From b3a3e78d1871e4167168d0a6ffb54a5897980804 Mon Sep 17 00:00:00 2001 From: Arumugam Subramanian Date: Sat, 25 Nov 2023 15:34:35 +0530 Subject: [PATCH] Feat: excited to release this major update (#9) * feat: file based cred resolver * feat: hashicorp vault integration for ServiceNow * feat: hashicorp vault integration for ServiceNow * feat: hashicorp vault integration for ServiceNow --- .gitignore | 2 + CHANGELOG.md | 10 +- README.md | 59 +++ images/img.png | Bin 0 -> 43674 bytes images/img_1.png | Bin 0 -> 67710 bytes images/img_2.png | Bin 0 -> 36668 bytes pom.xml | 8 +- {test => setup/file-vault}/creds.properties | 0 setup/hashicorp-vault/README.md | 59 +++ src/com/snc/discovery/CredentialResolver.java | 167 +++----- .../AzureKeyVaultCredentialResolver.java | 38 +- .../FileCredentialResolver.java | 10 +- .../HashicorpVaultCredentialResolver.java | 361 ++++++++++++++++++ .../discovery/hashicorpVault/TLSConfig.java | 192 ++++++++++ .../discovery/hashicorpVault/VaultError.java | 19 + .../discovery/hashicorpVault/VaultSecret.java | 21 + 16 files changed, 821 insertions(+), 125 deletions(-) create mode 100644 images/img.png create mode 100644 images/img_1.png create mode 100644 images/img_2.png rename {test => setup/file-vault}/creds.properties (100%) create mode 100644 setup/hashicorp-vault/README.md rename src/com/snc/discovery/{ => azureKeyVault}/AzureKeyVaultCredentialResolver.java (86%) rename src/com/snc/discovery/{ => fileVault}/FileCredentialResolver.java (89%) create mode 100644 src/com/snc/discovery/hashicorpVault/HashicorpVaultCredentialResolver.java create mode 100644 src/com/snc/discovery/hashicorpVault/TLSConfig.java create mode 100644 src/com/snc/discovery/hashicorpVault/VaultError.java create mode 100644 src/com/snc/discovery/hashicorpVault/VaultSecret.java diff --git a/.gitignore b/.gitignore index 2f43530..fade76c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ buildNumber.properties .project # JDT-specific (Eclipse Java Development Tools) .classpath +/setup/hashicorp-vault-configs/ +/setup/hashicorp-vault/ diff --git a/CHANGELOG.md b/CHANGELOG.md index f7b7264..fd08e6c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,6 @@ -### Minor Release -Feat: Added file vault. Now you can manage the credentials locally in midserver -through properties file -Feat: refactored the code to support multiple secret vault platform \ No newline at end of file +### Major Release +#### Feat: excited to release this major update +* Added file vault. Now you can manage the credentials locally in midserver through properties file +* Refactored the code to support multiple secret vault platform +* ServiceNow External credential resolver support for Hashicorp Vault as secret vault provider +* Docs: added detailed README for all the components \ No newline at end of file diff --git a/README.md b/README.md index 4d67b9d..f6b0146 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,61 @@ # servicenow-ecs-azure-key-vault ServiceNow External Credential Storage integration with Azure Key Vault + +## setup +* Upload the jar file to servicenow instance under mid server jars + +* https://github.com/arumugamsubramanian/servicenow-ecs-multi-secret-vault/releases + + +![img_1.png](images%2Fimg_1.png) + +## file based credential setup + +* copy [creds.properties](setup%2Ffile-vault%2Fcreds.properties) to mid server +* Add mid server properties in config.xml +```text + +``` +* Create a credential in below format + +![img.png](images%2Fimg.png) + +* creds in file should have +```text +filevault-linux.ssh_password.user=root +filevault-linux.ssh_password.pswd=xxx + +Pattern: +credID.credtype.user +``` + +### Note: The cred ID should always start with `file` + +## Azure Key Vault Setup + +### Note: The cred ID should always start with `akv` + +## Hashicorp Vault Setup + +Credit: Thanks to Hashicorp Vault for the code reference. This integration was forked from https://github.com/hashicorp/vault-servicenow-credential-resolver + +* follow [README.md](setup%2Fhashicorp-vault%2FREADME.md) to setup local vault server in docker +* Add mid-server properties in config.xml +* mid.external_credentials.vault.address (string: "") - Address of Vault Agent as resolveable by the MID server. For example, if Vault Agent is on the same server as the MID server it could be https://127.0.0.1:8200. +* mid.external_credentials.vault.ca (string: "") - The CA certificate to trust for TLS in PEM format. If unset, the system's trusted CAs will be used. +* mid.external_credentials.vault.tls_skip_verify (string: "") - When set to true, skips verification of the Vault server TLS certificiate. Setting this to true is not recommended for production. +```text + + + + + +``` +* credentials ID format in ServiceNow credentials +```text +hv/secret/data/linux # always start with 'hv/' without quotes, otherwise it will not consider hashicorp vault as secret provider. + +Format: +hv/ +``` +![img_2.png](images%2Fimg_2.png) \ No newline at end of file diff --git a/images/img.png b/images/img.png new file mode 100644 index 0000000000000000000000000000000000000000..369b266e7cbc512a4ac7c5fcd93af9c03b9d5df0 GIT binary patch literal 43674 zcmc$`XH=7E+b-oeN*#e9N^cRQ2og%@p(!X) zst^o>k_Z6;Ce+Z90QurPkIwu3*=w)8f9(4YD|fl-S&#F$`1|f16V6kDrw$!D#Ch|E z;k`qLjujm`beQktan>C_ookJU4*hlLrlH>bP-jXzt?8`Qv(-taVRcXhV#lC*D||X) ztlg=JY)!DS+Hb3_sIqbbH3U0=(hbVzZSTzAm4v-jm%7Mx_3hh}voUY~I&$Z)lb`=Q zd6nz+#f0~I!gn8AC!syy6JB}wsj1ndhXw0YJ96C}V@j5yqM|E$hcdOU##{pIlT59C zUky$NW}5oHe_A!93mU$w_;o#UP)V@<{qS2OUCp5h`l9^TStLTjo;#yKk;55nAA7ZsoIvulnmO!-cS4P?+VVA-|>Z z^QLGMHNPKk1;AyHy`O9c@iOesLHSJfAn zz1sO`bIWBH z9kC}Z6pUTF_1N_7tt>~WgaTz6UcTU~ri=rXj-s3ZOubQD730!ToMgTRSjX|nhIc$F zSefV*&jHm)cahZn=-o=)&9BUL-aMk;|5qSH7Pmq82^)UHruR!qqKH#THdXfd2*~>U zS`KzN4YPl=J8)X>buW44_;49K%$IhN0&J2*d6F&h9q1r7F<6WoD$fxR`ojbD?$ptis^%k00T`P+djZ~+00)eB@V zE(zd>V>2*;p;R6Advk7S%y>#OiKnAZ$-E^V;iT#*6R8CO_}ExIWfw&vTM)+g%k93! zX3ABW1_^waImls1GsN(+d}-oodL?W+>8nS84`=exuR>~I#LnYF3I|YBlPAEu6&Nno;WMxcn@ZLp--O*U?ADnMvL|*2&lF&iMGrGO?H=0Ec zyJgtbQ~Ij-&&7e;q4)SZT&8yA^Hy^%ab}KzL(4{<2)QNtY+Gsi`n0gjMWT!Pa<9R! zu{Ct!GFc+;!ZWSUc5Ag|^(jw(506G8#Mu5AFmNe79a*b3J#jgqfcCLc_DrLqE@zPk zKnajk7UYlO40C%6SVYXkSt8SbHheMdmMZ>quF&y^}~%k8;GvHK|!; zoFlb^e;BxgZU(8v%@{xPERNvX{(#`UVrBmT)2p4Yx^k&F5oWDhZ1LZL1-)(dTz`i< zZIV0`i6Whwk?USkp3r2iV={!{o6+77Y0~ILmGH7~SZold_sNBT#+;ip9a=W_>))n5 zJ!@#9=8Lmudq_NTii%fQTDfcdekxzL2}U}_+#vu z4?Xe&BCqBito8S5)5LQ+a>LBThG}77_+t;xtGw{N z0&aJmOLU=okbIXE5Ax06G3)Un8l8Q+#vID19juOmo5GyV@4%H8xTaRxHYRX4qq>=(EP9Pbo0sZ-45>EK3rvf@+=Cq^f^)}9e%s8%{PjgDu6joxUnZ=h zF8AAFd71g(N()%;+a}@(?YSCDfB<%jx=eqw?KzCpv$nxZ1t6;Osi#sH`En+L0|TJ? zjERR6wY0i-4Y<6eZ`|=xO>o~g?F{QH^Rh6g*GV{7>y|@W#>)(>5p>7d~Z(ZK8XT zC$qhe4aY1bmGvchSBd53N8pWIvR-6X$;>LU_2U+rO`k0`VZoJc06e)l7tF2~1j%~P zE*?IyY0@o^p}y8box0gQzuOV|;8J0@W0VDt8M~k8aoQr$Ja)M-NmgfMzvP#{bAo>V zV1&anBh9wEde!P;6P*X}woT>tf;Y-T1Pz;p-8Zl-^G(QzsZC2iHryI)HKgS~Lf%(P zSXtba);btUL<(?&ZzKx3iys}9>qM#6^T3{7I|Dm2aW8VG-LiGFq@T>6p?by;9_b#$ zlYF#0rkZv==e1U_*=aH98^BQ-&9mLqn*s?rAG1&k+R73FS0#CbwedOE>Gs;`>OIMe zyUuv(l@GmDrni|^j_G>r<6>qbctR8s3X1R;C=f!;KG=PhD9eudTBISH8(G6v8P-lu zZ*VFtX$bBZ@@?Cw@UGZ?^=q=h=__gnZUpZ-t9OK6(J&volaR4Cd^TvnVeQs7HLAfI z7Cd2!pYY@{8xv_O=zM*N&p$o$zNKH~&$$H4-f=S3;##$uZbaiL-z@gn0>U}`F?T4E-EVtq-Dh-KNw zM-XR}Na4^@AmkEK?$NSDaqcTf<|Pnza`o2?>G`}@2ERlyTFG^p!0Eeeg*H{;N@>H2 z^vsClUiSfKD;1y?#io$js@+;ycUiSsz(hTYus>v_PcQO9xhaKtztP*|HSge!b32sW zru!p{q)+p%_N`6>27ju!B`y-ZI4M!d){PeFtWjM3TSATt^lAmdQhVMfaKLOVP4>S%d|vORPuhhoE2m5g})qTvDFS}>p$>8JkO$0H7{x(5KDuJS)ym?m;*%`V9I6YMd8 zXqJ4sM|+C;og_f0zL$OQH7*{(pVITWbslPt*HYif>M0M=BIds>=d%+y5qZ}$Kr_<)EZA2;?d`NngzZP_2Y%px$6Ge^T1aCiB zD6QZLUqUwgV?ZN{PRu+~5;RmRXzH;>*O3C3!=62Exth=s^}`|E%NX{91D>hdDN~=c zuobZy5}a=_YN9+Hpxx=?u=q$Lc(`_JdPv_+&`{2P(~lq4_kR3Q4yd^Pazb3;sLBZ^ z{k6MY=cIrYNfG{A?{HeVP1a_=qxK0t(SW_>3!bI(0lG0)ruMgV-_)Vuj;ZZ5>;k2c zt?u1|Z)Wg-1$^>g0@PFdr8-2Q^WjYo9#b2EyJrp2D~cJ?(55reQG4r|h0>fwHkF~B zXZ{p>{B^3AY_AvS2$+6i3a>3pG}-6xHxhYl}$07cm|@63G8f7YSpo9E@!n(=bp>e$%Elcr)P`&x|k8c zL7i%XMrac*mpE@EqLvqL#*M*!u7EGk>CAjI zauL;@AH94*c|qmFI!pu@yX4AahBLrm<2#B3VBEqFg}Y-gA=CTDmy2O~fj)oiPX##C zoe=wxrz&Phkl#+1Hw9vv@Euo@5@(djq2E6=>4y$H`5a?8A!>L;#2y~2m!OJdJ8l`ZJE-5Pjn8 z#lj$tmz}$=HuE3iL-#qWV-9H?AI6k{-=>|uXIa2q6ejyXx9y4#zGFX8w(lWhQUBps z)sORESXQe$6S&e_)$SM6_+*~pWpV9@LPCL3h~CNYYC$NJU(|mX#EKSha=D?TX%}rw z!IO#X*3M0l!aZ|z0e?>?4I3w~9dgjsyH{^}ur3NOL1+^%T6yxK3} z9vh^yx5(?%1EB9(x@h;^BrS2W6?v)T!N4Ew0t%KbvL-hHCr+U_%Fh{^H@iLI@ASIu zPx!t(zFp*huC+z)i380`^C!^aTfrn2nz)BY!E-CGMwdjbrl>=$J#My6jF-Wlznhd{FMz=24i=Xp2cR z%?%Da?QjdtLuL8izB?kp!6gt@UWL05rL9>R{XTT=+gPmiw@l|qD}J%Eh@b(oi-x6G zo`pb2ck}v;4l=)miK$zN11%VAxOi}KBbt`5vo_2|@Oae`Ze8ul_~kA# zxcS;7v5YC$8yWKc0mc!8@&*pBh2>+Xdd_< z)Q`~5>ZNv!9tRitfXHebQC8HglH6Y>_cm}?ze!=wGDZ>mz(!C_A9f&Gsi&q^Q?D z1XTqN-ijX3X-JB2kndv7pG?t>9^E2b+~V}k9Yh*$-WlYXDty=&)Wsgv9_qWCi%Yk0 z;*IlCIiTzrT@V%x8px^{z=%ak_Z!@PvOrkdF7?@uGjjRev>}!pkDzf8q^1o|5-q(@xhyQRRuOaW*fT{i{KmWyon4zaT z$c3#SmkxeGxGH6;CQ_GM-&a4fE7;ynX@89>cM3z$bh(#RFu!hB2RR(BTNmnB+ewo+ z{8YP}{k&{>xZH1Vt2>$6G!lE9TQ!NBmjeEYEEq?7cIm~r@wYMcqBy#@o_Qt}UKl~D zF7LEt)E9t6yIkVfYy@D_kO#U6rCT!dJ7&@yj_o*9P>oMfX5 zEQs;?M;>e7VS7KxGiy^EK$ol1W# zK;uwHzXRh`^y2w(AD;bdT3Eqh)`WZLZGx>pusZ~>7H&Gw@r&%Kk> z3!E^zA!vAsj0)~=UdxF(|FNUpjgP9^tniQxpo-dyB0zS5B*8Zc!rVHg6 z>nxYB5OB+(f@&VeifLRD7x{o(#6{QWnIdueTemwW`%1jIupz@GHrB_6D--46GwNc~ zVe-I8yI-T9VEl%*3XTt(qUB|hmozUmzGnd*dY8KEpCv=pmGZa+$N~((D|gNMHuRML zP$rZ92(1q<1+8V(HpN7~ye6@mM3$&`7nTVZFs46o7v8t8<2XDV2yK(g&>Is7bK^1h zcHX}H^s$eCS!ZwBr;Hg>F-Ab?kXz3%Q^_gjD_HS@;`GZvi3FHaS&cU8e6}ueSl*E} zG3rC6q8NPZC!(`78_oBwaesQJ8*pLKCTGQT_rxDe&j*CBWy;jE$A;?@NFUPM+;#0W z(Bhg0Z~mI!IMmB7*K#peF~~ktOd76e-;Oca{F#fMAEurU6wUlSeXW0{&%#%K28I+? zvU8K_Q1vC`%bTSzMjV-BgBCeO>w=O zbaW^t^=M-)0d)8dUCf=%7Glap+~8)b^xz0|d!45yW_W4Fog#Y_*XU8;boZLXQ4j-f z-&v~&TOu+{4!bPKgxg-AqCup~F(u$f&gjU})bsCSs*fH}$j!b-YXUv=)$cS59(i(r z~akn(rB^;p9*PkVFT4m9m#qgxZdZT&K2TUu+dTQ{jt z>-@1{|9$`Pt_6NW%N_=bhGm<93ql%A`5bI{U!t*F>+Pp+m8}~6f}SQlfb$6GO#{76 zkWJf*ft>bh`Ay3;cd+?>Ll4ripA~#oxX0dX$hNB*7{+jTz zWrPw7Uso0WH&Lso2sZf_`nCGMs0Gl~ay9V-_kZfZczE&O%lD(Wz2Wa`;<;XZ z!tbm8T(sxu-+hD&)r3-&dYQt1TWZi!J!^=GH_?3a?|Y9f{jVx4k9ZLOzUuo;-2UIj zCM)#*EuB;}TK(^DVbogVL9!%a;}fO6sCS3Z09SoA0_LCWEB&dw@TsmK)+wWS0XF(my~Pz)Nf z-9~v8J7kkw-5}G@6EdbI7FIOh=VOf30e8*$U|t1O^d5f(m$lCr=p zI0yF^z@ZjI9jIc6#r9I$Co7`28L){`ZH;xfi?s|Hw0q&3{n&gvEO&d-qjl)C*g&3> zO2_9NF^F;m_(!)Dk&NpN*N@uRpC(}uttl+zCL7TaS>J6u#18ev(TcGR)f8xYx{7xQ zEZMqswj&;CQ>J6D68U<3B|P9wkX-4EGsf7vq9Pj8cx?D+KaA}{{P8Zfg8iUTgIf2BOG8nb7uOhH)lz%!V0YZ1Zgqc0?0&Dg_HM#s zy%I_h04~@&0-7y|*n?9>yASTGbZ8Bt=3zA}3==0CD{LjDX$)1n`t~m*C#Fio!Ag~< zxTtp<0PTyZK)Qo~+6pU;vc#(0J^>e6^8L9xfZ6di@29M(H6=CIKjEm#SE#FKv&+Td zpDuLn!-1eo_!HxAy9W>GPO_RAf(=%1myjX0ePZfnp#Ts$_|@n^&y zlkU8>#N2yBNq6CU2p?SK$R|XtrBYgedsX)a$-XpsBtn0nrTR%qIF> zsrh`n%=BtP#X6`FRqz$Q_su*~wCcptu6-k&K71wzN zl+y~cwSJ+&eZ3U{R z&|LGq%`*@s=e0cb*(lE|tC0dIa7?Ju2?+hRYkguk=GlE@LGx1Mua8+Xuc^ z9hCNKYpP~g+3A5pzw-T1SML)1snebc>t*}gU!2=IY1Z}S9?Yc}N(NP~N)Tusy|`NJ zI)L1e(R5FN^GhxoA@uL%au#{T4$`jxbtM^|a^7uZfjoU7^#_c>`vXroNssTV!X@f$Mn8-SrDh+xO2t$mHqdQxTtAU?QS z3+!m~a|@8zNY4e^N14+)5)TkNu{t#TC+ff(wJAp{>?D@qLno^gFHT{A(wctZPuhz6 zZlcq16iDk7E^L0NJhb zx%=%*Ifvc8{W|kk@LP*b!+;q}hqC=IY9O z>3mUNC_|nz0Bv7}9|QHPEl^HdK|hq}Der%(B^c*@r45~kbp3qbA&A#XzuP0WJ$VGl zQoK=+-Ckgd*GR7nVBS@0T*BuBW4_yi&uSZo;B!9TQ&$i^Ie;|DkGumCquR+kaR~Op zxUp!!En{x2rh9|Px8H|1qM-xG@%T0X_6q~lxjQGud_+(ZSL9rn)nlp#Phuky3unS$fhU8{$!@vCC(mJZJ0Vd8(;5<^n&`XMs}Y$^*!B1811+&Mbx~YZy^#m5gA~!D zz}J)#^;cCyvC^(9+_a^F>hX0?G2R6xhV8CLi-p>j#A?WJgn^ShglKGvq@>N(Q9{)P z5UIeP@U&kd4rMspvaw{eBGBG3zZkw4;BqN$A zd3S@SzM63n+F#%D6GXY5l3z-q|pt}7w zlO96oO30X{u9&V?k6JinA=-1L>8;zk(?i0j{c%F9F*%}5ZKY&ZahHQ;qC`p-__eXF1cxD0VRgTNrMN+f&ghZm#vzy$6MO<+%b z|0`LEUZXN+o&m*B=+L=028mZBN44djy?=4*5554&wwuQJX5N+HP&uCycT zta>fg%ukZtgwJU&5JO2~+6u1=5BK`_ZGP4*PU)}{sPAmR z{FRI`;UlIyB!I9eo?UH{Bf!yekn?qt1hE+G=kpcQR|L*9FP%sB3 z=Y`wOe#?;6wBr~(>1tn8bsud0Vjrw2e5@V0lLtHjz0Qj|^IW%+IgIO3XmW?k?5@Cj z-@!B*&QzW`PGT6qSR|U|+)UuuC!S=x0yDgC~(yJSZq*7V59?B8aWm@PCjqwKU z9{XPB`0RL9_+c~;`p|{3fLAMQR7D+TvAYO_q+XhpF>k3F`LSfCc_IA6=6YtzG_7D^ zU@W({DuhBRBA-}IU3OtU)+Ob9R$dQNG1| >^;bSU{oW3l+CGe;9J0ja3^u#**{+ z1a;!ix03>aDjUw%ND%$7Jrl=?0UI3cXkQgnA)!>yB;1#%Ii$T5jNbXIbGUC-dq{VN ze=bxO#rL3NuT~H6k<#7V.GqViPUBh8>#z@CR;d#oZ%D~^U%Uwt(cjf!dyaL2Py zo~RkPz-YE@2u^XlfMszgCv+opLw*z~3(xRN)17Mvk^dMSoQ_jFvF7caFT0TGca>b( z*wnCmtl0>ZmFXTq>+u?*b=P<06rhMtUbC@Dr+D}rleqnFI?P-=$0Iwk-r0Ts(X1Ia zCcq_yd+z%)0Y*ULg~QCHJ0O((g~Q}8DQ^y+ld`z~?Cs+@Flr>%R+7$vwmy0P(A(W& zvc9D8(PREuz1I&UERWukPQ2wbWpjUScECva`0(Z*CMD6Q94HYfOLl&FV&y0A-SiOb z9k($R0#C4YZ}g?42On4#bez~0U?>4^Ry9qVntwi5HpJXy#d;s;8|QGlcyQ<9hP<#8 zfi`rNv&gdCr$-10DWT2sYB?OMaZ;GNIp5liEQcrxH^Fne)j81s;@g@}&o9p0LRETN zBnUY4-%WLAe#+?o967J`p1dO5?GJ@;`8)3Q1H%?mN8ECJXF?OE&SxODwZJ7b71ArDh17?xZq~ob>PsiFM22a-}tvApM zDduA@MnhN1w?y8mh_=|loF3K6HUI6=dQx3oZi8OcSG}^WQ9ev8q0o5%XwoXGQ?UxK z(SZ-|8)Vyp3E4|q7BJZ&>FwqNK(P%18R^!N(Ew{Q-oA<0acqF$sC7X$j(n&^aqY{0 z4(vpjiVe!;hgx5*iS)kjL3quQ(TEhj6fvw(hQ(P!UTMB$^UJI%gnx$=$6*I-(|VkP z!Sy65nEEw`J+b(hzqEZOKMP4>NUaN3b2Gizif{|+av$U|oskwKfTY{)71_yG>_wJr zSq3k3YU`@y)o&!Z8D{B)MZveNA+pdTVrQCv@*oWBvWrj~BEp|G*29gf;Xn9m6qHBBUTl~w&F*aWTckS*`F!7)t?5)gfuL^PY+@w}) z6;M?-oT+ecj+I3H4tvroTW9hFU-aVc?V`5PYNCH?(}rjO_v0&zNsPCP&WEUI<2>Dh zrskBnfX`}c2~Whj>J?s-Lg)Dt<_Cn~qbcKYkdxD&6$Q&zKM}?EKOH^~t!BAN=W4uT zu=&_$|19h^Vzceet%0!%RKnj#)ZY~qT&9y}44Y8iT%~1QFJUCWu49%fDEHLu1Hg9u z#Pf4cB#%1UzPV(s^KSFQ<@*J$x66y*of~kcMycZur)hRUf=@1{U&SA(#+liU@zJ59BNii~KJ39ma;NG=|>ib_VF;b$=p0zq_Nsi4D)}nPVo3mf5T&zyq zHg9*!!aiFHxr`sx379O-K?k-Czj+Cd#MaM=*TB?lhKs}n69><2Wen9ik#7?EZKOD4 zCd#rRGZSH#VT4_~9^K+Z`bQRZZ6VVsI8PvgX8^#gdUz3YuQk=$4e%gZ|eSx;Jx6LYjm!(!OhX+AhJkaB@EHb8IHS@5iw_9GOsK+G-H4b}E5JMEJnJ zYSvM7%K8RwU%&m=t+kwt(>Z6jc#GnemyE}R>#uXk#EQW!tuivj!?(T=_NiyR5dCd( zOi(DF-9iT2P7HEKjJ~ozAH9eS%U0zqO5LH+Y5AltEV8BjZA|)S7AWPwwyZ|L(lAsA z&%pM_jD;JC8+$58CN0cwRL|GD&b5if)3`plrF$!o3itLD9ujvY>G(8}S6)u-&OG^@ z_>wX1DmxDIb`*6?#Nwd#Jaag&!^X5pqp@m!im%Kis)zm7n4EcOevRvSDg zpPN<#!!X{!5Y)oe@Ra@`b-~)RP7L`dAMw?c@C%G*TVFYEN?&^G&S=3~^dO1t-Yn`* z0OZNaLqd(|AZA^uyeY}}N5r1s({*7v+Ip7g8{1Vu>wkpbW>cU9?P6b+M0A~gXD#v) zxoL0r&aa5&Q!tGzwBWiutwvv8PS(+}m`b!e&bM5D<_;(}@hl)aG5r&y@0tCA!`ua` zyxh5KkzHvAd^&`Cb>}YV`;=e*6gyM@EMX~Dpyk2?jm^Xirk5xq*(Gx0VS&*iIELfFO_ToKBX(KlejopmAG`xybSKqdo9! zUgc3OUDmb}z+NTn)R{kI?qnA*XQ_4I(l;+{Saj8L^`2bRrn`9i2kA!|yx>2Z*QF}1 zmSWiza@mT6G+49(2frJ{=4LUsW*c&ryTb+|VgqUBb=yf2QLFFt@W9amOxvfOhHNex8S12U%gs#>@^BzvYhI-o-y)F{dE!xW3i_PP4_t~cKv*s5QeH~o z{g9!X$)a+gvG}5)+F#b+i0pkOp=w8}pA| zz>l_ZjClBD+S1GxN~(&R{KhB@A+AZst*jDIQs_Xx9UUjK#qwK;;;{{+cuv%K>DF~v zE5G`ADENoStFVYOhL@K(pz)*$;dt?hZ$x_@p?Shdk) z9Eim0oaw}{KWB&z0Bk+moZvGfkJfS-Btj2*$i_ajfrH{Io*_oVvqg8<(74Kpt&0nP zk7XKXSX6h6-AG*A+d0)YNZR@_0NM#Of?I?Omj?B!%VOJmf4uM#(a6D?{mix|GQ@MP z&%`sSCNu8WWNw3U#P+`fyN=1oB=%ta@6Vk)+N_rZ;7nvLm7Tkc@GUo86SJ1&sWmzd zxOr;dYx*|xaX`0X^Z5MOX+}NK)$CYOqBiw$EwLwsU4>i*5(e14IVXm}xTerrg)YV< z?lw>AgOZugl!V2OzqID5UF^zRtyW^bI8C>{r2JilA>RSF9b^U7N935t2ghe4$0$a(53v)+?BVcd`f zNawEZW9fjrH6<&1+}gD3g!{9_BDZUP;3>X!k2mF8y4`yNdaRI%qESc@wp@+iLxgCb zJ;oN+x2+?yv~=VpsAjoR!dYoU&A>?QF-^$gz~Yt$!lT8GWisvW>S^S2W6T#F9n&-AxTw+<#*v)|!Z^DNH>O*t|9rF%-4hr+aB( zD5~09q)+du|WN;DkzI07)FSp`Dgna>65O=brUqC za$9B$A!m<#Q#j~~XPiCo=Q;Ad8Q7e0Z)ZN>Z|)mDo4ZMR%GJc`a`oeacE;^=QMg=? zXvT-F=O>;Zmua$UBdb<8TAOow3#Fhcl_-y}RFwS(@L1^NZTNAep(?7PVuH!41SC81 zFlh{cH0PUZM15djty#&ef&6K?ua0dSe4>()j(ctzd_Qd2NQaI2cxsb^N@pbb%npc_s zaLP0f(0C@{T-`-GiE}TTfhSw-f)TwQxZpZJSp05_#kwoQ)z&^3au$)Y!OF&-CX+!C zY@H+4J~Tg`alU%%Bn0n9`ohgjXDgcai%$f!1LJAw4P^&-j$c51IAm~-Pa4kg`2yO?FVv4rrQ-qSBQA%Qy`H`#M zP~)`u&anm<2qqVoI2Zu>uUgT9eA)wU&42joM$?(vpp~*#0C(4e!#LYJA?NGoN+85> ztw$_^iVcg4ba-MfoGlrs0W}2SjP#T@9)F7Moa$5*!+cu4d_yA1UAyp!&nIC)HctqMY|VvM=c#4MB6c$K&3`yCSWqQP?MEL@j;yciEL59}vbja| z83hHf;_alFM;*EB2VV-R18TGz0mp}9+SYZiG>U>ZcjxxRSkJlNLw$GXLjUO1bkSEq zb=l}0hwYScRx*ESYr%deFj+X>D5&>8xjggEXhrTQ>Y%*h5wpoxPx*;OF-X}7yq5F) z+(wRneT?6qF@t@vuY?8zAsyOKWJFq`Kb=~8v8A~bpqF^2OBI=9+;3AnzF?mYEBJhH zmChEBcI!rXz~2-ia(^m;f`%mUUv7TgW#cVY*5~QondTdUAYPnUT(|ghG8=ZgkBk8H zlG3+1rxSdl5IcC;h;WX&_GIA`<(2XKA9oaFh@pNDv;Xk~Zo{Mj?P;CJjncj=FG`C< znCloxZxI$HllMoy+oNUT#fT@`Y0C_IQju|zn!(h`PySPj3bJDQbIYt$82Mj3YhWTj z;GPoMcbk6qAHXV{6r;FgUFp+-9J<=DXzT7c93ns#0fQLD!#k#jOxN;YDRJ^mJ=0;^=7o;2kvI7hT_l@swba7LGS}ALfcv zz}>=CZH7#&MB z<*UP?h1pQ2U|n!A-Z605>!W>8uV=gFLrq_LcA69OzEuNr0xK@KR2qH$q4xW=pRliZ zHLW~AO48^E&Yn3e*1wTWCHUK$7lSm{grB1ygKv8W+P_G%nrna}2^u{#k^mwh^w2p( zwCB0|t38Nm`aY&ZaofBSy7~;hU;2Y;A@X@4da>R|-WzIeWflM2m%FH;QCs>=WyJFj zR{^A1!2X^DKnC-abXPkr!h!yvnDKXD+jc=-b?A)?0B{LhpMKq}Y>9oJC00Kkyo%Zw zk%*)`cYEvkpVt0QkIVialQ~#)pUHS&HuPX>q$2xY28b0IcbBK#Z8pt^1XZeV|4kCI zvO;*USWRQOO>x%4F~f~X|33NV&SIq;|A*yz1LN^O_#=-lv1md6GHVh7Py9coUcV|#>pz^`xjawm7k>aAJ&hTC~K5nQb*OiUcaf(d@6@g;8LMxR~-rMlZD(`m`gd&jN5 z{c(vTGYHH>$4UMi`I8as*BG^{nViS(VsTe7+f4)ozXOk+gyAhDDYsfhjxcWkqSRyf9A|=@eHiu$Mu)2MXD=IV6m*~^ES)KwOU*T zo~H%gK0YV{Z4QONheiVOSTw3luKJ7hm+LFI0=)zVXg*he5~yS(IK5_vCXEb_E3P|c z6cAYr7l*t~vC_{I(F%5N4G!ZxpZfIJe z=U>JtvzX-lV|3%wsqX*Kyp|kTtv{51zm2+Y``eR&_hXSr{GXg&KaLGI0k(`)57ryfU+m&zCy`5Xk`YAjq3wX-SK>MQw)JuV<{s5&c=j?*0uB+3BTP5S zI3VX}4=e6GUogK}c1>_l>Y@Sn&w2AaM$#uc84RC^dI2wsMwjlmyW3bgrQgBWA9J>T?O5 z*o^Ofe5;L5i!nvT6rH*a2a1+vLw4F-cH4LG+}$bKnstf;L)%kQNr^}^6R`k&hwaRS zP4l0tew{}Ou)85u9ehnlT5q%aU1xt}RKEt!sHwm5|2NWrrTI%zTg+r3!p+18L*0Y| zHD(JX%`zS&wmP0_`b|gGcS5+a<(o_->vSYQ$2%AVSTJz$R81H(&y8P$R<}p-_OcE~ z+wimSN&#+weKw4hNK02bZn?4!b5u~il(~bt2el>fw_l29l1m|l~>_s8VKc-)^b~}f42l~ zc8d=8Gq{T!IHw~w%f#v54O05I0c&5sZtSWtM81|(YUwHW-69D65h7j9XUIDDzt;Qs z;hryVS3RZG`jwxzx!2Z);c?BQ1CS_ExVe2BfgqTKI!N5S}b%o3Y;{w)bbm0~#9VWn;=QzatA#OVg>}z)&QZ z+wqjN+hB7w1H)q3pNch-`%#mrwd&I=+d5lu7tGw~larbsT`FHC1oj~cVRvZhm#Vq; zb&hN?8KtJ2g%TiBgU^CrSmkVfJh2Q=o#rp6N1keS%s9Pz8Cz*5^vt#~Icx>R=;(#W zld@ZIx{QOWC!P9a;EKqLzf^j7@)1ZqK79X&EWiKF zw^uiSL6T?gC;b(c75pO_qklQ+lz}4_)r7S<>?L{szIIk-$5-1E=gvyr@QPJ37aUP$ z9rsn|7ShmY(_LvB^wn9KUB|`Pk@cH}8@CQh3iHNDgmD3T;KUtKqz;umq?9nsuOf|6=W(DB^f-x6UCD z2LZ74;jSoo_h^l>X3GLf!DV-AjBs+ECax*gF*1=JCwcVKJL~qdD|#@knPMKFZn?;Y zkl?|!(--RJoG%gnI);y8M*C2j9lAE0!@YuPB-gQfG40dN_OOXqkXFKR)Z&Ad zuyOdz!NSvcq=;6CJ3F83scB^_BX4%y|GO9$JNo#(4d#S8aRV;Ec;<%C>U-DVd(j{r zvgRlibNrY3UN3p&A{pStldn(qu$MiQep2#9>Mn5K9IyLnUP@C~kt@r$5U@#cXA#p#-LL$$^welK9t$m1h zX`y8D_uwP`Kla``s;MpN7qy^>ilC@~bQMvN-lU75C@5F~X_13~NbiIal&&HmU8*2O zr70l22q*zU2u%WnfQTg2Py&RIklYo(bI$jD_l|MLeQ$j4jW^!@!=Z8QwO845&foma zIoBTDu&4$_cZ;0)&|f|*4aALLG$r+-nvucKyaHUiHgPBW>cxko@b+8wcNh zKD)gb*&4FyACz#F>R~Q!8EFEv7Qtj4&ST7aepJJ>k~QK7*>KqGq6mnvK0m%wwz#uO&#o_G|=ZzEwsP81wD->g5<7!ZlsY6xv6U@~qM} zxhd8hd#zCd#tJjC47M}%{{R#moHIih4Z}Yn@Ubk?-*Y7Jg{(?j1>xq*^5+n##szGUe6ms?;QXt^hhqCv(%nBA@`|@Y}^`;gNkEKUZwAX!e8;>-U zgb>6fVn*c;pMx`y43jP3U;;|Hqd@r4wNdltQ-cHdysJS$)}^}|*-nz@i}_3{LigL% zOUE;&c`z%W9F>{rM;*5-afvGEq)l+9v0W7k$BhNkm&YNG!czUNCnY3wcPM)d!l$gm z!~3?>Nsuog?Z|W~Q_#8P{2Ol(rKW#n)RkSEcozDZZ4ye%IM92Cgirq&ZwNVn3dwAM zw6kbu8nCmL@#1LDD3NUH!~E4#?<@{9E@iiQg>}7lRGd7JJdw@bQBr$M)X;$694;X? z=xO|0T3yWHO(-mcCkK>p_`Wf26!$-U_bQ|n%bN9!av{AYHt)4y@+Z%UkDQu`;bmu| z#D21@-u1R-L%iF0L<|Al@#tWQoxfi62yx=MnM~-o{frmVdt-0Dee|j+KXAVxqt7|V>7-)xa<3}A17IDjrp|bz~W^e(dzy6 zW@=EpCBy%w&G(IG69P5?RD{(aeR$k(uq-|!)K{?v_9`e%bkt!yX*$Yv`D?u#f) zzU%$zqKBC=FI>&{LyAl!+MV;Tg$maEo4D$}oD4{L?H%*uS{#z;^0Ngx8yN|u!5`em zzV7ZOjuR0Pl4i95KR3F3ltxjK;|~HJj3=A~P{ei-q4aC_9%5HuibEdHi>n}F=KFc` z(2wkKe7r;yMS{S*?vM_mCRWKRDGE+3W@X=|Y?0XRZjd5A;}*D_F2S~8DdRt+?)C3g z(V0Yu`d_@F|FdD(C`vZ_1E&_L4{p98AKWpuCjG~ttaFebMu$b>YZ{;Wp?McGe$I#&_{}tIUi@j01#YhE=fkA$N#nmFbiGlXCLt^>-~CFYwwxV2HHlY!{EQ&p2W!NbC}xid&N&m zf0~*cIMHdNc^Hh{RuSXn&T89P`@~m%wwuureZI*a>15*It$&J-)>W53>x7qD!aMEJMP|02!>=`j5|1-H z?o?Fh$xU~X!6Ed_Ki4P|0xs>niviq!PjcCk;h{=LZ~CK~6vPx941e3(+#FW60E1-M zbYizSir27+zrE9;)><;(punLwiE}lhskx8%amO|r{UcWF1ztu)&f!r%%4CU@~pwq6#b52K_`7Fg79_j8L;xoYz z9l^Ef{Nj>;wPN~FDwT-p{gv!|BvlpvMtuCLnZLtoMF5F3xX#K`9pS`mTRB{?Nucx? z8x+G7mDjpXHLLEVMF~*PD$fVLESbYpU-(8mH6pdxDQ?BUufkDKBGO~D=W=%$@*sPVzenFSpG?3F6>IVpRK6$xUUvtKWAXZOZLWo;AHPlHB zE2R1p$Yw3tFJQTys#n1QFV=+Hz)EDNb$G9JJB!!Mtv(-9dBc{a2w94%?nXy`h399PyQPY#4&>?} z$;)DROq(y354!9!hCf+W#BiqAhX7YfhiGGn*GaNi9fqg(;E;Z8EIXsf+q0AqP0`S1%?3 zz~Vj9@dZ7~PGH^l;II4!F0Fv&MfhL{C&b{KI&pR^UR*t);nPWs-TY{9M!g%V$xi?_ zVB{spn3SG*z{acS_)90Wip?lK7a?`aJ=5(Mf11J-3(cVnYHo^TDmR_1Gum~J>WyR( zyWF6ey6jlBvbw;2Ig}-9blV9zFQT;`_)fUFY>F++Mbcp?Vqtxgkci{B(;Fpw>}vm& z{BTwt`A1H*i`MTWMm$LV@gC??tf?ONNG0uc40fX~|POsS5K_a#EUPJr_L_DJ=`xKDnU9dd<(Va`L# z?CY{a=NX;)yp#>cQCq4+Rhe&ATHcwU8XBZCl;^r!Fesr8A~PYON%S%coBN?eGq*195cF{IH%gc? z?ZmgPw`cZtiyGD?nfzr51nim<@Ld<*mXUQ2qD)4w|$=K=u`*xYe={ z8_hq^rUL7?UTL_$!@B%t=(v%StXbp`MZ7pnI2{n$3kRZnCKymF8=~2Ox+c&Cg*ppu zT-4Mz*4nM_Vzsu)lBS;jZeo|p>KcbdQoEJc^`MDTlvzTd8S%E~j~^2KteLD^#i7Q` z*tOdYc@TV=@1bg}px^Tb*oFOB&s-MKahC#mq`mo361ll zit@`MT@;{Ss<(zQT4IeHa+da`KF{mPV$d(4((C3X)$R|xk*JaPmx_$4q-$nhtDaJ+r}(HU&ZW2NJW^JQ|qdQ z%C@zO-E-Faj|ZA&fYZ}XsGUjgn%L_&RHn#?_MQ2L<9|kB=kGc;f9hBBe)1j>(ovO+ z(64VCX;&f2XX1b*x)u<^8|-$_Rs472cr7kbP?CUK9HV~Mgea0&)#*)=)Kv@*&v}N* zz1A?%gU}Au8R3NZy*?h|D7!X)Lfv;a|7v4f3wecX2hoNmIA#r_wZ%s=EW z(B$7%OGbsbCTIxsxD3X94`ujUJ&-YO)5Y5OMDdqTLtzS$byYDn(Z#~VOrE*7v zI5+6S{=4pAA_NwHe2dB#1K_VL6z3;@6ijm)HtgIv#wy0b;yP)0|GvlDR_IG2`W9+yUeJr<7Q; zB{H&5h*L;_`=bRz49fUu8nYG2 z;9I}^>ru@=&~0nyTHl7M1e*r?1*bmR3}85j?ClQi+S>k;()WZo8Ea~L>hG03%-s&8 zBfN|O__r^{`}D8samM@f@49n_Gx+bd)+lR@4$Dh$9IaR7!yZvvUmM?y1E3)RvB$pz z7uVC2W+o@EX>%^M@Hko9^%vaKW@ZE*K91F@W_E*uyOkc@{8G^R9b&Cyjv!`k^jR8H zlJj|kmka<}vkkpXBqMYT@Mq<77df`y23iz&DEq_@bpN9;0goG-u&t2+>f+J>9X$)| zrM}3VJdyLlK?H5`T~tq2E(i!Xl?=M2Pf0uW{XmCK6pwz&M68|kc49F5N=mhmgvHi( zGR=}A-z)XAz~Qy{L5QC6yYr_VgRcfox+p{y7tEkU(uQ&h`aMZ!=;O@l?Pv6oO}Wi0 z2!-}olNr(GEA|5$Zx&z-qjMV zrsWYZb6m!|^)nW)t)^@o+BYr$H1s2uiM|6_gQN>yJ-=%-MSsN^W3VaN8q45hnhwVd z$;BF${nvsf7b|YIUNx6fdZV)~HKF@~O3*x5ts`hO>_iVLMX6B=bO(Woyv-Hbh8yJJ{rpmnyQ~Pm6v8_l-)N(AoQdW zuJ&w(4eXWvmfuW3RkX4PC7^@^{mAiU?+?H;ymdhQBVsmn>{Qb-`c;)wM4rjsz}qc{ zZ}k*1VXePX<^$M`&%#SABPni)g2_8bO)n)5SbY|a9&lP<#0kW!e=p4f#9`20Tt^FK zPws?TJA$KS8V(?`lwY5UQWGyA0*tL$!F@Q;X_sd%Wh^S7CuhaA@KQy$;EBmy!6oNN z>e0u4WM2qBGi;?iPHE?9Cb-ww%>}HkOca0smx7l~F4rD;(}zglTXx@>s;lRmjjVYvl1b{w84)Mu?^oC+_} z&%GIN(QgFm9Z)gs@PHudvN5e%kV zPYs^td}p8bv$rX>PSq3r?B#j@vvHY&h#b3f6rYza7w#D>IK^K5neg~i=95Qa)Yb>a z2Qf}g2Qx2NNipf|#$J=rkX@ij0PbI@`izx^EG5?J@bXgnLb`8W@QRZ^2`hOMR)bho zr^`O9=V~bl*yqcV`fLNlWH3$jV|CIFvu-J9HoX*nbIqX`)zOpd3=$3VRh@NUq%!Rs zV6y`R%4oR}mLXj!s5rH3a86Q}j>?>V@_48u&pzav41*kG1DIo6>2(R0` zMoq{UW)2H;M@*f!KB3FRZ?r<;4+W+ zDdIEhgGN)+r_|>GO3d&lPbA*gko~IY}vk~FvrzwqS5 zgCtxUbG5WZMz>OGKaOi^pjxgh66a=hB7vjEWXwY!9MfS_F4V5(03wP3^{)WwF2H(? z5o_PPrbdC@KPdIMP{&(4e*_>!{(D>k$sql?H&22{7^o^mcpH^kgNpmlu2xpV0M6Xs zg#>nMOzxS-VO7>F2%xaM{po$o&Fhn+Nn_xUp;=Mmu{#F&@h*o8K?dWh`ZwnU{}zbx zjooaSk06ni3o-UYoS22cky%h3X`H7G7~_|d*V+9?<35bZiA|gWUV`mpPl$^8RRnUXb_fTbW;z{_6EC(?SV%lm=-GKh zc1q-gM8Q4;f;m~mITH4aMFcv@JHzikmvqZOB0O^JtcKS?Bcg`;tU^-kiAGVja?45( zB9=qHYBMPEk*a08JhgVK?jkr9S~{FY$JF%ND1TH&l1LfvIai8KI%*FSII(;c<5%y) z3ke_V?;pb!6;-1T)z~Y@TeN%L=5O4+*YZ>24f&u(u9U`yGCUD)Yz~G)6QYw2zhip* zR}51OyPJ8saPi!|bX7i=BSL8?g2H3v>cFG%Iz znsJ#*6jVN4dGmepDpLyi*Vo$4>EF>37)rl6 zajh^HqQH~rjhX}EC(1(lZWqB%7j$x7&o%e*o*dKOJE0_vUpc@r<2JLmoBY>T4IX>Pe<8tw)8D9id(DRhdoxW|=%X)D9&m2yPW=JcMjaRxqqm>%oX^o190 ze~mlpV#Ia4E_cZ73E?wRQ^PFpF~WT13Scx2R>Rb&zs6f`p2ACv&D*D6$E_h1MrY+w z=c*d&;hTN!5I7k4c*o@HdhjRXddkP5A-iKaT=2x^KQFPf?x;H%&iEk0jvee;yDt^* z%i6j552o%NU837J?O@!}E~K5_Rbcw18gp>7fn>2!ozKm->$p>(RUHv?pxEBAfjHtQ zv-!VYYfqA|xyF#egD%Y%n1iEr9Y&kJv&l2OeJ_QrCVDrQqJN)k(~gPl&<2lFV_(vg zZ&*aI4fkC>c|GRz^_WzNGi=wzr6HP=g4;vfv19qg_Rx3yYkWKY8TXEV=JQ`03+zKA zI6RJ|w(Umdc~*TOPr^BupR}|ZadT{rXa`0>L-y&&b-`5Uwdxr|*%XBaELIi&C?Xe^Gc^mya?4om-u(F?1uSBh@`E>2je=l8jFgQ0R_k&J#^S_QBQY=M6#x7N zCex*ikvTY${^#xkj8>(p%|HK-8Xei&u!vJe4&v1Y{T!l{Q&2EM0`6|AP3UUDR+E>aIjfR%D0$fE=|2-P#`jzlej zS#9=%FHbz68#oguxqL$>C|0DDHK@1-cExS&HOVU_MI^%~XK(}JWH$nAFrnymho}A4 zigl<4KAx4W1vnSUB9b;toq*6Ch#~>&Hs2d40`x9ZkCpivvr$g^TDQKeHZRn@0-EAI z{UI+UFWp>z07jnpGEv=7ih>1|-!^q$%*mOzC$rI~B$9je)JtpCmfl;oE3O~xZ?s<^>eO7WEiPx-^|Ev|ihOFoQBbP-4_1-5tuOyf_N#uvHZFC>b zaUk>VEp+47nkQ}SPJwK!mo<74EQ{+%4&n{JKB{}3Xf$Q&Rv2|PDa9+0o|r>de&`if zS(RHXu(6pBtE^8}JGxm6*IWF@2_H>`;lMEgX3ov8ux7|=k7iB8V4T;!`C6hL*-JcV z5;eO{E(8F+Z&9?DsT*r~Svj2l3eLKmC=)pt+Bn{XbD@Mv{m1Q!cJ?4i_U^f;U43P*S4e*uCb4JdhZt25hR&^i)uJaI^RX<)@ zT^l-R2yvTxJA1vzMSkUj4bR@F11a!1o)&xfmTLMsd@8)xlA*?qU`$68X_JsET2 znep}-EqxFD`HWeYJ^krL6>96di2(tAKO^GLAT~L>^wB#UReVQnLP%_fE>;F($T5w} z>a%d|IDcTIDn^EmxQbi~z`e22r7!!Ag>WKhtK=H|+V@3~c;9xHL{lH=ATV=0$%*DZ zRkbuMnNz;lao`qiDKkufn^)nvZS&7Cfd^>nOrn#-2AsSYP@UQLIz7~OdzzO5fS@&( zf~=?`G5zuj?2rQH48Iwxl@Ib zS{OJQ+=T7n9oMm$r3VSfXHb`mCOj0h_`iR=pRe0cGjDEG4&T#lR+7BF#sPb9d3IU( z=hvVVn+*RVpdxxh8?|{o0!p2`6TbTKg4fOwoCGp&n;?Pd!pa5x$Kl0BUlf{p#>_W_ z{c=q1w4P$5PCc)rLk(dy(24Yj?;U`9fJf0lyN zh^bCMcA56&G2WCCE(_D})E{UH!Ryk4XK9~QHeBfzrtEb-$mBbbr!4zi1=TkOQHc72 zh)(jfoXYCJc+mJ6DF-fwLlgz}yTA5xymt|ZpfQkRC7=06E4o&Kr1 zS_!fLVL+ZnH#`W$$+K9_yqI)>cV1ynTjU7MlhvNqq5n?GxOp&30P1dQt3L0=DLaEM zc4CO^hrmhT$=A&yOs(UgMN*l*tXZPxFt6>_sGJRD_bC^1S%dOe6PwHY^Z0nS^wx$@ zc#ED!eP3}Am)@)KxXf!GA_`*kOqzOcYb@K^q~0F_%1>i3(YS-f(ycR&(pv8~28LnUwSobuej*7zpbfId4R zZ$B`=>)sl*S6KKj9pmg9SGbO8+2pwF!WlQ6q+3t8=s4Aq`%QAh-Bcme0$^1%`G{WDl8Sb+m zp?X$Sc}ZKhY-_63D~v8TF@^`acv7CE*V3`Q2Lts0T`hN(Sn;&CGw{Q=_Q{CXpa0{n zKX(f~b2bnW;nl<9)R0`x}6%D~y*-*kt+CY}SX}0CjraA^CqE*&+Z}cHVGq6A!X}?APlcz8P%9e9 z*EV5-3`iaub+76CIae|2SOjs_tRU~Unx7}2{ai@J?kT?b$qZTnxmDe-08@Ljz^ta| zf&2Wg!XZ~e0MUs)Zs724?Qgt*QHfz|cFT8fo)~0&LyQ5Qc{G+)gfx~Jrtd-Rqc(&3 zg{GI-A{nF4e_62zxz9KoUJM2K7k76yMi z_jEU#qbI$`FlB~wcz`;tt$uqKGWdN4{a2z+TNndEvFX74tkEd8Cl~XmT1^;bLap5= zb*pnd^e|?DeqP^U37z-JF-PIxZ-Qt2r>Crti4Em8wo%&r9vy-Q`HpFM6^}D4y&FmO zWqW<yfgg>z$!6xhGHRJZ80(LAVHCsaD`btMhY!`~%(s?2C z!bI9+PmUD?Xflxf`vnQ1t&ApEx8JBa%y9NUE&ZPtZ8I zU|Q<2ZNX7Kwz&!L;7Ass{5hZR%>3?;S-6Pbp$u!z!kb}UUJISdNlbz82HY8h0o;(n zEa3M(xS7R(KqI4!)2w}AnVS26QvH)L>oIL%C(27-|+a=q#GEb;-2CFN0E1t_(FE_rAyOzjQ7y0fshfcpJyvX2hV>1`V5W8vzT=uIYYb76e6yD*Cei zsJ;5qWRI&rRbE7_@6EGmzV9{Mv2^Ubf5U@%Kd2(430K;w<|S#q%23c&kX=)$6hKmm zk>Vbz`%8ya(Yxx4{iJ>wHqekbLJg;UlsZj|g(L&BGGb4|$4bGxXdx3X*6dDKj<0z}Dao@d)vTlCm$lDyNffd`f0l>|apy$eWoFCSlbl1&(OhMCcgw z<&J`n3}B~Mv|a1q84HLdpL^_S&Z{DDY5~Ud+WX`mU*~3MoobYL%V`g|>D?!C5by5q z6Fw!=kA-{CSoB*}x9&PZL4+CsFB12(?xu2h zrw$noS&8aR_Owq56H-s6B9iXoER5LsN?aAuN%d8saDLy~ zGOr91*kJVBONpuie{Y7raXx=Slf>VYO-T>+d|ykdC&k61Rt~U;gmi7Y@=y5$fC{s? z!=AQu_`$Q(_#%LcbbfcS%4)8c8}^rj^SYGsVMHZSU&A8P`z<;bmBhmj#TsaNY5ox4 zb$0$hQHgK^-|8^+GJD1wskAof!F16WBEsS z*v+n!qf9lYHNq@VVtDJ+I9HE*1Wgtc={?O*LU=f0NbyQomeEnanL=r= z51gv!!u2+ADle%gg~mM6T{c3RKj9N7MHXIxGfZ<+u{Ov5ne2(H5~j<)zWpaDD$`Xh zyZJc9l^vQU(VBmnX#>$f!yIuuliGRy*K!;5$Xaf_8!ONw0j1K46VlckS|Uk>If_er zpexnVG&G62`tZlfd%<;p1s@**?rG4tD@|CJAj+7mkcC%^Lsa}NCF*J|k$H|=0&Ng9 z8Ljxy?Xb*M*5sOTD=V+{zKwHlZo>;jqrtqAdpy)QsQnUdyqrKnftkq~tR>G82#O+G9axkxxVcBd?w2PCY!(c@?Q|RY(bDUJi1dU4Jv~XPMy!;~ zs_7Q7#p)m|yT!@PTU#wNsK8fxS7YMa1itA^iUS%9CA>*=8DAq?P^R;Fk{R%&X3I5t zn0E$x&Gq%~Q*GCCg*{R#INems8BgvLG~ULxIMKE%U>mzm$!*hoNhmP8w+vEn^8#J} zjbfhy`tNUayU@tg&8AjXuDF=3oiab`rq6(x;&f}}xl#+07JlFuUYZ9zZFaKG3cOEP zjUw4lH>G&a#l~&?W`6Pn%Km}_nUtGi7{5BJkCE-Lp0#DydiM#ov5uRo$n)js3{52# z)evmWVNlNomp7~+uxLso)XaOP*en3zE6%QQx#LIb+^oj3EOB`{lofC{Gu6n)pP@t? z4ixJ=0b>a-(pm3es9G3W_$~Cfc@dfD!3WLlMJm7oYb;p<}a&cLKZjB z^t`-;<_0rhceQNqMyZMcgwmlaQ8(;I@*Q=eH3zJ}#Oc$PQ7fm}g%$uDO+g+&c8w=GQ|5GvrSXqr~a4XxF%M%FZQ z0Tpffvdsh;xd)qZjx20OAOl}f;W5t@FIc$(*$Hl&moezD=@3O^77MO_%+Ihpq~_ih z@ll|41#2OrH@{ zYSi|%`pe)vY)Ta3#BWwz1}203SDG zG59SzIdJ*7$E#m}D5?742@EEWQ+@AjHAW1nE7355{bA~l?D(p<(W4H3WtsfhCI|rT z5=vsd@#RS-Rfi*M1pyQBg+os$_H9ytCIlZJGMO;#4SvL38ilkD&fISQ0|eryPBk zg0f;)P02Wiotf)IovwzXy#g(I@3o!187 z>i35@?g@BzW#))ktd5Lgofh(_EG3bOtCfxQ18y7vl2+w$I01$?OvpS%4CV0uQB#8hA zRO6HRQ&CFR?Dp=>O*%#XC?~@G)ro30rQh1fmRCH?4gq9zfJsXYARR@I0~5B?OJ`>0 zRjH&8YwpVLb15VxNwba@iDp6wHIW&|V&9Awtnw>B;tQ-%a%ZwXK8m-(og<~XrMmPx z?Zsd7HPcAn7<7#F)r~eLp%s-G4o12i?i5K<4B!}e9sIIRNuMIZKaGMJjbF_#t}5@i zGE^F1ip8l!o#4s~XhHaX1ci|ONA|l(=`(y1X!$#?RW-l4FX;CA)eT&!%bW+AEfOJz zli;4FEW*PCet=R@+y0Ev+Zmt5$tu>7GH3_aP6pinJYOM_?p@+%PLz4?+Fq-?|M3Hb99&s`&xMxoe4 zS=y>m5s6h*zdq(OkLN&eQkIeHZ(`Iq&D~v~s*bc=mMmhu-iIuIlJeW-jVTn&d`R2O zjccW<&36KLc?Kh*gNgV)n0}w2PjZIFJDhKy%r2mup7K3kr_0Pq`WTr^o(ebr^w7$! zy*SM90GEf~I=<2+Ldnwvh_a?5D5P1^NV?Z~a_7}`f1gBD{M(Zjng(YG)fi5luhBc? z1k&SLuB{!0xlpf9BryfCJm-+!#9LEGU{=awXu$WIHbpSmu$=56G5Dk4qYN5-kVcl! zy8!9&z^)uiM}HQfZWFaK`g!0?@R&JRMb- z?;;avZ{~S3#*aJ-vrxZ#nbp0yk~~AJ<+;k5Lezamjkvz1PDs}FcU&^RZj_Eso%^nv za1b{38d4PEgN=pleU&nQ8?}#N**s;38j0`OmG)&x6}O(R_2Vkp<;u%aa)kf%?8iRA z-vi^Y+Xl$*1@5{g2Ab&T@*Xkd>kXEv>CbYNH(PH*(9x$(pVp<{GIXs#?7gwyx}>M5 z{}=Z$ErIoSr*zK7*!gX&6xvN?*KOD=ukcnC>#!z(Z_j;bRJ~9&Piv%E^v&ozOro)9 zYVJythA`MtIMOiXuDKJ&OxmbwfF zi=g?X)zuYoHbH9fCtPuye>t@H7nMjW7Gof12kN&r4KH)5zw_lU>^E zsztyt9*@U;Wxj0CII+8Xqjz1LrDQ0dU-QY(?*XQREWsbO`TXrmVH=_*AxAU$v}{70 z%x$h%QwEZ5`5Cce4=sm=Ji`7wpMU-C{>&mzWc_;H6!z1nnERa%RE+{|ozBh|m8i+Q zZD5mEc+-FvSBV*^p;?gFTg(ibx`MqGf#aCuY~ADcrEPzcG>Owxb{}QQNf@P+Z$6XJ z0*{d5WZ1tm;rt|iUyv!#zJHX-uDNx87gMOBnp;|oSQUyvc05c=bYxFEB05LE_S@fd z-d`N|0gUsDU0piEIW2qTBY=YuhpXqG6+A(<_YgepTT{r$;X{-N)|&okG6h5@?i$>| zpODs$zdc`3wJ$5UHzj(XV{LSEr#X7EHYATXT!1vEbyz>TE+?pE-oCg-`3)ls?9*~o6os?5maHLv34~zbpPkXTZNid(r z0`rYGO_@cUuhB8E%q=Vm*ZZ0L)Pbw{@-TQoA4nxVJS|GObNqCpepAzR4R>J;Q&xc) zE^OCX3&Yh4-Q#_4&pliI(Tp~AgSDV(`wky<9c*5K3?hDm!p@i4ZaB0 zR`j~uylz8gd0HY-OiX{@A^$KfbV~x>8E92p_fEJZ<`JUZ%{tq%ryCf#SipZ&&o`SI zQlRA@M6)pY>7tk=GT$mU&y{JxJSVZ2w~H-?DPlWq!29B11(-_7Glk)V(A04?Ll%tN z4d44df$Ki6#?#@S7OP2J8*lDlp1f6dq*W7TA_x?vh#H*y918jASog|?%gDU=SqyfE ze;?|t3sKd+lkpNiw8@PEg5&a|6xkRiZd*-1koL6t=4#&PdkHCfnYn@9li}%krysY| zsUm`{`^)+a-!#}$yL=G)kXR+AGEa11GD5?N<#NH zq$^yAKXO9-K5txk^g%t1axFaBt7R1=O>SLMc8wGvx1NO=WUo?xx(m(;F5O(fkE6PAi_e5fEEp8gV=d{isSN5J~f zl2U$#OxU@du`U9BlVgn(srl|&RF693RucNphQTaiKKH6a3XHf(FocBjlG6N&U;2`a z2p-U=Xm)wjMNxO{+YOl)H%d!XCNA7LVtKDs5g3UdLxYJvaA?1w*#@P=tk`9k$R%$M zJ}^zY!7_KrYnbYRx8cH)Jh;4&P&QV|@NXX?wACMP>=qfP(@t!+5pxG}v#FRqDKbJ8 zPt)E2w}%=qOjEC{*!0ZM5K!u_I5!yZQ{$x#Q~w_~!ScwH({Udy?yzdwJ-m3nRmXX; zux^!`=@83siL?w*Tlp(~A1abJzQAmswD!C1nu-nJ2o&x+ar{^AJq=$g+soxXrcDG# z$zE}X=p7;+0W&(ajz&ggq+$b~seXs2@G}FfA>zny6q4iU4;qb ze=PCC=j0tSLKZC@rms?pEq?1S$jr~h*PQ#_18ZTqOH|r<3wBNTX(2k{M@v(-Qy#cLJ+3G`aHj?kr&5A5gBx}<&s)QB6nmK&wv&GbRtJ6H86LC zV%pK0E$A~$k=$vn3hD5D-)W=9{3Td3ax?aP$;CviA(O(*qdk%`g`xdwcbTtnUKCDb zZRwP0$3FzT>HRjcu>O#16w8~i*Y|&ut+Z5~2sL}B27&m+su?z@&Qlw!mO7RYnLe*9 z`WTy5xM&(Q2`u~2GXgN|ohZrb`I+|jcAXI0i1p#q&YhH60)n?JVCN6ktmaP{8smR! zv(6h34R>#cUK8YV5!Ip1gcBYo;~y6StSw8SMDTsE6i0L5HfZHJoUoQzmED(hdsmD_ zz>xa$-~)3Kb9OS0!dCAs4^do8um3(kYvD_DJr&y`aJ49}Kh!byl9kay$|ng?c%IdO zhw#@M7yHCjqraYQywUWfo${tQdi=2`q5I#Bgb9%_ht`JrAQx^RDy!0#xl_JnlT3zeWE6T=kx*hpuGKL9NwV83U;c5f z6`34qTiOWQyCUc?-a5G|Db$6y89O6}s0B^7Z?F|O=v|!Z#)0!ydS{mgQxFX-?*;rG zJ5Aw+AFSW<-C;EyqVBroI+KBD-q=%!uK|82Qln@jk=n+W#* zH{M!-|AQR5|8FlH9b;EqHxj)`qsE*bObmRy`Tkyyc~rbVYm)#4|5XPvuDAcb`cW|X zPviXmmd1K~S`udKu8cf7g^ZzzT--YWh-7hxDt<(U84G|zx9w1lbnPn54 zA>52a1)0&-&34UAXtKO|EG}q!=omea2C`xo2q){|1l=rP<&sa-u5C@cWbPiwzpd{K zi?5Gu<$WaHfjWK_$-F)L^0f2edS(ypg}^4?q11BFyU+_*t5oPTE?x;}E zC*j}$b3BoHFokV@BT24zPA#T* z?(>AoOuzqse9A_L437?-k#I>U!gUE?4Ohh~Ev&#(IzXPlC1jr;s&y!!3`xCM{6Qf$fd~F{ZM^$7I04L@BdjqfscagSg)|er1x_m@5}=3 z0CsPRqQS)I>{ifZ7{9r~V}$A)EeE4RY0JCdu)>c7NRiF;@710I*=`L>UzC%ZqiP!z z>4AAEAavq(?zYR&RFs08p?ST%=2WcZk&#?|<#5=~#xFt6N^lx(I8VoS`V4xB(^mhh z@01k+Q4iA96b49DsL>u%BITIL-jwaNItY$W9@j6Bm|H|DRK!hkdDVfyC(#waHiT-x zbO3fB)qSbQHQj|MHJxP3Eidp#NIV$+) zr~)$_=0v{|Gy-IvQh@W+6k|;%(WW$TOcrOSJ*d(U%Ucz)8q00?}Zo~ zpr(14J_+S#+fBWwKDquG-mfqNfxfGyZG16VN0%IrQmb~%AJ;U1Sor6N{vz;(B7NuW1;>n&C-viy~wG=p!DmwlsviTD^$-P7NUvIlIUSqiw z<-n44_v$;{UAWnrF}B7hAhj&tu)(05Ba}bj*E^FH*5)U`nVk>ZBdVK}?61wYamiNT zcy0f&?^We-RpB1Bw%o^SJFQ_&m4ej?0@oE^ZBBf~&nm>bWUj zQLq|z&U}+9VMQN9$~~Ri+illRl?qqG<*_B8D@GTo4+Fq!FjMHI^ZdDz0jo2}6!f6> zW!A67Ozgh9|B><5TP%4#95(&IkeL))!W~;w!Kan6hRB)lm{zTznEMRMAeHB9mEG0O z@X4_LOPGNy^3ljID-P}I(`o8GQ3Ar5lY6@>hO2Y!1zZRGkq>OtZ<}ZMcg9+c*38!{ z8wsU?dBtBO;Mo$pRzJfl{JKXY1lQpK2hHtlqgOd;bsMY7K@!@jp$wVD+ZchAeP7Z& zjK0cLcaQv(4@P4-KJCsKA;8WbOo_S4s7m`LI^ofN73AWMBS%K-Y@8#Rx)V*SYisq4QheGyzPPhyp^LDtSVfya zY>qBkE=r|DI0C5{r9SrBb)**70O?e~kUtP#+o`Q}2_qFq)xOS7EEoj`pZw(%_qsVj zpYfK8y~IQ}8iAUJsOk~W>t}^Sue`2q6zP{Yw+y-P0W=01a@%u83AE{;oac7F{K&Zo(z^k4F0_ z=rh%mh-gPMMG-wFoCvC*Nzyz~#`Yg&3~cC)pGiN8Sp@EKdaJ$h?W~JBV21Cd-jMmz z&4Vo&Hx#{gWoLl0<1;-d&i7 zk0N2njNNi;1x!5hZ)B&O54vHL0hoNrJ9>rnok)D)WObp2d(#k`B|9Iw&}6i> z))Nb+`8Qf56x7cPD)q;AN2xFNy`76Ul#jdLOP`0+J`^0G4Tz{=P5lK{@?;d3B+J6NyT|F=?meY#NZfGM7_?gDv>v% zT$xZ=Q#MgepQo=YAiWyAzCIM#ez{;={-YYpvHD`7b1YXC><8`*l~h-T_R`T1DjFBY z%xBQlXD_l)2=@${G=yM{0*6lQo2TUzC!!Zad7Q-kY2*WR3-ge|DXk`fKKo8;vjc6OU0eo?KLdrbMh*l@uCq|Wz7 zq|62PVO@w5Vg3N5AizmNkf9|f)^~;=urf5H;a;@pmN8mqk58YjdXh0y)Zo&!N+n9j z&-B+xk1K8C<)!9d1woTVEFKb7%P$JoVPlYb(^WBZ*8mph{JeBeYgXJ(}RNcX3GEBx`8wgfI_OzIo#G9^IDlwZFgbb-}ydcdd0l_j;cDe%`)^=0I(RVxQoUd+||4_$0I@zI71O zzxV^v;s?y44`}JSom~lb}x{2X&H6MMQ=aqGBfs~)ED7v z*;#>~(&4|$n26MiNy?5S&pVNkK^XFAIE@c?Ql}_$?cdZwAOcQQ z3KgbD5Wc=Jxg52SGO#pf%gkGAI?wrR6sX(F>#`?dx!NCI{xj~2Z+x7 zAlx^{vu{p3TM9{AP;TIReV9Mg(`E7{`uwJBTwEtBKk{#kkf`X#b{E~|$y`yJ$H z1WRH(Tf;dEa<=71UX5%?zw5&e6E#j-*BIwb=g|as9P2?)3 z-1jzK!BXcP7cN^+?Bq~juspr>pbvOH9lfaNhzcyZ<;7mJ?lneRFO4yo3t%ScZtqW8 z0o0-JBh5-x?G=+GkGdN9{D*;#U3pq|VIs=GIuD2v;a^;({xrTT{xI`g>y8AjpM)Gb zw6Ydj8ML!R*CGe(d^_r7zwN+BUSW>Ft@(6rR|fv411R~pA?xgm&YC)v{3*|YQ-sA< z>Bb%r_vdIAuT?rSUR5^?RE<<`(AGYcAZQWMjoSPTGQ2=d$Ii2qw&~HbY}IL(M{^o+ z(*Xo8tSAEYwgoO3tk=HBns&`}uiM;6oAA|Q-vM6!a~FPS_KS2}Iu_qj;k#2WZzK&O z&p+K_xA1ghOdvv4i5V>9SRIDgvx#NIB)8&{IB~_Q~yQ0O<5}+9ouU$3HHS}16OWHY9Up}C{{W;nwo{{eVaYE|w zLSTdeeIqcBmuqV;NB3VMw{Q!un+tc)V~!PX4vCI1gipI{9e|5<|9UP|ddK(B2foE9 zr!NO7w2=oCYpNNl9m#f(Cx<{@F7;ox+%29V@@1Vzx2?pG0Bh>so|jYdvj@40&D+D=z~)U z$OYL9D}wPQ>;PF^Uq}geVQDQ&!N+w_FH+G(5uSBd&JWh99rU%*&(Wgwjfs8TC!0$a zEMgb?qt`oFQrKbL>gx{(gtTO6uwUyTeKtAHJa{2>^2YToML?i{M&hWKR&)b0#S2ek=oqdS6m48dUM>Vdy9$On6B34y}#Nc8`moDgB zVH(QX-MJ}A`Sb?f6e~ML75B5D5KnVj;$GtU>=yM{)^zTr+3|6`PL@SH`BDOz;(xYSFOWT<<43`)RznVmT9-Y#UP?Ssr5h3-PbRL*Y}+<>5= z0dmN9SK{e`;8guzuB4a*CC5%~qplieNj-l|>A?v$xZXLVebqMaHB3>4_C;q5HgHMh zfsJK#s#Z&mN<)MrTT>^;4J>~45p0kMQM3x030ptX*Tsq0N#M`;W1zNem!g2<}w`V-iw#e|QjGeW$>ExJZ&ajk?B zq-D3lwbSMx_m=YlswA-?4CU@tGE|}H+`B^D*%IR0aDsaS^?k48CccI8qE_vv9{jNL z$?aj~YDXp|`CVm{GJ1e0U$MFPlGmY&0s zk1)(&w8g#Z24XP%aU_ES`{A3;4&h45!+&MX*HdLg!(D3P8y0OL$Ja)1R8R}#37hfq zhZJjZ?J@4j-Cq=^C#tSjw3;JkH@ijC%7m2#5eIjW_#i>GvIBCNDf@}%_#ju1kZ086 zkZcF#WZFO@&+V&@j^UNDR-=B}t@nKf zuB0zCKLwk|>qp|UOEXY$GC0_Ep`S4O?Zb^8xv-d>ovGt}Hm5Ney(PJg5!UOp{QITW+Odir(`lX83EKjj>)zuH4R(`MlM`@msvPp+4=9{kXNgK--57*t(`uj zUY_LBZs+hcNWVaKgGpsZY0C_A}y`(=BDHI>JFduQ#@ zdn{AqoG*)yO>L?aJU9?Bc>#O~0DI+9J|v3n$-o!2nDC(zudJ+cTOaR{l@0S>$?Fr= z(o>vu^^zP)GD-2xbOwY}F0sr=y#K+_u( zUDc-goS!21&DARVmh10BNj(Y1>Q65|6bF2~D<0E+&^>?1Fj(j-=qO__({%Tamejr< zVe@9UV1zF8^RwYL63$e3ztdzx;-%>3o}2p)22R;iZ5%SzncZX0ZayG#E}3qwOn2H2WJ$x*m1{I&-1TrSvs=L8I^gSYmToRGV$O_$4GJ99J~YT-8c}CgiCT!w+Is&vq&Yo=Fe!&JJnslPIAtqM6BByY7xc28}k9qmsB`UHb8L9D4=h<_42xL z38@CfPn0?uz{RE28(V{=k%#X)mm~kS7dzKSjUJvbX3FA*=vk1ED|zZ$tzZnYyBOCF zSPGr3I8O zVg~JBMe9wQv}VYG-Kw!`c7u`*OCrm@Z)i6oJ}5ye zz)*(*NZT^mn3=2MmrTO?#u|m9&{h8|;DW67bj!OG#tRN=+h^1E4=!tCfuFB&VZy1a zSc_O)LpM(0=_(`4&i^u>%?|pM(@9REepxIqQ@s!rH0r1#Zdg%8GBhpPCu3s34EW5% zvkK(r&nu(PR}38hjQ}vFjh|jq9UW%rcFxl;Rm>q0_RNPcgL;wl;jAY10~#*%$lw-p#!r-jtP8jq98s8DF8$^xb?7T$cyFp zkrlR+g=$j|%lqDcq_kqyJFO8FG0_cC0R!)XcSoO;BURdB?_&X`b=f3ukC5YHkDqlN z>Ai#&z1I3W06O6iQX1CL|!!mB*Ilsg1iwU#$&>*3M6^H7uHYmE=BJEp=SoDv&;r zdhG(MB5;{6EbuEty-3{X4YYQVV`i(K>EUcFXe&y2_!te7_`XSd^PE8#rLWx`VyaQX zI$Zwu11j_-g`Q!BRg8kX7AmQ_c4adpfd0rS@rFQBH&;-K7FG2aPZr`K)l6;pj)vIw zt8Re?X}K`;$guIFW~V4C@(duk+eczx)6qonGd7%^EF123-X9*q=LaMP<$6COFJX1P z=Ctadf|89M$?%E$frZN~3v2T+6XV^5H4YwZ)jdlutKTnHSjG8q zj%R;WtU$hv1dzsH#+=xZDk-+nt=aWjTtOSTbweKgvT^n#UFr{wP&tJ)AtYsPbJms7 z0IrPsgt)NEC(*gYxJPGTmEf38k9Tf5@0s?CdRP|iE>LTGn_qHM zd=NfWL^;R!^tTN&_*Ks#f$Q$xqs4p1?Oy0tS`4!kO?h1f5|mYSiSlV$fD!49BkKEG zqv1A_HyaN+Wvjk}P>V{X-k zT++6AZlWybW{MMjAMjyGObVU3R+iVH8%)5bG&8v@bUOFp8x{_Wm9=gFfuwvU)3x^^ zm$*Uf{As64t|?%dIgr?h_N-e*PawHOoAkPJ51I@@R6f1n6slYBM(4#2uIr>>PfJf} z28^T~Q)FW335Z-e_5aml2 zgVoLr%MEZFiV{rq&leUL?BzOjTKGXIH2SN1VZ2O3->4P!qxNB_x;A z@083Sf5?EmgEMJ(uqpzPm@J`uym}6R+=sl?^&!xB>%;Z`P(u5kDD(fASMSrC{}~p| U{_(c%o#*|~J|7R7`>Blo0Y@Q+c>n+a literal 0 HcmV?d00001 diff --git a/images/img_1.png b/images/img_1.png new file mode 100644 index 0000000000000000000000000000000000000000..89df5382997a66cce406dd1d1e8e7d5708bf1c2b GIT binary patch literal 67710 zcmdSAXIN9|+BQ7u3|2q}l@2PSh)QoEG!+Gr5QNaAN^gb`AW{RPNKpca^sbbIA|Mbz zYNRD}giu3?5JE_3(mT9y?`O|A`+dIe_xG(I9P7xzz1DqS{W{NUy?zYVWIe-s=9gc7 zVbywgU;me1PJ(~=<+%PS7UnPad1sA(`Q^`FwC>+E@UdK|KmAFdH61fQEF&e=C$M(C zsV~Z1_rC7>D?asYYHmhD-9EeT+CaW%&qU%f*NPTKy0A>Tyo_N)Es>rVb{(oW zc^&@q1#(o?XZiVu@NkdLIXh7rePc8;H}$|SGo>P= zAIbU7(hK`>RGw&rp2sdR;dlOe2{RsAo05b8CW7F zI6L8M?3yl;X&Teiup0@>r7A6%zfE9Q+@Bi)9-CjN?mZmj)D?$ma~i2sp-Ibssu$?) z50Y~>c7h1$&kF^ub`8dAIA3dv8Kj?HRQo?fZXUp#+~DrclzELNQfK z|F=-2d%ydk*S9y2rIhi~|5M4T%>K0SU8XNCtTDecZ%RE8IZdWxUWxn86amvISTVy2U zCk6D`Dj%Rtk6w+uL1b+cut5+q#P46a3ghdujb zUE$Zg7TkY0PQ$&MPVz{g(u_*@%A8HnD&{Hu^LA;Wjr=U%n;vMhw1&ZX?aiwj0-Kc6 zkrU%Tc9J_D^nHZVX}U82xcK)bcvSF2Sc+4@8V>DwFfd5)$%X^(KcZmy5jCTi%-G*7 z696HYOy6R;)pdL-Oy~j^3uUmJhNYg}wxsD+?f6P_X$3nYDXAI$%l>zyEn(FMJ#kz^ zquxis#JNG``f7!Vgr+FK?lx9=E$ytSFZr7pIo}OODZX&{MLpUmXp7!!Ai3 z(cdTGphvH)r(RECFwMYR4Y46L>6FG6BRMC(JBcoWx#RO7=;25JI+5y)!;7}$5qTUl zWNrk|EVf*dgBSMR+$zz^2EVqIy&ft8N6n!6(!%(k8@wS064K4aj^i0=d~T0$L94_? z(xy&w4{&dPsHS$I(p%c>1?-b}^>X7~dgCa~a>VFTo(x!5<>2Fm=OZx$H1N&AjIgmb z#j9_6&rBGcIDYi?J#q$5f9Zdz>hto8Fi3!NTtcUgy;!I4)xWQ96owfZ3}`_*wB7u| z=oJl$SNIHGG+SXOvQd+t<&RE~=B2BnjPbML z;7;76ZRXIf)d9Zh9Y@=;BzW|2C0Ez*mT?jIx;@G**IeqNILksxg#>n5FmQb(jzt*q z1aH?B2{~t8$;w%k(*vNUqF-6NmGNsxIJkY}w71W3N^1IZ)O0DE|1|$&wU$H;=jw5T zArGs+w|%w0%V(GAhls;ruj0%aW6ep!W3PY;S0#^N~)-US!Q z-R{59omd-RF`oE$ECs2~k~bb!jLu?=GWYiH(t{E@5q2}&x;WAG!#%@|fz{yx!`=ox zjmUhaL9OIvk`I<941^@=wx9FJp$iJ5r#{(GQ||LjvS+)b9Ug8i8)^z1Jgu;6KWlH0 ztx=Pu5!?@;jwM^yG%n1~qQ8IO#h`v=CAux?R8=mjiFBEwhRFQx4|ls2z`9Dd4iPdA zY3UjXp>Wf{s#rSAwl))rgY4GN9EKIzcV@c9i|Vr9Q0K;gc+6)DUx@}h*-BJePDt3< zbg^{2#$Eq0QFqXP_@%$u%D(tk-y$DI2k%@}mf-w%zG|D9CMiY~mIQ2kXDqC_6$<(X z*dr!?t1`CQ@4rI#u3j>6?}V}&kteoawRF!1C9XhT1n#4Q*{aowg65&UtY?B82Khwy z!_*p(k9|t~wkEcANr#J7TmWd zF1-rt%rlL&N1lt%?KCp1nml~`l58JPf=Yq!&ZaIK_%Br4F!aM+RD5?)&NL1$`aM+= zjgS2Ffg97STzft89SXa;jBIMhbaUGUNZX6e3;MN46~Vk_h2@jownhhCiOXQTXn<`n zs~LVuL1EwWmh!pregCY&3_kaTJt?s5uZtX-LYe5bNUvzMl>wJoMK0`9toRho!d;70 zypMNAJ<4_KaDEYHn^rddb2v$^GxzOoVib}ASvCGsUofPX0)f6@#9>IVqcgwOB{56W zbobRX(}tB2O(Rb?leBN%f`sSxrm-y^3J5#;N6qtOh$xs$ZNleG{+7dm%$P^FkwULg3roS zl#)>KlEtdsOR_qW$Ho9fOtkc?C0S#B8yuzG)@jb%8+5-}KtFCEofZL3hx-xI&%SF< z)D0dhgm+*+fvh_fRGaG}M4zo4;MXhfkanuTT;itsDis0tuKxW>D>Fo*sx9N&b&3~0 znTGAR@p5`4G%RrTDv zC!*r$Be6&#Gf9Xem*YM`z)GH9E1TuOsU4>1Ykxf4n_7tUMvDyE0dk zZ$P1gb<3G#HC&@9^NpD1Ho%*=mXH9P2-!VKYk>r+R}}&#iIYex%{t zVtd>YINx!h>PPndI{*S|vyYbgn;Limbv` zHZIf!3=N7htx%>HSOw)n&#|s;#Sk)_2CdyJ^(P;0O=+qHDCMQXfwa(6{c+1Z!N;}C zKq@WvcP2~TmK0dVxw#u4$icdX#z&hOc8{5rz#XA&=$c@0!}nhBpi&A`Xd5nR((w{F zSY{P4IlKj0Jt#0pyk!N0HUp)2V|ny<)KJ8#Nxv%K&HzE5_tjCrUacwmo3o>`5z;?9 z6#^iBdncZW{X-m{4q2oTN_T_?F!p+ZlRdgNKRS7JiRZ$;Wyqdmui4QJ<8Nqtnbz+^;eL1&p?}rLj66!Z zL}Bk%-g}*(7k;;zHo0XKwB774nm$6d)>M8QX!}|I+;b=-{b*44K$ZvNS!@+Qy*UBX zGIi^KIj8kBxV=|RKE9ooEd-*5C0gwu3A;`twDI7eW{JC?gvol#`(BG#yy$rX5Z<%Z z6wZU`OsF?Ha6$%~x%bvc7riwX}(GF-}&8BZl9*W>7shK79hhbQLJUtcG08!a*3(FSfiPut|a!RyfN7+Q`<@FXFsa3LP zug4Ktx{Ozc3Yobtkb!9jSorkb;dgMa+E2iX&Wd#QsvQ}bHuyJ^uqeeh9lLY(sg?%D zLiMXNkX|F#p$5qtA7#Ou^TS&6LpgecI2mTZ@ylAA?tk4^H}}&y+qT__-CIoiF0w5U z$uJ*uND==`TVdR?QmLzP<92we=9IR%q|kb!oe##VTrTQxV=5Q!w{lIlVn}i3)3Ndk zo>J&&@#Fj{}g46~`coRtg|JH2r}+a=lDP;zwqG?3%XO&Qw%ezMqKvIjsi&sc9Ex$RkaA zBppwJMI=o1vk}ijFr1|g+lRM(JHzs$Ww+GYP9_dxLlQw)KgNdn`Tsa`OnZBRS!N7M zPa|O#E$T31jDz1tET*+OUm($C+@6g+$GR6xE&&gMMZFv|)>__wuU!_DJl-t%Q3h-a zG}TZI<=ABuo*?2A@bu|c2`uXVIo$R{J0S8vW^wVNaWVIOHL~Kr9hMotOOVSta9Ua| z)-}+RvcAEtLAh7GM2W_|>ldHTPK5gDSs>4aopwyi8Y~PlhSo3c&wOP!Y|g)dVJvnL zdzFom3%!R~yUgCA|BV0oibx@|zxzJr=W3OAI19-H&rbvrETGOH*-K&#I8%=!b?B6B zD`J?O#Bk|FZo)z$y)$0If@mj2VZ!!Clk&^OjMpNGRSCV!<}L0pTK>p+tmYbGLpEa| z{p?>^K^n2W&&6JxP-0@SxR`V zBtL)#InY8l`lhdI|87$9{17YXSZCYghHkCxWJi^ZrY1oB+%$V6vAZ%Uu_+^Pcf%zt z{ZbB@U3Fdm4W%~qHnS~q5EXvX=jMN#_dEIw#cQxYq2B{^u`8}&*-=OiNlV`{#rf;~ z%h$c6!4&`OFE_^Ab{1s~VX7BlmX&3ykE{M8NawUHW+GOS>nQJiLK@bDtN&Y+p!6r$ zPB(v%Y+0-2vsSx)rm(53Yd_?sx;7g0v62j@Remqc>N(H9to)m>bJ{x=XX^xwk&DLN zU~4tqwg*Lm#4H1OquZsnoS&igA6{AffWaqQWV>j?Put6nBq) zk^)|O)b_nkJZ6O;Zi6qfXA9v@$HGzwBcZE)g6_o)7#P|}fo74FbYWFMLt8R#KgD)9+g^W$roAEQ(^KVZB3@`_b! zpu`9U!xjKCpzrgxaC0Ul)$On z&{-wKH7(Z<@11G_9u;Qpo~Fo#?Jov>Lk>bZt@yBRkig`Eq)(jSfIo^Nq7~K_L|6tD z$*Ga~QS*%KG5LC?Y(kq~$%FfrgN`f_1AXj9+6i@!HRN1!Zn`C}24gf`;wyRNX|r9^;%B0p z^T9G~mBMHY6Dq0P8D(?cSynw5Wt2TJ&PC8Byy7H|b$*3|#${U2WH=f;yz;8oxN~ zzYyE-n_oNCIH&HZ(cx2~n7&`tc%UQ6;YU$Vx`6gpOla%f z8ORZ3Y$(!Hn;dZN_uCswwab`A#_HgYPTHM;;o3;G8d{XSTvn|5m?*FFBST3}MG`;! zuoKxYm(K->}h&r1Z zu*jQ1cg(fd_%$^DVLHE88wXus=L&fr&1SOog?+mCGo#8m+0T|oIEFfYenCVxPHgpy zyk2Etadk0pZ~W}Z!QXB(VU-OiW8a80;Ez4gpj5-eBk2k&Iq_AjQ7S}nf;58f`V2zh zT$-!iQO?RlWYB==R?p7aLTyKjD@i%+4IAeV)?RlCL?HO750%hVG$+T+zMzO#06y?OMsIab-_RcJw zna=elyw<*4zRaVf(G2T|B(~=;5juWA57KeXmmDNk_c@@8w4;HG99P{i;O z89xuo1IQD9#e3e$YO#wK|xLTEUc=mEj<=^bh?(c#cQQoi5VvN zxnk|TKZDt{J2B}}?jNI+RtB(Xx`Sp3_4$IG%n;+#`5rhm&i$y`_7xQ66IJOm`CDR+ zI|!_C+H<_=yn~&quefAZJe6C;f8jJH#~!upwkU~$beZ)ew^jX>`od9Bwn+3(V?%B*=?o$_ppI z0^#_k&a;>#X_TrErdYKoo|SfXxb_3lp7cnYFbuE@UYM#AV)M_~yxL^HkR z#>3T1!l3zvY94CK%$rYWpu?jvU~HK<&Nq3)J4a~?J!U$lr!d38DWSooy8Yc&*d}d= zDteA8Dec*GN0~9gX=ZKhg>SgRI2S9^5r;_>+T*rhv6i=plg@ z^(r8ESfB?YSAUsZecYkr#}R$H>(rCVF(!TrF+oX(+D5A>hFC`>(2nDw3&GSp3DT3Q z=iGQv;$uR?Um5Sd-JkzA^2yOa4S&)UepiF~n`0NC)^FjpeK08b_l5_&8kRXPeBVr6 zXo>rf`{5$-RVbV{TTQbQV1L0bLjuj~AS;}$)69KBBSyOWHjam$G<^Ck7_{~1AP%9Q zz?s5GiU~nnw}%D}BLN8Mv2uxXE!^pC3UbZgu89Xm$H7e#F_Qb@nFxfL#j6+GWbP2j z&8%~ZYfE*tBnrYsYb>M5BLg*x{Lvr=QIIFld)%)3%zr9ERVOil;x0 zBuc9Vn^;Xsj%+Vo^PTo~d(>1w8_GFq=UU_0tQD;Fr>)KyjCF-(eTAv}D5 z>SQ9{vFMR&8Tt25H~(Q{I%t9csoh{Lx=vZ|BV>YbFAikxi6G@a}AY{N# zqE|oZqH0Ej;8O9D&S^d!JnhQOAYoXwR7h#XUdA5!^PZs3=c2T)MNvDdE;(VxM!P?g z{Kl-XjNp80VdXB@j^=^(QnpYb>wWw=)dgnZL1guo2K#q&X1m$ql0IvelxQYMq#_J8 zPe?V?wm&2bM=O4iD|n~;wRl^HcV>-AtMuJGNlXr!O4Pc z{Tvt>lu!$PzSyBD+!fl3WK)QZUP4hdn>uOOv%!$Y^v*RL(kJ(t-Vf2 z+~~sXWn3`!7QYkVpCB5!_8tBF^Z#IGE@^N6isf;rL?*2<(0-Isyg|(Ww}g+KoG|OI zhZ{bL(&PFUgLz##NfKpqtNDfAv-XkQr;i4n?!0jc+@bi-UXcb<}Up2~) z8|lTqpUFKAju_|Y|9T3@U-l=f|M6ndT8v@gu+cvrbd{JKZSY7mH%|ZOKXTo<@PdE- zlpB|_*$*)M`M-WF((!jryZK+MbJ6v(;P`($kog}(OJ2->ug-Uth=lz2>H%ybKL5X0 zyO6Xg2LIPK7ylo(siTeD`y3+HfLM6Cx@}_gj~5RNB>Z>*;;W3SWx*11R;>G zNHK`4o(wuVkap^Ds_WQfxRw~ME!WiUHY+X1>BT-Wwvwr>neHg;{KlB@ChN>}jvYP= zW5gRF zi<FxG%uuf6wfHn+`G52M?PvmJ@VV3CKlrM=Z`QXm(;k04Zi)&<;&}Ays zu;S=+d4ave{s;RsapY!eOY<$OBxyXI*`!%QOR4fj)G}6^mtPYCD>|2oKE1vHO67yq zRG$-+>8_bBFwp(*p>i)~NI`!4IbzOQGoevke^frS(Ad)V+Tdu~Jk6+Axx4_CVc@q* zj~|RTwutR$CYM=u;5V2^hXhFV0SQU93ec84_iL7_#+&k;iBfpc1c6c?U;S|sBg&@-s~=x*@z zw%av<&b|HFKkwq{i)%|C8!Gzn`LUbC%$+bs)v#q^Q_xl|IoH|z2|6}&J7{mn`yD+r zsV6qys`+E9fzNs=L4RCnxz0?$V~(ReO_+@se1JD71wmdn-skttl>r>}I23m}TEq<5 zzQLbh1Ip&|KseUw@1mC@56Xoaq+V-1^&v%B9_Hc1MNl^{%;L2S&)P0uwkko8_;Aa6%hjFy1Z%^2)R zLSNS03`AFVo)etRrnH}TA#fs%PhXL;J%HqUx9HGaQ&s`O>?_hN-fo(uAg}ZT>2bt< z7$b7E?>aEwKCL0}+n>(6jo5nYw57m)H(f5L+UpweMOB?7wI)V4znT`{8911pIv}^x{OycXRsvK?bw@*dFOqU+EQ*eO?O1Pa9xM4!I0O0^ z^V~|Lr@ek_w4_3H&u;xTao=N+^5D-rHOp6*qs;@pWV>Hcno|*;H@S-~?Y`!DNK*Pe<^~AZxGB3h@`!gEvIkef?Z^-Y~GlUJ%}t8`ENq z8h^eg;JmZV2?qOqK|S4h*XeML0swZOCj4tySYl?w_c_n?OL zK@gimy(7)tA$o6g9mbTIJ_l2VCwc7NXEEtsGYfb?8z&*tHaz)-^9wBjXtZpeHX|S0 zhnKpkSlQ<`%03n=*onzd6)uWC&4+l|p=a%DF;sEafLAP6@`YrL}IbYhN#9I_LAo0)SkRRb3#tUj^QlzmJ11j738hn~%^*GHo` zI=MgjFV|EhakL3a9XNy)xcCr@ed|Pz{Q%r(^4z=X=q!aF|QgH zISX}LGsZ8$Df6uK^Su$L;$n9(Jsh*raL}#ZO?a`&>fD!31?E^t+zZc0TOH)P=iHc; zt);H=9`H`ivyVa3S{Ss)d4ht0-oDO@DsrGw2;BVh_4nxAJ3Bk$SgQdqaEl_rx3dbP zt48^V{rGbch<^7YS&+J}6Lg#7A>2A`K&nB#my?1{NOEF4 z*elT1D83-IfGhYKo2?3p*DF`NP-REeD96g z8W`>>%5{i-f!SB9EN#b{+S@T6f*99V#2}#l-=Ja>13!K@S=Fxvr-#%k(p&Qqc3i8r0H z5lwYxWeS)NieJoFlT}OLj^)>_Z2a@qMMT9+!yXer>JsoAKV1ZTZ~jVZS3-k(mT1|sUPVY{!s*2)cTowV&ZzMVmhBO0Jy~kkr z`)NNmKT z`{5o61AjJ9on5aV4Ku8CX`~aufCwS21oa^dHbycy463=) zAMh`J0OyW!*%UaUqAd}7+4KEzb&A~RVKocGa<2M!DB>`aUfCd-EhC-YH}s7Hpar+k zudaz_1_JKa+cw-+`fx5O6suLqnh|suLXz*9t4)%=WSxT7J}C@Mvl-D0w6PP-uCm>A z9!mE-7&r1&WbfF0D*K1T?@tQ`@}Fhq<-6(mW@OjYX^h!m5$3S0bZe~bed*s-&?;;Y z=g)Xif|y#uLM%trvshgL{sN`2E?MdV)@RYl9O z#jy9c;W`rwW%uqah@fK@9_(dG7VfSbdS8V4<-WX^B?uWE_43Qj5hfEbhK!L(2pa}8qQ9T&Q869#HdH7lVY=kU^t z0W%`x>kfPSsiSexl0DVRz4pl+t{(sLETZDw6e-fB2NNzo^~d@7fBewH%}7X>CYp%K zm(_Di!?*Ei41YZxX?;Op3W3&l%Uf7WJ@Ibz#mzEL9y zHBawfU)hh!ea&y~qqbK?T0mZ4@A9 zT#pW4i}bsKTK*Q=Ass(FvmdZjNk)6V>?_WBP=h6J`xpEiasQoSnXUPJ93RFji}*tK zq}bO+ZJL`1MYh5AjaK7ac2YqMn-%DMV7UPPqyy_LtsRq*aqikQcmAt6S%(>&g~T3; zN6QU+x~$J`LjER1C`kK|*$boiST#+$OI_wMr(exdL~#4~{@eM#JU zKm2(>f^2h+iWl9uD^Sk5@mf!7jK-ImC(G<MjX%eIrXGgCbplx#&soK)sNA&d=gIxai}%bOr#~O3 zJpsjx*`-|twU0zmy5=S%!5qU=lK1jElU^!b7zUhMJ`eeYGeM}T3`CWyR?bY_9PQh;2ge`^Roe5uVtp(91a0uHNCG;l3h}$>5p@LD}31(IkJ5vVIJydtU*l= zPnCb@I%$8#R&=1~W0G?{NDpYvTCp%-ulka^Ps%Ek+H~r@dIpDWeYl>@j)KhmrXqjH zi!*t#a9)>!TT#9i{6x6C0BtHfrfNV-qQEtH;(js%9jSrUneM0*%o;ynCb}^HF6YGb zju#`a5(H6~uVs7DE@Aj}&4MgK%zn;bIB#slNqI^Uk&y_?{NT2`F^DHoX9-~+UI=>38{aZ_UE_NF z_Ov#&zy;OPW~I@F;0)y?yb%=*E9hO6lYI1sGQry5N$O@okaD*gPO~DiK_aoMF%9j2 z^n3PvZ>IO^-~U6BKZ+OZMPX=?O&r}{R|Tmd$Lvvq(OL$!C6<~GvjT^Th*i;MCI=JZ zhSRuZ)qIM9-mH2L28C$jSXfRsTju|9^#v{ug}u|5fPr zf7xb%)G$#3XCa^h)2V3vNF8LC`02|QCItTt{tfZXH!ok9nO)J-$D3MbW@?8GJq3d* zYUu65KSSx)FZ%HN2>1x5U?7^j7#C3M7?=6Ojkj~lISU5p z{~3%&ANLXT5pr?)0TJgXZPnK0{j@Y3Wb|EiVBjqiQG+=D#E68q8Qi0IG5)pYAE>A)Yr0JB#3iEc=K~hYFAt~m z8y6IEl`#BkSF#|gsU4HBiJAGtG0US7?ZI4cwNcZpxWeT;@njrUEHY-cCM>fg3b!!p zvKd@RT&12(G#0T8bRF}HO^=vWF-=$9E3W)*xxIK$2r(0Hp1%>Dy-skd#7$veyaUq$ zh#T*fY5p(PJZD)WAPqFtLyueg4!)(tk);F5^oH&}5u)@pg!#M0(k!Dz zf^;!WaDHu{=Tm|+ZywwtO<(5~B==EL_A<0-bdw?2LM-ly{kWZ7Spuy~am#>4-hFJg z?Ihj5r6RfY`i1Lgd_;y@L??ZHD+l7!vf&Sdk4|(JKuQ|Q7XzRDv8&`}P7*Zg?*s~K z;r46~o*-YqpXZ5{D(YBKZ-! zLZgvOI8w=OA?{%PJvI7Z)au;y+R^HPOJXy4ar^RpOf%b_z_4j1@>$g|$Gnj0{F;c`qgjE-ZD%MQ zCCfE__>i=Wn!kjm9_Uu*#bfeYD*Xj54|;o#w9R}ZJ_$hIpDW2$j!OUXtI~AcD0J$; zgIa&95K^2nd`XpG<0eeqT6T==PP)_MTcw<|>a%c7f$fY?`}}YG$f*rcu_3BohIhfU zx^D47T)>eCbj-_EmZXha_f(Z@gaeL-PL4HUjuXrS)PYOJ5Jh1JRh$7{4M8}o9_HV;6QS4rQ-MXP8Knm zyV~czOG*Z`aW5+~zhiLo#8uY;o?&q(Gnn+JQHf2L!r(OZ-WnHk(w2J<^zizp#lZO^ za02|AS3>#HR^?>1Sg~DBajuA!BCJK}NHeu;p-%Qry#Rc&0?PbqkP!uYlCWZ@yezDF z{G1?TYg#GODS}V5V~zS*8}?{#2KKnxO#-#GB1B(BaqUm+(Th)3hD2W%Mv_k?l@1)~ zarHPyoZVDe*~j)QoMf?_JF^K~O1l6K(yi`(GE7#QgNg3UTB3>d$9vV+jX;fmJZFqV5BrjE-pc(jDen0iLZA)MHVAhpV9%r9BF{u4M{Zs0`~@^Pxu>y?0SAO749n%Kq^eF9SAQq3pZ!feHB8g@q~HPMTo z+e>6lHf@j0kCYdd&)zQBRGg|CuvX|(g4__nKN3txP4BystiFAH?4Tw^ik886zp&)GWe`yIiSU=~E})Fs?Q*j$INYn zoB0S(;R`LT-l`dl>dY#{{QC*yhLW1wSs^yz_^J<*DT^=w^s)#F0{pV}J*Li5@@C}c z({l_Xb{fS!)IGAGBAx+Xrkq-Tf^z+(!AGBIAb{!I*#b#2XL zc9JKLv9$iM{*sxdi&0o<*6lqzDe(N?_VTh+65P3F|5=0LBXkra-s>YJ$fP^STX)p( zqVpQuv}fyA;JRN_G#hldG3#sYbz8~~4!cT^OcYZt+~9+c8_&qler;Y{K1I3EQ2#|4A?f%um+1UsBbzy}sR5pvYRW zaYr^*Dhc@9GvgQLZCEeT8Ee`Li7B)nai2@DOou;GoV%an8GAC{gO71}*}(3Md{bZ@ zMHM<9n(r}Hr#Uvw;9d&8FVf+6<6k;o01-1=eBq>DqipU-RsW-?6Rd(4JO%%_8d&C zxX@8)ZVV<}qVg8NP0_=*5We)VvIWiw0Q9Eo4=2C9EUcZf`J|ExMpeR1y&KkTWryNz zm7|Z`J7r?#2!J9bHqK)`FPH*`FD-pK`m$inPY6hr1nZ_D%x>L|k_&R}M1C*Rh2Xxr z?*2-&yIMh z*X&4a30xrDIDYO|;6j*9+Hn|=xMQUH{&0@VAMHMglBha{=8e!}_cF1*p)rnw*65_X zMCm{NUp;8fT<-Js^LiJ*bNUe_ZaMW6E6h^}zO=Aj8_=nyVq&Lp3eh;0 zjL>+fK#B9|;O(Ra-^X~Ye$}Wp$pi>K7O$a{-gRCJr7dapI3?3F4`@NI@wp3KVv)Ci z5NF{5_PuZ0(tb%%PdZY9qE~5qg6XT=?C(Ga&8j>TF|;sQMfsf5pj_^;^I*$tWNGw% z(x(3PFFw1364*e2L|~Y6C{OFI7Z7s2|C{v@7ful!FVd6#(6!J?C~a~k3MwkRcy;m< zHQ-GjhzieHEbH=nritvkLO48~9en6Yo=}bt6O94T0829w8>t=Dlw$N*9RkKFQGQkWomDOHV%clkAqTB+Jg9}(75lK?YY zX?%&;N@$Ih&Da50Flnf2iPT3oCDBzsKop%J=D{Y>6m4MKhcTr3go^Hys`O%=^wr<# z@)ov#%3B(5N`kebaX9$7)wO#1GPKI}_`#%_cL4^_klvv`WVM5eQ%B;pFD{&*%#p%| z(2hmp_if}+%F74il;^JO2We*&_0*L3-OcBHVrknsAPf$ovz2I_CN1C>7qUC06xpI+ zfn)T@_2jp~Fl*PkM9|VjwL%Q9=svIg6UEgFx7f26R*rjNTwNiGVP+YY{Y!BQ9o@^@ zsa#(j06h~+Vx34&a@&RNmQsQFK*vsjv7RaLFy4~%oQSxBTb`;hoLqAccI1orbMe!n+TY`>+ zn6WDJ-L(G)?xZn+-GG!c3Me9BtrX7}oajYL>7;7!M`^M@ z^KKL(5n&qkKvCW14mmEefU5C2au!P*L-YOH^iDFG>Dg3L60l+UgH`Q^mO z<4B0$kQQbkeA@bTs@=5Y%7|LJeap&abpSh;7k^9Y*7z$*UrKz1E1kwWLNyYfi*{5$``rY{*8}*w{Yp|8` z7uopNewSH+ihxVpPAwtMm)O_%B{uImp6*oMCLTLaJOeNO6gb%^Fc#=vo|zlwi+*9p zL#+6y7IgxbT$~c7Ur7aUfCbKL9_H;yemR{T=(|0`54|a}LDO^y3FuH4^_=pVU2zr`JD;(H>UGzg4HPK>wt)rw%>SG^P68O@{;D4WDf|DUi-H zpg_1>Jk}=~Q`LUs7WsZoMpK=*PRIvrV!$4{a%8ctjZO>5N{>+h-jYbh$sz*#lbcsS zi2Y8a{u6Pl?*_L1;m>sg6-)9wNypRe7id`5S&R>mBiRLI51h--lnB}j%jZN@J~G8l zlnI|sA?c-!c`fKKd;L)c5|P<^4|!V$7s$!TXP?%lU?IpBgsf%P2jO_|1Jc;zPSqRa zy((Jjb`7qy&&XS40UIYox`N=4V3i&GZN+!*i}E+q;{$5+$Ap#@g+DA}#nWPY^5#nShctr8{rkL@GIrQs$bU>faz;904kZ` zR}OnR{ZVz?i?bvnJHom}r@?L>|h ze@J&Kz!ckBd^cDhykU;LnQ@-#1?sM-Smw$LjHhZtN_RN}@_nnzF2fOUyim!~8hBgwv+n(>6 z7ttuph<~y|;j6X?T3oRF`g(sF`@Er@+Cw(Y!FwJ0e;hlor}NHofzzJh@}b@Cb)mjW z!&h*bJt;NoP@d)W$n&an*E$#YW;_Mr`PBiZNBVa5|Ap7*m zBIW?Kw1i<*>CJ?$5`#dgw1kIK>YHc#B*6mo?>DTAd+HC8mK`Hi(fuI%-J2Gto4xP{ zLxLJfzQx#$!HTm}MvYE~H$-AW)>N}Y*j#{GJial$!0DUjsku4u?qemUDWU;#`hxTW ztD#(J%V0{uAY_;&IMFxW*rre%yOIQO!|fl$D1uj{FZ{>-;=-u>(hq$p!sfuvB2_5E zGb`&pPmZg6cG5^wre!QuW!qCG_LNSbkM-{@wkD;#uMV0TH(xA(m z6cN1xdiS;xSzM`c>4!s_XEJAZi*)8K(P2(iSfnCL7?h8=!=5?p6PhCM$*!)o!L6UF z5t7V;QiLg*&Hsv!=OaN?$oH|U%AKq%2P%dskdwZ!+3#M=Ez&@ywVXfJt)xwaW#L@> z7wJ#9hx^WOYUp$3>obcV7Kcuxzw?fDap2@bv@JPVO6*}Tt=w_EtM}5>5!o-o4uyvN zNWVY)<-13aNOf<=*pq7V6%3lZB&5879_8d!@0&l?l#!Q)YURHv-m9}jpAt|V)#gcY(uJ1%iGW++ zz2D`;@aKEy&@C(;g1-VGMIs_mp8eYKsS9?E(;OIjcX#(2p5=JImQZa0O;PzlfBJmT zN0>R(4Rf}vOHQKeeO8WEnj)sgBkC=z@!Qev5Z$aunMLKLc-J>9O!Hk=hricAP1$o_ zuNK=#*`j>~563+!ajzTAqy7GMVB zhDkLIF9{}(7}rd)wowT_2hK{vFY3s-V+V%Xuo81V1`?=h_^I>ciU=c=HDMi59pD#z z?)BIz)Jb|S09rVP%`b4HfLyW}P;7-P+{H>P^H;ZyE`X7Q0u?x+rS7H37O1=9gG}OuI=gaW`>=fqp;hHo@-UpVz8M2 zAXDayhi$odyU>2cxZs?dI|GqvNSB-61vM%;MI6Z$>j=5Hnb54Yjas&)NJh= z#(}~^$8>8$FjbHIE%718fiNcZjMQo7MaihR@;Y!6crB}VVqp#GBFZaoZ#@fo<6vFw z^DX>2yKH54owxFq0Y-6UUg8*HUgw($f2tFZ{PJAo&dE_jJhMJ^-XGR@qDv|c%GdUl zf45z6Qmng<`OYY)T}HF-Fn{uh*q8RGsVEpKa|e_{e}) zii;+S2{7}6WDL4uW$PkzT-TU+UF=nSib>#zg2b&k+NsXngp{K7eMv->)zCwj`e!`f zT#_9xoSboZt#xXLo|dihaOKsxTubjogI9hRdZqu|;iG;9(uS;Gg0|A)KlUuOgVuJ^ zlM;c#mW`0MGZ0wf#E@XQY+m)*Sw!E57Ji?}XIWgXb+kHJdkLIwHmjea?WGAc{~`TS zATKl>)BeGzU&+qB5xQS8R-``Xm z%1*wQz~!Hyj@5rgC>P>2WLdsQO+4TwzP$UHO)lr0@k*E!Xkc6CiF10exzOV}G|yx} zH-FE_wMox~tnj)gnMyJ+5Kxij^&1OO58C_^I&!)5<+*8}6PwT2dHsDeYk_jS?)~5a zOP`2uUp`9{iS?o)v5J%mzDuy#bOw22|Ch{CL~NBtxkG$po0`x@WTona^11k;{z`*z+?AgSNQgIm$x+eBn8Mjpg7{ICraJl z<;xF;N3X>q%+cf&Z}{7j$y&34 zeeqDP;r6Xj3oYE5;8az&tc2+WP`d0VGR^V96rPWVbN zf(CrzejVt?hI_!}(ZA)YzkWY~=0*cyrxaM%}V+3q)a- zZQpIoJ|u~9OhutIL`~VC8mHYt6p)$at5JFAow}^J-u=Eua)j*2>F_5Wj|9}j_(byT zzD0jLbaX}T29VKK0(bp(gmaiH(wYD8ejlfSem2!jY@)U`H-Y+5g#o>k6Fz$_3bK-yIz1kib?vJN zdunvclO#2?_%c;p@%l3OhVWhuZr&5FHfoQ4Z{XG8a;*oDLAP)gIn^KCI(#)X)A0(| zVK?LA#IfDx?yOU+u_rStHdtc*d<6+#;cJVq1LQrik2@w{);3jPGapk{j_?rMde)_+ za%XE(Kk%piaMa!j^a+z83QW0YS&-Qk!qEMyt#%y z-~#Fmo>U0n(zasOW|eW7UG;s^U`{uUc6pW(m9BDdOiO3?FPc1mn))63+z=wESQ4n8 zp**Q=%Yy@bcg$eA8MB?Qe(h{FiO=NQ_g)6dbk9rv?$n(6rcfhfZmi8>D&|j&9qQnd zl^G?ceNjsD$~l9;77F3;y$sU(MVtxtXkXIM95i&a1CIe>hEPRv<2&dF$cy!D^?dIs+D zRe|X4%;LMIw(*^~aRJBKeXBltX&2N+5BU*btT2~&Fu+^>mmUfU?Q}>@gEo!MOMHHF zktz~P$lHH)@Mp5YlmfC$ftWEx+~NAlza(Xpu&ayVUdw-IEa1U!>GD09oLcc?EBqMc zwp3FxPLPMac*>_IiJ+f+&os;Ch?4X1CYHV`P4rL~OF^n+| zrFb1-aNAz)DGP>)W+qixUSnIKBDi?hIzPm4Kah@WtoS+}92j?F>WW~j`(H+HY1F5K zF2qGPN^uu5&QB>@_$Nk1T5q6NI*(CF;bo%wz05ErXh~}oBGT^*nIA_zlz@0L)t1a` z$lz0@4knMVHv0*=%rlB4e~A#SfRGUH3A;4Mp*kP3w0|9rX%_;^Sm6iF(W-$W^hyqdU9rHaQ9B#eJ zV@TiaX^1k>ysKh=y!=jJX3uopiiS=}Z&~JeNKDBsX?<;EwOff{mhbC}BGqFrB7~=C=gowjpTYa%^+rkkY z2Owx?2EQz@OtLTygH(6wp63U1s^UXKWxRi66e{ygsMS5V^Yr@rfAR!?j%zEzvBr}s zUHtcEiWYd3o-Va~oigvvYF6ia@~o$=q50X#oYd1NYDyR8Q){-qToKA^pP{{g?HLlX z$#PX$T@4Sk15(?4r*dCcd%*UdD7vqceP@C$6Dy=iV*NlnzS0mYMHok1pYUhyec~TX zd|mM-iuv@Or{Myh2X9I{ zlT5}=Cm53_eU9Jb>u)UCKB-CbRw{;((9Y)29D~t@tnLkWO%`Il47fv?V0c#z&hVFc*C>&r#U9k>0{CvdShAJ4s@OvRIphN;XXNk04e z@5#OfA#F+nHVuN42DI#BGVua%l^89pyT;sKUx)lg@(Dn+L42P60+qTzaIwu2jXbKQN>!1^F+cHA+rRD+>7yU&_a8b*^2PS^vn1ZKnujH}5M5 zS%E$T>rpj%cunFGwl<;!etA*u6LHGDVq=Uey&)v2R~*x{C-v9Wz+pQ%j; zEKsD3@9^$Bdt~S)MPbp;diNh(9UsKknF>cM9cpgYH`v_xJJt*>&h;JEb-FIp@=B%u z3d_Vg_wq6>hu~W)BH_C<-!6wqDNBLhNI#tPQ@*CyI0<;NCp#Cy%0$C_1O0>vSKuVk zTU;tEUN&utpF=Fe$n^G5seAi?V>`sxS?8j}?scU*V0X?x^|9~L2>>`pR)>+w+*`ai z&P#~NTjA1sDv?{k`St6Asx~)a@xS`EtG`>DA2vW;P;|VPy)-&%(lecmNvX)#y4b=b z1FHv=_^_B5!h^ISF+HkEq4N~itKIw=bk0#)VHr#y>lV2K{r7ZeaTy$I01k#Yv_XIC zGF{J{HD~K>6ztoT44w_|ql3O-g^v;A7m}Z)@HZjDd09Z%Z0PCCVzU87ygh8jBCi%| zuH}xDzJ7uAyi9_dl%n^s3R$INOlF!d%Fce8jNu-m)K6q}w=D^tIl+yYqPLDZ7aSYY zs!2Gp^46ehLNVTtf9*Pe68&q$Lt_b~h{y!5^dTNijGwekWRqe4Y*x`~Dr(W^x+7-u zS=rX-)_Y^p#q5hWMb3^)-wbW0b6=n6yc3|f^CRF*PdKxEEI9RAT~cE8%a#6;jKEU< z<*l}6sA7Ku^R88O$Yk2B#_iF(^idn1uSwJ2T(~buOcWo_A^7NL{PCvUoyZFgS{k~j zbtX=K!eWz$Qg*B)Uv>L7W>j0g-l%VxMMS^Sv;Q~4p^Ou# zq89Y^cpiOkgWf9<+SnbO*m1VKLZ#=*mHteyfS3Jpv+#YC$ey?xrx1`WmB{*ESyFF1 zn2n#xJg}V@sJhb6l+CJ3(9b);3Z2V;_4Q6uvt?f7p+o ziC}sLd!Yf4s*Zsdc9wkpe`R#NU3&IEuHkW0+JO%I-R?o};XecanbY+&aBBg*R{&%c zb8%+M19wGpB0e?2OV`5)BdXWrP??Ht*WK-=tC`HzRg zjC~uoY4l!;&_{iRiHiMM^~2e!n!c;M8RWFy;5@g+jvh3<18p+qR&BM@7av+7R?PkX zy6^YE=|;+A0V-hTb=78?jAI@xsw9|r!wo9Xid6LeSm`p%d|H{@B@?Zj@oVGZ{>orh zB;ROq+f(8ho4woDhp%P0_Fo*1{lCx8h|9H65=e}gj^wun%8xTe4iqK>>=D7jNPqto~ZK`p?ffPJ;wSoVx0cT$=ig{Dlw8O}S) zgM+jU9J;FqDDG~oTyIxDBrU(y;>$nWj8r%Az#aI>c}zAetJ5PH-;y0ZFW&EeRk2kg z31%#z4U_o^ure8WIKjA$XVx%c5=0%r zLXhiUVWZ?5gj^554<4e;38|+gm*5WfP5Ds4TOG1G$y3VfHFi-LCIppE?)3<<+fBA` z&!6u_+jM6tD-btu2i1&Zy&sYMp`gJ&pj(-xmG9t#e3gH*2^;@SFtq40x9*0~2dkow zS~cjo{hYECm_hGls2qf@mbNF{dPRyn#KWl)9imLfpwms^gFx$F)XZ|fC~UoUAy67D zbw>&`axy~n@lBu;GOk1%N8ehG;C8<^X6ZL#4>_>%pO6#lMXA>BuX(^ThGGw7TW!6b zxNl|LFJ1J<(X7lJ=58qM3>X(|gi`946bMXcV2b(HfBLr78K~}- zJCg>ZF5ECD{X36|FXYcOLt~Ajq)p%L2D!lw{}Pw_PryvR4&=#x56ohp-CoR&2ji+I z{KnWKZTCMPW62Tmp^P}9+589YYgJa+Bd+b2Fm`ZNxfz6~Na?8U!G|{bd9JVS=N6J* z8w6kB%+GMIgSaRsOZiX_zG<)sCME@!HH>U0g?c3%IhWXbImI5nkX;7-iY)6P+(L?|iRZD}5$Hi!yf?^Gp@ zS=M9;8kXl@I%JB7LM!;~5g|J`KsPXj}b%v%~r_&Wog%QxwSg@g)i zwHz|W;mg^u-LKnm=_x`;Kzx>#^`~)fPnry-Zf_=<;DM!al46#T>hRE=()f@6aX{rfP+JcklX)-KR9ris4s=lXubOpdY5e5bp9$x3%h%6VS^r_oGV4*l zR#i|1xEZostP`QMHArR%WkNv=9k`r7h(26Gn*v))ka?To0S(8X4ejc6M~l49Pc?Wj z_8Q1K0yc#J^GF5*5PK!gnpYJZq*~AErl(KVfmbxBrM};{JfGnKCKZmcX^kQ{i>&J9 z#Td&EaXNU8dpgG z=|gVf=|;rQ#vMPGxMWk+IOdBbi^}HBm5lc>4KW+Z5t1hb4!;V-^Hiv|%>f(7_bT*x z&3ftM?tB*oZc1_BcaC-S?G=kW33K8=MYBtQr|es6&f1zwHzm4d%sd7xkp6VJV=oxb zSW-X0R3PC5wqw2{W%fm~e@;EMx0=c4)?A&3O+ql4CkD?=IozGV97bGO zXCn~jfd^c!2hUFJ=SqZ#aKbne?NuH-xZ@6X2ahaWMXS`ugbhFUiat#-4d05(>QsLX zPPu(jJiMW@%c-YZeymVlT_4)Gb+l=RNXTgx_#LxLQd;&s01N+HE}-u)QlIs+MnKbw zu|9QBFQ0g1x9$GDAiqQO@75=B%lp8tKjKhv+W*u}wIflf+k}8!U6)hFr>X2sjN7(nU?+V(h85jK|Z~vkFO8@rxgqu&2 ze$f{D{od{0PPxqy8C6qPR@S--KU#mRuRFxO63Xf9`q&BltoLA~jg7S4OX}-#+I4;H z#cfo>(f!>%exdYPeoTgwcEVNdgq*mi(CgaEpfR;dS-HH#*|(T%AwJ0UpWkV+MjLAz zX_4+3+i7Z{Lg#Z0-yQZcs1HZrG!J+`=8cSi417xno^UW|bMQb|uQ4wlxZzc8E;muI zpf>MIm-IX$ekKX+h_P-Er0r&LmopaBgJPueil`g#5L2{Q>HWibWtPaC_?jRzJT) zb%gqSMqWPK`^B4tOc-FkhykYbmd{P6_NJ}U{QK^Z(|_2-KpYP#j9D8RTMi`kTBD7c zx=Nt2U;kcr)=ho9@z2Kv+!ue8%4Mf%@x8dx2xaux$e}0H*{aGLX!g1NZdNfs97WhN zF;aen)JafkOLp7QdJN4G$z94-fG4<3U?nmw6GoS(4%epk5xG(^E@5jNW97!zT$!~{ z^VR;YjH}xHn=@YvD?BCJQv3d_^5~vfG>Gc*n^lClYjZjOHDpwsGzvA`Z_X4cFL-nz?te~mEt58$_^03Z_ynt2sZkLH4K zIO_;gMD~j12mM?cP4g=z7clX~(rrH8N@=ZtJO~(@OLN$DIq8%~lsEA7EF=%8{*(>@ zv2&u}SSfo>=9Qr$ymc_C)wL~#^K#-f{nORjH;yjhO6yPf!eOUroGynX5b`Z3fwMnt#%ew+~kj8;>%D0k5R+LNi=j61_FUYPWu`)G2Ir#iYP>|!|eA*KaH zVjOQ!`I5|Jhd6Rm$FD_#Jbx3{LeDpBOmUw>@(>Sx@4t# z#e+pMs(*y5HIvN_+R|4m2R(K;`N)%XEKPf+sOn6JtW9j2f{qOS8wVl7q0-2@IM`R$ zudDP-xkX+BO3dOAT4ldd{O4h>WSf+Jxj7(R%MwQ_oGXFdyYlqvJ>9TA6C^lfe`3{u zvD#bi!f(y#uHN8f;MZ4yS;?akmr^1jd0l2>3x@(C6l{%RhKijwdU~ysv6oR|Z+C6n zv_1sCT8-;c4#{(I6t5+ZY)(#8JGr2tMGo&)H0y#RWKQxO&{n5H{an%0FW>rQ{gL}; zE=R0A^-DwV*Csl*%7QH(En`Xgr~8ch5%(9d7GQBbO81_q?5-!ufpIJaQ- zt;?IV?A2gxYMB*SJS$1~1SKwQ}sn!^Sk#!$?J60??YDfjU4l zW=m+}DNR1~FnkmFT%IC@9$n@?RJbCuX1Gwh!0y=FxaozS_8<3!r&eQ7*54d?6t`bx zmzNyitM{2a1ec^mGuZ9Aez0TM-UFwRxK=qofJt?N@*q_zZo9RDkV{80IZ{JnE!zn7 zz^xJt)OEG&f$kUb+}_KaOFwMiCjXIL3u<(mtn;M39mampmm&2WABksC7OaPpghJNU z6TH@U;vJ@F@!7!R9`--k{4v|p0p?P#?DbjedVCRc%u1o3D1+oY+bV+jVecr}>ZHh@{^zGPV@xO;Rb z>zmm13>$O0PAWtDq1BY5!=AwQ4!-E-mX@a_($DT1|aLdB_7qy#r;|K{S$sR_oX zTQ|TNRwtIWUz#DS%G}wyJ?er#_IG(RUDddcY#SbDCOHv;6?LR^n3Y#Qy$Mj}i`B^* zUHovQW&MV;!rvZkWlHU?`fNX&izZCe`$ysg`9kMPpMD%Fw5V27aX9oyf|1ePU=T!a zx1-9fRwUBYTzW210u0}qJw`)5@mqHDA8w;mgEBoka@1NOW}&cc(#Wss2QWa+)3)W3 z!>PhIZnVduIg+)_7g5T^6psPAC#qy*AqH5H!3GY(8pKqFC^#%ZG-=2Oj&ZqqwY6d# z^VR`nk#M3D*mX^AfIATR)kCp2Zh$FkE(|ce;*Jxbs||LcyE_{U(S~9;eV(O^WQ_Wl zbOTwJ)HL7AnDMy%)~6*u<*7_c=*8mdy&`^|^Xp`P27O|+LU&`?xT}S}`yMj#1*fJE z)=q`PgYU?@tp`niRbOYo4-OQ{PF1V2<`K=~#<4qT6c>s*gpM$WASA#Nb-wPqa5zP1 zTK@PPg@yhAqzQ`mZ5orOgY-69RdcW8yBeY&b{3rYY9etD`YUl ztO^H$1p9TRJseIZ_TkVxI$aLKXD5Xw+iUnx{QL%`z6SgOCqa@Y(KZ$9ZDnwMcli`$Rg}h_FaG^a;j-*5cpmhBq|iP@?UY zHvM#UBZ8km1J`z{!{8fr{tj;A78?yI2Rl=Tc7AQ&z02X$Hh<^VrPo4e)WLce*_qHt z8mb>*?6<=^fWxRdJe6(stz=12n;bk@+OWX+k=drrDYS1WC`vjLo!CYf*TcWfSOQ7g z%{PxwC^Ts5um^pGvOJ%%l7|ZJ{60#Cc8<5|CPxx}_a0b%8Bf35z`TxMdifA{*pmX6 zImF7Vk`InJnLHE*o~tkUbxVX26-0potUb?L1ZFOA4Q zu@Iqt)yBM{Mqb<&`qr9v*k5c0YZ^CBA+q(V)z`r~Z;29)xnlCoj90=Lp_@0PU2MPt(%Ls7H^P zD9>!{x0{B)h@Dx`V)z;fi(*tNuPKvWSlqsUPg{d}Tl)?tTXgSx!=BAlJE2~>*XUqn zf9y0Hyc9GGEeYDL+=QcUOfnwY2|3!(cH^5E|7M{}p#N<^ zeVQAj59_q7&xT(Vyd2-kfHkTs&v$LAl(xhYFP3D|tU$itN2Ul*(GpHw^)t<<2$Cou z^`A%*$A(yMtdZUSxO=fxrd8@V2mS>$Z&ha@(a?)jG(Tc@h+ z#4MsiRK4@-r$St?2Z3me*rPM{n{C2gq(4a?Zec$rtX2}bnY8(cjm(xjj#>3?4rCol z8k-Lvh5@@)L_5l7O4k;U{~~iCF0u0Wln=Z!kU&DVesmN;_Q>O$Zra$UGpp@(d6(&D zs4=N)c;IH&NB4M@{hrz|=KY)Up)7y}mpr7=)@+n>C2*7t_~+*%t0Ue`o^AZT+t3jp zRA+0$w2BaVQWXpQXlbxBO_F)j9uf5$wGvElTBh8H6izK`xB3`nCKr)O-X7odKS2PR z+TS0U*5c!}ZcZ#mpC)rc;qxzPTl+`H){RcFLs5!bNxF#5NA0|DBfM5Yo}h+WDTpZB zh=@b@lLFtf0!EZAw7?W+^$>YDY^!D8&g1`NO-fi41~@bPr>gE4c6l1lXy%trVsr`E5Xp7SrMDC+0z>D_T^ZzKs3)wQrHfp%Ofd)T}b ziiShAcYy-{BbPY*31Za|Wl6WU)R|ST(in$pS|h8N`SA8xs<0AF6wKNcjPx2!v&E)} z*$g^br=g@}lCxCAdu1Hg%cpmbvs-aR*(HA&fcQs1DU*zwYuIk_W{3IKRCjQBx`;&l z9`S`Me#mO+hwFZf++~qGqFSshc|1YZ@aXNBL-(l*=t$nvtFDV9HBvEnb_@W+gns|B zITIaS2EfNM%0TzV<{oBI%RS4zV@d6S6A!{hB@< z3-e0imDl1A3jTiINKowD$0!2&(Aib^m2k!rVSg}>zjx8A>^W^+flhH937vd81RSrj zR<@ZMCb0G7ON(6_M0hm7^0bzFyY%|J(3EpNh`3ujta{#k!5}GJqCJ%YQV(;nG;)R<9XyaZvrxK>)ypV;$n&6M8>81CFz#OAo>Log7$GU1oJ1uWSBM6L zPG-<|jAr*c?tg-!s63LZUy|x|)fH6ODX**393yx=_wuLx{###!)fEF};armr(Z)t? zfEOW)m{*fgr(4F}6~;{&-)s}mQl}MC{BK4y?)A^CX3Du}*lKfjOr0T7LPOzjw?V+m zR+$C4i39!@)EF~y@et<&+1P03A&n9UtnTeI2njQ5|7QIW01r!1-F&>Uv4W`P57~xt zurI(`qmpc`$-T|z%IRmlw^9jZl{SZKxAHruMAVfR*=}HLJv;fSp)LhJTq}8t zr=1V(1yVv}OWSd@18Y-xSHzgm9^JYG=w|-epy}Mn?B~7pKW0YlNOhc5yAx+^xljem z+ci92I=ACh^zuR(h$+B?LHUq(hBM2|I=nva<$ z?&QO5tOT3!QrW9k$l<_8XyECBZIUok+BGq7^nB7ZGBg=R{6jm=`YK7yUyXJP)c@wT zC>9kEWqGLnW(M(_R1bbBWr{nZ6l>Vh3fZ#d10{KfJ{pvc4d>s0_o+{V)|Eh42H4ZwMp!7pcB;L0`>Ew+)WJrz#7V{ zuk`#taxW_b=SJHd-Ft+^?hK8E9Gd>xDxvkE>Ix7&cCcf{QNg|&8xmSPzLvte!`NZg zi0X1scjWEF_IdLH8vkawBtLRqfxoj~3%z(CeJ$K+p99##w;Q0}?chit+gW|cY$2|M zcY5?g;oLprI1tgKuD9`f(EO!&nK+yMPM7KJ1|B!OofOLDopkYki&WVvkfPk0k6BKV zO*o3ymZOYYJYJxK4)@ermjD^(jAM$$tO%}JYWr($Z@V&8*Ye%Jb2(^ug5nT;k&-Ow z7^A9OA24HIY3VhRWB4igr$lWp;1ty@XQga%T3Q6aWUYbRtRFKKXg#ghiE%=ZFD4I= zlY1@vILP6*sL}0XBH)6ib8zIx)TS6hLmM?68(@KkXlDce*eWu;*h{}32I-%v5GCEa zcly>LQTTR*`ex^XEsB}iU9-9iTWOYl=LBr!qz^Xz&QNoNrWP_U*K$yrc;H~E@>_~0 z!VTH}k(S`ocm;U7$hdR{!@YldGq`YJT>LsX+Gv~Z-?ecn{+0+5j5gS>wdGaWEp%DQ zo2H5wP~qnPB^#ErKKt8CzQYn?H^3r#0FFBUw}>!r;Bew}y<9|&>{aCD2wNdkuukf= zix}h;g&ASP2xyMOevrC@>ZTz_RR|4})GDI&3}}`6eY8fUC!l!=M*U5Qate3GawKSC zOB47q&I_&5^P+jr5r>?551aQm7nkF9_b9Zxh~aVLEIF309w=jj0o|>o*8GfLtF&WX`*_# zfj`2#&ThSTDc;7q?n)5+;N-N^z$0W;9aBacyIq}Jw{u=Y1AJe3M9kRQ;AF~0jGl5x zoAS~Rwe%wdQ1}R=LC>&J#)IH{FB4mUXxQm~Xc_r=<{@yHBGase7!XqkX~1XhAZa=@*BkY(AfvV83DYO@d*nK zJguC^r75#)HGspw8P&+mhX*$7SXrA=DJlDys8Ju;W3tI@$}5TbWk4@evDWN*DY ztyHdZQR`&8af39RMB;4Qk*ej5HU^)?A(Im>Vse}^ohp9DXOF7g zt!jE8haZf+77`{xz<3%9W0NK1(B`M{G!ec+Ritf?J2q8n+Vybz+j8{y>HyAY!1guA zByIS{Nx`eQmF$loG36PA%y-F&kp(2W$Od?v^uXuIekB~xl3G{mRwWdUlok3f$#hoXnzh_HSr<0!Bs z|M-7RGi-LfDnj%=&S=6>fVKMhhfm$A&yT=+F&>qm<5TVnA0B`yts$U<9iabhp}xh{ zBe%{tiZx2%bm87fP&kwQ`PpJ1J}~T(L_S&Alw#G$Z+#2cwe=w4c5BG#oYacPI?)6R z2g)I-w=ZuzuO%j4pW1#u!@gA{oL#F+I)=L1DDU74Ra!c{TRD6O2ypqtbRiu4@rJUc zOikWmQx|laKykw@J7$2$S=)%VaP;EXoRDoPq=w0w@!7ZG_OCI|c$KLIE6)=G2Chtp z%vLm$goju7U~&kjm{}MYw~E?i1pE#)XEOS|9Ttnp7CVh$0J%pTme~lSPahBh5AfR` zPg>`T9ZMDp_X`CgCBVH4YmaJ$05&v1D!C)9J-de2396GtPZTgHP!%WNfp*XlA@0I& zVGVSzSbHIn>tOuQ>yP%P+kBO}D$9r~0C13uxq2~|$6m)Qou#?+$c9Ax=IA#~fp&JV z4WA<}taMlF6F$1CkH} zMCYGpn<=<1o}xISSoW5__>xr+fSa2P!Ggqeu%HmP9gD1-xlmI22cC0^c0&TT!RGt- zpBf>hRf#rzvQo&~DaK=MQ<>O<2{^-x+EWmVc@-0X7vzsLaKsawR=yDxWsIeE_e4BGVym2e zzhC~spSJo-Eiryru;@Biam}M8MA7-e>Np72^-z!rb7nSU^+Esntou+d8M_Wl*5?kE zf>?`vvk4J{Q^Ti=lwvn--d_6Zo!5--@2se#nKW1zD{J>phrw=eKV(bh#=j;G`j2Bh z-3UGbH>Q0NswaA_{6>e~e^Pl;Iwq{*p;UPN0lvcZFr(HZTh?4b*aScH@_E=!j?>7) z5cdF_xmB?}#4oLqmAKRte#V6e5j7-hrC!X9IRcM_yHFEBVx12P9%8b86Yu-7F^3Kv zwLtO#Ez>Kf1{GVyaZ>_^lf6?cQ2GXNZmyqv_{SMGf@9A|TE@&FXL-}x92L!A73@10 z{S>bInm$%(T_OjPQVtb)W<`h;1cnFJnIAx9Bp21+-cxS|^;eAavlXdSU)@OorkF1nL|H$Z zE5u+v!RI)(ySDV>Hstj;SAgeP!d7q-MKEi*H)91q9$m>wG#JEhEH5n)$%0q4O4mmS zINTXwCu62rD&8bEI(6!>$5;T;@fYFcT-h*J(FjjFSh z4*oYr3GbN&Jj8i0KMLQPZWA_tJ zx~`ph1mnsgLFQxtJSfOaSJ(k44qFvW@0$ESgW>Ag^7=o>H!d?k$7Q8+1z$?F#pKDl zfbjU~V0Z0_X5e-MQvK(@%$W2$9dWe%UjYoijYB5Azi?VqB9dGy=*x2CIJDo>{T=w7 z{T3L_|BG(JhAg%jin~s@XI+B$JPz7z&Q`FWqI%Ji-N{G%r1=!t7XAK+aMSpXm0LMt zR{hq;Gno0jRD^()(&+v2TO9%D&nK|!`Lm_Gc0qofVcjE~DX#fr zlcfiVSGAj0X1gtDh_k?mxtey1%vdF?P~8Bhsub{*galsuS-GEs-&-x0SdI#7y`j#c zm1%@(Gq&Ke)5Amv=o@h16luE>@)2tmp+W7tNAzdOL_H;7AYaO1AbgE$tlHs-2Iiq^ zza5DaFn}?mq8H`>df~&-dMdS{8h2VDq6Ui6(FEWm?J%h}AEWParK-BR#!Wx(rQUfw zuB+^(T$@ke(dRC?va!OFiu;Mui7Ro;_5sW&e7}iN{ZC#{ClGjMTg+}i#b5lk(O+C= zPnCg~L9Eooxhnr7BK@ki^Uv3zwe{5);5*~B(sh1*T=`SH?V#Q2QQ=}^`xlwpI0&z8 zgWCMMUH-WOee~x3x<^7zu_N%V|Ni4@{>snUnD@5nk4(t$0a=3qZhpIa9l$+G6&W)w zE?PaQzOS7c zhXi6e*WqHTrKbr45=VHLyW}Hyd;?{Y_Hy@8>^4TWI|T#GjEf3P8^ZSfbI!N=on2+Z z{V!|&GU5+no5pVQsJEvzRXX`O$BpBk# z083dmYy%ev3S5_&-aR^Z0(@Qj;K@-yy%wiFU7dvUPBE+4Bf0{nzH+R$%i>Qy$N8?4 zUdCrLE12Bm{v8EEX?|GfDPy~LYSH_;nY#@ALw0-tx0)e&UOgkzvp;n;(QT~%zDC}C z;BfEn<;`&j04FV(j!SdE#LkkHUDxYqlaj9F`H~22BlwYgXqL0cyL}8Xdpq^Tf>aG> zRJx9o5i7@d+ya3^Jsb;6OM3L>eEP3cT&FSSmR51h8AljE!hr43iXZ~lsq9TXuc&7( z4xP2B*{qeMk4P}w?$(3hgHf8TOXH67jwRTt>p_$W%5}VIGzhc8g8TQ^LP zl=-SJ2cRTexw~s)DIo_LQ>Ugr_u%*VRBC5NnxO|d9nW>%ZqbUgyDe4=fv6GGs) z1C3v~+r94y&cgT0HJaS`(1gR8juC_KvA(g5!c$t6UR)Mf&QRd+(BZiLxl)SykI$=s z3BY4%jR#G3_wQ8&Ryb$R$U2)u%*&-G+e^FC!|H5Bwbq;aKKu=(_C-x)P{$sxrY(e_ z{prlS4AiSV7LqE&V$RVn*#C71jY|7^;0R`K(3-f`Ob<$7|yLGtW96R z;4Iv3uD6CfWZ@BsyFUpCsq2amIt=f!nX0mzkBKi*j@Faue^DXan7h=r+LmET;S>UN z?rrap3YLzo*W6gOTwEIAaBmk7z)S`P)r3r(RS3^K!Q<8ee(6$zlUlt8Y}38YT6sq4 zV6@^5wrn0>oxTo{%I~C`uRG<`q`Ze-+6HbGLHQ_iQW$%e;o`FtA~e+Ro5bxbZvG4x zZW0Gie#crtF}B#hEkl;4RYciZ92H=u1R8f7b@R`8DVT46q(XgBIOQ#z3z?`LiktWN zeeSY0vX%pCewH8^Gv;!*$JnEs64s&4 z2*BHU0JkX1hxqD2=+M@2W30(&RK*|q8j!jlBQyO2z?84%%K)O#FRWSH(eu)!xbgCM zo-omm?jWZu2)e!vG%G&+I(!~*nOzt*b*o8qjfme60^pI6bN-%}Y>;gXk1=ec{NeMH z{LIb3;mg6Rbh%q2(7t8ghmqMJ;@E~IUQR-MVWfP5^9tn0(Vmxm0jEp8+a+vmJ(qho zx_NC+;TX;aGYN-Vaipj}@W6tO#~a*=+Ed;K4i+)baPOZhaDmf2=YdliPycWTdGMyE zqb=6P^kEd=CjVe={?Tq`*$2;9Y!2Ba`|xHlg3Y(7H64`EeK zB)lyM?mfp?ubnH?9x1k}ca9&vhy9(%m8US#Z;@b>t~T~g_9*#7dztBI&+TkHa>%tk z_cwY9$MS#iGv6#)xpJ52z=xU5McAjS2JH^gjsrKNDp(^YRGqU5=++pTmg|4y~!l!aflE+6~qYJ>!)$i22(Mb>aJjEpv+CJ~U zoZ*pXPE&rNYq#w>&JlHA$MDb~t<#5owmF6Of06gzQB7vu|L8cr!i-YJQ30tlq9RHW zX_1z3P!UlO=`{jkK%{pqDT!yMTydTF9HUTKmtS(AoK_bp$7Ya$8Q*!! z{oe0d_n&(&uH{NO&&hetv(G+z@6TuNb9VO?OXLJNB_fxViDMm!^O$u1IeT*PaT_Y& zOzrB*DHlq5g20PJw1GykTrIn`^`B)+ZmB)19{preWGFCLQazI|dYOsE?bfGQ8M}F< z<$}Yx8Y?94xqG%z_fJL})ol*u)OaOGsyKYGSnU_BSL??(AF@TTeQHfQvL}BqZq@C* zv7@O~0MGQt#%=G`q$3>S4AZqqQ2Ff3#CwYDkTYQKYjM>1?U8V#qK%spOw}>!9DYCEkTwdcS3#QVTKN@8{)FLw<4kF-N1F1oQNy zWC?SDt*^_wij5xf-*G6iUtMs@O#r5DJIBJB{bp+bGTRT|wn<$v>^FiP9E(pts}Uk5qbn9WKd7lFewABqr(frXI|iC5unWiE5H9E?!E62I^>y^F>)5Hc zuFo-}3wg<^U#!S4_Ggx%oX1T8bor;WyTEpQ%W2iw3sfO!;~cQFF@9;SI~(-p&^ce$ zWd0AP>CR1pmjBDk)OIXda6?_KSL;;N5zLzoF$%3hJO2@WnbWZg+q-3QR2NnZREDoi zD4=h#9^f01`J>%WT?bcR{Mi&RJ0E9e#_qJ1F*r7JinEKvVN@j<$Dpjq(J%dRI#uG^ zGU;zTqC3kW8O)jopX!yo8v9o-n}Tr~j@wa3-+ndKukwX{82x71?##^IB8dkq={YmI zZ|yJ>AHPoFTjeo+GH^~)q)zh$czr}&4al(EQcLo#dS?lWMWOcu}_9QvP zG1UvOA^0>dV`ePvkA@MB!3t7itY*gc15;r{CZw>>+!~rge3204TZ2YRiD~=-3tqmk zzVhTXM_B`-&;EpMcuujVRsH6gk4MHuvdNlUmY{8bw3zit7K6A~>#2xJ%n)8z5t_^W za+v(OskamE3RcxXlB`v4Q-__^d;E+6lqDmkoM)OBtjyt@sReW^)ryHbW8siWGmdlb z%td~tiAYQL85;+sGYWDbHoy@4Vsdw-WBotMS~9&*Vu5o@ApooQ zZQ&x*>0~H^`AEv8Qp(mV&<__V_$m7heYq{Y#pUc|S#i1DOr0t%D3@aZ41hq0s+h)+ zU~nw&c)5kf+9=r3Th3TFhH9(beovt_)$vcok>OLa?G5a%#hY8}^LjeGk6r}u=J?Id zIFw4pt5x`^4_64fn(5^DAV&2S;hI88M(=T(fLfQ4{?c}nmVbytJHck_*UE}%*nbK$ z<;Ng;7v_6!=t5nX;w2lC$Eu}+NYNZJO0I~?&%Bte!90MG29K3i*kd|8YJ1@MHla&d zsGEWYbuwZ@^1BE4&{%jCFKIn$l+v#+3K$GCZ?sON$1~P`^d&DHF~EhMtP{_scn9I@ z>FB4IX1@p0X3VkSYJM0!seOp>H1NHrA zvPRShUO>t=yPxs%^249~ZhLH%o8&%~ZY%*0=uYQb_)UK3in*(~+G1DT$Vtg+NX8jQ zOFv-Eqr>~|>C5R)cZI2db95ELHyz_!;x*K2=i_R7o3w9ngy*%RevPaAU_qSm%z8sc z?}X2A&DywMkD=}izS5M}Y=2M8Dtzr)oz(n@9Bns;wFqn9kV zj{?rG=(u*9rmkAKwY5h`Hv=f|oh5f&&~92F%mW`7uK27Po{~fSN^{&?V0f z!^#)~|Hs7|fM)QA_>W#3Z^tWMJYZ@3&h~D;&Z|8L%lwlUXd|E3RL)$FHj1lyJ{Go) zB?%S>=Oh{SRr$RMVqc_b8CyyN3;HSzspb; zjz5E%@PRy&r5R_@%S}wE=Mu_<@;39nD#E_o@Q;}K$J;HZ$K5ISP(fuxZX%-3~TMZ9LfDBn=YDcj^Lu=8?xAC(3`t_b ziDyI-;DBe3jpbL4TBN(Rc3M23;c$sLqQEogvlyi_(RE zkeMPRN#cvDx|C^JtBnw`=VGBUfEBymyG(7zP&u3!dCSn0#v68i?+o}0>Y?!(>j6UI zP(lCU5O?#@D*UQE2|rLeeSan;lMzEYLUHmJhl)!#xy0?+g%4R^P)c>57V=Rnw2}?d ztjT}0OMeO|c+;cdnVwPVIZ!M^3z#E>`QO@rF2aKW);6;myA;GRXt)#1U@`RG` zG*>Key(7tt>k)1361!RrrDX6RNKA~FTox~JYYohnc@&>4CqE*gC6Pxlvko+w51DRX zW~!x;X4U$f(gm=hQ~6HhxGEc2qlyp%n0qMew*i%sIq%k)Q>mG4_8ZEi;h!?I?jTV1 z7H0Wj8Uj$g74noxE+QUzGq@%k2{QB^@FZ8{H={acSjtk^D5)4pZxN-7Q;w z{DElbUg$zwT>C>YaYoi@$fN|m4VR5rOc&3FF=ky}blR&WnaNmC_|i%O3xn!!z<;{n z_MT6u)#%MHNzHYUiK!&pFhCpJH}R039yk@)uls(bYB^haTzN^JGKI?!jMDHsNE4E8 zs5&u}?0b()zlu8SceHiw-uN6dM!hc}?;#^jN9vk=iBS^6fm?;pN)5xbu?NmI{y>#p zJhUj)lG64t>qWorgR0Jc-8SZRVefRY#JTg6AMXui`}|`YKJ9gW|GU#s#}_1$CDiK! zGMOQ{QyG)*wy<%f$pW$k^Vaa;ah9Xz7&xCi(KpWbCh)YDf`k1;>WSval9o8%m?Hf) zG4~7D_zYH^)ZBT;hBlawXG#R#nrU5>mA)oh(0J!Sz+BZG^N1T(%`1+UaWBV}R{|K* zw=%N&pEIZZhNMyQZfU7fNrE(d4VH>Ff4I@PGIa3M@?bT67%CYoZZ47HzhwKsmx0A| zlaEcs(jQJgr1IihHsA5}1HbnEGULdZg@BuFjzJ%7nZb(j*0srE$UJW_6txOWU3Qh| zfT>bY$g<`w?i1LEi9bjlUFE9x@v;q)ncqnVtY^EC0r4})$quiZI%l!^obw<)Ox|lF?f5 zA=Hd?SBh5XkN4<>oE0f@t(?8=eV<`x)fpF7u{%%a`KNIPEdb?U_yp!3xY(cMnZ6d! zcm(_I!*+1=;<52^ns7jd36_^Z&)Qj!6*!Zf_1M0hCx7OJ>~b zmx1o9K_c@TpIA50j_>1sA#zWhl1~bq8@i$pFRCoGtfd%3oxLZP${@Y3dFO!1nDPt> z1lhYS^T5*?Uk994<5~l8^+4$d?;I2x8SZVWCl3%DTlMwb6h(m(xVLg(KQ9}$et4`j zF-&&OiQ+eqylaJq+scHdMH&@Nk{)afyx${eE1D#|XeCqE{kgpLx@=gPL}9d@hJMeA zp5ezcn&kT%)eouO*02e|-`~A(m8zHb| zH7DfAlfbD>r?=+kmn`rSA37>dZHvl0U0qYQL<_qTdd09a6`Fj}WRsCB2y{r$kxb87 z%epOMv3iz*<-dZDTi*!i)Ml2P?^$nfvdtwn9-RD+urlCoJoO6IxPdqyIvu)6lWj;A zUCT5pA9@@H6~3CD9H!|=wa%KfUbmIpE)~A8sC%+8)@7BZ*=RGn2+zNRFkKB4pT!GP zZP?GN+Y-#fGicJfbvOCcuq?dtWK&CBu1VV@@DmZ?c?HcXX9NYxRHa&Hj zLH`9BZ?dRUWBV)X@Q{-_vLh^R1&em7=RzqG>zQYAIih_bSgxU40OKeYCe?}e?^81@ zufvXHt%m5oMpd6Q!8i}Oy~leU42zWAT6yrQ=fj`&Z}KCZ10_$RpivBpx`4IGYe7QN zvx_GNEt(Rs@RBQ z_$X)X`Idhu3Q*$0-p@ESSN3vgVta1x;flIb)Kq;B)wPWBG~?CW^9~2G@i$`{#0;M{ z35aEQ8y2s40zRSkSl}iS7rXVIfHzF>QqOFTu~&fAdA{O9v!ZpJ&bSWsq-&`NKYKKD zCi;S`&e`*Irg0#(bxLhbSo?>DaU?Q~46V$I*jrJXYr~8n~OtuSKaV2sqhp ze)OQGKifM+KsCS9sD_eCkCe=mZ1|~(@}4pNd9QwPo2%A=xw=lNu!9CcYMPh5B4``S ztTEUp*lwLev~8v{2&2W>59^|mee-*$4mz$w#S$3F4-l`D;=5YlDEi&fT}30sHV;X? z4u}q#$3a`3Lc5-cPj;aCMdxPBOf`@X$;!XsG znC$548i%vP6>WB&wH+#II0I&cpM0A}UUM4X8qsGakLl@NB0M zk$PLdyCp_vF8c>(1H?g32(>U4RapPI{rpteiV2Cx>(CH5f64!*=^^xTyRhHhd-hMr zqF1#UZJXE{3ln53Az{iuRik@CX}fEi3BQ}+paDhSbT~XYntqX%8R`do$A@@bQJlAO zP(I*ap-;qN8=V-Q!s@N1+OZ^|efLYAl-zDp-!9Qkq9;vL9=>HCMCap-LeZ`oFRMPU zM$d^lhEBlmlb&oJ(Y37^`LsN;Y+02AV;^kl68G$2(dby0)y;llHoZ&2v%~kt)TFGW z!>wxXYg$fgZ83c14naj2S?((VjZty;qEFDz+8n`S-=;(#tZ%qTHSSZ99WF+?ktszb zk{K(#^N7Ap!}3@eOA^KJF+=`(S-reb1=~~U5H{1O-RR1DS3#_XI0Loadp#H93<4XU z>(BRjX|q{x(kf=x&d;ckoX+aZATro_7kd!b%VTpl8JTX$T$>i!HJW;d>Y?Eb3m0Rg zsc!OD;mLBeT5U)=9EG=3#5m{7PU{Zfb8_$ki@q9r)hFl=Asmg@6ZEVh;v#wcA}Wiy zBK?G|^&lrOu6O=I&wjKg>)|nnORXD`^9% zsnC$4I@Z_JmTMSOYQRd4G+HQr`Xoc{V2_NVM~;1Fv`b)Uk+V?%kG>g?-}xmWUs6nn zr(sIO$~`fG#CB27{RYWNqvwp27GrJY(R*)dsM8=P6Fi4-g6O%UF9LvfLX8DK^9P1< zTEkWjEY-S=i6&gatQJzTCSUaR`BH0AU z>C4mzv3GUJbDa)sK#cb?{t4fN=J7s1=W?7hVrKlwc(_tpk&=BxxKlG>+b2@4xIhtwq3(OhDDj_b{y8XVqHJX!K%ihQ<1=7|T_zKC-12yHV^A_bQ8 zD`CleS&5Rkhbi~Y+q*Uo5)0iL$S%TVLr1Tz+P=J9{p)t9@l~s}pblbn4rf;vWc^L3 zyHP;*t;?9KvU#T9u_#3iacU^@jDgx!+kq9G9n~nDljPd7WqIp_mW#7ON+>bP80f?; z3zM~hwBv)}Lc7r0)v(xydw$G1PK zBqzhH>vlP0@+m^^~;pElL4}M`))`HwM>+0z>slmFOS~TkyX#^w>X?E5ijA-mK;t<1yQlR3FNt8 z`@lA%6BijqA4?RUi0Ld_F=rffmebeolklq`CDSkEVx2(T&$~!LQO6EoBk57wrKQir zJm!`hs=aKWBd98EK@*NvHb<}M1bfV?E^ucm%E6lF-^`YKv1B4p0QDPG%5(5+^XOU0 za(amJZdR&mEqU_9v3boriy22ZZ}@5I(Yzi=40Jejh@+?L8mu)2pUj)RPyT)d<&tC} z6J{<&QAq$fuIrB^qX}!rG3$S<9St)!wA3=RZ6jR&dG8*-!Fw6Gb!>4Jc zH#mDjtwRH?v)o3lo@^9-CwMEz*5JL$CxDXoO+^RBpxiUVT@j*fTOXz$ij{a;o!dBb zwP!!$FH^ws<14b?D{^054o8LmQNmdOe14tY_pb-bX#xE|(mNmW?B!a#WI2uO7$w5S zpMej5Xw)B(tT4z^zeKW0(nFfrN)}4jYX$Zo!1gQqRr+&?)g@o0KdzVl>b8j4I*nC9 zUgX)Hs?__82QC>R>Ew=G(28HG;*Eyx28lTxNnyqnSI_67%5xl}S3~m8^rOnlgswnc zmg)1x1Nf&UC=(NutgRlKeke%_uK1Alu!NrFR6k2o%xUtgn)ObULmin}G%_5}FmshZ zaVaoth4vJhtJ8yzfBC2MuQYCdg6%UOr7Q-I?cb$ zgr;&j=~JA7P87kc2|Ig;D|s7tz-HjsUR;fg5js91C=3r%#D#1_p(B}r_S*5fG+ z%pqAs%+h4CK+;uaC$Rj|dYq~!pIs$?UNg@3cEp|yDU1#^oqoNjJD^f9H@#K0PwwQf z+zTjpg7X8vm9JPh)R<07+OXf|(93p=zN@1oQ)Nrltt|_eS76^xD8UPu$45m>o778~ z2)jmNwRFN?+{wg7WX+Wlb8;p%h0NVdu*!vZ249Y@ePJW+z*qp#Iqj%!mUFqVr1#BX z$9Ri!T24aK34IYe3(SPi3C|$ay|?0ic=c}T#O})rAngaKpR@l&=I?$0fVeNYF(GY8 z(!($o9<2BTwpx8W@-Nsj<}KfrVL!?qRO{J63cp+o zC{7%B@y|E9Hk^Cf=@$Hdoy5s^`}50>|I=k3djQv}V6W_=7xSMt=Lx zMxerv=ig>$!YV=B`Sv$pxY6U2^p@FC-TEC|G}^^$NsnFON-hoAT7RAO0d%r6vwuOi&MBa(jiB#gHx67o zKUA$KHdHo@Sih;MsW~(DD+h_@T<|gM&tH$&)tCsXkFf%6b|6Vk=F@tsh#d*_F1RS~yw1mBk900a$)QFZ~ojKt-C|9PSJ6RRbs3OYIXFe30n?;YZ9 ze#b2dj~hblc87Sh|KaPk{)@O)WYEQRz%F~8wHE~XwL0PKO9TH>3*+CxYhf;6Xv%a^ zd@6OseebLbhB5pHhz443MN|)Rn00(76EiQTyi}Fdj|>O%&AHESz_&0L$l!qV$x;@o z>1>bm@7F*gOgnphu~A@epOJw?y6Zs6u^0+0ZslfBD`(#ZnI~d)Ly9zkk8w9xpacMF zI0PSJw*gYOe@#D2`(rMq7#``#fg*%(Ws0|Od$&;lv{V5sySYKCd!FXvg#&UwViu6- z>08i^9)so(e$9zDJ9IkqLWtM8(YQ|whsXCJPHnTw113(%E5#Rf(I=9V?@v>HAaQEF z{FUo%`BinS{e_>|aU7G9gqI1DYMfm3YsPY*2EowcXNP$HNvY%3!Okbd5h`w-Dj=8Q z!HHv29Oe=Q1`0udVmAhy)O+)6HapL|#rHCYS$Z1j|B9K|HM4y|gbE#*b#i;z@hIs)ko=4*bXAD=6^*@+pTD`U6Sywa?8O06O7p1IAzf z6vyQ#q!VWAF^+k$gxu<6&e8DD!r|@J(Tu|##3O(=_Y_V3s3#J zEyS2mVut~0K>0Gi#)gN`Iv^#Iq6l5-i1^?3JU9(`c3iII=o_O=|3ma;X)9!tL3;Ws~cD0{NqF#FM-Q#w9gH>WvuZY0#6Lng~= z-6VQnNHLMLV-UnYBU zlGcfU9?jea1dBK6au*&2adLdikiC__8O;|!AAA)v{jmlVWAW;^!EOXehvm!5S_j|! z*=Nh2dq(f+hnN{hGwW1YoAt{T0RDe*UXzmn@1gG^;<;(5pN=g*FAX-S&##kVhg&`8 zy8&Lox99leN%|zn>;-rU6Ghl`1Hx}r;^Pd-mnT78D>)mTCI_Ux9lM3kwhPh{7 zi>r7tfm;%WTtQk>60>Zp*Jp>SY0WN>F*G;HhO$F&1hebB0o2EK@; zdgPc>k1M$n9Ug8_;kr-9OMtOT!1tcx1!){xppa-^#uL?e&)7MjAIYU~ceQ|Pf9mDG zmf6v@1Y3&FtN*~4p#b_qi?6PZ+P{hQtGItxushtW9i{s}Z1lpa%Y&Rv%%^BacRfk# z1_Ck%OE|j58G~;gVBM$5f{pI4@85+US}(lxBnU*Xo~Z4xvaAxKlk(bu>}JG$wG4Kx zXB9youugvKM+p#{(i503@ycia+Ti;{J z(HrOcmjiEoo35{~hDD=|{xVIz^1iN++9p1JE~zJ%=4Z z4H2TFy8l8~4R2v833uki$$ho13?)nPf0?0qU`#o?Kx!Vp%p(``mbk|wSkO-viyG+nG`=j=_^wnw&ux>ifVSV1%(g( zb&huKrt6Y4m+GAj83eqm;?8J;e6OLak?}!3(u&1)+hno-V*7uYDNAWCQvR0Gm9YMV zeZ7VQ4-VM=NXZPnrLC4DErneDy=q%WA}llR)sP#2@P2OdHoyfHGzX z1G)~joeTAg8Fv;(LS{a_4rQf}w1HBsH~-6xUE(V`h5FK7ZMb?Qsj*MRf(5GO-*F{=g)Mh`!Tb4xJEi=+< ztWRN_)sz3pli{qrE4B8Xw+GWqqnb>k2o7N^YZbeRQv)o*=m)+{Mx95;;9J5-yFGu6 zU)TC+UiynWH`9VWYl1OTmZ=>fi*;M`r;*gqR>Jrh2NK=V8BYb(b==Z>+E#hv2kUI4U~5&)!kZ59DO@5 zaTsm!Uj*RlDa?&i80iZ(GBlh}?Hf~JIqQvckl&w-58bksx%8vs==yxE3!OE*C`f9R zwOz3Tg-Hxt2sBZ6Cd+I6BXVtEu)Lmj5wh}xFwwfD6g|UT5`4`Rc|`8ORCy0`Dw<$Z zyZ*ot=bB_@ooSTaU|XY+vp~puIcfKIfhH7~BhxCfpV=2dF*93KE#69LS`{D;>6L<_ zDUGH=_p+{0-rk|?M;A6WD3doo6fA8+H3rl}G`i+X7h7nuvP*5a`XgqZ(68IO(TT36<2cxvIZ z!|_6~59}ht zO?H+9cpeR`^@>62xKd5*lqw7f3gOHyg%y~kq1KxsN4nPMw_bV#D%BV$MkW0hL5^-} ziL<_Tig~1?!F;b*$n{s48Rj05mU&M~vSa1w@~w?+G5`8Qt(^3;a>>)u`V{9|Qn0n# zCl15H99*h~(UAJjxi3#=o=n-g2XBb$e38| z`Sh{%hFZ4H|L}MO!sQ#vq=zD}y=?vc@%tkOffsiIlm&8~U!OQ8am&4qp}PS^CuI1M zMF!rY8;ub>Q3P&rYZ10Vb^F?Hl%6-mkm0&&|AxRTQSIA}_3B|ISq=R4+h(64nMvqO z<6-dc$>qLsZwd61M9OLZ_pfQigAh(nAhB>G!|iFZk;AhRJfNGwlZ!9V(=x)pmfzZ}8!;)g*9T?hKO)bfX0)OOTxA91hLkm8sCDZ# z4`zZWR0RjY$_1msLEgQQo6Jwsk_$A8=}zgmvu+ou#TbtOP>7Ad2pS$;8Czx1p>CRC zo*DGv#v`C6m(*=~@M=xx!p8;1cRPP?qMM}4g=cS^PFw3B=WBOGNH9M?m?)MqoSU`uNqdt}S( zmE%)bf45qmJ7o5=^UP1xwN|y~#;>7JE5DqDE(pCGL5xP7Lm>QW8v{KyakUb!3B?-n z`<9Vyliu^0@wUk`CbiSMcSiPHjtl+q_M7k~FLl4*8k(BcTRHt_{Cy$_iwgCdZahEJ z#8c*j=)>{7u0AKVyvx;MV(i_q=BgjTq(Jes(puh0b}Jk^)$*$ubv4+h_DbcTCP@D0 z{P`+CUYl;+K5fp5AtYP_!@GpwL6rL8xp%((&4x$+ZC`^h4=$LIZ{P7zH8(oacb@CP z)-2=jkL3uhokriy+Iw8i-wZr$o_tCI4gz|`P*ZT2zgTLMXtomrWb@0ZxR9~va=pp<$4Z%#5jc?FD4??c$bDw>4 zsY|YRX~U_^@BldtXzlE3@RwnJ#Ed0c%37A4owpDQF9{tkJtL0L;9j;~-J%hw|11L0 zyDa8xgjz~Atg)d#$Db8PRQ_rQ)r8j4{_Ln}?BJI!KO?x%Utaw-stDQh<>h8(lk}HY z-E7uL8G`@+N0+zhM6y-%OzG62c&)Wy1@^M; zm;0COh&F-?(qJ&tJLL7I=VyPAOa^N)>cvdDySubXL;2yIW;f0Uxe$o=vulp56R9eCpSjD`3r>yL?5RI2gY z-8=)t-g9Vi_Tra^cH>plfR3+tbNfvo%3mMa-Qx-nSH5tg+m2r!ozkNwXKx|o^;6+S zZ`$sWk_9SOe)S zIVpwJ9J%lpgJsU%%X6RJV!A3v8fl|zr^4A?9PPlPqYx}Ay_=9zHL86$Qy8fd31;pL zD>5XWxzASv>j!>Bsdmlh!rz+3B2>Efi;u@0$J1>*%8`Sjd$Op?|(er5ru8 zbi<=#cUIPoqi^|s z)p?}}V&zhv?5D~sDlHo@4^E(gsZo(_I`=XC>;@=(!Crq6NvT#)biA$}` ztD4$GM;w(is?SWgxi-ifp42m(OA{1uA-Z0H6$UxDDuhhU*^j?G7LKb#^H3vnxX^>- zokjevy)t-mbE1*2DsKY@)5zMG*w!i)@}-rA;|K@)e*JXG_}e_+-W*$H2*OS^Eb+qy zrje>{-FM4Q;tov5VvP&o{&|-51skQ%?dVU{ALRKgC2Wyr@_jQMPno`U++L2|O_)i} z?!1JSui98429`kZi~7)7^O8H0>vBzGB{+Vs7NZI(n>22NsIbG_5|ovwj2{OS3bgRWwUHy22SL$G>iQ9cuff0 z=lnkG`{gvY7uB+k1@;Ph&{=$oB8lPolx@mzWS-4$nl_kM%DPa#u#y{moZ*MNb z4A3x8rzS&dYiJ)~2F%Gjl$ck5Fi&fV&~g1#HSg{<+kg*;oLSJ|8CVoWAM$#m7rJew zCZ_#vHZbz(mN+00O@ria#TyJ3#ZQ(W#)5M5)C|%2*v^*pa0#}CjS9a7CD5{AC3e@e zY#3~UA%ocHk&2EK53MVg!!<&=(Az7Mg@-^6=4D^cS$8%&8nc@so+C#TFH;XEyvCXe zK-E6=PmHo@+`7S<+vOMfO6LjoP9l}8A(~Ncu2Sb2&YHQKFyoINP9ISWoqJ?~iOtHC zHO(LKRjN5X!(d>1RW*z>Aa0h+i?G@^DO%pk&$02weZSt6q7T)+Tw}LsQ_OhH>CMq1 zy(>TB3&eb?)r=*Kq`1&sc0dcRW5#@lbFahKr{<30tm>H~0%4ko5id!a%1$-{)CmpG zk=dGI6Y=f`v$kjjA=$!3We7;Xaj{B{ZD|+x9(v@=Q03bo;KLSd8h(3Fk;sFjVQM~xs=8N%A2#7FPu+YDT$wZzNc!l%OO&cJOwhd#gsRpT1! zgNPw%O*8EucGSkj%wt%h!1jj0^g*m?o=922Z0{-YQ@FEXq>(pQuZjKccU>IWx@#F^ zH%}7P!i{EcaV#1;4`Bg$8>3(rR9^bH7Jc@)Z?Oy!6PQDdc&P@-U+~?0ijq*d!MetU z9*aR-h9#-mP0*YNjwQn~^hdqOHu+nj@BSE-wheH$wA6BMqGCqF#`Q2M#g*uBhrGu1 zh;;5@bhn#_uy&`pK>SQx?SdW*g=jjqTh2@j8BrByE)cmbi>f4z`AobLB(P%Z{U|=Q zP0r{xVZ=$8&&;#@MLp5q1Bi1?P>10NUqf+Z#942cSWy9CY!&G6e7WoKLA?5A1woR$ zG7e6gfl=D?ez~Nea6-b<9jhkh$|!UrZKC=^t=76r&yzmPvebx0Fyqv;Aa^LWV}i|{ zU4ip&x6A6aecSg{*e08t%R;u=FqQmiiNtadq<&~LNOh2GX-8o*HP$@@~vr|W!`K(aMYaYsc)acGT zGEpHRyzMkdRU%?WQWTbAe2b;vBk8nz(QzGh`^`x!dR|9S0*5)hy9}opg3EGDiQPIUZtDsI{fy!Fw(7m` zy^f37FK#J?H6@i5s6jHA%>@L7pKMCkS!I#8InEV^>>idv99FvBQ}ANCmA`jJsGxPm zAwE4p-<@3H&>iym)i;ZwT%HTv;u%kvs}af6kNnhyrcljIHAgc~@asD)c5SF}1sBV4 zJ@(v8{qd<5X-sLoF2;8n>ECmAQZKpiHt&JbenqdoSzpY&|8TlK%4c>apSInm%6CP( zVMC2ypRy92TyVm)aQJaVVxW9SfHmV`$#&E?c)MRwS-%Y=971Auxmm05 zd*%-E>QfZ2I#}?iQhdZ$TTiQ^q@cupBPIR^+B{adm4?FyAkouOM6<8r5*W4_8dE(P zS5`oS3g-{zc#Dv{4lVa9%>xST$XYM;v!59E2mYbDNrWuKRkJjq5Es` zdk#2tB)*+#K!z;r!2k#{Y82&Xs>ULqBx-19%}s_Nw|&$!5jf=Pk*P6>Z5dumhbm$E ze0NJc*jpz)6GMa-WGyP}r}6E`UG^50Kv85V;u|%1Pdao5cEwg6%pEZ&SgPKh%fOHt z7+DjH8Dy#BB9DWnt-E)Hf_m&j$g7k6y zP-z>j27uOV=2xl;9>_!#2RL_h5*d^gg-fw`bJmDK{FQJM-omf;L@KlS-b8orR*N^x z#+FGolOIw(&mxrcI2;#{LTwJj{nCe>b2ZRnbv&nc)mF13;8D+VRd{MLhYf+gf5MGc zkf~o?!N=hQc6ZN?DUGi{;(x!ME14}2uT`NI zq8ZW(M?7D@{>_>j6bvV%mL~BGrubi{k10ijZd0S-W%}sC(IFaMS@sl=2_NwV%(Z-t zH(MIv1c!L_v-vKSW)2TEtth8!Ju^MJd{qyjQNFgDYFsGK4RWygXwhtJd47}gnxX~1 zajCaVBO;w55qKmdv;6z5^m=89|1`*qO1IXB4dbD?{X)%&9M$=Ay9>JrwpHjORC z(edp08E1&FJ%6vc#B|~MdqwpTiaLO+1OTWn3dTPV6b83Xy zj-P$H#5nS~q_0Pf{p993QmHy{1@wVVg=o4Crq8TOp_s)f>h9iP9>LLU%L7|x#qith z;UACbjp`yYE-t!~4Xp#$TxO{Kr<8*>5>$aCR=h66LtJprx4L!L6nyQ!xM88hZ2{Wf@E5~?&uXtkBm5jmToLU~5q+^7i>sn?>Ek;lqN4zVu~8l=g3TQYAsf|m+z z+-VgRkz$~!Y1cir`T?D(i-<^q3i^Ts_HZt=h{~NSXjrNy+IOHoeXXE&QPwuIoO)J$ zCXoQ1Morn|gkIsL-Nc06wJbLm-m4ULab{zvw_`^rRXQ>GjdXCOAEZVrQbXJBS)kBh*`G(qpi6!|Pf zrt6oUoU%mqSd2I*a)nY=>QWmPlpwsLkTI+L@u6)N(ccP7`>v81_!2lwSGL7E#*`M% zAwEo+p<5VJ)cVaqk!UNo+T3I7#Mnu2Mi8vVdQDNEX8U$|$e4d0Gms1ISwnVk9bg2H zgp7vI1W)20bOrHJbHWKiajeb$(TW9sapVXfrZ{gfdK2HO!#sk`>y{=8w14OK^++RO zM)D=AH$;0&OJ=#IeK53r?-`bzuwZrXtE@*30Tv zqgxW=e~<5Nk(=B**Qwo{o~t*?Ca~Ce&9fF(aNkyYxWv2{Nys?@JEMBe5p9Fn*7CUo99B?b@pTO z=@(YUl=v??;CljTl?UDPMtnDh)fX(2h{;e%<*=lg(gUROq+u`elXI1$SN~P72_+R+ z&~JGzvW%j(7bWn*WuXSZCa(ZKv8PZ!gw?n0{TuLciI5C#w4-OH&?m6rdv&ip020I; zc)jearR0&K=3tsYALLQ^M_t&^M%h9NMgIyGL@5G1YJ3>*$eh?+cWlKGxve944B7>4 zQJgAHB9azMP*}>hg{3Uby&^i=_cO+-bb41b-iax$ub)ePq`f*dzSw+0&k}D39Fl-K zMi2}U;^`6yrrrpD12kvSC{Ux^0eVBL-x@n>SA8~QTZ*LHQb*b=03#Nwp57uMsbYgT7Pe&lL1NMEh z__))m|G_n`W~mlc4_~oc28KxX znrF%=Gn2T84>%^PKGlDC#z#hOF{4KPpTb!zHApN!Q)@QGD*Dk=Ke4zM()O3CZu?F* zCPv|PyLOZ7k8wR@6gAeK;(CGD3jO$E-XX-BfSb(al4z)WMJ{rCgISV`$gHhRb}XC- z8X;Fu3*V*L0uQ{}f0Ru0ymS~lO0I4Q3K+8)P50-PT{NlH{)fxWn>%q*NkT+ydK67g z2*zA$BOQ`L1^Ij80&CY##^TSirv6A4glDjBEZ0j|TV2Vh@aT5bDFH!0_h>t3p6j_- zdiFOD&jiY+zZi1kvV!}$ElpKBSpTqH#=5KaVdUl7ufAw7)~rCDO}&flSK=n zOWckVRK*v$1>6KN%Zwdw`1BLtpGX>hTVtFMu4YTkctX?Lb-x`Q{qEBBzmEp^Mg8>u z8-r1&HdCWiM}u?KybZfJqpEZ!Oih5;viPdIIM`!vKsG@rnOFFH+)>Z%+;5RgE_Bi2 zuphkzljvNUqbS&i_n?$1u4xm_%7{*dQkWi;-50_NA(VsHZBY{wO9#mB?o~g7XLp zH7&G&)s@i#-^%Tb@Px?hT=+N^{2;F{#q*=PfjoO28rHo64vw?5Mo{uGNwSMPYVKl0 z_kdEM@7JGCvc@`pghb`@Ygy>z!`ZxGH_HC}AoKDWGjf0|pSb|XrJuqJO=7u?Or&B5c@ ztKcXj^p=ecA7@UkseByZZsEW{!n3WCTDYG zeVUml$}$iytCIlsrsw9Q*;IwTyiLW)kj5#T736bC%Lg`F+>|>Uoe`p|aC^=s9A}2E zKMS#Gn27bUnbeF&WhlLdEPV0?3vN*3Gt;DR8XmS2U;XYozqV^|2_D!E04owN^q#d^ zG|FebPNm>4wZuS}a9bkPqhXlHi{Z_3A1&0bWW5Ex{j^pC_hi!yyP|fKQqRzwTk|IA z`<~v2melWe2`9W5Ne)g0KOd{DX2y-qC_}Jw@CNdrl=amudyg9VMS0Hs7lrZot~V_? zf=FaU&9aj!q@K0l>724Z(mGZf+4{?x%P7Qbac{a z;RVn7TkiY*{hkav2#zCQ#z?|$w4-!W_pW4pbs(t0-a21)Jvzzi$WHH|?S2j?D3vHJ zaH?+Koi6~})YxmtHNx3y0y;6pUW6nEYxg$iCDVK7E_OyE(S~2J(9;S)`_NfqyiW(=!dYoJqdg%_8JqO z&yf(bmvaLK)tY!Jk(SJGXq;~D6FVaYZcIj}rk^h9N_(OSd!cK|l;+MkEl{G31Vz=l zYoew`rBD%r@pO?yq@rep?eJ`6`&1lMqEIGlce+r^vNf1|C4e@m@_mC56Iz@Y1rL>u zG>a5$o0O60FKf3#4(m$V5iF&3z9Y0Sjtc|c)AE#-26ejyB-LXz#0&jv5@}q)g5Y3@ z=bafk3zuV~0woMR%|NN}bV$c=)nATXGFXH(fnLWmM2=`I!vmLZI2h+onf>MR23VD_ z7OgjO!hD(lAef4i!Nwo6a|zp*+D%Eej-LG1_+ey-F@ctE>fw%j=07f6GSO&As$9K)tSD7 zexWBJLV&u)H*;tDzb$Z6W(CGq+f6n`hXE`x`PEE}|4M+ahm{(&DXw4cmDsi4bgfmE zErIxDa67sCZ1bN4Le?`E#dKAX?~pmf-I!Osx4Us%l5#i^1jN~-vg=p72=c}G6%vu` z(1|Q2U;;pE#wzt!?Fq}Ja)$m=eFogvb7c8*$8Fi=aj7sEUfesK+OGC8ibXaR?;W~s zZ%SP&jr`P<%e&ioqGxKksv4vn6T-YfX|jO3Lf)2}A;3qlnpN}9M{Uj&Dj4^=! z%O%6PFI@>*{}ym3CgzLehcmg2VRdMqP-|>A3w|~{?pap7r|P@s+&vTJrkqIb(?-Do zvU#sNp%5T((_0dW!@PsK!9xv`(mAaANX1^zCG z0ab)CciE@^)XQJ0z~vFviMb}SnFNRg`Z`HMZ82;}FR`k>YI|R9%lty3d)aMQui>Ha zd>>&Uv2_ZlP$UMNR^kF<@NkpU@(s0h&FW}fYP<4EJakB|S)3MJM#ziI=LJ*GYAegQ zNi_Ki!?pX((x()+Ep=_lk*e}I&&W?#r*&so7hhD_W|xO)A5bYvLM9Ze+w#qF+TVR? zeVOY1@lr}rSc&A;);P19basq(d+$dlQE!hILe+Jp{Z-^tVZYK=bqy2;n-%(%I&Tf% zkiNT@-`}W^)h|IXgl4Ol=eHQ`RG57|QED!!S=K0W%i+9f%V0g;;m0j*Jxw<8qn^c( zP=v3;2qha;TXLj1N@jvp#!RXEd;ypH8zm-x)}bhAR`Xk32*uE4u)Jjw-W2hf@kdx(;`px$`jtI5+I8o2b*Gn zGs_n+tmSlN1fRbZnl4ydg2pa%0F@3=3S3^Ba#Sis5k2N<7uvifKb}SNa3&;WJ2zqm zFKM%23&jfDG76oqw370@q74hWE8(vW?jEF)YMUPH*q-TS2H&5uFhG?!PXqIS)bPv(*wIH> zkV`?~P-i>&OhVH03(^X+7u^88XzWV`kPZABEvQTb^;NOHJXaZwq8gqs|RT zwN>8GK#-odOeP$kPg>dbcAUGPxizwxR4TU1Fz@rDf3@E)5a-OX zHOvQJdh@rZJFMKmxaOAxX7Js*bZ5n@3}j|!W1g82OJdtVJBZq4*4A!zi+ORIcN-;z zhz>F~9Z7*7e&qTy!q^dR^5|6p8aEp4Iocn)-RK5|eKNHnY67R$^lc&)M0L!`c^yD{5(BAcN-|kCN8y>TV$Ycq7q6A%b6AoJ*1PR; znJLl3Jm1CMVll<_O$?-vWfKN|_o5|sSsr2Hx~R{?`mL)gFte=L@>G)%r(Gk>U+b#d zA4Wivc*6Qvd0Rhxr)oHNcUTF4;d0AQrV1wv*bevm8SkGpLN==Xb@T`(hdY|n#$~A= z&f=D};Je`Y{lV64ZJM>&C*!r==sA2ntp)hSCJE`TG;7XG?NL~;$vi0FW^F( z1rk4f+>}tDP_9x-Yv))b;#?{WKynv}RgE>CmXrUJ#b1$@>3T2*g*oo6J7v5BpV0kk zY+DJX*8Sto$X%fGo0REI#$@5y}=-R<6kn3;kwCHXI ze&YbvZWQJCZPv->vZVY2X{B^ezaX+p)v{QF@DK_xzUB2ucgWEa{5jpq8foqmglB%K z5y?i?o}*;VUyzUh(^SUMJZDcK-kkj2c=3pni?TU6V(Pces?T$5PDYsKZ#Ib?NkoCU zdQp9}kisP$VzI%GQQF}g?jd83ktPnYG}OvCk1##fr`}D@ zD~BZ2d@jb*RO`(`380gd>5?~d{j#|ild4D@V80=Ev}kyvS=;3JqKABC5Ds7IzSNH< zki_ZZL_>Q#mry*ru9(Ozq?KxqH*NnmqY%a#bm*I?$(SYY^ma4FSI~> zP#6ct>VYeK>H0~6HsJ&Z*v^dE8vFbf=c)|7z#{UV`Qm5eQ+^`l_K}MXy<$PTe`Sx- z6zh+6AB-8Kmg8I9y{Om`Y`;`upI%Fw^U9jjOw!Wi(H=-zZ2Acpo_qI04QinO^c=0@f0rg^<+63Za16s(w8;F) z@1i7-fc{yFbNR;Q55ltdHA&!umlYo}-QSCpL09Pwz|{P%6Z=rcyL0o0eD_0nknh?* z7Yka#uJ)<18V`BLYfu;w#BV;4_(9HmEYgImaV_j8+rnMlgE+31I zi1rThXAfhfXz_U-MDqz1sRuN0uTiwh5Q`=0<$0t}StI)@09Wc|FXx0m^dH*~EJmi*#Q zZy+{Im_84jd6sEd^0V`Z<5uK4kT-*%!?qJ6+t5q=uy9_n(n9E}eO6vI$@4Q@{E8d^sNHsz{}hxRy|LEf0o@ld z#AuoM45`~57ALL@jM3h2g~A{I;5%?-nNFqdaTZfHmRUZ~0Ud;Id^5B86SAG-VgU+enj*Ze%Dk^r^PR1 zp$S2Fr6YYu)S1|Dz+V`H-`o5My@cBMx?EjMQR6f@I{+ zy=yb6%Kj>M7)-3Av)H9|W}n&7{p4s>6vktf9ycdDRPcxxD2V91=C)P9odWC_3gB!Y z;|9D!eW9$M0v=#UB9X+3jB}XcJ{jsbibmato4c6?1;Uv4!6m+(V+|gY`}q`tc8b?c zkQ3gOgXtBjSq>(CEq^8i_|jIU*uV?CB0-H<%)92$hdCdrmNbKkQir_Wz70hzC5vQoyR^+kR z_)MQ=^MRBzl7@}TNUQjFrfxbfbZGiV{J!NkzvHj;^CfauAG)^95itZY*MAGtf(x`q zrP<)6}@6pEk(#)A?B6fGP zfL@yUM8Y+3^9;9d2%!$5_YDZ!t$+H4Qj=xV1|F^{Eo9HMTf`xY0sUA$lOA53E$h^2 zKQjv7w<@hSb!enj?4?qwwnY?+5usrj>v3g3=5SjRzAfHC^8C8TThwuq4E{34!}1Yd z$g=ryWM_o1kB#2ma6f>``$3!3y@cg;6>pl$i9mJE#Jp0QER3DseMSdas|Jt22xIN8 zyqpl3pp?$G3l`)%m0pbrbC;+=3P|7dm{a!F+UC16Yz)$hawyB^Y7vaa#6%V!5w1O{ zDshW>b?7#$qDRp1%Vo5~2g~ULG$K~ae{Afmwuk)I!>!&7!KI>5$aNj@-Ykn8O!A6W z9m}Bra8A7*gt6xi5T(CO#Ka!0Q{0q8gF@uU$TKZcjDCmz(Yz?PkR1HVoiG@OSGdAi z9BnPi4*w55VPT4Jmt#329n!=`#{9f0<7EzknlzLEa}Qsr{?+WRYQXu8%S49+gBB$K zcDn10PqQFNpEkCXLHEpp#VM`v?F1!yOG5xMv&psn2t%m(%AM#UY`n4~b==uCoQ4h$ zg^;1Q=p^h})5y7tL#Ojy#2yHb$P<^SCW^h-1>0&vPM@H;fRC#hbP(ww7y{PiMEqLx-N5A>vpVP zGg+%1Z1nP-51{vT@NaA)Joj0+-E?}eQ4tfea63o0B#x4{3j`r^QDE1g!w#)z&c2lw zP)+pC9PVCOgWc8oxes1VP#2ls16`mrgVy1~hZV_~K7KDV_Z|q($V!J>@c1SKpu^|Y zRO-SR*N)bEEb)}XeTB$r*$53kpPuO64pS6D+qU6fcRGAAlJMm%*TW@w<@?FPWH?H} zBdCAro5@JvwmwL4_HBD$c77DG=PGpThF0L0_!pOa5)_ULPieEqpX?;OTtTq16#HBV z8u|@8q1YHoT`jrb(m(aUMs@jVyoOn}>_r1YPU^udS{IZ25^?T^UXbAm6P{{^9158D zWI1W1v&xU3*I(sS$Szhj(Th@re(f{0!A-GT)jjv==Tr-F$Su(K!M!xErQ#NaDlGFW zGU+|hlBaXuDm3> zJ;-k^hT&z862~4Ux;NM$Usi0&JNUU2$P(;Y(b`$~rY z5KpM9L2ci$gC&i%&90A7QtPbScrPzpU(8CNg}L2-z()V@IzekkV8!Tuvdpk)QZtr> z`t&WeaIVMu=9*qk}0xiqV7o0wmdb&_21I$Ueo zp^*yd(Yqn5ror{$6hfoj?2D<36{8`H+Hs2%ZIPHxjooo-q9!JU{$n8(BlZa&mF03# zh3SU{MkK8XRW!42p)LC&btA^&^Z41M0dyFe83<0};=CU)9!TX|%HqPHj500y2Q6NV z2m$CFL#}Y03fLLB>!Li~czq>x1@;zeEY;N&+=yln->ZKO=1o3@$Qtrn8rlR6)PQO* zU2IDsr}YZUxg~6nr`tzYupcXC?Q3~bkNeOqdK-f7$v1TQ>V1nY^eC{=^u8>FPf4E4 zhnBL`k3)hNt8||^+#$zX?rfGc_;*kK#ocC=zjb7HZHh>Z8J6@T`rqw#&ym|v?bm`> z0(hl>h13VOK+JYHLl@~3@kUIhf$wX53xF1_f2)FrqeOqRCL?P6IDPrNwO%P7$l`Yp zmTrpCtkF-73=!~kwhdot>$0#2i^{a0HZA<*qB7g657?`0~*0I1%Q zn`4-_2`v(1nO>u7>JZC(gEh0a^7whWrsS2x;$tnd4g3rDW?3Pq6RU|dQ&LjWxn@9O zO{27^V}nCe7W!WPHrIlBm+>90cKRoKEvFi0-KzvD3J=}LS2~HBP4(1q}TC?Z*)NLH4d-h2aCt4BYyG5vNaYYX)0` zTQ{cl=)QcYI}ktNyMk(W|5YHAutm6oGc(|PY{@5LktgQda-!W)oR5RbFSCb4#P~_K zZ!FW%>TSIbJP=rbJJJ2Fs%IFyJH|7bIJ8`h*sDEMYh`WXne{D-e<_1Zi9TxI;1fWT zeRB*qQr%qBfu*t}QG0+oh*wkk#Ux%FtjBgu0)-Ajz7~Zk)*v`aKxv%c` zJC5crOX3UniV+bn!40Pk`6gg)UJ@g!Dn^q)m;Xl%R+O5jQ|$IPYWh?xc}kKuI<#1c z{hm_#ED%Q9qs5Vz69b6SzZ=+j9j<<)C$hH#0caqa_m!`*yp9yRdm;eWF8U=Be=-QS zVlC11sBkOluo1~1nSilT5s8W@=8Q|;ei#fZh$cGN+;3t!Tmn}sV}Hl*ixprDx<0Su z-*xp2tL74aG>1uCrX%@RsBp)dovpjr4>end(eWCwkzQ57Y3csF_2dhp%Huntg$l_jo8vk$UW)-#}59?8Q-%dNBE{mX6 zWS@Q%$4?)>`9+Gs6>)s%YXOxoH+J!dUVf&JO~DddN_Z$enfJQi8aHvFegZtMd$ts6 z;-`!@-anuRTujK>#iE_xYICbLslu{cMwAvZ8{t_35D$CAdE9bK7;W%|yR`>63xN_D zEcI2B-4LJtO|W=xUGgAa>!cNRHff9*^tisQbxXqcO}t(mKP;Yu=yTbZ)vU@m6Jkor z*Y4r-x2C-9?g~3hb^RC zz29>;D9HEBX|1|TbNa8AK@Ybn&9*XK?TATkn48>rd` zk9*T+L+u-s6ht1hD`EW#UqKe)o3rGB7JN1jMWn_7gCubJYicbUs>G)4zpRSKkn0@b z@iny|d0)5wLqH1t>Rzy0w%ARpH3eCa@7#Uf8b(Zxv{=K=_e+KyQe>9Me;eQ1#@?Umn-S5WU*Lc0ioB+^+ zLFOBBR!G0oT-h+{kX#eobS7{%h0V4$1xnLgpmWG#W)~d`S`8$~jo>+?S^l_a#VY_D-C?`MOnufHXvKdR73(N1c-70q4uS$A zx#-ty`$I4oa4%yEZ+4HDsayzpX5@q&6+lhkcg#x?eZSL|`|Fq+`Y$Zsnc&#A^OPyO#uUy;XQq$jp zu2ThF)-9wl+w3`0A|ceiEF<+55ayJlZYK$GRM(N}gr4Tcvz}#N z9VlGZc-FqGCzU8lMP4`P7rf%2ys-sKbo&dYKs^{_Nf2$WVOtLsfgHkIZC9pF9TGiM zcrp`K^1>NJ@buWXX@ekVe;K*~Y<|qp-+;kK@Ad$c#zRiO!tho# zuFMLoI(~=4^nZ6#K7aZ*VQvu&gK91dHeLM0>^y6cgFQj?to1+yb<(o zi+c=0(b>ocMHc#Zw_{#CjN+W&+%hX+i93ixZlIGzqR^~@Y5^`#Y;#Dqm0nzV=v4bMnU41`{ZmYZeT2WbyW~~bNHF>HkSS{aNcKzHSBC} zdUj{bPm30PYUlgS?qk?1!dNQ$h4b?;;4?Hv9D(5%WN(q!T1P7>DkDWnGx(KFY?^O|CEBk@M$e=c53{ z5*155ps#=ytGM6$gxI}S{W21?$8ez!HlVD)JGyinW zK>67w@1u2|uARgH^9;}u1n=W$$oCWW!2NlXPJUHDqJE8aQ4YXwzqVG_@6Q_RL=R{$ z9`OX%;v5LIpk4|ZFoKx%DxZ2ZMme-Z` z$)3sL04vaZFVHxaR+Aq|?n6t)&`=H&(T+(Xq1B|+d!YUn%|x}ARmrlvFz|ckSf#-Y zRl5Au@m{X48jmi)m&KXy+#oA&20f6+-%~qtuK)C3n&&)?ZEwp9V4>H17I7jt+}3dP z)Bk3nz_YL&x+O@ zC~OT7-2L~@8w+i*>pHzFmCN^T0F5(dgjjy|eW!>+7M~mJ)%){vDRg4f8mIhgxMPyv zTXal<{t<@>xD~WoHnR11b?n~D*O2Yi>rO#>e{TfxJ9GN~yQwVtf2NJhoc<&2p}ji? U9=~ugY>w|9zi(>4{_dy$4z{6x-2eap literal 0 HcmV?d00001 diff --git a/images/img_2.png b/images/img_2.png new file mode 100644 index 0000000000000000000000000000000000000000..ddea96aefa396bde4779dd4a120d046f73ddbdf3 GIT binary patch literal 36668 zcmb@u2UJsA^EZrg1uqKNuu#P=2wWxf5(H6EX$pp(i%9Phia-((0R;mn0s=y4(jg!{ zKw<+Fqy`8*Lg*!-2NIHe2Q2qK@AF^p_kJa=#X6pxv&-z+GxPh+>^w8jyT;2S$iuhnM#)<>%t2=po%BBgLmxNZ)+{S?*Pwk@mDXNJkUEXp2l(G(Sz2SCbMzl z!B_*nbF<5UNEibCl|J_&Q7QUt0&+u!-Ew+dziqR;0i?NG z{K>xGe?aq_cN9N_HSGBJ&3&Dln&e0SJhXLX=pg)`H%{@OIDa>@{neE;PmTX*Jo+4n z?>}zrI}q}}^rV^Iu6X=k`GSh=jQ z^Wea5YqpTSVZr5p3E6S)c_UzWnR#q^A~|Np4|HYbt!JvZSMcf)PV$|*@^-eTE}Ma2GtsUoEQZ~H?@$Vy+j8Rtxx@LRw;szS zQP-WOmo2#bN^88)VzOvx$P&-2bP%Dj8iUBE6DQtQXsk*}5_bCrk;&J{uI?wYj#HhWzrEaK)Ro^ft4I43zZKJQ?)-f~h^M-dNz02m%A&mc z1-T!7Dd_WZI<$VX(#028k6s%~cY?iF%lN*c2v^9JnlBA0|6b+izgs%_cJp})~dpdjXeDQZK(E%21k{kn56+8jr zTZ(pseyg~*hE!j=GOD(BQ-BNF!oW7v_JjD=#4bcxmD(}01To7A@-}gn!C-+y?QW|dyYz9warbHDg)%)kwYWkP@?jZE$2M=<&^VRAl_zyp3`$hK`^P6J zPLT+rc_nI1`;)SWBCM*R~XiA(AV}^l%I0;y@dlfM(x= zoLd(<*C@oDD5}qhv^*fhEx~fehA)iZK4(bsZ(`xF)1RyUL|xsgV#DP;Kq|< zT1PkX#REN&lN7Zz3y9`awIB~mu8`ycDNl*X&KRu|q#i1P}KYf zmS1Ev4lG~Ry4t(EZlG-~``uupW2$L)J#;bEMnHNN^SsySU3W^DmeBrxtkP|l|3P1$ z^9-Q%65K*y&=nfw@HypK+$^`4_A(d0h-sncU+y11IvILe5I!}0NIxy zl|ySH_VeDW=W|&}&5M0TOUY7VZD^>)G?vzT5B11pV|A}!t?ZlFbLhs5ij4=YTr|K` z^Iz~6Mnevvf+Znt*vMr0zRPW^8aS6%Qq5s45GeS{})Lj;hFR)Io99AE7aM!vy41R-gjwa&6GJsdkU> z&)x}gvsk-346ZhPB~bk8zdFsXE#H>oD|1IA6d(JZv`a`nw%?0w6(h*4j#Vnf)BpaQ z3*z#Iv}xebNpS!cuhH(k>iu%;%#W+FsBcFrp}44(X&o8=CstyZ2s ztQOfunEmK2*D!Y5eZHrzD-Qauz@Pm6OUF%l=CpmOjl9Et8o}?Wt_%v6C z)8qB|vvPc}kSA{HYW6IJ3UFe!c;rX2_HQlJ%(JH-aV{vXs)pgs>+IqOe7~E3s3`e^ z4#J?nALLf{RCs!v)xCIkxl@kMja0PJ?@6Xj6dI&7FD{~jE8N|401VhG(ku>IodwNZ(}tfr74^xlXpXSlzNf5E&Xt_SlG553C!bXqo_@@$_x zUzT2yV;fUoub|n~Vs=Wzn(s*ZTY1on6yKTtp|}nKPQ(y4Dp+u@e=U46#i@D5>FK)K z$yZVStNEU9{t?&pRR_g%Hsfz(r7hz!t$Pr4H&tf9+_>2c_aM7wl5{jLM?B_co!me} zQ0S#jvVf#y!PBCLQs#vZ!lEp~tukyk`_=`;ud-KB!TAvPYU`6tE+UDntFz^XhJj;K zmuL$aH(juyJ39U4Ky~Rv)s2-0Nu+V+0pBx?0e=ADgqM4S^jz|;?^Yw1$;uqz!`ZW|aJFI<*$jsUt*ohEG)`*hR zT`s%zL6AF)&+>uHrtMqv+A%*x$+OxGBH!}&kFl1_+J`3DSah}$$s z`LH(@I4W%*54%9;hTf4TrkjG1cub{vmBURGQSM53o{qVf1|%!g2r0M?_;0TH(}wJ#x;?IYm1yzmtdcAu^|4!VlyK=o%bM8!Wf((9o^L`b zM>$1srw)zM&49Ef<5QOWG6QrgUPfN4nC`MobY7h~3PDtzNIdK=d@eEDmZwuu(c^o1 z0EG(nm{myOu^%r0v=|EcH@fLOdMR*BlQwk_-P`?#HR11h`Xyf~a>a*~b1r3}pZ**( z@Kz}9+<9KpPXzT%Fn-3Vq~Sd&Ta7Vky=KAIEx+aZ63`%GLy%k6g-W-fXNjES0+#Z0>c+i|v% z+nzv&sMuRv;*^pop0K9iBAm01nIyq|yHhac$j+2}rQ;)uUnb=Gt}Bc7*?mw*8Y(%M zou|7;h&w#au?H2*o3z%m{y---bhGoHWfjkCH?6&&ACObeQR&Mr5!4M{6{1x!SnZ8c zIa(K0z*AFmsUW?3yKIY7uZ12mTfH zJS_`+SSH5>v%OsFn0jwhOmu2?%O$UgsZy?@OpVCpyaJ&TO)g#F(0zhnPxtca*&bto zkMIwwxt`y{$Q=n(+WhTjwaw}yR(T~ZRx#5l-0asF#-S77^ZqRBN>|SDvd2wGNm%f^8FRu{G6-7LJLc7~2 zXA;9IAp4_{4By{biQ!QI%9h z=VcHDx22Wtho^3EEh-%56XI@+w5*s!rel4o>g%P`Dd_B`ic%8v} z4%>8sz{(QLJEwlgaI-F?QR`COPZ=~d1ieuUXhEDiduuSBpnI_vE1VO^YkWwa&knBC zmV)n?C=_g-kR0%h>r>w=s{F1&)%MFmhdi`-Xqif@Vbe+M>V`|av1=kVy%nGC6C4aL zvLX_oJ+D*Ro+mBj&bupGCa8N=FeZ^q+m#eE+$L5|5QI6pmi!xTwx?d4ku{_QEw zmNDu>RCUp+Pbtny0NhNlia}+P4dV~Fk~LtQsI8#xL)YoQs&lBE-TVF&;=a+B!YTj6 zu*yY!83^Ef@ayB2a;P+HHv|a^>^UNXi9;n-cA3cE zn(j$9)@JOqN{-I+Ol1;R@Z|wSDQNW?71{tbz0&|qHrUJ1`{gd9Cz4X&IGCD$tIxH_ zzxv=PpD5PEwGYO~PfG;3E<{^a6wLIJ&(0P4eDlWt3GTWBILVbnms289 z*vuRu?gvb|E0Il}FDhGsDM}X7)eU%G6nhr?P2Z6GwoM!OQu>F0AoQ@?;FGWNmdzE2 z(jgK)Q__V6weoMtqJmA_+Tx2$MCz;{e{2E_Lm!sup$Q=G{t4f?!NLaIXIb|Tngc!Y zUWbj6)Paah-g5R&XiQX&XKLxvr|G`?Bcrz761d61Z#qXc&l{8f{?_|Up4t0sEWjM} z8FyAU;&$`=Z#B(y%-X#EHeltMe!;_3Nq&&ai|{3W@TGQMsh1)f&!Qg=w^k6z03_($+@e%coGk*?pj8gJ zYLFnywi<7$V;gC{w>y#7>C{xU+k0WkO;rgA=RS|!$C0NW%P4P!T;+}oJrI)FaDcXg zwkmVYc~2^BYxL><$St<^ZW>W-X&d0GM!>xm(G>#Se^PgCKD)J+Xi6JFymb~1tntV# zlpXGJVEAy?C~JP&9At>`_aoF;U0xL;^YNGdZa45Hy0cp*)HZtwZmWsBYyC?n8(rZ} zaSqst{1@rtBsX@->~Kcqe1!Tz5qqc$sW`VQGA2vXiM39S>HCel;x*UxO?=eCHaU)Fc5S%eicNrTTl1PkHk1|mP+{Sr z1)YDHIo)$iL0FN|BELOnBBD#RJ(k<)@Kg#n)_Q65w7K(zYl8B;hVHspr3W_AMr_xo zWP-_-HeP{DpR&x=A|L1fTH*OUqKtKe1BJv)CJ1ul)(agmwZjdp{D4DG7%yIlf4bVY zG~hE=F*)E%DVda5VAxu@56L_2p337ANcKjC>Yg?q>R(NA9q3QN-%f+wG!F9xz!d;0 zJn+(T68>uxcP+Vkl9nn=<&Q9_O=#A1|SnfB*1pfl5jBVGv#ustfCkl@9Mbc zym4RH0E_6#psRL0F}QQJWxr*8>i8Dr5+|l)S1W~Coi6R6cN=urPaun6wcRU*oZ4-W zA}a{F?)M&f5*>O|tIJ$2Gukav7;ozSZxM&?Mg^;$0z&ohYJW-uElPdyY(Pq`XX^S1 zOu8)b6XS4Zc&i@K+2|Y5OW@P$Ab&vSXCZFo8q4J^;)1I6uyB>+0+stCD!fbLsk5m- zISEl&DuvOk4Da`!YkN)f)DgVVsKD3tW}(BF7lE_Nw%I^OsaiMJC-EEvCp!^FKP@<* zVcL&LP||k;@nHo%I`2^nSFtX|r=%Fo#yidM1I{_0GbWyaLxGq-Jo1I$6`8uFP^k>K zdAWaG%O08~>X;hjqhA=%Fb5$IB4Toa^&@29-0cr~z|TIz{^UARnKAD&}9)p%P1mr5dxu2ZD%3ef|jQ zwJ6Bd#!G{fsMF>EFRyt2cCVsASs@G14I4S%&ARiO(Hj1!31Dk~&S+CY)P91~z-O^} z;w)u3p<(JULDZQsQg>lR$tmYFZ`~N?%3{k-xsxmYmI>+JQ;X}*(0!_M_f|HZG@h^J z=K8(Yc02YSdN*w5@^S{>vat?qsqOX7EJAUD*Kn=9L@)3wLy%F&h>c;82~DycNw%M| z4-ZZ6aE968S^3rvMwiLJqk8NhtuW_;Yo-hHqYflk96l?zw}_Tb!%SRWPy7qmjaZ$s zVN7c@WMlw6jd@br=QjZKgps&9_C3+Gs;&d-L{VDmKW zhxvt72OBnsfdYBVweI`vpyZ2~$#9Bxsv}k=xF>C=PnBAoOre(6pY>#+v&!aHjkk9N zBFBR$dr}{=n)XOhsn=33GURk=GVReif;6Z$l9ynV)DR?gS~{V0dZPlCrNPu zB~l1csHJokh9xPxX4UZ*LYHC2&nTY7Zd%VQJ&OZvyW39xv(#Vpc}(4<HK5f}(y zH?2${sS>4D(q&oaFB! zCGTSy$`YA3(@>2o#^e~Lj+XGuv2Z&it~+lAN`dX>t|T4CpZCmK-&yO<@%bPC2PLjD zMq&=l54^OM%-E1Hb7u32Dj(1#EU}o965nUbbri1k%rdcL!ww7D-F6!!`VVdU-h7iH zE>vVWNkQP7Ty0F^F^Nz{XecY+Cdc~u14rShrd?p87oomOjJNab@wdeEd_jNa00k+WmmV!zCxT z*)7Sc%YC*FcjPxB*w^XtKje4X>l*DUJvvGj;2=fUJ6ma!+^hBs#)QVjDx&rjwyRQIQ(L9LEzHM?d_nGh z8Lz7(l>1rqnV6XDAqA4Orx?HRD1A+AEUV?UE#z#MN#sB7;t*&9pzY1y<+A0o$uTX9 zIn*xm|23D10{_3sOa6Dx@V}F!o$`E<#&1sjGd1Aqy6lbqh8;i(c>CjEIe_fXuWOAb|GfINUGdj#4j>`*>-xAR`PU`KmH(yjUB1gbBEI8IBEFPS zSKkR?@h2eM6yqkzhOWNdb81P3Cr4_kk;9%n9#8glzRsY^ZMP*T3$)KOF>0I0^&~p$ z7#zPn{&tfNMGk{~7LFRb9cM!D1Kkz*eFLVA}aaPykaSARm01> z#ZhN`!RFKbG$nhI&4{lMO_hV=I9@_RzdBcTqMF~I-#ZyB3{dK*GxXt3T0E}t(LIf= z=0YGsIlWn-mj|L+d(M5?uX(*>GOAFoT3#%roJ+G;^?M%B_tLd`d4b`(n4!5ybdE>1 z9{k!?I|2f+Ys|OQi;3LlxBxMZ4OK^Uw|(i3<#G~S5rKb5#=}%BggL?!ag{5~)w^w_ zKI4}+8M-82U|e8WR#CW{^+iCN1n;bVjnv==c-R+Ef!K9K9pt>h|ch<-mj793VSZ&4tZKV5l2u7e5-qYWx;o z*1(gH!8<_GKc~9_=Q;#r0y!QYIou6&<-oJGeg-BuPYnWxhRs{5j3D>9!&}p^Gy$9n zN9y@hKua{NHvpvo*@5^BE^LplIA^QdJAmXk9(_#z@z|q#mwybU9EJ*hShMFK#}|Pu zZR3e(*zqXqQNxb#UH{!L&=Y9a|9!I#_b7wa2lc`;lj8NQ4W;go|6WmG3_jfmNKa?k z=j&ISnqzv-tr6`xjzhLIIi%eHPj;6+?|oL!h#83>Pv}AnUu-h`FXrAPYcyV*HnFPn z?=Cd0X|==!)~BFVy_9@lK>sj=@9An{t$c~fN0Gb~! z1ZLmM_qdzPY?eWcH=xiCQ314R_W>m%D=_lrAlAEC%B=R(8w-1Y+8?a){KQYx3PcI7nWt^`15nPWk9K-K0*LAd=ji(p=>6kcCFSO^^h@P@- zy&Jxnu8}6K931T{07R>Z9C@6amI>YsVvZBduAxFpY#M7Kld)zn$2r-yy6=2q>i6uA zIrc$WbOpDsowgl5{KAS3`1{T&Jqq`GpE}g&d`vehLIu}Q0tV|8{NmJD1J}qyrLO8Q z8N5O-vy#0bNsB?V^oe=o;|jh+kt8;rf+fQLq7O`!b7r~2*yJO4PlAG_hx^)5`(>~> zymO-ET-_*QSxg_>Bleunmy_cXupK$RoMo%9J2JM4OX}umYqLbmwdGZnIs{2fIWUtM zS+pUxI%h+Z+{a{rZD&A|x1Ces3=Ib(6!>6QS(f;^vx(XG)3CJ~D5htG9d}N0z$V0N zKFLbfap~2R_dCC@w`uQ#`L7`{Q*-{z`P7_LO4v-tB{TUWYStlxpljb<5tLGyk4RX%S&I0uJge-nV9=$}F7uwQ zZHVbMN$C$oq;<)Zjfm~`1Z)d1TERbD1N6!o3zhHA&(2b#JZuh&7TZ0VpPig_#fjo+ zI>s@VrfS8^a*s;qTpQ_i|MKSPb3(GS&4v z)jRb>;UqGfeShIEhLFbc%I2~ov^S8gg5#M`*2y6?a?WoI*D+iG$h1!;Zr0^NvPtGg zR-DwpoO|?LOsyMg_Xe|$RHJw=@g*U7OO!>XK6-R76J|uhAPKc|BSKNWGO=OiB;Uxu-i5i~3aA z!>wpAbhaVL;me6a1-(WB3zwk&$+8yqwa}`rA+)e%MF{|-jp)E0gglJBYv_|EVHBMZ z8G`6>D#aNwxImD_tC#b#f_~f0Md)2^B*5h$HUM&0+|n{tHuwsDW%>xB4K3$2-XsuE zR3g7>VUM1=`pv%p%ICfIbg5@RWG=qR2-qW*Kvl*XWmaK5gtdic?Lja;#X5 zNM9wDMDX>&es~uRT+a6*k|o)GEPsD$dSNzc+W1K%!T4ji!$ag~bdE!jH{I@XUPBPO z=HC0%4;@st@_+@QjL-EB65=3shxge`*!(ko$BcQ$-Ev!dixKa}= z#&TDZLzdO5WBLnZx^X*N65NlT)6wNj^W6534w@euf}}6H_RSb4Rlxdq7#MfqsrdWM z^lW4ftS5Y8qge;2kQm(9SJh{*wM!cWJy(K%8ly~fDrsiniAi(1h$zTST#vyTX5daqSY`Lg{!Sd{S%$$kLq zISD%myQ%dU?^-0WSCx5VGbInhPCtq3P=V5i~ zmk9Oy-7|7)%DmT9tUI%N_O{0!EVqPq0)k1#j~*BJ5pO&?b86Gp7}gLbcIP&bCWb)W z$!4nbR|4$reNzL-zY7Jq5h>DYEq6_foTq?XR`B=95LB?Wmv8^F{lH2wn=T&tO9J29 zb`tw0o8vIg(+`G>+P8(_2@KhF<1cZ=01@%A+{)7R0zi&z1#NyU{oWnUF%Bl8^BHlg z+Fmj)!cW)W?Ps-YZW_;Pb-rfhj`b_HUo;qPH0%&K$m;C|NHq+uy-Yw7a;+Ko&tJY) z#xXXm$L=3Z_wy>frDaTLX0@H)+*nvqK(i2COdi8H_xk5`Y^>5@&A`@xJ=_j+VIYSZ@FMGSrceLmZEuZv}NrBZRiBerl=2 zSSSq2A@JQ><`Q_KwspOS_Z3rZFW}y7n`eBHOxvXp3^X)~yfqa&=;!t!eYoOq1tU)Oq{cuDXG z*t{Ar>y@|iG;15yiK?h^C_t4>Q7;TBNJ|4iKYaGBc}4%e670QCQ0w%ox31IP5a_Uv zuZsrTd9&eU@$Sh}Bcwo2M2;ClDSvZh@&a-7?SKMDZpW`s46*sG*z>p`+h`f~Npcat zAc2J$;a}Si0N8&wG9ecs-qXDY0XK_6eAPRBA+Ot){2jSDs$d8Z1&16S&c|or378rF z!s#UGDloIWh5_{*nzf6wDzU})!aCv}uAD|B?21+aaLA)TgOMJn+&;ilL^F%>fw<`P zGJVK`uwwFQ(l4>d`qAdTYfdLzdaKSSqKiCJA1@@ik|GgoV#2fp!ufiVUUH3bk|;Dg zdwi3`?+?ZT47naI%b78)clE|gAOf}Tau#B7HF#n*H5o&|p3+_5DZfhz#4&NHMUr*4>S9@A50!+TEnPx$0;CWKTp8m?C9?e#mDQ#CSIn zMla*-{pWB%FDk5D2?|1bYUzMneWAAw@<) zhp&$UNl%39)aUd}@tbmLNqE_p75U8C!0L$=m$6Po2d9-v%g)7DM(8`P<5(Pw!IgUE zUjPBvik%_**D&3xWK8?{_EX zE&weg?)=w4YZ%oxBrB5fSAuvo$eC0OxI%fHvcaI4u8RPuc8MH3tTnWF@J;j|sh;^c zIc2|bnAef~Bi;S0%9H&FSkI~mJZNIaqpR0Q=5&^S{-h}p*H-OBa;M|A0M|wD2GvUc z`3a9p93Tn0D1mm&zyTQ1*ifvbZ=OJp{Ct%iL?q|o_b~eLC(#WDEFIe?K9y1^_LB3A z3oK?9RRsvb#ROur=PnGPP7e&N&MJKD<1px2sRJ+>JZhS;_Z$eA)e>c*a0bOmQf*Jb z3QnB7&;%gWi`xU@N#Y8}Q30&R0&uLXx3M4L=m-F?P131SaAXH)8_c90|CkTdM`z}S z^esz)p^x{r zNQSJbfLkPcjWmES*#4kWT06&Y0JE}*0#b-S7h~%ijg0JnpfSToQRpW$2N3*EIKBNo z$p60}@sGDBg#hh*{nI3EKPss9Z*}|e)U|&p=k`Mmfc@V_+uN#a;L&{7sOoHr6-Csg zL@|3x&R=TlDM07j5B&N!v0KYyjZu;KuUgr>{yK z$~}bx-&@}(3AN^JVc)R`9MO%06Va1T^c@+k_jquM5ctc*jy0f!DA`~}_4rJ8{>a>` zm8hQd`kQ&WvqRZRwnCGS@Exb|nwKPJW(?~gv;riKTM$CgYq4hJ#| zneYVzpt^YQ;qtsw(4R5tD81Wxst+#(>X>cqdI1*0@R*95X8FUD*HEaLiwv5WhwDIj zcra=c(7kkPUUcO9G73VDqG#H=KdO=kqRmGjB5ZgoY?XlY?6P zgl!#~8HkmH%+2g%x_UC{t4_;X*bb>s3qbJhtN@))K2z?`fgtd~h7fSV;87@u(X6y) zDettR$Vhpvz_$X=ZEzy7I5Qj(M!R*JLEy-r(|@Mumov!PktFMj1FD%y)P^nZ-gQl| zZHAa>U0#Oi48F=G433_@ImF4Y?m|cjNP8Q=s=w>A@utYCYPOQrJ8M?q-wj_k#5m1% zf?wnDG=%xu`=H>Sf_CMVsL5#SlP>-hA15^O*0Vm8T5R)spxu_%siaxo`65>3lWc2w z5EOC-2>>xlJf4Lzuk+Uh6?BBh=FcM>ncREd;dzY?E!%g~8$N98Ibsn{tGTv30AOap zosNWw1HL3Cf1kl|dXhFqB|yGrC90n8_c>!7eEj^p${7V- zU^KvIwUIP?VR~lAqD{ao^-s&>)W-18@9lryqBGvJ;c0kg+lTIjGs3=eSV+&Gc?&^IG1PU0OQrB0L3fc9tW)?XOG78B{!M znfxoBM?3UCx*R+&h6cdbfS179YV*SbC``6386OQ4n=8j$pB204^jwXG zydbRf0OTa$@CJ;6=hd$Ia5HR#ZsT0qK~F`?87nzP0(Ohk-dKl3g+z=>hd@=3i@KA+pIF<3ij(h}F>ZTIA=b*8}uY zz)1CqSEWMdoaqXrEcEX+`NP5Q1XC-cc>q)p4b)r8yVCcXPb{8Amp?|lyoKUij29%; zK5TB?ef$2@!i$PGMSf4SDMsXh6Bgn0BFqLum95(E-D%S8FMeDeC^{9s4o1Egwj7B3% zy8_wZ`;^UHYZl18U3YtT`%Mm^-1Pe%67$=7p6mW_CmPI-;w(DTigtQ;m}KW)S0v&# z@*{xcS-K<3$+m;JFOZy?p57@s8y<3M%Z_kaliw>`Cqw?89*z=hs8W)UD}2K@S}h%4e*=Kw3YYk zL_rFz$Y*ZRyF!oOjucUGYkun_oHLz@-@oGf)NS_+J8}WY6bW?FlQe0NJHZ;CQr70d z?GsyEd4Umkhwt-rswV1NY9qGuM(AE4YZ4UuwHC)vt|iu|h^Ysj%HI(EDc_T{4`FKa z@k;;$5K`)5BJPdxK2|(6agW}p%l>Oxj$r@oUH;yc{=-q~0&=@R6IQp$@1b{90V<_C zi#k*z<6oDaFSc?`v*P2`UmnA#ix|6$|JY869D2ht>;gyU6Wx3o^^L0TWaIvo*OSi$0&eWn znUf%XgS}gEr=oY)YLv}-)S2J8+Us87Gbi(6IJR>gA99mgW4V6kyBsMUvE0AEbG!g% zlKmD(Px~^~<~`)MC!rCO<^Oc%L|#;m-p=jR$1Wg*1O13uHN4(pft1*mt>NHlRrr|% zO9XOJ+ewf^fF1fF2;hb&U?KjW-*|Lks%UMpHF?ijV#M+h=_)yAVl`0O7*aY@|0A-~ zR#fW1!5NmOeJLLAs=X%lP?L*Y+F1=BB9m(dKWL4QjJ*j2+;tJGxyR#yVSkM;6h-!& z?U4fNe7SrlzV$f~W|P#LTTZ{F&{t>INC(g6A$%TeDDB)HcR2vAwiF?{p=ijKQhme> zE5=+u8;54i0f*^SLA%ym@i48VEPpWkq`bijllqzeT`U5n1XE6T5f)bQ z8SD|j@BDis+_=a)semDGkNl(3r~l5a$52pd>~w&&*(kB5O?mWdG~Ez zaTN3hWraCW7y5V8T`dK^GLqRft((eOI-ya*$pG;ta1y_{>OPp)?VP7eoJ`2`j0PFK zQs@JB^H&Ti08{?K{Ou3J&eXGyB3anxr zEV}+o7wqvpRiIr?x1I=8ewi4WfDWNr2iKN?V6xndtg*|NH#g%U!r>J3OLyOtWet3a zYpJ)Q&eYTYNj{dM+9u)Yh zM+smbJJcPADeq<=e>(&$<~xp}f)^&Q5A@K>pd|R&S8= znFOpi{|{OJvI>v>PzzWsA9c!;EmZ@9^c(do=ZAMnyw3ZA(ahs19v>e!-0$5vcK$91 z4&yBDo!tIJxl~2mT=2&myqyx?o0c0%`7e8TkqnU#V&~4 zDK7qFZf%vW0~7#zSu?<1J@N9oFitx;DUea?$fs)s--{mN9H3$-&JG5(tJ+*q>8%TJ z7XYHp@OIpB%*eAcu*8y#DfU}jcT3!=k|SK%ZCYK{aM2PV z@AD~Y3jmv4sDT9dcysin2VEvWQO7;=_(V=Kboi!!QQJ*zKPe2kD7|_(M*So_GDUs1 z!=|CnhHa{spxhz?MttO<`cr^P63n~Bc{gw}<-!+P?P}Wm?cPo#m)}!vsdTMAh=hcCj zVvBFj6_3YSm+H}!p2Czic$!0 zG)9}LI3JbBiLk_;xZFIgek@(m=wn*AgoK3aF%k#Br-y{ZJLR0vZw&m>zJJZcp6=Xd zq$Ti-hh=t^moowXJ;@1d{xa7ydPeqZm*PIl>2zC|aM@7i2!4Cs4sJigp9519#S%_; zQ&f+&=AF5a65c9JbPiahK%|rdhK`iesNj84V(!8~TD4C!zgQUQibik_uFetxaC@cR z5*g<&kK#<0!>r~%%^xkB$Ss!II%~*iSGDAQQ3w?8Sz8bCPiIIf%-e@d2v< zA!pY0_kxzdv=hHn3`KUJ*fXZ(&YiPkKxBWWsm7BWs(XhZZh;oO22>Oobg(h*INPZ1 zy&cL~y6F8afWZ@pjrB1Oi9{j6h@66jbw8))Q!@f!ix=s%uYt1V|#;mVxOB z1SB)|@b+qg?0@=;^XvJ1pu@GTU3V`V)!#v(NkG=7;+Bc3fB@RqqdQ?pLV5O^hXB+V z1_?6Jwk^D4kIwfiTy<1IObPRPX2^b&lV|poPPz=h8T@4rx5|5u7BoDONom}JGm96U z6%!XgheZjywgIVngNs$L=DPu6PAArd{$Py1GX~O|4x0#FLdhK)je3|`Prw@NOf7|) z+IATo!PC=E1%$DQJ0$UR)?}(`dOgcY_<7P_U$dMYPQgO~vZU|}MhF@anS|hj2?U4F z?l~e|fe!YIxuGjLA0zXbLCbCkT5H2VF{W5pwHgiJDet!AB`cG*T+zdT>pqjnq1%W33Xa)!;k5I4>+EfiIh*-_Hn2Cp624#+jUuKbK(LV0E+ zqVvAw=2YdUW5SaU9M)G8xN5FSH(F7anv58fC}W75b^T!=ZXRVkCopsiVl%)XI+;SB z>I11R9DtjTeXq>FSCF`W@iB&HOhT054V?PZ2V`g8`lfu`TRV6v^dmxK(I!K)Bz&+M zIJ=ozI#=G}M}E)0JQg-!SYlQ0#5Vm3R9@uq5;Bs+o&8Sg&=MTK6eZ!f9? znG>xOj_W7EhhDMrC!#_x9uPUnmQ77Eb~ZVQJZY!jsKvWSDq|<>c|z%&99B~sCdP*c zJMDDneY zLxI2v6P&BsT^k8?-B0$@T!Xxq2Xrct+dZc${|c2Yw1D_{`y(jy>)!wO@R{S#Aa`9D z7GQ!ue*MvU%ME}E?$&vvxmBI?{U7|a{jI}YBQe9|KenlI9^khuUU?G~;#_=*7}9S0 zACWxBF)u7fI-UM>=F~P>Y;b5LDqVSo&VAcvU-x?p}%P3sD@&|b0ICOFgHWkU&GiDXsYQElCt04}X%%&iGLS~l`&jw0qfmJ3~ z%lm!~r~TFT=&KJ?-AOpIvQIy7(sy89LK5#wf>uwRmnhpz#3R6}p7mysst zLg)^{7oa6gW% zmtyhYg;M;8+Ze#6u8{x;rMmiUxm%EXdVM~i55)J8c)iv$Iy_RhsPSyFMFed+k#l?9M0lK9E>K0^JI< zc;96f@6RZ>jsuD{%;PCBsiRo8;)2mCD?%v*TEqYT<=f`D>aE!nj#gG8KAiz#cOPeq zoKzVV-}wrn&-_~208qr2uWBlng{&>cNS;&nrr5RY9_lh_My?ymBmoSW$FiOA9ZlY- zPhnBLOJP*C*HJ zRRF$0$YLYy=176yyWg5`0VKO(veR+l{g%U2(bl|%Bdc<%FS3*NJNEOi2T;BR@R?=aQtSm?O{+tU9S zRcWg1h;e%llT&jmKwzJd7@T$wOvD3deJX17wK{rqC)vPjdv$z-Sf?B_)zs{j0+v84scDO zoK79B?#UgA0_iIp=>b?(;M6E87=~#9ejepxE#+EjXqec}b5_9N-KRCQ9Bg(_TnF<2 zAUD`S8(rdprW4m*F(qZ7l&DC4fvOGhykLnP1QIf-427w>yg$?OkHcgqfwO5(D-yP} z%q3~Z%lUVGzpbY9w$+49zYAaoi+1c&2@hTGC{}w3Fut-I-TM}_=u>#*Qt1EH-g|~M zwSDiRx<#=dxVKo4CfkCD6hWmY3L+v30wO9UAOa$t2%&{25o{m`N|6$kY6GR$L}b$m z0YL%@At)pfLJ}m9kbW1I{oDJTbMLwLKF_)T`{AsI53rbP%{Jy3W4`a0V_E!8s*4(A zYEIxw6gOf3x&vQAzL8XZ=9*G(o&g4cA8;anaL#=F8JqpHn!t&EB6i5IAAA2(>Rh?w zXUN7o02gr=6~nw`^(n?U=LsQd9%Z+|tr=q2V+jXwa0OX6ri~Qd#&VN|@L_ z3gpA_9eSm(3Bc&1zg*WL`Rm(5&65+)RRz8=ao$mUlHT`;(&PMk`r&aw+BJ7$Kn`F` zW14$(RJ9gLTTA8Qmo+j31+=Ms%`Xf1* zn|*cWTUi_Ge;Vkg+rL}BgahN-{^xesj5DPNTby|l5{CTmOgxaCfVx%Nc&lwt2#{Lq zrxl)%UT(wKGmFgGUc{Dpb|~d$&9lJ&)(wz9_Z~kg*-xdTS8Y@Pyo%?3KTO|>A;9|o zy8hc>{-5{%FT9#xPyR1KnE!9Q{Ai1oi~Z;P$msf*w{2f?pX0w)|9omjE_qd!35>bB z_}xftFh*08xEUBWs|QNq-w{204nSZ7aBE*e`sTpzk>ZE?{)`TMvgRB0Cv1L$4}hms z7>rDdTbM)*b>6Z@CEgznS%zM(eoG4pbFYpmLB_nJ0JeM$o;7)si594?SI2h)JF~H3 z?4D1>ek8DH6!+?k4do}c`BzBTskXWLC{O*J_@AvT1rCOI3>ii;6EeyQtEw*9=JB;% zs}j9B9=N1GOLg9ND51Rtu=Wi7JBk2#NFRL_Tk=kUwH)U~bFemn}jGE^7H8nPo9c`l7(fCplOz_o?& z(l>7prfM@x0RO<6fC2@e+SxcBom}Vi3V(di7&c8^rlEnL^&zvl ziPrNs&JPH9+gwIB8Fr5V?5J8Q5Hi5~sv-sCDr@5a4uK{6@adEc7J*@5;L-1)8Sj55 zU%YCKWdZ}h>gty{*TKi*aK2R=9XR9`0$z^$bHR9~V+R|2`f?cr*w+9yXc@$W)WjA6 z`6IlJFu2@t7TT?D-z9RNTVtSdT)qmxuu97+Rf+mzn{NXU=LqOdP02G90l)+W&83pkB7Td&qGdlNC({?EG@i_T@Pp#a$Vj#7=)@#(Ah zQvYPteslkZ3@5ed@2Frx&_G1hIN%!`7ff_~wfkha-RRnDt!1E2F~XX7>0MYgmW{m$ zM4=O+uOq#iea{RE@bj0><6sQ!O71gmAp_9mcb{^B17C4s6Be4*-O~dcY?l2_pXXC? zc?M+aiLZSFdd~8hnD5sOJ`k~W zV)fN6F;2oo9zQ2xKnV1jpukB1^ImUx;3VXrpXlR?+io}6t6fY8*&^CPKF|-}ESv;R z5fo4?fouk?g9`LZK|qAbyP~+KB4xenx6FXt8D|eR16KF*m4ZL(`f5^GT$fyyulmtou4kPrhAOh&w~?-=g|6NVq3oUAgi!%S7@2jI{?kJhKhZ zKi4g`M4`{VF`vigfMqN;Z+#j(R_BRxG8{f@@=a;KPRb7H9r^pTfwOt{J$(Gjm*iD$8qXLB<;jrH zP2}-q5S<6aF^sYSG;M#Mf89>-qtxfG40pc>-PxdbR8Z<&Ef>R?t)Bi&E2gIAc_@%aAvoZ4 z$k0T87@>nr!x7PTxx#F$&Hi}**9fih%CCoeabl75>@1IA5d- zx*#y38E0pNN*ot3--=zjxjU2!L-Iw~%_|kQ?i1vi$BlPvY9P|rNJmAh-Lx6sd{z)K zS2v%3_tu_Z4BK|Pv5Dp38j{MDn{wT~WId7!bzSuw&CZxC`+Ph;QEFGVI_<#q6tyH1 zruEk~D-WAqsQX&|?%B1*dlPD(kJp&gy}7ma^SowR0I{-p)@7rtIlq)+*?Z)gZa>LAKey8~ zJUVgHOX3^YlAMb3_}#Mt{RBRL{;Pe)f{LVr7f(JUpK1Zoa22N^U>o5_Y4-6YhD<*o3w9}*J2hF-7OC^5Q3PEnr zCS8}G-ot6RmX$Z)edM?Wrh@1DLZ6F2>RvHu5wgMqRXLGg9V4%DCHugJANQBr^s~f@ zqxUC%{ko#+|5vwrHw>4>RM!JB=Yh7Sj9F@3I&Qah8t`L!^|aaU@P|WIK0Wug5T6X9 zxyRWLEw&v(@SI`2FGf$)JP!Qw{={<6(1t&(mO%aF4B7Sb4X%w5ZZGZ^ zg7k9ccCHr6vx6JqPL)tvBdN<#o!D7ZaprT&&E$y{??LK!qs5aWqLjVgADn8rGPCPN z`sq_lv7H(sI6csZXc+Rl(uxtj;n}tPU93S*TtH zL_Ap+POqUhbI0knKfo@-r`A8ZNlDwF z#zu0XOnq!-N?f7QLIErj!8T)5dfL?_i~e0W2#L%yAqVyerYoqGR;D9k)gEUm=ZhFc zS`zKLm@|I3g{m_j0)WQ=3EX>`O~qmxS+*Q2uOnCT4PN%=`Z)zLkhY@sqj#QaNT_y-8pIwD_nis$NcH+;CKhZ zU&MCt-H8$|O*Ipph7FtTZTt9|Teg~eU7hj! zhHYjIF5kjiNZgD?2z;@66?750co_dU%C~i%qI0AN;yMrry84wf+Mb;A#4<%&CCf`s zc45LJEskF);XI=vgeVD~M4;{>kw?a_P`V!%sb*@!D`M^DA_dB@2r5C4D;B9{unjgg zARPaANzKB~?s?EEA+uji! zq9E%!aRmIk($h@&rw)H5ZF39rW6$ln|D=)G(8&8s9Xu!`BDfunF?Lb3Wi85?^)+11vWtb<6}zhUhV5uUZYr_YGKnEKD{)VUNyn8$-I!;yF-I*#AP z1N++=EygrfW33u6@0zV^b96RqQ zIcJWPr>?QS8N|-eYOMam8BOypR#0jZ^_h6PrOO|#WH3Rn`;FbjtlA^oJ=Xwgd< zf7D)9vjHEx)~x{^!Hfdu*>6JKLTVX~48}dt+}m8^!&c0>H43Df`4E}-A=@WJmneF{ zw$nGv!jc~`#SsEuB@(3s>nbG;ZN@E+xo+SeGE870{CT5hM7yT z_tngRU9fR6O+v#wo|Y`s>l|{a2?{*_+I3Xest$4@h`;Da8sxoEF-)G%;>=;ny1Tw8 zc-iY+7B^z~l~y%&j=3C?KEeE4ZJkROT9ubj&|NjlU8f$`IEseH5IHO$CvgUYG)HuU zN%<-sj_eYWO_?r?Z?x?W9=(QBi`(@Bu%)6?507-X)uK$&1~E}jE}ug<%~ze|9JFjZ z#k_0_reswfk zCs0qQXnr2@n3EHPu3oSt=);F%q{BehZi3mqG4;hW(d=Ml2cI3H>oa~OnNX7?G<`1F zV0_=;niK;}vP*DdvzxXcOFdy`aVgIcO`IKh=QWHWdt%;c^UR7<2Jy%%c^z?Vl$Coh z4lFU}HB*DnQiLe?3mmY_)^=7MyR0Gr?F*?0Zq2_nBeoUKv?842woPLKSYm_&s}p&%W0k!mH@6XB?bD=$YE$Etinq)SQH zm+4<8;?Z%g*<1lwXz!<5gYz6=?ZtP45%j6BH&-t84Ne@kMA&) zk)RZ0>^hmqwQkX1D~Ek0 zXMS+FXHn1QzHJ4&uQ%6-q@}neu0Qo|zi{a_v`0^4s<;&O+yjlD*lGDmUXyLs)?JA+ zE0;$(d_DbnA3KiOsq^^xM-q3;87=wRL3@-LKOP}arU)Km(8cn7KmawUAT@*GtEkhw z5C&z0V>AY5wokXlBV|<6%?X5XdiQ;h<8_;7nr*GK{_A}&N*WgFJvN1doVJ1o+Ckf!VhT=!k_M|+9 zpBji`5UMFLWwlL}yBL^;c|65BGxxqaD!QSP15TYhiP;K(k8&5qHALpVj!aN@ z+%3Na$Mp-AsXS zAXxm;&qvL3g~`?z^sk|Ai-N-5>>lfk>f^TAWK^wm`p|!t8#6|JYA-UIRa&;@@5SvN zXLS!8TKmK5XB}gPVO7h=JWcP(t2oYDhgLXja0VN)J1AvCStizl86_L9**AYwez|YZ z@!Xr9Ve^=K4vSE&Qwj2i^%13Zr(|Rc^vY5*OfJ$dgaH$tj)q^;xa_S;j)ijHO?(6y zzCP(@_288Q^2Rpz3*#!SX&oxTC0u*1=IZfY)R*v+E6Wz}Zm>*N0pCA$gLYG075=DN zLibqcn3b8tXn0iqFN@)Nb&I*)y@uOi$&`d~QlrFT7!~!vMC?+ubg9d2P~*Du=93BX z7of1XJvW`2HNk~>I6>$UDPp-ABwKttZ*mkgOtV#cwdknnwKBJ3O%Q6_Q zE!Vgs=YHE){B`yj>x4qnxX)&#TXY1QI1djgeZCMyLe0jUl*F=&nR^boAz#WQv|G8b>K)U7%4Is0T-0fU1N~&Bj0Care=m* zoI34i)46F4H)iNxlW}sR%w@>cP1HXPw;w(?@RqXCNvdU~Pio_7w)AV0p_7^ND$=a| zvI^;1J;gg8{pP;dSR#2k3PiaFSr+MTSDKRL$Mz}XkUj0Uw!>RmJXY3}myT*3q6RT! zHafEQ;;M|#SuJaEN2z*~TCt~{ef9Y0nASXH`gYaEG?VDcF*u8bARoMCFL?YV{9f5b zSaYjETUDs&@JVJra0u(ur@+u7lJj9@Q0FM+{kwe>2lw5v`v9ycd;AEnCvsvwwNtA~ z8S~8hEjYst;=A^h5)G##^7dzB28E=mm8_8z11a3nly z5*tN#UsdmK3JZd9U+EEnGif#7r$kM}<>|!Lo4!bepHy{9bPFC_EBi;rkf>|WaS@iL zeyCw#%Y28Z?2q{Cg6kowR(UCCMtI6Ifk9Et#x>Hd{NT5Uz0GB56`c<{S#(TrE(a78*+OqcPVhrdfn154t7?e7|1 z4#8ycZM9(Y^^e1|?w~(-DW_eT(;hmerv-a=KCBi>nAt3?ky^5oU^!5U z3G4I8DwLmb7*pP+bk4!>P1~1->2$ASPpfg$}Jb?UMWmecl_SGRUu^qG5+BBdGrui^ako3K<&=h&%|=*CF| z+OahV1Gt^i5Pk9<#LWo}Tb1I8K%Q8HK~Ue7%FSND9DPnygao0(Kc*E65YIO6lSu=d z=nFmGV%{7j%t&ge0?)c;`$p<;io_;#lXTsuaRk29SJvo>9#cBOiy-CehhQkWG zgBog`Jt~XXMrPJkK&^fNnbS^IeA?$@oh2nw-hdFfFyQU`<;Yz|Y>i1t-p%q^7Y$;N;rv+?)4k2p&8 zay?gnlaGR83lVGXVqK7H1;%u_tGY%Vwc&*YePKZB z?Su8Q#RGPe@kmd+Cx0i3ef=0;*W$8wqYWzdWwQ!2nQGi4j8Y2&vA!#(BS})OqY+fx z{anq0vRbJiUar3xrbLMCGEQ7AU41nlnrkv~`=KXB4?@MID=LhuTS#rxJe9(Cqxju9 z-4iJ?!W)cVx8b>SLx*@@iS7o5U&UwEAy+Tii|`B-r~x0oy&6}a$d5A^B@0!;#zygg z_t!y*rPOY1XlZ$iIaa`LEdTD$P8{_qi$@A2bzT_WRp_`~=HX!UsATssg1%^J^H$v2 z?fjpc36Fgm=0$fd+(%SLx@~A`U7w

z|KfcTsJ`oem)(Unp84|Kksdt@>GTdn?@ zXl3_3>?yLmmg6meLi7Ea(PC2TDF3EsPwv;PAJ^QDwr<$WkM%WJ4bWsB`Kkm;V+ny^E@NpteKjzicZgU$tj+bm<97N^>z z53+FFm_I3xVH>S(6k6?B&29*;&jAZEMC(W(8&6%DexOF2ZFc|?P-z!B@0UoYXy~xr zs;`AB$QEg*({*+1R8G{se-c-!Vo@q6M)EDI z@Ma_Cj@YS~+I?nBSU7Ksa}B-Q$R^8~dr-zi6;6D`+E?0gj7)yi@}I@npcjB*%MZOJ zpZP7`l@@-9@1d(ZyG9yt3HnRLO#1gNtzl~RtBIXW?2Rf}XLF?#J>kbX z2KS-p1?$N6-K*cC&EfYdqx8HS_#DmEGLgUjTWG2lV$3saS|Ug0jWW<) zv%BC!W)DJpj~JFFHME<3K zjLPX8YZ^8h`e3j35bIi6c(So-!FG;8kzSbuw6>KKHN^5sLucKx7k%dwr8htol+LLj zE_*>a^|(V25dR^yKV{raeCFxfg|1}MMXL&RV3UZPSdrE7`a*rh7(7SqSQsrlk=4n) zuU%hdLXX4d{|$!x5wpuMYpWoPm=z->{oYi)bqA%WN1?>bqEJRw5cYKE&%?T#lsv@1 z?{9GcZu9*D06N5`Wen#R`~}z%@OQihKvuqAfWM{s9c59^kBC@?l77GsE8ZV#1N_8O zc~=}jVPE5YXnn9oEY!9pJ8<&7F>OUYIrT#*dw1$)4ai?wo@aoQ!XiTw^)#WOZ12l=fK%R&{ z4Oi&ubRy)_OKIR#g`Sk}FxkAv!Nt@eOP|d<&N;ltkt7;aTJtKXU(Lh7bsJ@4fAtJF z0u8kE*LCTC-~K)n|9eb+O2mJKK%7`39o+Qo2j04j_TG_KO8qX;X}i15xBS3ZfxiQ` z{FmMyez97*CnNBxtr6oJb=Pg}tK#``reSICLE6ZmG%3z#yTCV1yz@ICyxY3ZuH+A; z!lSvDzXjHoUyESI)*6j;elH1cn@7Guv@c5kEEy&?emt=gmRWK(_H8=oB;+f~O@=PF zjCunw$wg9Qz(dN9CF)&}P$s7?ravEl&=cJlWu>342N4(BTiRW>#n2%RQ zSMomC%NaNeXWFPF7@6J&dW2JX=WmvC1Y7=}k%n-iL*_o(5W9t{B0)?;`jd3D=t6cx zN8YQ(^u3pBT8?qlJlhUUYd*piBR-UX;E0Pg$Xf%!e?~G7-_qg>5*&qg`=uB-yDwgbezjt0TW|pE7kUP}@_gCId1{xQ zMvZTN%f!UpB1NLET95ckW{*uwyQsW%Ws%ux9=!~5vDj>Jp*Vs-mb98-v9+%W)$i8* z=#)7mWK(`j9Mmr*7}MttqBaS?NNcwK93+gZ!15%?2z=K z0%IrZta6B~3#8Ys_5S3`%qHC1qv6@sT|(7D#D}*NJBL7B=m$hH(3dy0 z<3eF;)iR%8WZCRq{hSCF(A0Ed6=_kBsUJ*g(2VVjJ97&1EcS?K^NH2ci|g*+R&fVM zAf%B<)4QoSvZN)Q(NK}M5c-v#654ax{GS65V`do1d+gS7EOEeZOd(vYX^r&b zYJc)RvSSm7p6eTtW3bRXxf3=>4(*t65cXBE^2NvfSelRUCY;J(1&;bK;~%w$8y3sx z912>loB)aX%`0TwO&|ygMkKlT{PEA#MWVMHgRcvYWn)Pl-Q{*NL-A1th8Jp?axE?! z2cExnaqr&arK`VPK;AfuL`tp3yH-|+@-rnMt}tWXsP(Js^)4vZ8O=Z0_&`b;?_OIG zYa43DT2*SdYiPn_vfWLP7hb#x6EIp#oi2fG!BzHE_Qf^4Hb8;D_S^v4R1L1ck&XSV z*$D+IK`C0FJAsp!k9h42mPg22xWFV(;++S;jBOQVy_@-buQ9#!e=1ZuXr1hb=T;E^ z+l0GO7w0z`pqq#!QT0_fnvK11#{YcPpiX0KRHM+|3j7g3q13x+Qqme3cy-0giKMO& z%j}Z0%Q1OzZI5*_YF2Y!2i`t>Z&}SL{CU*@P{@@GRLjmH6`1)g&A7!cNsS^aM({@2 znGMee-HDg^rajKz+cWv^AzLl|xRxAOuE2RtYI$}qEE7&nJ*H8JH<=TRR8ZbjBzsQf zZ6IBa?IdxskGKGp0Lyc)_Ypx3%x38G(*_xOihWPg^YVY#61a*|(sRKBr06D~(Zvxm zfIj}mf1{L@Oe^L-QN_~3upHW9K=|rsP(aatC}LW8$XoD7=Y8NTLCHTJ1vKa*KvSvq ziU$8*S}4FmPAps8WjpGk5BhpiwNPgPr=9o@Beq=R(V$9j5J2nJ2F3P2{2!XqmI`mh z?mUWyyy|P%@Uq>WzK?AF?~HNr(cH!!#{+$J9O-l;s*<4ePhQIqIDO%7lO1PVJ#piw zrL<;B*314f$X8zd=YGw9?QQx{JQABzd*s#mH-13Q@jyR%pMfF^BY8&sa9<~I_)Sb; zdsQ>zfpYL8I1gYxuvs?+&XSkM2nF`!%q(JujrCHC`_x zIZs%Ui4F=>>k%rNprD_jKm+!G0DT6@Xrzrx`RsHDO(7_~5=zk_GrqxJJ_A-2a zqMnvn8wf;nYTE4)0?9>k!nTQTi}|V4C;nyRz#$s?$})Fp>1U@FL#$CQ(t@$@x}POW1(FdVd!2gb7Z|$aC?u1yM%tw| zNGD}9`8k#HR%%jtd5j;~SJi1J2pEhBoFtG4+a6DN7v(xNIM zONtgOMPj6C{wM8B4nQ&Ai7+fsg5;GeDm97u?SEV?WH4ixI)UMLiVsKt>JA?(8ky|j zE_lKIRwJ{}nUX1AQO(#!j8{il=3e!4 zoq0?F+20lag%^{@RJ>>JABKT+ptveRpattry_9!Zh3lCJ>s&u-7l(1o2 zCN8SmBV^RCdD7zo0Hr6cp$R@_V$KsXn=s`(cZ-`YLCwuZ)RD<zp2Juv5zunF{0%| zsMg2OwtzbdRBwEGz^)JD(SBqQT^o-Cd=uoy{K;M*eCu4Ls!7D`SYY;Jo#v0A7paKN zJFg2K{MsPc+nO1cvVgC!c{)ZJ1ry37*yKj63sFDU9xvZb?>7eQcd`Mg!6j6P5w}4e z;{XaYJ%9^1>Q2=9rL>+1mk6|!bkrzRS^UCQae<4D~W7B|W3dS&OZ(#^{1O$mkHcdX| zSkyR?Z}uM+xR9q)#WS|*KQ~JiIHQfSm$h!F@&{6?b#{wKS2y09C_#l%gV@v}jLreb zKpbn0G%XL|$pbBgP2t^%XV-s2wzQ1WW_O_Xu~uz&mFyL2EiXQ_>at4ce9qVVVyJC+C+b}o{?Z)ke8?vHhDYpMmS|Mi%rwPJ7T5scz2OQK z`v!4K;uN1*ou8wT2DjBRted71Pdzklqcf{Y^4*8gS&@LC+PEZcIQ6*^UH)_{Mf&!( z86fcBw~0GA)lYpWZ=JfiG-^%#}Ix@NR#UrHOcfI6$7w4>eGnd)oWw{3uV9kqah^%Wg;B*^Q@Zh$TjEzdn z^IOVDqS>-0Lx*!Se+dMrWUJEbi>N<57H6shJrRHCo7!h6D4iwx}l=2A!FJ7<* zlBwrm>lJ*-^(K?Ex4Zc$_~&W`HcZqG+j)GsQmiwlRkl)A#EPg4`VW$V3zF1o048i?;8jYKv)b%qNF+TJ#7Q{a)OKP%F_4#zK|r7%U@R?^<2leQs!Ydn_y9M@ zB|ne`H0Av3v9rZsUT?!Ze35{qXtNJw@*Wsche`JaTZdza@f55Ys;Q<5!Phh}KpF9= zdcreJbD1fJ5uqba-UM}Yq!;VLQY+Qw=90y22q_mj@H}GNKiKs=H74@g%Zj{SRG@F8 zot6uP+O_F4f;&y`t~!8D*_*IKstfuFB4!?`ab@q)Zdj5g}v&@#2WBX#FB+RY@rpn7OkWXnt5V@a?uY3`1F(xb zC})LQTfe+@iii^ru%_&?*eI{;4D)dJjGW(~_a=0jmZG7A6qS90=iiLFQk7+7^IgQ3 zvTLU99xl2QyF?4xXNgaOp*)iw7>hYIhGy5AHLjuHEg$CL-zNRzFz7t2opxN6QmZnH z<$Q01hL)HS?S7A(8?nM>-q=mYx_#4lO@s2U3{sV`Z(z-5(U2&Sqjyeu@W^@d8&z(x zZIj;QnLJ(!xVi>#>tc9Hi0J7r6|ptW8$KG1%RkXSZHGoJiVu2A99$*C)7%Wd(Ue*L z2jD?~ssnQU>}Sy2=C4L|g#ghtPZQUzi~fi=!bI6w3=6Q1Ol{hpK#fvJG-b0F?o6>{ zGBfDF%A@({&QRaAFQw#1-Q(}}=ER**EuPC~MZI9Zg&IV<7WBc3 zQ#TDzsu!DHo)&z=ZO!--+H3;vf2cXCW79iKj^o^#>GeB?P);lAxT@WRgNFN$VFG8Sxj&ffg7l9!uvZx~Gy8w!}P zg^zn012MsCbLGb??T~DzN;!=w8XI{3%A@OfBu*AIr%@m+*l)MV1 zF<3OE-i>bvU^dygBtlPx=x#qmG486eDH{n_UdU_o?AX#sivxTk_M8Z+nm;fe9s-Yg zz8l4svV@^SX?|nj$A4<{nAYa4O4sjCWydY7gFP}~IqG8Ho(Lb8+Muw877U6zlbu0v zIF79X!n}bGFdaalq9X7i;CG5jNtc3amzuokWnZqZCzqfW`-6%%xz`@-imiUD1nm&M z1>IE@2+K^^jr8t!LlZmgHVyH-Ajgb5vcJTEN>Uu};Q9^L>FNdZ0Xf(*QmLvTgb}^C zW9?(gsKx7C6FViKi*nl0^|5^*IqjJCdO3rf+Flvi%VkKE=(6*Tk7lrUG0Sre2|0`N z|LtK5CzNgjo{E8q4QEWxgem`;)$tJ2YH5YdATm8fH$0cizw%)V-t^+VZa>un^RgRc z^%iVEa^rb!x8u8_+uzidFXjFj!;Duo?E?X_zv$hWH`a_g_{}l3TxW>EvF;sQmtEeN zUk3!kZc(IJdKz*tzENJGe)4J^qJ?(NkfPQcR7nXE_ zyji+n*coM5if2Ea>>Dhl-}z}rxfy~3hMmg8i?)nl$pktA&9}Xgv<(x*exTPb_ILSgW1bj6{m+M=;=@yN$dF-l5>sEPP5f}_>lK2*qO|bckzezPS?_n!_NrNrd(M5-RO|^YP6aW?uJB|A(na0hXog|v zYXfnv%eHAvivL(W;34NiKR?%l45LK7jT&*{SL!Fqbl{Ka#;l_!Ri|=kwGVOMJ73xu z{ImN;&VVWI+;G`ywY27W=8iJoIVRt@2|F=org4;J%dP5=Pj>qj)?OHR7q&bN*cpE+pqtYhMxTu$&PyU{(-)Nl-|Qx^Ta z>XT=T!@07aA++`9Iu)zl&8svVaC;3qV`Q!!YuGyAl{nnB>F8uUGONEp#gT8u+SlnO zB0*iw?6Vi>`k3 zxpk54Z*)3xMV(a(kT^vJ?Q3IEJ0g_B%ME@mxLg~+FFQ??M?g!WYvF$w1Q9?5Z;XSQ zHTqyghXZyu8)Xk3>b0iP8~g?zjC;G2>jJ0HeeLosf<#>QU$a)V!2Uk1BPd2GJm~U0 z8oX8c%w?bv*MYJ3;k;li*DcUDjQv>1oc?=>4~77gMl<`#)Pk9?Q_)9A{ka7SE6Y9g z%hspumXrCPyLJFK0(fNwj6Mu_36LLbrB2h40{A8L+b@fE`P9dsa-IlOO!T;lL53ksO~Gphs4)n za7|e7cMClLSrOgdNn*D> zF3*hT?S@fs34=1S;w2p&|E*><4Wj&#jSoyYHPpK$_`a;#{~$;826=!6{n|wac8`OY z`q&eK0C?m#O~-YzK8->kU1twwaJ_6zP)vbRhewERcZ2BV-=I^y0Z9{32UK389mIM4 zgsQP{hDtTb4=y1^5}}NX0|Xx+pkZ6dU)zEMGQ?uPn*ln4JPI@*TU<05q$$XR?Y=@D%$V$YXIdQq zue?l2{Agtdss!Sh1rgoZ+{{3qaU~m)!QZ4`Sgbw4r9~QhkNTbgDscj=k?(fO~ss^ zxaKPPnaT$TGX0$0B-htz%n!AIKYsgXPb}-TbdPZmCMJsK zjzpqdg;&=pGV8c)4*g)Rh@~+fJXY0A8n^EtyMMT4!Xhn-UURvKf4L+SLwEAqH&H=6 z{~|4NrC4eY*;q7Q5u0DtSz{|0SmpiXACs2Ho|qU3*4bytk*B??*Ov%UI@-V)l{WU& z(RPulD=yqX2RO!*xTCu%J7d#xlQ&!Ew`pJeRP)JPlugqK;HueeD%7%Arwn++MHj%^ zZDnMg9{E`*LH!#8NGHY_XTh`=i46hfcY9H|9^gCoNQ*51pi-tD%N?iA;Yepe8~)y0 z#S8+t7l^}C>;}RIKFD3VFRs;&d?usy=u2dx@I@;(X}zq9>rz;D#&5B(OAs|li)AAf z%p7Wj5pV1F!RtnwD9O~fhz7I~|CULFi`_=qngG(`gLu<-{bq?R>Pl;BGZ|BN@5JWs zHtbAaw@yz_%7I_Tu`FKq?*`~e*{x@jcn#>eFZ7}d`LN%n1f>8*pf0;+15Xn&et|GQ zj${fCvUZ=;)g8&uEdYh4PIe8hCs7gug8{y;1_kOqYZ-<5z{SBY{H;;O)cc}BQols5 zCr9ZVP23wz9bGKiDOpw<4T~<_jdJsUejW=)U5;_TluMau+@z;;Hc@)V*ohCfWGLzC z3iG$jhhxU~q%e;p^?Rs+eZD^JMTxqqnjQhF|FmE+IA6O*NX_uIx$zK=1;Cdps%$fs zW@kl|+_6OGZkuF5jR6q8(Bk&MIK;Tce zG|RSZhTewX6KS3g+6Uv~Ik#3u4TNR@(WF-O8^8>W!t$7K?#>B{Q%?8by6{n493z8T z#LZ-APIcUp|85z?v$$#lZOy^?d}NdJQ`?^VciBOSGTx7-qt@^AG#?L7o#q)lvq(HR zLv$Z@LLwu94.0.0 servicenow.external.vault ecs-multi-secret-vault-credential-resolver - 1.1.1-SNAPSHOT + 2.0.0-SNAPSHOT ${basedir}/libs @@ -179,5 +179,11 @@ + + + org.apache.httpcomponents + httpclient + 4.5.13 + \ No newline at end of file diff --git a/test/creds.properties b/setup/file-vault/creds.properties similarity index 100% rename from test/creds.properties rename to setup/file-vault/creds.properties diff --git a/setup/hashicorp-vault/README.md b/setup/hashicorp-vault/README.md new file mode 100644 index 0000000..6ff0caa --- /dev/null +++ b/setup/hashicorp-vault/README.md @@ -0,0 +1,59 @@ +# Hashicorp vault setup + +* Install vault in docker as vault server +```shell +docker run -d --cap-add=IPC_LOCK \ +-e 'VAULT_LOCAL_CONFIG={"storage": {"file": {"path": "/vault/file"}}, "listener": [{"tcp": { "address": "0.0.0.0:8200", "tls_disable": true}}], "default_lease_ttl": "168h", "max_lease_ttl": "720h", "ui": true}' \ +-v $(PWD)/setup/hashicorp-vault:/vault/file \ +-p 8200:8200 \ +--name vault \ +hashicorp/vault server +``` +* Login to docker container +```shell +docker exec -it vault sh +``` +* Vault setup +```shell +export VAULT_ADDR=http://127.0.0.1:8200 +vault status +vault operator init +vault operator unseal # three times +vault login # use root token +``` +* List the secrets +```shell +vault secrets list +``` +* Enable secret engine and create secrets +```shell +vault secrets enable -path=secret kv +vault kv put -mount=secret linux password="root123" username="root" +vault kv put -mount=secret foo password="root123" username="root" +``` +* Create policy to provide access to the above secrets +```shell +vault policy write my-policy - << EOF + # Dev servers have version 2 of KV secrets engine mounted by default, so will + # need these paths to grant permissions: + path "secret/data/*" { + capabilities = ["read"] + } + + path "secret/data/foo" { + capabilities = ["read"] + } +EOF + +vault policy list +vault policy read my-policy +``` +* create userpass path as 'servicenow'. Use `userpass` as vault auth method +* username can be anything because you are passing as mid-server config param +```shell +vault auth enable -path=servicenow userpass + +vault write auth/servicenow/users/servicenow \ + password=servicenow \ + policies=my-policy +``` \ No newline at end of file diff --git a/src/com/snc/discovery/CredentialResolver.java b/src/com/snc/discovery/CredentialResolver.java index d1218ce..7f0c02c 100644 --- a/src/com/snc/discovery/CredentialResolver.java +++ b/src/com/snc/discovery/CredentialResolver.java @@ -1,45 +1,25 @@ package com.snc.discovery; -import java.net.InetSocketAddress; -import java.util.Arrays; import java.util.HashMap; import java.util.Map; -import com.azure.core.http.okhttp.OkHttpAsyncHttpClientBuilder; -import com.azure.identity.EnvironmentCredentialBuilder; + import com.service_now.mid.services.Config; import com.snc.automation_common.integration.creds.IExternalCredential; import com.snc.core_automation_common.logging.Logger; import com.snc.core_automation_common.logging.LoggerFactory; -import com.azure.security.keyvault.secrets.SecretClient; -import com.azure.security.keyvault.secrets.SecretClientBuilder; -import com.azure.security.keyvault.secrets.models.KeyVaultSecret; -import okhttp3.OkHttpClient; -import okhttp3.Protocol; -import okhttp3.Request; -import com.azure.core.http.*; -import javax.net.ssl.SSLContext; -import javax.net.ssl.TrustManager; -import javax.net.ssl.X509TrustManager; +import com.snc.discovery.azureKeyVault.AzureKeyVaultCredentialResolver; +import com.snc.discovery.fileVault.FileCredentialResolver; +import com.snc.discovery.hashicorpVault.HashicorpVaultCredentialResolver; + import java.io.IOException; -import java.security.KeyManagementException; -import java.security.NoSuchAlgorithmException; import java.util.function.Function; -import java.util.logging.ConsoleHandler; -import java.util.logging.Level; -import javax.net.ssl.*; -import java.security.SecureRandom; -import java.security.cert.X509Certificate; -import com.azure.identity.ClientSecretCredential; -import com.azure.identity.*; -import com.azure.core.credential.TokenCredential; -import com.azure.core.credential.TokenCredential; -import java.util.Arrays; -import java.util.Collections; -import com.fasterxml.jackson.databind.ObjectMapper; -import okhttp3.*; -import static com.snc.discovery.AzureKeyVaultCredentialResolver.*; -import static com.snc.discovery.FileCredentialResolver.FILE_PATH; +import static com.snc.discovery.azureKeyVault.AzureKeyVaultCredentialResolver.*; +import static com.snc.discovery.fileVault.FileCredentialResolver.FILE_PATH; +import static com.snc.discovery.hashicorpVault.HashicorpVaultCredentialResolver.PROP_ADDRESS; +import static com.snc.discovery.hashicorpVault.HashicorpVaultCredentialResolver.PROP_CA; +import static com.snc.discovery.hashicorpVault.HashicorpVaultCredentialResolver.PROP_TLS_SKIP_VERIFY; +import static com.snc.discovery.hashicorpVault.HashicorpVaultCredentialResolver.*; /** * Custom External Credential Resolver for Azure credential vault. @@ -59,9 +39,6 @@ public class CredentialResolver implements IExternalCredential{ public static final String SNMPV3_PRIVACY_KEY = "privacy_key"; // starts here -// public static final String AZURE_KEY_VAULT_NAME_PROPERTY = "ext.cred.azure.vault.name"; -// public static final String PROXY_HOST_PROPERTY = "ext.cred.azure.vault.proxy.host"; -// public static final String PROXY_PORT_PROPERTY = "ext.cred.azure.vault.proxy.port"; // ================================================= // AKV @@ -73,6 +50,15 @@ public class CredentialResolver implements IExternalCredential{ // ================================================= // File vault private String credentialFile; +// ================================================= +// hashicorp vault + private String vaultAddress; + private String vaultCA; + private String tlsSkipVerifyRaw; + private String masterToken; + + private String vaultUser; + private String vaultPass; // ================================================= // Logger object to log messages in agent.log public static final Logger fLogger = LoggerFactory.getLogger(CredentialResolver.class); @@ -112,6 +98,13 @@ public void config(Map configMap) { // fLogger.error("[Vault] INFO - CredentialResolver " + AZURE_KEY_VAULT_NAME_PROPERTY + " not set!"); azureVaultAddress = "https://" + azureVaultName; // fLogger.info("azureVaultAddress : " + azureVaultAddress); +//================================================================================================================== +// hashicorp vault + vaultAddress = configMap.get(PROP_ADDRESS); + vaultCA = configMap.get(PROP_CA); + tlsSkipVerifyRaw = configMap.get(PROP_TLS_SKIP_VERIFY); + vaultUser = configMap.get(PROP_VAULT_USERNAME); + vaultPass = configMap.get(PROP_VAULT_PASSWORD); //================================================================================================================== } @@ -125,28 +118,6 @@ public Map resolve(Map args) { String credType = (String) args.get(ARG_TYPE); fLogger.info("credId: " + credId); fLogger.info("credType: " + credType); -//// windows, linux, unix creds -// String username = ""; -// String password = ""; -// String passphrase = ""; -// String private_key = ""; -//// azure creds -// String azureClientId = ""; -// String azureTenantId = ""; -// String azureSecretKey = ""; -//// aws creds -// String awsAccessKey = ""; -// String awsSecretKey = ""; -//// snmpv3 -// String snmpv3PrivacyCredId = null; -// Map snmpv3PrivacyKeyTags = new HashMap<>(); -// String snmpv3AuthProtocol = ""; -// String snmpv3AuthKey = ""; -// String snmpv3PrivacyProtocol = ""; -// String snmpv3PrivacyKey = ""; -// KeyVaultSecret snmpv3PrivacyCredSecret = null; - -// Map tags = new HashMap<>(); if(credId == null || credType == null) { throw new RuntimeException("Empty credential Id or type found."); @@ -178,73 +149,35 @@ public Map resolve(Map args) { } catch (IOException e){ throw new RuntimeException(e); } + } else if (isHashicorpVaultMatchingPattern(credId)) { + HashicorpVaultCredentialResolver hv = new HashicorpVaultCredentialResolver(); + try{ + result = hv.resolve(args, vaultAddress, vaultCA, tlsSkipVerifyRaw, vaultUser, vaultPass); + return result; + } catch (IOException e) { + throw new RuntimeException(e); + } + } else { + fLogger.info("No matching secret vault provider found, please reach out to https://github.com/arumugamsubramanian for implementation"); } return result; } - static boolean isNullOrEmpty(String str) { + + private static boolean isHashicorpVaultMatchingPattern(String input) { + // Check if the string starts with "hv/" and has additional characters + return input.startsWith("hv/") && input.length() > "hv/".length(); + } + + static public boolean isNullOrEmpty(String str) { if(str != null && !str.isEmpty()) return false; return true; } -// private static void disableSSLCertificateVerification() { -// try { -// // Create a custom TrustManager that accepts all certificates -// TrustManager[] trustAllCerts = new TrustManager[] { -// new X509TrustManager() { -// public X509Certificate[] getAcceptedIssuers() { -// return null; -// } -// -// public void checkClientTrusted(X509Certificate[] certs, String authType) { -// } -// -// public void checkServerTrusted(X509Certificate[] certs, String authType) { -// } -// } -// }; -// -// // Create an SSLContext with the custom TrustManager -// SSLContext sslContext = SSLContext.getInstance("TLS"); -// sslContext.init(null, trustAllCerts, new SecureRandom()); -// -// // Set the custom SSLContext as the default SSLContext -// HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory()); -// } catch (NoSuchAlgorithmException | KeyManagementException e) { -// e.printStackTrace(); -// } -// } - - public static OkHttpClient getTrustAllCertsClient() throws NoSuchAlgorithmException, KeyManagementException { - TrustManager[] trustAllCerts = new TrustManager[]{ - new X509TrustManager() { - @Override - public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) { - } - @Override - public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) { - } - - @Override - public java.security.cert.X509Certificate[] getAcceptedIssuers() { - return new java.security.cert.X509Certificate[]{}; - } - } - }; - - SSLContext sslContext = SSLContext.getInstance("SSL"); - sslContext.init(null, trustAllCerts, new java.security.SecureRandom()); - - OkHttpClient.Builder newBuilder = new OkHttpClient.Builder(); - newBuilder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0]); - newBuilder.hostnameVerifier((hostname, session) -> true); - newBuilder.protocols(Arrays.asList(Protocol.HTTP_1_1)); - return newBuilder.build(); - } - static boolean isNullOrEmptyMap(Map map) { + static public boolean isNullOrEmptyMap(Map map) { return (map == null || map.isEmpty()); } @@ -261,7 +194,13 @@ public String getVersion() { // TODO: Remove this before moving to production // public static void main(String[] args) { // CredentialResolver obj = new CredentialResolver(); -// obj.credentialFile = "/servicenow-ecs-multi-secret-vault/test/creds.properties"; +//// obj.credentialFile = "/servicenow-ecs-multi-secret-vault/test/creds.properties"; +// obj.vaultAddress = "http://127.0.0.1:8200"; +//// obj.vaultCA = getProperty.apply(PROP_CA); +// obj.tlsSkipVerifyRaw = String.valueOf(true); +//// obj.masterToken = "hvs.yxS5OatpCK6gG9tGusLZooXA"; +// obj.vaultUser = "servicenow"; +// obj.vaultPass = "servicenow"; // // use your local details for testing. //// obj.azureVaultName = "azurevaultname"; //// obj.azureVaultAddress = "https://xxx.vault.azure.net/"; @@ -270,7 +209,7 @@ public String getVersion() { //// obj.azureProxyPortProperty = Integer.parseInt("8080"); // Map map = new HashMap<>(); //// vault_type.cred ID from ServiceNow.cred type -// String credId = "filevault-linux"; +// String credId = "hv/secret/data/linux"; // String credType = "ssh_password"; // map.put(ARG_ID, credId); // map.put(ARG_TYPE, credType); diff --git a/src/com/snc/discovery/AzureKeyVaultCredentialResolver.java b/src/com/snc/discovery/azureKeyVault/AzureKeyVaultCredentialResolver.java similarity index 86% rename from src/com/snc/discovery/AzureKeyVaultCredentialResolver.java rename to src/com/snc/discovery/azureKeyVault/AzureKeyVaultCredentialResolver.java index 80ccc56..8ccede6 100644 --- a/src/com/snc/discovery/AzureKeyVaultCredentialResolver.java +++ b/src/com/snc/discovery/azureKeyVault/AzureKeyVaultCredentialResolver.java @@ -1,4 +1,4 @@ -package com.snc.discovery; +package com.snc.discovery.azureKeyVault; import com.azure.core.http.HttpClient; import com.azure.core.http.ProxyOptions; @@ -7,16 +7,22 @@ import com.azure.security.keyvault.secrets.SecretClient; import com.azure.security.keyvault.secrets.SecretClientBuilder; import com.azure.security.keyvault.secrets.models.KeyVaultSecret; +import com.snc.discovery.CredentialResolver; import okhttp3.OkHttpClient; +import okhttp3.Protocol; +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManager; +import javax.net.ssl.X509TrustManager; import java.io.IOException; import java.net.InetSocketAddress; import java.security.KeyManagementException; import java.security.NoSuchAlgorithmException; +import java.util.Arrays; import java.util.HashMap; import java.util.Map; -public class AzureKeyVaultCredentialResolver extends CredentialResolver{ +public class AzureKeyVaultCredentialResolver extends CredentialResolver { public static final String AZURE_KEY_VAULT_NAME_PROPERTY = "ext.cred.azure.vault.name"; public static final String PROXY_HOST_PROPERTY = "ext.cred.azure.vault.proxy.host"; @@ -203,4 +209,32 @@ public Map azureKeyVaultCredResolve(String credId, String credType, String azure throw new RuntimeException(e); } } + + public static OkHttpClient getTrustAllCertsClient() throws NoSuchAlgorithmException, KeyManagementException { + TrustManager[] trustAllCerts = new TrustManager[]{ + new X509TrustManager() { + @Override + public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) { + } + + @Override + public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) { + } + + @Override + public java.security.cert.X509Certificate[] getAcceptedIssuers() { + return new java.security.cert.X509Certificate[]{}; + } + } + }; + + SSLContext sslContext = SSLContext.getInstance("SSL"); + sslContext.init(null, trustAllCerts, new java.security.SecureRandom()); + + OkHttpClient.Builder newBuilder = new OkHttpClient.Builder(); + newBuilder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0]); + newBuilder.hostnameVerifier((hostname, session) -> true); + newBuilder.protocols(Arrays.asList(Protocol.HTTP_1_1)); + return newBuilder.build(); + } } diff --git a/src/com/snc/discovery/FileCredentialResolver.java b/src/com/snc/discovery/fileVault/FileCredentialResolver.java similarity index 89% rename from src/com/snc/discovery/FileCredentialResolver.java rename to src/com/snc/discovery/fileVault/FileCredentialResolver.java index 637800d..ed4f3ce 100644 --- a/src/com/snc/discovery/FileCredentialResolver.java +++ b/src/com/snc/discovery/fileVault/FileCredentialResolver.java @@ -1,4 +1,6 @@ -package com.snc.discovery; +package com.snc.discovery.fileVault; + +import com.snc.discovery.CredentialResolver; import java.util.*; import java.io.*; @@ -9,8 +11,8 @@ * This is invoked from CredentialResolver */ -public class FileCredentialResolver extends CredentialResolver{ - public static final String FILE_PATH = "mid.external_credentials.file.path"; +public class FileCredentialResolver extends CredentialResolver { + public static final String FILE_PATH = "ext.cred.file.path"; private Properties fProps; private void loadProps(String propFilePath) { @@ -40,7 +42,7 @@ public Map fileCredResolve(String credId, String credType, String credsFile) thr throw new RuntimeException(String.format("MID server property %s is empty but required", credsFile)); } - fLogger.info("aaaa" + credsFile); + fLogger.info("file location: " + credsFile); loadProps(credsFile); // the resolved credential is returned in a HashMap... diff --git a/src/com/snc/discovery/hashicorpVault/HashicorpVaultCredentialResolver.java b/src/com/snc/discovery/hashicorpVault/HashicorpVaultCredentialResolver.java new file mode 100644 index 0000000..10e4f9a --- /dev/null +++ b/src/com/snc/discovery/hashicorpVault/HashicorpVaultCredentialResolver.java @@ -0,0 +1,361 @@ +/* + * Copyright (c) HashiCorp, Inc. + * SPDX-License-Identifier: MPL-2.0 + */ + +package com.snc.discovery.hashicorpVault; + +import com.google.gson.Gson; +import com.google.gson.JsonObject; +import com.google.gson.JsonParser; +import com.service_now.mid.services.Config; +import org.apache.http.client.HttpResponseException; +import org.apache.http.client.methods.CloseableHttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpPost; +import org.apache.http.client.methods.HttpUriRequest; +import org.apache.http.entity.StringEntity; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.conn.ssl.SSLConnectionSocketFactory; + +import javax.net.ssl.SSLContext; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashMap; +import java.util.Map; +import java.util.Scanner; +import java.util.function.Function; + +public class HashicorpVaultCredentialResolver { + private static final CloseableHttpClient defaultHTTPClient = HttpClients.createDefault(); + private static final Gson gson = new Gson(); + private final Function getProperty; + + public HashicorpVaultCredentialResolver() { + getProperty = prop -> Config.get().getProperty(prop); + } + + public HashicorpVaultCredentialResolver(Function getProperty) { + this.getProperty = getProperty; + } + + // Populated keys on resolve's input `Map args` + public static final String ARG_ID = "id"; // the string identifier as configured on the ServiceNow instance + public static final String ARG_IP = "ip"; // a dotted-form string IPv4 address (like "10.22.231.12") of the target system + public static final String ARG_TYPE = "type"; // the string type (ssh, snmp, etc.) of credential + public static final String ARG_MID = "mid"; // the MID server making the request + + // Keys that may optionally be populated on resolve's output Map + public static final String VAL_USER = "user"; // the string user name for the credential + public static final String VAL_PSWD = "pswd"; // the string password for the credential + public static final String VAL_PASSPHRASE = "passphrase"; // the string pass phrase for the credential + public static final String VAL_PKEY = "pkey"; // the string private key for the credential + public static final String VAL_AUTHPROTO = "authprotocol"; // the string authentication protocol for the credential + public static final String VAL_AUTHKEY = "authkey"; // the string authentication key for the credential + public static final String VAL_PRIVPROTO = "privprotocol"; // the string privacy protocol for the credential + public static final String VAL_PRIVKEY = "privkey"; // the string privacy key for the credential + + public static final String PROP_ADDRESS = "mid.external_credentials.vault.address"; // The address of Vault Agent, as resolvable from the MID server + public static final String PROP_CA = "mid.external_credentials.vault.ca"; // The custom CA to trust in PEM format + public static final String PROP_TLS_SKIP_VERIFY = "mid.external_credentials.vault.tls_skip_verify"; // Whether to skip TLS verification + + public static final String PROP_VAULT_USERNAME = "mid.external_credentials.vault.username"; + public static final String PROP_VAULT_PASSWORD = "mid.external_credentials.vault.password"; + + /** + * Resolve a credential. + */ + public Map resolve(Map args, String vaultAddress, String vaultCA, String tlsSkipVerifyRaw, String vaultUser, String vaultPass) throws IOException { + + if (vaultAddress == null || vaultAddress.equals("")) { + throw new RuntimeException(String.format("MID server property %s is empty but required", PROP_ADDRESS)); + } + + boolean tlsSkipVerify = false; + if (tlsSkipVerifyRaw != null && !tlsSkipVerifyRaw.equals("")) { + tlsSkipVerify = Boolean.parseBoolean(tlsSkipVerifyRaw); + } + + String id = ((String) args.get(ARG_ID)).substring("hv/".length()); + String vaultSecretPath = "/v1/" + id; + String body = send(new HttpGet(vaultAddress + vaultSecretPath), vaultCA, tlsSkipVerify, vaultUser, vaultPass, vaultAddress); + System.err.println("Successfully queried Vault for credential id: "+id); + + Map result = extractKeys(body); + CredentialType type = lookupByName((String) args.get(ARG_TYPE)); + validateResult(result, type); + return result; + } + + /** + * Return the ServiceNow API version supported by this class. + */ + public String getVersion() { + return "1.0"; + } + + public static String send(HttpUriRequest req, String vaultCA, boolean tlsSkipVerify, String vaultUser, String vaultPass, String vaultAddress) throws IOException { + SSLContext sslContext; + try { + TLSConfig tlsConfig = new TLSConfig().verify(!tlsSkipVerify); + if (vaultCA != null && !vaultCA.equals("")) { + tlsConfig = tlsConfig.pemUTF8(vaultCA); + } + sslContext = tlsConfig.build().getSslContext(); + } catch (TLSConfig.TLSException e) { + throw new RuntimeException("Failed to configure SSL context: " + e); + } + + CloseableHttpClient httpClient; + if (sslContext != null) { + SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory( + sslContext, + null, + null, + SSLConnectionSocketFactory.getDefaultHostnameVerifier()); + httpClient = HttpClients.custom() + .setSSLSocketFactory(sslsf) + .build(); + } else { + httpClient = defaultHTTPClient; + } + +// get client token + String clientToken = getClientToken(new HttpPost(vaultAddress + "/v1/auth/servicenow/login/" + vaultUser), httpClient, vaultUser, vaultPass); + + String body = null; + req.setHeader("accept", "application/json"); + req.setHeader("X-Vault-Request", "true"); + req.setHeader("X-Vault-Token", clientToken); + try (CloseableHttpResponse response = httpClient.execute(req)) { + if (response.getEntity() != null) { + Scanner s = new Scanner(response.getEntity().getContent()).useDelimiter("\\A"); + body = s.hasNext() ? s.next() : ""; + } + + int status = response.getStatusLine().getStatusCode(); + if (status < 200 || status >= 300) { + String message = String.format("Failed to query Vault URL: %s.", req.getURI()); + // Try to parse the error as a Vault error and extract relevant fields. + try { + VaultError json = gson.fromJson(body, VaultError.class); + if (json != null) { + final String[] errors = json.getErrors(); + if (errors != null && errors.length > 0) { + message += String.format(" Errors: %s.", Arrays.toString(errors)); + } + final String[] warnings = json.getWarnings(); + if (warnings != null && warnings.length > 0) { + message += String.format(" Warnings: %s.", Arrays.toString(warnings)); + } + } + } catch (Exception e) { + // Failed to parse the body as a Vault error, just include the body. + message += "\n\n" + body; + } + + throw new HttpResponseException(status, message); + } + } + + return body; + } + + public static String getClientToken(HttpPost req, CloseableHttpClient httpClient, String vaultUser, String vaultPass) throws IOException { + String body = null; + String clientToken = null; + + String jsonData = "{\"password\": \""+ vaultPass + "\"}"; + // Set the request body as JSON data + StringEntity stringEntity = new StringEntity(jsonData); + req.setEntity(stringEntity); + req.setHeader("accept", "application/json"); + req.setHeader("X-Vault-Request", "true"); + try (CloseableHttpResponse response = httpClient.execute(req)) { + if (response.getEntity() != null) { + Scanner s = new Scanner(response.getEntity().getContent()).useDelimiter("\\A"); + body = s.hasNext() ? s.next() : ""; + } + + int status = response.getStatusLine().getStatusCode(); + if (status < 200 || status >= 300) { + String message = String.format("Failed to query Vault URL: %s.", req.getURI()); + // Try to parse the error as a Vault error and extract relevant fields. + try { + VaultError json = gson.fromJson(body, VaultError.class); + if (json != null) { + final String[] errors = json.getErrors(); + if (errors != null && errors.length > 0) { + message += String.format(" Errors: %s.", Arrays.toString(errors)); + } + final String[] warnings = json.getWarnings(); + if (warnings != null && warnings.length > 0) { + message += String.format(" Warnings: %s.", Arrays.toString(warnings)); + } + } + } catch (Exception e) { + // Failed to parse the body as a Vault error, just include the body. + message += "\n\n" + body; + } + + throw new HttpResponseException(status, message); + } else { + clientToken = extractClientToken(body); + } + } + return clientToken; + } + + private static String extractClientToken(String responseBody) { + JsonParser parser = new JsonParser(); + JsonObject jsonResponse = parser.parse(responseBody).getAsJsonObject(); + + // Navigate through the JSON structure to retrieve the client_token value + JsonObject authObject = jsonResponse.getAsJsonObject("auth"); + return authObject.get("client_token").getAsString(); + } + + private Map extractKeys(String vaultResponse) { + Gson gson = new Gson(); + VaultSecret secret = gson.fromJson(vaultResponse, VaultSecret.class); + JsonObject data = secret.getData(); + + if (data == null) { + throw new RuntimeException("No data found in Vault secret"); + } + + // Check for embedded "data" object to handle kv-v2. + if (data.has("data")) { + try { + data = data.get("data").getAsJsonObject(); + } catch (IllegalStateException e) { + // If it's not a JsonObject, then it's not kv-v2 and we use the top-level "Data" field. + } + } + + // access_key for AWS secret engine + ValueAndSource username = valueAndSourceFromData(data, "access_key", "username"); + // secret_key for AWS secret engine, current_password for AD secret engine + ValueAndSource password = valueAndSourceFromData(data, "secret_key", "current_password", "password"); + ValueAndSource privateKey = valueAndSourceFromData(data, "private_key"); + ValueAndSource passphrase = valueAndSourceFromData(data, "passphrase"); + + ValueAndSource authprotocol = valueAndSourceFromData(data, "authprotocol"); + ValueAndSource authkey = valueAndSourceFromData(data, "authkey"); + ValueAndSource privprotocol = valueAndSourceFromData(data, "privprotocol"); + ValueAndSource privkey = valueAndSourceFromData(data, "privkey"); + + System.err.printf("Setting values from fields %s=%s, %s=%s, %s=%s, %s=%s, %s=%s, %s=%s, %s=%s, %s=%s%n", + VAL_USER, username.source, + VAL_PSWD, password.source, + VAL_PKEY, privateKey.source, + VAL_PASSPHRASE, passphrase.source, + VAL_AUTHPROTO, authprotocol.source, + VAL_AUTHKEY, authkey.source, + VAL_PRIVPROTO, privprotocol.source, + VAL_PRIVKEY, privkey.source); + + HashMap result = new HashMap<>(); + if (username.value != null) { + result.put(VAL_USER, username.value); + } + if (password.value != null) { + result.put(VAL_PSWD, password.value); + } + if (privateKey.value != null) { + result.put(VAL_PKEY, privateKey.value); + } + if (passphrase.value != null) { + result.put(VAL_PASSPHRASE, passphrase.value); + } + if (authprotocol.value != null) { + result.put(VAL_AUTHPROTO, authprotocol.value); + } + if (authkey.value != null) { + result.put(VAL_AUTHKEY, authkey.value); + } + if (privprotocol.value != null) { + result.put(VAL_PRIVPROTO, privprotocol.value); + } + if (privkey.value != null) { + result.put(VAL_PRIVKEY, privkey.value); + } + + return result; + } + + public void validateResult(Map result, CredentialType type) { + if (result.size() == 0) { + throw new RuntimeException("No fields to extract from Vault secret"); + } + + if (type == null) { + return; + } + + for (String expected : type.expectedFields()) { + if (!result.containsKey(expected)) { + throw new RuntimeException(String.format("Expected '%s' field for credential type %s", expected, type.name())); + } + } + } + + private static final Map nameIndex = new HashMap<>(CredentialType.values().length); + static { + for (CredentialType type : CredentialType.values()) { + nameIndex.put(type.name(), type); + } + } + private static CredentialType lookupByName(String name) { + return nameIndex.get(name); + } + + enum CredentialType { + basic (new String[]{VAL_USER, VAL_PSWD}), + windows (new String[]{VAL_USER, VAL_PSWD}), + ssh_password (new String[]{VAL_USER, VAL_PSWD}), + vmware (new String[]{VAL_USER, VAL_PSWD}), + jdbc (new String[]{VAL_USER, VAL_PSWD}), + jms (new String[]{VAL_USER, VAL_PSWD}), + aws (new String[]{VAL_USER, VAL_PSWD}), + ssh_private_key (new String[]{VAL_USER, VAL_PKEY}), + sn_cfg_ansible (new String[]{VAL_USER, VAL_PKEY}), + sn_disco_certmgmt_certificate_ca (new String[]{VAL_USER, VAL_PKEY}), + cfg_chef_credentials (new String[]{VAL_USER, VAL_PKEY}), + infoblox (new String[]{VAL_USER, VAL_PKEY}), + api_key (new String[]{VAL_USER, VAL_PKEY}), + snmpv3 (new String[]{VAL_USER, VAL_AUTHPROTO, VAL_AUTHKEY, VAL_PRIVPROTO, VAL_PRIVKEY}); + private final String[] expectedFields; + + CredentialType(String[] expectedFields) { + this.expectedFields = expectedFields; + } + + public String[] expectedFields() { + return expectedFields; + } + } + + // Metadata class to help report which fields keys were extracted from. + private static class ValueAndSource { + private final String value; + private final String source; + + ValueAndSource(String value, String source) { + this.value = value; + this.source = source; + } + } + + // The first key that exists in data will be extracted and returned. + private ValueAndSource valueAndSourceFromData(JsonObject data, String ...keys) { + for (String key : keys) { + if (data.has(key)) { + return new ValueAndSource(data.get(key).getAsString(), key); + } + } + + return new ValueAndSource(null, null); + } +} diff --git a/src/com/snc/discovery/hashicorpVault/TLSConfig.java b/src/com/snc/discovery/hashicorpVault/TLSConfig.java new file mode 100644 index 0000000..bf82011 --- /dev/null +++ b/src/com/snc/discovery/hashicorpVault/TLSConfig.java @@ -0,0 +1,192 @@ +/* + * Copyright (c) HashiCorp, Inc. + * SPDX-License-Identifier: MPL-2.0 + */ + +package com.snc.discovery.hashicorpVault; + +import com.snc.discovery.CredentialResolver; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManager; +import javax.net.ssl.TrustManagerFactory; +import javax.net.ssl.X509TrustManager; +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.Serializable; +import java.nio.charset.StandardCharsets; +import java.security.KeyManagementException; +import java.security.KeyStore; +import java.security.KeyStoreException; +import java.security.NoSuchAlgorithmException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateFactory; +import java.security.cert.X509Certificate; + +/** + *

A container for SSL-related configuration options, meant to be stored within a {@link CredentialResolver} instance.

+ * + *

Borrowed from https://github.com/BetterCloud/vault-java-driver

+ * + *

Construct instances of this class using a builder pattern, calling setter methods for each value and then + * terminating with a call to build().

+ */ +public class TLSConfig implements Serializable { + + private static final long serialVersionUID = 1L; + + private boolean verify; + private transient SSLContext sslContext; + private String pemUTF8; // exposed to unit tests + private Boolean verifyObject; + + /** + * A dummy SSLContext, for use when SSL verification is disabled. Overwrites Java's default server certificate + * verification process, to always trust any certificates. + */ + private static SSLContext DISABLED_SSL_CONTEXT; + + static { + try { + DISABLED_SSL_CONTEXT = SSLContext.getInstance("TLS"); + DISABLED_SSL_CONTEXT.init(null, new TrustManager[]{new X509TrustManager() { + @Override + public void checkClientTrusted(final X509Certificate[] x509Certificates, final String s) throws CertificateException { + } + + @Override + public void checkServerTrusted(final X509Certificate[] x509Certificates, final String s) throws CertificateException { + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + return new X509Certificate[0]; + } + }}, new java.security.SecureRandom()); + } catch (NoSuchAlgorithmException | KeyManagementException e) { + e.printStackTrace(); + } + } + + /** + *

Whether or not HTTPS connections to the Vault server should verify that a valid SSL certificate is being + * used. Unless this is set to false, the default behavior is to always verify SSL certificates.

+ * + *

SSL CERTIFICATE VERIFICATION SHOULD NOT BE DISABLED IN PRODUCTION! This feature is made available to + * facilitate development or testing environments, where you might be using a self-signed cert that will not + * pass verification. However, even if you are using a self-signed cert on your Vault server, you can still leave + * SSL verification enabled and have your application supply the cert using pemFile(), + * pemResource(), or pemUTF8().

+ * + * @param verify Whether or not to verify the SSL certificate used by Vault with HTTPS connections. Default is true. + * @return This object, with verify populated, ready for additional builder-pattern method calls or else finalization with the build() method + */ + public TLSConfig verify(final boolean verify) { + this.verifyObject = verify; + return this; + } + + /** + *

An X.509 certificate, to use when communicating with Vault over HTTPS. This method accepts a string + * containing the certificate data. This string should meet the following requirements:

+ * + *
    + *
  • Contain an unencrypted X.509 certificate, in PEM format.
    • + *
  • Use UTF-8 encoding.
    • + *
  • + * Contain a line-break between the certificate header (e.g. "-----BEGIN CERTIFICATE-----") and the + * rest of the certificate content. It doesn't matter whether or not there are additional line + * breaks within the certificate content, or whether there is a line break before the certificate + * footer (e.g. "-----END CERTIFICATE-----"). But the Java standard library will fail to properly + * process the certificate without a break following the header + * (see http://www.doublecloud.org/2014/03/reading-x-509-certificate-in-java-how-to-handle-format-issue/). + *
    • + *
+ * + *

If no certificate data is provided, either by this method or pemFile() + * or pemResource(), then TLSConfig will look to the + * VAULT_SSL_CERT environment variable.

+ * + * @param pemUTF8 An X.509 certificate, in unencrypted PEM format with UTF-8 encoding. + * @return This object, with pemUTF8 populated, ready for additional builder-pattern method calls or else finalization with the build() method + */ + public TLSConfig pemUTF8(final String pemUTF8) { + this.pemUTF8 = pemUTF8; + return this; + } + + /** + *

This is the terminating method in the builder pattern. The method that validates all of the fields that + * has been set already, uses environment variables when available to populate any unset fields, and returns + * a TLSConfig object that is ready for use.

+ * + * @return This object, with all available config options parsed and loaded + * @throws TLSException If SSL certificate verification is enabled, and any problem occurs while trying to build an SSLContext + */ + public TLSConfig build() throws TLSException { + this.verify = true; + if (this.verifyObject != null) { + this.verify = verifyObject; + } + + if (verify && pemUTF8 != null) { + this.sslContext = buildSslContextFromPem(); + } else if (!verify) { + this.sslContext = DISABLED_SSL_CONTEXT; + } + return this; + } + + public boolean isVerify() { + return verify; + } + + public SSLContext getSslContext() { + return sslContext; + } + + protected String getPemUTF8() { + return pemUTF8; + } + + /** + * Constructs an SSLContext, when server cert data was provided in PEM format. + * + * @return An SSLContext, constructed with the PEM data supplied. + * @throws TLSException + */ + private SSLContext buildSslContextFromPem() throws TLSException { + try { + final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); + + TrustManager[] trustManagers = null; + if (pemUTF8 != null) { + final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + // Convert the trusted servers PEM data into an X509Certificate + X509Certificate certificate; + try (final ByteArrayInputStream pem = new ByteArrayInputStream(pemUTF8.getBytes(StandardCharsets.UTF_8))) { + certificate = (X509Certificate) certificateFactory.generateCertificate(pem); + } + // Build a truststore + final KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); + keyStore.load(null); + keyStore.setCertificateEntry("caCert", certificate); + trustManagerFactory.init(keyStore); + trustManagers = trustManagerFactory.getTrustManagers(); + } + + final SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, trustManagers, null); + return sslContext; + } catch (CertificateException | IOException | NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) { + throw new TLSException(e); + } + } + + public static class TLSException extends Exception { + + public TLSException(final Throwable t) { + super(t); + } + } +} diff --git a/src/com/snc/discovery/hashicorpVault/VaultError.java b/src/com/snc/discovery/hashicorpVault/VaultError.java new file mode 100644 index 0000000..0477965 --- /dev/null +++ b/src/com/snc/discovery/hashicorpVault/VaultError.java @@ -0,0 +1,19 @@ +/* + * Copyright (c) HashiCorp, Inc. + * SPDX-License-Identifier: MPL-2.0 + */ + +package com.snc.discovery.hashicorpVault; + +public class VaultError { + private String[] warnings; + private String[] errors; + + public String[] getWarnings() { + return warnings; + } + + public String[] getErrors() { + return errors; + } +} diff --git a/src/com/snc/discovery/hashicorpVault/VaultSecret.java b/src/com/snc/discovery/hashicorpVault/VaultSecret.java new file mode 100644 index 0000000..1ef540a --- /dev/null +++ b/src/com/snc/discovery/hashicorpVault/VaultSecret.java @@ -0,0 +1,21 @@ +/* + * Copyright (c) HashiCorp, Inc. + * SPDX-License-Identifier: MPL-2.0 + */ + +package com.snc.discovery.hashicorpVault; + +import com.google.gson.JsonObject; + +public class VaultSecret { + private JsonObject data; + private String[] warnings; + + public JsonObject getData() { + return data; + } + + public String[] getWarnings() { + return warnings; + } +}