From 44f35581a9ed5989878868c73730aa99a2023988 Mon Sep 17 00:00:00 2001 From: Jonah Aragon Date: Thu, 30 May 2024 11:10:43 +0900 Subject: [PATCH] update: Create new "Hardware" section (#2594) Signed-off-by: Daniel Gray --- docs/basics/multi-factor-authentication.md | 2 +- docs/basics/passwords-overview.md | 2 +- docs/multi-factor-authentication.md | 103 ++------------ docs/security-keys.md | 133 ++++++++++++++++++ docs/tools.md | 20 ++- includes/strings.en.env | 1 + mkdocs.yml | 2 + .../mini/nitrokey.svg | 0 .../mini/yubico.svg | 0 .../nitrokey.jpg | Bin .../security-keys/yubico-security-key.webp | Bin 0 -> 35408 bytes .../yubikey.png | Bin 12 files changed, 163 insertions(+), 100 deletions(-) create mode 100644 docs/security-keys.md rename theme/assets/img/{multi-factor-authentication => security-keys}/mini/nitrokey.svg (100%) rename theme/assets/img/{multi-factor-authentication => security-keys}/mini/yubico.svg (100%) rename theme/assets/img/{multi-factor-authentication => security-keys}/nitrokey.jpg (100%) create mode 100644 theme/assets/img/security-keys/yubico-security-key.webp rename theme/assets/img/{multi-factor-authentication => security-keys}/yubikey.png (100%) diff --git a/docs/basics/multi-factor-authentication.md b/docs/basics/multi-factor-authentication.md index 7161f267..9c358af8 100644 --- a/docs/basics/multi-factor-authentication.md +++ b/docs/basics/multi-factor-authentication.md @@ -35,7 +35,7 @@ Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account. -Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../multi-factor-authentication.md#hardware-security-keys) are not supported [authenticator apps](../multi-factor-authentication.md#authenticator-apps) are still a good option. +Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../security-keys.md) are not supported [authenticator apps](../multi-factor-authentication.md) are still a good option. ### Hardware security keys diff --git a/docs/basics/passwords-overview.md b/docs/basics/passwords-overview.md index dfab5d48..ae5f5f1d 100644 --- a/docs/basics/passwords-overview.md +++ b/docs/basics/passwords-overview.md @@ -164,7 +164,7 @@ There are many good options to choose from, both cloud-based and local. Choose o

Don't place your passwords and TOTP tokens inside the same password manager

-When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). +When using [TOTP codes as multi-factor authentication](multi-factor-authentication.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md). Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. diff --git a/docs/multi-factor-authentication.md b/docs/multi-factor-authentication.md index 0b14b64f..217b5d35 100644 --- a/docs/multi-factor-authentication.md +++ b/docs/multi-factor-authentication.md @@ -1,109 +1,22 @@ --- -title: "Multi-Factor Authenticators" +title: "Multi-Factor Authentication" icon: 'material/two-factor-authentication' description: These tools assist you with securing your internet accounts with Multi-Factor Authentication without sending your secrets to a third-party. cover: multi-factor-authentication.webp --- -## Hardware Security Keys -### YubiKey +
+

Hardware Keys

-
- -![YubiKeys](assets/img/multi-factor-authentication/yubikey.png) - -The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), [TOTP and HOTP](https://developers.yubico.com/OATH) authentication. - -One of the benefits of the YubiKey is that one key can do almost everything (YubiKey 5), you could expect from a hardware security key. We do encourage you to take the [quiz](https://yubico.com/quiz) before purchasing in order to make sure you make the right choice. - -[:octicons-home-16: Homepage](https://yubico.com){ .md-button .md-button--primary } -[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.yubico.com){ .card-link title=Documentation} - - +[Hardware security key recommendations](security-keys.md) have been moved to their own category.
-The [comparison table](https://yubico.com/store/compare) shows the features and how the YubiKeys compare. We highly recommend that you select keys from the YubiKey 5 Series. - -YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source. - -For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never expose them to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker. - -
-

Warning

- -The firmware of YubiKey is not open source and is not updatable. If you want features in newer firmware versions, or if there is a vulnerability in the firmware version you are using, you would need to purchase a new key. - -
- -### Nitrokey - -
- -![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ align=right } - -**Nitrokey** has a security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**. - -[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary } -[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.nitrokey.com){ .card-link title=Documentation} - - - -
- -The [comparison table](https://nitrokey.com/#comparison) shows the features and how the Nitrokey models compare. The **Nitrokey 3** listed will have a combined feature set. - -Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download). - -For the models which support HOTP and TOTP, there are 3 slots for HOTP and 15 for TOTP. Some Nitrokeys can act as a password manager. They can store 16 different credentials and encrypt them using the same password as the OpenPGP interface. - -
-

Warning

- -While Nitrokeys do not release the HOTP/TOTP secrets to the device they are plugged into, the HOTP and TOTP storage is **not** encrypted and is vulnerable to physical attacks. If you are looking to store HOTP or TOTP secrets, we highly recommend that you use a YubiKey instead. - -
- -
-

Warning

- -Resetting the OpenPGP interface on a Nitrokey will also make the password database [inaccessible](https://docs.nitrokey.com/pro/linux/factory-reset). - -
- -The Nitrokey Pro 2, Nitrokey Storage 2, and the upcoming Nitrokey 3 supports system integrity verification for laptops with the [Coreboot](https://coreboot.org) + [Heads](https://osresearch.net) firmware. - -Nitrokey's firmware is open source, unlike the YubiKey. The firmware on modern NitroKey models (except the **NitroKey Pro 2**) is updatable. - -### Criteria - -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. - -#### Minimum Requirements - -- Must use high quality, tamper resistant hardware security modules. -- Must support the latest FIDO2 specification. -- Must not allow private key extraction. -- Devices which cost over $35 must support handling OpenPGP and S/MIME. - -#### Best-Case - -Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page. - -- Should be available in USB-C form-factor. -- Should be available with NFC. -- Should support TOTP secret storage. -- Should support secure firmware updates. - -## Authenticator Apps - -Authenticator Apps implement a security standard adopted by the Internet Engineering Task Force (IETF) called **Time-based One-time Passwords**, or **TOTP**. This is a method where websites share a secret with you which is used by your authenticator app to generate a six (usually) digit code based on the current time, which you enter while logging in for the website to check. Typically these codes are regenerated every 30 seconds, and once a new code is generated the old one becomes useless. Even if a hacker gets one six-digit code, there is no way for them to reverse that code to get the original secret or otherwise be able to predict what any future codes might be. +**Multi-Factor Authentication Apps** implement a security standard adopted by the Internet Engineering Task Force (IETF) called **Time-based One-time Passwords**, or **TOTP**. This is a method where websites share a secret with you which is used by your authenticator app to generate a six (usually) digit code based on the current time, which you enter while logging in for the website to check. Typically these codes are regenerated every 30 seconds, and once a new code is generated the old one becomes useless. Even if a hacker gets one six-digit code, there is no way for them to reverse that code to get the original secret or otherwise be able to predict what any future codes might be. We highly recommend that you use mobile TOTP apps instead of desktop alternatives as Android and iOS have better security and app isolation than most desktop operating systems. -### Ente Auth +## Ente Auth
@@ -128,7 +41,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
-### Aegis Authenticator (Android) +## Aegis Authenticator (Android)
@@ -153,7 +66,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
-### Criteria +## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/docs/security-keys.md b/docs/security-keys.md new file mode 100644 index 00000000..cdeecb74 --- /dev/null +++ b/docs/security-keys.md @@ -0,0 +1,133 @@ +--- +title: "Security Keys" +icon: 'material/key-chain' +description: These tools assist you with securing your internet accounts with Multi-Factor Authentication without sending your secrets to a third-party. +cover: multi-factor-authentication.webp +--- +A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multi-factor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication. + +## Yubico Security Key + +
+ +
+ ![Security Key Series by Yubico](assets/img/security-keys/yubico-security-key.webp){ width="315" } +
+ +The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers. + +[:octicons-home-16: Homepage](https://www.yubico.com/products/security-key/){ .md-button .md-button--primary } +[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.yubico.com){ .card-link title=Documentation} + + + +
+ +These keys are available in both USB-C and USB-A variants, and both options support NFC for use with a mobile device as well. + +This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include: + +- [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/) +- CCID Smart Card support (PIV-compatibile) +- OpenPGP + +If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead. + +
+

Warning

+ +The firmware of Yubico's Security Keys is not updatable. If you want features in newer firmware versions, or if there is a vulnerability in the firmware version you are using, you would need to purchase a new key. + +
+ +## YubiKey + +
+ +
+ ![YubiKeys](assets/img/security-keys/yubikey.png){ width="400" } +
+ +The **YubiKey** series from Yubico are among the most popular security keys. The YubiKey 5 Series has a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), [TOTP and HOTP](https://developers.yubico.com/OATH) authentication. + +[:octicons-home-16: Homepage](https://www.yubico.com/products/yubikey-5-overview/){ .md-button .md-button--primary } +[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.yubico.com){ .card-link title=Documentation} + + + +
+ +The [comparison table](https://yubico.com/store/compare) shows the features and how the YubiKeys compare to each other and to Yubico's [Security Key](#yubico-security-key) series. One of the benefits of the YubiKey series is that one key can do almost everything you could expect from a hardware security key. We encourage you to take their [quiz](https://yubico.com/quiz) before purchasing in order to make sure you make the right choice. + +The Yubikey 5 series has FIDO Level 1 certification, which is the most common. However, some governments or other organizations may require a key with Level 2 certification, in which case you'll have to purchase a [Yubikey 5 **FIPS** series](https://www.yubico.com/products/yubikey-fips/) key, or a [Yubico Security Key](#yubico-security-key). Most people do not have to worry about this distinction. + +YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source. + +For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never expose them to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker. + +
+

Warning

+ +The firmware of YubiKey is not updatable. If you want features in newer firmware versions, or if there is a vulnerability in the firmware version you are using, you would need to purchase a new key. + +
+ +## Nitrokey + +
+ +
+ ![Nitrokey](assets/img/security-keys/nitrokey.jpg){ width="300" } +
+ +**Nitrokey** has a security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**. + +[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.nitrokey.com){ .card-link title=Documentation} + + + +
+ +The [comparison table](https://nitrokey.com/#comparison) shows the features and how the Nitrokey models compare. The **Nitrokey 3** listed will have a combined feature set. + +Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download). + +For the models which support HOTP and TOTP, there are 3 slots for HOTP and 15 for TOTP. Some Nitrokeys can act as a password manager. They can store 16 different credentials and encrypt them using the same password as the OpenPGP interface. + +
+

Warning

+ +While Nitrokeys do not release the HOTP/TOTP secrets to the device they are plugged into, the HOTP and TOTP storage is **not** encrypted and is vulnerable to physical attacks. If you are looking to store HOTP or TOTP secrets, we highly recommend that you use a YubiKey instead. + +
+ +
+

Warning

+ +Resetting the OpenPGP interface on a Nitrokey will also make the password database [inaccessible](https://docs.nitrokey.com/pro/linux/factory-reset). + +
+ +## Criteria + +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. + +### Minimum Requirements + +- Must use high quality, tamper resistant hardware security modules. +- Must support the latest FIDO2 specification. +- Must not allow private key extraction. +- Devices which cost over $35 must support handling OpenPGP and S/MIME. + +### Best-Case + +Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page. + +- Should be available in USB-C form-factor. +- Should be available with NFC. +- Should support TOTP secret storage. +- Should support secure firmware updates. diff --git a/docs/tools.md b/docs/tools.md index bf994374..f28c2cb8 100644 --- a/docs/tools.md +++ b/docs/tools.md @@ -166,7 +166,7 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
-- ![Ente logo](assets/img/photo-management/ente.svg#only-light){ .twemoji loading=lazy }![Ente logo](assets/img/photo-management/ente.svg#only-dark){ .twemoji loading=lazy } [Ente Photos](photo-management.md#ente) +- ![Ente logo](assets/img/photo-management/ente.svg#only-light){ .twemoji loading=lazy }![Ente logo](assets/img/photo-management/ente.svg#only-dark){ .twemoji loading=lazy } [Ente Photos](photo-management.md#ente-photos) - ![Stingle logo](assets/img/photo-management/stingle.png#only-light){ .twemoji loading=lazy }![Stingle logo](assets/img/photo-management/stingle-dark.png#only-dark){ .twemoji loading=lazy } [Stingle](photo-management.md#stingle) - ![PhotoPrism logo](assets/img/photo-management/photoprism.svg){ .twemoji loading=lazy } [PhotoPrism](photo-management.md#photoprism) @@ -336,10 +336,10 @@ For encrypting your operating system drive, we typically recommend using whichev ### Multi-Factor Authentication Tools +**Note:** [Hardware security keys](#security-keys) have been moved to their own category. +
-- ![YubiKeys](assets/img/multi-factor-authentication/mini/yubico.svg){ .twemoji loading=lazy } [YubiKey](multi-factor-authentication.md#yubikey) -- ![Nitrokey](assets/img/multi-factor-authentication/mini/nitrokey.svg){ .twemoji loading=lazy } [Nitrokey](multi-factor-authentication.md#nitrokey) - ![Ente Auth logo](assets/img/multi-factor-authentication/ente-auth.png){ .twemoji loading=lazy } [Ente Auth](multi-factor-authentication.md#ente-auth) - ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ .twemoji loading=lazy } [Aegis Authenticator (Android)](multi-factor-authentication.md#aegis-authenticator-android) @@ -423,6 +423,20 @@ For encrypting your operating system drive, we typically recommend using whichev [Learn more :material-arrow-right-drop-circle:](real-time-communication.md) +## Hardware + +### Security Keys + +
+ +- ![Yubico logo](assets/img/security-keys/mini/yubico.svg){ .twemoji loading=lazy } [Yubico Security Key](security-keys.md#yubico-security-key) +- ![Yubico logo](assets/img/security-keys/mini/yubico.svg){ .twemoji loading=lazy } [YubiKey](security-keys.md#yubikey) +- ![Nitrokey](assets/img/security-keys/mini/nitrokey.svg){ .twemoji loading=lazy } [Nitrokey](security-keys.md#nitrokey) + +
+ +[Learn more :material-arrow-right-drop-circle:](security-keys.md) + ## Operating Systems ### Mobile diff --git a/includes/strings.en.env b/includes/strings.en.env index 1181544a..cdbfa19e 100644 --- a/includes/strings.en.env +++ b/includes/strings.en.env @@ -34,6 +34,7 @@ NAV_OPERATING_SYSTEMS="Operating Systems" NAV_PROVIDERS="Providers" NAV_RECOMMENDATIONS="Recommendations" NAV_SOFTWARE="Software" +NAV_HARDWARE="Hardware" NAV_TECHNICAL_GUIDES="Technical Guides" NAV_TECHNOLOGY_ESSENTIALS="Technology Essentials" NAV_WRITING_GUIDE="Writing Guide" diff --git a/mkdocs.yml b/mkdocs.yml index 53475188..c0c0356f 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -417,6 +417,8 @@ nav: - "passwords.md" - "productivity.md" - "real-time-communication.md" + - !ENV [NAV_HARDWARE, "Hardware"]: + - "security-keys.md" - !ENV [NAV_OPERATING_SYSTEMS, "Operating Systems"]: - "android.md" - "desktop.md" diff --git a/theme/assets/img/multi-factor-authentication/mini/nitrokey.svg b/theme/assets/img/security-keys/mini/nitrokey.svg similarity index 100% rename from theme/assets/img/multi-factor-authentication/mini/nitrokey.svg rename to theme/assets/img/security-keys/mini/nitrokey.svg diff --git a/theme/assets/img/multi-factor-authentication/mini/yubico.svg b/theme/assets/img/security-keys/mini/yubico.svg similarity index 100% rename from theme/assets/img/multi-factor-authentication/mini/yubico.svg rename to theme/assets/img/security-keys/mini/yubico.svg diff --git a/theme/assets/img/multi-factor-authentication/nitrokey.jpg b/theme/assets/img/security-keys/nitrokey.jpg similarity index 100% rename from theme/assets/img/multi-factor-authentication/nitrokey.jpg rename to theme/assets/img/security-keys/nitrokey.jpg diff --git a/theme/assets/img/security-keys/yubico-security-key.webp b/theme/assets/img/security-keys/yubico-security-key.webp new file mode 100644 index 0000000000000000000000000000000000000000..ab3a75a0b3d63e0329606e7f3f084c5e1f06657d GIT binary patch literal 35408 zcmV(+Ue~-bfTN0gT*6 zQj`oHd1m1S_OSm`+%}ru?5@y~LAK*ilU$(OCMh%HF*8%SJ!WR=F*7qWmYEx9lQ`^v z?Z}R8S+Fp_=do9gR{PU$M!A0?LKbW*bu1kX8EpHGf+A`j{f+P+BqSYhEZdeK5Cw+v z)dw+4XSuo(2(TR6_GPV7Q$f?~XJ=y-;GhAR-L*mj;pph5E#V*pNC^_G*&>8WgrT~s z*`f&m5iTMs#89yyRE|(#g$S1dXNwsqoJm*0R)~J-;6z`F9y0mPzFfkwEZdS&&dN;A za3Uy-%N z5Jd}BYOZPp)#7L0cv_AYx|dvZ(LiUHjkAp)$Ym`go}5CYbh2kOLDR}z>@d112^?haCh8eT}wb(pJ8C<4!OD`OjP z+fpQoqpv-$FC`Tw0R`6E8bnc-Pt??pdEGv}}qJ*`PKiphwBGRThvYZ?YfTYiV z+owNxQko7D%U}KMg@R5s0(a!DXY>+6=joT8vLv6hZD>8^VrgRE`X8(trwIG33s+h( zmAFHQC2P8yI85{`1mpl&(+kgi(GQ-Hr-J0_&m7eYv>KK7)$13M!MxX8d32#=9o5_- zG5Wcm{(P7qI+o|G7z>?kra5ky%ku-$E?DxBi)|uU^|=#rH=jiKcw3}`oLzxMUJ$U!>sqIpNa zgbOfW@7c>Kpzq~GC73?*>@7fOd1MFZdBs14xJ$*et{qIBxxNk-;H0yHU}yy*`Dnlb zR+0co&r1rbq(4c4A|x55LEqfm4! zMHW2)1z1d=2YDu-34HVtfe#2vkV1u0l8e^JHKY6>fA}T{*N6g=z=dukH)vY?NpOHO zB&4nYEi!6L!q0)t8gbZAPSXi*y~TA8vQ{IhF@`hK%94n|Vy#61AL`|%9-!gdB3Vo3 zW37ql^U=|lZcd(1qEfBZfjC z%GG2ldGuL}y7gsBTAY+iuw~u8{o@B!y0@=$*^x(P;~htsCSTaNBBpP7ur^Wh>n@L8 zxa`VjbSGkU5cC#Qd~nCgxBqd&-kO>%xwM_G)hAwle3w4_x~7%-%PPUHVEn-YhrDU; z8e&>CZ2a-VdmFzt<{3Av&9IOxS|iKR-p*I_@VFd_FeS4u{#;*Q ziw=GWoNeyPc+TraqdatH;Ca^`rGaE1-KDoZw%LuK(ZPpKSe`Kt7GuHS`fWi3?BBd- zewzRNEuef%-+9}XD5cu5d0=T?Gp@kV5ly^@*6)c_tdYH|;;}%y0Gk(M!LB{qs*#E{ z9CT^te;`Wfj=^#yOpbQU6B-DF;g)wq+%&Y4+EEQrCWrP%)b7DPhkXV~GeLPg;=V#U z70;roc~~HosYc!Us?7s!YBvtl(2wfCS%G69d$1S>dZVg$`ao}%gH{V%A^IvA)ciPZ zzeMdJmQm6PqMD#`DrqpuN=A)Axv!FJ$(tvDE~F!xiCx5qs5%x0y203sO*a|b=$5C_ zAw(;lKsQW~lu@gaE?YcgWNP%Ys!mjRZkI4YMn&#VcEEx$z<2?azn09qc0^RHjBYH6 zK=UjP#uAYqT_w2yPZ6A`_Ste{`6e0&64OyVwS3xR0T?flKv-+tb|Io+320pj#DuFy zlfFfTsC}m=p87NMr$AE1S?Or#9m}?=(sV;|&n%=Pp{v@##35s52urK;mVK^&wA_P za;7#hU~eo{O9ykL*B>2mkkRh z;0(ljJxzxCYpRyN`?{6O4!JUzDD+#G)LM8MTSpMx&s3ZDO&)qI7+8A#0S*M1D)b$D z#EEOISh3>ce|_5W0%dWnxc1{09(#0Q!kVhSA-|O{&6c)PW{%7}0Ghsiv7xYmX2QrI~r#3s0xIH)fEIhUU$dxJW_TZd)6t|=IY2~ety2Y=&~WnWD3aC!0sjQ8FlpZBpo)| zpT4{oD^tiVPIPyAe!z)tl7zfh$ZB+79UCJ$d7lti+?bD~P3h;IwTAb|h1Ph>g8bB< zmAA1$g3lI314b2idDE3Gxdb9>$v?=#MdS%GGLR3nUj(3)s-OZc`~%h?5!^TlOOUH7 z0G~{|bru%1(sRIqQwI2lP@s`40tA$Zt4xqV<4tyTsx&mAh{#iNjmyn6rAU;WtOQYN z}gAyOz5wV6e!6j_mY!bC#vS|rqASI^tX^pOHp@R}SPI&htckFQ!mamknLQ6xn>FLt+LBV~v$Dug_MNBRB3GQ@9!C|2hU&YyXwkNaa+YhO^CUd4!f7VwD{W}KI-!U z()G_A^@1x0oJ^txnw^vBZ{Uh++)=#w4py|*^sR$=S1nd8-H{XhulUS|?({Xdb&z|; z+m|PtRuvH>#Zi^7{j{5tJI?(kBmMjnTfJdg`QzXIwhj7Y5*J^8Op7n2q0xMc; zGM2n(Y3naT70!NXzy8RIcdl)H^#(6k!?k5`PF`X$Q2FG`kJldQc+Cn97Nq+=xPTG0 zVN=n4NuGrPxaXn{j;|AFu6ldVVL`Axi%wzMvh+TMhgNB=$_vefmHi1G7Tune-{YUptefaLdrO4*TOqKj6o=JE`mtW1`PF6vr><&Xx3pM1{oA!LdR^;(<^lg(5F zB!FE>F}-R74jc6crj-VqSVO(Ns~^|^&swtu8_?X>z!FAhf^6VpDOqz-3Zn}wPcV^Z z*608h%UWZZVS@nEPr$dOv7Jz{JWK*`O^l5JfeaG>K&F#9UYA9dlNlk%v4sOu&LSD< zqb8>`;2AtKoQ!^L2mxS);W(Ny%uZq31M(o*lCX_iw8(y%x5&Z{Y*xZ z5jEFE5zX#knzY{m%@}CPNBgK1W}k=L_U(y zl#`KXYoQEzz(!9PT~Hh!U~&XG(Hb1K_(M2Dfn%L1Q{MVVvojW|-M+kz6Jp8$PR{Mf zilNbELCq=6Kr9fLT_cl{;~zpQn_Ni48%H>P_Jqmtpu>~t&5_#e9^G!YGENvX1{n2f zvcbs;4A0kTa!zE~(=oh8c^KnsXmo!|DA8trfP6e{U4w?DO-yE(X~UCcQxAp4rd{Bh zwAonjE4Dvq zy9o$`BgnC+Kpf5pTx=|X;So5jVOUUrAx98xw+RA{>(6qVL_X@ziDeOnOxRwuSLSw^ zK$8`Q97m;?INPS|p&8#O3H)l!^maSi?ks4|ZPK8b_VCQ}fZcX802=K3|33*Jgeji@ zxVYoo(jEgQVp-bnV93wIIn3dqf!SSe_5bf+$V3Rkd%qqSvspQu5v1YuXf75xQF~*b zWaH@x&6O3lhl3xQ^Vr^Q`=7uyIL?AB0}j`bCMUOtEfNe`tnK#ThvuBjGO+z#mz5U3 zZ-YU>GL+ek)~Jk)Ak(g#*)hO#G~{G}8PZ-SgE@ZUF~rWs4N*L$$S^!8xe5C#}I zq-Ds&^u`gNV<>Z*ZU8Vm<^Y0_MmJ|3xmf8LJ@0@>)Hrku<(F=)o@&O%{Z{WZn2dj^OGXW+n~XB$B~IACjVB}N&t;{d|s zOb}oo4ub|%Xv*`iwlEn{a}yslyN^+|*@hFDZe>bxd~>HMcV|nop)ocH0vhtBJ2Ks! z6~{`0HvEgo#z}KOr~?gey#zTP{n~BdaD>TQE7VEF(>Oc3(nkZX?dupM020BmZM z9IMPnK6tZ>qG@2|(OA$-)L16KNeq~%{dkYk8&g&s-(?{s9}`TUi~8p#%{W>5O#7c~ zXw7k1p6D{nATs@V#bZKguG3U-9H#;%;9E>*oJJm?6mUVv_R#Sv8@>+HIFM$7OeZyW zkIMKs0t;s!c}^BP#(2wYI;9msW!N2YOSFP?#wK68*XT_!) zPL{*Qw|#nPZ=$7V8o|b2aelL3<$oW2_Os_FrEppj${(Kobw=nA>Yi(_xp1*%wd#Kv zxWykFzd1oI|n__lmUS4TFN>n;?! zA?0}&5grcRowrPvCS6c|;Ct1H>by)Wjgspy`iC3l%`bGMY$;)uqVnORU%tOOMa^Za z?%U^iRnPN1-}gkx^Cl;ukk!JC{gZP%NYJu`Odj`By7AyE@0nDHfTI3kfs6y<5c;P2 z^1|%*5b+D&`0CFFB_-hKz2ATApclSw1rcq>wm?^plOEi123e16|ucAk?6tqSFT#V<6~)K&L|u5wL*_RJYJ6lxn?~>uCKU=U4-t zZj?gqpj^rg!9;@jU4V=6BfDYHbc-*`@jf{Pq!HuO78+A8%EGWvnF6>j0gxP z8x@U9aI9XCM&8?2?{3-k)T8e z?m_8S_mqi+(H%A^0N>ok#s|@(eNAM3~b5cDY2xfr)LK*!Wri zQYcgcL3p)lstdGhBSAma_cwoY-9)Jz`@4)LD&u$lWS9xLPLy{h55=wig*3sP0#-DSghFgrrWr%j_Sbp)Ypr-`chXt-}eu0 zp30uIAjN3wZ0$cZHMMWZd-9Hvil6CNbnG#mR@dVdPBc>T<5edc58$uvF73Iq<4{c_ zs7;r5FX-x$Ttd1);gIp!xZ8fS8&Z=84hSKfR7Wo5iL1Z3laWVprDd$JEhdKW^0vWS z`Wty=Vo)5OJS(tFXk%&c+Kol!B&*YNQ~<@@pSo!qAL8te7s)gavU5lNDjR)-_2l0> zRxQl1xpUdVn7r}N#fDzX_}`m$v9T1Mv*INQ9#Grrb%+Mxjr{nGle4s(QUJn$)-C#< zuif3CZ+zd6%S=Gp81u9ISwOIP)2hb%Xm$FoqnAr|%q%;-Yy1UwH`)hA{=~%zAYkTF zONfPE*AvA=PfWSp(=xIkcH%e+Xt$$KB^U+oyq z9_-gYKGeABi;Y2Epmom2 zloN3`W_!+x<$?i-;Q3orp=_X_H5JeB_m)48H156mTx_bK28PK(c87=r@4+KU?H_=K zn9}=yyC)#p>v|<%X#10LG z-JkybnCCZ`WkSRidEt?X%>ye@iH5vKY{b$K#(w^#y?zZFLQv+zP0&C~$wD*>otY=7 zK|gHp*DtP{t~3VA5#|_r%T*O=Ni4&qQzk_Ve{l0XdrPVz^sS8x+#~}JQdru*Ao`Pidm64wbO@O=k%oWq*7k|)EHw}L z;376Yehvp@iBF+X?vqR)V8<<_hbnu&%*Y+Ck)7a_QWW0wRpSBPXn`JpnVjRu1ftA( zwjU&GW!4u6U}y+gfV;h$7YhtPPp(6Xi7x74u_o_i5GAGZHNPuircvPH7E4o-o*r|ZjUk(xpQ!WB9!-4 z8pVJ3?hyvC|8FVnT_><@%NPqN|4@hs?8k;C3A&E^|I|qXqhDJ$*7Df#xI=OFhs<0I zzwg@~2N*3?BaL|Xy<__*HB6`N9cWmB0Dj*aNwQd9={91B6L{#odlU$WD3nrxUoGw3KbR9F zF*4>R;=}lMlGB#m@BZ!Oi*hYJ*VuGVt_cFa>+Ai!`K04mjw>Zd0YW0;Y->j;rDfaB zOt2)(01?#;l}bpkqy;k6Mllcp2CnCh6>|w{4e38$c+0y#d~+u0*s~SKPz%QT{cW%$ z$Qcd*c0dyE1Bvyut*2Mm8NK&1i{N+8a04SBBPY0G47LmYE|DFpFrXl$%6cE@GLdu}F{TByFN@DA0t~~RM-fT*?BGmN6;Qq&( zWaI^B;lKmG{oWUC0I1j8oQ8Lfa~%zpV~%17n6rQ=LR=^xqL}68ssaWQ52zItu(xAcZsGb_QB${ zYYIIbmIMJIxt*)LZI$`&_aF5y~e+#gHJ=bG$uI09H^qAm(cT0MID`odGJO z0$Bk7001SOxz1;MB`?_9F(wb4LHv24_6EZoLAhIH_AtvetrF8`v2@-_V50` zTEFZ6p!{YDgt@924 zJN#$)Z*~9Wf6srQ_W=G|{Rij&|A*zT{vTvd@89=*fj^*sY4w2rZU0C7fA9a&zx6Nj zU-G}f{`h?he=q*S{+shd_y7O@;0LZ>@DD%_QGa9p`Tno*C-qC#H}5~*~V^#4l#U;gj% zOWuF7f9`)I{(!%ie?9*1{lE58`|$lYct?=l$3G@A$v&zxuz? z{n>jf{l5RZ?tl85^X7PLrJW^S#5*t*{ox@M3J2#{?e(CF38QyXA%)yEM*7bO>mhgC z9k8NMy&449TRK)IZRaP%=@B9w01M=IX@HRZh`Jy!1ghU*C8^IC zub*~szI%iC*u0T#6{?0wD?uM0);a$=cstI5d9gjsRo~aT7p1|AxtOkxF7Jm5;(rY* zPtax>)au?;z)3>2P|R1jg#%bg@5>;m8hBfhO~a@-ep6eIjMB1M$^&XU^b*fP_9_{b zBTZfC+H*ah4vkfi3)Bmf>E=jWW3Q;ZvH{|*oZ(%@jx@epAoX|0hD=N40^#q|0EmmG zlXC({T_74Wal$7bb$grVSBDnB%e{4pCw#R!8Ra^l84rBlGuKRH*3^l}uuro0 zw_#+cxbz+MW&l5?HnT&D@@`?M*UL6nkcRD9ZPP#P`1}?~X&Lw-!;!u72xph}(VVb@ z>|nkUh*Z}KVsndrrpVvb@`5t@mvvDt6^i}Svj-qpfq-r3Zf@xEJg?D^xy zv%l_TG4)EX&#ZzBYoYKHblE1r!s3IF++4@yT+bQDo55s(+o@^t|Eyjc#qKfhP1^O> zMYt}hDohZF(E_L+$BSRsxIa^A}~L9cj-3cPP~%=nflfDQ`9D zTk(`}%4Vi~403>IuB(aG2NdH%KnM1byGP-v2fqU6$YV25?XdUiwca1LBGQC8U>8T$ zod+$Xu#VB<_Bs<$q<4kKnv~=hbMpmDVF>n#StiZj^fIUd=Q8YZiH|3CCTEpgXx3t$qX zEp?x_rbIP0!q1s1CCrMOODLG)VjaB(+lYjan?-3M%kymP@blH5fTOd~Hp>(4Pbig;9UH=AV-Q3Z3{XQWg@dj008FFfNXoFW(0fk!3b31!1{ zoT$3xs8t;JVm(MX9mJbUS~F!(B`$4$7f?=d{UdLG#A3X$KYO;j{Z%9zy={z9&HbAS z^0PxsQ!`7*2swZNQ`3)YJMmNrh6H?Y+%@7{&J*aqz07g|vxbWxLq0U4b2**?{SRjTLTOx-bTQw7FDm`LtN0AEixwL|<#gv+#Y>eCQZ zU8PhyaR@4F;;qUig2+#!K7OuS=OgmRiCACQojxw_Yzu;dBug0Tvx}!D6_eZSXkMrHtID%)dS6W z1H{3rjqI;#W2;aulHJ#_S+0!G1*PbzQhqQm;! z2?^YY0+b5In?Q>*PJIXqjV;yBTF6=zTR2tAMNlk!04zITKW>XLY)TLbOoV{J2|A}o z7DWd+frsciot$6_9;}(;3PQWw32tf-a-T&TW44FR#z;>lT6o`+iSLD>6$yr#ytCDU zZOT0kXt9TAL@>5KZXB@R>R!gSksu+7VFAbW9<^P9wYn}O!lM)CRmGQRt_Np#=b~Ps z`irtI-bD*8p?W;HW$sRMDYHmNbF#Z49eWBjNL2cu&`OK0O4H_87e~rg#=h!Bhin44 z{ACeNJ=)i-Yre$e5r0)$NZ|S6UK0>Sae+6RAiNqw2NJEwc~rIk@L!`Eg6goU6dqtj zwGCaG_3wbc-PaaXf{HoVk*%L&z#-D<_Ghe6?1R{_8o5sg*_6$sazJ4eQl`qoAro!f zT%2sQjfUPXkfZ^gj;2!JE6s^yvL#{Zwqtv-*`leF0jVXl5}KTKwG-i_U@>*bFjeS} zjT|=N{Kf(B`&xwjKoK9VcK=LRgCRIpfk)c~os6hB#)F$VdrIbKKwd_tDXFBbd4mX$ zE#VrUQVj8Sluv)lhz9Us$&ipu##shQcTgNWeOFU;%I4ouxwHjbv)x3VeCVRWr)qBO zAUi#I@tW#Ga^A)QaG4?k8=J)nI|*I<6Bk)|zL!3rR0V!UJ6b>bD*qe+0RI0F4EH7f z^K0Yzmm`pjo8CLOIMC6}{@(7Yzkmo~V}dh0*~Dz74w(!{)x<_WyHr-gN1jcS@y_D% zie4m9(ue{n7cH`eB*zX@*LNM_^#%glfz_wH&~WR`>YkbCer}TvbWf0LkXg_Ko@PSJ zioN%d{#hfOa3^z8;nlC8N7!45b3Bx^Q=Q2U*fp`hR0gTrMTYfC+cqKj6ibA3k!1!a z#@&Q`IncZagsTBqmE*q92#iNiN3#+`a4qPj0eNL2C^VsHmDYhmx&GbdAx|NtL;P)d_P>U)&1dRh!N+l-*Mg11wFkpn9bu6_1bQJ$0LU1xt;VXV)@ z?p9-AvPy|?9{qsfLy(B}zZ>fbarATPHUF9$L&S~VO59G;ZfEn~IRf-NHb^^Ehq@}6 zY>pK|SvO*u=^%+IIk7!uA8*>cf>EdHyda4fWPA4I)TSCk4P54!_KduySBT}4pJ@pp zQ=>NcF}g#+feAY(LCl%G7*hkdMeVuO-q_H8x#i&mH6t|C%nJQ;{^6R|8aaM_#W8GU zjalV0ke;O(QDlXN3Tdd*hfX3}z$M9-NF1Gn5!X)lh$?bCbrEaCcQ_o-CsRpmIj-Ze znIRKsE8;h8+%t;L(RqgB$~5^qI=J5(WEhi2t=h#f4<9uS4;Wlo87~>2nC5^;h^6>x z!rZv)uK-~i2G|QE1iV~Lho^if?23-ck4c*L=PH8jip7me6@<+<`x`rxK8?U*GnO5T zYZV774h+6z!YgneL`>xo;%Ql~6l8>EciMb_UCjnC8?u3>)ie}Kgp%~=|G~RhG0 z-Pd-tPtWXxd+QW(Q(*j1*b7{vOZKsp;fX?>{8&gob~Ak*B%oBL!cTFP2)y+qPXm@M zMpl`HBkj`!hM!H%(TD$gJ=4F0-v>U-aBpz2Wd#Nd1`uzUJilt(bpdG;byhhwxltVG zZ-K*0UD#9N@*;ZJw^8|u6idp9mb>eSg*%!m7H zwsx@Ea5rvi5U4^()!bDf zhY6{%^(%_l^sW{L?f?(nZa@wrG#fO(ANrM2a2J-Tyoc!O$o{@RU=mkNfof;Wt= z)^+RJ*b*^K?b)BH&e)*@;HFzXlAKi3h&%eX{OcA8-G*2~!P8EIp3;oS7pPN28e&k8 zbcv~-sT}}FJinHNGZJIAp;&>YQtUX(qGUF`-)P^&ES7j5Cn^0O>e7uqj5*|#pN1-v zL0jjoiyVd$+eW(?b8fHTHHM`be;RP#g3M`4F|TTWYbV`wstKNFs&221e4ZeC_CRKR zy;_h?{JsO+fBcV^Ta28H>`F+rZ+3PKHP6!7&q4yeI)CwBni-=vI^qknmw)^;z!Ts6 zo-F85OqDFT2McX~2d*Fr7ey{W5bdUPlr+roN=M_Fp;h&JT9Jc_^V!R`c@9dU@k5;2 z!P@Y#hh1127NeE+e!Ps5T^-kWeXas)({*MWuJAg=LEXZnh=q64l)!?!sfQ9xXo zn^dZ^+Yp9K461>@iU9|}L@B6&Kzv~t?*o`Pb2mh?CUp13X zPKaWyBD0C=uFvQ|cF#}^4l)s1$?Kz<;u8+}*N-ZVgh;_9q8rRv{z>|>%nc=gIH{g; zj~qM*nPW9pd)(*^cZYp_L*6}+jRqoH(R^7VCx5^)9 zF+$;>M>{2e+LgvkMtY0)r!tYtr5V6#UMM4uBAv!($O|#YIGD5jJwDkt2CZ_S#?Gvy z+;dUe{&y~NdZl+ZNkp-DP68YUnY&V-8+Qeb?pIc`!n~eFyvTi%*(yFF9{t1Wj>j~Pj74kRusXQJRwcVg$`)Ls3dan&{9wVW7BMl8-3 z`xIUq0w{iZ%>4iPEP2y*R`MW}IZ78AklAT#r9qv`T~LSJR=W7akQ${tzK+l2QZz5W z%2KqOrwn-ctznA{UUzd<;+MPUjgw`*7y=v=Oz`z5imkuCX{bx917id8im~H(s4+zS zOn}h4M1W@h77z?8{g*AgNPVzr6S~3WE2dT`g}x3MnY01H+j!;8!{7*-F-L+llSlxD z8+1EbNJ-aQRfRm2+5za{HX%NG=WnY;a}$tBNH5=KA%`noXZG9z9wWOL-F3L;{*|DW zuJ^<#ui;0kh+)UooAKk}@cs{-x8isMxgU7?Pch-QBPQLQqpip<9yjfw4+?yfJ;8exjcJn_^HPHu0A)cx%m0b3Ytv` zo`BYVENM`M>TOhy^c#KN;Lx*tXyabEc4~Ya9305#F}T~thzP3WAEZZ|#(`bZZ!e_w zz4`;~w+r@vwDaxUwHTm80IO4K&QpS_kcrzyFjE`jgY{v_sLTwmM68Pcj1uxl6Q;OM$(B`(&RY@eAbfNjU z9S48@JV_=9Hq_`W8Rj;E7Ip7n1h10rbreDk7Tkv(1aHr-{fB5ch~Cg=>;pP^{e+JU>7!-kzAO)Q?f^Gsa?$75rF@MTkbB%j zmu;Ai^7U|i6nYR-z9RTh*n{H0gbn)h{jXRG%b2$ASeAlelxPW0I|x7q$Y@JAmQBZA zd*t81T^P<#4C{=P5)K$=VFBykDy z0-j}oE&qTjEdMS^CBfYU-MtgGL)C48Tn`0rL+wHE$$F_DWUbYkFbP;xAe3cl$c{o* zEFaxeKn&^Ag|&@jm7jD*(8&?CcPc;)Ss3mGm9jR6mwbgfw?6dBsP$hR9MWl}pFLcK zv;J$;8tN@0=ptFE9`2c3@63xN>GSxsI6!l@gT;HDJv|fK-_myL@dKrn5coMXiBKUw z1j=mQu~EVL6C)*iIGEGhrk=|^trCHNOtr2DvxiB`MI~bg0*g(MGy>+2vfw8sOD=Lv zIy9O%=bHf}m9^G>=;&6tRk=Tx^jk7ldAuC?;G zS9mZhL!}TElFO0>|2YG&@PlFYHCkR5#=xwuC%&tHwy3#ztXR(=&T-j$pW!0cc#Nht z>S7S`n8p3<23YKViK*Qs7E~M323(Hiek*`oag4Jdga$ZnaX*{dvkJg@`?W;+mjGbN zX#?J7@)=>S;0_ZqI&tYChTJzgowiA%31)l8fs97-q|%L|J0v4(#^`wyy51)w<&b0! zdWFebRkpTrkaB*vcI4$QZu{pd4-ET~n%9n)1HSGEAc6>(sq+K{RQPaONq#i{1+RKi zYC_g^CO!Xdtne*}vuC5gC#^>`FbFAG{ylhYx@ZM^wPcA>PtB(E&=x5}5p0+L;yv*( zKO^!I4Vk=U9#YJk+asTETJWSb)1Sr6ryt*?YU=!zF|0%7C66pMLIj93K%~Hr`}td| zX}TudVjwC3o+qi%qKCOOe^BBo=++JpR0 zjAa-Q0;lV|3jyv&m1&PM+zTws2(+$V02=hb-zTOK<%BT8XxLTP0hD4l*#rB(c)v}3wiJ1 z)TR;%tdJ*lx`gFdffPp{S#6FdUNhjYp3O|VL19eN?>rOq73UiUUx`Kl*Px0<*t<7n zAZ7m#nGO(#qvF?Z1t6R8h+$&j$num<)4cHj+jz$S-#KWntQiJHQcvNPQeC4HlI+?J zKm+QR!)8v=mHfOAtTw@eJ_j=8OlOtG$P&o?OgCMgPzVb z5%|7x{pE_~zv5NP7gm63tWCsFymS76b3>OuljBL2Uu5*zCN+rrxAR1|8m0m?|FY>toB&(bq(8bHraskR zQ`j{!m%q$M(38q6))R+!1U``5j-JXSgrC@)Sn;_WHXwPYc*VSJD56mFTBG5{sVRO2 zA?;VZQO8p9leYeA+kE%?%KWG5Vq%pCp|-WneUd>cHr&NRTay#DP)!UcV590>LU_-u z2N2o+;^Q^F1v8*B#P_BBchX{kP|(Wjbd);wfFtY)q%MD;epEY!b;|wEnR!dE!+KIa3ZkPl)UF>c=^vtyO z&x1>ASH1aV;6PHQ-hcdvE4hL;(cNFl;QvyN(1yCxbT?;Lu<~KPq;agcJMe&*Lb34EfWQU{)#9popt!I?!J!m3n>c=P8oQ-*{Zo2vJsUIuWVj3y&ud6)C*!PK4N zBDB|8p|^{m9^Qm?uOM+hS0q7TG5wV=0nM@a12jK5ACmS*np*a;e4*gq-1%=O34a^@ zGz<|3WAjP@bnoC__10ZPfjq&AU~M}lH=ON5dd4*{zkKg5Y+}+OhQFK-E-1DSu)XnR z6(KkaPbwj>Vj_c-or+z=KKGvOI!kxIYg$umH{}y8)WR+h1dR>Hp=w5PvZ~QDfLX%G zvx2E8S6c&TY)YrE8jeA&UquqbWm`%!y^<2T(mK+8#({iSByj3h!yg_I?eKg{>6KkDemj$Sj$quG)wfN$m8`eDqtB$3R%`l}=I!>)E@ANhBt(GD{dp;J zjwr|w$u(u7AkUHli6E$@s=QI@WkdM(44^c?G|D4Le>LeDpbkdo@E`M08@L-3NN7mN zF`vF7$!``z1*S!FoIwS)YN#J4&45SS&S=4x`kXz&AjtmLLX5JaQ zJ1nUDinTyQgpr}Tn@+ta)C}2-{6H31x30qv)5jM+kLPmGoC`2yY0{4&)c5^a>Obfa-^Imza!G2WmsYD9VpvNX#L*ra;Hnd|^+GafWO>!i zj%rQuWd$uow74%pUV%TrubKSP6@Ccc_2Ni4XI8NoUPBnC;+sZ`nodzq?9snhR?Ij) zV*cWmB+)+ht5@$@-v>p@eB)u9?y@R-Sq?^37cyeR^U9M+o6e_w2q5RyN$3dgE)8Q) zZi8(l{K~P zAt$U21n6{=^eW30eJ*IrIJ77>Rz93C3%nUZ?f8|5T-PlM7wUCtzew-+Sv28txmTrA zs3b4XmKx9LG%4&2N#-9YxS*3O*VWm>hVzKP+1w@?ChU;Z|7Febl@TfJan<9KNJJaXdAm3D zBBX7X(C10jX=lbcsLOD01oFR_@rZrxea8YbzJ&RhKpsFI-$fI*73CNN<9LZ-k756ydq)fbL6$Q>O2sxgykFGL9Dk8wyvq{`Wb0-yv$*jB}-` zx?IJ#CbXY31SkCN4>(_~n`adhIdNIL3FMX}y+fAdh(AYX9+UgjN+RgOd9#Rt31QSs zzR}3=z%1F5&zESL;9kkV4XTO}G^UtAMMgJyY`6lUp#r^VOU;8@ z5_5Z<1oD>6Ap*B6ReF%Sk7_@b2Zqa{y-?XPNQa1K43<#rg^w7U7kI`P0>=q^kC%{c zR0XAd!hERs#7_%3ZJi4C7RH!r%ccU(R>|Y506g91CIw0~=)&z^l2mTBOp77vftUF6 zg)x-E`Bl)i;zrQwB4)C^~JYnHuH}hT{%v zWs)$6vMX8?%aUZmv#&4jXnGwRz1bDF^^ZLrnF4l>m(v0er6OIBKD61Se{jO;od^t(*({_cop^i?gGsZXdN zx@hZ@HEVWm<3I~=|B0s;frGUO&it3ZtCGc3lqBplP)6BVcA&Tjjy**+Fb@oe(S2Aw z<{SW3Up!x6?ISIzh|TYn**lI1U?&$f%GFtW$Yh|2 z2Vu~BJVE==Ga4OXJtw6>)#9{ke|D3%SNviqNl5$7VHA9AE*l;i3oy}JG0@P2n%4Qq zM{cQ9k90Kd@3QFwB@4z*QDkXg-m(-aRnubS))vD#D!XM@a<``X zM^%Cgt9nrcREn?xHjKX^x~8#dFHRKCIt`L$9xOl(W8s^2X!Bwox;B#pGZxbO2YQ1{ zM4F=2Qj>2bm3f#W7b9L6p==X7nyWTjhx zKZ5-327&cp^~B=eks26NwD1yYPCkp&YvU_9XLnI!dLk^^{(fMzZo7-Qa<6y~`}!Pk z&G-j%1QYL@8{|T;uXR(ZLRh+4X56um$B3xy*xTXQlXwvmS@@XBacZ{Ev?Bz>yYSE0 z@A4iD3y7LNjnppJy^ACi)~_}*u}v8N-^r#lX^9WpHn6rr2;-RE!KRjOdnx9L5TDdA zbmccB@Pn&)^LW^A@Lpv)?Xu5$C?@cJ$DMD(Gp#tGpU0|l(a#rLfs99tJXm;WtV(Da z4y)RZhtBG2QNA#ebXX9=l?V_KNJDf(=_@+&HUtiRX$$9t%Gwsg7^+&)FH_4lIiRaw zO*$YdwRcXP|M#w@t>vkuojhB32|`E=N$EtSctdq%`gXJSSBi}b*t^D>+5Y&tqhL&N zJ~fvwd%Pnz(DwDq+l$*;VdvC7`F-Yygx(V)^m_Uo9Vpy`3LH*Ah==(?#7xAy*;enf zm)|akxC?=n27#x%Shqv8&cENjru}|)#21TdYBz69AOfN-CRdZuY2a7n%haLz{lxJ6 z%SuuXnM7f!+6XR?MTnFuryOtobiDmjT`nj@ao!}zz#q)J5`&b}ljjsPt0(w{1Cb=U&`3MlQhJBr;=G6ReWCU!Lf*{gW zvq@TY@5Fz#5F}cjIN%_Gdf5WzSTii&I)=R zm*ArTm)nGy^Ed^Xk4pdmuZ=GsU#qmL-tx|*oL<7rWaa+f_3I|X_1Ck1c)bl2zTr-F z+ynu3cVOAMsgUlSDGnHEE$wv5?&0KHl2C#_w1#v8F}3ihq|kgc=*>zDWxNO8=Vw#4 zqMY>DlaHCXcDN|viX(cIbVw>3N+baQlU5U+M(1iFlh0o(8v}HA878`yOetF649k31 z{T6b(s@c}bp12IYSrOYU!(B?_gCm(XT~o0sn|#a%MIY!Zg@W@v-%>3h;S*UVhPUrV z$6k|cS~ULgMWle^Nsb6s;ruy2=O#<WOgw}O1~aS$?J6W?Hl`bZQL>L`+Q-&^Z=14wi^Dh*u>ynt^60vFg5@{ zwjmS4n~x%n!zswZ93R?J=4ZKgtSNHw59EnmNS3wG05<#Xpst75@uhc%eAK7q{4HAT zF;vd=PA0Y2dT)~AnbCC8QL0y!qvf)eEOKl|ZU2_aOTtsXgcJrm-dC^&+Li62nmFSg z&nG|1SUCZ@d9UB&GWaWQBkwtPEewP&TIXqn>HV*-;uj)guws*Z^L`NiEu$okqUSB& zBFvWzw(4TO#uzrL8?7w1YT}j0IQ1N|hd;ps3oOUEsWI)4_I~lb5!m@qiC`ySN_QzD z-b;A#&OJPfm0=?pGmS@!C~X*%_{0s$VBd>Rz@rSIyw3FcSCi;LYHMwn;ZZH-mp9KHrleaso&F!^98a%-7_vcAPUJe9&ESs;YCGKr+DPEC5=ho zMN--9Y5l1+)uL#nI7XA8)}wA8OEIAo-fqohvjsmK{A))6na_TFl&9fz{-NNhU}fJ< z4w)4sD7KLeo3cN1$8PX(*NU7!8kiUMXZl_p{#P@evA){!9CA^hFt*FTS^@8k5TlkZ zvgDd{lM208+)b(qVqxWe2Yng+QgAt!p2OFN|HAF?gS^p+&vo7l44qaN;osp)TAZ6m z#VMR9rRV+w;pH$_RNri3VU9YRDEre|wV6`G%8B!)DU3l8{uW^%L85@ro+4y8IXG9) z;w#AdfFT?PsljxEaWsJX!|tpkTgV;?@}?&al~@z&2|!MSUchWF#!WHkeX^w>#t@6- z#U@}wq5Ydgs zt_Vr8kyo!UH?TZ1l><;hLv9a)3u*u-egnqHtOyB^hBF`)(Iy0|d9XKrmqTz9jOb&F*}Z_L z-y?PivgZhBz^LK8oB9=$cxY#4x1G|>>c&js41D67Z{Kt7AD96B6 zE17LFxU3tq8-DX+v6Krr7zsa_Do^b?-Cbr0)HHw&`d_kETJQx|f+6>R4C*Y7iC~UH zgE?$3OYcpVCXrJtILP{6UmH`8r0?2&@Ge&rbVLV%dHLta%e~SES$!G|avqp+M@5Xu z9<(t;=Q!VwMx%YxA2T?jonVG%{wDbWEnRs~uhp#&DoyA!RnPj{&G8*=Ohn0Q@o6yY z|CDg_8osiO=eIN!q>M()=ve^0-A3&`Qw6~^ZV4n#by9Ax;1()V_-P|lVr$Np{DDZX zBh0#d+pM3c3hkPc^Pwv%MsRDGeTWn%n@2QR{W0~y1Xo_C)8z$kPGVbjk&kuYw6uO1 zebw?7U?X_U;r&0Ih);)c6E(jst>SZQfZnUTGuWfdC|4mNVxRYz-=VaYSMM~TE$b7j;Un$f|bFU zA8lDUEc^HP9o1C))2(dM5!I@&k%-@yNoo}GCnUyE$K+$fef z9*3=JSXUV?nD_v7MeRP_Fu67_(KKLI)Uvns)K2GLxl0pJb7(UiTh zaFkHb9+`&WJ6xK6TqWc7!cGJ79;68l8NL!q5L;c`keMK;>>&U`EFrNAPa)HBRFtBd z3zWQgGYE{MRh^gxdG4=nut#@tC{y|nGN{MxMCrI9s%YQ~tU1C}fBUm*WwMA)S4D_D zpwJudZ0l^Wp!hH3TaRNFdN=UE08enLinHxU`qBo?h5Pz0%U5Kl!uVo+Y>!@WzL3>$ z?i6@eAh9p1Yya;Kf2~+j=^z<;68W3BDOq*(O2X;_tu*>^o= zC$etEAKxpq19MC!ai5qSr=LzF0nZd7YM9!nQ#uOOAGTS< z*sTO1?f^EBuS3aF z)6=@cc4&Z$7&~+Ysqf*N3*k3R!iZ;G=k|*FdG4<}CY?%@imC3yN|}*@ zo41$oz4712IdpC2Z$7N=qsZWZ91S|g(;Qhn$Rxb66`U{eH^@{qgRi$2Dnz~UPO~$x@-&7LBHex)5R`H zL|Z@|brHGxv_;=_sZo7{J5yxy`kOnwOs1j}YOK0j7ay4n9tx04ra!OEDjVVFq~|FY zw-T49a{%(cDPeLrDScS4d)J(5H9!d=E}?)&K5_bjQ%S_oFxe)o1F8BlNb}L$Pr*>_ z*?6~l&pgycl?DlqbF*t4s{=GF^REa9j*MLjxQwk(Chh$fA^%&9s_~Oplaor`#GshW z0K`JIO@{Ai{ELt+e==>UBguGf8p49R!I4~-q#E_B9xmxVZwS3~E2f7hRroKsIrB3( zAc_@wYhE>*q?F7`>s?gr3Vywd7aK!w;lTe-@`A&a)jde*{wRTPa1xTHW6EZ=^InA_ zA9_SXiSSwljePjvF#n?(=h95@Hh5=OE#gcsrFM1>fxpM~zHEbmZP35#Y3=bLmZ)>D(H#FEju_}HIOFMp|LIj2f&xFsZ;#mSF{EXq z%P$2MO29z%g<_SZNg`^>WCs zu>J^{n^C!O&*7~ z(jp)ZLD6SETffH+be`{m;@(BeQ|hD({Bk}HuzeWXS507rbmY=GnX{exE`D^jxx7E; zqkuSr-GkGkKk${gSUaDpc*{ueDspH6y4H^>)9_q46n$*Gsl$ zNol0=BPlz2SAQ<4BRdy$8PF~pB@@3LN`+l&2=j`xRHjMakDJ3=NOTE<399!I1M_*l zdK7;;gR?raGS_To;wXvDyI!%e(KLY~i>1OUX!a3@?wliLAj}}g?swAtg$Av^h`&E& zwKZhZZ0E{N&Cj;Ie*PafQwxWt9fvnPMLx?G%=hpFPtYUv#a zf1kBWeU_x?`RYRk&lR~wD8TG~(&Pi3K6>zyF%+dzRcePAcOVcWU#SMDTKv00)?XV~ zZY_3JHqRzf6wbTTn=_7DNy+-4l|DX15T}O%Eoz(;jGAc8le_3?%P76!+2jPIYcbB^ z#Zda#Qc;obR^xrdXZXj+AUqI;7H*XUGze$b`l>)zav(nv0F{yN2MH4vpaRc&zJxs| zSG^Dj`yNORxCp}Vr5Z*hAE3T5zbSSRZBPdL!crSRU!MVDvUTmH8eA(6+Uc_D>>5Nj z@(u&aZU^I!;MTsxxZ+>;?Df+~4C>#t*C(pr%J23;@ZctTP1s6R;=l^v)of}zS=LnA z8M15nGtJM5?QgqQ5kJ@{W~LNsmLbtZA;D~bd4w^Qm35`3IKB}QG$lJ0Bk?b$A2-~M zIbanjX(7YwmKe6S7wnGULxlxuV+tuU1OH6QcKWHZ(74xGCPB7SI#pfe?o>$ zYzHY*^`6w%4%r-R(rEh#lt`*K(t8_0!Ozh;ODO>bK3TT}IUfQC4OJNUo?9rY724-M zhF@QWxX2wlww61T*X&~iPD3Zy=&`Yn>>9TI{mz}jJytgYXDx0$64{V(^h(x({(Ep$ zNftEzV^y^6)m?TIoCh_T(Ge8nb})^ZNdQx8GwlJJU{VmQuH0i&1E zhMFwFkAlGa+PsH=cp2avfdCW_;m3u{yA(rJ?f&FKu7A29QMMzL{?$#fl=EJbGKNxQ zby8j3j z8x4VaYI%Js_5i|Z4I0UW5L(DMm<||7zXt${jdlTo7I2ZLYiDACzKU>E^#dRT5iJ|D(liT;F#tju z>Fglc#M(o{$^gaDMs2Du!wFgjPv3NqUEso6!0hNZ?_>tj($nu4bNIf_aqH{fn0Z<|WaKfp;A)-Ni zlbDXSD!{xQi3&hfPSU@ledqm;JDENt>vqx9ZE1Q^2*k~egSCoXgXsQgaEH-kG^um( zIF$H1VVvekN{xDvYpnUCHZL%}O46^bj~-^I`r*TJ8QNcdOcqtk8klxz0kM+m#s)3B z>5(OR_&HFNL<_GB#O(lwPvfa2_jaZ)jybkV!(P_(Rl43yHiqP$m|b>EU}3-g+!7@Ag&R?D7v^%)E_Fy-4~n<072`7mQi+PRRUPBkfX8h&3wBhuSx-C0NTe zX=$s3AMPlY$nMM6^N=`f0rciM(F{*y!;}aS@k?y*#;^t~~At6_iYz zT|!>^aYJ$uBC9c@HGhh)sI#C6>o{DG;vkSIK9>9e@g4YfPdyrcoN=QS)GhmJp1p>R zfrmSws_Z;+h9x=~O2rWARr=qzg!w0DG&eaFl3`hT&#npaI7^~b$@g43ghHZ)V0m-44hBVlxtunfHwn#!Fb_rh%5KDbRaT4{Rq?=fR8M!R%MxMb&t;bt<9ci^ z&>*Qa|5iuA+x*nRI7&PE$}IdLegLlzTPGA_3m!Y^J~PA?WlL1SE0LST<3O25SVEA# zV;M|NFCJ_c(gqjUx*R!zhG81+Dnd(gpwB45{hY4uwu>K1^48mnO7aI1gLS&}YcI&$ z3)9c!eOc}ra!OO~zXrPlWDro(w1MFGIUDFztU9HI=hW+6 z69tXn26m(@`WYo9WlRYk@ndaP9ZV~tFoyvV1~PYF;;Py35WORmd64@MD}tL!oIS;? z5l>AL=5FM_as{~#unfSyV9Hh~jRk4H2TTXuZlr;a_=*_nS|E|JHYy#ZRp42rQpqDq zpu($2QI7=J?VdNw+~H1?hF^3cIzeIcvBx}JV(hCxd`o+sUie@BaEQqzre=am z(xw-WA@EI%v}bvGS{|#TPZzYeGeGcgaJ7Ah?}iPe&;QGiB!dXLR*f1Uj?v@xiBCt4 z80`1sLutMn!TL$ITVo5tA?f{t<+?qfsgn>&Zg#H55H#J(Ca=u@9H%wIi%5MMDAjT( zl)nwc(>Q@()%lbv?88yog@#7XNzI4+DUtvVnWYq5HnMYHA82xD(92EgwJKfCK>gPP=EsFjMx0@?WwRs zUho5Mt%(M@O=kaW;FdX2`e-q0Qlvt#wr#Rf2(kDY^&m00D?GZ^su^_A%O!u*zQFJS z1g`w{;{io#;(1^(f1CAIFV5p`Ek8WK3PGI4;AGpyQ~uunk~c^6P^|8KWc{du4rUgh zcHItcMjTO|y2e2D)t-L>@_u+8ZN50`F40nW>z(k3?n__wC)52($tZNj$anap(yy&T zs6ukr=pERd$V?Ye&h{`Lo2sT!o{cN2#Ct$4f!Fi{6Bft?-HZwTf0ItMGoH~B2X0N) zIn13(7e8bfE1@f(vSXXj_#=9{&X@DNX(=O}ZUMkWb;78Wm7QW>t9AR2T$%;oE|e*E zazxD8SEysVpyu9N=Tq=Jg8PL=f%(7{4$pauOzq?`%T0;h4?eyrs$O_mOS2 zqc}&QJ$8LEs-egq7Fdj91_t&CL*)pQDths=oFcR#J52oP@DWOxH4c*9vJ z=9~%C;5-K|hH8fmJ1FR8Uj&gAg^C;2;dpO;kGU|OS0?cNT*!)B9xh?vkiNvFh<$;H z9NpN=bW^JHtzFn9STT9v!7vzBh&f6EwrkaE+Wqe^A2`N3yjQEd54LMlYmK*%8L{H3 z_u%p7?Ctf}|L;u9ctN9wFD^a0!Ee}fB{s|zMWR~>SvFl3`+DS%%GJSZu z9yT>(tk=2@hAheOCC*az{{Sz&MoY4!GZTp?otql5Ok3RJ^RcKd;c`HT)19RRFUL> zyQMXkkUe{`b?h}h6spQM#DJz{MDErluS<&qT=OUB>+p16LVP9sJ#<& ziOa$VtKt9TbXxfj_X!^QGs<`2CzB|c{SN>MTfhJ;#JBdm5+oU6Q3hu-Mxs|LDp4Lr~$PhmuU#y=P{g63D+wd0UR#5+&|Z z?i?fTOCw4$-h8YW)d{Rf6VR{rIMk))`-E2S8G^NWY`M53ljuk-{Hpc76!HH{o(EhDa{{TPJIU577_x$}Gh zU$}`@20L#w2bd~OjO)2Kjyfv1RTIivV(BoiyVVw2 zgbd(Yqz9CLqRTrPQ+&AeI@M)W&C>t#q62)!?jRgAul;lgq}%f2pR0UXL}5d!O;{P8 z;zJm8G8N75Ws(=^web%H?(ouc+m~AokpB;+uj~8WEsj>IISJrS(Wm0aA+jGw44S;R zwz1|k~G#h<(?Rby6M=zn9WPSG++A8Nt=`#tb zo75lN7oNma46DGxOk=V{3aCQsQ588|Cy6Ll4OSqlzSoMLEjxLV4bvfnNK=OUFsQD$ zVuga8+K7hS0(A8!?j5b^&(`Fs9p?0;^;+lj$@QE+AYo?(CeB!#>K9GMDdJc79%Byg9BGMK z0RU85^2j&Hvfi=xoBAMI;bi3{FUx{W__1Cs(SlWMv)B=RO}=fjIbsQ4sX6imOXB_a zE7_s*dFn+m)`LRiQ0I9i8*p~=kex2D>$nBs7elMo{YP_r)`Lc(vaxC)lw{3(`+z(; zU4q`ytFt8efHTw_nNBQ}0&LV4G;Q4-Y`L(w&jQi@Y-8;l9ayiEcw(UfbdHgPB7`Er;2M$N{7;pTRju@ z=LvJqT5O3zuqT#}K-;)WdvHvEDL#$L+vH5CoHYL?dO&pYpt`-=(dFx>u}bJT)S8Z+ z0-K^pVtbKDmrjS^qkYo3`lgZ?`R5j^JYb`2aUbX;)0)&brN|&VW^xQ2QOp{B?$VSJZH)YBUY#BX~`}TFIYbECe>; z_>+mwoLvAB)mJv^@r~4XaHGnHSQ;>_oOj5x&Fo5U=|&&0W`GgjPld!iQOVk~9}U^8 zp=uqo+bOp*dhM$|beZ|Xy508~Kqn>SZVwqXj9J{CmHYevAU@u|1XCtaG{{?`I@K95 zc<)E)r<(Iz<#PjJBgY7eTTpc8*BZWh%G0>U(&90rliC}2FcHEf)(WAe3%vPgxKKns1#vQ~8BBCIof@W~WA(o{@hZj~-ydw>7 zUDnLLuvifAAGp`MVGGX1rwVwiJA_{LO8b}%@7N_{byM(DeQWfuvq&VnQ~8TrZLI@g z;afM(&K|01Y2kaJPbw4L!8<m5{8Kg%%ffw^_5D&5%EYCLl)?i>^l;^Rr*L#u`GUW89^ z7a!h(EI=m$mXE4%cH*%UjD907w6=L`v+7vUH?<)+TTh=rb37wxs0rw4j5ocZy*Xsa zOYM1-qSMW9XS?TU+wJ6H=ddb$x8oenUifni0t@e{YkRQUoAFL%%w;IxH~u2us?nl= z=U#tVU)>TYERM<5@2XpXyF^n2aIdwKm?8Q9vB13HY2rBBJHnv-#0SYc0M!$y^={+( zVx{RYWOIX37d}$;CU^oPKf?!Swj)2t%i7%P;`~pSL3$*f{+q^h>Jsd5ln29^aq{Xs z1=ix}eJ;sTs0%WZw$3)SVt*fdbABfVhr?1JV=~ z$%vaQ&Pykcau6BTY1%PpJ4a~{;yNgfx=w^YdfObX;{W(6UeYD!9h#6`Yu`=f+wsha zWcOQF?`blXph6SQ^TsH_fKZ7>*yrdTbpf+1{mAl#|4trJ0>kk`%#>+-$GZ>D=5=hOoy_x0(jcJ>`G^4bRSZF8h&u zLN_s13@^U8rMk9K%v=tTJUOON7~oZq<%bvt^BWra%Na|r6cWBJ3ru*`z53InoS$@5vw-FcoisS3F4V zfxv>xpa4#BxL1(MqgEfgPAulRx6S*gAz%1-)KnO%bRc+;9~5@<#zaeIss#!+?;kBE za9@{IXc0ufUIB(|L4c^uBmFLI0wbQEk`#u5TCJQUgpM3>^Y&M(9A_+*iTM$_kD#^H zxw*eQ`?CjW^>EXTRd$eYKGsbJ&-76+=X$3|M-1~0U7SLr7;nF3$??Mmr9cjlBQ+sl z+a`<~9g4gmTDV0z^db8qPL0l5n~Wy(F%Jxfe1reHwX2MAzbJ9m1bXIpgxVa#buLJs zYqmmX2lCRggiJ*gtYusiLtC4Gv_2WP%+^n{G*GhQp{|Z&AOC_V-i?&V7nX=Fc0d&n zdY5i9D82!6i}8RsL|B5oQT;pBPSK0IC8$C?@7EwikfZYBF2*j&N?$Ggw7okYJ;@yz z@jj#tLWmwY3>LQLly{YTg3VLy27w+7%d~M?_AqV@g>;|F zDhqGE^)^#zqhF&4Q59LO=7`T1QciIf{hbK#7tAXrub>%CU=W5zZb5MUvr0UOSvNO6 zWFUu%Om?iIOT*)CK&|5lB&8O8p9hPT$spAb6O4a|a_y2Bmj$a}ap5QW_Zd(1I-E>C zQGbFZC!BfZq3WfX_E>+EqeykIfv;a$losjrsmC7+n!2XELP3nb)`WWg7?4DOW=uGa zjt#?R-xF0d0zgn>YQB?Yduej<+DTS61A~VCsd?ymMGrR zNZ-8SAi{>EDZTPKkpf6M@{ys=(UI%&(}UqpB`u+tvZOvS`v&I__?zlc2pnRMV4G&k zSI7-Cj(3UOpcslp^DLOjnH`F&Z+uydd!<5FORI3@Ji?d zl)(Rps-|vO%?qj#QZtewFLeQ~X7=9BgZaVij)aU<(SJ&Vu6Mk{`RDY*r%Zb~KZ8K* z8kPHplzoKni{~htpde`zbUN?uWT$PGE1NQFbk_!=M}xYqqVOtIbQpSEPAOC7z1PMY z>)NCT03+a~k0SSs!m?T_Q)DDU(KBuH_?h1!qc#)ye;QGSnEp~44yM!0#27c10zM_3d8 zy>^DMK)=-f%Mc0%m|8rh{NKyIV=>+MsiwermcW0*Un(J{1oh)`Bf-qYWAnMM91Ac$ zVudXeF2002$&Qx}g#8m0^fUnW=@a%m=S9NY_{kd96DgG3_#Y4e629C6*$j3)NARmh z%qGKjEuQxq9$6>`8gOiees=1Z3aM8%62+(Zhs8p)183}E`rBNzO+UfYOA3ozm7I%^ z?rrxdFcJoFI5=mA1d&(5fTC5-9V>+{E(?A>w z3zO`yBU6GkTQ~3!{T9c|KQ0w%qaBJ39)~RJB&yQO5n@5Yg@!2skpoVj50O||9pbW- z_68d9+Q-d4^DC&gUuK~oIqb0rq?RbPb>l{y+Q)n)i`{(mm5m{in4SA*Bk%k6*c9$% zTMu1778WWTOdSu-D|i31)YS|<45ONgUGi8#`|q6l3T6n!^+&_*cpse4>%Cgf<3 zQvRz>Wk)l1FA`ZuL*Ym{{f2W&n)OoH;QppH=jm6E5jTUv11A|cv&7#tMX!qKVih3;AFpg`HTTqqe)`WVz4*c^1UkZ zRp;uY{!Pp^N^{dcPdp9Y=4)hJbX5%JY$8(cKN!a{%GscqoA=S|P0fZ@9JJf`r^HmU z;-f!=K|=dLE5rzRli~mF))5U(xU85hb1`9SnQKyzMaz2&;sSOsW23!i*;`R2D0m8+ z6>B#~h(Srq$j4slMw6PU6+iHK+X1s@F|zq9~c3$lnS<6ioKZMu<{B7-RfBx$x{LqoZkl8FmgKUFR{ya0%uxbgOqrsXs)4WD18Uq>$ zBYDj6clGE|on>6C4k4Y)9^JH!(kR*D=#bWKY_rm$H! z2+L9?VDhcpn_W5!&rY*rZ!tarrsc-^%9ifJ2I$18;X0rn4t8y=#gmPNUn!j#dFsBVjv-s_ND? z-ww}kT$qRj(WU77jJ_@EdXwZ14~Usb@{tr~kbP6Vkjl}lR%osG&tDSJfABL*oU1=B z3sRq>voq6ui*Oxl?;Ruy8Rlqx-txO!Ef~+r%izv}aZyfH z;w?FxF({1FkM5fKT@3!S2@SmfQ(p!I~d~*#p1PVykY)Qkzr%*Jrg&( zV02sH`HHqd^tRG->!y)h(-&}9{>iZ?mX|Xe*4`fsmmh{lJ$ZA-si+8N> z5~~+M?80H+elkj5TwEUsfKCJJm*bxgM2h!ViD~P?2@^Y8^4IY^UDM{!$S)0b?Tf8! zv4PCYAEwFqqjd(jLeBn~upoXa?`xNsnh0Y&&j%!Dl?0hY26`=qgk{H1mUa~|eBl^A zgRKhEj<24U*Kd-*aw(rm;9le7mMYx&`72XO*n0ac>bj zc}3B%0S)qDK!*$5^f6gv2gnd&hL;veDIFy_JxdV!WJTEh*Aa4!fVdO#7@|1z4n}X_ zjcG;QR-#*_)|dQTic&OiTr<|*w9^{JpvT<+6UQwT25<*-gGFiDM&Pp~)*0QpEdf9h zDys2{rFK>TmKFdxAG6B0K(qQfe>n}m$4lsBCvmDEP-P!#s71v z$ENSo=ZV2x01H3*pvwC>1qwcihoe)65w9Q1p000m8v9pj( z6f7ySH+?S_+#5MHM_`Kp>JDKg>tjeCl%R0NKYxSM83aD-AZGZFhl#1sd?RmI5!DsD z)S^4o!p)To3n$7S@B~fl2pg^_;hW$MGsDjDdFw!qPg*!>>kbK6Eo_2(`q8G$| zklX9=-2b7_kJ`PQk#C6*1e*@+ZIwq{$LactY`^~wla{nzSn=1isb%AfOehBqx)3dN z5ZXf2QqjjyAg_4}ohPcy{Fv*pWy87IH9!+H{s@69rN#$||33eyzsMeMwzB-x*?Q!E z2mK-;%6GpLyvB-VxAvQsw(1BaCwxUBW{b>o_`;F&;k z>g+}2k8l5;4pJwC!aEz0qNl**%F3E0f9#8C!A*fOhq<}``@deVq*L8%hxD1T2>iC~ zNOTIy1P?${`r@%$OiMOn+WqIua7(Lzx^PS)r7+(p1Bf`dz%htSm>jTja>hfZ^C-D7 zjL7R5P)76InJh-(f@uy%&kBd!+^*GP71jR}^g8Yymu|{eP{{3ji~8j+Z3%a=*zRwp zR>1;45%M5h(hMgRi(77D;tY=4?I~F{3U&D3=JW-n)Ss;q3YM3;p5+Staj8e{RU(2L9tZ{4WVGe)3H9h$!pp9 z0p_Um73a5q3V4h#R9H~EFw@=!_kHZisC|n=oV|+6(64_kNt%uYH2XUkv$VacQ z`fjW^_N02L2#XC>zQNaGVTpl`hn1}3bu`qq<}BDD!a&YxHkV_+Z?9yrP~-!c-C5aP z^`OZ>uH6%HuL?I#7jZqQ@Sp-TgXkwV$d9uzd@(9(%5piIX(W;vi+B-+0`K56Y222n zR_qDYxO04VvcJV!KGotq_mP*54<3a!AIU_cwSl`bQr~I>Q`1kS2_+->CK-)o3Qc1EdF_l_wjpJb4aQ-~_Iq_{k}?ZnT!BtT zVZk;hVW&!P958zP%i)CQw3xL(!k+1QOc%s%i38gut7jaNbs0Qg(& z4Rv({9ZiAvNPqFGtvM{}tJqZlsQIk)`)>dW6h}%DBeKboosJIqgx7T&8kV>Fr9YRn z`Fnj1kn*i`+Lbpl7sRW|GoOJy_t8$!{tW*^Lyeih# zalCNNQA)QjWU+kZl@+9QVB)*>AyRkUA-2h&3#bV*c0MDV0sxZgQ%h-?!e;@+k^YBPqARNb*@o53lK6G6RW$JW`_++O zZB73~0r&|A_S#SMX#^P(WJPmaLB@L%$AC;euC=%L80YK9NAD?g!^Eh7#X9@74mnbl zEVnCE(GG)j25>%g8@KG5U2B28)FHly=d#3$FgL2sTyud@$ca zD?dh*i(ndiYc(kA4?ssoQBW|Yu2OrQTp0DD&2>N|mrt$61x6z4JQD<<&*?eBrz4qp z)BXuPXcrBUmWlo>b%pymM*>vS1$P)i%RIakNsDI>TUAe}i7&}&J3>xFV|p1t^;W#L z(yo0eH8^2po^wX7FkokpYHu~U#m6;sbvDF9vcf6|zM>^G?8^W6_vPgxSaYj-oEjOR zr~w4Zl-|e$c51vQ^qs@ic=%KsKyL%}_W4N6I1mXW(@!#)OajFMlKHPCUCDJ392*L~eM5wH#En z2*;+XmK~5>NGn7TQ{9|3hn6f67!Vg-NLfKo!JjJEw;z6r)HlIb=8 ztnI}_Q6n0J1Wu>Os7U_2OzaOgbdemGl+F(rPk9ufy671&l3~E(uBKP8u{sC&IOFh( z)Dl~a`qV4zW+qkA62pDZIIO!wo&nN$3EiSrENLEFv5eSdkphs29<&C|jRxLG9{HBt zIxE*zH218#BL8GIdwo)nhcwqWmf8D8l1Ban4xuK|HbCkc-+k=d?87|Xcu3Zb8q;k? zmQMsvaDsbfZXp`54~(7r)kI zZ0b}f&mBI{vbEq4X;W{Z-gnkcAh;);SnyBhK*^YAd5|mVT7$f?aEMKDDGxuRpMxtr zr;JpP(}KFP3! zI6%uYb%vp7Wnu?p5=FT3onX3`!LicCX=Tn&AWa*t;*JYZwzV&_)mg_CnErQymOX!c%?u9@MsX%Y?j z&qQO_qP@R6CH2;EobT4kQQ}}9r(L0Se<%-B$4?HqZz_821R|h%Qlu{XrSzfP&~Y&O zBg8Nl?-bJ}SHCX9gIQ-SH4vq-|McF$`gh#C_4Qk2q4UE+5fRhWV%l@sebVXDZ{iP7 z%E;3bYbYB7$&&YtN1(zmN_K(pwjZ#LWyLCb&_iunm`$}0X>arf@ZaM8`y5wr@H=XWkcS6zWtz|tTcxKJYjesijALgBdHy@24?ZpXo{ab z#?M&V6~p@7J!e;5d;@p)*CzT3tu)Qz*QWyyUcmBCVn?mjRMkZA0AqeqNj+nKG;rxAl155o%p zNKgWfr?73FzjJ13(H;9GM+ZR?t%zG#{hyS`nfr39lHPsad{DHyRY8Q;RO>q)NABFc zUMA?+Il##eH%K>@UG~|tYZrGQXuI&2`MGf8Q+&ZK@gq4=D*#51WaDBmqK>cHa<;ne zO!NjLk~Zpv02V+I4y%4S`h2wb>ohV-%{+LC)f16FXO@x#XES9F-O9k0CP8Sh95`U#m{@dbBytdWG+^1>FhDEb|No{DZoKC$I#i#W%j`S zu@2N`0|QJQU(TDnz=0|93fE-*9%t^3sFU3&Z(lNdy05L*_MaI6@OT7DDw>LoqIJIa z@Az$hUT2S`(>-sI&}6*YFN5?-VH(1XDo%;Ocua(X*8)h9{EL;rlfpii%R{_@X2M`0gV(6-!{$eGlds{vU_z5EuZVuwNYAf|WhE@(mZ&x)A?r|ufE!#x`~ zYK`f0t7iEt#RP1M!2Z|asRfFkMe91+5#5gZ|h@X!ze%NHInK^-N#zpOBV$q|KJv zq@K6~peWPfgY{9{*>@GVKYp