)IB{m7e>^N6YW%_()^4vO==CCu}mwSDU0=wKv1Mw2(oUy>$X2IqE!dgi&>VG5u>ZDk& zR@<7Kwwa%tn@GG|JDEh~pRD9d;I2t@=S$s~pFNpNUNFjR*6JyQr;iMvtLBVci5@ z;d3ILVdD6-ES~b0e2f>P2G74guJ*s`BG$??FI+*_k|UVOL^r+2ys|JL3RnT_6n!&c zwzMp=9G@8 zL>;=q*8kc*ZV`Rbn8w*VTDw;>@=**^eV`*%@D_n2QReli0<-0YrB1Pn35%;`u`6@* zk}VUoBtf@9Bj66tsdk1Nx^1I~<1rdluGpSQg4}R*Picfj& z=e;lZ(>dxOwZhHxeb?fx;y8vDNuY*?CE}biOKipUgf07~H2aw?Cl2$uEACnOql6FC zIPNWPxKdugOkV95=YBO4hb`%*4W8%Om#Kk;>YELa12xuHT3cp!vDk+7vNG$5;Mq)f z3-1IL?0d zhBDSsiFWf0HtftXawT5RTsBo@E^^^IY^XeJ=Q?sUuu3D_3QhR}v|G)fIDsL|Ratub zxy~@F&Iq{AHTB#s<`;)Km)ePD?MzmrPA|G`FZwyJ)vK->IIq~NZgjYB6zy*uxmP@^ z?(9ylgSqcrPw&&X?^L*tSB_(kPD=Doa`wNU&s9CGazF3b3*jF;kYztVa|5ud0k3&p z^dM>*2*@pZ)l9^x$iMUt9H{!-J83iXL-{SzLwT=YVNijcLw<6<>`N z!h@ZBhFw*S-ROXuU5)$4fwKA3SGF2|jfY^jn!tQ_mpSg`DGwo54dH8EqIb(j!ze`} zmYO%*yu`va<<#7-IvlV*)!=CTB+2I?9jGSJ<$Y&bLu$o~7gFWb@6TH;(HPmZAgU{{VHh5`oYiLotbeAL~NrSJkYUyeD7+7ipAZ~td|bP=T&IrTsd)D;_;|4DcwY1K=97JE(_?kwV=k-Z`+dO|!6zVG z$Hwo(r+dl&k)K_uPEed*_*0#b>7|etzmQhlNsS}@JASd^II3(c`~=Tt8@IF@T**%WRA8UirKXwSHdNGig!sX@#)YhC8 zlmrw%3Vb?+e_C=@w}Pvq)hl4Rd?LQq*mVBP?V=fyEIJ^dtyHi5NpP{*DOXca$Ese( z{<>_zN#m!WUP!%Oj9}hrah>hLqQaBZ8WLT#N@?3^oM~PV0?( zu8n>lYsJ@pc`fwyUBmAvXB0()8MlzRa0A^3W5>@KN?-6 zRlYDbdSnZG7Q0!{H3XJ6dUXhU4>X3$Hc*W;`m722QVLss685ul^YglOjSzOny7LQh z^CxcdV-fik)9C-+{WtgBFMbjEBsX8(rXbU%Z-=fv<{}|(O(9P84*Z89F(P5fP1@=8 zzl!htKZ-;sHAR#){bm#i?754qx{Fv6iIQ%L9=VHdyd%|W3d3rKz800LL%F>t7L8+R zjyt?iIlYOK7EMsP|33h{KtsPF?{|#*IF4U=mEU-l=Qxjdxs`7@me)9#kGYtad5>$k znR|J60lAd7xtqT^6KnX9!#SPTxt%v~h$HZw?>V3Mxd5Yhn4dY9e|ee{x}XQTnh!df zA3B*cdZ90Rq9eMYM|z{5GMoE3rf0gQZ?2J_^QM0~sE2xGHu;8&x~ZQ!s$(XVKf0o~ zx}-z;q{lj}&$_Eux~$hatG_y~J36mZdam308(n&;4?D3Jdnd}dryIMnFFUgvT%ONc zvq!tMPy5*cIpHhzd$<2OxNAGDf4jJ2`?h;Kx`%t03p=&9ySu;tyR3CO zyw5wm*L$du`kdRlzVAD~*Vw9;JGp1Oz@NLi6Fk7D`@t9dxFh_)FTBE=yTd2E#80?v zmwLZnJjQ4IVbjJQYrMyQJjfT=vrBHsm%PcJd|_Gp!w0;-G{JkSTd&{LDV553VJJ<_8Oz9)OqH@(w8J<9z1%=i4xPrT04Jl0cv z*7H2qTYb)debrBW*NeT^bMntaJ=&+e+OG_C;c zYrWr({nh_{-vd6_^F7%ge&7>+*eCwrqu$x$J>*Be|lfL2`zUZ$$>NmdWtA6Xhe(78JuHWJ!}JQKnS6l4VPmFJZmR)w-4cYgdorBO4+tok!+(ymX#PVIO#?bfzm>eR4UF(V2?L~XKnn|;P{Rs0 zys*OzISkQ55kVZ$#1c_l5JMF|WRXM{hbxP)83h8&uN!gy%u&Z3dF;{0AAt-~$RUX= z(#Ru`Owuo!0&9{WoRo}G$|rOx$M%*FTo5GBCr^;QOq;ZOjFG@*=*Cz zH{py^&N=C<(;_IH%=1JTQ*>}eKU)O!MM3u@v`+{FMRZU_3uW}sKON;$QbQ+=l+sHr z%@op26XkSKPa6gG(N0PIwA4^f9o5uTQDs%tR$+Zr)=EXCHC0<(#Whx4XT`KuUvC9A zS7CQ0wpUGqMRr(ai)B_u(8e;;&S|Nw*4k^a%~soOx$V~5Z-->E#wG;=*W7c_O;_D@ z*=^U|cj1lKNHUj`R^EH@%~#)j`R&)=e*q2{&T_~9<<($g4`%k*UlmT6;fIrjcv*>? zrFh|pF`hW%iZ{Mkq7_)_rI~Kp>8GKNTI#8(o`^|2$F;ZWt-0>n>#xBMTkNsPev4j( zv@Toiwb^dl?YH5MTkfdwBv@yn?+zMop7-`y@4t%%Jnz5>AKY-h1xLJa#Siy;amO1U zI&sJuublGBC4W5g$c65_@69a-9dpko7u|HyHAkIuXOYebnQp~ocq(g4?lbH zQzw7*@zF0o{qxmtpZ)i@H$VRM=Xbw;_`9b+fBW~xAAJ4)$G-sj?|TK5Uw@8N< ztC+6|XQ?vJf>Xy&T>M5pqXg4wIP0H0Cjp zd9N2143(Wcd zr#VZsO4bN7nf0{iJ@J`OeQqg@82sWs0UA(&4wRq;wM!kzVo-%Hl%WlE=tGSX$aktU zniF+rMKQ|GbY4`W7H#K8HwsdZhLofuHEBlSdD4!el%gwjX-ZkjQJB88r3R9xZRiP6 zo$i#UJ@u(hYgv$6{*i`v*q6R*sa>}_$ITix!qO+kIqKY1Hm;SQI$#pTgb4Z>LCE|dGw%6^hb-}CM?}~S|vu&++%ZuLghL^kPW$$=FR$Jggm%jD2 z?|t#hlEC&Zzy0;^e*ql-;D{*pFv=D1ff1Zw1w)py>NW3!9US5Jx|h7`tuTZqY~l85 z7``2*@P;vbVF`;k!yyLoh)>K!`5Jh^Eq3vXVeC`i=7hyDw(*T|oa1^TSExGn@sEKV zWTo=gwjcH|hmD+MBrn;-M{cr`pUh+wJ9)}buCkO%eB~%_S<79{@|VTCVj+*2%w;w+ z9{0P(Gq0J=ZFaK<2`rWxznRW;w)351*I+QGn8bbN^Pj1_=Ro^;(15nGpbt&xL>n5* zif%Ncxs2#X7n*Nk#`C2yooP+KZN^#K^rt}`YEeIp$G;u*sZpJ3RjW(7l8&^aUkzz5 z!+O@Tc6F^Oz35#3Pg>W#=Jl^*z3X86df33mb!jZUYGp5*+0AxSnqlZ{X-}Kl)s|A6 z88c^VZ=2iQ_V!uyOzT^ZTioTgwYi0TY-5xA-0e;`yWfp&VynB@^``f|;Z57t&GXy+ z_V>R5&XrF4GvEa`_`wk#lu}1K;SG2A!yz7$R?B4x?QL)I z#Iw$HxldjH>vONV-LZakr{jI^bmx2A{T}$c3qJ34C;Y~^?smm5p7HdBw%QvXdC5;c zw>#e*|bB|vL|ir zj~{;VkKd1vA3pifpMLd^(egcC|NG$|e+G7b`}Oz!^6iiR`!|38)$hLk0g(R!(Eqrv z0P{}(5irZZPyQIN0UfYunCnA2A{A6qwoc#kO`-72CvWwt#Aw1sRoVk3&Ai9t0e-(unf)c4Cw>|(Qpmf zunocF1D7xkp^yvbP!6lm4yiB?v5*e$unzsO4*^jRwGa;%#|z!?5D_sEePjm}u@N2d z5p_feA#oBZu@dJ33I9+Kvv3pnP!l_G4+(J)GZ7R=Q4|A_6i?9zgAo`%Q58{f6^T(8i*XoJkr|P(8J95{J*pM| zd$Ag=@ft0H5wUR_xv?83LK3|(9K~@QO|9mjQ5n%O8P)L|*YO$M@fhLJ80FC!E3tAbud*w1 zk}JQ`D}&MrhY~8y@+=pxB++s$*;4XUvMu2*S@ShvQ`+7#HfggqQ;jY`(=GdzRSJH-GMAE6Tfh?Jkj$!jq^W?GeF5RJ^2$r2h=|WR6P-t z3fVJ19rQsT3pycmLMgQJ8l%T5G($Bsvb2*xJ#;}8v_D1EKtq&73p7FhPxL@X6h%Lj z2+ zUbIK0bV`p&LaFphu{58mGfTO&OO2^Rmo!X~)JU7OOv&_2i!@D{6iwGuO~v#{^&?8X zbWZ71j^eXU@ib5WNJsUwPyJMme)LV9bWqLIO~=$w;gnF>R8R}GO&yg{zfw;BbW$mm zgRHbtF*Q@E>O#v=Q$6)lK?qC_^-)I^QV~^APqk4^l~fZ|RZI0%TU9+J6;x@pR)yzI zZ8cYQ6?*t|SAF$Ye<|9qXHj7lRawfL2p)pwOXw;Y%cX$ zwRKxBkW(3sTfsG4)kajIRawh*S)UbI(bZYmHCoeETH*CwVb}FxCANF&RbValV$n#AdW;7#wqrfk zO}6x7MRsJdgYN2*&X%=ap7H!>jZPS)*rB-g$b{?&^Z1Fa4w}NN?^|o*Q)@;0JvHo^&30E$R zmTnO@ZWZ@!mlkdrw{0CaavOJYA(x}>ws0{wbAKXRHMes;H@dtP@;-NTN%ttuR&pyh zb?0_*QFnD8*L7RBZdF%yVVA2ew{&qgcR7M@b+>nYS0#e>cZGL&MdEN-mvU=&b`$q? zX}5WoH+G*Fd7bxozv_00_j<9HbFp`OxmO~@wtK-he3PfdPsTVHsL&6s3o_>9%~V{h1twb+fh_=~T2j<=YO;n-drH7?KrPk{j8p_}Gv!Sx?J2 zlR4R1)3}pC`B&R`k|Vj4N%@p3S&vnDksaBTQ<;@x=8{8smZubuY5A5vm5_0Hmo*iU zTN#yq`IRX-n2Gs~f!Uaa*_DggyJVS{ojF7QH~E>R8BafXnyq&~~d6kD5nU@)s zxmlULd7Q&}n{DbN^Xi(_*-veGo!wbVb@`p;nMZw@oWc2?ySbdTd7r;IpYd6o_4$LF zd7cT{Hlw+q5xPRFIiVRELbJJ_0s5cK*`FyoqAPl$Ejptyni&VWp*`9$+xeqK`aR=$ zq)oa#>p7t9`J(xGr8T;xRXV068m4D@R6F{laoQ{oI;VNMHW#|5ff_a++NC#|rdb-I ziyEno`lXe+sfl`ZZ#t-@8YM$|s;$~FOZuv{S}{|)rk~oWW%{VUdaT2msma=_%X&T0 zS#-C$tsirz-8!z#@~7pxuAOqI(|W1@llrX1I!|K zvt3)WWt+2KJGN=YE z8xe=QzVX`)kGr|cTfO<4z0AIoWn8v!;clgCw#>JiEqA1{KReWzEOO|IdH!{T*EIM#yh;fWBkQ!oW^I| zm_?k$d7SbXyvKoD{<=HJi5&haT*g8C#sNIZah%DQ9Lb?v$rX3Ui@eIs&cv-e%cC-M zcU#N7JpEj}$)jA%rM$+;{LG)c%yWFhf0@d^{LOFf$Kia=HE+o2{LV4&$kp7***wkB zyw3sM%>8`O1Kmj79M2IQ;jlc>8NKaPywM?jF3DHW3!Tp?{nFPQ(=9#IIepV{nRPX&QX2Ub576yT+_##&|!VgW4+RAeb!%{)()N3d0o{Oz1M*q;vPNN ziT&ZiT-H1N){~vqnLXG4Jzd$Kz1dL{)Qi2^y-v=pJ=^_F)wR9bz0K8;J=&ce+R0to zZQa~)J>1Kk6{+3Z-Tmc${oUog*@k`I?VZ_<{oKbL-Isme{axMpUEBfw-*Ii%@BQF! z4BHWY;X#et8UEol4czs8;3b>Mqo;oL8 z<1=31TYlX)p5;5<}f6U>1KIn5y;%h$OZNBIU9_eGA=4HO= z4IJl%KI(I8+zoN{~YS+e(;})>IwhwhYRZwfANKj>+jy|`@ZWX z|MC4E^8Y^aFIw;!fAfK=)YXjhLEpaQKJ-Z+vFu*&F(36WfAuZD^(+7NC!er2zw~K8 zpbWqEaeuEAKlgcGuN+_XT|f2#KlmwM_)~xQVV_NBzxSEHnB2bkq2H)RKl-WPr%oUF zji2?CANaQ)`-}hkx&IlLzxv4^mTtfN(SMkh3pei9s&u0^l)4bFLcMmU-u>%0a9+TJ z1@9$%*l^#%j1xCr>^L&y$piUTMojsiWzCo`EB5>tv}DnlH=FLv`E%;ft4Fskjrz1| z*{o^1wheoB?A^M1*XI4(_ifA0yAhdw=fb?w)!8~45( zymRr`x0~&Le*kN&)R`RwVtw-0}Q{Qdg-*XRGAfA;}6pn&-Wh+u&U9;jf0 z3_eKzUWD&Sh#!RnLO5ZD6>4~)g$8=KAc*%Rgjb0K$%SHyDz3<4i!QzhV~jG+NMnsQ z-iTw4I_}70jZ`57q(TPuNMw;l9*Ja%opj#$XP$xXIcT4N`ibbF ziVB)2ql*&SD5Q@X>S(2sT1x4qnr6yroSyReX`!J;+9{}}ih3%kqfWXirmb%JYN@Es zs%omN+UhEGQbXPyNnQhZjPfc~zR$q;E z)>?0k?7D1n4R+XKk4<*jW}l6A+AL{%P`finbET91oh` ztDOM-mp>Hlk9#acUklx*!Wh1=e>1$_3SEdp7}hX_JG`L|b4WuV+E9i<Q%Y=)s{|mtXK`JR>=z1t%|j*YCS7k(Mms=Hq@zft*c${ zidPES(}a2Lt6%>L*ucInpm{;6U=NGf#42{N^}^#?(+XF&LiVkcovdXai&@EL)~jvh zY-BxK+0B|2w3pSaX-O;E&W?7qs_mIvPsrHV%67K2t!+JBDJ0n1cDKCkt#5z3B%?CK zu)r;@agU4K7rWsFuXeL5 z-f_N`xXNv>d*2J+_|jyrZep)|?~C93>UY0v3SeRR3*Z0?c)|+pXIK)5pFp-7a<01$7$V?uxlaq{OAS-#wQ8x0E7fE6r zYkA9D?y@TBD@HGidCX)ka~27^7yFud&1`P7n|)_sDmNL*bCzc$0-m{Olw+SG|ug&KMm?oi@LG( zWoV-NJm^y+I@PRR^r~Hb=vW6D)v%uRt7(nvTkBfZhPE}YRjrpsk9yd|F1E3u1!hwp zd)drxwzIi}=BQZu+0?GKwXcn$IRCoUx!!iIdkt=2`+D5r=Ju}1E$(uEJKgLyx3{~E zZg;Cz*x0VOz3+|hv``wK)6TcQ{|)ef+oaRV7P!F=j_`!Tgvat$H@qEwZiv4-;_Y5{ z!z=!9j8pvL9Jjc~Gv0BKe|+PKqqo9Oj`EbNydue->&jma^O&DJ+O3qi&2Nr#e``D5 zBcHg>c`ovxlU(ROmpIUej`X5yT3v5H>s;@;*Bwo8 zmw$ciWG}mo86I_`t9|KGUwhM`PV~03-R)_gyWQU|cf8X*?t6E7c&Tpozzcrx`E7ZN z36J>1E8e#>*G#_`5BbPTzNtI!JKX(#_qyvn^L*z#<~I*|&5OSCp(p+5KY#kmtA3e) zpSG{_z>=- z{rT&^{_)>`{`rr8_ve41(t7M?fCq^GfDtr%K9ztC=ztHXJYjcu5J-U)Xn})OYGOBi z0l0w!*nt4(f%f--|3`uX2!bbAf+J{xDJX(1*niDYfEOr(Gf0DB1AaA#gE^>!S#y5j zw}U?jgh41S?uUXaXoM<=gf7T|N*IDK$bwFIgiKh3NeG2hxP(<$QZXomTgZi7=q(F4 zfnF$vV@QU|B7r_whH0pVYp5i_XN668g>eXnb2x=k_=Iv;hghhGczB0&*oS$@hbE|n zY)FWOXoyI1gNLYyi^zyX(u0i%iIFIYF+zlYXo*p{hkl5Of%t}isEM6;iJ-WNpJ<1p z=!vJ;bAvdEtH_G2$Q59ShOQ|8i?c|J1E+hQR*Si)i@TUX83d>2#vz%N2Utj{C@uvlMLkPA7H?I@8DNs$<7k%Fd=2kDU?*@fB&k|RlyWeAQXiIOSFh32@C8F`T} z8IdvRk}}znHK~v`*^nA}lRKG{FgapCQ$;E%ltWpA|45WaiIfjWkV(muO{snf*^@NM zlNC9YIvJHSiIq4>l~<|%l~%cxU+I-$86?@Kflg_bXK8yPiI!{0macb_Z3&lgsdy|| zl|I>(c3GEF$(4DTm3(=ZdI^?zxtD_(m@L?la*3FU`Eo|7n2qU}Ik%LLDVdY0a!^^A zeMy*N37DFRnV0#OoynP>DVlysnwcq>XmyyBshX?VY--7xuL+yh_Li|po3+VobZMHK zd77bFnx5I4yqTMzxtqhOo5d-d#yOhTlbW{4oXu%wjOm=wDV>lOnbT>V*I8zk37oze zoXN?Z-?^RPNu0+?p57^*$oZS&X`W+QEM4~1*383XUpz9g`p#FKF=SiRf%AiZQocjr(5n5Z&DWMf=p~Y357pkEfN?Y3bpAD*@ z2D+dKI-((3peG8VA4;Mk%AzRxcR)Ex94ezTs#x<$qc@79bcLTe%A-A+RQ+k9DVm@v z8l)@gqD6|NM5?4i%A_T_q)vK659*^+N~QTkp;d~dSz1sTs-<1(rS#;XP1>SD3Z-Q_ zrbbGpXPTs9dZbUPrf%A%7$c=$N~d*dN;Ybzd8((Zw4;0Kr+;cnKnka68mDGjsBg-q zgsP}$%BX8#HE|+sh=uBVfv_zI;fZ`rer@u-Nw(t)Uz<|PvthXbmu&S!9 z%B*iE5C9+n&q}Sb`l{Ait%!=P+p4YIDm*aCPRV*y#0mh?>Yn0?u4;p+;`$@yYOc4K zuJLL%otmunK(6j81?MWS`wBLq>aEVot*lCDY4#89TCUR?umJn7vAVF$%CG|Kun`M- zwECy^TCfIdu3^Zp8%s61imcI!vG2;UBg-|xDy$Y;u2PV(`bx4b%QVZHun()S5Nl`A zngI470RYej?a&JCU<;*ltqmKrG@GqN8?zEyv@`2#6ziuJo3FM&3ILD<|Ii9Q>#|qd zvAD(mZySp(toxJsM1NPDzHOSp!6x01!Q6-zq_VXJd1x!vNi=}HwnYqgWBxpa%F z(nhjjWDjw>xufeYFuS;?JGg}lVV!%pc&oUn`?`sXxT@>Avnxf7OS-wMyJ@nnyX(8Z z8!c$NuaOJ9#cL*YE4#I;ysgW;sGGda3%j-}z02#owCkj}YrNU3y-ZTM+v~mGTO}q7 zzT->2P-42#OTFj|z0X^{v1`5UJH6}szUm9VsR*vxSHAhHze>`(`|H2|dn3XNzynPG zz%7Ej^UJ>UtH24&zzFQX?hC>3Tfg!f!Rds(1&qNNtQFm>!5!?uVbryuc5v!YACqES$bB9K$foX!pyqB#gs3oD}`5!#(W7Lm|LFEW|^c69c}DLlhYOv6b`AQw!;SB%9Q!NFO~#a&DiA?(FrEXE&U!c)w|QQX97jK*sW z#cfQ*X8go&EXDO<#ba#8T+G9FtjBx2LGXIRd<@8ZY{Y8p#%El}acszPOvsAN#*BQ( zaLmGW9LSR_!dpzqm(0arjLDmv$)=V^hz!b*JjaWi$fX?0quj`*EXt%Tppwl0$*;V> zc?`?5+`~ak%ePFzgPh8z%*w00%f9@`s2t3_EX|9n23^hitj!F4&kbGA`5e*w4AK2O(GIO$ z|D4bpeXHoq(I0)a>}D(%t@qR}L6(|bD5H?7kr z%es!Y(?1>33ysn&4bv1o(?(s?7#-6@z0^mo)GAZcKrPi&>d{ke)tf5+(pRn3m1@#5 zozz3^)L{M9UftAV&D2O;*4!M`Tg}!Qn$v9!*Is(iaZT4>TE=D_)?|&=d;QdXE!Jtx z*MA+@rM%X4ZP@Wy)rYOvJ(|^v?btWk)o1P3dOg{aE!dTv*OpD$m(AJfS=f&a+O_%C zp-tKlI@hI*+7Wu!fQ{LB?b@u}*_tienN8cTJ=o)H!y22~yRDyz&D+2Io{bIM!#$mm zUE8p|*~vZIw%yvuz1+@y+_z1CpH1A=ZI+{L-Pz5Wr>))H{hF&S-OL@^(cRqP4c+3c z+~hsp=zV0=?cMKPlD-Y!^R1Y|P2cw&m&VQB>Yd*E?ce7O;N~s=;N?x=>up)?jo%5* zkJzo?4UUxD?cfofl;B<9{T<*H{@ep@;2Lh>9G>AA4pRs&;Uiv+@=f9=PLlSG;w$cv z`hDRW4&wjq;r#vKFmB@=9^)@QHzLmBJwAyH?&Co&ju0;7MLv!ce&aQc<4I2AO)ld( zKI2c$SN^a&(Ugl^{=4%e+Z9e5NnA^k~ z=5v0CKu+g(4v9pL=X)NBNWSEMe&$pj=xHwKYVPKMZs?uO<9yEO7P#e&4(V+8<&jS5 zCh3dCl<0_F=$lUHozCWO{^^?T={dgWm2T?lXXmG`>N}|a=d14OKj`O!9_q4w=(G;% zwVvs=F6y&Bzoq`_zs`G)4(!8jfs;<`$F7u@uItO5>&?#Ty#DOC9__bI?KJD_$d2uc zm+INh?c~?$-45>M7wgVG>ebHd)4uD{Uhe5`?&L0&*B{ z?$EyO=l<{R-tPn7?&uEie+cjTuJACo?F;YliTCXfFY$9J)a-8Y2T$-9FYpB)@CLu} z8c&J|Kk*|UaP&^{CqH)hj`Azdb^Olp{tojQkMS=r^B+I+Am8z9*^`nAM-TN^f>S$}XUuk~FIa4rw^O@H%a zZ}Vj@^--_%X#e!=L-k(o_HXv{Z!h=MHuQ6E_tkdvX)pF>ulHf^_hf(edms3J4=ine z_lLh_SdaLNPi$Pz_>UiIU=R3xKly9V_m)5Sm9O@jFZh~b_>d3!C>HmjPx@fj(_~xv zsqbugkNK2;`J7Mqng9Bo-}rqh$&dWY zZ~L@=`^N8SWU1T3PyK5)`qhv9E>`#1&;2mQ`p>WY&42vjuldez{^Jk+>z@1F&;GI1 z`|S_^{OQNjAOH2Q{mKsg`5*r2PyYH35dQ@K{`)o1U_pZd5hh%CFrmVS1S2*aND<;g zixM$T(XKUH_Nv;paNn|> z8~2~RmkSZ%jo8=kU%-I{4<=mL@L|M>6)$Go*zse?ktI*2T-owv%$YTB=G@uyXV9TV zk0xE(^l8+oRj+2<+VyMLv1QMuUEB6;+_`n{=I!?v-@Czq1Mgkj_;KXPl`m)B-1&3p z(WOtPUfue2?Af(%=ic4>ckrg|>77XbJp6g|>D8}i-`@Ru`0?e>r(fUxef;_L@4r5L zAn>dLJj*Tu>oQO)xe%mF!2%gPP(ZgFln}xMDO}LP1~GhazzrkRa6%42^f1H^OC<5c z5mT%X#T8Y&ki{2W%n-&IW$ds;9AnI}#vO0e@kbtk^f5>xhcr^e9+4DM$s(CN(nK4b zloHA$sa(>^Cb4{y#x0}Na!M}2^fJsZ%Ovy6G1IJaD!$0O$UOeylygox>$LMuJoD6Z zPd@wf^G`qn6|}P7gi8o7I0sd9QAQhe^ifD7m2^@{E4B1eOdlODutYQU^ixnn6?Ifn zOEvXWR8v)T)!GpK?^QLgM03smShJi})>^xybyr+@wKZ2Uebu#BVt*Aj*kXq@Hd$ns zbyitun~l~?V5vRUT4u3*R$6Ygo%Yskz3mpuGDTyxXC_FQq>W%pfmvxRrvc*C7n zUKiVpX)jj$_4i+Z0~UB-f(thIV1yGU)IV1R>QrHfBbIn#iYvDGVvIA^cw@;nHR@rG zLl${tl1n!EWRz1@dFA5#bJ*T`%cXZ_d})T+W|?c&`R1K-=J{uzgGLwUp?fYG=%a;p zH|C_9UYh8qjgA`Wsg=H$>Z`40x@xDh?s{vlxfVNYvcWbR>ax+sO5eO*X8CQn^^WJW{@0R(o@) z)9(E2&pF2$^wCAv+VrncADi^kLwCLO*IS2ucG+uBJ@(sa&)xRbRrg%?-f<5e_}_Ui zes|=DH=gz6&te-VelM4Pdg`mU{(9`Q*B-V)U(S4c@WU5>eDcdT|NOrf=c#e@+jswc z_~Vy{sGW;0VLo64JbSTBCvo8JRtEF=)eXpFM|7hWMKS2eQ)D9+*XTwy#<7iBlp`GHIFl2$WQa@TV;}waM?eNrkaOyup)@y0 zL?%*^i)3UY9eEt}mFJO@q+}&6c}YxWvM~3f;~mLZ$4=T&l%XVL7(IDLP?~a-sx0Lv zPx;1HqVkogbmb~*8B18QQkS>fr7UgfOI*@YYCXIPaWF}LY%XA?P&2vL$MpK&8 zq-Hg(3AiBkWsle7W;eb0O>l;DR86emEY11LT=G(#!0cr@*||=4##5N`JZCWL+0J?9 z^Pce3Cp!E8X-|Ld^PK~wXFv@KP}mVuBij^bLmm21h(=VR@+qXN4mnYbW>ljaAKEGwRGkmD8$QG`qfEhGa@1dYgx^DRQ}k;)u@8qD`4wN*uM_euzAg(LZhcv z$VOJOlcj9sDrzVvR#vl{ZD~z=TGU!xIJuZeLLIT2Di7s9j}FTH z+wG26A2M3*hF84fC2x5{!`9>?*R{tLZhG6hUiY$BzVW3meC_*NfP^q`#azJ z5?8+h4zNv@YhCjuSiuWsaDy3hS#mm9!V{)&g%cdwgMin<8|H9_JzUn+0{FiJ&ToPF zOW+Zk*uN-dafws>;ufFS#W7y-jBPAq9M?F69^Y8UTh8*1N$h1Tf0@f-?(&$!d}bJHxy)-ObDPoJV>hS& z8IMn0XqD}JXFTUQi4ZO)koEj$KnGgT)WdK^{5)txCtA^q&RdA%4Cgni`O%V&G??XV z=1a4=(wK&HrYCLbPKTP(p5C;kNuB8*Gg{TFW_7FWc4Y6lTGq3sb*(Y>o#?hs|cD?C+?_fh4+xxb6zNw9GXZJhc0N1y`3r_HV z`#alE+jhJi{&0v#JU6h$ti&yTag1mDycvPA#y$RVkcS*Gz#h25`Hk>}mt5ul2RFIF z6Tb47vmE9rmwC-&esh}R{NybkOT$I}bD#&^?jAj*U3Kis&~CaK973a-Trn!QyiLbr+eM)o@87X z{qB3`d*3Haat`o?+QVM>!5iM}iZ6TP1s{0CL!R-EKm6nu$acSHUh|v3F439G zdC-Sm^qpOLAxD3D)TbV;Q%`*BCGYym!+!CycYNey|9aftUiY)lJ@0p4d&>u3YM57j z@r{4{k;)yx$Y*}@oiEP3fByN?r+)R73HaYr-uK%FKJB&N{oaE=`?lx*{`bvKe({$d z{pT0HY>97u_{U%ViuC;Q=YN0v=l_VMZ@T{d|9=1+AJz*$_Vd2=JHYlEzXVjj1x!B& zEIBoJ3cQ#aC2CTD(PA%tc$& z#WlOcQ~X6>3`X0iLt!jNV?0LK*h3~nMrLeAXA}%Uq(okn#$BvNNSwuK#71kR#%q*C zZ>+^`1V?Th$DVUTK72-WOh6d`O9$NK;fsio8gS+{9=!NRC9vfc(gVR7jBo z$dDw-jvPsXG)a#v$&`dChRjHqj7cYKN13cin}ou7yh)w^+{qTiN0v-Tl|)IPY{{W4 zN{~FspiD}lJj#_s%BB3tVKT>MD$Pr97~~O%Cdw? zv~)_NOiQv<%C%HWvvkY2M8uZ_OS`3{K)K&RHW&*Gx{@yiM7J&DnfT z=ZwzgoKD+(P3mOM>b#cRG*0g9PAcO}?+j1zytB~%98dE+&n7cX=)6wr%+BR(Pwb3O z_?%DWTu=A3Px-7*x|B-v>`(t3GT;190Ub~W8%_c}Py{6}>4BfizOi&N~P|pHS5FJqxEv@n_Q4~#4%~H<{y-*8%Pz`<24V6$DjnNi` zQ5U_@8MV=z>QEK^Q6P<~01Z+iEz+toP$NxJB{iu9l~E_v(I=hID6P>Pl~O3ZQY+0; zD#cMQ{Usk=QZNluZW2*3EmJcErxQI>HC@wcVo@#S(JkH4Dvi@Ag;P77(>v|bI>l2y zRn9MEQ$P(=`eT?r6I4SzR4a26(Lz*4ZPZ8qYEmqv(@4!zIn~oi?bAxl)IGJ-H^tOV zEz3W3R8bw(7$Q?rJylfQp)^fZR&CW6a#Km|R8EamTBX!az12&dRa?zfP32WwB|`pm zRbd@g6&g}vJyv8TA0$myW^GpNfmB)T)oA_ITJ=<4z1C^P)@s#NYt2?~-M3J6R&gCy zz%f;FJy&!soK;O%c5T;2D^%&*R%w-2YTeauwO4x8R(##pZq3(w?biefS9cv)g3TCX zEm(w2Sdv**g>6`ey|tplAAp@$ZmrmPkNwx0^;ew#omr2iS)Sclp9NWq9a)$iTA~${gDqO5O{TZ*!%teQ%)O3|qJzT*8fxqb*#-O%Dr66&D^@J+|9+@&aEK9eO%EUUDrTa(mh?&y^Xd_UDj>g*N|Jyy<5+f z-PrA0z`b40rQOfnUES?n+zeLN4PN1Gjl&&Y<2_!^U|i%~Ugo8Y$emr=&E4pQUcaSY z+_hfmt=`(zUfxxj&~0Au4c~SDtGHMbU-LcR#aLbRU0?P^GAC-Q?7iOYmEZ2=Uf;Ff z>7C#B-CykOU$yw&_6=atEnWdG;O13c15RM%eO~?b-}^SAw`JfKreO)jUn4GJBwpbd9^xZbVj{*)8wO%2e%KG5Vk>sq5x!zAM%oizVlRH; z7jEJ(PU10kVlkHCGiKuMi{dSAV|3MFH;&_!^LEoKi*?N z9^^6>CN{QXL>AU6PGm;^9@s2yWJpfeE(YU1Cge&kD5;XRc*xmS)iD6^Ccjqd4zmdulmX`u$oh#qRA=FN&eYNaO4jHc#IiVwdU!pX6v_h>#9b) ztuAZ3Zpfm(YrWRWq~2@4uF9r{>$#R|tR8Hrj_boVY_&%0#ipye{%go~#;=ZS%8tpg zu58S{$g?JF!7gmi?rhNJY|&2a&mQf@hLOk4Y}JNHLLIl&er=iTYuKLccMNRPZfnvG z?cBa?#>VZ_*6rWs?RH6R+Ai)soNVJxZf3k}&Z7zHY^~?(D|y zHzIE5{%$D$%xmx-Z&H+P@;+}*v~B9!LZu)lbwE zJY;VF4)8gI?)qkL;ht~%KJfN7aQH@W2A^*47H|pAKk=S$3&%-C&9DpKa7|S20+;Uv z2XO@-@dgiZ2N&@YpVbKGa29Vq{%&y?FF^p0aT@nP0#EQ1&+!jGaUM5uA1Co0|8WXk z@ft63(5rAGPxAaTZzXSXu8i0q2XY*bavh&?D}V4SM{z3ua3XhdFNeDq|8g;Jz8N2L zGdI2)$8t5-@+|LhDPMCpuW~pS@=xvZGr#koLvlRd^Uz~*KL7L0^YAvO^Fe=eHlK4t zkMk}6FLXJ7L^}s`NSC-Uk90~OOcd0+O3(DuOY=kTbVX43byqh!KYw*u2RcD7bx^-`ThH}VPjo`pbyDATt4sA+ANE?CbYegDiz{^YHuw3W_E5Dx>oOYa7VXT4|j4ew_2BWTt|0b$98tN_GxeT zYj<}m683Vh_wO{@>Oxz4-}hEic7Ff&T61=Ie|LFb_kve>L6t-aTl zKHcYZ|Nqsw=8CE@YkcE*-)9b!n$P7UC&tX15QSS9 zR)<(?=fdVoPCMtskL;cxD(6TL(0A-M64p6o#X0rlHcRL>@wLlQl2ewz9ci;u&PNxL zMPM?gb8@&#n*UuPqjRzQT^E*1-iphlzH=GK1>wT6;`KeG@9b9gUAly8`bXCc_4~SZ zmqG>CDL1F8@_SNNm*z3oGi8_7llvpvy9N{2`qy6@%3VqX9y;9bnP*(ut-qF?yYz>D z-9dL9EdM%HJRVv?RUo&>xeC=d> z7?1zfi~Vgp{qd)O{)GFt6?f_Z(6=>M<^+NMH37E?R#)KC<4FIvo%+XZf47C%$DNh= zWeK;#e9EaYw_^pGHqeRNsX*ae`M2|Yw>^`mz4ph8a<_|F-6j-wAZPJvxcl80^-#I{ zLpt>^xZb+s?g6~AChl|x_e}W$6!nDspa>~Nag<0!z0v8FTQojr_l4mKFkIrG8;V3y zNb$2JqHpy?GAOjY$E~IqPGYf~Xenf+QV3!FwhqT}3O|%wsGJY)i^0*G& zqHgoC%mSW_<3atiZl5;hC=6e@&er?F$rQ@Ia$jtZri+9#eB-&=pD8yOEBnTK zbG+Q{|8#Y`vV9KK@2ybo_V)hzc%?g>(VhSC?)qe7tlV7y^z;OJfs^6!0zDz+ZK|1% zjwd3^T!uG_FixfqhO$PcFSdR{rXRlTT&Dl)W6rdI@DFNKFc0QZpvMSW-2^ zf^SkYWgC1{x2#rd*)Zz0SlX~1F!YzH{z?3AjZ zx>l{2e!6ag>S5N&_thhu8!6SJ`=MOpPKQsy#~s3CNSEW{*r6w#GWb8)e#ibH{bnOmm4<1MTiAKh9J8gX}z;`%^ufTUP z#{2s5eBuQ8@p5(}v0ecwdb#yx#rt&|a3lKTlU*V$f64ZC^-A0QN%!mahl`8QTk(U* z^!BIwijJrqwES>ki#Iq-yH?TM~J4E>r*2vLp63)g}OirY!( zr9OzshnOG}mQzCzgD1j=3R4eWvqAV(k<X*GIr7({B8ACV!rvBq)*IT>54~es2j# z(Sl8T$Viz3kGkKR`V{m~2{VK53?O|~OwBTRRO-!WL4s79Ak5(PIavQ;9jDc_55+Gs z#GH=|VScxZJ*zV0vyTD(&Tb#W0&}?i&kg*O1aX0(N(Pqqff%Kx10tj>kwNdt$zJ-l z5f_z5Mx~Hb(3uU&=uf=8mQkeS-5XT!Vu{HjpfHC4vhsj;lEO_gBF$R~)jHeQst^kL zk9$LcqZ4tBJx27-h2M3u&=Wk6wi$!>z8j!pBzC{2eDjiJKq!(WX(EM^z1VDo;7L&k z6xdA3*}OMm?ZuiBYCvj=Kr{L!i#2usJr%E|uNW~xb>dKr3CqFYu=YZ9+RaZR{o1f9y_cvYnEwn(K|db(J-FzaVFje7I`bh(#(&b;UVN4NP*bryT6c`rFPzn^6rp`$FfdLe(p9>p}ljh1<&#MUa+87p-bV(Az^@{N}kHmg`C-G0>qQ zA-*P(`Bk3%(i;=rgZVK(NV57ACVeYT2~+gqMpJX1h4*s!}bBWSun!*6XUG zmJTfK7qyqSu^QT5mgxn`Xs(ggH*|lnvJEf(xve$R@WaR|kp)pjv-2YN1_2;Jq3*tGLTYta2hdQ=YV*Qfgv5J=(2{xm)ST^9n6_+eoAVesR9=f_(b-4}T) zFQkdVhvx?&;(JY9XdYr{TU{6qu}4B(xS&)#rFXvflFd?&aAA$` zItYG!jp$tOb(u8cogOj5If_zoF+Z8EIk6@brPN|a{hG+t@S(_ z5)xZ|Dwix@!AwNAb?PX68uN*U&;**Ib=oRYm&Bhma#^JMq-3M|6chTC%lZrp>kQ&q z4A-QL%Ik~>WVV+2ba)%gq+|}edMqpktUMcbfOS^s4L0TMua%4T&;}esqzsT79Cuk9 zefnH8>r5^NoIzxqQ5)QD1{I-;YN{K&T?Twz;?zS1Zx=S+b|KJm;PIau2%H;Wmu2%L zZE$&!3B?)k;N=LClJj7Zix3%#z!(a9X*1s$h-u}}GHigv%s0iW^x14TCAmve@0_3(XI^{03kshhB{&}j> zF@?@DxGuS6(3fiAYW$k;52awvAotZ3WZI7Lf2 z&sb~w(~z<8sIkccrO7&_@p7Kk_O|hPo}76uZ`C%o4f;+qyzysJ6Wh2&JzA45JSOF; zT7m!o$t@H#3jhM}1_}TJxQ9Q11i*m+FW?9yD>6F0;V@|54^(7!`=gRcr$|<2^#&IRrhZrSey}R{dpwiDP>NJ_-bganm;IlE)l?F${N4zJ(lrG? zvL&NwKMd6rPUb6SOQ%ZL7EKpxRGTji)fUf|>vjhb%G8z2SDQ{2efVBix>#?sF_bD( zU$)fjbg{qmy}o><-Qxu!k!(Z7T6X{joz8GW!;RHDV;LgB zWk1bp_9hG773+*N)gH`N7<^BYYpy$5Z1{4pJknfm-6{AI1|-+gaJDfJP4{uMrSW2C zJXV?FyyXuW9PQB)Xsb;$7i(?E-@r3-06X{Q6PQ4yL9%s59 zNS#-(9`vSecRiS?k9s47ZN_vXlxw?SBaH8QcOzU7hGsKD6l)JF0Gq^YGfI|YZ!=m^ zoMtOVMa^t0R>Qb(EAG9+-d4P>AI)}xVVv1^qG?{?c9KQi-gdH09}Sgw`>@$gs?&Di zPMYm}*G{?z4DD`)50?3EW&mZ;ZWi;*;BIz=IPG3ejGFmgZh~>qUS5jB{$75DA1!St zD8zifupqCfC_1-nf4{h*4@7$qP&#UU03P9s4$4}t_YcZDVCW7jdaynnRt``WA65-> z92{1Ui_;y|OsRc3s+}_~KC1iaaBx(=>PL6nuo?I1xN$eH__*n??%=rjw2$tj<#OiJ zNh@%>_@wRO`rxD;0Q=^&0}9*Xv=ff1TMyq-7BFTGx{s6V=1wCSh6 z`DrI2{bk8%r}Sp|>ka7WX2k=R0l4aeZ3SElpeh5dhj1PPHzFh$ZZ~7pt!}pxOv-Mz zQyh;f{s+N+)INZnD37ocG`X%G~FCG*DWW)cAWHJ zTR)r)P?bNN4|AS8T#QRFK3-0#TR&dSnUp_X|8zWgyjk^Ud;)I9TR+|I=9fR+9oC;b z-JkX|f*vkstwE2#opR9A!wq=b0U%`nU?n>s@lHM9WHTVK2RdMQPCZdWG6K}7IuW!^ zy>NyzU^oXlkzG!`iIFnlBqY1glTLl8Wit`f2fDDDPJNj|GLcLqyYUuI{kVoRksSxR ziSADQ1(C8)LH?3GqVrdS zP3N%{A-Qi%q`qq{oX0f`=Q21Be%HA>kMBUrWAc|8*2lX@7?90li60y`=DA2556NT8 zml`qGx=5NE&f};b9IYaDzA)2tU0V@aYGER? zxByzXu4@=6wQ~HvxO{hA-|@1{#$V>=I^IpgfLxhv{P&;RJU5Nwp=EaYGE4hfH%)UR zWe)YK$9rHl0$$*vH6~@0C50J0P!XDWb=e_$85mu8!CATN7 zeK(OXT9d~)vM29)H<^K4TOc8~ubg~0RUltmq&~8*)_gZz5msAbB6py*csJ89T3hBg za-eg6H`{?+SK%*rsE>a?Hy~eE6+d!l%zHmS9#&VAFLz|FeZMd_T31&;a%AOtzX-m# zwV_|`*ftrg_{rBd&5j&9G~X|shSj(1$ep+>-Y)}3>)UQdPTcPAR{$st9kBAJUic5I za0(4w*rTU@ybo)r;SD`h@@GNX;A8t(Lm%hpS(xj?1~E$GfQ0;cRPw_nHAtaxNPYA? zuK8h$DZFvmME)Xa@nM^5tZ~$F^djy4VMh?9Y207_G7JB4S5l#AB7XETkN0s;F}!Ii zU;e5{`*B}mtZAlx^s3DD@jw@)d9Gjnx+?kc&{Uy$VRrPouKDrECcOFQj{Hs2;^VQ? zSo8AD=uO-GSK2^%}-Yq;jM=z3ik_(PuC4&t;ddI_sjQBHytQ#r~V2L z>-ZqxfC9J!GWM{|3%VT-Z@bJ_c-+?p-OY`)UDuC+Ya5{ZRg`uRuwUWnJQ?(`tI!TU zPdr^WgC0-A+aGomKzECvC*WB7)6E#TPzwGP#_@pU@_^FtfN}DGOYlHw@IadLKn8lC z;&`HSd17jKVmW!@BzWRAcoNKc5&=DlalA;myvQ}YD4o2h6TD~}yxz=tF#x@oaJ*T# zyxBCoIh?$?61;gDy!qz5`GMYoI6lH$KB5{v;!Zx22|m&dKC*K@@<1O&9A9NFUlk2s zH78$<1YfNN-}iIAIzV4t96x<7KSK>aV<$h;1V8fzKZ`j(E1;hZj=wFJznzA^gOk5g zg1<|H|JONxH=w@h4g5I^f`qLB!mn#gbdGxi~>W(aY84!LZ>uBXPiRk5<(XmLVwPME(1eX zal+QQ!ZtO+ww=Ou6TL$hrtiK^JLl^cr8-xiDh!mv5 zC{thaV1tp`uqy@V8bXR&b&`CO<)Ge-rjd__0_32=3qnq&HV_3VI>4{n)y=&ljH+uG zSPhnUDa`Ypt`!-NIZD{sND(YEqw-Y4E2IJ#b zUnFyXZn4ZZl!!9eLjsmmr5&55zERjV_r5>kndNy=cudodsB;!~-n2AgMK^ela-4@9 zJ6MWr4}KlOdev;~Zfv=;l-ZlTBJB40Z&vh!WZ$<&XFD2xo>*fK<8Qz~{hgbj0-ylL z@LvJ{Q`{tf)Zz6JA?AMde~X(0N0wXkmhsTAN zy)phbZjz((kKE*+_M^XY6Z`pm5b}~0YUTCuZ1)C;p;ZISO&ATbKaRDv-rt_8yp< zAUIKJdBd1f8#(C2>}H0vsT9P*3eiU7g#HUR*)PbktuqzNk1N_QDyjREo0Qbd{3AEH zOEmunZXz>Lfi84#_AJ8f(V!{ErC;0xO#nV_h8;raH#cc? zFQ4h#_{B}!@J8|H8TA5xbCXi-j91Q*&f&lIqo$zN1zqrX!7w#`^;t>2v=b4+#CAWE^v2v6Ddv3B(#K8ZGT#{5+Z<*vH$hHQV$HMo8#lRlm!}-$|IAH12TCOA+W(Q82rDJ$8cNbHfw{@H zMauO*ag(uEBdI??8Fo6z-;wqrDwvzZf!+RyV)Yjrm|$-5`CVP} zt5=*peK?Ip*FIWG3sLHQg2*i8Y{P5q2!C*s5~hL?%xd;MH0_k(OT03@AX#E;04p#hhH%3!s8$Lm1IVYdXAqwWk)Z@bjm+{RUU=bTsrm3c=LDE!8Y0<~r zPngWsUJpgp6gHk5rDlt9!nE2|>c`dHndcBjhfIXD(o?3$6B=9{ym$fm_m2VGTsgIC+6c3Jy;6x*Z?@TqzBwuX_Wr7{S5G__AO)Br6A|nIef$7&tg- zfwKh%CoeheeV&6806p&C1`7b-4G2CR8Umcm0N|hi5KwPqA*UQKck98?z17CLno^)|6n;x;0!twXg$m*~~AU2L~5M4Yv^F~Pt1 zpcO^a^*sTkM`UV!(c$rz(?1jVKcV=w?*5WefuMo?6`3M_aPU#{qUMv}tFAfezYZ|3 z3o0851|dn=l1cazLF?BH*shC4BfDqHnxPrW#S`nLsU)yuD+J*=j$U$AnM!58dDs@GzoJQncR#I?b=s_B)i=-PY9c9}4v?!c(IXh7b zqqdz4C1~Dgm&(zC|7A66FY+om0z|E8XMI61uIfWznExFfsCuxFYbW7zbJm7*5^q-3c z9PdE_3<3M_vj6Fr%JGowAY%_jP5yyx}}vf-Nl-{U=l(pjZIwsXuROYXnNdw!BR@92o0$JAf(9t)M;M|9!@!Oe7Agf)^hywUTg1|1C_E^Sa5}0~jiUUD z_xj^R`(#bth>0dkGJg@KiX!PPhx*YtH-kQp?Exi6rNpeH(>#mZDF;hGPDzKjSu3Pw zP`WN?9W06fP#9af64Ye{(O)YcOZ{M*6eL#RSc07{Rh)O+v5Z)Md6mkHYCvWA9Pd5h zbZT1&_hA`YkaCLXDp*!ZYXc%Y%4M)eW8Ol^5I14Mq2$#4gd{hx6kq3w+}K0%ZgXXLRL}qM|Llv080s16@-1kUYUhlP1Co z!b7(_4wk{BMn;Uh29EMM(QA55=%;$s+P))q0SZ{+xCS00ceULK~f z*iU#G!V_r)UvFJ5&f;>+Lh9(U)mkU2~pit!r=8iTAp z{staTriuthgQQMsjb^W!jR^9R2|z`!!MdFg`*O4;_&7laQ^tK|*-{ zJnjYj_Jp5igubw03>O;(@$Yz#4C<2@uf>m`M`+?GZ5$;!+Cff$N*J+fjBua@Gl-?m zvWqy@hY;XK!Q~B)X~hr>$NFNGcY1ovtTbT$C?^r1TJ{nE%E=oMpAvdg$CSnomAn9% zBrjn+?3F?%$?__x+b=1cMqe~QuwRnth%GEh$UC2pZeBQss5%zjcR=`q%jmCok3E1M zHb3?ImegXI&U9&S9l0*QAFqQ+1xNQb=Uo&g$$lxNPA!T zr5u`#yPoYml;RgZXhqzM)V;p4ljQ>1kVv)Vj?#3&Y^t+N?+4UYG0en3f8n^oC_ zU+^;a32Ulqn%mi|iyF@ves6CzmbFB~8Zv&Ni`c#3Zz=0qs80BG)fB;}!Y2j4lWRg4 zj>?n4t9#)qV^?G~5o@;?Jb^l5RMRW-5C+z=ayB`>4V-shf5?YAZEiswx0ALJ(4;0U&htdN z*T-Qb!I3QOW0_2Z)WRB4sDkRaEj*$&Zdb!B{2zP99L2uGJjZ+4!5!6hD-;*?H7k9N zBx;YdBWOiLDbH}F5TyF7A(*Z$#AbE0UL|7aYu0X$5#`6$3M-fH z=B&<^3$$(;e3H`~q;;9pX|bsE{I>6pia!|l9Pb^KjA1#|Dj!~{;1YaTsM8u3gf;`f z`LU>@7!IS66uwPFmkP~$<8Oh_ZnW}gf}rj?c;d2tm0-uprj4~u!Q!GhkrJ%}H)g5x zN=g<*AI0ZBVw%4OIL}vPnh{DJ#kJ4?f21UB%StYW48mq;ZX5x}djuMbhB;8IJUiU5 z8S%W>D zc1e>_2LmG%bCEiBErf)DD%b>^o`W`g!qp8h42NOrdu&oFkw@byuI#*Ft2LiW<~m~} z5y5?c_~&>J<<$brj)e_A)baQTmrta|XE@em%;0zr0#<7!ZGyNJluo|MsmF2D3*M;$ zOuH?THy>MK`5@ZOR}Qu)??TMlk`wIM`~?Ie7pzsBcEtw>7{4;R&P~J@*paQs;S3i) z+TDc41e{2v1E1r)y>%jui#O;FRyZ_=IZPliV~g;nTp;$ALcp~V?Nf+T`i0AUnImoLz?0~nRuMnyFbT!yYwqmxM;g*G=8YBB-!6z zc>Ip{Fei{jzn~I32@w5bya#dZPL9FDvdhhe!}A2;&G0MU1BoH@l6dp)a`O*(|Bm;H z(0FnLy=4k~GW`FD_k7p9)qvjWlE30TAQM*rJ`%Y_mWsEbsrQFp@!pLsm(>QdvLFnW z7&af7ACewoudfi{8KV9+cb*7>Wd$lo_X|fkD zU4ZkIw=kR!U5?*#ythlQ7LD33q1s`uHrI#R-ob`O4)M_mwQ!bA!O3QdT~YvA+7j9X z;YX0as2A><223Q+Ih!Ngnom~)yv$tSbG*0vCLvCD;SABb?sFFPH?BCeMNt@{Y~vkq ze_?S=DMbQb!(cyF+2!4juYVXwUnyH`nC*D`9&-5%0>e&m!oPMY5wB@MbMV((e3t)W z3O-bk&!DCFSU9LS!Q08w?TGAM2Ip#6zYtP@oO3&4XQ`-W_S!&Yb&6!84##VZB*3K* zgAztEl7W9G+Cn9Yt`b$6BN>xJs6B2-*-KI2M zT%@69obfyv(iBf5rgLPEh)}F4-X!NSvIT=);_~AaOjEXnaw& z4tfk};Z7XdjIifz9OM@JwuW70fyoF4uSO4tIhjjozRq|L8z!Y1tb-)(h0m!UDy*|o zoVtaMScvRglF4mS1#U8-vW)8>T46q+MT|&VesV61AcBLwGe)8yQ-pR68*Xg!hKMP& zUW(N_^Wi}~nF~6{7f>?(axZC22|1$XoFrV0m@F>dB3&!hff^miClPE+^dZ}`s3r5;Sbl(Dlwv%cSs12}BTKr1Uu%tj|`-kqDGbV-ETs{vG;q0_OPy4k2O zq;YXTZ@#AduM7F(YnF(d{2p;UUbJQ!e#|grT%0d>l|h&B?%etZ)p6c0GK#phhcMMY zU>b^Fn+O>gguO83kjQKe(50VYLoHMW!KKo~d|}A`Xw#k4tr6nJQ(U7}+}LS>xMP6N znqz02)81%>OTk4F!xKvu5G(C?AR_5hSK{p82?LP?WV7}qht|y(zIg>crE%tBvWS^0 zAHo+vXBrh!@oZ6X?K`1fb|wl-iTmAR7- z#@2CnmXfP`4}NV7CsjVKdWGm_`5YeL2YhAWp78Ni<|CGOd;SOV>Q6V&u4}XcA8M>F z`V6KW_!%%+duZjFfJK~1kr#JWO!(DNp2d!04s9Ukl)|YLbw?!yYUpTgNzXzRZqXRt zV0&SFmTy}rII0G|oT*T2>=yQ{sa}Xpk9Lx<5T!6e zyx8_-2RJ^?`(Z5ibvF3*u0odB##-1Lym{>0E}JqYTTuiYF8L0eO##BhqV{|-N|u^Q zTy_G1pJZN5#>rDDwqZu&Uc|zh2&-N3{ERlUNtk}t7|TV=9GEGf_|w@0jrl&qvGye(izZVE7Hg? zSssfW16$ttn-4cR$XYRrg=G9hQ;)Y__n!JKy2WUCh8!pV2O;;RibYl ze)~CZyJ=+!jD|Y`8mq~SIQI@JI<7mKUi%@Z$G!^MOf}I|REHI-2jFKq21FU&k18(d zcFgykSi_hY8gz)2?}=1`Xp^{7*XU3pJ8`G#5}Z1zQ@Uu8Xe$qV=pMS52)g~&!EXoc z=J?vp#YbLD-N}&L&HvENN$|IN!~Z$l0iW!FfCzvXfcWnxdtDDG7z|p>0GrG%HRQh+ zcX=MvBgw>E@z|dbXvPgBqoI_do{PIOQ6T-H6kLqW?>^T9788SC^2dDH44#sl-;vO; zNH|i8NyC^bCW&F}lW#@uPsz!r4~3YY7O3ZatTtC2tj*U8tjWaOh6q%+FQgL)hH;boQFjg9DvYwcmR0^ z&$wC?J=9_-mgF`I01(d@jc}@3_H#%X<^}xe-Ic{cd9);)6^_TUXDJ{9xq`;?%a2jd z;p0!!jC($;VlN`Q=9VS31pyBr4tgEk^9{&FTt=>j3c;R$-nQi~C%VF`flzNgkS4c~ zYq*&BxFP=@`D;B(c5xVh+)G0gi|sXR5*Nr?^$1JZr94Fk0Mx4vtSvP11y^*Kj@Lrn z@LZ_&svk_iy#^;ZeeV}Sruu6N1T^>q^cXBa_or*f%GeZVymEC5xzfGRI5HFnlO13xTwH!A!Ic286h z%e2Td_30gjwhfvO$p--}oXx#_8+h|neZ|_lwD7ZBp187-RCDvcw!8}f27pF@+^@v~ zg8uKcXCTm5e-2J&b)@~f_Kf}%O>I&4M>TNEyD1uTwj2$@gYZBR;m?*g{Xn|abITi> z@@LcUmN(;Ivs)@8@~@UR(hXOT&?Ot37BvRf(%`Z7emK+ltBgJfu_V z)oj`~j4Q7hR})Z({C4B*`D8l^(ij2R*-hWl=u`2}yNAGui){7wv{tLbWE<>Nhvl=K z6?dG}{8cyn!0lPj26m|TpHHD@<4kCejDx||n2cy^oIQ!H zQZJWoU=syI2PM^l>AKS{y=0a)nlgFfThLtey4AG>Li;UuV1=~s50dOB&%p=tlJxLx#hLS!>qi$k-z1}mSV?ih& z4Aqm?4X5{~#3L8szlNjI(%=`(i_d^J%L$%=(8%@OKQbnx8G;6QUqLqp5D9g0OeJR#cS){QrG(W|2vw@pEZSaC zeELy{umyT8JEpkt=#&6kV59sXy5;F`zfQokn$2X^J3 z1p>yy55O9GmRSXvmC@GbzY7G;8&mKg;}&2GI0)bPp03ai76>@pp-sgQ+_#srBJ&nJ z=1RB!DiFBu^`{Fy3hipRctcSA^uq!ZMt@?zUjhM_5*;M2ss0BXgt!l$v!#C*2pTkf zU+ovD1$&j&r-h4RnQcZ&J_q4!nGLU_4IT|-!0&`6g+>LC>wOocBDs8j#|RHKv)o_WJ|8hB|v3j|4t(Ux#{8gzD6BnvSBiwVk*2rskUKLrBX zn4~14E0ipI0>M2=e&52> zcCrsiQ?G#Y@}OST9|A#eax|^^VpQoE@(gk{W83c09|A#^uSGM(Jgr!Dj&SgP;pra& z0i$fy6Jk_p1G3+4*~hGz(vIH(LHE5?4+cGNdFPdQaDENuZ-L-FO(v-b6ocNzs5V0m z#czSYf;7B(Xc)~e4`DuG6^8y>2HC6Q0cF~vCpV|2Y&cJdJrfdsQ%APn*YHE;oq1v|BTw7O`3mhD9%O& z{nexaqjot+xW6?NpBo|l?ONjMl0Q~2cb-j}e|Qjnn>1r>k820Ve?AD{MhN4aIap$T zZiIM%8;XBL?SD0C3iLinS^VWen6sh$n@NMzh5gQ+>ED?&($GB$$#CQbk^gGatXK2isy!+ zfJ4}GL(wYhxb3;2h=J9{{%q2G_3U5-n>5$wZ%r@8)va6Gva0uPR%RVfzZH>16ELq}kwc{I@2}2}WC8f&%5*r&UNQNg?;QsFWMuC1ET{ zApmxPRLxED4pYOyv!kFveT1wBk`q|B!K`#5Q*m4^xz=(V10lBpyp^q%Sj4) zK@f|e4-}xYW}%S?lamS;n2Ld~bP9ADHmKF*LUo-(qe=#JAdyT2$wff;DHC@S`zG|t zS&;Z~=fGoIRz^z+Ln(Z=kR*n^6@LphX==>Z1uKA^$pq(NXq}`K@Q~tEFss-(008PI zaF}j)PEp%J;SNw_@=HOF=|G~a0OEK^Tt^X?uIgjduQDr>6GNcyM&RmkC99F^V$?N| zGRpbO8c}*A!p?7snGcFnk17)jRv3w-+{&6cpaQrpdU-JfVZt@5V<0NT(D_Y4edM~# z5K;koh>vrlP@*h=nVvijijEOai?wuZQ!#YK#0WXb&U87XUA$&^D32)SF!bImOgw4S z&v@jCOb>YszJn8S^3pN>vL3q`2}*B>-enQ8?V{aMio)B~#K~Ra$U&G-dOu8%7QKf3%wC9X6-nVvUgAXsZo58H^!uK%O> zX;@FyQ%jnJvZF+ZeL$&J>zz*1Ww}SM3TCpTvZtM*iyIUG{~ax~^b=$>(?bS(HCIG8 z0(qr8yP24|rUpqGE5P|1oB?4l)v(TWINVZ^pby-rr$$wl*Uwy7^TO&|=_I zB7%aaq&;!SL&n>Nghha9T~*Aq-n$piCe40;l*Sge-fpGf&}ZTRzCvn3yv47|>cpUm zGM#Ac$eb$MX1LNV6WpjJPtp8*sK8tTR(PE|Wb$}~`2+JG+QY~E=V9*+KZ%@vLUono zEZLVWrF)?(kGnV949`(!4!%?s8ph|RjR-q?tRLx_@ zVGLw|C)&9#RrGuXb69yOVbu<>?JD4>oh_guzwImexHyL>$tTr7f2YBqL8g<&H&rmIC;yMH^(E+H}gZh;PjX{!@1~L>9dU zAB%V8Wi&d{rY{TFzX?f!O&T>}Yx(?UU7yq0NwT;N>@L7*A4c$I~`i1QxVTsZA6|;ns*5p+Cy7W&9lK)_5hER1uwd| z0XTtcuGeMLs`<)m;z%{f^u;20tO+sD&N-2==LU|^ToHI66f05DvL)|%hxS22t27EX zD(`&ebqKIYli2eysm^n@C4~~uaEmA*?tnPgQ#XO_rkaV-8np10b>j8JSPV?e0yfPZ z+1mg+RO=6rO6r^jMu|I_(n637IR;a?#J;#gF2!)$xh`9+sMRtgM|-keVuNYBlpIRQ zBI@W8m!S~6X8t;eSeYr4pSYMQp66+gn>VW_JmT#$cD@KcLON7r*I+yE?fkERY$)x2x z{)F5(Ty#=7GvK1sVAYQgi%f>r-tGx)m75=me_CP*B#i?3Z5wRTU?6V3p*m2x1e-MG zB21`R^EyDVN#l;^u5~$vPG@|X0mS}yCXEK_!;J^nr0IQuaV;o}$4rRUfHq=`PCV(E z3E_1)iAf4X!wc|)Rq~S0^g>}4#sqq~D$9^LqO$-6*x|gn3K-e#M0|76an&tp&b)Pg zAgI+qzfHgw)ew^y!0?3f_}nR+GY&&F17kKTW(I?y?4+C%VMs>eLsaRl)ZmL9DJL2W z^#%<3b9_zU&=jeCX)eFO2>I#P`f+RcLwZpS*@+gwq8pCut&u~^H=uoMK*f3$ptQ#D z8CwJ^{-Ya?mmnxNK=`wy-!4|Vqo}+gidcgh2ZVU57-}Rmns)%2FAz=HC@?w!H4$48 zABeUh_9@jAJ$6?NCNjvx(7(=!q;FGlxh4os$rLxh9L*SOUkrxYPx3XjLkkcGj3Y(t zLRMAL>~M_AC9&VDh=tjOhQgrZBz(U1)9&DMEAsXtbC3(VRExyqsH_QK>@skL=}EMi2qF2 z_Du3bL)q>IJ%yTgh|L?eGXgO(1hvy<3kxkO0Ar7wr`ZpkMhcZ;Fr0y##E!!mFJ3{Z z9-f6%sSVU0^%UdyF_&C_OX-1G>1g#GfWlzVP90uQ+^RSF^H#LcoEyosC4NE6iZa1C-q!@V#*b7Ds2RB1^s4NeVrfdDYTt?(O2ry7 z#o$tWSgC;~d=)O&7$>=>!bKCye;qVx=x5U@mhbe%Y$jI93{{&c1m0KH%-&pV%2;>H zF;~=2*_qJlO5|;#4nUR398;|PGFl4!I&o*Y5jDdWd&1H|HIm*KfEb1bIhlQYJw@Kqu{ ztSSe{k7^I7PzCqJjZ=FuFlPBy_Qfl?6LQ^a;;-wCZaT4P2>BSzep02Y3_90pxjm_% z%hX4BD}fwYK}?y63m0)HQP6E*i-UYn9TqrVZgI?*2~-sIP3PQpVDkp&^;MpW~`v&R-yJgeH!g7XrJQff|IPbL<*7;6x{Am6l2KQrYWj93bRxQsrIzOny@0xQR8{?a|F>srV3~; z^`Ni;nl9F~G1ikx`PsCg)n~RN+^?oP6UGKiHdP5T_NAG7 znke&wT|Rbdm;h@1=gA@qo1)-9yB5Ym^+=b7E%-P`+cZgiZot!9(kenav&7o->7{jG zWy@EdDhr*@y9*+ClC;%~{rslUpxQ+fW-T&L4YeIQ|6>jJsdQ!We{++wQOOMWvO_1KuxOj z##O5`l@sh0j0m55c0YeUliW7@^5kMpoosVFQU0hZ-LW8n-0AX}ymp_v8g8c|TcvV> zI^C91NnInnDn>X5ph62(1sktTZ-z0#W5{33t@b^#^?xyUmr-$cd)nX&f)!f06Ck)t zf(3UE?(XjHPT?+vyA#~qHNoA3yCe`G$Z($1r~B#dw`bmWtyyd4JD>J{-@;w{x_*+5 zyF(egNZzTM&GsENUQxvMUd@Pb4J?&@WNxZP9-t7!Mx#_)Ch_Rfh{UCF`;A3?_xU{c zl2(C)Oz3Oy22LEyX_TjxdO)S*pJ5Ai6R&4jqb%E2tV_p*F9p>TctvKbf`W-krzm!GyRWN8lU4$M`+X;0l(mfNQ2!^7fdtU+@MH*n+ z8$0Y5>4aDsL*QQ})cj1*``twa^TbvOTh}Wqxu7~m_l0LVWZ;^*96do-CpBTMoxbMw zH-zm?9W8(=q8X{$4fRM}l_*6wi|ymcSs7=U@Ge(VGqyWxG(sn%N|UF> zaA~zfQEf^Xvf3sIO%`qk6hCXTE|BFNn8Gt;&sy7HGgy3Tm#=R$5tXU^kmVWwxsz$8 z>Wj6GEV7H?V9&eML9!)V1_JSxPtMGbL+aSQZqY=(nGOO=%5aM#QXN|SUe)1*-4T^8 zUAT&w2W@e$gtc0t=)N*-<)-$S6__0l(utX0jvIln6$7JXy5>bTzMcBQgPd2t%(hd< zGKr#HsKlKV$7Y1geUQiZ;q|3kRCOBledfHE8!fYFLzZwfWXN z7P_ZX7CvbMBR&C-K5^zVa!*7gYpw2KBoCSqf)8zyh^i%+bU8Gsh3;yCsm_L@lR&R* z;#7=*O=vh>t0kQ@I6XBI`Q@-BYIK+0M0%jPeS(9*==Qubg>XI16= znj+Hk`sSNJa73y=l#+!52V*TG_Qq8d*9FK5 zIPY%d{R`prUvjA*;=k|gq~W)|r8M0bPl%G=vc zWdHj5O4s7vIf3?XS=PbnXdZ~LOrt7{3Mf6nhEoATBO_)p!1L>yzj+RgwZXBkdz$Lj z9~H5SdRNtCC7C4$p*q(;Fe+N29#7ROuZ+6YMOx-q4aqbIDZjT z|Iv561%}z?+4Cn6-S&0aRc&1QgC&AXk+|EjDVWk|IU$69>$(5?hp_w)oXy@RwOrg! zEq9f>)>Nvhs3K_GqNaMAE_Q?|cnScI41qy$zjClt$zk?AQWhuo-7V5xibnnGe0cMo zL0l`u3=Zb)M5II5)+@`{XT@%#k8Sp!6sd^l1LP6&9>9eAHSZf$2wIOLnRxK2hphsS z54{f}M^mV%VdG3EiuuNSQ;(>Kj^i0+NbkPmyU!V4R|+v6#cfKIZBB?2{9xiU@A6AQ zLI2jFA|1egQv2csS`1)%CjG#Ua`6vo+L<3gZQ)GuM~PR>yDfWLI;48b};{k?SHC%&+A8gi%7SkY7PCXy_pO z!YE{1RDDtZb#!cjD?)vI^j`(AcI%jz=#=k6-cO-ZqhaAxTw^reP|aM!zNX&ri2ell z|NN0C=R`yu?joBN^HcB(TgJPl)^H3mG+gw1ap^epTwRJ0{h?Nw#f(kYNi7#p}u+6+M^{_}r@FUL7<5QnVU5`@5)ML|@h(g_; z612xk`^$ICPn}1aLWAlwiFyLmMAozGL+IgB$&E7HTjSKW?tPzCLXF<6Xjt z2$EiCS$6MzNjrFtzQZhjXpciP(o^R#$n7UO=bx@AUzfFHb1LwHuITc1;5{G&0E+odAALaG5aj%Dn?sRGq%y`c=%Q?;+UU4F2HYG)et zrr&bJGS$wtnr%0_LkZO{blP3d_12+Dp~}^yB*P{l>5Uwj^K*IqC-zvt;I5&gV`&l3P&y%X#Sy8l@t2!L%wqhvGiX5k3q@T?#$#h_v8 zjUq{A=ntoHxgdi^K?Vqcxsv+_eu?X_2w})!UH82E)G0ZPVQF(kk?JQTS&&X58_)_^ zMF)4(X=Eh`-Nbh)juD~NqYvjkVa$@23d@3}Xmj`KWte+l*kxHqC>mthr$pK1K1JOy zMFig@*5-3;J)stGqXhjd_>45}{0+ddLJuhYA!|Ve@IVfDP2M{itS1xvLpV<+;$NPa z&-d===YZe`xyxBu;+w|r;lh+IWJ=G-f_c*VCzr)?pjD?T(hd2ngbabNMZ&_jABKeg@(OTI)F zz7@))>qu|+`-l0`r27boA;vLRunpOeWF3|GG7pL3@V!hb=cZ~Nj8|70vLP82hk_9N z>;!YyQL)A@xQDXcqA*UJ$FexhtlhG7<@C2&*ROV(*OT6|u+fup)=4dq^6;j`4kffl zNWPkeu#`>s_}7f#$~IJ~^Iwf{9j7nd!;fU`Kiw?sTNhNY)#5`dT^M_&PI2d|2Y8>z zQ%B5BcH<*Ptc^4gj^SPZ^Z*@JaLwa63Kk^MD zm|RJb1wSRuWOTcqjmT_y4tu)4C)b8%2KRH7+eF&`L9+7qUU-E!0KjqyLgP#az^|uP zrVe2}o}(%x8g4tZ-}M$3Ne49-8o(e)lt_zRzLG8|gHMOmXvQUx$Vk`oWRhD1kxHg* zs2Jj)$(H+p^|gU035Kxtqwz#m(_cQD5Tm>U;S;44hYM3op}XHxQ0h&S$p-@UB@@!T zuh9VFiP{ZcO@@%k(F65ijPZuJ#Mx43qRmyJ1%-bRUdfuotUzK2QToNh_QYbGLq1fT zsg49)N7+)Z7+*c!gFd%M#i9WzybvFT7uM@Y!)0?mD5ps9OJgLOYUv*ix(@|47NQiz zgRjTyC3$ngljDl^lH|Fij$%wGL%kzC5`|B+uaEr zL@9X`BkA^p;a9fcTY4Ghj;2Cdew3x~5>UsF|15wTqiNzD6%&GsAfxo%S=PCojmdB+ zqOP)(U2vX#^!->${H!f)dZU~Gw@^x^o31D!S)$;lK*~EVQ%DhxlSAcF?p|J@(2>00 zKo^pYe2o+#8c9i>5>}~RZK1W$uGZYVP;Fm~QY%thywQT@=&LmLS``RYjVcuO%<$PtGs+E{%Rh#Q8m(V*dRDdZ z@Z@xa&3iRmD7BtkvwCdOg*$$Eml9(%OHlNHI4!lfF|ZihOoV>z@ky-#1UVTXz+QOz zhT+`*iP3R~NB2Z+seNh4&TR!+49Hs>spe8G3I9VEJIvj1*L2MNljUZ1ewv}xxH^3i zsLGI12$~jpyn9+IAqz+^--YqT=g^zoXoFJ}W2Q#P3zkz<_iM*7BXcmUsXnx_M)K|s zljrm3CbEdfz@~F;7#j5UQ=591<;{w(r7*b^g6I%*8?`3Slitq|4^88Y>j=huBLkpl zl}I84tH^+K4{B;SXTdHp<+amXGJXA4WUV>yxY#WZtl53U|Iw}0ZiepWmB?6P`lph(kxIHjo6put zeQkAV*sXa)uBvwL&(5+J=taF*0Q#78Rp)(&u8zow6^(s*uDF< z%iizz+SV(aM=vbD!)p-k`Zm0TM?ZGALm21!4qCX!Am#T7moMu-a7R3bKXp6Cy07oP zhxZ&6<9A9-Ti>IW@Elj|c1mqo-)9c@oHXTk&RFtU#cuKZ?%M7A*2{aiLJ8rOx*JnV zuQ{sA`C;ntUA9|c?&wRnn@DP*OR{V>vW&Y-Rdx5TYJJgD?K~dRKEGRQ%Iq_EONoa_ zc^5KIrARA*h!y%2H`@9QQafgzbup8SI_IuSjV|i3*shJ9n$lBK9v^iO-EIHt`gL5m z&t4zJCrs%3$wAMU$-M{A_$%jknY|rJj4R_cIg?)}bx+44iC(jp-+xt)@GIndH}r>gIbt@ss36)J2})y*2xeD0ch zd@t6Di4!7}=@o(@2GFDIc`(ny-CqdCqu+lz%bso+=j@1ApaK3|Ds?%F^AF2VemT1A zQTQY9xC?%MCunsY^>YG&Y^A;qsROXgcJui&ShBZ3TQJz7_u9C3FTU4_T@c!(1ZuLU z8Sp+&gTLjz7d<%!3%M80u&)AK94lR$)86y$tebGKk7!<~zLkh}l-ybgw-lVdM}WOt z#-Bw%5jM>r!Yvf4AxzE?M-78Ng3d^_hd|5Q*WV{x)ezT!-@itSU_@3mK~Rtn1Tym? zjFF+TQVhH<84aYA3DdYBFjPeeNGG=E4g4GxVObH$t*xd%A*DDSAf^};{x~Rt3}gd9 zk4hB<@2|v*twS)q2Ok{C!vN`YvlX~EqGKMS$KaaGAaH{hSV^TqO-oF` z5|%W5aOVM*Km@EgU#A=*7F{q1s1=hh8j4a7(}iiwwj64s>GQcpZxg*x)$_ao}P&&s{BBwSaAM9VYXZX~c}F%`7~2Ud83qpr0s{?YnPezc z9YQDRM=_G~YbI%<*VA5#cZ)V>8hgm0FD~1HK;*agyfc zO^&ndZ(5$Hq>x!zo+!zZe#Ddgx`)scKg1Xzbe#xIQU^OikzRHtlQ%#4ZEq4HB0U5V zLO>p67iBy60rtC&Dwh=SZbx5OADo&kQd^0Db0V8pnONwo^7D*{?3II^i=Y1}^JYEHac*RNThc*TbCF{@LwrwAN1Kdv ziTs`7@!Q(ocOurQOqjH5y?SS0jBNrZk8U7KEMh@h?=<1Q;=ugO?AuXIpc2Zr@$VSO zH+2Gih71IS#pJrvWk09rhh`a6Tb<{N@O^;nzdlZRMNCIiC|*krB{Zn)NWCVQ^ho>| z6ON2wfBWswcaB3<+4?~V{Xr}^T@1R3oTYk*j}gp|()W>1nJc^S)2FDtiTGX>BvDso z<@!1H7&OT)WrxUyOS&>9Yem<$4{Zyx3fK#Z*_`=}@Wm?m6t%O;XBEmZ(=L4p%CPex z+aS1vg`Z^$`B|!cL9Du=s@kFW!4V4vVkw;ps^D4$B)J@8U$BX;lGgb`(fYzn(Jv*-M3Dt3_f>=CVZ|D^wFgs!$A*CATG5kD&&MwS@RN@31Q?<;L(= zwBC!LO^8wx1~%A}Ys)>cvde%QKdpsCmNa5(t6ZZN(a`<4hpo3|z#CG(tI$qb(bk(^ z6DUyR`bpBF3eq)UZj)PY9mOSOoiU$TY7*2rbB-Rz#vE>1M>YiIKZg4hHIbhxRGXHx zsIJb5ZOpsUE5$=2I@eLe2kqm}eLsO108{tJ$1W^33_LfM_t##fZ%AmQp+B*(RcYU(Cb}M&M z48B&;zoXN?9^X9Juicl^Yh%GOf~vLUL)xj{{JFiA)5rPPUn58Fn#DDL24Kjcy+1@j>K6^F?JWQrE28VnMrmo9%AgjfVOb}FJW?F4ff&Zg_E zD2U?9BVg!B2niWl6dFdg@8Dl-ztu)Bdl<6L7_=2(&ThvFBhrxQ?Tqj=fQ5``xqc)B z7*T%RQBO9+{`!NsIZ7Z|M#2_}9?t02Vuyt!={<>VESLN%ShM?MNy1R3B+jA{Fm;!^ zWH$_YDh)bnN~3+!lK2-0ga1I7PYoy}4;1FlP?J=TlHRKjG{Lpn6S~+Herq;A%9Bb( z5s^m|6vve1h;XKC5NzJ#!P!@&+E?P(R~Fw_QQKEF+gEejR}b6QNZr>g+1F~`*B;*2 zS=`q>*w?$;*XPKdaG1U6L%xAJFcv>BQ9Ce&OOqpoo%b-C@GvtgIk0LzupU0RWqEJ3 zX=eOphr_+eJ%^5PNI(~X3DQFswL@34Lt`^tW;JRfoCBk;J8sQ~-ouAJUzxl?0<}ri zZuiJ37U7H_98!;&+--AOjqj?AJfbIsepIm4&LgiOdf%&;RZ0ffJCe;T4lI1{j^f~s zn1@Y_cAA^4!j%(jJa{s+jfJ+?Ao(o*x0iT$Uc5}^dY4~m!hXGfYcg>Z3jWv{ z$Kol5QEinQSl^>LtkobCAzj}CXr6dDNpjM1aQ6M~Y^sC~f{Y_Oh5%<78Z8+BYy{2c z2pW{v8gQeU0teGQu#y?DA2Pr|-t#3U#aDXGS|N56z?`j73`xn|xZw(PNIMobesZ@4 z4u&QwrK6QlowboBKaCdMWiN&|={w`5=#htGXGgQxO^a!c%b((xzeo^qb)yruiM)S7 zdIIfn2QaM}aIzuzW~(qH5V27yb+jLw_sxkxR1q)jpCN4!I>f8QEHR!5iM$he82?na zP)oPAc)BQiTtul(DjX^4E%UAfI((xt4(xnXt6TAFEcI(_2{35`LTH`voL2QN4T(Sj zBAin!W{SL~H2464(Q`ZsFS8OaTmgwnm{clZ9xLl*8+&e%QA`4@SU_%V@t-xH_jKAJIy1}`%EWNX8F}u&aPzg-6F)!ra5>pR9He@D? zKL2@a`$I&+nwAnd=h5}X$N1wXiZyT!nOr$7qh^xpacn zt_w?2q)Yxe8?U>E_Le^#{@Wr>3#$Z9XD-=Df0i(I#!kG6@>*-*+o;Li(+R?vjL*xO zTFzr(fZu=#{c&G^LRY2H#Ox0fgcdXEh4#e0{~{-0Y{B_#Is9i{{du8hR(~1#^D2zL z*%s~}!VJhTJ}R3+VfrhTi{hrAJ#OZ(G_8B^kGg1!kw64LGikZn2{85sK7&y7pNy+z z2bKem8l*ROQ)d0`D|!YODs(E|6d!;12ag+6i3{S_zdN zdilrnhtVKPdhx;KT5NG8Txy==*+eQ~Z9xjVMCjhsw@<&EF)E`DMZ+mj7!*P$9{~_K z#Zu|&$6s`dRaz}h=O?%H%e6)$iHz2F46BV+OZB#=cZ}<;PKUGA*1wrHJH3A2oS*(? z-tG;8$7Hg(XZi8^R>i??cXrRZ*VW9ypZ#=d{W%bW!`2dUv0h_Zo?4)3se)Lc_D)IN zF5K1CdJ)wy_*PQ0T183O^^l+7f%9s+KOB?U?uqMWZ#<3N{^E)I*U@aLa*f?H&)u2x zxhoEhn78p9){;1->Vl7F!S+&v{pAba)BVliT#fxJ|I5?k@1K{KuL1$i#~h^iFef;q zK|s1z(qI&xd(seeX)dx*Y%LGNpcd0&GA$y%{d`^0APMXUHA4^bNZN{4@+ijkd-7=3 zajp+BpB{h5xx(BnX2$S6-hYS}Lgc1M5F_xUNR*;$qeznDd7wyEl;);PQPuLKOx3h% zqfFEFdZ0`vGK}P=f|wf776e;lv{7Z+wm(p1IgWEvXM1)$z$ePu z?OwoN)%z?vRBT0~ywO|<(S1>{gjVY`3G)MTB%kg2!H$Jvq3FuOI`|2DLrE;}B(ok8 zsHB4MjWeo7or`6HdE_FA5S>i=0kuuZv?3WA0tB+qf|h;yz`l&9 z(mHCfT&N-nDFCSu22e^XL2Ox?4gfGYqqIpekg03}6g7%Sel$_64}hxDB{Z0yjE2YcyXzKgLwK#Kpg(>s@0l{yNl@ zEmYg=N!{2Y<{mI|BSnu2>MZDEEMRm-` zVJHpLSV=`{j#MU&OiFECs=nk)AQG|P(-3;$OuB&YrVXsYL{Ao#Od=7a@jwZnlw%h% zhHa^uqMm)QCxv4QDBys%3I*RW2&MK&8tNilABh!VbUW#^QbGm5Xs1Wo!lvg{Q)okH z=`eh%+YA)Mcu9iZw#NXZHNb&nYl#;Dx*gC9>D#9QB>*j2ihcL1!@#VG)MqQV{T@cS z_ePZCDu{iXP-hoe4;ls-AxTj2Ml|>3I$O1wbgAR%R@Z=OTP3xw=?1gy8Q<{AR7l;f zxVIWDv;MNrPwT)s*YO&z$9B1Od2Ec0^X^~0a=E~8bcrJf6)vEeMpVNNYFQb=2;DTd z>Y}Ksk?G6v?2He>P)LQSr9n-TndQd7V~Q3{!vI8)Lem4V&a?Lmu$m>QGkx&LOLO^v zZ1ZZtARLN3b#6BoOi4mj&V^7hXxAcPrUdF$b=cLrI6lspPx@b$p6?eG&}^|W#i=>| zq7$SrbH5oYm47v za&On4^5?5#sWLh!fFd#}&=?@B4F%xE?KSZZd1o+`!4=r$pZZf8N{}wV1fb2bmK2at z+f}14vTEHK-&9=;fRUCLtR+5=uU>5;V9IJ`Y{uKLgJIm?KAI|$%(T;C`8cYd+F%W@ za8vucY~tPfW|J<3`iovzsFwBmh^{|(nOe3v<%$*e{!_1F0?frcfJrN2xHT%7&?O?j z_-Erymrj(A+87YB7EHN2;`A-QIVgo(zQS9Hbi<86Ty*DM%4KmoWN6Yrom3R@Wgk{b zvmO7(d>ROriAkCuJ)~=KE)M6}L`@>0oF<;n)s!keL{jQgirx{eCJ0Pp*);1yBF(Mf z^iy*zkxx6h#MDsmy^u?h#KpYG7A7xzs7^UjpM)_}w$;bPe`~m+S z61#tmlHpA;+3gP}CH~hadEXQhR+G`cMmbtvA{WFY^p8;Pb7Ds-dFI0pGCb>;M zfc`Pc6luB9dBe#{$x!pSs0X}(oEynC`vF_;k1mOA6- z1E%C97YY9O4okXkNZZppEYLM3X97rm zsEFlRW!(!u2hr!0*ELzs#VNkNL%K_|Ee^&+KnYkrm!IkJe`$aR1XPFJVH|C0Cl>X= zjHz?T&hiFg0oIYG_+lZto+6za#mgCXZBCv)LFas5ta*3;Wa_$$6#H$NyMObhSUZ5iFA}GIXKBRzX zt>!O^C$^HR=Or+i7xhDk4ZB1BJ<##x^vkFHwdg}%`S1)d1A3FMyZOeiuLOpo*&AXA z7M%AdV!|<~Y`p4pXTbJBF$}k?R?8JpcBuI3<2bZX0E#PO3}(wNV}HaaAgN%`n7lf! z-UFn4H>=T8NyXBk_Tn3kURClz`5L+ONxuVf-ypdvL~IGRSLoXFN@Su!cdWY{e_ z_Os|qGSFXf{(-GnF+;*RcK#vi?RhR8@zNpHMD;yZN#t%F@zYLEgr*P)v5az_Lc_Zr zX%ns4L*+aTq2@$r3ZXnh^JU;G^F=<1^gKpBy zyk9p7V7sn!9ROOdkIm&vbRt0L7C|B)j35SW#;1YLsT&O+Zv30u-=X%dajq0OO6d8m zcs=bKi5HJt%~p}AO@(} z*h=%`bN0;#^>wc0JU|6aCwUteV83iTH-(CJ zeP`M2CQ^e%!pq}v{qEch9v|E4d)~X1cL2~KaFAG80#A;ubZ~#)!0~SznD1X380Mb3Hcu!J2JL^cpdx_+ zk%RX&do_tPa>9SjB9+N7@i@JnN*c^8RkvQmen^$UVJ++;)mW^UCK$Zwb69fqJP*D4c{iD!FhrSv$MpnfvW-97q-XqGkEZY9$(YmR-C$UAk3c z_Pg6uqmgB?*L#j%7x`{$J`qZ*$y&_Q$yD1db8~@anKj@o!Dg>{s%k!Sr$a-B{)>nX|RvZwX&R~u?7PK~FXv$~j2Hr>e%&he2pG_zEE z;`3j-{2f0@C}rKMxXAzNB)=-JIcJ6pa=Lv7^eh*3&AaQ>QIvAu1gTRN|$<-Ai2`_o^uY0Ft#sdXxDd z=E#YcI^R@A!WH@ zRfwD?RO36QhF{}}ML!7a#njEVm$`H$D8J1*&Q?L-B2d0ZYe-8NCl zw!^%&W6HKV02;_epyk_4m3K#CIh&0BVC))&Dou?Sd*J^R$RYN>?V_39G^z*7xE-`6 zJ54Moo!gcmu6;Q2FC54T^Tu*KU-YAY?TT)vTc{3rzv*^gX}Y!WCXKx*Q6_@_u?%}} z<(`xPmcMq)e~aQHoD2N}T%2H061jIXoN5F6FafA`OTeJdG8qCCCwxp*)L~Q^h?2c6?s* zr|M~lrQrIC$3wpQw8wFEX`1{I5bwP|-oo!RO|{~ocz+{4 zb6g#uE9cw)u7=nJA!jj1X<>n`_n0DDfnZE|3N;FJk^dZ7w|#n|f}16wQrZ8v%)7smx;Op)sed!?{+ZPEF3$U3n|J?Hcl*~_l7E_a|CZFi#dyJ5%d_Gw;k*6krt&v)sS` z4@q5_iqrtpMSLtvw{8oO!!wRCU1GzUrF66 zpIZL^WZng94gM$duAS2QpXMF!3F7~edFR+YqxYA2$1vNDFh-v^O7dULI|g=j{HgzD z-qo5Q{~wumww8oe|6$(!e`SdX2g$yfcluplZ=n;i-po6CIq5g^F0KjY;Qz+F)6d>~ zL)rdj-WiT`!T!^{gP~r=vsZjG?_9EB+272&o07n#l|1-2^KJ=7fg1`7AB0%nkMU;S z*;&C#Tfx1VcPz3;9dG7cIu-iOn|b#%kMnAR_h#NDNPN@**T=q@cR0uI8C~AYJG|m+ z#W(X#RvD||&Ag+cjrgm({mr~nvh{v9hKKO&|6k@^luN(mzngb*AHLT8)4YoiGX(A_ z?)_!n$)om5f6}%oIuX0U%dwv`kbOzZnt#Dj8T=RpT*9y%+f#;#CuG!~=p zM=mGQtx&NR8O)KclHd9`Ds4-!Q0|4zA=jmWK>@u`<#$_^M`kp`6(%2+j9u-(C#S)f zs(R7&>8l5}oT{nXT=l_iO)kXRWwNcX1NyEOqDZfwAGtiNCSE(pS{a9Yx;)NfRx>PR z7`4|l7-WN8mWpz2M0(0L9(mUos>m>Y;t857xN8a^vz^dEdNc1XiYw$98710I6thr0yn7Gtq3S*<{iRE+Xl4Es;-T z(8~mmCFNa=L4=Jbspj(#WXz^C0pvxl;mQ_5$hXf+Ejmj^@AN_e0BC20jMCSImzuND za;b;T6`}$wAc;n)0jn(4IZ}Dy-U%901RpX-S%saRjS~jF7MORM#P!atK-R1NCh5#? z8Tze<1DtLkKoFWkky@L=5R3s3hAxV?3f#s+(C&2sXgS&jH5#uTt`FigZp4~U_eSmw zH#fK0#=Bj)&jJ%z1J8x@g9No#=SdLSj-$FweyWF^+KM%|Y@9pFkgd*r$839ux(Isu z`~w}ItM?Sk-dTNpC zc$gLS7Y>r|v04{+X>R!vP^C+1;6B=$R()gl7 zkqDocf3Ar_r!v~wQs*5}p?U(UoHrk&J9?VI$yhWbw(<>&{dq6G*C|upy{|bv8^aF% zAA}>DlRAGvX|OhgPo0excJ+L?e15&je_t*rlR3A6>oMB4rFl*r_{Y#3{D2wY$Is3+ z3Z2l^Y@HjhroZ)j2F`bBNi(m+AIsd^(jAoGq_^g7e>cq|Vli%^ zHc;F1yOMA|Jq$Qm3Rq6_C0q9Gm+%1?_^7A{)eHw*QU^ir1h$W$FW|bBq=J5``)^X) zB9H2`P^0_Z1uU|LK$F=aEBgN7^nUwJu`l7s3l1c>4+eljVDm#j=HBvLc1#vFuw*tJ zCDsumHdqpYsGOlhlAa10!B7SPPlx_i9)9gD0c~l1j*|Y)_n}7jp!FsH9tp#b;Gm@u zeO@lm=k#!>>2MqbFg2ck?dxy;C^Zm2M=-mZD!GMi@kl^wdIUW}(73SQjM|rhaECN5 z@u`m`+O$rMdNG5Vw|Vrx0*+o-{rMbJ78=vQkr(N64&M>I@b6u>fiPg4J&)ti_s zzK{!aagS7uhu$V`4Yv{n&_qY{j0Gtszy?bCX93GOfU0| zAw=On#ECY>;7M77U#Z>WM?#l>$9+wY6@^cN*Npq@8FhpgeRBU6Hn7njdCQ`yAs^Y7 zFNaaK!s>xTbVjwZ@c=1!0C^66`DP*dMYVTAh(#c4wKlaUGa<@mp+G8=CrT5&VRvD29XvZ;{ zmUhMJUReiNwxkwMki_4j=yz)RnV!Cv;&4TRaBVpLPYbB;+fuN17@OPDd~i}R1QAi( z_0W0pu}?t6kJ-1ThIe<-&j>-^@Bl8rM5f3XQo4d{_*@;lLiUP$XmkkMW5J1f0hU!b z=cL|iiIjS7dk_vuS7$f%QV3?*oXo-CKj8sJf(B`$V53 z%?~Z31hqX2btgeVJ<-T2UsyT;ADFj+;Prtv5&y7IXf<~Rql6O2|ADsbI4uv}uq-w` z3FY-VS7J0my}iJXC+knDU+ii&h$o+lr{s4V{{XIUdL+n!%65@8;RGH6Doa7)_7O`r zuCBFxE=Nydi`IQ8Gj9({fiC*ilBsQxB5z8(xDtj#1I34(YEDr2;8x1U1BufF$re8&*vn7A{MJE!DsBAEmcsh{Q(v6V_F~3;a4* z@pUA!z@!%TKBGok5ROl*GP@1boe|&Go(J%*d5o-iLQGiKs6@0TM*aheK5-kDu0YhX z4ywp4mCo@l3-3w=byTD!l;=3oMVUZi@(5~UEYrxivnVR-h$}%QUcOb7U!f0-G+xWo zXetvbfkEuvl}W4R_q0XLW%WX5Hsn|e+}>!&ukVN{*8H0u*GRs&kI)0*WcT5bQt%B-2tN45A$w<=h-#1RHq zt+g7gp*N3}L)@BaA81^MLB(%Iw|BMsV{?jCeg%@HgO-_ihh6|xDJ*&&Qec^UVCw_{ zU@^G;2(Qdx!X^pHY*;4II|GzPXQx5cZk1WpVBPkeyLBF^@nRtRPCT{wwHBDE5wFbc zLw1*^*p?%})3kn{qJz*KnF&^k4`3d)ITSO{YX>z@Hz!y^@_B+G^q?#=v4_kI%2uQC z#BP0Q(7IGX7&o{OlAhg+{tmhCI2PWg?jc)x7A5h^%oFS{ZXyw zv;heaC9dNSjo);=aEQv%r<|$gAUpQs>h!}J4rNkzYwDz(d3Wm}46py;KePl%JwzfO zsSK1dz_*94wAi$Ib z<(Bc3s@mkq6n030t(fk>jXeC1`k^ucmdB9O@f> z@V8nS>p2_hg{MMF>(ceJ@zJVMp0a@+`q4|tiL#clE!h+;__0ogu`Z(Mi|E1bN>H!Q zcok6%pXOAt>{!;M6PEYL>-r>A=kRu+@6o584<5G9u-F0~wvB04Scgw=EHh)>k?X99Wy;#YENS|j zOn6b^58K}*b2(!(^sQM1i~362)4XFgr)sl=#6cvwX}=HVHKphIx?EtO{E5#)F^LzL zi5G=X+*whK*q`TE)fTn778Azi?7D;)zbz`q%=lXrf54%Y)Ln2mpPM-& z9X0#ri{A{p+zJXN{%T{9MIJrJYPQT0vusI>&V35e%bq`mEQe<;hx2*mF}i*Fw#Y&? z7s;2!-DN}BF|WR%OwG5_*FMWZ+$5Sk7iwdigR;PS2g2Q$cYlrvAf|03o_UA9Ce8=y z$)2gM6V$qOCE)GPZYLdiVws6)a~59Kyj& zb%1QS6X#>R&8;?eQa2sP=RL_6Cl?*AV^*N4VBPCei5WKO={K(2Hpt*Jpb%hSzU#rE zqCe_x=(lWRuxx(T@&$Ic;@S16brnB#xe$H#YHZn3;QWE1=RunD_BR_F*?MXa7#;Y{ zr=e|}3tOs}oey$7_}815hI5-6JJ2}GczwHw;F7gy5I^d+pk3HUWM^pk-C}bCZA6%K zvVCZ(!KbKAe7$iJzpdX?%xHe=ui4b|8xB&ag8WhYh@(Gn7Pn~lXU+J3Nau*#=mpuK zZrtrQaaR}?dV@NmLH_(Gr5E#ONT-J;F49xdPxL2{~5?I}@P3@S0`1daa&tKaZ z`dp2lI$!;;dqA16WLK&Amv)L*cQ03<_tzK#*I4@axAJ(nubB8r*W!KG)pge=ITzRh zH@T4DSh;UrEkiNnv3iAXWjqE7RO)$Ded)l4g;EgeTw}e9XA6 zi>78Aftr4sRzp!_EJ8CR8846mvyRH8N?rMRb+0$j zA)>zQX0liOgsJYgW9;Z93D$l9ve3yAz}vARz;uN{9|ZuBys;(Tu>Z{hmZo?o7%3V{ zbWRB%HB_djB^_f}hu$_B38Gc64;jNSl1O8<-5i7{AIj$tv3H-1)nf-R5)&pOW~dy? z0Rc9Qp#-XQlVG0nPbssJdqc5;0MH&-)mkJR$u>~575!i)9R>S_r~=1ou2lJab0|~& zQm@iL9@=G^-r4`(By7Q(SAYRz^ z9^dJBjzefs*8?Po5kdNj6!e6hY7`J=VC$)B>udoXfn$klLd?#s66Hk6gvN*0KHo|l zE)DKxY1&v{NkL5;Rr?`y2-|1PsmoG09KDZA5C`lrzb#wq+8W8#fAxELetv~#5rl%L zs1W3-PVujW*AOb^zrwMLi|e`@QoqT*~Ew6qKGl8qpB(GX&Y>=Em}TH!dDY-p%n0 z%T7jHA<6vU$XTgZ{$xGrF|i1OmA4 zqRuum3*e}$Z8DH(WbY;m3{vQaAu3LkCTL;ArdG1^X0XS}xXK|!2 zIw?F>rJ5^ye^wa>nh)Q%awk{2toYcCwp|3g<8VQhxO}ukE&Lj36EgX=&E-+j%1S3hL6@*!I{7UDXS#&dM$@uz9TenE4bpHsV{eVwQ6v(@fXcGxbT$MnL@^Z!NN zTSm3P@7ubR0!3P&P+Z$mDBe=sDN?jZDGmXOYZZ4VxNC5C4W8ic8Un%H-AOL*+H38- z*E(n4aqhlnoH5QvK4GhQ>;yN{ze{cS^v0 zU;pL_?#>TYHN(W8i605FzFRR-;II59l89JhkS%&i z@JRgo{0V&xER3n@B~fe^f1&z027@8xYhQ<62?~!$@1Zto;%9YCnfn+FWNs@sj;pN` zYf%w+%Zh~79j(HQ$Lw~B2@=gt2|{-EKn@JFr`CC$c{w3Lhauk@)h}X?5do2mgMAXI z^?c#7eT=y;^@wSlCBH6G#+@smWJOA7Es8SA$auTPcP8HVJ>-kRg5qYHHL#l7iegoQmpmpE z+n$%__3+2x24Yvj3DFG`U9>9ANI>f@$IK+r`U;LfLj|Kdj(DoZi=sFOi>@?n47#-D zpEcfC^rk)6dBUf`#9e>Zc<`vxpI@4F8mATeN>m2gjDO4y|2V8Fa-1&%04jO=RGSUU zCH-p8D@Y|Q%GxIkz72OsJrgkh&h?CH<>@64I5$WAbgx(RaOF!d+LXlkQv#_ujVW1q z<>DWm+cJ-jgu_i@GlZg8#I(^z`5D{n6{ZTNzOS?uWU)V9CQ0*xc~+)8Bz+H$A{qVx$S`h#X&g{x%ZI~JFIaPBFQ>SK?y;< z;8^QD)}Q%|DbrGGPBS93EsCr!!0a>i)JefFzYgeB!ZFnN#wO4&xkp&T&x?UMV=iiP z%DQaZPNBegkeO9nBADT4+Yh_nh&M}kw9jAWx5yc4M@K)qh;Oslv2Ee@Aykz9SzD}x zGc?Wu!&Lskf}00q4+!Dp^ntbH>YMzuWQ}@EP^_|QyZ?Dj0cac`KADFOVVpD_@7BukBAe1F*<7A94~Jb5Q@hY0Y(C zCaia@X)U0%h;{RtOEY=(>m;o%3?q*Rv>jzK^*JPMCF(N1Q()vW_WE8E2+&TL3_bIH z)Eo9r%qny+)+G(d(W!dB>O2UDhN} zWrw#U)EV|Q$PZF8l$s|^%G|GBCADKv}+ZqAX* zkmm|1WQQ9?xOj9oQF|O<0XPuswCuB#81};EX-A3t6-v+M4`Ma<069|HoUZ~?2Z<4d zIlNqN-$IEcFg#4kI!)a)0hAO!)PAun)U+5Jlg+q(NG(~-Q9-i5hQD547RsgBOsu(v zd!%s0T!t}mdX|N_DAZx|(bQ|$J2R2UWttLjaXLYdX-L%88&&S7@HJ~kSM8im>_D_P`R6R<2B1mcN^4W>zP@((l6yNvKzgOKVH;YZd>{r;@Q*QP8Et;~4Bgyy z4ZGncAyCd*PZnLPHg^4!UNM*!u_THo98Ty*)h>sB{UKzl zDJGw#9RIA~d=-bRnVawhw8J}}3Xl6N^3Bshf%xwdg-68V#;t|V>$G)CGQ>gQ^leyh zF%+f90ZT+)0dICxyVXNGzp93M4H{W5rd!okrPc;6s9k&A!NuM2L8^mWy@Mwd7nSpv zo!heYE4;Lg>!mBU1iAwCmQLdftL7Novd1B0CMTtty8;d&nWCvp>b{NaCPHc7B}c|9 zrBah8-acEwZXpT9iG)=%?7TiHz*W&{PvPgh`BF~Kf+s&vIWdt<{Wv#;KAE2=MKv|{ z;T?m{^^MNc3K5f!oK{crJ6`!?x07bQl$aFbEaGB9m&zE(3(b)7ek|?y{3YRWm(Ga< zZZ?zhj#S)en)yX2AA?Th`Y}X}g840Z7KL1m3h9Y1wp=7y7)GBURcA1Ea6myewjy4b zaI!>G@ZmA;Oh+HvEB^G!f_Ds*cH=mqv2x+u*bx{$VHkMdZvEvtVp1oAZzcLR`$aB- z<>EtMMxhNfSW^CY-&VFADfE(Y7A?743folR#poCx=TjVtYoJ94Lv?JV9;<@&c5t9? zYC&q+fnk5dZ}|lEoW|5Jw{Zx#L5lb1z!P-o+9Tr9F&|aUi4jP zC|htrYG3dX5pz&qsp88@w}JK~;ub%#F#2Kb0R<2a6VnfhgSBG6J63~nsV0mH%WpWd zp_x&!?LN=@c58Ys{YI{0N3L^5ZaO23Q>&fYmG_F?>I=|rvgLAQMg9?>#knFBp6|L7 z2DeZ2@;*`)+s#5R?mJ?muBnfTC4Z@}7v%9#3>D3q0vp*KA7Ktyr?IqO6G`0dwDWagB{Kp_wr>)arG(@$9cj`9}wl2@`>OpF6A?v z+^W&}hZ)D}(s$ZpPL*mO+v2QI- zi*ny~Ys5{3^nFcJ#nbY~(a3%3I*O}bi>GUWiSau08C9t6KAzFD>DXt`^u1s}hEmm)%3(%L^xjx-n?m+u%{c zW|{OrRvOo;q6_G?SOpTSeMOw)dhY3ViG=p#N@v>YwXM$&pU;nAB1TCNV{Z`SJcz%V zx?d4fnEFEVe%@Y)nK*s^ny=G587(9q<`D$xO1Ow2a@67w!BQ<^`OU%#&%$b4-VDuq zF0F;-j|-dr3tMpu+qnxnwF|qLISx;bd4oUvn4Etr6&P~ zkaL5B+$C)A5?=Sx)9IyW8%trjiv(ti_@v9v8JCH8mx*PJLdF31O3S1U%VYt|^xht70;%tl|3NjB6ix*Cb_3=t#d|Os`5gtbGbtlZ{`ywOz$cTT|#>Q=DE? z3NR2h0DQ(;SNU60H=ajY|3kb`TE9{Bcbx0*1`_MN%3j9ezl#?}W&R20ns?a!C!8y<_~74guA^>N zPIt6H>%*3-zZ*ynp=eLoj#@FuY>wLgOYs8rzZpo_PI?*s2b}A4kbCBTz_~`H{^mGl zDm@$jyMcuLd{X@{@q(6l>G@ych4UH1z<(G>Eb>b);5PpaoNK^Q^}%sGJSmpyc;LMG zSiej_5`;Pt*o21Cj&0``<3Ha`Z$c98r41Yq?&kU032oQ>f(RY9pdc!T5WIAi?RqLt z;p6_-Qq5aK#Aj}2Sjz@N=i?tD+_&KNbggF#o)Io5%f5##*K^qsE$5Bti|#jv<#b}_ zDG$9#iu1*EF^c6UUSiDWa~No-x?m*Y(Cb2B>Ha1ViiI`meLt6uLEJ0;2)8xP(ySkn8e}pBR`6#bm*G05(J`0{#V4ANEz5iVjV(%v`Kor=UNhkAK$q# z*cjq4*9CUqk*fGp&l?gLk$KQmW}qFMc!8XBxgKPHQx%e zVa$ps3B%EjX19W+9{`Y>eKl1yrC9ZS0BZ|YMuLX(Nat(Vz-4|Pn$2Tbw2VvJ#SYHL zleXpqcJf(4uNCgPU<;gefS2+M!raDv!QjrH;kRSIR>1+Eej%S~*IJL1{dccN$^Y)_ z@pe}1Nv6dL5VH{WD&$@FfB1_ER>Ot=&5(Xg#r%=fGDjk%IYHbN4SOxiMUA>J&O%MY zay{h+OikwC1Wq?)bq>@V2{?v1tEGe!D60Yk~)J$Uu6)dlyaI@^lYI^2If|0&T{uj2)^ zc8$x;%OUzg-wzgB>`^^Pknq(pB0ryx6Y|i4UY_bP=cK!LySg}Sf{p-C*Z0WU%SA7A zQY|_!Y$B%&pEI5yfDe`+jLr{F=8E2zOo#tv0F@QFp+CL+Rc6qO=-%ZZih#tdVA}Zl zm4_iC^4B3;S^TdDQW4_23tq}s0|Wr>_~qPcm4Uq_EgGq1<0|HlVt zx1C}KIJuxo{04mZ0L}6!Hj+)Ng7Z?Wz|5N|zq;i%K@J-@n`wVeg7ec|E||B{eX-=X zK#yyGMrP^%vv-F)>ScVM;SYIWeuf>3RerXIj#WWUo>fs%LD`N~aYY)6g|)aEqGMfB zvtdgCwAsUD?eWv`wP)wQiDGM*_0*BbZOf@d6b z_v)sBo6HSc@$z=n+djKx#ry5W2hE3R3gyk`Y3BBjjh$V4DB4UNCj^7Q<_L=Zn)MtjAsW$~Hf`$-k8RXd|IA8IgD$qIlBBn6IbO$C^D~)sIn0T|Mxj zLpXAfZz8pN2z`0JdRXj~+G|Aev3|{{6q9YuxGd-X?+Fzs+n=E?hkAcTHR(V+6S`uE zKa=W#wzV*=n9|x=?B`+If1Q8cxa}?`$NAqQwvGs=#Zt!ww?ovvz|Lto zh_1|OC6x2PX*E)e!+9-M+0J=A5m4s5k!t^N{xdu|T()u|>|C}B(#u?Sf}#62yA?eg zw|g}+c0#}DJ*nUKG`r3pcSA1m?~WQ!2F*u3Ps)Xln>f>jPf5f$-A_k%X+_Q_0Oc*` z^HdQnb(cN>clVVTPlM(qYr*f=yXl7zr}Z9a%jN0oi2M67T-+8j`k@&_NRIYB8O2wI<`z) z<@)v)RY(3Dp_$ma{F3C;Dggi-BYah-4%&mr0I?b)Levj_LV8lwpic~0_%U0OjQEwo z3ZbtE(q*NYbX0*dov(;$3p$w%#zOS`vT)ker17JpRJ9piQVe3t5ZiqWwG3S)oqOBE zG5tLJSMxWD?Zh5Y_*jI~T{it=xn7Z-#O=nUJvFT_kd{{oACJv_ValRhD6igF6<1-B%cdzepgBAqUmKcR1k(^A!$S}??XP0l9haQGOU>q%-=U;=W_ZtnwOP?kNL$f zVqHVT&UE3hL)9thAe2dXlX=8t{4~vZ?&JGi8B}C1`}<$0&V2EGxlwP*nhb1_f{(=g zDotUhnS@~lQcUt=Ky-h>%vZhwU9T|D{cy9h(3uORtXQJ0`g3TX6_%>>kHYkL^d%Q}s!*r4 zNXxcRwOU@i% zZ@a9-M@zZj084f6yK~l*RtsZC*nm$ENvXd3-q$y~Qx!57Re-J%(+>l)LoOGEvCm4) zB!qN&9pY>9dG^h}hQOyjgKNr__Ekq%G(%AE3vm4(s+mFXT;(;`1}dWa-4$~o^I&y=lGf1q_@LMW;51x@Vi!5|DZ_ewZvVnz`ctUZ$MqZ20N$AjO)Th z(M-#B7^mx^0^qvc5pq$=>2c}0h}@ZhUO#*1iBd3p^w_Bti{qUSncET;E36GC{GBgK z0qA+R+6raJ#yYlw!AThce@>a>{|cI^^YAaHBwZHg9h(N^5rcLRoDxpXu!f@Abm>l3 zKPI+in%k>3@q-_c&WdYvc-Otsv{g|tp=%G1^L;9IKVy>=O}jTP`nAGofKOJIpMY2C z0lcz_cwA;avCj17q_WA6D>it2uTewB0UwgqZOjC-XNRr2Kct-RZSdbZ4||sV$~Y9> z5+-vQ2|W0aLB?(&Lku4a2;k0oQ@SOidoz|0{yUGUWm`UwL4z_*ocoillA8I%BwVVt zNMUH_OP%0Uxj}8QCJC$w{gh7b>Pdp*GuTo|Wf=tP2WNWFw-4ym;8wf$L449Mqw%TP z8f3UZ^{EW&hl?3Wzw?sXAzN)nq3NXsa9t10fqh8ReD+{f3L(?t7pz4(%AFiCV z%y`sg86VxT?V-n^?qcxW1_ruq0M0eKkdM*GXLy#jDKENxa#sYnajL(>8J#D+-@Wey z=c^pLsCfe`#=3^?1v~#E>9^%;oZr%e|i_lco*kv9+0$F+W(wrb`3!Scc$A6TMCIZMW9t zpPxT5zjeocK78{N$>hbX<;7O-!y)U%S>W@I-WG4gW@B{O(y$i^{ z6_E#(6c`t80ZX@na}$A;Z-F(~A@y%V@~?o6P9ZJ5AzbIdyS|J@4pMYC^l)jc|Zei*e<4bqm#i??=br1u;HMv74q;k?66gf@b$N0+py3rSoqFX z_}*3c331k!BNynQ8d?4v=q_w0@1IuqZyo|8Iz*lHbk?`MzdWw_ zj?+qtlQHsrpXh5a8)q2oYt$EKtQ~LS91pOJx4f1#QHkNDFklOe|0WmuojJiuAmQOf z-NiD&ts&kcDZw2l(NoS;M>|ng%a5|sETAC~$5KP+IwqVVDN-OwSt}{RGATMZDb_hD zH7N0nVc1zoa3Bal9XK9kX%NQQX!C1q@7Z3nNk&;QsbP`oRrei zkOHAdZ52qR(heXeb0IY|f)=I>Hlz+Srw-wOM&wc_C_t0UAeb`Y}&zf+7U(ii9mY!L_E1Uo*Wt)`q&RPnRMiJIvQmLx?lzd z?w>Et8LCMc*o_&u@QkN78Tgc$4-71ki)KBe3mW|+R0ZZQt;`oUnY5Hy^nzKhbg~#+ zvKW)I-Zp0CYG!cUWWA%z24~xJVfnn%{JCzL%@UAJtd%XAoGk{=er;|bET1hYC@D-y z&Fq*h)t@7~lcR8xqehwg;C7I9$yE}})kx0$>XM_MYz(lK7$*~vAb%+u1z`(~AA z)0k(+lJ`A1&!RuqTqoa_GXFPjjyOCXHTuK7DBa*?z63Deswl^SCC8qnz}Bk31(jUj zyi;H$U+{~v5QtkC<5C#NQkbMunCz0DdQ%tyFN|+2%)~8<)hQ})DJlXMrX?4Z2o{w# z7Ui%MbLkX=U5e}BZ-pC*EjMEzKu2hQaqEkc7Tl6E&vD23`5PlEX7 zy!oxG1)8e8rK=_IYD9HwL|AKhg=)l#Yu+i;$llg`ZmJd&s+D1_m2<6CX{!0EQ2WWc zR)3(@fC_9V1lH9B1FXTuAz%|%uuTfswh3%URrg(}&ME|~SX@n=P^ac)jaHFKH3N1W zs8%hm)t;;QeGC2*QV(RU3m&Ksajg%hYKRnS2vcZ?&}~R`ZAfNqNE&EJv2IACYRnL7 z1SvG8&(*V~G!`{AmdrJl-HJmA(V&I|U=^-fs;2UkrpBhG=D8+_?w_curgmKtHp!+^ zLp-2BbAMCw;9T?YZF6!^)ALO0(cQFhA?{l1V04KV%(fPc<(9{&N02#J!WAmCbyvt* z3Ixj=vRe#6>_Qgtpv$b#)j7z;E##64dMyOK)rDT<~U|?^s)rRIOOTtxxn?v71|Q z=UX=vpak>K=ZdYwsjVb~tz>(xdkSq-Hf=PaZFD7Vgw*X6dhHBu?XOeYi9*|1OWLXT z+G(G5(6e>Cns4X5Yv-fx5D@MV((B;A>kxd}Da_U>O5G_V-1$kbQ?|KNe!i1Yu|s*j zLshZ!OKRuW!A{M+PBz6ZU7Ifb&@MnpmkM>awqCc1TlcrrZne;E>ymE0y>3#ymY<5v z{X9JmZaq$^Jub~XZu31JcRgOzy*|Rde$=W#*M#dSa=|FQ-q88p@Vkc_*cUC_7pvD7 z@79-?+Lvsj8`9jDcGs6d-Jd1gpQG2G=hk14+F#V%Uvj4sX!8a%-(Mv>P@^{hb{mMG z9;j~~Xr3Q{+zqrowQr;z?9?0Vb{p(X9qex&9Go89iEbXg zyBk5H8ATTv#n2zcav#M8jpDY9K1Gb;-;WZ~j1h^9z0e;cbsr-KjZwCYQ6t7^@5ktA z#$SnyGw6>qx{tpFjkC0jvmwSg?#JKJOmK-zaHI4mc-<%XK@);46T*lI(fbK;n#qqM zlT!MVGVYVIph@|bNkzou=le+&nkhArDRuoR4fmGr#p`9NcG|Kr=2aGj50(kNX)f8kmm=%ugQ{;0_A{ z!GJBWPy{Ue9u`S68!a*$t3Mm>KAQ-dO>UV@Ma-t%&t}lTvqa!I`tUq=cmW7r)B-O- zz{~F86*O~IB6BtRb71$mdeB^B%Um;J4st)&N;BUsGT*5`-|ar%`|v5X%nu^whwtY{ zX%OQgh)I3Kv^xR@Lcm)P^9aNO>K?H~v#=tvu%^GT;l8j1TG(k>*h4HF+%Fu_ES`ug zp6M@MxG!FT7H?V>?+}Z~`$aU-q50yeM+Qq+9*d+Gtr#9lPZyT zKQEJ~EpI(r?$d6kL@qxNyrc`ulTAx6Jyzc0&r_$R?xe18AXf%OR@e@f-x;j(rp>Vq zudsWp3NNgJpDja2mw)W7N*S!>f>s3~t1^%^MGiQ-=<3IXH8s)oWYE$E>niu>bsflh z2>U9Ea7}Y~-B@%32wEdOXf;XOuo|9Wg|sk2Honttnu#oFeqQ3mwv!>-sSDd_$n6Z; zoh;Fv9D|)akDY?Fog&Ci$-+(1P*bxTc2+Q*bJN*b3 zdh~Sh2p{$DH19E~=P`NuF(vevdhwVRbxcop@=EN40dT_jH=36PdcwAN!ht$@M|aAF z5De7qu%17+V4{#OWc@>m?1%zIOE?$MBt|IBKqs6Xc0oU>W*}H?f&Y-)=61&L(+~j%Q z6r|r2L2pVHZ^}?N6?C^%Vz)JbTd?PCefn)9^tO5N7J|BMrMqhvyXyqpb$j0Rrr-5L z?*<}dG#+PZu^yFSE^;>(6&GS5F~UJ-XB2BrFzN|tmOt@H!UtCpt(5`Ca~chrmi z*StIbi!`tHso5|{#1o4~=geX}S1DZvq;qaHUHb46OQU;X1FuEdE_Q=-FYOju+)-Gx zdRO09y29u_rRiP&+!z9h1=8x@{N9-=1@xrp-#Q#1T0Ec78QlF(y*vB=70pX#QX%n# z&hOnv9HyL#k9eG&?b*3Hrb(qV8Nlzo423DfHyJAX z&i9{a9M>v8(RpHU$-WF^sFHmhA;l&4Cc&gijw#)bOP)DDr%Il+ypv0Ty^hTakK^y& zonIVi{eO9PW=yJ;GQ0@4$oMvMsy_=IcAmb(Ia#Y#7DHihKL}~w)Tl@j=pUizq{vKb zR6o)AbF0ZQ<<_VvaCUKjQQ}*#`Jya_$)m3N=}oQr7iDRluU|DyYrkp&{CPCA&2wut zbnUx%H1!?VYc&C$n7mp>fp5TC-y)=WwM`RD!P@5O{=7Pt|Ki<&V)E(z=y_A8_iIF& zPyf%1X`Q~~qCcO3^JZ?Hf$L!xAHe-`y$;}s!sIvfe!^I9=u05OZ{$yAR&NwY7r<{E z{6C?2qdqYI(#Tqtjw9dEK)YWO!o;lE3tOrWW)N4TvT#`B7=W zi~^{Q-)08B(&2v<#9*bh637I$SP5ZkuU`penI_K)V_qou7A~B%l^yaP>un_a1)-%$ zlq_wbNwgxzwn>bND6?s-`e#eiI4y%h(|A3*ZPNrp4`#DOlW7No7onl|I~Lic!t(Rkp`R(YbK~V* z3iDz=_HXB<8RJ^zW(UYy&;G4 zMb(ZxTWK@WrKGZ-SE!`Ai}B$Bd<+YZy=q!5WWQ=$W55=?U@%YuUJX#NtD6Ic*fngY z;n_89bmJX1?@c!yv>d`yI3bG{#Rm|y+ugF(lO2V3E#X9K)0%iQT}QeE5hU-w<7>_z zbrI^OzV9Zoo`2u-!uPJC_l0Nk@k2B~&DGCZEX*~)*`)V#fV)TUbdYy5^mLebcmBf& z?c&|(sKl)v_b3A~=xj{BBeZ5hX@I(RR8h0#Y)VBJ#51jCjo_J4_qDBoDSNh@&zj}a z@WQQ&MR@1zoAe##e)s5K&O2;|)oIQtp%M^3x*r|X{qoVgbX*J|4(E69<}~16_2u)p zS_6LJ__t_aEtLt6ZOyR-f;obC@pALZ_6^Gpv3078-gd9{*&y1O3E zw|BoPAXe9i0kj>O+{urp=iJMz0CJFrGh!&z30?*Y!$}Mc|HuoI!4Ua0Q5=Iq#ryW# z(qkHO3G9niLW(lGyFflOsLf#?s?xI(;MokNPnCW#WBU#iNRrzaKgvn!%|T?a!tWKl7}+jHjrTxJx2zX` z_@!B0o`(P?jY*rZyXoMs1k0*oDLreuxvP%D>_T7X!1+J%PpgLi9?YgW59$%Qsf_Sy z&ZfWS?-e8Eiu6;=c}Wu7D=kJTT-#4_^M6%N^H#H1{qneleW4SzE@5D1nucODnu|I=6vIx@)@ zo{<}I9G*x!4>cD(EJP{0-BhQet>=qh%8h#BPi9~~v-n6*q~a%7lSyb=AVnrW7WjEG z>pFBq`n8T~xbayw?Xzu}PjJ;}pUIq8?1l2mjpMOZXSp0<%<|@NwdD5S^rkPqk@po$ zq@JAR>pf+8;VQ45fj?ECD_o=!(?9v1W2#U-%<7Bdje3zhNfA26E0SyTsluC@B0!6k zW~KaeWin5R0XvJ<6pKbp{8XvAskKhjjmCS9op`6IHypNwGtDRG<*v_40GM+#?dT2_ zK|E|m1jYRu@1`Td5!NQex3Dgq_^O1jY-W7Lv%?zk)#>LpW)#Kme)#-KEf6WSQW}8& zESs(^RkF1Ku<9aE41w>tW``JCA6AR848g7brQfX;^x%|y^z^3UG{dDi9jA5?M~#lnhwS!lBSMR3(~d2d zww!L4tN`Tr4D5c-|Q`6>pHcQmA!L(d^C?$ zt=T*=RS_hX3Lqkeb<%QF0+pLrUQ}OoafHA3R~23*ogwe$i~kW|+5C;_lDtQ3`h7s4 zurVD0%w0#Rib9~kgpsqsQz_siCR=fxS$DQiEB_4R-rR&_#$;>P=wh5-xG zU&#Z_8y|`vq5+$L>XcQ*O@XU!2C0jxt zZpK2wYqH-Uw&W#U#uLHZxtyijiob3qQt)d*W7zPq=8Eiv7sv$=wphr>j;nyCXlL)aBO*JB2>_AHVHZa&t1ST9SW?mL?0g41r$%Q|p0SI?}Y_m_Qd zaJzp>=x3ed z2k-IATJcj$^izlVeI@tT#P-)I@YSpL(|`D3#qY1dAD|^0pu6R7fgND^Hoz1XU|taL zy*I%AZJ<%2{~wD0$E^To{y>NN0C)00Pi&9o9Mb7HU44n5-#>z^GlR_Af=p1$LBOD( z==z{wt>73~P`qq#!c|aGP;d%)a56bC?JY3%DmaxNSfB;W!3Gxg0*he4hb*9K3s^%Q zQi~l7P7JB94*~IqG{QpautT91z-HOdcCFCjdWv8sLUDRxA{FO9GbC=BzG#uwYLOVJ zPL7ZbyV6!CpG)1~gdaHc#J=55tXt+O@4~@LE}fY!44L6*;?z5Nq);AGxU6%;CtGuM z=NvQ)rnirdVYnkO+%cz6EXz>rq|jdM5WMXNNk=G7U*wa*NMh!w=i8Aa!BJ#5Q7;;z zI$%-smQgPYqh9w#y>gCbm<3W_0A6-Sb5IzvGh^nB zZsg5wVNFJEY?2gT`rX?|j>v5G2LcvPxfzepiYL3&8(EL%f%&*v61~JC9;=Oiu^G1; zmjLay{^RUp(if+(ov4kIq-kR*E{ z`F7bdYud65$Et)PrF=H|AswjFPN|nmX>?9$vP?-Vo6a%yx{i(Qy* zVt)9eNVMl?sZUp(2d+s{=pXrPI1W9+*tjB*`);jPf$535be1^*Ig>H_PMc4G#X^}d zMYto6eIqUi(O_?JV9qkWW=>NVpq8YR=IeCGcKRcDItFeAx=RM8U|(>Ov)np_9*JMKBE^;vS#9c#Q*#e%0o3jr)4Bw1`x~1C(;-E=EnfszK^9xHZ zxlXQ@ORkQN)wm4V4EXISY2Ia?y>YU=seIlympoH>zt^gy%M@v-BcgB1cIMtLM$glB zw|u~87;~1SCSG9+a^W7A`L6JA<0v$76=%aJG&Gb~K}rIKi%Y?|7U|wJ?hYfV?r1@w zX8yyFsJl6yE`1vKJ1D6R({0txVTZ&Cm}i!pR|YSt=r5`&$}6|h^XdC06;LdVWzt|} z(!^o{P5#zSY0?2NZl)~hOfKohEop?8JiH|J;Fb=u=szB_-d*>8*zOSF_nFK~kS)@8 zr|^A||HBX`VeDms_?2G6M(KJ#H5sfF(p|a=H|j7dr6JEk=#1_!SRVlGh=?m9N(v(Vk-AXDvL;iCv?oWPGSXHc& zRgAh-Z(XZcQmWXRsyODV-rZJlQB`vbRr8{BtNC541yibpo2o_Us>N@sKT_353Dt1T zVF7;F3TaZKBCC2D6ucT!FGf?LZ$PF-wLW0o4S^z9Vfe);^&*Ay6b^NwCh6Ta$riKo z>j6GvAufz0G?vD~(1ZxUOVF7mc+0Ftx~a}(uFmbY&V#DnOQ_yQx8BdSJ|Lw&sHvVW z#pB?zK9Z^-TBspbw;|rOAu**Pxv3#_t|9HVA%m(hOQX9v9o*rUaJ6_-5XC`@0-v`GlWO6MUJo z(Z@=IE!()Ai???Yc!CnxQEv%tnB#Y>dd;c(EN!}DLc3$#`r=djqC@*qO8VmF`!e+6 z3I(_%U;Qf2uP+#^FG}q%Y3?tZ@2|M)uc98P5gsr+CP;H>eR&F&TS~ja!B{0{b`MPJ zdQ^9YQ|l1uOoTR=(m!x8i|b}ZfM^)Zv0Kp z=?Ci#?4%CwH4h)m4rQwS4KZ?|H;Uo@ z5DkoABS!JqNAZV73GPRTX+~eLkC8tcBYBoZhn-Eel|^sc1mR7j+={nV85e-zGV^D# zVaGR{`8FveFue5RKsk+bW%}GpP4EE6(Y;GsF2>86#&AGmWTj(Lwqvrkqn}DAWe}6n z_mgrWlb>m(o{LN=KAX~1nj!&B>48S|b&6{!i;YBz4fUsuZKq9IC_9e{$ZT3sO%&*g zl=~ryzeJ`T!loVFr(HnPZlIYemtq%Z18Lts;Mqg4ED$`e6kgB*FGIj9T3}Tovn3*P>GyE3 zKD<(Cu6}5)$$bu5I@jP1?|25!p-JqaneStd8DP)pc89SRCXBJqkAUW<@8>)B=eiJc ztu2T)6bOMRMXb;)tSKSZpDk>F7PeXzYDE@y5DS~n77vFIr}v1Hp@p-dSvrN0)A_}_ z`$Z(p5}N1|y1|lH(=>Y200v|UYhmdratWVynNW0@$Y9y?ws}5fnG&*0y|7IC5Dn0- zyb@huFj!%Hhz8PDSRgBGWy`(=zzp)$ccQCY2CLj259z=vKV(&KVO1EpDoVR1F1q&7 zU`@(nO(tzk7P2P4u%?Jy`%Js8BDyZ{x%F}8l3Ln2L*csK=XHaHbwlL3G3|zl=!TiW zhK0w5RoaHl!*>jWHFfI#)VsdlqMHr}eU2QPPLNHPh0Q<1o1PxY3oS5Jxh)@$tz#5u zvE_;v`G=U_XRb|+tSCl9hy zFuYT=uv3BDsY=_aIoPSC-K`Vd1w(f0hj$wnc3Y9V?Py^qqHDgQSYk&w5l1MGBaFi%Jk$~H;t?_D z(Np_lBF|$?iBiU@f+wdqw)z$`UzXa3CH0vJHaU@3UK^k@wk2> zPwlQ#HuY2(dMdiuDMD~2hMJa8K9dA=%5a{^r=KZCoP8FH!uHsoKA2V>=~SZY`V?`l z05}(fp6hs?YmA&rb6#lET>z9X4D2tg7SEgiAnX8$@2HEPbeF%yE*$`uPM()8>6dQM z%ZG6mFVv+E-Ibr%RRG{B$ny%AeiaJ63SYd6L|sMGUB`-D#{;etJ+G6~uT!DdX^Ynx zsOv1{OIh&YwZ~zB=S`9QO-cD-S^7;W!EHJ8rkd`yhV!=G^R}&TS}kJ#Ni%bU{cSto zwv+CztNgaZ{;ogbt|$F&5PCOEcRwU{zcfs%(=w?RHZ|*cuYqd0*Vmtd6Cmg5kh=T# z8=S~R0CLL{xwD9bL6Jv?NCX|~kQ22AKwXKUF2s;`=}5FO`K4BkN7(q>P8AvL{^EmtW?^baM;j(XwOLWA05l3k5b{RWS7O42>8O4Ggr8&d*t zG@OUUa$mfe4DCkq-G$l|vO|Lw_iN-i75R~2n?DX6Z>p9#ni?LJn8Q47l|*kCvqHC< zGuOsY+-t{;JAq#o13A(O7bVWWttN_810CFT9BkmFDBJ4pXSd*k`3(2+4Vt^l-Q{XW zvT_6!|HHb<*!sW2Lo6G6WSfHb)frs18 z{(f~20Sbb=Te>gb<+GT`19L1wL!vGtEfP1WuH;^$uBqu>`&G+4u2$odeJ!_!o@y6Pr011yTiE83n)2b21Kj z%(zO2gN%CW#ej^uG>&3rbT)}mkhwOA`(oy7nxGqSZJP8g&)F=6mGN6ls^fy+3y|mV zta+L*){S{)h-mU=P8dh>R;H^RYOm$GZn&)cQgeaprY^vOFwP`rVYPPSryb!W)n-je|?0m+VdervVp8BMR z%#r%ImpNhnq>ppc?bis;6aC|1N%Om3V@jN$vwmewkzdmQWtxkrZ~5*HbNYNP5(vl5 z7RN=;C!$WvflLsm)re1`&g%*0qE2ePPNFVb`SuW(-SQq$*ZsOp$nAjy1cze_C5Mit z=25vxb~s}Wb-!E;6!W;=%!hj19`=a+>(Ixj*App2bdq{;EZ$LX0zX5HH(M?FBDOwc zorYMh38LZb1t=2Lsve(@1rkK@qkc?MMz~+=Kazq+{W<-No|^JYQcjNs@HM}@(kp-* z{ZI~UTwOl!&}ydN84VhuGA3|N=tQGd4IZ4BJXh145CRiMUX)|J$v_+yI*AHqX2 zfo%X0k>SXy+z*%W;uYzy{o=acxtXx^Efq}#za&pj=J9n|e*V+=CGFxYai6>hqp?Ux4b6~v*t+Ni z?~kedxIcJeHBXpJIuq-jmitJbS{gKwsdxpbmV08_7-9-(wUbU)1WMZ&lkAFSL{BUI-CetJw;pD`hdXtv?#ulXr%vs?_FA7df3_fgSQ}Vy0a?PjL>1xqE$x!z!uFsE zs4i}ab(e7t)8m6z=WAF2AM7FP@B!wVY0=K^jlnZ$^Q?=XFF0Maca5Ea?Ybz=OT8p; zw!uO_^e~dR!er(`el|ZKwOrkmO%a?)t-$QA7bJIZa9>bBua=OwFUeAjNl(-&9yr?(V=o;`~EScbVC|NZi$H=IK@ET73Q+?A=-xG&K55il33NzL@9KqZC{yO4@((NF>U|ieA;o|Ca0=s}+Xzk#5c`D4ui?)b_^){Y=+9i)RtebN z;of)`OSA?sGEpz9o{^?DeNVAwOWp}LZ4Bc)W%2prT4w257XMp1)Zlz#Xk{TI&#!Z! z#K;Lrs=oniqdof|mA&9Zb2s)pHA^+GE1a<^G=x zPrk&`rk#M>pbvu~)x!)9$vu=X1mq+q|H@70`4n|8+WvX?iDH$XK9cQ*M-8Zq*Ytj(zaL_my8Xig^}t0C`u*;#Rs3xDcUPFgK*;sG^>i~Vt zO4=U^?xi*a{8%2H+Shm*f04W~8PhNDE>iesFiCMJ_?ys36ygLMb{SwWbDFmpK71k5 zSn{>eulL65*o3Jiok{uRPTa&r(#G19<=V~kxtAHMmxbb8^zl1$gwOYP3;tLqls!~n zouzcDr>%v6hG>UW{saD!8GH?E-j+ls?-g?#XiPAb=|>TA4@sP(x_KK@zIwzt)l3o?*pyiBNA&eonUNem@z$*4;kA8EA^K$ zI&%Al7Nlb1Q;tv9z`bkXST-PyXnPuST^;7H=;bO>M25#ao)7+cPDixxDI&8wzZ!>` zHRc9A_XfRg2E9Lv!uRzP{^42l{j;6h2IduI&tu&lrhXPD6PO#2_AeneV1temaPAP0 ze);ql{iIZUm0bd>5^gz{&j2mjRlr_y2zVk&L1=7G_}_dtT8XbY-qqqXI^1=! zJ^308qraFf335xw20!C5*{%7a*Ty0~k2En;e_v}PY!hdt&WaMOYPuPbM9T5iVJg=Q zW9bp=Y-O;s;K;sWX!fA}p~&&!RD$#~b&=i}kwaVYGY6Dca>J*3@Rao0cPyv9%-()v zhJAeY&-k3;_&k`(ZI(*`>sN*Ea0A*f@>fB9iChleA05xI-=kxxeCwbVUj+eQN$9rO zCE9uYo+=rd*@ekDh@aqh$KGYLS>DwQDiR+FZZbNbOUJJ8N+^o=38e?w2RHN@9p=c+ zC4rDXjUpN%6=bbogWk$o){Vz(o=;snYW*~N<8L>U(9csJu%}=Gvewvgjs1mR{f1u6 z$!H{HN$sWvXoD}^T9yAyAyst2g@jQ)HB;6~6Bx)gPffl0g=PL7+VlyV`JL5#GzB*v zf{aXp1CssXNrMs435zU;hfUgiO@wDSg*2M#DK7Yta)t~zLoPH!VK{RBZRF`wCJ9ld zcXdD=52G^$F_924eSoaH+tjX){HuLAlcg-9BiW9t+!<;24}}>h&~TQ+ah5Y+c4@Us zQ8O2_O`exXf#G&$2Y-YWn91Ki3)s(`!JIw7mtqQ^{i8G|WH=}6I49Ck{JO>_S}-Tx zFelMJCpoVOqsN!KJSPJ?|9?auLi37B^Gb$FMftPJ0rRQ}^J)e2>iypZ8|F3V=Ry1P zTDSAsunRia3%ZmGdcXyJp#=k_1w+FHBPD7+#|4vw1=E5BGs^N`1tgy#a;FN!C*YZr z=>_79Ry?BI=B-XVqDA8$i|4~~b`1;80gEmPi>@8H1F0k|9aDC%%KYPtr^6}$-vtKP zS$JesJ7g7-r|E$nWw-Y&iQ`gGfa-^Dq65D2P@;weg+w`xOb_V)*$BzS_%WI#R*NPkIOSU%KKPOB?4FS zgjVt`m)Yl(^=9RY64dM&ejJr8rvTed%2i9|1&Sf^j#6Zm8S1>?6{cJD)cu914%woL zE;81|r)y=F6_pBg6>BMtf`-+${?&Gna^e0`CXvQh*kv0f)f?XtmRs5G@!8Ufe4sW9!S?;GHMPvtVQWR@S*; zp2bT`w?>B2<>B7-Oq5E zSN&U^>lqqI#HxL5%D%X$4;^1z&-L#=l(V= zK$l4iM8B_xC9DgjjNAbl?Q%HjBd6_DK-6aUbt}ioDZN%s`nSGyg3ju+Huv@M__iQv zy9<2lO_u9L>pFjtry+5hoc|;G5EG{FELhu;(qw$oAIbnpdhNwX?O-WyAH(iTCaz1v z88XA|5lOF;7w)M9?yDy5r`8(u_3vol81mfd_F3wZ;~3&BtbIn&m(*I5=h&}qF#Nrs zN0zz&KcWvKf4!M(h~8hr-xna&p>@@mih~Gb;)s1CEXcwv&$0=}p}p{-gHg6cAxU*Z zWu4NYOX8tx;h|gOq5Ht0$HJlK!J*gPp*Kgp-2kHx+>tNGk)QC9zw%Ll(NUn&QBdGf zaN-d(r0^)T@hEKID16~4;@~LK%a}y(yOLY^lbn7O$8ntSG05-`j4=C|(G=C|*qV5s zFwqpp$dJS;i=gm0{@^(C?pUrt<&kDn3+Et}@g!X8K%`Jli&0U=$n>6QCoA!!r0_(9 zVeS5SWhr4TxluE@;2^(K?UX^+>desFQM;h>q+a>7!AN`SM@?Krp7pqXUBfO9ETv&1 zG22F$pcjP!z+e@m^Tkl(xr5T?Zg+0qtWg=2MDz+pT% z2OVhNEwgNZPsjI0&vYiG!2`mOIb};04=_pR-juQ?G6(PDxP=nHXlY^RuhjmK^bXVp z#qcvDWJBwC9&on9arWtt)&+xlO`rv6WASx;7div#G6D_4E^iisQl$)7aMq3ojBY|f zsAsyf#Amx4=hwpL73P~qT3Rj}TOEF9PXUK;$T}!m8c?DGl9^3@41*7Vo!Sm{x zL&KiRZDr-v8|4dFW1C8i^G{jY8D|zpjpq!37y2C9!j+K832QKLJ7ZwKR#^x6ejkqW z5>v!hFl^WG%|_+U5K((4Bj5ye!Dwniuj5XGz-sZ^piTb9ev0(vcibz|ApIs{Go%f@ ziHS1D=YTF# z7O1rkpS>f*=84fjNO_4Y)P{1t@)=vZ&BOaS*J?I@op{Eez1L;wXtHJ|i+XzqScU1lHA%WN z9n3MESlT*Ja2`22MLA2<@`QRt=;IHx!VEhp1{16oM01b97_LBJ?n)DDh z_z=!n?z{L9dH)cVrRxI!7(?}VgX8M&Xc{A9MuB03-*h~IV|{0O702|L+T@yvVwPgP zujTz{DPZOWdc2C*oFcx=+B9N6yiQYjDkwS$;VTjt*FSDpYJEGAzH%*HH$NtFCRw*G zpLZ^Ic0LfhQ1&v7G=8cRaSw2M>e#(kbzWx>xGBPc88YvuDbMa+ z;6BQ`bHKUUqSmO_m7(?BD5V>Y_nl&uyAH{d9HW_$wyQLX(Z5B<1Dflu`(G(*EQ+Dxt_73ipX6}h6gLr?X>mdkkj1&pA8^Ve(6jFssyJZ3jewZ|CSH3E|#1U z6gH5U)Oo@NQ(o==t%<%Q7m zEMB9&-5PrvdtMYATu?AAA7Wp$2n3dRN4slv7^Q1cO{WhC-#*;`oYkESc4Krrh)zFpXsQ(?vKSP#Zh zIqlEDk8DR%xgv3lmQU;_bEPVER*)y4MX?cyw&og3)lO&(tUdT>;c9n1&X#w9kD0u0 z*PHJBtZj|?I*xT&TAIG4#>#KfzOI~+mHT38XE2V*`t8Tl&B-Y?ZbB z-IliLZIFZX#iAzhF+A~Km^U0X8w6w%d7p&Kq73Uugt@I>NTqYQe_z#_*L5s?g1-9) zKHi}QEbu9l88k>OZA)YOnvjIEjBt^^dnjGVBe_qS$)ot59`rpQ))RG{8qtka91`*I zNaLh1@No@BkVS~BWwliIMHLZ)vK>jt8VSRo(y5|x4nI>}0jZ{?Er2x3)<;0P?Fjc_ z8(?M3YQ+b<^}<87HoTxKKNI8e48`VXC4G zw+EN_^?sVJ4Ggy$$wrem^nNZIPVMT+L%4ykaf*PnS(T(~zpDDJF zwyO1n!lHDX=b65KTAY`mVP4&xp;4qlTrXt+8xK9yh2uds(3kj+uHbfLb4=?-={%#* zW^7nSpi0kaPCG`9%a-4@RuPjvWA5CU*yB~7MI!=TJM+8o`GvU;UE;^3QUYvyY&o7Y zFKA$Wc!jb6&)ot%xb67DBu9m0M$r#tXnSEDV;TLyHV#~+FB*}wlr$TXzV%?65=7!- zpB5tUWSyE3QoExsE9h{q<&##KbPVU1D_c!jN_aQCMaY33F&q+yHC(mg`Q}T6@KpQ_Vq+!*I_pHUapj@t&F5tqb z%SarY!^sC}ljt@ca9^sXs%k%*mJr~(o!5Z2bw>rg?1WzSRDK2iTXWs%Vb|JJzP3&Phyo-~I0f!D#M z(7nNJZIJfuI~-f_KV-XT`yuj7Er$VqO~(OQGTC?+XSpVSUPO5xm$xU!tppz6s zm*jdO!|SCUU}+53SmeeHv`gTt%SPgX+r`29eZ?OiAQMQjwubf_vXv-fcX(wv}Ag%ycprlB*;#8t|kAm5cW=t1jmVf9fx8i5Aq!yVt zL*NfX%p}}@Cd4#J3pZijtU{vQ` z-NO4Jj)58{Q*pQ1TVU2zemECNPmPTHr3#H6{!e{ZN;Fd$o?uO?KjgI2A@XxBO%4>) zmwPO=f*7GbbBZf3tf?G5H3o!~ay2(i$&t!mau|MKQJm-FKY`c_Bu}(x2$rTiI_h)z zUuk6hTBV~I;$>L*l;eFLWEB__=%U*9eJpq=0C01r6!~OC*qSx}MS&!v19o6!UuWP)!{4vX%MT#)djN z8e`nH65os}joar)3di5WTYc;aEgdJs^T7i?Fm}z&mOCwqL!z5@=Xpc+3T(7 z<&_q+oG+Z>~xyfK3|xOl`K(3s|mi*-joTm{&Wjew;dr37O!Xuu_h(>+OiRa{QoQe|D) zd*1;nC&Jt+izbGVzP%#LDnU`qjS^E3O#FppK4XkM)OiIBtX+3qaqhY6qOo4l$RCwb zK*xC9xkbd#WQnxK?ToAN)dRqpN3D9^?%n}&c+yL5C3k(*wo43k2`D@29ow<1P!}4e zhS66Xu1!zV!hqg$v&w6ANGVto0R;GO9vOlef7SDmX-n{@OUyB^oCJMVSD zFW{QFA`QR$GpgBVw||*Lp;i31BJ)QAbW7rq5`c$%NW-zcG}!mK^LYcx|G~#wgtgEnRNL13BMkTbFW>65t=u=UbVx`< zD9pxK2|h7UVWtGnv2W7Wf3AqzpJW?-k|DGasAFfTaSMx^GKReyGqZ*ee3Fpz`7HHA zV>VLf_pJwwj`6J~%FPnewJiErBT%|)!z#+#*73YbAB)6aWbOV(ojm;19yw?h69U0k zeo`!9((R#a3}wT z9KwUC25gyEeA3X696oN{;|e^ol6mJZSj2WDFkT@R-!))EzXpwyl5^yeD@SHC2$A}% z*6eMkc25M=j7lQprt{@ed67{E=2AzJ(In>5WRlSq=F*1l5LD*Ub&}B!+V?nPE01+bYTm;Mu)e0+9Eo|{nfejzsfx@wobovN!2aZV-RCiK++1iL-v&AVgs7Vk z`PUj1PCZn%ji77E)GJs6eqxGWfc#R?G(o$s?1eJTz;zzq-P4<0D~9Y}M)|^4`E$|A zm%53JYPxR`TO5_&L_cmL8piZTkV?>IR~Bz$e}w0?qmWw2m*NkgYrqzVTgRB0B}vts zluiG~K!n<%BGZ|NXSU6Wk&{olFU3!(C|ponLHaRr4Ne?~v^L=q7^#$~$rOR974y#Q z#QH$=KLNHF#R}9bDK%K7B?2_WH&UCqLw8^IIC!*3eq~-~d>i7E z4db^wD}E{mb$xh7%`btVb-u~p!ud}8OAp+ld&`BuaYIb?L+ugDKf+XQg@=5pl%E5K z+jSNG!BUa%%b0{1s{0xmondh28m>i9>c|zj!4>~K%jFR!!D}t_5!T+rO8S{txR9`| z;8-ZmV~9sfZJ>4JgHjx5Wx`+-FOZr_a7F=OH7UiX#3$2^{jB>$q@J^_Y9B)*TXhoCcRFdRHlN?x*97&UsSdx-?T&6~oT1k_}q2YAruWcql8aPgRM%q|h zlHPvIzF?ZZ5fq3n1Z*tH<|j>zq>95i$p)0_@leTvjiKAef5=KX#7kvmPfTCZ3L>{c zfwYOfg`CoRg*`Mt*V5cXvo6Zw;yc|^el&BFHDA84GBcsVM7TnEgAl~Sh{9BvA2h}j zrOGGNQ#1*AskAi%s{6~S5q1R?jFX*`WYtdcbv={b$@sh3_@1JRNXIl1N5}9ZF*$(A zMz}Itnjs6E7#ovQhv>=A(q;EpWopIm3`N=+KoEHvRPAOFVAMV5y}YV?rmxXWgK?+l%9-JSeQYL;rb zs0UIo)1J0tSfJhX&!nE@D4cgA-9V|>_@+Fa_}yaxeZx`Ab%DrQ@B2TZ*w-zr&EvyA zTl+*Mb3zZ6RG9@|$TI12(%@MAHw`J>wxH`vPY_1K@7tytyTn!pJyhg0U=@qAJ!K5_ zi@D><=v~@ihiI&$N^R7CpuLTvfnb8uD?_EdqujN#(;e+Bp6qR{FPAF=;IoQr<+<4R z4@{?#7e9%GFV(<&W_c!wvnG>VPwb#@(nSEny;XuXH|YM20VbB#HGBnWUNcUT>1uDx#k+L|=d3V4$yzds>eL?EnI zGO-vLR3NPY<}ktXPEW#x44^0Y|H?kEwv^_%AoDWzy39tru388+7{}P*A~V(}W=45d z{E@>fZdE!ITdr?apqOGXQD_pl0Zm2gVaUO{_?Teb+aC+xMIjkl9eq}A#8|NGV~wbi zlQwK=cfcgvM}OFpH}R3>gR#;w3hFGYElSfRls+E}eFy-cX%gUPk{V ztV(r*V47zr5$xHK8#QC&^g?%fmEkW9Vru-R6e{2wYV&U%1iL`5Q^CVe$?Qz+d|NTmT622~+uSGsB)p_T`(e3G@>ON4? z*vL^C@!P+5jy|nY`Tnx}yaJ`WDm0j4sFR)$>1;f_&#ij#G2x73$`it7yCw{7w4Wz7 zLKkNHn_Khb#mf0sAz*Be!<5U-S^p=FO&F75*~sKuW&T@e@k*lQ%A55-k0q|1L&6P! zAS=n{m!_9NQ!$eKp44?+-{$`nM7E*DO=gPj$NbTC7FG}So%ybKw zUT93n`R7qi=6(qKM$|9e&;%lcjlJsXl&kMC+!}G9uA8RLqqE?`-NA9-b(CqcY`8&e zP^mr(c_61CAyy}FP#w%aTByYAC&;VZazIg;?FJeP-?p?MEj@s&m6SA!9O;CB3L=f% z%hnZA1>I&R+1Pc)3s455EV*#myHcY&+$OO(3Oy9Y2rd!}KaNY>K(m66xf~LW7QYXx zKPt3Oa9FjOf1fBZVTxdZ`_}N*I0K~CO^U*LEw*8cxRnZgWK#w!sScV?8^rJdYWzrI`-m4nIhgd69EU0P?@kljIP|* zJyL|4HV39`)1g|J#ku&4n3*Xc1~YMmnWJ>Z^o7-p1`j@vM&&>vo8dV)as?Y<5xA76 z9u&w?qy3N~v!J&vPl!ak5+3GUM68#+i?)%JsdA%PU!POj2% zW--0jNntH1Q7z^-OsVAHP>GAwpn(JxE}|yagvG}#EQjOQ8zEeSki{}DbeoClyi5`R zp7F!4+3D;k+m}0THHzvVahI8#PdP=d`J=ANJ1rT;Py5vN&eHX{U2H$$jSx;-iu1k| zJzs@b6IN%sJ-PCrH!)ShvXntCGdCJzwAr}TxbURaZOvP&4x`s%+|=9Lt~n4$0(gX_ zt$1V{YS|2MS@I=1-NdYcHAuW$tp>_PZWj|Igd|Kq<=brOtllS1jaB&IL=BBF-aIHz zoAwe88JAt&*px-MpZyi`Rqe>8_Q;Wctzg<+hYr_9Cgq#pvM?K#@*FoEx? z5!b%SAFESLOG_{4UMv$q3}+|NAMakQCYb~i%Ra9=Oc=8YKCY0o!Ttm>Kw`s@LIdY-e4(6+YCl4Ft)3%J; z;Q+MN%=y~^o9kZM%OMnO+T^xh^}LnE-+x5h+myw#t741tLlMYt-G9dwTl8n<>FmYs z)SI%n>TS@vpMKQM!Q8rIhres*>0hK5oC5y|Cv@K5-dOO9va*+%C*{p`TUu54c)}~< zYSwUMg*Ra3d{W(_5&PlV%1qhtM}qedzx;7p=gsq>mXbiyEY!ly`cbOu`W(74hx+p~ z8rOyPKkrWn-(K#^zW?$;B!ZJ|epfFC<6yJ?z>Cori6RjU#Nv+K>(<7gGAqaXNj?~Y zrNYl{f?+riMz1f-?sB#LJAsXbks|o&a3WSD1|al4P92Ysu;iCoiZ4-2QOu*AZ%u%j zFP6b7VbHJ4mCckIPTK{zvRP_0kxa&xo89gUXRGvgdbA~3Yj=6Wz~lT#w$bekLZ?!0 zPqx(`j3O0D{E=d3IGV&_ywHws3d(TKk$#a}u$L{<7PM#7yeC^NDbP-1gsjv{bTs^~ zQ-+{Bfv4+Dd8Ht8jYsRj?nqQ=T#uJ)y%|ZCD0WYlQ;XIji=7$n&gYx|f^Y>gJzTF3 zr;Aj&GCOpS$T!2nN$kAbpKX#hQA->6-)8NuXHh#Jo_;g_gdnyv{o8p^m+gip4VUdf zpedi~L1Gz`?M3DWPxYR?ogQ_e?aQC`4vYSX;l@^bG5>?95iU1?Z(2S*Kwt|UlN%&* z1y2u>_S?n~`7{SDcmNhRn^%2qG)Zb;}dZ&nd`By|2sFEE8ttw4RQ+>+C{-TpQiA zN`0Dw=?!%nj#szTyNVPz4b>haC_h#6+{`LI7O*-kerV@+V-;CE}Ur-0y@r+J1tid1KftRxs1e$zfh>-l$PdgLb#e6 zKJNop5X6s*W(FnxVJ(bhLUlJHLD6ZW?Mvb$$ot=IGEW$gyk*ZnO#hM7qve)!FIolQ zWR!3Z#M=)vFKA>*&-~lPQmAMJ&2_ao21;nLP@uB=}<}F=X7P=P4Mh~o2w;WOD^}=^D=0ylhYZtxf z@YaRan5zeuCzwI{h<7ZQC0`|C440 z>4I~8K0J*~IrTd`a0aJNb*XEew;gs`e>z4a@dEofY5%&zPfXcL`{&*D2!+A>3B!19 z@_9!E=5(NGXn))rQGW}p$Y8Ng~dPopEC3Uvbv{j-tHjLM;6T`l>y=OFL2AhFL5^G((VrCwCE4`7AD6K{54 zlRQY5CkTHi^;9CC@L~Y4*?DZ8Ra5lsnl<@D6e<=JiRE4P^%%D*Sx(ohJ}kWbz;(c- zmy|V*i-qz?$~ILYV<*_Yt&Ygy0+v22)gb40!WTj)yb)H|_uH)b(l50DM66<8c25OL z@}=_9oGpt}-~Id(Wt!Xu_k#lu<^Ch#+HWaKw@m(Af;6GYPs*2~j#gR;^QY>Vi*9G} zRi3w}+N0NuRRiV*baR_Lk0}*(xpH9u4X~be;?mGa1D_N<-YHfa^H*9VmD$;QR{t`7XJveE+ZFN`jHb&Ug4)PXca3< z9I6}|ctjp1;svEOK_ez3DO0rJxma%2C7)ZM+E*ya-LM=NKIrK>uuRGSkex34NC|Zj zWRiQZ8!rM_(shxolY5EoE`kIJ_0Xe|`zSdsL*&x+u&a{$8JsS|bP4tGCzA(&jh7L& z>H0)n{q4MWmr*{12Bd>cg9qv7(J|=;luWLQB8icmZ_hKSIk8EXH%Crk>9WT1GsC{< z%yIt+jaZ^uWR26#g1yrE&Kt`c7d6g!lhXF1&Sca6KGr6+NgDB;r%ZY($AKm^wcSb| zCz1?x8P_?LIoKLOsx75yukt1WGO05Ojr9c|EL$3F;++!eL3w#_v0}>X08@~mYOhmL zrknf-Ifyp(8ObzJQgQ)gOBiJun=A*FfM5K$d|Ti{WTA_iCSZ*@Q4>S3PW7$G!&vjC z)^cDN+*e;b_C^G~SgFXyxC&-pEw2w*lv!!Ki=^HM>s}LZ3Ljd8Q~>VUwu#Ouji2-p zCHJyJf^dgho~k#Etm?1TEY0g0HWUNza_~#R_E)G|Z*YceIigmc#8ca-Q4N@jQWG{+ zY8yoN4}-dr=Pv&$%Je!2+{cs8x@sKuk9(c#5Ku;Z%FybG`$9dC)6_$!UzR9kZW}Vz zd)G?$!^m!1q|TpB!qa|Oe|LVG&C$}2xh6OYQlwF&ZZ@khuaC2FcuW}dZArwNIT-(# zJFmj!lr^>-2dF4msS8A}&#H$y8aB0b2E-28ZDLQ@r0|wxV5@wHpgadF6p}+DZ;F{R zFC*?R=AK9CV>#**Eq8fx(L2@stnXZk{dV@Uo{ePBN9G$kxrExDhudW2I-1fS_%};k zXG3mo-MAUsG``$;@nqh2+`syhcG-vj&4kc&c_grrSUq`lq-V+iPLPQYJ5BHE)1BN; zQo7uDBs$kdKQ~-;oLU$jbT%|QzMXkzdEHiJwf_^be+d?tK$d^Ix!NR|xYzeur@Puy zBCOylu=cc?uKYNONrN8*dBAdN7$w3%&_tWqE zg0bug^$86{1%oN?$2c`K{rt1HxRn+1GkchzCRO=^(C4zqk2OZloo9&@hvy%PAo4>8 z9#b^!6LbzXvsTp~*=!I}su5;QKDnMA2~XX!AI()(+Nn=`((Ny(tv>cbfm1kd{AAFPebsml-79_}ym;7?#B@f0KaD~atHF|D(La)E zAh!KFNPAc~UNdBa?RQk0c&?v2iuSu|BfIRz32nC-f>AMs(GrO47=uCyht4qZL?+vI z0!B%=z{+9yRxqsy4MYzzK;#eY>8zjT7z$CAJ|J*5jMc09qF|Q%mpQqa1uF_Mb53ev z%J$nf3-P|(-zy9JbxSddapFU&>ML8~*Gm!@*6*H!L}kX6XL8@sSxK>3Q?H5^LoJ1j z_JmISzKhgIPnb93u#yAq$lcEuk7CFLSt*3CBSSgk4DAj5yJ^jhnKLS8@ z0MlB4AKz7yCPZ|Z)_>P!dLmq&x}=si z$AH$^)};E%*vOV9VDI~CfdoY*ow!7BcCDZR#%Mkg{jeQf#TCQ$l}I2OslydH&s6cl z&O&sq^NHO8l)A_~HkU~^=tGiT^Fu7NR29=_OqQlxrrRs(v)J#bvrBOLEHuVIJ1Mfe z_Z)FFMdKOMA}jN42{|zvU{a1hIP|Mf94lrh%kC9WcUFvxjduFVI8)BK+Kxjkpnk1Z zJ9MUf<1ovOW@fI2aFvz8oP{I7o;zjlj+POx0SzC4rFjhP;-ccvLINki{G~^RhmK|I zK*l(^46HT1d4Pt)XU=Om{iW(F-*RkW-!%{0M1HRQ3)W@G0or{x8pf%F&YnH`rzsj( z#Ty)(5idDD-Sf4LIBxuU!4NPv5VI-t^2MQ-TZ6&*iD73cz<^8faAcNq!1DLK3{6KJ z@9Gpf)RO5>M8R+D`hc$yD8{I0leN6Bn0WUR=UCRYh4wg<^>-f;UUTI?2+hF|RQ>=t z@R`QEwW8tyF~uyWc~K_>3mn9){joiz%x=WZqlMrh5T|A{UHaLJSlE20kHNvdhm0Rf zWi87kBbplPA%z!`DQ6D=fCS8B^i+JMZ;e9eFZIeUlO>K%FpPZ5e(@8#qB>sjcLQfhy%K1? z32q8sNk-Y71=FXVY*Iv$>RkSmE#HJ){vCfgwiiIEXM2^s2Q$JfTisWFs`3Jg&?O*2 z^Y&Gc6%Q~(QD`bL&#_dLP&8KQluH<&gsVRMOZXh5q~-^_+B z21OWaYHDeKYz*6g;*xvWRJ#OO6Zyo1Ao$u~UJ_(x;w&vpbB8wVD0m56Mx5YBuByax z!kmT}8^eL-_bF`R1CE-)p!j8@QZI7@fSz>F=PuB%01S`74XLnmT0K(NQ*A%jW_aB>V3@Q z@p-mXBa5^N=L=?jE9}e+2tXw4H+lsMb-fS6HQy)Cu3lm-0^n_YF21015XzyP@+(+i zeuPjrF>B*049Id|bgn;jkdFr7Ks>dr0=+y_uLo6h~`ys#5J&~5%E0oCR1)J8cy zOPqc1@i;fnKRlu$Q>wZ?LgD2kwu1by4W;NB67O~ zP~G{lV5E0O2bj*9-wqsZpd+ZoxU-@9KjQv5bqq|P3vi@!@N4#yYSz?Mopw<2jZzIH zcnHbC%M5i8p_vw@dHB28m|I(CjL0}tx0H+tX2m;QQI|C zOf6n}H{SM<&LJgH-$pez>5IKy(lN7B-A9?jS%JQosoX-zte|A*E{B#GH>I#jv~I2o ziCjVgIj37owUw)}dP-UlcUlo3Im$J5nmYr60DDLsek#eSQ8#U~|7{yrfE|*tx~y@< z4PD~y-czv+!>-vw=zdEX{p_za%{8@gYOBk@ZH;Hc%#poFlRMv%%aBSJ!9^RvG8+#L2&GWilBIFk>?W) zl?rp@qJ-i&Uu@*3x-iD>y*Rc$XYZ$y9G=nwx6+c<(u$|j8lEynIpVYG5)~eT3-rbZcn5P0m zw_hm2CVBYI!iiArvnV~W=19S6_26*-0nI&^i8BW_*9q0FTFDnSD35`1=oT8CZ? z7ll^AcFDOf%oXMb%wg*M(V>p|tE7Z++Mtg~EvODuY2&IbPWsUD^uiR4?Z+o)znFxM6%4tfEzHNU8q6a1iZd&d23Pg3fE)NO6zohZ@ z=TP*y%g^WJYW}p9%BEX14h?}DYc=*7ob<-y`eM7<=Yup@ zmTp01ha56DiQ9|!J#EIaB7Ru2l$onTbf)|rZ&CWA}2i- z`OYk`A2O03!nYD%G?y~;nvr*{LON}Rdfio^0UfiyUcQnPW4AaBR7hDkzG@$6{3BUf z39!;I7Z2*>Lsr6GCQUwWU6(5%5(we?3v6rCI{8aw2fa%+DR;2wPE3rwM4aRUxxQ}Z zO)RE0Xdo=TQKJr{B5sqjfcn`=T?g&0FSgLS^ulx=I({t{$EoR6y8F7Z z{?BtT1XbPf#tgODWM%QF34ef-U*(iJy!7=O+vTn!-WC^s%_C%IFe&w5@w6hzOGkP42M?mLmwNtdO~=b3G>tf$h%98&?! zW<76t-B%+%zkk0D*S<@7iGkV4>i+Qg)0Y<&=Iw6(uLL|6E*Clf{Jzj&gcqaf3P%v| z8aarvuU!g>h7@G+3;*dLnUFt~CppqrjT7 z9m(V}Ki>7L)>rm*BOz>hn&6p;_xfTBSb`tUhl6?IereIDksIWvy}Ee~bJ-cUyDA%i~RpRihN|xo-Ch?kN!>k;xFk zmvrwL8g>F7Pq`o!XNvtmsJ7E9e*8E81a#Fc2UKD%A}d%#=hdJI{4YDEgv1R*PEW4> zIWj1}Pu`_E51yT|4Y$;BE{pI%k1C zA?R@@CV@pXClEn;NW)VvQp_mDC^N(;)vR*ZD9x%9!8qOe?OMWdW!h9DV-daJFu{}d zVL3|&Kx2{!hpoP5*0uI{_$SPXdMb|^@r`44=cT?>g0T=fT}&;%M^_o{St^?$Kf$9`!BWzSUch*XXi?^L zm111JaI6NdUlJUJn$^ydor1;xogh{gE^zoW=miRwLL|q84@uiL&S;D~?l!`#JD<)* zt-IddkZig?8dJuH-!!^Yg=8EU8#^uFKiTA-9^9ydG~8O^WD!24?nR+#z*EN4TY^n{ zH&NivBk)eSEW}`$3Ml%SPI0P6siT?=+g1kB?22#B02C7pgIsnaeBP?;J@|F(*JBh& zd{@I*0v;?=benFr^9Y>gmy@5ok)4+GqNJRbjj|$~R?LzfSrWA5a0){;8rI8OCuWk^ zYycw#w~AF5l1+*}RL(1YvLGj&P47dK*qAWf$E7Vls2it3R9k@hCM`hgaV66m#qB6J zO4{wXFe?(;x^D&Lr<+Lczlwkxm&iZ8pvJUEzvfLhaqGY@t53-`Xo=)N(86O}`P_!3-69Gx3 zQyGo8J{LVIxQ~L?Hsn;76cc##=SHZ8Z;6d~xiGnh%FH%Q6P%0N^<{uL)Hd9JJ`aB~ zcz_*RY8zo;kw>ukWsqycHqxOykLWyj@W+X5lm|GE1o~y@C!$@nKYczaYRJ$ZTDzEV zi+pktgke!}yV&^hd`hN}VM#N)xO8wnl>owsY^Ys)K79d=Ovs30sondGuYgV)VN`X* zF0sD6fWbOsRP)3xsU2LvCS6ACGjGa^_|8KnJx=ViUcf~H zP=u+!hz{AG8Hxo_L#O;{9df=}7XKzeoDLRu$i=EC7GesW4mWeiBZL%-2q4ZxhdMy> zDHuw`WI|`+OC1X6ElWh&C~1>M917VhN~A`WtMN7*ihe*!WW0Hj()G}b|1gxwMTO46 z@-UQ0T9ztgAu6>AAqB`)lqyw)&PN~u%QPXSDqX456~2z;1`K6tP@09hQpXAlOY`?% z6MfT&W2Hky8QZMcV*80>l}7@l)-&Q#H=aA?Lt&d?zSEY((;h_LRer% zxgk^7^4ME-Z7QVPSO96|#+IW#pP|B3#+;)W1FfOlvcg}9G|IdE z-}%h-k%qFxDxKa?B8kTG5CDYaU`b@dmCK=Tw z@Un@rtOs&>!ydx7`0%ZG%l9kC(RYb7)%YzxEXJlxh9{-sZ5>NTyw$+(fz&&}6p1GP zMcrFQRoQQS+lvk<=@Jp?QW5FyMjC05Zt0RP>1NU0U5gHp?vj*JTDp6^OVI1$+IzqE z{p@Fq_rv>L9AmBXJm;F{JpS`{=-JJ@bNn9UU{T@6CtrT&KdmG5fRR3r2;0D6eH=yz zl@J+$|JXS)68G7=$SCYr7e7R0B(M#H6a*Ak1ywj=3^{om&n ztlis_AIBER1wkX>Qzkp18Bm4$KkLC(_h`VO=68oS%})=&2}tVW$1Wg}6L7iWmPm75tiTTqaeNw`%|oIAT!SbCR{o!z2VR9riDNuB0=>JpzU zD1n_()`98&jK3SV$XrG{^Idcm?13YdI3K;)PR;b#xgO}3Jz1Z|yB@pR=HPOto*Jp3 zG#tKUj=on{2(@9IwUencD|6c1Yyjxi_^fIS)D*{Y%c^e!SvFB&h=foB5 zSg)_kzhG$7S9D?9LL8c;@97V_o<(m%7HHNI=^E&3x0z&&QZEkwvM0aRaNQ+%Tu+kF z2+7Ef{Z=vhG~BIvOgw4(cubZR^<+X`rFs7=&ikE;Nio~O>M1!N>6&R}Ba72XBgd4} zDWj=emRajo2G+R`Kc~o!V;#fKY~B-^vig#*>XD)=pmuTSa<}Ph z_iArRT78|r9pUZuK?gcEUKRNgnh{V5wHyu<(iZW zH#z=60=3!2LwFeOjk59#A)!Zr%qB9(4U&NTK1nE4+Qi11=g{jC^u232jH}2tps`4h)R>fyFF0Oh^xEvxB0P$3M_GFn zkT9S}W}DFGmdl(_FUDk8ij&>8W>(oN-SzHXpV=)wWW%%a6pVq$0pmI3kUO5dACkwl zE<*d6Wh~&F4ed%JsO`OS>S?7r^Tq@!#FWL-WJpndu#J1ijA0 zAIukF?HdhS5J|f^&KDDv7>i0g&UVHG&(+ zk)4a2P{8Nr@)!x*H=mC|OlGE*A*gViR1)Wt94h1ppz@ns)xkpL+CoCt5$0DaU&U1G zB_=BqPl}B-u@VJ1lp|3dku3-zrWKkdwQmE9)^O6yIe!HTm#2|;79_dn>`2KH!%%B>I3JZbk zB8+~%Dbj8VF%v3DjAa+{M&xBifmx2(NR8V14e2tMseY}{x3$j}ntOCp z%zaEFo<1c9i|87dNOsX0cy+KolSQjaJsVi(>8}_2hOW5~=)yTgr`>U&;FDijAay zs?9Yd%a&FNi@8QYX=m5eiet`#hwHjnhYrGAuYZuD*Y}9Z97ZKwuTX-$uO4&$^-ml(tA2aH;@{Kv1?*oNze9EXlluddhm&>KbqWR5e5ZZ^aqdGPT=$GMz0 zn}76~g79m~!wr+Qx0Fe?H$QdI8>hQvPAijcwvA;QXQzfvL5(*%*5Qrc)@9Bb=5BVK zh8q{o&`64pZuUIUuQi((&)bP^_X8m@=y=2DU7WWE5#dcMRI(R+>bHl$;ifg#;fo>H z+oOR~&J9snmu{?<<9ylXEtTQR$;R80^6=(uBiXCjx!cpa;pSb(;j4wK+p{)w_avbg z*WZc2D|x&vhw;PLYn+RVv`1T462H<-_8{@9Bdcr$-zQ}P$tn);f_C!1P z#K8B$Wb?vS^}==X!UuX0)_D<6dy$-bk>Y!&%XyNidQ&>RMt1V1t@Eaz_GUcyeu?kH z#OA}S>cisX!v^%>sPo~P_Tf4AVHfn~WAhbaBcW0C6$AQ8)cHzH`^udAzQy;GXY*53 z^;358Qw92|)%j`QTM112>EQc&eel&&^*40#HwOBf*7=)H`&*v-TjK}Vum#wu1~@nc zI2n6u0|VTq0~q-I-SGpx*#do41O1%>1A&1-b%7z%fe>d=Uf3Fs8y z3H+2i{VDbQQ#yW7CR0I;iyAIUbUcE#{lV77TIcY0C!*myKRBG4`(FbE~Z?<;tZYRj1%Ha>*LI4;w&%X ztdYz#2;%KF&2`?zJ0--s)W^Hc#JgX_dlCS>*@3?Afd0-vr&sZT^*~OC_>c==1VKU+ zdqT{+ggEB}U_wG-eM0g~LRvl$qR(_&1!lfW%ymx8Pe?4RPb{8EEWJo9CrGMfPm)JS zgoraA2`ARoCpFC^wOk~%5hS;>CwII{?s87$aWrIc&1UgjX7Leb3vgr$sb!1w#lLaMme|5! zZ^)Lp%zjIlBhLZRXXYro)8wmgk?CAJmW^0-nteyUdRu zEQsPLh*2xhG$;VlzE5ZDO3o`FPtqby(}yzEUM%v zs#d$xXA;I2Bo^^O#DbSaZG^?`9K{`K#a%ANJ&DDAL7yPLM~1DUA;OX|j*BN%RhLUe;ZiBNWgvcdJ9HlF2rE4yw8;PY`4W-+&rMp2^5IGnEZRw#}*{Ms}d1BdR zL)rCg+3jT+;HTgLVfnFm8LVqLVp2JT`Jl{|qg|C_5LIB(;lprN{4gnpWMmUILU?Qi z$yEg@Q6(8?<%C)VIcEw!BqO`Al76m|@v8DAQ56$s6*Ex=B_t#Jb3!FsV-?q270*=_ zA5pacXSI-e^;_pEk*h?Gq-v?TYMHC*w?sAaoHdH-HOicy#9V7q>Z{e}YP7CubcjHD zoFIL5kfAGRA-=}=3a9~bXI_D)Ywgr)9b9Xj=4?!pYCq0^AQ{=7M0MVrb-wC# z{;qX_Np<-(wLy(>?sNZ^kzMpGq_O_pMIA(+`FBS4oj#Lyw7$48CjF|RlC!Z|y%FTv zSa+w-6!_WDR1{rt)!5G2)S=$g<=WJf^h=)!+-e+1iu!!j^e-9Nhno=HW8^6Ks`)!- z%Zhr-nrq8OQp;9ji`-`Oc4NfyRm&k~>#=(4scY+bQtM@7Yvo4Eby4`iRVy@C8>~hf zyjvS$avO3}8{S4M%C|76>o!cT&)6EDaos-SCx0ev`s}&hMm!Mu`1&&$S39{zJEdDY zb#gmxQ~S=^XZmj;&#v2!j}Anqv;FbYCG3<@T==D0$d$J8XY2Tkj&Z+ ziKdR5Tz}HYjhd9br~mjnO=X^ zYU+x>@3JKBw&Ciw)A+5=44Uh5kqWf__D7$o(c|yd6WCPd22Sp=JMRwpr#{oNp$8b^ zANH^M%+y4;KGo^o!f$=0*L~&0{rCDzt%N?%fNyc~AAKhAKs(n!M{;PL#sF7cf6qVl znaWNB6DU4?kbA%Bfj-mi<0RJ*DR6Ktd1$NYk3N%lSPjycNO^5&{MKh)e;dC2rO&iH zCLV!z8ioX9Kh$SZy&1s>^?>L8r#`cU67yzsTV<5&pZd&@$776xAIYEmi$0U#@yq$~ z5!P|Ohx*K&0p8|`&s4txvj5U&s&aQqr+ft=eARfU&kSu=|2SE+{?+uMKJy94L~|;+ zd(!ElKC`6Mk$XBaZ_59nJ~JiH@5zjRz%(Qv`)_@wMSAqjjHA&^=0knv$ApaeS##0Z z@`w7&(5SNJIbEu`mWTSx`QYZ1Z}JG=1|I4&8T|S`&Wo;poBfAAv)O${bAhXS9+Hv$ zw?31>X`OqKA#dUIp+0lr!^x8+vVcX1I1@2-3AyE$J`?TM1m<=L&u9sfk&WyAOP_g{ zk^T1Z!ZNbxGU>yN>|4sGE#Ge_zcZ5jVB-0~4AE!0|6p?`WJvvS2>&Z1n~!8gfM*4w z&lFi`5S4M@NnMdzSdqD1c}ub?zx$n&XZ0IsMLG4CK2u|1RqJ-OTXR(h%|aEDk?p=_ z4AEz{teG=T>Mg8wDX&@ctlMd=J3#cAsp~h_Yc4~kHVf;Xf9W&BdfmY88!o5oK@aqq ztjQZOmii&?5A>Oq&2c1KPvSPSALujfIk!qnwQ@-w=rb)V%3FRGzWLemK%ZGV`?IH1 zrLEoDRss1qrnesnZUB>oe0l$iau`V2TI&Oe>#P ztw*7@hddATnTk_KVzRIKS|8{$d95Y1Pv*ytRUhax-5pN!_UP2KALui!OwSdf@(GCN2{_Fwu;?WgW(=Y*K&ArJJKVHM|b+N5ESjO@jW)O&qq85WTD@}S}( zH|>u;bNC_$e7WRxS-BVsh=7&khZo1tt>KmVOaaG*bJhIf2?ziPM?WYa;*Aa>NB||Rh{ninZlB%TK|PUQ&}sF z7oL5^7pGP8*;=DjD;S>3`ZEGmll2#LQLYc2 zct%Yhx}OF#iPk>PYqIJ8ka=Y@$hzKSJIsr~Z8s`P)oeE|E6Q#ERmG^;eo8xl+hN8i zFD1R#teg9+>h;ur%E)eUUQY|)aoNnvYjN?ns)b}^qpy8*-D^eQbvx*$YIQpr7UlhT z@{f${TZ@WXNJh5Oj=KjKjGzO6W8;Iy{r8M)HhyF@6b~FoMt05wFRH@`*yky%E}}4- zz<R7cDyG! zsT1Wn9S!$@)hC5x7Zbo8iwF?XC!>KE6=oTW#3}gkoPr&aYdjVe-=R_iKJcV6 z3fL`V$P`;IWyms~Fzjo{oWm|{syv=J1@2g*^GlGnBpU(F!y2)5vdh@SjVG@Q8F75A zmvI1%r|kI}aShi)ZuH9Hk_GiCx>!n+}C0w z;iCEcL}k#}qaq7GGmTXam4?Z$rH-9uS|<%EEvH}0JZeVNpg5-unq%)XvKv*qSSBmN z{mjAo6rAt+lqU$ zCnrI*ofek%jp_@hleMjImewCv)s}G`eY%7#ZDJcW)>x+Mhy5)7WMr2-+qJK0B%86E zYFvb~a_Z#NI*glYS{Jr*`P!(JVi@1NNAcEinN$06a;oL5)5`s%QTz6Esuc`Z4l_@r z105jR0w-eajnkw9&pQ1X-QU`mf=d@!Wm*#kWbOaaRtNQAM)q_EmB@!6rR^suWz(JU z%lp9wT<-~|rn^|XK7`pfy(c-F?tW}}0QuDM_~$PIm9ER zvNL^3G>5S@O$LmPGyU4|w!lsX*Q8@oE=Ytx6e1i zG?8me7|Ri{FH~waRj!@=TIO$GY`|@H8kIPy&T~>?-)yFJHapb{?@;c?ZLWu>o(W=M ziLy;GH)Nfg8TNOm&f&H&Rhfe%K0m9h(EMRwH8-~i?^xH#ZD|uf_iY`Lkv*DgVIR!) z4hjnJ>;e{!2>=D42SDKfIHB=ie}m6y)AY~Y@L04OJ>?ny1Nap3rBo=?=&j7@kAL~T zFIl`QcQA>~cI#VjRo-wKpAYgAiR%2(EU{=>&AvPE>3o|cQM08euU~FD*!QOJ9()qD z70!6*v*c(Nff#0Le}T`RQCnqItrL1*8*%C8@4%<|e(~4p>{&{YrcdQRx+9)bz0t5Q zS}l$G1wJn*3<}K!8+W82;By?SXd$J+g?4cYDA%7VopiKb5Mpa3q0v~ox9Cv>dQ@JZ zWKbG^1N{qpDolz40Ac{XpynbA;XM0a;4@7j2LKk6e+%u&0Cu&RbYEQ4jf}{fsz~lYmaUDf2oc)N>=11vwct42iVcB&_oe}PZKqMbYNS-a#boPG`+)cTVT5yBW^D*-crT z%{#4^oGrMWfp^XpJrNksmwfRo&zA$KO3%NCu)!Rz zi0F%(;|Ue3o0DmyvYXRyj(ay}O93x#&sXBDZZ9_SAY-lV+P&MW{q7gw>*Faa@Xh%; zL`r#mwg(xxqoe~6#M+<<_dOA%(xLHs+Tc0%y)Z)3VX4GEBdhIu;}4|6v-W&ObJ_PH zMae)E6>G;#-1nuH%0O1>X~%8Y_j?(Vfnp?f4?YJn&>VZdkX-Hu@S$X4fCI!j$OsPt z#iTMZ<9j+NISxL(g)ENciFMMd9R#TkWJ17aC!@G$6;hdNH#f@ zc&~)oVH9v6o07G+SH|TqIvpj4T2#DGKJhRnUn+-IrMFMH;V`y5B!}KeykBkhFs^PO zhtaXOU+eNPz6~Y!Wq|mA9^nzNM=F;ozIVWo<0xSyB$qi)e9%3i_Wah!n>nlD5p zF&d~SvJV1bNd-+1cfaULIP;oAU- ziA=(id@<=l`S`wxT#l21x1oiKc@kd>)lLfUz-QmrQkRn=9n>P#?%&{3x=3xRZxYmS zQequiq_HkB)i8Tf>NNNVe3p5l7V98LPPY@DmIq1~>*4iJcX6CnM1&UWQ%TPBshw5= z2a63^`)7t+POH*UON>P&XUBenPnG`J$%fOK^3W1UAe8bAX0bA)FE_p=u~IxX?Esji?OI^M%0Jdxj9!$}3*tHpw(dZQ^746%C;pY}@Y z>-2>XC}c<`F$kkI6<`>Or!h;G4j_%`Ny#%slFT#5P!E5i&MNHKup<|CWi~RkxGY+I z5zO~Rrdjo*pd-ha^_iwgQEW-Xj#{YsT%U!fb~Y#idH;3JL@Y#Uibw<3_QDm4g#rNJ zLni0~ki+&!yrb0lOzMFHIy>2aPs4|4KHIKnuAQL>gAV_0+SF4yq?TB!NRdII5b9+W zyiRx?LsuY@#Eol3t!cZzbGwWUM$u$nyo$%SYo#Tt83btr3fp%QJ)NbxlD2YUoSPPv zto<+)Gl+ZI+IplST@o}ziySVsXLE5WA-@X;U3aRx)ReKTa7frix&38ji~ z;F}?r6AP%AAa(}DPGQTDUr>;l9>uFTaGPGm{M7BLH@~V{tpqu z55C{|9$p7h$aQ%0_jNEf`_)mvkxBKGFSjY9Jv>Uav7go*PReb={QEjkqVygvig}&( zm`91*<_^Zvdw97KEKLnW@tVYS%p5)+1~7@wC??vC_i2}?)kG5>Quh_nBDk0%q?@U@ za=w{;ty)zq9j^wKwul9I%7nK%-3k&gQ_F>m13cgKRTV5sOYGf7FR>JN6rj)1m>WEz zQ}%J?T?-9S{*DU(ZO=eQ@Ga%S@(oU6OP!bWe98tyAV(0|0%(9gbF0l>uIPVx%xZ;X z{m$N#JO#`Iw_VNBGgkMUQtVJ2Ibt4=U5=ZGne!o{_Ckc1F2~keT0Y7=lG0})cjLPW zFIj*(MB$`d!4LD6p7VI*r_%|gBVwy7U><--{!M-Z346>XPx|M*UI=6=sZLO#hHujqH2w@Cgczdn_&!b`O^(UIuoyg-R90I5 z@ev-kCQW2L)FH)$w6hZ{v^s~1JgfuNX(EQWgc?`);Z=GIzyVM}J^kxxDNl!-p8iMQ z7pc?egNJHZ9BBPqFdT;8hFH8ZyEmFzA+Gu)B1a$|N(VEBy)w4%f9m^az~U(qO0p~TaaLIv3Du&^NnD3q?b}~hdn*n$yR-`YEtPMH zazBN=N(tDJF}Sf$5p*q%%;)(PP!5jvZss|;oQ7*lV<`EsswQyCK+f-m(th#?pnh%p z1R`jQ7IK`kc--bYp^4vS;lJz;6g(v+7xtm{KaqtN-=>1YcnnS2X@Har>I6VM z(*@o{I?H)+?RKsvMc+I(j5!T-PEk4$CcyGV%Ei;Ow1&S_@`k@TA`J#l!vHYmH64sy zq3G2X!nir8HgeFN-^C~*@lh*bGR1u@@Q3nrA&c8|&c(<;i1eokDuz}wAoReIFxGxo zjchj`3ssIZQ`BZiJ7Jzk2CJw09KMKNp@SzbJ_i-2k={-SSE+<@|r;b`0IB2>oo(v4Hxp7@mS!` z`AVki?usnYFl_P2$Kp2Gy@00*w@Jp~1C;SEwfls6590f@u{@fw>#=gh5@|W*?ZhPv zFkx?8uU~kl9!O$sAQaXI90ay}?nv59KGO@w;#f1ZbB0aq@3zHtT3Y=5O~#o5f#) zQMs(k#RqKA=XRRv?0+PYh>D_F&rl__K=T&15Vci}jy%aRSE5zl-~5r!UJ6G_;UGz) z4iZ?@lYI3ffkd1_Ot0vhXCQ!oy z*$yIp4Ky^La{z#9j)KD+$#`W5RX3ueqbX%^+?pUb{LUX!q6YPb{WwQ1OBZg;F419& zvQ_Q~{``!tRJR3st|FUlzeokBD+!W}cvHk(4T@5PFE?0HtKoVs87Aq>sOy!O69G>u zyrkI}A)GYfmcU3e39};y!t*TLYgIbRi~+PAw*u6wF~4Pht9bvJ+Qc>%dPx`HsvqNV zyFI(L|6L=xG1wl}Q_*uu_*r;3!4tlnn1MlbDVYP-rKL(qOjeR~98Xx7*i|jS5I4NM zk=4zYIo#fgE*%AExp;ujJGj~>#&Er?5pSQ|JYO<=2iK-+6-$x+%tbU3YF^9kafdqp zskmR7BmE?-oR`iAI}M>Xv(qDf=18nq9*;8u<0Ibiz-fedzu8;~d)iDb_tz0(0D#^P za(xH^PaqYw0RUAE%~zhz2dSuNkl(%EZ_?C}*aX4&FHG-maoApS%wM;7I5qe&u}LI_ zc<>XCoNF8#EShLm;RUISNS&@UB4>xO;lUefQPYNDysAdaE2Px7X(#^*a*4w0PzRFfAklSgnknFOYiqr@% zZFW5~(5-wu3@t+keEIf^&Fd*m`pH+?`6gNLTErNC-)_E;k3)3#arXb5i1yw=`)e@3 zbS+wuDIApDqyH_x;zwIBDL8V5xstp$`YHcyr5Mxu{wM+k|6;bN3Gt*iti8z>;aRfb z(9UCACSxl@5v^LZaD;r+oyl)mXReJQJ(EWXOHHN9!TNA`HYThXAl=+sS@u)mlZ#i7 zex#%eQmQ``Nak`wk>?winX4tsTWz6iIRtl-1L|CM@LzlC0i@|9pvo&ZW&zuCklXYfi@clFQyvu`BFbH<@ zF&PaLl|rTlyLEQI2L(~o409FbU=joWt;+=+rC=hJ*CbcMk%3qm^qdkgTl9o zzQ~5+wcGFF2`P$0@oNq!^VoO%6;09C+8ka#t>kuoYq1Duy$xc-$E9Be=ns06*PLv( zHLF93ZC=$YZNrLBoT7{{@|(B7?DWPG5wvN}@eS=N)8!~}cB;dJ;L3AwXcpU|Z%;I> z_f;zL!35xz(!}iMlFy@$=;;j7cRJzD+;KPXx84`neT6qpnR2+AKSat_Re{3Ip0p*W69bwX7v`a>Q!PuQG~xj;i`Xa5l|SZ7vj z0(JsQ5_{2$+6Xnx5AnJV$MY&r-Iv7;!>ueLCMNx1#6Rl?P%+iu1VFdPFL~#FRn_w4 zEJ5IdRyVIu!Tfv?=ZS540ZOu#kD*Wpf)LM^lS#)YK7Dvr5s;pwUL!gZsSd^OZ}d`{ z>KVYQms(MdQOR(|-~;XPqu3B66B>Ox0%1&fBpOx1EM;9G6MkYBW2}6qC!I6`w7r3} zdPTTs%=(HIlN@m+n4yVp|9b2p12lgq41gXY#9R1ZZw`2yJ4WR2$HVDD8mWj}z9cB? zE%V+ZgJB@A5qt^zvEgX4sN*jMNi^bxjz;dH9tQm#vz&4E1Dyxpct z+n*!Z?~~#}6G5hP#UC0cQC&fMv#nML!`yC;2McY{k5pum>p!gb#7kQ7+&G_XOjHRj z{9|+A;%H;MNPD=Y88SfovpH~n^mB3e*8mLwPpu<5{Vq?_3$Z1a)ant*6saA$7T&TK z7NN1OH;Um#x<7^ubw&WTx09|PzNN8VKqqSc_aJ)E#`oZtU3Z%U#y>*Y*7ARZah*a2 zXqdgR7&7>e*;65#14xho8q4NN^ji^{)fh!($N&w|**`L_#6Vmx9%kk+0tg@ZE+PRX zgJ6x{RBv-F$+`~fo znbC|}#@Rq++RdCq!@kWtom-l}255NrvAO!Y#Opruc zVmBuB=)nN(jg|;ej6J`)=*r;>VX(K{*z4$$;{lbw2WY&S%mboU0?6Zz&p$eTdoVzI zIdoGwz&dCCdin1G8U?|w&Ag;h3)1SJ0a`&$JWW#w%ZoK?7Lw%#Hv6K%@~x@CN8G$ZHBtOCK$Cke zaIDwwzRdTW$rlAc3L`-8#KPV3dw_Pq&iEb^EeUslNwkQGF5azR$@-3A((hUqr#rKtIYM zmD1VT3+WNcV)#8klZO@%jN-$9C)1B-EP6jR5f4j>JN{9BC2J-fvN`Z;fYvd5p@=83 zAe{Zgv{HY646-@!Yk)R^zBh@a`k2z;#r@`h#M@w<$7BfHVgl%uvI7)VCUCz8XfFEp zQ&oX%uZ%~-ehtuKjRjwj4KMmZRvsP<(4LU`2m?*?d_6VT9qHzm*j48Rr=$NxpK z{oiPXTy%EWA6k(mks?u3__av2%Jkuy*7jR@brvKkA{{LCs{fZYEjIcDX?{WL^ozTV!aKh*4>Yg+$Xv0d_n#Wh~?LZr-JdJAUWSn@$-q+a&LRyJPt!#B)d z_QP;EAO34i>-#5awYB9J=#YuU-^EsxM8N5HvE_rO(RXDBu|eG2lm(DtizzDMAibcH z?IZWA*s2;9tZK^&)UUci)`yp0XvdkXB^c)x7|Ldo*HF4Dh@7weF1AeZs;Mj7(_ws| z>ggbEP=uZ&z>lPFJu~DNtsn;>nK+&@8%tsW0FY-={VkFwb^`Q>M81~HJ*_ZxDT!&= zvP9DZ(+U?QNsOj*0{|6p`N@{hp5#wkXzyr+xmgrR{~T|&+g3VvlJaGL9<+&?1$5s% zt(a4xb9H$%$EzNAnO;_M?Ng)%MNaC+heZBt_nuZrPy}09P?5O&rQpjc3;OaD)+jl749obLHD#`NY_VCKrDCV zZcQus3xUx+t&oWn@ZZc&E9Ka{rxgkye7)*nl12sJ#XDNDfT5QQ(+b>dxu+FrX6;cSkE;3f?L_IpDdc71ytHc9;Y2X$5RJOaNXf z{#~)vHD}!5!ri*36)Fr^?Gvc?wBjUFV2=V-}YMCsK$V0`gXqvZq0vVXx5^qet=BOkYer$MSI#rRXvzo6U5X1II&1M*1kpGR0 zR(yu?_;)gjdi&^K$mnbL?OQH#j7#J@GMZxEBLUNEcTYx(1&AZRra_ZZPonoqJ^y-7 zMxP!tyBIl|%FY`6lZ+-fLwudb2jFJvIj8?fMi&-&A!L+&wLD6|e=XT+w|?c0jP_|+ zHY{F3?M80FRcPT8B(*WRZdXU&kx`PLo2{xmSX-J@@J#|5Ma)e?6=tbT+lfDSf00qE z&CU2P$ec9Q?>%lP$L`4Jo_O;f@J273!Fwia<4Z|8uL9<^;l#ytTEHC{eY$oYn>Nvh zyC2;ydsySgz-2&TJm-J&8Dm29V%G&VT}(VIQ`^ zis@ouGtUW&L3uK`b@>%Q=?WT(ewp3eyKC%173&ugN}VvF_^!b`FrMV*y4nmVo&!DQ ze1KxvXGzrGahV215p7?*gd#_B_3Df@(``$K=?Ga$FAmbq;lkm zG8i)vjF>`RXyZC$R>5+F_Dg}*UByT^2bU^`RFMWNKBr^t;nyeAPfDWJ!j^vD z=U7qc^(f=%jg$Bt84Vd##^RqAvRK0kkyiX6ngs0dGLFcWCJuazN(QH5`B^uZdGG~a z10RhqN-#AXK*%IWEO#&_o8?6OF@hdCoTYp$+cOhPW_$p2P&qTQ-P1?UriF}IY6{kf zdhi4A0qXnMnUtF8V(LZ{qt$YOO7@zlW`U!3WKla&s>oP&4_rQBZ+~QUZYYL=blpQgSG%1dGCM)M+L>!M( zD`sD=NTX>o%olIc59XFmxcG>nUOGAglTie3F&dW8{rXwWL~6j%AY>&p*}CD>@+6f# z!V5lRFqFl{rG|2&f+D-?hG+$fp!dEzdrEEfCUDIxo+4r_CHB!~b zF96&oXn7xhK61nK3g0H6q-08peq#fHG;bh##M4OZw(IUPkd@FDbMQtTt@>yyKUKQt z5=jZhGxVb>yh=})8N4O23b+kg>jL@d_FCyWv2p)5ThR!ly(LnY(lEka;V(XZ4IpAV zO5BfB3kG2bdWgsFwH$w{=H3&x)EaKQjqZNYut|s5Z#E=9ITA3x{A(rjQK$_JoaqlU z4W;pH&A|K_%4@NUoD%JCu@;rXH2h=QyXBd!J=^dOSfb};4#_x?>nNTd!3GOtQC{8S zLh`8@45+aN@=LT+V;*l}U!KjbRhEM?jCH4%*GX@&~g-NTCU#{d$j->V~xvm@s@Cp0%tpKp%d3P8#ueUz6O?G<} zB~(7Mc$9%;Je6)&jL9QU1|TklMs>VAasr?Pt&doudSgWUAu9twDDXb40rY=vJPAPT zY_I+rI%h!ux?s>9n)SkwEwlsL{NqTTL6oU5E#Gh&*GJ^}3tQunOrd~FE>rAH`8@GR zCOBmKErlGpB)yu%*saMzoz|dO!nkeK5<>`@{i$T34pN!#@|&~YoojSBnw;;iv3l3w zKKy<4%F$Y<-WTpCH%i^UUiYWRuUSx>58ro261@i{CmgQzrSk^I5horS59TUlLDo9# z%_ieDyZz^#Pk+vVY^S8f3Q-jodA!bUrHPC7GrBz}(Y1&-50|@=p2wFabJ(Woi`_hm z;J&oqSV{{9*P^*MIIgdBr?G~+f3!baoay&iY`MKYKi-QU9)8*iz5y2)X?p;0sngvN zFo8Orn{N=)ywK2kmV6!wi0S$w>gA{VV@Vii1mO7hECIuJ*4|3A`L|s~!5&Wc* z`bRLsB-{HCZh{FJbkrwoZGIh5HKsL zN|lh@u9;Ztv#6P7EZV7E@t-THpUYI=t>4a_+ilqGdbHQHHF;IqeE3~*ulagy?nNac zzu(t3XgsO?&+t?s`|ZfA1N&dZOc2_N&{R+kI&qCc4!Q^(2M)SP0#FWn$l|3Adnxlm z4*O_p2M+rgyHSn?n0`$ZS=K|2hB(d!j)uvOPU-W;kd5p>Vpu8FkPISj=5ZNU&f zgG+P(7I+-F?yZMo_0;i4%{SBf;TE82__VT;;tPTeJr^Ug=$ z=CgT4){^5TO&G1y@jwI;`+3>ml=F#**K|(H;gT(NtG+5c^=t7~rA}*U3M3rs>7u*! zn<;r(9BY|bEti|c(F-oySyQ{0+vV#m$5RM66cGxobU00WFz7F04%l(axc2)WEpi5-w>o=iTot$mWiDuCQK!A;HdBo$FYM-7|HN)kTS}1{O6graL;e=NfBsz1TYUH{557yr9}7x7;N6d zM-uR3i1!L9A4bIukW;c2^vc+b=^-9S=k)N2qC^QGe<_HeeqAFWRa2=@HXuW<06D!k zco+v7$f31=*RQF(<>Ee&`odLQO6712_(jO@m9DdtA?0{Ne~iKFoC_&ak?6R-0ZQf? z6KP95+oYv!L$+3$A)Bb9u<`kB!Cnx1>Ws zw%ODS1!77PVausQ?3Hxlvsw+ zX{yV_rfO}SFDaH69)=Xnf1QZFKg6()pi_xbRlsay|pjeB@^D}BV{cC6O zIXq|6?ubHz{q=;deNd-}%T(UNDw$2Z(dCvpf?2$%qom0}$C&v32Mem8ORG+mJS%+G2VIO>mEJKx34eH*~&0!%Zlyx_a zk)-FQQ6T730aXU2B(Kt?$@Wtj+Qipt@VvB|9v~B{LUL3cl`%j7$7Y*XCC^K(v(MEJ zIki-!9u2H>U)2wL-oDOZIY8Hi=7R=f*rnr@Y>2$R91RO&&Zc76lu)=FiyLCjWi8p1 zv27TJ0t`{o-;8YOMPeUSTMCR8Ed;eYdKa$k>JCa4C^+IZ=Q-FHZlWY_pHilmch&H6 zOK;2KT}^k%uvEsEY#YA5ni&dXsm^2AF~uY5S;Wbg-Po9&c5wwQl@^`c9_YD>K>?ta zdTSe>Sk6>l&F_YtHLT9>I?pvOoNN8mspXT~rH|{DT&)!tNXqJG()SkNHhsjsT>zc%f{T}rE+wu+#3~`oMJw!kKZmS|u>8be*N{YRK@#&a( zF3uhcw&}K->ze4C)7`fxl`zx6shBTEZQC7yD>!B9)XV_P`O`mHBuWA+Exf)xro89! ztBB_{FS7R&-f+D~7(VahTyPB!b^Gy**SVES>oB~w={rr@1)+A!Vd`Sj+N( zv^}>i>8CDZX<8?lR@__fTQ8@oT23oH+<32MzWcqsI-5ju&zpO!Aq53KZGP0OD;gq%U z8?UQ)ubXa9!VS+yh+e3HUPOrAPpG{~@V$xIyr0&2Q;T`iPJ7d!B+(!WDBedZojPEPT<||U?E7s#HG41;{-$VxJtH|c3jPIuu=%;e- zs{!=Wtn<^t_t#jEH+rzcyWi)x^UaiDi#Af){a0S1PG>jJ~@KS|X&#`HJ@s(bK;N-xes*?%zSH+g%FbU4j~JvB?}oR`wTuC^)U;BD*Hw~8|yI>2b8^5 ztk&ofLc)Q?dDPi{!E59H;VWs!)u)rqCnNwogU zB5|u%ORd*vt=IaOMPioPV9^SBoA57-B(>4Cwb6a4(eqyxNl0r`*iuu()4wc|*5U=(B+pA7uTLESyv~1EBuLAh$j_Z0@w)zDk>D+N5j=Mh;dTGR zBKf-9P5azUkJs}Li-c>rhv&J653lzh7Kzkyugr6=9A4i)EE28dKAq=2J-q(EStM=! zR?Gc1&;8&3ZjrdQ4Y)54cs~E#B1szz0k;i?Ee}Tg-6Ba!8%k*#N?RVvcpl2a8_wYx z&eIw$a33y8gNQrBWq-Fw8r(;k(nea^{%(rM8tN;LB3ypB72_@^Jg|=*sf=pB9P7%0l`IsC{Mm zZx)I6>aNG?emdm7<{uUb_u94g+O5ah{ht;I!8#PrI<(F@?B6Vs^^XJ_C_Eczf3rw7 z2wpdc2sTOnv`B!PUspG2UpMLhv`8|xIDlJRt6MyOS|py^Vj0^Kz&|V!o*gBf9Tm?V zwLdHpJ%U{Wo?RoIKP-~fU7Oe4?*w~xe^?~0z&-cXJf7!E z{(^-^ELm#(YCyv?S$*|u;=KqRTe{xO?qsdxyi9tl!`VV(DEN%$)$QSYdpcD$(zE^P z_8dkh@k7R|%hT}%Dj_hrqjL$D;V#qb4IGxYA>dJD3G#l|ImHZFBoCx(E&ShIk^nr% zePVvp2jlo4Zx6H0;Bs^S{}lH~6jA%le)H1(=l$+(k)b(NMG{`H=jVA<0C=)#D_Ts$ zZ(Wj-8C%}B`}1GLy%cm(e=BaGeqNLX#hpYKYk4)bkG_9(NnFu4b@@ydC%=FJL_X2x zbJ$9eRPpx;!KuA@h3Sy@yJo7YDnj~#novaK>AzSw5|T1kV2X3&R1gw;l2DS0edQfn z2n#bs#6xuXBOb}^e^7ClO2}y(T1XqCfSY0pF)3M!1sj2XEniLijWumZAb(JV-CC5% zc)?EY32T0pl&c}(PoWkZr)4^+UNEsdNFjxtq{)EoD&B9hx3D}_sCI=pX+FM1IE^Sp zFWITu##lQ2ujOlAG7fe74RGYF^GkVXR2M0+6lD1-XId` zSifNw%>OFx?X=*r-c3vxNkMy~-L`#|iZ-i@=j zaoNqXC2-x#^`d<|$jh~HJuIsnkKN?d4*hssr%J$glCfsPd76Ke!Fg8lw90v2j!4LL zQGu(=bvaBv@qE=P3U0mbQS@rN8TqzUL33L-g?#7upXICRem?iQn>tU|Vc-l8|Jet$ z4!)~*a^ROE$nsULyWA5UH-UPtRP(nlH|LxcsKH{Wh6Z>31l0I*<8W-m zsY18S>kJ_QvFTi|)$hZ+b{p&W&4D1&Z>N@6mqr6IxT@n)>eVI_=`>y#_$l9ZM^fc~ z@o;_igvzmwF@Tb%31CmwVckAPdvd+3Umk za>e-w54YR1)gC7>;Y2$Z?aQv|Vo3#E5S!7||4@m`%*dJ4aB0B)fCTSy(AYfr52rmJSB$zyfA}55RB55;} zwtrzWY*~Lsf>VB@$S{KS_I@UU?RCL0O7KyQESm4KDK|=zpg1pDoDtqQT7g77KUSH? z+&EU=-~f`7>tKILG)NHNO;*flHcqjsI4DT?ZbG@2Xwra9o^G+qUI3YLJ(y%VyatnJ z{z5n`%?^NT@dyuG)zxRH`{mP($q1yJnAMLNO95;}QVURR5ta|8urq*9! zdD`U&W=|Qz2%}q=-6-3{vE4WeIgQ=SYX)*NFBpb~*Dp$EYTtq^8q;r=RC~&qm*_)9(^vLZxHDFlFTft@ zYpz=~_p2_LJkDzYsGj$0!K6Uv^$=0WHb0Da{C+!0Rfc^#*}lSMFVTy(WiKyKhhx2< zFyiqrJhH;|sIcd?Wv6VK*6k#9B7^fZ>*}=Sta^#|`Lq#}*Zr&?)$93eh_u7~eE6@h ze3ZBH>3Ts`miv0qzS84v-ir=+x7}fr8?`T+42(azT6ldr9GCz;pH6=OKi|)1f?pmX zYApB`as3r~pBD=1yEoidJ*W>wov@7Okk_W`P@nht5Cp#aVwLH^(m}#LWnlZVU+A{UvMz!FXQ)r~7*VTiHf=Q7koqPGMlnW%fs~|4xq%Izy0< zltEPlT<>S9->Op2#AumjLR2KbgVoXuFaneMs2ndsG>~#J`{4Q+QmVtutVpnDokds* zIkrBRQ z7Z*`bh)NjEBV%Y57gMQ;4SLR_U}u+*jk$~~kTRx_Z83>cI`r4?4 zMY|OHDOA7^>oRJ>c$GX7R=`+zAZ4x+n=;v3z+CGxW@C4i zx`b57GH@XMBOx|zU8sH@Z*3vj3YspttuOO0w=|SoS_FeIs0#Y5Egh&eSLfy$8}lV> z{983QZ|9migl)cSGHC5$%r_7C+t}r|F7ImGHP46JI2N|992(rUf?(*J`i@r46^w~y zU@BbWk2I$oo!SqCE8K<<*Y0ZWfEQzsi@%b(&!=}CFFTbk1DxxZDEFPPGT%MkBCSKw zEp)vaSNRct)r00`YXD0eNNSgCAotAl;JsD_2}*6gPsQpbSD94QQYFR0zg8jQHVcsq z+r)`|xLWIp1+6l1Q)Md8n z!+@>{X1QkqXl7l;4y0`}axRX_i+oF-7~N%R#0HmeLg$k1NbQNtxkNi<)TZBsnerU{ z6_(d#T}heoVscCd64Yg5hMS2{xBQOstjj}{HWyXpm`cp3gIrHDm$7V_&Posf;H3lF zU2s&(#h{c?^wJg2*k{YXGZ*nnA4x4~%+>ebl$*96XaGew2J`cc%vUOp4p8JuD&A>rHg{yfegiyC_ zAaykL<7fPcFnr#^HEmL+LP4*Ob@5)?p^{h2tWU*Fndr)qCM(Cn zfags`sXvGG%&`4RAKbPpXnXrRcI7&YmwQis;t_%# zU02e19COpTEi3_Vn+n@c#XH;r9qR4M7ka}BY8}Z^H0=4fc(!9AO?SRUJP7^-UZ?&Q zmapB<2lCvOPrRJC={~KC0>Sr*yswa-?2juScpv6%J#TZtPkR%d&(pkK_pQ3GcZFWB zCu^^-9l9^CfnIO0JT#-A;UTweej&uqTrYTn#6-Z{5k zH}Aapn!E%kyan03pPl?9%>1N^yu{S}WSacs7yQJ<{N>dA6_fncn*3E4{Q2+wh2R2Y z)!0+>KVE&-J&6x6YYLch2(T^+upJDrVGH~&7HFpy=q zf_&A2f}Ddwu!6$OAYpk@P$VQTXA6!J3w8@~=~lH-Rk6vsaWoT!wN4C{yKpr6Xp%js zwX0%dA82D%7z{=1RD$KMXo8-{hmhK2lWJx&=%6z$9Fh#@QY40+3UJA1bE+x|jZO+n zC<=>T2#eYOD=(kI3ZH2Tn}Z9VXA56c3tw3HD=c5W4|jEz+r2=8D{`8PjsOG_9b(C! zB*~o(%3UnTU+t4zsYUMlM1IMMB zO9~>$79HWi=T2zkKMs>3s2lLHioB_tU=--_-$2^yMA1t6-gENNl;(tp4}|gugo?q0 z%JA_B$?D}ryKDf7UlHRBQz)zj1MBP(T!{x5-j@@EN&BQVH0g2a5sA*B6P^! zEcyw3Xqs7Al#?@Sjm^HYQx~R7AbAok8~Q#5n!9MyPJuCkp|Q=Lu|GCiWU>=CiMy33 zdVyFHe~k0~w@_XK8$fKZ*FaKw5_-mBLK$UZxq4!yd15ttYK3}g6+GXMIkB!ln*kQ9 z_GBwyu~j#AS}%NB|3m5^d)h#8+K_tM7`r*tg{|9xAaA1`Po71yoeqiF2kK;>25;Xy z?>H{-&$yOupXEhmp@(#A41kWKH=0uhtHLkRMIZjU7$GQV)|&MBYIvj|A+klt_cM%U z6g8RIhXeBuU$D`Znqx*6v&IjyMjoqbKZoRCCghN{DTF`TIS0;3fJ&=y zD7YBTq(2GWh$Dv)C)ZA+@Eb=V%W$r1NFjSmp`%2h(_^8_a3MEUk%vT4!Dqt(aA{e5k7?dG=&B^FXc)-y^ z%xy3};JdE~dnq4eZ!zgp@Q8n}PEdvcpgDj%|D_wz7UX96!q{kHLq1Dg7CEl?tCYnF zRON{p0DtVW} zKIxzmxz^cF9o+)+r$UO8O<>5|rOJ4h%0J=m{|d{$aQej8Lf!;?~l0)-r0= zGC{&}meg7Z+|996%k@;tgImYPStp=bC*)Qql3FL$S|_noC-qb(fr}<0ZY&(?3r`X4 zMEVBKtR8a_+1fjfTPS0utL!#8L*GS=C49Z_QJo)WQ-EeukXutoYExKiQv?L=erk%rZRQF6wB+2p9@M;v6_Hlj zoSxd8)!LlF*^>R#oTJ&2=hjjp8SZClT<=_6O%b9A>k`Tust@bZgB4P_5bVre(DW42 zybwHolV~^ZSUeOA>^cJ{&vexYXf2>-o!!f9*7*$7advg0BY{{*q)Ub5rCvg2x`U=Kk zfW_;4C)IhE+6fcZiCotCg4hLK>O}e4iRRvg_}qzw*M-Z~g{{?v^xX9ZshiZQ!-@Li zJ2OPSD(7#D2$%4`8e>Wj)bQbnVl?G?NGV~4Lu@{&|0k$QFd#Mc4;4X>EQM2arI+7_ZfffH(?0Vw>|DB;~KzE>vvr4cfuQRTrMwha%)d?^eD z2P4Y{BiaUI(guHV4JD-wsw6lT!kh4wIH~v~+LRP~4-CcKIV)~B9b-F}S%qY^ z#uZESF(vu*yZWdjPRJ7bK0lycrTw}YErZ;{pk6?@$M$_1$b^M6#2EC3ZU6P&x=&?k z9H)I8ul+Z{%5S2V-z4}`WbI7?_t`zAn$=}fwoOyLJ5!Y0y7cW+jNp|i7VT-au_^YK zDc167p0R08{ApgA8HnA@WIaQvJtHAKBjqt8c`_rNJ|oXPt?+(UMSE6FdRAj)S~h)F zi+fhrV^$M?#sGg#M|#dQe8#YRj@x6#SUS*Bd&XvL&R%=ooNZnke_k(q&h=&P=gYi{ z^_)lgoX^<2ug3xe?)Gk<4?UUpUs>=QTZn|5FxOs;uwIPzSWHP@Oyiyl2`Qg$DbK+N z<&~G`zXuhR8_L6@yKr?8Dg#9*2XfOvMcPZX)=PyROD*k0%Xs;-)dtLVpC~w&d$pJQ zJ(dUmFJbvsNeyZH%IB4pW$??&D*oy^_v)th>bA$~Zu%+&?mk>uJ$_j|Jy{+1Cp8eM zcOo4|+h||r1U{~;ZM3cdPS>7a)}RR1A#nHGjCI)8aHaC~@8Jv1YzrvJ8%}H+er6j{ z+zVzw8|X3{N#z>^p0l_Fo9Whbq!kPJ5u1cIn`Eo&G_OIl(h;9Wd%x*yF?nvWWNfhk zw>Vb+g1dPLw)uFr1$4HBJhw$Mw#9(k606%%uiG*NJ90cb3OYMV#T|J&%1D#zX&s~#@T{GaW*y%^%H!g4AV*IdYHqvKwh`_`YWTCO&vx(jNdAjFZ z@y(rQ-=22gi(p>|{B|D_EBNuShQ98bPwxju?7I^jgjDRsL>wgAuq2Nkq{^`R^Bj1b z?#B}x#?Z1xA~U5UA4WtR7QP-t*&LdY9tCAEmhv3toF0bQ992~umC+vN%N(@I95q!O z1kfILM9@2ZbLWWh9(g?;Cpa17IT_VCnUp!1w>g=rIDy#Ri?1iE1g9%Jr^`C0>*J1_ zHm3)kr-w49$FHYH1ZStTXD2#m=R9ZkHfPtKXO9_Y&#z}s1m~}`=Px?v0N!&r+jD5I zbA-%uB=9*R;RQ0?#e3b0kGvOHwijq#7dV+0c;E|M!b<|WOZ+v+=ddPVJx`T+`L*Mc zcI}cLe8~tVykg?LV$r=~^Sa{5yyEJ(;#s@m178UcUJLPFi|Ag9d0k6nUQ0pX?zL+< z@U;TrjS}yTitde?*NsNzjaJ8v&f1M$z)kvJa6HcZm}ZMlL+h1+tI>$%`IiolK7{eviXiV|ke_v&Ht6vXw%Kj}cN&{Z>y; zCblh^wq?AJz>dd)wa1Q$(N5d3e!Azr$miaU=ihkGJ!{Vc;OF+t=c%)SRE`s`p5sMu z4G8RYvh=}ynecU;_tj_mW$N{1hwk-2_H}>lbrt-&=f!G$^m?HSUibjMvjy*Ff}cCU zfZrwQ)%%?(kk1lJq>6WmGgAzgOXOG?QYxJ- zQ_C0Gadm*?ruwZBG_Cbi8V!200n)8t*z66*16bXF%MWLJzq6%7dCC_V4j|pWT$|ApW~<3cu;#pq zH0SN%QiJwgzqGTX#bT%b)m%8&-Q^Y#k&_Nt+r@sjs~lXAq1F21G(FepU5EDb&ECdX zr0gsHi_7h5VPjwi52wq+MbEp2St_vS%gY1!j*buT4y}q0>H`x!KQyLN6+bND&&e(T zQ67Ca0$m-wAQJ0Ll^`$)VKh~xYGDlBp9~^crg7CGIJR{RqIga- z)uIHH$JAoPZ!KY}IuNL1#M(lH?1so<$)*O$W4Rb5K9~E&3{lsQ+DVY7_M%kLcPvkh zFigzU3^Nr%$4WBH3n>hu)LL-)fL!?NudI;OVWgfZ)iXdYKai)bEJkI`~kmrkhQo;EH;q@Fe}_Ai}O-RPv+Hs4ino^`%7;GVa_ zV?LjEVXC(M=pj5y{V@oRSiTr0r+c;=quk@V8b=+#yB^~v*S?;JUd`c|J<)7;m~-o? z<(fD3N_Skc9C&eDvETD>T625%>a_8T+|zk0RP@z(C)U*SVMQ|Fzv1qq$^i)6-M9z* ze}}t0pUws#aJS@Zp%?h>e}ucC(G-V{FZd8HjeR#-^un!cjK+|LY?!X=S=$3 z`E9&vzyYxj^8;L(iFNFnx`D^v0~!7s?v6PQynKQ|4ln8;yEG1v_FMgQ0o8Z%Am^rZ zjEIq2*a!IjJ5>0274xB6nEnsAyIU?~yVl@#GpL;TZ?g`UK6)Szj)P-#wrJ^V}8C&1m1pyS4C;+_Cceh(2e|GWc9{AVX zbpA_IKtmR$-Jw05cQn+{d9kc9h~W)DtPt7y%_w>dNzNs;$+r*9-C?(KNv<;#`1bem zKN4p0$c4=%6cH=cD^Bm>rI;Dz`qg`hK0Dd}e{zI&bDdY+iX8LVGYTZ15 zH+%yW01baisc*j9>)AK2_nMk<_MxZ9PASBHhZvceYT=rAuHe7m?$RkoKo)*%pOp!7 ztNOU_ML4gvE(`xtWOK-Y?_2GSFGDzUhd$_apr?1LUW*8nT-TXkv2JZiSgaXXqEh&K zNtCh_Oh1I;5(TVqWx7M|sl&N|#a={gq7>eKoT?VPHd+E)koqa)1pFFvv1ZqQ!`<<^ zDh~I*UmqN*h?$Syza(n9A)(SAj)g*dNA;FL@gb-ipSbNT@#glcb^_3kzci;{=E6D~ zb>Em#gf0me=s5Z}=bLH4v?}8vU{)UapYg&8%+?rO5YB0BXz_!jj4o@EU_C1dO^Ze_ zD=~X%cd6a|$rd8|?<_e6NG?1cU$-sX7@`kmp*O`dy8{1 zbz0Bzj_YndzCMhAt%LLa#%5!nyH2*XXsbV)t#2b0^cTOkfC+#fI=#4=KNqKmI(hnlK<4_kHUe1q5+ZGgEqzY_b%$RwsNx68&Zy3tbY z&6V1M=y)}Q$NLik*;J57L{7ae-tqmd+Q?sU_mHOXkN?2kjbCHMH1nYDN>r8U=-<%K z0P@i3E(;plhlmafhLh36-%7~N_y%w;#ak_8@cM?q1i1TYpyD+ z+uL!xLwUKX(JCRo{9E8D8u+)SWcJ(ash6vUH3AR)>*eeb_oH7)8ZiixhwBf_+Wg{| z@e4|I@=C{?G|>UKECzaDkO9W6@>0kSY0T1+bs?+vL4Y(#b>yO8KH{R6PkpwVmzGpj zW#ds#Z^L3ceqZfd%_L*+<22;9Y|FeyDsQ9P>J88dNIKc|+#?B`|&#DAcRQcf)q2jj7EFr>hQo~cw!{R2x)RjDLQo^J~fxa=l>&=c!ZE{5D zY&JiHf`FMhSmg1r&MMk^2EF?vT`l2VSD+!&Z5l7%=dX5*?xCgAp6fa-AK>w^YJA=rItB%wJ2g zrK-z-k#G`hpQuHUj(`c zGVI(#u1@Dh7r!cAG>&l8PV{R+h97W_ z^YI}z)x`K#P4R(ahB)w3Ta1>Q+6M=XE$J*rib}VN8Z=pMu8ItENHma!NWY0+{~Dq) z61l3)35RAhGVHLL8A{(4Z!hZ4fF905lZc<{1r~7;81R#)^yEqix4{iA#6p2IxO%Av z@mqV~;!6Fdhj&KAH!R4PQ--Tze95pRLyl=Aev0N^a4#2#M#p7Y2f$I;#RX zmRks1DS&2gYp7aEIV7N4yOWH%SugvDmilzBSV%M(sp}+&IT#W1Uw6VyVMcDWW-7bUer9bhUh~IOBAd%tT2W) znLphCrVD5J=D=A=-EhOjGF~p(-+Des1IxCyrh*;yl zEWxDMPEA|V`z570M2LHis@-+E_HZ;bP(gVlM_G1N2`6k6edwg*t&7tn= z9Gp}tM`2#5mudIe`M3}^7Pn##m<4ZiHDY!_0Z`oz*KB)Mozs=PzXwI9d%1RdN$(aF z_&sw0v(Q3m_iP|HM;hY5l@M1%JfI&{J+eM<*_D+6F=lE++8CXyRe?!ieIY;_1x)g` zAf?f(q&)70UekF&z*<5xt7$o{o#+G+Nw_?rJJ&>N$aZRQ{F#8*59E^%DoM|0M+{4@ z1(olBc+)}q8uBreT*TO#hx*jkI5VJ`JV%NJAW=|}>k<($`Abs<7TS^u#aB0P%@%G@ zki}BXWp4%ga@XhOZsz44VXcp#dNHVy{;>=sU-Do?>I!J4i)<|i4vmH3gAmBsuOQ2okM-^%jr%F52l>dgvx4Q6#6 zeRbpW>L&B*mhh_DqeiyTw5inUp8x88{OUpeDx-#uV9V+hdfq#W)#LKjGnln=^tFr6 zYYLB=G6+Nz9BcFWnK$(Uu|L-?+ihJ#3 zXR~Vnm30`Cby&ysOYK&@G!R@sdEFLqogn?Wy8xu>G2u@GYM~(=WnuAHM`77O71==R z7wK}&BRnis(Gy}cdk4{wgL6nVqx?b?b=e>N-8rxkev&BAv&X!l?xQLs%*ghCTSUM^ zj(WXHKqZ>RNP~*E(J0A?-oN>EZj)wrbId^h7+d>NUno*wF;H48!j~Lut*{ic(VuHi zH5pDaOVzSmMlnO0ERomaA_YjR6~&7<(gT=MZv0=u3IOt)I6}tFkR@vMu6hWcsK& zy%I`%+5rAJVcT0_2IP=Z}bdj8rw0y2iq{rwtk8J~%T|<#wBiLL)6Wv$AZ3U%<_X*Q}HENqs zi=C-N3c?j~yHiAx^_K4iNL$(P?AY;YN(C$%yg^V$xC-MQvHIKDQ*U{;mFk6Pg*iu; zAC%YXZY^g*ladSmSSeA)M9$r6ho=-gK=6kv{1rt^v+uZ8eydWg&{->_$v8ygN8 z*Gp<&EJRvc=p2*`c#*#?OKk=Lneh{fV&(+(YW>r#%`FoE`ZcA1)*Wn{?69!H0*Q1P z(!n~CsuDc)m&?i^3mD01Vt#2JAc(5AMQO5UfWSb#J*h~5t1o+}8SaZq6h7@uykNPT$cQf5`dIGa@$P|F8f~MQh z7UWtNsOFg(sv5LohSrkK2E(4Wfcz_CJc+40C6(ZjcA4EC^4S8IB`V#|r8_7EqGjsx zLYhE0;TotSN0X|sSv4AuhN^^<#ex&it%Y9z!R*&>nV>o_8H&c9#Vni>O$dUGPUxnN za5h;)xJrnkGG$h^61Fci}dB@wOB(nBAEihK^@T>wc@!=K{IG4VhL$RK}72T-TS(H}H zDa?}q;K`4~Zo*B3aTwOTAWtcUysX); zp|4_+Cs*c^NI3sKO5?RU@?4Y6dxt23CX8}cN`P+xxeC}+n%ADXKr?X5BFI-=0X*r_1pJxpz&StrdL*c&EYI==Ne*OwXDjsBDN9%1*E zkE?awj5MA>Nm3ZMzn09-rmRB@Z3f~g{S`ZV<>mtL+BERiEb+Fy-EQ{1=xDud8=MgC zuPSR@UZJpsjH^m_i(y_N>IWr36));MkVJ05x&G8RUnVVDoUbfC6VBa$x9=F-S7A;b zCtT7JjH~anHB9a4)cU|pL_{sFAJ#hc0tOkk;Go3&;6mqVyd!*$dbtoeL#lSw%nIP_@&-v);kv-l<10h2S^1OOEJcfi#HAVL3%J_9#hsZPvtap=$&Z=i zt(FBix?W-Wi@xjcxsiw0-_tOXMHn}krNg@gC^iO`jhQ(yNJYv0pOIqSSfuXI(Vu}D zf|PJ7sO`qMNWz_G)C%#+JX)+JPOi-3htM4*EJQ14L4?$3z2{oWxmTJ4_`_XeSmE0mdCko1S) zu-YB(Uyu$)k%-28HNPYqj-yhou{yZ?JetI4I#p(V^<_Mb!|C$);EH@QOCS)1#^Rb{ zDi2EY2idnt4DTX^Hw#o^ut7?c%J2{!aMl8)I1l<&A|^{)ph9up23zcl)eM>LI~yqa zh7HYP@gzHcL_S)6HdA- zwuS}xA(^?sEPZCvKG$7oMargPv6Lr1^^$P9Iz4$}Jzwt*M5VKNX1m-TPW)zj`pka4 zKUJtGOUp@0`5WzIQQ;)2^)7IuT~Ip8C=_iFyUTQD?A7fq5ORrO2`eM}^x+Qs6(lRy z;f!OA5$%PxQy}L6Pt`>9>pjOkk>4i?He!Et4QJv2Y>Ou1KoMi|G#X7Yy#!bM{%d{l z=9id+V49YDk}!s0HqvlrkTYon`(YDlB=_U}mhih8II?JA92c?}ajIsrSZR(2vN-wS zqSQEL4VTXe>K4tP6SZ9*J|}_oL)gD~8l5U-37fG9yeWWbP4&k6G z&QEcrDk&~$ISfyb-?IR?Ba=}J)zt`vpns_pS0ooRsns?Nib&M<40F=8-+GPXpbakQ%2SHSY42JHX=srK^qwmPpwGYpP{gjW__Gdf(EC4BHzZUL z#}CM9mk{5U11U?}7)QV~tIEVUnce37i(bvC`*jV-3!WA)*`>e zqtek*4{+wjc5F8AC*h6W%^M4|_Ew>(ilWnrWo2_E@fq#oeFK@7wzDi*x4xJSqW5t} z8853C9r5Zf8nPOo9DRZLm=G=P7r}Fu{4UF<;5XmtRYDhD)81kBdqtNIwU>q4w9ftk@FMr&DM8T8nVf^m~1ZD8^wxvz00 zM9D+;H62^)BPqqlbABOP3w22qK8gYMsp<&FHc|p&->#sr9iH)Ngb&I+^qJPMuD_%V zh~K_VarUPMWEF2dim8&EA&D>qYK^{e66wH?=r@1681^}R7r%Cqo=z1HZU$;HqQaQQ zjYcVK0a}3>ObqoqCLSq_Mk5+?P!8qi%3FXS5R3QwdwYfkdQxQ6=^ie|+T?NfFHE_V zbf0v>h~qX=_hDn2Cz*ewLjNFLf%?d<&VmAGAtZ(BA~ur$wVWu}UQ4L}4j>M<{i9l7 z)gcBGok+=FA_%+S74rDE6uo0AA5@3JGQsXmQ;63aP10%VOSgsUpN1%X9prE+Q1JPV!W0rr#^07)|FF@QxHGKd_(iQQ z!umZE`~tKESF?!fh(fwBaC&+$0i{hUfWLRc~!dha>@GT zhksCo!C^BXiN+WI+fp+@4^4;XlvgafMPtoFT#`g6+Ooj0pKLRm14~^u<7@=^4ZLXR z8|y5vFmdxX3r@mlal>Nix?4KFVYQNO-!6Hm+yG#bN+ zV(0YMGW63o8(-?dY8nJAh?wv$hgs!Vp=Y896+_#Q^^g_pwDnJLzDL_OXmO%vvdKr! zx|Sm0bZLO)z-Bt!$ka4j}?$%o_L26dhiRO#TDtIaS>V{qbR#-^EPhjJ{BZ9g{Q1Q<26Rq;a))Vs-m2qah-!IzX-6CJAjomwQr_^_Uv=i@)mU z57){m6CL=) zh*HkpUZ|_ULnr9>j`KsSJ1mBdWr;KC!M+lGgw6iQGkC1t_fh_XPnWPMWKMQ1mC_WJ zf|~ID(@>Q9GR(RVmZFu9Wp5TuuLc?kV!hnPIhQ{sNE(xcxQs{-g*^&;F%n~ELQY%_ z@NveZ{ueaXCn6f*S0X8M8sTZIPj4C4BC0WvmESAq_kDRr+gY{?e+iJ1gi zBZfG98pR?!nOQ_jD*!8AhGtkp%Pg#qS+4JSll&q}J712RBj!pg#Ip}RZ0@leJ#?2IDKf9_r;&M9dSQEO*V?9)%qCv zxWKYOeT4FnJ#fc`!cox{nvCP$QcELIDw@wQR^!*3`wiXiVHMyN)%~RRTV7z>76MoD z_>JT*iGozM=cWtr``x*|7%99bADUNCDKOUg0?VSYn;+-JWZ3u~9Bayh8?KJ37e9@F zk$`u)V1KeC9NlI5162rbzQ$}6P_M73pK0cdYIdv;W*m=Gkl2(pa6O~NS!be#R^aTd z%fB$GP@X=3MXqlU@AX{3cA;ligG;WiBD#oa;#lb9X}Sfo7OfwDxii~1snE8fEXYqv zs%>menP*qLq;iWk9JZx_HSR7j&JgpP_d;E>NW_^r-eUbT-NT$o^xhm`th3sXMMnse zUB>k%j*0jiCtpOovA)<1P51r?2Ohr$cM5FxeS(5Si-j-F85AJ}`)em##@D&l`k>rk zlW(9TI{_o%#c%O)hF{s4w82VkHiI7+_k4y1?u?&_f4OfYd*hOPwiO`o1 zE7KPa?j`JTka?^8`xs4nV{qCaeF`%i7Y*jn;U-=Z8+>$EU0PLA$d2>jHkopQ2DkE+ zx)Zjnf1}tmE3iv$-$RN*#~`Ko>sMN1NC1V|5gt^NJR++i|292PX(8OS0mZ)?W}p{F zrv;&>Ojai>vq2;ZUU**-D!Sj|JtOd|GMobSrm?A%Y}r^`&n9j;PcN24s_=RllTBYZ z{@17Pq~+4EUv!{x7)m>NXl6uCJRhiPq!#>Fca+SKdvs8B?)|Njg!Mf?v3F1Qqxprv zn2_1Qs>Pic1SMH|OG1A_`p6b=7gT; zT+xp-{EnyM0#+k>W2;MMR4R6KDm0mmKdoks8H0sf(gyZv!bY@5_BW>zp@Kw+Oi>() zor{KQ-HSgce37^o710}Y)1y7ztvDq}Iph{v+JQ!1A-1;}qPw<{>0LklQh7;Rnf+2x z>p&!PpJj_AH7_l6T!1a57CKZ#bmdri=V{9%ZY$$W`HRg~kZn&YicTcyY-9c7jxXJF zf93Ny-OF6%%PQULZsqGK9r)I^Ff9H4u@dls{taf;8$x<0@+v4g`nRlAZ$lBDR)x|$ zhM;+?V07tW=R>bt5#PO=okGbJq#%_wl6>?2U4xk_{nZyAQmLbz zs`|d@fN_N7I7Af_1p1QktZ1=DxUCoeFdMgV{DKlvZGmgf-e3f9 znz%&OculPK2E(vg9v!RX-q>xrBR(nzH;wvDW`(kF;0;3fO?Tnk-|^XEVUpr z@Z?VbiH`(;^HdS1GTWE09aRpeB-2WBxg~PEKL3zWod%jAPXry4VjvHf^0IcMGnc|J zJ6i-P=M}%+vOym-z-qD&nGjqE*IPjD48i2+?HdXSCi$@HlG)Hqu3@JM@ltK8L}==l zIjU03C33zKDTN2MRB&Vkk#GUq7@=B5R~kgQ&`Qz`8(D-%3sZ2ovbF{h3;kxtpp#1* zrA<3fPFKWEi!eerwNwAA)8t$$pz<%VkDH3qSFHAU7&Sv@aT6a6~o-cR1&Je zm`t4Q^-}cpNdGlMoHg>L^;2IqX5XXp2LG`y^(3_lnwog@mJQZi%2SC1XzRFU8N=&A znUL&GFJ9hTs*zIIqO4~-6lC4D5w`(7FW^Xrlf1>k(5`~6$n>BabK3qzb?n;pk0R~mJzGAM#GDbYo zR8`d{|3--D6E+yt!2fvcNOn>9G&v2Hb0=6FI#$sH8uGfh0YNcMO)`jQ zxt9MRmdYD>!)u{|G->r#=HQ%k-PX=}M8XJ7V+O}ae%V<-c6!SXg2JARnTwgln-pwUl_k}uW8 z;qte>j)t9WuP^0HiA;MVvHuw&DQmV%#kNl-SWz=h5cbxm!0%cebs(o~$ zd--ZHk#MX~!m$)$5o-WQ!l_Xx#v-4lEiSO-{Hv9`$RA&770moJTRX3OY9cq;sJ*2~LJ=g!8yJhWxULV4^TX}igVz667*_&hBrMpSM z=M4=FF|E5DZBM%!e0~|5yV8@v(G@+0*xKS|{e8W)y>_TiuD~$d51+l!J%h(H+t=59 z*h52W1zmqR_H|kgC;vWn%ssw$z2|@a&n0nC;N04wx5%^tl_NzidHV~i$KE)k=e&N) zu?~EsL@uTNaG3sRus$x?KI(%$@CQHHiT=V=uSm48oKR^T!IFMjLg9i~NRJf2~Lx&F`MwB>_VnvG=F=o`bkz+@XA3=r`Ig(^a zlP6K8RJoF6OP4QU#*{geW=)$napu&ylV?w#KY<1nI+SQpqd5Q7w0CgnQKuYRNonuXQpmJ3nA8@jsT6HV zN|0nQ!MPTHk=n9}Ow)s;+ARFn3V@V?b{RKKN?8I!#hY3=ewb9?;ew|BB>^D%pS{1X zMME_0mUeC1w{hpzy_IRRc%>pmITbTc|&m_=`FK z2}vZxu4t=!_f3xhBwAz54HmAY89{Wl3cN8Faz5`PWQT4y=3<>9EJO~O%AK@M5ukx4GuX>sgiT6?*$YvdL4q%f6fR+wunZbRooh`-$ATB1&y^J~_c;+tvQh>g8 zXf_49?`B`U1psQU1sW6p)8^EY=9!fiXlJme{?<>Qs}_3J{ItedYK-8#w!4)%@7(jxK@VN@(Mc~IWmFL& ztssL1k`4%@1)b|Y<}^+`09&G^y+b7FE+~QL%6{Ex!c`No_Af!qxA@X_2RFp5RsXXP zMIfa38PY_Hy&W%Zv)A|Cy#Y89#Ap%Km%2@42huuu)h4LJ%p@8Dx0@_>t`}vac zy*x%x1F;8nAXdVroojw8G+&&|6r1oZvzZs-pWLlH*5}+j18ALQF zjExKFQ>gkpu8V+TV-Tn4kXGz*kG9}rXw0X@Jc5vrg*4CQ)Nb{bD2`N4Ud0(Ca zkd*gC#%#a~ACTtKH)Z{4HU-03Ey36hQYdDD2I(XaFGr9X=}02~kmTyZC#Lkca+C+O zW$(NNEHV`AMhyAI2?bZ4_6)OeglptG;TcbP&Xb^j&w_AK zAUg7&Cy(@=_6!P#E^H@5@DwJ*m8XT@I_25m*Ep$p^F1(n9N!EDH;eX@UWVG2;10SF zJh4t=@A;kOaLAD997LefOyfhj6(@s|F`d*Ir9!q4RG|)aDsaRlKL3%LRHZJJsZDk2 zQ%AN&hp^6*H|3n z5@^<7+SAdp3ItCOv?M8|sYQeI?LMFp;CsZ?5U)0_rxyL6RZGgcoSpTon-mXc*t%AY z&@liBgz9HO8(Pthmb9fcEm`#GnZXKHao-}(bBtOadtl0h9MaRE?vIz6>ay?m&reVK57g);6IZ@Q)#NfJeu8)JW@f*#9=2Rmm< zlSD|0)2!8qGRC#X{=^hR9TImVls)Qc@ta@$?w7y)_3wWVBLCGs4HmNYqYjfAcpv#Z zP;Vg8TL28F$G1AqLk&#V55Jiob!GUQ=yTOur)QXfv;mi{{37lQmEZ%PtAf9H&vWqf zMW0QUi+znv;0j#O?iplFN=mFl2x{OZF|UFOUav(Re30hN*qsw$XJr8#WhqaY%2l@V zl~;)t$Ti1w|qxh2g&A)0>INW;nYpUoqU;^t_5X zj;izK!gejZzzQKwG~utT#L>DKxjXkQ`mHGclg609&w3J z+$LHU2(T5G@JO|lDT0c%n9___DLltgOyM|1G>edw2e=hKwoXDKbs0d0t+th{Igd`> zafXOzrZ8!gLR`*9nCG10MK}70kPd-amr~KtHpLxx1p7Z*(Jj%GP6rFdT^rbib=}|BD z(9h)aRxirhcEa_qkC67MxBcyLpL^ZwS2@DnV@%L#9*Oh?F2(1v@qbSg#`y%wKrGLL zcOQM}PoMhLMJ=_%Pncof2`@_Xd`eIK5W#@sA$Tc7^* zxBva|AF>^aZT>Dva;gTVGFXXwSP7&o4kc*oCK9kA1^-oW1zE5KYol)h22G9$%%%otzQbpDCN5f` zRxU;Y5-Tc_hz1Gb0VP7YgiDj6rSGT)Xw>8Um~B3ICIK3QM{bB9G=^=cPCCHj-3EmT zf#ouIuvvVtKd$AsSi~VV!Eg}mJ3LAXXyx6`MJjql3S5o|d1MCN&js~x5BabU{ZJ!X zud0Md#zrKGdZm6=g{}}MS-j&7lgKf$Z(2-Hi26^a$f^V7>gf`ZV9Mi2++;9(DyNPR z#(G6s@P&CKk##u35wFL2v@ks?2%<`{V$9|h?<;Otkr45Wsv_|a|L_-qF&Kq$7=P`5 zibXnpOh=AHY_?0x&g7f|NxHmG$N!d5M&c(Hi*Vk!C7N0h$ehvUm{HP>#J+@Z0k2VS zBxpXS(M?)tsrKN#emYW><}W15P=M_L@v=A zt1Ttbr6>tvr_d@Tsd6cW=pF0kDe-NYpopw0i=^!EC;eiqnrtW4axK}iEd}plvw-S?f1nGc{#%G@&y(rE@wTj*I9D6ESkr z?CUwmW7GCBA{D|fyAvaV4A16>y$H%CohRsa@%=;*!uYa=BBC}$$$ff9Aq52l8*@CV zvp@awKLIq#_74N)amU~bd&J9IAjTT;ET)q3A+)lyE;1rCQ=7<2;FfVHNkr8?j4NkM zZ>TbG0>vI5VvxF~7XL?dVZ!FcW)t2lUXEdB&-F=~-VSFA?;^iKgbP*>(g1uJlL z#wo+p`2@!?cvEo@)k1<#aJ-YIdTJXhB2v5K#+*_LMB{;+kwa^+JD3Ag@y1NU?bO7K zvmC-QNueoF%vq9C0P$vt^0TKP%Q6#HP<3@zd9_zRM>Ru&=&XV-p7S(*&Ybd4GQwsq z4nsaKVm5wm_5Vs}Jd)K{t@T>5HCr98yQon6wDnuTHC)B@4<86>(sW$WHC@$pU00@B zYr|br;x4rC0NJ%(?e$*qHDC30U-`9P{qA>P%K*UG`-YPc=Mr zBxDw56QpKsHfMEqT#3&w*pnpCX;McbXwAYd#_VTR#%TE`DDDk7+5s-w;4IrfOa%u# zQzB~7gcJso?~SUX(2;u?c-jkWoPAfZuyIb(uq?& zVn7rk4gcviBJ>umq@Zu9!c)8BHWT7+Lxpgck0&CEI6w+M!sg4?6eeZ|A!l}V(h>~= zw<9KsU?d{=z61SW!XO2ricI2h0SzI&13ciBZe90v>nUJ<^q5*VAwrTO%GRsY)|sec zMaGG5GIuY$s%3ZgIDB`kDx>vgFCvP!N%PD%UTiU>_rV(T;x3|PYn3B&3qn^?CgO%M ztmlUUky~q`LQB_MLqdP7XECUXd|~%};rFwgRZw&!cqJk-RRVw6!cEeRbQwZ_JB5F_ zr*@lzFM$I)67E4;qTf*Ua;wrSVeTYc2v6)6n*_Hcl5n|FB0@#-dE@tkLHLkb&oI%+ zQU5NcRyxTdF-9bD#T35~O{XOZzGPMM!d(W#f1+Yml;}=cm=VYLcLN$-;D1%7B|#I#7krSY!vErH&usgb2ui=oDg3 z7>%LWg_#3kI%CXZaWnXT}S1XvKAa#zI1Og;hve=ro8E(<7< zGg7L1f&($`meR=UNHD>6r%uiz`_?Hq4QNM5BZJTPg3SV~HFA@Zx~-!+k^jA>tuPR# z#oB?+*LdK1#^Qn<0XsKh$#yKSdjA^Fkcq@%ajE_HATsGk?MO!0`mVp^cC`?1#e=bn zjDu+;h4zCq%o@X*_9c>nl*zbzmU^&H`-1)Q!jz}2A?vg)B({lqw|SdW=2uC^D~Mne zrfIIVeG@D3=)Q=~F9CQ6k^4MhE4dvwCa!6fHlbC+Ml_fkg3&3uTE{ZrL_OLpYqT4j z%0_H_qq@mS>$JpSglP=AeS)<&sXGit ze+p)?M6kw#yqp4HRv@fa(x|+IE68v9fJkh**FwpgE1RVJ#u4+a4rrRjCICpR$+;Yy zay%+=#%gKfJ>GCyP^EfD#EPK9raA}%L|g-x%AA$DipL?GF%6iV{5GAC zg(PiU(W5D~VM56Vf{EkYX~fCQ`x1hcM1-7N$N|ePKi$$}eAQX~NldbYE(q>=z1D;C$5S3ZmHMN=AdNVJOAu<+{#U3Dzc|?PLl9j zH;&yecBk3rhc|2FJ=&y#@^UC`JBBG^S#wM zzT*|dsHY<`Fbg$Tjz_|G$Qivo&(u^=47psAcO0E{jQq^I38HPHjOSubP)tal9p;H8 zJV^fJP^8U0>EE*^S_}(5M=hJY<~MNuBsVg%PVUKSD7mCH!(C zU8C*&p6)4B)Cqf8qQ&JG2-5Rj>IvB6DZldB;*H(%u{BYSQLtK7HBpK?D`RX1M$o0e!o)ypxhKHSe^ z_h)<4AxH!7WBt}b-S-x`y^E{}Ji>L%;_}T#@YYXiUm-rf>8D?B>IAZE;kQbyUO1R(O*IVB1wRO1PdBGh%lkTg$x@ydDvs3|WIT&~9z@=XU3h6X1?jAp!csJw1hZ7<%&X!)S(5>7~Ag%)0jVTKxR$YF;beh6ZSB953L zPYd}3*ned;)!bH0ZE+NU1o@PJ6fl-$kUgIMubE64amYQBFInZ6haYmL^XQnx$o`m|Tm_5UR8E8g6g_fh0 z01#;-L6h=n%a2SZ@!Egr(TM1s4!O03d;_(TKzD}{DkqXVwn-U~!x?5Hl%kSa>#b!G zDWzWyk=598bt(&IqPAl7-b}4BYya&)uwF`#i?Q~~5E-m4D+QpHW*fk%|D{STx1>=! zZm0I%i*LUA?#pk#{{9Pazyc3UaKRj+xU2-(nk!`zpa!tTW22HQSd5DOB4x$^0O8l7 z*5x@W8IL*}l*OlEtZ`W!S1P3xBp>;Ym%$CDa(GCpn1sjx*jllaq>#+;vU{1hRCjIx z2XfAj=2(`^1{WtK5Kad@YG@w2T-{g0bu9HjN$YG6$q_f)>wsSC^|V1I4#%#2DXWYp z&S2yD+NfJZTF}_bQk+oM1R7Ry!w>sK_0Iw9n6aEFrwoLj7AL`XLX5@@THr$4hZb=* z)xEbtdQTjHiI+Y8Fhj#?tpB#zIm$h<<)DjBwZm!8PJ8XP-;R6ky6?_=@4o*Ie2(z; zJ-k9ZbM(vc9_dJ8J5(Z+JVrVy?@;t!AM_dZxI3@?^dVV~BtqT?FB13#{TM#P#+_gM zN8_{fzWeP@*vj+b&(FU0B$@1TSy@ktLN`m;z2J@i5qP9%ocQwYNN*E<@f zZ-;#Yi4JG?Ll@#qMH2j75O1QqBbr2sCTyY;p9sY$N^y!*tfCdKxS>r*Knjt=q8A?m zqXe+3ZC@;-8PABuH2T!>Jq@C#c2*^MRa*%{9 zq#+N9$V4h~kt6xzhL|`&NNz-ujI5+3FNw)aYI2jD?4&0lLb8g45+b4-lSqLr@7z=*bc>vrJ$q3F63?xN<|ceA+HQ3Cv&$bC|>|rZJC+%w#HanapgaGoJ~~ zXi9UM)U2j8uZhiUYIB?16iJe{a5sv4Gn_MQ1vtq_9dnY?cg}lQ{YcRYc*@g$<3uMz z+NqUz>T{kttfxir2_k=%^PDow5uVh^t|T6mpu2-7f#}(aO@Om>F%js8ELt#(azuN$ zDq@Zh+Rc!PbpNCzEomP)x3MlJ1f@VwDMDE4(u2UXcT1s@=iZhmuc=5%6lF+FFX%0t z&dVV)jmR&48ls{?M5zy9Dp51mQr-RMAj1jPPRjyRnK)HLTLoBGF|r9M9B*<8K`G=+ ziq^EMb**eQA&ua9l*U2it*wY_MCfYQxdH~R8{3^Nb}GSEkYN*p9W0H0^qL;k6-N;H zYs<7!Si(w_IbhuDVrBIZ$F2xOc4Ymo;{^i6sn-?h(P#*OySU@V4*+KGzLxhxAeJl=Nij!jF4DDFM4;k`@bv!B$ z_jn*iUb4W-!ZWtbDaHYgNs~1MsU&-i$O5}EMA|VdAb?4WNm!K_DdQCgvMDqr2GWr! z4Cgq@dCqhO$$65auHvBQPY=1XfwXKM!2LPTv`baTYGX=rN2t;PdWxhj7N{6>|LCA>VkSJYMhj z<~!!qt@+Dyo_3?J>gU^)u>+UH@^~M;!9DMKez89A4%rG2_UV(X4u`iNo80VA|MuVu zfB3|&B*M_+*@hgSAj$8El#riV8$O@;(Z8LsrO)U&?Ytt_PspMrviwF>pCR4vQ26sc z{)3#q`M#An^(*Us@#hZdrhnH!+R+A5yvAuQS%3N`(6P6&^?P5E4ib6zC8ZI1m`v5E_U<1!p_wW)Me1J%?oxBDf|&==UI6IT^ZtBgVS`zOgBz%W{4#_M0WGP*gvSGM1|foz zlY|gRg;i*USJ*)o7A|JzAj0BKTqr?aSa!hCA9xZZUr2`UHajpEcixw7H+F^!!G;SW zK5=*)X&8ofh!B)VAq66Kq2eZYm^pbEh+Bwns(Ors&g{5eUr-+KcqlL}Eh%H7gG?PNEX8#;{@`_Rti>*kD z1_6sTgp2maJ3;1aJk(wKvx|H9VZoS0#mI`Y=!;%cjDO=~53-C6*C)w=S<|Rf)%a&j z*NfVSY1cRq-6(5a=3kmZCzF>!qVb0C6OPR2jTM58t{5=!n2Qe)i3XA^m9k(SlaDkf zkEsZd0V$9JNjokg0dgm4r}H;-f{;|jB@xGvz~+!)w}lbOX|=->tsn&wP-cL^D%nL4 zuQ6kv@f2lNW)h^3U9piJDMnj_9wK>f*yb#wagY*e5W`{_9m6Utxs&{7AqLryH))Gy zXORgxloy6oK?#IMS&=n)k+%~gTcjeHAqiNuCl1CEKxva4LjRL@S1?-nlnl|8b@Pb< z;A=G^1!r+JZ{n2ENRV#{mvJeV7V=`xcRaT66gXFx5_gw*sbf2pk87frfGK$RQd4j9 z6(opcZ3$5@=3Xz=4 znGnrs5zx6v(wR2YIT6+=5!e|K+L=2^(h6Oaoa4w6+{q#2DKO^Q5Vp_`&PfsId7SSF zpYbW57gCtP(@zCe5(;%j_31(Uc}@Nqiv~5H14^I;YX6`Iil7OqpbN^N4eFo|3ZW4y zp%Y4>71~G^ilG^*p&QDf9f~_z=%FEsM*u3KC2FE4ilQm1qASXxE$X5#3ZpS9qccjQ zHEN?bilaHIqdUr@@_C;rq(e%iMQTE};83uZfAKVR@f1p=umyz0L`eEDNZO=S z=cEx~PEuNPQA!3RDv4gIL|gi$uhbP{+NE6DJ5Z{ot8t}EDj)bKPfcoWXj&I<3Quvm zq*z)#XWFJ(YNrqqPuNp+mKdlWLZ)D#X74uv06RIsW-u@sEVux^Q;~rGDyZ^(@Lq?s;%2vA`Q_FfTb0Z z67c5#~5QK4-T!%eQ^&w=p3UKv8}LAv)P}D@2kxIEN5{8)*np zxai7YjmsWRHn@y|vw{kS521-YmXVoDfQN`XtsrKJYa3x1I&LFr5Fxr_wjdajx;){! z6w$e$+Yp-zAtB2Xuhtp1yCId!6qjo+yqj5jf||m%EMlZ$U!sviaaPI#RG9d;(JQ^v z8xol@v`ThwK8X<4tA<>bft5BIGK(7M5xyKkUQG6F9SFV;`Mu>)m*Pu_~|qFj2e$oS!}TsHyp%2{I1d`#5>G&xMR4H_Be84Y!cJF?OAtGOg3960a84}#xcZ4 z?1o89#19g(?U=MP;lq>a$PHq68Qa>iYZ!v!H1w((sqOD}$53v;YKIvmC+?8ko$ z$k6Cp*%xq%OMdV6eaD&fRW1nHUAN&{3f{)H1HC>t^AHRHpz41$)lWfp$y5qj6}dU5T+L# znEcCGn-azhIgxxX%G}7*L6M2vXzw^09@ZVs%*=tT&D%_~gG-sfEER5f9I3m3%c@rl z^A%%^#N|r1?1>lkTdsbAbYC3Ls29Zb?8OK{!}UDRP}v^lA_4NzhN8hLOKHdp!OkTU z(9>)cq)^Zdea}qc7x}DyKf%vS46;l|%$>2%5^c|FY|(e2&TbsiF7wf~Ygtlza4)i!hBr!4B-x5ggRa2fv3Y)IeR-@LMoB z%@DDh5EvuQbFys7W&gUR>tsre)bM8=L;VuwEEQ!e6Gz=BPR-FxEr4q6Zj8xl)Z8AE zW7a=S({*jvHwwJUGGZx}5cJ{BWw+NuWopDx9anu2gRvWh%^`@5C%l#rjD0qSt&3%m z*p9upl-<~poi;v^1j|X$kk`|l?GT^+*_cAumVMZm9oe_*jm?M`kc}j$Jt45I*aAb_ zvOUhz(}XOoV0Cd9x2@TCE!@K$qItbyZpdg$kpQlwhv#$L`dqZ0Q;5`pDGR2D=y;8n zmLV=u-Rd{p&e7e{{e{^b-OUZ&v_Z&Equimy89tHNZZR!Eh(VHO-gaV2K^P_RtvT@R z-Q$fX+U+gh&Hvr#4I%O^%sMgP_}H`wZVv$NFA2UJ>7CgoM=|_}-Qi8#8Lr_mdT19! zGKv{-Ei52RS#}|+EMij8kACU3#xhI?>6m^~nr=6oZaXeQ=p2b2 z!$Kq~^8cywlIbpI>N|<*(>&_Ur|OgLVWM8?q3-FMj@vbnCt`Fu;u#a4PU_pe>1dmY zz8>7iVK;Fyf-Mt>B1kJ0x$Ak3?b)uOG?Oyj!NRD-?HQA2-`X{%{WjjdF|I`JKG_Bm zW77JY0Of8F?cOqGzPs*jO6$Id_^0FOK2-Y~hoBIJTFOhGaJZjBm~ zVHv|kyw33b9`8OWy7g}H0v|2}FO8xqI}(!dD`M|>LGL7QFhZg65fM8SRXEBLitTao z9g|FaQFFNaKDdqc0eQjZga zNB{M~ar7bL^GJUoSzi(HgP%Qj^*2xUWpDOpkM?P=_G{1fZSVGP5BG8JA;vBDb#M1~ zkN0v$_j%9veed^w5BPyE_=8XQg>U$WkNAnN_>0f@jqmu65BUsO@{v#Zm2dfozvpCK zKrngvo$vXdPf|%b6GUu#bQYkt8-kz!mX? z7q}aRiW80sA;%8-#c%w_&q$)r5XjXAE1^Y6R5vlQU^P|M**Gd3xlvcOJ_QjQ z62Ra=gb5Rp0wBSjLWmJ1CTK{il@yAt6ea;cO5(v*0Ja?50w94!jsQRcC>YTmMJXr; z{`y$6rj(8faR#tQ27oP_32_1qT2x}lkw%p+W!lu~Q>am;PNiDa>Q$^+wQl9w)$3QV zVa1LmTh{DZv}x6@W!u*6TexxM&ZS$|?p?fj_3q`{_pZjLfF;tr%JE^skYt1cp~;Y? zPYDPADczJ4B4LS>Bib^Fu<|B^{}?6-%CKbsf$a?b;^;9z$jAmYuS{@|wPmHh+F^!h z4*(E|4Fmkzxzupzro1DXwmMrmRm`)^O3(UyYIMKZwQuL%-TQa&;l+<9U;p0xdGzVk zuV>%h{d@RmT|1rMDnSAXq_;>ISf9U1G7bajzXSq2Xp{UXN+5~+0K-T?gF@11lam5q zPN9ni0>Hos6EulI1_jK}q%9zP4X1%Pd<_87Ryxff{sc>C3kA18%AnB@@~Neeq-Z4x zm{f~!i}?a5NimS50AfKIS7PZShLSR@1?gLWGqApr82^sC%#1@PiLK7n`fiw}S5y^Zs zumle6QUWv$MU)~;qbVEvD zUUKQD&|Ref3R<2rnvx1zN$Lw4Va6{099t(z>#Y5uad+MuJ9)W*Gf__ z-m!V&4{cjo**j)rEptqvcl(}JbDrMZx=xX(HVSOD8*iKO5*=?mq`NINT-ueAig+N< z5MR;s$FVYZDT-XX9Cd@*!P;(waFX?@xa~f^Db|w`-sI+kAD(IItGE7o?6cQ?d+xjU z{(JDlM+{Ph2%0uFU3m;P{e%EUsBB>y2Lf%_65*K`PS{Rk^6;DG+;Eg>H7y$PLj1(UfO6wBxFoXDngh2_R zK?0a0JY6t&87#@Z9vH6|!7hXR0ZO}8guiZaFet5PNB=8~Si~ce(1%O$AVL72+d5sl(wV;kN0MmWY%j&r1A9qo8W z_&CidQ2U8Oc6X2q{?Q;Zgi#+8Vltd0rA;s^80gR+HICKahjZPF5-hOmJNDV3?rCKdaskfka$ zsTyHjI5}r9t!9<0l=JCS!MIPfrd6$LWoujA`c}Bc^=NwZCq(!N5h)(hT6uln6-oEL zq~OFypUf#@&WbtQ{1RHWAfr796H$dWi6g4P2@s@^gv%17c8Oh6WpKlp*hJKe5{a1B zZ1f9z{52?A>maVeiPM`Hvak^mt^Y)6%>SR_HkZkSUu}8T6qnk>w5>ob>CCz>+YwSK z%v@|^t;0NbCgr$trEYbtdtK~iSG(KgZg(MaRh!64xhZVmFJQN$*~(_JYLkM;I993i z*^iL+AW}joD&H%*X}7SK(NVn*knf2l~Z2avgPYh~9mRJyfH!LVJ<3-f@X3#254b=K5oU4 zpyUPA>B!5rFei_Jnq!@b9#Txl5dXzK4V<3V2v%2`^NF=scaS(|R6`KCS44`V z!lrOJY-xrbo>NP)K(ono10l-uWQWW*_tw#RzDjVh7~ypqa+?b*q-v#N<^cEvwoMsz z<66DyCdXRVv!->eZGCH8Zx_5Zq17+8;L4I4=pG^ zNOBCZ6=b6OE@U7x{STU|UF^en4o(PCXNLE+F=DeQrQ4>_`W%)wgbC?34M|k%ejyOd z@(lnirQ&!QED<2YrZ`MdwiK8R=xu{r!Ss%|-+q(sbvZn5>c&`0_(PL6IP2Zk9tgjm zLYxb8N(#R&%Dq{X*$|W3r~m&OuT-i{?tR;gtQ1rEVRLU^pS5znUcG%6*Ctd6uCs3xFERA-4s4m0mv(KSl#iyEo9p5vHk zNb5q$x{Pe`-c6YLem%Z=ZyL8P`ZV2FN*7Fz1h#gC=52xVP8Me_O}0#f#_ww1wNZ#3 zO)pQ`g>W}+bOYMssc`+^GS9JeE&p@ShhFrfCw=Kne|oJn{wP6Li0C%sSb}q^m0v9i zw4NIj+e^gt3b6+fYq{FrAB3?rY2s$c=#t>qq=jY4J-A|1eBLJ?`bw!^=j1YdrugQ7 zTiHG8z5jjihhO~TC;vbBCkY<J)fBo%$fBffP|EB-v{=pLe zuK>XA@T`#WKLb2K1WZ5$TtEi2qyEE+-x990h`_F(z>l!N@(>yNdNK^mKK|N^NqLmL zNu35PK@&Vd6ih)CTtPf~z)x{O7A(0KoIx6_K^we59Lzx-+(91fK_C1?wyOg)=JLqj}7L`=j| zQNw`oB_PA7`2QG0?cgM?pv3FxJxGK=deV^ma0s#JpN0sL)w-~Qp(*+rIUvD2wK&DH zIK^S9CPB=^|C2>UtVLVAMO;)5=~zD5hzjZ0ChG{snqb7H=s#jq2<)i7b1KHHaE@U# z4D6_@)ldpv+=^pNh-eH7XY9pistV_j#HBDs+bD}`jEHiqifq)1U&s-NP{S=O3U+h~ z8WS`>T#9#mifTlNdwhy{WHp-;Mi~^kf6PUKEJ%Yq$i3htuOKzBz`nB(kwW|qh0KbH z+zuxk3x-UZi&P6pqKb>`$fxi$YEs3kxX6km3z4KgT3pDLL`au>NtldDuh^T1Ntk1C zp<>$v%>Q^38f%3Qg(hv3|sxdJH2t5zDB&7Rda{zH80O1WcP8ChJrV%2bXYIZecB&YE~d zIRDuu$}~-_^v>-JN*1vZ9m`3Xj8FNTPx`D0JK2>b0lY5SHoN4B6=_Wk5gin{kA_&C zn88HZQIGT!axv6v^yF`)I zgot;+j|tYoh*Zf5b0mN5AALn5gQW_9rJ}*S)@s#~56Rc6 znAqFm*u)BoY_kn^IXZjH&`7>6v z78Z-2qpaG>+uMQMgD{-1iQB%-TgH_b84(aFGu5OBTLyx)lL_3# zrCF`@+(6MH)it8Sa9g7)jlVslg#E77Ro<ve#uGxj8AD07*s~vdR%%UYpv(Ez~XP z)R%RpA5$fqYPEvNTIZdTxaHcrUD=UD*>~cy&cz$HncgJuo!HIM?EjrKzQxk3Jzw-q z-yA%~b1lSQEhv8}-3v)2pQ4zH3xJG+F=UO~s0gAnqYY9Zg8;6KX7afAjj+0t-oB}} z5i+ck5a26uRoWc0fAgprDwy`&UsMWThucU7Cd=?W;0@Mb*)`x>fnWkgxQbYz4|d=H z9^ecrU2uF^i&?i7c3~8jV3$ZI4M7tBm0P1oU=wR5Cw#nc^5G1++zb9+>;)7du3$jQ zS<0B&coo`~4aD%WG59TEtfF8EUcM*Jp!ZcHtJGnal?eHzxf6!ri$Yd1uG|($WA%Ap zHdbFdzGFPD!DCddOoLO=D!|+FC>&*phro%%V-uO>UDK67ga7DOpA9tugAo3;-iUb{ zz48nN-8@K+CO3`6DQl?~qn&eF$m8f9q~8^bL`X&$8f zVrPg5%Ae(2d!#>p@$m5yaE8|j(eJ&!4BqDB~dNa=C3QbxQ%0Ip5Lo}>WyS*(H?Em_P(s` z7W}Cbgw@A_ey7VNTp(^S#9Jp0b*5XI5e&;d7DHDq89Gywtv+5?fwm0d5RRQHB2~Zix_Y!0~M=+7~6hS3}LP z@`W|>K5ngGFy1x_&{gh3@@}h;Z!FgDp}k^28E%=yZ>8|vy5-(MB}sms7W}zwl8VzV zeO~9T-Y#kh)OHgak#PIw)b&mm^llvZPKXK@zD*#U2Pc~jcOLUDZ53Z}7XLobb-4N1 zSJu&1ipjV-Wm*G^xu2~#p~7E{>ko-37y@((eKV1ueesrKohjn9{y~#{MGYONu=%iA z@r6_Q((&7{)sA~tA&0~n4|0JO5*+7LD^KgxfblTra>k)?dS&xVCN$g#+cUQp+?aDI zM{{aw2^$YLfhd@nna%wa^FCh{l>qIYz&9SgZ`3D)lTs2r4gFOJ8+*T#7yK^gGXUJU`krH+8d_ z^&P+U7jJQ34|ZX{IZ%{>+}=`G`e{;y6OKWk2{QIXB|#CziTNXBDmvt@V)hTUun1)$ z$M~vTeZ?xfu#_1&h_uUOM<7=kIdO@fWD$2KMa6CJQITTz&Nz%|FVKDQAPq5ggl*4e z7hEr$KUO7(V~^&%fp>`^(fP~vEeQB!fA|kQ#d0S>s1{A*QXG(vcZ|>PZ)b{icO`V8c#;1wcdU4MyZX`rPpsQz37NM|a<6%d4`QAt z8-_O>Qsf&_v@m&>6XA6dfS>rFC&iOxAfIpdf@cXI>3Ms1rf*Mn)T;NNm)4|j&yizf zk&pI|$N0nedJPGCtMB^ePL`4HCZA7wg5gY#VG$+De90&Je(xZJv8uwLWEL&5iEERVG>&r88&=4@K?i* z0DwdcNzk4Igg_*;0w9H;!G=j%MQlmY;zA%9Ar2&I5~WI(69K#wDRd~&qDGG*O{#P$ z)22?JLX9eQD%Gl1uVT%rbt~7dUcZ73D|Rf|vS!bsO{;b-+qQ1s!i_6;F5Lk3Y}t#L za^>B;LfaJu%yh3^yl4ADwdYslU80DEK5p80sNki9BZsW46>~(*11}pU2zoJ7&LcxJ zMjg`hK+h3Nl7Z?vB5Q%Q*G~VgyES*&*qhv1gTY08Ry+U3&F|l!jt`m{f>pjYu1ZE3HNyh61g~ zm}D*{1|w|DgFTUM=3(qmMrV8KjUy5?Q2?M;0lTuo#rI%uwsivD2n4@Ddj;Eog=#3g+sosg2 z)v27a+N!Is!Wyfrv(j3ttZdqvtFF89+N-a>0voKb!xCGpvBx5ttg_28+pM$CVuveK z2>?(fT+~`iD7Mft)s7SjHMMP~N|6BoxYv1V3n|D&q;M;wJpAxytz1ZP0Ak)pu{{v4hOvjOY_Y{A3@aR> z!VEiA63L|4IIw>OA1qZ$=H{ewpDu@G56D}@9MZ`hhupJh9t$P$P(~-!N&+at+qBb9 zLmjo$Z%R=$x&;5RM}`z*8kOZHQrIY^njzt;^_XLCg|=2|i*%*DRaGs;)dOX{HB*}y zED+m7{qwawZWpz80B_%&w@^}eM590qy+;tW0zLj302EW(hUD2&Mr}tl3xv1O19=V= zLc1ab&u&f*|FQEc|%-(hLC6W z7>^K4V&e@!<07S$z|jC$uatXI`8~Dw--92%_~XxocfeTL{Hpm_6^!{(>A%I0`z$_* z&=zEzkND&S9V8G!&K(3MvjYH2Z08tiNnjJLkXy9|BEO+LFe?8GNdzI(zN*YDBnSB% zb>N4fQR)9=YYS9dL~L@tfs{mq6CsE#jK?$$!Y(2Kw2T3p;z9D^Fo!zaArE_4!1+l9 zasF!51+Nl1s2pU7Tsb09sKqe-CBbn73;?y%RFeH1Bw)6%iKnVZkl97?bsP);6P+@< z7n*L22`Xb$0JJ^rB#|n-6OR`MvcZTT4viPX9{&tiFqITcj{*VXPzXswK`teZK3pUt z8|lbLDrP|44c0&$kK)+Q)PElX08Yu++R=~|J%1yajyw((>VB+xTcDv*Jy z90&swpui*mk$Rd00vQ$qOH`@^c}5wbCHJ$V1d=P2W7>i%When9ibRq%tK=nfaxrAe zl577k8we?q0JfuavXahN$l~`IVVj(N(*?fZa%X$`U3*Z7PEyq43=CyO-N&Qw+= zoCpEsOV-K4j$V_RWYpxr;z`p}trV&g1*Onf$x2bqRHTKpWkgFiKogOItOFrk=Mtch z6;Vr=1BvTkg6Yo6oYR?k3FjxN306{uB&)fEBw-6{*ux@LPDSLOCFd4^b}UtYOf&z8 z=BVk`+F?(B({s-_m%13sHc&Lu>n!#@yVQeZF)0JIBtkYjTGp0UwWlp<@=5~R1o)+3 z(+j{E*%w;IiZffBz3pO-STNiog|ZZBEGZx|yXpO+w|nfXXED39)+&XKB5~qH0MG_L zLT-vxl-x34f1}&s3)`c7QZ-vxm@} zV{o|{&V!XAlx7DK0_zmc;L7op;ERka@XOmm^}R2Y&xg(Slps$j)~` zSB*jdxEeOw26Me5x8;jtJmVVQI9mu8lEr?!z7&ty*c8daRO1arb$p#3K|b9?qX?pi zTl7$Ld*CpxoQzd2P9Ob}^OQpvTpVF|Rb2i<4h>l6O!M4#6QCI}L0wGk5EF7tPU?f% zBzZ}PY#7xG^Q6dEicf^Nr6V_9f?V;Z_A8D49KyA*haD*-j7Z!C;_{!9*mjV8;c*js zl!0zNflB5kPz3Vb7oInb$JNY#O&4>8vs@$rwF=;WDtOye9RNND@08~q0IS>gg?o>P zLwq)Opd)4SWD0pM&wHiDN4_-ZQZG$AiM`q6*nMs+{2oimdtm<`CFhX!w(2>O^nOAI z_DT;rLFUNu=R-gG(w{z$k%H(AA^MM7s|;zbeV>Ftj1&w}Iqh@?dDAVLKIW&{s0l1q z=P+c^;I$9%k8&4M;E%g|L_Fl<6Yvb_9L=HMiHH{G1X4m+Q{vDIskxf}(N5wK!~|tp z#E9R{i3CFxMLyxtdM)3nr5eSJi9P(0=Xr=NFjGS;ltk&EsuXkRO^7Z0w6{_TkKaN&a~MF?dWaf}~yq)`8g07%-US?S2(?1&Zh=%D}P zmjj}aJyan*5up*H;TKLC^%>$JB4Q$LoYAe7$k|;-R76Dl1L%EQ;@}(_?jP$3nP^D? zdw9_72;dG@348n=Ch~~hut@X#Q;=mMw?Tv)R>kNz;@}j7$gv`QM9)%|{9&*m=^qNO(9vYq9 z;8?(FH)6?S(D0174s;z@20O z?%J;@T>I5xIwo4rfEQAp-vQ|qO!#3GrWya04nxJ(p@|{gg(X!Q;O!Zk4QV9>>DoNv zhvE!nUob~K&7urB90-Qqsp$t@j!70(4>VC5uIbyJ6$L}c6<{XXqLC$mab{{pbPROs8!|u zVP;$o=2tRb&qY*B3B~_OmNy*)5R^;9sf7P;enfB%lL5`$4}PRT2&GEQriQd;XXfN| zQfGBq=ejWBBkq|s_LFN=UJi<04c(pIbx6BGSWm{p`Egz7sU0GP+-~ioeT?2f43sN{ zanx1{0P|oqxpM9rOfTR9F7;zX6bJiD6sU(5fqXmY9 zd2$;~Y$FTC+kNWX!Hs8ll3&uHo_*O8hMHc|*#pl!V(F~sQ>q<$g-(Fd=W;sG`JL#E z9-rgnr&27aUASm1!Y2p5TuyuhUAhL|DP)iO7mhv!cWS3d*xZUn#c@FgTOp~pnUihe zAsUrLOuk2$Dxi_!A&cf=eS)G$5GenTDut9@XPnCEoYE<;?4(lC6EjX+j+TyJ*qN5n zV6LU#X}*qDW*Sr?sa9qslmx1Dd>i2zDxsp?Xt|nt320H=X$(qgErJW)SWl@i#2q3~ zT7KK0<&mE{oR%I11`-MVS1oF!{)k{fAQs)&S_sRq@f0vb(Z z8o8oTsICUJwu7=RtBKH?F{!E(h8Kj^ zVl0LoCJl;ZC74p`uy(0PX>0$Z>1lXfYMpXy$9n9?CW<6jO=gJU4+RBD$A>Qam zxb4!Ij!GhJy% z356z3_V}+yB;8GA#B3}t0&4!u_B1NRVGlc@FQ^$$4Yp$X{+;I7k~1o% zv2FxHgkr&_;R8Fc0z&YnE>^f^m+|z>&<&~-kbzBL5AviHzin(pDIl*Z;H8}$!<}sn z2b-6EUIk}pN2ry)?XVIj&Z#tEjxKQkBeCOZusz_H6buy2%+3I-=&mWSXArQOUBm^G z#tKs#Zz(YHxbFYfRAs$(mwV>w7qbut124J)QbQy_e7SH=TyYkkut#{t4YyVfFN6zm zp9vqU0>+FWo0sJ#&TfUV^uVf^7ODaYlEdz1(0=Jm=5a{CFl6p=0^{%)^BeZ^?qf;d>=;f^?ozz6R0zjXP^jA6GJy=N(e9X+#IjuIOe@H8dbI)$ zeuZX&2s2LwQL;@g=dw{qGtZ@o)`rM0Hw9j(%`WR#0MK$WgENp8^EKY@P+W79Aai$= zb1y%|I*UX#uW~)x^F8BpceFCa=FE$v$Uo<*4h9&uK~p-*s}mX&WTb8y;>)LyNJ1m5 zs)(ytluQ3bZ-GT$YKdrcQ*aC~Pqh6-MXCU_g;-N!5X~5psxAj#7gvQr8%04&v_q3e zRw8P`j&wfbbWZE^P7BFCSKm|k^fLZ}&rSp!v(D;4?T2`sTmZ%AGMHq_uXS@89*s*7I3bz&>_Vl#GQJN9Ekc4SNTWK%Y7d^Ablv?IB6 zOFPPDQ-x=HG**DNN>|5dTZd^^c518kYO{80yY_3tc5KV`Y}0ma+xBhac5dtTmX-Bx z`}Y5D19xx>_i*boaU1t>BX@Eu_i{6Lb36BQLw9sb_jFTtbzAp!V|R9I_jYr4cYF7D zgLim~_jr?cd7Jlnqj!3%_jZ5O`>>9wdjobK*<9Lqi_>S{a(XJjpg0&1^g`Rtbl^c3fBsy6v z`dBnNMtX8s(79Qsxpq8ypf{hS%ehroI#XQwfdHhKi@ID)om}ZmxiptklsaXcwD$O7 zsu#_|+*{C$b@)+WYfxaWk3=iHI@;_Etm{Rumj-qk(E3v#&8{zdT&((E zw0hDA`+ZcqWn6nsEKpyA1tud1#0YGzBahD5Iw1>1nO#h_Q#;R$&8f3H^{BgO$U2#& zbcO)TTX=gLsZq0Mh`2jQzF!5vn?hN8mld{43fU z`v#i*)k{681-=&Uwcb*7MLQN)xc&Flv{7umP(*&wCC=VgN8?`w+*5_-iv`#-@zJx| z-Fv;~cWF%aqu&>f*n64WTeaeg+%LHP&4>NEW;KpAed^P`=_dv1v)KRI$71Z81?GdW zWZb^sqoB+q|5t2LMxd_rKnw$!`|_7w!_ctm=crq?lWU@yCR184Wj_I-D*lN7`Lx3L z;}1h1SB`xPNfAd1iOC9GKg7Vl{oxczW&Iy21^UbX+`0ev14ICU0|^!+m;?YRgAxEp zY1IlL0D}`LRZI7%_7kz+%Q2Dbo6Knfy9f@Dmhj5u;2%abW33bdD?p-Yax zVD^*(z?MN$B6}7k_%ow#S+{E;O<_*NQDv=93U@VtcU-jKIM8DRY^AAf%R`}z0x{~y2r1ssq-0*7jdB?$_$#U#G~Gw7FgxC`K)=Q>I-ve36kwuKA>+LC{5TdT99RnC~ zF&hucaUc&VlIkNB1?sWM5aEk(!V0xQaKj9_VRrhM;6F#S;z|f#RDSa@bN#(3a zS6(fu6eBW+rD)4tyIg8ir9LGV08oo6_Su4b_3qGEAEow7jF5%&(m2zs=*=a+Wo%jz z-P?1?S#LF}TSsf0bX-{V-Iw2f{rwlH1|t0+4Y(^UVl#cFy94 zsovUElrw93;~XAGf;J9-BeB{^b)bz>uPE=rBL0}D zl6Rju=)!5IJ2QwM?tOTtg*S_$)tT=O*n$?{$Zt{;*yQjHOJC1qh^!s@@}o5uUW)7` zD19V`zAi|8bmfNW_1MAg+wp?7SZfQQ2L=EA=impL9(7Tn+*JM+IFk%+eH0->5|Z+k zz7S1qRt%H7}_v2cOyvdpclmX1u!eu zGhgZMXOc~LPartNoDMaJxD28&i5B{uR*0A|H@*>$ag^g6=~zcQ-Vu*^?2NA_VvD}8 zu^_*Q&9AI@y65>ZP$)vAg@|a#g0w4zw98H_)^wPk1cpJ5YXwSf$GelYPc6?o%3>ht zl;2roC+xEtApb{{EnMy?M`PGXO3D9`Q;srIA(=?JD3c~fHs*jFk=d4x);ELvav+Oj zWitOrHDqQ@E~%>J@B;A66za{Cib-HaW@nNK#sro{E815$<)Vljrh$MuvWow`U>^(mfU5_D=I zUFT|=*+x%VNqGlZs-JDlU4(O?qO)81BMQVS1EN>W^t)HI!ZX>36rYr3ZfpdC$IiEnLkn#CL_ zl!Kb2U#WRK;8Jb90wL~pO*3G+ad*DdG_Y~uR3p&{wI~d+)_zC1NQnUyzBtjFgl(cw zg7mF?N21Pnoh#pJvgiM~7`6vPK6z0J=gevy70bqWX}k}MwkJ5*lUNpfUN|wxY7ljq zd5xA^Z!VB_Jw|W}<+&lqg7Q20;&6$rHnsZ2w^}piNKy_YUZ4=E%b(M5Q4+Jb&SAyO zz3nf{B6vJFO?i?jZcmrj8s34x*~4_3u#O4)W$a|q9zga8Ah&d74U2`s+39OV!u*^u z+xIK@9S9Y(1236Ev9ySuNH;Bwk!6O-yJ%eugO&2>g#u+Fc&@U8enX@m?hVtXNgbz4 z9c$BKM9JvAh%FvWSEfkW#U5@nmaTOlE(^2INjV;diCvU^szfd!MRJ2@TWxD!8{65| z_O`j*ZGCYn)$jiVg0kI3incT{FcG=D2UZbnj``?Kx5!O5N(Wmz%>Hu*1O#e}mz)1GQRRYaPytbgwX_0tP@G5@d!ysTano;>9rQc=*f z7~k}fx~^{RcnBqj-;SVc-SH`p*N}1BX;1sphbpwR$&E5`8g5?Hd~Y}aoG)|7Dm|Gd zO?(R>d2quQ#rnXJz6<|~e&|;W`xU8s+`A8ozIJR|xV73rDC!OZ+c- zMxx}#Y(gl9BlOPO9uNW}Py#2A0xQr0-{^Jhp=+Y!be43Tp4mQbxIc> zP0d&=WMrz(hN#dYx`Lqcj(7UXB*{b9_yXdvPd)lc-O$5+LgHjn5+fSX6G7$EDh~X} zizX@RBMCw#-B0VVZz$2P$wIUMSt%I2kswxlb`ad0Td$k>7^h6l(t!bL(%NXli3eiAE#Qf1nTD*LjY zj%Onm@is9>!qPiCf=GXFqtF4zBPEK?;G zd1|N#a;V1gcgUbQ7|1M@q9lOEA!LQ50!3yrlWy9eAX2j4db28ilV`vRH=iaN6NfcJ z!ZmBHja-l-j#4>srxht8Fc0%Nq2)41^Onv}E*6bdY=}9-ZRVbDIis_#3^OZ@;`KDc z@Yu2zM~u0K>33w*9R4y>(biDDX(ua z0_|A{FQLA2BsYXNI;o~?L>u>SFK_Kva)d#`v%ZWD_7tLL7BbnC;x9ZD`hH}gMn?*W zrXzx=BqTr^Cn7sS=ND=ak%B9AI>{-iu#-~sD;$(VQdDm~)V3VtuaN(=B0`O(7%0$; zZ}v`fGmfWzAjXeuK}zAJEUDC{6k<|LO@6R6O8p4`5HvfCCM4#}Fg8Lj@Nl$N4M>*M zpX`Ao;ZH?58!r~OsGAiY{pj1oEw9afZR=x%hM+^~J&(3-Y2woIM z8{#g0qEcTpBBTJds*p3>6hX-}QD=|Gn8Z$=i!k@$?Z^I)l6MY zK3T0C&=fF)XByZ*}P|He$FI z*6gYO7)wgb7Dl=?T#t?*2I_iRBW8gm&jdoDy2bPwf+ya}xz00Kd=+njfII)Guh=&I zSm`J9<{tzwR>%f5VS)jpQ9&lR7CYr>-A`?QjAEq|tX}_brpAwHdqPfJwkXnWLr^WG zfJJLF!*3TLJi97t6vEg ze&bhu=a+u#7hqneBt#SZWHlW7cOv+=ARa9{lA@cGO$`AU_!2<6-lXIl^1?3SCvIsd z6qq6e_!_qn5x?;-r*K$jk|8U?f+KZ;UlxIj2tnypcqkZLo@YzEO4)EiFQzP-ys*ts zg@{TRZ-XsTLm1|8I70Uf5p70BU?R`_HnHs0N)i8VX^faqJ#iLMBT}bk!c_0Yj9C6& zMzk=7!e%F~KvLa!_{Ks6hC>O68)$g8q%Xjj>mt<;(-Ugt6k4sQidBdjQo2+t$mMJDT=I`gpCyyIfG^RBB-&2 zmnSI(*b(0siRse|N7y2KSRv2wly8cRADO>s7##(R{g!z1-0^ouBDgxaFjQE9Sb3Da zWR<&Ajc2$qR`Wt7^4H|kkpUSjJ9G-K(use$nQ{5v%2R)9)PA#Bo41*pyLp>yD>Mct zho&MU{siziqL7T~VZ`}>l13-lS$xRZWzhfYKqR1xIweJ4l#)lOrnbbKWQjA*iF+WG zAw>q}{8^TYhBNBI;s9yq5I5hrx~GJ3Ppg5O`ZZq z(U%h?V4yvk+S&k~2j`ttdYnUuq=CtvD=Vc(aIb0__%=kRnqxl)Db6cKaVzHM-usOm?_}Z_% zsoqj=x`o zm2@mUB1JcxWIwfJLP8TIJga8KMyzNMFPEP?Lem15X76@+DA#qG%vx8RLi-2A_PAo2 zOq4I9$z&$Q-$|=Ze3J<(#hd?Z$Zc^!uHt%P^KocAfrwngqmjdt@||!)%A?}Puf{Mx zydJllu$oM{5=Bk_+tnD5oG$svL*l>xvKCXvsm}$St91~^e9g0}$JvNmJtBTqY0a=X zL*gpLp;>KOur)%Q3zO-bT0+autA0p445{N$Jr_i6)XKZ+gwCtY!e{ej;M$u2E!6Qm%tbsd&Ro=cB8_H>8pDXj0iAr3 z*zfwLG$0Ymd!oas+-FA@pj;wPTsE8YTG)%ZA$K(v(JGyXj|9^LK(4(7pG=tI7Q`VrkG&gJEb*b5}P7USTw zl;yQ0BQ}aJD9In8{#A57S#JkPHo@iv1LzN~S4zlTJpH|HKDBs$=3V|5G7#pT9_Aqg zn{%{2;6Cb&BI#8n?zK(k1tjbRwC_E`;|+qpKmK;UeoC7@!Np$c-2>y5?dvUG@+Y72 zE8p@jAM+hQ^IQL(#ptuf-3TS{ILe`GWh&UNCx8bsl107WROKH2ojYEg_ zYlIOX0tg&Pu%N+%2oow?$grWqhY%x5oJg^v#fum-YTU@NqsNaRLy8oJq5$&6_xL>fFh*r_Y~2g9;r=w5ZXeNRujE%CxD|r%*`_luhX4%S-}bi~Rfe^XuQwzkhgJq}YNGDO*U2#6uh+*~X3;5ojQmuN8^XlJp{u(>fg24W~=SCAlb78 zp}?-_ECBHJY3{d79^@^!6G<^?0(~wCz?lx&0>ryF4kW?2^9r;@0{j9XB7KD>aHIcY z?goryD*)4*5xUNHlrXD1+Cng^`9?$v0K~3%F#rZbWJ|$>o`~SS<2npcv;-9jr3BUr zgtD_LS2VJ-@P$e;04FjO^FU;TyJ5N`1+CM~IS)h%!0+}PfV}u#NOVCHgZ%SARl~dD zy^|&_P}cD_Y>+)8OTdw1-b%3reO{wvv_ZdKs<<0jzr*s2z|b^>i{wC>bj z2Q08a7Do-y;6evbwX;`)-8Z`wZ6d|qZZ{5*3PPV?rgHm{MKA-eFnLl z1k4W2JgMplj_dW!AeX#R+G~@`(%S{aEz!WNf_yOIwsWie^2|5yd_nCn4S@gI1<{uT z84nUl`a;pWY^3zmL$nFU74F+=LG}P#=|l7xND9gmMj7EI5XuQ68S~>$XlT~Al05)! zdRqSGw?BfU?^zvb1^xh5KaPwK2;~DALD~l*_(=p{+Y0~%-$$scwT}!OJe)w}hrjw= z&2EGX0Nu7TLcoj)VTsFEHAk98QqU_#W$ktH2bcVZ;t zjKCMX{EiWwtPNFY+teK-Gv2pcEJqzdxU zAs-B3{Df%2ifpWLE0hQc=?6oN$nbwPtfVGAGR81kWIKx-$PPuR%1EA)hR@5TE_caG z@obDqpM)Nv2r|Yn8Bk@vyj%*C8BBzbZEQ*mz$E>Z!iFrVZj%h%L%tQJ@zt%E3E^fz zzNI-F0w9BOizXYdNsxVI@RnOw89Wr4eq7z*^`xtGN)6LbIdwM5nscY0m&G z6ad6T;{ne!%>a;7A$J4G_yT8=jH0ld5s@d{NIH;&&g!E?waEWY@dnJK4n&+!>t{+G z!c3=9)0qBbsY+4URG{+2r%6QVI;HB)dnQDv3Z-XF17Or&5@eqPk!nJWN}+%@bf9ys znOrGi)R)FIOm5XDULEMWl~DAj6&0XaUQx$%Sz1p-#b7pAg3XCgObAnX=)P+pZTNqd)sEeNj_QM%W# zq;#6p7GzMWb&?bS1~}G$mbpU%Rx2{(U7jXHJ@oY&8PfmDF)8UyPxV1A5E38-hXEL5 znrDV1N6RHgX7;pmAYv7)(4a09G7J9d!UoS zHWyd}2ISK8yIp~_7Qvk*8fU#LG~sH^GxUt3D+BQ0`pWXS$#occ$-uCjX_&)N>KT|y z++bR6wYmv$FGPgv;u(hu#emyTdAVG(R*o|Xn3Ix2L`zz${uV*k9Y~E8Lg%Q4_cgg) z-Hjb$T0ckR7wd&Hg$S1Bpw4%}q|-2=)+^C?_Be~qm2H2|NK`NvB+ovMZdxz>wC?Kp zyH<_rc&%q%Arm;!?fv6>NiE+1+jqJ^&Tk+|x99(ixVhFTelqqXuwdoBxr$Y8=&L)7 zU=kDC#18>ArgJuA>HfL0*v_`Lw;h%0WK5oD16WbN6~>7b^=Z})Ub+tgu_Z?Lhl?$l zEns^PcO5EvO}b;H3F0ne?zSM8q?%m=Aa8oJ4}fQkQtlwS5EjEbA@&wH!v%6TYek$O z?dF?6?9te`=^G*Dmbk(hsHY9ncfkobGBp{FZxw>@+^U}5qzw{swz5^+8z=XKcGTF? zaV%jS8zR?C{<&+?w@~8x`ONhs1%mxjcS2_s%JY>|1oL?0g*wyCUbl2Y)@Niwv#3D$ z$WBUbwcah=__R;$$bE%rrlC&S!v%tKYO4Rp;jC&I&*rU=x_hM8TL-#yu|CX`O&VZs z_wk0Mp7MMdec>>LNYznz&~YMN@+rLJ){{HfZ|Kwy zTp@T*@>$pY5RP*_x(Je25)yXpp%pKnQ3u)7pZM;)gItb|yF7|QXL00b9DPOYc)C80 z_K5@i=wV{mf`y-QmD^PL3T3d%otAr-bscNU4|n9*s&km5?(CHlHS##dc?1)F{fuQ5 z;?Wp2XPJ#5Ek_Fo>}#CNl7h^?LTnrIQcBg?r$W|{1Mo)!6Kj=|r2!WG`X@pXVGFXDxQ8@5d z5x+J?8f1q$c!PuJh8YGj0VG`VCyA=2U$E#9YJ`L`W>37xgo|ZOc6CjNVTd`%GoOKj zglG_{7#e_>d^=cy6UZC|#326xM9SI42f3XJix_?gEC-7>Ri0M$`p| zvC)H+XpQVhhN?JKzgUFxH-yG_Pih#2!Z(ExScT$sg^iPi39*F;)`g^~N35837Z_g- zc!t5qR!_Kw5|N4u35Kw!jIcOH2p0gf*fzGPk%%ZV0r!xexPT~`k}A29IU#oFS1{;w zN3!CQJd#v0DR3u39|^F82b2JDLNGLl5CD@jzXUj>0F>-DjM}qtP?(fh)ssK@f*s*$ zoQQF+cYHYsGD~O>LrE>Cl50`rVs9mX6!(>xNHLr!0h@4?QpqD>}NbYi)TbXBUjdY3 zN$L>oiJ}8Jk_~~T=tphgsHPkPAqn%Obb@A2T7h~4Li%%1AxSvr1v2{frvQhZ3K=g% zLuUUOSCQvNh3ZWYu`zNQJ{;*Rm9lkR=zR?_ami<4QUIh}nlRpHZ|x(hzGb6!x|E-K zs#|(jQd&;s`4JWwRegF#lG=Kvmw)s^sc)!5mv*HG0j73Etd2<$ms%*9#f6coP1WY8 z%xHkZqk{j~=v7OKCSw{@Np-ERm!+txt)zJnwOX7K04YUfIC9huei|s0L~o|bG2e=Z z+1e1s3L5iTEM+Q-%Ep=kigu*qk^~tMa7v?}Kml!dh z+ohhQ=UpZ{Tw`-nN5wCy@hW3+K~KDm03D@VBJ^RnmGgeSTYp%*a8DX3^9v_#vsL*-g3 zI#eCAF~(GO4|S|k1801DK67KayXvU;$Ww32kktxtpR2SKA*`qe5r~VlI$9CEmPO!` zF>o@xWH7wuMVT}sa6xH#EK6`n+gk?2w9Qs;a%K_hBDLX&C2P95cNL8ep|#Y*wHkM7 zU(2aEH>F0pEI2GSU7S|L;w~9Xcf@%w zA@Q(+`NK#2zrs_ozS^$yJG3P%1rmV5_TerJ*2naf!Wh9aSiD+MJjbMFW-+y7Obo#* zlf4_LI<|Yel6=7samFhMjs?sR<0?yMh^Rq$FSe3=KrG6921lE$!V&?&TIKvZB!*j|IWlWrLWy==<$2}ayt=oEbT#FcsxhiX;4uiv!+rR(PJk8YX zJT6Ieo+iZF<1TT~O!xr>=G6^-BAqI=_rinSugJ5B*D&tNuRyoJj1 zM8c1WPxQRXeaEE*5zSH6nM#R&d5FfI#LR3;zGLjL(rV8&SzeeM&hIO`U{;-l8EP(u zhHUG+;K>ksCc=o-v;-@hBTbxQ7pB8%I8E{~&eAvyJ*iVubwqteiNq746hw z4ba*wyRrMwv^Ld+gH_auwGfBU1r0Nk>s_+9F_?_i zzAb9pnu!y5t-XzYD!ZZ`EHs{VaJrqa!mUxbeMVSS-LRLBch#YoCSqXw3kiLJ!DwV6 zaxZPFh1_kc#ho*VHdw~UcEK3ih#8CCjlT1BdeB zG{2qO1D=R-go2*|S-(|8F&oKH3yb!WuyA+Ct7wiLN#C4Uhttj5V4HmZnqyMx!m1N7 zt^yuvJOjW^E0et4 z70#o_4T=$o;kyltDT|88_gh$$ivZF7Y5ax|I=&e-P)SI>71?@)$u;NM=(wI9ybRvQTgD{M{!Wnbl~zj@B!+q&Lq26qTolF zG)*|@qBdM}8iT{73%Fs$8!=%2KnEp5>(xV5r_KB8 zcq=7O`Fu=1x_|pJ<;A>Q%5jqhF&RVbwchI(1u`d`J1*9ZNjY)E&NaSw>&{+)3|E^3 zBbn%~;tT;=&F)}@($HudhXJ2+3F9|hf;)z74;*<=P*Yx9b0z>kp$t*tRCFR@=jQe& zH>;RIx|i$YDK8RM?$f33h9X|KE;P(eFu#B$Dc7(MWxoF8H>^g;w|MYM9xXk|btIQ` zOk!$F{kh@!xuRRzKRqBw6+RXJd5#hB#h#ZoU#B>KSDZZ{t1jxUj((2mx52LM29)Y5 zl=ZEymRzq8Vy|i|kMvxcv!UMVr0z3QUtT!>EezJ|RLWrgMwcI$!XmPJiwmECX+9tpD%d9_(*NU#Fg%oxc0L-}{1*tWmvjva_tvvteNb{FBlo z$UpG9V*KKo{L$)HQja^0I)wPk-oT3x4@w}F;ONJvGi_od`VoMHp8&Q%w5OG((ga`KVpK|Y z=hC1G54IJ$1>sG)5m_#MxsXg>i3|0LYzmPSfK4iE>P_;t=C7rIi{@My*6!YwEt70n zyvgZCQYtldOD(tLvP&<&1T#!A$0SqAUs`E}zB0E<^Q(5+q_Q1b)co>II@fg1 zPCSj&(w zA62N&MQei3ErE!PGSk`UgH<8DSk?4PS9iSCxJgN^wa!rY%yl-Y2K}{HPkAL2NkOel z7S%(KOcdE-O$2~eNS`$>RyAkUG+JZ-zXdm3amOXMTyxJwH(hntWw%{---S0`dFQ1U zU0XCtZ8N#*^^1&U<+X(rq-tXCUpxoHD=GE{=GVyyjr;}Qh9{=DVvA=BiQzI4UdWb( zF9tbekw+%EWRp)uIc1gCe3aK$S60nsm}joF<%Q^!x!%K=tF%X!d(9c>fyx9Fz66rc z%4a--b~5OP3&m*X6}Mzs;9eZN2$c&2GH=X1wus6a7|ju?u&+a?3BrJaf%A z=e%>zKL{Dg$31u5cjvu#-+u?5-PqOU zn&#qzFS~1$k4GLO=DmC#?&!IkzIp47tp0lKx97fl@4qi|>aUs`-d*v{J%7veFJ8Ye z@Px9yeB;^&lm43I7k09R@DI~|G5J>)`OK59;rXvi;xnLR3aGv*C9qfR10cvEIGYJp z$${WnAVx0Or3!AaVjcuv2t_zT5|+?}Cq!WiRk%VHw$OzygkcP2I71rNFhp3P*S%_E zLmu{Uds;!_ ziK-c-^Ac&tMdFN(T)a{%5GS*1c+<&tYu3w4~1w%Yt@jkI4@}%38Drmy03_A z^hhKEoPZ1#vx^S@WMEHO%CdGAoTk8MDM(pqWm;O&YBh?c8O6vZq;NctqJ^f1e9K)d zS{b0$&!aUtDvK6!B9bh1DI+NoQ>8;xDe06^1Wi%}DYR2W?N3S?s!Yd_Q`D~r6-k5H zp;O!A9;wF8r5KHfR3QS^55XouQ<6enhv*g%zAvX-U5#0i6jP?yrZPA!Qc`6_o*@0y zNQw;rVK)LnwaUbmuyO1_D~gexf@L5ElkCtcTURdqBB_m~s#`NVKgdF4QX_RKdupm# z0E`r+8yTr&4#QE5A?IHdp(>rO-H`%W zk*XsCA!#xHWRnk4ri-KuZV9c<3DIyf1Av4@q#bvaXnf^6Uo6?;qGZzwR$5_Q0BE;k z_k|09i=>wX2rMKoiU@o9`ALMJ$tVy3;@-AEhJLn!!WWhzdtsGdfoVu57T#Nk39Kd# z@Aoz&9m^*6YtpE;@<;?WFhO9_;8r}?NFkxzU$R?c(XL5A-|3=&H^trD+K z43ZBFku=*lB4wshLl(>>EMug~%p}8vMLZA^yP3cKoz0|xoS6$t_%N^%$c{CHP9fW+ z(G(v4@oehcW68ir3LPGZl<&;lI5T<97*X(Q0^R6LAKBELu5YD@YiJfLB+_V_w60_g zkyJ;d#D_LguiK1aFY7uvMv8EwZ>E(`uh_*+dNQctJZmV|I@->rlYNgpCF}6#IFsB$ z($b}8DGdg(h!iZ%2&7ZUI1*3vEfUO0C*JDY~IW-uJ}_g5;e5QsBGX^&xVzu{|~kZ|o61&g>(IvxOq zb3C^TS&X+i9`cmK<>gO8IKlJXBY}TBDKAI4LhyWYO4YoJxh49)@N8D0le$SI_pFuw zrHc`$e@iPIT6xTiq;>Bq?aYp8xm$wHaviNa;|dx3(9`bpvMl#W<_1&Mc_eitkvl0g z_xQhW?v|cAd?6dZdwauflfFv^@RA`qod%Ceypw&*eja&B)=oKz86HOgNW9S{V+#}= zsqlQkIA>PA__-APesPfph3SqTkLevQ zpCpAu?oIaza1gyGxJRi%PkP$PR$qIFw4Cd%p?$rzzx{_+a1#aI5s$n*Apzy<`wyAW z`2#S0&-Up0M^4RRl$<=jtUmz@)=O)qB6GLE$1xhAoW}Dh=Gct!lfCK#Ki5kg!oP2xJHg z%r7OBktS@gSJI02C<_BjjWBw_#F;_An>EK6K|1rmw@|<6TQ&j&qxCEQ#QfkDEh?NL zG>$ohxmpA)TAV*H(u!fpiaR_&P+Sg4e5_N<5T~O#4rE0%>^EkFykK03Pz*%(kUvno z#JJ&On+3NI*w~L?`463*p0GG(#zjh;U;s6*CJ+ z8yqKK258`%n-tx3;%+yPRO0c4flDVwI*cr`9Qm*x)O`|x< zh-1y`td0rHO~TO^;EYc?Jj?y0$~|LBbaKt7bPKVxiGLvf%!eCL!Hh=Z2v2gHpXnSR zg?LWPv&!S}LA7WH1d6lE+|HCtn#P!)q0|?zQcn13OZVwZw$mUIT~7E>2n{6||NKtG zGc2t<&Yc2F0i8^A`bv9B!_fRoYgCOBU5K*O2(l#7>Z>i4fK2Grh_hNr2u(fn#6TS> zjsPGshfs+u-BO?M()RKy!b?w~6C0hp3jMT)*m=IZ^w0I=FOJd>#0-h%G}8%0$JJy^ z|CEgNgwGxXPO|ui{S%3$7_a@&h?~<6HFVC3;?Mv<%b=9hNrfnJgd)7+Ny$eo{+o6?v$2(d7j7iE=VQI`76-TVHwP$mWb^Jm0 zYD~L8RlcCoGTX0FlB6Zw)FYj(ZDdycUL7(f?;FCFb6ji*yR$vuVY2DVaIXav` zMPHjO_+S`^0#uGnR@vAqb0ybF@(669mQYI3B;AaVd=G)BjdtZp)yNq4BFA;}zqC9l zs9?ay!w9WllyAj5wh$Ehd@i5J)?TDl<4a44<<^K@EO5mLjS#iRQp*@E*AtUJb=3-= zkiVuV*|_4>Uc}dRMUqzaLrk?;f@?_CsMc65t6|l~1C&|GU|2ETJPWH?k~7#Y4BArL z2!pf=u}c23xk>e)qE>j)zDg|4MkNo)vw6evdYbkSXH<< zqp!8r#A-!|qgq(Cg|?;Avpqhe6%==ai&Fdwr8tX8ISZfw+`AJj!WAsR4ZpexS&`eb zk_E$)J&udG3xna;X%mnS(+cN$NMJNsopg)Mz0uK~H873O#7xj7QP{t22XP%W^!qf* z{8&n*-P%Q=r=cq#cp?f*A6SG%-euV|q0Lk=+%vQr_9|OUxvp*l4cdG;y;!hGQMoz= zxjl1C;Xt(gi<+9!)%VJmyj6`P{fnc#TEn6h;0>(k(A5DvUlH|-2C2H0DV1wiR^%ZyU^p(ORsb$ZMiWuf-Xo)xbX1MIiaD}?J5EjzPp&CY zuE4x}V^jVL9WDz7E{_U97=y|G-~>LhBlHj>jea}E-iX9F=f<{*jApN~&JRUHjwxom)_6Z= zrR}dknjcJn!Jx{AZHrk^vP5OM;I5Y87E+39Tn*kcuEr{TvkxBW=rcNL9L}Vk?p(5# z#`WS4Knb@!qdCs7$IxIdGTt)0P7I!wI=!e#W_IuQ4juwM4vykz2a<2ka=Y}|nc9#s zOfIPOV7*`^4*oO$(1>V*m}EAy6bt(9Z!l``&c5#nk>I!3@0T_*m0&?M#=G@>=7FLq zN>R=2MmOlZZ}bAW#8e3Qs_+!Q*^b-@{%*+R^5!3_44E6^`~V8o91sPhX^Cdmk;m@P1s6XlDe(rSOg@F;nJ#dfL~$xllCyIQCtt7Hz;Ylc2_V)| z0H^af+jA=I)1+zd7d3DMSDFk*k`g!c{^q^)GO_}_$+ST9o@{aKgU)PWbP92E$vE&c z-9brrI2p(PZ?wQ;Jl@+iNKri8%7<2e` z_jk7*Oa1DIYwxo?TbrOL*?>4-jkv3+Zpjcpws0AT?OQva_onkNzC}L8o;#MEU5~57 zxNvbh2U?E!^#hZF9s2id*<6|+>Sw!mtfkgd&v&uHi;~Y}<&OB7Mrxd8!atGMT@`5@ zC+U~Bhg>P&8T%r=cnF!D5YZxBM~V5~dcsm)EYWB@4UvM2=Liue*qn-5Sd|))TY0=V zc(SAa36%F>t%p^St&;3!LZQETmTq{gFMFq&`8IcYlLwTmzj`LgS%J5SRy&fo|JlTe zdI5)LimykDU;3su^{UrcCcP86r+R(Y`-3wIj+9!TGn6@=c;>Ox1Vu}?uWBlW3Ob2Y ze-c{B2>HEti@R?Ug3lYspFKOrTOSujZY7P5UHe{y#{S}r#fbf|p#A&P(rVtW-0s|w zzD$}F-Dsbao5vQyx0ob&#sX==HfE4^1_V2<30Bm_}8yCRbx(i93JSh|~ zLc3DI9!$%0VAac%s|wB-^Ii;4A#)u1w~&C_LDV8o23>U`09@ULpFt$q=pSrC(FNd& zeI=A!0`=jf5n)C4b|jJYrP!ZAu!RVblu`+m9YQ>zMILPuX%wGn5mkAkP{VELS(o8$ z5hH~KnHfM@I^GuIhyF#T9gSS6x87rE2KgtTfeJb(p@kZHD58lfx+tTKI{GN2kxDu# zrIlKGDW;hk^pAhp6{Hb~mjO^+0I;D*>TN)Jx{#>=L?oDO_6TMRM_UsA7T#4t+0$xX znsJ1xK%;te6_{HVH=;zwMg;1OEV)M4V8f=RSF{1NBN&($X6qcR9?jYkMW|9~l63~r zWfr&wzDDj{f|*;=t)Br9qdg=|$!mw@t{Nq~$oTy)a}64(iLi{i23(m z!&{L0C0SRNb?|b#Uc8XO;VndQM}m zcPtPPs}t)qvL3-U6RZ9Hsd-n#FZ4IRz=PeuYgj0l0Xv(;LQZY{PEou6vh1rv@Oy}8N9xV^N3k>&+}E(H2q zryK?mH<&q!)DYV8G z4FSRyHo+LnU1cg^tiauhp>&?R>gA&FVac9R#zaE4+mUP)F+IeXZshASKqc(zm|DZr&GO$?R< zmZ&^i0HGuam|~Gw^hAT4@iy^^;vWT;qVV`9P|jwpzs z*`y9nC`93jDvwA+iV+2)kR}G;7mRFWDVLa%79nPcb^J>uWmu9r{zHyZpd{tM#zbUErETgH zt~**&l?HL)h{{-!O|TQ4GofTVakQGIy$cA1EY2_gDMvke@=l42u?fxslpQOc5RR5} zCPHn~wyuEjMPuBHJYD3bZmo?(cIpH~Km zp|(V+H}h9SQ#!CRN?ao=E6SpR@)Ssisa}w72udKbkdR$$8X^I?NRGntqfC_zLVl_) zcqSpEG^DDHvMPloo{phdY|B4}7?YJsF{IyAD@1I%MjP4GBz4?qP66}Oj_ftAX|&}H z+1kmL`i3t-5{wuFSj09AuXm=Zj`1GbM#q-K9<0P`Y62jMfDUA!GU9BJVt5(l{Q^rS zV@O@_X~csX#EQR!V@iJ6z0Qgjf5OBmSejV>$=RMxti1guoCZiZfsFETfZ>!mSyb0u z7E*mV^Wq4jE8Xc*x4PE7E_So4-R*MMr|X%P75xakzLeB*S^cg;&daCSl$VR!D+{WY zn8sV)q`k-c?plVJ5K?``dES!RJ1^Oj@D60WfSK)lb+Sz<9Lav~HE>u+@m{2cb3IVB zZ&wUhL<@Tb!|&W)<&bo|_ey}ie5@Qq)Z3W!;@37`v7FN;j4BD6gu?Iiu(@PRpZ6vJ z!VxAhl;nHbr?sTPIW~y|jzX=*(Dxt@e$hOw)T#t{hQ?`xQdcyx9^v%vFD3EuyI|}Z zfw(NjHLfOQG~y#2=Y_yMULc!~ToN1q^X{c;{?n2hLm4Y0<|t1?3Yea_1?Q&t$r4mZ zk+=Al{zA>oFg`JuJECI82uXSy)^mqZoJ90i+P~!0G@Q>I7aUKI#|A#JnD1*jKGRvq zC7z9dLp^6t%Z#5ZnlwuC0N?uP(WCx#Mo4^1{YpVxs7`Tk*Spu>_Y7;GpK3uU#`~Wh+W384Ga$Mjy>Ky_xgVvKD167 zrkkkw8OVO^ETQRbl8ShW&^Jc5nG^i6IO9fGbb;QqFSl-R4;;)IUZA48tMQF!cMYC%Vg_7WNmF)YDF4l+#x< z^#EZn)taI?$s5J>6(#-UV~@+%jehsI`)BS(%R8X_-WRK5D(y%IJO}IUL0a)0?S$`% z(j#T~xX@ZsSQmTbCGv~1H@@?p|2*hJFZ$7w9`u#hNv{fbsmh=JFRdSx^I~5v)w_oE zB~N|rGbp~h*?#-L@u5DC1}F7o@=Q@M$mn-q(!!vd@p#xy`fV zyZ%{SZiV6=h{5Tj-uJNo4vAa!MxrQL?|P+-SJjR!H5YiS?|hM)+J zAPJVB37#Mdrl1P0APcsj3%(!>#$ZQ~L036XJFJNej*!WH&=!!yACZCp=AaM`ArTg# z5gs8DCZQ58Arp2UI5i;@Mxhi=Ar)4k6<#40W}y~tAs2R`7f#_5eqr^Q9`U)K81h{Z zo?-DdVH&ET8@^%VwILkNAsyDC9o`|PFdZK5A?bx7aDk8>Vo)I3;UMziUld{kBBBcV zp&@e6j$GCiDq;-c6hEutZ#;3B2C(3Egj3AtS^mfrsjV;SNhFKWtwe9$t6o-Zy+ z3B8mtP9rtSqAd_$L^xjzk%0hSBlLM=ptQm^dRjY>0lI~SHf{npLPR^X!Sj&<8DOJR zjpK9BHJRXJfh2--EAwmuc%M8Uu2INYnqeR}tN`^*EHUvQa!bz~k z263b`E*e7rg5*20NI`1kO+4f^x??N!v7LFwla=XM${>el-SU(dVQnD02>6R@j1ru84@9 z6I887YSzZ~$;*1o=IE^EVSSfwTIiwFW^M-9caEqZmFS5kO4N|kkV4Iz8EM9eg?>iY zOZ=ycq?i zrc~^tq0nkh#v`_s6GsU zRYtVlDV4UXxpr%fjK;oF%D6s8i|_}b!bQ3=YFo0axAiM(@erX-C%^vUpKh!173`l} zEVs5qy~--0a4c4Sth%Dso|f#vdL6SW3bb6N1@aYDL7QP91PqatbyX{(WC^1GD4*#O zYb)ugy^71XX_04+snH%S9F}Q8MJc%&jLLWfKS2xAK8Dn4Ddgo0<8<4d1qqo6tAlu{ zn>cOkyv~Dk5pu{z)spA3tXtp&$yLZGa;#4H+y=vZ+t1a81OUsr*)81SS=6$J)ut_w z+^urREqRb_z7lTS{?|`H3;!s}+tN*+0tU!*Eyhsn(ps&TBx%T~u5*|z z#ysXma_;A%E<|kYUwqBzO3uIp>sSIVc+6?=z}w!2?sz7I@O}z@1k3jSQg4A+n`*SK zUSTho9!%>ZFXYr3p!`vWHAwPaM%^xl_VSCBqVJ#h;EQ69&j!o@i-pfV2>evn{TK@S z97@*MY8-m*eYxAxNJR!-ulgdb25;~g(qIqu6b906DG^es;ABEYi3vMU+2E0VD1}f2 z4yh>ZM08|;P>oGq@Qq|3bhrm;Y$hQ^2B&y%2(Jjla0QEw0Di33X zPX6$dvM}4V*5%GHn4Hf)Sg|Ip29?DHZ;6=~a|Icsu<`^k8k2A%dGTo7hZOhJMSznV z5AkS7u@4tWi_XRvvkE5xQjDliJ4gYf62^|$LLX1W6wL$;mPBj+H1U2s@uv`$w)bkEV+(KSmuNXG_^K(lP23E5#m{$~1%U zVccs++>jir?G5Fz__nAiXR&6$aqwK=6{|(1+OoNYMbspLAqUABfA9rsMA5>DC5HwL zx6%ShXh?=WLj-h^ z#85fMi}l7K8xic5v}Bxg9`!~OA=9S(jB6Z`O+?bIpb$;}PY*paMCHJyPTzDc&mfi3 zl}YIar}&~W2lIUZjf6>CFHdqjy(b`1a$iU+Fz+?4UHV^=BW&Cx_qSScxHO6JIj6f`DqtZa| zrl9e-CaKQEJ?_V~6&5c(yx3(tcQkW^eXtH13E{j_}NL z4TVYxy%4l~nUiVuY9}}EFw71w_iE42a6dPoG=yjWpoPnbH|vTphBj7z>~=v_1nfl4 zXY=-d(Y3&^cQ{pqeLuExNa9SV^nQSMb~CrZJh#YfOlBi@X9sw9!|RGb?_4wX^O90s z&URQpZ*=T(R#JGDsjX6g_ObrOw0fVH=6B3~*JOjx67;riDdf~jrdn#Pk3!h zgo&fdgNv{7cEpXd<5D2D^~!dQuZWodc{u@CY}e(FCpL(CuUN>2c?UMCT&tbbgXF?ML5wr!$wjQuh<4t4m#vMjugdcpT*^flkSdI)r=5n_#j1y*jDm zI;v|r)`|oo?|9U_E;q}x=}@X{ZuI(AIZL_zz zNh>?ApOX|^GJrNCjDYlNR1ejaJCucLVF$~(UsM&1`()zliVBW-Y@WR5J7^U9pHMl7 z!1}3(j$#%3ue;l&lT}OjI?dXzuX{VNqn3OQ3eKX|N-KM?Yy!IXM&Lx0q7gj3e|$EF z4s`Jj5VX3bQM<$$m0qNLH`^c2#=MOGPQ0kgy5!J$M2AJdHx;%oyi%w-R?Ey@#0$=U zyL(bjkl$9d7fYKT`=6AXsGIr(v%K*|yw#5u(Vse}2P9&2z0B}D4!bHq@kWH1Y>8P2@=^ePG7tWd8k}=ve4R^0YF!l2 z=xkqUe4++&xN;KqRmifM7v`2kij>P|)5M09y`90buK308$DKI)oS?;lhGs9u6$1 zaAU;)5-C=6NQz*`f~_zXv;`nR%a|NBn$%e^34nG7VJ0a^N}>djD{Xot2vY*VizRm= zylGG(%brPQ0uUKs6M!TarBDT6)oa$R5*5;HRj_J+t7cD*bz4^9)`Cc*=8f8QlT@V* zA1UrT9c&6*o|xuX4svRD*^#(U$Ec<$3XP^q#2583{^+D03j|XsW z&>rsuzJV`>9XopD?!A92OxgH5sqn7_SC7noi+lAE)5@-hS+idH_Jb2Ew*Csb&NKj` zJ8z>_7;L2{QW&&_K%Hp1ZM1_bj0?K}GBgasn&M(fvsQS6s->L(XzC&fgt~~O6fH`z zMY&*HaYmM2<7+1!IUCHj06-#z6yC&h2{GFos!lZ?56tMtyo_8*ip*j}&7SRGoa?8H zHiXZwsL-MbIl-EW(Zsvt@>0z;*=*CzH{py^&N=C<)6P5b%u~-j`RvorKLHI?&_T(p zNTMX_lR%-L;G<3dCr3+jC_O2D34k|(K+^BA)70##I`_)7khDV+UDU!!E4`F4GSJf0 zv{23SN~OTIi|?SGCX7l_Pg8Y_Cr)2`P_Q!z@>I=s$RK44Tnl{@(u$sqY}eCzC1_gD zRMqQRf_STRC{_pD45kDy!>lWz3}W^X)g|MAcGXfzz#GUN5E$QBo95fKiDoR(0Epy%h_` zIzb}iIdcCESi3B1^Gwn5V%)IaS9_E%GFwE`j8u?mVsy@E4FXzYdV%#4X_ z!%PbAa;-@J*qKWrnPXKm-73k7l(uVX08)OTuyiT-1XW$NSc%YojS{jw;Li$-`}X7OZA#ThQ*$XNI+) z65*2oh?5fNYEz0-XWey&U|;>}*#j)C<(+o#5mwT7;gb`TTi3Ku)1eE=OMj&~lwKz08T`!*L|sux01J2!koe4gk;#zCs?;MBDM~z>amWKl z62Z9tpsO?&A>sH86|dQ7E&r zFnAAWD{F(rf8(Fg=SuHClX0O5?VPGYhn}s zIAXbGHXXA~a4ykRk&%c!Bp?NttnHIpN#{BZW+8N{b0YDCPaY3~Px}>8IkAD956jfV zKIRjbeB5Lvd)bwh)saJ@)Q39qCLMIO1?N`s@EnW}J!zIrKqa9WU`J`trm z^P5Z=Lev20GzmP_OUR^mTt-xssw%L1B`i|!7=W3S(n*>BAu3k2 zszpQ2^&@blDSjkJy}5oirB@u7P^0?R(MlDHMwL_VUNu<3+DfeiktmlY*PlXSajg~U zNC$s<)5toDhaIu&q3mkP;_?eVsC8?byr&b)UQM&krK?R(hc@oq#~{`vZE4W?zz()F zD)$1yc&VCPx5-ka!mU(rvpe2bwl}^#by_c96Wx)xR!;hDEqrLdkvO43(~+`7>trqYqb16ZLMv&@pl&8O@utEl`uu)U55JdRgh`1X?hhF7p-P z++8^*fX;v1$#<(c+x)fD2dh2)FHB@QLe7a|DI6+?1bHJw!1^1u$o7_FS&0X|(cC zHE>M8q8okVSy3r9jh6PZRnq7=W60F%{*|!rO}&la(~{-BtEV^rgBA%`y2>Uw5An7# zXpR(`;WLKbhB9>SbNjnC7;oo7*PQQ)clj~;R&$p2ooCH(+?*#5D5)93p`{HvZJK#F z`AqE}aR+Ya2Bqz)M;t4G0zt=^8+y?ba&%&Qx#IXV2tJwmqaaBZmCvOlcEtSjf?E7a zVq|%wWin}>&p3O!!EKf+o|mFi1?DQBiw}<(B`MFH?sd2O-SM7xy=$~zKXl0Nrt%91 zQnqxuEWAlNskH%Sr5%-G{DUP@9l`tapXW8nxXv<~O8tF#O2PBvsi&XGyRq+7EL_nj zJ;0 z`v9xwLQf>%Y(w~hr=qU6sEq1dB>@4C&yJ7s;A8p7CbXc3_Ykl7DuM+GMohe_`U>Lu z7BBm95cxz+^cDyQqk{i_Mfwns>K>4+C}*Qu&Ib>I1_{dlmN2gfE9GyxFbLhSZZw5$>JV>6 z?*%)Er#Mf#UMik021nwyG`wG7&b6rW5(* zihPf)xJT5ur&j)lZ+^mfJGF7MWmoF&O^k~W9eoHa#{%+Wh9y` zVjO`(8?hrCHw{q~!i^k4#I}Gp`b`E8(IKC;2fiJPL3cD-V+u%aS_l*U*HHUX$e_~spVv`A|%OuV8zezY>LW5HN!3(GnUsZm)Q6rVPJ!Y~_fJp_ z0#FAPfU2}IX05sI)Y883Vg8hI9(7UAkcH&yQOUF;Xi*A==q*c^r)FvQtCkz!CW0fGnl_R78NvWw^pTk5} z6<3ecMvKH+ccKl(RbrsA~T22b}LNbXsGCGQgP;4!4z0@wla7&QsqNkC$)pxRbrv2$9%C+ zEp~;ds8}g>%g)3^W3+3%_G`g5Y{ho&8022nhe2|s9Uco#Mr3WFr4`IpJH$$Q+?GyS zp>7M+JlF(n{iH9wq%UU+e)#rL<`%6A_ww)-yb_l?pybpR7rbv03VNAiex!HexZ`oF_e9>ra((M~ z_e66&w|dWGY{|EL&G&rKH+|K2ec88t>1S=IWnHE*Ia2haY=IQGPzrT%eKKWK_t$*^ zIDiFsfC+eP>9vvEZ!eD?v0z$TiefWogIEaOKh>5s} zjW~c;n544zh?&?$m$->DDtDh4il1zX)7OfrIE$TFi@CUqz4(j4_`$-MeRgw<%~)*9 z7*EnT8rS&$jHR)SF&K{HCy4`qj@|f<@i>q5c#rwGkNxS{S&ZdpmJh;~(Fc~-1ef)MmqWN6B!I%`WR*>Vm@9&gZDC4=d82&!4fCRz z=|`8<#F&Fvn(IWC--nuOuOOg#eyll8h~kEM(;{0~BGu%Zqe4+mcWkv8lhYWTnYoxz zneV1~$>8}-+JQkFt`(w*6h=9pD-NL1%9(ojCGb~GT7jUGs}&B~Bm~;GTA`Wz8KNaR zZSooaLNJ=4#rbD48l&qZqU+;P6dH9IdY?xcK9ZxKt#>Ipx}^73jM`yY4rV zIiv?At)+vkHCnCb8n3VDq6NEA&KjlLK&9#WQL-9Z>N>D(8q^kBP6Rts8{4n>I`FNEbrhHaarzTF12fnu^>qN=gFyk7&b{Uo9Jd#pG5 zm^Z_Le1<#IqPJs^e{9c#DFa@=@PBiY9yip|;Ot%vJX(=E_ihWvd- z{3edp!_{ON*(B=(Bw<5U$_+DfxW~jni^|FJnxl!j6#Pz(d|lrp!y`6xQU=TM2!zxW z|HhRQ$W=UexGVsxyfVK0;C3y?(_+Ufg3N=3g^cFM%M(!ed^lOiTM(Sd?@7(MG{o-{ z!b=0ty>l~u%=FNF)8q!k&HTZ&{7vvY03kid+q}Z5md!Wg(Nnopn=8@F)uh$OL)A5%+22maH)Ge4 zeSSy|e!?73o|SQ8UASg_yY>=wo*iSO{n&fmOO*ZG6;(WNUC$wp*O%^ns{MVgJy1F# zV(MKd?!8pU4N6)(!guY^LA}}WG)EM@Z~HwC9o!&rS!aDlQ8+c3d1IrMCN`rE~V5d<6l=HNJAtho_WrLhxu7Okb^oP1T9jc6#ypYo5=VNIN-Sa7WCu0={Q(E;~$FvZGP#6{YmU$MWk2hWj>-(q~#;N$~iUT(HU#U zE0W@b>$mr#ZT^7(=0E^uhE7}Y(w;)rGaezN=wUZg-hL_^9)GFp!)apf7vd=L9^};? zPhM|N!2X{S{$`m6=9m8L@kZ|bK2A!$#(4wfUB2g2w()@nN5K8K39PEB7new1GfN3K&n*|000P* zIhb%^!-5bMG7Ml(U;+SSHg)VsFr-L=n*eMYi87_il`IFg0k*>^0(&SEq2rW(&_^_-* zf@C9J1iSI0$CEot(&dSl=gXLR`{KQs({JCVPe&3S2o^2F!XgjX|MV%PmD!OS?+%14 zdF{ZoZqKR&YYPZNtAb~O#ccN1z^J3ImKIr6%0r@14}$$=SLCmDB1uV|J@8)u-&TR6 z+^ss~Lf!%wl1g6GDs-7qmkx9u5~u3`s$(19d@y)PDXPEYCXLeW^wJx3>JGkBH1hz? zRaYPQ3wy}jDF69pyjpnI0YC~t!toc*w@DLe1)@UGp|2P8RVuCQ`!#JG^&^Af`ZEQ>31oS+7gxw4!Y8%uht~wo37?ZV2!^xx+0tc$?4>&`?a&9 zN|m~_p_M@5YGGPoZP#A_vI-lLJpcd!XRullWG%KQ)(NXh3MSSLLpm8$ge;s>JU|6ME=Zv7!cWZ(q;}r*BQSYN_o}$vMd^rKaZ9 za9#l;{ANlUhcw~G5YA-qjR4n+uek9JRBmAC7ABle|H?UqCSs$>%MiUa*R(L09K}Z` zrh`V@%EUo)=bXi*WsKLx346>^$UK#ds7xjQgL29%wY&4oSu^-Gu3twR=(Yjy8epGR z2JrB|+|4&os-fmp>~8#)jiTIp;=2h#!=Z;PfG!0QN09-=}!Feu^PqE_Nnh4_?A}% z1#9woN+Fu%iEUE-MhRe_gjW-`{(6E&xgYoZ|MSo8lLo=hdh@HES6mk^rDQ~P(zBiv zVAqQMZ9#l8S%~ihQZ4{#sAfV*;NE(d7lVZBZvc8o?f$o!B=DtH0-@db1cx3L`mA=c zGoei`qO|}p$|d_FLt<3NI@fUtcF?n&LOQhxDG-o;_OlB9hB%YM{f&9mG93wnM>z7y zM2d|2Tu1~2Jn-ahRh^@vZ#K6j7*a7Mle^&>Tf#-+vBY~QK_6Rw))IJ00Crm}<5#R0 zM$GjQadNDpXJQ8+7q-NX6zSAVK=`;4dajLsJc|r%IJ`HagpSQK-W@v?NT2aVbYCQ0 z9X;7d!w63xmnDVdGJ)-c(J*3*{?y z_*bpj0xW~ukD>%3iGL0Rd_Q6=@fJJ2HBy$Y;DOvVk3uZLkW#H1X+>zEVp(WGQe6{S ztws(>kukC-Fk6xU5avfwuBsB8i%H37Cp((v9cz~V+H6vf0w|c+qZJ9^s&RpPJ(`_Q zDWbWpQZ)G7L`{&n7aU)7E0x_}JXVL2Z4z>2(lYBv zpKZZSsejuEdk zfA!D9`Yc@>?yX2fqg%nm|24e_Mpk?!(lv?T7Q-#%uX`;7U+WUMC79KnCTF+G63gyv z!KF!$8%q$^Vg^*Y3uCv)GYRu@$9!B0H(4M`w&G6m zY~JnhInv+k?45a6=G2iwClh{%RQB>zpod{{gbg6xlLSFyGAaGhiMc8yR5rYJ1G+ofwsdm*CPDXrO>uUu(UL==v-8EpZ*T()eYmzf9 zE!GiPR-aa`XRU%l+?9IS;KnvfxUFpycYDi--buKPRb84@``i>&HwFz{Zz4x`A+Cux z&F03r_AL<ZbkEDuVHO%tH#&#W6Gd^)?LksPO0 zmg-k{P40&|G+r;Ej(dD*M_lGeZ0#}E>L6r-0@rKcAMC|soH zYizd~lSgtjVGqRNHV=q`c^48bLpcXnWqA~MEyRF@=7K0_UWuoD?ss-z0fHuo5((IY zq@n?HS zVR`qre4K-bIirXL*b>c$QC`}A;62Dc5aK;kscZ5Lpg#t2$PAE;&SAv;W z7ltTqqbL@t7>UsFd!IOo$|pShH&mYUC0~m^s2z(a=fK@j$?-U*FpoU7ph8t8< zaL5~Ss8e-#htSwlwm5VPC_fqTitWdWWT+^zhEVSLUwGf1&A)tHb2f{+ZCXA8L#7U(l2D1t0_gXY#k>tv2b zhZ0?+jGyRys5g)!c4_NId}=a#r2$`fSa*tT?Jrjf?#nYaKZ)vZD0>R(M+bJ zVL-42@N*E}_!*k0VKDJjL)kcc!x|Q{Dd^FZfKr8q1CD~BV8~)B2H}pxrIS4QS!bn* z4iS@KI6iLnS-8eZV+nPO0UcGrDM`74Ore%Om^q3RcZ@e2H;F7W1(!9|C#@g>BSZ#s z30(}~l56P{X~r5>1}$GREhQld$<;M~LJ(51BV#jKvnF6mmoAGLcPSYXS7~?l|CN}K zg(8~yLS@M_ICOMfX&VKH5VC_4uGy2G5kQ8id$YNduQ?GD1{k&3A*SdhY2}$97MZ$p zcUtL#Z$)$`LP3uS0LQ6kHJKb(2wb%Jm2&x#)2U@B@|09`mM6%R)n+_A2{+(#E!&wA zM;Vmn>0NK>l{>ML0JRu{>7F>rmUvMTHfV1(sUp@1mJZjSDuGl|hn;}qp-g9^GM;VGF;IhBnv8VgEX-KCpeiJ%$U zn!8z>2}WBs;)9FjP&$Ep=`xR2u@}~YQ4Eq_41t%G`4s;_6#7ymND6vO|LPP;`ZJ~_ z8B!`4cbIc%2_DF{A<7A23BeF>Q=H^=oPg$o7>I4t!lhKIrdAp#fQe%OmN=#96FPBm zp?9Y3Fr|1}rJN>-E^2Kp%A3(~kAB)6_1Tvecc*!pr;C*?a|(J*h!M~crjSXOK((AW znPCe_naq}zQ>UrKV`^q4nn#DDhv`slb*UH;oj(c_(*tAGHiIjXR%^Pb11F;r3aB$` ztAxru@X4PKm#9^`s5KV=j@mH4l_rvDWn(ILilm0ok*Sj@gqukb(aM-J(`70}tk0^d zg`qwwvaM_tu2`B!n)nOkDU@+(NR9-dylHrZSzFyHB~ZB`ZrT{||H>_4>0(vqk-xbK zq+k^6$VNuxk*R1B8zD{`G>p(;m!`o|0?4p(RItPW1h?rs6bnAvnVnh#Y3H{cR<#m8 zhp_MnTYv$Y&ewULr&bReDVu;UhdCVSc1Laob+7`mK2xLugF=;Rb$@Y7{~E9f;aknG7o3+6M@u~Bk`j)(ltbkjU09hD;k3+!v@OxGAIEN^p?gt58(joR zH`@{~N@RUw6(oCfQu}5jtFQ$569CH)2XwG)JGUaMx2$rwzW`8Lm#_v7bIfw zx1A8CvZwY&5*oLC%Vd5rv4&}}Hi0(u2`$7Cu?F?Cb}N4!|A~=h%1S#6WHdXlCtJGP zL8hrQwCVX5`q~l&+h-%nvb17U8;hcBo3MVnNUsaC33`8$#kajX5u8gA%mca5D!0CC zB&OTC0r#>Rs~y`zv6q`C!26P@8M(&mSfo?DZrdshhcig=CowftP1~7k;!p-5c{+tp z@hb%#+9XS{1wil+M5Ytec)$6J6WM6L_}dUT;UYsiq;OWCJH)t`V?snqSVpTzriiu* z>^U$ZUIsiGG0|9DwL=1e9t8Y1Tj?*Balsh8CgHocdF#Dv+q}mMy^Y(BcxS?5@xe92 zYQvZWr0{h|@w5?~DXyAnhc&oeE4qfOzC6se#6z_P|H(FI2zBO58tD5sytlqFkrg>H zJy{_I@=L!XEW;)o6DW*BV%(c5EWVYqSE!pF|K0JdrE7NzM;MVLddCkeuWH6io6ph`)r+yxt>GD*?M(Zgv5lKS)~COZbrM4 z@=?U2DldUXH26k@*b?ZnO4pLA4l=na;S+nqtr{}QJ*z+JwKoxD%OerJUNWkLST3N6 z%9o?cfn1X+vmj`jw8cylB~g;Z$`Y>i%T$@Od6X{5EEAzT%p<|f|7gG(_D0cL(Amr*rkpzYq;m16%*+NYu{_KJ zEfXf)%Fg`Bs=G-JNM0_DK{++eD47zw?0h4=av2T7H=V%=t)J71oXB!H8%@yI#?d@W z5eOa7+6vQ~n$yh#(ldEf#FJ1)O_ivK)oB~L(J_22VnsMXKRJ~V-a{Nq0mPJy67HJ> zk%1<*b)#+l5<7X+n<9d5P0%i@*FhPS-BqUzy&V_5pUyTs?hMUx1lZ=&LVL~FNP*8L zT^Kd28f_q;Dv?%v&DebnWK3<)o1Mx>|IOJ+EmI|Fr?`gMrwtSuauq%?+1duH&?L@7 zS{R4D+DhviCF0Petk|)gU*61cRX372`PFC=)=zq0HDlJ!mewkUZK#deNU_z?{nJhT z(xiDI?a|vykz9+&Du& z0c79u{oBtxlPWC|uN)FvjnRbV&iG6d0A5Ezy)P||7<1BHdq>hT`D5aLlw!kG zvrOCK>nO2ejt6EQyHQX#@CO5v`ST(BH<6&@h8@wIcp8*FRgE>2!30((@wWGb~o z)3;buo~(oj#2Yw(PhQDBet{@a;&Hd)ehz~mUM+T4)^~*CJhr;d{`-qsQ!1t&oq7SiV(E}SSs z>vI0)n`G*wE{fZ8<6Rb}crjkO3+ax;;(cb3AQtJkE_K^P21xP0nMIAAC_kft6oI%w zCy~YF96PtIA&J9kesdHt|3n}(?9u)t!hs&;;DL6W_(FpYd&w%nDocN~tUGGFv}=83 z9()xb?CxrJh*iz!*N*JN9)S*w5!b$i%&_ExzUJDD@x!j|dEVjsDeM|Q z5vhoeu@>?I_L>=>l4s|m>b7fubCFm8ORql7I_Gf4A z!1wlDy-CmR;p@C?cpnxMFX<^}%3dD!E)vIpQ}dV(_zK<^^9dr2mTC5YPwdF}Rog3S z75Q3rca)j9-BK-=|KEM7E=V?mM#3@qZ!&%gZHvvBL%odRpcyEXN)e#XEuIe|=sBca zLKeF950D=j*#QLIg^}FK(ilPeN_`$uKqkDF61?v_!Xf;n87Pn+F3cau-PK_11N_#; z5c`Y!7${?VfMFBvFL#w8E08nDK^G|Gy61bTI0ci%hq6Z3^J&)c`NI(6k2t$iatRPgX>@R_{T%Q0v|efHvmA zx=BR(ZTr?FW4MOt0#Lk@FG2tSz)IYjImutJQ4flRi;yZ*glIde<*GO8QMWXG0w~K8 zGD52#0Z0;k`=AscdIeJK-CE?s%*m5KCFwEYZomNM_O<)^w9JAuv(h!bS)yd>Ndy8H z9w77Cv}0*|HyvE$d4z3rip>2yWPF^WIXYKZdoxKbvR>`F^bI*Bwg z>7^9I|4I7;weHF5$i4h{dkm3$Qq&Cu0D_&%I%l!z(b6(#h%=; zN%k1D48b0S0-#8aro3@F-In4hMGmWEjjfylM2g0eL=ug{J3*5Or8L0;@Hhb4C~QU& z3)0NT02fTk!GpL$a6$koWG~7lYXWP_EA7m(O|!ZrGqEu7TuI6k&EyG9mWE<8H%}|Y zF(W0(th3KRMIsGIK3DoP(_UF3^h8J{k`%#6&HOchWs|)sTJ}`abVWEDwClU{u;UdZ zPaAylHEA#GvsO}_gpo5bZ(OZ0WaB-ET3ahakXVFXI*=uLMd~--O{CVMCK0(!-DR}I+X24nmgp`m}uh92{f_G9U$$NfUBIIx09AMk8|6cg{ ztf9BFYl;%^4`htnp@?7JYhL>IBN2kV_wx;hn)c|k2bk;V5sMLKpf5*Ud0WY@9_rbN zq<&y&9%3FcI;(9>WitZ{$B-qzoJnMFE72dLEF-9iun2SPkx?r=V!R8gZ)rSXoOwDz z5V0+2I>Z54qgEq@&}Hz2F?1nDVAwhKe2yhLRGI(a#45C`?QWvm-HgPSH(Y&ha3XYD z>?r3D4JyolEXox|7R0y#>PCs)si54t=)TGwtbj2(pa9z^5+0UGPFP#d1_k7mAw~y* zMl_mkh*rnS;q7SgW8JOdh%J$*&V2u)5e_#)F};A0Cy5;4n%;9lB<^m7{{YaBywb>? zFJ>@+ntb2AdR9j55mJlDsv^wF;zlUKk%nMf5FJY=#jxPQjN)shP z4B0?ON+dHj3?^n?Sj>YA(=sLO7Fc9PGl}reV!LA?1vQ8`>In^E(_5t|tWo;s7D5?c%<30v3%a+JuE?X|+4?Odly^tn!czH>I)8=3?*L6HEN zP6}I~2);6w&&&WJ0qkUFkQ92ucm0!{1#xGJ76b&^sSKnmdEPm9xX#Q>)G>QPNW!Ma zlvYZBp+AzGL@BxHbSCTU$wC;HRP>C{g{amx)aLsSW1R8v9~{|Qn#mOh1)aG*OS z>V~@KoR}&#rzxe6Jn3mqvpBV(7$l!t>X{j6A}pm+z*Fng8l;$>RdG<-0$QX)&q`8k zLlPJnS95|;qtYy{$Vuy0>RDBFUMN6iT`W%{$)3Ed&Mh+y&}l$e!~{?lH(r&if8vTz zh)ou>0<&Of;luGGEQiJ*A7QqGDG~1<~qMMdI6yR+moS zJxEo{JKNS8m8?~f&b8R1(SRPNq#m;=P`8>->ULDPUtwx!|7AK_^GXE1;mr(a3d|C> z##FQ5P3l!=Gu*Wz__*;BYkC%3;RfHUzZJdNNKf=(`GyCk@zpS@7<*9TZpL)QHBsCK znoLR}iVT$U)ve_DQ+95VDGscibBL@jBWn!Fn@Vl>7FrwBa>dE?1XfGu6IC_AwY74k z8EunF8QHS+hDoI|l4AQ(#+G+c4DORo9>S#cZZFEJm4c8NJK-XNxLKk#ZinBsVFfpt zyk*{un{zCmnD7J$b+&Mxxjf!44`nGImS^4ui`M^gjit$(&!y*TW%BYh(`B{fTES|W z%;6Kq`WYCHZ`oeT0NHy?mNI$kY#|A2IIFsDEuI75|L3K$cg|C`vq=oy5Jcy0(J=nA zr@I_qFi#q(m4=hEN9`g`YuT)?jcuqM%wCmgv(Pz~$U_tbpK|vE-ET{jdC1M~LOIqh zvbJbu*ec$ujTonS_I2(6{9E-pn%f0cv%fVRQFee zP+m8&7gm4n__ZynVScB`=Cu2F7&$)bU5_~WwlMQUAxlOX=at`6%19r21hs3mdfk(= zuD0iJ=sIZ*On<%-uzP3Y$_Wz9iRvN z$C;n$mNWhDPxp>JLVBXzci!fjY9;W!b#dbJ$-Y_t_`IAieIb_}@aJ#;(K*lcl`jXH zwMV?|Ivduo#~?=Dkfjj3(9i~(5O0Z%DEWyA=mLb zqg%VLi)nMD!UXe#KDzVJJ86z4JNS#8 z(BmLI>_86Gh*sQ?Rx~H{$+?7bKB1$;;qnsPTo9miZ zXov4h#)h+ncBmxWU`A)G3TmuI|7^@gY=lN>)JAQD#%3G{y5pd5Oh#^G3R_se?pwxi z1jiOi$8Nm2bo9m;u?y!)5br}rdx%GR>_?N31Z0wlXne)@)7Je9dg!O!djk)}&3?yiMFRES%}g z)D%tI%uV2|OmqoO;w(<%JWk~7#~HhpRZLFjj7d=%OG@j-=d4cayiV-QPVL-I?(9zQ zWX$Q5#nbeq?<~)$3{PYvP4YBP_H3cyG%3Lp%J^(g`mE1$noq^VPxc^#c>+DGvro}n zN_)7>#pDW(`cD8&Pz7C3kkL=`oH+)KP~>z_3H3(`{SKa(C>`)NJND)m@{}ydg7kyC}jZqn$Q5vmL8@*8+%~2iQQ6BA45PeS{4N@T;QX(x< zBRx_iO;ROYQYLLuCw)>VjZ!I{QYx)dE4@-I%~CDhQZDUMFa1(54O1~4Q!*`6Gd)u@ zO;a^pQ#Nf=H+@q$ZMe0JQ#!3vJH1mp%~L(yQ$FoeKmAj}v<1Br%2v2FKs{7MO;kl) zR7P!7M}1UCO;jNLMp7up$vmf_SjbA{7kX*~b-Yab%G5|5RZ=ZgQ$1BwO;uH0RaOPg zNv+1t5KovfJY18-Sna)$NWS^A32ed+Ic!y64OU?tR$?tyV?9=6^;2>|mLqDdl^Bl8 zcuycjrIv!b|At(MRv-oB&=lEW3UEqRa1B>+9anNKS93krVSQEmgv+CptT7bN=G;$n zYNdDGoP^;O+8mz5(;al}SAYFifDKrI9aw@bSeBp|G?SdoA%m1Kvz3^jQj;o%^`{5~ z0-#Bwozcl(ASi?FSdaZ!kPTUp9a)m?(!tx9GeSM|p;ZoAB%TVzxXhRxOPos8$?+*! zoXuIC-C3UPS)cvc=bW(}0yhzo!_bMRcvBCZ5Q6U6A;o%Ey#t?QmG;7?czBr@4rxQ$!6om;xCTf5a$b*;u#oS?A< zi?Vgt|5!Pat>F(@B%!-KT*OUW#a&#+ZCoAAThVKa&0##1={ct8RmZ~B+3*{*P$G^E z9LEh^(H&jVEnU++-Q$E@2#c`{l>!jk5X&_Q!xfft*{UQU7ndEB(h2||5I5BQUEmE~ z;T>M$EnfCutNB9S72BNTgE6O+Cqo1T|QPw$Oi`JG?-tzY{k)stO`{8f;3k^-XgUxV_z$dy`X@n8S7 zH+3qD&aAF=f)l%1sNQ|IlhDBXtzZkjU<}S+4Hi@JY1ozM;HgPJ5Y)&RYZ(!|nvA>M z|7@a+kXjIm++Y}vVHuub8m{3qMGHmI#&+-^C-Pkz{$U^vVj&)4B1TNr{Y-lxgS7NU zTe#FBeqtz&Vkw?tD&CAEMq&$r&???yF79G4{$emr&N&TZGA?5?K4UaaV>Mo5Hg01# zeq%U}V>zB*OK0j;ZBK3D=pW)EGARxsw6ZDOQc3{r4r{|HNF z^~qLjo=hi>CTkvzZ2o4>nC2}w<`Ze+Zzg9|q-JJT=f%UiVjgFC87Fog32n~ib85Y< zV5bC7IrcE;dPe7UoM*%kXMk?FqJdxH^k;iUjBj4%^DXFf3#oU8=!uRUf;LEjj*(`D z=f?nDScSM3Ce(d1sbQ{)f6mr*=4c)6=DyfyQn;3i2ALf`J7|6km$t}Fm5Gyv=#mD? zotEZ|&d8bem2<{s&bVorX6eh^X@`z!(Yxq~9F6}(>cybv%vtK9KI))`PpZ~xl@8~v z?&+uA>M6<`r?!n=J?kuPg-xg{I0_3Mwh2L*O!5w)-b4tlx79?QO^Pqubzxz-exhL*TikiWo)yO!#6hRMVJ zyU9*zckXJ&UhKy{=PZ`&$gFJor0W(M>c@cU#oKI+p64BA>J#~()Fx}Nux$tvYypX8 zkl_+%1s#Y>S_Pv%IaKZ#gDmBM+W-4B_Gs4R01fG0tij7Tx#@1V9lC?j?hunxe!V0A^Oe?m8c2)j&GI_ zjZGNBSF@14l#SB^u|3jpXcGF!Nw{^ynVa;}gO9!i0I$L3&Oz`oSw`S!p4c z=N5{ic%U~4)tF4$Qh2GqjJ8*Mw0HZ84|3y{F%uC=|E^!6u#EV|aeA=NpoPDoR5#0r z_nN{#Z+pOby6;QCM~I6jt-^2kubBKwH+nL7ddN>iF4BC?uN;j(`-<#L>I{pMA9W>3fFQGl%%%Va4k(wyvNdmtY^8E%LVGHu zG<9ijqfVPE6=HR&wWrsio22gLD3erOk5XC*wyM$A+`kZI8XaphaodM)rPSnkP-lXL zmUFgK_&GGqovb0+N}cc*5CF0REKW#L^hS%N59SWA`gBBw7=^ng4$-(l-!TC&?u<|+ zTj>F4+XfE3dCBL|QAZ>NH=%Rw-$&mz``cjf001OpjGa+D?*I(XE0nMBeP{hSyC1|5 zPvx<L42m>deeTJaAAkl4m|uDt`Pf>JMFv2ii}*#9QAFi_L53tHNBmVZACwQ=UA zmJ_WRKy4wuh~Ak?T2>RH1GZ@(oEhC&=t1_}Y{ z0wr02Icn+`XD%Jb>W#B{27rwc-e;YMwDO8pjUi#m;-@QKI_#JRftl8?y|%S0v(_c} zEP0|HMCwNf+JtHVDkUV7tdwqc{}8MNMmW~88wFczcEozR?y*32cCNHzIXiD!(c1f* ztQkETDU=XBn(lIPYNRKOjs9EfO0Owout@dJxXDy()+ZOL_E=PLN%cw07{nb@9Oh|z z8Enr|yosl3Z(E$V)U6is6`@Q=wj#kMwn%Z8nR$+9 z(8&goVp3EDvzb7e+rAWG)L<>eBb&(I!S0f9vxUS86+F;M z(jeF?wTN9a=^5w zFh57k$IVNNMg$c5z=lE~uCsrPDc~r#DYFrBgoO>0S_d^EM1@F{EH2}fEfNzWh44vS zbwtSCD&)~*|C#8dToNe^k0__NT#SWBBFoSm)KTuN)SYs=DVuV-zli)Ib`qk{!8`&t znw&2#ymPGYG(&MV= zC>K_wQZ=mz2`O4Td61yGiz3#tnoVRxhR@x^tkH=P=#V-pq`E{#dNXRuY+|Fo&gG8L z5l@hI<(tBa%2Inx>{y688ZpW7B|QZoZ$4TUlFZbJG-_&r9MYG>s1`X*142?o>X6vN z^dHD!5KJFJ*BQx6mWb`ES&Ukh+7_s=GPx~aC5uzcB9|gOHSK4&+SP>omL#40DqmCz z)}>W5|E>wkk9YTzwN4!*yCcCIg1D&6u%q-!I| z6l?$t5dkBKso+GHP&Lwq`mUC@tWA~Z(EAVsBS(e3g=$MR;t}x9kR%|ENKFGk->GT@ zuQPR#f^a+G=d@VC+LFkJ$wLZ|EQLVft&sy8G9DzJWnUW+PjnoMtf?5t$iHAplKBQ& ziUb!oW;G&Vk4h~fIqJ&n94<;-a#Wd!=8jZ;4|L`Gki8xkfS8q$R{T;Gn^+ji1D%MA ze=K9&)|pc#zHfZV5@m@{sy5kb^H#pbSK@4zxGeqhX^tz_q$C=`b|SNtld4%R`?a}( z|CLsaVRYjnK6pJlwpEWMF+d>43IJx_$e-UN;|RO-CU}W zof88eWZY;Gv9vHK9;=OU!5e-E1~D|hd80KtQW?^|`?_Low$TgmUo{&~E(Fe@zN2X+7=?GW*UnAR#w&5vyf`Nd2eVlKTawg<+$TnnxYzy|rIZKO zF9}FbP(&zNZ!h@WQb5~`O+4}_PN$0*J;+)bW|N4YlPf~Mxzeo$5_>49=yic8|F%|s z^u5@_BMj<_&5fyFrVDq*;nJW;&BXE2i9{vkdg{K{)0fm7JKsQjo4u{Za8$9~;&Lw{ z-Q((YYpz%6W6NmDkj}T1v8C_{kvhbCmh_N7YyQy z{;oV|E-yyWzvniRm-)Y$cC|^HobnY4_+5G==r)jr;0H-K#y@XB9P-|&25NgqZ1MA+ zPlV%m5oyKy&Ue4W@gZ8yyYn@UeEM-7K!Mux#bYCI$A909ssH2xn*ZV?2K#q6 z>Z0eQCR}^IWOm$UOPLzqKivLFUs#ect?t=h{2%`vUC3}!oODv*Io^x>|B7$W+|pUy z&9R)C1m5wiO_OjPdz}UDbe+u=nX0+RPgIpfRbZA3pWb0h^8rZuaYyX69`^Z{M1)HL zJ{3s}o~mRZ2Y$`U)tm(;UIC`c4gOu@VIc41;Lx?vwdBjgT*i@5nkb*SJ%rk!g>Gp?0il&& z0D<}tM0NDd>uKT0Gl zhBjK2R^TGGI3r(lSTB-G-|(Vkyp}cA2VGnS2#QyFNrsblQ)01!AxHQkN-QHm636{Wyaa`^>cW&~Vh2z>mCXx;>A0*z_LO@=iIWV8ch zw8Cq)0xq^1Ypx_eVi_rfT6&1&m6#;KsN-tIl9MnAY|3VALIy~5UUL|YL8x2FA&Z6- zU2QJaaJr^(CTD0d=3Fi&Vrpd8u%&Dj4@{aN$XO?HUgvDOhjd=cvW#G-^d^&Fm~Wz$ zBxzS$;$}~>WB}&pI_3*xLX~9BkY$bsW=781G=wd^|Ji3!qIr@>dZH&ttYt=aXLwF1 zcZw%B=2e27=W)s=NQ}pH^38jGmP*Pea9Tzi+7^DoVbM+7}WK)!b;ooR#~bC0RHr89*s{0BV~~%S$u`DRe1Gh$(T{l0|glr7p$o zlu8U~YPkfCvotEQfS}5Os-z{~hWf;mjjA__{}OR@ns^|j%p~bv%;|ke;iT*hDE4ZW z(&M8>Dz;#0or2)7Dr>pq*sO??#IY5of=T>fOpt*cu4a*@#^QoJjB*TW&S03a&T5%z z!~P&LI_-Sm=L-8qpn#Xmp%^^1fBkBZw#!5NuZoCYY1|aKX$1ws?5a(->OL|OtGs!s_V$&Vk=DSl#&I? zE(Mz^VuX0CN*)=^KCG|WX+)?*>s4WqK;e;ch&=#cP<+G{UQ*F&CXSRwO4J0lz+KWN zz|vMB7Afsapq3YXreAatDn*FIbkhGI|6^!?ruRDXv)fPmmPD&AV z61Ai#2#N=gQefP!E!H9{#D+`E@@mZzD>p$AS8|~<<*iK=#M~;;ZS6#Ck_QX5>V=G; zf@bSkcKV??;ntDg z?yb!(E8r@t;1bSJ1fJEdZQ}AowA8J}JqFQ0E?1GQp&ls{9?x-HZsfYCXk07wcCPXw zBIrtsEjdh)=1t0Ggc5yjvSRGi`5ui`EJl=z!cqjf{>ZI{+XN*kuTa-&Rn}nK)k9cV z{pK(KQbfzjNr6gGpv}oaEGbnI|A&M4FQK~EXkCg<^{aq5CRsqH*IFq6V}x!=B~+>3 zb?9%^cxwYw(uh!mIv%hoIVQVZN&#V`M0CoM*2Q=rV@*1yq8v=2QJ@q|u>7p8o@s}v zrY)o7t=OIKKM0x9If!BMFBthm5BDQ3_67MI?UIg=5)a9qGNQBk1%qsGtH_CNVeszh znGM_9R)leM0ud0p2M%k;3+}M14d>w=BT5C%AJ**)L&*LHaZBdZ3EP>B{DY^`a9J#H z8(>oHnc|Zv8cB95AJ5%CWvM^FK3|L`T#kq#U1CWElqp7DBuu@N~k1nZO!8)s&JoAiD=<{Ll^U|D)g$0)di$+z#l|krM6JM={s4#c@NI=uE zW$bfApG2G9Tn>4bpu`A=ULLBrJ|3o5pu#0jD zfgn;~U&mid2*fzAi;(icK}7f+Ht%%aNB)*bBpkt!hMBo`@V%^rgm%4Pah#wwXdy-y zZcIHt#m-I5DwBn5yT@hMV+gxcgNEjBnD*B#O=uUKaMN4l0Bv;_ruN$Q97awSTKDXt zZz|jA3H&2B`Xy@ZZWMy%4uoU>VRsi?ubL)7}o%Vf$Rxk#6iXS(Iq)yc_bkEYv+e8y%0N|3<(G_yG zyh4Z6yaXuePny^2ntNs89(Dqzt%N1O1lDzIDEO-s%5962gwyz8?(ryhHPg|N zUkRdDd5&8-oNL6O6PdgM@SV3qo-^OUG`P1N$N5w@djDQ&p{{0j`ub`wvwS3`!h{NE z43~SkmxFm_BmXW%Q(ZWfAfOmofMc1W-#URaxk!i;ML@cwP-{z>x22cuRfC;sae7C2 zy6a&&Lo<7KyKAZUN|&Qvq1zjU&vTMc%YIG@<^wjKbatT#{LJ4ySuXtIJMiiE=K@=OMs#V7acio; z5W^e~OJt_g*s?j3g-);=U%A#wh?erxYV#*Nt8uhL1KVljinV0M*Uu*?Q@<`*DSop& zteriw*!2uOSXy(ww{bl?;%4sWKH!JE>bunX&rbO}$obD>bZ9?{mjBoT#HIiNYyn6x z5dUF9g!Z;bX{E3g04WLENgP=4phAsO0JPJ%u;Igx0TKWqGZN(%iwPwFc*xNf!UOP6X-{Vby^umk#8aL?J_m zD3vl*xU%KXHUPRRBueTc){iQMW<|?3AxD7(<)RcT5@AHE11nm^$dseUk$+K^Y-{%B z-~c)$o4s1OCE$THe}Wu4QgG9$0kq}?u=gWlmNZ$n9(*%_(ZwNAhF;y;wPmWOb@%>g z8=*?Dfep&G$+|X9jlh#4SJ-l?y_qos@B~2J9!Dw01Kg~cQ0MUD5|%4RSP?+jrvH@* ze_uEmfOva1$@^wXR55YML3PiJKApJOj`A)&uincE0HI`)io37~R4BZJ=o=^^Ah6@8 zE`%Ngk0$EcnJL5L;7V=7>aHrvD-2} z-hvd;!W0uUN;n|}s*Zr0RJFlb1}sE zVqBHPUr*ds#mN%bGDoxgOaM{ej2gAQ^o(1uxB-PV5ZVCHgVVul)70}(Pzyxp#_A?q zNYw-33o%bWvFp&QS1Ag0#s9)Rj$UO0C{^8o_~lT(bA=rAsB(QBjVR4lvlq$$5>}6- zKKDe*Prw-5H-Y?g!iu92*^I5AEgEceCPP;&P>Lc?_P0pcWyyBl(24?)yu=JkX`@~D}n>=WMVI9h5Yj*QX?(R6F3nW=WCb6MhWwSKfhVz2Zy z-$Q+i+D4oA^x5Yl5q$JRpqs8S!?v&dIaEfOjM>*n?}oALf(j+m=l_cnBbPO!QucT= zkT-pg z)iO<}enAuf;Ey$m*&q4(H@>d4gnJV#p9M9SJBQH(f;7p`_o#9#n%s{#XS$4THa5Tl zB1CXNIMxg+6TjV+CquRX!U@Soz8YT3fg$V&LV_p>`)ve>H2;x8smucv#*r$C4@_BK zS~$h(*-#9shs3lra3haaA0Nt0y{oo{sL?KGE&~ryu-VA)^v!DNl0zxCoMT<$`B2AhF zKvB_;g7?cGDMuN@8Tt^4dDEpq#J5b+C^3Pb%H%NL=dWuWu#NUJ&KHju&E09Rg6CV{ z4aq5&27(ZbmI+ydbkhoC?h=0)!r(`o*+W5@6C%@8rvE-Y=uP=K%7y0H*9kT9#Rx`o zkw@cDBp+Ba1d4MtjqIdCjcF*IWGa!l8s$5s_)wq-l$U04=o`Iar;t)qGG9T-MhP|& zJxOc%R9zFDovDXr=;pe5=*pSDp7OFsjBiSDg=%b ziO5M1ZZba(Tw;815>-@URc|!~5T=utDX_7;QJ~lCz?>nY*dBq zL}W)3V%DpQE-YyKNkoMnaf!WE22vrlL?dU{>QkAW z5T|?5scC#VlR6FrIzh!@Fa1eA#BM~Yc)e{?DF3QLn)Wq;fo1DK35yWJ>Q-5by-H)T z*;a&twwIJ8ie*74ORplZm8A8o@;=GZ^Pm=w+9joZT>I0ahmbr z;B)z!(W4aiH%#g$4aJL2WuEscjYLXjNH|E`G4MZ=n&ZfZzLaPGLiwsVGkRGX7*69h>y$~BU_5Yz9UVB zM|7zggD1=jiLfBY%$g_uf|%+K?SK8R35gv>UCDQ0E zUzm3?gt37mjFXD3HNrf0Fp6u9lPy@8ORr||l8FZFyii%myG}KQV-4$LvnI*UUND(P zdD>c=xO#8faTb+rmunxA#W3tPnkmg~NK2c`=Js(n3;ntV{rb)$T=7g9o$PZH?vY&b zS(m5nR#hL>#f;-h!Rjp|07u&0zTq^MC#f01t&rDJ2-$2S#%#-|u0k-XOU4zo@m!Iq z))~okkhgp0<8-BW2!Ei$n%t<7KmWSq0S0rteN^xy$u(_=k}{V-) z&z-9|!V%R7>EPorc!MyE3&*otP&;Y>iuy`Y_ubKBK5DIhgp5!Yx3d#+X@$GEs*ij) zw5l?3MiS}Y$xXV?H7xW=2c2a_w|BE%?q$m`T_;XAw#uiTkU}~c)F;Gxh`z3FqY;Pk zX)d;#9ls>C=9fLCK}w3DP4s>@`@y{)%)*Dxmu!O`(3!2ZuF1}MC5CjjpmC{v{!w7B zw4xQ&w*BsH(Tdk*u^qqfP49KT`vMc+_{o>2@0H*DqaZ)Z!8e&bif?>dNI&|*w@jIG zj}qt`>iXK}J@%V#o!{HW9{=Je2>G4g{@!#f%FH)e@5Rsk>eJu*@>j?&WEk#+#{PT4 z&o_QSHabHu+;4IOFg0+m`Vi0obp!tvu>0nZ{eVyX9#8@KX#yXR13Pf|^v^!NulXWS z11}IMNYDcza05qh1p|QpX65-n&;@tM|6oW4Kd=E)PzQIg{W35tau5S6kaud32eaq~ zZBYGC&;pClEG{Prh0rT>j{twd0NHK*OfUeU(Dn{60b7s>c~A*?=Lj!i46pDDPcZ$w zPYbE@Oy|b`3O-E4-pX&ki`s9 z5mUnv!Q>GqhY_8Hg#UgIaTF_& zOfvBhCy^Dor4&>V}96h!eE0dXDY z5drtG1Lg4!?J*JYu?-P|9}(~$>9IEg(%Z7ldjt|8Yw_Vm@v;;uAstX2^|3efks=?` zA`6TlkwPNRa3cZoB0mx&FES%Tk{3skBt5Ys_wRce^6~_7AtCZ4WAZ3cG9hR(y2j`A zPVyyXk|*D=C;xvED1%Zchmt4@j0}W{&DvoLX00fjaxqG=6}O-zj^*H-(kibKE3;B7 zw~{Nn(ks6*DyLGNVp15v(k#DFDygX|AF?dZ(k%lQW}H z`8<;{Ka(^+QZ!4mE4}d?QIj=W(=}fcHe*vZXOlK-(>8AtH*-@rcat}J(>H$;ID=C- zhm$yq(>RY4Ig?X4mykvcJF`6i0JZM|adO*~rXtqJYedJIuuYHk3y%vOgPfI92mV zPc%uJ6iTC1N~e@c|B?($BCGtdJFxU18wy5i@}R0zOvjW=%hXKI6iw4qO>a|U%%e>Q z#YjJ*yw;RX>(ox~6i@S1Pxq8h@3Edb6ynfiM{L2Gyp+xQ6j2jZQ5Tg_8`V)CH9i+K zTmND%O6p_O%1-PcRZ};WQ#;jDKNVC%l{CBb{3?p-M&wc_i77>uRa@0nUlmqkRaR$} z34e4_Dx+Ld6}C>1R(sV~e-&7RRal2rQ71J}cU4gEXP1zsY>3rapA}l8Ra&Q&THDiD zfx{@ati%%QhN{(DzZG1=Rb0oFToJQN%OjLDVlBAmc*@mX-xXftRbJ7B@2JZ>WZ0FBW4nR%17o zV;%K7(bG>lR%Az(WJ}g$PZm<=GY?UgWn0!|UlwL#R%U0GW^2}FZx&~BR%dsXXa9TF zXMYxGE%Ql(mS~ICXpa_YlU8Y$mT8+-XC>5WqgHCCmTIfkYOfY!Arx!3mTSA#Yrhs+ zwH9p0mTb$mG@;gP)7CG=)+c>~ZPC_bD)K1U_9L|qZRwUm2Vz0rwjb|PH%u@f@wPAP zC~!$ga037k+hKs34{i;`o=)O$xiWIkaB_FgZb_(dEh8fPRwcj3Kna%zLDxP$7jyqm zH#S#qJrH#f7a=m&{o3G^@W(#vX^CVvCMy>u0JnAXmUU-R2lvTxjc;#v*KZRNcoPwJ zYqupkP;_&*bWzfDeb+LY*L6(>cSoXmu~$n+mj?@XATIYCtM@9e_iqCucK?^x0ows8 z!=e@Dh!kj2eMK>TO{Nt#VJX$G6-Z%axx}895+&vrOzQW31K53quS^QKHuTp%%EW#Z zcn1aeeF=Dg=@-Thc!E6w}n+$%<}h#dt-yO1&NQCe{&hsmUWN%$#8cmcgwf+H9-D!6@jI0c*d_Q1G^*B6U-xQdV1K1GF$rPw#n zm`1qxi_Mrq8h8ZZIE7ovAmYpuWvssV*M2vl+OjE3k#vhg%ZlT8kN@5HkwxN-kys<_ zI4~U8kj?m!&tsBzuz!}ZjKz49Nts6II54s}mG$@=LwS%-$W$?yjhACpmH0PQ`3}p% zFCci7VwfUkc_jS!h^Iw>5jh24PKfzejV~FPt7D5_Ye7)inMc@wpLryx_>*ylns1qv zc`=0T5}B2+lA)N?0$J%g5S+jy!)RhHZHh%L3VqEfK6I}}4)uT68Aj7NwAL92G{a9= zqn{~)pOe_TEMrAkqn*J{0+5l_lAvM!nI;0-KGq^#Av#yCSO@i)Xx`Z}8hVsG+BZPD zMR5b8d!v2mNmrHcq(_m}VnlFSL!y0yq9;dnELWrJq}DpaqGNh`qdEYX`oQ$jr_JJ^+k}bnSu?)+k*ZqE z+7(;?x}=Q{tF=X}?W3(13aFt(t8rr^XF4nf8m>87QPOpIc-p3y7%5shqQCd9j(P_N zPJ{7Tz)B(}$r>=~x;5&^rzM*;e!{Xj1D=!PslVE)wUwnZ8vw*NRgz$>w@v`@PO6}uJVdOSE=kh=N~x$2q$`(w=Lh5N2GmV&HNE%|<-sJ|tw zNqVCd%A#LnPSjf8R{OfGo7c=kw5eLSU3;GC(YNE0x&Ir&xp%L-<Laco1^I)Q1$G^!Y5y5BALNO3f|Fy2=F3y=#27OBI3Jg_{1UfdtChFzwIf(SERp} z1;M}czIYWfM2x{#W5FHBP~POHI=orIkiZqnzT;U@^4r5x9Kc7s(p0=AjKaZN9K*i{ zCV<5OZ~QWWViUY0e^8?p{KI}J&o@BaP)>}+H(WPhgT_|_zU|3p;;6}G1jf77$eXWd zcu>bXYj(+?$G<#|8ic<`u*55)6}%kHhx}7oLc~WK0?QmC(%j3#{Nglx#g!#U8QdOc zT+d}Z&jTD!Bm(#D-0(7WSKB-VPu##CJiy=Fz5ijP$^%2r)f^PB{Lly8#kuX#y%diH z^~vR%%BLK?C1MN6V2(IC32kx11h<+Y^KRBP=~3 zh8@yHoey^Y=;!%ot}tFM5Ql4Jmgaz*Z*rq3VvebT@b{RWjB5Z#p`4=pkk;|f=*1gPJ8}?px&NsFX}5zA_V3qZl2{`(B;c0<`H7)d&zgQUL(rB>QAM0 z#hrwbUa1if?prY%sXk5t?dX}pR(lEN-F_s>e(X)}YRF#fja==;-Rav;mv?aPAustf zexcL~?R(?o(K^)+sqI-^_O>49!R|Ed@$fCYJP=0n^NaLR)tx|`>McDyesA?lU&+SO zP<*^y6W`}ye^NL!d}MpQ`i7TKLuy%k@7M1cO9u=opg zq#ytQ1tkF3qVZw^0Javk0%?#GfRZh9>Lf@80GXWxXC^Qxkz#32AE2;V*r~;0W8(XannGqPoolS_%JJgRzTzC9JrHhRj+dM>fOt?WzU~| zTb8|eGO*rF2`JiBXmBRZpb2H3WIQtQ*T@DDE5=-LCTD^+9|!nI`7)5at+p5?_z|$? z%cTP#Tusm^sRS$w_RKwdA^+CPDCKHp_%=W*+y-qW$-PNJl9vgRIER}vw85T?Z|CN@ zQu1emDyi2*uDg5V$rf87j4r;Q`jb9IdXN2j@xuDw-J`F0^Ezhh<;CV%Yyfh{SZcJj z2Gn~XZ6RL(%{>Q_bV*RRm@QJgBtcv5A=Kc5wB~g0;w9}tKCyDeLQDdc4oL(QXc$sLVffn6$%YpWzfslzdQ+87x^oC41IC44Y+mx| zs{G5rPIOm=mQ1S&AuZJ{{_xqTyAf-KRQziDzDnHl|voo#vEk zK?RN`X#kGO6>6X4ai=IouP$`!f>~ZEC6nI;8rMfWiV0PE>s44$h7HOH7-%KJnPW~# zS`;gU)A~kLnADz>02$XZh~q+Ayd=dI%I!Mos+qQ0=%cYVX;G~g;R~T<_K6C>p9}Q{ zBvoG$ijls3k1vW0X|NqZ&`on?)odFO^ZjanXWc-2Og#<~v6Dwd*k32rMTj{6{t zGOEkri4)REtDMg%X@Bzp{iBgB@(F9uFCabG`$6zA zmHcz7a(vOtFs zWQG!I+fH7>FbNXyC2*NZ5I-Xnz91x797GCEBC@QlG(Kmlp1X@JGARphdn& zybLY`i79j;49Vyg2TDXOJQQL6tg5vwq7eSp&kbWKkBn0<%JPT&zBkpRQ zytKF%@#V#mLpu^78Ck`g7*Hq2If+@~a>&r#rGynJWo*Lezj#FwPz1!tCtIS*^u$sp zbc9eB)7ZbbeQ+lN%LoS(=s*T?(T-iDAV_!?mti^)0N27u0ss~!&m@4E1%YD?3vwfg zNdIJVEx{zKw!_N~j*wHYgro!=**HOhk09&|PE#Dz3R1Kpn&S+UO^l+$05EST5uxGJ zq&P<-=H-*|l;tibDMl@w@tk@AOCPsM!D-&ak4IVI9{tI}mplzP6D<-!Cu&e@Vsj_X ztW86R_^*@D#iVg;;5B1POLm^;TMKdDI~}S

    SoMAYCA$tXag&c%>&sL?ArXHWZ}d zGbc=BN|5v-MgCAmqC&MuN`-TzT6)WQ$y}sD8Tmi8coie+9HT+U#7c--M4NU~-~)ql z!^FTxUczK(D<>tEf`Uk{6dmG4bD5ES)}~Yclqpb&I#($b(_JZr>t51ok!iNEApge8 z8fU<`Oohdgl6;+9zxLNqZhGY-(BW(kL4rz**rFAlHP~o*mrQ%0g&;DF-$xjETcpA# z0j(V#x|W5=nJ5Y&O$6p?L2}C;xiovF?FvQIqrVf9wv{R|3Rn#ClH7C;x_hl(XeH^v z*kn^RZ*MV=3VY27pFN z$UQaE+`S+K$KZQ#Aai^Y3+=ZhIXZLb$S4voLmIbg70H9Pj8FQh_P63e45HBDnAHOJ zB7Zi_Jhy_LI@?&sLGf>12u<5zH<#LbmN8XqUFr@;*inFi_RJKC+(n@&r{9*gxI;Ou zPG8wopbh{TMVW2CK^ViQzIUNpQfIdWnj*h;vZG6$bqA>Bh%>pf zjgIl7yX~u1eU~8Jy*H138j~Rx(7Ze+a&Fiy^m~W<)#H9;a=KGug(xrItLCnGetzMR z>#ZWH<~mT4ZIPs3c7R1n^<9CGT-}hO?dMTq+$~}}GQ9nNZLo(*Lh_QcG-M@BOTfhy zD#C$e)}ItiJF~r_oX^k&+=wr+Q5w$}Tl{?s&9Qh+z9f+0vZT1*k;qezp7*_b7_&~- z>fI>}8I~L##L`B+-QjNAuE^)MH&fE=VJUb0^uF$^H*M*g*Z=nb4xjHB9?0%Netd-e z;&z=kq=o;%k=TfSfH>XlRiOEl*zCt5*GGN5<^8Qr9`Q#dmJjvCT-gIpz5F@XG)>0_T_06@cOf5^0{=aG6HNB-glL6VhzC9J!Epyz zc2w9Gb_hNdNL!3SS+as>d&q}3;e+>K9t`*vWf+Jq2od5}iMFIfBnWtW*A|i|6=(() za1wYqLKm1ACjAi_O{IsoC0XO35aQ|ky~=*WF;hH0(N$Bp=b869-BZ09uizuBUQBU;*m1_xiM#7mZI9hcECYK4Bnwb;gq)lSzL}M{q3TA(D@qht@7>KDctwx$#QvaFefl1}GR8>huJPB(r=ali{mp>Ugr*|(1 zL7kL&FtB-avS~Jnxgd*4l~y>Ojp-idsg;OnT5$QCZK<92!jPK9IIWPLa-nB~37lT? za-PI$?(&`yl^?Acm#`+3yLlw}37&=dM{EcZK#(jphFi8^mw3rA%E>^YND8AjX>(=^ zoC6=8V|GB1q5AchnTZ*}sNj0&No0~uiMfs$&(w30~phwA_H;P*ZnyFJNrBG<1 zk%@tdn3{1>rwdx6+t{VzWfFl1enYVZLy8h+>R4*3UwBrRdwP~7M`W0ps&v_ZgduT0 zNoU`o6z4%rJ~cUgnuky)Z+|j}Dzz6nDH$kNG&E%-y{8^DR3zAHt++&m3W7*JVtqCl zH1M$r#qt!}9-le4YzqeSM{uPTABm(oLuN^_rI-5_xQhv`Fwo+RxDSLnZ5mz@` zunKEx66i+bL9uNyw3oq1Wbk)4!I^o5giPTf`({~fgcKswL>^0z(9<64inW9SwKAKn zW0^>=RA=SdwBnjXN!ChK+ZP|992^HtFGN}c^%<25hFxeQ<7yFb%PKmXx#nsZpG$<_ z@op^3x17SXyjvQt%l{LETaQ4oRYJRqZ7@m4+jfpyxc(YAZp&$UIIvc$xjHepI+$Fy z;kQQ%slU~eOM6&p@~3)nkFKS-OLVf7_Pq{!f)Obw`B7)isvinlyR;j-;0jBV1GV=H z8F!noKJ~M_OScwFt#}))GKU$vJF7rftMUjFNszjFM@`)OxcVV=@OxMC+qwoU7p2Qx zdAqFRMM5CfB7%1>{@cPp!4Y0zTicYP7sj(0QDp!-71v@9Y_p*{Oe-&0!#QDLYnHYf z{6B`9FS-=NO`$}n#k1Ff5I`V1vNIWs)WcD>YB549@1B`;>o z!bXJ`X`HM!O#eX(V_WTjJo+cHWQkjrS-5gc$K-36$@L(;L4V&dRgQr?wlK#qsUs71 z9_IvB6!9BUOvMW%1+ZwC5K6|(=EM;+#!S3TmUK2N48ukt!(#!%_SME(x2(h&$A`?v zUaX>+WE00_$D?Hr{hAR!JdP%dPj7s}sicIQA_2W@ON^7tJ7LPI$rr$kOI$WEIfBI? zH^mh^$$P`Y%S=li0-pDol-KObXS^Dy%xukkFaadZRh$r4+|A4y8<8vp=S<0sa0(hK$H`k)pTE%&}Hw z$b1!=xc|(??5qF7A}Nw>pA(lHrLPn^P{oXqu1(}AIZ z5eLC*X<$jLOJs%99s|MlO3(=msWyY6+-DPHMbv@F)O-0Ikvz>-Jbn?($>7YtIVBSf zeQz;RU|kHbNM$;RLd5=dSPf*9;J3&?jDKiNTaWCI{_NFu9HDuUOH#(J^Q_j7hS2dM z%!%aJ-u!;oB2M&t(V6U1tPIgQ4Tw9*#$xftpqCp!O@2B})?lpE@^&TVLa_Q#bB?mb z01c^2t;emL$kON1L2bfI*mFG6aI~@oe#lq&dXOLn+dP7M93csbgIi7e+Of@^0%nj{ z?f(`b7}FVXVu$0RB@A|WWhyb@id^d!gXdbmk=v}|(medz7WuQ}dd=C*BiWdazrn)? zZQHze-uGhO?`KrHEzS#@Q|j$RI5j3x@SuHsJV{5-+zL4{*%IBR-@p8kVdaYP=-z>$ zzWt5MVu9JA#@#O*skjXQ?VXI#9pUXAPjF%332unLtgHnwO^E9kdWd`b-PzF7Ewd!u zW^3YT8G_6CB`+J_azWd4m`K82l;rpA+o*Jq5zfw$TH8Gyh7SAWqgUjz-E%)1g=B6dtz8^j&i~_W zt;-tWvuzW8SXbj0fi_i(WOW|F3SFxp9vE6d;%xilEg|HG^-eqP;~ZI5PnhU)M=Hvl z*6G|W1zLu{BlPcAvFVP!?6~*r%zm)}IpPaFR{rhh*{<4p_Wu!9Le^XT zsTaYQ9YlrF<|qtvLQSNZ8!s~Dp{yPsKqF)mD|~cuL-M#)njO!op6c9E5p;tN6d|v^ zEQ&BBynHFDn^u zlUe`aK8N6hE>(v5;AF*hyd?I_!K&isqm){fz!HcukE7rv!7ag;NN+VSPhL+iDW5O; z6;b$+Msl%&RGSYs{^6yd^DRZ6WO&aXp|2;CQ(!@*0#|}WxCOw-lo~lAY-f~aQk@>5E}cr#CeENk9ZDtj@S{@z6g_g} z=`+AZu{{SS6>1it*OYEI4$Nv-pwzE9>&g`fH1E!_0_hSoIRDV2V4gYya2-gdsZ=16 zweEa6Fmhe03K^zMQg*MwUjvy^)O!~|Qp8L>3r1))_Ue|ICAwUjn`KCYuwRyx2ov~8 zvwR)ecBrv8*tU+F#@#(vbpXv&E6cVl5J2bb2n{pFo%r4Qz0*pk$%Dz)ggz1+}q?(GvEYoatvB`*ZO`=RwtrS%NR5hza zGBY#{SW`X4v$XOa!_?B*5WT9PL$Ayc)DT%B(Zs8`{q)+~ssz=%^e}C$ykDf)!ccfi zo0V9|+A9buQD+nJM8H^e6)b79veK-Tr0r1(LxW_C(%6=qQBt-L){{;?H%-(vNIP_N z;-NUL_QyCUbv9HmNyXUVealsCWt8Welgfex4*zyMi>usip)D9LZ&4;Wmel2l@T<>Z zh$HQa)pRe*lO&Kyf>q9&`*hgnh{Fq(;->@nc0^;xJ$31#OO9=&03CWaUJl_M7f=re z6-ZPd1Wm29m4J|96ApPcOEawFCNs%#6H0)*P624Qyu0(>yV5Oa9VoTAElO?XhlE~F zz@`tEKyPz}q!{#vjs{w%EfpS`XOEzC=;X#_3;njlvsp;%1N}NTFYZ8rAzWa<^9FiQ@(^Wtmp}gWyortLux0G+Xbn8 z0vzH4x8*iL0jgHITN{ar1-a}bC3b`}9HyLy5DN`uO9sKCLG*Q`AyH603ELW-gNPD_oH0J69yk#TvkkqHorAP4!C1>wk$PVD4EJg3L`eJqa>VA!{` zr!$u{(vQt)q_igU$%G`*gq@<7A^)NE6G}=5P?VGkVi<|XHA$$KJ<=seGTJSdt`Csy0EgRMG@MfTWnUy?ApVMKR?3!1>A-5=RQN#AHXznH^jW zGFa0g2}RnulSOVWI|ad~WU$GbsGJF$-boA}CE`bL7ObKDd?R6;hfYH}3!K-x7jdLz zqc!=nK(6eaMzfR1Qa%!oku;_=volIVLWQLL)TI+AsZs>#l8`ek=}d3gP`+7Hitqa+%cFRCA8pv#EWw8P8fC6RI}-3QwDvQ=uxApR*jKOuJf0tU`3C ze>CB~`gm5YR+Xl^kqS2{I{!#u+2WUg3?^*e#VU_Tt4n(1W>uzQi&kVQMML7CJz7y% zhYiM&LkZGfKjN!-I#7F2+s#z-@=^r}l$dTUC1*1d)vvG=mDHqG%BI<@oJ!Pr4T21? z=9)($jgw{_v?(Z4i&R>A_NL_|Cf}qY)0JW~NcnqqsTA7PCAW z*#cn^6P%U!Wn9&5NMx}Y*yxbftU)rZ>IQn2#|8krL$xbnS0c>uB1AK1n^40%MG@GH zhM!w1C~*;z8c7xnv2)xfY~oAF`O?IuWc%1r$(l^S(Kao9VJcWpiQ(QZ^RqZTD+U#s z0EQZuLKmehF@@4xA^&EltpSFj@1zA?>AussY#Q!EV5_Z!ycf8D{mET7(cqmt_{Xy$ zZ%RvAO~yhv$4`awLloN%xzsVrSC&wL6+&ew+k(qj2J=I_yu_Soc_(BJGuOuzo78 z#r$Pj_d3_SrgNV!H*DwWIo7_8@}^TFY-GFZ(Q%^*wCj^rS3jhl{;egj2XgI$jGEPZ zZnd8ivt*w*r~f>70fh=mAU?_TTL*!)h&y@vvEqTIyKtughlDg6*DiwfYGHaL`> z`f)I$J3EAKg|_vb?3iXL?hW+ZKNV3_Rx>ySmt?M3{PAhh+cDmQy z?svy~-u1qB=fT}IbC2?3(T;ZK3BDDCcL?BTj#<7po^Wn=eBBiv`1VE~YKO6 z&66eVo&N`Y=<&|^r0q!)eZF^~Aie?IlEhkfj2KYQAn1y|$?Y3+5NW}v8DZi4#U z?u9>m;uqie&0g7&ELZp5cir^IpLz44?`!F^`T5hwzIwVn`|4-k``+(hWrl{M)|)BtZ6)vhR~Wyi=F} zgsdyGKL=zxtV<>961xM0zYC-$wd=nE46_ZSv-`_Gg?qpcbifjnJr6Vs5&Sw7)VmSn zz^0P41dP83Y%>r{K^jc9>0`kcy%tJU)tZ#7LCHNuaUz`kSp| zyr*gh5+Q>|oW)-R#$Xi2VI;<4G{$2@#$?os`-2yan>l8@pXJLe+VVwZ9KvdhJZ!Ya zZREyo^hP<<#%~nIaa=$1p|ed)jiP&_*w6?dSgfRgFmjZ~d8EgBw8wkI$9&Yseg8}r zQp-2m01jzP!Nv$Bel*B~M973x$c1FchIGgmG{vDX$67L!!NCwRXa@<1nFHAZ5g`M) zy9)X%9G0LHahi&Z+{k|lK8+B_hjhu8gvpqc$(f|dnv}_i6f6@0iVPv3uOdldi452< zk)O#E9hnn}m=mf3C=S7+;sTqDvB{{E%BiHvs@JcSSm-QjF ze@I6t0?X78K=v{nJc^^Ngv+>;%ekb>y0pu?Ji-JyCv1bQEOIQWSha#e7=Sz+!JNjl zNR0#lig3is#&pcbgv`j4%*muolGw`FA_X$YOzFtI+{262K$x>+wCQR|w*R0%mS~NL zsLa)5&DM0y*M!a3gh{>REub`)vWpr56DdT=65CQNk0ObB`ijPq&Eho9<3!HnRLZ<^<316wmP_&+;_SAEeCy@XlwEF}4^S zsTj<4xsvvbjli%k;5^U#)X)9o&;In!|D3llyUYMkOQ?d1>4XZ+I25J`B!6^|SSd|` zC{V63BLKC~3&qe3)zA%Y>isfB_Ob}(&TKE)I&woL{-#9Wz)JKKXNR`w{eLWAQ)Jw(GOx4s) z1yoDr)K3M~P!-itol}-WIGm$3NQAdp^HfybIJ0QgRrNJhO;tqOI)8(*STzes)KwtF zNm`vXQ-v~M4V8D>Rbve^VRb@W%{OA5G-til*@ITCo7P!HzBJ3Zl0(+6t5zfA)nh%? zhqF~6BvxjP)^OduZp9#21y{{e*I)&`cWpyuT~|7zSFP*SV*e%8edX7F_1Av|*nox2 zj9g32vxN~ASmSJkR#BJ;br6PCn1r3Q^H@WQ1-pd}lZeeqjBVI`6w^|%2U0kqvvEO( z_}Fu*9vsXL#Tr>SBZZVB3X#P>2^qZAyR?^$*_K^4oc)QK9XvL(1)n{<8f*ofrKX~t z*@;?;5JcL7?F*TGrJ!BCp@p(s+=)U>fYXW%srA_!gjy;4+I*8chvhz@CE2NcQkz znA(~x55i^Iye*H#?X0zp+qz{m%565wbzHN}3%O<6l>hKt!xP%bh1-eJ+?8EjnrPjf zNL{Fz+{SG=(5(wR@>{Ii5)L5>q*Ws486V{TANjn*G0CTlr`|}*~eYqt}S2jHD1R<->}4nl=-t2WA&N#ah%Y@M2o|MX zq7V}?h~iOZEIX_`YBLR9v~xn?IpQ(Y8l*RE zhZ?r5L0Yrs_?-dvkT21tAC6oQ4v!tqVLBT!b^q+OCRV!_Zc6Q2;=;3Ey@0KRkYNtq zjV(ru1fF0m&Lb{n8azsZT^SBKYgmiTHz*#>bsVV{CXNHXG7H8E9)3AHMhGw7wy1*E z8&(iJUMUQQB0A0|Bo<@0gxNOJWA}=xqY&iXXk>27BVy&_>`>x7(qTc)WIPJpNCpeC z0b|I6GAW+lHKq@+lZr3xWP^ZX2q{0<1LPjgBjp(7Pp)FwP~0}7-w70$S9mQZmP=3Zvu z7V|ncwoGsSx>c?_TOs7pJm3;WXU*B=z5ioaHU_g>&No!1VDX4$7e<{_ZsX{JqE~L) zFlAy0F>Ot;dfeCFR>0X*aVU$X^!?so`C3( z#vO#{=){wWl9p-fD`{6g=`@oH64U57N{Thn=zxxm2|cH$Sga#i*&RWC*Ej&CuFuiD{Ge=W#j-$H%>4y+%CU#I{`|9}wvzI1`z!txYMh}oqk%gw{D0O7H zzH5T8YLhOa@=$E1@oA$TDaOWTxBtfLh^7|5p6h0d?B8jH%f6K&8oSQMwm@U-)s|_s z&TPFf?bwE_h;Z!BSVrECXpvTFyKd>8E^6H-P$m^)pH2}rBaEgt>GHa2eM1W=+mTJs zYJ$#=EAG6_W@<8U>PjN&zpjhC&Yavf9G>WH${26YP7KB#?w=;>`P1&*Q19Tzoz)I+ z+dh=s-agv4YFydg%RZvaPVMDGY;890?fCBSerVDr<<3iRvS4j>F=+=cZ~R{Bs>X1z zD{Q^1ZnZmb)KG4eHX-zmyz~S!<0fx?Q}Kl0ZYXA4+mQmzu#!Xq z%`9^W9{2HtAo9w?IDs%>#s3Zs3Ylf04nC)Gq$e+NwwReHpIG@sv?W(=Aa|gsH8a1H z=g=1NG5>PW5U?`G6Duj^Wh*c&KR-$G@-U(bDi`gbhU?o(vpK^~wY#7{A}AnA<2kbN zf#7ns2B8+4&^f=7(m3?EdGygtb1)lFWb1Q1FXhS;b5DCMJu31!CiCt5h);KEMX&PF zLg+vT^)nas9&fKrk7J8!nn(|{BxnODI{-gGz`ydA#I8^dbu9Mu%7dy@PxLW4^^~yl z-8lBx3Ux+TY*+_$R{sejeh5qJoBHOuN}pwC$LhCCJ#CMmNl$jE7LKoo^kfhBU$>HE z@47a(VrSWGsJe<_hj!@}EUN#=btx|xaW_yjUp7i%$=GXh7@zbAnrBLZ@`3ldOW(Un zzjky-j_(wbnW6QCxArbG_+sxhhQ|qR7to5QHHEj@mz#Lv!$ZAE3)2HA?W75&;G{=7 z`QI^lCq+vufpynHDhk=&#C7K)gLpX#lANcYoxgda81z}w&5-Dv>}F>s!Y9IT3zf2m zEQVdl_K#M2Pk&WvaF9b1mO_u&XZPP6pNYa`LL3r=y||6tX@3Y-`d`y z&ljLCsDC!u6aj)6JNqelm5(@B-d>D$(0gey`zg_q6iEwZ*%7}V42aIS(=z)lz!2U> z7Q)})R39~DNqL0ulE?q?BW6*Tv^}R){`o6u`rsf14LK)L7?Cha{R5@@kMN7why8+T zkFE#mFne*#9}mOtoWP$fqoSmXL=Z-iktFzgDG>gp2jbnY`md*YJ0dZ|j<%xRdc6Oy z>NmZbZ!eyJ*12P(t55ZqA3xOVtj^Cp?~hP)a(=xqe_%(Cb{T)eWJm6ofAC*M)W>~f z2Z$}C0uT(a1pt|X3KtS=B~anPgaI55EEv&V08$Ay6|_eNz?Ovx0JKtwQ6oo-AWgOc z06+@EmLEtJ3V2 z1OrMY#Y&pdw zmP=)An9=`69pObBk7SuuVu0_(gp*D(X_a1EOzt?AkB${cpJmt;#nvYHMF*5{Qe20n zdcGO-A(UyVx#pU-*aKTj5-(oa;q^yz#({`3>7 z%-+T)rIu2wP&?S(ngB!ADnzH9I)bXuvu&m86Ly1=(Vt8G^;c1xOkoS(y$OspC{Gr0 z=TiSd`;J7_w-tRf=s!~h))G>IoU0W0sz{nmUW%yZHVD?^`tv|zy<`zbK40jvutq$xSvZ^TPy+q6xe5@f1O zC?A__vy$~$vQv*n+Sb@{9%}Qh{f2v3dS0vC?q+BQsy0J%Lz#1OJhL4%SFJpZCs%I5 zX>8GO+oUX3hLcUG;<^6qbDCziOq}I5)yvS%d*O{$=hu!)9OF8#y&!j2U-h)MI<hsvu4KD&O)% zxHL_rBH;_bll(OjumtRC=#$K*T5+m^(9eI%OWyzFXS$e4%7U))9%{yiFrP5(fxF@t z#Qr6!Z)L`0OdFxC21cvi6%Q-4`_)|N)GxA(?sW#EkN9XPHtpF@A;n^scks71_rcFL z28_%vp7cB4jSq=Q8Q+51hBS@=Z%v`I7Z;0|x?2U$Wi52loEUL*{89_BaSpRPwM|;covcwy+fO zXoW(bv<#AZS`I@l*%>r>5_qHn&Lk61NuogtK`xQjL>AZ<-8_<+79`wKGKNY2`xFg&vp4WhAJA9=+;D zplD)cB+R3wC#^WCWX`c~j*Mssy9qVt)vcD1Y$QQ2N;h28V(Z3Rn!OUFc`~d$?|WD%c{OIeERX+ob86AJpw%hS>fcJF z`(Mch6SMIhSz*YsBzg4}zdHUkC?tJP3KGdYfiz=RGq-I z>Gc@ATR`%-$G;hC-}D3o9FbuYa|_cif$TCPUkg(f8t}}@(xvi}PEW^?ra&yzK_gAM zdmQc8tfIVyDbto$S*EfYKeiL{;pDbWUN8EdO5rRPS!KWx&NJ_K#w8yaGgrRZgS_Hp zKFLt4WS4z-(QqGocfx+lR&HTmvLn>=$xcLmWOoCp70GsTz*dch8`p2!juU_ZGv z%e4%TUmGCoD6N$ zhLppT`AbW9J!f?TS=aea4`!78Yfd$r-dp(vPS7kFcxQKj`-T$33+-^Q$ve&lcM7JV zlyT9u+cj75H+wrW&O@bpWn^g&%6q!!xPZ*t^}foTjQXqeP}@5P(bIv})E+-F4ppPh zcDA>OpeSuzVB{zi>%c?4z&$c+nd*$&TCvxN7vq#H^_UN!kI!B~9VrMaKt9CE}55bXJ(%Qq>yt#kxl$`@I^RFiL#lWrYGsfKa zoR|JAWe;^9bN`R8ia2|=K!&lnyEL@9ZN#y1C;DK7px+zXnPSb5R&3(t3FwnXz|+2T z!sj5Y;(YyKON_yv|6P{;i5{$2&-q=SzEw+3upa`!pQbE@n=z06T#>%5m;7l80NUS6 z{RCv#)T=Pgzi9@J)ddKW25sQgcw9>Yh#&v??L+|jMER}RkX;HX97GxQ#MsbEV^oUG zFcS{yV5Yc4`SBptDN^zkg!{F`4O)s0ZpEu8pbu?Qm<@+lUEudLpiRt$!L1*qL?C?F z17?5>82+F8<;e?*6M{D{dpj9h{jmOp%^ZNut`QDhFn}w;E!Bi@nm8l(#;yipa8w$9Bv5l znV%-PR>?1tq2-S5(Rj-XDnNB04>y0EP!A&R9(-qIU$NDiQ}IB>+(* zfOeo5%aKBn&6*!#AZRGcfjr)OC0hSbZNXw8;8r{q(O9Ddtrq0rQbyGq8ecxG|C2z>6)UwgiBzTQ{ba6TH;gLrIR4I|r7 zBVDRk zNu?bgn&Y4Fq0LO=7G4WUdDZ_(s^0@<WzH$&t94u;67Qu9_yY2P1-x@R>w& z2@6~>oKdm~X!4`vJmxT!<_6M6vRRo_APaVC;cNvZlvpQZSf*@-g=N;8ds^PaT%Xk49NV}We#WNdH77QziSu>m za;nC2#vaH_MYlPpNxovCfrYDKTVaAwV{TY-PG+IaXLg0+{E1A2_RViC99u%DI_^;s z0S9dCClmH3kvvQtCM5q`LIxM&rkYG>{JbWHs>yCjMvflKZnB5psi!FZQR$FqjZBiB zfQEa0Pm^dB<4MM8%EWb$1!vlXuk8+#{+V)mXS})QyK(4BgX6S{QDW2Zch&JYFwg;-T!I&~AXx1mKoavez#9Gux zok#$p2Izt&=V?l5X$+NW){dKADw|9yfsWN&C1&5vBolV3-<|L05 ztClXH4;rY+BxxB5|m0jAS@7*`aS$y8{Lw9uoK4tqjLZ{6jBSzn5w zqc)B!Sb-xekt<<->6{|P*45jG8sa9q@GeJ^r_FBO5MY84?keU%fO2(6z>r#=c zxZY*LT8x`)tOc?rZ~>{t+JngU;K(>dl0wEn`NT%yF!)d*lfY(thfSH+4ij1+=@`92gQb# z9wF?S^ez9|rpMj>tGkNrH;OIR0PbwcEm;^WWFW4Z(8N~2*QUrvTI!P$XMRQO zbhfBd;Op+_;pl|y$i|E3@asl8E)YO&QWYBFP86vWF6lCCrZBE;Y~b5MI-2U62Hj!B^B~U-W`1ZjElk;?}*6 zFLA)vO|EQAd8}vR3Hl;Y_ezE5B4fSsMPMYQlFDz`l*s(@?Ihw$*S>B@uq(~juK9*g z_O`<7Vo3k?EjeLs@V4(viHXQQEtKePAiac}q%Nu1BwpHO*zy?nYVgzcVEj%kd!6j} zlq&z$8t}KiaMpmR?8MgAeApx9+}gb&Ki;rqVB2Q}2IqRAB|?a0pl42==ou9%XbJH> z?FRn@@wjBBrtVI7QY(BWrw;=j1`ja~51g@n$QGLf5jU9=Bk@&eDi0T$(2;HZcElKq zDwyIegHcBs_tpNC1VYi}&j#KBE8wn)Phc1>S#71_CGB+Bn-7DgAbSk^E;6|sa+7pp zbfPPYW$}V;#3g%P0MPIzlZ+)t-`@e5BX6>MtcmlDa)C}5MGcC4pgD!;Ea8T^Q zT-qfR=!WXGfCUX7vuMiNv$n-f$#FeHGgq{8vdM`Qn+fqYmf5WCH&1057qg4XP99IE zd6qKd6;ZwX>mx-)gWQYguJ1YTu>fsoMGMQsRbLLv4iwXy*)+*Rs|F|Mv`34LL6(HU z>@%clYg^3pJ9flh-1L^Jb7&fMAEn|}aBj>#v!+mwADiG3i4UnFb944{&8TW%ECp;7 zi%lK0gV1wEukRP{-4c(>FN-EvtP08e^u!&sNDsz6S7#xg^6lzs@7C~J-!A`D8&W|t zABgNUl<0NCrt*Dpn}2TTGrjV?wKNP*HU-IWp@9d+WQtZvBxjT8=pZRd&6*dk2pOV@ zN9^zS1jlJ3(d&?QPhe9=mUdv6h#4W#y}0&pw6>6M{x*=h2~I-Qzuu%dV$4qW5hvVHgC{&&9Lcp>J?t( zE_YY!!^RfpMqrAlv(rhGzNULE<^bCcgCIyL+whWt)IliQg|51xI{_Ni6aF! zIjzWeU*FIixNu`wg-zwRs?5YC3lgxc?gG+hNs7!>(zdng-ca8e|JQh(*_VgH*cT0NnA@GDfy^bL%zXMu?Fn}5Y@D0;Eyi|!^A2vC#dF`fp_e&p?>hgqdwP1|V4;;p>SkP+Pf zXF8;;j*)CW*T{@)9vmj&QPY{3?&OwvI9oT?bc5dFiD3U~N?<1>f@dB*aBPU@h2 zn&k5P?YyysO7&&7&VzkvK@GXNgicI8&o90})=+!6+h0v-Oh|$hXoTsNO9bLW{jY5Q%j1W1um$h44Yr!8m8(dKUkxs$xi-K_QfsBet(ZXLCW2g( zNFmB~;lQdB0T8u2a1%-?JT3NRTW|{iGBp26!8(|rTDB>1hFom$VSvH_4$rmcG(b+P zh_eQ$8aFWL%{0YsB=}d-+yDrHBPWM z>DPAy>kSD&vFWRc2^N0)RPc4^8H*R}C>!`r;p)dST+bPzM3)ycKK5)FaRS8yd;6^^ zzjUhYCfxSgVv~*l*u=WhLVEDJlad&S43z&Ai%T+#>T*gf2?`PmESgCBEHv;4w8}uH zQj}mtg3gnUG}>(AO|$C?GV#TM#H#2!?hI-NsJN!naIU&K)3HW~tP0UJ!uS&n#{e4B zuONG#Jjp}HpaiWy#Z3J2I+iACZXzq4WN$w&r36qX#6YwW2uYw3UL}ExZMHLuCzOSE_H*GL~CmsjLa2{=umy*B&gYQKV{FfY6}imq;b)e%G|Wlz4zdTmXgBXf-Xdu*@rQ%n74Kr zy4WCOi=Eh{ay?!Q;CWkV2sHr4%cN?De+h;yXThb^3X+#x`lCmG5gx`E=y3v}Juu z-yRW1@~r~5ZtOGeJJg)q_BeG7jA2)*2=-WqIq)fufS`j`wH(JXhBU^0udxO9HsL+s z%}Y@ivJyxT2p0(&jCLbi8?#DC!rmDqc9jDf2TyiDnh5YeC}Uv#e$_Tr0f8WLixyMx z#w5Y91%HLBjJ=X)7;Z5yiJ-X`1%ZXXv>8oeA)MKGeE2+qNKr9C^j{IpN5lrH?|WGS zQcjiy#(0tJIxU2oo814V#tmNXiEj*m4w=M5#;}ofM$`%hH5h;_N^Fi+2_f|KH9aV9 zO=oL7ASAc0ayyYVYcKe34T1b0Qip>T+6LEF9Xl}c5vGHzsK@7JZ%%2P z18Pfy&>2s52DF&j?4~>knoxXMbA7%;s6rtc(O3@Dp$6TIFXL%Zi9*zw4e94o@L4i) z`s!%N!DbGNrN{qz%A^Y7YoElFA2%^N%$)v&rJIRqIgz>3Dcy9V6Sbu@ zPX^DG7Il?G?IltV0##ZXw5Ch7<-Nq|Qk~wjr4(gINpIvUTWIwlTqUSe1v*23UUhR) z<(Wn=>Q+^rq^DIaE3m+-Ql6gEuABKNY3M3Zv@(^jYcXqK{wz1wd-Mn_ae`muLCCPJELa!~4Qk zSX>P*t7NEO1uvMv4R-K@Ask@|=Wd0#3f+V;tWc29_Ajf+@P|PhViAv+#A`W^hd;dG z$l9#Lg2haWVGJx4$JoXD8s>*+oMW-RSjXDrv1Mm$*$%s~$3-^sk&&EaC7+WFNl@TG z+OdV|Ejh-frR^3va*-)hnaf@F@|P=%<(Hrd!&XMDEi?w^0;^BWG&Xaa*F4`~MS06` zE;F0k{ASDQIm}s30-5a$%gzLv(1kYip%I;EMK7Asjdt{-AsuN+Pnyz|w)CaFJZMaB z`nvy|_VlMg9codJn$)E>^{G)kUfiad)vb2*t6?2$S^L(jv$i#iYkg~7`&QE`+4Zj> zoNF};8`#6_b+M71Y-KN-+0AzLv!NYrX-}Kl)wcGvv7K#gZ=2iQ_V%~IZRz@ko809# z_qiK9ZgfLi-J5QAi*51e5J$u=@6NHk*S+A};yd3PB}H7e5R?A_T;Po6YOMO5aD^|N z;erjYP)M-_Nsytwws^RNEH3Aygh)XYUrRg45JtBABI2891Gn1I2IP_sqoCXTIx{c%$s=X;v?tzhb`QGLA*%Gu zr?29RXBE|BY51?#87D^HJnBOwdf3?gHJlF%>{SVJj4kkl+cMyz;J zDf@`_Y<5x!^;EXtFF%o|WE6{(9VPfB zVam?MplB&`SJ^!9L4J6y3#Lrt%+i)c$gd&DV7)d&{SrV?;*I}^PHPV0{}TV8|2WG0 z!b<`}#Q@zUW&RFhFi?{6ZIS z17*+(!$oyM=>C|63zzQ+j|2XiPz<3ED2jw~faG5o@Cz02lFZOeR?x?yWn89kl}b>H zoKPcraIzXB1uvud3d@5EEDi~36VeQt9FS?25NZ7H4OM9md2p>H>IZ8l2p8iHy>Ama zu@eX4*chT6(uE;lg$#TSB_PnXWG6^QF;oiU&qyK58lobs&!dP!3RwS+K@{U*$Ux|x zjv;7qEfNeyZZQ|}gggR6eVir(VFWK&&L#j+HP+A-1H%|u1S&Kp7LRdChS62BQ5Pp` zxK>eCT5(EV(HbWQ7G)7f&QTk$u^6>+8dr%Zuqr-|i5^EQ<`ARfR7mLFB^m>u8!rjH z+HoD*s2bgIII8g!0U&7#l799>9U)RCQjw&%WTWsgEbK8p7}pRRb+Rw8Q6;yrQyP*KK?5k|5uL;l z{hop=a4{ZpYb2F2BGJ($O%f%9O(3Q58-sE&pfU$RvLXrO&lvyGA!l+T@#Q4yLP0i# zV?wgB2r-osK(8VT`G6%Uz4F0Q(kZ>sD18!Elo2JE(IRURnKH7Ig5@Cv(GwMOG1mG!Pjfdx6FDst7_l?KOanI6iIq0%zKZiMn{YXQLOE6Ixug+XjFV?_;=&e#HGu_y zX0bc9b2F-QXM|)jD|0`uQ$Vs4fxK|KScnoM>LkWWBQgI`80WB(a&RGpv-S)_I?qow z-g6+Z5|N&BGa92dxl=$l^i%XI7%8+wFY+~oay&BhD~FRIT69Dy3p4>zZ924eY)nJL zb2FmzjrP-eHgZ0D1y_JGKiR@GZWKnXg1Tm$%6;ELUS)Jr-Ue#IiL<%&`SECh1T5u&a^)}FFs7U2mQWYf}g+&vh z9i#v+*oRmFFhtG*L?)3-#x*cjbs%^UO+YgVoT5})K?0caHwKMeC5N9ta$P6#weHn` z^i?4r%0qY5!X~FA$OQTlKoSzQVE$oR4OONt)>T1cOQaPvdTnSDQql_Jb_3(!?vCGS>~)lyZ3XW61z4ON#wqAyrNO=|Tugtk|Rb}QFn zW4CoN9+hd57VEl|R@W+1lja}L$3t{=QxX3ZDt@LFzV<1qc2UUnH-t@Dsg+f_HDA{B zj^u4)+jc*|VpyGaIE8PM@ z0taXkU@ra_2q3U9%6CiuiOj|~Gamm`tq{0-ZPg-(#z{hgK^`=Lq2_zNca$LX$Ex;a zn1X-@Mv)viPuSx#O16IKFfYh8JpLDeD{3e;Cl0)apnKx$+>^&>k41cY5PlLV}M~rJvR-0h*uRMn4D|Gq$%e3VL!V^{2N(E-%_grX*IN0%1n_XQhC6DRHKW0%0sd zRweX7ntD>FaetZQW3~U{7F}g9mfBaoi;{ZCDwlGrA9kfHSt09)r?(?Vd*(Mf!b%1@ zt`7wW^tmtY+NASEKY+TUT_rG43ec2#s(;o&zIv@LWbL?k=&!H(DB;JDUJM+x>_-s2A(Fkh%#~`&N%Sb&K{mW2T}*o4P!>Mr8`7GIh0^ z4sK3cuptSwxp63I`=mu%NGph~*-)>=!^EI6gvTNJGMXK7&ZELO?I0PJ3QqZs!6!kJXFTO+QAl&voM%4NSK`h|TI=6>CC;U}b5}e_OY6rLBFlYa8_&^N zvfRhjnhDz{!?hep5FN}}8MikBjqhBL@>~_uT)ThS%!#mbJDo>?!oyQs&Ogb-n^VHa z#E$ry&aDL!EIY-O-^-#HnjMf#P0H!cQ3D$c=VYSiB)XkmHapbB(PYSJ-E8R%n_J>MVNo( z+=X&MH@!Zrq+?!2JvCXenj}6e1dV7JvUcUu(`(qRbQdWx#-VJ+(=_499FN4&;MKj_ zkEl6$tkiYO$}fW28~o!zUfBefLZmEJJnE+Vxo)TQ!zX*r8(T3%x%LL|*8v10_UexI z#FD}r?_zE#x}#Cj!>9CHb8lRvkDDz9`4*jG&LNusXDNxJt0BO8EgVz#Cb8I4zS&b= zaCQHa<(;VArW?sNM+g$c;Hr;y2r(9Lo-s{{RRF8h7Nn@jNo;~Om zt$U>LdQrdi^URAlE@>Xh7!XaN9{WZPkE=xK;TN(6#iJpg=}A5wjpOmXdd`#nNyh#s zFnuxN+iX}a@TJCZpM;YS=j~r~!gmBCq!Sq>Eo>8Dn^Go9MWu8=Q zdjN&KG>AVjW{yBgVn+O%(5GI;`Y>zy+3S41)&)B3J^$@E{1hDC1L3B zHm%yVY}>kh3pcLZxpeE=y^A-m-o1SL`uz(yu;9Uj1Iz^L(5ch}Y!82QtTrM=#626P z%=)mh+mwhg{?d8*qUM=Tp#s?Q(O%2W1A#~>SbC`DhZ9K|)@d4bNR@0QEDL$)mjDZ=TJKondQ?KTxFI(epNYCTyAWcwH`#xQ6`>4worsz zL%w0?AppZ6W!Z(}knWD+xr`P?B!7@)Ln+Es2qoY8ClpcNu2c z;ZPCc_#%_TtySclJ`SaraoU;aW?d5+?F!M9#PLHXI?CT3A2!J=uUWSd;x$;F&` z>!ImTOU=EBCzf+fWRC<=Y-CFkpax**RXsLoot7SnxziS|-P9shTLS;s(Tuv;C{>&+ zx*9B6A3|AJvdS*YY_rZj3vIO0PD^dI)?ORHKWS|g9aV%6E)^;VXr{ zJxS4FN=ZnJ)`nQMa?nJJA`BPFFNrEt!wo&$kjm)FnleS_viuReHNj+$EjjP3@Pfq_ zs1vt4>#VbAt3I@qM=4nZGmi3^Wts#-^Slq}cgQzf0LcHlZoL3-JeSF33tXs( zjH~7N%7;&0Q{0Br-ImQ5c`k|M7g78*zZP!nR;iN>JXGbMFCMO_nm?2->}ru-Qcp=3 z6(Z_mii-Qb{buC1L*ULnDgftxWcSq+Z36PVixz(y;0ZZOk zSwj#QGv$>{ZrG}z1uuxf3~F$L9PFS6KZqA?txr?~QW&AOaH?^k%un~TObVq!w<{^A zdPc(t3JFybLS+vn64X$DT7|Cpi03*0dP)vOvoPA3g?|4+QPqpMvcrvhPliSUAV`># zwkAa+YYw@g!eWFN$>`68gql+TtQN4VZGliId0|G_$38E@&|xjnjhA9rM;p4)G z5&fmT)R+xP&-u#F3`9ZNd9I576VaY<^t}LJ&2ouM3s)3%ve*RjfsS;ELw*9F7LLc0 zb6i;-VZ<*iVbPR1Dk0Jyv`TcH@{V+b)ypDjH1!!vSBk78$$T`CI;A8|6B*bqZ8@tR zHe^E`0U{JvCC9cPOnY0)h#0@K$CI_Nno4tHm*7Rki$pU_3D98@yO_;CW@lmQoSV&mNiL((q7s+d+q>J@E< zQ4orCtYj^#SH8~C8X{OMNvsVtLP$%b2H8HnHFgP*)L&iA|$ zX)9jIh1~@)2XO4wrbBs(wlIlTk_nD1VGaAcm`Dt3o4gI=K4ROu8kfeHE39;1iC_t5 z_Qx$tv5$x2WADr)y8$?Ik(un;*wD7e4v}q>-*e-&{35k386!xB>yQjXS+mFG+}-x7 z+yVO#%0&&XXR2ITEU%=;FxGKKCL8}};Lb){DOs?M-Q`?0>zRum5nHx|8vp^~C_}n^ zvWTB2LP48XEkwn!n=c}j-om~;GLt9n3*aYXbF4%}#0m*~B28CkiNkGwvo|x#r2u%|$sYgwKHsRX(baX>bY1BebGg>{g|8zO{3mOn)OU=YUJX}cAaQ>7 z2P3^laHLduaw2|pf_Q5|aSY}#@n>(1=PM(mJE`}3Czk-nw-^KXfR;poj7NO-26@mS zc}ur|J~SDa*KERfS3oCs+D3ylXoEM1gE^>!9pothq8qBy96%6k?chC3)PwMW8b@dz zgacI?!DSuB5>J=}14D#D*il5}NbDyOJ3> zg&5HWkLWN`Acg-;M-+mXPk`4$kHm(YIEE~!DVf+DDpfm7#4Yg?bc6zmm}n&M;X@Rr zNQ>ANFbERN^hT7pXcp2LU3ek!#C8-BiJhX0P*IEvWNC2c5f^73k<^Ne@(>UdhW3_l zY2tYI2og%@96xwDL;+D3VTXrxh?WBcUY3rMc#IWRh_qvg%@K;| zIFFSmhGue7mzalQsBuRkj(s;2zaS}XF_0XxGFW(z(U^~kmWWkWj5Otr4_S-U$BTtPL7_ZO|Om@iS8ddZnh<(ZR7 zfRCA&Q{tDTnGvG7W_+m=sTrB3nHsA}n~jMV3*vu>X&j$PIlQ?toGB@MDVtE?o8tx& zVqq6fC7YKSL<@qPwV4-v8JK{Xm!~Nds!3K|;+yNUor1}lyNR7c@txNqopr&NoyiyD z*%$xesS$XonCw{--wB_zvzotvnI!^}!&wu)u~7Tz97pqL1U^`a4MH_ z8ZBkY9czlGd8(&-%BOCjYJCc*fl8N~U@EL*QwS=ko7tj;K_#lP5JZ}&kt(Tk*{J{C zBLR?VEu6Vlzo4mf*{Rb~sgF9Tqe`l!YN~Jfr>Cl_*}1AK)2goutFbDp4LYl`x}mj- ztGTMHyUMG*>Z{YTd^H%XeVVFuS**W`tiozv$*QNr%B;@{taE`juHh=K<4UgOYOd#suIZ|->&mX}idMJku5}5o@k+1tYNGRMuhfRGpbA;} z>aYI_umLNu)^e<)+71#xcN}C3=yw+dODzry63#lX6I-Hf5Ox)Frfy-eVP`57YZogR zsSum3+_tFHLb4v~u{fDe_RtC#Lkbd$j-P6nCHoSaumzC16gAmVEqk*XVWj^{u@o8y zqc8EZMjDx|V6!i~vs-YpF#DTKJG6v>v^~4DP5Tx>`$kafw1J_rAJMhal(ZU`v|D>U zRvVcXOSOS96ShcgL0Ys91GGv(vpx$K!*Ud13$|%XJ3Onj8iBWdYqq0PNakrC2|E~T zI~QMjv@Ux^QHvLf`#^CkxqGX%ZUMO!Cb>TwE`OV#Xp5;<;<>BIw;ETuLQA@VI~bSy zn~ZC@GJCgri@8M$w9>?ttx&pbp}I%$xuWZ`m@~DzyB2Ocxi8}!hD#XRVHW7YvOhbw z9^!JR=0Ul8oqVf5(z`5*))v<57X*nHwu`!}`@QJmy?sj;wbLBNtG54|C!W;%Mq_Ii z)VUM;A-g}z74r+Um?^olStk67UNl@*BWPQNIZsJjeJ3< z`+65xcxhh=1o{ia?K3r5ShZc!UQH;!wC_Ka&@x}j<3CV#x7<>%H&e6P> zOvX&y$A!EWlib6?xXFWj5u$8Kki3Y8Ocz=#jF5#fxzoYPQfZdgj1}xXX~oInsmj5& z%gut6b!^IlF&0w1nw9*>GVGAbOc!q~%gHjwc=#4VyvjV>$`|Gz^YlL2Y!O^+%(N4X zkiuA@G&eCa%Nc=-v0_f;3?O7+zU>^9%#6->bzDenO~Y)#wTi*dHOyuq1u%LYCCkq! zGte2kN!X&?y;*@i{gtUDN*%$KgEEmCiG8(OW?*hFVB-*oiMj?JW`S9p8ri;0I3C_#N9> zvOLXwi_)FX(aId?N6%2{W7cDkPA3tU72F^$iv~G4n8aHg^I4n)TjnJ~3kBm)cw2!o zN*Ur~U;(8eV$Xf8T`=1~YT@F-)>m($*05#5{{UbtrsNl1;%$M!O?IO^q2eiy;vT`` zXx3cHq-MS);>6W%^XkqB14jh^8X;|%HJU-~FuG&sMNKlF7Ly;=y9FQk&KCeFG7ryIR{^w{O zW){-Wv@SQc&g#Kl>S4y`w+I}CE@Z6E>0txxho$QUDJT$X>(5>jx1Hu`A+b(N>YvW! zDH-j&RPM6K7H|$*#hz5qeSpF~7jv%dIj$DU-b4CcDL?L7Hfs#!JFMC8tg zGFm+^Dl)(GZoef#FC$zpDrf&5b`KV|yF3ohQ`a%|@8oUxcaMj$+>wIz2jX=JkpLa| z6kEV{wsG}_zaJ%`QYY6XQ%@%TtdlLv_zLPuZ+8)?#T5pZ`SLOL+GvJm)b&Z%GAZZ! zK{I%F&-Z(uMH&q5!hCvy-}qj#35l>R2+Y{AU@HJg6oSN9 zF{DC5n3&{1*n8AwvsqxDv_c^m0(%M4FFQ)%93tP(%mXE?9QGe zbF%zekYQ1RWRgfB>ryY=zDyO{BKXs)6p{84Y)&!}Y=TX;egcrtZtFp|3mXzdjdFE> zoKFj8joh~8&B0?of);(&w8GK<2!|rxB%!m;B*uHf?M?dkRl6fwn!KBM`pWBCV?SgG zF-gpf-vbkjTAd)(#vrp_&1qBN_oqOAF%@6i=xgl&WE1TEuztt?3M%g*^dPb*wa3}iFRRvOC@s8)DXF~}i{RA{5|0+25NC?5h!tNxzks73Oo zQw*q(cJk~hhHPZXJfCg@ZpNEvW2(J0vouJo@9={WIk6x@QN<6}dy&gHX*3MK8}B-7 zP#k5HQ#Hg?OVmH`n2HMjxwFbTF3irJ0!ad@>P&#FNyQ}XqvUk5XvU(pxU{oOt&`xs zl0ZrTh@Hd&mCj0Q1Bx;i-6ROf0NNOJ&bVZSFsCS0GZV+}+_QzM-^xVvE)hR1s6^|Q zH57nG3(cs&3=e%M)Z<=dku+NCtg0YSziT$JRmId4-H>eUuus0c15d{!d(@N7zW$6+ zA(&G8*F>2F&X-_2Ws=sqNBat}wuvE4_Cz($O&~vn{Q`3nfA2ka;rAkSN#Tbcb`;IB z8fMB^_A*Ww-!?a{ty&V*RN31#7mazpj>NqWPdnSK*F^Oa7|qimODYC27uR$ zc3l$cUn3QJE7e^jh1c(lO#O5SYwv4xg?x_vcGL+1l65If4nX&U&fZFS4x4xWdFZ2; zetPPwe-Kc(rBEzlo-=B&&4s&PYP$en0t#w|z|`sDgj?BOCA-v5V7&BaoIghxFI~Uv z)Q0cePXArSR|J8HO#lUwEi@)4!DGt!-c~-H`07@rgBZ(>_qKLOfg-jGz@#A3J<~nq zR9bQfzfyMpCXaj%BG>~RK^*uL^U=mB1dJf@KnR-$#*lcna9`K@vJu3Xa7_#}$!l8C zw}JrCg;JZ1PNYDY7s-f-Ix2`gc&DBO=4c~qQR0z|M;`#lEq|o5O5$WR9{6-ngSrAh z$X-ap^CgcZ19{gQAsEN(Z7(x8gkcS7*hf4*J(+7$hI!NET^SG621%i~u>nPs*e{Jmjg*z9YtxiP4=+Y)npF!V(Uet`)7YMLU`r zo-kgIn=aWYQ<>`1r~)XfD?t-dp|Y`0KiwjQV}9L@|$7wDxJF^up_LM>uakRJmdwCMH0~ET#2|6 zrrkBTd1YWuP&=Z;A*-**Z6k5hRHW2S31eppS;D;fKf085C9Lz@L~}-$xp+jo7<-D| zG`7pTc(-g~g~;!O=cb|Hh$iLrl{;nI7ZI%!hsXVE>C$Hr^B8xz{q5O|P$%H%(nz@p zt}Y)nv^e!*_q;80PiQgLvGKx)yE4;?Ti<$Ee?4{!kp-%6r8?Y)(8OR0p)D{`3{KPX zSG8L~5n^jo;|Ak+wlcM^%kJ4)t^9%}jqQtv|3zK<7+FR#Hly2C>=&urceOJA-HMXW z6$1lG5s9#E#jAu)0^p4;ZgDW9VK}eS;whKZ zu`I!CXDb9@KGP&tzA7LM{YE%O+m6#8^|VKj!V(}HSRh`OE|?<&lS2axafk-q>gLQc z6Zgf8q?l{6)wN|^x>s~xbP2G7y-sNln}NEGuX+A~!*5!-$dzVmxy^lUbf;V0wF#va zb+QRk45pzSc_^`_Es={Xr9Y?g7fb^Ekxc+Q*Q`+*!yLlzmX+inartxqIqi%h)SaqS zbKIOfRlFDJ7;Gb9)-t{s69AvN`^j29sgK?LZ`qLo-@NK)Wa=H(djsX;{b`TP^{w9z zd;I2L2{^7fE*F6ii4^`8B(d$il1a`{=tO@f$2Z<4bA4~9{Gm}kmrho#Mk#9smSfbj zbHyyXq{$byImjt^>yXtv-)47VPC!Ejd9S(bG_T3r_3KRyjnwKxV!8_NJ291!l!$&0 zdkP2Eik{neC!v z^FOEedelDib?WHNBtKW_ML&53k$x-g22H#vj>F6I(mv*+l}>>FkgSoq&=#Z^dh7s? zABh)QD>H-&uDEWWkU}W>M%w$(r_*K_jeM*q&ym~V9ru?u-af))zF836a@7oGnp%0h zgE~__ATR`n3>+!p#UJ_G%LvmOnu((}2+=#GOd7FqKerH^D-?C^gv+Kmk>0W5rn`O^d9wV zJ@Q*OAN)Ze3_>Byh;Qq#^M|1ufo$RpaMice2C9#7*!lYB$SRnB*ZnOp*|c#NGYrd*|ckmvg~M)r<)TDqr}?V zr5<#`KAXbcF+>SzxrWP#jhI6yBbjHMK3WXKD%?Yeu)>buMmdxVIP|e-gb+&lr7CMY zZ#+l3ctu03##0K%CmTmfqYF;MLu#@sCA3BSz(olGzn~E{gQ&x-3dV9m7&4%WGhw}d z05`HlNRt>wS+kRwBollbLw2MP-f5!tf)tATpP* z3lC{352-Gfl8(_zx+KU=r_wVj^oZU}6N;$+ul4XM+!UtaoIRJYOW2akxAB#n*v!SK z6Dg>*!a+W~c`wXlm_=bt@SMabu}ktCweXb9)@;fRLBQa2&fVcJ-Al`k5YWg-&&qrd+w?5%5KOFqPy$^O?Ci{o_)O9WO^*0&Yl#K*8tL%a!UP-(YlN(_AE~gG)ItAQt5;$ zp`tShsTlGZJ5*f1UZXKVm8U}0mqSHT$h%F{^i8oAjGjq>Nch z#|zTMj&N09fmMcqP*!BsRKlTNWE%4UOk0f-CCe=d+5({I*1B>-aSMQdAXkEb)(wl* zQES&~y;V6&C256?TwT}VfzEmLh<}(=`fL$L>xcomr7P_f-jbPF<5hN@5NQio#Uu@j zK$u$#Hfc;Tw0uH6>k3n9Ye- zlbL=kSdN6*AbXsGm=7tqSEf`J7PB)qveqO^Rahg#24yj#O|+bgJfi*B{|VVDT3UMz zjBk5Xbv+TE{Wg~1S)Zl4X|{QXq^?O*@>-v|jM zm@p6ZC@Nu#B$9c#A#F-^;+09^6;nOJ1Evnwuo?B}k>zrT2X-N*yI>az(=_444Rkp! z8^B~$Bv(Aej#wleiMUDghy|W4jGGh5g5e2Pk2yg!Q0pQ@k;KPS;0Z3C1~#1`-X?4- zsTM9L^GKfwOsEuIF$Qd%zzDome2K8zh~rd`APPWI9hCpex^Y2Nk~&Tno8fVLF&1_& zJ1n04NMl4BVCgXbK_vbiHzp!xl_LYRjgAo_pf%(A{HXUkD5QnrUsPcPPQN9ljSWU! z2^K!4s5cze!5aQY;e%vHj^SY|;vPoi3O=Dl0kBS{;6Z^JiS$mW4(${ z0_9QmWFJu2aKDZKoW>6ZKV1}S!CdQZ3=DQS>mHIJ5>z0y&31)oc z0Nq{KQKr%G&W?#cZriQ*x1<|jVnDZSBiE~7byz;gCVpaDVg zvOzI+6iMv=sNGE;h}Kv8q?kN5&PZLS7GyN76XTPH6<#(xwFF?8j%k_p!8S;aO*t|#*>#d;b(dcTi*ueD&6)BK_ZFab-b{zFc7cm(Pqec#-F6x^e>ZFb&(r9Y9c0Ux8>Y+gkt)bkdsE3EdaKF3ytb?BG4Y1!j7Q0-YU{Y3RO-q1^lvR2-|Uv~f@|!J z-EYRes}%$Aolb6+SZ=Y9>?6xuEt|hzm~JN;v4Z$(?#`+LcbAO0&h7l_zF3_1!tnu@ ziHUS<`!I5R6U^CO<4Nr9pD?xCWN{GR8WlnAo^}rpH*dcor^o>EdU+1#7EB|ZL`3BO z^8PL&kPc{wv5Fn{K>lrupxo{z@{alJ zl1q)EWQrIM^WwJg12?TG0ZWc+SQE!qCNCT(0u$MAm%RoJ_>Bx+9h|Q`;!hV}CU5nd zfb*FhpfShrncj6?@AY*%$zW^rXB(5J=@?)?G>ka*EsKlc@w9`O5x&5;4t-cv*Aw~S zaIsjsh)|!8D==-ZqTjx!w|1fFO7F(NY^8}P15qEv^&V~~3tuAJ)oJA*bvTNhcT#dJ zganP_eD=9WmS(ruUQG60%#MIxcW4J|ZqMd-b9ZPb_sY0-my>veC$$I+ZGxNsk=D+U zYbz{iuiP0=%OSlVc&B)43^uM3AiBNJqO~A@|8`iWp}2VYZr|=LBle6Bua{c*NXnws zy3E>W#bBdy_1XBxwDa81AeVXhf=bh?Q1*w9_)glSnRs_Td(6$u zgEu_72i)6gc(4!lxkq~hzj>gcdD|)c)z%{z4!aaw;$PndYz}Cip}PI@44WidHQ+(O?&nT-Omoz z_edjhlgq#Pe>LPHy7%apdvUko-e<*LBzlbxj6Kbpr2qWDxA;BJZc88b$mjX5ht!HT zX`5xVO0{&wPf+=3W5CbFW4>JV|K3S-R)3v3fCwOPAQ=E;1|kfw2>`=}4W%Ho1t7tu zgbN)ygqUz6$BrI9f($8gB*~H{PohkzawW@_E?>foiPB!HcD7{3wAJpHN1ZoQ`s}$= z=ueJ1dEy*-w4=SEAAi{cIy5O&giS%(idwbh(vCV;ekH0hE7GJ{tJ-7eG(al=5(HlL zYOn0px*sJ0Amw!`%B~w}+7wDRVc3ll6KLg_1VF{AWKU{EDuuEC-IGE0uC1)OvR})A zrDh&@c{Aydqj7dFt=c5u&;nDhX6ib!z{!mfLQS~^BhK9ofheY|GI!6pvIUX?pmB5S zl#6deb}icY>gTbqm$dGfdP&*=Y?p4n7dv^8r!_B5T>c~w0P5Gnk1u~d{rdLrRA|Ztha@e7VAA%SnfEHq? zVN9*GvfzR^p{U}91DRM}TLt7bI1M5#!YBDxV7No?`x7J7Yz zsg{qDBr05W9hsD=9&IsM0!e_{9iy|-iXEwDuIgW_6TuoPb1pqDtyYJpdZn*H$ z+mXEW;;W>)`9?YKy!-+ju)qToT(H3hBb>0p3p3oX!w*9ovBVQoT(QL$W1O+Z8*|*T z#~*_nvdANoT(Ze0qnxtJE3@3P%P&`^EzC31tnk18TJGD@zBwPvbIoVo?5)oU2VL5| zstqk)(uOWsG*wGO=`=`E|GW{^2|+EN%vE#Uwbx(&yfxTk^J|L~2kF>~6wr~~w%d1- z(yFvHmPCrQb2F^n+k5lfx8EaWZ3`)`#Vth}TMI5-;wiPW#TH~p+D6tGmww#1X(dMgE zW3D;sVs}*d>$1~c+Kgrv@8UqS?=GE4v7@wDI~=vLy3CC~?s==VCj>t08#TVk`3Y%{ z(=QmI9pCdRMSnWystkJ5Z!^#C+=i(I4+n7puDMF95Vd8~~G-z>p|!QQZq) zY!(+06=^Pm2UH;L@K+KGipE74++ax3x4yb{FeS~i+6p(az|bY|g)yn$f*|xhhr~}l z1pxpMUUd>O^sqg^sZd^662Z|~?^+B=z*ag}J_Dv`eJ#@9@&wX9W3^~^Rbtrq)-z$r^+XM4=8@l|jv8%y)XlodKGq zLk?&QOY$=zQORc~ml#r*2-A;n`DQrdvk;7yWFn`sl|TvtQ>+N`jS!^@sWu^jSdmeW zgG|Ud8&Z^_szo#x-Dm)iI#idaQ3~J`j%vm^5MnM9B^5m*SG(%9c1Va#(-X*Il0b&W zF(iTR0_!T#7go2N#6l<<5EDiJDxoimWHDzWMIaNC1d5Ph6SzBJfbP1HvYyp9#^O-` z*eX_;v?H(*8mvdMb||^Fg0B1{t8!A*S9?V$NCG*OUOjtHlIWEbe7z@9{;EE~st-~- zo8IpRLelI27PgSP8baKKShR{Z0A*F}XSs-w^b979N0S}XtQeB?^mb~RiR>mOt3IXX zHmsz`nm`y^E_Oi6-S&9-)tiDk(41hNnykhiYxI#qcQ$cRBJ8 z1LIY|7xrsz2|SSDK3UFomWh@(!ex~B%fAQ-Ka}DN`8$n=<<^%T`HT5EAJ~PMSuIhBBE=GN5CR zIwgtvHhyefzGWBxB;4GKHA&L_mt2qd-Jg!pwRK79!VXd^F*0yb7<*fpEF_VdA-AU4 zO_FJIWYr$2Hc2*})osJ*)DWC?R{0(A2kz$8A_+FEL!8*43i{7ye)0dtn%6Y{^+|Tq&w$rw zH!TNAkm1wklbAf)ihTLa8>H}rARHlK-#WM9GIoGdwKN1r2(2Nr^OY|;?sC@{5D&uf zkqY#x&G0a zCD6kp#Il$Fg|8zJU)}hD3_du_ZX#T;hjoY}t&zpIKJBJC{zRa&sjvqBn7!OWJ3KE>LsFk2W%2#1-m$v&vS`9&YHg;U+{p%lQ6eBMUfkdG%ePuy=6_}>}NmBdS7$>?cB8ze!9k%Bxi zU-UiS{{0T#omlVfpW)$&$MM;L8AkXeABJ?^`mM!OnN@}~#`Ue=t7zYh%-{EsMDcw@ z(MQU{iV9jZhE$QVqh4Iw%d@Z4YY#mWNq+DCk$^VQTA#zb|s zSDXCAU-3`&QP_WV-sgp$Kp>vvP0#+xjwue>7-FFnp<+^enNe`y_S8sO8c4_qMQ(&RZsSH6BrqbQg9PNpL1R{Jn7=U0g{YONQi2 zmL**JTp&FpZ_>zG-Xw&yMR&&KM+By17Gr=4D8+o?*5S@2*(UB4Ah5NfkA3AiUIdRh zXhVQrbS$7RwZ&U4l2b$|6nf=>ex-?g6n+(`=6xEh)zL>uoT_Qydr2r^B-sR#rihwV zmCe$7T!ihxh2TiYa%AX0Rj7DZ{f z7;=`AF2)84ny~fWmIk1fu4n-8iWEe}dvxhQRN-Lq;yM20#An1sS8Fjf+Yu1YOdc3R|q29RS=+muO3gS_Q7oX01jlYw+k4%Epye8njABCLsa;Hd-i7sjvd5w9*e{ zTw8%Sn;;gGM#!l=s;aPQXoWh7sZwZWSZR+sERcp`yCLSKz6QQ(>ZwJZr@m_dCQ8C` z-k7qAwZ7YA>-N*z^*W#vBGyZSabO-?Hh9fu6ixif^Fm_kM)&CWM4!VdzYu`+kJ= za&1UVuSp0~E8*oTNecW<9;{_Av3V`@;%_ynq_NzlJ*Y=`{qEZmCR194{-P{O5a(Dl z@Kfoo-kw~8Ip-X{Zaz}&cTS{oTu5?kkXZKa0LvTmHf`D_?^D6>+U6eMdL{DGFxtIQ ztMP8B<=g{fB;h(Q@gD9-*e|%cY!WN+w`2{+{laAbaLOj!5v6`+N33K08iZc)gqXqL z1ded`gkO7YN{Ib#7thynKr!yzkvm!*_g=9}Y@X=lT^QP<7L)1d&e#aIvG`h%UZDgS zUy>Ln;9vZ? zm;_NE-4v*pW#}hsGD*a7m;4?j#UUfP+JY4+3wuO+a6}y|#}-%P9g(6gO93xiQ6x`s zYud4x>2eYXbKh35OCT&J?-(Nm+wT-^a2c z0P`|WE)qYNXmRh5r9|fKu`SCEF;8+j-!V}CwA9AI-1XvyAOCSbi!v6UUohvh61IvZ zBXk)57df}_Hi*GU`y zvNhOU$ttgFFL4r8b23$Q^mKA>!aYRyN+uMW#D1cq#zh5TLxwpj2c$?uh)IeB!$m4F z<8wZzgxRb}&5@7w+Fkoo7&e+9k=$he++`I9$ozyhM(}U<;_+a*#_R?c$DP)Nigwky zBUT|Wr@Y5$C81#}5gw>gL^*AUCSj6>>)fX%6p8sIWb8Q#My- zUvHm!koI1mHXoOYTSUcNpNd<@v$n?32-hG-68B&;V6W!2_$D@EGANn&wyXj71a|gX z2exx-i;A8mB*NTejGAHxbb)Jg4a-q<1E^+ywz$EyRfrln8hBA2b}ok<^3Wzo+@^7& zQ&ed8jQsRlC89hkD@Rc7OL(|Zh8xL0fWma9vFuBNGl2G1`<)m8c$3{>OfhTkJV^_-AQ*Z5U4o-uzCJ@^ox+2s{~K@NmYwAD4-G5r$wxj zhvAvW@;)kanKjp7%F~Ts(w`6JMZ&qCz4@H8S)AiWqu0}&&(1RaLLx`kQ)s#zlX|6Z z)|U%6rh`PGw^CNXI-0siav3`FHN~x$HkmR}&L9_HAH<6m=thbjuHSk{+)FE)_baAa zoj*?e3}lg109GE?fFaILR}=IjVWx|noc~#YT6<$H+ne!F65R`*L;BLbT7{3gNAN^} zBD}MUM7H01z>9ljSw$fIVynh#S^z<4Jn`5K&BM>Cp?JK(N4vybe8cnmoP(Bgb;Qat z4G+-;6t6|ZNBY7qlD}}e5jV5F#gCKxpykZ>D^bX&zmbcDRj$x$xqs*AwwZGc{p74k zat1n}s%Rl2gsMBQv_?HTwgu$m#d|x~PIvP7+WGqqF{{UXAr1!3i><$_1iBM@Runo< z*HN~=`zXgdR)0I1(>Iq3{@|kt%wq10y@<3tP-agps}u{;`P?k~n8pdF;_u^&z_v$8 z*g{Z#T^+u;?Gr}-kO||vgm%js-amUW4K7E@c|<+_g4t8&%6#sf`BJQ2kdRa}w97F~StKm%!eDI%nPDJUWS4zegagLq6S z$K|a5!_5{Tz8mPI1SHF>#~=+_N`fU5a?K(oD`PFmB{eFkBN_*i2!I<4x-r5XWfU<1 z2an3Gp&oUjYM~;J{L-P=fUGMgGHa6v2sIvY5S(6^2Nt z#Ow_Dg6sjwq3qKoAN##Kov3>og$iCg;*m1G#;0=MJ$mOoBwizjc-L4)qvMKOuy;L; zr6~c;OF{zWVh{5{WJwZvN-GekKn9BMf#O4-`M$D2^JhX7<>7QME+>-{fA%>s)7bs|9wRR=LIBv4`8@;w4>Z-&B?pS863LI_rv(X4EDM%9w(z1G^JZAJhxk{akQdf37NH0U#3Qe|9THSnKH)H8c-RX{% zyF8#d71%&*&LuS|0pzWo_!I;>ri4tyVe?A(l#V1oiME_eLQq&su4GIi5X;Ry5f~E5 zfa!&G6BQi;FuqAbkcM+44=GBSzu_b_igVEjjdE1ciq?~!+>6m2(@B^SVp1|5grQ86 zGEO||utDYf;M78@lX;d;rG(_-AyE=Mhb*!-L9EJQh}u#!<*=Clx0C8rsajR5UKOiZ z)#_HcdZDU?W-u15O3Dt>j^eLHa5MVa>5ls^x4r2Wvd?U2lhw1(1j2nb!2CIo)Ybe;U-Gp4~6H+*8+G+0>}kkgD%y zi&T3vC8UP6sOQ3Jt=hV*u3j~Y+M#QC`kK9^hVZQaF%(2ocgWZ!DqLeL3haXoEy?+OH02@Bl;65<&ZqCY6k|UDRuBtIpaXN;j=7B?!TaroHQ z8J>2K@9MTWK6c4_T=B8H{8kg`%*M-(@-Id_%1!K|&BG}4aDVofUkASh(pd1Zm;LN% zUwhlbZtboEe7m)pd$RAoAihVD@NbVH;;Zg^Yu|(fTuZY}SoZkG&k*prB7GJ`pF`GX zk;FYj{evW*E8RyX{L&<^uZ4_l`lB!K?7$`*oZ4+oJDL#-90fcc_g zL=G_#9j_3lDosT05v#Bj{BRO4QAF^tExHVXNMQ@M;19Xt%66#B#14X5;S>MR=k^aT zR`JHe__( zNBj~%P+GAUn=wS}AsIW77*~Ylnjq9cghJ$MGGd zr5y!}73GdB)GO{zq#JiI8!LhwdvQm~k>mtYeEJbXN--C0QDgqm7Z1`H<1sfz5p6mOWt4$-jj3a-JJBINi|HvXy5+bp2B{9-R9`YnTBpk`H^Xg(Y zl2Ai}L`ROO7r%n=Hld*i4t7pYBA;#WQqmuN@*rkW=#I=nSTZIp&J;_8jFgQOgk>hJ z5lKeU9b+;p&(T9ntSay^b@s9DkWwm_k}HvI6K#eh(Ssp>u886i)_BqvrxNq9Eh2tm zBzLZEU<}ja(9$I74AxA#t zhR6asHuL{b#Z!=_Gcm-#gyrR=Bg^2=EwU^%4PrIdW+2witjGc<#Kfp@YVCG&%|K+a ztb+X@LKAauypTpWaR{g80@2cDw3PEVt53^t(>g+fkNj_pq`>#YOn208?LfmSA`?61 z2|DS>Hp>$)4?_AjK?b~`9~46}byGhTG*Puin+`~W%riL?DLfP5 z@H8cqbVN-QM`=}_MwO8+^)&cYJ<~%L!74qw&sSfBLT#c!b0bG3@IKunP5kf>(*!SV zK{?&TTH{RrZfN4?sN%g`B{OxxNdDuWy45odVqBkdB7UxamINej;t*9Rc%-#|iWP01 z4=IKxT=|UrT45~2Ya+VrUoWI<8U$YZ=a14v3fOgt2qF@nPhXvJJ0behI3}ypwR@Qvz)K;7_H#o!3`qf+c)m&XkW2ZG; z%GF=bl{Rb^Xoti^=7HT))pBm*_MeYHWU_wklv& zJ7jdL{FG*>jB7ALTGBD9xuLic5<_sFi7c(eEUwzqt{ z_k6!scf%JVsuy+rwsjM>c_BAw&Go(Fw-s%-Udr-ODaU0;cjc1TV>-74t40dUB}{eX zU0Nc`5LkgJqCILyNhTSCxoHIW0qHT)dWPgCR|2lN-4Mh zf(1j2TG%OHI7UM_04SAk;MCIIMizMvhckqR zxS}{TL|E;tgAwkE>r8X{C5r=~ivdVhK_qrpgo*LR9Cd_pc}6B6n1Xc}va1j`4z#U-W-D*pOlN zk>}!(GZ~GKERd(hhE2kaq2iD!#6eSMj0YKtGh}Q$Es|*_%O1Iv0nLONb(FaRl~JW6 zV%gI^m>_<5Cc?N-Y}l7aWQ!aC|TmPm}Q3-r%4X*v;sQto(d}xL{C`KESlz`UeQ)V)iwiQ%d4~b^@AI zx}w#?I3$U%_c*aN`k~#V^h)G-5v;B?=686OD6|Bq{gph<+Viy9ukgt?e5x&S`rv{` zOcWaDD(a>I1fk;?wNHb!&xE2UV%yRL4FCE|Xqq;X872;}ilf&>!}k)<6wo)53I zbECE$QMG&9r6+k%V!NR+>cq-OxxG;+pt@5^`9Nm-w4<7$TAHH=wCK#crY{m}^)8;4 zP$(+})xuM4%`2dODr(kvUnD+0zzyD>VO!C^&r>Oz5jf=6N;FTJ}nK3ljWNx67h9--IB zP-tN8IwiCmfEN3PT}G0YTe`43;JBP!!X=C@!^w!osvR7*1zOB;n!Gn^yMr6fXW5Z( zLoDrwzEkGo_S#lH<-q+yCYI!XB4pJ_486w}D@?7&Gg*C@Wt~EvqKe`O%T!r2 z9+)Y1{WE*LPruL10Sz}mLM_r{M8dh%ovAML?xkCdK$5HfdjA2}Yxrp}7@Uwr%TJ=C z{qlXgJu{%4Dh}uM{35FX?aRR3E^P*H63A(?-BsvWy?)`?bt2yJ=_Ou{c=l=h^lOpE z0%G<(RyBs7$Zu8u{dxkPPQ2t7jG{`Q-H!}@n7JaH@mb?=qSZ&1k2M(0+5EhW!)2rPL`vSNNVo{zM*|Y2E4WjBZMCB)EqIA6~F&T#p*d(%E>bnhQkDhR+ z{_CS&LYtmB;r?u|{^Lu7+soAMDKd7!BbYzrwMl6>dcBt(n+Ggzv{fa43F=PXI4K(7&Z@@uKTx14$~MLnHz> zmP+HFv)`Co+Ck{yOR52>=vXc(p$zxF2T_KjvFP^=*0mxdY$lqQi9-wc>VHCppfvv!xC+^LTXoQtBeXa0jR0aB4e^$9d1Osx#wj7 zdA%mqyVx@3iFMyjbm+8|gwzyIx2;T3GG*B}lb%cfSz+vnH#LUL$k{mRt;Zz>2TWWd z^Mv*?j&{ylp~-^3drx*K`)fw2*_BHqX^W!FEvC;alpi4d_Jjiq+Oo%gJ%IKTr3VvY z>LmwXeIzwUpM7MBHjzN(sRTez0xD$CeY6E&{~K;#Wn`2@s}c5D02Totm_wUb_#A5) zjrg4u;SrdZh%zeHVpawL2wGQ~rHD~f*lA}~X&TZe6M*kc#GZRJ#RsHVzCpBAQCZEk zTZCd+IZ>3|m37r!E7F)1m11SM;a0klrKLh<-j=0DF)s9+Jz|DM21@|6vE!N)k(pJR zWAQnWpQ?q~8kFO8`4yK~N=Ay5t^qLHb7w|+C0Tpjr&W&>8M%^o10hM1is-!-)?OTP z)a5`Qiq+SSI6j%4b+QVn;XtF2a$TTb(&d&`j%IWgTEp5{SaGn<_oPWc(8?Ku2|<<8 zP1Sh`9(h&vnrvj7kvQs2#d1p8fv2Uq|CM8b2_;;9kWDunvLv?isJ8C1yX~d`_(*H1 z>b>WrR7VckTtZ7u8zcY&%BktSY`5+9+Y0>?7PzsV1jO1$ zZIX6w+VU-Pw0eWtiaj}1SRxQxY?2eazz&4C;tvxYK;ap|ba>*6gXxxz0n&G?dbU9N zc1E1vI${8t{Y}w@lNV*GMCpnB|8d|gzvZ)5vC~ES>MiLQ+ZLo`4%_aE4V?N!nwe`H z@khA@JV_>2^lAX@xHCQ7ugxaY~o9w{6?rctuW*v+e?VJ{01H7iG^-;dkFTxg2S;XM}rjE z3ktm=z*`YeA-N+<57jlmvAl34MbpRw6DX;%{6aI48_N=dn6IrQQH$Z5h!Dk6K?pjr zcVu~C61Jzt9iB~gMZ8^B|GqdoH+ID!KuACy^O!1WQN$jcb02F=*u@$t#E#H;lKw^{ z5|^20Yi?UjLef?;@L^>y#tS16H3>L7sxgLJyd31J#Wp}nM3A15NcHrUJgAUTVkd#( zpEwCCyO?Ao&GVoirDHx?>Te~O%i`~XCrsxNGkPFuN!o@9J;rTomz^=7`miEG@NuSu z$wZ+bd3n0~g$#`}{FpJD`4k)8F_!4;)PJ^;KW;G+Th}`yI!~g`7$&5h(R`<(Fo-5! zc4dpO>>k0S2t;1C@Q+uq2z>H&yEgQ#h;qsc07q0J5R$N4mYmuC;91d(N`!rVddre_ zX-YOdt(r3IRV7nO|IJ<&Yn#6EU_=!nO%B@hra0Y-+;|v9gCt-JWMGIrxdPDo-0Gmb z+k~*J<}sNV#b(1IA9e!Z)W-DcgiDoBPpVpJ?p;r?5qZ*qS#*}YUHENj&) zQ%<5Ii@dgPb~VWn4f{G3!Bq;f#m);kht;^MgeL@=tWXJbT-i1kxmx8S-q<$7@}cIm zUM=6Sxa#!}QsE0T zySnu&J_YJ@LP_8YnHaC z#fl{DabVoJ*1{u(-Cc{tRj9rVkT}+{c)0=|>WTSnOcZvL=p6pA{q1d(F@^xB_o#kBUU{&RDphZLLto8(_oMH_%s}%Af~n zWimcw{|iz8by!U%~35kd6b6b%x@R=JxJ^xmR#L+OG&5DpmOfL@AOwL>76T<@pCpOJ4HiK;3CN z|DC$BU}9H#E6clA?~2e#jy{6qapOPY`pI10Eun`-g>plA0OZ!Cju24p75{P4i->oX zY_0DuGqqNn-W6zq9i6rdxOnA8wttw!Y*JSt)xAy@Zx*kg2X~vnz0&loAae7QWDUht zf~7xm1$%5KpxiocVa1n^k(EwlzjY{jg_no$K2geciRyYW;x*`Uy0sE}FA>w9>LfLx zdlG2Q`K#bw>NNfm)ei(;=xZ_Cm;Ye51H+w^Lo(C%$XmyBJaIV*Lt;0EwClQe+ zRp}*iq32Now}FNwf-jaQSob4CMRp}(b_D@{9jGTCRYkNigpyWvdUS+LmoLD_OA(lZ zvvh@9QFG2$dnreNJcwUkq8WLVSOVA`3bZ6HI8T*vf0M@*MHq!>cX;yWbFYSRQm}dv zbQ4lxfU#r`E;xI6Sbr@ThLo2=9rj~|mWDHyZ;tqgIkhG!lR~=(7qlcOT!BSmlS(rs z5iF62$;2U_s6L9siQ6}d?I(OJ0*am?WXUp#T9SZSp^5qAd#Z?F9+3o6|KJcn5NgFo zD7AEp&Gt>WQDsnZW@FJ8nD`ZwIEl>$iZ8Pt(l}R7SZ||c7Pin1(?~ulmlfjoizyO7 z>r+MGl8w^{8k0yr=h8*f<5Ro1i!0%a$G0}LC_OBfa9mi5ebJ1{QIFmN68^}EKY~*= zR*u>TNFNf57?mPJpxQzE=ku)WYU9lzssbmx>Pw&W!@@ON_$Q5hC z5Fr_lb~Y)R;vgNFeO(bcO#&L2_>o!h7bPhdoMe+>@sh~`jIN@Q_@Rn8iG3;Aivv@X zaFZ#`heGMG1sh=x@y3vqhFb2&6{wOG>Ub|o<~CNzgyo2kfn`WV|K}w*m}Iwjl0+5& zsJJap8I=WNk*?GZOT&zf2#YTECb|-i099iOxsqVQAzGJ_XqjY^H;iyokO?K03HeY9 zIb#i}B-QwrKbe*;)|IQamapcFCZ#D`2{+rfnT>c#jrf^akzp?bD;QZo(B+c`lb6y{ z69Cjjx05`Baynxqj#4mLy;pnVQxonVB_j ztPzed35nR5odp;^Qgcr;Mkh_yPpT7H;HfDnHBE~6Z3I}J@i#CZ_f&$r998#dlqA5bsb@usu9jY<17M&b}6(>3-*O?H4r$4trZl!&fW~8m1V!dt1b$U@}A!swqB-PG^yzf3%?DDVYZvRd`A(BB~s2 zieF)s1eN$toHV9436yb~r?CR3ewLv_%2EN+rz)Z;YPzT@<}_+&srR{x6fvi(&s24uz8X;zii=0|d?DT}Yim9;luR<8Gr8BUG zI7?*;tQ`1F_*$dAdWb!ENoaRF;Hok^I)k;S6~>32i=w06@}h*vC!6Ne|s_+ zYoAydd)_I2$ssfbfn7@K9Ds?UY~_Ol@{o<0wg7iqMiDiVhAS!L6sub+X|)&SakyeT zwO%u|#EzYaqUNL{>s&n9C%IJ3Sp?s1nAuXZo7WdpeGLl@x0< zxXUqw3p;H4A*YKL`Pn?!TU6mYxOqjpl6z~~i(&tflj)HFjtX!x^Sm}Vsy|k~n)JMh z^lI&!9w#Qfh$~JkC%{*W9g2IvdPlaM|8`fXYr8~iwyM^FrFv+e11f1%yrYLtNjhZa zvUCxQy+fH5B@(R%%ec~7AK+@YPdUB5Qn!QVxCggINsF|YG?Bdva7<{o#}>GXbc`uQ zvc6Zlz!+I2JaT;ja-*r3&G{8I>}Ss9Z*of{{`ORJJHXB%0o!K90d~Z`OK!2-xZql6 zDV0{nOQE6_k&VS0GMvVr!^H$7z=gsgUFo%|T04d%$LB=H*=NV|ipN~RnGcJ#670rn z+`LuszvwosA$vr(^ThQbxXJX5QnSLVMVHG9$hAtj0p@=2ikufbBmh!pVT`~SMaC4G zh}3y(54p3h{K_FQ66+$%DIt@O{{uZJ#1JDQHzFYc!l4rq03#YA%Stg4!kj(XCle9? zSGR>lQUF)CsLNA$70}$6IB{GG_{=TxAubWjCvh0bkw;096kN6vNCp~8wG+5hK7!~a z*DNfvCeBPTEdTIAhT0shfG12r&YIK52k}CX(aq4zJED0N{nI!9V4I#N&69!?N-TWJ z{LtiM&ym54!9;G|4AAbp%;cm>`5^@rIC(uJ6VKeysPh+KwFNu$6Cf>T`Oz{N5zI;f z8OjV-G%Ig9kss?kvTH1|zX=v3>RrnW&&H*;7(CS4B9lpQ(Wz0>L@m_Je45p06<~;9 zAl)LNrY}xC5a8^sCWRB^{~@F-9nxP5n;HGh{xMv=Jj=d3Fbq96QsB!iV$3P=3un#M z{fr#M>=tc3BuKq)34&%mt;UD5&jpd!(h=9cOxLq?L~mUYKARkTEH;7xZo#Fpo%mJR!6HagxeSAvzbtf#<2|L)_Bg9;E!_w&TTP1*T*)jwehS3|2K8u=;EV_bx>vUd!Y*i~&g+%F zC5m1Wram0VXz7K4H#WT@l<6Isz8y)6PK>kd95S19b`^J$ADSZTIAOvQmrfe%6$5eY zJ_bfP$L^Q?9ltm%_}(gs9!pJOFqgi&1K$=anP>8q>YA4AuU?i94V9Hf?vV@Y2zKi3 z#8-wsPm`|fUy<>2Y9SU6?T@~v-Y)7F4~HDjB$LgC`*!O=O7bet=>Z=g(?0VhKkH6> z&JGUqJV_e6?oK0r==R8pDKA(iFY-7N^1~kO)xPLWj}xfQhSyo|GV$}BQS@EGlyju; z6`>UJ|2u(84)IC(=|8v$730x42kqtpNF;-q2>)VazwigapdSskFE8|0&-BY)7|tr` znGyH<4jQ)L^_L}sfZu)6Gn%+l^L-EVigA{pTRwfu^{9MuhtECiGttbh`PTmQ&Hnfg z#`VrV_YJScJudc42N-$L?IEM|9v`Y8e-fWhB3Qo_q1nBDtl^~-oJj9!bd38qt@|jR z_JoEnj!*k~Pl|Y7@trUCL{i4fkFAyFR-}&eOK2|aE&+7!5q6LE8~N??IZu%B$#<0( zgTLrtU)BSY{o7Ibe}57}Bl?px5V%h0_TM&cwQBj3M;4f7;iGB3)mIt3qw{Ly7Yw*=z? zNbB&eNisx<0=e7SGw7+9vu=*a7Vt}?N+VZn%=l{nxhyAhe5y7u%i6E!YE3vW79u5qBnoQBL=^GUPcIcy%n(5V@47L-1_|^j!XM+ivBw;b zG^xcG32KKZTa4tWomMv7@GdE-%3z&uLx z%m7FMV95ZQJQ2zN!0chRV_Pd(^mU>)h<;_C1?|(%CZmu{|Ru_bW&k6 zw1p^JrAmS*36f1J$67OdwxehvoAtVCgN60dQRxHruv`DS7A|guomNt2mnF)zVLd7q z0N*O5Q{4f>{i@vn$~7olkMM1dE@S!SNZ-gRl{O?(i%kH@U(RJ#-tJocmeaxnK9b^f zVX~Ok$N+X$zH&3w6#!l@Cb?vjPewUql~*2{LX5 zI%uJXCc5a7cJBFSpmQG37Adk^nQ5axEOcu9sy-5F7nQcUYp=fsduo?q4!dl#&qh0K zwby35ZMWZsJ8rq>rn_#t@5VcCz4zw3Z@tA#^iaRS{&VoTiWItV|HBQPl+gnXSKLN3 zX%sec_XJJb@-UIqeDNGR=hMx*L9fYc$3th_?9&@1-LKZ?dwudqSKpIJ&u_;)cingA zy?5V#2R?YKGZwyhDMp>#xT?d+oR9{$h^12S0rA$0xsh z^UwD@cJ$Y0zkT=D{{CXx9p%yV@C#QzP(Y`*#pj?~k;0cG1R(+n?tQL{O#URLzyaco z6jBIa0Fwm4El99-jZ0a6k`KUAtsbqw(iBM zR-|x+8)*j_V#bmj?od`WRAGX8xDiscfmI9{;tVZ=!XV0!|01$t;tj`0}2 zA@U?8%*jAPIm#)Ogpnd~qnKhz5GbbbjVCN*z7EN?iD$zrfVx5HHl9}rc&Anm8u?*YDk?@&IH6$Ejw+g zLiGYxBu%uOFtTV@PhwPgQgk6%y=q6`y47;#bgs#|m5 zFy#?c3nJBWa;JYnUFuVvidTygD1-0JpDxR_ROyn|J+>2T#u(}K+NER%viZ0v9X93mXrlwcrG5Eu2}B^ zeds9PS8;PhyWa<*H6S7V$@NY!LdA!M^yd@s&etkS#NWXZd9b zbFo9@g2>U23D|@Uo2VrN+r`BWYlRB+|9oVkC`8334#}NIx@SH286;)?$d0AZV-_cx z!i?sQq9I+7Kl|7qQs#0}N^EJv2)dCxUh$1QO=dCE_$Y+tGkipXX-aE4)PasMMOY1z zE`K>oh>i+X0vKmrGepft`gKqeKpF$VlO@_&^sAW^>ju~PW|eNVq?MiLBUd|Q1NF7D zeZyvgxS1umes8$NJ?`drKK93eUGe+&$f2>FDB@&Un2wZl5Qy z$VAtbuDMap)1}zEqygtn#Y5im|9>w<%5)-j089jBm`J==ET8g&-da*U{c*Z>vIm_y z9ulN1y(CFbFP#Ct@CUzK%6M9L)McKft>n34h`WE-lrYR%~?5e~qxJ0kA zLNz=ZMr4WLn+p;oi!ds}MceW8#?ZScafHSFvkN5KAt`vq0C2z&dq6lmK`-;f ziTnr;q{dVG#aG~zMRy_odgMy zdb_%Vh;%w9|FZ(8cXJq@Tsxv9H32fWEF%h1C^?gO%BT!8rZhr=stT$^FVezFsPqu3 z_&u!553rn*y>c@oO8_HGOCUfqU17?6q6n%OO3xTAkRVI7^G8A46{4uZ&nPUeR7w~z z%A!1^q@>HG46_?^%YM2_yd=D;WK2a|h%JRMTg<}bJ)Th-e0z!D zEXy0ix1g*uj>v;%#)x@miW(x2+-1yq_5)$xn#PTlDm>X zN}LRU0gV#*bj8S=PJ+-+k1)`);75vR(7LP%6JbuJaZb2Y$h-uJ+VcqOBq`Vg!S3{x zs3R%bq|b(^!{n+^pIFhE>PuzG&h@J^a|1<=_|Fby2=|-|-y?|A9EumQhh;HC5G+d+ zys6*hIS5rq2mLT8z0NujP3>gS^K{Yg%$3v>&&|Y7^Te^}BvGDZ(>CS4a_P-?0|F^P zGRe$CSqwp-i&Ii#L7}uz%)`7eyDyjwQc@e#n*39xNvHcFHeESXj*PsKSTsZR3`m{D z{}369oJ-V#lb1c^wvX^r+5=QgRV`YyGFe11rxCm@&5w}Tz+{ohEHkbhb0JrKsl40M z#B{$5Z7iDzeg1eN3B%juvM1GRgI%A zy>ix$q|f&#RDso4VZ{$*#Z#eR*$uRbI%P*zH9dG$2~PV6>9o%oT)UV}R+HG%|4>cY zt-!pKeLbvD)tepJTI8uzoz#%PIXX2$?hsmI<QBj->BMRjq@o|WQZsZ#1HllF%}fjuvC&|xi1!zJ(XV|$l@m+JrAzpf-qx{$W`tg z;)Yn^(}H2-qKX%0k<~p>*!0XWvd&)^-y`N>1o7d!+`RpCSD3KV|B)++%6L71E8nMW z!K!#p>8+|=$&dBz5aPvMsW3RDdl5R>EN~2BIX(&O^%JU?+RWW!m;lEc?&KWKO9NI8 zACBI~>*YG;5UQd%gTjQP0VH0JvS`rGL)_#^s|CPmNd{#AbVp%+}DPhGy2C-Ma>A-q;l{yeh?oi#j4` zg5c`%GB*i;%99Ay&hCg1{w7XBAs~xCQOUn8G>N_5slGmQGE=n zKF4=1Sb!Gnb^sO2-U#BM?yj2YkG{sTbdA~e>dLKd|8F*Ga$e^4c5nCk$vkY$N(Mgm zwQk2$mm5%6f_TuDrbSaC@HcBqgu_r||w>2ooo9hVy3AEGPHlnI$&M^m1`Xa=#EZh#04c z3!{oG+0*+HPK(0Y&7L_tF~XP0j|;oaC>6w8HnRvGCN7FO4-1^d>K6|E`4E%M)~BZV2%nY1S1PM-Q%Y{K)bv zr{`2bk=&Y_;&ML+YSkMniHwWg#hyzhjiDPb+!9* zOoxhJudFd&sV^yYg+g=mQu9LQ@>YNEYPa_C*;5Gha&y$vJ@?UaT~gLHz@a|SnagL< zh^KI`s&OBP0h0nk3e^OB`td|33rG0p0OlJs1t!{ z7hhxwswn6o$75Xe_D%-(hWmE{9`=Q}_?EEnB2Df4lf5SiV2Rx;y?w!umpzz9@qYhR zi=J=yb7034`IIjSHl*)-Rd?C$^n!Ph|6rf$Z%_A*AKm-dcy-tIJSlpMKTV8p&yR-+ z>XrbMkIFbT`DZW7^Zq&9oOqZfym<#XY%9ADq1`Y`0^&hklP!s)&v=i(@sKdI9T!%C z&-Vm)_l)LbQ7wDhC@eHIDJ*UKjg~I8?~u0-34+gPjKq7hmoCGP_m4PwjSzgP`1yuB zr-gr`UvPMx7mTj%#hL0iv#oi~C-9H zhC7)`ks7m|#gsmEeq^bTqs6Rh9VP+Lj^m9)(zI9r4nD}2g_M!!VP*$$7a(@Wy_Vleq|p{vMzggRAc8DO004@k0kGSG zB{FqZOrV(v+-V23co0}+9TbvDH%ZnTjiTk|pH}K!NSknP^g0X#*~CtHq=&W zwgBPQkpjIH6^0UO7XXvHvW6$EN8Y+?u(9Du(^$#!dYC}7$(d3DyZ+J@OwKadE1icH z3+%Db0wHZozQ#mh8$`8Nk)P!XBr9WA-o$2xH_qB^s=wN1>VU7h%OhL(+KMY=0*9OL zN#8nqlLSlsk`P~6MHb<*0gU-)L;OvQP{jbdtL43ISvMGt*xrj{LKuoRBe}qO%v4(< zpMB!UqRn&yX2~S#Yff`^7K2?d42xy+I>g7{3mI)g+=f{d_XTFcFyCO$jVD zSd|xNyexrP|55Aki!LK=GQxSV!rEY)4940>p%$`ytKu6JCyZ$L2|4r zp?CLv5#SU*RnfSjnHd1%af|lLt$!`LHq#D6EceU%>Rqd@ASv`_s_>qa?q-o^W$w(3 z)y-^*bHhmVRtkrn_K&))B{fa*0+={s_y(Z!#>auVy6jL9PNYCJy6QW<8~^fc-@Ex` zI#j?P-fz>+4vXQ_&O=psRD2UUwd)v*26s%_Z_eB3P=%i;?~~cfvDIKt2RzquYk76W zB(^tUeX4*4JRkxSsK5m>uz?PIAOs^QK?9OP3Q3TFgD@zC(C|zlQXoTK(B~JzRq%ot zOu_~s|7SrA3Pgi@@>_NiQxF&>Knh#P2)$mjyzAKzhjST>3jD=#SY4T6}Y5*?`ph$DOo6H#bF=8RBZv>8hnG5AE1z>p&uso@*_ z#I7LftBe#`;R#b%LKgZ4g)dy57iai2i+r&-Z7fg_tI|P>yhnVrA*6#^rbQ`Whbn-A z79^v^k%$N+B3mHcB)K>*z6^$tIF!~Lw-8Aak>P>`!C*t`vO7USr6N#Vi-&>|#JF?? zGerz!kUE$|2mK6~aWQ60bk;l4sl^_ijF~4fnV3~VPJdT<;}tW)oKTL$l3%;!N$g?8 z{}CDqi9IZ$4$YXAJ?3#NWeZ9Z)tDGIk`RwAM4>y6Xh=X7q>%Ld)grIhyni+Yn~ij% zLIeu6Fyir+!5QQf$EcqGnuwkEOrbCp>K!{e#G-w)AtFbJp*pnVM{;ilOg(WnTG0$s3gRaXA<(K-prHZ-sQx30yUvujS5$z z`XipIvaMrDB{kp5m}}a#s@oh0CA(=&6Crbgj(sd-BP-d-Qns>|y)0%KMXIdK|LZ|l znbAO!fIhnT>>-_nPfkv&m(8>z0YDgS0NPMFl~71TvrR(WT5GwJkm0s1lPzL->swbb zr?;V%mTE)$qcU2AT=oF%m%yU3Rt|)zYXNS2D3n}U5~;LegUxmYN7~nh6Nj(uigl=4 zklcE=Fb^V1cyH5M@}6$CQmCz9?2BL0?$#yxmCJj=A}93uq`+Z=7aUqg_6a`l!(LMa0^3U(3Udy@?y}M)tCXGizcShj`iz@hinzF= zh2mJm*7A$@mXp949<0;wB+h=qRKo&6uzV@HAc9DtWioE=Npw5n?7i18{~ZCsehIaq zhs-y|RlbTxvK-6ys;0(crZ7jOaNGPyIh<FZw4X3Wf27ISw6eW$U6moIJp+n1#is4j;Sv;{#QDa_nmG>b-eG0~!4jI_w}(rd_s zv}J%a)Z_u%w%zW2H@xF5 z?|IX^-k92Kqg)N^Mlq9_OxaH>=JKX?*uvkUA-KU^EpRRu{7@}H|2TOdrSOQy5;qht zalkKrDTD8|nGM&^qWUeUjMqmsBtO)|QFC&R$HX2Vw|F>P-jtUk%HM5!Q*vlNbC$Pz zsVZMM$WxA-SC2g5I!9<$x-w;cAAM&QZ^=@QC-ayysufM=$kh?Z^JZpB=q1j2Rsb$? zp>I9xl=XVZU2<~z*qgCLFL}n+zVWHky*^NPdV)sl^0IR-d3C4QK(MEDMX`MEm9o0X zsUFL#4}R{7hZN46&hy4o%J7f(%-!?;@59Tz?VkTU=tD31(UZRPrawLEDTV0Nv)-|` zXp72B48heyo(#fPAnidy3duD@nV8Cb;g;e(3F5o;#y>vt|KW{q3KgH#&Ay$ZY(a`v zkb(@>6^-<%Z~bJNZ-T&g6y>@fsqZ(6{G##wrGO8-;U~ZS?tef0<1hdD)4%@qzd!zQ zO1iM+AKnv&U`F8(yY(Ld7N7x^UI0SKWc^?KF(CXoU;`zfv>hM?R-gr5AO>cj25uk+ zc3`7yf&{D@+kB7*PL``hkTWHLYe~TMm7oj0APh!I3a(%aKGq4!-wnoJ4m!{b0s#xg zAP@$j5Dp;`7NHRyArb;$67pRVN|n}iAQRSG6h6=tW=a({Ar=*$smZ2G*AsVKk8m=K5wxJuoAsoh`9L^yf)}bBV{~;dcp&srbANHXiszvktp&$+- zAr_(`9wH(pq9QILBR1mw1)^kap(D1QBu=6wULq!PVI^iFqimvycw(oRA196?DVAbn zL86Ww3M$6L@*$8Yw$7-WUY5P$LolCZ+2V1mVph!JxjYIa>SCqPBBcOh0ktA5LIp7b zB9TY{$SjI5K1wT)AX6lxq&%acSYx74W2b22@Aaal;G&$6A1^8jHi9FknB%65w1*K9> z3smN$4ecbQpjzr>A5BspOU&d*P77A91sUJ+GJ9K;rlphUq{A_$ReB`mt>sA`rDPV6Uw-9P zCdy@I3|!I$VAf=bQRZMG%4Vv@SpJ(%MrBJ%3Ri+9S`b8C9?%G7ME4wKV4BD##1V*P z7E&taU)~<4WL0BkW>bcxY5t_8aF@i5|K?Bid0hMMP{dVdWwXo z%pwiM(&3Ggb?2e{ndA({zQvXKn5T3s4Rh&5dwi!yAcbxb1aR^fL4;?yGz_A!CrjXv zKmfsgHblDAjeH8|1Ci&y3}DjjMa%f7i9jfR4#a?p1_6CH`k3Q*=%1M?g%W)OygNUMtc9oP?XqQ6T z>*QLBcG!ABN{0rhKHejlF_6@q|HPZx+M&4CyvZk;4e10H(64DGkU~wW44{sFN-I_9 zmRKo$4ysAKCqXpiwM4|6ZVHW(SfU{5c5W)CD$u|XX+z8i3r1r`0OzL$(5W&gQ)JEb zIY>-oL~N>sKxhf8wt}mk1gw%rE0Dn^@G7rf&r-~YMA&LgKwU;y7_p*?lf2O;M5B{N zXuGhILbR%?2&=2zs+<&0sH()ZI+X#XD%;o>pG|ABLRtb)YfiNfxw@*cssy?s=UGK7 zW2kDQ$OZ)U7J?*Kmrx zPD!HpOs{6_tLjsufU9cw|7ykp>p@s+xtfT_W(>&ws=&_Dxt8p*x@)q2Uk4$pgZwDW z)@-nHtIGz=^^q*QYRbtX6wL|*`33ErwJf&oYR0Op;T#9RYL(7nEB1*i+!f4e;;L^b zY^nAr(iZF#D#jN0YS_k3tO9DpmK@lMt&H}_ZeG^0YAvA}tpX`Y&An~R@&?szY}r

    Fh* zXhoea!K5xJP-FA%hVb@{Ydr7uMlAJSpX@}pIohI6l^vQ4dY9`Dlh{D zD#}&x#w2kJk4ovrTl?;=6Q8Z&Mv8F8+l@AM$b=^v32r@{}6$q+e zLSfMDv2cRG#Dxtqg0OK+%t(G*GNdtwCcA_b0UAoY*5k;Q16n{|H8_szx7&JS(nX=<;ixUL&$N;hY#mFVbW*o+ zy0MF-w33V5jRgS}HD8c*wZcFfGjMt`OqaAFa~je~ia#gwtt_)ZZ^A>{beg=8NF=m0 zM{+}}#AhFK`NoAlld)^Rb}p*L$A!&~8IE66$$L!h)>O=FD_L&qwR=592ff-W4tG1? z|5u%k(tpy(ajONNL=nf{%k2?uOjpLTDA;yDvPCqJ8;eF(DK}SO@o)FealBLc=nK0v zQ72`GdUwuvAIWZGNN=;-d!J8m-`QR(XMKOSas~`=J`EggZYyCJcO#hu06}{j4uBhT z#<E;K2pGN8`&90pIMb!3O z+%|sSw|(Ck`Q8dBPTOcLIEU-RfhYJ}WO&RVv39HAg!4Ftzf0Nm#wW?-n;5s4)%RM= zw{vHxd1r-`m(*L&xR%W@%*b>XJ5Mgfgbv59iSDgH&#EY1xd7dsnjf`{8&a0*|3us3 zMRb2!d`riiE05uf35&C7yq@M3S5rc*_q_~yTcFXqF!+xIdQ<@MTIi|7CHk=jSwii2 z`KUMSnaIkz?wvUXS*RTO%EoJ5 zhB+I>xwPiEq;GDmw>O)luAv)-DoJ>E2YZH>-H3oUY(G1+J47<>M*wBb2gS^^k#DNs z3A;Iaqrb)*Ek)J@-hGby8<~WsU5~(y`@7VLi{l-a0kT}!!meie)^!ey0}yi{F0@)t zRe{*k)YgFn6V*iHP6qtI5pfc2tan%0t~kj_huoe75opJ+H}9 z$otLruE85hM$9}Lef-@p$wW|($8Y@ISUYuHNxJ`gQFOPu%Sz6Q^;)QK$s?3vDTrh5 z)`fWmyX?D0;9Ms?T&3QLb}Iw{vAaT;cz-*|#4Fyd!~4@XA^*Yq-f!O3zmc5KJ9UvX zOBjBpPp-%hAi`5kG9Ns33osTlmXay{$Q#i}-OtvaOW>=;#6-UQBz=idROnmSqI(c^ zJw?uHWJ!}JKehrO!Qd~05&*;m0K^tTm!wG5T&R-e&Xo+w5=#>{m^Sc1 z(Fs*1F!+z}rh>^w|6+ddSIp)LpC=@$x}a&x<^#0Ldp+jp0NW`JY+YJ{^W3gQdJ2d#5XIoHgi4uBdTQYo*Xyt+=TsK_euCfX>9?I#k^+L58n zBvP^`gyKp|K&mi25H}Dfnkz4tN?gb;4Cw;1B`=RVsIh@&JpZq<%c#_h&CDQ5ORL zl|)bU47BiMtj);>`Ll=5hf)=k%uf>lLez^0{Aj#_{&CeH6(vhck{A(v@H>dSoT)Xl zWb^1V8%Lw>Ak;{yaz7uZN^(zynw88cAjV1{TV63*uR%})DD@z9PeTvJil8)TTZPi% z5hQlmyHPt953LWbcVm@|D0@S@aawm*eaN;zQEJ%Xharww;)yA)*y4*Z&RAoT8ay@t zdx%P46Efx+m7zbpdeFIt|ovrSVOSWBh zJ0iHRHhL~gdyJ_SQuf9$)^oXoJ$|~?ptk%1~b_p z^#lS{rpQX`32m+etcW=As*bz8gD3@!Zn-}Wd1NUDGWqpfZ|4#rzBC7^UK|Uzyg9)U z&3xUWCu|%c;w4S_(}VaD(C4Nv?+ER-PFINN<|DfPpv6|+WM|m>Ji5}w8*0V;q>V-z zZ-cfs5NfQerzqa;>$h+H_wn~Qch7{jGLsFiE&o}&i1$cGz`MwfWVNHw_;SS&zSJsI zKPBIr3AT}Fr_Q5g<#yJ{Erw8uc& z6(wz8(}>s($3eg}WI=N|;Y8HuzQ9#)dNb1!1T#?)lw8mcNeQ<+JJ05g)FG$eFrNz42^h=i|9572y+ zOb3-mcM2g&GYwKUm}u^nr;BDXml+Wb{;E@1%I8fzVnZS>$~Uv5WwsDn5QVPmDtSR4P?&1X5pkqeAt6ImlMtD2D$}RxJmf=) zdMKQZ5+tN>s!VLT$%EJ_CQQ4CN&ka7$*k^Ef`Chc6jXAQwFXpy52eUY8)8zAiiEJz zq{~^Kc~Ip^Rg4A0W?^NjNu>Ibvz_(qXF(fU(TJgvwTFr!xRe~`XY3}5i3EDOx!F`h3+*6prsK%wox(o@4a#dq)6}YS%u0#q$ z6d*`}yMtkoz4#&l;y!60TWG~Eh-Qnzc<*BrX>Gf_HeJ~ARzG{CuV+dclNsGtA;wLg zRX@`X_3|mYY`kG%D5G9m2-sJWYe<1_+aIRob#)02@POM1fN>ovoC*0IdbG=3DR@^3 z8GI7y<{Fdvc2chqEDRi1-2ao*8e}k2(Jgy=0%LM+GmaY2ddsB89ECJC8c3XEEeL*t`Kz%CEFF&3paSSPHu~$+skNDI_qQQ9aVbQE7Jvu zs=OQVFOjoL-GaCiBMq8rQR??&$hsQKD|vHy1kGoW{20Li7IK4wI=C4l87t78EPUG- zksDX{*`+o2xzU|&b^ouM-FxiTHvgu%UTp!e4C&UvHu^DoYmO=C5tf3Ah8LXLW8Vn* zpgbihtrZO`T>+O?#pC{iqzaY*34P2&?)aMA1HhiRDaR)<$<_nSatidgG zP?p+88&1(mrrIul^$I{uzsNY*L-ngmAnRpyY?u>U+4Bq?03~0$NP*sVv%vcx4vag) z<4!ZLXH$w83FzLJ4K$*(X<)v!I*}3I5J;-0G6#p>OvY4npgJl{g}>;pQJ!ZulLgYWfFGQZK_r(=2W2pd-1SC#gc zpZnJ@q*jcw$a2HZki~vHB6QED>F>>V_dBFnGe=K5Y;HwVgX5%YC|r-4fN%QJ{&mbDhxiSldPLB63u9`4}_@u1wF5>T82;ZO%{7R2to-XPjt09E1-CXbm zVK4?|a0Y3xW;}*3mdQs*$kRBG$$Y5Jc(4Jp>ML}Db0PzAC{QL4!U(D7JLaU;l!pnO zs9k#SWB(dNTomG5jz{d$MtQzQGZe=@dQFpbiXonm2os7dmI~vlh}#I|3J>piLdi$c zaIzeYaTp~C7oyI%4Q%wV?uKxj&JgSx?$ZWQd9*MIxljl-$MLAAdCur78WDMVY%k=h ztd@*$P~;1ta1zUK{4R*`9zvtOO|^3E6Ol=44iPkJNy>z66^SJWSH~4MQ4j;M6zNYP zl0*F{jbJ1(38kmW5XDY(!bc=!{wT`=QIT-iB7UC93y~1uFs^?brwX|Z3$bb%`>-0< zum@pL4mmIp0nV=ekg}F(*UWJX(-0ev3vJ-gBECXoG~#;1vEj&33HPvmzHyAYk;-z- zUjN=P8?A90Bdxu>ryTV|7H?!9rEwtT&-Cb}vgnYql!q9_uvl!77cEiyCaoVEVg!K; zBEx2!=YejF^ zeVQmrq=4Q+=rx}-BL7Nb3(5^G zb+mJg6GZ3J^j!2fvy?AU1UiM3adhfS8;S~VQ#O~=uG#=bwX`oCr+L2gE%PESH&h@b zv`r0z{LTbJ1wum&VmJRx)<6^p)Y3GsM7y{%I3*&WN)P>xuRpu03oRnV;ONev^E_!R zNllZc6!cCRv>@IzOl6cJErL*cb6grzMVo{_1_M-=G)avVOp8-a>#H??>o+BCYXHR4 zvg1PclDldo+b(d7*7QatgGrBUi;_|s8R8d&HA72`H9HjXK6EpCQ&PY)=P*lFw{wSf zt}My5T+Q`d(Ur8$(!<`0mYTy(Wg-D?jy?#6uB0h2>@}H=gg4fRL8x6x)9Cax zA)2DD%tyTv%3oQCU{~bq@Rek}17uCitvVKqoQiv3R%c~`W7a5gJ7gVT8FScAr~m}YLZRs~f`VCo96Hfe2>Rv4G@_`IW;;3#oX_GBj_ zU)?qIvJm-fHqRXEU2Bg&Z}w~(H)MxGVqeyAKUY5Gb#&|M*8hIRQfmC%XmO(&P z%huO^sMlv7lba0pOyqZy7I&+jW`f7IsS-F{S-6E=_=RDZv?f@7xhOa7#srZV?CH@#iH=-3P=bS+TpZ^VK)a-d;C|D%^xm*XDTnoBl(jq_H z`FrQNp&k06Av&TZdZH=%g^}ju@~@(87?mf6OA}RpH9Dk4dZeRuFc6i*&@DMKrksVC zqr+0ASs140$fHr3q;2}9aXP1UdYi!+zjhkCen=#GdX7ee43c1Jn~C5g^_#}qd$K9J zvMu|vF*~z0d$T#avpxH>K|8cXd$dWrvHx4Sv{5^?ReQBryR}{WwP8E9WqY8_X|R#1Ge@2P4Hryv1Go#Ua`jHU*3JZL4Lxj%QpV0B~f+3!l5%#}xtq zw}1>7)^OUuaDrlapu#A!u*Mmp9sij8BcPlVj=XY0V#kTR$u}X&Ekd7tW668^7Y=93 z6JpA%oXUT^e&S3=%XTOB=FAbJt(@E@#=NRqDurFp%#FMyj6BCD!pq-pSHBY~vb-X& zJZk5B3D>jGPi@F;D+N2EJ7|f+DJG!#@6CR)3^pyVbmbME zBTil>?B(QN%JwFLWE=-vGlJ*qXyYSjtSDaO+Z-a;%i}3R>B-6BXS1#j6X6?oTz8q? zwt$Z(2Iz6b=M_TcagpIe!r%2yn!Fw5Y8G|kwGE$-mcY3lNj`YLSL}6C8X_LC!*%3w&`iL?&_!cB(xstFoN*;efN3a zq1!=teXB14ut_1}_g{Ajf&X#y0-urMi_8zZo-oBMs1=&uK5Tttus?ueb#ExdJ@A7J zhTrt=ha*~n4B&{+KO!xrzxqcLut=f%O$Q>k|NUnXB4QOt>K|0FpU}IS9svSCl3xJ| z8a#;5V3Guz$ZXou&|boc6cZ*9NT%Hu003Gk1R$jqDG3}URybcoq1L7PSqhg@8@abd_6I}_d7mE+L>VJW8-Y}2t}gqItVa>#M>#m^)| z)09n`c6h+>K=uE=7Fq;Mp~i&7xe4o3&QmDfS`Fon>IAj#Mx zj6hPfWB)>c@fbjN1#L8=Tud6dltD@&v{7C)z7_yUN7V?xjTgEHl7|0H_@L5^%=EI7DLwz3JC zbJL_c>xTzG#^(Yhu#mwn^$kPL@Pn#U)Iq-+|&QTk@`yP4%=xHu}ow<6x1^@BJ zBfq-xa_Jp_Phaaqkmm3y_40rTR~4y+Yd6_O5>Jz2Jj3(rfBEdFi_Jf<*z9x~^AE=m zl01g6gl`fk-ruN%npP-qdI@T|wM?ltgxH8CHc@J5lTaSbI^V;bx@N4c1kaBK1# z+z12UHt^77aW`sQ3Spu&6TXm!qC#EN0$30L#>6KA0UQpshP8>r&?JQu;OZd}4hJg1`2iBz6pI5*k_aMc8a20qqda0~JRV=KowU3F`7( zMmBiKn!KoN3GpCBPWQqz)h>mn`x=M(*pu+J?k)`ENGO*S!3p-RFx3;D1|4X`i7*n9 zsWh4~kBQ7=Ds!34Y^F1niL^z^?o_nW)1BUfknsdeBCAPaHxuU-Yo<|vAq#*|Y*EFN zoD({?b4oc6GM;NCWIS;J%&D+xkac$GB9*+{LVog?nzU1o6`^M~1Ny5zrBghC0aL(q zbgDM7@HTGLrZ^e;JAmdzg2nqu@e)8vgM^bt`J*T`6=oP)&J&?`s^&f6vJ$&UbcnXp z=F2AeHjjezC~9IIOUqYNmB#TRgL+J)aH_|T9tBtZW7t1OgCru_PyeW=0YE>&rASUC z@>IZL>RiSnuYrb)BzZxVSkq!pkv8mFBtJB1$_9l_idd8=-;@)+>@ib7P4kBCEFeRR$uEV%#Go;0Y-SY+Q6srDDesX8 zTd|eXEi4pHlWplr<#|vzhOo8xil;y$S=qTn_GVf#+iv06(1EE;vBAaYU~%}qi9Hde z0KJe&{H7DKA}$Hq#O%b}NR)SmXKKy87I*DRF7)^)n16|@T4l>n^xlkPLb(&7Brw%T z2DZ7!RVQMhQ`qx#YDR{2t$(wGrcw2GLUS#MRBd`!`XVf&I{(RwUn{s%;Xd`JC^_vj zFO1;~Yk0#P?y!e3JWS#4gmn``T?<2KVsdH>pYD9hW?F1Z@|O59p=9x6fN+p#+Jhs( zB;rbZ1Q8OGlg2V0-^?r&En8d!y9Pm;jX8qjiTGGDrGsI-%EuLi9B0ad({561fxmE( zEvH2+@zJrB zXw&_Kx)L!|g$fc)DjKAXgZ^{4E+S_@6NP*}dCf0SC258l`pQaHFGc?G=<~W&K1ty* zfZ5{YwcdC$cqVbI_NKlv$jHsdRc>%L6KZ;e=v-~U^zT9CWRS8;+yDWNqDlQF}2 z$T2qaTo^gJJ?o^;Rt(jxR~=&}+IjJK8Cx7M4w&&=F_l+mM8^O@0w( z47Mf2;&$(mQ`es!x)R;vF0!iY&1;lo8_e5AineX`@KpM^&Yd|o!0Xa$cMkm2qJ{}9 znJv6b^6n@7Joe$nBjV*QDXp78w%%Zr{if5~6|s`+P3|C_xL z*+XE<7Jua8C=bPZC^vZs!F_qMfM=sTw#Rvfw|R<(NV&Hz;FNsMmr(Wce-OfZ0+&Ih zv24y_GqIz3qGwc?cXyEzc{_(LUU5q%SpQ5RxOydcHZ`byG4X*m5qliyP#_e9vX>C7 zcR7)fg4}_F$5#^@;Zt@}V0U5{v!Z}%l_OvkT1^-~u#t0fVGmR28wI#G>!BVtM--Qr zGe+1RVFD^^a!5BMVh^}@nwNMyf-JSCO?GG)!pC`PrAI%uhoq2)1NcN@IC2LFdS6n7 zOR|FiHhl=#hy~?>qz8j^XNi}HiJ7R0o5+bskwh(+1Q4N3SJgwQ^ob}zPg_9{;{tXo zAw(W0ghG^xAhC*rReGkg8>TZJp|}a7_%X8git|A}SaXW<2N$YnPJ<;K+~#ZUr$o8v ziCZ8`C1*dt)q2KACd%@Ld{m8-_WwovW)r(8iX1_TX(ElRQ;vc26BLCTS=DUB7%gPO zj$wfimB?)Pk}Y?WBOx{}@^~KYh!mV=OQWHDq?0Sy$82f#e)eUI&@&Lphh(L4C}MXe}6%vg#c zbdDtFi3{VAAc;WsND+&ZgxMh%pD2`(coG-si!JDoK8X}_c8!ZS&-O52Gf{DWT|D)*o;F7LulC^cTvYC(+m81e}B?*vH)JS$|fh!qkY2%WO>5W_Il$~gsw~3p%shhiLOi4tK;9^-H zWQwx6e3&B8ZoTL;^Gjf~-G#;t6i`4X+4C9=U6rB??n62fE5c3$&X-?8P zTv_N;;6iz;16o934<=(I?eZ=5;L<9?6hnLN)tqSr$YFXPh%JO`JW(RHuy=1d6J+x>R3Vdr;YfdNP0P1 z>WAS1s=SG-xvHzX%B#I9f(TPBtkf6vt*C=l2&+VMM#= zI=dAm;~{{l!vB{vF^rZ;oQxW+C?lseF&@Sv1+pXs*RqS#Mn|ySvM~y(@Rh;(4Bzt~sNh`Z>Ii zLw=AXPug|7gR{J8;W3A}eDAjrsT;gs;S|ryoe2XhYB>?ni;&feiedB-i5f2Ao0R0s zP}TCFgknnYq`ob9EeJVsOxC>K=)RQ!F9y~{A{D>a>k+HNzU!6{Fnba->UXp1wkTm< z6oJ54m4Z{FXwbX2Gn6m}Oe6x)xpZN^Hu-T9Y=FQQitPfvUjo437s4p~F|cKbMOvDV z`u{{293(xP7mFAGHt2{QsK7i}s2H2Q3!6>xdviRQFe-PyI$Sr`*N8YA#MMGniK>3` zDt|&ur}gs035ufsn=qUL!Ydq(f;ty{$Ha`7y6{W98VI6CtisaU#0NFN(4ocxT#um< zw8^*<=o@GqtX5_0zk_NoVhV>f(>@Jo!(+^v_IWYm>&H1KK0`dn|F*y7vq~Ss7DVL7 zbm7FRg2(Z?M>Mfx<55Y6Czm!Fq%rZshmsbQMpvoa!@(iPheF4#>`IN?76m55z(>QJ zDTl22h`G$9O8l|DE6l@8%*AZX?ZI~Hh@z-NF!gq*FIkLjMi=Puxc$^=D>0o^X8)o> zn9c4(&2K}BR9Q1k3wz8wF4ydhZVD6MYAQcu!QYH*!bQ%6x}4uB&*UY|AJcpSv^^kX zk&T$o0dO}V^|2)7BK$xbrqzBN(SB&S#C!1ohQYHr9GAb2Z&%8pG9Ir2j|(J=iO% z&lNqTXuY{9h}S2f*7ItgmH8USR&pRTH90cWK}{1M7uXD(x<<`dA!FGWy@e0$Md$%` zTKLv<%Gi)|)Ce)x7!{X87n|I6)h*~hRsD_rY+EC@&xDPgCh^bmB-(P3)LSS-SmVx4 zo!L|dTO94Ps14Z1Y~9z5-Px_(1Q($2B?UzF-BQ3S6qtDHGg2$#-QaCMyfPBhrQYHl zgjOUFUSTTqtu(ozBj@c<>zY%{V@vdXP?RS@iw0ltRaT5w-hQ~QLmfesT*^kl;ZFCI z=ia_ihmKt2(cd%v--^!gYp(3iz8cS-Q1Bju1<&M&ljr{?;p8sp8cyiV+r45gOeU_* z+l}%muktIuiN^-T&Tdq6Jtq|;ATE!^jQa9jL-T%XR9s{857cXfA@g1`ZR8T8Cqr)X zouChSC%pk>HE&c@OR0(4TK{mFFxm5M!(0QZNJ0;9s>fYipJQIXeNpcb#}Q5-K{I6k z7rg-l65yMC3u$bRd@#Zk$B}qQH}f*T86|#W0^;-<%>TAeEEazI#KI#dR^KjpU-&wg zpn#M2gz{-_euQBr_%}lMLEeH1YGoLU5WQx7Uwu2CMO!rPn(1-)ey;d7iFad*_fgLjLBI1ffiyNhpmGxUjlcI$ zug9{#FxJ=Li?aOcxR2)B_1ka#&tLK{q5OOg^M4Qfu?{ua4~x~0{Ux8M-#_#?fAjvv z{&au(Y=i#~Z%gt55bY8GArrvh!2l8fECi6GRe*m76*6=f;8%cF3^g`Hh%n<8ix@Xj zjCfEW!Hy|aN&!GhrNxm8fgH4#U||w6EbY;pnEzx8DFB-gZUI8k)=Q*Y0BmX3s-4P{ z1ykB;<#eG+rAaO#eOdEnP5?U(l1X9|;ii@}7e3_5QzJ@)8Dl2ts8q_Gb)C- z+HJ$1K~th$Na~{NgSb;>Mo7l9XyCzx4<}yS_;KXPl`m)B-1&3p(WOtPUfue2?Af(T z|5a7&_Qg%Vrxb6z{LAytySEzOF+F(X@8O$gkF=Go_Q9V{Z-*bLJ^zSXFF%v&D-J*c zmqRc*zryOswFSEha6amkatSH}iIXod@Bfh6us{O6;z}W@qKgo?ol-PNsS>g4FTnsl zyiP{tXr%B)g9h|4LmYc_&c?QYR08|Ws#gtAA&a#C76AsG1R3g#1Utl!I z$>wwW1oa?S0jTv?WRq2PS!SDc_SqhhJWfkPsfG4h zY`0YDJ8qkWGRp@O%N99nnJafVd;hMw)2jrMuu0tN&W#p3d6TR6#(PD}cU*+_4bxvE z%VpQyg&cKGTI13M09u6)Mik-T8eZ3?cHcD^K7jevcw>$`_V{CvLl${tl8xL%g3qSf zq|K5`T~E&~+;#WDmTR{8=8$7du_JccKdC(i62UcBjEI^!g< zd7qU{eR<v?7E(n+ho?Gn`Dla7!Q*VUuXcLWGpCNh+-2OIm@$Zq zcnHK4uJCbjLE;e~cf%GE@rTFxNRxDy012E+h??T!!Jw$E87eV5tw_KGm9<48(nN|U zSg0Iyae)BAH3abHcKbq&(yl1E;Vk9n(jIBo`|;cu#zqDw&ZoTrn4NLEG)~ zB?2AJL}VgIkpRF~qPb15a_CQE^$Vf}`J83=*^$WH1fdxT6>~DG5!ETjpoDp$S2SWt zA4-!Z5Jl-jH~;dGl9Xj63k?oX3}(_KNPsS)k?BTgI-HW2lp!q=$V;EI2`TV$Dai31 zQvHQJkH&;pF==T^IBFc<7!V;Nb&POE3Ixn-X`&tZstiBcRrhe@ITDnD1=shz(;dXA zR$Z!bda4nc%H^lYA*f4FDx6>Rb*qh`43#zlK9O`(tVR`%V8f+YZ;o}a3<2wQ9BWvO zJVvN%8O~(~0|11+q^yf6Nm2g_9MdvnQ>o?bN*VjuCb6_RAEoR;*y`3h%_$|cB`0yz zbt%?H6m*V7j6$cQz5t-5n<$j*Vo$4`oK%%KdhN(v8PblJ#>7&=-IR3~vRC3Tu&r!D z&htJu*Z**7wRg59Y(Cxl-a^@;m>07N&lYGC>B?6!Qc*PJJ~sUe4&ZV0~lNf(Lw%vMhJHD_h7G$Y5aP{MW*Rl|ofyN}LQEP9Y_3#fkN0 z6Dd5H!3VM6$~+9>;8d|UiOE-u$#CQ5IQYK8^@@EX6IwVrs3Sm8FLV?#xWu)B!-@H@ zN&dMBC}}t)DK5^8>++Wo14qOyCJaJ^4B^fIn9Ktnvx}>nmgt}b$JTjrN|<~cAFm9@ z2zHKy;pN&GFVM@2Y0!kftY!h{=EIA|@?Y-7Ww)@{&4ljnOLQfiGvhbSVZM%^4b}=q zfB)DrVp*|?e@p58dL+~#bhK#Nd}`(2uF{hC1-vJp3e1B| zti0NsW{@H@coAbT<#HwBDdBk#Y1;9#!0W0T*K%;mqSPjr7ub?xj>~6dgL-hR@UK8g<~v9Vr=q$ zSBYEB2uA zGr0tiCu0kj&NB%7Y7bIK0IkZZRWh{P2tYPT5w1%R`@;%~*#sSfK!VwsoEnc7)RuIq zJ*dbiGEk~N+lc|xB&9<^Zreeb(5jP}L78ET)tJD<@RW9l3?SG76_LR*O0LLoi6o?$ zC0vmK!mupD2npDN7K5>ciozo-jSnXjR+jF62qt$Y%!_WLP+UC!*Ie%)R#5{ zBa?$Q4pcs6o4>$Qp`N)z7%{;1Q^aktiO;c?I?TEZ917FxisXX7_Wv`tV?mN2j620J zL_LI)f|0JXKt<*AimeDi4a~*FjqS5IhX3dY5(K#w{6MH`Bm8QI zw%jvfPc` z!>F@NiO*TXi|`9793ld7Ovp&ehEO_!A&iRAiqC{Kzep<1Osl_;DZt>3jB1afu*;x` zoi#+QD2a@VB8zvC832ojt87if+=_O{&4q{*;A9{$(};rL&6{9J#FV>#pg)ch&Q`mo z+^jF+7);v}9ff#^t3<%NI0(p`L-F|smPojJ`^$|Jqy`a-#O$rCR5Ear4ZmE^-iptf zoXzKm&JrmtY{L2}N9fKHJp%%j3ef9|3<50+F|{;>%FG;%D>^h5pEI4s15MK_PV4kII0F@V zfl-UN%a<_Iu7k6GGKgjJ&EIHnZV1S})exXD{p30}3cX$)4gypaEr zrerGkaY+Vs_1w=6YRrbQRR(Pe+#s9!oVgWUU9S&^0*`FmkN>$nPi!uAKiA9~D z6l>S5OIWUBTcib!fFswfQ@#haD!Nr$sC2`(T@1bjNLxYM!%ZZ|JvfG))^vTdZgtnf z-7&IF3V-xGrd2nfB{r%JT?1kXr)9*pXf~|qTxoL-(_O5lE!emdt`HflgTKTZo z>BUDWBmkCJ_P|FGfnLHmHhe_h2LGADlj+{mYzVV@i&|+vk+lZ|&fFl>F~L;Y*Q>la z&EO42U9Y&H0uGm*^56tR;Z10rj6$pXgbjiGuGx6uFGIq>W4ny(FEDR|wJ%=?n89F;MLpc-`jE?GH z+vN&0{Z0*bwC2sX1Z3k9o?r@IlLL0+Un5~WzGChJ-1qe2xPxM!Z4s7GukS+)K_=3h z_=yH4xCM@2w;Kx|-d{6{;gxGWgOTGs9?=_3sTH=}6Q*Rk`eeM@I}3){Hm=L&WvFEO zTHz4j&bZM~9u8Rc*-lQ{JO5T?)a43G9*$l<;yR8+az$gjn`N||WZ+Az${Qtk5#%uyYdltPm z>Edx#41p$Raz#`p#=a>&QDaHv1lC`YE@^K3L9-M=umG*RG1~z~p%Lmz7~6>%8(p8B zQ=3*mLClRt`wPvAM-Mx)_Q2qvm}xguvhM`iQdXQJ1;T-2VO}ok3mmj9S+P$>_#n5ImXKC%bt=>)jsNAX`SQi_f=%lLJa z7$giL!t3#9UsK+wLi{tfp0SLu>mS1F;ZV|qsu+f#jMM~LM@i~YTXx|cqWef41J@7AMV8oW#K7#d_C`SD z&SLC8ZyF(3mNLtj>xdaegIVpP?v{}T4$Ho?CfRB@N#{(O?lcCzw{G9fMs3!nrma2c zLW*t`dt6Zz#%;;9a|Z9{&M~>B>s5;HxK3_4YGcJ9HQFUn{6=dr`-=pim;@jdN9>na zfhJr7*UN_J691d%aW10&3UB~_?Sr`AC7R&|=fJ;)lwEE#NKdzvhBK3aO!3+Gf_XNHf01)ZK^YAFW;abWsK`fY{Uw4x(dwKff55MGX-oD z!XTcoW^>Clxab^nIhWKgdtWy+%~n{+NAd0L1Yt9;%;0Ua2 z+)2f4$M)ml(TEteVsz27a~6m6IhBi%(7{7~=>Z1L!D!iCUcCg7Ma@u+1+2z|3iaXO zPDlQWmH!;ijlGDZHuX@^bgme6pVjj=1XT4>^9l!oI!BD1GImET3})YRPHAZ7_-9bx zh)?Egc=^~-G%#S7UT=SNNsn_NK&;e@%#Q{hGgm-izc2*^bVUAh?)H~-S3O^c*Xz@| zXTNjQdKU^$cOp0C#8vdb^jUZBjCD7Tfi7P&^7Qjb^mmWDsB`#l=DlYg*NxEc7Xk`- z`rBasZ-7!%-%9n(Q{q^+cC*|RLJz3UOLtb(cPfG?C9C&jiW1@Q4Lcuqw@w_Tu!SU$ zg5uO*cBl5IM(;N72$#TzrdEQ=f~tvvbAJc8z~CrNZ_(&36|6aKRID@Cj?N1!?e+?%RIwL(Y)z&T@e6*6M=9ue0jpN$ko%!`cem80|D*MHV`-mct!M#SNd=WL#cC&}~PHYEz zc#~DWTI_X+2W>xfX+i{1lgnROr&kK0P^mCI{KP1D1tjoBB{;?UmZU@bNA*Wt34Grl zXW^f=(`ODIw<-L1{?ZS9h+jRF&qdH@ZXZ8WDN%b>cMi*^zQ)gsx$k}GRjiIH{KPnX zAV~b91(>xp{JckeK*#)tF#hrv4xX1^!!@Jx$6kO)U@ri{f(8#FBn3bULV~sc2>)y- zk>Dl(0LT=4m|!Buf)EFGocK{>#DZH!8kAyDLJ}!S005D)#o)=3A#a)l&?;obO$Y5I z0I+4JJ(acyzT8=`jnITAE#k~cO5#bSQAu9CO6n-m6Iu9?oggZbOBn68O})5Mj@QfYHvpY4#ux z0Cf>U7d^sO$t+P(8s%M}5+wVT@dEH&$y21nv_ib z-s5UNT+2J$3nDyyu`@QtZdK6^zQX?nPnjVGlXHWwOY#nnLd;ud`inmfHv!()8bwVN zp?5*o@BHwL2}Kq27xps5&;;kRd?}QsS3O=*5TJbMjq@m=WS?Eu#OQbMef$tU(-3&^ zPI9M3a3f^J{`hzZZzcv8RHzQ+{jj&GDD9f3CWHiSX&k5#R&Ok!DR&(Mhw|V;`9qXn zgVY9xyvIBlDgs$F1@*1S_vHiC6MK`{G*Sl|o(`D#DA^2{1_sj28>bq2B1%TMBH!-k z;FjI#1v1Gpg{C3;J{U$3tPWyFTw|wDh&_FOx9Oqv`7tlvRu+^Qr_B_`5S(4iy%$Y& zs96{q<_lq9uBZ)?Gf8(V-d`z^$7!}KB8|0F#VK(rw9*0c2INQ%7F)84H5KreWyoffJL?9oE2eZ5Bee(oV3|Gn4{pb(rhd$ykGjpPx zPms?V!MAv?@luhQ*NNhui0fyf9!J(wqDQ_xS`nejgnH_Ki0^Rb@m5oI6mc?{-UEnp ze(L$7r+l0`wyPrW_^L**%^oP~v)%Zoy@5wSEWjiEy64AQxusDdKAM_}<%tx}rL5`e zyR{^V%*)}S&0C_Vo}iIZwHQ8%&b2}W>+_8k+2}SogxTd+#o~_OCP}7=Gy1_P1C8U0 zcNd(tE_R3WN=&@$@JeG6$m2k0Rvf{e!E#xww3t5PORN-gTIEAjLtW7%+Ca&1F9ac@ z^+`9}GoEr!sob=jdM#1;Kosx7>IHYZWS)Q!Hdk!@)u*4E5}nwR?*(!UzU0u0jvqiQ zeE`#_m%NC=ZSG^9grp`iIEX1*Naz+)!YU_Rdp#G=y?UJTs_&ZUdL|cCf;9rvF~^dn zhmp^sHmJAoCX#!mUM?&sNlXF7UAT7Hy^aht;f~Ka;uaUuDr6oy^`cgiLVgIgQq>{d z{MDU3W$eFFbn>uv=&=P-v3>ay^x<-81IN58<5&E&iG$rm4$T!fEI}c33$Q#W78lAT z5&)JN96UH#u{bLI9gzN<)DG=|$~gDxd6-rujS`1EUD%UFLRAJ|MK~$%u2>krCzA%K=dNrLzd3-sO?*-(V+uZY zvY2Ip3PL(<4law%TggRq_JfMk7Ige(g9&v#x6>m+Ret>;kwb z^-&`mpK(fCYjgbfMo+Gv6pPp^c1?z?*cU}b@-(@yc_X_Vx|FwE=yfT{5WxFtL~M*) zZanp{)beUHVmg_q;?Mcj$CUJCJDS#?r=vteHGjWj(g#Zl6_w}ZA;3V66%kRFS1uVF zTYHHR;}PM;q-krteh<VXP@jKIo4l^Q6A%!9OZl@h=a(YNn!_!?MmCL+%uc>vhpD6kk|D?{}(vY8iaxtZqI zT(Dkh-Yc0O8O++Ljo=~OzSJdB(*AgD`JTkmqMD7y<8wLi$@vXfyzM9CcJh4^t5nw(a*khy%@wNu@8dKFlbrGk*%H z>G#Pv2#rZBJ4x$0QM1Wcs0?BD&*cZ3LFNN1_C$s9D^z#9_x8CNzf+P1s}%97r0%VazseLxbDFX0|m z8?N6#gtxcwXPL>dhM%}z+;>dNY!iCiI4nIvfQwkm=QTb?z}INYrF;Ci`L?V+4cqrK$=Msu~wet9+EU!fEe&dND9km5xe_KP#|= z==TLFY#k}?3-V?>w5*ZHf;h9N7O;}irt}M{ryk0t(zQ9cQqLFUUCQdFK6L!S3eF%* zreNEFFVfpYrde5-OvEtS(+{aN7-V;;@qZ_6X;KUQ+ z_pnoHpWLIlh#G4=!vH$vi4FUSql~e2`*A+LCrVwP^EFOhHzqgf$5;#`bIrz?%%Z54 z*{ypY_+w~GAmE*5r2qJ&6J8XgN^3(glo|&Y|1|(YEs%xE^74MIt z0ms%iZt7xw{9-Gm?=-efQzH4lZra3KtF%8q8(g1AIdnN z95s&xHJ5|@wFeG?YCktvm3aV{U%a1pbM(_DoS+Fck71ywUpzmXjBwW$dR3$tzNwI3 z?x)ESe!*>ugUFAITi0LsT}@h&K@@;@!%K zG<0`9o0w}7_x=7%izK(RbRV?jP0JaTuPH61^R`*IN>VG;T(5aYughE?yrVy9ZV*IC zbgxla+YP^HUY-3##2(s60gKVc%!qi`n5y7AoP}DQFVgGI(mYH%H;o7}wK?6c>FAV+ z()bmPg{9}NrQh!Iu%=a~w#b&iEi@vcp^g>Cb$ZI^`|c-L;Sz$wDQUVKMUdJ74k z&hD1Z!J_}GVXi5RBQ9(Fa$fGX`jSWSNNv z6e(y22k*Xjx84t{whEstWR0K^f9}$>gCWwOiEzb<;*w^jNr+UE6p9fW*?^0gC5^0y z2^qGE&WVZwGekZzBr<>u_!+}2012n_2{{Oi+!m(Vj4K=<#NHy^bE`;%q2!O&n#l)y zw9~OBGR%~CD)ka1E;NiWV#%Xc>7FzI8|y=kSsNF|l4r(1W5$Fy#s#=yu)EbL4`8$> z5*W1~4Q7v;7(vzrPE3Ubdv@MTp2Q$AI>u`dV+rp8 z=(RV|kg-$=vEa5Zb=9iq(K_2Apg`_0O%7DLJD*h?Sf(3PY13O+VC~#TjX<4fsuEhfgnnluE4DMtjI-Ma!J7M4^T6jS=4CTP<_$dFhu^QF`%=e6G z4qdK0UAzBW+F)!qCd)V_(9>UTD*rKXU9{AIboNUY;gDf3n6C5i-u6TQkqGJSk12R$ za;jZGb-0IQG7yf*93C=?lKe+ax1a5}quy?q?WF0uiC9=sSV82d;A)=|TpusM`MsTU z9*h3C{7~%iT)N#*;sAeFX|L1#*rCGw!@%(A%0M4U9g=-)K-nP9F&&6?dewfy=G}a$ z-2z70z@+_h*vYD{S=H>|!22?%^JAa7etf{mavI#Yh16|T4v>B(;iNmAgNe5@Y!oZ@X8gBxka|U`T_^V~s^N;p9 z^F)kDbY7jf{Iq9pk@e|ZNT3m2hhcQ&yzaBs%!igIkfX7#*`{n!^rvje6|Aj__#2<*% zjZV5GH8_mkURDmvkf!}|Q5uH*Uc#*&H?cG%s#wT>=fp6bqDm#ci@? zIF#cD`eufXr6uk-?83c*ddmjqT~D?O=Ll@U00K4YKN>69)1P z&LLqhX~U$O9quk5j?VcvTtc7Lc{S~W6CN)C^WJ#sk7~o1z-n#`-w-a&U?;W?6qIZy z=jCbvI-2C2?ZxxxjP=;U&!`+95D+%aSY)KQnR|(2RUC>wu=K|dSH`bLZCX`1xOhwR zLdH|^3}92WIO!9)2uM(oor%`qxSSVqF~A=_Ihv|$W(_kxx9Y;AbJgTsa%A?a`@PwT zT7}zDhVuF>Z=RK`R`k=5kb2;~Y8Zbmyfh*=eRQNWq@2kMT`pRNPlEc!_f+KT(D!*x z)9nh#qBiNL%_WI$bwGHS+?~2uv5L9b4dL6edmr1E{P;N8rvJq5;{XeJbAsa z`&ty0-^RPi5emQ?t*=Sflqw7Np+u~GG!oI2_MGm*nXV@_TERShl+5Ri->d8qec^7e zYyFgo;EWTH4JQ|re$=MWfc2)C16gr(N(#Z1nr6-+<xyiK1|HQ(e|5LrOODOX4L2PO>vs==8L-~F2M(gSasB2msmFW1 zH|@W*>0s&dDI`6@^D9HyUQGCSC}$k(%81z?8Qw>+WXttFxlVvkVr0hDjg+f9={M@{tlG(jQvVnz<1`KI@4XoIpres+rv)B8F#gM#c-%Zr2jG-sdo!V-Hx+x^e|dFKlzZ{rH87WU?zI@qBVa#_8E2{G51;(50Jluxv)N+> zj|=%dH(!N#w`2;p#+x`-nGo)!=g>X7jomJm)=KQxQ!f{gLOmFGsa zMqf11*LfI&V~AfQlbvjdyy}bs+e!kbAzBis$I{&G zqyn3ABZaQdle&~%O7etObARBb2i~(q8aDQbH?<94J@)|w)A<#q=!5y&p5MJZje4=F zK@&X0Xa{ZmJasD=KPHmRCf)+YeYUL;@xPhSkhC11yx;@itk*7R zyem5D$A3z4et2EqP`uJdiY5G%C1nyOTsx=*p4I2b+v>Tch5%zaAdYYy?vlH;Ke3v0 z1UmDolK}RL>A{Z`wd%gauZV-`&~Q+cFtBj*Fg^-@{9%3ZTpE#~ppY@%QI!tFm_T`z z@zTa5W1IESK=HnN=7~!HK;4SghcWDELFrM;hQq!y4EQ^|$ADYs zV1X*fVbRQEj`<>{29xiyEbHR%r`Z>m1a28?d%*Q8qdMJG(&h*heFbl1BjfIHF*F-} z@-a~-{%-)8U?5Yog?SRrF$|#V=KXp|gP8cUHc`nCNT(a-4}@&;NN$}du!HqytJ7AX zZ<4K@6nLxW5T4Hjf}Uu4TRNyyVt$1GFmVFiN-x^d?lBM$m%})_)0MEiZ|{k|4v%`sNhK}?wIh+a{SoG zmuK8@QFyY1-g_=Jrkr%E;SfBof$h;67>|SmRT<1S8%W;LbWPzO)&WAxjB1+gfSSwiS`LiFn(8|PteTb9WP)y;ern$Fr zoC>~h=VZ?)V(UNqVIb=k8?)XYg3VS>S7h2OZXgqtHQ;82sFngGdsUw1i1`z3F1*jx zs4Jd32@dvJYjssrVLG?ZY(*!eZRy%4xodKD=3Y1CIy)}CO3sDgk)Z*Ln4cj025b)u zT}CbXF_fIU;_1($MoRKSx-ohaw_Iwi-Prs!gQbtoy}r*@9LRB4%h$t3tcz8iGKiq_ z-_(9dwks=mNZKLIM#&_m`8NQpeAGDKeigM?O)!T+bL~zTB=La-GM- zYp1e9X;!fPBtOz~U;~+44j8?y4al!nBhDiYP>U4DyVB(Sq&9u_(|T+5Qq=rY$2~g~ z)H7jkX#ug3FEiWG!J7K3jBqhlrBwR2&`n5QSB`6pFP>GG&% zb2Ui@3nrru+Lt!{+O8YI-T(rcY^={+d}N8^<`~=I*2nO5WK5;O;xsu!3iO4{zZpY~ zr%hg!G_l$nZ8!!{HqbL0NefOey%3H`P*%*k1Ao&pi%k<_Fq)vMXwt`!6PcOgh4kIj zs`(63`D05^$pMQT9qV1Bh0>yXYd z>PUURU8*tbg_Zj|v-*$;cl2kR(=Vg829u$&wVOLEjwLQJC$|V~Maaw!R$e;Yl9Djk z`j+o?@)mgo%sWQJ_wjXZ==R9DndM~5D>bR085_;$I={1O81Wca7y?po`lf=ghq&r? zZUHYR#J1m-HYf@b+nIk~L|E&alB^N-3(Q_Py;dp6>1Z%Fz+=c@y5)pq(X!~$ut;g> z2tm2j3~FCc#pujYP$Bw20R6rsaT`yG3_<~E6g?#NNi{qB##%V_I_BoL4DhI*>J2CK zKbXhWgla-bF;YIVX=8it#3ZK}>B3#tRqAz8XEuR)5+Ws!zcI3iHLHh#kGLtT(tfwlyc5O#Hx=$!<_AFWJr_tnyT30~G2 zN3+R>u``8gE918RkUp@uy?0Fhb8YkvldZS}tH95yspYwD9tRFZ!#%TAjJ5`5g7&9fvnc!WXh^bp?X385VUc5 z)$|Cf{=MEB?d431P8$zzcwy&`VD7lrl;(k?KtkDL50+ptn#YfD^4YrC`iZ0{};gOVDp zi_N=&2(=(rJ4+&wiEvz}8hdA*Bo0HZqOb8ihBu$9%)jmU1fTf*_EK(ypfVmyt)C12 z8gfv(y-R9nh4hEPp89B7cUM~q8Ri}8oh+1GGrX>LwdK@T4w+xUZC-S$XeM3ZnStfJOGcbct0&T60Xw$O`olfYYI zO85X>3=)Mbuk;}wudik#OYF903PCtJh^yfY)epp3?3k)$foT{96 zpT(tFs#2u86C}TVIF7;iDl3h!$;~ZWi-IXX4nrjzOQR_}jFKmtp^Bix*-q=4{M&cwKxSd8_wCq(g^YBh7dc^lWTttPeyW{p z5;&n|aBDgJD2D_oRHR;J!~_%b<3kpC6W8wSnuH;AP}tZlu~?y;Qcl=3gwl4J7j1G5 zAJ8Dh)R?BDc2$JGE(im$X-y+NP`=gbRzn-TWn;%8cc9Qn_=QY=qmj8-k(*${@e9du zNIA@3_NT_QRP?so(G)epuC(6tbw6$Oj=@ zM^W5uaYhZv>Iu=5526ya{PcJNna<`mSap)M@(qp>zv9<%dJk`FB^wST-}4C5@)%>d zs7U0PKC7!3u*&R)NR8r3{J<4Hs^KK4QWrk29iZ?bP=WdTI#-F}?@h(00wFQ@vi-Qv6&%dH30!`^#eUVQ zvSNzdcXcmb7h45rVcsaeyODz7Fstq6+uadNxlx#_h0;UUTHqG?%%da4a@05@kXR=& zrs1f@ZG#uFkW=Th&Rw>x@pQ_gX|HZVpJ>87Yr?LnypB*mU;FmFGZua6+aa>1M{+#U zyrpmFGkhtxbhCN0U}SCl`GntwC($gj{o#!@T?A)&$GgpRq!s*P*>rfzl2w~Sgw;vDqgG05Z*-M4lAby%fJ*}?m z??qAjDkS?4e)ie;?1c2l2$y3_MGj}Ys`YT@4G4Bu^%Tb8uAQ?km*TAXokF_G<>#{w zTC}BLRh&XIWcnakSgopoEPEp+z8og!*hKRk^lSZ*_gXjC#(>R~_5KGMvwAP@+JhZ6y3$WN++# z5U}jKwxklsE&iOD)it)%dtb9nIVxy%(zm>ulFS~Y+^eu3(yDN15H)EKc{gulqcvHH=C%X=#i<#ZlpG424+S>9qe}jfYCYoYK<=6Wd`*V7q0-I=tnBM`BI#l61 zZ-a*5NYvg~FHp=^`e^%OS2-OeX&v6Sdp+$Y@1ET_itP*r4-thS(z8h?Di5cvd_8p{ zmUW55HOV-5+5}KRvdmf17F<&BLL3iFy#2Ux_6sOR$O=EoUtfg7c{05 zzpjAz*z zarr|}*^^m$e0ljvQ`weo#a(K}lb}HXASYp<0`bW^B(V|`2t+4&JBW9Hw^Y%cT1Bl_ zO%JTLcMb&@yeuFV!lO)Tux9bpk@QTU0ej>P_|PErIp6 zOZ8t#8l3eS(%nNny=s1VHTdhHpXoM+FEvJ!G{wK=pC$pDRGDg^Nt%6|n+k!=B}>f} zBrP?1Ee*gH8M&GcV9i2ZOFyu6XsLCKq-{#CZLX!_y_cRYNxKoSZ4cOfwA6k^(s8BN zai`b6yd?3Hq%$d`12L@=b-5Fh^bfB7ALQpIFQH}v(k^QKF8Z`C=H)K-)`~wQH9REU zLd)HsNP8sodt}mjGDqvS^qS@Md$rPf^_F{$Nc&8e8!WwROqct zrSddx7}CyO(vd0sk-4;yCDK9P=RYg@qkE9F(WB+jv$T$+wC;< z5B$nFCfNk8!32Rpp>$gE_bKIj@%i9g?XZ2J^w`^WiJ=(PRtp z1`A2)3&53yOtQsXgT=!1#gdi93bLgdgQbS_rIwYY4zlHLgXRA8<)M{jp|s&KgO$1T zm8F%HCz_QtgVnwC)uWZwGqSZSgSET#wWpOe2-!NU;W}c*I_l~=Ciw=g;RZp*2FdCM z1^Fhm;U;~?CiChhJNed?(CUYbEg{J2)~AmxeB|3Q8Qb!!+sfoS>V`X789REbJ4WQY zriQzg8N0TtyI;xooDKKfGWNVy_kNM@`y1{DXY7Z!Z%M80#~U6bWgPgz9RSG>a}5s* zGY(5u4=c!zY7CDWGLBkSk2=VYyA6-~GmeK=kH^SQrVLN!GESCOPu9p!KOY`!Wt<+Z zo|^tRJu^JJ%Q$;leQN@p!y26JWL}W0T~JV5QX5^;XI?U|U9uY; zUXfq%WnKw=+7_X>mN2@O$-I_dyH=*SQ8&8L%DmBAyD_4;H8r}m%)GT-yZuUW=WKN6 zmU%ZNbLB;G?{9RUetH+Yb{`F)c!)Q8NXmQwu03Q@Jmwlb7G^${tUXpxJk=OIHDo@u ztUYy5Jjb@)cV|8iQQY;fJx>|E%w@hTt-Y*Kylxr2?q$9nt-YR6K(34+cbSkU3Q8Cx zQb1+aAAclVCjEiR?CxMJYPmE(RZed>;Rl=LfvVj8XiAANQrYUf!FUGsV*SDD{I{7F zQ*fGWO~D9|-}!KPu%>VbbocUHrCMrfj}WJtoy*>Tdn&d(G{)xq4Dmo`(sHnYy{wG zT5SXpS`=*rk-F}01XBhvY=+PzT5X0h6clZSvDEKxhI63I7)Ef?cM>!-t#^KFTYz>F^<58klD-5n?k1ZhTJNS< z6@YeA?dlJ9fe^<&#)$~0S?j%Y_gxUZl*{SCUZxKM(|%R}zRiAi2wm}hP6Y4aer}93 z(?MQ>rp-ZqvPJPhL7MB~L19)9(_v9wqRk z=iOK`c52-?T6Pz`gqEcjeWY&37yXpMESCc`Np_cm427kaV3vmC%OQ?_maAdzIR%nl z-o4VRQAqUW@YR?oBJ1_IB!T_)1c1KmdQyS!(*gEN;v& znDuu4)>rX%!K$$AcG0fkd~^kFY6nC)>tFUjHYz=9qCk^y#bMw2?z&G#*!}Hvq5-l4^2GE6*dLF=_AqS^E z(1kB;704Emjb;hxCSE)b;vde&a2x0*e>@KsMa#ho2J}!7a|&_@=insG18KM}LRBJi z@CpIFOu83g+QT{c4FkPwo)_U?&~gd;_gT48FCwD8Q4!A#^zk-dL^?*~lI{We1s5-( z+=p|??*{rmK5}~7Jm*p(3dD)xT*ibbPbC(a_5d%IRLlB@gG(d6*6; zda6aGKj$&X$b!{UFB6Is@|m;-!J5sNzbhm1SuADcD*~$%8;>_wod<^uA1{+SA!r30 z!Lq|9#8=4!3I$wAgToerA2?gQ3%IcfN33u81i{j#G@saI*i zC3J#wp(5X_uhP#W3WfJ%$2=FWGVX^9Ki&?f|XO5M6b<4QY;cD0FMU= zUT0%P7D>{}O@!%Q=Mc_phZ7iXb^H@ML21bv_5{jEt$A zdfrHF0sja{$qhV}@pxS*ie9V|EH|A)d{YE4A5@G7Yecfvfm9-kH45csigj;_wMU9I z8^AN=o;M|@UQF8khip}GH>FmJCAxEOQ6T|bfT9#2FovR65llrD3&`V z4K42qCJA@^D0dOTTRG6ZYn~q|cWoGY+njXQvW{Ni-Y>s!7e4WzxKFz*M5(l>v=U~ba33z0fkZNgQ&0$Lvr7Vq*UogFuaa{c+!CpRcTAfvVo#^ z-$giD8N@fdf#G%EO^HzzqAt0C4bZu<&1LE z=O=%g>ajP zfR0BRv7bS8Qs@rdU zu6dlPjCxx~p?IXb^f=o%T323pcxVvbIM1hoLv$2!a?95lMVI4uav5R2zJV@wy11q|*hhFJhDP`+sR~vsH-{?h@ z*Yg%7X48O-(q&w(?iSrIRe6#7bBBPXbNN-q)AODvX7hNk z(sd5W%Ra-7z~sA<>wKY?1C{9J=|ZKOV!f9`Z8y`YnxAuJ&M!w_Fk9yPm2RtnFUMBO zEvK#JuC>)|CyvoA%X><9%}Xz*?qe;h*tfTBT6JeXF>LXgfa` z7DfGP-KJN50PDS8CXco5@{K(#OSWIJzXgqf6C_d&o1jQe8Ky088R z0cq)24*ewk&jO-N#FAk$w0Dy1IcnzOqa z;ooD)XcfFW{u_W!h)2Z#0?-O!zuaE{I>Db%`wKvkI5WC#CpU9nf<>_AOp@&10CcC| z`WJu*KcN2|Kn?BJ#LuX`Zg-Hs3uvfn*_XiKZvra6-;DU51yod6{wAP?)5rf&Ko!rI z!+dAYSK~7OgMeNij~m_ubl%VY-w5dM03sN81JJoIR>c1VAcbrctv3KQp9gaMO8`Os zE})ALfWn)A272fO|62h8`u-*$D}~(uPCysYK4^KAh_VCX#Q&Xu_yz}+JTK$3(DMJK zfQEDzFB2Pw^V!_~O+fzyKvyZ_5e3|ZvLiPC5W1VE6#1cY8BiYPbk zM|}OS1T<14%?F-{^1S|60*VAFSjtVME?)mD0Vx)%C4r|41aJO@fWDxYX!py_R;T_8 z0hPOtlo;ND=i2`{fCO)=Vj@e;=>I8zWaJkoQ*UdF6#ol=Ab%6kNSTA%(9-JT?LQUJ zUDJ4Exy#!)#o<2_(CTICUF*JL#Xl3!NX5^)p|#h?yT1gq9Gijl?*bCK|AQ4(89=Y_ z&jci+u!#e_?_p5-&jR`jK>VXsQEtOq{{%ou!`pO14}&WI6+m7OLtijzlKcM#Adh-8 z{{Iai$cST9P1>Hqp5W4d6_Db-ILYI9NVy$M97mca&3ow3sOvAJZC0AHkCPr%@KB}x z2TD)yP#G9JMxv~TYHNYh1xj`LDrJY74S_S|Q8zkJqP99qp0f?3JUU;>jtsvB{!Kui zeOQl8#`4IZisGx1L~ztt1flc3)YlroKp{&4@o*?_YyU2wr=@j_hQ@xy|0tlp11PGY zbx-lkbLqbT2vObv8GYC(SH;W zK)HD`Y4p0_9|Sbk{C0ykoyN*V`7z%XxIi z^PV!~aS8HzKi2VjHwJlqdaFYTePH-~;Iw@Z+9M{iyi;Xte$4-2E7m{g@j4xT=s@?)^9j{ki!4xwZXy-TnEK z-?p9l3(xz1y!RI+3=roJkkk&4b`Jm~2go%BD9i^a-3O=;2CDG~YG?;)x(8|}2kJHk z>dyxn-Uogm3^L&lGSd#Sa1XLd4zg(svYQWbxDRq940hrVcF_)Ybq{t=4)$ye_MQ*^ zc^~}NBlhDD3D6D+at{ef4hd@viI@+Gg4~D15QfI_hbCx;Cc1|vCx@mshNjJjX55En z5r*aPhvjL96}X2LC5II^hLz5TmEVU|5{6gvhrb>CuXhh`43RZW3U8ecZ@&-kB#h|d zkGPul>T!=4NR9wEMhwqKjNV6#6Gl$*M^0-;&bmj=Cr2(eMlR1suHHwk6GmC6GmV1M_+44-?~TNCr3XvMnBI-zuref5yij=#K7sqAb7+e zrNp2##h}R=jRg~6rchza2I4Nn;CsXpro<9A#p2_8YVXIA62(z9k@oS&(Rsu%q{J~b z#jz~Ju|33b5XEx|#B=M!^LoVdLsH@eo8pBR;y*sbixMS>3nWPDBuINC08$dveL?F>jC(*(q(JCd;rYX^GA<^L> z(UB<0Ng&BZC&|?#$vq{>vnk1YA?fEsk`Ga`pFnbePI8b(a!5*YSW|MuLUPnYatu*Q zoIpx~PD-LjN^(j{YEw$uLQ2L%N)}OSjzDUjPHKTiYEepRaZ_sPLTdR#Y9$e{S^!w9 z1FZJ|Hl_fZn}Dqg!1f1VCsA6LKw6JZTAxSSKuQ|8DQ$QmZS)~+oG5)#AbnaVebys= zJ|%szDSde%ef1%IohV}yLX>JGkg@BLv7eH0*pzX+ka7BuaZZ$ZDUf-slX>frd7qN` z*p&Iakoo$M2}PU*BbWuJn}y(+g_N3w(wrp(9f$Uqg+-i=Bbbe+n~m?8O_-WZ+?-9i zm`(neO-YdVTw})to_bHg}6k;wFzb|FGX2#Il@x; zH4_#n6{MC0f?D^(Y$?TNuEIY8-KSQ``4`#}vweiA#yTpednzFTR)6-dM64=j0e*ml z6>#d+@It(5-WvUaOWgH7rSKCqW#@(BO9*!;xFFry(uv~S=9+C|%w*y+_z6&~U>ycC zHU}!U*?0-Q7=pYlmR2~HQFxt!9+t5X_6WEZcM^k)xe~J)*=)W3F|}Bf16PI_OHz(& z1&re*$PO3VfcocyTR7IZV7=86**I~T{}5JkaS2Ck9sCm30)DwRb`!B`J!V%?pdPsy z6r6QIEvhl<0ZL6&J^V?GJu)SH;UvmCR5)Zu%6gTmj7Qe*%vhs|aBvsRsbR${;t0`+ z<n&rqzPa*PHsMtXiEuDOEvVs4 zm5}gagev$}aBBvzY3om=N(oleBUag?RSGd^aia1fyr~2S6l2peQBoINLY9gEB}-ZN zNCK6eTAl)K1~X%!lXTWfH$r?nYAsq2q&x6SO3s);mqS$u!fnVgoqHvnw@WBEoh4;L zbrkm3D6Y#ZdgJ18Iiz{G-}mvMg*^olKai%0Zg zpmi_BHX>IwVog*w9CgDOV~!z~f7iDyiGyp|Zr!?su>Z1hn+ccngd-52-6a1P+ucECXQ+bNKLd9JCwtt$i9!~PkBnZPj1 zs+dOUD)z<#G1ciT6p!D6zm{};5{?bFwU2x1v^@q_rrA~NW0jIZ8K89;we}k8*Chdm zz6}ip3u7e;gEv&c%*Vs16S(=_U~PrE`EMf#v30S6oey$#_d`8Z#Kp0xo#8VTP5usi|ZKHbw9T zbs!ctg!c`)3axxB&~w<6X|qFbvD5g>&0NC`Szc8>#8Byie;7rua94)lAhE1OC%pq` z)-3U0DzZr!<8f%pF{BYPaWbeJ(tejTG8eQmSW>9K2s^DbvdrcV>)VbiUpvJ}tiV>R zg`iqw=$Qtg8L^SKZO;RZ!u_fSvp3#NrMrVs!VL(%GsqL|PbGsAZDfnbJ?o^{=w21+ z#GaNbgIOnDX#0b`bXN84b?^F0h?e5&N{t&`N zhe2F9M(Q;Dw*^?}Md)#aa=D3R@3{$Id+6bk32=bp(374I7QRre)B2 zd9W6}6H9zO(0&>LtrL@V05t=S!vquRb+Y={4tseW^=Ad4lC3Bu^Z>pmGwUe)#`-Jz zK#bs~hsYY;X4A(q)&#*VT;nZGp-H~-tyQjAuF);_r>bv1u=$lpISi@U%L!$FZU=0R zR2bldK4T{`4=bE9)UVgOXRn<*?L_PC7{2aY@a%l~Sk9EQ<0`akr6irYxZ_#1Ypq0B zhP8))Q|rQ3`|OGH7Bj~2ewPya56%B#?<~CH%(Hb}KtU+93J((8C0KA0oWg>J;2{LJ z;10pv-7UDg6z=Y>Aq0Xa1PPkdB|WEmx@UT%XU?5>#`RxS{uHQ8^iI zBsv7rJQqBb@7)fTtAJ=8?BRb|)M}ewJ3M&)a$JS|2qUJ%X$&XjF=T`k$9NroDsqOJ z;}az2@SgIgjoc$vNXb;W83mC7wgBXVRhR2Ry6<98b|1HxQhV%1UAJ&6HUwiXVPJPqWsx&J+zbyp^&3AXdia@tV5%b5odoVqT6)kFSTddpP0bdR|lh3dzTmWvj=5)_1wD!H9G`Y)~QGK_RsbY1*25j$rnnLdY zczi8q`RdZaWSLcL{qXAPJDk!7{c-#4T8jPKtTWk9=51KPClQs$vUBRUxbEbefbPT1 zwrff@NV^p&weC&z=j*Q)HziM;dS8I&zrXAGHUnatf|1{1qLY^&U-Q1XzD&KYnlKkx z10%z;z(a~7LBd0>_io1?-WFPrMvz`JS8rvYEvY@ZD1Sr7UA|z(+TH737y1nsE(b1Y zD+M5Q>H&O_k)Q}7!y6C%Fv$pj0Fh8}Z3w1yEVRl1(XX7wa@w?-qCW(42te@xoYM{H z0Nh<)zdP>=xRbUwLr-7!s6WJPKmz1#$ojG&97+%as7EsBRe2!ZLCa~&F#Vl8dI;Ut{c8N;B_22} zQC*NyeNP;Yc0Du6RN}6$Fv4hsLfrY&4|hh7R(bHF!4htny+crMvz4zz*t=VpPO0h0 z-M#pCGD4j)D*Ge`c@H{;Z-bf<4nGk&2zsxe1gN60iy+*isS-iLmS7h}CN!)Py+`iP zE(W5{s}e(h*vl^7;pGR+1ptS6A0`DtzNQyOfcJaz#{!RM#`Q?0 z(H`db^G;%9Xbqo5EFDS#TXixyNkm7XZF!~{_}-Vq#PvC+2FTXEV_1DW+E$I*4cf0e zka=}%2WT60>?gKoloQg)O6du=(L=L&F1bug%z3-5&#gTlbPulH$THnNGj%_`Tml_x~m(vyarAKOt`9#TuGYs040xtH#4xL8jX@(1o9iF zm=rV{r@ijyH_1SLc0te29~Mk|Bg@IQzyP{i)-wn``?~4;2-jXX%p#Q-zV{Z%TY$yg z>+AH3tEY%OdsE<=s(Y|cy9%ZAC!;y#MuIG90(a}w3AV2-+1P1k zTITxi+nh}L2u)gT2grkj?1tzITkS^9&1pfPSa#)88i9Zlo9st%B51fFNWQX+1+p1U zO>zq?2%BQYTj;8doO=Q4%u3VT$D@X~0K*sY7j{9P}Gn-|^hKCiz? z(vz?$Y}ufF?K;+?gNWZGg2FTDgYB;mq~#Mu3k;Ba%`}udXpllmO93}Ws0s*)H^F@n z(=Bl;nldY3lu(p%EP->m0ez}b#hR{!$hb8;U*IoJ`1oOi$)%9iJoRFI7DNDea)3oeWp?u+=?AGc)Y~OW>851mDt4DycY;6%34#x zoGxl?r#*5U&L>fsto{!f&(Rb(3i7e)x24#H!{i4zY1%Vpi=-vZRT5xo+U+P_%V#4! zqhcuMZQCITu#)HI`vk?r{SUM|->Fp$s?{XUm6=FdXxRtGOvE6{emO-~8c=zQd3461 zJ*V<)j%uOD;aT|`WJ`TyL5=Qp#z${C(pV;9`)YOzDk^o1;086sENuk=)n>MPHILOb z#+~MCvyiP!LAawA&%VA`JcI5(?!%oy=<>t6qZdD#h%s_c5LD~p>^Q^&#_?I~t4SF2O>Ko}s`qhXQ zoZGBqZ;fthIlKyZu=IcneX!7M8uY}qiO&}@VtRg6 zFrc9hLbP96D4a-r;DXEOwJ#Dq>EClPpi-KZpC(G`ZZeYwxnfZkl4wzyA?e4C0~|X~QlRqNK%} z;EBiAOv^ks=57ls>lgjbTo+QNWe6KlV@Nn=pp#m-Q}la&2TYtcRA1FHmJ4Z+qIa`G z&wL=o?Goe_&GSKH@N?u1@*K+h?-~+;O3baaJ+RPDWxbPNl3Q-l6_*OqjN{C&H&P-o zkVO^-NYF#l&AJr60RpU(pt!H(J1_YsU$DJYJLP?+800pa|JV_2S;9O0F?%Mj9}Tjg zVkJM0KtQ3|X{&B;pc20A`-<{Uy+%vVH56SORCbC3gK37?_oEV2J|3yfebbto5!C1$ zKWpij{4C?&5Q+vD3d)Pvj|%eGqJ46eavsP?{lsRh#W3McDHMrXoH+c>Z;yvi2C;M# zKRs?5jUD!o(WkKG&1R4hd=R>=3-cVl@^e!sgG(HVd~f(z8L(ZYoqBfq5&Ss<^J0+{ zi$P+=vy5o_`SA01*9!w)U(dO%+;>|?bP5_=T`a)5NXWMotG+AxJ>3(ip7D_pEY{f$ z=6Q?eORCh)1I&ouPG4iDEG-GLF}2^g6BwftfZh_Nr?IeTJy|k+Qs9nicaT!n-CAKI zbkx&{G24l`B{FQv^<*W3?KI(q2uxXo|uIv=3lR zaBuBpb*Oo9hV((gvTPHCrR&7Cg^0A9RIOa#Efx+Q!KR%s`dI=&D})G-An__PQ-zSZ z6@wzD9ShjQj@QFMBVIZUDfR1Q5a_9hi-O^FgpwD1{uSymG%q9mspF&WNad9j;V~7MHmIgieAJ~KriPyz~Ma#J6QY6$!It`WM z1oEl`^Qy&kcyDbpdYP-Z>LjlCBsK+lIpg~@^ZK;%`govZ50Qu&cXMbiv!Nig5{%Fp;85;_cJo(*LIWwU{gtr6ODFfdBPy0g`W^9_d! z&ZM;$5uFYRv=@QJ{<6h*;j2r&;r7E7XTz01xuFr3Y9cvAM!8O+krP0|H{5%^TmL(h=BB~*f`t}#`v;gwZi^W3l+<_PuovT@+iPSVl+ zva!S2@uRJ$8ABP$p;e9+t)&)u<4dFsfPP$CSX@!_^Ja`f*uyaS&}JWqF)2-48pzCD zP{sA`R$Rm<;3NQl65)v8(vP4rq!E9*KP7GOfKT|Wju@03v5-wgGK-@x^I(~s{7N2s zY@=_~C$FifPEWLcPX}jAVrqtB65nWwz)@MCy6H1R$?i$7Ue83v+m5CHykfzSdKz7 z&Qx2g>@gM1*ftokb{quTiz}0e2416cd?vxrq#P`bAtDph=;V z`<_Q`b>V-YkbwJx$+S(8w_)K|Z`ot7dZ}ItO!IM-w1OgT!$&2SIwckojFu8J6iy^? zeYn_e{bz{C`1bXAgu^0IEr?QMC#RT+C{iAkp?2`G67l!d-6pGJ)Dy+(qcW#REp-Ve zcJTx4m||O~=iK@H(w;7Ip&r-?;%3AwK2R9hK8U!A~|vwJHX933-7##d0g^fD(BMn&GOOx4G~m|$p@!hcW65+{>vDAm8MiG7^*}8ROZQ5 z(Sn*7{##ev72&D)wbA`&8_34`9KB*{Ef~_(YUfrjf{ru9>?<}@lP7FuFBp>_y6bCe z6ZxXzS~TP2k;SgCcZLm7B#MfykzppQwj{jeFW=UmcL;V>CJ!e<%^sXuj8GZnUO}PT zq~h5eB-!{Xm}=$`>a~PPH(ycmKE2X=#+fzP``hzTD2p6E3C`m`0V#d8 z?(7;N;S>zlq$;kS0GJ|8@T;EW_DW=8Q|GgT77-C^GLMEtHMXX!wM5h<$unHY*!RKC z@3VFp(NuY2ie$(pa$>=U3HK^GQAY(gB|~k=7DP}!>JxnYzE6ec8igC{dnICQh(J}4 zygKEMt0ra41S?a&PenQ1gKZE;pp0sqNo?py6^4*&*f7XQ{NWQ{&cbz)4rxwlPD3Z- zyRS$wUvOLTB&S~X?|97bOyVq`jZv#z4`xx2ZOMpNT-Jh_R$;k*h?wc zOO-0xNQVxx%d~cy^@(h_H|%8-?B`hP574Z%(Cp`_@8=uu7dY(~2JROn?iUyAmo)5` z_V1U?n`6o-^zQDLqa0Kb91Md{f6JrofwulF9!+iOQ*K)nukgooMq7HxED|4cywn&5 zskc0~Omoe3)GC=ji2Q$pN5jfeSG%ocloNb=^N1oD5yqy0qWznEzM`$Yb;a?<#0QFNYJ3Q=q< zyc{uH6s4B|sJcZP;zZVi*+Ix=rZK@-zNnNzbh5#lK`e=jn;}>+sBgn43!pg>cX`W) zF!Z4!gK)lFV6V?_iTs!}q2ChuuzJbgCGzip{GD`%{{r%V@Mw2H{>GexGNSk20`h4c zgZByyJcsrQ!_Co>ieAU;Cl*`fpzW8al??v?^8boQV=nb|!aJ<|6_GEnoXt8Wm6jJ( zj8aTcZ~3w%v0>Wj;OI|8{#K&JKS$(aUyexLBZ;?>M8};y7Qt>Iv<2YyaNG7h)MZKN zSGL7S7!dLiiW}sNk^dqB$NLK+|0f>pj>s3fSY_^i{I`I7sGDpap4y*){GWKVJ0Rci zCm!u@1NndA(e8+R|NrID{+CDlf1gLwr1cs4Yass*^Jsc#ru{z?`M=`P7T64%{({K= z13cPqiTq#lXfBJJ|6N$F7x*{^~8iQvqtiPt}PG|zWf@XCeC zpLn!I#Ln~7Z(i_=A3T~i-mR%*$JN4wS8}v(?dR9O@MsqyPk!dnhVVTNPCb?u2oO&7Xf8g7cHTryKGrC#z4>0G$$Gd%z91eC9(8X=i0fBg-^5;D6a!ae z1Q*;zi!v#9+#DY=RWKjaHz(iK0>Mv+k5-UD<}n}6gGC4%k^hGP-@rmMaTndZWAvj* zm+J)@nP8mfMg9lzoH)l`c}kj!E|8a~q)mkZk0sIIlW3r5AZQY;1K@6}5>VUkzmb5O zV1#bIh_-|eaA1JEy1Z``43-QAGbP_2{}N=3D#g=p4hH~b;K>2RKEae+V81~~tO)pU z-Xdxd9Gx7zZ1XE3!$Clpg}|M&E%7T0{}UTp;|LR67jhCP55<}_|=0! z*wtZeiD4BSID*x<9ZldChA;z%u)#%rz-0Ic(aYh>a3CEX2oOH4!97qUK|v6q6BFS% z6|xYl{IxUUy@q}R03fXqiDHax&VT>_1R-ojOi@PdH%Y!*K;xxE-a;jFdLH%q9J|5$ zk%~V0*>2QAekcl~DX%gvY6t{5C0h498q6Pqry27Lk4Cx_^I%VJ1Ih;K2_@J3Esq8g zoWG3yg-6?jL*llnVubqR*mvUiLhSC4v^yS6QYBdFQM^<$!4|6jd&H=3xUq8l3A%xy z8u@W`ehFlBcsGk`m@)~yIq~{;JerJkXKA1H%)@m85g`UHCaH$2+OR@$h{vpXd1Z}VvUnOmAa zc(k;_1pU0s-G9WRvF^kp{)$J#Sk7MF{h3E|dorb&^Rh3oaVd&uIp@uk@e8V?2fy%W z<_1$vIgHD>Y}dI8eVNRZZyivQ*xlaprT&>mOX$rlrO6Zd+dP`OTfW8}j|R)vS^k+v z6DTm$Dlm2{FikBmhuzU<1=iOEHpGQ?0)-A*g-&jTE~$lXutE>>7ZUrBH^dKoLR0*f z3j^JXf>Vn^VMWvMfuvdGqK=)SaDn1@V$x_WGHzM1B$!B=R&nNaaW-*@bbN8HR!MAcW4G3OAeb;Ws?QPlyFdb#Ri8pOwPU7)q~8yS1J-3Y0nRm-5{& zi&iP?UoIQJE_Hcwp+V#+n|E}Kj(Uxt-$iI*?h`>qmKYzkCtX;pk&W?6Kr*oRdd zE?0cIt~fR)tbsi|9p*omCA)CLxgxH-U9S9oT?rtmLKLh5YFD8!8?L)mp|wgJaDgJS*gjWt64*? zy|W~6|KQOM-q5+%3bfP;t<*lgsTCoq6BDeH(5{nmuY;!5$+pzVuhc!gsZ%1UR}rjN z)2>%{uh&Sc*J`QPS*h2%sn;iIFc54o)NU|#Z!k@3FmGwFTxqbrX|N$_v=eM}&~9{c zZ*)m(bW6*pX=(JjXMx2V6_Z<<|frmbg>OH)m=aOmNrg>a_luE3V(T@a#S2%V)IS~~e*PZ|$ku$C6N zq!zIcEv**Jog}TjE1Fpre4ZqYJ=(2Fg9S@sGtzPVB5T)(wy9b5jiWTn6`zR zwhcH*`=(%fa&4QNLA$GO`&LW)VVe881@q^X_7lMlIK9_*gO0Pbj_Wjgn&yu07LLuK z4-sxVfI6Kh9-XM^ooKC{7^|IFx1C_pE*zmQJe@8AkFGB+H2Yy)&D3qAw_OxvC5Vk( z-ICpW+g<5|9h5@)bgkWN>B6kH-CJpqoEX_mhXfq0Z+LZjggn6NOFbf^s)FHy;-tM& z9=%YOW|?$)1`Kb7)?OvjJ{6%pHJv_nk3Nl2Ud8l2oz*_Q+dh5LeuL2}e$r>!Lj9)c z{hgZq=BxeIxBWJx19n0K4mtx)ma<_k18%JYEoMO;tB*}?2YiJF{dEQdJqCl*2Seel zgW-p-VwVTsp$)|f4aMu+?VpE|(}z-9htgMvGFu1D_U=#6$5`GDrFC1Q*M?BV4B&A1 z-GdAkkdBzpw%{;~u!#4Je#PMz&2DHFs9GJlR_Se?g4Cgpx}6U83vqQHg4us z>TPp6Yjb+v=Ja)Wp9$kilFhSwGJ~z=&D-WJ*XFIi&D)SIh$YV3=`J{VF1TbYxV0^K ztSxwbTkvLOenqxef70Xcxfr~b6w*FKNQhl|gBiFTHsGv^3$*E1I7wga3px;eS^&{-2Qu{u?WU(g@yo-jXPc z06@5@WwNjq0ssWa#%GXuONwtCcBio+v>$!jIbJmIm^eJj3&XGzkP`C-^(1{h`ta6MJ4nUg-70{3}S3^)-O2k!GCr|^Fx~Ow7%r|*uHwpUr7_3#}4#vt`|E0N}6CSc(XJa+3=Ur z1nr8v_5T@_K{wxiX8c_Gfn70Y@O0dtD}z(Iv&GUy`|5X}w^iIxMB_=lr-|5Y|F|;v!D3;Ec&wjwle5-&yDZjtqi(rJpWfJgQL|Bp?8%*s$VLDgC;MZ{kAe#M6LT=^w(n} z_|7yj3tIiRlD%2e*ZYdJ)mHx* z!;3WIzf^7g&9U(xxwbsv4(B8FtG_!owiw|UdL($a{5{v!e|l_GHj?|hs;xhm?7^Ik zqwZW=|7)7~JFcyN)ij|XBk&ilt$)chk)aN=`mJi~cgDtFR9pXpO%v+-(VJ8N)1O^i z|JXF4Do^{zO%sVlX$}7&)5PCS_U^_;J#`Y!KfAX6KOY;9hOL@=S4fa}8}CdLver$j zuj4IcW?4C$-riVmR*(Slzz;d0log+!R{s2c`!wF@Y=r>OMkRG`N=Oqv_B=l4^q>H} zzH}yM`*Nz%y19L)+Ui61j(okkNnW_#yjSogT5)x23;s=VNV#3tYawvE(@GLCHrgB7 z)fx?XGS~V}Hq`yypIlqdFQRhqW$*Hn!|Y?m9r9lg?%k7t&BQRD7e8s-SAWemPl+zSG}%IQI?g0}pMQxCyd+ zaQ5ZvW63SW?~t#L^@u2)3shXcnb02&uw4h?r|E-1P|B$V2+siI!@ZaHnv|ZI@L&@; zp+US*UfSbpym@}&WO>kAl!@bmcz_r76$>2JS7n*YHUZ^~N=)vdYFQ5@>u-s{))G5|~niIWb{3AQG6 z;Z$uRcv(b4U+wfF7_5ls%gPam-W90(E7L@vpTC(;Q2YBpr=Ls{I*X1bO%#5p!FhQ8 zfqybhBvZ@42ZH2dSfjfABZ5`jG=4ia{teSa3t~vsFQ$p)Fj&)XOcTAR!8IDcGEEFV zAGi$vVVX!53DAhh@()=2Z!}FTMN{BJVBL?w;g8{QiopBXH1Q+ZyNaQ>GfnWv()>lT z_q(PE+QENhnqYi(#+#t-nxK)Apw*n9vy`BB^&8VfLyVK@f0Joq%s3|XkD4Y@Lcmuz z9mNm2uA+LD(ta^b*wA@T*oI^RGZsFikNz-C(54RwEj0_R+?7%9OcO&fYw-JGefKkA zCciRG@T+WJWpd_4oGeK;Z1|n0WOWl|U0)^L$tC~-&=2>2m?r$VvK<&RP+-}2$sV0w zHrDT&CS;$QUolZ$b5akJ(z@Z$U+4T}n)s3I{n<3}+hp&~G$AICCvlhTF)^dL{bZUz zqk}K~Y?=_D2W$PS$=-6I*L9&cagnb;k-t{aFUejwe7Pv{x+t2sI98TLQJ^@{tvETg zI2Bf$zWgKE`|6vOEl`pdD)u~7w@|C31XfbETrw0>QbAl=BT!nWRodWI+LT%fgO#=} zmkuQ4wiB0i3zYS0mG!%o4W^b2!^-9o^G3DE6Ryjq1Mm#<%! zZ~T(%xmE0@{#UXWC+7W$xbj4x@=UApt6Sw|YUMTTuaZ6YD%6#y^Qk|Qy(c?m2%u^# z_bPPeQhdQ5$)0RaIk8|Q;YzjoRW%`1jRa-&go__VTFvfYHPcEB+f5BSNv(@f4d;(! zkC}nyKalLTGP3n$lYClD*a&IqsE~yI8MV zu(emawcovUFs*gCrFC?rb^NAvlB8`~ux(bmZQi|YF|BR6rEPVkZFZn$9f*$q%flG) zhl24FKo#_-JO%j=DHu8H3jc_N`X4`x|F0<+|2I$hI}YkU@-Xg}koqeL_3u86{}~DO zfBIqk|1$ELB?wRvk_*HGOlAS@B@?*UAp&p!BFq|McM3*!mIkE_BzmZ51+ePQLA{~I zR&?i}W@jY5%|?~Jj04BsIjGA*KtCMRxj+EB!w&~_EdKPJgSsyG?#6M?15U%B$9E2D zI5J`{B{3xEp5*`}X|U(#s3IBKcb_U650OF=vGivNHFeCga+KSw?*k*DSHx2qQamNq z5f&`3gjb<=7wK&yZMk2Oy&seoN>z@0jgd$4xk>s-`&{!Q&HjZAE@cg zq-EIbq7!Fd(UG|h$)3c-d0HA$N-xPMc*VvRgl{qOG7by*o+O0cQZwsaCqsr)E%@lBL=RdU{R!zCCE8vbWQwnlZ%^g3B5&UMR>=!zliTJEo z%E(;JY+0=c%dtepvqZi0&QgmNSE`?}|2#uLy*M?YM1$5stJ3^gUFM_Gm!73s+spI$ z*3ZhM$1HSrhUaUX9Lt^aE%eu9HJT84Dgx#X^p8SkwK`ApM^5iOI1TCdSD(*Hsy8t{ zZ(ee6a;jlQE;mNLUW!aitSibdlTa*Oo;TpBfAFo$@};2G2z)xRw(;E38gqDg0oKsa zj>%>d6t?n?;Ca&kZH2X}fc6JA!sdx*6{c}=YrE=6jV(u3qG{;5hXM;NYulfkYUS2H zhhD&T>MPs|4^#%3K9d`^7VyH82PO9BQhm~2d+`n_=up)Xe5rrUi6FCKPH-7_56e)% zC`8}+`guYnhRqxJ$SC~5Vl?Q}N3L`CakI#oo{h3T-wXFKtmnzSL_AgerT1TmM-rt| zSns@{Z8dO8)X3n_+X-S$Hy}Y;?0Q^4!%vkBf}?44K4`BZF`I{Xbu&5otl%x z<6sIw+m$#~ogs4M&JZ3`iMwu|u=~zc3Lip~Nxsg_@2|^08r@MQalk_i_OH}dICQf# zz$?sjs63F_lX`fQD+Bf}`l5NDEzZ4=)lOexW@Vu}1Dm|El*aRBKT06T8|;f@s0zST zd4@E*hGkW$mpA#b5J3e8F$7UT(h|%X-CTIy*9bTxo7F;1-_R`22Lcg+2oyf})xEiZ z!LIq7leG7UDfYxMHei)_Wi-s!eEs=WQg#>;TMyuh)PfkXCr{XP0F*(OIu$r+)t=m6|6a~m!=1sn21Lsl`>`3mE+{d=IEs^$&coNh+I<^>@ zgueA&kCjib=Bc$vWDf;#rOP5~g?(mi42DRwn08M4=Z4dSPtH5Vlf@nbZ{O-hmZ9>C zN_}}R}oHO6V(J8p#F(xTuiVS4KVkzbwaqX zzDiJG003;4TRSxp62Mt>JIj+^t3H>?G+gRJ^BrB!JPLL~s>@bVAb^OXLFIc8C7?oE#bui@m z8Fpf@q4BJP*{sc58$(6kEf>S{7^V2eNG7I_)I2Zv(&T!is0xw3zh5-)n~&>LO95xt`pC9xMFa6iVF z+dtMjW@s_`iwP7r8TfHg3Y-E6SO^vE56&lyCfAh0L5W+KjjhRx$xrs8ca^GSKsMHV z<>MbYWh&P>?1=TxfsELOOP-#+z8iTTrR~} zZ$O$pdgr{)o?6n^jR2eh53C)7-3Zq2g{Z@XSBx+(gkX#R}QT z-%KMgOfJ;OE^(pC1DPH~XKtLlXZJ^myg2;MGDo_%dc?0yEA2KUpRC>#9Exns@t(JvB zm~~l)wpXl}V}`yPoN^A%ejAc{%9yrcmbtla8aBVsXZcg^Uz_o3dyi>SXYT4aMs{8*<_dF3oJ*ra($q28|YWOf=9=1A8?kMTP>D zN0F;smHTxzhy5Z4)Q7fC4Ntfr)WS9R3-L{RK|eUf~hH7S{ag|z<|J9Bc; z%_d{X>@Bp@zY|V?OmFTXZm#@dFmvD418F-eYcBvXJISj#iR_C8niANH9stP(A9G7e z;^8V2g`-S)A?V{68yiROv7b|zpC7YiEJgz+W6#tLy}8{QcBLEK95RaH&{3R$3mTon zad!SLYKhQxK6hgp2ScSuUs}g{cAs`)7i$@mGIyV2TDy<5y zw zc%b*PVj-<9hl?MT0Qkd58$e(2j3?uW&{_f2Z%-{?T@E}hiLG9u*rtWe8=TU~Q{WOD z#C;jqLW?ZnuJ{gJ%h0gBv#~AhJm@ruIl48_r+hK}* zBwb8=n=)70`pv&!xur`P7C6%U<~*&_7}jxE)i&YU!7Zd&Mqz@P1f*ioeX-khG3%gr zcX$Tuw{XzWzmxct!uHjqpZs+feR}Uv0a2=<#5w^VRF zs)+3qGZ}Z@@=%S8G@H81*62&A3j4Y^T+LF_fzYO=345Tu>fyLL1Nh6Wyrm#?^5FHy zbg2kpDECl;$=2kdP2EAdNh*zl%S0?1x*q`w_9ti!&BL`$3c`YO?&pLlp=s0QZ~phP*!38Wt4O-iM|L%j8AhEE*=E zKB5Vf$4dH;NdK*Lh|X9UN>beLVCXX5d@8q_=Ez*&NX$|443o#aoro?!wNGaPB0m*gU58B?LB z9wr^(fNj2b8?rc#y@Y!I1vBo+5bk*hNw^8nF7$boB4eC+h+2)6l#xQrd8cc}L4_&J zD$9`@Q_{GZq4A7I@;#1LD^F={I#KDqAW9U9r?u9QTzH#I zb~=Ji?qT{C(mju}G#_Ft4-J}5{LHMq%XF2K3w-hRm zLB!jBJyc8b)Syq_w(Ko;fV7*mseTuRLpcv#1E*FoDTl}xA*GpMj#ZqkHJmAybzE^( z8s=K01%rN1N0y8-(STB4T4`ly1>3o8LQ)vBu7h2#52)06Xk6+naMe!D1e#Ww6yY$2 zHFV|FHZiVlDW~e~S$Y#JeOVF_HF}`z5_f%5GfUJX(+R`B=bVuQo!CrFIdhEHwyi%N z5+g|{lb#H%cWTsohV)sjd)x+iaWvU-Bz;?B&U(rON{E5{9 z@M1)iyffJ0lbyqXk=iGRbKf^-EZ=!nPrX(Hr6Wc$arAaRqHwHHPqmPDU4UX*=-y)? z$CT8qKO9U;8Ftr9tWbPIs^eUADbv^;7o~Tt_C_k*0~GxfH#x_jO;@e;YU5eJ2!2QQ zb|C$&V#ke6@|(6c`s=p7^d#i;@91}o=X?3@A1z(3-X31-2P>973HUZ!tLzQzn{b!` zdFEnYU+3j1&>IjxP8C4anO4k_cDY8IyS_NPUVty%tiW&9@n zn_>BTJVfubD=y_QnxjY1kg)6@MJf`vYr3~~065S@W8Kd7t4r@D@NQ*9V4cBSXne0a zDkfF0#_@(I5RJ@>)XxUjm*ISQ4v9i!MoI-SdePkEvtfT23F|WVeMvxZIO-$ERnE8s zZ=i5KA8@*)fFMZpsG3BJJI7m@7$QLW{5ASyvQh|@Je5A~c%-m`Q`xgPy74sQIcq~0 z=c}F|2z^aSpAtYc95Y`>QmMXD+@F4BuPj(qUnZOtzUhHJ|1zFNIT{s!L#xtOg~*`Y zU$(?#7)OqL%atMEC>vBn#w24U=lvuI1ec$2g0`pu=9RdZ~94vk@kg0p)^l7c_%{_9xTbGmVu`KBD(`kJdVZ$X|T-xIRC6H<0xL z?)Cjfab7MgesrI*D$&idw4@WMmn%yh@v2XZLE*N#a|FsbEz2yKw==|mkgnoQnlj2UPAIO%jz+=W zgUg5kYONlk5{-}U(mt#0;hEX5 z>%^tKQVnC^aXgVzR_30hRI@M(lHJd?JftohM#m%@;F5fnp|pVbnpIUE z!7Zaclb(7}0-(Z6!}BmH5T8PY79>=w&dG_y1wy*FrpioIJq8{$E{#{or^+aAP=E~C zn9BO9=+-9Us;0|!tNRf3&3h=~d3WM#-$u)dADAI)TH_Lkpo=d^s!sde$HZ4fLcgvT zfqmbGh)|xYB+5GqqC{61lK0O(75Y4TS|w=m-Lw;%k`>(e;=8R?Yi9Mq)lQVZ`ccw) z_&nC$9?fp~4&%Bi>`8H90SsMLJB4}AXK-Xe;- z=DX#zyC1?hy12}sWji(<_ORg)1+mbndl`{ZU0}Z^GcmS%mqEe`F`X4w!&yq%k3B6D z7OrI%_c_7=N5m?PZou6J0nM4fc491)Ah>r4fs8r`hd%%90NN{A`_|{YAvWP^Pl6pL zRzifRd-Ticm+|gtJ2}UNz8kblj@_xLij-oMr=R8U%{*^g?U(r+F}vS>F@yOT%6O{$ zM8|spo9UgySDz>z>rWv2^~;f}HxGhWvZR%_g=%A*Ft$04njT!-ng{`b)-Li_Szo9& zQi4YF8HqyHG>dXOQ3W2tS?oAuSdRyI5S{$#L+xe0t7#-BLi=0@<#myHH=|4Pfc_`q zSvM7StRM0FojLN>4vB+0!qZJ(Ti!?Wa~Wu1^r>R!-pbY^vIiqw1Gz%(OUgO~wFHA~ zLiP42KHE9Qnl_u!QPO+>90cMaKHlNp5M7bBK_Xp7HQ}o>3lJ|5Nptr;GF#%*ralgm zDh9F;PZi3XvY>4o8@x1x-8gntTCt{Q=+C7>#1QutWB?8+vn&!4@^Om^PBMh*RT#-7 z5W4f=%_dX5V(lJynSx1bkU|g*rN9(7w2BTlKx9rfrMe9B5y{!;tan^ec6iLAjs*F> z_neQO?;9~l?t($4c4^n$@`$;UkXN5LvpB?P86UdJ<~kTBB(qG4V$#Yvy0K*AKVlG~ zcbh_ys>SccW3Zr^En|kTAgVx()G=_zqa=LNf!B%bn#5zc2=DWX%g}_iC_w`O=WJ0qt`lK3@K$n4FBV)pp~WZG#FdBP!46?kji`VCd-y7d|S6ovMQ`BLAjA?r-{W=M&-tZ@@~EOWeedZep(RF zfag|Wsa-H!?Y>%6@?-h*VOXA=5}u-MY+lh>teLPc@_4mDi8^9#A*Zr?zH>XLi8u*X zTg9vN_f>QW1qd04dEzVYq27%uuOi%%6Y1wJ31SB%t?d$8bUyMdG*1LrJLIoG-^_~R zc0C#sk&l&rCLn>USS^e5ye58EWCpf9_KC2MxoHbBOKBn$g14Fm;5;{Md&KzGJkJhi z($k-8<2;mOts8<6?c=!nZP07Qf_Or*pXPk`q4Iu z%wE1J%35v<>TQIJJW3pPbX8Qb?(j(^TU3#5G--Q7Je1VI?Qbs*wu~FQ7vJ`jajZYC z9NlDpBH&G266B#R8_HPgXYChA{++ZHhWBKASi`#Z9gD-Bj#*r~?ks0gzA1i3ol%d= zEA7HlI#wDL7f4sPFT3n#_m~*2*rKnoDOJb zg**4GtmEIEhJI)C)T3kN9Y)7RKk1fDtXP22X@y$L!5T#o5$PrpA#>L$>q!)sjsy;U zY@c#FyLvSBI^{r<*$OL_RiDt)eY>XMja0g*TBj{WXFeUrr?$bWW$LKXb25!OXCz7@qP#_Q~hBuiJL%;QZaR?Z+u^bU%E&-O@08D(T`3J-n?@8b`9G zbos0!A=(I&2_ENsM7zHOCB7MaM04z&2HJPM=bGDZ8ck75b1e5-U=g3~GD~&+kY@mM zqWhKfHmaa`C(oE#(W$Eh@tEoAW9R*69d~Dd*3T=0JP(atWY)1NPc{sEJ92!}zj^`J zyJ)}n{c`}h$0qi>yS?l8FXZVSADKI@+IQMc^WnE24)XjkWqd1&JHGAh9C@xrJ-)D- z2vzP)@ezc)xllCRee$;BW-sXbB=_fx#{};D!~9Tr=kq+5C(EG~SSDWL&T7b`3v1QqE z$3aqjnM7>zQyoLA&1=z6_$E5A$Ml1G@25O&Ha+6ld7)ifc;t$?! z97Szql=Tk6B$?nGOZ_&;L@Oti6s=<&N*|7w=GA^>_Xh*fE?n6z($OwD(Jr>pE;-k1 zKvyY=;8`ui#(E=5np7uEB|9(DvGTG?&PR61LRK*)a#}^QhHpD{59D-B zWOYsCjI=U(z`*l=CwxfM|wX}{w@K_Ejx4_y$Sdb*e+PvjH=HH&ud1_H;2Rd z9b&Q^9RutyB+i%=mhA!@4kVl~y6^46><`+1OgtUiy8oqMlr8xhCTE|Ybp85 zDn-9l3Y_RkFi}c$>`nUCo6M#Z(V-Ofu{UBtDg8hx>W5M!qBosHIn$>XA*-DHtS@sw zDfcO{9@CejrJUuX3=iphdYf3;SB&UOO6e=wQ2O&xIrX8h#H8;}M_-kwa;SyEAtC>S z13~QoWgR_1y-8RNMo;5Lf73;OGsZxRPq-lMz&6uBJMTb;>_Dg1K$potx8p#M&p>a? zKp$eDzj9!pV_fk(7NoHxX1DVIzH7>m zOA1oHO|^V?=(uI*WI=WEMzxrEc(uvbIp!+4Actc^!shzVGzgf43kyv!bbwK+AVlId)CR&vvQ7 z@pp`eVf+mr9yi}OiuaY~#+-(L^*GBXO(D7QQ?>D}JXPUWVRu;?XD;I#@b{-6?^BF1 zX}$>=xd~bA2|3dVd8Y{l-wDOo38m}_<*Esl&WX2^6Yn-BR4*sq11JB3f>DESQd4eH zOM6n=bW+D@QrCC#L+qqp_N0E*q(SH8$H~c0o0Ep5LtST+Mx;|;7^c4RO&QBgnP^X$ znodETrp$b&%wwl4vZpMormQ-rzD-V9Z%)}eR| zbA_FAMU!*In{y?XbEUxfGSc}!4D;rA6Xj0|M(z13(|M%Re6{a<2nVWEw0p>q1$(%Cw8GXd!estp}%usU~*w_ zbKzeKM&RPe)7G0|ag1+qTyAkfdvVfqams0N+IMj#c5ya)ajt4{zH@P5a&d8Uap`gq zwG3QZAzfN!SX$#-T9;ee&|ca!UD|S5+V)-A`L}{`uWD((bLn7m>2P!D=yK^8xO_so ze9EwV#{C9Kt@p2gjTmg`+pg~s9 z`B(mtU%}9MQZTMy!d9^SRzPtp*f}dW$Q9hKm1k2ccv~y@S1SaVtAu2$M3B|z{Hw(B zt0X$Bq|j9|*ebc-Dn;Dti=0(T#Q+A z*C4PpM!z+txHaaSH5TL=Yu6gv)EfKN8pqWdC+0dA**Z65oriz@jr=-_S7)6My3P+< z7w}sbj9VAVSr8Nj*^q;7$ip@i{5BNh zHk5KUl#v@MT^nzwHr{P*s9tTn$J|sS+f;{aYVdDr%5Q4vY-&R{bzqyiew!cSHuZ8g z^^uzfU7H`LHa~4`8eVOF{kJjanHgt|Qp+{S=qiw&Vow%djoTEMD(SFy_!PL>=*3r?`(ec(u z1t0zCk=hxi?Hu3nxz6z=^!N&PeC>C96L)-@V`h|nJXdvmKXv?f>-a5f_7U?0Kz@S8 zc!Dl)@{hs^hVBW_>;%*K1k3*f6n}!9dxBGag4=!aZ2AOm`vm{`gaGT5ko=U0@$|XC zDY3#SiS8+>*(sUxDY^eCMf~ZD+*8Wx)0f?+RMV%gwoj?APhVr5fyvKk7|&=0&gc}r z<8NBJe>$tN{x0(4>?YuhKKG2J`i!;vjBWaiefx~#`iv9noQwRNoAI1S;2iZv;hb0Z zoX_l>-}zj?|6DNsTqyTkxcXeA`&@MTTx|PX{Q6u1>q3(JLW=Q1THr!P;X+pTLeA_$ z-uXho|3WeTLMit`x%xt-`{M2N#k=hb)$5D*SeI(#m+Fj{8UmM^3YS{Cm)d5RI?k86 z{+A!(FZFUS^{X!px-UOYUw+!YG`zn2jCEy1e)Wa%>Z`!jQ;ESu_sZ1l3hI1i=6_`# ze`S$-Wm$b?)qVAC`pSCy%I5mY7VFxM{Mw%J`n$ljgTl3=?zNNIHO%?i+5g%l{@OM7 z+O7K9z5Dvd^!3l}Yme*eUsyMumkZv32Y{L_!xnEh`8b8mvG zZ-Soy?&+J*?VGUcn{ce#2=d!V#@i@?+h~Q`7~R`gv)ef5+j#%mg!tRU+}ot;+vM)s zl%q5IHj_R#gY1a-CP3HXnijDKUDgim`%xqt5+|HrV-f{(rb z5$lw-I5rwg6m+m`(2K|&N|$_nM$1 zocUTHQ%>Gm5F2u5Etut+W3-!Pf}cWE;0rBPDGXd@qTc#aN3ol}fgmTJ1& zI=Lf$v2M`p&-94P^F+oLty8{nt(NmRv(7qr&Z1IVs?${dt)ggi`jG+xh(Kq4VtStJ zF8ywcr<^rEqG0r36gIXwR?_&#b}ZK6!) zve5K!_e1sER7DeC@%zI){o|y`T6|=w)4Ok9&MBwc`T5JD2M>%<`eVuBl@-B@2d3{0 zW*eJeRTb8UHV*gmWpT*rNOlWr*1A`hc?#@1kwo&IsIKa|%U5=;1XL?n42L&Cnja!M|-dEB#e3GGG4P z`EQrCpEMb*M+62p_XmGfMdqeUu8z+)euwjv<>yqoHr?R#Of#?br z=S>^&*A^=7w8g_KK#^Uqy_ z_wJ+fO;;7a8V^2k+%0T-Tr@R{_5GH3SbEuf(-Yo!;&tq{HNA9O=kLt!W=Pmwsyp^* zbSDXs^D*#8LMJ2(4@sjk-~Zc`FoYj&nVAV z!P$EU`5lei0XyDaP{5Yg`G<|5gSE?dC&4G5pg(8s_o^~KTwMp(JbTJ%yWbT40U-Y% z!SB~o0Y6cBHl84dy&M}pXNMq=LkP&hs>k1%$)Be?06ydACK!}C<9BEjkm(=fzY}mi zy{u9|TyF2k_PU(JiC z1%(U1!ny)N!k|zhB_|ns-$VhZ0hiMl$ePi@(X`q*3y#e$gp&n#;nDMY^TH(y3{Xd@ zMLRl23n@kO3gL6j!X$U2WN)La1aKnZz$7)?0IV49K$y&Jl$_Ahr?HiLV*{M@weFw_bC5p?D=mAi6zN=_K+6GvOiJ zQFPP{FA)RlG#*t3G~+k_sbe0(m@s2bh<8ii!VGZhjhEGpLqCmEs>Xh<7U7&2k6soZ zu16T@>SziE;FN{`vzm~k8y~fmq#}?Q8)zQQOqh9_81o|Obzma8T9SJAQ;eIyMJMVb zR!W*Pafhq1i5(%f1#X}cVUwO?e`1OVB)Kl%amqCrvo8Tl=Dl&!Rf!Z~9gE=*W zfjhIQ5oRevAi%_~V>|=e2wA#P{EtI^Oi3fctg^s<@}G6OZXM3gJU?V>CNZx0TtbI)hOMvsifWCY$OrUP4XVgw1Pm2r^Q?p2-{g3NYQEC6a{ zLhxSt{Z#~8Unb|>j|W)hi#vFs0{rRD01i2}Iw3ZC22g?$AroW^aLbwyAT+x*Tr|VQ z_!7?>2S5j-Ay#nEC9{hoe#&%bs|gc22zh+2i&Lovq7#L>-V$t)dze9@Sd@%;^n)#g zJ+zcDlZ|p=Ns%sYx%SL}RWkxD7U&u?A+jagUN{d>X8h4E=cz2@=-HPSJsa^+*wMuz zQQj=aWGc^(h48y_qUSAv&ukbbc5X^go{(VvjDV9dOT55VwtA4`$Dn-kz5Kr3Jd31) z0AyaGaIU3tc0CJW!%kjopE-gM`j$Lp1V+$~Q~0GiC1bV#rB0^*I?I>_Fv?9( zhN{G8w+dk*_ww@!B1YU2R+I8RQlfni4AGlQ7QifNPRdJr0YG2L34!J4S7W2C*=o;#r4O4D-pC}`#Lx}iwnvY z6ie?8dm}=~7Yq|fuFx;5Fk&ue=*K59D3!*=@OG|5-gxZo2^{er_#Z4>pMgLMQkW;GxvOxDL zs^L!ygykgT0&r@td&ExQ9)$1!9)u7KgfRLeTHxFbft?E_ALgHu4TLVcT0FoZt_( z)(>4G1Ab%I?dXIZ554U?&+HFII%QG%c9-xT7eRX!Wt`-dl)^oS-Pl^}kucQDG;}xy zswMmPUWkcsesV%M4qn;@ain4!TD5doMGN}XrUmbuOo@Qcs9 zGv$T#*RlaRgrG|BJal`<9V@g+T?=V>RB6yFX!fjcpb}=Q(old-U(!GUqNwkfD$NX%-P2&aEILwE z*ZlK#81rxMiL!A&#lTiUqP)VeULA0&J8_ySY4#x)V1cU<0r(zV-zJn;^Ub3=1u*+S zkP=u*aagESHp+W7+M4oH2?YntV+|UN;7p4GY2S^4j7B|Oq5aIGg%75yjAp$9#vVzI zP@K{Bg+X4O5nK8Gi64EvRQ-7DDX9%Z`i;%FhXgBqar3(UBRa%^Nlvl%q4anYyj#%d zhf!^oF&F0gWcavkEw*~ZC};8Ddv+l8yX@!SF?r`9jDB;U!!Q%&GHATBWE zj`~Q3ehW+^0>h9ByT}tG*1BAArTi~)HucapDm6W25SGmj$W4U-gD}42&plCV#IA@J(nTR3F>P&>Y4NVQe0e)Fn8^L`=BzWjKc-u#7oM;GR(A&XIK$p{&sJ;BpmVbW}X9n5cy_mN1W_Yy>rlOPKjI5*MGW zg>AKdz}gIen3We|c&0{v7ukz>0obbE2wfWTuiXte+6cBe3=4By4UQ@=-1JE6yd<0g zlgEMean}KHC3qOv00*#D7ds1J7uI1%bxetKEU9qJYk9a>5;No-_`k!}q+d`EQc+;H)gYMw#bE(oJ%-j>A{!F~m zu0672U^+(kr(;^@i|Xy3J_WaNEJtOo3H@Ka_9a^mz1jVV07Itc5M&A(c=MDo1?^-D z7~BVBzScXddk&8Hh;O#u>w=cyjWr;9H@#4IO_Y-*uWw{&{vuJX#u=!3 zsM}v03*2I(9kkusSIhw0z=I`=L|fbmx17ZG=G3FTzeY(R7B&&FcRy#H2>_9jEfU^W z2$1>a@#jJSI&$XT?7g>)HwqHP%mnx%7lt}=qR;y?De-j1!a~m=iPNn^iH&?arcNgt z!H13W0Mww%|MiFj5t>KA*&|WBHU%}&E5mToUO+4lB+xT~26*z&J;Bh*Ey;%y!KLw~ zJCM#gO-|)x{XGJRZ8#91MkC`-IB!A!TLSg2lYPdllZD1*<|X11D2%t$o) ze1YUoeM_yz+fZ!-Cldc2B2eC?u;95)h3_wFc74a)4gDDgtcW_N7`Lo6mEOP3Ay?a3 zV^$y2KY8q)QI5{v*Kc0h8zf@@UKGFDGO6&7-PRvfZ8{`jBS2eu-k|!F>Ohot z@$=&e2Px{0FEMGnNx2eZx(|;sb1tG>nYFZoM}@t5qg;iv8RN}c?r!>uw{M1J-@N0S zHmP_guvIwW%tybN~_XoKj_UBSeZItuM*vp}7jwdvDBQrqLjZ!N6x4pnJyL zM*YaABjv#;6JzGp+*e|3Uh8g%;_Fb{tduK65UvJfE+$LruS}5!y-HhOT)vJpA8jWa z9`E=&k;AI2&w{T&lk5P=fl+zwJ#!X!icf60%-+7Snt;4_lRDB08I`nj#4;fUpMfok zQ@`l59o5|DVqr}0^nya>r3b4f^=w~mp0mMB+jKOoy{!M4{o+*?PhxY;;xd7;H;X&= zTUpuL;D;D{V9w_U71*eY`r;ceh1s?bdCEd@vDLv6hFWEXWU1E-@4D|cOM-0qZePa) zYfn!Xcqlv5h$~raYG>PdzzXA}yeknuWzgYYyaE|^Q2B*1{4ADVuvC@lB$*p^_TCZC zkSUeQ_*T7gV068;NLx0X)8PSt^p{eE44t-uX7qz>!tm#O^et-fTuso>KZn5W$ukuf ziuDVsvVL`HRNkI|WD`n01U2My1FwF`Y4 z+)&4H?Lr18w6bL7i~iY+&9eb3`@!#<;Sy=7Gkl{=UN9u!Yls_Ep#?U>a2xV$j*k%8b>c4#NS(&wh;!$iSO^kR| zSCM*rp(_MaEA`^Vfa6({OOj5tz1F$|ruhiU(vpn^D9C<&9$O;|;U5ir@AH);TTqT= zs+S2&qpI-iI|!J1Jgy7pr2_XQ_Yde`cMopov z8}ydn!+&o?(gkkx)Z<*rw^jP+k|u^QqSU+Ew0z>A4G79=4aHAwMC_i)0VF*6x$hbx zqoCiE-~sYM=?!P>-3N5^FLVn{$coJeQ8C!ORy>i)JgU(ZJ{xpd5rZ8}=SgF4`{|mo zi4Ay|(X9Ur=tdEeSSP82`Gi1>-a-RyZ)NGKLC?6{^&*69GK0}TG5!3J@)_T-^c-;|PL5VmZnm3)6VtdnJ zB!4l!URk~KpOc~*rIJ<5vd241>u4f-;JPUh6~C*o9nZERhq-MADuRX~CJ&q8=;BT%WYL z(w>ioQbCRW6mqJn)Ytl(sffYc)D*J1)7ttH17KF7u8yIEuS~wKESurL-4#Nm9p}yQ zy-$OV=)<#eN$>6?NeG%IT5x)~dv__lZp~aOhr{(m@6!{`&~jOuX~*(K!SX%5oXS4i z^$$UCK%XPeZ(BLvDTBC^DQk0Ax{8Tp(n+`Jklm_2y@&SC$z^>_B>j+gA85y1&iY#2 zTkXt1Yn2sDG-iN(6}=nNC6iAxO_ZwrQc+w)eq$TV&%vGBF$P2ic~`6&J5c=`je;<+ zOQ^o+K+}(gSn~IRdNPS4`dFQ(HxOK|$tfXX2 zXK(O&s^jBIztLvh*${UNKDKwU|D>{j85&rMkMafZri%uEF7E4jQS&NYyP_8LBij*H z@-avYA$|Z5cD3*T-{6l$F;)7#LRSw>zhv8SLof}mXucAu1P7|eCrw24R9u7dlEjEl zV8hIgyNYPy>?3-B5JQ?IIz@taR%(32wKN2mxkU5>5YLtMFX*m+8#nW}zyh+!682nk z)!$rWqw*C6PCpN<3Y~mb=p1)>zwcl@V$9X?S69~mZC^mnFCP0jH*AX8{>QR5sZ@Ec zE{n+<@a6T-$;@t4k|cuU(Fs>-E6US@cmYDCGF^{k1!5RwTRq=WWOE-dP5yzws1!oM zhhMe&8-&|U;K%YQpR(78CU*r%y#}~#h_QkMK^p1a@iVP29ekli^hId?6SZ9gv|P)I zAZZ?DPZ%tNk_F2)_d2Wm>IN7&(%>;Sh{Z@Strcu;=@AEirX_&2Tu&z&i}x!aMj{X@ zUv@Pl`>5(ANSE5ij~){Ueyhr)%_f-hez69!7BT-CrKeHk;wiB8)J%Ga&!s<2m%zX# z#JweGMaL_A-jYZgy1fEG~@-!+REXEd#)bc^zvMo*IBZ zxYsgE0kkw`BM6MdJY}W8E}{4mhS5_1L=bdP5)rns-Ktfxe+b=xOHn9EJYS8V;cc7d zYQ+;GyrrYOBbKI~WewUV!aOCS^>2 zz!?ipm}H*(MgWw)^ViHDp$75T77EjcQarkD$eUL`^0_J8JAUMM7$^RrB<8T*AirhF z5_9cxQm1s~t?)3Rl;G`DHW5-<3E&sRu_yp~U4)xywFjwr`Y3lPSRkCxI%-zPP&Tr$ z!>rx%Daj1&J=oEu(dcpTTVP8dnU~cI5BHepJ^Au7PSRcS4?lVvBRHiu0$v4G!qlq9 zUFlHR9MiQa@FG6;fQ*?8tONU3%eT*Tm|nqCXr}+9-u0&EkpR8}(jU1q*7LD)CP0^~ zZ_suk(Y~kZjKAKKB3P0tGHC}7jPh4bfZX8zgOSur`L7Enlzc!=;px#RVD&5tnG7^gYzAO3loEj8-q(5ZLC2#sHHn>JgY!J zi(sJ=Pkn!8d|h1;E_3HT$SXk53mj6vf*Wwgu;G*6yz(c{DiFh^k-d+uPVrB`+EAV* z?k*c>k2fo(MpbAI$0T3Xi;H2efax*>bafEeOd(ejO;!4WVMYa8i4ynGplc54m8*cP(ZK1*aST+&{;>R`reFiu8jnpsO?Pz2fYZ+RRg@a zQ;SGSzC&>B;&$u1s^{kQB$tgOl?_|pWl5gp1SDr&eru=b%tk8VtYhTr){VMIbN{sr z{Q5Dgp=a2Q1;>lRw+%GP!Vt2`7P5xG=1);o)&SAbgb0M>0V@Jg?_1^Gqd(0hG$bcR zunS31F2m7L>Nj-^nLVX|zn}ocKvj)^aIltLpTeN$5Ymbb1!#r2;A@P8-DMPvj9`G7 z@N0=BH3SI`ca%o~Y(&rSl_taVS@B_cuj_g6(Gn)66^V|S*l+D7u=D+yTqdyJvZ(#V z)iU)*o0US0;b)IAg9)F$6aAB%_t&3zY>TZJr{Uxzq0Jv!aV9{89V~MHL?l{HnK!1* zfj(sfsomnNCucc4VEv~5;FS=-O)-Nijrf3LJrlJ?TpGzK!Z1TH-?%f&jt25( zaAi37$^>tz(U8WyexTK1)+2SzZjSH_{94-4%7L9g7b821TS)+}2rmnudtyD8zmh_B zi$mms#R92xS~>Vl+M9`Izi9;KGtC}3zE3@Dh}E16GXIAmU`C=16j1fy&)?*HQaV5Y zK(0dJ*?H>MgE<&F0GNPYep_tNqsN?3moW)?N;Uu58)C)PuP~ZR_CXYpl7_DQ33bh4 z2gNFvOEVMdbE5|>(!K=F%(|H~mMMOWc^j-U(7|)#&jT+@&HqF8swsSICh2g#!Wvh3 z;KenhbvtL7u$N=2CFc@pf)s4LpQ{M&?sn`p1;e0eP==3tz)q zI8+OPJ80;actLvgR5O3V+aCBQ!TzNI-pZQ%PKCgOyJvfU(l2YlIu)O1hy(ylNG!|# zeha=O^~l>|1@ zPmky2e}Q%85UYH9j`F#WA=<(YsQ~5#i@dY~g|^iFTJaGweEvt~xnLKq7gM0wfsBMs zU~F^^j6{tw($iD_c|gLm=)z8xcOY*%;7iR&StP^oOTma0;ntS*+@3Y9aP$QHh|{CI(>xLeTn~WZ%@hrul^?>u~{(+?sad=*h&d zkHltoB$Z3379^+DjGQuFaj_-5}Rop)!Dj**~n_Cge) znS0B+(A38Wip^5^n3qUU$$E8eg0bg6j5?27T+!&|Z|Y;gzQQF9p)=8pzGE+6${jvqTp(wAOEo&qW>1tr$Qi$b4Kno!CrTfmHSg=3=lluo#nLE?60C62ckzbxv zp|i7s2rl0|=Ab<$oGd6;l<6h{Bv4}JODqlJ3nd_t7TuRT4^2}C7r+#aTxko3)mV3d zQ}{)@L#Gim&}E!a47Z^0t~C}+^w23u^lIh)5tqGLxZty_BA_D?p$VRvHC9}l-ghVd z5B+wIkEdk%1mA$89Svzcp{C??a?N=8-m zh}O(1{)*{Zf>N$R*W!*=#baw)Wh*6*Cd9~gsBx6O_11hj z+T;~koLb& z2)~e?Euh$ASU%Awzm_7nw*OC9=WBb|=WBtW*hTa=&QDk;mi^x~1$Q&bvuMCUlJn1N zdb%OLkrjUSk`+MT3Zah6XWY+CqDJ2gTu|Pq0r}(`ZnK+U0f*lLE>7b&gi9{G`z~Hs zw?VI6gFoLyUEko4xduqMhUvP7Fy0!U)7btetg~8R*6>+`jH4u$o6_rg?dnU(&pYtx z(iA_j2+z8AaSYkyZi{|ynYMST3csMuZK!3w<7=iehAUai~WMAbSCicR|o>+kJ#0fXx%^^?m(|nvRDpm>o=y+^t};HZ2|Uth*ge;MeA=*Vyl%qfbiPYF z-VJx$X};dMMx59@t~Floli96YJ+8w%0Hsbu-F9aLr~A67Ys_EO1a|uZ*E{~Gj#@j% zQqQ?hSrC0#?kIMvE4H~x%jt6K{VVo`n(y0V#a7oPGr!O;&KCEp zImepZ{z0*`&2X)u+JlJS82;;LyQAnd)4tX6Z1pF-aWH)A@@8i!Qzn}FUE+z^c(!h# z&EQ?t{!E!!f62Rhq;*IB7uHM07J-xHw%^3BZ5jl>uPR2rkvM8_J>4A6mC3bf6u#P@ zt8iF8Y81ISUTcqjZA;C0cd<8JVSD^2_Hc8yJzi>y5`TQSyFNcYMoD<0;Ru4gfRrv^ zZ)}z)D>a_*4cLcBS&+t;RNsZh&lYcs+>%Os^QGp?Ibh~@m03;FK;=cv$-uW&f|EgS zJ8MV+nUQ>18np7h#u}o^3X{Ps{G03A!nAVqk@~YBvOsz9SQBkoVIk8`Qdb{hqjgMQ zm}g1%1-Po=SB{?43w*I#c?be7l)w z=I2Z4#*`VzQpc1PDtx!&(aa0n)`$^iX4X#N$j;YEftgxpy>!Ew%%j$@)XrB`cU{iU zkdNIfEP*D)7WBIdpv-OJaCj2tfuyspmRPWeyI=!>M`D>`N zN>+THyo0#68d~Wf3-CoaG_(EYNlQ9(oNQ`0!a6w+r+p%vjhA!ooK3fT^JXb`ncc^Y zfO`?HR^ZDYTy5B_4P5PbA`e_0M90(0S|vN(@){H}+1$mN_5*)DT1Uv)d(pF+^5{J` zn#9*YF{v~#^;-olXbo_#Z}Rvg&kV#tZmTSLdPH!=ct_=4{^T7a!?a?rWC*G!0lbfQ zF`H0hSeXjc&{`}7fCA*0k}S|hNoFL3@g}DjsFStk-X@Eg&wNB%Fd0|g6uQ!~!2Nh# z-WK(hc6suuk%WAR68~mZXi2+o_8a>vomrbt#ak<}xE{6sLD5yP@i&l{&RZ(n9Hv^( zoE^SR==h+{bFca8>V^FHn(c$~3hi)BG*EusfrYf3NMNK2@W)u^%U_~ry{yeY^iJyh zuUo>Gw;ME-RzlKho$Tj?&jH>+qL+)o65_X;$-l(!b_<)EGNb7>J(}7G*d*>R=YL5& zqHgz_B~X9w305vMrTucBjj(9kyq-uZ2i8*AF$+8NFXyZwFd>^vGOR|LY%Z}UqYU0U zr$$Y1|5zkVnGZyi21hfmjkKIlEJdXc-Pc$A&YIyn@5Gpae92^E3YWE@7` z0J9W*KT+bDOzr|9Gl^CNUhbG|;ahbvJ>^V|n&~#6l5Mcz11&{6Qx`XWz;FHCwU&Vd zGTyU3UnS->tuf$hCx#)Xq;oE4I^(Twg{_RSAX+th_gn{prJEZhi{MoZTMrL;m>^v4UPs>)GS#WrFS z8p|xxwPRH!utrwH^MdKdv#L^$zpO_8u+FqTN0#|%LuCs)UY9TV`kDPDFqXQVY1crO z$2GD+8+r5;okrow#jjOf#1zLNeJc~+Wmr6!Lnq6TRV6>!zZtX6&yFFH$VPS>hr;>A z%*~3PbM|)6V7_N^an)U79N(i=;wOZ)Yrvh!=dyVVyBgJXQ^0Tb(NPoerqwxwNgGb> ztV^d+)eQ!tIj-Y{OPA%Evste&h;}5pBXt2G*c17pZ(9DO@LQ zFj3zpZ zZIfAZR*Im6JaGRk{P4S}jA9%O%gdNemgw36C`Uvw4<*?}xm`Ki6%IDA09r(ns5SB< zCAy0Clc%t6|7FHX!Z6#86tUZgJB%QCQE5o}P2Fgi2k$-n*{+gi-B{d^rB+!%^KfK# zeG29q(qDQCG|~(SCg0TKMDcV!f2x}-@!%^mX5ZHvubV&2GMsm# zB69`l5V1YYbXPOR(ldFwhCO3WcLg`Qa+#y_^zf~_+4H9BCY0F8@APJrC833h*v)Cl zl(-(Ah-yQyaJtBTUUhYrp6ODOT1cFxDs=;ntl35mP$(#Ok+=D$b3 zBp%i|QMcnyz-hC@<9R9S?|C!o5hVe@gah!wXk>6SYA`wkj?Mx8hadirI2c17j-d($ z>cD}9U`!|+(*}$MgJXGsL4I&h7#KSaj-3X^$${gPfN_y<+$Qj|F8H${Fy0g#ZwZXQ z1;;-E6I{Uw9>Ii|8HD&WL}VF6)HKf_8P7RTG{pQF#Nsq0@);zmG^9Eiq=qzP&r==mwq@kvzg=Erl(9-c|(uvd3%V*N7(lY2|G8ocApifvUEh8+G(Sw%B zFOw;ZmN_nyIgOSjCzGXwmKB-F+CQOld&8ggMx2gUK8shCj!!3x&ybEEn#FHJCjiS5@Sqd)%MuKu6N<|c zN~04#TOB~qi6FB?n&?EkvP6gI#HLVLVoP-5TUp{qbP`ut!-I(um2qFT;e2zeWN1sFoXgI>`Op%_N56o*hsqgT#BD3{Qy zAQ37}^l!TmZ-?mLO(EVb(W`DDRFCN2Um@N<(yL)+tKl=KlVz(@GiX4vH8>bF`Li{} z8MNfHwNx3jb+WY$8FZl8IyMZtuxwoqh7W$(AHo>);GNpAC~gEYIJA zDZno;AdD$6E-x^RDJX}j=v{759WWTl6w;L!GQ<=*l^43i6tIm90ft;M{zJm^XEs4Gsnp1$EY&L>g2~7GRHyl<7}AYVfpbM%n5$^31Q5M zarud9%t<-=CrN+v?J#9tNipwW;kX69G@kFtRRD$ zB@=X7qyEQ{ew>5 zp~}{&Q`Bk5)&(uC_4pO_gt7I;74@dE_2m@xm9X_Ai~5_`2D*v{hS&zD ziUyb1hPH}^$iCJb6%Ch|4nG!+;IogC6^~N0k3ovZIM~OJRq&UtzZRzw6#>Ap%D?>k$eZw;M6KHn*DzW+k^XudzKv>Qq7(z50sMVD*(O5>GI|Qo{jU1pZ2ZD;*?yWFI}`lk<8$q0J&b zf?Q83f}X3KI%~$89trnlSCj&S2%#hxJSZG(or-u9M|z6=)*-JN%>)9rE$(593^RzS zCnhUn>kc=jB_tzrREw54Ft684`D=6$03ChKOO_sFL>x!5Ny5tFN&gKEqz<-VE@W2s zo0~9y8-sz)|0Vbx0G!k$3n0{Q?RW>4d~Wp3p9}*I{OqlsE4t_d@WfF=qlmuKR5-Xu;CI&^lstWJ{JRziZHk!Cpc-fH4o|%NHHfoglzw3KCpp~+~ zch-YlfhOyGv}q9#@TGG`rpe8lF zfcHJZ)$#g@ZA>OfV{VR9;rn=8uwJG~`WfR8M8M&<=sA6~i1jL!Vkj+ch#}g8dJBcT z9$`1w6XO{@l3LY9jJ{=}{7!)8T?m_aa{Vekc}KfJPub1a1ObSALg?WGjY#9YYQBdH zc+J#AYW(j1VDBxs;%cz1-GUTOppak*1PH-n1b2eF1cxL*2<{HS-Q8UZcXv$zg*z05 zyC=AZy1f1NX}^71&i(p)eft;eF=~&oYp%8CoR6q14Gjj1oK4?#v8pWhY;gKuNvw)V zFWrc8U&>ACfyE8{rR{9tPIpxzTb?Qb6GzDxu@j0YPJ@19XN2P?)HQ12q!~{ajo~0{ z+ms95H&*zSjn-RuB)pbI^H@{*U|DM=luiSZ6%Flfx`DXac@OfSH&jYK7=J~C^lkTl`cbquVvdJ-W z^-F9q^WT;3&6()K{Ws9PS!& za6@3|J>47eJG!@eP`uOMglViG390%GrjcFPM$;=~EGwigk*Wn2(m@j1#Tg1w5AC@O zxUdT)i4N_Dg$_fxu`YgtX;crJb_#+0c~PT|{$;kymt z`>^oum*Iyb5yzYnr|J>sP7#-h5!Ve7x3Gx2%Lo8zBr;bdP$Lr6ITAf7(nZ`)zAF;C z8X1NZ#Y`22sS!o=4`Uj6Xa74)BUhZV#$UrU8YRV>{10IolN*y#|KBi;4Ag|P$rYq2 zRa_}G8Yy+oDGf;}O^qonvng#?DIKJ#U0kUUjnv;^8V6@nhp$pcNz=x;(k6ewG^W9l z(gONI;j_QNG?J#TDs!c;You>F{{g1)D*cc&dJC;waQ-Gjdidq;iy zAMD+~^PutP{U}m(o%{d6-u+7l4eU$++V2MqV(2~g?$8SqnhB(n=)}}KyvN>UqH;j* zv3G|)lr*1^qep`QHPjdw=vkQ0ow|U4EMKP3l?T7jqM?WW=Qja34>E=01%Uw0k_cRc z4`&P&S#f|wC^{&pfZ|!tIx&Gy_PbQ*6GjJ-;OB+i;x&PUFNq)_RJs9DyIvp{5-^cL zjRYCSyB?nsYf2;DH6b_&;B}WZwT^3!;Qn@xSIJSt*C*)YSBao^4k8iALNsE#Lie=1 z2VvnQXgp6aB*o>9qfQI_1md9(xiZV>%vdnJu%wh?-7`SyDVQ+>ERj|c6;7$B&!oj7 z?bmWlPTIi7&M@`W@c2`a(P5ZZ( zj$0+`W%u^^5{)EhF^e2UoGtejO)$x$s$uV%7|JSMC=VKod=&jeVyCMl??W4ee9(S1 zti^YG~O|b_B;ImC~+b^Z3G`GUmrh6*_P77T5EX z*p!r`P~#|>9_}j8=?TXjPExBqlzi_|7^!QclGTLG^!Nf}z>O@Lx&{1 zs{icGUPB}=Kcp0!%T#2UyVu9lI??F^y70s7X`l1x_`&_>&!1^v8S%eQK0ORzdz1Y7 zEA&e-fmfDv9VOXd8w0+-E{aipv{asq&6Au_5fimyxRU>IY;JBzTk3N!V}!NCn~$;u z+LjE{wToxe2y9Ox2wWj}@-wy|$#>l#Cj3@|O6nRTi6_m;_H_JKb0JE04&Fbpq{u~yS^`RP)|WY4XKwt)=!SSTqNAN5PChd6zMukd6RD0<)&xm zGw4i(`^g0PR0iZlK(l)Gyswk4%KGB&*~;l~O?`mGS`w=^WgtRTqU!~Jw3MaDAhrf; z-dY+c@f8pWEsIM8lBgF5ny2LRfYPJm+XXLcQ!~_vy4%a)ON#K$;1`;Rn!K@#CTx8! zBOuX7cYNs7tQw8(v@-KzAQ+D}^AVz=v1Rt{fu{#}jX{!Y<{7eMuu%gQ)~g`+PD^C# zp2#jy-;LmI8wg0?{)}1Nby&swD3TM4%9Fzhuza`at-h=4TQxgemr*08&KVfUHSdSisG&k=lxo$i( z&t7){fr2wEGt2&`BWM_{nK9fT$~*7pN+6dzKMy1YcUE>!LMo?Opa>74(F4VI$!7-F z2~sYbj>uG=zygqsxEWx^12xJiKF$f@Z+SC=cVTE5Cg%A@)LIy#(|uuxrE5s1j?WD9 zB2aV>a0HRlxj&zFxE1%vQU$$5*Ck3cMjJDEMh|)gb5;a>Mji9rr2t9NnaAE8My-3K!QE~JTrbarzTF@ zdiy}deH}5tp?!?L#(l47zCJEO&}9vcykPo66e2)Wi9_W9JATf&4=R!^Ce$e22^67* zADw8j)B8Ei2v1+fR;k7-;~ZbV0wbzdIfe+3;{@^-`y6%Y>8$Easc0E}C|j_p!w(60 zT>uKZ3?_LK^5jTAvB&vP#k%nlq-1BYqlVwH{hq-w7+Y7VxK50}LEKJRzIN0kSOQO* zRTG#cS}|!0s{>7K>DPAPeAY3=#R~_HS%tA`>aS~~BZ>9UN+Jn{H_@6pt*f@W znJOzxPN|Kfm``4~4){f2YKYgat2ijTS)bi=?IoiiIGgA0u_6`|V95~rr;njN*qwef zQTDO^R{DvS_?;S8U%b3$KA~rYVky2OLU8!9Hbx70MI-CRyr)7^Rer}=8RsjwknVy5Xi?J#HK}8?l!ef z4;9s&ro_UXKjhaWVE0Al89T=m;{60lI~XXqpx6`DS&Y)405VbFjvt3Gp~V}zgQ%SI6iw#0{2=|6fUaXHcnbVbAqy@^S}*hv5+ zz404h#duN7IfhR&NnTDp`0H00#l~s7bQuB?nSiZydPUzCJD%7@%ECbXiK|Qup+NK~ z8wb=RoC13k)Qkr7%yUw}*Lqp*-mC{g3H2nt2cyBKJ0f!W8pzjp6V92P(6omu&c+fT z^*}s!G_eziq@I2NCZ1NVsI3+QUM^ewgDjMsQB2JSQzR>`at*Lvt(-`({C)Gv%O1UI zBK=c+e}bbN)k|TH9(nXE4?avh%Nh{_5h-;{MQtL*TM_^dS=t(sXn0W0I~BarI1NO8W3I>rirNxZS}vf+E24190aA$)B^R(Ki=K8QAs4!yz{HTIOe9ss z&3yr-wE8xj0iSC0Fufv-Yx10(KwmjaNrJ!tv zBmI}Axg1BbrKq+z2&|MbX!?nGhM-p!g##XGiZWsEXJ)FL)aw}PBdZ?&_y>x)z)D9) zDT29%0&1$S{5QTBin-Ilc;oPz?{JVd_dOj@P9-5%4vIIMZ|^lLr}Y&N#tqJu<^ z>_-9S)l{rh<`Ypla*^P@#n9j0F#-kP746i#Pp-kOEPS9?L^Wo>K-hqy7@PFG@in*s zl?v%C15)}mDA}~|ab=^-N}{qf9y(Eou?c>rX-F6yQan~%CKjMXnjmx_^bM@=qpn1S zG{}4)2Om#8Sj5U;vQ7zvB-0as>7}EfE)Bub-fKwFy{x5;3cKDGKYJZdk}p1_RaQ@j zqJ?1#lq9f2=r`b2x(x0}AS#gEIv=J6>HEx+Y}bQvlI9f+STmIka+47&2a|CoykzNO3m&2m;l|$!h6{6160g zr&=N<;^B&0r$~Rs)ofQZ0;O0vJ`X9Nl=555`%c2IFweK7&)t;Z|O;0QIlU~ihHD!a?@m|5Cs z>DlQCg7nZwYXwsL(S!2Pbq%ljOHYDq@f7@oRY3#23fxStd471s0fl&-{#PBB9~|`hjHE0c5QWj-L=iEn|x zXdIL=qvK0TkCaNT$Xp+WOej-C9FW6sNoOXF3Yq zpoKG$Y-2*DO(Nm}Kz$v{_xk zJTcvnB`QX{Yq8RiM z^2cQ)cYIX$!Hb`G9cD|Vsmt}eOIHU=KV=CYqD>Mah121Mf3#l_zg!{mT3O?sIn-Y5 zIvBxhtt=smV8(egows`8fa@K)IC%sER!tgY z&H7TiOHeRIpRFSSHk2qflyNph+&9$IHzXGcaJ9#qT<2=};DOE)J_j4M=9Mb*FvbNP zgYYEdGJ?Yob6igd^uCY#myRLa2tTB6URZ(L?luiS4%o>J=u^zHjjbOc9&M{1ZH&2A z7ME_!WGz-;ZyTo%JRVa{w15X*2j$8xM8$z#NcP8}3GSIy#<}&#nY93(k>ycw<58+Ilk);0vg{7E@4|qH{uY>N2?T^R2f8q zmRCoLeWIMr52CJW@DkCU;=6pkOzK`jsmzaxAU?79G2u>7YzgvSB63`s6t2AahC`U< z(eU)mEsyREU+0IsB|PMWnk^9*`e&&wRBxF+Ux!2Z!SQHQD!0N{Mdx-%Lt7)69f#!LEsQzn_sd=ZlL zeoHQ$&+QIKro63?EgD84nykE|lqZ|U@25#%F#buglqJpOOh+YOBg5w5s8Y^Mf+n#X ziuCJ)u3Gd??>N2bo&F4lIkMUTJcIchM~vvW=7}E)9duZRHO`!eddUo=jQr@NMeA8U zadL4TV=SMC)A&44$u&=n#&cye#M17g3e%+@ZU}EQ>$GDi5r#`WX<8Rsux74_xC7XQ z)oORxQ}J}|E1S)sG%TDbzP{BbtH?rDxfv;ZFeZIijVh~Um4k-&Hl#V1dGJM7HY*r|B^pSkz?sU) zyH|irH;)UsRMoE(CI005MvU|;Twe^#PlzczVWp4To$9I_-kW4nBPsFtX@AMLX9+UF z5+|oTg}k)C??L&g@AR*U2 z^79%6VO-G~L^n-}ChJ(1L@ZRX^bUfqv_>CRB+wQ3O*vmKX@1_R_Po%5K?*ko{nJ>`57iUJzYggI>t19ujT)x0?;0BLq;n^rOUS8}(!4 z#kju2sTnkWN%-W?Wsqc;*JzOPlpxa(U;d-{>tQclyX(pOlWm(xn_ku1lcfLw_p7b^ zj5ilSH_>uudt2=u2t@hpX()AvhIs@X@O1Dee2qKUD2xl8CTVBAiyxpm>Ye_6xsSz3 z$d^VJ!H+*Lm8IU>>Gj&mgGNLbQ>CFRa^n?0rM@oq7fxZa=}~_i-DPW?%Lekr(EtIU z9?0VzH?a^%S7g3VgqkDsNnKAM=lju6opF&+))7v5LOr6|K*sI{5S{81we!ojv3J|h zkS9AU!tC^=AJX2?-tb`K%U9FC8Q*b!y+=_(Bb1dlX&vGL)Td0a5ij+8W9*MjNUdQc zDvEiJz4O)YA19HNqV9ec2hpb$&7*SFFs1JCnWiJou0VYxp_}?-qgiJ)L4h9_A}NA% z?4OsbhAJCV5Bc)azES$)`FKJ*(BQQnmy90KL}IUq0ZUw?jDcQZJfAbIYI0${5pq%T z1Oj5f{$N>rPRKM2?z_Zc`Aya;ej;^C#E^TcQO==mBJGE-A@2s4yvy`N`US+0zb{AL z{d^(=0W=as;a2b_n#@GAPvXRDQt)S=%!+uw%=VOfY}edBxZWr933;|cu)}1|)3B#h z1CEN3@snV>p>^~B{J52~iKYs~ zMNO3Anw0a{rwZwxZM~Q768COUEK=(>QLSxKDRY=A{)A$x-p#E#Ga6fBC~B%X)udWi zH&trsXR5uyt=2R>Rp!_lrtyRJearb&xyKg+<%E8<4x;Ib08ul&N6qRz?9-JIer5>$ z=R6wy?C&e$y3GvOnl*+UrmHhh%#B2OG{@toYw}B%F!-clTiSKpVPHB_#sBI@Irw7J zthIPPT^~BeWUX_fwMsP8@Tb_jy;6aos?w@73y0cfYD?t)+U&0H4&6K-lZ5)5zBa{+ zZ4qi8*Uhy4@UwK?_$vL(eTFYhuaNv3%cr~ZnRWzGOh4(Yr z46KKv$2#1;A%qFN81D)+Z9`NC(aIRl@r@3AklZ#DgR0iS6{b*S*;Gt(oUgY}9zRK>NL z8F0+aj`%y&C5?8_V%_CBF~g>~~gR3$9z8;XC0PqjJJ)h`@a27I00 z;QzG+yZ7tjS({_q#ljB{G}mPm0jDnF#lrw`*VRYuPCXopM-c(8>(2$8`_&eY6M9`Y z+1j0l9T!hB(A>5~1zg4x7EklV-G0H|#rn^@r?BPQGkyGZc4qOszSr%$ef!tN3&i3@ zyJ3lomw?U+?$TwixclyGit8rF($z?S`)RI#+pgNu^-Qn(d2PGfcgLlhrKjkmsH@h8 z2}`$IYKK;1?e6FGpPFhMJ#IGyJg#S!?k;*g?#|jh?k<)P75?oA0zr1NU$J)`z{whb zatEqi2bymOdTa*zPOwjdIs>{VrO&E;`>X z`q(Z8a2I1u7Zaq5dGb&DQCL{Ny%qV!s{D;j{~Lnc?i+{iH_q5^Tz`zc<3If-0E7q< zLWF1_?^q$iA`lT}h^Rh9%nl;%3z3M0NP;0!H4teCL}n5qyAF{%g~$WD6$rZ(X}XnI zyWfj+D=T-a=y$8yb*uSytH*Y0fV(woy0swP+LPTM*1JERc7Fo)=n(ek()8%D_IwuU z(O2&IqTgd+*JJ40V-(wC4DK^v(pTko+r?Xd**S`qeI)AZV~_S&A}po;X` z>-Rd?^*Z|YI>m~2SC%{1^nQi(S{Zk`vNF=H_Id!J3C&l9j7VRsa$lT&U%Xvkf^T19 zY+n+%Ph6=q8Pbngk@EW3fkyB^Q_Vm# zWT0ho;2wLYP%N&4h5lQn%e`me56#hkvuEKy=IH;JqYwVWbom#UqkrdF5EhICFd+ZJ zrC9a^xh@FMl6Yd=eWNUu5X8qH4MumVuqU`hLBSoz0o1Jd&}*lmJUZ?mYy#O6>#txL zsyC6)g8f(rS2lO?JY6Pph)xf6`4HapB3eK|0JjYFCQK2Rmb)@YK?DOoPNKUHV=O?V zWfc$UbvL6+rL{cvDnSx`_p9Ve>sp;v+@M6Ur_-weciXF^Tj~vO*sTepM!jiGtlx2s zA4P;C#kcr7iDIAw(UAn-q5VXMihY+2m7Vk!WUuT1m~{~WUS~h!=;L6&14V%kvtHbe z1wUkrjwvvE{Oq6s13=SBBy);(Z@s|$8q0!IIQV65TPTw0+6oJ4vXM)bi_|)-+ z9U2tz*HaBeIEvV4>wMDCOVOA>Ab=`sYz}=I8Jk}Nh8N9plHh2*zT}Z5vqBi!fByO{q9@yAI$~QmchA#Wks!BqU`@$I{}D7yUDB6a_x+51B_;uN6AU z&MN|COZ12bU_IRDm62g3`b*FK`ZUk~0j7&|k?rw$eaFKxs{rZw)xXGefo6gKl}wk) zP(ztDvboD1&f&^%$H6sAI5HYNLsw4+C|jbM;nh{b|zmWed$tC%X#+_2o|#m+((m*~PzKJ=xR$--2Fb`dol`n?X#!Zwun zMg~9h=N!z!afE)OxIPRJ#LfmG0wf^RWJiG#GTHbEPzWveQIJAtHetR*H>2iJu=-#& zQ9ZQ#rOQ!>4t5SnuS5?^@=>UfOb*!$w1>UvD9kD}=gBW&Jor(#(_jw81+#)NABMiaoGWNr>a?gh)I%v|cu0PkCbkei^|B&7sm|ML5Z}jG_=D(I9XnFSwLy#ng zh3Fv6H1+f7>OBhY<%@8iTMdAO7dA4b4$DNteG{o^ zr2(h~p#w7YHb(9q0EAyw8#T6Te8e-5Kly||ZKu;=_^E1t7LLeX% zs)B$E&ioQQ+ofuf>pU~ag=iIM*%xl{M_Lb=AO)_=*WJbRw7z|Jykz^R`&Jhp3Xf(@Gpe%GSchT z{&E;^iMsTjA^3~l99ul@{zY%19nC+Jzv{ma;{lnkWLP8q!7!d{rFGk%>CIO;YwtZW z{M+3l7fbK;=BF<;cWnp(I?Kn$AsJSi0`1qo(VOipbxyz0o0M7}J!iksn;zc!0v;DL z9;!zk$p5o?Q=Jc(=)(*1;lKQdcj5Dn(^o{@SIo&*BGFf>!B+<6D|hLuK;rl3dh_oK zWIF}-{A8Aonm*}?;!B^VLW;R3(LTW^ZPI!I;A)4Ps4ba zjgi>1kvLb8APfm1k|@I8gz?t814$aAp3Fv3Tt!imMpJV|(`ZD~I!DtdMKd-=GtWl9 zyo!EJ8pEQY7O(!Ct&f=l!9~h7i_gRLXJNcTVMJoA%xtXORV;E{tiqp!@i1b@NOeEW z#_4H1a-WL%>>O`Q9B=f0AdEMgTz2)RVZ37&{T~H?EsXc`OZ@2X!g!=_O_I{)C7&qG zrY+xx@escaAu|I;wuRR(}8^FEA+%xDk%O&AZeDHHpT z!+1n4StQ9>WKCI5;8_&cS(Iei)ZE!LWa&p5+4RZTj7{0h@a&iH(3Hb$7VaEY%^Y@@ z9M0sNm(^+9@Erd8N^COlJ8rPZZWf&;SRxrL)dZG-gXMOePOiX8+_}n{xvDO?>dCp9 zO}X0e+>h6}I%Iiz+rhHd; zzWa5)Cs~0vcY&{Ffxk;ZU~)llQ$c7rydeC#Ad;*wn!7MovoPMJFfq9>xv4M}UYLGe zm`PTY&0Pf6EXs2!Do8FWYAPy$7nNNXRge`|aTnKU7T38HHzXG~H5IqOi`%Y?JIG49 zxJw`=a^jjL(BzW-rjkK;$?$c_C|T(^cj=^N>9k8JEV&fkR5}kYUA!(`CM#RzE?d_u zTd*(L+P(sFgOJyHB=q^GJuP*(sD-J+pzs5fD|MEX#cXum*J!tzi* zB&HZ#ejp5eH&FY`@9CrtmLX>&e%GNl3pfjh{G#iz$>GyGSQZFDYS=}X4f5f7l8uis zBaBt2N1#R7{UD|R!pMTEep1&?zzM8ZsaCLOEQ}Gb!Wp-4B&%+2BfG43XHq9bTA{cnDIKdUmM1T%aA#NKBT{BT0z^E`w%NvY{ zL7MrG4SpUSM^Cjtg2;eKKrA{e7PhO{C8t*rLv)(W=+`GxTqz8AZ%^U9dRkp$5d)1;<~ zG|!6Ehl*6|`=`oW&Wd%0RGxj4nyyMdD>0HS)|~18^&}8hti2^Q(*!>&a~k^fByjyF zBbr%AUeWJP0)Kf#3o_^*OFpkDkS#S)8-PzYo!3@`m6{n!&%qJ!^SXwiQVYlb{Uh4H z^+|wTwu1hDsxRfAItkc@B}_AMl*B%p35?f8%M zr39|nx?To&k_3AHc0@Bcw+sAjU&_N@PXg-H3iZPOyh7~tp#58y_%($S`3gBw|5@VG zuZ6Ns8?A+LZWgSC^PX?7MF^rYtVfCv8Lvl4&=#&o%dqdP$0&#~Y{V+78gIm@8x(HD zYdh?0B|yrSKrlDgg9 z;))&w<6cS4w8>s+!)DQ5SOV{Te|e+cpDDyYDY`g3 z?iFB%c7C$5@*%;_T8AHX;@c?r(z|NEkb!m)HYr%s=&zs=dq)$)6)bBhL(6TwFB9$pJm0`Ar0l!SQYR5m3SE45Su0Kk%28Sc3bCr9fN!{I&(dyfua zz`?&S%sY;f`WyhD5sKvfUJ(E=^5LV21igKC9HYpzj=FFe!GQ??q(}hh)g;*%Kwye^ z)+{t3l3vcL<9NB4bwL^iDFRF#0&8vX6KhGC0L?=l?)z7H}5S%$+byN{NnSZo&@gT+(3&)UbpnH32W!b+G`jRbON(KSq>Q zM89s+Nd`wwfS_KV5Wud&KO9)_&U#wfC+~f@t#*NkCA%B}*{SdI)B-Wn>Cx9>lNpa6 z7WQ{EbcU=>#8Ar?4k&af0UBZ{F;og=w0ee<;C5f~m?dN_``^boDvur5JUzG<^choN(`EHBdjXRGiK@Tm-w$@U#^$<{;_G~HwsZz&Yw-f;MKtF zu*-RM=EG7WacTJY?-XKfOVxQT1YRPikM(aV@EnE7UYk(Rx%a@Q^CrEB;_+vQNX`^CW0-StH~ z0H?weO=cPS@nr|PT!lCB;4&)DWhW@S!k12F1yk#?i)6UMpJQ+Z=j-J+N}S3-ahX;8 zluHP`TxGD@;3`q`W%ujwe`|&KKVllWFV}oL50&QqUtk*frBN>*WvQ^{1DEBeufD4< zFPi3les>yaUc8XAkvsnR&K=RbjF!=Kj{iSq8X37+ym4>Ga8x>sU~}yu^myKjX#ICJ zjr_XA4~%lv`zIUqbT2(U&H|%3gJS>AM!i!Z$C_VFBfl>3Nla4?Lw?(+_v;d0oo3zs zk5nh%zFzIeZ|l|m=Dp-^tRpNn|EX8||5v@*Ur?Rd`eu6v^~?TD-y7EBO}{s8=M{f% z+OOOD-h9}@^rPi;+Vn^3fx^D&er!R)w?KELF+pSgbjc;Iy}^T{CVjM>Q$=T^zdFz?0w z$%r7@i_=jNV)N563A)nLaT$(-(+LIf7iW{oYUXEC>V~Cf)7p*)XEQnhFV1253Fhas zM){@ZaI^Y@^Es>D7Z>w(Gv*fyPFtlHi>?=lgNr3kw3nC5zQh)nD}i)nm;VcUoc}x3 z`G@st|AciUL?pt6Gm2cUM4TXvvs+U{F<7ofkFc1t+eNUFqIR2_xSCUpG1@xBi1iuC z07(yPonn|JWR+|ID)uHFFWezDhhj}#jH~S^!g+m-{3i+Y-S|ENo^wDolcKGJ^G=;*j|9_Kg7Ve91T)NS5;?uou(`+KDPp=&96)U7Z2= znJ@T2YSfFYCKH{n;2lB#s2_Jt7RaqY(-SbJ-siy(ceHE;msr(u*tBIx|tLO`a<9k1Nr6v8UGUqI!?jF0qg; z)}Fndt}A;~YL~|J@q%ooRHUxikloRa0|CONHJyYm7IY*OdC18-6O*oJF|D*HxC5TG$TE z&BBR7+P{=qI`YgfF0wZ?yePAYkk;NLBW@V-`)=#EH@|VeADwKqu&*y(_-=5~+_&-4 zDN1^AJA9^P<;=omglFNbslMgF@0G(+$j7VTgtnv7a`%&gr7O5vD+1+*`17yjS$A)O zHDhz1wkPVC;zW1q06+7HVai5ZM8~SiSo!R2ivgQ!hz_8yWy+0ZOrjH$Mr5p6Ey#JM)6NT$#_}XYHwX~Y51YjE(adcVGpj%| z)x~^V2kYQJuOK(w*T-s}g?y~5${I2=e8y8b<8S;S_otbu8qZuis$)?hxrN2&x%oL- z$NFx!`=5SpZo>bfDIm?lxjkj!tcOE=tku$SD`oL#9S6y?y=`YCScoPFN-Lpg>}W!S zglX6ysA;{lBu5gAAz;h(X5eVWAR$E&1nAD_`W=OgK{57s-FvQpdfX zs(pD@rnRuA@su0Zcz0G6@N>t2?q;@lZrgi+DU!C-FW35^n6xEz{3luz5a_k;Yic2Y z<0}@bde9yd3nv7R_Om}8?kbM~XII2Xg&=I~5`FIjX6O%|#huRJR@1v5j^*N8SLvd% z=z^G%Wi~NksVJw2y<}lz3J6l4@ zQ6N(^;D|m{IF(6Uke0h0gWiN1LjqtujpmsH5S=1MISBv=>Uf;jV4!=t%qCcUSHm@- z1;EsB4=Ale@{FD|cu~N-C@;OJNxW$|y=m3G>7Be86TO+$4bAD?wv}+>XhEMuaeW<4 zR7ISo4b`K2ZF<>N5_(KECXJCj0jFp{j8Vr0d?e9J$9wojhNCh1p(C=F%ULGMJ$?nr z$>0oNii`x%fH}fY#i)AyY|#8jX;HR_EkfBWg1h~#w*5bo1VEqtOALqHIHU?40o7_l7~dKnl^5)^wG5P7MjhU&9R?ehRn{{HA> zNb8=a{;A|OX3C+XqzqJ9bd~x?P1vlgl%mW?V7EZ7B z0vqZCw?$=}{ELuA^^dYN*01vo&_O7g9qv|j*2Z)WGl34poDQ&tuvvBcMUrq6j_?JE zaJW(U^1W$VEqvc8{2(#>M??5`&WJ;ah-3ALOQ(oyXxRC-{i}kYHEK~*JQ)^rV9qEG zUWH>5Euh9q5}nAVZW^z>?$`}4(9Z}MVduJT0*e5oI7P;PqgUsoCtnAM+W0I;afAAVpDbpXh6LX{9|A(XT z=S+;8ObiV1c$0YGh?9!~4M;!U&4k^nTs?G$4&bzt;L<2hMTfFnW201o!V+N2M3VG^ zGbvglDb_hDJ}D`&F)4XADfKGp>1BjAsSnqb$om>MQzB7TdMhnuth@xE9f_zGC7_C3 zG}6Ghp)t9l$3O{UT&RJIF&d(*jAdfr*UDg9|0Sh;RwS(_g=a$vISQy}c#4BVPcU&6>(VaQnPOF!R9-*L`3 zD$F?P^H1VT-bJ>XBM$kfZ;Mf3w*ZV+nvpeeGDuYMD(%256~rXqwt0@064z}N+!u7A zrt!#0n~K8*H#wQYB{5S}&crEm6_UWj2)H1QxJ`_B(-g5Jk+X`P!^WM%ot(q#lJgUm zv)gb_>B$ic&Ji}r5z+(;xPad!gJl@yvN19@Y(zihp-2j15^=dC8@fEv5Z%|wMQapA z_R7^by$|V&Vlnu3DC2S%DQRlvMdUjwW;#D25laxu)TakTABua3Mu)oBi>{HC-?cJo^)$%hE@%1G|$>^z6T(A6)>zJSlYU#uD2mmTo zM41Mf+#rH7POs8$H8MDxtGVZ@1;19mo68WAt`Q!n7Qd;MOvw-psS&%Wk$YS#g;o3h zaS$S?ynMIx{*c^f;`yo1ZH+agk6TyL)Aqp|%vv%pWJ;vLZcU6a*%o>bhEB<-Nm&4? z9*bjLO`mo(7ids3WNcTI>{<)Q3B(A;DSZtxD8{ITgT;2ikv9#|&EP2M#u#a^d~#!4 zNMlL}IAO0b{&7?4O=CDyQzlPSo>o(VmiBuAP)1aqwelcfiz#c zgWV(M-y7e&Yvy|T$$<6J>MTI6sGmndAwTj@h*)(z>lh2pmPxwh>&7qz{n)h?X74t&LR+{*#OgUsTmFp)g9G6fOL zTdi^+Z#k-V2fAwqW@-m^O9#$;2WVcQl&O989qy+@;KDo9Q#wGwc?}5zpvu&oE!Ujg zR7cs!4f#z)F6sLs)vlMkT}lHr(kay}GPP_^zOkl$Cm7s1pq%= zS?3ok6gBsl-}Xo~HCa6AwJm7`OZQrt^%jQox|a0Xr1qv^K^^yd?VmvV&LR*xpgY7N zZj@g;as_mjurFc|8ll~XEZ7%~-50SBO-}8LZRv|i?aR{ciwf-vckRm#?FaMr-!rC? znL)X!{TVX-8H0U^G6O*3fr^rW(w6>mv%cyl8uiSBjm)5LgZ&Nr19^i3eWC4;lEEm~ z{@#-QXqlm*)WHhg{@L4s!TF&Qvw$V>|l^Aq?7IifG$k*$-W4^`8W%7oRNHj0r6pim3-nQ z-^8mIASUw(9`Xs^hZ8)d6U+}MSr#VVeVF7rm=J$4$^COuf^SlWZ;Io^l#1-6GWn!x z>y+%!6hrHzWZIMh`LurNl$6^PQ)`0y!K5Dflt}6H%Y`YMg9+1vDbBEIv#=QlS)V!` z-1qY{lyy$tFLZs#VZLrK|A%^Y0OvsR=BOE%-vKOg2p05WHY&l{FKjljbT*EBHtFYV z%))HSLwNQFc&Zyb!W<4BnvFM~Eg*+iG{eCQ@G3rdEcskr8m#1Cw(%!CAr0QvI#=;w zuE=c;5;oUeI#)e3*S|2=@pFEdZ@!0oq3-|=k)4}-G2cf%Kl*cS7O}7}ExQ0)m|qW@ z-*lT_4qF^QSlAev-}<>QasNulmsS=QPfHi4!j^u#SeiLlyyRPKBiCrpgx0;*Jy2La ze;rB^xQu48jGexWF}#e@wv4*y^pIi&hd&fUZiQrc<)PdP1^>!D*_!6%DlLB~9nK1A z_zLsKRkF5KO#W2{iZ$xCm6sH&^yzElFW0!;*ZAF6DJk?w!@byFu2R;miCQd+$gMK+ zud(s3zieB>$5|7+TT=-468gBI622jmzNUe*p^39WWU-E#zW&L5liy;6k$>|G&Zb59 z=KJuq7yKKxi)*?#TY7REF5z3Qa;wr5TQu(LydSsR($|$fu6#tiT=%uua2sAWYg-Sy z+YJ4_=1;K^|8Yb1ZZ+!r3f}w4^aEJi0etab{_bG$<4}PdsD!j8*&p(JzKa@LWfup+ZU0?r9`Z8u`|&Vjg!IR? z>W@of3!2;ahx`yKlAH z3~R3w5*Kv#9xNIVS)~F71gh_pRKDuqS8l%}PKp8%O^4nc*q+tyUHidy%FG=7QM2hs z4WQ#ML?!NK`UPF?JGxm#1Nbwj0J>cSy)AXUeS~oP zwY7AgxVx^1zOR|Q-`}|#eSRnQ$UoV1`{Xw=%}QQKU|TVs(S~rgHl)B z5(}u{simZgGnNR3`y4$(X{FR2gmNlOEM1i&9fI@OXbmV$DHvKX=pev92psT)|5U`) zdR)*QiaAu1xr}8so|=ho4wR28n2wROi#aWI)sihz#$HGocHJG)rzj9$R`@zM1Jb57 zKVKSUD0SoiOtIhUnyX&33x{Yr%%Bk1?3}Ido#uMD81ix1(Nh0YgnuUghX@?`CUfns zC{%PHtd!zzr$6J@esBtn`e>x!*9T(HE%_igqkJK{#+;>`iqXIjW$bXMXh}%k&Aj0g zeSf?Wf~vQ-!S|6&QJch3W&!>~ZLt&NB^d2T*OS@wnMfi2ZwF&sye{Wq>YkcS<|F;z zlyhni4`8w+A%^R9HrfRW1{I(=piY_bPnyF?j-MBdwxVfTFc@OnN%fB17dsY*mB5{P z$Ihh+FC~#xkG?OtWe(4m;#2*nqea{Ay&u`>0k_j)a}fp8y`D0d=-!1NSU9hs;nhuf;fCITkmSl$k*s3iSWVt2OV{DYACKaVoJ70qd1Gr=&QQxflN} zucjh++0UuU@m3lNbZfwXf(AYV8%VS_$`v8l5^r!(>ax%{-+oI|kR<&MCjOE%4cw3* zS5rhH`2bC>+p0CALGUG99xjElG@CBhGPsaVAb4gl`-qSi53tCB%q;XCYi6o`a z{M62-hK72eLC>0cooiZbi2iP&P21;TNrN|BD_6U6UrWb^q%lR?$SC;xnhnV>b!1tp zv!p7-x$k$M3^yaVXI0sSQ%IaQHRcu`ZBcbi%Rw6WnF`nmK~7LV~)4!w;4vNR|(^46-L4?HH( zZ>dg7ELt{OBv^Cw5U(^37C9H)o0^E~>2l`qP0SM(>{WbW;{$~653 zSDxO3{3U*4D&DJdirjOKlX|%LI&jD`&GLE7eqf`x-3d(B>GL-Oe{XqETXysN6M{c5 zmiR@UKA5(%YG<2=!0Vx>~ZDKZgmU^2Mv7DZ~~{_xhQ9j!B2IRcFjsk=wyFmWF7B=$WC zn2}HzgWUxDH&}5>khMU|J$HHL$r;JHAWK$Sy%D(Z;lK;%DcsZRUX0|#aD1s>P+CtZ zgJx=p?fsTK**{dJH@-5!19Ayudt_;wuHqis&2gWey4v8ral$s{A#ct|$Y5Qi7ED`- zvQj41a{&St?)C&l?WW?N!!pvra(vaTGx}Rs0Rf{s6!K=$=n)zLq$l|wtQ2P1Cuf3H z8}h$8C(K|JT}2ZP>=9oc$q8xz3W=!6F(MRthDSB^n%C<(})ej z`6yq~gLOrJ(;>xoR9-N&8z@C9L#0XM3NuHpO+4e&RdF(ZI||laH%g(L2>vq3CLPhN zgsYc-p68Ojsyp1d@JUR!q7W`~{l@$ReEfygYyZ@ErKg!R@ZM2yP>qXF;i2tCSlbNm=kK*T3+S$ZK1!Xqo(a_xP?T~zFzo((SZ?CA&8LD zT;p->oa8i4_bplX@A|*Si&%(iWOAYPG+*7H+G_O`zEw30ht-O=c1^q0qw(Co3Ix>{ zeB8F!rD>e)+>Gqs76%QLAN~11@@ihyr2hKI1S$^c@@R3so%2x!G{P8ii&Px2T5`qI zU+h9{3FlzqYeTj9D2C@IhE#@D2y2}Nr3nbtLr>Xy;LACB4X?rxNCRi=cIUSU zxls6IUxlrbP%44( z*kZgRv^gmsgHpc`26Ray^SAP1QFiN?=y*GQZ*2j@u}y^ijt`NWhLM5A`CvCowd0ij z=X=CV&H()=?7WKQjuH;3sIs)}X5$9Yyrx1c_E;s-^3!VS|{b<<#$?xImz@Vq=_vY8knv*zTVA%Da&NN&+!{139^+pV-FlNDRRvMHF2l9`ka15^4Zk*co+ zps;Jr(~!G^!lwD!337GS=OsA1ff(;|j2c=p-ng9jHJwqGcuA6Qxw_r6tLpw* z6T7!WgL2{l`n5lj{9_x*hNBq(T;;IK!^OvW#g{47rvBMH~u1G+^60_Tl0GM0;>TARjKPdWp zNzTkeb@Dg~Jqe;piX&P(doWYK?{F*elY334p(SNE@uxKB;>sW;uehK`xn#+HChT1i zJCjJoRAPpgqO3jUp!(S(fho@5m8|l2#g|*Byv%VC5vaX{jL{BQvFo0bPeF0p(!COdX!s-0LHg}BNc zcleJ!X2#?m|FmHII^;77S5vlm>~znt0a&SOeqwQ*yM9zdM1pUbZY2W*{e39k_*}R9 zB=-nmUV6nVx)TfXfkYplcl+e_IK=z$YY5VTOjST8T$Zz*FZ}E>?9!6ynbv?L8!09+ z=vvgzNeWR}i4@&PhLt+ufz*Irnyev&a#`dgfVW{UX@9rD_yB2?7z?c2unP__7bR2> z2gVBx{45q;fdVO}KoYAR>{#Xqd=*C(lC|C*;w>yNTdoOU0wfXlewbrq5KMDx>3gq> zXEMZN$;xhpmb3w<D*pll^0YDe~-5jboSprFdBp}YSbuht-1l>q$x zGVq(>SDAotsX(d1YEk2`fVVxlCNg(hd(&es60K{jl_Z1OOnP1h&|4A)CZK>sA}n^A z_6a(-aAz#qz71-nC0U*VYsQ-`i8J#XTaw5KB>;!`IMx}I#db&#XU<4? zLI7DE6@3jAP>s%7K>5mxK{5k%YrJFrYoW6%(9?GO=hv9Q^!)bBNp&`qQi(vi8XT}1 zJ9IfrZ(L)$EbVPqLGmMn*I?!7^Sd}ceSTDIJeg|Los0m(TDPH0VcZr z=M=4ia`VT@m2sZZod}N%zFUCu_^`^l1pXe20ndtdn!R<5{3lND6ai!V}>xP6`sXc3i7vcqp~r9nQ zhyLabVihSXnk4|@a)sIomk62s*y5V569%nBUkSq9~cjOiy<3lie=Ey)=owOH5&^>_{uM*LmE z$~VeSk26Fv0W}O!DXQXiq&L|5@qu>xl|-4*L~uBd!_~74)yggl9Rb?%wF^~d+6n-F z+=6(6{v@s5MHkEk$8k(~ayEM-Z6$&zIu9MTtiGM;8t(z^a71!Q-g1vqUSIr(j-FWp z&c~iM4Cy6%`AJt@ONv^jAejW}#dv9sIf3rqFye^=9FNb@t{(#3j2JBK=15i;JtkN* z;qWDv*);ydkPwJpNCZ+72kY3?-k8_f#Otu->u8P-cf=1_C+pwkuNWQcDwj?`1!{kl z*2$p$NS}yL^c9eDuLp5hBK5>kUMlY)*GZS=bpL__@~QISX7{tI?LgIiB3w~kf-AVk zZk!mo=+(^uA~i54Wt?NHBe5$Hr8;J(d7ZP37~zdZ>)?G@tz>2$KW7`P6mwugA+Csh zPAi>l#L=FXeXOZwIIX!KU-7g8j4A6{9~-dTE=sF6%|5L{tO<1Ud?Mj;m%elu$>=SG zeAfg1T-wAjj-AyG+F#b*W(nukUWfL_sr{gV|FL#w{_?}-70%{0_2vz?3Ey#~s#k<^ zKr4I#Ma5Rk8)f6&zQU44Ps9siDt4uLd8ojf0BT(Y*sUb}j)yGnP>d}sQbfu?>bJb6 z*s>3>EZf4bN@yZ;s?6KPRH_-dX6p{Z$8t^jrkj+3W`WMzpIo;rB0mnwBhhM@87rDx z^_j_kHBa*25pzY0&ZW_GK=j~bI$LT`KaEUi*ufjwflMiWYU*o&!)R{tj@5g?Q~A+I zQ5pI95am~96P zgSFdt*oVzIatfe(RRc>zO25!9d`2X;j_a9KnJu4^SJ=KzL-P#VI81A#k+Dei(!^8= zQ*tybF4#g*Z+rIHa_dFGYBCK_+cd>4vpbCxcT}4yHw~1tHswL~+_DO&DL~{4W8ofm zEWr)^1^0uuP30$;lwRIoKW zYxc5lW)Z%Zt7xrjfcEr);Dy0V{e*C_(s-ME1PL!XifB5D96W*|=Jc`zbeORqGFEHQ zi!~$RsO$}TUP*>fBWV(UjM@_$_)a8)$p`#1GSLPgwyW)=kWM5XZBc@`L|*s^OzMGR zpE}Q)uj`2p;W!eolf7fnWWsrPlMkmqc3WT1!AyE*m!ZyT))tq~w_BOV;&TbF7lBSX zShvUMw?ooe_~V)`*v1lfU_UBs=TMm)7rd^7gk!qTGBesk({rlwWIvRl_mh3#9uCKg zDH&9InuJ-OsFHmhHKlII?{L51l~?G(Ri|8Am*i_dFi&80f0lf}Ef^u_WsA_70;8{P zhYLi?PXUxzORV;gOla#uJKG^Kr8jTsKrDl+3NI>w+Q~HV~3kEMN(s8V!PddUSuC#~437qaozbsx1u}dyI zUf6Da(tTEhaU+R(-3WXwQc3GA#D$tV?g?o)jdyU0=jZJp_g;3M!`0wTqu;qnD##57beFn%u zMKW4+{?hp*PRrSw%8?(T=$Qx5aPG$^~A!K-k+j?`iYcjDvNrLyxo) zZ$QLd?IfVR4th1_so7Y*eqbCFBwaqxr!9KcuC;;U;e?)7d_ zxg~GxZ5{{8wx>FQTOmIBZ(Ki@Rp@V7qc@z{g+IcRF8MpU)@JSE5{wBRrzF(I_O}OwV)BTHbT;j_Q zZ%43XKSH}NK(fv|xG9Hu8Ff|c%*Gd#?UTR;zUVSw1HPsXCOw+@%EvQc{0#sYAr@xi zqfJWAtN`Y&YnR~>wa-paiTM=70D*9NNO2l!+kK%hG#V9Y{l)`PFbQH6c=V$sF__W| zt3hhpxX^Nd1P!~-h2qd+XE>I0riDQ047nyL*DD(NzuRH1#LFzBQh6FQO;`d~7IJwA zkr7hJT6A+U%mH9v$*=9<3JqR(<`=d@mE!vqX$&@nbIC-xwkAb#vE1GQ_w9t&<>Ymp zP~=o(Tf&AET}Ut?Gn#c7&viG@QIMuGl58BuL}f{DyP8wU;&IQ%`lh1Y;VPfyEH;32>Q>yP^sN)e?kk6m!&>*PH zxW!Sa!jd6m45+vpQVpb1S@ZyywNR6giWXXOdNIT+Gv);OK(Zh)g0M{u+?k*GVXy>< z6foE^p#WLNPLDiq!G+!3n9F%iOh%Xl=%C<}=&uPe@aAE;f%j~5{y%r;-SNWzn0f4n zh{$lkV?gv9I6?Bd$jcTXM5E0gFwQ%4HWluJ_{^Cv-TZrLfpPA{XAhCN3lFX5Y{r7XD*A1w&L4hE75HZ5?RWgQx9EBcy5f@X)8mZ!GQFcn|O!N00LZ(Dn zn6ffY2g>eAKkRLOQy+~q2In%R1I0>DOcHvUy3D$-*J(JC3hV>pEK%F_yFMpn!QchG z$ZE)b{LrNb$rxT$M3xG1q3_W>tw{vO!Kzux58Pq1N$87Liz%KiUAmUa7{$q4r5BqG z`S%^gia55*@v`U&NAvoW6A}f|w7t$SGZi!xMAupMI>F6k(v7zL=|9H`7(>q3$F9X1 z2FOxyz+U>MurQvNl1=Zrx-BWBY~`)R24AMlB{$M4$MOqqhK3N>XKd1=yhss&<6oJ+ z0w<;AodTzo?e79-wPP${pTF(qyynR6nFDd27kt5K8by76bzKx@!g>rK8=|U zhi$Caf*DMFz{Waol$zD=mWB2SQ~gD)(toYxB&W5qd-aTzCO6NyQD9I`I?Cfr#T{s!;eW;JF}g^)MLYBA9qY z1=c8id<*dgQygX~2^6+kq=adF%tUfiYIq?~Skh4%jfzy1)D5Nl-{U&*4wFEnYY-IW zR)$E1G=<6drqtl?c;uqXz;Cq*O8%z!D!r;w_!Y7^J%59e$Q(%Du8pBkZ!sW1C~}4r z;IKFvZg1{zJlpw;F%insprm#r(+9I%eHs|3AhrIO8ukLx$S1i#^4kO{a3$~O$ZbL5am!}{Q_GHM)`wcjtP)ySRbGCwmw*&vrVQ0mXez(fX7zA4q}<6{WR zs4w+W=Hc2zN|+^zEx(ThY32l{7{tivlb_Ma#WSB7)xZ}%jk{Gh+=rP((-ikj+Q{d* zRNA@kE$LXf)qg!_GI=}U)VF)6%b9m@j9)d_-$?Pu>R605<4?bU1`MkbMiqgTWiSGUMd9}llqVo_{JpoJ6 zczbY>R)~`Y!_NPn|C?iE? zISP!#1e&c6cpkj#R4#6>)T|^rf6|B*u9ZhiBgqbrSbl|GMk=yyd6#1wg9nP3VtmMxB;pzM`{!w@V4V^UBT;tA_3)i`_g^RZO0xOZ^WED z=C>}C^%G@hpV`iY++y#(#Ht@&x9{f{c|WcxCeieI zjXiJMI|kn7fAm4JZ<-))m;7X2I~FDvhL4XsQFV7yjO#}mkKikMKHsv%zGGqpKD#|; z$kS}s`$L!L`)xJk4fI`KXEiDIb#s{x75W`iL$EauM-GF#mHROlhGnb&j|p60G_=ST z90PeaMeYYja#;P`8Y}Wj|E-4UbOenpL>O{dQd7i?Ex5mf7-*(Taa+g=5Gp2-CJLC^$6pq^%$oYgk`4sPYWLOlW&)bx43a!^2 zbRnP4*AkCDB|vAJD{*gfSDMow#Bw8jU`W|v%mFZmV2do9GgjqupPMt+nKLBh)5BZ5 zLlx*>QL?;Ko=xnqA@4HtP_dunGjwKie^TP2v|x{bmu53j62jmjwP5kI;1wv~*52h! zC}3dNm5R$|9yA{fFHon$o{;M4yAI|EflvuQ>~Inm2&N2(FU|4^0RGtSilppv;})`} z6o_E$i7f022U0Q7P>IA)NfuEG@>mLr6mmV7OEbW6GZadT>OJXn>D2ZGCTn?NA=;1S{WEq>%!>3++)JaQ&qXU-T(| zzm)x8CT_o3kJ`G5+RB>7(w@df1VUpgP-KgCV9P^ems4a{bYSgC^VzNFGrWB3TcE-u z&6kCuFB>$D2StwX2pvBP`JZW=-;12#X_j zWS|S>uniSB3e6}C4pjMR-Y=zQ8}cwnU3KKybR<=C6xmh+)qNC&JQRj28_p6EZVeag zX#0JQ&Jn6Ks3|ip@KXdDeF6=nG=YUak*CxRVCOn)?WRT-tWXN2YbUKsAE!+(?QG{{ zN-ynS+AdD-999aYMt_oa{LQx1G0slf!!C|xFlCfJ+rB?*#V-5CHtjhiBY!fRV+eE+ zlKeoQgL{&EaU6a?pBEUKi9D2lAya@Gn$A*|E@Pj50-p(wkdpmoKdBh!#u#gH%4a7e{)4AV$T#mL{$z@m!LDyFff zim^_n@xhAmNv4T~iir)T$%Bf?3#O@uim7*|Y52-%H0Iy9mA^@uXJ{&CSeR#dDrZHQ z=VU79RG8*veTW+YlD?* zlg#T2mFpYK8wZse7tEUvm7DL(Tkus|Xe`^fRokS0ht8^YSXg#>s&++K_GGH|R9N=4 ztM-jq4y>yV99a(CAXSIHEJq<#M=>nNDOJZgEGI=(Csiz`O;x9zEN6pNXOk@F3svVE zEEfk=7Z)s-4^@}%ELZT=S7@x)xYgIBtT!~(H!Q5TJk_@%tamcicPgy++ST{QtPj@J z500#lZq<*ztbanP|HQC9rBpxVus#=6KUcB7G*!QJvc3*hzfQ8gEmXg4u)ZHuzhAII z9;zYltWXFwQ0Q#Xcs0;uY%sJnFsy8_yfv_*Y;dwQaH?z{bZS1Bu)*8Zz&o)axYr=~ zu_1=mAjYyGrPd&U*pQ2BkgM5Hnrl$H*gg)`e4JuKU93UfWJ5cwLAzu_f2=`=uwfw7 zVxY5Q;?-i3LD;cqYq40_v3YB;McDzewE$Ii9GzMm6LwsiT3jb~Joj2WKX&}kTKrgc zg49|95IbRUEnzh~QFAR(7d!D#E%6jP$zm|bg>-tsde-q4u;}7 zhH4JR<~qhM4yK_xrYR2Q#X9Cq4wl0@mP-!S$2wLB2OB~?8#*UDUOhV*CkJgk2P-Eh zZ#}0dCzotJmntW>PCd5?Cyz}%j}s@adp)loCtqkiUo0noYCS)QQ=qtBpqf*#xn8h~ zQ)mcMFEqs|yjU;1$tiMJFLKE#`dBXt;S@t?5JTq@$7>KLF~aVZoxC{%MPHa935)S`4WC{1xG zFE%J|a;Y3Ps9bWXJ~pUAxYQ6D)zG=s@fy|1xHV`SHCVYdc^frFxwT{)wN$x3=`?;a z;nuck)OO<5ac|V|Q{3cG&dS_aT^Xb8cuN=EjAi$avL8u z8eejoJT{s@xJ?oM4x93r;We3&@tD&#nX~d(@HSb9@>t3?S*r3_=`>lH@L1b4Svx^^ zY}}h{{CI3bn`~ow>{6TTKs@%vP4?A1pPQRLckwt3H91W2d|7PzvdQCk*yMQ07rbT{GG15OW>;3;ue{BBFkxS1o4={@e%ERKZo=zk)9mKN>+as{?#Js9 z+Uya_`y;ja2Z-0RxY@Is*Q>eNtBcorsM&jp*JrWWXOq|Wu-W&L*YB~}55nt@(BhBI z7l79iK*kqH+Y-pi_mj8frzl^LY)gRFS5BMvWqWjs3mHOFM6>hdXq2auqEb_FZS=>DF|O2LTem4e>@(fHJ*$= zfwnb)l|PZUHBpp5Nwzgfl|NahHQ9te#iljIi9gl7HPw$lt)6EwXEja7Aw9H}7{s4Z z&7axan%TvlHPo6l#h<;{np~flUC*9#$PapK1wnqyiZK0MA?4w<<&g>G)3)Wa3Ka0R z6^IHH%C;4%3jES(`(+|fWYbpUBv9<$R_rHG653W0D^Qx+Rtgd*D{d>R7AS9SEAJAh z7;3AS5~y5ktK1Z*I&7=D6sUe|tA+^FAhg$@3)bSb*OCd=(YDvI3fA+s*NX}^$a*PD zy62k3+q)ow;GuT#lwikV zd&j0==V5#2rC`_NKV9!e0C%Gc_27Yf$b@=n!M&_PeZ1g4QK5cWaKEb1fDU-TL}<_k zJm@4e5#*YTT7c!suPhE;f$w_{dRcuuxsPE~kbr(@nkc)_M)!AW@0y<^c& zcqz1FDOPwnwPP71yi(k;QZ2mN+_Bmvyf)OaHYL2i*s;DTym8pEaVfm{*s%!_-a_cy zLjOB@+__CAvP0Xs!z!}N+qo+$vM1ZQrz*0q)46XVa$p1LJa7^@bniU$6FCa)Jc<=L zPVGDfy`Q)Wo>YsRHg}$OiJT2}o=u6IFLs`9id-CaUR;V?K6YM0M6M9JuFyrV@w%?b zL~m%jZdgTcdAn{!Mek(0?o>tZb-M0NL?3Lr9-KrU-Mb$BME`_BLN8nYq;@@lM4yYh zo~uP)n!8@QL|=!xUZ+Ig7Q5ayMc)s*-Y-QVkD_9T7<_T2;y)2EX|!76%p^n6DP)rP z;?1Qa@z|~BTH-BaW68ur0Q?D-@`<$SMOv*1R*I>tW`jxmiPp-QyecACYic{0fY$@ZVhb!x5W+ma!lb*fEzLU06A9Q5jKeiwaePx)fd z?6f_YESTzO)b4(LFyEf)WYXmajeskZ=4{p%ib<;tPIIvsilvZE5lVNp8cSujSpcVh zwV48mhvEune6yP^Rxj4>$oT$wvD$1XML5&#%WAXB;X+5IyVGV@00N#!mWRvkP&}

    z*hp^=!TyJ0bv)OtP;I865-P(-QqBGFe&_oA?mtM#GspH26ni+@z_ z$CPLK-H)xVq&|S7_w92eu341&Ac0-Q??ECL$#L}|k{@TkhsXjxY7A3^GtCTB#Vcuy zP^UZ0jL_yqX^hgBR?Lht){bk8F}I%0jIs87)Es9YVVWK1JbXr&;C}oc2{;%iCb++@ z!ZFf13=|>+>ObcyP`>_`tMH$26%+=syg3K|cbZqyGBzkt=^vU`=^pE~ncY8YUNnxF zpfuC}sCl)jVIcvpNweKX|Dk!&+G!9ciFpPPavg#G7n+xy6nER=anV0CFXSt`f6=_k zwDPL{S@X&uBxw4F=9Ph;^uN=*m`l2i%g>wE-2M};0$UUGKf4ODR+0bLxe6LkhX2QF zUjHAt3jc4C9PBiAY;w$q39`^GQDXg4vPy?@W7p>bCSe>GGT1CjD$}=yKNpOx5@uudOWm&GyAGyn@pWRF(7I?8&&U6jxQa8N#1`8x}*x_BS|P0@3Ck2 z^H=lQMi{q3?gteRQ%fM0s^;*0%QG9pmOxcwz4b2q!}#Xb=SE(SQ|V~dZm>)m)YQ@V#o6U$ zbvxsMvKdFt5j9~gjLW?>pR4NYFBGGB1w6_rW|ptjFL7sta4oC*Up#zXjE;+%+UMpS zzYQ@OK43M2FNCW+78N(1^?5sI2b{jkj~Rt}EOx#Qu)58nm^^RbQTk0x_~MOi!B@xB z!^}9y0>|UZHFV?9s?wP#vbHnf7HG&WkVEMcOyiSU`i|4B#RcTYJA*umKF}bFD#9#; z>jTso4u*qicjq79fkVv8>u)1advS|rMXuup7wso1am;W!rq!SVD(2B)u*cX*aVxP{(A~N z>S0i`2D&5~A;sw$oSZ+n81H4d0A8bkcb@SmRPLGID`%Kb+b~fHrGL~Z{U$pcdl>Vp zRW7HQEFd>f5zZE_FwV6Risu|dwjeZhLaI@Ys|?F~<(aZ5W$ahu&1vVt(GslqLou1e zfi+qGvKCKRm25V#s!cGCffbib5y9wpc%qb00ajTiy+vP!lWBikxn@`gicxq$s=b`a4j-}kh zDV9rWn$WR$U8%${KrE|IW;-t3%^W|*&FOoGk9)D){4XurfRZ(G&P_SHWfedmsP&?C z`-dKkDCR)3)Wt`OS9jlY%#rfJ8|*x9)u^h=P-hY9x18ZaOh4j@G3vOY%~I)x>}Tpm zA#gQBX+!ec?*+eKmoVKz$Gp~85&a_ijf>MvX*IZS|z26e>K?-%G?Sr0O z*vCYJ&;2?85wl>`7FC&Z(?nay^0oQPBAf}$AwsS0AS7XD*|B~b=5nJMAGmo!5zUXFQXyRdf zJz>I-ys+-;P;*_Jn)OA4W_IVbLF~_B8CSw8%z_Z~1f>buCe_+fm=d zBZ%^%rXHeT#Unoigu(bb1E8a+UCi_8qCdM~Ewy0Bb4L^8MSs|i{*o6%h8aAm8-=PK z<22}i&=Z4|7p);3jkFzu3>}LX5Q}q-V%&nsX&#A65eq!{0dE%#PZ6U99XZTLsKp&6 z@>@A)Kg<eeG@dxI6iv#X&%V3R!kq3+|U>L?R4vQTIHvuLu zq!h5z62+O0L-+#&|H%rHg5{%&3vx~T!WSR?J2Aj4Uc4uXJ}+VfI+=C*Cu=|i%oDZV z53IEoBCKV6mC_`Wod_q&WJzdWHT5KrSxRGkf*)oIz$HO1FAl~(#axd9WMlP>9}9*c zSj#R6g(B8(1Vat!+a({s>j~TS2bMNHRCqe3>tkREU81QRM(i=B(XnMXMOeB#rgJGS z^2m=rd{mC%*dRSDks}ZHWeWZuX@b2egX{H z!U6VAn2{s&L#-L;ni*a_S(v?<;w~9(ztf9gDEdaQ7fT68O0(AN@UnEtbNEO$A7mY_;^5V@=INoH>9HN>(;&lf^x_fstsqh8 z>{}%4>*IJhiii)$SlT=uV$jrKX$j~ncz6mqf$>Q&SDAR~QLubLVgb2wc@7PFn2jSC zTZPm;hk1B;)N}OtU+J(UJa7VTa%dhBD8#eT>{d?AQ15`NRtm zF|!b$^Of=nRRfZcDGFt_3%{BDB1Fb-7%n*4{)KT}AQPX@=8{eY2XQ3gWwB=YjI|isbRc-MvY>yP zz5#p7t{CK-5H>0Sa7D#T7pznVs)h)vu%P3RTqZ~OQpYZe;`j;dJ6i%gBf29Lu z`N}BA2H`&?ISxFlwvnrjB3MoYgm)PT&OHgQ?Fnz&s>*-sn6DHri+?h;kEIbWoE6~t zMu-djxthwN82*$RHnV2;y7=Quje%zFJu*=UQZ24mE#poNetRwPYAxwYt!6_Fp+Kz< zMIHHzz=zMwmnRG{CA9ES2Nrc42K77;ullKeVMY{E!FDQOWW5+sgM?s%ltF_` zri`#xgX>MbLOHYiDVyqQgN9(EmO-PoSK~HTqi%cSdqN%eQ6oJ}lc8Xfr9qRmR}*bt z1D`~_?HDfmDLp1-lUH7&$M0&Uf*6;TCeQX}Z-WN6)n-kpX0Pk!Oz{>&R|Z6smIwnj z*Y=i}mzKE5@@S&grrt6Msus4u)+8_PL`A|3Mx5++N>FBP<`~P5c0zr7f&zoKiq$r) z_!bJ+HfhRs2S838bbCBI-ID@-xmQiqOM5pFxK|L|ZvYUtKi8O@HA1! zj9|x{LC1nu$5Lj;N_)rJYRAS)#}^rSpoY>qfBa z&YQ<>uT5gOBWPzH;hm>oMAV-cQ;~IH#~70a#m!=YBvUP50+35VBECD zpa-9+-eHx4D65C`wTC>4*Pf^sXxK~R-Ak9%%K+|WTI*%0!1+i_$^P2QW!T5#-N%>J zCjjmfTI&;e?Gq#Z8(QckmFSo7?w8BzR{-}bt@W$C_Nx&OXb25x84hTB59nqM=z|9g z*9MGV2TX|v&4mUn4F|2g2W_(k?ZJZ%YlDujgU-Z5u0liK42Rsjhdj;tJ-|cWYeT-T zL;l3WfkMMUhQlG=!(my&5fJcj)Y@>&>u?^o z8;%cpj}K>!kAla?*TyGb$ES%WW`ri@3?~-6Czi4%R=^W$YZDu<6I;ZSJ3^CthLZ>0 zlSf&TC*aAmwaJUu$t&Wi8=NbAX9TjQp21VEYg6y9Q&1$+Fh*nO;F2ZvY1ngO z#O&#h>(gj&(-lWWii`!P02KI(jn6klK!f^>YXQmuM^} zp9NRp#cxK7Za#}1*^8bXi{9&tzHf{EBujz9OF>3UAwElC*-H@}OHu1fF>gz8B+CiH z%SlGdDL%_-*~=Ln%USEoId99k(etH5EAVhLQ=eA~vscPGRw~w4s@_&=NLK5FR~w90 zn|xMVvRB(WR>AA5oo}n%Bx}9GYyC!RgFb7+*=wU6Yvb!{lW%L&BvKly3qI>h z+3PDE>uc-l8<4m4Es~AYnVub^jRT*JqwI~7j*YYRjf=O9E0WC{;Z2^;b9X+Qf3i29 zJ2qd}H{ahjp-8u2(3)Y5x8QxZ5OcQJf>w|>w$R?UFi5w#`nRx*w{d;9@pHBbJGY59 zwn^W&$w_x8MRtH2eJ)0S{e&Hc&K;(W9hR!ChqoOLkzFp*IgOJMUgKSX&RwC6U6J?Q zVD>&Skv%EnJsICUxtu+P&ON1#y$!}a71DhTk$o-WeQn=;-JE^>&V9p;{n>ESoyLpR?;4^r}wj6-+$eed@}f6}8sk)xaK z!ywoDQbT%5R9p1dRcP`(6_Y!O=s9WGIPH8t?YKSp>nijcpAGt+aYmet zcAkxIoK3!;O_QF_h@8(EpD*~HFXf!Cbe^wmoNv6JZ;@W?h+OO$UmW;e9OYb`bY7fo zTwJ_gT#;Vhh+N(oUq1L={>iy~?!0{6xO{)Vgd)3w5xs&lx%wwp;jgIBb@g%c3Jr3F zL3WKLdJQnS#`U|#2VE0(T@!C!lR~b^$!;h`Z-6E@G=4X9pc{s+8>Y=07RU`7*)4~u z=q;DYEsx(VALv$~>sDyMS`Q-R#6k=<*E-fNlM zYx~{ng6=P{PxLqMjUo4@Q?&&o50)km*60*%z7O_Y4-T_%XHz3Rtvdc7W|t$w{3=e>Nrot9;NyPMN-db?k;seXG{bH99h+zMrV|Ff6s^!{{I zT>buh)_nQ?ay7&XdA(b7g1r4X{QF=3_3`p==Is9`%ym@@J(NqGyzy#C^!+-LUf(6+ zuR?&^*donhtsZFtHpj2z8)ONLkJOT~AecRp=5DKvb{4WA9{3}}zY-tw6=*?n?IA0C z@H@);VT3ZtFTcF9n`=DC!IF-V ze^enmOuDt* zW?w}W3yp-2#|f)bs%M!)6^cPZ{Nf~#pwf!P5EP~Z3GZ?dl}jY>MyEpr?(#6AOQdK8 zraV2PNO05-0GGd!q2!>TDr*p=|0f;bjv{G(?a1Icm;#s<8}UM0X#=QkoOZ4vwMh9n zV*3WUFlQZ z+0li@w&ZfF=yLsS0iBwKPZfb#rQ=+l1OE2$)Nso|;_?*!%(k6U=6@5~lF%FR7pwaAP#s7?IcCmcLhQX*1)cK6Uk^lpxFx>4esRniH>(LD4A>F{OYWY@|HAIIZJO!Im`_vg@cv=Yr1s@KxQqx^TA6(ejG_4E*_j97t zEVK)ujXM8gVqfg(;b-uN=E4Y;oiO-qsv^fCcf2A^*js;alGUDLfW6Eicx95j#r)ey zPB3cD$^bU9L^(>45qG#goCQ4(Q`xe5NE~r1e%+p3%M*sWfe-o$S#zED)Uol?<5C~H zHH1voB7#&O4r+>;OHpe9$GHOf>&Rwm;F=heMhzE%$CN)tDWf6L+WCr$ng{DQVuuQk z!|HiU3vA7lU^LKmML2Pq-0+}(yvz5~tvz>B=Yb^N%YbTI+X6Gz1>Qp1#Y{uTLg*FMkw!_TNU%oT;~K!W~pHa*{?SRmlA8}YvPqa(J0w8hH) z?w=G(zcuZeOkBec&TT`}M+2%{t+)9_c`bs*E+(#1zWgG5rw#hTzlV9-a3* zy_^SQb!}lY-vqT7!VQTosyDEJPiOW4X#1CFxd-ZBJaBZQ^Y}@Ba ze6T^6M$kXOKjLExrhNZ;Q=iyF*| zT6F#08KnL(5NA`irT4;R`K_8X7yUx}XAIA8s=s48x#MrqYz^bI)!A_c(8Hb9n{MHG zBh)L_;oECntM}>1pl=y}z6;?-2^ARepwbPcIq;xo^my}J)s{l3D?-_`Lgg94Xh;9& z{S-|Il+ueN0UI^->OCI8g>GwnMUjBEQe5o8U1TRYDR$SfnlK`CWwf(`x- zTW;Ki7wrd3O6%{BSl$f#A^?0(y(4Y1BJJ8DX?Me5ZVvAnd?b9Z6QIguBbJB_NXoMM zz?J z1nuQ4Ra_%<$M=;#R)le7g5z5rvYFiIV;> z#P4Zfo%AI|k0fnW0QZ+vpZOwz<>6R(2{Uc~(F1(w{ZJykb5UB5j&!xGSI3b3{KhC!I|HQQP%&DusU#PV(VhbZ16Cc})# z)v7(i9WB$7DAO@JM*Nt42%GuzXto3-FleUdzd?~kl&G=?>d&hOO!u@mJQC%z+iMaRnu&7DcFlD zc+4(%wk?3Q7qFKX08k6x5f>u)79t!KFcB5rGZhL&6qc11VvQGKR~4d-7vd`xzKlVT zeIaPR5aJ^UhGG#7sE|Dhf@23^Q7mL*cHvkpWM+n-Di#sh74d_LkvkwCRv{u)#Q^jY z>Z2k){Sv~XV!72~@v0KZjuN_~5;Y6`yA|m&M&L%4gA+s2p-re4YLb9%5-M7miEq+Z z;xY^LL`!g)O-I=cW0^x$soiRsHFLR@e!0XV$Z*VAhsnebTpkEk)xfQ=WvB=ju87pH zi1w`jfh*!*9Tjg?z)6o4Da4g&!j&2Nm07-(U~pw_M`iwMW#MCG5ph+Ca8=oO#XGJ5 zq1n8$v8uY&s`|&OM&jyb;cBRUb(?Q>2e`Vcqq=9cy6>@ifVgH*xMujR2iUh}99%Qm zQ8T?-GxJz8M_fBET)U`WyX;%L3aX#tdFJt947U}QPzX!hUbo$Al*vr6fBJXA2ssTecHvNMn_(y6x_=*^%+5GXDr53?Wo4!)I_sueE_$3v-=+qKop z58y+B;~R?;hB({G>DtCa)h^j!4~&h>Jg)DuvOK0& zC0;4dUbBd)XfGr*GbZ$bh%}sxH+<0uF4=k;Um|HrAU_=`L;rP5dUV!{sKlguKdpYC zvQ#l`MXRB7>r+B^{O9QiFlasY96R=OpiKXQ=w(pfr8D0(`s8Ur*`1ExwdwJ;RMu&{ zou+Fb(P_imwZYQWN6=}a-RTwGW9ZQ}d)#%lri|{>9VcHmGmk!9-F2g+V!Ce(xx@I^ zshWstXe=PRoYU2*)c4ZaIge|$FW0kYpn~fV3GdK-QLT#?C);Nq2_#i*kp<+jd`78J z`STQUJfVUS*SX0%z@{^>UeZ~&*84KibEu@!`sB9ssG(RDrV}IItRD;peL9Feudyn-mZ@WrR_5)!{Bd0{43!KNujj!I%|-)5 z)qls!2dTeH5=IGFrXQu= zwLpP~qrMCJf~xAH3)l*ejW@(vA{k|2je|2yo;57f)EW-=_xbLiQbDRazU&fLGrnbk^;OMxb#Hhgt-kp{`K}MiQ(0|n&tXl+swo#v zW5o`UYINb+$TKdMKwjndv#qlsASP>M%fTryPS)gEg_>_9(bK>+PSrO`7Bx$S`o;+V z&`xepIV4K#&tjC1JlnO$~cv2*gAg6)Q4?x0#ttqOHr@mmPOzNc60P^t- z+_ANw9Bgap$wLg!E|YO@^VNa9hPC03>FZP!KOzt9(FM7vFBQ8Bw!*+$BBc2n2QXtnR@nSeguAWZl_O#x!8rAIY_5 zX5I99IpSKKj#UTauGtRP&BLS52$=?k5{y4r9|zG}Nkgu|^g>#BmD{wd!@c zW*M#Yj@JG9`3Kh858|&0axB{W5_&Dq^wl z82z_1##{W3`r%Rdxht~=A?J~Hze*xjjhvMQeRWj#bX8Tct;VmFcYl;`?t1?Gdowob z9jx{tW}|kqb7)8ZHM?gNcsHr+{;K@RQD$9Z?wgZe5G+t7B!4JFU{5t`<>T(=*0s7X z`y6OmhN5(KHLWB3eW&3vn>mBg-TR|?M17a3y@Chh0)zAlv8?l5r*L*}%>;)K&^{r- z@c!}cUt0e?+=SfL0M9@bBjx>!o`bpT!~SWNt__vXPKT|5)*bmr18vcA39_aiRGQAb z7|5;X^G~pDj(??{&W?H)dH;lp`L};OvFYBg`>^Co4yT>g5I_zWL%#c@v=_0VJiM`Y zlRwxw;b!wTfW5>rT>N}gXKQWbRT^bont6WZAcMr=JLO=D$nJ}nV3Z}`3a;}?4Ui!$ z`-Qiu+`8p*8Yok19hK)O+k+Fvv_E zHKzHu#W9P2kLlz@^Oa$Elw>_pDQB!HKOl`z78gqvtykI6$|^@qHUs)khr`Hx2_39< zEs3R~XL4H@F*+-1;NI40-FpL;b*@0sN9aTL%ozW&A8U|==$MpLlYwY3^C5TG3dzUP zM@OZi>qPu#c13QIk-ZG9qmxeJg?X>4+RTZwfa>TDH$euYr) z%o%4cjFbSyI`ld^#s)R53ZqdK|B=3kG3p5LjcEwL?-6IAR+N13Py`A z-&mR^9a@`$ii&Vq1Q!it!tX+okQ$1Dme2y=u5^Z?aVQiGg*5h6^F;$*5sAN02N%|c zlgog=9BP!Q*BNyOB9UmH=r&qT<;&#YSIQ*7ki9JKXG{>_ zkWL-3CH5d`v0m%=yuOVzTWzctz<@S138_$&HDH?jc!p?3`Z?aUbtXslBsNJ3^`|N~ z$y6A3uSLX)IovoNol`rLgxm3K3(T>}@va_EJ&WLYuC6w#p}!|x;GFF>33oWCnFq%s z@b~tcab&xeN?C}vtBooa#h>5Bx0waRLk)g$rb*fWnjw^b;Oh6Doe?pfoc_Jt%`}EF zH}syP`%4%*!l@I>D1J-|B?sEC*M6m7I9bIlw&L-tDJmo`I{@b;a~C7rENRZaB6KwU zY019TRkoO0M7X{TM1m85;M#{(Dan3$rZ`^sws#UT6q{22D0-s({}pbNR-YA|%r&9V z6U7*C3&CLkIeF+X%;z9)eW#dZ)FU1?6B#y!E;8?<+!%W|rq`sD@>M-1x|5Hnd4^`M zN!bSIV+~a~q55n8ig~x)E@0D46Vjs`V&_jy+-Imb&D1@nO%0TXb~(6pipfe?lG|<9 z-}$NE(KQL7rHncY^2q^tHKW)`ndZZSXJS-UG4#sI$RnT*Qk(82v0CS`lzU4u963Qqr@hGNIOT zHY8vYaJSoP5(GmMGz~$aZ!-Y zFb}m_MF@tM42)AKLQG0Fk1}MB{)1_-HYE^;A23QDgHQJ^SS_eBhAvNUFRKmW6^Oc* ztfv9~T9R4UE^Hu{0)0yrE7$q#W?DbbS|$mU=@y0Hk|vdAn;`31R0lPTWJHmSXEC-r zL&1WHXd*MU>D?K%hbC$Xdd@kieGfFlWs3>tN$+6$+icX(hSSzmD=_5`G^ws5ldg4P zyU9xSgUcZ9AR!B6rlzPrQ$fFdXObVPzFUC+1g2)Q3f8%9p^d2*w%wmi5haXKQWp*g;%dF31_rcT*Tw5G?6U- zK@nwzp1V-kMqoP+&=fd^vXd(4lI{x12`|njcn^LhziE486J`@VJ+f3-OL1uN5P2Kt zHp+qR4BX2$VP`^X7l@ol-0zXBWyaqtM_zHFIfUZ+$0VDPYnFGJS*Pg|m(sSXDG(ZQ zYo$vTyP5KmIZ_=Ya|s#9@aombY7a6J@PP1jQ-~1TJ_~i@?#kHwQ24ArXEsWU_wOIV zN8<4^{wP>lsWf;+@nF(T#*&AYH%w*}bguv(jl0UoqM)*Y1pNG?YIkN{XCf3}iC%1L zErhY0%aW||$uW7~eNmwdYV#|J&=!eF-mKzLT3WtjG=W;~ugXp|a!RivP?r2Q*Io}d zlW>7j=+n_GqI9D`wMUs)|HJqeVN*^JvCUsbaLx7aq>K~Nf=?M&s^Emf%sbaYxL}3P zc_17~CdGpvH7lf^i?|4IWL z^&7OI&=$U1xDNtrX}`GE8%rnyM%fFpD+?B5z{ac0pg8@c*DUL7!4)gUL|Yot^=qp1 znpK!_Q%q76lXm`Q8mlcYD%^D4VPXN2qm7J+{#?dlbGeM8ot8*O0@@LQ{}}4{iCkG< zoRt8uHcncXDI&YMGzG12O44Pbe@-_^>+k&L0bC!kUfl_GlZx7heKbQ2%*@iBtNEI7 zeUkM+X|(S6BMy*AneJ;V|WI7=P&)%?d&<6=e{s&@USlAN^$yH;VxLTi%%L?+ZA&(CLT94!0L&%0;g z9Tv>wZeAG16dfpnIS;7LE0@Bsq7$|pF0|O{Z{~me?ZQ~QRp@l|n?C4_^xr|`#adwH z;#~u3or{=c1OaPU z@T@{l7op;abEKQ)aIOlP{4mugoPztll?3*nl0Fso6ekY1{jBx}eyx1&VbXX??Ig2q z1RIX(8qeCDNE8JurAdvkaFd;Z-Dt#g1aet>m>F+YSJ( zN(Bw*I^U1WxbZo|GByJVxYXi~>Ms~*$-*L@RpK%rwm#b7oi)#~w1C|h^HmNxXq5Ui zYo^5w9gj&wt)s(yQP@CaF_jj9(m6GDLJ!Gm?+1LiB-*nP(BrrZ9y2IZlo&Q#woF0b z+iKM4J1?@m|I^=0m_8O~Db)RD- z4z0a_C=h(wALGlWL%#A|#=P}b>ZZ?2+^C$m^p^44U@8RNt_<&(SN2mr^Y?Sht$#gk z>sO)wL*eTdvox5?s{QK zhh8hsOEyLK1Qcj){lLF>a9z0;i*7#nD)1123kNXNYemWjaDzM>!THYqwhM!n(+q)I zqcljjCerBQVYM6`KLgG`^|}?mr;Llfjx8TPp#&@SK2GFs)1+<~fHz~~_kU$U&HBb% zvMGT47(6Y=7JYN-B_W#V#KexC-;Sk!YXI}F zd1i|KG@phJhLpnp;0fsa2`u2e=NwWk3OkD`u%Ij zXlKayddLKE*fhLb0+@CwRb-kRDkUrubHse9Fq{%xsc*;H*O+EKC?s4B#+;StD`o~3 zmsWs>F?l+d8B465g%KhBb}95&pJY$2Vp0X;zBUZ2ddMX;mF=q~+2o9HzRS;QqztMa zmI{?bs7i=#lQ39Du*?k&_+9XzpC6Ld$yqJ*X+Ck)MHu#ozzjO+>iSa&Y8%B<2z~9u z$_IWAtr^wf9(lDN4g&zAxI0CEvFGbEBq%0l~hk#W)a&n&gioIMyV#knj`=Hsc&J&9fM9@isosc)HC#V^3| z)jp+W{rZH*a!pMR?-RLS??$^#M?>aiOXJWm6-Gfbp#iwVv$Rulyi>oVr{=$?G|a?n z4#W~7@W~!djsrf*SH3^9ZFsDYNUEp!v(3fxz6G}OQKVylWYuRJnA5bxn}hZ%DT!

    QRp_QBTQHFU?VJ%TXUsQDAt{5IoUP8qqMW z(Qqlz@Ga4ZE78c$(WrPa=sYo)8Zp?eF%Y#nxGgaRD=|dRF~oSWq&%_Y8nKkFvD7KC zv@NmpE3u5vvCMdJtUPh-8gZPiaonJkINp{x{*^ev=Qv@!coCj>QH^+U*LaDPc&V0n znU#3C=XiO%1Vx?%WsL+?*97&H1kIKN?Ue-G=L9{xM1xQ1qLFCgnrJpc(rjXc?rVbj z?GMC`sx1$OgSl!ZJ9?_)A5>FoV}&HQ=OpwSTb~jecb;TFyg!mu`oCS#BOR?GQX~dYZC47QsjbDJn&Mncar8*QVPtqN&(_LJ1GS$DFGUG zxyorUBx%mBX^kZ|#h)wo8`D}w#JT}Y0gb3crZ_{cA|sMCV=3qpC3sUBv=7V~^BNh8 zk{S258LKTB>*g6NDH&^k%uP^e#=dLDu13agO6IC-<^fOU;Y!B!O2#=)#+?SrgKO4B zXx3Fr)}{I9i_9~;>^DI6{c{$KW;Wbu7NlD?{A$*NWcJNS#>+|;s%FmfNH&HhiVr0? znHW4evBWJ+HYPBK)FKC9k&6V(#gocKqs^g!&%!9pL`cnM<;`Vx%b^<0M%B!tbITK4 z&E^N@36JJ}=gkvy%m4P0NBfe?vzkvMmCpgp-5JT3kSY*($(Q@gd07-_TjZ=vqZ?PC_c3$akM1!C4Wn!Bu6tl?=-7` zw*+Q1)48?ubB$lBR8h=ok;-Xl25(sae2E-wNyBKVRBBT1QJRK*&6 zWVQ0lqVft@xmsFzq*?iy^V$Jc-KJLkU9I|Tv%lh3Kf+f-(p6tcRly-ty_8mex|Z|P zs#o|*bggR4*XqSlbgl#_K(^f6Nd<=GXAr#_+p_xMbNRVeEp=Ko>R2`WTFp{vEooZq z6Mij;bS*oGuMSeHjtZfU^Q@Y+t(NjjJ^WZ5-&vg~UHy;ODlUY2p|X1Jv3lmRItj~q z9<2tMFEy&KwHj-6YGbvEYxPKN^_mE^T4xO!(pB1HwMuK%mVAvi(zQg=4Ii|Pj#~Bd zWsOc}jen#YJzg7K+nVIontb@0f0i}bf2os9t5;uZGGA+U{nF?{S8q4g=rz_H<=z78 z-fa7&MK7!+W34d~p_NLyCI76&tgNLltTi{S#d)nYq^vc)t(97AuN0LGx;^vzIN7b za9Xkovh3L9>zKpq+;{JsIcq=F>fGe(TrVrX4(nL@(g8)=A!gBe71p^i)|mn9It%M~ zc%!#k!5;5IOz*)&tT@u@LE`T`IqM|Q z?#4auqM+}-o+Jht0hkM?`S>BEs-bXv$OXbn``PloJuK)Ec zkKCi2V?CRIzh8`?SA4zy?n^%(LH`|JFI0H1PNZhe8qRYXK4TiOV;Xs58ufh|op1(I zU#C@+>2i(CNR$%(JtKa`Ma6|)9x0r&g1u- z7v0DZ@0edf1Osgss}W{tozClK6p!G~FPblqyc8%)weO)qr}`9FMJ!5Wj5*6JNy?6_ zj=(EqL$?CUtOOP{H%bFM7q`O7on#kTt%@l%muSv=Wsu5$zLzO%6zX^`NoX&lr7l=z zEDOA^WJWBeFcfaOFAuvdr(`S{GYl$h;|B z8YWiyB9?ha2emq~3O2e6I@Vq{BS z5vR*@G^jou%R>TrdGG7%3@hs=>jMH?hY{Jw8H=X^b4RXgEgfq;Qd_{&vRR~+ew{6d z&H3B+Emy*2Fvis@os6!HtzN=a?TgJh&z*qtVs)fdXrgVr(emYnialodJ+P|0>!nm- zlm>(fGTq(H)!nMJiacU~W;Wo$r?EU6P|n;!Nd(~Vs^k%bPbJ_#3DNRrjz(>zq<>Da__v zS`KCK^29`N`kwY;S_*lT=pgU$H#Y#M|>gBXYOL z>%uJUD8F<6aPpYr%YK^hJ|t5`H0PN94)v$h!OqV8U0=E*}gAbN1Ge)Bl*OWPY` zMRex=^ybw;=7rGafwXR|Pv=F~kN>id>4`B4!_Qp+|KSYA66OvMqE7*6(}j|An0L3E5DaRvdCy%4?BjpBYlN_aDPt7 z>Sb+xhUkH3*H+4}9ysGe7U7V|WA141fhuM~-M^kI|N8hKjNByj+8QNM@$pxH>&1M0)yPL8VXI~VwAFKck=6P84FddaRO`)$6Lr6O zB#UY2o*c|t=3O=mNP_ApF>N(?5^s{o0xSoXIX zTQmgatihkVCJ_t_#3}`xwITgH#P~?$sE6r@1JP(I9g`JEWs)Gj0qd!2C}hK!RYsvS zS#hK0s(2U==f}>5n!u9L^o}r1N=r zRQ0K?U$GM9ni39Y0D1apbq<97%9_ z*v4{GEZ^P4ct}tJHHChBJoFHW^04ixd1x$1l`iv4UV3g>Lc`cPT$6n@>9@cYLF$W> z{R~h6@{c=?&HVaQK`OEwU$X@`iSeaZTch6nrhEnHVPvDtX0si-`t~H_!ZCctq{z8EQ;`&5^9&L+JpUeeDgYYNcQhMfka2V zFj?TY!2m1fA;L8`>15o7J zd#1rciE;>h7-7%tBqah$nraq$Fc#Q;06PipeiYWCf}gB}q)3jcs>P2X2J#gVV47*+laUsG;r&6f@3yN! z7L^TbPMX7}t8qe>stYDVE4nbqR5p9i%{b$2{W=Wykk=q_CrIP4Kjt!pEQ%3` zeU-rJYi~awWJ3jCBSf`vmr$@tN>X+~=!78K3~7Klcfrx-xC#yCX&EcD)L|KDXv6(; z=zGxmU*ZO8U6MHHW;drP7R3rz;85NB^SIDq8plym(#PIvlk=+qIImo@aSp{-ZI4^5 zOP!JgasAcndGO_r*MK|~KC6iwRgn3sY*9RAz!F{{$#0`U$X_QfTr5w7jHUoU_Z3vM zP*FXDCqbS%WRi*S3(_RW#}2ahXdI_yM%E_aJDukAJ=Hh(+}{Qu1jW_Gpk63HMopEl zEo^Gjv`dw#V56|iQCvzu?8&qfpkxOn;h2XoV?tMwPWuf=`Mpu#(#M`p_g3nWJ1NE% zh@q_o&E-@LESaWxl{P?M^KECDzYaL|&)R70?t!3W3b;z!n{D=QbL+SB2YlGE$;uGL0EOTEV;dVYvx{Qdao`mW=@ZfD&n z>T!T!icu`|s0%1zCD_EWk$Sz%3j0L+xEUN|?OBdf`!J`5A5-VRLYvuQ zugXVqI%c2MO6#iUqQy93vZG553!=ft*u4zoMzm1P~hsOUXVvonr!3oFXYH`IC13k9Z&r4B;>jiQ;s8JA3g5frKOv1X#g7 zn{AeFhzfe$d|WJMme{)t-5V<^c`a6ji0eW|;^?G*P(szOj45|v!|M1DE3GQh$ug5u zg~7&r=`LDXkQ5zo&IOA$i}t}n8l_aF^)@C;FyXwceHFb7>OQZ?+Dcjxhp|KIK@QK3 zLA``^Z89@~)*{gI$IsVkAGtp@5Cs@?wYjUm-;I()$=cX$ZDWw1$ z_O1$msavWh5Y;&|(ihH2GB3I8C9p0j<6LZLOp!Poy!mRQgsZEptX#E;XjPWUxv4dJ zR|KFjFLq=3Qo-{@kwzd+K$yz?a*QfNgLET~d2E=>{dBqwmxT=;`%2Z z{4xV%YQ+TpeTJ37lJHtXg;xW*6#&VC(LH|PcI7NIY}F90&aFko=F&k)afg8hzrbRV zwT-?^jnLV#zf<*(tm+vq(N%MeM`krp?ZQ|Q1+)K4V@<8yIjuffVa~6?`zj&XwHW)C zM%|nHpg96sHYLqASt5A|F={(`?_MMF( zkWbUWCSb>z{p?*7QZC#9Vmi5_n2Y69@YRzNk^S#NuW(!3v^Qyurz>o44{Y}{dK zt#ugP3D;bHXZu0?pjRacQ@}N4}nrO6GYK&aoX+;z^jew z5z)5qa0^K!Diws7?-h(~_lsk*@jY&&5}uiiSOd-fdq_j(2sB>c#i#jC?8d8|a)-}s`8deuew;R%`(`Gh>i z2ly}tu=x8E0{8={rPRaQ^Bsjh-({k7h?};g+B`%NR7w`R!~@-rz6T-`RjytIdNluu9>8B@{J|+je4?QCfQLUy~d>hl;j(0o5@6?`5 zVlHD}8#}~A(_lf6!~0q*6%sk^*PGYj#x@X|ExXpv491fj5aKf-;RofDR*f6T0pAt~ z*H*1WODzr7wVfUwlXMQ1-|dR^Dg#l=E3d&r(=IQYHX3ql7GhI69qv-z>cSGhGWmTi zA=w-b7M!L2SQa=PGe-P#YITCZGogLFs6!Of(okmWd8X1l!sBJ!GbP~*G&~ALnJsH5 z6so-aEL^_)RKRvOx9jvrygV4R-|D)e|0rjLUhuRPG-#lh71w$;*slivTSPB==uv76 zWhuHJ+&J(182Le1w|qnc1R4&*Bv%65_B`U;@?2Xu5J#Zq8%xWx!iOkf-tpo}~cl1wtYKCgsap)~6fqA)Q>nvuAZf7`Qg1fBb0{3OSXs)d;B80X> zG2J#sKw+-m0NyoWa*;i{FhebkV$s77=#sG-@UZxfn!=D#j~Iw61;`Iw{&^KX4H9K0 z{1)C{8W?=HYR|gL`gyR>K@JLpv+6)5k%Vu|UZiQ@Z4E@XS5Qt?U&y{*s8U}U)>cw^ zRwou)$X5&vc+$Xt*8bd^5K0)*t*$936dlZsTJb}rB8z;tcgy*8~@R!dS8GYSw2iq z@|mIZZZ3#RYjWBqcw74k{|z5f#P4*1I0RnwX5q_KMfxENF*at3e@w?c9&8x-ug;yR zW$EOHf#gSqiAP9QmIEkzNKU!A(T&+o}Te#6&C#?^Q%jV+0Y-bps%`5?pAS z&T>Ls_1bwluXONKr?;L8I(*ExkYKh_NTI{Qnmb!URIFgN;QGk-w;?irf!p#+gwF-j zNTQ3Uo=5myymtlMY|AeHk{-oRGlzBW-f8I%>8a}`Q!PjVwk^hFGjzidh__P&MNmi6 zWoqn>+wD@34iblAi>A_4g)u{O7=peO?!p;{T-eDi<_M6Q^e~$Qvt%a2NBSX5Qo;#t z(Tl)`?ZBmsX(VfH=VzzPpXoQehki5B6A}OQeKE}pKw%|9nID?MF{sa)h#eknkgbIf z?$X?Rwo9qI6BpM`cDX;IuLml?<-a5$Y|KDVNg*!8Bz+`+Dlho)u?Nfv4x=C(uiq{j z*}jN5h_W*tSV>#B-VtNm*YP4!?;BR9+)6kxZp_C$@h{9sGtqrCp3*mB_(PW5; zqlJ{miHaQ95QaIiYGKOD@%Nx)(Zfv&H{7Z|{YCClippRq#%*btgYuKD;=~=W!kyYq zi$BPx@inLU*C+TQA&d0}VUc{Q!iK3m>6A|T9W~Iko6TX9C!D8wvVz+??q+_ICgtDE zL`(ubVj;A$6Zj?Hms^U*o}Yt&COnCUd;KLTxgBT6l`@NM&nnZZ z()B7iw*J^n+r_dk^-Zrq-E-&FrQh^dSU(t?QtCXot~UH>d0WlvXs78y@U5GHcU$*b znuz0A@8b}5twhjtv_09?6?0SQ9gOC%MO{06Sl)FB)sHZmv|A38)fanqbA*zfR$wQw zf7J*aZP@uqc;K-qQ20gy2aH}V^g#}|=W`#XgBD~4i-iLA zLmKeCiX8=~G14=Hh@+lLvW)%f85WC%p;*zR0fKYFEkxADV683dL%3*gh?v@~HkVy= zZ1KzCANZw)zqRlhZI1H6&3@4#dE3I`MdMqfPADxmhQEuA{-Roco@SJOKO)nw^xQid zmh{2d7pMLfM?$tdDjsII{gdrQK(5|OUvq46JgX1qjRLqS2#Q8 z8;k_(0UtZi6ED)AK->_GcpTG*q-+E)zt9+!yRqWH{qR*~*yYDvYNu$3NFIF^XVhB7 zrV_WR=)bWs)XDIs4yU;^`z?sN!FPk`PCe;~E*655T5!c?Y=KAN3dtd=%Uc}ZoXwdc z7)>Yr6dI)j zT@!tEoAI@$zO&0kxi!Ue8F#*Q5_(i?la5Tc(>RJB?rlIBdvbEC+>(kmW?D%3`aG+~ z5C=ld~bN)F@1h&T+G^X8XK}L`e|4Em8}yMFF-N_gzCBndskg# zAHhURm;>a* zSS5Fog_yL)i=;O_1Y!3uXtu)@RnHjdd=n|8Yt<%uD~CsBv_2nQ2;;C?B=88bJoZh!kCr| zMT0eU6bWh>%MmUy*}GB0!*nsX9nKXAELI9CD&6fNZ)Bjh)tO z^$;XR*XW!GId@<`T)Ob31G62iCYjK&$OU`Om%*x4(yB%{Y`AT!6J zu@%lrV|>gTqi{^uktJX;X9!2ohngUlhCSdAM};Fbu5CGuldR7fD~B_NA!O!t7DtOU zcCXqmV^;0h!Q11KCK*}CXeSuw`Is1y%Ge)T$!8;yYl?86nImXIB5`~mJwoxe@b6(d}2WItda8y#P0e-q<4t=3Yg#Qt<;l=}Dx`Xh8X|ia1XO>k%*eY7& zD?>-MR{F3mXL1Q0U7@Ke1Efc`WU8T3ACCA`czp8E%F-%zk|5D#*m|#lr zTl#1>PPT=s&T(^v{@Pjn>W?ifHcdCa)U=~sHtV+c2lq$ZLvcm3Z%27D_!&1~!Hcrd zbo~?KUWjbI^L65Zt^@pVM_uZ`u0xR;I3R~4as!(0(C;r5ea*bp8e`yD$I!7Zu{MRi z-3Y_~eeYNzu@s+KN+*YSXVaL?LTnKo+=uv+=Rmi`19@8>e}Zjjx(*-U3>TUD`>}HD z>(ea@xwH1cs%Jj9qb*lYI&{F;ZSe4df1?N9IJL*VtUF5!g*MAARPn+uugCLekwNb5 zqSJp%R%;o)5k^1)Vz*GG;GKvE!!`G{Kv`BUTZZwmHd9;hmQ_tuTSe5ex>{|E(W9yH zt-DeL{&7KdjTIx=v+u)sAHl&@KZVJ5%M_CT{>m=LX-1z?9{$>uZO^fS z2@iw6i)Hok#z{MFvm->&6E;xxb($~a%fpHkHj6~N!va)|Nh5?q70z8;36H>fP#$(# zGc*`*RnaW|S3Z3xXWxgzg-7xS5{UTc9cCm!x%C)aTz4u=zI!R6 z5g#}E-dBQg?PuJHXgR}Xi~=7iPPnl#jWE)!^dn>;m%IUaVRu3tx>K1eeq@Op$Q(r_ z5EIscg2|$dI>FbJPN`;OiyNq)>0N#ss)1t##x>8(nUvAU`K3s;XD==%E16-R36Hbj zpFzl)mNTebN%WgoSt&X_g>pt#$?$i#=Y)kxVZJDAt4i zly+5aID%2Sl1-V8FPvKCPNOYvJ<(j4-(FlDG+p9gjZ7yum7G*hAIng5CS;+%7>eYT zB{NpSzn!_5p_!HVpF%AG)s!IniF=eLpMyva@e&i`Nsb(*r4F!u;VuofkjP^V7EZXR z^kz(_B(JN2UO0?cJ}zX5SC!t)+2iVJBUjN8faUO6^@(ZUb%-lf^fre$T!RQP!idKo zCtj4;TNi7!qz{?PQ_BDhH|4(?XkTyr#+zvg+WvlNg!Ve>kD+mekZ9Uj{d(SlTZ@pW zMmRCsv(_1b*G7ZmyXL+V6i80Du7wM({|L4F5hjIWh>LM;Uxj8OAbwr6T$sR|5w8P- zYbTJ8jnI-mP~acuuiCAulWuhcw|+{^V>!Aap5NF^^T`T(ytZ_6a2n>${MuUEAg9jM zH=KiU7ysx^6t`};;u)2Tp`h+GqL!kF-y>vmCG~UW z0MOPwe^mi~woRW}yFty-Mx8xujmGc6?^Q5r+zFGa!UvEvC29*(S28T8CR?ij0L&;F zy{mZ2zFU>j+;p1qMTDw$BFkk!Z>OzDJaur5&*09FN}D@j6SiI^`Gg<-Fk-}MXu~@y z+z~0hzCcSOn{^aRU#1km00kC=RQdK&eYhaY4-`QLW>0bX3`PkzSydH}Esh5zJe@HZbOFaBjpUL3GZrhv9 z)lxsxfz(s|RTREq+^2&;Z0Zxd&n(+dGf#9+_G1+RE1awtVSrToYT~_pF&g1VqN22V zRO)nPP=CdCqeqYE#Y)aw@CY1Wn0W7&fa=bo}fDBY86D9v$yMM#J3PLf>4Y!Kj)$e>%(L_dqnPYD@Q*VG|s+)?}0_Ku(q(0~KlK zo&)j3!IW)h57IKFHABWWW3)?CQsHMbO9DICM>v?dAN^oz^!LFKe|#5ricD(1P))tG zEDH4=BLS6k8sXM#ZFqkIY<^dDfFG|`>b)$@Jo-Yt#-t%_ZlH~8t{}}2shB6td3~UW zp@SQVCsT?2MM(N(?eiXG&9$?|ezWjy~y_O){ERR^EoCKzxypl|q z9<3#w7+{4sXo2>YhCG}k+a(wAoKWTlPcaOEMquC z{JkY}#Cx=^Z&Y{~x;lROF5{N1U}(i=Bt>BFIY4q4;rFnlLn|jg zJP-~k=S*Ib4;vMvjQl)WAx13yX$dwe@_66`wiN59lc~*u;sA5SMkRh#2*OLkpRG#c zluP?>itB2AzNL|Bke1#}M}*Kx|5%dTO_B%fh^TBjbyUdU#Fnq%07tO-2M^#ZaHLjg zUki^U#1EN3mC$|Kh^$JQVtOSET=@P~#yD+-uu4P*OG%#$k8=z1wQqFZS{lx9l+XpG z{z|3cL+P{MYMKaz0#ZlpooQ602=qUWu(GTW%Z@bO)M$2T9R?886Dt)y zRS1(xBLIFs+pkOD{8lK9GPo_%R+ZNEpGtyva1~GD{M3maT@9TxKlrB0?oIo zS|l}0HPg`HXhr5MWme$T&EqUsGL%yF;kk$%(NMKWEv23D@V&L|jp^8atO^*Ocqksm z?;zOU(&%R*pg^sah6z7N)>QG+JGkoNsamlXA9JFexO}8zO=n!VvQ)}l-=VKmX+3@c zXwy%f&?}ZJ$W+??vB;sRps!!`MZ*syw6i6q6~bh|*U2z4pwpB(j@U{Me_>*1oj1}< zwWp+YfUg1g*=qf;!BD9FVt**9OyB`Ok&Fu9EzT~ZsODs3Ru^9tL>p$ES&&GrRX?<1 z|7hzMKg!&i#$tLXHw?4mjV5+xrAr*I;f)w$e5uxf5BL1DEXO>mx|PF(rseTtEq81s zYsw(|BV%6EydQ0iR}-!Gc+9FeXCFknujT3XUV_qxXg!8<^^-6}R`>4)qim`GnbgVozNX>{uerz|@M@|>Rr?2x$jeD>RQS|y-R$OKrpj*M=-xwzb^2d+=zR z2FLVm+!7KDYtV42i(YoL>3S#b>Y-uge(}<}{qiEe$@)xrKOIx_=DMa5#o5>i(KKeO zmE%2@S;_u0a1MUv*4Ubg!e`#=*m9m{F%m`jqY@cCoys8^HukmU`kWT^K|S^wYa$}` z$A6S1myS*qG`ZJ=Q&XmL2WuaM_Y?n5FA zI=gj!3TYl#W8Y_y>r1`zIRMeXcnumEE|3bHs5AX>sgN0J|Xo@!ni^?2%Oc%Gu(m@#VJh!VsS( z3KhN^rin`%_6uib?(xbxv1O~pIZL=Dbhu&qHrj&S&WN4+XqagaHg<{WbX{=YA{G=kTN#hf?4E5;^*i0g(Hf;Te5_qL32)AL-k+ne8`RS& zyD*0IYZwD7Mg@<}oMQUFx8SA6AT<3+woUd)!hZMEPsJxZW4}eB!Hzs%7bw=+KOmYR zYgBR}Vc#O{jzJncEO2DTG`O-Aj&HQ{~c&5lT{YLHtjmUHJy#!`NoT*`{=Ay8_dqgoIM5 zLinlu^>9#6l|rh{8Yiq5`MV4^L$eH{124;F()=M1rHJc8SICO&fG=T#SW$B z2Z;?nnVR&kGGX?Z-fz;JVy`MrYZ zaylyIIq~CE&ZP!2KkZm)zIcU2)w zEs+6L7a&bi?($IXbE@&Hm#qDRg;BdR^03T$j?Zf+0`SyOg|B5$TPbZ-k4jx%N%yVY z3!qZ3Y|ST6rxC979245{g;T(XOgg%&Drf+o-CJJszsFb(KPgTxs9(A}9ZVpu>p)+t z9aigSD&Plo>;9IeZs{RNRVZyCtx?d3g5)IGUpWRTkS@|9(j&A*Fpw{f64(}z5&s}xDn#GVi=1W_=4)qcvWn;lh_@hi|0@-;c};Yt%2^6%U5+l z>H4o}O=cPn{eAk4L5fXYl_Pv0D*g+NJb)W7>Y}%LOP6HWexP8moD4J%?>++ciN06e ze!g?M?`b^6j=u8Ac-y~0Dgo)=-`;gybtkQo9OIOe_ue4;zp2@c>rc(k>W*4}L#BNT zsJ+$fyP~M7CgonNf9Dk==CpQ}ecq7zx@TkIy!$+9%plr1<^U6Oka^P$*xR9>4{d9?v=Foe}?c>L&r)*%13Xv8E^m5 zg=(q~D*Kflx(mbEVWRx-n&g(zo%Gr`A}2BoF#Aa=*-Ry|vP>UV`W}v6&{*pwlvYP# z%c07*BFc|wJmRlyYpY8{Xkhb32W_aLO+;WTph`plt(77%O*#{aS*qpJSkgv+MV6Lk zCX%IXNNuPlgfV~i$GsO$&r*QHN_)ib(Wsw}HFRF1bL4|Ltw*Y&(msQ^f5=4wE5e+6 z+fDlD#lR@TTOOq{kz~tQCYL(a3du)~YXzIFCd)P9ZEJ`HohAcaCE4*lm4nXp2|iyghm?EHHZ)!nWdo*1PlDw@^lzERc5=W{a{6#O8sGib+Y2W zABwb1JHOs1{MqG`DiK&I)3F4_hs!KoJER{{N>wOfJSlWXxpYa~6CQZxc-hgcieb1J zZ1NfDq%({3Sa__CiGMJDw8&<-9VK=T&(OJd(>ax=Hl0u|sRM?kB0#+X2;FL71Pr_i zc(ffnxZt$-d^QF+3BzmlwRZY6K|0iUz*J6zm%2<^I?8SN)fPL-99qv0oRRvs!dlvh z?!elQ#aJ(nVvQGzZi4MAOB|xS*kdj9h$J)i(_OM3l2)@_IW%y2WE8P!co%2fWeeEp zb%z5UM<2l1UY}OPXAw5kv|IGAYPFiZ*qKok>6nunR8=s+Y8~Uiwn>iv{w}e+$lh`B zXn&xX;^b}szRm2Q$mjYM54CZ&>MK4C?=m!c+A>O2xa)CCnh86t;tm59)Kg~*nH9FO@gkv}6>&ew`3DB|a*x z!0Nj)qy@HKjXxxlAB=bT^np@MqKzyUfK5q*^-liNW#u(ppmgv`8P0z+EA) zt&7OTt{pZpK^K28KL%gjH$PI?XI)39M197nKV+=KX!h&M~uz9{UcCa4&09N^Y8KlpzQVD_}avN~(S@qm0K{RAeI zc^sbHf%u<)sHCi@9U^IMj%lWYQB%%#VhLbrd`0|}i!yLF%z6t7O~TmS6d>V!u2cU; z&X>p3Q7c}b1xi5sV*ZEtY_bt}9b;K>_`+kLbQjE()p3KY|925rWC>_aOTxHo>7g9P zk3=&yn#y}VIWvIDo40D5!QBX*akh=j{d>VEFrtv_ERskB zn1soZD2n;w%C6{7KSQff5sv6Bnt%W~7RSXP)|Dd4F*_xr7mchxo|e^+noko@&0Q}( zHl8edv8tZ6rY>;?tMzNHomLGB-i~p#TU?8% zs7a5mTv~yM-nu29mZ9n&EE!xU`|03g@Az@?~OI=!8 z*WsiH_qvrh%-`sAeQxQVptsS~)*4y&-3nbve`B|&VW57m?>O=@9-H%O91xFF2e8iVFVwyZ#0Sf$Vx&#(2854*k;Vpz7qc= zUvrC*{A&TcTknS(yop^;I7G}4`pI6ba)Ka1h4{X9Mx(@?AeQ(W=konCxk8e{`wyv0 zawlXcZ&TFt(tH5Wp*Idl#<^^sA$2%4Dzp6I$4(I4so%8dACHi-D{DYZ&yWq$UG5^g zEq{Ukptbm2{@#o&bgl>NLFiHRyYN(?#$e8Gm$wl1%T5s4aNdiuy$ot>|Cug-TFS>O zuBKm-4Ue89iSafk>94&QJRF?TV{3I!kV3n8{z~cFeU(b%A#z*9aOixL)@a63J=hI-xc=aI2;IUbVmz6JgDE?lI#k9v+!Szv(%Tdg!lhu zV1j~Giaj!$jgL9(pwlK;TrAS1)O0D(@y{Wi1ue8_WlO>{?jandu)?!1$O>~wruXS| zVh5GoeoJLd_m#Y27dmF03sp@x^>zcwd`z*kjg*hLz(l?~o372p5TA~kqH8DL!0m%K zpPq>#*dNcXz#T}4@4#u%e}PYddvGw{5#-{VZ-PMwz)-(2rea8f?`t|4mH&iN@oh#| z&@p$Yf5#WoyS%5MQ%RWrVodRUg<$ZxMrgolP4UBb-{4CNSit5)@nc(8@U?qr;La)K zW8vPv|NOCo+Fr$<$A|_YX`w;KupPpEf?>`wSkSp#$;)zA$O9-e_}Z@Ib^9sgX#^Gw ziFqeT1w)~Wp&<`7CI2pcLthVIA<&7Ex4W*;e~{47f2Sp|*QZbz+zkwY3xMhdz-$2k zZvX^ba3pSU6fJNxH*gGG@GNfd94+wNH}L#iAB5dLh_!r>y!jx*g`nVupwfb%af1NU z;X*WULo{hYBy;00Jfs?qK(cE=a=$_HUZ8hQMfO}kw&6mF!a+eSMGj1*OKzb~Po>Uo zL5aCRE#pF~azm?YL2JB01972uxS{v7pbw;?hTfo$xnX>3K?UDnR4rgErt&?iAg!iS zZ!ORtx?!HTU|ru}4c%Zu+_0f7*#B;@|8v9oiG%Z79p``x1rvyk2gHd>1yVqOG~Bqp z>bNZK{P%8{L?B##Al~&2t{@1D7lKCuLRE0bk%8cAa1-db6BvL9Odtdn+=M#Zd(o+c zHjC&kAZm{^Y9EakR|ru!H*u6ZaU6&^2|}F4O;XW9lm#Lwf{>JPlUBKt!s4M0Sf+$h-T)VP`e!d4n6h??93eKwL9H67>xBI48};!h_M^gv<5 zrIz$SN4=%{f=iMIqPMxBzf7gqaHr9@#dBC>Fl(h6aHHf+r*mH-@_u)^w$k})GAQBF z1$!`i-ZI6tG9}zHhc6LZY2rumuz2E<=XfyIwX!zevVwTnIy~5VTG<9}*+zKS$2{1< zt?aY6?29}cs~#MitsFbI90xofk3Bw~w|>07{RrXVeDL6ewsOM$-EzY5av^$hp|){h z-f;nWxd}YEN!qw6?zm}qc^Eu-SlW0v?s&L)dHFqgh1+<=?sz46`D8r#6x#Sy?)Wr# z`E@+`4chok?)WWu1#CP89NGk2?gZR<1-(55{o4eC?*zkng`zx#;@X6g?u62Kg|j?` z^V;6m>xIjBMXEeS>e@sa??gbnq8*;1J#C@`ccLS_pT;~tf!jXK-hEo+68hkQ3UNQ#lGA8#j7JRZc zUa}7DvM%?s?tF6IUUL5Ja>4g<;e7H@Uh;A6@=5pdX?zMGCsvBFU7ic z#m0L@D(;Vp+Df2%f*vpSp-k+b?MmQw<=K1XMLv~PFO|)9m7RN)13uMbFV*vQ)$4mz z2%p-6mm0KP?cco`9KSlEw>oNvI_85qkY9tqTZ5!SgW^GhhF_DxTa%?jljA{?n_r9H zTT8e@OYA{Ql3!cKTU((+TjfDpgI`C-TgRY7$K*lBf?wChTi2mO*X2RionOz}ThG5k zFZe<4-M<~>tsmE+pY))g#&3}2ZIIVtQ1oC>#%~C#@;0pNFl>A<1o0bncpLR}7!5oa zjqn?fc^iW}jAtK=7x_(Ay-hYdOm-ej4){%vy-m+MOs^kIA^c_!-e%Aavwsg}a02Ft zKIW*M=9rJ>KmiK^9}ALB3yMbz8UafNA4`@_OO8iNZUHNPA1mQbE3ro_NdapaA8Un9 zYn4aqcW<_ikBvd6jme{pg@CP%kF7(et;?gWyMUdykDY&~UGSq_xPX0>k9}OHebS?S znt(%=k3(LkL(!u{nSf)Jk7He@W8#~Iw|Jp1UpDB!Z{ z%QyJRH(by!%GWQh%P;B4FHO)t%hx}z%fIN!zf3To z$~T~{E1>Zy03;aL;Tzb~6*%w|I3gG{<{Jd=3YvWiS`-Xk^$p(a3f_4NJ`fB!_6<4j z3b}p?fe3~^_=ZB?e+N&Ya6(~-eqpHHVVKWh|F2p2*<->hoZ>m0Mks>8FM_2zg5x=Y zTj(3V-#6jzZ(`5iB!wbn{2~>)BVj7fks3l#I(|_G-BBjbQ5HhcHh$3#-O(=3(e6Sq z-hMIu-7&$>G2ue7QGT&;-LXl}v1vkaS^9d{7I8(-ab-gBRetex-SLgj@gSju4!?w+ z?u3Eogb|^{F~3A`cjD}G;v%szlLx7j6+a_K(t%L&v0w6eck=afGDIll!7l~co$~KF z1x`2>(LWWnClwQ#3KUKw@J}P@Nuz+K(FmtA_@}ebeF^kacvwhJ`dT{y?vKgYi(Cm5O&E}R?XpBvYc zn?xekwV#{ipO@E@R|L%?DihAH^3Sj9$!~<_gML)y$Vjd_$v9Y_DCckk4Q>nQE_Fu2Glkj92Wa zU;VD%=D0J}@qNA7{AWCcQfI?voBeXV$#iGqc9+}lsUoGWrky^&yNjLauI9a=un*{z z?5X$%KV$LOOlP`5zb8`Zl!}#mT92o5d7XA=dfHCsOTQ#gs`R#>FV|{)H=XV6xLj|s znl4u9>%89X_PpGk?d$q)Z}=NJm1=)C#+(6&c zfBQcZU{q>@{m{F!9 z2n>O<|MRZE&R;&4*IoP3Y=63svYr0)oK=7S(|gr<`KRw@obA8<`!%Qk2A)s8|2O#e z@$$bR05bc{FanYD%?Jup!_5y2!K<5}ICAWeQG7jT$QZF*17w`s_X;vW9m9S*NuT3< z3udlqxSe9}y1Jd_nqa@1;ahjUn-w~3xSRX*bagi`fy{BgAWh_QzbMbtc)z49czwUD zF30h(qOIrhu&Qs@_^@W|d;PF(9>ejtVV&dhxM^S0__*cVb^W;QHo@`q%WK``X~*xh z@o6{c33mOo7l!=tc|VfK_4y!{sp&tm|+2V!5pK4ctU=hCm)jd|6PH-kR-Rn3i4C= z36U*GvfoSv<F^t625GQ@XvkSuKfG>~;#%hFiDU-7{4meZkYFFSj|v z7}Z=c3Nx0Zce#_w)jT=i8C#LNyoJPSz8ZyDN5i}PjhSkJF7T{tz+J(9!_Mb;-Z{7Y zWffFrRgrn{oKG)a$}#&SX8@jB#Ecg8Lr{%4$Qnj`c<)&Pz^s*+6(Tsq_bNq6(i9JG zTZk07FT+Wym1a_0j5qY62XxoU3QjF12i#XsI@W%bMq5hHzprFgsZ-ROTFUOdui{Fo zQ?^rF&fmJP7MiV7^_^NSez~uaz^qq~QCuk}eW;aYVA0H(TB)u+DOOFY*RD}qtv7t& zf%VtxLbcNy10KGcV}944h|h{<&1$e$`EIyAwbt4D(CC)*-S|{-y?5)O$**I_;BIPN z;F@17^!mFwveL#6Qi0&dS~W}T>5X~`9q|;G2J5n=Rj9U4Ywm1=?Fjxx0zD0!LhiiX zm%h!VM`<)f6U`9@wJZy?t@+JyB^6SfAc~ z?0p)zNoo!{RoZ*mdK!G5Z4P;w-g|p_8UkRogdr>M!;?J^qo}q-5Y6l(i9V0uB)3E| zDIcI2J^vt{Yl#+|Ilu~h{z;7mij`A7#4UIpWmW~n>&+Yz_C1erC4&;}lz)?MKaUH| zfs%dSi@#ou{G9_2Lt4IpGspReGTybhO|FWRfD2>1G zy_R|vG9ULd4I3#M!WkFRL1BqC!(tvDB?y8ngC7MYwL@?s>(nXt!Pl) zTqKLdaLSnI;S%^o#I=+Ni2erP|au>sLzL!5`5(Zsn(u@J&fLgs|L!VvZXkL(%+6TDQ}G4^S5qP5wr_@mv&*JVQba*4-b>oLN4isv;Ub zdpHazpDAYPVCn&XHiOPjS3aS^iHcX4+{J|jcj=}Csg38orjX-r%LocL+BE&$=j?w* zJRiUh;{+T|7*X?d1;C`{0^I+Lu|7mP5Wm!rTAIi(dz|Eqg_enX7IK;ZYR#rz*jm;9 z(2f4Z0J=b!00%X|AwcksAaK-IJ&qudElr1{BQ)W`o!dQ-6B5G59p0%&@OuRfLKJv> z6v{2BdEOrSU%SVhHSqx>0AC2`;EO|R53Fo4>UeVexfUS=@@Iq75z+?+bVZyC;E2Qm zC4_J|iM=0JfM-mAbT{2k_MsGIZenM+5U)ra?nq>aheS(6ZB!Iic$g}86br;%PzX3= z9*$|@WP2QlVd0Lhhnr4~qZ{ik1E*tZkH_=$u91jlw}?>*4-b|@Lbr){KyqcDjHY1F z;2$$$D>8k~d-$?VuvJa3IN)qkD@$JUlI%5vb!8@MRaAJ=6kY?<(kw9eO zhae9$-$)*e2^-W^O=C(qwF`3IP*Yq@#MJOV&I~1n_`<7uJlm(JF##Ni)c#Bc!UO!8 z{Zf#*LkayuS!hzg-GQVADP}@ABdejti|Pr-p@6tpr5uFgY*m)Jv^w7eX^pTDB7B5( z*J&7`>*EbN6KV!3N(w;TgF4pth8Rd;5c*`7NKB*oTN-Vxo8VzIg@+~+ek8+D4o4F; zsv0HkGB@n5HhtnOP{u(6%Pw^xHkjtXh1WL|?Z8bu?khQR6mT)gVH2lb$VrDK021kX z=ACRfk{zW_xJ2v$&+VZ|lyFRsh~}G3?Cy<0L|A73H9QZ;^*OlT8>s$}IpmWSD3llA zN0P{*hCUL*VUZdW6^G7EfEwmRQJZOlhzC%|^~eDNW3$^FaNFX-F&DFx&ePWA@R~ML zk>GM2+yk4s3&^|Ug@E}q3PHcy^;h&$nV$+Y^)kMq=5ytcbZz2>%4kv$8(ERyr@@H) zSL|`lnemo&is4K1DBX)OMhsK+fxlzDnGSM*2RW52fJX%aueuUf8n}y|_}9D;bsD!1 ztbr=rCCKij`$QQn&si9YCBho2fBbyy6R1^sjVoITR zz>SpDIW9&J}R4<^@*a022@(W$*7WbJSYwnnLq9P0#KMN}4=>n1icrHxO!o zr^=j=6c8RAi{r|YpAb;%5tp6DiVKa+mIqf8_~NkT)+vH=Nfyy?4Wr@Rb2KE;N=Os4 zSY5FX>SH#te+lPj2H^e{pkv>PsUm1#iLd4~Y*=?7qd-m90~J+}`VvVth=;pulhjj@ z5RfYpt}0el1jKcMV?{)8?*)mL(6W!G@J|D94SIr>Y{`eatN&<}xdV%_KU6w(q=NHt zO&l6|9P-9VfxU4#>`%bz$>tf6dIaB=@{7RT{ARiMX4p$8oqW~Imh<#foh}?m=`8CY zppld$t^3Ji9^8c0m!~wFxQDTKaN)>cG4N*odbRwMsv-teNxB5m2HllM@aZ;tG zYmv^Y%nn6Rs6jy|dS4u(T#J)ZJ`eL0D+E}A96o7hcK()R$@9DNOGGLoiSl)JT zGFrdbNMEU8zjPpOcR&vqy{_IU&%3A4sd+;4NeMb5l9Zw4`@m_@H z@)CI6M{zoh3)v?9Z(CEbu4a)H=;=se4DNa}0zR^~u%iR*(Z9jAaqRN-Bc?pOx%ReVF&f+rx`YWh1~Eh3z!skP2~rsFr|U06TqPU^);PDWA#CpW+btu_ zzxc82!(2{vgg}=(_8)kPKim>X9{Rdy{9UpNfYE<(YOYF=7blHhCN=Y`^O^DTl&fuf zb*h=ioeq8u7XIJ>mai)H7lHd*&~;2^@Rj@V>*Gte1ABEL?t_ed3reFS{S(UW{SF)b zc!4wAhNDiBV8-pHa%ZAmzd7zS4e?dJY0lt#sal;zD_ne9NlPV$hB=5J6Sn?-o`m(vkGU2}g zWA0^+@Re4`oFwha4BSFQ*@`R$vrI5<>nA);vAD3b*(i@yUAR^6)nyu*wV{!PUo_!E zfAQ&5x|-wg7-w;ni%4}a@g$0fJug<=WZkr0XSOh!iZBQ(!K+`(3Mh*3A~17WF8egx zH^u{J9S?@dbCV7vj>Q*O(>fP)^jkKa11CsF$oi1!8jb7nPLl!7i*QuDHZI% zuSrctkS#fyZAILzqTucBqV3*+?NQ6^5XtTD?D&HwQwqPRhLcEsx=?^;w_{x#o3<$l zFte(5wnY8Dzx_%v9oblP+FDg1*@QLhpv?X{6x&sRN5C~FuB3)5RM|!I{8ezU8wt0^ zY)trb2Mf0ET@tmvNxL`UXg;k%@ru0rPtve8dp?pB;$VZq2ng zM06peb0y?bZLRI^irNXt+1XbE>5J_yg-h;(-F1aj)zT!7e3b~&vRVeF5Bt*&+uV;7 z7LPVse~Zwp>bg=HzTuhA5dqvzUf_={2B+mEz3~c{c;85CnSUR+5ExTZy@=s@4H5?q zo}|1oDVXc_)}C0npK`UvlEVHFMgBQW&^)mM?F(u62hW{V9UUvfoztdi;H#eJx1GCl zpR-tC7tftEd_P70ms7(5II>00Rh|BYNovpt2J)QXRcR-Sr_FJH&knhu&5I(_7;2v* zA*)%bm(#3h!mI5%lNL5?Z1M2~U2ZS#hZ7iQyy;Et;=50tqW~`p*H=p64A1@>`!>&WYdoNc<8VbS^bSi$C#4 zEQLuhltyMq_{W$Acl&qvhUbeep-z&`0}{NA!w`vvR}k z@%u)1HMizRFS92fPAej#ADSN?efOS1U{7IG&us?}h(DeLEuRU$JlC;5_sFiMnK&g< zLDN4&GhvV{PGN>-=Dbj7;U2UY1|=gndUdZ+m3l$peM0>9>>f80C;4AkE7bBJv@4mi z`<1=}``swbS^uBPY4NMI|XM^`}Fw*d=nfh?(3&t~W;4A6GN0ODHzkix(FZZ4%#NHUrfn%J+ zB#3Xdp0K0EHvo;qzC;8fCZ%+)`hiq5CWUw;vBsfvJOPJpyRXJ?*<=c_5CjsO(BYlPEq%lN;PxPi1kKjTai++0GS-g(6WH-rFx#sg%eT89q3!HJS`X zQy4uuZ*{<2_Qs2ho?Leaf?-IM#?NktV@XtU#l}#Nli8xrF_b1RUKgv4W)sCGuRecv z211dkO#k}b9?zD@m6-kuc)Z>jilH)l3wn9D-kT^fgN3~P`v*hjl7K^|Z;|+bEzKo~ zNMzk2iA)vAC56gV*&>C`Im-0~Q}C$e3-)IOZfT$#JxCf)O`2PVK+hT^Lu3}oElXlo z36drII?63a;d=yVFqK5|D6-U4wkonUkMbzJGfVH* zydeZ$W$p?3Hf7#>oB1&)?Wh$B|TF5evsk+-Tfpc8QDoOC9+bZQVlCX7}9Al4lhMKIfO_rW* zk4=tQw6JZSU3HIb!PjwNyCUC{9=noIBoX_v7{*@viWFH9hpHUgUWb~JXc5P{n(AJd zibH|CO> zoS65jp51`=x><~v&!%0?fY0{V2{GRt-_rr#y-;Lvzk?X2LBHQAa^n8SId+5orzJ7s z0p~R}g8`S#6XJo_U8jSA{|zC34uVWD4F%oJ%Y6=hShpJre%g!q90Gk`cnx{|Z{qX& z*ywa96b3^!2OtVbz!NTnAxoRX6Ld=;2`q$TN17ur2uY&pE<_NGnj`UdOJeyfz`ju- zSfI!VN#SNML^4TRpy_l=5q2&_aYkBT*a&?gU2_vCqDAdREB_LI<3=rxkAj0pElo>V z8H*%*sOTn?LC+%{i(+tyTh@(3A;8V2h7m_l_f00#4MK0qhe7;GCmWaQ&Su+AlP|(B z_N^t2%T>AJ%f5WQ@JVHIZI2asfhM;2(zldQd=xQwI{9xnt+dgR@?uEk@^M_6fMn}f zI)cc8sj8w)Xj_fh-jTTw**GonG z)jvHn8le=a(M|@fUM+g?sFd2kUXqq{K9ba?oWG~`Gh6&(l4E-r0@z+!Dn2ze+pC1h zds6;exn_5Zc8Y|DHAj4&LLO;lb=2PqDnvIe`EooO@!(^%XZe|=Ql0`)7Y6!oaf%hY z_tiKDEHo1&D>d*PsluQO^~CsTL$0Mdlg)a!R??yt%B*}_Z(Bomg|udmqdEkzqXF5i zdda7(Cet)0`CZo3fj{@u!NDx){RVUWNNX)IVqksATR9n4U7BPuJD74e7^vln+iDQS zE{$NY8O5jjeao1Ylba;-2dz!(h=#R;%?JIt7M?s(u(PXn!UjP{IwkVXD9w`rw!5i7 zEoK~trZL)jCW>~c6N5axdVcEfkG>3m7CSj)G|h7)-zK);Nt1$2Tt6&9&b5a)4;c{I z4J!hilq8d_ic{LJE$O~U?sK^!B_j-(td0*P6AkRNI_{4eG*28TVg8r8Qo5^+AK&2%HDY+VUBSe z3AjrExK668rEeuw`i`N4KIW`mSXeM3^oNNtr;$iuB_)o~G1{VJDOt)3<>;)f~c7@S$nUw*V^ShYrp5W&$+JiJO9LUJyH;bys4{CPah$Kz93hsC1fXtbv1uht9tGIeJdFE;W zKO1ij_W`6-D8}lO-_YkNl~SQqO#NqyYSJ>R+%;<4{*9VaZ>N<2IIN%g6?r}R z9jbSC7LdH<{&#*fI^scIa(szO>MfiS+aXR30z$~X+v{B3C?2orCid>&BvE?b^^WOX zT2uogpS?co0s=3l-gA|Yl1N>pkLO}fSE~cPL?Q`>@9S>Br1nm5mG3h7qgsGo=(ihR zP6YS@>vT;0%>(HhdEVD#^Sn`dh!Sm-qooVEtS0WrD9gP7Rr#(O|G?=vIVG&$xdk2lh$ z_{K;nG<>DXtuZXI`P>8LxltZ=tniH&Ah>*UsCPN3ABFQU36F8}XDtPPb-57J>K6T) z6`1mt56J49(yBy3H&)Vzz6H+++8;ZwCs^yRE2GGJ`*7{*c5;dDN?pHOE2U^8hZE&R z{=#zDZGYQql;h3O2o*ns)U&%34E7=n{B;40%?V=^&hns$Z&E%WKzzeZ??c(WdMF)) zf+pm40&g3hc(f^DMe0=+Nc&Fv?aLH}V?mq?R0>?6z(7)SBoAqw0Q7!ckp7TRr+}=OFL8hP_NuN!6Hzz46yZgAfSH5Ojx8sX$ zjwYPONRsMHg)G~iDk?ffL`Z3BkII3$g9j1Go!+l*&2HhX6x_f0ioc+38 zV!K`8Okx;jNh(_R>~0T*CIvnUPf=>Gg>G+tgpZ`Uyj@m^SC;<+b=94~NK18J5W*)B z;pu?DPkLnm*+7CAL^u;gxD_~1L0#$sBH}u?>~qSstW22tot)ur?t;)@(I9>W4S&I& zo;r8DLAFi-w6H` zN>k+2Yw?JfNk1q$Rx`Mt`nFX_RxGHziaLr3P~)T(;TIIYKwZg10b>F*RB2V4Q-nEz zYEKb~Wm?G;{Y`8SVq5xrZP}`_DLS2~8~KCULMghL7#{gPXqQMx+n{jLPyu^oJuPcY zaH77{_JH4wf?HT)cmc%J!CRuL5lG*`yGAWF*H!g^vPTs(xkowfcOFYaiSwht-VDMk zaA@@`3`AHCRMQW_hX*4E$Ea>oN z=mg~V2O%ya6o%@R+xPo*>YN@XM?R<|>G0RR*%eF8`a&y@ZD3Sz$QLz)lo^Z!J=`lA zI26>quAv*y@^E?2KU%pR@K~wWSO-EsqzxU$*bW2A2X{^r0;|aDB|+q`DJZ!?$FYd7 zE5oa(Va*GVz5;GBi7~G1={6a6MzHnzM2^t*3}+Y*2f03~MT~Ixb26%d0!2HzwzU_x z2jgw^SX@W_4jY-Zxw9*yzp z2k~%+NL8yRZ%}Do9%J#KmNwV-K(#f~XlkX-#>Mt2SSg<%frunE%=`1km%TKC35ap7?`_jXR zStHZ&jAPS*_VXfx=Kz^O$!q|YssuNunlF)E(OxK8kaw?|OG07Fo97(P&d0%(B> zO-ag$l?dBMeJLA{U`CG_k4N1?$DGmn6bDBak0x89Ra;TTAd{#1Cb6#{+}upyRig$~ zqf^fY5ELe9%$SVL3n~Jp!mS3EH85E(F3!lI?E@GSZvCX8o7G_+l z0Iuz0deSXi$75XQOI+7ST(>_C5r^x^!Sz<-`Z{s_6S#pz+~7WLh;(Y0d1^#pYV_9B znA+6%HR7E7t-k&=IL31>A73e^J>!z zkEa)lc{*NBFLSf7&6}*`OeYyX;^Q4(o0!%gK@%c!RvHh_olWmFGJ&f=s{&v49)HFS?{Qy_a=si_e>v&=aw=~ zd6q4HmOXctqh^+~YnBT+E2Hv-`(XAG*&I&^coHh5lP=|$hltPzeaUJ*n;K~ zO=Q)=1LT7C7H!tz!b7q}U6#d1R~88^Z~c3V28N4|trrcQ7mWfI&+8DDu^1n)V8JAFT%b&6_2$PN8Y}&WM#PY(t63-dC8`R!75-$ymj$a&60iBk^^$- z_0kggD`x(!rMFkkzhGH@FSY#P-tvblHue@6CnSTW^RmlD9Eq3a+xTT*&13ge#$fKS zb&E6;D&L!?$?4Oio=SL2;m69QHf<5$7Ct4TGh$z7`u!zr@oUiBwStx4z2+JN;sg7oLE!)n$Wy4K;y^~R<3ri1lnvW*s&jn*q0ZBiTU z_cl5VH#)61x|}z<12z!x8$G!jy)_$sT^s$#je(^NLg#siY;%}pbL7hAsMO}zz0GmM z%?ayGr1R!vz$Pkw6P>$>A>_omHgU+!sijTJ>4VKLWLq;VTeDZT=A^df?`{ETt<`L;cWrGTw>Foywhp$wl6~E_z7J&ix-0ed+r6)QCH5|cUk{wW zeh+v&ZdbQP-Qk^Avvz-Gu{g0p3yC5vDT!Z0L?lqvB75?hIC%GyfL4 z%hF8w$Iu;iTkwAxx_eMp_8$t}ZJ|VeAG%96#nb)Y9J+g@J#SI4nhSAWTU7yn7GBHG zj<;Kb=I0iy6%^I1treDa;f2?Ws*rZ;#dS*s>m~4mKMeGG1O#tX^h>RazUfsG*{m8j zwBM{oSr=~ppA6kqz8m==N(kLGusHph&|Mj~_Rr9rb~M`Ve`Dy5P9EFF`sOsb<5KDA zZol-`({ID~ubu6U8@)N(N7LCrAz^6ta4E0!$MHt(*B>X_-PiD^ zdy{YQXNSwB_#da=zY=1fH0c0x^%i1|Z7+%k>BOvv7BabQZ~D-5lB?>iRHoZLZ2jqE z(uh`Cw{2e@nhc8j>TL{3+kS!%GN_CYZ7i^D|LdU{j>A{mIWTVpB;gsfpAhXAkGBJr zX)@{Yf$AN696KQOzYg@S2?XkdKBvwQ?EFuK?!G=Mk51gc3Ecdbp*usXn3B+!I7^}b zUg)l#6Zn=8x}(XH>DCy0pY#o~@*q!c@@MGoTgtW-huFNvkn=!g>S2GL()S+x(C6cC zzl83{HHUpT_R@=BSMRWLi26(XE_An-$u{s?=#J++RQ_WxDrZlLhV_uk2-v^F@CN z-5r#Hw2Pjz_My7u4$33LimV9677IRA(KlNd!j}K~F&X>Fm)WXeie6K@j|1ESER^pWR523qd zA2FA1Aj3}dclgTRh3@RHd>j4VL|T6Be<^e)lXI;2?wx+oKZNd@E`_|7p5U^v?^gO3 zp}XC;pNWKp2%$UB`i&U4YmAhnDzR}mPeO>KbyBPe4<#UuiHvyRx_$({H&)Y&DOZz9 zC>uQhuf8t=;349vn(KENEEWS;hA88a7XjBL-!c~4evyEUz&#|hKZ>kse5D&C-WJZK zY{N*2bdPZpdF9_!jMO&6RL6x&ko*I^fEl1M>Y>mClYZpT3_x)Yk2RgT4~b*)V-N%@;{WsoGD&6>lo*Yl6p~eZfnS) z_2S%;^E0ITO}iKpjKcFzstX=#PKChI11X^j--@q(4ztq$y1Eu}ooycx@@cZ~4)u(K z+X3>YvoxwQ9anXBg3V6n*oNx50{vFq=lkY4>FN;{dlAt#n1#!DBT*sK^4;iUHI&f9 zqI^%H-Nf6sh!|??Epv1~q);;tOMZ8K);IMbSSc^t6S1ht$~2~B6YqK7 zW5r0iNc!fj{i5YP!L0+>QwztB<=^9a#qoh+(UEqQUzpbfYRR!vN_iz?jd{+jDPvy; zzc-znef6S)&yYVnY~%c~4SM(|271wn-$%5n_HrLKt{Dv-BYz#}eZxOK_9Lz4PYm?# zCxoZ) zpB(6A7B(1i`2+x;uPxO|cM!?3>$^zulMDLRF3{F#AX z6V>U&$hyi%nm-Qo*3L$<)yr|z|MP)fX4^phx#&^im@wWLL6sQMp98%@Y~0`&g&tSn zhAx zxCL>W)h8H@C46R2^dW3Dm?Q?cCW4NfgM{S0>J!6{5+m8c(X!xJ6L7pMI1vm^ss}^R z;M5~{*T7BvU)L^sz*1}Qhu58+#N!o#H+95dYxIXO^o%Z7>4Zx93j8WK=N+)wm zr$|btf~C`7(rJ&=-I&wpdqo-KGFaR)*pf0hU>RHmsRW8>-p$~V%j7rByyBKAn3O3j zclmaGrucE@b&f0vxhzRc+DoG>nWQW^Se61NOX)c47JsI4uiG6t!U3}Edr8@vu(5YHbgt=UDTu>obSY=vR z<5pOgR0x9+2Av9uMMZK`13f98@W2YgG;!(NcanoX?TQS)} z5z3So11p|BE}r2inUgD7FfCbfD_Kb@S%Z~qU`n=*OSU;mcjZd=OiK^kO8rKQ4>6BV zFoZY6QUGTev3wbmX4&h^QnKVSs)jNeY#HrI89iq?gM2xYSvd=^oGrPWqoJG&TYmAR zoQJc58C1rH<>LQ2&|4wgP$7z~5bwKi^`xThLZyURr4$}mDU)0&*HEc|tyDUxROYO@ zBVVOzR&@_prJh`+*--TWTg7{~Qpb!#m$TZytlAJ*ZJb=qDpzgVz;2GMw&bjNE?;A1 zR$~pUu}!YAYp8L+);ONjyydKYFJJrfwhyp2toI8w$@NJM^$=`*>PbCeV5cXxE)&R{Z3fFvh7~lx zim)))Cs>Kd#d7(EDzk;*kt5Z**)4;sb(7n?b(rF6s zG{<#5IqkIM>UyrwW#tai32nA9@3Mn;IpDe+PrIn1yY@x8-d&`PU%FP2R&HHNH`|2QlMMXWEeSNUgz80?jHiiBU z^ZqXPegvey7vA5G>mNMrALbeuRTy}&*0*jyFb)~Ozz1-+0fvx)RqDZMg~0{$!6o;> z70BQkd~gFdxOFEFtlerbl^V3c6D&MaOe;>^y730z&(7scW6;-nAl^OB4wDW zahPUmnD%U#o_mBrafHcYgvDcoEoFqGaissn@cjA+7xyTi;wZnx=xfT+*%LY5ULtl2U z=A{P^6hsJo|KCs$#FfII3R0MqH+b)-f&|#u{U2A5->QcmLRI&ERu9K5`u;@quqI!< z^k?-@deP~BbM?^T^)-TmBo3bcM+FJI_Jg1xZ+;xDRS&JeEO#|} zmp#h=b@kBW9<=XC@K$Wozf(Q@n}U2fA^%N5Lh}@sHHO?U-+on)hm5-wX@E1f>*xNW zAQam9cUXIe1AeU@!eE|ydzptEg1=S||9u7drFy8YUGPiw@TY>j%u~zKoKSjI^%n){ zohUiTIsfEm_3*C>vN&Qe)@vwgQT>PN;h$3wbg${bFV#cozbS}kC2}OmS@Dfxv7J#L z1_}FX_3*C>k}oXg_(=;gzWeVf2%&oD(ycYUoAf&ck-iG^D0Q!$!yf%(^{|iS3lS&V z)qTbPwdx_86=~CsFJsX^R1dG%hF_*Y^0S6?>->xA;fMb5SM-7*gzDjeMGSbH7E+ao z=hajHK;L7|FE`dPNKDkC;*eqEEow5z)p0ZXhl(u`J*M9)S3HB&Vnwy|(@41Eo2<(N zPgL}e;qgsQt~ZNUcizLs__J?j(mh{&1blZpH@xQ>mB-^%503E;kB?FKqG?YQUmw)^ zS=yzS5f+>z06iXmfI2Vf({@;RG6jQBsCMMjDn23&^_FDP$n_UP2bZh>US*7-TLw7IsXvdQ0otPBDC7T|g_V6VfJ;Z~U@PCf8{#iN*Q8 zh8UPh<_gzY4Q9U9m)-nAv>e`O-{lY`=zfpU6Tu>}O9!wrB_ReG{)# z_pJFmQ@jxg;QA%?Z{io<%_hN@P@A^~-j$exzA1Rhe;My$&D4p;Lx3tqaf*lT>sdCn z%q<5sBPpNFEMrsvR)SI!UzVZS%Llwq()z}0bq*?$&o*oyHVkx?IHL==T3<&r;Ffj1 zGrn%v>U!-~(iZ+{WeWbaO-**jS7gPrOi@2x>2&60!uHEXkDaD@d1%Q+tImg7yOFiH zd1k@)W+Uib@Yju{yJ_NLLYPMve~cPxI;b7;xXX<@o}z2UA2Onk zcD_G8S|TV&J?O_iK|!`7ni0L%@WFxK(cV`QeT3_LL{S6+VGum@ zk&y9~H1?Hp@s&yRm8i`YN;e-Ko=OlJOJ$=zTBIPqWUCaD7_m&`+1mpKyKp z=_5abl}GCTpdePp0R#fEP5gTWaWW2c{zXA(zXA`r-_Dkz#lC(t-3F)=8qE(n4ON<9opXA92!a|#l!76doeN;nK@lL_rG z4kZu>A~CeLF0^DWq#vZ&dKfw?6E;pz5SK7iVi=|_Ouo(}W5AE-B!4OhR7*v zyML-6^$G6igwIC_UhIjDDzQFj6%CU_5I8ZoJ~0&ii-Pn>`>}&BI3;R!2FCtV1z|Ux zmJxuiiWZ{Tih~$RU4JUb!834`YjS0NTwQ%KJm^XdK|xl7_E;eu;IPtzef-}HhbE?RFJj! z8QJvao2g{KQxJMsC@Duqm2W!JZwi9RxOkkw!;#7Ndj)}Iiei4JAf{OtBr>FgWm%H` zsvyc7*#rXV)yVFs%=%41#79$fIC2OCVqp3Q1)=3ge!`JU=a>Eb7X>lC0kI`02#2Q( zCimstT+(wnZ%t(?jQ*-1q^f!DNz$K=^KS3t`oM0zr@Hak^fv|R{SbJZ{|5y*ei;OV zGV-OQaum#>pubm;c+LExf}2r)RFKiR0@$%cIpz-v@=3J-0W0dq6b&914HFaubJbGz zr-Go8iU|aQ!xXa~6ix?&;2b3v&Xp|uUO_Zj=8sFrUX<+qq9BJ!rN^++)88owiCGyL zu#DpO3L>vZI5oC>rSxn0Y@e`V*ZSR%$hdtHt?d%epL``^A9bqy_4n( z@0*GLYXyO{a==@;aIJ?-Ef>u%k#M!~o3~wYZxe*HRZ+JI_g}n>`xgpw+OEviaYv!! zuL|P8C<^K5-)VdBn}X2fX_x$eQ0S}rRY73zJ~*zg>30eu)6m;>%3K2Zn}VeK_m4U-_n8l%epQg^(}5YT!MT4_ z5Xh79(?Pj+1G~Q{$RT9t7_PAcA1YY-sUXCP!z32NWdBM*&R;uoA0f*d;hGw`cs9br zJxUQf!naAkXFe*JGAi6SDmpbPel~iYdrU%cOcHM~Cgm|ElQJgPIHoW)W}r2C(_>Ug zaa`46{GP|S`jm*W*w~$vah0#tHMOi6>_hmfXnaib$f` z@f%a)Rw+okMx?_O(oylE_4zT|Go+Knq_fAQOUk5M{-k-io_0MVO zPh6$?kJ8ZZ12X^bD%F1(kohYOt#4Eg|3X8*24q659RA-`sg8wZt;_is!7L_ z&AR21lP&o7t&^`Uii9d2^G`w4IPQp^w9XVkTufPkmmwrlOPn5#(W3C-QKGog-mskm5^pRH)e zJK#7f9!u$+E8UHTSrWb+e^_=a8_!0(z8C}9mQ1P-V;GiR)z4|u;v1k>vC;LEy&pUIA;N;sz0odyc1aOkITFu!Yqy_Jl)?5(-WR@}w*G_d~Ul zhT>se8|z;JGV~F3zYoYr5AK8mPv?0E0h#+cgiy@sf*}53eXr5rZhXV(;`NC7ejA-{ zN!ZgRnW6f@PlMl5PfnMW>0rZwI!>R?=6LUaQXjn>?G@q>fBE54^>J>A{bU1f{>RP7 z_u`w-IgB0a)I{>$9gh3nk=%SX_hI7$P0lFWsmmsBv@p*kzQ@8F`9EFNn5H9?tRfq~ z(xDqhD~Vma-==Ibtimww*7hJ2O+22L5L48*V-Q!H1Y+-NEG093YJZdcjg&}HMfKW| zuVCuV6<4^Odc<*XS2p=u?&FQ`zlP zvFw8f_zKGS3K;udwe_vO>MKLIu386_bMaM9^p#QfRY4HS6Ta6#es>55RuO(T>U=eA z{T`zHw2b}r1pQTI{7qf_AEEpW5dKeB{7n=6E$jTBANm@)1n9B_IM@cf1_itX0pI2a z=*R@VsS9wF32;gb_{8RCRTua&(cd{S(AOB`Vhj4{0@4J5+!KMJcs5Y5x_<-(2zVGs zcvX#Y35pa9iUI|t)CHv`f->_1vnbr-)j?_ML4-g-zHx9-Vo)(#a0Nv${3QYORqH0!CBDYp%xn2E}&NCbZ_oG4KHFDZ%*R1TY%tBAcAJ8dDLJ z>}&!&7*4X+0BcLrC+mJrMuU6u;_LI02D@WFX;A4~f?K;|@?8lBYh!N-B%mnWO`#AI zla%&u2wVt=!$W~wF3Ilo$r$p~xu6tZjg%F3_ciw9jiWfsY6^xj@eyTmgH0+tC=EuL zQZ1b-`!cOpI_U{Gwp9o~c^$G;OPSG~>`_nId<0C6Os7ouDuBk3CFxHcrE09ESZSnd ztfnms#i~JL6jo#SH9uPc0G0K?#rn*O+8AGSDmPV%f=Sj>XsoPUS`BMjbs&VED$W#| zAtxLaX_7p3m0p9#Eu}F17?>o2%D6@vN~{Z&Lqo@o{L+OBD!ZY?@A5M+ z;hX}1qJr?cNoZ73Y_?rkx?4i6UErKkzTzvN0;)o${jh85RL2Q%=b}g$B1x{h09$(t zHVF^-TlCjtvl`aIl6gpv*^>d5QCr4-Xgj*i{BZHZ0t;AN(OO|072uOynAlpesd}NS zOkp7vRNppV*aR4nL{cpbJdw+7255I+f-iv|0d$Ms9RlC7l|*BTdt3_Yq@kN~WfFCy z#47n(?2t98;9$4%+N-7fb)>7uA7c{>;jYCWQTf(_hBkPfS?eH2JlCIy1-3j=bFebq&ZGz()m3ZdWK3Kb9)SCgx>`a(*3 z3y3X!NT~}cM5>y|LyqkHw1N5CYxx2iRsLEhtqrO7q;VX+7ycNNjL-etN2 zt(K#ZboPyQteZQ-c6*IY(GO}5BlFJYPnmu9+nzYJB@{#_^R$QyyGxq8+ro-PxZ3Tp zz&GYCItras$5r9>-C_#eaz(Y*lH6&7+q%fR>L!!01)UVHTI=z(T?5_C#O0lAMJ)y! zz`k+a2y>utQMWyoiXPWP3;{fWBhK|FOK-HdEF&%p^?E{pt(2WE8g9eaC(_)F~;SKG}FbBGC^vUCTV?tXlLt6pcNxhJEV^Ls3e@x+8QC7eA z58Z)WxH~ad>s1KY+x;_(eeyvAXMU zYbIOY6?Eg|fhrHWuDtH1)Ey-g9IdYH*gb9C7VWUd_qGqxbleOZ9mpGKTTb3H8XUWi zXq4_NfB?m{f$m)0*sJ3W(t`uv+mN_!)bjYf;_<%w6X?lK6NkjEgz&R+Ww`w`6Z4#apGKmKO*b0Ge#Z8RsgB8-K zYI4+sP3Zu6gNI`5OAFNJ^Epn6z%ILqDJJoe2TFz=Nj9WyD22Eb=^-IJ8PxC%n9K>4NO-i%)q;6 zgw$u?M%exo$l4j|yf`}YHIi=ni|r;APt$a!$+S<(Y|UgQ_4&`DTX3>XYUFvD2O8g%6*)vUvPPt_WKKU_h&T%3p9Vw8Cw9E#Aj<+ zrxmv5yVo$8^|Q3Xlw|pf(y3FjD~o>TF^__lmM5onzt1f#Pu~v*N-0&HD$eu{%_fGY2{5-Obmv?`3agLZGzakG)s@05_hH7iZ-Y`$S@t|3ga`nS! zB!euJN<1||0SC}sjpc9QGG1oAmjY_upDnDMFzF5aT4K}DSu_e3=%%Mtj9#tYxF@c|=t53)+syH=YTOPdPRVc%4r za-ufvn5!>pg%aB-P%6v%>6=*SntZWK$$!T*h-x zL#QPItgkoa{#YrCXlR1<{BHZ_g&esJZXA`y%$mWIZ4u9HO3wxAi2Y8n_B+LZ(o^W% zG_W8H$NCz4YY1pYc*!~X7VWqveQi(GWOzUms0MCUc)bZg>^a`GN>YQ*F~@Xk$C6XIhw)=z0Q0&iANmsot)1wM`q9 z4>evW?=v5-etNPF*m*e9EJlpLasG0Zir7qpD3V8`(4UUToIfiv6rgubLmZPrD|YUr_UggQ2%%oN%_? zt!Em*r$^R`lpk|cq7DEQ)10onLLiMEkdykP$P*zuEyw4{RadZvVPAawk|N)C@Fz5k zR`;2d-lrtS^M^-4uG_A8Q`X?b8Yth`=`k4B8k~Q`w_C>d$^KR^y|qYDLC*67Hm^cu zNK|bsv!I$cCKoG&)oIIl{t{qSkZhn-{%lyA2K$($Ol`NHWIxYw{95gac<+jo0xl%k#{^pGuasm;VGC_5>;JHmu1@4iHSETmEFWu+c`ne;e_20(mjbGhBw zt}`Vq-)f~V>a)fjFXtrqXsV&Q(CduVK`V*=Y{W^RmJDMBsh7~W6=Q=8E5pqU<#{Fm zz-(@B1TRzP@a=={_2Le_KCaemJx#riQ#H-@4u`t{9`472V|BtQyO(r(B=yr3YG*37 z^%+N*DsrQJ3j4XtZtUFH<8PBh${4+#81lqqOdug{Vz&x-HBxkkC05;;b-h8=+WLZ( zk~f4Hwc&djNZZbEQzFRj-bA3?yn59^S!dyuAchrWuYDlLB(DXlwpaHnwMwb+>&(J? zx(b)h83TeDUPkAxkgPdP+n$jcXxbLS-}7jY3y(D`kPfrzg=oE$6ec?TW}F^US%k70 z;nLPb1(KfC@`^;AL}N%4;8G)R?y{&?soj^7HTqQlSnrY9H-GjbX_eP(&-Fdx3^ClB z9~1F<`pXK;8vXP-`3s^k%#}Q66*aIi5-Rxkztxhh-dqfj3cQ6z#MF%2 zCEENLD^&wGjG)LGH8sZw^R1Aa){pKqrkGEjha$a-c}xe%g%SnUp9_)3@RudLPZoxoS{WX(w`DzL2KeTxGlb z+FVbU^bN?9yY?QgJ$GKf%OXNomT(?E`)X1Ac~wouWA0qrXofxtKTAByFe7nZ%zae^ zZ#M$#9*vC6C8Z60EWo9I_V!bo(vIV2k9SY&H<<5cm#^Qz`mlD{Ww!QoT(`N60iSZU zm7-(^KG#qiJd4gO65?Ls#*WkaoW*y(!)r2{QHBf086zzM60d^- ztk4{$w6ZQ$_b%*)&~Yq~Z`SsFGkK>gvzFTC=2H1}+=|!KC+dzWI`VOlFv}9NdO@VTj3)Kodm(@TjwI3PxqpMBRUZdwk7Yqsq`GCT3VEl0{CWIH za*=LNB)cN?fnzY!*VOI&rY zSXEDi4AU58Nm`;Bmh*_ctrCaYOTJH;SH$;WGKqL5mjNLp^5TAcf*f;x{RjgdfEj+! z#?t@NqP5R#os^|%tFv4w`GWYeFscj`pY~3G^Z`8ws)~vSzlf4 z?EQGDsco*jpN97ek17c!gfC%AfE(q&V8IzH4rC#H1IEA{Myq za@?!uSup9HIA&PJY(r;MSl}!CsR8CO{Oa*>d1y;GIOp}(JEyaBP2&3(BS?+Ue;2k~ zFN%*(&D7UL*@ToTyaOY71yrWYroT$mJ$a&H`(0hkuSVp64!OOhu z*>{bSFbnGH4ryi+%9_=x(p1d^Yyp$D3KK&&ywn4%BQ`yVC#C>G!i$}qI*Z4-`@ZNblV-c<4 zWv>_PACs0bYhLeR~o0$uKFXL$;;o8 znl7JyZ`@RS=id#I)k|82FY3Jof6+54F=R@yw0Rd`1#^vh=LDV7&dPq{w&*iK?D*lP zQ?a>wM$fd?7S8@s!rBZ5>o8VQMtQRqeXr^z=4E|Js95XT^$iw>5AM7 z(|IYeW-BBZgRihJrNXOO5vr~=<=STCbfXdRlsAXFjvi2xXWSvSrhXu~WiZya9)H{6 z1;uJT{>O#b&o@c7k1Cx@sJ&(bto7X%I+FTwY^#8zB$WRAvk_R% zaI6^5IiVY|-xH}4BJ)SJ8W1k&N(@0{e8GGh;bkqsKwE$9mLQVEBz(jRVWJsgzisON z!)rt+#%T5STUDg8a0+kN0`T=vIRm;#O-X0W9qVtf)9HesjCXRMh6obw@;!S^=j@w4&Ox9ku?9 zQBRN}Fe*BNgK%{%hIoX^+&o5ti9NiH%5z0+3@iF*uB2Edn9MEDT(V1!QY~tPdlJZs zeNndJRjBEgp~|G-^+HvMqMffQ(D*3-nnOooa+@$sV!m+q2d1Eg#QT}=!IcuvC*O4b#UV3RI10=dvN`HSH;FZI6jVQgN2&Rf}$&a!zPqga4Yr4~k zXvqsRSH0fRorMa*8B@KD6+Bb#3V*IOmMv~QsnQ(#U9NR-G>QbgTU4r z8kf(7J_w}|WYTQm>BZiR20E#hDYu(gwKwL6hgXFe8&DQPdNX6Az^5hgq2kz~ zrcyq4R1WZZx2>fnGt7SA=@bDprkcj1mpw>8@5(%K+rJxekD0VUwn2^Q zbs6A#ij(8#&srdmxks@@jsvnK(zWkD3_f9MzGjV5DKqoV$#v5GY4e9$< zeB(H%FN;0Xhg17G!zh+tpm&rEPBqQRHOe_Ac54jJFQG5EpG~~0Cgh(Yd?p*k&a{}H zB~Tr_>c_6|F{4gMo;sTW)5lS3#V{_(eA=JwuNUplo*kCRT1r7Ie`ieLW21m@Y!U@i zHz$)UH>6>_3KdZ2ViP&dyT8PC?UR}c`` z#7zt}n3eMFW{}czK938MY)O%3V{vznxNR%>8jSTrUq8AmVG`yN3ckg9%mHGLXt66Bqs(1wu@&6eT4<$9+7;;yTA&sp0t-Y936W z3yZ66bVlFU7Yp%c$Fs-wy)bSeig~wrEB}1?XiU)akCU?6SkHO|)H+Q#^n9IAw*4(; z)d3D&_c#bCbYTq}GJuLW&wS^+dC(M(<%C?_ONQu??HA?jy}$QAk-)R{UfLY?v`HzUd$SVv+K7b-3fLi4{p@p>+KM zX21+7)^-#9;f(d3{==XA&gQ)gKZnh;rR zkd0nuja99@p#X&Ec@J9&PH?`_s_nw%=QJM(=eEfER}`3OsfEf%)CU&>05#K+di>>K zB<+^ETcQRvvwE~;#$+K+b3ttDVnoPjXBn}@wW7y{3-25k28m1W=d$|UG2uU~U3+U~ z-9}|OZzYZ_8ZV&p?UC`YXOUCt*OQ;YzX=a!d}2vHyX@#(Dtq&x-&(IfeA#-|Hq~n- zq3m;dg z$mV1&4&|wKzSFP^=Xk|>o?6$iMA~^xW=Rl)^zl&*cAc9AOwS__uL|zzCA^SifAqYB ztiI+XjD4#uaXhFdeDJar*HXG-Zm&Z9jdVD-MT0m}%b+6jv0-Uz!KeLoBgZxwX3ggp zW>W69poN$||A4}2tLC{e{wCRVxf`iy`Pu;3pG2RRiMB{zxOBGa#J{vS67K5kmmH10;U7*^c9BH1n$n2th zrIlsxvrflz9-ZX7X~VIViro?qxEMAl))-5};wP(_%xyQjk!=6)?t^I$Z^y3IFogEg zzNRSjyG`iY9rV)Zu=9HM##XpRM^fy1K<1mz7ub6)zFoVUzf^(*FTMG(S?ycz=+vYL ziHxvzvv;j}O~U%R?#g{4)=hkT)JgcZk47fR^2X%gh5y0cTSm3r=-ax$i_=1IYq8>9 zDDJeyiWFMBXp2+a-Q6v?Lm;>%Bsj(0U5dLDmqIS@TI;NRwyb^jK6l@9@3>=s%}B;b zzWwr_b3RYlNBh^|)<7e>yq1(97c8QkuT4%x&r!5q(&6<*n)`k=%2DFaAeJDY4(G3A z-a2DjDygtdg(J0mBI7K>5fB{Jj)*+k+df1Y{0zH^Q?Pl9Lr%Q|f5mjGf&>nJB6 zVkb9+95-Pk`v@uLfab--rl)Gi6lOa~VHB3i%&P@5&JB7q3B4!ujxfWxQd2!TPNzog zl+8sqjA5K;d?U!Hd5tXxD&R{!y z&^<+QwUfb+o`8T!*dxp+fL9mUjdG4jfH0moT3^S|x4q6?KIdG}i%ruPSN%>@^p2vh zI6i=ysmhO3@n$ZRG3B*R7CCjV`Nw-X5A4n8^9i0=C=3KV86r*-`zXRm(G6Yk%H9Nq zm(r4KD)uVWVYrWCFE7P-GvRx7Tn}4w`uDpc&y4_4+|U5wo&s(x;kbx7ceh&o#Z5w6Yq)yh5 zeT}K1xn23~TBSvjesi5@wk7xK@Lp;lQs6G~**^Q>uv$GU)i$`)@1{Y6T>9#}hi7Sg zNpw|+yvI16^HoIUu-n47#@<{^3FYY8szeViEa%=I*+gNOxvsGu&2WTV{;mLyfpXFFLuOBRAN^y9@DWQP(q#kiR8iOb9S_YVq)$my9lR=c5 zT%X@|&)kb2QzN-gG`eupyJE(w+#7e?hJOBzmQYCD-7{tVc;6U7Oz8DO^UK@B3s-+JIE~;OYV5#F_QE^3AHVnX-{BZ3e*FVfBASi+ zM7C^|e3Lk3m=Sw3X@`0iD{iMc93zYafu2AR*S^vogpHwq zANOrd0t=<@Sv^qFkHZ&%EnY4sjJ@Wc{Mhr7fdUDOI7s!&)N@drFZBcCVnB?PQ;rkE`(54l zlH{1Gc6j@n3({l>W@=%#YoSD;18JJ$4u9BBWINET6@9cNbhui#6eeLD*SN?Mq>q2E zWA-YcZHhTwhg6;h?LCAZd4fdIpML!d4FgRYk|K&7X&hoeevKhj?f2E7{$~~#z8r!1 zM6t96w&9kP6;I)oberNlL&8xx41}8SGc7LDDFJO)iRM;*Iaz1n+$F3DRCPuGWEe7=@GqE*N45Wj0jZx|o0r{lgwfFSP zS?hOnas5BDd@3{)2Bcdu^c_n2DX_9<=v~PYR4b(jngG;!gfg?gGlJPl+#fGy7!{Ax z$G9{q7RKPr4A*-w$A!jYu8fNmzgAtt1)IcEI+0xoh5SwWgx&en%KWW-L90?ky8>H1 z_JUif+zU=!?j8apn&tF-owP4+f4nTW1HNLSFG4~r^N51FS$>e8mynhQm4*TyYICzF zx!9ge5jF%oa%#;lxMKN^LrQA2;2B8GA|oH@dWFp_OO#)87Vg(=>nsnX(o|R;sVcH9 z)PbisEncObg^SjG}yc2#;HlvaX2l>WqOn}DiMNHTKtB;|CVS`t+%dBPq1HLuZ2DDaKIQXGA7jGw4kSPg1(u-$4hzxaN-qfh^fyNB zHzll+8OxxiQb!pzCi)3V9jFw~m+YZ4r4w4nS|P7&OhlrPGMC1$rsBPwk#hx4C1GKf z$0l$ZR~^%A5msgLR_)4OO(A6rGv^4IqrhZaD6A#t$ETD2-TRq}FHV4b!eiPap{fss zz<4>B{kbaf`3$I%YeCjcJSq)~0XBe8Y*D36z)Vk*6l{&$jWUz?y(K~aUhHL$wetQ# z{EJnTQWl>$HS?&fNSBS$VWe{|7Tv7h$0fs@8i~ovU&2m#_{!=Ew?1nn%q3^<4h;8M zWctTX3kl>?uWFTKX?rmZvAeT&K0~#8U-!}WuD-!t149<%VJHz#B=ky%Ay;mH;hT>D zz1ol?4s)PZ_=Gmu5z+bQ5AV#RFf3o8ot{%~cti$E>P*Z?Rm8LF> zR7GpY3M*vLlr$ulX-sVPV$d`-k!uKz$zKqU<_D@b@;2PwSzp=Ve}kdND+ z_q#0OZSkkvyq-_|uk6E>*udPDmk357qK5eQ<2-EaEy)TbmX=>g>GDF<9Obs2naMKH zWEHA0s^85AeCQ6JYR#XN4gR$+_6ayTtC%8s_1RoHfMg<7!-eHw>AC(($DAZJNIA*9 z(kDK3IydlSa=$77$;&Cn@zEK~rg{*5sG38kHzQ+4e)Q?ft*UPIOiAT;27G6p*X$Pb z^`xxFGgt1kWnlaAv}Bu>3z9EW*a9GF@52bUeFdX=6^-qr9v4sf88Kf~`Miu+HsLyu%I`Q)O8YAx+nxDlq>w`h87-M=l@uP6f<8b)@39o2<=0 zHNETS@2>{wku7W7OOIS3AdoEMSY4c^myL`nkfxSe+fPlIsR^3zQ?hKFC!6H@KJi!k zdQ&-UG_AUy6^bjB9k}Q0k|s1Iw(lvOdhFaU{V^->qBQD(7Z9g z2km(){?g{)@TYcX6=UQS@V)NhT5!icw~`u<_99)+m67Y`If8z+9gnr?ZMPad@dLxb z<~ko@_-Lt;6Q04B&2usSw~4p~5tAHibX){uN)y)Z8(t=#@f2rOl+Tko7k{pyLxw@0 z978(4OuhrdnkPB!OYh;cyt1A~)@w2Pi7)1iMlY8os9Yhd3}x@3!o!G4!azLKeg9dv znJQ)5_5|7Ekoe|!1ba>#x>UyboBpHix3Rb5U*DhE!+PCKE8Hgr(JukNL`(8o?!ti~ z@$!jc2jmJ7M79}SSiGp@9AOt=ki`nypdv(Fd|(O79zin7baexjxrynmB} zO45&pz3SAyc;-xlF{As?vik7;CyD|UrkWvw0Tp3kfR&Ajc#ef^Y=A4AYf^9c+o&5a zCUf5+_e*uqhcHA4Qe)?qQ6@5ft~J@b0IeFa+8D7Zp}_Y<0ed4%qdZa_BeH-sk`yD- z^fgk;HS$U$3e!Bwm^=yy?Tc1giU^~Z3AB_8MpWy0FBb57yYOEg8@<@id$F=cb4E+c zNJq!H-bH3iLqc~A7#o(PV_;pU)n9+5W6a1&$2gM5B)raqz0T-D$DESS9AeDiu+Cgb z$7*TJ2F}MU?Otu3VM#Y;wWKY-h~|JBlQO7tJg#%pu5+dsapJyWL3zbR_lljOfEzue zf_dXL`Uaa!!Ap`?eCaqe$_3og8~h5dcr7=`NL~p9JmIDb_*}m7R1WcaYzU?g(-*%I z<=hZlSXZw`WD>2s65lQmKYk@~RUoc_Y0>b5#0w}vQb>fmD&|2fMM3|TzwoU%{X3b$ zcQzfXaZ*G)^wQhe9Av5Qj16R5=;bVzWJBmLqBrZXHl-5^6$Y}?E9gJ8(%d$Dlh&ZW zhi#Tmrz>q2Dj(CUTotN3(tkuR`iRS*N>Zds#h}J$5}%o+#$WVFoZ+)f(Pw27RSIpn zFGcbu3>r2?8ZHc)K1G@#3|cWoS}6?L*+rTwf9O;eX+s!vTZ?pi7`}`YeVJjo6+`o z+W@?+K4WT&Yi3$GS^jz29vjc$D#n4|%t4&VkpkqT%;XH8a9|8~lmWRIn>o9HTz#0_ zLO^aYOztUWglSA3#UPJLCeMf+X9$y556EkT$$JLmnoi`t4%(Sx^1TB2J~H{Cm-yi_ z`$vF$bU;p2=Kh?_fi9o`loB6t=D=37z!kG#edZ9;k`S9+F9qgMpAs(*W-m47FlqB} zOXl#W-;vE62`PzeWsd48i5g*!o+*i5VUE!Nh3zW|Zk5D7GRL8p#^JKWla$6&SwtNp zm=icz68TFL#aWVMN|TgXk~K<`^;uF(OaJWZx|9NaSW-huQ)5`tQcBaZS<;L5&M{R= zIzU0KEEy?g#VmUsoh%6u7GG0}Y%q)0u|@cZMXbV}0e)mok9i)-ZnliMFBPl)X=y<^ zQvuI@0ZFM3c&q&8M`7h&p|PcyDHw##k`)5VciC4@cw%_7g0sP3{UOj+{X7;5j(@+Ez(jCOImep&N zHR!WJOv@lPY*3dns1I9Xh*btN#CF+nJhY;&DDswX@CO9s~v_{3WKF5q{#f%NdtjkfG%y++$ z@&f4;St0P;$i8bp#cUskED^g?5#ZCzqtE^po17KJ z`Cxk=&W%dW14!jTE9YU)vG8q$y)cKnCCL$PMJTwkLpj)8`AH7WxmyWZFlIi9VOmLG zb5P(+A*o_3tvos_J5=Vn)Tp}D=ejbjawDj`B4EG9jve9I6AiCyGsdrn>|DE4-Bohk zL#pmutJ-H$ZqduRiYN$ui_yMIlXq2!bceLtdd zW;*xa=&407@nJ&Dlp>o|quX+0xK?A7l?U-0xNcXvhMbh1Dqj>I_{-QGfk8eF&g+yIOkz*D(W6ZEqfVTO(O3$$++m|l%8V(-jTL!k1S zShI%Mz5^5JR^EzJG#&sd^bVPxw?lm1#EgcunD}mZq5@#VJujy5I7&L1c40ssL z&Rmac7+q_be0i8dYnfwtSb()GIXtYOTGl!arm9-DHXiogTJ}*Mj@eoc*P~~vwVWqB zT-UW+2p(>XI&M7P*Q9l?sd;&r>Ug+#c?BF}P-=PWIN!+f@@dxb8SwI()$!Z%3b@t@ z`0@&d)(OV)3IXeca_Um&geSFGSyAc=$6r@c2jyb{-S5{SC? z^eGflbLu}X8XykG+hMwZpy87Q-)Gr|&nkTCnhoj(d>UpA8n%3zt__;Ld|IImTCsfEzy|Fc zJ{?elP8FXnv_ZFx?@MpPmr*{w*#^B;KK-2r{S!We>jnb^pCJas5Rc!86k4C-Pl;OYu>^%Zang}TKGxC5c?IRYLas7IB6Clu=0Cg9Zz^%@oM zo`rg^3i#|meNF^?uc5vO0Y8jJKRiKy(nf!3!2qVl04~8mfyO`y!64bjAQi!2&BkB@ z!4R{?5L>}e*Tzs^!LZQAuvo!xU}JcWU<9Z!qDn9l+8Eg;7}eVtH7XcA+Zeqn7_-wD zb0Qdf-584yjKhG%;R(f)B4F{P|h_h2O*S; z0nfz~&Lf5AQ48lY!SlI<3k2W=62gVD@In>gB29RafpD=Iyx3M48X@ia=ePpuQrFp-qjkA~0YREJp+mYJyjZ zG(nr1+7Kemy-m%dA}zB`Evq7}J58-8B5l`yzTS?}+>R&OLE79wE!xS{+{q>SL!kMG zglLy+bC-%}w`Oy1zKd`x&w5A`_JWwS%2yGs06CLVp z9vT%Lo^2jp6&=}W9yt*my>1>wh>l^jjNyrmleUagi%l@KOmK-!3bag0h)v11OsR-X zYqm@qh|QR_%-D*}y0*;vip_<#%*Be$16$^E#1=p;3squ^gmnr~v8CRYrBSiv*_P#1 zv6Y>cl@qbm>y}l7*w0XYISlbN($+O<@pY!wbuRG@fz}NP@lDy*O%?GiP4RcL-cKSg z+FMjK9wcNWc2pz)QYKc@AAfG*|G<19SDo7th)Kx$rLQ{gM=0QxLZ)0zes?4pujNu- zO+jxg&D)4Ca;EyG-}!>G<;DEb^#1Ekj(?FxsHP4F{4NmKqVE$zOBk_- z6Ut;TD~qoF1(z5AVOADD=|`v#HxLRU4ndNClSW`F?b7<^{vDU-_%(L@v(tZG8UY!} zy1M{L5`Rz$RQMY%(eeXk!BnwvDZO$u_%rB98u56MkJbTJhd$vFJub@(|0i6cQkl+d zI$K5UWyMGA630DS*{+fRwel+ zW3{HkvZih>#BG_zHM?NkOlfR zM;vz1nx8iDx5)h*!ASImt322H61y*t#>xzBEcX-}!~q)5VN6_BofprlE!oWT*1AOHE+5+c1()cmL)vmY zGY=;cs!U9${I>7*B#l4=>U6{`zp}(@e{wL7WD7si)5P{IlH;X*KlhHfxbjryRB=aX zSoZfg5f$_wzRmX1zvveAmirw0S7`)jZ0)P9+KfaH6ao^{FQk)MLG)dtz(i7mEAL}j zmrsp`#Afl-ZqWJKZvKKxRC(xPmN=Sj8@j9;eK__+-2bypeCXW91hX#Eq;zN^v&P-z7)x&<)* z9hWFaNi)ZMr%BIy6X5Vk8JRecIUo=tFOdH)xJ1>hKpyEo*YI-x3YYjU}U{kB*ZPUF*Oq27}-1**?JS%P8RhqaEU`t(ukX=F|z1? zflJJyv;2?X693^Q-aQU8?Qfg-e*>4OZSLLp7hGaLCkT`102J^_h=$36kVTtKv`-mB zDu8!9p0LJ6Vb+Q*oQMaJ=75vuA)Xrejg&%Y9v_)FiRg6_o>UT{f075Se@k(aI<1y+ zKdI_Gp-i}&m>@vio$!+di89PZ8J4VWlqj1<2*yYeUrR)nO8hjQkYS&=nCE3mp5Txc zTFMY6(~*c)gLX+u=3?O?5&j~eD1~Aih=QN`hg7PTeVD#~Dn$*DaLrx>W@BXURl1h) zJ}(s-??!?gkRng`Q^rfSMme1Y(2kKBA5NaNM;wAh9@S6O2?8L3(lCFiRHXs9ONs3J zlfT{))TR-@$Wwe+@Y}Qj4e~_V;e;LnnV2=(@{f-PzQ)H6jA{A9v_g?u{v_a%yIlMasV}0AB*r2V@e1Ms$Fs7w^yZH0N`2zUJm4=(B@B<5|{C*5VF!RV3A=B5DG<*0~YeRX^CTCFK^}v zup09@f90Ve7vkg>B3Bo*t`&-Q6n?~}lv|*hfZ=~)CHdV?EPhA4^SR(Az6hx{T?w2U z?2bRGS&UrmzZmRt}I=3-3MBF$TSMky^X3Zx1PfE(EDj}DsxmelQc`9#8m{;U9dVIt=R zg0OHP_F7=Z9YKN)A%$5!W{o#PTCrHL7Q(PBmAtf2!Nn5>e*U@)%O3p2H6nMw%lEdd zLgZCtc3Q@rSCJacGFYW^q7)F$!zRt5^%6@KCMyl$OMnPx-1mmh!ph{I*xD)rl z(@>>KPb^C%ED9O(Qs3&}yXqw2j2EG-6$kDoA(au&TIO_H7GsqG(3+~T)*QvUQ^@Qq z$?__>q-u`c)3jhU#x+&s{wX5%nV4)~lyN13MMA(}%_U2fO?+Zp8X!ouf{Be_YOh8d z5nr2IR7>Wsd$yPGrmU7K9&5 zFwA=mnwUnE>scy2NEyyX7ut{$a zh7#4fAKAWrU!2s@B9zy(fK719)@E4NZqAxkGytF%0kmGbm5C(c8sYSybr9fpu35Fw zd9{)>H~gYZ4=p8;#y~oQRL~%IJ|BWsS+&M^;J?g-3HAwJC+ElMFq595Fkf!I)hvAUbhy<4_W@I-Cu7K?-)X% z9nN3N^%EtK+0AupvfG&g9u%gwh?WqgBPnPO;XwhU$par=5Ew;OvW%By>XaJ7m48{| z7m9XsHIG`@YyVX2awz+eK#PV0tY=ak!FU+)Z}uQpOo+1|rCJ-2%o};T22RK%XlHb) zSZI{8?$~&S|CmWIl}X?;Tc!GYz((Y=__YlxIF**8eoHjh456wTH=V~2-G{ndTymGL zz0gP9p;`K@48+ouIh%xGUy19Q$GS6gINuT!RiPWNlxu~c`}UPqM!fP1Zy@RNWk zO<6W;ia35!H*4DSMPSb~?$PH~!@XX{CV&$|*4GC@gRGuuk0P;*Y|KG?#rr-N#Tj;^ zq+vFEQr47fZTu~fp;H|q8q3d#?WLBMfGyaui*3M?H z?L%jE@^?L!S(KXLXYq+y(SWQ6yxDh}d~Bl{ugk)%W`vuI-pOkxH3N8$NFBZLiJ}Rk zvWQ5shj59PY;55 zJ(9I(f*dixh8X$L1L2S6rIlYxoS74(_^U-mt7Una!AH~w--$c2sQ*xA#;_qB^O_fl zq(#dnLbf5pqawt@C73Ix^bu_bSrNQi9(|?+XkX~mS144=9LKfJwJ1--$W*5g8~tiu z&AtS9ncaRjG|XTF5_nP<;jeH1?!0{oqr)Z4N?#OLUf2D-_I`wb0c(R1cShdlDWfS< zsU*Z%+F-K@KWy&QXx*~wn3Qc@S0CB<@YHXPnF!R`iW4U0#oba;-qsc0*3ce(9n&NE z+LQkak@>NX#^H7c|Jopa&DtFUGpH*nWvZMSuOH_nGNQ9PAv zg-J1HZA*1;a&6~j26c8TdD!=isG)^6%FQq0{lWPAejWQ@&fRLN1BZk??6U5}wUl~X z;;8KAAutJyiY#zw4~(+YPDR+nNzl2H^9fg|=E%iV1Ruv|Wlf*BbW7S;F!g^Em@I%Tk zjQpoQXj9y-n7;b7lbYC~$Iz$#u3 zl`l9dV^O}O&trADZTFN!dS7GD2^!(8A49|O@O5;7y74-ru-h-l+MbKf$OiUam7UD^ zx4ml@R0)1|2BP{ff}4kd=o5U<36X>I&k*Hne*2%&y`O_)XGm%9CLi&gb;5*CNN}D6 zLdCoK0>V*y8srA^BkdIB)CWi$@TwT_WL2{*(+rdrtN4FPr%1FU5n%RM+1{;4YF|tE+Cv z#Jm*qK_yqC@8Wo+l%08lv!#&2q1PHj{%Kn=o$vcfSK6l?yC3th5omqp zyn8a9X!6~n`==#I`RdQ9l#JC6W}->S`CA4WXy-z;jS`46G&q#%*$OnQn@EhlgxGF{ zczbA`=(l=5JfgkOIyLMJeoif8t!ARtgMVa$+Rp9Z*Zq>=nb+aj+3FA)8wL{Huk)U9 z6cH=2Xl-lD*enrX3}!~|VQ4+VciSYZ(PV2FezILDIB%lA`rJQJ-(1%&Ah3lpg!5R< z&1rv{jTM@$ckgn%+;Yy2#q(PMPMG%TL7c$b;|jm`RXu}~hvywfmP(X?frLWceZjRr zMb-W9SJjd!NN>2M&`7^kcckZLShV`5I8;kFFpFZo#eq`Ty~UGwSMofcCQ4a4?j3#H zJO7WUHSb9cf?mszKW*Y)!3RVzWuw;zxM-h8d+Z8E2N6Z}p{(vJ%C>y*lwM~E~ z5N)%ZV16A7(DI;$WfjAajx}@(qT42S$^XT^mjU|4arC`_p7X2;RL^xaSU}%>rwFR= zc@iA{-s^f(A{b&$6v7zlbZ!fBzblmGHitHEZ*} zUJaG-x!nP^`P`rMO87op@3i?M5EzC?Xo8X`Bx8OU?+j6h8zs^C$E-pe4N(~crLZ-| z0!X_I(fJysa9zd_fz+r*nC}Ip2~x&_nBEy-t2auMK*oZ(f{dP-2)?D584D5UGQxFk zd`opT7Ak?dj`oW59UaMdnCv@ag5<_`jQr!_DnZ6XMS|~HHO3<}yNpR18sBrej7J)v zekJP`l;KGkk1~7rm14S4h95E>Z5#CU#g?F~@XUCOYu8t*%SKu8tMOQ0)F;}LkeoEh zL|o{*Z*;^kIT`+m_}HLt^bA7s3K|m$z^-qMd@y-smx;t2R1@a+LJDdr6G@TotcRgXqO46Gwg%@)da8&wYUU8s%T6ynF>eNxsHJ;n&LilP5nck zw@66IlC?N}7SUzOZR^p&ux7WVMgv^E(q+2L0L@CPTUetuWxCvq zxS)Lut^t8eS8#Le=xzyX!e^!{UAwLH-`)wdTuoQ`qFEcFiD-3_%v6WIXLl!P((3V0 zaEuPNMtoxs(SE|P)&je&P5CI>l5D_r8E70zq43h)kePbW`|pzSB(sf_97p!aO-pIH(Xi3rWBCM1y?u>Y_-wb0 zEO&kQq04NOBYB@yn~46I$9~<`ds{-vgxS&t;RrA$-k7PwFEp{3|;vTiJDaUr4CpYor#>Mm~gtL6(OZ6ziAQO_RUTm+Rv=aYdp}{$(|p^ zFgeSxx7ecX)gE!}am>EV6lOn}AN56d%0&}1mk#Y3DiLMfQU(1q!$5a)6eF)N+fg&Am%bER{O zmHzd@Y#X{ub+DMVG3nx5uZ&A=a*MU8z~cO9h)aEu*mq0K#f8}(7f3_PcN^Em#Z`3I z#%?hi2jJq;j*KgOy2Zu?y10B2;@Z3=X6rG#xN_a&+Irby>vO%hia>X3M-#VO4(;~9Y9Hgev_XyG-uGVIApy9w$t3GOpx)|` z0$tkT3Uwbc5qC_VUD_7tbsuqVb3H6vN z5_bk`F7IphddxJmI#;?b9~fYG&UK5s)B=|epStP`)2%KL=<<uzokiREry7$bN$KZ<{Uw;)c2b+0fc01Gc_;x2Zl=E)4 z5NLC^R|2ZM`~N%&{p1f4Y|Xw-68LE_cU0d0HVU0>6A#&GoCX1qB!kMyMCTPonJX4h z%=Y#0%T!UJ`4>>`xK+E1{fYrlzM{JB>lMGVf9>$QfCjC&SBio_&;Lyy2X23#Hcr;~Eb*rTJ+o|D1+PbKVxeLYt7g9fFs$~kv9C}(GbR!e ziW>um>pUCH=^3yIjK&=*KV+Ox8~Fs1B9HDL(qvEr4o4N2q@=}hDV(Rz4Ve<0*aK`V z&ofHy-fLrHjX0#AXYMM3{(&Vg;~iqy`|dmk>3PXN#lHXClBX~pp>y${kA0sAOn=6{ z&%qx<|3~cmPnNvD#lAY1f4AiQ8?o=e3MVES5S*pv?fAxXq}|#rkgvaCdy24gJSWfM{uMj#&zglS@M)? z6M#dTj3T%FAOC?RuP(J$ahoUO$&#mBmp(hR&EIs37`BV4%iK}i5nj9!N7P}-HIyc-KscKUJGPb{O-J09TzD14=~r=WW`kvdXe+)~!B#8xtyjoVOy zB|D<}Uy4G1%iOJua$VCkOy*G4wY2gtQRpWgi}(KrQRo->ln=XdD)0&5$VIWp!`{bO z_!LO_60G~MuQdvvfsR~OdOjQ&;x*0n{@s$dFgtPuX?i&NYwUXsUwk-r8*N&-9=UG4 z_g>z8Z2F0za??rqcp9eCyiPiL(e!b5FbZ8i=gkG^pHS$x@Zh7r#=g)0ibD4lD`GVIdod0L ziT$s#nC1T+Sz9$m-!3Fp8~mJ9 z!+&`p38@lb(f^{#avAvRg~Vj3_998r!=K{KZq7frkSt{R;In(hfAI(xl3ZAn{*PkZ z=e)|Ezsh13D99n(;DgHMs|B*8fA2!#sA$(OJNnNR<32->Puo#Rtxr2Xm_(j-J`*@R z{Q;0=|J6mLY5l94%&h!Z&kNVXU%fP;>}P%SKERr06X;XY>>N`{e0-nto8Y@ z;78C-= zih2JP7ZUXUMlr6I6-A_wjsD%H}@2Su2^_!j~2Z6`$?%tm`Ev$xC--j|kq3Ka_U) z|DaHEOP|cxXE%R44;u@kbIL=_GLyhl7>PFioVVe`{B}oZ{0aYENWfqrbPk({g@4ZF z;wTkFkbg>!NXnsT*_BjgRmnb1%IAI#erIv_DRYIWh(4HEmK;2ljWS&zJ-qkUTX@`K z!KqNT+f1VXKAmJk4A$@7|5RnER+DmBj?`eT=}e(fKXXxL&0wh>kF5zFP_MLRU=utM zRx~?)`$5Hotd0ylRcF>tl^%X%j)=P zuyLu-$oS)BEr_pN>y^&j6r8_4OWoQ+{lnrc!iJ>CO|Q)60b94nAsO1{TxQ`}HVZ{@ zEy;b(sTZ3uwFz;Cb-w4cjHX;($8Knt3a)hV%+TFF=7-Oz+qm?KES-r1n|JtZUCZwE zmV{^Fd(pOT8#o4kdQ6U@_q@;9Rt{Q$Z5PfqR`~09y7dKAN8Ht73pIwQY=RvaA*TUM z>_(U(f}IUvr-9GCjIdqjI*GTr!vxBW(4Rynq>t5M)Js1B8L3^=Hm@T;H2);dczX2T zV;`YcZcNnF*u!;I6YVOx>GI93SD4=+4nOl7V_<40KYDFqxZ(!khqPX%;9hNrKE`8*w5BLi>;i2>m%RRYYPX^>&EjpZTS{H_@Y06(sP?e93s00( z=9o!*7oxoXE(K6R2!TLS(9K^H082=aInWGi!{N-L=-6iMEy#&(-EVbzhHmw$@7{6|p^| zSeL-DK$*T1(ms2}fV z4SrwA`XFR|=VUz_XjD+w@Hl&MFWdc|^*P|q`Qb484#A2U(CtYJd)NAbVr*8|DD<)Zj0eAwtX{ z2Ic`KyTN*bA^hecR&F7jC4n|_Ax>c-&Sarab{J;CP>;S)x0|PKT!4>Yn5A22fL54y zSQt?wAiOWc4^a{pv>WD+8J;v3sHqihM;4yO9Grd=l5HL)Js0jO7@iUqo--Gw%p6hT z79mp-5xX0vWgbyb5>~?;URx5{&=?NEjLdV3tilY1^+h}hVu~6g;h0e^=24w;k^OE_ zgME?RyHRzR(MG$Gm1I$qjp0Xr00g(QrzVahMhpzYalOxV+uU(0ET&X8W>qfcgJ#U> zP0V45!=9Gg#+<`5Exb!P$NQ4lqrTYl-Pmj9IGx#8bn>_cnkR#d!)ap-(rp~tZS=G7 zIONh8fJOXWYAlv}{90ceHhKJuJ*Pdvcv|@Olk!dgP z?k2tlL7FHCil?_o;F6Dfj+H1WA73>aOIDh|$C4z!m-wC~9_Ka*Z7=$wBpxA`xSAR( zE1#rMnxxK>s4W!tVK4a@Gugl*L5w`O;v;?sPCn`u}IxX1;(ZUS;)Pj!&B0QQiame zlKYc$=To!h)1tJ~bA-}_)6%`MfB~iHaj>KU_ovNjdZv6@J$ZV0czU*bMpJ10~K4o-16Jn7$*`L|$o;e<#F$K$Pd0IDVXZ%Kl z`H7g|d=?Deb-e#YX=UfQoJk8W^+;i@31IwQ{^3^#=mi`3*wD`Cj zbc$R|k6i5Z+-LCIn{ZT=TrAv$Tq5DT8y3K!9e@~~M>3E{wU9@1mq$mDPcNL$sFTm^ zk>plUMMwyt*cOMtn>5+ zY$+$Mj6&nQ*;oAask;_d6mnPKB;;6OSfbWm@&|K*kSw}nE?VzSR$-~n z3ecCYx9Hu1gV92f5JkzQ9oTpPJNnM60Vz)v?kHzj)GD0r4F}nSV+*hg<# zLenf23b{eWF7T&0YxxD(5zC@b0ABoMzvy7VtslE&_s#>e%!k~vw4N38lEn*euy9hR z2ypMcJ6CB1D)G|+=E&9-aF^fRl;A8DCG2|@&>*RPbW8=8P9h+sD0$o$CDl21wKu(S z<2vBiuHZ;`dEQ;w4J%+LB5hOHX%g(PO;L8WQ=_>bA8}VOvrwTlm`3VZzYy-F|H1c5 zS%V&1naO>f!3T)tL5AU=@0I|hfdbl(0VO+tSVTgMtRPmpP-`ownI}}~9_o|S@GE6!9Np0~E5g{0^^zmBBDmn$ZwOO&`eW)T;f-72tsc$dZ_?FgB!h z&*W&6q!%UxdNIO#zjZXl1F!>}HkrJm;{SRWOC&?$Censyg8 z^?Yacmx%J8UF=@?5Y;r;fy7^FZb6=SGOsA&ru87V;X1x@{-sEapNetwaoJga(dH06@aqQs7R6%w0bFwA1WqfVsJQ+ z?wg!n4vrgFpb-lu8kbJ6SB#=aVqZPWBh{NGvy3x?C1NVY0`{jlzF?(0{T{ma-w4DBuAX$8`W$87){vEaNcCQH$XTT%}ZI@~NBV z1qZA=w&e*nrJ_$UvLq5X?s@jlMzkuOQKF+o;=TCaf^*Ckb7351 zhkava?sawpo{G=oQeWmVW;GQeyeA2EQ$Nio^i-hrWo60gjUnreUUFmGa!l3RO{rx~ zX||+%tXRSDPCR}&$;bhyj~lBLn<^8VMdPU3d6={!cbun4*KSD|`JTqZH1+&BDqhyC ziXwJn#gs@y9Kpks4#)K8@6$35DTMRb9?|1^S+hpNt1%UGw4O5;sWVntsog=Tce^v} zR4xKX>jE*OF440F6+K@#kfbS->$O(|OP3U|R=&<}#I!h!dH;k70aYKmE|yE2loo%B z&d2LzbuDMD^=}!(Wa)8k>-%h*W^Ws{ZjXg;TjOqjuiXB>*t-j^xE6e0*FYe_34~w? z?jGEN26uONcP9jQC@7>TG`PDvf#B}$5ZvACuvV|`-o1P8)3?t(`yRQ?XDG(_jsKkU zeH@;*jrq1sWOv;7c05sczUuDSw(Wdl*zr!^39#J>e%=X!0CxQVI|dTzW5!4p^w24% zU0C9XFb3)H6cqMHe&IvCFvNSzR(?RfJtuAdv}5153y4+4Js-d=A~@CJzI$w*%ZoS% zZ?6680s4GRdr0^PRkRep9$H2ZvOA7_%bqjb@V^(f?Yj;8Rxlg{I4|=56y^s8UKXO9L-TaF9^lI&-itjb^pf8B;_$cEPK_HMxYKuU;>5=b1!2E1T77^KJ z??U%*@VR)=_7ErBKW^pciN^%d#|&7z(-DGwdG(_y2m{o zG&iLz4>cUKh~#$5!j$7*-aKKhIyR8BI9f&5Lw4FU#Sq0S;6Q-#M!d=^-}#P{g*LlK zbP&%+-D^3`VXleZcEIwy&JBzED9Z z*maZ4=%FA5Oq5t5W(BCXKo}gn67uoQ{s07QP3yiG6%1IIx8{Z#j2m6yC=!iR8pTE! z0of!`;an9&(rIrMW{lqF=0Qo&)yLB{_7f#V$SZgHsD? z(=o}6=&Dj~(GhxK*|U9va9k`^@=%c`zlg`^PkI``iu)yD)AaYjKw$?<$gLUvylTJ@ z;d*@_eWvN3uIA0a4Q;Gm2X_2!Ka-Hcg$UJ`G7Lw}eJj*%z+j z16rR+PB;#^I*ZxvH8|5ll{h*{ozXxE#13{aF(QY>7j9pImCipiwwxJ(mn_&YKLaat z>2pXzA;lG&`dL!E0jC)H4Qt_p@YH37Qe_EYt|@3-@$vz5ZNYe#$W#&G2R1@*g4X89 zMCyx?wP-AxpX$TKl`Aq;*9?m*mV`SkL^je%$Ps{|mEk=l?gvA{m^#H{nVO%RC3EM( zi*tFw+*S6(6!eac1KHMElATlw{TAJH^hLS&K=ysA4$mPHiKdnc|7woJ&aaYmDbg74 z_6|B z)$$r{t=I7!E$t=*KBo13XS15O!GsN6u&H-_3zd}+$g)7P?l~7GloRJl8nov57|*%s zkCx7997J1ISh!pxKolFJ@XmpwP95l8A7aSfNHA$w#<{_U9x7CzP?M#x?YXu%ES6(R zpy`_t2k0co)Wb?P%^^?chHMq-VCjDZa+F!nM6u?19>l$*JWYU@D@|#s4p@c6VH{k8 zSjmeH+{U$VV;);PjIN8egc2R#ELBn5+>8op+XsOZ+BPLJYDBD2D~WjqTnk00-6Z=A z5mS*I$Vio^Vb63;ia`ivFwPMe0@6GTm_T-|K8YLyioT?-6`Y{6g zo->bq0#k7g=(q+y2U|xQ2Bgi>6!fzg#5gFe6G46PXkJQ)0lB`~qQ##1;+iuOHEONT zszWJrh(8%R21zw#FV+~eQk+blTiV9%o|m!tHkq;no6j{EHsS+<^>aw?%WO=Di{HQ!O+QwhJ~RtTV&%0l)w7bPuH z2gEOr+~Hwq^#t!#`QUA zKqx?-=5bpWkvBAwii;r$^;iw5Kn#L}`2Zlf!oNH|Y9ne_ z6{Sp}#V&DB)Eoz6@=GK(zgi{W(MEW=^hll9P(>sR#4r5W7KE%GAyU&EKQrEQ9 z&Y&vuLr2~%dO+>SHMrZg<3OK>)*vKiw#Ce#(B2`%VD;rOYjDI={H-_xtL~Vz z3gq*2g)2veID35T;DE|m+YL4B3JmzsOCLUttw~PPF);ucs42YB`Hsd~nnWu)hOS$< z9k=pptF&sG{`?PweR{3&$CvjFL%P4!9;7=-&VjqIDiMjnVF8Gm%#EzjKpi?0dZZ~* z99f@f_opwE<9`8jH0fPv2VaT$Hshq}K;j%I(Yl8~Vtp7uw_6Tguxmh|Zb6*~bk`$ZgM;GJ62&(&m$?d%Msc z+Iy_3D2xwjcQK7&Ev2XIQgNA>3hEbG)A#fk8%OFh6Y4nosXPM0hejV+Fu=L=q%As= z!c!dY7(FldnBFysChIzvh0u{{zShc!^| z%-2rW{(sc6Im=@82pLlJvvs6Qs@Q|%9aoU%i!A{ zapX)5dJZ6W-kfNUeWWQXJWD`~6EViwIYNeeC}1~C*#h3Uq%0?lnm4THI)+Xp4B_-XHTp*M9CuVfuh&}pG``*$}q*zu7=?UamqBnN}%{88(X+(&g>Jo_`MLoCr z6Y2Wn0zu>+$iZvjVx)be$)PlvY$Zg!j)ibnhKTbT5o8T$3@q>sp#z>312I1&J+(t4 zm&5}q22chh*>J_eT2OL|!1YCmX1H&c>}kPd1L@kKpprMIRiU(kVevVG22+EE^YmA@ zVKmgzwG(0y+V4GmTVe}hKT!8)#v`||!Y8qYHnK*}6ZM53iW!!OgW<*SfucqqL56gZ zK~O`ZfnnuSG_y;+ z!As~lv9UktA}4aH_u^5a$q)c^;?T6!ijLpZky-spo}hs*sD; zOJoZhWW9-F8(X@Ya-`WRhgk2*B$(ja$z*R8B$Pj7y4Ad=TJI&{L5hm>zZLF1W|g(d zlywgq!?cn|td;+oH0E77_J$XPT#AiWD*v_?8@+q%O`QC@R(T6zh4&%~C_3Y|9t!X_ z<7jE)Z%fC~TgNe6T@TZEwXDasW-y6j6bjVA^EJw+H-I-@k6!AADEUlYVC7AIK%rtChuU@vv&3tk~u zw09FVR@@(CM8ZHanKFk*wpAc7oLssNt~Y9ZO)?oPPmC^@taJGz>)j+w4lYN~q)*m| zs(|mp8>z2Yd0^FrU3cN3F~0;?buu5yBEsI&W=uF8Gc*K}3 z{JJ_M;wq^j+{#0w8eZILC7A`0L2a*vaGSI7c{HPZYcZ+EV5sL{(rPhJi|IJgJHw&X zL~`*(UFMVhrgAMZB)mKKUiot1Pf6oAHr9EJyJ(RFCbhI>lr9INBJq}d1(JrM8Xg+tNMgia^+V_ zlUMddXxO~MS0!K&PJt*BFv-b!9`C9Sj&wg)mI+Nt4lB~1MIk%|#`^gVS~W+&h=xVq zS6z9ABe}9K|I(?6T^k$FrFsZ!2uMP=rHLo1L<3gcCeUq>ynGIh(U�tVvx}6;JoB z=)G&LsA9=tWGO)~Zp@eFM3SQV0oj0pu%MjU4Veb=vY_z!vLd0bpgx+x5(6o4z3zVWRruC4Y+KZ6wi!;&B-t<*bYk9qX#(F z<_tbv=&uIFLZS+7&{t01o4kLB`BWA}&CZo7y&j@eDy_<cpwSO1M{QBGq`hQ2XkkAZ8% zO8%IBsQU`)3NMW+3;VYQjy!R6&?aJ!>9iCS5tKwWS*c#S!E{sM%`UEnE__d>9%z4K zS%v7Siyk|FPWH-!q7Z7Y7_SzzRW*4}<8;!LW z+h!h%Y7s4K5x=sVz-|Hhwig$?2P)f30$C*F?WK)aB+l%mx9xog>}B?_`*tAuP^mWH zW-lpD%F|ab(cJ`{)8`NN5$n_R80@fe2PYt*qolX>F*uC4l|tC(FkJWrH+u`|CEY z{nk&1nrSSDRq2Au5vU_v;a~^r^2yJmqTysvz6DsyvkH8CX({1n{AS*bBkN?ps`qOQ zaMGGnrcpm0UStX85ZrRvK*W?S=@X_81Llf}2!AaKS2;EB5(%#wrCUdFPg+sT7+IDG zBK~^)(`a+9VI{f5|M&~6vRKQ{kWa_C781?JTtppT?}sHy(Cf_u*_}twqgx24rqs7`FzH3U z_UawyJWBPk@(PG=W&ZGv!Uo5z8tdH=X@2ubx-g1bn|N#Mj43anpxxA9&NPU)!r|ze z$001~SS(#cgY1Hd;{w7gcEO@{!D@EF=61mza>0>!!I^)-Re!2)n^kk?{i}ptGVXdB%ft z;Ma6ysP4#4DOAm$5_O)`(smnltivSq`X@G_bMc{0%I_DGFYQ<_<*=D$(E#A}aFgRJ z!O<`oN@8#YjbJ^)lz3@3vnyf0sBy?8hQ$>#bkp41Q5+BF)-3T63>U@uQq(Waf|;&% z|UWVa_~)Uy&Zh9WQ6G({Ct>qpMb7IFZlprUqb5;Ydb_^!cnOYRd&&? z$5S^ycOoH^?q09Ce!6@Q4Y7BdkSh%aZ=^6vR`hWC;4fzhn6P@DE8AL{#scSiI+Fd*jlYvn6>RN^^^P$X>O zIi4k8(eX}aq-MXvEIK$vM(eo(C7^O^vI@OQF-%2z>8xzHFRbbK0)8!K7#0ys>>SeK z$bmMb3q~`Dp0mz+xgz`RV?r`)80Jr7I4B0K2s;dDMMN>cp&FFlSeC>EZ%a+_T6fd| zH-k>fi4DEdpl%rtmxQrmmXZ|N$}y{cM4_tuSMb9%JeuW3ruEMRZLT~iE;H!{`C$||FBb|*9Sg12 zJREhigx+}%DWK4j&1M=X&{irJJ1Ia_C;|wNYb#6e=w}TGw5Y;Hha+D5x&_Tm)sOs2vqp1K>n48-yRJrD7yGBJ?ozq!bEKVuiZL#=r?raR`WsMxp< z>2`y(6^vuaT>_KcsM4lg;f@O>Vdk_kuhI8#0NmFWAHnm?Zq`*m`UBhexub)RRbx>* zdd*u&Ap}YN=;|N8PU2$W!AMwd7Z}~=_Dt2uB;e|&qUC$6B@GCvYNhD3dVpFW?@25c z6t%8BL5-MMDci-2iSSP0(nmeYmRAgx8yZvtsrc=$>m@b^QlB|lru+$_il%Nf@!6&| z_;uK3w5*O;=b+?{*yatQZLX)ai=S%eEULX-7j?4f-IlBpb#4}IS5Y`tJx6VBRy`({ zZ`QtTw$`r)zWV0A7K;6RyAh5=;IWbLg^z0+p!BVAJBj0&YZIz|lSv6uQw`@|MS>G# z4rAwrm6ZHn$$9S3NN*iY_#VT@x&2p?p= z%m*o42J;ak41GrE9n2i;D>JtjpqDeF1ihYfe?NI)vmBAjE%!74&H!@FX72hXl90q!gQ$e-*{-# z1>~`VHc#c~)^Oo?2ST9UF>Hlil8WD9jPcXbl)rrMn0Z5wZ1A>6>w~zYtR1KK4G)%5nF(k*z1s%r<;>vV6A=q%Qx*-QLKvxwq31lC5 zGNPrCxVKv-m!@-KcUM4AgHbR3EEO4PGJ2HMXI)z1`TkD~B1jZnCWH$40>$vc-U3vi zl~x`yDwgx&4j1~nHbdtz8z|0jQG%fD=yf5lC>!=uJMtS_c4su7jY|m&^R6Q z&0YI@?%)J)B>>YNW{`4#p$HppjdHPfe2%WdDrqzQqsWrd8E)BRUHbCN0>tx2NjBugT|3ItWEs9kYl2&5;E@i&g zaHcB0wZxRSd49mPt|pU>-b}7|VX6vLQ|w}6CHP@+bi%c!Du~|Ju6S`FT-9BYIE~*L zy~P!NmZ955hE`M%QL(0&%@r8!5TX^ahD*^j!-m@EU$5;dJ;+c?B;uLOLqLvF-_T_f zQrDJ}&Q%-Sy5((~u|WLtD0jBiuc>@`#7pN^2)li5xvZ`vLU;cGx|J~~0f|onZp{d^%<;8ena6e6T|-YN z@s&fU*a2eQL=p0_nLPSl%HSpz0=vl3PSiUZ4JdsA#+32T#$=;h!>)NwE`v*3EWI=c zlkb^QgQT`MRg0tzMx3HTcnChw&M_E&vkT7V*=1gw>(gBM6aZJc`o+ubM)LBZ&Q7$l(?FJ`rR;}VDD6&Q zq;*%BCi%cC>SuxP)}P5Ssp0z~CLAKseo>KfAWGAvJ7j@hzPs`X8xVUwkNBy*%^o7& zXT{(U5B~a#s@J36g5f+p?&B^C|NSt>$f#s+O*c96OyI zA-B7Jl+JL45<~LZ3i&x7f@`pzaLW1gfTFl(Tq9}at`I-hT)ym0V2oc1!5c)@lo6LO zA{{C|J)XfMU6-F|x<_<(?i>6Vj&)+ZWFBgs%aBRgyJ4~CgYbF}r8T9=nmB^9STRE? zxC*OYw{IsR4iDcqZSQiVo{p>49)4MUf0!{_xxiTEJ!t)Q*ZuHqx1N#j%uml_{UZHN zSMJ-13*pl?_VJC|Qlgb&NJ&nNkWUr#?k?)y$!&NHLEuf7xBY>a-pABTLq zM$>yfsP}mol>2snlYZOtP}=)hWEM7ja!A_dW5zPP#%9e2m|%@p$y(6CfUOvmd_UP$ zVg2p5YvH_WP?8zHBJo};X1sA6ff-1dbdGBdS{rKUN!!I4cL)5?SbM|1Go?8%MEPD4RZets;mv_@C_P&18SiS$|}Q`cLlLMHz+zc=oJkq_&(aBC<Uk6)u<>OK z`Y;hR{(Ux7RJMA zcAo7qh23?Y-7|&#>wJ4uN(Zcb2Leh*ihM@~N+?2dP`*|$zghqfID zkQpw6h}THIIZTEhbGILZh(9-+KYM{cx4AvcZaG{*Z;hF^C#BB|79*PPgShLAQ2^y^ z?x09z9ZQ89vO=oIZ+U~Kn3uOi~yKM<(WojZAYh@#w2gY zfJ}k0+rV?kZq)s5ER01Q;$9qvMLgbKJc&gDjRk<)0wlBtlC(%v+)LE702>wpM$D6n zOk=}MlY_UD{kH*tywJ{V#tO5&Pu-~u-D#fE>EY&H$AxJC({y%`3|p$yw(Sg0sx0=M z%5k0jUCC+w9HjC&tstJa@cp$wY2u9G2brCH!LbdgesibD+F0O z@D*8B(U><`S~2WriS8E;6r~nfTC!V)np)C0Gs^Q*ut}3cSq^!g!Y5>qSf{Gi{X`Aw1u$TkuZ?u14F(i_)7238JEasTD{oi3R1azGgC7ld(KiTQ*G(&!hmUPL|b*q+i>(cd@mh{-t^}3d{ zFC17j9i)|5nO$%DR~7fMo6%NKrD0LZ;O+z={z!Sf<14h=|4b1C${$JJ9`Q6CiZva2 zP4CSh0`*B`oMvaxztFtQ+Qt8{EsxHXxwJQyb_#Sbl)fD(O&@Ieg2j~1exskO%bVmj zYw*mYk9i*=X`L?l!wGa$XIW$$PSDt7Q^#%PsA^-Ab!5@=dKm<_S3$3|d$e3eu`*)1 zdY(s5WIdB?x{-CTzF<1RZ0kZ`xpkknhG(`uV7i@mu&oH$*$k%N4KCXSFzhv1Sg9U2 z3zc*Z*jPQkIzTeMp7O^L#;2L`C&0mU`Yu@LGPiScQ_llGm@RX39J1i#qynKvB(|45l7flpzejb$t zuT(eXHMf<(N>#M*Rc1WrVcSt+7w=B-IlRr@Su{MbtU9g$*arj7u)kY=RCDOPrvG^J ziD0LaAmSL`=nzfMj1aPYd|YYy`rICHWGh;U^p5$Sf!Uts6X_(PlKjckvqO*2xo1-m zvKTYvZ&*xKm*V*?I|J1N{nxs%U>IBK-V;o{67p(O%;E!zY*U=xJhBpIhMnKA7~&K2 zfe}Yr?y53|;@*LMx)0|LiUpsfEL~tOoO`P5{0msxDbBX-FzwC`CC}{)9nqvdab$1P ze%WDN-R5Me(9biY<=7#7Fyp4(VNNmS8iknh^ltM+Q!%cx@a+FsY`@7G$g*WTc{D!*Vc2bHy`uel(W zwWt^Q7}nL_D1^LBP0=9b)#2wNABuv+>!g}1*B43~HsB1DT(U;;6e1`%%CBk=P36VR zEF-QlR=2Yzrp!{T1mi|1Zd~n->wbXttyAjER?aOK*=-+alwzD;-aoQ~;rI=UDQ8x! zXLmNbG4H%~wXJhtxU!OEyBA_LET`4UFK|7u*Hd#-b1HX(;3@L#I2q+bTh&@Ra(Mkm zSWNJBfkD9jtJ!MzdMgS_Cq$=WTf=HInmR)l!6t^mR z4S`0iPEtGCKBmF6hX`K|;@KPg{z)w6?lJlH$Ao)NH!Q}Z$J4`C z>V{t~KdG55Da9oP`!JdICgmStFc> zaqqR=8%{QLEO3{+U@=N1B^x)!2hOQ^_2CDmmf3e@56)kAiYuK;@otJs2w$)mp5B?d zninkQgGZI#3l`ISy}Hq$D;4fH=7~RkI&o2BA zhLbHr|9vdRu6da8&sYq^ZIb^fS?y`+KgMF7+KqUB!(!@N7jG`B+W#{w#(U^@EXKC2 zew~u`v8dG((aVPW+r}SQOxrI#zHKu|+qNCwj$7N#3Df2Un}atrO!S)6}L(nNzTfh!Rz0t&CpwCH;CWDDgW-~2GPG+Ou1w*iSlbtOl z^A++{Ta#U^X3GtFLA)uhHjDKRJ2R~*Zg#8fes8e(Qr#Ukdx4Z{ZK)nkJENImiF|3E zE(f!fX0vT+UT!C=9U<8K>0doAcEVgGQGB z0gXU6_Tv@0w0s8~uJu^Q8{$a$P6X1xhRSlP6hE^iyU=Dh^N= zmP`!LRt_l+(l;JX3^H~gD-ALA(@hSsj7uvGv&~yi4s)zWDvfaMl}yU!KQ}6k^4=Xz zj`BmJD31vu&`*thL6=ch5PAo$8W$msQl5~YE}fc?Vj5PSl;Jv>nv@enQJGSZpr4*n zQjk%ZR?)DTo>nu6Qkl`PD4m|sau`;b)$ur*p4Ib1QJphzdi*6}6egoOZ<1s)GjEm| zrMh5ISUR&{RXMD>Xw!H!vuM|WqPFDFPd~flG%lmI>@trso=&-HqqgF)S30}mbvCTF z>V0=KyXpgts=nrj0AZM03qY4uUk}2yom&qf2B>d@QJ2kaL@%?8S9?&T)g zF6`xJ0yOsv3(FSviz`Po4@w)47Y@ohP_+&#`xzDwtH))vj%w#^7mw=K0b0k6du5Bq z&1WN8C#`qKizn^SXxgV82#iaoKhfp1&$@B>8>4!NqqWcbsmqtn2bo5-FNV2JmM%sG z(R41yB^Z}4Cl%y$uBJ8Ymak?FqIIt4Ey|a#7ac}*Zk9bxmTy-5&~$It!x&d?H-U1x zcfXSCR_=B(A(P48 zcYEcl&ktv#dXT5Plhv1>AdUbuYK$)&>l!pVSOAV8#t+4L?G-VOAcAa+|NELXI3}pFr0Sm=FOOc1^EI+6j-7u=DUV78id6bJAZ{NtDq-ph3~ zKOA9VRA8tG>jpXyEKJS-43lvt={?^{pi(spmn+eKUkVnXw*^M%Ty9`@;D|B-fRQGw zo45(2(5wXVQC7~IAJ%cixR_~mooY7m&%k25$G~Xs%S}RPTya6v*q9*JEn@T}aS?`C zV3adti*X&-KU`@8)HrZA>oyZGN!o-VE@{|#nSL8D(* zHCR38(1a;PW7rl{opyC-Cip>f9001xWuxb#_tKm$1J#zg99bEB(3&3s)z#J>**K(V zEgysGTd$7n{61)}qb4?VvmHACQ?!3EBsLDa96M!xSY8iQYMQP+cBxF!IkHV`UcNeZ z>-eC121soA#dhK`o}znIme_jaa^hu_qIo-#NOzul;(eB~x<04Y{&aQX1N{-A4~+)? z0oU`s3OQ9Dj`8JUvF0Hj(1kX@~){$g@AVi~O}cM&|@# z(C2|Jde^fEgO5hIqu?I4y0a*UR3rQoa4#>QG|>AiIXZSVK#=_$2uw95XY>#!RW$*= zfia=@(%)Ywd>UVwYC><9G^oROlF*7wP92goWWs)tG@iOWUIgy8biGh0dVE>uNh2;R z=BXxyhCGXXKfSIm2;V`$`q$izLiIRhS_y~G-?DuZ5Uug=c-+OsZ;CepUFI^iY9W~= zPo`a8=BG$n{1V2S%4NSQR7ew+%1@pyb$z*H<69|(YtGcxU6nedS?NGdl4o15ugd-K ztqssp=DOLhD}ia&CX6Zb!>-rWnfNvqaw!Ybb=S3(X*M=?DT~Y3*YzFvwhqxLOTXA} z8pmHq?edi6BiEbeb$mOI(Ug^|x|`OsG&}E;l+~x}n|5dddq1?)H8_sj4)k>UAjZ^n z6t~--!~_mua;Y2d>uQDXIA@}z?TT>Rj|0=4a~ae2WZdp2GYMP@<hGs3 z(_KpK(hhWP?q@p)Tq~o~4ox^7<|V|;Ys%A(Y}_6eUoDz7jHbOmcB%K0Gxv6DJxM$9 z_7PusA{g`iGoklV3i?+|aiq2R=49<>1cXqot>x}wcd}S-w5|2w=5%xLyIgzQ)5Gn> z!RlyxI|KstnriLkBUbY@KX{6QHGgFG-G8DK^skoUNjuaVx<5)m@RTM0Dh17%l|NlC zxt%=Stc5T>-)<$^J>Tu-mp|Vh)}K5-oc1z89xrF@AWyeD<&fvco0FGcAaVxO8}T17 zc&EPb(it%SPfJ1nlUj;QmuLaEMiKfYIFhi6(SGrjSO(IYKX+f=4D*k~w~Zw2n4|Lb z9IM1~#uOm<^;=8vEILEb2=_ox-1BV}mI-VQ$wfE7ll2^UWiCd7Eg|8NsX!F^nT+_r zpp zX*0>m-|-^FG`928>zWYyz7cknG(a_2tDrW%9yAUV@j#{ z0nO_w@NkJK$Kd>k=XG@kO6ebjUQK~asioTB!c5b3ZADb6wb}pXEydd|D%n4^6sxg7 z4A;jLhX2JaMGPh4|FET4lZ8FJE6Q^}9s{V!q5Nx0@ee{TI<#Q=W(UF~AFQU*#cmHgFrq!T@Shv=ES#4(LRnxKDxB3jZ>eG)_g%W^)G8ef* z!1#71H;T2V*7(r-X7euOgb>QS{i%FbQh?7hrQh%?*e5f;ITleUeK|aJ-u5v>gcw)^A|FCd-W@ml9N%x0bN&ps{-1CH zm^lMj)dSew12{S9>JkG!&js-PPUs171`4YOivH7t9tDA0uw_HA^<1#+ZLmE~h$Cl+ zvwDcDdx$$Y#Iqsf>)cBwD8v^h)SojnP(3u*{SQJsX74HA*m!rjp|6XJAsCLfupKVP3YdM}gUW|z`K3z_! z**#tTAGaL0&;l}yBlL6Bc~K3~pyx;^OpvqjTG@Kon$8R_-LpRusz$KaRT9V!|M_=R|-DA$TJja2^{?f)38|H6ak-LE5k;bh!9%4eeU9qu$!k0_*tKu?PvERP+ zhw}S$PLu+lOH+K+?_cwixKtY+Lseo>zcrRv5$6lNTT-b~4+aHrE%&9uEv-V4MzRI!Qx@lWHvt)N7`XTzTl9txMF=q@hl$J#wm|62xtFtN{5zN5t`KE% zflb~8@nlYc=&OYBD9_7mB9uaLG429J#2-0iGKKl_MH8T=%iK>d%Q3NQB5C0=k8}9H zVmY#rziBPjy&0Ho`~TN+#Cn%uc!X8+UtHlHqI*B_pI5m5zgv!4!EDQtb-C3?R$mGh zS5WI4dS!lJjv^qaCc>O!m*$7%=t0_+9htwYaNiiv!pNTbfA~601%1=Oa);yxYygCx8`22smtQ5rc1H9!9SawLr7=-=sq zxi<_f!^paL{HH41eeBeI<9}1(jw)~cONE;h=NBw=%j$0xZVs2U;D1!%mc#t~=L)y4 z1m`})?Pj|9`HE^AzR<><3M5b&}bKR|B#Mm-BBJk(zw6SncWm4S zoUGT^x8L*;1w9_Ldr>)jds&W~9KI{0-(JJ}W+nPg$H6}J`p&=eetzROc_C67^9^(E z^X3g&JCqMD=Vv%|UqViQvVVs!bJB|5`2Te|f&;i4{`uwDKsq-Yq>mG9$Qk?(@MZIN zIN-loj^`VGfq!0(k#nI7Nh&^4mA-weTu;_IK_P#&Ho%RO~PQvi?QHk6pGGe_895cei<@ zMqK1TDBFv_ta=eSCe8*`5t70g#dq-)At*|75>a5xr>-w*oC+><>UAC!V0YJ~5)3$; zGtQm@XjVu0W4-;GJ15kO8DsPc3LXLl2mevLBBLV!{vC~WUq$B6khi3gsp6Gc-4Qq} zmP>t=*}c(3U&231ROR%?QT@FcV^W7Mu>C#I2S)s8NTQ}-JX<`DMrWX=a57&$TQW_u zwrILoz1nhlptg9nT>mE)*%jIkxk~fNBAvmy(#3lF&4Dzj`m*I__ly1IK{d-}Rg+;D zo7wt`^`D{dXmy7gDmQy$NTt%H8_#uqKrw%}F=?#c8O`_-K_Jsqvo~3wRIIyvX{SFN zfP`Tx(_DA7*x+=qGTdB$vigHCZdm%!`gF4|j#h7^rSW2CEL*9LBbi%hwkx6+^fz}- zkAa`nKl%Rcozs2D6q@X|7c$E~at-(AJLeA@=nR1zYrnMsOB6~!C`G6-N!pwkN8-Rg zn=vG+rQ*=~VMu_2EG6HkKw>C~$Lw`I+CR*gYycIz_y9m)L3oDW*!o-!1L_gy&t?pX zS{AINsKqaFUmz1Ht|>yyM#3LvOrvT5MRMV`Ft%kurW_Ph?e-sLjDH|WxW{$>{CEEI z9h2{WGGj#dvIV|UaPRozTHfYn|H+I=uMdj#v5hTE#(sICSMU$bnEiwDAOA9AZZ~7Z z81A;>)&5U5WBxZNqMyfvO8<`)(Ia!|%p?Xi7tTQqL%9rY{e!yq=YJ}qznC$27vMhW zJm$pyAye*)q_N06)_jR!OU>WRm^}9S{$X3sixf#noj4;E!5l;Ds9v`} ziBKy;#iTbdQvQ19{9kOw{J&kREphM4+=i_R;2UOt91oQT{G&T({qT{k*Tdr4U)SpI zch2Es*O#?=3V6A5{{31-Yxwczx3&8C`<)Ye=nwcjx@K zYqh{2w-)OQCy7YtH!++*$%a7bxj@<5KxAULBg!Co^`P`TD^+liWy|0 z?IsG!YT)1AIUB?g?0>s+wj~CB{SWS(rq^x^QIK7>XmvbbC`MdEDClLag8%l;$r+xb z9-ikOUH}d+Y6vfx3opA3ufU0@;*6+KkEnBxXaGkvHAK8j)wbJ+A2^XOQ?*Myvd2BL z4;(qr5cx7yM{Xm>aH1wSqo&lOX56FZz)=egQA=}CE4NW=IDidKz?M2-+a0hA2JAPy ztX07AE#MR<`kXWRQa$?GJ^B_Lec$jBKaYOCjfTRFf#HgQ)rfiR5d)tTgV-2@JRgI4 z7xPv_DFFwFsR6|D0OBM8@fv|2=U=M&KqA~&60TS>jaUkgSgNF0n#NeV`B;X#*iX1| z%v^D-8gcAN%F0#laomk@8@EWG@8Se-^m0&=c&{&Y@{_U{-h4(q;w71Z@9_L6NEV$$=)8x4OxkSd***RI>Y@28@>D?ro;U<tQu# zGL=lidmoOxS2Zmg#_O|>EQy)--vFUNUcb+xIE5ZHs7C)S*?OTFp9j zt5>aHyN1R3RjgUEW0#gidsb~)r(D^}b=wy1TDo)XzP*aKuimm$*ZKcAg;c=E;LCzlVMKJxnW^W)!tzrSmr046uwfX5NI+=1&&$6NvbB=HYO(y1q* zc?z;;VTBk<=iY=DR!5wW5sAG>k9?9gAP$n5Al1Roz&V{TvIpvd5=4cv~Tn-23mQi{( zqk&yUsAY6(vQi5>Z@yW8n{d`SXPkD@IZ~W-*3##na`u^LpoB)G=b?q(X=tK=F6yYF zeljZQqli)}=b)Bms_3Sb)^_Mgoi@s8p^-XTDx{U3D(b3ylA7wPuEzgrDy*57iYKbF z;yP=ttinmFuE6%HYOA{z8!WNM`pPS^y^gABsFOM?Ews-@OYOAQW?SvH*m8UAx7v0q zF1X%?OYXRVf|@R+>KfYaobMLNX}t8ZYwx`Gewy#P`1Y%>zemZ-O2D8JY^cF=B0R9W z2Q!?o!wbXPu*45j9I?O(XAH5%7ITd8#vpeb^2Z{VO!CPEkDRi}DH93c!Y+RX^UN>T zEVIoq=S=g>JnM|}&OY}H^w2*SEws@=Cr$LxOe>A_(k_$Zv(z+GU9;6UV;%L>Tvy%o z)lN4J_1LXwJ+Rqje{J>JTc6!_+HS`U_uOpDT{qot->rAveB1xsH{N~+4*1}E`%Mbo zhf7TgEB^rC;Ae+Nj`-wkC%(1iZeyOd=89APcjutD!nx?44=lOWr@NfG>2I&T`P`{X zZg}Y~XFj;=uHSvQ?YOs2I_kblF8u4A4{!PKz#mV#^06=fdh^i#uDbKaQxCiJ$Xj1L z_Reo#J@ed0|NZmfmk<8<-jjd6`s}CgzV`5EFMs#((?7rX?TcOjDf<_2CI0~IUjPGG zfC3JrfCxlL0u8u81Ck;MTS(vm7dSx)Hc){SykG?pxIqRsaDox>U`voCn;bEV~D{Sg7Aeh#32oDC_)<|(1$tfp$`9nxWgX~@rWX9ArX~`#2Pk{ zhfWlt6r)H*C|c2oQ@mmjtB6G|ZV`$z3}Y9?xJ5G3(2QstqZ-S&#xu4tjckmg8|4Vc zIoh#~czmNC>A1%`_A!rq4CHQ%IGY?6a*&2};~{~QNHH$5HjN~tA}8rcN=mYln7rg5 zkF&{6a`Ka&3?(Q>Daulk@|31bB`Q~`%2u-Sl>v%nXkmo$OR6Jay^LUe7fQqs6-)(P>N18q881lLovG1igMJWkJ2beFFI0@lJuk|P3cEbx>A*vw52c| zsh&(a)0ndKr8vE*PF=cFoAUIhKJDnHFeTBNhE%9V9V${In$)H;^{EJTYE+?GRH_p7 zs!N@!R;#*ItRD5NN(HM_xk^^AhV`stHEUY4T2{8I)v9idt61SW*RIMHt#rk!UF%BL zbNSU=fGyXv0v0I3PV7*Itr%h{WmuiP$+1U6+wN*M*_%~%dNjK%>oV&z&619@prveQ zM;ltpl2){Gn=J5B>pRxE_Ij^fEo^5i+uHwPmbSOG?PhViTit$^x4-qRYI956-WE5w z#~rS5my2BHDz~}NeXev{3*70(Ho3Q*taiHzfbKeob=u9Ycy}9K@{aenQaaL)P#Pd zsx2AGRu57qv4r(3WzElj*80};%(X1<=@VX;XVF#g0ySpEEx4ETV?P5QC;vN70w#q#&1$}Qk*zSzE%O5UtpGX1UG@p6R$-(Z9!~5M* zI9$$qEzFt^{pdy?Im~rFb8{R0>A!3T)Wtn@q#sl2Oeeb5e@%)p2;J#fA2)u15P%>I zK?r4c92u65ORNKXN^LsQvXoUUQfz`*#In_|uJu-TAt4FELewa+tk=Mz{~#jwf8*jANkJ- z*sp%}udn^?b6;Sfs+a%8!VfX>kH7rrKfn6HpMLhQ-~8^6Km6z4e)_+^{`kMY{^g(l z_&@FcVgrC-Gk|0hfCfl_0$6|ucz_DnfMDY_5cq%+m^EKRfe~nd6S#mH=zwU`fuHk% zf>Stz1A-$Mf+Q${D0qS@Xo4(AJBq_NEB82;4u)bt zI0hnQjAyn53-xYJ76s4iSS z0N4182()C>xQ<>Hi3Oku47EQIB#vA}4s*ysqtJ``$Uk>BXW_UB2yi7*w}>Gm1xQc; zDQ1j5L<&dvM06I8K!lGD)Qc49j$o9LarR~ysgWf)k|#-$2#Jy_sghJQYA|VPq=srS zNs}^JlQaLBlYF*nndEAWgh)X7lR^neK}nQD$&;GolSa9eNEu15 z-L-YKWS7(Eb6)3OykvwyXpwmsZ=vx(9T#Pq0Gg30jXoEdv6P6`6m%{|Z%N>85rA{F zGz#wJI7zo}?zK+#1_TKpHS9nNNZ@WQ*9wUU1P<2<3aOj`BAw^P3P`Yau`~(@z)b+) zgk1mUIBRKd{q-5I8HBrJk=WTB-*`)s;B%tr6UAvu^%+glcyp{U3hYLkw+RG65ClRX z2t%+4OP~l#AOylWOzrj=b@`wGpp`jgQ7N`iO=h9)MR`FL5u2c2yUAh=wxK7*KNBh^ z3K@|=#ST$`1db<#5dj2|sZ%h@4*DgcDhhaugLpLsUvNUA(%4f7wO<4k1xWxWGGwDZ zRRFOFC;Es4a)JaccUBa|3P2zoNSaeTx+mT_3LFKaNtL2N8m3@6rdKMaWlE+cnxn)sNer5 ze$cmlj=C;H@>nxNsV`%x7?`PVqp5PksdMA09(aM9I;x#Ys-J4AxN1^`|sI%ALoE2>{x5IG8q08R*D3b|zXrjMhbok9QC3MeaJ z_Xe1waId1103o|O3>Aj}fCM<30Hlxra=5VoP^?ebWZH#?Q#fQeMm-8^Z+)qqDi#4- zcyp?g1V}K4tuP8vfSg7vJQ}Ns_bRqwD~V70uT&OZvcn1h(3hX3u)avOa{F1Rd5eO8 zi{E2mtU>Kv-sFk2|^C$d3M~kkpvDT0oJOJ3)z<1PTO^ zP3UkEDT*wnwM@8(LNvN!wo7Kf8NEf@k0Dt`(kLC-S^(bp8lwM8yHQ||`ZW@x zfTFyMLrqvf`n8YRxCy3bd9r)5K!`wOyJ8ASqU{?6BZ6WDB)eFK1kU(q_!vT@(2MM= zVo{oo>nI8QrNB5D!8bX@O~RCxSzL79wwn&}4`Tcee#yk>X2$upb!IY4$LVekw@#Y~ zbi@X2zcFBW$(M)I4iEHlRGI-%kOc_$$5Al8Wv~eoFa;Yh1zZ163cX~n|3+YWJYWZx zn@wDCmfT<$mtUEw#I}@jNZTCD>2WozbRCCZVHZ|%j(GpDXJ8XW|-Fh4wnmFHw0=Wf{w%KRI42Y0}f7X^aI3a{vR_hxha zE1i-M0W{joTDP%3XLs?Y%J9Yx0MHKHX?436$Isc2x4fLYdA!sqisncTF=t@rEQtIW zhVF@-HrI>TIR=ry3Moc&*jgS`DsZgJ#!g0gTld4CVVgFC0P?2JReYRDpa@E!2nk1| zV7t%|{m?qsCR`FBctR?vcVQOVgBO|r)Utc5AdUR{CPx3LVhs(L0N`Fp0GPP33j zU8?Sl-s?>?q56Mlquvsjf-N}T_+5hhz2EzNtNz_K{zD`Kp5L?z;H|njFbKN4xrJna zZ#Nj>L^$DXSm8rh;YtgKz{80MV6>yNLQY&Ga)c`Un9Tpm@R?1*@QV z2DSyRPzq#VV0&vdlh?D2NIE@>g(a&w!$olrG_PZ@1!SNF`XvQbID;yuU3B|xLN0{g zhO^yOt#~+xaM(Ne1+`=lZ}>%rO3SdoL$k}Hu&f|8D4SwQFa}bij}SzU^%FZcPMy#x zi}=HbKP?6J+Sl)vx9<}kuLuu1yd-ENkFevYCHfC<=s`*OqRF1*|eCx zvgSiR)@+2N!-P3Y==-IyK{p0DonJ6oJpiEThcnlJxaylIUy1{f*rTyNewT}Q=!$D^ z>l5fZc$&@=>h}{qIvog#kO&UO3Ys7Vi9n=EyXl!2Kf#z~!T3Mb&Ol$r5ZI0o^oY!% z3A);z5XTtq0}-E~yFbVo5!l*aL`@J>3IOm6#*yuA%|Y+x45RJ9Zs2%utk4b`8wCaM zjpQ!w+ddHFP_{rAqv;6n=-i9u48QGA%?$jG**@+VM32h6IQZ_p-TS@oSnw|t?jq4% z1r!AlFc2QU@e0WfKMI%-Q~>xm@G}2T5Y-HrGzz-OI1tMl@jyTZ1JPa?SEc1H)LSqR z774%7*$ymr@=-1BHze`|5uBO3cJNN~Lhp{0&5#f&?qUS>UhhO-|MXx#_F`Z5MilmE zPxfhV_Bn+1Z9n#1??x)|_HkeLY2Wn#B17|5K%;!bO>q!@&k=hM5`e$=APo2tQTQ++ z_h+Q|wn6wh{P=W1_jh0Ulz;g$!T5HM`9HDko1gig-}#_#`J+$yvtb&efBLVs`oQ7# zna}pAAN!&q`=mkps6YF-U;A2F`k^%US^4|BAN;^S{K8-S%OOj$(ZkB$#mnFP%>Vq( zAN^Pi9RZU3(Em%_J}^W>G-S++0gq zfCS^3=78tqa*|fM@0alIDw?t2e-fl!YZ@fBvHD?3~e_o5G07I zYayqc)u<>?qU2nTaAvz!JtLd&i$}yltFgc&_e)}wj5aA?lmte>4+swN zT5k&z5meGf_E1cYl>{_d56jMykV3`0CLCppB(!ibFE6{Ck(|Abi!uRnRICq42Q6d> ziCSVqkf?_cASM65!}gPcN4#o5lS@gLR8)#hoFs*}QSeHW$W3bL(KHzibTH95Cq0$Y zR9B@F)mBw~l~q?~g_YJXlLVB&T)Eu!MqGcjua#bJ4HnRYd|jwMVSzmspT5omb7Flq=?RH#q%SBh*bcsDzU3b}C7ut5=eOKOipT##^diS-r z-h9dRSKkxe^OszJ?Rx@oJu*81zD!zR1yvCXC$Y_zjpduz4dJ{#_|1a(57=_8Au!W&*r94^~+KRLXI{zSm6%7v;Ks{k0iX|&di+^4iKmXtle^Hnq;)p_u=FBfej!_^| z90U;nlyHSJVM(zg$OChR>EZpA$wa~vNa*>5# z{9@21gosEWLKCAv5h>u92`J2@h-Yl#1Mhf6KC*;*1N#swKIAw;3i3mk3*?8|F~~(K zl97-6P!t}dlSu}sM~$=`B-`UiP8NVSE^3FCoYE;N_=P5c3=n&G13Pv+NH58;Q*zjW zm)@MFMO2AEJ9sjnPO_($niQ3C#?+o3IY<&xxJX&rG0Zgm(wUiz6eC9=rw@@ON~izS zL;^7B%S?WVo8PRaO=NjZc1#nQ7I91glHjH-bfz=j1g0i2iKb}w2nbXv016AhlR;*) z0HGOVXUM@5LoO3`#DS4kqBux!!qcJa8O|p0BFCbjvn&{r9WM#`(1vc(qa6h)Lq*Eb zk$$wKAth-_O{!9quGFP1h3QFU>djV=hdqn*gs#dwym9BS zNKSgv*z@RyyQSsPdDM#@*A~W28tDrujzb2J7-S)BkirD)tCB59!!V{qsc!Lw(%vx}#5voW9A>@b=e4mqm zr8iDkVHFL$)KIZOwb;mx6qy?M^R846r|+#(1o^IP7nbFb&Mhsq~L~CRw0TA zu%y6lcJpWr3+nfLw=2l11;kQ)BP=&CKmhWOj{vo5V$m8}sn!w>Ytfl4J>+p2V$Xz3 z#0o7TkVl9*Hs-Rt>jx!!P%Wy3g9L>!YCA3hP_oef64fI>73rRW?23iBJ(!7Q3{cJa z*o2_e75dE*09gV;eQaGZ1LZ0T5eQ#>HsiP=1zSV3p;A#?MDPD{e@T>|64h5y4NwQw zTT2Ddf}T#KB^2!?)jWbDr=$R>%GG+-s&TIbhob!C=@+NrD&5bN-mCRU2zZkZJo-$$;o!&}U+0dH~F{ekJ+Er&d z)(gJ%rE^{CUaxl7#s2lNhkaz=p4i#d&M}d-on&Z-d&lI?_O#O-Wp&5<-SrMKyU+dY zeviA`1OIoy1K#k3M?B#bKX}F;e({cPeBvYjc*#TF@|Bmo%WCE-u0+|z3O2Ivrze% zQ$Fe5|FZ7SZ2sKe8dC88wY0q3Gu8VKr+7a7%Nn=nBbK9IdG0-pO}p>fz02~Yx8 zAiz?PKng4zA$pvdQJ;|*3RVb`z#+h+p{Fg_0tG`s@R0(E7(uIPLDjj8ok;)~3?r;T z3e{N$-Kq#iACh?zMIn87y?TEU^9iUq8} zFUpjM0E+Cvqc2P&w>S)upo;}0Krp19`}rR@GNb<-93C>Go-t_!7FSBuIki@iHJ#AvgnW=l~2nV!=R6BQ0o=$Kj#(K|@qj!m1DlQ9uGD2n0@W3m||3D5x`7Y@$e2{0fq-TVkW~9btw8o$SC3R|%6#){z=ncy;B~>a4 z%b73>Qx2W599n86Acz1-s)|s;#A=ksOhN+Pd59RX93aW0ONs!v;0_aM2YtMXd7Q`Q zfCz}-KH7i?9fX}Vdy&0>Fl%hao3h4P3K0J&S)|Tj4}eRNZij>HRO2&z5hkhIb?mz+v8z%lp z0y1!rMo~tJe9Do8%AlG^skF+f#7dvc%Bb8*s?^G_4$E?iBw9Mvms>syL&P=Sv49n0QOZnJL$K=e$J}7#Ln&1&hF&S@AS^_6fWn25Ag&q@Cq(g@Gmleu78-B^4w1Jgii8Ih|NHc z_0kCyQ;GKAkNZTA2+*u3H5 z>Qb;61PuTBM6mF(g_y!w%Ao(4u#Js?vEAs6ju;Ll3l&0JE*PQG|3L!%{H^V94NhTO5vftkp%dV5aG2KQ6Wikk&m>MF2RXsbP@Ill@l2z468GZFcNlvlUl)*kQ9(xWf3b8 zIV@oh7TGvRwT~p2wldigZ3KcOST`P7idxVVV4V{#Dz#AQlO%{X2daVwOpp9TlfJS+iShcfTaire+^h>{a1lCSb`ncf<@RG z$(DqjmWNfAfo)iAo!I|{O_qyo7KPPVhdtPh?O2YrSUQPUe?^#k5txz<7=T$AmDL!O zUD<>|n4nv`yd%4s4Lh3!yPPdMoyA$Pn_0bUoxj6Bxf@!MDO$bBy^TTIWf4E%3%~E1 zKBv9C;G#2*5hnIwn+02U$7NT5zcqEEylJDbEKDi!m^BlcAzUlSp!_#Fz?;8y5QNU)A+ zm4rfV2{7EB8p1>AJ)Qpmq+uKw%n?RI8pdXHBxRgoXriQ^c#tiK${OA#YpmgKib!tS zVaG%&kJ{ny(kh?);YZp`lS^V5c1uhe;wiQ&B_`r4Hp?OgrzFl|EUscIe&R2#;x3-b zG8U;Y=HmY`7UMK7&8UooTv}t3Vq-a`<1Mb^GrnUj#$!9?<309cJqBbip5s0ak8{at?ba}M|)9GG*a&B z=YEc|C?ztfHngqw>aO015_vF5U`n3uiL6*^er9U5?hF6IYOW@=ua0Z5p6j~iYM^-x zBv6dcx*6Td#p*}`AW(ur#l!&mG`Q|-(*ieBW9(9M?Dd$nZjrZI;}Xyal1+dUhXA_G zuD71!Y@YqO&c0dE25p)pZF-xxo>lGBo@~x;ZJ*P*(vECYE0>*(+0{;M)~2@HrZxX0 z8SU7H?cn}w;nr>5zB%GHZqF|6;~wtj*6o7JZP{M!x8pnM{%za-+3B|JhskcitM0w? z?(nAW>;7)-HgB`@xb7bB^@h9ezC6lfZ}o0(@t*Jaw!8AC@Asa({nqdP#yt4u@Ba>P z0QYYK7w`ffaJb_=+bcc>@4W|i@CaY<32*QT$J(vMaIMvFspasc9X=2LJrKX}4HxmO z?eGsbz2mEJsTDuxV{xc`+87@{8E^5oHJcizaTuTR9rr#{G@CC8akqWi7VPoDx!eZ& zkI|(+BFDlMnZX#5g4YnlEZiTSuoPBQS5BA$1(*OXpMo~HKk}o9$9Wx-xQYKW96+m~ zry*JMH3#7N``zDd!6^qG>#=hgeG*atLK|F=IOkC4VZc2P^g*ZcUu+`VO(S45LqkW3 zBy>SWhjc;o@kx(#EKDQCp>#>FbTrrWPG59S=k!k(^-w4EM+bFNA9dit;9x|>L;!+U zhxGusF<&foML#2A#Pvf8+Fa+po+L!pWv}*Y7t71M%53jRh`{z}XLf2A_i!ioZ5K^&H}`2T_hTRTbl3K8|4Pi1_s6Ww zXP)*~EX@%#T%< z)mYL0dx0r^mOcHzCt1_ye3)(h!*_kefBlq={o059bSYZfr~Uui-+gnFZ}~oN>lS|S z7TV&EyWAI~5kK)DKijgk@wcgk<71kqsT!zJny6Wt?8pA?zkcWUTJLZEwgrE+eg5z- zfAar+@mGJrVVw0(|MO>C_#fN$m;dpP|M$m#^VeJPrT_g02v)5~wGv3sV8MY24=P0H zupvZ-5)+bJXz}4hj29zr%*atA$d4jDRt)L!WXF^yRVpNiawW`>EMK;iiO{7*oHse@ ztVt8+&zdoV4xO2kC(?;MfgV+wv?v zH6q!Hj!ojIV*yJxDdmYy4hbcdN+!uf#O*xqK7Kl=c0Nx%BQ1@N*ZaNV_J&mnRjYh z>7$r>DrcgTLOSZ7p%QuNrl@k7>Zhx^nrWBOp--ukVq;BHGUx+#XWtzhd$ z*)F{7Bq7DT_0oH($N13a+61rtng6!j)d@4`tme6Yb0L)`Gg5?c&0 z#usaxF~=Kw+%d=>iySh^Bb!_@$_^{+amD`(pZqevEvuYz$1>a8@69peytB?d=bQ7- zJO}MFzCaf(^wC7GthCEb&-^sSOG7Pn)J|7DwbfK>oi*23dwn(7TYtTB!eMu9_Sk2O zjW*kBYh57$!oI_jsZo;vHRyWTqNuUj5F?Rvj{d+oX7zPs+d z^Bw`>zz;4w;l#sjyzitVpYZaaH~)L^(GM?u@zVeD&oB2}fBirH{9@1c-edm{`P+|g z{`TOXkG=Znw}1Zo>7(y``{I9(KKuXk-;cfh@nf(3|F#Ff?8$F^`*R=u4hX*l`cHuc zM4$oVN5Am>VuJj8-~uDazzu3Je;$M&2s0Q$43hAJ=NsSv8>m7Kj?jc9bf61k2*Vk! zu!Ak6Aqz#Q!xz@@hCSS&41dT&7Pha5L$o0facDy$eo%-(%;6Dz2*oENF^Wlaq7tQ8 zMJj5si&vat7QeW~Fj}#UT->4d1}H`^nvslWY@-3=m_RwwagKI;;|23rK?(-YfNB(A z0{_@Y0uB;|fGlJig=oP&x^R)+bL1ZD7fA|2(vjUepg%4t$x34Kj&A&951GhDJc1I8 zSUjaEQ#nRdu2Pkw%%UhoxyJulCeoF(B;^mw$I4gka*dBpWhScK?!OPTPT#F3H_c!1*%YlO7x)> zy=X)!s?mum)Swsj=teCX(u(sZRZwJ1n$I#Zq2 z6sA1=sZWEtQ=#^Bs75U+Qh{pJe<+lxL{(~1zvtA8PBp4Wg(_B`s@1D*)v8|2Dp$k$ z)vkhdtYR%ISaa%9wVwZ#tU}G`Kj8||hSJrda$RU$F`8G3-nFQAji^Tf8`pmZmav2U zUIG4@Si~x}v5bAJJr;XW$x@WEj-9MREelz*au%&_4Qo~Z8QRZwmb9L2D{4!d+SA5# zwDxeVYOM-e*3#Crwq5OQV_RF9vX!m6y=`xI>sy@$7pJ@ZEpC&G+~pp(xw&<&axcr= z=l+7B*2U{}vy0vBYPY-G{jPVz3*PaHx4h&%uX)pp-u0@tz3hFjd*ch=`O3Gx^u4cr z^NZj8>bJlA{jYxm4B!C^xWEKHuz?ed-~}tV!3=(|gCh*#2}`)b6uz*46U$HyM;5Of z{;-EbykQY{c*OrEE-{Khd}0-+n8Yl8v5RB8Vi~u1#x|}oj$wRb9p{+FJpQqdgS=xQ z_jt%gE;5pVd}JjjnaE6jvXi5{WGOd!%2uv2mZ5xQEoYg^T>i3`!@OlNcX`ZaE;E|J zd}cMLnapf{vzz0*W;wTc&NtStXq#%-@A)Io3H8NmQ|ele_8HI~ovLdSt!IlWn$e4< zs-FWb)kssc(U5jDrZ27ONWhWekSp7f|Gt!h+n+SK*{G^t3?P)ig+Rv^wwy&*i zX=j_;+gAU!x5EwYar@fZ;x2c$$(?L;f1BOsUbm}Roo;ulJKFU&_q{ER=yoT2-|u$m zyy0zcde_?D`R4b)1&(imD?H!{fB3>1j_`;>+~E|zxWzL*agF~Q;~W2Y$2mT3j}{l8 ztR^|g4=!$$7gXXQPdURY4s(~Qyyh|Y_{(!{bDG~=sv5URzWIwyv(~kDFtG(@Pf4ke` z4)?jsz3z0syWR7S_r2@A?|lEe-w#}t!Heauu4n}n65j<<{B@wVXa(eL(T<4rwHB=q z1LptNK#E!%7O!^QYv=h2`ni6-^m;WtLJQD%)Q28?svo`QPcM7Xv!3*`Z@uklfBW3y zKK8o*eeYMld*25i_QD4~?~_k_B;o6mgXQ~&wWkAC%sfBo%eANkm~e)pZP z{qRp8{N^A3`MuBm^ow8pPF2I48EA}X$;Dz+jkzM?C}A}r3L zEZUb879NKQ6hqmAE0lp1Y#}gO!4+`AE!aab>Y_l^gXKM*`{F_QlyJAPw3 zZWKMzBRcluJ*s0q;-f$UPNV;T6k|avLq)e(LO}1oBvgA$fWK80u zPx9nU_9Rf+q)--RP#z^wBBf4pWC657A-V!7xWeSQ!#LW46nG*?CM8ZX)=5GmGy>pP zKBQOfR9D&q8EgSTj#xsG!6rl`I;JH#UZq*KrA&?`Q*J>cy5&9EC3Z={7D$0#LeyVM zfi7+WVDjZb`K4m!O)Bnr3HmrfZgFYp&){j%I4o=4`%ZZQ|x_!X{+eW^d}|Z}KK;?q+TZr)m}_ zauTO<24`~iWMUNnL3+h_oq;f3ffrc8bzT7%enNOno_98*J&@sdSz{ZP=QXaO9MmE$ zuBUpoCwso9d&Vbx&Zm6VCxewj8;GJUkU|?g<91!8eHPdzYyo^t;(&I}Y(jz! z=t7Z#1S}L_I;d4j0fmkifNo-jE@*(#r-ybZh<>PuhA4@SsEL-SD|$tEeFYLO6n1K1 z6A-`vbm0|#!FT;aA|~SG=_oU{s4awn8l*uSpg}ecX*Q}sJxKpn|6SKyG3kvi)ayA^ zl=>)@F6rypo|Nt%Lm}Ok;uV+r-;^$CmAamGHK~ur;g{M1n#Q4%o)}k-X_Kz0b;+s! zJ?WfoDVx%%n&Ro5z8agtsh!qonFeZ`E}@_vYM~}7pbjddBI=?#s+dOVU@5AknrWpH z>Z4NXq-H9oUTULis-6YNxg;tg33PzACBO>Z;DF ztlp}t_NuPpYOVSzul}m5CL%!?Yvkc4RZeOWcw#HaB^mhT7FgGS`eiHpLOW~$Df}fV zY^xMB;xBlswp!Ow^+#xWX%5f{(aT zY>V3JKv-9^nk6YZY__JXbzNe()~hKFtivvpC}QcZ7OKtKY_1OLq2}z!KB~_$;jRX) zq1r0Z5-raDtkAaW&<1Ox>a5ZhZPe~8)kf{n0l#&dM=8dDCv%_>6R|)p04V; z9YHKqJy@c3$?JC^=(9HBy+Yo&8YX|ftArxryr!%tN1+Oj!U$6#eFb8k22Y2usM&WnagA>$f;s$^MXrUEY0hA)+el{bI>ZtpA7zoIK zklt`MwqXjq9x~?Q2>-BlMOF|4@pieeY+nDD5sxJj6Y&xcu@g^e4wennb?vKFLLMqV>m_O|&8{-~UZsA{Eb}(vzCLSqVFgZTVt8ig zK-fdXJ|2L|r7R0`8zArkqwlm{D2LkXD2m}(p6~Ha-p8J=E*>wyCZb#}s0*iT1p_Sg z)@xqgt69#hFi-C;ek*qIa!WMvycKyxxB z7xX1}azGRGK^wFsH?$`+^g}PSL_2gsBlJL9v_ez#MMHE&bM!_}bVO@(Mu#*>cQiUT-AIvRE^oF|YOX zUN3-Vs}!tnJ4k>iawz?_LWH&~VD2?v@AWd<^L3H6godJEqq6>{GJ`IZgQ~KFt}g;# zFD2e!5kQOEO+;GJNI|Tu6RSKc&na%Mk#lPw|A#Edyltzzju4Dw|mDoe9yNn zn74h)w|>|6e$%&q=Qn=`_<#2|fDgEU7dV0wxPl+}f*ZJlCpd#g_=7h%gipAHS2%`K zxQ1W&hFiFYXE=w4_=k5mh>y64mpF=(xQd_niktX|e@`pmCn*#oj=FaeZ0lLmtiEO| z<4G*?>L@Dncq^Q&EfD|t?ZFI;BfGq))n~S30I|`lWZerh9s(hdQT! zI;o2~sE@j&7Db5~cFf*bTASkJCn6DV7PdHGWB0i!irLnuK2uv&*={#xij zSm-T}B4Os2UylDFJO3q^TdyWMHYyt^_&#sGCv&v+r(>G0T>5XeR`$k9tnsq*{Q9$d zEB0CQuDqkR!{W6|1hB-bugJz1Ugzr=>SqFPE6vI^$oDwKudld6yU9oU$)`NZue{2) zeChJ=bT8B^xPmbLqIUkGDcnLF3bB4dw{)j>WYt0~tRWg;BN(IrEA&DYm)A}6*Rd!2 z*EPL%N%hl7=ZZl+%V)jIZ@t!cJ=ZrFYkRjYwt*SAK`9&~D8nqglR@ zZ zwYC3MR)R?F)nc_qOj$Pdym~Ewk*(UVPuHexJ6CR2uu1FEwHNm*--37b=C$ZIaACoQ z5g%5ZnDJuAjUhjl9GUWD%at)-)|{F1X3w2Le-<5@^k~ziQJ+@5u#}rtZ4kCfofzco zqLxeA)~$NCy;dD%^A_HFcyZ##jVDLGTzPZm&z(nyK3#fs>esDj$G+X`LhrU*-FhYd zmb+VM1){I{-Q&Rm0&DrA)oXsO_4nK356OPNe*Wy=^H0G12<(r*02_+Sz5fO@&_MfaCm@NpuojX{(W`Hk3MX3cj~X9l^pCnIR&PY}_3Y?~mONf>R2#rL zHma*50~ynU!rex~Z$IcNFceQ_(9d&-e_>#3i(DHt@xqSj8wHoRjhnlXzT`tBQGc7T z$b`H!GK-?#gW6W))QlslaVJKO5&guPPaCNu)CD7yFyk@~On|!)2c{+-8_G3vw$s%H z2%jaa!Hn-I-eb;xn85uC;d@tQV*Vq;%f}0!IUjm126DTDf-0*j5tD;?4YP&LvhZ$GUuhoF88DE{k)wRkR zt$#VIdf{lW_={|~o{YKAQIk+p?9_J85#rp$h?v>$;Pf*-=;BMCIp`5>Ha_foJwJ0e zAWtwp8UnDx_kTAR>c}@T7|9Hd@B2J2ZQxM451MXpl{t~}8n5)2@SC4KT@2tgIs5lj z&g6U{NwVpDIh}x*JKxC6Gr8ETXg0ZAudi*o+-{zqyWDT(MO+;W%OUW4lakH&f9Hbb zUAIg$esq;gmCJQs)lVV(t_TLr*EgL6NcRwg_0HxJ7N>yQ_8B+W^IIU6Diu`qI5XL1{Bevoi(8Z%&_hvNOq?^M5^_(+(D| zTBNai{F~)xbg2eFlLRzl7Ib=Z#w*02pLgSrC^vpcbgO@chnBa$>NYo2`SWyuvw-{`YY z0Vi^1uS!&q_uH$3Q<|!*pEpke9U?1}#_983cZO)WIk;ffEZ3xF83$c|xuhM~+sN#D zfzW?k(odGx~aqpqS-ul%s zZY9=MTd-MT3H}!mS|aV>``!lFKW=62D+1b*I&Vvf592{A>QcV36D1tqDuRK6=8rB7 zJ72#15f?9LDIx`Jw|@EKsLkF&PGEAt;bB!WejBAGU^Gx#Q?wJn*K4N4-rIQs_s!gTwVGh7zJO`f7CF9 z6Lzb-gyXb48fRu5JO{UCk3Je;ml<|Z<1mw>pOQ^`#IR9+7?Iy4G+!P&qAn>33k0H9 z;ecT;fYN^c#-nc692ciR&MQ-L)x=+PHBLdIK4zoQoK;_so!;M_9uEKL`uhpPeh47k zoGvf1UBKNr#H{$=VyL)A3zrC#pk(j2{R2Q-0>=Cf(iRUX|(n6f3kCb4!th-N#&P-2U!m@bA-w-6nvwZ$qDxz{^Px&u?3l z-_|L=0~xvlyMM<``;JHS9ml=9F41>`hVBMNli4_tM%}*~d!HY zZSta_9G`9qWadFt^qr934`0etG&tonIZ^dTla~#V4{B2nYg0`}Q_MzFuauK-Jg44z zesA~wy<;beb0_M-3_t%E*k<-#pI@2&jlyCFWu8177?b345Jm7VFz+Lu$d-wsD zC>`JagV#EAqB;{@{%R^h<=Mb3BQv_GjD1aKI++SO=sts-=tH>9Lm06pc0!#W zJ!gZSS$pI~`xq_yIK=sJgfnNhKb6AMo9}{DjX23`p4@B^QYWN|zVhB@3Zi8W(_xMh zWyU%)i&`>B0$JqxSNir@hDBM&oLMI;SZDWHg@kDd5%daQ|7m_*+M#7Tc4j}XV8`#X z-~7W~MjT2;a#WOZ+!f=b{lH1{gOmDzli?5NpgP5`=LP<6SF^uviamJ37{kT=gNy4A zm$KMXz=Nm21Fk?}c4`f7YP$pNs4EKcr0S`TE^s;yI4hyG=&Ch-l*4pLPnU6^ zBF>jt@hX;skGJv_WF*^&Q=8j`(gaMgPD^%BB5HReioAKl1bpk~Kk-Ly0@)caG}I|P zW2qi+%!}#jg838GHpRoh6pz6a^dG5WZcwowGKzly)!rccu?O55)pv$yIYJCv;L;4j95wzDU>BS8Z;-H0R&Ec8G73AHmloKU_O1G&)%T3Xb@_(fg}8(` zCciCgAI{I!tgNrSsej@y?f#Gd$l>@Q2LUx|f_61&`#^ciK)6bAnQs83} zpoV2wR_JknLv6SoL`nm@&q*$#cxc>$EMeG+YuuNA*O( zmygV%43%Y$d}ZS@om~MkRmxVbVH*{$)J*9wjM83Tq)EL=mz>H{X3Ca(lMV3B1`>Ig zcaF|aKmZ`eBss@CSsVF27vZgE_a@KTJI~B050#u}HI*00ly94y?|6~-)jL1-XMVy( ze*8s25>p}OO<{pIagv*x!&FpcR8%&VTYpi6eN!CdUDQ66-|Ai5z*I6gRowftV0@}% z`l3Mmg-&6yo zYLKWJGv-<=ShYt(joW377jqq2s?M*WF66SV%xL)Km#9zGas`ml?6E)J8z$$teil{# zEp6BD2@^6jQ-;V9S!7S}^SHIyt?TE&9GoKEt#*WLj4w5hb%?v&JybmN|^#;zpet_mL;qfBvL7Y;*+1VG={ z;$=eZbFLIg@~1Z>rXN8V6mC@+P<+=(Jf9LBHs*Mn6d&gDk~U1=(S^yz_!Vm`Wqm4G z(M7^`jID_!?yGcfna?mQc9@g3hY|jV9rK3^)5FU;A^;x|ne7q6kGy6bm5~_*phtn| z9uT%i2R#NscXfZQGQn4V$xe#SjvA^Dc+Wb1`D~ok+t(HE=Yap{1y2pe`@X}D`?0#9 zvEzii2?7Q^p2<3q1)oeoPllkUVr8b2FjMvLX*=vxD|WhecKR!NrXN4u&N|zTpKL?V zR^VrP;j@dF*%6sJ9A<77JG+LTUBS-pV&>~vXYu&SO7H>!PJC`($eUe=#Vnq(F48p3 z?c*1@*%o+B7CEo~ammgL$Sw(8FUiO*OZhIpZd&G>TNX`Q2Klal*;XXeRuD}qW^DeK z39E$KRp;wfw>dwrxy^U5JoBIWc9&~jJw^5W>nN!;l*tCtcf+G;BQtG-OV^*e$)8o0 z1NUwI$K1aflP&5kWW)6qsqi-G*21r}ZMYp6ZWrn zj%9bxeRuIqyEh5Dq;h-YetXo-d$fc-2DyEgoHutP(|Q@Bo;0Tg!lilV(?psB9MJV5 zXPQy)L+DhB-27ifL=NoY2=wL{h&a}0KGyL&91eDPq@U&UA6jM zwKrdN6R!H@@WbpiW6k*SdHf;)zan?N;YS=#T<;UEkL3vGeuSI9^aTQL-(?c~vX}Ae z6V;{$fH(@BrM$>u7$gK`sh& zg*rJ{%&VPe^Fv>3EuA(G&ih=GlP&mP;1dx3cON8X1W?GX6HGsmYE5tiT>=cvK0h-0 zvhbP7o$N^8Cvxs~(^(-q=_E#5IwA^OC zPSh(lV)mFhn3iou7A`-N?b=Y<#4W}+8`mfF+Bv*?XRIDk@p(=;oK%nqlDZi zEz^?)qNs4T|{TkLDfyuFrPM{0LVBV!QU1lm9J2j+->^T5dma z3ZSs(AYor`AyXg%(_#)%k$0_B=1zf3+Z=c03|l?>d(|J)J_e*dpu^f*@*b;mw(LQY zKiBUe#Q7++4WA`^-zyS+tz&4d{z?(m9xai1zGy2e&cwyD|3%4o_ltX%Sb7SI)rE~ZZlRc21V&BSBbA+rydW}|NzBLkkrhbz|pQ%`43(G1; zt&@TecO^p#M;njYaNoN(bjbt7tKvC~!1pF2$s>Kak`3eoNON$?vY@{>1C30KT~Ai9Qq=x z_njJ(uPhL%^Tk9ji!tY!s@&#qw1XZYo0YWypb@GYou-$=$4#7=ZvIIu)yoya6aei) z!HIKvd9QQ$Kz^Ge83S=t-u(ROk?%*dpSTsMBl*GUo1^*v0n-wGNZI?bVsp15BOJd$ z^CqN3oip7s-sT192kAsr<_&vf(d)qsw2it-n7@%N>cL z8F~$cINz*oI>YVy9`?=?E+kvF@kRbLeTFw0hFWf$I0Xjwnv#k?Y)xWy3gVMqyc@{< z3%^qCFLPyjf8O9Xj=RDK*oUA`H)x-=s_=vxn^KEE>KM;)c0mflSzHV{J6A+MS#6t= zJ3j7uxxeoeA#L%52HHhl#Bb=#|_m6X!c=116w@u3G&V%9u5w)AL^6xk@#rU;2tDr(q6z zi7a;9x|*W*pO{h!LXHSgVrt?2pTsmz4!5BlIOP{AYgzz6w}NT3$1W_63C2h{!(Gr{ zq*iqatJ>D($`raG4N)d=U?)BA{joJtt%Cc*wg?R@pj%74A_3oGUBoy(^fIH0;REum z0V-hfTAZXZ9O)R9#M3@w#he}O-^7zSLlDh*zz`vv5n~teKi^FHk^wk&5^17weqUCq*CPFY;NN5Ziv3o%9k*-dTstoO5`f&+-$I z^G+b!L2QxqiXiWK4}9)JT$|6TSlM~6K+-b}Z*^^HcE}*)_z-jHv;LO%=TKPWQI>$r zx~8P}NG##{C`Sstsh#(8v?%hp$WCU{xYm2T^7^<0h2A#hZJ6kdJgF>_*|wKNO%uDQ z)eYz!r@V%lt;o}cEtwskTGagE^(poez30!{xIh_o)+Qjk7cS|uL`OJlm-0P`&TCv2 zh&u1JlRZeS^;r`qocE)Ak1}|%>l#rPBSo@D#ggbPFyUgX!S|#*4?BT0qnX)~J#C!F z?xJX}<|*aQezQ02hecg23CNxIA({?TXz*(qau=iNO~*x1_$@oR%bEG6(*~OB-7vYU zW%lOt-l*%tB02mvqWN-~hH%;|cYT!JjNghPTyDt`uI8Hwmo)waUjLhF{v_}GNxu;M z@8RC-1H)Qz`a0@cp~ zHP$}?$%15`1qn?A>UDhrdwv3a2@>@T($5bvc^qU~7X(QRGBf;aF%e|*?6Y0|XJl6p zV*Rt_*=Orl!SBd|-MT(|J`T3c4@N%=_Uj7v_YD517X0a5aM0r~A+NrKe)$r%{w0De zB=}i~*Sjyo!}Qp?;HWPlzMjNQU`X2Ikc_&J_{5M*!_cgWki2K1Mfss6T_Ne~q1k7I z(A-yH`D9_$U7>Z4!wT}lu+PGpyTV#L!+xoS{eBnL{y4n*6|tTb-n$;&PZrVnETaBh z_-I%7$l1rDub-s4B7WutFp@>iKZ{&ci(Gmaxk41F=0|RHMQ*J};>e1@9;hkRuz_{vHi!_F7O2#8^W{s#lNY-0pMVgw6fgvet>_+t40vBJ<;QLk8W+gPcP zSm}aT8S*$ezPQ(bI9X_%yjPr}ZJb6(oMu5BkUSp57Y_i$YeD06yyC&O@x*@?CeBYpeZzj-hW?tVcY`@use6uh3h9pmLIw|QVmF{wN0rHNogoZ!FH!KZ=|%6rxH)4+X1Pa zwyE7Asl5fM{oSd98>z$Om=QkA7yvVFi zQN~nZT~ES$N?~yaMRD6yaW_TD$j{=gi{de+lJU*r zKJ}96_a!r-CA0h`i|VCw$t4T#OaB!Tkx1!EPwDQ@(*4lVy*FhC7bU0OrDuhu$30~i zo24hoWj7njuBS>#HOg+I%5Pnk;S0;}P?nQSmy=Ug&^45kU6wO2S3KG(r_!ikwyR(X zt6&wVAlls6QYtv?emp6v;7a+y-TOnN;fJVQ(L>wZ_v!^2M!A$d`uyK311>VZtyDgH zuN4|!NoG_fgUV3S$Vj=!SUt*r>s|GNG8ds<4YsR>gjE|95vrlR)v&Eta{ycA2FUmPZnrm*Q3!6q;wpRQH*p&X2k7 zeP~{(a$T-bUEp+GcyC?v(7j+-fffuJHl3fsUl%v6A1YPH*jgWPQTIKiAVcG4W>|eZ zWj*mUuDGE-Yx-x!<@*5H%Z!~A!2Z3&&PX-QNnuyQn%0V%{xvjB*)?rb zHt(b~?K3wWOg9~eH7^u3FQb|-FPly@ny;mrZ)g%)&U>40`m~S=w%}7*?p!tBlWw`+ z*Fw|SLZ;bDZQM!`-pcIL%F5EpDA@Y&s+C3h7n^h|cla;f;{RNxO!mJ7soI27e~H>R zBo!uo3aig#%9AQ?lkv&_c$_B}UKhO8rpQvK+}9?jnH%r+JF}=Qlkzvv{x_=VHzd3c zWZw?(X@`dYhWGt1bt-PR*lssB?y#ilcxT^X>(hbk>u_xBa4zm}+3xsY-04cy>1p5T z<-1~v3@Gjl-0u8n-1Uj7>x+F?h)-8UUsqHkQDD*)yWJII+#N^NooL^krQX%&MfZE+V1{t+>=e!lW*Ts;L}smNBD22R#Dtjx!v=_xVMU`x6Zz|-lrGa*W29K z+uGOWve|Y_*-qlqhqOxS_NjX%_>&Ngbs+8U-tO~*we_*o=NI+=kZPP@`6V{A}6!fwP%`3;V%y|CSpRTi zhB`-{O$ zmLaEWBc|(1rW^XFvAF4G>X}xdnKs}|J95SvIQbnt+1WqSkDD2!o*fpN9RbdcA!o-U zW+zK#r~7ATakKN(bBjWAOTf7mcWnVluM zd&}~|%Zggd$_~q_k;{P6WsL#iA;>c5-inU!3Rr6e;;>>6xdJU+feoy{cUBPhR?UQ0 zEwomx99C^2S8dtmZj`PfcUB$mtvL&?xoEAqIjng^u6dQNp$68RWS7wQ)&qps1GUzJ z9M*#)*F#Fz!v@wPcGjcrZG08ph}GJNci2dX+(;_jNEz6`>};gp+sqW+%+lJ-aoEg@ z+$<>FEE*temh5bnUC-jFw<@)^svWj!Be&{Hw;Bevusd7LO$&baw%fF}+a0z$Be%Ot zw|fV+`**en@8O1paU)u|F$dguByO@4H$8xx-NDV@+gT*a6SQ_#9Cp?scQ#6Q)P%RT zc6N5}?d}Wj9%}6#JM5lD?kWmzpAYQfcZgPmJ$52>1nrR$-`S(~$jkO92luFV_h@ML zX+`$wK>G}i`;Vgb8O!#+%j_}l?z7VzaEcsofeyGG4|t;v_{t6h1`mWBM_G3dL`4q8 zL5DAhLzAe(*JX!NgNHK2mrfoP6(M2^9rV~8W+ z*dXc{T6X-8`Vh8zjG#F&6FIQ}ome@Z*hHP!614+^C&=9sN19V-ky97Yshi`eN7SiT z*(qx96uo=uM{^b+au&#b2nU@7N1cU~orMjaMeLqM(VTx3IgbUM$2*??Ck!Y%PZ>PN z?4GC7Tx5z|WPvVnh_4t?7X@V(UD%6~-HS4s%LMpzL9lYvqKKs0TH7tT30pZ6S@#9hW$uj)(AbxfiKTmVLD0007 zx?XX-UW>ZkD7)SoyvFTb@6KNj(GU(ngkwj-X%ykSjBq(fz|-6(y-m3H)Np8lcniTG zY&kKssQ87JTPxde_@8n(;|qu7iQy&HXinwGr_evkfH*!#spaIK6^%qutAT9j$SN@P zwcF0}&h}RZ z^APjb=&SSN-L?67g5M1idZ)JuN?dzyZ`0{H$=_ji-IFKdigQw+5UAQyAg=PA6z@qL z?J3?@q<2<&K)fhWq6h0aD?fy}?khjGh;vq9va8xxVR0FCR%JsS?W=MG(tl8U5+-q= z_B2-SLw5j`*4DG6q^^IM|+zd=mIDQ>OVD%S$ zv#=K@hL*7qcc^vB%5g$)hMT+5`=aU-Bm2rRcbG%N@d?bSjbU7d1jcx3>^cJRfV)q- zox(kr;yvd6`RAOP_#BRTAbc;6PZ9nk4?RskQocMh{Y0nlY4(}f{mkqO*Edh|P=T5= z^KkLMo)(c(C$9uiau2;MV>Di#TgHL)y{x{$+|R8NExvhKC)?GWTc^7G^|DDrot)cb z1U~eB_dV?8RAF?KzPD{|iu;9ae%3ed_k~3@7w?NJ|9ab%Hk@48mA5@a+5hN$d1+rY zqL0Gq#ac@#n$LejIsDwJxpZhe{EKpIx;(jbB(#t`@^Sh_DS74eo6f+;xr5o`%DGF< zMe0M3Ky7Mgx5&7U%YfABmCKOgBed%u4N1J~DA)k)_7~=Xcbl+CK)VZy=i%LnJ6p8J z9E!N9T?l;S>-jHC^4fDb*1*?mHO1rFYdtH$_d)@gckR7hIqr+vX*j(`?X^Af^Ev31 zB={VS82F)2racJgv!#UjS6gefglmVbPCw$E{weV%@Q$`W$y3vt)Sho|^JoW9TAGru zp1mbganiboH6<1Dl&7-R4rE?7y(@Dje}A)-n)9g{InYyqK36+Pz|xEoe)eli`~GL~ zY%^-4ry|R$cCgg484dbOk>ife7saRM1lkBsrKdbPAsX52beJ=xXDT|O;B0e-5>I78 zYn?FIviT$Iney|`I^h;iEf|NNDvIaoMA%tcFwdT;yz0=2bjh}0#d)equj)jhmMz%v zXPw_OX`=(5T5?i*sVVX3ewEW~dBS?Grlz7B6PsHC;N3yM7lz0K{t-&eN%hrBhD+4J6v(AB*UMUn>S7*b9-Wz}!B+EWS ziY>V9p#4)UVk)q2Xfn+QKJlh z^ZZqFh1grLUK)0(=>Le#v9}UJLHn%rD^pg8Q(Dyh4qyE$L%Ys*K$OvFu6}h993W$O zIrV0kq^2?liA17^{{PPpYa3ROMDGJ^;f_IF8@GdV1j=}s$DqC!^35UX(s*6P;O9t= zgIfs-zHM#LFumg7fxVpl`RY;Q61SsQKg#4qDFb%P$`K`0U~<}F&~%vNh?e0txm-Uc5yqE&1JuzsJxY+fl_A$L}P}m{?b^6G9WlE-M=yMhC6eQ$hMrC8z#=PnjEOTXc zKiKd$7msuKGh=i5Ji~SYYv(ZdmHFdN!w&IW=Ln?FQdjEZPN`MrDD;&D$6aWbBGIoK z;bZxf*Xzd{{SUF2E6Zo9&>nE^hxig7D?uA*FHD##w*JcMc`&qZ!LIykkF>Q!9<<+1 z-`uR%Go~1joNm|H|~YGS{sH ziMBIdGa7GLbt^;T?My2T|F-hDS45zR&l#}EUTgPC4Bq~oDsyJrH}~oiG}7J%Ha)%S zUW>&eoq}OA_p?vx`q2VY%PtUVfL@eZDyu(?BFT7!*}+z<1x`O8(0W<1`}|E}=@ z39n}>wXYN73iBeRjb|I{wbK_><9~E{p6x=u&f((9i;QcYoif+X(ZR;cT)a=R0KOmM z@{CsqHB)Cj@aqqWoyM!;d0zcUUzgN1<25kyd;opzl5rQluE^^>9O3Jl%?sb~+CKk- zxpvK0g>QoMyvIs>-HL7CTUmA&{uMvn%7fwC7QCp*eqZ;hJUDJp>lb@NlY3n!e8(jZ zHH-80Xk3HuqSmB>=H@(FI#+fBczqVB{XBp3n(T+!_$-ObdUmRs9K`1NtO)se_1Tyl zrmRVKaL#)T1)CgY@uD|?e%_;bCdWm7`)g2w_e7`3No5{!CGCfrSu;5WxZ!uu1k}P^ z#914!?|y`z&oVE243-ero$}9T=`G@1r$EpWcK^?~17 z%*$?Qe#wvdc1P(g#ZxZQ;eWmcIw{VyLx+{N}l$J{l;T?y3r>z(((*~DR+(K zANj~X4wq+4m1ioJXQnTvZq?&6Sb@j>S8tCz zZ@2#Nl8;l*;q-%UP-l&Nsi#71V~j< zFILiMRMPBI0?sID`DCeWD``_H>#!*63Mzx8mGv~0AwFp!V`T#$Wy5e~XsWVNu`;Yt z**Gpqzfaj@TN!bsY)YkK#-d^_sAAz72bWf{GFGv+SF!O?c^9r?o2v4@G0L)7#lBAk zIiupRt>Sp4;zXtD{4~stMb$+qUO`&b%~;jlUe&`#)ib=4OF-4DSQXW%>eHu+o>BGP zR`pXNa+}hpSE|H>R-m-nCr!1W(Z_BuA_2zw`*ii)`Yn;A7SgB|-lrBpoTjL&Mqa74 zgsDZd0Ad6IvC@Dz&F-;7wRrpPpLBqPa6nQjAh{Tj(g;ZH0}K;vr7%|y6Sn~wROjpE z)6{G?)@*R<&F1Jk@$a*mx!pk@-c;OI-Kg0&qdBmxIe4WxBpCX+uh*Khf2dKlUmBR9 z4ji)wj{5*7!hzAznv)XjQ^mj;st14jfWUa6=t*V`b%6)33+bc0psaOESsiw~4hOX^C#&ugAzdzb8JmnQH(ZwosmqJjeHNk1XI1nRqbq>b73|j) zn$;D?>54?;@#A$xS;1mLU~w6+1Q7g!HTyXnEQtociU7aHfZvpWrAjhhV!<-AU|Aek z4iA1yttbBiBh9L(D5IwY)KiA*sUY=K3D_hB^k{8}9-u@|1FNUmuLqpf3(D5h!s}^M zLv&anxZs8)Afo823Zqvk(&;1c4u8A<;Ku)i)Q? zw~*1d1nOJ8poYQqZP5DfBJ^!B`tM8rsw4I7`t^~s`VKgKN4&lhTF0K+;DeBXi;RIQ z(7+9D@Q=m79c|zlVc>-^@Gdbx$pAdC2IyG>Uz~v--oT%F!nn^MK*%sq#_$u+FbHn= zIYQwh((p@!VF<=Bw8StBYdDKC44*ZO#2H564Wp@{U#s6lutH;Hpm9KGJRJHB3H26$ zCPYA!Fwo=@XbKjZN}!fV?1!e|py_yM2DMQp>lDQ_^t+5vHqa;sZj?(*^s)+Np^XYK zMujCtMOdTa{;A|pqY|7^8Q!Rz8dkvy`!UN?Dg>(n!m8o08YHY14SV|rR)>N8EP*v( zVU0vc3FNGwg*D@0EkvHkYWz!RW_1JB1~hJm8+Ra$JJH5nCCtAgjC)Fqd$GoS{l@*X zGZ9I~19;;hYWOfK{ErZPWQAc+20jLd|3$*b(eQ}~xEKIFSpuKN!e{#7v$OEIp!-ue z_yV=bBCE+iA(JH;leshaGTdYpX|jekS&uN;P^MhLm~3H9w);(RvnD$@ldyb~U24QW zffaEeggBHz43Q#^;D{3>;uMWIi$@PTY)Y19N>OS`*^-@cXCQHo$OCV1XV9pYBZK-|FN{7u#w=`c%*h){!3SwfV?_g!%o(uN1 zf~Hv+m0H1?tc+h~8xB~R>{ubLtxWG(o89>iXS24D{ZBGtWnyjJly2@|{VvklHqH8d PskPl_R$g+l8&dxRR#K}8 literal 0 HcmV?d00001 diff --git a/linux_networking/images/closed.png b/linux_networking/images/closed.png new file mode 100644 index 0000000000000000000000000000000000000000..f1d98ed8005fd9f728079966c6c0cbef16eb09dc GIT binary patch literal 18898 zcmeHvXIxX+`Yw(-I7-oxDsAl400N=I2qG#{6saK~K|mm(hYoQ@0Sy8=G$j-f0Vx4O z2^~f-pu~Vu10f(F2}ME;J>+h%%$(mn_rv{vy64>akYBR*UhiIOy?gDo-sgFrl?P@f zhTI2_9pvEP;J$q6!gUUgePrO1Z~!>L5vw=C3w-T!J#T!Tg98_TXv=XwaQutYrR&BV z93f{oIPToz;Mf38-I?UzKq_!>OyA_-(0IbZA?Te}drb?t@B_@q@B#-rI{sY~aP*V+ zB^y5u4k66WXU}Ei-9+Fdr~hSR1I|x}e&Rd{lARg_?s$oC`NH`dL4&hY&A26UZO%+( z>h(VNKQBC`$dn#hZq9ow_HpXhJ<@bF$}~=$At*Y;UP1pU53*7MbHS58=m~ zfs$a3I(^(8vKX5CPlg$sBOv;}s0cYJLNRPhD%Qi3Wsa(pu!QUDrhCOzZM)qmp<4!P zhR;j!QJjK@p*b_1s)4JzM-LDzRgBG3p8656sAS3j5~n>^Yz;T>Zc@X|c(V5HJy+Ej zT-6Z{L;AZ$SmO-ZtXkb|f@dUz9;KrZ9Z<2x<>+Sq-Yy>~G#OE^qLM@Go-O{ITXxk{ zGub)pRG_n%rE_$dIHs(Q>BY3s#gXj?o-1gex#Q>T;7OYAd_D@?YFjq*o{v?bO)V%G z1sU)aqfIsL8S)S(N7{vVCuUK|dZ=~V0uTcBDrfbM;m!Mm49vl1U zQ$3NyF^t9BND*2;?5+$kU%jVlTjh?a8b9Teo#1c@RFUK~b&mb0Gf0!yfV^f&$Tt>X zGvyP(9gi}4YTo;Xiw{qSI(Q>jy)_3{9N^oit05Ta@sr^abINXGpGNTLp#BlwX7(*M zgEq!SWKT1-iQPhsU@R&)@|Yq} zj32GFP6X-$n2mN*LJ)}Kg7%Q#J{Vdvg}`xFVZ`F95o z8VKwBA#n{(o$5g1_B)NZx-BPLT6X_gcc3Qd&)D3xsbq@}Feybg&F&2I=LJc)lMNS< zQSmO&R&cnTC4C!rbw(1eSs_62uU#r455mG-ZMREYjZ(y#8g!(G^kn02^|O zjVCy7+0pBc!-$shI3c(E2E2ior>u{c(nrs3*F)ghF`EZkjdA?M+y~WHuHZ&Ti?Y(k zJ{%i;AM1^3N9(}73v(YWYYlN3mXnZuX>p(5LDRvn*M#+&xQo+(W-oi<*0X}i^nsdL zFup?ggw6%v7HN8+S3MFV{ha&LY(XA8KG;*kp9_LG-du+>eG?PB&eM6I>5;0zI}Naf z_xkE0ZVM5sIrC$)t0uTX;aTK)?~W|(*GV6w(l45|8oMtj-_t5i6fF;`!06YZEa4W$LK%r#_9_uneSg>yul z`Jc~*xtskGZ2G5o6m=u-)yWh34i91Gto1ol!EIJ2gnc1M`PL-y8vMC#L}=|IMWSl^ z>Adxu_x;&qWmN0cZOY}Vr{}8H_MN+R2iAQLc^|dK@;ZxR8(Jq+Gfg86^`f}U;D4YZ zuWrxkT{;axEjZqK^8?|`ddu1Qxs$6Zv6&J*vibyLv2!$P@y3kbSw&_ z#j|_5p06EM`rE$DU!!D!JEiEYj~qCy^Bb4VGxDi>KTGcxIeg{in@9W6#(I)jC-em* z!9Qi)L;q9YA3yvv9{zbRc4n6UwD}<XPv-S8epM3Nlgd!O>0P%S`#G0NSXWYB-Ha~mo-RQ!wE?rHImj{8gOIA^~ zu(Ry3pkBghA4GE()Jfwtu!-QT?6Lm!!(O-Al)aA3aZwO(^I+S@%+)$?CEiFi3%Y9u zRNNEKN4dLGR~}3xJcX%0KBTbzhx?{aoI`Chzu%yEibQz#1O?^+?PIcDO_;-5o_m=3 zS+PE-W|f?G2n_DO6$cAF%qMcA3WTq>S zAViq{gtzxFBYLmikM!K&_O5Xs-%%b%sr`hNUjTP_Lg8nP;RWvLzPJ?SL*^JWYo9CS zQus4*Z%?4uPh2KVG!NF!_wsHw&!WFqID4NIUt)JHFP3eDi#4`Lp12OTNxN>xhmlCF zDSJT0C)?cC83}Yge9>*ZtSIWcSxh>o6F>Oggk!8y(ltSbs|PM8xMgsH#zEC#I7n_F za7aql%^)p?sB_6=_Ks@`VM}pHaVwA$&KQJ+*4}^{q-EC&;eyTSn+hWW5D7Ha;a;rg zL$dfm!jHWT{1^#5VRjq$FwSkpx`~exY`nCQSm0R)mD6Gd4KF80c`H%K;+#NHZGH%p zCy&!f80m&O-yi@HYKR>r=962e53fq{HSVb*fI*sEwe71;87tT_tL1B7h6oxNi<4+B zzBjHcQLbQJXgADjPD_;%ZKa_VJ;8;oXX>=#u-?%T8MZ0Lf&_sm*Iu=CXC&@tV#fHF zTCp*+MGr#_QXr0zJt*Tm-X15l%4a^&LA3M1KD6^s=E5p2+1(!0s*?2(D~u$V!Fhj& z-JQk@Ph-kERNv#Ih#F#l20V=Cvd~J-_DIEfZRBfqj|?ead?pmZ29mu|iq{Uu~tG^)3TJCE{o<}rAM%YMaOJ}{9IR739KMsqja z*)>`4#gQtBc~4<2@;gBoU~nC7E+COdo_FKJ+%t=K(3M1jLEuXtY8*3U(A=2@yZ0cA zGJLMVvleJIK%{M>`i1CcgK!;FbdAxppbi+r5&1Lm;z>kxnZnvSpM?1dYfCY z_w7R9<<80(DH$hkI~&epQv)Htm=)127TUG zE}Ni_Fk=77eH&)igM&)7{g=`L&fF+oWSexv;tHBWBbw~^T&3{mIus=ejt}v2-s9>p zcD#33B0ixzm~4I?_v)Z<+5De`fIs5G3;Lu4LobhCRyUR`Qp*|OgB)$U^|%RjRmne3 zY(I3Z*6wK0bMno|-5M!zw!+;lSwE{9k4vaTBveMV_x9WrQ=!+UD-amBZ#XMg68 z6h3#$QJz2(o6#z^YlUI#Z0r2<$!ImhU`5zcZpW%)qa0p`57Kl%geru4B_Lc@nhlF_ z6|gkIiFNnkBBbz3sWhgP1vQ|~HfVaGeoBse)CG@wbr>j^04pSpF5i^R2F=R9?1vr7 zu2KwB=cibUjfqD#tA50jTb-lNTdhaD>u$7IK{s>lddRZK<00#Cz-iIE^(T?9Y$p~Y z4)jZ=H9NwKg~naV-Qi`#aq_{yNqRoFgm9T0UO}s{^{sqiOp^7AXxoqax85}G6{Oe% z*FNv}%@<*-r0bZ)kM{iDDmM0%bAs@c)3I^s!wH`(x22)7B4m+(z*m=*68cnK)4iTK znI|JP?#v2F2p0s&8ulwYjVzmos>vGuraV*g+{r4%S@T_)DB&w39!gF`|#W>bp=el`2D(uO&u`$ zcfnugQU(9lgObR_pVl6Yu-8WTFna(Xh&!*38vqIwUHs@*Y#VEF?c~nPGzR=eoY4pG zAfwlGyUM|kolKL$o-K|rLo~W6o5AO$_U7nN0_XCk^mFr7C#zz@f4FQlyF?zO| zZ}3x_jg9s3S@TW8SyEP#Jw%R_;$zd;XED2|4*I1NnnIH@HMXpE0R!;{5dAl5>bJP{ zdbhV&yF=jHk9{>rmLv?w9bFZJ4KP?cSF2@2grpYxBFjN{VWE5g+!#sEI>Sx)JqrVh z!BY9G#H>yemxf-=5NK^7=5~7F_nqn$Nz+YS<7L;c;Iz2_pUic&xrYtK!!!M8RE&L60D$)X}q!KyV)J7u7m*zTX*#*vP#fn5z*V9eQKo zmpGC*X(kII*y<84S*cYN?Bc_bVriD=9}No?`qC3;Rr*`N$kM#LGOQIW${6h$6)yo+ z@4ku}o6}b&d5vFzSFx3VNc%|l5ADaXRDPvM^ zTEAV3*`x2yW!Rad6Z2wVOU?n(Y3JZdnte0F_Y@h-utIY4Th9ENgQ_nqwXh_-&+4A9 zRcPx+61&Z0#R@_J6j7PMcZ|nr#;IElLhagv@Z!gm;Brdb1tE(5lVztt-`l0FA5Nnb z%wSHWpPq=pnzmN6&xsBlIonFwj+o98iz>FS!d0@|Ywf)&88S>{Q1D=L*$-F0K-{^` z_hv=(XVIP-UYs$8fuhNpGjFhVd6teYtE~&-j(6~BjEs&F)0T=;89$qTF@fBgB#X8) zUs58pBb;h7)AQQDmJwp81eE1A~;j)RE{Dha3ZmJ}9@p zF-?UXie5H@SD!w2YqS`RDCb}?LjGYx`}$C;qU;NGi7@l4`?NY*H zj{+r^>LZ5xLkR&J7n{(#3-AyM7wg8qwEot4;rHNdi7KW~PR0G1qNx+FXI!rXT?qx6 z2IZ%O^p1K$;Ew5jVfo}SPT_#8p5`lV8&}gOoKCj7&Xn+pFm_sJMZl{|I+?>GWCMco z$s685hWt@}oFi^+6>kv({iSy9>97{+NqqrE0oh(07s=YwmQw8Z$9i;mY1=bqcUNBc zdLIAizId%!oo8h4)tzog;{~g5B*z@3OnXUud$0bGlfqh3S4Gn^4S-&NqPYX(f%y48 z46}8Rc8JhdQ*Tt5_S7hIMJ2r>w_uF1_j`dubkm7WjN3svxBqCe18=NBUxv=Dv*Azn z5u)l0qhz%%;v$dgIo!^Lt@HJJ8;_}}JD92;=q?D1K}>Hp##)6*&>X(TelN(apL1N? z`@5-zf}FQ0rg{(WRt2K5C{}@l#D(4PknxfX0zKDhCFaEEdAyLo2!j4#xM~!4a+iCR z;B+Dh=_N(mUEM89otuuRFN}J1HZ1hQzmV>chSGSGrq&HX*|8sXBh8=}FpuH-H>-hi zf1Rk){}-Eo3t0bQ^8c$77EOlT539D1ynFN|q>iY}lBLk&HTp+3IFP9sKQ`9Briz*@CwQ{{>|*StOY7Ro zKr?_4qtpJR{+S(cuyx(sw*MXM?)nEv5d3zkHC!M6w`&NY^hh6w@El*>PaTy5Wxv;I zeydSB&|uucXZ3vLfadh?=?tOMU$RkKR}2Hk3|*PdxCs!2?q>0=_|&5x;l_Rk>Ual9 zQU@X|{H4K#xuIWi&w6BQw`XUN$ARdG*Wm}8hGaCV!#$mWNoluzdZgg{0S5}Ra)_J3 z($GrLHhkx}-`ht&?Rw5kTv}E=%F#Ac-Kx6UO>S0Q?X$0v$X70>U%1^@jjEmq4Lap# za8&$iLau&IOVYLf;yl{hHof(J6sygPz1pWM&EO-r04ag6UlLKQh0O#*+^91j2AGl- z?Ilwzv&r+)XcCa03|2}+ZPVFd8UR;y?#mhNL_zFD+^EHu(pMzeBPe_Pv9IL;Ch|FX z2f|t!WPSM&ApWZXZU?7|GWPKAR_T2QbYs`JS<1rf8vLI;Ti&Ubtru8*rJ4`#IJj*hgPtMn%khLVWgv3)hmbg^{JsFF%QD(y1M zrKY%kBSSxZle2E%7yypB&ne?`{A>nZ`+AHSEoxz<$7I~YZA_r`nUxE}g(Wos(Dn~C zJx>$-X3yo=yGXYr42Mu7(lPuH=|Vbz#s)dn`&fs<-KwShil20vh7^)(=O3{9c|~EDua2i3*gytEhre zmWegwMYnY*W@ey!gus?63>trQF)&@GY@*@j(y2h!vN}s{#w}wSIqw<`)Im}DG_u0m z=$q>_S~glhjx)+Kj!=6XX?44a>wIm+AIy!L#~oUo*KMtc#FD_^#$xxRyfZQmVbq8$ z2tNe3EtbKG0^mo)o1_paBV(&-ylnxa0XEacPFV1Li1-btpiW6S&5}D$>tPO_K$DQl z>xPf^224NC4XPtgSLmqhqJR6*q(Tf*SoayZ9ci&O;6={;%>%$HJkFcS&zUHCzG)=V3DWwFj{#o;F|Oou2R zYW?z2G%5ZaS`gJT!F#w$jd8SbG1g-4LKiaCBrS9;$p=?moM$wREa#gkLJT|QSY zG{wue!MfpI@G29^>+nM4f{1KM`SK3>K_yBZLgATn z+c=m^3Kkjlh4WbNB?7sZiK*L>!PG%00s4Y9g)6XmXhqb1ZPEYE*eNW@((T$p9ajHg z13zV>Y7$Qn=u>Y?iD;=V8;;a9TJw9c8arXCqys^PXOlHr!a+a=r@*V@eUSEKtt_5I zl!{ZJNr|dY*jW;+hF#)m%=g$sPUSlFK})4HVZ#%|gYL(YKbMffnt`goK=Y0U?yR#V zS75fx$!^okEpxzM$PJ9-<;Tn!ZaVo(?b0-PC$R!41iXzgsjt6}9Mz(2r!h3%djuki z>~Y+aRDwH>@P*iyTDVsLEhe7C&(}#fY;Y^Fy#=-(Vl$I3R&2W&Oij3%(>4j$rly`V?!K`fu;Te43@Uehs)W5JPat+oSis_G`;P5md2fx43DboY^40o#4F_WkDY6wT0J=^L8u#3Ekd0hsB z5vs%W9`CW~Grz)+vRFAgaAv2anORxZ4&qsu4$7;s4`R_19U8te{rMJ8fMwmZQ-q&9OX zZM7x!Igna6h>9a+*~Qn+nwBK{qi##G@KX`xKH>F-L5P5loHC? zm01({H^qvLiyaa2%Ik7Km;a_DV`PzQeX|>TPecH7`Lv^w^3bHg>hV=GI4L0JQwf5> z{@q~fJ5AH{A%>w3ScsEbqJ9p%`(F*`{*l@JBRBjX$g1APb5D>nA1-O#L%ER9)%s2_madSZH)D~6dbC#r)GAiL<_A5Xn=lF9-Z4+r8h?gZDE>2;VU=YDBY}e0n#tvqoQN zkf5G>4v{O9TmAaPaK33wy07kA-L6(IpEqNlKz$Y=FrV!swbk#nmfa`3T-?TL$RUCD zec|hW-Bt>(7(?;_;osJj_V=Wi2)R2){7NV09Lodg48P9Ma4AMtmAf1(?72r&eVZ3t zG=9=KZO9p9blM{JE^4y6V>-pk*jy}muq}zY%-un-BuM1@4Ft{TQY*hZaxn>ZNRvM| z1_3vCS=`s__zU=+?2zfCq0Lh@uZn!ln>4NohCBZw7ndTi2tZVsjFrn|>2lA^}nC!ro2i&= zb9uuDD28!aVSoyy-2spb9EZ=e`;H(I*d>}4X5?f2UV>e+GtVe!cOogv*X^-^G+vQ) zcwnk7tu5HkAs6c-NB~E+p=k`u3n=gJgTl%{|8y@X6CWLVt78Pabu@02mP?+lK6+Cz zExB3>-&|Ago*Dy_F~`a2-h)0J5CV;`5BT8%s~k|vfnV>JrI2%#Yq*h> z@I1|MOoeJdacacXqi0v^$y?GM0VsX^Ur#m`wzOJC>UqmgTsUShWKk*y*5x`R(oj3g z6YYl+b4rPI)~di>Jx!M7^cQVz?B5!?UMbUBkxz;j(quzD1RH1a$x;4k(V1(pbnUQr z-(RtHOI$2*v?``KGCeEnkFoYofNaA1S6eIRsh1R23OP&{&zWKY@(RD^ylsSwYq9IQ zH|}k^`9t$+(TrADoqRF~Z1lY%!RWRWL<~aQ zSI|h>#FTynj>aA`UpoHz{bv!uRN3?w9|d~}bOb0)`CdcDz;P~0v&rv8htB?@jA?jI ztT`B{dULbp+q)@WQjNEdM^F_;yz)$l;|uMGyqYfaEo!k?-vDhLCN&J`Mk?M4QnWxz zt+msb!nkP)Q|q43)1G*rEMlhy(>O5NFm!8Z_YvJ&tWy@;6izFB5&Dg@gaRU@A9ut8 zBayHc*BvdvI<$5%jAPJjc%+f!08sWj=l<`N15MAp+RJP@(hl}N84{w@%JLcqW>iT7 zVyT|`Vl5G!EhUV)^L_a_6#m%~n_wwIJ zL*)^VXwON^3Fz|p^XKj(w-LI_$bgON5%$?2^RG zDmlEjbM_5ueVjeN7AfqZYN}>^YHHk9xmbCbzXjM!qi5V1$4}=qGO=RofHFJj7!aR0 zAu1ji+4mL`T4(8>_ETU+GI^J4`w$U6ikH#c61%dnvtlLk?{HH17+$RV*nTAIPdTr+ z?kPp!vi^>0>}+p8wL+>qrtk=I$|Py!aW1dV$Y*})wU)2ijEF7>As{S^Oq;TvnBf#t z1wnY73cXk{VPap1g?3YSXu$fP6Za8y(jkM772=^A&zvj`7Ow45%GaC17z=MbG!jVo|AKu+&W%+h_~^VgJZ(7c=%5#% zZ=UIHg=yb%TEDs0E6V9UYChD0nz~V-F(liv*HLwH<;^ve@@;S zye-VbkSs(}265>A%}c9N;4olq4Fs^YilN6*Nc@sX0l6; zzKsTGTZtxJZPo~c{jwSe3U*l92uY_x?Q8HL?p;c?{%E@{dkLij#O?JDVda2Warodw zZZB|z-aWGCo^UP%N`E0>>wj)%BYWNdER+NT!k$l+X4^BF>`ttMe9+-9H@_&!M%J8b zFOamqxJ%u7Mf=ue0o!?qUks>b+v}NZKn5uHrTAmBTzvq-eyv$Y=*kF!UCWF|Yknbq z|Lc-o3>|%Q-S7>maV+XK+SqqB>ov75JnBln-H=2&(KIlQQ?Ms%Xy{^1upY{1)mkuO zPjtW#C{)@G95xPYn@SkcNeuF@>U@vHsWeu_5oe|St&=u$ryb<+3faKF!$t?`UjkRQQ6m7=?W z1>m`xr^FSlT8isrL4igJZ%59odn`bsIoZd_cg$86s}(o&XZ#o%!K$#OuQc?9&;7kY z78Xen%NEt(;T4Y@7R4{L#tR$fR=ijr7ot_{heDNHgQrrWe~xFY2-g-BC>E&%5E*x+ zPMwK5bEl3{6X0TRK-AZy2w=yrx#uMu+ZgK;r+c zi_d{BMve~nP{ThOdO_8O#+9c-BD^m(YI(&K=JXQ-Y{oMX$x4QQH#nG*^cy5V;*@!W zhRbR#c`H!?b)?X%et5tv>aLD^fVkF^uU#Cp?Df{!r#jNnomo2tFmowwpIzwr=BU)V zEk+Aj5=@%ae_$B6$%QB^u-%l6Ylw2u4k7WrE1>&@Mwia~GC3Y`R~q{^Blks3%TE>~ zp&OEfGd1Co3zMFiS;iK|18&^PY2hE|1g7l$j`?Y8s=a`C(i~S`J*n~4#;bn5VNDb7 z3O+Cbr1!p#mPaL}I!|ktbnXUq^R}RKCE}U+fMfxyp6;$vwcsMMA|M)%%m8;`{TwpR zdc}V?GYcNP(kD2Bo)876R8HMntJs53BZUWhzX|zcQX@#yg{U+gQ&TsmJ$d&plm4RZ zrd(k#Z=jzVdE6}7S=&>5`17hL#zphA_-8QE*hW0Lt<$fHVnYI8#g4bWu7LkGb?s>h zC#{@oX=sAva+-#k6!`x>AR~BkSoAWvIP_)o#IeBMiC{!SC{p;`Zgk)sNC?o7J`_USw7A=?!P0@m|9#o>b4ES|d$HC%`obDs{+iSX>>h9dB6D7EkwF*M!x!B@_3C#oXF?fNK;h0PA-9&sD=oF) zSMj)ui4Tkk1N@J<1Y2F1M*~WZf-9OF zfO9&U67noM-f=IyE|~HMTkr=;n8D*+yloo9iIbt&ONO=*W8m&(l%H$E#i*-8jyTd& z)$kYOu-K&hH$2-HCCgTpul?LY%TeeAgkmr4REp0M({+VzwYRk2-fF6;+DS_@aO492 zxE@BcAjmF*IaJQ>CEgK4^WaqDt_=bgo9Cpq5fskU znI)LU=W3E#*P547X5UTSe$=Rr3SsimbRB%CG>$!b>x9MmZ6#+Q-;D~NgiTG4VU3T* zKj5Y@VT%+q!rx~E_(tE=GU1$q>vY3-zoq@V7V59b zLB-VrZ3NHq`J}uGnK!9XFQ6}cizstiru2iFH(aViEErquZfX|Fhm7$8l*GKv&D|}i zK-VH$XQf>PjNk<++yyCC{gmFnQu?rfA7h!LFHOnUS8fv1be)M^tV&Dx)Fa}PpG7Pb@zh0DFpZBV9{1G^A7JiE1qqP z69y9Fd?Lzx7;dz2v->_BdO@!>zlz?j02}!2a_$x|F(1AX)?rady7gukVXdW|<$2E% z_@d)h%b5=SpCPM%RNXuKum3~E>+9;{%dM|R7d>@{H}Y8GUk6;Kcabk0T@W)tvnx;U zOM2=D(k+?*-xzI_ajF3}OJ>r~4NFdYN|3&y@pVV@$?Ow77DpKNd=#NvXI$yDbtv=+ zR(k91?A8_B{$4C9zvSDie$9NetOF&M+G8k4u#}Ai^ATH|-F4ZgRPVuLs$!(asW{EG zBh=+rUZ}ROBVKpz{Fn6mFe-Q3WKArqAj2zwMtXXN;zE6#M6{>(lY#98#Tj*%7o4~MLme% zRxXKm8sQ^?@y{K&7s3h~b?0n@{CC|PES1RqB~jj%ckq7R!w&jMwdMvVym-gsi|%=w z>pqQIKQ#`e?aQ3KS$}b7$H>mV5O|rIvg?_h$dpz*h*)5Z=}t`u3YQwYqMDA5>TtWET5UoL-AkoM5v8@+p9#g?LhYX z%&P60d9~e#uoQY}g2q~zJD$)qvXR$(^0@wwK>Y2{w0>BJ6_47gnv`Il9NL^Mfv|4` zox1gggK%cU>gq(F7XU&#@3rYgHHs5*H)d9eSGPMt<#Zl!g{z~DSLqV$tyO|9`zA&{ zVvq0!?Ejy?*7-Mo7SzG!HImz79~PwI1^ma+X@3K2|67j!&Kgd>&cGMPIfZiya*B#_ z3hFl$R5g@TG?c+I3JMwu3Q@o6&;5%5!t0isOYr~MU{!3>95CRxY+!PsSnuZV{|hIY BAA=@g+UqxeJ{TS0{?~PXb#ZZVkNo3{9k=&W z_D1b>acL$kwa6R*N3BATnaY2xSapN#l_?(IzQ>+axTEdW%{IxOUMlum(^L7 zorfTf7w?@q5b>3Zok)7lc07HQ^>u8ni_03a^I8^p?oyef&@C@AYM+Oi~rQh>&m84N*sM|0)%MoOz8gZ&2*{wsY!Kccosvr-~ON!l)t;DUNba#T19WyGnYa z%2~P36+V+&mXZ_I-$?fE(PSv=(T~wk^+bL7-EhL=WQiZzDzg44Sg`)S()4eNJ!rA+ zVgG`f15ow_Pv*WtjQJ4>z7k0hyXrzwif&7v06d9ZG86)BxJ(lPE)wB@jVeLvP?QOD zliB(Kd?uzWMK>hl6#~g>7b?4E=p6S51#O;wbuLtKL8;%;7ifQ``S?1JzUd;m0m6aR z`Gxek@|{}N1ByN8j;fAOWZk)n3n_*zeRQvAaTl|k%D%pfOls?MrO9K;sG#S1jXv4D zFg!eAI@IUt?<|}9Lov{ROYbiPHmVyN445j|G2nGCu0*qV=w>ToBt*SYJ@C+=dB{vH zJkPHoSF^V9H6UEX>#NWRKoX?BaDk_9dOSMS2BAh0jObmd1}b4QzfmNr0yM;}0H0Q$QVW?cD~S(|QwJ4C1_M1DZ^Z>_ zizj7I{*wFoXSFom+-*mNjTOX&xnWN3?wM8U(NLnBWI##PSqS|~dGiaT#GCM_3cgXe z$pCq%6uBXA&Mz$GZ%yAtS-g3fFX@==G`4tD`{xgP&%wabFb_#sH3no?`#9?5%>>ff zloJvVUjp1{m7X7G5Z@wKs1_LiAgO_dM)>TgZDwQXkbdcPJq85pf<=HVxWHOp%d}V`HR-Z@?8XsS0 z>+0%xvgh0C*JpM(Fc4;o61=tf_+8~%Iwm26o*5C!)z5OwOpFk59_#CH5A8{L`T(}L z2Ue(@I8KRScC@B4y7bb*96tB3cRrGg{w}bin?9YBn>Hw&zSXKUL*f&@sX65R+Hf3R zrwnZyZh(Lj*mtWUkZAGDZkG7m9PN*K2u4e)w)2Ph_WZ?G*;-tudpx)k>q+6}26`(! zH`3*WfXSz3C?7VQgU#WKm&&U9a#!0e27j={3Spatat-d!5tWxl_{KTDhdD@NsO-lq{3YRK=kxd_+qk;BAXNHxpXK18M7BDej zMF+BQfCGa9qo#%PmTgl=8*LgPy2&z`{w%P$=KN8AK5Xo)O?@ed%+LDe*G-AxAJGyh z)#jfq3VE9CC1UX-lV1VHSa4f+;abXGw4;u=Don}#-G|C2#D(KCQ z*iti!5w}^pRRZm#N;5j*2q`aow>^&KPoP9Pw1tcAhBXRNTy;)ir*%?Y&<(Brw-Dq} zUcWJ5swq~#8s$INiLdG}FihH6uqRFn$)iyvLPADo@4TT|rMEtQf!w{Ug~cj_Wv ztg2O?&MzF@CM`h?FnL6MbvxKzFddiWbbBZ6bh40hD+WQ<8|uhyz7H1p`m{bk+`!h<*8@@oH=+Lz|z*KM| z>DA?k9bDt|tCu@Gjd`Upp@-9mQ7W>gvd$_B$5U?pH-yrH#_t_(d$8EC$K7owS3i*z zVP5RsBrtGlwZPOr_G=fu8?@CyP(&LYh2n;N?hL)#O33>{F9}`-W_FCW_*CO~{5Yo2 zI#!y=bj1gr7z6*UpB#y}ZOm^|=EYIa@4pH&hyUP=-t9x+J1ri^$>`;&!^o35#ac;r z427Z2%5Pb-;-_uHLekPf3M;%+sn# z3*bcg#bWTIRb);!vvb4Qv3O8o5rJKy+&wkSWyt66DQ(>XwFp1_-Yc+QRGS&V#84Ij z&KBGsD}Cf}FR`h;@{5ELx6LZ8*MzjAwKbG*dinFZLIOlPtywd102sjBBeYv}f8w;p zi&1REvRDv(GRElsi|$yZLE5tp4@+l_lz@R_d}Y1(SiLw$BAw~n!Z#XP+f-CmlGr)? z=5E<%$zN+zV6~P%7fF`91qwSqk2&a#|3D#&Q(wI(lA3$_IJDakY(4oo!G7~5m0%eV zIzd?~RU7!$`6`ri7W~T>*54bdZE_g9^Qm)zN8*ec1(j{J(8vdzuD%|w7>vUHhg5&y zKc%>Eha`*e(i&@RWPH23_(x4wc@(BCBy4is=|1|by;Kh}`I`oV^1yxC!_lQk7K)MI ziCnl{KfkG5nU&g~Jsef0Y~9R15Q`~YIF>Scj*F5Mj)B=GgUw0>*sv~ygbj>?rM9h9 zD{)!v z*XD*9?l=3?^yRvSw$W_P7HtUlB>K zh{(&n|KvC8>u6IkTv$DQgj`vV^rk#3 z=6+m;2sRK*Dmt~uU9JAj09J`O*NjU8HlMgXMb!r9Km2}QA}z?e)X4mHf#Q96tJSyHY`l+T6|-^(6g090b>#S{D$olCGNLMwaN!>9_^yJ)sKOFC@Aei?|p+pl}5QLNB%X4M7jQ_+s5F-!~A z*6!0jOlvSZl;Kf3Bgy zH0!$p%>PS6k9mwyN+y0yqlz=m6~uuM1%c_L^&#<~Vzkz%Sfgl4Q(obQ4#SIwYjpEr zqJ@DBt4*|$sHJ*JV7d&v?k9T`p~YQH)O5A+YIE^>7Y@{b`*Lql`2KLblJ>h@6Fdf+ z_;Mn6X)xHaoAX!iHcorrN6du-+ms28F5_9(D~#K>@Rz5vT}{mDI^{${lm2X_HnrAR zZTlgqPn&d@vU(V&JNZWXwi{xe6%mydpiIfV1M$zWN6Zo>2?T|;1rBx9WOv)-hz-+3 z$-&G2=eNeU2v#M*vS^2y9%v%Bz%OdLtSTiNH?;*Mr9wV}6#xUHhrIDuH5)816h@`p zV8?bG_GZC>Px0d#>>nkX`QoxoGB-cI-E1I@UO?P|IFHa2kxP4d^5IqNTMoT;1&~{G z6S2>sGO6k6I9g?QmQE@F?brXbE$=J64Y?wvysmKC{+It4ymR0k0`CxbhrquO0m{)P zDVWvWq|*O9ch0iZjpt!*VpJe|0){t7I63*i9u4a$nvDVyes5FNNfT}v7veEuiveGO z;?Zq3w=ejr7|QAZRVUKWfA?pwG|7Afaa}1Sv}v;LLilqpqK=5)kc;hIU?~S%h);jn zU(u(%=+OyN0C*k}nCz4r5uzb1D;0Ga#v&Sbd7!uoEHu6Z_KIn2A=9Ge)aT66>8399 zNhp|f+r;;Ro+RM-rv=J4Dow_!(q~H_ar;k&#LxE7Izk#!O0}5K%sRRv(U*@OL==C| z?DFR)?jkpG>sfLA%x4oz{of<_n@ShhlY8+$xQnYbkZ!>p_WfPVr-`GxiUmflVW%p& z0yN$l_lV_6|nY(t_+K>F45|}OhsJ;Vk)B`T|vH*QqQo~^k?<9#MfH$kLBeK znZME>Jr!uY>yeC^cg>hwR;HZl9|O&%Lb%vYPuL=?Ma{+FS5lxGIGN>YTi%`rd)i2& zm#Jy`ImOi07tkExwYIs;&NJq8tTb2=dl^wEA}DkwlfGc{e)9wFkvl5PBrVZAMpfgN zZlHglrw&0HE2y%1IMKfo=GckInm2hAysrSzJX`sgd>;>&Y6q;|1$4q$9^{>!gM#peXlA5`fn7R(B_qqCeZFEH2vMMWhFb z7F?*}=OGo!mdXUz;1fF8vSOwo-PFWnCJ@3&w;}M^JddlO*frajVG}@TW|5$kDT^qC zjznD3YEBaF@-Z#F^r^TLCa?}bsTRk}s}t(H^111J&@f;@g|qgmBG9S*F( ztx~FVniCZCkjQLGx~=`Jil9s!Gc0I43jU%1a>&RXwv*AKsEU4KTpZo{Rwae+&fKJy zcY?03?aV4nucr;Pz;29D?7DPbE{pci+zFZE!j!b!@fDaNae2zQjsp*w3A&*r7V$IX z8%6Nq-}nhqjMUS5w@9tQ z-n@d`9AHKZ&6z+?;9Jqc<1kKZ9J(~g{6yUxi6Zy)&ap*>k0+OqW(qFCE;+n`yr#v#pPQOswv*deO=0mE(0 zHqlXWcUWINYI1v-^1c@e73EG6rbf7nTdLM~cn+T+#Yf9I7gGFuxC;sQWC;zN`7ht- zxY7r=2y@GJszmhBT9Ia^D26N2dptBdumk_pb)pp%@-2@sCL;p+QNP9v*1m47J^vP_to|EN+1 z>=-NcZc7oyy3<|-TP{B9iUZNMhCopoi)lfG!qV@DG@3~#Kya6^_*UU>`4<+Q z?gbnNaYH#;4vomEuzi_~^?ExxpZ7=jwK{cVB$q+b>P@(CpiLg=(^#~6(W4rkmA_G- zw_G9>9(n`2;%siMw)Awyu$h-`cc=Mwfl+x4+>`<^aiadd;~H5tL+L2dgaVzyK0^;Z5$@ZSdwU5C0o^^|CF8Q{=@+HSy>&5sCJP#9C6X z>HX8$-IA_562+NKW1kGza?S_7nm9pO*rSNMQM4S|^?Yi+cMkp;4T7!E1UM@8^(#J4 z9&5Pw8$^vB>40c;XYC0T?dK{b>{*86?2vO-V>`97;;3Z0CoWFipAM7@W)VyeX>+a8=RB3yujeyI(fOH=x!s!=s(YMj zbm->NRLt!D;8f5FiS?h394gt5940s7(>CH~15|nTz`UuCqbiS9ip>YM!nXg(03N}G zu96o=x43P<6r)pw7#>~Hrq7TzvKg&Y_ORH?%DX9?`bO~TQvIoET2|Yi>??*!_9;Uk zd**L&1VXn!s-`|H(D^ZZy>YAMo2RIgPFzrTAwi4WEg<%F&BzNd6=FFe(rtx&qZIz{ zW`Z#ACX(GU{i)MpyH3HYsCH09Y~(g43w$9Cu|Ig>KcvQO|0yBe9nufrRtVztQKN`& zj|1K-bNiyNbfLCfIVddVPuI`1w|@59f2EOVkF?3*YaKiiD}RG5-a$2KL@Nz7@A6pQ zA@B}?|346rMfma&4Mo!5i$29a)mTXW2%BwE^-SAT^MfNtj*nnrjXdt4%f+D2TJB);f?3O``dQkXF%Bk>W{s;=e z`il0JXSb*b9u^&;jbL4*MIg3Pes=$$3kyhW+n-Mi!ySo+=iYRTyr`bj@w9px8|T?C zwXi>9Uv;-m;m>Qjx~*Cz+io6}640l9l|C-AorZk{oQLoKzbB*F%-({HJWz4X|C}S? z`}4eg$MQ}m=A8*i$~oh>x$Fqo5#YCdyI;Vb?*f8DcI*fV4BQ$J5E2kzovU#qmj4%p eOw{SrWZ-|UaQV^N?;Hv)k^7>*YW(NPi~kM*zKa3? literal 0 HcmV?d00001 diff --git a/linux_networking/images/pcap.png b/linux_networking/images/pcap.png new file mode 100644 index 0000000000000000000000000000000000000000..22098647ce0af36b74152deacb4bbc6afb23233b GIT binary patch literal 404662 zcmbrlbyOV9*ENc3@BqOzKyY^n79cP{Ai*{0;O;Jg1Pc%}XmEG8;KAKp0)YXB!JXUW z`N_NP{o`Brds%B%_jGqvO;w*dXPX&EZ zdBKGt^j}q_kYz6xI~PpY_VVU zJ{=t%x!&1cRzF%6arT2_qS5%qRCnBE_)^ek0N(coW z9s+L4tbf9#J3Mc;y|!}C&E?}`N#O}HHzk}Ze%C7>5)RA_H`BIFh1@2%ENnWr;NGS< z^!6xD{V&hMkJph3K(HiqcYrgmG1`PIYKJP?c_8!48;8MxJUlyueEpg7W$#k)Uk%LIs=4`P~9KOKA zWd{4Qc!gltL6Z3*w1a+5H&!u@B>R}y6ou)ax|OMSRd3sA^dL$#%~)7~>0_!S+A*SW z06J{|g#(I|5xNb$Q;8F@q7!2(Y#?!4Q5M{#$3W)kh`=B>T$9>eTT>|gSPVgWT zx@M>8DxCp2N0_{;-aBWP{Xq#iRSLGQX@xna#xZ*55%t|u|fV|L|lk?+ezbq zR2x9B{;UzMJb-K++XKz36V3zu%};Mm6iHm{AFp}k5hp_A>3xryT6Oj?jp^il*6BcP!aRB93Sn2>sc1tmyF^S(W}dVqRFaOqHs5p~HJxX2O@U zWv>Zym{scv-@GR)CUC`^i6DLBD`hgl%S&MU*-aYthsn683$_=s7h*F;8`VmrcvySr zk#tN}hcVL&wn*eY!tTxtF{N_C*H&JYUzM|CTx0CWQ)TLV&heJ^ zWm0vlnu?I3r_^QH3`9QdaPFL0;dy(uGTvRQWY7 z-t90~sFrJpmoMjt7E7sDeL&Y7P+Q1ydi^_YFpF7vMr%eTp+cunr@%|2F7wk5l5rnP z(M6p_%0I_i67!R*=a+7?2A@{3p<#yZt{bV{$Z zN&U2S=h)`PreUFVp|>Vx*e?s&I>lPnifyKNs=1i2xGaYvi)~`H+*iX}D=d2}FTPy8 z-1)7Ad{RCnn`M%1POR)UsHo4BhbJXr*m)RFjIHgpSktOq8+#jqltfD?d%&=HXLu4Ro5M_uxe>8szzqbwLV(}u%LV1;KjjxG?U4KnU zeT%J1)n$Vrc+Ki@v9n8Zy>eyk=c7=Uh)BlJ5KUesHNzci(sTHaMna%qi2&@SA;reU*JuX0c(U zVZs`LzwaaOBg$heTz^0w{9$17&-I^^KPjX6!}^PMBawtq*>Hr3m9V2R$}#*%KT^_S zfiXj+gQXfm#4&g<2*T<@f*q8v5|8`w81RJfI!3!kBa$`6pxU{%+tt5DnRKRq6e7NZ z=CtJq$Vxle?}fn<(oIYCF5!=>m(fl684k$?$t`yu&ldOh z>SOHz?f%~4&1bMCoAiU13oH1T3bDBY{d^YIqv5<-&6+3!M89;L_kLx$e6VAFR9;Qm zjnz!QbaXt}%u#%w7@njzA~0r{`PlliW4$2nPhM*t#n4$|nZayBTAR-$hNbM_m*@l( z7EDd-QVgv+e?CXozI|(Jo7rz=o(=qVwz}DF8^v7@P=t1CCN<_bqVrN`-3EyF+2s#t z%j{CcTKj`8SI3ppXOM#IKoV9fR+4|^efCKhEUJjCg-yEfuYm0MKBZfEX1I7+oepkI?0}^Xu_&&K? zOc2X0jyE0C%N4wWH)luBe?9cf!o+-c2d@s_p_Z;?q zqX;&ITp+jf^03=ta`eodb>G8-|KZ@!`E=AZ9Y@?B7W5celYTHdMZCh1(YWokcV#yF zJCQ|MGqpn4K+J6fwphhpP`(2hozt~%T(*Q{Ecx!|?~d>^_}J?=jx_oHR-R8kYTTi9K4KL<}wh26J4 zBy|k=J#wpFMV^#yHXWVbNVaqmNIysm7!3P!9jl!<*);y4Vty?2G`rbPl4yNs6vmg} zKGwPMx*Pe_Kx%*4=Ik-YMap%v?K^v0h0{yLCw}zUb2EJ{baZ-J)obWr$lQ_YYkNy{ zcR1lOd({}i@>@9?fyuP9s0glgA#AuG9d6tX?sb|3pP>o{?>UH5VO;_?{Y?CoGTihz z9B$k5fUnkYHWgBDbm+wiui3-1Xx#+hmX=s%J7f~A>;(uT4n9XR#Ps*Cr6L5dAg^2R zU0rFdTwTox=gx=0)$Xc{oD+PULW64n2OUK?=by5eTJ1cl$N0|~{XjrHcE49C>LzOu z|8eLH;9U(fEd_HB2#y&zM}vb81H&N!XYjy>6!-wJIPMc1DsaRHJ~CMd|GtY3%R>D3 zIpW>ZgOcjf3JSnc-Nebv%+A@;-i4a^x&Y{E9{gU*MGK@PY+`TAZft7*(Tv^0*5RoM zoT!H|aB6GjVodE}Yh&ju>>)<`_X%O({OK|WE%o0=T&%@twLq%W()Lbf)O_r`?3}dX z7}V6%qE4pf!fG;a{?#1#CPr)N;^H98!Qt-i&hE~`ZtrBl!6hUl#KFnU!OhJEJi+Gd zY3E|>!Di=7_fIGP?nlPV*~AI#-~zU{qkihw_@lk6ix@5K(?I|E`{#F>d4T^rlAZIv zrUgup%T+()AWP0 znUl1=Ezr_M{J#tQug3rL=Ks6l-!ZlSJ0=$=H|PHx^MBm>S5r}rr@8-+wfJYD|6T=F zS{y@^<3Ddr979ode-sYxHJpNs}*XFuL_1U^Pk_w5d@R%lyKms z6y(unrpFaIafM$5cXk>zcRp8_vd3;C<;*7`r#4awgS+m2IAxFhF=J~uvU+$Km9cB* z{_@cB>}`o~Y6>%TK@U1YPyjVG8ruK;;q@WfS)rJ$f+{X95)!=R>;J_;3P~nhg*oVd z_j>}U#~FZrDnLIKtN*ui3qXS@Q2ei_wHN~QQ-|)Mpz*(0n}3#;M!X2|e>fFv%=D zGYmfJa%)u7vu8FC>7YpiJ^6N2Z z2Mud}`-YDIRP$&4-y9U(pF=X>}jW#czj{|5sJyuo`R=2h$UJ3&*8 zz`!iw!}|`ud$lcjY6%3b(Zh)xIddudR@f&UA6PHXmI4wXhOE!!ihGf2>)E8DRnzZ8 z#VESK|Ew|&61M2^YuBTu-8b?p&SPTx#2r_%Jt~xc%_Cg;_2O5-_lr=*)5eRWKnH3x zUiiSt)GGsz4dj|if%9qgl0Zb%#6b>a!BvNDER3^C+>=#rXec8ov4Mwi-S0%*;)na& z5^zC!{qw_O4qsR=vDI)gSLi@#!>X56`}NL{kNx1cS617neG9EoRZx~8$R z(|u(2rS&Ury2v&nBP-s}Hmj5E0UBLJ)+!kf(n6+~$LlfwX$tq{?DDn?olxZ7iuRkg zBb?pOHo7*kMGms+=RZb7{}MsXY#(f6nO3249Vqjr@;MIlI_^Y`x;z=;Ser$jC9`jR zcYnL~$bV-Kywa8+j01Xs5#Fi7mq~hR=SM3owzd}d_QxDc?pgjX1nl%k_ogci z+Pp#!t#opgk7DAk*dq!Qq2KM>(U-P&GyTO`bAX8{j&SvpWB7927@zf9<}4iw4uC6@D7oEG|C9L4 z=bN}&Dy1`$$u5(3HepfU;DpT&CpZ5;>8fG8|3L+JsL6=WK(M@jZ zmd$3pRT;xv7wp{@6sOqHPVPg6BI5pcuzt3MhdmYl#m%_{vB7E2_09=Dr}5gM(K#;) zflU4}r?rKrUA*u+zBhdsRE=BA(K_g{x)W#8ij>+uH`%han5wT#;fw?FktJu_K?+8} z!YG6Vph%q3onp!U3US<H!vCrvV%kp;v3E%0L4Xs5c=(C3YzUmE@u>y^d@|I=GI`RG)C~HUU#kb-5Iz@cXF3;$)=O^5OiB^`YNIucQ5~KZbL$q@093m<`=z%?hVUM z5%)TWm*i&KE$OICpiXt-tg+^vcW=mfT~~eenr=QG@3gRAQ-;xRXx97h+U>?)9V$PF zceqDiIQN9(bp~OwCoir|ZIrL)#w+iKe=PZ8vEtf((4b8`{{dEeye3ZB%qYIp5e%IF-~Hgqx|23==zZ-{J$oTj_4 zlI#U18hGu&-TS*cnn6U5H!LNDEQ2)HAg+2oL7I-DXhsLOzvyB@BqDWvn~qjLU3EV&S_hucb#E!#p9DixU^rN=^ueAGCx4n^kDaZ+lrnplg1XJXV)q7 zvuhhYO`FZwA>6E)TJXC)4CYN;4!HUwB1oK;I!?7K_%+Vj%&_kM)XejLm_@ zHS_Pb=8Isw%~S25-{7Y261ku@Q7*6eVcQgLvAxQAFjanz=m zk%N(VdCk)t`??TtbI*UZa!C1@z0JC9+bZ$jO|^F#uKO;8GUj9NEPjKkj5*dicJq(E%z1I5v|j^)3M7`d3QVMR)oFS zWTK&iZ z-oJ(d^Rvo{;#YGX6|%52IIkXJSEp|!>XS_EcsQ?^NwqF7BGNK~Kc&3H8eXzOJ^kjG z|Hh@!SKnnq_OSn#*suVc+@X0Yn86hYCoKE9Gd49NL_7DJ5gZygVrQx^kgYh4buIu0 z`p#wYO~-5^ixNeSUTqF~){kD^`(#M-5PJ(#Vcc9aZ)j1v+oD2Q+r=VAag~b1z03L4 zR!mqYXA76nPdM4h0bws&%{3pVZ{G2cf|%xQ4HO@`eoF6Bn1OBG%yZD$uyc!@k<~B$ zg4+Sc%)%CE`%)$1)Iz$0SOU%r#! zZFdfYW`homp&7;u*V$|4H3r5?aoDuaO?hT&In>&HL}c!A^_$bBevF=1oA;$g?!@$Y zw6B4AirL5es-x!(7cN^-0)2hNW95NxV13QqH0S7nXG(K+4J&RN%ebx>r~5#_Hozj` zmhrvWD=-!<6+37>9sLp_KH?1)a8c!F6U6^?{_fDIIfJP+ZW>+XPAJ~ALqYzVQuEEqN`?JeJ4VORPVuy- zQSXyUZ);U-t=F{7bd-NvJ6inYlE?k6bvhyd3KQ-3P?(+FFC(y3WK$G`)i2p$$~%n8 z2NL9D&r*`!$=!Xi^xU7T$n+#;q|O9_lotPTJdqrwr>Tu7`xt?;VCV6k;_WzX1nWo3 zuJ@ei3O&^-LHG=moCR3L^B%5V53m@2UeSplo#O?IOv1O61wpn^D!w;oU?DLi!i8Ei z%Sp-A{wOj{ru5=ip{s4CONP0zV%GsSlQbz^tD-!mwiMv?Anw0dv7~@0MT~w@nT7(W zy9w8@o}oQgU5N8#=tX=;2pw1q0EMBG#rP>XP^PZ2T!naq($SxneScDaD%?H>A+boCsM>lal1aYS0=*!(lQOA1sxU5RR~W*cJX)wJ z_>4K#k}NX)Tkx2*%R52XaJL~vK!x1HX?m>n`W1eK$nFzbdfP-?L?^qsn0oalnp}H( zM#|APO6tew3S1YPSYIoLtYDpd|K8;o?76;^DA(7EXuOUS{t|b`-BpgZARnz;Hi*q3 zuUQ!zx!={sr(Lm&`5aCbpf#uI$_aAx!^))(0dhCjoE-+J;iFR-<1MAPGi+}&JM(l@ zL~v05lzQ$cDj-I9?7xQLJtzOL>}<8UwQHcp^d(@-Q*Wa7rJpbY`IcuiEUvUHFUdp` z9mH3FNl@=4Eo-Pir{7p5MH)?O>=}AhIT6%L2EzGnq=1b@0=DFF)YLXh$SwT*P^pRK zed2jtgD&Zyd@AJfM^&V7`d$RuYVs%WNZ)-WK^|2wHj#~>E$ zwZfD#CP(4=%`=mi9VPbz-33LQQ#4xi$4%XW(-B6^CV@J?n?gl9-%4Uvn619&?*zMV z(Vpef;VKpv(IQ8jYvc|Kj{Ov_xR3I*`*2Q_psxfsfH(lt$LO_FQ7-S0t+fHPsD!%l7A&sFSqHynPK)YwPE zPDFm+^8M3&T0wfl)@>_e6lZppAoh#S5EDk>Xeh!n6tjs_!? zEV1rAue%PedZvxYc@JsY&G?S-eD>tPRUhqFuaKdX&$`^0J^*M=8*{nu<>OnkVM!f# zFL~O@Btx$BWVRP%14{fa#n!fytp!5!bE{(Wfq{u5|!_!9PL3PdbP!rKHJ_D8nb){B*Uaj*z<8o=uXt8DRNL1X7lGHb=tK$s@?BS1HNE&H$Y*zaM9oHZ& zH#EjTRz8p8^~%-W-pjrI&VLL>qfF7xv-=>z_Q#E8$4$bb>zw|I<;ux5uxe(OabDAf z?~EVnQta$F1#hBhMLX^y>*(t8i=Cw?O0xw* z`1u;d`Yy2u<_?_h9Wxrbd2O37BXc4J7q9cz2i_$C8CYR;tK?1Oi)^DEK3nB2kweil!FB*Y6EIv`ZY-LDgR%HIFC7IS6&-#( zWch2vx;9neRQ-sk8M0TUYP*m-{?nb$hybKY5s;AGblq)r_JO)4wm|t3Y0vXZdSBX} z?SE#>Q046ZQuUmoSuHnIrmSfv^$Two;V3&eO_Q_fljHN*(bx9pGnzOf9V$E{y!%@* z5*mx-oamXaN=ddIT|Bg7-w2-rc`;M+n-FbnVH>gs%N$Vb&ZVfSusF6uP85Cj?k6%k z%cCv3%EYj9CE&~=tw|Z^8!!Y5H=A4zB81dp?C!hVERd9Bfq=Qs$ z2hQb?1ouVv`{Px_Ny_cFC?P9X;_t?0wM?*N5#mDE3xaPp+^?6N$3oYB53*F09*YGL z&H7fl`SucOz6J+&8T4g%ACVYfzEq>-mV3nJ_Zbrq+F1l;?-8-gc~wKJ1c)=)DQ|?J zt-(3Vd^qV|$o%eWzV5$PMNfxw>Q}uWXeEyimmS^b@Q0u8(cMcOAY~23muvnKkwNX> zN^}4G+0bEe067nFbhOguF@oPIy+FqffowJY5bNjJ)ikfn)7P1xv-Kr z3^rF>QeJ#>3AJCfpNpyxhPK=zQMQAf%I2cl=U9;AL+);0}eNonR!(eVw&BukgQTAzw3E{tUxv=Ngy2`VqmN`j*)H zVST_Y+1gUT?LdnUa9oi7UkR-Ap<5Z@yZ%&_hFdjQj#I~h7W#+y{mHYvIV)psnIZRL zYDjs%sz1|~=zPHjznYxR=U=kn3BBg*>rKXqPZZ+wJTX15$-GyJm6Zv-JQ2he6|&qJ zP}CuhegX(Zd)C%qv#*32a%7u1WkZ8DwmY%q>uNo8_7y+&>A=8Alch_VB1k zd-om4eVh`!37#;j=^SF3-N8&rQqf7^dJm<@urt*hEG^nGa&~fbtK`Muz@QwrZSDiMAcKt(EuPtd(H#&h#_s~cE zc)L(h&+L7_7FW*AZ;Xo-V(00X<&NQ4U!e~x`4sM%4e2r7b77ffY`P5*5&%UM4A4-W zsGc0WjqUE~hI+n{y9zJ3f82)=C8(XMMC9aiAmG$mCOm~2U>kd|=Ecdu3<%lyr02+8uJTlq>U_%;Br{Cvhq zoD13?UoKH*9BZbvy+E$5N|Gn8)zEY7h4WPtpTPBoJ(@AoyZ z>Co#or0Cdfk?KOayOS8i&&*OKrrq)5!gIr_g0cGvQ_F1Sy4tf*%qYV66%N<+F7@>Z zsN~YaKFL`kbP0d!TW$L|Dks(0G#C(aicqRgKaqnqxPGx@k0THNnqF)%a!9triaz>* zLi9Srp5N?Yw6j3JPY*KC-oL8nv#8a0>A6d>Y_@$egFZH|Iej>ffXO=Eg@2*qDp>BA zzo*dH-;*tUiASny*OZ4|vp0W9pG@w_cnE)(dC#siEj5JOCsp6!8^iZXm?`N^BHyq@ z`sIor?N&SZ$H@9T$HfSvbv6%Pm}`5x?=8cu>$JC42VLj#du+~(st!E-U+8QHu>p2H zhW&wV*25}Bw(J8G02xvRwIT&;;y-|B$*%0A4?=u4237zJ2(~5nS-DN_@2pNNXUPp< zsr;=_D^VNUEtxNUyT`Kckl6YRHG`bjHvzNXBg3S1db_T!*sOQu)0GvZct^bh2Yp#4 z3_DVptbz6GdT6zj&*#rCkq&@lFyC>2?yO+I=yeGh-K~ykR?D=SA_=L>qIx`bg_bBa zmOq|ECJsG_^ymAe9kBsXS-n*86T2y~gUaq_RJoxX)UOOh1n0zvlwA#8ck8=M$pjRY zu#-V0lWVZ&?8GC!{bz41(PI!DWcb~HMH=a#5TeZ*;uptkGgS*KqwOXD0Sce)!+kh% zy_*Rwqx^OlQ_TG{uz)QY z-ojz$uFuSkUBz{>(y>&#;yvoN3S!y21_B$_9~avp2HKlUiMtIPc>a2Tk^CFj1Q*uu zz^L+}M?f&=_7w%cRf&S|d_^2gxC1^EB84fXg#uwAX_K4I;Y~S62`J+6jl%8U6`1{_@pwS{IFC&s}fQeGF{j+eOYLD%mo5?}U&@e^BX2>UG(GMLpM zEuJQtqjuM-eo)h2J4qtV@#Ps$rK03scyG zzH14gS3qoPSJ73K-J)`TX)OT{ex|^NS=t%jC#D|l=&~-CdKDB)C--J^=4DU+LB3D&^;)2VE&Kpu=$h!Kqd>EQBADJ+gyTZ&d9#siA;qXgIzXua9=W&amzTcC z_3(G9Q4dXh*ALrpVfq~_-ots+%c)VcYk;J9 zYM=Ym_na%HCiKbycXXAY4nlWB>&O<;@UeRK=u2+DA}Jp*(n@@);KH9JNuBiJ(Nt`%ihAl}W9w(tWO)>B z^E3kAFS;n0QRqVkwvAp}l_0ttSzbA)6jyZ<5Hz9hhI^b0Fn;$5_UEPaOpj@W)c!h< z=bTdFAu)&++Id0o{*M($Dg(O7=5xN3ac=O!?>FXYn0cD~PA%80YDb`w%=Y~_c3n+D zEQB|IEIHBoz{K2-Bt|F8=wy4T7J7hbx2y+Y4hw|xW2)U8x-9#mrtt7y_ZG>sUfei* zxS^xkW1L`$DDcI%1+u`mv{W!EPNRTMH-MA*65`q=y~@35x!Zz}VFpo)tsc{TbC|D9 z@4M#f*aCca4DTCoe=Of)&~IA2&OMvFbDR{nJHTM;d=Xr0y&)215t4BK#G)TN19|=T z2js2C+$cS?fceGF%T;gt)>Su6qOsPa9h~idj#t}A}L+G8{rKAkCQ7^H>E5hyD5!} z7IfAfhJ#ai1t99M)N>i{Zc)YXG0KSSF`?hz)TN@F1&6)n^xcth$EjH101_13 zm7S6wStHQ?>rR^lpW+rR!WN~r|VY?lJe zi>FZ=S^cMu$7dsynEwzjr8Tm0lR1ChBu0#OqjETJiJM%@fubv0fA&5bYX(aAPIc4H z1#)2um=9XN0^OTPH0t>+p9d#tZ zE~WQD)iFhDf&aL2>00m`r9-H}ien{c&7BNku^qN;lO)(z%ik^z^&Q@_p%I^^n5LPA z0-229&(4?nnGUimA@$;s{Q}Dl-SS#-A4r~H)(vYCug-_QQ?ScnCGA#TetFr#HJkI; z%%>|m$lx~HQF=7suT?~HVgrj8Td{*xTVf|K=T(QcsIRiuBpLmHf(gT07Kn$|Yx%hH zv3Q2zfRCJesfd9NYIvG_P&b|WotLa`%@NFkG%^=c-I?B`v-!cu@1qEW(dRm!p(|zY z3m&qG2FTG6rdsBFepByLk&tF_F`JO@T3b_Gk|oz=GuS=$Xb+) z<(^UR0tDMBcF3H_$Zs~fXt#Ejb?tg~!Xi}9p~4m3)BLds;)Wdd1d_1%7uN@Cw#|;0 zX@@>~UY_^V0RgZ|O7A}`wTaD`x1M09K9<`y=i1C)jM%}FS$bQaSax1$eI?~FSF$9+ z*|;cDvzhNES7mIh_So5Idz)Ty3Z&dgt&W4610N(#PY&q}+<&z|p>5?(mrZ?}Ipy=b z2Ov$$tWBqSPf9dCBFCfr10ZXfKN05VK4@ZDyvsf3v+-H*MN!V~xH}nQ<6ZOIP0v!v z6pw8LOZm*_*4(DjXP?MX`SMEf*s_&|zKWp)q7ARexRJfd7jLu+<5O5CDiy2ii}3>7 z%(7TGNX?>gM)Aw6hz!myPH3}7I8e#lyTsEFfw4F zmZF*BPCqgIAUi1EF;z4NRFGC{9R)*-L^KPRKbQsvqcq!giGMUem87|+tQ>|cN7;=B z)HBoq<86Lsr1j3URDrm(Lqz3n2PAngx40p$hwD5nRIZ-&}P6ZlC;qa(+|T^cSv3&n(%;S)2RD!OfF&G5Wp{U@>5ercap?cp>B04&YVbLl5X z5buhTW#6)@_eE3+(8cd6mQ?z-SdL>)NgIBX%ww^X52tht74HK4n4o~;X3wv*Er5QC zh#-2+B!7w7C{@TYVEkZOV`}e&yg-Ltb31=pjAh zol+vGmsp%;=(DWX&~3^50)fPxXluarul)Hm-nTsvA0LNq0}9g8te65q2>Br+>WE-u zN%`DNuLU{u@Sf=Ak-ixS(Lt*_?I7S%K0<_~c@O$gr*ktDJ%Z_pZQ!=t?Wve=; zRm0pvAzfx#@;$UYKr|;|r<@P63-?}j?EkHd5%ejw-Mbe-JJoBsRAz8Tf2xl7O{`pU zi>tl?jd-%b^mUC&dxra}=gu^1S1k4*CU!*2O*&ANTLGp1Zu%eA4G$W41>+`4yxFxRT1S#xq& zBQf~4M9D*2w5rk6xV9OcmY3dgXV^0WP9jx(<LEZL;FtiZ?>U*%|vQIq%wM=&5L8U<(|}f zd$$T8hAx9;P9k=Na4$-4&mkdT}dPh6L7NjM#YacUOc~cuc-Nasf@qX-627>Fau;2OG#HgO17r$IAhs6LZ?yQwbkARGS?=22v_ly| zsn4xyt3tE9FOLpIQq;}{{h)e>j6@V!uDX{zHy9vzP6gAk8kc!Mf0QXGz=HfXG-+@% zCBbw-*zmF;B_Za=h8b+TI8*kz0>49Kd*$+Sm2eOMO`R<|mI@6qp5^JxJz+QS#T%Y((sCefE3TT-I3_u)yQw(RE8qr} zr4Hv2fvMy5WNUW}(7)5~slm2`R=Ow#xu$|VP0bg)ki9D6;Zf^?I(y>>99x4MRk-09 z>#zsRL%OcX+WY;hn|;M_`?Eh2sip@rD?RK>7Jc|CuIq^;X_dbA8{$Cx=>B?cW&! ztvMlAS)&U?7~KIc$Wjg+IK$v+xbLz;nXJdX00RFz3SRoy`JAEQ7u&*z4nPGLl%S#W zO3J=&MnjQLQkA*tTavQi22#BEdnCr+YwQ)gG~%~N=qOwlpFP(@dnM=SQHQA@@ZYS1 z1VYc>N*-?3ST+e1`Q4N&7G!u87ZDdyX)}6PSz6j>EiqQJd`OJrxP87kwI(-9XntpN ze*aSY@`SYCs9!t*hcyl*Lza77;r<=z+6P!q-d@8q48Du0YM{(cyr5AqH4j~ z`h8b2)(+Q-G*HPmiXB*e(dSb{z6;OfH@;s=W8xwVTMG5nwgeJ^p0Z2zmyIO4R~x6MGf4jTh>Xic7| zTbZ<@Nw{l`j$3N+z2thkm~*-JKi|{7L=f8l2k_(Q$<9F*do40r9r~;4F3SN8LQ`D# zoxkt)zW`YMgh#hZ;M{9kvUc^EgwWt+iWg5TdS8m${1^F%Ct7|j0F zVm1evoMaL)*dMjFCbvbC(@oMilI;?H6ONOfEzVUWG6ED7YUK?UDd%SK9f1@?V-qz> zu+|F9>M%n0+wj%IV|%1}Lw)fF)=Gw^Rw@0o-iB+J3bO&pG4-z#(APn9xHPS0GdylSLq0E<3A;)GWpE_Zy*_6+@7C zIW%VC#&aKjp=Km6+t-Zn!}AOCMmKJf5P-a;ZGp;=-K!}#kN2$l3u6;F#GgawI|c9!GEmS#&-g` zfM7u<7d^eYTJa(Dij$*mF6N+KVoy8>udKpMW>~B&5gB|b6e(60-)K7&p=#a%Z z<|RYqZ`K`KKSHJqa~4KpUj?e|v4|M*65wb{Oqe8Eb#V=!tZ}IsW(L4bV9|J@ky|Ml zRc!zOkZ-Jhq5DUxiy4i$(MHK=ixn@{>&al^4*<%aSgyK+s;08`%pttN#%VcZ zt`_Lznmgi6C5H@YDPJnGEs)?(n~`V zod(J)zYDIIEg<#G5PAX}Ek2un67(w~a*#Wi0dL#-FK?^x+hDo_)m7Biou02)ek#=q zAT6;tT)rqw1k8#GY?v>YCGpuPrwL9hCpFQ)lgnZTeIY^_fz%3ukA&uVVm;M6%P%>TlRW_y$Pn80G5P44wllOoiCzh@!m0mI z)$e7=F{}}`@42-UoAs=W3Sg;3pOosnaTIkNk5mj>s*pEaj&Aq|#(T7EbkkHnW+&!U=9Va3=c4cV|%9fM3> zu-Y#kThTD*{6sYU@f<+W@dewz=t*%EyT=tTjbB-TjEEn?32uM5fqdZ)80Hy#hOOE5 zCd8pv(iFZYw}t^b>7L<%is6z$Sm214xXobVpmBHo|B`V#pD6IWIZfEnD7oTguT8%2R&qNCAri@hhUli`AvRDVnj={$aaj8o<( znFK`gA+%WeJ59qN&AphxZQuF@bM^Y45FjxtmpA!DBfEq3Jf)m_?6A2==Z$OK-%=8J zN#Z+l6>{FK$&Cw^si*LN5-BZsb4h>T+iXg0!W|>Zh*R$O2eo&3 zu&Iz%XJ07jm$%M>YZ7PVR;4Ny>V_D(%#vNpVPs`O6k5W^dVQA^myMQy5^lBm};QenwavWUKNRD==b98pZ^{_mfLJ#wu&bgpR>F*32w+_ z3kkbs#h!o!o9TqB7%D{AGToJj-u-O3_iH(wMBkg!-kmzp{m0%5FZvbE?Mi@49&06WL ztsfMd>$nemHyl^(cDBQFJ zv-+|~$(%gNQwDe^4yG^{2?`=;T!J&%USxM~mDj_q0Naz2_~mTH+ttHBXI2<_Msn7C zxjS_AB1ibJb_yT)3Kupi0_9!IJdTuYY%PDg`d28JKdlnoY?^shFW@(|A4Y)_WU$$c zf?&zm7foT!9o$>MtaBw?C&5ip3fn0v$WR-%Dx^>zSxSwm_0O{z(e);c8N_>!ebWlm7gZE31v2wE#d2@;R*k)Pff;rQ3LIkyyi~5lJN> z&eB{xx6e)2FZ1)q(V}%l87D(%pA+{2X^Q)z6ggLgd+Qt^6oIG)Q(*5zzu=-J?zm`v zX7Eeht_iI`raJUkHQ!WOAkvnK=~I6*q@3&~eoxA54(IlsQ)M4P}b8@^G^7$=2STk+@O0Q?5K0S2-}>E z7wTIj_v!mxwcpyEH}LLAI7-=Cg6m;gN~Mqv_be<}mZgm`yp5G&7Z4_Mh0PrZ3j43z z55C(4N@dspNN^?hVVIdvzU4n`HnlcU-lTePYZdh#_v|BaBmZ8&D=y46ytC5xDoRtt zfKqhI@*0grB>z0tO*6Oi$tsom+V?$*SW3%W``dF|(sPmjsEvl*Tc`<9Rxz$s7-?f-Q6H1oj!Zc`Nr>gexG&DTF-y7T+9sb*>UgdzOL8KJAiu{yN*A{BUk0B zc_uSM=c2Xzmi=4_nsOBWSz{A)lOW_K-j0E`Lz$9+KycT@q-eadPH+v7`UyPI6`qkz zZVxiKE2MVfhxkF45n{O^daJ$5`Pxrl3+Gre3-61FX%CrRiYSweWw zRW;z*hUB5j3^(!Oy+>tn z^}xGgU}HGaVz)BfKDksqBoz^bsX3BMVXCfap%AbX?x>PysEl)>{6m6|9z{7JJ4Z$C zRk33Oii$_qq2Ep1X|%RVT!?{uXg}s=uH)IXRhqlyC4T*x6&`N8riT_sF;fv z;Rj0z5~#8){z z?CW}8LD?VKbLd8{AIfLA(b1s@uZIiDj9hI!4wsl+WOLAX%fQUTFZGd*)9EkgS%zAI zg=C7wuYqE%7$$N07WI5VCR8sZ+dPf*ueL7)K*HtB{oaZ6a(YQeunQ|;5 z2C-Q<`u6^1E#7ilLJ7hZuyMcctD|@SsW z8)Bl7cT-9BMQ_@E@{USMZLY;Tv&VnpJfMm1!@obeK^TpQ#|^kFZ=)doW7 z_${6_{u28p{p6?Kc#BB%8L-|Fx1RxJ%kwM-`aR+Wvc##@ikD?cWC*7UO z@ncik!52`T^SF7!vVKn7i*^hf(4FvExSKCntiQIpj>NeUui}V_Qo^B)NI2dZ z`(M04LShI{XsXRL9PfAjrGGc6-1?b+$nzI36)_8pOMDNYT_sD<(XziXGVRWvSGJpc zXV&u$?j8IQ@A|yC>p7`c50WxTP2~o!D>Asd&Vd&)*^SPW{u1y$fD(oqHSG_Uu ziuvJJUlR8)3Kt)oBY!ribo3#%ugWTBKxAiX9Ji9s_x8aDgQ0{BL6U;f_3`7$4<34Y zCglyz(tNkh8o@8uNakg7V!Q)=8Qb1TVEdtKw*|3J`|v!;A3;v6+zxi&47TZAegD`! z%e&S~QuJV|317-*P~7`d+})@7x9qi9gkOhk8_D4;cqK#=u7AFC68!-}cuZICv1wh2 z(bKS)yg|_Er4&C%yxxv5O_E(S_TjT*VAoOC=$U716x6oBp6mtw`=gl zA)WML8>&hyn%7=UQcie1WzU-98B+mpf_2l|{E%no)|eIw0>T6`?OKY38ck>ck2Gk_ zTpOHoA^J6#>L%-Pp&H{gCRwWmY!zk5yAOOYm1sJKC)SH~JXc_fK(U||YCMr~A6BHm z?z2Z+7LUAYW6MX!hQe@;sSJ{QhLi(o z+fqO5W>>ue!Dk`IBm9+aQG+mox2c48Kd&S5Fr}@fhrL%mILfD2UyF2g>Xm&c0ebmY zx%q0(gP@I>8Ng%@Z8nq4^eh?zPY!~e2?c4 zjhunMEzHxPiPL1%rybPR`+3L{Q>me8Pv&!N7LeiI<{Qa*IUf%QD@}zmBRB1JNTP8> zG=4=9p{1Eu^cLwL<@ug?{S4uvZAOJyGI$U%*f^q&(oO#D zl5AU!N5FMl4XMymu6{1r=<+oa#HV*4-|{hwe#PWHS71bjPUARdW9r~)CF0}JirBv4 zdCW}vS*|KOc`X`bT*zBY-EeT8Y$ZGX_PD#;v=4Xgy_duqXLEEOcTS#*MX$(~&1ja^ ziejt>353og!j5e!R@Qv5pLl^u%!9fMKF6RuRWHj@S$~<&ZH5$a&|S{STY@~wb0H)Q zTvlO(4_9QPTt98kvo3tOn2q=*)T(km6{JElH#=jM?OR7er?hCcN#eTLT~RvSQFx*> z=kdlSr@igPIexXyb2WT_yK$kE>PYXpV`?RzJq3{O_&X@MZf*h!F!;(=ge|?}K^`Jf zWGI!8iI^uL6=0qm`;5zZQ=Z3AJ?a+rzZy~kGbgqi zo+Hm9Am~FIQnT5AIP_M70`tvYXS@f+Zu%0DD+M*aq1kWXT@*={@N_b)oxb(9xwB@Q zkCI=b+s&F<3Tp7ODd(x~=jTdhk$~QIkgtrcC!AAT4dOPxDSMoXzoV5t3$$D2=Ej-0 zl?9dK>PgqW_3WE#E#Hki*9h{@AagPbwr3$jw7 zac*>bcprVH@B?-mTSs)4KCQ)fo4V12o{iGw-HU3k7ivtns8|_#y6IDw^@9Nu=sjZi zQuDv}#_UO+c)ZXv3;t1uIgOr7*t7h|da;^-W@%PIZ^UB)Bxwm4O?}a-r%NhY-bJJ% zZLvWa-K)AD;mb}PGd9O~(vvRxNnLd7vz`qnq#p>OZC`XFDlqC%HZ!B~MWB@H{FhSx zv)w1_@5If{jQ)5_Uj+9{p;%jWqC9rg>CW)lD4?bJYc!`jL%p2G5o4%=%)lM}X$y zsm|{^7L?~djaGkvbGB2%ZnLu?sBfkVUyjTy*YiRex*HITj49w@9H8aiH@e91SP5Td zOT^bCS&Ld)-avr$)k6dnGocJ6~6Zd5DxHmzEe}im7Y2^2A z2r|3%Q#B{x4=@c89c;MeYq=J|+zS(GeaRNEYCYu(boxrBSI5;rXqsM|eFp~DQ{k#O zn@!Pe`VLRth|G1Z!g9teRT8=Sa?1}u@1ASi{{3lldR~4w`6B)A^s>(CbouF8E<#TS zr4z{TCB^ydt(}o{2wu$^TjvDZ)D9qWz;-J#OtPuRk{GKqTN*#*6M3V>4ytd*JXild zHGJ+yn$)-xVv;E#SlqD}*#2-T2}xuX)eSoUIht_EDf7|L7jOG@J~VQc*E7GMgcnAM zK94`157~0@Ug@1iShoZ*S}LSA9Mk2zfAIX}c>jb49PiG}V_m@U?t^JXvr=7l{G3Mz zw8Z;<>@)Vwt+IygIha@B(%s@q=m-vHYxJu*Bzk z?wjeaawt;A`)QidPWI-v0%Yxt_jQs?rBG*HuBcgNYb-w-IC%f(x^JfIp%BjEOvE=g zNzKL{HeB-O@#$s7k5oowN19wOolode-EG#UrV279CJtDQ(nc5@SBk3~h1)RqY5UwE zxONU0gSklSLnjRXGQ#7wHDU;a%Q`2Q6r;LSehO|@OX0uA*XoK^pC(Nh5L9e(uB*@_ zrZ#CoC(OM_Ef2{x9p%{NrNcMdb^l2Nv|gPHW1emKOUvVr3cB zr$1cJmboA?Y@!Isp6$qF46%w!{$=C>t9TRM(f9;enU~7ZXE`KSB%_((ViUpD$VV>* zS-7-{5h?Gd?4`;zxw*ldiV;yCH0C*|r#|IszNsAtX}ofWTX4{qOJ(&aI%HXH(-zoE z@?M`W+}_QU!f*v=El&M(omajJr#s`S!`rOm6(-V(C<%!PM~UwEQlbb$Z?zNCpCqI{ zU?Zj17MRA}C2mpS?P%$jD!=RJz!ZXG5XT4OapOo0v2{pyD)Jo&HZL)_<1n9 zl1YD@NwgybGfS@em}tpb8YHLG6=@oGfZ+QS7FMCWBo}vRe8GZ;`9X;J0rDy^7j`L7 zylY4Rt9zE)u*yP7MU{j1!FEuu3T23V+{>osit6r8C%a6kI3ave zD9imWoNm~UM|2ak&eKT#Au=QqVdPn)$8MN#bo z{==Z-Gzp78U$!m3nV=6noRR7j?S{2ntfsqPtPB@)B95s^2m8P0KGxLikGNlaai5n9 z8=}yYQ~DP;*GwQ%kPD*=vQp{}8FcB%>n>vsdJ%{0+|ixlqcq~Fu7NC#?oT9|5NSCM zV*Cy-LK%{tKp9ZgzUw~Jp@_uT1_xY(vM?!0HtWQR$`Q{YtznxBmVZah~ji;kV zrmU>_S&wtE^~FYL$@{*)W@!s%7ka<=ZkMaG4THwUbbtNv-+wV96*5#hp(>70Hai3I zqi$N`+1j2Wmk z2DZpzprn*(CEJ6>7LK~5k?-aD8=#Pdh$lB(%^&z$Wj1w0L4q#16!9g@2KCayFzRTb z7mBh)f3fM{R1oFsX{vQbLkJ2t%5U4oupiZoTC~V1B&0oR3)Vs?BkrU;(nKqq(J9Rc zPS^jCvi`#-6=Xr$^Foj%W&luW3|QXsfD$Aw`07XOVNw_N0+py!et=(=h-|h7nlYep zDLZ{Nqwtsio2{j+ATu+hV9g4UWSrn*)ROtC7$TmZ|6^uGAEhI65~h}wd{a2`u!`2%V+yhI^FsqqgL3x(7!&yg>1I? zDV;B&&YLfO={)BDI=a!2?a)j$+<#3~?EuaF*+I*7`PHxLAyU{rSMy=VoA7&|v`Wfq z^{p+F(g<>Rz;n(BZ2Nd$N6xZxSPEom-SI6t!vFV)3*h?$Jj%0Mphqz+N_w3=bCSt+ zROGUqAl;hYz}-qveWiG|5G?68y_!|JV1Bkw-A`LP$SW-v5^| z^e^uOKSjJyxo%-R%fC$Ef1}2MsV3)*cb~&d=U*14e}OJ$?=pcGGOAF!r}QtM{okGv z9)iV3t*zBj_`l!uKTo*-{Dv}<^5BIUjZ>aP|I26pH<%=KK-(DJvd+~1ko^9y*URSm zU-;jfng0a;`@eqW|9I0C!sG{x6cmiU^ECbd)K>yHZ}-T85CZh+?j(<3G}?a=6kXU* zMh4w28z8#>^%wgR)*p4#j0a(n$eFiZeCHVhIJo`LO08`@wE7+)&~wkY0-!SO<3A&+ zJjI{_L1{R$!N$+%+XPYiib1j6ho`_JUX*pS#=ZlWC%~)7=&Lxq_b;P!8WP6V zViVc;I`Y5pae{&eO?$NlbtEg-OMwJqfdo?44llt1+|f6|?sHEP_A_j?N{(e6j4wW>&pkR*-0Aye+hn2~PiqHBcr=J{yzkE`kJ2pO8|* zqp}ek=nQ<*Y-?Yt&h4)_f}E=o?2yj;u>B2K3HG?Blf1D}==_oT6~J^e-T_v`p*2i> zIKm-*iePO$vU87w=eykzyuS!!_P>7$&TEC_WIO1#BB4IIZxpa40B3R>lyupMp2%1c zgU?Ca3>bZ5U|gnC6ZpeCzX*W|sit1bsz83m0EZ=QWJ4>tb!%c+m{ig6zQMawHcUef z5!|{X%?PVdgiq&9Fxd+&gm)<5?9+pNz|X+0S$v%+E^wR^6Dq3V7$8H70;0F|0$ml= zgfiEtWxB}(affOToVP0A?zE0wM2WLp8F29BS7=C{KD#a2a)@g@?7$hQp5yo~S(}33 zQNkD+Tj?bmH@;#EXU=~c1gl}o8_?Ond!JnA;>vz&smo*5oAnRR*pC41!*u#_TrS)i z4F%zV?HF>McYSmX+!Ems+BUU`tUota6!f0tXpNF6ylvSHL|nMKmPx~i!(WN6=(Oxegb-VEFIoLYn(gAy)C&eKHz zH6|x8#QNdG8DXgp7I6=01l)@D4Z|TZg^^fkeYG`0%=tlbuiylm&$75Ld8SJ#npv5mIDjrSW)b>m31wSsT6&}$o#^+x9`w4p(+G&U!;TT2pEbr16YM)m%O z-MWYldB%{C9kTY=6!Z@tu^BW*h#DmqyhLEoT7V$A;fIFoWWh!Rc*09cXdq}Jcue=y zilP}LQiHRZkRKf1fsKbSmiO7OYXE9{39qv^A)$au{sj&DUQOn&@pe-sd-UTywe)yD zBhJw^c{w*W`o8p_PV?0q^*Z(9ct%qh6t5~r70xGqjTrAPxBwkZHvVz~>~NfZDXw&N zKyl|{b2j_>Dd>qhZ5JKj(%Q@%N-PJFs2OGzGVY=IoH)+fw|-kDVM8}76d6R$%ars= ztq0FUZDkG|RLEnO(!+5|{dlkj6>s8!@!b;egZrEE74Lfh>&9v>I%~fD3X{=DGZ{@q z5j*rguBnFJWE`+}mT+K&FET-Zia-}%!~H!()49=_Q{~63cWb^U7i0S`z2-yP*^TEa z$|4sa;$pG7!S`8}+6J(pv+m&5Elxpk0$nScjr-|&3UjD%#Pn| z%X}yn1`ageE$PB!4bN~|5Vd%6+&Fpn|NU24>Sl5gOLQRWU52lc)w%rQLKP3 zHCqbJ`q*$dq(+4>m3I<&LXT}0`vD7c2Q+>0)ia=f_$<1&3>t(W{$Mog0<*%f11=Yo z^@mmFUfOE3IJZE6>hN&ov?v1Q}8n1a!W7 z*4pC(0G(F#r?VyyBsjG#;8f%9Oy`{gYf6dl_3Yw{Ty~y10_5m}Z$1riACDOw7CbkD z^%Y$WVe7S)ntL&vGtb9}_SiHtO9v&-4R7_fu7E5nK6Y^lcDkSg+0py`J8aNYE(Js8 zzm8K{Bq$^H6KF72mVYP};T~v(8b6VRB&y6b^tDO*$?tY_Td{@n&A#k|P2(9aI%W>G z4O{GsG~VVStUB09b;pA5wQYg$3$r^rP;f;z2dKvou{@@11wE7JaTuh>ku)|Npv`uj zvk06Zv>PnM?eF}s1d`hWw_6ZSt9I{IY|c``JJX4w0^4t?9;*7LatZJAxzL!|W8%V#%BO0nk#f!syy#Q+@m(=bw}5FIcb6!L=7oum zYYiyfLOMhE^8#%7Q4PgTTW zBvAaqU3g&(y`)&AB@R;IH(f#8j)04^rNc76(1)1qtRvc#j|2UvgOa`)>dai0dcO)z zz)&PXFLWL~RG@(@^PSvx;9aKP)JlQ{iatwLRd+_%W66T*%s!CeTbk8@z4`}dKAr|1 zgVfwbd)I><({%Z!NTD>?ui$nBSlZgo5s;hThTEl$t`n{t5BDGdm``w$7*T0#DrHrr zY+}GhyXcFHehQ=)06Bw>3Jh(n;)|}u67rb39DF-Ztz;JFkcObXtphV?!}f{kqv&@+o$7=&q#$KlezmjHp_60&R=!3h2gKAoTBIGbb>FiZ9ZZ9HAruK`lHDhQho9DhV!(R*7cOc)gVPt^ruEQP-S zUJy8bB=Q}|p2(5p0-mjI7b)e`eS}eSd5LfE zgc*x2RRm-~om7H`SbvbhnajdIAHOxx1z0IL%P55FB$ik2!N5z)lzWV21XU8>J*9vr zwjBg3KRqF_EHLfMFFiIB!#u^d#J8;u6#7&j8ZN2-kmqM%(z&&cNVd9JAUkwXRUml% zUOS3{Dfd`+B>7GtFp)9IWK`Ymc_kC6@ylD!2oUVjXYpMv7MokGP_C?DtOd8Q)uKq z1N}U9p$^^DdGwSqHfRdvqognENycU2yi%NuiH-Mc{sSzfu5L$3Gb!Ube?(}AhBh`t zm?YW*5f@UWon0-;i~i8n3dY|rQ)m0MmwACC-HSa@6;jbbCMc1A1f*c$8GZD&6KVAx zp+U3yD<U?Wx8_7r}R6{L2pAQwfCE#d7?YXbw zAWXg_;@rr(M&GvPMr>3{5qD_%P?CFy?JUhu4`TF>Vi6+_a?4c-zLKTD$?{ogpbwx#^oDE12GTE1e&S3#k|4jX_ ziIqA~DJS#ilAN_8BudprPhv-5(C1wFplsw;H8w;T#%POPtYQd^x8VVesnIQ<;vdU7 zG$n4=u$LED4EX#w;9OrZEJh$Z^?>M4t50NCmLEEbfG-!;3xm+swuo_f~gDB zA1|YJ=pdtH>F?1qgcv=P{*&Yat-dTx@4MJuHkR#G3lA|KhIw0 zbN1bVkaE!gTfr>;P&wxJ3;mgpp3Hz)5COGjw6vc#SADCm`Xe5!}GUHqN zb07=$&^iYd%9}nQ+)y>W3WQAsn|UC!iTpYFEPa23nZk4N993-`A^dbl()5eQA?2uq z!0M8{=3)t7tfgq&(qx)-5K2!Xa%UfcQ047MP>54y1F&jAr5eKa7Vx=!5h^-7@_zrP zbnoB2DVC4TQip`%l;kjTR0@Hs*tk8NMD5fFi0asu5zE${25})_3M8(qq=czY?%{=* zc_)(w6_0`=+vW#yYxxA8&JaADOGUI~ThWbV3sT$EprhRz`2{m=4e{i_fS0mk_mbE0 z1}=G9i*#ADv(M(;O=^IK&YJpZ*u~q#%<>WxjY6*wY;Q#rQp9Z)ImK%FaDsucj#uXK z(=^9Uc*1SZ-=`H-^BzZ9&Ah_fjTa)oAd%svC{!P5C~aq@!%_-9)e3D_6I46uup#Wn zoCn;R<@0C32aGM;CFNqZyE3F%(ZOdF(~8nL0Mub7T_A0M)=&f4>WhSL2?w+^M0m zxYZaLkH)NSDIYy0zAGwWUHbL-X+D*9oDc>2ac_C`VqNF2DwO{1_{YnY>Y>Fd$ys?( zGjJDSU&Z+Tp&%tC`pO#o(yi2)&;Wh5TbukuC`)Hn|izkTnGsj`T2 zC1i&=da}h?^OK*bboHK5jP%`wLvy6V2yGe2sU74OmEO@>@WNrc&_q72?f~#KW83|L z>N@#y&-_G3fiYQD`hj;u(e)P1!uvnB4*jUdKj#MTjD0|e-upW9r^Bg|)UG!DL%vDB zUe#pF349Ce{y0O->VaDMhD}F133v{wU`j>D&AJ~lDk;`pup>y}m+=~h?Hcfhdqyrb z;kDOwi5?s#yE3g)Auqc2S`xr~`Xey$s7cSbQibSvpHUvb&F~ciys(eolvc$O=5*-G ze(I!*g&`~DW`MR%mcw;XQFW>$E3Mtd!({cO8ys3ah## zlYKo> z7F9a~pKYI9-#Q0U!D>k2IU#}o!ysd^j+Ik&j*B4qX4|68+&4P!BGFWU$;a{r(0m8( zdy*Z9z|D72>j6J_zH}L<-SvQ{cH2kEykk>gU|5RMq2Vr6e;g-4e5IEbVmk21C@j z|Fy^!OL^nR{BQ#5BIUO4-ka9dKyLlfWzHx|L*ibTV)-PJg2FVdCUW#{=gmrIGd#1? zTuQG1@55?wBm*G2dM(6#s(9c$CD16QCU690{aOK#`k-6|YviLvi5X05+CtPkt`sj| zW)1*X3n{Ds8tGfl6bWE7GdkV}l{N@(jSm4fxUukzb)H|)hW=(8Lt=L&$>8)0RL2={iKEPd^`s~&KV)P}2~}m)Vr~;Ma%w}yq{JrN@WXm` zn4^v)zx9JWxtf9mXfq&1*^)!j7k4A0$Jma*cg3Ux(IbwxSOsj7y;&Xjm9fngdLFkL=|{jriGz zm5WWMl&&1Rm^o36LNUmGO)q6<_yT(q*xAi3((Hr$%+mvTgKd4;HHx}?2{zOOx$|%N z{Cb%t1#|F_hXOtuI7tiv>zC={!FiWSS3+HgXWJa@75WJ7_k?iTXGX`K;E?U`%b@%| zAfI`IVQBGaXPU%EvX5H2X+Vz7&-9cjlr}z<8Tw4nmSVx5(Ji%lR;-JCuZe5ewp|8t zZwkNA%*=`8U#FjSgS8q(Z=Pt$poQD2hgPRIUpjoFF;^WiXqwed{SDzi~Z>p)VBCv8tN3tsHsBdni1n%KFKI`N|9ps|ZDrqfJ*{$L3^r-e22GRo*~ zk96gyK1th+@g@#t)Q*$-j__`W!U)kn)(7!~Te1-z4WI#k-UNU3d<2J=M~;SujncBR zexCYmsad?AsL`JCadJk-OhV|2FwDuFdjKOZ2LSq{nBPqYnZoJjvulq=Ef4nOoP>ie1Q>JF+AWD75+>U$- zgyILpKc2#J3Qe_@#FL*(T`UEjTI}gAO_%6abh!x6yXcTS?r6jLXL`po zfQ*`K7m|lJ97gps|6HsJFMRd+VWfP)tuHT&Qpdmtf#*SN14hxx%HjgO>T-rT4G%_= z3zfa1XrgYZHdqm7@Puev{z;FKsJ(+0i=Iv&9T0%DkG3Mlf5Gwg=9dr-v^`P+>oT7$ zqJ^w5q9%~aI9Y4V5~oI5tufCC-0Lw5Bwoui3lIA=k^;PEBpNd;WGe}7&2R!ADQNc7 ztyN{na93cl)8w>(D`htYD^ig%M0$;)kcy{%Dd2}5isiN@@Y3BrS?inbL2gA{b@e*M zI}HSRIuAMr-v{*yNyTpH2OoWMlfIrFBBlEcj|r|Ak~of}2DgrR9&F{syl`pjl9=@D zD-AY%t6c=UFqkGW^wK&zG$mVcO30z!M5GQved-gP<)Zx19Y5)*zXeW%4#O~hxYNH z+d8cI8}I7YsdkN_Z&A)D$=U1@CX&1#E#~`YgXgTHV~sptOrR@Evlj5|cQG=`7jP8i@wm*OB~?7}b2yk?G4N&_)}2)@+r zO~85MKUWdXmVy^+rhi~40>%Uah6Pq)KBEhJVqk(;hJ$+-@~#^|J>cOgp#?ShPd!O zZks~wV9q88b@M=2LJ+k73tT3Jyjw z14tlKL#{xKg)!7}WBQLo+tGEoQ|2Wz`)GJ|5@G z!DyYHT*jagguh)Y8~by3PEAyQ#RIO=P<0QRGYe<>nM;@hLrT^21U7Z->OeeMNdI?H zn`lsIuP$TIk!OVB(U9N$P^i!cH2iTOcIRE4?tYF(Q?W^%s;|`)pAC5K*8KIHP@k#V zCnvTIG_DF5k!0BXIvIj$e*_u497$ZfMsy~(Em+8DBA^=f`7HQoZhpdbsJ^v<-4(25 z8bt{`%}4wa+VgM?bfJka<01&f%of=cz})r6=Cr?T!HOnG$AF=qPmXe4~RenQ{q zmM%6!n4~0ulj&IG@`)j+F58hn+Qva%o(=XI0YB-RIP()jYo~?So`d`LYSm(kE48Kw zJLtC35LeD=sis>Zbv)DGqL5>3`t>ye|H(HuC-JPl`X0o`f4=;g?n>-r6pnudI&q=k z+;F`}Ch)n9p~J3x_Emyb_^L|oJ4WFtrOVH2?LL-0M%val1zXXh0k9;XvVzHi} zBP;B|dEQvHR@{;sxja>5bMI8*A1%!OJ}_}r0AfM)aOM)hc0VD3I}n9|N0Ubr*$^=J z&~`sAYDJ`gl&J%1i~hV4(vG82NuWhLgG920!m#l`z`O!k0wuds(3nbqX$o-;lN=Apkfyd_{{pLFT=al!=PR!01 zRZ#9_rb>8z%?R!i5+v^Rlu6U=nm#(NMFzL-S%^Gt^Tyu?eo}0~Qn|M_;Vhdg#FZ!KJFSm5vh3TX+P;v0=;FkqQbKM7qtkn ze0r*7t%oOke>Uup+!6djKm_teMkkegV${;9${(Leifhg)>u%Cw%XG@&^GK7 zlD-B)awzpob^#u>cXk{u%`e{f5qQ5uHs2fsvOO}{2d6^3nxiRd2k+sHY}6cyo8MwK zq!Y`(bj}H-WIPK+lkI{m3&BDy8F>bLw}pyUI1wb;_fsi@2y4<@CtjY~?urn6qP+@NckC{M^^qO^l+3SBP(p-&;I?Gp6;CY?EZ!H44m!i$Ck@*n#EE})E& z!wsYagP?MG6f-z`Had+!?lj}DDesIgSAV;i@OycdA;6JvYz`Pi zlJ8gR>PXNFfs;Rk<$!Y=`SqI0dN5aLpT$;sON3C zTxtu&Zt3wUWtO-qpxXtbvg^70+&9_>s$W3_6>?->j)}lRG=(_?s0k)Mxxz8dD7QBOew!|8>TGra> zVmG1)HPUDBwLq5Cbzb96JZD>IbGEwNAG5c{lb*1OS|q_Be5T|itJ1J4KD5i4>Yjm_ zp>Mfa{ z)Aq%oL$&t;^F2IQSikL#F1j!H98JJ{M|E3*qyKTq)51Uur`NS=w!hxD{7h5*>P17JtbdCjcS7Su^rI-8~*`WK5qFe2$C^(BwGNGx?2mL1?-N5I1& zG*&ABj2{ZJEesZaE(jj!NYSG8R5IDw2P}U)1x6@3?0A`-1b51MD9&s&Q$aCxRD3YZ|L|Yggj&R(&3X_D#`TleCL zXU}q`+P@2H;%@hryfU@E3E`!`deeVAvT={FYaD+MW9B98QlFExa}A@&%8bj(LNJiL zMf?~=SBwE`JV0n;77KFH}&NHM`E7oSgunVaU8zu?JrtE6w0@8?__tghH zLK|OeCh2_p)~qf~fR`KtaSYPCN-9)5(2GTl5+~dl-3NESVAsgvQS!=orEmrz*ZK3KJIr5=j5dD@Hdgy8Ep8c6G)_Z*x=PAMV@{@lzUNtY;%76p!b!N}> zQRVi;Ghu)}p`OUOWr?X?T_2W#7uzalHj_uOc#tdh+k3-;dBxAu7H`;CaTAKCTtYoh z8);$JfdBe1hnx=9#CzE!1$D1h-phuk+mHib>#}J+WaiF|NQytLhq{8+xs78UC!ov z%tmLVNaJ+9=+x-mGPQsN=L6Eleqy`cgg?2Chel9YgJzuL?^6BG=|Rjegbb1?Yh9EP zZGqbjhCv6GT%%p8ietm={6US;qSvtZRq{_p^~KvbgYuRQCC3X~dI>#ng@D-`M5AZZ zCF~e55BN?cP1Q+YVH8%#l6XSU8~VE z95TkIQBK05!pQ*kpZg|#-_56~_kN)gsyzE8>ZqN*|7&r~w^}?YWzFcHhJ_F0gd_e0 zXq}&^=A%(mo}S#~eUfJfe{5 zEnt>pj4mtlE@9z?n09{Y7<#^YoOud>QLr;Ta<|<7nBH)H=WCz2xscM!%Fb@jpOVnu zE4l$%=aF1&7vwKY$Jsfvz3Y8oOt)q|-MXSJASzQek~@GJ5d;t~z0Z~cQCLVZ-w_@9 z5B}jmj|jV^ypei)tt>2c>+-y`OJMtW-s6k&VgYm_-o0-sD``2+E%pu=j0>IA{P<|pS_wLQ`twdNAF?TzpnrLNVC&~vS)lph^i zitt?zY(cBFN}Hba*t?*S`CUuNJ5yajum?(3MHrdb9MqO6@Sqo%7Gd<&9Oxd-qG|$fj@Oi8%hJD6@e+434r- zSlcd$(VSurjKPPbo;t54KZ!&ztl+UnQ_pVW>^##eEN{k*+KvDgm4Led_Onjxl9^{ z#7xYHa)K2fAw%I&6}I#unYP;8wE+ODn(ulEVZR{$9bgZ|U@-dtu3RR;E%ll*A!mcW z7U8I0LpMFXyFS>Qe-U%Oi?8cEkMht;Ru-wX)^O~Cp?8V9w1}%++M^Sbf(B8odd-|p zo;3jj=ww{g3w&PvYP=UJxMVx;y zh1N3zY@E@T45N?$l11#rA8{-e=Sk?j22Ja&339!rQUiqiwr@=Z9xAVT4p|fzmr}mt z&O4QQlgD$pPs`^XL|jp!)eKbMREc2oe)c3ibF4|VSb2n9%RR&OH(1bEyY2dkb~sMt zh8fD2ecmos;@fY2efiqzyWpOxFHJC|y!Si(vz=a$kFSrSD5pP}@Bj4S^KkZ0N} zol2Xaxhhp^YZcd5nd<2apyIr#5lE{X*(WVzcJt*iuMmu55SQ2^!hTZj|!+ymw* zZ=tC7K{Su+r#cVB7cZmVm#og2xSUe>jAAXb^BuGX!TibYNlW20$@Pp~$X*0Z6_M{&SC~Oat-Kwb@Be zfXI~AVSZG#P*=27XK(hnVH!5%o@a6@MJk23{Wb}B$=o8yq78%GQIaA7g0LjQ|9LP! zw)U+=NPQog7*nRd-%U_t#Tr^2Y@W37kXr=Qvved{8()r(=7@?szXEfw=udG6c5u#9 zqTw)LlF2bGNPMyL#51=0vOKXkxy{`X=N<;k=V?8VFCzcQPQ5=MU9UbjE$*!)Sjm>y zKlw7jcxzKKX0q_B`Bp>Z#B~vc4-`1)H1!t2r=h?p zE8hoE$MTfQVQb*e9GYK4FQAX?z1z4i-OBRpHyU=3!>%1_Uucc)BJr1RN$xf?Npdkv zwm*73^-kV;j|%NfzAL!Io=+M%kvHtz4Zus*X?tgH>{s*Z2h7ZSww#-rQnXr|@Pk>Lt ziX3xX6*SpvuAzDaz0;HWo}2e=yzl9pLF3o$*-aa zmQFmS2uz^UobR!|%N;pU>A&qo*BaMVeHz?g9ATo4H3qweEI?_4PAOi?Kd(P{; z?(6R7dB44%{P_Wx*#EWHI@S@nYUm>xqjR1+Un%!vR6Rj@Z<>?BU6NP|pyv+9w0dTIg2{(>B*q;>J5D4cOQ z*;DBy`*+sc?H~E#KMebg19I*10*QGyn5`%zx$7lK0?l>D+e>~DBJ?cp_A+PU_mwv+ zu=@gi`k+<()@eY%Jce!>8Gn2(Ex(0+e(brGzK5yE|Msj9-~Rb)7}xe5wQ;oqXSXbp zmr?sQk%EP%+98P7>@Uh}KLYpNLsH`W?^;3;Wj$!Phlxf>BplCaY^#tNWO*dZfzR$M z`?>u2)!0E3nOyUn^NYJ*OpbY+2;+Qtwmg5F3deR(#m}xdKsr2o4&|3MyWsiCx*v4j zO5c(}ymLf&JIWgLijh7Kupb}!SECb0Dzcuib%l zDbkh^CTTkaP#>vjLy~uY=#r``n}FuN^L@bo07;(3HuHLx&R^ABkb-&f4jm5ao8gQ60t&xF|Y%^bYclL_wbH`mnVfSz9mojz9`QrXdSNqSK;VlLZ<(=dtWCggtmF{5%t`N*5 z!f+j!sVB4T@;X-WLKQxi63@)^UY0gtFID!^&0Nzitd=_Oh41Sqm6#ZN1x4# zpv3Yk$$G6|3a@vHy83}Z>RW?U=#z9kK?Tmk6eb~+XVrI-JNuNDGE|$}Z-kNx562(z zd`w1Odf+hRd?Wq4LMw38YE{FmOFN0um+rS@oBtlUB6qfJa3z`jgxPKy3soTh=-RH( zHc$))J~u?j2lZkk8zv%+4g`(iNAl{5#B?eLK!H&+FE&8~lwCAYUMUTMoc1)wK)@2| zhaCrrJr&_pO{s=_I*J=qUspWYGG0sXua)u!yy|2p=iK5zyq-4_&r*&LUOkln(pCT0 zk#205@zf#{No3woNJ$(77)rH8OOIL#{*eFVwcU=E zVVQ(X;Ewgs!z8zLXaXRS;wT~SVTWV%bh!gwO9&(yGNQ4Euc9dzY)QY)f}=qPtU;rcn3 zkjPDJ|5Vp>ED5Q4A9SjuaxqN*-Qe^05eW|K{8;l$M^s5@T2tSIJ}RCNj5I;(QXhW#&KD-$%yO z(i5u_BVcya(?OFPtwqhWPZZl!Eo9aMT?-JEg7ju~R5L;CH{4^95 z%@xrVQo3NB`O8O5oo`!Sn8Y+rFrcLnH$j4Dc|HX{$?AKPs~ic1*n0+^9PH{Q8>iMI zIVL(bv59rrQv|t`_y?|;xp(kI^gLd4myKy)qB?6O-rrWwyCjNA%njH^ z6gzJi4fesjhiWllL}`Qw)?YQpga@%;6*B!yxF5^AB!)(8CPM1X%wAj*iu}eGh>{FQ zO7vsZMAD~l?6+Sz)s9JFTQa|Z*|x3$9f8Y9pTy00#IZpE^fZ*Mh2mn4W-z+I?|nOs z@hk<^M975T#O%%~ydwG-TvpR^1~#HZpqDjXrP*^jMaoE{V{=WCu4LUao<7wT%z%Xk z{O~vWPscjo&*7-+D82;pEB+ARldlv2JrcVcDC=MB|HyEvQmJ7H16190{|QgUG&mZ9 zsEz3CdE{tn;C|{(Zgl+_%-{+D_kso6`>Z=p@TdQ77x>9NZ=Jr7NpDTyvizXirvf$F zOyqh%_c>PKfi{C0h0<~VgALsIRKYD*o!NH|%oP=}4%*6^TAXx!$D3S@-`{iOGV`w+ zn8e+h*MeqI_FLby!mYmP@pL_%qS0AU4H20@)+LU1GziwkXB;Ry{&! z>+?tQb^Zny#u@DxojP8ymj6ijnB59EkP3qYaE-$EK_`HfWd4>JvcGn>Q3q3rvtRqs zGO#5SLYkVAI<9e;eXH;arjz0!b(}nV20v&yfCS^Ks%{f2M#_P!64G3BQs;lY5>7|S zIdWISHJSQc*_D|5{Gyp0Pd!&YJ70;NyK)uM0TN)W*mJDvvHKEUYDQSIvUr%o>{P@_ zrB}$X1j!|iBylBT{ACA>JO+QJ`jN*UQiZre1g$`LwmS4y7}F0L)wvLycXUbfm(0s> zSAafKx;m0}h{51yzvHN$`nvDMw{4%8jq|5;@Uj%{t4`%=B$ZyrH)-*LD|;pT2oMS= zT?L$f_@5iHE+!ba%!Nt1s^Tbp? z%A07k3L}B?@3#~5gYnsXaU&AHXktFKtD(48@7^Mt1662VLocO$8bBh3pQQs{@U?TR zTs;ca0qRC!?afR8L=1uQX9=i^f^NXEwuup}Sv+e2zTa%0^Pi!-e||=PgM6PE$K06P z!)bllzSj13c^BL=A_$^o>V(iW+>T&9!im0B`cD97o9j-Jqi^&dRrYNE(m(ni9H#;u z(GYI{bD?hDp>}u(%s@ORz)U*bb*;CjL)lHP_hg5U$)Bd+YlJlhi9``!*5U8E z8S#Jn8YM6e4Zlk`@@;2T@tg%>*Ti1d#-fOU!3`8(N$CS(T(Hs&ER(f{KrwIvd=IU( zxW|$I1LFDj>w^=dJ$$d4v<(23*ZWTLG32H!=@#z`)?4LK2lzRCC*Q-{@@v?u^W;)Q z|Mh*k%ih{|?~A8%u4uos6L4LXIRP6gDjj$x7=(sUd-xQv>zf;PdL^awug~MZ{leIS zp1opjClX8x`Cn@AfBTdF;Z=PKdNyI~gnMU5>ffWg|Chi0AAZAM|Cy40tKfI$V$RL@ z|M^G%^%`Rd^N5ViF<$&vwE6%2mp*%n_6hb1|M4c{|I)n4{9pdU82N4XBcZT_|37>r zNC$JQhyU;I|KA^8--u4&pJ2`1yv=wL%H#JH3N+7FyQL-j439Z8FbIMqrSoRZF_Mw! z<$Vdp|LYeQCUi&Q;+x743JsIOLD?k;01S(?cxCvHvcv~1DqDjSwP#vClK)4TL5UH&f^}XfL%jpC;b?{dH=)2kRZvJ z7^43fCkFQmb&w+W7nnE*h6r^BWB^wI-_z|b!Pe6FTPbd=09UWL_Z0kMDv!HYZn8y13bvCC6 z=0NQk;_IXSkQWHV^As_`IH(g8Q!~Fp~QS0B)!I@Hs%? z(@>ea;()<)bO3y&B2R`v6q^;w;THj|jl11&O$99XkpY)-?<$qZB-xPE}vgtzv~{wxgTv>&8*oRMS3+_PrMH2hjR5cZxGd z@W(EP^-{A;CCY)Xi zP8Wyj9#ShHu;lq{ggD<_jXd82X_4xg#>;QdHIoTe;c7*#qPB?DbZ*7Mz~Vs+|EJ$~ zD~?+6&050u<@HW?e~k+FHV5PkuGh;Oicg*{B-l<`&U~4%VT#@IS3Nvkq}Mc_uwlZ@ z2!Lm1*@J2FQk}}JTeQZEYR&IMgA)_a_q+ZeXec@Qa$&aJ3dQY@^8=P@&0oN>TXgk0 z0%);f6#O9c{sA}XqkhFi;pEa)+V?GA`ke-XKx?y&2H;5W$mmbEo@HgyTnFD^`FG-njFRpY4fXrNBof?)DQjpNjc1N!BQ*IX+x|!67Ui;Cxk4YxaUjY*;CN)hr!3pGw zUXnB;pPPQV=O-LJ$A?iKhF7gk8xh=XrxOcWiDZg(U057X{8+)Qxed_DN6IQ?`?lyA zhoxr@#XdN$+0z{@Jr80_w&~!*e zJn`Z2b=yLFxeMlo9ix^LdlMuoxkgm{<;F&Ew^-o`?;rQ?sVw3#T)mg0vK_1Qz;~U> z8VuQ2bR5P-3`8xg`9=JiDQ3v*wEK3ZGdqX{pRwarAz*HYLSyVHZeI}O+Pt~wC;x^% z533w#rkr7T38L;X>=WUeDDkN2Lpmw_3RjYB&jnjUpTRZ5B%+q%=yQEaX@e{K<<9gV zj3i0=kF6gW0)ZOZBAc|X&LV8=bv9|PW1X6z&o^g#T!@g(rT9rJ#T_$`fi|%#OT!lZ zSgDxY47ZB0HKIdul8l`O`^)|3lieN>)!fRB+_@Pi%H`*3&HLSFmq4Wbvi}g9v+7yM z#iR?SaxT~~TWdgS7X;9h2ZVL|e_2y+UZ7$xeiPrd_?q@JoDZg1ic1>ObDTkZ`8za` zvFHPoAH}Rx5``$g!DD_{J(DUcC$tYVy4=Hs8xQ)N6#P&mGu!4GMZsnu9oIzYh9Xfb z3-55ERZyrjnBTOLZ>muHeV^D`x}0fbpR9x_Nt(q9Ujn$|K|W6jBHhc-OWgx3Iv)MdZox;fa6h|9MvWL!pEJw}$?V;zcUJQo_tw*n94!G}I|zAM!OWRz{hNdXJkGpu zTIs*^B?4>asUC6GUs4&+ax#d=I2|(D#cFKAqOgNXHe?F}^%f}mR&=~Ty%<|CEab5r z!x@(l>T8xv8$|9A-BD4jl9wolu^Q11SPs2l-ZwL#vK|he zbe&6rH!$Wl5E9qVeVYGYMzGU+8xI$UgSNIDFv^~htPAM&~$ zbR({+o1qMhLkyoCoG7uru%%YL98}`KVl0L(27z(ozzSpw2-Ora7T+T-Mr{&xZHtnJ zPzE0@uYfRBBbKf5OU<&;DazOZ!0egPlaQd&9TZ=T8-4##twF5CQ5BHyrGcwP6pC4E&y=ysT|vg`;=vj1z6tL0 zsAyD@LaZO#Cm7cER}sk~sq&nm>9N8K{eED%6Qlf#4!CNgcqs1YmhVk1$f8=D)?^A} zQ7ZeUz^hUG@934FCqn0bVdTAX@9yK$_C-oHq<~9oEnvu`RtR5y1C*t;?~U9bAWIIN zLSsg$N)BF|<~&f+Tbtfv9nl0JnD6!Xx7&aeauZy}9v@fUPkD`Fc{Kw=lw!#%>rkLA z9oz)Wy;$cWL;7#~w@#)sRC?ATXpFgH!66wysW^YtB%5!0-A}`N8V0hkY2-LxQMPsy z9MTfs7V@;lBbx^j6#b8{zQvL=+5LYX3-+0YBW`)2`z^+aR*yOxmZs=jJ zAne(DG71*DR{OvvLj6LzRZQW5CZF1KamVretCAwB%O?hiinCUHg@4?mQomHntDRIg z`E3dlyx$q=^K%W@5!EfQot{A0ybHLb&Y3|q%$xs6x4AK$HfVEN)UX+*Y$03j3aQ+? zgKDM(jr0EH626sc%&6zLBi>}V6hs@=HG0;N8I%0 z2XMSHN6@cla7B7aVlwTCjT(KE?8R4s-WkBQ|&qj;=tm>UGGLjr?684swoCB{GIvATgCmo{=WYtoG5vRa5w4Nn24Redbzduo&F^|`b-N`{dB zLwKF%Z(#0~p8k^K`0ZUh7r(HDB7QI=i)Oey;2h9T{|TV0c5WKp)O(Xd?v8RdprP{; zkL)r%1w-R2cG{MA{)+CX6sGWBVndY9zy+>?dg?k+p0-r;YB5rgukebL4wb!+t$ zjF!MGM=2Tt0)v< z81u^U9Gz=YYZ#Za zX)Hc|kDf~@SbNE~mchV_k%AQL9UXJyu6x(pB*-Q>*~SZNVNxcZRqksRROW(AZpKOJiWjF8tmw^*xdHYOSk&jrn068XRoBo^>%De#Z``-)jq;LIQoDH&6>OLDrr zC;TCaJl}T11HlE1{bWapuA>-%5jN~ji1-Eeh>VoQOZL2ZLkf8mc_Om^%>B8QYyEyhS3}%j_rfBDqvMXTraJ4<+jGpc; zSpT|jyP_NV6=i!>v2WH!-_=sDgmJXbrtvaaP|w@$bd>#!{e$O|SsJ8`_(Aa4{-+il z?8pbM)ePt?D_49rXQS*MTmm!oPg6^~I&!t|jy726b`wnGRk|gAlD`oH z#?yG}LIza>7e@-kR`f#Ew@Y`UikCFmq@%$AOcdjd7B|-sV zIc~NwiosF>W%q^sy)4FY_-2ZB><-hpyF0iAmZp5^F8mJtkpJ!wgi4R04uL~pAFd^H zyUI0pgq)OUKb|7lJ+fez(ks9>Ob6uyGCN&3nBaEjq_g09fB&+=(r}%X)n$oZjL_f| z7z83l2D7Na8l^gVp)%mCta=cw$*!Ep$Y92z6d(B8+)FWO z++dzteFt2c%dcVRO^u;%rVHp5qS5y=9S`9Oi%qA56)Ma73t@CX;%NoAx%H_ZC6|hpUT{b4IbFd3 z+Gqh&C<`ikTK(I;@M`lDC@z{6KXqm|4T`b;?9@?uH!w^VBh6};?5|F)_d9`3{UeSPnyr%s-cw3NBav(fP{P>SdSrK6%0Lv?=FDns2RUbOBlAS_yKFK zUk%~CNcMI6lIaA{O^&+XlZH;(_2W>!&PE4Q1mOa-wDsfH67*sBKhz%)V>P(D+&>0a zU2&FH4rAQ`M!;K;Mj9Vz=k-sI`HSM-tN!D$N_msJ^EeWGdXry)UDfr0HzY!YAwbuye2}|kXq;e; z5|a`c=Crd#a{zdkGC2j<{qYG*lGyTMuYAF(!AwLWNyz+*XE3gC#Kr<@Qx{=ScK&a7 zZ_q*#7;IJ4WOMrjf~{}u+r9!jI34Hv2(wu*3zuMGk38#!$fxCgE1r8IwCOmeg&cMc zAVyR_vqnd7le0G8+x{d8ISO>icj!hQtr4I9cAwd(P)5*6$1_0oShjMxKKOv%HunC@ zYV=nuKBgJK{eC!ts_V&c-Q-Jqn3l7tukkoGzUn+ZOByaIn&Y!CHDXhoRh@TG*iPMe zsJ!tQ@t|v{?cjG5u8cz}Ly!l%FWXkI%p-_YFqHLi;gNw~^BaM+AyTs5HSNi>#7YH% zSJZNKd4?%Kps<*2oxNP-co))&BBh{Xy;zVej77;N`Wkdn+_!vKx5-v>V9z4tw}o9K zzY=3F2@ip($_ntye$||+748SD3YJPOu*@rhBXCAi4zswXkz#ID&RPL}SxG2YyLC{df)P^Z)1`1wi*GbZI?o zmpmX$jX;4g>Md9NtSrJ*j&+F?kDamz8-L1iN~G>Sc4Wqymnb_l@Pyjib8Cd27t}Ev zO{LgI@2YL&fIAzM^>-ybkbjL)@%ez`?Em786Nb`a%7ekU6Wu);-&p3dm=%KimVD63 z$R6bP-KhFB@8DGsKbf4_`@nP+ZjVbO4qmfsL8C@4@{ts4; zm%VL%1K6@QV6VIX-2xayMLm`^iFF+dHdJanJDg>7G`NgVHu`h$=epwwWg0(@@EuBj zS}Ycw@V?8Bb5751h2UqSwzKND;w5~kHZi}9 zC-{6b7lQT3)4}JtsoBnUt??7Br;8{PV~3x9IHC-IORfD*_WOBwKs&9ResGeP-}Z$2o$Ll$-{ypp`6AJv*>v>H;`%X67YMmpsEr zD^{kyd$*eZ)#of>;$%mrC9WEqcd2IMkLR0VM2aMvgrU#F%Q^LA0nfzQ^pfE5;0&CH z<6&-_pYXNlw21R$HaGGEjeJGmvM!NiBi>^2u}!O3T`xfgPo#;uj!Jd&auo>z8fq*3 zW2&>3GZ0w4ct1?>Hf)n!DRG!#gS8a8n?4}2TP~fJ;Lt47oB-|bEmT{ZX);fJIOzu&1{$M>FkorXo4{Qb=+rv^x z;xn3$1bPjUa6Xo3wGXf-DUSmf1AyjpA4~VKS2OY@YlJPkQb3dRB{FE z8eH2DSL38zBKw5|p=>TPGC$hx10>(sM94lrl$77a7-ujwUuwR2@mT6)e$aYy##S|M z`@V4h{g@_|Is0o#@yWd;MhK=poVwoIhH

    )_m}-!tSIzhFRr;8>lfh5SytH- z*1Suux2SOhHN9!>J&sb^U8W^Fx??c5Tw3e?K*V{#w;!hux);Lt+R<||_#GQBZQwkM z|G@1^$5TJoSW011X+PTPv8%-Pl8&eN*G^6PFRw1=#44GeZiFi z+!~ensvc5(a$VlI4=Modt={Owef)ha2E<)&9soozrkujuq3eO&0g{bpIPnH1H_R#FZD3RK4{e)p2{{MEGr#>2| zoz#zh{YIGu-~vOhM%6SCD)hiRD(H;#V%y4O+y=DY${+0!Qqo2f2@+hi`LniMaHl>| ze(A>bO*IFFt-r5{@Z+P?+{A%=k5AD>63^LP_&a#3zXTzx`dM^9#ja)@Ns+QYF|%(H zL?cSMbBin|K`awJW_TU;~HR)TJrwB14ogLbg~s@S0!$XrNZPC`Y@TO|W`i$O$kodK%_FJ;S*1V@->&c5kM$bwg zz}8Kq7S$-rNV5x+Zk()j@CeTfWWN!guS;9Lleo>;9wz6N{?;%+7~gY03Of!%o+{M? z7MCo(H^y%nMNj%-E9N6H%RrD;18VZRuJMa@nXArfn7Xq!b&t$|_vUMtj!}ZF#w%8} z=RcpbC?qC|KjT)WG}ay4>7R^_5OsVQoK}{KV?}tWt(FkF2aDs-eLJAU{h|K(cOTJ( zP6w2Kl7T*Tz6e*aYO&U^(kexw$1Wa!{>9Ip+VtD^K;K7oq!;Pe9%ezWtF_npX5l5QpluLLGyJj zPP}q&v(stjkY)3@)9ViI96f%=4`6?#-+&s#^50s++ck^e0}X1Gwkcf3=G>Ff?V4Ur zHm-IW+Bke8;Rfc_J1PM&TZ>C9Kn&Ir{MWG4}4g}%=itz|x>0r?sgPr5oF zNWXRVVw}j>|7Xo>yHlSb0SCG+H4;h2(`ol6z@;J5rahi%H~nG>Hs+p!mW6Ju+8>Hp z>9QHs%v^Uk@f~$n6;IZTXOmHg{ow=O?3qgY86S;whUj8CG6ijDcZoLD{AK9-R6(%c zvqe0`=tGTKoMDti=H%;)u0Bh*!`W(OYQA(9q4e-#6G%dz6y$oh&%-E|IK19rl>d}|5aIctOs@--*R#_D1xDyVB* zP7&y{%nd)D!~smXV{fE~-GVVYm-T=eD@p77v&ZFPX}H7I`lH2nMGs$OD)^Z()ALoB z94{eM&*Aw`!v)(m#V@~M(@U#+mLw-n;!GE7eO zXtV@|LCtB)S2WL6!Lq1PY+b9L+y#F>-X}rc(pobF-}IUYtgQKe&(a{kqad2PBiHfm zy4l)2UKJxIvPOHD(d6kSR*+ zT{=-@bV*uSgltL$%A}^8p9%=5vp}3-R>7Xz}nObB@C1B1k`+gZZ0Qgk7=1bA)rEu7;{^hSuBl}YyV+t~= z7tzAk(aA2e;XPQ!EO9R5>*uo7j5+CeiQAdpz1OF~P*@2=;GL2&L|tAwUcN<`ApF!r zL$~@-uAXCvZy4Bpp;qBeO9Ab8T#I=X?WXu_J7347jSe5^9maKqAGanH!R}K?wU$2w z0t=o~{ZC>`Q)zC=J;ggsNm?%@#-@C|LZ}gM!Ln3$&umR<=y7IyJSWe!A56S!z~)mW zE^<>43_3mMu)$}3FzVS?X1|ilKKGw_JaCx+Uw;q}QS@laM%)@OHs9L~JFsyK9~)K6 z_@j#I_YwrdYaQ+u3bn_nKkn9Rr^Rm1wDuQJ;W#oiPx01x?#1JkP1~U&y7SPhayvx9 zk79f3K_35e51Gith35vQO_KO2Kk_7vS(opwYrQgjAW7A(&;%4&h8Mqjj=|znNSnJ` zijkBd$9K0BBl>=O0o4RbBv%yut{}fC7h)Eqr1U4HIQgYc<9aXGU1B8Z5TZ+ZvlwW)66e>&CyAFZl2~A{69n38r-$a(~ z+wtXlIY0Q#d~7O)jt^(IsI@`i*$XCt8jung`pmZX-{!ZO3QFDUJ-w zfwM`QAi`$^ODh*w)~I?3T{sPn1BRqxER;RcDapDU{c0 zh@7<+MTydVLFC&0S}&1^Zl;yjxnXW&Ph5rIU`6&hGeq<5X_Xt?SiVXJDeq@NeExVG z=#up+{q-V8x5~C#OU=4ewN@v$PpY!a7VprRMcpA$anz%(g>wDAobB+m&8wPsToZ>r zzYx5y8>u3FGo@29Y`3P$FHP!5MJA=~Fi;|gx+DH^@NE&0sW?juswrKA&E_NQJ!6up z@mmT^zg~SbcwYnyKajrB!7SPh!1371q;#v`M~0B6PHddsRUY<|@2`IOVbr~44xxH7 zTztSZs3JkN>OhcM=Olj2_4%uPJ}wG{HORMNqOxr?JpyVs=xXhI-I=@pG)xElE?sbyUJr?jF%| zuf<-l9LMIK?GbKn>9f>Z+=ur_Mf?!n-abI1x^oZT$4JMqewrGh!`oYcopj+qj%XckiasN6j(RpPXT zsgk-J2}=8!O1ZDqI1Qc${x#~HpI>!>d5Ug@sj(y71f+wXe>nZw>h$MluM51oBEqR- z$TG^?;hnWjdP9Ut`5TXg=LjDE}ySXQpTZS%!=?{L#f8S1pcLCz($TSVX+JT`!X~Wxx)#9{7twwc>+B9Szt}Jx9&_r#Rdb@C^hic#RD|Pb zF+)sfYev_)v0De`0^V7du;t-jQN^#sanc9_&7?fOxo@M(N+?9To3G7>aIu^tOh zVN3=Ai}8Bb{PpHyKf5}@U2;96iDix8V#lR?cTSE)6Y+FkWdpAxiJgSU9ZUanz8 z`(0D+jy$g4G?0A~N}2kb|1z|AriJNLr=+K3iDl>Huk&3fXngIBJLv1VFA7!#Vx;9~ zTu}M$j8wSh8L({_DY_VV)lL+z-}K6Y3vP*Af0#tH1l;`Ivt&2DI%PXKIsU}_Iy~cO@ z4&YducR$`Ma_ert%hNW!myY*j`PM6llELQml5-^^GsIYf3O~Pc9H+JFNt)-k+vk0r zx1P5wbD0=kYr}=R%nBtaYCSkaH@|!l0fvk;!u?B*UL2$&zvGWl>npCT&ohR>qef3N z>u(MAlc+~lemX#&FYot1mdO69ZLj9BL_=wgL7L{zf#)q}!Y@+39(9B-c7EMs6El8o zl32-|Ba4gYr5W%CjIbI}?^*Xl1H2waG`gsfsl?vQOL-8>;+!=D)q!+AoH+X#_Za?f z8Wm~X$jWazslCHS=aUA#$4MU0t5$tI21`A~+H!Na@Pyxw`xK+a{*TJwhz2!ME~*mA z$%zVIz^AH%r+yy64bsZ2Dd>G-T;I0%+*u;zSwNq>9@N<5YWfIC&_zTCl`HrO0(Y2< zh~M$k3gejGO_rFgaZ40uZbwnyhhL2ywA|A|BkNphdYifBn42aWu@^jT8A=m1Vsq z0N0~WWmx1DsW#=By2LoDd!a?tA&2bTV74QV%i80Qy?-`(_lI~wYnNuKY_VJqLn2Jd zMgMHeOGH&J`E1do-aqMMX8^|=#hujQY-e5YT}dlZQG5Pz6RZH#D1>)UQ7!!>^+-*u z^EE1)nr9Ms^^A4#0L1bx#fjT8L)i4Zuy5pof%vsZ{}>5LM)I3{=6GhA5LGyq=8|ql zMcoIS4Mli-jC-$0Gf~P#IdL;SJnecv@d2AsVfNDxLvtP|IeT+WG}=Xtf*(-&#TRbP zVs3%$fLif}R1m&n_o~}xc_#;&464BkCY8r`i`d#jNpPThIIUiW1UAfzh7uAAR(0C zMXLK`upgNk?N-w1>K1P606{F)b9fiX+}pOu0%WYC3B6oJfV??>ekgC&)>++p7fgK(^N zqFm#!r{R`mz>y}LotrIt>|~g6({H|VpwTeawRFkGu2oF1R}>c#eW^rsG7PXCM#$Ap z&O!D8Dga0qWTEt|9yv#IHAGadxZebn##PxSIi+`*7#Z7hZU_nnCtlH z$W~lF^no&*a}nS-Q+Xm;mQ=0hKi$x!4J^A*`{Coxa#zu1Lo3_Wxjhl7fTgGW$;bj5 z_1hI&lF&l(>N+cwRIe}EW{i>|0e(iG#R)Q?;)Ve~VJ3T4gzz3U6ZShfQglO4-7NR5 z4A$fPMHG|BmC!77G-A`fbk)MTED=<7@{z%KX|RZW#Ow@<$|pR>1nZ;?*{zYD z)(WwM)DHl5X~B%)^ralve7wrS2ZWTivk> z9wOe?O-rE8stf9@{tPc{eK-uLZ)wPE0Q4Q{uv--kOXEMauqgO}4;9{&1RPcnu1#%R z(~^hKVU-Fd^jhYQ_j@R?Q#}Hw9wWZ!v;+VcOJ5sCg&YK@8BstS>m{$|bM3BD82C%$ zI?9_O2~~xI)z1rleSrUvGbl+@E0jwIaZ0_+*`UE1e!-e;0lOC&O{KsJ5ExGCumJ;> zGAAF`e2WF~%lx&>hQwbd5F76>C%Q5F1vy=DK&N4s7poXBC?@kS{n^^2tjhyr%EUK08ngp{$1q@9{G2^Mlp5!=wjflm89tYVk_ngLahP|c(1-(WrwS{3b^Ruyi+rNS{N z3ZIMA&P6%tuL(VZDkfh<${sR=In?gj^yju2m2hzgSTM|j0-FK~>;zbAqXxz4{cFmS zM~itQ3y5JeahQKRF|+?&AGucKDaZHnLoLe@OA4?#yG$%bF_oZ`%aaWrmvb|IwLh=e zhK)OnfKYEDPH6ruc_2O+hZopQA)@1jW7&Sg)`%wNO%CP}D*;p9ai2}}8UpRWMgj#k zHtY>n*ZtmLe%vE%w=%@(B~*Pd{^$0onyc@e)`_dlk#%)O^1gI%=|`0p`Pe{{>$ zfhU;9O@L8YAyTMPik!Z3ZaENI>$p;zZo zn3Cc$YQYMPh`{yiX3oQ{w&K_iTV)RfxW^{lA7pqsaLNqFMw70|VF0cP_X3`vs2wxm znP_bB3#ywwJRf=|5a)$qzvuB0b(R)k&<0!m3XX0tuG#kg<8HS*4~WI)TI|dVrmOlP z4xIBZ)V_}3i~Zz1K`~|{^apiDZktv!T6%&!BLU$5VzPllnJXy>k{T)JkS z4D%lpibJlre!S}HZWJMBs8$#R#Ae!jlbB&??Qi%VM6QIw3euzl@bL; ztT`KSwgjw}WST`iYWB=V!QP1P1hx)`TS3B3O*9hOnCG81QGBnX^1=vvEjLhw(O1yv z9IN|ToP3C}Of4g%6MC?3OZY8w62p{>6*mvQS0&CF;uKN+_6y~DBZ1iF7>hhOhdxYq zRo>ml7E6aI%B(p_B{Tk!rGYdo5}~s`J|)>D~;f8#a9%6w)frab@;PwKC~8W)2CDDu4NWr6Sd<$ zV`pp1@@3w_U{_9T%0H%M74kK)+oBHo0AexW?e)Y;o%K4*diy5*v(xH(k4o-Y+ouPP z4Q~pF1)DnEqT+12RGad?g}U>UZin)Lu>uw5$7 zgJIzl+31^&)$~~_z$L6xYxV=|?iiNqS~9nEQU4d_PID>1Ju3@;d_SevMcj-Ao6g#S z91tFWbWo}I4&6**Rer7h;ZtptOb7m+DzLo5el-S7XY6M4afdB$Mdybup!~^7W4)jw z;IBFNp8|0yPF0V{IskE}jHKg651&8D_VGuc@?iW!9}ajf{0$Zu_F+g=`isAQcC$aN z0^1F`S)iL2eBhFlZ$Ny|a$;(uXwQ%Gxa7~zO9V{T<7BeFJ|}CFHN>EVVbP{85v*4K zBKEW_A_Ax+ge<7o5@G=*Q+rf?q8PRxd2#`+sEcO zG<9R^a6(_4#BXoAYksD2awi+ms<}kxmOD9)xf`$-ETN4G!hxKnYuXWn<)}@cH-pi3 z*t%ntq8W%iV(n+z+6_w1S{ujrb^Y^SW;G4Q0%vr>^DKRemz;m(0+HQxy9o|lDiX0C z0Yz6n+-oQ45d6rJBEwh3^%vLX{ngwSRP`6F=Nvf!Vk_b@##r-mDH4G3>^XTe|I47* z$#^1-s)3n9IN8=w|EjNeZ+{ZYKTaglza;uW%h);%Dqd+MnTdPWz_0N`$L|duZaQQV zeBp~OY(k2053mt)(zT(XE$%f(LcV|=BQVLJ4&9d3nXD!MRt)`KXQswoe9yOLh2t@e zQv|c5yhhRz)}$Rg37;(P{*+3q*A%+~bXZJu71Bf!3#=yxHWCfbi)Qqs#pOW=YX%33 z63yOYA0cz&djO~`2GJk?;N-Un|L|VZbC_&o#seaK>$t4eJ?)Dq9Rf;{ z6LjE%))(RL6P9xi7||E|J6YBO(x7R9>UPVLRr-ZR?~5PdLX07ODE#}t zdypx^lEJ_~5kb==kq#ooKT|}Jki8%vSDkkCsN7JY4l_bYp^?8RM2l+X1Ungl_pjHh zP^+Px%v>h~C6rMh<1@@V4Mz4Xb_CV~-ue3#4`7Q+p%*KIr#?0r&!xRY30#|}a8?!7 zb>c~18v()&e@RM;@vRuxr}{zQu(&N^ZE2aS-A`6Z`?%-#?$)T|D{bc60Xk+T+;q0p zew6mdm$UEqK@C$AZ`Sj&-1Ci{Y1%SCkn0MnE`t~N*b=?KfPES4B=BDI={rDCa5 zCrRnI|K*^GQng;AtmO4RnX}ujFSDvFVZosng6s7{#;|VYP()tqItV%b^>=7 z3j;M$at(K2NsU*-!>xc|OA{!@M_pQ+h8ukwo!SSG%zp8eZ?;6e8{I*Dy>5!9w?=^I zqji|1*NR20e)rS0(e%Bp|ISBq%@gqZaM=5R5Fl1tkM`hl z*E;s~apEOVjs`ta^vWDSMI?4nA-4l#=fu*oNXUA)5f`}*nL$%<<$_y~@)9p$96_H^ zcb4s#X_@WG{}2q%!!m-U!!|9!j4gN1>IN@*?Iks8kp_75Hvh?kUw<{;^Boz7nvx3! z2`z}v+JK7%r~VGi3wC5oDD1)HRzhb*U`x&`?-v-*=_sa=73hBIw%FpTzH1m7CyDSp z(km)&yjZv_AzR38aRcF2F#HhA9S>36ipE;7Px92S=2@a2GE`7tI3g2$@AGh-5G=Mv zxF=mvj_hWPvEM@e383wLbHUzQZK6ly6_V;;-4at>xd&b#0%H9=127FyWkz+H*}4-P zPm*mQ2e^<(XUA*R<$IcRIbdiwnFzc|dpXJ6f3%X7g_Y}0=s80_+XgB|0_;bECl{Wc z%eXED%bF-z)saY9l|_*v!_g{lD{!yA&9M1g{_X8A3Z@Nzvw*gK=QOkA{zZI^5G9TD zMiUv_ay}L}Jl$Y8yKX9Z{vWtzQj^Ze>F31xKz;;T)+6tNYK_ zk8oyJ(>)20r_w zOTa{gQi0b9I#YdtT-A)Lr9LeR01T333^b}5!9J{ij3&+%kHah7{R=b5o2#%lzUHC7 zsW{tK=lyaF+=0LU^JuuyA0;L2)@EOD%?o~JQI9&waq5GQ)vJ}*lzKqrrKIA(H_VME6R3=7w0%)zc5 zfw8RW(#lc40Or;fBwR@UK|cE8^6iM8B_;?8WH zY$@NT3-_D=0cR_`j#CV-kwE1g#_khsxY-Wz2*pqep{ar!nw~b!9vOacXb6ujwp?|X z(#UGTp#hzMnINjR)9as9kRh{ZcP?iAQ;2Qgdtu;Z3qQhHMqmNt>_?QBTn#|rhA2?LuY0p^?dyj`2}0W z)jIkJOY7y@qZ?MS1SR;#1EqNt4@Yu=p*KK!ZnL=jKCRbNTj=E2qFXbMSJ#YaCB&oU z&mv&?yd~BrCHvg|wkU^r^a)<&>E!BjJ~6G&r|>Ram8yfvs19mYKj?&Ge527(eDrDI zJ4+41RNT;zRkrW@9kwBd)}fHK@5=y7**C8!bK9X{qZzfAoQ9h}w6`X+1R zt{_2afMO1dB!8b+!kN4j&4+ZgDPMxP>Is6|gH$iWPaI|V*RG@U#ED&U&x!N*fzJ36 zMLG3xuqPgx`s;@XWT(U=EcMBLH#n!Ge^L98KDe+->im4K`Eei2T?H~;SAL0~HrP8` zpg(vHSi<^BtyDaz+6TS4NBfm$Xo4YofT&lfhfy%1)`JZvVUf4eFHRzoYS5_Eyk9K zwu`>B##Ew}c&(?Zcg7-WISi2jN$W)JPb;Xwns~c_41C6kWZQ_0g~8DN*C;oubkBxZ z*<+)-hr9UoF=wR9-g4R4BmAup|L_abK#wm{{={zYfL} z3)}3|Tszs--w+t=ju|x=Z)mG{)td!jHxt@1Omu}Gl?%0j3_9wah_9~h>>>sM`7%1l zcoz{*rB=RDwg|;oI729C!)KFqgsX3CMcXXp!7fz4+MBZWwxmjlNXL9Eepl?I}ivhrZwi`~G70uNTph)nma(lgipU&=mAm<1G!}^J8A*4(UG~0KCNz7U7OQ zDejA3l4cqW|HX-e^ScC?ix!msailV#Bju%V<9h1_7z)_y_&uEX^2hK!l)hzMyxA$u zvD~3&W)gil+r0Km&)@Md9Ko#v7rp))4UeT0%YyaK6VEHE(Ya8(e%lzx3wVy*1)w_F zHopO(3^*C+hq`O}OYcR%MtHeB_>8KL#?c^iy5`{z0ZfeTZ{07s;;wdO`eIz!@v-5( z52GARVylkDw%91YWR@NU%XtAIs(yZz%2BB>Z0q6p3h6UoGx`CMs1y;57An>2tq#sq<(;DtUFhe z(W^}#)r_A%20gd)ynMxed;t%=0}PUzF%y|&V`cpXQXjxptuQ64-L5YPr@5X7?CBr) z0hk)hL{Qet>s=VwF@F}GMBS1;B5y&JBoBON> z>D1Q5d7)4w&GcC>)H;h~^EfJ@v7mgscis!9lG3&+N}eeXqP~fNjsGFq0fpq5;xfF_ zYoWtX_h=v)=(scbF{Ta%_b5U>8Ft^a^)v!D!OnjxSg>jf=rVzSZvHm-SD{wt+9T z-LK?g9JFUtYP)JCm=aaj;G;OFt=1WT43u~pINzf2{?h_r_a@3Mv{28bj1ROMB>(~e zS`Eg@Q5WI<9F>Zyb)9VaL#UxG^k>V+fASuKe=+IO@9VoiLpGzOqnBl75FfQ54|IBvmBWDUenwK82;Tep5XH|myL1&`5r@5E>N25bFYb9`9y~C(L2aR%wMs55wnG*z$mxB}M9bC_72ed?Pb6se%#MNf6t5 zR7o=~LWv1j?^u)3wVDIy1{fv9RzO`;Hi;nV zaoerG&>InbiS!EM((eq_xTwICi7q$+H=`Apd!RIU6I4`5J9sm0uLq?#>5=m3?rUAC z2Alam4qSJ#Qa?_>4lsi*qSMa);$;tWlzltZ5Iz@su?nm0vlcacij=)`Wcwg zS|maMBe{-_Rw-tC;QDG!{PBt&d@{_CcgPLZ+RBg#)zxD?iu>*ELQhmJ=qE^5cew99 zubmm)ULI8ie<*vuaJ^2^2RN*%HYb{sn@B`WOeC*kDpls0{MtBu>dyx|Z;Gr%7A`qS zrB7dt?VP0Ozqi`knJ4+gh@r(0Xx2)%kgrgZTT1W9pxtY#$P^!@E4K8QG0= z&AXcVt3vWK5st|rvaR$dvN2p`V6X-5XXatBM9N5lbq9kC(fgmf_5wf+Sy5J&0Bwkl zP}ZFM3g~dPG7qoPE7tprqgywFm}1 z3Rsbry)3R~z?vwvqE21cePW^{>dftc`DJ$@vmB$5hQtV3)0ZfmBMAH(;`xj% zMW}g-^RWFS`HejrIV;RP-{8ZWv3izpW36)Ie@8U3A^Q9H zEPZ{Gm$NGrHtGq!=SK?XR%oX)00)34a@4!=B7)K%U$6EouC;2~F?TIfO~T#adMg+o z5#2s1Ei)mFsUKyxByswbrUn0$fl-PP8OF(0*VU*$M@qC8sYTCGO==6HZ;iuzAhpPz zG+dF6G1y?X@#)xqw$J`ruGvsmEX%B>0xY4#1XyspWdfH~vhZxy8o-@HpsMC*M~aJz zHobSvW_ju%kOCIl2F?3SDBef&U))jI^7}MVA3AlJ`{j9&M&(GCQJMTkScMh^YvwcK z&!}2ScXy)=W0ZklW$by-nJM}fn3;kFQ!&uJ5pp7$-A={YjqT$LOY-u*IM^fns#Q>W z$E5a=1s!ErG|d?u7;k`)wGk5~2Sjy<5(vMX&*JPN&m9-;dRr`Q2j-w6&l>qJLlClP z%R-?%LaC?wa&Q;~Qd}?UYx7|i0JfNRsUr{uYt%>`HS&hzQ_Uycn&1+|`e-AS=w#G4 z(iif@-Me^bUUu@W_$CQ1=-Wjp1pk)PH81%$h$=?cM0 z5eEs;5*dW+dP>%QRD(pkMDegi+;7zUpppa@UjpL}E0@atn-A2^DsBi_TOFwo&4lWu z0@bF#nXyU+`eLm#hjc(1(QC~FK%NcAvA)%=I0zbq-HOmo6&;HB(2FZnnm@FZ3bg2CvV73@!u@Yo zteEV<{|ZZN7W*%-L_6|Bptz;_@DbbKA%^~6|HHT7+N7bPJN)$p3iv`B3DW`FKbx%G zqQ+tj)3iff#i6* z=S>s~PYz-n9p7_Jo>ZT@;tEB|le5ZFk`Z(>{BOUHfBdFI{*XU#Yh3S*;f7XPX*^E( z9$?&zUba6B0o1^Z@Fn2BneLg_`Pzt#0OBH2R6AgEVkN*r^8uxei_>G`Kj@Dl|B3JO zXGVgg02?3{z#!8a7KRl|Kmr@#U{D=`+w%|e+>T@ zWFl0pFW^Rv|K>3MpZ|bLc#QYo9h`r?2LJj)iNrhsAjud%i>kl>w10n*h2)Xmhqf#G z9OIk-D%z)5f1t9OfQEd*R^V9t&1djm4QvOF!E1;5?r7Q_4#x%IAmgvz#vbI!>BWeXV|UnM(+ejC|Xzr z!KoLOS^;YewiuynOQUDF|H(p>{m%pN*N-Z~_As#};%K|B35dEHt^i>eW$r!D5)1>) zj&7>CihZ^3xtlyh#zV*${{uF70DiZ@@fYJZ=5F|9!@oILaO7hKNMqOrzF(ygxwTFW zw=f?;ZuL(x#}ErAl7OQK*JPH;yW=q){#cjs4%o8cAAEpPABMmX)(T`jxSm{%`nF=* zjR}Av*d!fzX6rrv2?`tnv{(WLcj$Eip#r~1oB&1Nmxi6v&qKh#X_2dN4R$D#3XtDU zZ5x5e)^J+O1Ref4{=D=G3`dz0-~haJS#hPs>5rhbjX9`=H$ZC`;|t}XuKUzZsmZ4S zUFZZO7}Pl}?`Z6TZm~U=g&Z=}BV0v1+;IYfRo>l#SBfuR-wHhaW%c#|?7q2yF5eRe z+ev@L--4Uv7SQKDPKdDBht zE8YAU4;lpn^BG-_Ur87>)ii@FZC;B$+o$fK!XQ9sduw9Go#mtO(_pS^>?Im##xo?9 zcElH9fIdh4`FYP7-b2DWoCC$a90>bp(r^y)7r205Q17-PI1){p;Mg+hiM1|@V2I0S z@h~TSljxO`AEpZD+d=r^^Y{tg*&a%dLg*g`(t6s|NrDCBb|XgJOY!qj7tF0MyTC0y zx(8;0(IueO%d1}8V6St>mea6}GsBhqmpc$T`r-s|T5BejByg%){*NUt5@ImoXl1E< z0L9qnCb9~K@#v?CaV>B(NLKUg%%j@TRK)U6yo;y@uPXAYveex53;4|ck1Dh;SiA$j zYKChd`Bjs7mH6@p_<#nHpASOx&74BI3Hg|}upjO-0*ctsMl1ZddPj$PKL|&u z&lG+ge&9)WdBv{>Bv&dqvY~ORGgU~xDdoJp;gYmogn?ka;!9q-9pNoJcakae<2W)M zqu^({%ju@^viU%zRfO9RdjQU`G?I{{=$w(pl+d;(wB2Q|y6a}~QH{thWWiNs-zKjv zZ{>7agIQMhQ#+sWY~=>N^%!W%BU|{H)O~p`BJ$bygYjEUUhPFVDX3qwA{C342W?2c zToC@|%MGOD%_k<+h0mo#9t@2L)X#oZZ0 z88=2!`+dnmeDxJ;BUl8l<=7sV=+1)4`2NN-dU;Lt zz_l>^v4Mf?&?bZTeYt}-!+S6jYn(6*s6@K_jUyJ0>FohUyo?=8*k!s#xj;JSJaQXQ zy8}JFuqtz6LM~}8L2c3{DBnIwWC7FHdhVjUWa}QTFHpSXgVLaC9hzVBM&A4qUxTbY z?#BzMqDn>Q7Lljs`}DvyRj~vLG|aEBP>AyUp{3O}g?n zgfKyrr9CwF!5W2b%T*VUi_7Z|;?3{N{Pf;DdDXN^T& z<8Z1WDIz=5)~jI$!um75+rzG5kfTnp8OT2Y=8ZF9kE1a7BJrO;TFJfuWvn7=Ghk@+ z+6jS0Nw2-(sxf$c97Ij#`n~`!N+*MO%%X6w*DNc{nETmwehkv}-@7^T30ACi63I9s zo>1WeVa7$hrz3^HFy~~w&7Vgu6QYcd(!fMJ@+|<043^~-CJ2$=f&bji9~YLK>(Wc%MZSv`Pa`~t9`ouf zuR@0;NZOWp!Fy(_P8AIs1I?Iwy^#b79xNl3v1S1a7+ohnJD-ib8p$l9!$TK_mh(~A;Gov9j z=mivy<`KzFy!mwlDX;hEm`T`lYUYemB+WzdXa1sbEng20E&#}EDNxL<{$fXYay zM{OAo?HP5>zd6cdn@Fa#=WL~qA6bTfc^qql>jYHe()m1_?{Wqxp1(ne!xRs%r%%3= zih1$-SP5jGjDvKWoPNFeou0oyb{KKcHti#_CfzJu_A|p@PN3FiX3{1ml=r4a|o(oa=B zf;)tT!;V1S3&govQ=)vTuvJZrsH|z7Sp_0nM}a)wKffJ(Kf~f_pVi;KQsOnEl>3r) zwd`~A+Y+pSovc)+|KhwQ$7La1;=-;wuybf#8ovd-aZ%;lHq|kfID!?5XGEyEnm3lo z2z-I~B3EsP!7LK_kK&Rzxs}$5KOOClt(-uBzS*RzwIo#IVWLstKVFY6&Mn<;S&Ph} zckaL)sAKlsJ1!&GO6103?Mf3zYgMA{(d&Q$@oUZSy92oRZZr4Dj7S~t zv(b+`2B0GCoZaau-p3IX6vjsbuz}2KDC7=i1HOa9jJFv`)h~R16qCdl|C+wC5O#d@ zBaA$s0UdWD8NAipe&={?%Nww-rH_Uge~D;49$@&vtBio?4;+isJ+HO6aU@%ZQ1(Dk zwqav%liqXzWm;#s@po|W7|EDfRWBbc1R$E@H{L?V#K%&f{$Sia2+b@Iq-pKKzEZ;%l2&b)jtE}pQs54tB}T#;752!HD+Er2eqOpv zZaQirq~tgnAi5bj8imDdTy}iT(h`%kAgH%laY$-j5klH$=_bs;VtBRz^*UG#XyyQV z#sN4-+GVN1lCrdBqDSVSh>z6cCO1gS^#}AYc2_z%3JuFeyVFrHM(Gawjt+s`X>^Ag zC8(5E=utihazV<9^V)T!x(wr_&USQMvFvJMT}Pc?GzD+KbIhp^9q6LP)?Oq&1xU$# ziA*hAP6)ys5f~v-zch^EE_Af_kSGY~PWaz_LCJiN#d#gCWe_18u-3)C2%chMWuq|W z=)p!q1rz@xbmj?>o1KTucEDY4pdA!h49w7NX0W>i zxHc1Iju`hIl>;zk#pSGvu4tz(?)=W2iF#s49E!5u>3F8`03EN*t{J@P52$|J;BDDx0}W*|6%Jz- zQ2R!TV*i`m2>;b65p9YfsJ{+f5EdP2;OK0ijg!n**N{=e?ZNgiB`1N%KjYv%-YwCr zOjPmicyXc-6^E)z2ABD*mH$4727bR^t%}=?BhVS?``r&mDHwe~iuXGO z4aPt9wdXH%8~c0nJB?o+PUUKAg`;qT=%b(bpCs}0II+z>ON@XmJF|Zt<2CqQ>V-XP zMPjx+0*Rf?rp)?@oVvX3%+&$37Lv!~bA<`r4P~axO1NZtI<;+Hr;ZnU$d|R=@X}Lt zw0nRu7k;X#=lWXpZIUOU_cnkOhDlt#ROKeY%k0XsOR_lsQ{zT_m@+lRcgRS3SP;&s z{eh8`lvp>GI%a7Qq=9p8>#5RB;KiBI$sfFKtnCiv#3~4z5dF|T(bNtPH`sg6@kj8wf;o+P$7S1(#UI_S6wmxOc$bEU5m4M? zCAb=0K7q5uSsq9J{slkb0~)byqXRIg)GV%G|L#+cjq$kC_#_`mj5Y8=*cjtj_P57o zEsnTBOxuA-Bp(*r4$rOZwSE!3&7U{-%rAS6gxF!TWTG^VD?52%SAOCY_RD}#tamjG z_-R;dq6I~CdMUBA6D#zxY|>@clp9>Ht%?b=nd@OYpRekBcbWH6Kab~GZWoJ39o!2< zO$Jv7{RhaG=c0zS(}VBx0A!_B@iv1=TcB9ep}XQWh= zb&(v4NgCuM!PTndx_kGD$D`S-Fqf@PXkH+A?-;A)5JJe$(-Fvik&GX~i=ntDUjF5k zYvXqt@#1T`xzUe*L<|ORxB)IGkhxFV<)|~be_oSvyNwww=3`_Qe$Fd6>WvPG%vtAr zR9Y-O7y0@V&dNVhLxCknvb=J`&kDD`yFY`I6v0w?^z^^|5rX$Hc1*(((x43u>$Dz* z+&Smm=nf^OJS%BSa{}XBs#KZV%RT4|Y(q%S!{Gw2m8^g8w3KBE4 z#7D;zybO2p-W-;A2!po_MXP_WQz~F=v!`)W9wvs>7^zYUA>z=N3`cEk_;eDpxTamc zC#QEL{a#=3{3P{WD*E|$r@s;XDDjpg) zbAc1v6&dlu1Ff6ui+jLP2^s~-7NwPqp!-pMJ(PpR98?t+j%ilcfj~q#0Y&?Hu2F@T zhO<(l=hG;p!~d98@(LBFSTIQ(_W9t>nYe;g8SSth54eDQL4F%HPRA}sibm(PEL$rl>7b5>(e(8aQ^uVxPG zQo_#)($k-kYVYh5@T75sbrIHv2)_vy3d)u`N~o2iCZO`R;;|jY!HzGn)d*Xr%h9P@ z#Z{XYrLIF9=F_QX<3~ zdK;AT(?_PynDG@a*m>JZu)1l(BYIwdvnOCxF8D82$f%RwdrJgw3^IX!UuCLaU-lFNHkTyI*i{=uJrLG#F z|11G9cqFWg*M(xH_IQ1RC|*+q&xt?hQWEHBhA)z1Rn5cf{%xU_l!D~ETVA)(lhF$c zeJ@L&fpbI*VmwNYoRD#I(SN<^$<00%D3lFQFj>psaWZ~r!irVbA)rRBETDixEyPM0 zPoMEfsDO(DRL?Q)*xq#}fzKn0zde@~G-6il3q+TvAIvYiS1u(k#F{zHrDhu8S{(bN z#drksH_AR*pi9+s-12LMSHo9%$5R|4(Mw&lk3VxhtD2%@XtJ5vPJE&&Geh=0Ydipz z8Gn?Q%{Q1h{#Be3ZP$&d4C=!!L!?(-?JC|qG$**|&wIp_(pIHXt>+eg`GwKl-VQ>Tf$3^sYL<9LWTk#uE z66y-Xv}fka7unwZJc0V73U%Ded1t`x-MNw~HHhC4SM!bT`VSU>*u_cS43gjjj!EQuZ+^SQ)8t}bN4?_t$pc!&cdZ5TJ1Bj;eJZW2wEULcO8IfmQx3n z<$w(Ng4G2dRApU(j-@LQ354SxPUN}sPB`vjP+P$ZD0nm%V@!Mp?km68PWsiF?(PfA z5_{0Mw^9npW0w4iItSjYEzo&JvyMWkukX)q<6^!=PU%)LUB4v$x2GmA3Y?l{DAWS? zFqZrwLK9~oI=swkO@z1YMiGH82mESBY(U0TYXj)faj-Mm1rp6F`-ciMP1!g_=VJ@8 zlv!;~yMoNu#FrY>30S`$dKuTi2#X!NHk!_q`A-wtUy&05g>8aJ8XW(*GmtPH24yhJ=G37UH;3>=fKMSzgoiKa4Nu3WvTE6NISQGY z{z&ZUx|$gHuonBP8o(n zeBLfAHw%=-yPW|gA3s!ORLL+XzKtG*g?fFw*Pf4EZobwFP98JLU_J83m6@x)s#Rt^ zUloCBnHbCku}NJTA?7Gl?rYVy8Z^y9)Qu`eit*^`2|`M0A(`=qU8!HLk$(A~MfiunCSpX4T9ehq z3Axv>@hnQBjq-b_%qet#3$@<1*yjwb(^iM>iHlwIOV)n6lK&kVv{cvee(*f>9Jy$f zGbyy5wSR_vtFFC|%+5XAsXvjZb^pQLJ=IIrh*>YA=8GuU`&Y($_=yd5Fs;3mw4XP* zXRhsHX_o^tVPj{n@^cWovVPYb2Dz+&K#($;1QxL5ss%Jw%1(2(qcblB3?LdPyTMI) zSW1`^j#<0b+5P!T>paf0>E7mS<4CJPnW1M3`FfM8|5A7SRfXVRBmHDQ@}CP`UScqw z@ShiHDtSPsVMQ-{JB-Gf0BwcRWKM{tc=|@zW2r4BdvHQ!v=QohoLEB*=8L4K-N=53 za~xfvMc?KkyI<~b08B1UD4xC8wbVo9a31eQs^vm%`wo}hUB~RFLfOi!cDXG_4&MB? zsvA~z6FuFSs!pVx=#-L9+Z2ZS;{2WE1{t^*_Y3S$g+U6@c-BZ#GbS)D|cm03aK=b7#7a86!Dl%4H^b*LuGnykUM#8z7l!YkVFFgUPiO1wAXY zn9OiY*BB1rfNx;D!^1SMRR7X!Es#?vCoMh&6@!cHF-lz<6cW|?Yfdxbc47IRD+$*i z$v%7DEc{)f+*96nSzyG@Ge9UTlp?10;Nz2mbzB0O>0hoOG*@BP761KCw3A&7vFkR> zU*m<355Zie;%guA_g|w>?-(gJ)L)YAU{5^idXXX%brtAP-#FH2o#Bz`y2&LFUGz@q zehA3n)8ZxKFqm6rj{{(_j1(_h7fyL_ataaA?)4J&7ixX7b>#{J!k6=;jMhN zd%g^U;lX>2F~fb`cx(fHld`|UEiRZ|DX>Z2!h&D9I*`gkCVA-4A^ehkY zfPKR)Y4`4s4)SCi|U8|i>j+d5$qbaRDm~?poGu+tj zaZ}hn2G0dWfQ6P&z*)V71PzI1zUvLi80gM#iA=3g;K_S&aU=40Y{} z`ZSr2V)=Ida4Qgp^sa&O3$*j}rm)*~)9a)z?nY6=tcgs@46Kx-N9}M&D>AzoG_hAQ zSzAX-l8KQAIL|Lk)UBMPePlwDhbalWZXvj1_qzMV+}DYA+6@j#kiVK?yy8a zz>SnvQAY2PXN8F+VJlO7X0%(h8f`SuT`-Z><7=1~i1^M8xJ0RB#6z>Ox@X|sB}J3v zq82cYZshMoygvFd@4PELq(YL5*7 ztd2m9aHyt~m5n+`<^oR=n@oTstL8Kl%$QbYU2sJH*vGI_IvN@2!A99}jaFw^aRNOF z$3tb#PsslBN!V8%x-Twv)~|hYKpQNPq{Mg!d?t%uaLqVXNT}A9*PX|k-(`L?FT$KDeOnu z>JvG6yPqV4g+Wlvj72#x=x-AkRoto>38!67Fnh7HQ!pz&bru-09qtPLCO`B{e6sk6 z?%@YN@?0d^|Mmx(!6WLz;b8@F`WIOwKf*X%+SisQ84Um&X=tYP{N<)3qR~jUnKnSF z*EAcusS*9U-OlYAGq3jC#5GQ21=RGnN(JwFW7X-!5f?+a60>epzK)@vWS5QGId4kE z`(+a2?x!4H?ny$A!bwXK&N?u}8;O0&FOF8qwq4s{4)P1w#T5t|w8^XtLhMh7<}*29 z4}Nw|C~AuD1ftECy`=m-_=F;wjE*@3gR;zdO*TGnk)KVk`*%pH>Ck@DfxV2P&0gra zJD6(`@tuY(TLlh#ceS}iizWL^Q>}oxNJ3L)o`D<(XBpH8_ITte9HYtBvBFkXeI}KK zz4Z@+NMz$#VeV^-V;6Cyx))0h@`O?_6>FKt*|I0Q+%04ipU^GEL$g9Cxe3)4tXj{? z9SCX}mdD7N$mk?O)R$6$lkRe9?Es`t70L&uZoC>?2m3HLBN?5-8t$q@J88v@rRX*CmF^^mG)9t;dL2E>fH=1V(8kbFE~I_Bi`p zq>_Z%p;)90GYp&p`)_mRL>Kzq6Sd4_OlqjMVRXw>@;fc)J!*8X-0X4EUkn+9u`Ni- zr%+}J4hOtlJNZ)kZffJw-U_B0ldAOF=2N!fE)81^QDf{{k4)km=zq;+tn6RkK5Ln@6htG?F8PyaX!XHZ#yF^kKD?JZL*#LJ0Bb}l|YTc-^uFmG$3 zof0=6o6*`;wpQN|!nXF}Jy-k@jrlj$wMGND@QvR^=3GLiNE7~BNTjl9&y+Wlafi=u ztADt+33YxO9z>>15(eCT?x%t0Tst%eM3cu_=F2w#H|~;y`;KPG&&C zJ{4$U`DSuF*H*sUuNhN>P!4q~$cF_^4W^;5cfKZom!orK0!mX>$%6zxDfT!USYLD;tL{5 zD^jQSsQ04rPoIC}97Qc*+x!wj$=~Cg9<*-3VrWm6w1{8=hlU|C!m}PZ>SadKd~k3) z>+h3E`Lstke#6YZ;TLYgcTIA}REP2otx%`D4{%-l7DH5DlZ$K(wm(gRTe=k_MmLDF zu||QB%aRX!$CAHhR)ZqzLoJEiV9FL=Jk~CMEUH~ZDU6XyWGUO_+Lx^-F28>v?@vGT z47+XseK2g7%SUz%61fyabF>D%g)&GLj(oD6M5%^lPUW$^!z6@Rs-$GPv?dhuF_GtJ zLPtEq?qa#l?Jk9saS;R*h$8W~I4U&)I|QaHoS14}Y)IFuz!e$d4=#p!5Nt5A8pih2 zr<#jZfQNZB^JoiI&syy$gNv%W#hfKK2|#}cJ9!vU3)4gB>q{&{{wk(?yobyRAxD|RWL?U@RA-v zXjmR6GZOp$QkH8QSs4u>oQGErwv|x2ghx+iSI@rl#uM9a>q#SXoJ*P5cNkaOxojkH zNrPXh77>DSb11uR7PE5KyllRNL}*fQ|M+VC$2fc$6W91)64eK%1~B}cR$^fvuThKE z_bpJ48kYKos2-K(uSYtn(R%D;Q`@+|LNVq(f=FBXymx570HAdDnK$90FHrJ2n#qPH zgs1snVgYjcTy%3W&KEt+PZ^}iExC8G65^q}19ubhEM{c)c2soX%tIhULn^z9{Z$`#|0*l$#vTbE7JgaR)^u%r9%b7k0Tr|sS*{v04tl`2Hb-zhvYR2RZ5LOsZe_mKvuy9W&sXj4-qE{(ba1pW2w0cXG)R3Y5{=e`3I;@UlVW$M zCN}ARmwcXcw`UQ8fwgC|pMcMkC9M8aY(g{JKL|$#J2$X}2YH5=7!QHQ%JSM3bzx#|14r$5m}*B^WhV-tK`@9uR`Xz8(h0Y=8w+ZD3*;p| zvZ95|1^hbS+g`ukmaF^7br`DzZzhk2JOmbD`vvV|qLF|=tcWf9F-seM+t6(15nD(G z*jWkPGb#q8MzQ>Ke$pFVeHHri#c2fV>%#)^8m+S`#ZZj!Oql#G?wa;DW~1i134Ye- zXTt=HcKFJ+1~EeZqXf42_qKd>t4^|Wd7XR?x~G%B=v%#nZza&x*YyWp;Rjz?-iMthPZ1x6a|a(yi9+V=9?y1o}H0lLpz9$HF_|26`$Wp zC_JJg`jfl2kT|TYT3?u~GoZD7q*4;m5c@g_RrZ(_3BErY7G?=n=@ebB4?0;!gLEB^ zUBse@19|@1HGI>nlRtCS8@8eiRX?`n5)XA&Cc6dPHI?F>DD|c{CBVKF*JW& zYN5{oII<#Cx&&QaPDwImt?17XtXcBt(S@H2iDjWoafzMLre2pd9Co6j%Q~@A3Xbt@ zb3BHFo@xqYEj3DzR>>qCE>7hL(RI`ejcfg~10Mf$0KeF_7BQPro6P*h>X4=o&I|Qk zF+mFT+@dsK(r<@&J|lyFmOPN&h<&F@MCO_@YFB{dWl*pvZITm$LagLYr&Ie7dTMCi z2gOdHa_!jzd7DrsYSfKjfvB2-$?E~b)IoO29}KIHrP$-u(;ekKkJ7Yn-ESR$N&ner zif{WW{c;m%XsN|U)JmC_et)1K?Lf2)njOM zkfWP>Q3Cz}!xJD6n|sXQtYr?LKuK;BmG-6Gl*w#hii%ZIJMbun^5w$JA`L!X8JswO zD#@`zLW81yv*N8+NDHK{G#_!mw#ZoL-+IK6nPZM~y>RsYQEQ##uZYj!5f8$kR@yC;m*L+D8c zYn2z|#d$H^2gI6{RcLRM!$*ajJdp50852k>*Oo2D@r_%yFV^#>LjqZ$JE>;C`pIJ9 zb)#sXC!W>w#A{hXwC7&8*nZBZj9v~)Cli`txeU&dOlbe^p#>*NitaBv`MjK{fJR%K z{ILAxMSs_7`M}dl)#UPU&S}$>Mz!M*e=>1e< zmw9c+cvZ@175n1BHqW%*RZ-+omv)K3`2u9S)LGvI%-yX1_Rt47)C!K+s)zc8Ez6Ew z=v7bIWyrf?)NjZ>^c30aK_O>r@FemN3V4B?i!aF^GgR2nkdd9I{;yDI)|{hZ56;?H zl#*0`%<)(qJMo=P-N-(~)L+$T_~-Seg$DP>DcYhq`zd} zZjJbn17qjt2FRZDcbwJAe|L)JYY+rh#Z9F(Gm0yg&s3$Qm=m*z^!6y) zUZiH(r}i;SUl}Twj0`iIu(t7H5tm;uqTI1ieE}kCec-K-zv>I!@l|AL4I!$KF zN8dUsHpI!2yF{qKDkn2(v|?D;LvQVdP5ZPfE0m!odfmiWqgep$6CFddt3v?Ie3Myf zw*V3zj}fcGR}=1Ii!NwIurKx;)5MDI{j{EgTqN;7wxAIMC7)?ELy)kY$V9fb83x`@8*b?`aK&}Aq6 zjjcc|LIY%(Mn&wNQ)dZgo+T-_$~E|Zoa9%oSuz}W=G|#*GU!X z{M9b5SIE?QL;i<>1taVTI~C=SG_vfwAa4SLdf~HS&Gu&hKrWjxt_4=RXkx|VKo3So z7$*JMhan*RvAKjJnDR(w(_NbcUUPKH7!5WsJVpBzYpb!*Yt`*;+6G0%)N6LWFt$$! zV?9JAiOAEa=@TKRpU3ghF70#AR9pAN%DOvDDbDe@dhm*$xk;-;r+Cn8V;K7`UV;R> zF(*Zb;%Aa7l5qb&Zmu@y=E|Y`>JTWfNigJp^}YtpBsb~{a<biSTiCN1)5Uc@XAInCDsWH6jDOkPubZF{4UR>QOOyEn?L2)ri}3Vk_KMtPXCmiB1enZs=|J zyx`csR7FOv2Ep39(qoh=PrEIjW~xZX`KTMOSB?6&=RD31FPZizVXd8k9nvk7FG)n1 ztb@FrWQDN9b=3i{-l@)};tWGidC~i$W-o6S+v0;nx^`W%Q>rg$S54!-uVcKdo)*dC zF6cK+Gl>!8G8aL>IR>ej-_@+`CfCw|$QV1G7{HZ(>4v{VB=M?@K!`*I&I@^J3Qn#- zH;`iS2#4a&lBD{?Lj(?`6t&;Qtg9H0R?x-_l_cjj(;)W! zA-uxpjVRxme(H?+Kr>bxu$)y|Z0g03ddxbj)pbL%OMPZ*vu7zLteJx7x~?LgZ80{Z z-9yIu|44i5s4Ba5?OPEMlt$@h0g7~kGze=E5`uI~hopd%2m*`l?gjy+yGy!3y1S** zcP^j3_t?+=o@amWH@<)Fp$=}ubI(+4)J=KBSuOb6s8<;hh0JlLu;^3dvew0`d_apBM1dA>R-UlmM_@-xi`T`&YLKybA<48Oi-I5E=m zZN)Mt7)Ae}YZZK8=1{&zrzm{<`<_|bM@BJT*2UkwPh1v!_hTV{uLxl4^K--ls}mvt zw!SK`I%j@WwXA&ug^l2o2sHybLe!#syY#XbDV6R9Iv87ltn~*Q2ZVSf+`c6X9W3*@ zo2PUcSb`tXM`jaarSeLCy)1pxBz@)>LG)poo7U_J(K+RqylGqsiaS{rzcCS%tm{*5 zNQ*}Vm)dt@ZPOBcluM#d#k@b&p6~t3Wl1Lf8Gp6LH_P|6MCtXgsOJfA5?4Zwq<-WXWAxSp2A45;Dfsto@Ni$3<$_ze@+d1&WsM*hC}%^sb%M%Yzx5x z>=(Q}%8wD7E%kbdKO~JW0a_s`pP1E_;!oJ8MK}~pG52KvLgr4xa&DFrPnXelC*f?s z5CZxSsS@=7U2Q=f^hc~ zFHQ(%hI5!tGG?Qe+G3260tJ*h`^giHts$Y8&aHwH+R_piQ%~4z={Bj%$jn-l=5#>X zBdS&F1Xctmp+2cQAhf!+j*6N}1c@>;Hj4i8AW~A@G)*VD7zjDa2nsisQa3vQvEU(+ z5sFuSIiT?!z{_jN3aUR zLLDHxpLK$GJ(nhFdMj)kqT~pt4Y#1B6N-Igpx28*^2s_fQSE_zIgt=PO=x@jFdhx; zLjddD4F4DQK6a&*IytNz8ktAi=Bl!Zr;*Aduh2g~gy9z>i*I_s3jU+yEN%WiLr)_F zUK!=oq?m)8WBL5su%T;iQ}IfQQu#u>VeXoiPalE$;f)VMwdcAnazkSMA%K3l^{QvY zG_}3GI}%plcg%Y^WA?DZm*2Wmxi$NPQl@#UjyG_wtzjR9%mTJH% zeT}ebO%2lQP8}a?eUaU-`bDs|RDy5O>yz@b@^w{C=D)fYv7X>G7u9Ncx5?E`C95f~ zPzFJszXmoJTL}gz?ju7rw>Fl*7MKCY1ES^@Ug4yNWO`X@pyNgzK}qP<-EZ=qn9V>! zf``!lm}L!)!Pcla%ta^kx523`^s7*+0d{@#`wQ6~CDSaiMPWGQ6B08A86m}a4=tAi zh#3n`s=H{zSrg4E9OP*Sd;E?}m4Li{t^sy+*Ve+)9)_BrhmdECM;P3mQlaEz90^Q- zv5W(ICVgST7Ou{JyMe%JUXc53sRT=CBUzKmuacm1{CstV6QM2I!ASNi!!ogJLfTod??PPc*KNg z`up&&eZX(Sx(F*TDc>~U8BmS_@|NabPwBS2L*BKgI^`MTVJOC0YTZovz_E@lNEUu# z^$_*#BXTi(9=JxliTKIV+AM6byLtkfx^?rWyK$48uRo!k9uD<5$*e9)YdEC%&XKjv zv1HN~o)s!!=Y17ER*}M<3}C{BzO1Akg^gF+!@$fpg69j7F&goz^y0NtUxYWJx{u&% zTH>S&Z=ib}O8r^Yt^9!o4YK9l4>R<8noKBv`5JTaYbE>&NuZ^2|8Zga9&!!zD=wFoJ?#V;R_nv6lk(

    rP!XHDPS-agDIZLp`=W~AwBTYrT*9j%x7(qwi7aoh#;jwBJ^AWH9dHhrXbh*q{v^BQlTOXdGDt=^ka9J?@73v$7 zxP@E z-iZn0?+PX%u!TjsIHE?dmt{eIyLn%J1XSAM-Igp(smBzdZ!?&WF3NVndV_3mtCw@x zcGZ*kHM*=>-8MJJ(q&J}3!hwsh%3s7$I~-gfGpyPL4=Z5h_aG!ak1KTAly$p&!ans zYS_G`n=mYN-SxOu?nr-rGT z-tZ!Y`+lK3BU3eNv@z%?G83T0LIPw#DKqlqZz%(2Ma&Fs40qlWlh4+QUf}8GRjNyv zsCedA=>PmHW(}=y*Pg&5h-7ZMu_Gu3A8pSHIO=4KhSslpTHEj9Ma6WfheiZ zj{cd3Z`Qqdgv`m;TK{;^bvKFG`T*@B{sByo(;;!jr3v6~eB+R3T@z@PwSTXiZJjRM z9-18>@&l+;CVU}o*&(mbNDSiGvWVw~?l)4Il}^-rkT>v=&AM$kaA!HvIiVg7*&|c33&3B{-gQ-BSHc(AtY+EFx2a?-1xdTpVJn()CGeKLe zT7A%bl|x=tA=EZiH`>jlffCw1umKm_+3LB67kv>M8-8-GAFkXrl3c9S#D_W_9Dmcj z?Frjv6UQZR{o+j*5o7LeJA+O03CPc}Ke>GmfQ=st-OA0=?$DEEby|&$NZ~$yvO&si zInANm^nN8~Q(WxqIA$Qs!Ux;2KeWxW$|2T$-JNBa-o7?rK$!MiTx@^lP@qky7DD8vt>2=f+16UWh`_AV#QgJl0I!*)NU`t;0>GD0GE@( z)QDSwE44yJ=!_Rt=a$4f*ca#e#(H3#VV~rKW3lV}p#NOK0K4Lh%RIbgxrR+Q;@^Zh z>6yuqucNlDbUNM4byD4;3#vxtsII8~8{L*HQb<$56y#YsTNzruB^#u4p^s<5EkEdm z$_fTqiuDpnt)LYmMmG+mekG0efk|U}Wd1V>y^X#g^>DovpDapam#S@Mgv7S!%Sd{A z^Sv`b!6Q-1GzCdK?hlNySPzz@Mo^{4d4yk4c;1v;0-Ayqv?yM*j{da37eW{}{!X*# zEN2nnY%Q+;Egkz5w$E9%!FpHw`C$y$_7NxmV9mn0uthPh&9*x9&adr;j^OqIPu+)k z_j7GkNeCKs$*_8uitUFJ`RDemAH0`{5?l0`+ao{x48T(g`>d?Z0Ie+LfzA4NQL*}d z9)4tnr?#wGW%Z6OL!JU!ktt-9t5llR$t2X*i6@({_bUll2UjTK+P4W$x_P7S7jH%m zJ4N*D@D3EXD<+@xdeE?ajFPL9<}H_ts3+oJHGC7uj?~6&v!|p>uNYgf$oaI*fYAfI z z)u!(;m~(@OxfncX;qgbm;HT*8rEv?Z+Lh(DS%Qzy28VX!7I8l95@sP}eo61Td`lBo z8<#07o)l3hk8?@!(RmDZ~Y`3lG*IQLd?2`%)SpWmkw z;tCKULoR0?7nN)JXJuesV6#oU=Q`Wbcn9-d-O?8mjrnmo9Mgc$tBo0z{W;lqXRca5 z+Krgw0Gx?7rad+m$)uH3@RLJf3k^&C)xS9`0z{m!FG7o__lGzcpL_WbUr zq%g`WKXlPz#9j2>c6t%926mcN8cPQ&1b4ia6B3}v@!z!*&CQf)$Adp!XFL0Lyfq|A zL51$-o6hX&Xlno>LO-Bdm^b&G1L_9Hyvz)^W%q;PiHze|4!En=!3CEKaMmjMz|CA6 zCGGdkBjF1#SJl9OU9F{|I#Apdhs=&IZSkM$&cdA>T82GzVOeD=<49nVN7L= z2mSZYdkBW?a7R?B_H^)vv$se<{-gf2e1Jtw7h<^5SK-G7h0LGH{BRAym@56bK`+Tcqf&s z6C{n;E2KKQg8#M{n}594H2?4imjf?rSY=0Nu! zqsRDUb9f!Wd$+#$i&wJmV>1S^>OB~_DgUyo0{(DF5Sb4C(;<{G8~RV{TX%wjS zAVzc@Krd92PCzHif-e4jghyDq8N)x?)vU;AZ_a_3iW>|hSOM0a6G8vL$l6DwLb!on z@&F)G%0}pELMI8mJJ*EcBv!GwXl< zMgMo-&g%_LnygzgGdb;>|K-#9=g;b2{!Z^X;v0$AIBgxVkW%pmdOO_Og zzu?yvkWTt{3;w^p^nd-EniUY=$k%SmeE$FEr^Fu&UVq10=P2HP_h|nwKkW3N<_%xF zb9q5gdi)izuf z|LdponVR(k`xo%T^dnk*vq3=hZwoS!a=I~S_7E_|M1(=MrW-MlMF1~q^vB-*=K?|X zYQ~cn(2r3wKsyGTP3JHZXy~pZ-VKDy*?*G@6Z}}4*htg!uapVNUwD_s9Q~Y7{rk~r zi0Vc7%f5VJM*aWt!+|Xd03V2tL8Y-VQn{HCm;kB>CZ3>AJv5*9X2Hm(oHZRGR_p_f zjjv0P2cKUogUza2ZaG|voDF!sM63x<(L$Qhr~o?TzPu!!zS40Boy+&r|PAE>flIGSP5waVLd;s zcHQ^wQ#mrFLW{pXvo_EHEgO_0{kC-w>=E)oCj{&V2xgISKi4Fu?#(iRMaSGpCUB4~ z%z_;(I#V5dc|S0rYhBEN&a)MB?I!i{YNUK;6HvGa-dTh0CJ%yMG^OVa5T$zwfCS=U z2*yeMafJxG`cYAK0p}f{XmJ9HXl4yK%`mv1{yF$_H;C}|2k_wY0AYO@2rF=+KEO2s zTR26B3nHm$< z1I*`CKk2w7K=-}rT7A%sWm_JRiLN&5`3_n4qLrWzZ0lC*!0^?0nyg;l(y;%_>u3r5 zUHyUllOF(ID)f51UPSx5j9K|)$7txcV2^J3vVl4YB3O`=_ZNB=Zv{tKMi69q)#Zah zY|2aNF3cq$2? z%xv1I15tuqTHpj0+@IA4P9qNvCL^q$`N93rq+}uMP29qLe zM;Ig3L1s@5v3#cayC^$A|&MAI--vDrUf?Mw3sT|mnNMqveY1a-s z_=A0GLgIj#UCTc9o1Jv#T7f}aTM9jUgjC1H1q_P%4?NE6I^z+2X2ZMiLVp_%WE~Q% z&i1uJp#5czVH5zVcAYn`7P&@x?bJ7KXBx_`^}^a!I~0ukfm^1@pZ^W?&|X++L4h`b zmvPP-zR8^z=-p+qSJuZabJFzZx+!`E^XNW&Xdt_PWK)<07=C6~&AhpYUwyQc*k-g_ zp_gn%C3NhTP2y#vrlXQN2d}YCd_6#h@ls225%`5t%){Yq)VAy3+njnS6X6(Y>nGEn zQVoCiIQ=%Qp8gtE-un0@uNyr$BR6vrtqaH~gwPfDh3->r?tY^9B9J?NKwVXT_w+P# z)Ab@VR0n8UsSU1<(+_%GM@tMr!Nm}Lz-Vb25s`QxnkOUhK<;SOwqls&=wy4Ewg+k; zK>Sp|iqEG|2GcSsRWS7YWN#ACte&aL*vsy+}!V1HbBC!Lp(VafvlO@P4vOFrSCV1DLi{;34-@{O&w<#qmCw#ay?o!xLO@;cTYBmmADl zjH!ZG+wg$CoBu;^y4jy8{NxxNcW&{|gbEo5&EZ`*cD!+T$#*|ZR}=Mva!0W9B%>(7 zcNmet7MG)GVzk#AWh)GTI&Y6rg^;rD>ttj&gS6mL|G4G1D~ertVJ7*y*Lpe9ON*@G zknh>=dNU&I5VsP2GY@tm~Za2tlO*IAL3ii0F3v06Yx86 z`c0yLf=iK!)T=n`1>h8CNbO4e=;rOevOa@22UJ6vaM}30XnQuBA7BM3#NN6YH%!h6 zyxPvo#5Dt=2_Zf{rj7CP*-<4k=?%&gs-I5pF4t=|PIE!i%lQV;Qja1q(YW++c*6D( zO74IqtzBw_izH8?s(BkB_kI6uMv#r^(@+2NvFCxuu9(3L>$4iMDSTxTwhLI{q}J9{ zGj$SwTz~;lC4nP7_+-?lxonSLx5}#0%N|vLDH->4w3F$G^gkap)sB)WT_YfJQrCj_ z)YSuIT>0+gM#EX&qfLbN3SUq&VV%u ztw9J0;kHU7NO4|6Bdaf6B~~T zXK648=Zqz8n9Rcji!=sHFn8hsRviAgJEb;UZ~qrBCr%JLToCv3BVAL%RtsCD0npvz z5l||(wU@f^@oy=hf9@MMsimR7aak zHTJU~EF4^VPvE^J<`?-U(F0ulCeWUwYhTFMc#vm_pzyJmnC=2NVJA2$1P4;NBhlxc z+8tP_L3%a;5jJp#=Yy~UNj>025c_kw1C>AeSe9J{SNow!8nMak=_IgojzxkfPQKG3 zP*+!{qZOD@V+u*sToai}Z=`_*cK%M&YOUwN0hqgmAQ}!B7M5xJiQm3@^Us0eWiah# zv=2JvVD1ijugt?+QO{0lDSw)Y4hJc`L@FxAJhuq;?I> zFK?6sxjWCXkKd#5({8)Lb8Bf^eJFF%DADK3YRRQ^ziL>j9`VBVUYaZDDTeJQ0)wd=D~6-IKXr$KD?HMdHkLi)Tsh8?t*>R-?392@&9)w$(?VQy@&^fDjUns-AxqXA30 zMm3*CrPU7R24bWXqvc_(`hO(AH?tK|gj_RQqHQ`>h6&SNe~b@aESmq~xfa zYj~9DhSr{>0<;j)m(O?)kHQw|3GlBE5Qo#-wgN*Iq}%yNy(+m+o>iWSbO^zywcUP* z;fCOPfCI>82&q$$gaWgr6rJBTVrab;)Z7{Bq8xKDVwDqczlb&VS;q0Q9TD3#wD3pB&CENc#}HsKFeDc{qWcws0ml$@@wML$l%pOjRs%nC17=haN=|NCw)6Yi@ zR9<7J-sK#~J=$OgE_bk3)w3zarkyupfDWW`wkwF5ad1fm;s@%Whm9br7~*9D4$M%O zai@It$AaX5nvVOAO1et8Bv&vc0|QB0E!Hoe zVwj2HXCZFB`@%T%uo-(pZsq%{M7q!J!zc%ykoUSuR}XnmXE5z{Rn z&DzFy&vcTd`~CX zz5VM(W-*Wx4$&4Fzd(N1HJkt&%bM}ydfp_K9WeCMw{||g!9uz3!iqnFRek@8gH#sJ)~7pXn)g(bQJ2K*)Fp7xDW7(D1>|O$bc1x ztpRaGD9jY7{<5`Wsu&}kGX8s_ymmFjwG9j?NgsI;=QHG( z&EJ;$PmPGE(D#9Rm67-(OOLQwr#vUnLATe68_tv>$$Kcr0TCT=1BBerUd+4pAmh#; zBD~4E@?fy-F?R2KQVJISZw=Zdj_y<-;Vlfsdetv}au zcFbMhevIh-K~5)j+s4qp**3reNhRSmh(Cz7 zh?CMkKtEyv7Z(%;@ATqRaJ>B;w2`t{>5%NkMzJ}#ObrEp1Rc^r!aPkM4dPl$l0Tba z!(prE?8BynubX{}k3UD1Pq&|v+afqOCFWKm>-s=Cz=qJP5ssaPq1fy04rVNTZJB49 zjw>e`v*l?2pT!<>GOnXeZ8CQ-g+(&rE@;aM#8rl3f~2H~n{n5Ubt2|~zzy34ILx^~ zbd@wIvWa!pvu>2o!FLMh$9(|0VG50d>R@k3_1PXZa-{HbbnxL1{021Z2Y=Oqw;V9V z&}&$q#SqK)n)QVJ>q?pA7s34U<`3m??aPM!j=Th(bYswm5kg2g1_VHkm948t{b4FN`0Z9YYIsbS zQI4%F5XtW#1#tA&WINt5SzpH}`hb#nrITsyyv+lP;{_z_XZH5x((hs6?pK)>pNFSC(cPTL!rr*gVN%>4&v6M##3xL({HM zg`o*A+1n3SMlL~D;~-;kAeC-^|J9I*CnuVNegI?AaVj14>y{_CX7=n~ki~CI?cNfm z*gNBj>*_m`P)f{OX*qwfE?z!e^u}7B&)$9Rq>193akon3k@;weO0f`wMp07B@)D3C z6d6bq2KtWE#%R$5vahol)}jgCfgVR^rf3V8 z|HGmcN$fl7YgH#$PX6OcjZZTPx18m+sc9vQ*0)(x@~(L@%TKg7yePH> z*?vHJ<|jT}O9%=t`QW)#zg_5sE@$>0;hfP~-8hdJ#f)8uy~13sCNlrWx!@6-5jk0f zy@T0g?Hflg(vuSbi0oo$r6f=eufBm0dYXG1U&lb^28wl-c z+XELJtL4Oc0)ukd_DAF2!_xd4W4pTde(j_`F?AV6Igd0wz;#S95m5f~LXJMSruU<1 z-tqYJ-=EN4aW>=NSy^*ap29t)WbH~~_zZI7s%Kcku)p&0a~2!LgYnPHQ%w@7`A9<1 z(u`oSDyI~M=iniREmg*ZcXBA#$duFQ2#ZfW8&rU<;vOyUQwA!xiN~g@MeZiHJKUZL#-9* zuvIL1?KT)INhmM=0ROrgq?c_cCYf#RiK+$`-`S}s`0TO*SAeg!RIy7Qkg4?X#Cx!- z?2%QpWA+)AnZ#F6h@MSc{Ks&SwtaWujupp~+=oPpE%)~H~#zGT+yA3ngaQ7&*Y;sS0Wcl&Z#Csdb zE0y?*3rW;zB@(~6ThdpXD4!&%D76z2;dtUtHA$tKwj+>JMsAf@hh9o5=ls`7S7FS^ zlO=Mb8Ytxi(z~-d=IG>^iwkhFTpS%cb$g`bf&?LeLGtXC1h1 z#1IC>;IJpsllc&6fGD#7sD6^#NbNH!gOF2<%swb>%vdHG9edk=a&&x<;gSLGBku;; zg^%@tRkZ7-U<|uswq=|sfPKd)=j+bvrCWvS)QBPwA&^7JctGk(5)?FwD6 zM=Ih+l6{Z;VJLWCa*T0>gChL>ypOr0u+TLoidd823@1u3oCT5+;r`P`3%q+orL(lt z;a2igsR1TX&axHrR(g>HB;4Z+KozBZl`eF3;r9M@>j-qjjat{GwE;3QZKiOV2xn1E z-e>q$XmBXQ5f#t5k!Fo8ilKNr@ibqxbm`FN=PGBL%4N=_Jx^`;nojx~0&~tcU`VM3 zqH*QK91ejN$YK+vmo?!f$Ki`>jonl{RV9YaQe$9*(>&GL}f#3}> zzsU=t^L=X%EMXl6(q?a8y_0%y+M&LjJJ;2RTQF-CrQ|SuQI;Zi6;{amsDCct+rv4B z&-x1VS#rW%A>x>P5d6ImfssAAGSKOM)NL)i1J-TCtrB*#g@h7#Ih=9L5q&4xZKdc8 z22IJ^kTU5jppLsOmNDAkCe0kOM#-FoN=yGH7~7xCIZ58 zw-#vPt^?gOD^T8R7rvu^Ne*-R$4Y*%DB)+yMyfE3babWgV1uMK&%guh#QYlwz0XuO z6RvYic8zuNhdQg6eymoog{ugETm2^cYbnWT5%deIRQ9RP)q2Jv)A4o5BCw!wQs*(-^&}}2hJP}vV`|yB>>mVSK)%n3G9&_r%xDme(Zk@ zAZmyCVIQd_6NPV-fCddAzh#hiI^8b4@Fjc-#A5b?fhWnR6HxLdfMG4|yLi9b4p8jY zM-j8L5V?~rqe91AM0^F+8}HJ37kuM_Fvdj0=9rX!>Msy)@9Ay+_NGGnl+)w!>1N5q zGj2wVb{KAuk#D;isV7Vf;)D+8)$@ z+Q)DPF&LA)Xc+m| zS|D93&i1<$uQ)T0GJJFP5%jT)0l)}lwqBGV(_EfghHLV0di6(r-t3|%n8o=HNfw&B zbBz>g4}CfIw~kU!!KIKGnEu2Hxb=QLl6%gOt`LN*&i2?AB#TsRoe1w5Xd?wX9z|`( zy3J0zv1m%-t_&+Qmsx8UD0Le3<}KL9$mtps{|c>DHnDDFd(3CDc$70mdwp4c(o+i> zZjMJ!_I{dy%T(>QYiZ%s|uL5T({$lpA|h9t-HWd48YrZm4tK5_|;Q@B_3q zvQo&AsK!&aglcDnNi5#Qdv|6Fd)g#CGxL8eYr$L9tgv&=?;ss|kiOnM;&5f8Ts3fg z@aAl&B5 zvf*(Bx0K1wEHm@j+ish8ZvzJ2Jbi~o?d;k*i$6j=ik=m8RDnE@JsQL!itd=gydu#a zH;i`!ra;nt;+smcCqT}5>LX*X1^}Jfi2?vqKJsPk9M77!*<#NTgQVzs_+(8WQQ+ko8f{G!Sy<|A&~Jvo#Wma7!|ZRBhD z1S3t!#DMg-g@}vhXS%&m7GfKzUYTmJCR}PAsu6=`bFk;MpH-|9h|!Gd*YG41!XLwB-iYfr5L#4X69%jp-+;~@ z_k3ZlvT$m&&NHVx;)0=+}(RRdLX+`X%yYN~aXo*XPa;X&g``b}PdICs*|)Dp%*3qM@8kX%XS zk+EFOft(=qVWV1}srq)hmt#XKesZ&g!7~WlTG0k83W9_!o$Z%(Lfh(<&(f=R+t0EJ zlwpG4G6Q#RagH$hVe*g;`(}g?wXE^U7AEPXntIk3-uKh#%gaW`KWRdJ0xA!Vz?Js|qo7FCG-VEkSXuLyW5pgh#Znh1t%RWc!lzcR&}qG8JEFhyC;d z9TVck@(F}YaE$)t*3SRXo#T3&-5@i5Idq%*G+Fy)9p@*Tsqj<|0yL>5lki_3U^5m+ z@u4{&#%2>h&0#V^ACG&FL7?Oydaq#Z&vtsRTxAM&tx0xJqei)E?)g{c^MC9p!!#dn zGV7uLY>)b<_1OZ+y+NFdXx1ib*#0;g`pLtIi=^U(yR)i%w(A0iqZA`hm#Ld^O+D%j zC<}0<2QwloD~SSDtroEn5^KXTHeOcm`S(z^JOjiHnE1Ym^#P;(3&iY(u8;@j5pH#+rQLJl>(XyslcC?m| z=b<-6^#Lr(ZaIfzq~udEpWi;%7q=SCW=6_`e*9X+{oR~}YUyswKW1w~a17(#Mvg;v z^Ty!PwWDfm%OZJl1wsTQH_;UdTr|bpKt=zJLVH>8eT~dWJmoYXiugGz@_1PB^V+Z9 zvzf^yLSF=lzk3#Abpnzz<<5}VEbgQ*o_W8R=vs}aF6K$vA@C}|J@QdyUi>LAg0PWe zJQUcO$Yx*Ds0g}xW)knH7p+5b9gwj$K|1`SXELH+KUq zq|tkw>tH_z4V6FT&U!jQGfQq(EnSWle&yz*eT#=hFLRhvUZ3#fA6r%SXSgY!ehmtRq9Ui67)!{)bQ{*0V2nuaXe|U> zF*8wIYd8B>p>Ql$9W|brld`NB2=&2AAh_J&+Y!SX8r#IqZvKFtUbVud|3GwTUv{9!VVxLSa|9UA`waTfgKrceck z^bq`lNtSIh6u(6jEkiEQ-ESZzM|q+zN*$@mXT0RBet-G(h}|*sy!b zE9zMTOvw3{ZW4Z@eZ~z+4b$kkymvu7Fl|c&7{*faf~U&W=*s?P;ji&+kJA|Mq9|@R zrI`DWo-isPPmPt;#GUZV;doxc{jcf2OarW^9pUE5Q!MjDc(gB_>7=( z#V726yfR80{5@o9rBQTcGm+r$9mIVeg96908bi+=YGj7vrEg3^w70}dO)dF(kMD2_ zymoUKQ^G7o_}6G=@0G7vr5X{)s5|)C#ZKESlW?2L2t`_wUDfHthUL;Z0|)B1-t0*t zzY&Cs9D_eaZd*x*Z{kH}{ly|Zj)`J|*`1Po2luv;e~sKGpEz;ntXxLw#*trT6PWxQ z1@n6F83Ls*TC!}>#df7r{vDnncb4@GU!c2z(1UT9Te8uuO_=sOS{bG=1~+Ab!3@Yh zT0)9K1y_?DZwox$WjDbtmcq`5_S~OGxkmDPfAGV_qu72FS7D`#<#=l5%fS(?cz|%# z*724&MVK^#kxJbUy-n}h^H=-TnGv1A^%vq-z!?JNyv9?V;twrdCy+?f;E6hlzevOB ztP~ZX3jh8sM`p!X^E#Dk!q#Pt$h>GS>P(#6gVD2+n9`!|NIuo3kjf7El)sL);B+_ujgEgmnCB5 z7w02qU~E$>gk@jv31mHjFgul6!_J_sqwgyUAB&O+oSNbtN;?l)Pmeo<7r2@`_2)Qel`rAB7F!Yf3_aOL2pqxl`sz zo__7YmI4R!2H@#+)F^HkK#_B(P-r($NQ;&hG^;8>=h8G<K<8WZmm*0{z)G?Bg_y<&^YZ?SMB@ zKTNiiD3-(NeoI&3V0gUt9lIc^9e(@NQt$Qv(MATzFjB(#8-Q7x7`LPlD|Rj;cUXLE zHOIcZ0{eMnI&@U{7UlKA7*l4wGwpJp49lRrdGRkv?Z<3YXo4m`+cYv#2W41%7C@KJ zd^0AI3U<#I0`c=NJ+OtIq?X%++EQ<=*xqg0bXo#P-#TcFa+QB}a>*g-IGT;dv_OXy zayoSP4yBjX0BHy4Xv?m&VmyD?9DV%_{}^#|A_X$WsP72>z10W z`k7=6m?q=9`{xtLzfyAM?LHXWs&2;5ueP?GT4EMwxilGtJ#8 zJ^2ubKjE1A?#iMR!wtHbKdS>P{(*@;Rv@$a^x#Q8Y8Ewi!9e6=NL8%A&*l$7u7;eD zET)dIu|^3_b=M`h$b&O#wvXi%e~1joVpX)LCa2}Lz|3~_)qlJr#6A1%d6s{Jzm!sq zp>}aCYN3wgY|R~0otG$Rt*l^V)kGDn=}XvT;KX0e{cFaXib(@yL(Ph0Bql0xb?mKt z^3DR*AmX$ekU2@kbvVmR+RlP$G|ZY9Z8W2rGy%=q zgKx?ERgTc7{5CZ@F<{m?FmI)JyJ2{k1`lR(wSMWZfC!KE(*Ejm+939_G+vvzrh>{G{9{ zw)BZvqD@xRxi}^V2)kbLf8l<7@Jfy_5 zS5sY!)7h^hWJnAc%VgDIZtcn|%PTHll8J2!R>ku0D)sB~YQd!x@YoE8uXesuh`QzX zlcYH3ieGOA>fU77>jHy(sa~l6i{7sf{Mb!jup>Ow*S_3)u3u!L>X4HKeLUA$pSwff zV!ATJLno;gLP!F_6l_36Xd*g6a6V-Ch~4YT@)#>WGVElk9bH;mj9h$?s6f~Ji_7?j z#HjESXHI`--vXI>(!?m7P`?@4<<+Aq{qO9myHeT=ud2f1I98V^YQY+R=|hp_KiUD| z;hti995G(2w;e(TZlsXsYHo+^{Vf9GBsXx)uVBA5)H!^2v%MTIr8URD@NuTES6sUZ zl;>lEwJv$ra|(l?w?OfDO{c2y*FoVJ@ku(Ez=u0x-dTQnK(wRO=-GaK$LJaZ5i*E! zGVB6)TBSHugNu(#fsiArQiRe>m>d>F)~Y`!m{=w` zlbch3@h~712g-PDO#p58~qR5D`&X8 z&b@I68D%3M#uj0_MC64JW)a@O*~5_*=Ee&H4$zZRr$28GrnI=&BiflbFiB=_4QB1V zbpv~R=f~OKIbLirVUKq8n)!n5ezGUIegaxip0wovcw9kVBE4aISJFPuQ}?Bzjlv(*oUsK$r1@gc!t< zHFbX1(Ik73V-ywRE0JWj1+7zwe|eUPXw^geh)RE8%?+AlKQ^QoiYey>I2I1uoD87OBb zX111Ls)*`k&^8YmjHhHmLBX}rwnL47QUgrK%uG$z+akQ8H#*%(_{Ty?bLnjELr2mh`Ft- zcaR=;jak$LYiX5L`6{fueyt|mGmXUGMbx*RVs6{c#m97m-MjvpvV&b~2RF@hnkBpW z#qwBr(9My=Kf36T^Ua8|haos78vG;Hj_UzdliBR{Byc`){Im4y%R+~QYEQsY^@aS5 zN2rldK3YKS;8bQv>p$8s1FzL~gz^T5Zt1zvFVdd?wp<+OB9Ci-Y|(fa^b`WG>dSqA zlk>MT_YtFS=(NlN9PTFAznRD9A5k5+81ZP`u!gp!v!TbG+u&Gb26Ia{1fj0)Qgi7L z>J}|MYMSWxYy^7w#%`&U5bTaUN5c0S zawI2kuW6Yz0TCjLZ(4Ri0mudfM@{O$2DNe(>JLK-ngS`p{h$Q(&K?D^M4chv_I7OZ zvMfaAx^b`KBN0DBZ-LkvHHa_>cm{m@9I2UeHFJ!5+f7pSSUrF&-!R$+pW?2;anuCY zE9bwCZo2T@eUc_Ou+aM2L@OM_T|gHPeZcb=y;bdjWP~V})#3}U;9{eM^l8Z&i&s4? zG<&hXkMfrT1qlze+!1;c;cJ8tK*we683zEeDZ_IV)$)#Li%@+bhF#Z!3YSmrP>Q9U zKo}Y;Vy>mnpFTPL743{oWI<{W;oA3I_~~oCiuZ<>3KjC}c_$r7{+b-CPc)pA1V8R# z#qU84yKlR0t)A9MfMffffwJ@sZ(Gc%ysI5bEd&2x;%c&d(x@rJitpE_JdGZEAWxJ( z(hF-rE{>I|(aLD$dBRgL8RG7CO*DFM*7)b{8Y9b3{Xw^xR;$0`hWr3mKbEiy;le;$ z_Et&kb0;+ZTQ}Glm50XFJQMPee3%A-)KkocMCejvp^V%WZEOoZljBu3<8QHbK?$M? zK5}*0+JM|_mQ@Z3qRSI#yVRe!o9xY|NM^ z{`@d`h^{Ss+@pM~;~x6DpaE;cZtz>C_U|?!e9WaHkfi;#Z*w^FEz!k~P@gBsuYD~F zodFCj@C!+!swyEb?LAD}7qA5=FbLM$5i z6lE7##(!;hg{21?ua=#KZcj$l-_y^!RI_jVFj}8L0OG!r>CJmOj`^Fbx5f*! zGzA(1de~h;VO)T~r*2sxU$4g$da0EXu4b{3J?SJo9hGlnx`gTebYH5<{AHK8pT@px zdj+_0y@s?D+X<06&d@JnsGYv&$}!){@yD381r`a7xj3D*R<=e|f^ z5;G&yNVRHlgW3EH15F~@GJgnyp%AM&9Tf;{KSn#rmsyD=`y{n3gbje38Lz)2>en-j zfCx5TcFTK=;OQU^>{TC`Gb(}Pu#XAPtL;Rt)8*jO!-K$5wePy>IV9^}(zfmbWM1}a zL8N@_1ss?lRB1qCA*Wd~7hK5Jd6|onoNp zOjd*6zVOz)PJOkH?h@M=b3EX!4G;lEX@ijNmJkqB8brFJ zTe?e1M5GjuE!7L_ISK_z=Q;bkM86nkX&V3V?|3&_NP3@f@ zHa`dBw0Q8s6SpRVgxgpoloEZ-5^*c#x~csBWX=7rPCx7i=}1WIJH(6E1Rn!RZ2e`x zQH$HFaXHRP>sa0Y6^;XmJ(N}Rc~ugjkD1rToRTi9A0R19M$Q%D-{+~;`u(lP%!K0# zHhoh#g@G#mjQpvfc5GKY*s9>1B;suFXlX%PB5(henIhB0_64uY?IU2l&IDs_X>JHU z4%-Z4tqE(2E;}dly7kkxDmOjNolhxiMP;)0XjFESIQ(tiF3wpx%15=-p<+j2(<``p@87f=d?2YrVs-t0+CNUC z;Wv3C{sswLe%WA+7MewjP4V``2rL+;_y(Uv=}vQ-tVG3-M*hs0oT2&&KC*8&{#ogM zesF&+3a@ttD-}JVy5MXw6+Q8SNrsL4l5HnbRD^H?@mc=Iz?(vvCR&-ol-ISzS7Vbe zx?%D3uAH)^ESIvPW)?dtH&lJk{_btqtTIf@y=oSd7ILOXiwc_LKkdn7p{4yOi+-^g+H8=!1oOd8;TLl$ai^5$tE23l->UX znTfYy{y2?Yo)%GTc*6aO*nP~pn*)I*FazHk-7mR+S>shOQz>}O2{5Ts$RXurYL?;(4>(*@bqAH`Ro%j?C|T2(2TqFM|8A%yWbmwa!OGKq#%okjzwR(b-t)4&9Q$-$ij)HGj|=fW&LUJXm5r%{DqUsfq859{3t4W6%%Sn`O&1Me! zv&AL-&Deu;jm4sky+T(;`Azq}&gqfdie8}3A_ZDrqS(iBh%A@?it+Y-&6l_NkU@nc zo{>K@&oPRDQ9M637r@J1+9g_$H9DXs*YX2V31VWVHF(^TpcZJa3DU=Z?SJEGc*)dH zN()AQ|B+2t9Wi5&w2pJsG^ZCyhA+hY9SKgtXLKy>Vy){jo)@~{+3hVgs>vq3tn;}Q z%l}NK-9e+RxCHOx=gtht>Rfgi%dj452LYyYWHnISaxzb}y!}hO!SuD;zzaOzg5Ouq zfkMQJoz^9#nMQ(s#h3lp$aUPpYVWsw4q8d);h#7#&-02YG=yVpT5fCdJqJPy2P$a@ z-uEUdugtVqdd{3)w>MmfVWHt;93&E++5HVuW3*S>p~y$jeuzYGyk&3Q$c40mHEPNt#HbtG}5@EzMT zo3D@Q2RrDaF54Tv`33XyuR9MIV-8vC7Cv<<=R-6cMT5cnCT@b?tOd0Cpr}$Htd&OV z1!TOeYX!S(#5mT3nh-5|4GTmBe!`s8HJ-q`O@_SHP9LE=DKGC~x6~jp&e*d$K10PY zdZ|p;n{Q#@`Y0|_97yPls06sOri=%xRz!ce?7Yd|8i+{fx9FLG`?{3S~+I`!)U zGuO40lWL%*__MmONbk-l-zK|3xjeLldz5RtfH@oXqQB|jTg|>zv5;wSb+HkfNLgB% zWVuw|xG3oWUUJS>+_fIRFj9>Lg6U5&H}5{Xg+`#Nb5Z47g3(3M(fsGOX)-hCW|Uj( zk?U1{7dPn>DiXr)WIN1q$WhYfNw|%oX_6+P8H$Jp&fNZSkR*zp%%m_EKPWBuwPPId z!268ZK+tO8+R-Ac0ToruZ;of5qNz6@+Mh#${qKSID|I*>kw z*_uwwD4-vA6`&_@&3FtQ@mdTHOe*n%r(2x%@1d##_U(x2|2j~rJcbK)AEq%&&NsTD zb60PApk#7ye7NN+m2YCf5a=H~#32^ar@zpI8`{pgQgG$z?3n(Xu1>H1d?g&lICJ$k zUtK1e)u|2AE&~hvD$7BFJ5M*!@9rk`ixp`#cKuhMA2hX ztqI$Z-WvDnj_U~AL760yEfB5vv;LOC#wBeKn#Zz|TJ5dWfujP-`o5Dy`HiwZGYdMX z=rhd!xiDsWT?tQQ`usfJA8_Y~-8n%yy7}yzZ@o`ORvNQHFp9U3(nROm8`Co%@`OKv z+(NQ{ZDD5E(SAryjB26{taT=n+c9@B#LE{g=%k`CI^uo3iC3z|vKOzcoTyt>JCHNp zR}I(gdc z6rXIdNn&Wz~ohfr{$e;AP6dM#mz?~Ts5 zj@62paA)yG{8`8$=?&7zJI^N914OHb6e&>19u0D3{ z5^iGCSbc%$Y}a;nc1eD2#ZZxUXv?79-6ZWon{il_QV13@Bm&H@zsT?=8G9| z<+Yi-0Z&L%eK-d!X0y9)f9L*u>~dFoHQjK&vFaQW^sW-Sha6H)R8le8pO?ciPSxV@ zZo7=B28<}1LT}x3d7G_NV0WR*p_6@^+hQx!`O@e=R=|iC^8zC0;-5@ku8#8m(m@ia z=(_c?eDauL`&xGsnhE#V?vAJS*}96R_CwHj?j2I_Q!b|7{tbwEy5S#rh8*M)Ws670_$) zTkYnaecD-4b{7lJyk`4a=Ce{0Z56Ivx7w5--f2X2>~*oFg!vZq8E!|{UeY>=PpCst zy};%F&`gWw8(KT2OWHMD()n+j7*Ssa@AoaHDvZk5ViCOjezp1>z3a)Bg_Mzr&uc|{ zRQ9*WodXk;R@%wd!gF@{XEiqkk<>I{!M6g}pWH8doY-{2J0@59_36meTPcRdr3;=v z!Z=Gm=vlWV)#gFDCZNJcn?2qoj}DPCcMf4rDQ4grd(s z@Zt-hpPjs6J2Ao5bgd1=wuRL%wBR{#i=_l#3(SxaV(XCS|48x#skeyK0$PrRawo% z{`k+{^^J3(kMZ5TrKz2ShY@04P0#tj=eF=hWR!2ANBO!vazZCuDtQ&@etaAa{j?xg zz%FP3Xd}3%*yl9jBWJ)pH*@HKtFO#vL4KiNdz+?Aty8>n66U~C`mdzBvgYfAmZtSW z4st3oL^S?#%d?|w?Vs4NzUi*e=A!6q!_j_F5>>mf8XrGCCZkk)-nEl3rg24p z?CG%W4GCmTT#dgerWIpwv~)emZJ{VT^bpc+)k*4%z?=?C<*9H7$+tj%#YvS8bAh>4)`+u|Ij$@yfoRA-bjBhrkD3(0ZT0kTQB9dV_>+x@q0#z<-gy9etp_AjcwncJM3G{ki3*q=*TocX!GM=c(scyc6PSd6Fxyn zG*oqd*DGzw(k9$=OOx3t&dJ{x!d~TU8V{&d{Mb5!R#f|w-*_DS1Raz<&^5yUcgs1GIuThL+KYq##9H9x-Oh+?GTdXdvCPiMNI6;(6>q4Xkz zL%BP4e(!I{h`(*nsLpx-eTsa{MVBd66@!?*&FM5;9GP|j1D-rX%I#}vPyi*TLHT2% zepZ|Kj~$;oF=i8(ekZ}k5_gMycWMgSg4}~jnDv$nFS;JbE5De|)B{S1yuMh3TdGet zBpT9FU>OkeS>{-K$3-~I7tHFADU1N+@d5S_iNU7nzD%9AJlU!F7pJ&+4=t2UJIbnzddJCL<68TVb(l^qGTlAL63 zcb&gU9qb=0wcZtKFB{2~X^o@rn~IP2fT)(*RAb^V)JKA!Devs3s+49k zBC-hoARJ%y%+@sw#Qu6n`I3Xkw$?9so zb`TP4b`}tQ7;^E&=quhR$f7S2lSH4d*CN>20lu5@a_RLO5U2MvM0RiEJPX{#i@4V| z%!&5>%iJn{T6Ut!ZgQ}(X^Lw)gp#Uo#09CPd2r_)ZeOsJ^$ z8^(D0jCQ(!lDW_@ABP+#F7@7r5xGtNBBa8*D^IM-4JGa3m^Vrgh{T`j-fqU4dLlG1VpgLtQ+CmSl` zzaMP&V0?uq1u9`&pzONpCl=*Bj(eR##p-w}=xTg1Pwf5Pc3&_mhM||d#&ZJNeDM$S zHR71f7HC9}*e}ZINh(P+suYf8ENNR44B;L0C>-`7xcL_Vh3l;-wImuB*ywUPnauq~h? zJ}LsH@T#YZdidJ@dcL8X2Rm9nIEf?ec2B80q})J#E!ipWkh4p-0&}?>;ko8;>6|v& z93RfO-Tq}c(V=bynTM&uWKCUBP2@^zoa;sl%IW+99(*C`8x9l7EA}1^{Vi}g zly3{V4`J`xOVx?R9k6*EhkT7V#-6F2AIID(W=q!uOYLylsU_2E(N=9@m#A}T-)Dfm zB^Q4bv2eq|Qgon>R`9_@(!Cc0%6oouL{yR@tfDE4$setQ5{-YW@727|`_k}LZiac` zh;bn_4P&;F+f{JBEG4|tCR53I{v+N9W7Ak9j!)gsaajR##Y4M-$R8y%<=x$*UrW^K zI+wWQXtyJT8neY;q5P+>Sf4s@XC|g^c|=m6_ytz@*Qfp8eGV>OzCv4|8XZ%kMD9-C zT5j-7;aOF9T_*+)?bc)e;Gn?Zk180Znm3>2>98}OJ8(V}8fsbR5@Obi}{;<7Xt+$C2iLgqV%Yh)L3 z?p?$Yr>WcK_;_7k{2t52{p6~Y=pd9(^uw2;;x&^^*c~?Q77xSH)f2jMc`nj#;~Tdy z{HH4f|87d1|D$4q-uyO(p@8|_%S*W+bkhP)JKN9fvxv~al90=w?WO}bm)>5>f8Pb9 zZPOmU*Xc@lqi${f7O(e4Iy0n54_2>QyfK6icF&6kE}RWHKaJNs%2;p!#{xd(O`5tR z*Ld+_yCA9I!{#s4y*$_nqtdS=-5hXN&i>|;Vc@>ns|KJz9SJL6Zzc6qgtZ?Ca`eE4 z+M+J&?tI-wJiOCY-YZ^&TFzwhH)~Mdefx%v9&!Oa1?SsgOu$=g%8SdaR`pB6G<^dz>_=x? z@DV@vX;#>y=W>)Nqth}WpP=XlT!ziYk4~GaDAZ{lLzxQc;!DlF6d(BE28vVO+~VHe zZ3@J=Vyi)aHRth;zrXQiymyu~m%>oyC)Q@F{(291oB!<>9`&nD`_^~2lfg7Fllp1& zr<&i#W~kY&@Ia}6#5Z^yzA5XroO|bT@!#Lzk@z=Ak&yR1-4SlwyU!KU-XA4q#pmj{r}g<1$Z4H`a$A9?=64x-11(5 zRp;>Tr2*aF{LtUL^gQH3#NqS&0b2HdzkUDnaS$)|9r|xCfdBB5k6Q1+r3{h_W<>oD zKk+}`^xuE%5hhM_5vpNY+dua->1R5CJt_#E{ZdE^_r7vn9uavP-4PA_`#1X6S09Pd zuu9y^OC}6mqWJFzBO|H~PvPljVA(}=#UU;prifAH(?R+VjlMTj5V?3-8RBgN2f7vf zwqvrNkY1O?(aW!J26fXqh@a1gE}{|LBsrUUU;d|`BA)?6O||TKznts(-zB?(N+y2^uCN)}P201T&hbm%oozhC#?Q48T)r8l-;@SGzh5 zf6*2!hNQ?$y7c(Mo0+qo=MTGf0VY!b8ko;5OCeJIn1T>yw+Ga{m`(yM=eY(9-24=KfKh!J8^(z&PamQ9%wXtqI%$pn6^_zF~+~geDGOz2YgcTYf5V_5cOHEJ&$`8Y(w{~ zNo2NYw@Eb}-;dP@>lSNWP|v0l=Sb>wen5O)YcKDyE3rlU@F6lqf4jh62DEsz&p!O8 zmh;@WwI31L)$?NNw=z(zVbr#&+g z9RTC;5-^WHF!HI)>f7#5-HnzhDvV#P3yg zcwJe|5Z|s=f;xt>4Blv=oxRr=i}+3#*qc)aQyvKyQ1HNjfn&ElAf8qC2`ey=VqD{` z8_?C-aThe&%Ynvu=Rs)41npBsNve+4x{-U|%rpX`W`MQn5)i6r4K~MD^wj7F9M55% zx=L9d%-mXWD6QGH_VV=C`0R$M6myHrX$#l!bUgU-y#_#nTPrtaCBsh6*=pCgR7q~W zvnx4*{BAey&l569w_L@Pv{0q+aBr|PpghG*J#Q#1%k52G(bE}4ChY$qc*NFFiFyaV~D zMqsvordY2RL>p+BCPc|tjL6Hc=Wh7nyjdSi4}P7R!H6d1?NAN{C8wT`6@)`!8g{vQ z$`xMAy#n#Mt}#(Ml}!}E{OpT~F|1TO;R?^>#+I?3h4T&r02&j@{-BKcLD*JLUyyKJ zYgu?xx+z@5Ad-jA5rfQiC_NPNM--dONjA*YG}_fx4oy0>TeMZwvv@sVW%zvF>l3Yw z%kT1?EdzjvjytI5BOin6Lg2Z>`jDkU@Kj-x1ka1Udp_lor&d7bWCm%lKlT_We%X{{b=+Mvd3ACKCI_7qmsowCCS~YMv)`6tuN4xNN z%?f%W#j}$G?$M@)NbGlmvd;ulK@*NCP%BkBS!$~q9HV7hT;~008dk+f-4!j0`b9A? z+)a9vpTvLqgm^0`m^JcN->Cd5j&rQmi-n0~AC zn%i#~)7pkHqVf&?pRafUJQflWqr@|FGfj&zl1C=B<#`{_0?4AYJ<27nH1{BL=;f*p zt;O-*6z%WI7d%S^>0_MiQ0?gw%X?uXw=kTaY|K>n#ip~u39z-7wgnvtny8ez#}+!VF~nxzCMa z42OUdV40V^Qj5YWC=r{CC+9{fh0}-P_6`gIN&fIijtzMvBIS|Fyw#uVJ3eqt{g?l1 zO+A66H%0^K6_3IjaRzmz?z=KPl0&&Btjofdt7?S~G9}5dEkJf|r&#bEfh-So>@~qb z%Pc5+#*I2P%md3IpD_Bq_yO#xR5N$IU=ig=s2gHV4BZt+asKsvd~ga0ro<9fqu2=L zvWYV<^e-n-C)JCar$iIgtaRiwDcECr6n^+UL(qaw3aFzmW4_leyC%i_jDIBg0j(p!ot%iZ2N2rTC4pFW*W zZrs^F;GMuRfOWCIIXPN%yC9MfnX^@7d`PB!6=(m#3T#+kP}Z#a(_+S+@(wswm=M8s z$*rJenI0#aX;bF5s>_oAkI{P;ztk70oA&PS+S$N5>c3CszgrX+abB=rD&8{T24?#n zWC{9_)Oix;ocfU`3cM!*VdkoJwm9)2xJH>-E%E@W-bPS?Saq+De$l3UFW}`+1J1Z| ziS%ukG2JD8z>J4OIZr1-JX}7U_JU}rp86xz>qWUZ23-b_uP!Tb}2Wl-`DEATt|}pCnPe`iAq#X8vBDW-TxO+Ep_Tu57Tg z6O#rb7YPZ4#`O@6y=5FPrkH|{tW)5=mjvR=sJ>p$ToGg=68>a5`$mLCmCDCZZd0cp zH&R>%?B<9S4_D!VrZOg8Fea$tKda6wQFJ&xg>^IpTby2iD;yyi@Pu^5PbMG{4MhUk zjX?M$*lTzn544S{424_pkIX6c-0C8FtPN;VUW}PHLRkYd*%9_l(cBQ0Iv4U&3o>&+ka)3HJ5=q%X14*gIg@N zVH`q?))4FmW}%2`t0i$!%`ifVyk3^|82EAo=u*57Aj58`SMZ!j^s&ngNjDJh6 zmSb=PRz`xUqJ34rD2^%L!6?wHX80Pd=kn~cAmxMn0e7YFxM65aap*gONCgF^vMSU| zEhQQG-cH`9v5<=iHy&ptU69uxAaqw?REh;Ns68mUNQ3xpnSHmYl};ieA=UqQq$w0pbi@a1!GGw$!nF>v9)wYFquy zrY>TFMn$k4KBIT5mMl8GiFnyvFO?1F-DYwzl64Xbb-<{#0`A8Kn(I_OtMtZMoe{%BLu%`C4x4YA{BeDcWu221c)BCY#oXn_h6 zmOzrBc7_U@`}h4DKgz!scHW^9pfzrqhE<47kF)mk_t}Y=)%x*^XbqL9TPVETLwjp_ky`LYcJG^S2K zJv59QH$#j0^k|(1`9smmpKcaxc^+G9MuL9bKjZXt&+WN#OwsbT*yAQy~fHA7H_QX;uq`&#_2q~2pF70@; zhg(P!=-L=F6bQBZJ{*>y08&T3q zjKsF%7%Z=>l35Q|Lk5z`ZN%`Y0ywt#9t#_`P>NJ^)Sdhvo9lo403MBOB@Ss$uc6xP z*T4%@?2}pj?46AIVt3EM8Q{g~dpvCWCw$XTDx`RKV|R#6)Jsm$vzgiPVquuOelHMf zIwqd~zRB$HoXCPIyo^e~yc1)ooSk4WtB%@i5}n&&!6AXSv@fGEVWaZV6;_{mk73hLtt=;+=bC?9)N16=XkD5Ihc@Y zJrY%&{JNs=Nb-{cD_|0V-}$pNdp?iVfbWMvBr!&i?4q|%Ls4NR!3?a#=c3DEf4CA8 zUfpH7d0^}FAOT{1*Hfdk*vs|R`zVdA*3bCNTu&v z*BaS#)X+djB~a1%e1*lYK$@h4>CJEfpiMq3QM>f~;FtcSKIxq!8j&SDpGEqxn3}KSX^H8eW?KI)uK8pc<|krUIuRXGw-kDcT**(P^@HRlBq{NpI6>NY&f?5`U61lNp@+JzO~Ch6uP0xGE0*2^ z7OJw!=9Y3FFp$jW*H%XNgH>p&&5# zi`%J%g7LE(?}d@e7N`P6my6uZYp?p;Fz@tZB8_WbB91ERVm_f>$MTe5w)A16la`MT zF6i-%51F=%l8v>%fEnME?;pQdElFsTdr(9X4!#bcL*&WS$XAs85N@?n8a`!o4;GzJNA;8l=|CC z)m`sqzAl+N54v)79*;QYcctS`=@7G8FgA%@bs@@WOZtBJP#88!A!SX+Q_<_hy!RCy zyTYu7?+dgnX0dO-{4-$7>(13S%&s)sB*vRa#Jg8jU31N+;c8)ZGmdEnTF*stb7>yI|=lYVN=T2rVPTQ$+sbM zUFM#8T`d2nHb+RKLMhD6L-!_sJ~fA0;$ahS|1L^19ecwxM$$=-iH1Y_W3c-hJv|as zy8LjaMfP2>D%CYi1I#(+50mjix>oR)aUD?&mQA#2Ua1c<#Tyl zONMQe@y{1%l`l)j8f_~QN6BI(x^who=GY=Pk~z*@OZl1hLOPRr=&XpRQ-9>WxG&or znNz&iFeWR$%=;B8I+WPrMI08IRFJGJNV@5Hu^d8UDDQKN$NE#I=jjX-4k42kD3b0b zSOG_lXQk;l+R23r`qwm>3yk8GDOctkg4=sA>#qG_$0&)tO36YyIqkm_jAN!fml#e? z9;_-Tm$ZnB9+;>z$yvZ}{JKD7PEL$CwP_+A-5YJv{|8h`A96LYYd|2gaMNbL@d9aMfZqkIjPJAzg&{9YK2`3#ntmoxsFr9iAtZ zHWfZ||CbHuG^>Mc*i}tQ+LTYjFGkSP)5}H5f#Z_w4Z+iVULZ;0my`}#4rR!ZVY(;S zqtrqjrNTK8Yx(xJku2;bswt-uM`YI~=XA|PdBSZVyy^Ox((j`X4(SA-5{q6Z6_^qx z^*Ed}Eo`UeSaEpSH1MIExCFIp!jWK8fzSMFAk%}e`0DQa6Cu-B3v2yb!u1rVja=_u zx=uS+nV{+)UOplLn8ZOIP2<@#=D>mQX+b>%*&H1|Pv{bq@P8_u16sCm&jN|ufJ#yd!41nOJ2~-g#>$7>O$4Qe9t$0KT_hW^E>D>i zxU~Le==RT*2H%7{`$QLhXcTWF$_ZGdkEcy48EwA5QsvLod{r_@M)dHEyoz;tDuTI& zL%?q}iD6PAnG;4=kdlP-OO6muj*5yx`*Bf}UoYbdBD{zBgprvxS17rxiGVv3Hu;utpUJ~y^k!Wh={CzlEB|`@dH5%R)Kb& zzTi}EKpWhSKjS2!A10!8cp{iFIzcwqI%wRl;a_Ziofr$Yq~Yd|(?MT#YY)}|{o)tm zoi_tIq278#;YC2LSLd{x;t4}x2{)Xa@-ugyb892>ebW(X(xKaSAs`r@wY+xBj>~$R z-SJV|hantNSOq)=Nv^+EvE{7UusNOku2}f+6>T!2saa6RNz_xyFdKud4V4uFA^ zb5<O%Vh+4qf-Cz)-(Un0VF=qPId%5 z^Q9P=AlMJ#X8hg!(R}kRIxmt(!9@6^U#jGhQvMK{Z`44P)=QJcm+`N*!3{nWhRfJ3 zWDglv9@S&o*6|KQQvJ zqYw+a-(TqSCDh_#x64P8A#d{qGfQ;CGGGFb?|pIFn!%>(OR0I~VXS_qFoL`5J&|kC zrJM!xj|M6Z8aw^mAMqF?{U0iq-`UVBwYFW?KkdTlGW7g15qS@=JC5w{x3qu8rQ_4U zg_U=Jp@68zR$-oT{M}0eEk|Vr?-@6j3qnoLmm6PNQAE*5C-ZAGano0tKirz<^4Wb6 z!B%cv@BBZekpBvF{Ok9RsJ+r;=L4m#W{c$4pmo~7aHZHEs@L>k5Y!sLK48A)e;-g% ztFO&;IeU-$WfQGfZSw}Z6Ds=f@lV$2)1Y`Ed0y!qU-C7#Z(RA8{T)@J zM#ri{B)eS!|Iq&BRBKObiDUBMm@beAoyv+cgQR%%T=i5*hp+a0XUD?6U?zJw0L^i+3|sD_iiTx)wfe@ZmA)BBaLj*k zwYl8LMz%x9v;Fw1Ay{NL~4ER%KRaqKKs%6up>`HdxKVF#}AaVcI?-;V( zXd2|WFQrPXyzIy1g^Uz_4&2``;nh}EA5`AAhYB?_HBuh%05Q`97Uk{J*E8rFe_XS@07Hr=&C;WTwW%Gy4iZOc^{}KXAfAyJZEgsBd-_R4RbqqFb8+DkCZcp z^nw$rI5=Dk0np9lE+8JTIUrzzLTnq{h}&8ALoF2<7ttRnD*pTC?Ql&BW1;I14%( z*sN3_!pb!IJM=;N7{6D&+mkErg9R&!H#NBTV?`i(ka}i zw+=;;Vb5A-6zujhV(8|9jwL&`6V(uadR9dH7Sk(;pZe?TKibt_p$wo8)qMN``6c-D zOOM%lm9wM>z#TS-}BBD^CP8)y!b3z^<;fW;4JXpeuNUQUGgY1q3 z3)TrKvJTJ|XF?;+3k6M)%M|n(mZ9}oic`>nPos=?I8n3K>!$~*KRJQJ0zYTg1R z=TAR}pvAE>3|$h#9k1sHcxu#rkkA%^AJyF7B}&*TZ*B=pgu?EcIps_27+shfr^j~y zTM;*%iNYHM8O!oK|Gm5gdFmz@Dv{LlFLr2VqLq&+GyE2 z$FcCzjPOzD;8fktm~uHnyeXNom0~D4t13wqGCv=0gISdf#$Ir3(dM;Hek5I_3o#r_ zmlZsgv2yw7A{Qold@D-hKw5hhnU5Ikv3XFps}cz5n=HtrXl12T~A;VfANDKj2KUW67 z1^+bRY>CB_O}Bg11t14M z*}E_Y!~3O^2=3IKW-@Z?C(FOf^Hm*;_BgSIXClsf+m_qd-WJ0gOeL)cW zL6fbPHH0r+0kepY5_|}(0@?+6O3jh>zRyD4#bvVqgCs^&Nyn>tU>NZ6g^2}|JiJtZ zaZ7?my%m+#n>kpO3KOBWh~IH1kL-I5LBGu@AAy4P8Voz`-wb5um2f@6OCTpdGnV1I3p#u>KtP0D&`Iq!Z4=*VI~1m|pP5fq-mDc)U4Lm$HLhgcY0 zE(p3M;R(+Rbz1jb+72CRK{+m|>aNoGLU*hDz9*Qs)eHg`FX(p9%eJoKR&093(Vi4x z%Y@&&Jf6^-BJ^M&UiE9hqW^E24z~}BFTNn>bNh{hSwKd}O$MGBOlsQ^Pk4Ui(OwAM zsEKLbfV;$LE=RM?#<}r)R9|zXx}#&w>~yHGVtuP-A~f=AKik%!zZ+t$DDFuZXzE4l zf~HqrGN&C;Ad810t?mxR$6fqP=_+#;qBepb)HjNp5G;+)k~weqin^*5wg@-=*!Zq30^mt+ro3p1HD zE8eWQoCB>_%@i6Wj&|LTFTAgF$>v|Z+-Z%3WJJ(%L_52*=LGT0U$rASs5`z_q90+( zCO5|H=uZ_Xo5V=i@qW|0U@y~gED~4uum0u30;G#2Ap`$K!&-D-D*iW*dw{lazbNBM zpyPyBBVbuXEgP&Sw36N!1a{`W$6gV1E^1$d=~#0p%-@?=!d{^8p6J1VDq7LP&N127 znLF473xy@J`*bwxrU*Exx8MfDF^-k)Zx6sU8=rCBgeJg7w-Pa2Z)Cb&aQ!|bg^BMW z3~8QO0H(m3(Y^iZGL|glg^5xUIlShFK$Mj}_RqAhqn(>{`3#E!DV-q3DGSN(e20Uo zLM5p|eY>P0h)+)Ey>)Qw3GV?LbNP=rq;WI7D?B~+438hT^!jMUftvRZ8_x|L7f zTYeLw)VpC_?S_}c>KPAO-UwQ!x3zLRWI~Hh*lXW@o($%ym!2oId8%gkFq-@TU{C4c z%U`VhNlk=3a?-DigFD&Azh-nL{L#@OUWe*sPAuqIfXFhN8vMhl_B2XZu46%H%2dNC zYz|(u`7x(DM>64?w%VjJ&M=X_l7AIs;@~Y1n1|Yb_PqhG&Sn@?7-wrx*HSQQTv^CqCNAZ zxbgA|$3Sb@Vxd*QC8NBT67yM&%Fj(w72o8w@Fv#b7Kl7z@WeuC=r`Z+=B$Pj72f=`gkqTNb-$vH|LTx3od-~$>vqZv&0rDRzK)FCM zV)mV1M`9T!CW=W<4bjq%4}hE|TLUA0p?W>7&^SmH9{Tjydk6}wOfaLUPoez4s+#Rx zEYODG5=z8qw+VFvhO!ql77_4LK1`gIkg#vba1ZjiZCp7=g&lb<#4b!SykfrJr&o7V zmT&S)<2;<>4YA+KY!+bBp(cgL((UrqSw~GKTnwKvv3=jif8s8v1i%nWMR~(xp|QK<4XB&WH6eB~H*Djhg2~Bi4b={Oa`Nrdi5KhkOrDjf-B@AFSH(07Eb$i6?OM>O z=C+v8PnX#ZY%t=XA>y&td67CADWe_sE6#_fEr|VvO3`aG3rX4iWS{9w z{*L;#Ubb980G=hCZ=pUk#DzX_XNBcgFSq#5^q^+E6>)Q+a)Dua3tazAP3Q~qJp%cCE3XR2-U1>y==aHleuvysQj{5&w%HE zH*psa%_h+(CK!)av@r$nIBv$PxPLgLPQiJBK~^@r*H~Q`RtjRd5n%nGN zp}gUTs}sS0X*4`|E}$F5S#Y6BxvBLiHxRMvJbJOs&G2yH-*Ah+p=0al-TS#BV1g@T zq9*#!vD_AlPNp4TSDXNAM-tY{O`bfj^22{y$ zv|WDK6y(ZycP&~IqR}t^;nO4j=`zkIsv0cSOh%ml+C}VzFUjz43kyFsU+w#B3K0rF z{6s8b*mc#-RE6KLlTHDWn1`?diUG&)ao_|t4ZXR8;D3oN=u&(U_j!b7j6c8j=U0IS z_}>22sQIV=#n|p6N4au?BnLUwC^liplx~#h?r8T6{&plyY8Yy)WDjt&)woorHw$%W z3Rs)^XspHf{n_#J3Wb;VqGkGIzghHu(>a!OQNB9ui3 z4xPFSdvGclOBRD0K^C%k?X3?pa1c}c=~dRzBY!02hO1!lHRqp{bjol37fL#aflhM= zQh;JvbzdLD@4(Ob0iC^OH`HcX0D{hORVG;Wn*ZtV`DBO=8Un-Ypx0slic$XY_eH#3 z&vLacbjbW!Z~m`Ciod?kl>~iE?sL2FxIeuS|MrM{T0%blQg#UH-_!U0)2lC(E-B8N z4aX)={jaP1|ND%8^AeK`e0(NtAI3kvVE?wMJj%xTgrl83LiGPAA$j3)DXhc|UG>60 zcY^<$Z@eT?;E?5W0QPM*BuYKsTN@OEIY_F!M-`7CNIRB{o5TO+Z>Q}0f#Nt}LbC^^ zeKZO|@cbzNfNdXR@|?}~pVEod|C4k=7#*2XBV2w(fK!ET6^!WxW&)o*gDx$aJT}Bw z>*`Y+zuiy{j=v#lzCge9PxVC3zp5u_UM)>M`^d{#)ek#yCdd+gyj^?FbWw{4DioF& zJ;Y1qF$#A6qOVBL_)m4mOK|$tonqRhqv~1cEj<8T+V}6;XUF%^A z2n`Di7z1n0_SGF$J~|Qf7$IOWaL>&eH=uvUD+nOxt8qSvNds02=4sZFFOjWI^?|I$wqOWbPNxbgPPgp9MP+%%=I8wdf z($wqT71r6N*2?jO*zA%`jZ*J8cXlnuUjOXE-t)BX)?L5EsI@qUUlfG4ExSJpuH33c z>+QrYTMU)Ln;@Se^*rsDmvmEVk%?0#?ww$6xk*}U^H-HKA}40pVo*t3zoq_6#X^Aj zpvf5;%*0Z;wWHMuX8VuD*v1DZ-bM!9gRhk<2sL41C2iaSKVfJjXylLpg$pc)pOXEG{9G<`uugi#; zdV`L8Ne+kIHWBn7KFue8sZA6)T$+yNG{SFPX6sesu~H#C%%YIXF&kSp%ntqrTqFif zyrYZPkTF1`Q>X+rI+B_E_6XsYEXStsn&44ua~sbz!c*f@GUTT&?>6Ebu>Zkcn*W;q zF9^fIZqtM8_#u3?z0zd-$#j_#C6|f9VK(OR1BMN&2(}a@=XFTjh;$qJ5X=t}Vj}l$ ze6qNWl0`F1+!a;Fyj54^F=0!n{Ej>(LcUnnAzvn_%O%Kd3ZDoD3DR=zN-iVQ%bok( z6*?+QCdi{Paa6f4^Um;~e^xzrMzfgW=qjV#)H^|%b-SDms&Y{?&N8j=!%${J)ozqU zRK1iROFj2Y?kvHYUqjZTcdNcL^MbZq78=irrj<#rA&Ps7pb zg`=?*f#r4}@f^LA9gTg}U6PgPzT127!2jRzYr~2@y*NU~n`JjWn{6vE!d@r*gz-xZDTC{LbgF%*eK00-**!K= zKABBloKV#bsg4#igsd5>F3Q9Z^gjF$A+Ykzg2V(35lxKR612O)R?bl_sIR-;!gXLe;5MX#=P&u!J$m0SW)L2RJ@7@f>%s za(5r-Z{;t~i5E!3UVn}&uBSo$&YeTeOGc1%#oc&4xt3ltOOFgsCYIX|9&4RKrOaLHi}fRoAs2uqw@NNWh@( zDn+BVbplx9C)Zd4yGiy3%G+2E7H<{oZwTR~?YHLC-JGjeZq<7rcLrzf+-5M}4<0Jqt|v+6`Sn*MbGl;8 zn&hJ=z)xZrUM7ug5Cj6jFc7tM=M8OBgm;JIN9VTX#BK;2>WtNF{`R);KKZqlYy`I& zVZAe$YwKC5Q{2$QP+$19H7n>;(EltFJUqU-n*pj5aV?)d*kurC;s_sz|DZZVHphTo zZt>a|HDJvT0j4>*{8Ia@8h-*u$Gmd0Bu&8jH*~{UV6T8S)A#?8_SRulh1=SK^LHTQj4; zmq`vIhLo;yEO$Ry?QBDODzL=X2^P03Mp>lTHp3t7#KJZy48EHrA5=-wS>fwYN) z`bCg(A1Iuz)CcAu#z;sJ@-DcX)*RzX$}VA+&UY3WR56NtL%c=E&fM7S5F*iuW(fFp z=EZ{*lT=+vC4&Jhc;TH)2R6L^#O)<=XVBOcokfy z@9HXfgSm5G**=F^&TAbIB6DNE=H%-|q&+AL|2J;~yP$Wud#4<~!^54yxs(Snl4%OA zU{=lTbODP-vDO!YjCdNY-D*J5(pLeX8|sgP#e%q6d5ZyJ?`NxXBSwVikrr(Z zGy05D)FWQR=;(D!6<(XzdTxe-5J%k2;Z|q(tu3%7NYSeZ-~ikC#`CHU%^#I?wSb#xpSg`}lsTCOGxjcKrtKTqn{JJ7qC>Y7^xmf8WLxfX5M%%7Z%*~u|1yuDY?ufQZt zd4=22t&hYcWd$6I0sWDQvmrv9s)<5!$!6e4`$d1fmEL}VwQjdgV}WxahkrSqGRpQ2 zd=*Nl5=Q&G+iOyp&)&!vt@2sb=k*f~?>l}fSh2y-KfY>-PTF0)@@jm8Cp4~yA70$F~}xEZjcBRtrL zq=GXmSaI@1pmv_cJ4d#ndN**~4TtayDCHCu7puk(%c$RUbvQZX zFOk@1HI6mt4S?bm$?DgEeHiUX1^t(0CQsA3i)~LL&20tmgJZXuvp4%i=jOV0=OXrE z$l}2(CdaeaH%5@Vzr)3uwHEd{ea3bR(8f5syJV{-7YEc96!4F!ugnTs4q;0NgDcd` zGp*7fS8{#E=_IUYW0Y@@`#VD`6WgF5@Me*Wu09>C-txzjSE~VWhF15nRgJ&)W$J-N zY&a_0-voCPXgKJqXktxC_7*s|CfXrZ2S)8*lS!W!;+{Sp>c$suEPBcg)UVq8~-9{)BCUOfAVXmT@2ZOO* zy|z(qHSx^!%SlAB7RkzWm2axGobQO4e!nd>e)kJWO2k#T<5~QNpbAlL15n8J=5o*n z#xZ)<6+UA>0q%x;83U1!PR+_b)C~WAOc${-6`EVwJvcKVzURIY2;`JQeKYTGGQv-z zVu4x85?)Xa2MSpabVdJ{?YZAF05J0L(e?%u2>(o&z9G)Ej*mE%kEkv1a4BL}Nxl~G zUT0OCIK?~9o`O=Px*`+sboDH?H@x_2@X+(pNbUaaI%>6h_p;3S~?w(Z6&f|Ah$NBv&Gk}*xbc2>oK710rP0o#_!I7 za}$yHpnM#afrCX2prKD@rT~kSLS0X7yJT{NkPxuaDry`4Kt@W`y+an5e{%WR36x+t z9S)$pX6G!M}!v3R_AjHi`@M`b#0nGvQiB~De)a(aShq;d7E9H4Pr zQQY_d9DS;@duCbIe>WtkjJn<_ovMv4kW1dENr$@9cG0Z`>$;pz2g*z87riDA)my%{ z=B(_*Ejnd_J^w2IxqxvsfE>F9SHebO|^E-hz5@?+#yTHQC#v^yR!5 zT|Eo9mzHgd)w^73-Px^coMDp;u=gDS9r41DX?EtHAJr-IupXDhNTT`XW?@rd-N3hM;V#c`Q2+K z_c&zxHSRcFhQ4#`;VZnp@(7eKU4P~%rx}96^_?9%(*0-}s^t~+g%)m%b}kXuU)u(M z&NNw1fW`(cVqN!0!t0_P2#~!ywWTS(Ue}}mzM-{@KGcvl^E76YriYE}kaqJv>6rR~ z!BFDOu^Bj}mPu8L4T;@?bK=SFpfptld)I-4JE20h22lKvI zkaZ(q!`ZltwL)v}y+Rj8F_>vrqdNQ>O9e+gy*dXhHuMyx;aV+t%i?fIys{AvL~YiO z{))kZR8wW+mY&r`5qrzU+=xzZDFMbTsHDWEYoeey;zv8_l=Ah4NuN3o6sK4UJt{wF74AeT7%JnTyGwXYVK@4DBJ zeW*ccFxwaQQq4o}My)zD7vqU=>r^d`+t_Q6@6%d+nahAHec|T-+N2~mk-D%)oXyD$ z?ohJ>Aw6&t6`bz;!qpT=OkZhXN8t)0829MRicNKN=;Q+BLg}BhpJN?>1hy+7>t0~- znUc_2rnryS&g1%g#nJu*r9+RuH#>b?g+pnidng${nLVM zvqH!!$^J>$BwLy-hAR+Ulw?ev?DFOpQE8=mfmoQzbRfA_XsWd`avVcE){h(*p3`Yy z9kmU@O+2hEdK*J!X>o{%Rq?!XDR(_rFj1wOzO6jBsEXLrsHtp#N_uM#1GfiO;hq9l*OSOOt=94hXZ=$D~spa@i6JUZTfGmXJzy}-QBatzLlx5rCqd~7esH6{#2l>;RFSpqnT zH}r+P$5aT^B=WtqPftUwmF2zArTw4d%%m$@S2MiR*@K2`iul;6KHf^NPt+#VVmAN> zNYWKljnk^(c!^P@GuW-*=CegK-WNm?eCPZ{TgO<{zWE~7#E4;3ZPkW5l3h@xO17w* z`?;!*P{C&6wW4An1LL`oik~N16w-zm`6OU@v)gBC~j`R$EZ<%3}(sm9Oe=+NGQVHZ2jnlB6Zq#9X zvZm4;{3BN#WFiHdfyJl;cWcmswP`45hS}2?Lso~#6Q~%3hr5w+REHySdr}GKi)4{9 zDSyast@(-m{zaf52%eq`FS|^Sw<_{-A|;|e-=AYl&jWu_^$LeK>KCbK)Z&o87L zhVR}l%M))w9#F0ztg`o&$6&715{(X`s%gshYeqR8!!~h{{^{z7BX(Ozl@? zG)(2-X2aah$m6^?I-@N-!$C=E7&QIW_=OZ_g@)Gl$-S2nRvU%FHfoGLtFr2y$n<>3 z_4)|WB4rniKxFCJzG$efTe+xq;&IQ3UDUPh;x|~Caas2}`JT_C>?=nb-C(c*p#Cs$ z;_#wl40%p{U(2_HdlU@Lp1c*|m5cXUedr<5Ed9ts?Ce*9=I_62e?par%<6}n;v?-$ zUH2iSUbEX&z$94Y;abxkm6PIJ&a+pV9c3%nhZ;Mv{n#d|<<#OqTEOwkdING~84VgO zAAzK&w>;SaG8+TG)z2^QE8NT3Pq9?zYlw+NKj*NJ2Q-b+8{HTH0<|1dP7wuOU}y4= zy#XZK+@lrNsF#g^#Q$l`mGgGn8BKxf7Z&^^>j=1iP?&?NyLY*A!TuX-oN9&@qmuAz z`8eYwlCTBMy@!(3_XATX3@`DT%&e?KWzNBtAlVuhH~F>g*5*0}_QO3IP>vtU$zdm1hwd17}DN+ z|0$kMB~=Zn#H8oF5-esaD{m26aiw0{%{f!847@h{3NVa?Sqs|-+;sEt1qAleV(Ha0 zP0~|;@#p)BUxm2VnLok^9WJzj=QvZP5gxk3X!fJh5eXU}OJ0O`LOdfqGf@dxG^WGGA@*%U$o*q<} zqH4cc?llz%Oc3#AO0)>7zm{A^WP&HHua+6}LSF1lW1Q{7`vxo>tRdpuu6{R( zu>KetvGjFeE2+_|$k;?H#L(QBxHXnpTGPxP^1`;rD&id%yc~kVID%oYzSuu2k>p1= zs+tHQB@0`ZxVmsmu{opp1^R$}I?}1n0kpSpO|L1H=Ox6u%l(3I9)mHlg?y^2M7aG^ z|J+cND^Iv>pA!g$XofB_dtJHkNSr%|<{P<~xu227k>1_pdXhL`-zuml1w8^F+FUPh(VXdk31Ohx@`kUBk|bpSg#dRZO`4?-n!3rFj^) z47L~zR^`YI27hGT);4^!u7@|4#+F8TQlq4mxN0)i6oH|!ylJ5sdTO;{4b_yE_-~9A zn_jQG$EH1fKUUYVOJg zcfWc@{x#=Dxb{Lwk4akGCF{|yjb+bh=N!|(q~y{;%@*1*brU$>J&N~2KgU>%@?KBL z8GugJ+2j>&S_dg>X*DmrDN607)J= z6O*Lp!Cdl>sn+7l0qfQg$gRZ_>0nw4_>%b1xGOxsS(EE+Rd?PKp4OOJv2iuyd`K3j z5h>X|P%iR7UrNaUp1JJIJ9ZkY){`G$HdWu)m=FPhgGlV55xs%ATFj^cb%Ex|d~{Lu z!d-k^@9cV|nC)J;<+i)tG&s{XYXw`hS4ZOt(F$p~Y1l}u<~6Odl9iLo3(lonW4GRH zr$0v#N8yLu9}kyp+~Ga#M3vPjau}BmH2O~4Cnc9JE`_u`4_0N2^O_;MYTIwc=mLp= zLGHASZpG%A|I6_tkM(c&ZZrC|r8KCEkMR{9eI)o0iZ(nNnJvN$$%anZ)f5TlA;j+J z<-9Q!FVDay;Vu&{bKb5kvVN~@i*VDtxNl%+|7W_#WN3{9{2R9v}|Dd}nSq4P7;%xWf$9*DZT}jz2%5!M$ z;tTa5MFlh0(K&E<(6nYzpOl`gsKldcm$ng}{k;v`GqOEwynmZOP4*{x%nLj3l?v28 z`i_S)$jV}!HUJaw3gx5YwnWVZ+b@=xzQk`osv0D=>{k_zAhKHdT{g#M8r>qJR!Yo2 z#gU%Kt3Fn!>o*e+m?S5)eU=Qj_q=ihRtht^dx;JyKZwSQw!<@_gsUCFSqA$_j6IUw z5JU(gtJwuetuXp~li6Cid=3r~TAfy9Z7$5ryQgk^q1^Jq$KcR_<9_z~*hN(Nh|c1* zH*NhU_xqHbeBSHA%4z#q$bHizFdi-HQu4g6m~Xq*o<8nq;3x93GbPLyePyr4 zM@oFn=7!+Qp$|V|cr2L94X*-m>4$Wqz@reE$YS9-_CuLSuNGE`{~(`zqICG%l8B8&2PtK!14W*>_9oOPaVB&);$~}=Y_PjeXL^?-~B#| z-_jz^!Oh48boXzbAkzaq!2;WNd6+&v2NcyWYjCiGw8kF+nqBo{Bj#FaG&t9%oNK(~ z89D8Uc!@<&hOF5SW?<2ANr`CS2<8f2dqrUu?v6MC+byqJzn<&NsID*2`bjl9w|l=d zczXm)RsgwV%v`iEoZ`{J+usSlzEzEAU%&sX}>pX%Rq{0Il8VmcoHsiP6J{SMT`C+xTs>dCvEQp^cjFYz)YPh=gM)7;U+PQacTz7x; z1V6m+36=1hIR!R!+E?|n$R5tjBHr&}^0T##A_G{ADK-h#D@3{ZECIMKUwG30AYjVXTsmMWH8ggCYoXU`oOYN7Kux>%Rf2F z#m(Ij$#&*R5}BwJgd2i!MEvE%!7hTG0RWcn4{Pm6Oy_GBx8A%f9?%P9FZr@_Kr%ip z7ob)0z4_MFLiallj1oX^qG$Sv__kAzGMsO%3=dFBTiPVHjlamQfqJ$(Ki+c^{rS?H z(-WAnxlHlR+7quF3_i>@LyJyJQv8@SoJMwnN;;X+gIyXtdI87>K7XAaNSNhW(l%`= zWkY=S0ELt;`;(QW&0@Z`#Kbl<5Je%0&=Pm&GjGwyc)0Cr-Gsk^ORmebYh?ZS^0Oap z0T~NGG+*bLgnMt$#uz94I87Ail|L^?av)4C>d30?2|wo@el)Z$0-8Dnwd`ur+NX%Z zV=4F8pkrRmf(+K0_^IktX1=@|REu62o*F^EzHEK(i*7sxs;IA8sG&@c#kH!>pi|j zp%Y|$FMlGLovu+s*P>)2JA-NWYbe_k15Bx^s#8*Uz|qqFNV<7^k8umMkC}&kIU=l< zpfXZ4(pDVvUA4Z>hl5HDkrcsW}7t&^p|A@OrJ&o4aA; zPuSC`2;B(k&)MO;-=#znMPb|A7%NOiw=2e9qYxp?yGFM~FMHq9vh4BZGYk8ixs4TV zxDFrN>m~p{q4z7qur$RpC6q}DyI^!YO@U34a!+wWvyrxP@%28yh?3&5oyXgzF7XVz z5*VyRiUEQ8$3>zAqzeT{!qvc{T#)_A&irlx?W)7gb93!uu>aA1>T@4@CFk|ixeC$z z^8sg&6>b2UW zmOEUeD<`Hi&vKc2J23MSCN1>H554pDoCVpe64r(I79S0Di{w{kWqPpdNXxpfaZtIh z*N0Gg_Y-c|$(yb46|DwqUwDV^Yacri2Ke0E-#+879R=TF?~fgfiOSrMr%aXFfxd6w zTX4o-RvGXux_={KfiM^O<)=dD+4+set7@^J`e@ao9?+Bl^#QlBfWpdl?WXR<*so>0 zv0~Co#Ki88PasPq`_X_axb*q0B38HCiTDG#siTu3U;beLr~ne({i$F~$8^X;j%3?{^j$`r+z2$#o5JbWJyS zeKraND)HukFY7@K?pDxhk~#bzD`{iO!kyI*^`9Mz@@kHRAM-@wD1MguRts{8x~;T?1_R7eLG7p1%CthM{1XFXQO~=q29n08qT7hA#MNiRLLN z6_aRJ&jKQjYCcX#*4ZSWV+p@w37Zz$C@?AdvEcMD;NZ-sWL@)+`GD!NVRTAWPtMEj zPB_&f@Ol=@sCz1Jm|%=5pofLOkKfbXapq-fd$I2^*=r)hy!XPa#!}uTOY=uszqUUPw0sKYmasr*s1fPNHTrZQvL^V>xyLaVJ;EGVJ9|~+N4wElhYkS zVOVx=8PTvzBXYO8ij}PK0sF=#h03PL;+46cMM=+0B;w?yk|vtFsFk>QLuwUr?LaXo z=jC2t+HNpXj>Iz{dnAal>5$#&i3!y*z-t4yr`k8Aax~{n`CH3qU)(FY(^|amt?!bm zE5&xy=lljXSs&4up#T2y1*62Dc0%`oWu5*btsA`yuQZc;EHF0%zitpoC)YVv;-z`x zq65tGfn>J2Hf7kWJ3I}RTHzf^EorEJ2`btKa#3Q%$)MHOp|vW}|HMuRER`q}|M}qT z@*Zf-+;7tZrOf7Cd!T>89w>F9YR>`C4@QxW%36>5_ss?mSLK4X0Z6m2-u7amqycfV zzP_#fQb;zdqAr>piO_njrVKmHjFjZ@M({jwn!TF}Fp)n4PXRpekuOOEOXySW2d|JE zmTYltvWv%Sk!=tpz~EEW17B)Shbu!LHvGtYTji7ZDm$E4*U!d{$&1EL7Tu* z!$dCMMqcCrthX^DhQF66_Qq|{WrWmqq;cy^o@Ei#h3&)A4eEs%PZEHr!kKE$=zopa z;c*bL!&{3qx{YV*$WQ+3qxo^Q;6+f3g@&_$o}mU35pl;_G6Hl@fiK4DWkLO3_q{aX zr3~T<@MB5VFN`GH(u5UELp<`J#nrrQ{%{bMR2XWtS1vaJBoG=;Jzvi#vdn93;7htd z^cywP)3>i!f$v!krvD0gGiMTvBO$%I6(7PHVN-0DLg!gJrrO#Sn(A8_lKYl5NAW$;{a->7PMWF3M>UW!V?$a?qI;iVEIWzp6}F7#(!@*R z4rs|-Su>fL>JXU-NUkkf>;OyVZauPpzvzzX^5D9|X3`q(KRWYPbh$$jUOf|(*6*y6 z*Y6&mf-cO7J~JMz$Vx+{)|!SJ+vk~*_2$(}*gwNl{MG5-@QfDy&+z1N!IwAz++o|` zr+0sS)eq9D!EP}{_3Y#h2QKIeuu-SD2q~rQkH?CqTsEL*3P1m?i^U}taI7-YB#7A< zO$FNlbPJ!^XGs|b$&$idLS6@LjduVL(;U-M6h{LoXvG|%F^arVIgIF=+6D>|Q&Y1_ zX27=+d6Br*DoFvn=8VnKK8)NUmO4*kh!Ya5;7gx~^)0tlOojQiJGoJi)EZH^0}g1= zR{VOwdPK>2hJSc)+5UF-D2N)nu_E`$Jz|QuO>6Hn9XO7aMrv)5Ze>;;Jktyr0oyCz zFYehkF4B_LdBan+%c-f5e**;$Fy46|7kgMvIq1G?cpiC?7%VK*NWsFtMK$bO_Z+#R zKyg?**aD+(6O0DxRo77Q=Ry6N++FNgt?k!LM~VzDeH&WY*i5q8)4T@~LHK#W>u@fV z>k{&OeVgLzY)?7ic_OG-962l<@- z?8_W531UwT@+u(}0U)mHJ~^g8rk1jNn?SageL`1}oMB)^^48fbsF)B%V)Kh)1}{xd zEwBKt9D%4B@hW$x^5!nYR6kQmah%*kmEN+PD^_aSu)yr4 z-K^;YQ`A!k8SH{^4>4T9ymra0JJ{NNEB{*j%-rJsM%SAsp0tAAKsF2+@U=HVx?CWV z^z{CKtw%wN=WUfhzSTWWV@9Tex^*76m1euRGu_ZX1Wf&{mO;g$XP&BA<#lw>{6>Wd z1JjeOqi=p=nrmdWB#GZ?2-@`wk_BZnry6 zCvSbFY{e-L64>jcW!9c|8l2m(k zJWwu_kGGW`zHodTnbRnZI9f9)%3YQdji1(e!g|Q0QGg2T~=`Ty6dF6nfaKVnr4G$+}4kc%FmokY&f$K)T7k@ zTwV6fQ3sGm#g@;sfUw-WhG9Jj*sv1n7CIB1!`pkA-I z?G_hFj1sM~RUo-s8yk`=p@uO)n&6P2ov0ej2GHr!SY2Tf*$Bjl6tp*sh_JAwGLfNZ zasYyEAV$ii{flbe*wpFc^LfwEE-didTLd^UzETNWznOXRd*n9{kSHj`-w)d4nU}mk z`M(Rfnx!8`Ugs)hTh_HiE^H`8PF)#YzH_0e0-$LpIbdepe0ra>Xv++^t zPzh|T)2P_|+*)~U#Fi~mQjB&0==G=QVNVSK0Gk_C0CGiH*~yRUtioGQ*~y$PCk}7R zlb#82PE1I#P4th(ND|osO~m!|UaO(*FDBAvXZf)WMIa=<#}xw&PSw+V1umeIIT4r6 zp+vL41$g=HU!X*!s2GCf{*4@Hfm^0mL1AV!9;)@OIWd z(x8w?MC9lx@6=h!vu()qtkNo{xQ_mfUo&~3SX(H58&`sN9qY(f7u_{QqM!uZJFJuSl2Q^M&U%S)rwsZOxEYoBV)lMGb7Nh;2_ z=VMkzp}FRWzhvPT4g#5p1?`d7aum)bv)-QR^bL&YM$7F+V~WW zpVtYgsrEL+`^G3(TbtVejR2_Y6i>YO0ba&pp|ci=RxFG12#F?U$<}2w03QYj&Xb?f z6%(KZIvC!Ko&zc?8k;KMh?+*7$^8bVg++^0J%<<6!pW{iTc3`IUH1TH!oQ*$^zb-R zpE%kb)0WQ{G?Lf+T$G(~PuaGRfbz}cf90F>yxVyLSg{VRT<5$Wp3?12gm?FL1zctuGCQZs_eurKG&3!B=PnENJbld7j?scYr$Dhy0Kjd z7EWOt;pkr?aj zLM=sF1Fp9(Z|xJ_S)fSBV9g@RHpWDpY=xEQBZI&8O~V!yGuNvL1_ofoXF4{kS(pEe zX!RovN{PhC96jktg9_G~BHGSnT4gB8X#`qiRGpoUSwvq^D?^=eyaT1} zir;NY85Smj_nUCuOhvVYI^dk6bvITK?MneBp~!M=09+awLX%DvnhAO`GcpoZ23Ygb z!O|9U`sP02Q4w&%b-t^(xRu%uviVSzFNtnJbAlpp6tp?~un(2~z zDv6#;ksZM;32Q)Dxky5Z_^-13gnYFJ=2U85tEZEn(O367 zX;(z|Aj2(Hd)2+;bAd>A(e>=*2^%LeDo_SJ2i8B51OvmQE}kj?@Jc8LmSc<8NDf`* z7Q;q7%>{|~Ct5dXc|r3eJni!w7~B}a*}7_<+;bYmE~tl6iFDC1Ey!2v2QmBY0<6`~ zr5?Q*8pwbBOu3*#x;2jCaSM+SvD2{un=<-kjW3pc?w@s{E z&cNaz!d$a25O+C)c#BR4Gu%Jm`m@(MoAm;b{qrCWf10R^n zql;R^?f^RAwx#Q4wSNgZ+)a@iV17~tBoE|VdrQTcMJAh}+z#ke36y`bWWDU13-z{FiRomeem$W-s3)8RYOi)lb~ zd^TSqDW>(-&tg3V`=I+ea^2*g>vsqhD4Pnc@;THv=$jVh7P|`eZ;0qoq6P6*G~I~4 ze=yIlX1bg?B;N$?Xa0S~lGc3`DB30mI`+nMJ}cI5pjq4ZS$b8`#BleZ={u7Myb(RP z(sQ85YG1bJJOhKfqiK6)HG;%fPj?}UNfaga zv@FqSiN1yJTTgJBT%Q{Au;Ha^%oLJJS)!2GYc9-dy-O zvvLdU9=>EF$eU{K8uN#Z!Z^D8C|uMA*WP}NVjiQn4Jc*me`KYj9W;RYr)YW@v;}4; zqe1DU3wXc||9Z>@92z&diO;jok4s>n(Bxa*5`3WOos#d9x!>c&LYtFfkKh#-rb64d z*Mvn_V8$GS1SO=`b|>5$jI|<_bZZs9x;&l}<1(-^jjWEuqvC=pKs4?Pr&T1nU^Pdc zyN$Vs`k$PIIf)wV0XmIP_mo{oC>-9coz>UTGaI_dVA@)3F6Q*Z7l@RlS_3$9+(;QK zh~fAj@X|J}^kW=epDED6SRRN6F|D!d@4Ed~ma76pVd<@~PduJv2sc<*e=(@C%J^6@ zoD3><=Le<}Y?-n5Qj6ITV>_jne80ZocVzrz0a#^cuVDvUZGjn1Z)k}tXPSGOApFtA z-lG+lMIGI#a$oIGcRwU#aZ5ydY~>5%xF{+ zf&|iV$ff((Ga?CT>`Ba6O5^}+nGV%vNqyK;>ILBFY;>**W}edqe~}6BhW7}b4`M!To1w;ZeR}^oM%xS?Krt(lpG32uwoND4uxe!zA#J)0*nkN-+X zzWbG$z3Z!3)oN2b?c!VNvG*lDesG+RCZe7C46^tO5~ResZ=Ze4&W;EZ^6ba?lfL5Y z@MR3v8{%5pe}_`V6>35f8SVL8p4|j0LYeMLS1}vL-(HK8&Q7)J=L6~QCapQp@x$IA z5NWCxJSQ+$^L_4<@v%f16nu~v-UZ?sVmqmho8}KwE1urNrroV@F3<40ar@R!LqPyf zO**hCe307$zq5NvimFK^JBufF#a1jAOxu`sx2^3Jm|#d_Tg8GG+^$)@MRn3JFH`yip)-MwGB{K9Bw21lATqoNHKL1Py2Yl;ksx! zwdJG^n4r-th;wv;cKKA|d%0miTGVR&kQ(;0WR?1*Mzm=uJEvc8YU7!5$+AZgIs?}M zl=Mb@Ygg1X$xvpQYb$y^M{u^&1MO9`7k|Z{3$UNiTs}JEVWcRdID1l8+#lCu>Iq4~@OAmBddgK1%g>BKf00-3YvVjaly&Z>AoHwy{k;oAH?y)}9AoM1&&S zA*E_`WsSZf#1;9r{p4n{`$|HPGmq$bEyza+hhq7ifB$TLWcaYGz(ZcsUAdWdOS3Y% z{T$qoM$h~3u#85rwan;+u4PzVcijNj8Q2j&0Q1z)$aR)lF<_#oahDIihTs0v^c!bS zt+4~i$&w(}=fmx}xt{=uKlJUI}iBQl2lM8B~N~&mOJ2G#Jzs=O?9$1ztT0$%_Xlt z&Nj*Al%GU-XRX$UYx|GHmp3)m^l^3lbrJd2)Uc^d2Mw`g0{_1AC(w{ZOo&LM zZ6f1A>;tTPHXL9)8$P>yAnsZ+keSfikt&ime$pnONX-hui9wbho=Q1x6v^U z&l&|3v3lEi%g5+iSDkcM9qoRb=uflqz$x}iw+gK+^m@Xhy?543!hd-xet9D{P&whD zML+ABEy{pSIJ4ZYojJ+fPjnfpu$ej-3`d>}8=0MsY}e@C7~yfST_0~pkzWrGHDYBi zY#6_KP%fd<B&sBwS+H9^XXb6%C4-xzDC%f1pc_^oV{pLfOS^15mj6o7AASoxT!U02He6~{G#WU+YT4H5kH_3 z-ODMJ$wzmt1S~O(LS1wbM_c#FPvjX*8_ zcn4O#3=MGk`dzeq81=ixiB;}D4*;2gs3e2e4@fnm9`s^vLJ5a;0o;8oy zUud?jOXzLjsGki8WPc$XU`~Y#&Ih|oYTqWeCH<|Lxa2iD0F_#KI*~F4|CW^9tmuMH= z0gnGzox;6R#t{^xeuwc=24649x}9L4XLwI-1zuP&#>K#t$7s~ zX@^=#MBLsQlcU!>Sg|%9R3a-NFEsuP9kM@)yJ`&Wq}*J_G1igbWF@w#_RVbYAB33Q2lM8}8|Ez& zy}Q|WINYH%csq55t8zEeb;vp7UBuNs1d>O}763PmEnSF*941=~*7hecLG4`A>t9sq z$9*;47cVcaVT5vtsoP~}Q_j%$;s-a$SF8)0>x$?B9+HW}p08M=XiAoUI^SMm$HZVq7& zr5xtzKhjj@3cq;VsLf zTG5a*x5%s@b<4ZA!ux=_vB`nt0pjl7kDLfDCd9Y*k#(O2?AFAvoBJ*G{KbnOENmdT zsOw(5!+LO?MjSKn+QY{f|NCEBAH4g8iz)c)#fN0PLjBT5gVLV!-hcui$3rAV>%11N z{H!utVu5=*y^WJ#67$xB*$>x9Q>ZXKY9FLgjmRMW`N`sfm;#kg1BgxVp>CdHgd8D`Y^^;lxI(>Aj5zD29=5pa zV{kpLG59r4!1cI8*Q1|sz!wg#XG$&^y2$_bJJJihR=%AAFqm(^^H7Jzyqy83#RxD& z5nl}>~cG^f*4&3Jf8@Ps}qCGof zJBB;0ypf!HFaCXK{zuTtJioT$3|PR0;91-8`dqjj0zW6C<;(`EI4uzbzzCQyN|HFC z=n>}wKHizqF9@H(UqSqfJ?JWJh)68`+ea%N@bJq6g8=MzUH`)qfP(qoKbyb*BEBv8 zIIpVlc;S2U|Mw5M_Ar;?`rX~p`-1o&Hva9k{vR>=Z+>h?43n`HbQu1p>;1oc&KC)+ zmx09+-?_E_=iC0DKZanzgyQl4j~n?(4Q>QQ{VRdxU(xgb{-*r8u&zJ+9faitI7m>{_Gqm_iddB!v3*wTJ?v?mj4l=-jUx(6Xf zH0FYbdU(PFWyE(-Y8wTc6-n1BD9hw)=)p$=si@W^uj%z=Mz84X_*@>MMuC!1huujb z4C{fP{-^IC@krMPHpE^Lc5rWR0I8$*f4!P_Sg)R4yWIy(5KzDarN??;ff6@Qw!5?R zs9=Kb5M4FLM4orv^yggcFoWt+2EZFw>iLqa9i^eG{0+kdqk%=?0RQ|k)E+Q^)`16m zyHVlu;t*EJw7f(+@qc~c#EV~iiJ@0ZJWO_7UlT`O~V2AqGP@V1_@0`-Pu)47EsXx#hrB^%(&xA<+bCN2(dyzy(bGO zqbo|Ld%}ObjN>Ts1SRTGkYnY{dhILnw%~AoJhTVZR~2x6_7Ujs!DJ%({RRj8Oxiba zy5W`*{p0Y7Py@@MD}p3!-uU8<;@@Edfppzg)71`dfW;EG$MWZwXK#T2{UxBQhSBTp zt$__n4RS=zL2G3*pFz}%+}&?XX%847B78T!?ZS=QBRaKPQs1SU2&7vjr^>C;i-(_2 z|K<+BAu+y9+~_)r%A(Wyq>Q?>pg=c-*DmG#fr#}jK9tq6s+a1 zpgLJ+GrP|&b_D>Ktsp^+4}5e|d65jzOMsBaYBsye$$s=qjT`3~)5s+cKR8-2{^A1j zd*ikihb{RA{{U8v8W@*sc@owlU<#_WU&Xh{oq8V@o!f)f(cM_3JzWG6qTT$3wMOMW z?|BfJRL@H!Y)5gt*b#xdIxkcR3O{;t9!MkGjU>6F7H36+lwL7owF(g^?m2@%NS8hYb&9 z`wC*3-e7eDO^D_+8<{vyLE0nmODQ_d1HVaQvy_NGX6WLcHGD~d^#y11N`h$i#zV~T zi@XB>_wloO;Kzc=23|%PimDCIgmd6{7vm)1l%#lk@8NW}q6JX*;+keWjl3`VVR{#* zTmIt->2-wVi#tl7FDTv{Y7r~E{>d_hwYQ8s9_z)16}=+o4DmEXmawWN{}7arpfEc$ zIRf~8n(+n{V8H7>DD>f&eqfHac({oLhO7&u*sSHVoZUtSSq=$+35@c?Z`)RZ>D}T) zhB<`AcaTv%(Y5g>Ii}a4{4RN|Wl~}`7VB*Y9cLQ;PAJ&kT6+~)9Fl{64`L{1;7DIn z&vDRqfh_5GCK>Ra-i!S?9oRMQ^O8#FSbgDExmp&_e@GBlmHp9WB8F3o-&h|WCVBsb zRO7Z{O4|8mTvYeW@-btOPtN7i%gU$6fH{@-Ksa5nx1QT==U1mNY^4om`6iolwTrZB zo#UWKo~87~j{$A?HPsj)gAc zZy;>!n6*Vz1*lmtz7};xhtpzar+U00{PV1g0ZOB~u)Zgc0`Xe`G=-I3y2NWRhYj=$ z*Fjyq%F8|f;Ukz=wFfBLzV?Bp;)V~!Z-6>-mT88nH)ta#hUu(Q=iJtJ_XJAe1pq%&Gi^HB^8>$uMJbR zwOboD^t!v+7Jsbv=lZ?%;NRZ-aR=%S|4E68?7Z^&=iF3d5|H|*oRRhFrvO13{=EB; zEH>+C`A_RwY5uSuiQ#5=zKvsAQA6vBK1Gev4R^{?<26I6OBw?Y9kepO31wT}m4b+a zxkk98lY7%ZDxDo`;N!0T#E!CXmh^sD08O$b(jbQj7R_ky`0(w_Y<^5#zTk7aY-Xw7 zL@;La=;HsHy7|3+z-W4|p=8VypEjtZL(cWUB5O=%1DQFhk!~-cY`#Fbc4VkB_iG3pn!CPAV@QGhm;^GDIF3LBi-Mc``ORl z`@Y}fefP1yKSv!HuUXf+e(TI)x>228Gy0yz$>57n!~+@oz7|IICo=Q(SbDl58Dige zh$$_g3Ey9DLQBVpkGl~Z2Va7qCQWASr3Ra#%qh`%fgB>YJRDWTbl*!EH~^e$iVe@P zkN9)&5?5Ddk8KdErfk3g=5aPXhA%il$}(crqM^1ejW6X_$O z<~GF^ukivL$b+g{(qjB8d>=iU=4ew;eCJi29p_Pnm!@cmlCmSGn7VNQ3tgTBgiWDI8OxKzWBqRso6aMUpAR@+X zZv~eaFCXnW`L{z$v`hDPTCJbm0GJ@#|GmIMG zyMvRPs$ZDntE~HJf*jQ!OczOGJ_bO(_vHtVAaY=lhy*UvV|EcSpgj%8c5dG;3Chvj*eKZ@3a|pg#4kaxoy;M`{_R%R^u_S zLAOqroSSR}dF`>2daWmJzLZzJixOI>-q3)VL{7NC#Udx{R%>jJ()2t^g*nyoj6N3H zs|ncKzX-lSIX-&(dGL66Yj-2Zm{8ehjU^1ma53xDM~x~(Hq|B3Ci9nrqg+?QCISO* zK7*qzz0L5)+q17aGz-K!hGWaD6cI;xB6!wbcbypyU`^OHUZpS!R;Wl<0ze4BVgEP> ziWBtLj-e1AborO6em*Q{#Qv`JbN!)8t0Ymh&-l+NDx$UwIEFogMPDo*w`sW*n9F%a z{=Fb%{^MlO@erljqu`CSu?V!-=yma@V~h36n(P~um0-@HN*gz@7wi}qH$wt|^z#c4 zPmssvZYZE#4AuBJPd--&Nh5^O4pBW6f=<_{B1<=~0l9v{13q2?7tpqv!gYv>Y! zj|{ueyEY+)&u8~|$Nc&N2ujJaa#HW>KZ&Q}MU!@}b>(WcO|CdqZ<0>W7AvO_e)n10 zfOBnUnJ0>Nc3pFH9a-QTTg_)MKC?d&?xu+Jj{`UD7p-|_Sc&wLN4!z5F=DbtWf4_Q zuPerNrhPIw#do(PYC4{b|7&+p7YZ(*@mMEFSOBS4!n{II(bDv#n|-(3PbhmXBVuP; z2FBp%wZ(-Zcln8l>UHK^Lbq&T-b18pdazC*2! zFB&a;{cBP8a#X3DzXL7h3$N5&pdx%wiaL|lfzZ$qeNQ)s0NwQyC0w7>{tO~=RtlH3 zlGa_7kL)0N0c{xYIQ56ykJ}6W{Z0JG34ce{w7RrMmM5SI7|~Q7qzngMR4`!>UjoTv zLVUuV*&%pld;&y7mf%JGQXhkVD|aIz-2!B)&c()inP6l$s_-(Q@KaQJa27FrgvwwK zQ+9}EK^LEc@GvF56KD+{g>FNqIfDv+o(f$<#MeTA%D?D*^^}Ct>?!U$f-LJc2QVko ztGfzw*%vGT)$5OU6RJhDj5=etL}|Fu?!I?OHF8`|i5rNd=KfG6?Vs)`SfT;>8L~KV zG%F|zzV{8toA`mKJd{lj>ar4_!yj_(Fmy@Nkjs#`BDdNxouaT3_h(nJ>*7W76nmfyn-r-55~D)O8#J1O{tLb8Fv8b)Km2lI^IP(z%=RtQf-1)>X1xVv0_E( z*}~hfahL8LzW+t1LC><)4aL_88kNf;Vh_cn#Ko5nBBy|$Met{j+GW~bvc{=RbjtcqUs{3_rEii5&iR&B8hRk7*0 zX{Eh6db0sPU*!n`A8}}&l)>T~)tf#{oDn!e$T|(RvP3{q#RCY{*QwT@X zG$6yU3BwsJE=*IBnDUj&4u`YNVeOCka>>gtVIpt4s@#~fVK{qjWmhVqQjoQqt6(_) zs55nW5lUYg)2JDbs@+t!YWgGl_LwC^Mr#Xo$?HJuN4?|Hn;{IIVH+!0!dBhduY8lp zqm?}S$U-F<5{m;=TtT{wd~?l9aIE7ovvlx2b`d|9%>opIUIVfHfy?B>L%rI&o-@2X z&1N88FPS#83e4%3odyPNZ8qOX#un$58 zr6c4;Lx!CMy=5vl3EjZpwYt4bzK6tI2``JPFeO%cZtF~-Yg<-}NQ{*^s$NF;K{$r&CI%5ntpY9TKz+0W%#nN} ziUMTwkx8?MVTbpLn1gRfr!ux9>5;1z6N|mS-yRWlwhw0Vq4R3^gZ|zG4+Yo( zI>Sujh1!c8NAZMlySyb3vN>rkKgJ>P6M=LDK+*eO-2vNk{Uf3l)QR4F`IyKQshaJ< zP3ua)0ic0K2EE5dLY-8(HtpGNoPk)y?*JTeW7x!nF&66_Ql#>lQFIW+{SB}R+-{mX8m95mL+ zSsep3?T>u>(|R z3UI6aB(e(OYXj+94x)mGeD`XGI|o(*lHPrBZ=mptv}#1Mpo@vKtFx{SIjD?{`eOIk zx>td2C%}G67sj#KMii%kkqzhF`vu^h#dR+rl~?5*v+O%_i92|zqS{?hVuX7tHbj-o z9mVgo+9Qce`)M52KKkrCcytWeeccTmCK{ww3uX=ku^()F>;(M%D&2B9alQka-?Zji zfL2>N!}L@YP3<=m%8<3ax11m+Vb?=(~EV4GN3!8bH2n1&P^L*&Ob)3GH6$t18RwyX{!(5nTbKZ0g$FNK^vEWJ__Y{ zAtM4BymiTlmA*~VGqUV&^j&|@wI?X$t{$dS>nt&*7q*cO&qU}>!KtT3dn$M=PjB?QQQisHErf> z1*O>uhOpkHN0!r_V5fU7O)gH>_-qKS~scgTjA7%{dNe%pVoqN+u{=@R8Fb zRw-nUqd*OL<{UVm8w?T6GDp8Nyn39zv2x$yd<6yvow60cCT^kd=-om3h_uQ(!Eqq^ zBT73}(ef0-^7)fW=VI@*2Tj$l0s!)>ERT{HlZ3X~S{ z5u*B-ASoQWq=Z69QJMosrm(CAbhTJfj!Uu89-|&ignE-uJ$qx3eJ|YIwMo9dkal|V zA(my?2XpaJyU4S{prk_K42W0is~nsM6xuZzkPSJNW@a0*u>$}@Oym{{2~p*=5>{-j z<#@ad&L`|{9w3_gmE(ig4iqw0)v*VaWj~;RW><^88}YlHI7bMoH^p~*V_7KE*q{5v zbjqH06%bGNgux-bS$o1dYwFQP8%U96Yk(8tKT{NN75syS6Yqh`+|&kw9l7*H^v@5? zsl5v~P}d$9bW_3Hm{PZtyp}#nTrxqe#6kE*qDtM1fjseiynwn~(XbZwhULJWoi7#N zqa&-hVfxaPhRtednq5xxm&0npv^VjYv^w@gY34b5_tMJOkrFax=g-71g=xJRg2b;z z*pR-#5bM#qX-gv6z(ELoqW#=V{Nt}29Ft}SpO)Bfwk{wV^eF9#&Jp7<uY$biq({v&YUCy6Sif+@H?^J)WUrhY@r`*3lAcB-ee9j9g#WvM22AxV7jlyuS#PX zM%BFP$sPX3W%qP=doH~eQNyKCLF<;cr!b&sj-KG|WZh1Sm!KKG19&I?MJ`%y*WbG6 z^b~gS{rA^3%0yMp3sd!eaL#WxY-$#btv~t0nI^{|?Mms;V8&V+hEB}JYPRMMFnBY5 zQ{30!;f@_55@}~A#f6Hc$uqnngI!o^6j5=$L2(|a713Ws! z^Ye_tMMozLm%pv{ermo_ck8(=1XacOD$A@?&t8+2)fGiE+!6s z))j=TLPc{EGL6gZKHi4R#e=@$%+7>6k(|dT*?Eo4Pk9)FkT!RV;~l@hB~YOH@I*I% zV*ma$01gyeL4FkT6C37a`-H5SNw(GB?p(W+ZcWBrOB-Zt9Kk43P;W*jGGwbirgiv* zGS4wa+pSV5>pWbAZqXKiWN|h{q8Xs3(&DD#eEW3ak=#+PPBlGqOKp*LS)&DHT}a6x>?0`T@#=XqhFy4Jnn-1!C~%O0fNhBlf-lOt?5?{!i* zdRLf^74@9)M`63$VCGGP`r(G4(?ckg?WO`D8}+sXNdTH{q3!vTr7(fY@K;(~jSe)Cr)2_Z81%qIN7 z2CJRNL@LXe6A==#NVXmrG+caiMJ@~n{r7y=^(GS0110&zP{$hLpJ8RSovWx;njz=? z7&c|0bngTw#t;3uP|W+X_!B)LB|UwsGDUdz%q5RR&~3JN;fUY<`HExK;-HkJ{}JcGN#7! z$%hEm_k26TFQW_%g@kU%9Y7l(SZG{Dv5uf5yBwrFK_8nibU3a?CiO}Ne|)h9raYFQ zRI9Xs7Sx(tr(YJ>_uAfN9jYeAW!7KdIl4<#DF z{vU)OO#D-sg6EfPg(L|&O4YJt^matM5^08B&Esxg|4DAg_VZYB&Gw!XojtSYjgCku zCzj$BX{fuJcWhr+hKS1b3sgB0(l;R;;l_Aq8^i}aW2RZnzaxl=VD|v9aWcc&I;ovy+&Fdl0&n%+I(DtDQG5X3uvLP3V0}J0{ zknoju8Q?kI?srFLBYp^Ej~ICYLWBat84fQRb&M<`(kIX>zLZug(FG2%513KCp4KcS z=NqV<;QRp>BQ)!KcCq6tgPZ4yEuJ>bW^Fu?<;DR7_9261HXGs&KO3HjC8BnO{CUnq zIJ{k##}qhn&rv9mtbZkM>KWffW$TsWK@+P_qE|CG(gKT{!%7W@XbSG%X%W^aB(GXe@k7c~v7lU%LWQM5m-SDM-Z$iTVPd7hEgwbaxL#n*f{@_;yHBh$4Is zX3O!j@kH0sk@Cj4Qn<{dA78bD1UXf5sTscE0UI|WybWMA;SH;c7-qYU=f@gfblyHt z4j)0!5+7_WcYRqK?L9fN7;UZZ@sfBoh^`sh9uD(ZI9S7^#~WiK4&QE&2>Zp0K`+i-OLI*h40L(EE&;%#Kh!=^ZHGXBav&j;;szl_52ab8hhhR5j~ zd+AM=!i#Y3RrWMIjw0!*vWe$Ct+rXALGj9Sniy4n`~-rubu2q!k|7JQDRCmAi$zVC zH03Q<)^=j0lXpI!GSn7WjzdAJQDT~yfjdc<9^GNuCLp4p$`EzolF_aU8HB4RbE6^2 z*_tkXsSVTFOYW!~sUycISipHm>tmE5aMfre?sJmO@2GgjG1nZ`gtq8?lC5|#<%>Tv zWlyZL{;8xUB%ie>Ii_&ecd_ppg0k*P9iRb{xmr3o?$j{h8^g6#w*^NbsG_QG!5!e@ z9mkbSVBhh5Ej2BH{T5cq+xOS)wSEm@|8$ zS%xkLwyn{57^|yF^Fx^Thq})Mx=f>XeDsj+4|fhCNxb~UnSKju9AaN^apqAE1%i&O z+e_}ZC!N+z0rw<23aGe#;BHD+Q@#19y3Q5J#vnIz@Ts*P@S|ayP2*i=DDwQ)s$44m zE?>T&s;3le&(}LXmPH5>?kB|DhNr$Fq7&d!X6dTw-BtIyOlXW-%CXM^2B;OsPIS^} z47ZaSEYV%oGY1=mo|@EQ22s)7w=rqF{{@lB^OkQYcnJ|IY+4D->nc+HL zW9oc%$#L&!>@q)O&lh}W>d5(2;wami~2b8b;!rO1`%;%t_dpBi(Rj9@EyhGqS zjYz8hfg_jkIIfkeSv=3cKw&PN#BBPR7%%eDQqIBva?D{p812Z8n&9qwBLK9hGIAc& zgMA6r+DrDX8!qvvS*pK!sB>hV-uA^SU0t>2^V|57dFace}-Rq7Q*{rW^S^44E}<3_kshh-vB zhHfXr`TKLS>1_|PUh5P;Ql|xteYkh{2Ju6T6COXVPno|orlYQ9iJ&ya<=CX1ZyqLT zVjt*I+Qomf-Gv<3m%sMHFjnO}ThuNb;{5w=yv2{k{LNe!)|6rj@iik18fG8sF~6>| z@de5YR=cilGYdVDE1$ivVI6~hEXsX^dg0ZYN377MM&2jYfo-l@aA++-5E0(gSj>6! zG7)*!jQ(OH-dV5uB@3)P&H8YQIEccq>-%e#hk!x&d*e`*JX+@a!$YJfO?2PNLD5}=V)6ax+Nm^ZtDv-xN(h3&Al{pu6Xh8;EE;WTk6{cK^8;q;lv5z8LYr!AV9P?)wk11De0Gk>VLma16r^IDTXKlr1T^_gSi+R9Zf z<<>5@B#y>ie=L5PdU&{XHJvDqqUmve<(YQLNl=tIW6>l3O43QvHXeDLdaKgsI1 zD+f9ss>sfivI&kjohvSuwm4`IS)AJ(V&u3H>*`Ev`el>Jk?in{7Nbx0s@RM;uvk|> zjxv^Z-yg|jQ8Q=XC+udHD;awU|U1RcRDv|d{>}!iS!W%nkV&8JU$o?&u`C6fe=S!^sBes5HrI~+rO0?#vF_voGXs?a! zvJ`b!?;nt2o3okicRQCtnjoE9Nso4y`vEnuca*S*n!lfp3^mNx=1W=KxKyeRgvA`2 z+w&L-NLTeokjIkYI1&(%sN(NKXI|3Fpugbr;RG((G9?mwGk{O*wr*xD;vPZW1N`E9 ztAKt}>{@O4D!2BNq^(8PraUD3p%9?z5Ft#H=l;h%85w~j^$m0%H_@FyWAe-Vs(Wi1 z&@h^(ufk&qjeVje;0tm$KTy2!VRAPTr!y9e7;2R(7-cG>uVOqSV>%He_k*Md31tN0 zaHN=^OG+fKr0C!~8RXGpcfQr6uk@Bg$x(DgrxG($KjH>d! znRaxMU6`+SJ@xr~80T+yj)U};0TZxH$M}uRD{L;dc6sfSb!cy_N&L>4n_nMj?Gm29 zTkx~mpuWM{)YE@Mi1GQ&Gbvh!A`VDibzwwqfX1~Q>&=wKz-R#)sm+3%^3!fnqIS`+AX^1mpLfPE zW7=35{LwC*9<#*>qRfeegU162+;O?r=i@H^p>76hzpJw*bnE^3t^ zChb#lUB=UTb!KTE!=JM(?{lBy5zVlL#rQ$}0<_5mq12HgUYcKt0iv3ASvoA}-=2N* z+d5O{)K-mV}|@ z2-t*z^?h@;G4zvide@KFks6ZlueUPT7d*@0y)3_uD0;%Qn~Q3e z2*_`)>rNOe+HP)@>-9OD9u>bJ=uj(@l8tAWHz6>GY)Gb4iZO=0$2xu72t*ynST%CJ z9R#@K0_kg`pd`U2TKo=rOvr0g0NHYG zBO5i|+~phhRX_{ycd3827$M`^2dfe!GGWX z@B<3z-aqO|W(vmWb(+K1H;JcGleV>XbcIS7D31bJwBEBE2n81m-(HD z!?WP)V_Bjg@xfw)!(h{|0N^FXbOetk_8qW&a0QZ5kU~EP-&ce71S;LNgz(=OJGQtg zH@Yd$;*VS^VX`y{%t7-tkg%8=V4;f8kCH-@v-`QJl34K00uGg+9im@#qeMe~zl0zM zGFTtk1yRdrfws**u!D}D?l9=yIAB-KJk~v52@aBUnd-91`{7||4%$e2L&9<}U;@5C zWt5AL!pmeTdIGdWO7@`3Z&L(iI8G16MU^}VVF{NH=d>x^vbgrR*hoel9F_XQ3$w5i zg1AYd=JgU;xj4n)Q12a<)}G`T{~DV-kn+ly5)7-enmFz(QWNkEd1OUJH;PNSJ=0c33{uZ!HcZjpkC5jO04KI~QW$j68#doTFcNwy8|?&|}& z-T1g$o<|2{adtq@@S!^d#6L#QfkmB=H&J1Q0C>x5-ZRnBsON7{J-#(|^eZ1ntc%a} z$yEo}GLq~Z?{SE>D<1@15N&3Nb(+z{v`Dg2tI?vsj_$?eDC$eWji!7O+vX17w-{)2 z%M}Z~l#W#8CR^6VB60o|r{CWmc+bY8{+;?7-GjW^FZmjBSosF|sBZN3$mU^(*I*M*@!0*c~V@?(D2FZr(ErJs*>p|LBCs@%^N-zx`7WetmDpSRj!C!4m^ z8{b_Mjk;$zE!Q-eAD}pZ%FY6z4IGdWKPd!qhd$D4KH`9Nue>}1gK+-{QJB(;jO+pFth_&-NAq$Z)+BSfT|8?dB=<9e)#}ms@7^~MW@L-97({d`TOv-% zoBH99STb(u1t2BeG)fT|8t)xT~fbnEDg^o_vq|aH8ec{H_ZU` z#AX$8r}lglrjYnd~GTJhv_1 zUL!;vD*D6L+n`dB0L$6-Kv42nmvp)`5(uLQ!Lp2DwB~j^fuxC}f$R*}YZDm9>n$MX z&;z!!SYj3;=D+Lg#V`XDYu@qzU93VNNY7h;i7YOQkm$yc;ES@{_dVI229~`V0f}0Z z@gK3t1rc2s*^1sBcvio1wx8XZ7FH&F?>zzt)RUe_YR=;5Ras-7lOGK_-)gA)Hj5vc zcZ=CA+GkYH)U6SB@rbl28{{x<)rshr7=2)qAzv>J0%N9fHE2kZ>~ot+uV+w9I?7AEfZI)) zsQI!LF@sD}6=f%si}#vhP`}fF?vpb6nT6Jc*UXE+l)h#zF#mS46wSJ^>x+t$s0u*e zbDJaPdqfgfRJ(5@e0s0?^of_8!RU9=?6fwYucD?PWvCa6a{KhW8*S1Zbw%Kc>ph7> zX%`Awmg%5jGt+RKaA}c|&#`j(d?DwM51``RPsaS1;d-^LSDz7UqQKk2*V0xXM92+F z=}=-jN7ab|n(RDiy}xt!QH7S;*Zpwsb@=V1$`&5?2=a0-dFPsDsQE=0Af!RstT>}pa?PS0${84N0>Vw>|eeM%9G5Y8n0SdZ; zcc6uv2~%Yb%_q8(E31=?pdHc6rN#ljMYs)5Lj_e(`Z9OnEWCP}Ib<*1DNyOLD1}Mk@Sf0wxs53HdEPt0i%erek2S3+4uz?<*7I z{_vjW0^} zdl!?UPd(pnnx(vZ=+3^PYVPtupJSF4{C1h=pXecPbdW*^dSP@Y}t zy2_%oYa?Jp|5@O?S36x8`@w}Nr8ZRCcJFX6A|1J>mkf49d@-BG$t6C0APSCH!V!l% zK_kyl{`d=ZfmB6{7PIkrerhO+@EeQz5QGUpa}5XfB!4O3kkJ=$-ec%H^L!A_I;=zo11so;G%Bm=QD|S!w=euCr{y>8W2EI9zj!w0*E`_^4Cuf`epB@Q3S{~g z08fI+&F9ey(>)6?j0yOvw%CAei&P$LThlGlnr*IRUu3>mqy>?fNBhk=sTx|?u+UmA zIgKGeuO{#imwv+RO5^lqmgKyu+kJ@#A8Ov%O(i-NQrqoKaif_g)BX-TE7DCNV9H5H zS`5ap2il=M{QE;^zfog@i+(ZqcM~nV+*kdb?CG#)`u!hbdquQYYa$a7Z?x$W-hR%7 z_*K)>h8HIHi{#xfy-zq`j)kT{nAI}KA}l1r?~4(Uz5_!1m}S6`R^|UC-l3CLVuv$) zD8-=l)?e>7APB_j!PXCE(d!9U_;RDiiz4ez*cleaBIIZqMN(WUyY1Nl2q$YL*!LC zC}#+Zj{5%gZUrVQ`-i(&>eCy>IwB==oCG6KzS2nR#5p{525*w$JM+-Zu#OB7Z(6v~ zk3H+iM}-g#6L@B{2tfm`tp7mISCR1fM=V{5p`>Hj=KFFvE%?fL1W)i)12@IEt;u?> za0#L@`Io$%i4@kD^wlswnJLTx!Va5S4_Y7ex}7wjNivudM}o{6(L&9>q&t>DnvY++S$It-88I*RIN)x@&*CO`MQnZ-@g4Ct21ZPJ-$uNwjfB4^LpnLK!nOUkz~M zen<|!mIfNXTfnPE7vN;ceePBp{~47!D~a}+5w0${f=0CXJq7|N_hhh3QtA@O&a>np z1LayPa=cG54s9c4Xe0S^cLm=NnProl%0jp$Y4g|UX>D-VUZ*q9WkZhS^77kg-gF>` z(rgV{*)XZiq4q|m;Z5EZ3Yy%+@7AS;OlRL+TL-aoaR@sis{#Qj9)jpd)6v;m&@meK z-ZY9j&CWSm4#Jb4Yo-dvTz_xo-}q*+Ldk>`C9tqOGIXPbtv2|IVxo>|y+8lov>X$L zZVkS6#4cLXx|OFn6JNE0=Xnz34Jy|x?6d)U z%o%VX30QUiA5RJVJ0G#SKvgxZ$IRP?XJUVgd& zUc#U28^3Et>R6kb?adn*-4Mr*0g;^*@Mko>XTRYDZ7g}YVwFzPhC@;bRGXzuCLQj2 zxW~k|566^`zUc4UyfZonp_g;_P)l6|2C5L~1%OyTHmbDHT>efr{6qdLedHf%Bmp|4 zJ?lm_-piB$7Uor54FCr{Yv8U0s?~dWHjIR^A>C{kQtWKlTZ&@kZ=bU3f;7({pi&jq z1;Zm_`WWN@I4+}1^+j=}y?eLYfnJ^774cfRQ_H^oTipO;@68PZoGNj)FMSekjz zdk>l>0xS-wW1EwIi1va*IY_=GtcLR^$yS%ckE`w@_0l((VF@8gKrVBrBjkG}VRA4C z_VMmC=lg`(h>O#`h!Bb9(zQTAxrwuXbKiT(;nuKCt*<;vdtpT-SVM3eA=pFiOma+X z3siJUwLEmb@m_q4u6Y}u8@!(v%~8J$&XD2VNP1M^oB7Y$xb6iUO7zli9dP*~8AZ$e zc2r8jH<_zPT@oD5Phny|+3O#aX*SCn9y-jw=sLe2Xgh^@|Ave}E@f4T99v_*1U;+>=EN%5ocE?&n zO6Z^Kf%{LFP9G%**cNgh;`TOa1&h4zdn(N;ej%&3-Lm#Ljd3C}$Kn>Bs?Hi-*%*TbVbA4wHUi)1= z*4LYO=5ca1#@XnQF1QuQ?KD2pOMI5X^YCjovthjR?DWOzgu-2M)tgzw^JUn2u@-uF zKlkz2cXFFJxNzbLcFUZLR>-+`jLrOTobSjq*^s5gfvqnSg(KlEAzJ5J7dKhlc9WKT zcm?Q65x|5uf(7aq_pY_R0)K1T($?e~OXuuiVGS&|p=V;68A-Aeg%n0hGQi27GYI)!5V&Y1IT3RH zo;~?Lo(31C*{uX4u+0_o0P?i{NSF&Xh7T%i(q%5frX8|0DzDw^14J9hZK%Q~Hq&5Z z=YN1Sy`m@W-PT5J`A3U)A9#bEkIIj*rR1TO>^p5Baq^9Yd^?`hB}BDZyaFE9=%SHQx20#*j&0jtyck!*m-NDjna}Z&F^45 zskS%vyE*w(snSI$y=wDa%LMfKg2^NfF(-fen7(HMyOV8JEuodWDR0_&EHeAz46LA% z?*vNR1`O2|+$rCD7k^ztY?(byFffQ6fUA_KA{w7IGH;MV8Dt+_Z2cwuNxL`2Z;woC zM2m1|K4>M8z&tr8*r~#*h}bB<2)Z|Xj!bC8nNS{{?jqO_iI30-7t9W}HtAXns20RP zPMdIWKMM?lz0>A^=P-{=v42o->=2d5M1Q2!_#-DlL{*;b7g=*} zJ>8e)g_;BR^vvCVYVyNBLLNLC{o1Uk#>@Cw?ChuJKw&9iXH5YsyKnggjEIcKD*8q@ zrKn#yi$-=n!xK=ZKLFZPBr90`ka%`RC-1p>#Hr9p2Pz)xnCmnl%diDF32W!wGa8Wp zBrRM=G)$~CboN)uON2b3$mh{ki1cG_yaHK^80k!Wzm?i6%ukO0C!L@vhLaM|IemrabsMRX2y|#+}<1z0dSqlr%28$6yDM7sI zpQLO^yXBvCBK71AnvviNpsX-q$Qp|;`PZBRcct~arMJ3VK+qFCOhtsMuOjS?+8D6hEBjCuEp0mb*|cb}}LqOv!E_RBnOWooA$f)BSm zSZk$~NoeLYT8l9s9v{0SSY$mzoc7w&dZycI=pANz5wJSE6=glqLwnv;6%~ymRAGnb@h2WyXezWTV1B06?aG*BT8p?z5NQJGWj^`0M zHW{+(jnByEI1^(W+YL?@|GF8PI+&wEzqD~YiOI7}l2Ua0p z*ObOuJ5k#5B|0x;toCbTUvu`jTQM6u9aAtha`wyj& z@@64UKS6R+hVXtw%lkhXmNDoa7)f)MX0d|sTC6L*i9?SQu&ZCwJlvqRP1iLrG7UiQ z;wI`1)>S4}T~i#hh1YzWZ5vVg8Ed^{-5ONs{`1^<@k(*Ui30wsz|BrVq|L{%uh?^` z=k2ryp)#{l@H0dTd3>X zND*OuTKm-&p{pY`n&K!)gK3%)*H{{McV* zKNC){?IgEfTdr=J6CUK9JTsekE&_>R1C;g(BXeQi2T6qeR%s|O#4zgEh|_e0FI2V*WRY__svs)CRKMNSiN})KWQk&g5g) z3)N#UlQuQg#fW1+jIrboeZ6*>KdDif%Z%R5M=*Fkrt1jpeo@@*1V*;_PCTBt(fF~D z#7+`-nX;(8J~&&Zw?%nH>wWe9f`VYvzjV!ox#p>AMidSn5-br#2h6#s8d=x~NVv59 zy7CIHuK(8hy@k8%JN@YK+rCQ{+yxmjs@>K+8xc{q5Z_1+O5`z>LZE+%;v&SQ14fzV zh_JBgVlLP`{?`4C#be*%`5m->hVEz)u(J2)@O3))(smKx#|Cy6atEJ#=5_b5tA^31TzaLJ!CO`fL{XPfv`3JNUV^Srwhl4>3%0hi=5;&!fCPj z{_kYZWQ^pOz40cYt@vZQ_o&VVb7q0^AW}op2`%T*{lbhR6&bVch;lNN-^r0HFL_De zY>^Mv2>#1f08%^TI;Oz~n=5&^c6$TbZ4?m698B25+M~B6Wz;>Ips8h^frReQP*va3 zFP?ur%HG`zSm_S?0?=e86@>ot0Gmjq))h^6zgFfu+COl{I0b)cZ}ccKX7Snx@fK})8?vkPoZ^E*=?OsVyRs8+znx#q94K_ znr1!wXY$g{?Z1^ZKQp;7ezE1)TW3T=jS1L@_{6!#>w=&`^3rzpaZ`d~3n2+{Yv5DeoS z$oKq_Y~ouCNMcGC&{+`D&g%gG4q&8wx@CpG@=fUe4$1%LVM_8q5^;6DH6pM>pwTn? zE$(v}T=W^MZO&zkIrH5(WCZ@}867PEJf6wYEjp}@L~wpQe%1bxurgz-_5KJIE7{-v zKck-@Z&c=o0x3n^E2U?#$)C!$0)c$03WA(@4Ptj+1Nq57bl-nv$o$P?@*gieN&X6o z(N0RCB!zf`t*Y1i5U{ot%&D&kNna@jL5?4z&BXpB5rDsoVk!RHV!}se(BMSjDiQ%& z1Q&n_e?d4$5zAz95;O!z@GW^C6@!`QDQ}Gdrw$@m=D)ARzrP4zrURim%!w!-|F?_x ze?;c|=Vkr(-vk&(NKQJut_b!|{m10~fBe(``v(E}SmcQCA@ZN8kN>s&|NcS$U+Necp8LY+(8KuB~ zf2Y!j%&W-%;RdCh2u z;7c)Y=ny#~U-3;v9*1f!R5jVeY6$SF#DRzkPlDyk7kn-AQ$2`u($tVv;B{2NA%9xH zuJ(rT2vE>3bHdQm5k2Ih9<$)yuD!k7{Q@Lu3ODC{5)M(WKazn_i^m0kpGnL$U6@Zk z0}g`ktQDlNl>kAOJfh2Hq)?z6!I^+TcF#eZvy9*IGwPrfJCEwTB<%gEpjjT`%rGT0$@RwnN5vz>abw&z| zmh~@Bjn=8{H$cG>>&J3xa?$))VwZ*SMI*T0gJcGHCEX=>bPz{S^bYK*BN{`|`8I4E z0CuX;e*Tqn68M^zs@iyB1kRfuGm`GHeh24I8ujiI=Vte*g)q7$jyCFYc+`X~>4+dT z?Fmm-=f6>1tzKz z5LGQ@MiVAPwfUB8$!!jiExgxia0vT0p=I>vxx6@Z&ZFY(fmddyf>DXZUS4LEIrWYA z$LjJmqm+Ovp!`>6`AZ#vkVCK^AgU#H0OoHCuNMR9QwEsuS%2Q^TLp>B=Y2wUD0tKu zxw+Vg?Bf+f>fbj@cQ+_SpUnu>0H_@01D3zKFO8efp}a;ce5y_Y*mxp{nXjBcRl%6Wr3j z#$iS+bdO;?9uuOy6$paH>Q8kCMTYO?c0fu^e*tHpKQhI~ z?|u>f%K@DGFWAsjBA)T@%N^8QYI1XGe*QhCz**Hp7y!BXxIAU@GTCyygnG8|WNgv? zvi#u7s-6yQ-qGIbe6Gz!gZ9^n%>jiQ*miTQL8_g6ixr&Wjc50 z@#wB;t;4?E-cgW*sik_pwDPI(Rr7l`_EoUwSN%+%V1WVjRzvBoIU$I%GxA9}bZ3Ss zL4`1yg6}a+*`#xQH2K`d#J%p5hVO+7^9SHuyx%VX4L~OWn9tt!cey+AzJ82hcM9+F zP=81cS{#TVIw#s-`w_0^csAwwN@}!!-XV>Vmr(NQ4|hbyl{rscbcJ)Ghd9tN5FJI{ zcoZO$XNr0vWNvgA+JxJqJpCWhUyonDFxt(w+zEM1L{5Y;){>-aQxmKfKQ0IcL&9w) zK8VVptbqw3c?BYg#o3I;zU?UZ+!us_kQ9o56fkszGI!cLiM|aaX_GC|2cK^jWhZ%v z8NzBv!|i^qo&lqxq0Qx|l!0(>aCT4i?!8d*6kiQzeERu@6M~gk{>Qk_O0FK}mh8Pr zVopgAzoVRGqV1>uGJHhMVnS5_ry5%Kq3lIP0~=%V-ZSei1+QtCkD<}Bo&v4;uhyOV z?!t}BMf9vR7TOcdiBqS&e=h_C6US>bsh;g)Brs(8`>j(zQDK-9=ce_kF5_;SCS{lS zV84Rb0g0%~MRTb#c!8ms>87J&vWqRg^TNoMbT5|J=k%z2a9)6VTG|^SB|8M*5bSyi zL?lfdXoiot6_e!CF69u#G<-F-(_kC(e6>RyaxSdNbt-IG)N5z?cKaM|W3#xH; z-h@FoqCD1~3ivrd?!Y7cN9_*eJg{#?_qzKU)Fw7h{2-Dkq?nI6023PfB;j+uiXpI$ zRDk{K*yG?{z|!@mKp`i1IMgiQ-()E{+A64Z9?6!n3=xP*$yAG>AumaLn?L?}oT|6G zAdEdY$l9N5*w|#_Q(S&B@~R--2W$3qNaRHjuJAJ>;QPV9Oz_kj2IPgUlG+UggN7FH z`FnlQ($(Y_4uL8(I^{ns1G6;9DthrHIQ6tgOh8s$H*DZ(EMwRqeR6*`F9OI znE-#->+8Rvy*uy2SJ;~^Qm3uGyS;is{;U{)H2g!&&+baVZYLOxqIJQ=eg&fFScM1* zOm_Q;3uB*i%nbxKUT&-VmC#}t)q}cXi$Y}1@ItOy;A8)6a(6k6xpSfrO_odJcMX3} zGMS4@BdR-K(=81%lJf)rdiQ1dwp3Xq@8W0+_fSwP__byWqCm>~G2=CE{(y8ch!RSj z1QdO-iEU%k&=o?#Hy2zBg}r2WNB-yICz>{cxn^5&1I(ch7%Diko9{qd3nL=jglvb) z)-L^3sL+BUOXg&-^+Jy-U4#|c33zx1--Krb@>C%77iI>nK#(78LM;Fmj-?37y|%e# zJa41b?Has@UkhLB8Pz7f)+meeNtEvv74BZn8653@X?0U>Y%W)5+iENY&b20o)NeV_ zhO75Ifjm7YJ|?z5sEtBogneBm`IEyA-a+XC<^I6+ZLU%xc*&p zgkzcC7C3p!x{^dPbMU}<)#aw?Dx>WQcy`Iy8B7(=|Fh&(yAvS-_cP^KiLSU)wa%kw6YY63i69;W)w2!7zU8;PW5N6tG}$9O8_zZv181iIEe*TW z)A;-2GlT;K;@(#nA$-ph8Yp-TtTI*l4W&*=?Ct|a>PncWYVNff_1+F%+^u>7BN0?` z9{fnYfUU=cS6FRq+G(K4lRrHG)NSHF`*uFJWbfci-r8{Bk60mkw?g7H#QH^1BOfdG z0}F>CohDZ!HamH=E{-A^C+1ptmm46HfO`Hyy>o_Ocjc&_@Zefo?Z4u&HyEU)E|`lS z8OiZ$ZUbWC+=)U$0`0+XOx`T}pK-*cUtA}G<4|5VVfpc2>C#Dee4^ura({PW?{Ji( z;BglRexq*%U{{FyW8P~e62PG|D*R|I53``oH`sc9m;dCcCz>)&I(LFB z*1=P4u7cn))kx3a#pg*^uuw5wpAco9e-(}%FDus$@Xty_2Zm)F3R~Hr-zn(GFLQu2 zhh8o61NOMjO~xF*Otw?QSz&OQQ-jff#gj9CUQzAk--^g5m<5f0nFgANu5jV=SEC*K1Fqh!NKIyceRT`>R zDBpOk*_HqNPX>IA1v>1R;Bo%cONi^z)TRYcPdpuCS}z4V3x?2!<`t}zFNlV`EC0F; zID^PFWRK3lPKTl2W{S($PR7GQqQ%VWO-I$Ubn%;SZ#_UOEbUx;b=@&3c~=rOn&ax} zwEQ_R;$r#vukdD!S1fN{ZuNeCmGHr_p6aI;2AU*l3Y@7Z4$T~aqa*ClAALpO+Z zv!$MM^Z_`&Q>wo7B?W*eh{**o4sLF28o_`!zH3o3C8p4A7G)Kf7} zoW$j_c6r20l^!uuf0a|kqGP>0CMqb5!7FHb7~0!_U>v(t>2*Y5(*jZ*;Oj0I#GnhS z#Sm8(qrv{OGnD6qIR;2xh}$8s5YC*~`eYIbu>pr(K-9O+K^cYRVg%W%or8R6yU%dp zh&nk_riA!qR;SeaAJA0PETbu^lFN)cV5mxi6{MPVt;qJeEjr0*@hi+r_TYWJoDik#wWcg|!SW z7&?x~No8pO=FVC+V16H&1N4Uc0nlgrO6lt>s|&VG@^^^%_iTevd5%8#?=^v!`?Q0M z%|{(FF~J|jSq;ezhz@F2zY2cXGd5&C1avYDgp=m1aLC1WdHTyRA;Y$2;MbFI32!_` zY=}TiTRMsLj`kdAiVC;Wee{AUSpz&mZ$cUa9n6yoC6h765G;s1cFe zg$UmhuX-)H0ffl8f*{S)OJk+Y{6$ zU;aqH?|(nh)!$U1NYnR;mf6F$o&ghi%pfTJS%>4sLR10ySUi!wq!q6 zP!R8}ieA#VLQv|n?mzPCOg>&0%hn`Tz{@3%nyws6PAqXAh=lbUv`~8IpCShGL?j^j zXj+8oA)`P?_CG5R=i%|D)~~k@H0iQ~F^(OyMd}0-subvbx}d*6a~0vTncdRVF_yRS zNHN)a*$W)c3cdfUx5EH=F~B`5Z1VT;KNrv3MP&@@{gIpGa$uN%3i?Rh<|OC6ImtVQ z=)^29;(?a%204P|==GZ)lU&<1;ATffxv-8J9nv`R9fZ3wt_cYs-tc0X(e0){wsoL@ zXr5}f8U9aW7hV(6*!xxd_BzMA|C~@(g>e4{8co#-(42ocRkfnu+#2X-;y&9N45Gd|D!3`6EP`>*J$2n0zj}HX>`_(>dVB&KU$9X}+veIC-tuly9}} z1lj&fy4&)k{QZF5jGdRbpfJ3oYTce%2!FhbI&kAr=mv+Et|H$~&U=qiL9bA;AK7p_ zhq_Q3*pWp%Z}k{L8u2q0fjnWhQ}N5_T!N#)9t^1*AUYW{SJ)SD=f7;=@=})*>LpDa zZWU$0k7do~u*u@--vbf??K-UaF7ALk@+)_0_&ek|@-qV@0>a&~%XyA{&zNEwpFVQ9 zzz~?(`sJO5&WK>ft*o2A+&}3NWGD`{x1{18yZP8gE$Wzg&V{8Cb_M4d!wjfkW=PEa zC-?IhB2NLQ^L=CS@zKnFpF$rlhPUrrq zCu*uQw8W=2xlPWg@zuvZiwzNlrs^>}ji9msrSM+hreZ^anBT~qLL{E&hcqu-^MTmvXD_k>m@#d*Tk1Iq(V&5V6#pAA5;fs#NMIpNekzk!4685x}x2lt7VWh}QDKHHRFWZY{3pY2dCs$Ht^0 zA)lcYgL><^X_T5d2`yZz3E}Jgs&?x>W5pm2mx*)(Aym}!Cv4nx`^Qi5vQCjF%CTOM z3EsBkcs>cf1BUk8$0z<*N*d*+vG3^*P$zlaQB^}?44WLl2!hG+ym`BE#Lw!d;`o(P zfp=Cb!f>D=aTsU4^JX6*3z9ws+wgEMD3UUVAW+tGe_RG<^BB^JY^oy*>9d}4BA5|_ zqS3F~z^#bsYVWL`sp5fvXUFT*yD;F!rAR@m2Qb0NBfzev#(weeh39t)CWdY8D;lOC z2SA#CKT&sTv?8XA)-w#{1r!{NBzbrY+NlODRS3#`pPMn*ZsZgT z{Ky-0h9NaHeUpL8UH?`3b4T+my6bNPGK)4qo_w68$N&11AuHx3&%>tzx{Uz! zTizss8Gq9K+0fUdAUhO}45kXK&94Eags3d8PK&u;RHiA>ddKVB zMqNQqFu?KdWyJS;$ohEzNP&?xYF5~S$o)!eUVTgCuejhKZ+FP22t6vCw7k?d!TiiI zh<1FphT+2kec**xtqh&0(UEAKkAz?7ao6szYsHMZ++u31glEATzs@kFweIE@!*DYv ziB1k0TU?DBHjq6hG|}g=%USfceH|k`3OA~CgwH`mx!g7iG^%Z}xmOqa*M;PJO~3%$ z&eYWbB!t5}9|32b_Dmr)@@pJoH^w=#u49U&-N-WeX^~_y;o34Xw$u1?WL|v9xVz}C zd5|-X4Vo*pXp6bt`TA#CuV_dg7=n;w94rDNcBa~=+&Jw47;`z^TT?#vs))&ri==U2 z=uJQ(R}VO!NY-dzYCKdzJx_EC!n|BOJ3L08Qm0_174;fUD`!hQ#vH?B&!XCAQ)g#m z|0(e%;A;NC_dE^QPxtb07vq`RhmTN@d2~a=Quq(*DSq_aseX{h4L$`B)yFM9kYs0d z=khnW8bE}7avo3=b%Mb9d%XC5SFmLdoDc}V5A77-dE)2sbXXZ|%ZfbP{ykA_rJ%e^ zud3U`1WiWNa++_?;bu2Xtd|7tl%+?8fC(Ao-?<)pK;(e=<^c1BmFzKTb@zrm3M1-ioCIe4E_>^*y!At}e?#BNMmg0(I09@$oU zX9YuRCy4%WFev++F;qc{Q|Fj}9f3}|!%Dx4eIuu-+2Km!Rq$dGiYGcPeE^IbpRcrg z-k^q^-w2uq{JcM=ua3y)o!Nh~Q{OXbworY$wag}YgkYRrj)zaozr*!e*LvKteyBd@ z)4P_7$mTtZ|ILkv|6K(s6bvIG&si&c{Eov9W{z9>9Q*vj=}lKYFc#k=by6Kqe;0-A zm-tZqYAevs4!GKz9C?)^l4`FU*j`y0bAd|~BmUYy_002?Iik;A`y_iy32|U!-A8^O z$&sl?;_K_+^d{jf&OzmN<)L7mULGR;i+F zqpJ*b09J$itpepz0n(Mjk4}Q6<7NplfVF)i%i^>>>iMivYT71W>?Nyl&wG?h1gRa{ zGvLo|g1?%@As^2FZ^i5nM=%V3O%nEWGR_RZn^-1ps{P+y z2drCP-t82275#E)^BGbvjOXeAxpXUvP2-6}^fKLM)ICs#A^ziL0HP(`AVq(#?Q9Jx z6|V2WeJ}D!KhW5xw4gJu&Ku*rr62^|=o89~iuudXCU7evugnh;i_%yDDL0M zYWu_W5n&+czgntyRhoR7&a0ke?_WUOt07^ape+yuP4+sgH?E#)__?*Wfyo4K(#A>)oJ83k91n^utB~OhG^QUylzqO$oCG>{ck2-Z>{ho z6mOV4JqCG1BExjYEv6SZutrFyqF&e2}8;A47x;Ag7t0S$cjIk06kD&M(F52KyL zXyV>b_v#7Wct$S6aQE#z& zJ)C6@CjD61TlwwR=hv7$j3Dsm9ntGX_s33V$z}h5g8mzM&c`WRupvVr8Ln)Nk(kVF zD?T4B65vz`Is{3f7zSu!8Y1Rs?ZKrkueshBt`Ovx4f5zbuiG*P7EsRu2Ft%av0*|4 zh))roQgM1ieTKHKu3PthDM_Z)vOaOcHYc)LCd4g*U<%!2A`hN91G zj2J@HhD-}hib9j+v~YbWrt7rqNm%Zn;%=n`JIwT` zz;f{!RI3^iZc{m7!Ce9osQ7GT_4CIpl9xB^^!X`Q%3c+IJu6f97mE+NbN^?*CO^-x zCV+l5jdb4U5t=60Es`yrX4-vC-*~VM-27*u?NcqluA=PW$0g$r6(z-1k+>Te!~6_n zZyU(Oz9jH~nT3Q(Oi+3YutDhx|@E>L(cIE5$`Y-EB{oEh4a?)f2 zQWWZ}W|wzx%ZguPKx5o5fZ(h~jW+f`wd!5Tho&7vyrrA+(>w;wylQL3G^-|T5&5AG zB%pluQ$3-ST?o~MSsth3rc@`Xe?!Le>dDfjd-f1JQjV<c3-OM|+m!@QrLMd<}7H zO%dfi@~@Bii^=I-x=Tx1TuZDD3#@eLT_D{|M(ve&f7JKTz81_@TQ7OGKmAngE^~;a&uu~Ntn4GDc_-2Mj?7Cgl>J#`jVWGpa z@Xi}jhBd1L`&bT0hA1HM)mh^c67TuJ(!vn)#MaMR`XxXXs}wnylRmxwB0rd`441XI zEWGQ;;AZ*pQtgFAcgB4XxXscEKJmvLZX zCW2+=ZYe%R+}$L%j4!ynSF#>uBBXM*qp_W?xCFaaZHeog>oB5`VGfc)uOr!d6A8aR z@Kuf!7&s|$ji@vZf}2SS@aj@$I(}ah)t2|o6lLxSbj?)pghWTUOBHWk1GSpO z{IedddLmgg`^#n^8cjO8+P?;v3N_{Pd6SVJeur!a!1BX1VPAGZp3atOa&E2dz2(j_nx<+NDGy6}{R%|=mIXJMyfq`ivZw6lg> z42NG4wWBJMo-Y@8$K;opa8Aktg?Gh8wkt>5m%#yM@kY+3AC{m{sB%98FGx9}g(? zY5m#yyC6#d2$!iABVyV>LTAW$AI#8PR!^d2l=(gwTO;eW6g{z4aB}XEzyMiDm<*M2 z@Xmf8nEHsXDWb+eTHQXJK$8ghU94X*>f_N~H}ZtWlTz>%&U~*&QAQA5+%Q--N`O0S zhRkL3!!BKB=HN~b@1u59`IKkAGICHlWhFL;)dD}SmhjVx*mnxSTh-X;L53G6kCcPa zRS*#$Gz5D?jKARMl+1Loe+*Pl0#dNWKTx9U%PhthfrAAgLE(&^6azx0L$5e3f6`F+ z)$@HY@BEIZUD#GfnB08QHxq>BbM9L&u6puIx#c6H*RrJW$@q#6p^?H`Q7BnyIx(-f ztp^+Fe$`IE0If(<%#x&!U3}$si421N_QmPVwId|B#=kkf#-@?Z7^0oY-?50$;O`=0 z_fC|WtAAs{g98*wRj}bKTT0v)4DBQ!G^@NX%$1^E|`Oq z2+Cu5_E4*vj>`Ih79wq#g#qgxp}$=tY?3}}OLa+Pzxq~%b=t^tXi6HARjCbr6kG59 z!DvlxO)J8cA?pGD*Dtjc5-dNlWf?NNHsY{AtGY)BqMV#tZ}9QQTR zJ6e1JBIQH(`RLR_&^?AC}YFETmpJEfG!O};-g zGRGf`c+#m7d8<(K^#46?a{~2hkmI z_7eeD$8X#wKW4(pJv2G1Wqn*3&D3nAXEg4xf7EuF)lFRqwJP}s_#z_4r9<;TNl}pA z^?@Sgn5`73+GODWa^>dov43YnS1V0uK0o5bR3LLsW{Cm$l z{>YD!y5#-`ALhJI71DvtAab$pKHjF^hYw#&-3*WW2ThU#yRDl_9royEz3Gfm4nbY&Mnd31gCzKUOE@M6X zvJeT91-;}|UxIf{Ul)LOzSGz(tNkhm($W6Cl%&i+uujU}B=``FhDVwiOXMvHDsU+m zht9%yc8vd=MVe7)ZnmH|2-%#VE+0Rw>^Lg!!|x8(@B%+ZHl1 z{OI@1hzfY;)WV>U}*N88*n^eEXb;pDIUMB=r8>Q7!Mgh?U%@F$TV@<9pvK?ZXrXd2@ z;9RJCYH7TwHNxrBNk`e>*$R7m(Q_n*Rr22)St&T-vQqheLirI5ln?chPe$%GP1=~T zsET0=0n|Pe^)@d1Du=eR`^?-YXT4l$>?QO4f%}=<@(ZGTB_FoG2fC%1L>%+W2kO|h zsLhQMyYWpuY&+b2ywYX}Uuq*B*@paeR*Q=pJ7^yi15V-t$lSFEO+T+~Jn^xo&HLf1 zZ|2zfdqXUp&obSw!MuV?j!b_lFUOfE4BwG22(Kv#kc!U@xA3B05#vFel>{0!S?>aHiJlv6ViQ)0ls{!4*6`#zQ!Uhkj z_D(3n8<>ZVw+Ir3A3vW@)V=Zavo~2rIiTJ|?;7HW9+aNB>(lVDb6r;J!6Y3GcUjwM z^s1F@AT#5SSpwe=tjw>;1qyw=;2J|H!cb)o{w9tq26k7fAaMMileY<0$Tn@Eeo;#? zYBQ#=7jJK$PN~07AiyGwp)oxCLJeM^eAfa2gT&DyXw2K_2!ZH>4gS(0KC$ctm9&}= zi4j~##Az$s&2f~}3+pTO6Q$+OKyw5sG%E{LD70kT_Sq>evGp%3V*Hg>Fuy%6Xzabp zSOduNv%eV$FI>G5*~}D@;i^h{Gi!kQCs_~_gt7NZN(9G#Y3o?opSb+sNqo6b2O=#Q zxbPLl0a|tW-3EzKp#-49zef-dg>2{W+~eHwZvQE!i$T%QRCnK01qSyS-3cbAFB1K8 zzuh770UR_P>K&c@gs_y-*ti<(^kva@x4qelOgJB78tAb$;*fQ*%7u6P`0J`C+fAHX z5DSW?Sz{PYD*Mq(>3L2L-+TO4_h?I41l)NVHK=}C!C zBc1kS`U%3Kt@3;JkHAy#a@#pDH;WK)E{8!PybF&C*mqP_v@EH9Smn8EYdJ+n@mjOV{HN~tIZs)GdZBBo zq~xLzF*@@av>uQse*&!;Httn!+)z2QyGx}Y^(kH+IPrh&s7ETU z0{(fPAHR32uS?Z8+hot@4kJ7>GbxcZ#eSsMKewcFBDEnw`LeYU+< zz)gW{56t^y7E_WI$6UMBvUqK`QzZmKyg;MKsknd?eCGgDC#slSqd0RjkLMN3-mJck zNt~IRS-Abq<-N`wubv=I^chJINkDwZ)y7RSXHo!6OnTnpUTrR|m6xS$vmUsdW zBFE1)lfT^C63s>|^D9gSD3#DDD^2QnO@hty2Rqs6nen&zcJ2J>_6U^^T}Y*)rxc6_ zW8(CBopdMOW-aswY=Z$5Zm8PYVUks8Fdo}4nq}{k60@9-YIKBX>zexGYe1ob=6a5Y zdKDJxuA+W)j5tldJCF3<d=1<`I&GAcM4HGB2>&CSE-W_1rMSj4S$`JjVo&p@W4|dv&}}+-X#iYQC$5c*KTREYJl_= zo}SdiJ`F3RJ|oqNp>Zze-Ad@xjbN=_5{>0^T#A65U%I8L634G!&-JRg&0ia|fqI6| zVZ~Rexi{LTA3JU&m@o^MoldQQR$AI7Q!b@`@OhlJCGF|6aVMUNC_In@-z*pRyeTiX zhp%bu`yZX2IQG`VsQeL~)+=<6v)_jE@y+H4vmr09#h!wn8?n@*~kh_GZAuXlQ^_aAB!EGwHC+F%c62jj z>seUTheve$Ws@_#bzpUf3JFrJT{FembhwbCu##uNIT9kA_vb;n!=`VHA7I>!R(B$p za+GQ|99vI4bi34>m8YmGjgFSb6#jxFb}h5yDjkgx` zDP9MaHcGnt5v!@`$4~bUoW=GyJseJTE?=~Icjhh4mfn&B1npWa__E?&OPu6ZTho~q zw@6{23*YI@mbZMT?}SFw$p_lC%`AYguWWwj$E-yVO-mWN`3yEaDqhFCr+#OlDHTLw zP1K6k({)G?=vIY&3XjFzL_ZPvL!WGgNbfD#+|r$@Ob&J2>%$+D5Mrn|4H#r<8p`Pw zWk(6fdBC)q4c`a$_R=zOufS3~i7jkk#>1KX_>;SLP+F%@W>Nn4hsf`Tm4ops61Mg@ z@l27o8iMBM_oagxY6__lqc*Y9$eWc5M0m&ZjH-nc|Fjrmb_EL=Uxr09eCq(jb$By#nTgulsS(e^{&mamCl1VU=~illU~_Qjj8Qq4nh$P?*A{(Q`XY zk<(>hVV0*%F;^My3*paoj(a9TcUdma#X{T8KS0DImTW>t zYvxnP*HMEAXqk)#=J2}T`7@JD_Fh-n({ddN%raSMYb1m7|u zr=PDt`vSb!_#zQo#&d+!E4c3EOwGG8y%zGF$(M{?al~Fm{gm+>jzP3LZ|sDn88k&d z#*!L_{XW#*q;uRAfY}wxk-yQAR9|=c*QrBP#K+WqS``7QzLp3js~wtUKG_S>UnmlQ z)Q!3|I1E+J&>jCuodM`rSixmZtrEvb8nuD9UjuzBie3Der7?tJi|hORO7wha{VSGJ zrRp+r^=DBhPRcH%(4PhO%U=becb___-Q-2^okW^7@2M^1M?k;Shu+l7=ve-o4~XMz zWn|Ylk@d7AeWD2pLXHJ z^^e&?f1t*@k<3|?r{{Jdm^V@$G{~#s9|R0qM($THK=5@awMAcrB4umN&4adPr^Dt4 zMRdoXKikm0VB_)(hi4D_Z8sgZ5^2fyCLM$12a19UQ!jvWO3ohx1rm-lj&MPKSKwLs zvyYdQe`+lQlw3&G;aYpfBoj>TUz1Cvh(1$B*Z)$}jGT;{a`qH$EXthPdS>y9mLfk@ zBi21NHDcMW`xvLvPpXlD?thD&IoS#j+s z@WbGoxKIZdF+zB@n_j0!j&1U69szATp)Ag^sdvfVAJgKp=SI~w9J9dT~hV4qK^-`XMhV!VoOE}%$6%5?E4nZ=b zvwCG;C5w7?zvdz_u&Hr9T&7|yeK&9VSm)t5R|eO|zHhqZhy~$t`hOOL8Qt;Pnmd8?GmUx{03pX3F~;%o15kZcv+iJl>YofJld!eh7*;imzDTi-$)mSI#l@> zl0=H9^+LO@5u=A6zDC+STM5RNo4!Qs&2rtFPxXu21>fmj0AJ5s6D^#>tUb=ey!S8f z9$Ge~i4#;9pw2XEe(Z=JDK|2Y7u=yAd#T)Ej&CBo`Av+RO@sudRRxI40s4MxaE%4z znz%ZE^Ck{BwGM>46q)>}EsXlJ^!?O3dSzxL@{i*Yk(7vN_x=ESZIz1br_wt(YY$lH3otA+m zYyaB*C=ughZ<6u7{!4-Ah zVd^4S0MJFcOrYa&gcaZz&>@Xaq`yg-Y%FkvaLwq<$iT{7{5Z?5R=`PUF-;82Qfre= zr7+Olr5{?+UL5NGk@&KXGVQyXhjM`LKmvbP8&b|eDYUo&v|quSg{Of=(RaxN$L>oz z>wem|#(KITP=&rA_s#p;L;X`SvpU-)UqrBB;q3Cp(YjbXkxu-9Gtt!6{&^JJf%6J@ zrcWM)5`V{pRlCQ~mu3Wd1m?DYw9PMG*jCdn$v=2CgZj|iW3IjhE|nb}L!(fWN^WBW zw~a}Vv~>Szt>!5ekNnx5EZfcQV;J-IC^n0=CpFlVJlJ7bo^fgkX@&==C$s1D>qsc1 z#)r74j>y{SK>z#!!59?#Pi!7baO{0z?YFg>mGqHDw{Rj_C?XVk5j5&GvBlN;l67K} zndtBzKu_gbyT(gY%Nt1c!mEXw@%3#Resy3F1KmH4a=qk2S3|X{pu;Z;*k0BG*VeL| zL|J(U8s}j~B-L;u6kCxdZ`R3LH(~{orPB8g8Ta&a)=??+(p#*9jii6~R_i;Bh~BCw zTy~Ry7*cc+x^;1@j7urBiLK$$;}*Q4sWd_&;AZ~`Ljwq02raT=j88b-iir3y~#ZR_RsqLjB5bKyxZpNkh=+ z)!m19VTGnv$(HUwU9A^QH97*=`pF3qBcscraIT1&W`v}Y`w@c?9w+KS(VqKN%=JSA z{bPzoa{l$XH^Fxk4HHF=@v>hs^Q9oIq=5mYk%^xKP0;g#WB(~eM5X%Gd~VzAH+DrG z=47hEmY*Sm9k6P1Kl5enio>C;a0DKt1`zM4e+~l`iqd%@Xc`#BJ1;XWL><}dy=>9=`vo-zs^7S#o;Yp7g-I`#v84Ar)+)G79&SLDho)L__nS+Ugh+iG10 z21D0~;S(CfCOz?YeWJ-VzEf3uCDPEB#dG3H0HZqwR|*Zabw9Sx5J~>MazELw+|!e( zt%_yTLuQx6$%{<$Kr`c(Z<4_n?p<2F!t-UW>6P2y4qeT_l->~_E*_lL(hY2PIR8>I>ItVHnXTdGqHWuvsb4+U!y1tjc$2+SzX}+00o^c}5 z|N2VHgvM#4_iBe?G^eu0@zx)^@Lp+}WG3pO0uNO@wi;7I$OFjOv17&dnhgoioK~~e z05Yqfic)>r0~2JdKaji;VsgLPOC~<%_Ek({g10E&73|i(Pivg{>k4jj9Ca%Z>jTyZ ztKmaxr-OF-d_k`1h2EQY*+TXMbVz5a)>>=Ql~UkdJv~#EE!A+6XES|c76(g|f!R}7 zYPcnO!77YUVOm;Lq+ZXdzPfiJB#1B=S8vGXCf?m?RD-tTsu&|8J$1K`aYg>w05sbYy<_t&rVMCS>eC}m=1!M1B03WQK z`$POxdM+bGRYD0MHa3Tt2^*@<%j04$bZYee0B`C94^Ntu_HNllY@Cy>tUA5HPk|_2 z=>nuy2$5(eycqcHF*1mf9s00)4bRKi1^uTTA(?TNXZfkpz&`#R5@di$S zmwA3%9TxSv3{1(_zj)tKK}gn8EJH8Y`-DL;llx(?-)D(o;yJm?7yj+4*cRW7@S_dg!+L+^1SJSy`pMa$)3& z%Xe)uU~i7}BGnM^x*QI_AZq7U)Ibc`RiV1%z&IQAom$%XqPMUw)I%`OkRN1+uPEZp zcDg;gqZ)$j|Jn0`WjIW!X~c4ssEVZMN;8AZ=Ae=UF}&xcKAkr(mzRt>X=lS=&>m%l zmJ%but%W*HqQ*YLWBiM406#*e+AUTtCME%f9#b^mK;~&22Dpbb^vCTIxSwIOqp`slhVAP zai-DrydSg#&+WCo#ds-Wo?u2Tlw@C3NMYya?!|V9@0BUav z14fZhO_02p}L>HUtyeC!P+9y(fCCf3RSXWZ;*rYZhcco{>&9;$ zVuP;&#ZMb%UJ`QS0!YNUUZ%9ioDo8YiwDTCkrtgu`Rp64UdpkobElrM+wMLPnCk16VZ*O|I-Kb30XVn2MUpO#wy#(0hqnrqhH?v zmL~ljU>liiE5H~LyOFbL{VV-XuuGc04QxsV4ARNhiZA&0v+B3R6zZQ&m&Pl{3mvfX zR%69|Mm&XeWFBwu-u1Ch%Drk;Y?R_$D1W$DEF^7!L(=vs3paM3pg2G&&jBG)Um({2%n@J_#Q{-P9r=WB>gIxu9$29bHoQ+kc+( zzn=Dg`S-I6bvbZ$E=&{jEPCgMQV48QIjeZ?ZZ9>!WTJ6*s#wF6FU^`6so*c7Cw$rX zAzvXA+H*noFqaa%N73U(?nXgsQ*yQ|2#tNpa+XP;RNi!3YSwxK8Zsbpo|)5 z>X(gBcpk7sC7a4uOdlJzMGux!{x6H-&D$d|oi74>T*k%2#fGXRqp!45Uy!9T-aNd> z_WiN@mU@)$lUoup;d}6Ko+Aw}{KqQ(Pu2ae?~9~}{M57i!w~V`RNR00!~UMZ-~XZi>8GE#kyO`Dzr+zl|EJ&h@4qj?^^oq^u)E2e3TGX8iy1pTYa}QHfBtS_=utBE1#)fB9N|BKM2Y%vA2*|93Uz2e?(| zf)Qr#5G?QoaS?zH!iP8nr2qX3|C4taBSg-7^0xX5O^olqpK1olX9REJ4lvCV`}M$t zpaw{hP4g_`qbVdpl|cGO-%D4Zh*x`r@~ls;GurzJP`onl0y}S&w!4dDL~w1!muCdn zws(tR4gb?e{bN%)BMN&3po0Y@?weR*riHn2ML8TSwu?NcS>8Y_ui}UDoXs77?ixe` zOo5#)8`!L)oCBU?G0@T~41=kD5jZF zYI4OGL?jES7hSp$xGfSQ!+zdk2>-zhCqo36{yqdbhj~dhwR5TfLHPOO^P{ORM7FQO zX+aj9MwntKNZ?@3rOEO#*9V7!P3S_Q;WnQ5W zP!qC*1mI~)F}D3V38-=+Go$Dk1)&JanPH{@{nEj9*tP z^&RGqSJsy+fHKf}boE=Za!(f$)<5U^Kdpo*FrB0?BdJ4#=@+`o+&*UV0@y5 zzMr6IICcQS!3&{Xb6|_3oW+yf3f7cdHA4Gf{%#+TC6XHT*SY3jQ{JT_%DY*1}n16bqpBUnNbYj0j;Pqpn6%7 z1!s!50;}F4fNjz$Q!_Z*Xs-jFqk4O8)(ga-cpl(wQ-J-QwTg|6Mym*TFK#!$6e@lm z7#F^Lc~j|Y#cT681)!$?xIk#tac|>k8a%ABJN)FOT-S-PB)b8dL#H(&OqRdNenm3v zhN=|)8_0d1Eqohk18o5sTCS2*f=Qf~sOtdGAy)WeQz0#ybfmJ)A0cwPm^W&NpIjAO zf-Q+hb)c%3qJHIz;|Xw<%mq>+K`5}t6OZxFbp9gL3_Kolu$`B-AQ5C1z8b{aq@H^f z_MtP^A+bC)0Dz^fulb_04#ebAf*@C87noo@!zGSXC^;?!UDSttu*PmG8yCP|tPcS! z3@YN69>7gYIBCO!zx3A`ulF?l;HC$OF?7Ps3w$nerQ)Uy0@(I~RGu$mwf=_(q4QfL zaYpQ~kE1id@Vy5*52i>jn}PXPKxM<}2)`d-uFPzbH9xA~!2J~{rHkd-2zE5n1k{s` z6|k}EZ%jNdB?Fh+Lai-HXVekUWCO4?^)N=kP=G}7U@rt4k%obMa^e8auh zACBR04F#S#@B6xbX|0jTi&QH+D|3B*f*JtCjvqDZ+_{F-(y;=C%B%Yx_mCszQD_&ogsZGqj41BZo8#<%wAS!v1-dL75$(Jjk)}zx9!~%qbZD^t(lI@JqP#cbUsAp1_e1a)XzBMtC1-KS#&JmAZ|N za)YFhB3?`v?awR>6_z^{Vl*x9vt|Y6+@OZ45DR^5G_SDb`VniZZp;bY&plL8OTWlhlriIk#iTDwG7^jfhnKAO|sj8coD`5)pc0OnaFi0P0Qg zd8tyNFNLkkE3*di^3#GgXCr3$3UD%A*|19Ar@pgYuA#%N>c0UM0dgQWe8aE+9k_XE zaQ@n<8{R>l!6h&abKUytunt{hdcm{&GE+VTKfs4}HPLHZn&T_LusMlf;FY0V6{&-M zmq(CB;vvVFSCRD8)=ph|0`O;Md%_cl?D;bdbc*COF;qmpof(FcJUZr$vKG#%FOg1UROj`TK8|M@hJR2-=a|fN6nirk)~;Ioto; zn%^!D28Lmw@byGbwVy%UBlKbIVsWik+(M|CTMj`UFINk%=36mP(s#by{E+_ZBMIDg zeV0bK3qJ2ndU))Hc%0C1@iJvM%#boArDD*ltOD!cpRO}N5MUvbHv*2A0U(~KAT2{k znbW)1&k8(TyFxIr$|pjUV)JVH+NWG37lnT7(KSX&ppC}9E|Sfd#`~h-lOYLJ)FguI zP1lxZ4_xSR25<_*FLh+`MHDs;UE(culNg1UuDA4^ok;ya^a)($qKTO@Io0q?3LDhH z@k}TC6T!@s-%1wW%w}mMgSet7ofqlP6LN?S9Y4pPFRv`1pB47Rb9%EKid)c9 zV%V7#E`%wHUvnv>daYFBc%?*W?(sw!+Ve32sxh!2sgwvPl;_tSnKreL;EUam)pIXc z5)7DIP7bcedx~+O2KOaLvoCw7MT13Zq++|&#_a7JihHH~ax3tnu;zUXUq@FgaJ+!? zWEX8k8zT36UQCHl%G~nYy{}xyME)tI2;!HA=r<#~@>d;%R!$*UnRVvpdf7Am#^8i? zfHra@rjxs7>4aLZD$NQc;+MtkLN3F=W+Bb$PR1nI*GAI`_kZt|f60V6D{29y7HleJ zbDwzsMoIn9EslG5ElM;~dQyV~4Ywvp)XedNYx$V#kfhD8YzmCkEj_c!9U1plX;T{x zFlfy>vsI}dVz~o+EU7T%{Z7W(=a!b@utrq#Q1q(m^M${Bt-iBi%@sBAfX5Ld`z{|6 zW&bSxzAOx)4xiB|m@?}HZ;bs+tJLWmY78Jb3lkn=SCNZNxv%D#rdDnVkz}TU7?Rw7 zO3)ox5`Eokg%(Ag&rv9W2aZg+*E3tNVkZv331LaYTGw4Uc!5OH0+sKXC9Z+(Aiac^ zkDh7`&>t7(4k`KD(s6~^eCy9|9~Q@u??8k-`(M^Z$n9cbCVI98OA3;YiW|cATvzI?nbL)d79?0z zUc;HnwvBrFAZsT9O8y$_Fq~?vtAkNGU3erLtUTGItax6fO8oWg9~G^=9qLPXV{@a; zw5TS1o0TFcdYI`+M+|&(s#cv7VdCUkVevSW6u@C=t!vR|X=IoG%l9!@?4f3f;YHaq ztfspZC$D0^z;4&EI=ThH?G`sJ$I%MuqGF6jBy9RfzA0(`N}~;G>IgKmOQ1Ir?Vf%Z zF^lGMXx{siT~8|_)im#006k+mz2UWMbMr56u5X~3&u;&0gS+@Q2O~d-L8{LBP^$}DcbGLAGI_eV;6~7RW=mx;F+?__ z7vFkt58L)F{zzDbE^bqT(apSMberL8iKNZa;ZJgkFV0MqyfqL&I~6W}WTf)f%&+m1KGd` zk0#JE4r~UFH<`1{<_LynLyf-BD-5MPYJ&1Gl5fQ@iX+*SFT(erR1>S|y2b5#N1_uq zKWKH8B1_~%hg22Rkanu)cho^NAVw0WQSTCkK=_(t6*#?6@)PAkE&3b6I~V`zx_yX7 z@%CI!s{X}7GWi`_#V;vfstC<{CoHWpe_!pq*w~P0yB#cr7&E3nBF zLEw&$ZG1)eGp3LYar&Rje8kz2k3M*7?mp z{LIEmQs^cWXZngn&dcOnjOENNk}sWT&dQkfE)u@R%eV^XX6P@3Df{9o06T)^?3(af_mQWg7?&h`!= zBStY<{~kK|>J3+^V8$(fjJhcx;&N-Ze(S>Yz|;3+OZ_>v%--M{nHv2r-2B-iyOUD1 zb*=`jzJyiky5D$n#k*(S-+k+TqyP4AfBqlpBerjGaa|&&9h|wfIK8ewq#QwClqnGo zp^sGVFDPJX#AcqbcZQv~AAt|>YOO5x!>l#ZzfS%>b1H@RfuT^J^ojqBF9C`l+j9N! zH_1Elx(uzW$76-_{rf6VDHBOgob@M65JLosE6#xFMC*|v#gySLs3UuQ-;}{ensc2^ z*QatJ-{Ukp)-cwj(;oxogyA59+^y9?%=0yyoqqcwFiCMx^6CL@cgS?f48GiWnY+l z>lm@<@si9Bd_S%9KbY)>6+$=Z{j2#%CGOTO3R!i9q!f}6%l1Ng1)~q+lq}OTWt}@2 zQVpwHeTxDq@62leZ~vb`jDP=>J@Vj_@*Y47dl^_tZ|u`x+zvk;c{iZ7UT&O@cdC58iV~2D8Je`AR@39@#UQ zF%p+m&f5`CG?i9)-Le(<`P6N<#aSIk^rzybUH#Hl$#m>*@%);+kkH{U6tM2Hn3v#MM1ysYtmvEd`;$DwJ?!f&2LDv1p;!*%uMt)<(Bk5 zg+jnYIT%b*`~ko0>8x|F_5W2+T#trBZ!=4N*5KL?17wD|8SCD?(7`gVOD;O11>&!J zXEJ1yJ85T_<@~D!VKq%RPvqA7=wJ^h0lhL;ZO!0m6_h@&@?nqbzFM6fgZSQMW2Z%R#wm%q=EO z9Pe-BGgq&&a{-P_9tz+G7nk|Z0-1(Y2&0vea5z6-oB}W2F`0AnS5 z6wMl`zIw+ZR^J+ZBPu0v_nQF8v$a>}0zd2uCvxs?TieuW4mUrm2^=Nr{@NO?u6zk- z`@cLZ87`zf^~X!LU}P0^{dGyh#xT{lT246?X3OeEeVKT(#|2uQrm6Vuld$`%K00hE zGks1-+Ly(I%O0FKYg=0qS*}s1CfIdXwiouS#B1MBR zdCrDKLBmCzL!`s^Y6Cse!*;rNmDFWFCm{Z#c0)WfcTj4lT^DpMk!>Gyo(&qv%Fc`RYZi;!XM6i|HXz%E z@@YR*ClpWHf|)M^9+ICoP!#lRvp1Nkg(ZkczO@8XWC!1$x#R#V3QB*PgxS7_cku=x z=9?u>TI2AH?qEFLVoMe9NwkMAW)WJm(Y2YvM-*tGg_&~5>SqvP{PIJKU_}` zg1Z-}K{0e!tzxJDshg-Xl8*furKf>QA0ox2VCaBK$sE1w!d)Hw-SIQguQr+xdS$f7 zWWWN*M;s_>x)^YMz08qf8~m|A1FxlLS+C;4F2#z9(zg3=_QR-5C;D~-J^?*f9rk#A zqwbB74ZvM;xkrp?lIt;@x>TN4c3JMkD%G+zwchst(aQ3u@1R;Z(Sa1&uqW~33j84f zBt*@6vg}5H-3a@&oXvp_`9(aQxe)@oG1^g=qxbTYJaxJ3uUd9y3e}LSqnseiPuNCv zqAYHsgp-1|PN8KkSRIpz|L@?yhkTw=xy;IJrf`;ZCG4K4TB?;fgge7dC}*y0hpP%5jCC}1{On(l}iD3 z1u1E{TS!s4fhERUg2#3KDV&@8tJD6z>m z?PUcwv(Skc9qJEj2Jcu%`Y$;F?qnMs#KK$pZp$KaizAUVBpZK|jZP_?{?K$ZDIwQ9 zE?)JGDkn`WlswQv>EzkH!@zkjUVo+3^$l&i*5OD@~a8j8hVw*4fT$qC71!Iyac zkLB_94KCA&!cL#rENq1~8tMDUil&rcJ%mLX=F$j{hG|$sl49cPZMZXAZok~vG(0IUg-JAk@1dD%hjRT6QK7#X`ep#eE<#X@bQv^-*SC9(A)q* z)$ES}N{f|r`(|RPz4n6QL2gdXMq|(~C^pbN!+mgKy|Hip>x$dEZ$j+|RTX1yQ9eY+ zUZ&SWs+;aie*ymB!e8^hd6)F>ZXuyb3qsO@yAiRRCSknKM?B>&5S_DE23yFlyrDHf z$Vm#LksN7*2`eb8TM!_c{h;;A#ctIOb1=Cc-vdI>vtMTOOgM`Sv#d{db4VB56WU!J zmbZWa@IR|Mmo$~bh33*9$zr}9)?Z@oyd&r7zKt5ljvC&t)l(z#R_k(|hHL4?lJtS3 zU8wP*3$Q|lhP+@o$3XcWNmmnf*JOxFb5~91RNBEGDUKMhMce_a$sUG@4gS+ z9kR|(R=zk=G8SnM&!%Uy@uFTCbPo?IK$6Mx$W&)s$y#V1laCptuZS6>Mp5!TtG0xp ze68Kf_AiN%5=zg>$uYXNGC1{PqpD@-MqoE1kUOQs5XBh1r94^Z?(tyR#R@7=IGic~ zvKs)(Q73pU0U6kbv8Ca}$#x$>2{COhZz4?eXA$3(uT4k}h8dCXlwv-(2mF^;#UoC^ z>c%CDn9++gwqpn}9M$Im+&5QBhvW#QjL{rxkRIJtQ_({(tf%Y0;@$HDS?cc3bo0JS z2Kn>77hYar_-AlQkV_L#j-Hy$wS{62&h$3IiE>T#;|b^@2LSueG{=!P87eV#OGdfF z0Qy2EW8ge?g+{gGfNzZ2ki|qRvifR4!PS*0#E;-0Fz63qnCKWdS$q$5c-OaoA-t}a zL!E$!<8e#zL#-Vkzfo#FYE-sQEN^1wwe&dG)dg#TcUye$^k_HmhBPxK9HT?#iYf-g z;q$PvW(7kXk=>0+PY10|#&#e0vL@Bv8tKQ*R7mu<@aMJ8aX)$V<1dFa)u7ikIbD}$ z6j`pubWOs=PhJDKS*RIE=;E|t>f|YzW&t0NJ| zV3I58o*N~OYWA$);&yrcnf~p3bp=)?pj0e0C;-A`#LJH@1 zdypNSEx}ABePISoD9rNf6`sqi7gshxWbQi~mO#2E8{+a6)&a80R+u;m+#p=dg$2)` ze1j!mDQ2j>l``~Lr@Jp>%2moTVyp)5@2=JQIq94IouN_rnbQz6tcY;M+l`|so^Nh9 zHMn*FsYRfA&O4Qcg3n=~u*3(YCb5k$jUy ze%%s`>WY{Y_V0yWBz^w`ZF#dYxXRkDz=TE8D@5;X&!|#B{NKXQi7nbYOf3zyxt#ax z_$yr1VH%8}uk!g|KebJ~{=(sPwPX|0jmLM_Ca?y9ne1>|O>&+k@$u*F*sF+LJ%tlk z0ny#35W!lL@5Q(XV4I}Bm$#PzgZbJyGt;1wM!%N`B#2G2Wq-A~;(OJMoa8;?DhVHQ zV`a78^NUs>XhFJ-dxCYtE zzS7HDDXL`@`c)Fv|V)N?}(L;)hFCb?A9)ld|)b8H#&~! z+dWXpKk1X=2r8Vo`_%1eL={Q{@LJM{fqbE@O$tg^H(7 zjstuVjUG%Jf|L}L)i=VY-;(s$QatvT_9rM4${B8~y3;}gzhz6Bh0_SoPC_mgZ<1Y2U`J>-6!~XJbkyGKDA&Iw`u6+wU^_wS} z4tE}dRJ$o47@v13MuZXMOLnj@yn>&-~iV1I<(a1`lojdd4xpl44-dL|s&7^P;^k`x7g- z`nJZoY!^`6mwOq+Lme;&g9QBaoE1bADc^5_9w9`zsc-`m#fk9m1O|8cs|+8YD7pOQ zZ}o2fwEA)?Y-WtOe!UdFrmzAMg51ejNVE{r6(S*V%cejb3CkhGlr%`9H%3s0HbUEq zEE)|ucs7=-Zsz|<`2 zpm8YEYJ3N#gE-;CCQI02RPE-Q8Tx?bS*-Hyb=sD;RMZQ6p;wx~p$|RY`MyH9Vj5DvD zmI%1DEt{P@zLp08Mzl}sxIAX~1akcdWZEI-F=^F;M|RXoO9L@UU_F$;8jovJC&r~QN7LP#fFdX)4{*XCgb;uD0Vj>BJE z5n=&J@Q{;()s5ZmQ_tqT8XM(kn94x3)M2Q2|5SNU50;7m)C= zYJP8?(~>;>s`ra=?fUp_`U3Pf-{C1#{9OCU=IXvlq>$<-GKcUZvT)Qy1lC_djN&&v zAL`K7`3R7S{)?D=KZhn1d7wS8hEQIT=S6Mlx7avC>H)PNe8qVl3&v_n3`sYY2F1o3 zoW?T77#xg(J)!?qzw$q*hD&fgCr>L&gQX&T{{571dY;QMMOOT*M3g%H95GhG>K@ds z#!4PRDEwY!-wiaFSrf0b>x(u;!E38y#dArtXrH;D7G)Mbh1} z{*}e+XmkNsioO0ZzhVX(DQ#j%5qte|#b&mJA>Qck1;564pfffLaZQT&&zCS2R1Xne z{SYK-x$ObF^8lRrX2Hl00cfi1KSE4c7~e~tQ(i?nZu$}Uhf$F5|KJ0-c)qI7BFOa< z(ZAm`CmLKAFOY<7=ikp0_+&lvO}OxDx4`n6Cc^_#SUH3h|E0g0fn+x#2M92-0SVL8 zfBQ3k|1g{I6K$PhK6U&5qL#mZ#;R9Xk7m>BhY_GZMIyW(&iPbrhkS$_hB$dSn8&cj zR~?PTnFRj!-zi}O&2_2GysZ7--Ms%znC-bo$7=90Pc~ zFjBrw&-=HZ*MIr`AI1?zXLZe|AN=R3{6G5IAEFUsAzEkTAXR{Bz;IPiAt(UPaCf1t zV~5}qftIG6)c<<+{&#=%y@%SMvQ+pD>}; z4$01OMf$(!;2)BBs##Wwf;59ostC5QY=B*<8F~Ml*!B94U?jwqK`7W1CPW(Dc)xAx z<3kfkH%RW|z0Q{U-s&Rl*q=!(Wv_Xh?kXWAsTt&!6_0ctZ9z(eJVz(1NJRls!Jc)6 z`{yUx_TW7iU=7}`5$^ti^E$gbfuFG-pUxCUpX8O^RLRdX)%5&F?FU=4IO9XlFUS07 zDH5hRN((HTOAaooAQJS&Izv+O$D#(vr8lZj%osbRCOXjODhmRG0#*G`(O7QBv~O>n zm3nYVPwAPBvddE|Y80HgbuasOppw3{?%2DJwXgL#sLUQZloTB=Z3wlbItx1V&lar} z<0F|Il6k0Frk;u$Fky?_|40RCzXxs}Fx(D+v^Z^(ANR}jrW)?fu^}dv!(8&0avbSu zA&pX6_zjJ8^{T?2JG5pRO9m-d({m`9H{I7t%_FzDHx`SSAl_J&{_2&?rv0Ftv`~e_ zm<8S7EuxzUhLm=Sj3y&=ldaPSC)0QiwC1f2Zw2PF)U4@ldXk-2vLmOmYmUxX0m;z| zXl(KG*EG#c#b(Ssa;`g$_CAD&T89^gmU?%8dGOcG+YcD-eI!G*<4Qu!oK(z$%}2JIyiP%|D*O?%&6Uy&>YhiCs_iN3O&G z#%Ohi5H{D!`42eyY;`{U>nt{htJVV{t8!%`YDM$8?S1=Xx*Y-Tq^E+3=^e9K0v0N6 zCDQyJL&p?_t3pRFs|Tu4j&qD(vex?cm52Ne!z9ZTTt7>b%y4>}s3F6u%#ezR~u({*SUunVlg%X_uB&0AqC z38rF=>qB-I=f;^`Ms5^n?GEGj;I$eoQU_f}m2?`+_YdizTq!!ctCKfEpt*ee*cD3u zt`y+1RbrCPrsF)x5~o|br0dcpkh3aU&y*UT@)A0TG5imIx~#aLTqQPhml$>qss=pO zt|P;sxh#=j(z1H(1OFtPHA2piGgJGaSbPEULZU(`p86rN+o2s_F}Png>e&TuK!9u3 zn;n+hQcq^UZQl{W!K~D~1v7a<=%|OZ4%-ifVRs>M@&O*mnxb-eQBELvTildocc!SN zuO<++Cs+nTo|}w41kHEt{X2|&J6@&W{9v|_=s3q3$+?i;mzs6(c*(XMExU{j> zC_nV213Apx<}y3hO;KjxHAeD$M29PrdTb^X+>g6kO9>`{SiB(s12z}pvPitPpV_on zt++E!r8GkrSaHZKB|Z?0x{TF)DY=RLwMq7i8Oh`(=eXA$l|dnuN%yiR9)NxR8Goz5 z32>Z)>9!W`0+a5Y4Q_428GLv7%YP6r$v=;>(Ck3zq2!)_6j&=Nwt5nIz$!HF{so|C z_1_DoO&hpT7890HWBJePU*(VHaOK@fwI2AOzE7iZk;?9^<2QMZf^vnA6pos%UseTD z@bwZt;Exs|F-bYz%Qcm!Ea&NW8b1vI5c@n?^Sz}!P!5M-#o{eNsK8+aatepy2249l` z0;Bow)S?qs0s|@LOkR;LWy=+I`zs>zR#dlXPLW>$k;@Ato0WGcQ~r*__eYqS1Bz&l!2m>v`?dSVkc@} zX2boSN9Ue=WH?YZmmO^S`o13-q^2|_tRwPc*ffN~Iixy9nPaA(?*l8UxNSR@Qs}f0 zZ})r`QbT-XZAitpOJiMUgLoQk9*5)~jX=h#D3WY`R6wmZ)Ps9zt%!>Hi=(L|Bw}0_ zspq83+S_-2l^3kB-OpZW`H@d+Xf#;WQ43;XSH>Oqw@Az+nDx7T!_bQopzeX2 z=*F30u?Hc*pdU=Z5vKq$#3)x-`iRuGhx5qT(mktNpK%X2iH6$FPiF_K@5330wUjsd zPku?>MJ3iyq?X(wQ`U@BVIiQd<CXy3dRhIw<`Jtk5dwhJo`P&^p_WQa1^` zWJUpyj!rb?I)p_>ey+T*$&_f@&Jc9f+UyHRETU&`!9de3ldnD_*p$;yPZ8mql;MQc z<0ONYx5!<;a~f*ml%Nd+W}4>y1v|_@J!hyLRLni%7x> zcmBLX|GX00ht*%j;zG)$DV1nmJ2{UeKQdxUhJ;5mg*_|L?a@9!IOU-k+2?&~9GkhEftx10%|ZFu~CIaA6i7_ucF;X|{J^imM^9sB*- zTHX8+GLm}la7ra*Vkekd!bNdy1AYnGf!5&T9M$d=6u<4TJKT+#`;Zzz^ByB8h3N=O!-CHl^REGqn!=#0l*z9mlD6hV$O;N+-8M79-Np&lx1g2;YkzBOn z3nNVlr-iPf=rS`|0^}RDNv58_2=<|IP3+AMMgy%5tj0MTZq_sV%@@nT3XU= zf|a!WXB4ctnnrEtejg6DWpuAo*^v*~HK(XHa(n>^reUxkVA{lI35&Cb>w35gP?yn< zzmmH$*5Vs4G~y;lo_ifM&``}XuRr;Y5XqMULhtLg&c>joRb=Jdzrr0XH*#!EGgU!$U6 z;OPTbMv`UWRJy_yV%{hvf4ry9Wybmrr&D!R>%AhBjX6wU>liLc$=uph6M!v5jwR^R z{q%XFpq>7gbAnrdc1NGQhgWkV&XwW5f8@RJx*rB1ID2qVUIb%JLg*rh(gN>fzH|d{ zA{Ny=qkEHNjUXT2V#sfX{^ItNi-l!Ia{{n+uv@t!P1hwE@`YX>qU(kYkf$Ul9>h>i zuV3Ng1+BzEXnqJ^z|N+_*dCN7Kk=7inOKE7!B>frG)W{zn{OInM7RJ;Fa4|bW++}GPly6TLxVm z$ldzl@p?*$kTWhcYqRH9tYl?}Sz63=L-d@uYvC=6?!&Py1xP1*S-tshc$j;sJW@_Q zB9{!gtb$6N9Nk6(FC%wTbKJ7ylL@qlUDw<#k|Pf|a}9GjmX3!;<^1z0sT23v%Finx z&q8cKbrho64i8IhIsDJaO(=6+R*ZRp8$5Ue3w_sBhY!P8cr|vU?!v@2zjf{H>-}^`NUY4UizAX@@LhBbcFnxUHWCdAW}%x9IvqEsd)mGlHSPku zTvw`f0uEt~$$4hBdKJtH>w5%Q9|T{q$dtsGTJHz9O(wZD zm)7@inC|VvFD(#Une483&!~5oqVmri-d}Br0~dBN0b?$9-d@ww*kH?;+>kw$6l<5( zswZ7h0d0v9gP1*qdabc)4HiR4ji*g-u$y1<96GDr3NWmk$3jj>#@yKiGlazav&dc&WuC1X<*madJa z1_*6ULj?COX{Z3plQ@0U2LJJ!OC-iDz<#MPIpfv@W|Mz*w;ZnJ&r9 ze0|K#_%o1n52ql<%(`22c8K%VuW5qa0#IjcWvBbOK31*G6 z$HBBOF$uOiW+B0~!9YqWbKbCZiU%xtjizB-)vL<(gSL)qBMSbG9zpN?j2}HII+Cp}rHv8@s?wE~`Ixf$kX-=cnO(e?K0MXeQ!KiUp<2#RJQ4z1Qy zjS^@LA~&+UGuYepY6N#g1GF#1B>h(let!3ZT!epCTvX@(yW-Y5)OJrL-{bnzd(~V6 zy;ttlntBpdVq$(@h4}}Uo5IvgZJOIfGg69RdP_#yc0_<^hg-el3nUK{3C(4YZZ=*zgmcR!^u!VZDK>je(qf)avlNn0 z-kn@IK^DM9RM*i6yIK?iyNFgxDff8y7USaFE0IywI=a6x`0vPAhq~l2rE58hY*Ip* zU6rvcl@Wb+q*=8mbIxA%DN$6Obw&0s^vwjEty>Q-^y!<q)Rw=<*{!Sn~< zcMlzUCGIe|nNQuCqF4nAB@cpvnZqfB(k%6@|ICzsmaRTZ%)CSj$HbpbY|ty{PNob4Ng4N|Q8GbNcf9mr`U462HE*zqISJbmbSM>BYBN z@z5U{yg>+&d6zq{1)9iTJf<>$bKuI5mv)n+fGyp`#r8oNpF}9#BIr4OXD|4QFO;hz z9=YgA+lDwi1>8)-1UKu^4-~A<9yjFC1qEJmc^&(*{=|0T=9O>iMjieKHJ@Q_q6>kd z`6tYTqR|iQR)U%;1zuw*R|xeLbR~knq=m|A4&G^3rYn*{ z-iVvoD89S$XGKGty$Q_v5iERCr^zhe(5rHmD)V<>6dec|`3$3IOgTHWvg94T)Ku9? zgF#g3xKk~yW|_}+xS`Dfim+V8hVML!C2GS#Jz%0aQxJlgW}=MczAPFQ)vV zLQ9qFK0Sw4R+LfVj*#<6p7mVdHv!$p>WXm6*jDD5*e4162Ns0o#+YI;Gg+~XBmeT= zPFpjdNb#uL@Sh7MJ9sB=NO`*~Qeb(cIU!HE1Lv_PGdtc7l*U#r)6a{D!QODI8Atdg z6~kZ`UY-KtB8;(rPtEu#S9_e1S-!W>?KXk7MTyF1m34dB3Bw$Yxp@KJ>b~6{LO-G& zn{X?|Md1mf7cM2J5G%86Kt##-Nt1~9%|Vk}%T3tAh7)3;%BI3rKX<~xHvD|ZJ6)f+|lo+Cwunp9UFr2 z%$4a*3)r54anmoJG_|U&n)(E{#GCA4pt@B^xa$|cVB%M!%cz1{a6i%Pm-h@GCrOcN zZ9xO9~@M%`OOgY3Ti8g9g1`7SzM zq|6tmV9g$%!BMXmYO@V7>-bC2?R-9z1EB z9Q4al->hR|sffyH%%+6`gR>ZxlOaEI1HATM&y*~%*sJrBi*AfeR{*(wLTr$dHuN5vjKfxDOz~JdU7(ds8 zTky)i@_Y^IHb#p3+2JBh`qWcW67s1543b-qGwFU^lKAB15stzD`KFz*nUM9pvLX+|kM|LEXjTOB)k@V-whPC5&f zwL?o~do-2V(Os7*aog&j_vIL;-q65{_Bz#Pc(V#ys z48xUlvN3bo)IX<@?tFE=ev?N>pl*q+#c=5ZOyuU+U(7`DIRr=y)@Ame_Rti5Kp!sv zg$rq|Xy&iFmL9prCYHO|SoD@UG}j~0%FPushlaH_>TUfhbe}#We?ZN0mu6d{@~fV4 z(gN0jt&Em;{{3bQF>Q~o%${L2fM1ZuVp4iY-QlRGUWqI96ggqBxF)TN$-`zr6O*j+hAz-F1=jIWg-|*pJha| zP$BW4Df$$zq~V}&)AF|0^jBZsMGG9K8B@OZ7-Nq^V-@xQN1{#|V6tQ*m}ewZNwcal zm3%+sKoO}UvlshBZH6$)KkZ&elBP;wf`-!G@N_m+shyf|YQ%g@x-i@x%*QV&RWwo= z{*;L-j5n$r8K%B@8V#4dNGaMGlr7%reCa`j zy4+(Fu=;ww zxujB`_lPcVv;hzxDv3A)e>|$iXP+$lt3>@)Uv~03^&L0%5{9ey z_g^l$td9@Fe;gaXIE=cn>fkGit62IPexpR>G8t=qQ#kq!YAP;DB_C6?VS1h|&MVJM zW&->4CY2J9Ys-rnpY;+6um+bD5%ghBbJmwVtgHNS;8RD+;uD9~{hX4m&Viad?1Z{@ z@x|eRu@;_$SWWj_)y3W8y@5ry%)1G7oBE?AlCQG9+_UIwjWsi6?sI1zq~P1la?t!T ziK8@Rc41D%XM#rW_Cn4__dONN8@D)mq3(In@4uPgf@hJD5ok7p{%lFI(C{5U@Aqq=4UMXWSMp4M zF9$e^^D5fbVflWF&=_ud<<7v@VE>xo1@E+3Z)jif8wFOcVIz+R>mhM8eLeF{x|z-F z+qCH~ziJ6QV?z46HslVU%vHGzQTfzQK-7=E^*NfG>*fwsDp@CMxWozX);?wRax0;w zErWfQAl9j`Lf9|Q#P?)mSFBH0YfHW47lut~GI#EHd-YEd9s|s`J>V&|3|AP|O0}rU zk>sAvYj1nrSN=tUTIdJCRs6Z8q}0*8m7mkq6uY__!YYbjw-wA7@jWoz5H-#tPrsX3 zhcX&>BX;@nV18WT<;Je9Z>BF&=4>0*+eymW+Tix$xdz5hb+f>1)dzv!wMz3lB&*xq z7+9Vu^<>Xn<8gUg7BTM#1FHDAu)A3}qx=)0k(XNa#ikl}Rq@&*WO@3Sj-Z#l!N@p^ zxpGE>Q&7qNM^E)kVMHdQ=g=0{s;Kfg6nL+}9o5ltKm`sX@M-`(6T>YRkb%g8Yc>x^xwKlAFIJ9Wxii@^t@JKuzk6>5>&i!ay2#Lu!2GDcrQD^37Dvi<&$?`?dYY?5 z(ltxFQTs2aS6qW$3yfmh-c0fRnrhNbV%%_ok4e|79(I-LNTAS-`CqJ?g2hYXbONp;^X-cMckT!@{wv?8%yy2R{)rIt~82pl{)Kd@p0EeZOMk zaoC|naz=FFio?+s;{`O)Qq$>@8T{-8jdVSZC!u1pc3D&q1Vvp3JW|J;9q2{4HaG3;)gG@#ZMS#K+p(75!r-I*_L`wzCq==xgwm~ru(vfO zS%W<__9$p+H&IGpF-TqBR#6aWxLUyFp>63YM77rLs9X;63C&RN3(-+t=YNtYmA!K- z*{^$TG*I;-g)-t^vSq5uT(#p3Dz~?3D`AWiqTzO;L#J*Ulz|$g>W3E8LUEYy=Y8Kh zs3?i~<#(2|{{CL_l|VR*Fg%p58&2AePwW#TmYgxxF_IDXFe zE4?{z>z6h*`o4B0EqfhMGp|YK*-MGu5>$q%bx0Bo;k8nT^{(E`0 z7_$YErMTi7xT_D1AO9}$kqq-WU>zLUrNE>dS;`trwJf2TTGZ{n%HqqNvTV0%&5P%+ zNBRZ&swz{88HAJtevj9c=c0Ym>U}QN8++C^=y(bBaU>UvJapZlQqT3a%g^&UXu4px zP@Y%0a9xCo$ar4mT)R}~kFW3`C--3H63(E@*9)BwXs9H=a|goO>Eu;dui{bgafUwf z^g7q|hqQcPJyqW*?5nN(y3kWgolHjhTvM7u(z%4}r|%=@6jf zG&#_0I2zS_7shcg&r>{~YdUJL5%sVd#h&FQHsGX=z16_^UQ>Sxd+j2eIHt-<4&(hw zmzv8O6exbVl_qQENz(UZIWG*n$#VA#*-I45?pRdV`lawdW8of4?%8{%p|x6;h-wWM zU~Egz#f_C2E`g+_F}Rn@W8f%8%zB`XnQ=U8CpCvt<3YCf9Zus`E(Jg+W~SXPV5)sm zq_UG1{QZ3hvC}wk-%VFaeFuD~W^3_tjrP0scMT#UDH9LHIX2=Xdfd0J#b!t{JCi=^ zA$I?@BQZbHRRAZaZ{>B|rz?f%X+q)gwY*AA>I1-en)h}R%zQ1cJ09PNt+={`RNbOS z6JX$FTXaWV)neJcwpz5DE$r5o+;Qapb-B!6y?=+v_s9?@pkYpS3^BW6A(dGb5V34*mIB|K4=APk>YTVR zvnA6**oB2OdMw<2m_+%n<*P2PamH>crS@San#cVhu+kg-Rk{$cAmIAXV=I=qLhd9w zbSXOfCuW3>>QH1L&Q^n0qGs_Fc95Heg91v9XCyS6*IR?cLZWZz=d>%Ou3pq!{>aeb zr(!H2WrB<2m%R-IyU=3+thvmf+CejTuHZ%{-klNEJyK#uIupJ=+t@Wclm*FSX(v|Vs+R5 zUbo%O$QXLX4o!xp2Bb@3y#UY63$J-Z669|7LP&(!&MD+fr7TP`=QB|Y9hcm=Ft7;!J69}E(HuE5gdPn3KRt-P0MY5)JQ_SR8Rh3($3B1%Xj-D%J%B_Js= zga`Uc1q)~I+55Wh z`-)$&Rw-gfQ9_1{B_017Q*dh zc*mU!_VD0 z%QSm`n7i+qiXp~xfNiI)oPy;BH=X5XRj+~P0Yze|k|qen0aPfO_BMu`Ci;YmlP4)H z82-5`eC=VM5rUuhXMY=|E4_mCoE+bGUWnTgsdeZY&D!}C)Z9t+*qffIesU5iW~l^p zee6@P%@d<&GXQ|fxTiZ-a&vvs;+A%F{X3o@ZNPD^8sc$}Y75TZxmMu?2UwU~{q*8t zQU`lsg!x1WP@!uNe0Dg~&RgS_7ZGfDuM>j)k3?Y!ge%SCEHRr9g3c=ZciW&>YB^*c zs7*0HN^~fU!S**s;eTT^K}$}26=^wNNNfOv6XR&DE_!;y0 zH0`QY_$`j~W4%A+-L#HCy(8ETz$t@0Fy=eYb4yCC^sO3b&R~31k0FL8LBN?>>sjgO z#93ygrTA-7amcfdkB}3nF6-SOe8PL7nfAKN=Rh@WdG9(aQk-}96TU`QJ<*aoXy)=t z+!v-!;nG8{RPYiz9)1H^?mBXNxD&%2$(>+DHUw(c?I&sB*(TN&qCg|U+LO3X$l_PU zejR|-S?A~+n!+@bfJ{_>Z6zzcY``g=@CrdpYRbdYT0q#4=?_q=Em;=K`Aq(@=RBz{ z)xI4o;oEnXX7BUSH0Mq`kzFHpgxJCZvsvP0=yYym!%9||2zI}Tq=uA-(QjjJ)YE^q zn(HwFPItQP{0RinP}yg5tsc#7X>jnei+G9^ea?$K-(d3Au{=I%y0F;w%=isW`81A* zVvFh#0!o2O3n=9kC{YiW_Fn%qF1b!rl&Zw`AV{GsJ&7D1PS>H zjkTLZGe=oc$1-C#YiI}KBVHzXXRlG}OfX7$5Lo?m1kI&*ilPJm(=VjxgWJyWGE6Gv z(&_h(THcgWffN1@-=ygfIJdt5mk2)2&iGe@mF=7j>x@*#Lw5J~Nrs~-=JPj98N@+T z9P{TU?`tp%xqtK&HSKZ3ST+L8XAjj2ISt2enNH`An7|mF&M7yRuw8#}trD)erUMev zg`OInV&=vv!BBPbaMQu7pF7*=EM55v zpv?6=2P{P(<2i-fKLEJG#`2t8)T2+j;)&re_`uVY*#$q-#g&T$n?DBt!+KxhDG;>y zb~EF3vEAYRdPn+(A6Rnj(V9V_-gkXkcn4w$<^d@p=4|S8`iqpubMBG{x)UiD^6HtE zkdSbwbm)sePYPbF!pX!?G9C;_&}-(oenM*;_ShKni7`&%M1Zj6rTDXo;S!L!`Rx&B z2B?NuEl8yiUyLcLK>Q^LsY9EX{6IZAAB_8+MHeR)_HO9;>J!|tQ(2Du{fon7@9Q(x zGlB8fOiyf}E$-b}ivNNungmDfK|mos&+RJsJJ zas}YF`3@QveDAlzUyUsmf}C5b2Q7a1^*r%bv{V=*jaLkm0uekjBOyI?ej$q6%{MD zjXzYV>VvagQDusaCy(?TB^|($R5o--TZ-`|D8VdI!PsNHrs$0ve8#k()>mXp~O%DVQs^ulf4^!LOlMwu$!y?jt7&b`ybizoz-RVO69mWVjn z3LqDH{b6+6+*G3<3SPMJsq=0Ly|(UN6e+J?Kqn=r}TNs}(=_>md4wMPUAbjp** znKK^9eh95U)&}$a8bNr)6V4){Z(9|;i5`=GUUuE|+j;RFoB?$c&gfjs?YlY;a~TqB zk~HeUh>L0CtgdZ?ekcd&Hl{95avt{HKFMWoXQd~GX;&b@#khe&7f1`1PwSp;)<7np zJ=zqq*nP-wC5Q*_*}ihg1;Cckl+LId<|{o)DRj+^eV-!U33XS^8a8*;6w{wjO>C~@rulIr^&=&}?I%cwS*3?k!!^>E?9iHxA{0rx(Dfsmc$`NkFs&`UffX`E(*pNED z@QBz$yYYI(QZCs0>BihRT5SiOD6?#c|98lTqY75kCO0D$PE8+a6z}W^FilAx^xuZC zjAX`Q4^qv?5Fxs#*&|ixOjk^7m;DB^c}I*n*N`F*x`{%k^VS%fNEStEjJ@4|O z(t3{))M5I>ZFgL>6r_9dla5rd1eZTciKpM-fuaE3%sB5KSX@)jig+38jDm%9@q32R z0LLNAqgoZi3FZ{RE685k)~>*x?gnt2PIeReSU7S85lZu>r>J$eCEg$BJZgS)^H}zY zz&<3_koflE%gJBizo8Hh6tB6WIxE;x6ABJlMg78EbZVA6)kKv|n*dD98M^@X$vpb- z&+`BhVz{nPIKZ?2KE#nGc=S6^tT8(!7HAU@LW%%o0@&Ky%IQ<281#TMthH&yF>QIp zXWQSwXuc2(SG8;a2r!EK!fdHCM9vSRUG~wCSMo+#qDyl0C&B02{`E!82@|ejCEwLr z#$L_&B;>yzPtyceDHa?Y9-Py;h=!G-FdU1+D$?5%+xZ&}uc{5LDkL|L8A@l|wdQ65 z^AP7fO%IvWs(*V{pRo2mqlh}lu*gFJBy|DSf~1PU8@wM@LJNAp^S`0Cf+PXWZe>?P zPK|>@jM`ySb>#&06f*fUeY8Z1{3! z*wXxARPME0%K3)hVETq)qgH{EILP|?QHLz$gvg)L(e+5}z4CMhgGSJ$Dgv??53RnU z(P2^kK_=UjFM&j*KeY6{fxhjEKju(pEkGwdIb<6WVMDu3XmFo@bc94YU3+>MMa&Qc z;uJ_xfUEj!`t5#s;kc@WQsA-8c6v@mX{CSxiKUC|(pXMG!HH)diLBAo7dz`gZXYaK z(NyZ4o!~_ik4W#%@6>%5DdInWbpP(cNZIE-aGS63nnM*EwkJgeBtH&9waqWRHCs5L?f$S4^nIW3y zp+|`KwwxsEcx>|h4V&bh2TpxROkW&P@S5-Iz=#|6l#0@W)BD0bb5$&qGtZ zR9`te53xMCf*AN)&g}ojBQRDW))t|;P|t0#oy*bSo9ED#d;9i#lb^<31;gBP6Jod8 zoGA=^TI#VVOy^&Mo?|SAreo?Bsc8NRmYesd@tK!;>kK3q49&OfXCo2|m7o_n#pmi6 zgRTwG3vj$XQ(@Yf`TRE`I+)BRmTGqv` zrl73S@sAb!U0%Tz6w##eaAT85HATFtp1ol`GuI1inIFvSpB^s1LZtlcTa{!g{HE6* z_O$===61sSK$r)EH~6rLSE3bem8#-r?^rHf04@Nt1^}L+IZk@;l`OAm$0SBAhZXx* zKalA2#7A5^E3Gwc+f?(Xa(e){(3K^#v+e9JlKd-vREbZx$4e-9GU|8QX zNy8goIJEou^)Zcu)2EV<-C(AOp|(YmWxjFphSWhocWMK=Aao(4{Yl`Fx`=)dF#lF= zB9Yg~ey@QyGHD)G zb+izIu=Bo{kx~e8ZvAm#B=b)AjS)fak7#ld6stkO5pd@3AB>%Sc5>tfT9q)D&xtN2 zNhie~U1>d77SeR&r8=ksjmM$QqDzLO=Qi0wR_`_t1yuPQN3QjB_k&ft2U%DPKjl$( zxv=GZO^(Vw-gEVpP0`&C2Qx#szfl?kKTdjopV}r_Ry`YD0mEouPH$h9$EWBD22DD-eND{Rwp2dIjLb@mf2`K8CLO1J5$#Z~q*JkS3| zRXX8+nrJ1@>3>QOD?p%?zFo|rlBGV&jXbxs`;pGoBl7MX5Z>hR$|Q~_O$g8J9YN&F z+WS4O{1-xTw7~G%z^N%pjzq1hb ziPtfSb)#4`t+sNjGObKH&suCs@TN9l`-Ar=ltQ3<^`LrZ$fi&wWx{fDqNd-*1N1HD z)2_D6qsj@)SVw;YRe^Uvj$y&qa=6`|1IO=7Q7;&ua0!a1Xf?eAI+#H5_s0thWxWB4 zk1P;6lb``0dz0W6oRYc=AGjvH)ZC~VE%=F1Ir{Ai6}eP+i1njF(jnsQeZeW8*S%QF z>ubTFCvYLZ^q{_cA`B(c9HreZ^m@jU(jkCifgQut()kj=4W6=nWEw0yPAd&Yd?uI& zy-ylj>dp4oK;P$%lhIp2rjv)O0@#1_m8<2j-*{Vt$?T&;aTOsjz!GD{#T=z^UGVYA zKMQZV0qoAZs1h+GXg4@<>IJnYpWDGotJyax>Fbl2 zCrI6=y9puPv~e41)UX5(CZS{TF~>VhqQn zRKoxb*~HG>&l}T5pu~wfwe*b>M@9(py!$~Q9h9$t`?)5@wJXsgY2R-1A`_JeTZ(uX zKJL`k4<3YyS`~8s+K#W-%nnuX?-geb)w<9bKDKSiy0ZB`3cVUTt1j!i7}MbTn5yPv zu=Y3ZooVtnYuB(^@f@|;!#;kmE-ABq3m+RlPJLz0*|aCchcA2eq%vJqaZq*+brNqk zhr6=I61Q(wK|s>T)bBcn7*_=ydZF-hxQf2jXO|4iaKoZL5>V?R;@ri&Id^SnM*%@^ ziFf0L?(v3W@(Sms+L}4c_#U51@J2jdxPuUSlD|VD0bP~PVrP9S{t`BXD!+Dmv6ZEZ zNfhr=N6ODj>iJ|`HCqP1juZ>wRMHRR`r2U;o?l)Kz zNFMD6l>>xg6TqzpFFdzZ+j?PWlF1+%DFAOw^*hT1t$LQl22FJa5BwXbEYBiW=l86+)@JJH4e7RCgGnh;Q(yEGJrNPeO&@o|-W_2C5vDZXImpQL|9Jm$c&H|Y*kxw|+ zG^5QNwaF|SogbNa;b6HWTg6X&HoG1|l>(NZcbgp@nJokjr+gmZL$xeZ!(xSTxd6X|-VEO5*P+Q!aEM z+`;Xr4rA|ZD;6oWo%4)~+C83=69XyN-zAX!QLomE5rSF-C7hctiJL-&X3yb2^@i7y z$7SmgP4(~w(xr|Ko4ux`zry5)M*xcF-tE{K6xhU!Veq;6`a2~B8tcN{5}+k_yH93G z`1JWP4D?!q?2>^$NfbZyd@{dsq7ReHN`(x=YP+M!mCQqB2pD>UPX3g`7ssLW=WRd; zDCVopuJNSW&{1alvn+>ae=xYVEJQltiF7u44E5An~3Z#DcuLf}>>-CB8h^`)t%|7epRwQ$B;(sDZm5C7U<@xXB0TFDWoorQ_-C&1 zr~8OpOD@|+18B35j*zd5>=GPPin)F(P(|G?-(9TATki{Pa);GwIM1GB@t+q4KKvEm z^zH9P?I3G;h~8jwGpw2hxR<(l^UgPi36nH)X|0~C$8f9zZ*%HsKh<$ zHYSkcCHrfWO{yQ#yv{9AE|!0C-2pZngRS_RZ%8~#XV7jkXkD|~CX;$bcGPlDWban; z?=wJN2fYTkF=dY{gAo#pugl{sU*t6Ynejlu&ed7l+ZeX0FmJk><&{Zm+|f1Qm`K;| z#_a}MOHbkD{6VHlj8^GjvjM@{KZDIo!s=4l#DO0F?PBupJjxA0Mm*EHsgA<%i)6q0 z?9r}HD8-az-dXQ}&6fx^5zh&?l(mMdCOZ-R#R6n+4F$=H(q;^SmKiG70W;cqJ(tr` zWJ75U)OOiA{MNSdx43w%huij;)5g@jjeSBkaoGwj>o)JN- z<#SIFAr%R77hu1GYyYGoza!HOsKxa@An5G*gray_L`S)n9?&ZAFPcTklJfjH0~8Da z2DuLeeVE;$WGA8K#Zx1g5CCB_AZ#Nt?Ez0EWD@c-x53OYX2!ku5Vhs32LRz zEA`XLtE#p#I0d8K*mE~bY#N|QM?;zQh1GwRpX&}O<)O=G>UK{+-j&j5LXpSZ@OPyz z_P}h2iq_~8>D#}fE#6xIimr0c=3PyJddfXlogckGt}8xqo|U#U;FKO6OQU7qkPx>X zvQME`!<0=j$hHF&Ui@61QG6%DnUWkiv*Ph<5C}*x@GIGzJf_6ht4>cS!-+gEZQQ~B z=0HQXD*Yy)2Le0r1Z#uo^;4G4H4|InGSptnop8UGTfrh(%R6Z4Vzc{Zst zr@Bn^^W0P+&zvpL#~mp>1IBe94WdM&2?QqoVghiBc`AMb`2@SAC3l#~nKK*_UG%qs z$7VSVZS9^k&P!Y262*6znqV1@A=QdgNr|u)hpE)|U#;PL?cEujcwhdVG;!qz6ioRA z9e^<`i5qE)L;rm=x^}IaV?f#JlAx&f1|s!1C9kDPx6_zHUe)c-dTY`5H1Xnk@P0Y8 zd`NU<1+-I(Q{oUZtGFl~{zXXmnNKB{oZj+}t5@Npc^`P7S;iCWH7uQiJ z8t0cDkUfCb!58k`qcy1bbmQ)aTEwlZD-0jOT9^5pq1C37x9)a)00b5td8oe#nr;hB zEpRt7af{=q+@cRB&)<|~Kkm~BpgXl#C_}fgr z_B#)@2^Fh^0~9{R-+>#bKcvL`Y9XP~Zm;#0R;ee~m&lP<*6@T9f9p5n<)f*|m(qba z`-)0aoroHyG&i8b+aJq)0Ez4LfBEA?;5Nqr7@#~#0xGWjE9#+=hClL1wrv&B&z}6z zQ-1c?=ur~4@yzXcG7rrn< z{m(^lsRZ%Sz+CMv7dq5%jOvZ{wL!+{fZeRuoJw!?{J&dvWySS+6E4{kY^aVM`U>4u z6g4&G8skShZT^>9B^8t>CMx^T2HXRDZ_BAR zQ83;GI9oaz!WYsDKmssW416X!-rT=0{VWh%`k9syGq{S+I6b(ufb6gxRtAA#3&%&Z z+r$AH-ZS>hDrW4tlApc9=BSZrL(XlS0G zhhTkz#d!BWZsR|HY(vlGA41^M zMVL-txcmj__dnj~|9ItpzutfSpX(s-eO?p)Km6M>A@$V*d5Y{&fq7B4_|@mUIpbof8tm0WG-@_`LG*;n5NO$M$qZb$bsE%y_m4 z{6SIqh6a>BS5yS6ssF=^YGUMu&<`NUV6JJ;jrw3bn_o3lLRQv5QlgDAmtqck+Rylj zRcyQJEUp~1AY`jSK_;j~-699J$`+{wAWN=|a(OgMjR)q6;K2XUC*<+s-;c{j1al#M z3JmU36FLEJrvMmtM^of!(|*7k--$j)scqu@x@x&Oxf#=jACOdod-k7j)_`pOHGey~wYsTyKw_RV%-xLC{982*D!Qpkc#B~OIKitkAZC>KE4Zpqr zvxr-n^cs+;D+XesW_~*AgTTIwFwRg+99;lqI_he_c;RygBk-urs}0zOo$p<6GI?}B zuVfOPwxwI;4TBtrJ%0dMw$hE%4$YdM5%`)JLk@ZdWv0q@3$Zi9EPp@C7 zGkS>w${8z|r7Iiwmdm1MfQznG0QZ~^Gy)7VxC)nnl{VfH`11Y=?0^8fc$xeDBj@`2 z%$qGc>okL8zt|G@X6hU8{?&nDcY06zpx1Hb$W@kGy;5o+vVnEFv8X&tX(;Y|3y`w1 zSyfZ1;gzRLp+!LQjq~IRC5CV8dB64tV`x4~4XA0^q-2{30^vq47)l-a?KBF>`_xOM z#GZlTfaJ*{>h0s)PkwrW`OTt-wss=W>(F$+Z&-Ak79g?k=xx%*VR_vCGv}(is(a75 zNv$z5#sC0ueP)b}ooDK@8MI7adajAiD})bXY+xGcy8!xp66U(RS*n|vCFVK*cV z#=Gsz)CzTI>3vy18@CowGFM{#+M;rI*18ysqQ=@CA7GWwg%LA zvLj}Wn!|2@CG3kn+%7H;Y4q9;EtTNG+^bMegW=urlSCK%!1I6st|iGrsqTw1C@0`s zPT_ zW~xsg-0L(=ahVNzXWA|++5kFtes@V<(-W%_%3%W2nPB#pylFkGPW0`#t5hJ}eP?!= z9R$j$S#MwGFxh*{vU7Ky!@d}0w|%~vQ>LncQi}DS&|d;K^UVW zWD`gz(tjuv385!6z_ARFE6N-oNf`>BOiLN$t#E*9N^J9Q*pZ=$pEm$Fi!v^q_-_j| z#oqmSltmn{eBSfJt|ZgI0PmnA#(RWkZ6-Ij*NiR$KT&0p}kH#h7IJ7h(PPb34E>Qc-2| z5g}LczA$_mfmsX+2y6+FzlVwjW^3^VSOF=g^(aU6o)9@C&Zide?e!4)*VS_=ih7uw*aMhDf^hI_&CP1%nZ#%G8Yt_NG!kT z1ei$63gr#Uw0_0(N6_DjJijwqky)?qbNfEVs1LWWZ+Lq4<%ZLec4ut>hnfV+)Xuf4 z&z;VZdw4p-=%u>o@XL&vX)CsBFcuEX)nxc`(0T{oKhpT8F2D05%tKS*38!f^A?}d7 zqa3ooLHj(J9Cs4bW+MAKx(lG8d+`mw6cn^mqh4^i(M zFe^kK{H&btpQH}5=j|H=cy9zYtNZ&=rFD$qK%gH!`YK&-!fnFy1?3`iW*F!Xblax@ z^fcBapyUYi{}HzsO5Yo51wRy^#7P2h<%Nd3@_>>cXEpE+MofGt19O-_5pc{w#4yWm z=5Maj>Iac^xufPc3Gwmp^Cs<8BTteWcpO(eQY3AA_Gof=;%E5_FOTAC&+LS+WH4ye z1ZJiVo0!q3>ST*{-ZGT8<08xjoU2LSu6Op;N=(gw!7bn0g~8usnMq5i|kwzSdx&&U|iH3Wet zYJ7vQkh@7f34&kDMX@T(Qd`}(eB_K_5$Odv>^be3BZu9q_{&mUz8K{+?g#UOLF__rrKX*R=cq_q80HTuUw zR;O<*7urhS=d3gOQe$wazLvButyh)BQ8U?Ygg)xct&zO)X&A_xnk}^-a)Pkh0m*5- z8`&SNaeoaBr`$hz7B>mUa2igjse7UDcPbMDS=)9q)P1=n@t06H_Ga*#?#oJL9Womr zrW(QPv z6hR$ALlkab|0{3i%AC{3P;Q+>M8C}Rizl6l{LFq>(x|Mr>ko#YcUolb961w?{CP=O zI;$Nuuu+?en?7`Z{18cOH0Xrhr*4)cE|j&kU{Ha(J#c>IHsS-#FgfoQlm zC~qyirT^$<3^LFs?QQ~S6pxd%^fd6nv)Hj21a7~@_SjTrlU0pCTeLcUf>z211X&L*Gq+u17o|1KedZ2F)=+d|3TC}b7cWh!lPA#rVVXAY4x`B8E_=M3n9diP znt5feMd^Vm3dGUitI#vURLU$1_Y)pxN$`(BB*}iTl8Tf0hJ`jQkM?Z)+5>k57PoCaa7BOHcU9~yw;1PY4$a5Qq%*% z9?12;JJ4M$4 zhPyFPBOEmA?9eq!vqh%{lyUrv76|lRd^Tsh_MR3+1(5)+R64#R)3K_zYSS-r*mIxG*z-cJ6SYmk0h2h?r7FpwkvaP z#yHPk%$-y{-NzngiZ#@Be2nY7S*veJyoYi5ffJa^GZ$gLOYG1WWU zlq)$71NS{Zlb7S5Fl5;Tk5%{E7%*8jhu=n4*K2GU|qoB>r1y|(+|xBbA=`J#{9H>e$UygwC~guHUwT(3Vn^k zhSKXIJ$(+e95A|e^e5+H?*|xg`$BkB{TC8Aic`LlqPGsyMpJM0M0y=&?GgH$q8t|0 z)JU&30n{u9pwh_)n2hnN!z_2Q?fwLuts}T?tuTht@5m6`)&hEsdZ{mJFH|AcbJg1G zs2YdI`4BsG|Kn{2g+1Ju)AY%-3Vhq|^N>cDHl*F>8yy!Fs_q4_+2EZ-TmwuWn^9=9 zQ1N!FVXL@R8DQ0#>x=0lUvsB5fj*+tWLquD4^ArMeK~15u&ncbG|XEDs)=TMn_F<) z@q0oGm!SB|xAR22$=Gme((e5ACkH$dDe=v?D14D5Jx7wqy;VXBhz;pXHTx=HH=QFZ zut?r9#MSDv3kUR-MDxRcwND;}NydF_1=TiHp{_4j9U=s|Z<#kiok=U+;duFu;ep#+ zyzRTzZSJgmWJwt>1D#j??`x@}UUoK$}110#d=Y4bH9c51y1eiCuiIA{S zcBv#E?n{kPsRrpFJluCg)ZW#@?mEo!7XFr>o(w!qE&VwwFIwoUJtx}9htKeI5CK~z zygmD3CaNE6ev$sN9m-za~8MdlBW~NTCl?_TlF0d%7jA zaRIE@wuiP}m`PFK&tz8^po^k?edfhT{q_0L4eeAF7$ewv5RPHVsC6&Y1C6P>jC!dT z24cRE!jqu3v|E>&ddnIA2c?$t;u5qCa+n(MMfM42{C&BjMBxa&1<*k#?>PYy0aQPX zL#NZ&5_2PYD?(gQ3BTtl&v=JNwavNCiTpXXW2R|eCg@tY`(TbHR{YwS)b3+IP15_= zjpxi;OfHPYNmbB!e2qH-bGnFcf9tcWb6w9W>k!jja{(=1b{SUXe1wbOq>*2Qi^ngw zG|%87XXa_~j-%8r0E`gXE5EY@RTX@=)g9tBc4wxz+yVv(izk^xPtlp@n)Wu!F_y>@ z)~5=8>!s~kF?d9H?z*SqE^r8f*TX^`g5pZS;l%_zSqtYul5w5E&NqW9$@hP&IZ% z7_^QG<~4%xdctuyR5u#M6opWWdc_IrYm0f$U#e<5>V{KwJtz(xJtaj!PUtZ_q~QUn z^NXK_9W(~aZ#J+8PemrW3b7;qfOPUH^!3*fbU{PyJPs*MV?ra(;*LYj2hQkj0590& zl!jn>H>62%mJT!~*oyS0j_6Bnls?jVuo(L`m@p#v+hmmA@_Rlvn6-+|d{9pb#e8HG1qQ+l| zo>{&5Qz`8zxOUq9#O^PID`l{S5DY z-H;d^2@cW-=8AZ6+}tZZHF1u~FZDw8q})>bYcmYsuNxkBVi>4R2bMu3x?;rUWSz0% z+&4jh`+w&BM}QM!Xm1}3T^C~LE^lbp=MfkRGl=)qJJm1h%G^r*1Nf^RAe3z*-^zB6 zQT5f^r!x#fD{uO;`n~4ZoTmBL&O%E~J;G?3Kjm?BJ|x8m`}E|PZwW(1;$n-hgXsYR z=l1bEC%Qz|&b4Uy?U7|?n++n>2{F<) z!T3QVHneH_DlJ#rc6Z!uEF|6l(#uQy;l`Dm3thSluX=VSFu|{aw{tr|5Dk2-qCLh)L&9dV%EHEkzLr?dg4UxHkW_@n-T}`pNp=LWV z;|itadO+d~TD5h+j}hVa`*h&rXGsHl-phMC@I=<0H;n6{*BEHN6xaOzpd%c3r5vinRnJPD)Lt}NQE;t0Lsl20Kg;TAcg6cUh;x;$dUE<};ZGkX6zS#EP zYTP7DRDp}+E(5}A{+_gq3m1SIlTUOnMFl=+2-*nbK*?P-!Gkq{k_Z1glP=X504tjN z8rdqL51}mCiGYZB8+GEM55)|>#>u%UXgKIk?BkAk8?$Z>CKOo!3ig}UD#hPZy9jgf zb(!f82L|4Z{CW2)kI8$Du{Fs(6b0eZj@kJ|rIwR-p4D+vv5N8A6X>SW&`X|JGj~BI)`fEdm2s zj?(ftEb*PP9n&bLK>-Wx4W1~!LpI^2W_r>nt6JqjY7iGyMKt)YJ5$O;?BZ+R>-n#S z>m353P?SXjw;6?LhtO89k@Mpn8G122{LQ^Oowqc$hO&G*76Y$?GH94%eY{ekM+)ZS zF1?3oIvaaBP;`&OoT`|CTL@gvxEY(C0D8&cL2MZ_|%wptno(y>GOQ;9w4O;#&dLh(3 zc0??uIebZXU|qh7@~->^wCT!Zz9@#!=R}O3TMu84vZRW;v4ftXe4Wb^%9Hl9YHHqB z3-0Y1JHEA#rq9PfDOI+zP|==BM}12ENV;#>W-Tdx$I25uQ9mv!+()HxN2D}FKs$No z$w}sxT#wI-N^SPIg)vYt!xA5)S_f6r9vh&VpMN_pucRdJ%_wr(2CBiRV@E8JN`QhG z5S7>+f}1R^_(90QUqj&KtwmKfdY!9T4RIFsm=V9USAGwhT{ac1@_ zNYsw1l44~{43cF6g`r`mUMCU2X^Zk-MM1{h%OmuLAC8uDNE! z_{w6PaMhyQ-2R+o)mtECzX($a+7v^g7ORqMF+Sf_FbRAI7jc=DcA4mNjs(3E1sS#Thm+n)xR~!JJg$ZGf~!-ReP=I%7>N%ud?c_a?QnnqF!d z_FhZIpv?t-RALv<(gY1t6=9Omd1`v0iuk3>)kX5m>qnQe*>CvXw*l%tXxf&E=OIXD zhrd4jNutXXGkyoU zXXkOn_H6fLluRC`n%rjCj_8WL^~*!K_WY2tWL9x^j{Bo#vedoJw2>@W%MBh$6^Yq} zUmJ6&DC3;okYyxGO;a5;T56|VnNL40@&~K!$D7z{Wet;{E;xs4m%u)%1)dwxJ<)`6 zh;$1SCIxNo<1g7Eg94G1lV=Ow4XLAVcP(2#-M&W!>nB;{(m!1Nd=!tl2Xm!V>I+Hw zAbzeo;o4Q6-)qvQt7{Stt+JVwM%V7=>!bjNQfFf07mt*#b|6n@-=$hcS{pP(9uZnV z_2uB}V|AO>vjXve9j0rp{~r0i^3z8ta<_b2P&a6dPyv3-khy#;fj%8q3sF5m^r z()}j?aKf1;g}G1n`NBT>2FZ$#k#y_ponpp#4*wvGG~1DVaOCyPxcfprABVn3n(!1ZCHO(Wp_Z}1F}xWg7kFa-o_EFxFhx8= z=EIUkzI!I#SzZj1xHLY!6T@zE`y41}$-u8bV^Nr+XKYX8{+}@!8u3XW-_}tf=Qd*^ z!5!3^lKivpO4p;WrkAZB|9Qg`v}a(!)ZD^@mDKoAkk5pPk?WH$1Bwp5#x=p|qvgVp zknm&vJ_1@UCK@sufqof#!UoxyiZjktEZIKRKRIs%A%NWX?y9eY8R6#9!GZWf04r(O z`r~A6RZ%0!>3>N7I&Kv;@{M6df5g4^!%@&rXVkC%OQD$(60W`GHVap&`b_EZMH`dJ zT-e>y|1|SgHd8~S$Ziq-{#3*#mhmqQcr5z+)a_IXh(4ijlia>o>?tZQb*5N9geH2q zK+KbEFW~QQEL)QP)COcd>WmL~MIijcr$4yCvjV()|7Pg3ZW5{iOFYEA#>>XXo$WIwspt*QRwN%p;YsX>+Y0)#=0{q z*29(&j)si`bLhv$PKLp3c={~$b&vHQ`D8Ht6DXlZ;$vw#l%XUk$r_p=Onilz`>cZc z6>qQ9!!SmiwBWPmsuO1*k~&nSHSGxd6a{&QBwua#_)Ea&q4Ee0wGcN6qcFrQ^?7W) z4eOK`0e;_F$eu4&1K^T`OYHdQZUVoKCzqZVGxHG=I~(p~u7c`2%_9-P=Aub=Kwu9A z5|!j+)NcvJW|lnWpT+!jexLoDqy^<-0GUCsJkkq)G!h`x_~y$YtBI2PlZ*Q@i%&t%Y{*|y3~$GHL_<)xp9$u-Wvzk^eejb~B0){I0t4C3_=OlNbbf(mn3N2Q z)Xc&n@i}>|73eD~l3rpv-i5i2;+at<@)sE=#Xn%pWR(t)Q)Hof(8d1=)9aCNHASKU zL7N=0stOfVi)th!?;5Y`HQ|$2j538XYN{xl+STgQ7A%MnLWsK(8+okx8%V4a8i~j? z`r(TUO*n-`BsrHv=cc%5n~t#^5es2=^tOgLjHX5=U>JVn#sHUgHWuOU=`kzE3ao!H zw#$#Cy&BWOp^$>Rx8s58=c#X!ggk=4?DEwl&1?Fv`^zg_ZhZeXLTLY3t)T z7hEtBJ>)~39W$1jyT5=sN)6LOEdTrOl|lj4HH!<6h5`j@BV zPy>Est}F-jj^994q&BLmdh7Z(EfW;r9G3@xl41oS#FeI&&iCKl&lu|p-`$a*{T=I0 zDDz`QfAWe&`B#Y9m(roBPWhrLm&P;~0Yk-~Y^z9ayGzg@%twidhjf9_`b*qhu8ox3 z4x@37-3flk>~$(8brFg)fQ=+=uIaeMu|8*v_+x;cbNs#F&CZV~%*T()yWa9*crod_ z6XZ9>Sz2vb;J;1znx4|yrp!-${-RurhX4a5ieKb3*>iXBof%>=0SXE zXuZ25Fj^48CC_fq%U+{jFQ@UJaOYVfIs5!b-F^aE-F}~6CSK&-+>bU7F{(*^%7~V8 zr#CNZ79(Nqv$V>eTs@E@`o)owWxKo|Wb?vplCDtWt6yL)`2I!JKZ7s-4G`}tyn=cC zBGHkuKFMGwJVg{pd*^sRVMjCfxoVNi{h-Dkn4D1Rj3I_LX5u^In)16T< z>Rt2JsjPcd<%;bXzK^Dji6XvxM-y{!SOLtjVC1)Nv!LXbx*b;hy~r&i(p7I^N~Zoq zQIs)t+lJg|WEYGa75N7Od|$JbRJ~m4!V#30xgSNOp=Skj0K&~J0LqDPz6neaaUA>6 zKX)6je~x>0p>8T6xQ*hmA-#x*JH)osBa@Xifw`XHY3Th^Np2iv%JQPe~1gb?RCdoTJtED}8QU}qUqzL0Ni=ss1f)G*CykYac73x|;NJ^+1^o4`nJ zEfs*vLgBL)pP^G#SI$oui(gK!=UmukBRE@beiVx4&eZ#h@lE&k{q7LGsmj z2rC`(r__Cpcd&8RZ@zhoiGp3FKl8OWA8w{|*grHA=Tny#o{}n8*#5sbd+V^Ox3}F_ z0i~p+OF}@Al1T|n8l*v#PLT#F=@JQP7J_txbV@hU-Q6KMsYx>t++(`d`knVZ*SpWP z_xaOxEoJikjycA7p69+lH%1bn^ZY~Z>;#LDSnJ13#{(QNyO-MHnTv0#&J1OchsKS6 zk`Q8rux}4ok5w{z#e%2uR31@LlCcP4MD2t-8a_7lr~e!c@rLd;MnXF@1l!24=};#q zxlXc-RPp7+ysEDGtc7UoTJL5Ux+RW0CBz?J+XY1+kA?4#h%-g%Ex(~>?ghvS2Cn6X ztYGY)>J~-rDNZy(X_jm7Iy-hOj-iq2*PP6VSCz2l-GWLNP*9LG;~RD_xB`VzUr3i3 z4#UTG^LU?a+Nu7TcT#S_yzrhm928Ht#w`A;XBYhR`?bIW^HQhOr<}d|Ucr3S^{t}R zVwJ+Uu?(d=wxfHkP0gZuu=CnTq`NKliSKgeRixJSBdFUg;`&h;`|t7Y!X#r?A1Z%-Qb?DlKcVVwH^HWp&U40pr64d~oFDv39GUgr;8qIJRBoNlbv1me5J1M$Bjs%8!pgx%B9vU26v^$Tn~9@ChJR#~}A(kcoJ0 z(FWDJ+Wl(Aeq^1w5IVsus8lmY0JruT{Cq?be|;&YiJdr}E`>A4zfaVVCxO2U)LFSP z@$u%*j5D!B9`d3Q;ZO)jK5qCF%fJ7~Fg-x?kzqMdSZ&KBXkajhJegFng8>1nI==VE zbDCd|_L6g|Al#!g9(roV84&l)a?&W z&{)$89Ibp{;9Xj2)eKY@(&-Pm!R!biku26iKNSyM*&fZ>H&5`!V4M3?_m+K(vy$6j zz*Un6m{XCbgNfM%pW(zNCe18L5`IS))u8isgU!Cwxi2ojxV4acbV|r6tlT|!N;d}G zoz-MAN0V?i$i${ae!!8|mlM@3uTwhc9KjSBSs~C2bm3EQ269c&f&!{j2TIz+Df(!9!SLvJUVb>RprJp}WLIsqfLeB^w z<(6ipS06NgX)`MQqNcrYb5pjQhi-2>C%&0)h%C>V*L;0-3$i(8GR}CPP*eHWfgpu1 zG-n^krb;e11Tg$oINuo9KXdWf@CJs7cuSQ11;k1SW_E5N#)MwK-Clfw7M>6-M*gSY zs8SD+0?v^lbaZG`mmK!ZW8y~T)E4>M+(-eN(jgJOuq5b_LV=*mb5AKP?JYKb3ULbm48C3^Tiv4 zTPOt+<5aKD9?BRiHif30#v|Spl)g;PFQ121z{~9WGG`*pTGGyybo1!h^rMcDK_-yG zYd_jwqO&;+KzTZ@(m)7#W;AwxKNO$+jw3pytygbd>o_}KgHVOtcku7#HmPNYKManJ zZ7#H1+rjEJ9rIo3VM?+lyfyqz6jsb-+~seoDs~rb=h0syKTUhUQX|GvZjB+LQjnPu z_pE*reCT!Pk)dA4`L=5rSb_;GxhtxEzmq)Vi)K`dV} zC-2M?#BJ%*FburMz){vnWit~U@yV6gI65 zBA$b_MDXpIuc-(q_4Fxxk1)A@aU&eBp>5wuOuT!AELRiZZ`Rhdm1Y$Zjx1ghfi zz7!~<7UCmJuOhn9Q?$~GkfV-Xvoiv_QReP^yK?CF@k$<<`PJ%{msEny94)ZM>&$VN z`acV^-9_Ik8*hIZ==go!j|ELHQ(Zc8mSX&Ph|zrUxZ6RQWAMd>HyFK;(J@gm_CJqI zP`aB22^O8Lde9w_FYd|0tVx4XN`(9C;eO>4y@hp7<-`iNb6yS+HfY-ja@#q&ty zj1M$|LI>DFJ4R2PVA@r`KZKjTx}EPbhWE-}luI80am}{E(`(*Ve88f~;nd|Cy$R^3!6^?MGI(D<={6*B+3)^w!iH<#cJo8QXm2e!&|-_s5v zWoz6c5-&^>?7Ntpr=!d5Am+@38m!BlE+C;SQAzpO#mUxz9w+*HXv)O@$Y$K{MffF; ze6*<0`^oD@qTV;-XIJ{8%|khNKRJxNz6N`DpsC?9aHou%vJPO{fc?yL=mA@emUtaF zy%o(=ee?n4mm1kC4HPoB4PXKY1-77(k9qLMpI_v~TX+KkT;K{;fvsezaXGg%mD-ky z@$nin7Kn5;A3pEmai6a7wI&_pA^!f!YXaZ3%F57^jIkxNT0ykk%8TkS>VpwOxi|P^ zKq~3lGwAICP)8ago)K9SHKbAUlXWZKds>+JLm@^OEZ1_;5rk_&@W^Q08 zdam5e!jh3X;?G)61DPi|nee{7l)9fjyT4X;-Ia78hrBq8$Jg5;dg}@Pib<}|ntJ4I zGsC|06>|g{wR8gewRi9m>C*;|aZfhbHRyO4R_2UF)@Vnma7$}Y@ePX*KG=BQy z44jE+()ZIvIBTm&EMJUOVG4Pz_;$j;Sd{p-to$CE!pJie9BKUB@dKb6$K`Q0;*#Ve z_GRiz**AZ>Bnv&4m(6>P?e}pWgdv+My=xD9aN&xt9Hk?K$oe`IgcCN zVinTGFdq{>b6Wo|3xJ)Mwe`c0BZz>ECRmYJ8UkUPRY1Cv)R}t&MY|UgA6&D%!|IJe zaM!pv94|+DZOBye?E=f%p6iJ2q<<*(s!=p{j#q{kZ?9Mu(ZF4EQXhlQHLI3s+e%|S zvC`{c^RlGz<<%T3~&b; zF8RE?`km^f5cS!%ZONfFU1XabNGmuIv1#e|O0=uIlg;(VLT+9`FlYZkn)wMVw9^p& zc&BM`PfoYU7dSYXb7Ez$1cf*XyvC+tg3j`Jb2mbj6pepr=l%}M?Ywr!xZIA0smA=O zF22{cTg;`gxSOW>U;b2o~S@g)=2L;97h1upLybrNLt zymT)w?UnvJw)S!cZ2>!1f=!xzi3Vgm zQ6EGrH+DodT+`h*Zs`NL$yWmdkNf>XGpzTQ$zgp+p=^d>nT;GNI{i9{CxQZZ0PpW^ zFvPF5a?q3MH!Ei+nxYH>ojYLh0}$muPxAp~b(l!Mad$t_ki-k5;Yi(Km0K`EQSBg< zE!1%Q{d$a44q!p0YFX5|26pZg6qXbqC*(&R_sE2*t7$yO2Rbhh;uMN84U5uaoE7Uc zkZ+ySt9x+}!ci-OA4E*twzC^#Z>(r=U+GIMa(;gwUuDG_YedF_4rHWgaU+X|Wa?|&!6 z~gl0cPz`3&ScBXPR$B}@hrDnbB<{Z(p z)E?Yjak%g5_Up06FJ)Rs?Q2e#s5+As)Vs*(ffIpwIDq4#w!O>0wWx4%;?_L#(#g78Ne0x=)Csb_`RIO5W0q_d@1vdnEna&9lZ^7O3PLp5gYZVPxg^$kcsBp zG{uDHQXXzMgkZ;6)DRRWnc;9!-zd0wMG2SGzrE}h2^8V939SW({g@=GME;Xi))Q5D zYqq~LXMX6Qvq!n6WVEI(f7euN*7($PZmPSS7ubps)mx?bYd_+_Dtka;&skiuIFcbz zHLVM1ANK2?Edmm`~IEpz-XuV%t~2H!sy^O^aR`|-2=jw3-K=l-<365rHN3z=1#;W zT@@Ol+mH3#OJh|zit6^fcR)5Wu3MDJg^ByOp=hOlI_c~v#RO{=JSca+0I`@0F}d{} zu=gwk27-_?zK1cKcVp49Z-Mo)+kd4}g5U?Pb;L60Qg1fZZh?4vRZTPt4M|RXd!(M? zCZw&6(MD}t(z10NEw$u3JUZ=HhxJ=GjFY_lq%|kxTLO3lGU1ebLmyE#)%A+?n92!LkrCBwl_TP-l$^|7V3fy-!S!Ph za7rve7B<$6mQVG{owaW%Se=*lE57Kak0%|6t?8=4P3##&Hu-BXQbI)~@09#iU0c>; zkl6B=C+lvTq+6JeweF`UAhUzDw5VyRw7U0+c?>w6(Ft3Ed5y4ze!P=Z!=<>a^Z??u zNx^LM*HHUjdS2_Zz~ZrW8rw zQd`GSf@g8~{YBs%DRS%j)?#)a23l~hM@Zr}fuP*~=ngur{Qw|p^i3VboGa1XWW0|73t=@@ER94RZP$z zDowA2i)7oykg&@cx?MT`dHKz6a^>l1ulXsA=Hs0#WoJcJ$cEMDx)+t3xdP@FosF3x zRt%Bfmx`7;02C2$-q4y-o|NY%O5y9Eb zj9n}W8IHfm1=zGZXJ_Cxci^gqR)R|K;JN+iCVq{MlK&GNHhLk`Uv2zPCBK-LVo64) zyD1NZpuw9Z{O^4N)$drx=uMcpz>`xP!Lj!Z`=(I+fe~7oPg;b z!KFU1gSNe8a`*jOh}M}XgotVEnQ54!kYN=79;4+MS4%7sioqjXos;QrUpR7}X2g4J zA3yXR5ryDLLs_-=QC2e7(^DEj%^1Zm^&X6w5CR~+J^s+Rh}dXM6m5$k%?sE>P(}ma zuKDV7WswI*e_)tn^`nyrjK7c^xBpo7V#p*B+Lzah&_b7~B(LPwyO8W*!OzH!V3fMU zE!y&JJ>$VR)#k2qqWL)e0BLYU{hvVi)4vXYmY5(o+S%_aHwV?Jifu^4ATCCv$OLk~ zHdc?Jw&bK4fj_J6BM(C!{qVt7haj%I}5G;Ff7w?>VI$_rcP=5Ck@vB$5e!NS*(*#o-OdR_osQ zn9Wo=as~=R$YI}VZ-k5P$uB|Zqq|O5X)njml1X59lXCs*et><4sz=N!`d$Y?#&1!7 zKb$~!_8_Eque)}KVwj%}LM%^P@5o8z;;R8B*B!OtrmB8RA*?iCUp7jKS*GPE4eO}h_g}dlf z_(8n65ozYkkeyFjsSjl!xr|IO3T1<68I1QcZKy1$6Z@baBa9y&c9-clT(J_slkYhk zi*PMBqn5KwoS{wEK2jPzylxwJs^goC0NAe%ZtauZHF8CpT|GThJ5T!{UdGLz;;Yuy z&W7#!mFd!RWNV_Xg2kn2aw#GPLd*4dLDRgNRWhpImaq%#>%( zbKYUXzlBqit)JF(C>Z3IGqB>lNeiChk%-K(0%tnjy|&g`0|2D=1G{@E11_1J1#a8% zONrditehP)FY9|+h{ob5NNdh) zF+`e@`SmG13!eK3FW2FnREL5}<7UQ9c2w)lErD#CEoI2_&89Ec3r>mb{TLk$C24gZ zCxQ&Q6;+k+!=j@P?jn97Z-{Mnlf!iHVm8)L++CHGF7G>h;w@6k({WB|N$GDw#uKK0~x2806hbL8%;Q|=1_*d~I%crR`!-ZOXv%e2H{nK00)R{R$_vR|6 zF$_bp;!&+*i_5zxsO?n_cd=+miPt2w5ZU8SzY{brcCp}BiQ}82DHjWX24<4BXXVAH z9sFVrV~)_jdOuv=KO=I?rX&pCK#xYg6a)Of(>n-QeNzLCAS4BW`F1^q&up$R;OpcWuwV+|1VUhgi z+7%yqy*Nj05Co-B?SMW&G?KRRk?!)%`ReQ?lyI{{QNV+J@73iZPbxd;cKTncn3lNh zG*8K-PnwWlWfN6eYPbvreDEv|?3t7NwPpYV8~V zhZ!+wBdB-D2a42*i_T>GY=yN$(?v52cKhJm;a-MHe6edIb?6zl>bJ#=P8MQKJiIyf zj?d2;o?Yb3sRH7c+09<0YYtBeKX+~z6BPX0o;&BdKSP@DYVX$Xcjy}Wzvm3-s|8kg z2o?JAu_vgyKBKI>(2vDWD=p7bXb$P328c2=k(8EfR{y#5uROzI(NXd095L+vEkHPS zFu~|G{6pyvu*~??(g{Qfk$r-6;#(Imj^?(fKjBuC&%}A|Zwtu7)_oY_^-lMUJhL$q z^}a?8we%zM$4~7$8}BRd=~ZiKa1O5LW<{HelS{}Ot7{|3D^;MN=P%nE&q)L2t-{Ck6Cghc^n1ZppXwjFlE*P5{P< zLOD)|1pL2XfkCHb*!z2!Q{dGqW`hBhV0o>7SbJ2bPq|VLeB>QjNB^=AMA^`CzTRb; z#Pkz9(;7vW8bfAm)At5*>i%p_;>)yA5kYn1A8nm^8TJKAePJVRtkF4|B99UqAa8bV4p9G z;KMTLO%(q``$~vo5NxB@@+4_dj_j@+@6lIt*u)RLhRn2@MLeHNiEG|z4(&B$^PT$K zI5R(+p&5hq>FE1!xIoX;L-r-WeySn@uLEVbky5^3WFI+r_rFUMQFX3K=%WR33RvGk z(z|>n>?7gom2^)DW>mj(Ex@Vnk|_g(mdj%lv!_nM>$5Ycr2qbTHzeJn7-VG0~{ zYLA6^jkK0Iqa1`REPeqG3f`6>(!fN#YxRXl%>6Nw(FBqQ5UcCZo6Qnc1_GfAkO>g} zHvr@iHt=}BkC2AeV(p})@1 zr|{ZEC=xwAJS$ZfFp{xsURdBhoBJ7q0ei}|m@UZyNtOHwEgq7l2g0*;ozkgu&^&>t ze!n8FR`ue@-TG?%ad&=9W7=s+2HC9zlMMS^Pzt?vxMU;ZCJL_?&b7jM0v&Gqk_ha+q}ZG1=woQ3Ao&TvyZ*Sii+mXzITlo`C! zP9vyIyK8Qolk2@>Jw9->-W!5L)-K#kkpI!`&_p<{oyF*S${uvdN%xCCIEiUQL3XEx z>6d#@Tcs%6mPdxcjY>D1n!U^}DzJ-n$1>OUI(n_Eeebe*Ibth%tF%Q8`Tf)d-%q`5 zKA^sg_^aD+_~eMnL;mfK#3E4SVtKOOP&Hx>U?({^*UjG6FS~@BY0Z6Kn;*7r8LGgQ zPc(p;1zBC6HT;+FFolj+amA)Mh3rPo_)tTvn?{kX^f!FIIa7&ftdv`59$mdDQ;W z>iTXQMeEY$PQ?HD{R+bHDIzy2eF&N_6;GnA{RDXua_efx`F}-0n!=64da$$Vf5Yew{hV+$h!1wvbt1 z#Txm|(%bz;7?2vnF*k9Y^}d4|+6CF$S^Q3nV<~6bx~{SgN{J{}*StZD(;5UYg06e) znLFOVrF5uMTR0NGj7eSF_nKYKFW-_pb#J|;#J$%=419DWac#Qmv#c|xgd9y8{dvV! zC4RUsScE=?)nhe7roPUIWd17_Tfy>G$ABBz`Pn_B;x(r0m?ouWlCu!^^x|q6P~*n9 zT*$U$Lf>c}doB33<#mbf@!Jbhp%c3m$A1+we}-Ny7?--V_DZmty}lgWLd=mebg%|b z0unF3kCg>*f{rn@<&S}o;eS2Fd<6K89=pI5j>(O_`rh0#>)#IpWSXKhDEN1}SKo3m z(?|!z9w3`BhdfZ`f2D0$zDksZ-}Fmq$x#G2WeTWCMv>60hcb7Vg$?@zh9M7mlea_Y zTD|khl%$LahBIGs(fo6Xx{Lh8qIzha#gY5~i2nRw8K}XhCqc)Si0Og+{TYSPDcm)K z27q{AAbE7GklVey^-q0rN{!YPL0t$1sac#7{m&{CmV3z@#s5S2ah14(e*a?8#ekvp zGu}Sf;Fp@a{r?tPr2nQLaiW99UrsO~R31EBgSC8(5-5$hGq32h_hso_ON_tV8Rwc7 zwP5pqL%yld+@*yv3|aKY`5p4{F4(n?P`vyq+9S;XYl>cF? z1yTW$Fz_`D3Jd>vCG;aL_?p1ei_i#6(D~2HN`H<5Z2F1rU~WDET7K!kBA^&O1bAS% z(h*b^2Rn5CJZG>fO0eO=@D8G=#!JI$8E7lzpT~!bvKQxY=jm0vYb;vW=)Y2*7lja(=K22ik{0qzS|$Xly)@W`zi9jeO&j4cZV$Iwd|0KslT5pSVI6$B7P@vIU~gu3}2Mo2mVnPKSHS@ zh?lmmMXypbLJ1%M1q)u-)e7*)g}*`sL>Wuca}wXJ&dS%UJt9yhWqFSCpLg;PXRtot z&cF^*ccqxjuZrxnBjKDGImpDGe2{jm@MD62SLc6za1W(ckn_MSFtZ!TSXlzjv5@9I z*MC3oQ#w()X1Ox>&%64?p1l_#x{u9KD&wd@lTd@i;~2@&EYmK|eXm zG|_?y+1SeieUi#>$uWS2{K$YdvqXKj_ub#WZ#oxvUeja~zwrOR-&{Hr1vx=RfZ0WK z!bq+C`UK#zCz5wxv;!KL;thxw8u&E;+T)WTeItSV^M9OfwW2G4AfXE86pe_}apm@( zfjE>oOp1xwIiO2Q+RKgnx@h~~nfD0AVvv?AEi!rg?&J@3Zv+En9Bqx_icsYL*^&Q; zHz>+V@JD(9$a5*O^UwRAWq}P3`2lVi?l>P*jw>ZyXMmBDD)Qb?2ltfzsM3K%wp|5- zz3deZ`Ey19Uyb+dy*@eR}ZXm z#0W9uNDe`QVtu&(Y*=5rzmn+3@8Kn)wZ`Cx zNDFi>k9zBIc&?YzWSnPZ6kek9V*jOADX~|WBJJ=6e_&M+F^p@t`^tLSLt}lh`&Tgh zzs{9ORCLJzpK7EN6E4O|}?t5m$GcsS@8vgF8&PU0zaJHSqq zm&b%xjX9nG4Ur0-$S=Df?pv@71KPw3p-bzYjaJty@4WnB!R=ZAJg=Uo<%;C-Y`8qK>S%Yc*uJ4ys=PKF>CotqHN%K_v70B#q-1`? z4LYPM{tEHxN;PN>6cZz5I~Kn`VY8DhfMH00MMKY{r2- z{kKE((ajhr_gnK47C`tODgohhPe5_s37ADHh)@WMo3XgWt}96jpEm?(MEj2D0&UM$e6MkM|0F>I)hMYpp-NNs;KFlD7jS)|uJe z-5UF0*l?n9D|NGJGWNRtYZl{H0ro!&!{?mz zzt1n57#wp&c#c%U45kjPiZPmXBNYw)tcVg~ui+DW=sbLB!}Ws82chY4ZN2r~b*f=_ z`US7oTk~=D&|JlSnctN=4d*q+i(X+D>Q*iqH!pF0H{3JFT6`luqNNv zSN4M85sF4sHL1}TQQRJB@9-s!@xKgHLr(%dJZ#B-jZf0v9erVfP>s47L^vWmf{V`= z9@51bf-f2$zcSC{>mPZlS>B~8#A&4${L_bX&6gjpJY8;X^-Iqh`=JKk8mbged!iT^ zhSQO7iB`v|tQXVk)cp3=&J#;xweG=ph#e1M25{d!oGGv(pX#}kFTuS+IE5@N^H z4}E|5p(maBc#7oo+yKs8Y!LoW43+!uf(u6HfzlmC;C0N)&%R=B623|A`{mPz`$Yz4 zy0MjWzr##n{Av%XMdmTtU31quVjC~nca4GIP_U_UtGp^<>X@#vU0(QLmTcbzhN?72 z+Qal6c>F7O+6Ddb!LskCpKVtZ^ziHHVmtT^CUTnb-gKtV3DdyzHz(D;`OASa7?3`& zY>_td8+)_p^`7u@JB=My;(LEHp7P5a!;>P_q$t_O*Vz4u$|qRxS(80rG8Q9I49_nu z3^n^a3|+<=W@xa{UCH06>f=8imEITP*g1EZ{d)tbKPV|_o(h3>shT6-w!`9zCA5JKc5Ab)*_d*QYULfhw8YqZ*I;;mXGBev}9k?g?7DZa&FPYz=5sf z0#v$afV5)RXFnEmc@Lmj;u-D_Wv}mfg1`TKDdp2)Hfv8@G=Tk(dJ2zc}jDcwkUXcAa7s9&ezuE(G^bv2EqKmShjG(7q-kcqG#c5a5!l z4mk4}iNO0QaZ&)-nBNFjt2lA`7QnoJQroKd8;Q0#UG#7b`ld~lpIaZJ8pDgFW&p^^ zJh$oa0q8`3{@qq2CYsv5gFudi#S$bVW5C#7RqX zKB@UPnE)0lw0D?DGjY}@Eor_)#-uF*YPvF8Try74-uz9@1nUp^$VwfVz4St-a}wkR z=-5=XF%?N=eIv~1|Em;ocGQf>?XS;5!4p3H>r32Tk0%=UK$7+M;7=hlV0Y8_u~%es ze;W+f9&{feDUGANP*g+99^Tw*;3h5vY{cn@m=#^svZnFlDL@6U=o!oW9z|BEH6OJ0 z0#AaH#~@lry|-PFJ`mtC717Yd4dWVkHNQ!fG3SVL{iI(Q#$aGGF?8|;2GZohJx3&4 zT=qSSkVg}8BT6-y3TfWF;*Z>SK6GzH6`4NCEv>4Ftac7I6TbFLDBnSqQ3NjL#2nad z{!V>!wbi0m_=UQK%k&M4k}Vi;zj~|qh$h*!1yDbj0*#lSSRC#E`Jj@*uqg6gDJqO_ zKDotoeo{`GPd(*BKapz-=8KKpSFY3NKbTwXZ;+eJfurzY*09FDolR^ysQa;6BKADP zTvjHBz>#wi7ol6@Om;|JccaNiKN5oRVSnyTuW!EO6kQ=4oKZ>qMNjA$Vt$G;A9Ntn zUjP=EVi}9jD?pF%Vqx$VrW>IZbS|m~lk&-!Cu(gU{-T}%8&C|@9OP>Iir6=25nVo3 z;Fs_zIK>`F+Og9QV(x27AoGk{<^GKz~*dH zqm+LGjR^I5aJ+-c1qiYveVS|i)|^eE?(#<^x>Dm~fr(tTTqPzp1t4!=oZhYv-9NjN z^#P5%D06B1qi79ARIk&~d%M5^^JD$p_;brWe#SViB5gJ7h` zJW`hN#lal=l7thp#`Acz++&kk*xCwL&4SbZcfnhndzDv7P1yQ)AQ*B}r!JRh$ViLrt z#^_5@ES_NX(wDmWbWjWdF+1h)c9}BBXIWiHWkMw~`&fHy!fsTWxDlK&JeUWfc1kC1 zR~vD;u~B?$fVsqbD(W(kr<$+j8*M)Od%syT3(V(n?HU7-vxI(`2Ggk*MrzZ7NE?zI;<#o+^P1Y_8)5WcX zt%~EgU>(3kY;PyvH$>xpKDZ6OnG@q@zc3S_Q%mWvv8%QUjL53X2a202K?)<3m~Zvy7p! zzqZ4#at_<~xdX~23EkAMftue);T@4s&)STG7E-ul>Mng7A(|C%3Epvte@;)&uU*4e zr+|#}+TpEiFsDWbV}Vli78X!O5DqdDXArJOdZgc~DuuGd>-qvx-7D9@YZuV{3jB2o zcASiaCGQ)A)Ihd+mT{pb>5l}<-omcX4~4R*Rq>oz37dvW6=uV!yTH1N5#8!CQMaM8pc^8F1vi2B((tj59{8BJO01 z&+oEjt=>l04E5K%v=8}2As!Iyk4lgycV7GuLmJbv#WT{AkEDr$U zCVK3HBEoBe`l(@+Ux-%x+>ir3S^<0APr`sYbX?PVpiV3-dPdFk9%&L#e6uul$(^rCD|c#Q<>K4FjI3w_7HVgXk!;*g76gX z&e^P)n?z5ABFw7XCkU5^oG!SQV6z7$7n+tkBGiu~&9gL+$%LN-NQ=JxOwS->Q$mXI zUO8ko+VL0#-e+Phk7!#W-$oAjGxBRdt*V3+hsq_P#tvE`>8V>!C2%=d1x8DjT-R~# zRs7_XXZUQ>p62=P_1pbNpk+-Du(v|^#D%;@E$I7zH~S`7G@B4cWC>o(8^MFxEO7&u zowD=J+h?14{CkUS$(gp(1;dK*wGhaHg7Q-mh;TCxhs7~KKO+IF3MYM$L~HI1b$x7vE3I$izsOq;abjSxmL(BI^7 z!FvVUfO9R)yID^aF6zcHe0sGDFp(-?PMt{@YKFCrv;M#s4YmPMi{zzEw+AlMr>Ab7 z72Vv55RrWFxbx*HX0}BhF0J%BYuZ}zxu2Tz02$Hl zd=D{Ja{1cSWmIAX{(AWY;%0)cJxdV(n(UQyBiiH`9P(=0enG>_FKE z5q-|25AIq^Dm1bWsRH2frLfh5=Ii$XXZTd9I9ktD6Vm{E=VkCmV^`KGg-H;do{{yc z6uMNUhF$2=ad_nD6{yXjI|(9Cp;$iC|PHG5eUIaTK8DIM<5!5 zz1XEs%m7)wFm|D%zisg+st^aXQs|?6Sf-mA|_e%jNC*-y0l0Tte(+tth_FN?1YvH1c*Q>!6zA63k#B9t`AIetkLYWXKBT%eYtPxHWXY^l_{vJ^pHH+sLJBbad5yZPKBD%VfzGRGX={6?{^Pn~gYLe-(1<+?%(VvF zAt3iqAbWAi#B+V80MzXa4Lh*V$$eNR13ZipP ze!F7NTpE*F+;^u2iB*Akqiv);nC{3GPnlcKo*p%kD~b`{HHhASJQ<=#{gU!_k zrlFv0rlcd2m;IDeB4+-xqFo~mUAhVy*|!Em9ag86v54Qa$Z}4N^E~}lS^W}wcwE}T zZM@BEM1hr+=6xx-ZV@r1Fz*QzEcjaFg3npJPTm^t3;V2`DkRVv%HqF%h9J=>s{7+k z>Eut%UAlmFHAG$!)y}N7Ve5`EHo0Rj$|58#%f3w@>+ARcU$r8ol5+9dNSkT}Lt@vAHe79n~B}m?MEI0cq z$x3rS8ZwC{e_U-EEaj;G3_*?$%KWVX!Zki~( zUo`i)FUh1$dqQBurb~Nfdw>%{ZiEEzMs|Q$knouyPvH}>X=?N z>yggmNj)J$9o#(*yKtsS8k~D?;dujG`nY5MdwXC}FEKv~NxuC#v%@%L*XB0!R8P}qs(5~G5$Dlr?RgHGw9pLp89Pd(^25a^X0M^ z_-@%ZCOPhzt*_PB1R9CVVw2`{%?gh7U;tg-#?dQl^5s)Xpx8a0*JoB5gO&M8p9|Fw zZ9o68O*#(m?mXOJOu+mkpcg+{3#v!)uQMuqn3F#M1ibPKQLP*!r(^yn2wI`*Pf6pv zB~9kS99*^B_DQKl9$|r1@Hj38Hd>MFEYjy!J6djnd6iqK%Od#h{Ztv`iI0i4-USkY z!qu8EX4~JVsxI@4K|@pJJ)DZ+EF8z!GH$$%7x4{;Rn_1%daWeH4QpR}Hg%gWAs(gR z33;6j)1UQ4SEs;mJ#`~5+^ZV;g=2+ova`NLwI^nf3ygLVsN)Pv#~%=~Rj+zeD6HVp z2=PP8L(w?DIkjOjvs{^f!RkaZtOqvfMgd$H|C}SfsNI7@Vc=tqr$0v8WWN7f0%R=u zm&kA0^3{5lK_@wn9SG1z-qD zbBDAJmpZ|Jm470C8Q&0qDX^#0-bkHHC8VAyrc6AmjK_U@{<(@xVQmo{TTGXKx*xfi zM|&1kTTBY>NLj{x;zrh>vUmz!YfW<{EDs0H(%D?)wAb9eOpbSz*$(X|d#+u5hWnAX zE@AK8tK!^0UzO6Ssql!;34EU1Zs4$zP&Xt|^!It7lNmgGx%z{Td_Fjqk>x3-pP@UB z$o%RxPV-`C3I_Vqt5zyJcF)K<@{M6I6~KaF2qcp)^`mdvDNVs%7AYPTgU-~&Gu^<$ z2X5V<)KpxyS@{B;ll6bmR^^+6%{|Ep69SzF)}khv2&#NZD-*JCXg%(BzYLb4h@$-VldOEmRv?lmHuZz&I?{iM7u2%5$3Dug+SwBF|`pz8T2IA4ubj?#7q&rg-j7RHc?cM_BilmaS zoTvK=g%%Pm zU-00pT-~~3rfB2peb%aFvH7^d$)B@kfXEwMTm!9)ZW<>w%zuAX91vpMP0X1>_HZRT z^-7yySUC^XSySCEpN((91b9y-9@{2r!%rtgPLB8K^#mst&spB zIZCLZvZ17veY1xpGq$qx1|GlQ-GhScsdXbojI_UOG{svmP|?8T%$?CDmI-PuQ+DAd z$yN;1>*vZ0&+x z)c3O&wU#Ee?$ad!%Cy5Sw1XQT=GMZrH#(5Zun}(`SKvM8@Hs) z(69j@ar!#euXXjAKVdS_B0Tg-r(dC^a>j{g87=^Mu3D6B2>okn<*|nsZry_2rfLw4 zH%xnQ|0=dhDJB7P@`~lhM|v-MJ9&aKhWm|@MbWsQeu<>udHNkUN`mVLFuiC;u|H|$ zE%XGiPR7Ui0!35s2o$~b9V=XmX%}(>*ZTJt?%`R9=)Jb&!Dd=$CmS5B%y$Yy&*w0_ z3HGpydxb&E)|cw2uRCb#b#(xl=Bu9P`Bq6|0o79w&=MCcE|Rud^Ly>7ICLS8iuP>} z*A*nKlB^L?-`$M=>0g?`kZa~xSkz^jrsut2Tew}lE@`EcL25UFjZOY*4FVTOQW!`I z_z2^Q8`$wtJm{OO>{>U)7iKNDD+W+!XurXaDySzq<~QZa${JTbVT(JyqtL+^ot)2T zcK$uuIHS=K8r%G+BxiB6O4TWDoF`|$EckVQwq7-I%_r;goQdl&p2<`CbSU=iw{*1F0?1PdRiJ*;MO4gt7vqa>Cdm`^$z@Qh#Y(gDG!AS&=G8I^q!F=R%duGi3YI6w z2e-gZ$$ZS9jiBFoG!eIXbZbM~Gf22b$@gB@pB+tkjOx7T(X()aFL#Wzp>eCNqf4+n z(@!%dvnA%UHYY&KQcpi`_X1S(Pv6mA2L45ZTa+W9lYWnEJh|7` za8t)YF#KW*A{f|%Cv0|$xr{PJQEF>|69wzpb%|c=zsufE(z6(L#W)ALTa4O+B~b;8Iv`$Jakmdy(4I*dua|fOiU#8ysym%J6Hq{9U!U` zry|Uyk@P@BqQu;pUKePS%r)t+_t2LrWG2pmP&o}6uGMFMQbA0Xffyd*_kJ;AFCk|@=d^eRYsVCw!`taivVNYg4rhYgo@ zz>tqTH#MXda7p5iozQiFkX2&!xi#Y&+Eqs|5h_;#F~J9kIb=$fiz+^3;&ff(0jFwv zT9Uf6QdaW6EC3;+VyEd3d*P}WC&98z)Fvfv0hd6BCZRSANbAc#N#FEEMGvva%-2;v z{xGd+j1!$pLt~x3;vb^d;(EP8L$P$^KsK#nelinOFOfdB$ya(`F3I+?|6G~Ysk^_y z>kF}X+IAsakz;`Tuc>MS?T?teHemCICflsuc{$H4Ak@mmH=A4Ps}`GXLr6_))XbZ# zdv@iTq6dv!tJGVV4lyf?WT0%wwCQl`l|FRwDfZfN!P;rgw24vLxgev3_~fPzZy6VB zmX>RsUzHFz)TvKE#!J9tr1IDjryKnZR}*Ov0@0)WK>UAk_SR8Vt^eA$gn%MQ2ui1b zA|)X$jihu*Be3Z1knRvrTDoI_un6f!knWH!>2AdLo}L)bInQ{`*}wOnJ;ok;3(L9Y zyyrKr>vN&Fa=r2|c7m!iPIBhS`DBwuc-69IWb;d}rZl5UErGDE$*}yvTTKLZRh~^k zT|Mdksr7k<$BU}7$P&+Lob*QYk89oCby;xTlmu5@^Lc}NR6U_Y(s3qna$Hi#tly3x{o9K8aPsCyzqRoR;Ro_Lv7rbx5j@j_#rMkOh#0u@Kr2hFypQX-z{ zWR4%7VXiEJ9p#Vba09#klb;=~5$_UPy=m9q9q_mvt=^$1J?L+_T}Sftb3<~xj z(>~pj2Di~u)A*L-gZq96+^oRT_B1-V}kIr5RhrapI&SjI_z3dYeBRGRE9DjCx z{)~Tz-t~{qgwi`~p?%{ib_@gJG@fQFxOCSV57A|$|P zHt({_@%(fKU52rFGvLD3evD8FsU?y-(rr@5B?;SqU>=OjRH~X6iOeZaGk*R2=3t#E znn;b4GPE=};ht}{Gy{@Y#gOU{5>B{Lp)(Uv!3jCErkLNBTI1Kjf{xw)Ar~vvqN2^5;MGjM%YK9Ec|3fleL9W8fcT9~@ACbAG(%;< zo#MKItK@Uzo_C!eXm%{xdsNeFwijN2;wHbg`9WGKe-sCH6#^FsP;^hU@>s;5iSL`6 zWitf!@=Ta;=3xQLyb|@nBJa8Ah~~Uj zHz2-`p3ck?De&AI4>RRF`nTD>`6&aj9ys8yOclWaZxdWsPrgrO`sN^T1d0 zt~Afg#1q5MYwu^N`4qeCRzRzvYxfT|i^T^Mb!lakC+~znwGyez9w=IwraRg~n(C~T z{kZEMM}V1u$F=@7s4hvP=sS$fhQ~Qh$3NpNfVB-=icWW>jnZu4BObfQgA(Hg2TONL z9LbzuY%=pSmW!yQ?xp$??=wA6k`icw+ZoCN5>IyZ`Rzr3ZhKT~@@V-urUSdj?drGM|$rlX36tLND92KRP0%%WosmJ1&fU5 zHwe+WHPndMI5%^Uif2%s`a;RRj{8AE0`8ZwZB<$S0+!~RmoG%eXo_i~xU*E;Ub4!0 zUltHmLwqLvw)ggmS;)$vKC$;uqGqNqof4yqWyz&!V?V=$9`yXc%)-OZfw+09V9QCp zrs9uh!1k0SLK?BofXks;ahTiTS(psA?Q*=Xmh;<+=a7sRmQ>D`N-T1>kpc^VHP?(gFSQsaj4b25nou53T6DfB@#;I) zT>BRC4wf0%#+eI4R>*Q|zuOZudhl0`^NN%K{lTZr<5SWU?4qrR05I5%;28|i%7rGT z#ba|0k6Bm0(o-Q@uM7590?a~=xEof2oXXQ+f=BDz4c&%+WCW{&UtbpB?v<_@Ksi=) zNu=xSw;XTNICxpko|Mzm6N^2%dT~Z}fRFDj{X&f4l9h1J)Zn2EHsO|K10GN$YoEHY z`My7EQuyd;`SwMbWrl`~VpbK42%QxRe{4agwI@FxYt6Jg!mt1o`!m8_EQG1TCvTNf?E=3zMjG*fk>?`Q8c4_j z&)@701&g(4MN+)h4b4I#+xdN;h-7$?c<-xzB>hanIG7=r_7ZI8OTS1DI-fG~jgTkb z*wW#9tBEBO_tYSfVB>1_Va`W`m#RLjuibq64Kp{FEwQYqPgKKRr&a{0F_A>`)00XQ zT)i`Sv)d~Z`;5f=#i+KfoG0}glV8(LetKxOS?eN+_!DN^#&t;fwT?-(BJMmtI;+-p zfNPSVXIsZ*`r|97mL7SSfaC7b+1mxD4*)&lXH`8-=fkT}KWED#g3}6ihc;~>deUN& zbxf?RB%rZ0bP(?FGa5f^NWu2c@AJuy{4!a1I@#i=Q@Ty=MhqtZJ3G?PW;6pbJ=wG3 zdKJ$S%s@B0doDbhr}ywfOqC%`m&yD_eRP!};VpdQvZO-0LpZ#aRQ9C>&hLmIx*!wV ze=FFdt6Un{-~@v&1TA)tPsvj>oeDVNYW!X&gIe1P7EMvQkl2U@;Zgcqd}CD0;-G|x z%Q6w$*_+7&nP@-v>^8=m%R~nxYlLPrxOHJu2sW7Otd-|V>B-?!ga`nSWGLYiOWn*< z^cmlBXY)^@(_C+d3P#Q4u~Um$I}4dKz)rI_|L{&SG4N#+VOyd+hKTz*x-kkZc+_jo-q zfrN??cXHL@*alSI^=9N7M>>4P4Heh=nuy~L&d#rjskUyaF(nRlZE#Eb7m6?(cddRS88y7os=cI~g;v&*vx`@M>WWQ}ccqeHUv zenv4bjz&nnO}-k!hS*YtL?(&C=t+$7sAi_=N5cTV3O1TmRN?q><6GEPJlt~`Uo4Yf zA@+t)F(O%Jdcr^ZNytnxgGuMy9=Ab$ZcjRp77ax!A6E=vysgM$X%ogH`(2mKA7Qsk)*tTqaf~kb$mKm*6{%6 zFXRI54AVktfAhV8t4Yo2Pv`q;er_+F{+@MM6>W?wY!-Bpsk|UUx($EXo|_dfngsS6 zX>iD0@00gkHZ(_WRL?UvAA$u3C#($8=dZ32LvKR8ne&)+9*?rR3#O4($A?3Fn5D*| zWPj(kyTq4dnQ8koZVRux5HVeK->be~*UQ!PxzFc~THk^J;;4!yHfPX6QU((mHnHuJ zBQdV~y^W_iqw?LG9=eRU41DuET#Rg1>mM5|RB+3!*UdSwY)bv;7mR;8Cjn_yP1TuX zr0Z2XmpqZyuGl>#*y-rRDmK=#+borQ<%CDWTXPq%)?&E+h7w*fvm}5>KK>2YDZO#; zs!!M}^!4!E!Q<dCRKjJw=?C*rZmH}@`rsKqq3RizkyhqOO`6%Tv@3O zD@fs!Gc_4}J*}(Vglez;dOtNOehfO2B8%(=Pbd&%TuO;I4q%m1*M^cGbz* z`r|&e5ZdZO+&=D>5*H7?W*&>v;@wKX5iql-n4JtDG4DtDv zBu_uD`+?7OGEWz3ho0H<%Um`5cPk4kVe6S|J~bOv<{ zNJ{gPhXbP4+4sj!Z#FG~>ILs>F{;O;5hW&Fm_U_g*-Au4*bL3q4l|0*aathxUpoahdRyuOO*DU& zM8uO!TOWmb2z8uENsT=Q2ZM%(rDTWfU zHCdKk2YgMQk2GD9!3}m6%+N>Smik5hMc8UjY!cm|hc=$Cd$YyH(x@cK)A2?v4W|A5 z3{4XOy~zA1QX9;rB@!&`e2YwDfRHc4VI}8twuIry8yRj)8Z=1!+YOfO%C+*v>wQZe8# z(f6H!#=ZD_;e#F%00D@9|0Ipc-egE19C|m&wi%u71J#0l$_ONo8?TAgfid>>avCJH^mNmy);^i4m|y6@`WQ;^wd&{Tsjhm|pVxGbtvr zkkQUxpDw16C3pol%`t}vzPjn=?VWXr;=OfiJD@hMul3pmiC}zy_I3#z7({8+BOFCc z_nmmPElT<1KZ~SfI43F`)w=SQb}DR?s?Yf*CDsmg29cnF9A_Y!J1wd&M7XATUzy#- z3YZbb|5D1N7<@c)h4E?k*bX)M)a}tmCHXmXw_>S-y^??qLa}&IhWSvot=2LzoGa{j z(Lawl`$3xEL|Aee!h*?Y6sVKHLcVYSymND2_68sYL#8t(;8MFklWT<}2y^TTXTWxM zL`4!@Ty?)asXCLl7=5`S5Sh1qP~p|2YlMGl&Bd>CK3Gz1JQu$I^@4bR_vfCb7b0o7 zJUTG?U`EG%Gq>n%x?m`>=agid?|}J0wZouH_Pe31hp~bumW?gv?oKImc z9uYZ*=J{XUq-Dz5d05P7vnHebAR%U9h6-kLrf9GPW0L*j{nu`1I!bTGA3Z>_+d(mN zS&4iVr0dm*HNW;X4fsCht15dfTvIK3$5vN6=cW(|(x~=D)vRQf1q7MH#p-2398&~& zai4_cH&G4YG$PHw*Mih`%spMp>b53cXHGbkn+}*ca^y+0j7Q(|(nAx3)o{}vl`jR6 zB=ZCPmAF!DSb2q$WYW=Bw#kQ9WgoH(23BK~6$v~;^El$v&@99o$SB)V=}H@NrWKQJ zE1VJ%gp{r4x$y8A>7p_E?;au5_;tIFc>%oEogMCm~y*c)ssx?t75u|p4MX{v1% z=Hl@O%7wR*uR2u;?+3k(Ae;UKJXOH6XLMwQZN<5QTg!EP{C%B$&m}ZJ zZ`Ypm^Orczx3zVa*=k=Bw3p3{Fq^}hRx2VoJ_y3hXN(U|zN(EiJk_xvgCw3nrhe#N zpSrPv_%R>;?WaC~bh8e=ZzLz|Z*DzUYX1>?p4{B$>LT#rO3R}g=>^~X%E`|4OV=64 zMV8r(ZBDKfg13{u+2;joP3J5Yj1D>H-!;y~U1`R!?g;-f{RsQY7+a+aHcvDIHjG)GpU)O6npkMI zCg%PI^JLY>)SOo=gicsgnQM@J^eXI8t5rM77X1WYD#4lqyfO)Kt_YUm;(X6*7WPtF z3;^<{=gXv|2!$89XIQA(=zLZWWt`IvUl01b;}m{3dvkZ53-e!LXTRRmf%gbsOXBc~ zB!Uw){ll#rtsIR_Z%M26Yd$gm%vLFm{<|&AKMeM3Ehgb~gAi;X45%_zc0{xrEv}bG zok+&Fe>d*9&s%5LHp`|*0|i56fBK@-ppgdzY zX%2mv#L)h=9`c#T>SBNIP(t<9pa{>I2K^7?$P`kRDj$yUgE-U07GGz_B0cQ(WPYi^ z&ans{YICxEAo}49Mr{9Q6^k1rn&cMhswU51d{B~eX7PrI2k9%e*?KQXEMX}PdBeSK z&`5~uTlcd<377h*jo4=L5|TakN5;xEo{m17aXimPi+lph8m|~IS9TX~xASYFQ$NcU zwj@Q*l9=Rp63`SIkZx`${}S45zeG57cbtM5{eZX<0!88|e7&~Mv$`cC@eD(Zz*yX! zt zi>~bxZCwL2G_Rj&8fr|}{dlIV%*=&9>N*xED%3|H^K$aOA0y zcN&S_?@^bz-MU>6caBSH-E?WfSNH73n0%nXXKvvDdEOkpQz<$*DV{!wNdE1Xb17R_ z*Eaee50oB!wm@~`sk*DV_O8Wr(`sF0OA4@hefhDxX;cb3etZr&cYuKQCU@?!CgTi; z_P{Zh&SURkE?i9;{oTNax%L$TKYuzZ2E8RV?yBFu9G#rui_)7uB+oZpNN63+Q{ETU z+nz!l><`P|zBQ|fKC9eordS@`-*!9K@C2%R8<)8n^G2?EoCV-{By}?pJZM1)RSgtM zZY&GB{Y=;4GHsk74l^|3?EeBxP%#Ki5l@`kk>BpSRg>~GL_s!)VF@~>fcqp%o`8Ln zx@}pajd3U(qEtfyH;n9L&f4<^kIH9m;6kQ3?db00pr;Fxoe?M0q-D~40uMCs(a{ch zcyD>1pWAWn1-y^A@3c}BK_k)RpfC8tUXs)G%!1DLR?(w<*JjnC}kboea8e1eYW zcId0*{Zr2*L5dB6^M0-me)Jf7zj$;oe}x9AiV@Khy0&rfl5awxd-&;-%Eb!N50Qc! z_$Olr)?6hoNmGW^VAXa3{tQ4xmrf)JrCtk+P&7 z(tCW0M!2D}f1DF67zLBuI~F?XaImli;va`M^-Vu6T1F-7CoM<~`aUHkgqW_CD5DKZ zn>Po2ioqY+rfk$LqI*c4mxAK)kX!1WI&nI4J6ry2a3Zjd>!%TDjIJpXZft{R(ymXs*))r;(~3G&EN2AelsF*^gGIU^3_LaRNSLS75Vc0~1Pw&>om# zsz$Vb05%BcZ@Wv@i*vdY!*OK-!aIB$TkkU&hz30<{FTUk7$!&mRoUtnav87*SSTe; zRyYmPl7}PEy*a4_`E$x~#&&&Md98oeVu+`n++pU$LR^EQ%`}DspjfuOflDT_q7~(; z1g&@>e+#3i8u9=2~x(#k|QHs_~5%tl~q3csS75!hqO-L z&O!Fm7O+S+Iv=bcxqw&3^br`o+@UIE0&UEMM}6=z-Qv|*zB z7io&-%?qDn@LR6$zBfJbyqBx-tITyUgb(&k$8GJioYt!Fj0DfSJHu)x6J>hM+Al8M zC*>I%3Ii`#H?wJIe>-jrsbeHP%>|6Gerl&~iDWAY@r^-`Mi2x+eKKNQE)^pNzf$ipD!rYtqLk)ZYlA-oUDGZWY4`42npH|aZLQv4}rXq6I3qz^e3gbihI z#1bqqZ|MqiJk9vkO)-1&Vk-oTFL9!i4qu*EG(1!1JV!a>SxG=E^OpCRqNKR%o!8u7 zM}Q~rfa8gL^Gwkf&SoG)v&%b3Evw5;Hz&7cGHUBr|8t`1GWS>)kUT=dtP_8<%80Ua zdnnIX=X1OkYN^?qzLI(aNGU@_t~TtyA5P2PyRu*1y@yeQvm2EC)sM@N7ma-Ec| zOMC5A+Q`{l8xLN|ho~PSe;rpv$Q|6D>~pQ#OK+aIIR7xws1#E6ojknkaDHd^*5jf5 zz5~GRTfLe(4*RqI#YMMrpA}e_RXb<|I98wX?Bq`EH@iv(4c$NU)4#o&M~@r*n{xI< zEg39dAP+DN2d5VX*YtiL#-N4#V|4S~_J;4_Uh)SaO&&nyphmj7Gm)NxhrBz_Wd`(mY|Sw?cMlo_#M#mVE;yPM)P;S6JreYn zATPY?d+VJDs*YT*xG+qLC50$*e^<#CEo77Um4)6IIyp=iyfhryuM2lSQtb08prKqX zl3d$qJj~?*2G_OPuF*--5%~VgrUS=0Xq{uc@pPH!i%#z{QSRBb4&b#ZgklO9HFeZe z22_G6#NeIa@OT|(O?LHd9+E>dhu`}@FONI7OE1G1Z+e$oy6c^1Dzp0pHPpzCx{Q-Y z8$q%IBe4cb@;Px$_YL^tpR?S+%X+`R!))KbKLvxv-SuzzNyazAqvRr=!uuoW zFC6Ax3oG+Yc$pvX6)u>C?Lqx<|IfX;KNq!igv*uv1m*FPG4H$O@+jPU+9sAGv(A z%*Z#nR%!~4eT@1kD?~TB$12l|1+ShL`L$R1t>GjOh(hFRP*-(u3%C%XiE_Fb@~#3m z_4zk6l(%3=U#^4_E^4-G7%YnM#Hcjc0aQH4I(+EDbEbY;-~?o`?ji~>txVmniey0wF5w-++i+;`Pj@Csk+K@Dvo(-CY2=U7bk zG0y^tNWo5n82@R(pHnTuL58Y@{pB`G7NFGJkKyquCpRCA9KV^`D3}y3DS0lG*0oMR z$P&&?0Sw=1Wa3+&KXECCJTwurqO>?%=?L4kt*9Ub!*JdAM|D8p_1wn{Xgds!v()e( zYaCdEVshQFd|h1ctKB3pE8U6Rb0gCo$?W2m8d4bTl#-rufp>l@@~El+RwcI4G;unj zMBJ!!obl7HJo8ekyWTqEzX34z!CM*grdT*mMthJg?ncGl)L8YUz41t!`X5J4mq<6y z707ZmsVHYx^(uF_TKaf}<^k7-k<`*ccDYeut$FvrYgcF3yw2IBnj86Lhw{pn1L^0a zxb0zyQZAOyt)r59z?Uru+iD_jjt2$yno%jn6}&qSXhtK&f9g4w{<2StJ|2+=vT+a6 zf49D_*Y~-ehni+zc@BRqv>Tf==~O=6r~`c5+KRokzje5Yl}r7f+Ot_=79R^ubU8({ z{i5+Uz*RUHTc)x_8+~TSq>>TZ|GqH+2@|U>l^;3Fs4L>0+~Kll=0GqbVhs#QrZZav z5bImDKv7L&|N4q_)(_z@)37Mez~Bd8$za^Q=QTK8x$Ox_K9JI8gk zRTrt<++43cI0+=ZlO}1ep+C<)nUiF<06es^$zXRP@AA2$c)JQKt@!L!qq)gXdb#BH zu7Tra4aW|K#`jUL$oKVgzjT@4o%HiZwd{jSgrg0HTcK@h3gjq}?iWn~oHFs@m=uxZ z0=yiLqy6s=85XA7)EZj(?awEgS~xvX9zvkDVqdq!GNZ4&hHiIf9{9nDz~5zz4Zltm zw2YYsP3%ne{DS*Et&`K#plzTH$-2AI(C+zw=S73w)QRP5Y&!rc8P6pUT6IfoxREpCB#rAjTdrKgg^@+_^y8JHJ$!n36>8bSjt1Y@$R|%zSfvBb+tO3fl#fQ#64e)+So##C z(I|dbs&1tr-}4U@dWNdqFO!=HQ&=~FdoT{j^hcQb*J%_Q>MVhlQ=`c6S&|q3f^wLl zExKe&_syo!t`*QG9a@iCntotk+06bhW7S`m0ERNa9QJK)_jbC^`!ccgpk0voOhwG% zvw=F75rMbu(eOZk`Y~m6Vui|+1Sop*{X+!=^Rr@3C`yy>3Sz^*Edsw+Du7A{*WX@Q*Fu>y() zb65(b;tUlEnJ#`5slvIh`0AcEmO*=WB?0Le|%^2u$E581UX#Set)7cd36^dsNeVvsu)Xv+~dvcp6GMq7F#g>K`{*7|GT5z5Ky|Tl-_2t$hBY zC^B6sMq~k42?d-R3e(=`Mpa=ZuH8{r&*B@me-`R{{_bO-x*9o?9`CgBfyVsQI2E0_>1$*vp6}Al}0e-mF6Hc z$+P+VCcVv$nGKX-g3^mdcS%umC_5x2{|y&6j=OlHNk)@Li9C)2OR)R&v_l<>rVHPf z1J$#MCg=0?_XGDxuq3vA_f6-(F`T&Yn+WBfuWIT~W3m4i>=Gq1VCcf}9BK@hVOPIK za>Iww@aQ=WJ3>P8s)4eKCoRW#KeGpzizrlv6k^v7mNH`o9;aX6(3ynDj&n`vqpaiy z{~Jzg1boD#C@iB8Azf7Ns3Yo5M=?qwB)xr%p4=))hK;8+yR!Uq%Tnf@xF9Oit}oI5 zf1+^t^3s$8;XFg)gFse_zAhnGi~UBxJ}GN-X6Snb?7RW%Z9xx+vd{q2x7MF12~rpS zbU}Svi~+w~#5eJ)+B8PwM!)10p)er(%b~JE<^IrxyCi_i5Ot?p@$YZ%z+Jo&hq_B7x>@*#pepd^*L(sfeVUjC0P>^6^}VPKU7$C4{^Yw`A*H@*Yz=;zYKFd}KThIvoXLy|%@_a6O~s1L zn$HKBMeSGLaJn76KLzt#2H4y-xV^LtL!XYB7nc$yPcz9T68-nTAqH;ZOXIMswFEtp z5Bc(6##EH$#37OxfSq+K3bz!|(x<83F?9Sv18{KhHX>^OemVa8kD>erusJOP-vaWV zYNdBC>Hfk0{r~z6Lw*1%S9X^q@&!J0VgFzM+yD4qgt~>mcTSc~riuCg_eb2pg+XAt zNxw*m`2T_{{FgpZh7l#Wu2I8LC3pYlZ}@+@>fBOP@)dXjy{h8i-mf3@GtDsI$-&$ zQl{Goe&xtRWZ;;JgX9QfKxmhBdl3A(05Amt)nDhvJpUK2e#R4ItjEj$7j2EEss$Od z0IpMC1fnJ0SOHmtd9qp9vj;Z-fHnpqcd{WeX;&mk{(n%=3Ym543V*2LG)F2<1w7VmTv|qvoMYhB%H?(0v+Vu8awt41 zUN4&Q{^sJ)t>|MS8h6IRNEH{d;Ce1MHFH;<9KORBLa;^y?k@^H-kODR?F2P_B0-(O zbl~-Tm~8jLs|L5%VfZ!pI!yxIcz!t1QZ+iYvkM2~3$EX>hWw`PjS*Sp+`CvWOK^}%I`#V%f z4^nV#m?)x70P2`bZg541qaFkfTg|%!N;p*Niv%fU)EeYVO6||-k}B+Lv6)V%oUUMxFEsE%iV&S~8HsqY9d zntv-e%mX`NViI-?2!zX;(f7w11Fi%1QE%Xjx=-vN51y4i$B=-$c#tgGP~=R8%c1g@ zo|ISc0$tAk)E-a?4@Fi*LGam-v%VQi4$})fpcLh5) zKh^i_7HjEl_!OWr{k70c5RkF{>L0;o8SYn|_j2G=+w^!jY|womo$F8k^7*ucGnvlm zAjnNt6eiKTd38F5_0D~2+;MLooFHvlPj8{2XKKQD6zch`&Fd;K@(g+n6W{v<*IjAM zUip6YPa&VaYQhcDb&EJN7;K@~)}5^i}wVY-oM6g8y13wo|R$_pg)(PCD0 z=#eji!o*iA1prk_f#DN6|Mn4#s~0F+nc9YRkOJ*rvY|^ zDnwpnYlTA0X8^cr94HC!lSu-~+kt0=sOt|zftaRdv%qpcd z6j4V-LcyJqk!75D=a*!X+%u%}K1SS+qcRQ*rIJiOTY>E(h7yBUy)vs zuRp^j4-d%gw~+F@Ox*T7(2Txhzeho~Zq%@myO|y7*myE7{$~tP0jJ)vyfT-3nV+Jz z0d41j=gM(Zp@^IrUEo2~V;x7u(+6K4mA;p+0f!{oLz{nITEJM5oodWpf#Q!7WG}|> zU5-P01ZmXE6RTDC5h?n>JZh&!{I~p>jWOFHxHQysju0Mo9M~V;5PPBQdIFwbP?PE+ zI`LKP&&5{%$oOIa$bJ{95Qc};@IXs$VfSZ9;O&*q?0{nQLuc6Bnrr6_h)vC+wGj>M%C+Q`PGlx zY1#YkwfDaUnoOGy*YB!cMA(R+diKdkjlbaI${fbjlFHOn;e(w7Nc6G~@++egG}WbT zdmciU7L%W1MSw+a((04SV8w6tP`Y;TCSiyY66o@1q-^jcW;vRmGh1U{sZM8K+enm_V$R>{yWuuKdY=S%n?DF zQ{bidJXQsvQ3#na16n(t%XZT73_Iq7X%fX#t*o|RpoLO9-Cxk_XKjB#&|~HBQ83^F zT1kc!F3-6v=zw{SHG${*yRv{I-3VZ`bUkP!mijkRX+XO38t(y8HfYLT;H~@TMLS2c z>a4Ao*32t`WhGnTf0Bo;-911i00E~-U!rY8OY~u77qLYFlu&98)T1g@iC10#9wx#* z0p^jh?x1=QCC+M8YAxYFH3VPadY^fi2}|JN$5o%t9SBB%8^dEx?r!Z3|FAvCM<07#+s4YagjjT+$=vO(&^;4i>)@d?(UJk!CNMx~M8K{nx)mCJ^A zGw-pVbPc%~K-|{o&slQ*Y%z;;vQL}c4)@o`45WE=&!NO4_Oj^j?h!5&o^f>lywY34 zDF91U!({GBuU8tlEtL5gqDEuaVF(*;j3!*Kocx;W5%LqOO5nvGbCiK+uVa}X*! z1%QD*#t~=T|4ahI^@4Eun2lxnvmGZFXFrswC>*{CCZt*Z=1o`0+bthu1ce7TZth)a z0&L5m%%~|z<^cTKlrSoy7z;`L_y($0-PDB3_n^3dz{@6(Dk!$@e!7*LLBuR)Q85s( z(FKg?rl=>5-0&fd8^D7Qh2B$R+9m0jfD-vG3ugh!R7b-mg~f$j1V5yJAIR8qlV(jO zNgX;*ft^F%*}R91F(&!!A$YGQ)h&lHK1w@0wQuV7XxwVG|3{VN->#4$NT?cBhfV97 zlIS(5VEJ+l_@t)mzBoyxR2IM?BrW>~v@0pLvn8eXWDlk`p+u{&M>v8b*5H{|-|j~A zZ*pVUEoD3X{FH08rJ?PUCjdF1vT1ZVIYc7XHCO{Al2d=eNa|QX!2v_3O>vrlPm%?4PhNn z{db)>;Mtv+!sz^}GtIG`AfqVz-3uWUWQrm4dsenpycnM#RRaOCXVpkCXL__-&wA(h zRDjQmbz)eZJyi=jxmTZ);00=#;Ktjbw+>+Hj++ctsqo_BTeH!e1u{_dyY-WCEbjsr zCHV)cwnG`byqIvb!_x?dILv_G!{4Th4|gRJTxxYrOv zwobG6?=diyhKSfARAjIiUo-y1yYlS9`NzxmBfWt#*zpN!q#jOPz~xx22N*z$?DF#R zTgPhzuK?0Ov~$g6{}BLX_efiW1_=Gq`*Sr}vO2#^DQ0RBE5_H#zYMlY@C@7|aHpsP zRDtgIZD`JZKUHK~TaDt5Tzxt-K;dTQQDb0=3_V)UA2w|UH&wZA#zWx-+R7h`D*&3x zcKQJ{c_O!tcR0jnhzZyThtCbXagix-&U|{hP3+w^p7vM%_!?T>&eGFa#Y&eeb^n+R z)MEGzv%m5D65#8DwAwqYz(j%}M`4w-y;1SOJh`DxyrrAJj0e@Kj|^-e6CghKSQsPx z$-L2CC;!7yxGifW=IE~()VhJPGRPRpZMyA|c+tg9kvD13OLm#r|B!gUT(EGxyxI>< zb5@u=ozT|bxdriUNH9QuBlK4(EE`6p|_JDH=8xqY62`;uV7hIBkxH&BJ{9DD%8HO_vhLkIrYl(%Reboo` z7N;8+!qtSG9K}p`gdgaOH(>m{dz3kq^VKa-4{@xziloQ;#d8e1qeR=M7+aAPyAOOIHzJf;u4LcQFEFs!+=xR$>xE0?~?@tI&0t zZQDIx7-kW}+kjuli26MgO(Q8(VL9HM1yCsZLsMVBbx1~vwGt#3t5{qR zxjNgmSa;*!k0nL@e(D*;7;rU`3KNdP=;j346sz|9=F=E!@X2RJlYuE zqLlw&0U-a=FQDZavhok~-XK2QTg9wh#v7?!>YI=={HG#U^0N7Mri-lLIl=LS|7fZeEOJ(Fyu{enTY z^q)orDLp(w1R7 ze~ufk7)SqB4d_q`csFz69`((doda@pkjAg;9L9rppv6$-9CZX-pc*aE+|Zo9%?f5s z-~j$G;sxHDY14F7X!O^l3fV%&9Y^I%_qI22TmxPw8jP(wt!!58wX$~^#Y%0Lc%FtZ^05FVB=fe-pbUJSH{r%i ziz}VCWap-EGe-w}rCP8VCzo-F(vjDrGkH2~z}d>>?CR{e_j4LM?Bdn*dwd5LzpG3s zC;Wqy4N%%}3cqOvwEmRqT1mvoGhC%`^jE98s8#IS)@4`*%hmCw+DruCnYLK+cl+nX zOaVLc5mocjUy&oBwr%SHy@;s9aj1~N4Jb)5#10rftHZj(Eh6xd5O=iR4*;N`K3MEv z*E#Q+|1z5amVEh~XB0MaTChF;%V}t<6F~J^)@Md5z*5eW^_tKHU@z5aKb-H)p(MJ< z*#GUf`&p9TUVbM}UXREp@WqKkGs_%b2a|^=ddz(TWPjmET7VBFmK{nzg0Uki_>S9Dima$#^*k!odD6EN zhLgWUW`ehZZ3cxF#-Zgo>D1TK2}b-daRPE6JtKCkGA+)Z;6xm86>}~1yh?msc_Eex z=(m{QeW$p(^*Bi!f~HPcTbCQXKMqunZ#`M{lt z)h}Vb+@2b{wrU%=gzqHtvOeW=^8`0|xvJ?V{`2q}-z%!2N68l;+(-5<7RyEGrTkqc zT2RsjYXO4hYW-%}9>fP7IyeHGtnG~NPT(4;`J+EnqYilA2GZl5IAKGSPCH+_ivU`- zKq`(diF;RAJ2nNl`sEIQTt6EsraN}v_uhdr6*4o90VJJG+v-a7;q0Z;A{Z4Fi4C#b zka=G$Z2>U9Lbck{FWBk;|GeYN#c>OeTVKWfz_Kb;r9Tj4V@2TM7u-+2TFgl)ggnc! z6t7xbAssQOpDpW=)H@pvgAhr=5dsm9nNSJQyRF|$>~MP9U3;#k8^X|puenab zC-UDs>7%`NJ``N5Z+LkUJ|H95WkPg2dUORIo8IU60H@Wr-2Gp!@h;(pVOq3Nym62~ z8rNW>*GFn5uQU!bH=Uq*cs=7h08y(q#QZNi?*DUHb&HeOMX`DGDH91Q>68u0)r3VK z{R9RVXs3}VP3lJu%-O|wadzfy0r!B838SqPN?a)}t$sQ4qr=jMK{i3+J7HSoXeubi zw{qg-EBqrUv>XtXuiLiDwcx;#nd%Of0PQ7aGou_juy>pPLZ4w3WgHQpVz^; zYgKW&Gp$Sp1P|+iJt#|W*mx`t0$M0g39Oi$1Yt7`wdO7WO8Nnet3+Gn$j}T@&GO9B zmMXzfT?~eeQkCkbP!6k#91UGgao)3(jAXi;iW9HZK|U7Y%1mc?S6<%6(aZ~nFF$zA zw8q!peqr`LWt;y2ns?~Uuwpeja1I)*NmsgiA>BWG2=(h6Q9UEhPez`A?56+cy7|BU z7okeZA%3Md&q9P)%|NDuI>hcyTn3YQSt%l{pnKdH#b)U2mB2LE+@#9-`P+~PX3}*n zJ#)Y-KtB)2gSmhquj|OcEvU5B!0M|aG<@R~?p*=k?yK*KIkCF|6*Al57d{uR+ZWMa zu!-+m1xIf~)1rHRKDy-S%H23W{jWj1fJmkctl0lpn4LEDK)ren|4ooEeX6ZrsNW*! zoJYjQhVdUy)gSdTjsp_DP8bSC^$fOOC9A>K58)@wx_M<4+N1sKEZ@je;M*CSof}0G z{Z7dg36ti>rdpbyCnW*}S%K=6sTN6F$0e%6HPJ4jfIUS{MNLa? zyw-C(NY7u)fh0&v3J$d4qu^^=-y$#`)GGb9p1kzX1a@2tu6{qQzgl4}v|hhg5x6g_ z@7FE=crxG&4D<>qyf0c;lL3Sv;`I;wx37$QAI1GdmlNf0SC*-#j}e`XA{Uqu6Mm9E ztaU+oV}fba1g=<6vz7pkD}X%4^`zxo4vRUnMuRT?bn4{px9D#J=w*VS*%Jf>M+GQ# z6pK#=bGSsN!0##r%w>{eK0pH)jjgu)d(oZ%>t{KYMT!}hFI#jYJXHKp4F{Zv_x=|F z!Tb1nT#_Oa(*&?I z388C-GCL}3f$o2sgZ&!AvAK{C7#{%BYut%Z{yJLCDaKesG$_Z;BxnE45L z9If_152Y_J#%ov&kRh4bxI*UE&!vr9AZ0AHBY$pclX4O525~H`JSty5F|#LiVu_^% znil2yy*dk}in?GkxnPDTdA!BnAf|Ta??V}OQ`l(3TKv10Qf=Cti0aLBF1Ig9g;F$L zeKJ6W$npym=Yp=MY#-eCX=P#Wc%7g32!=F&$ z{#N)kAYDlvl)Nw#T##`XhQR=aP+CcwD={EjyxEU6)fp%49Z2{(v0ASJY%{uBFfmq! zI)-mG0tNm|2Pc!wx8qS<-ms<7J%F850LJIZn$StG-J8OoXw#kpK{nbk)?h2jK~YVW zdRo)`yOcVT?2ZB6yLPQ;a)F&+L(L#zKCyfoUe8=L&pQl$YgtC20v`rRSO1->jKUu> zb@65{DdaQ1L4nOF40Qz+a_Gq+Xs$b7Z6WVdA5ZtR8#tCkmt-+imcg`q$~E?2e(&Mm zNsLM2I+Xuto(}ek6ypuY1I3nBvSx0{oIkr8R*fvL+6GUdp)tj=Y3f^wl{o@1(jSus zzDD`l4?tQ?-AZCvF1*^5{qrIbWM_kE>-LjaFqR4B1-)y(*H09t4vjx!%Y>TmapSO% zBhA`=(J5kjXh)wD2KklzQ+33@-P}j!o1GN*~E>Ol&M1bW|Ec3PrVD8hg^v;5=v@%w`BXm7qsBfBxSf}0@ON>#U z_6w{RQvqFvVpy6G5|;wMkpxHPT~PZqOYx1XDBlHNi8dv%v19DP6;OMjrr0!nlR}>{ zlzti8)r1@87lQx`SE&Oq-JOy0D{H!XJ_SNLpO1*+{dRT$ZMfKouPLsQtTb^*(zFn8 zgpH)zbrBJmc@32?tk(Ec?7}x8v|lS!B5u*q#i9gohKrII$^L4h7jbO;aC@A7|4a;n z4d>XCj%+JtT`Wa4fUYYY<5)a4yBPvT1(El@{*~cRZ8l=vu~XI)e7o>sV6tJ=-O^;q z2|%TYEQje1c{mx%w!bkKm;CK>&2_yZT%cwQ>TuMPAgVZ8TpjW42@3wx_19`7n-bF8sw$YGdP|Ld~9( zKjNMBH)9_+)p{WFWYP9FesUid9cDQ7&$J|UY<{s3 zBP%r)0Q8*5MLHM zO#AiKFPbV4CGqTX%BC&z-a~`MV<^>_vk1hHc6OiyC+NCAi+JT5FByPFz_C7sy^9iQ zeDqZ}R6&1Af;G~z9-I#vk);10b#EOOW!uILnqUD63J3zyN;gUhA|N3k(%m_9GYkTP zbax6!Dcw1AcSv{l2t(&y_w&Br`|a*`?C!h!-yR45_#7|~%v|?%p69R5w?oF5rAuHv z+D0?#*No6ZSQ&`TZ6M~EMuGK;XXUT+0W=utDayAa!oswD4AvqD8xK7;{E_9^8zRt^-5_1xBkpS(K+>&|s9LBAwKS;pGq9Qtgd|fBTw6{G>}} zM3e42j&QErwz_TavwZtS2C(i!3}lTV_U8Z2uJGZomnz#D(+a~S?$jK@TA#%S79oZ{ z-C1bjS$B17J!9~5e{x4jnOlb>jbwd61q*y*+^VBJsd^F3odOq)?<{YhrWGO*0eKdA z&(Wv<)!UB8&P)^}FOmg83w3oUdX<_wnxEiz(u)R?m)`*AkJo;(_;4(nrlF+$(CN5` zsq??Rm~K+Y;(JW$Uw5tX08t?Y(WjrJImfz4jyJ2ZdNu@Sz(aDEqQP)o2%U0oYNd}% z#tGb*7z0Gnt(1#URDsiI%Q>`@B^KB;eh=N2ej?J7;U?RYjzKXJ8eka1q~Qso2wsJ8 z^UB`Av>6<(^sVat!uTydA16M(yxZYBeu>3Qb=(ed zV7srE{pbjN>31Qt9&V5mVX3SD7@TrSAM1p)I$iyAWu;8|*l+X`^f4>rPjB|9?}UH* zjSZG@9DXLZ;~YC(9)^U|KvUr7WBW(68n1FYCEl>iOhpH2e1jN$vB1~1EcB_f$!o~2UQgZ&<&rDNk9KR&L4-bRi>$^bL#4Cn1~XlOko2ouuN z3{L>PrNZ^q|RI%(yi#zK?e4t?Jn0PtVBt!&z}S->IxV!3J&vHL)3Z1c2H^)93IfK%Lx zEaHh0huf3MKSO7+G3vq61mpUHR-9u7QF3`$c5osrC@2W%m}m;E|A-P9#azk{kBouD zWL3X;t5y_%+)_S$9zKNhx69pVz5xBdb`hgS=%+DJV=H{j-zg~ii*s!nxjAM`Fa<&d zd;Q`Lt$J?-l?{{|^BO;GB#gd5o1x zcRw1Ks3P;hN6IYlG3LKk5PIz2<7i2=NQA|{^14Bo50VC|JOLLZ)r`|*-n*!szYi#6 zEa}2Vk=H%Nj6g>S1^sclNBX?hj3s&oGfe&Xc7()Gvc~^D_qm?!lSd7-0+G$jFHi0; z#x~teE<=3tDI5i;ey+AAcBUQqt9uLl7uui7@NaU1onG@JPlf^KS&>?$7DySZC3^j| zHz4(Gv+CBvcxWlT=Uc;>T^226v+LZb5SKMTzMc{$2w3ewG!OK6fVK#f)3ENV*GBj@ z`~;?~Sv5c*@EerE)`l~HTYLAv#T#hkho;NW#?l=SP>|iQb?YI+4@02JlmBKs{3Y#> zqqdz$I6;m3{sX6%kI#Upfc}8{9(G!y>L}%1e{=EA0OKNmrjz>rqI0Dfcq$CfnP&Z; zLQ&(lcYwED==T)xeLm5>MQ(p@Z;%t)1Kf}_d~a@G16WcBtQb@2!*ALi&XURA_9WW4csQgPJpT&Bw z7W4(bwCWK$3oI%RcM1R;Dz0w`*@_wc|MV2m;_AHo&x^hLf1JdB+@^RZ4JRp-Q~A$w zZjvV+5Z6!flFM#g7TSE|*z&7fDoJ~ki0BD<4<R#ne&jWo>_93RD%Q zpszFqm*<0x1*mJ~w3vS5?F6kK{%_xqcQud{+W~bmSMcAzzX!gM_P`GzQ^1k3Pa}Z_ z&otE=pY8a71H%Ixl@Aaz3bq+Lf7ST(#SOkJ|FrQ|uATa0<l2)GVUGSyAo zm;cR|$Dqj9=o3+SSV`{x`~`oA+{m{9LRr)N%EbrlZfACAFg6h?&k%z}hAN=0_5x+? z2J;QH%zyPJ{?9+r4MP|K-uv+EjI*F;~P@5adNmXJxuS6&voym;cC78B=zC{?t{sD2~Fhj*XQ-u z^gZ1`$K3<%WsJ=XpapoCBN_nD=`34-P~))eVHMLM`ad6kLQ)UV-E~0gt5?g$Gy~X+ zz_yq89QmyHG(W9n_UOj4EsaIQrS5>4au)$hd}1u+hjfmepy2hIKUv)9P#f{ zGk|}KK;6nCjti!mm;~gqW4Wb660lApv=H=mnBD=nE3+-wV@taX83-|!Uf#YR+R#DK zaHWY9z$|ZZ1i*Nucby{=on#0g;}sO(M3f@xPgh$tD335IxJX)2uXM|lotrRVSH`{t^kDZ1(UrVDd0^`P|WV9lJFT&M70G@ zJ7wZQNtyl%n`#2zuLs2|zfl7Kn^i8k7H0^c%gd_(n%E0O`<8`2PJqyBruMiF6-0m! z<&B~@WZbKt8Hk9}3@ndF{(V9$2m; zRwwKw=Rj7MaiR2J;lNH4Cg5>gCm&Hrpez#rQFCfRc6n^b~wdO9d!eXaJXFp8j*A@M{ zjnQf26_xCoO75ja_MYbSv$&1S?4l#y4!)}2Xy+h%A3KsgCze~ZNp|5vY9c2P7WSGN z$+MIt^V{zf?#n8o2b0#58tpL3=6P^AZSEq4{b%*^NKo}y3*73-Y4uwgs7*iOk57m$ zliX~n%0k1`q6f$4F!QCA7k}gGhm-AqPbQ2Zy1_H$9Pb!Qp{2#-Lj+HFfl$&Tt>hVK zsdYM}4T>`OUiq%441cwEm9>r^SWF&RGC#~61S+5Be!Ky~r)l>HJ>(Laz#K{`hih{x z0LD2wBNUj%eMQJyI>ph=MXzE%=<-w)Z-){j0*Ut^fNr#6W#m|bkmoa~Xe2DV7|?LD z-ltuP1B*?nD3bqOFsO= zK8q+o{rAIOU2>|<)+YS<=WryhFwDW;ttU;sF<=)Ck`yCcjOz&VG-IU7(z z!LH#>WLEFh7g6&j1*fhrG@p!gjPj*o)^tf-m*uC!T~*ZP<_fpFOa67iVK!C;~;BP+r=lAPZ*q^o&D9g$o6{s(!l2-$I zdQp&d`xygedS3n5O`~7xfgh2|nznc!-JcYSZ%}QKLKt4=3$4tV?-aqxTiv+nM2;X5 zJgP6fm%jWm@&r;V4cQpQn`EwY*PjNNzWsdFe@pjS92TB$Rm7xS>M*`E z8IkK?tuo_-A>Nl$2k{Jrnsk$z{yv-@Sx=De6~s)UHw{LoZq{_$2p>5H?Um$I>1Ojh zYAo5{5;UHB)S4^)>0YuTQuMsEn6vypA8s+Dw_>de2scRsZCm-8C4eaHP>;SWK2-7Y z>XxA2^W!{h^zMvGo%)>DGg7IX>rh!PL5(DODK?mqn%t_2@*zUCYJ|o8dBi!2z)Yfb zgn=N3zEB0RK;p!&*HeRqquRfh1x8N%T)8+?3V3~tbMs6BJBdyoX^5q!BuEE#l25^- zkX%GV!Z~=NUJx*tN_;Z7oHsZ(!OdxAe$aI_-Y&2@`x|&`#(%sNm2@w7m={@~7+b~< zdCS@YJnd(+O0bAo$_dw+4nyQrB%AplcyPr{cK1awvcLzr}QgmICa>=l2ObM)@_<(9VC){|n>P2>; zt$qYl_=D3{%~;mBv0uE+CIHCL?R!*JXZ}j9l1H>|{AC0M`s%oTjx>4_@^$x7yD%o$_1eDggH3BqNPKUo!C+9pf>wW)kI+ukg#n8%@8-2 zEvEqOS0xNujVFpU4UXuPjEV!AuHKmX3jv1RI4SVOV{hH%1RmsVFBLKNw`w7Sav}uA2|vn!Lje_Mmps; zC!KIkSNwBY{ffV1 z6ZK06L03^ppSqk`B96wIMg&21efmXedw=GtKlvsTRX@!XJPG;SQ!P0#ly8S$xI%`W z`@o?zTH|-UW5(?JiuBUj4+I(`zT6&mcB^}!y-9u^VxN^;mIYyE?EI8sG#-y(Ci>wz zIik281O2)|j_-qx7xO!MOwGX6W53#|5#Mi?%dY?D$&x6h$G{S8HYe-<{$!41rw{Z? z_p+*__l5)yromr>w@tyTKI{d@8LyK!sbI|rx0sFV^G*X|tV@3J%fsPYwIG|8LN3vE zGTLT%+%$ymF`l(TE+4G05o31}uwie{W>AQjxS#{2CqVcnYsiz=0c;afOev{IxC$VM z5~V61;8XkcYzL%$lf+z2dl4O%-`P=sIQ-2dlV(L&2Z+Wfi;x0Ow*VQS_|Odz(J_DtpGN*tgu)m1BJKU|eG6?R{NhDpTg(yaUL z7N&|&dav1EsWlQNUBC{mbsd9VmpS~t9FGcpFo+g-5+gIx4%QaPzScrgBl&h5V?VW> zyq0M4bDaT=Pt>jgZBbiEx&)%D{4}30L>MiSvNtoKC)ICT2L}lcVkkG1tA^ScaA;0v z8;Aw*Jm9Bs^fOv7|Axqs6C+~#9Y}64?1Qi{Ez8JUO|f6|H>jf2n6O6r_Y|ABAEc9& zIV3N{2&LD5Clw5vqgnMAh!HyGbW-e;OyZi;pJPy?!Ad6DDKU5c^^>^QU~CibzPL#W52oCRLMpFDWnr0wpaVVrhHeH;(Pq>eB}G3R ziBGcACHsFVl{FhYBbAM9O=7@sU;DFa@2?C_eXjv}?V;ylV(;2V+N9+aBI9e|8+6!z zc?|l2o~YZObPc*QEUULS0{xI8I$iqClaAZ5wzRVozTC?H?IK+*0C}G`i zm8+HFe%>;f+`R@2qY6%2oe{J(rP=aDp3!lLaf9n70_6PuTLAWotrMt_+a1ySDY5}!z0E$ij;hkIq%Ukqhax6HLNfg-CGkdu&`F^QlBxrikP9vw* zh|3}0QJu!>5t!+vegYOKfPL6Ic;r|5fSwJAd@TLvfqz~NQ*{Q{JP|A>=hVozDs4s8 zP|YxrnbIhfLz1aV|HAr?0E=h0Cl^N0Rj>_Ma7A9?S4FWaPiwrF8=fUJ1s`@Rk%}t? zFW1kuk`r#o5kr#5apoFvsA=SuBf*;!9xVY^Fb>Ks{j%7dFGIIyV5_t3e&3is;C(%@ zX)S@{hgEm8t$J7R*h}|EeCJFVQ#LxW?6qR1@+ha@GYLwO?pfOkCMPm8Bho7t6&P&e z+=TiJQ!NH|8nd#~U(N<+yLbcZs2^;q=Z42>BIlA|GG7>z1D|wJDNX&(HE%=4I>@>< z6XBipWm9UR{v|DM_|P_W|Bsg>odmUoU>&96RG={paizMD6DUH9unG4$kcYZ-0fmGW zCCma;ka>ZoEakj#Qt=PAYVavrZ@{l z-4%_I&+|m!uLlmHoP{LqYd(Bx30t6wuHgU)@4hqr)%PsLa_*ZRmWTKkP$}IG|8v` z)3f%x#A16dzP^?zs%C0>rQ(<$>%qJkDR9J;J6xy4;{hQJb+txi|;#&Vt%3;ilLNoZDrKJRJG zvv@$)_JUzjJC|4cG<#gT_lHzyNK7xl=1oE0!Ft; zcQ_{3fVxZ{>IHJuG8AB0DBQIP#dGCu z>JIKCf*~aYzK7wP=T~q3IvIuh2@^o0i#GvDaGn=6fxr1pf%G{8?iv~! zP?(wbEX4LOC2cR8K<~M|3pIT8S~iZFq`130IbSN6@wj3#=Yk6i=z@@1`^Yte&$x}A z?~ z`IW-Cp{BM=*m418@Y2pCOy;?j>kv-OHq;hskgkDKA&#-1%s1&f0Mqo!0#nP0u1!xY zYd##pIjADo1wU>bC6u;&Zz2PWtAlZ-RS5pLzfvaZ52kabpIS|DAyw#fRaC`FMsDl^ z;UxQ3Ilr}4f8B3-IYL3PdiCGL7TKc%R*kEWr zXAjP-mQ1%HYCFMs<|=JpS8k+2a{E*X6y5=J`-y6YKU?`x@|^TKzxW8N7w0mmXC z3^)v{_6x7b1*b*!^)e;p4K?KO|4^#Da~vD5J)HuPuVTtLM20`8k>+QVGq@?D=idxW zl$#sl!{+)f-D*?(n#{QlzU01I`=D&p5kcEkHVC?5qR#d+zw=Iyr{=C0MGejs@wuVk^dmL288MG%)pMr3GScLzrobaqlCBrR-B!Y7i z9tFpyWVCx_?$!@(Gk%q?`M&%idGLdg2+^lL>O`z8;cx0YX%Z@JkuTh}1h&Q1?&b8ahJ=%ZjhlTi*UT+qZqOqRPNS}Sv<1Z0-M1QZAOP0zxfn6z+ zP1Ex;y_WrHR0OV9PYotTYNc-{5#%N`JT%lC2UUf=pp4DGJS{tcmg~XH+$FL1;>0TJ z&w(T+B7ZpSg`Z(rKlLox7rz2A*%WAZO*3aAn}oaK3yjlTQ3Zp)WB}@qV1-R`(DTgd z3f;mp%zGK1@93kVGW~n- zOm?|@DR=6q<+SV1e(UG{Q!bIn9LgZpDtbNuk^OODmKTGCs&L_4u`{*U+K$6a2B2m| zS7kMR2|mFml_J0&UNG*0h;2#SqSrc=0O>`{QO`1>q4z#8<;MJR`hab#>{m{w=w7vd zcdDd6hv#$t2>g!xEj2l)?(p~i%v{2+;{h`UgGq@A4h^|QuYH+8oYxL@_aNbMMF9mF z!pa3r_BLS6?x+_O-=$Frml z&iLAUg6%_YZ-tgriHoxCAz2QPg((!$@tY;v!ym?UPZO?L%j^SC2E#OX|eNB2R?( z&C!IP*FQNz}OgF;K%yH5>MVe4y?Bbm+kh9V`Ns4niUS~6O&qvL($us3lK znCMx#>L18Q?!RP%7UqR9TLme|06=C zXA2K1O+%SAr>XVYgE`smRq54G3OW%DVsHT+eo~N)+O-QoPH73y=DexsX8HKQww}c` z89R-|5P8~bS-lRTx)HMpOy^J|KmL=B?X{M4EJ&L8v%+mAmfrh))dYg79OXL49(%jdyP3sP6oL*LMa}XF!)q}5 zi%*G5d%0)0yQ48TIGjw&`sr5aA{;=g4i`Q?&fMf*CX$SEU>h3hXpb-Ira0Z_WgpoS20UMfG!Y*J2J(Gibn=49^E|_cS3n@z3Yg) zJ8`0tME}ZO7t%x)7m~C$QTK8q_ppGqX(|?|{2BY^0AphI>CM8oaell}0vv$$d}gxz zT(LlY|B=YMbT{23C4nQm(?+6K)1i%rxYIwn#V$kzw1da+7p{&TYMlsQyy#amdaqj9 zf9Ulpv4v?+M2O2_m`dGAa8NKv==MfAO6hkJx%t)9s_`@}}@1@|kRx|>XUh|_MZ>UDtE zP$jch-CH366$7+!oIVH5d>xajf^iD%{fK=lq`5%ZW(P`8`szy4Kx)(&ZLnz=Ya;S? zV%~8Z2<~|LFs8o+?1yxRD=*rfk2j*05s$Z&SxBFWb+)TuxFZ@YHwUuBG3BrW*OE3) zezg-OSYHE8=#2I*ga7tk(JR~bGm@hjQdGcz-~`Ck_%$oc?>2EI5PzQOLVc(9=H|!T z8W%JxC4wM*k!AN@ zlm1gR_}z%CR@K#HHWo3ffKUg_TU%n#z;u4R&&a$Guu^L9#JCp%8G^30br_g^J)@Rh zKk(!4ocFntFYA_kg=D}zR8N2AQO+R9M78f}lMLGYL69PY57|HVoadTIfQ3ZLQjt(` zqV>D;Vt^MIVg%@2nLhmnkF4LLX6oD%6`7H+lOUNFQ%ARV9GqpBRo(4w5KWp);?98q zW2=&(s09}*itU;!zCZXEOh7QE&S;Y_#3jQ!;CW=0)Gdvg&`#}dS6WZCO((9apXO6c z;&+XPwZ-z`I$=*n|0?zR=eadN73@vF5LNrdd;N%0iJ@7;Hj&x(x|SnG-R2`7LAfnX zjrX6=&N_WH=Ei$o5D1L-m;>-XO(c;ROpY&%=e;9o-G`dj2(AMxP@p{+)FuL}z3{tMtbY)pT|wbAhw(*-)sX+O+AbHUG46BJf^D27k_d6a04Wb&;yawNIOsqg;H9HP(BFc z*^c9iMva63=NN?BROko@2HN`|VC9|Y)HU*s8bW;WK%Lm;S`ZG!-|G3B`}A=`1{CM) zI&|{HIr>DKQR1m|;)}op$b0I(F>s7YB3QPHj@J{%->x<@Q(?QTq+7~z*KlzUg`18* zRm{F^nWGzE5UQVuLnA7bcG78E5s#PY{=sYwlK)eA=*o^bKR3ui~o2C5suFS+k zilw2nff=zenav>fAbJ4Z051(nHFr0fGuPWWT&U&aWpj0gZRcGqJc&y- zSqp#pyt6%&zq6orzpI5$MBq!HCd6^ssXRfdtw8Bj^qmdX;KQ6|;ppcIAs=XX@yb~6 z$B$Plg7=QV03~tSl6HHVwQ;N@ic+gTnk&S=Rlrqabd(!&E9E7)8K7!Q&ui zI3etpzwvedY^Qy-b#Ad%c_Uzm#^bUU`}cNQ=gubf1Izupu_<}UZaZ9L{A2ehCbNZ1C0oDEK#mCR7W`6JuTbLEMISLBy zXNafu`yJlDJ{UOuJ@TKU-=&C%;vvfHDLxkE30gChhrJ%TU|&`*dgKafR!`k|M&kvU zUOJpVk&v0SK8AUb;zD^Mn#CBZQEoKkYyL>}ol7C-=+3bpFysbOC6mEm_)(X9jaziD zdy-vx&UWfQbBJkB#;5a+no+Ig*2!t<2DnnFf5WT=ul7P_V!e*^ZX@)dD{;wIcZG9yk)%mU_vl$S z;-r~uQu5paQ(^NX{k-p8q&S1X+AM@k+Zr^ZR$&hn&Unuar%VgD1zE0^x2_J@l~=B@ zA6`Z<%tVypk_n`_0KmZ2@+u|v0R0!_ru9j0r5LBY1V}N9q2s z+N(SMoohqIL-#QmYoeBz1JeR^O=pvBrivxtU?WN}{aOt2fZDMxc1H@n5qSOs`M9vs zEDjPk?8ehL{Mfz=Gp>hoF<;?F=de6!y!B3#P;??yc4Mt1@UBEJ7g;#1ruwiV@!sQ> zW-Pq5jo~aY$Y?T+b7_5t54j&zu&f}jw+2EHtoJUWA6nn+G|i2nL#GGBSB)_!80_3GWnk<3=EZqH`N`g4sK zQT43D%MKF7pYS*hMIaUCX848UnokdwATuN@ zf+{$*f7zAm+pcunfGD*9R~T-eZraW&NS)xn18YL)%jdY4_X(D0AJv(df3 z@A@7f!-;uhG{-?L+S z?P0_7t&CEpcD#kH{VXHE8dzGFd3}D^p>{luFPE8L? zCnwh_0vK>BUcaJkHs@}`ney3oNDtzo>-wC&hLJ;=$6B?;w^f>vCPDTy*nfE;(WeJ- z+{06FIBlNB=nW93WO_r^qa}_uXD!6~C8SUF9Qt})HUq5FL}y&LJBdpn6eM-c|F%$$ z^&mLdGd2TUb9QsvO2NO@Fjt^Se6{}5*`Vyvz@;12h-(s;mzh{NsJ)m1k)&c*DO7-{>TbbG0#8^uc;<%Jz%qb%zuIRHo_ zdOx)NJ~uDJ;H*8hZMpgsP?X>lW0FK%^6VXhbBqiu-)$~VcI!_BS!Wttc^{Z_?VE&S zFK=uDn~uH7D$q_lO*d6hbg%AuUT=T%CJgSM9>ToGpW|6#-p89_5)rT`5>jLc8NRCPQFD z7NC5kG!q-xKm}9Xd&sAaKd$vxILSa|*{pioidwHqhu3+3`Li#_WGzNNByjiJKRj0@ zd>D3xv#xbMIVQ0;Ao29GUw^?`np-9BzO<@YR9>KZP)q`7_T&Yhs0MjFXrkE^Qg zLQXcxgsoTQ935Trk2Q=u%3jv0ZoaMZj9ix&rNPDe6K}BM6dnHLwb>4@rf&Q*O&_Qa zM)RBfX6-YYp|yK)7ImGWHWqcl(IyjArMvF3O)H~!kvqJau$^!@{>TO)3m8q?(2KDu z!=Df_5%SHYVA#+q@6!6Nt^LK{fWzMicP}USJsm%s=&x2NK+3Ra;(4->3J^76MqEw$ zyP-Pd7lD@GbUOaVs?_BzhBK8o036LDJB&;VylS$+Jj`3J8O(YHTr|6mYKQ1}35XRX z?h#j9d^jNh#mm$nJRE|NzBn-fSLW^wN6`6|Q8*K%I?Eq(!M&oT*rBNG20w)IQMurl z4Va?(7jk4nyoQ!8VAn63(P{IJ|K8vqEJ%6<^m-2!8MORR@5#<&7X>P5S7l*XFqfD? zqW5P-Wcn~hnas9WbCd!n)M`izLf3G#nhURSf=su`7VGLahuo5S*QMLEEsbX6o@JXC zKr|;H00rmHa5|0s#ua|OHvy9nK8Eci=fDr2Vt4@y50Lmvvw0jh34Hi=1`x{;~;V)NSYAOwsWHDBX`rU%!3edgt$1JepQpTA{H^KntMLT?&~I9pCch3U40!PW`j}gmKjI z^Z}YBu>6a|RSv7tL3i>j4u4uXM0#&<1bk=b=4X5!l>*ti{5SiW{m3hsI5JE0{6*;_FHP>D?)4gOw-vG=GJ3;tqWgr^E+*yE|)Gqr{uv zGABPL@kLiTP|@$DUZhSMsrvO>N*Wvi;mvmP=HIB3F6BW*6!n zkQ~7xa*B??vs#shKGn%(k6g#z{3zV_UfX_-jMn-E-HG7z`ElWSp*g4h=7?;?L%J+! z6dRGA_%mgLvC(~fQ_uh$(;l^>qd`m;xd!v~0!j$9kb) zsyX4@zt0B;80~rYNGz8FGEZclw&RX<+@ZHN$7!i3eM0Xes?Ik4sv_!p))YZR9r(#L zaGI>glG6OKP8PBeO3O5dm5kGjZNDXc?mWVoOmwJH5nR0g zlbn4^VAA?BIpON^`(SiepCIR|KVstYa$u>JnfCw*53_8k3j+Ru+A1K9NjhQGYl{Wc z^@MNDV}h|(2t?D%AOBE}NZu+vr8&<`S>xI^EA8h3Xgq24XNRDx*{I@}oc6Fp3^TX1 z4vS3bgjN67WWn(YN*aGU#DqoFt>T#xdjW1^TGOqw!IemKaIxdwCwXe$?$4C?O+ApN zyIt_gnv#t3P@PF|yxlpP%x}ptGx<*7%bV1VmdB$XN4~yPlU=v*PsKT&ic`MD73=ETo-|PL zJf1J;w6=}#^Ih4AvNDD^B0ZZ?x5r9cDMa>>Fk&?qOe{gq9wWzcfnq=uX%Q&jp;Y$v zb+hRExMqyObxz&tDN=lkqEP*2aNrI9&X<$teZ$PC14hRg-){8;sv_@OL%`R*zBn{i zgLl($VBzv3#?ynYZ=kuHdtLsO0N=LtR&otTl4Eai09RQJs_7xK`QPxY=l(#@CUbq$ zhpe^xj$o290ln=<+97RtXn_V#m{OjUj|G}?#hK$C3J3Amt4+xX%2E%4=WL4j(chxX z|2@4|=&(5|C;yKiWkhd=r>iT%rziK^xcwPFH+pvlh?Uu|M`Gz$qXZA$q&TMV>;cnj z{FANTRWZS{utp@-epGE3vrcVrUZ48E{xxG6fV+GdM;5C0*HA!I!Q`48~I^GEWbZE#J!M>$>DJ(H@@QbDY5 zw*yXK=@Ukr`U*OyFG=9?$XPtf3B zyVa0>&PM``Kk;>dxpf|7rH*}B)hNu0KheTyDNLRlXeAZA7uraM2&Knsk7vt!x-;;%yn}mq!s}WQ;4elf+YNrWe2;D>yJAuDz_|}p z!w-xu@3$-9hhs4EBDFm^g@{{v{bv}bGlx~^eU8#HyRZ#)Kh4Z?B_}EtH4#+zn(e&+ zJ|g<`0=o?gc83c)Sqpu_=XW;CPdU8H1ww{S%@um4(mj}yPETv^P@7dwBRA8RI2EpqANt$fWP6~s+;qaW_ozrWD6sXKqdt;kt zG=1VuxxJ%&AeDQi%F)L?=f z!kjE08mkHJr-(uE9F{)px)*i^c6wd4@~0*jdEh?ggu*xm*jydD>Ac~fl`^b7nxw8$|`|y{L z3Bl$#!Xs^sNaetG&2e1kdoo((2?Q$DtODlJPBAcN*?*tKN+kqPSb5YECNBpm1fAjAj_wjV*;;nBx48; zNaAiNRj<6T?ODigC!8#Myf~rLtzOZq_IAAd)OmT0y^btAE9w%sFE~|=Q@z!BBfN9g zA&U~fhKZV^)R85Aad13g1Z;MyYk0Na;(cjGsJ%WqgM7Fve@cKeIf2U(q>WC6w_V7a z<;OBPc32BA*6bElb_YePn!e^%oIEX5W(ev7Jbm?|LP5ds-20FeBHLC5C;M~PXenZ) z?^#hg74}nbdAE{0aFk`#n6IJ@$lyUAfYi4RsN*<01V&$Ovy11BV^O4yaDp`FnwpSG zYkGSu+{>eidiyc*lzj!~-7?)e@~|V|-tLs5C&g6fIsMD&0&LxE5N^8uL3y|&aGA1a zy7c;_T~Jpgl$OkCHM9AC5!JfBzmk7bsVeOU^467`D|jf9GK-9vXpVN7`uVHLZGii( zrO?%(DjW-EKp?4v*6%3UbhopmET`6u1bexT;IZ+-UB9Ck?ES`avk2t^SAb;>f5dG^ z2;N#tLnc4-^y66?j1`=k!?Is3vdGiQ4Fq$k23%V z{P@oM(;ovRSRkZgM7RO>N7?@K>fq9pglO0d>qJ-QBp`iM_9wXz6d?{$O}t~^!*~%Q zsQdF(m|Fq{%6DH#%rL&??psW)%T1-3lk(wDyemI9gW4_zg9FC9zQ3;Xt0i2wIoSZN zo4Y7;_L|f)UYl-YTy9DEVLG%bcyP9*L5Zz7Cmpzy1i~~0RHZU}DfaHgiI)Hm#?j9` z%9ddvD*v+Gc*+pIA;F{?W{d~ZoT-O&7&|B;z9~MR`G;p7!ZVm7P`@QE#Z`@QBcp&} zCCh`2mf&)kR?xcm^5!X!4A4`5&b>{O-!3d7_xBk_Ynj-puy^I66@c+kMZVgT3c@a6I5}|VYgGPx5VlcjGK@=B za1DThtp%$;3QE+KZXkyQ^-+%!lGcf+T0s=Y>OYUnlmWKuj^n_;>IgG-HK-#p|E?pl zt3ZuJ$?CHpwo?0Y7gu8vbX3jGor_MtA9=B|=Cypkvr&ZM!!n7xSxfLex!)|1Jl@QV zyj?#J?vtNxr-r?E?pn=k9MWk&3Fj$zV=)CDBO&YdKEFKAWaaF(*90vI@`-K9VrK;HfDzn3F0mEI*`#zjygZBiu%BI}K8d*xh0sS>qP%v%MqY*0{d-z(`~|IPZ+F>21_COYO1!aaU{mym_L#+B zA3v6F@Z&g|hv<)syNb%(JYfBe3lBN+Q|qlk2)0=Ej5&#@NPAFW->vzI&%U@zk`V*{ z5l^{*HpvbMeg7!_O_8;7oTG5}7`Q2DhMtm)FrN1#j@TV7mv6%6K{MV{n^Bn`1OmTP z#8a}2b5tA-{HSBphgRPAc!(OD`)RR&hoe<~I=*s0EqN3q%_K9Q?NO&*^0buG{v>wz zfve?4jg*Cv!crghr>6lSp}`*bwImMm=$NHcPIGx_%>IO}#%|jhQ_2XsUm=ppe-4Il z=%1~$B4&I=;`$~1nXoT7sZAk+9r6t2j#o_9h~gF z?xr9c-MYZB2obz;a-9;b(2!s3{-rnaaf0G@-MO3 zWOgUvq;AE1JYI8II|$T*dd|CCVtEx~qjo+B4P7E+r@)>yx}@_M{Xn_u;QVv4 z2mMG@3ikOxU1Mz@&OlX@m;yr8=^34wGA0?`$(Zo-$BLK2--OP2cS+)n652zBCE?01 zzv3#4rf6A@w@bP!R%3Bbv&f|=i=$_L`aI9Yl0XSHUZZ)nwILf~vY{eDT86|c9S zW|FL<)MzfCLnii3DP@Ane?qPqSltOI3wXsG$q5M3BC<3_PS$IwwJB1iB>Kf_*`?av z_v?8Ii_Nvy;I?_lDB#N%bY;Pg?{Wbq+sWEV*vwUaC!X^Q(FC%emJS|9>qjQt<`pmt zNfcG^11iUc!D`&yMT%v8?#%w)^EIUd@i{m_WR=H{R`s$o{HVllT zqn>}ULmZtG+g(CYtJL6p9lrr-&$w)P@Z8%cs2*SDtxp7GBWGmjMb%teiV))(Kt~w$ ze@_HDxgf}eovZu1eL?JjnuYn)?x%{~6BYdIdJJ}7-We#6qw!gPH`krKqpCT?IdxZn zy_M5*NR6cXA*{5Cp^xBoU_-dO3nR&;aqBasK<&n%3Xughb0K022|pP#O@gx-*`>Nl zdbYtepQ?Xc#%939v-N1Bs3>nKtBvoDfeih+&I_-MIuPpfDw%e{QRMn<5Xjd#Rwq(h ztPI2@(?78#A#7P+L-JWi5Min=(H1{-5h!5w`KGBhOc>F~W+y<7M{Y;rjj*`ljk&%e zGnE=OM;Hm*w6wGc2ug#BA_9Vdf>J6hy1TnUL_k`QltuxiQx+lJEeJ>>9nuW~zxllToPFN! zK6}6WjQ!7V42NSGz*z*dM{u8k&=D;azrals#i7`U-zH-z)tE%Z=LTY9a6C zf|GM+)!&A?P4g3X_-%?VoP->`o}mFnWHw}M{K~hdDC~5cb^h4eXX6ex7;*Z0 z9!fy}kNjHnDz$IcTR{fMROQTP!FPUh>5*7^4z;Ihsk@3Y3=y*3(^KtD^c)t zz|eePry)u^-F~Oz8AN(@%3bwtham!wYkzDw#D%Nvk1DQpYr{;Bdl8#p7*s^>^iTP{ z%8y%YzAvqr=Q^r71e+T%3r(z8$2uwr<3|)1*1xKE5#ZzZfX1lB4Vgb~xP z+BOhLZb$luTK+6-X=5*Jz=~Zb@XG5mKTPEil9O?bei@W5ia1h(8IJb{;KmFs@%XA_ zO+UtEY2R&HEL+U@8$A_$*OI=?*=nett42UyC5(%M1gFRtH|Oc~4dbq5(W<`DMu_;ra2$z27+=x`+%QGmTn3r z!J3?onPd$#e#2No>}R}%30%|r&J1>*rF+<|MV-2jQi$nC-yD+hv_ft&<$eJcop;{YlE#0O_@|J*fR-Kl+dc53X%3!Xf^uF zLEEsX7XfbF3(=NBUHOr2rEi1zFE&4YgR!PMW-N9_gR-AzD2$3c!Hbz|{xln>!cN5# zV<<1H(*5^EZ;If`N!6u}BD=Sa=Fc{$x(UEQVP3`7&G4?t(Nb*xZhXKvsfs-q#4|q&>ESKeB>%BI0VTYLf^*>CgN9TnRs?{fc9ujlNnmL~NaoecI*s_@rjx{p_w zRPO^?;NIS@9O>a4fAx?q4?SoTr zyw|&Vg-uuo@;_h{Rb55R+gk0OQD{<&=K>;; z6PqBsh}{v9Pi}|2Fvs^DIHBOlhC7a8aC0ayMykaZTSbWHEH__IL#AqnsNt!Ny z`@s(gRxcu-*5Oj@7rP+xLPIB#NGV(5+OY(=dob%-qvz(VR~WYFY^6!`R~ug&&K{#J z6+uh%&kKws`Dl(5*#O)bG`+uqn#|(mrSfG_xJ5;JtQK(qoY5AyiRF zACS>x`^-CK_xCf#?ua27Oe%QZs(s6#$gDo%mE7`(b2cfKtRbfGI8?md6-1G16};)Cajm? zs0Z9AT@&3Nqohx9Fs{$0@qyf@$|*syQuVU@4E04Xv^Jj>tMJ<1S=W`QS=%cFv87yR%+Pg+g|V^c>E>(^S5_^{BT zDf?(%Q)2tIk+nks!J}5XxdZu>2L2~CmHhvja3$i7Dfip!D%LAhCcjR9mfWZ67-2wi zF_Por_BqaeOuwo+LTMDGo_(iDDo*Rn?0wc`o`p-77p2?;zOzQ28wZPgFFpYRDzo+rb7-|bWm){i!%i8{uHc>bGZ53G1j=i0jUpPB^s8Q1F@H&l+d1WC zA#bSvy>8XNenX^0FL%Cv2oY#=TeVH%%d0*qcZQjpPHdL=OQ*BiHMbC^q}MC@v)D64 zXlSyMWPlT?ruHmyI9ix%Huxy;W#LD^6=8srDqfw+!KPDE5gRzjWI+uz% zc%{uY!k%wmLQZmtj7Vn=B&%$Ow4CzBhbwZ2jS!l-zDpB<|IBHh6;!}0n!b{M8`Bg*?<9@oGB=YRS_Km<84pO_57{-bZ8rAM4hJkgS^ z6cz9veSPv-8Ja*fBFCa#~&Z^5>)J(%B@&6IaxbB z$y+Z+vRfe9u7n$3_8)11B7@k!pv^f)f4VQJ&2vpA-Uwj6A$2zeAOGw1?!SqCOvz%C zv|;CHztx8YOm%RJd7kwKoK1`}bX}HwfwN`RJ1G}t!@nR${QZNZTEZG+99-GDk*pK`uaJ(%LZ^@1R)e9?79}4?Gr~r;1)jDL{nTL5>qpQkb!9)>HUyaBk^^L2Z=2c5 z^E}Qf19skxF=~Ir78WDjk9!LL77Lw=F?w?2Y zso|=W-AtII#FRlLcefD*%xc;%3I^7xFa_BA@HX0OZf9v8XBKyWsr>_&s{Cj`ThPw4 z3>l6NRgG!^FfK^V4_=F)_xJ$DkoK`P+BGLhJCFs2`_jG`!kGO{2x+=UseItNS202B z4!?0Q6Z+rO^Ud6YtxH9Iw({)WbVKTMV}d6?gfLa670N#{9HvKJms0q4aJ8qb(e5qa zu?F}WKr#b=KIscmE#v&pR`4KZ$zERp9+fp+`?zKVJ3c#q9hIT{%ZdghFyf_Wbuz=V z593FX-t&^zFoLbG2Rciz$>-I~RKJav1h`U$p*|GaaTfP6r zz5a{mV*vK^Eq@eypdmb0sIHvh?*Sa9#ax1h`_2nnnA}9$0+{~Q!6cUOLdbCfyJN2o zekYCncX`fO6b>H@n(1d7F%4AX&D1k5LGd#g@ijTQ1h#CE3QIPxBwM@wFc?J>AgnF{ zlTXdUM?>8R1?<-*H;j>8W{vsTtXxcw&LV3Mz7Rlv(dsLXV+j(4W^nL!4$xJBk(&<- zX#K2T#;LLn)G}|;pR8lq!tuElv61|{1k83ZFiYB@(OWbIt0&0xYSU9l@4W~#srQIC z(}Dk@z8|bIw}c2w`(O|0<0Y!8u^uT09LKQz6KCV&{qq!RJ;J{#2o*{>9$_QwV=9}@_SFOJ)!#-3Yo6ET1>xvB`U?*&bUbMdw^Td*(=sn4$& zwcx3*O+N3(Uxc-6*(qC8d15Em@j!ge!|$R|khF4R-UvSfNn71Q(q+kG9ygO}QMlP-NwNaUmE1PriSM9`8`eqFw2{ia&Z7zQwF{6|bC+(72L_Kexe@XajTy^<# zK@YXL_;OH|{yhU%2tDD<_D!t)2br@nB zS0BE?X=HoeApQ(ukSIH6U?rpZ0-vHt{*IT#48KdXZ z!&|a+pKZ)T@yuucRAA3B|hw}cDgop<_AWpX5 zR$Nr9Lx3@kzt-F)&(d=vo}FJ&olTmMEbI_HLO>KFPBsSbC1$Q|FGSlU+2H$^aUxhqRcYCe~=l4XDAv>OIHTMNEdfwCs zo!-@NKglmCo)!Px9>33t1r3`^Bk6FhifFrt- zc?9H?j`yayiy_CfsEe;}iBeCx4CZN4hngG3s_d-JmrV$%@zy7B*THCjc@-dFcPn1c zt3DFZg+p&JR)w9FnJ#qAb;)%)|Ceif%_Ancp#;v+@3k)&M%iGt&GV*J0n)~A_O$xSN^T`_ zj-^0N4{slV(I}8FiKX*H{xkOj<2c-%w7LHgF%$#bwP?- zXQ%E>8tWE}ur*m+qfjwoD1uC++43hlvkxvrSiF@*3js6fcmnnL{3<6B*Lv15T&_cu z68JP(99+689=ISjyH26vX@qIWygvMT2S) zE|lx0Jn04$ad9x4KFq8P_05>aK$nVXPUIWkSKlN-wS5@x`y|*!R*~adw)3zLH(k9QF%9GyhRusKsMuK zXNf5JMqh}D8mhXHloO+QvKd{F3bV_?$BVKsHpR0MPiXPJX!NyVE6q(AT{WqB=7$rc zS;aE!bIRaZv=m&`%HA0BsCdZiaI;Au*e#WHc-oMNGx$V9FJzanEj-Xfh zv>VBqBxFKL{vNI2quRRNVYtEm%Jm1OVf?o@;(}+zHO~o(amzl&5^P?tTEfac`-2;{ zuzX+z8?J94?`F*=iokc0sZ9__v|n^w0pDwNc8u2I`-QbyUg-yawH+409Al9is7hvy z6EB=x8=ZU9>bi?aimjoP`r?@%ac5;HRz;6_>(crW3(W#V$9rBKmqjqoGvz5yD0V?G z|79(?)LwT2c2o)wmtHJNlQe_1aDwE(E3gS^1pSohiDr{J_YD}7l*c=Ho=;o830;vj zuRD#>Y);5!UAQ(J{`eTK%+|*z5xkErr z#eD~Sv+B^>qgGhWp5P`Ao>VdI>A9w4k@}h_Wp#rEN76lTW?r52khf2ly*L}0 zVeYuO_y|q*Wzej0qiM148w4rNbTN)0=EQeRq5F_LoA}7{U^e^1S!iyF$ssHi}02UVd>UDp&mK|ga9GjX0YmaoWlw$|$OpaEc2&PuD0 zQN}{7zx(RDOUAmIZ3C9#q+dNyq75^<~ zEGpdu38660&JDiM&|tt7>g$_)596Ttk}{mZRb-U3Y8SYmmxOz(%e0FAXPK9ykSERN z-bQ=`Vc%8x_YTJEG_5!~WW8w{`Vm9Xp<;y(C6wVQ>MR&eC}p$eb5O=gXwcRd@O^bn z#ic<}$tbgNRMyT=gRM zpdZVydFcAl8_()C^r?fR=?;p_t3NRp3zg)(bN@GzCF#>xyZ=+Q<<*P2?Dbzo-Q`9T zIXQtHKQ{Vmmy`rh%YkqF?#&mM+>JW{Bv!@&zzut*+j<=xjr(*|^&aC`C^K00T)_z~ z@S#>CH01|?M-`+yDc=aJF99?&a5Pipd_C!QaB;&I|EQe%4!Z6&2{x8;JN7)l(pS;w zs1SNC*z^&i1>0!gw(r`pjWR1X3}VQ?{hce>45(D-190G|#E^E|p-NugLO<|kO>fw` z928fNM>QR;nJDK@LY_W(n<6TArXKf{{Op=(5R_&QF>W;(2KRkQ|sNsOi2G&P`;zVHArMfI1(CdhfWAP7?QmkBwi z6#)WE$(fqIC7+JN{paj@Rds_k3dZUzrzQ+~cSMNGmMwx2ISk-Pl_=e4EO@LwHRt*pw zs)At>dj8{3!MJPVryhtqK;2CF{0-KW8jeKOyQ&U({uMy;#0Zf6( zve-7?v8;!^ygnjM0>TZ!C|U~_x8+#5Unk%D+fat0#B|kNnE!L?sP{pi!tyt&RB+Au zT?qYe*mAs4_Z-ogDO1~3cM;`DeX`zHn`0^P!@=LFxZkm=Xm5i#iXj-4z+;sZPjIqx zQdUfiLz=>qF6K{Vu{oJelPmV^0(TX88TIb04CHpHfxVpbkMxed^rw7sQ%!_*Iv6Yt z?Rcd%&YTOQjfDsTDCR7|ohu=)aP4Q#u0HF-2>5h)#QaeO^OubuzEPh6`{oh2TfLKG z+1M@c(Mxmzv?!GbwH2B~^C}yzCG6aU4R&8#-GVE|P@a;`??74ohD?U%8d(WO3&7-& zEJg>&2t_Gh3P`sS4!+G6g*9#SKuCzS#ik<24M7#>{syH96)#MUQ97`HrT)UUc(Hqj zZ1TF-UBc0(FV`bzqs^YzhC$y89D?cX>105pga- ztn(!IovzehU*QWkF%H5CxNFqk{?=L^9e%@{(y?tN#(HHmiB(T8y)WduO-5j0txr1Z z&<^QO0I&qQDLvn;cb281W*GQQ!)SFMq^Fh74T|im4^ux*_14iUD2g2Kj}~xANyg^- zP8ukYa;dwZyS&*xToWBuCv{$uldRqvsYl?rixSOru4Yp%EyT0IAgBc9LRQ2@&O0NQ z9>%uLlC0JQs4X4l+WjP8=c*C^*u9EO6v`@$Vy!xv3v6r4Tdh7G4}HjZK6Br4SRAR?hpUhFQNo|>q{twRI4m&JiD+oik@bhFvY*OCvuQwaxd2H3)~ znE50}z@*UqF#gyv1`4!p;agYtmOE-iL$|2bBw-gVJyphIF^XngcAo@NZb$>B?N#%{ zdt=$YlNEhJF#b~%PTG_CX+-GVHr$#X4l{#Ex%I7M+B18d!3v7z?8M-gQa5DWPK_5spFfbh(84 zkuG_R*y58>d-Cz8*`3UnA3V-s-PfgEWr$LD4L`!sk@MZHhw(Qu|3Gy|S=Pdz&fAfB zZjFr(esa*RpZzis(tEU6II^{HR$R()(Rx5bsn|zHhw}XO{D!UMN90|BkyRar67MlW z#9F_9+ROf(KHcy>XWDCiEk7dI{rm)T6zb{?g<+(9q?XvYBv<}u^@mcT53vxb##SAi z##KGhA&f0=k6NXvB6A#^mpZrdC(?p}$<4`7|K6PsUr%oKPH+Kd0{^K~kDEzwlE--A zF3=-i#H!eT*E`xCI&71N7>d^IRX@7p_Yc2PPkkMV z!lhro`G36(v@R&)ap74>v)~YMb|T>-rAgynxXH*?d1C^Bjth+~>Z124`3#;|P=e>x z-BBiDg?QCw1siP;F{e$4ujWYR1IX9!HEArbSV@^jQFH2hX2f0;w$>*2 zvVGM)w@Gth=Vb47po0849vyi`hvWO{dSfI{~S--otx$&xkHqrWIv^8PBn_xHt z->T>c{ugYo6iL}fd4?|yJ8GQqJV?HBG6Gdkg6ml2w(>>`-=S`l^m6w0)24pf=$l6d zj|fiCq$b(8vBGTa-5J4I_dHbYI;#es2)%hy{VQeZ6Wa=3o`r;TWz(ItBHRs+?e%)X zdtpw(>gFZ=qt-5x+1r%z3eu8`;KAxFj?$%< zizf*J{ccOok^(|gUK@FPehmiK==?8>N?OPV`)%g^imZt>D0+(Ej$#c-R`G@DFZiG$ z$9oa$2#6eXD~0&h&BFyl!G;-dzS`*t1%+J!aVg3-XjYZ-Ep}RM_DcsWW{!dgV`RuT zT*T|)=-jnUU;20uFl$glys~%kFh$$He{xjniKi{NGt-51z%I0z)?YO8uBxLQc90j* zaA)qycJWgPorsd_7JtCL@g6{yt;b~UPH$PTR**>&wd* zI;Fqa15^3iu@yi<39ml;5K`VNbkzUt5jaY_GMs&!gg0STy3cRrdHNy7&f~q{YP8ZR z<4r;Om1gQ;XJ{P#A1@}q)Y?N_b~}bitRR5BH@9Krf4|CkMi*CFF8;EA8@qMNtfp|g zq<;3mn`It0&M)aR1UL>__N~51#DfFB<8nr~^h}2F64qNgjTXMAAKjbf#$PplMPyY8 zwa0ORoaHSwz0=?bj%{Hdz7$dJc0TGMX4+Y6q{@xR+~JbdMSm?hKH_Omei`w&;yl;Iy$`%2_L=D zyH6k1X6h%-in6-YZZeY^60LvO1_nepnhr}VX!jm;F867A>um@~E8h~L!VjnEPcN^n zft{}DWRl&2X!|9GP+BK%nQ=o6Op^ztf}{vFo- z`D27~g3T<)`ZVKg6Xitj+q}_48S14UH)?#tDHLSJtRH`{^kq+qOye0)9%3kkYexR$ z=HXE?SlD1KD*6;6adV{?0a=6hz2z?itPLN1Fh(BONXn(@lZHz&#HRc7$UG! zxb?i(1SqUecp`$em2)-Gz_0I6kmev`V+K86I4H6_`QrKW)ToizRFCJiF>nLk z=hMuq-UKz^UMF-<-l{%FiHp65K1_CVk{zg z7G9U!o9QF0A}inC!d=v|##?pT;5Y95sCHh6jbv|Qc7MRaj7r!7A{7JFuBVS0gz7jj1iDk5V`e0me{ z^J6YHmVG%FM7h8v?&+bCA{b9#Y}%aPl||cYE_LK#KcfVXmP3OC0CQ*Y49t#Y$y7G& zD@V}7Q{@xv@|UEJ*fT$TbKq>alVm_Xb=(rY==tbp^U;xh@BU)Rt{9Mwg`k@GR4GsJ z*V=Up zU-E|MQ2S=vZQ?yHLXk&!Cr3c1*0hlmo$d1&753mhDodwPp)TG>dJJ5ag5(#X%K>a1 z^h{$jGSRKEsPdkeGmhdXw?<0TF$(f(be6rXUieo-Lx1QuOjCA|@TE@6mm<;fWx!p; zZ*qMNXR+H1%$8-dzNuIdLYmIAkw5U+*_$2^5s(uIZ^d?_=P$Agi$Xrsew(ewdrS9a z)wv!q!krJJLfLaaCQmP#PG1LkU|YCz6Qv<~ zq$ZP|U61@ct7P4)+*$0>!5@1$-;GOmkZ49F3(D>vK3* z(X=)#3QDr@jX}D<>kb+ma#)0%d zGiv+_Ycr9Uq1ex_&!>IjUClWfFZRYxjyZQ;hSiP{tO6uyQW(+Ga*9P576w4QH*qzZ zykQIeciZO0gkoYkHR^gY4)#U^pFhC;psUzrAT$RuN4Moq%EBQ>0fSBkQP>^=DAw(> z9%`N-=&MCoy7!73{Hp0McrkT!G;vDDre3E)`^vW?h`mAHe)+!aDxyxyJlMz%O3keh z(PqiXcZBZMt~>c&`vp?f<1>xQXzqR-IbZ3CXUiHXvr&}MqI;b^`uUr^y8Zc00&z)i zM?9tt$G<`*2yHBt{rAY-SS8613>v!egOhWr#aoeLTdT9xrgLeOog0YvbW3mOugy*Y z*bz1vam<)F&#h99Knfp2(wgP~GbV+q^_pe&W%4S}Z7zQUV-w$3C|33twTQAcoxnYD z$jswGB`kZ)SqT!c4z5{#oo{veSVsER{QTH_gv>ns(PB#{7RL_XSI7}d*8@>@W} zg;nMjW%3UJuwgn%FN+RZSYw)#k#7gofnsN}`gKnu`dqFA1AlwKFg#nwobIYOkva%L zzq?7wS*~L%aw))Kwqoa8MdnY0K~P0q4`mSl7aAodLr5}v8t+>%EqGptsS-fF@sYwb zhC6$pMAc*iV|0Ulv?mJtWFI?AVR3Q~Tl0W3p-XtTFO4JRE8N6$ATn9CrWC7O``Gst zXp5`7_^~ohwOv;Gng_0jwI18E*WY zoV+E|-KGi|PORr3Y^nAiJy`z`wJJjARRydex|iV>PPE*)xXfULv|#7HtHO>2t!khQ(Uo&FX`|(vCJ;x%)RqIC=Wpxj(<=ngHH-NzR|C_DvHDOW`!GMAaETQ5U?EN?06vA)Sz+p%dMZQCBM+AEOD9@BFdao(8$gnE zx72`B{OOZdSzR6&1Jd%R`|Y-d3+)a2ilk5&8)%hup5Px*sz(fZ%!99~$Gu3C^1}T* zo&o&#(W%Qfo4T`)jJNm7|7$_a3b{1+#qo8e+d%MM^NifI+n8Wl-X6yn4G@Sn?zssB z-}e>QKCP#q)-+gFwWXi&4&mK15~Bj_j;{?5;a@M9D@;8~{)D-_KM4pullB`}aHM~7 zO&$qfA=S7UAS3!yH@9rghIt$)V7fkx6hBvLat6StF|VU_oD%eklvD|nI2T8C7p#H2 z_4+J)ebTe$DiaEnQ;2ui)r3`b6EAQ~$>x>num_HMxA19Y>`mkF_Hz+szS{W9y7Wge zNE+9aTg{7Yc}ZIRWHTS`Zo#b>h;?Kc=Q^Bcd(5Do_=1>qn8vQ>fq1HbW0#|~D{P7y zIsF51tikj|b?UeLLQy%5)w#Qj%Y9Kg*Tagq&Gu6UuQmciZPhv^Q`9QL9L~#IKd02H zjG?%1=JczexdV3YE824opwn8l`B^EI!V0qcaRk<#;A3s-Hf7DeM>b-x z09DBo0x@i@!5wE|QD%M>UE-T2O3kg9K6b{WrFgG>c;K_6Cf(98h{-ncR*NeY1a>UG z`O|woV5Q^v*>yL87Uk23KI4V!^xdd4U&KQbscupyq+yE2n5Us5dlM%E^Z12Qk=efp>W03HdwnUM*m+WYY3-UOD zOoXdzrkY18Oalilxp$%4cGdd+VlOS^)!jFK|K`#xe>B$25ws{SFMQF#;9{6R9lA%D zUtydTimRgF!0`Hh9iFSD5v6|A3&kJ$k@AYzMRIMdA1)<#6xLf@F}uj9y%wRqOTgHH z$sp2h_PKg%Pw8`E-pVq=!QuE`-n_HsQQKz0c3(a_eG+3-Iqz%>?%PL)vO)(;JjXC^ zP5+n$=TR*z&$N%(25d2{%_$$V1UwGAdFaPFBi@_Rk-ARt=HBxJrqKYhk6N&84f?1K zO#^SF{TgOxEL`(qlux2dGIs02W>9!$8{dr;&+3N<>06#yBfq|a1nPyd;+@}H z9^?{nJqEo)rHfSjn+R#l6P4n7A6K4VntlF`LOz-IDD`3-o3suQ+a>8&bAr|h{k#ru zbe>;XReefzpEDrxo!VeN$qINFBtlTc#f1G;TsWa#teWqCztOLpgvXl+C3S<1#!G7t z=qB7UZp?AH5`}F$PdObv=eq*paQu-PQ-hP=#?$sovz;Q@m=bz#(kjpB_Zau2BfaRy zA3T%C5r5-5@;z?(Uc844>MYo$^ls}9z{E-&WA~OLmxR&HC zn58y37JuDzIR!N&;GL?>=rDYdt^YKcW)J4pMQS3a*LzI?*70*OGe(tv-y5W zPsi(hlC=FpLbnXfSYq{v`xG1N3f)-;tMcxe=LSYUdah3}=MulS;l@ON=^R)jzJ7id zB#anpURuBK1A9JKy!YaUrsYOU$2d0piOrgUSPHOAw_`F^HXR5U5EG$bD0)wT+HP!U%q3dbw%^U zux-aaALcfkhBy_&u5vM~ze1E6f-k_L(}E7De`P+FC5^P}L0~k_F772&9ufA9bEdgv z23N?pjelhU#Mt1s56y4@>L*^L6oR`s z!xhu$qWh8K3Vwu4->{L2hI&(Td(McHS}oi1dmVj71z=VCZuU>sde?8ru*do|H!dl0 z!!7*2SXs&qVKiQeI-`2h!*5TQ0jABU={u6_&ieX;i#!De2AdzYZUG0uC&1L{`q5U> zsUWfvtM4J;Cr-MW$nmsQM6IgAG$EHCgfhLn*B1cZ`cD3<$7Q5#H+&gx{dm&ZK#s9K;h<(-OqVDhS+-}>B zgS_ekL~SeO?j}(yUtUD+X9_VEw`&efSIud0Halx}OTy+rL(gn*nuxU4Fh<+Ag{Px= zd*dn;N=C)=_HVsHMc2K~C*I$9g4^giS|2XTe|>}DH227rn4~G}9}290_@js_v(S}S z`iv;^KHT5Rs@8;qI+UMfI-V*`oyDzGE6u^y-*|09su7argC?GU*o4?mdit7Y$p;!% zG~Tx~?4!k-QU~hYzJ3%nIJ(;1AQj$%=2aznrD|2I->|3c#T&Zwz&e!b zjp~8glazfAa7KNJ;G+xsXh+eVbWH7jwG$^LYDFwPYNc>Ig-Ot;=Sn?ETZ3_%|KVZ6 z4;=!`MxqM3-rbZMezPC>Uxpsu)jr^P8bV9R7J<0$(x0#@{+KTw@q1;I@ha51Reyqp zN9Q3!)Z^@w(KvFoV0)o0IHlX)Cfr*del5#n9J`?QMV6yz>`NxGX20QUhXXd((LtJy z**j}n2N%0t9_xnC`Vo>r{X_LG_YE=q(k!G9nIH7jMuoa}OP(+aEti;mNomTPO&ldrgL{f*V@AF7IvRK2+JBde z6;hsC;8W3g)l2Y0apq=_)X@YNI`qr(B1lfh6SbJGMw0mtqrMN8xS@2B2vw>NkC0S9 z@ivX;@?=gu6Wk#~oVxbTDcPSm3~Hz1Lg??i*xeXHN3yxgB(6Z&7ky)J5Q8;bJ1D=o z%1J}}cp2mn_6VQ-z!_*Sf9W}R?9X$dk>l-ReDvyNib1fTiKwc5FWe@_SrYRj zz}HH+ZTYfYja7s}SS94E_$kt%!ck_bJY32W3-tIBzb_Oqwyq##xz0c`=%BnN7gf^! z`ABD+cOYRkJ60^L3~FWeL^~{}+BoWQno%E`rjA=LIL0itpq- zQ#@7Q+so$Ny8M?4l*j}lH&FmP?v&3fRFRxcf^2K*SK??v6Oii_`8sbtW1y@e{%|Mt zWv^mo}u zKw(qoMXNM1^Xkrb0Ffud(Bnsr!Xi+Z*_^S>WQdkuN{uqdPCOlEkaa9!AWyFI;3Pke zU_E!kxh!L*QFGt#c4S6gS^Lwk;WPTFbxD=1ct@eA7kreL^o4zd&pB%wPr2&PgHv8E zRB-c6-7Y+`U!>+!hR|OYdl;L;(@3gsWDmO}HtV6xo;57I%gNv^q$^o1U%nyV#1<)A z>|9_(8Io}MoxFqmBwq8qVjo_NgG$)<)$hJ`>$pQ?QKfLU?o0JpS2>{x^w<7C+!6C^;f*ZC9m zLdA$8enD4l^Bcc=@-`1rk%VsaNea2Qz@CJ2B%^!&gN2L4y8NC{lk?y~L;Q=;TWmA- zkX9)F>D`@(|Hu-;k%l%j*m5#t}MnRh|rADU=j? z*v2PXTAT=S;MLz&XAYp!Q;tMUwRe=~yuRzSuEjjy%-6Sd<$t~k8Cd+^zg`Ms-ZvD* zi3*3yitfDh8D$Kv_{*C_FLmP3#<%>D`IMsWgsF2aMR)iTAN*wTBD&!up2Vv&3cD-+`Stm5qOkl^yU0o*jr;qUWfw4cokQ4R-R8$tduBGM%q&5YU z_B2b^w48VOjpe-SbiT;xe~QK)tczAMBb8FVJ71x<_|zQeo)A`Fr2s&c906Fi>#B=K zr{aIs`?0a^^Zb(||Nou~yO1-H`vT45t&wm-r{2WxueH>M3tzye`sj;CNt}2e$~fNv zTB!h&-^SJ+8xx#3J<(3(lj4;B^L|7yI~i;4nr|(gyE_ctd(tI9!`3cEDrvNK%)nBc zBO|!+umr~54AZ9{{JZmkaeD3=4%2=$Uf$%p8h8{1Rg9b*A7%Mpd*3oY>!NYndDo4s z=;fb(Hd9aExk(vEFaeu<|0Hh$LdX(~&pgX7=eL>^xdo>u6a0YJ?21PEE}`!Hn;*Y$ z74!Mja%!87;$Q2Bf3}kR`L#=+$ae};%gEp~2DrBVgI`_}B!JQSkmVN(6WIU3H(1a| zKEUj-{?MP_*8lxA)l(Q&4bG)A_;;GqO-{>X`o8BsSiMjiq zeE2I~8rRnAH8^S7CH~#b_U9W9UiYwLBGkz5AgyMkzc;y20-T5@Ir_?0-*S72mbL z;Ce5R$@Gyez|`gW64K{tcpS{GuOXwMPUFzR{tRs|juN0!-pDssK|^!;JB+Q+7?^^B zhkt7(aBc(q5=tP{#ZmF-ysmpS1ub&fTkyp8!wrO~v@|4{mRjDSxEpDcnI(P7fSsB2 z&f0`#O33=95?F3OW1PJ}dZQ|^@I#&;xWjyMO<5!ozcm%U$|^ism3&GkRzpEJ0h#U9 zg>sT1CDgK(WwYex-=U3DG^;&Kpw03OT=kyKO&1lw=KEg6g|_b;RIqmo zG`)2yQy;xI#jAeG+0K_pNWa48fj?M%q%!2by=Rf_IJnXhU0JwN6jG48xb^m#il$} zl;;jzgiRzk?sT1J-yp-bd51$Fu#hZ5F0EDD{oDV@_o_}^aq45*mce8RUk=%|ZfK*{ z0=GsU^(By`LCw@)+>UN~1euoD+AOT0iU+Hm7rLk=f-B%9#^qbr0iD2kiJ9Tu8nW}S z+J(~@C!(=LNonn|&w*p$71PDRJ~E39v!lw~(6=?5dq(=iTQ}tHwLN|HNOyQlw|6KJ zKf5PW^{}g>sJ-xLNs?8huldrO6uT`zr#601ZHJLM zp#8RG`%Z~wWX2i~lZFLyNS;JjXKfa5O?_}5-c(=PYb-okSQ}GZ%N+^ha(*$Au~v{v zJ;&fM_I%d3J)FYVJZYNSuncaBUwtMMd-9S{AC|6vCtE1wIQYa!&uc%VZssmTUuGd~ zpQ9d;z;;MCul~K%l5&#>l{;U*U&K1F6E0d&Le)aVT=nr8r4k>8a~b_-SNY!;XU-0_ zXolI}8Z>X^Cm0Q!nr*an{Yv%Z@}nz+7}2)W^tO#oln*gDP~fZTxXk_SA<6jyC#x<5b8JbR%Pl*Vxw&P*?YEPLdz_NFF$x6q5ADMoWqi11*3VIxx7rIA2F|;v zz4~PlW^7yI(eEm$M(5$!ZmTxrHmvV(oNeB|x_tCOA~>MqCk0B&>rA)6S30$zBx?yF zy{5d{iT;ak=DjDO1BrLqprv?Adtk`DgkJfgi-i)|bs`G|9p}y`Oe^9w>}l^ln#MyZ z>u+Ng>q1YMs*}U@IA{<}ZGmQRq_fv3FwbZxg{imMsCz?t@6IE0>w`ArL{*^9zpoU- z-hkVh%fg?OYMDK@A!4HUZZS1vMX66AJ%c$1^_lycp=8+qSyp zHEuryi=4$}F}bbBD{1O#15WRi{JX1~$W_gV^jghEoY<~eIj>m_h1wOUl{#|_4i21` zP11d&P?j}*FI=xYz_#|;e52&i_d<8GBb`51h%85X^H#qn6f1r6s6mdcOX~cbPA1AR zds7D;iKcohj!U!Np#q!VCMtX~ay_HXTP0}^-hOUhHCbLhXpvOSG+jykrS@(9&RS-b zd%JZG>}RC8&I6fIwtWH`6^2djH#QD(``tFDrQCFg_$U0Ye^x6^i)eQWCC{Qw&w;F+ zd#j1)m+fW2p=CP6Gmt1WUW`xx?o7V?sQ1}gXmw3!PD^NWu{=brdwD5l1Z}qUIXDPQ ziYR}A)_&=3`J*Nf;0BK$Mb|c?zjN^3I_s*sGp^me_Oy)K~r%tC%IgRWcJPdp0gijjPuEf?s z31W5a5`gpkdXogH6>*Uufbcwz;7c*$V}L^ZPGy>%lAh#o*z2FgD@bmn;CZMq6m z+a^9_igK{2j=S5vM=(0FbY?H&ajwL+wd+0TIt~dl9s!o=MT@+o3^XoGU}{yV*SH^i zbtF;8(BOZuH{t0SbIu_4r^+sL{GO+}=gKa(kmrWTa|yJFrM-tmW~WjN^E!W0;On~c0g*eljX6}K^);cJh*ObI9vCGR!CCK?7JGG9 z-T@x6s!f+_e6tuv5>`Ps%S6IS`h+G2emJzU@v>!@b=t)cxrRI=jSFFunh4c>+LvIt73B8g|tZI7u(WV0J$kducH6NbQ6}Y_n zdA59fw;$HMwK0XiEmg49%`3=_n`7W~PVGWU0OmlGFvGh4kG;3>iaK2Ty#+-?R1^dZ zV36)IkQ!7(q(n+OB&BnJK|loo2|+p}q3xEp>$9H+Nj|{eCXq$|;osU=*+fDV550!!e4I`};MGU}y|1o~|6sOvhV3;C1vI z4#WJO;T0zuL+IeZp=MHXkB{^kJSo(pETd+GFSm!<^YiYN+-hbfNKwf;bIwukEzk+c zDflC@(#x~JQ+XgL!TdJjeNe^FR};-#eWp2g+p`Z)=s?*zY{;2iD|&nW>ur}#OE*W_ zPp8}IdSu{4?Fjnnq)|e`B>v5=&22iWJr*Kx_8}yRonebAl^qI}&g$FrvO=}XA}Bey zvMsECLRS3PeJYR}mAx~HY1+q=>BCJ9+$Hub2}g30>%&J@oEl6RY@W$_A@?)$e+RejghE97$70T6ySQE1R;>{-HNlP z=HaiQEaj(IWTTG_a?~`c5oP}CITsITe!T=`<{z6ik=nz9*{_@wk5S*OKLRUQk_J0!B=spqb@Cxj-L*}b% zFD1@nhbO$h&iHwFPwrs|OPu&J>!;}vFD{xC3+Bk)?1T1}2{zX|BSz4FA{ zQ+r`|Jo+Ma$x|ck1#Y4OilhZ&+eLR&tQv0>n&Q^Ij-KMIc+1@8e&l~0WNFYr77iTd zeA`n$WWM%y(S}Ab|GXTH_b6ipKl0yGY_Xuft)7{Ws_`Fd!c)SE9c!YyO|>KFb@XNY z`2N5+e8p>Z0)6mBJK#=A znNdD~7{6*O?WBVCu%XtuJWm=r#FJs=I&sv z=xSbw?jZ^p}TvripLa0MBJeX12 zv2hx|>Oq#%I!X{-jiv*iG_|}{>LKka)@h1@r{#;1swV0Sw_`FUvQuRskg$-gz%R0?tvpT;$|}tkAn4 z%8VLNrBRG;@*(x#GFSXq&TMck7Xm-Np1z|^!!q5 z6@R{*LXeIYU6@d;+{WRnT=AG=Q;$g)%=o`xuXQpO8A6%*a?~*Q)9}o;DZJgV4E+^y@SB_ zXz0bh+2Q|i9hgk7Opnds!D21|UTOmtR>UpzKU1Xty@C=SD9FcR(9AHK98`IbC^`_? zj?Bwtszr@zGBqEMQ4~Kb1ndcAR@h@d3<)kJ1x&JrLWB#`g|uyVXwcNUA5-`ZH!tCU z5U={DsZpcX=@0-frIv{q60$WD5aV@Fnw$e#X8Hl%CMl^MGW)M#N0YO^X%14r z#!yMwend0ETHNOWdcn=#-#5SY2Ms!rDVmz+0j=kJe`p;DBvcosl~d@`PE$AMkkd8wRgo6+ba3B3pT9}AdCAei12pBjBFX7tOPyCVb$-5vDvm%$F)Ycf)5E;85qZ7n z$5sift#IDkT+ef`-N_+Arrpcj;pMDH2kwRg-)JAW3*BxI# zXfH_phAIoHf9%Z@UxA{;I%a0x{StO~MX%%|4@^90NpSlHWz5>b%r)>^B}Gyq1A5nS zt=sev9OxM{18{3hpF5A9X_UG*G|$y;7n=m#>EUbtxYIp$%JkYdz`&R4o#y3KTPMIW zeT;I-WrM;wC`a8Ji1rv(rpH`TpJeZIJ@r^h;~g$`Q9jfa+)(*B~I7;~e>MIX6 zfJv!n#vK!P?A;(arla}oLv4%r>k~Y-2>{EIxF|3%+ydKG)2k6|{WYmPze!7e+VvIh zW*vg+2KEf*apI-2))=OUtXtNF)pOH+fLJOV^oUPM7MhcC&Nud z`Q0uP&wqxXj0y#ILlSj*fsU4DwmS+Yl~l^%oOY5fz9@O^1?^?+h6h)kme#NqnnvNZ&y@#^fm}=B zY=7EbR@>_@N|qejqC?WW1G|g1M{b2f0+L`Il2S4%)7O z(IqX9^LI#$dVjzZtYG9>H9TL!hB6s1C@iidIxs|vU@p4U2aR~Gm@0`ZUsvTT9*K>u zh%k-eZzLYLD2#+)cT~IC%z82Ojy7?KLuTE^jT_!ho*!$X@EfwiM=If|IT*(ya1X7^ zxEwnV%<7eX6o-lLu9U9cFzQA)Y!@w8PaHN4Y8*SOoAGAx$IxGb;*K2GNKepq_~1c5 zf@8Yu^bx`})1nVuSTOE z(h@fIN-J#B5Vmb4NRwa!xUZOFBtbWasU51>bvST58HYKxMlI`d!`i5QTf3Z=j${`F z7YyqzI(@3~2F+Ceo*K8Rnmz~>!>HKFr+=s^_QBg+`x7@dpl$L@|A~VLcJ?J>@FA7w zXIs$u>>MAuSD? zUBX^Gzjf~ID_);kYySKLTq(EX4SYKls;}jc&}csDq^*+6S1_q*zwhn1)iHWErBf-9 z4n>YTPis0l8eSOiL|F4kc*>}W+J1o1z%y3${1v)vlcIZ#`yq9YUZs}jL%MK!(~1KE z+pobsKN#!RK#F&G2OI$(fL-d~l+QS_uyzAd8ofE9j*Bd08-g&GxUXf4 zH5*mW*pHQ?1X%)Q0 z=2|qX`b5BJqahHjW*i-E!&bJzP#k4Q=CYbZh6#ea{(Ph2#oasXWRXmBX`V)j8t{XA zgr-{@Q(u~-BRyIRo+_(%lJ?9`Fip*F0Z8b)lWF`Ud%EwjuGpt$*;Pu#>n2jJDya$? z@Zb2wW|W~#oce($NELdh5jW?C;ej{kge6($vKd(~v_#+=P zmhYM^{;B{xkVHa#iQe38;oYCtr{__}kVKlw6U;F9=)^`fk8Ib_DG?btWf%cD>AARu zEqailpt+J0y+#hEGN{^u97~$tLT9;{_!Z&#)O3?yfvoV-Q2ILdN*_(EH#S>94&JAN zFFiYxBbCg=@Ki(~!S%;t(C;5(!5AgsY3GYh=E|*?-USJ{X3wT1Z({2%oJP>QjHRry z%4HlviLO?zJ-sNIlUOku!;BMxX72Y*D+*xmD{U5S$yQE_)bzPTk+xMiZg%@VC^vE! z_hc!_PNycWSDcI4cY`+D(83EKQ~4u) zrMqOjSaBkQE9<*E)M$`J(2W^5ts5WE7&N6@Os-UCDr^zQz6-8B`++2gDaCSp(`tO= z?oONIlnQy-3V;(f?NHGC_~l(E@IYMpPBH7vsW0ED-}esA#7L(`J9$Wdn;ZmUz}!}%(9P4QwPS1n%Z1|0vtSpeFh9uD>ZRmyJ4Pl>MCNL-b1 z`H&lYr-Cl#7@@NOsl^p_qNOEbq&ZphHtJh6Bps($nabe5J? z$c2#D>rf>stV}B!zq4Fl-xp!#umL_z2rR@(r zt=*XV(XM-qK)IZ32qunxDvAdTOs2;BlA3qIXx(#W>^2-TH#O=TvpR>ds1<}MZVjY@ zJ(zoW`2|7MpQ8;bdNI4TuQBcn-a=e7{UR-%NLJLC!ve&{EDUSFI>@PnL_em2xw$EMfJZBx0sfB^p`YKv1pDvG`W8!pm3*I|5%qFX@DbGDwIzzKfwa z;{yck>8yGxA2*-;2G_WPoQf#QTC$l$Z+CAP3fN-KZxNop35>qjKzfElZd}+K_y#Ip z!i!hWjDFgYEm-atEv@cNGb&a}jwvheZJKDGPZRA`w^ku~$>(f)(q_6afBgRJmFJ?o zcTtw(fNr{>cz;;U?<@`RLem38qG{J`(uN^p(OHFti7h#SF=(D;%3I-H8aZbKY2>J_ zq$vLZO?#W1!Bt^0YjnA)DeY$`RaecOF#hiw)}~vvTyOPGIdTNl+rO~H@hz;YEl_b2 zg*lLrUrfAWx=r739G3UMKzO!9e0QmI7;qmNepy>*{+M9BY^hn7VeTKCwIr_m#_-o zgOT)?=};S0e@?4{ciDzidObTrXjlLCnuj=ScsN?OKyOGw!&$JeR@<2K*DG9RIc-|; zgFCPECw@!d=X{WDU!8%aIqT-2pb`h=4o;V+{o^}(tEhCAb4a`T{pjlRD=bF6+*qNP z_ew@hzYWFE?3~zeBTPB55WnVH^-D@wa?R4_?#CyroL4gw(LxM#HdlZJ@EI!>QJx_e z*W*y4H(Q_HiU$3_z*77w6-*+7qw;`Po|SXQzvty0yU1H5Gr#Pl{aj_Cd82;nr*{P%=8Mkj0JK{FhgZ`&zTk~OBFK9W-+5${X-+5 z>cLQITl)lrvA$p6`7J=s1Jsb#p=)9D$l{k5a}>VS#)c6k(DUe`ydB>Co5FYU4)7g# zzthS|H-q-B8LAK#2oR4cFRL$+2WXDn5OcA9PeP_MaM=QA3p=J_yi-%6VY5%}yzF5> zM^h_lR%`%msX(AmAeoV8hxINOwxIaOt;~eC8^!)220cN~8k~P1UK(7`oElaDRUr|l z7xZG98}COd^x%oKZ^$#w?)B3 z#@G+VoxgukbQNm_R;YJJ9iEg#$RwY3n11c=Zc?u)5uem+?1I+*0ADgHG-i3N)U$@q zIKHky#U%!u-|O_7L_xg^Tzs+CC7n!8q;*Su?%3#&Xphzyo8(QLifMj#`1BI;0!}ZQ zod#pw4U5$=?2&0KIh!bq8?7H}p za@e9+vE-fuU{=K5TM#YSl-Vj`GVR_lV}-+~ePNH=g)ipu1u&egfwDWThAWIvzY zPCoIsjSfS56#x;W-(L)~*}Ted9)TzHzq9={1$-)^HJc+*l*v_J`|F~s9^WVU2x*A% zGsiX4(er?_U2g_D+lM`Q;4n+`;5opC3A|zB&06mU@)vqwOvAE-&Hkh+;Wd-WVpV#R zN|{WN1SH)Wf9p<3?wF_XKRB_kmA_Y9@D6ZdZ%C*ErMjL+A+k6KX;by+gPc?nDEZJt zczu6QR2_At*zkkz<&(B3qWvY^lU{bNp9E`xRox1N_|%sO?}8=27fCb_imin-=<-V; zZ=qy9=8ChVSAvJiPv3h#E+VG5#^RU01PJ5=v7vTfMf+E&=H8$%uGh`nVHDJf4?4b=u zVVDQoK3dT|CE}$f3!3ACtzdM99$XK`-wmbUdJQ~C&y)=yhUXuuon`|9pTsl#)tiN5 zP`6J^w*8>HqTl5vpV)|Lr_GW0Ib>lo6;0VMZVW#r58tIBBM?0fusTt*c{w=jh4kcuUv&D5>x)KCX_j=tE#pn@WW!(ewiW=_G+%msVnYiU_8o?!B!O<2ktOx<$(jlHm4k1k-Pp-k?!HTVRGT3hc$TJ+j2k<=PG`G zBQU1(6XhZ0ItbWafd>^@o&M&C3#puA;+VQ*b%`}FQ;wk|vWj1Q;Z<{bOGx6OXcye9 z=f-`@A&v-A2Snyizey69X<;60t>nJNr2!%TF$; zMlz^t_40!!_Ni*o$gd?gdj7>2e8t=AUlHgn@YkJe= zHt0+;rQhB6P?OPd1a(+&&bL2IRd7Lca&&)TFRruM-##P1X;GgB{NAIcBNaMd|P&!5mY4Xz69niB%aDuSx)>ZhZfJ3 z(b6J6R=LfivZToe^}PFZI|(F?<8TMNR`<*+IKfa#yDLZL3$J*hV%;3x(I1de-4R>J zXg!GxZRquycoEhR$Ck#41>KGt{G0ZWfC5;%hC_so7uuc&biXK{u*_>Rl)}3gP_ZjdmUUd%zYZOOp2^}V-L0Cz`@$h2hefDUVz z(Q0YHqBn8e`8<{HSlLz5QH0N8NHKg3Gcy4C9B`agJ1AYrD~<=ImQV)u0@Oj0iqX8n zJb`?>UYdxnhiQf0DE2uoz}U#uF>)z0TwZLO3~Cm$KZmu>{-*QN^(yy|xR?a9cnhJ> zT|?KaSMB)O(vZoVUtT01&iljScL!Z?9p!^>665b76+=dKzsS@oXd(H!KrP>ypqrrn zBLv2sC$Xv>M0*QmAIJ5mCt2J&x>sMOuavhe;Fm^*_*@W!=5PseY2c{9dEigdrAkXj zsRyIcF}68IyV?s>(n8Grd{hV0vU~%Mcc#cNWr#SkcG|N?@xaVzW;yP__?!A!`0RcS z7(6~;`1La49%s15O}!eyyjci;Uyj1;H2S9U3R z5@f2}N~Y~K_u{67C?5aT+wlNAD{sXI<1DKHIi5Z}SIJ}ljHebN3tNm?elApzX*hl> zjB_52-gx#hBg9(dpn)Q;;zaZyNF0VpdeCb{IqK+kS9EjX(H8uj|5=Gwk9)b32G7x7}pM}Hm{S+jN}p!m>gFA{BXtR-=ReD@VIL*L3&inkN` z%-NI56J36JH(M*YLsWma13(qM8S)O?SgQEjGfe{UfIFEx!c*((*o!p1LFY80@sJL& zr~3ywIrZb$xP}lP_zxwR5XLa<@Yc_!0h`MsJGhU~6orJdm6O=_Sl#Z{3O$`>LdCId zzCW5wu?(Ex=2MggVoB1+nR)01al}Z@z0Y{->jqV}KwP?B+|Cf;h5a)RW_tUCKi2=V z5y)HChxkq#pia#5z0>;ZaT`BRkglB-T6+l@E0?xG-}Q34isrrV8UlFl z23qe>!E{cW2HAa8(@R)~?KhNP^Xu?$lC?&yeihqt{%uK{_FMAf<5i}Lvw=ZP_cMdU z1Pi@@;d@bVkwjJ97j&pEQ#H+(U-(IjzJpIa0PRJMq9=@7L(QI=eBq>fKXLvQ8$!cs zs=m>A5mm!CHOfOgKyP7jEp01zL|G-tqeG!4WV?!~UncR5JaUw8J%PK10qr^JP}tqB zo$PVr8#H)BRZY`T6Uo2&2|WAqh={mh0xic~a2*AEeVMa=7Sh)+j@Bm+ zfl|t@H9asQ-Sj=SsXY^vBI=BrewqkoAnaa+A=0&I$7$k5#~no~i!H8C9*R&rezCCK z6u6A?v=rQXJ(JiZC$Pe>uwHT+Ad!%&@OOnnUZ;YmhfZN=`MO3^PJy<(> zKvd;+l--|;h>T>12}Ph5#ZW!F%F{NS{S(rOPST@`b=#s_2*PTRTW0_m3Fz^u0_d9A zxzguaI$TgT0tN$3UdlO(3zIWh#_EiECl`fn_PufM9^f_ zC(=(n4BH2)To`!n&d_fOc%dgvYIvl0}txaTr$p$JM3w_Il=m1jWU*8qdtA z+gP5rSY%@1Z+-K6^YQ?u_Mb{vZ(GQvP~>OLz0*XDg}SdhE$4Wi?^|Yzj5@<}}0WZg>5A{ikL zTk}}AiK|#L-b_VRr(zuRo$^(-wVxSG8PSvTdpJJ?eV8G@51^vP7lnMJ5S=8MG;RYI z<`iFb$>{n7+l%M#NjAY9to2&=!|*sH$}Sl(Y7|g-n5azi!FEjs*fjDcOd=F}WXwk**3=3b{t&A z@l}oOh4V&NR+vEqn2iDtrCPCWOZUWf0>5U=Kul5sY-qQ2)eH1*JuasAFbsI$R|JHq zTn<^*Du!@Y6lL$W?MzM@tolaGLhx6v!S?zz(4t@O%9^I>0@Ysh0v! zb7^en+_ndgDBSD{2O*~CkLMwYKlqprYhxY_PGm`pfay|J)!!%9aH|PR$XCUKW5}+k zl=G}5yS7eUU8#wD6#YC}d?8Vud@c?)c0wjZ8EW?PN;>&5(kJqep6Y{U5qDHFUN-d_ z!>8JiPbW}%`^Y27@c3Jca2?^2n8b)`&sR7k&;#OkZmAv=53E)0_eTVPJN(F z6&sn(3M#k`ib&*FjMA;l&ScHlyXa5nz2qBO<@{y2gDQC2H!mo!+_Nx!VhHP+D%5s~ zvya8B6fip!8}(hwsD7mXsdA|}qy$)*ezC!P&R@Q`B!3v~VIuukJZcitguY>9(7xO- zHKZt!@~7im)ffCtv)HDDP@Jnyw&S+_G?d$sXPR69=AV+Cm;saU z9MIx@PG4IJEwSkYIn#ZfVErO(H^mX&7jk*pv`k-;SLw)dvg4$J5*c>4`=~;|Jd!vP{kOtCRq~bET8-8?up5;0I z1E>4x^brti3{LAq+?6cJr59VnADe8DNb)ds$FvYJy!^@#|8Rtmzk&Uo2wkEsysI9wunj?HC(*;5b_K_)%$! z4s2K{Q^$ZgS}~2D-1=*E6F~>kk$8O%Y+J|aJSe)1Ffr?JoEyhj#^$ASViQ3(AKDObTWUhqV@C<`ldC_J5%9w0RcIZ{qxiR{Q38Vym@2irI{4H{qd z?AH?Ebw9ww{~m<^J~wU&XRaoIA& z|Gz9-1dXx4F!Lt);?5nXwE|F`Aa*fZ+%f!DnCVG)SfX;9M zg8D{W8NEvN6EL*e!NlLQZ$D7eaPifwrbagr8)O-Mcmolt9Gm1%I<1uBCUZ^uuQP~g znw0nuUG+&rQFzefK??Jf<;n3)UFTbx0OjfB!J;@4nrqs)o}1TG9!6UB0a!ozu;B|e z4>Z9NVqP1(&g&UX?`ae!O(RISTAJ~A#>eS!RgpEe$ymol;qIB-))?1+-aoQ7DQ^-al)j&w zchc}cj`5~g80*pRe#tyIOn=}6l{}Fg6B=P{6)d1kvy~RIzP_!v6sM;2DesrC=TI0$ z9JWNmCb=Ogbb-*i&GlDuobJJl>H$`)gbK_0tf)chy80hOPvt${>;f59T(#0ColKe_ zhoX_F)`yA#6eHgaFFz@~{hFNn;hRd)IUo6{(2aXz{VEH!Kp@Y&hQ)DqGQmbL8x*$C zNH5QE?aJxQ))=++?1;KuLY;jc7xqJ*&DsT|b#vXg%<)H4g}0sz#@oQgJnXGKl}55! zTO;{;T9ETSeO=C~^Vk9_HP7%Ek+FJ$;4hb2sF9djg$UWv1%p7fdE&hbD?-x7ne|k5 z5bs-CX=?G)KA7~$R_z6(F z9;H)Mmby>82%zwOee?Mt!n$~7_~Xk8Uc$Nzs-0C}izW`WO)ov6F_^UY3#ZSPT#?V! zKT$zfKidj6MoX1hsPI_hyx(o-iWXk@txs7Wh}{QXz9MwQq`n+D(U3K8Iq9j%l#f%i zNd~rHkMzw`Fe>))LUf)(qu>7X+RvFcLz=}0Uif>imVIlSB&t!sYj(aM-*@IAOUG`jN^&3^#Yp2m``(+( z(9(TTI}53kpXyIgD13@Ap+@F>v>GRO`a&vPD$q?H#8$-chX2_D9-z2r4Ic~gLTo-> zg7@vabqdllZ5jvxU;6%I0y;UFt%P+(dR*sY=F{tm8)GPQQ>;Olav@Yp)(>pYGb3f*q9%@0wIx6JR>Q_*G_3ue{(Jl9Ul8Hg5rF+!8 zkw@g~u`JU&n63oE(Pez=5(W9{i+bGHrV`?jx`lU;!%fRI*0yF%JA_$+XNi?0KVz)F z(e0U^H`$2yD=pKgGq%DGbeP8#V)6G_;kp0<*B8_=gu_x!dzn4+(08rDe;fH7ON%y2 zq(ZieJ3^E-!WXBx?;o1L5=l_A-ga<{OYQz_GdR6AG90>bKUQeVc@}(F7l0v6@dBum z0I$UjPX3Xmc~cXB61zYxy>PMgVN!+wu~iSY+<7m}G)C{idlLCcBR`vB5}PVMs6%;s z`k8J&HTDU`_T`O+5J9R%${9sN-iZgq@11YREbHo2Rs=OJFU_6@zU@XnNINA2K&4wUjnCITL7mAmWkzfi?66QPOGqJ_$KHgbVT#jkA+sH`CUPaC#dKQdz>v-rVc-ims z#(Tj|224@t?{J!5Ny3{Vz(j{d50s%54FaE75cqFzL%RCAIUZmuy^J;h&}gPjiW)h2 z{(5J8%9v0$50!G2%w%hE+2J<0V~&~G^8M!+>H#pIe3j&}ZG8I&mL&X_F8#yr1kKS8 z^V}UW4Ol+X-Qcph8rZxj3JF^E4M{qSWf$cUqQ zOwbT2OzUT{$hzm7Q<}@DuB5$G12nfqE#TmyOKz+J?d13+VE8J_@}<${Pz@8HP=cAd zj)$(_lEM{rMX=@6mj%gxeLClUAmy$ag$I=z>k-HS^uP{Xxn8vtkrgV~%J+7{EAFj- z^sq@%M;fp`c7NvWh8I`Qt~r#g*7a$;JJbSM3$W7h_X!jpfdITaaK}skpL=9xc7PG+ z3u`}#5%WA0KUz(Tnv?^!Nfa{(!*awu_Y^^QPs&Wi7-T2q3NigM+L<#o*76Obe9lRW zlc`S9vrgI?`waY9L9?hR{3`>`{b)jTl56?o6IpIf4`6I+0s`ELS6k4`8$N9e#sr9R zMS(rVQ6~YrFRyIkc;){)Ka{FTx`?=(A?5~lArzOUcv zS+-qsH~=3A*`e&AgpERWTXpvRyY@9QlO-L4zQW$5$nB!%z1HiRx~& z-DErUGZH+~uARgE-g3IKB9#1q3S1G!`e;Yn#oAu0zstK<%8>IKLv{F(k@%HBmsRe~ zCk(9cj!&f_w^b}$6HD4XD_CRxDTzl+1Hty2ajnTriS~@;@;C5ux|se6ZMF(5d^(-L zem!U}HhP891F$CqEq1VvU)i75t;s8Mm`CP=kTx!*9r>yn0(|b&bRc4rL;!j zsI1TiNLJCIVD(ddB8zu$csGof>KHW{zFi*V_8VKfs#_c)Qjq7a#AO%ta8m5t%0uTjVL@rPh& zJ7>>p-Wh2J>hhE`J18QINzpU2+FQdyMbW+`!7xd9c^!fd2qzwsQKGyS-ywOI0O>^b zlI{U>M_>$fBSPYJ&|9g2Ga(h1rgpzx_bBg&CW|}E+f<(ICBkSI^=O!UJ_1@{vTtgX z8Y@x;zE-B1-`q~H?acZASl&MB&zI zA)}~npUwK4-MPsn?BJ;Qxn;k}=XLEq!^#r2>%2Uh-ygMun%8EV)_UewT==mcpoo*W(9wZ|=@x^9AycIvS zLaZSrZG;(U{07kl{Q)aJz?@#Ee*qMNLJfp)#{f4eglrSPzm2E6rn2DwS1g~NdcWF} zsS#XkiuQmB%;L32ETvVH?eDr4OKt*@9%BWKo6TuBHrfj!7LzFGVN;b|=gZVJ$)U9> zCGTX;eK*a<1YHV08w(e+1leKPM3 z^}rcD=QVrh=hE-3TAFy>1KW*l#g(;MUc#5{K=Vp*7(u^w2Xda*P^&uS?3CoO6)5Frdf=j8Zo$FAS#BL7viZ8%Mf$-ST?j{Qg}T>A{g zffdmr7bX^~TQo*ph=bq+5B-dIJzpT%i@|90kK5M*gX12=+g3Lo11g>9dNeW-Kr1(0 zyZ;tK{ccD~i-^!|?;SH2KUY7hPswv%dnV#p4I^apLq>1HMz>I{>B&YnVkoA2MsbsB z*SK!?!xf68S!k9!>qXbnc-FcYb1{&D%L}8 zkg2Bboo}&{gS%fGy^9maXw=)*?&j@SvrjHN!1~+xb~RqTN`AS(P418W4>;3%K4-4K z`_}5s7`+~)x!=_jd;04&V3W!5(3oXzNBh93$K(6Hn~%2z8fTZ0oqzeooA{OwjJO`v ziuS*i5&p=D%>KmMc3Qw3@Wy)CzGF+r_XkIvMl~kPqbUsx?9TGMGrzF(C%^nIVNv}* z0mB{z+z2x4JZGu`7txk|A&%0~ZIz2nyarmtN#+3)4oz9T8g69)V^$*Bihs^s$bNCB|;hV(P$%*rQ zdEsX+ybK84{5xg-f1rh7&l!4d19yfh5EnvJslp*peaQo-Pr?pA@9sl$(2&1)(d!b+ zmuGW8DD;^wmD1oG={xX^zdYh13Q5j+72TOi!eV3)WaE)?D$}shjH*6qM?q5k? z|NVn`M7%}zJ#h;hv7qOZHUz4uL%<@JX^5}`X^16Iwy8sdhgZ!;Pop@)&OQH5@&Sw- z@Hg5Cw+3Yr#GP=Ve}BN=1U`^av1LO{rFrD(@u9{^N4CI|q`5C(jnFlxbNnZQ*?+*! zaXewPtZe9rQ;`2pKg<8P{=kp?G61{-uKC5z|Ma4NeKh~_%9lyt|96!x#{J9R{)hkY zZ~yfFzW;ZMpoDr*9Lt61^l<=A)Wr$en0pmkeE$8J{@gqVrgkgsgSf$*#ux;umVP(Q zI{trN_-_yS?;kzCet-Jmqxgj{)(ZiXx3}H`JN7Wp5Jt$b4F280oW#O2ZfWiS?RK|c z543WJfUNIpoFD1`*|Og*evoBPRPzMH);J~*fBln3w-)V_;B&t=6J$tYzM<=YBk(61 z!jY|iKTC0`vbXQPlg$5Zb)F&ai^2o;x#E4$@(AZ6bEf|QicvBWphy|DTmMUrJLkh$ z(#$RbbR>Pc#{7h}48U&GQ~Kvfb`=>t=kP*` z|7Tj1NMH>s3ez(|{}WiJGq#nodfNZ)x2htfU}!!BD)JoYI9JcuP{$EKTPs_~uD<-a zLvvXks>V|D9hNF38w-4s?P*Sb7(l4> z2LresM@tZ{s@w?5{RkS6@}3|#PWc1`xxxvv*Q3x($%x=&2weN*cJD>tQW*X0RFq${ zR&IR5XY)726rf>%i8Zwj$4&**?Z*H6D*U&_H5Yt_2fIv$yD!Oe5GRSeN&SiG*^-hz z<UUA&TQoaB`@v%@8fND_9CO#Ios@#gn%Oeq$<$dvLpt~ZT0`6hGj+E zGphx&61bI_UQ)3sbo5Y7kmSpz=$bY|!#s+cD?xKI4{+DAin75e#4t&LbEB;7}j6J@O`VtG|A{?qW1K7V>mqeR0i8CvTJFK?7`yW%qI>AF9d z{QKTX%kHB>(oti_!d)Z6zhA=t8v3|@eRO~JbA7L02FCc@+p}yFb!IkB-5p4HfW}8#-GeRbS+M)Af%jeIsel%N>22`ueY{ zbD~#KrpaJBaVzd75HqA#M)CfH13)!iGj}8TT(w;_K{G`WJf54_bZ8hy9<{O+&Dpg$Tj zUg`S1A$xKjv^bgR&N7;Z%d!=>`5psVNDw}onODb7uS|(IXwr-l97NNg50#>lB*D;h z`XDl5-s?9Yw5UV0g{QJN78#Fr07oYLViyA1B-Cu%}kDug~Y-Y(x(A^yE| z93ca-v=4AdNH|3rP%VMXJ1NP;Cyu8B+!&z6Pm1ssXeR$gFD$wegc$7*L}h=D`~c4 ztV#OL>J*c^LjolP2&*keTF)SzI}OX+O_yJJNzVM8Wg_I&gho%I9dD%h7eh&M%-S;J z=C)@HE6#(Yar%iZOZ>~$Ldl|UV3JwUmnU;Gq!t+x9?n5U6( z^MU9A_KiSfKS=i0LpS3k1F+<=4|xH(8U})(PvOnq_rXs8!*j2eN9# z&iNo9_WcJeHSH$A$RH%-1)tqBp9zi-0ai6im@lzA5|y{`A0Cj5YR~1qAS&|4lw{RA z6A4tII|JS;{_x56!e9-H+I2;(+?kW-cO|*I>0oKVm7xinNPg+y1mK2BR=4*%n4?i_ ztOW+XXR=J52|3r%?r1-oTgw#OKB`E&l|H1kSgx}Gb(10}8ugv#RPRU&v?x$VqYs}y z`jHzE;D8dOt(U_peGi?J-nR-%uS0&BMsN`gS`(i;{Cu;QC8yWub^JtfQoi3CdqKvadJ@aMPw$l_OpRWNl-9oxKr@^M${!)+=nljcus6*I z<}>t&PXYX6)RU_c?0ub=q`Ov&V<-pm_UiU9H>Qb2Lc;hCOcSU379Tu;?UiWc<)_oe zu16%dA6q{^*x9dHbt4J-%L}5gY>foUdkoEA5X7%P^w;2TB{3N$$9VE&c&?^%~&aEJ05Y;PHN$3 z|K|t;FSKO*Zd0NkG5lJH@krEoVZ{Ay(_LjvAlV_eE+b?UN%}Ig7Jm{~ z1AOz)kra=cvF<~p1zE&Rv*7yHa2AyXu6gZAtMC-Kz37gF^YxvA&c46a zxl4rdPcMMzjM-EYIba?|@|isrsu%cLd+!|%(u(n&(9U~p#JkYETc@KI464mHvZ@#J zhaMynp1^;viuyc44%Y6VN!L3KcGBZAaC#)#41s~1H+`U5BTPF1j93R7ihh~&{VWS} z6`WI>g{Pf4W!G5IG4?*GeJSj5bMZRbL}vaI?=NE8RHQ4BQZ9X2cCXhp6iuQ1ek{zU zXUs11POS4o5)Ahc`}lJcZ7`~`gqyYc)d?8`1;a<)F14g{UVp@nxZXZTvw+GeUSBSY z+uj$aS%P)0YpWHZ8SniGD04q;ZeLI_72wbh0l{NWY1nWIT!w0~v50MY^AxYsN#Jz* zH{s%n2ZSOQJ#)!yM7LiKQ_pZTJFw5>TvG@~0{<~}?I@Ah;hlq$Q3E{>NUv|;iJREf zlPLG~IGg|KBLBOa<9#{~DnXx~hxlC>HIk|#8NH}@`l8oXQoH+IaRLp^GhhuF88@9l z)R?`>hcjWVJC8d#`1G0c8eY}3QPSg@fa6nLlZPj|JXSL9I*DZei8Zu>fZY-1A#WNp^|e8z;ZrA z1rOS`{p(JVMQLL|6LMNy!9yx+W~y2$IR*JLqVsVbeOvd~5J==c0UXNAQKQcqYU4c% zgGS?_Z^o_~QdWwICu5mPTNlY{Yyg9^msQ{gsX^>lX*J=X>VWE8guVy6C3jrMhE~bR1%h zk1x*Rnr>(~7&ac1KEvpXGxVje|7=SY(vgBK)L91*(k7c@>yZF=ed*1iRhF8oWUvX(sHXI$yoQ z*wi<>!Ki3Ze}aR$^Cc9wqoMEtO032)wyEZ;&`qpUTZJ{#>tb@@Z@rc}`Zh5F$FRS_ zvVbA~%=~sIR!H1bW=TG1wD|tAaR*fk^UYTh3gF)i_bDPrLooWZzD<R0!TysU9SmC>o;{knuU(J-EsFTHS%Ssg)7OvKmEQm}?}Q3QZJ z$3e-M%y_5EJ|0+8j3F^d&v(^;hM+ZtTV=yErySHFSk=o|gp`#C>?MKz7E5byMHKc2 zv|E-%Xau$I6^{>14#FTP800sDOUj{_8F60b60$^?cM1sUU={6#v2TB z!q9IT2cSPK{9&|AOKvfF+z`aeLb$=oZA!w5>$7XikMxXRhT&N2#k{f)HDcPB+3Y$$ z2d#YR9>Q^%cgADlo%UG;*8v^S1t;JKM_c1*dt5(>`fd;_@^@zz1ocFOO6_P}R;~AO zvtKU#bk*7_XmcN$sVSdC*3*0qePrsJ^ceA1=&K~!P8nbd0C2kQ%kURL#NG{1 zEYM9g-hr$oK3YR>>Y4pcX@U>y~iw3fvXxiQkhj|cwVSo30Vy#>>_gQeg z&)}}Cnl>!y=8K44up8pj=WCsmp$paM9F4)AAo?UZg?@JD=IojD8oHp zsXSYG`UhBgzMHEFVvlu4jCm*|H16aN{!+&r^OUOt<1(4~ENwAs9_t1Inz}o;?`!;u ze=`JC(UOnoOB3`NuuOybB?*n}TnPH#hEDhhBe^8_Y^+R~Yk`I=@XS|#tdfKIQy~Xe` zhm5Sif``8|NJUx+a6NF0;f>#Ao9;RtZo?HeySjJPo&LrbKMi961f#uXW)&aFtsRy5 zgjOAVfJ}X5kT8PHr9e*VI-i)LWxkrUdA5<^z~50}q1DnA4^vxkCjXnm@(5&4Zfs&U zMqjj}>KuWRE^h;wYRmERO*$fy@W@A@m?pt)pYV0NUYZ1xY746M{1hb@yq(U1@ot&f zXr!$87ejI?f|pW*z*XA4dzb5XWRSq^61=b-gNCup1J8u&iiWpZzWWiAyf-2XtGzHR zO=K-RD6Ze3vAx4|MO`n4ITEL76czmYaf=HKnwD1`&7f6dqEv#3<_1cC{dR)NtCHV# z7g=yXC-W^``%!J_F#}Bps?~zSI33(`_TNUpLqz1%*LgHiFfb<^5CDa{YhCqm=Lsei zG7_*9wEsyw^lpR?3{L||_D%X9QGBCHA$G4S)}!vFQPmr;x7M-EXxCKE{l-^V;ZAHq zbzE6J0#1#WWCjfRIFH%e$Ks&uLBZ@z#|mB+RPuWPdg>Yoq-(AQy}a(=Fl0*7?TSzS z4q=h^zHG^@(|DO|anKVXdZy@z3Ln95Z?AwCLLNk~3!5?2Tuq8+U}bdmmb z?1pA&IUic)r>LXRZ0oD_Cq;S1^xW*rrjZuJtyxJ8GmOKz!d7eLf^BZ|Nz6ARx+lNJGpSP48Hl{Cpx&Wb$ifJ5k*@K9k4} zfGXX45wvll= z`9Phf^XF${)x1=zN*#_~gd#F&Q?i)ZU%`rrWx|ngZZ1$SOP06}$|WptFm*W=r~Wa+ zFPff+QGrq=Ge560l)UISn4twgO6{K@)CB?PdNw373$P`{d8gH{8_8`r{L*K;lS4O< z3Z-|sS`KRVV=VgwAsvZ@Z@ymV(nlpO9+OwfkuMpMz~4ss(3{79{3%g+Sb2ve=p;hq z0%J0C=DUT)RkqXGV~BlU9ShKqGs1VE7(!N~@Vj$It>}VR+2l(br20>JrchR;1wi{> zE$#ljQ2)!22bu@Kf6_i}`r87o1nws4FGO)4$ztnS9#j)MYj~rB-BLhec~R&jAvTbG z)i{y4GmdUaU%J|Mb>(skK<-?W$8L3C(vbk(p#n@LGn+WvQ5K{@nc+8(#`CDyun~7;~`TY@pc*cge=#8HG>2E@^Nx=&x1%=!pD8e-d;t`_6wlhAuYhgC8JIv( zxEiB4h+Cf>dsh=Og+GGf-$$dzr$+JNXJ~ohWX&KycNt`g`f!5s1)8bV!-XY$A6KtC zC_YkFmfIeuiw^$N-*@>d9M2p7IH#U#B?)qzKAoPfH6FV3^~COYN7R2k&Py^25L%w+ z)s~Bmjri2j)vU34FpRhK2FM;Ab%=zhnE+GN*|%~n%W`|XD9#I2ZCYM5w`WR~oHNHg z^I;;U!T&DdxBf+`<6I22SZv`IjG6!XOmeF36&|;c!_Nv`q1O*k^4vwV3(zjM{9idXFNt`&b2&0hb+whQZErdzaG*+@b+fJhB_$_ag3xSY@lILsrx)W1ox=)_l^(>lIakoaop$24dKS|?{7mh z8qkAXLHulfI6S)p6#w+P+tz>}fMq~zeqT~6w_M`6PuAV-5$R@|=cvp!0yjr(-qGp0 z>Cw>in+jn1aSz@_{+bt0buyG^<$f8+pb7+gL8PC1(XG+`5q~Iz9Y=<&2lU6zMdHs!FDUw3{8b$Q)N9?`g%ENwZts{nO$y2G+(Z zQ>AF&JJ={DUUqwX$;^oOcnawRz|#F80)Zm&uxI;OEw(7Ct?5odzwemZfxVX67lrhFze!Ft4YBs zv$ZlTZnm;qiu)K66&ACvCmkviLh_%dFYnV|pv}PBA47Wrh-7H=dF zKLk@332V?RRS`~CqK?)(S}qb9OHr?)!G5+f#$d`P7g5Fw_luaI^;$E&mLQzCtKh&9 zKanaOEN?_MdtIt`kEH41DVG_v7&T3j#F_gPB*_IuRr-yjVwN6Zte2H%tbQeH2*R17IDH^?y}t{IiT>8y}sNM3#> zAg88bLSyf$yPG*sPx==2lZsv;iP%n#fB)6uiY4M<3nK;m!<>JlP%Fq+++|wC(Cxj8 z_<@{OpPA5$CPCQF{K)trCkfGRpo*2C{T4%~t1peS+1hy>!7y4$W}eD@UeV6BT0c{x z<)C?K$3{Eb`*i)^rj7sGd<8jTslR_SIj35$=ooH6>?c4y8wlqkU&2P@OGV11O4yZa zwc&2aDGo95V6K4 z&XT4ff!;!aPrUoCZ|Q<>6By>p-kg2&{7Nu7ys1!woSh-SToRpm@&ydUPU!Wq)L=)? zRx01$)m5Kq2O;lF$mm@i91qfOl<`3pMlQfTwwMP@M*5XpC}N$ISv{vzHh0SX_~q#5 zDA$&q!J5D74K5^;f2KhEa=f--mi-?a&p4g~2HjL><<`RWH!RRcpxKj;6f@PzHhsA% z)=y!08e}7H^#^!%xp9}4k_P<3GKGWm`3P0ifEZ2swN7*rb0J7c_NfVS4r2#`0=Jl3 zT$qYc=+NoKTfZV!c)=~{xmZaSWZKLAICa^CUB$)fEu0XTlCv7tb>~TPH?VMc_!}Ni zLBO$FK2L^;m(x!!OSQ{ya?uF4fyJ@a79AP!{^zzd@l85a^o2ANvz1Z;P5f~=RPq7{ z!`*YTsHeYV`6xOmcFD{{8oQceVOjt^edQFmI&MOm#i*kF0a6R^Wxuy;g}j{)Plyh3 z0TbelPVEo79ITvr(A&M@l&jybPEuWZI}HITLuH_s6K70+qwqY~b$3kkDJhDiXpsc^ zAW|hhblVrOw`gsro1&BbK1{A-E)DtQTn_Pm5@oL`K)+?PDUzFe!~-x z^xfIuCj}>@3$c%d+sd6_q2L^>g@tAwaYx(nYV8*DXEt|rI!4H7ylyA`(9Rf$t z4^a17Tg*su72o~!e~Nl-CPlDV42<41``IL;Qcx~{kb)U@g3yYP7hlx4$XvEE^Z?)a z^v{wAyA*4eGjyyMU%s(SziTI7{uzU*-?w6L430(rda%x|RI9>(w~fhIdbfiaA+Gi! zEasiPoKg*>v+fl!k`T+Pl>x7s&}dvoWM9K7ok{e+?0ftK=lKI@lM)K%mAVK|YI$AW z0cXrZuxm91&Q+{pfV5af9e%$1D|9Kd0n%wea+wUKmzB`b{VJiyGi;k!8Bzk# zXt0nTw7+A@$PM>qM z{PSx7V2*h9rsNW<9^*LApodl;cTxvCPGmABIp6$>GfL=Wn?Y?94=%0-8Yig~u`BnOKs z(RTJ{vw~0=l-+=xZ}UU9*$uf`wrmqLIS+DvfsRdsKCVMPwc+Q86je-{4DUZmO$TA0 zaoFfp8m}7X<>&JOCwabm!W>@w#Z*R@9EWd{)Xw_>igguPMa0x)&7(}RS@<2M*_~PQ6|0c=S zn;DHyBoH@<5L}A&kVD`;vBE^QP0)$M96$ywgo5mvIkbG%X<`I=$l3svZQ{BeY7?ray}YK%Ba zBrAUbkt0g+!myW3HzzE^NJd45$DAMgaN6&md9gej59k@=iCgYrlj>?a)HQ)cXnKjH z=8H^?64AF{ z?lzLQ#5il$llO9Ms*GmTft<6zJ@IxIu+VT3wm53&%maGNzL9vpkz-dY!aq}cIv@{{ zxRjWLL>7dMEMBdFCWqcA$(-whhEq^|9(+?P#9qR19&jYiD()Yrdj%US#_HDpqddvV ziPP3ttp$t&RivNZ$)$IA8o8lfjdcn;`5C6|aa4B)jlZ5^R$oW;Hb`(6ta#1nqW!pRoVe*Wx)k?6O;Hjawe zam@&2NDY|h-CIE_iWZvw+#bGeK-{&8f%KuCXZ5S!b-pJNv;H{xS6_s(5Y||Pox)XL zNA!2#+cOyzYy9(8Nrp2f;MWyca#eE-L}G#kq}i*P^DivweUxR#og;enU33^*jd~+1 zwbv!2e6EDH`TDTJ$Q9L_qu{FcWSoQVndlNmSgF9xp{)^GN&Qi~&`pO?z(w&=aZ_A_ z>E`>Oh+;YJ z=TZL!q69qe85odHK7XoD-zlwYRUNvlq~@ETTo;F8Sg%fa!ov*ISRArvtB(^Y5B`9|6|d9Y5ViM2Z4z4Si&g z2T$)Wb$_ZW?5l)Nu8KX~QIZlYlsTxm0oGC-Z^=8+``M%uwnh~bUOpl>-%a<$898}= z4!D-K&t>OOHl!FSJ{H+OfOppApM1c{CDlc0!^Fjc1&zT{eDc=pJPQn2_?jQCrYfg~ zu2E}wx}L0hzrF#9%?#`o6H!|_g$vpEW_#xFQxn^p5SGu@e^Fx~HI=1iu%7DOPqIlY zXE$ZN{ViaTK^DT+x(F7SEBZ5c3C&&F9&-O=y;pbyTx%~^BR?H}3U>Tn3=D!~?`M~R zp_B^+Fjk+K6>MNCvMY-T+6p}H4HHB?X4@=aoO%{j)XP2kcR}Q8Xg50E>!_Ze!XN)2 zPJg7%xN?8AM844LkC>O{bHuPB$^lmtY^e1l&V)hkH|q=Ob4|%mWevPiG9!)RaN%66 zg4Zux&JXrCNg$FR&ffU}g6lg00FyY zD-kUNiW44EApX1nX|g&*QXJ4r;d;x4rODA;uAD5!7yS*yIg9*WDzWtTqfYicBZkVL zJ%#cqqUb-KDK?oG)2au>s-JSEa)9?fAmcpZ>5ONL2|(Sn@;V;0n=PVDw(fkq0{F_x z0jT!K6uaw7FLc_FCdC2~oj73_7L@ZVCj8_9Q=pY)uyHcxR+5v@dohy5NSv8^-odtc zn!$|kwCLRn;Gnc4B#I~3@2=bbmEe;#W(eK)6B8i%QT;&+Z^%(VbNSwr ziCE?4Ge8WM1RH~RN4bwU)&rSReQz*p@eS=2K{31JI=(ykFK8&z;_Aozx<)C*5sz_ETXR3v+p=Yk@RkK->7V?3x*BUW2Tkf<35- z!qAI-6HtcULls4@+meZGKO(%i+W?eCb%0n6ZRYoK7VHz6skM3hP%2j8U?qku?y^$Q zqfnsBd|mwMj0@8O$&qX%9U^gbqvx$MOwE=xNx!`4oT`5)b0b{QWHxP87bh3BlRiZA ze*7t=oI2{pXD4n|eewfuF^hf*fL*J;h~dB847~Y5b%d={eq0P%f&f0kQd-kSsa>o; zvk?^E1GWEDG<;Q341B4(EJU{Wt8AZb+Tl0--_cDNX~I?bA5AQZdo1rC4>$}yUw4<<~O;bNI8zDO5S9eJ>w%l(|= z+ZpQ#_6SQK2mO9r7JKYPG$Hf?vnC;1A8PkGrp^Il8^RiH3Ek=;$QCKC0nO<>1JM{w z#(HPPgx6hCt4p5qo_#BDP&7B1InT5o%b<|M%T*hT4rqDcme!nPfjz=KXU}=@ro7ReEu<= z)apA=isg|q-$3>p8w*->$y~e3Wcs0XF%tch-b28fSxaEnT~}sADe9}Osh&mRg<`^y zl8Uu61gU?-inIKgsEcTX?9+nX>YfOzq-IqcvK-eYj=o#x9OC`QBIrA(YS=Ac!Ezi9N3&W0LV8ar51SyUEfP{9e!VK z1|ywQbnRbv1kTEW6qH7EGU)vWn*9-w=k82itDRp7Mr5>;zjUAGuD=%bTCWoD7Vxd? zJ;9c|UZ09N)>&SjUY*`v!D#^>D-O%4HR5R;w`#lYPMb)S>5AFyim0K;$vObJN< zL-3<=bTcm$?n5I*q+7sT@LQ!Jy96uY{g5hoLBp(Bnq+P;%LbvMvvPB9mR%sJi8`LS z5pYX5Vo{eQ884WAO`er92S^L3?oUpAt-K7S3yPU^O-N(cBSm0IU+d{CZ+Ljc2Eoyz zER^jNuqZx$jMN)zhAVYB|Nl$r37=g)0-y??l^bM5X^F!9lwae=Pf8k&wj^&IL{?hIJ&x1D@9{rvyH{`9@oLEN>qw6z^qa!NbIg*y!AC$q&_?Nye%6uOj z>*O1eN>>UMjn8-^E}@5Td`Rok$$jB?!UuqpSBv<4wR=`F!lw&a7jf4|=U+3yWruxf z?I4CFiwt7~NnZeq)sISsG46ZoV~x~^fHn#bdQo*5#}O+$f8oy#H(x$BRlW(dQn;6M z-%R*=j|0U|CWHcbvO**7kfdCckxCDXyGq1;w2HW&V6XSZ4M|vP)Z|_xfG;fVxB+=u zj>i_Hm3jNwPZ>mYCux{5#?Jkq+@(*y=~Jn*3MPRGAQE229&$(2i!FXGGN_b8@XINA zy)U%vRz4_U8+^-)3Blw4&QeRd8_7fRedC|lV}BTs&%9icB!JtgT#G&}85PJrxQy1Z zG)$}@au)tH!Y?u`6mORXz+r~(l#{H+w}1_EyV;d&JIHV}9EUj~k{3=adHeP!Q$I`4 zJ^IfcfIxz}|1ik+eICIg5opZC5>AEw?s&lP4pm)Yy8B8Z@LR~-(RcY7A9fPdXwmfc z$v|%b{xVf{+W&fmtvWOq^ltn|9y-3c-$ppzYoKxS@#A4<7F>*f&VSa|a<6A<|j zFK|T;ngovr^wlo_@{lz^*smp;QTdsx7@78$?Enr>URnt(>IB_{!~Qd-2i`*+t#`kq zTk~5Qj{2`?@T%xt`4g6*Sb;u{Y_$LS%+I~|&|nP|*0M<{o+@nIz|?7xoGP#u9L z62rpom`eA#H;(Z0A)Ifz#Q$<%*WE!GG}%?_DQ$EF`NTnh&Z_NpKJT~!syISm6qovk zBu;aV0|25Z=)(8@pw-`k`ypM%EbPcm-4>CTS~6>u=gPYG7TeCdk&`~-DALdqcyTY4o`qW zhRFT;mrO`k@ZZRt0C<;vUwXMG9S89c{{nmmRrRw6^Yy_Dx$%^w-r}|Q!;K-Z5b1we z3E&y>9H>@#{0@6iP{lcZk%*!V1h|h#^N#jVs$d5y7W4C~v)#@5=@Rwogund}yb}r1 z@pT56zD)lO67oNMlUp#-&FaK9BkY4l%d;qlq zlh~;LyXQNg<+rQVGk);@Z{OYDK3Ind)X4TRiGPQr|4%RU|NikW?9~|P`y~E-jr@fQ z|EIrDh;Kc+;QM7HxZy#M$2`9la5;8x{Z zAdwykT;57ESB)v^?M;>G0b_j&o!of#2jN}>sC$RgWwOgX;evenk^ko$>7S3-J@E$K z9ui1TkTNLHX;y++s;(ZHww>IazFOpF|0IHhxVGl&9X~bXiZzG109lm2UbT+XGJ4sR zUNBAPve^IH<@s1hi#b{8c-EGoK@HOq8lVcDt~2<0`Imm$80{DERj{5=H%4Czd(81p zm&^b>zQv4upSu;MG>w3FD*JNp7L*{wpy?b;EyN?xk0G%gB4#|+Oghou*bh+`A4Y*8R zVFiQS>YOQE--n+R94d#96Bf&~{5+)M)9!FVD;+rgAW5`=&jel87#qKqXMJk`9H`n6 zPAaOQkNOfVV$WTlUSQ@#?m}^R!xV3cf33eZNvxhfqmw-2Uw)=6VJx~uE>cmdOtGpqbY@J&U7+}l^ zhKsf)m~tG8)iaU7d^RsenOzgyfe#Cbc|p*naYU^i(W+ZQ-9fgi`I#fhD&1B6er?Te z9aC=wxq0LJMZ1BQ%uVz|rDP=g9LfIst8i5ZlH2crXWG@|E$cr(vl6Y@k1xgif*6c| zVy}^k4>p&dTd}7bf#7OMm2{&GPdxmyqt?_L{dU%zK`E1l(vU?hklM+Vgj#+>eeY`i zM~ADml7WBH3I>JS^Mj^89_~o3^UIP_O@q|AvCD>F`+HiC=NQBQ0TA-&WAJ?>4E7|a zUCrp`RfY;%S`C{&0;*}tMqA&VSHf3*J6EhH?VuoTbbVNOjRX&+hCP7`YGv|nHUVTt zQSBfpWsHmOJF`|<6A4@iy3$9mM!m?t7XDVC7K)1HaV1x0*-h0M#>815c*&U``=M9q z8d;toF)of8v!~qeZA${3m7K9Hzcrlnwy&+D7CD0KR;Q5^u}rsu`&-@$DXm~0AW%S^ zed-PZH8utp0Iabj;rEDzsvoyYv86vM*VeYL+PMwP_cjJVvSZ+7G-mF?1G?mJUUf}F z;U%xT_@_i2V*+$dqO$!J!R51&+jV<^x|pz6wZ`*uPvml#;-&4w*j#`N@;G}$#~U`= zl(SdSX8(Qi)|n6P8YasXN)#-Mod*X>X z(umZ^BT*5#1Q-mtcl$aUZ|*aXUVpgIBHVRRcwt_0&n6pRXRJg(jSb~;)g%329XBrZ z<~7$*oUzt`gQm^byZXk61|F`-qL$CzXyuPekC`1VEw)y^BN*7*&geYTe}U9dPQl+Y zY#oFPAd>xYXzVUxOQ1IJ)OmInyY@AQ4I_$)y=2Y4Kof5crUPk9=S4xeT8CRBh{^b5 zKJY7kk1>sFxBHjv=vlm3eW-H%=EUh=SPGd3pojcAf{zxoh-vQhx>qR8O4Rq!2)=T{ z75o|ghwh=PdY`P??xA6Gpa8diay)Jp#O^lqveoW!P$ZyvN!GYDi2R0%*nR{G@b5w>#f&ybXK$(e&=3xHbAXuQR-=%@-r@;){gu&TjjL|e(um7 znbm?5(+ZZ_d@2%lm1%QxtpOsfp96&(X=0l}kS=G4E4dk7oy9H>dI@YN}SGs*2)!7LoNFjLBwX>;^X{w zbA$;B14lq= zJM2!js|Mm|<&`U8n?Zw7NnB};WrN{Zuc-3ySv~nbO+GREMEmuAb*J2y;!i?44%pUZ z)f-@6N65|E8(i0J+aS02JGB)!^_?79(uYrg6ma(84WjrFIMbNUW#a6|#|@Di)Md~e zxTHWkhE=Xy)juYg-_@xV>@%pLByw4jQP$P2OI%!DV+0t9nN0DBMIH{(L$ z_BH^^B|*CEho`*he>E!YF+Bu0zQ+K=yim|pBm#nBmmP)|RYT+E=F_d?Y&&A;ybSor z$v$6ymZDPdEFJLf#GlX3}P>y3kHnQwoAX zjEAe*$x`N9Sr_;7PAis65PWlGehOGlBqv2i!ijDL_(>)3=csFj0MTW zNM=sBWSmFiiZot5eZ6@CymvwIL#%A`c=)#LIT%c1-c*7VNp*29XVvMAzMtTTQogL57m9(+ zY9^UWtd~46bR1tyl6O#%gVbQLRECEyps~{&UoZXJ5JjA{H##Y`^+SIfFz9SnL-AuqM2PaR=P5xtBH|)sj0Sg zsJg={gLMRqDUP#Ok|(O81FuwF*Y2`eLBeA4fTPBaYaWo_9D*7$wEx{j5tvl+P_m~M zMS&(Ic`&c!r4FcBatvElN|htO^f$V_7(Z@?F$Rcr7M-jCvyY-vY9gHPppl_eJGo$- z0>kAd&p*UpUE(YL0>b&|uY+GU#xtdqM|`Nl-d@4A;5iagP=4)P=XeNT1(M_w3ZfaU zU%=<1%Xe2t1p*cRf(hJsMU0deRtF7PT<319hmcl!bBWV9aYq~3KYz+TZQ2%aiX zdlbp(GP_c{by(dc*KBeQV>3msT}t3IZ)Y0aDB4R>?_2W$2U$Xufb)v|dU^fUp-jQK zfH}1sY}922cn6)#B{IQHa=ye~*ksrePv_7G#hLd!4*&BYmquvvGymJhVB@lV$G71Q zf1O&(vHp(hLhe^vRRxQ;2ac)>J%!11HKsy`pHg1H#04O7=?`KrU?FKL{hQ`Mc04fw zfD_2cc4jC{fcx}kYq5TLFkf$!T<1O+>i;T2M%j1N@#A7IcGOp{))|LWAh0RM9Ez$K z;%&DaT9a`mE0!XBisj|7t@pU1c%uCcU6&uMO|%cqnyKt$&vqdB_(REV*2 zso>z$%8w+@VKGqSJHCO7X06+gQ^5>t4XJUk_ zSF3kkGTQ{TtAoMJO&HaYHy(_5j194MNT0WVOu#-Xs3!Vs#D^)>WIJ&(xcaj2IyYex z;jSj2RXK!UClp+a>BBLCT)D=aX&bp0d`yz450i8=`OJ6D7ju!h3rydKVNSnDP~oW^ z)r$|c8c4XsHeObp^=VIWt^t0|@4gNnSCyftSx)3dCI5)mQtE}gBM6dQH6}W}EC@z6s$yMk_5q^oah9GXnS=kGVj)6x_VbuDu~n_l z5zyyf&KCcX1^igyCgIzkQHQzbV6=;akdTSePsEOy_%@Q6r;X%|+LIv${hkgW?l>lb zfmWdt0OD`yt(Ft%qFG#dSPIM-mI?_zfa;Y{v6h95<`~MT5Cl#JXxC%FP&)KbO=ERf zi?h=M`m5tzoV<0ZS|p)i@gU@*tOF1)*}kBw)A$9D8u)pZ11Q?6noSUC$-qA0?j|@r z0H0SW1OQo^+W>APLE3c)sq!OFk=$O(So4W;wm}b9Ps-TMp#tg$O`9Q zR}Rxdc9AdpAZYuq!gdeFhHAN2P`v6^dMZ`~8{TH=!l(3(m z?=i053{r2Y`;SM6%0&G>Ct#rDj;=_W{#*gbI>8Cmd+*xln;-J;gJ0+YHrihZ|G|o6 z@G0uSFl$)r%;Pl{5a8XYSzVBu2sAI-c_OuUV=0J&kaq z^5J;~pjCAqzLjFBihjN5&0H*{mvRZFJ$~LO-izc83(m%#NlX!_5n2Ml5f5kodC9>_ z!0%K+3Pij@U#;B$hj6q@%n^CA*$N%%rDV{b^355$fn@ zL*9%6muBLy(pmrs++>6CnnM|w>SB~1fAhSR(q&Ob7YJ)R6hm@d4x9coQlPs$8lj2~ zI`{)egG+n>Z6V1>vyvjAy9{I3Ws|3V@Fle!7HhyQ@L&Se6xedu(8x}vu%3OUStWxjp|~KL<$g%tw%b-*;*eLcsEqrq>UGe`0X2*gKyUpoYUGn%wrJQ+kcQ zjt%)w<|BZVeKRE8P=}6j96}mzm6O{H+VFWjyA$$X#xpe!^ zD%`Y;z%;^Ne&kC5u`VxI>KY*w_*X*e1uiRdAre(p;Oh%W*=c`^ItXXDtl4yuOye%>Bi4;44o{S3W?4}RNhNnaiK|*Da(TAi`ak1iia8Z1=4kJU>aAJ;rTR`!*xB7}iS_VsYVH6?YDag$zGGW%gDC(d)K5!e zC$q$H=T(WJx+s7fV)>4tQs+#dHs#crWEa~nz2=g3_Vf`UhAmz}bLMOwuSKDIzaX$w z*^|y0(hHP(!hBo`DO%Ha1)6q)NFA<7(6gPnElm7lgI#PhrWv_blo5Zf{&-!Rkmqhp z9tETdsczL&5IcHhcks2&v8a2&ztn}6+-w!lgesGcSZ8}jG@m`>o|D(%SdYIxX$x%@ zl)#7=PCRe5=PLHs+v6Ncx^{v{`U*(smFU2 zmaG`a#m4RA$T3@?9C<3}DQP&<>`a8g_Y%tOP129BYDU2jT_`f3HqXhlNQMqMcybez zcT^1Ozt7~?dPR6yRYu2IBm?>Fp+M6}{Dy%Jh@L3st;*?d8LUayvYx1F3of@?RN@%hkmGw^hNp(y1jxh;d!cM1AvupXmfC}rVSY*~#NA&$ zDLq2V{V+O#!0k;|L9bZInefmnN0J5CBPX6vtyWj;fnHYbljg2KD$p86I4jec$C2A; zbt_-W%xti@MlvT&7OJjr(9Lg2DFo$m^-_ZGkCAV$NVmZd{PX*WI6par)R;A3k+Zt!($(L?0d>Q`=`PWcrL& zCULFj+mwb!e0%aPfR-wd!e>LGb>`II-v@d(Xm=_orsG}fy>@(zC){F9PE~#l6tBM# zAQ8~28WLFV#jjzCBX=`9KQG*w|Mf&FwmOniRtY4#+(i9+8>I2F)dA?cBvsbh!XWY^ z9EZU(0V0#YMn{eOCCI?ghfEY_8u$%K6!8^c?yK*Xy%%6S7E{_apb;Y3Cvfk%$>5wD z9MIoR=&A=`XJ*TvL*|LToR05fLewnB&ROriVzw7a1`c&pkalpVS#vEsBzPkZGwZE) zSa7o_@1d@Ts%vZsJqK_mAXo^XQcX#z>)qnJJLCK=?aO~G~3gYCQ#UXj#)QjI{Qpyl^wJB z`buGyZLr0O=<2oB+t}*%M)k=V(}77OrQxM)4`l9LS?67`F~lR)m8e)}!D5-u>z~6i zUXvaSF@DWuIG$cp-(;g!2$WON9wVMu>%SL1j;|A4jIjNI8Dn8=&!=93{wCFgt-C+( zl@56vtk2nY87Jn;H*&|R4;XTZHfKKqOIbg=yP4m8#?=OVE%N)m-st-zb57CMOG?#| zALjziZAu*Q36Rw41(l@C@d_!?(R!qvPSGg)u1uYEXkAB7Ezo-2J9$*|+AmIcRAd>9 z3WyWZ9AdTV97YXW)Ci!`Qkd0!p_MS;)b3jsTeG(#G&x%sa{+?snzp&T*szFMXCA|Z z`C;R(37Zj83u4ZRI&OQQFHa~(0JDzm>PkQfFsjSzeXqXT-4Q?cKp?m}N5DS0Ds+a0 zL++}2GicvJN^B#odLu}^w*JXxMXqIM+hm@Ctr|3_Ia5`O#5d>{5L$k~@#N}0ONmy2d<=}0x3%|!ev;_8l?9;BgMb|9H@ZY&${dE{ z1Y5S^bEN%Fs@?UjXTJ-WWV*;-g+q4jW}F+0sEPBN#lR|m`;S%5QH+f$g$c#zNTf@Z z3Lvw2zqG2`@Q2#H6jlFD;kP1|k!B}k`?Dyr2-t-yU2NC1E2=r|B=a`EU8}b$NF8TA zxTSlIFEo@Es!lgJZa%OJK{{|JE;8_l#eU5@>iqf6R3PK8zKqy$wyEDd-Iy9?F!fS6 zd*V3QA%JG`0g~0pYxW`h?mY_K8?=dc!?GErW}USFR9h|IPLoqyX*>L8r0FvUjH~z* zv|~tuL(?Fer|{13S8%b3i4lVhU9fQ;TmFKc-$^VYVdB#t|m^vd9zTeYT$u4Hu1uQae6HB*n+3*59c#(dJ-#A zvi&Cah_6|fhfnk|=;t%+IDjkZa_`&VpM11d!5aFgy*`O8AYn&0$|q=7o5Hy?WXz)H zz#S~Lofkkdm#NA;8GFT|-N5(re2PAADVB4aLWv4bc~N0c@#9ehaWfzJ>hlQtY||{u zS3K-601JD5BTyl8-H20Ng*{3?a=uRxN5A-G=O)0`>?r5xiM%P5;E|~jJA1^p9wHW& z>^1|7gRkmgcMNC{|_JgkUo96Z7F_9Az+W!sEw7ZQd2${{o$0sw2aU9nt+_ z7sB;E_A(cBP~MP-{8~gNki{?N7*$QCBAO0rAgS}ko!tdxI^$^tuLmJz&F?5jVV(ow zdN3BMfkfZ+7U~sWeH0=#eqijts*iQao+LmI%#3Z+z6mD2Z`DChJ8WBC1s92XTYt(j z0iU-02Na$6HuCU3VTC0vBRC{7ecq^44<#(Oc0-UmBl=fTwzMdoKLdLcT zibkPY2-ktYT*`6s)hMq?c~8zpbp(A`GGl10JLt3Hp~lC!u|&BWTt~T8N#U zy3m@({ZuKAd2&wEKc3c}Z`GI6k#HrF3fo}PCDiq$lv+_6UDuG(WlxkP@j;cyg!$ix z!77p8k21Y37I*K@O7tqa5X-Nhhn8a%eSusynW0UXqSwW~)k$jlf`}lZ*N7>{0rCnk zsyTrot`_7rqAgO>9q6)7!`FN+6OKSD5vxO59n-Wkq!m|j(eL|2rlbqgB+Y7pp>~tk z)JK&CfK966_5nf zLZs8*Z$R09(okqpUtk8{W>-|BM=}wbp-0QSJ!?~ieUA)h`}9FQ6tdDrZ26!>tVb70 z_z2T$8qql2ok2{quiSD|3A#MHzeJhUtMAf4@5_Z&Va597 zAa#jv3KsMbHDPcEc@*Lu4O%&D7q%likwpZKvVJg^+Kxu#)Q<8;UZZb4l!g7kID0Yx zpYzC*RlHAskl33KVuHa$vUUuIl$&R8vZ2g7-lu+8Bq7TVCV^-mt>BZJ4JJr4@lGD?;jAAfzq?wR;B zze2<(Z}anE)Q+~XT4&V28$kC4GDievFxre@Df&2vHW}!37^CD?Aj|x2k`Ah9JeJrDm_iJBi!*+J0;u^xB6!6j1P5dT5O(l zVVxBgF(rP4=1x)4Suylc8(}ldT`#4o#HL(E{?AfJfTe!Rc2FfhVg3iIdq#<*B2OOM z=T~<4mHOtGWUWHgsCsSeS-!S4Selj(uNyJPD_+oie;8K zOh~wYV-7=5(H(%h-3F=hEchjpPA`V!vok;WXa3dwtBzLeJkl}Tg&}8Ilk%C;h7}Vz zdw}^u(M;Owy$D8OzQt$jxW1#-y5N{Nwv!9y^uYu3C!J=$_8&YZ6a+~$1cX!nbqBOF zxzy3^O*$Sqf}H_v^4CP!;)yQzJfLh~JjWnW5s=AicB#uke800!L@Mmlzsipy_VS0- ze7m*F6$zoVCjo!*{*p7?8$1|}$jB0U?66yZRC!j_c2^LIO7E79j!H+$T{^b+7x)*Q z+aC0dGwF9bvEDeQn zu}~+l*bCmAfTFD>%}5=mWp5RM={O1Y{uz^e4k4DC4>xb(4GX%iNC_@z?N!QJ;7 zb<5V8;)Ve!c4o$;PW{wcyX4f35F8dV0J4; zce4CR_VvMxl(ciuNZZy0!LZq~i(e^`+Nc$p$+`;P`j#-aOFvW8%waYmKmAQimbngO+A)=oz7vtCqu%Y*2?uo&! zE0~uRaC2zCNKpy4J~P)yVXSN$`p1UOkeR3=A20znK&(RPOh1wVP= z(q%;AJPhz{^P!=QqgRFf3 zY<<;U3E<$v8^gJbRCQ3Jn>81-Bed4ACFKh+)WUAVHS#*R`kTt{JE3;z} zV=rguz$z1uT0B7^D|6I{$wlxfp(nk|+Z<@k?jp?V5_AeOVDsXrsy8o>zPo3Ey*n0JrcLx9BgQ z*m~^ruVl?7%+Vea;q|?l3h)~a&StIL;O{O;O}QtV67X|*Aqq3n*!Yd6J%>t865|AD zZdzWp6sM~D*c6-9;x#yF7JtTyMy8|aF3Kl^ z@zFA^2yZ&rvl&cP(^quKei4A7A1^8Sc>_rrc(4_Zk5ud8U=!}OB7)BWjsSJ?UfV8U zs0rbqO@{(5(-p7aY`vEI^`DLk(D>hCkI&bOrND9e`ra_sONT$kFv{3A`m3p?21QN_ z8ndQJOdA2g`6iJsDA!k^a-GGQ*wj=va)GAYt7OTz2#LaG#!#2xuy>?};B z4RkM_MGx(fSq^Fert97^;P)^OdcD#BS$k*b%6lgf+58as=mDOnmT8T8r_3 zC#;mXl!ONMASRFH?}9#o7PO%N%}(==c;mrIyU4>1dQfkNeD`z8A3CDV+%|9wAmL#v z*bf;F7%rvUE&tgid#pad`-z8|E7EA93{NRgY>QShjCV~W?Psk0)~7sGga(Z577UH0 z7x(mHWF-4XIgaU%q{`Fi4=SGsWyjG^f`?&%-$Ai-bbgU#6p7gm;R?{aOu`hDd1AF7 zy$kN9fa#^TU%DH-5l$*}rFRY6$@gwYBMv*$LBDSd{ACL_QIA3n_6HsbMzD`54?By; z;LL$>MeZ0si;*N|!Fu`!&_`%=4enH&L9>?wPPi(|S`z(ZAP9Uu^j27PE| z3l|VOpbWl>iVz*)7~arq8+r1xt*&EIJw_VLvn1&)1vP7Il&+^4UQ*LrEaZ0cVx*4* z==Y$HsHVG}wxPY}M$7lS-<5R)+R5wWkRAVmtY&Kkz3d-}#4R5VH0oi5W!6>LJ|Ya- z43lBwT#PE;?pmj%9xAD5awuS|!smes&!UnB+(oT_N_5=t3IIzeMeHx!#0edE)`FNeKcIMWkO_1OVO%s6lMD}0R*p`)zs08ay@ zdoDf^fBdZfu@*&q!vx-@?U*WoXXpV2?h31Z+c=X5ouioc`Y)VP&AoR{WE1l~;j8aB zCt9LSvNDgyJy=oNBYsB;Wti6-w7pf5nVR~FVdovGQFiWA>mwj8BGLx12A zn|tz9dC|{g?d=*9a72e?v4@@&sdhfN^`86yTDDJ~zK>Xvj+=W7uOS?JM=kh9c_-g~ zZ#J@R5^|Z&eXX?RRs_}UmP;M!)`NwrkL`uMj`wqRvrl{&1I$s6yqsS?EXD3t)^86e z4UJLaK{$njbnRu2P=q<-`!wKJfaT_#=XCR_46IRiY1v8#EPl698j*uvD8+CIY&3cb zG|5Xbt^~S+xbI)?5B7AP#1m+kvEDwhK#Vw`de-wdhT+VC-6$r)%;9Fjf~tM~<l)o8_hxxNfMAJe- zM^B#BcMyPCEfi*l&{__c6Tv#Xs6gifGoy^YRRAzdJ@wm`Kqa9dMDc__87}W`eOtTt zNt`Lq58U0;G9u~=xbmW03ZDk;Yl5`d&)wy%8LR?hbWj6EJdPO|Q}9J8G}$r~oao8p zoV261M=qJ{nSi&6QOiUuJxmkJPNWKL^t8kC{Xkz)cdM~A(A8{Qb$C?-`CVLa8@G#1 zXmEEArdE+c~en6TOsk<7heUf@;R6WbL;uwOKb@fRS zvJr{6dD5gvk+{20S6GX@*GgF53)~2z(X7MdC!Zwk8U^X-azhSP8T~~FyigiKw&X!; zSEhb=A*ngt*40oeoHd|!$6Anylz450@LZ&-{4vn#;{)YLI>7{(c(A&hSy9Y*uG_qu zwq|ux=20=jIASxe>#9@Zies8In(2BH9-kI6Bj#=?IkB{vmmSlt9z1cr{N|(E{M|=MSxu}XFiPDb zTxk5#F-!>Oa!;D^vBMV>lE+pff-0)IsP5PIO(oQBQc8`*skV9bj%tWuFd+5WqQ%`( zfJyAVM&8RbensTACjRhMyJ3_X*I-+P|-DEgRSHFQgrt;1Te|;Hl!TGlEtl60J zP@H&~W7Hpk4;_yL;&jZirJU(C#Fc;oaX$0#V=-fB?(9uu3UW}n$2m&JN2XG(sra!LIT(UOsb)(;ya~6k zHnqjAiQ@Etm$vJ&xZ=xoSHIu2gXtPG!)v#KO#$$67m4FBGJMcg*?E5WGhaX!YfQ_zU=D}yA zL1E^D{pX7n5M->M{3s+QDB2|0JZ4(bdqCI3XKv02jDcWJBt3$w3vM0uDJ@q5F!s}5 z@7|l#lOj?E^FH}iCPvZgnJd6vZ|R>m{))#}wO6uc$^R-YfM9s&zuaY^QqrPQ1`a{1 zCVJ*RW_|fOoorH&TVPk*3dkXKrCiijDfTHdFQ{wK4A2p_>04in9JInuw5C%T4oDrB zgPX1>HL8^HAy2HC)XG=0Zz7yp6f=juz+b+G;{agU7$1F?pqRRD+kC~ofrFlWiG@x7+7ZtUG`?Lg$? zMc!5&vLAgkoqI#-d9)~!CYdaKY0IjjclrgnyT_;~zdp~T=cU~*4UPZ~$V9G_wwKxD;tSP+t z8X6`d6PkZcsY3)Z0p!9|wf&2y13q9n^Rqha&r4)Ws)~ORJ1^03%5hi;RT)gew8>@S z`1Be@by35*6(4mqr9hR*odG?kv>}T}loJ_2EVT5=b;`Wl2b3VMZ%IK7YArYAR`>Dp zTdJ$7pE44GV%NPPB8f1!aH{tc{7MLS{J+wVEtmq#bSvv+?#24A$9#tT=eo{P{#kzo zj`R{@qfdux7tCkcWC)Lfo*Ko-K~4rjfv&^kI#oS!*e1F^<9*OCjt|-uE@kgYPZ^96 zv^Wg#144b)mexu2idnP&(!OOmSbVXZV4V;n^)$#@s`?S1VefB$-=Pg8Ed9C>tU0B- zM!T}eU*rej7;gNp*_O_@4zw|mh_7Q^i&3*PG=$jV#X$pG-SqqOKETUbZ~New&IZ6s zz7ln#={+^kF+bVN+q#=xzExfsTSk^lls)doc*&~zCm40q{r62s9!n3c=V|IwQ< z&uk(%?W&MR#Au8RM^%kdS*}NQWv_1Bb{}<*~H2>(e&uj zfD}J`SL`}?n9zLLa-nZgv^L(!#!&mOGzX2tVB4m@PimOxM3H!>E#kc(1H$>$ZQ~fs zu?fg5vi9=*3`+RV%MZ3?HzsmUd4&QM9h1vA9bxBZl=Yyls*3IOqyv1kS%q*L^X`C7 zLp{!|3}05YmD)UhrJLc=HyTB1;xKKd53mV?sdT@}q%Mu&vX2^{SZ{4PR33y+t#Xrx zX`ZN7b^p@L3{P6>**&LdXQ+{a5OxZbwWwd zd<>LQX?hxV(#oF-N|nUZq;2Xgz-!amUewq?h?kqQ=MV8CCq}LJ189ZTz5Q`3C{`2b z)fS5(?e!z_#IjuIW8wQ}}-{2r_IbudgB>vwDkCujVw=b$x?GY5tx(>U$?2ViL9 zBwwi9?TMIUctu3}`}B2hZgGdVpF&A}^}L#qluLnxENw_+2t}i5e(h*92sK39{XD1= za;T8l(-{rTij5~s^!#?9A-XhWDx#s`TGd+uBdzHf+(?X3kpzf3)K?W1-mRoYR)lDy zJ3wi5bu`(|V?_osFr%}mD`fRGY)l~50x1leas!n8p^Vj6 zNpI8rJnJj?vsx0z^7YqA~1nt^7~QbWl+VR zhBGI0*PJ82C^L&V`j6J>S}@FJxNN(aTXGeE*oZTd*>)4V0y<&tWm_G8B61FYn3Fn2 zohw`#O#R&96{&-FD6X`YnL%4S`w`(R^CYA!{eF}kaMXi8A}~Hlvi7c$^JFEw*TWje zhMA$GJD>KN(3se`B1A6jZy6Fn|HWY9CQgyuz#-~Ww#AXyrC}^|dl+74TvwH)Qip&l z#8PBJ>C(C|w;Ct@*!Qu6;Vb|$1wTo6^dT>MVS*^V#U2^~e9%i2WQuWE^zo>8E9oLT zEWagdRUL{a&1EhNGZX(91x{cGL(7(;0G1V*#i&CsP!sXC#9&VBlHHxZQT69>@CH!C zAd}||6y- z!M}hyl%7|{V$enF6>U{t!Y;Pu7N=WPgjYfj;LXY;^e%|6R1{2ERBu!OZ?Ywv{kBFv zqA}u$@}lUsebu|7PY~z^vwr6N069g$G&TynCV7X()d5ZB6K#8Y3w1g+(q(Gm3od_m z{0>4q`{5W>y7jl1BQQX1aE=ecm$%PtQ>b#fC0oYgn(oA7a`vR-=5dCrIk-3 zOvjC%2S}4T0xOC-e0=}0-oZqIQPSn3^jV_R!y5<#?d20{8y$S%^(KZ&LM2zdP7-Yj z3HBMeHB>FjOnXne<{FeLU!MqHpah0E6f5iXl z=X-a{?JuP1EibLc31|VSr~lwjcnAkw#^AS-W2IVib*^_0mhc!g!$@8A0DxxbJZM$8 zHs`v9Ap*J?j8`X=C*DQooo2SEXn{5n|*07oN zEX3JEF6f#Gk^Q^&HT&_EVncTJB;OC0J&>Ww|7#3XJkO<mY)gux7@?%rOTGFN9 z-aXStSr7Fv>A540GCpH79Wd#)HM;%8nFDA`JnumA_#}oy-P*pZd62Q%uhgkrWgdm2 ztw@^uz9@h~Z2>em?y3w8K0Z|Sa*XpkLGO-Oz2INH2Z1LrO*Y7SMdy^jur@#rX?y;i zSZgzZ&`rZ&_)`{T&!^8Vpt(jZag_tJg|GC+An)(6QP5c?0P+=$F18>Odw@{Hi=^Q) z7sP&JF#0s<$(Z%uXTt=PE!1%4Gk5R?paL4c%smF$?F3=I_r*?8X)RtTI@aQ)_GYZ@ zd7`vOTHAVpmd+2XOUn$MrR_q2eQ9~KGV|g~FTm)KX7Wc(@dm_qkhgKz)HL3Jwe`_( z=If#hHx?f4(f1@t0dP~GzqA?%tNJwe;3(Hrh!>)uxqbkpp+zCv4@cA-c$6z$UjzQ; zw7-|@`mBzY(Yifw9prm~qL}>pR-8v+P9|K*Y8y@kMzrxS+9HBb@ z`H!#-E6y0yVZg@pwO)XFcb$aO77Oh{ws&0A?kS8f)L@ef^1uJk?MQ53`IyLta!)FE z!->G4Wsykw!;+tgq0Q*ILqdka%Zi7q=-QsP@w4L0_&t{_v(}Hf_-a2_lg^}yp zRR%P+7B@4b=Q>$-9d&TXw4MM48)k&k_bEE*;?c~5T+t0fc9)6<%2T}Msa4^m5B?VVnxzy|8dG4I=X~bK-=705 zr?fFr!#Ky)uq|(FOh-8+Q@Yhl=GoxH4<4lnppDV`HTyNZ-6?2emFm3@wlN&!S|LSB z3c9`Knv1j+%;wW{ku`Pe@pCTh^Wjh0*##vHBl#y_fF8O8?8_wIohuTz6xo%wvfW+V z?tpkTk0?_XvFQyUdW}ZPbI=;4s4$5KMq8_d8dWr}@LEP91?P)p z=GZ5)uB%R-)Ba&DY{BtxLym=2T(+T^gP>SUmnWYEznNM)A%myOkv@ISlnxUTSGVpp zRmYDb|AZ$|8ZP?=dHwTlIYN!Xgv-z8&VHaAC06KE*FPtn;@{%`{sMNOi5OAxc;kuD zb?HS&|FU7)P3x)Q73e@t;}KS4|1ccV%>QW(#1d_@xQGQ%@cV`&FGo(LhN;7TmDT_# zqtMH{40@{^0;bv9a{NtezBR)T{E-opms-3O+kCR7QF$WS4K91`JIMsdl#vYgCYku| z9YCg}lVix(CKt?tDFZdGhr}j|_dAJcvT9Re{hYa zq(6u-Y5M@=Eo2Jen3mu~kq3;k5jnymq3M2Qz(oowCWO8Pcvet#x5DK*A?t8Iz)dwz z)!2wdFS&3tmjxUckgR5cE_^a$@aPJ#;uun!2SVp%L$~e|`*8lLk<}x}KKxqHyj&*i zx*nzLzSy64-}W)}g6DbUx>kfqm_f6o_vOAmt#M6&?fnl;AQbeg#YV&i7DA1Jqj z8cAXeOeMl*D%d{X6i;$!!XT&0JteMgiBo2hybIY;3;{&^EyA`5ZZZ*{P`yB%YD|7&$; zPL6|q(N^PEg^KIfq@tNbOa4EC?Bk|O&TD!R_kP)Hw#%p-JyN~+BA%CV@Ng$w;X-i^- zaLOt^Z|DjagU>|T&jx)KAkInAFwWjKo`A9v-%1)Q50tG3#k;OUAF@xjrUMhUv;2`W zZt%)m_poFo{4sT@>cBX{;rBzIUtUKLud?0^hvwz(6<~c5Wj^?r=2;pCt&q;2G z-i8wUWr=NJWKO^?!O3XJeJ1@7ztj_%l;GPDO0+?HQdwkvO1|#V@&JGzblWPO@W&Lj za1aLdR{2h~2eLQ}cw?re_Hj$0S)VE+W?PFzS7tz&v*Nh?GkuZh25GwmS4J^h(h?{F zl!k+QS=Ab|=z-$8Q;f7SD07p#hH*&nof=qyL6+5wm2vJ-(!*}El}WwUS}Te47MjPW zEaFp3={uEr-1P<*)lzXgCP$8!h6)Z@E})W^WGX|LOThvWjMZJ_WqB9QxLp>X3JNXV zG(jrUT?XRT+U&Gg$f2+I%PZ-(Hkd6DWWNnUPvt2ML&AOti)A2RfN}=v=(QLmvo8xg zOQ#iN1V&UUyhh*%Mj*XL{cQhGmF6o4+t5hHPmfZD5QD?z&cc=4MG;jWY{?+2Kg2iP zCYm5f*jG>1@ajSL*BmP~>zqw=jT)8Zhw~r18Y<+|=d)Zv9(!+{hDk9gEtcxo7lS%} z(_x?<%|}c9S-?hq0fW;w7d3;1*JB;cziXRx(l__NR=4p9PeqTXN(?Pw&&T8^>EK`O z4aU9bVL$roz%H-tOBf$Ij_j{lV1TR(@)_ zZP4fAW!i1z-sPjNecwe~eyHOD@sfiSbcc*JhB z+%~uog66=ewGkW}jwpp>Jzg=Z4mVrgL=?a9EWnuqiPqQl^e(E8%8~*q(QSie!^Q4i z;N=jV?o5r9x1_JqnfTq16Plgcza-UwHf?DSWU1ezq|0NRdccQBuleR2@xuX(Sv}3R zMWRgc4zn332#Gz1UlV>RV1A(;6^9R@>c-uG{HRVk(}8xMCiE_5C%a{llAS_YuIof& z3n(9{QqJutW&*td^5cGHA@e;f655oe4;vrMLa#xA_vlliq=e0t$omUVIQt`c$Nt-2 z+GO{6UUkH(j2ZODCPom$LuNdCBDRm%(T4**=UQjlp>_u)@`l&a=@#buh=*;=Bp5|dWX9nJ}73S^H5g(@uNW^A7*4z9@VjK zqGdEY5p^NlPYdc2*=Hg!yZalPbXz;`mvni!x}8F<8YMdNZ(>)e^7jEby1U2{)EOc$ zx^>F8^!IP7@&)CRNr9;VaReH>=cdE*iT&E?p#**36qo50KW%(}_c`&(V|b5G^|ZAL z)&yYAbScrAj4H4LH8spJsk$YWj9U|1 zMS04~<&owOo;ehsJ%Rn0=5i_a;#xvI1$I@fyNj`&Kn(AJ4yy0eG;D%p0PH+8KKk8L zA-<0h8{^yMw=5%zahSh5vaYE@T`{J!8v+(9{f3gKJ={RGt%8FePi>9 zG2NzW!cp}E(--(Ci0LA}!HCEpNlTVTG|TO3H&s$$96m)GX*1g2jiR>gwDxc$U3O4< zO8x^qtPA(^A~qh+qm)!9id-iu3=YC0G;A`4l-8z}vv-y2^1->g58z>%>ek1hoQ-!R zMP!Bbtwa-sLeHjUlNE6?n2`eF|Kt*{0#sDOEDE>VXti5Jwc(?6*flMHus!8yg&R@@ zT^En$;5_{&_SgR=Co$j#S#W#W+HXmq*TMdw*#&Rz7EdK2kNsz*UFghsHL$4ySEy@!_I&%Jy4Ypf{APF8E9g*f|DNz$<=KT07qLK z*?s+I9^A+f-(emn^bDEX;qMz1g5RSpX#o}DA4$AuIC%LOoB5|OHS)H2Bnzv2^L<&L zd|mvu?SD&O5>}xq06U`(DDAu(zoPj;nFEjiQenRX5X8mFPV|#N!nb$KO@Q|F^p!Md z1J$*P%Ug@<0E5_r`(Du>0JhD;5NG~uqQ^-;4_xs{8E`Q!w?6ZH6!gd&4s6040FjkXoldstAVb?gzP8X@ufH@88=} zL+moc+9Jh&`DFi(e|-21tjK$cIK}@0_4@Z;`G36e??~tdi~Q3i|9{CU|2JQP{qvpB zGa}iyJ(T~6Pxh}D?f<-)un`U*#~F>%ONss48|r_2-hcU8zwaQ|TL_cc7+Hf1MO@H% zuE*U2@jVgiqq!OYI`-mU)~81r?l|aPw}6g+ysAHi=yz{5qgW1BEav~0->!m!#gpbM z@xV^7@1iu1L6t`%7iVO<7 zQfNcK1-ac#m{6xq%6}-tFXrn=b(-7728~DHCJ4>G_13=LR9OV>{FCxOeH=F8|Cg&{ zfo`itRR?+Jp$G#;O-ULgG?ZB&tvmo~u<)>&CJcIS;O}YcItLV$79gNnp-+4l!SX7h ze;#cfI0!Y5LCl01C}l{GL@gP<{Uqd^{P-NgalNLSvaGMI0A>%|B}GSTP3P^&*@1tQjqr44ym2C4j6R7zpz?gA5=%VzUB|j-UPcbr+J;Kz>;{_+}Y= z+>y1Pr)}7RXTsC&x7QbCP)@JC&=;yy=#XsW;{=rY<*$LsXXHHwZ;{;w}rQRHE$f8wuLyMA?%dI+6Ae?@~IX|SP(^2Yy3;#Bzr zKu^U3AVTnR3cU&FAh+fY+m=n5(97HukkEP22*|+FQ`tfQu~C?cG0DLw#`-(Wj6col z(;dB@2-e6W2K-U}Ox18&g{s{n3s6_}u(<>Lk7Aj;b$2)0Xdo#cC#$9P^(M$f?upUH zm%G{D$_4MvTMK}fO%Qi~WJP+ao2j}d8VX$T&$zk|NxmWlT+yF&p(!<>GuQGfEEUC_=0=xvQ)wa4FH8Bv6iwtz(%7r_PcQFV$%cm>nru1VY2{q1hK3%aNX@|RpBR+%;C|^Q?V)a>{{Q&lrkl1tH z@f4m2wYhf_b3n=70)FG|+XdHzAyK94+994Im;Ze6I#CYKUrUFzW`mdEKl)6(4uX5= z*-`-=QXWbOxKIblbuA!`DJ8Hsmezi7kSK~9*Z>ji#&ptVV4>9|1()1VJtJq5>j%Pw z+-+3UTwvLy{v{tyFfC?BpyiX_htwB55NOc5SzEDEg=w~*vka~a+ zlq>9{j?U0f2NS*OT!_T@=Nw8(Fas~q1Bi#?nTH}1x4 z9PnbJy_MrUVO;IMSpfb0U?*MG-4s-fltipYLy6j(uCS)(f&7$MU{r>nO<8$S2>utB zyFV5Phxw@Dy^rnO1+l7v_|RpG_6Rt?%$Thf05V>I3FWc8iu#O&uqMp;b#3q_U4(#dy0L) zUbzQX0JBr6N?&UHjN|J;y;PdeM9MuV2(1Q)=hiDeNgR@aaGj0{{s~DP$PKu?IsaY- zX1jR>O|9b;3ru@U_@9UVw&fqLRK)W0r^yXPfv-!73CqB?#o9tgHTX+7I-2Kdj{3G* zD`Q(6un0?F7PmLo8t~PoodiYLi1njWu#5Xk6Vn9p?Q)ZH1!7LBdORj(4nVXl$P|+LHhsGi_c3#+5SsUa{kuWgDBZQcRj(_j00`_%h>S#4gx^l&U>;K;Xh%CR^PZYXB|< z(13iw-Q5Saj?Xw8imaUJvdIGn}YH&(124#OO|fH6+n6 z$j7-Hc5VV3`A%V<5_H{v%>w|Jn!#jVa>l1H^LRNn#{h8l67qmuIN!hzu>Ohj{4XUO zbh3E=B4{d>X?nO(iDH_*4m6{XnK;8$_0Vsz^9WN>V*=)1FcSKJxJ(SQg)%GPad<3? zb^c$Z7m7IWNI_b;Z!FhoUw=P5z*-V!Eu1nUj70Us_>YK$l-wc+j60r@KG~hoU;y}? zLMDZGjzLJN!~n-Gb9>e|siz)`06FgJfRSE0=q>f@kg+Hr? zy3Zjq-~z2c(E@)7zdjaKUu_dx&*p(`s^Fs03C?kazRdqDEWy;1N2J8tKR zM&dKgmJ#MvGOK)_gAJ%~G?3T|MYefF+X5vz_^f;@;=B-5yhA^tvSLKP2;xBZ@eNq- zxdCTb5+JJI#9&)QB~O17?__Z50~=+^ez81FGUgkbG7`J8} zt?Z!j1!ghnrj?|6qfpRCY%(Yv5Nu|1G>aFWu&(nxO{R%+XmYohfBM6bc(vGppiy8O zNK&X$#Q2fKv{Cp)S!B@B_}lmEOz!2}{bx|m;!{tKFF8p4bQKEi#Y|UuwcsIUh_BD6 zg?~MxZbY^Jo8 zKL%GX;|P5$fBne#73^}uxeV+&E$bls%paZlTT!36KoS{HL1To@$<(OL@#gJi~|CGA(shfpy@nDv=F~El$IhnY5}R{ zPrcniJ0v>%Pu&LAdzir15vN_s;x8Kfcw51gKcJxfvPQtj*zNeF8lU`J-#O_4zn2o+ zELBfZ%7qZ*csfh9;lAGn$u?EfP`o=$=mf4_b@jJ3Hu$^fy!hUW2El0(saD^f$OwMN zBAQSk#Cg-9mH&AsIN8L~zMSTi=CLyU@hp_O25L=lGG@X-CU_Ox9*7EptVyMR193qC$+5}($S;#xKI zE(zDQca(eY@cMrL!@34rDnk{9J z8~CAf_n1SKcHFw1G?cbJm0B!hErd4ybxtIe7}-lh|DV{)iTHIXTNfk@yA4(GWdRBO zM&`Oy)__yn7OTV0#E|=njN$2r6)Ly*E&W5=cO_Ld6{$?;>vPJqITrJRSB;Viq_0A1 zd-QcsQAUM|zR<3S!K&Zx{pC>Ey0G&HI=Ly5_ooLr>IBhkc46 z@yhn0SUZ1fUvu4E5MK4Rq$a|yKKp3>7r0Y1fa}j?>4N7i=jO|cN2FYZo0YWtlfM;Z3hL4Tdt*6p+g~&53KTJ&)~3 z=)ZZ1nGkrQ^*Sw(t>|bg%WaaaaxdU>pqo~D-^gX~d;L+q7jDJ6uK3p~xX3y6i=?Av zBt$ZVZEHy#V<(z?ZrY*xb33(?lMc-Pu_q(k|2(KWc9+a~I}sW_v7G8=o)o?8D|A$gw;;jr zETAgIKb<6xb^(Wwoc3{E{f$#8*s@xaBlY29x2vN9FYVYJpuUkg+l&}Z118Lgr)d2Ncfx51Hf6EI&fWEwqr z2a!%Q5AKL59`EqB%;0PtjaP+jBv0=g8}5KR(PzPubWxbX7633heRp?=+@{P{v_f#< zd`sm|nEYG6q=4+N;-(U4!j#xVcaf6AdneLPfE1+KOoGBr)Zi6uRMR#4W{xV^gCo>) zRoS3ryQdo!!1gSCqYe79EUp(Q)9U)KzGHp#%eZ_JFT8M9pRD4CxqQbI^9FmhSu|~R z$sC@*>|lRyb?GHc#Wgn2mQu*B_S<4=_DwM zA2-|OVDay+Wnq|vb7#F?TZoEJ?U%5&64{96vlPvSaY=@bH%YNTt+3#5kEU>(IhVPF zkm5B;3l^5(+5El$e!Z7NVA))0u<~`@kGTv;_U5zF6M-V+B{)?bj|ZT!|F*LTT8zRf zxIuybkx08=mcQm&n?4WwhO^ZCF!3{sds0yFlm64U+Pk*FTou3ZsH(#l_(9vjW5-ug zFs8g^fTkrXUKb?~!p+vg@yrutxyIa(Pg zihEc4QOXDn5A1GV>;q9hp3`q;_w(+K>maHwVhyk8Rf$V?;_nbK}@ui>&51;kflhq zi;}wmw*Q-pPp-YQSfsoq=8?@mvQ_KYimdBtgWd#`_CQV0N2%4q3^%1I{enm;F^5Qk zl={FO@GuXcuyvZgp*Mm7Y4g^}9tXUr8Q(?SiV8Ue1rOJE(-R;9tvM)qxwBz@lb$2~EF3s^Gm zR(kJ*o0lUXQEW>Ie5&ty(t{A%Te@Bc$-drK7ND6aB;iC34P@^YHjwy4ufFHXq#WNZ z=?CYn6xztO#a&xgrb*y#615*ZAZEoX-J+XCY+=+*I%{sM+5Gbv?tlMxmERrZ8l!t^ zJ7kg5?OsDARzMAZ@9fEs`jkLaO56c%ofrVSDxuW`U9WrHsPF=l9nNw7WKejpFpZ`_$QybWd!l9gjk%L zl?s5qPzI~kdk;U(HT%XG!rxM)xbLTZMfnJm-;FI;6eh?vwShyJ?_=-7Q7XYtl8#CX z-g0IiTk?ysuLq!+OTJF4h?T~TbgJt@TUJcOVkY_2L7}UbT(cvH*^_8Xz03PDo_chZ z(mx?341c>0tN&4V9^-&HDl4t%)B^D5-fwBmbEL+b*mnjMH(I2Ptb-q#OGDX~oQqJL zy(_8tGpP-x+5XMTqB2?Op5$k!VP^szKRvhfQkf69p7-5p&--vedzy0G*6+ii(R{bQ zK31Ny4BtgX-8l7`l=0SYQEU!lf^5+PhDd!4M*_(+S%-I+DsXGhU~~gCf9y$A4Ih~? zI@&wFBMo-tqi(e(_1{n~&7!TJ8H6sm93u`&CffflkdmRWlD*_w!qAOu|IM6uP7Mtn zUr86v$Whm^>zcsR=d?jvHzXRge^OCvxW-rJ-cr@s?R|H!96fJBj;s2Tf1;&wasDq= z(Z8HMJ$5NUk@Vf@UPUUd=Y8BYuKM#I6M=gTsJ}rjFVRgdaK9gPYq~xl6oQh6dYb`o z-7wFmNV7#VukOy6zr4V4;+L(w94lY~pshH5{m3)Po4C8=66BcN{@&4?L{!M*P@&m8 z%{%6O+)<1>JSBw7Bq{dzwU5}3-W=X9?XQqmEA`TP9^*0=3Xzf;(wB$U!R2321#;-!$@w$lI z?czOMnraJZ&p#MGwHTYPQbnt%{-$9l=Q5Pu#5nCk20TF+O#C|qpoKE&wNSTH_Sm8q z@n|a;-BW8_<(lVhLMxv=P zDH@a90;eF|=Wx|yKlm3ZtqM6pgQpy>7q(QA=@{31(^DIF%8zw|@f$2B48oOm;6vaH z?xK77|B?00Wt#!|S^)Gt z2p&bn18}d$I!U0!zDba%(fV+_Q}cM1Xf21xs`Ly<9M+pVR4CYbxYkJ4>@=>psw=o+YIG zEC`fT<}SV2N=uV!*ADWT<5E9{NTQv8C7h3*^R$-a#nmUCCT{Z7w8+K-ik z*BbriOo{yr{bf{e84&6S?!bHf{%m6PzDtp6zj)4+ZBzH30kZ#nQX`BIdk^rsFbNZ* z#Q%eq5>?Rg{6PmLz}iRqsrvvvI|1Lp5)gw_@&naYlp5nZJxTia;Zp$A8zx{yrDAPL zebeWF|MMNiXQRX*}kpZ)iVxzk(>#w0#PlG_>PCk}mFZhKlo#^o56zfi&Vb{C~ z$e=%FpEIeYg^0K^Z@G!$3KmP{|Fm4U0@GnurblhpBLA2z8ZjZU5{k6PscPGVXExTa zsaUK73_27VqH*FB?#U43+9?c@NynM24S!`Ippa-Ww|HWHJcryL5clbdHty0TnbXJ) z`NT&p`-?O{bg2vE)TE`>jrzIq8?jEMSs3DGj;NqzSnQY%#u507iFaDa3Tr?WbG2pRUW(<~yCcts)S`tfkCfFqey10*CPbsokozg>{ms0fU z79Uj8DIuH9qq%Es04Nk)yrO18O68X3P0u8^|HdHt>CkRr(qe|7ifPM1EG3o3J8nE` zfufqsW^jRL*}bc@Juj26O{{^swG4?QTR-j<__9mMwso;8@2Z5B(wGJ?13@$`m70#b zgr1^L>aYQ8(VNHi{3J0Sv$Z|MfVaX7{OSc?5H z%#dJ~uA=2&P!6m?zKp(3wYernKgl8vQ*@8pM%SvaH*ATP6HyK_W}| zMF6a&h^ToGCU_j`XIRB?WM8xSAyB{!SI?Rd)xw@ilU3my=~=bI+waN!AaZT!a#Za@ zkS`fiWcEDHMWDHHhl)i=I|6~aqXX~!%$#G=xR7C9(~}atm{B-X0=IAmYi4zCV5Ylk zUlDs2m3HOkXzva5x5ri63zxX=ZQ3;)m+o69zu+(EH?OS=Sa(PXk&oKUsLz20QvLS| z=AS>}DCDjwg#>unAAO-!Rtg)e%cuWt`_l}KJH$cB>pBrk@-rPVOcS_CC4eyqj5HXg= zQ2&l`Ml$z-(5zfG`_rfA!xmE+;9kAo>t~}F0)fL z&iFTFNwWA{OWBD(;6exvX{yase#lS+>XB6*u9+@i^ojYyibO~d~7EclXr3EC< zYk(`Nyn-QZ3#Q2jgUp;^r0BpksT7FwzT(OaO3L}vn|Opi*m+Mc<|do4NE`?Ic-Lp! zM8HE;OahhCA#*8l{!9LGi0(l(H>~RVm&dGEp>yq?=2@hpqq}83U_vR4O}|OYeG&(< z*|HpNp-!7bKB~BVdcwA1l5FJ^rL>y-uuNhU#J~Yz^=60g3vd%z%w9-BN!G3ItIJ7VE> zj#R81?l0qB3tD#G-z#{@!0g+e5_Uwx;-YQ&@^E0riBMqa-!K7QxKBwTNv10;wQ*xS zk3Gd$)YNJ~&mfX7tgtrp8}KP^v$Nd3|6C>ot#WgmGG`711sBaP7DsLa&9|47xOxex zIG*`8Nr>H0w4eY?L%~V_U^pWn-tG>=bqh$^RAf6kDL=BAe~PbRC+O!Q>y+#t5L0_I ziqKrOMxo|Dzm3tP_!aH$5_n7im9(wt*YS zVi&Gvu&BB$UR7K@z?%=!Jo0<6Zl({~?a)&8R_3=<%ZexxC@um0CZG9TcC7TyS+BQ; zKm}qrGi1I3&FjLmcU^#%jbZ`^GM3`7ME$v|0%|PBu1+Lnxz}W0@mL3fRTXOw6w0(e^op}q>$)M_)Z(A%WB8))G^w$ z+ToOb%zOwzTUKYUJ@U0dE~kC50{$oNkPY0k{(rk?dAWD2W!~|e3pKYoi z)_&AToI%crJ7IbS8mMfhGYJGIW!v(}#Xfyh_WcH{*>V1)vx%Uy?S#49 zj{RXVO^Bd5H;auJen7&pCw;GA6UVg{AN2bq9RF|4KE!+>!yGmTlvE0;y01A|kwE;i z2GILwigP9upCVAX7eK&KAOtwOw6?a>h%p6bVtNBj9ZkO$cDli-O zik>f7U;`C&Shtm3V)l0*U%*k%BmwBX`no})9PGE} zZo;>~la12;`2DD9_aEe%aqFS_S&G{0#xTf5_2WImBey>Gz z-CT}83=WO%W5Mn#<-rJBj9viyM~+_>@x7hn!9oRoaC92U_P`8&^uGxj9lTivy5`+0 zk%dq?bKz6TZM<0sM_08keHd$c|(Qhw}%p56{8tdndv~8 zeNo31LVx}z%oQu9JM8++Q6-l{ThHcq*7zCZD>D`OXzl0Rw~19Ucf9~Vq3eyO2wW4V zQ**!ST1*Z9_biUc4gZ?KAl9i@VO;EjfEBO?u2jj|Da3NxU9W~4u0>B{8NZj;5CJyS zU~P4U!v6WpQA19dsR9!-RtMxq5K-|R#QHwc>m)|-vZkgC;&j|~y^Hz|#s`~s#D z%a6$O7xMpFIi= zIh^rAa^3#d^pxHwKUMsQ3%Gw15xdTw^x1KL)|H=|gphDsu8C2lZ5IPBNBjc_FdRwy z5%yAd^ZU2ajxf4jYBkpm07|q*Vf}TdsAk;{SdsQ4k3#fPgH2&9&DBBACnU7jI-&)q z^(vzh=b|f;M8*K{oe$i^*dlH+eMbDaHwvOb&C6TJq`g+%@>jqmC;s{ufiB1eRJm_i zXI+(Y(616MQui$Xi9#7jI{HxZ1~JV$*}4fpGtrn9^|;t)#^EKxnuVa>QXha7Y&QP6 z%tl&~c70~b5!40T7Ty7!i#sYh5m(m=zinSv?Uck(IkvF}Y}pZzH?^;eJ_J0#=UqNl zs+GW4zoKOlcymWy7TsP%K`ys_*sV9n6&Q-yQMYLY#~U7O6#_2T(iF%LkBPUW!MFIP z`&9vNKgycV4XVGkOmChaS<6nmcsc$dB<`Kns(CHZGb;X~50%~k!DmAEy-a?f<}KEE z&0FeR2;3(-Ouvia5I|@w)aiZ7o(M?Izx4>&szBwB8)+WIyqTPxd^CWqaT<=Rx7LxF zL*jp^<#R#~x1_Syx!1B!sW}-R@NLpOVh-ZyJ6TzVXLd*9NT2ZQposEMjB!+axh|Q> zDYcQ-pYOMM8+WZRC{bamEHLmu4@t)Vfb2eq--w9`fe}$vTq# zND~xw?p4XpcChx8(Jv5*B#V3zH!{xv7n9{ct=Nq!j4rx{d$9vARN@@;1e{!#;GLxO zVE+LctljYMyr3s zSJ3_gxOC-H%>L=_Oi$yga_xL4zdr2x%D|rf%HU9p^tozy%VU*?(bs#O(fs*Y7?Rf9 zS5uYoFKVTZVycx9}L z;g)`e?E`1ncY|&x^rNEEa10&Hn&-Z+i20LCEGp*bc@4r1qup&JR|bXi9oB>rhsrPb)Dc*9-*pIe z0@$M%I+I4nEMv(1bT)D>AA1-9?a!87Bad0r3yeJ>H~a_z9Ry(UurWYh;Mi*gF)H6n zJz40yX_{T&?`?3VRN$=rVM3Fbll1F2+y{*{Xk?}H zyZ3gG>-@B;+g*;?YQKCJ2qEQZNM7Xec2Og_^vB2UztAelI7Wl;_f+BY%P zQet#v5uN@TCH!{K{gVjwYd>R9#oSha@)M7z%NgPpn^7sgY8T4gWAX&tOToe-SIbI+mso zcLz=27|KZ*>H!F{EU28^!b2WwSyXtoKb8%7&DxmeGRF%-ndX> zu9rsG)*|WpTy^6EDu%)mu$pCBR!R!@qU0bKIbVKf)YnF@mIQ`cjvc%!HLLuV*P?nr zlLkNS(mLY3@%dN(nWHckOQLhG-3m#)30OFL;sv^b*@aY!Xit$0p#slaYy?eL3G1BD zNtFIa$G4>krZZc7_G>LLk}~#yMfDf+?|=Gzf@KGXl82kRPgP} zuswN6t@@D_L=AO&(R0@}lue4yUSUNf5uqnI!!6Y4Sjn)CO*$(-(@3c$9fVgiBYuQL zoN7dqrBo$au*!G)S?*~JvV^yzsz9oh(N>v=B9V&v-WO~D<#}xWo^MDU)|q5x5{3qW zz7FjEb{ZA+y{0s~fL4Cnj4-$&@EFRbuv83X+ETn`&6*OxOficAWWQ)+oBR{z>DD1b zNQP{t`lI0zXHfRQqXiV9gJ+k z*`3Ax%>;{p0lX{|r+_NL7*`VG4#?qx(zUzdrNva02wQ}jXf+>u)!I5T8(ev-8TDtO zexE)ozpWvvLZxVYtTk7rZ^*;k+#FOrtSRJ*?RJ@2J|mqu2tR#r_JEQF3#T$@kvlAle{A^RmIAXKQbU`3RDrZKHOZt^(+k=eRZWYG-$X$5VVJ^4(9;|ATjjV%5Dxal4 zw~RAn4m!b+118!o4#nST*GSpI=*to8kkPx?+}t*%L2Q&?SRIw}dtBNwzWoms-D*kN zOspmW>P5%d{qph8n4`?5x}q8w`wxqniKL^}*RN7^{uCc~))xF$bjfSb6)7U=>nZ^S zYy*Pn6bfo*g{iA?a;#7hD#U8Ai#0awr>s?sUD`4&6>2h^du7yk?*`DOUZoh!SR99y z6@qA>qEN9Pz`+|@wqn@rhY|gC8?v}}1H!#y7PClXpe~S7!@kt}VS2~qY;yL?7NI%c zH2;M{th+%&`sNB4>Bt&66E`kuM9=)VM@C^f86@;wcYCgh{mAsCAE%gX!=(FR8AEf|{mN>3vN;5Jn+WTAnsd0D9B_M(f>_WYc=xQ6H zt#j5*W$w$n4t$vX@RaJJ4s(>@195qAmrL)B8?L79%jWcLU@c3F6*@HmR%TCmx)hR$ zypFD!~h=DMBmNJ>XabDKr+_~v9b6NdRb$~*z8AN_kI zVynq=A24GnE9ewg2-kDewBDz8sPZR-o`6tPug1-l2*o9I!^@3)DZ)*U`_B8)(1~o~ zNa!g)1oXJBrxH2DanP;~gNywWmtk4VO=#DQxG;u4>29fi?MLr24j>0I0g=dJ{=ekQYlR_@Q-<6O)e%<^XzV(0BGf9q@nqxFe;z5>TqVo!g^R zCf^GR;W7p`4nu^k>`dm5U*X_NA%(a?4dvOCm;Ct;ZB>GRS2yxHTT%0Ae#IcI z>(=qkJYDoC;AM>1Q_x2ILq_&L{AE}owVip#ohGVhYV=_h?P!5$XC*&u7u6R^_RnwM zF8TJ3OAD8|%O#?93e0RpsMZyhJOfN4&w&5ZSFE#-LYyU-@~aGG%f5@zcB#H6v5eq-;r`7u2 zL;IgIo&Bp<9}GP&4AphU0Jgazz%3HuxjuY3J>Tme0Yt^SmsweqM}gElZ(lcsxc}$F z`{&p5pMOvNj8*r&Jd{fYO#zSiLQ4o8l{76@>qX zzbrh!4|Pr+%N#oQhYRT;e-+GT(yZ+!bL1hsAmjA}sTl%-zl9on<6i%l<7;K$`kb5{ zP@S0oH&v6<{na(FFqMjG03S@ayob9x7x1jfA{qn z_&}*T(AwPczmt0I>tB73UhmB6uKVA8{r~&R-yTU$e7O|#?^gYPtixAx7}r0wK-8Ep zJl1%LC?U22%yA*wfSx}L8unyrAF2!T?>1Y2hc*-bXcNGc3flT z1)g_3FX~p3zXN-T+-$j|djvE35wgP?rr#DXA4UFk#^0v10#xoiFiGbN&ja)KcWDrP za5!{`yKOQ-a%w&xh6F^W&5i|uD8muo%H``l%wY6!G9V7~6dwV?r1EVDwC=rB5!oJ~ z^(%z>;3r`FYE6e<*zF7YtUSzwSwj3%T@hU_tO!&C@J=UZjsTe> zANbYe0#*daxf9@!H=jiVsYf|@s(B#Rkfq36;~0Rrg)`1a(@)hwB!Nto$ycd+@R2MQ zesxt$bgJeHB@Pd3#t<@d!|~7PJN3&)HT)L;f85!~?^>A0gye1NjMXVGtapYL0?a|Hmx49pWl@ zzKH~4fMHMx=5N#b*uALh{#{u;)Fe&~2y)XuhB)L^5uM;4p~lPgT@9EcItb!xaCHFp zhgSa66BYw_d%e{)ton+=Wf%wqQ7V9l6@6Avg(l#2IX{lxJM;qswID#93jKm{U1Zf> zwI@gj{Squ{WOS7Sgz;Drk#?Se=+Pl%DWr1SqXyRi=RnaKv5$3mjbIvr9ry9(;1NAg zQ`fDO{BUCy(b?|g!yKqpw+H^GeBshm`%I&|I@vK@>Q7u-i%(CP;SQ4L=Ki7WaG(-X z3PEsxcj@_F3Y<7wp=OuyQKub4d0QGGHhwgW`pTL*fn z&COy)#`~8}4fmI0)?)wkWPgNv(>FYR&0=l^$SyYqo0>gRPRNgLi?w)J8z7_~=D!ZQ z1xudM)(;c&z)l{$4Qi`i%NQAE%jR%3&{hGC57_&A7&b6l|O0iI9 z$A?lP4AWRW;Oas(N;-=?Z2m2%?jF4}Y!#!fHcM!j2AXFjMQD!|^KSZ;RyX z-j?3_-bDujo@ct14zj83gfZ!L&fTG6I$3Q8v18H%n=_@`91o?Cl9jufz1QFTW>Gp! zAHLUtuISJXv(roIY{$G6G=EXC93AHJ?k~@J?Z3uN^$po85k(z9m6+Qo5cQ5 z8!m``Jf{{cc>9V%!2_GJb51_bHsYmjcQk6N|Hx>;g0G(L8QDYf5&Nqk{rmZcZrfR| z(gJNTdG>Q?J#rAd#?P;QG(X`>N_SPgD4fZM(X(Q9r>Tf}Pa4tdO8J#4PeNbjX24>3 zi&R3EP56EwuqzT)lvDEjPMEB=E=@LnFa_9Xi2^~kHIvLcn_w_dy@=&5HG#5lkvB!m z3j&O788#I}&VeQ@V9EkrgOYxm>qCQG7DIiGBisO^bS|e8=yz;1nJIq|1FN;{s7)D3 zSyD!qrj!Hr`3-e$_!6IFbT@y9pNmuYuRcTMAK2`vN&$2Yc)f97XlTA2+yTmqn8@CV zK9H4mgxAkdAq&^xus6Z3fauK+llS+wGV1MM)n~cVP~hE}0zKm&o2Q4|GLHkF{&h?O!T=0ItBWYMqHgPa&rJ8v^bdrw~TD#Y^0>hEMUtCU%Jb&p`QzNvagcoi)U*o`W52Jvomg-M9BsH z^4A|8dC@XvSsY?5Q3(=d+lS-?ddsZq7#{$4RLKE?B-4r5CROLFYpJdKe1bl`SKk*bs3`i1Cm&5==NQe9AN^V2>K(6lDC8B@Nc&s zl3Z;7K0C@)t2_}))$_|bs6c;YXHD6~5poJ{LvVcbbqlv2KZ5{AIjbtkHw%+cUwwr}x>2W3lVpP0GCo}F& zFq*k!?#>b41`A8T&XqiSTJmRI`w#y@u6!TBLf3%Jf+}~Y61XVsV(kVlm9fO%ySUlA zzbSXI#Kn@w60@UW?3y$gnl_>MpAUj8k)n{LiJAiGYFdrQ;n-V>x?f`iY|ZD+Wf}Gj z)|$K+Np5(eXa1wfq%CZ#3v!c)=)Yd1(MALE2G;;v$zH>>5b+eH|-SryK*MqSG!uc9drVm$+ zlps1k2l0+7fGIU+q(!lR{u^t7x*XpCzw8Rx7(reMfNypq>NmeR9F5G>W=+Az=(Kk= zN9DDFcwk3~Z~M(X0M^mcL--$KysSPng6fR9iX7|Y6{Us~T%{)n=1x!~rVQGE_u zIAx(5+pLG#UoGmcz;^(Rw2w^Y2m&;23mF_EympEPsFnN_JNOc!6L4P^Bh{$-52^t2 z!o@|qloY;{Yyo0*T8;%Ju|66I5-TC1ogLW5hX;e~+!1S68Vu%yUg4d83{XmevXz^o zW1Ga`S09XFXtLanwi5s=6SX}yEG`S0q^$B- zj$5@I01Iwio-Yf#p1d;UY|vN-qNL)2(^)J{&t!1bgg4!W;4OnDZnsZCOJIj|fghvy zJ>L=uy*hsR%N229ZsTw{&ST)hN+2{N4rhsUOAK?)9P;VO+<4DU2QeQK7uXFudJ+fi z69NEqHcgtjFj#Zmv>#w-Y1m6#JHi!VG07LZY}9oWjw(?d&^19e!trR=QO(c2(NW=6 zBag0S0~!r5G#N&HmwMEN<7&0&dB;lmJAUL80q(=a~_C`z`2N`1(<>{mFLK z5nwL3o`(K%lFHpMSnB!%atfccEq1D0l}*sjGrcU0dUF^jV^?FPn=d@L@=Yz1FzP|eWBCOQEqW-E z&?{^C?q>1UGB?Qm;sSki0hkCIE57Rw;LXzkokAA$-fL^QoIQYF$T`2AAq1nPyfD1# z2nJcH`a6j&UD1Bpb~E$%p3FbNmh8=32EK`b;+=wriZR>}wcT{=Srr#qpJ%X;Z(d^| z4&4PYf@9Trp1y)oNPe(eU22U>S3YBnOgJ5;PxJPKPdepgTv|*_AFAwNe(C z_M|Hw#GHXlN6FG!{R1yz8_)wIlT2&KQbMe6=GI=aA94|`QpQP^zt{?1i#II*WQrBd zckQ>pN=vPB!7yEq4|BSO0|r0DaY8rjJ$XccTN72VPv(J_-F0F$rji(v+}#VBS(z5; z$ z%`c@UWyT*^fSkUIV}~iO9lEBpbWK`oKTHn79Z{lM9*8WL9oy^>pNY^v^!f}lD;8Uk zJH)ccOEacz&iWEU_&NR2YyPYSPbGa=)vC&52}*vbg6*%R`zK_bTRj&9kKMVn{k5aJ zrRI{_`xWpqIyM+L&8mKX2^+Gat^ydfSl`Ku?WR%*exP4BKmY=80xTGMYQzg3ZNfY% zDepoldZT0vxxKF_+`YuP-Y}DB2MA!WF8G)q@LChJ(Y66KHfz<*{(GM5PHR)xLuN1q zoFly892pg~cHZ`?y+Sh=tOIWEF&{seV!A5UuX^SA9a7MOa2!lyT==*Ox+B1f0eu=} zGT7SKvt-DizRaN7MR->c6dtv?pHZ=uDV5z_Gj>Aldfi**XL>pLT8pT9fe5AmM-bK#X^Y1ev9Si|T`mRU9cTl3 zR?G-^cDZvuNVh)g7n>h5LPVp~So-OG!X&;UlJFFFOvp!_I$Quw8Oij9r5K6A8r778 z;){705rcyvi-k4C-o)ACusT{5IKJ!iu(#kJjT_PT+rL18q$iir52mm1Uh7{;*}>GB zWAqRVjX~TP0@7w=H)Sn;T!l-esQ}EZZNtR>fb;l$Z2M1~1Ln*7f-dLw2LKh}4fL?I z(0i>VPCP3*kX-WPyZg1MyX2kzdIf$S<}c*^*&E{Yi0;kq{zVi7Gir{Fl-ASFV<%fYQr*3O;uF=b+98}m-wgZg-Z9}rl9 zcs%em+Sk<&u)f|_C5f~5l4DZwoSMUabmX~Hw}1$ZAUv`*#FnBkg(J9g2v@9;`)P{X zX=bxs!yZk2LRIULao|h+0Y`h93j~cWkj4?r-@1POTz~c6>OPoD3Q18sXcpZe%d7bH z@xC)NVttnP%vmiFuVqE#5P$3lOUG0i_VYf8=3gMUI zh}UY9#}y2DO#9_Qg>+RNwb9<}gXXo({J*`(H@d42orkkDi8=0eit{^n1R8dWQJXXC2)R3pIt;Ac6sz2YABA?wv=Vx=ySms$Pll&*ZVxga|qh z_t%{;lNItUW08&MPvSJi-vrhhY(SMq3}7O^$I2b1nhlonZ0z}ZQ z){L~v#Vw2h^Vb6B%aCUB02X@VP#}K_HdzqZWVHrn^K?nJam^aokOo<}I`Cz=s%Tb{ z5jkPGi!C)vCgTH6`jvi~*5S{t+ay!LZ3dzl=W8%rx@E)zHQyiOR9e1+KR|IBZC@B2R(?k;^jWd{x~;x& z#~t}u^U}(Cy5ptQyea20x>}c-2}XIaoIu2_GW5CTJTAK$w{|OPQdFg zsOLob<L=6uiVwe?@kfU1h_0}$(I*i_xgx4~iH zLgEf|5y4YdZK$}KS07_+8-f9cwfQw_8&|Klts&905g)-UFY;GOYpa3wIO?@5$vNr)%8NXzEwPa*>C7o>#|P2v|l2`Mbj@LIzK8qV^Fcl$M9-E-%v z{pg5#0{g1P*1S-YvnAp1kE=#$fV=PATiMV!zT1bGumFcIa${K~pQ#YRck&PS3YOJ& zN23IHYQ+5HQHusHQx)xuvAz~LpMM=ml!)0HnZAAvh$Wd2+L$-Fz(2+Trvrf!B_0ddh$~m~T3qnkCfl&@?g1$1HAT z(5xOVe3DM)FwXAI+r5CZZHu?v$D_5^IrZeXr!Pnu>AM-HW)-r)+Bp~07aU@z#y&ao zT+**!PPO);WG`iNAsgQR9xYvqzdV2MtKOObtK(NwHN}S(hO&!YraL&qrQe_{O}8u1 zN)PQcHv9x^ihh=XVe<4fu0k53?@y_Hol$PriDQ08zLVoRd0WHvs_(w$0$f;nD)>5> z1H?#n14Ji>^X25IVvOdKQE`5F2Pz{FeePc-o3fcp?hsPSBv@u$b1hZU9xI*;@VqTsEow;k-JXKIV5iamtBrg)WKmkAtu znWmY!75y#6Aw{vG(3G*U!~Sa$Tg+JZZkcL4HbksC{F&MK(>;L_V1lEe^4Sl%V*0>- z2xqPDTjk8X?|Iz-?KOAd+@@u;;O8j~8JRyk!xKpE$dYz1xU@wjFT@D-l%+s zE}bNw`6DNEFl?nPL|G~a7$usyPb}W_mIm1OcJwIt1-wVI;(W`7A%`8F&}_C999_F{ z>t@k73FH&dCska5Y=O+JLy1HHih!GPCqsP`XZE&e0h_ z5_mlJdq?UhNbM#GaTO7Ubw^l@X6Wb+*Ey+b%TI(3xHWFKL(r#uZh8<(nTh#lg6jZ? z4`eK)Ygaz)FS~vg8h412OQMSDWe*T)x%m7dx)rmHwfu4-x^57R;j-qmj!z!Y&{y@1yIKnsHW? zKf{>Ac?p6RqHEK5mV`m((8H|^uJh6G%OPvA#xGNz83SfG6TnBRn&CunFr*eE1vQO&R{yNvK@JO9RXW*4b794iS zr|rkRTW3YY(#AXZpYcZWOMFWXc=|o__Ys>5%h=<5{?t)D84S!yzw$`4m%oR#S|E>0 zzqRW8em5jCgGJz-z>kmkDk0PXdz%y;cXR>;A`HctygvBwOBI`e{@TP3oiNqiwo+lD z5NaL^-EAxb7o&rx8iwgILFPiF#2d$>hyLrIEnbJ7xeSgIdyFrSIeG_ha*WmpBhNP79Ms^hMM0cfU#>Pb z1YiX~||~OWjpLm)XQC zuMKLL2D)SPYR%NTiMaCQZ3h+lSj=VK?Cef2JmmI1rN6U6BGyDsz~YJcyP|LJn?-S! zZVY;CN>K%v4tj*xjh7iJ$7xGNtga(RPWo9^O;BVI3Pzi2O%=X(pjTdddz-#NZI65^ za(r6oO)7J^dKO->6GhBVq_Uk^?I6R#v_N=` zJgxw(S;UTk?1EkQm05BA{4P{};KnD;!RO8u8FCBLOA5A)YY)?X$sj74lNSUG4gw%r z+2L&d$&FK6w=AXlHBx6Tt@L80+pM&R*;}o3D7VYr%le;3zhIg^ykk|cFKpEfg;9%f zjBqu{+`W*_@j8_UwdLj>lIqC~>xRj@dG~Vo7N?b+Fo&Po?GHfl9?0aA(K~N8?~ovW|R3Lj;xAY>~s24Bn3o7BcFO zt|uF;E6q46WCrpx^I%Fz``gbH;fT%=ET$p`2ygi>qaP#aEj7=sJ(^KQQ}TufgH*@M zI<#yZO9U$R7Pd2lTPxgN;7ZDr)}-MWubsPTZ4C6RBnMAgT)LW34>xekk?V$ECIhvbEY z?1H;kAgy<}ba*$xI6>CAz+94KFJJbi!C61544m)>bv1>$uNyCt=zDeC zv*hS5@onE5tOmx9X2!IDDVeb%-Eu;1%d%%qVZ|>PIJp73v4tqlkjMbeg~{}(QB_%M zM|Ma~KTiFU_L85A?zALr?3Rrewtf^f)wq~G+ZrGe5q?4tTszomt+BmBlyHawsFpD| zJlT%-k22FeSP3uQ z7+~vwYo%<=TJvZNpD{7?Oi|(4@a{a!=DIpV;G|Hd*-W{nlOBbGSALg0F!oNAD4x&b zS-fh>-S)l!;~B)i_!wTiWek3+~HH}0(@Y>cQYn6c&?!Fc-*!BP{{++Kx#0`~NL zkAd2>&bR#fzVgZ*>Bh)StPfo^V}qxpC@Qh^jOT*QiO^Ie_STOldhbNklQ#!LYV?+c z3h%%=Hb*P`z*K#;)a5Z8;WZO(7qeN<7%8wu3B7_PgR>V@Zin4(qzBJo-LSSyb#=W& zpNfXlpmW#y8=E}xRWZAXj+r|YOrCFJ%+-Dw%3ICz;Xw^F0~Nz zEeLd~GhL|<}@GL_=BooII945kdcTdQW z{KiV(03^6vd+J#4N=Zm$wN6v<&|hb=1@=rtF5A%Co6yn z87S`eU_PPD{D5K>y6eTjvU4&=ts4FbfGg_)9>mGeuKEJo$eeEmt&jTI__qp_FD`>4 zb<7C!vks3CLgG4>#T`08lZFrYC~F+oaG!juSUi|G?eItnvn;CfD=~j7J^EO<*V*VI zP2(z7^TFah;y&QtOwRMXS?lU$`cQ~DfE{%o1-ue*RIaRDidyb93}^xds;mh+Hcan=-?pJC8bzt|Gc~YjD=G&w$eEXK!GZy6|D$o)o zsgH5oyI?k#WEfQwscdi1#UxEza1#1!D^79@jD$x(Z_)!F7E;+C=x2;FW$Zry%P(-m zjBf+HWYfnQusG%rr+%P@Yd_~O0Cj^dR*NsA$+W+T70Q5SNVQ}BtzNoNVkTJ%UM_Dy z4{TX+6iAM1zb06HTW0|ZgE`W-A+tr^Vh!0}O6Ezl8(Y;A!6YUA@gA6&1`Jd0ms;^f zQ_O8Se9emH-r3nY0V4|rvD-Def7KU`7zwYb)QBQfPWv+}SdM3f;Fp@K(jPT`(Sig! zHM8Q@AN<~?>MAw}WIZCQ#ST0XqcFe8szE98rO58X6hG?oS;@aIWuX3=*oPl$g)+{; zyf0TEoi>lu@=qJ+3bF2ZR`9A#$ z8B|r1n5kGH{moZ8E*f9f+vbI_7K;FG5D|IH!sZ!${vINF@Gj`L5s*5C%LOcoR0Yk+Zqrmw{=;++SK~8T9*cOxoyh zOitw@g{oyeaieMoKwrFzoH#I_3V-z&M-`!^$s1=)Mf*ew$FD!%QAv=7sd$2lG~ziG zt>3T#UV}@(&{KfbKa*rQMF{vVl9e~zxIdoL(_jx%LT{;?gUQHKHquKhr2IQE!Ee7Y z$>J`yIBA#>KqC`u+5EdqK;owgdP&yLo5y?Bv8USqs%Gr_VHz%vG(h^Ir>CuqWD5DR zym+nlhu{Mb`vIlnU}ZZJ>BzW{M36koQ@E#RM?%tnl_AZcJ=!-1;{<@%o(p3EhlL62 z{iDfe4zkd~>W4wL$t8oDkvZKJop#r=G`CS1Q+vaV0&+PMqz)g;4?k*>H^ZbTUwFHs zlVtr2jOhv1*RaM}KhENaaz)d1zF{4i>2Hwk8)IO|Zc4&}-&444a(W|b-+)=;QZ-un zy`T8N_TA4^$CSy8RgONrd#LO-Ypy@5Pb?kEFVH)hg($a*XHzs%**z(BEv=Brl@F78 z5lrsyrC3$ef8<5?()CLPN)cbo_WtCEj(M_Y7CR|JSk@BrmSOg!WHYyqJFnKf!c-iw zB&5wu8K8`ycQg0v--4je)Y5Je;sV`~VexgxV0cAez~i{p2(&{~lT`Y_yQ(K+))7;U zIwRQ)!R#u^`rcLE5g-bJlhu)ZtZTPNDiJx%qgf@a2Yaws98)Y}RK52EuqQd>OX}LcD!px(bmH56<6fOBZQG>EOa}|D$B1ULHwItW zV#IClfv$2Fbd^FXHq-r+i3w$e-$ql3v9_(1naXhHpd%%x%Z|%UiAnj=7Dhti9?Kq} zTAo}|r__!+-elW(Jq`jUQ;fo<5EZI5IlmRjr?$ zOj8~01Y9n8AcUq7{6XXXWELOK`8iJini_eE%^1!(6>^BHHFuMLxqbiRmb=ro{VUf3 z1HH)tj^8emy)Txuz&Wmg-fQBqSVhtFr~eJ%{{KD49sWP|-a8!YzwaN9q9GKOl$Anu zX7(r%PK4~0ot?c&Dv8L*UXc@#y-z!moxPp1_nCQ`^?jawKG%I;*ZuomSNHKdj^BU3 zkD-De?CvDkw*2N? zxOaVI(oARIDC`5rt-cSk5s1DT?}LwEKOhz8N#~f$wEA#yIb6WWs46ltM5wF2)lc7j z7tH)#9OUcXh){WdkGP7I?omIz53LaO$EYw2a1=$nBhCA{<>VqrV`aP6y>rJ8!j29V z`_ij^3+fQ4k-ZNNCNZ9CEvLe$bI9x{ zOz=zeBELFoj(Sc7GWEe-dokC9qG{`^GgaLZY0ueg?7i8tQ`3PoGIi#OC)v=BxrLcy z?FDu83`-T|l`HnM4{zLsby=bd{6xmqV)ihcwD!#OGZ(xl1?T(wFMA@I&#o?oW3VJ0 z)q$fhrXIZ^e+l^<9s8)C5bx5H^G;OCou>~N8ha%TdYi|>pK{{6H~VZ9pf$)mA|clp z4#TqkT%Fc&o7^MW>q@@X)8U5wikC_QCU|X#7V{Mo%c!Qf+i0dm6$0XID`kgkg?~7G zJU)RLAwXmDSCi1hgPX9dTIFjvH*=Gs=ugs;HW?IGoVi^J1mG&cwJ7R!Pn+;KbNX&6 z#o<`sy4=~^z)_Gd-&OBNHadA;p`CF$$L_+1_S#(h+|EwOC4}>nKf|ed*5_28nsnmh z_|*|*J$J0CgKc`l(eoS$C)VQkJz(eZV8ov&sT=WttWHpJ}!?8guQV|En*Y-O_>O+{Ks&s4@TZ~`2IA`TzLoO{43mCF~ zH|)F=)LYV1s6N%JbMrEo8Bf1o7D{wF@bM1OA$xMKPQNeA)!L%jziq+gJB){wcXQ(| zo|8FwGu+84(?5fh-%BP_x+KKGT)36v`i}gt*K6ITF+!(U_`36clmfy0;SsQp)PmRw z@1N&-H`VYa&+Y01qb8vQ8NW7z1>&JxC&+A4@%s-j!=zhZ)&9&W9R5 znZ)-33qPgR1#IFH>u&h&J`R%Qw{N?uJooiF75SyhyVIn!0-GnedM#3ivp;Uh=5R<) z*C!v@%Nr<-jGS@0=T)T9f;!qrj6{me|Df;Bdcc55lymH!A5fO&7(s@*Jd~LTiaI%c zz?2Ux`+GDFVE>iD^5YuFd&oaujNeD@65Ub{`|OcPa(Q9q^tu}`mr$Ol_XhYp_7TQ~ z&q9;kKmGWQ6dE<_b*s!xMxG;ciNQ`y3mL3dcRDC#o=I1HpQsNJP?k6&$$S$_)*m+c z^@QJvXfC|-EW|hHui+q>XmVrbP^G>7se0Kd-3Hu3&Jz&j3e{c7x2ac8?kaMQb)_)v z3*4D_nB?A?_n3;p^nx!E=li9$lmRB9iMe2(TRCIAmYQ3Ty6mIx_(^3=TiR~Sh=z#v zyK^~2diDSK{+ayZ?yb=0O`5CERtu&;k!(ewH|*$abDc@5t{DkNC`#`Q{Q8HXycgU^ zGGUFsF*Z?>QJLPUgmVabe$49BE_s5Q;uyFZ%wIgG}o z0^?P$6WeI$GQ>^WPGn7&4K)jV$l|sky0K$4oFin^{29N;Z6S)wANWl3o-)1rN;7(_ zf~g@Ael&PVsas|I?U*HjP|=+jtrVN)z(FP&S0+DXzY;3X6NJGIk|onkwF);*f8{YN znI5u`3m=?u#JLq|S(HxCevgGz=aPy2kOwdHsAp}{ocxn+E5HIW5S#ZIr%O zz#N$Ma&`k60BPzDlUC)bpEI#t_s^>>@m^@;s!jb2dysZ*iJjy}NU*(%Iu4WCu42^N zgrbhkmz!CYmA4mYR-ch}R8X?A-y-wa~mGKs7jo+rCv3@+)6{^%V_-5&VQM za+9fsF;>n98@n*I!1}?O9X`iUr#W`)*AK}R9Ep-`+aJimq@|$399%18U-vlVT28DZ z_T1u^yK;{kxqltIo}H@Q^UkH=o?cI3_MBdu>_{adBg#M>iQxv&0><8G_d(NXE7s#z zdXe2eCMv1l(s1F$j^eFZqj!ddLcLz6(?+;b#+aDtU1(6yja`rpW{nVIRGbjg(q)PD zl&WVxM-U@5ywhU47>%RkM3ntJIyiaHcW~JI8lFDgtinKV}0rGI~M`sjWJyM<0E$6gF7 z(<*17FnJJ>9fgXTHV$$nJBsH}U-1&5k93ESubBB)ZBb)gd%(gmS-UG_I_tYsZKTXZ zhK15iA((ZbK|w@o_sT0)Y@?e1v-%c(`=W((;Z0V)+?)hbQ^_Q@UAZ>_L`JgTzDCOa zY%j0jcpV-jdwhdwLO4P6W3G^0SDM&%pK5xK-JrsgAvkX2TkM@9LWM$$1LIXxCyeZ` z@l?dPhLg6<*@5yeYu&W_MHuTq`So>ukV+i0kuIYxU;#L^{$!XyqR34^!j67ZdQD=D zs=NEn7a-23OqdX~r?Eq1`&<&t z2xPP-p^`Jmr9)KK+ji-VAV;K)3~*j8rX1t&gyFj-*L?B;S4jk3Q&1ro?ZMa zDGP?!Rr#?s4#1sJ@|2np**848%6Z1Q!uc)z9Tu8bTs#qk3#5~%Tu~WLTc1&}`axmq z5&zXfPVU-B#=KT{+RbFO9%D4oulDpi{gSb}MkI}6d0Cnd_FL1=hTSfx-S5u}wjO_) zkK_9~2A*4f8g|gMq&nwa+K^JdbE?tAOy0}B$*qntq z?f$B(l7cQK1jVwnjJj>lKRUPgAiJtihz!LdSaqcnm)NgI<4DCld#y$6aaa-V>@Qi| zuj-0Ci^$M0*i`WK4^_LYd4pi<(}J-x+84OZH|`Ocs8s~|hn}?9*y?y7oxd04N$Jh( zI7)mJt{HlZtxjR=j_F+1QWJ|!QI?3_VAqW=?FZ38GQczx&fV;vSO&}K$_HBsIX7Py z+yD3+AX+eY?onadVm<5~Q-gVjs>sILtW{CwPXc9NEhn`!1Uo0@Qpu{jhP$htv~wwz zaRb3p{t;Z|D6hQ%MS^>tw)nD-IExOBF24L7s-WOXx&&&Rb^#-{sGyqCLmy!ls zZ#|;Wn7aFX7jx+nf}bIhI-qfL#;DVPXC2CrN<_g~%DpfCH6pB3;N^_;Nu9tMC2Dn# z>MzgWBp4r;tJ5rwn9f{1BVDO9c*euXkWYoQao_W@jDgG{(CC`O1l&nrhOzgc@oR*B zw0-MNvX;dY_9BaIav~8h3y@S5*8p$gK7t=cdP1pQzo6<6<+25GhVvc>r)8UPzN_)` z*KKK<&Ymiws5?s|B2ag^NA2cl2+T141rL7CubOT^-!-70ai&Y%;+LrE>;a0#V8Q-A z%I?EdrC@&Z`+LDU>FKrY?pupH__5Fw_a3T0%86{&49bJ~+#xSS7x!)^TLeF;xi05* z`PJm-_qL~?Q89T+A;!fsyhD0CMZ^$dEu?FFNJ=4&);MYO_~SuN7_nQ?IkS!r$oBc z=|9Vj*%GNOi4e}XE%tj05i-IoOX>ukddYjce)~t)wxH<_ZR|dYvsF?MX_QI!g+;R1 z7WSz;mKfC57Xp(t3Mv0SxV#>&m{x6L=~>pBiEV0nx<@Q|#A4JW z(UxDvv9XpGykv<{n6Zcstu{!v*~iI+Ru7G8Est_Gk22+O%z64w4ccf**2cb^V*{xPCj z85gP*bLRDNP#A^nJ~&kufOM<#O01sTc}B$XN+xS|D1*#E#r>(lM1iaRF|~KQb#`ckZXbHX~#86cC(+#9^2q?XntPf}k9Bo}|2(HO9sf7Yaop-PAE z8f=f<{lEFzQ%F`7nMW-*Y~3#o_?4LQ=_Q}bvt0OVTTEA{1s*Xi;qUY5iEpWo4as~w zeL;Miue#|@Nb38XjWE)C!KoH`S88EEy{#L~9j`5pqx{_;KLBs9aU<^wwS)OIS<8&2 z7KDV~23FmMn#)M5nuqbw9lqcnCN(wQS zi8FC-2^!&E)t`}~RX`d~O!|c|e!dwi=e28p=Y_(4?>kMq_a;%l9f^WPXvr-~<$1h) zCsyGgq6mw2c`Ez*M(jN?mhW0SjZ`!B9c+lo -2EmvFa>l#2!eH?KU`2wUXH9)K| zei@o|S;Vm9${2ZLuMZ&79|ElfG4vSrJF1E^-pZgA2oHbAhXF6HyJjjAy`8h{*9~yT zzg(Nuq1QxJGfe-jmE@X7oqM>%8ceF6I{U-s5wb%S5s3eIVWo$7_*omD?fr;ugnIbs ztS5*#rKhI#b3TlMoy6zxCI|s(mz%x{J-u0WJkYg&aPJCd6W;BL>QM`C zsD0_zbSDeXk+-Ye>90CqyN+J14ixb&R-iQn6{3o0uD1BKq7dwLir;$L8(#!8%yJe! zCM(HB1UV>$FHa>{F^FlR>Ju~$?feKX-NKv&w^X|}=f;2+RUe+ZvL1LJ$2@s3R_94I z)>n5#pF6GB>2f{_*%)B13mGiuW3|OD#ILxTC3Gz-QV?0LHdU2VY$n{l{v|Ac%He)n zL$1%!{_k7~mD1{D5M3qOS?g8ye#-6~-DH5EuNn~1ohMunjyng$ry17VlmLf-^lF@Q zm32f+QR(uD-1<9G>R;0uPg1&|8X8(|kn(DEF?)723!Jb3Hs4=rsCx2Ny4@PXLGi8C z1@U!a0>{Ut1^A73ebJrU942K%i8MUrx$;7_HE7|u5no*RZJ5XNO8o0rTqKfB2KiRf zsz1CaE_h?3MjUi}$~YN*$$2lhcq>{IllE)t8V|Ft!l&d1Q3fE$xV}w_Zi0aF?I-U) zU$M$LuUsxO-dIv>CknJCHkWSatHySR(x0nc4zKb~eb6dXoI2ff!87>H!8!@v@zZZZ zos1{WO$QfGR#JZ#{J-xU*MICBIj^^58XnTVfv#*f&7sj>!@HE51GF+^-helMZpQYu z0kRXVFM<}*v%fB&#r%6hKB{c$!^}!*n&<5BlZUkfw$SvKH&$7%DknE>r+w1E8cJLv z+#Q^jO=g>QKg;pyj6Te81w|{PVp1ZMjJK6TqRj2yJI6O`PvAzi@jzG&iaYN54lCld zQF9Y?nzD=8ajrOxC=WBnVtykktgCb}jXHgHP%Qa2W=Av^yDCPH@firM7PTLFDDPFX zdTJ)8}9pK(C{Z(j&o-HxXTS8oVlhRe$5hT~bjK^Rzx6*bW@mq0P?v@9jVU+o1#jo-rKD;g|}dj_Wn-Lh4S# zUCq7Ej5TJHZlIO~2j#rL>_xfFO+FMgV)K6Y-GzTRg4xU_IrYeX50E-a0J4%uvkQ3| zCeW^6_fqc7?L9VmueYb$*7B`Wr_F5&Br3js5ST%o6??b4^l=lefE2`|=x!*g=g90W zv}%?_Ci=f0HFZKB<%QKBqeC1sV3Zatu)LdkvEtu;*XAGv)9bkwL%)^q1T%SP3_xRG=l**U$Mo&VbLUESW1GF~4NH9V`!iwoumY<*g4 z9X#0kY}w^Q@^tt==yw}VS~wEN$0IWLCG}ru8?_{53j>;_cf(0Ql;h-_8}rvtMA=!F zh3@%RUJ@`h#Y2BuEp8~%4V#>%9vHNf3GVybQ~PvLWR0L+-BMV-@|S{74&6@o#Iy*aGHzCPflLvUDW~3yvV{`NhrB2*sDx|cJ(H6?M_9N zdl|;Q+D=Jsxiqn)NhSu~9}r_nRzvAwr}YGwW(|ajatP7gjNOFwJ@LB0nmu z_(kDWv19K}D=bGl(flxM@3hjhwf|TOWlNu~-k=gYh0a{{{@=^gg?b_D;IE}w(=6|@ z$6sCD{EkUcaQ1@m-n*Ubnd%T6l`g)uR|ddqX)zO|+7!!nZ`9&4PR+g{>T1Z-eQ@u0 znV$G^cR;P8c~)Jtl-==Buqt1jcKDIc1Cw7k4>E6&3!Rfw47P!%H@Fr*q3=G@(-Y_E zGJ1ov=5lHZB8}S@vo`eJ-Re~$rMOjhrl4j(F_4tq`Szj`MTm37qadHE#}Y|4l)K)xazE7O!^F$qG$wGd z-5c3!7Gqm|#I*~bFouXgq~S5;V;(I-z-MmR+joI2#%RuhV(#AMfFY0$|9w!~Bt5xJ z7<$S6_F!d5y-_~|A88IdlpVDrVLA6R2-^)|*C+5Q6xPIDM=Y3n2R~HUqu~TmNPvjk zYw}t3+e3u4**mwZU2MnTG`<+2?sn8VDxP6>a~^!|;AP7WTR0p^d58m#coKMFh=;l_ zl`m=beRjPXOi%~}?8o5A^Pbh==E`TG4{O2&O?F~6Olf({SHY&*;`D3kojY_#RK?l2 z^Le<-zNr_22W>E?YTPSXu$3dq{XT&rtLhj#D*WZGN~O;(!0YcmIWKa@_v{g4u%3!pS1?|WzTfv@cdi9no7{-N0t+*PBq*I2M>)FIYbHATd>-XDlgUJ zjG$6QJ~gHXgty2rkcY}eVjIM@j3JJk%*`#mXs@rXO+`8rpyfIDxM zao{Xtgi|c9`tIGgp+R$ADC)86Yg89o&7oWgX~%p0;s!(Z$Ghj<%05@=PtXyqL~2ev z*yvUbRP$nJrI#DS%vO(Ei6G|Z+{G{6qhq*aESHgPnTU<;1j~2Hz&m~|@tQz#f7}uH zas@;`U$3;zfreQ*^_rFTn1&&y@YYm zGz}Q)d;2?Np=-PBI6)jX#CB0!SU&|JA#=(}^+<{~VDFw6=NC+W{UFWW$2zr(hsN*biw&$iY%d;?Ah9JX+0>>nK)BgEV zRPC8AmqI=LdEsaBaV&?WgIg|*KC;ZwM=E7M8p}x>@r)Yf0`EN9?PMS#y!cbsi_>K^ zd`xb0n`D{)ozDk8)1O5eH`n)=@5nLyd!w$*pgNrK8B4&VyHS?@o6B7Eo83DnpFv7F zYk_7AWvvd!{=*Q*mO68x_4O09YUfgJoL~?m{Owrfw{v31x757xa^m%GI!oqJWCrsK zn=Rvtb@M~0Kx#)K< z9BMzxY=(8I5L$6DqbwW9Wqu>GIAW~HT?OysB3qUTffwDP$&Yu6Uisv%vW!-Ld90EA z_70K|!rMt+w02A1JfSHrY(R*RbS3}6x3gx;(y!75raiU0<1>^@4aQ{maSl@^93uZC zi&O%qn*aO9H#+=L>!LT$+8*58tgj}HEZZ4#R4Tzaw6uCb<>R_Auma|P8aOKs<^WVY zG_q(a?DIrhW!=p%#q!ewxzWl|VoBZPOQ$w}|DX2wE8^2qZeus_bCMNUh>__!r=RGq zl+FxshGppBM@r-Goq7<+Nz3$w{@=g01v)%Uv@lFH`k*L4nzhHg$7L5g!~S^b3wWHU z@t0ub2S1D#C{N&GsP9Yf7H~iFKZ*N>-pV~aGH1D>|M(c*Ko{W!{0R8ixodSk%+Jy` z@Z8m<@8eZJ2h%POSxKJw|9%Gl^)UYW#kbWHFl$EcV=;LzNojMF!2hy+_B`4LYX-KWU~S_!e0Of6h~>B=?)>8g|Nfq?`GHgDgQI!z zU#GDLTZ?Jn*uofo4Ug>R{imy$bou<Y@N)7Pzj>Yg_a0UM#+&aipR~r) zQmflv@-|}r(|3Wh!}@nW>aK!um-}7$`hWX&{>RJuAHRL8@Knxg*vswRzxx#Psh>{& z!wcZw{hhx*UUfc&Ectfv1;oER%K!ZrHVg)J(H#LAe>Bqjzdw!t&mYAfzx~~hw_E=E zyPr&e2?AA$7^nph6~J^;fs5SNj7tB;zu(CJ>^u0^uOAcQ)_KSMGpdsRc>*>VQCt z#2F*EKUNamj=XZ~k%U=-ZG{_9{4ybb#Dvim_>H(ED0ldDTX!d+nR#HI=p3~Vu2pG} zNR*cenXE5$#Ff$>{)^k-|MS!T*GCp&Pp~krSO3G{$^^K%nz9y?flNuaXqRx<`A4`U zt`6UG`3YuZ*`s!~dcYl2tOmyT(mxEt`XEW=6C~g;m2~ir-u%jW_2Y+4sO^4Ro_&|G zgE^%ooLIJ=v^hL_a7LW5@B%G&AE@_JVfvBw+w^Qe+bZjCOR=&~3B{+>Hf-CZgzRuU zu*3)a?$d8>-^o_SZEmnJ|1<*gu|BX6vPAc|pj|7<6pmeYdR_+(N_k&`Dai+1`}V+U zLD-r#a}(DXT!BQG?>k~}ROXYqL(0f!p?&yzv!G_wc<+;Hn;Md;#7w5!uY~r#FQUY; z4?!y7q_G^W)JMa>b*FBQIk#aEU-6#}Uz5^UvQ8Gn%Hdz77D1@?Pv=Lq6oQ6)-OUnB^W5aXtZTBT2n zU{dNt#48$m3B!P`bP?yz<==EkhfTHS<`;rr=n3ySEoD7YDsf&sJmp4w6@s(R=;`Q( zxH38HB$H?4l|>SgjfEj%!|RD*-FVFZ#fBQgM%Ms)1j#cu(Ozst)i zryOVIyEsx}^(9!8F{L>++pM^?w24otgDgslryilmn3^shElrZga2eW2kBaXvuhJj5 zyMA$A6`BKlV#Xv^JO7a%_5wi^A5XHF60Bk7e9rP~EeA9r6wB!{ldzC4lHX#m8q9r@ z&<9N##-!5|EFP{OEGi!90}n!yTQr$fBlkiF$qodQiB8AZizmxg-)-Rdkcrv5F(EG- z9NXwkx*2SxGu!&^UeP*%Z)+6$R^C=QGU}@U&hcacdwaJR-m6q+SvIi;%zIjZz`T6; zm~c9=y6H%9Vz|0o>_0sx+*7STbt`|zQUc6fR1=OMSt|?|)sc$lt<1jW?s5D{ z9Ipj^NBr$jq3ZF$e8amaD&1WWJ5tNLqFTP(fT&XE)>oE$T^Cu^zk=rCI#3=n7HIQI zVy(RjK{zM->*vw<=QCbkyjM5pI>;mJyOT2Ryg1_k42u>xzH}fI$UC8@8Am4I(OCV^ z)dViJH&;hWB7~fmhNhnp$&O(s1vNSK@Im!kwYm1hT&=`Xty{u~SZWyR#YFQ(XgAIi zOY|et!9k?71{KF|vqUp@;00RKgcK3X!TmNnt6Pg;1IgJI#U3%J@7Y0dBd6YApZX`n znoVA9Ly=)OV;hAVg$-OQ{_(mfvEGB|fQqPRx3y$U;XEX%uA#8-!8_`F>1|hZdSfTF z@d`e@eQgBSz5l#^;ZKduKiOEH{Xt89B1&i>#ov0d74KCQVPuqQU*TIrg*RYmZg^n1sK-Q#Bc)l)`dvBp^v>g(o#VTH&eQ!WiOh;%Y`$_-Sq8)eHgO(LZmaV$`jN(eOr&u6XWz3k-8SS5>3a5VCRXwZB zN^xOmtCg;jMSB+fcgidl$D4vEP}w^?fmY}O;{Y%43E82-30vT0w&r?L+`=L9%PeqQIiYF9CWEmwf9> z1D|xvQ5M64Fd33Vm@#KP%nHxDkh>b$^sHrw38$A^%}PI8^3Yn7C-!(ctb zS@4sJydEl|az<69*M#4xwW%|XPaedmSIy5xFen!16cZ-Jt^|ZdBe62Iq=ugyW?L04 zjK|FzUYM>76)2{xJR=}VQ0eEh8n_TK+|ArerM|;$-QHk(07thCX@5@zQ=(J29w|p= zHet!fB7Syu>H+9{Y;Ri$K4hP!>gNFG(C%Yq-nk_f6-zj4Lf88$UFKt$bLbBpa#a6x z+GRd!6XQcA|CRh!9pqd>hTbk2&l8%X+L_8H^IOy0Jxs zoy)b7#V5*YqI(I>WT5sTBS8q`=54#Jhm=g-_q^Noc@5UI5%*M}j*%uByKh(gsMqy< zOV7e+mDipFO3Z!3WEcjTE3j~VlOMNiSjYcV?CzP@juUoU)kap8>!@I6rfNt!1OBu= zgfk=tB)#@ePES;O>JW6)WJt2TuwmCJz0i@;U+KKuKw=mg&u#je{QivXF76cNc7;mgOD>Ts5*F7d9{I^CDbCyr5dT-NME`eqJF;B`1hr8lS{2)6Vvm2;_P9 ze^gU^8=WM7{6y98xzC*#;)Xu)s(_Lk7|)@-sUf5!ah%12THz~a=WXEPu6#TvK>V_o zPLPUgm>kP~$U{)1$QSo`P&PER#H zSK2dT2YDagSfs0g+EHu5=fGzE@JeGwm+!;glq+Qx16}#JlseQNnA(-LEneD6SRE}Z zlk~b0e9>A~G}*rPZq;VUvS@OnCvzZIL^(#k3(!(R5J#jwN515}a;V#Wh z&wlR!4BY(hCB3f8ghYabqFMO4-5wAC$&XH3UAeVddZ4uj}cAUBwo~w)NfGC~;1{i_;Jyts(~h>>l0zbLKj$?ofixyEc4*OmRJpP6#s$?#;(l# z%q?eOkAovnD6N?t#P)4cVuc$Ohu9jola!`@AF5-ndFFkEKCacVoF_?Xbm^{J_pPt6 zR!WdzOkCCD&SRhra+s)IE1jH&ihH(7b)4>S(nrsAe!*;rXgRH`fKY3>He2p)FWnY! zOL%OKC3h+xr{a6dxim6e6ZK)D#l9$A{F}@5RA3mE6{A1#$P}eH*lI@n~r#=i5vii-XiB`MnJSPI;bTr{#f;mP!h$ z&z@B%&OrC2p?cVWXVYSxiu;nHHhWbH<62f=WD!9l>LC?%#(DlDB^h`vFXULd+$FZ{ z*~qHrw;ADOG7d$FYX0mUPwFc{O`GrcZTL@2MmaG&tH!eD9wb@V-W$%7beagZ@klP7 zF@n}yisz1Ef`BsI__p2c_Bv&@&iIPk`cmE*P6!N-^Ve$u0>h!anh*T%l(c7y8R(Q+ z+aq(Qt?2Y)vO1^1Ml?TK!1t$@xz8G52h9R;T_2mintjc@b5%L|uY!Bf-K^KPa*=T! zmFvw%R}4JZVJhk5%LH&qqI!D^w$Z#mvnxB?>++4d#I7x{yr0zPS{QGrEpG%g&$S=rn&zL zz{9N9n|ADe9L%jnZBG>v$08eovL;Q$YK#G1@wmO15md&634~0%$F4Lo* z->wWJekiq?nDtgB@0f$IxvXts6)J5+Y@sc4gaU^{yOXd&EI+z@jRRguiyaop+a2}g`|tvg&==Twowk7mjZg^4^@4UN-B&E$Rz zyT_$`>8o!GB@R`GgLOu7F6~{9g_WU8I%&VuKuTU zN{)(u3C<@(j8wT7p+`bhW7}Uct8NU_I70pn#X?f! zW^AAEjX`8mBfy})e!H0JiX&yjhX zdR-9uqk?SAttKQkK>>YEHCo>zYaEGZS5e&1sru_%QYWI!(_g6S2=S#f2md24jA-RW8%sXq4|JsU*?(1>3 zMg97DkPdi_5%;iQJba0aj0Yi)V};3Ard`M*n43A6Dkc*%Jd?~i;sQ^zM1m{53WD&i z7Jv~V;KGyY=o}xVg-hsN%YEsyRG<*Y8-|!&1MwQIMgPZlnEksa+5Fxx3Wuq>d=uS< z@gy6LS2Es@pRC{2o(zLqC zUNb&!-0SWMv2`DRRGaCXSQOPq%u0RLS=WArM>5c;@SKqN{=^1<#G)+X$9q>*Khte4 zO6gS>_RpRW_bq^yMRl`1jy3i!%knQ<^kf_gcN42NuAFCG628&$d*cbKyO&-$Ll%bSd!P?OO|VZE~$Y>74xGH+4LdHY7~`0`ws+ZQ1GkDwAX zJ?_~Uf>**$AS`4pc z-&dOCzGp4PrUCr1bB&R@PWamh7dF&*+uK>Vyfd1rN07;`M5~syAw-3YsW_5=af= z?%0ui=?hqgwXup+yw)HJP8U)~F_hCHJ!5>FU3~71buY$s64|BS_3|37UM8SuO{4B6Z#opM(M0m|>i| zqyM0$4{f?HuKh4qS8(0J(_4PCmXa)B^2C2a3UKG?0~P{$I3Sp{(I21>T_T#?T@+-n}Vmhc$H(QcVm?ft$nn=5B2F5RD78&taeR4JP8aSq&xm5<{IjXjDe z+>hU}&WNGlt@~6A9U@9$tJ!9sO(B-MsfA3)d*8`?6V!6_aUF7H0j76EAVA6#$jpl8 zK3M^>EYh8viIglbWDlI@33R*@)t1p+UsZF z#v;*|MCOzaoACA{a%_7Ms90@&Z|*nen|~q(^;Le&-JeRN3ZO9l6PR-hpXHpE;$S?1 zG|!TSU}q-Ml$DS5-6-TE@VIhyD`9BO_^u|Jl{v-}7F&D~v^$o(wi$KvlOC#cRJ2>E z!w4zqwC@NvZwB$CBh!0FY-fk3_?TFn&4c3;V=fQ@FQB#ajPe|x<^yb2s98!kvR=Xe zB&iE2dsr8E-V1gGn+ZC`>qig{m{{&Pp#2BmOS&6)t>2po#m2z1b=OEV?ciUu(Pk7} zyyS%p7c)@)GKfK$xd2s^qr8rU4=QC!&_Tno^jMvDbu&Qx@V!K!YR3q&EB$tSFXZs8 znY5n`Nn8F4#i_!)EB_l(@2$48pKx_;&sQQIaf~-}?R%=P-9pred#Lv`Q=a52aV!s; zd~8E1am=$>qs#NE^EXe?L^lcxx{(Z={{v)x%&*~$6!c@(2DVnc$TyFp$`A@XFD-_( zZT17!ryfs8+{WzTs$wScXxDgDPORJ5+|lP;)Td%Ee!GdWs0QLqDv%^5;@loMAt&vf z9;wbZx(^^Z683vuY0$Q0`M^-t#J@+P7?)pERiAVl?Nzk3HZE+vL{K`r?2QXcFo8G1 z`9yS)-%XwrxtwMy9bp?=$jadTvmrPSlOsdpE;Zr%%e&k9%?Qx^1v3s^E7y4+*aA3H zXge;H@qBG#wk`3|2-M_XAzs<6h($eHy~8K8;R_3UmpSskSLh-<#c@|m%!Da>Qx4v& zZSPaD4k0;Kcie?yZ=j}m%k>9U9A0dceoApwL~qwy(LbFP`K&}z(&ymo_&m~=qt(kH z!|rxqG52xmaXnoXt_Mi>hC$HEw_ZCyY|OfnY_J5OWx{gxci>=HWqan^I4C~U701`M z*2Uz;Pr7NcXFZquvWy4)iPC5Hf;|Ej5~h8+nAY{>jM^uU90r3t(Bt;ck_QcZtH(d! z6-=BBb2&-WME@2RRA8Vd&xpIfO>d&raG~j8NiyIu3Mg@I0Q=*V7lg;kKbf{gtr?{z9}lPp1>$1n$m%zNkPU+UseR}^w)Z4ReCb^g;xbe$lMNjmpwZ+%VxOn-qyhf@kO~C z9?iILDEfc|Vb|Qp$UE3(cJ{08517ZZ@PcT)e)w&s&88Gt@R+sdkAnsBEmT6sGqbfm zI@L0h0zxIT%__!quP;X=-OHf|e?w(F;|C2B*nInHtz8nK1v)`+d}^qC_u3|oTFqCc zQhe_)_Z9wjjrg<&lT2dXt%IszHE1F^mGQpDWnpn;O1s4e>)~HVs<)P?URw~?D30Ll=UNJcE4&9Pjdo2 zZ!qaQ2y~)g_&?-~X{h~mWVcQzVj(*?Wf}LP%Vu-FD;n17xE}ElF5|^|@@-VV6+oAM zKA&{TN=I=qH^qaiF8eTKy2o>|QsMY<|8#3T{j zJ{==IAkD9;$Z0xf?F&@g$i70;Hm_#uq5Nz8*&3XqG6z<*x})&8SFcXPk=5aGD&jqh zsoc!)^i|k<+{0yF&G9)d%n|q60F-D^u^Px(-)=EW&)?)7?pG@S?>1Rb3vICC*a z?0s<^fid*8{t_#VQ6*6YN(BR2*I76su-m=s3U5AUq!rRL&x9-?X4#^D^Q6_-lbr-!6KX_CXZ{#^OPzts_qN|XlZF- z!I;8f%6)&NV$pRU?p!4TGzFuhz9pn&GCSL&4LwL}fW()>ISVF)h0RNsMLl=g_cd29 z|DIV&%~Ss4>{==bC`pBy0^w~(?eO*54rLFc zvddZTIfX}>ozoWv@gR&SFwrWMM$|#bW(+gqygV>mkr`hjo)%YGiD5X>1?bmrZO%98 zeyqx5jSrydmU3u6Tb&xOicS5Ekn}bW+9DfRec2eQYEP`|^pUnY0jdUo}jDAkq96X-mA4d-BsORb~ znjF(XxqKQofNmz1&nl`2ZF`7m00S--m?OJ9DJrUQURFoDkUt^UHrfU}V(Z*Ik$~3Ipa@ z0F5cgpU#`~boV4{EB4!Huc?%&)&DSYkz32i@(xsN+suv^!Z^ge4y=G=ny40^ZOLmewAv+NDyikD1|5 zC#<}NAoI-WRMQl`(eP2HU!ZKA#X--vFYZ#^dh`^h46Rw+ukPd8KKMXchjlP2?MfqlDMWs7e6hn75&URu9u`mrB6`@IJj*BKvZZzWbj zk?{KTnv+j*%rC*uSYgD0MKAgy%=!+0UEDP2U|g=|M@`of;RchukH6K~@=JPkdXC!O zce}Rc>d??@>h?!8NbN*npepaIh-w^PM~ul~mO*VzggyIsIpa;{>C3U5j$`)C=~u;^ z;WMQ3T4^G=UV_NXjJ5)sWysKqYwxmCy>1;~Z4~U`TPEs!Nu!xc#WL{F`8Cdjw zWyvUTJG)?PGbX%C`7=W$2CSglJ#vv=7E92&c6x}x&{W=?op&?&G=As)?xW`N;$A4_z0Zu@)dy<7u)$HteB5}abMQfL z-!4slYKywdweh(9;no{2?K6q`>&giLP?86 zAuDW*c~6WlD5cETqO);cQDn`vP?#h6Pv!Vi2}2z6R%K?5Jdqu7y7R<}z_4Be$+sML zfD0))f*oO`{M^~T)WW4IwKS8ZJ1Jx86IbwEP_mSWd6@gI3@LStp zSkq%IFI{?MnF7uD&RW53gS*xBaLuO0M3uWH1-cXxL0ci*X)T3YnVSh<7Oh?h=m=8E$NiFxx&Is6~b`~CY>QzuQlXn#z?E0_wsFy4NdoyG) zgnHh4kSzo7M(2P_9W+_!L4lF4Vb_~Z>|NUBV)zim3(s=9G!s2L;UmjQF)K>$Y@L8H zA-}nTs#Ts>- zEz4U#)d`DZWAf3Ql}huugOjDYd7>-2Ynrm&UycCJPWoTq*&z~N94aNxuy<$qvJDh^ zYVQ~MF$W?U*h((w$R1wf7Z7*Vn-?@}IFXSP->E8J4R!u~AO$`AAnt^kZr;wC^)B(s zYI!>sS<}1mLi>!GUbXLqu34`uIeeZw*4^RG+HxAlDfrx!e2Wt-b^UHsv}cv?&$W4L zgyNe2SzF)zMJA>crDUaumLBFXO-)W}M-Y;v&VCv{$YnTBbij7eg{H|nA{OMehs5>)5)o31Sg7^0g`&x~zg-)zvi616w^B%l! zb^UiAGcer(%wpa*?i(c)q)w*B?xx1wK2_w2T~lAdrN(4Ac`VRbOZ_iCFBcy7`n$`bOwzyqZi>^X$AXr2Plr^ML>X`yON%jM z9706w?>I_fw z8rPoxY6ONqa-n*0q8jA|amGIr{Yr4v#!C`v7Mvl~Bho)psE*;M>pewyr5}-SiT}N@ zhSCX&AFe^D^em*6M#9DY6?$8#qP6}!1A{BKZP|cOXy3ZB)^lH1##np0{l%>o05f}j6zyFG@b~E0?PdAv+}<6X&lJKC|4<^W67!eYcAYHSYvQn~h6E zHxi&@Rq00(ap%k2ZF!Y^i{gDpGsvFkpGtPV`%18tq*(|KyO)QltdvUJ)XQ}pYtPnA zuL#<($?jS;2$3VD2(rfmR~GCkFcFLq{R_YRDbT*A0j(hEF{I6_;FSfUvzC!UTl|iZ z_UyQZ1O+4DjjY0~|9g1+OsevqXC}y>yH=E|CzM|SY4iD6gssQig#DqG(BlS$$q{;{JdX>y}aBS3NFtav_@Q&}EstpYN34 zuZ3#jmVxax44CAg1#+MSEl{T>auoq~VlC34D-#MPiomZ+JsSE4L5l~{-~&($dn{fX z?>Gw+JRTjL*OQur?w~=Gl)3406b^(H1BT@??#I@6?UVmtmP9vBYmWm7TjT_duou%P zm@ceK%8VDr?>xE8=M9V#&9lMoZ-jF9@4t`V*D#xyK%4^*BOoOt5 z=ZBh-B;ekS@^}Wy@(7DcUpc%<_xZwphd5cc=Wty~#=49>{O_H?7+ks=X7JG*JDVVu zy`_W>!0cpp;jQmC;Ggc+s>)kz_-h!D(W!ahiF?jjtx-^UQjBxXWk#W%WiAz48X}jR zN`0=*hTUD9hlsyRT&O3s=%adok*AawZu{vD``rVzE~tXzcWWm4ii)JfrSdqLt5F+% zkyQnS>hO#&WLP1z`rKVsF5y!kbB@2po`+x(h8g;AX$>;2)g7q0iqfxaPOKS=pJ&jX|^(W!#)Z;fzOSKy?)bIp3! zPtV04J^}U*)$?lpkjs?(_7fFb5{Vj9(I$aa&U)$k66K-YM}WR&bJ82zhsSERtnHN* zGH$ByNeuj^^5ygK7&(vhLbO?#dn=SYk1T$>0TG&MpuQ*IU~22>8Ckxyz4Yc(p5K!K zNnhy>okbZH5Ew}~4KQe$*F@*DKgR)6m?9|9YXO#yUq*OMzTA_ry8Y%UNtWIcd5R;6Z4xOl;gLv#lZKYw+yp%>QsR!|5M{D>;SYD*&mV8x zmhDb*=IV|u&utJNbf_S0ASVMiHAQH_aocq`}DSV2nF zCpC)hhD|2+_Zk8-;aJO zvX30Mwok8VN9q`X6`_o{i1PgLzb@?m_p?V5NUMlX zxRki2eMKPwRz!h{8oafp+hj`prXUmv1`S;QdUgNt^jo311n*u&W7Ety*0TPpxXm0j z(GuSGeSXdcfA{6bJz+&AJWC?k)^uLg@&rvSNS+-s{=x+I#c=Qv%8SrC@>7bSNSPO@ z=KWPQ*^o8MqS6FT=b?rSP<={Ty;>(~nP@4LHY$9WcU8AYtys`84GRP~0r|s(Sr&_{ zC%wC}mM5|1sd{3YxFQmMaRBDPyEB6!R*j=a{L4Ytk7zB610N zw(q|3zwQcUtbl8kK&Mg$bJ_;MfEER=3`*fL6#V+21w&d!PU|7}z(txOlgCg)I8^hp zJZ(h|1{ubMLj(^uGfk8AG(QtQuYY})?>*DjEldx;cQ4Zn;lxjRbGF?yVqfvy2wjiLHf@YFpUx-KXkA zmgZ~=AJ;r3$44uFw~VV;?#QD-wSqv`wUZa3#Ef(ihO`WPBSCn0#D-nGgGFb<| zkmsmix>E#+OaUCdEe*klV{IHDM*tRgEWpHr0l4oT%XtjlEk|UUUxg*?^3FOwP>(5JxRrwXL_u#IXFzsCiz*GmjQtN;)H67)miTeuILs`Q;50Lm{K z26%X{|Bd zZGygCz_|{N75vkgr4*_(cY&T>ga@_`0~hA4s8Du436!TMMVCK*`Lq)e_xoLOqn!e| z`s{*spI>B60ExZ;!HG1`0Va+xlt%pue5UP&V@Ttvi(PZ$WP|!>MwPCNbLYSes~^h& zD4}3p&9g$S_dB7}580#A?X&F*d?o!tJDp)UEX0SW!4$TO$2*+Wmj%c{E7(H-mk;}V z1p}9D-D4qw_bIK6G3@c4<<(Y4K~FbouhZ8-s4nVib~6PsiLu^>{HBbp-WZf^8%N9s`?eCR~CMqg`bl zpDxgz@+)|0qs&SVWlk0mLA|UGdaA&Ir!a?2V-#)xyrZ^Kl>!f!_IBTpy4t6soyD0G z=w--t%;@gR+y0OIrvuC%P1gXnt^&;}_T{MpF66aMb6?oQb`$lh z(edv0pQ_^W#Jwn>C>sFOI~w}nH!f_Z%~$@69dQOB@kML^JrRWJDYMFwKgnayJ+29UD_Jrshg|UBGwA2oVIlGpa%T((SieVb_w3n%y z_zQca6W0zpJDhOX`VPEzdUK3u$~%IcB_~7a-Y~H;O14Ua_H<#<;nwFG=2!RaD)7Z` zmz7!>CNNkHSs$IHO6lt7Ftaea7D+N2^Bf8L{|bkHbT%A&&z$W4`r90uYAZQe2h{!* zhLdV^R21s8)}@Bm1P!f=fFXVm$Pv2sq~0dQ{q$Q$R&!K!hLEYH?}(5kZ12(L!orjU zrFN{9BuUOz(g=hGSK9UCh5Hi_*yK_{c^v=>Hi&BWo;gDnr4uJAs~5bfcs!GW2*1%a zXqE`1;~MB8xC2-aGnHvOBD2xuu)bhyR!q{b>GlFD<1WiO zN1~u2U21d!fw>mIfoa#D`Y;%%;SV_}eI zY3oRNUH7o!Sb0`c8)A2Wt*tmmUZ*LSz7CbK3?WSl)kF#0{Bw8;-cDRn>Hi`ylFXNt z-Be1MsZ8ym!~Wdq)>7~RaW#Uxt;~EJ9d(LC7hMJW@~s$4e#FFAWAxOH>7BojU?B>< z>srqKcOmkYZ8$65GjHM~gFp|oKJ(Q@6FU;KxA8XA6W;R{2HV=Ep2|lpSxb_*cQ)C~ zY9&Cl2qug*R69m6g=x8q9o!ZL6Pf*^`LG#zc~hFmh4xEB4opqsxV+n*gPuC;EJq=^ zZYIG4q(m2w&to3KPU_u&7@Jz1*fD_IyfVVf$2#S(dTC-^BzZbL0MV0nu6n`mOaIVS zsUdvkaM6;+o&cMr%a#$`5=EB!yFdhwD6s;T-EgssTRc$1?f=8PS(voM(>QgZ!mOw!VFa=gp>14mbJ#3Fwp z$9f`)ctnk_=q*0IZ7@FuM+*?YMB`b_SSZPXpFCan$=`Z}7G#7^{OfzgDo>F}=tv)~9>` z4%8^nnzsrZh4Qjzmck!&8+1ACE00E>5%==y5OCwP|~alcDIdd2@$d*9eshLJoZM8*LU@Y~_uwEBe_c zM_`pc0h*p$GaQ97O$EVlwTlA@ZZdaXW&cv@4Va`>55?p~Qpye}Ol-ZK>OQ`h!uuxP zSRS*~y@4vk!cQ-;3A_Y-j+BhdBR%}rxlb)`2vltH^uY|oBipwyvsg2$G!+_?i(mYr zGShq2&2pzZysHFL|0{t` zwB8;NB>Ii}w%uZ>@d+kKi&+^uH75rdzBJT?PdDmG9KW94VBfYke}Z`B4%G2H2I3^% zLLh3Nlk26AQ_pJf3k~9p>3%z}V4Cbdcl50YY;3ZOZP(FsL_EN{2B-V{2H5+Y z0HcaT?Mg^424+;QF@~_((zAt0XwSp#N>%!WB|uv64);wILQ_(^g1{F5Cd&#r!y$G6 zAyELHl2V#ueA|q47HU(l2XCI^`pzs+`aoaO`aZWG;SBqsfbDS+GKM zD!WltU%0xhl=(TNWX8?rJ-M>@$ql+RPIk^X1#g#*LvqeUL8+@0cup%a^HG~N%zIj) zQZfgPjyRd;=mbyAh)~kiY~PXz%1c*T3d#|kq`DR_))_)9r{K_*Q$gf^mls;#&^Zq- zcrn}hNH?s|3Iq>@O)qRcW;4xSm#*j9~7LNg$_;&C*$JjRYfbb=(?$OG|vZ`6|Bcsz8+-3$8*?I^+CHx9Rh}r=ijCkCT3p1(~ZjXSeLGz@-UE z*Ircwd_=}tyWK%*(XBfVsS5ahdR9wh-Y|zuC=N*s->`!Sp%_l`q?e>jp-{9=oG_x? z4%sC`U>)^9Pl5mv58qZCQ4(N9Tbfd7eqBxW9D8%$VymSURuA}$6fY{>0 z*SARt*vRjnRGPwNN>*O=3`K|q7`U)n%2G9o>0`K^u|S2`wI#?2k+R4s(SwqMZ3bk@ zl?aIHf;d0ZK!x%Q*5X7F=wB!@RK!)0hOmU*;zEuSYQ_g=#z;-9y~G?Sr*DI=wpt*K zGzl+9na$hCexdcIY)NB`)O+)WxF#sn>Y?*R!8Egn&|j%r1TNT$TCUu1%LDB{3ge{N zhZC9fXHl!@3GY?*rcy-4{RZY9OcQt2ruW-zF^oInbUq&4>Kpgen>)w?BT6BM4!XqqmL|P;D*QjENou%o6Cd6V0v@ij)eWXjt z)g?&Zy-Y$%QS5HaAu#58B- zq~?j^oWW5a4yqFc6>`+V42!kH8Iy~hzzV2`!9#(I&T$x0T6Uv67Sif^dud_D_nli$ zgs*btPB;IsivBV@lp=h)hZ{pmtg4y3KQ%YO<1FUs=XPbLn<0zS=x#``3|vUF@ePHn z^$&fe+JvCh)#T%num-k1nMgda50st6IUJ;X4nPBkS%NjTi>7XDOdN6^ku-65)!ADe zTxq^9no@H0D#IxTSYmYNZ0~DuPL43AJGgejjV}Uc4!c*KV z2Dl9b6uA*8yc-ggC^?&WfNT*NJ(qTxd)OXm*lKZ@k0w##aMJ)&eS>y*kqk2PZ`n~v z2o;LWd{rQGrg_)abII0ByZUf+BvC*stlw{dzsWqbA14El0zW}?TLO*T;$CkuTApgs z)w2&3HgS~Q>cdpWNNgZldV|oak6LBejNS8)JOEqR4srXWUFnc2SQxVN@M{<3Odl+% zTFy52=8>+=gk6&M(hS<60uYj6bJ$GYO+yaU6L4G+OOzaKp;mjIWqO-+l8w1J`XaXnv7b~X6KR_ktYNSXYaSY=wUz3DPsg4m*IcTF$BcAi2~nMGD34HKV+=Xu)dd)*yXjZnZ4Ub!O?i66R9X27J9n5Pu)4 zK#=k0v|iNZAl_$Xnl@*Ai#&Y#z65o-5Nxk$+Ey0^wrZa-7!8pk+}*A5z7izw`ofnR z=0GbR-tW?bQ?ixxB(GGL`H*yy&FgKj4|eN$$8I(EQiR|_OqFQ3##C*qivv4pW;*K(>Y0zIvqyK} zApHxDQ~jQlL(T9IAPwVWqKr$ItS!@u|FSlRWk;kw$mu3$J(6NPlVDc8@h92phnoIj zF!uFhWZ-aXqfSYjK2DUYVSLQ`*8DA^HUBC>V8Km6weIDyLOCx`vL{_D5B0x4d@^S^ z8RMXHEQKV8C=B#4=MhCSm^;r6G(+wg7Wlh&b&e(AV(0#p$vXo1!#;h zGH4Sv=RRcl(ErtyE@>55qo%RU zyzsyyPIBsWn|>7}&_!@HlR)lzzD{bb?NbJ~~_EmjBFmFv?S?wyNB z&;#`kJ#tV9q9SbJfNiq9due1BBS2zw+Sm+kzAo?sp}-%RYBE#?ts%j?*7TCXc)UOKK6qdO!a&4YJYoz{H=uCT-l5U5 zaXoVd6BJ>5t5+xWf^M~mUcE-$&RgN$Twc>F=)n`KZIl1{J5`Q7O{**S{syCj_N#JO zvQ~STtcp_nn+Dt5*U$U+KYqCK|KE)XwAAK4vAx%Ie;S^4@4kDtt0gL-AHNg5BARIJ%5@PXa7YH zn*{>6W&7&pdVQS#RMiybYLEE0Ojk4p;sEggB8(lJ-V+YYOl|!WG24Zy!2-KRz7{`& z{7dR&C`$OzAc(VjYuIML^2Ep@9AH(A#7wB(q3lH0Dz8deDfkNz&C)bU{gnfpiO6vid`5R)%i;S&RV;8l`_NM;Wj!vjbL_pFJ5OJ4f6#b6 z`vo=((1FY{6Z&KSrLQeK0JuyAK;BC!<2JA`^-u|qe+I@D9?8oH$%sJqh{EO*otT$S z-j57F$ur-G;hv4T0cvBLu2Q#+?`B=V)VE2^--2T`M-C^~yb9~`Ot$GpkHB^CpQgI* KiJW6rxBd^G-8?t| literal 0 HcmV?d00001 diff --git a/linux_networking/intro/index.html b/linux_networking/intro/index.html new file mode 100644 index 0000000..515f813 --- /dev/null +++ b/linux_networking/intro/index.html @@ -0,0 +1,325 @@ + + + + + + + + + + + Intro - school_of_sre + + + + + + + + + + + + + + + +

    + +
    +
    +
    + +

    Linux Networking Fundamentals

    +

    Pre - Reads

    +

    This course requires high-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP. Basic familiarity with Linux jargon is sufficient to start this course. This course also expects basic exposure to Linux command-line tools. The course will require you to install certain utilities and run them as a part of the course exercises.

    +

    What to expect from this course

    +

    Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird’s eye view of the functioning of the Internet.

    +

    What is not covered under this course

    +

    This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0, QUIC, TCP congestion control protocols, Anycast, BGP, CDN, Tunnels and Multicast. We expect that this course will provide the relevant basics to understand such concepts

    +

    Course Content

    +

    Birds eye view of the course

    +

    The course covers the question “What happens when you open linkedin.com in your browser?” The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol

    +
    + +
    +
    +

    Documentation built with MkDocs.

    +
    + + + + + + + + diff --git a/linux_networking/ipr/index.html b/linux_networking/ipr/index.html new file mode 100644 index 0000000..04583e3 --- /dev/null +++ b/linux_networking/ipr/index.html @@ -0,0 +1,348 @@ + + + + + + + + + + + Routing and Conclusion - school_of_sre + + + + + + + + + + + + + + + + + +
    +
    +
    + +

    IP Routing and Data Link Layer

    +

    We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table.

    +
    #Linux route -n command gives the default routing table
+route -n
+
    + +
    Kernel IP routing table
+Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
+0.0.0.0         172.17.0.1      0.0.0.0         UG    0      0        0 eth0
+172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0
+
    + +

    Here the destination IP is bitwise AND’d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com’s IP 108.174.10.10 is AND’d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn’t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row

    +

    Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. +At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. +Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved.

    +

    Screengrab for above explanation

    +

    One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle

    +

    As we followed in other modules, lets complete this session with SRE usecases

    +

    Applications in SRE role

    +
      +
    1. Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary
      2. +
    2. Understanding error messages better like, “No route to host” error can mean mac address of the destination host is not found and it can mean the destination host is down
      3. +
    3. On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior
      4. +
    +

    Conclusion

    +

    With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course.

    +

    During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE.

    +

    Post Training Exercises

    +
      +
    1. Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost
      2. +
    2. Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA’s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning
      3. +
    3. Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)
      4. +
    +
    + +
    +
    +

    Documentation built with MkDocs.

    +
    + + + + + + + + diff --git a/linux_networking/tcp/index.html b/linux_networking/tcp/index.html new file mode 100644 index 0000000..6fd325a --- /dev/null +++ b/linux_networking/tcp/index.html @@ -0,0 +1,337 @@ + + + + + + + + + + + TCP - school_of_sre + + + + + + + + + + + + + + + + + +
    +
    +
    + +

    TCP

    +

    TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. +TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party

    +

    3-way handshake

    +
    #To understand handshake run packet capture on one bash session
+tcpdump -S -i any port 80
+#Run curl on one bash session
+curl www.linkedin.com
+
    + +

    tcpdump-3way

    +

    Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it’s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won’t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. +The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem

    +

    TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here.

    +

    While closing a connection, client/server calls a close syscall. Let's assume client do that. Client’s kernel will send a FIN packet to the server. Server’s kernel can’t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can’t be reused for that time period to prevent any TCP state corruptions due to stray stale packets.

    +

    Connection tearing

    +

    Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role

    +

    Applications in SRE role

    +
      +
    1. Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs.
      2. +
    2. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver.
      3. +
    3. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall
      4. +
    4. Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help
      5. +
    5. Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is
      6. +
    +
    + +
    +
    +

    Documentation built with MkDocs.

    +
    + + + + + + + + diff --git a/linux_networking/udp/index.html b/linux_networking/udp/index.html new file mode 100644 index 0000000..f39ada9 --- /dev/null +++ b/linux_networking/udp/index.html @@ -0,0 +1,321 @@ + + + + + + + + + + + UDP - school_of_sre + + + + + + + + + + + + + + + + + +
    +
    +
    + +

    UDP

    +

    UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports. DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number(>1024) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer.

    +

    UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn’t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application

    +

    This example from python wiki covers a sample UDP client and server where “Hello World” is an application payload sent to server listening on port number 5005. The server receives the packet and prints the “Hello World” string from the client

    +

    Applications in SRE role

    +
      +
    1. If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network
      2. +
    2. Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can’t queue due to the buffer being full. Since UDP doesn’t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.
      3. +
    +
    + +
    +
    +

    Documentation built with MkDocs.

    +
    + + + + + + + + diff --git a/python_web/intro/index.html b/python_web/intro/index.html index 06695a9..4621cf1 100644 --- a/python_web/intro/index.html +++ b/python_web/intro/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • @@ -179,7 +208,7 @@
  • -
    • diff --git a/python_web/python-concepts/index.html b/python_web/python-concepts/index.html index 159d5cb..f84f00b 100644 --- a/python_web/python-concepts/index.html +++ b/python_web/python-concepts/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/python_web/python-web-flask/index.html b/python_web/python-web-flask/index.html index 44683e8..e61b4d1 100644 --- a/python_web/python-web-flask/index.html +++ b/python_web/python-web-flask/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/python_web/sre-conclusion/index.html b/python_web/sre-conclusion/index.html index e82a518..1dca692 100644 --- a/python_web/sre-conclusion/index.html +++ b/python_web/sre-conclusion/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/python_web/url-shorten-app/index.html b/python_web/url-shorten-app/index.html index b12df6b..303682d 100644 --- a/python_web/url-shorten-app/index.html +++ b/python_web/url-shorten-app/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/search/search_index.json b/search/search_index.json index 7b39438..9f3a36c 100644 --- a/search/search_index.json +++ b/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en"],"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"Hello, World!!!","title":"Home"},{"location":"big_data/architecture/","text":"Architecture of Hadoop HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project. 1. NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. 2. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and write requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. 3. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: 1. Client: It submits map-reduce jobs to the resource manager. 2. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: 3. Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. 4. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. 5. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep-up with the Node Manager. It monitors resource usage, performs log management and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it on the request of the Application master. 6. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status and monitoring progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. 7. Container: It is a collection of physical resources such as RAM, CPU cores and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies etc. MapReduce framework 1. The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key value pairs. Reduce job takes the output of the Map job i.e. the key value pairs and aggregates them to produce desired results. 2. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. 3. Please find the below Word count example demonstrating the usage of MapReduce framework: Other tooling around hadoop Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5; Data Serialisation and storage In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Architecture of Hadoop"},{"location":"big_data/architecture/#architecture-of-hadoop","text":"HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project. 1. NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. 2. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and write requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. 3. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: 1. Client: It submits map-reduce jobs to the resource manager. 2. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: 3. Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. 4. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. 5. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep-up with the Node Manager. It monitors resource usage, performs log management and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it on the request of the Application master. 6. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status and monitoring progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. 7. Container: It is a collection of physical resources such as RAM, CPU cores and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies etc.","title":"Architecture of Hadoop"},{"location":"big_data/architecture/#mapreduce-framework","text":"1. The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key value pairs. Reduce job takes the output of the Map job i.e. the key value pairs and aggregates them to produce desired results. 2. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. 3. Please find the below Word count example demonstrating the usage of MapReduce framework:","title":"MapReduce framework"},{"location":"big_data/architecture/#other-tooling-around-hadoop","text":"Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5;","title":"Other tooling around hadoop"},{"location":"big_data/architecture/#data-serialisation-and-storage","text":"In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Data Serialisation and storage"},{"location":"big_data/evolution/","text":"Evolution of Hadoop","title":"Evolution of Hadoop"},{"location":"big_data/evolution/#evolution-of-hadoop","text":"","title":"Evolution of Hadoop"},{"location":"big_data/intro/","text":"School of SRE: Big Data Pre - Reads Basics of Linux File systems. Basic understanding of System Design. Target Audience The concept of Big Data has been around for years; most organizations now understand that if they capture all the data that streams into their businesses, they can apply analytics and get significant value from it. This training material covers the basics of Big Data(using Hadoop) for beginners, who would like to quickly get started and get their hands dirty in this domain. What to expect from this training This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it. What is not covered under this training Writing programs to draw analytics from data. TOC: Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"Intro"},{"location":"big_data/intro/#school-of-sre-big-data","text":"","title":"School of SRE: Big Data"},{"location":"big_data/intro/#pre-reads","text":"Basics of Linux File systems. Basic understanding of System Design.","title":"Pre - Reads"},{"location":"big_data/intro/#target-audience","text":"The concept of Big Data has been around for years; most organizations now understand that if they capture all the data that streams into their businesses, they can apply analytics and get significant value from it. This training material covers the basics of Big Data(using Hadoop) for beginners, who would like to quickly get started and get their hands dirty in this domain.","title":"Target Audience"},{"location":"big_data/intro/#what-to-expect-from-this-training","text":"This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it.","title":"What to expect from this training"},{"location":"big_data/intro/#what-is-not-covered-under-this-training","text":"Writing programs to draw analytics from data.","title":"What is not covered under this training"},{"location":"big_data/intro/#toc","text":"Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"TOC:"},{"location":"big_data/overview/","text":"Overview of Big Data Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/overview/#overview-of-big-data","text":"Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/tasks/","text":"Tasks and conclusion Post training tasks: Try setting up your own 3 node hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here References: Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"Tasks and conclusion"},{"location":"big_data/tasks/#tasks-and-conclusion","text":"","title":"Tasks and conclusion"},{"location":"big_data/tasks/#post-training-tasks","text":"Try setting up your own 3 node hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here","title":"Post training tasks:"},{"location":"big_data/tasks/#references","text":"Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"References:"},{"location":"big_data/usage/","text":"Usage of Big Data techniques Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IOT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October, 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data techniques"},{"location":"big_data/usage/#usage-of-big-data-techniques","text":"Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IOT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October, 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data techniques"},{"location":"git/branches/","text":"Working With Branches Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with contents snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo I am a file in b1 branch b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding b1 file [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD - b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo new file in master branch master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding master.txt file [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are checkout on master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo. Merges Now say the feature you were working on branch b1 is complete. And you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you will pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. And there could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit which will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD - master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the fast-forward message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Working With Branches"},{"location":"git/branches/#working-with-branches","text":"Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with contents snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo I am a file in b1 branch b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding b1 file [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD - b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo new file in master branch master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding master.txt file [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are checkout on master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo.","title":"Working With Branches"},{"location":"git/branches/#merges","text":"Now say the feature you were working on branch b1 is complete. And you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you will pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. And there could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit which will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD - master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the fast-forward message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Merges"},{"location":"git/git-basics/","text":"School Of SRE: Git Pre - Reads Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs What to expect from this training As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently! What is not covered under this training Advanced usage and specifics of internal implementation details of Git. Training Content Table of Contents Git Basics Working with Branches Git with Github Hooks Git Basics Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains history of the changes happened with the codebase. Creating a Git Repo Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository. Tracking a File Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo I am file 1 file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use git add file ... to include in what will be committed) file1.txt nothing added to commit but untracked files present (use git add to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use git rm --cached file ... to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 1 [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be commited: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m . More About a Commit Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored. In an efficient manner. Adding More Changes Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo I am file 2 file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 2 [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a === 7f3b00e Are commits really linked? As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at content of the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel spatel1@linkedin.com 1603273316 -0700 committer Sanket Patel spatel1@linkedin.com 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder. The Version Control part of Git We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b new-branch-name HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked. Reference I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well. References and The Magic Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points. Little Adventure We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD - master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, isn't it?","title":"Git Basics"},{"location":"git/git-basics/#school-of-sre-git","text":"","title":"School Of SRE: Git"},{"location":"git/git-basics/#pre-reads","text":"Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs","title":"Pre - Reads"},{"location":"git/git-basics/#what-to-expect-from-this-training","text":"As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently!","title":"What to expect from this training"},{"location":"git/git-basics/#what-is-not-covered-under-this-training","text":"Advanced usage and specifics of internal implementation details of Git.","title":"What is not covered under this training"},{"location":"git/git-basics/#training-content","text":"","title":"Training Content"},{"location":"git/git-basics/#table-of-contents","text":"Git Basics Working with Branches Git with Github Hooks","title":"Table of Contents"},{"location":"git/git-basics/#git-basics","text":"Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains history of the changes happened with the codebase.","title":"Git Basics"},{"location":"git/git-basics/#creating-a-git-repo","text":"Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository.","title":"Creating a Git Repo"},{"location":"git/git-basics/#tracking-a-file","text":"Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo I am file 1 file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use git add file ... to include in what will be committed) file1.txt nothing added to commit but untracked files present (use git add to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use git rm --cached file ... to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 1 [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be commited: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m .","title":"Tracking a File"},{"location":"git/git-basics/#more-about-a-commit","text":"Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored. In an efficient manner.","title":"More About a Commit"},{"location":"git/git-basics/#adding-more-changes","text":"Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo I am file 2 file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 2 [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a === 7f3b00e","title":"Adding More Changes"},{"location":"git/git-basics/#are-commits-really-linked","text":"As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at content of the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel spatel1@linkedin.com 1603273316 -0700 committer Sanket Patel spatel1@linkedin.com 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder.","title":"Are commits really linked?"},{"location":"git/git-basics/#the-version-control-part-of-git","text":"We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b new-branch-name HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked.","title":"The Version Control part of Git"},{"location":"git/git-basics/#reference","text":"I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well.","title":"Reference"},{"location":"git/git-basics/#references-and-the-magic","text":"Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points.","title":"References and The Magic"},{"location":"git/git-basics/#little-adventure","text":"We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD - master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, isn't it?","title":"Little Adventure"},{"location":"git/github-hooks/","text":"Git with Github Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook Hooks Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. Ie: if you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo echo this is from pre commit hook .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo sample file sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding sample file this is from pre commit hook # ===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt What next from here? There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"Github and Hooks"},{"location":"git/github-hooks/#git-with-github","text":"Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook","title":"Git with Github"},{"location":"git/github-hooks/#hooks","text":"Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. Ie: if you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo echo this is from pre commit hook .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo sample file sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding sample file this is from pre commit hook # ===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Hooks"},{"location":"git/github-hooks/#what-next-from-here","text":"There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"What next from here?"},{"location":"python_web/intro/","text":"School of SRE: Python and The Web Pre - Reads Basic understanding of python language. Basic familiarity with flask framework. What to expect from this training This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service. What is not covered under this training Extensive knowledge of python internals and advanced python. Training Content Lab Environment Setup Have latest version of python installed TOC The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App The Python Language Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference? Compiled vs. Interpreted This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo print('hello world') hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode. Running The Programs We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------- + +------------------- +line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------- + +------------------- + | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Intro"},{"location":"python_web/intro/#school-of-sre-python-and-the-web","text":"","title":"School of SRE: Python and The Web"},{"location":"python_web/intro/#pre-reads","text":"Basic understanding of python language. Basic familiarity with flask framework.","title":"Pre - Reads"},{"location":"python_web/intro/#what-to-expect-from-this-training","text":"This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service.","title":"What to expect from this training"},{"location":"python_web/intro/#what-is-not-covered-under-this-training","text":"Extensive knowledge of python internals and advanced python.","title":"What is not covered under this training"},{"location":"python_web/intro/#training-content","text":"","title":"Training Content"},{"location":"python_web/intro/#lab-environment-setup","text":"Have latest version of python installed","title":"Lab Environment Setup"},{"location":"python_web/intro/#toc","text":"The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App","title":"TOC"},{"location":"python_web/intro/#the-python-language","text":"Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference?","title":"The Python Language"},{"location":"python_web/intro/#compiled-vs-interpreted","text":"This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo print('hello world') hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode.","title":"Compiled vs. Interpreted"},{"location":"python_web/intro/#running-the-programs","text":"We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------- + +------------------- +line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------- + +------------------- + | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Running The Programs"},{"location":"python_web/python-concepts/","text":"Some Python Concepts Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. float_number=42.0 def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'float_number': 42.0, 'foo_func': function foo_func at 0x1055847a0 } Python Functions Since functions too are objects, we can see what all attributes a function contains as following def hello(name): ... print(f Hello, {name}! ) ... dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones globals This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 } # adding new global variable GLOBAL= g_val hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 , 'GLOBAL': 'g_val'} code This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter hello.__code__.co_filename ' stdin ' # number of arguments the function takes hello.__code__.co_argcount 1 # local variable names hello.__code__.co_varnames ('name',) # the function code's compiled bytecode hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by dir(hello.__code__) Decorators Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: def deco(func): ... def inner(): ... print( before ) ... func() ... print( after ) ... return inner ... @deco ... def hello_world(): ... print( hello world ) ... hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing def hello_world(): ... print( hello world ) ... hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) hello_world +--------------------+ + |print( hello_world )| | | | +-------------- | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print( before ) | |call function object with id 100 | |print( after ) | | | +---------------------------^-----+ | | AFTER | | | hello_world +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function. Some Gotchas While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#some-python-concepts","text":"Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. float_number=42.0 def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'float_number': 42.0, 'foo_func': function foo_func at 0x1055847a0 }","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#python-functions","text":"Since functions too are objects, we can see what all attributes a function contains as following def hello(name): ... print(f Hello, {name}! ) ... dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones","title":"Python Functions"},{"location":"python_web/python-concepts/#globals","text":"This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 } # adding new global variable GLOBAL= g_val hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 , 'GLOBAL': 'g_val'}","title":"globals"},{"location":"python_web/python-concepts/#code","text":"This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter hello.__code__.co_filename ' stdin ' # number of arguments the function takes hello.__code__.co_argcount 1 # local variable names hello.__code__.co_varnames ('name',) # the function code's compiled bytecode hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by dir(hello.__code__)","title":"code"},{"location":"python_web/python-concepts/#decorators","text":"Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: def deco(func): ... def inner(): ... print( before ) ... func() ... print( after ) ... return inner ... @deco ... def hello_world(): ... print( hello world ) ... hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing def hello_world(): ... print( hello world ) ... hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) hello_world +--------------------+ + |print( hello_world )| | | | +-------------- | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print( before ) | |call function object with id 100 | |print( after ) | | | +---------------------------^-----+ | | AFTER | | | hello_world +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function.","title":"Decorators"},{"location":"python_web/python-concepts/#some-gotchas","text":"While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Gotchas"},{"location":"python_web/python-web-flask/","text":"Python, Web amd Flask Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response. Sockets Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it. Flask Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#python-web-amd-flask","text":"Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response.","title":"Python, Web amd Flask"},{"location":"python_web/python-web-flask/#sockets","text":"Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it.","title":"Sockets"},{"location":"python_web/python-web-flask/#flask","text":"Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Flask"},{"location":"python_web/sre-conclusion/","text":"SRE Parts of The App and Conclusion Scaling The App The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable. Monitoring Strategy Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected. SRE Use-cases In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios. Optional Exercises Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets. Conclusion This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"SRE Aspects of The App and Conclusion"},{"location":"python_web/sre-conclusion/#sre-parts-of-the-app-and-conclusion","text":"","title":"SRE Parts of The App and Conclusion"},{"location":"python_web/sre-conclusion/#scaling-the-app","text":"The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable.","title":"Scaling The App"},{"location":"python_web/sre-conclusion/#monitoring-strategy","text":"Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected.","title":"Monitoring Strategy"},{"location":"python_web/sre-conclusion/#sre-use-cases","text":"In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios.","title":"SRE Use-cases"},{"location":"python_web/sre-conclusion/#optional-exercises","text":"Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets.","title":"Optional Exercises"},{"location":"python_web/sre-conclusion/#conclusion","text":"This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/url-shorten-app/","text":"The URL Shortening App Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well. Design We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design. 1. High Level Operations and API Endpoints Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone. 2. How to shorten? Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most. 3. Is URL Valid? Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down? 4. Storage Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision. 5. Other We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask( url_shortener ) mapping = {} @app.route( /shorten , methods=[ POST ]) def shorten(): global mapping payload = request.json if url not in payload: return Missing URL Parameter , 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[ url ].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[ url ] return f Shortened: r/{digest}\\n else: # TODO: check for hash collission return f Already exists: r/{digest}\\n @app.route( /r/ hash_ ) def redirect_(hash_): if hash_ not in mapping: return URL Not Found , 404 return redirect(mapping[hash_]) if __name__ == __main__ : app.run(debug=True) OUTPUT: === SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H content-type: application/json --data '{ url : https://linkedin.com }' Shortened: r/a62a4 === REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) GET /r/a62a4 HTTP/1.1 Host: localhost:5000 User-Agent: curl/7.64.1 Accept: */* * HTTP 1.0, assume close after body HTTP/1.0 302 FOUND Content-Type: text/html; charset=utf-8 Content-Length: 247 Location: https://linkedin.com Server: Werkzeug/0.15.4 Python/3.7.7 Date: Tue, 27 Oct 2020 09:37:12 GMT !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 3.2 Final//EN title Redirecting... /title h1 Redirecting... /h1 * Closing connection 0 p You should be redirected automatically to target URL: a href= https://linkedin.com https://linkedin.com /a . If not click the link.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#the-url-shortening-app","text":"Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#design","text":"We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design.","title":"Design"},{"location":"python_web/url-shorten-app/#1-high-level-operations-and-api-endpoints","text":"Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone.","title":"1. High Level Operations and API Endpoints"},{"location":"python_web/url-shorten-app/#2-how-to-shorten","text":"Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most.","title":"2. How to shorten?"},{"location":"python_web/url-shorten-app/#3-is-url-valid","text":"Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down?","title":"3. Is URL Valid?"},{"location":"python_web/url-shorten-app/#4-storage","text":"Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision.","title":"4. Storage"},{"location":"python_web/url-shorten-app/#5-other","text":"We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask( url_shortener ) mapping = {} @app.route( /shorten , methods=[ POST ]) def shorten(): global mapping payload = request.json if url not in payload: return Missing URL Parameter , 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[ url ].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[ url ] return f Shortened: r/{digest}\\n else: # TODO: check for hash collission return f Already exists: r/{digest}\\n @app.route( /r/ hash_ ) def redirect_(hash_): if hash_ not in mapping: return URL Not Found , 404 return redirect(mapping[hash_]) if __name__ == __main__ : app.run(debug=True) OUTPUT: === SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H content-type: application/json --data '{ url : https://linkedin.com }' Shortened: r/a62a4 === REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) GET /r/a62a4 HTTP/1.1 Host: localhost:5000 User-Agent: curl/7.64.1 Accept: */* * HTTP 1.0, assume close after body HTTP/1.0 302 FOUND Content-Type: text/html; charset=utf-8 Content-Length: 247 Location: https://linkedin.com Server: Werkzeug/0.15.4 Python/3.7.7 Date: Tue, 27 Oct 2020 09:37:12 GMT !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 3.2 Final//EN title Redirecting... /title h1 Redirecting... /h1 * Closing connection 0 p You should be redirected automatically to target URL: a href= https://linkedin.com https://linkedin.com /a . If not click the link.","title":"5. Other"},{"location":"security/fundamentals/","text":"Part I: Fundamentals Introduction to Security Overview for SRE If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design hence are quite sometimes the first line of defense. SRE\u2019s help in preventing bad design implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim for secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password aging and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IOT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defense in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in-depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users, and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defense in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, it is likely that the security issue is widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability Security Reliability and security are both crucial components of a truly trustworthy system,but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery was later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks , which works as an authentication the HSM token supposedly locked inside a case.. the problem can be further elongated ) designed to increase the security of the system. Authentication vs Authorization Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources. Common authentication flow (local authentication) The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources OpenID/OAuth OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system. Cryptography It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon. Ciphers Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m), and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: This also means that in order for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. sIf the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer : https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Deffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains a number of attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html Login Security SSH SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunneling to encrypt other TCP/IP-based sessions Kerberos According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol, and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric key cryptography and requires trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client : A user/ a service a server : Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT). Certificate Chain The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and figure below summarizes its behavior at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate. TLS Handshake The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre master key with the Diffie-Hellman algorithm. The pre master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used. \u201cPerfect\u201d Forward Secrecy The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If, at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"Fundamentals of Security"},{"location":"security/fundamentals/#part-i-fundamentals","text":"","title":"Part I: Fundamentals"},{"location":"security/fundamentals/#introduction-to-security-overview-for-sre","text":"If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design hence are quite sometimes the first line of defense. SRE\u2019s help in preventing bad design implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim for secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password aging and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IOT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defense in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in-depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users, and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defense in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, it is likely that the security issue is widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability Security Reliability and security are both crucial components of a truly trustworthy system,but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery was later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks , which works as an authentication the HSM token supposedly locked inside a case.. the problem can be further elongated ) designed to increase the security of the system.","title":"Introduction to Security Overview for SRE"},{"location":"security/fundamentals/#authentication-vs-authorization","text":"Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources.","title":"Authentication vs Authorization"},{"location":"security/fundamentals/#common-authentication-flow-local-authentication","text":"The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources","title":"Common authentication flow (local authentication)"},{"location":"security/fundamentals/#openidoauth","text":"OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system.","title":"OpenID/OAuth"},{"location":"security/fundamentals/#cryptography","text":"It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon.","title":"Cryptography"},{"location":"security/fundamentals/#ciphers","text":"Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m), and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: This also means that in order for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. sIf the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer : https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Deffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains a number of attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html","title":"Ciphers"},{"location":"security/fundamentals/#login-security","text":"","title":"Login Security"},{"location":"security/fundamentals/#ssh","text":"SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunneling to encrypt other TCP/IP-based sessions","title":"SSH"},{"location":"security/fundamentals/#kerberos","text":"According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol, and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric key cryptography and requires trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client : A user/ a service a server : Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT).","title":"Kerberos"},{"location":"security/fundamentals/#certificate-chain","text":"The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and figure below summarizes its behavior at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate.","title":"Certificate Chain"},{"location":"security/fundamentals/#tls-handshake","text":"The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre master key with the Diffie-Hellman algorithm. The pre master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used.","title":"TLS Handshake"},{"location":"security/fundamentals/#perfect-forward-secrecy","text":"The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If, at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"\u201cPerfect\u201d Forward Secrecy"},{"location":"security/intro/","text":"Security Fundamental classroom courseware for people getting started with SRE developing an understanding of the need for security in day to day operations Target Audience The material is suitable for new SRE hires or graduate computer science majors straight out of college, anyone who has a basic technical background, or readers who have a basic understanding of IT security and want to expand their knowledge. The approach being covered here deals with the fundamentals of computer security in the modern IT landscape moreover it sheds light on most of the dangerous \"things\" out there on public internet which are potentially a gateway to compromising systems. As an SRE, you are expected to design, build and develop products, this course will give you that \u2018security knob\u2019 into your thinking and problem-solving approach which is expected to be turned on as a critical area that always takes precedence over anything else. Pre Requirements Basics of Linux fundamentals command line usage Networking Module What to expect from this training The course covers fundamentals of information security along with touching on subjects of system security, network web security. The aim of this course is to get familiar with the basics of information security in day to day operations then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured. What is not covered under this training The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised. Training Content Part I: Fundamentals Part II: Network Security Part III: Threats, Attacks Defense PART IV: Writing Secure Code More Post Training asks/ Further Reading CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Inro"},{"location":"security/intro/#security","text":"","title":"Security"},{"location":"security/intro/#fundamental-classroom-courseware-for-people-getting-started-with-sre-developing-an-understanding-of-the-need-for-security-in-day-to-day-operations","text":"","title":"Fundamental classroom courseware for people getting started with SRE & developing an understanding of the need for security in day to day operations"},{"location":"security/intro/#target-audience","text":"The material is suitable for new SRE hires or graduate computer science majors straight out of college, anyone who has a basic technical background, or readers who have a basic understanding of IT security and want to expand their knowledge. The approach being covered here deals with the fundamentals of computer security in the modern IT landscape moreover it sheds light on most of the dangerous \"things\" out there on public internet which are potentially a gateway to compromising systems. As an SRE, you are expected to design, build and develop products, this course will give you that \u2018security knob\u2019 into your thinking and problem-solving approach which is expected to be turned on as a critical area that always takes precedence over anything else.","title":"Target Audience"},{"location":"security/intro/#pre-requirements","text":"Basics of Linux fundamentals command line usage Networking Module","title":"Pre Requirements"},{"location":"security/intro/#what-to-expect-from-this-training","text":"The course covers fundamentals of information security along with touching on subjects of system security, network web security. The aim of this course is to get familiar with the basics of information security in day to day operations then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured.","title":"What to expect from this training"},{"location":"security/intro/#what-is-not-covered-under-this-training","text":"The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised.","title":"What is not covered under this training"},{"location":"security/intro/#training-content","text":"Part I: Fundamentals Part II: Network Security Part III: Threats, Attacks Defense PART IV: Writing Secure Code More","title":"Training Content"},{"location":"security/intro/#post-training-asks-further-reading","text":"CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Post Training asks/ Further Reading"},{"location":"security/network_security/","text":"Part II : Network Security Introduction TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relation between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed to a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission. Public Key Infrastructure To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. In order to use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE IPsec: A Security Protocol at the Network Layer IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE). PGP S/MIME : Email Security There are a number of security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his own inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate this limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape\u2019s intent was to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. In an effort to standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/ Network Perimeter Security Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection General Firewall Framework Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. On the basis of the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter. Packet Filters It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established. Circuit Gateways Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF). Application Gateways(ALG) Aka PROXY Servers An Application Level Gateway (ALG) acts like a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads. Trusted Systems Bastion Hosts A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on a number of elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defense mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are absolutely necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely. Common Techniques Scannings, Packet Capturing Scanning Ports with Nmap Nmap (\"Network Mapper\") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if its open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan. Types of Nmap Scan: TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if there are any UDP ports listening. Since UDP does not respond with a positive acknowledgment like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it really only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca OpenVAS OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and a SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/ WireShark Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN. DumpCap Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods of time. DaemonLogger Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted. NetSniff-NG Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. In order to begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap Netflow NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis. IDS A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT SURICATA Policy Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host Based IDS Network Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviors is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs. Chinks In The Armour (TCP/IP Security Issues) IP Spoofing In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compare TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compare IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot therefore be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed. Covert Channel A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behavior. The alteration of ICMP packets gives intruders the opportunity to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunneling. Check for echo responses that do not contain the same payload as request Check for volume of ICMP traffic specially for volumes beyond an acceptable threshold IP Fragmentation Attack The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been successfully completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. The attacker's ultimate goal is to write special programs or pieces of code that are able to construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the web server of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the web server. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the web server refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers. Connection Hijacking An authorized user (Employee X) sends HTTP requests over a TCP session with the web server. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the web server to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the web server. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the web server replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the web server. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session. Buffer Overflow A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that are able to store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack. More Spoofing Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"Network Securuty"},{"location":"security/network_security/#part-ii-network-security","text":"","title":"Part II : Network Security"},{"location":"security/network_security/#introduction","text":"TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relation between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed to a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission.","title":"Introduction"},{"location":"security/network_security/#public-key-infrastructure","text":"To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. In order to use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE","title":"Public Key Infrastructure"},{"location":"security/network_security/#ipsec-a-security-protocol-at-the-network-layer","text":"IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE).","title":"IPsec: A Security Protocol at the Network Layer"},{"location":"security/network_security/#pgp-smime-email-security","text":"There are a number of security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his own inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate this limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape\u2019s intent was to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. In an effort to standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/","title":"PGP & S/MIME : Email Security"},{"location":"security/network_security/#network-perimeter-security","text":"Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection","title":"Network Perimeter Security"},{"location":"security/network_security/#general-firewall-framework","text":"Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. On the basis of the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter.","title":"General Firewall Framework"},{"location":"security/network_security/#packet-filters","text":"It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established.","title":"Packet Filters"},{"location":"security/network_security/#circuit-gateways","text":"Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF).","title":"Circuit Gateways"},{"location":"security/network_security/#application-gatewaysalg","text":"Aka PROXY Servers An Application Level Gateway (ALG) acts like a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads.","title":"Application Gateways(ALG)"},{"location":"security/network_security/#trusted-systems-bastion-hosts","text":"A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on a number of elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defense mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are absolutely necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely.","title":"Trusted Systems & Bastion Hosts"},{"location":"security/network_security/#common-techniques-scannings-packet-capturing","text":"","title":"Common Techniques & Scannings, Packet Capturing"},{"location":"security/network_security/#scanning-ports-with-nmap","text":"Nmap (\"Network Mapper\") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if its open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan.","title":"Scanning Ports with Nmap"},{"location":"security/network_security/#types-of-nmap-scan","text":"TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if there are any UDP ports listening. Since UDP does not respond with a positive acknowledgment like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it really only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca","title":"Types of Nmap Scan:"},{"location":"security/network_security/#openvas","text":"OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and a SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/","title":"OpenVAS"},{"location":"security/network_security/#wireshark","text":"Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN.","title":"WireShark"},{"location":"security/network_security/#dumpcap","text":"Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods of time.","title":"DumpCap"},{"location":"security/network_security/#daemonlogger","text":"Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted.","title":"DaemonLogger"},{"location":"security/network_security/#netsniff-ng","text":"Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. In order to begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap","title":"NetSniff-NG"},{"location":"security/network_security/#netflow","text":"NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis.","title":"Netflow"},{"location":"security/network_security/#ids","text":"A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT SURICATA Policy Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host Based IDS Network Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviors is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs.","title":"IDS"},{"location":"security/network_security/#chinks-in-the-armour-tcpip-security-issues","text":"","title":"Chinks In The Armour (TCP/IP Security Issues)"},{"location":"security/network_security/#ip-spoofing","text":"In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compare TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compare IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot therefore be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed.","title":"IP Spoofing"},{"location":"security/network_security/#covert-channel","text":"A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behavior. The alteration of ICMP packets gives intruders the opportunity to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunneling. Check for echo responses that do not contain the same payload as request Check for volume of ICMP traffic specially for volumes beyond an acceptable threshold","title":"Covert Channel"},{"location":"security/network_security/#ip-fragmentation-attack","text":"The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been successfully completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. The attacker's ultimate goal is to write special programs or pieces of code that are able to construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the web server of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the web server. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the web server refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers.","title":"IP Fragmentation Attack"},{"location":"security/network_security/#connection-hijacking","text":"An authorized user (Employee X) sends HTTP requests over a TCP session with the web server. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the web server to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the web server. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the web server replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the web server. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session.","title":"Connection Hijacking"},{"location":"security/network_security/#buffer-overflow","text":"A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that are able to store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack.","title":"Buffer Overflow"},{"location":"security/network_security/#more-spoofing","text":"Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"More Spoofing"},{"location":"security/threats_attacks_defences/","text":"Part III: Threats, Attacks Defense DNS Protection Cache Poisoning Attack Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelled words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack. DNSSEC (Security Extension) The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in a response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption, and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection. BGP BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous system is a collection of routers or networks with the same network policy usually under a single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior). How BGP Works BGP is responsible for finding a path to a destination router the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link state protocol each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next hop routing table is based on this topology view. The link state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbors. The shortest path is then taken We then re-look at all our neighbors that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited. BGP Vulnerabilities By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are best defence against many common viral attacks where the traffic is dropped from infected machines to/from command control masters. Infamous BGP Injection attack on Youtube - EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. - Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. - Refer : https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb - Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers, since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication, since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators, when a neighbor sends in excess of a preset number of prefixes. IETF is currently working on improving this space Web Based Attacks HTTP Response Splitting Attacks HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the web server to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response. Cross-Site Request Forgery (CSRF or XSRF) A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks Cross-Site Scripting (XSS) Attacks Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application. Document Object Model (DOM) XSS Attacks The Document Object Model (DOM) based XSS does not require the web server to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser. Clickjacking The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see, is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defense against clickjacking, and disabling JavaScript is the only viable method DataBase Attacks Defenses SQL injection Attacks It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SQL Injection Attack Defenses SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits. VPN A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based Security Breach In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach. Denial of Service Attacks Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defenses against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack. Distributed Denial of Service Attacks DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers. Wiretapping Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host. Backdoors Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls. Malicious Attacks Birthday Attack Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/ Brute-Force Password Attacks In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks Dictionary Password Attacks A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html Replay Attacks Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html Man-in-the-Middle Attacks A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the web server. The attacker then establishes a secure connection with the web server, acting as an invisible go-between. The attacker passes traffic between the user and the web server. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack Masquerading In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228 Eavesdropping Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(ofcourse given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods. Social Engineering Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful. Phreaking Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system. Phishing Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers. Pharming Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Threat, Attacks & Defences"},{"location":"security/threats_attacks_defences/#part-iii-threats-attacks-defense","text":"","title":"Part III: Threats, Attacks & Defense"},{"location":"security/threats_attacks_defences/#dns-protection","text":"","title":"DNS Protection"},{"location":"security/threats_attacks_defences/#cache-poisoning-attack","text":"Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelled words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack.","title":"Cache Poisoning Attack"},{"location":"security/threats_attacks_defences/#dnssec-security-extension","text":"The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in a response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption, and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection.","title":"DNSSEC (Security Extension)"},{"location":"security/threats_attacks_defences/#bgp","text":"BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous system is a collection of routers or networks with the same network policy usually under a single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior).","title":"BGP"},{"location":"security/threats_attacks_defences/#how-bgp-works","text":"BGP is responsible for finding a path to a destination router the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link state protocol each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next hop routing table is based on this topology view. The link state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbors. The shortest path is then taken We then re-look at all our neighbors that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited.","title":"How BGP Works"},{"location":"security/threats_attacks_defences/#bgp-vulnerabilities","text":"By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are best defence against many common viral attacks where the traffic is dropped from infected machines to/from command control masters. Infamous BGP Injection attack on Youtube - EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. - Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. - Refer : https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb - Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers, since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication, since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators, when a neighbor sends in excess of a preset number of prefixes. IETF is currently working on improving this space","title":"BGP Vulnerabilities"},{"location":"security/threats_attacks_defences/#web-based-attacks","text":"","title":"Web Based Attacks"},{"location":"security/threats_attacks_defences/#http-response-splitting-attacks","text":"HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the web server to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response.","title":"HTTP Response Splitting Attacks"},{"location":"security/threats_attacks_defences/#cross-site-request-forgery-csrf-or-xsrf","text":"A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks","title":"Cross-Site Request Forgery (CSRF or XSRF)"},{"location":"security/threats_attacks_defences/#cross-site-scripting-xss-attacks","text":"Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application.","title":"Cross-Site Scripting (XSS) Attacks"},{"location":"security/threats_attacks_defences/#document-object-model-dom-xss-attacks","text":"The Document Object Model (DOM) based XSS does not require the web server to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser.","title":"Document Object Model (DOM) XSS Attacks"},{"location":"security/threats_attacks_defences/#clickjacking","text":"The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see, is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defense against clickjacking, and disabling JavaScript is the only viable method","title":"Clickjacking"},{"location":"security/threats_attacks_defences/#database-attacks-defenses","text":"","title":"DataBase Attacks & Defenses"},{"location":"security/threats_attacks_defences/#sql-injection-attacks","text":"It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers","title":"SQL injection Attacks"},{"location":"security/threats_attacks_defences/#sql-injection-attack-defenses","text":"SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits.","title":"SQL Injection Attack Defenses"},{"location":"security/threats_attacks_defences/#vpn","text":"A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based","title":"VPN"},{"location":"security/threats_attacks_defences/#security-breach","text":"In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach.","title":"Security Breach"},{"location":"security/threats_attacks_defences/#denial-of-service-attacks","text":"Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defenses against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack.","title":"Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#distributed-denial-of-service-attacks","text":"DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers.","title":"Distributed Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#wiretapping","text":"Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host.","title":"Wiretapping"},{"location":"security/threats_attacks_defences/#backdoors","text":"Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls.","title":"Backdoors"},{"location":"security/threats_attacks_defences/#malicious-attacks","text":"","title":"Malicious Attacks"},{"location":"security/threats_attacks_defences/#birthday-attack","text":"Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/","title":"Birthday Attack"},{"location":"security/threats_attacks_defences/#brute-force-password-attacks","text":"In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks","title":"Brute-Force Password Attacks"},{"location":"security/threats_attacks_defences/#dictionary-password-attacks","text":"A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html","title":"Dictionary Password Attacks"},{"location":"security/threats_attacks_defences/#replay-attacks","text":"Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html","title":"Replay Attacks"},{"location":"security/threats_attacks_defences/#man-in-the-middle-attacks","text":"A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the web server. The attacker then establishes a secure connection with the web server, acting as an invisible go-between. The attacker passes traffic between the user and the web server. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack","title":"Man-in-the-Middle Attacks"},{"location":"security/threats_attacks_defences/#masquerading","text":"In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228","title":"Masquerading"},{"location":"security/threats_attacks_defences/#eavesdropping","text":"Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(ofcourse given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods.","title":"Eavesdropping"},{"location":"security/threats_attacks_defences/#social-engineering","text":"Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful.","title":"Social Engineering"},{"location":"security/threats_attacks_defences/#phreaking","text":"Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system.","title":"Phreaking"},{"location":"security/threats_attacks_defences/#phishing","text":"Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers.","title":"Phishing"},{"location":"security/threats_attacks_defences/#pharming","text":"Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Pharming"},{"location":"security/writing_secure_code/","text":"PART IV: Writing Secure Code More The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software. Use frameworks to enforce security and reliability while writing code A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better. Common Security Vulnerabilities In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes Write Simple Code Try to keep your code clean and simple. Avoid Multi Level Nesting Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error). Eliminate YAGNI Smells Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code. Repay Technical Debt It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt. Refactoring Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs. Unit Testing Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit. Fuzz Testing Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzz engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example file parsers, compression algo, network protocol implementation and audio codec. Integration Testing Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected. Last But not the least Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Writing Secure code"},{"location":"security/writing_secure_code/#part-iv-writing-secure-code-more","text":"The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software.","title":"PART IV: Writing Secure Code & More"},{"location":"security/writing_secure_code/#use-frameworks-to-enforce-security-and-reliability-while-writing-code","text":"A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better.","title":"Use frameworks to enforce security and reliability while writing code"},{"location":"security/writing_secure_code/#common-security-vulnerabilities","text":"In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes","title":"Common Security Vulnerabilities"},{"location":"security/writing_secure_code/#write-simple-code","text":"Try to keep your code clean and simple.","title":"Write Simple Code"},{"location":"security/writing_secure_code/#avoid-multi-level-nesting","text":"Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error).","title":"Avoid Multi Level Nesting"},{"location":"security/writing_secure_code/#eliminate-yagni-smells","text":"Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code.","title":"Eliminate YAGNI Smells"},{"location":"security/writing_secure_code/#repay-technical-debt","text":"It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt.","title":"Repay Technical Debt"},{"location":"security/writing_secure_code/#refactoring","text":"Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs.","title":"Refactoring"},{"location":"security/writing_secure_code/#unit-testing","text":"Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit.","title":"Unit Testing"},{"location":"security/writing_secure_code/#fuzz-testing","text":"Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzz engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example file parsers, compression algo, network protocol implementation and audio codec.","title":"Fuzz Testing"},{"location":"security/writing_secure_code/#integration-testing","text":"Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected.","title":"Integration Testing"},{"location":"security/writing_secure_code/#last-but-not-the-least","text":"Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Last But not the least"},{"location":"systems_design/availability/","text":"HA - Availability - Common \u201cNines\u201d Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms Refer https://en.wikipedia.org/wiki/High_availability#Percentage_calculation HA - Availability Serial Components A System with components is operating in the series If failure of a part leads to the combination becoming inoperable. For example if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026.. Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Availability Parallel Components A System with components is operating in parallel If failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. ) Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Core Principles Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure Refer https://en.wikipedia.org/wiki/High_availability#Principles HA - SPOF WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons. HA - Reliable Crossover WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally DB systems follow active/passive semantics for writes. Masters accept writes and when master goes down, follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one masters. This problem is called a split brain. SRE Use cases SRE works on deciding an acceptable SLA and make sure system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure site is not affected by network switch, hardware, power or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Availability"},{"location":"systems_design/availability/#ha-availability-common-nines","text":"Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms","title":"HA - Availability - Common \u201cNines\u201d"},{"location":"systems_design/availability/#refer","text":"https://en.wikipedia.org/wiki/High_availability#Percentage_calculation","title":"Refer"},{"location":"systems_design/availability/#ha-availability-serial-components","text":"A System with components is operating in the series If failure of a part leads to the combination becoming inoperable. For example if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026..","title":"HA - Availability Serial Components"},{"location":"systems_design/availability/#refer_1","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-availability-parallel-components","text":"A System with components is operating in parallel If failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. )","title":"HA - Availability Parallel Components"},{"location":"systems_design/availability/#refer_2","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-core-principles","text":"Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure","title":"HA - Core Principles"},{"location":"systems_design/availability/#refer_3","text":"https://en.wikipedia.org/wiki/High_availability#Principles","title":"Refer"},{"location":"systems_design/availability/#ha-spof","text":"WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons.","title":"HA - SPOF"},{"location":"systems_design/availability/#ha-reliable-crossover","text":"WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally DB systems follow active/passive semantics for writes. Masters accept writes and when master goes down, follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one masters. This problem is called a split brain.","title":"HA - Reliable Crossover"},{"location":"systems_design/availability/#sre-use-cases","text":"SRE works on deciding an acceptable SLA and make sure system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure site is not affected by network switch, hardware, power or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"SRE Use cases"},{"location":"systems_design/conclusion/","text":"Conclusion Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organisation matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/conclusion/#conclusion","text":"Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organisation matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/fault-tolerance/","text":"Fault Tolerance Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail. Fault Tolerance - Failure Metrics Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time. Refer https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html Fault Tolerance - Fault Isolation Terms Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodology. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in Ads feature gets propagated to Newsfeed feature. Instead if we swimlane \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we come up with a new model for our Content sharing App. Here we roll out enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise. Swimlane Principles Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise usecase) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature) Swimlane Approaches Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them.(if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes.(Public vs Enterprise customers) Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21 SRE Use cases: Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance","text":"Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail.","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance-failure-metrics","text":"Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time.","title":"Fault Tolerance - Failure Metrics"},{"location":"systems_design/fault-tolerance/#refer","text":"https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html","title":"Refer"},{"location":"systems_design/fault-tolerance/#fault-tolerance-fault-isolation-terms","text":"Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodology. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in Ads feature gets propagated to Newsfeed feature. Instead if we swimlane \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we come up with a new model for our Content sharing App. Here we roll out enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise.","title":"Fault Tolerance - Fault Isolation Terms"},{"location":"systems_design/fault-tolerance/#swimlane-principles","text":"Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise usecase) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature)","title":"Swimlane Principles"},{"location":"systems_design/fault-tolerance/#swimlane-approaches","text":"Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them.(if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes.(Public vs Enterprise customers)","title":"Swimlane Approaches"},{"location":"systems_design/fault-tolerance/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21","title":"Refer"},{"location":"systems_design/fault-tolerance/#sre-use-cases","text":"Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"SRE Use cases:"},{"location":"systems_design/intro/","text":"Systems Design Pre - Requisites Fundamentals of common software system components: - Operating Systems - Networking - Databases RDBMS/NoSQL What to expect from this training Thinking about and designing for scalability, availability, and reliability of large scale software systems. What is not covered under this training Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability and reliability of systems Training Content Introduction Scalability High Availability Fault Tolerance Introduction So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design. Backstory Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Intro"},{"location":"systems_design/intro/#systems-design","text":"","title":"Systems Design"},{"location":"systems_design/intro/#pre-requisites","text":"Fundamentals of common software system components: - Operating Systems - Networking - Databases RDBMS/NoSQL","title":"Pre - Requisites"},{"location":"systems_design/intro/#what-to-expect-from-this-training","text":"Thinking about and designing for scalability, availability, and reliability of large scale software systems.","title":"What to expect from this training"},{"location":"systems_design/intro/#what-is-not-covered-under-this-training","text":"Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability and reliability of systems","title":"What is not covered under this training"},{"location":"systems_design/intro/#training-content","text":"Introduction Scalability High Availability Fault Tolerance","title":"Training Content"},{"location":"systems_design/intro/#introduction","text":"So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design.","title":"Introduction"},{"location":"systems_design/intro/#backstory","text":"Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Backstory"},{"location":"systems_design/scalability/","text":"Scalability What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance Refer https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html Scalability - AKF Scale Cube The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. Following section talks about certain scaling patterns based on our inferences from AKF cube Scalability - Horizontal scaling Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Lets see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs which support multi master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Read and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. Cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability Pattern - Load Balancing Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. Commonly used technique is load balancing traffic across identical server clusters. Similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB. Refer https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do Scalability Pattern - LB Tasks What does an LB do? Service discovery: What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers. Health checking: What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime Load balancing: What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern Scalability Pattern - LB Methods Common Load Balancing Methods Least Connection Method directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long lived connections Least Response Time Method directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of server\u2019s health Round Robin Method rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections. IP Hash the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing Scalability Pattern - Caching - Content Delivery Networks (CDN) CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources. Scalability - Microservices This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability - Sharding This pattern represents the separation of work based on attributes that are looked up or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data centre is split and replicated and clients are directed to a data centre based on their geography. This helps in improving performance as clients are directed to the closest Data centre and performance increases as we add more data centres. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html SRE Use cases SREs in coordination with the network team work on how to map users traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure and improve CDN cache hit rate.","title":"Scalability"},{"location":"systems_design/scalability/#scalability","text":"What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance","title":"Scalability"},{"location":"systems_design/scalability/#refer","text":"https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-akf-scale-cube","text":"The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. Following section talks about certain scaling patterns based on our inferences from AKF cube","title":"Scalability - AKF Scale Cube"},{"location":"systems_design/scalability/#scalability-horizontal-scaling","text":"Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Lets see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs which support multi master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Read and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. Cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost","title":"Scalability - Horizontal scaling"},{"location":"systems_design/scalability/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-load-balancing","text":"Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. Commonly used technique is load balancing traffic across identical server clusters. Similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB.","title":"Scalability Pattern - Load Balancing"},{"location":"systems_design/scalability/#refer_2","text":"https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-lb-tasks","text":"What does an LB do?","title":"Scalability Pattern - LB Tasks"},{"location":"systems_design/scalability/#service-discovery","text":"What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers.","title":"Service discovery:"},{"location":"systems_design/scalability/#health-checking","text":"What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime","title":"Health checking:"},{"location":"systems_design/scalability/#load-balancing","text":"What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern","title":"Load balancing:"},{"location":"systems_design/scalability/#scalability-pattern-lb-methods","text":"Common Load Balancing Methods","title":"Scalability Pattern - LB Methods"},{"location":"systems_design/scalability/#least-connection-method","text":"directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long lived connections","title":"Least Connection Method"},{"location":"systems_design/scalability/#least-response-time-method","text":"directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of server\u2019s health","title":"Least Response Time Method"},{"location":"systems_design/scalability/#round-robin-method","text":"rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections.","title":"Round Robin Method"},{"location":"systems_design/scalability/#ip-hash","text":"the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing","title":"IP Hash"},{"location":"systems_design/scalability/#scalability-pattern-caching-content-delivery-networks-cdn","text":"CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources.","title":"Scalability Pattern - Caching - Content Delivery Networks (CDN)"},{"location":"systems_design/scalability/#scalability-microservices","text":"This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement.","title":"Scalability - Microservices"},{"location":"systems_design/scalability/#refer_3","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-sharding","text":"This pattern represents the separation of work based on attributes that are looked up or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data centre is split and replicated and clients are directed to a data centre based on their geography. This helps in improving performance as clients are directed to the closest Data centre and performance increases as we add more data centres. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology.","title":"Scalability - Sharding"},{"location":"systems_design/scalability/#refer_4","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#sre-use-cases","text":"SREs in coordination with the network team work on how to map users traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure and improve CDN cache hit rate.","title":"SRE Use cases"}]} \ No newline at end of file +{"config":{"lang":["en"],"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"Hello, World!!!","title":"Home"},{"location":"big_data/architecture/","text":"Architecture of Hadoop HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project. 1. NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. 2. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and write requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. 3. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: 1. Client: It submits map-reduce jobs to the resource manager. 2. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: 3. Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. 4. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. 5. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep-up with the Node Manager. It monitors resource usage, performs log management and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it on the request of the Application master. 6. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status and monitoring progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. 7. Container: It is a collection of physical resources such as RAM, CPU cores and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies etc. MapReduce framework 1. The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key value pairs. Reduce job takes the output of the Map job i.e. the key value pairs and aggregates them to produce desired results. 2. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. 3. Please find the below Word count example demonstrating the usage of MapReduce framework: Other tooling around hadoop Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5; Data Serialisation and storage In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Architecture of Hadoop"},{"location":"big_data/architecture/#architecture-of-hadoop","text":"HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project. 1. NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. 2. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and write requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. 3. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: 1. Client: It submits map-reduce jobs to the resource manager. 2. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: 3. Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. 4. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. 5. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep-up with the Node Manager. It monitors resource usage, performs log management and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it on the request of the Application master. 6. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status and monitoring progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. 7. Container: It is a collection of physical resources such as RAM, CPU cores and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies etc.","title":"Architecture of Hadoop"},{"location":"big_data/architecture/#mapreduce-framework","text":"1. The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key value pairs. Reduce job takes the output of the Map job i.e. the key value pairs and aggregates them to produce desired results. 2. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. 3. Please find the below Word count example demonstrating the usage of MapReduce framework:","title":"MapReduce framework"},{"location":"big_data/architecture/#other-tooling-around-hadoop","text":"Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5;","title":"Other tooling around hadoop"},{"location":"big_data/architecture/#data-serialisation-and-storage","text":"In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Data Serialisation and storage"},{"location":"big_data/evolution/","text":"Evolution of Hadoop","title":"Evolution of Hadoop"},{"location":"big_data/evolution/#evolution-of-hadoop","text":"","title":"Evolution of Hadoop"},{"location":"big_data/intro/","text":"School of SRE: Big Data Pre - Reads Basics of Linux File systems. Basic understanding of System Design. Target Audience The concept of Big Data has been around for years; most organizations now understand that if they capture all the data that streams into their businesses, they can apply analytics and get significant value from it. This training material covers the basics of Big Data(using Hadoop) for beginners, who would like to quickly get started and get their hands dirty in this domain. What to expect from this training This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it. What is not covered under this training Writing programs to draw analytics from data. TOC: Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"Intro"},{"location":"big_data/intro/#school-of-sre-big-data","text":"","title":"School of SRE: Big Data"},{"location":"big_data/intro/#pre-reads","text":"Basics of Linux File systems. Basic understanding of System Design.","title":"Pre - Reads"},{"location":"big_data/intro/#target-audience","text":"The concept of Big Data has been around for years; most organizations now understand that if they capture all the data that streams into their businesses, they can apply analytics and get significant value from it. This training material covers the basics of Big Data(using Hadoop) for beginners, who would like to quickly get started and get their hands dirty in this domain.","title":"Target Audience"},{"location":"big_data/intro/#what-to-expect-from-this-training","text":"This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it.","title":"What to expect from this training"},{"location":"big_data/intro/#what-is-not-covered-under-this-training","text":"Writing programs to draw analytics from data.","title":"What is not covered under this training"},{"location":"big_data/intro/#toc","text":"Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"TOC:"},{"location":"big_data/overview/","text":"Overview of Big Data Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/overview/#overview-of-big-data","text":"Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/tasks/","text":"Tasks and conclusion Post training tasks: Try setting up your own 3 node hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here References: Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"Tasks and conclusion"},{"location":"big_data/tasks/#tasks-and-conclusion","text":"","title":"Tasks and conclusion"},{"location":"big_data/tasks/#post-training-tasks","text":"Try setting up your own 3 node hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here","title":"Post training tasks:"},{"location":"big_data/tasks/#references","text":"Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"References:"},{"location":"big_data/usage/","text":"Usage of Big Data techniques Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IOT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October, 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data techniques"},{"location":"big_data/usage/#usage-of-big-data-techniques","text":"Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IOT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October, 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data techniques"},{"location":"git/branches/","text":"Working With Branches Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with contents snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo I am a file in b1 branch b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding b1 file [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD - b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo new file in master branch master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding master.txt file [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are checkout on master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo. Merges Now say the feature you were working on branch b1 is complete. And you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you will pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. And there could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit which will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD - master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the fast-forward message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Working With Branches"},{"location":"git/branches/#working-with-branches","text":"Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with contents snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo I am a file in b1 branch b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding b1 file [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD - b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo new file in master branch master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding master.txt file [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are checkout on master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo.","title":"Working With Branches"},{"location":"git/branches/#merges","text":"Now say the feature you were working on branch b1 is complete. And you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you will pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. And there could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit which will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD - master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD - master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD - master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the fast-forward message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD - master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Merges"},{"location":"git/git-basics/","text":"School Of SRE: Git Pre - Reads Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs What to expect from this training As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently! What is not covered under this training Advanced usage and specifics of internal implementation details of Git. Training Content Table of Contents Git Basics Working with Branches Git with Github Hooks Git Basics Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains history of the changes happened with the codebase. Creating a Git Repo Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository. Tracking a File Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo I am file 1 file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use git add file ... to include in what will be committed) file1.txt nothing added to commit but untracked files present (use git add to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use git rm --cached file ... to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 1 [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be commited: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m . More About a Commit Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored. In an efficient manner. Adding More Changes Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo I am file 2 file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 2 [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a === 7f3b00e Are commits really linked? As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at content of the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel spatel1@linkedin.com 1603273316 -0700 committer Sanket Patel spatel1@linkedin.com 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder. The Version Control part of Git We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b new-branch-name HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked. Reference I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well. References and The Magic Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points. Little Adventure We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD - master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, isn't it?","title":"Git Basics"},{"location":"git/git-basics/#school-of-sre-git","text":"","title":"School Of SRE: Git"},{"location":"git/git-basics/#pre-reads","text":"Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs","title":"Pre - Reads"},{"location":"git/git-basics/#what-to-expect-from-this-training","text":"As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently!","title":"What to expect from this training"},{"location":"git/git-basics/#what-is-not-covered-under-this-training","text":"Advanced usage and specifics of internal implementation details of Git.","title":"What is not covered under this training"},{"location":"git/git-basics/#training-content","text":"","title":"Training Content"},{"location":"git/git-basics/#table-of-contents","text":"Git Basics Working with Branches Git with Github Hooks","title":"Table of Contents"},{"location":"git/git-basics/#git-basics","text":"Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains history of the changes happened with the codebase.","title":"Git Basics"},{"location":"git/git-basics/#creating-a-git-repo","text":"Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository.","title":"Creating a Git Repo"},{"location":"git/git-basics/#tracking-a-file","text":"Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo I am file 1 file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use git add file ... to include in what will be committed) file1.txt nothing added to commit but untracked files present (use git add to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use git rm --cached file ... to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 1 [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be commited: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m .","title":"Tracking a File"},{"location":"git/git-basics/#more-about-a-commit","text":"Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored. In an efficient manner.","title":"More About a Commit"},{"location":"git/git-basics/#adding-more-changes","text":"Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo I am file 2 file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding file 2 [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a === 7f3b00e","title":"Adding More Changes"},{"location":"git/git-basics/#are-commits-really-linked","text":"As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at content of the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel spatel1@linkedin.com 1603273316 -0700 committer Sanket Patel spatel1@linkedin.com 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder.","title":"Are commits really linked?"},{"location":"git/git-basics/#the-version-control-part-of-git","text":"We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b new-branch-name HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked.","title":"The Version Control part of Git"},{"location":"git/git-basics/#reference","text":"I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well.","title":"Reference"},{"location":"git/git-basics/#references-and-the-magic","text":"Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points.","title":"References and The Magic"},{"location":"git/git-basics/#little-adventure","text":"We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD - master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD - master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, isn't it?","title":"Little Adventure"},{"location":"git/github-hooks/","text":"Git with Github Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook Hooks Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. Ie: if you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo echo this is from pre commit hook .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo sample file sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding sample file this is from pre commit hook # ===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt What next from here? There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"Github and Hooks"},{"location":"git/github-hooks/#git-with-github","text":"Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook","title":"Git with Github"},{"location":"git/github-hooks/#hooks","text":"Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. Ie: if you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo echo this is from pre commit hook .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo sample file sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m adding sample file this is from pre commit hook # ===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Hooks"},{"location":"git/github-hooks/#what-next-from-here","text":"There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"What next from here?"},{"location":"linux_networking/dns/","text":"DNS Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends requests to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs. Applications in SRE role This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"DNS"},{"location":"linux_networking/dns/#dns","text":"Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends requests to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs.","title":"DNS"},{"location":"linux_networking/dns/#applications-in-sre-role","text":"This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"Applications in SRE role"},{"location":"linux_networking/http/","text":"HTTP Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) GET / HTTP/1.1 Host: linkedin.com User-Agent: curl/7.64.1 Accept: */* HTTP/1.1 301 Moved Permanently Date: Mon, 09 Nov 2020 10:39:43 GMT X-Li-Pop: prod-esv5 X-LI-Proto: http/1.1 Location: https://www.linkedin.com/ Content-Length: 0 * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message. Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host www.linkedin.com matched cert's www.linkedin.com * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2 lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie= v=2 70bd59e3-5a51-406c-8e0d-dd70befa8890 ; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie= v=1 202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J ; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc= b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R ; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri= https://www.linkedin.com/platform-telemetry/ct x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/http/#http","text":"Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) GET / HTTP/1.1 Host: linkedin.com User-Agent: curl/7.64.1 Accept: */* HTTP/1.1 301 Moved Permanently Date: Mon, 09 Nov 2020 10:39:43 GMT X-Li-Pop: prod-esv5 X-LI-Proto: http/1.1 Location: https://www.linkedin.com/ Content-Length: 0 * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message. Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host www.linkedin.com matched cert's www.linkedin.com * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2 lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie= v=2 70bd59e3-5a51-406c-8e0d-dd70befa8890 ; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie= v=1 202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J ; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc= b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R ; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri= https://www.linkedin.com/platform-telemetry/ct x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/intro/","text":"Linux Networking Fundamentals Pre - Reads This course requires high-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP. Basic familiarity with Linux jargon is sufficient to start this course. This course also expects basic exposure to Linux command-line tools. The course will require you to install certain utilities and run them as a part of the course exercises. What to expect from this course Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet. What is not covered under this course This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0, QUIC, TCP congestion control protocols, Anycast, BGP, CDN, Tunnels and Multicast. We expect that this course will provide the relevant basics to understand such concepts Course Content Birds eye view of the course The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol","title":"Intro"},{"location":"linux_networking/intro/#linux-networking-fundamentals","text":"","title":"Linux Networking Fundamentals"},{"location":"linux_networking/intro/#pre-reads","text":"This course requires high-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP. Basic familiarity with Linux jargon is sufficient to start this course. This course also expects basic exposure to Linux command-line tools. The course will require you to install certain utilities and run them as a part of the course exercises.","title":"Pre - Reads"},{"location":"linux_networking/intro/#what-to-expect-from-this-course","text":"Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet.","title":"What to expect from this course"},{"location":"linux_networking/intro/#what-is-not-covered-under-this-course","text":"This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0, QUIC, TCP congestion control protocols, Anycast, BGP, CDN, Tunnels and Multicast. We expect that this course will provide the relevant basics to understand such concepts","title":"What is not covered under this course"},{"location":"linux_networking/intro/#course-content","text":"","title":"Course Content"},{"location":"linux_networking/intro/#birds-eye-view-of-the-course","text":"The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol","title":"Birds eye view of the course"},{"location":"linux_networking/ipr/","text":"IP Routing and Data Link Layer We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases Applications in SRE role Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior Conclusion With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE. Post Training Exercises Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Routing and Conclusion"},{"location":"linux_networking/ipr/#ip-routing-and-data-link-layer","text":"We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases","title":"IP Routing and Data Link Layer"},{"location":"linux_networking/ipr/#applications-in-sre-role","text":"Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior","title":"Applications in SRE role"},{"location":"linux_networking/ipr/#conclusion","text":"With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE.","title":"Conclusion"},{"location":"linux_networking/ipr/#post-training-exercises","text":"Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Post Training Exercises"},{"location":"linux_networking/tcp/","text":"TCP TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role Applications in SRE role Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"TCP"},{"location":"linux_networking/tcp/#tcp","text":"TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role","title":"TCP"},{"location":"linux_networking/tcp/#applications-in-sre-role","text":"Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"Applications in SRE role"},{"location":"linux_networking/udp/","text":"UDP UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( 1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client Applications in SRE role If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"UDP"},{"location":"linux_networking/udp/#udp","text":"UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( 1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client","title":"UDP"},{"location":"linux_networking/udp/#applications-in-sre-role","text":"If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"Applications in SRE role"},{"location":"python_web/intro/","text":"School of SRE: Python and The Web Pre - Reads Basic understanding of python language. Basic familiarity with flask framework. What to expect from this training This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service. What is not covered under this training Extensive knowledge of python internals and advanced python. Training Content Lab Environment Setup Have latest version of python installed TOC The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App The Python Language Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference? Compiled vs. Interpreted This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo print('hello world') hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode. Running The Programs We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------- + +------------------- +line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------- + +------------------- + | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Intro"},{"location":"python_web/intro/#school-of-sre-python-and-the-web","text":"","title":"School of SRE: Python and The Web"},{"location":"python_web/intro/#pre-reads","text":"Basic understanding of python language. Basic familiarity with flask framework.","title":"Pre - Reads"},{"location":"python_web/intro/#what-to-expect-from-this-training","text":"This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service.","title":"What to expect from this training"},{"location":"python_web/intro/#what-is-not-covered-under-this-training","text":"Extensive knowledge of python internals and advanced python.","title":"What is not covered under this training"},{"location":"python_web/intro/#training-content","text":"","title":"Training Content"},{"location":"python_web/intro/#lab-environment-setup","text":"Have latest version of python installed","title":"Lab Environment Setup"},{"location":"python_web/intro/#toc","text":"The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App","title":"TOC"},{"location":"python_web/intro/#the-python-language","text":"Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference?","title":"The Python Language"},{"location":"python_web/intro/#compiled-vs-interpreted","text":"This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo print('hello world') hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode.","title":"Compiled vs. Interpreted"},{"location":"python_web/intro/#running-the-programs","text":"We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------- + +------------------- +line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------- + +------------------- + | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Running The Programs"},{"location":"python_web/python-concepts/","text":"Some Python Concepts Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. float_number=42.0 def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'float_number': 42.0, 'foo_func': function foo_func at 0x1055847a0 } Python Functions Since functions too are objects, we can see what all attributes a function contains as following def hello(name): ... print(f Hello, {name}! ) ... dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones globals This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 } # adding new global variable GLOBAL= g_val hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 , 'GLOBAL': 'g_val'} code This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter hello.__code__.co_filename ' stdin ' # number of arguments the function takes hello.__code__.co_argcount 1 # local variable names hello.__code__.co_varnames ('name',) # the function code's compiled bytecode hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by dir(hello.__code__) Decorators Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: def deco(func): ... def inner(): ... print( before ) ... func() ... print( after ) ... return inner ... @deco ... def hello_world(): ... print( hello world ) ... hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing def hello_world(): ... print( hello world ) ... hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) hello_world +--------------------+ + |print( hello_world )| | | | +-------------- | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print( before ) | |call function object with id 100 | |print( after ) | | | +---------------------------^-----+ | | AFTER | | | hello_world +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function. Some Gotchas While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#some-python-concepts","text":"Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. float_number=42.0 def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'float_number': 42.0, 'foo_func': function foo_func at 0x1055847a0 }","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#python-functions","text":"Since functions too are objects, we can see what all attributes a function contains as following def hello(name): ... print(f Hello, {name}! ) ... dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones","title":"Python Functions"},{"location":"python_web/python-concepts/#globals","text":"This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 } # adding new global variable GLOBAL= g_val hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': class '_frozen_importlib.BuiltinImporter' , '__spec__': None, '__annotations__': {}, '__builtins__': module 'builtins' (built-in) , 'hello': function hello at 0x7fe4e82554c0 , 'GLOBAL': 'g_val'}","title":"globals"},{"location":"python_web/python-concepts/#code","text":"This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter hello.__code__.co_filename ' stdin ' # number of arguments the function takes hello.__code__.co_argcount 1 # local variable names hello.__code__.co_varnames ('name',) # the function code's compiled bytecode hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by dir(hello.__code__)","title":"code"},{"location":"python_web/python-concepts/#decorators","text":"Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: def deco(func): ... def inner(): ... print( before ) ... func() ... print( after ) ... return inner ... @deco ... def hello_world(): ... print( hello world ) ... hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing def hello_world(): ... print( hello world ) ... hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) hello_world +--------------------+ + |print( hello_world )| | | | +-------------- | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print( before ) | |call function object with id 100 | |print( after ) | | | +---------------------------^-----+ | | AFTER | | | hello_world +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function.","title":"Decorators"},{"location":"python_web/python-concepts/#some-gotchas","text":"While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Gotchas"},{"location":"python_web/python-web-flask/","text":"Python, Web amd Flask Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response. Sockets Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it. Flask Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#python-web-amd-flask","text":"Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response.","title":"Python, Web amd Flask"},{"location":"python_web/python-web-flask/#sockets","text":"Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it.","title":"Sockets"},{"location":"python_web/python-web-flask/#flask","text":"Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Flask"},{"location":"python_web/sre-conclusion/","text":"SRE Parts of The App and Conclusion Scaling The App The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable. Monitoring Strategy Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected. SRE Use-cases In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios. Optional Exercises Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets. Conclusion This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"SRE Aspects of The App and Conclusion"},{"location":"python_web/sre-conclusion/#sre-parts-of-the-app-and-conclusion","text":"","title":"SRE Parts of The App and Conclusion"},{"location":"python_web/sre-conclusion/#scaling-the-app","text":"The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable.","title":"Scaling The App"},{"location":"python_web/sre-conclusion/#monitoring-strategy","text":"Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected.","title":"Monitoring Strategy"},{"location":"python_web/sre-conclusion/#sre-use-cases","text":"In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios.","title":"SRE Use-cases"},{"location":"python_web/sre-conclusion/#optional-exercises","text":"Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets.","title":"Optional Exercises"},{"location":"python_web/sre-conclusion/#conclusion","text":"This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/url-shorten-app/","text":"The URL Shortening App Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well. Design We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design. 1. High Level Operations and API Endpoints Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone. 2. How to shorten? Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most. 3. Is URL Valid? Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down? 4. Storage Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision. 5. Other We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask( url_shortener ) mapping = {} @app.route( /shorten , methods=[ POST ]) def shorten(): global mapping payload = request.json if url not in payload: return Missing URL Parameter , 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[ url ].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[ url ] return f Shortened: r/{digest}\\n else: # TODO: check for hash collission return f Already exists: r/{digest}\\n @app.route( /r/ hash_ ) def redirect_(hash_): if hash_ not in mapping: return URL Not Found , 404 return redirect(mapping[hash_]) if __name__ == __main__ : app.run(debug=True) OUTPUT: === SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H content-type: application/json --data '{ url : https://linkedin.com }' Shortened: r/a62a4 === REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) GET /r/a62a4 HTTP/1.1 Host: localhost:5000 User-Agent: curl/7.64.1 Accept: */* * HTTP 1.0, assume close after body HTTP/1.0 302 FOUND Content-Type: text/html; charset=utf-8 Content-Length: 247 Location: https://linkedin.com Server: Werkzeug/0.15.4 Python/3.7.7 Date: Tue, 27 Oct 2020 09:37:12 GMT !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 3.2 Final//EN title Redirecting... /title h1 Redirecting... /h1 * Closing connection 0 p You should be redirected automatically to target URL: a href= https://linkedin.com https://linkedin.com /a . If not click the link.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#the-url-shortening-app","text":"Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#design","text":"We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design.","title":"Design"},{"location":"python_web/url-shorten-app/#1-high-level-operations-and-api-endpoints","text":"Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone.","title":"1. High Level Operations and API Endpoints"},{"location":"python_web/url-shorten-app/#2-how-to-shorten","text":"Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most.","title":"2. How to shorten?"},{"location":"python_web/url-shorten-app/#3-is-url-valid","text":"Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down?","title":"3. Is URL Valid?"},{"location":"python_web/url-shorten-app/#4-storage","text":"Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision.","title":"4. Storage"},{"location":"python_web/url-shorten-app/#5-other","text":"We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask( url_shortener ) mapping = {} @app.route( /shorten , methods=[ POST ]) def shorten(): global mapping payload = request.json if url not in payload: return Missing URL Parameter , 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[ url ].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[ url ] return f Shortened: r/{digest}\\n else: # TODO: check for hash collission return f Already exists: r/{digest}\\n @app.route( /r/ hash_ ) def redirect_(hash_): if hash_ not in mapping: return URL Not Found , 404 return redirect(mapping[hash_]) if __name__ == __main__ : app.run(debug=True) OUTPUT: === SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H content-type: application/json --data '{ url : https://linkedin.com }' Shortened: r/a62a4 === REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) GET /r/a62a4 HTTP/1.1 Host: localhost:5000 User-Agent: curl/7.64.1 Accept: */* * HTTP 1.0, assume close after body HTTP/1.0 302 FOUND Content-Type: text/html; charset=utf-8 Content-Length: 247 Location: https://linkedin.com Server: Werkzeug/0.15.4 Python/3.7.7 Date: Tue, 27 Oct 2020 09:37:12 GMT !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 3.2 Final//EN title Redirecting... /title h1 Redirecting... /h1 * Closing connection 0 p You should be redirected automatically to target URL: a href= https://linkedin.com https://linkedin.com /a . If not click the link.","title":"5. Other"},{"location":"security/fundamentals/","text":"Part I: Fundamentals Introduction to Security Overview for SRE If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design hence are quite sometimes the first line of defense. SRE\u2019s help in preventing bad design implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim for secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password aging and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IOT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defense in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in-depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users, and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defense in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, it is likely that the security issue is widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability Security Reliability and security are both crucial components of a truly trustworthy system,but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery was later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks , which works as an authentication the HSM token supposedly locked inside a case.. the problem can be further elongated ) designed to increase the security of the system. Authentication vs Authorization Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources. Common authentication flow (local authentication) The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources OpenID/OAuth OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system. Cryptography It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon. Ciphers Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m), and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: This also means that in order for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. sIf the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer : https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Deffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains a number of attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html Login Security SSH SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunneling to encrypt other TCP/IP-based sessions Kerberos According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol, and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric key cryptography and requires trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client : A user/ a service a server : Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT). Certificate Chain The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and figure below summarizes its behavior at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate. TLS Handshake The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre master key with the Diffie-Hellman algorithm. The pre master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used. \u201cPerfect\u201d Forward Secrecy The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If, at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"Fundamentals of Security"},{"location":"security/fundamentals/#part-i-fundamentals","text":"","title":"Part I: Fundamentals"},{"location":"security/fundamentals/#introduction-to-security-overview-for-sre","text":"If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design hence are quite sometimes the first line of defense. SRE\u2019s help in preventing bad design implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim for secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password aging and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IOT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defense in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in-depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users, and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defense in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, it is likely that the security issue is widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability Security Reliability and security are both crucial components of a truly trustworthy system,but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery was later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks , which works as an authentication the HSM token supposedly locked inside a case.. the problem can be further elongated ) designed to increase the security of the system.","title":"Introduction to Security Overview for SRE"},{"location":"security/fundamentals/#authentication-vs-authorization","text":"Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources.","title":"Authentication vs Authorization"},{"location":"security/fundamentals/#common-authentication-flow-local-authentication","text":"The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources","title":"Common authentication flow (local authentication)"},{"location":"security/fundamentals/#openidoauth","text":"OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system.","title":"OpenID/OAuth"},{"location":"security/fundamentals/#cryptography","text":"It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon.","title":"Cryptography"},{"location":"security/fundamentals/#ciphers","text":"Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m), and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: This also means that in order for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. sIf the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer : https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Deffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains a number of attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html","title":"Ciphers"},{"location":"security/fundamentals/#login-security","text":"","title":"Login Security"},{"location":"security/fundamentals/#ssh","text":"SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunneling to encrypt other TCP/IP-based sessions","title":"SSH"},{"location":"security/fundamentals/#kerberos","text":"According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol, and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric key cryptography and requires trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client : A user/ a service a server : Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT).","title":"Kerberos"},{"location":"security/fundamentals/#certificate-chain","text":"The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and figure below summarizes its behavior at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate.","title":"Certificate Chain"},{"location":"security/fundamentals/#tls-handshake","text":"The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre master key with the Diffie-Hellman algorithm. The pre master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used.","title":"TLS Handshake"},{"location":"security/fundamentals/#perfect-forward-secrecy","text":"The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If, at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"\u201cPerfect\u201d Forward Secrecy"},{"location":"security/intro/","text":"Security Target Audience The material is suitable for new SRE hires or graduate computer science majors straight out of college, anyone who has a basic technical background, or readers who have a basic understanding of IT security and want to expand their knowledge. The approach being covered here deals with the fundamentals of computer security in the modern IT landscape moreover it sheds light on most of the dangerous \"things\" out there on public internet which are potentially a gateway to compromising systems. As an SRE, you are expected to design, build and develop products, this course will give you that \u2018security knob\u2019 into your thinking and problem-solving approach which is expected to be turned on as a critical area that always takes precedence over anything else. Pre Requirements Basics of Linux fundamentals command line usage Networking Module What to expect from this training The course covers fundamentals of information security along with touching on subjects of system security, network web security. The aim of this course is to get familiar with the basics of information security in day to day operations then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured. What is not covered under this training The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised. Training Content Part I: Fundamentals Part II: Network Security Part III: Threats, Attacks Defense PART IV: Writing Secure Code More Post Training asks/ Further Reading CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Inro"},{"location":"security/intro/#security","text":"","title":"Security"},{"location":"security/intro/#target-audience","text":"The material is suitable for new SRE hires or graduate computer science majors straight out of college, anyone who has a basic technical background, or readers who have a basic understanding of IT security and want to expand their knowledge. The approach being covered here deals with the fundamentals of computer security in the modern IT landscape moreover it sheds light on most of the dangerous \"things\" out there on public internet which are potentially a gateway to compromising systems. As an SRE, you are expected to design, build and develop products, this course will give you that \u2018security knob\u2019 into your thinking and problem-solving approach which is expected to be turned on as a critical area that always takes precedence over anything else.","title":"Target Audience"},{"location":"security/intro/#pre-requirements","text":"Basics of Linux fundamentals command line usage Networking Module","title":"Pre Requirements"},{"location":"security/intro/#what-to-expect-from-this-training","text":"The course covers fundamentals of information security along with touching on subjects of system security, network web security. The aim of this course is to get familiar with the basics of information security in day to day operations then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured.","title":"What to expect from this training"},{"location":"security/intro/#what-is-not-covered-under-this-training","text":"The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised.","title":"What is not covered under this training"},{"location":"security/intro/#training-content","text":"Part I: Fundamentals Part II: Network Security Part III: Threats, Attacks Defense PART IV: Writing Secure Code More","title":"Training Content"},{"location":"security/intro/#post-training-asks-further-reading","text":"CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Post Training asks/ Further Reading"},{"location":"security/network_security/","text":"Part II : Network Security Introduction TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relation between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed to a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission. Public Key Infrastructure To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. In order to use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE IPsec: A Security Protocol at the Network Layer IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE). PGP S/MIME : Email Security There are a number of security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his own inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate this limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape\u2019s intent was to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. In an effort to standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/ Network Perimeter Security Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection General Firewall Framework Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. On the basis of the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter. Packet Filters It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established. Circuit Gateways Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF). Application Gateways(ALG) Aka PROXY Servers An Application Level Gateway (ALG) acts like a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads. Trusted Systems Bastion Hosts A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on a number of elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defense mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are absolutely necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely. Common Techniques Scannings, Packet Capturing Scanning Ports with Nmap Nmap (\"Network Mapper\") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if its open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan. Types of Nmap Scan: TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if there are any UDP ports listening. Since UDP does not respond with a positive acknowledgment like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it really only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca OpenVAS OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and a SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/ WireShark Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN. DumpCap Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods of time. DaemonLogger Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted. NetSniff-NG Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. In order to begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap Netflow NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis. IDS A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT SURICATA Policy Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host Based IDS Network Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviors is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs. Chinks In The Armour (TCP/IP Security Issues) IP Spoofing In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compare TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compare IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot therefore be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed. Covert Channel A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behavior. The alteration of ICMP packets gives intruders the opportunity to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunneling. Check for echo responses that do not contain the same payload as request Check for volume of ICMP traffic specially for volumes beyond an acceptable threshold IP Fragmentation Attack The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been successfully completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. The attacker's ultimate goal is to write special programs or pieces of code that are able to construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the web server of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the web server. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the web server refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers. Connection Hijacking An authorized user (Employee X) sends HTTP requests over a TCP session with the web server. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the web server to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the web server. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the web server replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the web server. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session. Buffer Overflow A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that are able to store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack. More Spoofing Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"Network Securuty"},{"location":"security/network_security/#part-ii-network-security","text":"","title":"Part II : Network Security"},{"location":"security/network_security/#introduction","text":"TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relation between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed to a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission.","title":"Introduction"},{"location":"security/network_security/#public-key-infrastructure","text":"To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. In order to use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE","title":"Public Key Infrastructure"},{"location":"security/network_security/#ipsec-a-security-protocol-at-the-network-layer","text":"IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE).","title":"IPsec: A Security Protocol at the Network Layer"},{"location":"security/network_security/#pgp-smime-email-security","text":"There are a number of security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his own inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate this limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape\u2019s intent was to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. In an effort to standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/","title":"PGP & S/MIME : Email Security"},{"location":"security/network_security/#network-perimeter-security","text":"Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection","title":"Network Perimeter Security"},{"location":"security/network_security/#general-firewall-framework","text":"Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. On the basis of the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter.","title":"General Firewall Framework"},{"location":"security/network_security/#packet-filters","text":"It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established.","title":"Packet Filters"},{"location":"security/network_security/#circuit-gateways","text":"Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF).","title":"Circuit Gateways"},{"location":"security/network_security/#application-gatewaysalg","text":"Aka PROXY Servers An Application Level Gateway (ALG) acts like a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads.","title":"Application Gateways(ALG)"},{"location":"security/network_security/#trusted-systems-bastion-hosts","text":"A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on a number of elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defense mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are absolutely necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely.","title":"Trusted Systems & Bastion Hosts"},{"location":"security/network_security/#common-techniques-scannings-packet-capturing","text":"","title":"Common Techniques & Scannings, Packet Capturing"},{"location":"security/network_security/#scanning-ports-with-nmap","text":"Nmap (\"Network Mapper\") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if its open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan.","title":"Scanning Ports with Nmap"},{"location":"security/network_security/#types-of-nmap-scan","text":"TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if there are any UDP ports listening. Since UDP does not respond with a positive acknowledgment like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it really only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca","title":"Types of Nmap Scan:"},{"location":"security/network_security/#openvas","text":"OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and a SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/","title":"OpenVAS"},{"location":"security/network_security/#wireshark","text":"Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN.","title":"WireShark"},{"location":"security/network_security/#dumpcap","text":"Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods of time.","title":"DumpCap"},{"location":"security/network_security/#daemonlogger","text":"Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted.","title":"DaemonLogger"},{"location":"security/network_security/#netsniff-ng","text":"Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. In order to begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap","title":"NetSniff-NG"},{"location":"security/network_security/#netflow","text":"NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis.","title":"Netflow"},{"location":"security/network_security/#ids","text":"A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT SURICATA Policy Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host Based IDS Network Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviors is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs.","title":"IDS"},{"location":"security/network_security/#chinks-in-the-armour-tcpip-security-issues","text":"","title":"Chinks In The Armour (TCP/IP Security Issues)"},{"location":"security/network_security/#ip-spoofing","text":"In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compare TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compare IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot therefore be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed.","title":"IP Spoofing"},{"location":"security/network_security/#covert-channel","text":"A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behavior. The alteration of ICMP packets gives intruders the opportunity to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunneling. Check for echo responses that do not contain the same payload as request Check for volume of ICMP traffic specially for volumes beyond an acceptable threshold","title":"Covert Channel"},{"location":"security/network_security/#ip-fragmentation-attack","text":"The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been successfully completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. The attacker's ultimate goal is to write special programs or pieces of code that are able to construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the web server of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the web server. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the web server refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers.","title":"IP Fragmentation Attack"},{"location":"security/network_security/#connection-hijacking","text":"An authorized user (Employee X) sends HTTP requests over a TCP session with the web server. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the web server to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the web server. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the web server replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the web server. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session.","title":"Connection Hijacking"},{"location":"security/network_security/#buffer-overflow","text":"A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that are able to store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack.","title":"Buffer Overflow"},{"location":"security/network_security/#more-spoofing","text":"Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"More Spoofing"},{"location":"security/threats_attacks_defences/","text":"Part III: Threats, Attacks Defense DNS Protection Cache Poisoning Attack Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelled words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack. DNSSEC (Security Extension) The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in a response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption, and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection. BGP BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous system is a collection of routers or networks with the same network policy usually under a single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior). How BGP Works BGP is responsible for finding a path to a destination router the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link state protocol each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next hop routing table is based on this topology view. The link state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbors. The shortest path is then taken We then re-look at all our neighbors that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited. BGP Vulnerabilities By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are best defence against many common viral attacks where the traffic is dropped from infected machines to/from command control masters. Infamous BGP Injection attack on Youtube - EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. - Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. - Refer : https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb - Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers, since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication, since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators, when a neighbor sends in excess of a preset number of prefixes. IETF is currently working on improving this space Web Based Attacks HTTP Response Splitting Attacks HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the web server to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response. Cross-Site Request Forgery (CSRF or XSRF) A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks Cross-Site Scripting (XSS) Attacks Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application. Document Object Model (DOM) XSS Attacks The Document Object Model (DOM) based XSS does not require the web server to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser. Clickjacking The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see, is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defense against clickjacking, and disabling JavaScript is the only viable method DataBase Attacks Defenses SQL injection Attacks It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SQL Injection Attack Defenses SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits. VPN A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based Security Breach In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach. Denial of Service Attacks Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defenses against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack. Distributed Denial of Service Attacks DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers. Wiretapping Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host. Backdoors Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls. Malicious Attacks Birthday Attack Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/ Brute-Force Password Attacks In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks Dictionary Password Attacks A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html Replay Attacks Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html Man-in-the-Middle Attacks A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the web server. The attacker then establishes a secure connection with the web server, acting as an invisible go-between. The attacker passes traffic between the user and the web server. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack Masquerading In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228 Eavesdropping Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(ofcourse given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods. Social Engineering Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful. Phreaking Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system. Phishing Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers. Pharming Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Threat, Attacks & Defences"},{"location":"security/threats_attacks_defences/#part-iii-threats-attacks-defense","text":"","title":"Part III: Threats, Attacks & Defense"},{"location":"security/threats_attacks_defences/#dns-protection","text":"","title":"DNS Protection"},{"location":"security/threats_attacks_defences/#cache-poisoning-attack","text":"Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelled words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack.","title":"Cache Poisoning Attack"},{"location":"security/threats_attacks_defences/#dnssec-security-extension","text":"The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in a response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption, and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection.","title":"DNSSEC (Security Extension)"},{"location":"security/threats_attacks_defences/#bgp","text":"BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous system is a collection of routers or networks with the same network policy usually under a single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior).","title":"BGP"},{"location":"security/threats_attacks_defences/#how-bgp-works","text":"BGP is responsible for finding a path to a destination router the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link state protocol each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next hop routing table is based on this topology view. The link state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbors. The shortest path is then taken We then re-look at all our neighbors that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited.","title":"How BGP Works"},{"location":"security/threats_attacks_defences/#bgp-vulnerabilities","text":"By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are best defence against many common viral attacks where the traffic is dropped from infected machines to/from command control masters. Infamous BGP Injection attack on Youtube - EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. - Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. - Refer : https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb - Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers, since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication, since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators, when a neighbor sends in excess of a preset number of prefixes. IETF is currently working on improving this space","title":"BGP Vulnerabilities"},{"location":"security/threats_attacks_defences/#web-based-attacks","text":"","title":"Web Based Attacks"},{"location":"security/threats_attacks_defences/#http-response-splitting-attacks","text":"HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the web server to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response.","title":"HTTP Response Splitting Attacks"},{"location":"security/threats_attacks_defences/#cross-site-request-forgery-csrf-or-xsrf","text":"A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks","title":"Cross-Site Request Forgery (CSRF or XSRF)"},{"location":"security/threats_attacks_defences/#cross-site-scripting-xss-attacks","text":"Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application.","title":"Cross-Site Scripting (XSS) Attacks"},{"location":"security/threats_attacks_defences/#document-object-model-dom-xss-attacks","text":"The Document Object Model (DOM) based XSS does not require the web server to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser.","title":"Document Object Model (DOM) XSS Attacks"},{"location":"security/threats_attacks_defences/#clickjacking","text":"The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see, is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defense against clickjacking, and disabling JavaScript is the only viable method","title":"Clickjacking"},{"location":"security/threats_attacks_defences/#database-attacks-defenses","text":"","title":"DataBase Attacks & Defenses"},{"location":"security/threats_attacks_defences/#sql-injection-attacks","text":"It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers","title":"SQL injection Attacks"},{"location":"security/threats_attacks_defences/#sql-injection-attack-defenses","text":"SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits.","title":"SQL Injection Attack Defenses"},{"location":"security/threats_attacks_defences/#vpn","text":"A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based","title":"VPN"},{"location":"security/threats_attacks_defences/#security-breach","text":"In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach.","title":"Security Breach"},{"location":"security/threats_attacks_defences/#denial-of-service-attacks","text":"Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defenses against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack.","title":"Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#distributed-denial-of-service-attacks","text":"DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers.","title":"Distributed Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#wiretapping","text":"Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host.","title":"Wiretapping"},{"location":"security/threats_attacks_defences/#backdoors","text":"Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls.","title":"Backdoors"},{"location":"security/threats_attacks_defences/#malicious-attacks","text":"","title":"Malicious Attacks"},{"location":"security/threats_attacks_defences/#birthday-attack","text":"Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/","title":"Birthday Attack"},{"location":"security/threats_attacks_defences/#brute-force-password-attacks","text":"In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks","title":"Brute-Force Password Attacks"},{"location":"security/threats_attacks_defences/#dictionary-password-attacks","text":"A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html","title":"Dictionary Password Attacks"},{"location":"security/threats_attacks_defences/#replay-attacks","text":"Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html","title":"Replay Attacks"},{"location":"security/threats_attacks_defences/#man-in-the-middle-attacks","text":"A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the web server. The attacker then establishes a secure connection with the web server, acting as an invisible go-between. The attacker passes traffic between the user and the web server. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack","title":"Man-in-the-Middle Attacks"},{"location":"security/threats_attacks_defences/#masquerading","text":"In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228","title":"Masquerading"},{"location":"security/threats_attacks_defences/#eavesdropping","text":"Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(ofcourse given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods.","title":"Eavesdropping"},{"location":"security/threats_attacks_defences/#social-engineering","text":"Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful.","title":"Social Engineering"},{"location":"security/threats_attacks_defences/#phreaking","text":"Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system.","title":"Phreaking"},{"location":"security/threats_attacks_defences/#phishing","text":"Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers.","title":"Phishing"},{"location":"security/threats_attacks_defences/#pharming","text":"Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Pharming"},{"location":"security/writing_secure_code/","text":"PART IV: Writing Secure Code More The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software. Use frameworks to enforce security and reliability while writing code A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better. Common Security Vulnerabilities In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes Write Simple Code Try to keep your code clean and simple. Avoid Multi Level Nesting Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error). Eliminate YAGNI Smells Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code. Repay Technical Debt It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt. Refactoring Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs. Unit Testing Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit. Fuzz Testing Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzz engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example file parsers, compression algo, network protocol implementation and audio codec. Integration Testing Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected. Last But not the least Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Writing Secure code"},{"location":"security/writing_secure_code/#part-iv-writing-secure-code-more","text":"The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software.","title":"PART IV: Writing Secure Code & More"},{"location":"security/writing_secure_code/#use-frameworks-to-enforce-security-and-reliability-while-writing-code","text":"A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better.","title":"Use frameworks to enforce security and reliability while writing code"},{"location":"security/writing_secure_code/#common-security-vulnerabilities","text":"In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes","title":"Common Security Vulnerabilities"},{"location":"security/writing_secure_code/#write-simple-code","text":"Try to keep your code clean and simple.","title":"Write Simple Code"},{"location":"security/writing_secure_code/#avoid-multi-level-nesting","text":"Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error).","title":"Avoid Multi Level Nesting"},{"location":"security/writing_secure_code/#eliminate-yagni-smells","text":"Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code.","title":"Eliminate YAGNI Smells"},{"location":"security/writing_secure_code/#repay-technical-debt","text":"It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt.","title":"Repay Technical Debt"},{"location":"security/writing_secure_code/#refactoring","text":"Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs.","title":"Refactoring"},{"location":"security/writing_secure_code/#unit-testing","text":"Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit.","title":"Unit Testing"},{"location":"security/writing_secure_code/#fuzz-testing","text":"Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzz engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example file parsers, compression algo, network protocol implementation and audio codec.","title":"Fuzz Testing"},{"location":"security/writing_secure_code/#integration-testing","text":"Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected.","title":"Integration Testing"},{"location":"security/writing_secure_code/#last-but-not-the-least","text":"Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Last But not the least"},{"location":"systems_design/availability/","text":"HA - Availability - Common \u201cNines\u201d Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms Refer https://en.wikipedia.org/wiki/High_availability#Percentage_calculation HA - Availability Serial Components A System with components is operating in the series If failure of a part leads to the combination becoming inoperable. For example if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026.. Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Availability Parallel Components A System with components is operating in parallel If failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. ) Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Core Principles Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure Refer https://en.wikipedia.org/wiki/High_availability#Principles HA - SPOF WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons. HA - Reliable Crossover WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally DB systems follow active/passive semantics for writes. Masters accept writes and when master goes down, follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one masters. This problem is called a split brain. SRE Use cases SRE works on deciding an acceptable SLA and make sure system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure site is not affected by network switch, hardware, power or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Availability"},{"location":"systems_design/availability/#ha-availability-common-nines","text":"Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms","title":"HA - Availability - Common \u201cNines\u201d"},{"location":"systems_design/availability/#refer","text":"https://en.wikipedia.org/wiki/High_availability#Percentage_calculation","title":"Refer"},{"location":"systems_design/availability/#ha-availability-serial-components","text":"A System with components is operating in the series If failure of a part leads to the combination becoming inoperable. For example if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026..","title":"HA - Availability Serial Components"},{"location":"systems_design/availability/#refer_1","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-availability-parallel-components","text":"A System with components is operating in parallel If failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. )","title":"HA - Availability Parallel Components"},{"location":"systems_design/availability/#refer_2","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-core-principles","text":"Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure","title":"HA - Core Principles"},{"location":"systems_design/availability/#refer_3","text":"https://en.wikipedia.org/wiki/High_availability#Principles","title":"Refer"},{"location":"systems_design/availability/#ha-spof","text":"WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons.","title":"HA - SPOF"},{"location":"systems_design/availability/#ha-reliable-crossover","text":"WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally DB systems follow active/passive semantics for writes. Masters accept writes and when master goes down, follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one masters. This problem is called a split brain.","title":"HA - Reliable Crossover"},{"location":"systems_design/availability/#sre-use-cases","text":"SRE works on deciding an acceptable SLA and make sure system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure site is not affected by network switch, hardware, power or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"SRE Use cases"},{"location":"systems_design/conclusion/","text":"Conclusion Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organisation matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/conclusion/#conclusion","text":"Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organisation matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/fault-tolerance/","text":"Fault Tolerance Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail. Fault Tolerance - Failure Metrics Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time. Refer https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html Fault Tolerance - Fault Isolation Terms Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodology. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in Ads feature gets propagated to Newsfeed feature. Instead if we swimlane \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we come up with a new model for our Content sharing App. Here we roll out enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise. Swimlane Principles Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise usecase) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature) Swimlane Approaches Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them.(if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes.(Public vs Enterprise customers) Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21 SRE Use cases: Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance","text":"Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail.","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance-failure-metrics","text":"Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time.","title":"Fault Tolerance - Failure Metrics"},{"location":"systems_design/fault-tolerance/#refer","text":"https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html","title":"Refer"},{"location":"systems_design/fault-tolerance/#fault-tolerance-fault-isolation-terms","text":"Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodology. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in Ads feature gets propagated to Newsfeed feature. Instead if we swimlane \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we come up with a new model for our Content sharing App. Here we roll out enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise.","title":"Fault Tolerance - Fault Isolation Terms"},{"location":"systems_design/fault-tolerance/#swimlane-principles","text":"Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise usecase) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature)","title":"Swimlane Principles"},{"location":"systems_design/fault-tolerance/#swimlane-approaches","text":"Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them.(if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes.(Public vs Enterprise customers)","title":"Swimlane Approaches"},{"location":"systems_design/fault-tolerance/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21","title":"Refer"},{"location":"systems_design/fault-tolerance/#sre-use-cases","text":"Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"SRE Use cases:"},{"location":"systems_design/intro/","text":"Systems Design Pre - Requisites Fundamentals of common software system components: - Operating Systems - Networking - Databases RDBMS/NoSQL What to expect from this training Thinking about and designing for scalability, availability, and reliability of large scale software systems. What is not covered under this training Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability and reliability of systems Training Content Introduction Scalability High Availability Fault Tolerance Introduction So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design. Backstory Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Intro"},{"location":"systems_design/intro/#systems-design","text":"","title":"Systems Design"},{"location":"systems_design/intro/#pre-requisites","text":"Fundamentals of common software system components: - Operating Systems - Networking - Databases RDBMS/NoSQL","title":"Pre - Requisites"},{"location":"systems_design/intro/#what-to-expect-from-this-training","text":"Thinking about and designing for scalability, availability, and reliability of large scale software systems.","title":"What to expect from this training"},{"location":"systems_design/intro/#what-is-not-covered-under-this-training","text":"Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability and reliability of systems","title":"What is not covered under this training"},{"location":"systems_design/intro/#training-content","text":"Introduction Scalability High Availability Fault Tolerance","title":"Training Content"},{"location":"systems_design/intro/#introduction","text":"So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design.","title":"Introduction"},{"location":"systems_design/intro/#backstory","text":"Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Backstory"},{"location":"systems_design/scalability/","text":"Scalability What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance Refer https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html Scalability - AKF Scale Cube The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. Following section talks about certain scaling patterns based on our inferences from AKF cube Scalability - Horizontal scaling Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Lets see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs which support multi master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Read and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. Cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability Pattern - Load Balancing Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. Commonly used technique is load balancing traffic across identical server clusters. Similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB. Refer https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do Scalability Pattern - LB Tasks What does an LB do? Service discovery: What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers. Health checking: What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime Load balancing: What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern Scalability Pattern - LB Methods Common Load Balancing Methods Least Connection Method directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long lived connections Least Response Time Method directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of server\u2019s health Round Robin Method rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections. IP Hash the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing Scalability Pattern - Caching - Content Delivery Networks (CDN) CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources. Scalability - Microservices This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability - Sharding This pattern represents the separation of work based on attributes that are looked up or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data centre is split and replicated and clients are directed to a data centre based on their geography. This helps in improving performance as clients are directed to the closest Data centre and performance increases as we add more data centres. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html SRE Use cases SREs in coordination with the network team work on how to map users traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure and improve CDN cache hit rate.","title":"Scalability"},{"location":"systems_design/scalability/#scalability","text":"What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance","title":"Scalability"},{"location":"systems_design/scalability/#refer","text":"https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-akf-scale-cube","text":"The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. Following section talks about certain scaling patterns based on our inferences from AKF cube","title":"Scalability - AKF Scale Cube"},{"location":"systems_design/scalability/#scalability-horizontal-scaling","text":"Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Lets see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs which support multi master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Read and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. Cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost","title":"Scalability - Horizontal scaling"},{"location":"systems_design/scalability/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-load-balancing","text":"Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. Commonly used technique is load balancing traffic across identical server clusters. Similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB.","title":"Scalability Pattern - Load Balancing"},{"location":"systems_design/scalability/#refer_2","text":"https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-lb-tasks","text":"What does an LB do?","title":"Scalability Pattern - LB Tasks"},{"location":"systems_design/scalability/#service-discovery","text":"What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers.","title":"Service discovery:"},{"location":"systems_design/scalability/#health-checking","text":"What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime","title":"Health checking:"},{"location":"systems_design/scalability/#load-balancing","text":"What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern","title":"Load balancing:"},{"location":"systems_design/scalability/#scalability-pattern-lb-methods","text":"Common Load Balancing Methods","title":"Scalability Pattern - LB Methods"},{"location":"systems_design/scalability/#least-connection-method","text":"directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long lived connections","title":"Least Connection Method"},{"location":"systems_design/scalability/#least-response-time-method","text":"directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of server\u2019s health","title":"Least Response Time Method"},{"location":"systems_design/scalability/#round-robin-method","text":"rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections.","title":"Round Robin Method"},{"location":"systems_design/scalability/#ip-hash","text":"the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing","title":"IP Hash"},{"location":"systems_design/scalability/#scalability-pattern-caching-content-delivery-networks-cdn","text":"CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources.","title":"Scalability Pattern - Caching - Content Delivery Networks (CDN)"},{"location":"systems_design/scalability/#scalability-microservices","text":"This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement.","title":"Scalability - Microservices"},{"location":"systems_design/scalability/#refer_3","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-sharding","text":"This pattern represents the separation of work based on attributes that are looked up or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data centre is split and replicated and clients are directed to a data centre based on their geography. This helps in improving performance as clients are directed to the closest Data centre and performance increases as we add more data centres. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology.","title":"Scalability - Sharding"},{"location":"systems_design/scalability/#refer_4","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#sre-use-cases","text":"SREs in coordination with the network team work on how to map users traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure and improve CDN cache hit rate.","title":"SRE Use cases"}]} \ No newline at end of file diff --git a/security/fundamentals/index.html b/security/fundamentals/index.html index fb27087..32cbddc 100644 --- a/security/fundamentals/index.html +++ b/security/fundamentals/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/security/intro/index.html b/security/intro/index.html index a1857a1..e0be6f4 100644 --- a/security/intro/index.html +++ b/security/intro/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • @@ -197,13 +226,17 @@

    Security

    -

    Fundamental classroom courseware for people getting started with SRE & developing an understanding of the need for security in day to day operations

    Target Audience

    The material is suitable for new SRE hires or graduate computer science majors straight out of college, anyone who has a basic technical background, or readers who have a basic understanding of IT security and want to expand their knowledge.

    diff --git a/security/network_security/index.html b/security/network_security/index.html index 1152718..7999578 100644 --- a/security/network_security/index.html +++ b/security/network_security/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/security/threats_attacks_defences/index.html b/security/threats_attacks_defences/index.html index 78c7292..5ea708f 100644 --- a/security/threats_attacks_defences/index.html +++ b/security/threats_attacks_defences/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/security/writing_secure_code/index.html b/security/writing_secure_code/index.html index ec3779c..1e1e7a6 100644 --- a/security/writing_secure_code/index.html +++ b/security/writing_secure_code/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/sitemap.xml b/sitemap.xml index c71a98c..f5b42ec 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -125,4 +125,34 @@ 2020-11-09 daily + + None + 2020-11-09 + daily + + + None + 2020-11-09 + daily + + + None + 2020-11-09 + daily + + + None + 2020-11-09 + daily + + + None + 2020-11-09 + daily + + + None + 2020-11-09 + daily + \ No newline at end of file diff --git a/sitemap.xml.gz b/sitemap.xml.gz index 537acfc03596ab59fa6077dc1d91c7e249cf4de6..f02f318fbf8fef4e6f7d4fb53b18067bbdbb5967 100644 GIT binary patch delta 67 zcmV-J0KEUw0o4H*ABzYGqd2Kw0{?SqbY*Q}a4vXlYyj=okr*Hfy7dCfWtX2FzVnen Ze-t2q00Q_Ae3!KBi5HroFb*6J005H68dCrO delta 64 zcmV-G0Kfm$0nz~&ABzYG$|$K{0{?SqbY*Q}a4vXlYyj=nkr*HfdV?;@WtX2FzUz@f We-Yrn!FNe(w0HqNiGJyJ3jhF3ml~h| diff --git a/systems_design/availability/index.html b/systems_design/availability/index.html index 6a1c618..24428c7 100644 --- a/systems_design/availability/index.html +++ b/systems_design/availability/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/systems_design/conclusion/index.html b/systems_design/conclusion/index.html index d115e81..e339765 100644 --- a/systems_design/conclusion/index.html +++ b/systems_design/conclusion/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/systems_design/fault-tolerance/index.html b/systems_design/fault-tolerance/index.html index 0a3aac5..3fb6613 100644 --- a/systems_design/fault-tolerance/index.html +++ b/systems_design/fault-tolerance/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/systems_design/intro/index.html b/systems_design/intro/index.html index d394204..9d2f165 100644 --- a/systems_design/intro/index.html +++ b/systems_design/intro/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +
    • diff --git a/systems_design/scalability/index.html b/systems_design/scalability/index.html index 3f0106d..b5e95e6 100644 --- a/systems_design/scalability/index.html +++ b/systems_design/scalability/index.html @@ -63,6 +63,35 @@
  • Github and Hooks +
    • + + +
  • + Linux Networking +

    • ?!Se`xBu7}B~yK8>VmRi`+q`Gr1Az{2my%N{6!Y>>1%HwcNj`e8} zw(6?I+%9UUC?ELZ`X@*|8EhMWjr%jo<|oeIcC{-du~Sv))4}bw&(w|@efm=>yYs3y z^PiCx)FSwB_3)VPQ6o*0!r^$+I@BV*;^Z+eX!0$n+U4p-VDosS|2UA>7)LDvyzfE{ zzB6bRk4;K&h{!fbM;wg~mCrOsO5ZC~k;bT;S{uG=YI0>2L)J^ug5XwPRU!#>L~ebs z@JzP!)B>fX?-Gi*#lyMF&`pnLTNx4Qm}WqfxqJ!xZk>04LE+fD`wU=O;q1s;ygJ|gN1Hhe>SU0Po%Kgj3&m)wF zghiv#vASs(7t0)Yl;jvZvz#M}2=r;Y&|aDps)*%AeZl;aER4g2YJDwjYA#58l1Ztq zNK-Om1qDR!1NkQ@w|*V78xG#^w9LGe_;?19vBX*yJ$r|7*G^2&m-^muokrmM9IaHw zisiiR58RijOzZnfdT^GC26?F3Lh3kQ{@4efH6uK5P%uHNO=2t=dg{oJ_s`^BqV-^y>O7eaag)> z)Ut6L03ylFIW0v!A>^WSi}q6MR}LpXD}|i0nXu!U0E-F#UTNiO>gnijQhhQ>FD2A| zdz{VQ)q?OT(HsXS1E`_t?Ijvth}D=)QlfKWSgHx!Oe8@$h|tY{WG3Pt=fIMiJ~^Ae zwa?bZKSKsF{+DgmJEr1VNdfj z1x1rE4#c)#nq6HO!z7!)oMI4^;iAlTDNf<&bE!d-3KLK8ANrGI_B1Y>+wUwjsMKQp zl*Y+ow|{UN8_U$^VjyN8X$?Clfs(R}gudqK>%Agg5XgfLN1*AICG)Eh^?Oy*ZL00` zqn+zh`q$k;S!f}TF^RUAW&8HPZ2ea>@>28C9=Lh)xO(0_^#Tgjp5pT-X1ez?Ts4lE?Nb8;;&wsCv^L6{QK^*`yOIb zU$%Qs`xd=Fn0VL4c_mr*)|xyy)Sq7GIm>1nY$AD#_Iy@3I4G zNirLijEu7bF!@Mk9ggen!CIS5&aJH<{b7M@cb=+L;2yLP-_Aki=pUWknxIYLhHWks zv)~_!C-kU#_^4*_s1{mWa(nb0`M4hcxPkt-k^i^}diYwE_9As0LmyV|WS`+i5;GLv zCbk*huiCkIEWN}3cKCXcPx|mr`ep6w_)mVwo(yWA3@xJ1W31-}SSO^USH9R4(+jT2 z3l4lZp1if4SUh3*d-CEVoRHcTs5&iUAiz&X54m;7sA?U7?l0~^RWKME6G-ps2?~GN zuhbpD(rCtW*-srEW`EM3{o!|t@;UuGZN2fzqf%?WpX~W%!ud_c`5nLW&G7kcL0p7NcMP>N^K{$U89!i-%I zgIuteT;2<~VlcR3QCtA5FW&210Oc<5#V_zS{~bdwNJcJ5mt4)hoRQyMP@r5=5?oR- zTv7`h&+uO+$X?P~U($PDGGM9su3RvcUoy8|vW#4^E?u(iU$Wm_a-dvs5?paHTpc4f z!;%Hv%jDe!8)focx|4mbObp$R^RI;W(L^@UJ}#k2#Jcm}#fW8Q@)LOE!FfnvVR$Fg zND~k)xr@pOcodp?FeQ437hFrUUMqeE2|1%HXI|#}T-VNAbAQfK`|P1EaHA=A^QHAN z#lfNG{(4o9R{;fGn*vSSThzb=Lm-MzKMJISMQGxEqnk*czjc$x=minHwU9%%6!0?l zzO}l$DulZYF!QRexUH$URqXYu^11nXj;1YsYYTI)_~+%cGdq@yD^LM z&QtSN+Pt*H1_04KkQPAo8Y4QjNb9>RjZ)tu6UWl_#=(f8a46j1X*T47r!1&Ssr+cBA zhm5t46oC)ag+2C1CV>Jd;Pbb7O5ak>$2pL%knj^%0atd^Q(NX!d-+pG>r>~*Q`gc{ z_x@AQ-BT~hb05KTKg08Y!1E8e=Ruw4A?xR1@8^-I=h4jPvGV8f*5`?l=gFn#sr~2a zyXT)MFEa!$vkWhD0x!ShUgmXP7OYQLy_=*h4w&u@&|-0()M9z3jtYQBdI#P=Ks9|0oB- z(FwR64*pRMMgti%YHTj3hvSF^+)fTIXhxH$TYAYVB^A7i;ue-A<2gSeEO}M^f1A zZ&_EH?UouHk8jz2x4G@l)!N^&Z*=+IU7jA_acuR4qTsMQ+;jec4T1=GoKEh!c1BYe zH0vB5xc4T(0`6xg4?G7mMRKX^j*q-Y^Hn-cPN$Ea!zT6Czv>*H{%>Ng|Ne}mayY+! ze7rtdYH~h*6@9+H-2e6687B7n{CIbDehw24hDR5q3_&9Hp$tW1ZlestB=<@S!&Vfe zionzNp^7B3Yom%H^S!5vrUD64$IyX&s6k9sZPc-B9rx66T;qZ?@qDX3GzmgSZ8V9Z zkM}f5lITLT$uh*>Xj2rJ+i6o(gdb?r)D?y3(zW!z(Pik_wbNx9`99EP!OTEH^x2l+ zZ}ec>s&@Ju$Bqa3T-R|ShCI*JZw&e0j@lUt0v;b23PaF^86gqGzKlgN%pHuy@xqUc zCCQ4yOr`1izD#A=b{$ORdA^TK6%ddxb7d*mm$|C4s)M<@w&RhxreR!|rM6|&m!+=# zsDtHu_v0f=eLuPgYr_z+A8X?nb0=%ll<*U4^Q@u>Tg!sJ9~*SVu9K~G-S>&DZ5t%Q z-o6X=WAAvQCD}VqJD%9PF2+STx^GtfIC>tAIyrh@9-lb+;4waO_9Kz_a}J=fbaDQ` z6nW+x#8&#qHH2s2&oxYB-^DdT=J(7sN)`K&dyFo}pL?9Cx{G@P#@6}FJ;^okk!Ol; z&7Wsl=(vmLr|8o&&x|C7DDSKcNdWJh0!ugVFBOp&-g$K;QN9H&g8;roJ^OCHB_qEV zzGbsmQT`RnoB;k++v;xqHOI~u{@<<>q5|ulYXJfq-;TQlHUpks1hzsj#00k^NCE}_ z#IW=T{*4!T72HWy5);}@HwYBk%eLGJawjS5Ik7EBi>t ztXVm()!3L`=TFD_m1zQ|H`kZ}?V@9MubeQtY|QL=rsE7_nluA8WetC%=T5DhwB&Be zp7y8bEoPds)o21QcG2@URZcm&HRWtP(+mD!nnqZqVcngd78*fo^{8sfJM(Aw_?PMD zx4EYL+b#yNR)z@w6vu++X9kIP%rmKyHigKdj8ZsNGZEa)kPiWj(lpGoF&fQ9_}z@M zJXN#tZq3EyFO2e^nCFsHnoHxfqN^ND43HU-*TCdy`~S-rZ@2yLkgU~~A&vbHh@g+ja8 zoZPF|)-R#0Juhr7VJyG5fvs)BqU>&|)xUSSTid4t*gc9_)(2@5qMR-`EuFX`})EW{El@C z9;dAjS&TCjr)CR@r>*}(AZIuY>o%HZ+W>wKXCzO}Hl};q5As*e=ufPFuv6Oxm+8g0 zK$mFBX`=pf^5BOKj9$!=Ylv5y2?q62x zfa&&WuO6QKtD1e$tM;FPuRMkC*bXFdI%Xopc#Cjq4`g^cW)lK=OK8{*6*N2MGJ1H+ zcxn$-+&g~dzw%am!X)+rb;39jg!b^&xz`>WU3Dz= zsD74ABm(?r*aIGp75Pn=QTb0{<{c`je0^bm7%C34;b=YNM-+fYF;~8!XegGD$L{xN zL-9x=V`1kl?U5P229Ul&&%Quq@Z>=&-zyIZe8vB*X5g zvchXYv8o1obW~k`21B&0XjOrFdJt^ z`jvPrT9zk6J>JRTFX5)ou+VsNyw~Jg*rQEOxGp&%xT~0Ay<%AZ{%dS>4VlPM!>BCx zWpY9sEiD7nn4-pIO2#BDy+Gxds#7Cb%zMlI4nb_es*5yl!@o>gG2>ciuIV-or7T}< z$Mrf=(p$oJ*}mG2g5V?&N>JgLXt(IqiFuq$a!09$7!|DCE|aG{EO;T`#%$S}z{?I+ z{0z2JDyleX_*60oDM`Vmx z_*c2btnadaN_|Mnzoq?4#Wwc=E*K{dppwf#q6bj<=w3uHRY4<%9n5HxmRcMgj?b$e zs~G7~LRUNTiEW@fy2FG1Iwe~ek2@h|<}%&7MuxTsfEHr2ozb3F%I^4WLf?iO{nC(z zDEObI;UC_D6T;{mdG*l>d})l+gIyW@$GN(|sVXFRd$^=6Km)QwPRiS?rUd{Ot3Q|R zQo6@C3mRiYEW~rK9bp6jVtD7Yz=;k~M(;S$-4UotPYJaU`1?U{TQRsSH>ElZIW2s) z3baAt|yOKXbbqQU$l8#W1LvP4hoRBAam1;Hl0sSu{oxb!;avilEffU38mLfMnv@RAWdy% z0VGkzs8gEZ#Li0tleX3y>b!Ad2Q_fpV&N#I;kyXe5fLIgN4@ItI&U}`%%|Fa$GF_I zp*pRG;1x}?PkT^}y_Zm9sF|M5Z^Y-r4E8?G2@X%8g2SHS)Z^=#)K9`|rNKWVY;pMm zS4aqtUpu0Kgb<9Msa+vh7h&|(5Q9?iOYlLJf)`~4;ObsZN&SQkedR+cYg?*mU*)ys z8ZTPf^O`|VXrtQtEtTf}6*;;PwU85gD%K00LhJ6Pehq1K>~Ci@VILI|5X|0#2_xv2 zL0`I&DbbiLQRGVNq(JZf=;XU;>k%GCKf$uPRAX3KWL*H5aIzS*R1t()+~TC z@*!wN7NFnrmF3MiRU`Li1Z!(5*HC9N`=eQ3T1vQ@4`10bFh}&`j=)yWF1G!@1!@3JWZ!dv5kE2DIO!Un6hOR{7piLltxu2*LjxLSA!l zKjlX|)0w)Jkr-Q({fvel_uI=s!)m@Be9!O9bC>6buJt1!us~0YY^$$(Q_{ZgMm+s) zOr_cR8ey>_N#qk9=dM*txxa1wvmuCj@CZe_v5@VLi-0Wr5@K>F?i`^ZKxumu9`1YG zP3>@Gs_Wn=!|}g6(Ii@F$hlIypJ=Z5yk^hh2IAoz%+ZK7Lar6>@0+JOy-2ngE6rc^ zIfI1;=g;UKz3IX5tqsk$`~`J1X>`6NcVB8ia=DHVvH~ZH+r@%061)d<3$r%^0BnkJ zQXXhs#AFu|g71SvW^IGKtx9BO^IRf(DXr!yhn3U%%~#sn^2_Hpve>-j>zt+9S7{6d zKD8(-eHMAU6AARcg`u^J*x#Wc9CH>PX5rG&__3|wM0keseO4Q#p~`|06bmNsoZ$*t z5md#hhWDxw!%kRcp4tp%->;o2ubm_;Bfrk0&+OB$-hDBbRL>CC=1{IGc;fF+29{?s(l93=x_$$dq{mJiy0MtU*bW9+w zhD3%H0E+@Pi$b#NYzo$Pve2I-XN_bU7*#5}9_fN?r4M~G(XVE~?7`a$t4gryR z0GLY#P(2BqE4vRno3l6zsbA~UZT35OFftVwp&3!`mQYizp|Ji^+|Iq`fXBlFa5yNfuC1+286F zpoK6zRA$paJZO^(Ca4R@`+*2YI4I*RY)EvlncOoXYPCb$05lK|2yh{U`vH_s%Ei1- zghOTr&_c_gREN;crqhD(sfmdh?3msy<1joxkht;@8t4g*0C2w8oNwh$F#znxLOpDz zS0+5Pl~fcx51<)?Gy>dPVUS{SAud(JmvzE|c-al_Ul_Gvmo01ew{+!SICZTZAfQ;N z=~^WgQeo?wUhK=t>RQE$0OuEl{~f*ZsJ|+(5-_S$jB`;D*k8p8UlXVv;-HAzVF%1o z#F5SBet=&HY z`i<7fDFFXI;!OEwqs&$S8%mJjYq7aX%*|-;^|2LKEM7tBe(Lq;+4ZM(^%=H!hAp)e z*!3Y&^|tU0aaDDLR7I^vIOd1CUXUt5s$%Z`Jb_sdiG4k-Yoi%e<7YbnvpompF#+?X zGgoZG1#GU8Mgebcyn4~BAtj>zdjs<`Gua3;JL|%~f2(34DDKJWD^|O-FqOSDkY#G4c^K zAUP4i6>7#pVZjNNx@h&dXheiC*(>1^>QzxgT0gi}hp*wO+f_z&=DK(}@F%zZxNHkJ zmi9EjJygW?R}#wWY;VzQx~8hI6~Wh3>X>}jEM{L&{FKOs-N`K3K;YL2KLd3o`HqC% zs-+V8AJ?(d;9>van0rGfNH%ysQ3k#mUjhCnJ^ z`rCG58neNquhlgqW_eg4?Oz-EmLyXLNpOG1;z{`RuRQdUvhpGP?jPZ6r>t?M@W){# zA*&tj#pP;#pF>zrf&=vnb0YF#1wHr)NbGH|s8T7Z=(?%Uz+dTL5uZ?0o12X)9#fI(Cv3&&D*k32h{mq8SAf4Ed z5sdy3+KaLPpTa<|iL*|IFy^kx_ldeTy{Ugj(5NPW7iAyy#uE(*%PU3&L;Pjs$1;cs zhgos<>~T{y2BM#<>9)sFo+kh!p0Iy)OwmIc5A_GtsHOryou5CJGHp*z ziXHLK6Piv=-Ng3!U_y#>C1bMd+R_{?LY!E zB)~fb46@?mbkD?H*u_`PQ1*`+`C?h zkxEjvTahjqzHrPhP=8jX?o6EyPzy8L(QzT<&s4248P>uaiP@3}WZu;^--nId4s(g5 zd`ZMS5JO{rfNCi?o-+Be-C(>c>tc}yyCXGp*&H;EJ-Y0G_!W`gU$D;w^59?f6d z#q;$o`~Kw*XVgDQ8uIhXW#e(P0+!zSPGUeNB^J-a+RJEs3dm~ry?61Yd7ve$IAo7lg{UbDwLkW7ZTpX3UPG+LKb z{>e$T$M9*w&}`q$iT+;nAo7*#JuL75l+UTibdYkPme6yMB6iqhw)rN^WaS@%dk*#8 zw_?c;jkgbT*?9`5nFD)R&TS5houq?%j_O{I>hoDkdjy@%$Xdvc+wzY)dXBr^gc+xh zw|lXH9?9|qt|76L(ft1uW=^qBrpZssxR2-ln=r%9JKu9kBK4c+*QuuKNm%m!#(xuL z5~e!M&Jy9zPybiKOi5>j^t)63Kj)8iY=79B(z*U2Nu9x;3nP9YLHj@iSMVRg%uhyC zal(jKLZ6}|oc|GF2KN6zn9=XOG5jyW48^Uv_9u9gQEqEU9eV*KWo`yZoP`u2Ezs#GwEC#(S7rdVKp`cx=XlS?Ygf6UamZ5s5T*+&jC#U} zH20Lje2yD~*_!_?>~Wx0BoqHX81~RU)rUH+_e7BBoEdg_o^A}~=$sq(1iZW=k?Q_4 z9f-iBkj>S-FdvR56OSa-yR;ZjXEPbj)w{Bq&JztnCey#RnJZN(kj>M-v0JP)>Ww5b zxOG^43wvx1=Na5NZFC2~kjV}2UH%NkQ^@5TKDg~o<%vg;8$Eg)E!3Kfn<`&{l$704ABzxdvsuJ=Y!n7sNw-kffZ6qvvQUteBeD4Y`TD75tw@35pfC6Nd$ z>LpPq!a1eT7)t7;FgOM|KVb^&)PKSfN92;mmZNQu#`!GGC4;A9(I7)$63!({WL?rA zOX57pB}eAH(;!C?gvc#V6-C=9Pm?Iktw5J)(Wt;s5YDa0R9@1k$nt%VTZyf8r%{Qc z7m-JqYlOB*ndhf8j|$(CMU#raW;lt~u&u7uQou<#?FhpK8Nff$fwNF?w zyfAec0?TG~If@8g4F!hMW(_5dAzn=tf!$`!&*DgYU)1I3TE1w0mf_RV(y?sO(lLqP z)7G;tZP7Mx9^%t6^4@LHF$qHA*ENfx!|w~~5nk-Dh_!^SJY;zC>)V!>LiO#x5Aho~ zw(dd=oO_W33|&X)S`FQQ$_N;F5~Y|Ld2g=Q82Rj%wi^4L|3}!vbBa9he-rjFiy*LS zGmD~#6f}=vC~Gr+>qQm(8ZWTd_BBx)S;!(;j=tR@^|P#yWx9@4yJexp%by>Sr zj`OgPb)NTLyLCYjvak&#ioV09I8j#EwlveK!?wI2QrNDtysQIeSN(lh*uJ)PufzU( zFS3Y3!w7w+L(@-L5yzG#t4_z(%}5ca_WiO>r_S?X5$Eo^y-w#|81hG#eiVi-mmgSi zA6>Fz2EJ<8H6I{vmM3ItUrn=9Fm{} z0{%=einJ*LUYi6m|4ay0xG5r?pd`BXOen#iDKcN1AXXBm2zy2SDJ%SKR zPM`7QrSRvHqNFXT@!I8O`R9@o!!2m(gcKCD=Tb8LS17sK6;!?EQVS3*8D)eNH8SSX z%B3xtwb~W6p>yfq!!21Yg_QIc=Q3IcE!jQWm5guaGXE#`-ZQEReP7p&m{39s2!c`s zq$`R@69fV29i)Vg^xjJdz4zWhkluUmy@cLL=!kRyQRxaf%(>=VYp%Q7*<;^v#=U2( z&&j8Jdh`Fi@AGs5P1plp$r{|BNf{J1;Ychd8)KVEod_`D%zq_kp*E9-ME99+*Eh@A zxXh%l0Zn=PU&%Wp&3xDqHRYRYmUn5G$@m&z`g-e?0(^cZ^SsYg@U&UM>ulyD8fYd2 z;#2gyKbwUmW+p<~q8P+In@t#KCd$C46s9(tV<6LWO9N7ha+%G21TvQt<5P}Hn$2Sp zGnZCvQBG=@O%bv)m-Pg)rOwY5@bsI@JGZ>c+zu?jxHMM?Yu*EH&r&o&W$oG&VYx+8=-5 zHe*`fyOI&oIc24)JesTQ-ut2l;)nK#@0SINSs9SFLI=(wDi+ahLhpkD$XH&IkV(d$elKH_X>p23lJg^J^{6&o?yoTiZCdYOS8lH+F(->;n0< zH|`^w2E}X~5?i&mxslBifi_P0{5tz;$QES3jZ1y2&XEhUbq!<->*v?~o`h`M5wnHQ zwd$TVAlttN+Inp9>s`$wJI?!Uy-r*8ZqAUMXpo%`=(Rou8LA6Q+|G}*O&^m7)lC>= z7r^lPJy;#pLpER+#MSnmz!lZ|2-7}9?6m=LGOCYB{5L|A!Tm;5|MMXG2;Snb~wwZ7@E{xd*{fKXXnDQYP#$C4;%)Ygm3Z5@aP=p_R zbbR>djq%oE5p{cG?8i3!?^!J9CEOX`m1qyuVL$d)Mj9*EI(_cqQp+|~ed-Ol_e6KJsrvI^%ww5M+2)$9k(8H~tE0`e zI}=%N!>Q$3>h@-e-j(W(wbXw>RvC_D%C$BeE;TuRSsiO_{JPfVkNZfzt?AomMEn!I z@wVn4JCnIGALZLyPQRdPE!X}9l>7b0_=m;fA2&ug%Y*;SV)0+!7@vG?JNf;_xLx}7 zUpL18GeEhN(m~-}-);i9SYIv3&O|1&H-pDjl*q*sLKI9 zK)@s#oKWY$gd~v^0ok;}W|XWnejT zn{Q}2Ew?icQ;Wu!Yg#<5fQ^;vo)05Cu1+g`7?99t6=c`Lv#JoeG6S;k_-2l?>X^u~ ze+J4ejK_^vXX2NeNysctr=8Um-L|CFM;7N>&g!co%dJdhmKM>AXAMnb}#I4pvEd(8b?-+;ODLD_?56hnbq%U=WV-km2l+9 z>RHQq`(J=^7h{!P=Ob%3SLdAof+`;@*>wzxi!N;WDnGK(bxi(?Zb(#B0F&$|u+~Kn z`FK?j&*&!t_lsT{g6a?n*$v|Ki#}%g>M-@ujr*+^{p?ZI5vH=AA1+-C@QznUxsHCO z{&_JdL{JkGEW1fZafy(WuZc?@-DKpy98!#`Nhp-vV%54FhK|=HHI8mQbH5zXC#X#s zl-=e?zZ^A_uT4XaZgaO@qQ~r_YCr7A?(i*Lj>E=lGtWo=4wS=^+ZCa>nhcSzyS*{* zit}Gh#YENRG0E*oYh6vJjMo+LjP1$0U(I9@)E7y}?JK8W%@)bmm#B~JtF>OuRYld8 znaX|9T)LWX8n6F5P>!IXDp>BofZ`_#A>UAwJa%AGtCl$))lgR`cW9yYa}hP((9k$` zXyg8KX`P_4X;ALSA^qp_u6$z)a_q>Z_2Z zD1NPDD>U_xjUNZ`|M~=pZt7!_{}!h8YlD2EX@F<^Ta^2+&oqS12nqS`ap}J{nb8W( z!|LPTlUjdmu}8le6AC9ydo#Gr(FqxM9RHE|^Vg0LVawzXo%w97qFr%?mT6UWR6hUp zo?>*%Y@z&ViPrT#bfRUxas0Hx{rZbOVJm7-{;Veb`oK(~brCs!*3f!=XcyhOyd!_! zvUGg}n`m7>*jmPMB6sc#O1jA z&5ta?_FV~utLgNclOl!oef5c}`PM&yaz7WBZqAw}+K*f(ey;w!IqxFuI1X0$wLyWt zJv(=NPoDU-&5ypEjP5uoRJh*PLSLaKI?fs=u8-W&Ki3I6(HDaXH{a9Izy1KqowcH` zkE1((?I@tHme4mB6P-8b6X=_tw^&bd9}Hd}Ak+sF=7XK$18(xcL-`O~_&~^giFtiV zptsjWU-A^+hfTheC|~LeUm9{hI$l3|s2?NDj~SaTCfV;P%J12QA3M1}2k&1j7ES)I zQT~D#{zBvdBD?{j&;W5*fMiO5bW?yVDnR}sK#@F9nKw`c8h9tfNi8K%vnfy;6{vd= zs81ebz#C))4KjiK0hF^s1=(B#*^vi3@CG|UgI!?3u#{l9BrShqu-8Sf4|#|mZ%6<% zB)9<-loArw6cT|7iNd=Gi6IYFn0BHf`8#p=wuJVZ=1c+SZvpYYS3>)j=8XHlETJ(M z6m5h({f|p%ESoW+_s#z(p~-UZZN@A9O><_xl?XK{{zG&2X9;aP)vTa+JI$(L?~f9i z)4cgk25kFpnzMhegtnU-BhI>)_j?H~#iZoV5?T=J{vRc@f|C6|N@)KkApTq8uyjNB zf2V}@|Al}kf@5`fiqsEgJ3|>ITc0hM6_%eZS~VV?E!hpSoi95ftm4+%t(2b&K`&l)=h0z+|+;^UR8$k0uT;GEl z&?7m(k@hWuhd)QyLb&%?&bP?!cp&AD3@^0Qsaef(^2(dePK~OFyq9i?YU6jD}B17)kIdmp-b*F%ih*{Xd zBKbqy2G>)ZVufVsM@ca%j}`ExRB~(NmpSiY%j#$nOBYN>M~N4ajg>&vRV8ywjBp7* z6>BfPns3M~DaE`~D!OSwUfZ&rWiwXl=CerDdedJC$1lsfkd93i6bCCq^YqC|S$Z-} zA{dR!j2_nyi?PmeYLOd?-1$O0E`L@lV)0uW56~~K`Z5{V!|S`D(U3)2R~0xe7%dIP zL6fU-S{Ykf{VgCeVy;M9B001(CQlpx8W786>;oxQ_SFvRLQHjynE`=uCaQ#NT#zars4VZw}5yH$0PN_`}4)5zB{!2hSg1Eo^KN%1m&)J_o<{SAlAez2qY5JWw{2vFzkF)KvJ$3m= zjt#m0c|hdvAlzN~*u191+ zAoRZ#5SxNMQ2!JVgJ2;ce-DW0-veSCZ)gHEGzk`(k`kKsCviB7JS>MdEDsu101GQh z2`gy|D?^1pe6c_U|`k@K)f{U6@9CA4K!BvpaAJXX{yZ`39HZ!V$%4`MK0#YDur0NrA+Q)6y{!gvcY1eY<82eHJj zVo5Y&@4Lm4r^Y^P{+&2{8B6mZj_y?)y+#~ksQ!5q-y$sT>7^XYLL9r4-iuf9oEq`m zx5VKGI9lm3@vj%+1ux@;9wdmoN)Syoc;Y5}=gvR;9RGSw{nvBqzn)Y7?@7y-!I<9J z-2^t1{#2VZ*l1c2NYbP~6W%9msiqzhFS~$eMznZZlD!WWCj+?pKH)2+yrn);41D8} zO@I#GeM^Ti6(aI9hxqpGg`VSEsC+~YUMz1vqZ(0|dV&F7BkJu_hZi9lc%R9NdBvY3 zO@-^s8a(W88hB}N97(K^{d-zo{1ycp&80p^3<_R-i}u0Gqrs9wi2Rn8|0V?%=bQGo zyOjb{OASeDeveBT&12*l8j^>9kI$;hqn9X-QB3=uP$Zkrsy;NV*77|uoId|4p@TTz zd|ae{n=#&2(FpeyaYWlMh6mBm9s}@9M4#+7eq^&O=l1uM@ixQf=`5lq1V2*eRJI}I z8lpA^FH%r#1-!8jIA&S|qfp9}uhnccnf2~l328-t zI+DB_l42p+5{Xddgy^G$9$~@-C0`HDge$x}e!2aglnxdDF99@FbPf_6fG!%m{GB)4 zw0GQTYDfX7Lb_~LRe2i`nv0Y5`%&;&zmTe29XSi?O1J{VMirpLASouy4DzMq!f9B4 ztWnE~EcpJ7jKjJVfY9%00|!)kekj#wwuq@Dpf7Xi-`AhgM7`cWEw>*tsbZx}&E_V~g9_7_EgN zD-C}2T@02Oyia^58+yv&n}zTt3=GB_G#^#;*#09eI&)R|4}>{q-2By7 zFtBK4rDt0j>o8C@Px9<$fmXsDXp{&BAj?M%MTetxtFBoj@-4aYZ&bZz&j#t6iN@c4 zsCY=;FfvQOs}7Kg5hCv6li=u5^;eb@GRlt$@J2a;8$z68dzZV_e9~r&gl-{<>6X{h zKFEhgpzM29`$S%Rvp9$Ys!Fid()^3g`|~s`c!$FJ#%WQr4W}QsQuF|`O4D%-rse#S zdar|)7U54%i{Gsr=-Rf-JOSR0D+K0&D(=fq`dqLYGt6yUTL+Fa4Vx#fqn&a!OAp!% zh2M`HwbR9|ZLV-)5UhL=C({B99%a4Dr}!*aXHfqTopA1`I;Lpwg>SQH%LNPn=2P%_ zT82l`7S$4sk1Z~J%^^0RFtN()aeP(zi-K=LoXk5z)2B@@7_X9S$IW$S=H?>sF>0?p zCES%i)OGS&jD?R_oe)r#8)LaqN6Wb6zg1tF$gei#kz4_`eQ5s>SYji=ykc8>+6k)@ zTfI}|T6^|7y6a)@D5%DUADp=dX#9MCGity5-7hjlr0tYC_EU3zyD^w4-=`h-i&qV# zU5*~Vf+Z9NJ09x-!jS8V6cdA!bj0PEA5R=#37l3tE*>r=x-Z^A6P9((eb0&JHw-+4 zZUkQ+$}o71Gnh*hGPZ3ms8#i&W2e-3>q$jyo6$lIcG2Ed8x!ZeHmc#cs3Y~Z>x1PA z0pPN{>@Bj{d_0rDi6HVpTXADSUwC$}ylZJ?C|`Wt^c3ivjA4 z@@Qbt_-^*Y+xpB$nIxvg>`zGT*+|`BqTcw0!ng>}YzA}cKHHE69Donpa?sad(|5U1 zguKYN-NauK(=#sE_;HG-@3|JIxUVn0e^H~~in>=mjT7a$_g)YH1EN8CX3d=9K^g1| zDzc*r@O=gKfCf5$;r6`U1W*E1@y_HiU6k4Hn=O;tnA;k+LrfoayM`2Ojck@0>6=J+R zDBPYGq?lm3(C2rbC(QLiC*M>|2n1Ngvgl=itZs_tLFN5ZM272wJulnwjANvAOr?nI_|2ympYE| zcJibo_1!E`_u7o34zPX=gI}Q;K=NXKZlduplGw*i+TaI@csL^DrU_I-5`wRM*dN$& zEJ(;a@Oe-q!Rw~LFBL${qjZ-xHoz(2S~B5?Ax_!Y{h6dA7#e-oCFb#hymg}a57T!> zG$3q1_(Vvwor(&L1bAG`eO3%=dunXptgVsnt+%WDb~~Ay$sN?4=zQs0t{!;qqu8@#=@ zXo56ttk@nVrqwjT7wVl?uF>!?q^EV!0zy6fgT2P zB4UME?Vpw81P$gCYviqJcuqBX0`}8jn|`m%^8A7RT#dN^i%?2N^O9HD0!-!@5P+03 z;j1lS4eU_L5{c=+Jf8*OIB`Srkj%>>ae8hQsy;1~0ar%}5$7hj+hU<>gWMjuktwE0 z`$^C#OrZ}e-4D&;P8ky1*e_OsQ=DV!ltFH$1vIi2k6?C!&j;vg84)HYs@TuFXQU-C z(U&N9S@;eIBbgm?rQeRA#O?S*e5EB8$s;EFifK2CC4ePtc_n#^8eDLvBF*^fec{H% z!m5^%G&gt_zRAh1D4XR3dR!Z z@cg3B3^rl|Dk`Pw%66*L7YabyJ7wY$3aJMESeZw2QD(;aAJqIKWYmF5jYr3!pVcdR za2)Qwx4OTS^n}w0>ziw=Oiav|=2Wrtf^%(AT!$0YTzFz(N2B|b5DEK5H7T*mTLY0} zt1yQu5RgW=2TFNaH<+exTR*qB_q7eC#kAxpv8QzWoxg^k2e$Fy$XNG zUjoh3*4Q<+PmFx6i=M+ zM?FPcA@W?Bz}Oy6k8z?Z7+TkmRhnWC)X1 z(_Jes@9lg_)3RG}l5yI=+oy0tnRaClh&Yq3&Rpg%8DXj<*}KveC`!x`EktH5Dj zyy1{vxY}jIxle~&PE>Qu%D!I6Inxg>ON44)4qj_X?k4p zH;xxLjYEti-wb;oMzzY1N2yM7sRPEgUW;IjW#M6s;ZX&J&yM0}OnzIISQ48oKFPhc z14pY&`5H~qB`b#lr#6b!pSX?PwH_@hngG*}$PAi*GW_UtMmg|jIMHmAFFj|tGG=(& zXI@cF;qMUg;LpAqoe|9#8^fCw&Y0z5o8=grWj~x1lN&CT9VzlKc&9UmlAJ3p^M#HL zX z`+R}UVv*-!NycJX`(nk)V%7Cx4b@Vez*2+GQj_OWOU6>0z!GocQrF5-57ly?!16%* zqA9+_Y1JQ6;8P*ONw$>gvkMINRzL)#_&Z%3Q|k zZu{!z>s3_ya{W5tkj|Q4PKBHYiC#m zUIS-ukP3gMfB%`y_cM5E6ft7~7ax3vYg-&1dkj^DfRBzn5i zmOG*cqn4m}v4h#YqbnvO_G!nNfY?i(*k5<^RtijfqfbcvY$Nh!H;Q`iRtg-ayLUU; zNXp#1l>(<7t>?59@#7HzOW%o7YfXFQNgA;_|Wm`P{`6c5D+){ z2|~RQT>**+{-h)nh~ayTF|~Hs1+L3Hz92XT$sc3*05L0%!OsE2H=jCGN{b_G>_#j{Q)9ADyn^wlwN>igaIKX}hS-&N{l|M-J!?+3}Z?-pNv z@S=Z+Pjqmt{gCk95qy3k9=*X?dGa9d0Em-?qe+8_HN*1ds(6Z2LN-{uvXuwYb!Fw#rbVA`` zfyyxvCD7=M?l7{q4rPU607(v^oDXHD%I}}}ACN>%L93JU{Mi-KREDM*WK&Pgz*V6f zjH54v;&wMLXPHK`P7&C!<^;1L%^N%~QX%jGw5k))aCb85;NP2UINs?JSXBSto@~55 zQ@4%p%jdS7w;UX%iK~=Ei_TL70wlXDg)|p{naVx|^Cciu2f`)+fWsZX=HivE!j|6r z5pz)YIatk|dr3IB-BadleWFlZ!j8)0_)w|E-HyC4Gjd{G0Y?xocqwJu^R$qjxuvMz+=pX*alZ|ivE@^Qat#Atsg3thq>_}c; zGm8BCaLGFuPXeLYasXPHMU0ThCJw}aCik-Flky}L3(4d>PV=EyVAig5ywO{*%nKRT zPy}<63PQ%e=RmpO*_YU!AqqEEWuGT+!)oQ&YDI=dpS4>&>8<`w{{{WL*1+ihIoX&Y zWSjkcvQhus+iGF6Ns0RbDAaENFix|t|4u4wAFrmLpQHA3XcORpkt+R)?%4Crt=Y#4 z40$)DJI{4uN!0)b$d}yE>!LE_TO#RLAC66=IY*lFRFz6h>PurKvfsRQ4Bz*cg3UkPSPS`c)K3P8R4O z0et6s{JbMK5r{rUSuZc5XMVq$mSuCox{ZZ_IF5Zt=K&CV{ekgQe81raApubO7xpvw#L;k2}qj*!&QGcM28=Bteuak|v#55(z1M!2&Nc?YN6jFYo zlA>Wgj829nTd8G|=k!v^;v4i|#^mM4dUphBYZNp;%qVQls*5lbx7d^9>4{8>2$8lh z#_pD8mBdTE<%&z-=4Qy&FgIl5Tx`joyqg6U$UnizZ?Bo%dLD7lRMwd9UD_X$jXjQ% zuO3W7>)*_GIYTH+7wEVT*3}fYuqkpYcGNI{tnb_xX94(J{D)?&YMu}0%GK(r&L&wE z%S%31h$oWd=?_BPrPWXfqB5046K!bA{aYRFeZGE6-P0EJj}H@x#{ZzfCp<95YY%QYwVTVkF3xUf_ zP-|TLCqKu4bA@xerSAD6vJKCwaNM2gr5qE8wYqxP}Tw3`W^5pF=$M9F-sTx}8+Yz-%sgM-d4mO?3>0+AAzRs%kbqAo zb~qLAtn4WS!)NmaolDeL_SFaB^YtCh6|O5^^swAf{emtv$twq@67Gw09WD)xD~Gnh z?#o+(t}V!wBiBLq)zc2wj`NkT-dG;%pf|7{ven~Y36BlZPS^m?>bK}%k4=U*Zo}%U z-;)PDwz)dp#$8u`e8lqH6?+4pPF_7Jlf`!ru=lU6H{MsswVU%n@0-(3@0;_r+u>XnfTZgVeHR92*Im&rph_3W zs0-7n3oD=tJE03F?>4h`;r4am&355$b`hL(5dym*B;7>x-Nc;T_e8r%RJuuxy6-!6 zlLd5>Cv-o^>wZ|*P0`m)IonOO*-d@Y{Rr4YL()S_-$TdQ^H{WpUZsb@sE5%>#KAv= zDWQiYuZOj+=Sg4B)7c)j&7Nl`J?FM}=zBRhdtZw7a;o%l8TF#MoqBl!dU+Fi zU*+}k)%EiC^}e3%71-<*Jn4M{>=PpC6Q=JI;p}@W+9#^gCuY{le|SEBD%=Innb+OMM0uWHn<=G3nq&<{=M*U0PFtn1h6 z>(`$Bi=TsJ;643-0q20B=zx*RfU(hliPL~-z<^o8fO+14Mcsg9-+txUyi0~mn z_};3ZIT8M%hyWEtpb;X-2@xEC2uVPM<{`rB5a{qeM8qs2auX4Cf`|qV#gGie(htRP z4#kTOC8!J~8r{l;hmr$^QWAzz^M=yuhSK|nKFkhfYz}3f41EL+XORqN(+}rx4(Eyv z=cx?m8x0pY4HpIs7bOfA=M9(C4VU%}m(32BZw^>4P6p=7Gls7tDH#*WcIyyT#wmCX}GCBbqntVH0fWa6w;{w(>}xOD%l?A+`>{2ZinN(^(#TyyWl=2TSY zRE_7XoRyguptdxm)fu6aYTc_Y<%`d=f) z&hw^$^JadS@l7efW8q5_RkLC&aPV`PsSO7J2$7#WZyJ{=Y*pwUMHa`76a# zR?1!x<3FRA?ixOA`IBNwFCX@2ft)eV^iPVZnD`$B@-wuN(SJrU#l7{d{r4!Q;aY!C zOgH}jL@|ZU0Py~=E|6#AnM(FPT>M*s+!fJF{d<8t2Z9ck?4x`5EksiGw*q+|Bj2~% z0(lNeq2%uca_DHz{YFIpGx)b~eY{-q!QTqx_HaeM+=sqJ`L`o=`xAIB!;&=W9C4ht^Dp7c$9g2q_rzKIV^tRVXum;O`Ca5Ntc|3eT+l<3 zn#^eqApi(vO-T&YLFJiwzc!Qup}a_+kh_WdglJvjzK_a}WZ^3Sge{Pn(FLX{Rhv9-#7WlMR|b?H7XUsi#OPIph$R_G z@^#+1vbt%I~5$NgfL@Af$ANWpvA(80$s% zb5o?awXplBJ84*B(-vcV!SNZCw5+uJERbBdQOr|XF_m`W;`IH^_-PeOt$mBwkdlB> zq3dn+CFz)yf&ek2xe|lwnkgY0ryM`hO|fZSWaD;!70vriYLJL>pZ?k7Xf|n6GMUAa zDx-`-F%wahywS+Xm&%%HbEY^imr~KQ^UrIYLSGUV4^8J-mdLl3hzNn9K~J5TSW7G< zPwEOjOA9v@_}Vz+@y8TiowcMCm+L;B)(p;@t%#)x(c;OG6Nuz_yj0I7(qN}GbRU?F z;qz5yy7k_fG%!1@=9vUs3sw72w3G3L@4qps76IFXl zy=IXqX`-!{W6=s;ejnoj9W)aD9`0I3#_)D?kly~g2esf&xn z`f-Rg9YlM_XaJ13U#20ow_g@6pvTPAYSXtyO}JcNjoaD0O#c?K&E`5i;>=k4aWK`C z&wXLid-Y}ZdD#yCbNIOKnPcwVF*8wxtFgrKTi0>f&dWDx(=p>GLO^^o*Wj9gW)-3ul?!*zPmKw3*T~rzBUZBzWBqniEh%)!nB6FnSS1FMKAHzy_&2l35V- za}l+gih|eqFU}8~)t9y(S~+Sht=}{>waXn@FXb-n61Xx8>}NMHO)?aIGM_0`$& z=klpbV@GesS4VgL)ywVkwtgx*x6-BMJ?^F+TpMc-rsY+LL{k^xk*!l>>+*>gtOs}e z*jMZ4=ZBrVjgJYwMt(`(Tt;u#54Vd%$JQ;=JlB&Q1t~_S&E#(LHoA@5d;Q2j=I-!g z!N&u~f8=~w-VuERpY*(OEMRKilXPvFO}sfNp`hBAiEf#%9Y4)hp!%Y=)`CpET^NR6 z?;AenpX^j{082gy!y59ylwm41iUw$tBv2} z#i}VGQS0-(`&ixW;J+kfGUPHps7mha`xzTGs1>U^5n6mXcd*^wr?%H{kPw2Ia?7TiM{E6C` z@V*RgM}G_U<|6alI`>*h_SR?e!GZbUVLN|1_qoCHYDk8}h`Hb2CGHHS3=9ThKycE} zeKW}XXn6hTpnmi)KgJY4<|aQ@l;6`Pzd>hT4s4QKJ4i=?2hi7_A={rS8wBb0f9dOi zKtlM*JTTt-SQk1u2D_ZQx=2HDbF+Rst<0G?PN?Ii(*&yQx@_=(bB_aVPcH9xZDkNn zQ0Aaqp`djhg1=pCteXNQn*z8b9r*{rN?lUg*j_f+!FIbrsuwP@MFE>+K^W|qrDI7n=OBd~` zguxE}90L&Y0j#LwQlw}-G>SBR%dvp5ZLD=vR?2sIGxbCk7aGP;UpS-kZXv*N}PoGBzF&se&N8LW8 zAE$Y_DgiG2QpwWSRbWp@V>8I4&$1XxX2F)kR{0Ab?<>g$zQw(pE$xvLk7=LqRD+1Q znaIkV1m2hh_H``pN^VCu)#u?PUV5Jjfj@GBK}{eMX-N99vj7jKkbcCvs}i$C&c};H zD;AI#4*>>I?Dn9qUXvr&MX1wx4nI>ahEOgq4>;B?*J&`5t5BLKHTwl$Er@$x^v`EFZX-@XyP@YgCMi)3NBnIOSP)pH&3ra`>hdkCK%s_=$qZ5H%tggb@riKoeLb9ciI&Jgl3h%PIIv5A}d^@7GA-MLp?`|)6W!PMMue(Y90mzcgU4GnOO8YznYMgmgg1wWRC-CzS$QX^Xt1jo{j z4Yw?J{qzH$41`67WlaW%B{pcszt1A$CInF4UwNt+oB;-onOdJ-$k=SSqJY2V0 zIg}G6w1^R$5bst7kaYGg2K{hRs-}nGN!Ae}lHTAX_nrq%T?CpfS_l{$ z1gj_J9oVHRuu4alglMJ%UhXyU@PSp+y~q-aOkXvsHhJ1m6xs3nXiAmoSmdgf)GuIr z1(Onatm^PkO&KWS25RsGa?P+;*F*&Ee$w# z*tg6)bcYqYl}$Xm=$a9LW z(B#f6%W{lZz&;CXf**!4)h-ClbY||s(k9#~!kMzLb}>laChzcd&79}%iEUKDX=&wM zCNk8A@JW{3|I~{C=o9+oFHPk1rquBnt29v+j{Q$p+b8mTnz(t#LBS7G!cc9FyN<(7 zMJRZHoMvLfxUpckB^!17&0HRJf2by|)lg%q znUkRpP)W$A0GvxvlJDN+Q;)7ngPq;_h_;XLMIS|VG1#}e z5eBJ6wPGs4dNeDjzsO0gM^LwdlxYH|Wyd-~8Zp1MA78d#@574dGsh_45g)1<`D0PM z?Nmju&sH&8%XXM$ozu9mDeTSzE0~^iq_umGPjc6xRYoTZ;MhH~b`e(0RQ7(@nuno$ zCuw9w7XHhOX$!2QKio}c8BqoA8QqQen4CL5JVwVq`AsF0Tmw>PHNtpE#MKCS5nRh^ zO~kL&HpJx7JJ^Pc&h`*`?ZIx{_ROsh8$pnpg>w$Iu5a~xz<{$_@=;#Kr-Fa>TLiga?7^(oEwmhn+s@Hw?hu;laDL(QX@<}}>mUp$C^E#PC!*BqmRI#Dd} zE=@XEk57sib}0!-*o!kR3Ca6amy1wC`@CoJT*U9Tf^<()3hQL45Lc8F4O6xLTTR#s6^siX$)NzFqL!pziDV2Q*ow;seq=l|L@i?2Q#$BD$!AkbPk&^n zo=$^j+Wgy{&-{ZaI9;EunwxA!K3f_fa!^^O;f^vg1cymV?#qK_!JDtnHxC;SrAsZ` z74Ct2TW2sQ!KO`hXipFrXrTXy18v&LcJ23=G5YssYd- zszO$CNI>m2;}aPZ+v8P(3sMXMdo&6VQbCA7zDM6Ogmq{S^3CCS@+bZm;m@KW8faE& z&POs^5`@i^GF~Nlco&`rLPL=rQAR%hR~@X8lj+&_lD_fSKW^+fzz~0SABFY7dcMo&)KliQ{6R3{pSb#dO0;w z(ThyyVc0N1sULQFUN`$El7NOi(-J`V$>%|Wgp^b6Xh*Tibl9&2OO&tP8|l&x<@9#1 zSiP3`NJQdS-?#W?&7|K8)`-e|zV@0BKaPexb%&I{A#$M~C4HaqV8`}m^x}Xf^Xq~~ zlXuL#i~ZN;?A4YYM3_zI$DeUz6EsW?#|>Shosr72;Igit6U_aAo=Z_Yw!Y{G8IQ=X zkqX!2ja{2DQS+6*rui!J^f#vYuIHYY&++*Y?o4dh9(F0fRxFt?mVfP{BW^1(8A5({ z@#ig>gtA2dxc@_nsp|AQr~bz=EQwSI{oDMtEsY_UJ zSlMXODTkMlM1@hdJTr#Z|6;SkqRCeJk13|SQ{KI~E`4z4_YScKtQ?iQzt&Iu<_O{W zQSB{fU*_8hH|5!1!@e#K+CE1M2%H{m)|Prddem`odGKY;)*JoH>jG@KfCYJTg#lEg z1;#*`!S2g%!@K?K;woF`sAXtEfs!wt{rePCHotwk9YJZDTur((qMV11TBfoo$rh*H zJoK(3lBA?ED3Q41@H9^Hk-xSwZMB6Phje+?2M%^tP^)s~(~m~sFI(FBYGht?QofYs znBaUV$2OvUZ;X3xb9#*T(}%dRS2#-+S@158_(Xf5yFZ56N`FmDzs1c6M^mxI@G1i2 zu=~GHN)oO7;H07NiXp*ys9F7QDW(ikd}{u5id|6C#CkPN+j=f_ZP&SabzSdME~vh_ zH5RR5a5-1@jIMEmhUv$^e^5--@-}Mz9g6829hV#zDhpSwJ4YHtD=@M+9zBn9RmnB4 zOVX}2pF8)P^!*5Lcs>Q=1xe~gQtF<6Qrc4uF(6>`;xYIu#qt$p&XX{!Y?Ev{~Fg zQ%pZ{-2YE0rkJ6o!9dL6jL4@hA;)2OmAsGpb|TH}!`)Wr?}y$CMtmEPuwW=0^84^dr35ZP)sicJ-vSV{-Az*=xZRj zb)^xv+9S!+6$-R-cy#$lLcS4{@{7(FgMO%?i7f7yXMh`F+k-AiKU#tp$7rwLDWA_!3)QBFOJ*E3!?44ym)a%}^2OLrfX;5&)p(R9G=^AQC zX;3-@MWjo*W9aUoyF=+3Qbf8N1W`m9WzM)_FW25{t#{Ra&p!M3m2dNj`+xtg=ekq0 z)1l#HkyM5fxP-cpvxM>1%;QV`#4<}b|FD>5U3}IqTCY{ci1~JqAhTYQ?Tf{<7;(8R zKWecTFJx@*fegK77H;@IET-x~AJiOtu}Q_Fx|M4#`>0&X78^1r5n_hJ%5YL?*li&K zD2wThw@Wur7Sk9d0*1)9g!H6hwE+MXJ~69aD#bklWtE>Srdz9a*jr%?IzL%VZ|^@} zwNR!H_C=iA{a`V*$}y8~mr48-k$Cl0J3R}nTo`thA0;w#9jciij>f^sm~&?ZL>;9N z1p63{_`za|D;-T1BqGzv-x0t1K2@Xw9PsXhEBH8y7Z!rJt4tT<@V&+KR!ITRW8B5W zQSE$j+UYA^9>K}fOhyuW4VNGIKg`ULH~-#ZTCHWx^}WS(2rq(GFqJ>ZkbQ2L3RYSBVllmU z6O#EW7Souqq=&UD-&;%xEmazOqNk*$e!*f|UiIkVFxnl~->{f|(0PD|vY3vo?FRgY z#Z)t>#-2Ic`kySO{JLwT55>cfFIM;c5_+GX>_k&?UVbL~mBmy`Z{xr=p(}Kl@mcY} zV}(W6o-Y>DlQ^iucSy|B-uNL$6cTgeqM0DdV%ocMTl2zaGcoe%VRcn2NrEPGDc(0X8Zi#L}JRep2k(`{ri!a?wy)Hgv4OoyHft^NX#`I zO8fsHB&MCgx1I5KA~CbV$jFsz8&AY}Mr%-1%s(SBs{*nYIxUDhMZZU4Lc?ZMe+Lo+ zCldgFhs4P9sH%0b8J4Pljl>L4sdskiS#j&FcHIYdKllSkO!s48j}1xB{n6%1<{peY z(l# z8$$c@NQ`nvvSOmo5E%-Ip{DzS#7IVxcYTe-sKk}`U;k$$Mg@2D72+cHPsqnN3(7YO z$~Ozje~$%aAOn*Z@x4^~QYN-Eq@5^f*Z2JeGF%NrJ6YqdA4lk)M?T`$2+)pKuIZ6L z$XocN*j+A%nqFEVo1kEc5$Ph^$(O#fXdc1e{VLoZo=v@m=oZ2(rtySheP=-#7l-*2 z`%!&HAlxceU8SSWuumNz>mMEcw*a$4JSdvk^0iuvZq#rMDLZ@+pa7fvU z{XlEX%5xn_85pPy)CIBFGITB8YxVu)5 z#6UA|i@k~F3EY#x#Q|ibVq24fdH_IHLKR{F3<#1z^JN6vlAuG{1vEy2f#BPNZiaTe18tL4_|; zX^LPZ1theKkC5Agw1s`>R!SNb5skQUH#J&i_>WR)d>Bl%(iqM7@W!KJNKEuENTolT z<=y^D*a2&z%Nqi-*g84MXB`H&cNm|X1D(csWh^vcYyR%vFCg*o$&nQ zS5j$5Rc=oL6;Di*RGN=pq4sx6rT>UCkd4?G>h0T;aA;p2a8iFsHE#9sv@p=>gd~wriZcpS!v_IVbN2dCs6-@$k_ci}%6QpTg3?zJ4D8M_ z!M?WF^GIZvZ}-YVD^@^dT#%brIOV)YQN*+wgpIheU%$OFwzXJ|Rs94eE7qBCfhh+Z zk|^)Z_!{J2+;f{!rPlx#nAkRu%Tw1o7_(bJdf~b_AonCnIjb@e{TBRIZ_to8Yy_kY z69Y^>>D4Z;NLFpzMT;;!pP?qM}~GuPD3;* z(^Xk2c>%7cf}66{7^{;h-LGFUH zX`V2PipgpghgZd5V3-(R@t#ZssFx@BDVyBcyXVVDR*L(kSn5z~B4T8i z1(|Q=fo6^Xme|E{B#m+9FbM=mZ>Ui{v|5~tdYI`|FiCOU3)J-)=g!rc$ayi0!j8Fh zCHCdnc3>SF#+;SZlMuq!hxWy;qSkhEmYNs5YKvch165wKM8O;+if_n>IQ!k1KV7%2 z@nT|g+^*E}QHuwC#uL%_EC<`>l)$YxC=t6f5D8qAcySPBqc6rZ@j1>f1(_41OG)(L z&>xsW?6oV}8KQ!d?8KhuW?{re`9O)LGsW$0jvqn$1F~xlH&~%Kc8WKbuGXzZ)9Cke znc=Kn@fquqCR-Ds2%QJ1=H$_>KOvt`Zm2$ z%Js`+@7dWn-$*_89j5jFD9$VxFOTKkRQPqh7w^0Us@xp9#E>w{ad@W$^pS&oi2 zz4!S6pg2g0q0G97JLz*2x~c*O;owj>>sSqu1b+OqnO`A! z2LO6J{Wh7OP7%ASpH?yRhPy8(dH5?9qaBT+PmGLph>0?f)?x;e?L!*uZhoLmWzY0m zlc|TJ*AMi92Ih8feDBO3r7<)WNrvh4C@vDbgH^C}4*M%&7m`OgHJ=dxV2&?V4_1#* z#I!;zikN;Cb28}aArGZSJy}f$>i`~fz!jU~wbAy$ntBK2bt5m^dQXRriau2Qw8>IT z=AL0g;KsT&tI%^la5v2a(ihFbtXG0lp%O7v274P62@01wt(tuj+jQ2Q+_oPhl=1=g|O7M41 z2z*03ya^6*z8Tg_5z#;tnV1lxl^Exon2?y5)R34mm6&#tm_eD8#h(P%O3HOk%1=xx zY)C4eN-8}`DyK}Y=wua$o2oPL~`e%g@!X)68vBppDNfi92%)Xu=lFgTtEzp>KcRE|>G+TrUE+&8ipW#w2a7Yqdwh=Br4Tqk>m8f!51aj20bJSgO zG?Q|)gXxLta`aDg9#G{P3gjAV=bF0YnkVI2Hs)GQ=RP{kwV}$h709#G&U0|db4to{ zY0Pt*&ht3UQ|^fN6v+40&i8l84@}Aro(_FUR+k@snh&EYh!QA>(JqJ+VD6px$+wPL zC;D@rO5f%y^B4c?Kb5}CSN^xG6a7t}O8@-0^h2n*d^XhtqMN7jLzqn{>TxM*o#+SO zdOCxj;IH`B_ab4Ta4^Ha`qnSyFiOkxsr=|$x2U{N0R$9>=G-)s>DQj#i>o(IWHG4h z*F~)pwStLcy=4ZfBbPaljJcdO7l6t8dp8EF5yBpk1J5*{CQepIan~gdK7tmI&hF>( zmED$yfum`42>bYZdWXg#i!9r|IgoLt!MwXwsmJn{1QpSdvF__1)5Z1}M6e2z)$`#g zYw$pkCzVRx0;5t(Zut^VMu&s6Mw`@5=P!MNG7eZ`z6#8om38a=0%%fwa_FhyCkCbq5t>g~DYKFjDbji}Yq#*(yf z6v+Txpg!xXsV}OF9w<5i}*i7!qDIqgFBvENs-Biw{Ga@VLz76 z(wd{vU=yI0QHb7#nZ-F=e^m_O;&+|>GGAHlQX*PCL-fw@=(%_1BVGTC-{vd-__dzVxcSXu13~wupaR8d}a-hv?uRQ&IDkDa7o5@1-Hk%!>Y? zN%NV8{Gux7anskAhQDQ<=#R};p8PxJEBOrlCVoC&`Nuz%xF(*;{(QdjcYP`)P;eai ze?4ERO0Vwn^K~LRT06p@73X%St;&TT#>{_raSoRWL_)ufng4ee=U=uePbZ|xJINlt ztw7Khy{#PhW2%w=gssYPUB_=*mA;JfnJDf=41rhlm$;KZk_LZV-vKKUq5rhLLwYa5 zi%SJmGfW^zD+7~e_N76ufYXup$_xTBqcir&_&F+Nx?`f)5-#O1M@I);$gzzr=Ne+6 zmg#SGQvp@&_tP8p_ET5*fMTu&3clUz_o>c`M+_)4DN+JVao1zZ>`XcHWReWubtN^x zL%4DFWFN{#CoNu;XZEomwiN>>uMVs$Hd6xZ8~sw3Le0WznO?d~e@we5A0)c(j3n_m zB~Ayh4zrWBD+cdA&EOC<2apshrIW;D*jt#3Ff>v>Q`*m>7&ITf*_RmbP8C#}fe>Wl zR0(miV`7+-lNByhCMqRiB#I4`eyl~2L0b)T|c%EuFduoL=2Sq+qU`^ijdp2)Kn0u}kX~##6w{vl` z02mQEOseD6qonK|@~zqr$tRL#Non0#LnZA`H3Hk=<*o{E1J-d#yO|FwtQ(o1LMmW- zLz0!S98v&WL`wy7y?jg5N<3|gkQ0QcC=}fhS1TfXWlDCRpzEgCbfhO33C^HKM3$(N z6lz4m4%v0M15Nlx?}cn0)?9js0k8?VHm(iKYnbvDg@@=edDk{hTC3jI+osxp0vqX0 z@+4pAPxs^5 z+_WlQ{_Nsm#QjUh@Rmh(MUVcNW47b=bjoruaOe^~aZvtM)Iz(S+IakQb{Q_un?Q}? z%=l?^z#?m)1s748kqvjy>cx`bCN?Zm-8|j48T;jT7YfB26ef(aLHW@IUpEXq)AO|$T#E6 z)na2SJ$W_$%0s_KNBnB#^9nzKDsX)&&Qkyh>!wt+L>U3y1tvr}4qd-*d-zbb8}8K! z^c&i*GuR>pt!{0pwD6DSAHH-^Y}yPQIHC3ADVDvIx~2Vo9bU?6u0tud?YmFPihC2j6@A z@>b>Z(h2-OHfH{hH2Bq4<^Lvk^4HR!@Xpnb|4C!!*kWgg#5c^Z&{24wKl!2>`D)CZ zB%Q~HSjC4Y!AF2kc&7GujhX+hH2C$HdBV-+39z&IP1kw~_k5yfP66MKng2aom47dH z@^=>JOg3Kiku+a#RsL&n{txcNIWbzG;b+{5gjS3ciaX)wE{pqtJNZM!IVs%x(bvT} z!);o&p`pJl)Wj2T7-o6|YAmow^03e~%PW)v6^HQZWyAB!v2b>X)W-f_N zku~5wN|dxn62*!dlL`j3-E6p&C(!a*A!sr?WjmAsHjPT-LcKKmqkY1Mlt@o^%-3lE zRz-meyB7hUh-nvAdwGbL6+QHgGtj~|ZM8r2JL1Agbw1=t@M_ZloJekBt>r^%Rt5m8 z(JXB@-#|2iQ=<#Pa8@rSIWukQ_^s$%zNT=6D%#g6r*?eIO^g5zSy%>rXTI1gMsb(Z z*SXWV)Ho>D`t%ZMfWSdvH<~92v~1hK{17GzSgTgb?ndWg_sr{ zqN|pKfwc#vrxxZM6TuVB_>gQ_QUpC_`@I&bS|Q}>wgGwnWVgU!1uU%C*vNadSNpIs zVX)Ygw|{DgMxr7Ouf$whZh9o?u-XsEYN^pbjl#Wa%EL;m%;aXKk<*8@^@AmkzF&^7 zYsD+I36PszraG$sdO1F<)GkkM?n^g2IaumY*Z+^@_#V0c{%+Pq<$4zR;HK1_(^s(Y zYB+NEcL`gPvRtf=Mqv-#s8)N*{&itpYP z(ev}VRxCEYF``e4*oyV-`LjQk#^n_SQvOOeTd#vQ;Ymp0Ma1_|O&=a7A3jtXulJd%!MJ5IZxwhe43e^#IVxnue_?)d+MWBNDl_}el4H%-mI8Q9`||I#s?&R8j{ zPkm&QT*e@Wg~^;iX8?6fAIM>@%jnm~l!pc^p&P6&}=>QknD zQk4xd8M=$nJ`{=B3O7W{l@RY6xmsce#`^cm#<9-Ni0uhy81-5*J653luKLj@GauF6(U}FoYsU0k_v?-dIKRv9I z%VM<&c&_?mU?XOnU8AogC0{Cen%AGOuJR?Yu>}_w&AqGji?u!|b-HX6q8)zp!k?ef zt{3D7oVkh?XrBJJ29_>49(R~ka0E)fCA}Pd+^KczR{#lYO-~Nh*4F)0pMDkCexW}764-vVKK(O+P2&Vv-&o6Uecsj& zLmu5o=Ix&idANLIEx*OXKOYZ&4{O=YgeGGy3DA!81#0d^!!0og!7v%6Bo(z0{1Y56hPs4qw4h0Ntg-XBx!_u!&|K|>CGfhp)8;Cyr=J+SI5 zYJhnF{ai0nkyoLLG(jG~bS@g~K@}r37>dK=6(xrQYbS%l0DyJp;owU1bV{!c2_;Si zSAd)!{6U_ibl>&hsD1cD?M?Ao&yl#s{ha34=AvN0<=FQ9Tnx?v31jWcX?rAjB6x*L z0kUe2^!xO}tc5D^eWSSo2L(!D%wAEUDi%rT9ce`gkls(>8>a!Kiqs zusz6g3+7GLSz;Mhq`QI3UOs}#VuRab=7kf@%p3V0c*PH}ia6|vP={!Rn?r94C%X&% zE5cEI9)sLe-#dcu47`&3yDZ=Jd8l}3sUasmQu(FNvxez@iHG0!c`xv2(e(duqEU|3kuUuQ=JZeZ&X0uDh)eIeWXq-HVu#2UAy<-|*fCKQvy}qK* z>`_;bggoXJKb74`J8JSf2@o8SQ|gH7d9jPf?EbO;eph~73n2WlC)VAB?em;QU~>sC zUdke7v|k&3xQ*r^%M$KOjCQgi8+DH2C45!C4jTLqsvO@t^NLK%B-5>%6;->hsK3nHxbi zVTcUWTf~3#d3ZA1Pfx#NEw5bJR8Bq}&4<<$Y7B0vKR^BMS(=%`w)V{Fc>PdKspH_b z{@Lk7>zC`g!dt^Dzk{_5EWTa;zZ?(EpdXWFKCS=jb)7CYiCOwSbR=XxGw1eK@i3M4 zQL{imW$8hwtDaNzdE;acYRDt`^ILPp=hG8Ihqcc?@7P2xzd_P~YX-nhf>G<>WgYt-`w`PiG z(=+FX^*=pJYyD%aCGxNIdA~azGX77jC7q^=&{usPB*9m<-dFw)vX=Pm_EukC*PQ~K z5&~R)+v>oIiid$5Q1YM{&7e4^poD~=r23$RZk3edpbU!OEWTj4W^k@ka14pB=1E?3H;M*9b=EJ%wA~P#3f_{Cf;CO1Z+$V2u!CbHUCN#_E+NvcI8DMUZ zU+~HmfiuaPXx|nXdXdX>D|XP@rAqmQRTo*UNbo9Zf?y5oM*<)OsH3*6f(*={;8rLA z@Br44xz4T~iSz`6Ge~!DE(rrH;Xs&oMxO;1fRJj~KT0ZgGzD^}@g&KX2AqW*nJ3O` zdBu&)H>*jMUK9XQ2~QejqlgvZW>|g|VPz0wTs}y~ob@Vtnu})}jKNq3@C1&I@(DK; zC|RSc!~$a(n63Q;HxmJ_;0zuV;i()TJ65O3b%QPyB0Js?lqV|+5ZUdN^%4NOAm#Mbi0zw{TXY=)3Rgt$p~oe{)`Cn9 zh_rH$t>d7YL4`+J{ofUgUoOHsn3|by4{vvcL2Uz)5i6FawYy$yPk*=wkLj>E)SYD~ zP<1|^#Vd2_DXJ~<7zb_8mATxr)!isPYGSfwH-TSVIGsLf4!wQTvhYy49)l-$@c8Z~L)Ht;S&eP)#5dMdfyQl=2eB3!r zTS0*lYIveq-^CGL5o#uH6jQ+`$P85ufB2&8%G32O%8$1q zrILb2WsG(92$Rl9pXN|y+|j;RANo2%2fs=_>r)bQ$jLwp+U=wwxpnU6&PcA2m`U@}?;K{5UcL+G6|GE~xzn#RCQ|yg zX%6qbJBrWD5~>y*-yw9p@YO~5Me~G5eJ2C-LofmVGTF=eZr-5};jW)nKm-j4Y3N>5 z@~2fsq+&y##?W5e^G|CWKfTuZ*94h$@x?Ov z%j51lfBqtz&fV==={mhHbc8$++zn9tw0s45j8JUeYcO12Gs-_1ifG>dY_|KWVgux- zO~pSYHgMuqp8#Jrze!wAL7GoQe(XtA?{#(3i{|*RzSj8@3DRoP|Ir^!kh7=+Nf8vq z_p=0ktAP>4GP%j;=Un}-w?>HAGVKk3%^ySP8%iP5Xk>)2;>Xg zJE+|-Z!6B|j31t-PjAv(IFV*n=&jxSAGFf`SX-y$ZZ0x6wrE>A9ZEKyOc>0|sv9 z35f3X(|*1H*bd!@?=BedT2x6pemipKBdRiG->FIm42}q2kR4`51EgUnm`8ai!}Msm z04r+w5&@%ffzbUdsX|7;R?w^P^ZZnTuzYFh;A{s#1~piLDMDL$5U8t~!%=b>02T=b zz{JoA!U~{9qeH2uF;cXj3s9BmXcpB$K1AWG%Ct}|Pj;;E%SHW%%GBkc=mB1lW{>Q6 z<(G@PLXq}F-*|1~L5aQAMd74Al*r*qG(KYb4)=!lw;HYBa;wkr+%CsG$ zW)cCdt&AUhYx=i5Psh`)j0Sq#^uFD_$Rf(u`gb9a-(S@Kw?w$V8h9Vqw~H&Dj{M2W z^y9tBFM&5t@$=Tdn7jmku`+$O_>lGMi~7q)nMeSICpzDc7xj9Y9p#w{KhEO zOqv$$)Xq9=@6;{&v%ITcjeGd6VKcYrUE|x@?RU?2yT3j0e&344{%N<9{PCv`2!^sx zdjq`hKYbjQX8*iDs`2>q!K7K)=fhdY_n(gz1K7`xSK}X_pKRupou9s~dw+hm+ry6h zv_J6}`T2OG40-$vlpV*zxvA)?@<=4 zk-qz#-!Y18j=lXCYDTVMC7Q4Y$P5@#eM~@*4AB$X%6g+3LSt+I6CB`ato;;vXpR8@ z13c9ySFSArH@JHm=$QCA<7xq|Ol>C@pG-%k?A}%7#vmGUntlpyH&$i=aUvC6=0B$E z5t#~K818dJ-_L*&F^XOa9`;wU$hc&mFOdrL3?8w~qM##^@L_^^jNi@%=@BvTGQ%7X zpMWml705o6!1aOI<#2G1$QjA1l1~|dc)1}^tgJ!z)2dvN9c30Gm@n|{$7?&63RRv| z55_@>0ZXBqDtTL3E*>$3nmLhbRekr!o2tGgDu3RAC4AQ}6=Fr8wETA!A|tdSSmVpI z!0`_i;tJKDI6~JAtg(H6g#M9H3{t+HG%>Kw^Zd&ZI=m`nLw-YG=Hxp!>e0Z4(AmjL zPyFf(EQL+6E2lqIi2sI1C0A<43b~T`U+UMg=lsMdD&F+6zMVhwr9#B3d;KK&Y<3e` z*ZB7^igJ)aDEdi-#1KVPS?4OvU#SrP9!BwRsStlWLVK(+BAdRh5aVBdTEBz*&W-wu ziOTY4iK=BPx)S+$H{y>liW%hAgkL`@ank9p{&|I%Pjlb?r}%~bbKfEc_EkuEMw<^d zF|#hBJhLN!@P=#(q#~;;gyOd4ETSU2CjulMd{w3r{LQ!c|3Uov#sL1eTyXy$-{QW9 zDC`;b;g{VdqfX!MR@w&xIwOkxI?uU6*m9|-)fK+ldX)3CJCgxECb;b zB8ss#USXu}l~GAkiFLCAUlW$;myF_!iiufe)hdut+p3I9l{aDc3X)T#w~g)?prbPh zg6MceCFc8@Feo}pu?ld&CcjtHKXUn)ym%>(uSaIcHtA!^rhJ~jMDLJ8sBKaa+j*npgR4doNP`G#_5F16 zK~t%UhF2mEqbb*N@=?o9BT>0evxvEwWUdKF#TD-7OxjtYVp8;x9Zf;E&zF+if>tq&=A7>5L;bc?qx(j))ME=(o3^0hRQGaB4~kUqiZr^W z@0IWz6mLtgsP`7CSBc%rv&JyfojM(VGGt%u#Ja6_V0o`x#lB2okXhGD`!z=Uet95< zIT31Is*~0scgwff2vunL$Q~y9nJfxhi3Y2~vhd*Ll6Rk>0nlR90mk(VW|AQaLoQ_1 zWpt7}G8KLb$ZGGRMO|wiy|XD4v6Zru&q`@?rZAUAOgC6;1@d_wwDc&twwCT4@11^y z&H3?^mhw`bnI$cr<669t15=i$D-a!sD7q_&8H?fB^ln^qEqXnhYRyH(5h8F6oizr4 z>N#}VpQL$@+r*TBPf8`l0fYl%1B5cjKa>vTkgm-r=I`iXNXN%M^X z0FRSKb$G3K7ZJjgg+u{U1!h2;b#=usXHkp!v06zy88(13Y*67@qP^Y?&aBquvQgyaS5iGyD^tcc zcVC^oN=c7?bE@WCczbA4OZ|l>(p-F@qSrh%$q|%1Y{3#$?&mP8jcb6V-ioa71G}ZZ znBPB5wfLmK=He7;(L+DmQQ&;nk!E^JuVyp$+;((6@!$eM#SFIsVMIg~sh~Rlrimh~ z%u%(aNvL*2{2JmFmhFr3o^`{JbAsiFSI0*3_Pg)px5j!-$a)v(_oRggyKg)T4S6qw z6m?;C&n=u!UN^C8jEFE$NEbepUEr$8d=Kq?eEYM_BYUE)Fn!@8-F9>s(8$K(Nv;@X z<^!y{hvGnu_vPmePzpVLw`4q)*~HIK|fwKq?`84(Pqw*G|N&kcCXw#AH4 z3)50WiBOInDuD2LQ=@Pz-{4-L!n&#P^%`Z3K!w}uJ~V5}Y~#2DWB6z=gS2&5R&~G2 zV@6vHgrDx=q62_W_zcp?AqMq!I2rz_JpN@p53l4aYcCq%bvxjo5SC3B>2+lZB!i-= zQy>+ECpDuA!Z9GY{waE<$K_T{QptxN^oEOdK{p_V#(~-g;HLl%WuiE35_6H{02{F* z>nCK!*iPCeWQM{RHq$X)EsKV5fM)W-|IcL8J!G;GME>PsqJj4Zt>aM z*xP~PEe1A?a$-n zP8stUuMZup3+szFZ=eWIo{+Dlkcx~0>~Kg~D{0prUF^KAToR4`X5$7Jl=)V9Ab&CNU zK%i<`(ETF<6NGY4ojyuUPi{hRCDtnm;mOOWlS~me)oET!4oN#yUg@&b?NM+#(H*)M z3#^EKQHukT_EzRi=wbk9mj|-vJI__eSNS;w^=dOl24yq)#56oG)goj~Q~)pna0!i8 zC7vO=95Q&FKv;>^=B^yPb{8q^bJvnqxRkwu3^8sQkCDUxM&0n42t_z75Ow|)-4ORg z1*pZdYDdG!Twh@d-)Uo0-8E;FqkdQ>byec=gZ463HH5z_sKSMY>LiIofS^_W#LPR|$cbj8`nia(NVp&=pD|}$e0P}~w z*$+WWh&+l@C|*p@8B2TLnZiA3TQ2o5o5D>#NWUh-kI!7z4aarGK6S4)ov_a-8D^OI zCK*lb0pNl2ZWn~q&lsx22e@xoU$GN(dW|!M(RfFdr}*U}~9YGRDtwCEb_E(QSZhZg^;zJ(6L@z-fhp zFg$hrh$hYLs4xM=!w;TOLZW0GTx7GE1(d04a6IDd(2*c5I?NzE%ZxkB01u|rXH0|? zRQV)ph7d zV3t&z7M5-m4rm&+5M}{djW^?*ZZt$D*BLS4Y6`9wAv3Hloe`umYUiB_lWQ31)a#J9|LABz_%wp~}+G@)ltK>L?b0S$PlW$p~f zF;G{du48v3lczhQ+)oByk$4v04JVe2ea4@0nKW57t{Ti-K{xH9i}S?l%6;my+eFg!DU&c{FT6ksz6@_93@{3t$!4U8;-C+oVsTT= zP{1;C5KeyXJJmF3SO3{4-)-U{A`cilQC4;oksXvsNY)zaSW1I&llxR(oDt(XW*gDs z6SjQ!EoonhP#e0qDzf9&5J@8mNShZ+Qf^n97s4s0=E?2uwzF=pYr3VjXLeXGys(M` zh{+7DU4@d;J*6NE5R4DylB!vj>|kGme5YoL@_8$+aIP5% zcgJNa1DyZ^w3KS7K=3C&UHelLp-lpBBpE>Tu5ntQM|F{f(p_J_yMzV;gvN^mr_Wm| z5XwOa;}36)q|5gt!p(&)I`oiWk>Ftl7Er?2i)8QVouG>dzDIl*Z8M$?V1Lfxj;CIdwM z1852TeV6WioQY_<+1y#IHg_12UmQ?$$r&0uz^U1lH0lT8ReKvFkcX%|0U-XUK9M04A@npf6n6(Zydn79R>g-Y)&PCU@Q1dq_ zuZRRKl3xge)(QuEBV*-icZ!|@y7btQVahk%p)D|F?#~Kbtgrh?AI#Xlc8pit0gXP; zc#U&$R4#8ciP2{lShQN*LAzE7byt%49LH2L^47O(6PS6h{rUm*xS`;<(O??0U-24u zW_0Y>Nwjwq-xyg*57;f#SaAH#4%F6B(^+p~+ioIvQz5Xil7ZVtxhbeJ-XKtR64OuD z%3au+bf9ERcU)I38HBcXwRk&8W6w1FTs`z8cZ2 zZn~Iy+GI_2yJot8btYCLkN(YcE#8dt#N@#ZvyasiZhEtkCbNjt**-mJXNgj4nD7DN z+=v3fh~C_o!rXZ3+;r32tl-=na&T@^k6`KZ-15%cYUV{;2TB*;4z8~6tnN_HDG99|;;rosF5F97 z8!1^-o?lZBpS#btru}Zs=zQK_eobS3PK|BdDtuk@eAP(*;tbxp33S6|e%-XR7h}np z_7y&0IBJe^6SHkYdT7I6NTCTSL*yppfmN}I^<)*+Oz6kdp$m zq0KTE{uUq2794*oSAQ$tW2-Q2tGIcqbbhNGx-3*mMBV+SHk@jMbwh=1uCaOb#k=h$ z{kbNZx9{dwXIVGegf^z})=%*khM;ec!xj+lwzr$M$Duo;gKtmt=DV8T&eQCSE4)45 zA*%7%UT34i#@`|@U0mV7T~Q*~)+g90#mN?Ve<*}YDTEuDfsr(f|3PRgd;VQ^>(WR4 z_n3}h@2PKXUqH4^-dB4keElQ*2?6<&RdR!mG!F0HWfv>z&*_G{qF=_4 zW!umeS;TC^eKm-GL39ybzWS+Tt_Fl7oxZn=!O2;VDq}!wL`gg zh9aK(I%$WF!UrouM99UDBIzfInTXt>qq&}?>~ak4a*Qa@sk_ut2pw8Bz*b}!zwq73 z73|Y2#nar!+J&V!Hr=NM;lP;Sgb)m1$?lf>!jfNt`Aza=^h}%@z#f+Fsh~dqcOJhh zBB7mfyJ86U#k2kXh@~l{;%9pZE}t;bir-1n{qvX)1Vj3BM!UYDN5|$g@9NnxUMb)z zChWgx!C5FhSERroBEtYEm(d7%VO$)K0*lCsdShbn6w`?S8oX*?*ppmJ*&SgI1-94n5)x~^g{K;b}X`qNb^ zt~)?G7M#`)a$huA7+9zxtKLCW2vkHZDI9>2!6@(xG$8WD-k zPwfC8Zi-@%8<&e>UGwD-!(o7zi(O>zT`d0zH+?<@xO07$te#-6E^7Jt_R; zUBH%I*E$Gewvp+C)n3W(EWZ0@Avtq>`Bv5sa<;>RaV075L zCV<)`C)Qpd7YN|e`6M-`=s6{jtq8bq@eJz~bi$-g&vC(zSKoOfr%vDXeQZCC+fj*9 ze%K}23(T2>L?Tho2)qyEiK%5RGdzoIqw*lQWQ9vEV9$b7Y(q&KgOH0!nk?!uDmXd! zw=I+hU3l=hyfjq{^GF3AzXqd$03gYnAiPJ|DlOWfz>6i*JQn>D4Gz-5w0nCC1 zZ>!<4;sUs2+HE=xqHA=wXX#0Gt?9(PAE9aTYZSSjS2C~^y~Gr9S_)ujc3O#$7II#T zkFb%raU(ZU@rI;am15v@o8~mFmv0))n<_U*FxSHD`F)q_1b*g^^@5cHnFO+oL5G>r zC)wT!^dk!Ubkj@*ya5uL&LCPUKUe|HnJTv80}Nl%IULzXg&6!`Z_k9q0$En)zzBqN zu?}|$lFXk55*-m4cQs~z@Z_cgd=!q?I7CTpGB7FB9U%Krf%r(UUw z=U%?nv7nnHu&Pac`Kfpobsw|6Qo)>Lh9Sp|=5XpYOPMW0bSi-oslbK;TB0YhCALhf z{wuvpk0ExFs&fpE+R7sLiIl|1=&qxkW*N{N)JqE;zKVDTGzMXuFy@f%8GsXUx*(jQ zm!f>BRUl#`koM|pbKpo!@nC0AVzqxYHkvVKmN*TiOaMe83Oy2=^%7^FYH296Y&5v_ zE{<%1buS&xYlNbCdsP_8S~OdOteOxeTzUitNA$zQ8PFEuk7I0!SPn8ES!>|AG?Fxd z>@?-6X;66N@H&}QUdNn}oN56PM)FpNR+bP}r9^odyS49%$IzRcSvOPu_rSpheQErW zTXM9=m++ihJ1B4PjA$d(j4sR=5bQzF)X-&8N!hb#>d}^-yv?{`zHULoEo*!ceQ9Io z9X)hxR+g9`c5Gp}SD>{f7qnqWWk7MHkTgD;%iCoEwQp2SgLb>TGz#vor;Ee}i^}Ay zQAm_R80;-_WNUAOUi%8%j;FRa!R>f(wt3i}nQ#*=$~^28#95JiAS2m4ouCe5y7dT6 zL`i8cuy5-Yeh^p$*ML<8f!mE3zA9JRrbVDknJ2WTRlulhz6wa+h;jhNvPjlgB3bY9 za>i3wnhJJVnQ}iziG;?h(lJW#g3Kk#>bF9UKcr~v_2L34i|F7x!9_$;g$^M-NK#mw(BdGe6~$zofH@VLY*V?A zSrYGd*!8}LWOm*!lD!2(AIF96t^uybWIK7cjsHdBq1))&k5{f*1YT58Y|*Q`^HA-E zjLh2^(hcdZ@`w1rs@ltB*~cAR4o^bX#3dS!MT}UrZdR?z{RV-C8xZGe8Ycq8n{d`X}%PksfjTo+P!UO2qVNj?_VcWSE$A-Sk+QzkRXEXG`%hZ9r}JL5Y3pL;d&D z6HS@!n?{)bh5VLe(JGt(2@4z)E+)>0-4fce8i_4bn3 zCvx!F1!#XmOV*=Dbu)AC{T*Md2|jk2n3+H7c5FUqdhBsDvw*~OYQ+%RMPhg`lM4Y<}>~ZSmZhjK(IJ6B`415RZmV>{&V3s5d+|MP>)b8QLyjn( z1j~I>QrKlAetths+I{O@i_3W3{6SfO`&$!X*XfD*!@3^#clIr=^GC?}qZTZWT|Z&B zW%7mN9%+xg*cP{S-i4Ew0UrA~!tPrd3#Su39)~q8?(ZBI&K9tq9d`+P?8Psj#zLQ+ zj)b+w&sznvY}!9mh-3*5oU)p1**gG;T0+qeVCW7om!+rbyp!4K~c zsP4Ga*>QKYLvXc2Xum@k*eOENDGKfsxEQyDkmiF3p%OEqIr9b(c1Jx(z_&hQ?W>K@n59=FjR_thSc{hnt) zgeM8Y3ykpQLik7^eAN(s#t45qM1U_MFa{9>M+8?RkRhFj&{0I#Dk6Lz5drLlk@QA_ zd!y8v6F7Tg)Our$d*keS<9&M*VtNzdy-C%*$(_9^qrIvBhrPG_iaT5rEeohZ6DSA{ zA&}q%3BldngS)#+A;CRBaCd^cyA#~KkN^qpURZz{>8Iy6@bXb=Q2FwQm0b^|jXT zdG~(yvptf1J(2?)&BYzfqa6LgHkvOsTA(^wXgXTtI$9h&T9P<%^Yfv3)G#zVl9cvCAYe^hyEf{NS7;Enz>zE(w+#c(? z9_t2<_u!8AQjYhrjsFxI?^hikFdZLs9UlrFA5I(}DHtDZ7$55&ADP)^LUP0Wc+%&Sf;m`*IZPC$bvmJ%nH3no^M1+86he~B@#HONbDPpktc;lFVw z|4>eDvQ2J@O>V0yjAWGVkoNDoPVOg89t2B6@+Xh_Cy(bRPqrsduP4udQ|Gu-7nD<% zY*SZaQ`f3fFw?0U*Qwj!sk_9f`+}*5hN-{(Q;+jgPuo+^*HdudGyrcJfod9&eHux8 z8mKl6GMh$rn??zlMopSVE1X7eoW>ZKezh?DdS@CFHjM?E0prbJ4^StX^1OK~fD0nS zd;1EXYK9{i4%PAqtsY%Oeh0E!U%NYa9nG4HVJImRy-x?ReDb=8%4hxX&!ec$^4}2w`J`BglCeD((XJh+ zWWApyo35Rh{9L!tj#|JXv;DEF6#2rqo`e!Oz&LB8f)7`;!!nyF@mRf-?-)l$!W-UG z=TOF=^Gc7-`Oick&uoXP-p2w_0RTkd9d$%$>A)78WQIH{rFe3%2BuhY%SSV0nq^A5 zSPF`+O!QAw??aTDOw&-~wiN>D#;xCnr-O{lC=x`ZG_AjU*tq@%tkCLnL`O?EbTU_t z{|06)NytE^Qf z=V>>*Etz8KX45Cni(<-5c+qi`GQg@72y6WmKBMzTxC_xFPUedI#!?aHs+1aQR?_+_ zsvvnmts$qx|`2wN1GBZ|UeQm>uQEHUdC-m?{;+z)k?edSGtV~+yr@tL5SFw^( zi3JsCG&}|tsnC6t9!Fn#%c>60Dh$V6wn}KWr>vvvwH4e7PiWCjri$G@l4R4t;r_w? zKHQr@<3MY9kTtdvEud1_Uk1Dk*Y9uQ>OE2B(@qtj7H(!mI28$I0B^S4w3yrNJK2d_^D9pkR= zwHhkUO2%(Q4F9<6&T4Oll3#b`gZ;E37vY?mF+tO!0OsgVQ7D(j0rMV%$gNJ1cE`rV z1lxmrlNX}?$0lLm<@c=A!_g#lrc}(^!(7i7;<-_=UYakNg(g=1stz+om-{h&Oc(yP z%pKN9qA^p2Nl=B)Y4@Ns+ltMrYJyIdJB<4tIN=G4o~2_>5HHFrrn`DMZXQZaQ` zzsfn%jl`35EI~FJ5~5@T%V6}(CQG0umi{uKAZeXbxp6I#lm{zlJdmd`ISZ@!9I6|5 zz0b&QDEriRsAkYccHGlgdY5@T4t-fFwj-X<3b-!aZ4|r^+(tEzm2320LxMyw= zO}X*&C|oim=+3-@PqmCzW;!S5KkhJXxQt0wSqcY{j(?uw9!JV@N^nRc;~uIT7G!eP zV_w;1-{77#IlV}lBi)mkY7u0${o~%O*hW#>=-xl!=HmYJ0u^|dhL~>Z5}uCD6?s>n zRX0ubokyolJV*|5?p|2HO?PJ0KCC+T(Ceo^&x_I(L8N9~(5K(1*dCF$zGnkhPaiOg zT^Pag`=cM)#uK_bb|*6Lp+Nv^aHNL#0GElp!q_%KUNKHl6Qh$;2rea?!jz+J9{k4sbP1 zpv%{6F6DTzRBmC$_Y1EJ^cABMF3WAcWO_f17An+ zohwE=CimB_K|A6=Un#bGMuDK;*&R0fs3ZH?r`S5(V$&yoo%@0@L}Q(v>=;G^m~O=J zfg0n295E39Bd$(p%1&64SjBGIh@S%MA&vx=IN;l_z&wpE4zQOvx;%>8M`(cZG^X6G zLxG{nc8~L${UF3zkRm}yZdkC)uvue`5u&o@cCHJTyQ=uGD`&Bp#(pqjZHPL)w-zlp z|F=_on6rbq6*UMb#AV*tW9`ynw(SqFq6OFtJBbZ@vO`0;B(1a!gR?EnE^)&uz`?e( z!7A{5*GB)Zi2h%RN&*0s+U$8Cwtx_ZUd(hQ-2EX;WpV%x3wlA1tdLTe@eq1Q60q#f z=Bfzo=G=w^A0gde-AfAHk_Md4VtbMsrbCXVLk{X)LN^(TK#Bue-9{pUqkd{ebu<~_ z)Swm90)z~s@T4LUg}-Z+M7G>0{<8d@7asD*<9kPF6k=YKL$Te7kcO0@Z4ND<11KvL z``v8M{tL~wWK`jNLODNZ05C6%NLkab7>5%Q#D3>dKn>850=uf26>?z96ne85nMsEO zsGE&Yhh5Y;kg1b^Isl+Di)ABA#AvEnMK~Z-6XOEal7rJZjyxt61&EgG3E7RigcHVp zxR3W&$6)icgb5)F`Nz4I#2GH4yQEq`@Z)K$%ow$>KDou~+$4&8i-U87c4}go#76U= zCF)Ek7NfXYh1&{QB*LcAsgn}F4F=mDc$PQE7lgU}_ni-xfJ-g3t%?BD!wbM%f?Gxnz^1j+Os1 zbZ}(m8)g)je$$Dy(FSDRu%M&Xr1uTVZZ7&OE=3I>r+sKOJL!>KU-H+6`vdn0K+5C+ z%KpGDt!!!kY$+j~-|Q&>HcxaTGxXj-#JCiokyW_36Z!#;Jj66i8a%`Xjx7oT(}7<= z04ov7G_Rc+{C)+U zK^kj#3A3OE&BQR=$itZwJ?K4MxW!i!=2? z5f5Rpz)09OmFDq)!B_g6(|pzZRB*h6R(PCTur@fX&D6`IgcBZTR{)S*l7gg`MzjBnL~T2dt8}&T$t%B<(=li38QI!o;K|sWxU7%h@avOQi@c1Fs5FUe={|t;Q!Y+#$?H5vT;*J(3ngrDHF|BX zz^CwgI%!z5cQaH5z1uj|kO6P>NAyKqulz~baY!lkbQ3C+co<1F+Y2V9L%e8E&snD9s?B~_3c8TK| zLjkgyR@wl-Bm;opuRe35Vorhn;bGIXXbv+x)g9ZY8eE(5Z7&B`+YxwCg`{nQCe#c> zXopz5eBO5RN?BjZdT{qT9se#sRdQ7ra8!DL#wFC$O|HmbQ(?HsfvEHa`4_^=Ot3Jkx>^K zf}T)27^@Y0t^MX+7EEwwlb#AVLM_Q0kwsmyA8K`q+Nzrq_0%O@IiVhQ}fAfH^U$@R9P<#L&fl#MmS=^QpV>Niaj9CUsrdzWHAn455Pt z9jyk~`8R>pYs6zrvdb*{OJAFKLUK;$Pm~Ivp3v4BHhfzwteVRE( z>cSM(`s?LbVOw_HGbW0UZAlx5HWL$AI*LKiU2R&n$pG#ZGX+SG0qB}RlBSmXGN}`9 zOw=obzZD?n#c%K-+q8#S>x9FmS6W}&^4WZ+8H=POND#gM0Xwh4aa4u3dugTurtN}> z2uj-IT{^Plya*Ab;Wgt_R=J-z*Hm)D=slA(HJ4{Iokp|Pj6CvP7aGV2Ht0D+5o@Yj z8bVoUq2Ui}qC62IC*hAetq4_S7?G2@V_{T};jma#bK>}vCa(Z%Gw>uP5u?i6r`gyi z!Ju@!OKq^z?H_QjrgdYAX2+XsZ?N>a%>r>|n|ccJr+A4wO<9k0gq_W9uc;C9Qf#HI z7~9T!dfT8^vRv8IIZvq-Lfc(ZnZ1+<0;hvT^h3qphQ%=<6|s>Up*ylwOF)XDay{_$ zL#lOHWgo=b$i5!&qRcTRr4^zbLzHHx;2^q#mHr(JaNL9E{vlBih`Y_9teqvh@W#9~ zeqHQ7;ttM-3t{-{dNNPz?dM%L;%j_+iXpT|{iWF9lS_PbyGr{#8d#hKY4Sd!# zr{It(@JKfHWSBQ+vco6F613LXxvrdX8gPEp34QHQK3zuVvfqtVOTc(rPy05vPkP|f z$qv~ml>1ad<22Fp)K>EBqUw~Je=lKJ|EI$7M!q9J(CL8p9QFXd@$$GM3iP)>2~+Su zueQcII~QNx_5fiVuDz@a|ej@Y=HZVz;wG|`WrAqIL!Fnjj7;`Io6Hy2)GFVu*$i%e}{M9a^@s>>uhlA z>URstx%KG2_1d`ghTrUi`cmHchI+CMgUBsAHr@5D2)t5 zjM4;+Ue6e?|CyO;Ae;A*t2C@i_IoJFc_{0C$Vt#6-8BN|$>erxsV)@PFdO@X5Z1#9 zlcpZdgQ}wu9+icP1`;BjFz7(vYMYl}Mj0UY;^oBm@O4%JUakaX$1 zhf0BHD!bi!f7+Klg=~JGXCSfazS0lz?_}cXss}1X@>v2Q#A=7CWoniB1LNdGHICsV6lm`?tU?y;QnXGUQ(evaTPq}-NfJ0*Ahm!$JaYykPqMe&r3*e7v34bxh20)t>>+9l(HS_u+|{!fx` z-M6v%Uon$R)BX*dkCH0#{fIh3mSS2bO_LMMDnnOXP$$Ds-Onn^*t}gQ%iIn8Eca=M zvR>}w}p zwo!b8Fsdd^lNfObz5Hjn_gWS?AspIP#f44UHq`?hI(E%FO*#(UAc8WppH$7dE>q&1 zdT#$F>6kTZdHkECGr(!!bGxIVWLRkXt^fUBsusf_ED0{75CZcSqp)|OT*lvMidu{# znFqN{V1W4+lNdo{ZqqnP>Q>VPMG0=RBn|UcvlN3+Zu2yYqE_<^he2+OEce}3iyS{> z9?QHi>Nd;#7zrM$!W8p1tKytc9_!NLqBgj7dG#QV&HpUvOiA$CHA2nX?V2}2dF@;G zirVel&jxuNI&XK|9lGJje2%>+G#!pVu_XDN1_&%VoQB?o@i~vs6n8j}F%R*%OmOaX zxJ(J6@Vm}P(sa7cDN6FckQ$3lH>g1vKV;dWxD&GKFvRb^=DyeIzTt=RUnL!jF3-K3 zFafWF;^Ho^qv|1nuP4oWU0=_-Q3Sm&hG@FIucjmgePB?FZlBwYFhSq@z2a`)zh^^& zeowc1-F`24*bo5X5<eGP){f5ZwEy9?PX?V~( zpb@G#mk3VsbTEyW(SMb6M2Q!tLpl46Fx^^2$!?~@1cAoj5H7Lz_%q>>V#YX0En?Ih zGv5@0jd2UP#Oc*%A~gDq@f%yjnIJQf20)XSmj(&ee{-m6SM-N__Hs0gbqoj9QxtGg@$=q3eOH8PAvW#Rgt@-M>jX zH}l1UAZw)%9@QWC3nh}`)+$MDszn?NrHUces)amiW$FuM8UxnqjcsaGkcDyskd5X5 zk9uA5LWPC6jrKyDdQ;Ovr9+5~?hcPe+u}l%`+$u;tWBfqW}(^-WNQfG)$GGxtO*mh zHTE2pbo>OdjW)xCn!$VXRX$*z1XzaSRG<#YsRay zvbfmPJYZ+<)~>UDv)J4XvUd#O)!oF0whW2eJ14d4?s7m|r$X#q3wiYp)uCm&hoINgmZk-N{1;m=kkbRsB>Z=pBcTz@~Fn3b8=&c z8I$|+m;rLV5gmy+Ys&Jtg@jA`LWem=^S>k==<=ldpi4Ha!$RP8dCCvjH5bHhDMGL^ z{Vz#pCMMLifQsKrMq_0*Wze;Vy^_V#Ze=b9*{wvJ-&!SQWxiO#txT=cTK(T89ex{a z=*nXApj(w&r;YyY3bY#;QWL^&YfP}ZG$e7eD3ESz&bhig6$)u6lvZ#M}FMiOYhur?Ie6^^B_n2csh z*B4D>aJd}*8mTXy$`J}ee=E~aGLtWrK(9C2P&!wvlrNJd(^$4pu32xrHriMYtv37_ z@m98}V!7UOu1s&NsdBa1aceY7wz+Dp-Q((TZLGO^quU<|gG{ca=FiXYHw^mYEwx)i zu^(i!}b8(`|rr+|3+lEHjqB%%JTD&L3S zb{@hKmG{a*>L>Bac_`O-9;W;7PqK&eFriofTait!YI~=PNW)k8ghNt;tm*%6XDe@q zhXfujV*FnfkfTTsix6MNhRYSa|6f$)ao@?Zj*KXHUH(U8GyU?PNhpnf-5LK!Wb;rG z-NY(H1jkTBH$prG?N1@&zbB#Oida)d#?5)I(x#(|*ovhmthKMw|D#DTrvzUbW+r1* zs7S1**bA28>i$QQ;7d9zyqIrKTG4CzbN0>4-}Dh3e9GrV;d^>47DOsj3|utHy~8aL z!5CHY<#5eL<=+>1E2A7v?3zQERU-aobS8q>HJ|K+R!Z_=CO%@m0LO<`=EJDU_p13q zn(tOJqC8*XM;i+1JL%+X9%eHyRf`1%=;TAJ=W>XXO8DO%D#W3y79zWqD*2SDX2~r4 zV1<<^S6Zu7rmIycER<{8(Q8s@WB7Hv(K{}Y)P|NVHWe*o+xnF2>=A3Utu$7-g&gU^ zM%BBT7OI^m%JmQ!lzWLG)j{&dMt{pR`+T#Tw@$e+ITT{(9^yB*E`7I$P^?DR7co@6ov>hJ)sDHqX}~98ckmp@ z(7!C>EZpa>{<`;7`F4q-8?EPULU^k=$o1^>JxI><9Rbm>gaT`P3ZE$zXW9s_x`S4y4b!Ohebo!@9AJ^sI~Q~uBO zxk&Q+!X$0e;Q|dm-stV0s9T6kBZE8XB+&;D5}EBG*Rpd171 z*a{D%Hb1mVlSs#t?s3%+XH?fVft5FPl~q~j9qDiIRCEh8R=a;cGP>efY8Bw94d}Er z`tV}g`ZhIWWF1?6Az2xJ`Dm-`Jh2^f8I2)>CVd;j1ik_ylv7s-#hx#>SR6++L}yLFS#Fn7*KYw@y^#0B=C_e8%(*Ip7!maIK&Yx;l&Y-Z}o<6S#Zhi?9@ zYJqT8T|^sXZoRwp7!*~wjLY!e#DN!kj3`GtB?moj(}#JETC88Dw(D+l8njNhE4a+? zXajChn;R^9V?6_#D|eonzK)T6qZJbY2*tv}YSD+!#^3C5pL3o?= z^}k~L?o?CkqfPdmBK^$Pg_g|fsrA;ZsoEVwC^k@h$jH6~BN$gYhla@C9}pWYO5RAw z8x!-mJqXRZh;et`&g<|P(a65EpX!LEIlCKk*T0Ir<=c~FewYnfzbqbl+?DTsnD^^~ z)nIiVNeg~m9P=GC$Mb4IaN%teKo(jh*>HLN`~$}4z>g#h@DL9a;t)m; zN6N!<^LeJN`53$L+3S7-OYr3`5%cq90{n4TQSbp;{d`joe>#m3e0+LzS#v=H1eUTb z|530Gv=;`bq_{mus&C+XY%IEEC|PB2D1ICA14&t#)A&p8`J-F^-`6$ zyO?)Vc2qPG^4OsEF(5F)CbSAl0WR&@LOJZnH0{UhZ( z<~FR3MFS{s)T}rUWz}%u4|Cy@jBMeGXfBCtEOF`NitI>@Y`Tl&Mv3}K8`TvaHJBRJ zyA(CFA2og#HB0z?o>mz~6S5lUuSx?pQPQU*G$agh*Ut6WQp1qy`4(T|S^xl|33<%Y z08pnfcSHOyuKiGJ!d|fH9YJ6shvWHObhsqeE-he|z%9aE>1ZiBlNNk|Y8rMMgOnEv zn|1@!0bbe*zPH|p7v5^9Dmf@lt58D~Y99(BMH6zs$5anfccn&hFv`7GGeJTL!Pn1p z31t=uEO4y^9?t~cv;@BU1OcMN2FU~=?nExDME-Ay;#Oa!M-pYVzA7!7D2IPv#sO70 zIvhJD0lO^Nb7Pejj0NW^bCCiWuOA2zc3XsoL+ICUPY8q!<|v5mC@jt(Ug|q1o_TZFCEz6 z6D}D?@XdX7PZdt^a$7a?n$6?&h$|wt5voT#su1SYJo*$(%nn{MB3KbI&mH^5m10vN(&2H$PvbpP1dT~c<$}so{czzzL6Yw z6rTC<-jzl(Sjr<`AJgjM}u|V}Dr>4XksitWkFz*VItwC3SZC)J#pyp#9`MNb>HW<15LqX$>qSi~Qs1 zeA}daFEfXas2cn$-kz;l2x0mA92y_d^TpGFx0+ZPJ)G#;zh%{=l97f| zZ}8E2!epbgz7KE}w{v|T^C)(eiE^Va{u)v2lU_WES~9&~?4?~2@K79XT@plJ0)dZ~ zPz+_zSu6&C$w2(R5sKNKRRo{g^@SWk|jD*8sNx zx>&3{*DrL{aO|Pn*mBfRGL^0{A6P~K`h^jOC>fN@g zQ|;<2>*|ZL>gx!vR)W&8%QAE$MT60la%w>Nig|#v7RIW&9$lEtH}9Xf?kR)n3M>Br z%mx0nnQ3V@g#~sCHJ(I)Hf~A22WAGNfr&d`HMI-0(4DMcg(h?s(fGxha1O|Ms`?@U z$g?F*A;o)FqNs(tp-rnn>}!KWMuSv)gUo7!+}{Rij8Xst<3&HZCk>!Hw-Av$bYt;{ zG{8eptsGF8dC2Z@p@ng!rGM?=Ap~fG9OS$z@kpe1YZQvR6$=@*YC?1KxIoiTId3F2 zYuqmlElJI}y|D``uA?2v+UE|`F?97iYC=g?*0adJ#09{CMBiR+Q03_0U!#+g3N$R<_z!Z`0m@(O%r%juG+Wi!3GLDxvAJJCBWh z6q<&%zn`9zmLXTY)j$Dedy7&;(uHb-Rfy~{M+YK#gkG4pL3)ujd^sh1p@XNa4kpoQ zBOa$m=or_kjs#6EI1eoy!92@QXVxjma4bA%kHfccz*f>QhyaSLx}garH?cr2?+R56 zG2B3*yX7U{(@Vn8d%b0PgL!%hJ4$dWdhw4-2*!JfNPFLQ^u8zU!?W%4rEl!!rPOXG zyx5L`d1R@)thWkzFl%AN`BwlbUeKo%cSqdX^3QAka@v;GqB2KBIv*95m=}E4Cx%IX zAC1l8NG$DE2?pW(juDR17t@7I(dj><0=6v`aXoW(7YnW2vUy&`^wIz*?#k3kDwJ>S zwD|^+sNGLAGpT67x7^@-^2&SH_+Rw;$K+s8SaoqMm~A_1tIcR<{NBz|Im^sA*8%_9&Nea2elpAbc8?x~v(1A3Tepv#59+K3rICZW+dp41 zVbzVl@U%bp*?$PT{t&PKA$@+y68OPB0?gGmDSbDovo~qGHtE+lKR$0Vk!`UEY_aNZ zvH5OsWN&eGZSkyc@jY(|kZlVIY>Vh`i}`L#WN%A#ZOg20%RO%^knOxQ2~_lVRDE~U zvv)MRcIfQYal{K*h<6RUvP_?MjO};L>=n&kmfWj$?R&wGKVd%?bYAys=paQpp;=>4$uy~xx3sONoG%!5RMgXGiQRI>f=z6a@K zdoSq}7yW}=fx|4agCeHG!sx?qzK5AzhlZzfvl25i)JHoHs zb-nnF0>^#&$Nj#?gW1Q!UB{#A$K%h(lVm5;0w=TjC-c51i`gejT_-E+C%>Lg*2zwP z3!HB1pKkk}?q;9vcby)tpB_&hxBG&h9eZy4dr&$;U|k`%>zMbazfpgk{lz?o+n*s- zpMlQK?i9|^9L_Of&L6AJv8K+k&(0Ay&JnOK@B}Xim@kMnE(qZlq*#}@%$FpBmlS@N z)H#<_-Ipj+m-ri(EbvQKc=g36#jDR}7qn-W9Nkx3)tBrWS3FqPf{K@-IalImSDcF1 z(hk?MG1q+6*NRiu%4gRi8`r{EFf~D#1~W`+14ihuq_^u3L#TU=eB=EDtya4^xpA2pGM)o*KR8}-V;5v(?5KXd|2>#C=%Rw%-Sf&dU$$zc#3$) z7yMhO__xmBZ;RjGwwwpp+QZ+S3Yx64-ZufBc@!VUM-o0vXNxf7ytQU4Qc0J4`<`EB zCWjFME7NaG$2(H5)NA#H5#t}f;Lee3_6+EN;J>mlVMk1o06MXt=U#y;!N& z9r}O6op59_-Md3C*ghU-wC=sr&OjQcU)RgS>A^^`q-1o~1MG06QuK^0`>)6OcA>^U zaOcDI`dTFOJ9x+A@%i3HwS$1*)5&A^))`h0{N~L${}Uo5i!hLYG*%et=_|N%@4ae` zFb17#EdT4cag+3Ci;Mze% z&tJ9TZvu3k2H$^cxR9bsFujz#j2@dAqDXPA8=>p|S~Eo7+z~H}S7{pivn;rvPULMy zxtSbGp=(w0oDvC>!oTCr&x-uF+x3cqaMR&;GsxmcTve}5(BaAzxDydGWu)?_(>3HF zu52RAjci}!j()hRC{lsgXB5R>yUn!lFgDI8%ge)N)YSN+@F>}466=(IOmC}c=zLF9 zHPCv(TQqck+r+B6%7d?I7NVEDWX{d62Ca*iFITbZ{gGT@Tbu;ZvGE+>&~EBtTwJxE zdW|<@_wy~mn)8}ZvYsi@=M<>dMk6N!B{;TV$pV@L*^t_uAgGvCLLz4ua;o3U4OR1M z$qkoG_sEUlZqxLSq8s(t3gc-)GYx->nYJDG`f`aPPEk9}I6=#I*(^~u``+}MRoAk4 zpo)EoS*-UU*KSS-W}A8H_jS))PS8VGE+pb8Hc45^(+e)Pt-UOUAw8&+z>On$y>jGL zK)usZQoLK!rrl6(hKo?J^uwlPxzsH4)9{GHNk`|T*U=|f)7OMg5=15m%4JNLHkCsq z+Gp5np*p8txEpOwwIjRWmlR<-pG}L_GV^iA!lRDM1Vs#qbr%7%UdP0NRff~{^J#|7 z!tEgcU`LV--_>g6p!eAq%LFF(a!{!-re#;q|S@IE}vyUDuSE^j`CZRAOa06I?m^tX%h1=-#@@XROZ z0t)x|cK%G+Jeh#*rf>P@77$T^Gl9;OVTDgHOL*X<&g4x2OZSm73$F?T>0b`vP-U)a z2wKHEgzmvs?S>%RPEn&rm8HG~#wp+Xxy;uy65XU_j*d9vYggVaBAibb@ZCA=C}}uftIKwPUyJuY*?J zpbTekS=I_1U2XpPLCbgV=IE#O%joaQ1^Z|mLc|;3=J6qdlsKzO%*NF(lB-)0(Y~3e z_74NJvv;Ci!On?7rhjOKEk_%KC!#Y9Lw07NJOE!M*9~3+$j5MD+B#8ykdP3QlNOdd zs^J@t>jIR#T@Hlpsg$0Icaftd`=!?L>q112@ zE(ZJ{PxdHFV3MXC=IZN{Qy&*s2MYWDtqPn91mxwY8(9cHgy02Yisfi%i3@|z6)O8( zvY%~>g{Z9w7|HXPU*ipnVy|=u0NI#ruJ_fKgjK#rG^p#>((;3xXWIN#0Zf%)@=g)> zS=J$VIEDL0JjBWD61`+8GlBe^?8&r*Kvb>eY%y^s6@&sd=7A`Y^tRbAEsl73M0iq4 zM>DE{zvs)IK=ULT(+EL1_EZ*pJKL z$B3#6mR+iS#LacI!+^`g974TMzmTI;q8p<*FO5bI)(EU=NUvFx_(de=AAH0RZ2kca z5W;6HTR@jZF;?>UfzNbObHMy*OdG*Ak)_4$(7yLjryO;$!855+nqX@wz-OQqL$6pU zokVXxWTzU{@K|M{Po3_1szcJP0~oo7DpBx5~y zV+ynh!*oEuyI2?#x`p#J-$$?!p0OJZ11fVCs7Hfi6HfQWJb@d?0d)CPBQT~IU2vHfSKVRhn8}ag6 zttuWGt5nrdgEjtkiI*{)fQVP3JV9l-$ajjok|f6M1@3Qn(7}J2ro2eCS6qzbcL)HK%&F%!4h&o?+de$*7dd>(|8| zFOa#nd)zvuWj{$P@o|$ewN9kEkRhib54LtK7t;OTb#%(yXyoMP#+;3+aEFE5|1|L{mI*L_)ijoknh*Fn^f^<3H zHbbdDN!Um}x4+ItgRiXM>O)d0M9v-q?pC!4*;a9xrkI_EH-D17$t=`u;XZTvW%jcv)| zcVFz($Pp84`LML7b*126reND$=)al-{F$(Q=HWgX_K^UM_2|EY zE@bC-mnn*^brKyKjSL0uz9vY5cbiawtJ(_5KL-jQdtKTdnk>9;K*sv!NgG=dbuGUU zJhBl&unal-fSg_zbivnth9Gflm?kE`P3$4bGi%TnlE6OAA!7E{Xme| zwTG$$y+6OVf?R|^Oa$FjME)<6CqiG-PjvZkzJ;$DxD_3T^;vKeBGI|exF7q`@ftc> z|B66=3Ri&n9?S86#P>F>Ci6E4zo|esH||BT72P4}y$a$JpzNo{^%uqM6iH;0KJG1J z`T2IdOFIFvDmIwbUs$D;Vd*MD`4Rm~fv~C=gSRtfxnqw`}UpBgGA><(P@IchaLDcg)Nm?80jReB%Hl_6oOonhTExJej4+son0e5D1EzWpjbRxJ^6X#(wq)pdbhI&P&Lf%msASD@JrE$h zbvFbgl%|`LCSQ`s2O<{9vD++GOdgA<66+tp zRak3PQUlERR#E0TD>X%!RER9%^nH4D2YE}dq>v8DT6%17UFKLB zit9??U|LPrNA{%5qK=tSd5^3Z)geqGBub%CJ{(T3-*VnaV!muFZe?M!ly#o(CrWK) z+|t2Zyv^NNC5^^c#Fu*YUMyk zrctAM$S0@~RS~>#?q}FU1Y|%g@~s%7E&V%Hj3E)kx;lDkDMVL1R5wPk@9$B6jWGni zMJ;c`+x=DUqQ|?tz1VG1l=QlCd4(}xxFpal^0~M4Z$7$@Fgu1=c~+waWe>FNTnIH- z)17hg_-FCFQHcD90qa6-Qn5ZO`L|VTnxykf5l@S#6&n3ZiigBnfsGmgS&WtBXPZo9oe#7F zz!WQvF>)yu(fO;4OT8iWR}}15nK;Jv3Y$QFWbm4ri8woyJ+){B+F+zB2hm{kmLDHfXJiOQ)%1 zF=s_E{HYYE#Jqp8evuS>P8Hcar*}X#GmlpOO*By3WrH48c-N`_;HCm8G^mt9r1Wom z($i`IX)_*67(WzhxmDyQ>Ez;tx1EUbRpsS+!CvPg+65;L1}afPBb^ZMw0*XZCjV-&pb!QSF8_FI%5TOThcU7VRVwo=aP!k(!DzESLv&Hid@bA88n=lz}}Y zUUx&y7pCxg#VAsec*Le%%`a^D;ns_^gw&=C5-}tk8NM7Qke^^Cb*x|kuvL}m8|ehN ztbPk#X_&FVu9yG5^@lBpwd^|=OL53%I1|ffAoT=p9Z}QF(6-VN1qEEl9HwPN!f zbvWho9+g5|^zM#j)Nc%tK=O5PP&Q7E`R`nb1lp>7$!97ero&Rc!=_A2Iti>aCJ{_e zE5T=CP2MKP0Cx3U6n&29>MlzWam+e=8!sW7da^pFB{uTcF_E@KDNXFyKaRX|ZRogU z=~`^sCdsi6KW(#EAQIW`YVMVM+7V@^-rm^}=-lZq+SH7sm&CWl6vuQ89@E~%;$zxD z`1zUq4h0Ykc&$EW#P?@T;$&X^WWoI87Z?{T=07}9T1QF0ev&kBMJuJn$MvFGu3|zX zli8R$BN~H9a>doH(aJ}RyP7GK*HqpFYV%$^oUF$$I6N`bSgskcC88z#I$SyN_xWv> zwP0XcLJ!jZgBiK4FR*Gaa$zTe?TQEU?V88#Q}4-8(=})jWl&++g;7VIEuJjhB+2KV zRivIG4ffJ5m0S%9i%~dMah)HU^Yd+MN*qU2yj~=E<-kWNE~dqo(kYBQ-|%W^;I&}t zYxks*lXFk@YTu{x7MF@L$B&(PYPb%O4;ep)>)VS~1a*HweeKSYLe9kJ(F3@&#lAUS z`=%SybE+Y0TuGeseI?F_x2H`xAFp%1#_vOHI{zw6Q=9J8AX1Ft>-5RJ7hV*|wCO5* zL7mKs<%GeR`o2G6Gxu^ufe*H2_nF}0dVRz0{*-G&|2_O9W8V34P;?GPP~?_zK72JWwh$qy*r?_KK97`|wu zyx&77mAl!lfuJq67X2vM8iou%bYRb(R)GC~BMHQe&ekOlIp3DB_qn=Q+(|fo{V4p15r@fSbgY>cs_*D- ztGqWKecyQ$hZ?)pj>ZnCTVyT{Jw-1)#T-2?wt(!DTT2Q?ART#*# zt8nNatYLb)qY&X>o=B=)V1U(`RBg9;s@JNp=!tdXT}c z*CXzX4xeYGq~|P9dSHUIPQlBKP&ekXvknWUIyY-WSfB_?wti{a)aoUGBCOM0!I%-m z(x!HF^05OYpAypQyIw!m<5L^K+cN5Nn{c*U*6eu-sLJKW$Tsbxyq^A82=!O4lPcSH zN|~!gg39}RbXR#jdCSqjC+WeG?KSYqFy@Xygd4mnt^b&iKgDkN<>esEbMGpCfbMO` zK4}8vCFe^fP&_;u<~#1*e0K@m`U2MkxIe)zk%bY$kA)3{F`uFr zVQ8?1-0cgcDj0)t6~EGq6^QC|&o`wQuX^$Ppi(VAq1+7H-yZ9x7qVUj1qjTNJ=dSA zK|{0z7p19SBJkyusuEYdR4DleG@zY%Bdd(FG;}CT1dYBn>>x=X9 z)=kOZ&JhhIM|@3&tKV+a5l^@aS35mFCRPlBk8Z<+(r;Pyu4I5-jPwGS|#&+r?IlgD=WF=`{niMr{PnuLM)RQf40Lqp*w1sS{*~J{%NOESsb4!WtsU=C#$|0#OKC72%SxQF3sA1 zAuiE9w<5;P!?iME{muSr-PjhKNi0@loQh&m%z`A)SoMQ|rKC;<=f!Leq!jJcqU;=* zRa%QNUYUWd5XCT(X@zZ`wt*>|1(xsC+@&za8@FTY-?X{ML3i6MzC;3iCMJy;BmXd+f{#`ek00wjZV&Sr zq%-uCCgh@}P)uJE7sEmS=CYH1_#!expsXUX>euwCRSnHw$eN$vKj`yWk0A8#D^w8X z1AQ;7Sp>BS53_9xC*M30b z2?{o*3GrgGDFrIE)Q7Ka!U6GxBDgEl5;n&PA6k$CzekfxQ2|6yTf(^TR3$TaMFtOKOju9>zJvuKB9nqE5rCNK7~+MTASW- zG^sa%J@KBx7gH2?o;;nvA8aB({Y)i?J;eK6sT3{j7>ErH&DlUNC87B_1@rtlU4NYx zjZzcr^*t=Fx9KP1#upi~2j>{ee0svxf^m353w>EfDhykXU2K_< z3Mo)>#GA?0c(=hE;V}Er!Z7~6U|K}}_#Szr`bgIbZZ&xD@9)P6ci&1ylD~4RqZ}sh z$yOl8@J#WWjWm!a(80@Ts@%_q``7rg*cdadt<1Kxv~;uBIY$Zljg&iOil9=C!|8I0 zQK9~^oukL)FWWbxZqqN2aE$XN&fQ1#;qL_32LG(y7Vm3YRl~`!p`-iVSCt4Cz9c!w zp{z_H)OFrA?waK9zidmOI@t``>$)d}$Bh=br=osZr2%+nGf{!n<^nzi(mwXP`+h&s zD(@m$C*8SKdLOasz?Q|5l3bQU?mZ|X4XTl@j=+N^&=mjm< z^?lb$a>b}Bxs-PAv+f749x~A#BXIZ4RbTIUl=zNn!FFk> z^sFuqQb^5ApkwwAL?9S%z(!7GXhMMOBBzPB;5;qbd_MIm?_)2_S~3GM@s|>qNE)%l z)Sm5Wt!l|uZQtfqC8B)BLG?KhXaJcJ)n7D+s>xmq(p zzE&~`8l9v#%du*5*5`fvBM04&)xml#HxK;tB0qY2rbrx4N~9?E@Cn)madn3W#zrFK z0*lUPFrl&I_7~GU!*ek=arWQjz*L?it>QKjIFZIj#%iHdySJ46y5O*1?cx1@%L0)! z(2$qU@_hbTY{6Z46Ime*htl6+IRlJW{_6U#?H_N3M#jtAb<~XO=1*mK;O5PXDO41rdeR;goiMtJ+)D}7wgj>kg z@e6F!Tx7YFe?9$i|4SA!Vp9H#dqfSodr3GmZTuc+Efre*63>1aLaz3#uueIcPC`r# z7kD&ISuT++fI2X@5h-$W}ZFxk<+bu}V?jY2RNo1GIH zM+$w$?(5p_Gu_tiGQn|lC*3DldL#M0apj2gcJ{~qsldTcv}g)tmkcg>M$>@hW-01i zsRw-JFZzUk^2)QuxtWEz8RGEulm&Da4^ z42I$Z;+9p@hCn^?o|ck>CIt)okQ8nzey`s7V2&S#@+)NX6*${9GVmiB){BCCFD2(_ zFndGH;EjR&t^MP_NpT#6dGUDY0{y*#;lO6AERxq-F5+Oe(|j~Z#G(i@G8_jI!k{=x z!YDj`o+K#+v@e|05gn$@P~we3Op$z3Z1YJ=95wMHpiO^W4u1GJ+fk9+OZB6E^p-Li zfZQpGxM9a?e(RcO=WQ_mNowGvo4g1M2WG9DDXLlfJ(*Vc;{25s=)O& zkV;bO30@^0k+C9z4F9JCjHK0lh&znX0c`FkY5i!xPdf^|OJ05Yj{N&cxB`#~2K+_%X(hIUFT0>zElEyHAyy=Pzad5*5ciKE4=;A)q`qI|TA!J9 zMEp=RDtJGfUUbtFe%*CMG)K<5JX_%(wIX7%A|{Ozez6iJN}A-5IibvzXn>B;Ol`W! zglXn=c!aXNc#cn~j*W;4u?)NgjoL4y(kB9w?ZHMuGC0uy{4RLFJ^C+Inlcy#YzkpG zih##$d9lc)d;w8v)k09py0PRzCJ!PEJeD)HjD}gUiZn(5-r+eeq1|;X3^MSIf=rik zsyDt^^?Q_`z>qE&YHF$+wLLH~Ae*T>Tde04Y2h^1)fvX$ppkGpwN1b&7l6j4m*gyq<{K_*`N(i!r_}KKmEmtYocWMC=9L+)$)6 z%_5*&HcY!^^it2v84k5gD7qF#L98RuO$5>1Du$NO?6M3cHO9=F3bn~Zuoek2q4Nms^J0Sc8zUUU`N7awsFQWAW*7TFg`u(`V z;xOI)!$RoiwRJ;XA`+?W!M}&jEL@X98Ww~{#o#`hX8Z)`{M1%|Ry23o{&{hxu#GLf z&NS|(Qr|m#a=|o-8Zs%JEYz~}!$w#kZ{}w;Gy9j|No^Z!K4!RQCOz15llI|p{PV$n zHEPhHB}KL6x^)Q9Lw5QFtq0u(?AOGCO(q&^%c+^R)cD z$;`a)yw!4|=*n2NAcDBUIn$2;>`C%jj)h8DG1=}RC7BC-B5cGV@jye|DAosfCm+!R zD=4$Nbl70#p@Jss_F>3DhXhL<4iknU?%!$3nF~EVmF<5QgZ)X=u;cGb7cTKgtGl)r zEwBjC3Myhk_S^ZEzD)g{&z#HKgzUP$b|o{v4x>^ z0RAeZK2{x1z}lh>Lh>+x1n>A`k-}sk16sU0v*xU`Kd2O#QFvSzB{CrC_j>7fzmW4!@#r|s+HCdD?e4*?eca$^zu;c#x7h^=IGr0kY zzz5WG(K~vuCO~Oj47~@cV?dlW1;}GBk$%%8AUcNpAd36{%TK zmXqJWRi={Tn+lPf-_j@JTSYc$$=0v5NE%uO=sF)8e^i2${%}ZMIqDWd^y2Q7(>SvB zV>szhb+TLvB(?X^3B{4Pc$i#OKHV7=a;l&?7gRY5r8O{OIqmy2{J3gn#e&{3(*>Jo z$dZJ$Sj2HzrnOi$I@)znhzy0{1m;<{a@iE-+x(#TxbR@}XVW$-4<)qFP6t;#W!kQm z%dYXkc39t`R-A{n)q#oI={47xo7<)Fr_0w?7Y%M#gGXl_cSkmEcR?ff9xleQtqV(d zNz7R{Z*H$3ZpYe3ht^iBLU{i0z`qr(-hS>jjgQ{;2uv3JObCeo4jz4%+`Yze`Ay=t zP4fs)KT1$h5=wECwNM4g5brlUI;H^_h9t=TwcJ{@24}@19JJUY@%Yn?*vUTGx4K0l zyN5)zMYcZqo8t!j;feSo8PQpQg7QSO+2&ZP{%fgi_g`DIL~3m9L)aYj!E^30e6Q8_ zBX3ksTOxnEe^6eKF}GKgak%+oY~?$y*X~8|?BM+@o_u2&$D5JXp7EZY`v6D-F=Tyo z&FX2-8s-H}wS$&;v$xu_k9c#g+H)RxbD{0IQK&`Q8TJT#c^^CS>G%prR%2K?KoaGr z^c_X~e8mbK#TtAi1|22le5LjsrS5!XejR0DeC2T+Wl7eVr5zQue3h*ol}96~SXZc1 zdyKXQU%eWT_#1}#s&P6Sx%tz6cpIqk zHyd=;OT2&42b+inKDcE^yo)jntc^^aEoU9H5uNQi-Yt!<)ljGhOLWjOD}Q$`Khj?Y z*|w05H2$8Y&d%D`-**c&g5I6uFQ`ae-E=<9oveK_{QXe=4y?D1uU&r#x&{p1{*b)Y z>G%w~f9rLA8}|0;Ve%Q`e(N*ny0z*WsC-K;^kE5qt{m=~nEE!kx`JLHW&$rWVZy`?g4H_%`P)uo@+>H2harr+aP9w>zF=qw??CxbJGMzy|bN z-c|S1hu=GozH0=(7e9XA{PcVK=y_vGV9)vQw!*(Hw%>a?(BE73zjn=kA8~&_mic#t zC9`kvd*RMkTn0_zliS7|Z^hcT^Wop;Q{OMv76rE#FC-)`aYiqX#IE)RuLMP}RYtD` zN79@$Gp>H!@%vS>3EpdrLS9WCu12oid*W;aul;(S*07$?dXkcR zU_5#**TP@ekY3)IvSH{`r{L?7UqVyQ)tcbnT0!WQpb#>E{(4I&2mu3Iw# z6&FV7=RhO|jk3wp=RKh?Vmh}0kA%Wr19Guc>UM0C@f0?rp=919Gr25o$HV#dBy)va z!2m=&zGMrfLWu-gwT@&aUV;e?xtqh~B%m-Q6TeLR-g2qZpfyxL$IW)J)p)O@dd_=g!n(jwqpHTdR!FxXa2TK@T zX#gn2JTri!B&#%tr)4uUNMIDLG(==sH8VtV1N|Vv^NH=y2=FmDD&LJ*BM!rNzN6Uxk>JwXcaK; zN!1*f|7JpEO5lq6fQlSpS(!m-hx(r3$Fr>Jj2Mya{EP&poYIISL-qWu4Ev<&oE-1P z{G5U?hT6Q66wAWAijv%W!e7gFVL`(vMombxvmga5Wjd+0r003DpaCVto}V|&rfQKj z@{?0vG0m`DTrtm&QD3zzuU=fW#la%DO4pOx2Ru0mPVzmx4ENfN{vmC)%N7Q3fubiAE1Kn%^;Ee`pqz9obK%?L+$$Q zIQx|D-6ZeT`rVW;mfro06x+uAoRWebWI@Y*1F~ckr}wa8S-bJD<~XJIxZ!!V@wgR$ zrT?@O!M6Fdm!P2ke2`(k`FxZQjnjWQDX-mpIjf)2f4ykG+I+q0!!mfg8D-mgyPHuk z_zPLF-}?Kw6KC-6`J{I1-|Nkk0rc&yH#mOfWV~|gXRBPJBt4|kWu}g^3 zyWb_~BNS(kO^7z-*dv-r7w4==h_Q9qBiSL8-~}hdx;E{R-K0whTqeZ%-tT>cC6W}z zOpFiV*rx<$NQ$v0Cd9Zv_dih*jbbJWC#E#*)39eq$=M|)W#8}92@^>x#U>^fa~v=z zWk{>lB&Jlm955LX$!LKSQ=6L(SR6BC^ez+Ay6+Fz0*GXdFq7UFvk%!5GGt9zlQJe< z4!`CT$yv%LWiB)wa@J?a+1e##ZQLJn_YuiE#wLLdIF5K{GUQ!rlCm#cj`-g<4n4t1 zIgq9!ftw5k-^--jzxPLiu*8Z1n8|qvoX5hzOvMn^zJjpahclM4Y{zdl#&WYd9)u$iFeEn)ZJ!HYoBzzbj~NyJCRT8SZKa< ztymv?pp22CqA1bF*G+^H=qFxn`XGzjO_UL-G0{}|5NFFxj3daH?CSmB=fh200I3NjR>p`J*KI-q z=siK6F)HVFo0Ly#%Ak-jrq*(sQV%j^vCkOSd$>*OBQ;}>%a}0by33dWnQ_);Oxn8L zW$lof^G;=eU0d$5Z$Rb(R~b{j4|ln+WER3$nbRR$_xZqV3o*9LnHabGLP|1ADTU10 zl$QHq_H0Wz`^>rQhx<}tGApIH%=uz2NV!tBm0Ffkd!-ws(umAjYbtZGxdl?~m~E}s zb(Oi){Q#*AAhR*T%32=edZZRhIOSQ*@>EQVcY=Q)+N32AxkzR9-ty~^79`|#KUOYRVW1=>d7 ze(D3}IE1i)b}-zZ{!o%TMks)G@mik-*>fCY>_K~Ek59wGc2qWDpnV$d=TW5`r<7XI z0gLF~>Rk3Unm!$ZIiPvE&c)Km3yS10R?pl;IEm*MmM4x}*Os z=tI3?_y4`1&-Zj($k}qE^%l6h^YLo?PZac{!tbuDcg-?ZaLnK`aDFx7tOI~u@}R0n4aXy_i(%yCxpnbA1{h;xt}0OTfUzt z%XPA!q$tjCkgTe1d61%MR(_DG>vnRGW*EwFm~N74d6;2QQhu0e({gf{1aeul zJj(VsEI-Qec{n-B^+#kp&I`u3I?fNLtvD`-<~lttj2CA-DN0tiIw?*!t2ikExt*Sr z0{_k~2|^~0)7>&3&G!!XO^y33O7oHupwGKs;`RS@&}X8EmivDt=(Bp8+BQ+l>OMNI z|8kqwi(c~ie=X>9m$i*v$}=nlcFMd19m|&TE&V6xbC-P`{hy%El-KHA&eKHc_s3D_ z)UTJjTo{ZpAtdSPK;rv6WVtdCg0bmPzWaPYOqnR1^h~7oeF5QQnK<{@Osv;^Aq7Uc zq=fWrV&;7jyA4DwGj8tca{1C9q4m@hJc1kLieb|8pAKCp z3i>CN5E505@F3-Kt10$Hs0$U^kczM0fDTQO3pJ>g<(;sV8pG0y4VjQC3%N?|QNpU` z4oI~_Or`FT7k>TWP>suErT*jC((e~Ytv^PUA(G5;Kk-9dxLnmwg7M`czK8nwm?{%G znUyi^hlcdYDl_gV!Y-$W#ypH_#Z1Q4+02KgGC5nL@`}~P-zY*gG4EW4%-Sjxj9Zn{ zTy5t*zP9=D(AtYp;}9mZzDxYrHX>K!WS_it!1vfb9aG~{DzkB_{n)WQS>x6^zHyn; z(!PmN>oF{|d7Jszbu3rwH8;Bm>3HnEj;ZxIlG%D$ef<42S^Mj8eCyxKV-E~woj;Q7 zHXO-QFS2}HVEJMw0{>GVAhs@;PId=X=c%6%To=kcv4iRT^oIhoK3qa}7dz`|fL^{n zQe$Elzw>GEb8LOIx$GYC+S3pZxIWf>VvqdwX;=ueAwEoYpNiypL{h#XF>PX>mj8KF zF}5MORQ7;T=iM&>H>9>s9I$#nj~ik(rVq;=e#v^Cu#j)eT$(uK>U@3=`ouPZj%1Jc z)}Fy0;KrQCiKFkY&r|-GO?gOi$08&z)8X<>1q74F;`}c&@v%)sbaE%sIxn;7;HDDp z$rE|+m$^L5=6Ap3R5|NqzD&NkLSyn&z4K+EF1ESKT<%PJ?PakI++5>6d8YsRveb*& zQWqw7{*&Z&c|^XYA#L*9jQ@3II<}>$)HVfC<#l!0jlhGb?ZSqwa%~f{wQYE#z~JxD z`o4T?2j24LW|Q~Eb!=Mxb?TuhfCj2ty}*v+j@a04&`~?+sF!S{RH6a z(7Tdt%tsc>7~Y$3o%LCP?kCqRIoVk2Z@fejW+Q^~w^E-ZQ3s&kJV(==onx0HB}|SA589{0Hv8oO83G99-Q z^`*4o4a8tXQvt5eM>vbnmW!-dUuwi5Ik;&X^g55*!~IP|VtF#bwK^s&r5{MpDL;X28H z;!I=Y66uRy#Ju0lJyi0It_ScqF8CKG;8z5a|AT}-kkbFc+#e9&e^ly!PWNl!$RD%M zAC^7L75@L?nXmyBVPdz6ITL-<~l#=aGXR5pKEU4E+kI{ zWIuEx-)TA+4x|u#N>50g-*18txccCJ?q3+fp`<`Rh4(DBKj3|ym5}P^gCUxpqg&qq zDl!mZ)ZMqP7@!o7FZ2WqK_-xdF>`H`)jI-;L+N02ro)je0@9GeL^OdmZ9e8tfW)>C zxcCTdo`}d&ifp7vz)e^QAr5E0_f1$RAk-TNHfoC+LGZxiDl}k80`Q3r7x z{L%q1vo2d@J_lid2}uAD2787ZfIN-=+8Pz;Ms+bF+msf`ZxpTVA3@6Q3hcui&;*R7 z6Fipz-snwjABh&jfB1y^B`(>a5k==N0}>q)a1!97ES&X*z2bNPI;|1bl8H0)Fi28~ zIPBr~*KyAp5hye2+=Q`$zyy|u_xD%*N&06k>BpO=!V6>m)rbwSObu^ExDfZ;Y6aot#~{IG;28y2dgQTXp4=!^Sc&9UC{cXM9eV#c)U6^O;ih;iIEl5PkZh+Exvx}EgTzP! z=)8pEuT8$|`6&vT8TdGyT(%U|!HaEdRUH3PfD7p+XdpR!>6DtnbkK-9dIe^O>p07EH}QtT{oD2jHe3t#Bas@Dgla!um&$Fv$f>SF1n zGV{Q&&%qV96%|zsbbeZiKb`^!XUbX~s}=H#U$jZzQ0sVhssQ;Vt}hX8nH2;Pbyn}c ze$VQFS#?<6_Lo+)k&oqKBfmz+s>1qekH+xTcpDBF>x5w&3?n04`D)8L8Y(j@m|q+2 zP8+^5H6B3ctGxpo$Be4}l!n&yRbOcU#--|7BhqG0>c8-0|JJUOSZiX4YAPUZ?k|l< zM)sLv#1XP?lC8vcM#1LGBGmG(Qe|q+-4&o++YM|yWokU{{C)Y_pjcs;JVzHjY*=fgqh9U-zKVbCsT zH_{Q8t|71Ukp%Qnf7#Jc=Ft>%U`+G~YXu`vH;+pfTe!WKc;^p~@F0=!nDhj`_O-90 zRWmZ|7+juOWqV+4bl(FHutYM8&cgE`ef)IT|6Q>PpbvFq0ud->aLXo!ti+6<78WuB zv?&l8Y=CBC`7oN}%-?EMqJW1I6gS+VTBKux<|Vsb6P#6mg_ThuW&lyz$CBeQ2V&1I z(m}+D8l$uFZ<6VnJUAiktzs&n>YZT2c^XtSihJ78uGItE~UwiENJ zqXQlG1$-(O`=FAr#c4>E+N*!efpW^K9*&z;h5X z>;lY6^jDi|qs;2J*QVR^7`|^{DW5)<=RV4}MOcA;^0yXW5(`QeCV})hYbM|rs0dN1 z=%W-scLNY$;q8i?Qw1{zSC4XsT)Qa=jNAZJX=K57&7%asXjn#oh?B7TiVjbfICi2i zfy^N+186%7Q~?xaF=vJ~Ui!;oFWnsyDJTVtt{;68cB^pDVB#kDz z>&ECkXaTMSou+59Obw4=RUMRTkpOh3klt=Ugyu%w+cIodS_G6K9htHKEn#Zvq8Ch2O*I9t01ozFZ?{zyl=na%1&V?uS}7fh@^wO8Gm1j^G`(GGbKZ2E zZdr;?<#8nmaYqjCD)uK|>|MPAs=o_p!ZSoWd)!Jm2^iQ-*|_d{<8(^<3LreG_*vBa zecbw0Ldx3rLkgH_SM^x1` zS(k#T-qnWwNb(I}9#i|v^AH<07S}2lq&J2sjA%RP$PKkv`CxR6cN&8&P<--+gCsrp zSX!M^diVw91Tp`Zo;{Qf4kl~br^+8bkJT5h5A}SSsTw`ZS+3tjpp}XIuoU*-t7A|T z(taiBfUKO?(j-7$dPX4T44429+5|QcFh|p!H?_KSVqkAboZ(QOD+i3N9thCoD8an-byM#a}?$;^?CBpb5V3Bo!CI2GK z6WB8w^_6^!)v*ve8-DB2d;4Vn<*lFPrh-1;nO12B5I{j;0C2Yjh-5=P0afWWX5qH? zlkEYaf;b__^LcT=34JX3)~mY?ulTSEj<5=G^HGa>SqPZDu)hC3}3+TB58(|)r z-L->hCp&|!~_Q;*v%pl>a-1Oo^|DfM4|3Aw0;;<%6(^2q|@a-ER~Y!MZHm4*UZ zJPXm+1|0t)@)2qxq}d8?aUqE~h*h(V6x*H*>_3}@Mlq%TCBI~`C==BVn*u_0I5>772WM-q0%(Z1l)!Y0|Du>9Rx*0C`xFT2 z8DFAJ3+A?a9OogGd1Y6rH_2BTcH7m%HE0Ye7EZc?Pw!Z8{3Cj-;^$5;!@_9NQE7kp zhu$+9%k_U>d>)hvqIcPZreNaxsg&!InEuNz5k~qL{8p5308|V+C0)yVkoR~-L zc&0oSxLxH$clkzq{D;fBUB zm0nrN7D2eqF89SEaX1X~5M82X*JMUAdM{;~40?Xps6hM(o^Cw3$e*pLd8!+vo0PEn zJ!l?974HGH1y9r(>%9cQaJ4B6mUHL5!Szva`A;DjH(ReB! z&Et-R&xh#;IID`h3Sf4Nl}2nwd7hM6)7vU(;0$vPasRtt^1k`;rLa6+!ox`#d6Mcs zen}makqk9^h7g~<0c0KsM^7H_gU$Ya{6Po&L@D;uBcABHIXwl@xJ&4q$X50=#Wzt5 z$)Qy8!I4ruq~{bYZ^`7YyqZvD&jJ{;_kFT25fPF_Xn1JYV(4N(MY^UWgs^3P5>&Bh z>HVCPCJP!STA;v(o%}>lkZ7R`Exm|nxVb}mJP++alqeC2*msjY!!TBK>#2WIhK?Z3XuMAw;+$cvCUwu{+Rq(L#wAm8>~O{UDeKixUySKxDedevH+Z2Ma9(A}9W-1@9+?!|@+~rZglG;MGbBr>yM!wV zPA%)b{wjV@ep;k0pRt%!uG(#0mVU4Lg|^B6^Jq9MR-}3}xE3F1Y@z;NehH_M^}e2l zQH4hS&xM+^S0sus zlwxf3R!wK+tY(X-ST43qzEHpnyq_Tb$1l+-FrX-E5pS;+cG8L8z%FWSeD_P(Ua_`v z4qE^5u`0%PuIExOwM>T8Xo0-rPw6_fwdLt5{%K%MF-3H=V&|Kyj{ z1;MQgEt&n#en|vB=)e3DixmgqpWl+bDT;>dX6RM9z8QyJc(8mYM~=s!GokER9%d?EDBz zBW;G3(Iux;<#? zw{NvC14lStYb!Oa{F>ol8sNC%l1>pOb<(D60b3NY%+;lm$_Z*wiZ96i=*azU zZG$XU*^ZZV8^0Q1%Fqu6i}@Ii@gqC`(%5^_A*&WlxOQ)Eq`E4EZ2Y;D%0`fnhw>Hj z_Pt`?S2w~fAsnm;L&?WnDgWVy={(cpq$v&>MBiZE@>uMV-wJ=nbV{V7SyAET^v1(Sj;ThfY$quT^JyXZk?sMA|No%3a1=tb$GO0{BfF{p}XxCTF(uH|@re)s;l(Usmfhh2Wz6w7!@RsMA?RR3nUmN%YY z@GcbOS`WOi`V*(Y-SRT2Dtbh_U>EZ(YI^c3{lrR}oX}@!nIdqmtEnUW0{z7V-4sZR zP&U`npjm;%{C(Z?FAuyl{;0(*b4w6>b2xsm^%Wldj6~fx*@~uj9m)4;Q1BPN^%lz^ zonT|JAKpC^^W{mHpX1h6-UC11zsF&}e@Bd-#q{5<|ApnfF!BGJ>*-kygfynLGxZ{v z^df#kg*dXqx%8rNL`@X-q6L?|WcIwrY|-y~vCb(xy#<2uxQPqfqV7eW~Np^tE&fio%cP(}E_yS=ilBh{D`tqVkyTz1#j*=yBD{7smq3q&1_)?%Hv zj@>)q*pHggKW>RsR4LLN-(T7$@9j7pw{ zZUP-&I>tPT?mPh%b7bnu9|PUqtFOhH^N~MDkxiRE8*+#hISiR64_OusSv3t=4-DDN z583Vy+1(G>!w);)4m(m0J8=v2S4JEI}$)W638(UBsvnTIuc?s66!J%7CaK3JQ7hf64^8YjT#tr?6^f1(sg4z!jFq^Il?IQMC6ARCja4*_RSt|*&5u>@kJa3d)xwY0;f~i+ zk2i3PH;Rrosg5_BjJLRqw+4^5C6BikjdwJScMgnq&5w8QkN>_O?}4A_#hvJ*p6KV8 z_#-+opgJ*VGBM;bF&sQGk~}e5G%?mRF+MOcF+VZ6KLNg&g)jran*q|yU~|skh|S=t&ET2N;JeNcgv=18%n%jN z5I4_|49<`)%#a<-kV9rZBFs|Y%~I0LQgP0H5}Tz~o24+TY#~m`qlQPF!Jjd5O$3Hmt zZDCH}VD39)P7q;U2yb4PW?qDI{)gDSsM@@k>3q|Amw3p$WXil$@w{~Nyv*Rd?83a< z!Mr?VUIAf25pUst1byBo6ipY@-|4!L1Ojk<^`R>1>J=Oy@LgP$btdFq9NX* z5zXRH&P8LfMH96}Q`1E=*G2P?MT?Y0%i=|==0)qlMVp01+k-_r$f7;Mk^|n7Bh8W% z=aRG7l8f4stLc)P>ymrOl1IvtXYrC(^OE=AlF!1D@4?b9$dVtzvOnH(0L^kB=W>wP zavCAga(K#eMDa2-viaTnUXET^jyYJ4g)GM*tiso8b zT3gCmd+}OF^IGTNTGzr__rcn4$XXA=dN1C3AB}Dr4XZZuI{NtVfa&^>>-uoW`bf(9 zXz}`3^ZNMU`ozNes448q1N=f<4a#=P2w3fbC%>&8;Z#&XKWO7X^O z^TyhsUfAFD^@EK~$Od!^VRIXAbBAVgmveJZO#he9e1NWgx6Nj_mwt8l=6>xO3QKjmMst$VdCi0RgY>(*n))>F#XbMe+o^VaL&*4x6? z--E4xkS!>}HVpnYEbTTN*Y*eTZFu!<1hZ{KH^XL|4Wv}VRO&gDmTk15ZHtXn^uuk; zhixpxo&O&6*})Ot!ByYEGuwI3^bmyZ5T@=BmFy6=?2ruYkS^|!9qy1n?0iJrrNG~% zq}`?B+WjQHORc_3W424{wo4bfOP{*SP_oO|vdc8I%e=VDa=6R-u*-(H_ZfeWop$dF z*WOq0Jt&9z9;ewJm)jn9=pIk%9&gDWU&|i<(B8MjJ%Pi$?+<%|i2FkL`@*#QB3%1F z#P>zj_r=Wi#ohKLLiZ(8_oYhqrCau8hW2F__cJ-#8#EDC*J z{~nMSN{|jkKw4V5QMwsAMWq|1Q6z@$9y+AEVF2mw?h@(lmU(c+K5Lz`_qEqrJI?v< zXT6_STr(Hn`*+7@bt7mAB)+PmwyJ8hs^+k&?z5^9v#Oc3s#UeB-La}Ov8uaf*qOAT zhqR_YAUA@y_L_6;jrf{@nvpR7s-eT0vCkUL^t?%yk)+j{S;v~i#G2*Wn$_8wHPZS) z!kW$Asx9^UJMnc(PUEtgH9LoON1t`4n005)75l7pP3kq*iS-XYtF>R(Kkf;-yBUAP z-|*x#F(6G);x{oXTJm<-@b!6Z>9qm#&)Nv6+6e5}2%6XkUfT#c+XzM448z|HZvd%L znkrjtR9LP@8g0fnY{vR*LVVC%Z>KmTH*GUaL;Keg);5#RHdBzcQnO~0@VAh3Hq*to zGSs%p13H#2><(B`lVg0?c;w(>f*3MRG+1t;@4HRW_3-sp=LozZ$zZ@;qK>X6#z zlLsWGZ7FG+S08MZ%TGeHwr$JBrm$Z~b8Oa$8>F9^mzSFd1#dTT?zCpT^c3G|H`?iN z*vWph69d1~nYGhXwbNTP+|serzqT`Qwlj!iNgcd1M7=x0x%-zvp9zQENuS-RnBD2D z-I+V^TgUF)#P0msE^Og!cM)lC34iYk_1-e)-dFLx6}7!pqrEkUy>*|xjhMa7ti7$O zz3q;@or%5OwY|Nwy?vzp1N{9%>bnW-{bTX{6Se(Qqy007{d1rFig{u!99rs1oZ<%;{zne17zO=VC(@(_5o`30b1t)`s4w| z`oaD415D&YEP}%aG>6z+hd2_4xax;^#)tThhXlTdgt3Q2*@wi{ha{bc4<`>Ftsjz} zA3jDtA|p5=r#YhFI(i~;M5%s6Wqd^KctqoSL>v3o#ci9e`siur5yRwB9mn=0{5E5; zDGR|dt98#X^)dQ0iDPz5t7q!RB^bc}3J8YW5&znO#=npFM=9Y-t^8jB!9R(AY9?R2 z35{~T_&jvj_~J|ULqIUbWchCd1arQI@c(ZH1XF$Je*^K)g^sAhC7$v*>v z$dXO)#0Ty`*;IIft|lbj0}rgAR0JByW>l>MPr|-bB(ARJ`z{AwWaw!?3CR}h_yh3% zJ^X)nKrn^ITfi(M)a~yQ|9)>kaFaRe;134`!Fh;31O(HO0DIp9f~FGoBR>TMO<^=H z2X_HMLv%iP>AOolH5J$|FMt5TbQ$|Zx>evUge|SK#~tHH z&?-3JT<;3=V~J{!69YM+`&Y(o+wz6S&g&D48mCTh5x*}HJ|TLXdweM?CH_JE*;68Zm)fMBG-Oc8DZZzrjPS48120)qO& zAQF*@hN`OSU9QHr*RxCC1A=mUZxgQPHtqs~ll^-Rb=UtrAb8%t?{p>`y8;3SLh+oob@?O3+_ zX`c4CEseq2iRyvVBG+%*`j~Z7o$_a83Ey^16zXOs2hOVMzU|tC*3GTUpV!WQ+jAPM zTR0y$Z@B)p?~Yl&gsgDULUMcHr%=C4FnH0ycY7EXTE9Z0aM`1MdjuJ*U*j6Q9B{oo zPR0DZA)#{N zG70RWOQGQ?cJOA64|X{e+HjJs@NG*Qb~SYu5Ud{jw&x1FUczkDzvxtO(>1EQ*-&V_ znjE}6tAl+z2yMJsSAbp3!fr1H8*k4CVYk;X7=X|np4%Nk;|`|g4kWbii*ZMva=(A! zjz#E!&Fzs~iHPguK?w06uDK)rd5~UsOn$MX#>M(YE8|DZvK7MbZ)LFE{E1m!^1>3Q z{Q}1QPdvJQ8)n(^Pt5YwpP1#^!(f}BPY>56J9%dgL!A0Pk^W}P@^3r3WTGk4BB~4i zMXihqe3_%)(#i-LYW2U1-HUy1WeBdOlVX@w2oraH2(WugO(iLfTn6%hRAgd!(8-ch zj0TR4QE(MX%F~sN`k$y!2n9U7{R* zN{>8Mie7W%YU!G3B=AmvElxAOw=$&ChwoY$T02hpOtV^SwLParPI9zZ@KWk^g5V5i z42!$sS9lRBex%z6LVd=gz}BBy8MC4q&nfiFAm3DQ+3CGKf<(yd5KS3@BNM}(4tHhO z!d%MKnF&tR$_(#9bK|GEF0hh2ZZugJzDch(SKI_y8D5tm-j63|FU3QJGi?>=RS;4AZ%msmA0D`tA1d#(_Tm~$p>+|O4%gkUJ25J=Lix!o#PLZ8q z5C%zGDEIeT z3~{~rN`?vj-#ogQvMFD*?{~uSFPc8NX#T~~wH{s>vW~Ix%J_Z^-MovB^5FfJ| zAB!m;s|z0+Lf^OCzIGbE4o<#K5MP%X-}h6#ZWq4pPV|ceeqaqhA16OQh+jaBU(l3a z2<*ZyjL<)V+doRfKgP))0`ZTp@lTxcPrmR^B@9UC4#?05$Z`tEfdu5$1QbjK6kPfdZdKpee6hXlgL8%!*?HoZH7eNn=V3>|zx{P2Uie%%7WY>)3bdKbP#YOT$ zBl)Kz1ur9oiK3qKM2Tufi91J0#zjd(qhzO}nr`tIHT0qS&`Qv38oV4$iSoaj`DY*!R=1ZkMs{ zL=aCN2v`&1;|%eOg9Jb!LDP_sOGp?|Tm(;ClxAFva~vctE*=_}I31UK8J9{FpUxAX zp&6g$9G?>xp9hUEn2s;Hj4vTdDC0?}&`hXuPN<1XsD&ofPbV~7CNvQxw(umjX(o0! zCw9dp_COQ+rV|G)6NiYBMtG9OG?ONrlcwU5W}r!P(@6`LNlQe@%P^kg70u)|=j4sJ ziDt@~bIL_r$`v%_W;*5eG6g`K3eTI0pp}Z`k_wDZMXgOm zpGm!cm5N22hRvIXtCfcDl13PxMqHcra3+oPDvgXdoq{)=QY)R>C7m`toxV1mVJ4mF zDxHP+6C3X*cCAmGE}yvLKk?Rn;-C2>c=bt`IO92QhNxDCxJ!m)e1>#whU`p+{8fe` zaVCg2Q$;IN%_UPKK2xhUQ)ebq?MF~IIQuPc zww+eCgG;tke6~w%_WPM^x2tS-;v7%j9I#f7k4uhUd`>`ZP7rJ+C*&$8j5s%fH#bTv zH^wCw5}zAio0~Y3n|zgKwNypTYREbeCASo5np^&TYNK9 ze0x<4ASr?8D?!jML2@ktCX}Gom7vd-+`lftA}Ph@E5+3=#dj?wOeiI;D}6XyN_t&N zMp8z>S4OFQw^dz6n@~nySH>_~#&liALQ>AgSI(|o&Kc`k&Ye)sTUX9MTP}EAE=*GK zoUcMuyF%QxLNcL3x~@WYwnF~8LXo5r#8;`JU8&|;sgY2rRadE#ka9MJDisFM%_qJK zU>CAf<-q}}+^bA`t1P#xa)u3UT#4WERc9(yJMa+$+^e0@h~LjvryN$h&k}j^)g&m@ z_#_Yk!nFOjiC(!@1sZ7%HRFdAjmHIkI<^iP*^fm8wK&9pQLO$c5GK0HSeLnVo*A6wq!fK z)?t7~UpjvEzhFTCFXA~Bhkv)c%TZ)1dM2%eR1YZrC@M!blU}{MN3HfKx+Ex*!C0zS z>vt~*80BlE_glIA(FK91ca_}V7X%b3;ZlEG5SR%AgML~Npyzb4`OAWU_waKvQpTSa z1fs%#PPwwmQ6q6PDla%b=gMohg?Nm;$ri@QQ`9~iO(V7!;n<~<4(%C(`}Ud)W|F6Z zxe}VIH7Sd78^Bht0bFYHAk%Ex*-<49(Yw1EjEd=yZ7UQfFV!S)AKC( zhV8=S568bW2&A_KFPyN84t)6dAqQ?h83g}4t-3%W&ey%!?#cTmBN;pI*+1PN;Lkub zx9|RL5HOcCKKq{r0p_r!wG7ro_D=>uajxI!-IsOngScg}EB&q4`R5-D0!2A1kKbev z{64LEK_1QZgF*0*X;r-z8@4~BRhLVhHF8LXGrhHc)T$aUo4CGfRl2wDO@6Ia;Z=O> z{+m`M^z-EYr)X8ez%uSXs8y#R!85se`?kLu2t*)eOi^P@!WN^7H|Act_Fn9#N*z{RmsD`B{SS2t|ArkqBUOJ zJGm%U+Ou8J3Xg> zvh(`_Um4wzw8|8JdXF3b|I%~PRn0qp>N&@~%k@-WrmKyNSgWheoc|0xCmK@@^OXFz z>$x%ksT>1p=6}T^96zp1S@$2;bGL=0NZ%LXq$$Z*eq4mZ^BnU3X%P4TyrnR#{+ua;J@yn1M(jijrzZXK z&~*tZg{ryNz67lP1`ROvx`oh3?&HOXj8D|Z3haT{qjh1|%!<0ekB1Ih0JG7du1 zV{ie2hH^7FNydLmRp`@G@aw~KQ0ScB zn!u|6`d=H&niyRlv~zygU{+fH>hU)!7Ju*J{u>nw9Gqc!_^VRz0AYG@+lJu(*^0&Q zy|{m_SV*9!jI{nEX}=I;oBKahEPmg`P5bzm^H*spaSm0l& z#X5Yi#s1El&HFMiJYI#p@W-3&(Ip7LOywt_B|X~Nc0xvV$IZYj_fERHdnFZkK!g+l z0MD`KNbaK1VMUB)@Sf%>2Ir}KWgqnc=;vwl=c!fqj59Tt=j&tSYy8a3_^hrv+A~r0 zGdDwevUcXKq49gU8UO8Oi-Eu-8D&*nXPUFlDhm;JWMIPqj4+E=xuvJ(%7`}O`S5Jj zZo8)NlHs5wc>Lru?mXLb7gY!oSBZdFw_?hyIw->dtv}OBkBZD)ZR!O)fHu$JQcHy{ zh@hAiQP>XgX!dv_8okG!Sr-SOeK|57yX3tuv=i>WGs9Jsakq9$S>m7m_Pp^Om6#G@ zy>}(W9XCTQ#|s&I5%@3TX7JF`*Z;`PcoKqJ1u2O|M0KY`k4Bd|*oPp`1i;;Eg4LM| znj~00SO@1p2M|6#OYWA%n%g5v?VsOGf#t4?>?=0`a!S(n<2II=;)g=l-etfEY<{fz z+8;e(%=bN{RPkac&WZ+*QKABpOdCr32e=vEZ?@Tz0EfNGztYgidg(lh5oe*@KHu-b zRVPNd@B9-t<9jW3aHZ+%^GXA_y?sv-9hcX7hAo(P+>Bq=V*lXH_Lo|0D+6EmM(1rpYWC8hh!C1bACx(G~v(F83*ukejomcXDA5obcOH9>Q(BxFCAq zLEM&tgeUx*CwRCGRX^x~^9w@eFEbFK1EnE5r>e)}%TanA@ zkJsDQ2>;gDW7bLu*%57Y3A-YPXgWRZ+R1vi$|ARZ)0g+YQ_ncF zyaawtJ>#1Ys5&8FZD)|@xCRZ>j+JvDGRlZuV~)ggmJ6&Fm@x-xK_b+$vL7*;>+;RU z!5TQTOTU>~3C+%Y+N-MK{LE#zZf?RtV1D%;dCg(uUK3xtN%QM7H?-+5PkCA3Ly-WNMuvT&A zJY?}rLf29RRl8xOWQJt5eUfvV>|c(&#XXO1uMpt$%OH1BRcBqgEOg!;=WVhHoXevu{}q1&>`IwMhru<;JX+yYH3 zo%Tni{@^;h!(il6XD*ow%oNvsBMDyD$!|)N$-3?2dbR-^*2`mc4abGP9|kpruE%Hf zPHR4X*l~P$J=aTm+L$eH;4E~ru)T26-1zM=jUCLE68CG09zTL(L zWL6uCkO97&nN0h-!8g0@(_k5AA;8nB-f_BC*Ddb@-RvA>7JWZ1OSnCwa{n@6@!-Hd zp~Py@=&kuFNK)V3bq#aT$8928xsdDw9z>ZL;>JpA`Q+RkXVQ&j)r(#1Bf->Lv23pw z+_vV_VE86406^obgopI1*nxvHysgY4zMJr>#e9|u(9vCdoY5fFd#b~lx!roZ%2A2R zhw0RmL(E4MPfm~)e1_~MTw_lQc_+hd^Ot_D$k}^#d#lk&Mh;qK;H1^pSO8P|M{byy zAIQeamr&WiMw2bu-q}f+wbKs*bmmZXE~3KHT=!$j^x*QgiD%JDpYrE6M3b`d4b||D zxB$&l*umUwR;&GjA^x0*{^f+qSr=w^&*J__0lauY%y@P}tAPL(f6mMxwo3mxpmSB2 zJ&(Orm4+jOY9Lc)FpMm?-~zL6BWPAKgiFi{e#tB20&N%}(7@ixUqU66K!@AjMTX<0 zzN%a#FoZ!YfYC5$7#Qr%{Zqg88MPlfN9guiP|BHQycjCVlJ|0#6?c2sXso9=_e&Eo zQ~-vA_9~DbxY#aODlmt#!~i*qe?H+&B~t2V?Pukww_4dhgYQ zIZuT#Qz4@0Tf?WRVM~S2`1-JCegIKNv8Xz8L5&N;B17>NcsL@Jp{6LQk$fC?&0l2( zC658M2n&aZ1aX%&T4j*Cl`A!tiM@x5( zB>TA|0~I2+zU3_$qEr*&M}pYEIEa)mlHVm}0MEM+O=ZCv6o7De05zOs7+}%Jx{wTx zN;0ZH$5fxzG9wHD1kl(WiW#mzG>bM#V0lZ`Wi>|wCp8qUWMrQsWr$J||BOSU90kxL zg;aeRY8eL*X-W(@!;~sP6uoqW`U8@IDki4(byblbn;;q(A-Kms?B{;1YK-@*Dt$}{ z-n%LdZ5h*-Z=w48L@Dr^x~G@gDU%>Qc6a`BG;MW<&+VF)`i=p}09S%k{3%oFWsL4;bBA%^^SxqZX^njwLK(B~{7qg1LY=O48 zup&1h0p)gLsWg5Fv?yxR!E0t-CmJmN{$_)M{Y(Di3jy`vcE5<|{KpjJWd0^jOdNN(j0= z{cSVX;YIl+v&$_qVPizItlv%4|w3;e}oU-_% zYuGDmQZz zQ=h+gNw-AgNV7?YmognvKCZamQ)EGJK^+feY6l?VLI(f(Py)z2} zM=KD%LUgu`V_xIAc~$8~-7K()Tr1my*FAKyJ}E-c}tL@XRuxzH49LaH0eQbR%q$a}gHKUb~Vplx$X7URYOF6^TP zUZg8^TgSv(ji5GZe&x^k%974?cu+U~_YLPpn9w$51=m(sPNIEg(LIQac8L=Xa=WWI zs_uKU^VAP7%o^eIKIp*om4z%igMzvco&t1+EIw4ZyYqiuIqRrwQqzk9SX-buwYP0K z#(AQ&b#uxl@nS`i1ml}F-oN8KRQ0giM`?!v*3U4NOPXw;h(Md(e97Lbhi)^~wH)K# zbS8as`H{v>Y4;V@Gjg<+|GS zoH~NuH?vUn#LR(|=gOa=CwD$=J$pZRkvPbaC2>KO($Q{{+Nq_cq5h2_EERF+R`p$> z4oJk^1-o8Ph}V6tKC(N|7t(I?hQ*ntQVYnajXH0I9{k#vCiCgqAj>$CD2jLfY2ss} z5%%hA9jNUTxAQhED>B=AxBw4;fuYl@GNd2-GG%-;?sTaA3X@jOi`jlm5vW}Q)M6?$ zX?a>NKHEkG(W{O^ux7}5VeCxWVN*nl_yxi6AmQUU(F8UY0)gCw{x`eMliU^i>;tM0 z7Dnx?8#KDUVutga+=mKOVj~&IS~j}I*O!y=8(oAF_C{J(Z~Qf@!S7ht>rk`uq$kJ7 z>4yvXwKMYyYVxK(yA&jRE=YMalVn+tp*xl+P>?Dxla(}+!#Gn|IFr3QUD7|ZA=aAG z)v<_{!<^~1#jnhqF#Flk!d?Q&3b6t{6>#PfQY)ZbP3c||2hi0qL}o}5({=-40lxYA z?-FDsM5rIh<>I_>0NotJDOUl(DvB>T3&A@fIBeuLeFN?F8GYzAL^^&f3w^=7ORVEE#XE z!a4h`!>YRML%iuo7vnqDaQKm4_A)2XZF(qDof;$FTj`C+v$5DcBIP93(Zu5CC7yFper!^ z#ITcqe=BJ^2cf)g&1Mx-Dmjtyyr<6yQ}OC~h9S%3h|ih;$8t{5nj*2>#)55A{-W~2 z-rnur!9cQ8M#m7TayBwJBfIS)UhVY0@_Dk_^?>E7*{Ao{rf`cDWSe3M4hI%B9cpUo zPy8wu9n6YYy1uwIpAlNp?HQc19CkB8q^DZAPuI^mJ3Xh%!AzFOivvFW*m~&W@GOWX zu*?rViAw<;2QbCM&-ahv6^-BtZK((Q*rDo_%qMCz07-qcuP!nMPrGW8$2MjkG=B~OPlrS@@85q}r=E-wug)}x!*2^FF@8H|V3v6-{5W}-c!g9d ze14=IJaGzCIIjX~jGr8k4Qw5{UFD=)EugFB;urtE^xo!1D!Ki%lQo=)|Eib7#tSpR` z(g6TW#K)(l@ogiAY_ zpr;*f5l6H(o-a#&Osa80ZJpHXD8x)M54DRM%6?fapTuysI}PPJCvCWPI#{tcXHL1j zIX_(di#ER?`vZ*vyhP6$@#a@eN5pqgo;q%Z}4;bjR+Vk)=h|yMOmIBQ!!w* zpfDGNwS0vCTJi!@2!U1ffy8&}nSv;*7@oR8sTjdaFsnF`aYm^)iFF&R#3RR*Qi;bO zD<06M>TQQre6+|#qwVId@5U#iuJf0?A1sQ^ME)S}Eso#KrEf1)wFU|~Q|LoUnR3uf zPAPS7JvMoA#lzzi=2ox?S^!cldM~9nC8AvOhJ`ZcDm)&jrzz;B6P6t1Ce#0-m7#~N z2lGKCPA;S)kr9wF29Ay0` z(9#v~HmSOA395dY@x1yP}Tpk5$?PnQ&}&?#Gq zj7XtfD%}RVWqP!eS)ZO=l7NQ0?cm%=57)b86t)lraUR2Hbt9-@>`NaWqd4O%s8ND- z2aj=*;~LaB=Ykfv)t?~URY;ZG4)uC+R{6nHDjX4%(91QMFfl6`%F4r5mmn$W2aekO-{Oa>gyPDnc%R_=J@gxGRMWTrXcCse6i!L zdUW|mk_*x3Si#H0#Og=1o5l+bSL@L)p{@zmzO>gTg^g0TQTvY{=U=r~11~JZQN{bw ztq^f_;qiW^p6Me{ZSY`P0v!n653g`%G&k8`!RScmfIwu5=jbs*U>ZC10Lcw!7~va>_GYC z(SA)Q|MGB( z_eUY^qHC3Jk$S7?D>IjZMlJo-$|S#Fq_RtKhQh zm2*Mi^7*v+ZTfw=jZ?Ne>KTWMBd*zb!CDe5$*jr(SPXS#00` zR0q*~vT@J8#6#6w`&-Xsrd4)HsNoLm)#*K{o;^Pw`q~0i+nV&g^qg{+tf!eM``1K1U2VOpTglg#h<%Aj$M|K`5S5 z$KlHf^i`((xPCDezldXt_3j`Z3M-~}ncp5p2}p>NyQ6L^CoV6wn*oPB<(GqJ0jsKy ziTl-kwnM!bR$o-d;}%!3dm02sl8h1$7g?ESleDeKvDf;UFZ5@;^IQSt68AJvhm>IS zCh1!9^ly__#V89HmsNP7$2M2S4!7xg>$(h$-%}#-I9n+cT3CQ+WX1@4r zr$x7td=ScBT)jMhTQ3&?`+%dBmrmMc=_VFAXJEo=mYxTtU`vRPy5hA;s&aZ=ZyVw` z_w_Nd^QN0>uF)%$FC@p&0+LMi(b*QvF>t6A6zg0%Q~(cV5mZ3bo4`nBbQNX=>Flrw zfV{2LYL0XqqnX>XaCq7Z%{`ZLb3N;qhbwQw;$2oltV)h69~vq(cK71w*9dz&qNwEN z88%JNJ;wL~Vm|S>H*9k82kP0W0tI+V_Y$8K zh0Vm9(J5g59xCiBZ=kSnJ6cq`2@B{Tz~@PPjwF#ckPxVXmi{H0m9|Wd@E$KplLJ|k zzHKyekg$Rm0o^gG_N6bPDAD~0HaaKNGqflH5h7%j<^V4s8h-_zL9Ry*7ipU?z7C1W zWn=A|n5gDvHST6?+$L%}{D*B#bHI>L!WP^F;bxx7q*9R!%CU#LE_gFLU3FKi^QxREnf>hx7b{rFB(Ehs^wGCkwgw_Ww zK{8CstRg&jU`1(0vjG0x|kVlR2b?~ArQ zd(!^&;Um4xHrBun-M)62is&U^jP^tE=Ald1D*@#Mn%C@ z~`-3E|r>Qbh*6)uKe*y(sZPlE$UIf(VkK zc4(e`GC>v6sZo(t^>K29rD;69V?dd>QXH0HeCeHD>$sl!7t%m;*_NTM*SWPl=uy4k z646T;V{*jEL}B5F4IwsNO*^f;9(_*_`#u8uqgwfFWO2YZzDi_$q3lE{iA~l)K{G1+ zu#ZFVPEskKDG8q2^-qWbV|C)vEBcRfWr8iD6zY+q7`mcf4OCr=sE_wm`5%3o)65FvFqSFEkRpKsMA2QTOy#JYcmd68R1Hgv?*pqQF z5X8`n^aEOIP#pOcBit2{`zu1o{DFr4rchL007t%ytV-lyW9kruWVlln-IBaNbx6^Y zj??Z0t=fbIH(KUKxZTU7;fWNy$hEhui;~5cuudrw;p;XHaI9CV4F7wjDh4Hhj$GB4 z(q%o0iO7)LT%b$2w?Ekn{!b{-#34E=#e2G-n6MEvx#5=({1(CyJXH`3+NQ|Quk@ne z8Q&%z9CRdj1Me|LkoJpVMibv-i-^xGk(r8qlq~2O02F?VIK|8MRK-{?{Sro&=X4kT z`8lK6WUTj~N=qalv?~-o+Y)gx5rlXOzE?uzViHeG5uaE3-7P;UuqzjtE8|e1BM2xH z1p_&PfevHz6&C@!Iita^Sl~{S1E)Miyj4bp$JmM51n2#V56P3wF|-YPadbzK$-M}J zRbQ$GW|DQOCylPxsIepspVsi#VPOgfx@$9nFuj#uCk0WxXa25+1*QS`l42p5op&zJc+BLh4iwrzs)2I`am40+wwez!%uY^B~Nr<3zqEObL zy-U1(MhH@zyOHwGKTzSv)nR94`8Wg=@5cGWFQ&||(}xFXmjtj&`BS`?5O16OR#j;?z{yYe&;u_t4DH+R9%3Du~my{$BLO1-Gznr=mH(R z9G18>jF%x;^Bb1>F{L=7n=e_NbsQNNIJ@VG-w#Ya>o@#5%h|0TlD4RX#Sz1^F!o7T z{lOeQ^;|J-1n$JkrB#TUq`xp=ibW9wF|^O z8EB)eQuvDZ`U}VFr_@md)IzxcX%XBu+C+59xM42VH!xGWH(|Qt9Hf(Svi|TSk{lij z(aZx=L@ zwIz0_D~(L$C`ouKr#{wy_Ktc6;xvQ`K-w+dI5`Kqw!h#coqa%!j`SV_x}#442d|ET zzJeC@{zG4n&5Fnuf3j4T`(l3D3w}DccrSE-*mBZelmvr<`qbur|NdA$iW8ko5#d*V!)6!-{)ng8hJwn5hagdoKm<0TDn@!F z#opJ&i#1fRltq?kz%@!R04+*w?TXQ;$A4X&Gx)u{QK}!ikj~hnifIr05dtxjXQh+9 z7p9a<8}^?~qLnsPLrm4FM?NmRavXRZGNBR!Utz39py!|-c7f=M^!bJPS}=8UM3%Ah z-CMMHKv%a}edZ?o{V2g)|EHvaj`#|c?292jQqQ4g91Dh7R;%7x_^aHC8ItgY4n|Sa zQZ3>NACr~rJ65Kt7TeV@8k^f{#plMy{VGgxf-g`))-2?AG2%`vhOK%GWl&bY%O<6K zUECaX<|6yE%9DDQUIIjpxY)Bsy^ifl{2?>2t4C2m9dArt;Xdg@nG;t|T|hTRF#+!p z)T`luv);tXqJ&||M)QOl@~r+qJ+t}{1j>yGY`VZu^)LG}y=@G)A2?hU&8y%OYC>Ww|HLXUT{#!p-sF#l|PdS#2U z-;&qAT`i>~wp-Vxqx!&DPHN$Ba_3DaWupiR4#>Mp0fD`tAcD$KeGDI)|8g(?iMNRS zTYk0J5a*~TmdVS7hlI=`eHh0mp`T&Fw5e>4hdQQ*k!zOmhf{~sZ>JCXs6&tHHt;Ag zt;>nz8phrkU%m@pvPRrKxZvHtNi&vGBaM10ikod*Z8WcQNx-^J_>d+y={3_SKceCJs(C`h*}DmDD+84+^NYRk&vx3Q7!4i|VuU<*?hmzS_vdUMD=umBGSR8d z@qgC(iki1Y@!IXQrT zSb&<-IY{+PY6a^u-uOz4vZYAKHOtqz7~tNUic(Hqhf?!{V}+3 z5oPosm{WYJX1yA_UrTou2R3$27<~RdB=$*xv4L&E74ieO101e(h-Z(`H8~YlqT?C* zp{b{i+b|3nfp)6GZ=%RYR$~4`St#mgC-((#i}L7#O7l8v&;|Oi-?ec3U_c27=7Em5 zMXmFK6jdAF@LqAdg~Rz#V()yrK9>n_mup1Dr{oZqhKGX(vgve{EQcoBLu>uYlH`}A(c4W$mer2 zvSn;uaqLW$8IKlOUUTlv)jA&EeVXfFsl^wE+3JS-Xr(9inf2Zc&&fuK?H*;nVyT|L zHPMx;_6NSv;ic-Q_%9XtzJiH{Lp%Lhq^>_!^}R8^P!>Kfr`47ia0*3pm53vF{Be&6 zKiOXJ&<;-v!AK?99uEH`*$ckqe9RL`Pa{p?S>+18=R?o)c?U{0;42TkQruS`zix7+ zf>TRZ$P9|8Xw|%UF=$`Ym5NCr ziiw6r;WJ68dc&~2PnQDd*w|nCOh!8|ygq$ZGZn~ykDDDw@QNeL58-X4e@HQrVY;V) z{Uw!`6Dnlsy*{sBSh^Mc)a&F0R_6zwmXruh{bp5r$dfGArjvx8Vb_fM2q}%5Ms6ND zD+ML6fz5&tsv_D_AHutg;Y&%1YzO0@mb^-?mad@xIM3tqGHR3!NL|Fi@}z|@colb>8F4w>5TlGhTGbF*}Z|MN_FDY!itp$ z5tJUdLTTMu0syq2g+{nfc;>FIp6dtVeDSr6GAJjepNcn-0&v=Vjj}iVX5bx`%91Ih zhUD8`KYi2-W30Pj>tpTZf7Z`2`~KMg&vyN>1sKlei5hXXaZZ7d*ZFAq*M2cJ*$u?c z3or4ckDi);F(d&MXh5HvY)88!S+T7@G-nj&dF7-+b;G@%x}L!@F3bsM1w5NtSBkSVsRU+Odp2{?*CFwox@spvs_uXUyCYXcV1+ z(EweGH%4%8UwU*op>A(qw-WroLqKseF_6|syb5T_q00)#cP^=H>xcD~;L(Cz;FDeR z8`*XmJ%3@+N(v=An|TdsO*jHSrhh z$cOuks_A4eva%W_?XjdDoFJaWR5n)&v$)JcmsY1}IN@6qU85q0=5NnK>G8VdvF(PK zjVMIp!WjHG$SJ-Caks6-wY?BEcrBh`BM9Gb$ZX(;LWeC(+@<;8?v)fBP-_BVCJu20 zhz6fypNMdzd8^U4>g>wKk_L}kyUyR!_S~9E#@5TQ--d=ccbtWCLTue8mWe2Ea=XOX z%ECk5Q&K*m>y|nTVv)_mOBjkyaeu^U5qrEcQ`OYHvm#@w0m2)zp^#1s-ua+}AbjX# zfD7|4foFfWqez$88M!BnpsN$_M|JP~xnU&|06_$QnJk+YTwoK5(v``^+!BqjVH2$s zBv*s0(XT{`2p}nw5S6X&cxLGlJu!Fx@hC9)9TQ4C(Ulb4?t}iI5}X&AC!PGRP|`Qp zU5;n(CXx8KOS3*4d+#147Oz0U>8W0&cFyUFApL*TozrtBaoDEcWa4C!ys>TDp4hf+ zPdu@0+qRudY}>Y-nY=su;cO3fw`vde59q3{>VCSqe)s)cm$>4O(o+W+@Kk8O=cMkZ z?^)S2WYlfY6w23SIV6A0Af}-J?zt$rB-ezZPJx}&x#8&$_mn*3sReOQ%yO_Ld6b+l zN|MWPB~M2bVFa0Mf8!e3;}w*!sp_0`PcT@LGvh_KRssDHMS4aZ{iE0 z64nBJi%q8`#hcIgW5@7~Il`Eu+HiW#gAul$Nkr0QpIYlJ%)1dU9=_0+Ku=SMC|D-U zN*7sVXNZId3MuS<*bqshj;vYwpq?Z92m%_5fmL75lPEeDR>yP^iMoiO>EL}y3 zgwJxi36-N=#wV=H_p2ydN)G4c_Jvaj)=h6kxaV+}2h%?x-0WpqOwCQnwhvn#}F17FF`qFLae3n&3HMvm2SmOl2TE!>*y3XowgGJY9OQX~I%sGf2fOdX=7`;>QBC@q7!eE?=t7jS%-`%0? znTJl>Xtu05+~*78-TTJ)Hh|iD_i8s*ONMMTECci`svwX&MPnR-H@)vXK&1wuIJ}Sa zSwA>*E*#Ak4%3SU=kce^{qimG7*-L}Gm1NnB--uy^w$SS1LQ=(k|E{~5h z0UqN>Qm=!Ng>!64X9U-Jj5v80v~}gDag@CdAIo=IAU)XQpKL&C0aNQdnQ%A#--o?vW5E!7ZZ4Qo z*hv9lL%Xz_WB!w!K~(wfiQ2xa74cuLyweI8Zzc^ij`t85h;+`0YVHgb$cWX1K@}+G80Uo>D8%GaWkzoVOVCLbE@Odm`FBVKPKpF>NCi(w zr}*blzY`}QE1}e{Ac{fQ&`+aK?+G##%PGQ&^ol*x5w39WCE%MLv6BgbPhMKhiJ?s) zqmx1K6bHGQqF}*E(ioocA$CEK!nBG?wXTa8tMZB-d6dt#*O0lR ziz=8O(RhVRz7;+#9f@I>iSUs9s60Xmm|?{}D$0jgM@9i2lZoQ|Ydac`{RtU5tlFp6zQ5&x#qO@ACZe|M9f}7U0Ub=%J*A>`wtiV?cKnOTPG~9s} z^HOMogkqwgutXr!q9Bt}KZ+cRdG3MCL8nlC8PzX5-cSO;dgdIZL=!=*kR1X_peGbH z3w1R`PU^6VRd5hh8;fU4augqm6`)FfAQIagh}wqkXVR(K2aZUclsF)sQc}a2a#0L> zz{tLwh}DD3JC8AHsuoL{2~A|lS({42S%@2#A)6J64IT;g!rPLR9U#vq{47SZopZQ2 zkyb9zXrz?IpfvC*QyYQ)m1!zjN~Q`9pE-mgMvVGMg-|>d5>ToaC}ODCp}-mgJ#;o> zOcNC>y;`YC<$E$?ey}OR0A-DG?C+Bk9Xzj>T{1FsG&@zi_47fU`WsC$lBU|l?QQIvX-`Cy$Z zMD6G#k;+jSv}R4aXKiynoa1I)Twa+DMO*Bqo+(gO#8Oq~D_t&a<34av>84(4T%{9I zRT_CI#$;8kU)6GOE&+FusxH}CnVPRnQ-=bg?pdko*`e({soJf{E}_ToJJGc^6>oy2 z+XYq+eAyI$+x8*S4YJtwbJz}uTnz}&4KvsdsaFq3gAd$~RxZ;`ebGINiW@y$O>fwa;m}W# z*o|Y*&#~0Z3e@~l)X#HVFNxSKOWQ3d+pTC{uNYr1=+m#c*{%83tfkVg=hjSG({Iq& zZ8%?VRN8HN*=>c^^sdxw@6hj@)a+1|@mK6EL)LnIOQT9&pqi zVpM+e-B2O!zB1Py=`);|*PhrjoVtN(PkkBALTk@r?JI6-&T|=OK3th2w@41X0rF9>b4(}`upRqSjBXxgf82_%+ zP02>t;4MV2-P-LrxSZ9wb^rV28;(c3bA@37!G(cv9Kkv3ZQmSbn3(>G)PK{chdhLW zlvx1C)XzBHLHaSlgw?~uF~O$Q!{#x;mDR)5F~PUh!}l>EjMgK}GJRjI|GvwFcv_Em z%Y^h=j|5^uhIX>|xU&h4w6g^Mr?RA|1am-*z4OnT+IC;$IuLu}rPPlo@&^j{kgHE_@5cpa5xQ8{U@b^c5lpbR4gQm!KzfuWSEU)3M}LrjpPO_6c&vX4lI=Jjg)>YRAG%& zaV*qnjnsK8G-Zu6bu6@PjkJ9%bfb-Qvn=$hjr6-L45y6_ObraLjf@}`Cg>(6Bvxij z7dnNgIIJcXMpjnNCRRaKHi;%S1y**ACUyf>4vQuZ2Ubq^CQd(AuCOMqI9BeoChjf- zlj0rjI#%AcCf+_)zEMyU-z+QtY7_r1tH5cKz%8rbYm*>|RS3FS2#HM?vssvsO@y*p zgpuvX<{cg@1tyYO~xfoBV0B{4JZpYqJ7~O%b|95s6(1vqg!JU74~)nUP(EvqeRa zT~(q*Re@biqeabtUEQKZ-GN=hy+y;1T{EmjGmc#=twk%3UAwGByN+F_twpDgU3aua zca~jmwMB22UH`O2|CZh0wZ#C$ZV3Ia#?N7d*=j_{VNBU-%*bKF*=i!lVJgvTs=#5U z(Q0PEVQ$fC?f~MjaBsEnjJps{-dwjkcc#oNg9v zZVsI8?rrXVoE~9q9&wzWX>Fc)oL*&ZUUi(_ZEfCtoIay%KC_&^R@;8CygB7?!G}=Q9xI!)3Lmjxn+}p$a zxWdEQ!{fLj(%K{PxFXBiBkQ=L+S;S~xS~hfqi4BdR@-BCxnfV-V{f_QUfbh9T=CEy z@krbWn4pdXLheM$jzmW8B+iZ`LGEOUj${Sy6pfA)1MXCdj#LNkH201)KkoFfj`TS0 zjI@r7Jnqc0j?6mlthSDG=gXYH+*1!zh>Uc~dEvmU8Sp$+_48oz_kRWKA!_h?%8coqva(>+lh-(*`iIpcaqSNGH` zAK~Lew5>?%V)x7~A7LHeEQoLJcl|6h|2$?7EK<)rWzPaHlOJ8rqTnx>-;hfR{L7mT zHf+C^EqYcQ_*dO~R{i+b!g|)?_}9~V*7Nu`%6c~H_&3{nHv9OuMtinq`L|blws-k= zPJ4E4`FCG?c0v4m(7k&|0{fV~`-B1ql)VRx0*9Qvhk^n}61_(X0>>J?#|8o?7NFh} z2Z2-f-cvt;v#{Q?IDzxD-t#}6lSJQ>g5a}8-?M?>i$&jy184~v>6Nwf z)vxa@PVhag?>$fOqpa_vPVlp>@3T+v&uHJDS;4=neSdcazfSwUZUsTFflbI#$r*J%;rn&2__P8gu^+G-ivH?hF@;**xJe4E{`4tHm;jcJReWz%QX6O ze|f*&?vJJk=K22me7!$i?aTA?1A)L06#Kzo>E`;s0c8~jAhB)d2B3+f6$fFdtLFyc znWq$gf9JlM`;8=wpfm)OqMIK=RgzU2M%S{PAI3C_RvN*!s-7RgbplN(jpBP=&5sfW zASjO!N6;;dktWD0kCSKEE{szaL@Q5FS5z-d&^AmdPttc>Ele^FAgD|+kJBwqvChk? zOtY`sE>3gulYE=0I&!U^NxjKdndN`KTAURG`>r}C3`@T>_X8-WIxmK8w=^$79HY7* zMP0MBAj3SZx+uqey|kzx{9SEHNs4}XNkvIcZCOprZh2Y5C`N5X%c^F1MaOAcZB@_n zdU@3#;Jf;oQ3U3kx&cI; ztA=rg&8wz)d7bN)b^Fchw*6S0n~w9^&6}?K8J*jn_nXbzJ}@NRy8&3nt-Ieq1>O5$ zY=^D;QQ|n=hjHq4BJ?%S=$Sz#o-r+F#H?WaX01-<8GEr;#rRiik)mvyVU z?UzlbS-sb7&)eOPm-Ok5l!>s=2b;s?_ z=j{NJ!Jqqa#@#=U^9lxkpVu9B|Gw_W8GOB;*X@3N-p?9<{=VPt{(A+nguoEv{UO=* zz<}vOkPPtw-(B~<5n~C%%Et$yH}63*rwf0#j}O9s+JhFx5&_1>2a~hy!z!f@-XBYa z(7W!#8)5yxo{0}-Z{Gjzl>P(%CO(Y+X&)&7OOzNfAzX~@0GN<2O3siFA?JF4T7V@+ zEuRpn)_j28kS<1VpAe<@bbvX4CC(h15N*bGh&`V!&R&}kW9NE^yN@NoJ(Cdov-uGJ zK3#(UCL!+E(;*=kwxlp(VtfdjDPoDEq!>eDLX2zD5h*dYl$3m8VoLK7Idg`ToPAa zhWyXkq?~KlQ{H`S1<#qJ+{Hi8tlz-@%dH3opaTHr0oSm>|KZ~J27@PApFa=;gG%!+ zH!AoYhD<7*-F}BT9EHVdy*1WwC=^BTBN9)l@jo~vmAd1NC6j4PCKK6GO{LRWTrL+| z<4t9=c|t*O_|nbg^F@+LGx(&&RIO(RQA{ILhtX^+ zmWMH1C*_B+d@pB*aY9hkNAaQvut<`u`Ox^Cyk zX@;THC+ViCRwo&jr4=WcwyozUS&k#rr`fJ6R;M{0Cl#l;J}>8|dHzr|XZgVx)@KFb z6qRR%(Hs|NMe*V^=f%nD*5@VZ=9TBA*=`r-W%;2r7dA05))y7!rIibpS%&MT&XLjk(`Av6u! z`(Z4L>iZEq_pAF+qAW2xswyTFprct`bDYjMH$7!xO9H$w+*Q>`_ zA!z!iIZ;fzr+G=rnx_R>&g-W|MG1ZvaAgg<=VeWcn&%Z=_v`0X!!Y`nHPbY^mvzgs znwJgRw(FNo$5Hy%E!S1M*KLo}n%5nlSJ3tAu0J%x+g>oH{o8&xW$oL4lY!+GaTEW) zrp!^v7QktY4PtcOg)l`IAXrHL#@VGWv=rv=PtU8?^J5mYvVEZZK_P*bsRM7`|*EH znUj!SNX&dHrur`zN9R)slb$k4Ecasie{)JYu`Sl4tdSFzb>n}l*d~&QUpszRRB2o) zVwO|KYi`4U=H1G^pfdOchmZXuJLyybd3L@3t zt<+OZB?N!+hilz>VfNw_GqdMZ8QKgk58${N`KGMM#{69SeX>krt2SPC|A zecX(^aXs7>gCT=_+=7>7V`PxEL07m&RZe+hs5zBvU8zP=pBHr<)H>8kG+1K=CaI(F z?AF%*z1C62eC6QcnW!LV%mJ9FyCPuP!5UC28-0m+&QaWf+rSXg%)9lpuHF_Kabx`r zc{4!KoivpC)*#P2eyEa@!7Sbx<$*YPlCIoz9n*WoM|>tv?%| zQFv<;AHw~006Dfkn3Avc%i4_?!(6IDJIm;i0FzkNtWJdID*lnhtP$H@Ru4C6{kva! zBLPNu)GF;E=Iq-b8=_-0tnwP3_vr{415yO#iDB{*dp#xdltoQv`oa$SI196*OgK$# zfaWss`ni*2D-i}*p6M6@Sd+)?rapSz&?Gm5bG%CVadbR8h{PTp#spd!2kQ}n*@Hte z>!*)dG#MDc`z1n`5#=;c*YmefNL6@^4;DUZ@FcLHQT##|xiL{~A*NR{pAg)vdP{R^ zrlz4B|L?*1O*(TKLyL6z!wLI0m@ZQtGKw9FJt7w2l&LksBRD$zNnP?t(3eDh!Hl8v;lO|?iB*@eA2yYg3q z4WCZV83gm29CA}rU0pH0Twlj8arsIiCm(VLLfTNuK&z1OUqrT;UTwg_>+Z|pTU=NR z`AGc-0M!SP=IxvMLN40KH=X^Odn<7UQga^C;o*n2!573v+?Y22k<2pg(;^l2R zC(R2Gh?wxZt(&y4t)&Qz5qSi6lZcMwTj#g@>v*DS{r)U!Z zVE?Aw54IO~aY^A)>y*uj{}?{pGZBPGRYLL&6fdEB0(kPF>{0jZu3v-Ir528`{gT;FsjQt@tY9OFjurqdyxlj>NG){Jz)rs6SG$ zzkflHAG3qHS|I#D(9?j~PYGKvz%Oy9Aj*JXu6AO&K`*H$2P9?&DNa*14`g)KNhZ;l>Sv=zb0DTc}{F4Fs(6R%mZFLGStxu zh1pM^L&Jf_+Y)Ye7_M0*p#<%=G=YI~ATIovfnai!h=&0q@%?b5QA5Ss@Xe z0~)RQ;b_3nlT*hO^GFwoFl2Y%CrWqa6b+Nf457kT^dPX9s>)E!5>ijfDQrQ5AT))E_$HN zyc*3@#ZnUc@=;i;s%Qc}0fr6qVN$5vfGC`Cq2zxH&DU?)#}c z#34@w@uXUD8X{?_u7=oBF67kM9^)8L9Ra^O(onBaVUT70cLu+!)Ro zXtCT_Z>PW%s}us1jLh|n-1iJ9l2j9SG=Yk!Q+4$SZjxmV6vuUxBx?NZ3@q_=!WwMV zV539T@d)76jrh=^!>s98TLWL3ZR(9DOZ-8^nFY4(16c*&g%byNGnT&-IztUZhTB z4#?*v&VOGhlU6EKgRLr?K(3}iDc%4!W#YmoR*4lbA`wlc^02JzpU4!Z}-#GHV6qb9RiC2uPrV`Q2NxeWfX#Itk#7WsQR-GKndbr6-YvT%UOPlD%KabKi`d+T;UlMI(l#9B8d>FU>bYv(};f z%Y(W@(Z*=h0KMNzyx%4PR_Z&@rqs|3yHT*g6DCOO1Io8`8L4r@uF!ebZGvi7)h?7a z%1zb@qNu1%^iH@6>Cn+i681`=$3}_KF?;v&#wKpL9t};T4MF7!)AugD=h2aruKJ}( zLu3;a>D}~U-O0?HRdbmi2Ih$VkzW|mZCtLnKCk7>gAxk-3HzyS`s`Rwi)IZ|PArXz z4bsrW(5Q$OZ^OISPpha6fGzoLlSz@#GMH8NM&A2f8yS(Jhq9{NRHrX8%>Wyi{`71R z%Tob0;2ZJ$GcXcacEr;@v)om^SK<{bcrz4sKV2lnizyPBU5#cDw-l^iHS=x27Y7AD zyF?P0^Q$zij0@RJTK#)9dH~13M{v8+yp^g+`%kAfcH!U5MoqpAJzTiBd|SY_O*G?> z-`|*rHn~zwjnvI?fdW2F<}DVwB|~Pw;mrwey{_TePs2NJOdRV!=7a)>6ZD~Pxe+3 z9<(59RJ6aNdtF%iE>q3?5(oyzKo*r^ z8rOl&fB9{uTV%u*Y>DM?&a`OcxLL~yBSxVt={_qJE^Am1YJsWXw=44^OTywPMJYP} z?CaHp4Ha@F!mzCHGA7heT*tJj(PXSo3%Jpe2uCKEj7)l4r}B2+W61nZ`id^TW)9+o z@+?#gFg-Fo^qxO`Huuxt_y+;HsG1Xca}qNHyzLsoOQufc1Y2#;Rj7SeQ}?#z0&f7d+~zEEHRvaDMkCjF&^zqF8{V{%U0vq=-$z|ve>xcLCg2mctmn0#P6R+msQ>AK-yR5v9E(OY9P9)p>aB8D>yM`J`^BU*9EBshQ?yrtLR*)lUXtD9|Ubg36cJ^L&?_BnNUG@`P4GLTh>0gcbUXA5mP4r$(?Oe@#UCj|(F9=*O>0ht- zUa#d|Z}eVo?OgACUGEXx90=ST>EE3A-kjy$T=d>t{U@h{;Pye__DTQt#rO6t_x7Xr z_Rr4k*Viq8@D5z?4#MCL%I^*)?+&i-4q^8W5p;)4c#k4@k7jU>;dhUfcaPI|kGFeI z0J|2gATxNN@Oz-jd!Xripxb?506j1fKC*xWAK45ZIs6{E@*a8m9{F}31wj8u zAx|QLPof4-;(kw(4zi#*#AijM79k`#(36}2lH%=?8soG2za&QRS+(w2Kkr%2;8~CG zMTzl6!{NmY^xV?_tW)=5iS%L;_v{3EarS$$uY0j2eD+j$@iBO{+I{uzd+`u_^H+Ft zB76%6J-dKjqmW(#cVAumUUhfhl0h#qanHU;uWm^1p}Q~Hw{KZ_?}ZAl34X762Jex# z@97F3rEwqmpx3J1kJP^R=YGU`h0pfcw~o5^&brse-A^CEm%+ZzBEQd4!cRGe&pgoE z*zL!#!Q0&JpX%GU0Kvau3U6b(e})|X7Jvjl`$2!!8DA0w|2hl4SKNLs`TZFZe9kcV z>=%6B1budcKAspqu6F<4-u^A?`^o|R1qj#e2n9euuh53y84hT}V)O7}-R}2kd??5*LT-|PMN1@e!Eqv2rCcT8~~O()}#D16S)Kbp>_6G`+MBR*O#<}+FR?ofZV z*iPLv~uRE4e|9U4U~1`(6>o)-HA<4kiLywMr5!T;HkS}mE}DzfK=o}ieUxKF~5r@D-C@?d{^ej9cERMhMZPbl43u8Qf}vXMpKo! z9YSMO!vA%tDu^AFEGMQ%|8qft7ax6DTIE-gx{l2D&v_lcV{}b}AaXZN6E$|W`GsQB zRxOLX5DsmtvXWM9o4OL|DmNPAv;1iBO7h}Fu8HzgJ7$zLx@J?ako37Ut zeL8XU_A|zQteil5VT{5{`BCa=3)hbflh}>|2=KWfh99K$9c@DKHCkO zzG=I4ytlZ=Mek5Ou65kEJXbA(f<1ac{1SCrg%T5)`@PsausYlBr#ZjrcLr?*(%{H#9B{0nS=i~Jeh}w)zs?_M*3HqJk8cN!H4DF z{%ClRe?d7#fj6t`v!}tje*}|J+8~1Q!`A2KwI{odn82z#|`rC3et7dH6w?57Gby z-%lCW24g^js)k9ypzxLRgYisBp=BiZ>B&T0GIongxm6CP)E^|_!H`b^ZB?Tjol(dS zt0no1A{1OpOymBrrLpjyPx)64CFMUUiPWjU%ZU=}EqPk-ZFb0D4L_vzARN2n!AeOf zv+!;s0C?0W6wMoxe$-`CB6B9Nc{PfrqJx2h!z?I!sE6ZE(j61Hh|952NV|(F*Stb)f~iFsSgvgHHyK+P)}}5 zv=9adfva!O);Av-NUcH877__42N&btBJ@)T!9nP$RpK)z4`R%uY0r{8X27Hy*Tw&& zYtCkDHKMivZw4#?YzO3g&{k|is;DNxWt+2Y#U#ZWAf;@D;VW~BEQGyvl@rZ6rhnNZ z0P}TEcrZKr&7f&jA2eIX7+a5{0YAU(^}Ed}wQSSxJF8@Ezt3~14o#<&Z7@rF#QvMh zND=eZ^K~V0Bebs+2I+E{4Tvze<`VkU$`@S!qd_yB;Xt*Tz)i|ck+oi&*m@5Yk(~xn zx5g9}2kp|&y&eR2x@V6vhfQ!T}6Uy?$fo~bRkV0rXS$$hK9B?-=^~ zYu#J00kdDUVBn>PX@XUT7@upyzUGs;_*3H=$E&06Rw)JE!$%fSd#zI9$v!<*+nNK3 zGamOQ#_T;-^6ndpc~C#giyGIM#~5LC_N=8i2AG!UiyQvU7IKLpV})^X_T;5H?HDu9 zz_LgRZOtZz|J{=PdXK61gqmWiLH|fM7T{U^w6l@Vq8tu*7=Kv<+%FY0GB*Vgg2p1VNaPa`G;tp=-FmgFY;oiZp9GXBPk0QT>@AL?ysMsTw>g19I2NL!QN zEPyGUu|&mN_F@e7j8>$N<{}Qy%lzl@j-OqwFfQ+-Y+?UaVszlA^l^A6dhg|Yj!vIb zC22eD?*UUhhu#)#V>JkGaY(%f0i(~`K>{psL%iMoY3ySuhBaZw8_-@S-L(Wz@KzDy;Y^n$@8DR3X@xO&%mz(8CP^K5BdLbaU}q^O zsRH~Vw~G1(!w@(G*drBzlOOPfm;Fzu-1PuPlw^2BRRns= z(s;>0GNO7!<1jKRN;1hnYMc;!Q%F3Bbf>*2IU#@)Q4~LFzYyKmbp{{s{ahw6pDpp2bcvQS7+9d&yH$0&E2M+=Of~&8A zs2|p6h`=OFNeDcwGR*B8{JmE00s#DPR6!qA88^ajR#Nz{-%*ll!p(ES(#=DxZ2g}> z0x*1oSnvaLJVRGny?`;HcsN)Rwn2!bL6W6D3EdG>*AWBRUbP>h&2K_*Dh%c{@FvY7 z=9#@Tu0kAi{a|Pka#zA+lKzO+!QY#}D(Y9W;%BqK3wzm&Rg_#wrcTXi+g) zV0iY4f^?OE28pdHQEgt~g8`P%s*C&vG7)y`CE8fzMi+=}i!_BzLu!Lq@)uIc@qv+8 z;t-O7Zw+l7iTuT#;Uf<$zp4=XM9P5`A%%Ps3Dx1+l|#}HfxcDYe$0X@gH;X#;cO}} zVML_`c;Ts{6h@09f9Al66eqKPguA2g#N&l0LUfH56fqNpSVh7FB$Ru_PmCl6x?u&q ze8W4?tf@#w3Ps^-TIv#?5auy1@j{jg0P}Z-0|45~F@YtYO>Dj*F!#iWS>1iVa4X{+ zClQUu3#=#KQIS!N!lN$7Yx&X=Wh0y;D@+1~vl~T0;~VXa(U}|Bq&rX2QwV?nSm{}^ z3GU8`Ee)YYEx~fB$ z(mauQ5c#vxN7Dc;bQFlCO$5ClNeq!{fCpLMJyJV54Ws&!}XE;(2 zLp9tDH;k&Cp4lqw_=i7LxQxRV(HdNoJ2-_bSPf!e^5Vm9<9TqgnrgrGK)3oZVsiLG z6G%C79|I(jt9dUCo~&$x6$rz^eKK5;fpwqY)XTBKm~sd!#%b zq{^fKLqV9ds<0jeeWYoa@pR|cH-H2-WRYkT|2GP0V=-!gza$krP^ETnYXVR%(R?TBZxzTkI?QfoPExUmtK=7d7f!cGY<-z*)|g# z0)S-=BmSbn^192T2bzBlZYqp^og)VguGHDVb`!n5xX@s)HPcj-0j_pEe=ATFFm(LFvE< zeqqsbt--(bMtrhyViB-YYr$d>AtgnV7)i;o)UbGBtU8 zc=sOFWj)=Y5;`Zl718@X)^RovALPy+`p!Q2&Or!<_(r69iBV2t=A~>D%V-aF{i@kZ#&^Bw=SGy_dQRyNX zCPz2C<99etF4kv@Y@p+WlIH#|*X&rP+0z<*xAMKK978G&^{-~5+Wpk;!|BJ9oL&H9 z_y_S&NrOe|UAOszQy)4IQLLdG*q-A)ZD&Nrha5~L4vexfq!(37xs{2V$D!AnNiRu8 zJ(!V?mHzQog%{R7#}Wjp_?$664NdDFpx>~UI7-mmI1uL$460l3CqaNBb%H3sD3Ip- zGL@q`E&D@t*|R4`D1vt+?NhJxPYZt(z_900k#68f#s!A3HY?W3kSv`d4%;-5sNy`w zB6Q3lCLyfR26oN}b|N)9)WXfKkkP9t!h40=& zePU-($>h6zxU!BugMBz-ExGcGLH)vh8egT|`e8`DS@gbX6xVJHYH|$KVa%C%^qYD5 zd8Sn8bh{b=ipRH$`Kg#19Jf_`ob;a$U4ljTnS%f)Gc&-XavDu4G|7(bD4} z&0Z{3>hOYRmbEJ_tz?ReI*)a1)D7|C;+AW1IFm*iTj;`~VldoGZ=>@DBItW=wLzf` zEZp?jO~JC65wbC%@)!88O1kD==Bg3YK8mQ69%c$#YkYCrF-bKy$o(*%7^Z8dN_Cr7eA|Mpz(fxCL5ABId-z9&fu7;DI>e|10ta4s+Zwn23q5Q9@yopvZCi-w z>fY;`P9)vpdU( zvRof#ZiCdVP>vuKX_}-&fFhjpZ^bw6rJp=7+jONk+ho}ghc#L%j-F&N*Ok~MyZqq8 zxP%d)$BrphKmA?B`w$_Q_&NSFSZRz97Y4y_PKBx)t~?+I6HgcRF4JN+ngUa)3&AK$ zrY;QkDcQMd*N-?DQiTazg%v8~aI^6QU_(bxIfEsxs|+db-bAcWSi{7k>jIp@d38xw zF*K>ev4*lUSJ)i9{@j7-^Er7qwZqR6w5J}`8F7{)mjM^LhMY?I3FBjDjEbLuIO5sX zj>p+DadSq+rV{(c{WcnqAA zi3xWKO21Fs&kyXyk|>MyYK!A2L*$ciuSE&>45O%RbVUJ5nb*xLt4xN#ap4lX4Hvk9 zUiREY%62Dc!{zck6ett;q0^5|!UX$%dN=+|@OeSib93o~fk$@@ULDDMaDTp|#Q>v2 zEql*wd(Rs6RNVZ|-@;(EoQNA0NQNw_EM202eVy5`4qn0I^L}QjZ&Gp zJvF@wNH6Hw)w}uTNME7VjI7k0Uvz@X2zV=P@fZC?uc4sTqLxMA0nR{Qpm%9JU>|ug z3O#yyBU{#zsG6NEt)}OaL%fjJUrLCo1hm`3@qrK=REpGXcGRG^`YUsIV3+*~YI^nR zIA)sEzgoB%f!n}nb|03${b+`c-U4|_f@AH_eGGE0%Y3VmW&dSx{5LtDU{cgL;(CP+ zo^1|p+lBu_nR)U>n{~N4HX5#kR5YK1G4e(jgLKFO6An;n>en|f%FofGVmP46Bal0;#aL0w}>AfAFZRiN5F^Km2#hFC?Wu6ogS;sYk+}|4R93z1kZrq%|2H=EE3x2SSnWH97 zMHy&;?@5*=6gq@hCU}D_lqUff3@CTR@F4QHSZJ!u0B?w}NbtpZKMYq|(uk60tR20G zm#p_J)YB>*mCqseq7o~0e4o&70<-NjEsv5uoAX2Ss-Wc;65}b%dAasFpjZT#yeW0u zp|J?R1ADF&np@$v%&l*gK8puinmFrViIg;suGp|4hvBTWTq*!>rIEUDUS43Q{KuS$igXiUA9>vef~#y zsc6Vc2QR1QpXA6A_3uNZu^sui`B&Ko6UFH-wpFfTuYYA8kDUN>iM$HKYjpV^%-!`< z98kC>Xdt*YZov}V-7OG2c<|uvjk~+M2X}Y(;10n(xJv_#Loau0ZtZUE)b8x9sjd0_ z`~l~j@BN+^od1Q)_IMN(Y(ZJw`HW3^SoW04ca-h*?qO!)FU)^Zyw}oxQjU`Be_Fja z+;Ik-M=Eg9+}g7K5we};gMz9%h+{$t!A(;HHx*K9+REUtNFh?N5eS$+C4X0euNT8- zm_T@1)VLu34*!6v8-Xh+isq_wPwkO~t*cEN{C#jf3-?`4gAf-F0P&Q7%*nmFapox> zBlO-i2e}kok3|gU0qE7JJf1iZ>5l)3K2u$JpxkZ$^oJ4(Z3^;~ZO_@lOYBFBob}!z zCY54O7k2%K1VN@ZAM(%&aq&KUNk>1~x zIHetZs)j>E{YD1!DNl5-d(Iu5kV*_Mc~mqNlZ`9NkO7wc8-&m3hKlA(__bLX;DirE zb1$gctTFj3CJ!;rX-A!!Z&f92|8$^WOAb&;AOUpRjoIn8=;lKKb&V1=0pU1 zBLD7ckr*lFJxS}QHI#0_n()Xu$|hc}0KW^$+OanK=F`xbka)+lN_S#ebDR0I0EcVd za!O8zem; zULzYFgOXQ_wdr$kiRYwhRqNQA=9DKzz(4R$_-_O{MNk55v9jdKQ2xKLtqavhxuB7l ztUYJBOV)vl4Q!p0J%iK%rC*TB>riA=zBR3M)gRPb8?V%l_>R1wY){~#%#UcFFScAYpw2Ny;^;36TFs(`V0ARU#^9yQIva!Ed=_f^@ z#@yUN^J0;*GZO=xN>M4UMNBl#QYI;CIgaLZwi45>wZ`z_VvAXf*7_?E2a9bHXT=aqVpJK73zCl zh-WrYQbF?SopWm2RrAbp1J<_9VnNsZg>BI+joI|C>Sm57?o@&dM!F%x;a%QR)lW3@47e{V)sY$lM8Zgb zFXXEkt5V-`s)2=+3FEJ_&_8_9nRDf%sK0WImg_Z3J9qONf(ydBofZ#W=;SGO)d$-s z_1FqZB@2SL+Nz!5z*_T>%U)xS4Su+1!QUAg?j||DOQhoZvpf*#z@{)YPUu2)BoRKe zgsu*`PC4e>(vol-I5N~bL z|71TpDZqX%>}J}LO}PD5vITmN?(xG0jytcDoerRiL=Ykk9IvunE;T9%%cQNb3sy!` zL>mJdl%gArcauR#43F~k!N!JNq9=ceORNleh*1-FP(7q4P$8f-!q)$ZG8ZR5yRq&V!mQ;GI{4V<5Z zy5+@XNWdqFW0)R^wYCh>e*O`8kDWX}-AnB{X?T|$!h1{>YP4W}HU@Fbw6ZrUHr?!{ z_8h!A+8!F|v5r}vjFI8n%@UhA8bwI_mw08@&m2QZFb9SOn16m0XMe|MSv%89PM_&I zBs(#_sZ((sZSp>rh!H)F`GZ~W#B)hwoipOV!Z$2FoF)Q6o{*`(8#r!H4=|6q@!5@M zYWp6>tzm^BG=?3#KSLGwu^S2-IFY~idDl5DN}X}~+hNl9Q+Dm-QxuQODD5VBR~+gp znL!KQ^+VALWvsMY8qnO8JbuantfkC z;ta#}q_A@)#&e{wj;A21$#1okY%SlxRUam_3-$V(zDF=ISA`@H|A)5-W2H`vY}at5 z??)oy7YfqY!SEOzTBP7+B&}EJ``JGvTe6-?W1a3Q`-}=?YfH_e2-FQS187G3qF)50 z3z|*h3hAbHR}j{fj1n!3=u1%iH=;wKj2L(GjR?Q2Fd{SBg)`V8GbR!+6Uoq$7VPa8 zFu2OHM;eiGPqT!^Fo_wHlOpH-l&0X{t2a^X*q_{e++`p|W-=?_J}qG6mZntL@8VVC*7&>fT&1qFhhW-}Dr!VFa$k z@gK;<#OlRrdQ|FW#p-rc<^W<1Un|(7FD(xC7xa>i8iFmQ{1C97U zv^HY8cE7RaigoQ^^v35U>ZuI=&LF~58;+YAl9m|KD+{D!8*!T%@l%_)DguNK<$!Re zlGJ9AO1fJIrmkjYq>w|S_hR!{YJ*TS{X}XjUo)$k5~~(!YtItP#1d0}Wt)x?+nz(T zO)CB8zb1~en(x#=_)_3sNeEi0+O*-Bf4&1Vjnn&KLUx*m&|0-TjkBz|^KK?kh{$!9 zC@o<$;&@+AD_GN(#zngn7;#k1H=Y!|Si`sKl4|Zrfaxt+8hWwjZbmcLW$r$GTNIdS9zbg0yANJ|Bu za^jl&)XWoe@~lj58emg-mLvS{U7g>OBgCn({g!!`&D4r_mc}qSSh~L+k|j_m`U%P; zUITIqU``D?V0Edr-?oYx#3raJ@-8iBpDYVb=}N3l&0$Up#YjsfbIKJ?3j*ok zOs(=N=!;S-etsq?s-Z7R48)6{sXDCClC7xW$E;Pcs`acWZ>T6JIjl|0sdBBTygY3v zvHBi;S`KgBh*hagdRC9jP)&bUYG+;8W7TNHz^-gv`%d3fa9ZE+r&{uil)AF9!n#P7 zp*8cYsRlx2oXmhFNn!dpAo2^n7v8_;rcwlPz2}*spIWE)<|E5w^9Sp^m%XZ&+NMvq zs!qaY02%fVY1QB}!w_>-pOMV~ebtDg&2V7VfG^`fWYw6S%~%2BL}=AS&G|%P)nty% z$)hs;I98C4xJLBIL#%c76Ir{1uex`Y9+bO*21!ks2 zv5Q3o+j%S7MPa68ql+bN+ZE6153OV&uzJg0l_|F!&i<#lU;UGNoG5K?iyKs=KWZseRbvoJv$EJnti*P z12f3wz9;jMQO&OF<#8nQUMTZ%;^j$2&0)jkQL5c(rrp{2%b^VR9) z`TgbPv)#pe&GoL`H7N_|%hfe=Er`1Imc90jo8@lH?oOTMQ19ewB~ZI5=zi_fgPr|@ zZ|#FsEhxD5DbQXZn&m&7l9H>37M7RDtC#WGhd)=ZiC1qOS5KbyZ-1|zJ8IwV?H`fr zUa(jp?<~-*wJ=BauQ|1EyS1NY>|s9DLEu?o^y}cvfpGTMP{ynX_;m(m z?|_J1k5UQ5#;C{UsK=3F!xgW`RRp3A)S=x1(Val(UmehvSpmJ*xGWC1#%zQSbwqA# z1TWV_ehyek^?;dr!ZZiubrAAAh~%suv((`;3oDt31Gyp_DT*Tr#toqx$d;Mij+_0f zNW)htc1pztN)2`@{RS#?c53?uYBzQozXqBxcG|cG+BEhLr^HTJ(iF8kUg0DukT&4b zBCv&>k%KOl|0HqOF=?rRd7GUD;+TBjz=YAriqFB?>&Qyx#LRHZOw-8mm4lPzmP5{o zlgEkc<%Uy-gUh~=+l_-;pM#C#mdELq*UO35+=;LBmM^H0t?-sV=~f^M(#SC2B+%H% zJJQI%%ptVhC_KR-0%;U@a1#F1B!s~E?W*w`jq|se8&L*MF_t^=Pvs&4ci+XGC8U}J z6=@}Tnk1a=B=bwQV{J=-Xf_SJ*0U%42NaT|W+)}v`L=HWJZX*N>4H>Xu&tUJ5|M(yM zmR~=Td-j1GZNY_wQo?P1EWDv#?L&BYgLT}4&E3PCc#AIJ8r}Gai3p`AR$ZV- zofsCSXby9G3JqVXetW7pUz&Y;nj2rbUwe8OUq)PeMw$n`d1$g&ne4?x=F#oud5UT~ zUvj}wO>`ihbbr2Ylk@|hOfF|$9H#_AM=nN3p4(mi?NcsIhYSaQK8t7mSI;7bj(kPW zLY?PA4gMngjuN+yqFcvFSVnUhQLHAhzH#=lkYAFsT z0q2_e=cHGxu{fXSrz)yKgBK_z$O~)BL_U=P5U~rE_<#OE5VI#Me*+1oW4*ELb;B3CHbpUZ6mU_PXu?y^9dC7akm z?xvSCo%lKEX+n6rB(@s;hxTqHpz1MVz&%PsXi@(y%KUA?x;xCRJHo4bA*egbUT8I{ zd(r7_xzuN+@@*wcXemu-Jy&R>R%o-;X9NFB{nPYpq0i<-_xf%3=EK`M+`onqQutHxBaTmWGwgtZ^j zC`Wn>4KZ{6eR=i*5C@~Y=j|4{K!;p(>M8bJhv(F?*CxgqPlp%J-d z>Aihun-(8t?Tud1JRNKw4UUJwvVo@4jJ~4O3M#_FviSDnZVZocHIXD*bt+BNyH`?f zG@LWt=U2q5xL56ZZ{7Oy+m+w@Ex+hOrIezSza{awzW-dP(eX>_>1tu>x~bUP#Q*s510G)V?};RHer>wGGw>eR(q8cnK8 zWeNdn?i8Bfi(G0yU95FGSbrl&YAspXG7f63CVh3gJF_1cVcHgYdAOJ#8Br90yuLxM zP-c6e!Ps@8FmD{J-(b%KX8YmDY(9$csH*BjP@X0LqVO!|O5$*A8?0g&5=HUf0gC(A z;<$3Cm_xWy!E@gUbxlA+c&dW_Nae{DO_+Gq`&xZvdd6f3;rFW%C*57 zhg(N7U?i=FO&lXFK2MxrY5e(jg0+>BLzcB!aDI|*`B_2Ci(4fLY_z6XNs!4;6{$++>SjNM3OEXRxQgN&CjZ$2k{~Oj z*j7(%B)jBQY3M+%08IxMZ21u=m;kl2axN$t-s;i?s2+i`MW_OQwWSzOiBwW1|CK)) zGBCiDDtVHEmSU4?Q^a+J%7gngJ0Cc=bzm=(hK|D=mxh*0qwd2m*KQvTJ+~9vDk zkG*&iW-a3cW$p~46b`*7lT;yJEweOByVb*V>)|J}MDuBNRsAY&dGb~F>GtDnDFyz6 z92dK1i_(PcTs)R!#tJ>OB?X#L8c(3!?35E63#sR(c^VY>Je!GUv z9O8=(P^y4^2lz7Us`pB7>hH46w;A9@-occ>UTS42$!5_g^V%PhWqFj<->Mr9r_3YO z?NFNE?2|2s{RI6-LE`bNLLhJWqEP5c{&1B4pc6F8`xB^`bP)aV2*lvEVhpj3{qa6g zX;uYBD+D1SLeb$Ek|l6}4$Qz}hKq9=Sq6s>exXkYmlynEnP(wR!w!m2sVcxIC6Hj$V~fx}FTln9)KuRW z8v5&30sai4B&V5jjP1r3+?_T_js{SSV{{>Lucnk>iE^CJdx%5v7@t>Iq3sH961~dt$k#EhT&+RT54NX=JxwU(9%AOPM*Sb~Yd{#qDDf^VA;zfyS7P?xQ z1l;KlNX+ScHhoH&)Ek{@64B36X0-~XY%A63%*BdO)6kyrWc38k#j;S`D#hwkt+7b; z#*&n3YZnH!kEmp;ky^E5GlTA4neUL7#yL@*!c^H!Kpn=gK3@EvC0e@nLXCQJwdsYmF0szaw0cW( z@rA8zmJW<3wq^&I$u8hUX9qs5ZGg+pA;Ig{0d-pYgo~Y%L#2`&#gJ-_V_u`+BAu4n zvLMm-eE1XPsAQ|z;;QR~I!X6OwRor2nDBrS}uK z)`iRc*hMT&A7XH=579y0!!L9nrfFddQDZbFnRg%I;bx1KLzP+XgO}6}55$T0hoY3G zK+d)vp-RXL!Ov+REj**N6(0M2O5V>`HFs{~8w5rE{o{bVsl6tlHntEU?XhUkS(B+* zi_&9B`{%jXrQ1@tDN7}M&xOp(rZRCKE44KKx$1l83avLQm4VEq#+K%CEv8L5h);@6 zHE^-E5LY#zjdev@Go@6L%`7I82P)wojzGaj%Y(g<#wr?qy>2m5bZkaGT}<$V^8r2D zJ#JknSF6E{{7P3r*5)a-o8h|drTf78W>AV-_q>n2&%D?6+3-Wx+onB(OaRV1c?hh( z=y2pp);1bO+rai4Fhc70E^2Pu5JQfAxbg2jqTaR<4)p7INY?%vY5SM}^G!5TJ6Ggp zc9_&6x|jdF6PO&1L9Ru*+d`hwoZa0$HW*>-3BZzjH3BOPQkX zsaomtVs(y7m3_D0J)*zR>m0hDJIVYnp3bE?U)Sc+>jzDmtLH##)oH57>w zw8$m2at$=a^*){w3`-phHV}r56^1JwhVS~5z$}aqE37>0C&fBgh%yjPtqxA+8jdF( z&JX}=$_lSL3vUjDbpRrez}Lf%93ayky4qca$6rQXBgU{IB><69>X0(7k+NBl^MT04 zb;#w{$knVU^+1&7I+Waz%U2fEAt35l9qQCI>KrTDA`or04sG)qZHE>80Em84hkkL5 z4r0Xs12LZJFy5{)pxFR$4gjQj02&B@$%cvRfJs=7Ndm&8V8fzvz@n?iVgg~Yv0-yL zVDr^u3xTk?K&0B@IN$1Vgp9Eg>Fg1fgNPD9sMQHvCG`Yw z^~5i%#G6W=dzI0~*Z^tDpWj$WRvpkcm5Eavh>z+?nW#uCK_nLdvgPZ~6Radp%Bawe z0d)zaiw>Bd8qk+P==dstH|5XZdepCp7&LzgkZv$3ZZJ6h0vH?#M(V!qu~M7>$(b-I zLBOy1pf5s>R3o6T2Ov^36-wj3R9wo`Q+4DQb6l@%6vT;yFCbJ8M=V=*G`GLx>manS zM9jB2E~P{|x4F+ue+ktZaFVcSF>e5s4b%Y+4DAgJ-8T&V?2JQ>jAIRqQ#Xur>`aS} zOsfq{n>S25?92y_%qI=Z7dOlxb{4QB%hQK>`gX$tjg3V`&WhB?ilj_{Fyb;BPl+$h z*3X6-!p5#+he|b%$H0N{A)(T!qGEE?bKi0aH*)yJv5VhwtSWIxad3T8<&xk?luhE$ zcj7X=Wq+&XLYU(h#N;xc=M=)`_N(KWQQ@&w#detI(&FF_i{^}*#|TN{(Hc1W$-#HP z%HZb2XR69yJI}Wc;E!qKZ=A=pR24u#K<(u~%bMrW0SOKO_&Mm3x>SY2u!Z(+`TYt7 z6tVd*Fogpexl?X=y0OuYRM|;5_-B+vs#S$R@dB#K-!@qV(dI-aoP@_d0wqcKn4BWU zsvHP+A|O>R!UZgmg`j6u9-5zks9SCbSv{}JPeF|YF*X%+#f9%|3H(}flvlHoT7Owr zv84DwDZdgVr`Y+Of8yC1N)IV%M=#)o;GhTKFh@0^8~?=0!of)3lz9NkR&&aUtH_xv zOXn`2r!8PsHUWH+(Rgs=n2LYEDa-S){b-$s2q()OB%|-)u#%La@iZyi0>y1X3S{#b zZ#ej?&I-$pN?=xE1TI-OklZK#HAV^Lt9V6dWku73Z=X_>*ix|2QdsEJSjufxKP7y4 zv=mfas$Il zascZxwV-M&VNkeGe)?yy4%B}FnA5qc#Qf!Qchxg=FdJeuJHf##U!<^1L~BnHEM!L= zXeLaXv(&&Mlfq+|QTyVjPCvx@Qn>Z3vtR^25OWE3cYJ>#)iP<37Wt)+B;5L8;yB-*!Li=!Sb+LqzghzeB z>e$eaQC3rB@(rhs1TwhX5c&pWf9!DOaKe{*w#y$>o)|oJa#Yf z-u9S2XRSWay#5+&W2WNOhLg6UcQzZ!P#^IYA5NzhB>spK_sGKH?n34eQLGt!!D^UKKtOm4 z#7_u^0HfZ3(KHDH0h(yNAHP#v7~7h$_Vu0@E0`aAGQ=_N0ucAa8{dx~k6#}fpd1sz z6-zu957(YR@{};&5D)~PNY|do^prTSl*s0hWQ!TYmtp$>>PmPd%d{s$RD9&yS(QDK zf_PGNpHd8;5^-oCh}je=II6{jPc2QbxeWAEcmqI zPs|U6lPSmY?D$C=ZPPiI&7)AU{>Kns93c_D5D`I=N4P`%$FErN4tud~CbJ@c37S)p z<#UMxf9Z>3m`g{g&vR+O$E3%zEMhJ3nsszd6mLwl*i6sX7bsweEMCwZx-5NM$CYM|?EV0vj_6KLe}YUC40 zImuK9cQi_PHK7sL%5*l0zckUUHpyf-BxyGr3ba78HH$wr@65KC>R>tu_*-^jx(T!f z2(*QGwMBHc#k{m72(+howP$p;XTP-P3v?9g02YbRv|ey3b&|c-%}P5vKN)m(3v>;6 zb*W|X^F35Eg_JH{cj>A*xg~e)bYd^+U>y;s$^>-p3G{-!di4pbpI&;Q1^eJW19Uw4 z&|dp61^dT3bz2h)a9{f=1pgrDR9(zv&@ES*Vs=UKpldyM;3^MLy)p<1Vn7632Cw3a zGw$)eeNHo88}yqS5*Hly%KQTja-K+(3d0&P2ernz44M8SvgBh*o9m@Y7|B>4wZ$Cs z^B!~X#8&z}mM=K&fmu@AHD3KX4t+aT?>*7pHPQV#(ZAtixB;ksWSDrap(7YY(wrcx z?-_VS-P1H){f(88(I4kBxh*&Yeyy8N7+vo~O~Tbq@t#2vVkvYcJn9NU=$<9)o-1B= zxlk(LAQ&LY#wY3ed*Yp^(=o}`Jumb&|4nE?q8ppfXF>jLAweLc)f1gX$OF_>iSl_o z|9No}+>70vY)P`{BGjAJz=W@hcH$=M^P44XbKdU_jY^0m>TMy81P_wsvz(vJ(wSmB z@?|NX^N*a+8q)mQT;h83+j_sy#*oj3%+u1?+s2&GW_#l2n3USDY|D$;XlX)QPIFUa z*jpz;+hCvVr|#{yw{2+Qe{eZvAfJC|@Bc7`cW`}o2zz!&-ghW+=8lAR>3VjV-gnu& zc9S&r*n0Ma-uJ!YQ11x2-r~Mg8^8t^u4!*+&hRoxcEJI^gj4N9s)!jL;M~idLLsT zj|n1ADccy|{GPHQPx&Ix#eUD_z0cK<=X#NsX1|yA-j{C3OTWnLkl*WA@9Pxgbx!1M z(eG{5?}(-MZAaw&!0-K}_x%F$4ibTY{UA@h5a=)deF3m2M1tY0`F}!CiTS+|*$M_D za2T|^!r2OkV?GObz9O<0jV4gaWeP^H7muef>U4NRkT^;vGdQi+x*|AAr?UmUo?nqT z%VzVxM-d4{a+d!s{*lG+gUnU2Q2w)0yE~Gra;f@Pr{^0ochyS0$wa156nFJnv(0*k z4+>AsM!WObT6Yvr?N+z<%kvuwZ{5HCU=(8EXx{qWp=e?OUsS$^{jp>Qot|jE#>1)K z0w0}w{7uJmMRHlfG5pP^i&Z+EzGwn1=c`TD>pd|7t(Ti!UN7%xf^FA3gHgmHv4ZV4 z2a{O>e&|9ScP9&#I=!(%o%a_Ton8=h;jTx}{zR5YoN)Iu_pNnbN+6vfnmJ?x?X;m|3mSxw2Wd7T6TE;xv zbt}R=$MbT`JlFRf$s#WhUDhH$lr++!Ad-39qA*q%*|I26LDsT3_5Eq4IMZ(2vNUHJ zu1~brTh^+)Bqx&oJ5tfORb@>Na;0d?psaOu%a*5A3GymOLQUH{vQ6C|s}qKALwcO2 zb>qwvHjUH5D7H<1736H2m-M1+TU0<+5J2miFN$5;ZmgVL`(aL$UB_w7gk9%l4~l)) z&9t0-_x)Cseb4jdgnjS(I|{H52IB{?AD%24_y?I~5;%Y^g6c4crTD{P2v0xSVVKB% z(qV+u57n`MB=m>l72y_ zoFrL{^Iut(Dd%|w5j2+t6-9ZMMRolcmnCicDVJqEKQz}Bqd0ljRkPd}*EOr!Dc5zo zUNpB2$FCd18?M_iZd;yLQ*PV75H$CHffx$zJE3H;?z@pJ)9!n*BIq9biHZsy2dVn8 z9*3Fs(;i1Te(0XZ1#t?VCndSD5YN+!+G)?TnqG9T^M)A(uZx!LSg*^Dt7)&R9tgVk z^&bpHZ_qGVocGN*%Z&H!v&=X!-`o9moZtKN)r=qH9fHvZg$(qEWz2)d2=9ZX2L__?OZ z2I5rZ!Lfw*qgnxjKA-0yh#>v}L;`~;8S{}8!~ft^07DpU@=^2=2MET2p`2CuX!hX) zpHG2dg6H`deu#q!(Tw5W84EDu!Urko9U^|%6kz8f4$;awME!lu+ZhPQX3(2#tKS>>zazC%Mng8)qdME}9n9tuLBa%qlNhHeAmxTK|PIT(AZ7_WubGe7Mo|F4Q94-HlX0HX6?X{7s+wXXvSCiCEVM*Gn{ zuY<@@^AV+_|6pZa2men)k|nle@}u~lz7UK^53^^2qAh+D5-pDob9aDZfYF7YkEBQV z*FdrElZB)Yqa(u4pg4cjB60+oQ8Cg3vd|wzU+~99CHZd>;-iZwX=KJ^wQmyt6G=7; zqsl=orj?QzSIN9dF8fhTuQ4{R-f@#s7hU|38JN&syGd=EEM|5ao6vi{N$W!`VGWa+ zG$Oi9AN^6no;EgV#($eJ8(qR#Dl=uJeVe)RpGfj;)<4wJ|6h^hnDQUyvh$h$i6oED z=RDt)ilS90g~=`y5P{32E6`E5O>aF98A7hnD1GGxb z5!t1NOmLNje5LmC_)<#;xEdH!`Rhn_xnm7n<33fX_b|TP^9-)_N2@YGkX!jfbYB-P zUuA?pu`G-Vr{A8 zzPT=@+D2J3ZWXe2-_kZ!ZRh5dpnZMcn(jjm43pc~%`9$-|5oFWHnDNY|ImJ2BxO>B zvU#fg&=FkB>{?i~dExoc`46qu-Qjc{l=;wgEMIHcK`h}~#`AS8rdBlhW$Ss(P4B#$ zh2W!VlVK@{6kNvS|LMo(&3#(rd6`roe$~HE=4^eC5THNYAAJOYxo#-4x)3r{!za6y zNTPSvFd9Z9M)s9%s*-|0svp}pa-c!xnlDjEDmw&Zn8P?NAZ&_gBa&9PA>mLXTk{Pg z=mp+UK|xTY*KcD=Y_>n(vLSy61K<-)(TIfW4N6Lv0TV|;@7;BEfHkIRkjd%`4rITA(B~jpR%w@8*V98n=Yq@VK z%)YSl>RkV~<=R%id2XNPwXu=P-BFuu=aTfYc@fLgxyf|tX`QvPHtp5{?zZvGec8Uw zY3)8h0|vf)6jA4kF&zKy-5-pm+y*ehg%=F&>hsrq5%Hy?5|6ct@n(9TKCu z_Guv^?c$l@G>5}oc7wULhb!Wx$fd!JM7qnqW%p1Yc`&2v-5m-)FK*XF3~GdqNr z^>qcewq@N*^VZHSkg!|B_U4rrg5Wj+%j2K8w`;wJjuq^g`@Y<4kOPn4J|y;W7`x{t zVMOqNX8U18NAD(g+53pk&*N{9@NEgc&z73s^Hi8HxX!QpTv^0xoTcYJHcsfm?aFiO z$QS(a8ar_i@!o08>Axro6M|wL$U|B_n(5n=!ttv_0N01iPQs&wF6S|GV* zAY+;T_EEqiO(5>54->EHk%qsrYY;+N5W7X-*W)1Cw!k+ULve!OvoKp?_dwCn0I`)| zTq!@^^k7895XmwpShU=7-khX)_Q(LfQ}P>%E^k9j$VC`^!m_Bb9 z0~_IejFwpsS43}j_b|`&Fz>c7-<2@`$FM+x@L=BXP|ffhxA4gD@TisWXvkxDEI~v( zZ$zSIM6!ECYI;O^TSVqc#P7$59D>L^-pB&Y$RhX15?WXLM-#qMe{vpYJQ|0ZV<&D6 z-k)~3y1INem#g$Fh@})+);hBcAdvQVrdTD(m|}|4kH#Js1MNtE1_Mq(YBgS zWB1V$ZH{B^KAYh&K^rsm~g^tKi?L=JQ{x-=0|`O zk3kqufslA;5nFjI?wIb3%8g#gif+h*{8)x`m*)k}OJqE8;av5SgK#4!zJp3G%tMlEPxeMguIe+DSdFzuNTDf7&YDgBIp!HQf-XCjY#`$u z!h@XHmn2N*raFesK8CI!<6=qZ&DWkJ<&k1go?^s@43h^ZD~Yb{59^x&8!DAn7@uP3 z;hiRx%tDx?sgdlY<;_dyTIdgz(3fI;k`DC9P}E8bDL2q=Pt-;7wk7nW!GnV#Pma<` zy>NF);7Ku;aaAo(r@7BmX-{G;H@S$1Ew=R5jevqp$TX74sKn1m(#k+FOYz3f?66GA z;mgt{NAAlo;5kVxTg~KH&2Tw!`yKY%VJykYGK0Z2$+I*&77~^&h?KRynv`yt9*U5& zZJ8}knANnJeX5nsn2~rnmYgA#TxOZmf0Q`&^!xqfw@O5u)T;G6RG3(@w=%V)a$er- zvau*RKquZGdlfm69H8uPix-)XOccVz1HjbI)TT8p0_5+E^aF7&TpW=UqIZ*6pGGZ7PgUSFVL*X040^xBxfD&P6sy{mWDK2Hs%&~ z0aX~#+3YwG?#%$zwc3Ep-R|oZaRGqyTzAfzt@bW+uWW6H0koH=yBRRFz=*amgf{Br zA!)M$3a`VQqrx%AP3xmtcq>~x+*>R=jba#}F!LH1I}Lg|JNvRaRZw8HTN`uJz4d># zlp%H%5w_=M|hN8Hqr=8iCdwh7S!en2mBJU87kBh2(A0S)EX#oj#E+ zZf7mxve`c7J&_R%EmsTxP^AGltMxI{OuW9i_=GUeygkM)(-b;%41tvj*nbZzSJ`lH*fsl?jHwrDzYZ%=4~`!WetRBn zz8<>dHgNE^#g`fRtksys8chO0HuU@v?0+5|gKQUsYFZ`Q&LOBz?_KN@J@}<`RQ#72 zOdqO-DPV^TYQ|0jk?8fAB z=3d-`?DpfrS*qHZccRB0%^*8wsf8!$Hv=Fh+aR;AeKHNITBuVz21@yQIe-K%NPa^j zGYyp+xox!sOpeqBL4vwS->77Qn%pdzCV`V7@3tB5kpUnYHZ1gqjnVxVHq{f_ZP1;)68H8GCl>Y|Y6D@~ zxeBo2e&PPJ+w~@9(>oj17i|Sfw-ubX2IH_MO};Vavl(Z*1t8s|RoE<$*)gnkX|*i0 zOk2MbT7*$rL{wVvep^aq+DLj>Q10&4C)xSky`wpjwa?%#B)qB}1C>&3Q17*ohQF)6 z>8vsB)ycFY+r5Z)=}xj$y_oG`(9;_)b%0c|aw4}&F1#;}c4R?wlzH?oHD)D=2U(i* zAcy2Qh;*X|(!JXMh5su=rT~v;=EtLraDp!^%fI_RwW%rJY8|t)#F>-GkV1caD7|3mB2tDUAgaBv&+0JK{srxIiDo8ZIW#l>nO?~y*zvk zMek^A)jk^(4#0H1ZjQ`m*TD13{5ky7 zL`b=v-~BDs1o&E_xGOMf`~2_Gg=(8ag2>4(&$BS?_{nF}G+}U0$HfzApdL}a3g8SS z+^1aRbQj^d?Ag0SKQvz7B{44e6Z~sz$J4L4`(Lyr*cf-SwSKI!$i4n~qTj_Tz1%40r#j4^OT|mgRrn@u~`1F{okSSFoa(Tu=YpeQHAu9X@|(^B6OsC zs%Vr|zcGC_OoSoN!yR?y;#m7K22|};>~2lFOmcAo{cM7JhkAWfQP zDWZLvuF)cLIN6$QWATjZfyrg=##ZA^XvkDnKY1rzvC;yIycf(JtMib?1rc*LU7;g+ zWL}ARTikEpSJzS7wV@c&!KGozl>cZ|w_O8tx~E7}i8zkCp8D98P{#HJE*e@nE6qjI zF1^A9p}&mE7UV~+DYCV66tEWEqI*T8D3@XNF}+Ct2_L+^D@5u^IL3quz{L!T72lDT zIqd+T;2=stb0=R)4zbdsu|mT-VGM&zQ0ueVC}F=`QeJ3BrP9|Qy@pr3wKkB3suocuPF4e-}n)+hviiIhCtP%B#t4$2~n27H*Hdu zA`9VEk)bJWQjudB;#8IAVQR|pJO(+Vk{4VzE%Z~iMJB6gY>Hv4tAlYCJV$An)HTgX z!0K8fz{Mp`C6eN7#5S8-Hgd|pVo9+6P@-zOaw*_>?JqlJDJl{Y>Pd*PE-fj>wyLRG z=0e%2g&IO&?sd~FG;p~|tLd_aW}$A%mJSuahB~{yC={dTI4;zOuL8!=G>kwaSn7|j zewbIE;lhoUqjcBMpmd{1H%NC5HS>(Fwf9+T@3Z&Wd!5(W z&ucx8f5P{-`+I$^`+lFzYOb~Ir2(29%ZF1VT&^zD7g1qNW_R|r@~G}EPaHtMgbh6X z;`;2k=#^~aRW^bYM?nr%r;8mFH|)oH&j|MkRF14>*q_(W2>%sS&J(!JfNec;m#s3H zn-3HFIEc_##y{#4K0i}-tC2z|m~wkPkRN0Qg2ZG|r9;}mbd*bMIdm8tC?hiFBe>+O zRX6~ZN1RWtz+`m^M7%tK!87Ms$S?=tq|FJpZzR;RNJwNLLuY(Z_d=oKsGSWt5;!Uw z>Skt_roglcad?T#Brkx=U33sA0|HP?^LNoj`SIU%?!G0j5zW64$&|oveDjk+#+3c% zSjNdr5*H{F9j$qY!R_~;`KXvjW?AuOkMZB=kmPXft_D0ge9!V4_5KH)K(UXZLk3xZ zf}?wF+zN<$atcsiqL=U}ac}$_TG@};xfbn-v+QBA3~~j}2Qit$sEGBDxJ;dUT<|}q`{#r*VLN}&w6!65fSwCveho?LZwD)Ee-NlmY=1~~ zq>@diBhHsa_d$l3iMt|`?F`)EOJU}#kCMkQpV%F=8Fl|AX%JPqhO**ROoZ!gHklS@ zpcWSvi+7BVNBYf(3X&UjpX`9cqV2xvR`{OFuhkF+jiF zQZ*KzQSoswyE5jXaCe1{)>vs#x>DCQ>$5nMp4F}hkXDCp8HRqvZ@BSPqpaJXX$Eun z?TRtCGm1*d&d4X{ME{b#6rag!9`>f@8Yymu!K7KY-q+#bQUo4NXl zE|*kW)xPZezNtxZ!N<#?(c*S1?F+}%G*=u~Eps1g$L*W5RHT-bVG^rZCc}G9T3%rN z#SHO^|3GO%yZSk{XqkB0&fwVNmFE;*M#-REmtOW1OFm##-?t0Q`2J}-?idW2aFht) zuH*MzWPX?VRP!)>K9jNq>qai{*Ch#jChcH@EhF3V8|`o7KBjmluheo=ezdZxbWhix zJ&WX&Zt{QPB(H3y{^-2_)Kxz#vTG3#uidkLQi9$}y`h1Y@HtPl0`YKQQ=|Ou;B(}y z9?2%^U9rh=HR^|EZZr#h3<<4SCME9Ug&XTqqSel66?xgDbBBp_S|{&{t?F3kePyPm z8&B?t!;J{_VZIe>4;<^iHd#5;PS5TI2+Ln(W~DQ*-k#b9C%2;$$N1#aKD6skf*$oC zAUC%jD1<2{K4$;`DEt=a_@UO&#}R?In3nLgp~>5KQ=-Q<>A4mM+yNzI!=V-V+J{CY zkg`vYo{)Zk*9^7uhab|vAIT;K$*|uErwAanSyM&LZ>sc32?)%)UrdMbSzngm7C)Hj z>s7Zwr|oeLYwAY!$U6q*RYr)l4U6i|SqM1KzR*tcUMu^c`eR>;Qpc~0${M15*$=-` zGm|ng$}4CJi$+dRFi97YKp*aLAA8!d>;bMX{ZKuXCR%4y&NqO!dYX^lKle*rzlk>` zuJrl22aa+)xl{L!=7HP?w{MS=E{FVyPZLb9lrE*PTW@I`=Jm~}gt8CxqD8x;6e8ZO z73GS|s1rKYE4%Gu(T8sn650*V%&4}eH|?nIx^~@_-YX%DL|!VlD^r+PneA$RNfBP> z6hD8pChvLiwZ-F9m`tk*HMwY5t=4s14_6Vujyf(}hCUTSb0$pn5hrE*pkj)W;gTI2 za2(5wBNK$3bdMTMQ?_z6h}7bRj80vN3qZaT2@+pej>Ua^_CHB6=mzY zsPZSSaR_Bp)5zGUa=~x_wS-Zrw|5&Rx({Z5j>|$8Hd9#%B?C8D_Ss_AqmX1=zr^(^ zS)BtJ+qMe71Ad%Q)X$U*7)6Qa(JihGG8dZV@cclI$3ioSH|qG?T=;IQ)89pCKBDkY zq{yf0iW0;XD|9JYlgiv4g3&0f;+A+YNdrZZ?Un%~PJ)k!J`rcPCgsZ!Xi~%UNox*LI>Ee# zg0ZSON!OZpNkZ@P67yJSwo@l#e{uP^4Qf;0kXCQ&;OW23os;%bg}ZQ(>PvyYA8Pu6 z$j79~II5eSjW)qIt75tOAHctK_~^CUF+DJS+z9@F; z`Q5`$5&6Xaz&2DqH#5$iB*8d_RQ)QRxvIrtTke*{gMi1Kv@2a1lVrCnFc5ZcT7DTx z4nOXWcv1C;I1!qw+jr{Up z!g(j`002W|6t-*zWkjToDQyt1t`mjP!^$>qKrf-9|e`T9}!BvS`ObNq4#e;gN z10Yd(GnZ01v^6whDYUQd9!R51Ii*3-qYw09m+8lGfND6~H-TdiYR5zRe}Y6N{{ zMZJ^hLsegn=F~7jYJU+mOKmU^x3~xMS|#;ra35*$DGkTnfg&q1b5gVbp&ifjtLp>2R3jv1>hfPzU z@n7=~-u|K&1O8eNhOWb?p;+279VXhr=$-QAt41Z>B)!okc|G9qU7FD#9Y$)!koz=o zK@|SSuM_3IMIHN$D$Vkpedgaar^s6be{xFJ=A>Q9s!ojQP^hML0fc>80t;R9OP_Gd zUvk~5{2Elo+lzgFJTpWEBYYV52_5yk>wa0}DO=&5R2Mg|Rid>js7*Wl*K3j!!YG=HL8q{JH#96MPWIRBU!T zD#Zncwy7-oLJXIV%*h45Jofvz%jAPA*zD6M0_fYC#K1A~cs?qAuB z1Vr9cw&}!`dd2G87{#r6fHK3UE(_8neQaw0V&~JQK*5W>A2Fjb83uf;X|4(`=gl+n zmmaOb4Moq&e5|mo%?=*-dH$sDOYr?z%>Zbs^EJQg`${*52P;PjzQ{1ukAE+E@x2zW@5-{E7CvBpNF1 z`czFxnref@JNIa`l8O_OUuhOXbWJ%Y+rm&^i|Z*iXo|W|2y{#{Xwsk_eU-q`g52ls zC?@KBlFZd7)QvHd)>LEtWL9Qb>s@ter9YX9I^$1a6NgN;TD$MfGVMwTJDg86fd zAg`r{sChTBaO}F=l)j{inMRUlA1E^KyfQ}c?k)+WF->O>Jl7zWviTeYSi(YSqP4=p zRt;ii#96;VkQdTCTSbWIm^b2(qJ8j8aB|KnWuef?_@1HB&AI44#^-CuNtuTWml+(l z#-a!D7xrRbN}@Cwh`q!xSrmM*q(ru|vCb*1yOR1Ua5!^O@?d2b@NHt5*da@DlkeLd zp655hR}`|It3Fx8z{HseF*5q_jFLrq_1&szz^Yl?sySKAWh8kE6;|erE-OZghX<=9 zRq<#_H36AlZLpJwmBI9Vx8EPE+Mjkk;afwa`eXq&Y3Nx!HNNXYR%R=;W~kC(U9;*1 zH?30y+gaUlOY5;@sZmO%b{;f+N1Np{XM&Klm!qqf_gh`n*Cn=#qtw#D^0g9re^B@c zkY(*)>TSXuG+5$ivi`}4CxT}x*2)}wm@qtILP(7d9$fQKOHU&+djnt15bA`?aaXY4 z3wJPgNF$FOTYp5i(O*Cwt7e`PK&qiqgIR#lnSc{2)fwQi4o6v^R|?V2e?YO3Zey6{ zPxdLAY!lbm+%wMHjb|-^Y%LD+-iK53eU$a42k9kJ<(af*VI{XMR{7zPn~kS$plaLc zYHzYkwnIwp1n`&zKG?!Eenazkvo0+y+97G_{pt|r&M?`|$e=>hOU^F5oa}=9QA{<# zMWv*;(3f_PO0z5d1}m% z)XTg=U^SLz`L#J}!2_pvVjw|6WL0XX+sf)I-rEx75g+St?aiIEiXF|v-Stx|TkF?B zuLHx_Hcsalx5@TAlQka7W}Pdj%%xav5=4#*?QXz#k&Z>8%KT={TQoxJOETpRq1}Ct zT?El$I#uSQ!>>4gvJcx@Sw176Q;S>M_+N7z!z+p?(Ja(LR_ zDz#;6IpmH%WQquDk$fy+XT#fdh+r2!x;=C#xOaF*+wQjGk;C z&b6bPYX`SHZ_8+xOS9V3k=s*`+ur3pmU(t8t9>kQYOmmUtWbKSSZjYz+Fm-|UgfR5 z+PuAL?y)k~I}Nl$_@M=v{K;eOlP9JpatBxhtMgakC%W+`dbub1wI@%zP7KCR4A)Mc zot-?#IyD-Hf`@(Nq_Axj$c#)Kj2%x+$Q?ACmP{kwvGZxAW;>V-om!5cTCJVFJv+6= zIPX`@l*!|+^LK;=1i}!3@i1^MET|S1+yx66hlQ@e!p>mfSmzPyFbJ!2B=32& z@Og~-E}=PevO!2yPi9{p2vbOkb4Y~_eikA3q?G_72rWS9zkXvC{FP8apDbO z_(m=Kc9+|wg0bje}MqvHY|c@HtBju^*^IlKkudgp0QfH=!VT+|{i zyAW67i0d^3919x-6$`{=womub50_lPVtt>!9SmaCC^9=>=nSP2w%uMoVC;r4$VYLR zA2RjEaA;RpY#cK8CkU8+E;2u28B7s#Jlx(mVja$q3j}e$K4$xzqZBV-xp~Y!nx~Pg zQT+OZW2{K8)^=y}gma?IxGReL%_-MZ)$8#J%dJ!H8K~{r=i)bKJadgMXNNmmXS@ro zK3K^74dYuvv> z63a`W-I;pFqurffMv{qnt*%54S9;?G-|k+C95Yk>KxFU4k7*tMlJ~$juI^P>&FgiaX zB@udmQava70Ls@;`al{N7(JLiScD;nImwA3n7shX5W-y#V+iH%6=4j!Gv&k>F1iV2 zjF7y5F(RcSQKrcIRQVuEd4`yrC=dS0iD<6-lT5Ks^qiUFbYIso#~ZkuGbbR7f<;*p zUnM!SB$*e~u_Rm8pR=Uc^op{kzMFDpO>^F?V@-FzIA_i9#ua1B^rv!R%L?MCXUh%~ zyI{+SR1#x4`U{St@?J5{;_4|E z&XT&#dd||Oiwn-OHe7M8@(wCju8JOx2Cm8hu}iM15hZc%>aTjP+%=Q08@Ov{T`swy zi^1YNb>EU)dFnR`8h9FZ>Mwa34|>IUn@*-&d7IBS8<3@mi%Z^C6g&yOHVkSvzK=MZ zjeMVOh+pxw6DdpZcaZA4@pn?bY2@#salPX2rVo)2=wVKF6X<0xY!v82a5r2D^z-*g z2oBttb`u;F-D(sZlDxbU9G1nCyghQC+Wq!tMb4(%UsT1fZ;w7wmb~-ziN5=tG2J&! zcg77|ukTD4g-8lbzDjl%nldkJ5}LMbxE7kR>5~+meK+kcJm_w`5JyNHk0?t^o_y8!lsuh$ z(;|5`>*{$JGan)?b^a~cQ|e-)utn-}rvV{#bPuedor>}>D>ufQ%WPeu z9R0NRjf}KMd0mo+>jf$waMkW^K z6GA@>^#8KnF_6~#I?f-l-f6FXTJHpi6z)W#w zOF@4Y>wUAZtn&|9?@uf(ep>IFMYX#ZTV-85m)lk2R+l@_wUW!-#weN+kl7ULz-HIu;{~xp7izkY?T@FH? z<7fZd);rZ91pH5}cbCKHjDKjo3nuz0joJPo>%Di6eC~g;-X~t*NS*Z{hCD8g(g8Q} zWU!QmeW;EzuvPQq$a{wa#Evt8VR`phl}3W~j}_k9sXjyyNvhEoz|ZXssSaqNoRm3_{`*V|P_ZgZLlVSS+e9`OZqOdE?uOq(+7A7KUbUZ4p z6Y)(%TWWe~ZH{nGEY|LI)D5{73ua)cuFFxoMEFQmWszGxloGtC3iq&o!^pj%q+g#N z(|l|ySiI4XSx08NYM(2wx@j3)KN>H2r$AB?_@wmWYnj!D!WY*Qx?jYqGMlSQ9A}lO zz9iDVtGQE(HW2Rem~x_n1za{eO~5d6&KOkFlXxJJWH!GtM3;Fgn{c)EN*HIlH6N>N z3uV(KLA-mFfDbyWzwJPMIs0jjAh)S$hihD)Zme0cS>J5eBfVk%I1eNFjf$nEwBHPEW?FEw(!cbVLDs*?k z{)&lFTU1Ue^-#!nMv0Mppo>_;$~K~b?3zp@Nk|QtMcBTMDq9Z_B2Zhn-Nc|SuQ(c= zeVoOcvnhY8dlaMM1n1rL7S@K?z1Ce|`5E?7K@qHBc6QtQ?EIUnx9gLaJS26jS9C{% zYJ>b077bV`GjJi{;cM<=ppucEYdSbh{!!#@yw*M3kxCX^xgAyfu0wQhx4Q(lVte#i zL8#_fQ@o$Q1-yJp7jzb%Ei3I@UHO6}a@dE3Pbw;GT59WtVyldO#O3=l_^INau%Ivq#sgXr|AZwL=&?Fgx3_gij3eCaT)TKG|+`t`1O`enZ`KH~Jnq5B>l;%cf^ z0amF2KS|EH9+Ga7+4lB0Vr+q5KLf(o5Oi>1Ac~0R7jmNgT(`tW9+TrhG&TTo zXzK>di`a$`R%!`iHNbwn{EQQ>_ub~XB8oA$3pLOug!;U#5UN} z@;uH(?7#x{!RLtHs+S)Z@xT)44d=*MS>*~L|9kF>keCEAyo?9EUn5a~+$`D$@nD0} z0;y8Ye097{L43ehTI4$5TQ3}L$_(S~Xeod9Odl%CJj6RB7v9Ykex^ef$_lUq-+Tup zx(x=|Bv6Gr1aim{&=Un}vH|SY`Bxv{BJJUwhj_>11p0_FoSIh7w6g%S8laH^C?<$a&4aS1%xI(kHonfXpnbv+Y3<5yW0L z5ogx|1u0Zf2~3@%&-SA*}Bm9QT+e=sT}3~j{k z{v(r_^)Lq6@L3Vy)H)Dps6SNzZs-8_^2oPzh|$JF*4TjCP#|*26)Q3v0gS*Q^530^ zSXY3+)`7iw5g5)8eCG&kqX=~;WlSOzR2fIP5wD{O$az928asf<%NgxaAkKzEr$Qud zBm@n`3Xo64xdGXMLP&{%@v*%KBO?h!tyvItz-5Z4{dEXxB9OuvBoqYPfQC?SMBTxO z7V3$(XAb1ZhwzF*q&J9^MTwq>f?8mtbu7TnJm2TS$UVx9k+ zivvN&SqMtd@xqS`nqhPIW_L#;ihG+7gy!w9gq6h1pM+-PMv`y;UdMB}%l%WWJBCrx zS*}N1PhuQ>vaokDA7wK6NYV}2BrWf#R$W(&^<-$iI@~KtEz++;JGq1%n9Y~Mz#sn^ zholbb6)T!dnwjj!4=#P=Ki5OzfJg*B!6xct1EL0nisFF$MS)woB#}BKx|6`r+!ULG zw0hLE5^cg98O$93AV!gxy9bCi1%f}1xRFS9DiX`cpJBufSePKe=%vLk0OpcsuJdOa z8>Pn`WB@ZWy--a^H`6FkLh^)(WmzC!$cS?jOx-eFbv{^cw+2})nsIN^z&5BAhj9_7 zc21{+J9TWY6jgzaX`Le>50qT6AEw=qwG+*U{0ORJ{NQ!Xa*=0HC+! zXvo@N(7%77WO7vgz9uqfpwk%uKrec3^Jd%+0Lao4Od}}Ah!3KbO#-1@FzH@UI46?3 znfN|^^h(C-1G9Ht(?RZQ1X12@WKNTjEvX_f5&%#fwyWmL4x$LNt;_{{Oqr=n6h+C` zUd+#@FEHkhw_}T*&&=z7WMha{S4Y)Wy5(PeqE5s@* z{BOebNcBZaY(6Hyg{=ChG@UpYmo_P$QHL0LS2f7`R)`Q8^--FOGfOn2SM(P6N0qmr z)KbaT9++_Ze0U|RZLwlPSOWlXyViogxxg2Y>NEfZ$Z+6{dX(J``O>&9{-C{|=c4mHuqg~Z5ZW2S9tkZfb)Ql>vc z!I*NBSSC6q;-Fl-%`=443-3|00)6zlEAf^qa0##2*`;31yNTQ;wtfpV*hfyJ5PgZ& zNYPe*!zlcC3%KJ7!bquCwQ*mgCcd0*VSbc=CeciZsm9qrq`Fo>x7dI^QhkdkgQ$pD zQ@f2UvyHKcsH8xB_DwS0L9>^Uz2+q;*A+371obTmBL161HzkM!LxDNEsdsJ?ja}M* zxg<$9H_Ng9)b7*vGP5!mr4`!N{vfl7n7%_-wqq`tnB9U)8lNV`x+7t!ox9C#GXx|m zLAvDHiec2T^`<`V4G3kT9K+k+5}({aA$J?46Vs?GJ+ec8ySen-ZLgBmZ$FqMEAZ$>3bmCjb_p(M&BWYADgLC81CH;dQ?&1-6P@M z$DGwq@~B;SF+W4GPeRs{;c2&ixlQLy(6j~RsLB9-Tgt*s+T|2R-4u#%jj0Cw@w9pB z(fBXq*ZW>+m9UHqD7E#iGxkXv4Y6kq1$bvP-!xvQV(gay_HNORKOL5^9U!zBBtIBb zUK}RP95(aL!=E+261FCD9+AusZz3Azk!^-g-=r)4I4W0LUo<#W_xa68>%`S(KAJBA zl3zp+nxAi5ns0D14!V7jnEfJk{Y8dmR8DgAUYHzK6O%kQmtrb~vL#5>{iP5MTMl4E zRN(9V8*JnjRJy4o>a|~(+IzKW#$q~pvSi1WUyKGGvUi^lreM3ar+z6 zW(MORx8RtHk zkUE*vG?_9xnRY#yK{J&lIhA8D^?_Rg>T2Hc7bMYNpfz*U~biYZasBwvuSR7c5e52Zl7lUP;&m*VE)v79+o zl?NUx3TZ1!%_}N%D{AnShqT``q`o~i{HEpcO(*SJM%a+v+&4q`x97C0#!{;<4OdM( zR?X5@UpKE>%&l6%SFLH+kneu>hHDNUYffovF3oFh$XXr#GB-BT8x`#&9FfV^kS!Si}b$W{+RTBK~*S?B`g-zcv=Z zmA0Arm$3-OH}sRea?u`f$gv2#KAmoRhhN7c^d^vyDVO{EScKl)4>do=B7TR>wuBsz zBE!Fr%?wkUYmj3RypDt7kfDNj=WSB(+xg_iL65Pf(=c9lBsN=D@Jna{ykR3Jh&MZ}`MP5I^*)%iu7-Pwh z=xDc*K#dWE{xHI26cq;ml;OTwG+sPM1Hctp{U;wqIGCXT^kCLhu2&5dTd*o2HB`Xu z@)s;4I`jaB2Hj9F8HYE@^AJ^% zoKG4~w{zZ%2OreE7@SS$566!(v!kx!p}S@63PLmC#D;Z z)(w_#|>MlD${mi;r zZT`Ue~KVco^4k^^Gs0uHRJc zC~5j?Rb;4c&~fl6?ec0(hOmA(Q0+L2`g&bKz5a9j;PD6X>y3vI^`p6JCk6V~n>s`F zW3_`PC9c<7&j}kQy3|f9lCQVT)ElP82TyAnu6L{>8fMni&g!SHcb$eB=FSGsnlG>S zya*c?u+(86sp0!z^~NRgAy}t4`~VWsxWcM_-m4Ek{C?3;c<6l46@HXK*t9OMe(^bZ zu7OgzX;XXXVyppvQWnv)ZK{4bH4Q(74mIsM4qeV&!p~X>oA(3Nua>A0ux|C{!}y`A zRdK}maEl93w)*v^KH_3xsQI*Z=z7-`ak)U)A_?nKhaV;*uGZCCF2;x8rwxef{fL&U zF8AH@X#^ZL)B-;nLcp_M;lathP({4Zb-Xa0ys+7n7FT)yHc>tMcON2|x;%d-s{b#| zZ~cpjDtPL_&-pFK-Sf4KK%R^BoOr8?jlBQEMD?G3h%}2dCHi*~)xR;n^-mJj3N-4W zqT1_!_7M4x5>@Rp;Quhc^&%_h=ls_HJiqn3MD?F}h#V>fEOgVC5+f*8ctw8BD_yULI3w1?Ao}?2q|H$(?Qj3sLht87>oW5qUCP$s*c%pDy5;R~YcZ(`B66nRU z*+!tGpG1=luJUYQ2S`RNZ8b#lWDkTZ9OA{O~gJm{Y*Ht=EmoP&@ahLy9l*& z8M5ZxKs=^Jwn=E0{M=qp##MQ>j=grMBvlCcy>U~H^H(6AI8UG?Z;sQuyBh8gjpcjm zJheCt^9)CkG6r>GJPd^#bdH>70B#>r7^$B2~#4r1w^#;`S( z%TDF88&{CrHH4JD_1gpWxPokH&s<;L8QyleYdFDygYqv2KX@w4i3$YkmHCn&$Br=(C;)cI(ybf_DgppaPujkP zz5pdqM3vil1AsoeoHmt5je>YNz!*;kO%+a_q?3Jn%hb^oPvph=I*iP5A4?X64R|_^ z3m7IqWVl8N6R~5y#DP-EI5?I&I!4wy#;^dQwY{-mGOnyv%Uz)GI8Vk!Q}j$9drULV zbsugvz}qgL8Wvw(GhcoYUp^gQF|eQ{d8A*E{Nk)4Ta8AlgOe&~L zDw<3xIZrC1Os)`3uF_4eaZZLNCfC;`H%=xuZzNEkCw~-8Y1d8ZbWZ6`OzEvl>7Ps) zJWm;>O#LjHI;xvG=A1f_m^xLLIy0F%cb>XHnYQF0nzo{ww(6X=o|uMgFl(~ou2Po2|YiRl-0=~t8K@bh#4RR*e92D)Abrb`BPQU-2)2L4nA!9@m;Dib7@ zN%H#Xg-#|#QYKY>=FO>0+KWuOUYaC|EGE4y7MCoxq%4m5EG~{mI+MzO`z!Jj?(Qvo z3PIdbZ*Dw4TK`h`Y^b^E@@#*(FI~N*`T7!ev^77}(t}#@{UgkEpYqXCs$@73eH8A>dF|)F>oet75>xQOIF>a-@L6XB(ApQ zAUcC-KpFt)e3%5fZO-+LUAu=8P<9xbC>z9Sq^R82Ul9lO!v{Dd_8E$;#x>)!7<;kz z8wcDEr?X)e2ngco z<2{28^+&1up}7)kibF0_M`^JB+@DV5KXoE`TsJd+ECC~($UAT7XE#k^JjRetWMSXa zZhJ@M67Zf_9sAtjVKi-|Y^n2iC-PLIY4>lP$Y&$v*?-81RNrbal;yws*aG=0G9k&O zrV#o}r3vv_LReD2>ZRY(+cAAqS`afc3ojS8qre^s$YPOk^3?iSE1bA>$k((xIVe?L;U$WV+J{Y%Jd zs0g9PdZhwA4yugL`z$)(V?y-NOexj$dD}i+!r-qMvd7sku9MZX?vJ3C-^r4Y1X928 zu4pIFko234Mc<|zGh<+Rf8)>qhAM-1GJKr)h6o3Rj%uQ@lLnRH5urm&1MSZ9j*?GJ zRCI!_9D6K+Rfwu>!Rh3>sI=~gNdrn)Gc_lIHl~G8&cr2UdPa#rqy^>nTR2I|0#La7 z6Ep3BkIKvvDWO9rmaR>g=G8L#fqfIXnuK4po0Bv`?X<^rjqpjym1B$bc^?*wo&V@l zfbd$sw1br0!nek?+GWwpE!FDG(z{`=s9k)a z{MBGvX~}MYJk1pGkXX6ke+zfz?Wa^w-OKNlQhd&BKTcD>p14_xguBg*{+`z>I=p{{ zyR-LQzj4`}mAyto!dBGd=5ifefwNXGZ*qobjXGI_VJoQU5&7!%KgyB7az^hlrk*xY?2 zey>pcRYm+C>-cAX^wY`{6ix7dI^k~!^M6heU@Q{wQYXN~DZnft;59VBVj{o_7GO;g zXe$zk{10((3Uo>cbb$uCO$2(t0=+1}J|bX09dLjX7@PnOhJr&Uz~LD%Fl3!Vfg&hI zCkXlbk&qCS1Pw}=2ugzmWl#iXi3I291b=V}&Pxa`fCd*$1ed^q%P2xBL_(@`LTa2s zpa~)M&=9D-ZzC+El_K<`NNBrGXs1(XcS2|{G_-#rbPyIgOcC~3By3bCY|JTaA|Y%F z8a6W#HkZdQ01I0Z3186(Uv&y!PYA!w;Iugrz6%TAr-(Qdi8#jA*D?Fu`HDYgB>d#( zf9CTQyVXC9grA``K%_sDz_I%i?Ztkeu;L#x5?cPtNO*M*=kG#mxw`Gu_t4sX3nc>? zS_h=zNJExO01_0sVh%?^Uii^KhSnQQgg8AaE&{h>XWCiiagAV2SNy`Eb+&WkyMe_6E1D^2lv86JIW0%=w`BP&Rhy#93Xa6EkB$kf>-8fE< z8s<_I4(h9KPPM&{9MT|_61m6;M$Rmf)|i&;W$&28KD#La9lbUPUotBK)lBP4{Icz; z$P3j0D@uO=!z0rzzyid*rc$}nB3twG1h?t~a3t1UGZ~C2hH9rOnXCmOiI9Yw*pat& zvb@kyNNlv@-~;SvMH|(Cw*I@E)%Vr7ji1;tkD_{24|)_~a8S2@&1-)b#t=q^&Q(uu zXGM&PD-e*nE;1p)y0dX}WRv#!=aoCG5e&R4fmm&wTv?wlwr3 zp0RZR>&zk^tHLK{xOIHq#60CqT>8yr zMCWAVi|4Fg3?)=vtUg@-Ki$kYqG<)QbKXy3r}7W;xU5*~A> z@@kh})a$i9Okk6oiK-{SE-CstB2#F@kb8*1_0x?J=0jW zjv;Oas8}1WcC$05AE`aOT!j^v?)pSE;xX+~n!DYVvYh3<={J?AY_CS9{`}*!wIS3< zxr!wZha5;|8${ZTPko+uP&{F$iMa7D>c&MxS^a5aN8_%>ExWNoTF1s(Lpt9*P}eg2 z?6*e3UqY*=g27vj)3EC64*O@!^DWH?*a6Gs0n$j2^On50EAN&{?3CPe2^}?UVTwp#%Gctath@g|6*O?FeuCqvjFpmOI66%Ym z=_`W_tvY@eS@yRMd>w4Vj>ijB0$#lfa}lRPi=fu&3=T|b(X4}fM-VDsL%a9!8}!_ zs)0X3>k7gc9L{z}_#cE;@|r;8`HJ6$Ry3l(5+^}Kt0yLka}Graja>*78sf|B(#Uoj z0t?v_2-Gnm^kEB?xT^?~!9~d6f)*6I*LjixN%|*#6jp|DTlm68y1Ag_p|Z8aNS)sq zE1V%Ggxx<}TsCx8M{s*0T<|D-KaX2W!EIFpct$}4fJ7YW2pmpCa37f>upyj+5cG52 zD-j|jMZeYvpe~2tn+pIbBN<=d0a^o^h&_hhg(?{lF2h3o6e2m$02-|(FTKJT@&%0L zaZkNeVH8p9IDBOaKqqV>LCWa4PJu`fQGWA#A;3ilUS_yBCGSnqm`H5-yI;rQ0f92;~*ok>PVk&h>B|XwO=ShF%=eF5NTOc6d zzdHJVEZYB+jsMiq{-f5OrK3+~nKHQZm^(|^AP4#- zX1w@&N8ccUiCkcQr^M+;M?c;hnf+ackUY8uQnCA_-{tS4z2Hl%Kh)7z`&Etk-qHU% zHRcl5C4=PA(V#hcWJmwI8iTk!%ly5g|1YUA{i{L^-_@A#%9J&gHL>aQL8rmWw6p#- zsmt>rFM_IHI{Nialdm+gLaNO=Zi_KTNLA&qsv(e zHIgqz^VF&fvZ@hJH+Ej@UrtR7*3^ii&sw@(PA@zlt^TCCYny!e_pwD1#dL2k)w$YQ?ndr@)oT>P}k{?mg3J5Y~mD{e__0x4F{-*@R2p z)UWU7a9e(Dm`kzslq^T*j2`QQYk}1jci#?Ou9-LgBiZ;b(f)U`@$RG~{cmOCj=M)E zzsknQXn)Z%dc1>+{l863KY{3pG%)8xxGo?G$_!W3&hB&%cxOPA=AiZ;<`RDKzmSvybpZiY)W_J z@9+5{foL*fEbEulq+d0B=%8_8O$x}7!9{_{;T~OCqHW|xYBAB_;Fw`BBqo2+0?5?& zS{m6RZ=1N>>uhM7~1hoCXQd8&M#Qm_}SG0BzNy5LaXuZc>NbC!*e9!p))vJ zahxOG6o22XzDGZTeg~jQ z@daT9{{ii0od`tZx~$9Th&I>phg-?>d&w?OC7~yH*^M#~9@qF$T86y9rgWYLmplOc zte(*0en<%r2m6*$g7mKyt(NqrbQL~H#MSqTmdfOAL;29PheOll;04@OIg}7?eE$~1 z8ZQF;xfFiye)BItbY5ub%lC>F;_k$EAd0m4D1KD5^0?k>dyRke#QqBq1yXo}M7+cN zfmjOO6wt@G3Enp+ylG)bAnH?A?aja@QmXC429{t-@Zp;9;eq+^QTXP{xgY1s{&CtDMhZ{`P^8qR)Nm49$)@@HlK|FGcor?M*llX>hgz7_w&cZy|9^*m@xD=U@3bmv(J|gQQqQQ8iW13;YY= zZF(qWLSeX~+^=b1Q)7ruGC)Nvx8Ek#l0(jk1;EbXJ&^;V$Xv&g*Iog*z$HG)mT-N18>@~N= zp+(<V32DD7P4V|Da@l0`~Lm|UiwKJD#i( zGMjM5)}rf<0MQ~DPY7~pGA$-Z6JN-o?4MDrKa$737rc;pY)AxAXZ0(^T2ric_-`oI zAIf9DP^=T=06ml5t-i6)wi6|L?q4X@zmmsl2X?H!Q>?$_vHyl*{VSFEzsqC)O=Z6B z->S@C6vh6r%6#_I_PT$gG7k-h{&#y-m!XPq(cvk}buiR0BJbXE zq7Mf%F?p4vKIT&3NCwcUkX1?+V3d7mv&>Rd}gd z3X8R@D7+4P!ny~qb4U?HCqGe=ET&qArr_*RfYis`b@)kUe`iU_-x_G zQ6B|a=uPwcFL{-pBRWf4Kg9x&rvY(sn8wjL_yQ202y9Lq=|UtA zz(4BhP7F6!_d^6-rzr&=b_yZu>S+GUG|FKOp`^tT|BE#9Pu}Fl3L$9Uce9ac=0mg> z@xMox{_9O{OK_*VyjkZC63b%f?`27siaRfm5w0OS$Qv8pZe(?0siZF1sXZ|3KHDA+70s@eP( zhk1mywto)u{O5*wesY`o!`QOW_gw#InCB zA)XefH4k&1J?R<71?)S})c|||UgG+Aa8zgpGls=`x|vmtf(l66t_!^FsW+2X^;i>~ ze?(XjHmIMs}0zra9(BM{h0m0qf-QC^YgS$(B8qRe0%xSr8 z)6?try63Il>Y-q*z5c(wzYozE$zzbG6^qzbd_2qmAx5Gt!qm!stqeK)$)9qo1h_8slNG3j*uXOd3ZmoBgW9O@9w*8i=2^zTL; zW&n5op?&lh)Zx7eQvTb!%|De^kG!0YKvb?kw?*GFjQGMcjnTVn1(uI8W*Gx^fEDB zbzS;t)nWj8C$807M+Z_nUyETSZ3+b#T-kQkcq>QSEnK6mzsCFb-JaUxnWOnrxin#o zo`_j}*N2izARi92$>e*ROU4&8LJyTY!#jKuRDGqwJa;$Z+?m18tveQr_0xPcIp zMFOaVC&;Z_eqyo1D!R3T)>Z^Uc+dfuWPPl1z(Rw)&Gn4 zn}59>^xv3j(*IeiIZti=&jFl27fL@j|N8;XQH6o;{tDm>iB@L&YsNyVK>Ip`tR7jPp%I*up=d@fMtjZaPB9jaymaonoilzH6(NyWAiuErG zj?|Z}G}!G7rztj+ueG>dAFYivRBUwkyhD1g)L6OI1Hxi77;UWD830o%rYkj7?~WvL zeqSGLs@b2&lni^X++2G&Q>a;D@V2@;Ua0&!lCIoRf4b7>c)UK=(r~`f>5oLJ(%N{r zGZ@SGWxTcNdjJ3M$dDPt@VChDKOi#vcS{xIdMW-xnyUXAsX{Id@6eFSziM~?Z@%5I zCV_qbce1+8u<7rX<7>$p zGjA=Ga*kh)o;7tB0%a}bg=OBSONLl)8z_VHD#z**legvg{~s+Cd>#*ZG~2)1K$+Pu z;!gZanko=vmSY$;_lmym=YN@|${A?f`u}RG+QRf)|I0L0Z!Hxwg8ymB?&zliyH=WIX>7zS)ZE+r+NeOHgMk!ufm#Ov#&SU)69c}=1zMN~ zerpUeUktLN^R?JUtM5d;H4Juj4R%iq{;7?2swQLbFOf|BAqQxY_#rWTe<7I~AcWio zhs6Ii$rK-y%=Z^4RHk-l4njyV=GkxYZ}BljQBHWEWl@gmP3 zLaqlRA9$lW@FPMOBa;`S{6SHBi(c1ns8e|GSYgx=LMR-4WH2B25+7Wl9fei|Mr?}2 zlJ|Z^h&pKipAJSn>_?x#$KXGLP>LdvbfW3xLoBz^R<+RD$1eUS+y-osiC&6WzuzGK^)kR>+WXe5n zWPmwRu20IKTPl$bdJ0>(Juf<@n)jO^L$4Ax#SrPX0r8DO{4P2Mx+$e?2z&zJO&QQh z9~=rjfluu|^!lBYI>?`XW|3YkpF#ynS(Nvl(MfAR^lGq3-(B)LJD_>^~0@lWu{^h>C<(&+D-VOK4Rpvk?#41kzruhQjw zxGJx@qhe?~?*N7b$_L9+G4C@&^!HC_L3{bD1f>vgNrONroo;DlV~(kAX^%oaG&)Ql zLm4zwS(QLZlmhxXFg%3}igw6rLLfXHSlqo>5>)I>S6qn6fIj?GR!>-7Emz1E>OH4` zo(TjXcBZcog6cy{Qv}lC#EUZ?kdlfWjtD`8mTzQ^GDv6nG=C*5BlsPA8LWIM(f2ZF zvMTIjuhFBbi-AJC6|bsLm{|AlwdQJL!Vq8!EV5w8+eHKlBBvK%9&yqMw3sS^Hbl#5 zs@Z%>{?_YNFNS^^>MaidJPLqnsiAT=-+mkb>7U52WatC(`O?jxi6&T+N<@>*x+O$_ znL_G`S$!<1;{KsF<-(F)x7aord?%)-0j{&QMA}#ceraiFO9q^SvY`zd5H=$rnGJ>> zjnG>Sfg=rH1kul3Yu`oJ!aky{y5*D0H#jo_4hFnx`x?g(LxM&cB1<9@%?oOa>WD&` zR21r5N4(_eVGCCBDZ=V1-~ii*jn3a&cHKjD_o{gqz@%=WmV)76y~0iNQYAsZ+8_Dn zgRr$>&6N)gwk`G0nSg;Jhxb50eMa|EWx5t6HAZlHcj1h!FAsdVBoh2Z*Mi&w`as@9>u?tCq0VtEV! zNDANOXt+ma)ywKB{|Y`ikv~LZu?Mp3r9>Qbn$ioMS=s^a2Q>Ek(huZr_K2nW$qsq@ zta!Hpy;lk198#0qLlXUUdd;4_?0ybhLKX%fo50VbUP`0=Hpm10%l(SPjR`u5{C{ea zm&w}d?-G;@j24$HLkKxD6twv^%hvtPw?eu};R{j*vXbaCs z0Ssd&!7%a2BiO}J>P&&p13nec{q;hL$rhuzN)r#kquJqLUnOt8??Ku0hzNFRA}PTD z=E-V>+BNNwrlEY`>f2vLl>z=YxMi=3elIJ5sS}qv`#+W_r){Lifg8_YrNat&vZ}ab zfZilf9#EW11{JLU*Mc;B$<%8PL8`Y?3}GHiLllE6=9`B00q6n1dX;IwO4#~~Za=v+ zWujrdc;;@zkjsV1_rT?%-a$$yYQyvAk&9Hy=wwLV# zGu0rH6)p46@H3a>je(omW&#S+kUn?Z-cLR?4Bs{^p6<8Wrvx^&O#=>->X@rUUWy(- z*+SOk@?@|ZaziHxxbGkgEh9&rLFVR@ma95zl~3@iHwkOW2y4`7>))DxNep`_mCbdh zrPJ$A^|mfxGXZi17CWpK|DeRbC>P%;&qF`XVxD?EMXc@tlkrbx=w4RA%4?@uz&esS zJ;MT|;Z;!DRK!b3LE3W3%c4Nric{Kj3Nvhpu%EeShUJ)-)oEXu=Nd8#Y+3WlVaU!D z%EnpCjsVGQ2w#K2>F|iKU+o~!SsP7=8NE>(O<~>B#IDCH*-Ia0{Cu&8q-;a{u;Th* zjBXe<(6fk6anB!NkqR_nklF~k8!<`VYFC;H(JLxS4YXYMk{%uMeVC1WutfA}FGQ|{ z1_RV9(=ObnK@i++fBec!WB`Ik-B-26=wk2Er;!^x7lf7OK#z^p6`-1uckij!i+-=T zXF3(=Fmf=TO}Db+V&I~6>1eq}9&z8@3#8kRcrtKsII&$6!I{;j^N6E28UN}_r{*t=o8@W*vX^y}a<%N3iBYiK!eFTYo-yiiL zhUhFv1e9F9n^tt7@=}#Cz8Gy&ZYlseX+I4XKCm9&9C{tlu^ypI1`HE!>-Ga%pDSP? z%XTR_Zf6&1L+5H~wM(z(w`ObMg9qoR0F=|+Q(naONN?S{9aEbtjz3Z(zQ4+)*ZWiKG#K#OoOS3r!A6^p$8W5RUr;{gp)2Rh?I$LofPvPiEqIAdCf)`*(9-X^8)8#Kz$0 zmT)sUf%mrOh{nX``;Dt2frC1o$bisFvExqR)};>~<99B9B3#jAk>bJM3(LTrk)l@* zkkhLamb)js$W^}16m$TB;>(rD>j^I`l-dK#WrU{T2pbash97kMrTv|5nTcAY@W~6n zNY&4W8G`&;Lo4mW>I2|_)3auJIHw%&*Oa5EeJI(IjECn% zB%9L^gZ6;%sC>Y`-iVLIf#v(Kh>_>>g*oEA39OjH2o)QoE*8^qH!QPe`2$Srq3~ZT{)>->;IAuAswdy z>hPS7p{SGAw&{og)*N+OR5Um`=aYzjc#z=ZmRr<_Vsv|Ie+(`2u1_bLvji7NLsjWL z!O1&QB?XC8S^n03^9uT%!Ux^BPvCZ)5haYPG8cwx=!R4^FmM(!kIwp?W(FBton#)M zwjS5`dnFyV_^(!1GN6gVuuEacQdLP|sY!*6XCA`p3gq~JBrG8qq++rpF*FJ3#B885`qO><*0Q{zrq zc-#Nm_3~`Cx#B%-LPGgX<|otpLCcRBk;~*QWn*ES$11S>?BF|@E6uQ&T>_4745W4J3KM(}O+Lq@PGzQHC;`I;8~i}&;)Mx-!pH;D zThV~vdli-av~ghKgTt)-H*b);ft)eJHfbS+y|ZdGEM}{jRci4=;}=ul3=48*wCzxm0DIXJzPc zG1c{2_mp8CSfdH-K!{wUve2B8=|W0?#v7m~rbVJ~`%F}H6%7L^KDp$p%-c5uhdcSC z0>fU5ycn}EXD`%F@)A`6kenRG-Bepq(r(g9_(tT-NC+cjAgJf zN&=e6^RxN9eHJP|nl;ni4?gE{&0J9sBsJBZh0hz2d2RA545%|C(AvwLi3BG0DOIIn zBrB$r9*MTN_2D*G&zU4z{*rK$Q>RR_Y>@ht#Sw8u{lJ7s*jK}t=l6?tA}m4Q`w7g- zbH$}0C#DHwIP1=gW9mx6I4t)N&0l50a-u*2Q8Rlti;5@)H3oe$f#8AP?Eq^|1oX=n z^Xu+?pIfmHv^IGWXj526EKc?-1!xFn=qS&-ik1`xHaBO@&W7j(4>N4O*O)Ip;Y?Qu z*)kmq$e4+7jx*;f)$&WxE2^hwmo!BzZFZP!1qOHqA;THsoI4k) zuVu|TA)wd$kml<|nIcW@#qWU)AlWVNAt@c7uf}Q?;N`fsnE4PWzcM(vA0^LyVNb2s zv-i!kYjC%m8jnM}AGOz2bB)12O5^jB-6`1zUnaj90eP0!1xDjCD^*jWuY?JOvZ6=p zbj8NGXSa>-bHv0jyMx;aM?lKbG7d2t5Em0_-lZW`FO8YkOMzhqDg=#A2Td-S$*A=} zrXB*Nlrx;o>xT(-gewIpAxYc}eX4K3CbDGeA*^sW9|J#!e4~Y`pF)!)f?-Uf3LWjw4N=d8P1?U%NNME+Nw?P=vb1jZed2Odr|>iGziskFhoiwDlU(AV4`-l5%xH+nLpm`1B3Sl0;R0Ir z*2vPnR=4UKMqOZ?JRO@yJmG~`Ruj@;^VM`pQqgiCyWHI=nYt!Yi=QipOc%_}n)Of) z>JLG#iV*SOmZpOg-iDvl5TUz_kMCF5q8LBog7rHzsfZls2x4KUzVWx874C20HM)+qukS&Ogae$yeD-9{0>}?xZOH7QmtcY%*VcR>L4Bjpc1tVXYAg4& z*zct_JSh;fxmd6d5oERthy8c!p?npLQpZaP^P(^QDHhGMf9WTvmdh}(xQ_T!%P)5| z$ta7il0TIqH*FlhvGz5)MJU_J*g87=TY7tX8J6CY&QwKQu&bozl8^MN_tIC9OB1k5 zpEUJqjuw41>AT%(_JKwXP@`Z$DrYxl*KQFALqG~6OVRs4p03Ro7Mhi%h$rlZ2$+oh zR0#qXBACv08I?+04u^9SAfkk@m`BTW%K^+wi(4u|EeKtvSN%V0z_p8#3ku|J9Kf1` zzA{Wi7<>VarZx=5+@*{DkJA}>F$IlHXi(P-G|%B;Q#p2{o5F$5Z zP7MC3FV7OwHwGG7Y7$>`%~m@`{PGhaT!=PB3f)*o|<96K9rbf zmNDA|$RDfl{a5oKK7thVVD2m*3n#KuYgsT8)m2eNx6fd_xuTjSUk@LzJ8|>aq@O-= zad)9y1{v#+SdIM&9!Wr{%!kZ2Y=z*?VbkV%&Mp+;rNK-fQZW}z*)zOfE{?wxVoq=9 zP}VO(DFt~##n4VA!O<*tWP0!s8o!4$3zXj-Ihux*GGP&XvFli|95i#{*xn)nj5#V? zHv5MD7-W;H$QcP^6MK9|YFz6%mAls>>>ts&Il zPvmn*Z^}>QTn&D5P+jv=UB^ta=11fkRvk2)V5&pk`$a(-$P|@?gLI2NSUCmDOle@G z202Nc{3x$VPp4X*q<%O`tbkEE)56N<7hdERdLcJCLzOZwsE(67rRg@q*M?1b3w|V? z6uK4gztGsHLiDUsIhC0Du*!n_f(}y~&G|IFC-e)>8d0HbJVj28@MGpE7(ho&3voc;0hgsB5;}bBSaHL zW_T3ja+|hzf}E~~ZB`aqn~1YfDunbHH+hj|Kuzai9{9;8o*|qS>9Vxnj_j0pS|%BB zKy1?8K6SYi{Boc+m#N(wKAlCJy}vl6{4xCx^z@XzX4y1KrgfS76D0}<)+YO+5-eZ* znvQVKf*whz@zZjgfA&IeNysgIJV+tCM0pT^e)_wH#52kzt+AfDt&e!g-BezG75W!! zlWmFg%=Ak9Y-F1!8AgasG)d0FZ|`aFBRL?K^4?U|~yesJ6~3;G7Dp%`ViJZ%Xd z(fy6Za*1HO#xiox{dn0Hci*07-~VFIL1y1+FS{pTkLKgPOFW9zIH7C){XyP0Q`LzmhZq#2UNi@>-wu1b6XJs`Slkb7*Sizz4^w!;lll)urw`Na z4m046?9UF(=I7Lv4>Rxfv(i_ewnncCfgPG!>D%)FmCg4UdnKr(#8`d)c~zwmmQ>eA zCy3v%3BGqTevk6PEQZ6VlQ}*P;md`y7*?E6_;YwCeNe%nZ{}>^wf=p`l%XZ)I1TQk zceqZn7Tg}sXD@T|73sw6{Yn3~jd1nM<`n9d~hjo%>WA&!l z+Q%zZA+xU`yE+7OH28D4adRrxv+>r;>8G>fZ)ZiEwQ_67V!ZWyr1e7mX$Jn;=Go~6 z&)JI1+4eV^4HcVhXPe(aXNRaZvo>eD&S%HvHoIPDXZ1E`A~uWjXBRZK7oSd@C!=-6 z&WUwwZ&l8TjciG_P>#}lwpT7VF#OF_fl?$3b}aq9{2nL z7v3I^)dnlU9&WrYIwKmw6_|(x0Mz`W-oG`tzx@J#XNY%a6ntB3ZW#>b=-WK;KXbxS5Xkgs8k2K&NOv~3xwB;DEblq| zR$yl3ZKk&)U^8)-;PL$f{JlAExT6-Ct@o{?mJ8<}GnZgz#|#&9Zx`$P3=i6S(HIw* zhI@Bf=kM?j@*5{Uybt~zH-54YfnQt$Go*upA0YC)JQb+FCji16_l}Bp!0?W1Q3z#3 z!-M#}tAwqCPq`}!6EnC0UwpzfdgD6s%VT`PW2DxjfL3M#np2FKTe8a|eUw{z#$$}F zX*8)>YQtmt{dI=yV;0&|+QegYgJYz(d(OgRaj<)FhkGvkQ(1<4+4)m`gL|oqNx92Y zHJV2S@1Ih5k2=~vHD5fcR2_>{JsQ0|YF+-+oBgR6@Mzxfn6*&P$GivOJ$KPQck@2? z$UgUKJ@=VC_q#j~1V0ZZJWt;(3_ieWBF}i^R{5e5a@ai#!M{x6y-d-*O!L0X$iB>K zz08@t%n#h4C*7G82&IETzNBUz=$XM64UoJ)IRo+ld_rnx_#d96)Z1E477&+Q9fW#R<6e#RubSsxNRM7-4W0|U4-;CSuh1;7Wg$LVklWzr zJG|Sv;|~Zl32THd`S-wP_0%-sM|fxuRhh0l0KBIuRi7swr)-0lHk zGFtW)PVV%Fk;tl04OLMM$1+Ign>2BJRZL_RO?I--+*3|w|1pjna!ostD&h}KVu?*P zoh%)DCRF^3?n8lc(p@gYtfhK{Mv2IpdmZC^p-~$P?04rQopSSqV(UL~r+N*hTjOzz zJl3nNKW^9aRu)*6I)1*xdjB2&d>zv3hl3~6`e6UHBN~b{UO%aNXULz`c6>DH(rhq` z+yBmL`O0FnP^-jdE$R0ALY~n?JhQ-$lT}mLi!)|1#tZKh7%SlGM8+j(FcuO^*7-?F z1G=7V!IHJ>IH`JjBlCqNbS3jcWN0MwM-g}+3&2p|BM&@%bl!3?0f+_3)XVvj*dy1)z!02b2aq@+ zJ=Vb5Qq^N^i<(ePt%SEmXR9#+tS++wbj}GmFvuvh(t*;1Zd5Vy3{6zA$^ws6ztk1@ zspCHCx>3jLST<27e0G1#^Ml}B!L8f%@tYvok^#ZJ5_y2h99sa}Z{k$w$s+VHahT4P z6hymwReFzNdY@EX=KCn&ZYaZiyS5~kgDg0S#8h?o;Cuhvc|dm6>It*jAsqILEnii_We>=T5_6F<{QiUj;CAq>W|Bs z@BDJ-T55OyoVUHgh1+z%>L+0xy&QP| zg^8n&Ao%CiAYB5o!!U%oLaDlswS<^+3}+=gvDBoy5iD%`z5tzIhW-OEi=kR>O;iJ+ zZE^~gKY>DW8YgsrdYC`=Cc+|{zO$y%{e^qcC`_1V$uz~2XW62pjc3KW<%P$t8gAwD zWFrd<6TQiA;Z@rXXfozVXu0E5M)mVj@bu>m<~Ji7=RiuhA1xQ}YMh=I|6bDfcK-b| zk5~SKtS}MxVt#L}{7{J8!b(c3ypKL36yWvP>HfJ#PcQ<>u25KEg@c~n`+8MjuD@!K zD7s!#Mc{f&5F&Ilr6?+VJE!L@e76)u+n|QAc7zVTTci+qMBGJqVC_YVEZs`c{>>z_ zf81UnIp9!@9tGj8VRHO@d-dCUOlhwga2Dmm#)uDKjTK8eIQN16O$vj;R|BVV;fqO3 z2Fq^Vg`ED~7xwoiEG0rWhD~JvDOc7z)xvJ<>PkOGCnF^82ML0HwE(&Ra#V{%NuqIZ zFt=6sVXMDDQ0oDiZuIyGD3~h`$BbV&MbnwsueYC^nZGwhH$1eUjoG0p%;1>;JqHW8#e~shf3c8X@oo-kPVh!U+i}Fg`LMbdFhl=Z-3gS{4q+-3L1R!0fcubzdP^&XLOAu-FwDZCK9JyiQVVhTl}%Dt zI7mnT{`ZB=&oyzCYz+nO7XDu6`md^jx>=2;)3y0LZS*RR#WQJFwFRXLJ8lPBXR6H3zDme6Gpi7cUMHX*H*d-Gsz%^X$R5VWrur~ z%8(E(Me)Q}gFjlCqNM0}pzvfXz%qSXS<;Df1=k|$pO`Fg>&`iw*7ajpnSVxNTbd59 zFOs%4w{2Nk6Pd4vzb^ag`+ccLA4iDFlhGlzWOX-Nq1>sC(J_Z{?N9-yaJG%bxu)dv zb8c13`U{I|599h}OhfCQFsu7a$@*<|L))1r>(3p=jmPPR_PaJ#uj`VHm#c=3*B4fw zcTAg5SdE?M%F{|q?>^sBJ&2;%TsTvP^CKuGI<-{=mp)Gsp%69pynnrLWoM#6Js)p@ zP_(0mh?g1zG8TE6dCtSMn7%&tH}?*SZi{udB*7k00&c1j~~cd@R72JNZ!;`Z?`DXCz@xBomsz1MS0hsLm+3%(zsW>vk%FMg=Wk0d^=BlP1&inW6R3=D}<-9 zhvbWS?1~l5)yEj2-f4%L6`^e}-qs!FbGMn6_3NO#w(GKU&mKVvcIjd*`KmzMNHa2k z%V0;}OsH?pN_jmQ>}>PbC=E6t3N%|-dbUXWG9jUDU{!D@B5G=62K^4r#zPK*n?o#w zNf-&QN%G{RHNh`%BhTqjSjKV&D4h z2Fox?BM0@~cY@S+6diX671aA&%l?iITXGS^J3T zEGOPij{*=waRztMfGPQpwzkL=IQ=jIREaz?y?pUGLdCL-zaW&hR$ctlAKkRS-it>w z*Fp0I4Uq9iY$C&C$gK+aeO>6KB-q^Hc?IFZqG0&JOOAhaFQrU<9$Ljg5=>5a!Itt< zR{zNtEW0i%3^(TVJ7+_DoQ4<;pp;J5rS94)?{}G#;}oo{fhuDRud!i=S3VP;cuce$;vB1h#>VMQDy%`NO~G+=>o7$2a?hqrYa6NAon^h;yD*^?N}#BesWo2GH>-?Jb87VKK^j%C6Qnc7XJ z*C|=nMOWXE0mjvGU#r>7RiD;TH_goz#{0e850w$}Wm+CWc-Np{IRUA6duA>$2cpPS zR)mp++~xt@>ghO}uFyjsvk_img`|(Pu1xzFBf89WaFD z5-H+}&Tg|H>=S&#H?uImBDd~n%lJ1@D}C~|adJ6*N_|mEeL?~Ea75^Q9@`u*zSvrD-|!@H#ql zk#e0ht_aLa8ZIysImX77U_k}k)z=TAybj^YiOpghSGYnLE(0vBLmBJO_H6}7E`Kq^P!G5CeHWU#Px(eO$6Ur45pYPZ01w&f`au2W8EKM z%XxSDy80{_WvK%p=@X{JS=K5IcFw`a7b>)2P$+@GU*tO(HhTa$B-; zSAufJfQ^rL{rGHOT(WZA)V~#A3}mc9@b*GOb~wr-nOVFD%1aYj8u*Rg-j`KwaKPYnA8^r2nb%7Qw(3Za$}#ehE62ZAz4(2>A`Rz7d~Mu| zHLTw+jC47VlqH68Mkp2Wu&Z@bZvAQ_XQ*6uQZ8BRoAv>AUO(WGBJdJ3CQ_|J=_Trs z1qSPCE?H>?G^vpc!-#rxro3!(^{GPT0^v1M{sgYl*|ow}#3YDt^LKs)pY`|3_}Gn9 zxqAkq3w9%i*HG+9c{Ag%a5XzXz+|@V z8DY?LuVHv8`JTXj`DAVxz#h;7DaUJ`K-0q5!)3>!UD9!g=u|3NYqW#GqX65T>p#&T z?N=m)+l_p>xO>m`P8L?uO7^;ZUz|(nB|cF8Gh4z-cX;llV(TS}VAXjsvntn^_Q6FA z6x$eeAjtxYWTveZTo8cF=T-&Ee$)QpsOp2-S~YP$Sx%+WMb)R$3ZfaCv$Lv6L)eFJ z(GMz1vZL&6OntPYcBL}Mt%!-do0Jy3BOnII# zofiGKd(*UZYF|Pr==f`e`DAhExt0ClC3hxd|9n#jwEoDLnPGF|;zQ@Oj<5!2M@~+V zBj=2#}`g>0<8fu9UfWu-DMsNi<}>pJ2wJIdEIbDpE9Wc zbQa(K+?6@3}ueWR`^g$xp_KSJRfyb`{!S+AhSy$dB5! zQYb5~drLsN7F!k)KqDGUXkUbnX%2t(;Qv~uZe$N2bqmvQjTExBo2+!>b#-^ytonW6 zY}W*us*~`XuIhq$med!;o(X*t*#RC$9034$tfsS_m8rbKohuL#VZ3r0)8a! zYa_^ez?JARKX4#}V(IOvFuWiK2l0uppI9R!E&S6-rU!gPid#;Bo1w)>yZb2c)f%}XQTGDPA1wCHkvYcrL=Y0X^>xlA{!~Mtv&YXn`$O7Aaa}}we z7d!2y5E9llC7-41WXOG<7ChFEuh}M6#tK#rVhX}{dGgc;*$(2_a>@(Ds#W#5^I}%f ziYJYlr~}22;K1%k1K?+e4=tPef0_$s(*Ux5`~w+s12bnH4yi2-E2xbtZlj;a6gAXe z#JD;H>nGq;%#L@CEEH;DyJ}<=8m?skVt?GBeJ0ujop|oXIa)VbbB98NV%%EKS4(S| z%p)Hdy$#d{M|h$a_JBQH_}N1v$9Ww@bn$uvzRQ24B+Somc!h2K>LABKf-T6lnbX&1 zMwr6w3nmc-vWEKzg9WX*`!SLpyq$lzhg1dIJnou1{!HjG#e3vopzinIg9dCZoR(X# zOKw+npTktDNtfdxRy0j`tm3mAG9uZkVh07vxHG4}kdP1+T3}_(#{vNXdK0*V}<~ zzK^$XQ?rD=Kfd{nc~v#yv#)zuX4`a3^^!o?fSOjutCez0-VRd6ILfhUsw(h={ous_ zkT^yCWN$iIA6RU=4B|JnEp_iPGV^Du)9cS~MYeC|N|f?xOM*y5a^b7fr~!DR)<3x3m`J3HaK9>UYWM+y$)vv#gK!`g z;~7LbEZByOIb}J3d>XoByW@^xtq4pee0#;27!{A#)tFkFu6h#qJMKo_%C347n9@~z zc6sq`XqX01eJv*C^wZAuIjaRj1rB^`RG}3fI>ithC@{C2LT7%Gs(1W*2191E0f5Lm zXA8&r&C&WV2FOJZhKq?@zGwq{OO@kYfS>RagB~ou^ED=bj#nq#I&$xHB5 z2XK3aOjOc3UdOgf=$^|FX*i}aARqdNT4=uV;3s{(+gk1B>A8eY{y!lRw;R44wNA9$ z4IhwJq~L3{HjM{6?SJ|P6KVQ^+ z3w=#VqkH&hj8EN9PF@25OkP7P|7g`}`_RRJD#DM{4+}q4esVwQpC?_St`)Y9{7C-6 ze(s$q81V{iUK;_WMyYwYlK%iFa-Vi;=s=z^VKD3@H#3|G?YRk1$OmcC; z-B8DEMpJQ}`T{KE4KhY!8vUb-n zk}&5hn&%Dysk>3Y>1j&tnnwDz2yWq)-L|rJtAvlorWwg-6<3!ScqWEXANQrkbn<=jM~$iG84F)lra<&oWIvL7-EYSLjG{_*Bhhx-0er4G8Pw&j6E{ zPNAcqur9AGv_e&J;9Ss*5DL~5cq{*1$V1VI{i1Hkn@Xo=)2aW;FqQS063s$bk3vE1 z9e=E_-%>Ptz%?l|l8LhJ{;&px3{);-Y8qJsae(QWp4wt=p8#c>hT%d zazKEeo;SH4+wokTEPqjFE@B>NRC=NFftY{t*|Qi-*f*$2;wa+k&IC=SO#eqeAwE^W zGTMBFn8nPLy|%i>xke#dD{W}pVfkZj>Bv!9ZisSs%*W*0+!IEuo>3WL<*2mV6Ekrl z-Kog<+C1)43-vH=uv`{{VC{jKRaY#PRhB{-#zcJcJ!x3zUR{kPv#xtspOJk4cSzB6 ztEFDv%P5SxB{PC5CS@Q%EsAn7&WFm`ywmspV(+ek;t1O|0S^Ql+$DGd!3pl}9wfK~ zcP9+4!JXjl5Zq;e!QDN$1$TFtpFP?={10}wzOCBxKI*FO>b~FSz8+dl)rCf7exBc} zq++||3;oPRNONSHH8!muw1FCNKeN-uLn{Vc&%rUUaHwm^l&B5)u9&J&fmZ_=$`(>u zG2gAVQlwnZJw+4`j6hmwGPmyj=agm{O7hjW($+IUhmx>k13H1!PJjsD!5tfJxoLrO z()HXe9w%vA&IqUSb^Yu5uVkixls}P=-<_zHb;-oTRDg?p_)Ql$B=>HE>?&s%Sk{zR z_|2SLF|4xIUO3x@lU)5-HJ&h18^x)t>>^dFwfSM(vS}W!Fv+J8&BVsfUy23IvyuDp zKaD2fx(Q@-Q{>x=>GIAlj@$(7>$KY#p)qR@qJ~skMM(a*RJ!Cg@j_4TNYH06d)tb5Ia8U7)we4xcoDgPX2Q*y1u$pUYhl(; z5KTU?MvBgsTPfXhw^T=@`ddM;fZr^ZjOr{+@3gmpD@&qd<5d|TVr#3|kE_^m%(qYSk1gwpr>S(QR}o;txK%2@Ol z`3fx5q^}$iGQ{Nx@@&W#s_x&jLJD;C9>64$DwRXbVjQ+<)#$gM_59%P-stDPVh zU^~;O1>e$FlQRQ;7?OdHhflIi^4*DDgNHgzR^L^HDlEo_q5CQyTMGz3o1k=OR-oz? zbr|^4*Oic71c2}+9?vvdK7izYHOF7bd^tP0YL0R`dYUP?+Rj3K$<-(l3d)Gv=I#XtTl#rU z50>9()w&&%|Sk!)0vF%Pu$caXQEM_B^Ay(h}Za zo&b8#Pjh&alFGE6^OLM|@=c{yl7I87!P8gIyKir(nBOljJkcFt9=`%=3$LR_U@$JA zxN)%5=5bfmFieB6M9LP(H6H{&an)@TP(%UnYCfnae}m#8cq2HfVaG+RPQv_%gD#p_ zWKu<_Uch`~VT23*?8t)ndj28c;*E_3-ogS>ktI>Vh=slT73UuF zGh;kX^autTEG{=Z4xSY*Co3LxKRWT(w+m$-1r@AY2~?|Ee7j40CsqPiCxX%t(U&oT zzw(eO#-)pY1mV+!!B~W$tVFS_g#ETeIVwa&wM5XoTEZ;WxBU2zCGkXHC&Y3rqWW6m z%1h#EERsRifH(w(qh6AwT9UPRk}W6V-f7}j@izrA&%H~M#&{7CJF2T%(tl3m{VLzy zE=hM)$Ps5K;Ok_O*(kCKDKW4qK07P*#8YBne}c#U4jtm;4?S*e?I=S=Iqc+}DOT+sxu(QZjlh1b!(hjQ_3 zbV)PTL3MOlS9E!7^hM6}rFHa`SM;@P42{kVlumSzD~4`1#(rnUq~AIZ2aLc^OyjCd zOU_Jdbxd1VOuKB%htABWb-fWnyPzy=LQNXXkZcMRZ{ot!IC{VxLu|5WD7(#NkwD=j5$tBbwzb zh3C?C;oP6$pmX7JV&`&k;kHWP_QByCX5$HV;R&zjiN5CX+96<*;B^Y(74GAWcd_Yl z;4O9OR7T;0VDhV&^6>`o4-W9}%kT?-lI&BH9I3bIyB5fB*_ca+S!UqC|z=VyZ!m?aZYlg z;hQkJGQoEV_(o;4TV*Ux73gev;LbO^TNVAC2MSl!&}&7yTUAz0HBMJLb!l-Byd+=J zjq{L#c;EY#^89_@wF}h*>!cosRHmJkesGF^ca3$1Q|B$zxJ1(A4wBI3kT7N%n2<2`NulOeRC?lZzT^WM2K42`)cq`d4uO;5c+wa;i zGB1^8CP9^?-G8pPbgRF`X|U^RaG3O>(<7bf`nrw&IQR7j`J}{IqX9g~5ZGjhc4uf6 zq>jZ!x1#nPr(YmG>81+z7Qe}u>CTvy%j7;$vtIq%+C0zSM)A9O$={#k`ID{1Ksu~_ zKR(>9x2PHIe;-NQ7FX3UvAZ*O;<9jULg~Ey;Tm+~39_hXF^#k_mEAGnq%u^|kRoZ) zNy9N$k+IfchX(cntpNe-S8-ttd*6!@K zxa`McPi8=(lXs%WAgL}jTPU}>wT+ZL47Ve^n{jYeji!m{-H5#t%-#hER zBnOlCqUF6aEBE_on9HPtZn=v@V6r$Fx&Y#sGeKhPcbcEkY6^BqQjC9px=L90e{+2d zbLPDVIdQwWHrv^`Nf0(m8oIe{$$$z%Z2!%>O9r_IyLqHFdt?!OJ7170Y*ff`lZ$tg ze!CM(Z1w~mK&FR4n7=-(Jh2CE zzXTtCiSh(Vx(8h$M2H+}xVo2|81y zds-rfTcUOo_%HuP&AUf0wM4HiuK%HSveG5FY-t)1*ca&rq}XjGf-ZK~2nv3?7i^Z3R=b1^(^sdE%A9O3E=w^?D;3W^-uKEpLo8~B+t^c*3zt}(mcMhBG0nY z*0Rc{vUgOY(X$-fS`K+C@8+xM_pBIhtr&l*nC7dT_pDrMtz3Jm+~TX+^{hHsa~g zIlbz6+v)|M>qYq+B)uAB+Zq&~8&vok)x8?E+Zy$s8;$sz%)FYc+M4X1o1FNYUA>w; z+TL@`<^cYdV6T?&wwCDUmUw<}k{39w4V?81&f{+_@@g$@Ypr~4t>tfP^lAgQwLzZS zy7}Atz1oM{+Q*;Ur}-iCUXZ0W$l5bxi@#&ntK+b(z$HrgArUl05 zy~mf@$JbuQw*)43y(bRaCr-Vqq0bYy-jk2*ldmt6FoIL?K2t!*6x!<)mf$p=&omKa zn)G#=QgDWP4W+%Yz$ z2`-rVELcGn>|Pg~1pm7F{PlqR^?CgpAh;OpvltFpjDB5=7hFp6SxSQ}L9dmf-rX&-x)` zUH-}KRB+?gXX6pF@%p*}BeV(cy9w;rM0?xB652u$TEXksB7NJU6xyct-KOiqT%JfWi^-=orwqsq6VTA|}c-(zsc zG34#ITj-?U_hh)^Wc=-9TIh7%_jIY_bnWeQOX%!wEs#asK*t z4kLU4?{@+0yg-9qUr7%tv>YDNchgo@6M|8&JKF#Bz*7cckj`8?*qLL5Pk^udkF7* zh=xAI3qL0LJ*IU&Wur=&c|0u@ed-=HC?nhw@P%j3uup7?qgM8;Lc) zFC3Rar#+0dU?7@=-}42Dt#BxwNaY_9Zsxeg?PvwWdaug&unnX6*4)^s#oFp{fsxzTo| z)dz*UY8CwRco`DOUA+$RetvpI;i=i|4niRoisGr=?vEno_eJHc+Zj$|(Cvugt=}8Z zWd^6ju8M~ z?T%&e`=JZA-W<-A>vqNnw%whsws}F(h1wr3cSbXWV}&43wz!GG*(F z$1`|bj#h{3OD1zfej$^}HT;<_kV&A|A89C^Em1Cz%aUs>n=jX@w_Y1*EdN_=*c(AA z-&C!Rm;aeZ%g?%YI$dBSWIw**f zqCYH5)UZA*N;NM#EY1WS9hUrWlwhMwZI4fzH$xcCT6U6c&cFx77aW1@MK=;n#YGP)_sK;srZnSaAFihDWj~=s#pM8r z+sWl1MJVId5LJrp)i7;I#nlL7^U2jH%OKv5j_it7o1`;+TQ5k#h&DG36* zn`s%E%9|Ml?$euDWof3{x$l~GxAR&SmA4CeZl||@4MUmk7EM#^?v^Y|D({wUn@|6r z*mv_EC&BVm+dExG8ln~u4$2I$rT<@)VC9o!@_sj06fwIEj~YB(rF5YdvxLh2_qO<* zKO^!C%1$_^UuPaDl<@r>o&dF8XI(^<2<*#FdM;mQKa7>!Y2`yFeV?v#0BCx(<<#W$8G%GW6$+9dcRe z;Cuc&RV~!q&H%C3`>;BHXVBCM9JdP^^x8rfcB!pCId`ttT?eLc^?qJ^M+Ch86*4yu z2`f2A=(hj6fF`#LMnkR=f9cH&{bU<@vrSc&mL!-ly0pph>uulnx@N{&HYIF$eUOi7mr!*>Jna0%)jw3|E;=f zs((GTkL6$8XTEQpeLVwB@~_`l-FIBSp8H}5Y$7^~Id%H@W6xidgew=W5yUxZCJdpnSG?ValQ~XWvNVEEBq5kc*Dpv5s;_LJB?Au+_ zq~Mub_4E4m+kFRy&_(Fi7te;zl;P%{@k!q<%l)1X$J{!uvcCBgTRivA5U|}<3;G=Y z;9nTK_k~{PeRDj}^n2O*=KECo=6&1N`FbHNd|&N@b?N8#df6=ekTMCqAMJeEy7zlc z@jKx51IYLz@c2K6`hi3I5o!J32K})gO#dR9EouIQfAGI62_X98Pn_zD8Rox4@SaBa zt_}K?tNsJ3){2bhj&!hytZj+3DT&P5k1R`#>=}wQL5!-90TGBsm0Cpk4o1~1MmFyA=E3Fc#Cp?Vd0mARCXy z>xM%Yk75;vY89WU8P|OfhxZuwu{4(0D*i$S#Xcqe^U`kuaBS+}Zvwh^%k=mA4=oI| z)QyA4i+?Ge3g}6Z7ESY*K**cO;E}*(_4^trcEd7}{V-AV@V8)if~;(k#Czm&7?14X z{oxYj!zG5Th6ziFDTfA%k%wb^vbCy(4Li4!G1yv0GnvxO)~wjxj41hN!FDplH2sUS zg~v~Bgp^B=bIM|h!rv6}Q0L$~JG&)k4NVuGFPKd=n759Ye2b~W1F0^ub{?`0CTT7a z+7@oW^f)WW;54UmDNB+2w7n+VSXt8@OqlekWM|&gENv$=&5Xq23~4E3*<5%vO*^mQ z3?tg0Zx&7)T9?w+00B2lW=g>aI(q#l5rqZHcNQl z+-xbUQZ~IiB+aBajey2ctvHL4Af;+J^K95IeJRB_Bs+*VXYVjaYtXJa&EzyU)7B~z z$umut3qh6wpn?elTjT0nn!_}Zi%yRzM38&*m_FZRO_rX_j%d11Wc5$m>2WCy)*_kW zDJxamNv0(CTowaJ@eZvz^@pcYm8Gx`=6q<)Cy7XBwYFu~DcC~D0`ghlzXwWXd7~aK zA=)Xc9+|V+C|g#A!g6+MBbg#JF2}qk|CX`?tg@8ka$8GteIAPzY0Pj+@-v8>%cXLS zHA*Pyixo!lY+8#&%6`HSqu+o*Nz+kC3|1s$yGmaBLDTUBvTcTDfG z`mw%%0)!-j$w%xBroseLl&3}16c+>Ey9FOay%Y9pSw?G`=qtPUYPEDR^cWhRg`d%=YWQKfBqLSK6dBz}7T)^Mj00s-#EJ zO-C!Zp1sm304A7j&DP}<{4FM-O>3>_)W;2Ff2;FaYh7rXoJY}fh+D(kYT`$0;Et=( zp6XBhn*&DOrsbMF;dRA$y8Yut6{dF|^&WEXr0w=K? z+9TgSz;DufoXbLMjZJ|$Jc>O04hD;&qq(R4Q^pj5Dwpyvw9hak@A$XFiX!I@pd;jU zaDzJFw>or-A+TK#5-pSqc}(4lUyZpy6_%foS|+e@?XdoEi=$Zw41lZA5EBZ3tYQ0! z4djqG+*8ZmrJH@3CMB@5BwVSDmbiq4yu}O8_@%QFP zb@c0+IJNikM?nS|x{=2^r`rZu76ygK+8UtBf##3h3vK-X_nuASK6=_=c&xtU_TE&I z_aw55WuXhhwgY%FoV57MOnYd+t1?AlXu`|vq^nO=4{wds`X<=`xV1j>q+A>>ySfx_^hq-X;+_? z00i4|t|)4nR0hL1bIyD$;qXNq&h&7VHxWw0} z%7^uFq@Isp*_h!a$aYaW zKo&wVHujJyyD~*+6-dS(z^}R1zLo(Kcz&jd;zhgU=Yv1pe(myVtHd3M8=C}P;0}P+DW3-8#--2$c zHg!)Vhd*P=PenF;&o;gipD5e!(EG+)y~Ui#tl27o%AyxlyOzcb4$L}^J%!d;%@3=x z}qpM_Z3xroCKQdbhT|a$CPGnw@}?I1DAP(2bd$$hbjCZ`y*nce zIF*ZHg{C_bZ4?{<6IFg>lcq71i-Ll<*>bLf8;W~ljFbgNfCY43Na=waw8zu*5Pjay zi|}Bq?bt~+`@`ptvX42eN-hY)##4C6``eT$#v}WeN4b!Dn^s`f53|DDr^c?QfWs#% zt6bBOeCx@(qb3Wt^XGqU_dL;0&JYOq!hKrov$yOEvJ%Fx*ncIRK;N=wGomLPIgEPp z-c~5|k%cBJz$zIh;?KAB4E*13?d^1g77(kai41O`vVcTtVD?UP{-P3wK~P+{Sar~oN||&twv=!% zuJapCCc>R1!kpOCTWOe%NIqz#t-pxeH3 zSMe=rhY`Im%+;w^g*f(3y}j|uAUT7|zJsyrt6+4djnN)ogfSC{OFop0$%BD`$^?2~ z{#x$hs7Ij!`)iM3`Q)Oj4TXkO>#E^m0rk{(ypr?Qx~h-~F_vkKNe>)~VV|E0ZXMV7 zi{T6B6=!;(qA*)knW6qp5&RB?q8{O1%x5>F2H}?mLKb$A zs`_xXCjhOYoz|hynV0|9X*s2_E_M_@!H*s$R#4!pOhn0VFI3Sbkh9#_urY+C6k4Tt zG?E|(m-3~EcJ5lmJlYm_S`5vGeOQPlbM8xS(C_d1!bCpIg2Mny#~)QMd4CKeUTP(= z;a*gkfEeT&iU2Pin^0VKa^K`nR4i4}TZ*;CDVzFB|Di%Ruab1T_$<)&`T&22+|nYeEzm|u8W>YaeFU3b@$gOM&HIg zv{r>e6uJ8Y#TqkyZLvC|Rn4{XnzAMz&>GF=S(h9EqS|?_5(D*+nS#4iau$e@!~p)L zfXC*d>^gd6_Sz&exb*xdgxY}yBVyS<4;R;)*~t8hhkoPPvZB|?$F*bqhUR865T z5@A*WAmqO7C%J*XJp~qj-Zn~%gw)P%rxSZ?g?ti4jpRx!ws1b(v?G>K5oCi32S2aE z*#R*GG`U!(7;ykL@={$b049h|kFqZ@G>EfD1v#6FL^55fPGIExXIh`(nN~ReO`|Hd zEFf@kBw2!K;S3~EA&U#O6esD4#`|`XY8e8m)8eWRl7^aWFqHzOX>@Q>XlG%uwWial z{J$kI%CDTa(D0sxPerf()c%M;!)d$B7Uf<*7(FJ{D%=qj)f{Aj?^Vi96@>w$!Sa80 zw}70R#gbZ$&hdF1ie@$9AWr72mild+5M?2=M>NS=bsJ}+PDPppRGjatjz&t%r`}3! zyP>Ww!4n)F;J|{!^hD<%o6@iL;P*s!#8;2u>_J60w0j+6>dAIVv~l%PX2Q+sV-rx! zWSf!YW8#f-_2+dcwu&`x10r0uYHbCFrZV!}j}&OGs7wyj3No~k$?DPO#Es<Sb$k&+tIh-$0YDD|`lTHjl zwV|i=%3~f$ zUJTY8dqTmitTQ>CNs`U>BkDh`K?FKOI0Psx*+^sP;EQ@j(K>cO9*as7!pc`zEfo_= zVr}rnII?7u0B$r-6wQ8Comz!$9Q@!BB#JL=`h)|Q02)p0UM|f*+e1x|@xTh`!qiM@ zYuKbFv`%7xyp zjIDLEGy^}j0y6Af_j`>$mg}^Tf3kPO5RcX9eC#ggIs;ulTN?b@XEO9Eemd;_64G7SUub4|sN*d#%i`N)o32>ZDg%R5 z71JDHb43|$xwZdPC0ncidhVu6)jCUkFMeQCl2NGnS=DlokV7=WVQG1NkNLigSDpO2 zsZan-N9p|HHg0K#0Dz=uKlIF$yy~m@2`~%JgH1lc!CAJVH)!gO=D$s?Xcj7Bx~QH;Sy(8;PqC;x#Dy|MIuZZFc!qf%ijwI<(xb4L7O~7cBw7x_em3zh zFT{)$p;cCyJyulRh*;{?I1mrhCa$Ot<*Lhk$&*l|0vh~e zs=JURJL;{ykQ6K=v@{M?oDq$i>W2dW^0zlEk8*~n zqv;3fPL9$oJEBVGy>JXGQ? zaB`%mqtG5W#e30S*17KWS~BjRqlFc+2{##kx-)Bug30H4W87timw0~n$=m`57aaT8 z;Q*{Z<#;Q?&ojjb8HdLIu)2;D1OCQe$K^~jWmU~8|#gYk`k^^`rxDxrJeD> zD1O)~WyClzf)2jBK7D9(*d7WPH?7ti1h*HD!uZ;n2(W(8XH zuHHx&BM*k1NTC$Tl??Zfz`-ggFq?XpGQf^y(j$R3$14xVKrMM(o&{$lv`gYK5@l=C+eG-zD=U%8DJ4IyzKBDths;(p{cv?x_MX;`p&77MR_ z9@^Gn^7M6^ML<-DWiZx^hB2oGi5-E>E5MbCp_3;++0`<8-0{tH5w8w z5n816^);=22*YSwFp}(0 zo@x>UlaTbftLKK<(bVD-qvKjJ>swjCP{LnuF5X0NIZa! zKX(LSqUxnq<*p9@Y3*=fILIzEmPt^V2;4Bg+{lAdf|u$H)=qCBXbsa|{gjvtA0B)G zUMEIr---xWL+(HW{)XV=IdOuf*wSr6 z#}#>=bjf*(zy)5{O>nJpZFNll@AC!3pORUEILY@^-=b2z)jRGeDand-HD=(N)lgnH4K<%vQ9?8kWSMi31ane(GFbF{Wq)LbRrzr8MlEVs z!)u)sAp#!^-AM(1;IT!UCE3Ntnu;22Fret{MtMFgH41rP!9Z=>kA6bMVu(*&A z%n@}`SF!uz^g(#yrU;DgOU7qYaYR)+6RLLzTCT1sCuKaA)C-u21!Olz?=u z5p2GOvq&l_e{k*UaTda;x~51=SvXm};>Aj13i=~p-kpO?lh-xv(YOsS{TLza?dMyZ z?XC?nFMVyGe!Yy4$_krqh%p<`98kM(_!v3Wzlz=wZU9ox$<-q7H4YeF$D}_gw_ZVn2J)|O^gc&0)NDaCZk&njIFOw&=IRSp)W9sgT5EghF2%)%JNj=0*lfW zBv6U!tV3fsKC&-xvHAH+A&B!-je z)eY2Pf2-s@bnwJioU;7QTux;v_tuvivYQ$4CZ8E^`Mo{0tb>qy?PCR(j6bY`?B+p8 zaXv`WT9F4c;!VL*?+Br%H;n{bCuH-IH_#b0&4rD?QGYlqS9zj*c76u*E;nVW_Vt-5=y@PSp<2u`SEc5&5jt^o@e_g zn~W+N-A2#&ED+14Yt`}q-(Kar%s|!IdeG;wH2Pb*vvv>rq6sR(PvsLD_EB_wqOJDx zgw|0+XAU}Ic>1`soPj!vidNTvl&N2h}nwdlzL?MhV8>cJ|X^+VU~ zmAfv9U(ZJ7XY30!qMM1|Kdo)*-}hhPPd6!zT}+t#V?KZBIBAx3NE|-ZVv{FrwWPzf zI*Q4tJLuIM`RqJ2JX3tZ;H(AX81?59(*iRoCgRZwD4meNfrjxYG~V*{>~JU9n$#~9 zQ5dJg{?xW7r_~@Q_JEeY`6C2$`VvJrWOWgZ>P^X+JO zH67q~cBtgcOD^`zm2}dPMNQzEnm>GBD6LHHgyH5aIGK+IwGo}n=*&E(3UsaUR&e=K2A#+3Jn!M0+kdu-;D#AXlIr`%`%Qr7&N3c`nrqH#7WTjL&8>vNGD8gu?C%>4Bfpp5d-;XA zZfIrNG=MsR{xohc){w8z_6nYRIGl$%d042PYr|g~q}5yWDTNy6oEW9!+TW>6$_$u} zq1JX7?NFxF)qjc!7)jpJhBzAc2^(v{_2IRVZU|I{uwQB|bx z+(6moO-PlA_?pT8w~v<_CCu52&kyuvcPru^~F#)yr$ ze?Q_G&vNiyy~yN6@i+(YgcdwHH&;Pdpg+_`At31eu!HElben3ya>i6@R0%7BZEG7h z@~WBW#maMIsK;aqe@RIjqc#`rihKK4U?(|p*L`@JmH9~u5`~7~3~iB6RU{$F+cGg! znQH~u=Or#LWc3W1&p>r|6Kz98ViJKv3hSvN;}5*WpV6h2^iK}PKIW{rXZa)PUuXKJ}&GX-~YXsYd021#mU;BENT&Q*n5!^mwW^N26p3 zuoY&M=p+-6kU%e5H(9%i zNT8=C?-g3wG_^v~x5KPpzWOiQ)2?nHG8v^B09~|=6}F->L(ej{_`*lp@cAx94q1kI zNFrG|E!U+=1_p$zALq3C;ffe#b_833&S>g4 zCo>|(%saO#tdmmIZ}w|Kl40f7!%VRo2=$C0Wig`36>1qT%__y>w^@! zmqzd@5n3t-+Y&s7eF@)kjsB!ckhseHbI&&l%U1OQ55;>BS|gbTGlKU>1=U>tn(Dt1 z(xeL`S%GoP5J_>flc7IgS(H-EJRfxg^%kzx({@xA;sPv2v?sN6z59`^5v^#}(%h1O zC20XqKw6KF6OZ5d-C-{>GWDog_S3?V0bOabNL?k#fQz8LG=KCm>Qws>Z~|_;^r za&cKmTaV@VYIa+@jV|=%W?8GP>16<OrH#SL~8swO{ zExyAnwi#&{#Zny3>eIip{5vq6!*hq1eMum)$X;4uuBkl#-I&InIO4O1awR-oqN;Q| zvyCDDa=bHhIdmb0fknMifkCA4B_yXEf%ktG%8d>nZ~!@ATE3UI z)vC}ingJ{1F|;h$VUt=*|N7MK#$IKEU7kV0GhwMDXYM2xYjD5k-*i1iYh&S6Q@0zh zTG4LkIjmb~g&;XK-R;6CvMhgmMo{xhSJrZhLnZSU;~Z`q=P&4$IkW4eCv zfpEf`%RV%2uM*Ouldr$`9UY!q%Icf*vkN&a(5+Ze57`S8K$hO}8}d^~rI1qT_r3V8@EiU*J0H)$pE)BH~Mg z+B9r!l)8AcT@|Sbm_TAqO7g6+*Yb1|t$&@SRzL||AtNJUmdZ`aczP;ilPw<^WxvOT zT0X?ii85_-r(8SOQGbf?@e4+`Z~IfFdgYQ~!(@wiM;3dE0t=S5^yth-!*$-G?mlOr)Qfo8#;H zyR14F#qwj?lRrHZxP0mUSZod}demKKHOdTkdw)rG&MM72@&1FQUO+HDmEhUzQ6e?) zIN9nSjCVR`p&x+*Z?`~AO&(;CpfwWb?Wu-Mmh}g0T9)X7eUqiqrEL7O2(PLSqp*yK zmJT*C4bGjN`ef>hqHI~P;!tAAk#|XbUAlTezM24Tc$u~5y*foMM@9G2p-45KTHP7+ zx&i@hUq<2M?1~7D1QkS1T}=!c@)y>vS3w|YK)|AB$94#t6me*o#s7w%CV zMi@&Z{s2z;AJNOClbi50X17zu0dW8XxtOG@EUdT@PfX_jC6VI(I~v38NPXt|UWu$&r3RAN7I>mjt5!^mmv@W`#LSTaW%G1o z`lMj^dUu=ELmkdLiZWXO;uOJOkFUBBpN1B@W<4_@OWNCJS54IqP*Ph+gYS)B>h3$2 z3Z`_ z;5WI(*Mt?oCL+KaH#_{&ir-#ZmTK0pH7`b#FExLmc4)0v-{U?7OO5p74P|nyFj@XN z$ySV>cz@Tf6|7-CWKt-ycK_nOl%(X8*~@5L6!*A5mWPIkpOD6G!A?CB0(ERqc{Nx4 zkVYnkZp}?_y00_2EO?{eT)a`D0j%*8YD zIeC(0hsh#aIZS(v>L3c#abD4Eomr;0f5yv%K4Bh|qh}o5PMyh9j#Qy;^J8jR^Y2CF zQQp$9Zd}T09hlVKYYV6^U5&S>R%vb2pXK7+#6M}--#8@iW9>=hwItgjXG+9)a#OZX zpY?VF-ORj{_rTA6GDjR>{dlbDv}(aGY+DAjyENAPQfxTfn3TR7OS|wZ052#!ui^`D zpJi+SgJRNJ%D}yhwp?OGDl!AQbG5CPEPpt0dop2I5N(W^QZ7p3Kd2og%{nHFdRjH1 zg%Q4D*Vpz-aui7aa`TreN5$As`WI33>ePL#!fWROxin08yFsb=Ymy-E))6;Mgb80o zIHF#R#?NwJVSY&IK(H?h@QU}EKiox1zF<^-eeU~4ejjwcavS;8W5mHZiH?p;3~sx3 zey~=-7Xv4oMN7Jqg&gU)+C)oZ_(@$y&Y(!IaF`FibS@%JAHffT@xWJuYvPE_5yL%>z{85lAN zo89%td2)nll$UTtCjd-)ob>bS)Ek(5v1RP35{*P97dDwptOcrc4=;r(wZ1ksyiG~T z|By}X@go;58@B@t7h)Oy4uA$@p3k9 z(jXkz03UtpqA`ykKM&_@Yc0$0q{t8(IcGCIk0dz{bAIcYV*?fsZjBOoATbYD+3;Gh zZwEq2n4e4dX7qNrg&_z>R56bF1@(Oy#N{c){iES=?FVd@^>i)dr}^mFG2n+w3L3Kb zwDw%u5Lrg&AN&t}BNfAdWkd3#d{`w(th+4oh1pF7N(9eO_jF_cifw%30*d6}ZFLhs z^6_7!K;u){CnW?tig&*FkjzjC$}Pf#7fs?gV!T?i$=7IDv%V?(TYU zcXxMpclUz@x8SaUQ{MOXcJ95MPCISCX}_8NzyIvc?Cj3&^ZXt;ah9x6T5tJIKrW^h zB=!P;t^-x-jfNTe*0c#oI3QHLSIT(ptiQS&2MzPadozq7^3Abz%uDM`EXert(Lk$kZYfJ-+s6ktIP^=wdKZA{OYO%D9p+ ze}lp>C1g6qLz@nMG>B3Rgki3iIB<%&N%Xp@OI;|zOMdn>#e<8zRfzE4cTR)EQ#BNs z77U3lEQT0~UG#uL5Q7sDMnXIXhHC=@%u5QDVYproL>7O&imC z=XhV7$jld7S5B!=sa}Cb|8Cxs$flDREt-`nNye?=f=|OktPFL!$%gCl0Oh`_(zzqI&JP`%$m{TbSpM$FU#F@qsgCQnI=lT)J3)GUcto5 zGLY{NO#tBB#2j|Tn6B3w{xmIqmi4!=W6}ZDdH7V>w)1)FQnjaUXx5yzZHDPt-1_Z@ z&;-rF*Co+)UFjrKQ8#uQK0u+JsVGvC0_&^kjkc}28en~I`%?Gv{qwe|cMQ^0`6VV} zL*Vef?`5L!o@zqgORjDF*yztsVVK`-Kh%7otqi?!I{Nh&0$67k|63bj2lz=gNs1_$ zS04gkPptuLOi>+u32pjfNM?s@@j*fAN>$7k5FQTfmG&p25lgbgmasEi$|P{GBNn~d z>$2M)xnx^01VxF$mG4~bBZ=w7U|!VLu*-fR76XtPXVkFJQHhYgC)6hrWBu~iTqJQk1$#Pi9L`Ymy!^Cg=SWhhG-NR#Y*%QsX%xJ*DeSKN|BUL zmV&y6A|6gmZ!!(D(#}#|J?s9 zl6I3djho|yV_@g1LH#ObLw|;z$VssKlP1zOCkBhujoIy~)00}(AxslnbX__>>vqH- z33(uP{xurNkz6Zg+0jW31GqBNAP>pUHZ{Z}hC~?R1Oi+*@lJp_nCvQ^<6rA%U_ng< z&rWPv9Iearv^@^GcoA)4*HV3K8kT3H%^AOwP^3(AKlRKs-B6*_@I>w+t2E(S z|A=vdRe6F)gQQ=n;PT~`z*ew%C`^n2ByDo<(OmjC;zBF-#C15gC7#DE4C5)(Cvj5M zEE?zPhPE*{d?@PhdwjrCBzfzM*J4U@OJhW9%*&&k?o&CTMiQ^qj&w>@C@!NTcHgWU zf2wY@0VrMed*TgVqBPHJpKBO%vXeq;3LH-oTWcB;CT#+D7Sd|!$@ju<7iDJ&NV_dD z8j0zRty$3oi+OvoV9}-CC)Ab*Y)dakW*vv1`s@^VkzY|E|Yt|#G*RwM{bcP+np zZWL;*bm6N^c9+ML4bu%S<%^lBg?wbRY?lif3Nl@)iN;eJOehS*uWQHcn19S5c>49z zqOkHkMB-7`jos()TsG|P@#Y06L8lL zkDWWuIG;~F;J-29?rAukRR-8%xjZxZ9R+KDNAeQq**a!)JZs1K1jKn;96IVioi%Ii zo#~x%7y_&58a-@J*>D2Q^Y8<^kNJ%){V#13@dVi?uZt%*+em4XsvX%MJtllQhICqM zH#?WV>2#4SZE1woKYmn%Kz1;!yAE6g4}H20L4rroT}R1+f3my&6bmjD)H0QKo#YFi zc6XhQhdQ(G?hgu{Pj?Yp`5PR2pMxXi;S3Fz3NJw3c6++Vv3nOdkZUfX8=>wSNugWC z?pqC^yC2ia{5!2k&vK z7)r-c%NL2Ysu;;8G3%z?!lNGyDu0Nx%)qOsQp~28j$9QpH|@*(w1%M6=4jUGew!hY zc#L_xP^wlbF-V66Ia#XEZS=;nSfpR9F&>TTEW@@`Z~Q(j=tY2It=(XMRyBFjRHfJL z1wD`DnQXIOr<_VxnViBRP!tTed$)FPW7rHr`;jHPY_C6>f&>mL!1U`WE$|gvA;7ym zZcq5=z_i|0XE|DH^R-EypvlC&(ih%zc&Yy2w}B3+a++`})M5qKq2L=YuhD8t^;Z|h zOlF(k>y;XiD1o-Covmrb>d35T=bOR)VxP?wFSn-+t7#219|wDA;gpw))`pHTrta39 zK4k9gF1DD?F>Cyoj@un1q;5Fs?~2{$$U3$y_g@yQ1>lGhn8g6i*E51(rFdITjKMXg zUZ4hl^#HCFBv4rb>)}RT65nVcO!Bh>a$Q%4`-$=>Mk+<^5OVz9`S3J8Ca{Jym#|{6 zv!-EgoRZlQU7Dn{uMXQMN%R}7kA%O>XRiDm1ck^0_L3ptp9~!9@m4m*ifmUZl zp=g(DsYz8DW?&YTo+uU<e!G4gNl)t`5*PlDU>ruvO!kfv9qz(t@y*9_%8CYLL z$9XJp$IZBghL_Fs4-)}r@V7%x=QRr(B9{>tkif&56B_a3whwcb%XZ|$tLsj(qMq}i z8N^1}Z)woCPJzv50Q1#=W^qgbVUB|KLG3G8j7dEttEMpX_G zr`Q2Trif86DTm4%?qFo%iqj}4hp83pU{$7wGgvE!>+bE~bmB^UiBgU*qS(coOp#!Z zg0V_fQ8XSAD`4n1zid>KsMr4il8<-4!bR8CCvhR6(;0#teMgb0g{srWhxQx2B5frq^NT8ds9H($FEurF2L$fgW^>&pzk^0G6SAg{VnzL0qu+iO}AQyovL>*9eSAi^7t^-B{ zH@%(50T^<>Uzlq&9W;u1dX?)L94>ZyJ5>h_mg_^OYxWU4`#R}X{MtTT?p5Hdim5y` zV3A#EHNLM)yR$G6Y1f)2ORCR9IWvLv(4LD*sx57-Fw=ioSw>W>E3>jPGfH1uT)l5> z>$HOH9mT~ii*2!BIJb*T|Gvkh(K=~#?vP2Kd!(Szwpe)XRGF@OYOT@!d;i>}lR)n> zN~2?+^1^MBZ=jrNhyzJG3_BupvSTp_S=iTx7NQcaY$}2X+i%QXZw8sPLgns(+)?=g zJ-1$HG<#Hj)%X!)Y{3hq#LgoZ29aiLTPvjW;~yM=5E%5)Kq-BnnJ$ARJ%3?@;|?*EZ&vNA_8hg)U*BAj;}qC2pQ^5`%iLDL!`Gp33N?f8i|PuUWxKi|4a8bl!_ zLi^?Gu_(J=pf;{KCVYt4j6@PlQNmEEDu+Yr?7AvPx}&*SR#|!>{vmy})|8wVTjrss zi2#_V%JOWoMJVzQM$0G0kY@ zn4bRo#JRa`+w07ExP9#+sk!q+{=&BSW#gInq2q<<(i6#Z6N==q7b)r@@Fjf{9@2cV zu(yYuCAOlzq+g%27#3*R$0MK|HFVlk3}Q+F!vtN<*31B{`vGbmrojJ&gys&Yuk1)Ea-?y(q$PXyd7*&GVf|NJ@KbEgPlu& z`Z2UNyNJ4I)L26fIV%&Xb>EZdl-ge<@&QXsb5d<>eOSLLbgy%CMivYfI}DCm44x|t z0TxUVJ52FfOzA63c@`{XJ1n(WYBGSMuOSl5R##bG7tBwLAt;i)SYe(EVOSt=vzSa`|jwK!hlDx)}oUxF+06#w{lUx8% z!2@O`6Y5)gRIHTH324yv{+}Zz(Gq_V-tSQ%UVTQL)ohdFz@qcWhOd*YO|KSz*u27U_ETmRwrCB1=><=cGTretk98&cP#J6?vrU3L z;uss<1{>Xu1DpRD_OLm+P~PW%IJ~T%AwUtFTVWzq5rk`Ea&{3EOi?^XQGx|gk_J&8 zRZ-^KuUrdXzb1%^tA3Sl_zIC`7iYs1*Ju#a!u+b=KnzrY%8F2K_>5Ta^C4zSi?fc1 zko7o?oLdqaipu`8bsySV?+O$Yg1-$mFz+7lnIlhF3h2vSEkTicDrp9whGC&kSD~+F zmFrxf8^)whRFRu*kej`w?QW1CWtZPhkl$2Qm`qRrW6CYEEAC<{J}k(eBq*M#Dt>HK zJj7H&Sya4OkSDkOKnt?MrhtR=Gp(Si#QK^pe`0)6f$Ex&&-={noUof#MW4^Y&8}Y| zLCSGm#Kh&~r8M(VtDapSi^IT)?T4DWRie5H2fHGMhK-tr2AhWDjfMw@rbVJg<@|}@{1c_=C-D9!7NN4C6dNFGpRvZWO1{vQS3cT2tVh4 zz}zVzVJR0cnIqgO);cS-CYd)jnfKmX400;>Cs_{Pn~!5#O>fH zX|iZuve;g--b|o}Yz9|s(KV_{@;G5a-`6cYWB=YG7r3b`fBv+RHEfePg-gJtr9)3o z2DT|*bYak_;B;~N4DV2jWdmbkj{#>-s)4}R?10DQRJo(23)Th)JN^MVeUz=R)Nqi* zaVhR=Y1crAd`qD6W1t#$kd|wZ?lMS^#meyCO0cdVw-%7sBgl_CSsL`*(L%yLKmX9@N(a+}+V$u<0pRNnWIcqb)X z?R^omCHnO-8k#5OUnE$Rred7yo^OV!!9IRT|02QKw8kd? zO2!LF>0C}p{g7I!nd-+Ald1&;$!bj%x>tH(>SO9fTCh0U%cZ?=Z)re>sSrq{Z~t?{rNJY}7@WhO5tLBEr*ZvS3_ZObKk z&K=ZDApKVf_P1spi+es#+dmlCZ!4rC|Fs0$mdBAM%)tZVNMoVHlQ(n^{^1s?dvmG| zA4Q)^>+hboNP$k-T2zT!`a?T7F)bo}HMFv-zyUwB_&N9oFyoth+3X%xHa@6Pn>#Ko z0^|-Fb}uDqD{pV9SmgaS<{nnQ8e+iBQiPvV=~`)(R(Yje3^7Rq)oKS@^;UeuEB(U@ zdg0A`c#c472c5Z3B$1VoLub8$M@SHdOHzint2xX5}+P1{ZcM0|-IoG2Nr1PO-Em#AuJ$kL=8$lZ+ zEqXL3+9)=judS_lIX#^q9EY#{pAu}$8dMa=OCFf7%cs5T%A@;?Ad!eKs#B{wIyI~Q zrR(YCzm{Mh$-eiz@5uiL3HFMh2_pVIWL76kk-u@RZQvgg?0T?toCF$QAxcK}w~l-y zk76VK1P-m?AODnKgFHt<|E&buF`D^zG?#y@@Lwd@j9Yw zJN}&nJB|0R671ipEB@*KAqm!Nj<)mvTM2fxv~#uc^}Wr%_74fRbFK4rtyf@u&})6P zbA9slpAxLs@0HGfC&8Y*Ze0DhC0H!)ZM^^E60G3pu*d0k$EgnfS-Ixf zZ}?v!WKmMTLaDMseudFhjrVh|jV4adOh~(S|F^J+lA2Em)e1kWP5k-|YjFlh` zHH?#C8a0ep5JWIaP*IRJN>tYiHA>R99yLnV^F}aE`4uH?oNAmEYMf?XHENu0-GyM1 zVLv5plIgq=YLexCK5CNf{f1zg%DD zJ!V#%<&9`wk{2aoURsnDW?oiSHD+F3)rDwLQ8y)HQQ5Q+W>M94K4wwf^@eC!(}yZ+ zSvy1=Zdo_RG;UcxC5U9zFsC4E)wrY=Zq>AEJr1#I-tb1UZrO>FwQfDg3b$@Mt{S&) zKkq`a>A0SfwduUy2)F5aJ|DN~etSc*?fHNvXWRRUB*L~2k$J+lA5{q1ZU9|T&TbI< zM}*xFzRiT)FtHD^{RmmKoc$*i8 zaYhua5(7_+B+_wChI!I)UO@=OX+cF%-f2<&N2Jq|w#}pySkDK=dHGkgyz`22cBJ#F zdG)08nsqmd%ewuvyvuLr%}AFG_lrrFO>YQ_>y|&7g6noLNtEkO81t0tZj=zJ+g_Za zg4=%5k0`f;G@B{6!z>?E_oKXM1@}Ki*-;SpG!^U(`J;%dE3R5 z$3+)8{oq9(nxf~`5J|M>^%(QC=gpK5n%C`|qN3N`(vN7b`&FB1uZImEH1EfqXhrX* zgY0PU=i};W@0as#G@rlM(~3T?_nXl^Z_gLgK9DyES`QSWtuG8i4m4Uw4-B2HAF^f6 zM-up6co|!N%!<#8r~19f=C%QZr#Wy!@O^+V+dvA2Tm;3CKFl)PAO=g)xTdW>+%el= z_KI8-n~;9OV_OjaX)c-%{J>{KyAUykUypD40~B<2p>mda7}@ZHG%|K!sug)y)ggln z=62!VPxElP;fKD2*+m#K>@2K^9eTLhq=e>q8uyoi7rBh`H$_QJx}vV zAn+r?i1smo4DY)pp(A2+_OTI`1>__Mqf#>VaS0U#l+2-{a_08&8K(u*LI`6@VfG0H z4286cp<}9L_K6jih4eoV#x=+6lNu@t8ErzxzaQHtcbpb7`yfpGM07|QU?^gV4xKQh zb4Z=AEMm(>m^77fNL#2V;;0Utv@~}}Uq3D4>PDEd4RgrYV<_gC4xMr=bI3fkEauxp zn06g=$hxg47PttV_B?jT{(D+11VNa2{|=r5!&oAM7B&+|=a`FZRq~YtaW+K8F%Pq{ zM4UNnHp1L7pYW_iQV4M_Cd|>dfP%49S}|-cq0F(6!KzgD2jYCnm}3!pWvRSP*nGyZ zV=@0(siF_!LJp!+i5O#>}}2#I1> z$J5QxeEE;*uFjW-%iZy8#qO@xm&cov&FSuL2n6aA&6Y0=w&|81JXOh-KQiahRscYP zW;+m5-E=z$*SKUmn9%uX8}vDtW+#Lq$#f@_rl@2mjA5mJC;ZD0&29wylId+OPu&FkH=N%iafy357u!xo77?Qt*J=I!aI zxccq+^qp3Dxg7q#4y7I$WODyMgHn%cuU;p$O#Dxw)LY2K|6P_E!@nz$k}p$99$P5ly(?9UEK@C(SuE4OE7P1TQ*Rzy zta86A|A|trIV`jE{==%mRK8pr{J(@!?^=E|<{Dp_a=)+7L8&yAlwF-myKg9wuQb;f zUtMauZ>)*@UqGp4Sw7o6v~QtQyAI24T&F#B9LZO^gU2`S+a5YEBda|RWjCK!AG#hV ztGyq_H{YHgx}i{OeBtD_J`gQS z_J2mL4Uv@FK~H}ipi!s|)0o)7Zhsv75>*>vBDagb_Bg~nRU73pu}l2&I4q1>7Xx~a zaS}X@NGa6CB~R>8@jZ@#^hjsHZgPZ^dw=rn7ZFjc5e zv$_uFXn%rC+D17neitL;9ZwbH=&a9rm^c&!F(Y`RHsrv`n?7f@&V(p93a?ch4X?J& z#zZwxlQ8~~(RrRrnQAEFnlzi+!;8;8ZzyTCOi^a$giaT0ES>yzEZ5||STl58{;?)h zW~yze7BxDPmT^?~@ELp$%dWMW3qWX5S~ehc7L7nTHRgL+nTcv@D3(7n*Lhi8o@#1p zo;=fdYFpbvZEhKsKex{h1|NK)&u7CkPpIJgeHqo7fqH?oUfOy2fY;W{qf zdXEPp(mMJT`8sjjn2t%~xWeFVE(y+ei%yZE%}U`W>*epEFq(UZE0bdkdgqapV%uEu z)NK*p>mQ})wuNGayE2{EW6kNdrRJ%-Dv#HbpJ?sN!wUCx>941zitVf5sr#n(*E8Gb z_Vq)BhqkrMZo+Dnjf<&=t`~u(j{B;F4`x5}|1N$V`m=v_s0=c$R}%j(+Oeam#`xy$s+ z#>?A74_enHNb&Cu0pxK+vFkc{`tJcB$X_&^;ie;ygc1?-#q<#?g4q(LhFV+ z4*MuC$3y-eDRw`Dr{C`LFSpL4yZ;_4LY~(kZ;#X6Zx7Rux0m<#09@Y>+`cfHzMouu z;ZuAOTYQn1eNi8M0l0qX+Jd)9A zUHuuB{h1#9zu*S2atE-RQXRk%yA|1SJ>v3m1Ne?ed0erCxPc-^Kygi5F&cN75`g3p z-d9tC+Zpt`ORR6E0Occq1}@ZT4M1xIpmv0LcNqkyjD#5*q%(s4E9CRtOwb3B;E%n* z>ZSlQ8h}Fz!09L$p+4BA1q7=M!rTVIK!beAf;FT<*!@5-ejymjpgY@OPDpPE9CWB7 zZYYj2lD`zt1U|&d6g{p4-`h3F6*t(C8{{GtY6Tyb69P~x3E}SzgWd`YHO~V=OLc?8w%_X=$M#AlJp}I{$)T}|ann5EifFGI>q&MMxDL|)`p!WrdX3a?{YYCZJ3~w6-e%MmmNS7=`8+)8ZOMn;WC4NrH?AGG~d!V2w?p0ga9TutNdH zBOnCQ7!=YtDv`L4SCPEiXo$ctLj5>GvM|`~5VF=tq+Cnr97`HVC^P4u5LT@qCcL;m zvGMV-u^-;w=efhNMdJB$L0H>iQmFuiKj=p#madNpe_XLROL2o*f|f_(9cd!uv|>KZ z#(v37aOp$byt2__MMPpjjDuo-HI9)ChM{kwWMO_MD|B5g>6%}W6Q1fVD$*#s59 zQ5ta8V<`-P0=XsXa;IQi#b55|YAXSPMuYm}5($7Q#D8L>Sc1Y!Q`z(rGnOOiNK^f4 zQ~Y`2U~|(3xT9#c(@f)n!k>~d%mB(WSeAI`C1zNL2q`w#=|JUF@zO6v)PTN~^j|AP zHd+9mP(0I6Kr0V0FBRB~09*{sfXNN*8^s!v24K6z&_bY7ky$?Zky_4616otFSlj^q zAi%{FO{5uMxD@a^6=O3MU?`o1uOI#Q38ZV9#SHCG>k5oY$rOmqu7dV~7Dg4n%05O< zHhshatbPuW%K6ZngX@=5_XsFhdDkydNqB(+q3DF>802l3h|gHBL*e*im}+JisBNUD zJODNmbdEOs_7wnb8gSZ-igP6>tr+7Dff)_Xfu0wDj!1+JCWu=pVD^K8j>(URgTV&p zL(gQ8U*(yw6cDo}V%Fx9k>&_rMM{TdV*s;>!hj)~1@FHLFtvbbP$YN4mUU*BD!j~` zrG?bemgeq2RdXU5tyCWE+<Rte(6@RE3g`pN)6+ho|-uyjrIt>qXv=oyMk&Btv$V^{&-G~y)E_~jIvI$$2@)qna!B~#(KLQ@yi<6J9ekkvIDzY9 zDNJq^3IUXDdV;S%l!G~jrUk%-55TE|ZQa&r6pjvWRxgy=Bsc~PmTj0*&eY!0b@N~i zD9`*zn_Rt0d?S;KArf;>69T3~hkvSaRxUSK0S0^E@8Ch{Sd`f!($5?d`?oX&!nE&` zwxc?;*T4tpTeyY0t(LI<)KM=m341u$S#dJM?y1yhIh%6%85r*oAE1@!QBDNl${pVpGFI2@Y} zXz`2b#B|)%r04w!VUbWnj9TtD&k#i%4KL&y=5=fv|C9J37G~t2&^1Fu zI-^TX7HFhZ=K7c&60nT0n1ClD?fbZx-B{>fV9Ug43IAvpa@_t=Ds}I8KVj++ z@@VV&cqI+yzyx3txi~swf(SS+bT#ol>)w+wIW|$<+c9bAfw6>~0A`qI`95L@J=XVk zyt!hsf`3X2n3$S2)xl~2&lxt`;8mG4+y75cf)c2RO=7@a}LID4o+kaNIENv zi_TCvhfX?A4bgWc_zgts1aM`}@V>qu@xJ30;IQo`B0od#wIFc@V2=dIGA>AG0`S2L zaOe(0y9#kKw&H3_fDXJ6_(~Jkko4qhh>hgWYH)S%TjkvN*7?4 z3FIPL($QT|s$2xbF8$mFd%n)WTFo&{VyIfp{OANjI+ooS!C!!j4!;+Pua@Za7v0ps zmbLTb%HRY6a3%^SsM9M~Ksf*Gt84`3&(rDma2Gq}LK;FZi7tQ#XAOBafFFA8eS1+c za_vL!8uZrMk;K}^?X>|fK;Q4R{>=4}&gGYm_3p~`>9h60O2B+3VDW4X!LM*Qa$Xi5 zN)yt70Y>?~HVN21TL;*IKSGbdu=mq!J&l_Q%pNlI z9XDP5M(o{aVm~mR7=8O#MtM(!rCDFuVkwF!JG1E$bf(&O)_uK&lzU#?yEue8@5OSq zX}1~~dG0uue^j)wEeJ%oJje0_H)dj*zFBdSUcl5kcywI=a+B(q00~8BXxnEbSNTIl z=6dD>r^F{LvzOSUS0|C1zk08J#$I74S5kBbKt%%(qbpEIuc5cD>0({!A<^hxe74fg z0pxHsZ34J#iZ~=4?i|@?Pz1MJ&{r~N=n^&~$clho)Kx~mE2Qc9kIE@iZx?(K=mOn` zpfx(gskxa)Q zp#NyKHdbVwet>>3>|Bwk+7{^jBNz36A+iiY!$+dNimn2Cbpj6_l5ON2hm035@RFsc zw>eE#oPJ>V>MkOQ%pXiGWLE)Fr%Wj}0hE5vI?7-W)r(j6vz_-t^X8FB=L>V}^N&~; za#`D+Y0S>S59VcZY%uVW_rSlw_phDCM)nQdNxltgGS#R9KHq48e>sOG)V%!JN3%Avprd)UQv#y@K>Fv=L}@6I z@yAfclgV1s{POi(FW5|2Hn{tT%ki?=l7iB6Vh;`;NM;^q6Ir}X_6t{`R-v0sr12b zs_nvuuA2lVAsMe;Z$Cc{Tqu$*&3V`e{dLWs&bg3dy)1wwxjv(X`dILV?e~zyG$#s6 zg)Ld7)Uz#hIXq%*u8+j&7jdkQP-fydrRIm?c+?4YMW4Q=eF`^XO>&Xx@j1Qtf zXKPf+tCgZOim;WYhL*jSrY$bG9>p%tKp0F+8$i#0dY|$bzuB0Z%N_W#t0FoSh*>hh z>LT;4g3Bf?zMrWyg3XuzVy|9N2m-^dBmzg-p!5~U>j23k4{f_rl0>V!P?n}HY*3NK z3cpp6cQZHprYHo|p=Hj!!@t zqu_7dua=|f6L&6(v00wjo0dV}lp`?wVTqb{q8wX&>Qs7>N*Cu^W@5dE=q69xCC=%y z9oxWY+nt<1RGz^KrP`u9eVdhb#BFEuW~jnV@|@*Is>i}Ly&!N70(mCV2qWCw*sv*S z7?)8|z=N@?2!9*rGAGh}V%I7HHn5$MGHcI(H48^SL zXc9(To=zBuO=>-bz})_z`!nMBo*%v-&A?*@>K5c{evl|GIc9pW>QUggwA9=%1ku^; zXrv@|%LXvEj8*Eo@k?j^u3)M)9vF*GIfys$p|~ERd(@kK$rNgn2;YpvIsmP+dY+42 zJ#vx_bAfgZg(4(vqVQuOgKmQMc|C`}cpq#xuUM>Ov!G$p=>%rU`|AYSO6t5Pri}c3 zpJfm3blLQQ6Lj4!P4Ik-ufej|iox=q>d3ZHxp&(aD*y9z=+VUUvfoGz&iRAkc=FPT zkJY`BIpV{qhZ_I;3(raS#)i!_r`B!vxdZ>P!&T0DAInyi*t*jC(Q&>i|He(wTNOj%>*$A z>LVL*f5lFaEmM|EoXN_;;95`xK-y9X1(G=)*YAd~s`yqBK420bx6v-{|71{&E} zLNx|{VK=sjGwn!(Np@`Ev~#yZ7+Jh|{(gStRO!VmyrNe%#E&b27jk?Z4Krv+C%9^n z6uh5}_JJ|{49g=Wiai$t5;G*jYL$}UoQsVPG^C(R?dLIPtm#* z`lmH78ge{J^}y6z-Xht!)>sqg5?4A%8I_1sth|a{Jw?ZjG4mjgf_>6_Mvq4->DPz8 zxml&;!$1@MeI7;JYt)F&a4G?(ItAsGZ`px6M2qYR2b~T;YTQXLFevbwlOAq1qy@ zLE01SRqj+;v7E~9CBh4w&B+p!nQ9)f<_sq2NcUn6B+q6i+*HJAeX6ALk(2|UL{-}} z>H;Wv&A&dn6?-NHmILtU8F{W3IlL*$KAKVMFQ?3tHQAHO7Fy`twe`u%IaI6mp2&U( zkIM<0QqnrX_(jXQ+`{6_06q$JSN_}Ey?)N!C1k>i--i>ex4X##0NKcXptiu&fcVGD+`ZmRtf<$6{#*?A+8)#yD( zcbQWA%%F|;okjc7PDsQ$2B`~zLG6Uy?Q49@tMA1s6L<2kqwXQ<{J z*Yo{`c~Bxa2M3~j*on_bjL}CC4jM+#r~9ozO)+H~VZ^^%Rpe^ltxs#8yswX+4>Q=t zSY}k^Kt-I~kh~#4Z14yfWCnIqK}DU_#+m1D(P*rU{W2)5fY;>oAYGJ#MT-5Vz;nPv z{;foj7#T~~(>S66k8;(F)w7^o4NoOiMc(;FGtKaqA5C(WdH78ttbi%@*Mb?Zuc0ca zk?4GApN6U}Ze5~M!HO?&?_igl?omFHoc3Hanxl6i8Nupm9iCV2OiuCi1%JdJLf z0{y3mVTZW^)vD~TCg1)>-HxO?{X!KOZPwtt5NIt6CBhRvt7r|}Xtdark$*ld; zl-5>%L3ZCYk$Lp2TgNAtmO+8@rNXrJLkX9*#m;kN^3>lK!7d&90ygg8wT*`%m#(|c z3lEp{O~@zL9#}zJh|H(iO?#u?y$D^l!CdRxXdu@CNdQuF#gGstbiNYEh-%>R>~>t~hK6rsX}#$oz%tBik_LmrNo z>wXZ|oXs5KQ&`#`36T3j;S_IWN;>(QBkol5n#s5=)$|97&pOhqv;G2#=8VnH3yWRO zP17}p%;rvO`+_cQ;NMI#%>)}~8_b;-zb|~?JUbehN}FZbFO8y0jOV;vhqyMbqCuW} zltOM}8XMQpuDAOf-ELDZ8#mc-UPt0W?qL?stfZijKhoXqOKb-x?p^}EI-9b>(;N5A z!(QhP=}(eZ5WRlr)iM)ZK06YvBu^zc-Z^CvD@q1 zW%Fed&gZd{(fc}i^Y7u0t*zN^@B8M>*9(x(-+dvUXYl6R!?4fWUANEM!zKg**8_#w z15MHMfxYLWSPzV953FI&Cr9BZrB1kn9t20yyZj!cfga?A9+bTv)Y~33m|g&8@9fu3 zAiKx~PcNowFP331wqq|&U@vY$FJ3_}enT(8Kri7!FVS8v@ojHFSSJZ)A1Os28G9eO zSRaLIAEjX*m17@uU>{9FA8kP&T|*!JKp(?GALCvh(`_F!O#c_mein*;R`z~2v3_>d zeh$Na2&ZE|S71MPLO)MIKW{@n-#|bALchRXzu;}Z5X^uu=70#rfGGRGSFr&x)d6wC z0SU(e$-n`rgaPS-0hxvY*?|GMg#r1!0fpNEMVLV)%t2*}K^6AFZ(@V0s)K5VgX)fh z8iDW0%t5V!LG6Y?oq@sc3xm3QgL=1vKVXJ_Vh-t34ESy7`A60b`TqOR2_CQ9Cmgbb_pDIO&E47 z7jD$6e zK*9$`A{Is>_eP>_N1|ayV=zZ!DMsViN8`mt6I4eN4M&q4N0S3bQxZl~3r5o#M$-qR zT?yMV_C~XAN3&tZaxlkoDaP{H$MVI-3RK4m{|X=(jui)vl_ZRn7L1iO$ashMlvlJ@ zER0p%j#a~q*I~G$)L=7L2zgjI}h3cPxx|?u~cd zj(5XM^k7c(QcUzMbTm;=7qd?c8cqy3${Bs{7*3c-`QA0!FcB9qF}^S{xi>LIF$4=_ zp2nPv5<}`BoSYY%Tu`0F-IJMoWZ~7BTuzu=DVSVsm|Po}Twj>{y*IgWJGlun1=+%! z+NPM=VV~L+o7z*I+Ba;TGn_gMoH|OF`cp7<+%R=AFts^0bygrTus3x9Gku9UeMK>S z%|3l2HvQh^U}0~%bDVw%oPJE0eyaF72*Y)8EB;b2-5C+Pv_1_%mU@Mmfo`Puz%ipT zF#S<&1~w9L-f$-OavH9)rzL&{v2g}za0Yo%X>USq9$^v%b{2p&3v5J!qnyPMpT$(0 z#WI@3cACWrn#E0=#ly;hDV!x3oF!bGCEA}QzMCb1o%@V6M@l(I#xX}OK1ZQ8M`<)i zQTX&*?PJ z6*SMCIL}i!&)Yc9H#pC~I4`h2FL*aE1iK)NwID*dAj+}uReV8AZ9&{UqTb!&57?!jSWEhpOTRdl48)fV)s~EmmW-X2OoEn76PL^im&_ZN zEC!b>-vjmgOV)QwHn3n@EU+CV*q#IIAP#m^13MXkot?lgL15QJuv;P6y%Fp&2=-hA zd+me0@4!B=%f494ew54p9LxV0`BYmDGFlFHS_TCzha@hC7B2IJH7`(-Cp?RUo~)!i_3r=UJ;%hQ@6 z%JS3NF^-edx+!tGv-+QEmS+u%!1A+y_%y{;Pybau4N+Ff^};vs>%&1c`0eHX;`b&O zDF*;6*$s(*=>sR51Bo-#4a0Nkix!asMJ4$ILF>{FcPs~nbLa<(`=viIQZAf?WDiE# zWdOBoE`s_{4|eNiAag`6lBr}b{_DZnzWAu|0+aMHV-3t zsE?B8DpWBd535+RpH}NCOk*q$yXl|#G}EqNu6+E3p#hH8tKaYP=YKem9OPNPigF#x zC%hjT6exnH@IopehLsu;!M~3A{h%i)&hU^p&vk4}L;*RK)UdSHbzI6=0VU_~u)OvbY1qLAKH>i=Utjj8l(+JA#jL!Wh=yEwpeR}&Li zL1sy^G@^A^n=*dNjE9IfVex05rkuxJbfCWA4?Yc@lF>C^NMM6EsDHFYCb*#^t3 zZsXrK56M;8Cy%b~^W3*gMOHZ$%d8!1-M21|S2;J0uARI8dwm+_`x)y0WS^!k-b(?J zwKiZCm$a^LNZ{}EX;{-A|LD^!jO}y$$)~ByIFLQyS$Ujro%oYa^ZYpJ^GBcNP=w&= zw@*`_hckXC&inKSpQeCH?yr2BBYBUf*&LLH5(&9urSzwtCGrhr>f^_1ZBKKcsD=tt zxf89Gr}^fIhANlw6W!;hg>IBaP_W#oA;I(FkbGlp^7vo-G+^SE|Hr4X@p%5Y;p7>%#cCbKCP@e46L=hl!@n`|%5}XI^))m!@u5`Aa{7mrXc@<{q4h%OKvDEwt$7 zJ}UXEFzuIZ+{xwv&WWoikCz={K_cQm_%!J+yVSS}EhDg3$zvhJRf%2KgqZJCWtgp-Gq=N z{VHt_r~vZZ_YlONF)+G+Rsv&xUv7j(D**VY>CaW@h=wu%^bwmaYAPThe7;`rpcNlG zRqMUb>9>{c7a;6=$1PSP;a} zm2rNRd4I2b+cD=)2wB=MWZ|ph|MN5PWZ=1d_%qp_(tT@Is0|=Z8|}=HGvE{#&ZX;F z_>8rQa8iuPJ>7EMUn9Al@0zh;@k_Mb?>AL`<$QD9qU$-F7r_XR^mEVWUH3J+?|v!V zG>nhYd!#h(f^Xc!_94~}h#=|7r)4%`*U9<<$mziqAPJmpTSN0e>wypg_~Z2$V6w%u z{UU}AT-nmcNiG`*`*GzWjt+pycO~XS@rknb6guNbMj{h97txa4g>hFMhE27Khrc!Q z7Q^`gfm`ERy!r#RD|z&TEC8UA0k~(z8za-MNSpfr?Mn;*kHdRjc%W9S-^}~B9O1EM zh!t(XoVZNl?VhKi8tqmf;ZKqAvga8U9g6*ig=0(h|3X->7U^jCkHNz81^~7BUxx+p zqkHl&veE6xA6zo*jDLa!)RrNMKf?m}H!P@6Tqpe%EUdijb4|8PxJ>+6zHOZfmcPv- zc>TYYZ(q+{C)?KV{~+JKUihH4Z^9}(^bovVhA6ae<4pb&`BwYwI%TqbpL6nY!sG2G z2eso+Lg8s9{q43yq2u_d|7x!7?HA}jAm8>Dgv|dF`Bv;MW zAl+Zfx01N&%>P8b?QqltW1#(G4D}Say)kshPHTxXA@{owa5+tC}EEh?5F6@b7%ZqKypy<%03m*pL z&x4eQ1`d|&BmL_!%oj?q>%TdMfvcg8yNWQA{ikD?MM9b>bb9CZKaF9YuA+VZt}zS^ zKAZjD8pDvm^l2_*&^5IG8(Gtsed!pG=O%S3qKLg%YTQEWCT(%7h@)wE+{XPT{V!Ql zQWjq^&%*G8bL&m!WkfOGfz+h?@=ewQxgHN{EqK!N$${qNxmXBRddd&~HV00wL2HHPb-$STSKljFZQYnngC zc?VIU2P?DKgMSAKNsQOW9R1@M=E0ECSfXXo>vvd^GF}0!rU<-GWr2W;Jq6Oy{C=&P z7~<}sU+@imYB~wSUkNm5p?;#J0)}*MY+x{9G`B<>-B*k6d_AM~r(0FTXll;pW3=~u zj_zl4X`cL4XrJ#fe5BMA*WO`cUswKhf4i|QweQU3$KRPXQCC9yOsYgf{4r~~JVU71 zWPxw~fp&+)Px?D+S~>ZFz5m{ysLtSall@Ow(-KCOGWvA_83OH8P-#&Hn!n(fIXdJQsAFwP5-_z%-FakIV@|J@b$KekT)leSJdLA3u_Tc-$XtAAA7|5aP3 z|8W&JSGA4ZRd}NzJno?60BhPGaEI(ME@yzlP%*+L!U$oD`Y&52E-nuwQ3OvU@^`+( zLn7kL5J9rLP)#{Q;@6YW@DM&^|HrKp*{^Wbe{<_35eHxnmKrm}j~BI4F=34!{=0A| z<52dW;7;Yth}$1dRNS&NHMwX`bDzonZQM~|#C$I#t?+jbk}POXO8?D@JCRK` za7eoA-(PX-AkZ1&{0Vn{Z=H;(Wd6K$ssM79e-O35tK-9``(wo|9f4K!_YRW&bGA-! ze)(osf2p{?HEjF|cR+p=Dx1)Mskn(hHTU3p4F|IQx#BKDCP!r5MoUj2mtDII{m-ko z#kU0qUcy<@Q^!m>98zarqCXWcfyYgQ>e7~0fjpyl<5ryxnKxDk0ymG7--_yTe#x2% z!s1WaaX99o^P7tAJWj>vIu;P{A4$kO%_I!e7qX2X$$7X>Cc-oniLIF{dACkQaWs^D z`DmdQy*yVK^sDs!M@y|qp1E4xhDxW%lRs44ohZ)L!5@!>5!>bly_{+-<*ZCN)0c+i z8)_iVfck>Z^V1V|CD8oV)}L3F*1a4XlEghn~G)AQKa6@T~vZ*%E)&%1>b+?-25XdBA3x_!Iu)I{fX z6=k}*^8wsE^jY5C&8U614lDrI{dW(N^jZYt{#bGE%MdyI%>HK;_xF97?BB-U|E{>F z`m6p}al^a)x#Ip?xbufW5}OzCQ)COjyTD_&y1=-yY1_`Y=i_*G%gra)?;B#1t~1JO zxAqeJld2nz^Y3(SR-M03NilhpFLWM*Cfg52k)OvmjPAR?y`0TenSy3p?t%0C>6()- zo4j3@%0!*piQwyvy45F}FT?A@a?_Xx0NE_hbHfRac^8MyK`7y(g$zkWIudZzZMu90%~8Ic^DsZ=pIokL~4Lf zffDwE-y_hQEX0c_#2RhUnzY34O2VS29vas)plshC&(%jU#8wKPiH8ATEl_w!Cw3wVJWJz5gk7ZPIS91V_%zHE+WJP4124WBr) z?==hY3yDd&kJym>4%Uxc4+(v1b^ve#5mRHBl4Iw%qD(1cu7)B%l*VpQI}n-!u}Wj$ z;7z}n#_$$LJT-^h5ldw?L}`KtCEt-iWWa@{D@OnREZ~WyAY)w!j)K{wVrcQAfRu5U zA<8XtK!l8c;QmqiSLFZB&pD(gxsi(B4r=l3`!%79>a)BopoEBcxcf0TAXM! zBY!^!T0R6^b9FK%1|Z{lbZSJ?;l-#Neba`IPEHQfzKj=7j^Y}Q>njQMl}dWW{f=fH zn~fWewiF%lkmAFgQmL52KogZD|DQS)b4r%^fyq+$)IzLvW7oTAh4u)5N%ejomrt@D6S*Sr`^Mjsw|G!`8Rl83$a3 z%}beJpImdwJg>zZo_j>4m^?^`Jh9}QWjFvVf`c}57Bq<|G%a9g*x{NR$R?frJM*#J z&qZ%duTKT?Kc$HtMROk};-!U*;N_&bW|FvNDQTjrNSk6>qzfVx!f6#yXrbwhSo2x{ z$)8XqEYNTsQIAUt1@MbHj|w$t0azpUv+#K)?hc3+XvRr-+(UV)2WejTF)--)=D<9s z1r#uMfvHx$F?c!awWS2=3oz!l!Ou}tU6QGcP-HqFE*X~3C!HVb?&x+@6z5VXXI_RM zT4v;2Od^f;>gL2qYnK1}?>}}*vH)5U7q2?!bGv6pEf+{Gq&b8}!%SxaVgRYqWnNHa zqAkhunrHzCj?}Ht-w_-_ma|5Ofk~|u0?V0dt%avjXfvf{{~AW248x0r*RCio0fN?8n01f-8-fd#Np2<^=R1V@(-Ndl^pGK~vJ z+v9M%^O02A1PN)m!9Gh^0c&tA5fiCof4b!Zy4?sp@*x2UA>=i0YBk6n{)b2QK2R04 zPqjth$Li_OT9!fa3EWz4k2>|Hn*EXL4>H9@Ny(6#APQ|ap3-{8g?e(!TCR{9oFjL( zQD8|TNWi5bchDg^q~1L=zLHqV7!V4eH7gmcW8(zn1=q{3*xL{^0G(^!$z;k})}dMg z?GWn&)9M8m(&%{|bv%HYybhI$jUl7y@Bnx8@F>xfv^O5N;5PVBUNiyT+UMok=#_MQ z?$}W6#-veu4_*+%L9JAHZOCCQj!f;zQ$*IUnlDtcN`MegIwx>Wqd8@5eR`89Rec6s zL$ORL!$I4d#rJ#y0Qk})Ub_X7VsF2ukr*1PyvbF&mK$6g zuPp=`Z%*WF-8^ZzM{Knk?HZ#4;J1PN z=9{x6njm8%LvC9PN4s;Mook-!svZ$#IJ>A<5YYMB>__uAJb+Kn5gMG$W=);i5*=2J zj#9QA!%aPKJ^-%Nu8$GPUZb6mHSo-I(Ev~vBSFdXaTk2I&kk?onPu;4d9nzsyH9u+ z96g{j2PEbJq@sg{5X!`BZ+m`5Z4GY)CiTZ~b}Q&aqO7(X!GH=j5g?iSui+Xv39=;b ze-xwwr79fmPI?P)y7sVL3W%kU-~cC@K-AV|W9&h*JH#_)8{?e8V7_7_aJYZyn0bJw zY048KAEGH6oRv{{g>g`u+t`pNpK0WWp}Qwk@AgtDZD95)upQ5ot;7b>cX$t>pp$ao z6ni+Heq^u=IH_$K;Avh0J!;A^0#qBdQ~O<=S+$)GhpY~pH4b~M4t^6K`<|X3r!!)N z4VASFY^kW~Xf>_p>rIv&>Ef~`oDy zK8*bwGsCu?!mW(D`Y_dSH=fGZTL+w3JRK+KnCV}fe8>QHi~*U!a#Nl_M5&zgZs(zl ziXn!`NzmQ21FiTB{a7B%bSKB`&EiZ`_)Kf#(72VU^s9}x)%PyqA#(nq6?#h_l{kCn zA+NCDwgE|EEg zP_S}%_;l>*ak4w|yNle?8`oOD=V07xkRzOTpqyoE=Gq>(72X{<7&sp+k{TN5Q3^88 zII3LN(q3?3a=%WahWN(2r_!qY7?NQA%-FA39ZTvRrEeMMDX$SH^cu<*cO zFPD8VFDY^AXMkM@zzV6%+3d=I8hXf-+SHUHhLBPOT|{ntsPKm;%y*M2;Vf&={!kYX zzO`Py?fw#j=vqNyldN=^3&m4^;;~*qvnlYFcPE!+S`=^Oydg%|MaMWRY6C>7@_))Z0k5{8^=ubNAPmPiIUW7fhJ84)jUts?kt1sEcNl+(w;*2 z80D|8yQ3x_`B}PxTwo#oU_G6uxQBe(aX^wHbax$WxeY&cV4SlhvA!#@lEWFc9zAgg zhjIk=sc)p&;-MO<*4Q(uii5w5ccO#PuZl;IKk#VT-(A{&cfRL|w2#1@uz0_IQW^Of z(f0h~F1shHjLSCR>Sim-?rn$X!-#!|?lwKn-lKIN-Qekm_T(v>q6w5!maH~L#z|(v zqv^0l8=4ckg`HdeGl0P9O=ZKd{8>{~>}PlfbhJ8U)3enH`|XKsql~jro052eZ5YC% zla5`cLCJ#SBihuR@Tg40v}10$<~=TuG4b~xdD9oU7C+!1hXew0HUM=pn!{~RoF@ST z1kJT}RyY(hPFTW7HbeZ@* z9YFlHpZ69oW_8Q}d-^4L`xAIGtSUfmWAn&n_vL&S`&%ZTkx<^rWrf?oId&# zIeRw8#UD0$hllXAb?H!v+0FJW>+KTsrvHn1P<)L0O4$pTW_#CE4wWqcGODheSlgf^ zI@@zUZ_Zlhd^%alI#LmQmjAZWxUu`$hqkzZ>XtkYE^+>mXl5>8Q{q`V{1%S^1 zm}c$MssGaamTZ}Q>#}|cfp%{%f1n3uYQ1~BDVN@MuYPzjOYm{;91fK*y81y$w3Lk@BKP4y>D@k!c zs-H0cPEu(~7ZRd!`86*^$wb<>@&l!gWDSK_935D5Rn!*Pn+A2(z-R7I*qwkOEfS&0 zye-Nq1?4FlM@&nTi^u64V1Y>`7A~qxE34R$=aYflW@sfToulHbjW3SXeP=XMhlSdc zp>fG58cKJfwI?}6Ch2EXh42=Vw7C%#3^ukmP2iKqU80L?RCb|XhyO0M;U!U$fmUH@-g?? z`-889g(WPPMw3w9+zgg7o1f1#;K9%RtGC#-JRea}hSwOjZ-(Tw1$DEwZR1MwCD_9% zn`JRWS|*k~tm>DAK1a4 z*22wcqYFny(a(&eGb*8vl<_UwaKa|jA0|UWi?Zc56i7x&*9@r)Cqc_o}N4Vjf;3ZJi%~k9+;qZ zS&=ZqUx*3d^j#MER&`szS)YN5ic4$?6`qX4f{Nk0u7&PlJ{yfJ zl7sB?6-}7VAa;pY3Qq`E%;{d}e^@_ll^Lc<){5O0&*qT0JEz!x>UgL|C})@L$X7tkTFz8S7kYiR~m98 zHFfjVOC{KMnhZYgZHop7A83y?O$2_JDcXV>(5!G!i`y)2zlJ9_RwYraI-jPngBNnN z%l{fcILMi_OY6|HlZh5<&v+m!OAQw~dLn|Gd&V6YDpE>{UN?j``@xQ@#~wk|wz%!p z7De#RbsYBoXM2#9ox-eL6h1e#$S3YtRs%j_RpvXfnh#&>ZOcE_Ec*(b3`N>Nr-}f? zAw-xS8AVR@hjuECbj%y#}_heiM1yw1l@G-vn4AjRob(Vn1w z(~gh(3;CNrd5WiWaTq6FWC#mmHbw{$I2Rf!7KZT+GZkQ4rWBfiA?SV$3juGhqz0j% zO@D&EQ-Lc_im#+i5m?5h&iWx;vB5%gbtBAih!#oUeb|LDxrmz-nmS>$EAAJAq(v8+ zG6SZHK?5;u^84{u%@E>q&=$%`OYgJh2<4n8CPy;$bgNQA1s(r7MY#J|SlgKJ zt8pEjlD$7X-)=Uun@Rr5Rj9QH6+tgos;+?@^k`4X*$X5UsdIHmtOyy4C0R$^{%}L+WSYoDz^@F=ungu=XkewonvQn3=)=^yIlCmb8F0B7cXFMf z`V@;*Mi!hhi8F7TMX{=fF7fo^xxY^7F5(b^=4rGnt)^(&ctswOCj(#RVE#pGU4<9# z$BxmZ7M#^OIE=?6OEbJ$mbdRPmcw92`26aD!wAHo9^KoHzz-xF$>#kf#;XiQU`Qh z%62|h;O!^K7U#cV1Zo`{$e{A|jacvssi8HNMWS=(|c`Rm``qLJv&V>Fenpqd# zcB3@rh}(+^Uf}~F_4Hj{-M9>!fEc%qd`$!5r*m7X)!lMJCOvBMgWU;^^)J|N6AKJQ zuUo5BXTMlIXW2IhLX}7W-R2JQuxpRxFyuS$?tA*%td~<*=Op?g!`woha!mu4D447Z z7%G8EmTJV7sE4XtjINs)0vjA#MH>*^OEgf;BParnEz_8W2z71|SdT;RBj4|{7TUt^k_7MfuqzMc5P;O+wpeRo)(qR@|tLyHvgl{rw|b3GKtYLB8rzXMK0sZ+E-bO>{Xr~mPH^Sr2@G5V~K1 zxgk9=`45x~xO+=X>}j|MHW9X?G$JfSIrOBP(TwAK5$1Y$);=8Yi*oEctWe?#^xB6` z9VNk<=FZc)PQ;hCrmbG4TX;@ByeIVDH_Y-r8tNCH&mj-JNIIcs{vtH`LRyf8FTGK( zZGzzPuy+~Rf*8FV3B#%WxnEcsn1 zlO=J9zQ2OiBoEx%4o9XJ#>nLtH?NSCgx>3`49St_f#m~2>{;VsKYunQ7a7SJ zN;K<-aKs#+4XK*SMDnkz)laUeL&2AYznbd*f)V$zU?2raC=P3A;0Z?n3G!@*;PWb! zQj8x!k=1dTNO+ebe3QLU<+JA(VyDwE1|flba61^$?l*BI0;!i^3(oe zM@$9{F?_mV@AiCOw83CEIDN<9j_LMSykUV=DY}Rs)jGY>74#>PVoWvE=P5W#KcXR3 z8d_!HQS#8LacLTK64#UoJ$&OQi0jcYeBj`UN3cQ;UB`lq(`Q-`!fTOeNhD76Wv2>i zMzIijSJ|Bm#`kU-qD#aIga&(GMt)$0|8$H#6mD8CKmxD7NOCEUO>H(};UTJU56v#7 z?NqRj@rs7$q-F7D{qPjdb(@%n5M3vYf{F=%E>9V@9aq3YC`KDVut1#4ppr(HuRfH` z`Vn#$F}b6pkaSbaZWR&Zi+B(by-zdVJ44l=nE70RL0LollH&LES$4BeVeORJ(Q{JO zZtAc_E-^;ot5nLiPAHNXA8FVW?H3=&Ksn$Qa#}?gJTyOYAquTQ!maTXY(uAWD5GwK z9N#X%LdKVosgNE=iH-UM<$6&}=!o*Tr08y%ZFt2*-w3MS=oQRi@lghD*}@;)Latkr z!WF{AXNufX1gQ4YTLp^ghcoXh6JlyGR?%bdKV^aY$tP6}P_LK^!&wlBXC{3f70%ja z*%@L+Pi22$W_)mxee(PQ)SL=BQs}sfn=P1SO$_}^5yyLmLCH|irX3r~oX?@(NYO7d zwe++1XZqDCxefeJra7hj*q>299EF*y;Oyz6E5VW2 z@G8`X%90x9f84{%7l~SYQN-Vi-}9XglEfzbG>`o{UCSziV*;t~a_J!?dS6wpTa;8P6ls2OY~_#Q2uI!UO|KfOc^0Ym=c;PWL6*P6rQK?!JPURC^%e##6_ ztx+|^7mABaQ$l`6tVx29t7e;xrv&GHs^R=PqO>Vf5|%hC=Am`vnu^mNt+t|vKY&tS@5GQra`0TVW}HV3m$hFG_K=hUOsEA8F+?3qyM$x zedy1x@3mw6`l!D`(aW3n$kA?TTJUInJY5BsrF;zy@vHxikf<7$q#FCtuTM#2Y5VI+ zORc)QQc{|e4%$2jlwZI0l4d|lb0*$ix4{<_?qtog`Q2H;cxD7+0af&~`TV*{{ zETbp`Lf*p})Wa^$eX!5d?s$cpN*taZ*G+gV@%+sb{Nu%6ho#LcaK;e5n>UmslkQ(x z({2%tR#OJ9BYm5Dn`vV>x6|jWzaDhJgLoG6A~W88soyl@c$0=Q_$*ygz^NTBFs3qf zDXAbpCiyA}c#rE}R8}xyOO}B!z0_p(az3YZzl4kf-GK&Sw$|@K{8RbVhVn8O z0JE*I>NHKRzTBp~oyst_$>|YeFq`|~`U(pNVpB*}{1{;G0P-L^BsxrS-E>jUA|q!ohp+etXJ?5tt+(O~M<-oX_WnVv5vuur4FIPS?7Ed6Ykj z_-H@bmd^29!FGgSQjdskI67^NUE_bp=S|sCT$Nyf0tCL91$i@ zzlf{YE5tTow|s9)_tUlRXODOot4AYv;7l9IO2^WCXyW8W9_XEKu1;r>kC?B8&0t1$ z_&R)GM~c0JM`W|#(oYtW`Yf>M905HdjL)X5N^Z{k<*2s%@?BT737c&|x+P?jRV{)I zj33P{P#GkCuotz@l-n$SWOryEI>~X2v(k?IEf@uM6eQV}3;dS*`#3Vnw?5{n$Y(zP zsDwZ^Tizv`lg3H#Jj^ljK;$gSrwX{#0`a3$jvI~6^X5kNl}fC3-|%M*rSy(Gu~Ub% z9BnLFDvW!%0~R&59|S`ht43rqP=w*+cqsE%miFI~r3VGkI76uA6ZwytL-C1BeI3t3 zjI~C}`qqZNpx)9--OAZV6HF5+|GLqcS)RjN=!3mSPhkp&di62HW)QZMZqfm_-S=(9R9)P<%z={ecaSp#LB6?oojGp@-q{yY;=SYC!w@2ak|fN zp1r$9BRtqz?@`I+S4(tEB$6(x7mIRLn-S1;ac-9S3 zhk6>S_4oZ3<=xaTOj2>nIJY{!@nZ^+ox$ikzE1AfuUcny1GP_HE|@j$%|!F1Wn>SF)+agY$mSb5&pfzAjJBk_=eq_`GcX{J7~%@ zXGZZmR5Q*f4s0{7*OYk^C^e@{S1|-zJx6V0>Mg<0%3lUCetQpVLA-^B(_ua&dw8G0 zSZU7N+LG9X1yLb|A#ng=^gVr`rbv^zJG@lTjBrXJd|@bLjEI`o^OxpzUyom^#OV_J z)NxpD7%&ugfaXvlJxL1OSP7H4LDTG7Zs{yBZNLMnUf!CcULscUBMKxKZ)f8SDES5wRqwQAl)x};HhZOhNNEMr*`k5{^5fta* zLP<{Mk>MPMB}ZTvs`LA+uz@!EsnTTXtK&2mgN}IAGfhFr zkt47nqGlkw<(aiiy_9GE2hNteuCN=aWI=r@~H60F8;kV5n=RB&!%I(xuYr*u|8r>h25Aypl3HukUIfI|{6~Rj|6g5RA zt(uF@)rsZpP}kXj8}HP z&~@roneJA^H^3h#@o}#u;6-Kq++nyoGo35ScE(G|v(%+miR;kia~upu>04NIw@lDb ziS#)HnACi$c;cxq5A^6S<`H%tAK37F-vOk>Bu zOE3q^t10uT<$}Qvf5IouC-Zt*LT#2N43d*gU`y1N9m5^$h-JW$#X`6Pp1MI1XZ z0gm@>bN!M!FFs{TM&`Xcym?#`)?1;87l!+4J}?+9Uy|5y-5<}PwzzqJFUG%bHuEMR zg!^KR(E-e+2Qw_e)0`UhUP%Y_eQfPV)vrh2l|=|Q68hSk7L5cllnj+b3|oJFofMHy ziLA~Xzlu*2$Sb*ey!=@iC6!CZQ4B)6SnTVtzt66*sbr)t~_8;flxk7c3t!X zN!GHLX+}2$fS3ghZ)0JcX6h(~sw_=zX^e2teyiTGg=<$NSB$Mk1l*e+X8gu?cz?Kr zF$O$)VY_LR&xV-#s+62b;@Ax8Aql_^TJn-(VX62GD{0w?-5BdQo2-?q;sE#3QnW-& zicW-LXb74KnKvWaw$Esz?Iy9C>~(hebaLmUkN`k}D8+}bhjHuIoMENG3Xd6iS9!q- zSkjV7h3M4L2sG17X~u3Z?fZA@A)`ERB1P+~g#mD`mGx^E_5#KzG-$`sc6mcVUOF-c zd4UsAakZ(hZa`6hJN_~BAof)GqV&fjqW2=9QO505G^rNN6q?{&jeB?#UiY2(qp=1` z)zTBwbDlxx%|wZ*(DJXP+w(u(RIA+IpBiW^!(Hu+n1JCU#UDl3QvH z>^Ib<$XV$@sA7)X%?ZSjp90@KYfjqV)l`ksTfABzj<<3&Mr2x>BerSGg-sB)yvlym zv|O0IR%@tv6{`c`O}DrP)%H->SOn6oHN7}DR5RF^e!Q+}-F9x8EIiZSvRG_)PNv^; zvUY@1UfxmVtncUlX32e`-L-$4b)<^2l9bJ&>2}L*ZbKGe|c;U1;nL>u2%WFf>H3yYG8~ zu8FOS*k0>#Y2K`y#;ma#e8iw)jwQG-;eOF!{kCLh)mdxlWVOQ)J>S9V%$h-gv{yXc zI0zqhl`g@Hg@VXE>EXoW1q&%k?$FfbIB^q}nz21*xL7-69hi??X(Csg+C9!q&Dl;l)v(&v0h8(rYgI<*>f)>nB+Y?WNpZ@Evnoq>5iR#p<>IXX|X`xl>)+ z+PN2Jd-nGjgvOrLeryUFt=Mn!TiP4vb)2oGco)7*1e;KT4~|Ikr`V*PTW{+wz0;MK zAseRKSY2ELY`V4(&4x=zRN?)f&aZ;O9!cPkq9Ns~>%_YDJ;rDkl^DF7z5lC!tx;kjDt>;ke=bQ}4x8q?iR|Eyo-4jm^N zgTK%D4Q5n&tSuUIt`19?&(zjsE`LQmuYIktY1Yd)A8WM0Jgb5JOt^A>Z^_%<6?w@J zLJsd49Jc|naotBJuw zk8+!4^SGr4e&6}>4S%3*eW|vZ_f!tNwX6_)zl7a>F`RebYgBjJkJ4E~v|+ueU7H!t z@vAC#(u__9{5ak9cFXzo`?1l+(~|e?UBkxrbMNfgeN@4RL8iCseDKS$g5dMU#oNQ| z#`7H&_;n%M`{Ba-?e&`=U_=ivPxSUa=M9e-Op*hp*#x|00|ba62y>t)H=!8yp*e`( ziR8Q!Cx&*;fp#Z`(anJY62p4szy}e-MdiRH5hG;fAQTZJcIF@s5F^{qp<>F=KPSx~t<{Gq<5D|2ed>F|6FhTNhKKJ8#E@mqUVNxdHc`nhL zfhU%fM?=nSXcEdcF)3jlX^%b%t05`RHtB>une;Z9k|8-p9+IIUvRWRcydjmnA!X1u zrEVUzyCIF=Hnm6|t=2ZJ7b#5|DH1*@!?qy< z3K`QIDJwqNBYZwRwh@~y4k~0GyFA$^wfs-IWE{YJ4jVE~=X_2tGE6lRui?>xdV)Al z4LV#Xyjv2k#(dsRGQNR)z6mn^d2l}eI+=jI0XqWGR;ehYer#hb#AK|<95MmYu#Nzw zG3rc~2uHzZfr2yP0#SK#F|`6QuM~|My@CXz1XWyTB+(p_VILC=VUP%&3Y6%Fd{)XG zwlZTG$Q_y5UHXAt>3MRw^s^KO0>vkCSxA#FC?<*+g|ei3UuX;E z@b{E>DCAj9R45BoIrdc5DAa5U)tvW~mG;!7DSXe2&;pknht}eUGOtVb1gVKWs{~MG zLd~ScNU-l$MP}mT6h|Wtrw5pvEFl z4ydO%kYSW;fA0M1GZO`aUS_Czh6H#QJJPpLnLbm)Z%<{P z${T2+@pRw?Nv-lmrH)ae4rAs^dgzN%;)h@2&p{o)S`u)45O8Per&i*lR1&0h=x1XV zWPj*yco^t@7~*FZ5N8&gW@Z<=XXS^n*b<49DGD%tuQK$}wcbP|5KadJ#lB4RQ$v3? zU*93f$QipdmXIcn5?mU`NE6RdI*YgO$ga$t1y2(roVYKgg%z#CC@SWtL%bKr(lNXk zQ$%4>WVIM<#Z#JAMU&oGn%+s1F;JROHHXg{Yzw)2F%@W9F9H~gUWFHOUq_|Giu&AV zBFvG{t=g}Zr-c7X<26B3AYN7=Pg|%~R;X*i0VL035p`iz$NOGJZelKHB`PTl93dXk z_ci_+`n3bD+nWKA3N%nua2Pyq5xPuUxn5SaPg@;C9rjcf_I4Z!Lszp+3&KAEk(P(t zS=62%*YH@@v7Xcll-DDi)Qi(K0O=ZSP8yu)LTjm|bP+UErbJfXeNGU$w+g^E8=~H% zradaT)d*6S14~$n2B;d)cJ7yVp3`;Rm3O_J%n8#tNFG_H9@KmYP-p(oAu5fM2`|h) z&Fu%BDjwh#CXe<3p&M8+U_(FXTrucHKg6N8%ukE=%Ls#9NceDYC$`LMRkWlrMo=;S zjZYLqB>)l*fTKUVW0in4g<0OJcwr9juBb4CT{%t2Fhf~6!^mJ@LzO(Y7!??qdMsv6 zP8(ex!!JbXo&goHl$eSSZMxjg#H{1=X%;pyrdF$b8Jn)&oo+?#WW}O%t#S*SaT~>E1EXpip=ynh5z+5NGfcMx#(I|>Yd;S| zLf2;X75tgE9%VMD>M)A&D5>fwtLg(nMY9+}3iaBTT*lLZs?!O^v-zqs>D=AU{=81Y z1E7smN;&^3J#*ymi#ny5>x|cw)z^$nHyqVBkn&b>Rw_0>hSlhIZH~QI^EW8Zcf3mO zSZ(g#7PmOgAA*?fZI~Xjm>%+~A5q8>rq1qlzdhD6y;fZ)VyEw*=-2I4zm8nc4KRV9 zzCEGXJ}ViXm!)e9R6{Z`zvBeG69hpPM?ontL#uD5-pp{pAh>8| z_+$`#HZwvo2%(x8u?d9O#f&rvLYiboUH~C)FryrRP%fBJ??I?wW;ECuG*lLJoEmf@ zFbf7%4F(enCT9(%pdHdiA!0PWlB6B~wWVC$)@Z&@847%;_wg>9(IFZcGB|NIWiSsOrk)FFA|rprYwnvTwM+;A`?a zHg-!kns1jpD>rOiY&<*6EDpA8rnW*ibr|0q1ew@KHm;pXZ}~>+KEqxK3f7A%u%p+p zi0QG5o7RheyTx~?m+)qn46c`qW|vB?m&#_BF0PlZW|wKIm+4}c9jup~WS3j0m)l^M zKVTQ{jgh~vSLnT@W`Yv|+0mK(fJJnICa6=&cM#BHCVmF7MqP*gW0sp5tU|b)$-v#k2+E9IO!XK42q+492$(6ob@E{po1L@iNN*nYHvEogG<$a@`0?3xYMQ5;)Z`R4-hC{XPlf}0tZB#0rt&JB9cf_XAsxcefwgZrmrEkPkS%Z*Y1YGaJPCEK~H-|)Xg(g4vrn|!4 zu!nK7_*HYcw{b-bHb+cyMJ_Z)ZaiRvr(xbbha*z5l@MHPp z6E>Kua)YNT9#j(k@OiJb8q5O~+2jR5UBwtk#wbe2`o7c6LmEYC{*XIp7*0XuY z-ODw+yQ-I%MgQhechLHMfi+RDzDc3E)%ckJY}?|0lV!@01P0euDA?9kgTCkUeynb5 zIB4s<;O)9^>jLw3!?t&$^8LVR|3SppL)G5H#MjH&-Ydx0C(+)gz}K(d-mk|uVA?+L zjc?GUy>F#$Ft~jvnr}F{eK?zMq_};gns2nJeYA^jY_NT7l5c#WeSCv&;-G!vf^YJ^ zeG<$!1=}%&%0G?MF-^ojL)9_E#6Qc~F)PUbQ=;Ri0{@(P$DAJjylKb$H~s~ejsHRzYW|g`j+HL{)xnO{N&dBkj zs=yXb=N6H`HdW^~lfVvV=Z>Jju0-dqg20}7=boOxzA3nK|C_+U|6=bhpW+Oozp(?s z-6cU2+}%C6+b+S~oe&5R+;tbX;0}w!;t&$t-QC?ifh|uT`?b^Qw4HX^={$eHeZRV1 zT-Q10`#D}+2La-T5nYEM@uRe^qg?Uh(yrqg@sqcBUAOq@K-cMn_}N0&*@pP}LD%_( z_{Brl1x)-BrTY>`;)#Br2{T z*i~*1#I>?0*6K}Sunv|Him@DdbTCOLLNjV6;3FWXsMXQpjo2RnrNk*#$nc< zERKh>8@sfBJdc19qDcs z10WjtRM8A~tC2J=oB586uQn68QW3;rnI3jCrJAL{&dhHP3pHi~sbX24PAkoB2lJg- zUM?HmK`12R9d;kKW8$cEyLh~J_E~c|(!{fUzMU-8*(`Kr`+8k$^hA(I2nWw${_>5sn^A?NP2F)|pYB zDHZK8z9q+*F@ddE?Qx+a$jrFN)u{G_*wg9Egaka6&ZHC?+wA0LJXM`3Su&^DDS4VW zooPj;s@Z8}t}&e%RiU%l8FeWvz^tYs+uW?Srs^AduIDs2r)w4mnAfwbnwvLp8v`sD zd7sTKm;_+~7tNyB<`*pzRDnxY8BX&{Hu-VDWxMjK`DKT?G2n_*>)HH@OAnUrs@o9T z!s^#4Ro%63OHK=GUR!ax>)uCI3+ujDW4arDPiG4o0r1#gHiOV$?2DTrcxqp^!pNK# zw<2ibzidY_RWEMGaE*W2i4!_s+yO~p>+L2evM=o>X{zb%rRX^??WLK;>+NUQRWI#l zxsB@`WP6`49pnaK>mTMvu`eGMCaCEj6=ygvAC>0E>mQewS1%t|){X0*RJEQjpVahV z8=Te+v9FvqOsN^1H7z->oHcL78=SWuRj-`4UyU1FbUvN0Ty(?Z7+&_Eajahc!BaQ9 z>LYVmy&9ka8D0-D)vR8Ra7`HAj0s(=-b_g07~M`Oa;)9XXsR3C&FQ(U-7T1bjP950 zYS!*o+$M}3*1Rv)9yWq-j32k6IMyF`64Z^K_A*@7pAPb2Amitw@|yMMle!7xzh|u% z>whnLa7_MP4RLJzyO~lqdAVD1$sIUc1)01)9o1~S{=J$ofxSFkylts~CzXW91_vVX zZo=cGOCqs@gRnd{-_ejtp{ap`i5fSNxYDJtoWUU!x0@(Zq|$it;7~f=Ei}z^X`*Uy z7@Nlyh8gK+vT<-YU*i^*Tl!~;b8v*%?G{cDsSFKvLZmG3HeN!y3>|wyl&Z%zK|ZN$ z8=X`%pmCe1E?t(*IU&aAcAKP!RE{e?A=Zj_hioccj;}f)&dFov!xpK$(0D@px5gcc zt8{s>^8}FJ?G6<@nSvB{A~=k9mj*9GL6$u+AjdAr9EM5bbf zos{0kyT=hb1paTl{eOW*F8;4UBaQz98rclNm1EorB?Q`Tg^^m9ZH1G29&SZYhcj+R z(x%#OM=_R^ZAY{If6Z02p;$p2%!{r^kQ$gQEsu_j1=G9*eZbekYUu#Zto zGg<{APt=Us$7+ukqq@6IH1OC*Z#@-l3n?J!`y$8UQ%CH8Xz`)%u%9W_Encs&kg`2p zUZ|oDWQJ%-@iI8Tg`F7dVOjVQjZES5d0oPHk0NRUwEoZf-0{{wE$Jp62YH?A6O(B_ z(QmX2s_?r-S%+G%E%qn~)Z-@>H(D~-lq)JOb0@aM(y_UekLd5?gPnG184ZTyR4Auo zx_OHkycI|F*?BVRZ>>07o`!9?2~z*?((!tcso3$~WX`Xa2-GQ#yQ*pbRDsY7Oy~`Z z)Dxs%$m|Lvkqud8@?^P=(hEP3!6q!KlM>E<9=z2oCpE+yva@;jCHC~j!`2%TP>2}C zDc&mu^LzZn8Do^?YSVP}oGp02SEe8)tOfRO%wT72|H1lGO;Rq z?UCiVHfU3=UzMYU^2!oy847LbWYb@%!wp||Oa2wcz$q^@xf$)=GALH<9uT9l!Qb54 z=XWl7W^1@FtlPF2=IoiExVEeR(7tBm{5_Xt{S4^Uu|s#^F?OZdElWNW1k}w$Iu9|w7G{E`!a-! zeDZ-=u#GUDGmv4_4AW(?7wMke|HgM4zdgN&WZfm^vx)_L()WJ;)Y^FY4hy`$f;|Gn z?6G_*yVM_A2l)Ey5@TX_$!{KqBs|@d(|%YoGGq(^Q?FAhMXgx9GDZxXxl{U1_c(35 zM{U>}QWs+PIg-d=qmIC@S!1XBynnpM-MSinK0s^^=Yz{{Up@kI6@bzioyb%H|9EV-HD=>kpovo7gUbziGs;T$KN95tj<~!@ofz4y!w4I6?yw zYVHXv0^YsKIoGMVKleCvz59&1+%sH6_jzF-T?npmbP6=n%V+o5&(LmjF|_h? z8?D%W#CuroYiHQRK2Kpp_1nMKK2~yRqstJVj;y{tQoktSCRiRWurMm;F|wMDTECNc zkAGqY+9T6klKU2nKZ#IwL5HEQ*d{=cZ7gB05hd&?<-S(38yQGH@BA$`r!zW&L}W2W z?SU!rBbq*Eh15#^aQ8sNpF3KSAAV?FQ-u_V6#k5dZuaW)I4@U<-$a%poHd#UvX9GZ z#Kg^DcX`d7;J`Gov;0ACCw-%o6quNdx5SeR)c-7J!}1_|X=o55AZI|L7>p#LX~S)D z{wtyb#=JJ-_d5;tubPVac`ny~tO53N4uYL-Nd!FM_`lqPI$y^&UZ4NMUSCiGZy5rg z1_Iu-1UxVEzn!uKWU!y-V00WO9Q9RU~Z*S&t0WQd?(hyg0#ZF1^s z3L*k-s5W01parOV7;t@_?Yb9r2N&%y7@XA- zVcQp7O&VP|7-jP<7-ajU0@X3`yY6?=7*EtFWrf)OFR_E)V~5jYM_XdY7h@+MW2Z^u zn&-k$-Q*IfaU&n)PEB$3!9RwJm6jOcRt`OOzQi-r%i>exN>alq{6bHEYe-08lR}l= zO~oTn2Wf;NqDY~u&?22hf)D~hmtQb;T|o$2AdT5Lq=F zJWGF^09m9BFE(;MC>+t&VP59_P=dA$vLrQAg#H7#K{bCi?n&$VE7L+0X z2QA&AJWUNHsX<7#$qu(F3XGtU*#9lFTQSQ>54Xk6qKz!UeJEWcG|d>6VTRkE<{$Ob zk}R_aAghR`klSkI*qVt=misOt$MfF$(L47!>TOMy&C^isFTP zV@ANg^a76ep^}-P&*%UFW;mhYcs_doD>GcCB(iflh;KkiavA*!YHP4u{7w&`%UpDN z7?RZw%F=Mu1cUX2zX~pt+CCRBzVV`Xg(l0kP8Ef&K4r$oj(4!UG8c4!SsU8gM_l`7 zTcdQRQ*ddDy>0SfDW8pPXi2%vacPdeQ)X?FUK1K>Afkb5AslWIgcc+@Sz%yb@)Qn0 z2!!)LEE73)Jo{DY8ePE53|FIsZi^1lxvNOT1tQdaCvBEd_9zs$cgl-)zXO-(@S&q> zM18Ze{l^#-Z(Rx^cC{+5fE-uU+JBvocF~}#C~mXM_W24as#+DUxc8|HR4Th!E|O=) zZS$$}jxPRsTo958P>Fu)Ss}d+S35=*M*0As?A;gNyH75cnP&o&dzH{ds%C*Wcpm^L zD-|!9mA3C|-G#v(#{en=08LgchHoX-NHI<&@E>EtJD6tqwVV@~Lmhe6*Eyvs(v#|+ zZB-ZOrS$Ek49svknU!o6)tp{6*ZPg>EKO<#P2%miiLJ~a>y_1f zsDKku*=#M)VzwYtvm|pSh;Euzs+p%*1c&I~4l=BeZKB5Yu<;7)`#GY7>;S0r15w{`!vUV#ZWTesy$h9Us5EzCg8fv_E24`XAvE%T%;yHf5AP%_n( z%?fPy?8VM#Z&kf*8&+=7jrh?b;D;-VGa}+01IudJGVoZB=`^D4XvhN9erWBj?5eZt zG7IfW%mV52q7RI;W@*S{rl&dS{1~fLLg>Nn#*oiANnWm0d3EsYZT4vW@C#G4%}v06 zaGz|y% zZp##j+=riS+M>PhM7=(b{w_i58?osr-~H8xqFSfei@2Kndh%64^jF($FN$H0M)NNj z74_(q`0pbvD`{~&n13D&I)@B2c1~0R9o3j%tMO0mYFiisqzMRuK80&>y9!eM5K2gC~uHhW2Xr%AIE`gO>*~8IB5;nC+z=y~eA*!6#uRDg$Aq z9>Jr-H79i;KNBh{1ChT3qA3LS{~Sdn4IKLs_*QNnCm$O&9Gi$8of#dS{V_I;Ikx<7 zY>9k)oppRsbo}@sA8AV`F%T}x6vMQv<_<30C#=MSsqj1sD1zlvjGH#XG9n$ zjrh<5TPpa*>fy7};o>SZQzoF79hWL|Z`z3h+w3{xG@9Scg7CEK@l5&hoS;~ZK6uKE z4bDIk(3qM=jS+cnJ9~FI&DEL2D^{~Rh^`n2=OcoR{GpZ=tDe(uA`!PX#%6&#d*Kcj zP4QP9k64W&HCmDDf+pOe8wJ=y6$tIGa2%V9j4bgcDmINoWJ;g344ZT^nn#YCQ7=MM zFkQBfMAVX;wCSyR7<%WL7^Qrq(i%5Am-cSU%RIx|)uRo> zl!zdOJc?nXnp_&gFse0)ZCQ(E;hHh%QK&W~gQxLF@3sOI^M}L$C)Zi7bfmjKtlh%n z1V6p?kTH2BeRI9F;&j!doAS7fS*a=S7`%Se-IvUy*puaaW~mwnvo7(osden0S2_3(zx6CH{&pR;{!3BO!Ie6yX+=jw z1Ivz5g2%g#RlHAj)gaA$R86jCX5a?(7aTO;>Md$VtYpcI+ z=7`Tl-ua1~`Y{40a?vFEJyCnwQf~LUoOF5XWcJk^?p15s^)K>kK7-M?wrhJ394-!G zGd3LG$|16x(Q?k)>f2=0+PhnEbAGCC2%2Dyiv>%nTN;-v{odr?)u$SkSEK=Q*FUcO z$9kMLPPzO_w`E5&IdCmBaH=NbtvKNDO&;bvDh{g~>)FlLxF7ib)~Mcg9ExXxE@~#T zTb9C({8^Lk@@fTKGS{(lBFAMioK3rMvXpawPWw*~gdZ&kSx|FqPOQs-T^`eK??8kj z82jgaFm+>BkALe_|5!@?#;hA|N|?b(oKXl}qUoQjMWiLyT5g{%8WX!!)ZM55stpfZzGQC4xhZd|AM?=zCtKsbV=3X1`(H3hgw&H?7WP zos-!rV1hf+2~owDa?3h@z7;-)#U{I@0;dlo=c{$@C(~>W0vziNUN7e_DBfpF<)kTT@z~UUW2gAjV;A}3&S{@=v#%5H-(xac!oh;Pvt}QKsW_2I znVTxgD5&i~jw)*X02cyI<)kpYf+pLqc_n4_o;lMGbzFE>H>i@M)i>v2m(sng&;e`h ztG-JG3#(*Jbfu4*-N@TqbFL^HON9rske!BW435loS47{1kp|gIKBqe>E_UT?i4AIFsEG%-Qo( zH%6(bW@mq-LlVW8=1!oZ6Vf8@s7ba5`*J^ICYS=Jyj?|IJZ#Q6b|U#x@$jF2e4ZVH zv*i3kpO8rZ7+{+8K`C)43;`|pJ65H{quW*r?W#h+OLL3-cX}-fHabKW&J0OFeXqTc z<~mlob!NeTS?@yU zFS4Pl4i3)hMGuU=!>ymnMAW?(OTELjkD!;+KNi|4ulim~U$SD4=%d)nt$sz_o)>4|7u;T-B(0iVGJ zOuN|4)&JG{sLL@%5B{jhm1Pwon66Z#nf3?e;jS8z*Vu?}xlAe9k2Fbz|Zd z$==yC)<&V4A_qKIhS8Sn;sOaR3ErFaNfy*H9rNvTz8auP{cGyFN85z?5iM=Nuy63= z9OW?1P)!K?bz^?a75Kax`hsfo9iPM=Oo8N>Tf)ox=bNTwIIP{cTAVu`Z$1Rm;>P&1 z&lf3bbM=6mU{p+_MfCeBS8~*6GmGHIUU1Q+FSg>=Bc(+VTQHcqu!ZLDWGNmNWladx ztub!ef*f{roe%z2tek=Z=r^HTG?HFE0+OUOX(HGg^@|xTF{*?lPzEf~7zsz;lBBP2 z6&1aTC|wq*5EqJ*KtxjzSZ0eW9}kYPpv98Holam2r42+|L?q)+2>c@oro`e^U|V*R zX~|BENl+(8b45#YE&d5>9pQlRqLXpNb7n5?$dMFNwM+ zAG7ZW%r<)ATZp-vEUecT&8UU`77G$$`G}_|Ih}}pW%+SVNbS>HNMs1_M|_({^-yxW zkU5J8a^LL{U1xL521v2oq@I#zzB)RtCT;sKhOX#KI~szu!B1q@W3Z#Eu&pC&L4x{f zecNqLG+TKggNzB!3WC6~kU=}q&*)lUGeXfjCiOpZGjT0R5z?!JVhOjuU{k?SzL++o zJ$6O8l>?-eP#|YOFRte_G)lK5hl|rcKL+Y zbm1qjHB>RQ)=IGAx{co4I$-7O9{0iU@U3b$@5lbF$=B#Wskwa$iNmwgVC^DWpkq&# z!+WlM?bO|?^W5s<`;PDW19YM5I?ToYLV4rq6$%<82sHa=7Bg+AVE9EimJk|9YpAGf z1&JaFC6dXVrXDKhT%Kw+-TyfKdMbc_blLoNQLYn`7ozf=Xr_%y*QRMPysPD`5iG8s zu!a1IKZ>Niq#d&Fe01amf@OGviYV65dIaukTM=P_^v;?CLipZS0sj5ysd9{VE8~5-uAXZGHbqwz8|FYNzc>qntAo~s>q*}xecW&bh5B5 zsHM^tCkl~0($He3?!*N zTmP=cyU>^so@nqk`ibF^I7z|Xg9jIi?kQp4Pz>xCkvLm)@44<5BZe2=8CV^Qp=&(} z8%l&^HN~wuz55VD-ZoVqG2(b0_ipJI4azmBQ1wVGtDP4aL^9g0TEK46Q9zGS*GDyT z_1*8^z5}IqMWqw#h=SR8-JB5EO6}16L1+@u>!JSXD_Ol%tht`EXL10R)m-409?bsh z(Y~D9y0q+58v)i^x3lHq<-58i?$x@GeeTulyMEQ>)%lQp5%A!<2`};et+adT z5O4e&J`Vfd80bOrFAKyKlmYg<}g>73|oGL|A z20_T#8TCWEqfh7}{dN8Zx+zI6F7Q2U>I##_{NeF?cI)E$ZTZ2cQl)PE{lEU;_d*|2 z-jpA%{jS0!W(6sQATXT!>n;0|;tm@Q{#9Yq)7|&D9k*^W0SBjtgN+{wS~&P=YWs{( z&e3!448Nl|dfFz*L}PE%QH!We7RJ{d37A2oLWOt)+^e0%KDRX z5Jh89WDxWV=tkeagAXib)5sfFKsD5lSCFh|wq=3;l^Y%@fw3$$feN7#79Rg2HmDsr zG$OTTKu4=o{GiNCdW+Vq5cSIk4NFFnaEmgM^OsLvF|j31SZ$rLSqH`~1LbFQ<7>*0 z_f#CSbRohLH#5yMfP9i84^(yj$uV)GwEon}Za?WN%ZI1tpiu}5A zh@4|VTQU%D9+cM7iL@3jYvAk}H|S_&?EY65wZ-#0{MTn}QS^X6c`28&O}1V7m@+h? zvU`PMnzv#=6;xf`KUtA|J51=|Wzne>LS~`Sp{V_I9`vsxzc3(Sj6Z+FDu2WNezsTX zy^4{pT|}EE_~f(MBlJ_YCr{pyJl4mf$G1`bhm3URrhLHaK;Y;=z%EA6=|C{KLI~nu zsO4Y?CT5t7Ld5JqxS>K6?I0|oXfP5o7&ki@->VQ4ItbcTNVpx0qK$zm3HBe7rMBY1 zn?h3|g3V7^_)PC}$w0&2Sm+rf_#T*1gS5o0?(@sC zEX$D$NNXk`xUKQMd5}^LBm!eb(f3MuY6@`=b+k+;*S|{U0pZtD6Gp+*)yGo+BWR!`!J@Iikh2@%uyU0s@mSIawRL)9&Q5xM$Skp zS*FF<(CuiE25P-s1|NvrT++1Lbi+6YZOqe5^!Z6sq}{QZv!l?3&=j-RS!V<9bL zjYs3-tI4#J8M7J!^QiF%Y}gAwMpd~;14deGMAWCICNSO}#al@PW&$b>NoS5jj8SCI zq)2ds8rN?$H zFKl-di70+jBlRXP^3;$_Cu%A=L$hF&>_ZiH-)c66(fEA65`A1+R_iG2=je{9qURTN zwWGLqP17wZDXEF%*|{q&8%N(i|oxvzG!ce>8#=D zNV3gtbIr<(&3vZQkqMiXPnngC(^1OSk?ot6vzisJnpN4GRi2ww!vbi$%)&H8duv%a zd?@wZW#UW$k!5kTwtxg`?f7GcVw)5Lm4IgGZ_Pf;D#bHMk@bK&2M8Ks$`%%~!%BM8EZj8uV!O#pQF{LbJxi#wTP zGu>$Sd|1>PYT7hc=yWh+hogF zbw!X7ODY}8wtXII3nqp3qRAXFVQ+DYSZ5+`H&KN|9BST=ZyFb5`ZonMAuE(IaV#$) zm`L>!pcgNLjWg>5xR;lvmG;8qW&}1es zoFdX=kJ?W#RG1A}uQEjsDy7Z8^FxcF&uVAQ%-XlX^y4f2?3RmWC>@ zshDJR$%J`X6F(4eh)rWqdX6Tq=$`LBtV`TBvgfljTeYgIPs0?v`tfviWjHsjNqXkx zBTNmAa94UUY}+Ujx5^}XF473KE^gjGt|Bb1x^u0tg^y|2$Kb54a)XW?zXH(2y&m=D z4^^=4me{=JcX`g~-xp(Fyu%g~O^v2W1HhAtCmgdKArKm}H{4n{tr>Zm=u3Hrbr|5lcKuQIv63Niz$E8dq@w^|amT*T5D;wkU8gXBvqNX#soL3w(+t!M-ui ze21{M%BAm%vqzook)OZ>1T&29W`6i7wGR^S+TO9WfO_vJJMXH~?@7GArvoNq-$W>y zsUTjWG~`>Z!XZ$NSZsZ7%yvwYc2k^ev62z7;u_gQW67i0OETBwR?@`g)k-k!;>9S8 zWm&DmyxXI{N`ijQ@7cwvd7C`@O!)3-BCO6Fuun)=O{fHK^>rRwaDRJ1LI2gjb&>+Gf^AQ@5Z!ah_yCpK{925S*2B_ogux><(ZEYw!X(s+-@YE1EaT#K!D%p zpQ=@Fw|I{!qV<@p__}Aqo)&~EB93jhO1&cnj6Ve92KG#P9vyJ^o6~7qi_cy4v z5($=+B$gC!#O~lxUy+s|>@m!?uN0PQzS?US>P&BE;k_-!KDITs((7h0x-*hGA*ZNuxV#(GB| zB9FRf&6&s!&2vuhuuj=_2>#*4$3G@v@O2D|iw>2X4na?c`%g#aPe=Dp$L>$ZkIG6kp~QJHXQLBGlztGe(!&Pejg~mBhklda34qd zj?e2A@w(VN8l(*|#L-;XEpv`MB@eM<`v3NwBiDx4xe1Tsdd!XvVb zD)evoJ8j8*{)pjhp>nys9=VglGuz~P~ITx7F zde$|f0upJNz@N=mf1f`cpn`*Od2t^TLWOvQ6>X(L1FsleUBX&8X%+hW3ri5>V@U~5 z=f|)9xL$oK>N!r4#;1~+r7#Ghlit5UfByE%Aj)M{7C#q@3U*M9#5E9$(Mw00=XBHx zTwp_G(!g%gci!#!jfvjJDc=RL4O0+oL%dlc0=eUx^piXk1_e4TDzMQ^06*rs$wIEM zS)(qWWWlw!izgQihh4B0_pg0dxP-2pH*OsW|$JT+Z|UWyE*S zJ=}9IzW#q1mp5S-7!tDE;?a%~XUY=YvK|dM<&hsaJk!QMSAhf0>TMn?K}GlsX+0&U_o zPo>N!l5snhX|(P>*2u~~7*~Ov_laGWJa3k}=J((BOwbNx3JfK5JSBDv{%n5Aes}`! zKIOr@Gf8~%sGc+AeSS*#6bn3;FgzD8c$ca_mj(Eg+dNkcJeO0UB_ne7Pln5MGTUd~kNw?f@bMxfo!Vi=yK0q;THMC2GbS zue3G>l((dfCH7#W9r<tKw2z_3mh_3#9t#2oMIupa8 z{N_-CDZOaOn(5Qa7=wLs2_c4_9iV}$9t9OX^SG{Zp?aMj5djVrtW|5;>7zx6j*A4w3czyA68S}gS=?IZC%H(YlI-M-yT=$~UXfxfB zs>kOzQ>g1=aOOW~>?jeubtub}5A7hpbZZX6(l(wYyz5j$ZC2gr%l%zxt^Je9OLjUP zSr^w0dY;|M)@dq^S5hnmKwuXK+JC9#vccaxs?cxLNmlY#zd>cFR#~*PhNrCJR zcY6x>c@gh_(A1Sqc@Rw%k$pY&n4eMi#{w*V4WSE@3`w#I*YbvB+kg$ZzgYo(ynFRD z5Bl(iLq;KHrf)|x7d(E9V_#nU7|(jl_$iiWy~QF{>N))rh!3C15~TPZZ5OP<{A7`! z@v+r1S)O07I7vs1X)nb<|7kZ3rtc|4pRVVwN1tlvV`rUi6CJgmX`lE+pY6Q7M4#h$ zyoBx0UAwC;G<;s5;m6XIdT3`EVhI<#kPs7Ps&me!-D(Xz?fZROhjcQ|4f9pRa( zO|y;*XM7Vyaz83&hvdeb8{FPiu`X4J8wzX;JZCnQXqd#Ytk`C~2#STVtbCvKzrlL^ zqcc<0y7gIp?Ruya>gRLRH~!$Y9deKjJpfbs*s?gViD@*dIgGT;kqxZ#jbveL_-^%C zh;>|n3den~M?M9JUQG&c@ZC%s)QH|qSeU%rFN;w5J!}R@h&}9>xcEQr`sQ{%o>p%7 zKb_}t1U%mi1i+qQkAHF{V1NI@#No~sy5Z()0uM!~UvSI1t)D`~UR%_@ek9F8Q>qOn z?ASEoER(`;cMYLDrAC!t{EeIF8cNSfgO20=o2URB#y)C_Ve$Bz4Byi3K`|OG@sf({ z8XQi#Dg*r?NKRRS8wMfmv(uQy4g*U^@)}~{OG=~D3)e*eA=`*l9(`=)2{Fc}A4$6z z`#BTcVy#&%NYfYtsdMl`se%d!iGIuRLKEUWA)hEO$_7NQ-9Y}QpQvGsgOd2};BZ#j zk2vLnGSLa@r+AWc>?l=zVpVRWUkz*7%d6KkukBJS(VIn?6g8hu5{pK6X*Guw0jb<6 zRhE17CQQSyFa6WWxwOS}Ms_0#_Vr2iMSE=WQA66>-0AJ2R%~J3qlN`qM&ZYczR69s z;dl6{iHQ5mQBTSiA9+%|XG-{bh7_%_8z`&bg5iD@tLU1~B#HX!vv~k1ytTBoc2%qe zZG?s_p)*Olx25&T)2cvz?Vm4}3<5D3s)6jh`74fPd=mIfQODEyXa7oNDTX!7*1zU0 z_a1y+h+>M4Z~RGVRKgMEJ^5q$_~+5>o-7Oc)R!S`xLZd?MLg#5>=K<4s<|?$AoTH+ z>*O*KK6?!tAD#SHopMDYJI#y=t@51NQtfZY8s!xlW$Z+is(Z)Upd~=9^<1Sc-HC4B zdtfCHmXhc2%|UO<2iVk~Qf+5-0z4De%~q=jV!Nt@gX3cmG2>+RF36j}{7ZY0US3P& zNMNyt$S|M;RZCb)1gU+e?Q_1YC3l>%LTO(b0&>sIF78yY2yVDaKrOnHE=GonaDjF z5<3e7FE(j9o!lDD0aI&7`%b;vc@1gCJ?rB7oPL@wt|$FVm03{bP*Cw*ktJ*Xs6hG| z?*PM?68$k`t(ev4>x$t&cHJH{=y@=OiZQALX%7Lk)|c+58M;Y&Gv5AXIM=EvF6c`y z?A^R;l$fCzk=OTb7EiaB&cDWlx#_)p{8!)g$jvEAN&7|a-9T2Xdh+!Lwq@6;Q{W$# zpIC&39L%_r(pGmF)R%@-!?_a+f9^3mWDLvSU#GNoSaDipj9Nh5Gp1OrIhB`29mQ|b z7RapyCR)dxs@;FKJMM|xkd51@ea+oqJrw)vJ?W#yQvhQo-N0Ym@-_HqL=pFPpeqoG$qe$-~0{66ISD_~#l0%2U6XvsL%= zk$RAy_d5&hn~af;ectZYv9Iwr*(V(bqOjJ95bWE0jLt(DiMFYv_}gNZ&Lfq8wwXfg zyK?2uP!Ls;9wAME?On9fs6iT0(L`1_{H&NIh=_LUv%ht`qKbC2%! zwVU{d&XdlIAF%d~cQ}td7+sg45*=FvpvOLzuB+JGza~^nPea;W*Qwp2`!JrGr?IbH zH#soT!_OSgQ%PO7B@$xC+BMH}4PAHD0b-{X9DkQ)y6&OfV&`9L{;u70J#@juE<-r} zZ4q=o_DhIgC)NDhO_#jL58XZe@GY#|K zyV&|0AlUtH5BBm`j4I%ECYSEU=H-PUH(=|c`}K9f5B6dL_eup%oCi-yjX`K=@jN7;%*c~0vN81`VDsE5?+B2GQs0Z}Zh8@vhgOn@o@0zworlpy zjoF`vIZll=pNF+hjlG|T%}tGd{=W~6;ODc*&=B3{Ah;TnLDmU%{%2@pI`7$!=E7)e z-zxvuDW9|?|9v&h2Wb9>F0)hFyrVFhy(t=HL^!WS8s)=$xXrCkPi7ykX%5i}sLzq9 zpOI*Mj6as-?h%=PI`99OnDePVoE#`a3+<&lr=fNJ=wMku=l=1d_{SI3?RP!}aOnk1 z{>IF~+s9QOnf%Qe(6?C3DH&=}nClDZJ##*_y*sEXFd_d)ziqz1X3ol8z>dDd^qz_< z+?nBO%B1vpoDdHk2N?K|9B58Ko&;JP;p_P&Quh57wt()Z{_Sshs{2K1=d|kgMe47#8py>O*mRo2 z#hR3KTJ*(Q>~z}v#oFR@I&#H2YIFc#F~FD(Xk83+rqlH-*7c|R5?=fzo=z{dSTBc8 zzob~dn$7@PY|uq#*k5coPG>Y-Zr!#|>XQ`Jz!}svg z@9_-YsiofjRBAb;KGh7q&{E$nh9CWFN0G|%!hf2Q>C^7MG7jMVas9Hz{Y|0Ogs&Xhg>#!WEg?3d@9 zGv(fw=e{!KAy?#KGv^am92r{Ggr-5RIM{t?^jfxGuPZ#)Vwm+B3IU8v(yn+ z)={$5(^uBBvo!EmHi)w{%2hV1u`~fIn~YhYZ)2FwEX|&k&HgMc;gv1%EUl@PtvM`h zC6#T}EbY+B_AZu={>qMV7)$4TW#>A}e}G0Ab!;9o_BP?S z4;epaow$cgys}OrS50EGP5lRGWQM0(>$uUZ{vTbr+1TW4F}uUbE6+qkdVcxBr}uHM9E z-y*KwqGaEuuij>7-{G&`5oh0(tKL;(-vd_f8ME(OSMNKsA9%v55B%8=|2s6oeq2(0 zT+Mz0tv>1c575Xu`}uzL`8oT=ef7mF`z3PCB{s(uam^Ja$A5=L#5r!|YHrmy?tnFS z#vJ$7HTTXO51us-{v40tHIMNePpLI;%E)s`&2u%!Uuex=A8VYhnt$UQFY`4o>lbw; zHbuuAulF?&Ytw(vHE<*jblA1$4UbT~IQPRMQ3JM+(m1u58-C8cg_~pph$`HrJqnnfCBneEB-UEP9w)9gztau}vMZ3m1u39Z3KeX+#|< z=)XZDb?T=;k8-PtXV##llqxavjBgfkx`6l*^G}b<{ZAG$i#jRNNmK>OXRD ze;Q!G5a6bjucw{3a8jwKGvTHm;h?nPX7H+K2;gRnsAmLmGo{rt<#ID;9e*n2W>MzG zR9|PIa$$|RqHnHe+u&wD;I0AIv9}+hJ#cdtuCo?06DYHzq401sG;qh9bIH?laPU+g zbMnI0nbjNkOnCTh8u(p!1iTsq0(b-?8U#UK>2-O8a(RSH8-#0kM4B5!x_LwgU=5-Z zJYowCVjDc-2MyvEJQ5EL5-=V~ltxJ$UMZ4BDJouRhDK=)-p>M!pCx!@iBCFf@ zU!f6Rd9VND&`6`&1+V&tGG3m2bt+p8uPu!~#+nbjS`1BE9DLdWP1!);?qlO(#z%3FKyDV;WKD%GU(z&;4^t>GJ)}#qCib?_{~V5W>oy<3{Z0pehUGpg#^E)Jk(O1-%1y1Wx{W51GRR6 z@!NPoZ36ghBcQe*e!DcNT`s?UDb&7(-=P`m(9Q2S0Ck+;cUpitZSXrEK%Fo6T^^us zU%8?*yW$AAkubk3?4d63O}F`*iGZg~v!{!Imshh_fWY^N z=II%|9jt{1%%3D>Nby@X#Cp69`0U3B(b63(*8o z2?oDGBOHPu0xco$?n2~SLe&MsbX&qq1jB7w!d(O-yjmgx1S2E*=MkbG}V5aGq6YE9%2N)l*Ik`PLkZ%tMg zO3`giF%e3&X-#zzO7m(>3lK_=XiWzRWu&!c5+{3lqviY0K+2xm0Y1VuO|eRfZ1@cHvdlq?kA<63Uvj2F{C{9tAllg10d?p(d3Ht zMMFu9+T8#CM;QD6L>T+|LHP$yzwJ((;C|Uoyy*Sm4oDK2X%{R*Y`2@BKwrL_SXzge zo1`Mgw3n;{6rxK$H?!MIHS|2%OJj1z&rLT?wcF3IEh*p6bc7!5XSw!!ClJEHT~TIx z4woO~{J1|VwKpI~l=KOD&wH2~NndeT5X*mjSO}J5J}OEE+8-6CTUQ(@-1jaVmHg*0 zHnWaJd09!taRme_48X7MhcTZ(8t2~|ut4`KPO3ZZpVL#jkXcS^dx;%R>jvp7PwPkd zPfi;q`n7Cl}o|Q25JVh$N1eJ*rkQm%lLuPA~u9%Clbe66!i$^^w{@uKLNnPOk>2 zBUrBoY1169hZsvC*TbyMr`IE#1FScrybF#uV}b{en{m;H)0+uN6t>$*84{=4DFueA z+i4Ynv)dUBdA7S*9bKopxi2H$zFBAGabIsvoyw1i@rmu~iE2(*}F#g|DJCVhadM75bR=lwiHcp4MR$q2R7QjXjpJ?#DzcmR#4 zFTJcz@Jwoss0mAwl&r~oU@{VYu|#1jj+t6tdMcYf)wQIQvnWD_D_~xlw5a*h!wox>ZVX1^ERaes<(pLe4jEbN zD`off`WVhAYF>H~x!{|dRNgaV`L#DX;u$wr>}6lk3-Tj(K&3>g-}Hw)k7|~{T#206 zv1*c*YQBwX+0P;ijY^A2M-z4m39%DRP`p}G6<*eYr=_xKdcKllamG9DBQfA+oI|pT zu(cD3E-U<47iM2gaMW;~h%|*_uQZ=K|E|8Ah|#w6dCcCGy)sq9l59i;92NV-QnywQLG4ECi$H%{Ys`3Y5_qy4mooj=lg9Djb6@45u3o$>)Mj{Y`Xzud8 zo$+SiM(5K-QHdS9uw8a{8zq2H;`f}x>i47P1B_Nk9)ZYBN`pw_4sJ=7_U!`rPp0I2 z6UR_a!LsMKnH>-jMSEY9mR$W;4i41f2W3(h(Zk>zpXA3`IoriaF^0M1+vsX-Ce0=^nNxDu=?iFTBM?d*_b^U<JSf|HekDnS19 z!oJ^HD7_m!Q8>v8?p$1`Y$Kb1Jf_Aws`B|a%Km>tWN#&m_d<%BJv|rw-FqZBnzeTV z-2&(U<1h*9Cj!~}L3!&I+}zvXP@_=ExL-Jk(k_L;_&8_dilVv=4S72J@er!2+aCiPQhg~=eODSCB^irMuZAwAh8h;TiV}-hss?uy zgEbsWa1;wFjU_r##W;#1rH`dBk0U{iTceBnNFPtlO>i1Y+5ruwzKn+y$Iz$6exWBc zhwXdf+dFM6;=r@}%a$mIwM0Gb<4h#sFqP7YEG7up$Do?WaB;>eYQ`aP$E&u+6T8KK z2umU#PGTrcqTx=$LAC#ds!k!1gsYi+Wu|5(mCWvzq#qWiClzm>mSp&lY#x?kW1i$T zoZ`WqV&|6Py#(r0O~o=uMe<8!F18OFPDRX1<(RfoE=eujOI0#U^SVz>LrqH?wo0Wp z40%Y)UPvu0O)EM|BkM`aEd?bV0n514i-|H)TGRDt(yQGvG9Eycs2L@#soEdyeQ54FCY8Nyo;|*l-9(gAN}sbDmfdlb{b?&Jk3M^YKK*4l=SedMMxP7kp8d|^ z%{`EbT$YQPo`qqNg9XVx(#(D(%ELv=tlj#EU(YCV5yLW3sUe4ftrT__{stlMk^H2Din1ugl8#~vM7`Z zFO+^Pltn9&*TPd?E>uIqR!uKbf)uGN|5tl1TJg`3qF=i*m0x~*aP+`1N&-$zp|G2yO($!7uh|6f?;JP$ZAk_=_P59(v-5&tdY{xM{w$6X(11GpgY)|q0G9hEMuh1@VLwftvvb|2$n7{ z4KFJXFRv^suO2C{Jua_b1~xKOG+UInT2!=!S9FwBbd6N>i~#?jRrX6)3`$oHTU3sQ zSB{rePC|gw$Ca}Tm2(VL3({3f(m+9X2CzTyOJbW39ml)v4CjAQ{x6=hcCF>M&rewb%yrg!Xlmme@SJrTp61 z%%cU8`GvR!4eWjmxcLpv;e`l24YG`%6w7&)JU}XzAa(6hWTnQT#|E{w#-Elz9m`6+ zh(>+OCPR`YMAoKVttPFECbPCCi<2e^k0x8jW_y`toVZ3O^k$dxX6&A356fn+h-RM? zaKK4(5PA!UqQy_9CCsuVBBCXxyd`e5MFB2oUMbN+$q$=?g%T8S3kSgkMFT`2%zhA2 z3SHHnR`ab^P#)wX1w>Sv`rZ!2UZP36|Euww<2zuRATkT?7$6Q9o!b%4wjG~>NqElu%V1uM%Go$mctrOv-168O9dWj<+1Vl#fm70ke)ImMy!Bw%f? zn{4ah$LVrb>I&-l(^T-sY3olZTpw2^X)!OTY82Q&LXytmOl$A*#E8w5*^LacNngSJ z;t52p>7%pn$BgUeWbF?W?nBM%5svG_fE(c4>POk?BkmaxvF{U~?qi1Qr)TY7GVC|c z8z6@OwRQR~g}dQ5`{*(WM09XMWV_zM;)dY22ClU;Ft&y?T!C4}14Qk>6{NnvXHeK! zKZQYO{1`A&r(dgQsNgdIEDI`a$3go(z^|c>Yf)Bb)*(mqi3!&qWOi+O{)ycBJu!+iwOY*%N4-5(WiLEHX+JSN=8R)F z{HN9^TjvYFi_oqD7m0uB@zWGt+|*v(1n?#BTihf;C28|BkwE(hq@oRt;wRtplq-HW z&DNi*)o#575QQ8NUv8531Kt2iqL{|-nbQ%T!=#u)gqsh|nu~~ z%`1-c{#nJbC&ijq&qh}F6Z%J@#=|kQkll?+9+_KvAg1_+c<^AHn?YVs2o*mD> zoPLY&ph>B?$?7Nq4i5%1E8Nx&yzA9ErOTB({(9@Uej3Y(f2%kR-7RwQSe3?ap=}fTHt}(BT(g?58>4IdK)(M6Gj%Lkh8mx=LZAj#=FX(RE zd2K+mHXb`Rp5;VtFo>_BfG}O`cjwrXnfQo$q;O?47P#U+YFuCpVzmUz457-iCEVOzMX@xFh?y^c0l$! zU-Zc7Y(5HNu29C)&ReZn&P=%|E%X`e@?)|f3arsg&r2%l#q{rd&)Z?n+ug}qCd=E) z+}e|q7gZ+PH#=VJ7vw=DVxCWoWNbkCS9>Pjp(V%d;wNOlZ4A1Xd}-e zgU*p^7iuv-kTITtg!SL8oN}>R|D7P%k0uR$?M({VJFCLKIX`=saE98m%glOy9JfG9 z>4=~}g7OncV|B5rN)$?S3BU2Vk4%Wj=MwLG>6#n~-^uJJ&?>L@I;qX7{PTMydZne5@bvADGV7Fv5H~O~U)CBKLeD2J0?ks*18h72<{Nrw7 zzWYgWZ);1Ei1zQJVSQ}$t<%Omj{hlj{6Ft6*l2>#R|+Vx;bm|a)L?_sdJ-D@@gZLD zA@S!!vd=?m&O>_F!!t!4-xYMBP6G|+B4>*#eDXo%`l6)k@z)=0@Z@8SEoWH_Wo`_o z2!B-s>=&mhc^(5^m40j=?H+cG@uzxm5(DoUM z1-j^h0Vsqvh5QjQ$V5{Ww?u+5NCg53m9|C0@tE}bQk8bZqe=O_5r~v`CF7~(vd5rU zd(z36QjLK`D*LkO?AGgjY4wF8{-}-2hgMf{*~q2C*X z@liZe-id4{<7yrs=B#G(gK&IxkN!}gD6)qtC+H8hZEJZv^>(*kvQnxFZRQv7? zM}t{*3CL*|TCa6@!I01ZP`mB^sE-oaAI@a_TEE#49kn(ju1_TW9L&~zaz0<{@In5l z_w0JLH$HpkruX80ced6QV!2kpG(W>#jC`&F@A>-jw0-|Y2o9O5M(7=uD2p&6fl-Yx z^2b0H5meg38WHp_eJtNGICpElV+kU#ih?AlYDIArL|Mh~)QxJz2z~~#iW8X@){2wZ z_OVKky6o0UeDp#1DoGJSRVPUqBl=Z}I>o3?iZ&y6>wDQ}b?}%$F{N zZ?dd|RQ0moCPlx=u`d|a%W-Z5ev{`uD6E&~{nz(Rf&YHDUO^Csz@{jSOx>XP9ZQT2 zrX)sS+@K`!F^ElBingdhS>{VWn~EIgUW1B)AR_w@B?;=rA1VrB?5e8j#*M1#KZDrS zG);>d)wFH<+0}Jj_8QfH`XF*>7=%zaY5a;2cZ{%?aYrG6xqmX<1hHb7)&P z?=@-Lb|G@=*bh=S>-?S+LzZI z0PSFIlQh%fR+9|d0dCVQm;F}L93Lbev%C-*h*?35IFEVJWc=i0aY`_cMJc!#0<$Qu z9^kR8Y~F`hR(B!sTGetR8Cum(it}1GE||1gH*W;D<$)hEd2QPM4e;7_-0!#9cEOPN z?0S%W%58eFB>3$62~6AV2S0}JISh*-2>GW-#^s(4a~`z+#*&gE4@023Yj>PgaH$~$ zEDLuyE&Tkb_-oM=+~Is_)XeX)=2BfnzUqc7;JT&$gw^@1PlLUh^zH1f6apxHb15lGC zuy^CaZwiEIhzM40;vxy)jHo3H`{hPN6HVGt-z(7js)`gQARFv{5}X;yNsLdbb2K7l zZ=4F-4_oRJ$)zNiw7RCm z_>jOR%*4vdJR^noW#fumVSR$Qcf9olz@?QN2IsIq+F{(7-y-Ru#eqfP0g{814p?YP5 zD($=euzfT`^~g-yV!<`V&#l@fAlH0-A!* z&cdACJbkv;s0vO5utTJ;7Ny71;t77av#AeEW57hmUWZCpX4F6xW-LRptue%7^f@H5 zQiBM?dX>A!o@R1i#mbC$-TAC*7U zn3t1KoxfepSL3QRam@|6Xk)L>5Gr+0=6w;rVUWz!SRjAUm3ATeq>;^{)`@KY*%#4J z9#Lht8{fX#QU=?AvzCAr3m+}m<0@f+XQ1nY-1{J@8-pq{C>7Otwea~0E-p@Cj}EJ? zyjnW}PDEkLZ?%9DN}gl~LDr!Txz}O4(cWyl`Ca9Ms2QKfAMdrlWG14y*T}`SEl#b+zA)d-Z<1Jn5 z8gQE(o$z5EKU$bmK1vjpH}Zu#MWi@4d?urImWbVAbU0lU(*DM3gL;S+@05umaZSFb{aT^EAR%0%$|^6rpJd0^{O)u~|G|t#znY$7 zl9t&kifMiN#7DL`KyMKFw^uviC82H;c(NXc= zM`lwde70)K;OY$$s-_(ySm2F>$%F~AeuoVK{-pbMM1=lPGXKMDfz9q2@sfbT?-AosG*_>iVgI#qIRPZtVSsEjwq9q zC>J=`(w`&oNBgSYp-p&vCyhjB>qAw41I66< z*42yUwv=H~MXR2EOOxa`en!&@jy$}llN&A zqiBzgGNixe?X~Pnx!q91rbMP$3$=R$EUY5Y<$X^UBU)r&E5MRO@RW8G*dLdf@S9Bv z^Qb=^;D3QVoERu&JU#d~RVrU-sIe_nmF*AVvjkS@Fa#=9L|EoP6_u;=KHmtdurLf) zdBl=+q-eDzHF2c0aHOnZq`YsW;_pc1?#Q&+NEN~;|AX}4VO8SwP>raJrrU_Rrc8s` zXhYy=%MW73#8F6tjM}hpd=2ug$gl#DOy=gWTf0mLZ%Wq(+3XDJy8!B$g>VKu#+62NnnKRP4*M#PQZ$7&2Rg>3BEpqJ z-_vVvf%-Kmg6b>_#qcj_&|k@0rc z)d-2x=Y+6up46eVh}j6Fkfuf)zOLP=kXOTVI$wGLN(uBXi^M9pg0mFCYJN6EYWBIH>8 z%!^WP7#78kYR07IZYAL(CP3(^{8vZKwP7N`RjT7z{$x}tvqme%b za77Of5Em7b39X5CCq{a%u~rUCAk|9aqU5n$F%N2J$z5(osh(;_&Bs%V<*IQe?hLS7 z?V{6e8DbKhTmG~r;6Kyr$+(=&Mwcz7(yy!*23$3Zs<8Vr7^R{8_eI5|Q7w^_ikBZP zYH8IV3B?UD42I&tm7rMabhB8oh?OX#!m0aBIB6~Ck^6Zxbc}y(&ucoGOT>x4*#fuc zh+X$Ee|^oDuaZ=k9WQTA4lNs{jOb4l?$?cTxW9fwt+K=$|8!BcAUZh(=$lciH2lE* z+{N3IxD<+|bKS7LC(I)Zw0zOc)Rvzj4{s)9?E<=CAqssSqLrP{axd%mr{gGfy~}b= zV2ln_fZHZmV>2W_9;fPkju#5Pi4^hHW;j$oh%NMo_0OOw!t^~A- zm2;@JTG`!J;jDFS=mUHfykWJg^Qt&ek3 z^C;%b>-+t+yFsXd(z_-4MzkH}+w@+il2N;Y?KUQJwqeae7| zD%eucQZlsG(pjxNlvQdXCYAiqY6TtrkD0K!S#GRp8A$XO2X3^u@q7ENb=!8go|pA!YVo?93o%=lvY-)qQR8^g_W9ee<48RkluZ`^+P4YMlacQ|)L> z#`&;f6JVYVD)Z@dD$+>}{z)y(Ngc;Yz4*yM4Rw{;YQsRmn;OZ3-iV3XusJ%Cfb~zS z{QHhhapd8H&Zd)Y{L>zq(_W5KA)1}xDU18ilW;Su3b#|Gu+u-xf5WC&K;b|4%OpCT z2Ny1y-({RKDIMhuS^ZNDjd`@}Aru}lIh$7_4|6{I132^~GPg`S`yFMy$F^$wsTWp_ za+XGCzJFb|K@&cWgiGGv^7}O`o<@J$1oZ$DXJX=v!;2!YK6-VAE+H1S*Be7lr!I#7^bmZpC7A1{L*Gq$85qy^f9<>~__INCxjt|K3 z7rhrQ$yE!DW^EWIg76MyTq>%XqYtkUf5j82kqxMFB5rm<$-4TQH2S8VDS zx4|e+YS)}T8Kqh%9I$0niUSGW zo#I1pe+;HcHe-JS-|BoJ8hOOfQ#eM*zivczUXXOuHBF%ByfdOD()sz`ME%Y*hFsee z-Fy&sXc!n8-VBWx zghnnvqYj|a_s|$*Hy0OZEbT))=R<r!M5@ zZUWDgpZ7hS&m}!Eae~kNV6@LaaePgmhbGfxQl3X_(+tQgMi)Hu(`FghpC^%DrU+i9 zX3ObzpMQ~d53iE54iA)}stJ9-v z+NoTT5Nsxk8@ic7>6EY5$2atUOO(ONl@_-Q^KVf;hqL2b#>E=L!FbZ8vd_y677KOO zCwEM%Ee;1Wm6rF+>+SCMS7#^pUpBk_k#U%f)cKV7UdovpHd;y7Q0xLlu~J#k)a_J-hmv3cgY z+8s&xW_$k3eRDViR;jjm;ki3qZvOr6{Dl{Ku|1gZ#rBo&@#c7;-uB-s|1JR6#lGxH8O?p%LK(yV2&Ie_M&qW66C-w`ikD(& zrAm5QewA#?>%JdbpRand~WMM+xj^u=iw5PEQy z`y+ixUN{d!X;J#yzvZQ65Qg$f$Rk5V?FbKJW#h6tV^!-hgt5Bg@sY8n2W6rPWz2a&{+r5Ba4o#hV(?=wpuNQRHKA5Ytpb%4mS zopq2Dou+1xB7*PhFm;CK*Ae>i_OGKbrnX2+k}sot-^STjJikqF|3Lx(5N<2JO$nn% z?SA=A;^k~Y5VZsEm?N)->-SV_@P@7f&veF89oA! zN9A1tPiJi~f#=InLBW^X6(7M@*uzPe;M-{+Oc3ynt{V=!#utf?93H2n8}Vz6AEqZc z0wrA!s&b7#emgnRw~`(VhnfJgXL6M9biJVXnm`&p3N)3HUc9=RAZAaB_rK`=5Y5yC zbF@=n{x11LdQ}r5@Js;=pzEW+t_>CE`-GiP(ntNZHca006K(-rKfQ8oxLW%s{Q8o9 zCWqPxz2{Gaf9M8S<7*>L_$Y~IO9t5MYNKpCDL?Gc4RX)aMmx7tl3kY!@?X`)ct2B; zzoQ=##;%JE=A-(AQ#vH}wJt8&lZuLxeppJmE)u3Vo!-%i6(Upj6rA`ZX$OvCkue!@P!K69V%0NUg`;q=y^Klh~N zYnEztovF{hYo`^s)|7@E)#tdNqx_%veKg=4(2rvJAH(mdBs^$T%5;Y7ibhjdevM>G z)fbOvaQ!}B9j*sY<_HC#kxDm|OczKdFzAjnl+J<`3#7B88_VX(HR>(aMjFc(s`dYb zlgczzEY+LMmg$bZ-7_`Y?Tlo}G*_*)xn3WyjW$WT!>BjbQoA!4 zODU5r+gi6bn)=OheXON%~9y;e0hRipKMHab-`c&B)Uys1bnkiKNOmhP5<{ChyMZmet>Q#l5PHf zhTqF_9PK73{x|&Id@o7Er1Zbz_xi!~`>96%BYsbRkm)#Yevsw5|KITYgB)KZhQr)I ze2c@p|2zD?IMey~2>id+LUX4l`k&(Wjf*D#QT!f&{Q1A*_b9X#|B2r(npVHut-Abs zx!(-=@(SHev3-3w1XsU4o;Lq`eYzO@|EY!c{{p|49OPNPjCLI>AiEzL6nMOh@qJ%N zjx04KLVOh)DqHx8V0cKJ=PE8XvXF{aYFPRWzfT=2q~RPMmUq8O$Za1I6nP7ZrN7x6 zWQ!Qohey;PS4lOIMW0QjMzxl&l3T{8RTc9`^&YQMy5ASGgh-7U5?`kd$rgW286Gp? zxlWskEM@~sjaz74r!S5bb2JZ++qhq6Y`zC`4N6Toq+e$q%7S?oh9{gM*I5^lV7>#X zN%!UJZ0HzR;C>i3>HT<}1HdQ|LYAKLC%(x=kt-1)7?}#@xyb`Ym599-YTa^+eJBlAs=+e*8ra-9R|1<3MkmFsx9-u=iz=i_a)FGhtvvdm&H@m)=*T!kUQ z=;8p+U2SYsg%PdH(umewUFvv+3Fqk2g!^56E=Hx9gv|0x`dvebT&0Ej=<+h>u@H0EGj;!p_EVO=5Wp-p_SUZw$ zfXoM({jTSo{<)dlhP`*@+#|Doz-^5iUiUAPl9!33#+7%{WmWSF&~ z60+Oa8C+uRe3$I372Ei2(0-OG_3&S^JH#u{0j`PKXqT}avM1=EP}NLefb8xkl7}Hl z`MUU&v0WP8hhfF&xXQ@)Ug9O&(K+ls2FnKV#F8L3`Q+uEB8jyE&WF52j=6+GUAUG891k6q-jY4_u}E z9*vdXu?}w?Y4u%WO^Dp7A+HSD02!z*Vf@tOOZCD;bW;OZ?#x2_X?by?si}GV%*Nws zWfQZxWl-+iA>(QFP`(+mFn;db_Ox~p-Q0d4_s@OhX&pMz+<8C#&->|V1Ax`ijVyoR zPx8Epq5!oOI;9H!IJy<-2bHF(x(L^P-X@%E8Q`3_jP`imA;)SRl90cO&v@RYgDJF* zs83uaw>|H%#I%l?%3r6iJnwV8X**mduCt$>4}`EFQz7y<`6Mrgk_wQSl!=>S-j^fA z7|36+{B4=`%dy5JWWIUgw#wt>L?5edaZvuQF5~6YOrdRgVdAc-?d8larfu~={vNXO za_&0Wwthcx-}&_N&ljtG6IlV;OY(XVs?feoFbN&teZ7p0X@B#JJd9|+UZqa9?{iK* zOnAIr=VEmnN+>+eWW3&#D0CdFPd?5Q1aDWxbex(hJT0%h-nC42oV!dutv|iqcVl&4 zgeW|3lfa-u3Y}Lelh6CSu!pIb&Kt18%ds}>adEQqt{E%O_&4ln6RYb7bWq{-Dg*X> zsL=JeF!_4d279@P>3Tj;fIY6jUZIm+ulJL%*Qd7~aLCew?~9<}i{$EylIn}r;(M{D z{~qcKB=p1P^262e!*}&dfVU>V1^y3rj%WYRqO<>b=lH+%&^kV;?*50sS z(b@mq?i_I!1e2i=)I4!v3XX<21<)9J@#%1dzI@zL4KZd5Q238$LxMkt{a@oRBh}e{ z5l^Rzu{Xs*T(oh7myF8N{Bp8$NGuxlJ^fua?;er zIs7Q3qR^C-CYysql;UXo*&t0y zEBGp@CDWMMvUODZ_$s9xq4-OH)R+NrLSlz#F-wxBtO*%TQj=pbTV9&11@mnBc;Egv z<1{%Nn{VmMnZ=y_s1x?V*O~jWrrZmfa!ySNSqqM)d|OL$?%vl~&`eW-lUCTI$MJQ} zbL4?ApVa?1L#rS)Ht&CNXh|Z!MQ8u(&|<`U*%ECk`@bGqxD>M?C4AOMio`;4wK_GOnK|FSH%V*}5*YY5S(9bnFIIdrUKKTu!KWoHbT^ zZ)E&@9cb>l38K`@S&UX|@Q=7N3&L#@LK`J(=tjPy3jDYnF2}OiQ%N4g^kF%iNrx+( z2$Plm>uDc+4788J+t8nBRiD}UO~_Zl5=j6tM6zuu{Ayz#$zSmcGXcKm%Q>qo?Pr5` zDyjX3W3>V3Wkw7%u04We^z;Zdh}F@HWJoA-uPzZb_e)h;4) z7L624Qek5Xi2%T+j*VRVc;0b z#aU)TkRcuG#zOsw|NDExMu@Uvp;Qts} zF>`P${^T>xhVTgFejs%H8>WNp17z$+>MDT?Z&J#LH^ zMK1#W^{Ku837xA2Lxqv_ie`L*ej-s{1251z{KmqV@-|ODdWUDH@hoYtjL=xq{9Y{81Z& zVfvm!1VOfDK6*nw#)Q5dw19Ulisl;1Mu(!ZC`vyx{0-IISAyL$VfUf2gkkYqVTqE; zVott6NKQxu+JM-QE|yT;8}zeWF~yXy!W73e6hKC(WIj|(Kwa!4MC>mOV#zLA7M++N z6l=a%F=xn&ra5AO=Iz5mR4oOdfEyum6W-+;Iky)~dSC^n0)FK3-BGg{mGqD^iWnFY zZ6yrfE0$0}3f2A_Iv5(I&K8c%uG{PzO_mZ~USd7Zp*| z7{#dc#q4WDwwOg74p;!zl0GnH^K@L=vKm=;k2qaCh`W8*K`{+&>q7yf*ZVXkFbz$slV4NOq zG-6|P2|^;lQruLL`1>?TaAOQ+nvNu@-b!F1mXxF%s#pS^OtWaqZGD zo0}w5y!ccjr}I=f0drj=Q~)oL7*CqCF?WpBpqGAY)K~6gBgYh7b4jx>MT;Xzgd@?h z76qr)#6i)d;Wy}zz%4Z~es9r`{voon&jSb*SN9Dj41%q~_3vSH0&JR~ge%GB!Z&XE;A2Iy*S zUF6ppW~^f3{ay?WRng%~v*;ZV5Zn}h$LY>9=!XGo6`j{~_$6e#dz9%<;D|C8h2f@O zX_r--gy2zZD^=qqMGhww>puSAdvcVq_aM5ol)+19@{Sdlnt^3H1F)gFbEmNj252lE=`hc}gpKrC46cHw8-|8A~fp^0?=t85*P)A`@4j+7-C9 z=1G@iZAxWdq58)iB#91{$Ooo(AsjF&23}W&xy-64brC z^K|2b@W3M;?-OaUyT?+be$TKGF-H1orgTL%hJtM#rQD%vL$q?I5+{UVvniyOiap)MKZlq46|sCMRz%dS8V3 zBGC8@ySqwh6*1E`l5>HL8M75L96ikywX~Z~hvUGUHu#z$$H|2^;$j{r?mov&wR0^B zyg)~Kz%RRIsVUI|&DJi$78M@gdRXyeN>lcY7b>D7JzZfrVKa=QS;;ve;3Sf0Aq*Un z5-d|W8|KF-*|IPI>4HYLKZJy?gpry;Y$V$#C5nKhWZI;?AlGmn^8`ZoT!NhVV5uw4oJ;U0cLXVQZXz}2)~ zp#^$yAVEBG?w25CP>6DgV#tx9!I4x%gyOqnQF!}b#Tfu9%l4G?LbzOnZ)gCmi>8?- z>ny^ae~TWdfXbO-2s{v>-9u3Y-`M#cy{*OihS%nuRVEe#(C^5kkhWW#B)Vs%+yY z^(sf{KJgFz@{E1xW!;JB{a9iUf}pm@dgOM-03AKB{u!(I3Ehev5dbtUl5Ilh@1!5mGFbi1 zq8^IeuXcE#dE)&SNUIO%4AKdF# z=7;+})E2-(#ArR@i3z8w24^}$jaA-WNl073eA?J<;PKD-+)<-DDP7oh`iw_vvu#SG z=o54uQ__*`kjUT6{H8}z#_OeH1LpP4U`77Ll5NfTg%6Y0AF98QwqR$?Y|-QuqUY`?%hAGC)5N55Nf4Z$Um0* z@>_b?BAZm4)l;#wa_F9M)+^P<#yeyF~r3s4UB2FWP5MO zUs2duX6xzDHvjsr?)rX~iZ6Tgz-Tvca864Ut#A|F*fGIZbi=3AK)cY!`YkcC5?9@f zD4PyAUeOr|p7|(k|6aUn!QILODVbKYToiqQ`(U)PdqaD1B{H#H+tEhVWJC34Sc5ID zIA{{DYV-I`EGA0Q$ag~@VYcam9a2@&X94j$A(Mq6+r;7O?N#0J~l!`?5=50u5u8 z-R-#MZ4R5%GFQVk0%OgIqs~$rYUHSd)r@q3edhFi*&oO1RNH-hE?X^ePDe-P8fXI< zfqf_jN0$0WZ3fxV$8)ATrh0v}nqG2_iGuQC@in<2N!y#9;XnH};}Ro-{|kF}85C*Q zE#?}B#@z-O+}$090R|u3VQ`1R26v}%cXxMpcXxMp9lXQ0^X-$pPm+pMa_Uqn|N3Wl zbyxLM>wT_uBcHf4p81+f4o-%q30C)>59H&Xs^DEJuwNn({W#2&BFemE%2X%6yjH&A`SE+PNcN|rB+*h~!ztaL$Q0YmEDvD;@WMC9OPYZ&%u!JjU znVBOxjU&Ovw5Ovumhxm4_e$L{vxg}7!_YMrmCBn7T38LI)R+m8Xx4utwm*`u8}etiI)_%?nR?2O7S;&lhOoF;w-*C zLu@~ZPI|TtJ?j6`k7NXskpC-SdQ4U5Tk+#>7$`R`V?VE|bpArJ@T=i%S^Cww8(Zl; zsrZZ4MH-7|E;L%ndPf^1_zR=@x_J8Y-ijB5-9ZN51Ja19JClcG*S#14n4HuzqwK*w zz8HSe(uYL4wJ&jra2Q33~vxVU-%_) z_2QyS6ih+NC*J$xg8Wecr^u=3KX!>(2{9`g@U#D%>A};R_*7Eqo}H2#r#@zKh1F+@GVQ^%1O6Y`($) z8j%20<2~AJ{=+#EY5%Kp)PA-gm;ho0n}H+6~_p$8r8JK`G8aW9f*+jZMGZoN#ef4zN;K$ihObJcx%E3+seiwuMy z+{jvWMv^_I!VnQ(@3b(uSNo@t5Vj~0#ipVUA0}jDr7t5FhAn96DOpW9p#zu6F zC1o6wAyw$kfNP)X#4x8X@AX$lBZhn1%(wpu&C`BG%o*2r{4*Iye+wGMauvfRAQL7Ha&b>iJ?3$Vod`X_f$St~n-m{AR zCKKTyJ6|YOVY5LP(;&BD#6O)Qk5LTxMW~{UBm%LDKQpkAOdF;3C`(aJH%7k`USOC= ztACH0PSJyXJS!B_Wu-n{Qo6g(&q;2XrqHg#^!O`Mt|Vw<*~#gt^wIVKF9+&+HhQGo z>W`FpWa)>}5r{VypYx+VP6R%#d)4x1uKuf3j;dG8L}Id9h1n@EUNv?0bH#%&Z7(d! zTUM!erzU@?U8J^OFWwd0h5uVmD_NZa*k@9eFQ zof*ByrWGH^#K1vlIG;RK2wXy^IfW(O->A;O*mxRWRIuCW=?jK3W$Sv)i*l;b3fl=f zZyDowNp?E-a`(v2+~gkgx3AUlee{jfz$hL1ZhuWU{TQY$qI3|#tKf;&Y_-kHgf~y|{G|&~h_d;F$ z=cG6_fKp0mTyL{sVl4^bjoyPqRSzTy9>_85N2j*I1XBL`vc-bT!}w4MVn=>ugO+uB z&QbH<49%rU#_H5v2odt86#K&myIip>y@y_88l;k`PyG$)cGQaPxqGF{E!ppt=6#`A z*HGJHdl``=N~Jj>y*SPOe~iLl!6Sk?4@3tOg1&>Btqha%NJ^>B#wPU}QF63M$~n!( zU92D*mD}f(e;Xl#7giB_YJ{fAhj+~U z5QZ{bXvAoO5re<`n{qOw^7KF5Y&>(P@I8LZb#pgIg80#LS*7YZjB*$47{-Bal z3h_$JJUfRoS^A^a$eGxhGH~f<^BT5}td>djaA8|eue0-!&^-1&G|4zB+n>7>lL3!* zyO^qTCsn3%5=alGf>(puP}YW}U*hE-t3A*=ly!bi%ctK0b&4fJ!Z8SOVK_1Ogf#Du+%SP6AKLv!Xu`xynT@Pf_PIM&cCHVw3gHY z#-L~29*ycogYGd@8s+MMp$QXtrbeGF|Gb^iQ%=k)AI?XnSN*tRoQJyAk)+{#E?!rI zK}UjIGKHgpJ1@n}A!$-e`_fm6wVP+I;j;dR?SzTHErhhK(>Yd8EbXt!6J4Qal0qeo zMM~?y+242-6|7<~{_`*SfSmlz(_=`8H|&d z;KSY+9jf6apoxk0E&(;DEH=Qrxn2hEqR+~X%AS+mZg$J>xX^`1+ei1gUQ-Uvni+PD z`N)a9Rbc*{mv4mlA=$+$vKO^F9A@L4tffB2J{nrdgX;qT#(moBQgmcL z{=j`H_Sc!4rfnF~aQM^YoPWyg-IV)_;V}2Gjd+CfvfefC+Bm9xCj_u>Ni68VFZ;40 z{uiO-;=p*j<|Zy_$m5Ws%XQLu^DYavgYtW5T!7<9@~%P>gG_9I;f2vffa{UasE?av zuI{&jEr5E^<>zGukT`$59d5rE+0TH7Ouuj4aI|Q9Uk|>-NnY>5H$-k>l+cSobpM+3 zfP-}Yb|DIH`hv^`OA1~j{r=Z!bjGO@^0kJU^T#j~-jyNBX!w5UD`N`9d5ekceX{P~ zQ(6Iv;*O2GuOD|EXLH!%mV&_sU46+Eveg*Bu2BHXJU#BM&&z&{q2xDl5Vx;b(j}d! zF+Q@>!ZEqw4BXhY;JjCN-MOrSGi}n$wllhKO~=JRFe>PrQY5^R0{F-Jd(R042+v!UVl&=dsEp#36ju z#w(%N1Y8x@1p%RbzR!W7%-U&ZP%F#sn1E5s@+ZDad)d+~C!^NzhMNQY~Z;FMrHGwv(K;8Y&U*&aM7~jFB{a}0wuL$S`>{N} z!|#fQgTXJ1!BMZ5OwSE@?hkq04|zik`(R4M018sni8A%j3c)i0FEQ@b(7PpR$tzI1 z01Ch50Fd!Iz(zk+zdpqOob#N72*6w)VMV}v4j3~Z%n-Aw@b8hZBp*4JMsnB#0Iiz3zlaA0Bt>^q$K7}L(u}s_O1U|v z`;SYsy9|4;U#5nz^;`PDi z;ArSQ#Risw$Zm+Rny57L0911TYuH$mC`$b`T-k2zY;*LVxUUE?SdHAn308?<*VN&{ zV}Xd$d3K|K7nxmvY`qo{O>yuj!O(P0_{MOWyi_l^OoAJLWPLUCbC#6HB022aUO}A- z+Tc&+J>HampL6|D!*7`1vQix7URs#umgH5}P)A1yB#H6-n$vO5Gr0NQag_tw{d=oy)>X#~TB2Qx$uGhd-+iLn%;cOo;ES=`M6XG<71 za#_E8&vVjKEKr=Kd}m&6VTHXzpyQ}z^_|@$O{0roW_UngE>OHHrTDE}>gtCCVr5{C zKbFu`1;r$qIjOw32bL^!009y(>A zqKu@%7C}q)eXb!{g-&Z$WP!QURasX|nM!(rHbU7zM@0l_(ST5u24hilp`2M@k-ALD z4Pu6Mpjt-YNldpZk|g{ zflF>WYVH$D?iov-(913dY918J-dM{%3rqeg%K^sf-VxQX4dDYTxSDV$~A6Lnhu7vb!M6t);bP`nk$m6lzmzc z)_N$`dpXwo#Mb-8A~V1!N{lCxA~f>EB6Af|YoU;n2}7q^S|b0fT=F9m2Fe~DYbWnS z%v7xG@NWPU)+?&DQv+9XC)WA=H@wYsBFwYqD>fWg{Bmn3BKx&La&6qu%sR(}k!uWT8RmgYgmnvqD_hyR`4{TbDmqICy58%}D-+54 z7c)Wa>$@tthlE@6I$<-Ta5iztI}E=D7Pj6Gwmu%VK!K69V(P(!dM*v&K^JO}oQP12 z%f1}yFq?BwL8{6W+kq8&a87!g-P^z0x1lff0AAZDiAre5`lyrJ5H@<4j60Z(dKjwz z=+0uBD8W1J;Og#t5mZ4B+CggEAza+Sf!QTOHXx$h{ffOy#<+_wXMo4KOEI`ZVzW!F zYCvPMOVhYZt6G+z4w&8EWq90WgxO=l-eacRW8vIm72gA~sqV240+?*}*n{>s68E?Z z4SBo_88Y|yEB6Ez_XH#N_-wR=u#E&M_rGBq33Kj?sP2oJ?29?=iwEuhNZgkw+?QiG3hXd7!{)%#XbHS-DUVG*%HjP%}AD4?56DJkTsW&}ux; z9z4)lJkUKn`1N?82Xm;8eP}>=XvleJ#JGoHd}!iyXc}~AmUw7hcxcghXgPRjwRmWK zcxdx@_#5WP7W>GK^2na^$U*$bQT6DL$&r)Ok#o?IOX87h;gMV8k^A70$KsLa;gQ$l zkvGh-5B9My<*^^`T=2~xGl{x~V5Jk9X3D7-v2jkG8VIxR~)%}_PX8MG)1GE4M|uB^0(O*E+- zgsbB`F(W#wO#H0=Sk_#c)MJ}gGn(fGomF+3wNjq>wOdx%ShSf~bU&V@V4pV>9`@Rt zl&hZiY?{M91ovb63>6-h+E_NKT8;&ojCNWTR$5JNo)=zPO@ExHAY0E8Syu>JM=*Zw z39}k6v{-U7nXs{*%Cw%Tw4Upm9LpV*WLjiShemBio?ikk8%?ebEu*lnrWj{SnP)9JZSEN_O<;cC!I)iU zo<44xJU^PeARpf!e!{rlZTBDoeLoG}=BoUHf=lUosvc!kWT=y~0$x!7{zUcD}(0zQIkp!7I8! zud;LDys4cyBIvpyO0t9Dy3P+W`?_V?LV4>1b4#XnOJRCT>3kb-Xm^W!Yc6+-jB-1I zZEIO+PakYc$8-fhWzUp#JN;qLfZ_mR?6Rj7a^SeKXJ>L?`D)LNW6l$G%bDfC_0@qU z%7K5&f%B&W>(t$@gu`uv7%oEOtQ}8X&*f}M@(Rke9K16Oq|S`Ol-Iwq8}ga zF3n&(AAOLWO$Gn@$vN9(K3aW!G=n{I3bt~-3bp>_Wc>TyME9??iIZ!Qsr%5OXA#gs z&2+@;??0WR=~K|w5reY}Nc->KkfJ9m@f+a3I7hs!r--Geu)j~yIL|TvbdIi4IFIrF zbdIhzy3fh~);U(0V68^#eMV>h-be(SX5qMD!9v&zyV?qRB%R)@I?6FSjEQW5;ByJSlclgJ zqL0&mI!CWepO1_G?ELR{j=7<<|7)BhAAQZhzc@$Q zHu}2%s&m`{@-em?{EKreZDVZvuQ*4hZg7NivtM9{|Kc18Vi*wqOU}{#jb->hcaCqY z<1GJlj&(Y`yX|aK0^dvOz^tuU-w&(xRIj)8y_Wwuc824_UGWn*9iecYl`X8NRhfU~&HF6Z@zjKbJ97Um% zew9?g{Nr*rhTD-yUXnex1?%ldeu5{9Im_C>GHh7q6^!6=;$WM!9`u%Z?v zqn!y=tk1>npcZE4Nur zE*3yS1VU3`tRgnyR|S|bI&_WGuDMaC|a2Ps8r2)g#+;ECfdMk z)v7;7$36n|Er@i{zu*!v0mF0#WC)esVA-|&17${RWfi|T<*NmteKh0H7Y@Qz>m=x` zx4meg!ImK!3O%iB{gR=kdm9_)YkxQpTdr+LjbWD`FxciStk&%|_#)kz+s0{?L$UvW zAG8{<(2*vEqG>Xpm(`}r*V?$SZ)&?msBrG1+q{WwYCjZUa+@pLe5h^exb$T5*rVHe zo^9%U>|pY`E8BWUS2SHcVDf>a-v-BM?uHR$_QNROhGuK-LH1$}Afw*_C^h#Q0?Pu~ z%6E_)n)`@8m_xqP@1n&u_k$<}S%6CAyI6J21B_lQ;fC~kcyrCa+UI8@@)8V(&Rr-3 zDp{ia>Gw%6T8701S!3hM_bJ#~M&!I$pnl0L(7=%2WxU4{UJ+S z%eaXkTk2f-AxB-ygpC(l`X2oe&s@u-Qzu*IUHOr~UCWf$2U|8I!|^wa*6AQY_FRmL zV==bYnMg18d@_a;Nu}1=#7_1?wu%#3ht|2w5BB2k45tclt@DL~9HmMXrz&-=3zc3R z<%SGr8gs3Sjh!5o4i#rQcdbjE9~{;G4Cne7ZOem#oV9Tk=f-SpE0bQF^?3{z=1Og= zi=CW}brl!Z4sC0jA8(w^eGHd&ac%2|f?Tb06_`MdCLJp8GVa=s1VKF0{*3oI7#+vr zLcB(A!21HWjuSa=-uXPnhZ3cZQ`Iis#k$Ie3Wts}T@debALC<9T*tYI5Z~%tQX1=0B6iI3KwzYW;H9bhTnY#~Lb7@hA=p zhWJx_4e(#XU%O@DTG#Ld5v)Ul^D`Ev>=T5}bw9ZLPKfZpeWVAUP_>w$;NVE|MYR>8 z84_9GFh}wTzqrQHeL%*B^5l`ukxKf#kpe>bhbfU}B}z#&Tua%=D=j ztVSpeXndSpj1WmRjK38MqXKaAvB>nrA__yXXoSg=TL>_Sf8?OMycnnH^W+H-`h&n) zT$I3G`w`e@(0u|tYLY^0jBAGRrcS}^DFNGX^c}9^PJ#gxN8!}p;PI2ZPd^)AJQOsf z=;A>px495I)FL1HllAZyP+VEL%%qpKFWL1%g69sZndO|2;v zt$?&UlNZC7Ggw`qsh+3#cKWo?VNz5DQB3zkE@gGf~%gi{5`1Ow@9tz+3 z_9INYe2k?w*R6JOeiC`-1+7B92I__?R1=KrwIjX7PAoMpmxk3vuuksIM7%nu-+7g9 zS^jP~CP(-mfjkp|S%a|*3LX7?*Q=S^hTe@g`uKtny zafJ9RR^w2Z!chqY)=;(f^rFT73{1S*Z$w%+%$7mpkcwd9q;CW)IHI754Gy%lmi7wf zK{aB2)zCyNzk{K34KN!yc>13JBmZPP64y(BgcgktsnCA2DfqdJ=MCyNqEuGTpkX7S zk{F?}8DcwC*18Fv;ovPY?MG7ihoW!5yLLCFf|2FsXa)rD5O zKe7QGvlB!CGbV`UB5-^OB3-dPUy$i#A_$FxjOJFf^f_xokj`zqgVr`Pv*h$c&-2>j z*IEi6wMQ@1qSAT0b$p#&xOR{0^wx;yJWATh>@B*gU&)yS{^Xcz%pi6+rfx4H(V!FA z;1slNI7e`|x_P1j`zR9pY?=p?l$PB8hVNjUJ`Mgu9y6WIQ-g#gMv-Q(hRfIYv0PhR zjgaq{KX2V4)I2GSdfuh^q$g-RpH9WqT8f;uFE4OXb8#5lr#qV*%T6|nMCxK@GI=&I z__|H}Lmo#3mFj-VVK8TnGvB~|804^hRpPz>PM1EiV*WR?Tuo&w}?0~NUgmDK}P zT>{mU12vliwU+~Rp91x8gABNXjMRfnT!PG!gDjeZtd@gpo`P&~gYCJ49o2)KT!LMa zgWZ~gJ(h#Lo`QXFL;Scy0@Oo-TtY&ULx9a8;maYBpr?NYG3ud-E}_ZEp{dQG>C2&+ zPodekz+7%%zB;hb1z4O6ENupsF9R!|fYrERwcKI#>S2v8Va>^5t<7QW%VC{QVcodl zz1-pb>fwVf;ls({qs`&t%i)tx;nTPgv)mE$>Jf`B5zEODtIZMX%MqJT5!<+tyWElc z>XC;ok;loAr_GV)%aNB)k=M9Ux7<