From 5bde6aae69b2e57f6eea9bbe883d96fc48e3410a Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Tue, 29 Aug 2023 11:30:43 -0400 Subject: [PATCH] Whitepaper with LaTeX source. --- whitepaper/citations.bib | 175 ++++ whitepaper/macro.tex | 61 ++ whitepaper.pdf => whitepaper/main.pdf | Bin 420496 -> 420567 bytes whitepaper/main.tex | 1249 +++++++++++++++++++++++++ whitepaper/zssp_modes.md | 38 + 5 files changed, 1523 insertions(+) create mode 100644 whitepaper/citations.bib create mode 100644 whitepaper/macro.tex rename whitepaper.pdf => whitepaper/main.pdf (70%) create mode 100644 whitepaper/main.tex create mode 100644 whitepaper/zssp_modes.md diff --git a/whitepaper/citations.bib b/whitepaper/citations.bib new file mode 100644 index 0000000..a691cfb --- /dev/null +++ b/whitepaper/citations.bib @@ -0,0 +1,175 @@ + +@inproceedings{post_compromise_security, + title = {On post-compromise security}, + author = {Cohn-Gordon, Katriel and Cremers, Cas and Garratt, Luke}, + booktitle = {2016 IEEE 29th Computer Security Foundations Symposium (CSF)}, + pages = {164--178}, + year = {2016}, + organization = {IEEE}, + url = {https://eprint.iacr.org/2016/221.pdf} +} + +@inproceedings{wireguard_analysis, + title = {A cryptographic analysis of the WireGuard protocol}, + author = {Dowling, Benjamin and Paterson, Kenneth G}, + booktitle = {Applied Cryptography and Network Security: 16th International Conference, ACNS 2018, Leuven, Belgium, July 2-4, 2018, Proceedings 16}, + pages = {3--21}, + year = {2018}, + organization = {Springer}, + url = {https://eprint.iacr.org/2018/080.pdf} +} + +@inproceedings{ake_security, + title = {Authentication in key-exchange: Definitions, relations and composition}, + author = {de Saint Guilhem, Cyprien Delpech and Fischlin, Marc and Warinschi, Bogdan}, + booktitle = {2020 IEEE 33rd Computer Security Foundations Symposium (CSF)}, + pages = {288--303}, + year = {2020}, + organization = {IEEE}, + url = {https://eprint.iacr.org/2019/1203.pdf} +} + +@inproceedings{hkdf, + title = {Cryptographic extraction and key derivation: The HKDF scheme}, + author = {Krawczyk, Hugo}, + booktitle = {Annual Cryptology Conference}, + pages = {631--648}, + year = {2010}, + organization = {Springer}, + url = {https://eprint.iacr.org/2010/264.pdf} +} + +@online{noise_protocol, + title = {The noise protocol framework}, + author = {Trevor Perrin}, + year = {2018}, + addendum = {(accessed: 07.03.2023)}, + url = {https://noiseprotocol.org/noise.html} +} + +@book{fips_kbkdf, + title = {Recommendation for key derivation using pseudorandom functions}, + publisher = {National Institute of Standards and Technology}, + author = {Chen, Lily and others}, + journal = {NIST Special Publication}, + number = {800-108 Rev. 1}, + year = {2008}, + url = {https://csrc.nist.gov/publications/detail/sp/800-108/rev-1/final} +} + +@online{noise_ask, + title = {Additional Symmetric Keys}, + author = {Mathias Hall-Andersen}, + year = {2018}, + addendum = {(accessed: 07.03.2023)}, + url = {https://github.com/noiseprotocol/noise_wiki/wiki/Additional-Symmetric-Keys} +} + +@online{noise_hfs, + title = {KEM-based Hybrid Forward Secrecy for Noise}, + author = {Trevor Perrin}, + year = {2018}, + addendum = {(accessed: 07.03.2023)}, + url = {https://github.com/noiseprotocol/noise_wiki/wiki/Hybrid-Forward-Secrecy} +} + +@online{noise_psk_resumption, + title = {PSK Resumption}, + author = {Trevor Perrin}, + year = {2018}, + addendum = {(accessed: 07.03.2023)}, + url = {https://github.com/noiseprotocol/noise_wiki/wiki/PSK-Resumption} +} + +@online{signal, + title = {The Double Ratchet Algorithm}, + author = {Moxie Marlinspike and Trevor Perrin}, + year = {2016}, + addendum = {(accessed: 07.03.2023)}, + url = {https://signal.org/docs/specifications/doubleratchet/} +} + +@inproceedings{wireguard, + title = {Wireguard: next generation kernel network tunnel.}, + author = {Donenfeld, Jason A}, + booktitle = {NDSS}, + pages = {1--12}, + year = {2017}, + url = {https://www.wireguard.com/papers/wireguard.pdf} +} + +@article{fips_sha2, + title = {Secure hash standard (shs)}, + publisher={National Institute of Standards and Technology}, + journal = {FIPS Publication}, + volume = {180}, + number = {4}, + year = {2015}, + url = {https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf} +} + +@article{fips_aesgcm, + title = {Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC}, + publisher = {National Institute of Standards and Technology}, + author = {Morris Dworkin}, + journal = {NIST Special Publication}, + number = {800-38D}, + year = {2007}, + url = {https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf} +} + +@article{fips_aes, + title = {Advanced Encryption Standard (AES)}, + publisher={National Institute of Standards and Technology}, + journal = {FIPS Publication}, + volume = {197}, + year = {2023}, + url = {https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf} +} + +@article{fips_p384, + title = {Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography}, + author={Barker, Elaine and Chen, Lily and Keller, Sharon and Roginsky, Allen and Vassilev, Apostol and Davis, Richard}, + publisher={National Institute of Standards and Technology}, + journal = {NIST Special Publication}, + number = {800-56A}, + year = {2018}, + url = {https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf} +} + +@inproceedings{kyber, + title = {CRYSTALS-Kyber: a CCA-secure module-lattice-based KEM}, + author = {Bos, Joppe and Ducas, L{\'e}o and Kiltz, Eike and Lepoint, Tancr{\`e}de and Lyubashevsky, Vadim and Schanck, John M and Schwabe, Peter and Seiler, Gregor and Stehl{\'e}, Damien}, + booktitle = {2018 IEEE European Symposium on Security and Privacy (EuroS\&P)}, + pages = {353--367}, + year = {2018}, + organization = {IEEE} +} + +@book{modern_crypto, + title = {Introduction to modern cryptography}, + author = {Katz, Jonathan and Lindell, Yehuda}, + year = {2020}, + publisher = {CRC press} +} + +@online{fips_blog, + title = {OpenSSL and NSS are FIPS 140 certified. Is the Internet safe now?}, + author = {Matthew Green}, + year = {2012}, + addendum = {(accessed: 07.06.2023)}, + url = {https://blog.cryptographyengineering.com/category/fips/} +} + +@inproceedings{219400, + author = {Julie M. Haney and Mary Theofanos and Yasemin Acar and Sandra Spickard Prettyman}, + title = {"We make it a big deal in the company": Security Mindsets in Organizations that Develop Cryptographic Products}, + booktitle = {Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)}, + year = {2018}, + isbn = {978-1-939133-10-6}, + address = {Baltimore, MD}, + pages = {357--373}, + url = {https://www.usenix.org/conference/soups2018/presentation/haney-mindsets}, + publisher = {USENIX Association}, + month = aug +} diff --git a/whitepaper/macro.tex b/whitepaper/macro.tex new file mode 100644 index 0000000..1ba02c1 --- /dev/null +++ b/whitepaper/macro.tex @@ -0,0 +1,61 @@ + +\theoremstyle{definition} +\usepackage{amsthm} + \newtheorem{theorem}{Theorem} + \theoremstyle{definition} + \newtheorem{claim}[theorem]{Claim} + \newtheorem{lemma}[theorem]{Lemma} + \newtheorem{proposition}[theorem]{Proposition} +\newtheorem{corol}{Corollary} +\newtheorem{definition}{Definition} +\newtheorem{assumption}{Assumption} +\newtheorem{obs}[theorem]{Observation} +\newtheorem{conj}[theorem]{Conjecture} + +\newenvironment{proofof}[1]{\begin{proof}[Proof of #1.]}{\end{proof}} +\newenvironment{proofsketch}{\begin{proof}[Proof Sketch]}{\end{proof}} + +\newcommand{\namedref}[2]{\hyperref[#2]{#1~\ref*{#2}}} +%\newcommand{\namedref}[2]{\hyperref[#2]{#1}} +%% if you don't like it, use this instead: +%\newcommand{\namedref}[2]{#1~\ref{#2}} +\newcommand{\chapterref}[1]{\namedref{Chapter}{#1}} +\newcommand{\sectionref}[1]{\namedref{Section}{#1}} +\newcommand{\theoremref}[1]{\namedref{Theorem}{#1}} +\newcommand{\algorithmref}[1]{\namedref{Algorithm}{#1}} +\newcommand{\propositionref}[1]{\namedref{Proposition}{#1}} +\newcommand{\definitionref}[1]{\namedref{Definition}{#1}} +\newcommand{\corollaryref}[1]{\namedref{Corollary}{#1}} +\newcommand{\obsref}[1]{\namedref{Observation}{#1}} +\newcommand{\lemmaref}[1]{\namedref{Lemma}{#1}} +\newcommand{\claimref}[1]{\namedref{Claim}{#1}} +\newcommand{\figureref}[1]{\namedref{Figure}{#1}} +\newcommand{\subfigureref}[2]{\hyperref[#1]{Figure~\ref*{#1}#2}} +\newcommand{\equationref}[1]{\namedref{Equation}{#1}} +\newcommand{\appendixref}[1]{\namedref{Appendix}{#1}} +\newcommand{\tabref}[1]{\namedref{Table}{#1}} + +\definecolor{darkred}{rgb}{0.5, 0, 0} +\definecolor{darkgreen}{rgb}{0, 0.5, 0} +\definecolor{darkblue}{rgb}{0,0,0.5} + +\hypersetup{ + colorlinks=true, + linkcolor=darkred, + citecolor=darkgreen, + urlcolor=darkblue +} + +\newcommand{\algn}[1]{\ensuremath{\text{\sf #1}}\xspace} + +\renewcommand{\algorithmicrequire}{\textbf{Input:}} +\renewcommand{\algorithmicensure}{\textbf{Output:}} +\renewcommand{\algorithmicfor}{\textbf{For}} + +\newcommand{\N}{\ensuremath{\mathbb{N}}\xspace} +\newcommand{\Z}{\ensuremath{\mathbb{Z}}\xspace} +\newcommand{\R}{\ensuremath{\mathbb{R}}\xspace} +\newcommand{\sucht}{\text{ s.t.~}} +\newcommand{\andb}{\text{ and }} +\newcommand{\orb}{\text{ or }} +\newcommand{\prob}{\text{Pr}} diff --git a/whitepaper.pdf b/whitepaper/main.pdf similarity index 70% rename from whitepaper.pdf rename to whitepaper/main.pdf index c9231b70d133b24a21c573fde1826e1a3e17e6c6..15213c158a68f06064a8804a1b0147fec4cf58f2 100644 GIT binary patch delta 123456 zcmbPmRr2~($qim?j3$#4Sv2a`O5L1v+w9Zb_=WDPk}j$+#8pZk-)Q{W!nAYC(~vnf z0U{Ywtf>utH8T)4m9uKeBnhw~5rx%E6;*2Jeq)Qyc_ zYS~Qrw3j-4!4*<=FY>qLhAqu~&Mm8vpV_@|Yu??`)Zp?T+F#z?S~g$bY5h$7kT;^f zt%vqjteqSw@heh9^T`5c`AXf8SIZ+$@Z2*kt&e=-z_RV(u9x#4_aE7P^GP+^{afF5 zZ2x*#W&!V|xihcuU*h1%jBlUCd6(zA^YzbsswN=|OypHgr7irpwezJyw?TIeb9=PJ z)AWLmE{ZISPNJ3Dzs9u3-EY$QaEHg0zsN{Z^t_RM_d~`IrjWJsPfgu7fB7xvyGs^^ zUn`z!#9F~r&)THD{(j^#VRrG7O9%LqwwNyeSjp0rvR3+%36sO;9~=0dZRy|tuEP7i zfYRF4oy^UjYA0tLfB9X3t1epa{R2t6=grS+&e^xmQI+_{bHnVdGSjEB!yR*VKkRC+ ze6dx`JpGvUge|_;^}EvQGiKM`oVcUH|5$&(-4q_f&F@dlD9Eo**mHe*x%Z8Es&env zdObY9VBgu-ek-;!G5@k%C2sz}Q;X&Jy($gugA%(o?GtBOP#*Q?%7dA1EJ2&Xm~wAh zu2lH)ZQ7CCTkLg{uS>@rIJ>Cr;w8bGvRd!`_nhiIYb|6gP^mnvoLh=9aqG8hdsg57 zc>a58_I;i;QMoh34^4ksJ2$+3&p(BON*|OL++NiF`O|ds^CwF5lQ|jw{aBToRW$qO zC9}UNv;CQx+f$GAEUnwGt-YzPpl?4{bm+CaI!&KeZO`Ss^}EC2w&50Ou0K14Wg6#Q zad{@zS@q=j`TzU=zT5d=^1pA!D8?9tn^cGkny^3&frq+aK4bnnr7v}{k_(;HLk z?{<7I`Vi^UxpSkABKck9ctefGWMijPMM z8hD#Ot*UA|m%q(7)U@K3`zCvqsiu#g{BclU(Q=z{YC+=H`{%?11?+cDpAjn=%22oe z{Od!0H$MmD8#rmoR_y*%cYO7#lOO9uS{CG47)aKCi{x19(7RFYpyw{CWU=DomfVIVxDrdAvOFB4?^Yk&%}W z7weI3-;dM(T&TDC=xpWuW`=4GivruNV9sB&f|&}R&)jjv`Ci#mxz8Ui6mm4qW^(_% zrFnf>S9_9*|e>;6+FV@H7#w>NG3 zbgS}&ehl{kuFWzL6{a~yTzQVa|JLzwcmBKEe>N~T|6G#Y-^(#swO%DwcH^YpzJs$a z+6x|Oy!)xYcHhL%zVKg#atDu23Ej7jMThUmmKh<+ed_kR(=xaZt~+(;+T1@53&Zr| z4X;UUE;#>sRm}s7k`$LNksTG+|L`6^Bl$WnB3$Xy)xZBw!~}TB7x=c6_9`yEcNVe)8x z)coS7itmpu`LnW#f60}Amy(55s#E1|>shS5!n$M6<6R7gLJcEbcCPY&6+TI36N{=m zN5YgFM(f{Lvx)FtwNSf|^ROeB``i?DhB-MBA1qEWADGKGZF;KzQ3Vc{=})hx3HNuA5mytI0baiX)p@faJPvz8m#W>$2u`Bh%$t=7)2+j-8q z=QhX9XTOD#tXZA6H3>{+6ZL7d=4zOe)RYr*ZsE&UPjYr`nH?dVwv+wR)CsoIT6;Fv z%dXn9#xm%D_r~ms;A_E)wrwjCXLmcX?foTVhWaHLTU|Ll?}~`8C^^0(Rejx47sqJ1 z?oTQox&-&L*9O$EEKb!nnfF9t!UFx3B`xxAKT@YcEd< zb-%~UCLgu?PSc4$4Qn(td1EDV+&;vaW#9BI6c`D*&q6^YZu;-w?(yl&{5AvJ$|E&A@Y3r#(8VwflcLUh(}b z8g5qni~WN5sYw}CYYNteivG@=VbMF6`SjGJQkJXtpNnv(+i8lq+bp^9CZ}`e>H`l{ z3ldN4n)HhMXqABN)OK0XZ6D%Ju>`FBo%^{o=gc1qi`HX>v-T>9JLdIGIzJRrwQP-}&PC&*iV9ICP8{ zpYO8jxbR-=MFop2=g9>hZ4N#ECTA7-&p`QUSwpa!;=@D2dtSF~+WzU*J@besoB5d@ zT>L70aL0UyNzrZ(ccv;d*PnP0vpIgNYxwf8nTLW8Zw+v2T*vpXAju&%P4TtRh9_|e zp&cik%&!@$q+em$<+LZCZPV%}{HDAeei>Xxs#9v7T`p63ZleE=_v2kX_bR<~#g-`E z1D0DmOLkmaRQNM^)BJtRs<%p`LNom{4Gyk%Fj4hL37fq`&tT$2)3m0rdkyvScGDM{ zY~RoD`q#FV?^AF2%34{}{xlc&`W5tZ#q*|x%Wr0=?~lBoQDm&S@cLynM=k#o!MS#6 zDk4W1dU+>LvR=ID7cwqi*nM|C+mWESgcWJ4jbB6@k^koXnNP&} zi{F+dZv!K?yjVRu?Zt|P<~1Di798q-d%@_lxOX$Ns|Hg$j0?md3;UCZJw zk)k7o|2s7gy?ZiQ#ptPi*oI7HhWeuF#UdxZSX3&Fwa|?;loewmp1e zHA8}S^n%(+_uU``^}cUa0+V9c9?$&86%{cbuItP zk7V3eS@?TDbNK(6kL^tk-G4jzi;xzhF{n4f`83+Q__mwSzSoljgmvmIv(xxJcb<|k zVY9XU`(qb-PV45~kruyy`5gTJ(C6%yOO9(U&FovOaItFJoq2z&#BN+@yXm9X{ZV(H z`(`C6w|N3=nxESKSHI&vUuXE>|C?WLK2JBB`BG!U%FxZPZ?gx*tWUE)H-G=$n#$UL zm%rMda}xY@^lNg_e}?~m&K!PyndxPH$~4wUCh-Z!U(F0n6p%W-XivQO>EgNPu0Q8q zyt#6B+3jPwb!!)cpP`S#ZWJjpdO4nYW$SLw-Ei+rSbQIKlN|#H-hzubf%^*>#Dqz@4XS9~btC zTeC-R`5@vF7babIY2D|rXAPyg5#eXKzf1F7T=j$Dt&&dt>bH5pPo7?Cytmk5&VKdP zM#W*C%6Go?PGJA#e9c?mb0ceT$-U(L7AkA6 z)LdTI-Im^5H)~bOtNrWO?R!44KI%Z&-D^`%YmR4LM;~sV zuD?z!zW(c5*88!0cg55n@rw8PdH1_oZ$cQCVZgeI56^DSey-0f_n&+Fql!J}Tp6zg z-})mSwe?B#wvOwXLDOUwT5O$U`HAbkX?307!@C?CtJUv^J(ZQ3A+e@)*IKI}-e>Be zjLm*EA6l+vEbn~a$+%3zvSiQ3gbH2m+0MRk1{+uY*u@xG;j)oGe1eD4#Cp{>#A460f7GsD-kN-yj`^Cb4*f!d7hg8s8A6>m=a9?ZJS!5?JK zvirg0J6ERO=vMmmd3vE)vY8a4#EdNIC7GvuN*6F*oznL_KV!bxJo|Ff4E2kj_voIO z-1zO2O}9gXYGB7}j;n!}OcJo!1g?hp6Tqqf4~OEhlyyt`WTqIY{-DmU}xd#!~Wj_l&121mJN)jy{l zuXkG#T38w2?IOAS;m$q55^tm>Cj@+WrJZnU%JP7CTZh^ZU!g;Ng~@AjKL$TLVbHt! z%Dd~efxFe0o;tlwqZr(3l=_L1B2 zde^P{p0bm@XHHljc9i+~gxt+-C2Im0#VsyP@&E9uywN{Z++*4i#xw^G2d}qfvuiYs zD}}$<$z@k?|?XwTlmQPW{U5aJEynD~NGr zgj~z=J;&4JKGr|W6j~MOlh$*bvC;d~oUa`Eiz_GJuZq&|{OQ;MaoP2Ut(x8aSvSwq`WrB7*R4++MLzl|A}bOWeetwOsW0vnI`wNpwr%2s z?GN}CTdw~+yZ3Rm-_KYE#@5p_H|VE39cwcYo*eds`^f4Xg}v2^yZ`X@^K}(3U|9A3 zhVrXz3y#RPPSocxI`<$_{J-!$jelD-W7xG{=0`?A6UU9$%vE(v^Yv0+qTtz3D3B`XU-frx%AK48 z>f9fWSj_nPz4PcIhE+-XubDsZU^D-*|F%!T6)C^exhcnQEUh~f9(vPhr_sR^GZZ=} z^{0I~>tZ{R#p;z>!oHNFWgQLXEWS(fN^E4-#4x)X&fJnDWu+XqJK%sc2dmtI`1(hp z%<}G8eXMLjmkeT77_2o6UhekOSm3yS67$rh$*;>Da;7XySg=U><>!e)0=u7oOxX9X zXr0aE%OcJb<~tjz?3wA*xUA<%lERN7rsk-J(s%RTk8Sd-1+l<8Emb3b9mOi6Bmv=wbJ)GS@>h+lk4wRw|6PV zDBE@`Njr$>Z%?=XCvqudyM%ETom&vhvH^G=wtoAV_9v@4kjn}3LS zOMM79u$8$8 zQt;)D`jiQc3h{H3F6!`!EV+1b(elp|&VNw&bu;8uZ~@0PdD+>=3so<*?VC8yL3|?H z`K=$9Fxs(2@d6HcY2{)-w-xF1FI zntpIO@iOp4;0jkY?k%T2c-NOt(CoakJ#Xvs$Nm2!R9uyxt6GKfulB9ylk$nRJhLYC zqd{Ph#BU$#gre)}UcdSjJ3mHf1+yvLt7|#$DiznXnoH4r+59CRIcoYO5?{zy#1vh5 ztfzM5_#?SXZBp{#eGkIeB#)&T3y3b8UnIC6x)!Xsv1b?;`yj&lYul@6jY^nU^rv+;#9qqL* zzb{hG9lowB=D>P^>iavbD(-BMdZn>t4bvj`um3M@VrPAOVbh*$)2*+2x-M*N{X2dB z(bcC{hr0_%PMP&(UEvxQZw79m4sVM@jjx_Z1B6%$IT9t+1(^Cp6EZnghRsbnd4*v{ z%3{^}`C9wWB&S|};qCV0p!*4n9);YO=XTitw>hZR#?ZNZmBr%zutI-hrpiOfpH}pz zfA&c8TOf1&CMS=uYQwkAxu04O8|6)zx%Z3m=H4aq|Meuh#}~@+ztCv;X*IQ>@BfX4 zYsZ;x{dvfkd!Qq;WKsv)gR_@@Bs=|L>HalCPOs|Hf@}5lXBYe{xm*%x`;foBX+vGD z^}iBXzw)e(y+msnn{jW{lM{ZHlBfQ5kzemOsQEVej5_TvBL8;sPCKm4Lx z7?EzqP&=Qged1K3i}mggK4^-G%E;+f1<9Dzd&<}~X4>%i|2#aOq5Zz!qtIya-MoJj zK3`y2+0^`S@&wae#_kM0jq>05ENA_Q_RqHYKh_;+v0|U26Mv%nck$%ga%K{H zCtUw@Y@OaIRh9{N!nV(|DbrL~8xwqI>SRs%1nJlnlTsDWzYxzg?kk&N&S9LQvPx)M zhwt?8{8^Ki$UDf)d;iJy>eMB(Q}0#1o9q0b_xFK)lctv|vE}|g%RNaUl~HVRnu4du z%GiLw)zPPI`-62AQ{Hh1zv@2yeDYxh6UOk#KNJGA*Dtk<{`Z4HT%!DSM~!^ZA5~UH ztFOJgzisfFajQ_hddbv`z{b0(D8znNUDXwT?Bd9z{)=klt6t1%DvojE*NK}kMB zo8Nn%)4C^&U;CeKYFeM2bkO=t*Yhs>9SimcCQaeYmi)0lIB?J79}JQDJ0zN<7MK3a z+9bEDwm@#u4xtND({4N#milUV^hbHaF_u7$`Z>$_{~NsDKV$cvbCahlU1R(>IZs)q z{-a*;W(lbU>b-Y$c*;B9@0{l~W6tj8eK*-VpUZq+wUbk5d3)IGzKL&{x7+rAn!A5{ zsJgJ?uoCme|KK@jl6q6t^dTUyZ88CzNo%mU%px6(c;TaT4%1Q2P$5O`^x@r zhWQ<)TppRyMt18bzE@=>zjmLvT&z5y-SMHpk8i)#H%ye*d%`;-{_gDB8I|YwbvMnC zSZaTm;QFXYUruHXoIWf(!QFtEj#vEz4}_QfY+kXarNIjUqfS!vodad zpC>OK8YjGckLvvT2$4(>%dWFt`eeWdaUXML};lj(lg?;B2 zc5{8>;dT@Iskwjst5xgY7zn9uvAv&JQRo?^=hb)jzp>l%U5P)OSy}u{PM7?TJdU*Uk5ga&iMwu-lUUVs#G=!KG;z9qZNqH(YOT<-bzivu@U91?49WvGc!&9yACzp%u){ zy6E1<8D~Tw#M@Te?w^EB%{?%8zd^$Zd}UTwjx(n`BT$c!$W&{ zlB_NiZHqlW;o?yjqc8S%T@=<-T`-#3XD~mjpW(qTj+R$^=gp@Cr#8-Bbz#-rL}x=~ z^MG%^KTUaARep(M>e6-M>-8qz*|BQnf%|Wq{Vmtj&v-6vU=ZDM)J{j}W^FgWbW7u8 zzU2FSjAuKQFUV|4+;jBg3qR@XNdm!J5>l)L)Fl3~iL7>baOVDvg^FL+n_qn%U0Zj| z)=p>9{kaGJ**VLx{LA=Vp=HH&Z_;|@djiKI_WJ9DPL%Js=gj_e(eCGGb{;8Lwz#!4 zTd-QqZL@iedO*D<=R#NB>Dz+eg_|E=$GPO`GjZYejub1yUal3NggNF+nf=q}iul{P zU9kd3{^z~BuxZJ;Zu{if8`yVma_(vJzh*UiZAsaco_w=u9Cr;owq=}Icc~(G<`*Z= z&8xkBon=!OTk<1LK*-o^Mc}&~SG#*lzn${G+u~FBD9y{$z;?lm#`=v*7&>DjS!V5# z?>Ug+yJ6}MM#nATSBjL`W?3&a6O~rkcG_fJT@G)|LgiggOp>QgfBN;g@K4^@FHJvO z;(OOzpWE+#SGvSOy!x!@wmovI?s-3GmHO-YwZ}nW=70Aq!tdK$_HOXZTipHXvBJb- zPb{XJe>5_g^gyNMz`k{sN=k=2>hD{{@*FsEv$BEpkbU#R``xZp`agCb_Fi3bG?Q~vd+qic@^_c~vskc0QD8->bD6Hd{noW7r8^^{FB_kWnjoGq zIrPmQvGVRtrfni$7bZXbvpo4t&;^@?@jo-~o)CY1usCns&-c%x<8Fuaw;MWt$eF=c zuQ@G^<#uI={FL9uZbd;1imq|jce%*&GiOhBKA+|_&$r2@><0(O_oPR1Py2h0J4oMN zXP*0c#nN!cFt$$j&lVvCUDXC(B)&Y}V$2_*dH5RR+O_ZbbJeTd#B1b4*B>oQ{IOn3 zLYw<__!sss-8Lrg;%2;R3DkI2#Jo|cHApliq&{vzJ3>FuDQ*y z_l^r&D7pJ{r+7-BUwF}i?l04x%>1rB+2~owc|0vM0|=_oTK%idM*) zIqa8{vSiuoolvY)68G%clAdNvm2?A9`?jHyABWkMCV`12k6lwB9aY1y3)h?zDqQzAXUlK(;dzUuGF%RJw? znFu@l6RS)ve5kpm;CG2~{k*`1(mxh|SbgqV#g|z*@9b}AUC?=){(DByp$Ruy8jbe} zB=uQD82#V7{!pYsyQ*AtnWCY3md~&GK_@uaUI+Ac^3twX-#}m`y6eF(BPAv-g0rKIYldGoSquXxN?(svErgBHjHX3 zN|%ZYeb?ZfGu?OR)PzKZeFEqC!;d^ZUZ15Vmt>+6x9-ywQTM%l*CNxRISoJkT<|&Q zbVKVst<~E*eGjxYM@*BkZmj)+4F zg_lhpJG19;T>9L6;%6p9^GXL_wk`8LpX}Ln@_@js`vNm(Pnx(vUEa%BTd8bHpTT9RJFO((qj$E%rz)?Mg2isj!j|?ve>R^#lykbs7emb<5g z`3wF`oayHp#Jb7#zu-d2G-k0_n{NtTF#=msE*6~VVXuG8^eKdKLhkS8%=Y8WXB?My z*zEhRZt>gk^W?ULLFFyxfA%d~Bjx75%<$9oV-f~J49Xe0PW$I`Cu;vPd>(w?Zq}cY z1hEFeu;kKQA#eQdw~Qc;Cn5WxiQ0 zGpx*~*!gHb_&xJez0$`s4eO=W2sigHc)+S&IIaKwuUy>?53`@d+PS*~8659d%IlvW z>yf4|GG$@7?z3(lS*dOM4Ew77KDM6Te!r8gVZ!cnuXI|{l#WH6_u@7x5D1+Z#F}uc z?Rd42$HHH8pZsK+GyjFcIhn7eb!nZA>rQkU39n9j{iA$oT7=oeDwTTeGkaHh%{H58 z)VXlB?c*)WQ_rZCia(j?a!tKtld|{|$qd&?8Fpgc=_-Hwj?4Q6B-mJ-2({fgBMzD`>E>k|$y_j(%AGuxx>+?r)<$gJLJtt@7%{-|+l?#P@ zPArMIAh>WclhgHk=?tA!cjT-+48ls6sp_0fv0VI-wK*rGaoNgsyO_U=+X)EHwaBWU z(KP+$cQtmF_{ujCC7+yL2Tr(iep1Eft6xs=#FSSQdHX*|y0F*dN%Cs$sdvIA3NKow z!ND|tUjB-R)@I%%e#w%N`4aupHV3WCowI&wkn5%&g?e*uZdG4i@^;bX_11?ns+fB8 z>b5JsPyf@KH6vwR`ubBHGxjDVPhaF2<@3&3p|AeW57rYq4^Fta`39Rn*t#n}Z}qD$ zTAMv9<*{*=NobV5Zev9GUrYU8zii4+Iv9(-5j@PP$nd4Fzv1AnWs>m;?(4nG`C>~> z>$cZ&Of{&vmHe^pc4U5Zr}F&5;&&4!dj~V`h*66zyq3VKdT4t1?>sT1_H|7c{FS0b z8IoHRy_lZWZ~w*IcI?-ghk;3Ztr_wSzXwT_eVueCmhJR}_+^dumrX?R%mxihujG?|H<;tG79%E?Lby-xdAjgl(tDqa&4PUiLj=`o!Sd zazaJgOF8H85>?A@Y09SxPMha%7RzeB;?pR1fj?iMX@&H{1JmmN%yPT_BS)IW?A*x> zPF0&qH4hf3YHfaLc4oT#=aep9{w)XmC69E@Ug`a=s6&fojx~?yN5<>SqN|tuVvaxM zcx|&Ye~i^B^ZIX}7{ZsD?&;&7>2J&ZHu#~xSDx(d{}-3tou1ssFvH*ZZiC?7^~c_{ ztgYt>`Fn=-uE|`UovoiYeyHb`ND|KpvMrcj#CT`QRppJZ4n|C=Q@;|(F+*)y=Sv^u zpo<+}Ud39yO731?7SXp{Ucq(oMfE8U#X_2G3XYWUwkKgcug`|cu;LIX|p=e%TybX4t>cDX&fJ!A{L<%l=<} z6}|gU*|vYLZ+F+{-&6gl#&K80_s`k4e>Vr;5t|)9*W5mK@9w>S{(g%WpC|Y0?c4ct zf4l$MJmdNO{dNHY`9|j5FP)!zHu*lPUY9Op=~b_xZ+N&eWA?sSQFhkDhy}TGcD-bcsN2aSw0zCd@)P=*JN17oU;Uw;@5|oDy&@+f z`hQH{F7|%H_idqed$-J5m$d!1sk+jmkkVAehU)4UF@~S^oiC4gFnQf0Yu$B?5<9-u zns+Oua>-tnFqRdb`;Xz)mpQeOJ8UlV-__xnez|_15AXR;9A9skURw3)ZlQ+6oIv-6 zvlqM;+iy|LIQD=u#%s7z=#Z~*0$zz>zf~5?^2(If zKf21<>>T^{)4r^%YOZQF%R_nQ7xESq?{-`9X}P@qg!hMz9P{FvRT;ZL(4oX*ol?@% zw+mmT1ngrxyKJ{bLZ>?8g}b&*_bXR#-d*JW#P;m+i?=?lJRN(pG}Qi_`MKn)@-t4F zOs!9qIk4!>s=f0z?3{k^|D8KEM{0L6E!)j4>pFe+y275g37_+PW8R&1H_)AC`chju z=<%Ot``)qWiL+X|zISOq|9xrS#t#?Eh3sC5xct5BJpcYlRyPYyew!^n*DbfU@d|&E zRmL>6QR;uStw`_}mDd8%uDmrD+v5(*kLaJDa>&+gcKzg%Cuz@PI$F5{%wBLtb0jFQrIPGCvmQx4uU)&sHPEp+KG6Kj(>F5; zvUbH8SSc;OwYlso_ufMbICf_7J+sxSue=;%{?eHnTpp>(-kb8Bsgcf;p;_L0<(HA+27}oTdKFqSx?h`-9X9OIvx;tUs{3Xp-Kfax{_-pM% zt*Rr_QvAbj>K0zN)OaCmd4G~j>b%dj%FkvW=Z<|?xb3R*ZWE>RPh)itY`IxK&0_aj zzi)NBmYu8SnDG9rPZE1)>e)$x_cmwlp7e0$XT|l~L-#ISeWPwg7t=I-mGfU_i&x68 z`o~=RH{JW+<05JG0)t)BGb3|*eU3_9T_rnThlQK7?;-me&smP_r|f@idgpQb$A^9I z?>wEmRVpQn@6_UxE0g*v1U986UvtdG%#Iw_;%>;;sAffV#)S1 za}B=SsCW8MevCgNv9)iH!+XDVoxBwnozQ9#)@8V1^KKnok@pJn9tK;_ zNZeIDryl$4W5Bju2e%~UIm$5Y5!tM^vRCAS=bG=^<^FO0xx*c29_jjOufWM(3j~en`ERmf4Wc~prhW%mslXse{s^1g;%!i z^1H2iE8HSzO6|_q;W?XTt(F(4ZWo+=&GCxp-Z)t&_1L14Ipq)J7PY*|`yQ}$2?s}K zR^#369DNmfx94({l_YQ(_}qB3=X4y~=g0dLuUA~~+@GcPVyEE53rcGzKl8sId%^Im zQlQF#_nUOIwVoXgJ7aI=f5Pck;_a7di?8QS5Z^1YIzp}?>#NG2)cvA&GJnD zp3N>Oi;q885x{Z!SaVE}qL2BT2#t>S{ns9~3L3d+@VZ@(VSKjPfH`s6tcBJWJw48x zwSU4y8=8k#8*51+qW(W_f!&{n)+vmU8xS zw`>{C_1LyHm%mY{-#G8dZihq5PM%se@$QyttGOyKGZfu+-7aD6TyZAn`1+FF$DK{3 zq@(il7C$?(Cf+{%v?9~CSt~@I>*#eFy}b@;#0>eZ3dtIPssUv987ZfmI*QB3-C?2_xE z@U_!S#oA7=98@WLv0?dA{SzF2E*6)DUZ0-K=fiwM^SQL@lSO}&Bsqinzl&r|XVu`* z_tyu7q;p0p3zsq$?Y+=Fm8CTB ztl;vJ6JN)pMdp?KKUCCyUdP;easEBmn{Mw^9X$K`BvtaH zBrTT}YOeYEH-W2o(utk>rp@e*l6&DDJNcx|IrhaRIvIN=y%W7rqGA?$W<$_|H(M`O z@G2OUl{{lJKjn7XOSwwKVf}jfUH)>hl~NI`jBPcl#k~b9JNN`kLXufo3kt(-ZmD0O zYxVKYI%&V9dMi{_+O8j+W#hf{VPxio0@KYZ_7^|xUF3al##+g(xmV82%6Kd;VlsR3 zT%LtVtjDFc86C=S>k*S&b2Lk$ep2BQb@}{t6X)(|`m~uhIneECmHfg`^)meHx7sHpquZBqE?uIpX4AvNnc7n)hG;80 zT7}9OK8*a>RBwE}`frg6r+RESM=?v5>zoJsW7bP9S^3Z5w2-OevrY>(q05)di;GH2 zmUv{XX0e-jd}rp76N^46wJ~VlKF#bEcxb8r-x#~}i~S61Ur)Vv_3YL;{!MWWPdFLf zvrbBzIID9w{X6wl??l>lLCg2m8&_;g(-iq|(Q0?c-Pt?kn7D^4r>Mslz4Srjnhnuil>h{@>5U)cXdd%#;7<{+@K-pu&01 z`|8hsL!YoqF{N||?^5H4!e?wIyauESalOP_uNQytn$!QtkS= zSFZei`fZWKsR`|szMa`$8n0wqOUyn?mY-h6YC@kjR`_6d<| zUTqYuGMt+GuBxd1hSn#gt-%=|{W5&Yxb_woPdPfT`0|>bOw%uOk{%cy&A72gKG#>! zV&lbM+!hXd`cBmMd0L6dzB261Oa0V+t+?dZ!ur~1ZeJzKT&BzSBLd>*T7>&rdWf|x zzAk^Hb&+i$lku9vMkkGzsZ9BoxyF6*;lumRb_Z2I3Q7GQd2;@Bca^OrbF@_oqh_oq zH(UJr!Kd>Yb)Hpq(hO(koePMWRFJms%1vXIEcf&C6f>l&TVm`sT<(f1t0-N)%Xy`$ zw#+%UV2$ef!Xk%zI}gh4%Kmcmx!B5?b@FG-bemdO^-n--x%cx=r^N2QvCeG!zD00)@HUCSGqp2s3&pIFOrPVG%CjcE zGxd{`7mLtq@4AdHmF<6bGPT5&&QG77d}!)vN%5IK&lCu83)kBTb2CM5eDFf4?B0s7 zqzu89p!lSHd4F@4TRqKfU9BYE(r)%ImC8jM&d%{X zs;u7TiI*z0eH%`mFLcmy zGj(;qgqt^y7uP;Iml|>IZ_53{Ul-0``{sLY(p&bJ-Ya{x=GLxpG0@5EKksU>>3n$5 zG_^um;ZsMhaewo@U)t1bQYe28e_gG-z1|75OJ z*s`_BA)9skbV<$dt@pisZ8nvDKJl~D%;?{jrk!yv9$UK#f(`#O2UYJpsqk^e^oA#& z6n_`r>8d{XVrM7kr3X4e97#Wqa&IWTY9SpyceSMAml%^9?@u3nFT{0l>$21H+CJ32 zl)b^RNL4-A|I~8XS5-EwDH8WDEep-gvR_}{8pQEhW~!Cnn-%q!PEOb+b}WD|U-Tov7Jv)qHr> zqFV=}v!>SX-}tn)Qm5lb-w#H{{;7XXd0*Q-^WK~-Hx?*wV>n_Tsk!8!>ii3CF*WBj zgJjO1Yi&>5zv}7Fm6FTir_Au#KivA-p@%>192$(*Frg_4*5Il)ilx z>fOHRzDu=Kz$%Nw%>_k2PydTysn&UW`OS4Lp$us+%LJ*t+`SV$(Cfwkb<-f2a&t`9Ai`(v+O;9G|q;w@>FB)U(gbUX>+P zyI@hqR$cbrN@Z$F z=U>XA(LVXMLrVRFt@-C3t}%al`Q{r`7He9`{>w(j4he-zvLU-lPXvMBP^Qb835f1%2ihMO%u*v23CIp?pRpC|4u zyXdf6og=XoBD9P_D&B>`h$18g7W24%tooq-82#IEqhasRd(w~s~ZI4^ysFV;CPd~0;{#T`r2eN|uo_L%bEih;L8 zrPu45MjU%gcq;ehTo1W$^?F}&jK;M&w-(*K_3L&~=zaNH zZQk|ri6YMvO!)IQ?JdcDy(Wk6zm6<+(N1y9^svrS9azxsrOg29t{-5*S2mfFY7>yWZw5|}e- zD(4=B5S3LQ_N?gPiwt?F?jkDv*2VOvtG;j3MfSh;@0uCcf0?j$f~gKalU2yQi860? zDeZ0KI=1_j%h|2<`+qfRcBf^hM&wpXZPEFjkknPwydwDFpU2xG5-(4)UU$OpU`g&X zw*=Ej!xeYKdrvGp8W!};YZil0fYr7X-5yScyd?Gm6Qlx`P7J6nGCdraZ5*HeH9Usd z^4y!sr57w()V3*@Y}{wLF3jNOuN}p@d0W5VaSYh`E{$nkqt^tHL-i%cLNrB~8T^mN z31tedTHct*Snx9U+Bz|-8Tq<;_I%InFFl!1Id$sIwl(|Q7XJ;{!tt!dhx6>u_p@hT zKQK>$&3T9N?Z1Lkl{}thZz;NRz%ws=TEwlQ>TT=$YAxr5XZwX~Tv_EZu{p*3xK(!N zMvG;Z*Gzj(MLvny{&fAP1hejI_1Ac(R|;o65w4D!6TrH;;919?#lGtz7G9hga8v4M z>k6kj$@>d`$So9fJr=2yQSfr%w$+OgcRzOLdwy<`L%aL(DQVkhK6r8KUDumDb>-CF z(qNO^^MM%|w^p@%WqiVu$yC%?l6U&@8{_oZ3mmKs`-Cnnn>P1joJ`y2H8%_ytva67 zvlM&G&eAt+kGZE77`y(*mLqX@A|e$v5md%olmCin(+N(*@22K~IcI)#Ide zWfQp1AjEh_wIk()%_$TD4 zz1%=CZ;~7L+ht7BPmZ)a>G=LlbbC!nS$Oty&M$60K5-k_Ro1-sTz*n4FZF;k-{ba) z7A^j6GE>&oABpq0sl==Ms{RB+LT{1Vj33jYH(t)mcpB1e=cZOFCh=*OyG_N;X=j(+ z4syD2)zwj9{zWat;wJAEk+;{_UVEdmGQ;HXv97(ne;zKAK0eQI%Hpsx90C( zC8oG2@leq5W5IRi6K*iQTh}gMEXHkr+pxKN>YCmPLF>2z+4=Q?1+lu7>4*QVy)7Fm zQaN$GpAM(hDz?20VVjo4u3PnY;ks|Ek}kI{7bZq}o}2CzzD9YWuFgpr-Pw$9WKxY( z+Jod8U$LbL|IyaAy~r(J!tgk{_~^Q~LA z)!t=)o0~5sa9Nx@@ow6VySzirl5I=E8}d0=^d}sGgr=KNZ&5=@=kVK=r&t= z8}FU1X-?}G#jOvyBfCq1e}|4#8n2na-WihGV&9}Srg{B6DDrY~muMwpimQEnot;d; z;&5L+c{A;R8oXip7U#(9z)IGe;{;QRD>Y9s<(v?Arb(2jOKNZiLxut83 zUS-Dmq{6Q4JjtF0I||=+RCz`F72j@JnYUv?;U&-M-M`Ol6ymzQ#=g0@SK;ckm^Y#3 z>SfEld^zVPkg!tkcZ>G&#FnSn_x-)5(>)-+HW4pSHK`8n;R9_9KtW(`}+H zABXL3t6!t|Bil7S=A}&c@;UQz*~(Z;+`O8&@7_!)4^Z1Kd@D}$t+t$rO{%k@enNL& z*zvh%JkxVLW~Sa|`pd{*B`9e1zTq$TtK-vUO`3#@HmHeNi*$RrPE|-P3A5l9^Z(Fd z#~SwiThD?e&-A_X5(E?TR;&t0@o!poX36_yY|s7r((3={UV60Z+|xr$+9%b%$(OmG zo{=ZpGHHg!&(q8Kr4xMF)tS#09F4jnd+y>>*161;zYoS8diJiOA&&2EP=@i9TAfSl z`Xp~MUYz^nWyOE#fCi%@-i8w*N~dIQ4s!5rwb2h~-7Gu(=ayrauO4;G`QQ2YZH=I@ zovy|;NmC_>?jml^`kixF(^4(&>uFt%HYhV(_)J-2da2y3htd`vzb9XPVEuTqsM!b6 zG}p2!VyUccn~y6VzR{`OCCiF5S7)o`(1-g4yQiTLivg82(hh|A58 ztmcoId3a*c(KZ3EqSF$`i_KS9$*`Pnj{R`P{G_^PmCX*fl3O2aPVm*+);};5{nPZ-wMu%agO}}L8?ys3oEe!X0FY4^74Lkky>^$FN>U{Fc{aN1czWvWZ zecpT(W8Qz>GU^rA|DVqPr_=8CpnmQ0%PHR`?s}IV)gHI#1ILcpcWtVTO+7^}Bp;aR zxuE(*tJ_JLFY7)Wn8*}zIA)>xc`kFYy=srt_p+&czW!AyWQW@d_A()%W3PiWCkWN+ zxhkLcS-SE0>E$@He~W1D<@)i_LR(-$QtcK7(T?>YT)4qNa1m~NYbO6k{y>w>eetk6BG%sF>4%U1 z?dkrnaiD&CfAiaId-eW5Wfhls7F6vlzpm~Z`c0g1@`+tD)}40? zThP&~{ObOxV%hsXwNml%JyAcp#OHnb)p@1t!R{HiGVf^okNR*>@U+YICjKo9Ijgxu zZ7T$ws~+fXHi|cTC)B>%_}iPL`lfYmcPG5@4lK9a>Jh{9e-VqdmQlWX=;alk_X<3& zZ@*IK&YxfM{72@ASf5uWQ6VL|PafP5UX`sly}`M$*pPt)*iv-`i7O_ldX6qYwP-g@08}dPA)9!|Cguak!atqE;qTU zKyFUU#lRU4S0&9%b$!{SXt{GWclr12&pw_l)aQ4Rh}$_$;W#VX3$GPVn;DL`_Xh`L zZr1x@$?>~$+qQ|7ZWHsH_0;?QuWUOTWAWTPtbSgq<)0L-lH;tbX=?&z$6hu0^knJ7 zVwnSP5B<)$cGQHA>ATEK|H|&k8(yt>skC5s#7o)zWqgnR|9XCH;go%Kg3Fb6Gj?-* z+-?&0X3w$s&AX?zck#_eDfT7KGnpzh zHz#YoFuwGnPN$`^?|d82-#h8?TV$pSdLK}#v0Qz!%jO@qu#|v`-T^fa!Wjrg& z3yy?!=^Q*!)49#QSN6=#==D3wBEO@Ja_W%MEQMf0I)Rj!Fz!Luh@ zbS!*ppnQ9w{8rgCyN+c`IM!dRTT{d78K&S;AeABeaAotS`h#cRPiE{8o*Wlo204{w z^4>56=``kvQ&jWyOItZf{LCvn_Ho@UCBU$%wmF&P(P?<@;*Cg{z;O zc_`Q}=dh8fxpIZbJ;VNWMj33A*EAKHv~YdsJ1%g^pnoCH2e!^zt#J)@*`nMR(hCI_ zoIk8_aNz~(ERJV8$}%!cY!E&XkLFCVQ7bYBJ@CjK~)F9HKxyJko zf9wt>C*Nn<9S$rTpf+v>WBPA!(H(bp;Exb%f(j?M$C`bo`=22-OZ2yo32 z?l6vFt)Fc5z@>RfkD~0fC`R3`_5u^W9}L?SH#FHO?Bua!)H@I_F;&5v^KwRsW~PX{ zUuegi1sqA-Vo<`Azx9j%D8-^3M8MYc+3!zl~!3!Y2~XCms3xa>I=K z@s)=x=FL5))?75le^sKG_*ILn-G^FbO7gxwV)N8)UCl7<-p)Sdutnbk>+Tv_f8c*q;HqL4&nrXbx-};5 znRD#)qQiftCHxTzv{~2pW8KScuIuvEk(E+2jViff!xC5d&QQO2Eb+?Kwj|?>=NGsA zj!5xs>sP+uy4-Yq$t2vhiB*so#Jb$de8EY<-u}Yo9JDC7fQ}tYmnWe z%Tb@tH~ZbgE#E_Ga+&7JbF^IMyq`>Nz$Y+TbSklk5)ZPEY2<^|V}{;`oO?IZm*p}1blJbPxU6mRtsP4a2b7*#=a>Dr|E0$3hb=Y-7p~NKaXfC) zo3H0LDb4p~j|}|l5qI~OsdV3E^Pks$o;-U=|CeK2{iBeneix^6hL+pT^!YT2ukg!h zJ6>=5H|Mj%ukTxTc+a#w>s(_`?+Oc*jpsR|82+pJ@8_GLk+J`4ZFatW_`*Uq?eedH zoBvn-FaDof>hNTG${B`sJJ0o2qP1lUh4Muw8>zHer%mzP^I?K@;%h~jp3^!H>t{cC ztn~Yn!P(O_6YhuBPqg7vVNKehs?=-Sf9{Z!%>s_84%#i{DOaj7q{t<%_Nqp`l9 zL+wF_mgBq$6%*XsCU`IzAHT+_cDC!{gMSqTJWa`Wg!%BkEk>cYPc zc_w+Ws=x4_tx{0oshm`#KI``J)j7MmQcTzX{~W*Hct!DyjrY9FX5PIUn>W?@p4*|f zlML^v&uENIib~Mu{Z@XGli8@M{`Q3IJ;&!RuhLOVo$0HdvybV*={@|yiG;~KD)|{rlFzfAdv5x`WM<*m`ZWdT<_qlY{)6m5K zO24Dl>ASqnUOrJed-=ojvDQo1T|ZF8d-bc-s@J9=zZb9Tm9chtH=hiPrGadzGYYRo!a-9%X-yQtt?bX1G9F2*+=@AJ|U#~9knG>L+ zuyWLg&XHx?75-8*z}3Y=7t3mdFppPQIR>``)~Wwg>IWNmn=+sw(z|3 z*R*Gmr#-tqJ$uw-cgmz)RpYg}(3IM5&*HAnE|1Q?wszHPtHQ|QD=bS7Zk)O%!9*kd z+X=4EzTr`K1>N` z+>kIo)px7r)cRd_m37}U_X$b!yqvSbPhU>tc;1yvu89Y`L*LHJSXm&t!jQ<`sayVe?J8}`x&*?to7Y4lgrUN>AsqL?(O#`Mc&G}w&oWt zc2CThQu(YYry;gcb>%oiC-j>H_N~>IqaD4H*w)yv^y33dA^Ge?=x7QcEk#Zrh zRlO^FS>bJs@)wEIBc7kB)5$w=@tIsY!*$(uQ-y^y>VJopS}#@oo7-&PaWpP>!;S9r z%{$`sZ0&oFW_t@3=|40%r@H8tLeQ`8SJ|d=-`&ciQ^#w;CFcJ=!$z3#%hLU&6Kw=< zXnX51Z2X%Oy)3*u(#S(TOx|v1#KM`=e_!0D*nW1ww$4q>?fdw+OOZT#)PAunff zJg4`TF+**0!iB&7B9~9TRS*HS z6_X>VzwF0r{WGh-&3Ih9R_T*o)wKH}g@V&OG%d@!f;1*7JPG>C!OXYw%gsBUk+!P$ zV)%=*&)*gBuXUaD?~0z)+^;t-dzMaK|0aYtn12#u$nKx_<8vOV+)Dk?STO0$DW83} z&Ys_Y<1hbt^K~(kGc&aq&8KgyXVILzH?x5;eX?DaF2|{|rwh+KVE?hXIO{AIqv~YG z(ppCD&HGE2GBJrBoSatCTwmy4xzmBM#Z`Rz*Ju&8Y|pdL15SIsYQB@a>oi}goVd;@ zjo!qw&OxUpMQ@)gGpWX0nmN!+m$|Zg0*gNPdynWCtI1k=J0G{_83h)dh|H9iU)Imo zG$*m(!Rx;_{xpa(=j@rv+1I}^qwjU0-yGk>ZBIYhUy6~My;gLZzJ}G4z&+YuQdWOn zkol9px%l}5)oFj#f237T->t#$m2Z)3!V~9^4_!ZhX}|c-r0M#*aPmcFk;%&{{g}Qx zPX1PDQg6&!|JZ>w>ZL|t78d*KKS%2MSS|~2h%^?>=)P9JO97v*k+XUHkZLn#R=j-I>$B zE_<4&=tu2nRQQde81Gk3GPu9_y7bcH zYa~+-y>{OGobyp5+gaW7^`+0Xa#CKXukVPuTzd8&r_-emkGI)O=?OJ@sk`_c*PVyY ziv`)6zOmZXroFL!ccyjrt0;!v1W{=bf&A1>=ElOJhgU^eWPjUqvj0a?WoVjXEcc?s zr;^KCc61;1y(ntlo^<}f&NmDX1J<2>Rjv}ZjYpHEe9zj?q8D5q?wGUX1V?WD>1>D1 zpQ`tyN_`NEI96?!)3PDQtJ5r@!Odc3#h46Th%LDolFwhGCATH{ zu}sFbw}Px)#yR&H*1js;y#AGRoz#u8CA=-7U)$JAFIVbpic|>ZWU)x^GkzptHrq;> zkMr{T)9W5wT>Z&-eGT8TADt1m#lH4FsILs)oyYfkn&X;A*S6FCIdgW%Z8Y_qSLZm% z;%oI*#k$7MtC-by*O2xZTi<=AAW9IJ*#RHm4_ zV#?RKL(=)B5tc8i8h1O%O#UHYY|<&A@TY6OdgPBUU#;1u&fmt$BKC-F z{`|kc>vfYw=9(*~s5V}YUl1hN-mC8@D?96S*B_~{JqK1)XykoUm5d4J35h?yMr6Z! zPT{*P8>89IFR^%Nl&aSmB-bvVlxnRqt6hF|Ubi5_!7bJ@e;A$>b?R3f_jqB=%*2qk zuen&~K#}@Aj}5Qp#6~{1Y?X|O`XCa$K11N)-EA)_vg+eYukuFtp6-8O_}fh^zFKi- zoCk;6MdfuJcFGs;PxSJg!{(W$?DvmxL5;kC+>(;X>7E}99Sr_g3(r~mNkS+&sgz+F z+omg>oFQz=!puc!i){QFo-E`!SLHL;t&nMFoqgQ9#@&KRdt~Hn(X)l$s_-QI$t#vkvgtPoj(iZZ!A7X?l%rJT5{29z-ueEA#QbXO8BSOIe`Wb+h48a< zm*r=;^H(?Sl>B_owUbSBq2z9NqxG9lSP7}TP&6$!(2tPwobi6Ke8JC>=r?6c4RWjJ zT6b13C|TOn?$v0Q{JT=7nxHK(&qQYOXa!&==dllb&y5zf6t7D2`mmLXZCcs%_u)mAD^oy z=)!$1VxCxyqQpao^=ZO7OIKu=-OOZW*wA+>jB^i%)A`9V(N}eycN8(c+17HBxBq+U zZ838rM^>|hf2&tUG5-Cdm2|_qa_W7ykgl93qSKU?PFO7wCYQB7%KhufN7pv)iF7o7 zy=A7TWpNqLbioA`JDo47@x`5*{l_n2 zw%-=cg3hp_>r-7bS6q1i`^d}4odNTo2H%}` zjPdeu#@!1ljkj02>~{XF_UG!KlXms{pUF$?-P(W8DqMYya!&oaN(Robx6y{8@7R`y zJmlr8DSvufue3$w)Yrs_oAO85NGnNSx#qHQp47vIM<%;jt#({J)AMwZMoEjj zl^XhXKMX&l%om^d%4Ly$YM`o$|JRO)Vp}D(*MjcLmw9L!%}+hSe%0~h{CXMT{R=Mr zZeFyaL_~C9)CbetO$pb(nJB6l*GkpDO?csV@cNdMJC^w_S?1d|>)IwQ!DD(eTk52} z^=9hqNHIE}`fkaxv;RFjXK&K_xktV1%H6bchD)d42t3C3oa*6bLtF~z$?ebRt`^FTw%_+ZTX}$B8w7)V98cL5Bl@{itO2)<>Id{B%UcT!g z|0hOIHGXUUdG>l)T;snzN?mhvmPJ~97X3Q=_dCNVYFa9MwGUZk<@Y zH!3nKr2eMECijZ3n_276E@IhZBUf|v%irZ);(7}n3CD+CzBM&qh1bE0*jwDn7rrQN7hoY zJg;3==MQ~fKksvc?e&eKmt6x63$NWHDqfs+WILDH{owQxd6$~&728jwFJTaScrc@; zx3B!|gxfE=n{8_BX5Kt4Y^0{5vFq^eh~HcO9N2${Pp3}B;G_SYHB%SlT>N8E->Put zy9$SV>FpmCp<7a<4OHqLl+W>B`_7fwdDrAEvzod71&M9H_I`fHo0g(-jaS=*49~vc z;D|_Go%Jeg*`IGWpKRoe+GWf-X9_>xs;`CN3zl5^al|ipXSKio@9>tBXR}@@ms^?S z&)Zegnc(!qxb)3L3r(KGQHc@>_g?+j%rT>W)we@;7i#}{!_!eBe)o<{SM(HTSB%x$ZzK2zv~bU# zBb~F2x6JMOd+76n8dh%RZQ<&o+GjtM3x(V{<@ey>;{CUe8G7@(-A*cc&pW}l^W&;# z&a)~n%RjFdwCLo2FP|i<&(fyS^?9GH+tJj{8(WlTmt8v3xAR7r`R%Lgp7fr$cS})- z*U)iJ*EKPvZs$sGKd*(MOq;H4xSFEo@Spcw*_8Ery_QaF(|RoJc~iIcs>80`&pbPl zKex;}s;;n2JIc?)v64&(>R{tuM|@DcxVR zZ*yesv}1ek)vP!czCklWW2*bwwaz!?t=i(h-rtr|(&3UB(pR1RbCD`@oZ`y2t9NBt zf6-*wyC7=SE3djQXMSu~{kU2D`GlH7-Hm%Yw@Pj>oBOmm<-t_$N8KT-*s_(MM(_D! zv^gwGCahOh^h@~TBe%j|*Iz%o@t#Ptx_s@DDO$NH7k<33J#pcq<89f#*LiLeH$O08 z>M;u3qQb=8B|YaQpP<9fXRXsU&E5LW?YVP`Y@kzlB>SJbiS71v^6!}GyjPC2yZ%a^w31+cjX@iH21$3@Z_i~XLq!EEw$k*vq#-kxwDh^v`N%|O*a2I zRpe_^;oO{0X&aZD7UsvDZd~+L-G7d1&m2{=+-OHbMGM*bt533P%Z~5VRNtVwR!->s zo^YuTO)m4RRL?vxk1y=9b=vkKS*`nvK;k-a*ZJxEd#=?quubP^3SK_*mz42uW)b-Z zG3%#krrmt(d@6iW4a05!>9L9%Z!R{ktXDtz=c3{R$fMg(r)4IM?^xHWR45zh2;1kmQQUd-|HUlrkqT;|=(-iQjRSO~v)7=#Jc6 zmE0x;`}+@F<4$TvU-HrmVCl%ntgv{()1Kbey*RXGal9VKpMGVbK&OccR*RaHJu^%8 z?)_2FC=zzV<)LBzzb${~h?M)r?LFWTo%7?rTy5OJ^VvVn>*?>SU6@kuVi^=Q@x`ZS zjbhVJznK5y`TlwPcFftk`_Ee@_NDXV=Uw{k|0CS9%yzfv5+kD%9u*CBU2a_hDv}>p z?ez#RuQZxnoR;(}#cX=haeeXKsT94nZ(E72w^K|Kjmt}>yrYxqV zbEf=@4SZI9{b`-s&E9(1$&H<|j8`Ym@6@Q@=-ZXF(d*CcS&zO&&#T$t{W;}jeQYGJ zy?n`kTkq}*d(Ikn^Eq9=$!03EwyJ6VrCoQIxCI^TW4J!`NJZ^^_4%>!1?Tv`ztcQ0 z#mzOSacS$OxUc7}Wpp1t&fnlZ{wB~HrgR! zWsgZZJ7eJl(O-;g&5;3X;Y#6GKI2|d&Hax$K|vDY&p|53t@mM^zvyLi~%VVS%}u1!v$*lq1S zjvg=mg^J(iwkX_CSa`N`XGyY5uRw^WilQ5TTgFFb=DG!v4w5cQ*Zp?9+{aVg()c;T zQSa-F;>N^QjSm~^kIi_RboE&cTjHe>JIg02E5cT_U+j-w^S{Wy@nWT(PhzRo!TrjL zl0rHYuKiiodPb1vnA*IvosV<;6d#D0N@lNkv(0Do-K587kFHp59D3wMhuGcXH+*7E z%qOS(d805_Fx}!Dw&EQ=|h}37eZs+^#;9xSJE5 z!S&N)L(|F?o0cw0Wd9$qcXRuOpZxb;Cf4r1f4Q19XX4*-=Kjj>vGcdIH9S>y@w#We zd}Cn2L#Kyo(K^xX7T|*Y$dq_6O6uKl3Y- z+1^cEy`~_%Zl~WqK8bxVp6oJvnDg;yKy*!EQMd2JR->LH3FTIilE<#~$1E@X!BdebOk9OCTrG@ei!NKx7|Zs%COI&U@lJ97-ZQ_Z=1nP6;r*qM^rccb^_=0P ziYJ=qHuA3g^+sXt@*f2~+k$0;QXVU;PMEmIe_O7O#16^u1R3ZtI8h&JnYWyIFrqDERO#~orJnFv%k4V`2)$Gi((Zs7U%PrJbN?cx8w|= zoLFs*m6GB03m1DtcEw0vuD+kRfcZUhvag{^z2P0zxsCA*ZMD-d?tMPN8j$Qiej;k zjS6|6y#8wKLV>!Rzdwa0t(sMl%AK*V?rU#;P1JI|&C%hUGR{ofst>#9X?`)|nf_6) z@$?_^`169EZHsvhujJrvZtV6BE^a>jTbJ{BUr|xco4?a+ zJ6wxTbarpJD)e>3_rhr2i07UTee+WfRxdZO*y_$Zr`v_oKx6F*?@ij5KNWX#?nu3{ zC$FjBSn;vzJiT>h3wgG9maQ(TwPN{lVXrmIjizanl0rBnnm5kpN%u%Htv6yRX)bAR zI4F_JBlV3#Ao)<^QmLO8l=+kz|9-Z6cXX@ZVkO2@swmCxTS zrY_f0IOl3n$KkHRh@{z`o&VWayGqQTcvJ3z|AI6oAxojNtRH+f?LV5nXR5y81dhI} zmnv6n?xilxI{bL`?n~t-#1H5d-{+I4ESjx;fMMDMXnkK$KwSGeSx+}jXW!|&-QOzKwz;%D$r_Z_y4_LmPe5H73Q^?Nv zbMm+Am74cHp75LXe&r4G_49royEXIAW4p@*Y8&_iY)-yA^;^C&W1V=a^VZN^+`HV~r>9<1Fem77Y|$nl-NYt(TkB)P>d`aS#WlIcH6FCV-3_Si1n%^TeA z?VYQ?GkeCY)W5mBFFyG`?rM9R&UW8^=~dS=S}NRc3c7g}mme^f1_z8^mlc zvwddf0Y<+G8|ov@sT5V-w3~G0|E1sYW@2`)zzvOW6T~MoKG&>&8}qvO@ixK#b@i;j zS6(^8sT#*JVYW%}PIvXv%O{`OT=tWbuMo;Loai#&JlVtsOfPk!X(Q! z=l%IA^InEOZ~sxpTa=nKlF^e>N^8t zZZG6ay*NcEvE{W(?Q*^PCJxckUpB6OC4Xwn8vpNK=ly3#+_TT8Yo@OM=q;Pzraeim zL`45hN!+HdcTT>}jSFS4&rn8lAZ)N4|+&RnVq4N6r33VnZO*XncpH$vZL`#wR-a{Ri6`#$?*4pw+o#$z1%?!J?Q1s_ z9-rA-|668u{13&`+l+6C_iT&YIjy{mEp=}}{NI*OzEAhve^wV3b=swGdga{5U+?ht ze0H)_ajs`v^Zcq(v9Pl3@*KN^%Ok^0+XQ)c&1{;z{ECIq{%8Adr5~Jl|9wnku+zb) zOH+jBMezUm_*`YyVc!SM1&bGF-!2s`bUG+BIYV+UYkIlECD|#Njuz?DM0{=fuG~yL zQNrVyksV{NYP3)@g7vwA?}VSebHguqFuzgLeAwl_QmAEBee;{3WRA&uQY{=@v=W?a z3Y0F$&Ix}NZQ`QD`0a{phD`Gfg|1~Wf*+O^+aC2vp=p`gs}iRhLWd4ddvGA4f2H`-S6nga@E`@Apf*REHNwyx(0=1APOc2B|Hf01HS#oynYxqEA7THqS}yK`mrqDmGN#_p81 zy|UrL36&eOL*yib-p6vZyfEYAuoRCyV$G^Ch0XYJ!=4A5kIivSMj97 zmqd=rEj_W-?!|f@2gVzmJ7z6c6g_gng^TR~vL?#3Gtl|W%;en~kO zyMwK7HBI*RKXi<9RB1VNZ^5|_zmn^V4EC5T^Cy>UAB7RZ2t86+*=YX+?)5m zJ#FS4c7);XWw~!1-*fz9WY*;hMf3%7RL`psK7UZ>+&QPnU*#RWW;yqDPUqZ{PED8- zTt7>TiIbz*rRBBrP0KayA_WR7RpxyBy>P$6tpM*XqkoQ@K3_ig&f;71MD>`u45{OH z6HI!omp*f9_E)c(F-v{pp(`=3ex!z_-*9^Txl`<;T6B2c(#X85>z8lF=X1(<^s%-) zy*uxC`NLFOU*Gab{v+qbU7xPIqyBZJy2%#K<-cFmf4ZNt;mLRY+e^1?^Uj^moP7LR zy3NbBBX`bQcIun$NISMVt<#3JQFt!THm+^qbwBqOeyiH5S@@7ocXLr?l#`BvWzrS( zBXNr1k*_Z?Cl)3%u6V4q-#0}neYR5d_Ain@jpF04b^n!9PGr>xVr(eppT5y$hN9+y zJ9j^+dWI;ycdcLilzIEtcN6vJx;;+V*J61tLx}N0iwXyWut(-3GtJMk4xb|~-Pu$V z^Q(RF|IE*I98&BPE=OOA5NiL-p3&fHUD5C>eg(B^(| zH}2)fFG>e|!fS&04Cix-`ldPsDM|}J)k-r&wWIn$0r#SomE}hv|F86E9xpO)-O#E!a>YC8JyZ|wl^DZub^!MD`yztK5$!6uQ4J5>$l*8WVUFU$`F7)x(gz4j$DE$)Zp*-fR!{jcZRRvX6VZHla~ z+Zd~tFBN&l%YIFk@~-nN6I$-SzjZFL(d_*7cdNx0^nMjM(<#V&_P_ERam__f`SvjG za{k>Iw3Xq%YeNUip6t#&g|Zf}e}^TNEmm0=>t22Je$^fUhEpiyXNJh7`?lV zGf(puW?x=jvRNsbPjdA>3BAo#JKCRji#T1J(rB}S{nC61UpD`*&kO?`3dA-{@k%kj z#y;gpXV{{bpF3E9p22T$0az$^@hf-+3Q7Q{dOCa-JW2$=-0mU&CffWdhM^M zu(QtfYRY4)*Y&Yu()@3&AZ9RCWX<=M#avfyg)JPV*Uqk$z0$U2_OJGSrMAU#*V>q} z+a2fF+3mUd{l%9rhUfnHd~orYvux+&zGJ^t;04`hN(kqz3&_EG<{B zfAxH^?c5sCGnG>_tS2aUpPToD_sqQ2CnP4>HAx(Ce-N?4g8NgZ=9!8Il@9YIg@5(^ z;JNm3$^3erNy}fXdvAQu%8YHb^S=pl$%o{Mwbx}Ru~eH>O8u{2^S{H&^6c%GhaZbo z@7Zy5!oTP1tt-3U+4-)q7p>pfvUX0L&ZK`2BCj&O{%<$u`_iN@VTX5o(N;V*!+(BV zZ}Gq2gf}{SQZC-=xp$??!PZWp%X3lCXUQMeEKZxU>wI@P+Z*}Sw&m3m&EI*8#b$SH zIG^Wj47p=f5ebxIH`mHGkEr5A`1} z_%`kDwqNwjuD9DIcpdA)ngY9@ymH&Mq|!g{w0(S}JkjKc1! zcd68AM{nJ}ef%HRaC+a$mgmcM;!2pg)-x{o`ha7R!RHsun&iIY_WG!U(Ytr?*1Sk- zRpovkV|m_4B~sZl>(bpLO`H8WA158ifBxq7%?SrCCHyuEULJAcR!0Jlc52Q;$++9$ z5;NzsnTdS6yDsnia>boRF=3|#x7mi899$*ya8*%5#cBWPwYLM}Sa|stw0%_Gk?1jL z%eIHB`wG_7_s+k!Yt7x3{8`uiKAv7ThvEL?Gtd2FH~PGd<9TcM{wa%F<5krkZ5a<& zN7qCK7H_$*Qt#&3_bb;2eLSjrbXV|Jqcv-9Og+_6F*P=H@47I7PFthC6%_KCwKb-omDC``Wo8-On}` zP0|a?buGI#r8_cn`a9t_hWtOpn+;9mnPaB$rXSnpvuyF5l;>A(yxM!q&QO1L`C93+ zJ4fG^^Hw%pSp3`V>9dvqje};dZ(S|d&pA6IW!t^n$9Zw$Uk}}~Hu+!h?bXWql(*G! z;$}^r?-y3&hc~oLF+2J+bzf#ZNBZquF{!17r#Bd#nY!Kcx7K#n?32IFv0Tx*(4wo< zT;0rd%)xMubE)Pd-F*}9u9Tm?XsvwsN1o=~oh8g7|CUBXFH)Ji-0A(Q+MRJq3vy1q zeR`;rK~v!RpWMiwmfy3kK3x#Dw`i|)U}WR-)vIq^){A|t_v(!s|GAAZ-?N^rSvRkq zty}2hbs?LSSbeLlHP?m1AEmz*&8?50yu*3vycK_Smn-ks87uyNd!@vm3vsjlRcho4 zG!6@-z3nn^Y=xTr}rglW-fkrU3bTf z1WlJy312UI*PYkp7x|#S{r!djx&2=YWu*3hy%D))c2D+%-Q2q`Wxd>}Vz5G`Q_wc> zhTUGvuR`x0zNu$dJod(B%}MzQ;j{S^|4&bCTsnXHyV<2xJLdjhe(w5bTYH5?!No^f zKZO3h_RN-#A#}aJ{LC()dLL%@QbQK2oNeCGvA&U$tq$Ie+;*(vk+Z}aj&{X0roxO9 z6Q3R^o2NfrB5Q-@?C0;dFHq%?b27`%+fl6_@2|1+<7cjhnC%bQqpKH&W`fSp! ziJs0STZ6Z~e(xZg|MkbsC*tc`r0S!O*uFWEW68btdMSSm>Q=Xb}1N zh+xdDn_C5Hd;_FL6|ito#wA`R~6vCj_^2)}yuWZ2c%qbJ$- zbgSrbJeiy~U#7lvip%}EhCgPz=sfB<-nCRP-00dI_wL)9`O`Og`b=_tXYhXhqgpYq zTMNGkd(KhH`*AyQe)X5n4F6Z3-n>3eTDDMf_LU7UK4rCcpHBUf_wDTL>Ff2+*YExF zQK!(SzPhsGJ@=3E&T`gr=@VXSbQ|-sKj>eYsS_+Gc`Qj+;^X&Sd+P74>-xM?AZgma zw>5f8XT{#z(K)}{*KhIsE_Rs{H@Da8oU63jee!iSd&sqtr7>cauEE{Q;-<~swDS7L zeM>io9QS(VaeMKWQymN+cAs!+R&trP>V@5*%pc$Nii~y68LbQXqV1z{(a7qtrjl2P zNqed0L^YjVyy-gw4RlLFT+{Ox*Kh7lelep@n8Ba@$F7&LEiIo9efDB*JH4QD{kwJR z|9$*=I>PmOcKNmwcO#pQi?y^0lq4NJ*s$}+-~MDdW6fTcv^xomHmfYIu6#7DP%&tO z-^!$gAxTQ-l5=@tqD3#>3_Y;r>8C5w@ulUKy0apTrxfaJb&%!z`6W4J{qp27gNK_ta25uIz+_2zjgZS&5C`uP7WU-@hnt@(cGM>lva=_nMdw zowDRv{X*B`o?hFurQHpw+h3Jk6mNVNEpqMOB1;*epBg7yrpQbaJ9%`uvEDRJ1J1Kg z9-n>vCAyraM_uh%(X3WZh5Sv)V$T*LMgPq=nq-=9VN z(ldBHayGSEn(S6HOFDDt$fTJouiZ(s+_7%u5t(_4rUxIpXa~$zo*>Efega31L{_@y zu6l{W{@92|Phw}gN<=w*i8r~eb5X7Jw~yL^3wewUiN`iJgt8la7f8^&=xU-Qu{fFW z`&rh2>;64k>t`L0SaZho3a8f8>ZG;JpB%0U?>qnc=`Xeayp!u4IsgA&v}%_43;6~G zZh;v(Z5&)GZ|D9m6wtaC(?)e>EyY^2|0lOa9FITayJ}JpbUCo78yI zb6G;$OX0aeofcbPdM0eUP(A08W95Qczn{w@?$34Zv}%5|TcY^f8Hdc`E0(F}Er0eE z^X-tdST5|XKK1(`+71<2%Ltw)ph=*|&GEIxy|WoU_O7OmaMX{EG75 zpf^9BHq2cZAGNV0=;xi@^7x~3jsf#;*8e}>|2_aWa<|#{^hxOuB~R~ zwhQNjPMn${&7pC@E_G#1mg?*yn(abC>P$Md@rvFKe8+b6+&&@nVB%MO&dIB9%hc~J zI-|PK(mA_G?&sGI_omZDWovrgel%E<8#rrkyp}n0{L`+!R>SqL z!+xsXc-HQ0vRUPya8YIV(+xK2LZ2VW1aJq<-FxWh2C>}b{+^|}A2wfE%x0xpvM1!B z^7rLd^Lixn^wfBoF6>)=iseb-n%{dgGwvVT`~HJ-Y@Sz!;Q9KSIeWZKZtbgjIOqNH zi?z}#Ew3&r%AbBCIVGZNk^@s^OwF@ryW6GgB&J4M&5UVyK0!r&va*f!m8K&d*Fz?0 z-1YCd`^B?!BXhmj|0f$ChDi&g$nA6$u=#o-X&tYf)x-n4Z+ySfyujwdjP|nV)r;3I z;+yX}@7X-%e(PU3Jbx#%2-Tl>?7iWU?G=kI5C3J?7Fz0@UioB?PWzW#EMC(ug?tgt zFt2rDdfPC+xOwVk9v-9FI}US+Zolhlx#Q@oM!Q#Xt8F$NmnyK@bW+OWvA4m4+Ak{8 zBre|<=YofCRwCEd>pn?rnp@`D>9%fraDM00Q>-4rGdru-1v!3o(XU_h_I~kKhx41B zYxTd`$tD9Lf_@6+RBjP}8t^)J;?$!rMHcY|Hl*kD3P?{q^vto-!tl?@Co=OG&K^B@ zRWr3W?b9nOo5f!yNXN_-+qb{!RQIWwwcG2~3Cz6_zR^m9|H}G^)4!^YtFoE%+-Ft2 z#(eI$*osn}NmIm5s9&k#^KYn6n-V3IJyCJ%@%`VfEOx74GD*I|BN7;K*2mPhJ^hTy z-RM&pyUdy*1=e^o$afwo<9J(gbv9dKr^>{YbGLa5UE*es-?E}=$KjW=AM`%gKN-{8 zB-5yMwA?20+n4E)!kQV4ZRM<4UHQi8Qk!;F&lFu~Ga*{x?Q*f7Y+Rw5X-D5bueX^k zx|-c;Z|1hu8@~rSyBxma>dh42*^n0&heUJG!ZB+@KSyQFgn*UrDvHyUu-Raf4 zXaBK%S^4H;1m z$e6$1E`6x_{e2NDpItYKrkA-{x%Z^q)nY%+5?3jo+VMbw}YG z`>Y*VVafURO^>FFf9g=;5y+9(t(e4m;z@1jy8Mm;zs;|c_HN6)Hz%F#+^eO@?F+(= z=58*OvHGqZREK9<*XUtA=xprY= z`kt)^_Xg$J9zS(_?X&yluD$h*(r?nA{!zKS@yL5=r>jq|?Y?O7?!^6|)9WWl&Ums& zqkj9c4NJ6V&%Sf;j`E|l=$+i%HM{jPW?Vk|H)0agn%$dse%f&?>`daxTPf_*&m^7O zbZ^q}FGqZJOzfpRLced@&c8%csq`b`^q_0)7S|%rSQlH*e7G|pw}ZK3u-?DVB+ea_t zt+cuHtAORQui1LI{;Zeip565EM#26x)$f$g$v0BZu>k+}%!BOuc;+Gu^IoG>fx)OiMbb* zad&2=E>`Z+n7rA0%hB1zZr?pG1Xsp7amar5WNf{_dDZvWj{};GtRBpD5q}sx8&^a= zzoR{mXZ6a(^_L8jFE#pXttr?cUF12F<9DL7zyH0`*r_G2PwBF)D+w3N?m1>9AjBG8 z?~`^~=kq;W1<%I6_1#>eV)COnj$N= zZf#ziz{^9TN30`^JhbyJNUA-ETcGoHIa9XGRPRl;X3;+nPGV4$xb)U{wPK@V!Aofw ziHXyHYM)!|tZ89-n<1OY`n9x~O5>Y~O`enMq!gw&x_@Zm$=kX%Tj$D~r>?>J+XSX| z24`!!Md)7Em>@sLRASmi86OScT7qju6{Q|wK+*CU|xZm!duz0MawG$H?TVRU4HQNXK3Kg^yyDcwPwnAdB``j zo?5=>S>_h0qo>k++y%me3PaozI1(SK?NCcRAlN%oTVqoAgPPk~@fS;^O&z-G&6XXy z!{pla&(F1Dv!0CJ_jN%VH8zSyT}avgW|`%y0GTbjZ@MP#$r3jE^yIh2<-0d6g0>y! zNH??dDSj)>x7zz?@;dgP%dd*L8BDuyKCa;4Ey&R#T@;*?OD|IrPc2b zoT|x+uHv}feb8e0;av=h%^}+6zI=>l;xE@%POtu$WAfeUso3(BRtxzjB+4^rZ~Z1* zWE}CdYWIO0w&fdKk z{@h?miiwVi$vX!beut>7d=77IHa*rUiQTuouiZqUHU4ptF8`5G{j&$Q@OBh@v29PP z`nGCCOugL3?Nj=yjlv{Crfj>tn^7n`=yv#v7vj_Q2yS?&FY!pB_tPPSgJTd$v!X&U2TcUZh_V-UC7qT1{C=J%cb?G#dz`Tx(p347x1<M!8I9{|jEv=lk3CZr8VMFJF8s zXb;~OQz>Xy^W)@Yli2HW-@a^Ulb*08e(Syj(Nppp{un;Jnjdw(zIJ<5^5125%~O}@ z-|3jduDSmkOV&c~Y?rrJ!o4me9Q4Xm4czFHo~pSu*2Tqg@5)VL&2IZnZd*FV^VXx8 z+X9qiw{N|5KP^goNz&4(25bj@g{_=k5|}bOG)V2NP}iGJ`R&_^w}1U4ZyywRef_Ux zr!^0LnsnOnvAofv7n2^IsC9Z=|NK$P)&mS}1>YAv`_Ww`zi>;O*@chyx8-in%nNoE zX*y{sxU}_QN^{TtCyfiQriXS`MHc^wa`-cYVG&EY@|RE1_G%MfE)wXPZu(f$Z})N8 zNq@fWYuMkeYjClsGDohDwwJ{i^vmz+ylKAvse9{- z#rgXRo7)U)Zq`JZ^V=5gw3aEZbL!Z%%6++;)7OeNd(x-vfr$ z3xVf-wxxUVPLOncb84rhUr5zL#v5MV=8yFn>R_(KXo!$nCY_I6ZIdj#o zKmI%UssXc?s!B(ESam}={$Y{N*Nm;1+%gMAw zu*sc+BcyTjAa z49V-J%F9e!?o5(=8Z9R``AwF_S;N_xH=akX6fzP{KAF8mDdntN9QPWoOPpZ7)UE^}_Wx8ZO9eaRH8g;#y5R*M|Bh>ITF%Zr%K{_*Ax0?XS3}8^W$E zox1DT!B_b;mogN$2zGzWi|9Hey71Hn*ByRx#qams{Hl4*OSM6}z2d?O@kr}S>z^AL zbzbi)`n7k-y**`rpK@PXd)%&&=t)0I}Zz)^*pB<}ApB?9ETgbEjc&OiOiL@@RUrel~>jf4)n5TP` zUv>JlB9Rp)Hgb1);+!}fShVkcIF_wpS3P-uqDzK^*9Wm(er0QSn~Sx{=*2IZ9$LdD zFi%V1VtZ=(ws`@*IlhKtEnfbb+DdyWs?9{3wJ-(^Brf`LO#0yX0}d!m)xAIzLan-*WZH zmMe2(T&5LYOW*hFPU!jS`d3NELiwM@_pJ`wl9XV<(~}*nf2^a^NXq!^PC=iL#utY; z{5Y4Vl}%l|r*q-w#2ZUB-gK&V>1*(CN17bg4`281jOLPy4EHCw&$mpy{KDbOAB~># zsTTvQXX;qJ3eL%oITCy)HR@wf>{;)C^?qXC)9m|C3GNRS_CE2!%E)G@rkPxAB23K->Wcjd7;}ML+hVj;+t(gE(|*I>dj(7bD!gUs;_5B> za;Dz)p=s~s72(Ck<*MG9FWfUbUd?53bFS0p~D%AJ;`owVqH zwY2r-KA{y%7ys1QE6$m5*V~3`j?ecAb0t+{eLAwQ)K5C-^Jv;J$7}<~2L-JKi<;6t zmTN1lYyJEy`Qe6XOfm;%h6Jg-etgpCRLVqEon=Sz_uUk5Y`ma1Bi+Jc-QR;O_Q#74 z*6;?MTf3lgl|zZ)jQT9086Rf3a9&xt!aq~T;<0eooL~*3xP?0&h^6gyTA{H|WzFwe7>z1LU$^i}HR>ZDtj)C>OK`?%$u|M6#H+s~XlRiCR?Y$|WA zeP@^2tEXAj^%mRyrkU6Nyka_Uhy8`p+MKYx>%Y!<_4M$^2W3y!&R$o%`_8J8>gdf< zW>+{ZCvHEJw?=2}6wUs4?YPwM+izywxUeVEkv&DXpnl$(oww(gFPZdiM#a_COI#JktNXRLYE|Mu_S1NH05qZWKh43@nr+ZSSZ_i#sQp87-Gyya_j zL*Yl<8v#gsnS=J`H_v~eE-+gt%YUhK(r`;RR$LLw#NvXUs@7`ur zMxNI({U5u2^L%_3u9o6oa42_HNX7j(vma+!n-u@Zz5V7NbBgI1J^L-cx7Oc$Yr1^d z?#t^s>u-mjKD<(&ul(r4irX^#y$(DGKe4@i9rMMVS5M2exV*hM@7&>y%ad*~{dBLk zc~f3ztrE5(^)+Wfw}st%>2`}3A71_NaJ><{CogP8*{xtNRqZPC4AJg_%a+q7hTi&X zE85($Pw_>}_Fefk#e6b;@5;;tcK@Bfu7G*3rA6kfI|?7_m$e6;;EgUjkhGg=Nx{?B zw%2Fl>#O(~wEhZ9ap%w3CoB6iU(<(!8t-ZCB@3?^kS{^puff z%)U1TLVYp~P3@u2rN7wR(hXfRd$Ijm2DyyuMz2`hLvBpz4q2dDA{*K6en9#g&*rD$ zTPAO}?wuE~V_~;kVXcGiH@@I?bM&MGinm8jWL~KBMYqCsT~(6F9@WFq^^doeX(+4z z{;_YGN@L8Vf4lB|R=(`?eUALOs(bsD)&8;-N_{MOANu-T&BaXq#dW_ulnxq~@L2z6 zSY`c{Blh5`rysZ6cV-ky-Ii_4Ex1vt+%$c!-M=}S%)Xyb{^p;hS$O`J;)xyE*H+kG zNV)xX#fx(V(a3OUUcP+!yjZV0D)~WE*D-!# zDBP>E#C+y9*U&8EH=gfj*Rry!;*W&izhv7G(C4;@{_W~r0mD;n?5%4 zXbbkF=;-{rk+)s)rNZ5VE*W}ZHCD+==t z>m=46IPBA1JXiRRb&|CpY8p|%nMH%-1s-CS+Ur@ ztFr4F_rtyM#V$|9mOVNx|1Pa{;b)Z=U2Vh8rehzt&MZxNve8QGgZeQI$uCXY7jme_ zmIT$=9a$tA`|Ygzf0^@&HxArA!RueNqDQ!9nI?x9!K?cGaEH{@*IB39%Iv6 z6{h83@NLho3#lD9>hJDYruUpL&2Yx_Tk5vUOqj2{`m)y z+kUXWW|9k7y|2!_V^?mVQo7X|o39lY1RqYCxvL~z_qZF^zEsz~qy6=oI-UGXJ0FB_ zeG+&Q@?}r(#bUpw&DJwj)17uqeRRLXOepW{R{y!ZOXe4<^=^C<>HeVOBg5+Jb2?3O z^IjV%cJbFnxCJ~_?=7ZNCF?>O4;Hh)%p z9Czz${@f}{k!RbQPNdIiOL=2lKkaKD+KG-d*6mFN_XB3GdSSK7+M{Fvm)rESjKXsD zGh%YKuqm(JWK{a<>Es6tpO@~=l(|{eBXfWEmLD5#+XXSMU3P&nz+w8j#+~1bZ}u12 zhuK?B->j%9d1#H^ybhzy`gyjS*KfCPW8e5w|MARdXLZjQ+tYs=o?V-2->!4n@MJ>K zwg200`W5~A^)fx+QSt1msn6>ogRfh^+qEX-ug>}UwXL;#pV#d?n08z^FUR|mfy$nS08P(V|(qR z>O+q%6!TmZim(f+ut1%|CVj%{+ZJ zKq775$6E2M#gpr&R{a##O8I2$nx^u3m&xPKvh(+y3R#~xt~vFy*X61Hk8@9QqP9fY zaR1KoSvLQ=Onq4Kl$b*~H$=|X)z;J~G_UFsd%9v$4twgBWj{Rl&o1BKQDz^uJJtF6 zhKG}NpM9O-`S0EzyUlv3?HYfz=YO?YqcQ8}!d`2J6K!654%i)E&rtuV?ow$W%egfj z%Gu8z-)YJY;q*TH)5U6$o_p&_lX69lwf61-rkU@qwfFySmftBYKH=Eo>e50HzQbR8 zg8w)@QVzIY``rD_S!4G~yO^>y%Nh+>BX=;?Z<6xz43hHLA?nuFEbISb<=^c$d;I&? z{;9toSX0e~G&(Z*E;IY&h(qFx=Aglm`m55n`|fP}dNsp-Wq z`%3FyP$-mtBADL(p~qyZNnHN^eb3!u(@d;iU(t6JnCu+X-roMaZpXz}b)swkeR4Xu z|DxC0Ete7(eVXd$Gb3wn)cg29zg=gzMux0evUBeLBkwb&E?oDKIdFz@&X4kzy4MHq z`#soSzpMJ=-Pby?nZjw6%fiZM8|%DVbv6GWzkU7xU+IRLyV4?Rze|br-w)td%lP>HYwx+{86)ba{P#^q-0Bdv70>5;Zw4E&658fob(`{jTNBnr8h}q$vCJx|N4# zM^AP;IC~a5f9mbsUkk%eiLZMu8}r;g%KZ1eZTRw?EK$cP4>3SD;%!L-FkN5d4Ban=D475ceLxvcXNg` z25kFMDRbxct!)MCMf=}NHEnI{m&^ZTQNelGRZ8GpG`Fvq!O~@~H&6a5xoHX4s+(bI zD_SS%20m!Xwo)|M5H*kWeQ1un?cfbvU1dNn+%wwP1y(Wz%bj!a z_uh8x>CV*!mk%$m`B59Wo4G^1Ham!kz4y-Q-2HDW7L+?&vwg*~!(+TE3|@20 zWLn?tY+>X6I@_k~T*cS&mwZlS+H`aP~1vjT%O8^ykm%!<*{RLg zE%p0AY}&C9R^fkz*3VO?PM^ZGb;^738OI-QRI%yH|M;ffNVJA|*U6&o>7EDU4!_-I zQ?ch`1((UwYa7>mZerh4WVy6!&!VS0CrR&kVf)=<&9P4Tx+?Yk?S~akADg*B=ggLA z=f9sw>X@5!S6g;^Gv2b6#7tWS)1B!XMq22aCSnc*rFZ*LZS?R#SZ8AK9M$ zzjtSxf4I8qcb)V$=SYK9o-$v!oDSsON;_{X%c17eD5agf;eqT%<~0+}=bjd6pLqI8 zuXCu#yj}MC(O<6^lukZ<#dP7xu*s(St_v=!Tq(3kf1>&OXqs9|p-rOwkNS(ZUPXjI zb>Nd|ihlGyCikV#9GU64>zF22uX4QiWyP+bT{&6b7oEPfFNL?$K9c)UjqfknYM<;k z8)Fjl1FT>0oVdfw*&@Y|o16W-`Wn-2>tCC>L-r`WnYL-e6Sm&P77Ps1H#du)n)272 zDQesQuW$SH|ElRK8>Cu(3tyHZ*nH$!y>gPX$ib~9*3z3q(e)I2JD}y^sExmzHdL{pVc-Q}! zS9|-nZ921diKbnMUs5e!alMMI`OK@PrrO}XV-`ur#?0K2$ z?)b1G!b;`1(ME}+sAEQXtd<`ZR2L@CmgWDM?;!i;P2Cek8?N&?ie{2W`;PzEQh15=?z_g;2b;lSxzjJy-Go^Q{2-wYTt)Ja{S?9{jBY|xl z-~I$0-0L|tzS)WK-X-nbvmd=lnLbH+*L>xR5qa{eJsJ|}hC6~!&Y4}d?(> zrUz!VC;LmbGfDjITj^0Tp|4$5Q6PG|-@BEMJnjB&xjw~?tm6(5Fo&>wX|6=cB27;^OeNLR;&pNR>yj*{J#)QldU*-wk?#;I0O{upJ zy0GDY1@p}U=9cMq8u*(61uGL>8Dyr2B~9DNe&&>)=k|sTev=H&uRkf_qVwS6v0qJr zGcR%UF7tnLw7E^5g)PT^lEhrEjjc&yRn;$cX!D#i^U%q)d1w;g-CjP#BukEjQXiq;-KaU~Jt*1Pu%VI^}T8?(X=_?N8%!rkD zk2w1*m|QWN4GV1{Y-iFHaai;q$QusAH(I-58mA6;@{Kmsqo-d@wz2Ni-q;_ zjOQ{=6V%wzpkKS9pt1VPNXe*nNeRS@5-x)82%VIBOew-;e`?uZZjMI0W84@))n|N;O zS{vRDsySXYX{My(&0Fnx*{>~T)lTYW{aG=w+ch@T*tWE;u#(TLNa@kbq?TFkCwHiI zPU9(>(O>oY_tAtKDOH9Ndh}?(w;{<%j)ZZR-uMlXqwMCJQ@d)LfnMEc4m*A3k-*g93|! zZ@06)cmjpR(P%*2`&fZ+42cyEJnj(-hH4cH!OGVy0rtZIw*}BfQP$ zyC=>QiH}Z=J$Zj-`U)Lm;kDbj860(={QO$;T4QaRR+H7~>8=LcS1UG8=bIFxt3NNd z`;BC(OqKho-MxV(yL$Isaov9H!xN1iHt(iAGG~2LU@CXwu!g+eu9)w2>h(tJH(Xx* zjCtXVZU&bbHqvW%>v%#Q5r+O%Ww7yUp9mC`lBfB&uetnuMk`ca2& zCGUBstPC<{XxV=Eo8)cx&FO$(`^uei^(x0+9uT<~oHRGnWM!$aJL7fJ@^w)`@3=%x zJZSq@Inlstb-Kp)Gc!)lnjlzt!%F9;Vpc``jkr}BA{%mL>^H|uwsEiZ(dJt2!cn?z zUylCY&~LjI&EMB@@ASIxKdiStte*GAl1F=E=dmgG8=G`qochfDFs}BbW?-Pmt2bJY z<7{u%U#>Zws4#s&h>%vXkk-vvMSXVc)h@Qxk6PbI&lhq2`J|(c{o~9P8%wiKKdja) z_|)_FjOe^g`?g;WF;uxiB7w3uC$ z*Z;om+=}myO=GUSSS9g6>b`;I+p`*Cc`G+HCWqei4xLe7BX5|Pdp`N`-;_B%OS6j3 z&hHAmF>QD6f%`v-wmofBoNqrR@v2Rt?$#VWiK%IaA90`d-j_1RHF4SF|9dy>c~CUx z{WJ%YB#_TT=6>B7ZF_!l)VGO~ef+;W@&B(epYTHkVGsORhdp+^J@x$u1=es#V z!XD;--BQ9ip>OUK|0RDql4EynSHG|~SHg&b7F?&DzU1PrkFD{$R$2V=jJICVX8y$I7m2L4A5#Nb>Hp zi&})280LdC#KX2CedKzUk4e{qhS_ zi*|fj{>O_9_BI#3ge|kXa5`Axt=#vHdXd>pY1>~|izKd7bJIR2_Bz#So~Wa*O?44d zw54N9ywrl8%FAg_9A_*%vdM`PyKRf$mlICQSJwZU#yjlFp-@fX$Y5#b0_wTg$4|D8`CFSOBb7l;1l{w&Wx`}D-O!3C| zzQ)3P+*}=1xuZPS=Y*=fUl+frUi;^}g#z9Otn<9{e$-doSp3C)%eT*o;n)84vh?Nr zG28YRe7*dCm(YnOE-!vFcp z4@{9ik1iF_D468;=!2m2f_BlbN|M6j5j`o3_^qxVSYLj`mV@(UO(RkEoxGKU-EQ4H~rQU9p|H_deiJ8kNVADm2~>@M~}->6ZjkQ zehNzW@uiCX*{CVIzo6Z2ui%y!Pao;mr_`jKyEdCA;_PN$??BE&&$ipm+QH;{BD5}e zx81hG*1<7K?ZL^moge>`xR;w zT>B4c&FA=3f5E_^OEc9~<S zvq)9$(!M9%o4rFlWWHaGdsF@L_`m!&EI%5g-aT7hXlzkz`=#pM+r)s+m*nFMm(?&@ zT;@=e`}=&;!=ClxEPog(*4<4szry$DvrhPVtq{h!_IbbbAMD9z1n*n;c}aZoK_#vFnCQv3 z%{JA2UwAJrBLzwwQDOs>YlUu_O3H__j0q{{4$-36O}r-Jde)&{Mz4qm!ptO z#*&k2Pgf~2G&wB3`1dR8gvm$KChF{~oOtMd%0xXEt)!{XxEH3ZX^mJ@re9YlIQxjo z(I$EC{ayEO#$6Iyn(gsO=6Kuw$1l9i{}k05{X2bLe_vhp7pD_9o~Xsv?5lP;`uyvo z_7`8jo9Eld|NZ?rK2F8w%k1<17ysISIRDk=tBwDR3*Ab3CN>T0Vveme#S1aFbBmYlU*4a$?dz&VNu7JIh1A`=^Jzi-*D~+s+*P$#5Aj^t z=iZjM(CSXOb;ZV|T5BIM&Rn+iHd9Su#!Ry$p6%DN*Ii#dDQw1%)sH_eC=YV6p0RK3 z+mL|W*|TM*TspGuq)X`D`xj=LerY6=f53>(!0=Pz|Y>opJJ&Q}#VvF1>Aid71Ho8@44U_L$s?Z5O*G zyxc`->g{z4gZ5fq$Sa*%-QI7)wCh!C1 zy7rUH{x(xYgLJlD-Bwn7?%1lxO}9f!UvxgbkoEM%>T{(le_QRD&pyW>J?z^F`%4r+5ie_9t_kI5z zSKX4B89LiJgqRO7L~hiXv1&@SZ{e{cZl{hene4ucm1Bvr{I_lmHPx3Z7A}#KE!+?_ z@y(&`+RfXu*pJ4q6LC2BEn;WrRGYlB%?)$bt}Lnd-rbQCyR4Gw^_4TRZ(BIrPi}fK zKlFCZy0tG-jjF1rHgipxEvq%Vv+BX(yS^`eY~SX%u(dG!?6g^H1P*_`U}kY&f5Bpt zGq3m8N!|N$m5Y7m!*`b+3U3HBxcx-<#vD~iUE_&stR)#-%5$`}%zwXS-kbaF&XF}L zYfm|Nf4{P@D9N+_ZESzQ*9aSzRY_~73irQfew3KRD!Zn_ zwin$xu74sa(fPf`qlLSRo|kklG*S;sO0TNPd9^NSuh4@qkNK_d?@zu{J?+=5DUY~k zv9GuvJY7E`ukW_$-n(YkOaxEp33_e}_T+ac&7Q}ey5{|loBYjb`?$O^v@UTQM4f)bz0ivpfZx7r&nIQS$(g z>~e|e^ES>(2r7AaTSR_^3!8`PRQ^yaj?nc79ovs)`+6rWzVz+Nwp&s2rsy&-NNFzQ zwc=J;_hH`Lc~>_swTfbSliZu_z9jw7W5yr7KNST2*B(lhdGOHcfV-%+X-|Q$h-T&y zR;8(2FMrC_t0$P5oiw<6dV~CeGoQ`hN>xs`cp5wP!9pS7@4U7r=S9`=ISPlpTO0J+ z@qMle&sDA+b-UN@{+%T|nJIxw;q27)40;h~UA8RyyLlfgM}G0`>DQJW*5020`x4527?#k4QuV#5D{Xg;Q z-!{Gc*Sa(GrFjbWu*A-ZH`t;0w62M1$up%}Jlpu9FJ>#%ofc^+e`Yo9%!+3Q8rKWo ztEq{7T9I2?UUG+Rd4m5%#>=76>3m+3|L)e+Ty^l`@wY3~r4ttC)qiG5joaYR$(;Pw zIw)m==%k2=y?5Q_b-3GXtiR I`EAx1wls95cIeKvv%y!y7z|W?Qng4Fh7Lbq)zx zyJs5SGP}JnYAZkcluxJjZZ)}W^oA+=@Ae(@eP16ce0N*XRqV;~%gyp<1!p}MaN-vb zi^|#k%=N&Vt64njSWic2I6W^2TVCAe*nKx|u0VH(g6#&5d;W9FD+)Dk&%0F5@!?!K z(*{QE#>IA*LGNY`$L5{ z;w_HPR$ke-@JowRj%#&&Dxfot9$m_y=pHbpEyr`CGLCMTh* zv)|L6XNL8*6GoF3X0x2?*;Fl5eCHC^oQ<8O zlD?+yX9WDFzirz-ci9cOavcHQQtBBDMbdqu1M4MNC-3zRc`Wbiu0rYD7Lf40Wo`Vo2H+1-Z^8+&gkMs3U% zak?FGYTvt+^ZQh;>UN%8rpy0f?pcdu?S?yiF<(C(VY>D2=Re-sOjY4|8D5fqHd-yo z7F;;V<`=sb(|NCBC+q7>PKX4RR&xi0PPe_BdGht0({GnG=I*>-s(7U2nC;@vj7GPF z79aAQwDI2gt<(QBpEI4V<5u2#x-h2wn56Zty|LjLLf=Fmb0!o%ef{}*{^yi!(JTJw z>|6h`Se&<0WZUD9Vy{K^>^rmY^?sqLHC5%CLsmM>)m|iDaY)52e)rMJmGwVt4|%4f z{Sf*q?Uu0q-eOQwA$Zg?=Sg-@$_$;}^3{99ISvzlmk>g;5Z z)QzXux;PH0t33GFIeW`J`M$lU^HmD%>iy?ioi?c|HoNS$kn2ZI)&U3UI|3}XtaOSh zUk6n_usLKSesUSt$z?4S-mNLZ7rd)C{rvaz_x1dbYtGM^d?qADYnFlcqO-1xW*)Cv z^1LO(X@1R#e~MchWnEGY`c;F~jZexvy8ZnM`h2G1 z#%z^(w$fkkyp}f1`my~M8?)v=uh+Y%HdSLUL&K{mV_OKTZLRNM-ir=0S))aed;mn=S8U$6rhbctY(hk?@WuOvXS8qMatrGJ zsnyeY+0g!%&B6~7T8|D{|6BZ-w>+=;^rjPuw~t9MhaXyg#Ddbt} zA8|Vq+n(w_olOLnlhoO%CR{O>`9PZ6A*@xgUh6vM5j-8vj%_59f6Bi2?@*YBkG-SNF- zaIxZ_@GNEKV7rcKy=xLLFkanIBW~m@WU^S`=;yN&Y->X<+G|{F+8(}Z-Mu&M-dZ&? z>sjY+)Qt~!jB)t>c$(4s66@oE7Iz*$^f&Zxey8#~yX5}TrF;_iLcT3(vDGR2o_?oR zVWG(*{_C&yE`IX=&Q>Y&oxd48?1Qv!_PUE(WgL7s`O3wF4;INwj#p~h7}&lGe{+_P zUDN2-M~|N;ODqx#n{O>CJHB>D&&1fC1v_Gk%1%D14;KE^$?(xF^q(d}xa%Ch$M!Q@ zCa`XCU2&gHXL&H={!O^M8UeAe6Fo7B!7`{HI6=xXmjSG)GxCnve|Lq2mq zZ?o$8&R-y3yywEU=DkaE&-8XzZpfHy`(ewwEb*etpLN8NPd&HqP&#mzeX;e+Z_ghb z6*AcKvSt0k1B~11-EEZfE*#x3^Z9a@@3x$e3I(}S^*H$V=&9+fn|ILX{UlUrwAtT39+zD?>6-_H~`{(_)(<0?Z$29&a^BGJ{lyhM@9qYruKUC{C2FUa z25Zmt?VBP$Se*4t*Hi3iop`uX=@G83s5W4Qnn?29)YLbjod@b` zI9n8cUUpox-LYToN%z|b7kmF_4QBQHzM&2p3CBKnK0j}A(w29-aImrSq)#5wp8E|F z?IcqDId$J(4nC>DQFwJm6}Ozxiil^o7N0kGl=N_e?p=S?11V0E`^rMEPnE9gw`e|Z z=*&I!XXMiLDXo2%FN)YMP5sFlwd|jS?&j?8^}!}LLdxc>^YNJ@c5M5@H*M@MSWd_* zFAF`;(%fwGOsDRTVa-cD={624{f$y{Rqa=9TE)L$){bUH$z$_p^~9amdSUIe;_<@p zUS9QYdP^oub`CLfkDStVCpCV_-6J8pU$C4%{yXbT`_zoH@`=|fGNSUFws5b_<$KN( z?>Eo=+?m*VzBK~=Gk34?c&Sm6_s+&&I{cTp1kd}~D$jG~?z(c#^UI;n+_`f-p4^;# zRY~^A)33Xqnm2D>^jDCTOuX&ZtkFk9Mxsrk0Z$8K5u<&90Rl6|f)?YO1w zckFI?oyC-`doRxrU%o-}tck|ndF?Z2J3L}jh)8+)CGGTj#zmn#JfGif-SOt7aQhia zh1q(~DwFI_OgLpNcrbL6_r%9nd5hYApNh8ste#UcNkuH`Tyg)->2v(fuM>~?awqy- z@}s^PeK(>wjelOz?qE)NTCuNw{k&5hP4{y*321YCa{TXOBy2b>sC@0zIXRYAH`nl1 zSe9R5b9vHf_F(PgZI*Iro>Mv5dOcsJF8eh3T7W~~--}G{DgifEobikjS`gP)XtXpq zXPcGBgr44y@5*dh&I;Vq;mmAco5pXimDS;LB}IULws`QoM`c%%-s`e81SaS#udkOj zib^v2zFYdgkNBL1i<*B=z7nu%n0-yn;m!Qmt^6|$);c_D+bL0goHg9f;Kx4Ucih^} z?xuTAp4fllK=QSlmam_b)c#l*)qS1$;-=);yPtMH^|bR^=D$GRrEi%0u-5frfHfv(bwSQ%sI=`VdOSUV$o8d@&YCfup>`jFcnYM{X2{7Fa9!nH+z+4V1v z8*a4*{J8Bpqw*ZjqONsu&H9_?-Q7B8UT3v^%gw1@{tG_PU-F{;<>Zv>%KFBW|6Om` zceUVXWm&saz53)O8q5lTmt+^6{`p_})Bn)m6Vo@wG7C?B`Ah<`+p7Mo^zFXe$G+Z; zSNyUx=D@6iJQ<-%jXB3W1DCtb%9*HCD3{S0C#XG<%k$>Fy4v$IjStUun;x6rbm%~q z#dYK7b&|)scf0QS@r|{8|HmeM7IB}?C5l^;It99~zB`()Kcmxkj_#fFMZY>pJ)SdwA7+yZQcm z|NgqZX{f8M=6hFv(BA&@mG`L!E>%q2s3XXEDD}vp4>OKlvY61d-7q}#=G4;C%^@?p zf>=Iu=O_Hypmot_1!ku@TbU%GckoiXvr6|l?t_u(yf zMEx|sJU-d|hur4)%|0+AMd#tI`Nz~wr!_1+bK=VRKkHs_2(VmutL-+qHNn&V=h@fw zI{S6C%5UbF_!b^({qlJqPtKAVLX&&r!dG8#GYk&0$y&U=JCxz?hQMWKIsVRh_tL{b z{w|xeQD28ingZ{ayZ0X)VV@NlvbyHJ+_s&nRx<21^^+y1X>5)t;&acm%3wcmV3Tj$ z)VF=C2d>Y`tYlhzQf6`18M_kpl|EOVT-|jqSN_H8bt}5m-giy2EB?j!;-MA)?>#wj zPW^rEBJ&dFyq?jyrhP?0@FmwnMkylQpIn;Q9`IDmO?xYSW3v0x_6Kb~(mN&2{`-`6 zQdszoRdQj{vS|7Gd#o22n`V8=*`vAW@ZC4clP0>K<$Zr%f?4I^gzoR&=kMh+apkE0 zl$dg9;k`}5X5V<%T(M$W_2r5}+$ND#*BCX7r+EMMFk&g(8gd}ThV?I7l(%XP&yo)g zTrqoe!>@e%uvCl7aII&g(CiIg)YO-LXF2RSP3o)6cb?BJyHowbi>B9~yPF^RmVfT+ zMe}z)nSZ3GXTt3%o1ScT{<`q+-HMWyNCB&?xekpCEm?m(X6|OU5N#3?uw;CFWU}kI zw|lrBMi?*tx$#aUFUOvvOZ=8g3AAkF^jz4mOdz~#Azxf2(~Lx}h$0h7$r#PIQ>;vG zwclO$LTZUhoseo^piO{#9OGN3MfE2vKUhx>pX46zvZ%vR=4)gG`|qGNE7L>YF;0&C zxN`CPUw=8D=I*EyTEd?=@l($d_jN~nWE-L`2E}GJUrrBU{}p)6JzkaTN{a{8ybVPT?MYTY64FBx+;H{A|9k<|F(TOC1JpKvFBvk zr6<1T6V7zHzb=`~CV#+Bq~f}SP4VGNCQDPhJQ=2Q%ig``u!L=0@oOgY%#trz)#2u; z+iz}VTyxM*LAl=OY{v5W336+^WZjb&YlXSqe#UE6wzBiyQ?bzR<-WBW{Fr<+Z|Sk; zFS;v|J%v5tTmLz}hg{y#yMuf8%D+tZWlS@)JnOQ}_O4@!XsqL z`t|vu(<@mSO7o7#?%N{KzdXi|MPK^~V`k8H&q-gs7vAhOHRZAN$ z{ax2xc6Ey0pQzm%yO=_yKL-7HJDMw6l-K%AqQU04tBkwMJXUzQQ#pc^jWVe=u z=|z8kx+mn)D~~_S8TG3Vu@ro)pQfgGHFNSJ-L%`=-|a4BF0M+DKb7!wyT;uvv63r7 zTTOYcO}#v8yR;FL?dyzwE}_ihkA&_#6+OklsmHbN?c(#Hd+&;Ay9@u==EHrs{PwT8 zPm5nD*It>T;Ntpw(y_fYYcjibAD-rtG4Hp5@Oy`iKAAp$HuPBYehmBYBWB-`Z8j_G z_is1PzP0IXSKK|7S5x~W)=QL#9J}wge#Xk*DiQk=i{J0??$?>!efyZ575_%9GpClt z{r{Lbx#r}{%WCbN69SpCE$m)DowCHX{?YM;U$>l;eOfGaqaiWJ{AcZXd81$dj+;N% z*!Dy#(Zi_kWAi^-&$OAZ)@2-!U0mt-$n&Jj`)MZi@Bat9imklG`N`LR_Qmxv)xZD# zOLQ^fJeb35CcEeCGn3`Z&#Bt@x+LFte&NGzsjEv{w`Y{GaA=iFFXcB#cyRa9i=wM;ET?$uZnK*xUbL(b zF%E99V|kggq~3<@g-+q79?zF2C)+gI*yp`kHv2OB<|!FQYj$@Wd%XX~hpxmE9S7MB z<4clLuY^-o?m zYwRlgwC)R9T-Ut+z0|o^R_XhOt!g#Hn@4A0~{&GqD<h-MG$0ORyJJ{4Oi#&9Ge%>|s{xrGZ_p|@xJ^yp)PO$8Yn^$(2=j>V) zSf8AuZ}CA=_`o**a{ajX=113M)Oc8UJxLaOwdnlx&O*%}mszL#N7bH|oio45E}rM` z>5FTY|El4?{-dVh?8QL-#QFMX`xvd>PiU?*o3EUgo? zPQkQgpZ;%8IE8Pr+$q>9aYC)Pz9NXRu>4*=^RWprx2`Oo^yjnW zV)Nsto{E0nG|O7-?dc1mA30mzJS`JFldT>k_w>$rg;Tjq-=&njitPASKjLQN+WdBg z^CX|u&s{Iv*)z|z|Jh@kr?m#2Gx=EOWnUF#sZD7&|R(^U3_$P!2YF>juQ<7WRNS^0{W zHV1hs93Fo@ASkq8>dEJhEL%+f)`jk0+@^crhTGoe6F0;X9-iJPYxckXb6Z{PG|4$h z<^}Jw%=AtjTvEhzEy_pu(fVyqSN$lqK3`n&q~_;$Gxf-}75_`Fzih9HK69S!vv=k+ z23;Wo>BFm!s?GU0sV2nx$lkrdD|MQ3uN9mSnh<~GN0Gz)w1QZn_@0LUH^0nVQLLaL z{_uLF&8`K9E0<5}Fe{HdJEhfS)!cgL)h8pe);9fjDM5ZQu-SPHQ zR(lc8GjhfA^O+to+3<}FfLB4_GdS`^|tyW+#7rLS&moDpqf zTCuG*@_EMWIj zSF_JmX&5cmy^wLWjMdKOfzhvM+k%JetEax5)50?I9$UtDC#UaBjj_t_j`(}k2RBW= zy-Kl!@1#h??CsYUdMpn0?B7^$%)LszsmH}$w}PYPr%OZ3^EOqQBqylps$^Nul*-)r&m}o*(}MpSmd9%s-?E>vk@?>#lLyA>KU$Kl zV>j!CJy@j3&n@?Nx9yXN;*Ha!)GQS|Hhkbce1^eCw&}+2u#YR&WXJB?D!ncyx%aNn z93AtMg&So~?qa$2KAZW4wb>QRDe=j(RS!N-(3W~7yr%5K73miu8L3sSlBeo2kJUf+ z{PbGj*|nTmy{l&zoND8DJQliquGachi$kPu$-B-v&NJ)yX-}EIf1YhUY%aLJV8zN; zeNwu1!EXC|)`(O^eEy#A%DV9Qst^3V57_Suik@B-o5s+#@ynD#MJc$bHZlWalBY>T-POh$yLGVGDnW0%dsTBgN|Gwel=b3=l}EH z`p>Xve#T_R4w1>(UysyB?lKHZtz2fly}WfzPmI-CLZEHuza(N=ufrFQA;{Y_|Et|E_VVlNswZW)x9)y*-u_R0f7G3u zf0<65;aT+BMO#|=4ujbNe+Ad~O27EcBkmqh^IC5B#)bR8plaZm<@@#--Td~qV(E5< z`SfkBUw$+349F<7%1s@_N17Y+IjytQm65MRFN03l}RlXq;MjHz$tK zlWF#oiCR5>51ThWoq5UgUk3l;;;FOW7}tMGxHnh$5Ch|u*0n~WFK1k|-e(`mD0RRq zS={8pJT}V<3%DNNbN*d;XL;+XM@kJ_{datve&eyxv(GWAnV(z@TW?^3KL_3I9uL>tnb6-X#*~yH?n3_uA+sCnN5L|7BgZV|L9PEj6u%)XM^1|7%NX zCi?1Ksy`|wsge9wvO4C{2AB0VvjiDBrZ-*l;!?a?{GdGd_N>ySXTNUan4r6LLFHx3 zn{lCs56pidBl0d%ywJZq+Z3ZGc=sLjt9@u@S1HL zkajzK`Muezy7YC!o$BYvq;?n_z7XrXeeS}}{fT=|Pc90$`A(M2FnEi|n?3K6C}4J5!w?ra;d$uxTcwX2WZV*8vVRmU z>uA{2m@FN~%~91;E_+n#{O9v-HZorV`rCK$7FZiZuy{Q`d}p5a>b)-Y9G?#?>v3bV zsoJ%plqZFC;|*>p@9&;3l0WR8_i5K8`-Xnj_Sn-E`>sVY_POjj@`bQv3&%6Lb8_nKLe?(O@eiGn>OEy@$91L&^>5s4 zPP-lWQeseCvGH#B?tgzXWhy4+W*L4j>wde=PIgt@ntQ!_JOp@*7x>+2-&E4bAn~2! zfnHOI`Y3hrQ{D0(4;S8A=>O-~$5hK* zV)Y-nz2q6E`(CQmNL{w}-lG<2@mnEllkdicZVusYe#{h6cm3e)6c&A zM%hws-G*A#Ed`7%4iC%MrpRiXU6vB+?!G=GU}4gSMKAvCzq6;ozdPhbVi(WLM&@(o zhZIw8&1n~(r|qkkBWV1h^2yP8;!Wy10#3|baCWJ3{W6D6u{(<{Bs|WKwGG+x*R-JTjSN5pg(bg;Ug(Gvt>+k34HiUM~F}!kQ&xQJw zjAv)KKf9xdDg6T|AGyd*;;ngWLNgNRNEBv>rKvBF25kv`Luxfi~1&kDxpNlAF{{R zt-r%pr~7igIm`YWtDuUyq{e58N;iIX2rIp4F@0j75-4b};{d~@Q+L-{&zn_cF~MUw+d{QnX)YEL zJKmp4JCN(cl0MPw*u$v0)#V@Rf3B0ec<|^yug5=gJufXZOw>~L`Dv`~^HAVY$F|wE zQ!W449i95}+rxm(*PfdmpR~MPwV|}So$vc=wG*ai)^3c5{3CnZvSsi0i#Jv;{Cw(L z+@C!sdt+j|)&6dsu`-c^H|lB!>%%{jQg>$_te9F|F6UKLUiO>8y}76Ry%qDs+ zK-1b0oZq6&o%X8!SUCNZ*GWi6f`w#F=-_|nmS_9v$$=fHM ziDcXT;BLscTIo4(?<*nGB)}csx9FE{(P?W zJ>%eb{`@~H8ISV6&`n(Yu7&A9mn$D5@1<}av%AuJAmr1k*z3*mrfsr2IL)?XR&QDK z@siAAhMPRk>Z9N6E3;y@J}jx=SH6{BuW$m(oV3-lF%79gj~^{xb7@9^nbC>s%=)g3 zhvOf#?|X8x?Tv7CqAkCo`-4@rrQsWm=c#@Cwsb>(j^h0FSDa7OtexsAvq`KmL+@m0 z)Q>$!GzGS+aM>7bcSzcH>1gKDJNkUCdmELxIaM;* zi|jn(ro(s5DlBs1Iz8#x-qZhH-|xf`>^Y}~f*u|HfI&j&30d8uF`oR)86CDk4;&t=Y6P9+}XDB`00~d zU2Ep7wE4dL?w=2Tex+V*yS$~o%RCuE8qH&;d&Reozb)U|hw{2e|e&zEyJ80J9BQ0>f7k9|s!NqJ7TbqlsX zT0C)*K~ngG>5IRmt#NGKKY8J%QcbJJy+;q&HrDPvk*@JX;Z(p0b?3L|G;Xi5=I4F+ zLG|UAo)W7$FFQZGJe~ZdzF~TBYN^J?XZhAA>Mi@;wYX&W75BWuyF17<{OucZv=(i%nRo#E-Zh)Yh{3&`MJrYRk+Ualkvuhx$1!K~xl-{|wbqGkn}se^Sp>{Fzd<s_tm99@vz+ zeER!HdF{+nKIR|)OssxStk2wft!AnBTDuJ^PO^q}v@%)lGq8`k@Zjg2(;EsM>&%ud zJ+EF>(=1qY-q5~w(#pQy-7M^UGg>ZB?=M`rHt^!=@W`;69u5 zgtJS&S$RKxtL>vI8>pQuaCJ(pa^Q*N5S30XuD^+yzeH3H2+V4+XW`ee&Iqc1bak@o z%9FoW**Er^wp~bBDEYFrC|Xfz_UU)3Pp9~1ouAoR_0izfWpl%qiO>DiXN$1NO*m1t zjo~TFq{XaN4sII%3=)J6?wq6h$4a0%BDGijTs@m|&zW<&tLHUsIv!z=!Lq4e^SZyQ z^MkUPfq_pR{?jVi%yfwFx2O5!<2I9*Kd684>T0rF<@MEbl=&*mC(lV=?z%N`skN>{ z;j6jZgLfZ0v+vNQ#oik)f1Vw@%;2NLNmZ-(KGx(bVb(wU=7zkTcXFZOUboD!_D#w< z75eFw+c~UcZe|^ptJ-t)$H#z8e;Y2YTg$XwI;q0trrV4N88*MFFTa;FE?O#SVz2w> z`Wlvk@AZ5C@Xh726-htk)Ad56MzwEEe1pI2S-THgB0urBBswT{9hnie|NMOGnI*RA zcUXOvO|ABAyg&1`tmW)ocD`|mPk!zGiX*YAlueEiTG?bV{6gf2(i zRQkWe|AR(-d1Gzqss~ltiBUh;!Zs;=NUog9ml%F?%Z)Q)wcFw+)K7|^P+#8^|ABqM zp+5^(RJ`$6Q^sg_Dul%&;z@w>?M#75oLhs9#B&&~8l8yNGyAtN*}L)l&dhy}6y@22 zj`|)EH8%iZ_nE0CzTF872K4Z`D#m}h_K2zw{OQc z&0W4SAuZliR66~I$1CnA_aKhr>y}SZohIq9;Zx72#MRC0a!Jbt93y`0G!SqxUHY%& zk7CH-sfkmg3-caoSax43Lc~%t7*}Vhijy_DHtr?ZaBHXr$al|O3eEC!XxQ< zIYAPf`}g13Q*ml-y6@iAcicC9HNTskR}dr<{rwMD;Lgpfqx@V_9zIsxrW#zU^}4P= zx?yd_o6RiTjq~d3HS0U`U0;7u2i*@eyY6N#XSoygzkLEv{QfW2mKQl zDlZp##eVzARw;2|!S;Hoii0oz>{=Ke6{C}RT=QLgRoTw4w4k8xn^fj!K5%)NA-H@W zuid`X2i|9!LxQANF1EP4W^(s#5&qI+6C-jrHoXe9{&GjrOi4aAytTpoHw|$e1o}3YlEWL9(T>1Jp$KMYQ>O44nY3iZ}R~8p3L?}Mg zG+TOaQp{o#KbO-NznL7gbZD9^V!UZWcd3uee}`!?a_&%G74{#dvl;;#}FVa9j2I?lhL`Dql~;&QSY&Q8Rzp z^Cedsz4UcMUkSU&JZvt?T<`CDvVQA2tApOg>=&k7VcKo}aiw0w>(=zWyX?ZsZS<0s zi!bw;_cCd>+2zeq5jvWCS67{LIs12F3Sd-xpsZ-(uppammdGPyD2CuOk`jB z+Q!Dc_ph(}wpVAXL{zh14GVkU+mp!-1s7!>H7QFR`?S1qw$tNS&z%x7iTeCfXWVc6 zs()>K=S%dvE1y#D?s~O~=k?4DUo=WXZ9kWO{?7fTJ!_LpK*;1$!>6C`pSyeFt5eJ; z4;${3#Y)ef8%ywn)gRnmR2${QGu8WO^1H4pg@M~^xX-2Y-)3^IWijq}S$pa9hKAG8 z-s~Y?*WH>MJNMY)T~6U#XI1|n-c#^4D756wgd?(k_3spKm;6or_ao3}mgu?7o$ED^ ze`8V6RkXP=bG|X}t~UZ_)=f-)%VX(yc&@_{8{5UPf4aMltogs_P>`qM4WV!c^%y_n ztqg7_^|jY++q%Z)8H0DMXur_rfXZ62TaI#(7nep@{@iDCAbe+fOuu;g%JSzcFEzRS zD9P|SY4+lSwM@Nd*Oul7OUk|}oS!2#%kKQOsb39D_ntdcqT77DXo}GP#I25B{e-xJ z%x9;5mJPb$$T!`fN~_;=S%Ba%tB9zHr9O`nR4a1?;k&WNV2LnUc7nze8V61b2mz+&(TOrkMUe&Ie+c@`G5cP zNMvOgX~#|bH~(FEq~^@MQ=hU=iTIxLKT|FK@@=GR-Xj_cUcIXzAGI81-S$*3)~ zZ|dj&I&0>ve|K-$@jvhX`uR*PW2R{nc3X&)hlx_5c6;9ugSNw98;+>B1>Z8OaaK zBl-9JJ)LxN%gp_nUAJbcbqZb+P3Vmmsm zXQIo?`aiGtXbayCbJXkDx^2yUYmL>i?EjfseJiKDQq^?r_B$C$u0dwDho_u5b3LEGy}mW+b4mFrdySg&d+&<; zo5m(})G$zp?HxJ-`{xKAF~C_R6T#9QuaEotdh&s07Ue^qHc3S4@Lv7AdegMmZx5^4&bjn``JeoB zhLbPREhVfBnztv#%CTj(a{o^;uzl+3($NyOW}+o|_&*zK$Tlw$lPFeSa@83SZ`u^94 zuStsTT2hlz<*_i8YtN^w&AME2@}I-j-+SJg_pSXC=lx){@^uH-^o({M8HF3!PPd%wn?AsDF8E?sfYMH%)8UeN`N8+|-Xe`Fm!7 z!55F?=Xc-KmUzN+Uf@pe(v9s7g%U5PXv~|~Us#%FxUln@*u15iiz1)rZT|K9>oiWm zpuS^YZmg2@X#8mSe;ea}{T_zqm|rj0Zu>K5Ef5v#nJN;??h=*8I<4n~%Qmx)X2zI= z=8FpJECikEfAjvzn*KAx?{LLr9u~zdL62@bOcqHDINqnmDd3eQ;x)O&uj9;{*z8H- zc~90>ZDgw3_%rR`A>GXvPOi$isdmF?!neLQPwh^l%Vt1xUXpQXsb^@s+)SzPTA+is^jM- zD&{CBSn^kF-{r4-#N|cuyn;jBY#|#?a}*2wiiq%9@$UA~Nrx}9xbb^;>^D+<|L#$j zfAehV1x#lq>=3mGX%L)uDrwtMrH}&$d>DeW<%=Z?-C53@lC?I_E|+P~v@K`h6gzkL z)eL>R`mag?e~Wx8OnJ7}`^-4te|F}A)e9D^p0%v@TTI0{uO)tITb=Cxig4UgbP*E0 z_V$}q1KVb|xd#0Gtm!Gddx~z|aOycITkppsalyeRutHIo+f;wqq&;)RB_^=y+MM9f z6;SXFD{-8*MuPq2q?fitZT<>em?yiAf!lEaaZG%8);Q^VFYHb5q%#_=J47k!d`6)n-rH>KisS z1}P2=E7&?+XSEx1P0Tk8_fg_9;oH2>p}})%f9KSAujbo}ws_d2?}*jeIcK@z_q4q8 zs^8}p^i*F2wMEayreu&!u&`cu4*Ir>%V_XMCDw z-{yt1tEZgIMzsc;5AoJnLtse!J zaHUpkGSGjt=ECk1&wNBKC|!Qn=w|d*Vn%At_0~wuqZVh}a*l7V&5(QM8XTsx#rm?) zhQ|x0h^7^k&-V9_+A_gvcEqlELN%A{GCu@+OV`G|)yQ-o#x-OP8nC ze{bC;86RkoZ;`m`PQUEUiY}(8qJ4Z)k8POJj{f93)AjkW!TGT3F@Ihp#+B`tNY-7F zZt*%>X$wzY((cPAHul!rzBIpK!1!!OOHY!;nZoSQrw`-BZZ5PE`l2&g#o?sQg>IG2 z+-tT!WLfDW^j_f0j$SXFkfX-wu6I_6%s!(S(Os|YW^&^Jf41-GAEo&^hZRa@Uih{~ z^kfGAaUPC|A_~7fB2_avt}ZQ9x*Z+pa9VK>pOo|=L4(zbdzd#DbrsI|C$P>WP)|Pi z_?{fUX&+w*^v#*t%l9z#&c3~V<;&k{?l5?3*8BC$X+HCS8IC41D^7%aa2$VmrC`qP z$K^s#d-e$k2pfJnr~E5f(b@gW>j{_rUR2+l|7W^^Fr#GsSC;+PQxamso2Lh)tL=)4 z<&<<qQduZ?U-wEaHv>=LhtBqxd4c&qc$TX?{G;Q1M~RVR*$So3s;5a4 zS(-HOyv*6YeB*LWmHKwYl`9^(1bgUlny=Zf8PTq(RmJyi8pCFdiWNQuGhDy2KkR(E z*3jTI!;U^l?gl{v?d@+5thrMr^Xz7rclq_{?VWSB^YJU(l6MFxW>{$Ua#v|XGYjXO zy)$-Q_buHOe#82P&hsq~Ia~J~+c~XGUFezFp3mnPMb0#t$)&ZJNz737%iU$*eXHjP zPn`9GM5XmS{!4sc?`8S1MzWwdNjtkOTJ?Zb@`Bj~d9NN!6AV4JVd9qe9%nY&+W2J2 z3s+yfcmDfR?xe=U#-vaU`p00VeGku~DPEm`V_NC|2zKQ$qzgzt9 zo>1E67Zyt{?A+O4yh7ldY~-BCggx)}geS|SeCU(o|Fpfx-9NhCDeCLf1^-^$?D@y} z^5wf=&fL4x3>VIQXZKXpPVR~8wW-y&Z^R_UN`CB{e=v;GLy(oZcu5UgtDe8hb6#m> z!{+io6*KnF^sc*g=+nJ3f+QD%%NE!=4n2?0tTyRIA2 zBYO66s%eqDJh!L*<;lKV7Q40V{v-DOgUyMYrgly*RHy@d|{sSyK7AWpXTJ6he(^>J{Ik0 z6}kLqX_H06MD3-ElupmEG>PI`e9tsDJXc9bvg6hEiLVcwyR&SfrpTt>&-Wke<~@+8 zz%cVDbE2%6)%Fi}^zD3}cr4nuQGeE*C4mzo=KVce|8L#fSBd2eN+laZEPngU+SwZ}Z?^NuG^SQ9K^OH^Ki~UEm_=y5F?lPuePfVOXM8hESaF4`iSG&vz1S`zkQqiO)k() z>e|BcN6&uC$LZF^Wlq)Ezy7_S?76@vr;iky8L-Sq;_G@F#-kxWyIyQ%?Tek<#WlXZ zo8Pn-t+>u(H!tt|y0fdRU6xkMP6(Uy%A@zvE@2+)iD6=zA9iIbm=LU+8SwHe>hXEgR;Ss?RUiR^XZ~ z?(?Vr>_?M7%iRzA6lKaCjr>@2(pE9e?W9&{Ak)6orJFPkf9QzcxBeI7oNSLzo>P`F z`lsksEqa%HBKye1b60PQ+sZn-TS!!WB)m{1u5k|3BEDdF@wD`K# zE9R|W|H9VqD5o3d<|?`2_T>$qvuaQJg#Y&ZljY%X;Gs&WilXGl;DpFX7R82K?b$kS zSMEQ*I7a>X)9i(3{R$QS8YJgb{?7aAe3fOHk70yg>Z>#!!(%R;zVYW~XdMvn=)BaV z+}u;*@_ga6ueBcO0gjiCvP4(NO6}@+Wb?hs~tlv;L1s(94^zKf4`Ho}jfzB%;OnXsf|x&eO>|y%s-t^X}XqGx48)T^Bx& z7x*=OW_-YrNYMiuzmz|({mP{GBQN1pYx>cH{^z6Csj0tcJ$S!(r=oMP*`=Aaoxzo# z@6O)NDC~XU$fQS^A^YC+*|SY!>)CuPdKTZ?@B{iHm$%jm`v|CCthe40c`-2Y_>I4> z*B`W)F;}?P!owqR^3Ad|@lBl;K|A-aGufl}SpT)(b)NZ-AYg78m$M$nosx3clzQl8a( z-xaO6*PPqyl3eE4+xY$R68-;c>JO!yfAS_g-!5kVZ!MPzU6<7DGGw;|8J{ls`rKun zZSdsD&wmSxOgUN8xvu$Sd`_H5lfI>Dyny(eN%|Zgy*AhA^d9VX5^9|oIkR3)-v6@+|*qE z;oA*G#TzH)t?s$cqMbFl=>F&0xWbdq*E;TRoU-76a8KB;Zr6S4`+jl0el}G+_P{aj zPuJ4J;^tkurYo@WtCKYEE#<1R=Bv++B*d02(7Md0?ZfdyHEh?;)w`0zi>E#))!^?> zd^~Ia5{r*g-1j9z7Z*&MBwxGpUDlk!*y+`5jf?9avdJ?hWM3{?8n-X^R-${W_8XZE z9*;jr=gpnn}V>GQRy}_bH_p z`(m##+sg}h92Zy_nYW71>|KS!#zclNpN}<)n-6@7+Q6qOpX719_sDaR-22zJ|L%&< zT{(s0{l47%o%N2Uu76$>tS~FJ45@ZMA93|2SBehPtfzAWt`>a19;{!?w|mtz%^ja4 zEb>0Qo)GbjMLa(L;}w-M=7i6(vK?<4r$-z-qC9n1YV81;SnKObhwFwM)5F*x%? za=oPBHI0a@Exby_jFRd4`S3E;Nrm;Q z%iXLR4_s(%H4v5l#FK>^pwE3Txz5KiIdF zOZfZOxP~6bNA5n$)>XS~+~#}qLi^l3^CEc44kqm|Tz5w2>EulxEfn&0+BC+r&M@VB zIxXi&V1%g1Y_=A2-u?RRiBLXd%4(sIE9)D+$iK3cd(_CZ$!O`$vQsS%lNju7&Uu=8a%zZ5 z>ER3N>AD|yXBVG)ZhYZ=d9M2Ug1IM_&Qjej$hFNVvUWwlLLa7cy+=2dr%W+ws$V~u zL4mRH*WHPqN-rb@N(L>9>0|rg9djUxPw4p@f$gm_Q_|~&7M}2IPvt%w{{Qy15+AO! z^VjVc`?KsV-;2AKH-8E8uR5e4vnxt@t@?tk#aA=k+&o@ClYQ0oX0?ao)9g6Y$7e-k zJhD@){Fi!L&Ju0q)Y-knSj(gIo&WD;ue=KDPe#cUSY6ehtv9pOD|pFQwqFx#6mIXj zT689RYra26MUp?yy4g3|AEjM9f9cXD2KBAa85vl=Hq2qza{cYY8(Y~YPWg78`GzCo zwRLWb;y-VkEHiceY2o@Qf|fFx%-P>UFWz`?i@`^V)qi=zoyEa!S#$TwlvXQr9AU`i z_%^#P{L`%ZgP&8DF@$}#7Qd6pks`)#JU8;pu^S%~SZ2BN+>7L!=WREwL4SRu>Hoxvr-x_mXqvViszSC^NTrf9oaWC{6h zdRlj~->~Y#?R8AYzWvF%anhrBvok2u#DihM9Su`KVH#|MXt5|KyZQ+9I&Nc-X#n+~;YvY{lc64oSyNUWSgXMxp<}AyPRA1e%^szjk47BMYHXM^b-yitJfAVwzG<8?|0k`y%WiR?zWw*n z;Psw?2~(Q`_kKSkQ_!5&mu&K(rmqzPtL77qM#+F$h>&xgUP*&69NwZQ1Uo&aOVfUpa1=@|M~LAp!tT>nLnF^ z9aMU9GS9a$@VNfw68F04d#-R_k&xQApeLzkVyAWY_RViEl<=GEa(P3cj-q?S_2ZxZ z{51J_-0o$%!@f<&U+@)~H{~C4c#yw}z4On!ir~IGC$>Smc%)CQ=K0z zpMLdMfaao(Nq=^_s;|^jY3$wE8l%s1rhrY{U+6Q2HGgHeLf z0^A69&}3|3OqqUElhLPM-pu#$2?gbqTc&ABaUK@9J~eRq=95WNMf?4m6@^WfUE3$0 z?@(s#QgmcPlj|wQa^|y-LXFOER*F8OU3gjGIhUty_Q!a`iH(+)mm+dfS;~xh%u*yS zbzL{IXAKMTC=BM_BgxYl@^QMCpNo*>(JfP%k9%w=_Yg2YH6vY+-p`(5V#a=_9SkC(yEJ>yHj=dNA{_c_C$-76jWS8EQXI}NV znrE^yiq9l`{-cZs~_>*I_vXlch^iCTI@GkG@<)^Cg#?WqUH0duzgCi9xzLs)+&R%fhGo*J9Tp$n zeaLoM(I@2;`L4ukPUM5hrV2-QeL4DP)(RsKpisu208W7oVDQM2+Fh zN1jV-PVtpzs&Aja_-M_%KCbUeyKH0r&RnO}7`4{sbazRf`s$X?N}8)qZfbW>(b%ey zoX*+m6f!wY<6hL-jGlwWF&ln7KHS&1b9s(Y`TWb8RUX7$?}^n*^zq;}nG)I0j%y3tXu>qgOaJ@0S!ZAsR9n{#7l$N$>u zw|Q1>DK_V>mn~>&yqOew_fsO*rG~XtzYcwryHiu=<9xK+X`}M(MMYU+#y8I;ec-Ho z8?qxl+-%+FCw8+p>{zycr`$u4ikQPb2M$fyVcMM{v_W1%Uij9TpOKTo6Rz>wi+K6lEzKPR+Rz-_v>9^*I0P1Bw984VdPPcPADJjD2Vy14=4S;m{w zSq&Ngu&{otRG7|c#OTRrI^8jnMYH~DlyAPYxxn7n;U8|qX-qOc%zuDmR=<_*1t!Ni z&e6&oBGq#_3RRsaU3_x?``J@|TeVN`zMC`WTf!TiuhV4C?UCg3{Qaia*e?A~=f|Tn zC(QLc7jWTOipHbJ8y)%;Rl=4JBz;cZlJjNM+o*Zbx5o3B_42nYjTfgk3urihI5t^; zrM~CT3w;g0j*EixJf#45B`D*=;w z6WAszur~c-n#)!BMaGsTP|+cvYJq-Yk=o+M$z}~QLCMN2#~uj&<M!P(GBHY}9a7tTAd~ zsL5QWpElcfYt)PlwSPZ8e)jWZ+P0NF>!sB$KYp5&+}C&Jiv-&zgVDN~yx2_9zzxyS-)Na0QWSz?; zzka5^ozF7=X{$eHh4Md)^RJ)v&!)EO)obz4S3H|f9z3?-=JCk+rQgCf>rUR@k-0$b zI-8B*<>#lvy_w5vx9_XleQf#Xr-vpjeSg(raVFC-<*m1yM4o@VvXxOvG2{J}CrSU_ zRfXQ%d^2>d?~SXjm7zQ2|4Ui;`dxI>35m6+KhHG#V))}s{Vc!!*H3@v<-Im9v|q@x zq`2VDvd!y09DcE;^hk%vvquNy)`sRZ&QuY3y+I{m;|9&|iv8uf-!hI~ZnyQ7c_w>A zOkx*z`>G>pYc9lE^auDnINH2njd*QTO3sJ;^rcd#jNX5Xoc3SzbXjj?mDR>CB}u~V zR%bR9sQc9ib1lA6A)qezE!ubaZ7ZklEPv%+y6=CUJ-)E+^UC@6rFK;Rxpv6)qnU8& zqazc~mjB$|sx5Ktzy6-vT_5K@kbU)i!nZ$iDJ$+fzj^+h?OopfdS?EVyY{>I7V~d4 zzBq60N&eVc=Kh_()Iz#7_%<*fTeW(rv{>?+!q{!9Q`RX>n(bP@r0RQF?#m=c=I`?p z9S?tOH_PZPkoD>OJH`8NP~HPuuRAY{gjBalPE?M5zEp2&@{#JKib?GOi=H<*oIP@e zmD#BLu>@=KtBdo6SDU>%6nN;K#}et|e1?~7^>!vLE%`1Uv~Azk@_pRTm7TV-_uP18 zc=>St(Q3V7`@OL=_nTAR+{_?9o)1#8{k1RpDMxS$uj+)Vyn zoyC5Mz_~&j5-%wi1jO_&^4{plZ!GAf`pd60?dq?)H|HzA5_UcA%6Db6Xll`cdO1=5 z#Mi;w?ZP*tT1$JKH}brdI_dQh7q@RqFZC9m>w4@r$74%X!kyOS87F_fvn)`Up7PgnYMXRir|cbD2u>Msx1^88tOdutrS5`C{tng3sC zv>x;do0@$)Sz@u+SAkD zfwRA-L~GWQ&v)A+pI<#%V|ahw$!*21uPXbd-g+K!Z<^EG9TH5N{$JPLCEb#HVgJE< zX*z$LZ~RVr7+`r%&w?Z5_nq0-rLwnZH*KhYC{z`<UHI^v$QsRr~VVD_%yW`$z$kCWKa+q{wmwT1@_ekDueem)`9yKIqRBhoHP=@i%>LT7Yv+sq zolmQNYwv8Z+Q;v1mtX#$&BxP>3pALo1wAq3YE*RoZ8x#H@9PylZ4wIbeO`BS0sp&Y z@0P`h?CxyTo$#%3VrKVN9W9lq*KXVIPuH8`k>wKD`{>P~22Z~8XXczPKUZTc;`dH? zPEEbz1A9LYCr;O<7cE?UDoaoP`S|ECYfwbu z<^Qk5!bpYw=w^S9bs)=j(hf)q4ad>++X-SIJ})9Q?K_#uohkx zdM*_>L$%|7PiIfhNk`^=lLak|1Tt1`yBx>HIME|T2;a*9oO*<)z)Q*9CB#SV$$S*jZy4j9bXy8JKmvnfnT zGtL`VpH}bQ@+mjftp5C`{@_*WH`nI>+*a{_`rFfAKbtk!heDwV|cx`-1XCE98->Mn6u{c&nc@q--p*fz0ASM ze(%z?`q39#-k z6#8hb5dCuT!!QpAtF0}cPDxL#y1Oc8U!%;XWwt-X8>%MWt2Zs3wq)O1TMw3xR$I1I zUFlAEk+yf#$ms-&mdoF3eAXr(Hpu+?Am2uvA|W` z?&sX8hs)xwPjxurI6GOB3fME%%s_6g+M2JoYw~I*;dkW|g(#-nEMamZq?9oZ%1% zP`j=0;~1N(|A(-@Q_IcMB?JZD?%3@axbQ&s>7{!wPcE@Le{F02T5-OR3sGtEW|5)M zA3VhBKMAwsC{1XPRiFPfwPNx$z3pOWt>t$t=ZaD8$Xd>k^75S0D&C}7ruRF&Rv)54qTR_P`N+ zWya5X{US4LdA>5R++;j@a_!l>uG*U}3Ab!NFw;G0kwBPkN}%9JrHwK%W=Ieu*8K4z^elbY}JYxoM@6@0Kb>bQnUUYwg|`tf-Zdm5H@YwQw{8#!-pyb-|=cW(F2C!Kp^lioerTjhOa^%>ocjZOy^F8P=o z@wi@DV%n>mRSj~YPuD&dDr?l<(_XLhNo!4|eeCbo%eaDSKAqowT~I=paas`TK!yew(xC#Td>~(K@eok)ZP4Q)k{4f1` z7QDRHoiepPMzpd1kj@>?OUE-)f?uAOD6vRxFn`#SIAyJjg;bdOrG9(&sDB~r<0ifn zobP`#{gTGU?KAJ*%Gl<$!7`-D-nzNH)l=HRXqiXSH&3284wk9sd5;>tFZhw1JtK+Z zbX==cx|MWtl_)2BVn@*4{W4iq8e-G$$L{M|qA|52*!a=xWA9j$>vvfR+`U^p`G$oQ zopVF`LrLktF2W$)IQa9&Q*bxyUQjrmrY!kn0F@4d|7m| zRDj>s@+Y%buwJP%%JDRn-n=+Lh3C~Y#k;AmIi!Aan6OD+u`PJ(cI?2qZ}ozc&z|ex zJ=VwH93;!ED$DOxqZVM+c5z{S%HwwbT~;T}N~Z9YPTL&ja$<&RrkkPrjBi?xoxd6E zF*@Y{Ha`+_ib^Zx23Dqaq0x+~K;{%$+4hhyHq_T8se9M`OW z!@y&md{pw`my|RPp}oHMX1o_rfBT64pP6G%OL1lSt(>BaZFeP8-!~kX*F3Mlp(LX5IrgGhCgS@}o}gN-$@7z|Y~DRlHToM} z?IN)7ycEZxigo>$zR1Wgo!=QG|0~1yfLzU=={bM*UXUyMy+1%f%IV;XmHPt3n}4oa zbL!}xWoEKjc>9om#lzv8+MSLskuA(zQ+9qg#h=Qjhb%vOYX7QtT=k4)4?Y`DN;9tiKjG=L zclQLt|J{6a?Ek+_8sV++AFqmjI$t-(evS5d;f_ladp(a7Xy2)vC(a+*QhrR}>M}*` z@M+uQT^WOzn7a6;Z+2&Fs6Qe6D^ zYX8>#bvMbj|EonvLo-Wc!Gy?+T9!jGU%5XUKCr*f`G4`=4|;#re+#?(aL>_0TU0D9 zUCuY3Rk^D0R&ir-K+&t?t}6_;NWI8Wd3p5cgNDYQo2C~uHtkjaGPmFGZS?EOXX z>HDR_-ASRk(_DQ{ix{f8Da@IcR%!o4WA827IqlQUH=YvwF>Aif%|$=dqHkX8(4ETX zad>g#1%U@GK6RbF2X8ERAS}dxv`wb3_wSDFhMLNW^R{ZeV(6Z6bH!|{l849Z*mv1y znC~p!ZdjjL>+j&d;*xWgl1!A?rl-G>W`Djhr^J7%^vdOL?|$P;U3~Ps>wNh{1G^XE zHx|y7k0aMR(aEY~#_&5N%^|JSFb)X&m=zVR_n&z6+ArF;E$ z9q0eHul&!0Tao2|5-vL#t2VU<`=>15@a-DEVB?c>^KRrk>p#oYT7O%%XqWj}n_{2d z=6}wQJXx z_vhjp=jbWEl{MRMozj=YexXid>*_RZ4PBY0tmg^~dQ(lSmZZ12RaNr3`QKfi^T~aM zq|~a4oN`u)*{9<6)kSV;ej8`*z2t|+;mgh!E`DgdG-1`r#8ulaUtICoQKO_~8~ZB3WbG-N?0@?dgLIopG~DxSJ5?{% z#(%xD;P}59i3L3~Qdjxgp3af|v88X%{MRSCdj&Mz56#^E_}uRFjz1@jkEA5M*?IiJ z!asf6-qpqIcIv;p?vBj1+yC~*b}lZLno=(oUb|mbYmE_u__z1fKimTrOH96gWaAZ$ zvTd~w^A=zI(dqOi^Em612cMh7=fB$XAmcde!^DYeZ>);8g7#>j}pp>_x>OICI1~quVc?$B=RaOI?y@skLS*F^JJV)++I3GB>oxm{Qor$bu;<@bU$aV-uCXlsr<$Q z54m60YxMlTxLui$)wxmqddrn$7q4H@|9KOnmxh9`$DOWb#mF~(yALDiZW_({tI^TL zceYKc`@Vk0Deo0g{QQhfEIU`O)wS$PUcdU=qZct*k3Tz{cM$5gJj{8r^UWOl{dZrm zdG;7Ap163)rlneiH&_ZYOX_PKjU(^qOgj4gJj)+{u_VRT9^*irlx2@%P94qq{APLj zM!%9Ey&s#t>7DMlo~^x2{CP>OAzUFE7oy_n*0b-P4C(A99|o2|Sj{CqAQp8n^Bw3r|zu zr>?&rCe3`Nv}#-SAH~I|m&Hjgx*H}Q2 z+vjGTSWzz(!(Qq?i8%+$?%of(av_tHOC|7?HSe|KvCG+m3H6OGp$e)_yIx828Q6m%{{ zMLTI_z^`2M`p057mHNHsirrw6O0kGqRa<)2<^AN%OSRfv>dja%an+Ukdv-^Q z$jo$FuYGv$SC>Z98yg=!KX*H>Zr`c^rzKmMoM&-gkxQL-e>;=<+ygfq&E7t!|0R>2 zo}cfSq5ZBhch@YF9A6gmpuKK-uQOJJPh0L#B-0dTviJNSugf#DcxwU$Kl!HlY4J_n zn9si@DLZ1PS^}fiTCo+Evw~v+g2Ux!oiAyxa$5WP?6Ebkvo=^SR$6VtvCqEOf{S71 zY9+stE{0!^?@vA|^}=9x#Pq7d^ypkMt$O_jw{+@eC~juGt@QDrnZIK=%i0&4c4qFb z+Hp5VXS0iIq(fV=?DCf@xWhGUV_7GdD9GFimkr&uOyPXx0((($PqVEjCpoBR#=Ho; zt zoF`c7&%`|x`{bN($3`sUYr1V)!IBQ{8%>dm4RQ_^crEci`@h`rUwWn3oU+QUX#Y)& zzb5{siulQTBIcs~zle^0{Nimto#%`CjHCd3|Rv#^LP`<@mtRhwM zzy(nrYs=ZzEx&x4wVAxq5Ax*Mn74RXaKy=;J9vKkpZctHiH`^73SQ(D;x>Eyp(O8E z?qks^f4;{D=jj_yY}~kF=ULU(!XE@uZnP{)f4-+_C znRf1QkzIhT&6BTd>eJR(6)db3VK)zd;Vj^P`jJYwe7QQm{(_cT;ts9k zK#uc_Ho5v&c-B9YHp!i`eXI9Gj@=vQz1eTF`rYR|4#%~#&i}cskiz}*K}}=p(i!K= z?_a+?yP?P9#>SeIZ|)7#m7SE%3krSRFhN6TQjwYpqg++@Mw=-bajH5V^YlO8J$|9D zx$vy(g{S)dZ-1CKUR-eTiCD??e(AUMIzO!@{INMVbx*Ws0eCCTs|4h0U zU;eZ0ZhrfLkW{hLSC}sg-+FsKG_{baugCoQWv|!O>g|`F{B$u~y*R&~WrecF5hdsE z`)%q|TP{T`nJl@8XVP(*#)~`NYG_(ckXSXFVfDg=r{s>lKK))VzAa*I^D&!qd9v*) zo1$+PdU)A1Khf#@;IR5i(k#D8EXPhITmGCEE1;D!DQfXFIrA*JkQK^qzBUkV8#x4CT)TLHj>*VjISM?vQf;_q~z;)k>d|PElcUDjo8`alV4n7`Rs+=<;A@( zeGc!xEE{$>DAHTLI@_X{STIn87qX$=XZYxbrc;?V4cxc()ca;kkO8Hnku3ugvq~2LK zsb~Hv#djgE;!g1gA6O_7$X7Gh;MKz^@;X7bmA76t=A3;TQ;_}Xp886zGdy*i4<&b} z&YF6#Mo6Rc8voOySDFLGcKB~N7rD6p(1g|!$!Si0D>;2Krf?O%m#%4Y_gV18G^6Hn zz-7&oJmw0kw2SYSEx6Xs&nkC*#=6b*6%743eJtxl`7_VgS6KLz3g~3a$d3E5VT0M~ zs@&aylBJ7_{QPcS;R?vzw{pYJWzr$LlnO1_e8cBTN?-cO`e(yV<;U-|cI`0^PLhqQ zaZa8v@6h9yYZw*ZrU<=suUI&z$o)f++$q_WNihPA^JBS}_Y@q-jAweztbdEY#~@tq ze*KdNM^o3t$K-)YOkS9Tdc)IKV&Dg2}TMy0;+4BJ>WgB_0rcusCUr!7C7%SW^% zX4!r#(HTwd6Q-P5vp-29NqOBAZ>^P6x-~==tju6me7@{o>+QlF%ao)G-kSfIzxaNi z+zllw)7FG6o`qGrR!jA)UOB60)~)(S{xV!n4$%iWO`=aXy2uGKt$6kLjjWX0&49q* zzIDxc>sPKwlCWObTAH23>ll$9X7;b@+`{q&b(hY$C$&cA@2RqEO;tC$G-p%sr0G4P zc_r3v>*I^R-Z|#if1T~S*{_zizZcB5?Qu*JoXyLlyZ6z@)rm9O@6GM4a{V&vweLi? z`klx7ZrzXd39V-r-7{&m>5}em-*3785f6KDr*~>oUuoQ`#^<(Sx_+hmPwcrV)??aW@FC)c#k5Cv3QALU=f`|a zx_-6z+Lr2fZDm3ncW3-`UAgINS7k^nf6T6#KaSPbpLx)?xX71#xn$VewCghtuGv}8 zcFFKV!fn1rsbi*Bn%&yT=#k_*Zr0k<72eS>(;-VSk%{knvJn4_;1Ct6~(WV9ak2uUG(0gHZOB| zzzos3VGCxRHS5pI+80*xvq3b1>%5o4Lx+H=I*YA+PHk4Oc$_eMi;L);bE!u+ygJ*n z*yxa0#P#wCrU{kLgJ;h=Fi(5K)UpNh?`!Wlo<7HNP6%6`*@{)U?)6^XYgb&mujU&1 zCC&Rt>{Z^3nl-&Q%p)G;1n-wzmoITlN@oAAjTRnz=I<V&Doi+L=GvHO5FayE_*FP zgtKt_(LS@5_pEYLzLwgDM4zjzU(VCmYH_e);c1KTUo~!XY`8s^l#2uX!b}Iw8^!a-7aOYOZtHNXcUooiN;gwN@567I4U3GV533Hs zLQF?)`=<8!-!ASeU)SK4+_c1$cmLbhTMK0)i~VaOntR`xEq>o#el04o`|q~<*RT0q zVt!rzfO++c)wRK;ipQ7UdMjnu>GE#cQr}yvk5r$(^nLHk4=on#_dlBEdv$Jj!INZk zQ2WmwvmbXSKJ;7NcT#!r1h3bR#Ve=W%_~{>wq8f#i%Fy0B%LsI&idRZWjSYMw=N8w zq?r+E-upbA=T7_D^|t>MFLGb*IlAk|->H9}tXkl|j;kQ}S7`YA9}74*!WbTAz2NyX z?OlyHljaeA7N)g#uSd52{<4~9&w-$u@2j&6Julrzd9iA1=ECP!zPicJJGkaVjl+DK zzq_NguiqACtZ#5NI(usQT%`-Vb6+%SEsjyC{L=RFudels)_L+AStXxdm=w$r70|Yd zIHG&+hDO%@txB1DuO@~4IU9UK>N@++o>n`ZN{u-;Tg;vXZ!NmK%Iw(Mqy@`aL~fl- zl_|=6yUOI6-i^*zN!!#EtWUhpUS0EJ&YZelp**uctCzZOapTRdchT7Rt+7w-tHhxT zeGy)@w%>xwU1phZym&3O{brl9{XGaVDiDQVLB|b0vh=97@u9UbJNm5I` zus_^k)FJ;kFg5On`w1&~`{FB$xAi0#cGj)f=e8tM=Xq#NdenTAj9M41^Q$&q48D0} z{g!fr`urn(l2;@fj;s~E7gO(__>M*S`tP@=5ymTx@Ym%Z}0N1-phF%&!b*- zFO=DEGPf9?s=fB(oI0yN+A-c8M^69QaE4`B{fFoGe3#v`3o%~!?5k6SHveh002#)( ze_6~%r@F81DLW)0x9WMy%(b5%nA}jkXR`Rtjy2Nz&oyl>TdI*cXG*(hmagWU->arg zYH?Wc;!^LObdfvTZpZr^&o3?0H+jb@_(pw)`7-DKQ|)~=;RynnCqS2Oz^}e+c6Xnfb{4c2d^wwLGZHn?r z70H;mwFQNia(leb-Ji2}kImn=pPmc9nfdQyk?j5d&HGoS{QmBIR_Ni4YfqSz*KJ+- z^Ig5Ujl|*G^BZedK7BA*x0>Bm#Y$TE~t6Q%RzbDp{Fa8JZJhoKe}j!Z*AdSjdP-pRMvL=@9ONh z@WkVx+e{I64#Oo+Hl2x%SCHjcq8dES(51&pKp^^6oEK>1o!d4;&c(bcz)yKmn8tFk@#%CueQ-JWgL-dyo6foG|hjTiG|y`Rsno_uh3 zLg1u5I_u<5-4PUKe8nh#UUB}TB_EEQ{!>@vHR(K?)C9&!UTPoSvBjm#yZZ8s$^Vmr ztVf?*PO6*yTkmgreVBvcq#tJbdUxJ$I&CgG_2zF^Hr?BkR5ltj{3t3~rPlV4|JG^W z=#c1JJ5R4(@+9)9jwLsjbfD-`@3ZS-zD8~O5FK&QIWMeg()FJv`kPzda@d?pf45hd zF{NkIN^hM{Cyy-M^m|Rrj--btDsKHO38~xHZl_nHp1anc;mW*AzH!C%vVsn04IiHj zg9@78>Lfm4fhofGEH%A zt>-=vrOK+tlKbKABz5NI%9R@b74l{l&b(mjTl0O!btj>atCOxw=6uW{%oM1#+9=g! zs&Amc#1+3jX+JYu&FsUl;I_Yh#RBn3$9!1g+3xO|YRaOmq;crL(gjk5GcvLTxTnm% zI^(Gs?^!m^2DypTgjl`uB#vEND90np+&WSB%srNRhosdTb1$xRmuhajYU$y^ly_>G z+V#UrGM*dkwUgg>YWc)YMvF6^4Tt9zFa;?leA=?)(s47>*K<~!@v{GUkSUKta9bIJ zu!75^u+XH*5mL7|2d;Wl>N=TqdFgz!)6f4b*ZXLo^4oLy)&C1w)C~AjukyQQ)@*B8 z(En*hQNuN}alR{Se9 znbkmWmmou}{|m(i+n8+yRU(qw5#CS2R{cr(W)OR%MDm+(j`^G?nulWA!b0pdcEP|l+YWBQ?-8X%l>Eb)G$S4 zWk~tWl!Y-0$heDG?#lj-|QWPqY8|qGR9spH+qbjIPZw`!^}~+=To^Y;1e( zCnUD~&Ue~optr02&CQ#)ySvj3r*S5AZF|!k*iy=>bSe7NzUhfuM9kjydu_OUB%;3M zbGcM#7*Ch*#jA52JioClEin&RB=qVXgV$Zz@)<7sR$QKJYnZt@&`wEd;=Bnia)Ohl z?X72^k0e*B7?DHRe8b`$yXH!wm0ky!kLMDU;mR#Gs(9Ep!M!lTXf2K=oRUI-g_t8 z{$80~v7$p^YW(x!i0Rrl-k!=$-mr)-oA31IbvyD}A`Nw?9q(9cpdIv^=~qi+;z54d zw5^I3nbtk^@zPHhm&^Q8yqalqiv7otUFmxy;-3eES>>8#FRHO97qroP=@h6Cc=V@+ z_;Y4U`!o0IH`i3!|9ms)94`;2v^3LxJ(ZTtDzif(Lv4DhSN%CUVb2bSyzP!6TPMac zcEsMBVZh%P>odWVQ}|z!k=`BYiF;=F@_zlKXMAdl;*a*rCH0bjl24)KwDtwBUbVz4occ$G5LZESJ20=>MgUx-UOIj{cH-bo&YCdM( zOTZMD^_Px(&nTVpF<0l5gjtxxm*}i1oBqC25GZ!P7?gB|`L)vSzE;WRxMl3z#`oSS zWc8m7u+Kj^U*PBoKKY|RbkuSmXj*)G{qkS^C-G17R{efm$Yx@(CZ*kaP0vI2HS1m8 zmYuJ>d(y<$G-$QF;ESh!7R^yo`{Fn!e#*fx?=`>nIjk)`^PM#<^>1h6=bVW{EzAgmu1rfI+l9d?mC~d^~P64k4;rq=Y_X#dgo)NeP3MR;H7GpXWf@%WPf+> z{igNJU7tbY&%I68cm0?4xDvYh=+1lYPMi^o{+e!_-rw@*N}Xr@!rSgbO(74IGd&77 zA7wJV?P%nGGU=!4qTow$jh}TFI4pOX@HpY~B;`1VSNra7s6O&&x`?ab4c1o+${dg6 zO!pAH#;loOCbVns!v!WnFT)Qfavye-Jy-BUb)RAQo?@BX8aaRLdphU7VLasf<3wUp zB8T_Eu8FJf%Ph*=o6F~twWeO~)+UaYxUC#5e{XgDE$~nlVlH}nJaWU|UFPowwO5DzgGFoZe)`W?7HDJ(X{S46F&?h}^kzZH4DrgEii)a@UG2|4#D4fW z`+B_1oxiUio?ovN`9)sNZp*v<2koza`u2Ug_>xV|lG7yr9H=^_qqF$WgyVq{s+RiC z-)}RG&3)IW)z57GXg!zKzn{xxm;Kb^x8ByV~mw&ITo!0iXf3s}Q_701R>gmfIuik32Z_ip)xN7sv z9XG!RuGu|VvY<4=uyFTFn=hYV_Vloc$v(EwxjbdN%{TEmO5O?X&ob&ZJxQ&Jty>e^uC4{^R(by}^|UY{L=Mmuh}1ZcUkA?CExU$oR_lV+=Y6cX9+|d zwXaRz!8Jp{^m>*|XYbz&2C1)p)_)iL$tkpb^W{pD8y33FSx@f2?0K9j_%`XojgG0& zYz&F13}04Eh&_92c4dRkn-4zAs@HfW*4~-^oiDd?zQfAj>x{SZ_^xh`KQ5qgX;Q$n z4by9@0_)p+52!i1di%Rh-oz0cdf-~->HF@UI%_X6XXMWlxuM0oSw<&9=2cL|f z?vX%Aw~NbfwRz=jU-(I>qoUThdu?u|ZQtR5Vl~5qx?jXML|Pg)h0plwIEZq%?=ZZX@bd3lxyLLK5laFz4%aJ9EUjDr=*6<@*JP4UZhUc?ue4mL zQv1<^V(YNn)6dw-16MpK{`bny`Ra_{w#%|NymtNhdgi*F3vVS>39edWQPKPF@atdf zuN8FIzqEW4TlS=dtz=S6&FACc?eAB7ef{l9bGAkNj^a%Z*?79zmTENTpL>(?Xu;#Q z9N&#B>{G(j_3EP&k9ctT9{wCzUD_;pa87u)=HY`?VxJ{ql36Bg5&V3=IfLi#(Y|Lt zc4ha)#~tzHO};mRH?ku8HeC+?9#iwAtdupZQ?vWY)CAkx)4b9sDmw z<>R%emnSxdb>5g>8ul{DUO`T`DZUIetzlYyyuV1!dmJL>Yr4(CNC>C-MC4o ztf4H(!+yit(p>4oHEprB*1pnhKdp8;rj%PH9A=E!nzQh1k%Pt8wAUwJtz_`2iFg~) z9P#qY{{gMFw`Hey+1c1gt^0QtK3jS#Q%>i( zxT*eC>9fsxRsNqB@tB-1x#LtH!naFLt38;rH&n0m(SxgZv|?6;x1J7JvAI9YqNR?< z;L4(cfIWd04Z= zK9%b5*Bf}VWdE&;YL8!28c`&$QRlC2;#u##&RM;$neH~LPWqMTepAq=X}h%y=zx;Xz^WE`l}+xakuVW^@96vAMtQhZ|a|yAOC*A z#Ou#iigTabq+9Sj<)?|&y4_*t4kennh=@PwkvEHt6wHdPak{?*O{6JOSEG5vHY++f>|ZQINF%q;?ak2<`G*mU$jMWF2myYABu8t=MrZmhC?B<9UJ z>yh%+AkPT4+-Xmkf~NQV@jS_zxjjX!AyDd$knyS>$+=TzR2lfaFNihjf6QT0!!-ZU z5qYaP?$$3J4r*_6Cb2q-zC3nFY~_2C50_^?YC10xES-~USl`gXae?(6YwLqMemeRh zuPY_QHaNHJJG|hr3ICLs1xK71U)=wy^1J(`u#|X@&hq$e+>zJM8Ktk=^o6t8S9fyI`4Pqrl0HoYTVN* ze1@eh@?`QJH{}^AbLtNsIyQrC~lSr1zR9&ehhB6qdR@@`_lszWxq_9r_V?q9gg z+?cVnW!V-MZRvuK)!N>x-v*o)k9nOW@~L6XMzO~oYqkD;+|=i?R$X%Ir1*>V+Osy? zE-BUMoa?mkkju)qhPlQp?!41DLMeMaq8<*8EM7`m; z)itZQ${~%h>Chyl6z%1)T0Xxk)&DB3(y4vW?xz`=l)doODJMUJw+zPbZuq1Zm@eq6 zoT&OorJQ}gUah;l__x@AtTz#}7f!y)RNwXV?xu?u1TyC?wauG)S6ok)Q`O?G z?2Sk*kv;xX@-9`@%{J{05qSJljJ3kyrtoaH&Lt0jUo&CKwE13q`-7PJmhF0*IhE5A z*PNQo(X>=aam$h}R%eE1?~gic-gI2*i(CF$>xGMKueAhzJ1MYJufF%^pBaCivJ39K zbhNj$KEN`fy*lmm_WGaAPZX9Pyf*o?$FG?@z4zvD3z+da71u1yIJcysoIfV@6S&bBhj-H+_)VHm9uCMVk{##GE zxL)vi3(6dGx*DY8*Zx~)s{b-6UD-!m4_~}us&5c|J8`}4hsm~QqpiQ(J!;Xq5UA4UTK}zdh!u$P6?^ySra8GDd>0o1?H}B^+?XzXun0;3t zoUP6O%hs-<`W)9Iv$$hd|5yrbGmCY-Ze$y~YUAufQT3lcL~`CNd#1jGCUkH%s#5i3>If zZrs8^Kh^N5OeFbT=k;-{O_{Yo2st zR@SN|EMi;Qa&7V#N3J|taOT_R8+P^Yk4pB7%JMk(KC_4y%y2m%df|NaIk~QlObUBZDFNp!Q{!=)m3E0`MH z>r=J)Mg6DdrXTY5+TEizA^LQU%KK#>=1u)Pzw6A0*3KhRTW7>9h^cC7a9AAESQNBW z=wpYM6X(`vFQI*Ef@-(Qmxdu;MtGBeb~?>Miy z2dg&6%78B^$GPh#ODvl5l$XPD*O5D?V-@%_|2Ld9zZC58ELNc+utG7caTo8gxr+tV z4m@J-;CmPlrS>5Mu#ToXgMh7Xe-+-Je--5wXGmv$Bbj=#P#|U&dz?E zvZ{N_qZj>I4W+xUePQyOeL*=bkSF?+ab2T#YU4pJ{gdiby6P)7*2k3HdFOMQ<&NY( zr4+NrPwes@$ak+ex5dMX_x5(<*=c`nsfcl%T$7~zVChZ2(6^ZZ>C2ujVtFDNIcYlz<#9$rJFXg+}d%kIn_}fgKyS2~t7IKw3ObOd_wBqWP)}HX? zr)?`)R+r2==VG;SU$IQb&%g->G}hH}D_QJ{F5797e*2ZL&s~ioftQYp)NPFp1l#X< zKKI;#ovdXyKWfE$)b!V=W|mpAn$%fupV8|e;GDIMXI0bdo4Z0UnKDQ=hAiq0$*PyA z_F`kz@-1g-;kYn?&!KtY!W!RGnJ-0z6BpdyG{-k6Cw=i8rQ6lV7Kf~`|7R6Z`ywi< z^4--pu6I*sJb5L2*Z#H9xAY~_EFU&A%rX>KVlZNg-L+|h;&vsLXL=mHLi!x4m-|%A z-dV6})`@R<+__zuLxUbG!W(>bKPH;k%IbL9J$E z@3iK{2D`KpE@h}yuJ7!gURv4sB&{&b4XKWw)t3F{B7MN4+FFeIr zE5IOb&B8@rf3ozQG?bpQhDZFawLqQl+J{r_WwZX7!pc$qBcej%a@W+aVfTI)NJO|N z8f&gCD!lsk*PVHs_uLQOe|h#@--g_V&_%Wmw<9DB44bEa^s+ssR#oeu;qGH%5s<^r zw`N*;*vjU4ED6VF2h51J{;=6j^VM4JJ*?mLKCUc})%X!n@Uw{hdd{YjL;e~UV;|ky z`Xbe^m9L=Me@@S3_xkU@yf}UxWqvtfZC=!(BqyCk7v3C->0I>urb#%Ly2NUeAJ=&P zHb4EYllkGd@d=I<+aI1^Z>i#u#Kjpm>r=EBFfV3Xc8q2C zu7c9*fT<)!6W>-=__zq;Y$6QXs|>YtumwxRjG4MHmlygxR7 zWcrfz;oRhp45AG#I|28LG`3n; zbkAb7wLAj3n<{7d`W+N{6zaNi{i6?##awNEtZ8TGSSh&ubQGv9RQP^7h1bmT(tO6` zql!#jDFQECqkbyh`0n0(hQr*Tc)P|G|9-ZAAwq11F6}qP*@beP9{7viujk({eQa`# zB6Iz_Xekda#u8Jm$|)6h4cBiF+sxT6XQZ3+BkJA51@g;GG{jFYto7R^&gNO_eBDg` z0_!3@BhCx#Y+EhFlu9%79|_DAU-dFGHCVR&-rC#~+Z|f+cG&P;UvRIoWE1C(b$hM9 zo!xh~pFK&+#OvRzfAzf+oZk9~W~|;f-Up0EIq8OJi5zCR7ZWIZ@_(b< z@0SeeZz~&OWkRNvbnVffb&HX)eTC$$wW1McHKnG=Dk%7M7YRFdhFe-qEM^eeU;p{= z?W-^9Z0;1ZOggbPyYTvkI~&^@I}$hNE!p3+wc=>Re%pvMz6Faj{nHjj+E18}l;q^r zzkC{_b^fPCPonDW1k{!^Zg`R@@lacw2QHwb{=lHU# ze2Xt0U3#`%_XEdIXY(1iHDx2KHMe*t+8NLd!eRhrh2bR9=V|BCE zPTy1Z#QkWAfPd#g=krWfRZ;2_kF0R$`Oa7NqfDXf(7W%C0$Aw#rze#v+Dc2 zxF69MK5A!2rfU4&=?W3|HQzCV%?Ni!Q73 za6c-{R9t<+hWW&!=>u&U7oLDB?|&2t+~}4tSzQk z&rABe&S7!q*X-wala=qA9>4eQ4u^8<*EV0iLz1Bajmm}#(Gp?R>MM&bE{+|iNaf&eJljInQnP?(zn#$=i}tTkJ~VOvyXjx$ zv#ifQbGdxGC-|V?yGYB@_LDR7b~=S5Z#3n}&lAEM9;8@g%K!-lu0rnqKM%+l3#R#rSm5fsI>MaIUytn0Q_E`je8> zIVTS~7A@b{e0S+NE`eLB&h?x!f6dkNym-v~eg|AImi}V+sqt|a%if2gTqP^y5~FSg zEaMR`iTM=jD{w5Kv6??GPVZc_Mnus3Gn(Jn&Fkw9vdq0Rb;_ijEB1!8_;nf)mMoyvkc z&&o`6Tk=r%l+{_KTg%^xUVXMm=B~vl`|B@?f&~BHWP7>AQLp<(XZxuoS_>6Ve!2Fv znv?C=lDn(?s$-__WtPljd-!VI$~BMGYs&7PeX2OaGU~`j&FZhK=Qz#b*<@k#5*Clh+T28mVd!N4ig>;VlEgyf}6FA3I@G5`DlRr9< zUnkT^>fAZaq7$|3`bF-B3IDzY2+WtM*d?=f_Cb$1OpE8;yjghSp<2ADKu6^T*L2oQ z&qWt@D^0)q_VTs`zSl!#I5|AR?D*Liyj@hBXSm9J=T(E*mcMpvn|f;B!zoo+D!Tbc zo=&ffF<4&TzA__a&XEvBR`$-7&kBFYgTja zJFH;-*yObKjxeuzkzRuIy&rA2*VX)WTlTh0;;wO@tn-qT3%V7qcNba|iK}<{9rVgr z-YlpSxFyp*;80{?l$*c5p+WMr83)vsN=y8l=(5}Nsv3_&z2q#9b!tX>f=^HAZ*li> zop~cnLPW|{BD0)%ZNhVgs;p{jCl7x`k0u?d&soQAZ#_FP`|@<73k8DCDSkrYFIF{N z{<~;etiS1rTglfMcgn5#(-Yw)sWwfqJ%wjQ*&S!2wJmZt3Mbt>ZWy%1;@Xubn}fxd ze(5Q8;b_URd&%=cM6CYF#D_cXm`q7y>|(gea%BFQB~xA=T$p59>#WJ#SVxW*C{Oo( z|7laa=Z@D0&VTuHRNYNXbW2rx)!gtf16K7#4}M=dCwZ_=Jhb)m3a)p1Cik$a$^132 zKIu{Rso^B+LJw2Ew1rAMF8b@(?%#g>R9kl)Q?yFKk&=tE-$+b%K79A-&BywgC0={( zecbRjWjk~F*?EPlnm@}0E#1?uup$3eebbEfkCuAPUFOVUmCbDPtgwgcdWq=fd5(GS z`d<_!%r%)7`1s<2SANNU`Z@Qn~K{nOmN??ePLGVowQtb(TimP z(#5v|^uL*^-{~n{UU@(4gR*5q(WNZqHtj{#YMvVfKP9Br99yO~S=nr}4X4R8M*D9T z8@=j}sA~MQY~(n8Sm|k5drr$auGv~nNmY9fJbA)9-DmO)<24aMc2igXP?U|!S+p$k z>J0nNxt@Z*Z*orht7SRwNbU;{tGv|~lY-J`nsdFn(=KVDI)A-~>N78KeKUcN(|$~3 zJsz)V(NUwn?(D))vrWpCTeQ2>u1u6~|MhvFBJZM|>GekLp_85m%(e>@-16h|S(o3Q z0=k-BIUd*7xXTK*pW{3JrKKsR>HJlPpYH@6+m{+&N)B#SU!uOEdGqQ$C$AsrxGw%~ zcXRMrnPvNoo_*$+#!{@^sqyh|$)2ybSeG`=U-3pW{J>YBX`ty}HQ(U6>7yqjCc*loQAFV7O8q`HD z`e-~a?^}-A#EoSWw;8@T+u#D}z020?En9E2?Tf<87=Ew%_7(AmXLkNck$usbi+UWd>@I7~>*?<69s8-}7s0^uMZ&|CXDd|Mx3(n%or5%{JZq=G*(r3WMe9 z`0W1wJ38GweE*$4k0VuP|9kYT_V+*YKbB|Sem^W7^l~9bw}{<_`9Afsn=H7L=Y9;! z+x_p=traRSR(mI}50SG;u;8rDUutsdt`Wb%A&){~l@zlJi)Av7yT(y0?_3CaxPPQkZ z-Irg)v}$=ZFqBB#IJq>ty~{BCdA(Vt#8W%*tlw*-DxO@1zS{r$3KPx5Z}-l;fTu5EnJEHXi%BJvj&g|+t_J3^TJYGNGzEdVPXWD7k3RRWNtM6W2Hed{u z+fmG<6eY!=CDUJ1&A{IDPUga)gsi5-Ey=Y{zSTUxu<~PH@Yy>$Gs>qbaAhnr{XQ{& z;u^_0UqU{w{di(heRDz5P~;SdRV-5R^?XRO7XmwBNEcl(>zL~YGSv#OR_zS zl(m}bY|gC5a^>CX_~pCYZ)N3nNHDl8TsD92(|x}$`Ii2Tez&nCsryTuhrP(`4F+kx zk7loqQQrSLWpg}R=d~-IhmJD~WKOmDV8ra~v-6+sB~#582`yFe=DhXE9|9w$YDF&Yj$LVP=nxh`Zw4rR$YMkIlUN{r@dP zjs)GshobwIZCX10`F+o0zw!hUYi`zm$}g>bS?05aCE%v#|B%ysbF&VXeLW{_<5s-g zQF^)d;=?CQ7t1ObX)RdnWqzzWsaHslEjHG=lDsx zCUR-NH0YiDT|kxZVBwCqgx;?^mF~`5s&s74)Cc7+j%;8*J%8$+0|xcQ=Qlq*XL?kP zQ@MU>{eyX%j@-Ze%KYH8hX>t5O4l8H)m>)%sje^fF~{|$TS?7*UQ9K!$@5zj8sYMioo|xcJk>~vuZOan+C`;I+Kjc@6QA76 z5BKD{mGvnijP2aC-oFQ8pYaIZJDRn6w&#}r=Weyc)L%4E4BzA)K7IE6`mb+37%zBs zU`Kf@|Dv*IGdIRnt}l?gB&2ZZ+u9$-TlTLjuU@xz@zjRttFEWK^*GR#pvYl+Tb$ug zVd@MM5ht3lt0$UNkr`x*1f%}b(>COu(kaW=A4g7Uy@p9ItbV3*ncT)oz|tU zQ@eKJ7Zuq+|_lJLaT(iC666chBZRrX5!FR77h$s`0G4y^T;3)qkRJq>yaL21@tkL3$ zNoJ?EW<3ax);{FyqiQB{OD9|`Sy8(uxt;xjXtMvAX}hZ>j&48VyT#^F#r3>9#ch1z z)pn=zpB;!lk>`83@8hhqDhdx&z2#Cr%Rklrws!uPXXgvHX3o2CHOYs49iMB|M!t8e z#8lP^z9>j~&f`9(>!93DZjL{1>UYcUh~H~{Gt=SFhXa?`j}(S6^t_zYcCg*XqIqfc zMl(*g>pmW_Q|x7w+Uw5eezpI;<^EUI811T~4{B}a=Wf?}ka57K{D{pefpnpRk8+q) z?_cq?_44RZUQ==X1ozdh+V6Acy1cpiIKb3MX$_N2t4&{bq@2Q{q-4(!ne@;?ncekq zd=B6Hlob~F?}~kNS!i{~dvVo+uOp=IZI*bU@$keOqq-wAcub3@oY%O=E^pyt*!O$V zgPz~BPeiz;^*t%89Ggsv9N7PkQfg`=zYUa<5ma ze!b^|UdBB3HwVtFGjHfHYf$C;Qz~`*;OX0}J@vDlUA;P|DKqy3-#v8nSIExaVyA;0 z*H2Tm$Z}(ty!we}-eJ8vtE=q43f^+v({U<&3{2Y#gSgyUMQ!`^ z_HafeKDn978$MBPd0L7^dXEy{9|6ZD2D3wF3-%qpSi0+B*s@PIo*8AVmrXV?dbqaa zqLlS@rjJ?mH_u*7EijuhVaFPeiPI`VWDf^^)ap)2KhBXl^XUeWUDDRE1)I3`%e?0f zFp{m4XgxZOXJ#tLfpgUiKW++ zr!NtDVfjJev_>k!$z3a-6n3%NG)uQ{Q|PwHWOyRKM1+G`g}r|98M%$BrXBHOEU6Y| zTW0(g>^h`yQlRE^U#`mAZOb;CIdYJ{WSZ1x5C54qPbO~7n02Cd`l3$Thp(OX=;iEG z=_-s4t}V7R ztSEE!j_RCGn@mj$57ee-CHYU9 z(-F6EZ~EJ}*ORX^7~WuAur%st=C;-g7F9Z)%}hQsZm(}Cl-1$gdL53 z$X#?Y!lmuScI92^x7@`R>{@5>llOpS$=NGrC9R3mpWc$2aCO(UBe}P%QyDBS&UIL< zvha{$z}6p^*LW>FKZikM`ueGis=46~n@ZLO@Ef#m+%6z`XT!x_8oO z^5^+?mE!Jpu(htgyRu*<%c84S*e@JkdiDOa9h(eJZ8<#MaT=qTTA9}N3qO?Y3}%*0 zX5M1Ji4#F-kLvOrJT8QKnw5GnUcd$&<|w zZmkOo@jl10&HLf!(0b5s}xA_OXb5WvGjd zENQjpovL%0Vg0u)rMBuTd9yy-N_m*9JSn;=^7GSMOZgY3{w#j^cH+C1-8uh1mEL0e zE%|1{&K_nKnH;TzmN_Z2jJzK`s5{FQbn~Ri^fS{L-D4QjnYZhP1ooZRtNW*FHHD$Q zn`^U@^&R1BKNEt^oG@z-@BS|H#YMUQn!ia1UsCLoew*^i&mCpn3upx=rqvi-w?Akw z>87;y_n78|Dh9$&xu!&>mrJ~_w>i``Jz#qN3`Xht1AXh3{8RULHwb3g*ErR7L+FCv zlQ*x?{&2e^(%a8Fo9}~pf95sw$!dvmv)`W0Q26jWFYWi!>$cu%ZP8jmylRf^ol*9V zoEHP#McvAmhHt)fLFL|}{e3=PT*B_$E^42kqg9olR_yxK=HZ7cYdRk6o2?svd?M## z5nVSSwI6PoTkBtMwte?T;>GkAKhEDM+;gXJ%_sXUPh;9otxzwkdHL@D6xsi&`BM!{ z|1HY<9;0V<>Dig1!5sDXV-KGBdcGo^zvg^X!S}dLYP)+jT+~wtb6xSs>BPz4eRGeU zHu;xpoL|b#7E(Cv-QF!#QSUa);j#b7{`B3)WYY;EUsxa8a3?EA|E(8v=GU6DwBIW; zazlrT!OaJUIUKfqap}Hub=F}E2BUp0?SJaHr$5x%=%ccmA%3NCQ~x#lm}BqwjM={x zEh;cN7q;%f0b`Y8oyO+otiRu%5&Qo90RM)t#`}|J{`Hj=zF%^6ZM9<9>D}w6x=Vgi z-X$&h^pb5-?o*`0q;LMdHlN6`v1`4)4ubwYFand z&)&{>=>qFZo|>Q!Y#RTWW%bw;w+MH1e=0E(Pu_5N{q7H44S|1EuWaX^<9YdJ&UJS4 zx%>6bv_5vPtR9@1tG02{`qtU~%@eubY`b~-&Q5RHKhjbszu1)L z&wC(sLD|H$;N6e4EG;|!|7nuWc602|cl;(GRq&_YQ9oMfZL>~H_x&A=`*NS9zHE#; zxAT2_V`Bfkbk~2GZA-ihE%)te;m8otwK}*ip+@{-j;gtjq`3{O8vm z=dCN5wXFM!YRNAy`JkzH7KR3?%e_=S=;hk<;CKA0w`(U@)~Z*?-%vd{iTgmomD*U< zD}IObzMV@IFsy%gZcf6=d+WZua#T$Cz*ipJX4h@09kq13q?u}`U5rCq(y#7gEGzcz znANhUu0hpdqVL`%tpaveV%T%tx&b3;%vUdbMfdZ$>%47-M<%o-O^c;mXx_!Rczhk`b$)j3mM_4rFAEqAO=ViI=7P`Iu7{TDs@)6V=3wSqo2#%~Fc|*_B9gp`28UlP+^(Ji$&4n(Dd!7} zKixSTesIaEs5SCBO3!XqJKflJ4!{?yto@$G$=2(NxG7#P2zfQ=X<<&jp{xw|_39Z~aY^UgPGT zC6}U>WvI0}1aanHiT!(FOX&8>J+VfM#ag16_t$WCtG`c3S@CyM_2b#kWY;`R3Y@Zf zl}7o$hZ{6^``*08zVC&UeZ@JNg)l z<5<3Nr;2@-e!hsy#kVP}^6{I}>rZ2M-n$-uBjQ+htnf1H`nym5zMlMayZ5FDXPvj% z))@y@?KS7NQD~f~)N%RX-7Xe4CPCd_tYN~rdtQEPZ$3^XU*QG%x7)? zbC+~Qy>^4-D_fUvC9C=tw-_GAJzg1$1;dy{eHuS}JR|8~*Zn*;^KN(Gwb$G7Ze5ac zI+_%28&-PnSEhT+6t<;PL#ux3-JjYjzwh_AcdhXpE;s8cUad;wwmxYYxhJkVH1bGv z0`IYA(|X?sX30Yyf`Vcl`KR;l=bcu1aU=Iv=W(O^ZPEU>7F=DpD%*ZbeeSLkKL0mp z|7H8J{LW*SrEYE;8z#Sb*tc@dN6(PxL)(5C2<(6VN9TxV__J1d*%ue>zRamtIpi|e_s!pbar7^7 zcPGcsLJ4P{PH1mY^l%h3JpJg*i_MYsd-kgdZ@Un{#_=ezeB~qkiF}(`PN*Du6!LHO zF@ANA&x$kla}~HP`klRP3YVnW;?JRndPQCCJUEhXc)U}DcWPHsG3&(M#SYf)_vbfm zQen$nlia@Mnr5E@$LwOBg%e~f_j2*QWUk`Z+rD|P)|4e=@&<`1L9C0$=p9wO=vu-+kv^{kPTsr=8*vaV)&Genn&2>bK3} zKj&}CZMvY*)-rS2w7I&gE?Efa%GSGD>^qq++4_aYUNehvjm5+1kMbB4-akI~smSV| z@{EOA?lV?PO7ou7c=+;wxJ}Yh)hYk%PR6N7XG%NE)vsCecVFD4DF?0<);V3&e0o-- z%|yx6`q{-9cb3`ISIHKz6yKOxsUTF>!dX-kii+jrv8QTsQ$y|0R~7X>t%yUCPn@_53doLj$6PiS$uB;(>O zmG2A#H*H9n!MIsgmZfl!Sj*CHjS6P-*6a|H+c4$K&i?mV+gq0wdDgP(&CE7?X!Kqz z;e@>G4eR@J4|wnY`TS&|N6nUG+tf7?^KN~rz4|7$sN0ZDW#WP(k{MGh*-c6sa#~K$ zXLbAC-PpNs&b*}3e?FbuqE{zxs(-Je!}IWhLP=!et$9Z*&X}bh%6bvm`0>P<{`0RD zdZmo3^CCS~e{48v_oTLevu;c!w{zak%i>v%(hs<&KI=9%RloAnW@`N!|LMFZz058;Nd$0o9bNIlCU1&z z>La(Gm8V!bIbEl;9qOOspcd;hHz?&^eQ(zvLseE!JBQtV6U~gOet50&>JqD&I_1Fe z|Cc7D?9TtP;IQ)q1qai`2TI%h8SE!)aGw+}e*A`lR*npFn3lo8#Nex`i~JX`T|4o= zF>dz<_o~zv^|pU2HAG&|zLVDfU9VN;8{>`E!qSbB%g^T@V^4P2oc(A{P_M|d`A283 z&*y!{9`(TFapV1fdDbd#kI61r_GO#7@*3R|_e1k<&3oCB=BH*dfx|lREdRY}RtG%3 zJdnS-|MZmg8zap>>^b(jb>469@sCXvwe|*(epZ=WolejV!!U^ zES>c0Y_k<@n;@0>!KIAijK-4% zFKY@($L2rT_VI7s(M1l7lD67QJUpk1EMrt)Tsqx!8KXjd-sB}_=O(3Ww%zmVW9XdK zF{08xWAs+v=-;3tx|VaM9a_JRAqJkd}8^1tTqtIexzZmXD`i(O}aeS3OL%zLx@ z?)5*fKM%hy{(s-U+uEu=^@V?B?*DJG@Bew}dn()HoZus_Z1NBE{mph>D@-%lTo!tN z?ygslF0Hb;^sHZedgj9V#rwmau6reMmXAmXT>Oshq<$V};?Gjl$_@X>C= z;~Td!tHtuE@$1afn{o5xJcXqPwlVIqUl9_icW=QWJHF6*egogb4Y~gcO;%f-PkOz{ zciJk8lP6Zx{m4s(bQ$a6oeGmxx=WKdYz?37T-a#-*o|{e z{~Q(8HLY=dcjoY!=hS};mpk839L9D+P-@*Cx$t`rPc5EUoA@zaY&zS#fKBJu%=UYH zC~f|n6O+61uN?nkFTS5qYUl5p-1$M`>WkF(7d`Y{##q1g!|iWJ4zIf=o07S(yx?x; z@%HO;mVC*+_B*}nXSi@h<>dN1QTnYj)Cw1V@?DnmM&Z(2oi{Ihiax$g%d5ZXd8f;F z!~Jyq$Q#pd*50&O*2;XhWd58J-G}}^HHqW;(!8-|*6tf=WlxuFX1Zf??2}dhy^8x@ zg_dT43z*{hOcyvbI@)z#X1I1D>X}y6ii4HTU#=ERtucD|r{Dg6M*FSDeBYlwSUI`8 z{nED{<}AiHRVC+c7oGRDh|tiQyyDc4hxLx@?fyTKEhz1L_WQJX{P~a%Ti<-1{NgF| zq6a(;CSPSN3>xconZJeJ*Pq+OqAkN9EpRc9ePX=@U!=9$(&XrbkV(g^rYkS_wIIad zyY36649~9HZz8Xr@3Js=T>4eT;o}@HJJViuQTvN}WuE^8O`Q1d9lMnmv^rTm@a~6- zHBN5z_l|Yep4-`;d+x-W?pIlzP06%rn`4d36OKD+F3^I( zzkLsR_r0HI<*ZL_o5TXvvCj8PUU{BLVUqn)?_UfBUU`+Dzezj(EQp_1W%x5dzx`mf zA-S?(VePif;r@TwQW)x0J@($<_>?d{vEpUuNAD^!~4m z?sM-;SJI0mPB`80bg!3Os=`_~CGV?a!Cr%dombvCes5|Her?m6Soh;y%ktanY&jkm z1?|t>&73}?BlXt;ALh^T9uj6ZoDN0o*M7ZBo{9bC`E{3=a_m;sH*vAH_&RMA7d&?$ z_La(9)n7jI+``3MzjoR!KJFrK=DCP}fyUQj=YPd`E*$UX|GQ=JY$iMSZDhhuOu~%+tO8i}{7cdDq4}i9R#9`1GUhJhnSI z_qvwDt!Y9ZLVW(t%bvVQ;c6!Tg^u07mRB9$t+^p-((;*$_)kgPS~TM+dt>hvt#jNr z4|P^4p0h9r+qLS=?=GR&TZtcPj_Ox;I#6w(u|}VNvsq8NeMT#w0o}Iz0QV% z|MT9<#>e))k+R?5JlExk^UsCPOr9(5FyFoDC4cGt&3zWFnVOS=9Qz)quemTx`s&PrA6Wl7YCrbLI5frM+~UhCY8e!litn;8f5%g( z>nnX);ns}Xmh#-J429CUvJ5q!r*Ds0k-A{lL502V+Pn6eI9pnBvfkqg*b$xPb2K5~ zosde;&Chd$>Hb&DM-`|fe?+Hv%OnqL2LTbb~H$_XBe zo+=!?d1K?Pz0;+N*_YNud90C*xW14hXa6&y58eBe13gscU(89Uy`8vZe)X?}IR}0& zKG?Ty>kHExaytV&*3|1Lewj4)OxTy6*)Q)k|9siZmmbBkS~YR);{PAoTsZ2}te3T2 z{VK@0Wy|*F_qFV7IXAff$nmKEc6qI@w_wBSU%%FUw4LsJpwFrEOz^*JCsG#vZRF)j zdUu+!c9p<-)-zmbfjpC6GjN`?-KU}-r zTqI%rE}O&f$u?I#Mx(ehKb?xcABzu{VO7{}RCnAV@Cr|3@HN}dt5}!bHa;yrW99kd z=2xfj9Z~qux25wblcICt+oJdN<*mzHGT*Hhnh{m6;@`^Fn!D^%d1gbI^o9dn+d1Dx zncnR@8uK?RVah(W%^a#xF;DYPGaRVzx@l`PLpIf#MbbFc_tv8o75QvtFQc#MAC!}Q=h3k}^Y-U+ zCvTQ2EWNxzN>k<5*9nKd?0OxP5~lZ$MR|dSlEd8dOI?pKJD*#1r%*ZYVx7!emsZ9@ zzv>tKywmXYRU@~=jfQ6nG8Dpg9$Mq;KFflmZnLyzNXd53t+&kIALaZSGe6ICVNmUY zA3x-J?VQi;T{mq);PcH4%$)4Li;gVtbmaJOR%JtSL~y9}l3!eY z%_mq726uG!eqP%j#n5;#{E)czC9dapm{Sg37xYy8=yNqR#yL~%-%=;1e)YbXgtK3n z#f+U#6e90A*T<0ZsavKy)r$#lvp5~J%&|yk z%bkA<^fsJp6^q*wYH0r})55a0Z>qWB_K#+VC+&&9@c7{dNB6v&^H!W(oqzmT_oJtbIH)Edi$Yb^KZ%ektY-vO}~|LMI`MR{{y#G z5BjDrIO5Pza=E!h+_Cek-t_$XtL2S998T0&?tS55WM%j0`HnrdkES>pdP}B6=4?Ln zTB==oyFS7p7#=bOfiRht=+a6jAteJFdx{$@?IZ^-g%-C7gJ=2m?&uG>6 zOxBq0%(~|eTk4b(H;zYs_K5E5G3&e+diaXl<}+7nrkVB6EuDNpKj_rr2YcTyJsHFi z#_-`tZO*h~Ru?CCFm=miPp@h*XB0B{HKkzMg8A|vYsylmgyU!Iz#yF4jr>F3U_pv14urr$iQ zK1+Tpjyl(~WtGBdvqEi7`w3F>gN-xSEaU#RTxH6Bh2-sO6Ld|Lq{Uap%@_FnYrp90 zwf6FTzNZiLeeZJQ4f&b1-lV2)p1QihrzZ@`kycCQ6}kt%*<-2tzS-A{?~~)wGrT>~ zH9?KKC7-_6Hwwn^q|do37u^$Zfa4|iD>jS8>pt#DU%4~o?c$Alc_JpCIkHo--D;9< zWy=Ac{kt#J28(H1Ygy`A2B@i8%y(ltS~BIx*a?|BDBmeY58%(ZH~O= zlc)YdjkIHa)mdkfOdf|D!=eL6r_KufN7p zGgcq#zh9zW#$EIJJts`>4ns!ryyq9Ui)?(XvwX!3ZpHa62h8(+v^L+|CbOz-Q{0X9 zc`6y2B06`p0%F+yNhGmtiL94PEwMiL?@=&cop_Sr`;uFybFb?>S-PCz@#hF>M-^{> z-=3Ji7cXBqb$RXkSI5ltV?8wD45f5}66bdZJ@0niZT0y%TXHj}G{bkDyRQ^-3N2oI zuWb@M>{Zq+b1^5a#QU&ck)8ie$<@0w4R?B6l``H}eKWBk|3FXAcczM|^%n2ySF=9; zyXSg^V)y&BX+Jxc`*FU>T^qf3X4&(T+UD^wD}4Ps^5i9*j_-EQ&==pDx{^9eD?@jDgoZr$s%Qa3AOe)Z&kwxyEw>zRJsS~Gu< z@-gA{zdjyf?2p#t)iYxek4&6raWkXY-gdzbl^;TC%$wJpt=XA)==z+82R`<>pX7cc zVc=cqP@ntI^?=@|LVhWYhrO-UKW)$LDV#My!ja{XXTPx=!_xaL3L@K59d^sIFs|Y_ zyMw>7Mdg~B_539LTOIG^a#v0Nc*3fT?Q%fbWK*elwzKQbT0Y%iV4hyK>oceG|7a28 z*ah8+v#fLW@yz3x@v-kndfePF@#wvC9F?D7h zcctn6@x?kmlP;}pUsMue^sn6hf{nCv*7AL?!oTY|TJseAzY*ejj%nZf*&pS&*SEiW z9e63d#vo_fs@d_zPwVu0ZpF)eWDkz7DZcFE*nUVyO;zKiTVi6&2X}TaafwRj0u?5& zJHNtf|FbW1d($%g;WkE1CL@FC8|zs#r<-nPtYiE+eam)6-TIpFx2t9B9Q*~}cWK;d z_dK}d%wpO1a+3`BmrZ_p>~lh2`t7?%Qw+Q=M zE-RnoW{&ea%Xr*W?@#HUJbe*Ef%So+G?tGDhb|6zX3@5`(g^Q`7Q zTYugof5XCUc0bdys$vw|T%Xss20nTxr=ZU(D5|`CSM$sq_WuGCxON&iZI`XToR=;) z>(}Ded21YfdO!Y2lPSz~XzraK_4?VzEp-_U^2e7M>oQ+UVz%+VtWjYzGc&v5^%CAs z`U`bGba0-NbWieEYEkuK;5j#)dvmG4lZEaw4KlyV`lbK8Ob&Zn(Jmp%_pQ6THZp8a z{J#DN4S{o5->2U)?rd7=xbI?b%E9Bi>$P}Wep(#6kiT~2TZ2z*+O5YvPx&ds6E5A|_@fE#{X=D|p%% z!`yD}ogW?PQPOBF9Q$Q`@5Er6@6GRamv*Pk`ZHVXV^6ongWH`=%YOIU`rI))9Bj;+ zR`IlcU4HDbuWOv`c|N-?n`j`a<)h3c-Eo8eZ%NiJ<;7RZYrjcv5DW zw6mK4?tilk9yg-Q)J;>qGZj>b&Q! zm6WWuC{C(oIx%hf8;N^1r|a%{wLU+@;I`%@x2Q@I+qnsekLK1tn8Uv&ZK=!VrWK(V zHl0*A@?73E$&~Y0{Sh|thmU4&G>({3d2e%*qD1A>Z5uWURjVl}?p6?M3^;PIi}ik& zx4VLI1LuL#0AKfe@3LL=y*d+~d5Qk9+CEp7=XPa8;~Cupy#bzEIu72Q#J#I(!rJ`0 zKPo~`-ZXGXT0A?LWl+#t{QTvi3d83U1^@2u$~(i%S-*b9T?YnAk7odlVJ=E`+r5YJ+urodM+GvNzigQ^WL&T zxv{mdROIi>oHCwMw`2@2XEgMDdGK03Vg8u|s~B_pq!O4sO&QFVSWTN@*LTf{r8Z`s z^NkyVpPkxM-?*|Q^?YwsN)T^dFZAvGc9w_r(Shb$JG)(dZ7aAGg||=i&5UStpC{4d zm2x0&v*mF`HLmEI%7!afRxz}>zo>c`&Cix1XQSY%z#({2fzjVG=rQAt8Fd0G*M4+! zFebdLdQx`UXv4@>C@zg9rEI@BwWnO<~&ggRnikUXVT6Y zxwSCrq|gPu+L|UIaW!1V>s<3SG z(n8S#mtxPXdHj7<)^&-P1v~f(3-v$AdtA&_`>`Q4$MoG<#`hB+#clgwT5D|e*fyIX zJ?uq*TS=R;@&aC!&eA%q!wzmH(F_Xi$`V?o@`cmvADG%N^z-R4+BfgK*rf%`&(Mi zHorf+`AN0@Ht82}6`Q>Jf`pvZ{u?I?URVD<)yp4mao*%^-~@*$FC11dZQdci{anWN zlH&6xzW-hReyQrY>-S^Mtb5bFtZqRMlU2d=#TWk`+%#c>$W=SPZqwIw^)IBCD4gqh zAbZyKchuOXB>7clI+o1 z@I*>qW99lD#l8bY{!Kql8Q<76$+CXdvc;!6y?R%y-mdg2E40F)zgAsR(8n%d!NtOJ zLY00+4+?p9R8IUZf3No%vFgGrLcBpKkIF;qdyw{JQDgHsh%d z3)X*8eCKUEFQx8${8y#c&q^Gww$pki-1SwDHsna26J~I~{>PEt)C~b9UCTIkv{)-|J(YK`@w=Olfus}U-V|#G?|yJu5-G4 z5BF65+uQX{JtSb>FaOFkj_;Bej33NqH2?o^die(Fjs^dD7$?+!-qicXc=fshE1e{E z=2GS`=S}x`lDx?07Px@rd3JuKLI$H+%my`Q4`~NcdJ=jxs`e1|5`=u*YJ$IdQZ}?Xo>rj*Z zc#_Gd2cE08)o9LDJhQ$^_0ucX_)Bg7EM}bUTvX{W^{v6$MZYwDJlk%2X#UZPL-o4L zPU)J?yWp7Iki7Rq)5HGwZ6e3Y+soFyeWli&{qpp_U$;(2X3Wbu6Sdd*$;sSj-P((* zPFt)F-sZwH`&xbH>Fx=B{-$|m6YeZdPJSEFq_)bXSakQ%>lurG8jEfY_RQ-3uq`IO zg}ae;n(Gd(+7~nVeV1>Vn|-wP`_!-N=Jy?5Ti-4o`P*W)qmoAU(waQe!W*ABS4*(Q zA5zeG5Wa_pGnAR#wkvzX$4d`>M!&1*&z=yK6m@bHyRBLJY3;iScfB2FSa}6@sc39{ z?z5$HR)@4^y^VcaTkJcrdSc=En1y@ly-FD3 zweA=lo|enG?3efS!};r^#RAq|cI^6<5bw8buSf0j=&2o(&MvaJwd;Q9`k>2JH*W5o zcztth_%g9ew)G8e`4Yb#<{CfOGw*)sr1Cy}v)E%tji99urq(M*W(KKvTP(Q!*CAE? zg-iHET?S>Y=kITRI4kR&xoo|OfzMQ#v+s=TXPr(ejQPXVWztu+?l=2|zFA$|kxMpS zchIu;KQ}!^$~NWV^|N!m#Sfoh&06z#@vEx4JrVVD6cs168~@tr!CS}oM z0ow8xCbVBNh|ev5&C2?&zVf0$dCLub@6s&`qdv9mJ9oF(UPkw_WO(N%n`P5we_msg zs1vum+~835{ci^A$ewRE^X=jVB%5M+LJwHXNFfStW?(}G;Lsm;Gvu>p& z+3#8Q=GVpty-DsdQyb+bHV3y{IGH-Z-9%&c&edn!d1Bjod8>lB?o_0<{jBe_U95F< z>AdA4dkfvQBo-F9e-F5LusYHBY@GdrM=rHlGJ7Xa$=LL;;<;|y3ace2ea}u!Nb=d> z$sg{yBjSe1Ix)3_cf}G+?2;BWoww*Xna>;YXc4Q%mBW!4MN+3`aO9}vo(wbp-s7+* z{ntGkF2yPD{KHKCL^}QC)qWFR<>47qpSf(g_~EEi>eAOwt|*BP@z(uYlr56_Tc`Nz zwR3W}*LG#^TQAi9WxWA6>&j0PCe=o!@Nhoo4Gr1-C*?A2L2ek|=Tys>L*L#osZ1=Wo=3Koj>-RhgnAGPB7`pb!L ze%SwAxNkngN&Wc@XHu6Qwz*MlwxjpWvfH194f8m8-qg3;3p*^P^xfD0l>dHFyVm+? z%d7QXF=Xs6ipk`ZdV8nH)j zYiZrq_;HE-*%dLbwkD>%{aIx6qs%|Bwc6v%9qa6AG2tGnD;(2T3a)B z|7O9--~U{wu$=d=o=e~P{;xM&nL8$HUtkuRZ&>_KI7p|;|CHCZ`_WT*-~Tih-1yjF z@(D)s3+2CJPR1`&@m$LHS8M;l!-_k#yDELR@7etC7{AUVCLv|+MbW4EneXZgS+5R# zs`U6#{=!tYmI_9pGRZaOP69u@iXIdyj zpX`K^aH9*gU(H!RO>Ql1>+1?Sa*%)9!*ZSaCY!m5m#bZG{8D|Wu-^Sg@Rw%>+tV&w zUm+M;CA4(f^k>T>e*ORKgZ~-7 z=e%T`E_j0RYW>9gDV^P$Jj~6@`8VvinP1np@882;N6%heZ(d(LjpNe&J2gD->krvm z7yqr5Qkiimg|p-2WbkZ{#okTadS#nR)rb zf2y9JWxx4^lz)9$mvj6_R(4Nk-5#ydD<6);-tT?8PqN}sNlxnb`sjOGvlFC^4cENh zoon3ZTh8hn96i6{;@hKr+pTYwzN&l?@%T#lkL8^orR?h`hR!zWU9A)Bk-{`R;7Dca zjAJ%o;kQjfBfrEJTRl{B72CV(QfA2e5ASDduU(Xu^rL&Vm%DSV1+x>wyjLsVTHB=* zPAqVXI<{-gkDk}Uiz5#$yDL{O?fE6O{`7>}^9}3fOBl$#UYHnhc0zLS=h~?q{6S^s zALqAk6aS%dyCVJI*0(cl8Rqvf9lb5u^i3+)eIQK@gPwkSNjo%zP}ry7$?`t2)jFK@g3 z`^{@8rhJpx(i$Z?imbSbml;%u zL@Kn)tn>1Xk=(pzj`XC(Sz;%&>I+VD+-?>z>o_cH^1|Sa4*!~(TN~VOv34K-c46y^ zWeXg(G_{D&xIPaL+k*N);;w08tlOM=gFU|}FSt4R_ZkrieTddzjt!Ivt z;f-@*Td&X`*U8-+ne%p`;poY`=2P6U4~(l#cyltue*ZLQi#_lE zIMVsF`Nnhx>ByYMkb1X>rX~fk-4l*hRqwPl)b6p^SN-nGwURfwo7Mkx?47XtPW{y$ zZAnfuBgyX4dds(!$^~8OWvBb!mE{=DQur3W!Ss!e$DG&ZZ!!vB9x<5qRc^^_5gx~K zvBN{`SdM*eSa=M}bAoR94-E4Q;t-R~>7QKYFodlz%#r>Tln z=M*dE1ajCWbeumczpr-N&&t)CRjMw^={48u_+3>>X zTf&B0!p<+BFG>mIh|;j0IszzgZbY?zrpj z6Heot(j#81mvYl%!OCXAxf@@9O|oS#x%c4LH}B6Ex{ZvAG}<=tC^P%7nt4+qO21|2 z6|*U3*XsFf^L~`hGI0DbcWTH3_e_hR1-9|5B{yvEZ*Es;m6-Ti^XIO)YtmE-rAwyW zNca-ObHCcDpk4FayhNA#=|-2`Bwt!hbKdsa>4>D8f6o4ep`V^lGng%PlfyzFXw_mB z|7>}kmDA6zwUB2_m3H|4tN3@mlNg(u=dNpiwnXnThz+u-FA}+B#3BA|d9e0Dp>H=k zA5B?S*2na~c7YVv=})c^(_H?)xE(ml{_ouV0%C6!msUNNxoCA&a=!Nmi%%~!>Z;rg zB_>AQ9i_WEJPxm`hZL@0iJ+&EAwLHp< zeWLV^!A5WJzwwo#UfkP{8gSEn<)FFaB^(uXZ92!lgDSgZ=^6^*>0Wln(>8D z+SWtF3O-C}W1Xxo-!$JCx@Ds0z#yyb#)zR>b3 z4M+HUH>`W#!R~M%XhU;FZfV@n$S58CpO-%bGyd_(`E=@dzfY5Penk45DSGwkS04E9 zZe!8a?Bp-ou+53xc!s#aqfE9h9XCI)vTppnu4CHAdHb)a1RYP;o*y46>T@cx=D1HudU zBt7mrE3`(S`GzsW0k@OoHqS~ZV}Iw8 zQ{9<3Kiu?bmiU`yw))-^KD-XuE9YLlliIHTJm6QE+Z@%6^&DyQ-uJH+Ugy&#^`X@A z=EOV}g_Mb#dRjMb_*^@=rD$r%qq~VY$4pLJFs@B4zqiwU($A3Rz6+h_oK<;$;C_`H`i=w>f* z;Z3|4d%-S~w=JVg^8en?`i~Zc?E74waJQ4IM(F3d@~f))kCk`DJa~KcTK#qr`%KwW zx2KfVvEKe)_4k+Pwkg6JoLF+sCrrO^AVse%S@Ug0S_cb**UlMEFH>(y=&liB4HGeX zB>28y`rb435%rVK=AL1GZSX8{$`|Fx|2MgBE3SN$Gy7GulkPQX@rMS}jBKpCt~x!l z-Lm6Lqsr!j2`{+TY>lx1xb%LF4t8^=`*2wO(in3ovq2l&our|GXzmz$QZE;47IE zDXY&^`Z^uHmVV~Xk*29W<(vkat?ybNdXsx%MoJ^YrAL!Z5&~B&_5buYZmLI7UaTEM z+J5#6H{TyTkyCHDS2Fx{T72Nzxzem1GmG=gW~`lKyNc<&)zq&!jJ3L-cbNQ?zZ@>x zqpnb&QtcCKIVU0Hk4gW!YbpY%X{&ckYpytZa*E$`j;Ph`Y~iadkB6=KdVc5L=cb=l zEWet=b3AiL!*{8aITg?Qn_o4j?Rj)AX7vH}GyId5G(WM8UmN9<^L>x`^z)rFCQt9_ zaQ*9%nyMDXJ%8)7(_ezBWMyZqlRTkj`y_u>TEWhGruzDWa^e279v@KtXm&Mo&f55{ zt$RfFORdmQ?ksz@Z~g4MsSNkooWJ|;=em8!$c`nbm397eK3nnczK`VCKhAa5S@ZqG zi9jY>B{|k3W%YGZQ`Rz1n{iL(t@d)8^gf%p5?>knax7Eg*d|&$zQh>L-@9jy#F_$| zZyb&83!l8nKH(wrt$tP1k!*{{JP)&KCmh^a)1N<^;YZ*6z-j9)1)R*Epz6f)pf>Hq zyv2-LiYzAIk6);0uXjK#UgnIfx3Ek4q1< zbK`E^;^r&#Vl{U;e^qU6ta5LVM%Oi&>L&@OXZ|&)6bXF%f?M5Cd_`pa=k)tURcbQ~ zKRi72thshZ*7@$0pVrOVw3Nff`^@)co0Fa?mNos8fAG$2hqQ%s^FNc>^J9&o*Svq~ z>DVyGPUI1r@$3r@htn0lS^m>Mp|SqsoCDdt&&z5)gz3zYRh?ivdC{vE>6)KEXEWGw zdrY3kx@b#;J@cQgRy!LR;gUOvXMO7bZkVEHT;84TCZ@#@?H0}5XYgp%mh{*|l6JKw zGCMx??<-xS_oT{9I^$^YW;KgA2D|z|HErRDqn*Fk3je*fJloZdOZmNq_Tib+3&S#B z^VWH8db0Gf;*7`AB2!uCa@3xUR4wHDT|cL|V8RszF_R^clIlxW%dLGGdsN)>=_b2rOvbWDY5_s&m0T-9yqkVg9IXhaSD(%BIrgG#yQd&RF=eMe-QOIhOU)ps- zyPOrzt}j}t6{g4iYuihwb(a01ub%x;-O$;2FzXiQ{gU0&zv|5>YHZh^f9tsHm(tDL zM{iZ~*nDD9?q!yCG+6j7p-@dbK4itC$U`UG#3xBMCmm+>xH0iStLUl=#_aRj&zXr< z{86fq{W<;FRmS*wAIE)H?y}sT)^b<$pIfrThszJ<-xYb(+c&j(#|BlN&K%zVUZ?77 z`8cZQ9a&i>^g}HmzOBGaKh4oh@$HeIUH^7S=x-I?dM7OKwCkIgChqS-SM(yznMG{> zo;K0;i)Hp2UG7UUPH*0d{E_k5$Mv{?SMz+BYQj(6e>tX|-J4=gFRS;TJcDU}!ymOD zR>7*L^cC!rI7?&1)K+Z$w=n6*zjo*8W*6n=Lz3Aho&r@{BT9;zk}jSO|^m*ueUy!E6N(rx5KF?-e~<6nX{`;Y2@u&n}0j_ zv}ADC?T;drUu^H@FaLJu#HPI#b2rLGWzV0cUnR-r^;Bj~>ne7S`NjbU-k+*IAiblp zeut_2t-?)Tj8P-N(#cvF{_x@IhtDS*32HnY$6pYrXZSUH5vT2vUu++&64XCOgkSZN z5x*+KEB<(=ZotZhiH#2y|5_Yo^5*8MR>9a6`MD%lQnbzii?w{Y6wLG5p+5h^}M;GhQ)7rT}Msw|nM~_}LbakIT z+Wqvp{apLK7S*L6|0>IL{Ck$v_fGy{yme7c?d8cX7G?28CnsL~c36Dw&wHKn_W8J(^DdMy4UPH``T(Z-}~8G+OKm1uOD6a zW&P*){PSTUy2Za^Ll3k^S5Kdw9-=?{cwMG1yLYgUfY_GU-!=E|{0QvPQ8CJsE)x;z zVOAG3x9Q>eeW5u~$T0cV%6Tn}Nd^syuA$ZsRF5eg4~O^$qSP< ze3=ul_4<-O9)~A{oC^LITe&-bUr&aFvC|>WSslXcuNy8L(pXUJ%3jz*8k97y_5C#SH>{uU;c_xTuF=ye!Q_$y_nT=ab{0RGq8rv6_|7EwwoGA~ z>KciS8!{i-$ElmG6$rDsWs)&5FEwU!gy<46=UMwTuh*YGv_|3XwPOO$+KQHJ-D+Q8 zXZ5IJiHMBhf?R_Y;y*k%C6!wEr?jg)Th!qx$@y2&UiW3nne+W6HWOE@H__;-H~IMS zk7>TpDZZHJOK#uj*KAbonBn&z?l9x4)NJ+Y=B%}ekN@9@{h7V(=8xItzxQZ;vQm^| z;cm%P|M>jn)0M9{&b*qx_UKvty^(okb*+n59=;X2?cNjhPJ@SBl1|BLxxp?%AN>B< z&H7!s&ril`vUw6mWG){~xS&~|RyB7{hoF_%P0xuFc?|WE^ZwM{m)Sf~ zW`cXY&Ez+)Yc}`@blsjFuj_TOelJb*yspY~rnOW%Uf=Lx>cxs0CG`vaS2{AyN<`1Us;TF+3W|HD zBis>FZ&&;(B=>FV{ggzvMfZ-*o!pq%^Fm!l!**Xk@a;|MM$K2tBHEYt zZMyr6FK+Fe#CMFV|Nptvr?>vQYwhIl(xAix4>$T{@Anf}J8?nM30>>;;%6FGT7RDq z`>#k%CE&fE`hlE0S=Xf0B-=?dqa`gCRi+C?$qU$Ap3eC*I*=_Z`;924T+*Uq1+9nA zJ0I`rUjAptqCGKp!?xFRHus5ZTUaVZc{%DZ%vs+dcruu6frkU1hEa&U3B&dUTAAlX z*4*stbS;IGUs=-(>dikYfAID>iA9yALjqJag=x z;O3VrE9bH7l9ao!*0G4AXLHiUb=T%e^?y5FHN!=SC&KfHu7Od!`U&-HvzISm z{gQm>+QE-!4_`ZYK=Ou^|MkulyC;Nm2C}AGwrI=tr#`9aO*!5=b#}Gq>(C&+r9F$* z@ar_+b+p^*bwZ&fP@$G5aZTT;1u~}-=BQtYx;-Pw;PU^Lg2)iv<7F3m-Yk$?9?|B_ zoW@d+ku!_yPd}&HA6<(JHm0&U%a7N0em}u}WL};`=pRGFPL}9PnrB0;W?hio;$bOm z-Ei*hZ06I)%XAkh&U$E7xM^OS^2K#-U7s~>*|MIBSM6m9y*sVjipj@!>-{@F)n&Qb zev3?VmTMQ}S$03j>`3DC29JaCI=XizzFy?bylzE;ZCD7O_9cV;pFXdST*G1E`qiP5 zt6rNgV0!F@cN2fv-txX1vip;jjtt{J&7e2ZyL8t5=~x{r`fM}fp5JT<&lr*~^(8kL zhWl*`}%ByCt309?z#y# z?*34@TrBV4bj>L(jEBpg2fe@kttUTfMz&(bWR`gw>Mc(Tq#ItTXMQK*UXZR|v-jZq zZ65lDPc`Sc8~$ZE&6zVpHReOL(^KVQ3+@Vmlf^3=BuAh4Wo^%QMeK}Y{+CVnI6~L% z{>Z)H<`co^8x(KcaK2`5arndYoWIU~*X&Q6oM$_+D%8X&$SgViybrU&#jNR$4;W?Y zla6@3iqL%YBw0pthTN?wn}5c%GQQewGtc|Eo4fGx;=eO}x;5AelOBZ#_U=pNT9o+D zKumOzfJ(`sML`=@7^Mbsz7lQ>oT{0$&A0jm|K#=e{S*>RSFQGXcv`dI>oT6aJ!iL; z&kbz;J>_iadG^$zAD_+ZH=e3b(>Cio(aP;o#Z$k_H~Wsl#y2_|XMWy#nl#(y&q?N+ z*7Zv*?)g1?YaVQ%E1h_3wbt%?ZD$oM+|wF+pPlA7>gtls`p^H&!?Xi3R()Is(evs* z%Lr^K$u8LKw&DAZuQCO}>Gtz~p4$KS^hEi+eV;GfSeVM+clg5g^o2=j@43T84&Slf zlJZ2u^nt0_>H2yjpIfnqt2P|Eybq}sk%2?gN!6Ka|9S8UY*qfbyQGmJ@N9bM-DgEs_5V^g=^m6j@w%|JJ;Aq9 zV&qcQ&dvVAxMrr|$y~u5Z_hq)cd`2J$9{0%hA9{Kt-1It=$6F&xLYRed-t#XUOE3+ zf&Zkdmd7Q+T{b80Vkx?_BQ;s`8s`oBH!N4L#&)?qy&^eZF693NpYVqk%gS8pp6WlD zs=jrFbLfOshmHOk+&*Y|#81<)aYg;)FO{2D@~n^wl=4l~R4v}BQgCQX@*HpF$f9ql zjNhaGyIU-FiM{K#^O?kAw$MwW;pPP>UD%tZNLGf2!f$V8B1M zKKc639k;9YYA}cJYO#Hhq>*^G}|4)vz2dZqG%5Zdf^1bE*J8XO|8mc9z z?Oafh>aM`UIaRkmNv5iEv)tR5Z5xHe9bG_e!y@YnXkthSR?=yk>i^g4dnZE#IA`GKz`< zvR?g}Yx?Zk{kf6N*=O?%HVe1v@>sRsJTBg7!F%i5n>YE<9HwS}74@U~jMki8chc$b z^3PJ$&y(WZ>nH!X7GQT-&`WXEu=iTvX{+Sz4_HS`=X9h_bS#n zPtE$eaC)mpYHu0eqXk6?YTE4nLYrMW>`zT|EqcB=)%{suyY8m?#YSzp6J-a>*Ygja{Z3& zm~5>g=5|;sz2Xl?E$FNTaSKa~Y4UKZTWyZ^)9Z1=8j<#D&Ke6rI2taV#N@1gtE zPkN&6TpvO{&A7Mmo?WYtm`;5#n?Y1-XzZdR_tWPwSm=fCD%^5Ur1ql-(`u`DYJ&*K!f5Djn$?G%-o0g89#kq6ti5ofMfDc zmgb`Z!Mbd@F{k)Wy$_ztru!@Ja?duG&|h=nR%n_!E8A|^`FhQ}sE?b~M0>oo>n#KC zKUU9YN>Mju?CQV6azcI$XTZPxoF9ram_+z5F>Cn0V0^-Vul?7-YKF5bZ5!T{Ut?bJ z>rbeI-%CDGZWp`dY@&wp*F9#Re^9vi;{Ryj_mh*w)wim3o!@R6DCcVGHp}wSf#(_LAs;YlJd3$?UY%50GF`J%b&)bX(CbuZ!3?49UTou^jw0NWS%dM|A?f6nWz3h6T?EKdp`je)X`7$gye~VZB-H#GR*^b^h zuL`%jrzd;*Evu8_k$Ef4pjIb!$9mGg=?4#7Ig`KLIHllyJyV$ILdA1)J;f?Qo(g=s zx-cq`J?w6an0;2x=K~sE-;U4l(5##+_1{M#>6~xJv)Z_Y|yoO$kzN=({E z<+|rloaNf5#3cQ-KD;at?aZ1U>YeB$BVCr`he9Ivmp z{#<pRc)9uPq^-O6+RraMxIAQW%?IA>n#DSX zlbrSA>bXzv%s+g_MR4`bgJvNUeHIzGM7)&#CpT*)o8|Wj;)!Qx9)Fg`R*^~|LZuG|-$ zd+lNETHcyJ>-WdZleW9N{`tDt>EUXYf+17S#Qaj5W42{+eWHY;nydE8%|Tf=GnR2A z?^@z49F(oJW8N95DPhs)AD{C4EcRcg`>oNnV@LV*8AQ7jTz^D0mx=a?s)n7K^m<#5 zAPWm?PUx?H;$^`x`~3?}Fr40&(|)FKn(y}6)eky?Z-*Gz*@?_9UbZ|xy!+{){gu5- z?*Bf2N8!=wzlWJQnkLnU&VOt6?rcr*^Z3|&uK$4n2VedAn^pU`{`TExyTy*S*YwH$ ze<$_+&+e~jw(-Bp`U)$)ev9#XP`Q<3Rq&a!bJjhJc^`Q|_Fhi0zx4by(j7mZKds@f za*(_C+k6GrlodI@*8P%s7hYaI??QIQV((Qy%XaVo9%OaP@6;}F>$~gzafsAg@sx-# zyx+qlG&!)DQ9$%Sy&sSD4Y^ejChu-^PG6z1o@3n~y@E}g8C!Z%W^!7E&TB}Y{CV5F z2WOq*o_s$o>#*>&Mi1|qrCfEdSr!ZV=KPpD=X{I6W$pVjSEThDv)>TUSZgh6(tLCA zF<;hL|L1?NIm)cqm*?^LtnfX{xd%%(w$w{o%@tp5aE<$X%nXThzXe|Q)HU8ad;j0B zFFBts)!sLG@xdea$%Z*sbos+}D;4m0Ei4Ym)j#5xT^qMzkD6@Xq_z~dYTG|M>TbN> z*ISWsm^Zewx2Jx&{D-0or&dXreLwicti5~DQ=zTP1vJZt`)^dDX#FzHIUVejiRg;m1$%jFz6gHsNfFn@;G)nbnM8N((JE@RS`e;E0lB z+j6VpRIKIGIg&=a#w_;J$|UOa)DyC&rMHAl{!ur@WeT&rL9g<}u$3=)d5x@-%7Q-} zotd|yte__7)y4~v);$-~e(l}QGHIfQ&!k%-yEW8w>yOkQ_gR!^vhjySF%U`(~ggu|K^>r;^4Tn)vLem_6*O-g2#?VB#YIrPFN;Ym18l_ zq#?-bQ0qIlJ8nKJJs-HGyJ$wb-r;Oc>0mkB+?cST_WY!49!1w$Gh8}^y(;gjE#|c9 z`Ecv;)UYL~HzxS8*3Wq_Bm0gqIePggxm3iirEWT(fH^H9mCok45@$R1yyes#lZlKe*ow=nK za+kN1JKqqjyHHlR;e^yCIjznsCZ9?tzP)teOo{JxSFY{_y2`U9Z_ckbti2_W6qsht zqiD(HRCM9z_L$Z(k6#JlA9dE|pFXQ;l)!lJeA$9tav*zm7a z=5fR0AcrRn{(_1pA1f`fv)1TQDcK@flBWOaEQ1KEg>=D?J4Nja-qu@o7)=6ba_ap0!yscsGe@S@t;2(>^fCpzrdP^N$T! z=ZkZ0KFu=2`Zf2QMfnjL66f6(PuIL65S#qS^U|^867@Oxox3JYv<{sZZCToq%y+T= z=Q}IGy^Y_W-f_*ZGN=kxUTkiwG23F|>(&=*7rw2#emmpF5A&(&9^cOMIsTUo!lf6DHb58Kn;*?0Ca&Rrvz>?oGs z_#mL+jL;OF7pp#<*{^cF+DA5PYBReb`>|eQw@$M?GB$sBtFDM7uC6S|e0g!n9FCun z?33k#HGW?>SaQxfUOy-~tzhGi^HN(Ze4a`wbIoA1=ZFl<-{55_*7chytZ&l7$ELSt zPOG@`*kh$-{VQj!3F={vtNSI>w05W&6tCQ&d3 zIPCoCi<;!an>}hK)(J!)=?HmzrGDUAi=| zsnjO5dUBG~m0AH+QQaRK)^N(D^)SBkRjK3l;@WO#5@q^9L|Q6(z1DtDw=T8G$62`8 zueH2p+1VnrhqY2vA+o04E4=E|Q>9;8Q?nmUlfJ8U=6J%BCaWA~!9$x23h&?5>wenU z+V8Iqzdl<@$4~sh8uRbHckWN!T{7qQbk5x$H|n`83i?=fXkJgG zqg1eG-NyTOmuXMFboKKqUC)&+P6tai=BgeuTf6ZZf5tSy_JOSq{6+=0+a-rgBQ>_d<<*X&Rd@I|kOw z3=m0PsNv=q$g|^MS(JaIQdQ{MjKxxG1?w%ZXl$@sc51CvcwFI;pc>C9N$V)~~qmDOX%s=tA4>1rf(MlJ}PW=TYSJ zz4bdtagBlq+mzI{4A0*l9@`(9zgA>?@yh*GqR_O0h7T8;mhkJz+-Y^@jo5!~S!9~e z_mJl5-Fr)ycizjbRjxTyZ1PTV4zuwxyUUZ`Pg|H;y;`*1SnPrK^19cYbMrnf;n;k6 zzWHv^eFyXJ6waQKePph4=*kz0do7YG_G&QHzT0l?zvY&0Gym$X&zGFIZvIeI_qU$e z@7dA+6Atb6^*JQJuJL9RCR%t1;b;_cgeS0FsZbt>C zo)jv#+QKi}lJ;(cSj_ua{@Wjp2q`wCv>ZFm&cAljLl5)wZ0ni@R@+ZY%&D*E$q8S6 zdV;Wx+qN9usC^p#&QFj2K9Ff~X`AjrL6g8IpLc)wIs5OX2;J>`>KvDYZe0C)`0lDd z1~MV5s~@j3XE`bL{Jq|O&JUpi%>~l)Kc3A0bhT=CcfWt*WA~*Sh#Gz zx&Cx*#=}jYT^@zuxg8uYRT6+ZF%juR7;kttquIq0B&J4}*%zqJ&pj zTi?}`b-q3NW?_YghVJ3Zp}XcV`+rbSf05_5b`4j1;FhHvQzhIZ)9l=pMD+t*IkuLvd13f$|d)0ea^N%7bTgV@)xGOSsX_|_~?*3|9@S=$i% zjrC2gn&gJZ=l5(Y@7-fC?`p_vmq$vIJH4Nn-|BuM^+!#1F~^pip09asAGh>fYw@z& zGSkc@>lt5N$EOF!zsDDBY+0&f+q$F8cTv{G4=34A3ZIcwa)~+q%C_HFSZELPyr~EN z*E-MGF=y-c^Z)s0@%zpPow6k|{m^GdGe+adi7XoRXQKl1mA4DlU0?qo`L|P{g)<+g zOq1G9E8PoBjy3$5z0M1MP3gYaopQpc>gV^rXt^c4x)N2_n4_T=IgdZdI=FeFOlt>Q zy8A@#cPo_7Nz`kFxp#ix6LY^QckKQW)y0kbya;+uR(T*ESyKPJEKG*{8?a>}*q<(Om;Zzm#Oh za%t_**^3^ZQDgd<^Zrc00u`IiN)HaT?eU%OcKtcJ*G-%@!9El2uHO zNJ;i4@fHOsNlCjYXUm@0fE!N|g7^%3Hlz`2y387YBYU zVHA*9JypBs{M0#Yv#Wgl>Nmy+CouA!nZK~Js6nyG>L^R$a*MNPgRic9RJ&pE^*3^KQJjDoKk;ekJQO!Mub#-V-6gJQvnp-M~_R`3l$M zj)yiZv)dw0$G9qZI;!~I+cVSW{x0pdO9%fxSZ4q4^?g3>wVt(%%f!CVx7$0v=IhnN zMS`cp_BvgRwKV@*_A_(mu03;O&&%c?**|~n_0Lxi9rgXbe*X3QvFp-b?_B)sSW4B# zm^F82o99(6e6}K0xjgX9`)#roDu(&iSMThoe|x}S%B64fQ{wKFEl~dWO}_Z5{{I6< z3eLSXE;zo%mwob#y8Tgc@#n6;&3fO z+jeEWI9GDBx<2*u|CFlA|MN>P|37~A(f-LV%}-x#|G7%iYR~+Cxxc=@+#Y_V#Ajyq znWmtRf-+OK{NQq1I&1IGK&^UpCja&}|C{$S@8yO|^}l{Td;B-+-TL(HuV+6! zwA_AnVp-z?X2!*_2Le7Y`h7dqP|2daJ3vZWc_P1o&`VE=n;Ua_4%de*P;M7Z_|z2o zQ+ch!@pE%UEuQUPzK-GbL9U!O`=j2E*?6aUnuJd?+#7b1{m5*eC%QVqE3Q>oAAg~I zQegSn-G0^cj5yNvF~xRB+9~l)6xkC|;(1ef63<1qg7!PWK7BIP+I04)#u};9gN%wCLE@JKF47AH}ZEKdswd^=RGq zvN`-KWsR=IO?z|XhU}?1aVpiBcly#!mfM}4`gDR%t6ypAvTLpGyn6y4m_9pfTH)Q0 z%z1Cw+QtWme;tYw*8JTNI=%7-qn2KE=27P&jUP6m{~j-sKfd=(n`*2MXP!Dvh`GP!x!s?q z_2#R8)*t_U^VQ*wn<_;S-S?;5G`AL3{gq?6Zj-+1H-~8%HohF^vI3UPsAXIo;MZXN zE2d__o#mb~fs?g7(qsjj3^&M5j2HTIUW9w*FA>Sf*9B%b=NdJIH>+OvDCxdsrd1>^ zHA%H(tKp^-%$HmC%vWo8{qS~ek>r!$E&F(WmOT1usAg3^HR+3ifcAVZ!&_=wrH=C) z5b8>gP`Ualm|^LHUs+~3oSu27^gFI>a}sNOe#7d)-w1xsXO2%jt0b0{Bs{pB_rUoa zqubQ*0fYHx{bTyAhn)zcXhRFpRCso7UwvsCV8 zqD_6FmtDjhrRAU8>u>rToAX=p+t#43f^AzG(%VJ1Es^@X;D^z(V_}X=E@J7Ew;$dp zV$N}->gNg@kGaifKTc{}xJ&uF$Bx^Ry-j~P?M-TmQCo67VVU2fyNv(+#O{4;3H})O zl;OSUysq!J#MVr8^WE$H(JcML)a}Mzd>WU%iX*yIcGyj;`d?FA{rz%IeVuvIw9Z=> z{8*HlmUhTy{Z6Uo+reuqe6)Fhl#|{q-t);|O8JwV=UWy8)GJ1mnah?N-b%g4 z=UBeY;QX_cC*Hp$whBKCHoP^hvou)kmgLuGUT;gU7;`XLubL|&G)d-$QIl-$arL8* zRC#V4ShBgyYS%g!4_j^tWu-OZA&=`tngtV64m}O@|5e(#P~1LteckR@efRSY%3mg_ zWwf~IU+%BY-X_Q^{8r`29)_6UfHg<6T1|DB*J%pHA2IqZ)tK;R@oa^&&q7?z7$vDX z9Xwk!$t{2F4~epOccylKv-Jpm{{7^}xBVJlPr1$xTeG()#iRBZze?ZayB}>g!(M5KHqSt}zDF(-HyrQ0RHvILf7v8FYp3D1I}*`(Icv>=V$xUF z2mZ|P*cbA91>1$j+^GWh`wAW#|CV{tvBp3=<=VGc$?8qQk0;o!+{a{FwBp{r>TXHR z3AM%36OA6{ueA%fA6IL>-Y!^JCED_$xNnQ@TlrP>CuV$QTYbLl$F|TVT2AdeS5wY7 zf04`^=fcc8af0$?8{qd-^7L^PHvOej;al_9n#y zIDgGfU+&u&_xM1;gOye7H|1}pCp7;FJF`#qPf!c1`u^jb2O7REEcyB8v9RaEhR;jq zocejCXz!B3?`DkBa)pu3o4@lO|I*@Pt-N>9mFI$`uLb|JGh8^L1{pi${mUpm`Jj^K zbl<;>HuV|>I~l~f@9ULK|B`-trhWC#j>A{yf1LTCDO2ujOPG#8(zaXnzn%(m|Gm(k z{w?2b-_g1@@0rW8IPJO%a&~-MeE#;s=glAI$Js^g;b@*2pwr`IxBJeWNso$btKY}& zss8ln)0^d|-^=|Bd+~gF`N_ZjKeo=f{6D^G;*L+g{-PRU?)5i5{`LQt!^^*)`Q>4Y zIkD2$YztgI%s)S^x$%8`T3eIYtdbY@Wcd1j%8g7tn^$jk-R^ru&+F(t z49^_pPu8qU6ubPmX!^XfQ+f8})StLq8#Sl%MD`>#ZSFAYo;PMD_WUajt3EBmy$ z6)!q*=tM}Dgl8PPQuF=O#W#CjepR|Hr)|v`uDqE=a7MN}!w;o*(+VHn5(3(bV%e$A> zoSbCyo3}hz%OSG!|3dTU28&I&Tp1oM-le&E%d+EcXK(x{S?1XHCnG3472tPtE;_#jugF!JdjlUYS9WV0mJ7$N4s|Hur>VqvFXvxhT{@ztA#By z)Ps^9`MnE$+;!#4+TZm8*Y++K>2pn3bLgQA-;TRx3uU?+ejZ|Ak^V3@=D15p!6cqJ z7s4CV>IFOzY!npMlG=IW%+xQATUNH&eTz0aGBx?; zIAWT=M=MM<({t1#FWYF?>k8DT}7Huv82U`b|_=Go@gu~Ct6OmckJKTBK{-g?Yj z$o$H?+;d(D-HX|53wE!Z^tMh%d0OwPS3 ztG~+?Y!f>1`?M*csjZ@#5=$AXCTxqn#Ce)AZRSZfXGZJlWr_P8e4`p(CR;C8pUvfY z(r&L?d%z>fPZuQ>9MjhBwrQCda;UxKc3bH~i}Ob~4jIX>z7xAlXwmAVEsVYSKJvB= zx%-@b+aCA0oY0$b*Yqr7?D96j54##x8-@G6c5knbU01NxA@NyM*lo@04_>aj`Mf+= zr9Y`7GIc%Y??vemyjTBn8x)jg^49$|ocr6(W$`4=c#oQmN7X*g`!JKskng$FQ$n{5*R_?^q0-v^fdGF*M>t>MZue+~pM*>85`)-uo}jyDTkz07xvlhj?j~35SS2kN^wC# z5JO0XpRzpPv}5({FYYjI+R2l2?Ba?xtN)h|K6C%bk<%~U{rYuw*rTb5wUfQ+Pyxn_b z`)c3AFZgON&2GB&R(gLLpBhVDRlba&-Af_a4#s_kw#~xx+zwWi#4m7qz)-zrZ+QLr z`S#mq3uhlw56uuvu2~wwbNaTkU2nSGJ>6iI4Kx3=Y3QF*m~!OJgtGIS?!MuFCa`w% z<9QxCw9ik|Kl7Z6FMhd_+OJ)9$5w4f)mWUn=)v;!M_+;&)Y3i?&0V-S+1ENz;vXvT8XLo=K~h$ zWBO{5rvE20X}$PdTV-4yXMQqt-qqc;)AN%ev|pBuqWGdV{Gn<=|$ezZ{1Z>zphzbh4GNw;sfWN`!q;3d0#ph-p!Kw{-v&8 ztJ55=P7BdfaozquA6A4)TPb^mnSYyBpkw*@>yi(fbnSH~2nzq!oA%=9|a;BkLCVkmeP;6Kj>;}+|d48xS{=t&ZLVHAG+MxKGbkjsMxW5 znDuj`1XG-wxC$fVJ$`?txPz9b_e(u+Hf6Pu>D|EC=vlj9ufbcs4-WN-E`|-}+gU0+ zUi^46^*P6T`z5ziN;gOBGhH(4Lj8-2_Y>pXzPIn**rM^?8;!tq?BCqkym5=HJ9VHtIAFDCNuI+@M~b-)Ukj+JAO~qZkBHjHVom`^woV>Jkdv%qd?(?}je- zpS$eu#hNGm_x3&b@Ws7GWk&*IznfBkj!4oJz4$*Ln=<2ne_T<$^S7%^dbMWus(pvj z1<&!GfBPoSe(!GM|F3V0-`mOO?qn#NX}4={{id$^+c#fq{`~COmp^5He!tb%|C4ud z^6lr>{_6jDT`gDr|LY+ai>^qSL)_PvI*Ym2EZKR!W@TpN{Kfabi<$m*SmW2ti_~r`In<>=I)!nYx-+zso1#z>s#FB z&Yin!tLN=g0hN)r>hm@mmfyOwqw}YM z8Uh>3mc3rOR_FDa*rd=WQ&{&d-=>_SntknxrDocdlGs#!&t1z7iQ9juSJ(Y};EVkA zfG1m;_uk-8RnYj$wkCUNY;F3bX*)i5b*&B!*Ju72+cxVh`$bVj2BwSWn8jA>UHLdM zV0$H-p17B_yaHd(nR3s>Ybi-5TDdfzL^LYa|I|LVOM1J{zCKRvh*Q7*h3q-~EM(qH zmG@O5A(wS_DQ51BX*{3U_w}^!s#*0?ucM={uhr8|+nSjrrM2fl+?iQ zm(_ZCw|$s->0{lB`!m>gU)$r-z-)AG)z?*;&qd$ZM(S>wlC@sDWm#ET?yV~wc57tZ zauolYi`MmL(-_5XI)(*{CtUP_G?Wz}(IadpKD~X+3Zng6?@73G`&AehkWd;3a z^$|;1Wx|xUER(m7_2<0#*XrB0?gN%xmdmExI65cn+-sHmO{tNRF0=UN@aOxjczC&_ zsPtq0CjZy7`0{2&?%)4v)$L02(|R!rJqlQv`%adxR9$@4rK;R?Vw&Rn@X1%pj~X(f9COx z*5b!|*7j)L5O`EufAEoRY^};8on@E58yGxeiDvz=cb4DoSzSA>UYp0)4jT}3D>(98HP6QX<2Hu^SzqhspIv0M?#$voF(5aVK?k> z;C;~b-(G<8n_|)Q>BZB^Tv&9rm>spz?pe8s>DB3_)75%sPQQ9<_xZ5;t>0y&-dNts zTYOsBL)3HDtX;>FGt<;V-ex~*_xa(Zd`!8peitC-=nHu~&UYgljXAX$+KW3Q3_049XWPa|ihHK^1 z^Us}J6)dyWz}tDw+WvxVpOnR1XV)7STZt_UUXa}-_L(7S#_C5GmbJ%OxlGbj{N{XP zN@Zul-149Q&dBAfR9QS?`L*1DNmJ~{F9o;DqHVWBZcllCyJY>gmv&SBRIga1_@ziQ zLgcf2!}?#+A9!cVyZ+rFx0Ox&&ITP%?bA6slKfk`)~0NO>u=!7E&xR>n4;4=F z)tBu#K3C${-QPOy=Z`lQZ!=hNRv|5Hi4(8ZwB;N7A1bg(tKZ3Snco|>GiFxOGyyqL z{yD!lDLvLs3M_PuxbyPjH32iD@U5BYsjfmrVS2kYZz-u(8ck?PUUJD+;{cn|{r0=A zTe_t`UkJU-$*R!wh&lZ|^T$(qC%x8iXl}~ev@Ey&LyOD4;CsPew=|ZjUR|?HN!Bc5 z`>DGZ9%?dN{QOn>m10f3K%P^ZPR|$rrsxAr0rH1**RGx-8hLj^<oyvzG_BI(b_?}bwLE3n z?>ke0SzGwo`)PJwo%YxzN|`h{9@QT-YFgBhfc z-2Q3(=&AIhT323&cMg2v!CDLNypp{$}_H)oWH%H^QKLjz@u4K9}7OL&=6aZF`ZrHzBi{=P90~IhH8W2er~%N{1r#) zJU;x}TXJB#(BXOKH%c#*>zAp||GeN!gV))@6Am=yJ+ubqb(YnrRooH zsWASzuvt%Gy8Mf%+wblBZ(cvMx&Lx+az}}I-@>H#GZxPhTeSR&p=Wo}+Iy3?d|I(Y z^i+C#lbM8Dvu~$pt?mXX1`ZAh36X5p9daUKA9hQJ7F+&&a4&M+>T0o&zz2Jx?}tXF zU!LCdYNDQdY-;)C_wT$|zQy1G#`6Vfh511uxCwvqre3IUDedpK0@ENnV7(KZB z{J}EE$(dgthp$NgAm;AlS-K+iaN>!ZId+Sy{U+WzKR@w>57+ElYwsQTb1~aO>)|Fp z_255+zbA^+v+*oXS9B8V=CwQbmN&-j*3NBSr<|_-J8__twd87=Lci%>o_|IfY>n@3 z-2KORX-&ni%u0`s%yT>w_j7Z$h_@WyT=sE7bKH_^an9@?79TvAnzvZ*;sHUqT_<<% znsLu)i$u=6ge&XP{;W5eJb|(M(Bkhhf<^kv&_3iJyMT1c z06CDJ|~|`FXocH#c0yAakpaa?lO~G`(ov9JzFL%HJg{s(L74(KTDP)aaY!|)vA@!ul%^;&YcrqoOZIWYxchUzGH{g zH=k#n-Lm}cT$3p^^#(Bu^lid)OLBa@&v?nrx#lDnvu;yB(SxGWpR?xw{#Lo~*Npd{ zuP(2dzkcDlw?Cy^oZ~lC#J@K4nr`~XUM6E>2ne zu*P(rulLj6X8$%kWeL6ZAyn;UkYbF|hlgDL5wDGY?#|uTu6sl){F;bDeKIebsq4y1 z3F-#~r)}N!-)Y?}$>>!9*}W0*K|WV5PLVps=ijcqsG>-<=KgzG<1^k{zkj`M$cg`GJ1}OcjYdt*)^r_Q=N2E8yvQn zrXC1m7ip+3aWLQ3qj#@%=6t(aE&KXj@v|p?78Hi`rKMl3vB(!Yopsm3-fG|fri}-^ zp87D(oW?h;Z%3e74C7=khpyfF6_$20`CJ#cZ@#!G>fG#$KPqgbg#HTUK5w6#W*F1! zH#@ZSf2sNmW;2Z>-zFzP@I4sliI?JjYmxArtk-wtmT#U6n zbo}I>KLwF~$4`e=8vTw4Y>isQD0#S`h(Y>=&ZD!d5AH512wEPWmOTchfO zAP$Xv1W6SL#~Lkd-}^5*XlHLruJQWYC+_{Syyf<7 z+r)pCb~Y!>=bhuvu{N1oyLItKojc7zJ6Gs0E!wy*UrW5iZ==t?XCit}MD(_Ox18F& z)AmV--m`ByB32V8{ho8`Xoc^qvg+jwM`E4ZPVjg$tGtj^)Gf8IKT^9dXW8TPJ)v%! zUluZ7?3u;2X^wtlY?5ib$%2TD!R!3mFF#BAo?~MhWw!e1;k~n+Ry91xRJtJEbMi31 zOLhN(N{g9urz}2tw8qprlIQty@v~o2Y;vU%HVU6p5eSh|Nf*ERv0`5h!wOTYsa@xe zNXRo?QQ}s5{Q_4&jfFTVTt=A+96gX+0nVjRRxT=#gR!YD9K9^t48h#9NjnQ3@fY{*6q%*N_u}}r)PByH)+-tIvcBLv=HI^4z;6MwgmKYTC8pz-U&?%% zsC4iSQ$N3V*OLDdH(Z3LevtBD?K)D;d~fDk>)FR@y}s~Jzy{Zs-YSYKbv=)7UbFFL#-Wzu7q6=*=Xm^D zb!<|NBKO%+|Mp|kj(>mg>?Ox!dEp;dB^Jf!W!*TX@TE@h^(EE%rbD}DY!^-6w&n54 zBeQJZmUXLU-K%T-%eJ>aWY6KLiRzCs`<-O!Rn*Mbvjp&HR~{ql9kD?&H4 zUc?B^N)318nA_@~=g*$E`gQbwPkv2aZIyypo3<(UHYdNGo^*efEzjN`%=}lv=XEW8 zbcc7I*|X2VI{ba&0iN~_Ag#%L8iiBfUDvnJbipHBZ1 zk*^!3h1XwNJv)kL?YXtHt}m{vIsMqv+vD}T>?}>*;v9Z+EY`5rf$Dx8a)0rhF^AGHYV+nPS1MSAK`OtV(Rcy$-JH~Md_ado{tRaNfBT(xh9RzAz$9>FEU zm^Ep}^n!@btsY9%j|FP^LPQcxe#&xwb~z~Erxxa=6BTwaHKFq4soM4bRKw40y(Mz@ ziPhp`Tg{ekU7!3UEw=lG()TwjS`V>3np>1Vzw~mw)}~2T)3;>nzGpr%GuZtxVag);IlS z^3s@RlGl=5PJ86qUUEM5Z`YC(J&E%kCqE_kG4IvLsr=f~-o!8S$K$!-rj3TG@>iII zHrO?#E^v6i`=)M+X=237bHWB6zPN2YT+iJr%KqwAskvV5rMtI&*Tg*YjLJy3czxHk z>n2;jeSQCWt7}Kzj(B(N^O5!&th+m$zKK^kT9*VoJAEtH>)RIHV>@fNNAsLIdUfsF zn%C3hKK|M#|8Skk)i;wmH?f!gnmG9qd#8q^)=#l194e<%^Cucf-;{r%zr&$8=|Dr! zBHw_V`pun=TU~S+V~qOR!<1d?mM*lJkioQH(J*iEIAz=x z`J@`TnDP8N94hfy=-lL>fZIf8Dp%KO3D_HT@cj9k^rU>{FYoM!i}*|4GyU1max(m_xtH^#ISCiE^?oTb zYDRRQf0WaqY{=^E8N(|dHaWIP?RdKw(-TcMhf75p6m24_KA&AVE7>a5%aV18NLaCx z&m`Y9oRc_~%$m$pKdChSV$iy!Nvw0S?fzVtistET{VHf zEF}E-&zWufoyD5U-{wo%EzNP?owszm=I0rEgPy&*?BOjiCCHdTY~I|*#oo^L5lQ-v z89^_6QYtehF+TP>yVLbmugbaEzn@D=EbD0d#N%`_)oV`1_o!RK_qWFU4tn`nMR$qu zwdnHcPw#I1`a58ChM&n4-R0`ya{jC9{gQ81`P{x;-6u3hEn*V;@^4?$SoVd8@4wdn z;4hDf{INCts{4K{{&-z+y}i}{YhA{DJ@bDzWXUR}%qm^$f3B5lDz%KN-UE>+LcU0EJ=;UeHt!%6lTePxBsY7yne%bHXA^oZp<-GV#1Wr*go%Lv@T@i;3J~ z)2dv5$bGiRZrjDiY6?GQ-dMXMreE!2x1#0gWg)kXWb4(tzc@>*^wMl^i)5RzT))@O z{an#E?}^P9ww3+#owV?NUrJS0?$77fT$XN8ajUwse(}`j*DhM=?DyE1tyQNcG|6iE zh3R?r=DI7UO+3l$CAIV~_dLD{FI{dw3yONd-e)({&-viCbia}yg-7WN&SZptK5w>i z`JRid%YN!~&O2RksouE%?2pd6cQcNgeX34sFus5H!}UztHuLP))>3VDq8Ikg^5c26 z>-nAL+b^D&ezN@}`0`@lN#nz5?(yGW#>CrCe(E*X+p5A_rfbgAIj#5iE7VljO}WbR zN6^7^|B3{!#mvm!bz3L&*Cnie67j=w>(M*b*Om8s1enTqe^Tr|b22rl-r#QjLUXo) zfN7%de)!&7TD9NRZCg#ph4sppbsn?%zSDmDCVQzW%iR0=%g!3kY@1YPwZ-cvgF^7X zd%tfq-Al92p0@aC#lBg(Pu_l;{ZMjVjdg|bkC$ibZU6o|SsnWLU`oX%oizbA58tPh z&($w8{h9exw=(0`+}lMi@uz>WoLYXk{^#kmnxb8c;=SI7nDE-(4*l}sYLo8 zlb0R%&>UL)&6w@b&Z$m+dd{b|2y@2kkI@q1V8TV1!}URd+1*stEEYuv78 zn9cNEy?E8i9nqyRvi%?5CkM-(KPP_GvoxxAwP$IV@9LKow?Z~&wH3vkoqe>TEJSxz z>eifkJG0AKmj7bbuDbeiQRb?v%OgwUYS-9>ieI&#ee{j?!|M8;tA`{%PCp=sCcMNy&dlZc z74b#J*%z-yKM^bO&vE;DwCqHfNow4A^GdGrhcBQ0JOBH>J-h$;?Rnb1HmbkcTIxh) zezd2~)QtXKxvKhDLr4X8uvt!emZ6O4+4P-y9gj}_SW;fTZb_&wSsfvre?$1$F58XXX$6bRZu>e$KQfK+srTMHB0R^IN@pJIQl%%%`xIW+!W6{(4?BmeljlT+Va8vcD#c zf3sAcNAT+19-psnHn;!#Wy;c*>qM4uMov4n%zaYos_myf^=Iumd1mgNr~m4|-``vL zw`nG4cywD1DWx_p38ncT#@%`MtY&datBdEex%>F|_tW@vVgE;~DgM_IUwlcb z>ngBa_iuf-`|QTKbsG+UF7{13uBNiGWOiZEzLtOgZ1Si5F?})r`R35#5{rjF#-tqmn5A8Ru z{rCE`!j}cjUdkWzcPw~XD=a<3+VWGgeBIBN=|xZS?}}Z&Ud0rApJm7E=#^G^-&t<> z%wBWnWbgl?50CG0JMGQiuHn1g&@=O|Mws-r%}mQnucWcd)-QT{$K$o#xK9>9L$)EZEYd+lF%-E@!yYcOnUv-b=-F?bd&$t&R^3X5wRB^%XB=v2QH_zO) zx!$io|NUN;;^u?fE<7tX@b6T*Z5lm2FaL1t9<}#3d$Ol|=MmV`wx_fI_d?fi#o8_U zE(Pk(zn;Fg`?~+WRKX*<^+E+}n{4M_vWZ|Z%n?2K`OR+gk2Cj9?yvg)tUdnzL~FS} zyG-jF&lde!Br-Q(hpD&0gWrlK(ec8QIA-#Qci&XMw>@TZZ8b;DK}qj+x1t|%rjJj~ zcxLhL)hC82=`6y1>YHyi$rt;|&C{8s$k5;*!t^7^TH61i+_`h=t3TEh1^Oz^7XGh<%FEI(XZercKiOoHP(RBK+5VkmW zBSS+2Q)Bb#@u6%oa86SwTcn1mf<{Pcgo00IS*n7OfswJMLUuu7Nk(yMqC#0}QE_H| zo`RX4v7YI6<}fx+z936O7h_i!BU4vHV>d@<6GuxICs#KYHzPB17fWM9X9GJ08-hw= zx%7Qf^U_N)6bwxbAbUJir+MduyNVop{wIFRQhkluOHP@UTLUzvq~|woyTE=yJ@^08 zrMmsQE*@!>7EW%G_U&-#l~^P#;>j}QN5l+`#oSYUlnPb#Ombp&C>Tzh%B42TYJdM( z{ri^1@9$JUuPJ_K@!V@#&^ae{4~OZN;m?B3J)N_2qqpF@c}~XZ)0YN4s}C{`%6uO4 zGRQ?zgI(17*`;igS)GZZ5A(S;8?Nb1e75XR4A1N28MR>#jh?Tm;tXZrTN<;<(owWY z>4NV%;jJ@+*Xn~N6_h?4QR|^I{p)AEMPN@s{ z>aR2>Z4m3e)({oI9@boSf#Dj%-U@pOhUNqop2ow^w5FXbb)Q*cx`J)j^!L2h2mCHD zewn&Bfv2ZgSb@Lotm)lLHNr7_q%%zYnj{VQmz{lE5qJIUCzGA;Oe~x;O*bU0OP_ls zazn^5sIHJ{+8RKJAml zpyZKh}toUuxaO=jitfcu{qAoZb{(PBX^^ch|Zm+t-G=oX` z*}q-OR&JPgyh`r%Pfi2QXAbw)1k_$X-xOT9DtA_v;i|e_HA?&swd?Kk!~Sm5J68XX zXYr;hmYb*Lxob$gzmxJUedVE4h1_dD=N!^G(fD-1fj1wdr8HPvKkjU<%JU34zQk*> z)TC8iul9tPYA~;M*m(1T^4TE1u!gA(cjt!8(tTp;CGPQpi8EGVA-76NV~gBGlcrJ! z-6GqFCT2wm@uU{lD!8-yEI2D~~&1eonIDtiUhLDf&0qugJa>JE^zf z?wd!scfCJ*d~3d&7XE9>ZRTB%rpI5J{`s(PmBaFzUz1{s7-U%54j5A8nvx$_NOYaA2tPlA>97KSM!?AhH^2L9SuhtDsq`D|xb zzn5*DwmGjK)0wK~#@P>?KM3w%-FNBe<_9`6OnyJzC%1Bcrl^ME9QUgXqLqwu)Rv?u zvRb5C$OeCiN|@Fl?96zgzFQfc({%1$R58td*=n>h zc-p?=(5!Qp>iO*_&)V*@lt)}l=W?C@t1YQ%ZA;HZJX^Yc>A9$9zpR6v>l8otUg>&z zSAA(v!L-xotxjL7Uv)v}_D!v+o8GMczVyF{NAaoiBFC)^B{C=%TJ)@}SV= zJilOVxH4OPuS8adgl?}y{H0>^hTa9-G7MI4UQAh?Jo8-DucI&C7qNU{l)b=qKp|ja z>4B^EuE!518ZeaV%w4<90a{yKVf(u#%scT0C>-C(-tz}!3gTiWfJ=G9-1wC}%nW-K$^o3@Wb zNj+an^}W2WKy<*Za)ValkCb{BQ6dL2Gl@ZRsD@ zX7*PH-#^cIOX2QJzZiYa#tB7J*Uz|cc7yD$dF2`l1uGgKHMe{`bA8<8s{y|lVTMN`WUb^PbvIY-aHNV z(#b#kBF{IsXdb8+))25M_%(OpV-@idq4QsrwwSK|Sjo|qvNrpY36sO;9|mG+Tl@FF ztMI-rptN>%Cv)?sSXu4UFZK1m{EN|h|KO$l)8_P=bNkzSR3*Og+%S2|%(Q7+!jW@N zD()V>Qy$ekJNT`P$E{_r#Va@4Z#lc~jYrHL^|x&+@{HO#ZkDI`?5Mwf`P}K-yH#`i zli9zAE&Y%la6he7{YrEr<6pU}-O?XaM4Ob;ZKq64;E9dQZ)JEfS8Ts&#WKOhmNioy zW|#SCeVDsfv2gacdG}LF4|4B_ykZb#rF7dl^>1f*gH=WG= zm3{ll;#@sW9=T~*w$pyyUAN}MuY;C$PnWIg*&E4{8k&DgYRh-Q#%0MF=1+bUt6MPH zuIxOcEAsV3|NZ~9zb^+LRR4Q0>HN1qi9LFI*3NpkI)3^$ht%ubjqE*okCyGpdwOGP zz2=c>%O5(+j_B}s2bd-ZXt$*bsfivqB9|&3~FI8T=Ih5(-Nexd8 z5dnQO*Z9xQf9p^1zvP*iDz;g$K_bIn^+mQH=aG5okAnCkZ%?g0bJ+Q~B1;~Z%-hd= z`)Z;r=c(tPzI7t| zwPOBGu?EpJ%MBm0G>*8M9Do0< z@#sL_kK=aQDN`R#t(((cV3;~}tu|vfv!Slq)sDv}&##lb6|-Trk$I`QeZY#VpT&E& z9@Dw=d6(9EOFmi2iAt<`_e}mDFf=~4OZwW>j+)Z{`;Ek>Tw;xpO^RK7GGofN(%y}d zU2_@5ioQ2AU3@y{@flA4M~ffS^FK*>%~&)q!XsC_^=`l2k=HU;n*1(KYhan^_9u8{ z@j9E7y)&j*hkj_B!lh-a>nHEA^!PSzKkZURz4trx8VaWRiv@0bHTl<6m3AG+lk7|q zs@tw;{_bO}bT;k#CK7G&=t`6EQ%(kTX*Qd_PYfHDH$P3i8EnYGbTM^j(}MrIqUsxV z_tl(_T&TiZtp55)L4<*?rEk&HVznHOM>Bfc_t~k3>5KXY9?*QfD=|Oitp4@L_CjgJ z**Wn}Im;7Hggr>Uw4mwaW_QL3p*_?4PFtG9iq7|)UM8G27&aLIoE-yTF zYL+tV9+BN`=Bc)-S=n0Eg$XS=zs+o!9lGknCQqMmrL?ZmtGp+=>`_#h$d;!YHTs#> zOMJAxz<$)-AZnY_TMs@a&R>(f+<#0opL223p7aJ0l_?n~@_JV0zT0)@zPWB>>5DrF z9~N#stJ`sg|HQ0GmoBs(Ok;Upxp~^%l)&Lndv%O6@RRb+jrMWx&F=EIzq6Z>Aj_Wj=J);9Qkh+ye#iH` z4_Q=SQ5!S++IObEGxlF9h4)ZtzR>#Wy4zFOyzg@4gk|g4uKaiAy3eeA z^d|oVE}iT4asH;CX9>786)strrQvsUcct&rtzDD5w=g?8?$NhQKOk~rXK>vVjqBY` zr!Pc(ytm~Vm+6aH6LqGc70WH{O`Rlx=T3@EYF-^d8$UyWo>V) zjQ5h=PqWuu7nv3f34%H1!*>3f)5)g_(;2jPz&woh&FMEIdaa)UH{KcFvxwBZSdH0-Hl_O&9KI>{;MbXDkzcwV<|6A-S*Hjj{{qfbb z6~&tE`|AExtV+15RhqY?yH)$+9f?!FR|`CNZMAyArNvBtHy*hlyyA<9v!bQ{(MXOX zzf{)MZ#jE?qhYD?dl9MQncuo%ICfh0>`$1MSYvit;A~J;S&aCl!-uNer+(a}YnbAg zep2{WgxVH{hKg&m{+zgBGikvu6B}R0!pvUT>dUhn+16C%-&!*%OQ$1NfA6N02?1S} zLX*2T+|`s*+ZO-l)K<0oM(#a&zjSsyo1()vzp~n9`}_Km(=2&>H&m}BL|qWNq@(rq z#L|rXv*(XrnRQD@Vr%LQBR%t`^Y7mF^)_Ve;NkArvhYLl-y@6WFQ30YTXDk)mN~Dp z^j-ExFL*3iqN37#>@&yo+tn{peje_ba$C+%vbBZR|HC@zQ}<3}Z_eFtB3+*4K=WJm zJ%#p-D&{?hioN~WCf48EnYKTxd!3)`62^H_>sp1lN=iSp3p2km`WiXCLG?S+>KGrf zT^supB^N)tAo{4*ctWh|?)8}tB~IK9d)SYq+vU0!`F(zLPvHJrqb2FZVoocrGRz5{ z?a`jiD>dC(_4iBbfHgVGL#IBQ!j}Ap%O$ueB5mu&w@k^Bk;!TqPkDdTKMa=iD*nyA zVO{?0D(%a8uPz*XdAfc_K+yD4?zYc)Y|pw`|2*5&ws5W|=iYf{oI#aN^Rhl0Dlb%! z$`JAKde?JGO}6mB#fO!fI?vh|I4<_Bd0tj8CE#7zxNz25zs1Rd^*8j-S_izjV103t znS0{JMeD`RUI=tv|5L!mu~mNd!smwi)1=so7Nq|;e64x5@d>`;>*oB4NwzMrez0?f z_T2p$j|@0&op#x$;B;>K$xEjzSIGuX?iZA)Uo?B3{ZCF4{g+37Og;8ErTmZ~2lJDT z$Nz+bTkf7z_e?nzzb4^%kk5+8^CM0q3Ox_vEB_c`wDQXEJN~%NEOy>W2T$C_Pt^6O8qeD9oIbZNpp@rU|7C$ z+QWXY(qPm2+seudR{U^vJT|xES6gnxj(ZMDEX6B-hHJ)nOO;+&JMsDvlZF*3{Nb{t zab9eD|2=SMXA-;Zmc+a4;w`fjmBa}#pI*Jl-uA`!dC@7gFAUychr0{^9O&M6N}fUL ztiR6NuL>$Vd5#&^GP$2VJ?{ut!JF&rPA@WWig=gy=-QLuyhA?652q`hU*~w7Jx}{n z4$IBwKa?e%jOs#u{O2lgWSbV#+0pPiWpYgIZBah;L-*YtEUJ8YEY)j4jro!P){CaD zPQL%|e&g!@XFkfm*?E8aJC4iwg@*UV1i_uP3(!i3G% z_V15f>^ZHQZ%11E{x!4d|KXXlGM6?-EH##OcU<%}XJ_rV*P9QtnVm^1itNe%Xgf>v zqQR#Y1CNR3f9@B@SA6Sc{Qo@syj^|j;+cI+v!hIR@7k$;^lH|($A6CQ?hX%6w~zh% zI8wuD|DGz3ck&PB&#$bgjZvtVJ-bQ4yQJw;gzaW69;f8UDg3XKDwkdU`70-}#4P`M z-t8S{^F4}qFMqoAP+{)$Q0*yq*R3nyIv;IV8ow^)ta1F_pZ|;!wD``?oK@XclX<5o zUR-z64q>m^(^v0_oBR3gt^EbH+b)#7bKo)6pLxAK>8aVLTS7ZTPCv5O@!-1LsapR+ z++=fr)`>?m%DHbhYaTnGUA}wUuCpiC?Yrh4Qeew7)tcM> zeqSA%%;t%bjUR-ItDl&P-mBJEXbcre2{f7Z>y?h_=T|v`FIia1D_>X4d3^NTK`~t$ z)``=vw$0!2de2nLgjnutp`Q=^ZFAnDW#_P)qyBW(?%N`jJ4+UP*Wi0De`3{{IiZ(0 zw$~~@Y5X_g>m~1?oP#2Bzdz7^lc2$Ln)zJI?--xll0)l_9-rk*zH2GQ=c#Raf6MDd z4{t7*zf5c9ulJ`K36_{y?(ve#!JtG>%Q;xRGu-_iD!zo+@9Kh-;S_q!-~LzMZU<}17h^?sDNZ7Zj>UCinrj%bHoi+TTjCNh6t{it>Y&zbfg>8DH+ zJCy}eG!(8ks|)!XB=xp-TJZ4fTixZ>CO3gWOv>lg0Wk^HDjgmw1Gy-|F7KOS41lbCSpw*jBxiwBFCmQ^f#oO16?{f&+- zT6+9hof?l#Y^IlUHP^@{#go=!Im^Ln=G)}4}(Tvj;s*56(F zS>IQf{QPlr$Kmordo+)WDKs4q=UF@u*-7N?A4lMfd;>q@XqiM>~E5@bGQ#T@I%-23mo1+^EEtAf13Vmz9xLzWP1a9U%Wt~Z z{?C3a z%J&;*lTqKY#mi)-vzP&Ja?d(z>#fZx ze)lAPEP7lTk^bSu#)NCZOXa`tP| z^U}J#g*E3j_j4;OD6ka%_SEOZjR|Q{x8@iPiC#q|NI`^@pU7&Npj)oxu8cX==EZ%Kh&8Md_V~^AeO(-)Xl!*8AFfSWEPi z+SD+PZf4F*8&cc|P2`N4kTux4wtThhw zS843q#W_Pia-*!$171hrmC~~O?Aq541p270ozZr#@!zZ2L9tY@^SJFht!uhe#r_*r)o&7c;WG@W(muYcNI1>*6*I9eg28b zQGqAV19&*|mjx`)RNg7Uv2V_Sr7B_5BH~=V`NK{vXPfi5pJC$0&-tsXj57Fs=4`mu zyW?7~+f}pa0qq=b#E)^B*Qjc?Pk3Lic+XQ~TehRK1izL>G8<>=rY~>%uA5&?b7tSk zKVjy+1+@!{C0Eoc7C7HtzTD0y*Wz2EZ+uF|qoTRuOP^T$3Hg-${i^d(fprt-xlZI= zbJSnX{-4OXun#;Yk`e`z_)UtfjT?<#T$+9J>1O#S-e(J3r?xcub_VKv`upge+9B_w zj`fpPHh+-X=+$KKcF}T;jWIjbE#BxEs985Y_;FXANlbW>yw1wY2hu)jPBVG1up#uY z>h_2QB0ohoxoUYFbnDMpv$<^NeLs%*s*PS}HCxU*e2(gEdA?}VOb4gQES*Nl8duEb z)_+`@Fp;xarFZv|bD2+n7M|~0(Dq_#;Th{SY&RX;>K8YQ-1|M{?X4L>qMMX175+b= zz})!IZ)1iSJJ+Qb85b{Co=C3{_?x5kRnvmywfgaAg)yC57UnNezu>y$VDZ93GmH)d zFLZOuZ0<0Mk{&QoL7^O~#>^h-s`W3xiv)d=SPmN{~* zGObZ5n;cg2>@TTjpE>D7?enl|tA9WGU4u-D;uZye-Eiy6^92X5Og(%iO66$!x{)BlA-{yN`!_sLxE8IqQDsjDM4>qE9Y=zvA}{z4q*>I_v)K{Jm>O z?2e+)Crov%H-2Bcdhl@D)d2T}siFe5tN!;-v(?CGpY}9%^~%`vkd{8(H~atS#Kp(# zvuirB;L4Kn-elDXricj+F^4#vSNdzUP15La<~VK9C{VG2!Q0tm>njoOWo!pjq;-GR zNBm5c)0*uTZ*-{N&gobpOQv`EvA;i`bD9~lc-Vv_){* zPj{U2OPHa-xW)g?6n&X#g^SO;St>s>SLN@QbQ$YkU7rga+!fDUU&&JP=Q!IIJFyGT z`1v!K-Fy~Lb}?bdpLWcj^QExPtK_O3FFc#0{@0r}|GMmZ+4XCS{U6Rlzs{a*nf5U! z@y%gYL77D#7te20UdeX;?~+q8JtA63qIPloy^T-2*X5LapBUsd_tw_myK?x>HSgZD zV)?gj)*Oo!LXQKygjZ}&lC6&U{QRnOt6SqM{zm@jo_(dR|K}e%HAklXvihS9=W-Z+ z*|G8|Yo{(!pZro*I@0%1Xtell-oFXO_gPjpH9uTD!E~3gJA+T7{C7T!o42-H_)#b~ z>5yalt4Q>e=19RC$E*06hFFbfn7lI+CSUo|5$gR#fp87 zPW*}P-^P>g%9%;bopAlrv2}WLk~HYWJaw8`4?3DUJICZ#H#e<7Z0 z+*dZkoWnRpWtGsj4qx%<`Lic4lXsBmd;iJy>eMB(Q}0#1o9q0b_xFi?lcsN1V$1#g z)_XFOLMkKMS5Po&KTYU0S1rx^WlYc1$@aHeFjQ;n7 zL0qEzbw`bS@#IKFX~uVxOBL-I-6wBVOo=~U6>v4?;l49}-9k*?JMVjV|+NdKv}2$p^4yh7)R-Dmh^{>OZg-n6VOdXir+NU_E3+x>Rl<4LDZ&JLPpv`K!#_810^2X9Na zD_k%C@;uHwwUl|bjneA!YWpRN-`CdPKf9=--;aBxLG*l=R)^}V@;{RA6>x7cEV#ld z_hy25XnD#NeI@_%y$*70t%o1nen0yI1F9vop^`>ptTc{3p4Lm*TsZX`ri38 zt)@OHaEamy4!yEx=WHh~-kJPmkUMF?!;##K^mKMY#EbuqBz@M|;lg z-geWMxwMfABT&A@f(+#jBs0oZzqwxc@A;km*mdIP4}lS_qo1% zvfB!s(!CX>GoKs_^=18+CSP?bvHqyd{f5SyN;=;XC!Tm0U2{W$XHJR4?=p@IKbgj7 z6L=r%`ni?gikRFoV-c(JpAIuj-urj6pJI2Smuzv4KyZf&`8^8OQDERjs%eU{6 zpAcw{7FgBdE_n~!T zy_YA4Zq|-1bBp%xvMlpe&^6yb!@@=7a%X0U!_@f>50>0HlfGzQ#`};rO$z_Yi`%EE zmd5>&yxn4ZW2$VDNX@2eH&d2wUYu65d85mVHpfk_$wgC-WuIOm?lmhW^isZ=#YTmr z-bbM`G&YI2Pb+6P?x`fSxy_#M!9_6X;QDyaba!TpKlfMZpZrM$1kMMFV z+Pi3)wBdz2np;=iP}mr|tnh1c_5&{2i>k{dSMSkTZ$JM;{)Cn?q9UX1s*1dGQ!pJe0<8hekN$h1_Vqa9QQk&}wbGli8-M8K_}=q4a%w2#P! zr7QSlwV&I|CQomA#`*V@|7*8>5&ZLti_g~E-~V)LS(QzXWK;U#l6sGgCdxO?E&jFO z&V0j3lbJX)Kkd4v`l>=AVzx|`S@5SEp(h&;yF2U<7yhnMpJKyy>qgn$%-Qa`d$~3l zdDzT4zOX6yPV>U!3*?v2tvui*xs5L)x3)gR`l9i!2cK6|=x*aaTpxNcA~ItCBKrmL zPZkz_KNOpwC5O@6VbF+#KcNQQXL@248`VmlrM%;2sSxjTEh z#XEgjtBQ|$7tj1=j6ccv%kN}-Tc4hSpz`TS8s;l*^RT)f>*_JwYIf*P)MkcQ@N0{D z0j0;9^O-j|)H!B!81hOVjIf;MC^7fvgLmHqHJH`T{+ReqY1>)mCCjeX>S_xfPY`z& z?k?N3tBw6h@77g2To1R2ulu}MN8#IU*%W0(^BJw%?@fPn>!#|XzBw^xx3eV**vNd` zA0aWea+I~X1 zo7+FJ_4ab<`j0(acMr(7#+Pn8w)lEV@&AKijcJnhw~tQ|YCEFFGv{NgK=F}-lYYLh z6+Opfsq^v1Chktlz~oE+r#QJ8M6_r5q&z6jOOe^kr^uIdQK>mJVey=Z#WwMitS7up zWIZc$GQ1@EPjKV=RhrR`|MuQ}691$s(&oAR#Nr9LGwV6s>n_x*|5G%WT$rl8R;%l- z!L1^BPq!T7%JXi4-+QJ6+q#-nP7+#ooXPpbo0B3o7H*>I%Kw^X%yGP@<;bX0BE@q? zXnWGcIj0{9CI1z&eiCzV#Vjwss81hOB~Ere8nf;Vm&erDS=@q4pKuyDuGQW zgFQK?*0OLje{8L&+o2?9Ums@tQDCv+$D*mr*IB$O-Ez+8wpYi*^Xzk{N3rRA35(q8 zo5Q3hb7a$#6OJz!*juYLi~U!wFXk_sy@Or2L3;Whef^RO&Ig3pI%hAFl(#By zo-j||<(xmWgb!<$(SpA|O3$zQvbA0K({|#{l%5vbg9Y==Eqc|=N~gyDkk6=}>HJ}W zd&d#QV}H$!1b_GIPKy>?6d)UAl*|&y$-lU9T6DDQnii;bw>hWT)Jup@SkBdub6eiW+D0ygPs{bm$G!FkZ}QKY zZ^AQmm-3#6-%V4m8dMqePTX&HtYIR9gk!egufH)I(HHwI=l}Y4@yT-L%?v#j`&3sn z+{<0^Zs~CeofARqlTOcke`b>Q?u!xLc88RIS}fl@QIT=4U0IL3ac+?Ekt;hFeo2gC zynlX5y?AFjTg}ykxe_%jtojz6n`{1D%g=7)jaPpE$x>-jlVzPqVfCLkPDa)X7x3)O zGK^1oabZI(#MN)g%m~xyP_5-jcU+80p7|ViKK{*8`-#WV1-85|Ufy{2dm-;9!79#8 zA}UAMUB0%slVkJK$xOM2^us^Ay#4LpOdpe5*KB9yRr`9JI9+!6!CCI92~KK9oBBBB ziU{obX2sqyX~Po}MlE&WyNF5%nXaPg?V`4iUO z{ehyBdA_}gl@#1;p7SQi#3Rf*kYIOH|WD*pFRmo24%lXGf3 zdY47LUaBkbd!7Ar*ZBF*{UkG%O|nh0P-SU|`y^-(ant0n^qUvqFV8KUoVWAo0se(T zZT{6daRt_|^R)|~8t0vhEh@^)VVHh;iS|3GHw%vZ_>_15Y}2y~p#pzAb5=7Y^cc8! zo~Zv5R)63@#C%H!uQm1T4|LPwxtQ0-UD|!RK+@=p$%ph^%aUx=uRWHq^Xl^L^w8-y zykK-+powFtoCfpZxO?AabT?H=J31$+e~v8dmf5Mk(P@rFzvbPa7>9WaIt6B?G-tNt zF4&@S{9dk$WZutbxna(^GiGUCVE*-z*GZsUS>#6jqWH@%q~!CO54c%LUi0wZW~3^y z&NbESVcXA7#q)eNzHAixq1kLvYFv6UmM^Hap}75^lHJ3q1xZt{)IadHJW*BlqOsfk z=QI9zxd*GZv|azG_?3f&bi(JhvaWHKM=H_J3-?AaFWe|HztntF+I@W?4;r z-m8=N)br~fwdGc^7tgQ$GtFwI)6&0Ur=3~vPVRl|^)CLk&}#j}Gxd7pIoF+ZT<(D1h%R6yQ?aBTB3YX%te<_MSn7-sQmu@}N zVjFLRl(T{JGds-M~;xaThQ!r2fu_iYd@-SOi7=R{`>eog^=HGD>s{6iP;)$xrgTxB?%E%Mh)*rd< zSxjtTnf;_uYFpZld5WoWVO#dsy0(;XUa#KzW!l-{+ym$v_-nf;y*FZXZ% zXx=ElW8?hXCX1rU3OC;P>D%os2-g4lskd(1X}xELVMorMV6rhkeCtbnRBiV3`{%CJ zmwtX!zk7S;7EUGevqAO6#owQZm_L11{`{-{^!$9ie|vsj=l19S`|O$b^M5n{={)=S z{WUw+BHwq4jReK!&t`*(G{-?D=(>A|({cWwHnYL=Wa z;8~u$=(4=S?0K8bm!3BMd*bZk49maQyLFyK$}N=J?G_cf*P2hYx%d^w2Fa+*FYVVF z(s8TcDe@l*OxmM^+27wePwm zT6^`%H<52VMJ;#p7Tk4sUe+7%)Zac%;lAsPmaw7=I34&M?oIc4F3-sk|!->x%D}F-`Ao znzN{U(P8oG#mPD~U*@*-Td4;AuedM1y{OU9?-29%+>Nha^7UU5-8pNnL+XNK|Ks?N zirAjAIuaJh9RFpZ_y_lEkKJb$v|oItQZKvnrlq*hL#8RbRfoisc$9alFqPC6n|%HJ zs;JmN)^E1@W!9$;E-qh~b=LFzJ&X4zq~lLe~}!oB;TfGJB!yp9$GD)9Sz39MEM+EjMvp?K`11qvNN_%9Y|)@3UNWPjgBAnY3%7e){p2;LBf|E(%Is zows#${0mVw*At<|2Janzo}MkX%QIbsX&qC6fq-S3%$Zq16B2meE}3L^zjM=qx7ul2 z6B#`-#Q6Y0W*NWt22)T8Gt1j&rAH)R$(KOo>|j<-B>5`^wYr z0#3BP`s263g{ek#t&eMV>lx$iKlk)Jeq;FZ{KY$8FJ)yZ_X^)Fld=Ba%64?kW!{%R zJ*^^S@2|6rx-Y(Z(eWJ5ZzWUj3YE`oZnB&B+4f}MJ4<`Bq`-t^6tE z-c=@_*}0vYZ@)@;zdZX@{i1e;pZCtFlud}ZrX%^#cJ?-7p7V3RyY5~4N;mfCx7yHY z8)^hAm)Y;RQ62yF{ma+(k)PznZ>zL6U%Y$bOjdS^*0mL3Z-1mHMtBtP*eCd3;;~Bj z_saL~#BCoR*52Q#Yn5$!VvWoc_sPLWWj-pToIY|(<($H*e8DG7S&uF++!cPIes0Zf zxiYU?-*dnIY>dvOf$^3loIYrqB#XQq*H`@f)Zclc;?b*LnsP|$_?P}%6 zkp?>~yhUzrJ}`M7i^}B_yvaGP7hYtBEp?l|%b&GnBHxas23~6Nea_deO>&vc7c6YG zCw8kn`&SWz>7GaKbSm}hvec*lX%G#2aiX64OWxC2HyYgM3C-oW$Pf|E5a}VbRD#)h z_vuScANf8tvIJ|(EZ%+P=Ze!dGCr%NeYC~Ijwl`|Hq4%N(}QvDm8$yJ59JS@-}|6+ za_EwK#uM*Y9I`pkHCgzuY5LB#a+6EEKCO>Lt!j^@z3ZM-{ET6X=81)d+Wfpni-cYX zu(5xXs5e#Nb-Vq_DtCHD{6mk-s?D#%b2iOdJzt>O-Ej6b$19?H<7A!GV~a}Wls}Mr zH04cRdHmKT92}iljd!#ELXZdrOfAP)QTIR=&iaOH#MV?CyY*UUq zIo8x~5!3IQsOXewP`~RLm%;p2Nsi4|cHo-7ma?*uM3_Igq9QA72wc=SvuvJLZMlIH^4(H>l?X6NXly4fe z`c0F*yFTLGi_WKM>0j>Nwzzv@FN?;>i-yft&TjJQliVe8?N^;at7Yb!nAnqNTy^>D zzohC}CeA#;nK-9cw0HWYy)5(ljx6u8Ok+8fC*2#)pp@#Ko>%y|#$>I@qIAYDuU_r@ z{o>->^v0_K2`9pXu1jq1`XCVKZaOW1K|Ft|KliOw!sp-adYDq;xK`0{kKXmX5HDW; ztY*dO#=MqY)AYq+i;m}EzDK=z=B0L=hVMR@es|nxVB-bpd0tmtcgdX*0g5Yd>i2quNbMcv$033S-<&e$q&^N@ z#k%+QHm#-k^;vzstq!|?b9ILIuUftKJ*!}i!Om^vTO-1%WnE7)$$2bsyip*tdr_{u zdi?2_he^lHn-*W4c;_d}=|CU18jIYeCX+HVRZc9Mq^xGMGOplN)$({g)rU)8a~1YE ztnCo~vwgLx)p8~lUGFO_JJlaacm#OgzoU8O@&CaBzfsat|+O^!al z#?nUr`M+9g&K;6xjJmJA_w;LR%lR&Q8BR(w^<9}{ozdne(DG;f#IyU9%kF(m3d+40 zz~n#U!P4uC7M{#*{kAm0uK2}~S=ol_bGj}r)OBnB)Aw;LUp<5C9w*)8&0F|mR~NJt zmX>Zilk;Z#YW-;ztS|Etj@R#-QyI5LB_MXr84t1Oe^+Kl*4dxAYw^Tg-u(OKorw*n zD~mrry8LCHNPC`u`)q~&y9S>=>U{Y<|K74Cj=Lny&ul)+ym+43ld3~KQOD1I?VkVD zG<#pJfO?Dkr=Yqe{gFv6Vc*UgnSW~9pL+jJ`P8Pu+x&@Qws%dwIA2$8|6!ivRX=fw zG|SDR>!;1H+yD9e_td_?XKabTw!iVNQ}&tsbl-LRxMOt-3>|h^sIoFJ>K@Oyzutv2 zT4&17i$M|h4jJ(1Zdxbo+NW>&E%~L&_PnK&XI1UL6BptvS!A!TRXEY^LK3Ug^nAT| zZ*O1w)oP{eT%ysLSu0KF@3my8pUA*y#2r>|yUpqRvrT7n{onCNAB|g6#-)3Yv-hOm z!t%VnPe+Q^&7Nwg+deOt$7Y!X@9ZCo*IF{An?*G+vUglJ{CVEc`}iVf+h-To`qW*k z>hrVT)Sn$V!z*a^p)clQSHji(!i@VSwLX0DmA!CbhX0%cJg+w#`ob9;bn3s!wZ#`7 z*4-Cdda-_^HIA&)blepT0uR)519Z z)f-u+ql?ww3vB7NbyAeSk?CqKJMZqQcL`h4S`Xh$;40NW$9KZoe1~(nuHV-8bDxyo zPWtz0ih`Xsdu4@J(eI#{XSI)rZi4t#nL}Y55pssb^}Sk?-~3V4IXUgz)1_;7 z-E6-k!=I(B_dJJl(G2V08&WZgG}9+}X7a3w_g?M2QqW_KK4;R3_ttODiz<9s_1k9m z9D}Hxa|$QUJl~_Xkz=uXlB0sQm`tq7x$LW6Ji1K*ue{G(Uu*v^Wci}C1))!xK3qCx zue(5Pv&r@AW+vxqe#o%bJEvWLE!A08#BJ|>iMu?ZI5pzBg@Yp)0REEQN;J! z=XYe?5=Yr3a_j4NO`9%wFQH0ura{Z9tBWircZJ7sZ2hOjkotS!ygF5b`m66uPIn%P zm?xhx<+A_0@UUM8bTyewcStatIu_E~P?B_T`INOzu4(D<=fC#uo{(tyeQ|BQ!1d`# zQa8+5y|>91SO$GxRq}14(7_E$Y;Cj;S+Dh;yrYjZHH(|=_pRe5!S*RP~Q~;>FoZt~6F^GIjIcod38!?2fm^!*Q@Tu zoMm{|%C$}Kifr%HyZ4K0UdkSMlgKsKb++#AOHtdu&R^Lfwf4V5)}_y{(qGAhPW_oK zdd2=`QQ+C1UNfxoyH+yH?E4+Od6xdfuGj7ns$UuHA6qo=h&|2zFMXQp-x;;w+uuuW zcTK*$(0o_@3Y(hc-Rd_(>ZBbnY<_XZfBOD^0Xlu{*XC@P;KQ~vwEe*EDOdUay$@u_ zVG?>B$JtZ`_}z#L?a$(|KXZ z-xo`EtT1@9cCn4=VVAf?eRJ4OEz)PXRJ^n7sBU-gwAx;}IO3bu+;3j!NFVAiD+~^{$xvi(?M?*4QS#SgWx{ zeurGqeo46}{jVcEtz<7q$*edW=dgIeY0WKX=2S#&e^L4@W`fFsn@V3lA5M51&T9~> zK5L(T)$0w_v)^|KylD2db&1+lykEXgZ=TQ^T_c^DwHw6BdE|E)8pcgwd}A4veEI){ zovN>%xMmA>G=#p}WF#FRCi?jM0>L1C-<^v-%V+$P|Jo)lJ(=GzrC!1D-RxqE*S?k; zZG(4jo&BUy*-7ZSP0FNA&|L&-?%H%yyUh`s%)S<{zF{&098K z&0~e@Bh`r=6Xscb5?U%|^}#kiOYQmc>E_#4Z{?Z%)GpU@a?zz3-;eJxT)HyMN#A+Ol|tjK(~GvLvV$667G_B763uqyXi-qyA>=GGJK`LfZI z>kFNGi)$8iO05$-p%>8|bAV|}PoZv*%DfBQFI^pvXir>syW->laeIcu{$Hh)nNj&$ z`C23PMI0@PG|$Ved_8U6wym-E-50SeZ;L#1LO4k8n&Si2#1o&Fx<)&P$6NIkD&8;3 z`jqF-{qgFj*}wX3X;`$d+dbRZ}fpeNK+U)T4zP&a3(kfeq|4B1e zJl@s#IbcR=!~$DM^WaL^m99AtveRNaB4#B?6VjB=7i6Yn^kgoV!(zJ$6cO`^R~qwUpaN_ z-<(*fLmjds=p4u=B2Fs%Tt^zFSHiM>|IG)BV3|ntiL^?NGF4y!)9v@d48b#oGlgb-zHe^6zR|Xk%{gMi+kYKif=5p4MpPefNQ6#PQPSpjSAN&n(*e`jU}>%V#l`}U)C5X**)j=w?CnBXVNatSXTek zDBo%AUl-5r%^?SM=2$BI&zOALJfkEnWSe81;;ISpr^+?U}+#NIvdi=n8?gmI^f)%NF^ zr>@*o)41T*vsfpy__SZ8KHuTgS>iqoJd0Eh*2`Slrk8tmp@;Q^a?e#t!l(IjBo{NC zUUUD%H|7cD8WWzbF%NLpVwlUIRhhQ@-BItwx$HNXjDwk7RQPjvBREW^7sb;`r*Vzhm|VAa6ZB}oTd(>zty6R_-B|RmormEX zM|w+V{>+VKw|Lji&ANE}#1cIw*SOCu?E2fwHox3HMWC#7wZa7d%&8MB52{|t@x3K0 zT{g+ZWM*Ren!UV_KQ3Fnb$Q4mv&+~0-kUqX%a zI*nJ?ZXDd=d-26G%cf{IcCj@Db?RR>PAm13H~QQ-x1!f3g7utcW7oaUtudj+_0t!v zD=U$^uxk6BD+w2wug-nT#iMnSb!A4p(~%>J@1rm8{GM{%-a?~yS;OR>yLXee?>1a$ z`rZ4kh>B|z<66np$D&ut8gDnAb**IYrArY3D^5OZ%T+F4JNM%1j0@Tee>;mmVVquh zdd)$$MdHT6M-SC09~J7fpQTh8vQbIDVa?V4`uY6qS5yrCA9yb|qg7q3)^Go#8I>af;pW9zqb8QFPFMy zC)3S!M(XwKO{W-M?#VnfZOiMRL!YgUoISWWp3m3FyUontylRQly)VX>3PpFm6;gk= zL@Ku6hM>vIlI0FXv+ArjT{S*^&+0YnthhBFf83Qme{Npk>qV;d*&P3(?n#GR9e<>m zo-n&9mT~UHt_M!#W-n!@oP67|Exhu37kjV&&44pSHx?~EyKzJDB}wU^w3~MB^$ZPu zE-mM*6aF{-`k2bz`=CW;&CH{HN0o$DdrdI1%AUj8tzO|YpJ_FFwOfGD>FJ{88#)Zk z!$LJSsXGQQ+xC7P{k!8AoN zuB-9LtHpE8*6L)eoRDg{svxRhrhm3g>}2^hZ|w{B%++7CY&q*eD`hp7YenG z8zrshm7d5^Vo0JFMQ5#lXmFd(va3t ziR-Mg-p#tXW$oURoXhM_wseaB7R;G?XtVkI?HTLV1|+0>2rm=-8PVQ8VI}LdqNK*+ z%YL0QeUdwOe|`C;FsW*~i}2IbTQ^?Mp5%K>olkzbKg;{yxBodDnlRpM%vtb6Ko>OwcG9Ao#(y=@(U&^#HQaWSynxEqFNa+IDvEf1xZxz*qxtLSg?I~|U1js?l~_eo8-MV0JyUsK zy>XA2UE-UgTDyvbRQDd>U;ikdL8h~I!qiLi`j#2pZ#tPATHWZjJ#S6;+`^~5HyZ+N zm``+{WIlFiBa=$&S%xD=cOPwDCI8$(NuC^CvF@IO zCxsq)RkTlB-ViPH>*&VRqqCK(i|=ks*>di|U(U3zNuSoaJ+Bb-H(wp!b55>Yy#C_N z$M2G?o-01?)-F_^bV2yz)*ajj4<6jP!0%@AquUQ-ayDt3eL2m!N33#ks*Pl2e4k(Y zp3^T%PVAm@uJXcSR8x_p_R@7(DfBhrv z)#V?*lCB&I-}7P0b^j&X*zX^`a_+I)kLykReGyu_#A+6>CPcexyg1k`VZ@L>H|*xD zLUHRmb2p}o*9(`JzB-l?-?i)XO4mmwf4Y<2Xq?zHH{|T%bKjk0eOLbNle_og+{eok zcF(v{xuxSp)QN)|)kUs5>9MslJ@4YEDidE@_U>Ehxo;PlFE8G)d&a8Oh33ot2HmMO z%&N}*E_vnKh21l5RbKHZ)cx{7`Qz3L&Feh^Tpm_CMYh$1%fGjiudfmhE;apfY)d@X z-qS1hUVGweQQLVEWZ8)mpNr=_T34?24o8>wKhwE)ob{qvYKP*_Ms=aNV-&`;wBR|Ue zyvnECD^H(%?7a1DCHM0`$8OZ8NAlUv*p^1vH#)DQk|vi<1=hGN^e*pQ1AUX^SS9iEvEk| zXFO+A8~tHP`gDt7+2e;>CBk-{=G6LgZld0KZ9Tq3wJ!yCcX+5B;ACohEX~B%cch-j z?cu}Kg3tJU|0Rkt9kIG?!NQx+>8#pxIfA8L=xM90S!OD8xxuTG{{k4f9ZK(}yxu7u zGvW2g#~GOpzpO8_cYS+*eN(-Pyqu@zniEV5Y_u1f8rR6GB={aaKj9+tL=D|vvn$W+ zKXc|}sm--puPaXdKgVe+-K?m5GDWX$j;Y}7dd*p}-I)$nQ#2c<8?gpE&fnPk?zq#8 z=Ra~zTsU8QYR}^xJh{wb4^L-0hduciKjT7!LK&l(W79*Y#aojd_BJbT3rgX1dv-hH z_vIT0dv<^IKJ?(bisFx;^0xKeDfv6DF?QJ{+*-H(?5CdkN6je)lb#<^NO)YPznFQ6 z=DHpHRx{Y@dCYqY_xG*ZbnnTAx|Y-TEOyKf2{>_Ye&^1YrIsmjanqfbZRd{oF?aIw zIeYBqGCW?;C+mKA$Bt#Y!gCB9k2lTs36(FeK36Q@#WTC#^Zw0ei%#$#_--n3+pbFF zx%-DJyVd4i{dTx6W!l|T3HN&o*2!y1=*(YHBfs?_4_EXn-d11jw| zQnuo$#;i$7d(?h!{E+Lhi9xaHvcqc*f7vPjnKd2XJ)GPS;K67<*>R%gHw05OiX1h+*d+tNi=$=%Q~ z=1N#_DC6+Vry3XgTUP`&M)qFHOyhNFPMB8jvNTofm(3K57oYEapW_sKa^_)eKHG*Q zR;$kentPJvd{Zy*s710qUcoK;K(=3RNupe=M5cuBa&5$S5PBwZom&mQ!v<^Y0lA?sK+nQ)f|-mQZAgiu7B5;S}RCfoVG# z{&O?#sNXZ`;~8&1e};(2E;#||4At-|Zfni7d#qQ5gAQ`ACT!3v_~EQ^j;SVc&R z^BNAGI_$&w_e1i8D-#8EGAe=_*bWv2WhZRKgaD`aOCu(r%P z6E4tbp;fR$p&(|m?X;+JSCm2bgnXGiSR#MA^(9f&pCm$(xFJQiYcaH{{?NwX+p~a-v1!q9@Al@Zc3V|!NWY$(ypdYu z|J=Ii{^#W{IUcM3^?sB6vF0~#4oio8{#{~|IKRT_-=V3C=X(pCUw%00U(HkA#}(yP zvw2Px+O6Cbc_-xWinmtFpg7 z`uaNV|6>#RIq9k;-|Y8Ur%t!E`Sb7b{?q5%Us$P4zgAkS|1mwAr$X}o|M zfBgTzkJWo0<)5(1`|9;Wy#JB)Hmx0zm0Z?Qx86ASg-&6A)+W1Zp4Vp6(CT!ynG)wV zdc_8$=%-D&e3RR7UvW~0i&UTNCGL8|xQ>eoZdZAvpNc2R%$8`^F)my2E8fpeOYqW( z3$ELkIoQiK{%ilE#9s8xd1B}`l}GMbpAM%#)%kZPz2u*9tXhfYOQWUUe$y3W(@G?d zY=8Wt?9=0GeoxZW#Y=WB^mdzmKBic!zWbHd(W7k#j;k#(y2iG#>^f6QndrtXGi#)N z*GnFYy6PFF8N<5a%em4w8-@1ve|p__v$0-axAvn{8R_1z=y~o}Gesnh-Ok*jYjq}{ z^O(Ni(Z^Z+?`Q2>QSf);^r_1yYEE8$AystQt(HomTp736Tn)44GP&H{{nOW+{7}fU zD`U&Ese1cg`5yS+k>@cxIZG_i#Achy<@vgexe}A>U3Xl5_V)3b$;ZNBkiTjpCa zp>=`zAAhVl+2vSVFg=^A+$v~m@A-3E0*=0#&Uf_or3*&?7FR@Gs=IjfRzd!Zdk+ut z#oT_h>Gs0tj9nFfvW;UhFK>FvF=O&3=7smH8|@i?WOARMmRFzQmZp71Dw+Gx{n>Yy zRa?BZjooL~xICMqzI>P0_KoG@6Sl62%d;qvJg&NAsr#-ATLS+120zT*l4Gf@Yy5qK z^Zr|=OQy}!E_?R6b)~vte*diG+?$`&CT)M=aLuV>>k-TBi~n~xUfBKYh32;43vasq zT-qtV@%UMp&)ZJ!+Ffxns_kT>_adpSwlZHcjUO%E#`1a2(TkVG%eUqJsGoZzVfxt| zlgvkwTY3&XEPfMn;=joKrMljy7ag87ZQ<^a9Vu@69v;}baj)t}JM%c%712V6qC!4f z%+&jkV|O!sNgl&bm;GCd%i8AN+Ogzpz}D02%Ci6Vztni0*lu%h*-D)k$Kxiw`Fehn z(tKa`$iTlIakjrqrTZ?M|GfV5+}TU|zv><1lESC@U7W@lYHmBz=hGy!!Y`-oO16qyUj_J%rB3^>-}h7D#M;Uk z&rIMPa1PLSu@tCAZ^iwyMyLac7b34`@=RZ1~{pnZ1gDg3L zswaen_&=Qx5b{iTcEjr6l1M|TJM#Q}js-o@j|`bS9d7UaC}O_SMo#Ksij(>rm9~(A zCcj%MjfcIZ1SeZxyki%adO1{Ob>-jr|9{POoO`(AYuKifZ{EEtS}pU*Oek-9&quq1 z9B+g!Gi7IP*zfHpF`@qA?Y5Z5*6(btCL3v<&aq1TEZJc9tky#RvQhHql?$)i9}O}6 z|0-f`%%`tM+@9~7vLgS5&eT<=b1u!aUn-VwlP5NLp>x5M$d16-KW(mlTDhTqVy*6V z^+jKIUOv&g^YVx1=jH}oFHW#+e^teI^{dRPzk$!)`b3q!pJAJOq0vY)#Hrr>m&`or z&E3<3SkC?w{M>$E!iBO|krZSR_7c z_U(sX4b_iKi11c-6K)TRo_OPxhJyc`H+~{m%7+0Zl>}Zvnank;tYZE4)VQO+SGJ7#;a)FHbulv*5W}QqkY8_E9OacgW74jw@!DKyO6|8tao4-cqxG+?U3GeLV5D%pYk1ThIj8!-yGIUcbiUZa zaHZ4f()DZVB{eeK2fj_Y@aJ5O2oKk6@z)~3VyD+SL~J;>X<5`1ueB;apX)ne*}B=lciZ+6L-y4HNP(X^Te*d zp8}ozj9P2f`fiue<*4tSbYD$AH~PIvk+*WLt@%ZZ-4iqB)a5NIENv=u|0}hi_24z> zV9Vq4q*X4?aD4G+-@)R{{V(&j-}-jBUSBXG6>@V)3dejIhq|DAy}mU(Bz!z zq9}!+U*E4XP3698%BxeyYr!Sve?McxDb5A@f8)hZ3O8=u^n^*^_V;b6Ri)Eao4+JJ zJ#m!l?4CRQ+juQ?*tYskF`Zj9>-7<3R+pXo8LoFN{XThnloq4G^o3cBnv=Ps8yGz% z_eAS5ica1YEyG;+YVYQo(LL;p+MCmof3eh0ShVfSsq+@vWq~ofvJ z>gOxBz4byy=MP(|o{!vry=LC$%@zD2N2h#$q#w%mj#;s$;(^R&)2#ChUwE4wzuO1; zsBdo$nBc#d<>Uwb7hKN@J>Q78S{(f5u6_QRTE33wmPw224rmo`blo%K(fa)c>u)9Z zec#%3V)u*4y5J+O5lTy++|l$}=+ZR7`>QgK#gj|v#piH{p z_luHi$^PnBefMn&HubUfU<-KrtiFC@=j4p(57`fSZqhdXnPqPOKk2*uM*VfplV@jY zF`7-^D9WNa`F&;sqx$56EL{$-vZo8rEaLgOd1=;JE=J4A#ig~3x|=_iE@fhRdUW!P zist%K|DQ~(0%EZ-*YX1;)~K4!ch*&3$zRm}QO|lxWy}VR#U^d0{GOWLd3Vc-JQyVX zlNC-aOI64hob({|p=@TicY4rK)$%_VeAT@8EVbW0KK$jP!vtdRsE6y;!p7n41-{-%pCSPP0nS8U-k7+0WWX&p*`pqo=jyVdgaB(#| z$&~6lMN4$e_w@g^-7#+-*-V&!^^4$j!D$N@er&KfHNotU?27d^Kd*NDE1#Zze_w%G zfLhT^@21nQC&$L*HN_uFw~yPi!{-0_r}pQPZhrZE`uDfLZ2vybi2wEX6WdhIPa6KA zUB8R93Ot3DT0LC5cST-b`=^@J`YpVZ_s>}$G`V$pG~*q)S?et0SL(!=TeEGA-Dt;t zApg&en9uKjZ_kgPpKjIjW2Z|U2<-DRcC9pBw+%ys#>9Y5(GZoMnau*@@} z)Mlsqi;Zt>vb3|!&+aUGc>E%p!zYEsq95i)pRPF{w_eyZ%~#!OkDW>NJO#Oo3wJ)% z$CS@&>E-$RL^Lpa*Seebjvi8Vcc!&Z+UTXWH}y(vqxGK}y+;lg_8nM$zGv_8xjPGj zW4RXyu1RWUdbHN(+p_dUNfDvk>1X52ehS9xtUtxGBHPhqjm=vj#dnVif=iB`U3kN| zLeJX4V#@1Hzhpb7>pF8Cl+Ax#!)g*}p{K5E*+BVl(<@$)dl(CoPYkpyKy8F1I5-;n9tSl?Pt$ z%8D&{+IBE?uU*Z)x2u-Pt@U@|I~T3`>2cC|{snvMf9+hU%x-KXVK@hmNgL- ze_6Fe3vc|;dG+E#OxTm_8y>N`9d$0;tbg*suA~LOs?wG=)cVeNq1JQPs6y>1=XA|t z&ncfQ{s^cqb6!;WW8qyAL1aPtcqGqp7^7WuLJEL&7s_i{nf><&SzFPZsi=tMZxZwy`y4zr6nU19v$L*(Z2@)?CEiCm61Gs(1F}Hw%SBR+tn?t7p}> z-EL<5satq`I%|}>Ut@-l1|QEU)y@RBfAam;euS%Hyl-8SZKBLeGA`V2`o8E4DjU(`RPm} zZuMI1iJPAnskQQ?Wbk+>GPnGhnAC7ois{X%WnyI$?kKVy{N%x%v_qS7g2#p_bDl8j zPZd8MG_!tho|b50^@FNB88f4m%-1&x#9mQ8y6EwVEZ!u;$R#;t?GY@el?#oJcO?SH`y!^w`zzvwT{=Y=8N;fEf;9wQLW+o$H-(Dri9l^XwNM zj?A7mwE>!(S>1ly=F$}wP6N?T%uD!YKXs=H|Bkzp=S*yYv z?Duy`d<%+ux}9;Vl5}P3QV-21T5VI?Z>_!-Si5OQsZM^_g|k*m(_PQakv&^_sjy!s zHZUb|zVXBLC(SSV=++B|u8YuLtzvz!3a%+! z!fV1~4p+_1S$aL_S@+4qP19<#>yl19i#yw&vFX`WW|Q@D3x6)>o>d-Lzeugif1lsS zfN9^l{L@x)=oPf(0Koy zSJq>-)77^9^)9_^`I@V!)BVmXGw>q^=l1x*$@?Zg+m!1f5iRJLfAfSy zzWmqz{@071Id-Qzr!=2>p%E6WY%`_el1I8}hN!dY;K;s68p+xxh_m zMSYylf@g8ZEfWt~pL04<@=)+i${hW`XOHaf&(QzLZ@@M8<74ONtB)?pT+sKo>&DDy zn;&paowZ{^r~l&i&e|^){)giDIxKx>wH#N^nRU*eZ|$0AizPhgax8e9_hagZj>F+I ztR}wjjtt>E8EmU`EvCQYWYv+2D>Z|<&ZJ9zax9(jw|;W+Bk_=``T&useT$Srxc4pF z%3YT0C)_mmW$^E8cHeTYeap5!o^{R3H@kh-wGCQ=$MiCt_xGw!-@>hz`F!V@xmULQ zl-JA*4pW`~{Yc-g+dNx5r^F?>OIq(yUa?_+&87SP7gSl!eNbp#G-aOurCgiW5>dx~ z?^yfmHn+=7uDu_p*7IGQ{k523QAbbrwWAxSrk0cnTFd{h+$YLuKk@XG#c!5>n7w{> z73;6hT^ePZW~RM76Mkj=^5{to-pA)h&o{e$iT(22FAGX+`akWH5|{mVwx@VadFt&h z$6wQB)7@jXFaMkS^JQ81+STXUKbX$wo3Jx4Me@RAwwWrW*WKQIeRU*Yas4T_Nw$Yp z&)5BtEf$$-%k*p2yWi(k;&wE2`PZ1vytb~zDU_>kU-r5R2T>+Ix2r3^mFrr3u=C!r z&#KjY!bb^1xjmtoKj*f8lG+^S{gjnQ|q=LxI*-tT2F<1XZwrJB$nQfI69epb?9 zhEqGjF7v85pYZQ^7q(*Kecq)!g0tjIh3XD3+3;iX^k0qp_dVfLZ%+HOG-uzV+tWk~ zZF5t_CN;@@J+h#{z|`_smCwpDccBvz&+qTs5a4^MPUPjS=PbEOvpvfU1DT9Gr+jU{ zbgsTFfA=Eo${);cT%C2+yee|MXxPd>_oU@@|B4RJxaU8bthmipW9Ozn{2hM2^1!^; zH@aRbt$5fOcCV}3()dv{>+JU{jd$@Y?aSU1{lqwkq5DIE$v(H^yUR}GemUwWXE*=M zo2Q(T!a^cM?iC@gL>3*H!CAvb4zLgImM zua+b&mHg+|)D?Y`)28N2`E84|mj^SVectV5+@xt3ceTdDIRDq(QUhKt}9c`clmaWZ(>FV=cAA<+XNzIPDK|5ajg}a zFtuszt(gpe%`I*R?)#=S)lF(uPrgd(_AjB#FW=2lSL~asa^;PR$~V>T#$ronFq;^6 z=lW$SrEhXvR`Rj^?>uh(zJ$d32{-?U9)DA+*W2?d{9L)&>a&-2T%XN<^#_+3EA!G% zE4G$u{B}P6VfDY;(|Y(OYV@8e%-4WovC{cy7C0>jLo*@6gzj{qrRMn@QVO z7xJA{-y?BjcEoJ9?BGZ{54O0S3i~uXCm+1!@smw||CcpWrP@Pt-B|x#wb=OW>aY6J z;x*<+ADncT*Ieo)Eoov`#eb=!=0aKf<6W}@pXgZhGA#BH(d|6Y@Q5vamorPizSLUZ zXWZv}E2G!$zW7rh(mmy+-s^_@`ky`=e}BFy{)bf1zORQ1?F`lOVsHk}^{ec`*+bhVTX?k#AK7o%*0)^3%+vOm_SgH}k{oZZptwbX{I%pP@D<-SgS-zHIiHQD^!R0rEOe(wJ<;KbmOA0 z>i%<7x6DyB%Z+w4RJ4$-zxpJ*w(R&$&FCAGyyS%5?+MTPz_i+LuTa{D+3PKi$|**F zF`Vm~)nRbGd(rvL>~Yz44$a;y2UlL!`6*@mn^{EuLCpGTnrSy5JD&=lRKsxFe|qe} zS#K`R-cvt0<=+c|4?Vj=D}M-NHy{7#S7E6pYY&Go4&eHFxNm#b`c!~D9ff9Hsl z`^MQG@QBX&QQvR3{=sw8Kk3uO@9zt+sb3_cxz?kk^0Pzt>C`X&e?G_i$H$zz7yGZQ zvH8+@egBt#)&GP}ik*L#D@aZuLH`sqrd@bNauFlP`5@h-~ofO4{i4=klya-(u(0?C}1a z@^b%VzAo|lUo7@VOLu$rE@_fwT&Lan@z*|oyWRU9%#nY0H@HEww`&QLH+SmZSM$p) zq7I$DpU`ixc(K1wxP}IEav{=3ZkJ*)btM4T> z{;X3KS;NwK`pB#m4dG7~o^#Q1+0eISTE~USR>4UEf#0LHH`E^plFU5E$Mi@+`wKG< z+vWvPwoHqS_8GITd>@_05hTEUhfDC~bxZ3ew|6=guo&_5 zlw2`nOWyLvmm}fWJ71>yYGL-ns!OilQ*nCrP;ExaSA#DNGmNvox+R2Eaqw<@uflSW zjWgHp%u?yc87&LElsFBm3|zY9B|b2pWjLjvReG0yR$0mnWu7_5xr$aEpTo_g?b6t9 zdQ3-rwb^rHj>*eDpHx(L-Wp`vQ+Frn@APV}o^!>CT&sgQ|H*QmoRHACrT&?@Zc1N* zf!W6#KbiDmF2?OEPDVJVZcm-{R!lly&&_u3N+mbmS+UpSsaAY<7Xl4oho~?I+oix6J6t{E&Eo-T27VmABt0coZ6} zn&cO-DsbUct}cs*XAR}Wqju}swQj865qP0_j_eZSReZ-^q}_H3KH=UZ>f<_9SCrTK zNBgUpwk>DtKlt#!{{45}J?(_ay-nQWT;?~EZdx7L zc%GwRV{yk$5s&2JfUbvXY1>2=KWPr)+4D@ zwE7f>#`K$0^F{hH-!>HQWa>On_;R)BhjUlMO4e>;%D+6fe!6+u1G$~2xXPbSfBocj z!^3XBb=kt_#Nv6j9u-&LenTWuj0_~A4 z#+xG(xukBSZkV61b4t6R`rXFqk^3+8Ug}%oDDTo!ZN8A@fZ`=fRlN>tmjxXt6~67OWJgYKqP*h^o7U}u4@wr@ zIsERf=R1wV_VxENbmMGVALe?nXq{CMn9#LjuFl+OPqs1{kVXKs-_b8yqzY*tm%$66&Kn%)z$ zldIla^OQWOO<1GZrm~@OMjlV4(z%K5D(k9Om+X${|6p?LxZL}Cd0pu=1Gn-=r(AUB zXQ`~q@?r8kKly~9_XKPGFrf^wO!1;hocLBubC%yFnqe$)!#R=OXD?K^rP$d zwJces7I%|r*82F`$I|n!t*k%&=2|Gz@d*uY?-@+==Gx19ICYQr1Ec>ZVvq5ko85F@ zEcm%ElbKk`*(u%*mUGPwE$j^QtqWy3O7`Ro>1JeIY2Qhl?@U;M?SfJf3UZ+8XjEyb~~xSlsJ)SdKBt$6`Z> zvV7GMN0kls?;pp-NE>Pi1+<#{a7lh*T<_W>m-c>R=kXhVKbmD1J~}9IJW{vaVvR(* z>b99ve$;P>YWXNR^DX0FmMk@eiOLsa7|yHwj;=Wt{Zoj!^TCQ~enDp+$A;Z%V_?1W z{qS#w->XV?{aoF^@epB=oTl7%8)A}gWZUoP|2TJe zU**?3=GV?Wk^erk&A9O|!_moa*6sN}sr^}1pjk-t(%lPQ*Do)9^kDUCp46WiA(-@zprO(EVWDHntX{_XtL%+aYlp5juVaQTYs&*a)wj&UP9ibGf(B_Uh!3* z{@KU6vgU#3mZL60wMwGbC)e-W&EPT7L}lW(_Yb!`mh5Iacr;0Ve=LLd(aEPhZGPSs z=KBAbbFRUujwNY_mMC;>JX!Pi$zS0`$+GIg{|#T)9etjopQ!J8S3tOV%ftWkeyvfn z&%XHo*PoN|aoL9TiA@=cUq1QsNKE{B_sRZ?r{B-tZ#Vy6&A;#J8`FPX{b{)G{(<u)G} zTeJ7tWy#)4TJ5Kknu8g4?Q)%N-$6MT`IGrtxXo@7%i@MQ8`q)XkYMb zd&ib}TYlNN`uTjRv1|RmKacCrj=0qB(>ZfFvH))1qwfVbq`nxZEpV`bX;jYR3gyx>0>;K*s=hQuH*O_%L zBi`Uv+1sdlHzh@`UaI{nd}`a$-*vNpS0?HTTgIh^wq55oH#o=rRNy=7hR7+WulV+q z%&Fh>k7a(}?Ny!`GC%*`o64&yvc^@@uOi3x!}0l#Pcr2( z$+xJd73J<;r#>fO!;y+jv-Ys2mpfdNnhN*S0U@W$K9%A)(91cGPvH`iMrb zK3DLa@Y8qd)C(TWZ;o{p@a8RKUHD65w}~gmhPSXvAF0FN(KfL%|S-V9Rtw>_v$mltDF7M9Te6z}_%iA58DvWqD=CV4R7Fh5) zz+28WV5(2lT!C#ZA2z637+gzy<+^bn({;<1m<2|<#|uRd1A%^pU!S-p zcgVzPMy|GA%=-FzvC5Z6tIM9{<-U%5GTXa6y}w&bHX~%}J2!Sy9TOwYZ)#iJ*`Ds@ zZWOqCj8XCVqTUMU1}A9)W4;sIcC#xkpI|y<;No?wEMg*0QN*f%H^Qwkvlst6#URo! zw_$aqRFHE|$Sdc|9qKX#J*%Qsb_BL?6|+k*t`RYun549n@wj=tsoi}R2L3B~DM{5v ztKPSs7g`s{_SW&UE5|&=Z?pMqy4`Lb(~{2py5f+$OC(d0P{iH6Q%d=zOr?1|8vA9q zg&Qm{skkpInsw};#=$L2&%NI{D2psU=#{W)k}=c5|1%ysJ`s+&G4IfY-x6|9L|vR# zyy1Dpv))>b{cv!X-H90?g7tG%?i#+I*5fem*`_VdmY!?pUtU&r!_Q6Qr(=iAmTkuh z-7dd)BDY0$Qf1R=a{~t5&X3xYmz*o%E&2TL&H7U5=7fnddA~QEoMh_R@NPr9?IT-j z0rB72vn8e_iyWG#9)G;ppnLP?fNB3^lNR&dHean2TjKUo@_CPzuL5J@gpPvZdL8Tb zuM^n#RHn8V*V%s&KcaGF(xRUF32$mFZp=MaXYgspX@1|wTcmrI6)wLLBk|$ojW5BU zEiTQNC_4~C>BlF3P4IB2{|NKL5&zj|0nfk9A zfBZDkzdQB!61%T0ZE6oo;$#0wf1mc}U*hg7^=4%&-xeplx$&b%J$7=$56j~hkBVJC zQxU2^FCwHggYQo1@85ndZv8e^y*mq2{jdaMzm|#y~Qm3#6II$E(|7$oJy~nZV{5}k;)ZelwO|W2C@R{wxR@N_N`lVKTISej~-S2Te zlkVi7W~AnI;+D%!zMF+U5t}PFon5yr@@4tjLTBS=b)QA`a_arwY}5F&ZQK6&VSDFk z9%(Omy6*YWUs>Ub4v)-y=`Ht)9b5M0t*hK}a#L&e(G!ijFKgo7ypnv>+kL2g zddb#Lg~wVSZ8~H7>hP1#TkG!%HT}zcI&0nZoxPpj*K^d{-#XN7Etsy5J7;!%-s9+S z*SS@{1Y0LpZ}eKdN3LM*+U~c!rD%I)e)9(fa|{(P$T`LXF7OTmt4 z{ts2pJr}V3Ws}HCd%f+*E4!~}itQIy?ppc0aPRhX{bi?ftuHhFz|_R@?8};v)-V-K(#@TFg}PVU?%VKM|W-O0&LO?40^U)mQ38pTVwKt=vbJ z>?u0#n(=LSueI(XLC!ojXBLw$EdsnccC(D@7pF#jTk~>J#M(QJGf(puW?x=j^4TW# ztEBe+7y6s6cCf2<+%xLCm|n{kge<(B&cwXs;*Oiw9dkW)udM&0vB>^aVQ$8TvJ1_ZkGF6C#W%Ol z?%2%veDgRu6K6@6nA}tS`JwMfJ5RM!d6&dFyIK0RK6hmgZtLgIODW={jx;Ubn0{3K59cH!&3_Yi?XI6}U;6oCpWi;NXM3Vd zWKVRurn`UQJTuSP+3AXMhhq&(Uu)N9h56HzB>8RlUl=Dl-RGQt&`R#>&*KV~F6FWF zIj?OrjFA1*{$+;B8^i67x)hx@xKCdG@&EB({VOIX-t&`}+kWHmQQfvL_Vss9D(?Di zvawF1h%?&qZ-mONaA@Y!xOuxvrA|9~^Y-oI|B%Dc zJv*0QtY&iCk=_gU8`h|pw@*2dbYYR?;-lXUxUXJv*dW1r!0F{Wt_@BGE0~;FeA!kX z=-wJTnbBzL)!tb<53x@vjJj_8V%HPFcV(;V!#-Twm&Yu>D>C`yA?xsSo4GvACc3C* z*>8OCMl>stWuWAe!YCVrk44` z*}t|1|Eb@kuYTaW#pa{I;X1)P#hq`TueNLqOep2tr#S2PE3x>n5P97#tGvH`u70&T zq^8h&UuNjqFWK7PmKrHVEe}s!zB<%ryOQSmQ#qxDJB}R<|JU&ID2H;ywZmDzw~GJ1 z=zJ)AL)sK(hiD#)+0*-XGA)|zVCQ=H;le%5vRp=pB=mTv0mQ(>=Vf?a+giD%+*_* zIJZTHuG?3gnSD%U^VhuS^3PW5r(L_Z@MrtxaR0x`()T}GZ5Q;Z;y+sbn@MHKmb3c$ zn{$0F?uH(7KY>mR)(r25iEv}*d<(_e)cQ={MLO<%|C(YWJTe)pyGJA+s2 zRd0Q@^mT0aDK4An_|SP}52d~brrTE)^c`ImY@A;D)g)p{$Npkk`}T=lem_q<&~ z_R;Gze*d0z#8#`+E9vSYB{dwKlXP3XU)Df1J zWolJoJoh$4Tw88%;3Eg%SUgYR?tviCe9wy`Bx`k z)~zWU?aBov-HWC0$Ml=! z5gPsXep&GK-miLd#=P{{)zf!dV>3;^M94^lOtKJ^4ZLAD*RoXT-M=^0ifT8jBj(yG ztT&T&s{g0oE#qykf7kr=mjdhG{!??s*y|jQta#GG{c!cK-m}#*46EYi+ZjD&{WpWH z?^O~<$&Ghm+jh;`WL4U<`*TUN;L&!22*Gd85y@&yN{4SXzEz4|Yj7nYc-M)0?;X4) zY+BabzfhfAIgSKPT%Mjcg`<1`j6N%nz%#ShvgS=Biz*Eq*qXO+3f3-{ohp8U=6`ZG`rH1>Z1{im=}q(Xy*)d6e6u1-D)$~f`qbu^!OwSh zPhYQ}{(OJjzmjPd%l7ZLIr5$L&vV6o*?!{_sZ);5d?xiXIaBKN6!*4`5!`Nn_Uh$t zTm7g;t7XQLdh7XKE7hiN&wKPdY4YV4xgQ&tEr0&&ziH{OzP+;cal@%u>!y5GTAz`% zZO!wi%VMs*uDE|Ga#gZw>5{jBQK>ErKb%t*ItnUzhnCdKKQ#ICTVSW8Sh{4m)-O@D zNf~l;KZ*#dYRx*dYl?@knC_v-JP{vm+0ctOf4_M1NWyB_W0nJ#<@S|Ti7P(b^I^}W zhKEKOk7nrh^u5A&p4emo4nk}LGr zC5wHt(*;%wg*9^yZ|J(${P=BBM#L_Th_cmrVzq)V_BkfL)t_}pabo|ZdLNIIiJ22( zYU~~-&19H-!N>029>4vi#}8B_CFvcHoWbx(%{nbnZdG#P`f1_2zg=~b+p51oB=tyN z?bpn&Z%*s~+R%8j;fP!G4Cl?+NzBJ|d~{|?W}nra*8Ez^`^>|a!NN9vTbQ<5GR<80 zfv@vG+rqSIi+&$x{C=ZV)z8i(vSnets>^@Z&1Z#jgLa%xVdBYUWZ*IGV_g%~u(F-O zyHjrw<3R~o?j8AB4ZG@+)?BqYmXx|`pYmpr{O?~p-X^5=KDYW%>onqjFp30Jd)S3tcy(RS}^1L=3{(SF<)wqcrF$^ zRzE#&TlI>@0+o(LovmVL6)pQz-7Z{*7|qDFDU!OhMV;lma}5Y%4<*aM>Z%N8r`e~{3`+Z%Oy-QObdp~14dyuU_#qc`gw+vR#%W;p~ zN++ioR|j3nSunqT>4d3<<^ll=YEK3Iyy9in8T_Gdr5{VguYFF_8f1D(CAUvhJ)rzL zUPvvxTV`+33Dt#`&e=tBKi@XEH=QmjThsIQ!-e%po+4{i_Lc0GU3OH6HQ{DN6637q zA{pOvinkVCSM#p++?coN%Vc#GZ~k8~|2n>=PkR{mf}>t!LqY5Bo%LPv1s)Bb9JX|) zn@_1NbdQ}nhVCvX>2jVOD=Ie%{F*oyZW(APhknO z>;lU@yEZ=g^Xk_Zrte#(8{ND8J9D{z;YGF|mUBdcT8zq=ui9L7HvYg_5MZ&3UC)^> ztI>wX_TZ_%&I`_JtKi(S{e?|ETf=bHoDj*F*F`2C_& zXIfQ_yUYVijk6n{%rW_WrAcb)I!V=Cu36T#K~rxv*{?p%DXH#hb?LQ8g7B{m*DYuG zKP}bec8lSHqR?V@chk`9o{Cl z_EkNc^ZxCFeZ5!aWCiZr?)}E#lD?~_LZgk|zJkwpoq6SZPU*<{>K!Qdn6&t$;5^wZ z$D||KTAowhsU0i(wdBZ+Cj0LCPd5ry^KuyV->FyPm{*lzc%4mtuE&GeH`T8k1LQJJ zINx4-^UDw2(DX78QE)~?&{7RlU6`sy&hq(4;dW-_mZ?2Q!OB_B;C zKG;Jy&|`K=1+5y{_y-x(Nm@+E6<#;4PUvS zYLWQGZ|`?jEl9svJk|YM409j*w;1M?HN4wwZgdx|_`34MsYfL|f$bUxjJLRT^m-+J zUf?oE;$KP;pMS%%M-N_2+2m$iRjNDBvFZfxIzR6F@wQK0pPs4T7i}Nf;rC{BgzOad zS7B>XYd1d@+AIC*eUs2@#^=u5SFFT5y||w!XW6!^I~aTDc5Xc};nw5$>Q@2EHjJ|r zv)H;c)}$Sqwd}BQ%B**~sV1?~2X#2EsW$YxBw4ql?Rw?YyuoGCi7S4$RXJa_HtR=) z$liJQCHKRz&(~AdxjFVZ)K7h6Jx{0l*XcE#B3m2|-)6d+B6vz-)2`~7q6=*%L@T^q zF7}g+D^yeM==#tE~-i~|MHhYd%x#* zDe~^0F?(t8{tT^4B5S(#6`Y!4{OGLE^=W>ee#)@7u_UFhJGJVL!nu0(Sv%s^wcTSm zs;~b<&{aa=hE3E5748WqLqpf)cNX|1^j-?M!Z85Oy?aXQ7PMckQr} zl`GO$x9|3Sn72cjd6B}FNb8oJ$K7LQoVy#i+>Mj(_-Sb~THL+%^muOLX~UOG z;;wy83SQH2zi6*!I?JOT-uCZL*aXxcBb(CFE;Y-8W~<&!p_l-78E(61|W zZur&1m0Ilat|3B9vi4cx5-io-=e4s>S_V}X6u(#(X0ZKe!@E1p(5&1Q*uUedy!7admJ z+P=3|!B=o)H~)?)o9vEkJePED*6ou#{;gR~G6MB`HnY56d9vhI&=*&4_h^Q7j(5CS z_I$RdUEEazdR|#7RBGT=KE)auzWK-XDn{*;QBeahtqzqD1=r**GaEos%>F0tcMY~&h4sn-r3A~AmrXP)u?vi;S;>k*Y( z_eAF1b$vb0!nghIl8nZx(AlSZrg^=4_V4GfIfizXl9#_cU90}SfBTl}sn=(gWH-&f zU)TTps$|_&yY*eBb9DsjqI2s{?OwG&GW@}VPHr88nY*(C$|`m&+g0hfggac|eZonF zwL2WMXEao|ZQ3%QYfWLuxs%^+q&#IWW@<_B*sd?l%gNJJeE-3Ljy-4M3*}_J4z9e( z79o5i^7;lv&XnVmeP@+iW?0B$)g+!$usSz3d10FV`DtHsxC3WeY@L?Wa@DApss87| zn?i?;s+Ng~>=C#oe!*ZFlN4jN)6t8qE8aC8y83H(p?x&N^@bn2=7_Iuo1Gf_W0iH9 z=lU5OQ`F~hdQ`X1eW4M@lEXORvPnf{U2Mp^o2iw}UTW<^myRbiep%u!>QSV9vbLWYR_6G~@ixKCW zULC%2#?%{JXEQcMmtB@A)!@5z_st@MxUHPhm7i+oWWJBF3fgv@Bi+o-r}(Wj-)irp z$?K|rF25+|W-#r-`M83ExBOf;_$_BzF0w}P6m#@z)w8DSyuaUToci;M*>{0;;?0GA z?WK%PY%A--@@B~}&Dg*2v)T7YHxu5qp3?OTE_ISuIBdrdmi1Qs$+GRIzLvH5Ui~Vz zo8=R02A9#~QdWs6=U3RdF5PHko4fd7f-*z*ZGju5foHC>%-X$p{kcSslPlsgGVU~5 z$Te)ql4-bAnQ}bx#jZV@`r1ttTJJw7(&axAs($vs7T%76FZH(VNmZX#t%#A^xP3}r zwNaQv$dqlfcQXoQhrDv{?TTE+_jPge)wDBbKbCr5(~#VIsCDA%n%u{8d4u%S?oP`! z%aZc@?W`wV9<%#FNO}FHFLH2x83hAidu-&A5~k^8GC1&mtp&qrnT2Q<#)&{JcZ!;n+|Vo zFXo8bbo+bWfpo6+9p!!J56*j2lwb33pL?Uz@yy-Z>u0h3d?~dicKXI(C-#-UOae6u zKD7L2Z92dE;ej<*-)-MgUB2;{%Y5bajjIl;{nA|2|I6EDzH(LNnRkztU+A_`OziKF znRw-!sMW7l)qIvU|GC@#v*+gb+kp;qFP?mjnQ!v4b>h<}hOuc*ezvZYap&ZM^}6+X zIhm%{HReC$J{+-CQB3eD=TNwRwA;b9rp_?UIt}9f!4}*X`kuxBK%X zbJn_S{_3iT!@M51)8xodonY1Ee+2&1CZs{p4nsYBCvfEMle#-5jQ!2S1eWEoc_T7$pn{T{U zG-%@`FA3&^+SOOQcWG=otED+PjnlR4=XU4YJ8xJ0?3Z7;;&piK<)>2;Do;LL@R47# zu;gUH6T5{U>x&CFMI|se@2Cze{^Pp0KOjn9`o)j@+uLrNY+tFwb@0iYj!TCMHaQ-P z|8(HOtIexi_O7w4(^aVRVF+y6Em-w)t^DK@C4n4APtW=&vi$C2KF_-9_yhM3i_OT` zX=BEJoXv8xs%3NEsf(f+tXE$z`^&67=i9yd8IB`z-AhT_Ue8J}qpl*Wc;zx$yF@xT=S9-dOJZU3Oi@&vDP=tovJS6}YA> zb=mvpeeCV;3!PUaEjN*HR^6-=8uk9p4gv3ibyoszCtsIeX~NH5(BSl9MY`H;R=~|t0=O(}Y`0r%a492BG zLPzvhAJwb6mdcy##dp1>pdv#5o@lzrQOU_lmD2H2o$Rx03I(^9`W2l^zjcL8G@$ig z?dFQ_n}bgYuy9oPKXTRTo|QK5##iHA@$bb}in{TMmfLN*AXK|h>JUeuD+fnN<7SCX zTuk*+yS96GZPl?{?J&=~MO=I!VK|ichAU z(YXKV!;F-0=ghvFK8Nkjdrh4%Q^GrLv8ZCU*{7(4&o)U&lbn;`m$^H4RaOsf9*?2^`^v?6fLO($}x$d3u$7CyP3pPKSdZKxaXo{e} zf_{MNiRyz^i9LHX*Napx44*GqZMpmXq(_X(mIh}T^qVirOiMpAx7m%)xwzrpMR`dkMAmVHw&@-!{WPQc``LB=g<)EZF_uS~-S(ciHL=ci`b5t?Wm7J{SN-~I z>ude^33+?XxH`hLPp;z;Z&6X36)lpa7V{yb@dWS0`V_XH*do>W9re!Yd(@aumS?>Q z&Usm~l_zHZggk?zFFE)e_#S$sPf8=dG$Z$Jq*9L#*#Ht4u5dbs3BXVk6~h6{;5T@nfc==*&si7rAvb zBtH~=>h7E{=kt?=6`z(>ZEoAPKsuyJcjvxK-P~`KjV>BY*fICxqed-(vsE88ADZkf zoVs|=#-*PPZ=QDAq_3$Iyu<0&tOg&4h87t;wv>46^DPq3~jh>z%;w0X3dsN7l1sENMEWGWmMFxsqjH2ruLE zS^slbI&FH5ANAin8NO@A(@y@WN@3~py*m=E$}}RcA1UzOp`V(tjg{%;vIL3S*Ftu1 zHC3Bfl*_M6;m&5=IA>M8flY(My^vEcQjFSm?sdAZtE;r3BX5P8fq-)JueXPsgXPXB zE?)6;>&-1&r%ZN!6(nUg-M4y`!xya@pNgdn3+-HEyFMmHp6o4|tmATTLXr1F`-cy% zMR?0Q8T2w(%-+7-Uh_xxySwJnO;=TGbv~`?jP`z1RQc#z$jKwN=^vJ-y{qS3pE<{E z@2uH7wIjWp?Y*2s&hxaNIMteUp(xcbYr~#3Ynnv(YId(PT_^Ua+&n14ptFo|`$5-< zyTVGPW;b_cZO>cuQGJclu7y(nxAoquTYO=Kyd$`0BbK3MpcU+stGJnm=N6N>U!&jzzD z>OS}ndIg{9J3jk`GGG4|p=iY2rt&qpaHvUW+=petcTNdO@Upq2t6Qd%j&} zj%%#HzbyZ5>*gFe*?C$5XaCn2DbA@o>?G9B#J{ZlfA#nB8;7E`zF!kGm%jW~|Ne3L zww}??J|6koxbAiG=2x|ApNHtn_pxu+&c9nS_x97UrMGX-y1HSZ--*sWsb$Hj znM-{t|3rP%+P(j5*x|NkXSu8tvKxPYPC0w`-yY?uCH=AY-_(3O7<@78W!c_adGaey zm2$q`w$D8|v_9wkd-k&Wy_cD$^3Q&?;$6X#u9tFdI>pwU`GwZ0xj#R#nOpykZ4_u( z_0rEv-zfa_v*6ncGe7=&c;j8z@oOhp`?ceHYM&L|e5iK%@V77XbU70uo>%pR-%0N< z-*2Q?-6WiMdC8&QY4>HqZ!esAIRAFqcX@@?iDf?*-d+Fqbl!SP)4OxaeDBoni<0xJ zE!?5acl`FVAE8Wa`|U36ZW?rC+`1zTXCb4ZnS?x z^pTI1_brY%wuc{g*E%%sQR!xV#?YKIkW%jv^J!>w#d%sdb|4Uk>Uz|PYdHD%jqj|k;k5k@_P0V7qMHO1L^-W^(|NXjL%@FW% z{)LE&$6wyQ;5c7lUE*9>>Tomn^49OwG8+wpZ*{(o%)R}aS93}Z{|O#d#|>$lPOmJX=!CJi~2ziNjY;wi(uI85sQ< z)UK=#s84a8bu|5!EccP!SC?OVt7rGt=IOfvE(S-Y@-BvAwomK7JbCgVwS98I69y5R zHCFc*JinN?GU=|&-%QpI4!frXs#`2Nv@B)`lkURTC#-Ck?rlh)p}T+4+&yPp^|s^7lVS<>?6@$XwzIG;@V za{cQ(`I%z7p8qMh_W7Tz;Y;(5%N@(B*GH8<@Aj*f_&NFlk{Pr7@6})M>8!rS?|3YBv)kK7wcB~_uH}C1 zQ|F&z3k<)~v+8jr$Mi4m^@$lj=6WCIWfAyR^LxkVH$jioDkrZh;hn(V@mf`J@5wE? ztAb`H`d3~5GPBLFI^Zy0f%$_*^{?}!r}FTxDg1YCg8adWG1B&vdgW6hIulfq6F(j= z+kMu9{Ux88)8k`Bv!u_vitG_dvM@bl-oz{-@L+=@Z{wPB=h@mvx{IaLIGO9^(xT?P zp7VgOs4wk}l<$JA8c!Qy?5|psH!NNnnalb2p5cyzS1B% zYY=`Ucy856>z9R+72jEUUaH6YGaqJ34@$f1!!@06!_M3nbrzWlHZp(L26rqzCVP0^ z!Q;GVp43}xfB5pmQ9HgRd!JV`boZ?Jrc$50t9Fhghi}`#Z_{OXX8sO56TBskrW}nB<%~=Yg@WV*pda+ZtgLo|rQ{E{O%qr`{Ww6$EY#a%|f8{A#P7 z^O1M;$4pBt%MH2@?zv+3(r~Hdg0lDgw_g* zezkVGlG`n0c{%av%Hz#_9MjKSS^7K6(k$qMu6B`5olkwDXN|xK*5yGH+7*^BdOo*n zPO+B!os&A2!iUz1{9m?tVnO!0+E+O$e|wBGds5F^F}e4!N9=v(vm~=PdOBxd&5OfE zOzUNmp~dhluW^o9m&7o9qjUswKoiqeRw&$xVg zp}}@h7rVzMD#`OZ>skI;@;T4i@=ZtKghi9$^d|=mS($8|_PwYHxo^YD8v7{fw)Vma z&P)-@)Q5`aV8!E&0ihdrObD-~Bd`E5o#vuYqY-3GbP`^H0}J`MvSi$(?g}Jx>ax zm40-YGPAbu^~~D6e+_Lq&eltwzawSk`RG;TJ9d-p>;71#%tBTmDTf6u}%GUv2S1J{eH?eTh@QaMqSUt0)^WBd#=7++x;wt zkMsPFGOzB+FK^~Z>rK{LH?7`3NI%@yvsq3#Y|m1k#z&QZa!)?E_pS3iXSefV%b8An zd>wv0#gcvYLiu;MC+_`RGt+j@)w0PIrH@uTd2r#-#PYhkC-lE9*EM%eobmJ6_t+J^ ze)VCmp8BttaPqv!%!y}SU+Pi6Wn0gERCEISMy==OLR0rYu%5g*^J3OVoj0ouXV%3P z|A{;sSj4$GG1%ny*N-0?c~)sfOvn7_L9= z^XdDu?=wp^tzBNm|6FrD(e>gP{@go^4rU>bSif1;vDQ!cK6zcYQbC%lOr){=bFrAk zUJ+U6)GrB^T59<$+sW;i@z=6xm1psGyP7-le@@)p(O@EXe|7ib0*Q6$a~_Ec$v5tL zXKkO9KhN^i=ZBk;O?g{1PaNX?G5KnM*Q84hht?Vx$-Jp>@_)PkY+6lK&eQ+QCmE{4 zz@s81;LGkN-(lvM+;d2r(F}aM-Bsz^eUG<&t=)g5Q;ydG?zbyZ@ z*YmHh`y87We(PA}#MM_1e`D%yKl^I=i+=l>&vy^s-7oj=la}C;|6e}H+^cW@f9O>9 zTW*2V;i)lcR?d66bo6p}oeC9FS4-b=FMH~l4ZqHo-}2kHP|oMVqx@Iau`cu9z3bIn zyl#Ef@w?8ZlJBGc|9BDgC(vcD{Q)Ua)8*EpU-ujct$!PLEpPTT>#HI~uUD;G`FMBr zY}JdiXR-H(-v0eHGybIbzUQ(v;&xHy?aiyr^OP%0E-`VPT{&Ng_jzlwpXcN?@1}O0 zHhJ1yr|o@)%VXMXrs+=#XQge>*|zj)XjItQms6)4&D!MQm%Z8KQ*=&lNkRKE-elSS z+8w*unJnV%KmGV!?-HqSv#$U6!AAA_?<-!eJa+O{`EG;lt6%wUUu~zv8_V9J-C)3P z-8R?l__e=2!7fkY+}w3?p48n8UB2$SZ?Aikb6VlFTb917_N~9h@j&^F!|H~or&ZcR z3u<&%%a!#xD&35JS2lmwJ=q=mS3fyWASHV8R`P9`pMP@oYYup?npa(awa&g#OJLPB zJM)W+SI2UH-}Ufgt@DO!A1*H6eaK~f;*K*)hiacMIH|nsN=a?qHaqueAs5rOP3_HE znBpyB@pzUW2hW}RZV%AcKYqYUmiBiwfffiHU{+`Y@3w!dkPi&I}nn$>s!U*Rm6sPVWpZP~$-2Q+V_ z2PrJ6yHjaLLEFSvF@L_qd+Ext(tjJ(LKA}37<%LaTt0c2DHk1Fqn^{p zQeUmYtK)DfW);_LwZdsP76{*0w~D;L>^g_fyCvbfnQn6G`6F2gE2<}JCOn;IEhi$` zUHSe+fWft|>N|NO59J2$HsHU)K51FO1oP-fl@Hg>X6~=-{hK6F?UZ1lSMX#Vi%!-X zW6dBtmAe8Rkj^oZDeLCa=?+dl#cju|HR`YJ({Yv7) zvB#PhrdXffbdG!8hf`0dXmNH;d#;uDU=jZv<&9G6|9V2KLW9q|gO00+OPm){nZN61Z;~{N>nIWlP{AKFdAHV;n zcB}YD*5SV!cyBMXk-DnF$HuCdusyfYr!3Pk-=qM^3Tmj621=pO(2_oq91fxLP3g+BeZ`k3T1)1fFMKdVeE1D!KnD zS9S9($8?8h?>rQ)Fl0QBGQYoB?8aTqIk5{Ki6(BJ)GBJ8A#;?G;l_!1djpoe+Anlr z(_j1h|6Z2fSdz-JOy~H&Q&V)3Ce+`kQOW5L+A%HdebTl^JVNfXXGPyX{fdqAo6D*r zOw60LAEpRt9G`pb@9!tk$L&AptYNWp9ga*kI_@WcXPA;NOpX z9v)lYtn0ljuT}Po_{)3h_qNVEsIYn0f`t255~8)YFfJ&FSbF;i6YB}v)_aAk)}8eB z>8KC6Q~Bvhv*UWJuV)v&V(zkF(a1~LB)a48x|d5%3r$oGKQpaFKx@r!hQ(#s>?K)G z)hBV@c2=Fncw2S(>U`--%xbQs-YP4j1Q+$K*xz=8!Nywp;n&+nJED*A@iqQga#%@W zf8o`-hLe*M(!Uj?P3i7iJ}-iA!|k7YS6}yY34eBdL%oo~R+))Qj&vIQ-JJh>vT)43 zFPj!GD6rC#os=x8+%{v{#vW@&KARVDcW$JecYY`xz+PQ0QOVJN$k@8W*KOltL%X$| zGxUPno_##%e7HC-mHnsLoW#co_7}?^uWich5HI;M$!+(e;H3i5yndoLC2hNBU&si_ z5xn+xdGdXmZC3^BEB)8-PhR05bn^P6s6*^;aLSycMq4xgI(jV-Z< zn>?E1a-?prT^D~qwZgQ8KbiT<#0sv*pOV%ct>I17%?{ito8|vES$Xj+R&#k4@vW&^ z(^$m$HL@Nl2zkGWJ7LYY?qcoXzT+Ckwua%48;<;DS+cfav#Sut{Q9?t&d$>5FEuNi zqPS@9o{)lkBhhOM0vfh|S$o^R@Y^Quqr7*|cV_5p?-z0tG1aLcu{^vR}1^giW`DV8%tk5oo8lq@_7B!BbrawN1fSR_?=xrWsS@7 zoVxb+cV@{7FH{?@c%IVuUm5 z6@E`_YWsU!`b4|5!k#B=P69n$8XVe84;E|@+1z8B5LV{3i?yY6)-l&Y?_&x{jQ!VN zXuG9)DVxkv+?dYBYtO-RqfW)pYHAYqQJpXEZWM+~%*mY)5oP?)Cayke{oLDgPF}F( zh{|(0=fe2P)$;HMu}2FT=O;Ds_vLHvf4@U}di{ZU3~6pT1u5@j*7v?&^80agTXWaXoL6t7^U_aR^2r=BTt5Ba&0Qh>J?*}V53CB-r95_5 zkGYd(#jGPKwC=~&6zl0Tce60+yT=)pT|9B?kk6OGxM|7v#LF`-{C%!>{A>sFMGiNy z_srpkYUf1NpZu}Zs$%km$q(l7Z7P0rPTb7ztK@FImnOxD$DZvwuXF2Dzkq{xAxaoR^a37O;+Q;q6!h==um^Ew^7ElyvGZ+{SD zpS^mygx<4{52kJU;yv-J@kX=LDQ8dpH{P|0dAHrx?rT?WNH{&7eQe8#PaD)yK3Pxe z>Y9DaR@Z?&oPTxXr>Fhg%b99|e=iE2`EunmF4n8AGdmjDQkH2l9$EYH=vSXmp8w}d z!(LkyTk_sD;C?py@+4DzlZJYYJlT_XY=Y#TFWptQgu9kiL;Dk-TG@5IEFHgUwX8)O zrseJPc%-Def6J*|6Zdb{4~Q&Ni^>;gXo}M4y8ZK7VAR_XmeM$#?gY8jAJf*$s_c!7 z+jB$grtwM3FMc5f(vwq4q@7oG=dFEsGO(cXj{ebnt{V^2YyysW8pf1teRtTeJ|!-3 zdH!tvmLx@{2??Kawme$L%f5p3@P<>#TtbU9`g)9ah*qn`Jjz~Juu!^flj-NJ6|&_3aJBl@Q+*Ss|Jdp{Yv-cebXBcWkNPg{cS)RZWuxDh*Q?JhK5%=2 zD6?*tPNm-K0}Be5eYs=px&G%3ZpQXb<7(@A50je*L=FZg&CN7jS(-hm`cxYZg{Hmo(&*SWq#KT!U1*C9*6 zq}UbbZ+q8I+?)4e`T2$4H@!}^bC#~VIC*bNqN>@&8K10!Ca}g<)+yduz1~t)%QI>2 z{ggYi)vN30wQJ*EMbS}km=A6X0shj#<*+(_kEx06hKz!fzswcl=e#E^# zt;94n^hdOysBe(9{?3$(k#j`1ANI99wMV?h zbHJQ9(@VjYco!CN^Po}5`5fU@XML{30XPc zD<>5-i5#20!+EBS-ofsfo7&eHpPXa+qV#ae-QOyaDN9m5-SPZ*?u>cQt2y}vZ#LcN z>33U^wcu(?enG^KHitkyvH3Lu_Y>aF$uH2Ep>j@bS?V11o0a>n>Mp%yGNX6Ro{4_? zjyt+izl+K9emKnRo1gkhd9O|D#dnt(CnnVgUw9*4+is+HqJ>Fu0BLzhjpKeV)zVs7^ z?RV~ykJ~;?nZNPFwW&V&{-rDO4Py>Ie;{A}r|J2pnWsOz*doi-p!JY}ElNz}#hE=E zHTkn{zpxGw3E8w@>X%bts-NEdGX1@M(tA0sjVyZ}Z+q0%-(GL)_22n*o#ngLR(mEM zn3#LxSZJdw>*|F+&K_F3JmL)%8>YnKH#qoL6kFR|@*cBCRH%#4SRHnX! zbN9(J$I4#^UuXTY_e{ROZfJd!7~lTF+NVpE#JzHZrY(FVCGI_cZBqLA(2Y-DRxEny zwSnEC{7(n3d;2D?e>cMB#qV&Qe~-iJOVP)03nM$@^w+*@Yo6U)wsZwc;^%02-UY=7GU7NBF5mQ0J>69@Fi2Qn^M3ywRjF|i zHpUlKq8=&AdhN5=9nyN_W5C;^brb5|ocGIX;9v1DZ=bw*v+;H3_0R9lV>8wN`%yIg zn0SM6ufU_=A2DWgK7MU#kY_x<)&5=kEys#^PhUr})~#gHDm|;P{tL(Im(DBef83U_ z{ySS*_-ykp!$QscQ|UR&g{8H9l9rgUZPuT4WX}J>%k_+=EA!YVgU-Iuy9`;FQNJ}N zdh(rZ8|$vGzhPdyx-3KJNUP1tD=V*_ElSa}oTgQAsj|C6wz4<~WSH#QzmH+@ldRgQF}0tSTKAs}tx^pVTy3&n$m>{C$Lgowj-J;~ znml94jz`B2t$$R$ZTc41mr|1~j&FSU-s0CG-unGBdj5a<+`az3RHbT4PSNDJ+I{s- zN1tE4%75|o`~3TL`~H1@zJHI$j2Gtf{V)Et|8V}R%{LqW856=?V=@*_To-d}rD3?5 z?;{msmoTwvli0r-0z8Fk>sIW3-8#W4i+^^PSM1e)MY^9>JTh0ceYaXa#^TMo%Ndn> zJr?h43)=kpQT^*ypVBYe@^;U&zqNM5f)pQ%2Swu;+kMKmdR*QS&~=T^Bu0PJqK3xP z`xYI&In5?(^`^s9O?E7kj%n+9m+-_U>lgd47iGcv+FH|YWV=3{ezsngKPunMo{otJGb$ zw7$H3%a3*I?`=1oG=1O9@(H=R+jMWFqy7w@Sz+ckoSD?a*tf4YU03WI|BYX?_R_Vx z{vlcKUhdTSz3KJswEqG6D~~Q-TECVrwsq0OnJ>OJy1$gJ+m-mcD%+g7>uz%U8Slk! zeKQu?7J8`!?tCewb@jIG+pzGR7p#u^cBLgaATu~WJJ04ryY;^_Mn5NN$-nx? zZ2rA=r;FX+BhHbEM}wksv&^68teK^{J2ve1ya>LvVSW2v#Z2F|{_yXe$2p7BQv3hZ zPmcVuGRkas=*?@hkH5BY_B_i{RFV6$^>!+^LhXu4CaQ*#X$%zx!WAA{dqO83-cz>k z|5Lr2Q~S6lKNWLKVvtbKp2iwHwP?NOxfwS+DotNLnV84O^zuaeU!^WjPpd4AmG15` zYo@8}{*ZM2&6-<|AE#%t25hhl$qQBOkN&KnkY2B?b@!s4QnYyHyaQII#o^Y9hXOb0 z{7S!SHa}atYG%*9xaSL)o>q0AN?RoNBcoi{>fhSjfQ-aDshbz7X&?D;XFKn?@7ymm zct8JIKfleqcIy$xv>m$(ez4?-oH46pn!QiPwjDg9 zs?UDqQ=7^C&Fnluml9ptBHpZ+r^_eS`1|V%i>=ms%?uW(={0EiKkm~Ftn%i`Z0K1! zbKQikUwyAzUeGfytKV?u!_>`dk6xOVE46>c+!+29*RGbY(~mT)*YJ5OEW+0JK_Sd5 z;N>*G-#=I*b#h+Fy4sY4=grMC40(3M>y1x;zwh19HQ`KmxL$7l@V9zW_4%Ot6M||S zKQnw~fAxv=^x4GCi?+``HcO4^CaaQWnbu3j6?tbrFX;JdYyUgZU_+wrYZHUpT2H1k zHiYdvWH+Tc?Ye5!%Dxw>=cd&wP0O7|=jqg!_5oP!w~rsW);ag8@HeP+(en6R(cU?3qVwcU(-+sp>f6e0 z7yU?M*x_FFH6Y6QkxWd+MziG?*1Wy*V&8Hpt!=gMR%lP&o*kgMFK5-&UAL;_f8>05 zzL7iW{*Q^X?(ADUUE)EpTKA15ubkXY2ODX%&N}qs@>{mMf3>9=^_jU+9~|YFdoI?+ zt;x}xG4b1z-;aKsxRZWyTb#W?{DxhtGp7F8R?i-NSD)m3 zrZX1`y9!@QuI5y872oIkvC%7~AtdN$z|!V`uTnB45qqv}Q8ClX_0K)s`_%I$6T^au zLbn!dc6h|~{^rX_xu{i(T@Tn@+fn9HHLb#iVZWg~%cK4MJ9?OH?y&q=k+if;Ft1rj zwReZZk|4!;+xw3>&Ky&dTvjdljd@Dtzh!q7-U}_?b6UtIBW&?z>-?Zk1FVy*4%T zz%;`G=fzo%^K;Z14sBccnM1$Ns((?(XO+DL%rjrSQE|U|Wb35*i`MB69AhQd=5?ri z>R>O``@+$mtj*Fv@6FbhD_GEo) zE|M+FOG;AgzZLeK{djHxSDA>cLG0GjXA4Yj?%zFWk(5mBoxZ9~jApOCnfnJkW96P= zVQ_7qvMXDpVyEcM8@W$9E9wskd;c|YN$uVy8)W#xw7`IA>9YfJ&1VG?oOf>$Vm>VUy2l?xZRlxLD&b2nwMv)Ra^vka&W#-$mzcXB{Jm1yF8+H{{aejm zhW9n<4ABk&|E4b4bT`WL!j!uWWv6sAr9Vv0kNx=P#@#fARb}_D=`eg*dH3T5^TmH& zFm5u)7xz1Kqc3PjUpBXvP;1rht#?EtUw$&Bq2*9YwsxLarJT^aa<{jJC< zheqRwfLTx8E=jna@?w9vr&Li6)4s02!lX0xJLkARQ>-m>Jd!T1%E{g!a85k({!uHD zC##>RovXDA3YnK!ac+Zx`&0QV#>svuMFmc$csXS?*()D^n8ki_4!25dKzqZBT#G$L z(tL;N93@ixmiF;3Rc}$`+Q{d`eQEPjw3hJ+XS{Apl^x4$9qq{v9oYB~=Y>|EZHFIzdd64gRiN4vHz#8cyf97?N%?=S22Qr4+yIn{<@`Gf6n{p zdqF=X|&@nQ-v2EDH<2N=bmE%GqP$6$?VQUY+@I=UuAWZvRDZ|HS$uKW%DX>0Ews_NI??tJZ_fD;b${3!DWq zUT-*YbguW)#?Ks|V^n5qsmvC7q$@hf*Fpd7$!EW(zmMO4bhBNtpHXn(%8Wxgoo3>l zX>zY8&Qo5*S^G)xcl#B#GJ&ZFZKnE6J+D&Sk$>O#?y2r$TfQ}I%(rKI!nusecjlL0 z!3lZ=z4b>H_}!0PEfOI7KWuiwf{e*0PQHBD_H=JnS?$;C3!9mfb-r3$P-@lq^;ode zpF5sCkcDmI(XLPio73}7oOn=?(8}jGwM(L8>OK_)wZCCwp$iI+ReZH$G5AGLW^e{x$_~-duCDfHI}Q+$Lrm@FEO@VH52?Rdw9>L zwYe%^r>s9T!$S7+;`72>{R@@!_B^(?x?k|zY==&_%(mPf!vfVBuUcUR{npx3T$NsZ zHZ@@zCHPm%u*N2vHwCvEUEX-6X8W0==bh3Y7;ofZ;S72p*#GMl_oFF7GhANWaSoB# z9kW))?%_tYYco|NmIyqopQxqmozQ=FV~ME50TtK$))aF$XXiUROSHla_HA>jjNrSsxIKlt(e3t(n}rwa+cG}Q`S8o~ zx$y+GdVi18=NzN{u{+PQo__4?(bz=(OObK6g0ie1ofUcTtpCLCY=yX>je7Nm+7~}_ zS#gH@r+!UFmBjZS!lt`Uen~Ovu`;qZ_%Cthht`F+p6V&bd&Q-{w*PIrD=hHc;hkhL z%S+FGi9ihFPD*&V5QcEpUP5j*?BB zPuKmE`je*5JW#9<6vL$S?EBa5e+dGWt6Gk%*R+2%VYRIH+eEFo#g9E7*~<22=NY-b zQ_Gx@Ve_B!?8HV*d6&~}*9=}XWJT=bpQ*?>E3o6y&$JWs>{h*ypOSI#wsvgz`trl7 zqWjL&H=VoDwtlsO-h$tS?la4G&3&vP^X}t^uG z8^5!g5FqujJ^Smqz)$t>qIzfFsbyFquQBz_vBli7TONGye3fBPF~{)I<2@pBGvvy= zzooS|i%9;hSnwysYR-loj=4d*ABV*pJE7+ma7WK_cgm;wm7G6a8Y&iR{TFFit>m}- z<9r{d6HK?1uH-XMd%UtCKJqQY>r01TE;zf{`s}ybNa6J4D&^TL7R_INZmL~%rDDHv z;<9s<(Ql9cX5Z0o8JBVU(7j7$&yF3niP&;dt|F>@EBDTqm15n7Pe04M2tIh%d~t5c z@8Sd7hy8i=-Q8J_j%QJ&)z%j*eC%@fP;DZ7=_{^fwwhOuGBJ zpkc!Vt}m`)b!$Gy7HFudUx{c};@0rzs+&3|!(V70+w^`z_675|{%GSjG>}sJ{@l>Suj zSa|tGG|Q6T32DAZm+hFdXO^aB`_b2&*Zf~N+*mfLxztZNCFtnPN&XKi#lOjYv3ykY zaOvL{vt*g~BtLs{iQ8B>PRLk&eUI6{lZVb^%sKP4aV^_^=XqydF#5eJaMRaZCg*J= zBa-@j^VwgIrpRTKE!6jU>HF@VjPJ|T`jZ!)e>?m3b-}jCu1A(?&upcpUfdhK;!Nnh z#vtu*&ZP|>e}$QG%PqHjc}BHmqd}2{|DtG;bavn9RpU`x({DD zFJv2g%ij0fq&#E)Qf}{vS!ugOcXYcO-{oS+ns;WF^bDuUUmcHw7x8mlZAn_Qdri+? zEx{S}`i%lA_OdEf(qB@X_TA`n{qi}5FXQv~3n8p6OldarEB^URzH_<2+R)TkMU#Ka z#4p^!&zb|jO}X&N&URW)lR$Xy%Iyyno4Zoi+5X~D))V_S`_kVKCLcAEml@Heu{)oA z?=b!$W4t9`=KRoKUSTgRWPLAc>YmoWVD$BP#?08=^XnHKT(;?PNovxgEe88|)6H!h z)E)jw80s>s$;do0O#k?}|DkvJO#_z;m7P~#==}7Yn!1<$>JeF~<0MDMrKTeW4kT-7V=?u94Yt#Qfz$FljD^W`GhMX?#V z#TMy5ioVzsrM)YvPiVDBeYZ(z>Ea7JcYe0Xjd^)L!C+7Rq&b^QUj;?0U*tZozok@Z zV!D4=cgck5*WZiX=egJQC0OK`aoL_^qnQ$lFY_uL6JyG^-n>%1i-CRX(}l8mzKx&1 z?PA;ZD(mCATRAV2{ERH?8@T?nb?(qpKc+V0pr0e(lRpnvuaPcG6Qu6f>;`L=nMx(NjMo!2x4PDLv{o@uh zFKL=Z%c^)BJ62J?Tdp~cBY#?pi39WLc6m`#7o{wtj`p+Nn*N2>SsTBLF(1${n09%8 zJ+Gv$;mqH6d+V2R`yF^O&A?m8_(YTbo7&oyy|7)7wi)kYo1GRaEe~1 zKgqGy?C08Li*4CN_XO-TpY`?K<;7Z4v#L+O5>mNbFMjf^v3Q}R_oLUXo2Tm^%T71_MY$-tLbt1TK#U;N4DR_I*uyt-+hi&D$Q4|JZ`pj zM+xsI8F#KOu|2LVo4b?KUKq{gT&`f)EjU477k|%ff6jep7jm(&BzVkIWjfyR;pmsP zI+=jo0$lad#;)gQI)+@ls{J7~Z1e7EmyHYGw;SA^^v|B@PpimZgW5@Nsvf1LUHUI| zVY}2ii}UXS9=}hSB$CRY;xs@rNB7^^CR+D> zy~LNLn;Y5%^B1+)i13K#7W|)j_9(A$o8=*O`*!^O;tG$uZN)dgs%h}N z2~csBoBR5B@r#VY?HywG_dWPv9`&L1K~v^Dot7{iv80Xn_WpRwYCN&?QtR(XU-^%= z*4{UleUcUQF3A01y=LF1)9c+{*VmW+e$<`c6UA}VC+WwdZ+`_vx6eMRe|mj=#n-cM z&#vEIUoU96DE|Ju#lPb}oIh{#wVE~Yq*7|8PSTRo9jy-qyO$KIJk3{Lw`!60t5<1D zgSPriIH12zFzZX$nwbHHZ<6muY{9#d)j6^U3Z%Sh3k~nF3nqX$G215&^s_t=X5fsT!Zn2(pg*c6MXmS*s+MG+&XbI zufK)Q-7fg6;w67b?Ww3||AHfDWE-L{2E|G?Pfjmk{}p)AJwBD| zNhy%2TDK=O6rc?d)N>TP^boRaV^Q+)@5F z$IPNAWp5hunaQWuzsi%oP$=O&vx#46;xTb&`3IL6UB4>UaV=1QTN^f|{aEf6%N=gvm-7?vD_qs*e&5sh zxL}sy%QLfTUa(EH{G2g2pJ|4_Fl${l%ZWQ1R6Jjp9#xrex;5_Jy#t=S3yNR!%k_L z8I!ihvSlo~`%HQZd%(ATJ-&z1VcW`$rmI^4!L<7bNb<}Gt0J@>w@+P>X==B`g^ zu78#%ZdjqY(*Aj@o36r&V(oXErarAOxmqMt5x9`gWAYByM_cMeXVu@GG5N!suX9*- zUz(*KzttpQ$9>;>>t-L4-EWq+W>NDh+mDw%UN?RF@%p)$^R{htKgWM`nvb*3i9Orm z7JOH}5XI8J$%rl7t}9B3>jhiG*B#qeOJWq!JLIwv@!{KfAx z2P~@IY>RYXJ9q2pYqpkCyy9eA>ly0b=f}=q(ACQn@|r7l@^;O(n%DEB%?+lre_O~K zR@ZrG@5QG6sD<0x4(=+7`&{PjxFB5iZKR{x+mINhn7GBg6CN&lc-yWj=6dSP^>ck5 z+|<(Lxj*%*_3Gyr-2bi6Jkas!n`&?M?;96HzVoWiykPS^QSF7p#*j>(KO3f4^M4Hc z@S;9u-;r&5R_xy%e{GBF?WcS9dVbNC)r_Ry+3K$2hR<42cO-`oG#;PR-PxF zTp||~I%BF|;Qx<#lWR`CysI|5Ga#TT!{XlSry)!B);&7B@av|NbDkJW-Ed0C*?zNj zy?oKnzy0~=JadkQo(V{iInV#=yU5JYRlD~vTDW~~I#fS-Qm5QBllT7vUdHac&H2%{ zeD=xpH-7y1`!7+&h_n4BTawj+v(L6HQ|A+!C$`A&O>xSP*xq-SF3mQ#R$`gE+jc3x z$%BKtmtG9MsdwgHhg`Glore$f81yaG3LaK8Rff)zNzguX@X3#iX{Q|(n047Ke7jjr z^6q%c+&1B6m>G#DSXLusgRSAp8fG>&0eN~v;R!?-**4$NtF!LVowG6+}@PQLdOc+V|+*}^~9{<&{$bcNsE{7t*(9&VjE-Ri{V zm4&(W5hbyUk89{N{FuV2Y|k9G=U)Ej*n2;eA8JhOk6h6`Ltpf9(1+#R6a1sEYFkYr%&151Y<7za+Uy?$8W<&wfrT{u7Eev(FoDzU=fe_UMYFcjrGzo&Tg^ zVsozj!_J2~o=^TKn%{$8SXeH%y)nr{FZWfj z=f9s_7u%Dce(H)0Jlp8{+vrPY1*_AyvfX^owkB)#7rjfDcq;Cx-ZN=Ve}Cx3R)*G_ zWoHyUmtFmAlpz;)ev|v>!g-(UW-Re(V>)m8W+(p!_BZKo>h%oNUE@{i#hWgdUoxLopp7U;U%uCA! z(zpB#m^m``$TKK1#?3U~H(Idv<@eRUWKDAzkD0xaozs)cC^m1-t;Emu_W3War_N*) z+1*$jzPWI@jE~lFfwf0X6#uQ#x%PAZ?aFzJl|MXve|t`d7hdKsoq7Iy+XwH= zX$?9_9MXr^9#xz3aZ*i)_mQo(D?+9nG|RR~;p7lE-6wNlxn#`rBhtzZ_OsjWhZWVOX>JZD_uf3={xY^ux0Pse9voHH(3`{ha5+28B=T6#Goro`P4 zeE<5J^)}gxsne#NdGWkq=F~^qn{S_}^!t#vV3$$Q=UWvGvjvnkR6Lj3W|Gl%Nx|g# zQqze)POF)`Z;T2tY;l_!9J{{IJ3sNr*|Kwm)0|b9zST!Mi$^~=S-k#jCs*wCDG%Hx zyL!-}fwTQm*cZ|A z?~2OrbEk5*+<2kyQGfew&c|!J*sY%!v0Yg9YRg&P-8-9e=I(AtE;rhJL~xt<2W_`_ zogK$leV_9+Amv!Z0>f2ri}q9;c={>->w;GKHR0QelZ;Y!NiVp|%XwFtrL1?0u)OA9 zUrxWg)om9nRe~SfU9+`8DRLe6uAWw7yGyo$Au7Kz85ISdCo`7$y7e;G`{rdUmp-3Y zz5U&@Z*KZZYCqo0dzz5FugQGTyrAO5^ckzV*Mv1^OXVp(kW&^o7auuyNMCw4W#Mt(ahSwBkC` z7pn`gm2)RFTzVRl2pxDSS-7gnJ`TH~l+2uWs$x%=*M*d_Vk`G0wL< ztS$5O%Us`mY#nV@IzK+$f2(+SR(J0egOh@eZLQ@JX^aV697_Fb7X?OMciPu0y)GuX z`L2+|wAoL#MD*pvHof}3mGMX)ZznGAYKUm$E)%J^JwX97kyA@;P%zJ@to8o7E z%&4FA$Eszk>D;u(uhiyjdU#mz@v6IiQ^T(YuHt>%uXH|{?fm1nDpCLbJlp!%oYTI1 z&B|AOQo3=$ZZU3wT!PpB{ELn|crkhI?{2pb&EGpdg@&(xb*j|da_Q|`YuA1WOt&!m z{W>r#Z9_=?b6daTpSp#Y>r_OqzP|LFHoM-Vrnk4UZg^Q~d)o(G{{8pu#!kZ{#mO8o zYFd9DK8$^77bmyAEk`BTYY=1a~TMVC`beC^FFOJshF?4S2v ze#?KxJomI$;Ev_uuSe=<-j!Ir$>#Fx+q>NZ?z}VKpEv*imp8j_udcuM@2RJX!~PwA z1@8Q3{l9yv{O`XO4af4hLYJty{wSHYLg{`=)M}G!Jon1K{@uBL-MYsX_g=lQU$<_p z@3#A8Zwt9;_$6799?OnU-kFS0`-CqCnqSD^F*#0|tyUW7={%rqWAJ}cZ zJKiDEr1^!_#Z$*P%o}(=2zy-I-SO`*ZPdG;8%#^S?b_IA2VwyPM&f-NR$?N&Tm1oG+fbti<+%K|9x-I~6)>XRH3bN83XG&pW@;asBiK^LMg) z%~d@6EIwN_+S)P8sY;?_#t-8%*~4*%-t8$oY43dZo_W!=jrG~PH)g+%y=fvhBQ}2O zj*j2EIXV45`fTBHi{#!WtrIp;WzjS~)uQr++rKvKPm6B8<<2z4_iy#q=NmUZHl4U@ z7u)Gge}8KAUo?Ag!}+es9V`B+I`$`I93q7@Utap@{|VDo3Y79^EKs_L3~=b_a0Wrczq<%Aa%j7 zESvAT@9nm~RJT~V{@%5_l@A)925$KBHgr1Q#5%y|boL=R|lf7IX}xk*)6PhmQ(N8**p2|`Sw+!Q=YEu+LY6|N$6t~ z!>9hc9qBhYX3XPD`(9@MO}@I%?&WQ~dv&?<)&8ryCyH}6C9+-V{2ee& zPk`aE9OE6;3xeWdn{hmfvU+lV82tcvaAzoGp8v^4Z&jSbyof zZ?R9u{d&Dpo#RX82b(;1@h?5IFQ#&7h493Q-2Fd&w)lt4iCnfm z6BTU>4*YbpXz`i-`NN^&r6*f;lh|zg_uTmG^npd3Yp3v*oh9{0L^LioMTEWLtvAfB5dpG&Fc}+BK zn>9oHS3l3$IhBd?Ubq}<``sXscj4@Wi7$OlPibvEywLe%-nVmkmJ{3aSCt*#eq%H1 z{M_?*XU?`xuQbdwb{C(vd`S-n>7&_PFx$qW$T!IpzkkMNV~G zyz-sfzoz{zb*!gU56rk@Vd`Tn!8T4$Qj#o!#loM&+v$Gy2)zT}%~v`-OQ+PKM+ow)$8B zCx0a!=KY6ne4Tpx;Cj`+pW7Zx_jTtw@2_*g#)ZXNzR-zf?uIs*HWe?W9bZ@8>n(Z9 zaz1T-xayOG-)Ag&_{?8_eooy|Q@fdrxw5)7DMho^D>^VZGP6oJMD4s?dOSFopIzwX z6@@D<*LyhFnZL*0R;Vc27@c&Xi!|)19Vy zjOEM2e|w6LSEs#t{jk^GbiohCy{b7^<_0iCY&@a3!0}gCV%x>PJ7=w4ml4hEWqFC| zjb&fs$5rpGueqE&Gf8Q)*NaoTzlxM}S*4sg8S^!7QjcTFx%2J21ZQ}~ZGBz!VezpI z%;pE%%yRp~OyXuG%P7n~SYOk9_qtztLb?U>k(cYf9aQC;)NnaxYcux-pQM;SQ$nSL zPr0%Eta`9iBjE@4p9|A%ZceC8(qHpj@d-!F*7fhS%8p%DxwlW`+eFa{h64@nXp|JYv=qvx^RVgK?-BzgqcB#3+HU@s^1zX z>*=;M>UfJ%LRpv6^qU<=4@Mo=(!O*x_3?{KssF#O7dR9mq%O~77o7QKyM(nk!<=7P z0v99QMa5HU=5CBq*?!=rtI4dT()-V>Il3UMM8nFzxa0G)i7$9Pl?rb03)${lb8D5l zO`ONN#8)4SigE?z)3wh3%`~^S*yA$9YWBSMA2cR>zu~bgBH5+W zZR(ZsBO5u^B?v63J+9q)#lWcj&W{ASX+HDzF5Hl$|C)V!vqzATI@1CEORodIwRL1D zCfsbl#9!ZfO8NYbH#;P*t*sFETT@si${uljkNfNX4x@&1%M#bmwdD+|OWDC$Y&dDX z$Fv!<1N!A(to@O(M5X73=#Qr>_DW_4Jba(BA}6-%Tt%{Bfqz20{wGN;%MK%vPbUL* z8=uYTH)RgI^Wt@2#H^r}ZTfj?FL%0GA-5-IDo=I3p``l7zY)`}OU7W*XWD_)!# z^d$bk9^>=nwuR|Ul?UCDL>^4HOUQWrS7F;1o^4Y?x80t4DCW-H-FaG5F7_6Sroa5p z%*rWr?jmnut}M#}m6?t)387pb^9(qiY5n;mbew5UWWdLhT9-<1O7ApTk>ImnU;0#T zw&aPMKYGSZblOt1sWGB{H|NqB-8bt4{M{EV_`IO$+@rPE5?SXiDeK!Kf3sZTRpOjY z_mAbpFHG9=g<;aU@}DP|J*HH5YcoA8>aUG;`eA&6u{h0RtCza--Tj<*SbXwkRhvyv z`JE;0FyZ8%S^wTWzWs$sVU{Frt`-f>y9YEF~qDG{$C1DE=CrKRws$Qkq7z5zEH2R@Y;v%oK5xI_Kr^ z`k_On-C@5Oj^bBe=D!GeTc>bzZr5hE0ar%fk`e~wjZ*6$n|g;+dtt=x`s1; zyewQT!f<-p+_-(|wQH7Kwd8s5`|^u7?)A&AMtz>DxAoV7MQY+9ieg+(ejNIf;n@7V zSpV=b)}J?LOtYK+;v=uy3ESg;zIZOPdZ#ZWW04@_7jJiL={C32$&0-;bdKL;WUk?U z_fdLF24lT+j)U3cTd#F`x34#tTH>;{$1x=MTd#{^f8a!wRT^K~m%a?1z~G!A^iRNM z!@hI1-oB=a>y%vb z!3BaR?3TsYi}E(!PIYsg*#3L#tq?yOc{`=M;(?%nW;H%37DcuKY>Pt6wIkj7*=th--Zss

_v~GpWq?J=@1cVPg znX)b7gT`*2gud*LCl)-K7Qz@FzDHaroUR9`uNs%&=v z-;o5@<;M*Esp7Cnkt>!d8zn?pED${D4=XN;^b0VJ3>|gE|&;CWc zWvbk*^>vkBUmZU#8fn%QB6z#^q|(&pQ~w=!gV&VUh>F|k>299LDw~?IdW%5euiv>Z z0-CK~>ldx)3{C2Kx^R0v{~XEUv(Km3TL{-|+GD2s6@ov0Ezc7Fk+t;td2aWPS0BzwwH(RY|I&kJ<&$ID`PV*d zH28fgt98#2ldx?k?B5C7oVp*I5I*e*OdTKa493>NT|Ftc6y`HuM{bG75=VUb#>v)so`$cFGx6X@{*mpQd&9*1xzB z^q@Fz*7}MQ#~VWmg$s}Jo}E(X_(;iKZe{B2Mmfu!j~;wv_2CJc`S*9nf+^`P$0l!M zoxWHr+Va&y2DkTXs~0U0d^5$U_ETye%k-8_Th4@cF}l@XZt2>>oc}s=Q%6B%%bSQ< zR=EmCSvogQ{JSydd8XEko8i7kk4aih`qgx8qR63*uQgLUQ`rR8*etHO@#;Zi`wdMO z0kJwg9+p7gmG-jr99IicBc6uMiMH@Mx2WV!b9L&TK5ic0PpXqNSU2+j3>293ysBtT zvy0xPlDGSRe?Rc5qF!ola_7{dN!!G#8l&oCl+$@9v(?x3%9L5WZqwyB^CI_*ij43h zujze9&sA!CoGCq9#O=^~eRKVJMXw`+-)nuJnDf{7`z+}>BFC@U?sp1#_h!{JVZq2B z6`i>!L*}2_C4Yx4L0j&(&OxUI&+o^dihmS+(W=&yNyb|;Q6-3LVzG1m)Am3UeT|aP zyd4hjytV&u8MEaYc}MRFcX3IB zu%|oYj_M{QHHeD*kK{FE@J)E2a?~eR>w|Jfin#p50L6Ppoh&biEnVGF z-!x;IZ&Sb1v;KGM6b?wpfAxr!F$6_g*iOJZS1^ zTO_{hWKGGb*)J_KOBY=7_MZBSMbQ1nf|y&cgM*9e*RJ;aaOn)AiR#t^?|f@kabK%? z7`c93|5e%k?i(*#H7BRWDv~B#8`C!?Fitr#k zHuoE+o7p}KZu?jNi^u%$H0!N3k=xhp(mGtFreo_B8+yLx?w`L*zZcHZVHdfY66^Ex z&-P;TqP+ssZG_G<-CWV}^Cu5m^VRqdYh&h56L5YS^l`>+rP7!yy7!wt-#onSK!E%~ zo}{YzUyO7fe7bgtF?8?hvh?ufA6KlqFx9E}dRl{_5RCWOOLY#4QWl6 z=VTOPGBlg)I8k$Y0w<$+Jri@>T9>o#pXR)O{P1Dw%Qt6x&h4u^_MqM>+4!7A;F)tf zCb<;bMc=po{ZrEL%7v7$KM}w7?|PrQH04{+wETdiyPF^W=l74F)*pXu-v6UlH=my; zZTWbTMD~q0ub!YUpMb=ieWn^ zG$~_U>~t9}M(ujLsh|JrteLa^-MwYU|9t=J`)}>#Wf~vO|NRzW^K$p}*|Q(dm+RYZ z^FL$j?mYcJpHxMb{JgEd;7Q@;U8SNLjd9|0-8-9($;F)hJpF#%UmmH0d-k=O*PW2R z{nb?T&%8PR_5c6+9ugSNwClo^T>)N>TMR$UUBiC=U+Tt`TW9WzxPJAipL~Slb(fLr zg6|70f?Xdj3b?BhaO`K=S`mhH-&wj#r?oh4R83Y1wEA!H{?w6ep%b{1*6P0g&Ufln z<(f$k_PXkp{+#+b%1Kf2Q`D;{-OW{N_%i=Jnjj}H=AHNK<*zNZ+Y9vH$=!8dW?((V za$eZ-w^sFYrGI`*+-fWHx!h=a)BO4M_j9jj{yV#BXZ)M`Gx2{m+2(HBy=T&?YteZo z6O}Y)&r9@5d-i&J`(dYzmAkB;=8Nom9+$^e@6FtsCexFg@^g>>UGt*wb8D4F7X~!m zv0BA<>gJ!kugUks%N5lhUHE^sc|T`j@FbO~qW@=2H`o%#6tGp#yXMpV@b&+`dOmP$ z5=^YGjO@{w*7oXWXyoay-x4Rw`Mvxd{BO5$!;_MK8=|a#KNYi*{mj4p_@BdPU+wT* z|M|Po=N;m^|7!l<@~W|Y_tk9zlfExk`*8N(yS(>ye^Pf>Pu^c@wWjR&Tch`PjtCr- zj@^Ct{Q+hp!K%&n4dQpKw{Ohax3`|5{pLKQ{O0r5fB$Z;-##J$(A_ zriyb_bLG0z=Y0EFy>s~?>Gxt@;YIBGlf^$acvEBi6XetvAJ3`}-?b zhrj>qWd7UvXUlud$=25suDiW5&#$ehv3Pr5CX9b}kAl+kekVx*)WUq65K!r>i? zLN&gOvQtVPpL;F;;*FGDvzm~?n>W+fJo)RRAyKvD@$dN9yL7{OfkjV= zm&o}O$9Gt5pK-w@oBRBw$enA7w@3c{TXnjHL(@IED(5QCk^?_x)ZcFSFYeY*@2FQ> z()@Ngqv?e%j$>Y3>zI{vH#2#=r6@&9A34aNx8Y!hK=>Svg@4&unOOm--yxq$5!yRL|X_Bqp_1f#u?sj=Id2%EtzO0|lH^*3Iny zS#V?ix7UAT8~c5Q?2_BZ<%M^#KQeNvGk1i{QXse9d$d^_DHowsrfuu{>4~Oi3 ztlD=dgvr?Sb@IMHpDHzYC#F1n$-wwF^}u&W^94TDY&x65?x)z7ni_sOBD7EcZ>Ebu zW_agP9eLT1kmk$n7QIzr3KUE)s+=z!!}m_NI22J5XdXkZNi@} zqI5rL-3%9z44E|NMuy2+^1|Btr?72z&74?qu3&dWk)^-$yR&!ZdB3xMDDi#U^wRe; zL==B`ie9^tE5@BI@W&;?cfn4%C#}=OYdX2~^;gvIJIyUS+3=}u>WmBy*Gsp*%-foK zU)1(_a&vC+I$I?{m4(5^l1kk!E=e6`Pv@9y63kI~5&2{C4Yn5sA3vJgUY+|Y;9Y{x zt6L76@3noLwEEjpcL~!2Cr(GLEZj6X!Nq||nd#7mY1T`XQa)90zINc``WLod9c4$4 z8BCwRaC5`8RI~c&KmOkI-jMscZMD5j&X(qnFQYHCStlh_Y%-8*3R%eGFZRrJj%bzm z%{iS+Q7N}COrGO@V2#E7#>m1tnP)d&&FYr7J#+eXC>{Sy}${N3#%~6=@`AD`& zZhK&7>#B-pYdWH*CQY_v$u6uv+QBCMCvk12DNhLVGvvE0e`u=Osi(=WW=ubO(nwDB(8SG~ zE-LQnxxM}R%XeFBS;d##UAA#v<;{m|T*e)0!u&tEI3HTfmFg=l|Kqo4&P8!1rFyq} zl`i!K_?Kl$us> zmZmLQeRb*t#VxyRp2p{!UQ_(PL^D44Y%J%I2W{<{CzsvZuQ;R0aN6QEHryRcXKb6h zouTJQ&K;%$i8JyNj^!~H{9gI#kLnKOe4lvQ_!aN`hf`GM%unrzR$(|O z5~>ooK1OGfgF&nH+_&FMzL~T>F;Ec=os+?JQuSfmS98|a2ClB>58f3@5M$+^%E`BR z#Xkj`jeAVl(j*zK8zwUvFr_`+COc#5?Y_e{x3gZp`}N6STv3bN z&Q~x&p>cD)c<}dKEB(H6RkP22I>*dr;f3oK*Drl=IdrG3{GMe)Q{;tXhkGutF>hYt zE1u>#d*Y0P+3YqxZ>B!X+>*I>I>UTZ<~+Zg)UySvSt62oN`%k(%HAEG)9?E3q_!N&!`A^Tj{#?#Ypi!h4ty-T#yb$!Gv z^0H}mq~6Kte?=JmSQo8#@e!ULAj&wS-hS$VNY5utj&stj)<1DLs3W|+^i0GfF~-eO z*Q^Y*r%SZoys=#WA$RY-TBS@O>AgnBuUOugyQ5Z8CBeIB@#AB2rq%v=H>vARmC?*? zO`5*jbY4m>tyQkyf7ku+Uez;c7YjWW78f(72Pn?5-ej@)K*in4^~WquJdm}Ody@aG zZ{D=}mMyPNJN~`6S@N&&rOS7h3*FkKo9twLxAv5Fjm?SfHQL{|ZQOZem(e3x`{uPm z6O_2vo_YM_;fkHtaZcLIEs5>@kBd%uoin$4TyFk3FZA%=vZUv|Ldu5cFH25;CdSwzb^3PWV)ZG4r|zun z6EG3~shKvb-s0>3H_iVRO>Y%v)MPZCKGBF#bNUT&#*X^M;+=gxrdfrXYn_gsP5b!y z)7#(X_wUF2{raqbeUjp@-LubM{9FIwxxw@E`odFQxC)9^PExj2iKmJd9 z7+bRSQj~7}olhL93+ru+s&>mBe}9+9&pS#dCRjM zH7d_-lU~(3JNNNgg}G}kKeBR^IdEcXP~gPWGcr=Tt%2`nZCh<7*vaGa_4bL01A&G!j~X}danFsecqcBeR+JLEabHH!WH;BO%5Ubs>vwNk-F}y` z@YBjy7wS7h(h&*GF zX>-t1IeW|DpX(3!s2S}l;JDxLr-(Uusg;5JmMbY%tWCycKidy1IOU?XneTgV!jf(q zEuXB)DBhTul^)`=Haf)^f2nHvQvRU6U`^x0uTrJTe$!vC(`sLpZn2urp*rLUS5?-_ zxQ~y;r@kt`T6e$hXvdPMv=H4UUfsvncsrKgxn4hcWlG1sSJh$3FKilacq)dUIwH8{ zZ1Cy)+qbX3v0c<-vc~!Sk+a|J_eA~Kb4e?*F8=;pt2v8LOz(W2lfYqcR7T|XT8RKV zGu`^2-xrF-pZ%CMEA1x#(}4AoH8ywO#m)}@-r@D#N@1vrMNWO&_C|AG zL&C|Dz~@H_0))*(TkCf$l)E5p!&bQ^LQ*vKK%W2MbF06q8ppm>|F~L_k+FSp$i$YE zBmRx4se&yG+t%i6+OqtgU4PNsIn&p-npq!h{BpQw%GbI#?cb4n9i+n z8sDaI3Hg0?WfEShAMvg~Uq4fP!kVshz3Y>IoKgwQDT-WMv2{LE_SOl7OBaeHzY98J za=61TtlxjL`_iI_`fVq8W@JySJNLYP`9!btar5`?Ij#`uqPc;iy^A|>neepZMN{2Q z-n={aXRh9--`!5<_bYtSH{QRXW3yI6^2_(w6 zd69G5vYaKxzlD~6dbZm+#Kn2G;6Qg%c(mQrrCYj9!Xx;gX{I*vyL9WAWFDo4V`L3NF?a z{9I(F#k^F)1i|uyxyt@DEhyTmPyB74n+W9MEZ)xiJOULW2Jiiq^Nna{CL2y~; zr>*(lKeFomHtsxh`@M6CSj61w&SP(yq?q3?_l*A+*;;>c-pQNm@73(6`ySe%AiC7Q z=7Lqm(zIzWU!Cu?sa~e0e*U|>(soL}3E1yj|AKhHXtm)XOF0uBDcz2C| z%~#=TXSMZrHS~%>Oe9W}ov+$9r*goS`ZVz=-?SB>By=w7zm)>_CCilbjymm|nt}T1& zwYTQ>mcxBq;WsQ3CLViee#gr6YkqiE<*E(WS{c?=%y=4*FE48({y}*0MAmSxQ@?@= z;uoGgnzrp^`Bc{nwY%4_*V!pd=u-^Zd?!RU=g!B5q{9qrW<2`ol-BrkYl5to-H{3F zq&v@R-rBc5|GVh^TS1zF_iAt7D{8LK>iTiPCL-lLVCZ`ckzv$hhr$*jMzsncDnbo0IWW;^_9 z;y)d}Y{6o4(IR2SN#i(Ur8R*Yu4G8NJYzEQ`!N0W`<9+*^K+a3EXZ87ID6OhB7u<7 zy^HJj^2}TR#!Kb#KQF)D5~k+0w|6i5C*3Lf?CZ6L2KDS08--SX6$;G`FFi6Vx_kqR zd;?#>$E$0Zr2U#?y+zgDz23_p*?gpbhEMGGj-=e#T?_fGD{VJQylFaGkQ_5J@|1e& z<3fi!MU_lDxeT*qPU+t4SiC_?!;F_BU#c#i@9>u+_3M%~PEI<;JgrRHv2^~4EzfM; zY8bDHQ*z*X@+GfK>4bCcogc?*HF=KL_0F0ta`MwRl@%-E8DH98skS-7%$kzwRs41e zXQK*Z%_hs!rzdHz^mx^_(EnW218KA8bIzwPxc~l^U))2hiQcB(dCDR=shfTUEOeU5 zGDo^Q_5BHrRF?R9bw&p!rmwq|pT1sjbdk{#pPe$i52o*E*eauP?xtcMx24AUe=1HB zC-a>aYg_+s``VW?L}uB?*6aT8y)AoT_ww|YOXq!QakMDe>K5hiko|ns<({4i*UnmB z5xp5cvFX(HJz2+QYg$aWcA{jS*YqM2Z7$)6GSBpo39s(V|K@vj>Z3{ZTP+@xtco{_ zHF`Z|na6A1FUmh1ww11aI^%lQ{doc(j?9yYG2hI8^z5SfOP8iH`emJGX5f0oXvvtd z{`TRG+5AeHZ|AdbXl7ay+v~FbS+csNR{V7Je;Ud~7C~&+-mG4<@!(d*875rw{1|t- zFYmcxRc-m|n}a|n<1K+V=6}~cF>S7Ye$t0=&9id79hU`8=*Xp6ZJyD)@$o?plYWUk zn`LaK*XS_D$8GjvWD`VY@^bDwp1URCbHxa0X67c>2TFWC7-)a{8* zqFVh+9^c58_GSI~uhN1qcRpVEtU1edyT*-80*WU;UDZ`{{_>MSXXk4}Q4KD?a6zAi zd=ppuzkYQhtf%0L%B+;re<#T&e|fMymbK^Y&#N0IPyF>sq1peaa741kgVYJWcY7v2 zXk28tsbjBA7Z3mXrMFK^j(n5U+``g#_re2f-3tog9rfF~wpAZEcfvwEWzHw3VjI5W zH=MiXbSg1Fn6vX)RZqh2Rc~5U#9d9|XC?-=S3FpxA9Xs0SJSS#Sd(&=x~be!1SiVvzwGb=1?`{+7hLUZv$*-!uH zulxD(XCm81(-}Wg)f+q{ZeE(l%P7(HO;m5nrrC2I*F076d9(Dy%#__a;?lDA{ErRh zsC6z&d>rA_w_#oX)1RL+KlRsMI^R%}+J8~@Ngm7nmc|43L->V$+J0OnvvXqp;uhXt zZQh&*=Vu(Y*nPU~h`;{ouM2}*1XX_)cl!m!dN4^BORqfQ=PmFwqS&_!-`RybECcRcAxWbK~9{Eltb(bXyQ(p|UB2!FIn@to+SsB4e*Cn+%(7cJR% z;}pl66p6eO21`WOr`B<;Su)|#GO-F{389sb^ry;ns~B}W{pEk?FZBj0eb3GY5#{@wi|TeD=c@3qxg44*%+YA-k#P#{`ANB_F30mlN~n`%PJ zjTRg#Qws|p+h zT%!EGM4(Mr*}Cc8C+c-L&Yh}_Unh2S(H`TdGhVY_voy%h-+c4T*{w6q$E_;JXcT$U z%k4hZveTDg#$(APkyB;gUGmGbckljbBP;sOTeNz|FXPxyrmazx)5Kri@eAX8?iv&_ zIhDWBBOojA*f}At))i`J1NLl8G*4OVVYFO(DPQ1Hj$PsQ?Q<67TzY1Cp~Un~s>q2DNmeFLyIh{)@0-}mxi@`1 zdbd(8;K27Pv$FW~naR_hx6BTpTzja_`-h6b`uBV4ZmM}(t{nGl_cE`^@GupbuTa(+d>=!w_&3jTF@L$QZ*fzIW_vsvkgBiQi6Wrdvm3(!+ zpt{~caek=l2i5og4qslFsydm2`?AhciwEJoTPEBNk}aC{Xm*m+D>e&k`!x620!say8<-!Qa!*nfvUI&Pi>9 zZ1#lkuiYm1(|X1AIwu;=&Wa4l*&>|sK}d8#-G5(*H?Ao|#3*&l<85G`2{@A-`rO#xu$rm#=O6~r| zR<$dvE&rC!j;~L*aVwr>;6M1Bsp-MY&8q~HruXVGeq-D-y+xnVkn!>KZTgId7*9{H zG+;c-cyGG9A>$vGr(G4X)7_02J(9w^PNW(?@SjUVR|7(6lvj&CR0%Yvw9){NfVm z;BI-Lq+RcPK%?p3iGov2eIL$Tn-Jr3k)>zCm6oiii#Z#I&Ed?7cjAyx zWy?M&@95lgOyc&v1)UNzlvtRB>#j{mcM0&kJx`crMgxb_u_GN95)bxVoVoav+Jon_ z6b&rVROD0V^E95K^F<-XGR@L_{Q6dwqFz0#vEeR{0&|wq&a*a_jtz=kw%w)^F7h$`@>zMyT_LH{Mmb~3 zs#)v`rNJ|iwa57_5={_cGp?F+uPRuhN-;33GrTPr&t&_P9>^xL2p%y;d@=X_; z@Rg|zGmXFKn=v-EwHkW1UFXi>T<9Pm%))dhKTJpUM)<`>Kdb7GNzdw^-Cv)7eRlWm zqoI!_7=LV@{eR1ix3kWky7=$wdHFK?xHn?Ej~(5XXjZ>7?(Lm!@w|URa$N?o-PN4x z?$3^kABnE})2e&u%R|=UZl8Yr4oicw|C2s)zev)LueY83e@kS1tci6w=hV82m(SME z;<&id;N?-`_=k&k#DzgT*{h%{+Ye`?XQ2It-85w<>K65)x~>b zYPSD-px12dfB3=Fxa1i}+3q{_+P+)(TmH_{r;EZi#{c{1zk~bV$$bsAtAF3VeO-hGtz zx%+qh_TAt9=AXX$`{tkBU!U!|xy8BV`se*;{#*V3XS7X!*%i^W;1lYb-U!!h;helZ zM_a}=NoqxYG;`dJpZ%}Hv)Rl4W>)_%>-L}idTRRl_?d<0mT^k-UwNk;6m#VAHMWeF z1+_twXFuKj+xPK$vGTQMB`dl=t~zD$ue4y=oJsx>E7}U`14YappFegv@X8VMqhXiS zcjn$-^0>ul;yIBe{^`*VmtVa3s>AqFL>5E!ny`eDRZi|mw?guPfSXN)L@s-sl$-iNJf5a|_>_2LAE?@SJ zaoy{OlicEGuop_*n7;ha?Zcrw(*O1M-0uF^{9x{@@>A}0>T_R}dp-Vh@1X75@Aik7 zw-s_TyUou^f2M3*JZIOhNpp(7o?RgpD3ie66MEgtT<6%0$8C?auP#&y+Ewqmr1E=V zu4IxU`*-`pP4DvF9${N6yl%2);hdt%m{Y2ji;gtwr7t>Sr|cypzi8XiBCm?`O#Y`t zyn12;cFdl!G|6FN;+zEuXOw?&zdC!&+2Y&{>6LtsRTSLXjz109d+p&r4RQJE>gUS~ z3>8D%4@B&dHLm@+_Q#3TcRZ!ta_i$))dx3we7|}B+>3AiRTZC>vxXaZ{}YQ5OkFM; zZ?uRZ^4htK8qv}@tDXx#EZus?)UKv@^Pb!LZvNY~!2jls?^_e~Lu8fzYDGFOoX0(l zxvi{~eQV|aZ-2j@mAtyLg?F-SWAmdjk=WJe%Vu;6tkUFLwK-$k`*r_H-D)S@+Hs<> zY#Y+TbeR+$zLN)o}@_%zl&s#wLUOCq2Om)X>A~Pi1Uod zqYpAI5^3Je7Hu=T`3~zaK6jMJ%G5Wq;eHY~-|q3vr%QyMJjuJOr*rA@RIk(LkFOI> z_&Iq}j-8#=DHF?+??g9qw->90PT?xcp6vXoY^%Vc?Y#9leXKVA=UZR??$4in_9vgy z%mp4De#P5_1CA|Ln7c~#=cg};*Gh{w$LM}f-}E#pX>MlTIN;Z@5oYW=O+TyHzyOlN`p z?YsMa$ZW_D_}Ub+Ui0^w^Xp3g$K}l`|K5G}>+GXhg})1T-}&aer*DmK_WF4)(**xI z_nqJm@6Hn~k(hY*>9drrr5hZ4cue_L%4hwl_-dwj<C-f}z7H8je&Tn#nI3P&s0BS=n zPnH@581LyyX}0q*pPOgZoiv;00z;;}NVIX-@np+MbIP{W*YWFbQk^;N>9Lt_k{Twu z$WD6xY3||vDTO8C4_~x%GyN}gQS#Cda&ZkQm=Yj$R!+|@Mxj&n+Qj`nyZe{TpZe(A zG;>}FO=Gh^_j~Pf+vaaO_P_q!vqwLtJ`sHCq2;+~_HA3;yk{48|9JZP^y=9s^Udw! z64rnDZth(5pQpYz<^Qk57L?oYVSqysZ#OdeQEHZn6ePAjs0yHq?OuxU%msas7J zJ|?Oi+3%Kkc*q|SmfhMC=d(;@;>X(uIvyNyDQ#ck__o@)i8aM2mFM_*fxLLQh#txXM@DE&1dd>s+btIZta=0`pAEUPN8$o#-1)e`g{F0{p+XQuPes> zyuP{QXU+BEm@bMpeZ8U0e~NZ_GVW^RVY0 zzjR@(DI-C8OrB(`U%XK?xNU+vv5?oJVuiud)Hb3fNBSz?;udlfmK28InjN7jeE z_Lcp#bHaprmLhgTH>NuF6z4J-?(Hs2msYAy2|u^u%FD3S&Ad-07{0x@m*GnHmv^r_ zx2lxpzIQy-eSP23tBd0*oXuZ#^~&QDBySfv!ZF=*TYM$ z?%iEDqu}Gj0G5NIbALS9?#4H}GB=z_kUh8SY|%Tp={x&33TxNLyj~Nrc2nfrYKOZ8 z>;F%l8h1d0fA1-+^{;YL-B!%?2wh(KEaj8v9`C<4NBsotk1o@(w&myXyffjNtWI62 zv{$W?;L;QpjxQVn0n@fPept)d)%7v#@6=-RbO}L$w>x%w1}YxRKD~5jaG}-g)YrGR zUgPH0%Fx}+KYPt8-U^{-pX-HLe3S(GWwqx&U0Of+n%Q=-v)1A}j&sE*cjPSZIHKFV z;!=m^wF>q5>8q{Q%R7JN6Owt)qHW%*D{-txXhH09q#%u zjC;lGGWQknhJJjIzFYScdwDuzX3Od0rLlLWzO0&fK4x;^L|KJ)mgl`mt^3dAw0NzE ze)snbquiCzZ>v%mU0O_tHHr@?8B;mctDWmoGJzGkdToW{6Qy7f>~#iFs$;>?083jPxWTc^%7HBk&y5suO6l zZqC^H)NcQOxfyN>2e++BV~cTd_{vcz$i=8|=BldU3D=Y>lQxE^_$=GDuKMAE!Ub|n z2B}KT^}?qcJL6fHp2f&%7*tEVV&vGw+%-9N_U`Vmgr({n`HjZhM_iP2qE9SRdf=L5 zQE`dmVneu3itaj($HH<_$A9px2=L}BvR`20TH@Z&pC!BK!j4MGC39q}ojx#4(`$M$ zsY2nz3%lZvucrtsa%4Fp7NKyI{WVAP*1~Yln5P;39`z+rm-FU*OJCx~u%NU} zQZvkwm)U6UeI|EDcz$Qq%$ux+ zAsiM{OzL>DYgpeR_O6xnoC9Gcp6KTEzYnRS!KRwsy`~zF5osXWiIQpilre9 z!nIioZG_Yem3-o!iG7%1dgqAZrJyCUO4U-?AEpZ>2Qe5;^7t58P+!s17|++9tGZu- z@8$Hv4>_Mc>MX3dv&H{j-l+p+##@#(JQodA=2V56x4lox@@_^<9tSPh+-<$LA&7Zk}pfoLH&!_eb@T zr}g8y9@KxzOU7 zEMI*N?_{2bOTrf(n|bcoj5yXqjuMMP-s-n=$#)%n`hB`Sv!<8uk(F{EeUrzN_b%JAg(?Dzjp9yn)E^h}(wQueMZ3x-GM7zU zmsoZt&3xLHV^v|5&y*XJvdq%l4|+&k(e>SR`kJ80C&7#_Mk}fx-0JOV zi+%fFNp1FALFpb@dA6lCY+hD!Q-1g?$l+P+e6s!+|NN5DNx3gHWMAo|ukDy%=zVEQ zQlG)w&||;f)K#Q<@yUnmIxl&7+7*czvHSOM$#;9G`v07@n`4nrnWgN*=N(5kpEkdK z{k#*G;E^(q&jvGDFYjJ2A-(>FgR7iu4bvO{$#RWRvUhCWO`N2_ICI;Qc?w@{Gkrc& z{VV?4EEZe8#CrAxHzl>taV&Qa_MPw|_tUYOc8g5$`VZSVlT_xMzI{3EvGeA)=QOI> zS)R#!X<=@fd}j)e_B?jRBONl2)pkB#HgWUEg*V#_m=8sFeUNl;o+o1RkC*MaNbnfHsEwc6^UwTCi?uxw!$$4B|!8t=~kjh~yk*Kc~QGou!xDR^P-Z}OCYwuIm^F3O5T5V$XmWM^Gn_>3)Zq131AGfteCB$KIQX2RqymgJ#*?}E*G&IqN6fj-uO z6B>HeSPBo@iuQhN-eKa|{$loK&WT#JqLG3o8m7F{QtAWWReLwFJjprK>oMQeVu8cT zXx4o_Z?pwB*4>Sq=(5d}Bm3^%Z~8ZaKYjW6sCO^JW|7Lke}!(PQEUFJezop{cmlhf zy>h16=kNTHc`x6|7CxP?oA>9ves@vm57GEo#s6=P|2(|wlTGHGslA>@3bgN3&J*Vk zZ7Dw{aCMoYcK9@v?F(EP1DTk(_@{q%XKbiHc{%j3i&H$SP@Crd9rE9-*>Wdyd?9OaL>*E-opGd+ZRT7S67Yugy!*Zt9Jo^Oz|CjGy|&+B#_GC6JGMX1tsmBJ5x>{^|LVOg zt2x^vW=vC2Z+}s_VdfI4CAKPMd|rNkcW{`tg)z_VRoS~kLdIZ%;chl5*KOZh_I);7 zR{MJYn#H_EdN+5k^jrT`Z}E!x3OROH{%#Y>PzcX4X_>vYe$md_+i zQ?#w6HZHxym|0;WAjLFi!b$y&h7!^uHBOHf-gt0$<3{=K+tf@G=WW$`#n3(D=8D-? zB@d6+vG20aFyB|a-7vGh*5AQ@#U z(fNJ@3HdMFZ!Vk{KW;H8xhCWGkCg2T*b^6RxayW-?0F|}&5G6}FS-3u?`1BUUX5Z& zJ0$(R&tfZEr`?6+)qA%uX`F7`eSI3Aj76{3jhqFK_*k=>ro8yt_21su=xqJ8&o>I$ z+@dy}+ZCsN_c43*ee1e{w`;8HHe@cGDRl7gO7%^_5!J8TI~|8!^Wu37&3)=wE-&u(1-C3YGLj>Ev)bCUjh_%Y?dokyNC zW-_)u%hT*uwF^F@qg+4Zri`HR=6Z`Xu@1ve?+=`LQ!&F*tSx}QLoK;&^2a25rda8g z-^>&J?d1iMpD{l&p21%b!Q7!ykfc%{v~IKdae+@|nyN>q|2**AUVcLSGv@z~ejb>& z_ILeRcO98Y?f*>YpBCOLXu2dS>CH(~#jg?*C;hut&wQ3;2{Tt}UP^Jv^w&O&Dw7{Z zY1Utje%*g(o8bR<`;#W>UtAa$x3A7 z=hlZMUzOfDZaH1yDC6?09gmVNKF?-%zxXIkP4nW! zx3}ReU9!05;Pj_o#O`liJLT_68AUGRH`4$3_v*)fuRk65|NOdnfBv9)8gUc|M&g+Jh?;t@71dtEC0*>i#h%C>z9@#QBM-*of3Jz_^DI3 zMo*G&aAny3-4VxDa&*0wsz32ylU8_J#`dGFR}S`z8*$ILbXO|t>pdZRA<+z_9~+!5 zjaNA-vBMqzTj`cT%Qp-2CJTKjOH0_T_-Wy{%w)73L+qbipeig~A3@CbRts-_O z+Hs3~;h|*@D|5T^?u%T_Xf_=wUKf1|~ zc>PLj?()5>w3Qy(#&xe+Rrtnwm+H1}=R-HF-Tmp86N~)IYlf21ccSjysE==(w{4kh zT4DBdj*u6E;_2H;ZqImKn|*CzY)3%ix+^87^_%}}-2Lg^Cf0UA%@0x<@|}N|9lh@8 z_Qk_(lFk&arT5D|%Wm%w&z$kv;;`5Sg@YHJrfO%27O(DH)4KA6_+qymtl!&(D>alK zwpG8C^;=qGG{+`=$FVn3muJNtD0n-q{-_gszVgCtVI~c`80*B%mo2s4{kGt*ckH%1 zzjj}DQIeFh_inzve*PtXiSC)ZUU>!0diB^(dT@jYuWdS@hhc**EH&DIqW-m z#Pev3nKEz(WNvkk4U>M{v}#jDcx>)TnI12WmJXVrf^%Q2Jl?`F*#%M4$1Ef9?j zGcOG;+djKHRcNKc#}fss4qLn{eaN+RxhBITtCr^9s}>hs7kOg&^~>@@I$mvNo=;w? z@EPCD{=L-wZ^;Ui)$vAGznzR(a5d@5Gj0Q}m3;fYlyKahvm)ox;tzgtOMmY0j%Z+r z^-B5Rex4It5msJb4?qAFZ=aUXMWxnvmV|TbN#^n za1v|WOiqIm$-{o9p7AZTyZE51;ZmeQ^XyJ(Clwi%^?c7CJkPG%YS>dz|KME51GY}d z*@YEWW{CK7WKc?86H`o|)Z9%%X{r#H1DSU_YPf2f*Zdi2kNOEht|4rMZ1?$e->3@0F z%f?i@t11ZC4AfPSdOZB69TLS)in5YP0U`W{X)3?(;maKd}G*@#oA$q3_=DwT)qh zpAOfD%60kp$Q*e5&8hc8)*i>hZob>fG?fy~%anefKfCJZj@LB-tB)D~zr=mhY2FCwZ7DTdS9g^p^sv!48% zy07y6?LvcfD?jY|^Xo=m{XmRx%nV%zCgx{?ZK2$Bd^LW1g1G(tdBE zJooPWw6cO(@z;LmKA*YD$4S!vz?Y6P|L3bF88Er08C`$uW&PFf*(H;YolarLSN;`T z(6>OKo8|8RKQjcooa+Vo(>l(aYq4ZnTzEThO0mL4QFFO4XXmLl9oMJF$J%}0XvNxF zIpeMsk7vsENrxwh`0`BZ*7?Ml@idC(a;MVyh)fOk`{L6~zMSX%7-D{`pl%L%Yw|v3%bgNC@gZD*d6*p_K?-n_&yz`)jy|%eVi_Ozt z9mbPNJ%#2^l@?+CUYo%BXujKDvE*Y`(ni;mxOOf3Gx3o{%)JRd8~M4XPt45i(>p42 z*S%_sVeiTx-+wg~-+3Vr7jUID_I~{*iN_0C*fw=qp53VR`5PbGqaJyut@9**+MV9B z@^&6a*{?ULHhxPE_Rdthvv6m3Pj1%P$Gj>`8{+5p-b@xP_nPbfHBgp0B4uUJLG5#k z#H%9|*Di}G+|lYwy6So6qSue;tq6S;0oSMq9H&+InW@8?0KtBaS<^-IZ?d)5>^`MX)y)bz9u z-W{DAqmOyMJFDI}DWg_Pf0>_KSaBI8pn|-uw@oa)ynU zrZ4yy>gwCBVtl7z#kw=4cN?P4%X8VxGxSaV$RKyKUWPMt@N(0MhY}{Srpxj@j*EXd{H(8MxAu!q z$9OtRD?W<$I#zM@w{K=^*|OMk$@_<`H78^bo?fY6zGPFKBTHSG?i`~-g6*{*=kVLC zzHfLaW@pXhX7TCu8;f>YR-_acbF3@5a(Fpo56^~viIQRdD2DWA?T< zTZi{=Jebb^%&8Ix%-_3hR?LUWg|;<1C(m5EdBO1Z`Xo-T88ul#*gjrH1*cHAQ89nbUk zRLV?s?B@KRlJir2$8r97nNBTQK~Dnjzj|}$5a%_U`pORD4T|%{{Ig|G<&?!$zPJ(g zgHQ4qD&9ey-(h>Y_k&4a=TaAv&fgNH@e;_XvyWzmZkS5-tYYK+_T5O zZXq+9seQr>r#~}KC~x7Jtnt_0$9h@%!(&%^=dSfQw)x1x#jBt1tqJ(#d2o@v{FM6t z&xC4DK34xx^PBt5w5Y$6mWOZT5;hF&x*w$W!F=QA$vz36DrP#o?{hX#Id8STCPK>~ z>_Va3|2H8CJaUdxj5qH)YH-9Y#&CK_kfwN`hC}c{Hm7sGKZUnHF7RbFdvGiNgT4EH zUfT_>C0QH?L*$*dmV}2$ga?~Snr=Nh-$JCNzF}LFaK^T2%$+t$ECEM>^EIDWPerE9z2Q-O;+$uk zQP_@)x$=AK&Rs2*wziFvzH|G9u++BL*qfi&I$d+j47Pk}I14MYB()v8bp&-M`CIBTwS^SY^;xAL~#Sf%b6FJpHr?9B>B=Tlc3w^UvV zeLVH5%Db)IKeWSM-1$1SsjqZ$2=n>f>!V~|)lIBitotIHA@RY!4IA~3?tJ*_L{1CC0O)zS}k5?mty;syinw;_B?!RIAO; z4oP|)KhT_ew=zrOdPsf1p4A%JKYxo0)CxRTUA+2A;?l2rzSI=}{DfuzS_^M%xYnI&Y5A3qn zB2okkw;$^>Yk4mzH)U(;ZPDm+wa0lHXIj)Bs#y5hAoN#_n~W`Y$CD>I2ToTA9-CP6 zq2kq^k2$5w6w0pX?73Ev_U^URkB?$8zw%FUoflt`dQz8b*PqQfyY~L9(Qd7S zn=Tlywwbngo{w>z8cV}`m0;VNlSgN4xvBKxFXzfn3$`vsb0=W*G&Fw)4hJIH07-A*F;{kZMVPdlfM_4-KzWT zc3FIswI~0Y`;Gi-7Onpldhv(M^rY>pf2auUoc-J^bN!-|)zkLn`!=f|(frY;Um0A~ z;+ih7m@)3*^Q{Np_wkfRnfSbuYz>K$-+yB9o3g#!x#hL=B2YCkj6HzV0jMB99AQt}-wt12&t zg>z%t?51B^=au}nY3_=1ZrMzmn*VIua;p9O$(PqP9;O}MpH=0OePx4Ni%_%>|Bc}40mF~)~W5=woUcWd)5z23m@)u<0*W!sQ6jy zxi-g7FBN3Mt3EEaU*)s;rQjyN-{)mY*X!Cw@GN@2dc9zw%&9`r`!lbpe~XeAJiR$9 z=SzUuN8`7$XX=fT4)bL3I6S(>mA|UppuC}e;_JUEc#j?qpmtHlcLh92!|SLGZ4aLWbBq&?)2hx)G^l| zmM8gtZ+cn3|7%8NKoq~|lslW7W#*bK``@*GMa#cw^Q^L7R&LYvlk%uuQM@h7b7#f|ME-=QmWAEDC(O1oH ze^Ni(InUhH{mhf5)}2q(D`)ihx7W92b55+7ckZ-L0@weHyD9aj-maX*X}V7QP_(7~ zY==UYil5imQl^M&SH5l0vS*DtE zey^G~sl`F##icKI(naoEyFK6MaK34ozR5dQ!8htV%$GU-pK9;3DL*o|>G`rv@3{U{ zr6vBAy}Lnk)8pK(NsNnK^EGe!alUPQWhy4$*tW%D#$kazPxgJMJZ`Q!w)D*5Gjn4+ zEzckQ$A3R2(rUU(9HSm$Qe!8^eKmWf~liuFvH}z~uj-Jfj zv*X&bXS?g~e@NiTuV?$TbXv3jwl}gOfgh|T_vCK5lbn&YV4_&ajESCB6D(X!Lh}OB zC%=x2)X972*FLAyW!A^q-;+MMiB42n%Tki09WzgB+LW6maXMW$uZU0YeH5eUcWKp+ z^)os=X3J>a(U|4#%W3|W-naG-s|+=N>)g5 za<@nK0jH&h)I6vB3Y%=eRAiN+>A$Z#z(GVPC|tQx_+|K_kPk0BX5H0t*_l%|+xPg! zcP2q0vKdT2)HYq#*xqN)Smgb0^;@<}N9!-X`NscZxek z*>C@KfdW2uy3fpa%3rFlPh%BP?tK6G(V@S3?KQz$jjH#bSdbn)Nu`XHA-2!|>LG(K zj`cfVc4yr#d-q98uQJHe`&`qZwouoXL7TP1_de74BR1{hgxOQ~oqSz0Yx>PYd@OR$ zjlbX9$YA7l^NOn2&y+_&H*3T6Vm20})!hDB5>mIX-B9n3Lhf3BhAaD)&fZhM%<53X ztfXU;R|`qay1TRe=-D%ynhfuEE|$LcLv326Js7EIJ`Z)XGWa+vss5qI#pNaGwObyo3k%()BN44k1ueGg||9PC@;Kt^sL%m z=O$K;_IfVS15t{sN-Vh-?mkjyZm!hS_^;r1c88C|Jhi%tGvQYqLv=m(&M@c`P!wq8 zJjU416lmt!=(UCj z?v~kCXFN4nbyJb?g7T$pE(=x7c^|(B;cx3|Ja9rREx(>gVdK?1+itB)muhajYU%01 zly_>G%Js`j3Z9$nwUgg>YWc)gMvF6^4Tt9zFvTb)eA=?((s47>D!-7lrSX3P)*N)X zaf{K1LD(}Yv{N@JGv~b9%C2joo?>&ZCEq$T|MUD^Hx5sDbA0Z#AMHXN2W*~%+KVjx zcvYy$?o{$2#-Q7GBI|SF_HR7dkm?k+Ea`EDWx@or431xZa&2 z$eeR(f#~f?iW?gFY%A~R#-!WNo9phvEh3k1wxzPaR@$-dL0R#-f|jSw39JtryHqyr zOUSY?JfU=5!ex)=mKV7KAN86!+;um*3Co%0CCv`(=?G{vSXuY`_KNx=S0CRxb>$BC z%j+|A8afRwGhX=KBFA*&a4Pq5_lY~1VwJWFJr&>F{!&Tp^oIEfyC16f3qCX2vglW& zsEL)*DW=VjIJiqvyC;3y7Ii&>!y@2syUC|*_rJc`apL;BsxwM;Y4xr(-+P3a3*YYyuGCQ!o4RzPGIzFDYK2A%wEyR z_})B1;^Dv96LfpJ-)UBtef#$4QDjd_(~L#BzY|0hV;Q@@OxyB4RYG^B@9)JzZ%hou z9@hVw>((mT{NPARsd&I7TSv{iyi-=R?6PhM`hGxGZKD3GFDd>$xALa-w|gv6SDEPE zvgGNDc|X7Y&Cj&c7fLrX-#Tn%lKXp2(m`2LE8TikC3#WoBSP~s$vD> z74~oY6WCbSX-+!ik|oyl_jZk>z2KYEqDo4(vtAdhz4gLKK7;?WQow+<=R}#-U+P?036CKCk!k&VdOVHY$F2?c`+Py~%TG=+VPFmY<5}IoZwqq)gf+ zQ2M55!;PoCoSz@uILb0}iorvDwa16{3ZCq~d1Xu7y;QduW-R{;X6ZH8*ZXK^s{CjV z&U-v9XZz8wCbM^J;gvD8?UQ=w{;aigiQ&(E4V}+s_B}VB*&Xb-+*xslq?hTWi)*C3 zubx$zt)DbekN0?$==>ykF8M7+=NkL8jy%l@+ZE$cV-%bI^hT<~bhQg?YFpfExY@mr z2o#+7A-1AtN>Y7NO?O9&&5Qku-Rdj<{Fr9?MDKC*k9eznsbu6dpqZy(NKyF>fQ z>-v@7t_Q!>e--jO;+Ia@iddJaJ=cmt)l!!Gh+OQ|cy3zP)V9dvrFc_1-xbx`riV@Q zu8CiC4iwt!C47JJ)xcxhH)YTP;mEQkaG~CL5XdFv7%wzUFxG~=U`}Fm%Ho5Atw$5e2^v~TzT{AAQ7uE%`MeA;S^_ywqHN*SjGp2r3XFIpq_1U^# zdOhrKNm41Ck>DI3L4dG_K) z{F|-e8||yu93Fn3w&&X4`wffNMV&qO)lSIkfY4k0&b>7%BFn#dbKR}CnkH1D^o?uIdq!3x(Iy%8+0$h{G6jAA+jdu3Z2uCCt^;}j>|42& z(ssLaZIJU|Ts`r^TVD316Fv4z@kLAUy((xstpBlh=cBowZ@48s{-5acCWT)h?~ps6 zFpqNtS6ENX-)928uXBqJ1SNmHP(RI8;maylg*Vs3-n2VQO_Z3BZGW!m?RDD+nR~Xe z{^sS2tZhF0^k@IhgbO`k&u{B3J1sYTZ=;!i@U%VOu5!g^&$%vty&>oS%6SJb@ax>! ztiR`(nOhT!^1&Or%l7BUuo=hv_S@UE-OW3{_U-9&F|oo8h9|GTE-22PI{9$j@xwc6 z>$hI&7kDmkkKz7fYdM*Q&nFce#3yMNb1W|Fj_U|=e6x`Co|@LeOYa|^ars)^KZE6g zW%AnHtUGpeX?i~XKJoaXLoRPkSNzZ`yOm`3aoZN1ef^s^FB7=-`O551{ARiPegyXz z{kK#XJ~2gf^3PLu*601!ys^>b3-90WiGtB3Yi~{u(%O=?Ki6l~4BeZYs?Um9v!WF? zG6)@FWU~{rZCI@(dAQm2FnfBCKpQauE*A$$>`R0VoS^u&*Ipt1We9IE$ z)Yr-QMEh=ge{A#KwsQBij~@8jp8LS}f5!H5E&ekNyU!NS=&NAATd%k5)sl#hGuB$( zJQ=sjGp+XSt*9<>8J0*M+eZ#+W{*Q`x0Ts^PPg|z{_o|Fh|;t7@+Ne9u4BGoEAt>_ z^|bxwJx+)Cx4cRJci`ZH32!#?zrKI-<(Z}Df4SeNowYP#*GnC1$EdTfJ(@no@H(yj zvHU$xIHT~AXHmV%8#l^JE%UMcUvH;m@A#;!%&MPFdUAg?n@s#q!8WZ!9{^ zpsd0zi{t2zJ^G=rZhib0r|NZISLf!Ym8m0G3mrYxk`SrtV2`1Mlp;JQN zHu>wnI=_MQhRTYJcPlf3#1dC=-LT62`CFrNX=o9{+q09IqL(I4Yi8|sj^)aa(T=ab z``O_1rsnG}$_iUY~PVLTK z3$4Q%zd~*YoP28*62~IAK0j^aR^9c-3njA7si^H}{l^rRt@QF>@0?!Q9ci{IKN5aA za8{)?{p@62!Ss;BTuoYM@BX{Va~Qb0MYvKU>Qy$Kdmk!u_sgwW$vT!|wKo^O^Ha%p zm8r=)zAE?Todp*-PmpbS z+A#0Jy+c#xTxjr{)SdtD$Ey#rTkG!5t194q&Ry9>nk7S}ns6{Vk=->q^l zN?W$_nwH@2P3N>?do=E^UHIgh=ZDRbRbOJP?tYHBbFAwFe_MUb`iwIr>(s)g9p$^= z$MuqZ+un7#$urJxSe?E+^RPj@x_QSNKlU7phSk$_w?y)BEWejy8)+-r(8<4AHd{b@ z?mzh{?|LPF?)klLVeitDt12zC|eY-d|T0%;YNlc9E<7LO)|$ zln7s!ITw3@(}#|tS8S^B9t&I7=LNiG5$ZC3q4DwJL?MGkHl@vC&Bj6U7py|Xy00~+ zyw8%|=D7Co{m|DRy0`Lq^C?YRx?goo<;rr8wS}<@syDa<*}u`)y)@Hofh0%0H1Fc2 zb(*GSCECpED-9QjM_-wFGOci>zNq8T#Hc0nk1#L1eZH3e%kJ1YjEVl=E`EOdTGr&# zEt{`Nijmt`-_6mP?{>WO`l(2Zp0;gTUZ$<>w6@znW4DQhDr>Qdl!k;yW%55> zh0;5wQCi%aEq-P^dl|bUK~5jebA8%ec8yv^N~s#^fDqUwHgt$)*!tJk$G}r{0%Xcd_MJYrnfN`22K znH$Zm-{uzgi|d%!^>5$KJ!Df~wNj!()_a?Tg#Ie_d+CLeHXCMZD2C;`-$`2O5L~k) zN{jRKg0qui99~_TXs@|b;qA0DOa@-f(MfJo4Hr)q3g$odQg)s9vqG81Hvb2~Gk!Q9 z&t5n|j`PHlxxSkeRw&(#xS{lQE?b>daLk99NmOf@Tqu_)ne(i168Dq{4TitF=cUve);c|In)vj~=`zLFw<4dN37uw_IKk~^Pwed8 zGhN0!8B!dVWA{ux@>8v=NzD85&sTqp>zgeM#S@g*>AHMmL7stKQR@s!R1;59Ob{`}5Mzjdg7s3z}vg zFwm~-xt_r?x#zQf#Eu)6BV7dT{f*}cWW|(CKC(Egy_O`iG4!Z?+_i}-zN#z^`=nh}?ySg^)C-CRbI%ld^fYT zcWcx4&P%>l=kqtGP2@_lxxa{kU!ywdvc^P{n)|cd6ndZ6^W`V+|D&K3zH7%u zzIrY8*9GTuety%hpCI$Zt<4Syxo7PXL;;q=jwx-n|jnmsEg*2WF%vyShQ)|r;?<~J2$CQVD0p(?XOy_#k=T1+^F%k+fOA4Fz zqW8zg&4t^=^i;LA*lZbW)-1fIber|0S?fxHnYN2`JZety?p8I+3Ea)N_`e%Zbg=K# zDF>RaZRmZTYofhXqVHy%-0kP}do3PsT-2Pn;-buRZKht19ZbI}&);-53}Z;Sllaj$ zYRe;u{K}?+syxN-ZT159f>u;|8t`j0b(p6xb-tLl^YrA(~4)k;g+>~@pbI+7T(*6n`R@CP_ zUHE9_rnf#7o|)4xvJ_>{?0<4s=BLE`!33ynKtFzl-C+b!F^kBKOZzk$3P@~+Q{JCG?{bwsBt(Yx-Le!)r|gNTQ!KU;!6^6O8lKizkGZsyDe>%;La zXVT`}InMhhS@7yiG0)|Rzsu4t_r%XW;-ok;G>3JM$?cV^Y$U?r3OI_O~*3a5D;p3~4 zo$CDwQ~fT_^iaQ6-p6cc&m|;rbZfpNi+lNLz3I<$qW5;Lly>D)vi10~#GS3;Rr~in zmnAK>AJDUod&=GUe&TwSvw6!Kj^#fW+bqbDdsA4;`tIiZL??B+ng!EDb?pIrf_{d9?!m-Kh|6K z{N7o6SM27Q98>}%@F)P6D~wd=jf9?73< zwY-b|CZ3=4=yvV*>l-f1vx;u$dAwOQ{@DHJfA%YSEPA2D{$7Z|^K$b!p|?y2J#>=p zty`<`Pu4B7-g#nz=6d^=>)i7+7QA6q&^ySX_jk`;7X2R=Rj%zRzNq=7bwmGk##=o1 zTJ*PFEGiIj3upC_I;-;DwD995J^cxHbk6lW`+MQwOMQjA9tI^XJJbKHY}u2*)b#mX zW>b*|E7!4Z(~vE8^A8wWrZrER`fyP-`=R_rrgJV;uWgvWiGi_Ro|`{4YU8GRr>f=o zm|tt;s4WfETemBA{%zxfzcqeX@4b0fa2xLiuPy8u(%j5yX&;Q@Rvy3MvYwygX-6j; zd)M28jaNUN(JH+#nc+=^FjsLld)+m4*S)2U+aKIhwfnk`n^m4$FaF(wS-#W!esHSp z^1icMY_HC;3ygX1J0}Z17RDxLN(@#ZRfv;yfzrslhqN7^QV{Ql8o-Dk(7!EV2*J zGi~SCvy@L`?R$3zaid@R1rOZWpuu%8=GV9XNq@xEqr}xA3#p4z6LUeV{G=={V>9FF ztE(CJBqy2O`r$ci#o4Q8CB?#bpRImBTRwizu3bOAzLG!Bb=L*L`{G_P^So|1D1L)21z7 z?T>xBjE= zoZPg@fA|Y#6uZhFuS>Y(JB8s;f~H(RZ^Bc?#s_hmmpnQXzF?(b$Rd}&j1R-s1TmcG z4a+P%%C`Ooukh=TxeMlVeBZ2)cs%%Xn3{<9#2X(Cel5xtKTvyQYWbn!dY-lfo+GEP zPp&y|r#?M?ZS`{L0)MB?U)-MSWS(0xm2r`;ng8aKnh{QWR%v_UV%_g&#&~^e`SE=>xBvX;;M44OGXC=a^@2ew=B{MQz52cQ`GUV* zTW;*DUl`-G;;2_^(u@PMwO1+sw7-yUFZ*DPE&qn@=2MgWCVqDfwpMr`VCuYkE7NLA z*XB*kEJrc}^OQ6`YPqWy@i{#Do?ln7Tk39qdv%|K(9TlbcT&@=zZnP^=3MLj623uf zy~OM7?A<##^Gx2J^f7tOE)?YBbK=FvD@F;=edDIYoUUg-)MD~s8i#9Vf5$s^^)o@r zkCZQky^%-`<@vcoJT}3pdTr%lOWE5Mwb5_B*N8lhOiPhGwe!V+K&Siculw$Au=^x! zcEa*Vv|D`V2X&_7%8h4RR?qx=W6P~XlU+Nu{M^7Qr&#}jt=M|0viJGNuE(D$=9h2s zJ^VDFIsFc!URhyXec*xriE6zKi_Yym-u72znwU)XGS=_@Mbpkb)v=v!{7RLxane$Y z(jcErxh|`HHm}-Kc2B>nth?efN4Mp<8`oX=_sun#eeGWN`%|gS>H3DgS4)JZmXwF4 zKK!&@$ZO3j?yi!!#JM&ZUWU8&B)=9as&t>;yYfP`yOD(blgVi%)e-eOdJV%CGCiGQ zsQoL+zvnRH`9s&$KXC5Ya(Cl_jP$2H*Zcmgn8Ei*)3D@4q=UQvYn4e7q8%Ua9pt;u zcf{|;-#D372accd?!MNt+P*3J>%Gg|_1so%t7bKHa|03!L(HwIn*)=;@}2&P->BG%ude*T}I(c=g?s6oKkUj}P_N zS$aLz@14EyUKgKG>eNk@yt zTuL6sn+nf2xf*!&DnH%p+;pPl_9C6|ZERV2w;#=7O3vXvob_HMRL?5p$Fz<$(`Lts zeU;)Z6??SWeBxKU}%FVx%b3XXqoCt%tsfV6> zMHnxL5wVyiX3F^0TJO!SN3-Uv>oK;p@OWoZwqf^`NJgjKDH`>Si~m16;@f%fSf)Hz zRan_WT7#0BPioErJAD*I?lpPKTpsn2`gD$YX^ItA|!o;`iElAG20)nv<~{~kO$ zuRmkKDDCD`MGoUL3@U9ftTNqxDB()O9kmpV-LxJE9IboqT{@1k2VQx;3R|9mbL>!D1CcE$7$m-f6>P z?A~o*m%6@gYH-J7$8Buv2GeC%O}wbCIPdMGv}BEqPh_JGmYj1t9z1bz)$zrt^%uWC zW&XwUaJGTmed$Ay41Rxkr_Y(Mx>|0MesgQ}%m&xfU#zMa1uor}<9ali*?;=ta$||k z;Djs2*4BKMcb=?fV>0C5^)b$Yj25ddAX}gnUV42spk(Fw#1g4({=l* zv0W<7*j@hmwxFBlbAtSPmptv=@yDp2``MRz1JT}|$uqQ;JUH>Xbo;SRy=UoV4TZl} zzUPZ&KDHuTz2^7b?$aKbN21z4OLLSe#09LFTD|C@+d0;p!_xN)Zckl*|HPKNe2c4( zZA|W%!n2EY{R(Rl_jiw6E^0<_zAZ6mQtdK(%kE{N?RWacOHH=4GeW{QmXt6n+fT~a zzU)>Dqei{6@X4z#$5a=|{A~T^u~I|$HdnLLVh-iEc?(3}$T;}t=DTye)MW9T;F=tF zwqo}-%c9(0L2OcbNgZcAA2G#>7VL_@vg!3ow#e!?Rtndfr_L8Vt#SB>(US>1j92@r zJ(f+qz-;Yj^xML%OYHcpSv6&^7EPH~*vHX0;jH>x#<_=@>TQfq~jpCU{=GA z$up-I*;<6GS(dMns_=1LqWuO*tCNcuR+ktBgySeY z%d3$#dd}arxnrhoN9BR03&x6Udg%wVH4Ykl2x$Kdi z?9u7hUC;CWyOQyAuBUtbss55DMK5FHzG-uo%l?=-Z~u=YCl)n@y$@Lb`4rc(2QDHt z@wY6MZ@gc$sz5IE;N0>_8xOQBmQPccJn1KAuv0-~<*|c0AuWwBj$VCGUA?zv>Cw=H zZkE0odR3EU9~Wip*lkn&N43|l^SZU%w)t<$9;~@(>{nWF&w169?*c5}e530HK8NlJ zS$Vmn!y!Gl;kZp-;KNz#lCBw_IQv&HmT%4EV@6pvQXzLU&%6w0SYh}0%I}r;EPpF% zXBk*O5tI7#qMS8qbKmVXZx<-t;>$|*lYVt{-?Nt4h3`z>-{z`QVGr<&$~{uxT5?`R z)67Y3P0#roS5k_Oq)k(AJZALZxSV=eXZ;QqReN=ThZPY^?!24Odm%D0*ww>lz4(kd zdmc{86e?~L^**({NYsAG;cnk6CTpcWt8X;cOtQCj+!U{ReDV%nS$(UnJHUOqa?rgTrpe$#^=+N|so-yhv-x#g5wnM!||>%|tUPmcrY@0l-g zH2LmR|7?ZVCz-6v>RL@=_4{UK*mEvYb?xMRIqT~RRGS@ogi3rlH1*;MnNvm`$LI#gR;uxjSvE8)j#3f^h9lLyX-dPo+YkHT=*!D_Zc%dymjnyvTS0;P- z3IrK}#O+nLnJvq$HvE-_}znd|b}()xRa-nxrlt{(jo zdTg4!`q`J?FDF{m+W)PebNf+zUVCL+;50iO{|yy?qGVq^S1Uf+EA;xsA*;E5an>8$ zEbA<`PZw$UeaGr4|M8M6u|oD#ma^T`ii|CG{5h1{Gwb9+8-?$(nzPF9=PW;W-O=IG zRl#!aM^Ao>b9{Je6tCD{8eGL%E9)2V;CF2KjOX@l0ny^Dx4-?I6eQ&#BK#nC_JQ!i zQ!1A(zO>i)BOj%jIeq%_ZbnT;1IS_hzq%PM>)pk>OT`x-zN=_e^Hrzq|3yW+6%nnT zbL2yk4uz~d{PEA5>*-8{D$lqeo zdoFavA{GvZc19n)SnCj*;?lgyZGrEe9X$4jyV>^g6Xq|U0-m0HXw`RE$+P0##@SIS zCnFf8w1lNr=y30=Z2WM3UNL`0>C#OPw(r`T%<$&`^Y*@N^-q^NKfU(L_t&e4tNS0G z^7^*X{mwVt#$%0*+iT0e?Y_n*s8+3E-o$`Onb-uvgof$0}M{=XiW z!;rniaf{uaKeNoT_NBbJ^Z4K0D^u>|?w%-}|06H;=xn#Bio-uj+ox(;Wi-lLrSSZm zDEI4#hIobv|LLn%KekkVuHX2_PWDsE>}6T+wNxC$Sno4TZDiT>;`90awW=8vi+Iip zCNU|nm%L}~w@B!zl5|yiJHhG3HugkI<>#+7_?9*1NzbnMr1Rp~w0As;cXjLg@BTFE zEs?yj_IC8c+BbKvKkkf9zkNsf--pi?3TvD71>Wjd=x*=+;N@{?)!n%`li=N1M(mR&w;XJp#FP@_Nx*l_a%Ur!xF^NH-bynTCX}{~=d7EGTn!oe-rB2;T)rx-uatW(Mz&}E*#8wReRUOrn&#nqL$kI>p%XU zbYl9QZ8qAb*Yi8xamMAIpVRB@S2pGTF8fej|83K`4Q({Gtojl?S?sR$j?2m?Hk{aV zm*vL99h2&#TrDzPo?MAst90Y8gQcwY@l%KHmRT4!v~*mp-4^g&D=2Y}W$pjGMwc(WCujNq&C97C(U$xHvP%&#auhX1$ zJ$%a7d&(M4tZ3-dx+|gl?AIMn+wwR@-Tifiy&UQrog&0E>Me7tJPs>eww!C$bx5S_ zQlgaldqppqrpE<)XP91l-c^!5txIBaSkwK5!pwZr?6oT!6aPJ%mwtF|c9*Y^o7VpW zwyB-_mtW0q(mmYVzv5L)^HuRgVk3=49dkE2x~nqUo$U|b$=Na`VZpA?l50)w zJ4P`a{q$9q=c>iE96b|r^^00Mi@q?kdn%uwq|;NCXu9w)7q8S|$*G48ir#Nut-_jX z`ZF?&?cB89zXxKU@d(~Knm2vn1V)K^pRQtQOYknb$$r#eRpEX}lO+V0_w^TQy2GSX=DG5#3X1^IsdZRxzJaeY-|eSGd(4t~R_Hv%#?$3*tDt}*D7 zm2(L1u{Df-_byT7zR<*s$|E1w-QDq=M^^7!&9wVx8uw4QJF89hvFU72hXc{mY)(D1 zKNbEa+WzI)`46)$+bmptbOv9HY}b|~**l@S9x=)n9v(R-*=HfzY+EEQ@Z)B=eZl^! z@=cc;S{^noz+tXLZOub@Nbm+khe|Lg5wPz>( zKYDY=NM!GoRf1nEUnO2XJHfn2f5(Kqt7QLnzFGVE(C!75avPY9ci&@Bx^+OO@WJ}a z7JPB{^b+pKXa#v~k(Eq{d1a<|ZF&8vyW1n?aaC>2IT&cnG$Te;zldXZf%vS|5sa)R zm#o>Rd8aSG^uYAaR-NjJ7EBy>j(KWIh=zT!*!4jzqkUrdbki8usyVYJKAdCNW%1!K zr&8<9HMe>SWct=!=H0$&%5k&ljyuY17Eff&U)p``#!fMd^o= zas4ZazOL{{6>ACQDXG&A2ffI9Q*!X6)}Nw1`VJ>cek6*BMH{6|Q)IAy&-ftwz2mpc zR6+Hwg4V}+4EL%`dziC#y`2*`<&5s{crC%i(6~un3!Wcv)>%A-QRVfrNyjzCKJet- z*}@um#FJU!zrs=n2?a}u)NdWSD;@uAQqVZOapBSWJN*G7Y@TfoqRVoWId9K8WF*XP ze<3pKjIwR&rwQ)Y7G)}ZkL^`DPN}cP32_gW$kU>*X;dU_eSagPZ?vz>ae<5 zxr!!zb<>tOGOC?WDwZ+>!JeBu| znjB3N=qWBgUmkkcg=xD-h=%N)uwI9w+cck7IX|}eT6^@)xrR+r2lnWcEp%D@>7!h} zvhb>Hv)}nKz5P)=Z?VgZi>a5dv_5YB8(GY=>D>GG#@cWEym-DuFyFX#)IWQDQ2MQv zD{`i)E&IU!=Kl$08J3rpmH|`sybLxP9o@-cusSK^M^lWEn7Z?q+k$tE-zswl#D>rL z!}dUCS6Y_zu0tD67v=Jw$coK=WcGHh5yPApehUI81w52k5%niCZ0Ut`zXr|eKc+IO z)|WeMDp?!ApT?J*uc)Q6CAi$BVfTkT&eiPO)tA2#Xg@dY{PpnG*+o5{Z`6wIbu8oj zn#g-S?pi_9Ge?mW)unTkK8Z?ZbX6XImYVrKW%kLR=ktWu=eaZ=y8bR?M+no!tXIr0 z9$$Ku?;R56;6tGb{btMsS`MJBQ0=ViutC!5%YJ(Jm3gp@@uwRtsN<~+0)~M zkkR%JZ+B0;F(F}jR{NDg!S<7LvSb`&-v>mhE;OqX+Rc=3;$-^4y|HUoOq;{G!299y zg}*YUvDzEmwyL+On7Cw_k)Q9yK=yz4te1;-hkH*CnIu^_BmX4pub(%rCv8)4e!uy5 z5X+9Ow&oFm1^4zBSN=~mjPMdHHk4S+n74b<#&s$D-=1w)XV80BvfESX7-uTOt2i&g z!)tW5Jr%fl@?KHtfvXw?XLrnIwy^F#G1cjlB=75(m0q)bcGigb)LVpao9o?q^Hn=z z*}8*KoOu!VM4n#zoMgum$}L=YvsbNtVND1t>(O01^k;TeG3;Nbvul<;@6?>j4C}wO z?3y?E3ftD7a=a?Dt~}woy5?um+e_^iHvQT8<(o(Oq1bKpKdo|`Ys+rL9AjkSGZQs% z@-xz%sajaDKP@%r=1HSTmh&a1OU__)uAjJ)c}MQTuA-W<_Phh%IEJssT4SF-Et~qhUEM+U;PbwQobEKWqUnA zgY%5bPNvjrH)ZF2x0g#i>K%M+W&Y2rY-vk2@Oa$Jc=O4aU%B<*9Z@#HC-=%3+`@zY zPhPHEKSPu0{sAt&9MKp5p6I;h`eT-KZPMjSvzY&!O`i4j>=Mrz$J45fr8xfVn|-tH z=dx)&JljK-NclAJ32&`y5?ZvlPpjvh*ZQ!f3qAL^*2~U((Ya>F_NRGGaUow0_&n=+ zRe9*)%1FV3wdNY}$0u?=7SVMRQv2bS+4}XST)6?;FIB7hf5rxV(Q>%Yg!+wjW+LJnfz$> zx?QFEN3trvZ~dgnn;EkPd?tnULeSX6y`wI_~1e~lJcWC&h7aOu!|JlX8ove@5;2X(6%mK;G=V zXXfs{a&Z5`i9Y9xzdz$#$7t&m%<{bNzL!JC@ALXQHl~TR{18gvU&we|{>vuSi*_dt z?fubPFMVeF**&_p7fxG#|7&3I=Hl-)C+yEoDACM&{&B+d&Q_cK9Tw|m#_PVh^V3Rj z$)zt7-zcw`$(Hx`%gypT58Rh$?(&FrTE6~+V(3ZPTdJjxCfW(D2~pwL_kZcFds#-y z->2MT-=Gp%#3<3XYyIk$TbVb`-rLEeq;_Yfu+G)nQ{!wk>RTjx9_F38kZzdny84UR z;bkfp+oex<`_x~Y!LU_4eDZ|r{2N#`Hm#h#Mc`2Ttk(;At6dgMS>MGmOYiRzi|pO= z&;O1%B-Hcx#`#iy{+CsnGnHNnD+zqr&a%k8>-rzIlDdscrx(t%DJ{_t_n&+PIrz@mSNWxbVL+0K0D_uhAR>)%?qhJ8nl-oqs!={1)G zta)z<3(v4vWTI1d{ZPw<>w$A_+!Z%^(x1M0^{U6R>iV3Qd1AL+5IK1&Jmz@V7>YRm3Rd2D4e)L)9%<(>1yG@QWv@Jg$ zUUp`+v&?Mm%-gq*JMw9Shpw>bJ0ucwD0^&9>Ib*GSNVOTOJ^Uyt!kX*xWe?q>FHDa z?;ku7@H_SUG4r$55vPwX(g+U?eD~*YVsP2)Ozxnee|KF#oYHudJxw%w}|IA=V}e^qn6(shQjYIKp)geOejdK8qIn%=LelDFb!Ii7TJ z&D&6>4OdtF36|h-yBVE6Wt*F(0oPrd!D;87QFdqaJ3|&o{7yoY-Mxv?yt_S_nz|S{*x%lm);$1us*7;!nPX6cC|1V5iy{YQ`GH&ikhTZ1A5!*Gl z|H~6F54_AZe@;`aBlw*63QG&PmdEMm+)_kwecd+C`+U;FD69>~gVa}7AZ z@>>0tgE=?Y*d-2239d^%Fh{)cuhYzbs?t;p@JC6*rsqG3k2C z%X9JOmH&UG{Cqn}=bC``?^}FQ8?xS?W#acpSi4mX z*(RKSR2d%iJ!#6ABr;t zZj+z4Yt_v|enoy_>#xU!ihUG|X#SXRHeUFeLz_X6OAG6x+na80zrBgWs%&=Mqm5^_ zKfE^CETeSAt6TiJv+MPYF5AEH+Ryk;^Sedh%87wG4^*mmBx|MD2wk1FVXYm{k@wd2 z+=Z8>Rz7rRuiCB!)5l@OGGVJ2Fr@|N*&J0yT7#2PUeSBio&r+Qx9;@6ID<< zy(pf+`uoBA)z8{z|Gj+q#k7A%Ck9;D!y-{^sS=*Z5ftEZW|M{SuN<-W_3KZz=$cGn zY^t~syXuGclEXTTMx7fhrv6{{@i6D58jfe{ndVG<@o$#yQm3}FFKVV1B(n;dTYQW@ zQ>f(XymZlx7{`>y8W+x8{GPr*r_)jD^$o? zzn)8~d~-v}lTorL~K!Q5T&dW9Geet-j=-7 zbv~#6TbHsM+wJ>4oVn|9WMn_0gfxc*z7Gh4x=OEGcT($w_sRVIBd-pAtw`|>|UyD8cp z_V0>f(DwVWbcZyi*i33t;GxTn`V~jKyfyyTPTK2XcFC;G z=3hkQ@7ldfG#l4G{?oE3_|$Aoo=lglvNMYfcluU-skeH-@oa;sdJx{WD)@>}N?SPWH3B5L{ewtS)w9OY?!2IKcznX9diS^K>UY zZ4mr&Gq2`|=wZJKB8oyEI92vPG~>II>+x(~%#06nY9}7;uD?+}eU&cXlLc(~ zJr*xgCZ3RVyA@L(tK#EB)y>^c z#FBYDlpH&aFK86=WxQax$uYfM^Hw~M56{ytBC9{Ad&R6+F>gw3dVOLdM?2fX(_ELo zsT@n(rYRiee4eYvJ*}=Ljy?0rjGM)$ouYc#b-pRSubz|p@Km%!QS>r(_wX`Imb;m?k^kBuzv zHqMgzr8&`Yql=W*qZ7|oM#sH-v|z*4qGva1rNz}(ujsY*tN;8t%XHf5_~l1jZLdjg zSkQVwVqMd&$>IysmE5Ux8;A@P26Z`h0ZeEa6u*^SrLr zFF)OuqB=W6kw;@mW=x5k`KgIUg^T~#q&6LCQSx$r=IRU5C{hsWKLd{Lw+Hjo3}6JGZ3=<;r{i#(bMdlYrHn=KU&SL?wApVItAxWp&YkTH z|FbsS>1vwu+t6_4ER7ctFX}f>^?GH#{vn4zE8DiJG~VY5U3X?U&g}0zY0-K`^4~-M ztAB3qXYSc|SY-OIrHoqB4^%U1PxoKOD8Se`Jz*K60^`)_jmsDn>gy&iF*`RYWwY&` zUmru?ObPz!W;gw_);DDxZ&zsst#2OE|N5`!Gygoz`PV*v|F1WvZu%xAKc9Oq=Kj3G z!o9a^Z3)uo6|4+|4}TP@pnOQZTH_(4)0gb662O ze|yWFI)?|D_rs6Z{#>}~{f?h)%fh~ifB4_{JfQfr$b3x>=hWLr#i!3aw|G6v*WKms z@5NO}?|r6qmeIN+Ku@n!#Yczruxx2#2^Fp*->$!ITPwbO9MB$F7kfBODO4cWt8 zwbu<&Hto3~FirgQ-_|}R@yViTe#^3d%_`KAoWOo^(WmAwH@`jgOS`&;GwpVVTKI|9 z(2EP-bjMy4kIC-XK4+Tzio4>!qcbP0KcO|hn3MPT%Q^==-4!u=lb#BKbyHfdBz5%#n-O(tH0bSQNK;b@b+R0)!!Ev?S1@c|Gt{7BAy09 z$7Xoko~d}dhCe|1?Ww%mVVhJv9+~ZuHxn*-{a%}KGMm8!M>f}cU*Br3>FM?Oa^b-3 z!!93l&Lrl%ZS;J9;7Q}r%a+F0w}h8$*_7Mxj$bQuTDSR%75%k08S8y68zjuGmpQYl zEHbBd+sPnNbxFyq@Bgngv(8{S+v)qxoWG@tfqC9>EywMf?(bpd-sf~=Muhh7lbsB^ zx=UZ3&xn}Z)bC;6#J1bY^rOnH*%scDd3Vf;kUV{8e`@%J`P@dHnZqvJkZWIh8x#i1$Z#>wPnIxw4J#6uh}F zo_n?Ha$kIW@uW-ZBj3;0d=~Hf;HmGw!faddq*+IH7R~m#d1H4@QX+f$qa)jAuS`|1 zFVr?Wm^goLN@9H4_teKTp2?M5t}jy3=lVbWa)suF_}-_%&y#20Y@L0ssNk~1>1^@6 zocpFeD#}^pz`9Q+%b}5p*}U^IL)hskD^c5!2YVEMt=j2jH?!d1@%i;8wW0;Te=p*{ za&otGX7w?~tqf(R7SD4xK39{;(bbx~;#A8+$MyAg{~yT~ly*M*ecC+UKjg#KH=ifJ zc*?x!0Z)U;*Eg01jrF|D-%_uio!i8sEyEx!a50a4;{Pg{O(i{E$IXtfQ0d(|S$V;) z1y{P>MPG2eFiB+l&CRRkKiz1&+DqD_;Zfz(nk*@Qt-3|EZ-l=Knp~6F)4TQVlCa}( zi+26{7_m;WQo3IKo8|L;dBtpL_Hpm_C+yqL+PnPeyV^NvFY}el4Wbr&H9k1GI+lOU zf{ZsI-)8RJvohuK-H`I>se4y*aXwXC!Y+MzdU@*aBePmM_v}!+b@N8U@__wr68kwP zF2C!*Hu=Iy_X|HN)8ZS~UrG8VZE;gVplDVv`?D(tC%)Nc@wVEeO|m{syTs+2K$P67 zzwV2jT?1`QL@6L0** zPk3$RFWxdo-}CZ>vxy4aiR!YcQ|g;Uegy6cWk1M!h($eUBl}%$KEJiRCcj=j+$}mU z@Afl=p3|Oxw`KCrNmQElve_th=6|0<8xE!k9s3me|~;!1gXk{iVvq^cbnw*e7Nxzk1|^YHz4?+BGb?a-O&K&=VC2D^JTlMwj-!pDeTL zHD^v*_I9^`JI_YX+u;@>-bYs|*4z|-JJ&__^BFe|y$Dk*?L0igKvX7f z%Z|gfk7_PxIouKx`Y^@k@4W2AixjRF@?YrK{c3sE@!grJM^*fd-Q=ejZmG08$Ruz(1cd zAJ)~Va<&Cx5~{o1I=pv4~jB)#Ci4q5Ngz@O`FZQ zn|tA{>{(x)=3G-+vEYlq_f67SNBlQsMTlRy;X6m?TH51>dnIoy$q(GmQeCivS@GU7 z-{aQDH@{p3y)LfpgR`a69h^Jhe&2%%9^nZNKTM%&RuG-aA7xsv&Un#8JbG60m zXXB&C)h54qEWhuHa&mjC#>gfVXWA*$tY)crzIJ{=wIU!l%kp z7uDB`WNwL4ttg(hS|OSza_y$cQ_rh@cY@c(y z#c2MGTdO7*%zbx0xHDH``^waSYqEObu?Y=RY^Sp<=&_sFU9eMXeY1hwD%q%OD#3^4 z*j=;UXD(wo%6j_1hK2RZ9r18gX&&5w!hrdVWG0%ddGyWMn{z| z?`~Li#t7K7&A4H4_ty$m0f`#bnvF`j1?OxXw*9hFI;lEO^Y)}{jk79yLOfo4JTj4c z&CbLFHAx5(T) zJoXDp{rl^r{QTx8KlMG6yXWi%mG|Ob3M|%KoEW`LJ?qP>+loe) z%_64fI?fh2xq;W&^xoWUOD~AcpSsy=?h6-%#anvL-P7g2!~6G!_p_po7fZ~fOj~FE zWZp5csPwpZK$3#Xu9psnHZM5BHvRPWSM|H6{%|-^W4Z5zhmn=tqvsa;Z68f(oV|o+ zlg_qCxuWj;@JU=zN3Zco%<*)*wCH_Z8IQM7`8N-hkF(S*A9A1lU}Bn22KD)VTvdZR- zMrne_>OH5NUdR-e*KFjKBJ*fX<`P|Zx7jZ5Pu1l-_L(^U+@)PNqV2i!7Y|F#^`%VA%?{O3neCADw$da)VTYP8hCZuN#ti3+!m zc-*jL^MpkE&saB`>kUi*eah6)|)ry1vrnKDQHu~nxRJKm=<_3?epIUB& z{@0DnKm4;GV-|bao^YP51x4L^gFahU&6;!I#AN24ly?)Xj>-CLv>kyTfX=0(Js@IK5xz# zT$z}2Qkf;~$KADe%~LmSYMyj?5_4)$)8|Z;03UYGJ2t6|m*TbFsE5Dy&pvd;^UYU- zV`ZU-&t|0lV-Vy#@*t|@!{?|iS?ikDoQZ4xBG&$~^r%fb_n99WKm3=q*T0+o>fxOw zs$Y(I8ysqz^*dEq{a<9N+x9<;%#<&=%w4;6@(j-G;?iwqOLZ(vWNv!Cm$uT@SxHY`_0L;2tue1O{OZEWcTU$Hi7q~<^z_?KjnZ8aTUKu_$TKK2O=N!1w=`O= zMVF8L@IHToq=*xF)0AhO>B-By;pz8W(>yuVT1_o|WmIxoxxO{e2i_SIAI34P|HOa1 z*0Mf%&+KnfdMO|8p0Tn2ctx{u@7k~3=9mB3R6bqa&As&_=f$_m&MzX&PjW=r$Df+u zv&k;ScWwMv|IUwv^LFfPzO`?;z)jUJPOp@F!w#=7>FqtgjQf4@zJ{!nB-Q&@PkjjX zT@Y~SS@7egU3|)46@Q+YwcwM5=iO7rnzNrc6`pZ5D5-xc@N<^@`}5o9n|8_7`Rw}C zyCg8>_oSN2mgG;Lew|uY^tr*oBIT0Ux({2LSsIQvU$~Q(s2`lwEj8=;y(RVjv2FKP zGwd@vz5GST$0Muj_7og=Jk38`T)L@S$J~ET&X$Ao*XKMu z@UhSRB=;K$1J6o_-1=v(2lPG_@=Iwv>}{?7X?t!<;hYH)jx3Kn`;Fxomfmks5ZU&$ ztE`%XDP*77PP2XHPRq@g zb3G*5?k}40ktvqv;+4eDsUJKJ@RX}4b~m-<`CR^Av-#`M8FGh~u<0As2cG$3qH<2d z|K9ZN>hqMgiCz7Yt|pm&$oSm*PsN^x)gY_<^ErX&nY=8=I+`QeP{QYTZs+r$Cr5(iG8Sz z=l>p2VOtWNXyI*FVY&FzfRZw|E-lz8CSzlW=S+319rYu+@-8!@IpuDWc z+~g;`2Pbl9d^{ch^{>3xM*w@`;Y&P$m+yi|D_k#+- z)&J_=F)VkVBhI#G&MfA2#gE<{<=K?*pqXLi8|0FNpuA$ZRl7F$E!J0mMrp^d-t1Pf`11Ku@6Qzs|L%O{s7-uv zn)8{!oh`b}f2O+0Sqq-re@Rf1Gm=wwuFZ|++=@N-?%SqR%KYJwdCT`LtML7Y{55l5 zm|nCkwK*FcW&Fr<{46tf1b5?bgO|)+J5V`vyU_XUSP2A^G%OpTXU4HV%oC64;4n2 zuYI`YDg7kgDf)q+@Eqg5BlBE1yr(co%+VK5d#!N7x!;1p^2=K}^Bd$-}&+XH&KP_DvIBFqNzAdJ!+Jyu9Ka``z-_VrNZ$n(IE26c0SGU6|GPyL|PG z9l34G)1=OPI8`5ee^<}z$o4vkXWc%^iCQ5u+(gU-Hp>5cd8NeNZROhv2`Nj@vl{}h zRhcI;eRW~-gcB>rhC!?kw1FBMUHmYD%m}kmbfx6a`B8!jqDxE1D|Ai9^59L zAgi(YsInSsN6Ji&BA+Cog=Z$IFfjDl7i9~oFIp`vJt16WAQ?ah0A*h-=}M5FlF zdN%3&wPDPRzJ7b#_ciQmIx6{=CC%C4dQ4TnDc-L3SEu5$ik63gI?KJ@uWudWVjhC#P@F_`D~b)!E?Fsocb5)o(s7PGycdOba`j zMY;EhPVaL_V-Rk5ylp)x>TUET| zt3vesKR-NGPTXV^G%7gLd^O>L)bn$fTR$e9Q&#>}E_!zcyU@Ql!`+2OHZDo^YzA>x z<3cP`zULZqN@S^-Z>`NcxYFjygN!;i*&|z5-B~I2jq9p?!}+^jCogGm9&2lE_exr@ zDq?2ri>ADt9&8&rygBwg6?%77U*t>*gTPe#$1`jB^oqVUsYxuVRtj>A@(>8fG3)=s z()V=fO7$Lz)h>5@TJOECnW?#9MUbL0XT4Q+Tk4Lj!rIlXb&=&ky`fn*E*^YxO-_14 zlAE}w>x0E=1#kb(WVgsl%4WDbQ_0BRZPjaw8`1f2I1xvm(6b5*wFXS>Ueq zmr8PZ>fSUQ66rZ{W4kf8->m6NTsU0QE@Uw4R6O0dIdZ1G44dPD52uWnPO6^&HNWA* zqzv17*;^u!M?xmDUevj4^JC}1+lM4I>P~zvROIFVy1{DdhsSp&Cmov*k`N%Vu(|U< zNW+Z##UI?5xF5gL_+@N=36qR2UsR$G30oZ>KN9_ ztZn7^wZo=;!$#$2t$e3%baNb$c+c#5K#wb4_09c!&O`Ov7v*IMi+9he`XJ(@mZv=X z(gvn}8$*eyCmQai756#&h-~}uiDBi+P)45q3ttaym*Y8MQ{m9%AfPnKk!fDhl4HyT zhJO`2)_fEfWIAx^>xsA1GB;FS`~KErr^L|@Da$_Wb9~$Pfbk(y_0H+D{<7WAKjFUg z_p0nKPk2muet*?t=B_t3Irh?o!SXQ2-q;)J54KG8SMcgNla=yR{ji|D-W9`+oHrIH zeOI}}D9p*^6W)~dc*`W!1+l-3GK~tSUVD^r-b}Ksb;^;Yfu4_!9=x#d2FDNPGrOj1 z&YCpi;R@|tUs6&pCp=Kwg=~54;G^#SSgT>_?irEC--ljZXSlM^)-fbYc4G8dBNlE<{<4M^!iUoTVqegHU@`2H-nH@c8_%G4`kOl&7C2U zT4Ot3cZnnWJEMo|7f(|2li#dSxcp5`y|I7Y1^uR3pY?7=YaZ4H_9>2dG6joL#izCG`qW5V@4Q%M=gAzp^Zu1#>o$_eg8I9T7F-_yv$vT6&f`z zHU_Y!73$~By}0h>vw0KW|MtJ{?LBAx{+%;oZ;Jc=b&zB&d7$UM_;+)vVxs1%+Bss` z*Z$UDF!ykrBYMz&-~D7|e!Bv(f=BbjLlmyDv`s7W$@o4uRc1@9$%*F&pB2fyk^F1) zPeWDKfO}4bp74?Cpt#OA(^6CA`>gW9bpCL#3*L;`vniB4aD9`%jGNHS&j%uo%T4;c zT}#WLz4?ieM5x0_)3|`3cu8lO#;5aGK2A;Fkg8f-Z{q7dU3jWgV0gakm8+{hG|2t- zGg6vSv%q2T<2kCI<~%v@Sfb#w(tGooQG2xUC8vT}(J9tkPT3$o ziHE{Zf1Fh@o}I!q%Uv~lBdxf5w%@iSfnyeH6ZZZ8&?)V| zR%NY}@{uWQSFb!eTZ@ChO>iRkU zt~Y&kEiZ9*TZqnXll=UrTJ)~}iUl@b=YKjQ@XmNa`T=w1ynlc7-zS(0IR2MpQuzNY zRr+RnSnR`+h$DP#uh`bKrRMC61y376DvL55PZFP3@B*fbD zpL422q>4s7juTq&yqM)~VaGzDdhfiIW=t36{9GE&%+RxKwd}21=blbj`u~jUsY%`f z4TpZ~tU7VQE$niY)tVq-(T&IdY$~cSZlCTEd49qzqy5{A60~Lt?7yVpR+p&s{zt39 z1M%8)-doAMe;$9GDEL6K{7szfuAZj%=V}f~^_pY~&3XUV4JM^~t@#LpCTS{-P zSE#Ha z-^Sd&vib*W+3Q*V&xJ_)Ca>FmJgDpQiD@Fw(nK|z^{-4ff2gCo>8l2F;Ep+yex7Q-wDUX%YIiJ(>fRBcqN#z zFI-I_YW=sZ@jW;Cb*^7wjFPd{6`%5ReMfXy=t+6grI*xYFU$RAoO7V^@3dw{)qCE- z-jhnE_A~tbzN_KKwPUK8PYzBF$^98*+4=JOz z>*t-UM;o3BhZ%D1YjF%Xu)ac4XcZe@mB{sk$4d`>-hSt!+;xSmN487~<*&*)H!XbE z!Cljv3`(ag67dYky4iSWLF#?;6JB~bQ)h_Z|FL6DWAiVESPjWf4^I3x_Bh0m@Hx%$ zr0BuJS)tpn9TGPa>+Fn3I&`YMer4yBL(?o9+B`cudj8CDxFkO7wMFv zwQx)6{?&0ymz8eVT&=u5efK&a-6hrk7<%s+d^vnO?Obf0*yUD_d*{=1k2MD@@j9qo z@4o5M5|3#G4%>e>p7OiUxlSpX!A<1c{ml<&TTi>>6Q7wdL(6j3-PAgh=|>;!_`xcY zDf2ewJO2V%Q&I6v9?9z)L+a+u(LZTYbz;%_+1Atb+GcWJi8$_l_3JLljsGm1omBYK ze=tivx<1p|XW}0gH?5w9VRj1?`Ijc{yY=oGH`kr|&x;b@acqpA_A0}9>l5DExx1g& zSwt-}UMKXl(nsI=(^_7GKYB&W7#rWb`+bpX(&`fzc*5lue1CbulaF`XmwS9`Z_U#* zeROBTrCs{lSz1cHK3~~#_DEfY@6E5t2c?hp?a*SjRbpSxv2gNfh5n3yu;TEU{Sv!) zq@}+s5!vza6wl{+;cB~U3EAo}HX{}0aQh_n#v8*4ng{#8DvmR>DpOt zyV>(K*9Kpd{->KhDMw!P>H9>VkJj}PlmD?LpE8aAlU;VzPSjZMvA4j~EJ4ofOt)1P z`_7zPe{v5iuN}*lYx;*9TX?S3q+J(W{?JbA@#;f@zgMldxDkB#sD5qF;cIJIbuK%w zYjz%OgZDNc%uO-BJ8ynRp?5-p zdi|GeQriS}=2r#P{aX7$^Ur3RyTyU*4!5U1_VT`v@qF6rg^ZPJ+5~^Q=A@bLI^^P1 zcC}=+Z^nlF=T8OMuid}F&~1=;;-(=_kNV$Cx2Hktd5yErPoI2ndv%xA9p|KH_aZkx z+2y3=$ZHi`o1A&f*#Ej_?QzaZsh$~op0^)6{qak9eTC$&Yw6)0hv&vL%1!vuGxPKO z2}u{LgTglby|*f-;{5*34%zmZE_^#0_g#MO_0LGvQ>*kv_)lIrzLT+mXR>!ao%_|i zE4d$4O(()9Nt^4d$k#_THqYXj7w?|b_-^%n%?a~$))<$BOi|*i+rYa&`KR!c zmprrYX&<_#&&ghCduaY5^Y)#l&HLPXS6rH`v2~A${n<~iuAC@7e~|A-0CUvK6Z%q>TVswcJg)PhRof@>SD4hjsLSHdKNs| zajQL$RnFx0^n&Ll_jc_1cc14U|LXrQUQCZa!FaVk(d^U_*T^NaXYXc@xbw!`-aY<* z!QV&EUR|HP-`1PuWqzJr+jski^XKmTXV*KyXtvh6qN&Put+zxnh17Q?gxrhE4V5%K zYY>;a^;)3)hwul7W9{eMes|zN=8AgHOEvAb!dGK!cgf#2+;>YVd6E2jFIiKY!t3S9 zyYt!RS;$7;{98Y*{H@fDV?I2uf92ioNxmF=@WPdA>TxC28y~;*E1O#-XLZfutL(qb zq&>&Z$EO@s^L?y!T105(0acO0ILT#({a3G=`G$(sUZ3N)!*inR`gJ8zSFQj2e&)4$ z#Y~BRk5*l}7$ASHL7-uIRo3r5{>T`WITNRC)YG%;wL58cFR~!FI*tFp^2H7x%i06aZ8CWr z=b)d%`&-;W|AVe}vBD0MiPlY#tZNspbXS;jZLfOE2ceFfT^VZC;pI*ta#zJ29Cqwj zy}WHKAJ5zOcQUL$>^N*(AOG;=;qpVm48GwG7U%c$IPJCO2;)Dyd)xk=<<)UJ z^N-!V(DmXi>-EbEB;&B za(;I{yk+>7YT2c7_A&pxZz~^u+xPK&qUplM+uSGS=dm5II=|{go6D=oVFl;??5`d^ zcxYL&Z*lM8C5@2^Y>Vdf9h#%bBj+l1La}{ykZ|}h9sTERPgcxg-E>O+j?tlS3az}4 z3fOtAc&tw|YtJ`(GqLR8qm8yDx~nub1lB4fw$^hlDAn~p7kQuY+t=^wcOKl{ur_KN z@|;7ed{%|X)plOH7NRCq{cm2?744j>%JoNIB^0}#X*jlUV(Qj4+deVo zYA?C4F(_H-u}A%;U}?mWs9nh-e$8sQ}Rst(>~RotzxUn z1-Au$)m=D6v))e4S^Ihk&&!vaJT|{hwEy&hkN?g2^p-fQ)oTqt$mz7bIa0>mXglfK zzQ=u~vlFZ?PEh%6CJ2 zB}^wbDg5jC{=C?j_if+qYp)x`-J7RRIH-MMarmP{31ZRJ86CFuwp-6yZ|vrHYOS1V z$+bj2CFl5|)iUc>Y<_Q@>05MU=iFP&_bMCG!dM*ybJo0gqS4^o`z*@p4`+1arR_|& z*L-pk|8Yjnmsxt&(Yk-Vj@Lh5uDEvLlkXeJ18!o`3RmX~PFtYRaa1p5qo(P@3~aMnAA1vRN1^NKm-(nXy3B_0)jZqJ{eTX*l3PG{Vf_R|XW-N9Qq zZa&o5p)tqhJ1=`*deL%=?JsZaP?T8n?MT2b%Z8Fg#?0mI&%S$Gn<)ENDQuF6cb544 ziz}B`_rU=nsTEUC)HyP+eh=(^-xA5B`uOM^?npDCj8_RR>2Ip`Mx1AyYrbRO-%B=M z7WMSVbS>05eB!|5tTeN>Yut%?TX~oEZmoCjm#&+u<|9y(t}6N?P^wQP<9s-yY}xtm zZxlTg-JVo=?aNbNE$MlOZLX@B#9ooZ-{%S3N$lF3E^+bu%rjd8-FEdoo$z*-Kw;ZO z;oJEcQ~&H#J+sWsjES#h$}5eNmv6Cqze+9EKIiUmlkLLZe|P@Pp3vGDIBA`!{o84J zKGQ||>t$NE@f>RX`|^s{hL+m0MHWj}&Rxt^x0T-&A%7O|L+M{j@;>-3@xFYiUc+_mN#V|&g(>WncT&Qy z{$ZTSa@OLrkl9U!uW$KoS265riCnv+xJJ*i@Zr-VR+kO026lAJPiedNq%ib_Q2LaO zrzTvxapQ>%?~`k(bHu71`#zc?HQ~oX!E0Y-KQeGcaFq$HUwdw~g?IN;)q1Hqt%muX zzHvW)O!O>x%KN%!@};NsJyL%%uTNN@s`~LD-?gw832dL4+-%M^$QerSTcA*OU-Y8U zz0cQYxxD(3^YpX!>LyQ1?{#-Co1bUcEXE{uR!QTEQgB35Xv_g!J-z9rM_;_yep+KK zd*t4kx&kKRN_jlNydPR57YO$=uDn?Avvum0`*qv~n%%~^Z+cq3Cs{VRN!8y7S-s=T zmC4mnyFSvr^KnIV`?dK( zrY&*xpR0bq4cD)H^3+uCuh+Vs)f&-DFGYyHykr>b79O%lVgC&6z?@^;hL0HvjLr!M z@^{J>|6Il4;%T{>Gp+oA-;r(8CB9XL2CpkSXqWNfddHb73|pq%iaZ-z_M?bzX@2^V zNTK@fgl9kh-LQIiYRL-5`00~nU%D|kiD{mWkl?nyZ|ybcC%!-LmT`X+z18QCVa+sms!T;f>MmoiVkbk@U(Py`J>63IkGeKb zklR=M#-mBGBq^9Fe6y~W2h)l-7k+rA2nnLj|eJa0hsVOlO`1miLp?Lk> zj&C9SJk3{rpE&qs9^>W;2lp!iVs}~JPQI4Vkv9F~ee3^9dR|Yh|Fd74yW)WQ#P?O< zv7e0W7M*6j7nfUK>-}-^wS{|pGoOcV_`Cl4`uId|OGa&%1K)VcIC*`ZC7DmV)R*4o z!LVRTx8{_%X}uQ@X$2;@Dk{r;Xw*U$W-m&5I*+Q|>u;d&_$makF=>I}jB;`9VLI2ZL0_-1@wdIm?^o88Her zG`K(K`eAxLoAqF`tKgb*jXv8>&AF~(l2d!^jK5CA$&%>|#=9@?RX%gCt;bW0LqXTh zlUb}a>X*v>_o1CC&#ygYPWV>MF!!%q&zW!HmuDAl&HE;L_14b7h8dR6)0%Idy17{E z!vMcwmh>&y zT9r|-byjiC(Ww7(Zdb=C_g6)oJytNMjk{vK>vlsUjohp8I;&Nx8{DTwI zoS&r%bQ@&=k~Sr97(KSzshw_oAEh;b=TM>=bZljV;g6~ z`yZ02FSU55{$Yz$I>K--z3q*ql!JD=@z1}aQlB0(<$OAN@J=DqhoQO4Pg?tI(k+~l9^ zE@;}fuRy4{aaO%){Wsm^=}nT%@_IRTH`-Tz+cQJ!{VL7qt^=Eo)Z|-fr^zL$zxdDi zF0W;G<7UGb{+oZ^RNZ{^SKK@imJ=_X74r->bMl(huqDlZ{J*K^lhk?6J=ZGoj87#fs=m5uM)v#J9&Bzfc^RqT)&14@!1{<6hYuS%9+$m#rv3`Q_e-PV?GPLwTK7^)=Nw4==kPZq)w&BKr6%r*-L@8^df&vzs2XKKLx|y3?pJbk2_Z zRu}VYcZEG!Z1AaXlhK??$@Hn)?md{U;vHut*JQcRF);E%=Y{KYLWQ1h_}`a3oam&0g(Z*E{C@ z)*)^;?Pb}@J#91ZwYPgCQ}}DoNoAjIGMO$=ZOv-WK6(8iix}rqn?pGx z>YDANeIG5-xxVRT{biM92lN&8bM8AA()o$|M1O>n?DSU7thMzkBsTtkcwwpU7yjBe z$Gq;}G4u`zY)a&xa`&>uMZX*8<7>_sA6BcJ^L$p(yi0$Vq&-|9s&Xh(k8Ywrc{@#mHIW^(`Hh8`qns z`z&%yJ-XG1{l(`FhozDn87u$IpOgL5eeUWIyCUJ`2B|MoEV5?Se{jw0Jr#1IRIwu6 z_26{obpns4pV8KJ|GdhmYj*zY+uyDf9h>r~%*Iu&*8ltMmA2-aa`gSu*R)@|wft#! zTw7z1C42h9SB#gQ^N4)d{YmZvTb@FF-r4rDIXZiJUd=kZ(ss-CA8qN{J1QUOetCE4 z?X&oa`ndvbr@mF((U;l2V&>(?NB>`BSs3;CaJW?M!Ts|Xx}#o%R{Y5NVX3k)^(w6)7NqQ*B z+}7XuMC0Xh0ziVAMT2@;a9UuOs|@_&?hL~?#+?kz0{O%+Oio6 zIvLx){oJ?rBTE{0r_pX+V=m5Pjgvdl@AQ8;oMPakG%fXRi2ol3F`fjEz^l9!of|z2 znAHMrDn-=4R293?AAHcFZOfy(F`-FHiF~``y#Md*{jvMpNY60^}ym=vGooRr%8X$7IQ5 zLwoy6A6*vhyR<;VsJ^@Z`Fhvc0c8)Y)c+o<^Wl_nRC&$%&QxYWTv=I>!HQ#2+urrx zox1zk?B3m#oAqC9$`E?wxWQq@H=+7@ar0KqJFw^H&4@dXF3o&e_B>4E_ObP`&tLl% zPT~+=7vPq0W=U?B2h+XI`|id2^{#a~s~?*qkp9|LXY0c@$1{epEX{s~^_O2iap}3R z@q}MjPfACjWbxzozrW4sebQjl_IPGW{QKtArhq$p|7d9{eW=`jVE$#Hrs|((R-a~B z@4>dOpD%BObguIawQ!KodObuLZ!6jxix^ep9jX`<(KRihc)ul@GLB^_G5sq}}7 z-varSf|qqlM9 zS-afxgeKo(p0+>Yla~8xWAlQ`5pTBMWBz0O{{5ZHxA&ZTYj(+fwEe^io8~O%l7C=( zc{=CM=s>ot*)z3;?i_b{?htb5yzuE#Y5$#tsiix2tnOE_EiW`A&qqUnK4>0i6AOf)#c@1oddeCUyJ(t}8i zCyE)uW-^;*_?}HR+sVOpHo@#$-wa>Bv!9nNj%F{(o*={YxF@1yb*ae3jQX4gPnClW zQ(f*f7&WShUzTC0|Czp_k}Jx=UM+{WFJEpO8*_R>woR=5qHj)dsxG2)QaQq_ z5fz~v&-EtZFEgCJUr>6QbB4icdp@6z{OzqBZ5eH^kDRoU>T}sGrFm{~#&;2o`l%*D zAz!2QW^)*9{aRQ2eBKugiFd&fe3mk91~clMBRdYCW1QGzA0f3v`FiSnwwSwcW37>B}(w(+oNzy-R2PosQM9 zZ=V}8?)l4>kk(+BdEW5AjMdxjh|LSV^rX;T@N3`-&EB5Xzm?8jdo}m`*+W7P4L7HT z#^j%R{pss5{++kNvv*%~d7u|_Z)J1zhg2@r!~-Ax?lk$m)$;LdzGqS#_tYBIbI#Qp z9EsxjdcVQ?sNfw-j{6B8mg`>f_NnZ89_V9#u!u=IO;h|&UBJ&1GS`^oTt3BUDYV_+ zerRIPlbsC$*RN!`x$><0IH`kWyGX`W0lB(WYd&-drv_Kg$q>Iell_0yzdti~@7Da} z-Ld=a>l%LMIlemA?;V<9Sh*ou;@j-%U+0a_POGomx96Mr({E+L>rP*b$hJa6_MO+U5Nz~DDQS^Ax;<_{;F!j_TArlp*#ah8fawdPfAg>m`f3CxU ztdQ`jho%NUc;zE`$6|K&yQ;-(-!*4v&u339`tjMk-0)O=nwDATiB@hGHlF%jzS%Jo zBDRT%Jgdnq-kAIF|C4!d=I#!X$yYD`Hd}MXv|fY9p>yN&|E3AdQ8qr{_BplXk zc-@QJ#_@*6-AHowVj$i3o_AKeeTDX z1;5%;c5xjy+^YIXyIgU-%*xcqtD8b(r@cI!!~R^rdMOL*qIy50Cuf%#Ey!}oG-+Kp z<;>Md2RJX!D>Um(IdL;w^-lg>`F}k^rKQ48(~e7shIod@+?-VKRBfAY{sHaT>}?f$ z?fc!=<-EzQDF0$?oM~mXVO-}=QT=fgDEuMYar0mh+mcWGihI!x4 z7hK~Jh&RyExVthibF=yR{7HS`$sZLjEnH@_J|TYA$H}HY6!$3E-@M`f>Z(Qo>zy^v zyeqnHKiZwi68I=ib&vcdhsl$hgM#0`?=dw0_wI~DOmf-YnR7LA5-(VuvD?RSB=f?$ z^z{1Mjw?34{9bu6Yf55ndG0%DyS3MEM2pvdwwiThYul%peF0p7b7g)ps98I?UJ$(H z;=ACEd1K#W9>LZMnP#tBVv!XVJJuO9rlU_ct63V{rrR?$P8Zw$_S@Ru z$(ysK%AarX)m`7cYQ<;YOyRl^-Sg6X=W7lvmjyq*udwO4=(%NIy3_KD} zJ)5E$B_jmtI3~=We${GjgY%3t>JmI{GqMa{JPIlcsGI-F1igat4=-rQscXl zx3?sr_u!naw)#8|^NFt| zo8HT26!w2gVV#u~y;$a=)GW0NvtBG;)To;hxN3qN$BBrhl(G+#&$g(zR?Ru(rNyn& z+-c_;{`1DGOZtsb26vlN&eY?z`=mn>vjDrXcNygvVKZ*O1ygWl-kSJzj*$#~<(wsx0}{@puMZ*Gl0{?zJE zcgoUOVTPBR%MN#0+r>ICZ+sYR`|jBbADxpYulP4NE_P-8_z#kk`2-$LxjMW)weu zyyTI|^`yP#4=at>*p8RasP@X<`Qy!&m^rJSK2p&YUpT{slmFO6HMP!JH{&PYNPM$k z`vZGz36Vw9gPt>n*556@Z6;LzJ$|8k^`=L@>wk#9x~aPM?gkgvXZu9F1hPLI z7T4c=QYh{p%bo1i>iMykt1}WGRGC-aQ?hX~GTwMZYgvH7S+xbmPR6fNckS36IsNFj zZ~tnJvCa?b{Zw0i_Z7zkHc% z7yoQ&z14lk=Bt*?ZAX*#>0Vp?Vb4Xjd;ebQPk-L#U%t9E`}*^#o_;K$qQ=t~cIIZf zAFelO^69!3ls@&!o~u5BY*UzJXHAF_KKM1|+MNmf=WgEHX{h!6JOJCY^X=$vx zFS=U#e_plq{W1-^GvYTszF+t8ntk-z@a{X?i+c_)Hh&((bpEK(3O_^h;$O3h_og$J z|426ezUAY&U5y>_&%0$`FjiJPpT9sWV9~0Vw|^D?h`n>S(rNvI-gPU^na{qvclxD^ zWkF_pZ@gUgLpk7uVf}?*2Aj`Z9zJfoYz|i#{#zQpNvK|tba6+rdfcK-yOef3D{q`! z>aaLf<+RU*m7iE_X3r`A%Hl8g?CBr7`%EIgdJf$<5VPvxb}s|1i$~hNKdDh`nGyH% zoQrMs9Lody9J2qeTp)Qy&NNT!MVi%nGrmU-Uqij6^5=b+epxbRy5*k*^_N{ETQa5l_g|Ug_@W|34?nxt&y>$E?s{5P%3m?) z9ovJ|KNXq%4!$%v$`@5|b?bv%d&|r9EWYd6ysGxkW~oc?DwrXmUOrhfx2!Ek%{Xag z*V#M88-zHIHl}W1=V@NBHPK;p?}|HN!RKZwUN&<6uxZob54&bH%#EBU80G)ycc4%p zUyX!VcgT`u<|ZfJblmhkD4xD+>8<9+lY{zO&+SU=F}wW!kLrXTm&8dX%Wk+DX8u&R zORE>+UEFz8-ZEN7{lCo8)ESeV%BoI=AAD1pyFJaI?!@C`{^hrwuQ@tQSQlFLW%n_k zSv>}N$D}s@h-NjudLjAn$0dwYf`s%+>>rsWdHFJ#TPb^;w0h(xq2jDES#Jr?w)dHr zq&&|F3FHbtY6-fx&~f_$}(H~&uy>2-uZ%ekN$JLs>|$)%}tG}F0-c!s~7DR*t>O$?VGA- zUiO%LAH8$0UwH3%_3B&XPo;?+P0IrxF`vmvVR2Jg{F`#dfce%fWO z(7t4s2hWVMd2d}lzqpvN_V4;`>-0YwEth;2zZO4tcc(u4L5{FXT3>%IDxBi}>UF*H zQ$58$xify}FG_Y$&psM4;b^o%g@!{KrJFoc zO^SzRDXuxH7{Xoc6>&QF#){?*X3QI|9ZY-gIH76cg66NjC)#VaZ4-A$@Y7&f9kXcj zm5IUcri8D^-MRhNX7}9;8Y%G-qEd2`mR~=~aX!st;m*BJkAz;zj#jI#OkAV3u!H4m z5v%3|gJ$7+-cPpMk1kxhtRubg@mdGp3G4<^=Xq~-;JCOg_X;a#c2|1k4 zH{~8a_&>#KYp%uZV6WuAK~Ykw5yyke3^bQH-mMM{y4=LSde(!wV-gSUxjZUgu%tlR zd37ka|Hg$I&#wCPI%P?QQKip<4e7o+JSS*t91NZi&N%7l@sj$b%VYEw=?Cvr%iDSJ z?x7kMH@y{y%>)#6xP`yJ&5e6jttEH!;V!Y>Z%hl~zghmt3yoQSdV@u5)8@GQ+l%VM z-(4zv7q9x}*zsKgonA+Gb5F#-TR$Dp~>r09xuTQ^q^63h$BdLe3ExdTdG;~La*yd#Kvx<{5O@Fay z2l}pkWE8lXK_ha@yq?dGvqf`R&rH#GKb^KvWho<@<6IQEH-deJ|7N zg0-g}{k|3@vE+h|u)x`%dJmSP>{p|*qIec+$Qsp?k3wR~o*)&YhKd?2EtYj^(qX%V)iKd(8ZhwT=7ZyhD}-$+L`YKj+Ft zm2HnQOs;3#SMqB6ybCYc{JRXS|5onR{lHoGxbOCo80B{|tGr$LUmg`aJlmD=Me+8V zRg1pnN$$}Mn>V>=-!9JnjH~54@7=xgOImo|+GL@B1-xh2lC7T>3$$5d)^69fHcedOw|5tzF)G_lC_uiDPtKA=M zlv>&FPw$Re`A37+cjW=O3$7n)uAjPKA;_PfrlGahq1omb-6_pYz$%<&BpMmgELEDrYR3qyO&E z^Y!JGkx!)CgqTSo5UMhTts|g*It`@e%*$>b8M&Zb1qG-*yR;o{D4#L3CrEHE2fq{ zH0atUvQX%;#_2Q5J(fID?b4X|%V*K7ya4{@6Ft!t3$NIlBu5a)R(Y31i zb`bM_%kI%HQyl+TX{ZM~jKus_G?%U7*nFWvg)PipED=tC4({DQ87e)(4 z^T~-U8ue$R?&m9S7p%J;fAILT)<*?xGC~$CKMPBv7O*z`kh>(+e&DO7_+s&s6H>o? zy8nIl)lb#GNx?L$SZS~xzeC_vZjGZTG?s_oe2B+S_T}kC#%O14XuY9y`*OZfm zJbLUgn!9z%q|seFLwFC*1b4K|FL1_ z$&3eqof!_oT9&)JvUw{H&AA{@Efm`mFllB?%C_w{T?1ceJxWrW?3tmGono@e^onb0 zwus3UsfxV@7FjUe$DF4@I5Pgi-Ctf;+g?~~?sTxbZEh^0!I_^VBh++K zQ%8+eR$P6fNxs#@jQT?dJ(G{>_?bk=bMkI_d9=j0fz`yI zu1)O}V;jdS5#}TIM>F&8t@0DS-z+;f%*;mUKnEkof(WI95p4dO1rJ_fJ+IE9B6={# z>$1i*g~KXRYRTWkjw!FbX1qIS@>iZYY&93wgey-_b|_1|5&a>}H$;7gP59YqOp8O0 z2C&!#ai3AXbKs8Dgq6!A7DTU3tmj;|QdCXwa3zNs&&FvxyBsDpdCb~VX*_dZsW{Kl z=HDlM>;GNfFRK5T1v}|ov>!RC5dB6TXx|~#5S6pdYyhrT+ z$D*yXbf4?3%m4qY^6TNBuZm2IulzBbIZyYQ_V;JKv*$79w+NaSrO&8bHCx(Y`V4dP z`d;bn<{Pw^ZmB%4kdKI|RSto^pd zm&-Sw*DlX*FR#CICdWfQU6`kI->kFY+n;Uv_ABMr{mbgCx89( zf4^n-b*IUvonH3(L*1|KFYhnEA0JShd@3eUWJ*{6g9S^Dh8t*IeRH-y=-`{DEIae1 zZ_nTTlE1s0yM5-r)9bIxzn^AYUs}0&SKOJ}U#ECB^RmctNW5igYvM216wY=gv8QB# ziJ6*i1Cvl{#6S{oOfsPCW4cx|s_M0tJB^kb${ zI+HWj=_FUJoy6Z^KJ!F$gj&Gbk7a!q-6tvf&E7uun@Os`nHttz0>(8iQc9W?8(&P? zA`S7p>ipwB6Qont{MFeho4j44xN6#)#f6up^MdS7 zPEDQf)7n>>y6jr3JMW&r2d2*sn^t%?By-+tTif{H@UKI0!kWJuBBvky!KhVloq5!` zNaKf%=)cd)fDX1(<|If}$5YOq(0X@O(n8*PX>3Juj}SR%#!ftgw9>lk6Jicn<@Q%2{&H z3_aT_OWgIOE(LPFT77)IeqpNmBb6O#v+EbgzE-WYfApkLQ2q6~=}T@@xzBc4b}26U z{mF+W>p9ad>PuYY>I;uP^?{Q`!rP54wOfS2a5}qVQR&`UKR=xPzi#^G{_^Rk`IXZq zpGefL3r@Sg#%Icl%};ln+Bf9}bL66rCW;oT9cLzeV_oB9$@s2q>m%l;cD|1~W`#H! zz3vd`sc(GS@n_P5`ehL(t}H(>V^7-+nVgA&d!%%Bx-E*nGA(f8?h6xi7Ow7{=qfiu z?a5se#u)zl?WSsiljIT>C2P8UXWsZ}qsZdipw)$E7<3j^xSgAr^;NSW zD4^Dqds~Z&`BQP1tZ2pV1I1d;81K7JQ#om~!p4*T@Dx6t`kGt3H76_&toZcm#%;Z= zR+%pr9=*6&G3vYGD*vVz+YC=TES|pZ@M_(zfb}xMlU!J)O+Wvg|NIr@t)E{`4*qoS ziHPMi`%_g0&+eSxux{$AeuE{fHn-Po(7ZZ>{pfT<@oii}3Y#ou@5$|3y2DN3*=hHu zj<4S6_Dwh8xhlKU{m|XMnEF*0#b1dEKQU6=%Vu0E^q%j>_Dvu9)MdKAYgJdQ{}{37 z`nH6%CRwjyyS5uPuix`Fu*hL%*sQZbDhI!Ayz=|{>)E&C_0qR1r_Ef!o9nKi6w!5K z**5FZAxK5yQ&rf#354Bo4M^ibDMMN+ZLr zzhBEymQuUr*RiO9?Yf9a_Qt40-qQ`)T}SH0H=bGNrXXQmBD^GWPFF{y+Zq>*9g%&P zUaS?BKm2X(?xKt5noUaU=F8mv)e*ElW=rDHTiWhzSJG`13TM3GTR*YXJYu`?4LC&Jo^7B`|!u%Om7CjKe?_DuWgpB;y{+dnow$a>jk7U$Xsg(Epz>%W{<7W=hO{`{NsHGew( z@=Q1Ky(&~A_VC7syZv_g?eqDM)mQz@_^1?Oyf8wdwWe(6PSvANtG?aaUGe?N(Wf{4 zr{A~zwD!Vz{r8i8&;O8VxqScrFG__^XV23L(CMq+@c8%qKR2b~>ew%}7h3E#TT}g@ zDEGp)T9wZ` z+ai7XPsdi7g&Td?^jFdUduE}U(t6KXYjir|@-li($oCxl%fL4At-}9fepjCzGnD3^ z`RVYqkIn0APuGj^%~0ufy87wQVMDJoe`fHrJyf~9Y|V;~^Phgw-L~bswP2l1_mcGR zX(73b*Y*EibK_F*X75?sN{>Z9TVo+3-QLmkTj#@jkxAamQkG9%vy5^5xn~RJh%9f_ zGhUz=&EfD+=h`i!$+s@Q3RvnpdELU*9FB4A3XW%7_SdpMnsE5+#l!V$fBsBAE-@?f zChx`~9aqDX*0uASO>VL4F6?r7AUo-*q{nwbS3l`RqNy9bJYR)IUhyrBiR9=Mb4oaP zYr$?O<7LlwPw!8A@4H_7=C_EOoI9jus&*WRv1U3TUbwx7`+6UT*tY{l)=gPUBeNVT zcUe9wtCX)<*R^J&l1k{*2TJ+7>P2U)lVn)xP&GO4@+!OKx>FN)V@|%DmgYO{$<6#7 zvx68xA^xYch{VG-n*R-4!s!SDPuXaO%X=W;yqI z?Jb|YGgGH=E!Y^>+||?j(0G-MWS#fwPjft^EBe#Ab8q`sl{#f8ZHm+i;6GM!YS+1S zMW=UInz5-ir5q2OZfG3>O9k`|BLEy#KWGcKq_oyd_8eoUpnZ{=!JE zKV`-*^AFRk_MJ~VnttnzZXjbPBlj|gJw-m^M)mP0@6Ffx-}14pRNOY=8Cmj|okich~+eXGwojc}=W|SAvxCK5LmN6Q)3w5m9PP~Jk+S%e&McR_<(==71#>+*JFRzy z_i6`S-u}+HKH~elAPcd^ja==;77xm9w-o6xJ>zB;$T?76Br6Z!kN3)xoKM+ z!}W*We#>S*)m<~MbP67+RW8}t_V1FQm1L9so~{r4{Q{O{DJF-mHU8}I zjIS|!vh)3B&1Xi(zX-fJwvqYML(LQOPZ?MV{(m$hbqia#1B)@sLzQ3idlt0L>s#Qr z@ZoxfTt&Hzd0H&Xh3eKxXKM#fNqCT?tQKNYv~i~P%jS$=-r6_YQ#!PdZ#v#?J4akE z_))|Xj(5U3Wn9aqmoYJA^5*+ak_w!}wf9@?DGvYXZ8x8L-yR7{t_ z5f-5{Yq$AN*JfeTWGtT^%EDx;erVbXt|}Gb>jDbutCy*&o_&$}g2Cy=D#6(aF;65m zEn0SQO>#!rmlxA_vM}k_-|sf}-t=HeW|ZdH?$@zVk#S6NeAhoqTovAWOuAD#>$_RH z>V~6%&2klYLQa<1PZK=7_J?=!vi6g6UYFcxe`g(2R`TaT@yxK?uZHJyHKjf!ov9FM z(JFZ2sDI*8vl&;_^t^L&|u2nvLWy_0I61fhKr7yelC(M5D^ThO= zN6VY0o3WQ=E|g|TFzy%su=dRMWnUK`uGb6S5w*bJb8Ogc&Fc@|uDkiXJXfVZsUtFV zJ!kbr<27xs{xR{y#6~s8*ZVx*$A57}${}$f{cSf??g`rkD;|3|%hj=4=%L%ma?f0w zz$exIFP<;bxs){dS@xZ|9o6zXLhRE*ciE~^T0c+VID^&AAhwEX!OQ&nB~JMMaNGfpK@~&Q;=H z6=PGSdG3Gs$Ca_7etp-LEjun>JtD~c^@Q7lm{)tdIKQ6UeB!qacmKiMuFmYhJdfJ> zCZTP04lK8-!`^lM^yav(amd{(=(gL`cV~~Ts5H88=otU;{@A94d#6|IzGc!g?}GYX z%@ud={V**yQ2cPY`f^G9%?ydS)|7YjjIT6No zE1kL}9&0a6inu5DDbwcj$IO{Z4QHR2yHpmkEmTQs-%>s8ZCbrSd&XSZ?=FX8E4S4o z{#*CpL#bBMqV=zn*KkF*8QoIjs`K-G{A0sG=C9WLbJ=yorMCUbp1Yx8$-a;@UB$kO zLJy?I%!Oi0(ErN`OKlNC7oEmoI`MV?-)LR^E``GOncD8;= z1J|#b`S;GuzwTQ!HT`Se{inB2>@}&MaicNwip!61-|#0F_MCVXI@PRfg8ZqscUEk) z{$9_%GUw9MjfxVt&Mws49$Ivx)U2^&yKjMn->QH2wbxIZUNT9KU*fgkk&VOj`f?M-~UYa#w{=7^7--MyYK9X*^ctcfsKpLD^7{CdHuiJNb-r< z752hUr_%7f1!JQd!^)E`FF>J7VWv*@%+d91DubX%^wL~_U7UDQ8fKj z=Gi+{Nb>Pf^96gNgk`_4ymxhnFPn{n6{Fk<&wOq%6*XHkfsOI94nDVTA3AKuz}GQx0+T@FmC~F|vOWRv zPuMrI{+!|3y6gLf)Y;&JHwb4&M=$BpZ9+Lnn(3zRzKeC-DzpNU-n+@%+e+5XpC`DO}Re4qWE6q5%^_6NWAopav2*;ulDLoTOv z!E7N$^9!~?_l{QBxOrDSK6bp3IsVmz!li6>&vp2mr2_e!--&A1MAfKR_Hb=AkJOJ% z4NN^Nw7Mt!$(MOM`Zi2m6BqnkWq#1*(wVj@FK2PZHyKFOn}1=RTp!~+@iO1HB;_d$ z3reI5)=ka(y4ExL(LHUgbz!-Cd7hR_W^R*riFaY(aIxl(TyrbnxVzI`9ixJs0k?iL z6egtX^Df%0ChV*i;-Yw*i|6O*c*ARNccgwQ^@unabnWZ%N3mv$KV4Dl-sbLS`gM=& zB(c+?KV+Uo?6+CCs%vZD+xzyuRVwI9>eEy$Gh9CPyH(_so0~Lrm3-UpwVSJ7`H*R}Z`Tj=o6AF8 z+0D<+xgWpv>e)4OQ^nT>sO)HBJpN?&l}Q(~e0J=XS{!*~_tliEvG+Eo$Qf^adu5%@ zwPVlgbdvQ{9d7miTGnqlXZ;50n^U^?)!#G~R=RV}Z#nC~2n&t$=5u>0yQj#%;rTMP zXXdp{rL``?XI@u@&h2sQ@9$r;GH2f3lU+q-UfqB0O*8Xabu6^8iWZxf-KNe&%Gq4WSM9SD#$6R&AE1?%u>(Xbl077chl=vXMK^8x?_1OZ}C}S4^huq zw^kiW&Rnh@BAX%R;=|&kEf4Ti@wX(mn zQ{rw{rKl5n_197-DZN|iGliXP=@e7ZWe>XA6FEFttLI(l*{)aX@Ot-Y^XDm{ntiiw zFI7Ev&D|oJwM}w!y`}MTXTeI#U26FT{0mxlYW2lby;#yb(T8)R{GnYDA{^HuXTLvx z=cC)Ac4fZ>^<2smk`fp2Cz(Vh?#SKg`?Jyed)DlC$|v``pZc=23eeLufh!@SM$pOssLmurDQDtEp0y@!5Z9>1&I z=5YS_!g90iE6ysU`7Lqc)ta_^WB)^iHfi-cIWF_N!#2j;s+lDqC(6I~_ac?Y+DUYo)69^|L3bt$pAZ228s*?BSow$b|+ z$tiJEJyc6MqO`bP=#G<^+b@B<%+O^z=U2@-+tq$?)z0V?&6E2Cce=JH@NcE~AF%-fuE-&IgrbWe;m#Z!7fB|81iA`{A!!&;I*Po4LE* zMdQ8i!x=>n8Cpc&$~sj}H*04xUw$aMDmFRYgC#ZeNzbYYA^sJU#sT~{dl6%g?%m44TXDW?+fYQ7kICo z#Zbgvv}0BP=hLv;AMSn4lGEXc2)eMPdGFqR+qxw=%4CFEDHB>T z@9Z0AlerYvtq|_7>hDTgXtdjA!H+nvfTYjf7o0R1d49%zxL0$4_qXD~-`_7W-uL1u zw`b@iOPBP?`uUhT z$G-3yUM0Ca9*0U5TEm&PrA9WRx6orJ-xK< zcMwCnK})r`q2h~U_r3Qdu-R*$)fStrzQ_9XtIFc%DH(AoqV+AJ9!x(LCdWGH*!&bio-dbl$t)Cc3o=}M)xSwFX2}+t1?+mVjt{b1*3XDL zrd%=c>bVit-Al+=jSy(9oy;s)-ONl-wP9&sRfbCA9McO@!Nx|p8411 z%>shmN7>|`zhl$u{kCrIq@sXQ`%A^KjImoKPbB-=H}B`^a$I0tw!OZ=M15Xelw8ms zhV-Bv@12+)vObiww62e6h+A^a&$<1>;)e%Q^A_t}JRqoCa{0xpq@vRok~UN}1#X`8 zY5yr7r?xXL?(Z#?9{F%p9&r10gS|4qy14#(tW;U)%q#a_WO0}-*>K=rZpM`K=O+Ts znk=06-q<6t`(Cwxc~*I)!pd#0SnaEY9yq;SsB&cW+exz=DgrIv2A9}gbdB8S8~L`- zYWKm?d0X#q_O=LHzpHvZ$2^amf{6i&uDTt!i&d^Zv=8~mE^;uX3vEVry1`pkmiB`p zOzj6nn71DkVOf8pzMWU&Mf=Nd8(BI`?;l9oQvQ?e)Rh~8KiO(~GV>L5HT3QukZ&zx z;AMWB=ka-+G_Q2kUG{1DyA~#XG2qz6SbguUSZSf)RXPsZYX!3*={}L)L zy>Z~U9BLe^d-8TbdC-TVvV9V!-enPk zoE?=E_UXYEu}=?*rnXLEp1%6@^*?vEpZ|RIc+LFvc29rT@RsJCzpfzltLf^BGmZsJMOL5I=-qN zb&>U5xv})Y%YvipJlD0n|GhW4t#akJeg9^qulVM+q&F+z@0V|)fB!x%**Z)A|L#@G zHh%?vZm^lsryP5F4gpzsDPxMXa2osc`wy!ApYXr&_cVf;c@2 zzq9HeSHHZF<4cBFRM_cCV=4K5cjra%i{AbzxTMpz`eNqhRqyt{V<|qs=DJ4HR$;o| z!Ydr-X7>KSk;;5DK|WxITSN2tyrXM{-aM0g#>g$_AO5ty!XoO!tVY>?{;gX^S2tzIeyKmDrTcQ0!_;1mcV)WX@!iI|R=fYOm^oiw@AS)xom&2B^4hBc zyiFC7CH(jjnCH6gsWhz!=i~Eo_#FHEyV$crm%Kd|S5|m2zu^8j{ayZXo*>CLP6fe- zJ&(^zGr6$Pv;XAT^7^wU3rYfc`F3P#?m2sXkD$AnoNZT8!AB1fjT^3BF0UEn|8Gw| zc4-r1nBXDK)UCT1w{7?pxbtRxse!=hMN*4O_GZhw^4m2rK1gllXzekc+G*TZ|NM~V z@ejYsEKjrDHMKk~UgB0AcEPvA>gc3%l6gy-Z}1rW>n$!W|dI?Bq8rvIIDtL zv9bJ#9xpHEyhYy2zHGQ&@2$0c;)dL3rGMY#8oR$v&zF8F|Ma-qcJmqP>Nyg#&aJ<7 zk!h~Z4)&!*f$?5XlWOmW=)IVeG_&TcX3PoAn4I^;TH?jkCsxLsc^j!wqNMuWa%%U- zSy$eE^JDDT-NrLfavGb*1#73MSM_xrziV##9G@?_x+m@OW41+-rlKj9@l3mqWbMmv z*qF3DW-j0Ivq#_Etf<?bE@7P@1>FLw(P})Uu_Q^&)6xkHu?CT{$+i$t`^uhas>t+VB=UNcJ_EI ztD*AIiVd|E4o<5zmxicXs<-o;`>QLlLBx<_1#{z$4Q;Iq9}8Z-4AfB#Gi^AVyntu+ zgs4?6&o`^e-nzDr=i0yJI+rHg{dAh)&DN;$OW$DH^6Og*z_k3~#Rf7$o+ZvVqaFTPtKsXOc9(ZgF0sXHE6eBk!AEj538 ze{486#nF*j>O_6u%B^la+H?8qQ=d&Z^zP@M7lnSwYl2c2DZ3_nFP=I3mz{bSf2^(J zrxkhAf8|^Vd=-4(+4Hw?q1%@v^9U< z#Ag=`%=_E^K3iVBN;S+j>guE*Wqv*551)TNda~ii1;aSoY`Z@9v$w_l>z1q56?|DF zzHK?fj)g)8v~HN}jnlWy>AfvDZNuNJ*iWacE>zUL+F={z^wvlIpy~5SP59p_1uJk7cZ`zQc>JW?P$>HdtR^ z@N5qu1@~`wRTe)=lmTdRWFET8W1Af{mP3(4JT&BD&u<88bpG)5@+P$f6c93Sh z@b0|ww>7I5eop;8`QM${{${)KwtX!v^i}sdl5_pIdXUBRRbhP{PY-q4pD}$Fl(ETT zf&A@hwrVNwmN0!0Tc9psFZ=9}MI&FrnG>Pi95VjPi%+>F|@ zTR~Jq=sj;m`nLBuQr|T%{;m@KXyB`JVd6|zg?dAs_DLaY4g_^~?qS!N89$}$-oXQZ zw#+V_ctP0dfY?&~i7iXEsmPw+bS!N#r?8xR{N$buiZ547d4FovF}ZFlD-|twfAQ?) z%06{I55ki>>UOS7)Na1;+jWii^go&^`&H7FHi(Sx1 zzVNoW9m{RG>I)~#xM9Jmbn&{H$sWb&35s$4@$7-#39A1jJWrO!;*PtC!Bq@ zaY>%++WQ+1t8JenyR@f!#jUHwD^E; z487+ieL1$+GyKb{MAgb2r*;4GJ~R2gE99Hc+>7kqy{Dg8NEB$^zGiWh?@;Wo?meci zGMge7FXRw^y)qk~2zT5M7-b%I3O3rrE_zsm#=6n~Q zJGctEO};iL(^L_ ze0Qz|JzMB};>xxX-TU_J3ET4g;!crSDM{vwu3RsfW*2rUbzY*a+m@ay*OYCS zyjkz<^{nY*&lDZ|XBHQ_4^0dAuh95$;9!4=oU*iZ@Fz!I1;*FP5o}yv_RYTQ6eip@ z^_>kPvwwa_z4e|85rqrZ#g#w4q<(kp-t)&(=PhYv6RTaDUF#d19shq{Ty)Eew%?^& zKF#^cynAzpMoRrc@h#5msr%O4U6$g1J891C^4&)l#Khdab#8m!OTqQ;e+$0z3OcJd zQ=>XyxxA%j?Szg=3n%3}b~TEn3s<&9`kDASv2=TrmbU^iS zMTTk6lW?h1%$;fh;`q4>O*~~F?n!xt!ebWyls+wK`6&PEvzd3_M)l*br7BwQ>`DGz9OozO#Lmb0QRUZ(=}Kiv zoss(UA}$CXF2A?*$xGXM<$C=qUwCcZPEEM`=_KRa>O=2U#n{vT#@Xz;X0z$}a;A^U z%_k1r*LSO%zH0v#F}+_7-}Mgs_nuI5wQjMA%1KVPy^j{j3r%R+`a|bjn}tyDhABs` zen>REshVC?lcDG^FNsA(mtFeMn@46TbULiEtk+bC z{4T2dG)gP%z|Lof`E@fz`cJrJN1iuRvy~|}W?D2VFQ-8zppUt*^UCjGe^UhXu zmw3@%|J*4suAx35)+qHs%KgH=%$IB0b9(k!{`tRu|EvCT!{n?olNMIzZue}zt339i zCVQ5infB&qyKH2?-SnACUB=4M&z4O5yP^Kf1CiUSxqc?NmzK_(pZQ~g#dM>j|0^E` zpDNq(I;?88QU6Wt)OB{fTUZ=5O_>uO-n6vaZt|sB^_x(OTI)HNY3*u~2J5cOiC%Kg zY#i@g3Tq_+H3RY%Kw+e4DU_BXx+KhTjAnmdP=Gg{|HjgShP zMxSWOTg%h4{9CRlZG8N^a7pj)XBSm}p6*oafA2C!GGhDo`kxUilfRsf@@KJ$xaPM0 z-etM%c`riNA3w3GVD=TKL7Re57%)B6dn3NU!Yj(+*`@O@7ESuDRkOu&<85QBWTvM1 zop-xVf6WluFEMFzj@MS*`pbozJnUO0u9{MmF(b91^4Fyo#ZPq7_lsC^C$Pu(KBmpw{XQe0WgS^M%^@#Us0$(c3_mIU6~ z|KKIVOusF;dP`gD9=w?R(nKVu`k9M5t5O}?sh%>^|2dPZPD#gR%sM~m#m=63b=%K3 zdgi})-dCBUykDKo;`3eJ`nlJVD>iT2w>a@dFyr0TFOMu(SAEWQN3UO;@_l9biE^@2 zZH#luzLd^C_w}oB zzF^;dIQq=qV%tyMETNw_YRGRoF(;;8jqUPZv8rSS_SDFSefOWluKFIGl5)D8 zB7&yNw;JsXKK7$?!0;mKZDWJ_j~(wU*vwAf6U0QGRoxQv5zoKw@+5Eshn?p zurR6T^24UM3I7-0T0JlH_tn*}cE4(Wm20}NJh#SNBBrq`O~T6ctu~`dPB^+G&r^UtJY7 zS8vv`sM=Yf&#xYT6R95csXPg0#r{Av}gHjBmXb3c$V`5MWG*H8ND({?)emgeE&d&=`~9$wQXed)?8y-PJ;-<a>No795tpVasM5 zn48+>^N9C~zLolXk6)rkCs}RgGMC&pd2;o)qW4Gp^ACQwog01d+S{-d@=NxeQ~pu% z*lod!4^58`Z@=62gE9J1!kqG>2{lZOdsf%2s&iAQi~oD7@$m%PBl2gnF3GIFW%avT zFQ|NXy4g$~@!0wsdCT0l7|yak-!9x`^Cf=|-_yyZ5>|U>%vXx(U;Y2}ql;+?%jMsE z_!Bev=0;9Wt-EP+=IAfnZ-0KaYCZ3-=Rb3<%EdYk!KeYdlL+c)=34B!4VFSz~j{k9M9edhoFWyE3oV!ICT#|0F3q@2k#_o(B1M= z=1lOS6J=+wExmoaKz#klYO}{uPi>i5)+^>edR&(=@$Vh3hung9PFDWi^!?q}$@!5i zh28ZmF{=~KFE`;AbL5G3{b2L^oo`Lr`zMRvcj7QCZ<^XHRUHuGabE-OBBsnb2Nz~KX%VMm{Pi8cEr z$^LVVwPsr{?7Uvjc;$7S@N~tutir8-S-1XWa}QxOneH0O7RPREXl!U^Vmf_QD4PtN zb2gMMQo}?+BP2CK!6&mURl&%>$VgKmyCAV7qc}BDp)9qiI5R&_!A#Fs&t$t_7#k;F zkddRYiKCN&v7582g{8THp^>4ple2-TqlJO7nT4^Tv7LeqK_#(V`aY?7=_MHohNcFP z%^s@LymP``MUFlH6F=pW_?OsQK~Yin0-`jw{hu~X%u6#@^NTBYZsRK_ArWCyLzNd^ zy|XfERP=iCD_2aIAt3hnSjXfYSB|-qsYwM2$#XXusw_MAKKb+M@^g2p-|aQNKgasq z&Ob|AHeX=ewBYg_?Gn!CM(6Ilh-rxq$$0igcV)}Y`XgIHE?I_e5DDbya`-rDXUbZ) zU_%|{Kdy;ZZBq?>V#8*1CYJJCP8ZcHK6h$*faL<~heEuOSBfTZSDh$b5Y}L`VS0?U zmb^%VV-f#CE=NHNmpt<<)d<#OC$}!_a^#$$u$?=U>(qh5BJ04X3z+68T<==N68gYo zr`VOO0NIC=pVXHLTx*CbI(^bqcpYQuldcoF>M`7}PQJXoP0*~N^hw)^T-6*F-@=od zjy~BYu#R2&gz1FaK05?+l$QUz?Xsd#_sOr5FNH+!y1g^l$=g!3Fs*3ulaM(1#p|y; z&yF)moaO1e@mXB=qN|sT%9?5u>|bn+I1(80`XcK$fh;8x=hg*W^&!nR8`!$T8oUBn z!7gnx;2R2MwU zZRMQ6c$z`_(DJjkRdI`R6zk`oHZE$AITrUJN2vd2?Yy1ocGr%+kvy+eaqW6?etgcm zqe8u#v}-g&zwnr~q)S)qd98hRZ<+t~jm$RtzJIdK`(9*i_f_J?^_kWFm*0Kdv3~iA zQ;$vepS!cQSSpw4$Cbz0`!C+P9xQcWo802+Gp}w+&71lyN3Gw`_ShGR%kP)$k*jY} zx1IN;;?iT!eq|fBkGapp{)bl9y!yEEcwZg=3pU#Y)2mEa@3&uC^Dw=C{$Ixi$3F%Z z3GcqiipsLQvNK&^v~6eC4fVA`S1x?`BXU5i&g$7V4Rdz2106f7(?hskSFU-!ah^Q$ z;|DA=Oiu4y`#SBw$B3-iUb-$<{imNl<^1E+`TAK??Pmo4dG2qdx%01gopq=!(iXnhut+|oyt%z$m-1bu-NHHM)j#LFTUwcN`=H+D z@^{+T*{mK<-@i`(dHd|U+*W7oDh-atCh)&tt4)x%V5mBqcjs#9?@XgAUfp|+1{{2i z3xD*Kf9>Hk;8A1b)v`|bmfO6lr$PCF#@8>d>W}ume;qgHGoxMoUxApAJT4jL8DE8% zrymskp!tKRW@UH!0ZoIvve%-vLG_o7Ciq))uVRRLVrk%iVp1#1gDDS7d=6$eYB8#} z$xL|EmvQ_4DU*Z+XM)Q2g?9)$>m69s=+3rB>_eyq+ppzI&i*@nS$3&IJ@egZ>|6|G zJbO|OEN3ic?Gf4Fdg1k>t@RB{new2-cm75U-?XY$unKi|2-=vPpkUIxiWa#E(@K~TS4aMy>ugP)h?XewE0ZR!p$XL z4|AQp^w!=}Rp;-e)j^)#@vkO(MgHo)zx2|yf6oh7_N0c{$gUQtk=yv`dB>#Rf=}NH zhVB(KZ5AwbSC*RBpYcgh`hVYzS$!GrI&v~}1Fg9HIo1OT^dZnZXXFHs` z1(nT}`(myaOFIg`V2O2Tmz`Tws&hHgf4{`v*l&%09oV-pCop78EIn}5-u3vwL<6Rh zqRWAAIV`x2HT3PWy6xAbS-|5Ho%W~w$1?8lyZ=1pt,node distance=2.5cm,auto,>=latex] + \tikzstyle{every state}=[fill={rgb:black,1;white,10}] + + \node[state,initial] (B0) {$\bot$}; + \node[state] (A1) [below left of=B0] {$A_1$}; + \node[state] (A2) [below of=A1] {$A_3$}; + \node[state] (B1) [below right of=B0] {$B_2$}; + \node[state] (S1) [below of=B1] {$S_1$}; + \node[state] (S2) [below left of=S1] {$S_2$}; + \node[state] (R2) [below left of=A2] {$R_2$}; + \node[state] (R1) [below right of=S1] {$R_1$}; + + \path[->] + (B0) edge node {} (A1) + edge node {$X_1$} (B1) + (A1) edge node {$X_2$} (A2) + (A2) edge [bend left=25] node {$\tau$} (A1) + edge node {$C_1$} (S2) + edge [bend right=15] node {$D$} (B0) + (B1) edge [bend left=20] node {$\tau$} (B0) + edge node {$X_3$} (S1) + (S1) edge [bend left=15] node {$\tau$} (B0) + edge node {$C_2$} (S2) + (S2) edge node {$\tau$} (R1) + edge node {$K_1$} (R2) + (R1) edge [bend left] node {$K_1$} (R2) + edge node {$K_2$} (S1) + edge [bend right=50] node {$\tau$} (B0) + (R2) edge [bend left=25] node {$C_1$} (S2) + edge [bend left=50] node {$\tau$} (B0); + \end{tikzpicture} +\end{figure} + + +\begin{definition}[The Zeta State Machine, $\zeta$]\label{def:state_machine} + We are going to extend $\beta$ with behaviors and rules that cannot be modelled adequately by DFAs. This new, extended machine will be referred to as $\zeta$, the Zeta state machine. $\zeta$ will retain the core states, alphabet, transition function and initial state as $\beta$, but we are going to add the ability for $\zeta$ to establish a session, send a remote peer encrypted packets, and to process incoming packets. + + $\bot$ is treated as a unique, nondeterministic state within $\zeta$. Internally, $\zeta$ is always in the $\bot$ state. Whenever an input is received that would cause a transition out of the $\bot$ state, $\zeta$ will stay in the $\bot$ state, but spawn a copy of itself that is initialized to the correct transition state, either $A_1$ or $B_2$. If this new instance of $\zeta$ enters the $\bot$ state, it will be deleted from memory. The original $\zeta$ will still exist in the $\bot$ state, ready to spawn more copies. This is directly analogous to a nondeterministic transition within an NFA. This is how ZKE handles multiple session to a single peer, each session can be considered its own independent instance of the $\zeta$ state machine, running concurrently with each other. If we are only interested in considering one session to one peer, we can safely ignore this rule. + + When $\zeta$ is in a particular state, it chooses specific packet types from the alphabet to send to the remote peer. The remote peer will also be represented by a separately running instance of $\zeta$. When a peer successfully receives a packet, it feeds as input to $\zeta$ and possibly trigger a transition of state. Below is the list of what packet $\zeta$ sends based on which state it is in. + \begin{itemize} + \item When entering state $A_1$, packet $X_1$ is created and sent. + \item When entering state $B_2$, packet $B_2$ is created and sent. + \item When entering state $A_3$, packet $X_3$ is created and sent. + \item When entering state $S_1$, packet $D$ or $C_1$ is created and sent. + \item In state $S_2$, no packet is sent. + \item When entering state $R_1$, packet $K_1$ is created and sent. + \item When entering state $R_2$, packet $K_2$ is created and sent. + \end{itemize} + \sectionref{sec:trans_alg} discusses how these packets are structured, and what algorithms are used to create and process each packet. + + $\zeta$ has a timer system to automatically and locally trigger state transitions or packet resends. This system exists primarily as a solution to the ``two generals problem''. Since ZKE assumes a out-of-order, lossy transport environment it is necessary to have a system of resending lost messages and timing out those resends, similar to TCP. The ZKE timer system is designed to be lightweight, security focused, and simple. It provides strong guarantees about the maximum amount of time that may pass until certain security critical events, such as completing a handshake or ratcheting a session key, must occur. + + We assume that the underlying computer running $\zeta$ exposes some mechanism for creating a \emph{timer} which can be \emph{set} to some amount of time, and the computer will \emph{trigger} the timer after approximately that amount of real time has passed. + \begin{itemize} + \item $\zeta$ runs a single timeout timer that starts whenever any state other than $\bot$ is entered. If any state transition occurs this timer is reset to a new amount of time. If this timer is triggered before a state transition occurs, $\zeta$ gives $\tau$ as input to $\beta$. The timeout timer must never be reset or modified outside of a state transition. + \item States $A_1$, $B_2$ and $A_3$ always set their timeout timer to 10 seconds. + \item States $S_1$, $R_1$ and $R_2$ always set their timeout timer to 1 minute. + \item State $S_2$ sets its timeout timer to a uniform random number in the range 50 minutes to 1 hour. This amount of time is randomly generated each time $\zeta$ enters state $S_2$. + \item In states $A_1$, $A_3$, $S_1$, $R_1$ and $R_2$, $\zeta$ runs an additional ``resend timer''. Whenever this timer triggers, a copy of the respective packet this state generated is sent, and the resend timer is reset. Packets $C_1$, $K_1$ and $K_2$ are re-encrypted under the key exchange key \texttt{kek}, and a fresh encryption counter. States $B_2$ and $S_2$ do not have a resend timer and do not resend packets. The resend timer is always set to 1 second. + \item Any state may trigger timeout early for any reason. In particular it is recommended to timeout state $B_2$ early if memory is being filled with unfinished handshakes. This prevents memory exhaustion attacks. + \end{itemize} + The timer system has the property that all timers are generated locally, checked locally, and are never sent ``over the wire''. This has the advantage of making it difficult to impossible for a remote attacker to manipulate a peer's timers. The system has also been intentionally designed to make it impossible for $\zeta$ to ever get indefinitely stuck in one state. If it could, it would open up the possibility that an attacker could intentionally cause this to happen, which would be a form of a DOS attack. The rekeying timer for state $S_1$ is randomized to deter traffic analysis of ZSSP, and to prevent peers from simultaneously entering state $R_1$, which would be redundant and inefficient. + + It is important to note from this definition that there is no such thing as a ``heartbeat'' in ZKE, nor ZSSP as a whole. ZKE, on its own, does not require ``keep-alive'' messages to be periodically sent between peers. Instead, the only packets ZKE will automatically send are those which are strictly necessary to maintain strong forward secrecy. This makes ZKE ideal for applications where silence is considered a virtue. It is up to the upper protocol to implement a heartbeat or keep-alive system if it is deemed necessary. + + $\zeta$, being a cryptographic protocol, also has many rules relating to how it must cryptographically process incoming or outgoing packets, and how those packets can influence state transitions of $\beta$. Below is a numbered list of all of these rules. + \begin{enumerate} + \item Several transitions within $\beta$ have a corresponding algorithm $\zeta$ computes. These are described in \sectionref{sec:trans_alg}. When a transition begins, $\zeta$ computes the corresponding algorithm, and it only allows $\beta$ to transition state if all authentication steps within this algorithm succeed. + \item If authentication fails specifically during the execution of the Noise XK or Noise KK handshake, this must immediately trigger timeout, $\tau$. Any other form of authentication failure will cause the corresponding packet to be ignored, as if it had never been received. + \item When transition $\delta(A_1, \tau)=A_1$ or $\delta(A_3, \tau)=A_1$ occurs, $\zeta$ generates a new $X_1$ packet, and does not reuse the previous $X_1$ packet. + \item The transition, $\delta(R_1, K_1)=R_2$, is only allowed to occur if $\zeta$ acted as Bob, the responder, in the initial Noise XK handshake (i.e. if $\zeta$ has previously been in the $B_2$ state). + \item If $\zeta$ receives a valid $C_1$ packet while in state $S_1$, $S_2$, $R_1$ or $R_2$, $\zeta$ will reply with a new $C_2$ packet encrypted under the most recently created key exchange key, \texttt{kek}. + \item $\zeta$ may only send data transport packets on behalf of the upper protocol when in states $S_1$, $S_2$, $R_1$ and $R_2$. + \item If $2^{30}$ or more data transport packets are sent using the same transport key, and $\zeta$ is in state $S_2$, then timeout is triggered early. If $2^{32} - 1$ data transport packets are sent using the same transport key then $\beta$ receives as input symbol $\chi$, which is to say it immediately transitions to state $\bot$ and ends the session. + \end{enumerate} +\end{definition} + +It is not immediately clear why some of the rules in the above list exist, nor what function they might serve in the protocol. For that reason, below is a list of explanations for each processing rule. They are numbered by which rule they are explaining, respectively. Some of these explanation are discussed in further detail in other sections. +\begin{enumerate} + \item This rule should be fairly self explanatory, in order to provide security ZKE must do authenticated encryption, particularly the authenticated encryption required by the Noise protocol. + \item This is to conform to the Noise protocol's requirement that the handshake be aborted in the event either peer fails authentication during the handshake. Other than that we want to obey the security principle that inauthentic packets should not trigger any change in state. + \item This rule serves a few functions. First and foremost it guarantees that when a handshake is unsuccessful for whatever reason, both Alice and Bob will generate new ephemeral keys. This prevents identical key material from being derived, reducing the risk of catastrophic key reuse. Due to the timer system, this also imposes a strict time limit upon any MitM attack that relies upon intercepting Alice's initial packet. Secondarily, regenerating the $X_1$ packet also regenerates a special nonce value that is used by the ZeroTier Fragmentation Protocol to provide DOS protection. + \item This is to ensure only one peer can enter state $R_2$ at a time, guaranteeing the other peer stays in state $R_1$. Essentially this rule makes it impossible for both peers to act as Bob at the same time in a Noise KK handshake, which would lock-up a session if it were allowed to happen. + \item The remote peer will continue to resend $C_1$ packets until it receives a $C_2$ packet. Since $C_2$ packets are not resent, they have to be sent as an acknowledgement packet to every received $C_1$ packet. Otherwise the remote peer might never transition to state $S_2$. + \item Data transport clearly cannot occur in states $\bot$, $A_1$ and $B_2$, because no Noise key has been established. Alice does obtain a Noise key when they enter state $A_3$. However, for reliability, we want to give Bob an opportunity to refuse connection with Alice based on their static key and identity, and we want to make sure out of order data will be decryptable by Bob. For the sake of improved forward secrecy, we also want to make sure both parties have confirmed a new ratchet fingerprint and ratchet key before they begin communicating. Otherwise, by preventing Bob from ever receiving packet $X_3$, an attacker can cause Alice and Bob to always use the same ratchet key. + \item This is to conform with NIST's requirement that an AES-GCM key never be used more than $2^{32}$ times. It also avoids AES-GCM's weakening security when a large volume of data is encrypted. +\end{enumerate} + +\subsection{Background} + +The following are the 4 cryptographic primitives ZKE is based upon. We will be abbreviating these algorithms with generic notation in the sections that follow, notation that is defined here. + +\newcommand{\HASH}{\algn{HASH}} +\newcommand{\KDF}{\algn{KDF}} +\newcommand{\AEAD}{\algn{AEAD}} +\newcommand{\DHGEN}{\algn{DH-Gen}} +\newcommand{\KEMGEN}{\algn{KEM-Gen}} +\newcommand{\KEMENC}{\algn{KEM-Enc}} +\newcommand{\KEMDEC}{\algn{KEM-Dec}} +\newcommand{\COUNTER}{\algn{Count}} +\newcommand{\KID}{\algn{KID-Gen}} + +\begin{definition}[SHA-512 \cite{fips_sha2}] + Let $\HASH(M)$ be the SHA-512 hashing algorithm, where $M$ is the string input to be hashed. It has a 512-bit output. +\end{definition} + +\begin{definition}[KBKDF \cite{fips_kbkdf}] + Let $\KDF(\textit{K}_{\textit{IN}}, \textit{Label}, \textit{Context}, N)$ be the KBKDF key derivation algorithm, instantiated in HMAC-Counter mode using SHA-512. Variable $\textit{K}_{\textit{IN}}$ is the input key material, $\textit{Label}$ is some static label, $\textit{Context}$ is additional input key material, and $N$ is the number of 512-bit outputs to be produced. $\KDF(\textit{K}_{\textit{IN}}, \textit{Label}, \textit{Context}, N)$ produces as output $(x_1,\ldots,x_N)$, a tuple of $N$ 512-bit outputs. + + Given $i\in \{1,\ldots,N\}$, we will use the notation $\KDF(\textit{K}_{\textit{IN}}, \textit{Label}, \textit{Context}, N)_i$ to refer to the $i$th output of $\KDF$. When assigning a single 512-bit output to a variable or field that is 256-bits in size, it is assumed that the output is being truncated to just the first 256-bits. + + So $k\gets \KDF(x, l, y, 3)_2$ represents computing KBKDF on inputs $\textit{K}_{\textit{IN}}= x,\, \textit{Label}=l,\, \textit{Context}=y$ and $L=3\cdot 512$, and setting variable $k$ equal to bits $512$ to $1023$ of the output. If $k$ is a variable of size 256-bits, then $k$ is set equal to bits $512$ to $767$ of the output. +\end{definition} + +\begin{definition}[AES-GCM \cite{fips_aesgcm}] + Let $\AEAD(K, N, H, M)$ be the AES-GCM Authenticated Encryption with Additional Data algorithm, where $K$ is the encryption key, $N$ is the nonce or IV, $H$ is the additional authentication data, and $M$ is the plaintext message to be encrypted. $\AEAD(K, N, H, M)$ produces as output $c||t$, a ciphertext, $c$, concatenated with its 128-bit (16 byte) authentication tag, $t$. +\end{definition} + +\begin{definition}[P384 \cite{fips_p384}] + Let $\DHGEN()$ be the P384 elliptic curve Diffie-Helman key generation algorithm. $\DHGEN()$ outputs a random keypair, $(x, g^x)$, where $x$ is the private key and $g^x$ is the public key. $g$ is the generator of the P384 elliptic curve group. +\end{definition} + +Given $(x, g^x)$ and $(y, g^y)$, two output keypairs from $\DHGEN()$, a \emph{key agreement} between these keys can be performed by computing $(g^x)^y$ or $(g^y)^x$. It is the case that $(g^x)^y=(g^y)^x=g^{xy}$. This value, $g^{xy}$, is considered the output key material of Diffie-Helman key agreement. + +\begin{definition}[Kyber1024 \cite{kyber}] + Let $(\KEMGEN, \KEMENC, \KEMDEC)$ be the Kyber1024 key encapsulation mechanism. $\KEMGEN()$ randomly generates a keypair, $(e_{priv}, e_{pub})$, where $e_{priv}$ is the private key and $e_{pub}$ is the public key. $\KEMENC(e_{pub})$ takes as input a Kyber1024 public key, and outputs the pair $(e_{key}, e_{kem})$, where $e_{key}$ is the symmetric key and $e_{kem}$ is the encapsulated ciphertext of $e_{key}$. $\KEMDEC(e_{priv}, e_{kem})$ takes as input a private key and an encapsulated ciphertext, and outputs $e_{key}$, the decryption of $e_{kem}$. Both \KEMENC and \KEMDEC can output $\bot$, the null value, which implies authentication failure due to invalid input keys. +\end{definition} + +\subsection{Transition Algorithms}\label{sec:trans_alg} + +With the necessary background established, we can now define the final component of the Zeta state machine, the state transition algorithms. As is described in \definitionref{def:state_machine}, each state transition within $\zeta$ has a corresponding algorithm that must be computed. All of these algorithms are described in this section. They have access to a collection of global variables, defined below. + +\begin{itemize} + \item Persistent ratchet keys $\texttt{rk}_1, \texttt{rk}_2$, to be used as a handshake PSK + \item Persistent ratchet fingerprints $\texttt{rf}_1, \texttt{rf}_2$, to identify a particular ratchet key + \item Long term static keypairs $(u, g^u)$ and $(v, g^v)$ + \item Short term randomized key identifiers $\texttt{kid}^\texttt{i}_1, \texttt{kid}^\texttt{i}_2$, to be used for multiplexing between multiple peers + \item Short term key exchange keys $\texttt{kek}^\texttt{i}_1, \texttt{kek}^\texttt{i}_2$, for authenticating key confirmations and rekeying + \item Short term Noise transport keys $\texttt{nk}^\texttt{i}_1, \texttt{nk}^\texttt{i}_2$, for AEAD encryption of data transport packets + \item Short term header keys $\texttt{hk}_1, \texttt{hk}_2$, to be used by the ZeroTier fragmentation protocol + \item Ephemeral keypairs $(x, g^x)$ and $(y, g^y)$ + \item Ephemeral key encapsulation variables $e_{priv}, e_{pub}, e_{key}$ and $e_{kem}$ + \item Ephemeral Noise chaining keys, $c$ and $c'$ + \item Ephemeral Noise encryption keys, $k$ and $k'$ + \item Ephemeral Noise handshake hashes, $h$ and $h'$ + \item Temporary ratchet key and fingerprint $\texttt{rk}'\andb \texttt{rf}'$, used so Bob can complete Noise XK before knowing Alice's identity. + \item Role identifier $\texttt{r}$, used so peers are aware whether they were Alice or Bob in Noise XK + \item Comfirmed key index $\texttt{i}$, used so peers know the most recently confirmed Noise key. +\end{itemize} + +All of these variables are independent \emph{per instance of} $\zeta$. So each instance of $\zeta$ stores a unique and independent set of these variables, and they are never shared between separate instances of $\zeta$. The persistent state variables $\texttt{rk}$ and $\texttt{rf}$ are a partial exception to this rule, as they can be accessed by multiple instances of $\zeta$ over time. However each of these instances must be associated with a single, unique remote peer, and two instances of $\zeta$ must never access the same set of persistent state variables at the same time. + +What constitutes a ``single, unique remote peer'' is up to the upper protocol to decide. Usually remote peers are identified and differentiated by their static public keys ($g^u$ or $g^v$). However ZKE does not strictly enforce a one-to-one relationship between static public keys and identity specifically so the upper protocol is able to rotate the static public keys of peers. + +\begin{definition}[Session Counter] + Every instance of $\zeta$ contains a single monotonically increasing counter, that is initialized to 0. We will use the notation $\COUNTER()$ to represent incrementing this counter by 1 and returning the previous counter value. + + So the very first call to $\COUNTER()$ within $\zeta$ will return 0, the second call will return 1, and so on. + + It is assumed that that output of $\COUNTER()$, the counter value, will be used as an AES-GCM nonce. When a remote peer decrypts an AES-GCM ciphertext that uses a counter value nonce, they must first statefully check that this counter has never been received before, and fail authentication if it has been replayed. +\end{definition} + +ZKE uses a 64-bit (8 byte) counter, but AES-GCM uses a 96-bit (12 byte) nonce/IV. The Noise protocol does specify that, in order to use a counter value as an AES nonce, it should be encoded as a big-endian integer with 4 bytes of zero padding to the left of it. However, for good reason, we have decided to utilize the rightmost byte of that 4 byte padding to store the packet type number, as depicted in \figureref{fig:nonce}. This accomplishes two goals. First it explicitly authenticates the packet type of a packet, which makes it infeasible for an attacker to change the packet type field of a header without triggering an authentication failure. We could have used the additional authentication data parameter of AES-GCM to accomplish this, but the Noise protocol already makes extensive use of this parameter. Second, this nonce construction reduces the risk of catastrophic nonce reuse due to implementation error, specifically during key exchanges. While a correctly implemented counter would be sufficient for security, this adds an extra layer of defence. Given a packet type number $p$, and a counter value $c$, we will use the notation $p||c$ to represent this nonce construction. + +\begin{figure} + \caption{Construction of the AES-GCM 96-bit nonce/IV.}\label{fig:nonce} + \centering + \begin{bytefield}[bitwidth=3.5em]{10} + \bitbox{3}{\texttt{0x000000} (3 bytes)} & + \bitbox{2}{\texttt{type} (1 byte)} & + \bitbox{6}{\texttt{counter} (big-endian 64-bit integer)} + \end{bytefield} +\end{figure} + +\begin{definition}[Key Id Generation] + \algn{KID-Gen} is a stateful algorithm that outputs a locally unique, uniform random 32-bit string. The output of this algorithm will be used as the \emph{key id} for a session key, allowing the local peer to multiplex many keys for many remote peers simultaneously. The output of $\algn{KID-Gen}()$ must be locally unique from all other key ids currently in use. $\algn{KID-Gen}()$ may only repeat an output if that output is currently not being used as a key id. +\end{definition} + + +\begin{definition}[Persistent State] + The variables $\texttt{rk}$ and $\texttt{rf}$ are considered the \emph{persistent state} of ZKE. The values stored in these variables are not lost when a session ends, and can be \emph{restored} at any time to initiate a new session. + + $\texttt{rk}$ is a tuple of up to two 256-bit \emph{ratchet keys}. Similarly, $\texttt{rf}$ is a tuple of up to two 256-bit \emph{ratchet fingerprints}. $\texttt{rk}$ is initialized to $(0^{256}, \bot)$ and $\texttt{rf}$ is initialized to $(\varepsilon, \bot)$. + + If two peers are in persistent mode, and wish to connect for the first time, they may use a preshared one time password, $p$, to do so. $p$ should be a randomized string, and it must not be correlated with the identity of either peer. If a one time password is being used then $r\gets \KDF(p, \texttt{"ZSSP\_OTP\_TO\_RATCHET"}, \varepsilon, 2)$ must be computed. Both peers then initialize $\texttt{rk}$ to $(r_1, \bot)$ and $\texttt{rf}$ to $(r_2, \bot)$. +\end{definition} + +$\bot$ represents the ``null'' value. When a variable is set to $\bot$, it means whatever was previous stored within the variable is being permanently deleted from memory. All variables are initialized to $\bot$ unless otherwise stated. $\varepsilon$ is the empty string. + +It is assumed that prior to any usage of ZKE, Alice and Bob will generate their static keypairs with $\DHGEN()$. It is also assumed that Alice already knows Bob's public key, $g^v$, prior to any attempt to connect to Bob. Bob does not necessarily know Alice's public key. + +\begin{table} + \caption{Intermediate Values of the Noise XKhfs+psk2 and the Noise KKpsk0 Handshakes \cite{noise_protocol} \cite{noise_hfs} -- $(u, g^u)$ and $(v, g^v)$ are respectively the static keypairs of Alice and Bob within \emph{the current Noise handshake}, and the label $L=\texttt{"ZSSP"}$. The ciphertext of packets is hashed and not the plaintext. The following transition algorithms implicitly compute and have access to the values described here. This syntax for defining cryptographic variables comes from Benjamin Dowling et.~al.~\cite{wireguard_analysis}} + \centering + \renewcommand{\arraystretch}{1.05} + \begin{tabular}{ | c | c | c | c | } + \hline + $i$ & Chaining Key, $c_i$ & Encryption Key, $k_i$ & Handshake Hash, $h_i$ \\ + \hline + 0 & $\texttt{protocol\_name}$ & - & $\texttt{protocol\_name}$ \\ + 1 & - & - & $\HASH(h_0||\texttt{kid}_1)$ \\ + 2 & - & - & $\HASH(h_1||g^v)$ \\ + 3 & $\KDF(g^x, L, c_0, 2)_1$ & - & $\HASH(h_2||g^x)$ \\ + 4 & $\KDF(g^{xv}, L, c_3, 2)_1$ & $\KDF(g^{xv}, L, c_3, 2)_2$ & - \\ + 5 & - & - & $\HASH(h_3||X_1\texttt{.e1})$ \\ + 6 & - & - & $\HASH(h_4||X_1\texttt{.rf})$ \\ + \hline + 7 & $\KDF(g^y, L, c_4, 2)_1$ & - & $\HASH(h_6||g^y)$ \\ + 8 & $\KDF(g^{xy}, L, c_7, 2)_1$ & $\KDF(g^{xy}, L, c_7, 2)_2$ & - \\ + 9 & $\KDF(e_{key}, L, c_8, 2)_1$ & - & $\HASH(h_7||X_2\texttt{.ekem1})$ \\ + 10 & $\KDF(\texttt{rk}', L, c_9, 3)_1$ & $\KDF(\texttt{rk}', L, c_9, 3)_3$ & $\HASH(h_9||\KDF(\texttt{rk}', L, c_9, 3)_2)$ \\ + 11 & - & - & $\HASH(h_{10}||X_2\texttt{.key\_id})$ \\ + \hline + 12 & - & - & $\HASH(h_{11}||X_3\texttt{.s})$ \\ + 13 & $\KDF(g^{uy}, L, c_{10}, 2)_1$ & $\KDF(g^{uy}, L, c_{10}, 2)_2$ & - \\ + 14 & - & - & $\HASH(h_{12}||X_3\texttt{.identity})$ \\ + \hline + \hline + $i$ & Chaining Key, $c_i'$ & Encryption Key, $k_i'$ & Handshake Hash, $h_i'$ \\ + \hline + 0 & $\texttt{protocol\_name}'$ & - & $\texttt{protocol\_name}'$ \\ + 1 & - & - & $\HASH(h_0'||g^u)$ \\ + 2 & - & - & $\HASH(h_1'||g^v)$ \\ + 3 & $\KDF(\texttt{rk}_1, L, c_0', 3)_1$ & - & $\HASH(h_2'||\KDF(\texttt{rk}_1, L, c_0', 3)_2)$ \\ + 4 & $\KDF(g^x, L, c_3', 2)_1$ & - & $\HASH(h_3'||g^x)$ \\ + 5 & $\KDF(g^{xv}, L, c_4', 2)_1$ & - & - \\ + 6 & $\KDF(g^{uv}, L, c_5', 2)_1$ & $\KDF(g^{uv}, L, c_5', 2)_2$ & - \\ + 7 & - & - & $\HASH(h_4'||K_1\texttt{.key\_id})$ \\ + \hline + 8 & $\KDF(g^y, L, c_6', 2)_1$ & - & $\HASH(h_7'||g^y)$ \\ + 9 & $\KDF(g^{xy}, L, c_8', 2)_1$ & - & - \\ + 10 & $\KDF(g^{uy}, L, c_9', 2)_1$ & $\KDF(g^{uy}, L, c_9', 2)_2$ & - \\ + 11 & - & - & $\HASH(h_8'||K_2\texttt{.key\_id})$ \\ + \hline + \end{tabular} +\end{table} + +We will not be going into detail how each packet is decrypted. All decryption within ZKE is either a straightforward implementation of Noise XK and Noise KK decryption, or otherwise a trivial application of AEAD decryption using AES-GCM. We will be assuming each packet is decrypted in-place, as in we will be reusing the local variable that referred to the encrypted packet to also refer to the decrypted packet. + +If packet decryption fails because the AEAD MAC is inauthentic, this is considered authentication failure. Unless otherwise stated, if authentication fails all of the following algorithms immediately cease execution and returns an authentication failure error. + +Prior to the execution of any of the following algorithms, $\zeta$ will check if it is in the correct state, if it is allowed to perform the related state transition, that the received key id matches the expected key id, and that the packet has the correct type number. If any of these checks fail execution is aborted and the packet is ignored. + +\begin{algorithm}\label{alg:x1} + \caption{Transition $\delta(\bot, \tau)=A_1$ -- Alice creates and sends a ``Hello'' packet to initialize a session with Bob, \figureref{packet:handshake_hello}. Alice knows Bob's static public key, $g^v$, prior to execution. By sending a Hello packet to Bob, Alice is implicitly trusting Bob.} + \begin{algorithmic} + \Require $g^v$ + \State $\textbf{Restore } (\texttt{rk}, \texttt{rf}) \text{ based on Bob's identity}$ + \State $(x, g^x) \gets \DHGEN()$ + \State $(e_{priv}, e_{pub}) \gets \KEMGEN()$ + \State $\texttt{kid}^1_1 \gets \KID()$ + \State $X_1\texttt{.key\_id} \gets \texttt{kid}^1_1$ + \State $X_1\texttt{.e} \gets g^x$ + \State $X_1\texttt{.e1} \gets \AEAD(k_4, 0||0, h_3, e_{pub})$ + \State $X_1\texttt{.rf} \gets \AEAD(k_4, 0||1, h_5, \texttt{rf})$ + \State $\texttt{hk} \gets \KDF(h_6, \texttt{"ASKH"}, c_4, 2)$ + \State $c \gets X_1\texttt{.rf\_tag}\ \text{(last 8 bytes)}$ + \State $\textbf{Send } (0,\ 0||c,\ X_1)$ + \end{algorithmic} +\end{algorithm} + +The ratchet fingerprint, \texttt{rf}, is a sacrificial ASK that does nothing more than uniquely identify the ratchet key it was derived with. This makes it possible for Bob to immediately identify Alice given just their Hello packet, if their Hello includes a ratchet fingerprint. Bob can configure ZKE to only reply to peers that have recognized ratchet fingerprints, thereby making ZKE entirely silent to everyone who does not have an authentic ratchet fingerprint. An attacker can record an authentic peer's Hello packet and replay it, but Bob will only reply to this replayed packet for a short period of time, until that ratchet fingerprint is replaced. This is superior to Noise XK's normal Hello packet security properties, which have no authentication and are vulnerable to replay. + +Including the ratchet fingerprint in the Hello packet does not compromise identity hiding, because the ratchet fingerprint is replaced with every single handshake. In the event that Bob's private keys are compromised, and all ratchet fingerprints used in Hello packets to Bob can be decrypted, all an attacker would see are several indistinguishable 256-bit strings. The one exception is if a peer reuses the same ratchet fingerprint. This would allow an attacker who has compromised Bob's static private key to learn that two Hello packets come from the same peer, but this does not given any information about that peer's static keys or identity. Ratchet fingerprints in normal operation are never reused, this can only happen if the initial Noise XK handshake is aborted before completion, preventing one or more of the participating peers from confirming a new ratchet fingerprint. + +\begin{algorithm} + \caption{Transition $\delta(\bot, X_1)=B_2$ -- Bob has received Alice's Hello packet and replies with the second message of Noise XK, \figureref{packet:handshake_response}. Input $\pi_1$ is a security flag, a bit set by the upper protocol. Bob will only allow Alice to connect with zero persistent state if $\pi_1=0$. If Alice sent an unrecognized ratchet fingerprint and $\pi_1=0$, instead of rejecting Alice's session, Bob will ask Alice if they would like to connect with zero persistent state. ZKE has superior security properties when $\pi_1=1$, but usability suffers.}\label{alg:recv_x1} + \begin{algorithmic} + \Require $(0,\ 0||c,\ X_1),\, \pi_1,$ + \If{$c \neq X_1\texttt{.rf\_tag}$ (last 8 bytes)} + \State \textbf{Fail authentication} + \EndIf + \State $\textbf{Decrypt } X_1$ according to Noise XK + \State $\texttt{rf}' \gets X_1\texttt{.rf}_1$ + \State $\textbf{Restore } \texttt{rk}' \text{ based on } \texttt{rf}'$ + \If{$\texttt{rk}' = \bot$} + \State $\texttt{rf}' \gets X_1\texttt{.rf}_2$ + \State $\textbf{Restore } \texttt{rk}' \text{ based on } \texttt{rf}'$ + \If{$\texttt{rk}' = \bot$} + \If{$\pi_1=1$} + \State \textbf{Fail authentication} + \Else + \State $\texttt{rf}' \gets \varepsilon$ + \State $\texttt{rk}' \gets 0^{256}$ + \EndIf + \EndIf + \EndIf + \State $\texttt{hk} \gets \KDF(h_6, \texttt{"ASKH"}, c_4, 2)$ + \State $\texttt{kid}^1_1 \gets X_1\texttt{.key\_id}$ + \State $\texttt{kid}^1_2 \gets \KID()$ + \State $(y, g^y) \gets \DHGEN()$ + \State $(e_{key}, e_{kem}) \gets \KEMENC(e_{pub})$ + \State $X_2\texttt{.e} \gets g^y$ + \State $X_2\texttt{.ekem1} \gets \AEAD(k_8, 1||0, h_7, e_{kem})$ + \State $X_2\texttt{.key\_id} \gets \AEAD(k_{10}, 1||0, h_{10}, \texttt{kid}^1_2)$ + \State $c \gets X_2\texttt{.key\_id\_tag}\ \text{(last 3 bytes)}$ + \State $\textbf{Send } (\texttt{kid}^1_1,\ 1||c,\ X_2)$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{Transition $\delta(A_1, X_2)=A_3$ -- Alice has received Bob's reply and can now send a Handshake Completion packet, \figureref{packet:handshake_complete}. Input $\pi_2$ is a security flag, a bit set by the upper protocol. Bob may ask Alice if they would like to connect with zero persistent state instead of the current persistent state. If $\pi_2=0$ then Alice will accept this request, and reset their ratchet keys. Input \texttt{identity} is an arbitrary string provided by the upper protocol. It is expected to contain some form of cryptographic identifier or certificate for this peer, but it could also be the empty string.}\label{alg:recv_x2} + \begin{algorithmic} + \Require $(\texttt{kid}^1_1,\ 1||c,\ X_2),\, \pi_2,\, \texttt{identity}$ + \If{$c \geq 2^{24} \orb c \neq X_2\texttt{.key\_id\_tag}$ (last 3 bytes)} + \State \textbf{Fail authentication} + \EndIf + \State $\textbf{Decrypt } X_2$ according to Noise XK using PSK $\texttt{rk}_1$ + \State $i \gets 1$ + \If{$X_2$ failed authentication} + \State $\textbf{Decrypt } X_2$ according to Noise XK using PSK $\texttt{rk}_2$ + \State $i \gets 2$ + \If{$X_2$ failed authentication} + \If{$\pi_2=1$} + \State \textbf{Fail authentication} + \Else + \State $\textbf{Decrypt } X_2$ according to Noise XK using PSK $0^{256}$ + \State \textbf{Warn} the upper protocol that Bob does not have the ratchet key + \EndIf + \EndIf + \EndIf + \State $\texttt{kid}^1_2 \gets X_2\texttt{.key\_id}$ + \State $X_3\texttt{.s} \gets \AEAD(k_{10}, 2||1, h_{11}, g^u)$ + \State $X_3\texttt{.identity} \gets \AEAD(k_{13}, 2||0, h_{12}, \texttt{identity})$ + \State $\texttt{kek}^1 \gets \KDF(h_{14}, \texttt{"ASKK"}, c_{13}, 2)$ + \State $\texttt{nk}^1 \gets \KDF(\varepsilon, L, c_{13}, 2)$ + \State $(\texttt{rk}_2, \texttt{rf}_2) \gets (\texttt{rk}_i, \texttt{rf}_i)$ + \State $(\texttt{rk}_1, \texttt{rf}_1) \gets \KDF(h_{14}, \texttt{"ASKR"}, c_{13}, 2)$ + \State $\texttt{r} \gets 1$ + \State $\texttt{i} \gets 0$ + \State $\textbf{Send } (\texttt{kid}^1_2,\ 2||0,\ X_3)$ + \end{algorithmic} +\end{algorithm} + +Packet types $X_2$ and $K_1$ represent the second to last message of Noise XK and Noise KK. The remote peer will not have derived the Noise key yet, so if this peer attempted to encrypt with this key immediately, there is a risk its packets will arrive out of order and be undecryptable. Receiving a valid $C_1$ packet from the remote peer confirms that they have successfully derived the correct Noise key, which signals it can now be reliably used for encryption. + +Similarly, the new ratchet key and fingerprint will not have been derived by the remote peer yet. So this peer will have to save these keys to persistent storage, but not yet delete the previous ratchet key and fingerprint until the remote peer sends a key confirmation. This means that for a brief period of time Alice has two sets of ratchet keys and fingerprints saved, instead of just one. We want to make sure Alice and Bob never have more than two of these keys saved at a time. So during the Noise XK handshake if Alice has two sets of keys and fingerprints, they must send both fingerprints to Bob, and delete the key and fingerprint that Bob chooses not to use as the PSK. + +\begin{algorithm} + \caption{Transition $\delta(B_2, X_3)=S_1$ -- Bob receives the final packet of Noise XK. Input $\algn{Accept}$ is a function provided by the upper protocol that takes as input Alice's identity and outputs security flags $(\pi_3, \pi_4)$, $\pi_3$ can be $\bot$. If $\pi_3=\bot$, Bob will reject Alice's session. If $\pi_3=1$, and Bob is aware of a ratchet key Alice should have, but Alice is not connecting with it, Bob will reject Alice's session (similar to when $\pi_2=1$). If Bob rejects Alice's session and $\pi_4 = 0$, Bob will send a packet to Alice explicitly rejecting their session.}\label{alg:recv_x3} + \begin{algorithmic} + \Require $(\texttt{kid}_2,\ 2||0,\ X_3),\,\algn{Accept}$ + \State $\textbf{Decrypt } X_3$ according to Noise XK + \State $\texttt{kek}^1 \gets \KDF(h_{14}, \texttt{"ASKK"}, c_{13}, 2)$ + \State $c \gets \COUNTER()$ + \State $(\pi_3, \pi_4) \gets \algn{Accept}(X_3\texttt{.s}, X_3\texttt{.identity})$ + \If{$\pi_3 \neq \bot$} + \State $\textbf{Restore } (\texttt{rk}, \texttt{rf}) \text{ based on } (X_3\texttt{.s}, X_3\texttt{.identity})$ + \If{$(\texttt{rf}', \texttt{rk}') \neq (\texttt{rf}_1, \texttt{rk}_1) \andb (\texttt{rf}', \texttt{rk}') \neq (\texttt{rf}_2, \texttt{rk}_2)$} + \If{$\pi_3 = 0 \andb \texttt{rf}' = \varepsilon$} + \State \textbf{Warn} the upper protocol that Alice does not have the ratchet key + \Else + \If{$\pi_4 = 0$} + \State $D\texttt{.kek\_tag} \gets \AEAD(\texttt{kek}^1_1, 7||c, \varepsilon, \varepsilon)$ + \State $\textbf{Send } (\texttt{kid}_1,\ 7||c,\ D)$ + \EndIf + \State \textbf{Fail authentication} + \EndIf + \EndIf + \State $\texttt{nk}^1 \gets \KDF(\varepsilon, L, c_{13}, 2)$ + \State $(\texttt{rk}_2, \texttt{rf}_2) \gets \bot$ + \State $(\texttt{rk}_1, \texttt{rf}_1) \gets \KDF(h_{14}, \texttt{"ASKR"}, c_{13}, 2)$ + \State $\texttt{r} \gets 2$ + \State $\texttt{i} \gets 1$ + \State $C_1\texttt{.kek\_tag} \gets \AEAD(\texttt{kek}^1_1, 3||c, \varepsilon, \varepsilon)$ + \State $\textbf{Send } (\texttt{kid}_1,\ 3||c,\ C_1)$ + \Else + \If{$\pi_4=0$} + \State $D\texttt{.kek\_tag} \gets \AEAD(\texttt{kek}^1_1, 7||c, \varepsilon, \varepsilon)$ + \State $\textbf{Send } (\texttt{kid}_1,\ 7||c,\ D)$ + \EndIf + \State \textbf{Fail authentication} + \EndIf + \end{algorithmic} +\end{algorithm} + +When packet $X_3$ is received, Bob might refuse to start a session with Alice based on their static key and identity. The preferred way for Bob to do this is to simply do nothing, and ignore Alice's packets. This would follow the ``silence is a virtue" principle of security. However there are some applications where, usually for UX reasons, Alice needs to be able tell apart having a bad connection with Bob from Bob rejecting Alice's identity. If Bob always goes silent Alice has no reliable way to tell these two situations apart. Since both Bob and Alice have the key exchange key at this point in the handshake, it was a very natural and secure extension of the protocol to allow Bob to notify Alice that the session has been refused. + +Packet types $X_3$ and $K_2$ represent the final messages of Noise XK and Noise KK, respectively. The peer who receives these packets can be sure that the remote peer has derived an identical Noise key already, and so the new key can be reliably used immediately. + +\begin{algorithm} + \caption{Transition $\delta(A_3, C_1)=S_2$ and $\delta(R_2, C_1)=S_2$ -- A key confirmation for either the Noise XK initial handshake or Noise KK rekeying has been received. This peer must send an Acknowledgement, \figureref{packet:key_conf}, to let the remote peer know that it has been received.}\label{alg:key_conf} + \begin{algorithmic} + \Require $(\texttt{kid}^{\texttt{i} + 1}_{\texttt{r}},\ 3||c,\ C_1)$ + \State $\textbf{Decrypt } C_1$ using $\texttt{kek}^{\texttt{i} + 1}_{\texttt{r}}$ + \State $(\texttt{rk}_2, \texttt{rf}_2) \gets \bot$ + \State $\texttt{i} \gets \texttt{i} + 1$ + \State $c \gets \COUNTER()$ + \State $C_2\texttt{.kek\_tag} \gets \AEAD(\texttt{kek}^\texttt{i}_{3 - \texttt{r}}, 4||c, \varepsilon, \varepsilon)$ + \State $\textbf{Send } (\texttt{kid}^\texttt{i}_{3 - \texttt{r}},\ 4||c,\ C_2)$ + \end{algorithmic} +\end{algorithm} + +Packet types $C_2$ and $D$ have trivial transition algorithms. They merely decrypt the received packet with the most recent key exchange key, $\texttt{kek}^\texttt{i}_\texttt{r}$. If authentication succeeds then $\zeta$ transitions state. + +\begin{algorithm} + \caption{Transition $\delta(S_2, \tau)=R_1$ -- This peer, whom will be henceforth be referred to as Alice, has decided to initiate rekeying. They create and send a Rekey Initiation packet, \figureref{packet:rekey}, to the remote peer, Bob. The entire Noise KK message is encrypted under the key exchange key for additional security.} + \begin{algorithmic} + \State $\texttt{kid}^{\texttt{i} + 1}_\texttt{r} \gets \KID()$ + \State $(x, g^x) \gets \DHGEN()$ + \State $K_1\texttt{.e} \gets g^x$ + \State $K_1\texttt{.key\_id} \gets \AEAD(k_{6}', 5||0, h_{4}, \texttt{kid}^{\texttt{i} + 1}_\texttt{r})$ + \State $c \gets \COUNTER()$ + \State $K_1 \gets \AEAD(\texttt{kek}^\texttt{i}_{3 - \texttt{r}}, 5||c, \varepsilon, K_1)$ + \State $\textbf{Send } (\texttt{kid}^\texttt{i}_{3 - \texttt{r}},\ 5||c,\ K_1)$ + \end{algorithmic} +\end{algorithm} + + +\begin{algorithm} + \caption{Transition $\delta(S_2, K_1)=R_2$ and $\delta(R_1, K_1)=R_2$ -- Bob has received Alice's request to rekey and sends a Rekey Completion packet, \figureref{packet:rekey}, in reply. Bob has now finished Noise KK and has obtained a new Noise key. A new pair of key ids are generated so Bob can tell apart packets encrypted with the new key from those encrypted with the previous key.} + \begin{algorithmic} + \Require $(\texttt{kid}^\texttt{i}_\texttt{r},\ 5||c,\ K_1)$ + \State $\textbf{Decrypt } K_1$ using $\texttt{kek}^\texttt{i}_\texttt{r}$, and Noise KK + \State $\texttt{kid}^{\texttt{i} + 1}_{3 - \texttt{r}} \gets K_1\texttt{.key\_id}$ + \State $\texttt{kid}^{\texttt{i} + 1}_\texttt{r} \gets \KID()$ + \State $(y, g^y) \gets \DHGEN()$ + \State $K_2\texttt{.e} \gets g^y$ + \State $K_2\texttt{.key\_id} \gets \AEAD(k_{10}', 6||0, h_{8}, \texttt{kid}^{\texttt{i} + 1}_\texttt{r})$ + \State $c \gets \COUNTER()$ + \State $K_2 \gets \AEAD(\texttt{kek}^\texttt{i}_{3 - \texttt{r}}, 6||c, \varepsilon, K_2)$ + \State $\texttt{kek}^{\texttt{i} - 1} \gets \bot$ + \State $(\texttt{kek}^{\texttt{i} + 1}_{3 - \texttt{r}}, \texttt{kek}^{\texttt{i} + 1}_\texttt{r}) \gets \KDF(h_{11}', \texttt{"ASKK"}, c_{10}', 2)$ + \State $\texttt{nk}^{\texttt{i} - 1} \gets \bot$ + \State $(\texttt{nk}^{\texttt{i} + 1}_{3 - \texttt{r}}, \texttt{nk}^{\texttt{i} + 1}_\texttt{r}) \gets \KDF(\varepsilon, L, c_{10}', 2)$ + \State $(\texttt{rk}_2, \texttt{rf}_2) \gets (\texttt{rk}_1, \texttt{rf}_1)$ + \State $(\texttt{rk}_1, \texttt{rf}_1) \gets \KDF(h_{11}', \texttt{"ASKR"}, c_{10}', 2)$ + \State $\textbf{Send } (\texttt{kid}^\texttt{i}_{3 - \texttt{r}},\ 6||c,\ K_2)$ + \end{algorithmic} +\end{algorithm} + + +\begin{algorithm} + \caption{Transition $\delta(R_1, K_2)=S_1$ -- Alice has received Bob's reply and so can also finish Noise KK. They send a Key Confirmation, \figureref{packet:key_conf}, to signal the completion of the handshake. The second to last Noise key is deleted for forward secrecy.} + \begin{algorithmic} + \Require $(\texttt{kid}^\texttt{i}_\texttt{r},\ 6||c,\ K_2)$ + \State $\textbf{Decrypt } K_2$ using $\texttt{kek}^\texttt{i}_\texttt{r}$, and Noise KK + \State $\texttt{kid}^{\texttt{i} + 1}_{3 - \texttt{r}} \gets K_2\texttt{.key\_id}$ + \State $\texttt{kek}^{\texttt{i} - 1} \gets \bot$ + \State $(\texttt{kek}^{\texttt{i} + 1}_\texttt{r}, \texttt{kek}^{\texttt{i} + 1}_{3 - \texttt{r}}) \gets \KDF(h_{11}', \texttt{"ASKK"}, c_{10}', 2)$ + \State $\texttt{nk}^{\texttt{i} - 1} \gets \bot$ + \State $(\texttt{nk}^{\texttt{i} + 1}_\texttt{r}, \texttt{nk}^{\texttt{i} + 1}_{3 - \texttt{r}}) \gets \KDF(\varepsilon, L, c_{10}', 2)$ + \State $(\texttt{rk}_1, \texttt{rf}_1) \gets \KDF(h_{11}', \texttt{"ASKR"}, c_{10}', 2)$ + \State $\texttt{i} \gets \texttt{i} + 1$ + \State $c \gets \COUNTER()$ + \State $C_1\texttt{.kek\_tag} \gets \AEAD(\texttt{kek}^\texttt{i}_{3 - \texttt{r}}, 3||c, \varepsilon, \varepsilon)$ + \State $\textbf{Send } (\texttt{kid}^\texttt{i}_{3 - \texttt{r}},\ 3||c,\ C_1)$ + \end{algorithmic} +\end{algorithm} + +We want to minimize the number of Noise keys alive in memory for the sake of perfect forward secrecy, in case the content of a peer's memory is stolen by an attacker. However we have to keep at least the last 2 keys around for reliability. Otherwise a packet that was sent before rekeying could arrive out of order, after the rekey is completed, and not be decryptable. + +\begin{algorithm} + \caption{Data transport send -- The upper protocol has decided to send the remote peer an encrypted payload. Input \texttt{payload} is an arbitrary string provided by the upper protocol.} + \begin{algorithmic} + \Require $\texttt{payload}$ + \State $c \gets \COUNTER()$ + \State $P\texttt{.payload} \gets \AEAD(\texttt{nk}^\texttt{i}_{3 - \texttt{r}}, 8||c, \varepsilon, \texttt{payload})$ + \State $\textbf{Send } (\texttt{kid}^\texttt{i}_{3 - \texttt{r}},\ 8||c,\ P)$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{Data transport received -- A data transport packet has been received. It is decrypted and its payload is given to the upper protocol to handle.} + \begin{algorithmic} + \Require $(\texttt{kid}^i_r,\ 8||c,\ P)$ + \State $\textbf{Decrypt } P$ using $\texttt{nk}^i_r$ (if $\texttt{nk}^i_r=\bot$ then authentication fails) + \Ensure $P\texttt{.payload}$ + \end{algorithmic} +\end{algorithm} + +\subsection{Security Flags}\label{sec:security_flags} + +ZKE has 4 security flags, $\pi_1, \pi_2, \pi_3 \andb \pi_4$. Each of these flags is a bit that, when sent to 1, change the behavior of the protocol to be more secure. In particular, setting $\pi_2 = \pi_3 = 1$ dramatically improve ZKE's post compromise resistance, and setting $\pi_1 = \pi_4 = 1$ obeys the ``Silence is a Virtue'' principle of security. However setting these flags to 1 come with usability downsides that could make ZKE unsuitable for particular applications or particular users. Hence why these features are flags that the upper protocol is allowed to choose between. + +Below is a description of each security flag, and the security versus usability tradeoff that occurs when it is set to 1. It should be noted that all communicating peers need not have the exact same set of flags. It will be possible for them to communicate even if their flags differ. Also, A peer may set their flags per remote peer, this is why flags $\pi_3$ and $\pi_4$ are returned by a function that takes as input the identity of the remote peer. This would, for example, allow a user to place much stricter authentication requirements upon a credentials server than a friend's laptop. + +\begin{itemize} + \item Hello Requires Recognized Ratchet, $\pi_1$ -- Used in \algorithmref{alg:recv_x1}. When this flag is set Alice is required to present a recognized, nonzero ratchet fingerprint, or else Bob will remain silent. This satisfies the Silence is a Virtue principle of security, since a peer can only acquire a valid ratchet fingerprint through some pre-existing trust relationship. However, this means a legitimate Alice must establish out-of-band an initial ratchet key and fingerprint with Bob. Bob and Alice can share a one time password to be used as the first ratchet key and fingerprint, or Bob can connect to Alice first if Alice has $\pi_1=0$, or Bob can temporarily set $\pi_1=0$ until Alice has completed their first key exchange. + \item Initiator Disallows Downgrade, $\pi_2$ -- Used in \algorithmref{alg:recv_x2}. When this flag is set Alice is resistant to Compromise-And-Impersonate and MitM, because Alice will never allow their ratchet key to be reset to zero. However it requires that Bob never accidentally corrupt their persistent ratchet key. + \item Responder Disallows Downgrade, $\pi_3$ -- Used in \algorithmref{alg:recv_x3}. When this flag is set Bob is resistant to Compromise-And-Impersonate and MitM, because Bob will never allow their ratchet key to be reset to zero. However it requires that Alice never accidentally corrupt their ratchet key. It is recommended that $\pi_2=\pi_3$ for any given pair of peers. + \item Responder Silently Rejects, $\pi_4$ -- Used in \algorithmref{alg:recv_x3}. When this flag is set Bob will not send a session rejected packet to Alice, but instead just silently ignore Alice if Bob does not approve of their identity. This also follows the Silence is a Virtue principle, but it prevents Alice from knowing Bob will never allow Alice to connect in their current configuration. In this state Alice will keep attempting the handshake until the upper protocol times-out the session. It is recommended that $\pi_1=\pi_4$ for any given pair of peers. +\end{itemize} + +As one might guess, security flag $\pi_1 = 1$ is completely circumvented if a peer acts as Alice in a key exchange. In some circumstances this can be beneficial for establishing the first ratchet key, but in general Alice ought to be more discerning about who they connect with if $\pi_1 = 1$. The upper protocol should take this into account. + +When $\pi_2 = \pi_3 = 1$, ZKE strictly requires all users to either have access to reliable persistent storage, or have access to some out-of-band mechanism for one to be reauthenticated in the event they lose or corrupt their persistent storage. This, unfortunately, is not always feasible in a real-time environment. For one thing there are many embedded devices which only have access to persistent ROM, but for another, there are far too many realistic scenarios in which an inexperienced user accidentally loses or corrupts their persistent storage. People often do not realize that they cannot always rollback an application's data directory to a previously backed-up state, and expect the application to work. Furthermore, very few people have redundant drives, as in RAID, so a hard drive failure will likely cause them to lose most if not all of their ratchet keys. When a user can no longer connect with peers because they have corrupted their ratchet keys, some will perceive this as a bug with the application, rather than the protocol working as intended. + +Furthermore there are many situations where implementing an out-of-band mechanism for reauthenticating peers would be too impractical or too insecure. While friends and medium sized-teams can simply message each other over a secure channel to request reauthentication, this solution might not scale to a network of thousands of devices, especially when one or more users don't understand why the application stopped working. This kind of situation often unintentionally incentivizes the use of insecure channels for user to request reauthentication, channels vulnerable to phishing or social engineering. In a sense, security flags $\pi_2 \andb \pi_3$ provide an optional, in-band mechanism for users to automatically request reauthentication. While this mechanism is inherently more vulnerable to post-compromise attacks, it is resistent to phishing and social engineering. + +With all of those disclaimers out of the way, however, we still highly recommend setting as many of these flags to 1 as practical, and for every flag that is 0, always allow a power user to override the flag to 1. Since peers with different flags can still communicate there is not much point in preventing a confident user from improving their end to end security. + +\section{ZeroTier Challenge Protocol} + +There is a fundamental computational asymmetry within nearly all public key protocols, and that is the fact that authenticity of the initial Hello packet usually cannot be determined until after some form of public key algorithm is computed. This means that an attacker is simply able to create a fake Hello packet \emph{once}, and then spam it over and over again to cause the recipient, Bob, to compute tons of public key cryptography. If the attacker's goal is to simply exhaust all computational resources of the Bob as a component of a DOS attack, then it does not matter whether or not their packets fail authentication. If each of their Hello packets can trigger even a single public key computation, then their attack can be successful. It is hard to understate just how expensive public key cryptography is to compute, it is many orders of magnitude more expensive than most symmetric cryptography. For this reason, we have created a DOS mitigation protocol, inspired by the DOS mitigation protocol of WireGuard \cite{wireguard}. + +ZCP is a generic challenge-response protocol designed to mitigate CPU exhaustion attacks that spam the first Hello packet of a key exchange. While it was designed for ZSSP, it is in no way dependent on ZSSP to function, and could easily be adopted by other key exchange protocols. We will be describing ZCP in generic, protocol-independent terms, but it should be clear how the protocol is implemented as a component of ZSSP. + +One of the most common forms of DOS attacks is the volumetric DDOS attack. This is where a large number of remote machines saturate the connection bandwidth of Bob with large amounts of spam. Within the constraints of the Internet Protocol, it is ultimately impossible in all cases to prevent this kind of attack, so long as the attacker has access to a higher bandwidth than Bob. For this reason our goal is to simply make a volumetric DDOS attack the easiest and cheapest form of DOS attack that can be performed against ZSSP. + +Without some kind of mitigation, an attacker consume a small amount of their bandwidth and very little of their compute to send a Hello packet, which consumes a large amount of Bob's compute. To correct this asymmetric resource consumption, we are going to create a form of challenge-response protocol using SHA-512, which will require a proof of IP address ownership and a proof of work. If Alice does not respond correctly to the challenge, Bob will issue a new challenge, and then drop Alice's Hello packet. An attacker who does not respond to the challenge can only cause Bob to compute SHA-512 up to 3 times, which is many thousands times faster than processing the Hello packet of ZSSP. + +The protocol is initialized with a random 256-bit string \texttt{salt}. As the name implies, this will be used as a salt for SHA-512. When Alice sends their first Hello packet, they execute \algorithmref{alg:challenge_empty}, and append the output to their Hello packet. Under normal conditions Bob will simply ignore this part of Alice's Hello packet and allow the key exchange protocol to proceed. However if Bob is under load, Bob may choose to execute \algorithmref{alg:challenge_create}. This algorithm is overwhelmingly likely to output a \texttt{challenge}, which is then sent to Alice. Alice then computes \algorithmref{alg:challenge_response} upon Bob's \texttt{challenge}, which outputs a \texttt{response}. \texttt{response} is re-appended to Alice's Hello packet, and it is resent to Bob. Both \texttt{response} and \texttt{challenge} are a sequence of bytes with identical internal structure, documented in \figureref{packet:challenge_internal}. + +\begin{figure} + \caption{Bob's Challenge $\texttt{challenge}$, and Alice's Response $\texttt{response}$ -- This is the internal structure of both the challenge and response strings Alice and Bob send each other. They are included as payloads within a larger packet.}\label{packet:challenge_internal} + \centering + \begin{bytefield}[bitwidth=6.5em]{4} + \bitbox{2}{\texttt{counter} (8 bytes)} & \bitbox{2}{\texttt{mac} (16 bytes)} \\ + \wordbox{1}{\texttt{pow} (8 bytes)} + \end{bytefield} +\end{figure} + +\begin{figure} + \caption{Challenge Packet -- Whereas Alice's response is sent appended to their Hello packet, Bob's challenge is sent on its own. This usually means it requires a small amount of framing to be considered a well-formed packet that Alice can receive. The ``Peer Identifier'' is defined by the upper protocol to allow for multiplexing between multiple peers. In ZSSP, the Peer Identifier is set to the key id included in Alice's Hello packet, $X_1\texttt{.key\_id}$. In ZSSP challenge packets are identified with packet type number `9'.}\label{packet:challenge} + \centering + \begin{bytefield}[bitwidth=6em]{4} + \wordbox{1}{Peer Identifier (4 bytes)} \\ + \wordbox{2}{\texttt{challenge} (32 bytes)} + \end{bytefield} +\end{figure} + +To challenge Alice to proof address ownership, Bob will include a MAC that is a salted hash of a counter, for replay protection, and Alice's address. Alice is expected to include in their next \texttt{response} the same counter and MAC, proving they can send and receive packets from their address. Attackers who are spoofing their address would not be able to receive nor reply to Bob's challenge. Many DDOS attacks, however, are performed using botnets of computers infected with malware. Each of these computers usually has access to a static address it can stage an attack from, which would allow it to respond to the challenge. Hence Bob also requires a proof of work from Alice. + +To challenge Alice to prove work, Bob will require Alice to find a 64-bit string that, when appended to their counter and MAC, produces a hash with $N$ leading zeros. In order to do this we expect Alice will have to compute SHA-512 $2^N$ times, which is a proof of work. $N$ is a static protocol constant. We recommend setting $N$ to be the smallest value that makes computing the proof of work, \algorithmref{alg:challenge_response}, take more time on average than it takes the key exchange protocol to process Alice's Hello packet. For ZSSP we have found this value to be $N=13$. This method of choosing $N$ minimizes the burden on legitimate peers while still eliminating the computational asymmetry between an attacker spamming Hello packets and Bob processing them. This, in general, should make a CPU exhaustion attack more expensive than a volumetric DDOS attack. + +Finally, to mitigate the possibility that the proof of work itself becomes a CPU exhaustion vector, Bob is required to ``proof receipt'' of Alice's response. Bob must include the 64-bit proof of work field sent by Alice in their challenge to Alice. If Alice sees that their proof of work is not included in Bob's challenge, Alice will ignore the challenge. This makes it difficult for an attacker to spoof a challenge to look like it came from Bob. The attacker would have to be able to read Alice's Hello packet and send their fake challenge before Bob sends the real challenge. The average botnet DDOS attacker is not capable of doing this. Using the proof of work for this has the advantage of making it trivial to serialize each of Alice's executions of \algorithmref{alg:challenge_response}, rate limiting the proof of work and preventing more than one CPU core from being consumed. The proof of receipt could be made more effective if it was also a salted hash of a counter and Bob's address, but we felt that the current design was more than enough to make CPU exhaustion attacks more expensive than volumetric DDOS attacks. It is recommended that Alice eventually timeout their key exchange with Bob if Bob has done nothing but send challenges. + +To prevent a legitimate Alice from unintentionally straining Bob while Bob is under load, Alice should not immediately resend their Hello packet upon receipt of a \texttt{challenge}. Instead Alice should wait until they would normal resend their Hello packet. + +The application may choose to rotate the \texttt{salt} variable periodically. While the protocol as we have described it so far has strong replay protection, it does not automatically expire sent challenges after a set amount of time. This means challenges might never expire, and could be saved up to be used later. We do not consider this a practical DOS attack vector, but for applications that do, rotating \texttt{salt} on a periodic schedule is one of the best solutions. + +\begin{algorithm} + \caption{Alice generates a null response -- The returned value is appended to Alice's initial Hello packet to Bob.}\label{alg:challenge_empty} + \begin{algorithmic} + \State $\texttt{response.counter} \gets 0^{64}$ + \State $\texttt{response.mac} \gets 0^{128}$ + \State $\texttt{response.pow} \gets\$\,\{0,1\}^{64}$ + \Ensure $\texttt{response}$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{Bob decides whether to issue a challenge to a Hello packet -- Input \texttt{response} is the last 32 bytes of Alice's Hello packet. Input $a$ contains the ``address'' of the lower datagram protocol from which the packet was received. So when the datagram protocol is UDP, $a$ contains the IP address and port of Alice. This algorithm is stateful, so it has a stateful counter $d$, and can remember counter values $c$ it has seen before, similar to counter-based AEAD decryption. If $\bot$ is returned, this means Bob will not be sent a challenge packet, but instead Alice's Hello packet will be allowed to be processed by the upper protocol.}\label{alg:challenge_create} + \begin{algorithmic} + \Require $\texttt{response},\, a$ + \State $c \gets \texttt{response.counter}$ + \If{$c\text{ is unused} \andb \texttt{response.mac} = \HASH(c||a||\texttt{salt}) \text{ (first 16 bytes)} $ \\ + $\quad\andb \HASH(\texttt{response})\text{ has } N \text{ leading zeros}$} + \State $\textbf{Save } c \text{ as used}$ + \State $\texttt{challenge} \gets \bot$ + \Else + \State $\texttt{challenge.counter} \gets d$ + \State $\texttt{challenge.mac} \gets \HASH(d||a||\texttt{salt}) \text{ (first 16 bytes)}$ + \State $\texttt{challenge.pow} \gets \texttt{response.pow}$ + \State $d \gets d + 1$ + \EndIf + \Ensure $\texttt{challenge}$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{Alice responds to a challenge from Bob -- Input \texttt{previous\_response} is the contents of the \texttt{response} that was appended to Alice's last sent Hello packet. The returned value replaces it in the next Hello packet.}\label{alg:challenge_response} + \begin{algorithmic} + \Require $\texttt{challenge},\, \texttt{previous\_response}$ + \If{$\texttt{challenge.pow} = \texttt{previous\_response}\texttt{.pow}$} + \State $\texttt{response.counter} \gets \texttt{challenge.counter}$ + \State $\texttt{response.mac} \gets \texttt{challenge.mac}$ + \State $\texttt{response.pow} \gets\$\,\{0,1\}^{64}$ + \While{$\HASH(\texttt{response})\text{ does not have } N \text{ leading zeros}$} + \State $\texttt{response}\texttt{.pow} \gets \texttt{response}\texttt{.pow} + 1$ (with overflow) + \EndWhile + \Else + \State $\texttt{response} \gets \texttt{previous\_response}$ + \EndIf + \Ensure $\texttt{response}$ + \end{algorithmic} +\end{algorithm} + +We have intentionally avoided involving any of the cryptographic variables from the upper key exchange protocol in this protocol. This is to enforce strict protocol independence, to avoid accidentally compromising some security property of the key exchange protocol. In particular this protocol will preserve identity hiding, since neither Bob nor Alice include static, identifying values in their challenge or response. From an analytical perspective, within most AKE security experiments, we can almost always prove that the security of a key exchange protocol plus ZCP can be reduced to the security of just the key exchange protocol. This is because an adversary which just attacks the key exchange is always capable of accurately simulating both Alice and Bob's side of ZCP to an adversary which attacks both the key exchange and ZCP. + +This protocol violates the ``Silence is a Virtue'' principle of security. So we recommend disabling it entirely if security flag $\pi_1=1$. In general we expect many administrators will have this protocol turned off by default, but will manually enable it in the event a CPU exhaustion attack is detected. Just the fact that this protocol is available to be enabled at any time will likely deter attackers from performing a CPU exhaustion attack against ZSSP. + +\section{ZeroTier Fragmentation Protocol} + +ZSSP supports the partitioning of large packets into smaller fragments, that can each be sent individually between peers, and will be reassembled at the other end. Most datagram protocols have a maximum transmission unit (MTU), that all packets must be smaller than. Fragmentation makes it possible for the upper protocol to send packets much larger than the MTU. The MTU of UDP is inconsistent and can go as low as 1280 bytes. Satellite links can go even smaller, with MTU in the 500 bytes range. While many applications would work with such small MTU, they would not work efficiently, and having such low MTUs even as just a possibility often greatly hinders the design of a protocol, and what platforms it can support. To make real-time networking operate reliably and efficiently on top of links with low MTU, fragmentation is necessary. + +ZFP is responsible for fragmentation within ZSSP. It sits at the very bottom of the ZSSP protocol stack, just above the datagram protocol. We have chosen to put the fragmentation protocol at the bottom of the ZSSP stack, instead of the top for a few reasons. First and foremost it allows key exchange packets to be as large as we need, larger than the MTU of the underlying datagram protocol. This allows us to use P384 and Kyber1024 keys, instead of their smaller and less secure variants. The second reason is that it allows the bandwidth overhead of fragmentation to be extremely small, just 16 bytes per fragment. If the fragmentation protocol were at the top of the stack instead, then each fragment would have required an additional 16 bytes for each MAC. This also benefits efficiency, because it reduces the number of MACs that must be computed and subsequently verified. + +Given a packet $P$ from the upper protocol, and a MTU $M$, there is exactly one canonical way to fragment it to fit within the MTU. Set the \emph{fragment count}, $C$, to $\lceil|P|/(M - 16)\rceil$, where $|P|$ is the size of the packet in bytes. The fragments numbered 0 to $|P|\%C - 1$ must have a \emph{payload} of size $\lfloor|P|/C\rfloor + 1$. And fragments numbered $|P|\%C$ to $C - 1$ must have a payload of size $\lfloor|P|/C\rfloor$. When each payload is concatenate in fragment number order, the result must be equal to the original packet, $P$. This fragmentation scheme was chosen to maximize the interoperability of different implementations of this protocol. + +The upper protocol must identify every packet with a \emph{packet nonce}. For each fragmented payload, take the fragment number, fragment count and a packet nonce, and combine them according to \figureref{packet:header} to create a \emph{fragment header}. Then append each payload to its header to create the final set of \emph{fragments}. These fragments are then individually sent to the remote peer over the lower datagram protocol. + +\begin{figure} + \caption{Header of the ZeroTier Fragmentation Protocol -- The ``Peer Identifier'' is given by the upper protocol to allow for multiplexing between multiple peers. In ZSSP, the Peer Identifier is set to the most recent key id of the remote peer. The ``Packet Nonce'' is also given by the upper protocol, it is expected to contain metadata on behalf of the upper protocol, and as the name implies it should be unique per packet. \figureref{fig:header_nonce} describes how this Nonce is constructed in ZSSP.}\label{packet:header} + \centering + \begin{bytefield}[bitwidth=6.5em]{4} + \bitbox{4}{Peer Identifier (4 bytes)} \\ + \bitbox{2}{\texttt{fragment\_number} (1 byte)} & \bitbox{2}{\texttt{fragment\_count} (1 byte)} \\ + & \bitbox{4}{Packet Nonce (10 bytes)} + \end{bytefield} +\end{figure} + +\begin{figure} + \caption{Construction of the packet nonce within ZSSP -- Notice that this construction is identical with the ZSSP AES-GCM Nonce, but with two less bytes of padding.}\label{fig:header_nonce} + \centering + \begin{bytefield}[bitwidth=3.5em]{9} + \bitbox{2}{\texttt{0x00}} & \bitbox{2}{\texttt{type} (1 byte)} + & \bitbox{5}{\texttt{counter} (64-bit big-endian integer)} + \end{bytefield} +\end{figure} + +Each peer must statefully maintain a datastructure called a defragmentation buffer to reassemble fragmented packets. The buffer uses the packet nonce to know which packet each fragment is a component of, it uses the fragment number to know which part of the packet the fragment's payload maps to, and it uses the fragment count to know when all fragments have been received. Once all payloads have been received the defragmentation buffer will concatenate all of them together to reassemble the original packet. That packet is then passed to the upper protocol. + +\subsection{Authenticated Fragment Headers}\label{sec:header} + +If all ZFP contained was a fragmentation scheme and defragmentation buffer, then it would be trivial for an attacker to inject arbitrary fragments to corrupt packets. Nothing described so far actually authenticates the fragment count, fragment number or packet nonce. For a time this was considered acceptable, because after all, the rest of ZSSP aggressively authenticates packets, meaning that even if a packet is corrupted at this protocol layer, it will be rejected by the upper layers. However, this protocol layer is vulnerable to a type of DOS attack, where an attacker spams corrupted fragments to constantly keep the defragmentation buffer full. We consider this unacceptable, since it would allow an attacker to consume a small amount of their bandwidth and compute to near completely prevent a legitimate peer from receiving uncorrupted packets from another peer. + +One solution is to simply massively increase the size of the defragmentation buffer. With access to more memory, it becomes significantly harder for an attacker to completely fill it with corrupted fragments. However, we were not happy with the idea of dramatically increasing the memory consumption of ZSSP. Also, this mitigation does not address a variant of this DOS attack, that is based on consistently predicting the next packet nonce that will be used, to target the legitimate packet assigned it. + +The proper solution to this problem is to authenticate the fragment count, fragment number and packet nonce. To do this, ZFP assumes access to two preshared 256-bit symmetric keys. This will be called the header keys, or \texttt{hk}, and the Zeta Key Exchange produces these keys as ASKs from the very first message of Noise XK. Each peer treats one of these keys as a sending key, and the other as a receiving key. Since our goal is to simply mitigate DOS attacks against the defragmentation buffer, we consider full AEAD encryption of the header with a 16 byte authentication tag to be overkill. Instead, we are going to take advantage of the fact that all 3 values we wish to authenticate fit within a single AES block, and that one of them is explicitly a nonce. + +After all fragments are constructed, AES-256 \cite{fips_aes} is used to directly encrypt in-place bytes 4 through 20 of each fragment, using the peer's sending key. When a fragment is received, AES-256 is used to decrypt bytes 4 through 20 using the peer's receiving key. Immediately after the packet is decrypted, the packet nonce is given to the upper protocol to check if it is valid and unique. If it is not valid then the fragment is dropped. If it is valid then it is allowed to enter the defragmentation buffer. It is exactly this check which allows this algorithm to provide authentication, albeit with a low amount of cryptographic entropy. + +Bytes 4 through 20 of a fragment include the fragment number, fragment count, packet nonce, and the first 4 byte of the payload. The packet nonce, in combination with the fragment number, guarantees each block fed into AES will be strictly unique, thereby guaranteeing every header will have a unique encryption. We allow the first 4 bytes of the payload to be included in the block because it is simpler to implement, and it could help in the event a packet nonce is reused due to implementation error. + +We proof in \theoremref{theorem:frag_proof} that, under the assumption AES-256 is a pseudo-random permutation, and the header key is indistinguishable from random, that the ZSSP header authentication algorithm is existentially unforgeable under an adaptive chosen message attack. We also demonstrate that the probability an attacker is able to forge a valid header is bound above by the probability that the upper protocol considers a uniform random packet nonce to be valid. For ZSSP, this implies that the probability an attacker forges a valid header is bound above by $\algn{negl}(n) + 2^{-53}$, where $\algn{negl}(n)$ is the probability that an attacker is able to break AES-256. + +While this probability is not low enough to be considered cryptographically secure, it is more than plenty for making a defragmentation DOS attack more expensive than a volumetric DDOS attack. It should be emphasized that this authentication mechanism is only sufficient for defending against DOS attacks, ZSSP does not rely on it for anything more than that. + +One secondary benefit of this algorithm is that it encrypts the packet nonce. This means that an attacker without the header key cannot see the ZSSP packet type or counter of a packet. Neither of these values are particularly sensitive, but in certain contexts they can aide an attacker in fingerprinting communicating peers or performing traffic analysis. We consider this benefit non-essential but nice to have. + +\subsection{Hello Packet Fragmentation} + +Alice and Bob do not share a header key prior to Alice sending the first Hello packet. For this reason we cannot authenticate the headers of their Hello packet fragments using the previously described algorithm. So instead, we simply do not attempt to authenticate Hello packet headers. All Hello packet fragments from all peers enter a single defragmentation buffer. This defragmentation buffer is larger than a session defragmentation buffer. + +The Hello packet defragmentation buffer is significantly easier to DOS than a session defragmentation buffer. But so long as Alice can get a single Hello packet through to Bob uncorrupted, Alice will be able to then onwards communicate with their own personal session defragmentation buffer using header authentication. Without at least a symmetric key, we do not believe much more can be done to mitigate DOS attacks against a defragmentation buffer. We cannot use a symmetric key derived from Bob's static public key or identity because this would violate identity hiding, by making it possible for an attacker to test candidate public keys. + +The challenge packet, \figureref{packet:challenge}, is small enough that it never requires fragmentation. So Bob does not use the header key to authenticate the header of the challenge packet they send Alice. Bob would not be able to derive the header key anyways, since Bob has not processed Alice's Hello packet. The last 8 bytes of the packet nonce are randomized so challenge packets do not collide with each other. + +The Noise XK handshake packets, as specified by Noise, do not use a unique counter, but instead use counter values of 0 or 1. This creates a problem for fragmenting Hello packets, $X_1$ and Response packets, $X_2$, because we need a way for each of these packets to be fragmented with unique packet nonce values, and not just packet nonce values of $0||0$ and $1||0$. Otherwise, these packets will end up colliding and corrupting each other in the defragmentation buffer. For $X_1$ packets, the last 8 bytes of the final AES-GCM MAC is used as the counter value within the packet nonce. This essentially treats the MAC as a random number which is attached to each fragment. The MAC was chosen instead of an actual random number because it allows Bob to trivially authenticate that the received packet nonce is exactly the packet nonce Alice sent, by simply checking if it is equal to the MAC. A similar method was used for $X_2$ packets. However since we use the ZSSP authenticated header algorithm with these fragments, to provide authentication we needed to make sure the counter value used is always in a $2^{24}$ integer range. For this reason we only use the last 3 bytes of the final AES-GCM MAC as the random counter value for the packet nonce. $X_3$ packets do not need a unique packet nonce since, due to the structure of the ZSSP key exchange, the key id will always be unique for each generated $X_3$ packets. + +\subsection{Proof of Security} + +We are going to prove that the ZSSP header authentication algorithm is existentially unforgeable under an adaptive chosen message attack. However our algorithm does not fit the standard syntax of message authentication codes. This means we must prove security under a different security experiment than the standard message authentication code experiment. We choose to use the syntax of a message transmission scheme \cite{modern_crypto}, and prove authenticated communication under the secure message transmission experiment, \algorithmref{alg:header_auth}. + +\begin{definition}[Message Transmission Scheme \cite{modern_crypto}] + A message transmission scheme is tuple of algorithms $\Pi = (\algn{Gen}, \algn{EncMac}, \algn{Dec})$. \algn{Gen} is the key generation algorithm, \algn{EncMac} is the authenticated encryption algorithm, and \algn{Dec} is the decryption and verification algorithm. + + A message transmission scheme is \emph{correct} if for all keys $k\gets \algn{Gen}(1^n)$ and messages $m$, + $$\algn{Dec}_k(\algn{EncMac}_k(m)) = m.$$ +\end{definition} + +\begin{algorithm} + \caption{The secure message transmission experiment, $\algn{Auth}_{\mathcal{A},\, \Pi}(n)$ \cite{modern_crypto}}\label{alg:header_auth} + \begin{algorithmic} + \Require $n$ + \State $k \gets \algn{Gen}(1^n)$ + \State $c \gets \mathcal{A}^{\algn{EncMac}_k(\cdot)}(1^n)$ + \State $\textbf{Let } Q$ be the set of all queries $\mathcal{A}$ asked to its oracle + \State $m \gets \algn{Dec}_k(c)$ + \Ensure $m \neq \bot \andb m \notin Q$ + \end{algorithmic} +\end{algorithm} + +\begin{definition}[Authenticated Communication \cite{modern_crypto}] + Message transmission scheme, $\Pi = (\algn{Gen}, \algn{EncMac}, \algn{Dec})$ achieves authenticated communication if for all probabilistic poly-time adversaries $\mathcal{A}$, there exists a negligible function $\algn{negl}$ such that: + $$\prob[\algn{Auth}_{\mathcal{A},\, \Pi}(n) = 1] \leq \algn{negl}(n).$$ +\end{definition} + +\begin{definition}[Pseudorandom Permutation \cite{modern_crypto}] + Given the security paramter $n$, a keyed permutation, $F$, and a probabilistic poly-time distinguishers $D$, define the advantage of $D$ to be: + $$\mathbf{Adv}^\text{ind-prp}_{D,\,F}(n) = |\prob[D^{F_k(\cdot), F_k^{-1}(\cdot)}(1^n) = 1] - \prob[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1]|,$$ + where $k\gets\$\,\{0,1\}^n$ and $f$ is a truly random permutation. + + An efficient, keyed permutation, $F$, is a strong pseudorandom permutation if for all probabilistic poly-time distinguishers $D$, there exists a negligible function $\algn{negl}$ such that: + $$\mathbf{Adv}^\text{ind-prp}_{D,\,F}(n) \leq \algn{negl}(n),$$ +\end{definition} + + +\begin{algorithm} + \caption{$\algn{Gen}(1^n)$ of the ZSSP header authentication algorithm -- We are implicitly assuming here that the header key is truly random, or at least computationally indistinguishable from random.}\label{alg:header_gen} + \begin{algorithmic} + \Require $1^n$ + \State $\texttt{hk} \gets\$\, \{0,1\}^{2n}$ + \Ensure $\texttt{hk}$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{$\algn{EncMac}_k(m)$ of the ZSSP header authentication algorithm -- Input $m$ is bytes 4 to 20 of a fragment. Function $F$ is AES-256. For the sake of the security proof we will assume $m$ grows porportionally to $n$.}\label{alg:header_encmac} + \begin{algorithmic} + \Require $m$ + \Ensure $F_k(m)$ + \end{algorithmic} +\end{algorithm} + +\begin{algorithm} + \caption{$\algn{Dec}_k(c)$ of the ZSSP header authentication algorithm -- Function $F^{-1}$ is inverse of AES-256. Function $\algn{Vrfy}$ is some algorithm provided by the upper protocol for verifying that the packet nonce is valid. For the sake of the security proof we will be assuming that the size of the packet nonce $N$ is porportional to the security parameter $n$. The version of $\algn{Vrfy}$ used by ZSSP is described by \algorithmref{alg:header_vrfy}.}\label{alg:header_dec} + \begin{algorithmic} + \Require $c$ + \State $m \gets F_k^{-1}(c)$ + \State $\textbf{Set } N$ to the packet nonce of $m$ + \If{$\algn{Vrfy}(N) = 0$} + \State $m \gets \bot$ + \EndIf + \Ensure $m$ + \end{algorithmic} +\end{algorithm} + + +\begin{theorem}\label{theorem:frag_proof} + If $F:\{0,1\}^n\to\{0,1\}^n$ is a strong psuedorandom permutation, and $\prob[\algn{Vrfy}(N) = 1]$ is negligible in $|N|$ for uniform random $N$, then $\Pi=(\text{\algorithmref{alg:header_gen}, \algorithmref{alg:header_encmac}, \algorithmref{alg:header_dec}})$ achieves authenticated communication, with advantage bound: + + $$\prob[\algn{Auth}_{\mathcal{A},\, \Pi}(n) = 1] \leq \mathbf{Adv}^\text{ind-prp}_{D,\,F}(n) + \frac{2^n}{2^n-q(n)}\prob[\algn{Vrfy}(N) = 1],$$ + where $N$ is uniform random, and $q(n)$ is the upper bound on the total number of queries $\mathcal{A}$ asks its oracle. +\end{theorem} + +\begin{proof} + Given $\mathcal{A}$ an adversary for $\Pi = (\algn{Gen}, \algn{EncMac}, \algn{Dec})$, we construct $D$, \algorithmref{alg:header_d}, a distinguisher for $F$. + Assume without loss of generality $\mathcal{A}$ will never output a string which it has previously received from its oracle. + + \begin{algorithm} + \caption{$D^{\mathcal{O}(\cdot), \mathcal{O}^{-1}(\cdot)}(1^n)$}\label{alg:header_d} + \begin{algorithmic} + \Require $1^n$ + \State $c \gets \mathcal{A}^{\mathcal{O}(\cdot)}(1^n)$ + \State $m \gets \mathcal{O}^{-1}(c)$ + \State $\textbf{Set } N$ to the packet nonce of $m$ + \Ensure $\algn{Vrfy}(N)$ + \end{algorithmic} + \end{algorithm} + + Since $F$ is a strong pseudorandom permutation, we know it is the case that + $$|\prob[D^{F_k(\cdot), F_k^{-1}(\cdot)}(1^n) = 1] - \prob[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1]| \leq \algn{negl}(n),$$ + where $k\gets\$\,\{0,1\}^n$ and $f$ is a truly random permutation. + + Since $f$ is a truly random permutation, it is the case that $f^{-1}(\mathcal{A}^{f(\cdot)}(1^n))$ outputs a uniform random string, $m$, from the set of strings $\mathcal{A}$ did not queried to $f(\cdot)$. Let $Q$ be a random variable that represents the set of queries asked while executing $\mathcal{A}^{f(\cdot)}(1^n)$. + + Given $m$ an output of $f$, let $\mathcal{N}(m)$ be defined as the packet nonce of $m$. + \begin{flalign*} + \text{So } \prob_f[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1] &= \prob[\algn{Vrfy}(\mathcal{N}(f^{-1}(\mathcal{A}^{f(\cdot)}(1^n)))) = 1] \\ + &= \prob[\algn{Vrfy}(\mathcal{N}(m)) = 1\,|\, m \notin Q] \\ + &= \frac{\prob[\algn{Vrfy}(\mathcal{N}(m)) = 1 \andb m \notin Q]}{\prob[m \notin Q]} \\ + &\leq \frac{\prob[\algn{Vrfy}(\mathcal{N}(m)) = 1]}{1 - \frac{q(n)}{2^n}} \\ + &= \frac{2^n}{2^n-q(n)}\prob[\algn{Vrfy}(N) = 1], + \end{flalign*} + where $N$ is a uniform random packet nonce. + + \begin{flalign*} + \text{So } \prob[\algn{Auth}_{\mathcal{A},\, \Pi}(n) = 1] &= \prob[D^{F_k(\cdot), F_k^{-1}(\cdot)}(1^n) = 1] \\ + &= \prob[D^{F_k(\cdot), F_k^{-1}(\cdot)}(1^n) = 1] - \prob[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1] + \prob[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1] \\ + &\leq \algn{negl}(n) + \prob[D^{f(\cdot), f^{-1}(\cdot)}(1^n) = 1] \\ + &\leq \algn{negl}(n) + \frac{2^n}{2^n-q(n)}\prob[\algn{Vrfy}(N) = 1]. + \end{flalign*} +\end{proof} + +\begin{algorithm} + \caption{The implementation of $\algn{Vrfy}(N)$ for ZSSP -- We are assuming that the input $N$ is being interpretted as $p||c$, the packet nonce construction of \figureref{fig:header_nonce}. $D$ is a stateful, finite array of integers, initialized to -1, that stores the value of previously authenticated counters. ZSSP explicitly does not verify that the padding is zero, for the sake of possible future revisions.}\label{alg:header_vrfy} + \begin{algorithmic} + \Require $p||c$ + \State $b \gets 0$ + \If{$p = 1$ and $\zeta$ is in state $A_1$} + \If{$c < 2^{24}$} + \State $b \gets 1$ + \EndIf + \ElsIf{$p = 2$ and $\zeta$ is in state $B_1$} + \If{$c = 0$} + \State $b \gets 1$ + \EndIf + \ElsIf{$p \in \{3, 4, 5, 6, 7, 8\}$} + \State $i \gets c \% |D| + 1$ + \If{$D_i < c \leq D_i + 2^{24}$} + \State $b \gets 1$ + \EndIf + \EndIf + \Ensure $b$ + \end{algorithmic} +\end{algorithm} + +\algorithmref{alg:header_vrfy} shows how ZSSP validates packet nonces. Notice that $p$ must be in range 1 through 8 to be considered valid. Also notice that, regardless of the value of $p$, $c$ must fall into some range of integers that is at most $2^{24}$ in size. If we assume the adversary makes no oracle queries, this implies that the advantage against ZSSP header authentication is bound above by +\begin{flalign*} + \prob[\algn{Auth}_{\mathcal{A},\, \Pi}(n) = 1] &\leq \mathbf{Adv}^\text{ind-prp}_{D,\,F}(n) + \prob[\algn{Vrfy}(N) = 1] \\ + &\leq \algn{negl}(n) + \frac{8}{2^8}\cdot\frac{2^{24}}{2^{64}} \\ + &= \algn{negl}(n) + 2^{-53}. +\end{flalign*} +If we assume the adversary does make oracle queries, then their advantage bound is only negligibly larger than the advantage above. + +The security experiment we have used does not consider replay protection, however it should be clear that \algorithmref{alg:header_vrfy} does indeed provide replay protection. Once any packet is fully processed and authenticated by ZSSP, it is the case that its packet nonce will no longer be valid according to \algorithmref{alg:header_vrfy}. This property very much relies upon the fact that the packet nonce contains both the packet type and the counter. This prevents a type of DOS attack where the attacker simply replays valid fragments to keep the defragmentation buffer full. + +%We believe that this fragmentation protocol has some advantages over the alternative solutions, like Noise-encrypting individual fragments. If we were to Noise-encrypt individual fragments, we would have to send at least the key id, the counter and the packet type in plaintext. This metadata is not particularly sensitive, but it does enable more efficient traffic analysis. The only plaintext data sent within ZSSP is the key id, and the one-time header Alice sends to Bob to initiate a session, \emph{everything} else is encrypted +%\subsection{Data Injection Attacks}\label{sec:frag_inject} + +%Noise guarantees cryptographic authenticity of all of its transport packets. This guarantees that if an attacker is able to inject bad fragments into a ciphertext, the ciphertext will to fail to decrypt. When a ciphertext fails to decrypt, ZSSP will immediately drop it, as well as reset all state that was modified by it while it was being reassembled. This ensures that to the application, ZSSP behaves as though bad packets are never received in the first place. + +%Defragmentation buffers are inherently vulnerable to data injection attacks, so the output of a session's defragmentation buffer is treated as hostile within ZSSP, and it will immediately pass through Noise authentication before being accepted. + +%Within the first message of the Noise XK handshake, Alice generates a random ``header key'' and sends it as a Noise encrypted payload to Bob. Once Bob receives this key, from that point onward all fragments sent between Alice and Bob must have bytes 4 to 20 encrypted in place by the AES block cipher using the header key. When a party sends a packet, it will be Noise-encrypted, fragmented, have a plaintext header prepended to it, and as a final step, a majority of that header will be encrypted under the header key. When a party receives a packet, they will first use the unencrypted session id to identify which session sent it, use the header key associated with that session to decrypt the rest of the header, perform a validity check on the decryption, check the counter value for uniqueness, and if all that succeeds it will finally be allowed to enter the defragmentation buffer. + +%Let us address now how this protocol mitigates our two attacks of concern. Metadata fingerprinting we believe is infeasible under this scheme. The only data sent in plaintext is the randomized session id number. So without the header key, all an attacker can learn from the fragmentation metadata is whether or not it is from the same ZSSP session as other fragments they have seen. Included in the encrypted section of the header is the Noise counter value, as well as the fragment number. These two numbers combined are strictly unique for every single fragment ZSSP produces. Therefore every 16 byte plaintext being encrypted is unique, which means no AES encrypted header will ever be repeated. This prevents an attacker from obtaining partial information about a fragment by exploiting repeated AES outputs. In this sense this method of encryption is AES-ECB encryption, where we have guaranteed each plaintext block going into AES-ECB is strictly unique. + +%Under the assumption that the AES block cipher is a pseudo-random permutation, it can be straightforwardly demonstrated that this stateful fragmentation algorithm is CCA-indistinguishable authenticated encryption. This security experiment does not capture all possible forms of attack that can be performed against ZSSP fragmentation, but we consider it a good sanity check in leui of a full protocol security proof. + +%In preparation for a full protocol security proof, our fragmentation algorithm has been specifically designed to be independent and ``outside the envelope'' of both the key exchange and of data transport. It follows then, in the security environments we care about, any attack against ZSSP with fragmentation can be formally reduced to an attack against ZSSP without fragmentation. This is due to the fact that any attacker can accurately simulate the ZSSP fragmentation algorithm to another attacker when given access to the header key. Since the header key is derived from one-way function KBKDF, it follows that an attacker with access to the header key has negligible advantage to an attacker without it. This rough proof sketch gives us high confidence, in leui of a full protocol security proof, that our fragmentation algorithm does not compromise the overall security of ZSSP. + +%Our fragmentation algorithm makes manipulating the defragmentation buffer a non-viable DOS vector. An attacker cannot replay a valid fragment header because each header contains the Noise counter, and this fragment is dropped if this counter is replayed. And an attacker cannot forge a valid header without access to the header key. The only attack we believe this leaves an attacker is a brute force attack. The header key is 32 bytes long, so it is infeasible to brute force. Instead, the attacker must brute force the header itself. In order to brute force a valid header, the packet type must be a ZSSP-recognized type, and the Noise counter must be within the allowed window of counters. We do not allow a Noise counter value to be greater than $2^{24}$ plus the last received counter for this very reason. The exact size of the search space that would have to be brute forced is hard to compute since counters are nondeterministic in out-of-order Noise, but we estimate an attacker would have to send at least $2^{48}$ fragments to get just one of them injected into the defragmentation buffer. While this search space is not large enough to be cryptographically secure, it is large enough to make this a non-viable DOS vector. + +%We have mentioned a few times that this protocol becomes broken if an attacker acquires the header key, so it is worth discussing how difficult that is. Since it is derived from the chaining key used to encrypt the first payload of the Noise handshake, we can determine its confidentiality based on Noise's confidentiality properties. We have that the header key is: encrypted to a known recipient, forward secrecy for sender compromise only, vulnerable to replay. Considering the classes of attacks we are trying to defend against, we are not concerned about the header key's lack of forward secrecy. Furthermore, Bob's reply to Alice's first message has a unique packet type that is put in the header of its fragments. So the lack of replay protection means that an attacker can cause Bob to send them valid headers marked with this specific packet type, but they cannot acquire valid headers marked with any other packet type. A fragment with this packet type is rejected by Alice if Bob has already completed the Noise handshake. Therefore, an attacker has only a brief window of time to obtain enough valid header encryptions to DOS the defragmentation buffer with. Once the handshake is finished, all of the headers obtained via replay attacks will be useless, as both Alice and Bob will instantly drop them. + +%Another concern with this protocol is that it might not properly bind a fragment header to a specific fragment. So an attacker can swap the headers of fragments with the headers of other fragments. The packet type and Noise counter are authenticated during Noise decryption, so it is not possible for an attacker to manipulate these values. However an attacker could possibly swap around the fragment count and fragment number fields in a header to make a given packet be reassembled in the wrong order. Again this kind of attack would cause Noise decryption to safely fail, but it does pose as a DOS vector. Ultimately we have decided against attempting to mitigate this type of attack, because we believe it is impractical to defend against a DOS attack from an attacker with enough network control to corrupt fragments in flight. + + + +%\subsection{Transport Guarantees} + +%The upper protocol, as in the protocol that is running on top of ZSSP, is able to send data payloads through ZSSP, and receive them at their destination. ZSSP guarantees to the upper protocol authenticity and confidentiality for sent data payloads. ZSSP does not guarantee in-order transport of data payloads, nor does it guarantee losslessness of data payloads. Even if the underlying transport environment does guarantee in-order, lossless transport, there are rare situations where ZSSP can reorder or drop packets. These are usually either because of the presence of an attacker within the transport environment, or because of multithreading nondeterminism. + +%Noise requires that if the 64 bit counter is replayed, that the packet be ignored. In an out of order environment however, where counters can arrive out-of-order, this is quite challenging to do without having to store in memory every single 64-bit counter previously seen by the decrypting party. To handle this, ZSSP uses a datastructure that only saves a fixed number of counters to memory, and is allowed to falsely reporting a counter as being replayed. This means that if many packets are encrypted by ZSSP, and the first packet encrypted arrives to the receiver last, it may falsely be considered replayed and be ignored. + +%The current implementation of ZSSP guarantees if a packet is re-ordered by less than 32 packets, it will be accepted by the remote party. Any more than that and it is undefined whether or not the packet will be accepted. Users of ZSSP should be aware they cannot hold onto ZSSP encryptions and expect them to be acceptable by the remote party after some amount of time passes. ZSSP encrypted packets are expected to be immediately sent to the other party. If the upper protocol needs to hold onto a packet to be sent or resent at a later time, the upper protocol should hold onto the plaintext of that packet, and encrypted it with ZSSP the moment or moments they want to send it. + +%\section{Conclusion} + +%The ratchet key of ZSSP somewhat resembles a resumption PSK \url{https://github.com/noiseprotocol/noise_wiki/wiki/PSK-Resumption}. This suggests it is possible to extend ZSSP to allow for 0-RTT session resumption. However it is unclear whether or not such a protocol extension can be designed to preserve all of the security properties of ZSSP. It is also unlikely that 0-RTT session resumption could be implemented within a small code footprint. + +%Another area that could be worth exploring is if the security properties of ZSSP can be achieved in a setting without a pre-shared static key. The most straightforward approach would be to replace the Noise XK handshake at the beginning of ZSSP with a Noise XX handshake, though it would have to be shown that the lack of authenticated encryption upon the ratchet fingerprint does not enable some form of replay attack. A different approach may be more fruitful. + +%A formal proof of security is the clear next step for ZSSP. + + +\medskip + +\printbibliography + +\end{document} diff --git a/whitepaper/zssp_modes.md b/whitepaper/zssp_modes.md new file mode 100644 index 0000000..992c3d5 --- /dev/null +++ b/whitepaper/zssp_modes.md @@ -0,0 +1,38 @@ +| | Persistent ZSSP | Opportunistic ZSSP | Non-persistent ZSSP | WireGuard | ZeroTier V1 Transport | +| --- | --- | --- | --- | --- | --- | +|**Construction**|Noise XKhfs+psk2|Noise XKhfs+psk2|Noise XKhfs|Noise IKpsk2|Static Diffie-Helman| +|**Perfect Forward Secrecy**|Yes|Yes|Yes|Yes|No| +|**Forward Secret Identity Hiding**|Yes|Yes|Yes|No|No| +|**Identity Testing**|Resistant|Resistant|Resistant|Vulnerable|Vulnerable| +|**Forward Secrecy Automatically Heals**|Yes|Yes|Yes|Yes|No| +|**Ratcheted Forward Secrecy**|Yes|Yes|No|No|No| +|**Quantum Forward Secret**|Yes|Yes|Yes|No|No| +|**Key-Compromise Impersonation**|Resistant|Resistant|Resistant|Resistant|Vulnerable| +|**Compromise-and-Impersonate**|Resistant after ratchet|Detectable after ratchet|Vulnerable|Vulnerable|Vulnerable| +|**Single Key-Compromise MitM**|Resistant|Resistant|Resistant|Resistant|Vulnerable| +|**Double Key-Compromise MitM**|Resistant after ratchet|Detectable after ratchet|Vulnerable|Vulnerable|Vulnerable| +|**Silence is Golden**|Yes|No|No|Yes|No| +|**DOS Mitigation**|Yes|Yes|Yes|Yes|No| +|**Supports Fragmentation**|Yes|Yes|Yes|No|Yes| +|**FIPS Compliant**|Yes|Yes|Yes|No|No| +|**Small Code Footprint**|Yes|Yes|Yes|Yes|No| +|**RTT**|2|2|2|1|1| +|**Kernel Implementation**|No|No|No|Yes|No| + + +* **Construction**: The mathematical construction the protocol is based upon. +* **Perfect Forward Secrecy**: An attacker with the static private keys of both party cannot decrypt recordings of messages sent between those parties. +* **Forward Secret Identity Hiding**: An attacker with the static private key of one or more parties cannot determine the identity of everyone they have previously communicated with. +* **Identity Testing**: The attacker has the static public key of a single party, and attempts to test whether they participated in a given session. +* **Forward Secrecy Automatically Heals**: Forward secrecy will be automatically re-established between communicating parties in the event a session key is compromised. +* **Ratcheted Forward Secrecy**: In order to break forward secrecy an attacker must record and break every single key exchange two parties perform, in order, starting from the first time they began communicating. Improves secrecy under weak or compromised RNG. +* **Quantum Forward Secret**: A quantum computer powerful enough to break Elliptic-curve cryptography is not sufficient in order to decrypt recordings of messages sent between parties. +* **Key-Compromise Impersonation**: The attacker has a memory image of a single party, and attempts to create a brand new session with that party, pretending to be someone else. +* **Compromise-and-Impersonate**: The attacker has a memory image of a single party, and attempts to impersonate them on a brand new session with the other party. +* **Single Key-Compromise MitM**: The attacker has a memory image of a single party, and attempts to become a Man-in-the-Middle between them and any other party. +* **Double Key-Compromise MitM**: The attacker has a memory image of both parties, and attempts to become a Man-in-the-Middle between them. +* **Silence is Golden**: A server running the protocol can be configured in such a way that it will not respond to an unauthenticated, anonymous or replayed message. +* **Supports Fragmentation**: Transmission data can be fragmented into smaller units to support jumbo-sized data or MTU discovery. +* **FIPS Compliant**: The protocol uses FIPS approved cryptographic algorithms. +* **Small Code Footprint**: The Codebase implementing the protocol can be easily audited by anyone on the internet. +* **RTT**: "Round-Trip-Time" - How many round trips from initiator to responder it takes to establish a session.