From b995424687d235220e166b861a46186c0466f8f6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 18 Apr 2024 14:46:12 -0400 Subject: [PATCH] app security --- windows/security/book/application-security.md | 128 ++++++++++++++++-- windows/security/book/images/uac-settings.png | Bin 0 -> 39714 bytes 2 files changed, 120 insertions(+), 8 deletions(-) create mode 100644 windows/security/book/images/uac-settings.png diff --git a/windows/security/book/application-security.md b/windows/security/book/application-security.md index 03709cde9f..ec3e6615fe 100644 --- a/windows/security/book/application-security.md +++ b/windows/security/book/application-security.md @@ -9,15 +9,127 @@ ms.date: 04/09/2024 :::image type="content" source="images\application-security-on.png" alt-text="Diagram of containng a list of security features." lightbox="images\application-security.png" border="false"::: +Cybercriminals can take advantage of poorly secured applications to access valuable resources. With Windows 11, IT admins can combat common application attacks from the moment a device is provisioned. For example, IT can remove local admin rights from user accounts so that PCs run with the least amount of privileges to prevent malicious applications from accessing sensitive resources. + +In addition, organizations can control which applications run on their devices with App Control for Business (previously called Windows Defender Application Control - WDAC). + ## Application and driver control -## Application Isolation - -> [!div class="nextstepaction"] -> [Chapter 4: Identity protection >](identity-protection.md) - ---- - :::image type="icon" source="images/go-to-section.svg" border="false"::: **Go to section:** -:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** \ No newline at end of file +- [Smart App Control](#smart-app-control) +- [App Control for Business](#app-control-for-business) +- [User Account Control](#user-account-control) +- [Microsoft vulnerable driver blocklist](#microsoft-vulnerable-driver-blocklist) + +Windows 11 offers a rich application platform with layers of security like isolation and code integrity that help protect your valuable data. Developers can also take advantage of these +capabilities to build in security from the ground up to protect against breaches and malware. + +### Smart App Control + +Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run if they are predicted to be safe based on existing and new intelligence updated daily. + +Smart App Control builds on top of the same cloud-based AI used in App Control for Business to predict the safety of an application so that users can be confident that their applications are safe and reliable on their new Windows devices. Additionally, Smart App Control blocks unknown script files and macros from the web are blocked, greatly improving security for everyday users. +Smart App Control will ship with new devices with Windows 11, version 22H2 installed. + +Devices running previous versions of Windows 11 will have to be reset with a clean installation of Windows 11, version 22H2 to take advantage of this feature. Smart App Control will be disabled on devices enrolled in enterprise management. We suggest enterprises running line-of-business applications continue to leverage App Control for Business. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Smart App Control](/windows/apps/develop/smart-app-control/overview) + +### App Control for Business + +Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means of defending against executable file-based malware. + +Windows 10 and above include App Control for Business (previously called Windows Defender Application Control) as well as AppLocker. App Control for Business is the next-generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to App Control for Business for stronger protection. + +Customers using Microsoft Intune[\[9\]](conclusion.md#footnote9)> to manage their devices are now able to configure App Control for Business in the admin console, including setting up Intune as a managed installer. + +Customers can use some built-in options for App Control for Business or upload their own policy as an XML file for Intune to package and deploy. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Application Control for Windows](/windows/security/application-security/application-control/windows-defender-application-control/wdac) + +### User Account Control + +User Account Control (UAC) helps prevent malware from damaging a PC and enables organizations to deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. + +Organizations can use a modern device management (MDM) solution like Microsoft Intune[\[9\]](conclusion.md#footnote9)> to remotely configure UAC settings. Organizations without MDM can change settings directly +on the device. + +Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized +apps and prevent inadvertent changes to system settings. + +Users with standard accounts, or those using administrative accounts with UAC enabled, run most programs with limited access rights. This includes the Windows shell and any apps started from the shell, such as Windows Explorer, a web browser, productivity suite, graphics programs, or games. + +Some apps require additional permissions and will not work properly (or at all) when running with limited permissions. When an app needs to run with more than standard user rights, UAC allows users to run apps with a "full" administrator token (with administrative groups and privileges) instead of their default user access token. Users continue to operate in the standard user security context while enabling certain executables to run with elevated privileges if needed. + +:::image type="content" source="images/uac-settings.png" alt-text="Screenshot of the UAC settings."::: + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [How User Account Control works](/windows/security/identity-protection/user-account-control/how-user-account-control-works) + +### Microsoft vulnerable driver blocklist + +The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to the Windows 11 2022 Update, Windows enforced a block policy when hypervisor-protected code integrity (HVCI) was enabled to prevent vulnerable versions of drivers from running. Beginning with the Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs, and users can opt in to enforce the policy from the Windows Security app. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Microsoft recommended driver block rules](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules) + +## Application Isolation + +:::image type="icon" source="images/go-to-section.svg" border="false"::: **Go to section:** + +- [Win32 app isolation](#win32-app-isolation) +- [Windows Sandbox](#windows-sandbox) +- [App containers](#app-containers) + +### Win32 app isolation + +Win32 app isolation is a new security feature in public preview designed to be the default isolation standard on Windows clients. It is built on [AppContainer](/windows/win32/secauthz/implementing-an-appcontainer), and offers several added security features to help the Windows platform defend against attacks that leverage vulnerabilities in applications or third-party libraries. To isolate their apps, developers can update their applications using the tools provided by Microsoft. + +Win32 app isolation follows a two-step process. In the first step, the Win32 application is launched as a low-integrity process using AppContainer, which is recognized as a security boundary by Microsoft. Consequently, the process is limited to a specific set of Windows APIs by default and is unable to inject code into any process operating at a higher integrity level. + +In the second step, least privilege is enforced by granting authorized access to Windows securable objects. This access is determined by capabilities that are added to the application manifest through MSIX packaging. Securable objects in this context refer to Windows resources whose access is safeguarded by capabilities. These capabilities enable the implantation of a[Discretionary Access Control List](/windows/win32/secauthz/access-control-lists) on Windows. + +To help ensure that isolated applications run smoothly, developers must define the access requirements for the application via access capability declarations in the application package manifest. The Application Capability Profiler (ACP) simplifies the entire process by allowing the application to run in "learn mode" with low privileges. Instead of denying access if the capability is not present, ACP allows access and logs additional capabilities required for access if the application were to run isolated. For more information on ACP, please refer to the [GitHub documentation page](https://github.com/microsoft/win32-app-isolation/blob/main/docs/profiler/application-capability-profiler.md#stack-tracing---acp-stacktracewpaprofile). + +To create a smooth user experience that aligns with non-isolated, native Win32 applications, two key factors should be taken into consideration: + +- Approaches for accessing data and privacy information +- Integrating Win32 apps for compatibility with other Windows interfaces + +The first factor relates to implementing methods to manage access to files and privacy information within and outside the isolation boundary ([AppContainer](/windows/win32/secauthz/implementing-an-appcontainer)). The second factor involves integrating Win32 apps with other Windows interfaces in a way that helps enable seamless functionality without causing perplexing user consent prompts. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Win32 app isolation](https://github.com/microsoft/win32-app-isolation) + +### Windows Sandbox + +Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation using the same hardware-based Hyper-V virtualization technology without fear of lasting impact to the PC. Any untrusted Win32 app installed in Windows Sandbox stays only in the sandbox and cannot affect the host. + +Once Windows Sandbox is closed, nothing persists on the device. All the software with all its files and state are permanently deleted after the untrusted Win32 application is closed. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Windows Sandbox](/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) +- [Windows Sandbox is a new lightweight desktop environment tailored for safely +running applications in isolation](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/windows-sandbox/ba-p/301849) + +### App containers + +In addition to Windows Sandbox for Win32 apps, Universal Windows Platform (UWP) applications run in Windows containers known as *app containers*. App containers act as process and resource isolation boundaries, but unlike Docker containers, these are special containers designed to run Windows applications. + +Processes that run in app containers operate at a low integrity level, meaning they have limited access to resources they do not own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the file system, registry, and other resources. The app container also enforces restrictions on network connectivity. For example, access to a local host is not allowed. As a result, malware or infected apps have limited footprint for escape. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Windows and app container](https://learn.microsoft.com/windows/apps/windows-app-sdk/migrate-to-windows-app-sdk/feature-mapping-table?source=recommendations) + +> [!div class="nextstepaction"] +> [Chapter 4: Identity protection >](identity-protection.md) diff --git a/windows/security/book/images/uac-settings.png b/windows/security/book/images/uac-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..6571f611b8da1967f0070e459a6feb567280f26c GIT binary patch literal 39714 zcmce-XH-+)6E=z>Vuha-Q6VZ#X;CcnCW3TO5kyEp0Re%~LWe{^ML~LrbZH_|LJx$H zfP$0=p(8c)00BY^frOA7^#88=<*xhbu6x!BB}O{7`DkqT@Z_hsc+A0Z2+YC3sd(ft`;6zX$!GSzqi)*fo*W#<&+LB=aHOPNV4pnT`S{^|j*`yH z3+x|2%sv82 zaC`nkXs^OeD)s2U!99MH@Azg4@-yO^o0|i+R>m0WdR(AA-gD5M_*7SH@|)v-$EhKb zl9Fc1S_I=G_<-0vLiKVe(63GJ2>KtDnJ+k;6%=_by+`w*#dzRsqS?OY*~faB9sWFX z+B>E8-|rcHl>eg={w@}%+GT-4jt|~bDMPqWpP#odKuL`xo3nh(S(Q@My1Y5m1Idw& z-%hm>qq#{VmA3eIFbnDLgLdUQ^@nGgXEpuY9d+n^yFstPto({EW2B-dtjeabq}lp3 zc!6I!ijxbqD5BeG%CI+IiQ6-REBs~u=7!-!Gq2{n+*_U>a%)G#=vhCnR&Uhhams9! z)BEEN2&g@xP%RXWR7mO>zWHj!9Gy92TK(bDO?i8%@5ChAh$`W7-`ZpTX^&Xrx#O4I zY{WX>Q|X8%Udp%9PnTjoN|h`d(ukE8?Oeq!I(M_8j-wysb0IkYvew2Q#cX#Ux42kr zQRHvkk+H{|i?{4C}e#(B{y zspGXdBkowuAHF`Npx5J4;0XSakr1G~ zZ~oA+V)&qP2U=l6ga}{%CS^D&(ACde z{5Ub8U5FSXU_X8h$7Cj1dUud>St+vk<4jd?rs7tc9VcfwbPaQ+=#hlGMgRQVEv9%{ zua)cT>BQF4_^7kSnDg>e2&vJ;>xPBrrFFcXtNs;3?J{unrOwTnvZXEQ@1&RR>m@a7 z=gkMy5qq$^Mz}wEOvA2Oj6ZWHl+emz^xMyl+9BF%T@>vW60HyjV$u1)wYQk<&7-xY zn_?dQJMKeUJuE%xXJ(4(eEE!?xIDAPnfS89yV6<^$0BPE?a?SL?{Cd|ImkyT6MFec zlJ4Yi{27g?egEd*=rXKtjyShnFnuhk_gw4u{1@g+m)tyR0yl<4YGDzrw-M6qy@;e) z&*&gC71p2Q>mkmj>IkRV`#2FqlJk&1WN2AA*R<5JqIHX+EM$?1ekh&BNJ}G+TxFVJ z)agKYsPn}?(wv-w+AKR{OoY9(F7c}!smj;!k@R3Iee!cx8~GA@y07Uqm0G|{X*LG06XmL%dC677V@O4*<<9#{FhK3jO9F0 z7~ngRD#KcOBHmhNz@<|C{mREYFrqCFi|^NCS}KU~@mVDl5`cAWFX^KVdR8pEatyR~ z6F3e8f|P&=tdG8Q0mrZA2(vbtG+1g7vjU6t1U?ErYe7eWeaZ@&k{I-d0zT(R zIvraWa-FYfID4+vL#?D{%cJ%cgDW-y_|30>cO=QSmJ%lkHW?|W+mZ*0J(jBm6;yG| z8Px1F_T0YPsRVA9j(U)b%j531d8JP#OQ|}#7-0PD02QB%e=*s3+xd3W+=PP#~`# zak)#UV`Nc3WRZ;4EP)B$(meoa>&JVWtX*m}o75aOgabvv_o80g^AR+XzP;AJx~_Z)J?r zRCeN3ch2|?){Tp}EnH~^u+{*w25@$Kw^e4)2XWG>tDLG`cg8kh3@Wn<8Ds##?z}p{ z)<)^p?h;|IDBg5hbvKL^Rv|O|Sm}HcaI0A)AN1)=N*QDH{H^Nv zC^KiDFW0({g6TOtLA(e{y_9jws@e1AKH3Yyo7*LNH z*OCCRwp(VcSY)_V=5~|VfZfC_U~dvIv+N2FnBw+_!$4x))}fHQFMIM;s5f?KtUV&~ zxmyeGkD#rJ%tXLWETF)Mtvr^y4xV@7!C>CPw|l`VY(-f!yHEZH?V6Q^Z^)hjdJeIJ zlq+k?74J{OYJ{cPdkW}x4|7@Ve!>5N2S!(n>b^b%cBY5~QQxAgXQOY;aDkUJ%b+hU z1bp37eryJG*wE`|p(W?eZ9jXwLB1Lbh1%8{G3$sYi?*3jeNIm@K>(iNh2dN=;7F&D zfUh~&d!xqEd&kbOK@*|QZM}JarB!b+=q_O@`_hRuPM|+O+y0?%9&j6MGW=7B20ARo z3vO%i>+}$*7a<2O*JA)Pj^`@7)!#n^1exru16e(O+5^0Ja&cATbhK)QFSwqiFyAA7 zeYGD6d#X<#Kw(7+b+|z)yOX@KT)KNxz`grD{_AaGHu+?QsEs-tqpouw8#MgN?sa!Q z3oFe7t%_WL>h#Enx*Aqq>*8rnqCQuh|kyLwkXmv%eIc<8#}0mdf%;{c-y{HjLQQt4qFi|b<;5L0oVP-V7~6+ zM@c5754fKv&4ln^B*_RK?6-ypCdSfoRFVV@)I?dACFL10m#n<4g2u!7Tm;-s)m~5S zrv$D121oGWc`|iZ|BBN zihSm{F}$pW%J?X%6J8DZfJF}S=hh83N%6^!S&hR9@CA=;D8JXBfB|a$mw(&a*jGv{i#q;r-OhN?IB8T4NgO>p|S?aKtM6W&`w*Io2YWOcGaSL z z&udw(=JAC{r;JQBSBq?_p1WSAv25Mvq{ek$nv57J84+a?L2=8klMAI)#LR%{2&W~x zA!$92;$vBs_0T*^_qA8@o?GhFy>l{dj`2!xotfPRQFH9BhrDd5c_-LoP`(SU0}iBn z3}K3|o6$1k4VV^rI3#h|$Cj&oTC8$;1I^i-Yu8Q*efQyq)h3WP^^dK6uM~+fl`G!LRUQs!#J4ur`)}&hX zE7sNLMjOOId9zK0I=|I^JfX95V6eb~GVif{;N;j{ZJ$d$n_HVo=#uF)Irkqs1)SD8 z+Xv2pcpLq@TW(A9eFAW-lX|6`LUf!%z2*pKoc%m0^|W@IXyrM5TAfm!l!h1@pRB^2 z9h`7I=r`1FcX?sDghsH^@-gV?y~9ddtvkIi{bgY~JKtyVS8jAZ4-b8$r!i|DyFgaY zJid2p%X8*Iybxo9iyZy{yFYcN8aKDs?@>p4kE`=_IIX>uWfF|&Ql3`o34T+n>(GB5wvB#?x zX3cDEZJUnf&O;uc^|~Lbte?ssi8WNqMft3Z%G(e5U^mkDF~+xUUII+*7vaX4-1vn> zwRZ#xB)1O0weTeza&$`dCSy17vck8i=3C%lhr^ev$TJHl<-{z}(lCsX!Q((reuCb>< zVS6Z*R|?wGy)7V$RnLHo!`4G*Ey^a5kd1;HGt8D$si2TJ45#Y@!u2_R0L&#^n*F()B_ytpF+d>rd5tlC1 zD(8UT(3@5PAkOkIov%NDWUC{sFml3$NT`3zite+RnZNRp2R$#XfiCRsHBw!MN_;mF z@8q0KlCntq(zZcRrR-wXeqEZ~$Yf!bMo`EMqNdTHJZQ5L88|CpXsqcY)dPj`)HChG zVky}b%Br=H7-I2ULojF70=n)|Wnu##ZoAoE@Ut9k%qMf>&4@TKd^`ze90k$a;JoWE zU_SrmsmbPxk+UE;1xBk&{mM8XId)pCmC|!A4H#*CJg0~qx={DmED-Y?`laMJa6ZrP z2Y4jS2tdLtsJ%3<)QlrOzOk|!F_0`>p@Qo@oV%}ExyGbEN2@nq>-cum`IsA_hq1p6 zCA#{x4}OGR5{Q&^{pLWruX$=v@>_zHZ1K#sBoz|y>NIMUNIi^`+gCcWL z-nj)4s^}P=FY^r%E8?4;sx;4ad-#_9x)W~8sdLi|NAEXeuSCxTeJ2js*JiSIGLa;o z?xRqvwQw^z-WJ#tNWiyS>cwtDgzEQ4>;#Z_t%-n}#O+=dYUJ(>1HhgQcaK>OJKjY{ z5*~cXeUdyie+7}0OEoBr^$SFe`xgo)dI{$!;k&|#PxZJZLZtMe4PqC|XmyXh#Ld9F z-QRoqG9hEx7F`cE@cYrBLHGC^bZ3MBtG4?wmUw<1IDL{@^kiXJZ^gLFkj&>E0^lo( zSP!9MHcvVu5J9Y#nMPNv$vxM)D@;zk&YL|D4Cm&P3O;A%U=ocFM^hG)FY%^t zI_4+p-uy2cum!!MfpR`N2ij@N+||ja;ynq2QAr9W1}~r%1G6>P&bDKhbX@E2WF_3A0se}11J0g{1y^!H$Ra0D7iZz z+g)Pnu25yVaJH!Zr*2}StIiZkw`ZiEq+Qq=ge2*AkJay9)=+qpAi~G9uOz6DbS$K< zJIXZfjIZO{{|+|tiE&Jm{L5yty&8{Vl;CScmS}Hna8OIYtS0p`+V?8~6xoUEajgqR z=)Hc-dUej%+~axmABEMIuBMF$i9UkVB9XZsUW}N@2iIvpp8H#FTK6X1oj43GQjuM` z2AQzy{n|n0_D#n<;MS&NCc+HA6gt|CA0*BQ=AGf2ofhjZR{ z{Pc~Sc+&$Y4Cif_S#FKZzzU{+wyVWruvfRLXFqFs+st-;5V64HzPlEgRt--97@abWY;d#>+7zgtzs)uW<}C3*_jvV zk^0E;=DP!FOTKgJwPY`|c93iR(-Q2K_<{xav<3I0^N2LHu#q5#p`9RnQpaNBrl=nU z$SNOYn~TTpwtMZDgCYv6S#`(i7oQ?MPS0Ye1t@Mwy^RTzlP|;?vNzE4Ub{>ptA6QE znZ`I9R=3|KC{05(=T%76VZEVa+qXzgVTkl=K z>EoytxTl!}qw&;40LQ9laAl5#&$f_I^GQX4B2ML{N*=WbVUPi#a|?8br?}`-yPRvQ4mNg6P{Ki#??NxYB6a4kVjfmi1NZ1v1Zcq}2SZ^x8E=x2IU$fBksao(1LtyC!9?QJU4@#`AhcinH ztcN9k(83WUDB`MebRDKR1c+zH0)qdrC^-$2%i`KuQ*H2_$lJo3!EE;xo5&8m>R<0O=7qQ{@6oga>Q(ijj4vMo zFXmh=kXe9eqWi-$uug;0Viz`YROvaLM;@}#yhZ(dY$OE7^af7!9>Hvj6%*S<{tPz* z4u~q0>%|ZgA8;$~eu-E~$pSnN9YTeYyLMh}YWTSM+A`J1KqO$;iiRGPr*MZ}M>nhA zx$%AFU^Zz3m4|2l_56^VM{6OFv#jVeQw?1w1>V*_f1W)tXNRdxPFx8esM8uBZb)`* z0SIVwpQ@~(f9%Y(=iklB4c&!ksw>bUcrb@Z{VgMaxnUAO78LD|+dcIbdd;yu8vWa! znf^Xu9YfM zya1In-&O}!kTNdn6o%4u)%?c5$1`Hi%1a(rnRy4#pd&isHas{b(Z^$XayRQvzJ#_m zGlo!YI@8y-D#V&pJnzrpc2$M~db!FN(rqs@1-l#ypH*1JA}rk#ow1cgA-7qQvR2rq z?|U?qBrW6y#snc(NK>uiISSf8Gdt)L$D5SdB&)x zq1po+l=fw!EuZZ$(wB*QTd4FTei-?zKtp%qS$4z$GO?Wk)2sl-)^aBr8o|#rF0#PS z51dw*obNZY0%Z~i8`<#`dZVCq&MLbub?MK3jEMP-!0pJCZHmi2*TBK_N zRacdS(`}Yn>9f+$Kaw4&9aK=l`J}2h-%dnnvr8kgK@SekJQL`Srq90;?;%w!xmnao zk~!WFp41k@FXP$`-WOg9mBd=N^;@xk9$UvL@lrr`Ef8syaG*OF0Z$MZDfw>)kw2Tr zhZ6;C6TxBu$55^3QYC9K@HRit^YZjl(f8d2P9ZOgcV)HrBSQrA^dJ*IdvqXPD*O~u zT*_Sax1(Zp{lTZ0J>4o}3crkE$OMuPphx`@bN%719x1EM02o3{wV-7DeFl+*;+dNF z3yyq%f-LmCKC*8FruRo1Wb3uK!So;Tn5&;KwzZIB7Yg^Hcz(|hHoT$Ne&alYXnJm< z9*K>3NnC&8v9rgpok)sq?KQHz8m-LE#);(y;Iulkajy;You&Zd4Oh4w4&y=t<@Jqb>cdhL;UY*;b_fw%H~XZdFj<7}<~1ZLobNl&}%z7UcO zV4Nv-5~t-Hd2;?3;D$QqwcLlP+Y z2E=8aqs66YaG4ZoTF~h(=H>L6xO$x=1ee%ItBRZ6=N%7Eak#n4i9E)990 zH^ReGAFcnjq;BTPuTE9oci$+GQ*}X}(=UCebMwe!O5E8K=sq)3!WkRxP?_qn%9;nJ zjt|AOZH_oD$e7+Q{a1!BdaFGl(iPWKU4K?O>9#HONrT9@ST~VZXo1hpVXxMvZML}uVrDqhi)M+_#`m&hFto5KUiHq>VYjk_+R(t&*!uT{6MjVougx$ z<66(4ee)skkMfr5OTVJ63on|dj)mWI85aIGL&b8zh`l`+DbFJ4*@;t!{+^79z^n#D24U<08hdx$F_h0E`$%!<-w|pSS?7VKR+++@UHfsHgX2rRaRj0=>uktB$vKMU zgAsO20Fo3FmG@SQzg%P+7$Ws|B*#(qr92VU(wBOf{bD!#FaM7Km)NRI7ljSYD_^k# z&flSGuM8(dE*gG}diJ2<-;7?V53c!`)Z6~f`hO#2rz&dYq`=Pqh^Tq5eA5!|${s;I z+jG>@QPB?@6A2E)d?B;(w-dx@9nC~AauCD&O#rjAv-@j8DM=<}sT)02+PmvA(9sJ)+ z{ol{^w&DMk)P>b=pRgs81LT#&@P-qMa>~fgapoJzBR$Wyd+KF2Awk&U0eK%SQKF0g zNE+b9s12LtI-B3o^hdl_ysh(fsR9nqQ*@hSqY^#7OH3}zmey)B76_KMWz3)ka>KjAZY5Y z%yqTn9&IVHj(5E0tfjdzye~R%w}``0GH@^VQ{flTn)1P)!-G^Q z8S2M4{pNaVBoe==u}E@3wPRBsOLFJbcn^q1T{7h)3208)n&4W)ZhlCh5`31H6_BB+39>OU zw6V;%ZeY4&MH7F)<&#m_ad$qtCe8NA(7ySB`J{<6h~XlZm*bX*zRy?>{-i*p`P?Pm z8gkU7r_FFm#>45s)T*d6%X+@h_&Jxc!bOQ7ftuoi2j2k<+aOQ}HI8bjZOoJ7HDHLM zCSwfa`n`V7-`(5U>STy1uJnzJ;tKuyMWrY*niB&m(Trn~1h?sY4i0h|4z@ZBg0vy8gL z;j9F`d%viiB==7i=9+8)Q zTZ+qDMp`DSy~WTXw%?Ew*s-rkH@5M+#b;lCAB{_bt+Gu{b*7jg@iR^OXN$>@U{LBG zS`$ToapUJi?Zvnq-@{zdk#a&$mkSV2XSUOkj>oF=>soA)w33oA6O#V$#_bMb_=Q3@ z!X@km_3`ef=Y#e*>Eo}hrcM)E_R_5iJmsG!1*jAZNZrVjL)47|X&DocoS94s@tDap zf@{!&_nRDtx;M7c#T~juZ}`!18aG6+R<%TC_S4KEvamU*r7zD)tgNMaqc&~!veP(fqAGUIw{TYFKhL!IG*Url z^rx0)DshP^m4SlVz5n4wS|*7+3X-=tXWyqsh;GmT&ZZ^lbPAZGOa|F(=diK zQP+Shf6%07EeyVsOHba~(5m*7C)-DS-9W-rKd2(uj{hXx7DKpDXJuPs<>NKVVQtfM ziw}J!3hM2{ z=*utUFFS~)desi+KsH8{Q4bJ9(m!Rnz6LEwte{Y@nH@yBGoq~9LX)>xd2h|s;7uqb zmPt=7ZpAWkS`x-{uz4n|w17K*FtkVVUvZBf6X(yr9Qgb-s%{L?<1kvig(gZCx^74L z3^7{})X$<%=??ni*{NWmhv{BgTdIT8fEy3P>32Y4wQa^$%QOS2jZ-wV_CqNjBTLx# z<#NjMihBmje>cvtGy1NlW#vR!ZNA@Ibfav&=)Fv{?*aO<)Qk~o*IZhg8%%W1qWj%0 zA!myw3J+*T5iM1DO_wcU^X5Yv-3dSY^VzmWL<-2P#SXqjWvy_BjZZRRBjj0!8B34n zs6{K44Q>32Y{4E+a!&^lCE0S4VQ}KX;m<1uB`Q z`dh9ezs|D64bMZe_gfsV4kC@s{c#y!eKo7)JzQ1s(c{qxTtD;5ZRU>JYU_e-?jm`j z!(*b_O`aL3*vQ*@a$&KiF37P;O7(L>W>L$XWK+he?b6GCSeR%y$)jm7e@LOtD2cvU z<0@M_sCmymcRi2Wc0D7&ZgVWtV_k7uo_8uwQFWl*y}R7&s)0|mV{75~Z7{D?XR;*8 zz6W=1?52m{4x?vt6|NNp9}p;8HJ*48(BElyuBJxOZZPi-$%Do?#}Y|^gPZnTunQOS zN1iw>tla(zrP8E+x^upX{B#-kVKV3oOxrZ(*m@tv1;yBEV%&VP>@QEdG?M&~;zjq4 z#%#Qheb_KB5bN5sOD%K_95+vLZwuZ~pL=m*kTD(r2qBi4z3+#e?L+;T2J{kF(9B-G zv;m;vOoIiQ`KrGGdm)zjS+pm6)_7MTAg}Yppbn(G&+JDK-Z-gUnNEi&E%Ei2A$}CE zPzM+Hk`{L7sngjzb}q~Y#GtoKe?Ys7t)hK7h|soY3jNvVH*>hS{rhMO78-Vf(K6=r z;s(Vxk)CRUJ|UVbkMR71^rpQ{Dv2FaSViE2ekD|`Cv$KNa32JIn1#hpSGQkK{5%+j z2UmdJQ~VHrd{o49aQ@{PeIw91#0PLATle2?w+A#o*T?60+ozt*Q18OXwR>Ba_urPTM~3cyp(kYL@MZtHG;WkkT{c=9^M7}V*7 zxwkJhU2TF(>LhXF%s4lmk+-@MV7IQf2LH^5-F)+Dyf?`0tBQZK{hsOjms;odK`7Yc zm)rdYXZ%7_bo8%;+MUKmD>&6AGokyBf*X#RrXLUOHrjorcq2@;H!Y2z(@?1LSzu?B zzwNeIXl&5JV`_JWL2r4+@wRWg6S(0t;U`GX2kq;wM$9voS zJ9AZ4<5|VpubU};;1H8^Id6}}7mid}ySs$h%APd*D^`YW;);sRBCIz)8)bBq`dq@02F9 zk>tcZ*|vPcxCH?Or44*Hq$=rI68 z%6n^isGta)hKyZ8f1_2(WZqsN5N6;K!xmKmVCA+ICgfnh@#C>=v^g8;)ZHPKx1l?< zgI=XvAI+Tlt5e0lI?ZW5u3!vbVn>=jm1319tW6l>~ThU(FcsGTeWDE^O3~%I(NJ;Gk7(zi8l2rjf6d z?uBiJB@7nYjVGevo7VLV91P8TQMn(H;_^Qkd;6_hN*}wP9$`SBD z9lPF%u@CG0{%tAfk4qh;-o)M<8SU-mlAE@$=(PF;O$anmR`MN_O>=rIP}uVje*YEk zSJypC39yE+cNjwM1u%KFhKPW6_Dx)44P5;FylWP$;x<$Vne?Ul?f|-%yXn60jKBM!T zooT-D`UT*hs}^|t-}X_9)cD1N9B&fYp3K2fB(Zn>ZvCyLwbvW(V>)j=Qsm&!4%^Q< zpVTfFL~ z$_0^BhZi0W9T}mPsvOol!F)}xS&c8$MZ@|4q;Bwz@6*^vDyw(hqq6KY!5T7cV&c~C zd}+FZwvW4MC9xhlubeHM19abW)qk2!JWu1|`19ci#(KH%a=b^`b^hYz6!t3lad&~f#t+ZvrnWkcAmvd_dbp7feB6w9*W`{;9Mb+`C87` zhc+A^kfU~VPnMtMy_~2a{>@kg!-G?QE+^&r(S87Kt(9w;@{u{`?)%#G*WuRtX~h$UVVDjNWuD z5%Vhi^a~5HpWLoAiQu-)+#7b-h9qA%wL{y@G?UH7%0H!#M-R1p#mE$|6Ym%yDXzKT z_Xl;JrTHD3e*6@Nc=)`}$@-FcN}$hp{tAA0;g9GI4e@SIsgh2GwCIisUccGbDn?VL z#5MolD!`b{4`Yn1CCPO z-6B~}U!d2buHjK5)fFWnp9;f^qWBI{#BfN_*pVtx#}!a4-EG~awl}3S@6WQAiYTZ* zsF3MshLValQ=ulc>}ju%e|t0O3^IV6bhL70)c&B89#p!j;9VyphNOIr5~RC|Qta?c zo1vH_5w1H@`n6Q7ME8`^TS&weByxr}XX_O^LS&sKh^SeJ8K#v6e;a<#oiz0p6agR1 zxE?N*m%NJ8*dYALqcb{>EoXlKrG2Y<7WO#M4b!7t>%Yo6?O zJBaJ9bB{t9eL?0H0waBP+Gl+iOghh!Z1g8YN?<=XywQSFB3AH1x_-IU+QwTX?arW6 z6bYH0#dA7Can0^oGE+Zrym|<=ii^Me^WKO~IdESe26Zi^JHfgAp}L;TBFhO8MpaU8 zy~JFjPzSMbJHTWBP4Fg`j~oW03sEbCyw5!spV=?DukMX`2MC1R9?Q_vX}`#TmF#Qa zM%%sy(&&5XxrT9Lg&jfI-`)V7J=or$^Ll_MDwt1$ZA6z8=I)yb&3w617lG!tipUC2 zSCT|?>*sRnzd)VM6W^$6sGNf6q+}yKii+lFX#SnUw6+7Fq^?!1bKMn5JXN~3h$ZG! zaL_FZZ@Y?5=n(oBd)v_f$}^gN%V*fl^VbPRpNn~FRB@L7vPtJ1l1+TvQuIR0(=I+W zFYu_Qq9t$7GF`cwu3u^8PJJFLG~NHpUE8ZZMGhX{r_Mv_{Jvse!%x+g?-bDy zd|<}CwH?$5S)#dKUSeNSVu!$8&!;Y>rDnmunk25>C+}5K_Y(K;WS`_nMvL0_>BmQ? z@?MNoy&bpdXh{C2InXO5!06DoK?vOflDfuHt*ekus{qV<`Z#wF2X82ixq7j_HI5-iOp#9%AB5;F7%6bfD^#A8**(s!^`!<+jq;rDy&zP zNvb4kmussbCtk}~xd^Iw__i~rod!j7p9wnZ-hY}>MuvY0MM?s67jtM$MT8-2rCxa| z@?CGejPY1$4X2_21zn~8Pkuj@Ukgy>&pqzA!!7qUkcv_*FHg&)mH^^=(iA1onaATj zYL+0L)rD6+1{C`!yf3u)6)8ar7(6Bz-;Z{6tlvOYzPr*xjVIw@7CNm z-4TqP$*4a~axdSgstfQ!TAfjbcX*fnAE}=i5W~6UPX+iKA#J~FvGo?cS?TFa%Y;BL z)VGX)l{vZ{83Oo0=`W|G^a@35A*Jn=lXd-JC#VJ^jZuKjo~8I3g(mMyI$Pu&A;x_R zfuAgS{g60p`V8YKz`s6QRgKSXYGqQNd`n12V8(5whz_Hl7slHUR=3>r8EXFwI791~ zE~zphWsXp8N!c!g7r+f3p&&P$Q1p6`EMLjU8S2YM(MC!ZpM_9kr^-9qRwUY`b=|L2#_6- z(pAaA5?UD~o0K434??G}AgYF4Q^I=Jm?0NQ_%v14oY18Gn_RD029dQr*$^yz1oK5C zzhLfnhL);1k~J+jb_eL6(=WTMrrH);d$geAaGaMParZ6bNz@0Z?)v#0j|a5IPe$1O z>$|YKVQ4>wk8OQWfR=8S$M#lS>*HLUt<0EHGlSgQsLrI6Ov(sOwl&%yWj3t%J>!!rNr)c zFf6~%juu~s@`Y(j`Xu)VhL1GKDJ+2c9fnN^Wb5tPWWBsQsHlkuzrwG_>r&}M0UzL~ zte*H}Tqd>?Y93t-m-@oflZ7o`NcVq2ELr5G-<~PA}cpz-=Jn9DSp`A(5 zDe5zMcasZB$8?HYJRR$;0HcKmwhyy=a79NUPn^@6%O7|y-Mt@u`ue+&XVZ-Zn#tdW z4uN9Y{gn^{WNKsmMYXf?|ED{5rRDf@^jwP5cAF7wJw9{Sd58T%D@R+`6qmtf*kXk} z;a}goHR?R@gC@I6)OAd1|JEM%sx2D$?J!5>eK$c4jw=G}BI%E?*BojRhe&LM`Tuk| zt|e@-y~QY;nk8nJ)r>3iI4{2OGE(K*xdSohX(g}z-N*mml_@wg+BJay{_JqO#XC9K zKk>xz7@&Z#_$Utanu1e5oI0)yj0gA||FYT>FQbe~7g9cb`u@f=nS8ZL{(VcQ=2uAk zN8XjBGBQ`~Y6+L0d4yB50?zVs!A z>dnKP=D$I#F$j;&jJ081m%*%*L|3**UHC98aO}ZT6%}B9b1u~_s%kiFd_;C^>fHo; zcGNuBZJ{$Mu|j4<6`*JNcp9P&rzF%oh|}e%SI^x=kV_?WzfaF`fyP(G%WR&rP7oby zs__1DEzg%VmNtuJw)W~@BJVr#MSj^Qrodk6-tzXVv0sG{>Wy}d=R^*P|3r>SuW$3q z@3{<>o)3oV^Gle~ntctn9=y(Monw`hIV zQ=Wu*Oz{Q;I*u^iG5ygSN-o%&)ImXrF|JWbU(2-yiCN$g!T9s%1?7bLFQM>{Kt6*w zeNjlD@mGKx(B`Lw&D;v~lLFu;ChDOBT<;n;C-w0t>vb}xnAU>gs>{u;gwsh+2WLg;hv~(s8PI_v-6~3I< zd{i!IBKLQg$HUxF1kZbl$;hQ!iDK7dtSiB$Pxqp^U+FwYy0_%!-S(LIBTrRhh`Xj* z*b&L7w(T;pT$#&$4m3bD_2(i3HHbhW%6b{{fatEhB&q@pP2O#J*hK%yZMS)tb|Fsz zVn_y1-yj#SB%c`6leLRfuJ#*nqLE&ZgS7pa&~Js-=HIg#jD`MtqF-t?v)}gD4lB`e z=)v;W(r<#jRV!r$mr(70q6>IeY05X^K|ZK1BId9l7>R3a%X;*b*SoBjqB=c0FkfwH zjw%EUV7P0vB|c6nT1lOe&4^!1z8&kLS!WASu(NzK@&z)<8+iQuy_;X3t1{;D8QW|o(1 z`=7NSn--09N?wD4>tL~WU+rq*Qi~7aq{W#I1S}IR<+M@OfdX$R@z(X%mORh!1O%F2 zneTz&{=O6b*HedK-?p%0()IV&WBi%-s9B&OV+#H1%fh8kfxVVBFD%Fl(V6kjrDxk~ zK+Mvh%)M%Ofd1fFl*rprA1(35Hd#pg{Z%3e0fOHSdR+8~c5X#s^2veZ&#w5oam3Rq z18;IzyJ}iA+}Gd|KiBhYW@}NS_i@{gwWh zfU^mb7=0&9pch1spFzCo$ESBIv_Y_@EZ^FTtt5q8vN1oW_vvp7iw}DIB!QU-pqCE&`%+-#-M4Hn(KPgeGnX z%>AD9Ur3phxuD8hH|Y%sAM+v6UkjC5snQ6CK>I7w750j>Y=PO|cuh{HXW)|^4ek5(v^`8oM$&yup5KgUYNn6??7*HNr=5E} zE<}|fTi%Yoql)3G%Z5&g03q!XSvZ%$p9gT0@6|%Am4E1NzqpqM7a@6OKP`z;a1Gew z^s#0PwEV2K8ujq;Cw8rAi_g0E^3L|#@P?mzf=Y~*jk2c=>LKhp>QBh0hZS#KoyAs> zGIL%NL+!SZz>f*YW*D=Z7C+4{N?tk1Zs6*)Tn3_Wx=VGNH}fXbxX?F(WXDdRtDn#I z@TNZ*8Jm0&>Zi&s1Xm{(EUjn@d!l!62xBvnf3n}t&|C80zMnJPsJ0jBfwFQ^!*-$_ z*l#j}TLitU#&bO&WYR}mU{?qCDam~Q>w`aspSK9#V`;|pR!vsD&fLYE4n}{D^zN@g zmQko4haY}#TT64(3Vp=z_y+Qc9YN{o2)b)E^Y=2op;Tvi`Y%c5kHhK%m&av2l;U)K zMn{9>iI%3WpxZvWbT*P3z~E!>et%vA9%#0M?o-zN1J%mGsd~M zZ=ciMV|-`y{sT4k-b?15YprL^`OLY166wS>{$X{!B~=70(!izv_AFnNzmy^N zy2<~)xmy2D2TipgBTr3@m5FYDy8% zFRDtK2;XjHAuCn9sCQkyn+lN=zfIyy_boJJ3 z28p2H4MfMS=I`-6g1PeW9)>7dF4t6sstA4crY{+)RJk~!GpOM1u#NU4b^foyzIJFz zUd~rsyw58aoak;;?*4uomVRl&P0vX3G*Zcv!iZ*wgG_^l$_=)#rFVrQdf~3u5~h<}xYHoXI7(QZ5N2sL@7X79?~BeCldOTr z$-mc>Az*&2l%%m3y>KSG)B(18{Mnv0_S8^wh9sD{z*=kOM%ieDBI|iI0z#{t$P=ds+ z(lY<|4p^nP;nIn&Bljj)ZSUuXISp-oQN=IW@Ca0Z zJG(T#(o#;aX>H@$LO8PsXsSf|+22>Zi?#I>e=4EnH+lgv*EafC9sA|)64`(f_x?!s zP0nvUcmL3i2Yv9xftE&Iv0I1p*V1jnJT4Jkyme;MkyE`iKeGl4d8N6Mv1QujSIr6j zff98@ZEJZ5z^{-*UfXxhUV% z2MWuTH2d@uK3WF5__s6PoO#9V5uY1)PiG@G#e#TB%k6>!t4v*sc4(KzKMHQ!{CBRaSnxmSum5@HU8e_-P6}uokeCW2FbRZ~gTw@Z z>al_YaegP_01e!o|9k^j7%PJBgg(1oWPv;XyO_Aw)&8Gfz6`}ccB><~Dy74)ohf>3 zBRqnFe&L3G+ZhKFpP}QjQ;4oxw(<3Ea`JzMe_XPw86CAX+C4VhsBfMV=(Iiz_#j_5 zk@C&^7}~sjTt*Wi?sgF<^Il!HIPw-b@i;JjzXb@;slFq(s0+QQw+25|>|ns=;NYkR zz5HPtm*=XSr4n7(NgiuC(S(^zE1YRWV^0Utpk5;KGW!vvQNPiKhq{I zq18JFUpg|LXyhVXMlo-mh29ve|0nF0gmJ>C~j=kW?#D!i-ZH^3IvQv?lo3hZ@!Cql5Ts^SDyJIk>ppwc=uGekb^&;T#?G znKKtOuft-ind9t(nerbi>!}pt#j@-;UN`D#dOrnd;Ru1EB$8p-+Ol@m9urRIXoemK zmn~0ZDHwz(@{U^@Hkfx0Us53KgBfaw{_;bh8r7x}aiq6i^xM|X3dpCZ%z{}!C0W=^ z2X{kf&(Gl(E3ifar%e;h>7xegH@hL+^n(bek$hvtk*~+^2CragA-i_9?aDjb~oE8~N9;mrc9)TS4OR>aWPHG3Y_L3usnGbWWz zWt1j?LX}opYj9Wo#}OWkMLn})23t;#uXG+T+%86ZpU**Bo%2qic5e4KD?t1cs(JLT zs^&$xX5XlT9j(@lqG4$Dl#3WN7?+mPz z&Vu7L2hFnRk2VGo3#GL!IA3X^94a=Gii~WQ{{hfiUZX#rEDmO5o;j?C(UN3f;=3JL zHY7>Tx|<-y##e| zgx=5e7$7WHB zLeFkfQORKHF*R@_qlD}qzp5J>*qtdKbtzoQZr2W%EmWILmg^lm4@1SiELOlIwkMf# zQ|i?VsK`&r9xUfut@vdBp8qvYZ5H7kkrItCZONz_2WKs7M(>N|hYS?KY%lLbv+c4= zp?i|k7oFHTca1|COuz-dYiA0N*GHxr)Pao{5cn~0=mY7x$^aK0tN(gF@xth=M)iDc zvF(1Xv$qI`Zym{P-SUPZp@skfvbjADK8}ut)uV4xu5}MODbRJ)P>jdt3Mv*!GB%uZ z3%tSIdp@JSGJr*%l{VdnO2c_!suSCy@VK*wg-Aivsm8?Y2K&g&ZD!$?^^KWLebcD; zp6c2#SY803XpFpe$oK=$J0P^iqmt%~&1j=RjQVt+*3(kB<@C$Fj;3=NaNGn#o#B6n#3g|)8Mls1`kl` z`~tq;ujnc{nS8rQE24)vOnwu{-7C$s432g7k{GJmlwn+hPJCzW`o%*LE)k?9^3W|ZF z`(C`3oPJxgr5#zra0QWv?(;VfE6kZjb}GYBHPth_%!&2QpCLlQi|-bj4GSH?9bwCY z;g>zVjg~v=Q^trVLc06lxbX4!jq3+n$tuwN1K4elI>6QeX|jy?o}?47CEq;aO=%v~ z*_sJ^{rgsF4*t}~MtXBFC#m4Gi31sWakEo%%LQ_zeK$iOkLQ&W)F3OJf zGRa#AEy?plI*B5KVu&W$?6x*}o%RQZN~e|7_|~~D?(z3A>jz)4Z9T%a^+zT^e#gSE z&NTptlwH&z{~GQSx~SNms+29UPZDw*Iz?Q(BAq>-y&%#MRqc78r^=Ha96oSg;UdiN zNL;Vpa%#Az-idG5xQvrY+)b7+N%4#S<8M_&#e^a(AgRCRS+FzvhB6JY*mh`pYA_FT zFh)Xyl=5reczA{LfY0yBoBFP_Kzvo_J9k0SzB{RnnL+{*T&97xyuS;-Ukz>%C0zkOxdV@ z1OiPh0*edXwLKHS1^*$7M=6n^4UpDRx%j6vsyL82eODlHJXG$Bu9Bc`h%;0&$ zx|Rd#|0KGh9O)Mi*aZMIRQ5X_>FCfE9T$F{WzyT4kJ0}Yxw8TxT zLbm^*}boZD|1@%b5{{~bpXq-;|c5vv$p>H zJX1V>;2@*pVKCzP?AH6y&XXrv4cOwb?Q{Adj3c=~xcg)YN`1c}OcugiEsr2+1S)%Uvvx{9UK-4>?W?m<_2UF zi=IbU^mc6BzPD5t5(&xJTogXhb%;Co;pTuoNIFsVSkO0Xidb7s!f_-xeXC^`k{e8{ zWu_R#CVg|d>y>5F`$_N*3!5CK`xa0aIvw7)?wCXo29|i6%#!IHi;Uwnk}&Mfg%-Pr z^lOG9z6B9IX!DDosM=}#N>DZ(rxi9BX8c?IBK}G7j+c`|h$TuX-g-TW=?=rz?Q*Bn zU#(k5`xENVf(~9+MbV4?P}t5xXHUG0t=DB7G*87lFT2w{{@FRGOkO(Qt`;|Y9X@~D z+4q4r-Jc>?Qd5R&*}R-bDNtKB?ch;xuMZND0vqdPS#Gq%(S5Vet09uuFD1T%oaC-i z8NCZMQtkyX8X7(?*2s;gTp1bi#C|ull50OYv}qXiaf=ou>r~-lg^l03V_irrvxF{U z+P1j;47;%3|Kf|5m7Zck{5)&-n$GKTkv||PxYgtw>^AyMUM)_faUjc#^!wJ)uG7L7 ztL>cEZMs}h#g!5<>3_K(;|X8G;vd!nwKF`t2TJ7~StBn5r@4N5I9Xoa!PRqjOaF~s zL5NOQwrzERTPl6tdLLjs@ql_^_h~F!r#$cSYI$fsej0T|q#yk(QuiD;Yae6#CU~Ln z#&#&rTC!$TQlD=_s9S@7=pJCObWa2SO0&ruX28vcC;)ZpKgA+;!e$rp)iA5@(XJfK zo>)xk)=8KcdyG|b_(e;2c^SoVL_VurS98_$S39UytPm^Z@LXS##mejZJM+y_A~F7f z_7RR%R1^MoArJ1tZ$inmk14vwJKq47fO_AHAjD!7VN{vI@@?d#hGnzCQX;U^^Z+6S zK~C)@a(Ci|Ytr%F+y1z{ZY}xBX5A#POeNkVNxzD`FGpD2;m4AMLL@LRr%tFI|CN9F zx|t>-g{3Ws_0DlIUZYB%iH9=ZC20Dws{b^x`4#_2Cy`F^@JSg=ud&$`XX{4l z*@3r7Se8yB6Y{maLE+Y}LTW1iCQ0)X*k6|N-jd6?xD}5PhJf{=EhIQY67(Pj973WN zG2t0h$CmQosE22CwSZ!ZfY&r$AZR!%`BtHs%xf6XZO-<8+6+Q_b5*hpG0<`EtR%-X zlgUcc82ufuRLVm{5tdveiT^<1k;&e8%Gz3Iv+Ho>`9?unOSu z2;$IXicqGy53Qe++Ikza^nK*o1xC_lH3Z!K@}d2UIcY?YEUd6B8@rEX@c`bszI*^5 zJ!s%2n>g^x!(tHlfxZ3%k+j$E{h!~z{}1AO|6{GXbrYmXKtxQu>P@U0YP;Tt$drxA zC@xlHZ#uWBJ?LVA=oiA0kXaE zH^*jX(l<|iAgxTKiGu{myyv-Vl;X<(dApz;OQBUMu;^fRn~+ou9rsf@mM^bvI^m?#MAOOPpPKy-`WBN#T}!^yc#aUgRo!z5XcDdSe1g^`a&H3c z(bQOc_h`T~2AhlaAXm{<=5nj}Ql{~bHwRy#ZZM@FL&|B7(aNGPbu_@@@OK1AAe*Ug z|Gc4fZpT#seSuOL&*H?6I>##1UEJXp0TVLqFfQCI@IT)pY{AHGH9`1^%KN;RhtrB2 zauuj8@p4!bqxlD`Z|&X%l{~=$(0pws2ckcSBWYBMyIzPkMOF%HB`{Z8hWjuFdGZL@c7lsu4|VetWy)im@ZSv2mC zuH`GU5~-~~bian7XHw;qW~SdFF?T@vuGnF2`U{(2OHt%BLkI5g>NR-X{&W}CguHFo zh;GDgh$uU9*f_XV@cm?0LaLs`MTAt!g@%$>?B(ezFLdK1Bcod1)Z0Y zwg;`FvUbUM{0yJF$rCz$v$)$O@JBN3yy{8A)S-@>h8rbL*0qiGl&R8HA)TK@hbTj& zT(#=Fbpq&0?jP50o^9Lhz-lz;Y8BgIsLSr%NKLK|S(PY@x(o06#!jjqkUunr8rC3I#0Y{GR^mDYL%WBSMw; z2esLH9lGV9opGVYZL&0uZH~(LEpW0y z**r%&yR73oA0O3)R89`xwBdC8qpi29=LZ`Het8Kz_%arbE%>qfj;sJnGH9jvM=lJZ zl@+-z%>y1WU;QCRo#TB#6P0%OZUbj5tSmv?#NLb(?D~!$AHh6OZN#ACvmhiLEID)` zWh0cx6(m*rjCJ^V97m3c^{Qq4{O&FHle55Wy>}SXH>Q7G{F^D}E z#-pL(lB!K-1CCkhCScG__~KJnVU>THcg`Wb!F-y>xg(hJ7^!#Vgej`uEfYo8_D{|$ zttTs0-mic8UR#)?DlXGlR-X!$sGl$OZ5A%otN!+$w&;!1M8|}&c_BTQ+Exo**(vi3 zCRqLsZ*dE_ie$>+{E{CmYz9H0XK+)7t(2-;7SeM(fQCHuX1vePt%MRbJcBW#e zU0bdiJ=HRApk`C2aAqeaXEe_Vo>``>(cO;98Gnt5TNUVckQ=Mf#S{Q2XA^T9Ff8jo zI{8U`_S|uLdXB-;Wtn^x$P8ULV?S+PX4FsR*sVSHqNSy!%o%L~r2E%>(eNpxMsJ0O zH`|gV($xZku~NCrO2m0JPXxoF=-y z?7GpUoOm1VHmMS55pC3vHPz2L?wH(h8#G3JJ;Uo*w-G9otY!mKJdp4EEL2Wj9w8}u zrc`^_C%EeCe&P!OzWWgF%=fS`oL!>3u-&lAmwPt&!IaAQ5YLqaU5g*$25aROW47QE z4h|d%K?UC1S2yHiMjiR=s7GePz%w}AhMwszT_dJ5Ld4!5c$4C4M2JVNNeBJhWw?j( ze08?YI;~fdTQQ%+Fcv7ldC*e%hRho|R_+Ow^E$a-Ir4Q8iWusOQH87=j7j`kfT~4Q(}x-{Ixa1)Jk{IN&5zz( z#k`W8BG$k zw#5)uAFLKJmKSXJ&Zf!DnAfP^U6#<2uHK&6l+MPyy=ayd&DnJ26DjWd_ONBeUL`BJ znuaZ99=ZhKF!}oOB)n22aLgd#!noUf|B16azvmAR)>UeXh{?FM?7_a~`Mz50^5Y?_ zn894R(as-oXLEy*uNe?-yn6wH{vUizv)d};$6dP+C>3@=Hm!K4r~K1JdDZz&e6)!5 zr-~}YCTQ**X!1Uw5_jJMDiQiu>Xn-?`ga9I&gAF*cDlond8ae+=DX3>z7$DaxucyW za*k|wZMs=PvHh4w`qPB-^U8eHl?||B4|)<7EUxK1Kc_Kz%P^-P$aRBHuE>)Mg$ETm znPr8$@&WF-SG-*d6K29E%6rLSl_H6Y-LpSa#JhJCZQCHzAyp9nf_@txnP5^IK7^a^ zac@13kzf)dThVCZu8KuIk;xM?EA2$%%nSZ1V_B7ACNwt+n!E`#yxZeK$SP{Ul6%efz{hZ0lmp;867B_QK`Ipv*FeOUWxR2tFE+G6A zLJ-~0J;GZze|@^h9uAjpa!T@xi*|E8F5Y_vA`eS3SbY4J*o;-TY|?LzYy}78p))vo z4+#FN;&kL}O5_#8A7ZPEm$1kS^na7~o1H)s5_tI%*x3bQX}kIFL<6^U?%BQi?Ua4! z{Ub%Y%{{0G@y;CTlYbYaPycs8X#{yw1~&`b6+UYy*aO{p7w``s;lD=)v4QK)4&KKM zm6&TgjXF(TKRNLOYazm3{}1=p#@FvqBVlOuPvm3lodR>LZ}2Dw;8T>flEtewVI760 z0EYtf>p@;;4g_ILziEdp0XU@K2}pkxi}X+iifNlbz?o?`_N*I_De=E?B1#o-ef5Lf z(H(4jiyOi9%tbUbrR`%CC%YQT*)gNkC4UnINka}?1)CWebFt$FPP^tR%{`CPvC4kG zzE`6MlqV)(_vWS$Am&I`g(Ly`>Ee3!*E>DKirq!v`rDeKc4^aIf!*InwqKFjW#!Ve z8(R?(K2*B#EH1}Sm`77Di?dE;JNFZ5a#>sBbdphjAlujQ?9n44AQFTxr~6a=Y7X#0 zltTxTJRuEbs2|0%?k9JmY&b-plx&FMQ`=RSA;vm7}t| zMOkieN%4)#K8H?Ogf*fTPgXV3FWuAT;XE4wbGWj|m~o~ue_EHaYIEd=XOdCXJWuY` z(M@7EWT}Dx$O7GeW>}495%{nT$om=GU4f^+9deuXLA_dPI`iQhgd*0F_fUZ(GD(1C zZ^oopR{4E!6v_-^$XU0&&?j|s9uGjfKq^;1K!0d%z`p;CQ&wxoEj&yev8@2s3YhF3 zpyF8RsblN%<9F0DLk)rLyJ&y5R%@BGJBuD{p^^oYjEdvsY_^ zKRn!xxD_VElHai-qM9T!M~8TQBQ zYpp)=2}eiQ%%+rT`sk4yyli7I#LIh-mNMvF3;W--ZD6goVqA5&3N-HBoipD@zI;o^ zmG=`?@n3Nyec~5PlCcKZoL-!&YRUIY#kB45ti-IQb}9j(0w!o|Yd5_98Q@EkppvbC zI7SxX$_pMI4VM8)H=C!RKq&7zBf0~X^&(w>0Ic0{zo{y{mu~A1KNkP*mVA)~}8o)xh=fxy8T3y>(?3(q{pc+uNyB{f)oCk#Ddy~b;`o=+>fD&Zn*cQB!X!aXF_yx#dspX8olVow zsPlPIr*AWMZ*E`@&PpX70FaZ@2=&Es`N6R$rtZ82M$|TE6E~4i)oC;D@t{UiVW4g7 zO36%iwyWBV&>6XUFi$POXn7jpyCRz6AcGZsfe0|ui{YOoUG15iCSj7*Z$z2DxNsHd zTC!ssN~8t~u*n*|#VJ6-T_W8#b#ag)g8824YAx-yDnE{$yFEt50erRb%Ka$HXf^%n zkg1w5;6V{92U~YpaMi|@vnVQL74im*V`#>)kw$C}1Zp+xJUH#;5MjEyNJ+j(vlPB+tjO8_%ZA2S0NJpzFz9_=PIOMeI9dTg}fuJA0C#vv)3Z=Im?F zzpiQ@OvD9XrKu0Smgd1UT9~b$4cS`bx%*yMgqYH0u&L>+u9xdfTm#XBxnwcyue1mU z6GE-yn`^)!GpDUvG3DJC2c}V$_r@ap1GSw3x=~!zTI45V zjSaq@@kZOXm)j$_2PxDJ z3XR7c#AJt#vq5HzchlF#!I5{XI`xtSX#112BX!gy8hqP31AJ?sUx7Rd@gaM_;u;t! z%e7q59v}Yc?bCb}%l!_{Q_P0BNeFcZIY|B5E%C(t;*V|Lz4t-t>~5TGU(Xx2*PKsJ z`$g!Rj@yj3z+vYUoMqcE`3Ea*oAazqq8M|8o)W`X`*gubaKwGmn44_WJU{+voeY0~ z^3h$bY9w8~iwCMT0CHh$JaGp*>&`~;I(iZ@ngl#()kG-;wBl#|;LQocvp+f9nxr3K zLnv0|N0*-AtaOJ6ajZS+ni#wv#~#>S>VHO*lHCP;M>+jbyZ!SV(=PkHA?;HqQ`d(P z4Iy*U$0uz)O#ppmBt#hSuaX1!H&xPQN3XB;KJ;6mTJ(;@E|JM?wad*bxb)?wk=|y7 zM=s+$INFJr-iRTaFpysMYf^}?t*-jej0susE#SM80mx$GiILujqvi||tAJ<#B?Yqp zXJkdP+pyZLzHa#fa*BPaE#ON}1nk)9owdi=mc96Ts2r6>F~K_#TLn0XDGz@+oZj_1 zd_Pss8y;4rAd_cnR5Luwa43)TkESmRvWQVEYeId`3OikjFqJ?;q_ox+dQ|(($B3WE zv~I1OFm*bpWeDgRgNcXOJxyJL{rWm4wTn!g3$u*$s&ZKeSD%hL8he{>6&}7B*g2hK zinBPx+%J}G2uwlenp0*>cC0xjohZ--+0*E7Us|3nC=((rRcj46r_HHppOA z7N9fu=4rCk0+$>4?WpfXy^(}NgyO6-VhH89#MxagxC310RmIbzo0OtX9 z7&eJon*Zg$`h=8B8Q;X)k^foJT!j~VG#~~oHF?38HY0lDatO!A_`O8h9KME)oM|#7 zD(JYa+O{(R(qx-zrDsfM(~16j+C1>4mF>N-EX@vUYvm*gG6J-nv~!}o4YhF#JXkx8?Gn*lUHTu@J}SHFK1qs+kV=V3>4aoO`Q&!?CtNLR&-kz{27z%Qz<`B zu5othfZ22Ho!hT}|+Sd&`l~kCH$sMnn z{~+pq@!WZO(Y>nL?d17-<*N9VndRvMlk+f!x}x~1@}r;zH@*A7)~|fS{_kJ%Cbv#I z#!{9NV%Vk#-dv@8O$Jg}nAYa1@9`Gv30rxOQEEx%Z+b#u)h_-Q=2{wuWo+nro=^F{ zwDp>LZ(~q16^#zP-SyKu6*~C`{7_0wy@TbM&+gg^id>3zXMu%OA9lv_Wz^SqqIYyG z0ZDCMC1uF%R;7=-+3aIT^w5**J9a|lF}znueuZe$oI?@bC?m5IO+oxD74}Q0Q|yz8{oIX+#Q_ z*>ct)J|j0r9dlPpUD7U4&+t1NoBuR!kC3vhD>%>Ip4vt)^jRHrKSL!NyVeE>Dqsm_ zk0Kent$A{3&IY0-wJIv4Z3|TH!`_qnnLilZIW|Y*rN1mOjx^`J^J^0X1ywC&}x`}7`EU4fv?0D{k+#C&~wBYq? zE)`eM-;H&*Pz}y?k6Ia+&@WrnIOnUUZS0B6q>E0#U3 z!Z{HJ!Q>(CRdXJI!1rJ)v(~3l-cGrkg|^R-X9TkiR9- zYak399%{3R8NLxC#wo$B8%d4%8S}%sMP;d7_c!7L^7Q75Vxb`%*2G-~GXo#Q#ZKD} z12?OH{QJ|An9gC7wFcP!9U|n%C6=da(ev9p+ko|C>_#DmaU3qC=sB zJ7YW;u@FnqW%Vd?$_V5Egkb;^u}%Y2%tzO{w)50hAizTZrAaRAd7hE#{)l#m0~@%N z`VqpE(xBla?R>AeUO~6kAiv=IVm)J`B?KP{oIQ(aHK&|k(;f>xtij(N-CQoEb)tY_ zoTU_7iNd!nKU?s6PF&bGZYtEzK0|W1%0Cuh>tH$a1fmjPI3Zf`%M?59i}?tbjx`3- z7&ZKca&FyIlvgbkQk^IRz2xs0lRJ90mf`sBOnuxr-cfjPc@pXTl`gjewAPMK@9*ac<-6Ma~^7hTx8bw8|@md7M&G|Wv+h`HRtdQ|D`ugZG zv9x2I<9(z@TMnWPvy3F>q{^C@ z#?^vI<8qh~@BEzfhgM#3UmL$_XDJ$!x(@=nxaYteSJx?oX=PiyRjwzyx!o}-I} z*koOAeYTuq_>8JA)Q=u5?hg3OmOGw_`+~S1k$|g#puRXVU5y&oWf0@|7%Q}~HXBR7 z4Io(_BJ2dw0t~N&^Fc+|CWfm4|s z5ojJ@u81fp_>PS|BR1YVx|9&31S&gv3Ut-uA<@c-omxhPyZ24@4Tbj-Y_bw23IMb# zSpsq|cmx6|xys7!Ld?dZOMCV#Z@+?;{CD^WB%G7@HtF7O05@RC)lQa%y}|7|GPr{d408!9LW=z@`G#dC+lO zf7la@(C^9fLC1`^4BH5mZ2aCgVa!oV5}~@MIbt{`?YTS}fM=1j;Cq6~L@JIP$KNEW z(*+#JmB>{!HJW8_eK#UrPVVanG!bd|B2zKd=w2qNpbK0enq{^Mkn;f6bWS76{E}Oc z=;6nQ0p$67R3`70RQu07!$R+Ntb`^PGw%;4MDr?Th4;uor3i)KdcA5K z?-Nes^yOOxWZTGje~?*f2dn;BTBrdmz<>p}D|W8*U@>cqH8bwxeIgj3UtbbGUPQmt z{jmOllkYXFii*iF1tXJ&E>>z2HCXze4bd($w{mcTQOI`SYbK^`_Nrv6hhJlvRjjM+ z6bQHPn6F(7Vd2Hgdi0JeJxBMers|Q++V(TR^lMjw3Meko_D;#;qMmvss!5RaMib}G z;1z2~E9|Wdt5U7a6cC;A>n@f>6-v%aEcJY((&$SRCUXVMkX^5I8q4>JXtpd92sM0E zcO$NLSU_MAuM#X&!Z8BQP1b93cXZSkvXx{5e1A#oQnPD1CVE9K)xf|gc>(|n(2Bt) zWxSYKp%;rq!ug%=;u49TTOgymN^OLHrQPCEK+|W_ODo}R<60Ic>(L){O__EeW}kL` z8)jd$5|r+W8pnPLo)>`1gT4{HL)UGxful{VQYc<-jj=^2@TNO?yvH%LTbf-yREBCb ze_!XImK{a*^$JV+ zZpm(r2{I8hN{lEAWWy5VU=diIwUIhe<3KQ5hK)*qX++)BIx6XQN zglW=k7W&h~DA`TR9tcdD)!KA@+k%K-OiG!dz5x=W_y@E1?rlw@F_k}_V%M=~1^=^l zW|Gl+ot{)8WI!`O9xrclh{a$l!~O!b{si1O*z3QVr5ekw%mkcz*Ag>)|IZl}>jHaq zygSQ+?eqZKbpiz7zyHkX64;VJ{{c&%2lSt7&27--)$y*VRNq-6{>gf+;Qjj_qaTux zk&4qWKL4b|*o;RL7MsQ0F5s;dr1E9TBuIE6f+?8(Wh)}moMc1>;&O|EX7?rHbbdjT0M5z%$ShD0I%u5sRH!iJXl6Ue9F70(sFfMkQmFI z=5)TV8~bytl`TR2y;%dT7V~-;%(g%w&)X1*Oj^0~C1EVkM424oWxq8QUqK|_TlL61 zSR-Z4`1#D*9qU7sEN{D*VS}ec73uw~twsYkGg*UWF`mz+n;Z7#N!YVG1pfN-J8-mq z(X`ZLRLl(iC0vXKm#53~o!JzDiLR8rqM3hCsU2OUW_eMQV{dH3^b3w}HptG$NzzlK zY8IxOw~)-!uSw^)zf7CHXpFAba5LNMZwWnPV1a6%B~Lwb&YO;+p2k#5=#@FWcF-!% zguC=-z3fmLY;rZMXOm~HDVS8|KR)ou&zsMLgS)XQkvxDy(>TAO+I@_bsjs{;wv2mIz4E+u3}=gcvVP~1M6;5~;^XjV!Spi&OtiY}SdqWH zUjF^p@f6*`DA&?T7Yb*xzY^bQAFFz0E2xoLY+^CqfHd$?s^%V9Bj0)3=Qq3=dy{cj zmV;H2>eha`up@2h@s^Nvj){TfOszGII=I0;qgs|_Cr}gmsY0jBesr|7s)$_Ll2!Yo zo6}ZYn68lEl4qgy5nr0ybZLh$C0pXPXk`G=R)5JD*rglK_*cr+% zHc6JABy2DA!EKzn+G4{zKgpnwSJ6aZV$MhV(3XGF5ols6_ic`zn^Aw&-y$z2tsdAl z?v3#2*!Yq9wLeaf8THxTa8~YYye-~-n!o*6kqb+MHjlsNP_+u1};lic4yb<}7I_cHOpuXYnL!f3cNkHl7 z^SteG$b2qUaTkt*l9+O=omSvA+hQ~BlIn8yW;;>Q)0-u4s#PD{y)3SVqiCNwcGJ(@oslD__Q>oZaife*i|=W5Kw)=e?RRJ5bY1q_ zZX^mFTj)~C@)iZ|7YP`G!12?GTB*S?AP z7DFeE?S@C+5H|A;=zlOC9RGx8nE;Q020l9d8!3beIY@`oVef3P{$rdCMO<)maz4&Z zw7K?N4e&euDf>E_hkYj17C>r{94tf=Q~I}3rNh@9dJV*00b^b^n&sb5tv1UlDk@^j82I?*n!E7w#}amm0o_shM=u?%V~W@*0Vaul zm9yJb*vXN*`>W*h$uNfpm0PH1M}?-}ZmwaahS@EAQF zP3s0vyB!ABpwa`p*~`W3gDg&h+8jSbqm;jP^t&CG^C1h$mwLGSpVjr;oP5*uR~c|R zxbR+PD}wQgMP6n0F~ITQ!30n@5?*bI<9ba(mMvKW_nP=7#*FYN_#OukbKrf6VRb?H z_*lP?E*Hx@(5bJ0n;F+UYf&P-`;rRCD@5=;nY~=mzE@ZDnK^QI7kGR-KDWa*ExyJ@ zmI|J8Jw6744e4y96N>Vl`T>>zZ>P;5+WqxI6SbgkS_+8_x21H&@*HnDuWocJ6Yix_k7IuaZJfK?!+uv- zPu$fdD0VP@h0UZz20QFI&98uLjC8s#>5)xT3Tv%ljC&lJqcxE<#+05rM6)t3m z2)wT?5gi2YB#5bqRF|R6h+0=6G7MRi3O2O$$k;y!z}(cAFy-ocY2v_>1e{^VY5p-s znHh&|bbSlij*ePCz_}}F@xE;RfEHIfFC%E? z2S@Ez^i*hO9h}EQ+NX}CK_~CIthr+BmhI`F@PzR0nRA^gkihIw7D`yRjQp~n^~y!aZReO|&IxjHgKoV|9v{C0 z=gc|H($Srjdg|$wL*h9-t|dF>#676H@!afuU1V8dDopQNa;0^D<#fC5x3ZAgi`kr{ z;X4Xihz-%}scsmyHB&T5#rAO`+?Rt^SpTjpcu^P8{=Fjf)JL(iXwTfWXLHv&14nx~9;jmBILMN2Kzruy7H$?=FjOqMH1tutGaYgLx za5l^LMX5-B)ErlL>>$FK=r!6c^~m=pZq1u%y@Pg~RYol=6k7xyM!hgm3>Z(f$6OtS z`62(P;?9ZGujijWF59w~NAAiE=|V}SHUzxw;+{XmPM29b{p_dZv4>sYSLlkaBnxQG zhssckLbOO@agm#BE}~)>cg}^W=;~MfGQLDKw2iwI6Gq3bUHyWg{Bs-R3Hp*R8Aun{ z^yO3q=1ON#w-;W6?9lFR_7ps@r+0?6@^;tCvW(LVS1yaTR*wmjx8Q3y5vlnyfg6_? zQBWvVEx%JS#%7z8qOYZ-;8MY6)N#KSS0-J&x$FaE)Vqm1#NElcwt+=*8hJINKYO+! zyLtgJH+tSn*idSB;Vtj`?(Ke=osHoM1W;7DVK}$Q6U&B4?k_b1#``nzRBV;y)Nc~J z1e}wv#*q7pqIP4(n9aE>YDH+~em8L4MNTEr!R z)8x6xp&Ddzf`l_o)R@cjUAWNFE>5Fx9in=#;359B3U@1$>7HVflNwdoc?XjDXV1oE z_~FtThYQ0}BS$>MZ&@k`Skh9(>-w}P!2#?c;+7+~*+wTtzWP3S^PLs3Xm|wGAR3FD z?{`L4)~vYh1+N-$kd>$G?adLZ*n)*>){AP68byXBsbwFvd@GB~XxBsumS$CdapZq} z`s>c>eBUnh>J9m^@>OlLgwBjIpOypnosE7mSdU)V%>B6~)3eIIHPBv#;a+KWqtuq9R z50xpsB8Brl$wD=iQ2h0;^h(_IW*pjT_Zx>53r*_<sjWib}MaLm@mw#PWC@*Jz$x72Xh1zrLJkrW*2|gHDtz2IQTvDXGM{Jf;_RzeIkRo^E znF|dgwmMg@+_Xb`nJY$-Cb;|W$G)W^_T6CX&0oFy2zeEfq9_saD@z!LQD_HDkfN!k zcbJ)kvg&zr-g5^)3}TXOIt}zb{qR@1Zlx?ki}CRsqdz6zgt$ng{}i`Alf^7Wun@Nb zM+BrC7xv3*3IEy>>N~~}q)p{_tcJTfH?6_zYByHDS0%V?_<^F*{J){na#|7 z>{1b|eQpYCpV2$}ygkp$=rgxVwu4ee=*d_+@cA_>YxKCT?+DqQ@={-TpDZi784uZ) zlV3@OJnT5eweZUnmP9%Rjy>f+FqSPRg6tTgbjxxBW1?G#wPJeJUkd>fe_#T#`0Z(_ zJ<_`r&Rd9&kQlod^iPq?ZI^|nYz`dP?9NrD@6Zdo4wfIMP=K!%jJCGmhRFJ>o%IAf z{%;0MleM-+PWx@d!2X-l8G1FxZM`y&ZkMy&nB3W)x@zE`6E?DBby0+D49-ZxBo!aF z=PZ^#`qliI+jQGE_HPrr}9e|Rj7kyIrz9i3U*knTZoNy zznnVX4+8Nyl3ZtJ8h9RrO2jG#2&59G&?tpn5g0wtJ&H@c-^81@xuQ&?<)egzgeZF0 zizX4Wf8WMuk0VI9JnPlBKRqL`Y*S+)u0X||9t#`AAg40EvHY#f_+?&W?7wXRCf(=&}dm$Qnu5a-5 zj?!XJ%S?|BQ?7(`oi;PE(AO$Fhw13EIxV)aMBAyvlQ|!~z(?~l1mt_}{IQcneJKP@ z2LS=y<7OsqJ5#SiO0_@k=FfPq;-D|*}5c>{7BbFtxrHjUG7qSHU95N@B#n;aDr>4r%U^dj+4wJoMPZI z?J#3R(yXB*Cfz~Wuz9{LZTaIflhL@p=U{>HHJpFDgh)XqF_6m35mEyZ`_IoM4Ve=#thIxSh%n zr)IrCT4`e{`)d4rt4lkz&sv@AzSDRPC+oH{-F>zis>L|_YV-JxUAofx4qKQVtE>EY zeRy~{0001BYHG%*OzU1gX?RSuUE}_zz4N-(j=f}(_wBSZ+4*bSwy5^U`&^O7Hy!Q# z{*v+6HLS{dynO$iciy>T;lhOh006*jmrVawHEDN)r0LAec`ul8>R?oBk&eEJX1g6{ zN%fzk`8LzlYKv2zNzl7`Qvb!#V8scqY^ z$22)w4>^gtwwv`0n&>Ar_PZoaN7tnzZNGlt_44cV;hyq8x9{7x?}`;GRz!DqcK`qY zz;xyPPs;z4(wf;`(&`YMw62p(?R{?TFs0i2?%EsUB%+lO9)%k1V^d0-7T;|aQY3XN zj-HErbvZCdCm30iG+9==ySgTif$;`3H9fv*q(ftWAI-O^f05L^Z!9le{cWZ-?brUU zk|x)%Sy)rur13juFSC(FKmF-Xv*6{w<;^_t#1ps8n>X(d&p!L?SiE>~0000mJ2kuS zpKRNfS0+tgj{DJc-1SZS4&-a9;Y4E}n4=Lzn)k1ne!rg5=+V^QdbgSrqzw}wjeo-G zLX(K^l`gCW^F|;n3bWz&yIvM|y%}wyzN}Fyx!PQP0 zK9rP3-X}+&Yo4mxS5IN~+%@t@TKOXB1PhZaa4E&x@4OTHp4%6P46zO5X({8hH#?*Y(bs1=