From 3a71d5761922d584cc48ae5e627af380ec9db778 Mon Sep 17 00:00:00 2001 From: TekH Date: Thu, 8 Oct 2026 10:31:00 +0200 Subject: [PATCH] Enhance FES docs, plans, and SoftHSM integration Updated README.md for clarity and added official references. Introduced detailed infrastructure and integration plans for FES, including phased implementation, deployment options, and risk mitigations. Added FES workflow diagrams in draw.io and PDF formats. Documented SoftHSM testing process and integration details in ticket.md. Improved alignment with clean architecture principles and production readiness. --- .../README.md | 484 +++++++++--------- .../resources/INFRASTRUCTURE_PLAN.md | 301 +++++++++++ .../resources/INTEGRATION_PLAN.md | 228 +++++++++ .../resources/flow-diagram.drawio | 172 +++++++ .../resources/flow-diagram.pdf | Bin 0 -> 85245 bytes .../resources/ticket.md | 84 +++ 6 files changed, 1022 insertions(+), 247 deletions(-) create mode 100644 EnvelopeGenerator.Infrastructure.Crypt/resources/INFRASTRUCTURE_PLAN.md create mode 100644 EnvelopeGenerator.Infrastructure.Crypt/resources/INTEGRATION_PLAN.md create mode 100644 EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.drawio create mode 100644 EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.pdf create mode 100644 EnvelopeGenerator.Infrastructure.Crypt/resources/ticket.md diff --git a/EnvelopeGenerator.Infrastructure.Crypt/README.md b/EnvelopeGenerator.Infrastructure.Crypt/README.md index 4dab4888..678b7abb 100644 --- a/EnvelopeGenerator.Infrastructure.Crypt/README.md +++ b/EnvelopeGenerator.Infrastructure.Crypt/README.md @@ -1,67 +1,83 @@ # EnvelopeGenerator.Infrastructure.Crypt -This project provides PKCS#11-based cryptographic infrastructure for FES (Advanced Electronic Signature) workflows. +PKCS#11-based cryptographic infrastructure for FES (Advanced Electronic Signature) workflows. -If you are new to HSM/SoftHSM: this README is written to let you start from zero and still understand the full path from setup to testing. +Official references: + +- SoftHSMv2 (official): `https://github.com/softhsm/SoftHSMv2` +- OpenSC `pkcs11-tool` docs: `https://github.com/OpenSC/OpenSC/wiki/Using-pkcs11-tool-and-OpenSSL` +- PKCS#11 standard overview (OASIS): `https://www.oasis-open.org/committees/pkcs11/` --- -## 1) What this project is (and what it is not) +## 1) Scope -This project is the cryptography layer only. +This project is the crypto layer only. -- It signs hashes using private keys stored in HSM/SoftHSM. -- It reads certificates from HSM/SoftHSM. -- It verifies signatures. -- It exposes service abstractions for Application/Server integration. +- Signs hashes via keys in HSM/SoftHSM. +- Reads certificates from HSM/SoftHSM. +- Verifies signatures. +- Exposes abstractions for Application/Server integration. -It is **not**: +This project is not: -- a REST API by itself, -- a UI component, -- a full document workflow orchestrator. +- a REST API, +- a UI module, +- a full document orchestration workflow. --- -## 2) SoftHSM and PKCS#11 in one minute +## 2) SoftHSM and PKCS#11 basics -- `SoftHSMv2` is a software HSM implementation. -- It does **not** provide a REST endpoint. -- You access it through a PKCS#11 library/module (`.so`/`.dll`). -- Your app loads that library and calls PKCS#11 functions. +- SoftHSM is a software implementation of an HSM. +- It does not expose REST endpoints. +- Access is via PKCS#11 shared library (`.so`/`.dll`). +- App loads module path and performs PKCS#11 operations. -Two deployment patterns are possible: +Supported deployment patterns: -1. **Direct local module** - - Example library path: `libsofthsm2.so` -2. **PKCS#11 proxy module (remote HSM/SoftHSM)** - - Example library path: `libpkcs11-proxy.so` or proxy DLL +1. Direct module (`libsofthsm2.so`, `softhsm2-x64.dll`, etc.) +2. PKCS#11 proxy module (remote HSM/SoftHSM backend) -Both are valid for this project. +Critical platform rule: + +- A Windows process cannot load a Linux `.so` directly. +- `Crypt:Pkcs11:LibraryPath` must always point to a native library compatible with the host OS of `EnvelopeGenerator.Server`. --- -## 3) How this maps to the FES diagram (Ablauf SignFlow Unternehmenszertifikat) +## 2.1) Windows Server + Linux SoftHSM architecture (decision TODO) -From the shared draw.io/PDF process: +Current business requirement: `EnvelopeGenerator.Server` runs on Windows, SoftHSM runs on Linux. -- Step 6: Backend computes document hash and sends it with PIN context to HSM. - - Implemented by: `ISignatureProvider` / `Pkcs11SignatureProvider` -- Step 7: HSM returns digital signature (and cert context can be resolved). - - Implemented by: `Pkcs11SignatureProvider` + `ICertificateProvider` -- Step 8: Backend embeds signature + certificate into PDF and creates audit trail. - - This project provides crypto primitives for this step. - - PDF embedding and audit document composition are integrated in later layers. +This repository must use one of the following three paths: -So this project is the cryptographic core for diagram steps 6-8. +1. Linux signing service (recommended) + - Windows `EnvelopeGenerator.Server` calls HTTPS signing API. + - Linux service performs PKCS#11 operations against SoftHSM. + - Private keys stay on Linux. +2. PKCS#11 proxy bridge + - Windows app loads a Windows PKCS#11 proxy client DLL. + - Proxy forwards operations to Linux-side PKCS#11 endpoint connected to SoftHSM. +3. Local Windows SoftHSM (dev/test only, optional) + - SoftHSM is also installed on Windows. + - App talks to local Windows PKCS#11 module. -Actor mapping from the diagram: +TODO - architecture lock-in: -- `Ersteller` (sender): creates envelope and defines recipients. -- `Signierer` (recipient/signer): completes 2FA and signs. -- `Backend` (our stack): computes hash, requests HSM signature, embeds proof in PDF. -- `HSM/SoftHSM`: stores private keys and performs cryptographic signing. -- `CA`: issues/renews certificates. +- [ ] Select one path as production standard (`1` is recommended). +- [ ] Document final runtime topology (hosts, ports, TLS, auth). +- [ ] Define where audit metadata (IP/email/phone/device) is stored and signed/linked. +- [ ] Update `SignatureController.Submit` integration contract for FES branch. +- [ ] Add environment-specific runbook for Windows host + Linux HSM operations. + +--- + +## 3) FES flow mapping + +- Step 6: hash is sent to HSM signing operation -> `ISignatureProvider` +- Step 7: signature and certificate context are resolved -> `Pkcs11SignatureProvider`, `ICertificateProvider` +- Step 8: PDF embedding + audit trail are completed by upper layers; this project provides crypto primitives --- @@ -80,19 +96,17 @@ DI entry point: --- -## 5) Required configuration +## 5) Runtime configuration Configuration section: `Crypt:Pkcs11` -Typical keys: - ```json { "Crypt": { "Pkcs11": { "LibraryPath": "/usr/lib/softhsm/libsofthsm2.so", - "SlotId": 0, - "TokenLabel": null, + "SlotId": 1720207650, + "TokenLabel": "DevToken", "UserPin": "***", "PrivateKeyLabel": "sign-key", "PrivateKeyIdHex": null, @@ -103,297 +117,273 @@ Typical keys: } ``` -Security rule: +Security rules: -- Do not commit real PINs to source control. -- Use environment variables / secret vault for production. +- Never commit real PINs. +- Use environment variables or secret vault. +- Use test-only tokens for development. + +Production naming convention used in this repository: + +- Token label: `CompanyProdToken` +- Private key label: `company-sign-key-v1` +- Certificate label: `company-sign-cert-v1` + +These names are also exposed as constants in `EnvelopeGenerator.Infrastructure.Crypt/Options/Pkcs11ProviderOptions.cs`. --- -## 6) The 5 test values you must provide +## 6) Test configuration source -Integration tests need these environment variables: +Crypt tests read PKCS#11 values from `EnvelopeGenerator.Tests/appsettings.json` under `Crypt:Pkcs11`. -- `FES_TEST_PKCS11_LIBRARY_PATH` -- `FES_TEST_PKCS11_SLOT_ID` -- `FES_TEST_PKCS11_USER_PIN` -- `FES_TEST_PKCS11_PRIVATE_KEY_LABEL` -- `FES_TEST_PKCS11_CERTIFICATE_LABEL` +Required keys: -Without these values, integration tests are skipped by design. +- `Crypt:Pkcs11:LibraryPath` +- `Crypt:Pkcs11:SlotId` (or `Crypt:Pkcs11:TokenLabel`) +- `Crypt:Pkcs11:UserPin` +- `Crypt:Pkcs11:PrivateKeyLabel` +- `Crypt:Pkcs11:CertificateLabel` -## 6.1 Which certificate/key should be created? - -This is the most important business decision for IT and architecture. - -Based on your shared diagram, the **primary model** is: - -- one **company certificate + company key pair** in HSM, -- reused for all signers, -- signer identity proven by audit-trail + 2FA evidence. - -What this means in practical terms: - -- Not one key per sender. -- Not one key per recipient by default. -- One company signing identity, many signing events. - -Alternative model (future/optional): - -- per-signer certificate/key pair (more complex CA lifecycle). - -For current fast validation and your FES flow, use the **company-level key/certificate** model. +No environment variable is required for crypt tests in this repository anymore. --- -## 7) How to obtain these values (IT-friendly) +## 7) Full SoftHSM lifecycle runbook (project scope) -## 7.1 If you use direct SoftHSM module - -### A) Find module path - -What it is: - -- PKCS#11 shared library file used by the app to talk to SoftHSM. - -Why needed: - -- Without this exact file path, PKCS#11 cannot be loaded. - -Linux examples: +### 7.1 Discover module path ```bash ldconfig -p | grep softhsm find /usr -name "libsofthsm2.so" 2>/dev/null ``` -Use the resolved full path as `FES_TEST_PKCS11_LIBRARY_PATH`. - -### B) List slots/tokens - -What it is: - -- Slot: logical container position in PKCS#11. -- Token: initialized security container in a slot. - -Why needed: - -- The app must know which slot/token contains the company key and certificate. +### 7.2 List slots/tokens ```bash softhsm2-util --show-slots ``` -Pick your slot as `FES_TEST_PKCS11_SLOT_ID`. - -### C) Identify key and certificate labels - -What it is: - -- `Private key label`: name of the signing private key object. -- `Certificate label`: name of the matching X.509 certificate object. - -Why needed: - -- Tests and runtime use labels to select correct objects in HSM. - -Use `pkcs11-tool` against your module: +### 7.3 Create new token (recommended for new company/test tenant) ```bash -pkcs11-tool --module /path/to/libsofthsm2.so --slot --login --pin --list-objects +softhsm2-util --init-token --slot --label --so-pin --pin ``` -From output: +Important: -- private key label -> `FES_TEST_PKCS11_PRIVATE_KEY_LABEL` -- certificate label -> `FES_TEST_PKCS11_CERTIFICATE_LABEL` +- After init, token is reassigned to a new slot id. +- Re-run `--show-slots` and use the new slot id. -### D) User PIN - -What it is: - -- User authorization secret to open authenticated session on token. - -Why needed: - -- HSM will not allow signing with private key without login. - -PIN is assigned during token initialization and must be provided by IT/security team. - -### E) Optional: Initialize token and create objects (Linux quick bootstrap) - -Only if token/keys are not already provisioned by IT PKI team. +### 7.4 Login and inspect objects ```bash -# 1) Initialize token in slot 0 (example) -softhsm2-util --init-token --slot 0 --label "CompanySignToken" +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin --list-objects +``` -# 2) Verify slot/token -softhsm2-util --show-slots +### 7.5 Generate company signing key pair -# 3) Generate RSA key pair inside token (example) -pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot 0 --login --pin \ +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin \ --keypairgen --key-type rsa:3072 --label sign-key --id 01 +``` -# 4) Import certificate (already issued by CA) -pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot 0 --login --pin \ +### 7.6 Import company certificate + +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin \ --write-object company-sign-cert.der --type cert --label sign-cert --id 01 - -# 5) List objects and confirm labels -pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot 0 --login --pin --list-objects ``` -Notes: +### 7.7 Read object metadata (for diagnostics) -- Use this only in non-production unless approved. -- In production, key generation/import should follow company security policy. +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin --list-objects +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin --list-mechanisms +``` -## 7.2 If you use PKCS#11 proxy module +### 7.8 Update operations -What it is: +PKCS#11 objects are usually immutable for key/cert payload; updates are done by rotation: -- A local PKCS#11 bridge library that forwards calls to remote HSM/SoftHSM service. +1. Create/import new key/cert with new label or id. +2. Update app config/env labels. +3. Validate with integration tests. +4. Delete old objects when safe. -Why needed: +PIN operations: -- App still loads a local module path, but crypto operations happen remotely. +- User PIN change (while logged in): -Ask IT for: +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin --change-pin --new-pin +``` -- proxy module path (`libpkcs11-proxy.*`) -- slot id or token label -- user pin -- private key label -- certificate label +- User PIN reset via SO credentials: -In proxy mode, values come from proxy-backed token, not local SoftHSM token files. +```bash +softhsm2-util --init-pin --slot --so-pin --pin +``` + +### 7.9 Delete operations + +Delete by label/id/type: + +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin \ + --delete-object --type cert --label sign-cert +``` + +Token-level destructive reset (do not use unless approved): + +```bash +softhsm2-util --delete-token --token +``` --- -## 7.3 Linux handover checklist for IT (copy/paste friendly) +## 8) New company onboarding checklist -1. Confirm module path exists (`libsofthsm2.so` or proxy module). -2. Confirm token exists and slot id is known. -3. Confirm company private key label and certificate label. -4. Confirm user PIN for test environment. -5. Share these five values securely with development team. +For company-level signing model (one company key/cert pair): + +1. Create token with company label (or assign dedicated token in remote HSM). +2. Generate key pair in token. +3. Obtain CA certificate and import into token. +4. Record secure runtime values: + - module path + - slot id or token label + - user pin + - private key label + - certificate label +5. Run crypt integration tests. +6. Store values in vault and wire app environment. --- -## 8) Test execution checklist (single command flow) +## 9) Rotation/update checklist -## 8.1 Set environment variables +1. Create new key/cert (`sign-key-v2`, `sign-cert-v2`). +2. Configure app env to new labels. +3. Run integration tests. +4. Deploy. +5. Keep old key/cert during grace period. +6. Remove old key/cert after legal/operational confirmation. -PowerShell example: +--- -```powershell -$env:FES_TEST_PKCS11_LIBRARY_PATH = "" -$env:FES_TEST_PKCS11_SLOT_ID = "" -$env:FES_TEST_PKCS11_USER_PIN = "" -$env:FES_TEST_PKCS11_PRIVATE_KEY_LABEL = "" -$env:FES_TEST_PKCS11_CERTIFICATE_LABEL = "" -``` +## 10) Running tests -Linux (bash) example: +Before running, configure `EnvelopeGenerator.Tests/appsettings.json` -> `Crypt:Pkcs11` with real Linux SoftHSM values. + +Run crypt tests: ```bash -export FES_TEST_PKCS11_LIBRARY_PATH="/usr/lib/softhsm/libsofthsm2.so" -export FES_TEST_PKCS11_SLOT_ID="0" -export FES_TEST_PKCS11_USER_PIN="" -export FES_TEST_PKCS11_PRIVATE_KEY_LABEL="sign-key" -export FES_TEST_PKCS11_CERTIFICATE_LABEL="sign-cert" -``` - -Verify env values quickly: - -```bash -echo "$FES_TEST_PKCS11_LIBRARY_PATH" -echo "$FES_TEST_PKCS11_SLOT_ID" -echo "$FES_TEST_PKCS11_PRIVATE_KEY_LABEL" -echo "$FES_TEST_PKCS11_CERTIFICATE_LABEL" -``` - -## 8.2 Run only crypt tests - -```powershell dotnet test "EnvelopeGenerator.Tests/EnvelopeGenerator.Tests.csproj" -f net8.0 --filter "FullyQualifiedName~EnvelopeGenerator.Tests.Application.Crypt" ``` -Expected: +--- -- Unit tests pass always. -- Integration tests pass when env values are correct. -- Integration tests skip when env values are missing. +## 11) Common failures -If all five values are correct: - -- integration tests run automatically, -- no code change is required, -- only environment setup is required. +- `CKR_PIN_INCORRECT`: wrong user pin for that token. +- `CRYPT_PROVIDER_UNAVAILABLE`: bad module path or native load issue. +- `CRYPT_SLOT_NOT_FOUND`: wrong slot id or token label. +- `CRYPT_LOGIN_FAILED`: login failed (pin/token mismatch). +- `CRYPT_KEY_NOT_FOUND`: key label/id mismatch. +- `CRYPT_CERT_NOT_FOUND`: certificate label/id mismatch. --- -## 9) Common failure meanings +## 12) Integration note -- `CRYPT_PROVIDER_UNAVAILABLE` - - invalid library path, missing native dependency, provider cannot load -- `CRYPT_SLOT_NOT_FOUND` - - wrong slot id or token label -- `CRYPT_LOGIN_FAILED` - - wrong PIN -- `CRYPT_KEY_NOT_FOUND` - - private key label/id mismatch -- `CRYPT_CERT_NOT_FOUND` - - certificate label/id mismatch - -This is exactly what IT needs for first-level diagnostics. +Current implementation uses `CKM_SHA256_RSA_PKCS` while caller provides hash bytes. Validate mechanism semantics in your provider/HSM policy. If provider expects raw payload instead of digest for selected mechanism, signing flow must be adjusted. --- -## 10) Integration in the full stack architecture +## 13) Production-first onboarding (single-line checkpoints) -Current role by layer: +This section is the authoritative path for production-style setup (critical documents, FES). -- `Infrastructure.Crypt` (this project): PKCS#11 crypto operations -- `Application`: orchestration use-cases and business process steps -- `Server`: API endpoints and presentation concerns +### 13.1 Step 1 - Initialize dedicated company token -Recommended integration path: +One-line command: -1. Stabilize crypt tests and environment setup (this stage). -2. Integrate `ISignatureProvider` + `ICertificateProvider` into Application command flow. -3. Connect Application flow to Server endpoints. -4. Add PDF embedding and audit-trail generation for full step-8 compliance. -5. Add archiving/distribution orchestration for steps 9-10. +```bash +mkdir -p ./fes-prod && cd ./fes-prod && export SO_PIN="$(openssl rand -hex 16)" USER_PIN="$(openssl rand -hex 12)" && softhsm2-util --init-token --slot --label CompanyProdToken --so-pin "$SO_PIN" --pin "$USER_PIN" && softhsm2-util --show-slots +``` ---- +Checkpoint: -## 11) Important note about signing semantics +- Token appears as initialized with label `CompanyProdToken`. +- SoftHSM reassigns token to a new slot ID; use that slot ID in all next commands. -PKCS#11 mechanisms differ in whether they expect raw data or a precomputed digest. +Security note: -Current implementation signs with `CKM_SHA256_RSA_PKCS` and receives hash bytes from caller. -This must be validated in your real provider environment. +- Do not print/store PINs in shell history in real production operations. +- Persist secrets in a vault or protected secret store. -If provider expects raw data for this mechanism, integration may require adjustment. -This is why integration tests are critical. +### 13.2 Step 2 - Generate company signing key pair inside HSM ---- +One-line command: -## 12) Quick FAQ +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin "$USER_PIN" --keypairgen --key-type rsa:3072 --label company-sign-key-v1 --id 01 && pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin "$USER_PIN" --list-objects +``` -**Q: Do I need REST calls to SoftHSM?** +Checkpoint: -No. SoftHSM is not a REST server. Use PKCS#11 library calls. +- `Private Key Object` and `Public Key Object` exist for label `company-sign-key-v1`, id `01`. +- Private key remains non-extractable in token. -**Q: Can I use proxy and still call it SoftHSM setup?** +### 13.3 Step 3 - Obtain CA-issued certificate for HSM key -Yes. Proxy can forward to SoftHSM-backed token infrastructure. +Required policy: -**Q: Once I provide the 5 values, can tests run directly?** +- Certificate must be issued by enterprise CA for the key generated in token. +- Do not use self-signed cert for production signing identity. -Yes. Set env vars and run the single `dotnet test` command above. +Operational note: -**Q: Will one company cert/key be enough for this phase?** +- CSR generation method depends on installed PKCS#11 OpenSSL integration (`engine_pkcs11` / provider). +- After CA issues certificate, import certificate DER into token with matching id/label family. -Yes, for the diagram-aligned company-signing model, one company key/certificate is enough for initial implementation and validation. +OpenSSL 3 prerequisite check: + +```bash +openssl version && openssl engine -t -c 2>/dev/null | grep -i pkcs11 || true +``` + +If no PKCS#11 engine/provider is listed, install integration packages first (distribution specific), then continue. + +### 13.4 Step 4 - Import CA certificate into token + +One-line command: + +```bash +pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin "$USER_PIN" --write-object ./company-sign-cert-v1.der --type cert --id 01 --label company-sign-cert-v1 && pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --slot --login --pin "$USER_PIN" --list-objects +``` + +Checkpoint: + +- `Certificate Object` exists with id `01` and expected label. + +### 13.5 Step 5 - Wire runtime/test configuration + +Server runtime (`EnvelopeGenerator.Server/EnvelopeGenerator.Server/appsettings.json`) must include: + +- `Crypt:Pkcs11:LibraryPath` = native PKCS#11 library path for the server host OS + - Windows host: Windows DLL path (vendor DLL or proxy client DLL) + - Linux host: Linux `.so` path +- `Crypt:Pkcs11:SlotId` = `2021549410` (or current company slot) +- `Crypt:Pkcs11:TokenLabel` = `CompanyProdToken` +- `Crypt:Pkcs11:UserPin` = real user pin +- `Crypt:Pkcs11:PrivateKeyLabel` = `company-sign-key-v1` +- `Crypt:Pkcs11:CertificateLabel` = `company-sign-cert-v1` + +Test runtime (`EnvelopeGenerator.Tests/appsettings.json`) must mirror the same `Crypt:Pkcs11` values. + +Then run tests: + +```bash +dotnet test "EnvelopeGenerator.Tests/EnvelopeGenerator.Tests.csproj" -f net8.0 --filter "FullyQualifiedName~EnvelopeGenerator.Tests.Application.Crypt" +``` diff --git a/EnvelopeGenerator.Infrastructure.Crypt/resources/INFRASTRUCTURE_PLAN.md b/EnvelopeGenerator.Infrastructure.Crypt/resources/INFRASTRUCTURE_PLAN.md new file mode 100644 index 00000000..d877e878 --- /dev/null +++ b/EnvelopeGenerator.Infrastructure.Crypt/resources/INFRASTRUCTURE_PLAN.md @@ -0,0 +1,301 @@ +# FES Signature Infrastructure Plan + +## 1. Goal + +Build a reusable and modular cryptography infrastructure in `EnvelopeGenerator.Infrastructure.Crypt` to support FES (Advanced Electronic Signature) workflows. + +This module must: + +- use PKCS#11 providers (SoftHSMv2 first, real HSM later), +- stay independent from UI/API concerns, +- expose clean interfaces to `Application` layer use-cases, +- support future extensions (timestamping, certificate chain validation, multiple key algorithms). + +--- + +## 2. Context and Constraints + +1. SoftHSMv2 is **not** a REST service. It is a PKCS#11 module loaded as a native library. +2. `EnvelopeGenerator.Server` is presentation only; cryptographic implementation belongs to infrastructure. +3. Clean Architecture boundaries must be respected: + - `Application` depends on abstractions. + - `Infrastructure.Crypt` implements abstractions. +4. Initial target framework is `net8.0`. +5. We need production-ready behavior, not only PoC signing. + +--- + +## 3. High-Level Design + +## 3.1 Architecture slice + +- **Application layer (contracts/use-cases):** + - request signing hash/document, + - request certificate/public key material, + - request verification, + - consume signature evidence result. + +- **Infrastructure.Crypt layer (this project):** + - PKCS#11 session handling, + - key/certificate object discovery, + - hash signing operations, + - local cryptographic verification, + - certificate parsing helpers, + - error normalization. + +## 3.2 Provider model + +Define provider-agnostic APIs and add one concrete provider first: + +- `Pkcs11SignatureProvider` (primary) +- future providers: + - `RemoteSigningProvider` (if a dedicated signing gateway is introduced) + - `MockSignatureProvider` (for deterministic test scenarios) + +--- + +## 4. Deliverables (Phase by Phase) + +## Phase 0 - Contracts and Domain Language + +Create neutral models and interfaces in `Infrastructure.Crypt` (or shared abstractions if needed later): + +- `SigningAlgorithm` (enum/value object) +- `Pkcs11ProviderOptions` +- `KeyLocator` (label/id/slot/token selectors) +- `SignHashRequest` +- `SignHashResult` +- `VerifySignatureRequest` +- `VerifySignatureResult` +- `CertificateDescriptor` +- `SignatureEvidence` (technical evidence payload) + +Interfaces: + +- `ISignatureProvider` +- `ICertificateProvider` +- `ISignatureVerifier` +- `ICryptographicHealthCheck` + +Acceptance criteria: + +- no dependency on ASP.NET types, +- no UI/API naming leakage, +- all model names are business-neutral. + +## Phase 1 - PKCS#11 Core Adapter (SoftHSM-ready) + +Implement: + +- `Pkcs11LibraryLoader` +- `Pkcs11SessionFactory` +- `Pkcs11ObjectFinder` +- `Pkcs11SignatureProvider` +- `Pkcs11CertificateProvider` + +Capabilities: + +1. load module path from options (`libsofthsm2.so` or proxy module when required), +2. enumerate slots/tokens, +3. open read-write session, +4. login with user pin, +5. find private key by label/id, +6. sign digest with selected mechanism, +7. read certificate object by label/id. + +Acceptance criteria: + +- deterministic disposal of sessions, +- no leaked native handles, +- detailed typed errors (not raw exception strings only). + +## Phase 2 - Verification and Certificate Utilities + +Implement: + +- `DefaultSignatureVerifier` +- `X509CertificateParser` +- optional `CertificateChainValidator` (toggleable) + +Capabilities: + +1. verify signature using returned certificate/public key, +2. expose certificate metadata (`thumbprint`, `subject`, `issuer`, `notBefore`, `notAfter`), +3. map validation failures into stable error codes. + +Acceptance criteria: + +- same request yields same verification outcome, +- invalid signature returns structured negative result. + +## Phase 3 - Evidence Builder + +Implement: + +- `SignatureEvidenceBuilder` + +Evidence payload should contain: + +- transaction/correlation id, +- algorithm, +- hash metadata, +- key locator snapshot (safe subset), +- certificate fingerprint and subject, +- sign timestamp (UTC), +- verification outcome, +- provider type (`PKCS11`). + +Acceptance criteria: + +- no secret values in evidence (pin, private key id internals), +- evidence serializable for storage/audit. + +## Phase 4 - Dependency Injection Module + +Implement: + +- `CryptInfrastructureDependencyInjection` extension methods + +Methods: + +- `AddCryptInfrastructure(...)` +- `AddPkcs11Provider(...)` + +Acceptance criteria: + +- one-line registration from composition root, +- options validation on startup. + +## Phase 5 - Test Suite (`EnvelopeGenerator.Tests`) + +Add test categories for `net8.0`: + +1. `Unit`: + - request validation, + - algorithm mapping, + - evidence building, + - error mapping. +2. `Integration` (conditional/manual profile): + - SoftHSM slot listing, + - login, + - sign hash, + - verify, + - certificate read. + +Acceptance criteria: + +- unit tests run in CI without native SoftHSM, +- integration tests run when module path + pins are provided via environment variables. + +--- + +## 5. Proposed Project Structure + +```text +EnvelopeGenerator.Infrastructure.Crypt/ + Abstractions/ + ISignatureProvider.cs + ICertificateProvider.cs + ISignatureVerifier.cs + ICryptographicHealthCheck.cs + Models/ + SigningAlgorithm.cs + SignHashRequest.cs + SignHashResult.cs + VerifySignatureRequest.cs + VerifySignatureResult.cs + SignatureEvidence.cs + CertificateDescriptor.cs + KeyLocator.cs + Options/ + Pkcs11ProviderOptions.cs + Pkcs11/ + Pkcs11LibraryLoader.cs + Pkcs11SessionFactory.cs + Pkcs11ObjectFinder.cs + Pkcs11SignatureProvider.cs + Pkcs11CertificateProvider.cs + Verification/ + DefaultSignatureVerifier.cs + X509CertificateParser.cs + Evidence/ + SignatureEvidenceBuilder.cs + DependencyInjection/ + CryptInfrastructureDependencyInjection.cs + Exceptions/ + CryptographicOperationException.cs + Pkcs11ProviderException.cs +``` + +--- + +## 6. Configuration Strategy + +Use options (bound from host config) with environment override support: + +- `Crypt:Provider = PKCS11` +- `Crypt:Pkcs11:LibraryPath` +- `Crypt:Pkcs11:SlotId` or token selectors +- `Crypt:Pkcs11:UserPin` (from secret store/env, not plain committed value) +- `Crypt:Pkcs11:PrivateKeyLabel` +- `Crypt:Pkcs11:CertificateLabel` +- `Crypt:Pkcs11:LoginType` + +Validation rules: + +- library path required, +- at least one key locator required, +- pin required for signing operations. + +--- + +## 7. Error Model + +Define stable error codes to prevent provider-specific leakage: + +- `CRYPT_PROVIDER_UNAVAILABLE` +- `CRYPT_SLOT_NOT_FOUND` +- `CRYPT_LOGIN_FAILED` +- `CRYPT_KEY_NOT_FOUND` +- `CRYPT_CERT_NOT_FOUND` +- `CRYPT_SIGN_FAILED` +- `CRYPT_VERIFY_FAILED` + +Map low-level exceptions to these codes with safe diagnostics. + +--- + +## 8. Non-Functional Requirements + +1. **Security:** never log pins or raw private key handles. +2. **Reliability:** deterministic cleanup (`IDisposable`/`IAsyncDisposable`). +3. **Observability:** structured logs with correlation id. +4. **Performance:** avoid repeated login per operation when a safe session strategy is available. +5. **Extensibility:** algorithm/provider mapping must be open for extension. + +--- + +## 9. Implementation Order (Small Tasks) + +1. Add models + interfaces. +2. Add options + validators. +3. Add PKCS#11 low-level loader/session wrappers. +4. Implement `Pkcs11SignatureProvider` for hash signing. +5. Implement certificate retrieval. +6. Implement verifier. +7. Implement evidence builder. +8. Add DI registration extension. +9. Add unit tests. +10. Add optional integration tests (SoftHSM profile). + +--- + +## 10. Definition of Done + +Done means: + +1. `Infrastructure.Crypt` exposes generic cryptographic services usable by Application use-cases. +2. SoftHSM-backed PKCS#11 sign/verify path works in integration tests. +3. All sensitive configuration is externalized. +4. Structured error codes are returned for expected failure scenarios. +5. Documentation exists for host registration and required settings. diff --git a/EnvelopeGenerator.Infrastructure.Crypt/resources/INTEGRATION_PLAN.md b/EnvelopeGenerator.Infrastructure.Crypt/resources/INTEGRATION_PLAN.md new file mode 100644 index 00000000..1b46d88c --- /dev/null +++ b/EnvelopeGenerator.Infrastructure.Crypt/resources/INTEGRATION_PLAN.md @@ -0,0 +1,228 @@ +# FES (Advanced Electronic Signature) Summary and Integration Plan - EN + +This document summarizes the shared diagram flow (`Ablauf SignFlow Unternehmenszertifikat`) and provides a small-step integration plan for the `EnvelopeGenerator` solution. + +--- + +## 1) Simplified flow summary + +Flow logic: + +1. The sender uploads a document and defines signers. +2. If a valid company certificate already exists in HSM, it is used with the company key pair. +3. If no valid company certificate exists, CA issuance/renewal flow is required. +4. The signer receives an e-mail with a signing link. +5. The signer completes SMS OTP (2FA) and performs UI signature interaction. +6. Backend computes the hash for the current signing stage and sends it to HSM. +7. HSM signs the hash with the private key and returns signature + certificate context. +8. Backend embeds digital signature and certificate into PDF and writes audit trail. +9. After all signers complete, the final artifact is archived. +10. The final signed document is distributed to signers. + +Important: The visible UI signature is not yet the legal electronic signature. The legal signature is produced in backend+HSM steps. + +--- + +## 2) Relation to current codebase (as-is) + +- `EnvelopeGenerator.Server` is the presentation layer host (Blazor + API hosting). +- Business flow is handled in `Application` via MediatR pipelines. +- Current receiver flow is centered around UI overlay/signature capture. +- Missing FES core: PKCS#11 hash-sign-verify + certificate-based PDF embedding pipeline. + +Critical deployment fact: + +- `EnvelopeGenerator.Server` is planned to run on Windows. +- SoftHSM is currently planned to run on Linux. +- A Windows process cannot directly load Linux PKCS#11 module (`libsofthsm2.so`). +- Therefore, architecture must include a compatibility bridge (service or proxy) unless HSM/SoftHSM is local to Windows. + +Conclusion: FES is not a replacement of the current flow; it is a cryptographic hardening layer behind it. + +--- + +## 3) Why SoftHSM tests are foundational + +The tests defined in `SOFTHSM_TEST_KILAVUZU_TR.md` are the technical prerequisite for FES: + +- `slots/login` -> HSM connectivity and authentication +- `certificate` -> certificate retrieval path +- `sign` -> hash signing with private key +- `verify` -> signature and certificate consistency validation + +Without these tests passing, diagram steps 6-8 should not go live. + +--- + +## 4) Target architecture (clean architecture aligned) + +### Deployment topology options (must choose one) + +1. **Linux signing service (recommended)** + - Windows `EnvelopeGenerator.Server` calls Linux signing API over HTTPS. + - Linux signing service performs PKCS#11 operations against SoftHSM. + - Private keys never leave Linux/HSM boundary. + +2. **PKCS#11 proxy bridge** + - Windows host loads a Windows PKCS#11 proxy client DLL. + - Proxy forwards PKCS#11 operations to Linux side connected to SoftHSM. + +3. **Windows-local SoftHSM (dev/test)** + - SoftHSM also installed on Windows and used locally. + - Useful for local testing, not preferred production topology. + +Decision note: + +- For production-critical FES, choose option 1 by default unless enterprise HSM policy requires option 2. +- Keep option 3 for development convenience only. + +### Layer responsibilities + +- `EnvelopeGenerator.Server`: + - API endpoints, auth orchestration, input validation. + - FES branch routing: standard-sign path vs external signing-service/proxy path. + - No private-key material handling. + +- `EnvelopeGenerator.Application`: + - Use cases such as `SignWithHsmCommand`. + - MediatR pipeline orchestration for status/history/audit. + - FES evidence model aggregation (ip/email/phone/user-agent/otp proof/timestamps). + +- `EnvelopeGenerator.Infrastructure`: + - Implementations for `IPkcs11Service`, `IPdfSignatureService`, `ITimestampService`. + - Pkcs11Interop integration and cryptographic operations. + - Optional client for Linux signing service if topology option 1 is selected. + +- `Domain`: + - Signature evidence and audit-trail models. + +--- + +## 5) Small-step integration plan + +## Phase 0 - Scope and contracts + +1. Finalize signing algorithms (for example `SHA256_RSA_PKCS`). +2. Confirm strategy: company certificate vs signer-specific certificate. +3. Freeze mandatory audit fields: + - identity, OTP proof, IP, user-agent, transaction id, timestamps, hash metadata. +4. Freeze deployment topology decision: + - option 1 (Linux signing service), option 2 (PKCS#11 proxy), or option 3 (Windows-local SoftHSM). +5. Define production host mapping: + - where `EnvelopeGenerator.Server` runs, + - where HSM/SoftHSM runs, + - where certificate lifecycle is managed. + +Deliverable: Technical decision record (ADR-style markdown). + +## Phase 1 - PKCS#11 connector (infrastructure) + +1. Define `IPkcs11Service` interface. +2. Add `Pkcs11Interop` implementation. +3. Add config model: + - library path, slot, token label, key label, certificate label. +4. Ensure secure secret handling for PIN. +5. Ensure host-compatible module loading: + - Windows server must load Windows DLL, + - Linux server must load Linux `.so`. + +Deliverable: Testable PKCS#11 service with health/slot/login/sign/verify capabilities. + +## Phase 1.5 - Cross-host bridge implementation + +1. If option 1 selected: + - implement Linux signing service API contract (`/sign`, `/certificate`, `/health`), + - implement authenticated HTTP client in `EnvelopeGenerator.Server`. +2. If option 2 selected: + - install/configure PKCS#11 proxy client DLL on Windows, + - install/configure proxy server on Linux and bind to SoftHSM. + +Deliverable: Windows-to-Linux signing communication path proven end-to-end. + +## Phase 2 - Application use case + +1. Add `SignDocumentHashCommand` (or equivalent). +2. Pipeline flow: + - compute/receive hash, + - sign with HSM, + - attach certificate context, + - verify, + - produce evidence object. +3. Add resilient error mapping and retry strategy. + +Deliverable: HSM signing use case in Application layer. + +## Phase 3 - PDF signature embedding + +1. Implement PDF signature embedding via `IPdfSignatureService`. +2. Build signer-specific audit-trail pages. +3. Append all audit pages to final PDF artifact. + +Deliverable: Signed PDF with certificate context and audit trail pages. + +## Phase 4 - Presentation/API integration + +1. Integrate FES option into submit flow (feature flag guarded). +2. Add operational endpoints: + - HSM health/check + - signature evidence query (restricted roles) +3. Keep DTOs safe; avoid exposing sensitive cryptographic material. +4. In `SignatureController.Submit`, add FES branch that sends signing payload + audit context to selected signing backend. + +Deliverable: API-level orchestration with minimal UI disruption. + +## Phase 5 - Audit, archive, distribution + +1. Persist signature evidence records. +2. Include hash/cert metadata in archival package. +3. Add signed artifact reference to distribution e-mails. + +Deliverable: Alignment with diagram steps 9-10. + +## Phase 6 - Testing and operations + +1. Postman collection + Newman automation. +2. Positive/negative matrix: + - wrong pin, wrong slot, missing cert, expired cert, HSM timeout. +3. Observability: + - structured logs, correlation id, latency metrics. + +Deliverable: Production readiness checklist. + +--- + +## 6) Transition strategy from test API to production flow + +1. Keep `/api/pkcs11-test/*` only for non-production. +2. In production, use the same internal services through business endpoints only. +3. Roll out by feature flag: + - `FesEnabled=false` initially + - pilot sender group + - full rollout + +4. Keep explicit environment matrix: + - local dev (option 3), + - integration/staging (option 1 or 2), + - production (option 1 or 2 only). + +--- + +## 7) Risks and mitigations + +- Certificate expiry risk -> proactive monitoring and renewal alerting. +- HSM connectivity risk -> retry policy, circuit breaker, fallback queue. +- PIN/secret exposure risk -> vault-backed secrets and rotation policy. +- Verification failure risk -> block PDF sealing and move envelope to technical hold state. +- Cross-host connectivity risk -> mTLS/JWT auth + timeout/retry/circuit breaker + health probe. + +--- + +## 8) Short done checklist + +- [ ] PKCS#11 service interface + implementation +- [ ] Application command + pipeline behaviors +- [ ] PDF signature embedding +- [ ] Audit-trail generation +- [ ] API integration + feature flag +- [ ] Postman/Newman regression suite +- [ ] Operational runbook and alerting rules diff --git a/EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.drawio b/EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.drawio new file mode 100644 index 00000000..c45d36f7 --- /dev/null +++ b/EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.drawio @@ -0,0 +1,172 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.pdf b/EnvelopeGenerator.Infrastructure.Crypt/resources/flow-diagram.pdf new file mode 100644 index 0000000000000000000000000000000000000000..34548d50b1e1e244984917456687cde1c9d5638b GIT binary patch literal 85245 zcmaHy18}6x*XU#0ww-Kj+qS*2ZQHhOdtz^FZj6nyadPwi@!ebXRo!Q5PWN+8cc0T| zp6ROT-!!?Rs5m_{0|yLw;P(Xs!$QPFWN&N@!^;c9sOsrpM#QLSWMKxwsBGqJ@9Jb? z=1laDMbXLLM8(X7Nax!uDo(_xYUbfW#3*I^-BkELrO1CuDIz@>MllZ;2^AM37qfr$ zmiR&RHEdT#md0N#>K@>#L3Fcz{SkP#raPxBHx3X*||6qG5^!( zI|vmQCsz{}MI)zwX_>y~ZDj0B#HjK;&41~Ln3@0U#mvt1pX9*&tLuN$ByMHnV&+7| zC~osTK~Xakd(-cH$(q?&xL6Xg|KMVV`Hs!m#mUUb7RDpz51*X9DM#GXEBbYhAeI!_ zBQO}SO?mDj0gIjCui%{tI*coTxf{k>et!XfrAB>~srzO#Bqfyc$U?Db)NWB8z-aQz z#{9=7VnLsHQ-Y1O)Ocz0M00hU3@E!vU%7ifz8X!1^FiccbejB0}yq zzdzrHX$-kZ4clk|GXs{$Jl64Rub;U+-0JRW<7fHkg!`8vTqp~}kSTAf1+Jaj=p3bq zW*!@QxZ1C+Rpve)46IdVv{7A8eE057)6eJozb^s``TPdu+ac23)fa|PF_x^8^m zO1~!)d1r%{M<&1IuM@U6ko*AJ=F zG=Az2R@`nq>793<4%zh!3(uD3eG{)ZUqx!~syf5Y z>G$f7rE|z>XeJ|P{UXT@J)e--D zna}MIP;zMdL|M1KIJSQnqIGN(NnOZgs0@1noP_y~jmS)-^LLFh4-PRFe->>4HnsOd zoqBc{&)mTEz1Gv)rFR%?m)D)c+Pd9<4m@6)<>I7w7#}OO*ZiTznA(_iNU~pXv+1uj zsQ%f^P0N&OooTcRs{m|#Gc;8~lD6E9-{S5T49;eAg@a<|9AFjRV%6-;X#8*K2j6U2 zY7ZVbuj8ybj(qNfxlC&cU#8th>yJN~^RrDqxt1^-OD7jVrU|5We;@HT?CUWV+X@|A zl(U#qJGW6k#+*Bj&cD>-wIMLQ@rN9B`qcZ3Or_SVy(|ccG(%_hdvjUon@jBOjLKKJ z8&q4zk1You5zSMaqt{zMNqV#Jmg_wLeaP!?Tu&`$)jh314w(8d3)SlFfQ1*!rR=%Y?ve@ePXUyKVjU? zHCLi_9^J1Oh9p{B#LlgVEJv~Q=_BeFZ6-*AGkV_Tt@z>0OU2(4xIM;|qBTfz;W9}@ zy~vGI-a9E$^&Of$9lNlT)5b(FS2j%i1Xdl%&==%hqe8gvU;{)C^_1x$w{%Woz`Qm} zC6nNHUVZ?EKakdX%+Uw)GIzuZ8BEeGOZ2feJC&^`5?SK6)pqc2-h-m&>)5Y{Qa?IV ze;FhL4w$SWAx~8Y-LP;PS>QPCZqsOL&;*`{Z)*N; zR4lh#-hq6p(th1>r|oLElNmI}UhrH+kRq53p4IneG(*LOq7wTN6kCil%lm@TINIB! zE;J?f5u9^nhmk-)EI?y^rGT8yF*o*{1;2&anZ2in+9%`rJ9N?i&l)4fssYx2Qi8+5;`8SUs9{;1p0mci-lXTJX{o+0>AIy{&3s^08&%) zq|f8B`*dRVvQyLPwd^G9{)}Cyv3E;rCPJFHEl?ly)Lo zE-9viwBuH4feAT9dE&^t_!oU#*f3{?i`8xiKL8z|0)CY?-Aj9hy;`;*8z)KOb+_7$ zziH$4eNDyWhK;ADR)~q#6MVAZgv{^#qTN!jHkCz?;Iwm&cXWX6qvV_2@)j>I z)<@~rB@pO|d&DX|d7r{nKq^oTDJfKf`X&w1K{?DU<@mBi(V3}5WFU;4@P0Q4AqIo< z<*QGv-KmFwV=-vsPiy=U9cR+ibI~DwH#l-|=Qnq6HjA^C2GgyGIutUG3~_G{FgIo34Qx zk&I?ePRQ%i^kgBE{N+u;jDgo~0E}|dpNy|X6c2CIbzMQHJ=?x$v$XCptAkmQTk0>l zEwXq|?09Rv+i3utM>*9xtpTFh(S%WdU7Ot$fn8X`E%Ee8#?W@Dvv5$kY-e#AmBhZ> zn*}=?&QX1%OGZuU+qigpG<8LPFcN?yl6zxB906FTCC}h$Nsjc-d8j*jN5>=q)mM{g z1P@?JY9lOacJFCsB~A0ELnkuuK$Q^CTKX4`F`>CLS}Ao`_dD8M9tP=}j^-Swai#+W zTR-N1uqOU~!#^lyiRyAOcSC9XA&fQVIIPtkn^d)7om-|vgMyFs`t7$TGt)t z;Unr$#?Ad;DaBA(oJH%-qAwUOQ@^%-_B;^R*d~@(>^#N|8m1?hrQ?pHq0NVIf*n?A zdv(aoCRFrS^Qdx>)x+b!$|5i;&>LN1C5a2Cu5BZKVlNiv0p3(p#FKmSctTsQ8(N3| zpeCD?fIc66S-V!Z28BIdbw7->0O(MB!j-4;ha_ zxq^IG#<01K{Q70dnyLJ*&gV|N(Y!SL$2TRKx$lZWNWpB7nU;)F?Ee0=%20+A9yw_a zSLF5;aYK2Q)O3Ayl@y@0v^D8)6)IE^p*YS68(Sk(w*2>+JSIY`Br~lp4+{v@4-M!UTQ*r6>&13m z<8Kc#jy>|*ebe&`zVR72@SimBv&0EQYu2l6sp6}ed%8eP)UnQqK7=h{u#8MFZK(we zt?|TFWO~@oXQyv7@;PBkS3I-bMm7@fPa--imhRM6)VAV|lv25UdS^G!YrT0VNEyn( zpLS!qy*J$^2hrJ)n~f_;iB3ue?K2*VYLjlOY7O{3Robzg`S6(AhL4-BOP%|>tx8eF z&|R3+D`FAaLWBIeSIS)7we7n@p?19!mVGU=?J@wyd*?{=)tnup)x~)+?0USdE1K5% zyTjCK`4jn@+N)sAO?n|e74WLst?(8`wRQ-d(`Js>1sdyWr#g&wF>5ng+Y%Y6@zm(t zdUSy{MkTA-p#CHG@|gCN_W}chJJ7@>D&A6hq+l6@k7dmA@jz58`8#clPV@+*t-p^C z!Lb-Igas$SO*_nF`O4#pkM9pt*WrxP(DpoMi{xAU6bU#(g4;y9Q7;>${l3@jQ#ooJ z_*#2s_;_pFfE+)83HZue_He}(tz!2sybB@oTaJ?ZK1yT9oeV9jw9PJq)UlMrIQieM7aJH^&d%IX6cf3t{>EHpP?rKyu z<9%yvlZ*ikf+%WUu(Ks8m*NmMlF%2pS#eY`jHCAu(|pcIX~=YMHUc%*si0n{1Sp~g zp^Rd%c`QeRaScXbN*9}Ox?*?yTh6iG?6Jvt4VGC6Pzj0cmV6EH6x$A#5ecMeHEF~^ zPK^sEdnfpu!(f#Gw@^OIrM=rN3h52r*F@Nk>@e*ReK_|cx7Yjgy47}8A}fqxJ%I~c z6jbthbpBg?dAcnFLOVK7!9Owv#7){Q*cA1tFu{M581}GM6?pT1jIqsohOh66%;0a@ zk-^7t{G_Y$Ou|WUZ_#RjE^>^kzu+>qmQ9*+H}skO#C!qz>6)SlUS4NiXie zJW*W>W(ic=h;7M4mLD7pMiyRY02bJajB4%xhJe?GMMRD&OBDzP=9#Sshm;HLNpU^m zn9NH!&-I1(;k6D?X?@gfQ11Dbvj{k%;s(AX(aA~G{M6l7$!+<-yt(@N;?M; z6Eq-9gsP`ciyC1V`K9ML9;Rz)c&WCa?8c@M3L4UFOAW!lakl=_;rx3Y@t0U|QtmJ}% z3%L})NNG>xgqEvjD4$?_hk?#7Z#WWG>S-Ofm$6AZbk3rsKPd>TgqmWu$$4V&JM+j* z(n0=56f}vJ!BbyT3Umx~V{=QB0m-x=39)tc8gNrW(cct$rqYb9o-dn{c>0$LGcnWT z;+|=BDRimJM3jRBK_g%>tNJ}-Oe$Nn!>Axzmb}nRUNZK=3Vr1F_X@}pUiHvP>A`HK zRq&?1YSi^uC=wHz1p`%u2+Aafh>Vsj6cEz42<^g&$jcXFzVN$bP}cD+8)0@dQ{pw# z-c^cFI?d}%)tpQQC^(PkK*emDq$hNySEd*o+l&F7=(sRoG!(KTXTV5FEV;O2XXRZ% zmKqn+?S$3}1Qw{Nn3!!9GgNSigdDaj9MMOYm|_^HAmTiQ0iB*R#%W+~J;+iIjF$s& zr_FB%!BYU|K{aIcEDUy$RGnAD`AP!7q{`g4L(r5cUw3I1MQdY_i~NszqVq)6bLxJO z68q5bZ`_(Ch)89Qof_q#cL54N#5%0?Swv@CU z1LM5TMBNdp`Gi|A$g(8uaz60LDB^ifL}XCLTz3R9A5r34OYF8aIVw{+jjeDIA|oWi zBHAQDLT)uclh`i^vP4Si^gexiC5->Q@yd1VMGzd<6I3cIbf1YHwPLs2o~3CN!aVKADHR!g_u4uok5VqxQ<&Qgw7!lE#yXIm9EbkO zgsC+QALf zTUX(L3^aQ?^2BFkm&zoWqEJym%NqF=f&z#$Y>lXLfv;?6gKEte*(3SVH9kdV;Lyti zxhPXpLDFYUkUoB8eN;Rs}|OspULb9Yq-qR!_Yz0^eNQi_;6M;OM;yw zj62uwR*jz_V1U)aoivo8Rn$b_-(i5@u^2#b>9%I39IrBgCGfrANmFwp>WyVt6Bt;d zn43gqbr(N!VPNhSDH!&>Xy~B^c71S0I0RalD##WXmp{`%Gqi3oEfN{yGpph!ktBsW zD0N`^jwSGMbuzjncG9RuC9XD8n|zMZFYK@yBaqvcvARGrd~gHEG<1RM09`lZEV1A7 z9dgms1&rm5hal7~ZcXROsKpy_CtI`#ce|ZU$T5SXI;C~gB`ZQa;Qz3$ZCwEC8=)~Q~icCBf zT4Qba!b{nH@7ElggFd1nwC6%MgraALx2yF31u5EzE`8c{=lhhRV~nsl1;zi zly4VT2Bu-?J;+g5wF~$3bhnyqwuu2l^O8(ku@A2$@jU5vUEF2yf=yL@M^JYEo%<}c zfADg6=X>ztEN{T|N8k<0d|?m59mz>|EJse`MtO$QUp`I@!QcI;T3)`NsMG;FIG5=TNZl^aeL5-gWlH%A``sLb)2yZ+xotvzB`yp{stox<0 zE%PmZ>HyOC?gPnyO&nR#1|n4;n6z*+hwwFJe78k>N^@rn&oMnE;G^pLLq}3tb_CrE zAyaytiG_jCvlP0HEL_%--{Yx3$zjsH=MW$RRet+I)((ijQDFJ|OJ}f(^)(?LXi+~U zt>*ytrl(!>H4keuoP!E4QOeLd=mnn62Rh5WGP>9_#~b1}eX}Q0+uL(r?N=D{alpo- zhBOq@Nvb*mJQ|&xmt85BIQcTyax3U4@+99JDeI!-FWW(25;gE4oD zCRCX2UrO?emTm<{+;r)Zx<%ucTgkLW4_91PhFq_`y#4nDyV&=O6H;&Tw51e`jdQEm zRN?7dq=w^=Hx!(me)cCV;lzZTIA;#j5~y4a)L0exYh1A&+cKt|8Cy+1l%0M!ta=YU*~Xg z{(Os`?<+j_8LqKS_-J`19butVA#m^UY2ELqPtAp!~yB{!38)FKBZ9htIfv(;sFSMj0zp z=Wmqr50O&-1~=an<$pT=Z%QR%Q-j%W=@JuX69z!c;~

fiqUmkowd)XLex#>i9D-bB^P#m0>2n+%!#m`Zxk{P1`)79j==b1N@I?=_!?oeAnfCCF)Z9ga13yE#Rb2)#j(Qyv4`)q=b@sv zZ^t`tyifeQzI}@>^!B}Kk1IOY%H>tu0YC}RL?FrK=_&MY&+)6kWC#VNj)Ns-)a~>y z9869ihTXnbcPpt2`jxl^c0f!q+cgn=JhWYn!!&f0;7VFf!2 zTwmUqcV{->ElmUb+MUEUaaxhwfl9Jc>vj43k3jYEeIPudfK;HNz)lSV;FGEbVMeoK zU1+NsF|`%PBlf%mouu+bKth2&E5K`JRCvMW;w}VmU0M1z@3zfY!r{Ewogy%v4*)k0 zTr21P7rfm1H+zuap>+Hn+ljyWHy7F!!|Z5)e7nGf)&$vwg5hk#T{Z zi9`axf#F6hSq))k0d%@yZ;jaD4q#)BL9O86B8nl}vV$(u!WVl^kHLh#$5qbDW6SX8 zkLO+a4rk@RDh^L(h4P=qH9tG!Y=|MP${f0G3RNq#3VPL^a{6}XteZ0GSp?W_OlA^) zwVAE=HMMWP{Wy&2ovmhp)uYv;Z5}mMxQBc48R6%;er9-zS7Df<-^=%hdq4bxXa#!= z|1vY@4$BkGI#OojN#3?>~%AN{Ia^J3^akTl^H~S@L?@_*K^$FHn6o7gGOO ztKB*z;HV4e1HBhS`f6)7q2fjGWLd?eVLjYSxe2hj1x=CubpTw6?Dc16Tsk$9(D3xvBV*gX zY$NnJWVz1sK(hShbpAQW=5b(__{xM$GDa zAXF6tOesZZ$sT^-D|^Z{!#*(tiVEMmr(?pp5oVSn)^0}lfv0xjae$J(pRK>=h zkW7#9##x00`YVk2-c}5K6-e!c`Q2SW?j3>eu`TNo~&XgCNR#2Z=ZSp%pW;7HToB)X@mO zIUn3V5DMJ^sj=r)6AsaQgSi!8l>q^b>cBIh?5!9CNwf!i84P=}M{_Ai;aHt-OuqtM zZ^X9(h|yg#hEd-$cS`djHa|%4pr>)bU>J~IsAI2euV}AC+&8kp{4Dwlh_IO+(Y;jZ zPuNlXiZh-bWpu%e9=!sy88)qwwYOR+Od+@nBd zOom}h34@` z#nT&pRsME1_2B$kyNBWw+Q6h-fl)LFW0cyUzeZ+*(gt%Kx>vDRr`hL>b0MzH4~nKtO0!~}#F`B|ao0(lm*3mg}�XMv zF2BTe@z@!b5sDSjVq*w`LQB~M5+S4_J%6;mBW13_7mdvbISy)PlwT!tVf4)-)=RS@ zO;{-AZJI-b1`5m{|{6p8kG0A!2;m_P<#p1nE zAGkSKLAqO^_l^{ChFpCE;hcJFv3H-%R^{AEnvpW4A{kZuMX!;-(Mx6-F}WU^w1sN8 z;`Lah^~SgiV?Nw+dZg3W1~HqB$jvX_ze78KIU=fue~#EYqS}q%KeJtp4SC?{bX<`- zU3Ib9R%_JiIs)#@WYX#MTO0uI_u1LARykZIck8W*S&k;vV=;AAHCS9lJvJUz6AizM z9QNmk!3*De4DAGO-<*2#F6r877c=)8HchKXY*=s}xNF5xz@-&c33JwphK1>wnbCMZ z9*olv+h`gUFMtGPWUbVUQ6Ue8Q!wJn;6`IwXd1x<24l#WNUdZ^XqPJ(7?jV0rEPXY z3Q#DU%h0mdKCdF&mMZ*#iMc%16pVUqq6L7C3Cc(? z*yUzqH?vmx08=1BqGyOo?CJ#En?S|IYYpLnyY^&flrfYYZBs?BTRIdkXti`7ly$`1 z>kO880z7M*vyFv+raT(Kj_CrRnODsuwkVrN#F)MH7GDEP2?~pMdNqyK}lJ zk&cGxI@tzh!b87eI%rCek&(}EKpi)$48ORLLmpGKhutVCBb!-0%v4K_Rs51lmthbY z*O{6JA})t{m7*BfSq5EBHGDFa((ai4P?p5 zEfph@KWXq`!%ad%Wkp+Dnc;B(oOy&=x-LpN5W%!&dX{N{Ie%Zlf-R4+7OW zXB7sl+~O=>(Z63J@50UiVU^8UDX(#9WcIk`aFgVdw2NjFs?$oVWFD3*VtgQsvFjJ+ z<%wEl6KJUSCdPeXu#Y_*>Kv`qz{Hco8CyEx_pz?x2LA9WSNcg`+yhb z;Je`QAFfdFKa7nd*rzj==Z&ybSD5J6_pv7`)FO?$gT za;d4Ymx7kp-F7UdWWO!5l(o|m701K`*OHPL>yd|g`H^LetU$RR8P$bb+&Hms$>iq8 zi3P*R9sruQITxyW07E!v4KsDTlUL(g8_6h3|mewWv(mjc7B$($;f)q z4Lrhu%1jZ$6g$*xP7tSz%~c71?8zn`=ueO8Ay8gEF6ADR9*j5>hde41*Su1MI~wrF zR!0U^WJ!bAbnFF6!(Xt!31n>u&Ic^C>%h`L`WYVFLKo(&VsPk*^NGxfjxAwc+|Zz| zYNF!TL<3ksSB@oN9^9K&+pGw2$$w{=k$<`EEVPiB^Nb=v{8SkFjRt2cC^BzpT!3qy zhXPC+Oo#Y$&xZ=^YWZN@$Tkb-aOwc<(*GFXJCIy=^YtXjLDf2{)|uF<$?i-ei>7( zTa8`DX#oV8kfx0ADbJuFj4|v}+UIaIt`Ad?u5yk?Q_{d?)6vWiXBin_^46t(A>3!& zbR0|@e)M3?SnRHNHYU0*W`RuhPz}Mblo|znHA|WTp*WNE+#-0&(nutAhP=8BV<5~j zNLx@g*~`dI6Q(htGBXdWu_NjHj--zcTcoPBnZ}R8!<#|#VXgPUd21Ukd0#aCk!GryWOH-C@Fc?sX^BPD~imAZh=GFB|8cG^x>D#l{6hJyWkCGJcv5NoZ)(|7}0ZZc@) zMaW#&M0N*t%YrpZKr#GGj@g5oI|!c{B{uQ}H5I&8S{7!6weW`~S*S7X5MbrS#;iSn z{_>bI4NqDkh^K~4!IufiHkYvYB`4ijGEybyS5POu&Gy7m#%Jx0*RPz5B0UzCM0xjPz&1|7Hg1ri zZyIhRI|`_fH}9u5v}~Bt|J2Q(vD`K#Ku4ttQ$THl(h}bs_yHm__Q23tr6ffg+)qL$ zuQtgeh(OSxjsf*o7?SDh>gqoWXg*Nfp3g8_IFy9FyXo7S-mHI>T${l95_X@yA)UTG z_`VYOBK|xx8g=%&v$D!eWT>kH<3 zz~6cj@xt_lG+1yiD7~I@CtB=p79&8^>I(bBPx;LK#Aorv4e68H4NL6<7v3$huk1ei zsfVs+w&_WtnupA4N&nb}~GHgZ<2w~O#-k0~6KF155M%rIK0JN{>q@G2hms_uN` zlk=lM2m0;0p1u?ksTgvNnSc){lORAC(GZ3&0K*H2_6*o^P8iXcoG-%73n}|lXiEW+ zL>!TY`VE-m3rOiypXz~}N+2a=Avj_#I71jwSi;~+dGM2Sdlwz&x_+j_zx3A-xWKl= z*Wf|=sWY!%;%DX<9yk($A7#zz?3|4_xC9o+)zzB1Qh^v(0bI+PK@` zAOhQ=C|$5@E|?UHdKn__Mx@)|@Y`a}-N!F~TE$;k|DFR0{246g{lq6&B5oQcgkH{7 z!cfvg!r^P9D~ch|am#lyh!7Wc-%|TW+jZ2|6fqby=gN^PhK3Qs(A`B>)Iij7S@bV$ z54jm~D0rck^CSrjtZ=eLidf3TkICN;JLPvU@94?tD5WdXjN;V2Sjb+?WpmNQ3(@P4 zyHPQ12JYw>uLloTk{*_Y{l1V^yHXqFiGLxb-h3AP(5?EjS~QaX-b;FCw0KK($G1pG zzAcvAK^j?8CgusPS4CvET$BIFmh#56LQMSYvydmTfv$`kxhS}beZ*UJqU27m!i{rE zz*9G^{j(H!X%1**0SN4}2>9}gxcp8x1fnZ-3(P4kex!3dlr8eTVcv}P`@#EVOz(?< zd)CY;njad0@=B+D+PtQa9|}b4i@_$4GE?}=n8O#t;4`3p!J-gAoCO;c%iFS`n=+@n zG^aaV*r_Swd`mtP8kT%d4j*7FmNZPC!zAt^m2@+~3Y5q%lYi8m4~!FWIIhn{m(O7H zfKnYV`?r!`J8)VS$Sr#ogYwwcAiMu%1J1WLZ%3GeWl@fU{2*3u_xSnXaJFu4@l%`f z1>J`vFkh8e^lqOr)$-sa@#b8U7exOR?7gIBYV$N6^`}O~cz>{_X07d~eXqoOzSlvD z&AtC`-;J*>6ilh~FZ&%%U*qhrfG3DASaL`Fv%71!5$JEJ$a(H&U+RCaALr#tC4Y5w zXE0J^`$^kd{*vzH33wL;c-lH9iq?Eu6>5Dh_HsN^di;8l*!a!eG-GhU_sbx60B7Rd z=04pk|8F?zgs^?Fe?_`G&cleM=JtX^F}IDA4kEhM^3iG`xW*gQC+w~$PBN_O z*m3jljzQRRjzuhU+=!dT>j=U&7j}OeJjT1SiTzb#1c|F*^a*B>uX+d-RH< zLV$6M#TL}(TF=>;icH?n`{;V^F$kU zU^Rz{i_Z)`@KkcNb)=_70YuZ;)U#+E_F2mgGzar$(Io{Rn6&MAgskeWxe;$YMpKe~ zwtio=oej1#p)vcBOk01Q6*%$g;>ENnTWW!Ej6)Z3joDNz*j%k!9~&iMag}XcV9Z%p z#+J9C_ZrUN8|UGupsYk8s?C{t`6HhfU;3G_SDEQ8%N5*{BjRg>bW|f=aLng2dX2=L zR4gH{4*H7dqi(X;Q7CLH*^^Aeha?XHqdBj2olKe1cgAuo@=I`}TWQ8puSU}_uH z98>GqdE2T#k;S3OD?$yZ(4`gO`W5L?3gG+-WvL?9MEnBPpC7wm`sbMd^~-(VHl0bXC1G)5g^K6l_^+Rp*b^0iJ#{XnGbSo5+{YmnOXLJ5Kx*adSFIksgo=ap>sOg+ z9<@!fC~DPvq zB?By3Ph%m3eg@1NvH(H!3farW!AtI)yTnlZkdfh5Drd89?E(&s{-}k^7Ni*2+;>DwuNMgNIxZl4iMv1T=V!k8A z@)J#VB$`Vpnm9{AZ3&2`DVVorEqh3&W74TnkJf6ljKNr=YXWb`pfjg5lxMeK#gW4) zRziUfQvko11@``Z_wwwUTV2sKk{XfGf{k}CPv)unt z4f%cOWj4z%3Ea(FJZ$^e<#gJu15X~;Fdd(r(NKonqE)k2yIQTd(UL`ruUE{1jYl?( z5ZP#i`i`2&KAM?*EPdisQV<>@pf>L4A-QB?-+>$7EnVfO>%fr<7w7Ok=w+mnR@-Eg zd|In^G<)>&4^7vmbt`rqh()3Uv=_95_K^@7rL6#du2OMQnTyB256NUJXD*#N*jfy| zmmy=RM_@S!=_*F@^Q+sRLf{3l<}EY zM9ax(m+l`wnzp@kD0r_fWr-HgW~ce2lDEy4Xg@FG5glF~QWS%atjAVu+*5DaH?eXv-`e1`o@kCNH@DkX>u;?Dic| z>@FeHbFU|G@>Kl0U>@O(H|VEP0LQv+8!gXfQm!pi2OP2buX7fQZV-mm_=xe*e}68} zhFV%s4P@op=Ad-!(IeS@Ny88zo}R$|LV4u00fnC6z(jk$U{ioU(FmJ+^rKgQvY2Lu zHF&krMRU-e&Q9XU27mwew>+SSp2DbD93H$zYQ1?AxO&_A@t>(39-*Thg2TYpSq3K|9`5V&V3cyXX%k*<;xnwUCT^STAW>^YZ{ zDY-?(>OJWw)qgW}KAH|3Hw~6zJHg39&1-?_D<_c_!WpkgF!4Ne6Iv5f;$++C54434isXEa{WK1&gf(X zqzsKs4g28nTd+$usb@ zcbN<3+ou&{R-&^{{v`n&;cqUW4#`s;wKL0@vMZTlePePfh1! z)8u4M)a3MZ(=>K!YASjli~Z5fVi+Rf_ZL9=pOycvEeV85kmxcIEKpH+FOC0upPGXk zo%?jj@3c_k%`hNvcb=`vmkChv7Xa710SSv(+fd<~V5IhD7_7zz%wuy7&1tBiKm>~L z2$theu}g}Ieg5PCsPseR$T@c(50d#HSRYsJ4~ASncfYw~f+Tq4dEQg&56usUaayuR z4lww@=v4f!gcSJ&^MWneC&cSM;)Wzt`^AEQE!Q)Hd7iIgMJ2ql!FXbc2YTU&VHFWb zFe8Q+D)Pmlge)IWi8XrR4Jp-p;+kQVec~QbDSgEvQ>n!pks(SLb$G#{Q)$E(qL426 z7e<8_Gb?{!j@~rj6fgN3(b0ShJepo3vFsJxyg=yBh^(x#_x$*fvqRfPG=;3XfCQS#(l2IMl_mY0=*shx zjM%gD6U$M!N9UZeA+C(dPf&VG)vrMHoZ?T=lLNfRAJby0A8_|fGT*|n?iCxuu!dQ@5L$alp)nUW zP_=X9nj<5gjV00!oS)wU0<-G!>P+k$vLi11!lCh%ziy2D{7o}nX8EZRIKA@v07AE} zFC0O)urD0fvGkSSZZP%Sy8~OJ@_HYmMs0UUT(`C_T&_c#FGj~P)(fkBU;FzUZs5g| zNJnmX|1kF>($#?1Ba&Yz{JGIqB>Xw?Rw(Yb4Hy5s`wL``iSK;^S`R3a6(Cz`jqpc0VeyJUKsP}yHbh!6i=XB8bTa12u3qbIB z_FB|#mAxS@V*a4WIc~&((IdRg*!2=eLvXmlfzl)V<*>>5#WN^@hQS!2X9ui8MZF0} zo~prEeuI`T{;$2K^9v6Qou%Nl;0!M$fAR8H4&Je$lljt5cz>aGFCfMO3BG{dwJL&v z=(RF}0T~Zzz5w5dYRDUn?;U$X0YrmQghwEKfc&=@AzWI$!TBucivoQvex>;g(>t%` zjMzS>^~epk-@|@H?}@Zn*0{m=TT#DfOYn*BuWkU~@sRfgzy9s{XomND->9eHYRr4B z`fBXWLuor6(Zd6bvGVPf`0uws{;awh8}rcmpyl7+FZU4pE{Cem`QJh7E8lLo5WO7* zx5F776n&u$e!D)B;~nh_+=jiP^bKa8%RFQ5C>sni6MW+OYZweW_7wL;)Zf;Z z=PhZ(W}Ww0zlgdTJl-q>&>K!6u7QA&$Wskop&~=?iXgi;_otwMj*DAClAStA*ywds zsto!65hNZtON&s_sAWEth+fW`4@tp0;|a>@i?`;@)z`;aQ2R;63ULq}ea-5WR<35WnPRb)T?R}Q>AjpCu2*Q)L z-`vDl*4%fzS3cg0n(CVB;iaV6(+#VZu-;3DM@fjG=vV3soo$H*!7Gi!+ipY zlky(iC!A-At4Diena;Gt)o*&NR-QQ0V>a`|=Mk&HKxbMlehalcX-`tkE^7RQa$?n| zD0c*58&MD{2o;oPx-y+I?Yo+U!?|M%F1vc?tV#R(r;@|uy`9_d=$Q5D_kC}D(f?Jy zj?w*i|GVT`?1KUG7~NY90<=$P;$%uB#HW=QNHq*pAVM`XmD$<|jkaLasETd- zrkqn&HA>jGZ`F;VNm;Guf}obf=@Pme0>*MKX04<*tT zA8D39Ldm4w;iXtbn%VE)2;3#vtQ*J3fU}kkCGo9WL9hcL>#+|4DtN1I%7#>(7|0fg z_k-Ymk&oqgb8|0hdWV;Ky3>Rw$=GSV0KrvJOShPvIAtQ(MbN!`>A24P6L@C2(HoNq3^%E{t zED_0KVx_mi#30BtndnTI7z`!haCl!yIJ^%vy?o3GOE9>lV?9=@hPCujkJ-!wOBWH`6^>l-AgY^ZAq}LkVwBB)+^USO|&kVWVX)>1#wJW1pPU-LJmY-{1f2<~yGvzv=(gmq*DWvgC`! z*Mr~?K);uE!$2%d!nzIVk*5-d6t|E{7!tflGbIve6e4EZh^69Mx{=G4L;u=?vMzWYNrX-F_U$#k#n5`ou z)|Q2}B@so6NL0!)?jY4<9TKKuRboc?)4VF2@R&8ODq^c*GlS+ZNfde_CQ9_0h$QKW zNzZs)W3MX7-e zv>QHJaMHI%^fuY-b~rRM%}k+eHlFw*qL*dOOtUXT@-anqF$ABFmHNCESu@jTVk7j$ z>C+JtHMm@gU$#-I_-*#8k^_vOl6@#)0v4`e;hr+4!Zh8X$!@2-!-(E$qp5xlM~rp{ zo$1S9FxGY#HMp3;FdFGh7xO-x+o$S{X*KJQ^~O7koHj-pqj_4|rFmNWyzT|B_6$?h zG{dsgG|zIG{W8Z5_MP?*vp@74%{J{aKINc3gRIkN_Ik53yxwe`H(MZ7m+ckIJ~>Vw z>Yi*Pwm5NbWpsiO)=j9%Fi71E1JvD+R(Erwq0RLgK$yytr|H#DAd||7$+oqI&Y>&l zS}M{VG!K5Vv6Cxl^RZs}c$nE=uAS9=)iu3+%|~o@CJ%O3)q2aYu;og5Pr{2ORW_pc z$X+=|_Q{$*sz;$!4@0LOgdoz;S zYpb%A+pE}OC*K(eRs7%&M~xaeA{5N!&au2K)0v@R_pP*|_Cy7B<^T5XFCV?@@@wuP z+a2G$^4js!A9?1%*}l!2Ypdt(zG}~h3zq)ko({+UH$U6l^!Uz)Hna{0L8JPSm?`Z> zm>eJAC5&0_2%BHG7lf%y*kq zVp77;LnX|{?<-*+*sE%4_Ca!CA0QX@0dBzFHb+^ZP{qykNNLv&s-zuINjspDwk^bcM~EOK zhiE9S9(#(_4{a)T$4O;Z)@x)3sRY#B5o6jjY$}SA+mgZ+?&ac@H2%lJ&1oOdcZ8`? zugqmFA!=#y>XH;8t{x_pl~HDn$SNj8AVdtB%vM8ODA~HqYV{5k<3h<(%Z8e>+-|Rv zOO%&OR9Q(m6RMJMd0CaMs-&EGhl)(*4Y*WkE7Hl7fH4WvvJk=CP-Bn(mrK`fdGN~e zvoh?)w)pi+7T=W76Zq`+m+W1-VBR&G`ae1NCzV|5zH5E#nkyd2xR+jX<=ktoyH45q z{KBqzbM6`D`@=1}`~UqBd%wsAL|NLw{-zl9GRfNsllonP?LCcVP11o#DNmwFCG=_E zl1fM^-=aw+^l5LCN@#USWL+wuO?hXXE{&6PO}bP`msnwqrJ(r$aJ^q zG1Chs=`7(a^X;NwCsYTMM$k$Iqo9S!WH#>=#0)_Y1v9A0ENX?P>C@1GlKUeDb~D&y z!d`5I!e7OGsD$-x}Ed}AL-hlKw_^6hzNE|5{v8NIaQ*yTL zsf5FnoKm~VY~IckJz)g5gQ&YBX2wS1wHSO(r`OJ$tkEipKCjtApmoR9&-fCWC%D06 z?vEKfrpWfHlD<9io-ng{Sab#Gm<~V&Q;$U4zEcaWe#bS*(Ns^4GtRi`h*}yn)M{JBB+Z=g?yjI>Qi}HVL z!`$44xe45|o4Qjr%)Lpm?<6B(CBKB3RCZamp30W_2ivki)~uPm<@Gfm;XG)zRh2Ze zcl`CbVPWY?c@G9U%pQHIRBGIz9)`f}8nbMxn%U0{QVT7>Yj#*HX0zx_SU9KC>J|BN z*K4-g<3f4YGOL(!m?i96ZY#GX{N_OOrqLES0?vRis=N%&46P=Z8=CnC=UvOL>DheK zIX4Y?>=ycF-&2#XyLC6wt-1NwU;0S9+;QWc2k-8hT$4%v`DFh^v-^*~^8Bq`he0t( z{aAELyOD!J^63E2>9-O;nL`BP8RCnWiP@YX`8-mtFT-r`5#-Bkp~c^|WS>iBqT}Lz z)5YJlT*()seFyf*e@=-|bFaLonTb&G(kwDT8*xs^nxM?G&rp^M^R)AHOYHNMHM$GE z>vY$959$tN+O!Ir!-9kf(98_7#hizw0=$5cHN{NL<_r&cjjcuF%wwjAB+PeVYyKel z$sZs;`2*x9zfI=yBNNE7Oy#(G^eMLHmNyj{;-s?Mmr^=k$_)E-X7kg$9UrNRm}^{f zTq|5_U7|})BDiD|H>;LLS0-!9mC0y!#c5u5IQ{CB@RbAQtvBH~xx*}J?oA8VcD4ZP zDNuq+AfA#g)&TRJQO{OFB!hVfmnpN^lab41D#PrNxXbiNCuOQEAx%UZD&TKT8ZGmV zcDDQq=E5ddFkeYB2FRN5eYd;ljHQjWGtZ~BI~Vr!UHtNO@AV(~%?+Pyey6Wu@-1ht ze(1r=FMC{^Zdp<~sdU^If1lgZ|MjaKy;qS2as_$pPmexx;+^Klqw#z1+_D7(t$>&* zJpwasflR0D#6>7*F zvVyE7BFVBO6_{1gaBoJ_2BV5;a!f8sf8?eazwWO^RdN_#Q>r%J#*W>R3}RBrL%T zt!^Q;X(ptwgtW>Dc}^2Uck&jUT;-f6_aX*wbTA*(TUC|b?|6z6qDc{=Nf2^`?|WEN zZZ_FJg9&lGifoU)wG{(bwAPLWBokhX-JX2Uvk{n>C^YN0eF#tg@9_~r#3;{Z83oeak{WOFNKtsLdr{Rs^qmfQ?KfZGvcJqO~ap0`5NwE_~yy6w7*F& zp6yl5oRw@9Gr$bws)xJ0N_Jd5+@&ZbEGkw)arJQLP=%zfT1H9p>Qz`3je5Fa@(kl< z!Q;``hj6oCH){giENBLpg{msP8yp%rBKb0wS}J4Yh*6G=0oGukX&_5hF8gTL?$4Gk zUw?D|@i*V>KYr`^*DqbP?uG>mH;g`G)AXw!-F(g3M+DE%JD1%5)}i|s{Ay^?o((%y z5VCvYpU8|w*Ihej?)vLasFOBL{$2Yuk3Wj!ejn2;9}4NLlY0tJ8U1d8e49J29_M1o zoILjnZnjY}gvq7b#s$;H_e*SUTT$3J#K-oPCtC!IB?D6k;V*$^*`}FE*is{xy?irn z?+G`Taf@5V8D0_&GbNIl|9a=o>3xO)M4VhMMGEtyFRF9|ej05nDq%vX~yx7`Q z#C+{mY|T$;L4HaL@>5!n-)2i|fh}UAwoTzdTF@&WPijC?{?kjYlP>US6sU(0R1bFt z6pfPFe^^DDquc?CMoYp0S}YmqMHTmi19u_P4luEt8b?QtC}5tCjvRsVvP`>;?<|H0 z7jGw*`<0tBuV|fq<&;rm)YHqiogmuhHuheA**_nA@-6z}!)q?-dhCiTA0X4^%Pu%; z?Hemi?#87=_r@V2-`)Q~|5yDV_jmt(moVbj+xFaZ)0QnvzPAJ9dNIV$z7nT7iYP&& z)l*HiC{z=TXrR?4r~zergb(PFXAY~FFYA^0NkbJk37)Nzs7oCJ)Fh4p%AM>KY5Tr? z`-JGeeJ38-w+~e91Ei?516o*U2kWsm2Soj5z&6u~bXq?EE)7VFsq}ysPmP#<12vic zn5^<$LTq{(bsD4bkIA~nQb1}-0m(_A#*lh%%}i~wre0}`sn=(NA@z=&O6V;qGExw2 z0`gQNu~=pP%J@}JGVu+!6qGs8DEEEbk4Zc%kxS);x<&dHd4sS?enEOpvs*qY8+B5Y zG}0;ZB4bScm+4>Te_8aRNi>TV!D!G+qG&Q(bQ-PJq?bgU#-t@cT>U0uu zny4T!n3KT-MKooIqDk+QB%MzqXySBbL=T!r9?culr+SQ(;H&Gsk0KA zH>;^fv)Bdll=3piMif#X~%aH$bQZZ|`^7ik2!Z`C z1mdUC4%qnn%DagZDN#KZ8OqLML~&xUF}NVuroT?FS)6^Lv{K(@yjHr_s42+Q3+{qK zUuKTJR#rb5An%|2^q?f-Zq(}?c3)xP(4p|=_$Z-%pU(!JyH-~F({MZ313ztO z4v(4bPM;(+SNE}vma}<&Qew9+@toXPuI{V0SCv%Debvl~vVC8B72z9y{M5nIrMDNx zh4QV->~@00W-)XmC$S!<0~RFg7}6FPuy1FfK@uoS>>G!I0b8J~f|+lYzJrDyeX(u9 z!gU+ZY5&tr{l6e%udY0^Vd6FS_P}(k> zOtWP!m~_U9q2J%HHB~O1IPFrlkGw$rSh`4h4LPKQpAgTbOL8blEYLY`K8eg>DFtQb zx$Ljk=d|OxoK3h}dO~>Eyj|!qKW}~+M{@p^W3$+EY&khXp=OA!(5v`QGdE_O<7~`Y zBrVOk+#lnLhSZIw%?VSbXRK9UCBu|G`d2Hj_6E@thrIgB}JFzn>(AoCxye!d;-swk2g>1 zO}=*8_%wyX&FthZ944zh5d-`Ghpe(}5o5KHdLm$4=%o?**h;(hgXWLlR!ouJ}ov zE}@+^*=L2$HAssFpOvPx$j=y~Cw_h?pyw)~H}JD#H-~Vg;vOQ~pChN(DjSkJYjR?V z6R|YP|FKeiol>fAQcC4Jg;FK6&4V;)cxm0Gkx_z2tJCnmOCV~p+}UobVSmWLY!Ecg z%#2J&rl9c%t^l!HTmj^TVU<)A3PWaf5->xRjo=(W8R<)#-xiVduc4r2)&|rR` zEO|In5DEtFCEq?V>#FFQwzDt0b>F)FPEvL2!^7(*{c73SoBLmqb~tm+I=_Gao=5uo zA8Re!JZgCTr@#B?>p~y9H}D`Jvj3OCh+aNlPL1T#>9kr1BAYUU-e-hP%Va!5wvW)x z5YAK#ikTX+&7z*BeSB&kJZ;SM{}+szUjH*z%{1oRq!uKnU{cDkHBUNr3L5LP7=kd4n`PZ-A!fr8V8$n5PJWLY0CRevWX2bA~SplLrcK zaY^BeLJRAKu5K?N1vx2Z=cJgOlQyb3A;mxpX`^c3FPes|(A;we8P!R0^YJ7nWzI^r zG0@mRHc2LUO({umb7dPn^VbIB%jo$-cc70^NZIETpbZLjtU@kkbb!OPb^0HACHsLI~ zd}II1_rKA9Ur#rg^7eg%+!oprIDgxUbE?2gZaPJk@AalJ_@uM+^?~qqDx7NW1$cfnXOvu9kK{AXE5>6HSd@NF}H?$p}GfG}fAvuW{d| z8IDxCr;$pggu@ghlR1t0ePTX1YBIg8k=Z)RuCsJkj^)={y30o-;^NXoJY;Ah4(2D~ z9A6@KXD6<~6q@A`inK}EA_;;**#F#jKVlF|5Wy52!cjhc z!`@~@z0Z0#78?xeOBF2N%X>#X%HD#4*Lu;t(Aq1b#0f z;bT8b$@AZn&gB18_9cK(Rp`Ri#WM;BVAR(C~3`TNMR*_9)B*G{vXjxQ( zh`WZW;8sh0|GIQ}V)a?IwFDAE1Y1*UZPij~>+-Z!d9SEwOUv_7T7hK#@0@$@^WY}4mx!Q**TK!n$!%6vE2YdL8FN;)dYc@ ztL*qvetVnIYLLQ2=8PTO`pf35se7^er(gZ)ez-mS)XisKb1U`PsmRc)Yu?8`^+5ob z^RUf8=achVNhLe-yfCF!Y-8KSS>grM7V2$^+a$h2y(3aAw)!OGt7Gn??_r*yKjj&b zhHdm)G!n2y5X|ZvmB2ScrT6>gyosOfH>-2Jb5G;@3UWW(ZwB%6?^|a_^1P5vpUDf6 z$eDCQIDFO;mgNLd;6;X_=>#MC8AcR%KEbhmj$=g;Fo=eTlX$?36p|pIhtL#DYi8hf zrjHqB4l*=z4v(LcnmL%@dbvK1;)c+c{(owrETteN{(n=x&&GnIr!bt59g9atiakd# z0)-t*CpJHwo%qMhH(^WxGl#Y^6T_s?&hdID-wEgTg%{85i;W=&I7$Ea$=x=Viys{A zmkoSsk6Izw$g#R=@_b_?Pvf6tEYA#;-X9F+ z>0~g^;!7Zzc|PgS)0RJvFUjt7p0)yc4>r+_-x>C7C}sf$F=Cb>uq;i9qHR6tan`fd z%p0xF8iv&nRzuEs@J00RkQ;dfeYFHejvrCA2C%?jzFZxaWD~#4Xfh=Lhrwv37*t3TumgmoC~}0*xgkTP7wp;glOh8a>K|JfT{#|9wNdC!S6-{ z@+SLG0hmBX1xs;)SJri&w@MsHHCSGOv>gcv@rw5toyTxvRJ@$;0kRPkZ-2=yTMApaEg zeU3GermD>h@-qzLWkqRbct6AN@_E{M(1Hl@Jf1j*Czt8?I;}8!O=RvxPXPr^+QlUJ zAvkHbEQl`T>EN1{P!JQAe47NNy{G_GDD7erXb4KXGzg}N9xxsdOD^Lu1SGWeI@E_y zVNZft!Spf|GlZV%H*gdY!8G+^XLy8IUW^7FD|SXb4-XZwj(1`Ld--2fKSEH#t+x=6 zaO*8EO=<>ZFmUOQfm}KX_|jVdmEIyC;M_iW@!Y;T?=n|P|JbRD_(g|p^TuFxUTv%< zjGMuZyxP)1#N89}YNNxd$#!q(DT1CNhVlWvUJAB`3?6ceGzT`s|7>4c4TGWf4p?o} z7_bH!55p8()*Otq!HXfYZ?v#ubSbm<(zD@qnzF(JW(v`|_ht(STwM&i90 zppz3O>_}Ac1#bGdSabyG22P>rPy=q^yt&Xg~@z=D@~Newdz#q;2zn? z@d??$*1H>97Mzisy?p5aZ_Uh8L#5%tnR(u7vBj1=myD23g270hOSae|ezwN$FOX{T zoa)bWst-RtHt5T9YK1LU2{W#a4&|VrYEl7Zlq2 zi&LY_-jkc@+fK}+dr$V_JqAi2Gw(5P02Rcb9Z}4UYS6Fy{jpFiM$)@JDvJpEcV29N+y8~C4q{N9Fw9v zY<^JPLSxj44#&ITK5DN+yL;RBgIl z%hgOz&uF?ZQK(sxUMHzcY1v`T^xZ z?ZH5$6Sz&N&X}=GRLIoB3;^{}lWv)m0jmH4%7hzYcgIjH9aJV%)}~>a2{L74ol+Hvsg74v#(0jUDa68bDyb?G%T&fDL@lhe zUys7*ksz2r06gN-beMn(;R?7OZi6fwf_;`ep)%p~owWpiFoW|g1wX=HC6 zj8A#X^d2Dt>R~-Le5#6;)Z@R0teN^~OSMZysCJiLwaeP6&X_P`V&98@%XF8VS+3ri z=i`+bndE?a#d(KFGV4@JTuVnvCb%_3A1P)J;hSUlOc^13=19e>8>hKFV`&HUJ|Ipi zwg<-GgjjF_L$crrQm~S&#~|e*%4WXFCM#4Tk`LpRn5rc-9l~jMYAgYNC`gA$sf?{j zrZUU-C>Q_omaCsxym0v$qw5x}zT(!;{@3H5Z(;Uo&pzGvSbj2mXKC+^TTXuW7o-3E z2z*<=>T4IAbgu1aT>Y!f>b>`GUbdjMb#2`lyEk3?`ZXIr!K=C% z0D3Rx62K6Np;*_(ajw9+C=vI6MTuA!CF1@sD3PTW7*t797#3$4S{Opt^e61n_#QR^ zQ4{82LAV<_xZGh&B8HWBtmy1c|GNt(@{H@!0*TpKH@FQ;ErB>0^Rw`r#RN7jH&e zN-yPK;pyOzgKy^OGx(YGIs7K=N#?M|$p9I+Wr-F1LTQkn3WO* zA;B|#o@W4r3B>pjVg!hoPZA>Fg;hLUg?IwG*5w!Su$SM)BOVi26lB%qFGld|=uw0a ze#S^J3mMeRtYEe=!^}~JVTRCM{nCo3>}0kF_cY?4ux@t|MAS!s4H2^4b4S4^q?VxI>w*nqz-?mof-w5K-6f>C zx;0S1Si7Slsz=K-d&mtrf*N;(t8dyEi;8AlbYAo*o~_WXH>6wv$>pd@EgdWCq~_62 z&EtUO(i=c>o@ZRyYAw`*j8Si9!g*rhvu-Fg|4RfY%T?=UsOC z79v3j*1k%LW*EeBJkN-dEDLxxyX^OwW*`^}hXX^U&VB}j6Zl>>4Sa817~q8jVDS6~ z;3v~SdA>3b_6GuCQx=5EfawneOheYRgl_nC-7p224+j{{&}D#_fXq-~UDE`C=MjP^ zY?_7v_-H5;)u#z?5l8?TE&>6#2v~rDiv|;zsS$|`!FzW;Wrq{d$h?tgcw{6R841sy zv1>Z=L4_WyarSv)Qex{?bcZRlV~iSMuJ#xqaH=xqXIb zQJ5m8(b`KOy?Ab4gBQUeE5U(%)Ug-(Ws9+Jk2WNL;f5k8C)^&NXeqMEGx(B06yP1k z7Y1+awc@kaiq8zSclcUi4aCeZ2>*5TreA!JicS_`=+oaWsEJSb=x3u>?HhfqmJ9hu zUt#v1>U!v#e@apBk3>iR{NMKuP(L~`lP=zuST*b9;{f96!E_(97szn2y|O%3`1A(4 zT?JFc_DEBV+-x|DpDj=#FA0u?vs4+V3Y02ko@Xjq1iD5#yGCAe)Ghl18d3;CS`cYo z6f+goxjGSkEjXb#m zWSl||Rt8mfuK9*;((OPHa{(o*^DtbU7cd+i$)jW>ZzJotb!`^}A}I<3o@W^n&9F{1 zlWifhAYgk34rw4)9jHftT{!#Huj%NiSGuXE2B;sbJm=YGPjOc~i#a;yln&EzdMc;` z9aNG;IE{iLG(?nWL%q__kXPCR9kD45a~g_Dv0;s}x?x50J<68)Zw0>{eOd|BxuvIC zGQ|N)Pez`p8;tC$dnxjI-ERZ$)$!AVuo8#)1`aMvbBx2;hQpf$SgHzDg|m$fxjdb3 zoI}rUEb!gg%lXyWP4ZUx75Q`J^Q_U4Qz5N4rE;N`YJd3R`m5_veY{ESQopV~s+Lsd zQFVv2tCsu zwu1~yErc6I@vJ4`Z~EhL4wU~EFr!v%iBnSjCHf^`nm!Ki{f8&&IOTv3QUS0el1*2q zaLDH*rhm3Wz7&mPu@vS!;4YCAhJ^6>OyN46guix*eBqQE2d9S6GE1$sa0hTA)129n zVe+^Pi8G|kQ0XmO*ynnR{z7I_o?woZHM!>ea2{>X!+Z#L-QhP6@h+wvN{5q8Zlh_F z>wKE*rDz$2rqm1U>ny5byI92f-8jr&?p3wlXJUa>N#UOKxv*hUv?u*9EI~(Dm9QuY z8H1fPd8~YnM<3X^S~jZ}d$MF&#gTFZN)VImhacjo^H8?y$VfJO$nN_u|8kF=3A??^ zfE0X5S0Ct!?EzFaE6ZyA5H$ex6gF`t z*FpZZ|1b!u^G$ z&`kgYtV+^GXdp)k4OC8xrk?xZZ`A6*)ABzcLIHQWPN%!${?< zj&X?{!E*Mj zs%+j(aBGZKqrJ7I5(RWnldPruAx}rpgzpb**m>!W9&7ZoA3whq<(7P7(+~gc+D$)X z_Ky7R>kGdA>NTT(9ewM&@WB_B+`Ip^125z0RtrmqsU!4M5Ji{R{yS7U>c+jI+iW1X zg60akE8t7y&3tm|Z5q_D`CJIr0}9Y)T;jrUT7qhT*5fnlFEaK-+&`tnR8pwIoVl0 z+@x6Ur82x?tD%SJw87cJ@dpJYwm}4hW5M;E1>v8h&JzdEVg#t&wlsTi(dr@%q$(IKCrtHkdIi(n?*z` zX(gvjSC}?`Tl@lazIdL0ar_Fjl368O=3fyXu6l!c)AwHFL*Iw~zlQ!4`H)z|U{zH% zip}WUD7LBGM3hn{2B)AlWiFbb%=FKRUmzBgE0hn}kAo-RF;#~FN|kgC#NrZX05K4! zr0_IxoT)5#?1Wn(*f$mvgS4TIv#Q#cs#~g{rFH#)0d>PNRv5hoU1i~=Vp~_k#OBK& z5e&Ao28$P#L9DGoz$dH|hKhBex;S8%axCM@djsfhgIQQsOk*Qg*ePd4g3{w_z8bX>+s< zQ%Jn6l#^GzblaQPu6g736%RJ`k0gG0?WTWw>Za=-+w!mXoqYUJNZqq&8d6WpMCPwv z{pri^{^}*{o9C7e)0Om85C9b@NHi`~1>ym;geo#cVTrVgTFYE5tdjVEJz23Zl5IG6lb>P}`8}Q=k&9!Yr$FCWr6$;IOj_Rt5LD0r6lV*jn}nW3+wV_0xKa zvr-K?S6^H;bIg>LEnvz^S%u<6g>0i1C(1*}nplO#yV_!wP^AxL=j%P$?C~Bikcr8G zP7h<}NKdEJx97CM5dKljssO}A^@44HX?BERZ~$*dN9#eXW6C-m=*>FvQMyR`9P=i| zhqg%n{ajD%*!vau%`Int!ZAzvQzo)}DgTqQ}};T!RpD`YohFC`|(jJpc*Wp?}ik93eeq<5jtB07fiqf+Cip zq9wpjp#M4o{U@lL$&gTP3QLO1}ktZ&mvYA%os3OEe5kN+pu{v%=Q$) zhS+W(27S1AFkxUF#flm!j*HN~psg)7)1{`ZwJq0yD?K5O_^ALM9<%GwM}5)TH=VmY zHo4`z>94;|ee1rSwYixWnBNs=uDJBRQQj0u>7uSD*J*_$G5$s=?LSwV z;b(=4NJXQR@i*4wrFQ>0(oBDWTPl4;IwAfopiZo5tesjjwf5ZFZH?O-x%TSz`mV;A z(#+}^_2*ZgU%#5WtopM06^*@(@75l!{!7hYYmHEl4Gf{319fp9M?#`#>vcbd}bnEzl^lNwZnQd-*oXs#pX%fA>0Q<^2}PhCmQ>$P@7A__09pf ze23I>_QqT83afBa-|vrJ^_#Cff8&#@e!u-EpFZ;BEjK^)?2XqywKTdY-Lmq+j=p|5}z#s`` zf);53t0T95tULmSQ4G=yMv^-rijNa;wVo)GKyV)cSGGv9h}*}=LXC+oHo^kk2X*DAMx(@qL8{7mea%BoyiW#t%D zcr6A227EVzEFK;i8WFJ7_E&yOB?m++?674Po@${<3Shu(+Nz)=u z(fE`HFdLH@k4(GrKmkc^p6&{)D{zu5m)~^6lU(TEaQ zYF}yCd54Aqbt?oc!_p$lr5Qj!N^ht8=wbRG%?{H?X$0s5eSkhl)3l8 zw1~d~O`Im}I!)TGoYNSU5V6|P^ZC;iZbK)T$ky3)Bn#bg2DVfiyiADGDhPXMkzw&z z12T-*p7o698W^p{T>}FH^q*dT{bYd7oO~Cc()UIe!6`&vOt{6?7k5RK%dc{|sO<`> zw+c4CE+)HzQa;9Aw3I8zuAn&KWx7B!Y32;NmD$2DA)aA4nnpC^15l9=<(FxLkvPva zsUg=yV!61XZSzBaC=``tB`u2EBv>VNNed(jGrFw~d<`6iH-UvD0(wf71izB;WsrD+ zToG>~MST8et7o0=M=%o9IbX+>rXJ8W4+B40(s)+BB1UWLR-Lz-O;ujkGQ2LvprCRw zV6S*MzSTdr)8K}vW=mLSXp;9*Wu0pU?dglSJdbCSZ5bH-O0vDGqkW)t+Cy{bPk!^8 z&u@A}o$~;_{N(nR=B)$}uY2krxOamxZDuYmnft!L{qc6R&|~>5_l41l&ag!*USRDM zkS(wm3Y4b&H*=h&1h+f?7=Z*uR}fqQbABx{Zg&ZForp{};UjGyNBhm%oPZHTvo>ck z8sWwfffq$a;Q6%OE<(|C+HN5c1(u?5 zEuLm@0aTKJNDo2H5*V74MUp&z6i5(!Mz?98+Z3pb^@_M^EXmH;3@HuD%crdNsNC_4 z(hzO~unQ~z2oq76u0y9S#e9#3yg!&1c)!1s+^|EXxN87D^U3HM_`>_6kKM-XJ@q{78{IUr5>?$eis#AS z4gl;RJ$#$L=sn8>t1t1Dr}@P4p@yDF9?EYAN%);euoP%*%RLI=F{Vy8TMwlWaM=Ekw;(fUHw3`FP?MR zZXX~`e|D71X6UJ)hPs-tVIKfKk1^B7@r}o1!y{LC&T!l#$2@Y>BUgB)`oukQ%p*rV zvh1NcDIQt%$eKs?dD1oABby%C@W?(-fbI>}O^tom zij_YpMm{Nq+q(?>Nih<_#|U;F!&a3f6)_oqX3VY6#)e>V5TMo?_d{x2^IYSYXMdq4 z4G#c_%L=FpU?WWtBVF+YBTa$`5Ogw!Q!WN_%<_{I!d8FPw%e)n5WK$s^q|5nFp)ge zQ+6tP2g2aTBZS`4v%zi{>>}Hv;29&HzIRpj`!asnh(S{cxCw@fkp0sT(GqnrDgqI* zQecQ`9$Y7J0>xGiQOv36qH(v`&~)Lw@HLY57Y$#x_mAz+F(HF>P%$u*lEs=D>n ze|@IEX8F|h|7&3B%5yhQp)=o{fAOVD_wE=RsYTyickz^OJ~8qT+I9W)3%~V^k$2qe z^&@&J2*QsD%Hm@v)`yXf6 z^tn^y6rJklal3CpBB`+iOA?gkhp~N);v6=7G>q1Vw}<<}!(lp1q1Hgq)xDsrjX^i= z3K9!_e84cA-qJ5kUB%NFl@{${oj~SE=jB zSUwwM4MF5ZPNY~pW3XxrYNF|=9Uhd>gM){dB`9K0ge=9FM5P!PD=Dj!Q=j+f($?=? z``(Jj7V6?a!`j)`e4oxdv}4Blc`dh$T!Xe;b>*}Nel_wuKwx_5FkMSe1qz7364sZ& z0GZY9!`v5w2w@Af3QH04g2{;yc@{gHFRd)J5tk(YIPA^u zsQ~%Q*qdJPr(y(WixG9>${SU1q|W1%PTi6^5uDZ|dvvJNoXc$;QTJW1AZ%U;gjat9q~Mecv}Tjnntu zIbEmE)KuNu-9H&er<)L*Skye~@P8)EWnHrB3M;DRH{7)aWq~!uuIcj2U?tJ;d*YQa z=GQn(#yy~?M$qcCxx?zHpzX{&ZJkjUzp@5OsKcLf1%C8ol{}foj5Uw$d44$i%T2K_(FX~10K~%{uO>$r|1f@kc)2>jpQ9RQW(lok=9*=arnBCpY-K_!qYkRc& zSz9LOA>OrB>$pagDcdAoTU$lw9s}_BlLcDX6L8sgxLKK zkJN~gggL@1tjBDP$3)RfIZ#Ebl^&D_zd1xeNcSxCiNt>8-W$DLjKU7Jh5C{0smxJL zhA_s$^m`=cqEXD?Ko?~pEQv_56QrsT3YNcGHnDW=8HJyHXfQB;s=S7S zI$_Ax&-gdELFf5EmW@!y=}^5Qd)}t&2XbHkZB}k^btchvv*o;BX#^3GfY)`Wilo9% z#fyN`RxSgdN4vm*i}~dx5pUW#5&X|k%V}O%Gi9-71a|Dd#Lap^b>o}kZND#5ZWfiYHGhj{P*LY>>v8eVuOA{vNLC*l-(UZyGkEQt>pE1Kk^sL zv&=#98cm6a_N~-DT6xnaHv=d~Nn5bf1{e?(7g!Jw2tNl{;*irRe6)6@2>PUp>a&D+ zUHv`RFIf-}C;SC~ErB^99MMo}mQru{w_8FY^2f46*5x%#TD`)sq)*92FmC=kO`rpV zB>-ac7^Y(u@>2Xy9hSOk9@05qMIZEn2k3`MuE7$rjsWo`)tQJKZMC#=5#fU8V_>+L zwWY_-tCQLhFgzmd-SeSd(5T~pnh3773M|n>;lXLQyw~hMp|PGx+)W|+VRY_>5nw`$mfc$Rqaot`v=);e z?uDN;6XBo0F|A#f9FM06kXJe#wS{B-O^}#I0qzP6YIQ)-hCpKpSA2_{6FwgE)%(`c zvfd3XKYW z2oRe_0!CuE@TfD+AuIz&J2-I*Z1l$2zq3JCmysboozCW&V+i0B*CMH3j9?07&9Rx7 zR^_0mN9`_0$3}O~xne8-SoSIL9{(=yTF_+#yx`u4;<*R{S;b5c?F(irj^ z2T8Q&c2bDK7?dnff43|{AB7g%n%;{3fl@%Y>~Qz~3pio}XaKu^Hk8LxH`MAl$C`=X z8U^CpX3Um>Wn}X8PrW~hI`gcX!Cl(kI!f?mHYLJqGe{G6GHdCe3?yKm;hJk9{iZ`K z34@}frKnPsNkZas+?-Dk3M97*@gqwc6be3p^=23?2hfb3IGG1G)X@U>J?P@i-kd(B z!@lWN+0*|FIm4(*`GZdlO~2|1hZaYv5w3biJPtFhN%&UUt*O5I;(r2T3$wcv%hyVh zBS8z}V?@lsutQQm#Sv7iIam^Flui5eV+XsmMNFGr5mZkxx#=3HDwFV%V>wN^9JUbn z+we44qfHcr`FJ2v)TJ}!N5y^ai=uv#0}xdcpP2@{Bx`VM%dd4+vnz8WH=HjC3{I{P zAZ6q@X@=b|7q0qFkIug|YQ(2B(W-~`G&Gr@5zi0YRqi?(>XU{95G@eIP&s(z74W3URg&FeTEAap%qJY0d4;hb7?|0x zv|Bc4Ga=eMgLMOzV3Rz^_6h`h$qYC08{lS@f~DG}q8L0A-sMQRd4 zIkgt|e%PFmTjkhtlKQ&(+h?nHXp(TIqTz?E=T3C666b%}mlTk>iZkke^l!oFj5rt6 zsAH_IK#IkQ7Ug$gC{xDbxL|OZQ2OH_#x?x!IqYAW!~iE*u-ZYV3b8r#6i9&zF=hfJ zBTr)4h6of90#V9B?O)kQq9alfzdgmquM-(_c)cQpwMk;RsGq-!Jsr6r#O{kro-oA_ z=ZlqF1iJ(_uo)yyEjy>w8FzR_JNc_%*W^VBZUZSkI;De?BA@9|$R(oS4@-xaK_D;ejSX>t5jgfW3 zG|fQBrD-Ni#)$Od<#+2{Z%2Y2q`w0OOuAI|VLJ0zXZBZ&pM<;JJ4U;Bd&q-NBSawr zn+ms>H!in&H)YQjH&VCc+?1TrfvCg8)GI-;Yb1;yY1GVVxKk`?B?p@y3{DOVF(G<2 zR{$$VsFCem7ZJ%Il#{HWNd6cc$uvis37_>3-p}>?zxj|q4kc)??mF^JAsHk%&7lxYhCg2)+BI_%#L37; zlZ@GY50vKDSqpTv*zWer`FCX?6?7)o0=6hMH=ktdTHCKvAMReXN#5sAy7KX5HNu($ z{OuoTdD)!DFg5b~VgE|BBtr(Si&+FtyuWyX0NK%sd4z6JTrtX5PGYs(>Ez`z<$`{{ z%EZxeq;hC_w8IUUtW18aQ1QFP-j(@otf7`2!}wpoTwre2bJ=6A8_e3Znpr8@JXJac z*531F=?V@#JjC9cNI9BFMdqpNZlprPNiMjI7%4*b@NbPscTA}LOe?RPDZKWvq%~V7 z;J4W8$>f&mPKtG7PUjj=OJ~n445T0<`NM>OT*1j>x@J9;Y?L%sBqBoGj1RB%1EPpD zh2*IT6qR8i{N$IKt&r_bZQ#Fihs)J%Vz!eU0M&e7<1L*WDDkKpeIw_?XcvdQe%;67$XKEqrW0Rj@SzuOm zL9~k_pK$k3|0M0nzVN#>@YuhAc^GHp z#Yjsut=75fHk>b1AxQVU{_tPSkBRSo&luja-aoexq1JoPm`>Z*JVJ*bj4n;?aePE0 z<>)_wtewkR-DY!039!GV($ra8OPzm#9k#HldQYAW*vpGptqI@I zK)(9bP~+mV*yJeYQ!#R_;Bw(T;S`Z9U<5upuVEiO%$$~8G*bHLM)|{hHH%pcPmR$F zN$^(jNTNvSCz~mAA=p*0x95YJ8&|N8b?GiGjm#p%D>{Z-nd8pPGUw3#cGgz@h%UMd zFEf+aVv6RsZ+5506;5Qc(q}VOBQcm&HN{l~A1j+)x*?~W575;hCJgygt@In^y^n$t zEAqzrmJ>Bf%rc6Co_S{(Xa_|Y)i{#u3ROpZXcUbbyuFQ>@D^{NkQ_bUV=`*&S+d6V z^I}l40q64$%VvxgaPaS|a5zilQQ^IL*{Uh`k49@pk4SiOBKpb8f(VElbdWYLGe}lz z=&Aj(BoJ}xa*~1Yyy-{|+TD3Nk>B9I?4s&+$ZRHp%?XMN?CDz_C;o_SKP9;x!}X$`>-plWz=r$LPW*h3pWFXnLzYWdqW^Ri5MSd_KhHT{T+C z!58O-qGya}=8fb=lYw9*Aj;zOndK2~EZJ_aQ%n|G(fg2~O*I2^7!+1nb+m9x>=Nn3 zD2b%XO^i)|1@RBFo2I}Ac9eGz7>u9#>IKPZH2w4{MZ`)N#%>ZxX2gulg*;N7Y6{UC z6g7_36i9<>gfV*K|B|OIXWEt^+~{N(K~Sbx?ENR!xw6Dj=WkFy#6H%N5~BC9(5(18 z(q!h>5!vdkbiA7QFaCUW4%?KaT)V2;2_tG8P_S;+lQL0>dC}sMCU~eFyRlkQCPqx0 z^%#y$vgvfo7{$+7H2qV^I(XRKiIli_ZuCcK3wJbJ2*PDkWmwuFC{B1E+ehDzJN;~z z>Ic2{yZ%d4oL|7p{rXaK)U2%-|C_8o{Ma=Ct8qpxfwAaQ)Iu2JBZt^syJKpN;c2jQ zR8eEj(!(=`=cq~TNo^GK;O_P?cm=y7oO{q|yQ*g8&dOSkCBV9q`ASE(jo0nP2ZdGoeolOa@U zgBIQL?^fCF&AOJ#1e~9_TF2Q07o6RGe}k5fthdhw5HBbXq4p)e;)3{6ePZ9H-h4gY zh_LdL^H!g5eLnJ|iQc}-Vo&nl!IJDRfTF751WFB^p0-{D8K=!=xIYtd4i=R=>Hfmq!7w?b@ z?-?p5TjX6EUxK5iNIX{xpi&GavWC z?%J{!CG1@ODl%ea=BOd!!Vh#u0EFJK%vi4-KrHKAo*c5d8t{Az= zK-{uWtfwOYLgmGBQBtlMcn36)F;Vi}ohhB(TnTSUZ=^7EI}t`pVe-9RN6j}k=AyzO z2Vk#Cu>ZiASSM%c(le=PU4JJqJqbsz-?v+_Np63cwYrBM!-LvXt#MG%)n{y*e(CvOX`eAuFVQ|G=?Zcu^;Rd4QFo#<()SsvZ*3T`q z{1g5N#XC%j(w0RmgYU&gj#-R{yEU1a#-L@UvSwzvn72@7cDRQddPbb>g=YxNkB6Tq zch-QKera`Za?b1>uuIvI)GyP4y*07T;ER+{s2Mst;4MgZ@Di}U9gg1y@OcnM;>hwG z8pTtO%Z#v$CMMO#SVVat5l3-Y31c*B!k>&zrxqUM$r2u_tf4I;sX)BpA8UAI9_ z!GA=h$N!yNN8$$|mXZ4!p_fZWl-wsug}u0(o+C1aRO0#XuC)8yD11z_#qXb|FXOJ# z>8QXn{ho@I!^_+vVvKm$^TJys3E z;oA%F)i_<(l$*<+6M0ZW?+9iCt{}wFSJ2nsAl9|aVZ02=rs*};7nl4SGHyVo+*}Ea zGjAjc5doll^m-eo679Mz>>biE&$S~8$ebZ8Mpa9&h`S6$rU;4bMY8NG?H%RvA=iZY zpAA_GJUp`N#wD)=ArKH+dc?s;R2WjVa27<;UpQ|!ZJagx3BLr(h%Ee}H+BI@UO~M@p4-U~+OIGA{g|xDUEf!9B#S~Xp%G?$W`c|ivxY24ARMpgB8cqH5 z>?m`qlsWz~`}uPu+T}1Sr#V`02Ue`e*s}eBpk!YuW4qN1vpPv$%UZ0`-b1K~jwp2} z<{W*Y0z;%RgZa^LAbgQ3wa-lGAXf%vFTt<0H39*l4zU954en|Plgk6Mv0>x`KuA?c zlQXxk{$rqfw!du)B+JWr5*|bO&Z-h|Pa*T%s+dsy$eE}hZuZ!>%w*_x;oyr)u?Gckk9ri;;+ zfuNqNmi`~BIbOfW#-uj+p~g%)a-uv!N@$`msO%VHU+J<9F9l#vjU1l+uud? z{ve-RtW&|g|2O1z&i@Sn{r?B?{Qtl^*GrzX4`D`;c>086N|7+VhmoNO{Uw^H`B1pv z3(^Q}U5PWv4gc9^O!=dfvB8ber9OhC$hHcYH89$puL>XZ1hhuJcfE&u#)LA_!f>%u z?Le=yzQ9K}Q)!*VH?*}CYUDrG^&K!g+QIJQIX#8bq1@{EPO~21N^knhI=_|k7LIDW zlZ*+uI>)Bm=X%wO7X;sO2|(n`Xt-cBd(*h>h#z172kfEBsC=(P2oukDGS-Hcz#MjMzWt`rk3k{(&TOqq^O7eC)1shEgNP)`%*Bep1j9qX z?7=xf4nh)m6sQ)4z0wqX)+0^_xQsAyZr=v4=9VuP->y3A%Q zQq;2cLMRah_D=~k>#*f@eOV4Tu@HMqUGpBs+CkQJgS5gj$MKoXG%vM zzxPnTs)43#2cs~c&+q_hm8aWofqS}xw*7_YJ)U~I=vusjkVX!ihsScAajI9<0d*z~ z+=R4n&0k(UgCM?uw){AaIiArHbezWn@xvzGz;&59`?->#03uBZVmF_|#*3%kjtEw! zE!^PFpub{=vCj~=)cjdjnyWX|G9LgY=>bybupUlGAgT=!)r(6eQ)}e--up@3l>P3U}S% zXW@qx;-LR-1WXXRB61ehf&+UTAb{9)d!;6)UYP!gDa?wdjOQF%+~>q(`(z^j!gv(jlLF$M2Q*PTKwJ<7{5Y!2EbH zebnYwo3JHqqsmt8U%?0G+v>l10vr4Q_pOtrPDUqq`@vrR<#caFZFB9i^5=dhjxU1_ z^$et+6t!~?`aWrmrI=2E{<5bh~>ev*CevErwMj>Yh?sOW|R$*1L=sOk#c zp6!~xSk=>-8-8v^RgdO!D{Mx&)hLb+Sv%p*@;O1KH^;vWeE9*AuD>qDufs-q zS8R`P#W4%kJ275+(9ZSZ9jd2-T> zRA~VDs|mEp)dY^YQS!1Rm~0px4DC!V#BAJ zu`17+>{Fx0uDiC3e!=PPh7gz)!Qt=Vt$<&SJZse54IltY6C|u#pQ%wRnN5>#kok@k zDifX~C%x|?TGz(Jgu{m~rMwqiBKd20Csu{y+Nex!*Vw2xdWCq^ecdz@nxnhh_^DaA zsa*^}nhENW)1}pkAT!mNA?50fs6u<>xd%e|^#M*UH#n7x-Ryp6+Am88js45X4z-5f znzz8wxY&?Kk8cO|T-5x9xx+< zNT6&NkCp36t)P0oW4Te7@ruvD`^79T5L8JtK(0_r_*hD@F_MVoS4mScI(~6lOTyqS zp;GZ92I=k&LtlS(vaL)>hgnm*$O_#LKC6ZLbdFMzD!0?{awNWN0j+7&I1eRj&We#? z5Ubft)H1lV1wz@O!Up~}o~%c>7d>G^v~W#Uj#BcYuq&L6Q3CL&E#ztmsp8z} z;MGyr99?a+*njd4KbAOha^~TC`8Tmj32Mp%N~kV9R~Fe8TmpN@Fz6Y)0-;5$lqtRj zgd!GGSe*uymG@p0yZF#QrrAWN7cJVY(O2Ec-Tv_3Cu$e<{}VQ7!uXLnM{7D~8f6aC z!*!PDxCd&gZq+I|+EbBXu_r0OMEgA@JBr=UrF9mbr1s2^!LLM0N;+uN(O7}l=#c!0 za_Ma=i0a_9!nCvM>``SL0L$_>gXTr$Wm|o!ZvvH_5oMt6) zhW4?P8#%C&FF8p_(VZ+T^Ti2)s7K zHykVKaMFJgCxkr6RHmdT4KDyMBiMj$O`?zol|WMp!HK1qw;L=Pa=`0&!p)vfvV!C; zPUJHZ7^ex$DhVc=lYkQ$HX(k3Nu>0G3{HBAPAprTA~V+Nj{ClmbDiFJufFcO7>dx?LCt)x^r$t_yO zv3Mt-GNj9+IDJ3ERz$f@Q;6ik>1WFm2M|)4-%)#sR{g5O?;7ZsenzhuAES;PRh=4| z=zvk&;qeWtKczLnq%?t2->D~$u_VvONanKQ)sxYHt1m=|vmCS1j7N+t!v1puLpYr6 z2@U?7Sdxt3OwW_4`=hT+oj0M6ev_1+xQ7w#HsOXilpmuQ&ts3ICo=tpH7Qb(RvMls zm7bC-aXSeVP@2DZEiTa`{Vs!_e76sNn;%;VY`+;yFxbVf8CvcD_wxh^7{+@BY#S0e zC2KbYZb}xJ2Kp+fWr>x~GkOd3rff0EW7c8ip;V9F?pf{0?QNIJmAc*G^YneyJv;0_ zjTx{Ia_R?x@cE99k<*VrcEEY;IrW5d-EeLV3uS&JYO{t&jhG1yIx{ zDo(6oy#FpVu|&_6#9l0QrRYukOw*UUE@4_sKXrfgcqROZ^{0~-jc3-@B;BMG56fuK zdzN;MelgDEmd&A@!9uM3S@kPE&0P9PI=h6bRG`dzkzXa2^+NFOn%z zYTpmot27tx;>h8j@TUj`yMrkzs)<8^ zPd0_6fPw`p7iw=*>e%Sm`u(oIX}Za}X>8EJ!N8oSGmn`Zbs5PX=^lk1(I_#Hv5>Zq zZkJ1t`&gh`@VDxZ%6c!8SLr-eT@)w__)Y26vPo({+0PhI?3yJ1Q~q6?@8Fb<0LygI z$EvC$8UbvaloY=MVAK>oMQneE2nglY627Q0&?GOJcV!7v&T?geo3p=zshTio{4EaY ze!~^0f5%9Gl3!$U3w26-y7za8^wbM5LdimOep>v1%1Vel=gk|lMH}cVeKi=tjcBo} z?F`Tg|6!VlFEK;KVT!3=PG|(xiSr1&R3)e73BMR5B|*fFyuZo*daq1g+ST(#`|7ns zpCvOIaTM5aB-)}17)cOk6^y_Jiyy;}?7;WfL1V68jpu5NK1gvTOV3k+SSX zkj*T}$0i(goJGJ|pagIoXxt;r{w^&$o?uG0C5%8-L^!*rr5n~h!TYd#5^!0`D~SB@ z{Oehouo9zasKB+XMZZhKTlls4A=wIJW@xknl4&o0O>Rn@%;gqNaMVMbWIrh$O?)m= zTV9e*q1<3vR`yxkDNJrVWH=8huUQxZBgS}ra^ zmgU5+FvPkkq3Vo!Dn@ohf;ak%AcV$OS^AecC?4KPfKXIOf28{v#>ddHQ+6C@LEJp4 z^BJih$iGKkJTKY?0u-wlR%M4}+7mlKqXMSj-$7r9KtmZyVV#xah8B?vE?1PohmA!- zLtU&zW{wYNHbKNW7MOWT$&oE85eOksc*emP|LXZ&+7aars1C!tUAzVRj6^StvH1Pt zJEIrvmMSp+yL)sabwqAhw67L9-2|b8x@ih5Yju{H`*&ex4_VSML<+rF8svDeM4Fj& z6ZNp~h;LTBB@aK#m3qvp9P32HLo4qQnxf<=evrcGMYGA#be zWu^&LRaHg8W@<6N6*^Q84JqMFC4!0~6D6vPs1xOjz$Q`gQ@_&Wk+Kh&GfP6Eq)eN> z`+{R)3Btjv1g`rsqeDhliKEL*o`82zwJ zV`(NgmEEgUnx>sHN3F8t%ARJfMB@YD<^Ncfij3`^w3mx!NtXZOGEG)n?59LG$=GZ9 zN|q4Y=kxo7PAaitrjfdtW~Q{jg^8KPsUBilig3Qq8)wT zK=FIDfsi(3c-L{wu7Qdjp3hKm{MShH&~NcJnFd)J&TPbJwYHC7`4uv4B*oZ5rfI)5 zv_p4GKA5nHUFXgmqz+AvX-KLadFB?XSGxutTSsowwFCBuVbJ9=?nGyZF*1w$n~@HS zXBA`}B;OgS@C;WLn##&bd+eXM#@e)-fq!yQIOneehYtfMO9u*{^%$|~k(NgdSP8P? zmo|5!oM!KQkW!*zcKLP7T3Rr;7I2Kc0V=|>qGjSpR5|ukoA!_jqu1`;Mow9OZwLqH zy~HPXqga+${UR8kCq;TBP4B#Wwpvs@JIn>74>!O9+S4$mbN3`=qjBwB%w=WaZ0+UX z77}(&zC--&CUo<{7h7gB{OI|kmq6u>^R)MRi6Ulo>;Yv&nVIU(wPBf= znU3Xrtf;)f#b1$W|IMhC93YGrb-)|BIK5jOIeaH$4fj-LwN-i;pU`m>3 zCso!<&W9o_TSkWmDdjlD|KFP6#4|GSPT4u~O$n-&^#lh8ZxX}d7+Zll2W^JRPn=Fj zx-;Vq7J#qE-x)GTw%B^0?2>Vt6U{q&8gC{<|H41w?06#Zik7Q;EZW=K3r2~?-K#Jz z3k)6^AupE-!CF9p<0<4JD^!BfXP^jOAmg@{YQfLLd4hdR<#t8indD>Ak^z`mNk~Xo zq0-_Q>p_~RYiE3KnEZ&IB7O|aQevjkzKRN%Pku$zs)U^kkN=|Yak5t>=@-gsOjj$)SbL>&k}YtegDVR`A!!d z!)caB-IdSaYv+~qZ6}P zCCm^n5WFAo`kF`826xoTLDVK50(~p004ATq?{yd2m@$Q7ArFKw9MarM8dr|lXl%vd z<3w-Gv@;otmk_aYq}Pt$(e(NDoTf7o5+;;F1_g!!Lh#f@PN+`<0qYgd32P1DlwriV zM_<4mt_fp-&{!~m6P$aDv=;Z_IAnAY5p!(c5&Iz>^k*$WwFF0qB<`571XpMfKH(PK z_XZ$DN+7r|_3V`w`vGt8{{)Mw$ z1Xc=c#~Hns{e|bF90q5?M2cf}A;BSuyKTr$8|R=DLc5Q*L~86C!mEn6y+f^vXJCS0 z9b2!QpuKMsE0KH40W6$(hC}53{S3!@7FRzP*$5&8I_u<)1l5ZjXNAGF4H=e;%oMLYw%XT&Q;advUpTQRAZGGeS zZ|F==*qBFgM&#u=pq%(;EegN&dX~R9;&kzBf>LW4<&lptu5c?`qhcEmsc=<)>{Val`zB#78!7848AOt}Bf2$xs z`<&>`Zx-(LJ@f$k)`ApFxUh`+8nb(!I0enG7vd5cA>h9mMmd1U2v>nkP?Sr7OK`|J zFF%ScHlYD5CKlNVtLvL_rr{9n;pgSYlma8TktbvIxQYG(8EXz+XmhMC#F5o;_?$pz zSl#zTbL=igB>4Mrj=wFiGaR2$a!!4>iZ#F&Ahc#kDiFE@p*j}10ZZU}7y%!P?8q}) zKOpgK{(ig)-T{}61O5%s7ze65eQ(pS;Yrj#3fTA4jcEnGbs*Wq1?+g&uzd#MIdwS+7peJ(w@e9=ZiYGFjQ|&FG{qQ5ur-OhC=WBp~ z{|nrneQP+kW5N^JW7m9NU^6Z|&cg}Wo?~l}=$3C^Z!=~a@7frh6X$wQ(3W{?@MF!g zCq!tMbDzK#NC4!E+(QQPtqtAlZ(6;7w_TWg<|7>V3;g4mc#OQ8@GWtk01jl~KY)MM zqTgcM8xfyy`EFpYxZHP?-zV0B#!xu6hVs2Wx!Z6Y3W<7wI-X#D-wX{I$6=R-->@gD ze}`oM$2%r6p2MEiNG#Va!fgJi`aU9mgdGsilQ03tVF!}myeA&p>l5wMwkN)S*Ji?U)JOonW^X$N?K!#@AF!vkZ+3C;!q{Wp z6N`M?b;~L^lntDG&N%MAO}pjt4JH6?-_UGv>JM2wci*B3j`0EIa7Ma;a?fDbxJJK14uXz#* z8Moi^`wvk8@7EF(G-O;SD^r8MkHH=eecy^tF0~q>)TOW;f-*uU#O54?IKHXf{+1}5A}Cj= z_Sd->b0$N%y|SsrENUI-5M7Q``dC+?B%83HS&mek@E&`UrZJWe@E#A9>cCGVg;bJF zP_PI`=$s*f6V$5#^IfDK`b|*Sm@vKukq+>1M`#FJ6#FsrU3aBj_uV#qi-C1ZEdK|J6A&|-s*#@Pus7nOXn(w`2laI1w99Y`3;MsTlTGzFUUx^Zel%LS7CbDKK6 z(bWx|v$plFoV;OfbD?f0s4Ivu{mPoqL+4!$@%#1Xa<>hC43^Fvow{6n=t!eP^A|PN z7rr}2LXx_|#h{1^Ytqn*a)J%%8lmQ&rG$AkIPp9RMl?5-&(p96!XSzQqES!)kjS*C zC|M9ftlS%S`aZ$4cUwbyza^WQMQ)rhA`HbKKt)gwwtffxi!5+CtUp!x22bGVooV?! z7AgmUTL}Xr5WIPg$W4eoMU6e>OV0MDs&n`%Sk7JYq8{cUJ*FQO#0p`uEbL$s}loodq9zP+iS$7I1oBPZDJepR_L zN9S(kj_d~c%lhj#84U=Fp=JehVON6n_0G3sqAWzRGWkp)sIHGyE5FAe9E`1F{RfB3 z4p>N3#*d;W(3*S}!RCR1iPMNYAfox@e=?I#Y#tCf|6VY?bNiCO8psayQxwcAwo_q2 z`lSvA0p(vwU=)h3jle%pehG@^i$a1uT(bj93LF+|ErkQG3RtGZ0_{s#R7r%}AEELQ zM=WcYp6PWm+8;LfZ5tjcw;a8iP{!r3dT=L#|ER2INadF(5~G8@V)=n}!pu=w3OS<` zBrN(rqZE9!;LVZ>6O}CEgn;-F!+wbpnNcbbl_3{mfo`nYSdfbQm_czqW#K%lFrl@k z-3=5!D7vD*!_2+;+ z1h4@D$bj;>a0}t$$wDW%;|BNK;SDz=o7D-Lod2ot)aX%_JKnu$AyJj%;H)eUG}J+b zyKxNA{KuJVs)LO55FMlc;|S;0fpu%7whr&-4NYyxbT)6_!X^1~`1gijP0fE|M&^H+ zsUo(fQ$^;5YT7=HS|5?CYx5WXee(cKyN_Y(^W&C}&7QR4{6)!#Wh?@99al{|Wd+p# zsmvR-O7KX0TmFYK3N&i9!&m?FpE$t4i&$=R(zN?eB&paQgm>fP@r-_LQh$x9h%ph@ z!ifa_OC&|o*mXhDFoupeHi3^g-ep9Z9Sy_J3jrW$5a$mc&T(Hz3X}8(0i=o})J*`j zK$#Xmj1>pxoOJ{7sgpKhX1YG%m0!O4aKW;7{7GW@1m3~)-F{Px7GYxLF#B}NV9WYL zhs=g8fLXbgC1j(6sFu)uTI1Gt`KGtOWZ4!Sx6cKfiDM3?Y#xTXwrrVQl&s4}>8&ZF zM^~PZi84E8LT$7}xl{^0$%hw_;}@~8wwujo$3XnMQ&84>u+#U?;jVDDH)!j9J_yH) z9W?sE@$+Qh_@x+J=S~Xx>NgQV2XlaH0p&NbeiM6uD>2hI4g84)XIZE^CUdH^*!il-#HL2mL(Jg zjfox)nLD9`7(dz?s1uIe%m;aTgd&6;85igck|vhi@PYpg#^NmMFen!!iN`|-nv^sn zKZFZ&!$P!*mw_3XblMwKBpe&+1Am9>&H^V*2v!o=VvG$|Ggaw~o+H{D#1e!vaf-Oa zVhagryB7sps>=@xiWJs2Ko-Q*o~)j9k~Uzt(;hSn-VK%yY5eN}YHP)q^c1lt2b-+f z)n#XXVH=tdmL19)ZyJFJ)K+GQIs_T&>UTH2>VN8CI&UUt`0fQ%h7m8nUZotn(ps|QUS$v)4+cY zo+IMtV(*hGz~vCkfkOuIUMiOvEKy$RsJv1yg3zLG%7G;bJL$)+Ki_h&>@CC`3fy_W zKzQ}=OCnA1IJf0cl+)UeR<2=I8>?fCmPEp-6_fyDK?SD#$w-z*0%!-xn{*G%sLXhN zyjOrxz>PLWmcdN7cmX{Z@GtXYj#64r`fv+zSQPUKQbqS=mj1>bW$qWZ?jB{>;$zps za!DPgp=-CJIGgFTaN?KR7(=k>n2Z?yNH=Y$hp;E+1!6@!Uda|yPU0ye`y^<57&C3E!O)C zyDQ)LZ?WhPotveR%vzni1-@)=sncT0@FVutM~8pK{E)Kw&Ex*&658{smwR!TUU; zz`+d2iF!b&Ib^47W9hqu1(@xY#goI+N{87pvoL7+;r^l?4{L5q_C(&DQ+TVaVaYG4 z3Ln0NUz@juk2sU@_qRMn)$Ge5j}8#+`k&F>P+1gwb{d1u%Cykm$u4BzNRxs5-~L}| zOa^_iW|PB{fk&3Nu}3E-r_DO;<98z!Tk}idN0#f-*~B+(3{|`=<_{k1tzlG*wxoY! z3FyLPJcpucyKpJTU5l-X<=2ZvJ@SRBoo`KCA=T$GFL>hXP8g08W?dx=6bOC%Pp|0e z6$XZkk$gS|e`m~ZYwXYNF*AX>X;gk+hk#)OipW0L?n$uZ&<`8@8G{i zemKW+p3o$YbbvI|17R01Q!vVhiphy+qtJ+ajgI?X3tuZ|dLLE7&*qhcRIfJ;gj9v9 zNKfFp?t<%xgCak&=K2lNZ_wEr^X*_K$F05L|H6Q#dN%~0geC)o9pSQ+NFqg34nlze z&ZK%h_pSz>RW2HD7{^kV)I_#KYDs%=U1{^8O<5&lLgpUTVB*zF3G@pE`40uxBws7B z$DKfR4*BRU# z#59j^^y#qKPxo+~Z%z3$V{kR)Xlbuh)UY)(&S>X9nx`d?P7SAIVNDb%RFlO-$z+!B zLNLQS`;bP?|9Pcu zy`y^ENAdWmk`rQy1IM(!tR#eCZ}9Wlc@@0; zu3OPwmE4r=A1w5@yDEESwgomzNjRfzDwoc4-K(yDZOWJ>yq ztw8mA(IFt<;aAmjU$KCA^p`7x^7i_|&G~-7qSskxW_SMAgQClug8k;7L!xl0>I%+zIQPl* z8dy5MvPa&ViNP247dXe6Q-HOJaRgo3D%dQTD@zilWfZLqyv7Ug)mnBDTWIu=8E_$x zNu(GtqdyBfH??B`m4n{23Z=P2zE(lb(O&I4+$-W0MQDRHRYf&uMIs82rYW@1S*Eh7 z$|_q$K(8uvFe4nm1nK0R==}n^q9EIM0sdsTlPV6312xb=>) zY)qt@2wV8EfOzIIWWewfJX4aIX9kuvP@rJbrqdS{X}S%@*tG5HF*Q0`uf3b>-%$#_ zX;ujL1G~WpDp{C!eD@MPcVElwQ2I{$orY=hR7-FitJ64Wrzq9|PHzvBiJ7y0nmlgK zneFzfpqV4ny{*sirJQ>hu4&jmWlT$|sat7EmXg6kaix3jo}Yp)LX73*RnGqpUuOXu zN6_SZGsMiy%*+@wGc!}n%uWn3GjmL9W?oaw%*@P;G5hW5=}F%`olY9f&cCOpdUjgd zs-CU-b<>I{#Qr`@0C5mc_wO8W@&V83&ar2KPl4&q{V;2uJRg=xUejrs1A6vsM)GBc zXGQn9xoDBtFWj$(`}0hvHtd8Wne`nBu*!!DvGN)JrdIWfCb_{a{%Z^6Z0ldr758yd zI=L>%?p>1K+A?$jZTEyqR9z;G3J1lC4XUSfLf;Fa8G<=aTz|~uU@4thXq9~wViB`` z=N_X9%}iY0cPT9yqxK9#m*R|L@1Pq&F_dp4zG@>~Qq|)K8k3~?GCko^d*1TlN>;9@ z6$uz>gDr8$d{G_}`CJddamZOWAVkgIFm~{oem(E{C(OC+V9o7HM0%Cj(i{Bvsw0VR zNi}_dEK@AD#;7W*2F(_aZl`t6sA8esC`yxUN`~EIRatk+-Ai48Z>o<6O_2DwgLVsF zmEX`B=mbL3GK`*FPgW$GNh#OnhvcWHlJcFOOKWPh2ix`@9P`(ke$lv_$Y4|yJ8Tb= zyfAkk2%tVyn(htGahK^-@X#jNB;8pkma7nJZ)p#>T6T$HK}V96sT{z}b7F82(fmX| zTV}+&U$6q1;C5+nK@TcRJCcUeDb|F`VQa?=)arz990=qnES# zRdFOZ+oeky43e#I^)x+Z3gRW_&Q3 z?L-*`mYp(gF6YIRv^Caxx!Se^plfW&cK_n?D$G-a@HrbQf3wA)i@C=2)mYc@>j|F@Ef;`La2qR{rVk1W*Qwd~0r zt-$J*EX(}%4dMdnNHmX__FiU$1^O(F#T==RLhaOKG@YMO!Mdqc4F(z`m6<&7ngw5u+LEIIySsl{3 zDU8-s);{^QN`voW8C=PvE{2N4WLD(K()%HxpbCNguY{J%fAAeaIh01v^Kwt%rai2* zVHqrBLGzatCTergwd6o7dPD}o07rR9eF6Iw#Ir#TE2&U9UD;GiNfp{uXw71cRIKk7 z6xgc~gL3oZ=!q*prDZ0jH00i3}k+ebCXW zozMNzOea{=@nt{#v z3}zo8c**64Z2}tYH^ZFtw-I&MCx+MKr)?3K>ZZK%(G7IGH^ft+kBpV^o zU>>L3gDiZf9%eB3ltTxo_~gZKKn$B#(&LZ>I(z1p!=r=WXZDFIjqR&TDI8?(71bQ> zEtfetC zSYJIVdzcfxv&*SND^O2p#NGZtd)n9*;~(*DNR*HjQ60f4ysCAJl3--g3NXeu+FMlb zM0091NVsM}z_fRl%3WAh=ys<9Ptef%iW`-o2{pt z8YlyN&@X<8Y9i99ln*qXNiDUhOswRE3izp?xta}$I>{N*S_v+nTQy$-`wgwUkOJ^MsDFWn@^<5TA=SmExCTriB8wqxJZ)5Uh2Mp z+LXvwu=$w0o$SNmVLE}g;HT}o;+@ga;*Y63Vm|7ALvE|3)u1z9yU*q6^|XoVsq*N9 z)M=6ZdJl$ep;%Px%@nXbtZwsqj$1v;UJs&+&KZT!l!1avg?L#n24Q?@bw* zLXWo4Xnhm>;?0r~q}lG(q-Jv(`U8{^VtF!$f-RBA+=%TP9=oj5aO*;u{gX5EWwL2p zV(Rb(0JF$%K1njNF-Pafw61yI1}PP_fEs;^qOW7{_%!afqCCB61BPesy7F^N%hiVn0NKNFY zLHY;HO~d}Fhkih5Ps;p%y?5Mm#5JyH+*p(uM`$NAw|iwD*YNw1lHSj6@lWC1kb`VP zj`a$J;i&YZ=mEbjwAo7-H{vFS4$iAmk_FYB9Op;%4GG{%Cr)8vSidFnsCrS+Mi$^)jtoi*XZ`U5~OgM-V zw`db3s$tQJ*>ouJ)NY5hKl7(>P%))chlkK&k`TQyof?9J12~8PjHDB3N~N`V6{+(v zPfj@p9?ZZ1N2V#+o7{O2z>;|+G}^Jk;5}c7%^f$;rVjIu8P8r>fur`)jP2Tlm(a1y z3ABPpJIY=>;cn>1Q<`-ml|u+cwqMQcm$Q_Xh1FH3!5XonIR|LA0q<#TmdI#pJymG( za8e-`PopUF=p8blpP^7dc*SNXwM-dz4!71+r8_bb9c1S+ z)^{M%^tD^B+iGyXY~0M~m?s;^@jAbewFEF$ta8;m5gB*vZn)BMdC{~|1hU(z zU1zOob6OwSX3o>ZMfRN4JYX%vXKH2|C$GZ?@5gSMh43PuK8xmWo!Pjx`e5^7195z( z{^jNdLU#4OHr?B9>re3nvNUHpT}4ACs)=wQKr;nw0@p2nU5!VG zdX-A4H0Pl<#G*zt=`VM(n^sdsxDqg|1kYa#Tump0l%IYs4LsD(!+Y|gZ3*C74P#t( z^hM4`8tyvx$+OtfMDD}Ytj=# zTW-;A7YEi>7_JJfKG2ex3DGkp1y;>i2ys`_eNbyES~@XNM(1bNZj!GPUBKpaNqXuF zo3cC*AwSoSQLj$@Ny=N)3o;3ne_B+=Bdqv}c-tDtq+c6NdV;S8IuzIz_!RhcTX#E| z0?NCXaI2J%XACt@J)mVPc-p1ITov|mo|R+utwadF=sqp3!zcqr47c2;a=38v*_|G% zX_^ut3Q+}Qd(!y-d2PN`N_u_n?yhtHESz0o!j9Nah*EGJ*5Zx5ew0lEW-nwrEDKyG zUU7>Q3Y$g0U{R$i0Hm|2GfOSE&HY9m629>68<%({1**2kw^!{m<0d$TC>W9e>xO93 zYx}k=rSP^J_zeWSO@0J(W)I&s&+0n#FNi$t{D zp)G)3ba=b>!kaw&1D4*pLQ0n(ZWLarw2#`f;KH&U->Gj6?BFiM1&15b~`@~aXzx=+5=aGO~4mF*QOA#!P6vRjEhe|LPsu zr&QvTLC&D`pdEbvPu6XHS^G}ZWI^w#PJIpl+2;9?kWfc5p7|HcAZGG>emfuAKy zLnS+n=pp9Y$5GlFapxJ58QJGs?RwBd(YjLgwr@$U(Zlfe=F^)1&nGg}GMHI*6B6;m znJFxM0zY@+)U8G5ImrQR;aHONSV?saG;<_sR??YkDO`C9Z-!bUlrC4c`uqej$k}{} zs`$~KI7!c@QTQ70Uaha>Xwl_V6z}=+^n8*oyeDqgO%uza&&1Qf7JDH}VSBpuJ9ICd z5s4=LGmR1HT7IeR%iJ0*#KVJ`W!nskIJ_{oO-j37Jy3fFYxinvAj)DsYxrn`pNZkK zo;%>8SW@#gzQjSC#4%%|`KY3x^0chOTARnv^K|C;qG$KdMGyh$zgrG2JcbrA%TgO= zw~(5avL@-+ijOnTM|sU}WkhH69!2FeBS}vsyNTMCJ&K+57$l&8x-aG7s27nBBB*rmJ=u54dje0r z8>9Tm!D+FF`+0eah8;{b1?V&Xd8_;VBkM(+i6EYAYd9i^=22mfq|@cGOzKmz#{d_V z4VJ(kNq{l+)EB`0;P{~afPP7~BF{Jv!_m(Z?y$i+4SV{u=u}tz#udg)MQUBH$|zm- z%3#?hnZn2}#}*yTRmO}-Y&NOsnGdygHJpUV4cnqL|2ar>uZ#O}``jSavmjw+pB8N-YU9BAeo96MGWnN-G8ksg%EKLjVW{U1&+oTM9=`me&oBU`8z(0GWbI5vZ!< z-7;m7N*dI!Sz=m>v@BT#o|uoA4z#Z!r;abo=OF;t>e<3eNk~ag%v79a&MCy5vUtx-f^QG2i_pI29>0u? z4gVZtOMH7M8j>1AFk<%Z5p~9d`sVu$3eyG}3tH-zPJ&TeV<2UMlCUt1zvV~w6V)#0 z|BnFqH9TBh;5)5Lo$1XV9#8pxMhWWO6chaD#4bU#C*Nl^X5PA#AfrWw$hw-K&qu6e zM-i8o%P`&B_{ML5cwH6jFWwGQ_x<3x=V7zY#h@IY_gfBS{`%9Q0&d^A>+v(1+74l* z(_($AbOqoupx`4i`A5AXAuI~_i7?+_HoLy=p9r=@iIj*&SzA~Cy%dFw=5~vYNsDG3 zxQUblzrThA5xt+tJ0i{wR`T78Qx88Hby2)|8CK1ymc)e!mlx2KnCn@k3Ojemm}42} zvH_6}xAAVJ%S7`;aX|{j9<|Nef=r@~*XLCZ?QJ~7sP|3*CVj!t)0TmkyymUmjl9U* z#rrS;caC@UcZOqLwtF1ztrDB3YCyU5oJKV(pEZA;83IKfdLA9~GlB=AQ^QB3^WnK+ zz$W+c<`}|*@$x{AzI@X; z4ioSSC>dQ-%9oBYzxK>w9EcTkX11TVz3nzVq<`HW9_wZJ?tTm7LYOl$FzKu7Fm`}> z76<3i0!)#SN_LL9%t!&mkgzZ40(4>bo&xSr@V@;TorZMJ96SXMo4N2`Z2j50201J> zwYC^>F@3V#8t{D`Ah6{6jp4I>Ev5O~1`UMoz3n+E z^9P<_nEu!XY(H)WyuqMW!Gz)qKlwfM5l|McjUw81HyNOhZB{=)KQXu3Xb~;_1id5S zs%q+e4SMDOTHzk!h!dIiyWV^WTp8v2*WVpF7_VMx$v?1m9LKG`OsyfU0a< z@B77Rmm6AE)2i^c5Y3m%b&>Y;n_&L6TlWXO>JN*tb8JbdOp4$f=yJ`ovQl$mr_QX|OZ_NSNoHjqP<97LvZwq;33idRPmtroNs#lk zrX+%nnJf0DiqqFp0|!9P8bpn2K;CQPM%#En0#Z zvq7^HU>+zR+)G7lG zzxpqt)`0aN@#}*WrWan)8>=_98$26c2E8tetR>u>Zoah77t?EcLssAi>yFw#XB`^_ zqJDx~0>W>hYRF($&N!^kz8WSO&5&l-VKHe=@u}?L060!8Sc|~SE{~^*X|3cs6lS%zo(~|UN%yLDOly_1z)5Vw<6Ndbf-S# zuxNP=z$a@AUt!f*2={!bH0I}@DIxG$4*CkaX6|WyS8Dlma=80d`$)w<_goqYTk~~4 zMt$T4JKRY05?b)XygxtaNIJ;>YLOC1DZ&NPEXVdImc#sP6grW44&_)OzWJ3S_>ZZq*0%nooMsCbEu>Q) zNZpZ6Fqm`xcL0tm79Gnm_#JN~)DM|1`xtrsS(l=!{6*u1_WoD+59`O|r#*ICT@oBw5Lu7ER^PFYRJWd3(v>~Dv ziRo*-l=@{u>xIk?iCmhoM{PL?8ZhnOO;ZT4tlD*ZX#%!1uCEFazm*84VrEucny4o) zm$ccJ*`YUZ_B*9ExJqrpK)%;;LUfEe25NNbX9e5x4=T&g-=*+F(wrg&sqxcImuc^O z>zXi5s~JgO{NWs1b5}XX<)hgJ&vObBB)*a0I7V=`WR-6KM`7Bl4VEj4%1v2X<~^YX zg{)FcD?;;O)&x+)Ug%poAF%Nsan4A(fui%-Ma4rc@oA$7 z+553lfADV7W$-=0|G+8tzJVp&k`ta1@(WAciI@H!L9N~$7%$@MODvF73w9hatx;o2 z)nOi*_ZoG3r|JP*{p0`MIdTv69DRR5Oy8T<7M)zBfG9gH(DN?GnBH;hdx$+}DQp&H zuU~G0DF+>59CRuEdiDDH%KtYAEX{x|`+vacu(SRLPUnB+8ga7!H+qg?lA==xE8_3# z7c9P-@F>)7J$SNa6-wl{86D90i71W_9`^9JC%?{?<`V3r{yuBDzN?d-eqP`zU`2It z$9tW?!Ibz~3%uw1GQp92jo%@6Un_oAq>qp0!uW+rnSwwA=i$a%Xia{u;q$m`JkJW- z^`>22*Xi>(SFP7X<@NjnBqZ)I^f-G>fu+&snu60L*oOFO_ne8rb=n74?U#~26NYo- zMKS@GT}G+YF9!u!Ml7+2m{LpKG(5Gx0#**rQKsy@h%EJj#i z=usb3byhNc@YN_1e)m@BQ9~Inb9Ou+tTp|g`iJd5`se@Qj@UTa{tITr^1t;LA14>(vUpH`vw<$-M?ig{s^GEyf%4StVA7=uE?g0Yl> z_CS?3DRU3CotZrmVE)+<(GZDhf#%%rp^^5c#shBJ?Q`rekaI8GlP&1wlLyq-{FpCa z-~)#=vHS^-Ym|`E@Lc6Z_O}~sha_2OL12RIP?%H~R*#7(53Q_jt1K0)3g&O@U}I&| z6qP^ApLXzb$Ygrz>5ScI7BEIz(PAgpKMfE>Ca^jP<|(7|#|rc|>sL^J!@=Mb=`vl8 zjkOwdm1V4pz3VURjj(AHKZ8JbRrOx|cu z&{vl!`@FOLeWgTgghGVajgVl-D3L(KHMtz*Aw}vyg+XQz^hRaPXAeN;;Dy4Rb9{JV zF%ix95JMi)b7?s{MybMxNn@ygg7^!*sICup=!Ag5iEBMzvCyog#=XknGC54Zjd;Q* zmM_3YeHng(yj$_oUX;7dc_)N&ai3q!|5fK9_ACR2mM)D|$l`}-6`K8Jas|n1tuk)t2FYH`%3aj%R(N0?R8Thu(Kmr2r{F#a04y2?PzYCEC8$VFhSE-v6~zCD>c zG349FYM6h0x8(BlEeHua^maLfHCybxIUSn3Kc)}nH}Wp_{rNkWIg75cM4hcY#Gb(t z$^29)Qe$8~_k%zF9Ozhgx+GWmJeSZIR-M+~>BGIQPGw~ac#7yETSKYs>XhG=+Lb!L zH8#bc>8yl-bS!9<6J}+{>RI`7(U~QlYs!%bDrxIFcVlR4%INRp@$}sa&4ObbhvzmX z_zkmnb^F8&G(+|{A=9n5o9^G}g`jecQj-u>IY#NK>s$qO(qI7DtC-Oh86gvtMyz(R+;LRlOo*t zEOXc*LiL3$WHBze1!nH*@s()y=CsqVLx1Y>kC}u>c1%;C9a7n5n{TY*M+#4^hI)~P zId;^dFH3H_z`_f=UWJQ*+`^S@8PH$pPNmGVRDsB=V{IG!>{$&G`g7W@J$#a79A>L6 z?F*45e40-#q?njDo;XoaLdG;(eaOrC@nIj1ZMHAvOO(}3yS_XBz@q6>MlVt^HoJ

8-cV@`zS!RSe< z4o#e$tT&8CoO?1gE5P62_JAB`Zw>==K7x{aK%?m5TfOz{V41CMtTK~MM3x2+@2ioG zsP&(uF$yUl6{X@;_KHRXIJ_`prFXPALH2Uck$<6 z-=EocgWASBXI)xo0;);J&FfBpn`RV}jF#R;v{7g;CUOAHfMx6GW^ zouA$!8j*n~{uMH&&?VKNd&V8RO=HQBxl5a69|C@Sj%nx{Ooi{Z#J>yF zWg;vsrh!L7#bLPGDTwZc;x>uaO~;(AFfx=V^i9t$tK!!3ngUv3IOU}AQn#L6+qMH+ zp0%3=gF6G^jq5rZps^MS=Gy7*CUelB&U));W>Q7t)7OyU+QBr7^Fch}@uI8U$E07j zvA1UR==N7bZTmnLA-~rdb*ZDv5uYn4qbv3vA8DgJJGVV9hy9B*f3t1*fm_!IZ8|`a zikL-1+xNWcHrqm2QJ2F%2k}(0?Xcl?6mB)f3 zy3uZR^~kL;{|8ySk7;M#Tb*+2YiZqrL~H-e!cyA8cV2`pAWe5%xmZtCm@p`z^mr!P z0J)=I|4iO}xuh_xYbHPSq-KAl%B>EX;#|=FdoS-bHNzh!+6NfEecew5V?*s0lVY!A z7;g;*9=%wpqCz~ZgT{B&Em9Qi+uLkG(b&5zjgShQa9j=j=MwJUd#Fx!joe5Jibx0G z(k>$l2e$@M+y%UtTMJtAn43j>{DgyKmAk8mQ(%Yog~)=HGv|>P$Fh%zH;4zPg57a= zioJn(3zLYre^o>hN*bSm_<3A%T;V#3n_$ZC)Qj_FMy!ew#jc9K&<%N4noh#ibK0I4cI**PjigBm@FsJ!VWstK3k|WtJ2pqz_jz? zCic;Lvt&SOM^1Ep75TUOvWp_z+)zJ?(owx+nA0Z2Pn%ZH+GUk;Ql@93h%Ia zm_YgmKa0KA7-0WC29%nRTL6JAK1A?9kk%I=W!$tm4Fs0 zcFScPK2;Z4JCH6DqUev;6>Ac1_;A5BV@BChVCv z7C>twZ!@qRI!hJvhSm;}IlIUZO2q?;&ipnKT&XGa2w^b(k^W{|sZ;ZZF!YB&j^|a` zZq^@*S|0Q>F{@k&M)z1rGjXp>iIKUDduGt<2Q4Fk1PZx(WYRAoEmC8I5D(D_%{4>A zA0*E~i#8E!*NOEpRmR&!ZjP9r;OC3#i^{* zsS1V<+oNJt;HdIeRgi?R-!rYpyfnc;7(`F~l4blZy)xitMhE;$orfi_(Oua7DP6De z@-?&3ZNMn$w=$4C`GR2vzh{auKA@KR)!i!V1+pOzX>V|D4tsFA9`m``-Qwab`I8HaK4nz>RrKDl~bL8fEiARpYE8Qio% z^)fGQBcNU-Ju-^QT*pkNJrculn)N}Z9Qg2I=inkw`B zFp~%=8&F#O{5x1C%_3FJX}5>Wh9zW*(SxBLB4nSJkYNziNJI63#df+!_YfibNW@>t z_}Pq&W@`|Ud`6+ieat3hUw)UiB;CZSCx0&B={QEA2T&Ndp^LiJS4E6#Da19DWOKwE z9KjxBjodR?rd+pTL*(e&wYAM2K92MO_*kjCa{u@M%JfD!|NXs0j%K^NVw0UQ^g3yr z$!3g+mwzgOR#gaxg>x@0iKf6yK^^=Z1LIF*qzpF3E*eG*O{f_JDRmz`HRwzJlww1( z(vd{uL<_M%3&|yii6w^_qWFV*i04v2$YQ24d(mw0WWYZZA!6<=fe3^wq)L*Mcjk;r z<26r_kVowHev~%ud@bsgTKeGoqfCaR~n-y1p*5z6{m8-Y6zaHU?vVK!+`@cK`fYuUo54Xtry8b*5YB z=TdcFHJ;WML30C@xm-n@~cNPUX?n;>Vm1_$UFTzSbwb`$b zz0i0nf;bOtlY@f4f6Uxen$xMYYOwCY%`%+s{Hdu~`pZ84bBg#QR_N8%??J)ufyr~f zO{tD7t5uVGtj<2OAtd$kD6&Da$03^dNA#6-^i+h^bRD7uh59P<*bqTlz?-XrCnC9# z={7mRY!39i@0u7Py*YbEnkhm(LT{741DU6A##0Q_Kp;GTslID0(CVxd`i*VnF@vdy z=q>LsGv?K6@`Z;H<%fy6wGJ_L|B#U=zFXhWC#FKjazs$xV4cX{p*(T1HncBBsj_{o zI>E(H_j?y*=uOEM)Hm}Pq2VX`H^>dU1)AV1^A=QnboZ|*Y_oXS&3Om17Tyz1YF@64 zrSY`cC`Bo4#{umA(b!BxTVfZ~@qYJ}m1;%UW2ns`)zu*|vNSCBhn6rMFY~loc37#h zUHk9hdKT8a8aTN-D#>x->W56aFl=#OE6gnIAcr;nx%BXgXhdoO)(qRf zQl|~CO0E0;vsmX3zpHT#<-M0!)hec1`#iz5*1tk@!EV|-4_wTEv8u!69>TD^Z--s` zU0hv%$S)oP?U2`m>gG%CP#&k-l0Cn)@*1vV^ntH`T|;J0KRShK+&H^bdCsQKBOMXz zv%2Ks-rrO=Wt!W!_PZ6i^>-_x6B;odF|i{& zPuRV4Xe-jFRQ$Mi+~$%Q7kl(*9kphQYyTZU3_*MTG%`A~(_|!_;ig0aODPG=5sBUqxef6vFIlKB?d(S`{eVI?)IL&wm=_%l} zWGYiwNHVqLBIk5`*@=so(qWIo$4BXj+Q`&G_?p@iCqI*8%*NWw@{Kv1?3ea|g_BrT zBA)4^3~OJ)-!sh>RIH)9goI?n^n@AA2kLQ-U>#yVb!bJ$vr2}1+Xt?`5&td4P6S{@ zH}H;GN++TbFlAPAQ3b6NbH)gO*09cv`NLnzLDMmH$tiaB%I7BKbDr~&;x}3A7~W{h zFU-5ht8}Ek&-(O3As&EB97y*&-1^PG<|{kJ>XQYk@%3+SlG(mX-gct;nb*PdV_0M9 z0AA0Ttp^oscK*G`Jr0&K+ns26;EZZkbvkcDGf?!l#~Fv<>L*19@*rQ>7SK%D){}Jy z{(u)^wfhz4$nwybYw4OfK9%d**qwX&gmE1AJnTJacZz3&1=swL;J>!69iQ*9sUq~r zhw(Q{VHES}T-|iF$Eu0djh&w$Z>zDZ+3XKc8fInxDstN%!VgWAIe)7!v0Pe!J(Yot zg00^<^N#^jENshUO`9L67EdEiwxO0ZU~4Q99%s*Wtbrv+Q%g%r6CVIv)6~_~)Fdj! zuQYf8c99xSbLFv=oZ9jMhx0GZhhEBRJbi?C6x|ivl`hy^Qp-0~uNbdYyT>>;*f#h& zhi^0i?$SVxF6mc#^(2bX%moVD)X}3lJ_jNDN`=L5#%asu0YVPa_$`6g_H`&|S=whZXqN~nv%>CqtCo93ZK<*C-Oh4zt! zHvVFTojF-5b8Ts*NFjM4wU`b?Q^WzB@<0TfTYCl#Hi9XJEV&^f4n`OsB|)%hd4O0$ zZ}Jb>%X^!JFP((DV_JUZ}PE+s^fC<14U`l{cWIx z#R_UUoua0)16t*U2--%bm;xXW*Z>5strVS|dB<~2BsoM!O|-!0IYh%vx8SWGyJ>bb zbmGC&Vn+^b|CA(Oi;&=zAb*XJz>JW{xFx}n?~o*qi<0oCK{xIDz}ZhTi1GV0Gw7Nn zN0&5HGSF?QhZRmQD0U$)5pH*q`$~{0M^UgFLm1*Zbo%&z2StWAyWFdre%hlHkMoOq1jNgy5^~C z?=!dK@)$kE!eC8zbT56Ss%~UXgT01U!x;Udo-Lu4!$Epkm0DMuNgxy}%CAX5sN4l7 zj|6EjAH)P27R0pUiTRy2R!#0GZm=b;AV?*~{%`JscuNFMh2SB#5bUfF@-7UXCPI2< z$m=i|gd;=I&g=xdu4v;EI&mMk@w&WmQV*iS$n{GnQG^}$P>eQ zOgOTqz9ob*BJMdJ1!F{8LYmErceDKKjVyJ^@ksT+4J~znsGcFZzrocrr*9c^8zO+A z?X%-f&kZIDWaQkmsYsn?1tYjY8&98S#dMo^Bj+~ZC+@#zOye5qzvJk%GNT<7+z5x( zi6g~-Mj{{YRQo`>#YPkdD|u#mYUHkJy&1V;S7#n(tr}|G7~IA-wSmUDV?~R;VO%mt ziQ9$69(-*mUBz$teQ9Q#`444Z z*7x?Gg4?|)kuPTTr#UaZ2(dWAJou04@OJk)Ye(PHINy-6w<&i*A3>fQyDd2*CbWf>{*F zjL`B7z-NWQFWro2KhmREG7fdZ-M5ZG6ku*0@TOr#6^FG+qhsiJg!uc$R0x!gYYVPPDQg;~|*B)NI>IF}) z1-q!S(il+BENFDK;)5IpxE7zL7Nlez2EBUKZEr}ng4p!N#(if}(y-JNv ze7tQt^&6ud_mqJgAX@3WmT*q|UeU9K(bTvPbpD|Az2CE)(KOGkP+_cdlmr?o$Dr#i z&Mn|s<=uXdx|MD;#R}g%%O1Gh)ZaATH0{1*&vBelnvu`eV;kAJVT0$8Y3DQ7u;n`E z$~=M2O%C!U99P0k*+F=GZ&()7eodBcN?p%7IXC_J+;`SIv79nikpZcGcmx*A`9X?3 z$a_jpDVqzhN-RsWEPtbeyL<^gf_`Ib_&zHotmGS3O8x%$o9h>AfM-=gzL}6he0|TI zYvLf&5b4n-z!UH`Ndw-EQ~vI_^miNmU-aAIc7k2tZz67yey{HwTzA~O6Zk9Q8{X!Y z0xbIoyIh+#!qM#9aUZMxG#&9s2M9VWw*{woggD5bL<0S3yUd-_FxkL6_;;%o7y;)z zkKS~9YWkJyUDMh+WgWPfE?TWdvQB9I0e9lbSGJu1Q)`kandb!t=}m6|?%@30qQT0v z+(H)fl}Hq491KQ0HBb3CAG0*r_>r5CT0r_fxJ9KVQ zQ}&ne-ZUnqvLsg0EGj2%*Bh&{Z$c*o-<_>C7z05u*_(Zgd8$)LUJPj{TRWm_k3fB} z$3Hxl6fT%F;ynAwCSGTN44DWGMZmWZ$G5jyc$YBlu@RZ0F2! z)gR&w2SOl4-@v7r;^qCt@czbdOPDu|pcC!8U``>n61sfDzopW{(;e1&i`-(y(6TGk z8GgAEhEhl1=K@Az{BG|F7d{&yMK}omSkq|&V?~B*jp%a3Qiy+}-X_7@cL*&(s%9iw z+@KnfbUX{ebl@Ywu#P@^CuoMsG~FA8>w{dK;($~s7|vZc)@T#0b;r0?&@34JWWz8` zj_q*B5+N?|g1}Fz^%)#DHbkNH8KZPU8zg0I*+FXbiAcadnqN?m{0{Hwo+g49WS%b4 z3$FMXS~GJXvJ-0f3Avd-`t|E->`7Gng~GRwE=YpKJz1nL?CMUsZC3pAr^G{w$PUay zk_f5nszuwuzZ0a^cVar3lLFwC!DL%eR8ocjS*m@}9xT6N(;5`qwch zHqlki4a%NDrZ(BYkY6V>J>U6X$DMY*SG>dE$)s8*M1tQTHY89_lM=L!aE$aa-TgQq zHw=u`-%T_&PiXKNNia5LWk1v&kxqO6CZ535)2DJU!or5wekYGOTzw}WqvA;kGs?pH zE#we~R;2~?(q)IT1JSLS!6|q(@5e#VI!+7u{ag=xOtgc3%>dR z+k{l6;BNs|MdHESv8i5nA51UP--1!wd!8?JNA!L?^arJFupEb_8R40CaCWTn#Jyc* zDbmg)6$fY=@ph{bu&nyrX2MqqvEHa&V^V^l0*9uIe+hkXd-|OYO&91pP~8s61Y@*=_R=lc!B?n2)n}&3=2Q}E?9lRp+kvc22Gp@TaO+;5`W7`oJz9KCrB+a zbnk5t7$dUl;saJ$CqeudL5Cj2gez?n(i?63An+YedE~B=DIVk1r z7DtfkpLtgUe_q;~YPj`*FjT$RmAH`BSb#U)^jN^k&*K9l`+<8`md^@%xS%AzdU%!* zp_Qr&1|6nE8I4M&f6FHs4Wn{_?mJ?<~Iv+F`j9e6pdzS44`YD@HNOzF-{ZcRBTm8m|u-+tOFW@ca$s1urD~w*Ir41c7 zQJfD~n(Y`Jw^G}IAiHnM3uZXiucXYn94rrJ90Udj1m@|m>f;>g%M=X6P(Du{(j!1?u-6&pjlA&d@80lyiP?l$_?%DSj!~ zzFLFIXca{YI6p$?9x(o|02ytYd)Swoj|UkAaDHUWJ(z<8$Y=%UN7>v%5lGN0eredg zmdeeGXl8wu&pl9p%0PAsIX@!i9;8Z6W98-vQUN@m=BhY9>gFE$<>pa9)<7a*?m-+R z48;|L8g%FXeL2~_3YVO|r2wwgv$~c4Q)t`18kL;-r2?)sv${co7$iW|RI|FJZC|B9 zO>1O*7R)`MfSyAcXF%)R!=~K47lYz9=s7@^oRZKgeu>(?!h*`^6t_z_1JXfNL6@s# zb<5knGMAiofP_X?x4P}CQpu?Rs1=p0ZgJaJWROS!IB92f8`{2lmYlAq{+Iado_qM0 z3h1fj{15__fhvIRR?+sA`#*)B+Ox=!|IcADEW@ct)W@hF#kI#EEZ~lAc&YLy8)v8jjt&+5tx=JN|+TUk_R(`XD z9Z))RSN@s!Ccl}>4v3h!W00BMe6!C#W}I=Ex%=Qu>v;W;ntgm1oVmNtKmH(Q{~TcW zp;5~G{-&HO7WV&sa-2Qu(dAV8EQs_~80G(0_`rHcgZt74rs1w8)>of}^dH$5kqfcz z%6|Rxr2U^E)R0A7Qo`Vr=Rb;Yd@~BSoZiuy^!pFJQ|Q{nEX@DVx~4nOn4Vtr`p@d= z32LqM_38clYL@2p|1JRqYq4;=J`3W%)NT9vd`16XnNg;BI3NC1l@O_N(GctJ(EnE> zKATcOoO?#d_x~tm|7`8)-^$cHfL15}E`|_}mG$3OJYok<{rPt# zZ76$#|7{+l4@IDi2HJlIqGJCK5Y_(wo zHI4Mi_pz5F@?zAiFyF#}{jY?S_WU65@%-a^&RQCqN-?QgEFme1fU^wCc||+$i|C5I z*nej*j{h*&|3aN{uyAw#??GqWENuUkWAEGx)meh~^c-3+SE)xaD z2s}*M+?0h(8fGa2ARY^1tx@LUp3rpi1vzL#`Vo-DjwjGx1UcZq$0OyQ>aZaR_Us|Pog z^QEK^L*5~AL+}OKXv&P_+3%z|OX4>QwNUhzZzUZa+5o%R4sX9I2_Zpyv)!_0?U+Z` zFVp%$DV(FTbD_X0a0)%KR1WjuF<<_c28gNe2vhp59M0I6{6MR(LW*DRid%FP#}_G8 z8^H1jyMDU5)@P+`4?uh={>ofsXLq}E)tNB-MIZ8ynSyA2NQKcRL?66SpWft-1VC-b z>sJcc-&=lX>sm#{bp)JrFt3*CoZ?jE0jpnoFuuF~D+8T%MDL&b=-^-!p}_)Bb3%io zoyCO9ovJXQlv1|(2!AmexPRqUVjdb`LN$GufiW67?|=)U$}sSKhDxZ@n|coO ze9wN1JKg&R^`}*jkK;S-A+%|(GSb76c`^c)&*C|B%%`qd66^r$7t%xVf?s1T$SHLX ze&CK}QOq*g;c*_nZw)EmmzO(FZY7LtAhjV0BU|cQw!cUtI6M%U&EVuk2One7rlCd7 z&C*g~lsJg==d~cWj1D=7GFrO&JD|!}pBluo?A{$x^OY>Bzja#4pi@CeeKA5}!~0+u zbe4~~ij9o`A%uR?yB*5fcl@oYiU3722Zb2+Vf!D2!U!$4GI6rrkaaNkrOJ`58|ZMO znV9SeJlRGFnPdx)6&UDXK;4~tqh`ZeiTFzuCu2cacLK5R3sS~~EbKeD5j51}?3fsc zL~S@fkL7}_XKo}lT-mtEh< zNGcDkguy5^!3e_sy)LYWaue!>=sf5Xdn8PUa?!`h8Eibg!8&>6(=-bfbbkJZY7I}= zMM#38>YNcH?5V^mWi8aPVu&lOA*BqQ{QPT*8Rx1d6R_3W#>T?3N}-4`p)fjRWW1s1 zsyg2o${bvOU5!tKhQjcsrjUy!?CgxO0H5R8=w+1S$57+G27eX&DEUqsu8`y}M3v7+ z@agNVi2TxGV>(6o*xZ1v{Q!rPeVRukvLc&+(o*_^62b>UV^9FMmC{EObRlLcWh1h; z^-j;p&Pc`SX8l7gduT}@P8k*W%w=8%a~|o#9xovw!LuvH9EF{SapQ;n6&Sx2i3KaJ z$i!e?RkBkBGvg#P;4 z7eUq@sBSej`hy~Oh!|D4Mu*&x1Ya7fi;J(ftN}Imt4di7X!wo6Jq&_l-0`k&8eLMJ znsD~ulYNsQ8hzF&*8Og*F2D(~P&`H^+l<$Ww`q;LFQ;|+4lmbK0ujGtT4Y@N#0nX= z1Rt*<&fV{tF+MRdai8k8h=;%~#3pRQp^E?&9~T!jr!VMP`x)MOXD4?oJiDNAl0{Oi zAGCb6z@rR@c0=G9eWZN6!^iLC;WGC3E~j^`Iu-DOG}&ac2h+-+ZQn$(fM@$tL?%W-X1Uv0l*qao*kV(?j{)E*q0V+grzY-;&Q{SmOjr<*@srbxgT!X3AnR z@a6I1l&)2=C){`_FdS|!2kXS1tmK;*1lAvA738!4 z9wfhTpE1}2`op4FmM2^1S|h=sWLJbR$X(8GmH@)t4mEm|_oj_gsSgsT>&OSYR9BF$f;# z-TypvaJ~r=e>$1sim4i7bO~B3`e&#R>y2_a)S76;9=viGV1zg}jE)64s&7>P)c`2? zflnj}?H!RVjPsm_H@`H|ISuF&6vv~zmMrTQaPl33ci6G=nC^a$gwz@>qzRndDVj7h z>L;@a@rPYf;8caK;P-wfAcNhb()jxl`jKe;%E6q%g6OIh5%q%tSGK%GM!?Tr(lFnc zrA;e9!=?)g^vT#ny4|w-YX8dpOp3Yt2|e*hwlP~bw>zImNFM)+(DN-)65`#Dt2$w6 zNYFBXQ7<{i`NVE3^C-YLC9?FIV&xk0DQ-i=K1X&Le+0+imlS<3z@+|~_aWh(B2$h+ z^@wCeh}an3NQ^ev7{^K}hVPnWqt9T61mA*tz5Bg{zx1_?cxt_$JST(@d3zE>9Yz8x zMk&9?Srg$S0e|fBjPkvUNGVHWgUiEcp#F2Z`-&b&!9o%7JI-2)usMvL`Z12<2j8+Z z(yWh;aAn@07Ge6Nfim20@SpKB`LDw6As38q+jg3d*6Ww9A46;)!f(CuO_-0{F&7_$9K)6cgNP63!@~hm!aBZXljg{ryiY z$?9i*q{-R3fa!}7|3RK5bb(%%j+s)W|6Htq#vgV{N$03~vf?Zv+4F|utnLLdM|;w#lQ6c zjrCyF>1Aq6Gzmtuezw#od5ZDm6U?ZeY)k_xkmo1oH*+3OJ2~{shB$uXjUdb-&>`X@ zWDd~UbYZpq!k+9*AlE-us50vY%;iYFz>xj8Q_(kv&KAM(kR_B?~8!X~}dk@P?jyPI_ z?8Ba{vNk6?pgllwNx($u-G5!?TNt(EaYEVez&Op{dYSMV56oHSx5MKeepnDWg7}wI zNKTlZP@~GitV4>C0n?>Z(Q*&C@4rruB)P*sxd;X0@P1-l^gB4ABW=Sz!{Fzq7ZI1m zklW9C^-G#c^ZmW40})3fP{=JpHzruxl)vM=;lNjm!uA_HxbOdL2@sg1`ZnmgpO571 z$ac}?1Efnj(i?gCfrXRmk5K@RyhW9iqjmiy$pnlxE*ep)O9B)(No53vX4IYdgEKXf zLo1@*1EpN43g`YPpp*sqGFRVF_${R%f})=L>$gjnWK&vSaBC3#*zO~Fl)DK}CoGUZ zXtEkjG4AI&S1zhF2*-Okv4zDY#126*PvDs)Q%uv)!v`#01nmm5qv!UElPgnqkx!`f z(60NfFDX(o8Ll-mgyt5>!4AGpw4)7Mu)CqSE(m8Kl(GfzZCB9=9#)(%J0Q#hHwNG3 z3WtEZ#9|L%(-rl%V81PO-feLgtW2!H2df&zeMjME#|`v8#>D_YD=Osb8_^(}7Skkv zyHa~$tGC$YpJI9%)%oS|nGI;-TKb#`JiTaWALgLGM@gwHKloShYlKaW>wVdxpOL{=A{yK%A%S(CN%Zbe<#W4 z^oYRQ2G!?S7F)m~($!%G7Ziv@G;%b=g7nBB@eKJ}f_iY`l61=M8!<7h-)zLmAfgH| zysheHST!A$bLUSKWap(moxle}>H1;q$D&}2e0FXnwjpM#_7ubm6JPhP2*aoN2B1RyW>8k$9G0q! zk+CjWp1+7k-;;=KjG_!0V}ATiRw5-C`Krgbc0uucNw8D0d>)Oq|D0L3W@e%V=D7Tf zifmolrxDt*RJ8WlqOjbi4QC5dY)USnE%Ha)?uLS}6sK|(S>C>oh6845=h=67sI8Gg zI6bPC$bv=WnapD8?&BOqh*aB@;fF34SG+^&bE)3$;;X%D-Q3l=d~ZA|2)Ch)#K732Yhf{ zto-Wy5nrBfQzFaopboj%kiP@Yur+yd4N1w+Fx8J{sgxTg=T)E5GeT6Qq_>?GpG!mI z)m&`-3T2u~XGD5}Gp@$LD72oVaq7D?JQ)*V5dXHqkW$FG;+T^K@B<2aZ3}3qm>1j8k(Gt4nB7gS?J6@Z=&=&xO=ttQ}-uhg0*?0SCD{5AL@ zhcNQVqQ~H7u5*I3nnIgxA1P0`TYBU9y2jUAm}b*~^h^twU)0ibwc7@}`k(W}3xn@gI8Y1B}|EG%eH z!l+vs3a`PU)@HFRDee9GmyTAi{P$E(3Ap>HP)+XGd=9vRWkC;Zq=<5mKbnflg;jw> znBtiOxWTb{zVOLB5Zsb2s}@!5#j?u`?rY7c(9X4Fy&+=Q|1TALw=a@%-^iI|V`eGiTJF zqhxcF5Q1X<&^xkpnDoZMgCdlwTPUYi2y}gxr$t=3tP`tIaU$v8bLVc@p;WZC#zCjA z&Qe%Z)svNOO+CexKjI6Qg4o#USnl{6X?d;s3gsIa8p4+?Rc&O;@EGbWOLUHFbjlfU ztleIGN)+#xU#Zj-9U=cZ#HrQtO`j~Zu}v7GkK3(!S~V@7C%lx5(_2X?e$s`A>l*2j zL2foX=(tu+v-elTS$|C=P6dwstb*L3doWTmEU+&bx2m;*5Zf{$;w;6obQ?wG2fqIq z3ml42tuNFV$2g3q4PT3_Q(MJkxT6i(6LZ?cY}mnzDh#bGlEBy2x~M7Pu=A@4OOUX6 zjqo4xByl8-3wV)RK4eFm123vnOn1%ES`CXmXxRN)GA)n3Ku~K-fQZdywUt%p`1lb?7LVb}@^4+r7 zDKQ|f&NCW5xULwl*g=~kjjS-wQ+A%VQAfSNDu3)}Jyl6s#n?}Eb1(Lyaq<%hOCx~- zReh5MqD_iq^#E?0u(X_>f{DAi6*0&8J|J>g$B;5lIw4gvJH@jPXST#zT0E;n=CLwI zrvB{eAber1bre#1k;dBcI0lzny`L`9Jhm1gi;hY4_{qbZ6}xyvfr;iD2HV%-hp?9c zOLZjqWVG{$>*740il`JbG(kjl#bT$WvJz>+yb;lJ={oIxvPkSSK0XGHF9_18Lh{LE zf^N1Ic|X%g_cbG4*}1`u@(9#7#4HL9NuZvl3oLF4@uDVYlo+WLM~X&H{RMuuY4Pii zfN0g7lUmEdavMvg!?%8tPx-bTrFmTZf^3=g(Eiwm>`F^oi5JoMon;71SDzApV~xhK zqhMXEl|($C(oZZu@I@;n08s*o-o~L6_^W@C(YBUa%dKM!DklOF{AYj;Ap||)85-vw zj@6wzHeFpgJqa}+o~m#xWATU@J2U2KYPh^ykpD3~>{qI!zyf+$gQUQFdf0R=G`AXx zYiBgsc!NaB96w59LRpdIt17UuwGthh&& ziJj{BepAAT5QCk-f^B*?nutLvteD-I-5=NGkI3%N+CHcH@%7_b38dx}hX{%p@`9C}$k)wu|GB%U%`xO?jF`~+tU;v29fnENR z+63%a&?9%k5efZuh;`;=t9=+K61c*M^ge9l<*3uRPdUG5O+)>HfTA%_{C5_*KU@Y{ zUg?g&%8Hehginn#anUza@nXm-PD&N;VFL$+H>g_@%rEN}D$&Gqpe3D~ysHyI0%E zdW1P5o3id;PWSb$mUG_Nlil~*d7uPezv5sWI@JnnqFe57x7={I+&DLp7}^&2C>QKD z7i^7beUIN4{u1tC`fdv*yw=Lc8h>5z=W4TZT(C1-uw{-JagHZ6=8dms3CkbAWr2pz zi~#iOs;TokhT+C(E(+g}4#ua|J6DQsk;WM=odo(JaSDbZ(eJgk zMv*~>lC$z8Ra5d(Md`7UT*hSUfyXZB8Z+`!v-0fC^#f=L#1e)*8stVfZ=sg ziDj&!b_bteRm?tt=Np6~-shW0*Areo*A>mmVTTg`rOS4~-eNeD&bJGMBHGZmU|qJ1 z5|Rg=MRRU-;WLif|B))5{U3)gOk4$56Y=0|ft#H!S^8A;N^&b8hJIj<3u=Z7s?0Ij zHrY`Hgie=$Ah!VBi$g5~GJ3C%eeIjHL!iig1*Iw`snR-q0d?@065@NO#q=vMu< z>y~MOd^y7UCRL=XB;IHQy$&Aytp(E4958!~WmBl@a7Lds%P?h1EDzN!Bb{f#I%COt zW5HTD`-8qFj7bg2-BWifl-iN0e6%5+4Hns_qsJ+WRqUG zZ>T9~zGAV$xy6IS4~rzsN%q)a_WOkRq{NW4Jjplp?QR({N#Qm#sd4sAV#dmI`GPuszD7B53duQXzquUEt8`s) zp+UzE)h1xy>{e^k)$I5$B6o%D4P77ZPnt%>`bf4-OB&Y6D(>`GiJIR#n#wbZGf|cwIUH&?&)6JfoV6k%{o(8^Na9Hpt0&cKcz`PL)0`n&) zJ&tK4m1#c98jck^-n~S>R21{W^(|wO=qtgxB-3W{G@U=K3a7HL<<>Z!OeBV;P{dEl zx*sZFG}D}#c|U?nGBbYMCQQ{7r%h-G)uo{QR>QE+jz;VBOSVppMjKc1iYg6?^`<|)4J4=H^4x|K+f*&FN=74Yzc|$>k1lU zEHs8isVr5qj-wqGtaQ(J_+D4t(ySRpH4(a3N3q4}^=fpKA@s|-&YL8r%% zII)tuU}Nr9J+8WEhp)>^cI&U@{?Lb~yfSK3U{Zxjwy-p2u$J2MU88RVqncH`ta_rF z6>Cp}$+aFwd5f_O;ffOv3s3daQD|KY{Bs(f^FGl;1Jzo5lQNhmoH0@(mL1&`nGNJj zVp4VzlO9|?oeF;`LJOMRa08Vcg(9Rr)#qD~E#0p?Pvcn;3XDZ;NCElJ&p3Q~8g@7& zvXbO%e_HSMw}p(X+(NTIV)*>UVxx5FCsr&t;T-0PDe;`o84UDgOOssCk)l+I7I{H& z)kJ@)_F;6Tq)=mP|>Pl5Acto)qD)A%Guj(c{*8j&l`kB;$;11dnD5ePm;wc8_E8hod z0Hx~|8W63x>36nRTD~ZAO12m;!7D{DSyXl(bN)4PtRLwsG=e1W2N*f?@9ZuqX{KIg zAb2Xygdzz%Ip`6G^4KDBZ$>|l&3ea0*I0BJVypa;g)Zj;Ci8ph3T6PoxdHJ=t(T=Bio#$XoCJ4?Y^MooVP9qp@ ztuzqx2Q2}FDklml=x7>}H$79^6biLL6LAI_Bkb<@otVr%w+F4l<-n zBAXQF8?avoG+~avlGyc%Fai_WvV4PADfNTJU%y;*nE=0xRtFMy!L4;6Zz-$|J@$sA zgMe#6=}%yv#IsMpwE*4EWJH0FpvI0y2XUzb-DMA;Daw5t`0D4r?d!m|83Il5MxJ#2 zITf?-L;N0y*#`d!YT69pXiB*3)d7JF_yb!%qsZ1LgIDbtNe8CQ2v@D)#~tOe9q()G z&*&3Ewd;MQxiPAjd!NDAkK}j#_0*ZYD}gpg|-01HuTjivdcab{psh!+3)&;7Ge+SxpfkqT7~Pk+wJNnU1ex*^26gjz#nN!~cm->) zduiO5pS|PyPV}&a_!;fUcc8yeocFByKtGt$ZTdlYgj{x+#}oB&c0gpC@@@JtT`_L@ zi7pLq_8Uug_IbbR`vg5cx%osPgWL$>?!NJUo(Jgr;74zZb|4N?zF`qx+k%jYZ*4(D z*;lsQq{qmh-<<&oOTC-jF-xPH-HJ=2jXM|**X7(%j2)PQrh=Q{h7{ieCPAx51H$i| z+yaO8AB}|{f`5-U-zTh}7e5^3KW@l4-bOd)?s~C{k3)c}vz;JhtLN^lw2m$RwD)Ck zt7r3?Lf?nnLHkUl>Zaj7w;N@9~^JKV0?4dp#KgZ!2KWifd4(9g8N^9iphTf z6$Ae#pdx{Fsr!E*D&CC$3!=if@gGEm;2mHm!GlW=>IN4i38!HiJe(lg6wIIFbbB>x*zP2{AwB-;rV8Y5yo*)8~BlG~+ zqzm4AA74$k&Nyq7RtIR11X%>p&hcyV3aVe~t2g|%CPqC^LQ|<=Dz26xQ3Qc>5UQJG z-oU$I9FPAyyYc*g*-g#U;U@``qKTENi!B_J0tpM}KZpw_XBQF{b}l%k|B1yQ;bv#& z_%C)n*FUwVXpH-)=*;cZkL*HgU7idu7MhGec4Q3AWOL{S#y4CR*As!iA#$m>3k-~H5|{m84JyR9HD3r>7y%99o#l1hDeYuML_@uA8SS0@NzMX|<%{hWi`kqtpb)p^u%xnA9&)Z8*F%YAd>Yi$^ z%F-DiJ#b%HQ?t0ptRZ`3x5Q3(I)*$mx45oQ<_PiWanh?YgvUW|`BGdXKxppOrToMT z#c3YJ_&2jTgpSxi^4p{OF_6kRC3&LK;{HK=F*dxARX}6-%b*1wUraQ?Z)Gha%^|k> zL%P!60>pD(HDF%*RSKchR!9X^R-NIK`y8pGyAjHBrPUq3qvpZh-t;{bT`d`!z@G0i z+&75kKoc{>@uds7D+B-c z#jX&Ot!^^h=N7d9XnH7sL>AsNxEsgtuD@P{4`h43b<9RywzP+xBz23iO{9V?M1Pn2 zxn6p=#C)eZQcI}~1n3W_XhGA3*0cEXRQE;TB*BgWAQ1z8rScEO3;pF%B&N14u(hPo7X;ZLdhQ-d$ZpI+$wl z13r3%+;VCtq7XJB;;Uv}Fe-+7eX@pC{oeH&0Uq%p)kW=c0+DBzq20w(ctUe|}rb54g?Xgl0 z%voQd2Jv-9*Wx(SxhtTnPDy&FtnMM*rw~y?cW%TZE!hJ^T_7sh+QbE>e83!e!(#U5 zvg}|4$h=(^etG!JX@K?l}Ip5-`@OoEO32iivZ@{r2tk{fz1 z(W(mx$uLw8z(9q#*=%_an715v0%WPQ%DJq{&rMgXE6SwFeG0sF{_h zYt1aZ64@#i+*oALkElt;ps3CqEwEd;^Vv<+dJ%C4y51C5~-jPv#23LOZYqK*Ur z>gz+DOH}WDuud6MA?byf{{6K?%KkU4WYIFygIf=@2)dj%3tvB`5jI6de<#CXCPSc( zy;2A*Y9B@Q_x6&B1Cq&si~eq<4qr%qzCrg$ABJw^ye4>aVW^0>wV;z%i;2=eq_r03 zK$oQ>F-m$)OMcI}A97m=7^lObA90gV&X5a|*&Ws`5(2$NQCp}dq8i6c-MtF*H?C$h zX7Hd9$_{&tGI9Yo3Prq+@a`B5k*@&O@t7#Y{vR7K_=BdeBAi^>ApFtgb?06D^ANRrc-sv?3#t#Q!W$WjK4{qCRx!uM7k73-8- z_=WqQKVLcHt{Zrn=@hkcOJRLaR+EP_A%O0v9Z}1IVYZppka$f055>VH9 z_HmebCXr5|s0POdZ&CnMe_X%-alY@+FP!&BbjB}mZ927f3khTf*^e&0*AR^t2D#>B z0(Lr8S*n#1zE0%y546E=#*xfRg;m+o#)o%+;W_t?7~-egDX)`OD-ZEQ18%5eha=b{ zT^VXBN2PBe;d@QaRnOn-TsiH=?*~=yHLz5WM=cQjUnDuGYm$}q z0zJ@rBxEP>nGcEP38{Xdjh^E5ai(MkIe?EG!htR?FINcB>#;kFVnDfgCg&NvwW*y7 zpjq+?>`o0mzQA^q80Vo&5b#IwX3i6X36HHH%LjA8B5DR3 z=OHdo9RRvN60Mqwkx92CbCr*K>$*f$XndX4YZM6 zxyX&>|I5*n;qr887 zbG%eZ*9e#oR#lex(L!YT1;yS-U5mAB^iM+kIr?B8%Bv5gO_CG%2JQs?DZgcI}n{_o-WM3NJ0 zhZ*Ed*P_z~ZBn)*o(I{X1*MZa!@z)Sa^!BL#f-~~8O`$%#V8-1@?jLigX~A>Q!n`NKY4dA54{Gm+m{YLw?f{KXxgnJw8LNbBO9beb~0CGs$Al$SGyMUof`#b zNq6Ia1SY13i=Pb+M-Yw+JOHIc*@QE^&=BI2cA^~xRJTuF4d4;^&)>|Cv+Xr=mWXQe z3fd6v2_;-eHJlMvv}Gjh3wGz+m7nq^{!AnXFqKs;U^WYyoD$4GG6l)z9ls20P)!Pw zGKscB=B&8w8++ZhV_bM%gPB4dZp41Smy5iBK)4HY@b%+LdVx16@B9|0 zAL<>Hr1R;@&vY&P12BoE$8V5_R?8KpP}2jMSq>_cW=CIg}XdFl2L!M&XZ; z%N+MFcglu+VSlicJef5BQ@osgz%8u>5Y_;4Hmq^iB3Xp0G?S{iS20)TZRi!OttSrY zvIYGg#f=f!!m|Oq2TN|h+=m4~OFHhNfEu)m!-HkEJ02ya(K5bP^VwRFh5Ji&j+<80 z;jCo~MFUca<^bQ!V%Ne6yJ8zWEZjYC6b+i!9r`aRm_AA!F1Y3oyz#p& zM4W!Zw+|ddpURm6Af#;u9u)5B`M)u~tmi$pX2@0nssZPf)bQ6|qi%6dm7#!Rmr(6{ z&cqFD4Yin05cNEh4H>mTsSihYE*u)ZR$aS!hcgMcvC88De*z}h1bMA1xw)PLlo`Pu zo4IdgYmmiFpPy@zv(CV_K0+|*6`(xUc+gsLA5*ze6rpU`=`8oH!H$V2>L(Ycc_jKyC*Lhlx$I`_RwWTz;usr`$({5 zsAVWzh?>l*%rkrlg?XN(ihl$R2j$W>(_>(K&D`Mm^>>&K)2>*9YJ=)Pm<_cJb*V!x zhFv8Ak2^vpF(*6L(`2)GtI4N??})iFR$85hH=quft{Q(z>f)guinc8a@+#Kq!l9XN z1kmtHwIPlFliEomq3E^!w7vfhkumXvbH)kF_dK1575gnN%W=J#36{f0`P^GfH-R<* zuT9UxVTzjQ;(in4<$HGfDQZ05FK&I0MYWS=*?={H)ytQA-h=@x;lodF%b>2F{!0T8#)ltV5j9SX1Vv(uMT zi+$AWWLo&?n5EY|VT(fWN1@Fhb&%eQPo-HB>XkDuNOJ`9X@9LLeToK^0LP1;e-#NN zj>R4V0O>oo%cWh=gCn&KvJg#A=jwWB@5^^xk<#w8zl*SGV}RLxr|+I@+6SiIjNe}f zhf8a2;Fev_xPB+U5>?r6cK85N8Il}{32O)olr~m@$Ubj$ zV$Z2lU;sm>iR5s?V2QiYSo;(oD9bPq)Zk-)-0Pb84{YxV$)yT|?ur{>Xo-gXOmlle z->cT&$c5gdi~U*STJeWL6uyS1iLaunXA_c2~Z*7TvE;G2IpxArN&o8hiH2s(A<_QBoSS=mN;-S8J%8JA*2u8w+#Kk?-MI z_(1idf7qn)N6N@?s43Vev$O2x&GUa0oJk#n9aJQikYaMWFFe_@wW*zpo_Dqc;K80~ z2*%i;c~RJ|F`H+hok5*S73&mEVjDgdokTdl5>7z6$S-ILe^`#!Nl%A1UE=L1nHW5r zdf%L$|0xPxolD7Qq`$r%fjTip{O&Fjty*n@FQ~XHkC`0;c=_D;<(gfUCOItCuBl~s z+;-E5=F@c3xX%G{{rjE#K+{opzN7vEWvz;C^9AeLJWO%Xbo#>Hh<~B?$TjGmi#vM4 z@)a&Rv1bnE$`giito*nKXXko?U)3*TUfw`6c1;HE!vSjq*xk37&nk~iDjfr53*n4bqXL?(@I0+EmG#77-6VBLCs-`a(y zBjMhYQN-G?gx=5v+7x=V-(q`Z3`r(<%^V;Dbu{>1evJrpi2gN6JH-*s<-}(oB5#T4 z#sUgBNbx^Iebk3QbV#zgg6qqqAVve3*Kyu}n;Jsb#Qvbq8a(vBH6D;_?UrNt7)r53 zHPgXdee`2NB8fh2p8_&WrStBW@)X)*&*mIhneYxcMA8LSU1OLs0yTTwX`Yy(j;+q| zEQ(>j*E27PR>C*fp0uMo+G@xZd4L~^j|o-9OwUvk&@wQ6uljY1hh> z+6m1Zyb-NUNPSQ>Mj-20xC4Im%Eww&+MTYBLi~;HJkAq91H&md&vB4Z1bP<^Kew{O zfuGXE?(sB;9>Bwi2>o!Mu#BjB-6YUeI5I_Xo~Z8T8u%mJBInyc?P!7UdL=;nv2HO`E?p^TGsUcbDn8Z)r6GP;a3$C+f#3LEvM_6R=Bdg*0T zSrRCeS=vzM??vy)$}y%N#9nw;x#6LbQ-$@;l6_R1WTVt3t{SwW4`>tJ*nQMm6h}xz z*KyEaV%x=$ojm+y`rwbM0`!86-o72h)#_SA)w-mZVA6f@k&RyU4qtVEDmI0V8pUa? z!tyf@VU9VTTvi`@n54Cg?D6TO*!_m+VAo7#mhOzZR8%|&W9*2qp!W^f%_dG$c*>%B zn8*_c)(`JN1P2^F!#*VmlG+sQu1+_7TwBVV*%U1n&fgh{Uy?V;U-0fjp3{J<-~rw7 zT(gShVdy!->;*>ZKLqM;IVT*NMg|KI&9cdPX9eE7t3L8E^f0mL;MHIqyf8eKHJC1L zVVAY0ctM*`jJ=_DZfli|D!s;^+@{UWg1@kw?(&A_U0s4N3;+Ura5}ZTa5_U>mxTKE z$Lm8pQv$4!A6n3MS#JW5S_9a)D=v$u{Hig$ z2uulQrsFRgiY5OLp9Pj5bL|=G6SM))-1J2)9&8__^ZrsfDqbMDG)f znh!eRCO>x1k*Ro?3e&sq$Z(xadS1{B^l_Dmx49z8U*>R54(=|E^4tqJTX_{CJ?5o6 z^Bqhy3A_>Au3{h`JW$PmV$4x+@=&q2&EwAu3l|Ty#;QHsGGvdHAs0CqT z7~5Je2Tc|<2P96VR2BU`L~k7L!O@-q_P{3i;bCrGcF3uqz(I%!sZ zCmnp=h)?MwHE%2XHPjBLJ2lSx-bEK({H*Q5-l!_(wH*7?e)2^Bti2}gc0OoSM0fi* zd5p8YJ!?nri5Xzpz0LdbLOx-zd;27CB8()%bWg;`bU}JaeS-y^CsM||iQQu&+&82} zF4ER^vo@Hq|0ia6_z)vPvuEMlNn|hy#D2gR|4QFe2@cVhm+I~kv48+1_eb#Z*^AbDY&WFd`6fyU;0A&Q-C3C07D?^9s8 z{j6xjwPEaiki$-Aj`7Kw#mN}lvoa!9_jeJ7u{(dG%@CA_H3U!%Tm(s0PCc(qwiuDo zIFhxi!@$rRH9@I6YH7m#hG^&_4RI}nhADjj;Oeb)o1-b&?GeYU#z2(?s2yearSkK~ zK;%$d+U<-|+%t*ExBQe2Vk-qE2L0?Eu|9=g+8MxX!Z|gZQRbxXXOQqNP6Z!<`nvJ7 zJ+_nFCO{tC8VtmBFc4Jbh`vkLarL6#?_35gB_b=k(Ch7iDr+=`=~s{4=bZ33MTB>@ z-LDl60{0H5HLg~~o-W3{&M={H7GyJl8nN%wOu;5ONZAq`yq%3W^yb+e@Y*6Byu&!q z!kN70c|<&@Qw1RIHO9&T5w17)wi+MUd=6ZlCTyKNZ|t?by`pXtT43HE=n~iGyu6s) z$s(PtjD77-yrAonFJ2|Gy1aicYOs@c#8F5n%;)*o2%qp4x=Xc7wl*~!jvjE8qj{82 zEx~&So}>q{%gxz1Y$)5>K-Xv4o>;FgbQC^MOFTf;EOyYFiE;? z>hvcglXsb>!-CK8*0UE^>K~sCQg{^z$|jGVFk;caJD^6!zYg zNn4kP-*pdu-(T{u`!&sriEhCDMw;3K&SETa<-BGVuk}_f$s)Fsp=U}oZ06MMPHM{C zLjHH-I%Ih`Z;1wZV!SciA4)K*pEGi+vW$I4WueuP1&4Fha*%)&Dzm>&cBI5XK&X3n zNVmM5*d9#Y389$i@Z#q*ou!rB$k7+)5`crgaE5`tv00{(nqi98;rOJsSyt-TQ!4bu zwiBMuR#fKwl_tRJq~22!S!3qOiSeWcp`Q@4@5aP2vE4VoovlvKV^A^n?WIbgEo$@# zJd!$n@3$TMs1{s0!8IEDIDe|V^Zl7k40wMZzBY`$t@s-wQ1ktK&3&i+r&iv#pqJK6 zF-58utD+N_DPpUIzBI6ksCxL<=mk_2^G(%j^%a7^EL>_&50i!}=j;GhjGl!SCCw{! zI9+nI9)VrU@=pI|Im9vyg{a9VhJ=X|x{cCi9baZ_`aov`FO_HXtJK%Fp||C2;Vf(_ zo4vUcQy+tGpf;2@-kaU}33yfBvBRJWroG!9Wvla?+Vb}MNVy5}~< zMA1vdPz#DFsEyf{I`XI6ub(Q9BqA9f1QYPcxtgCoM6r!H1!ggzT??PIGr@8@B&@(H z?Nrr&4WRb`BpnroLEA3ZqO@j&(r1S{p?uJbB7NKQB52&1)}&cXYYkX4T3LLPIRiRh zvr;kkE@?@#P5%aM@eV=LB;6}CngAHS9@6x;u$2Zzu_PJOv*An+-ay|)#%s42Uao8sQ>9#-JUiPM{{fZ8w2o{hLKxl}Bm3SCVus`qn z>0{{W`RL7WAU9#$842;w0byM~lRYlkfncBenWt}hxK`2k@*M=h_p-Ng=CgKd^@bX$ zjZ@2Pwru~p&a$92=e>cpE@miv-;A-BtG zy{cYt2BhgZ{E$#HGJx_b9KLyxJr*;%Ojf21dcE( z%8#Tg;+6s)pmRVcW4HIqi-y^N`}yU5#Yb(Ro8!H$+jUXVVay}()$OJ4%g+S;weR0M zGW2~OPh*JLJ7BsYCm{@T|>$i8K78VU%m`GOu^Y9m$$v$Hk?`QJY^Z-KX*vGi)0aOt z{`-CYJNvw2+V^XB{Qo)m*5##9uT@{Wl*XBC(kc8oea(r_pY`-z@4kPL`uU^%=1o@l zySGirJ-_yM{J#yAKYq&VM^3)}JZMX3dD+Lar~kIM&)1W$|F=g)_iPk(NIQ$GFu z{JJ|eg=HV*&%ZZ6@0GXz@aug6r~iC9-G0{nsMW$3`+h9Ezw<@B?TfQl>bsX&=2z#d zoZMX=IWN6(qNnEhsnw^ZKK`AS`_`1`l39M|`)$h)P# zBJx)G6q%&LXP39Vty<)Ae(u3FDm%*zw2cqM<;{HZp`mEExz_aE&75EDD%Noxy?83Y zee1@>+fJYV93!T?Rauyi-FnsM&vx18SI@c?82epFaBkNUPU}^#zQu(7U2(6^rFPvJ zH&$Pc!xvB7e0|*}S&Qrbj7QP+pC!DQ&p%LKd6dU#p6;W?&d#o;;mf`%E>^s6{!PFx zam{~zk>@QESe98BBVTG2oLQBs06f=2KPW#RxQfCExB?@HOW!juEnfk2w-S(zbpZ=x zAx1<{Y8rgi1@O`(F8y$YXrMl01tW!6kSQst6+i(4panp_ogG(kNl|KIE?31I-Lt!S z4<+!pJ}hQ_!pf4Rq!RVQ!_oJ=Q_rL|4*o|CG;|JdFvkBqtNz+!8{;y~W?PPJ4