From e3a2e227a3cf0b13988142b4510d1eab60d25855 Mon Sep 17 00:00:00 2001 From: jbautista Date: Tue, 11 Aug 2026 15:01:55 -0500 Subject: [PATCH] Bloodhound v2: cost-guard scanner, /guard control plane, and PR #2 CI/CD integration Single squashed change promoting the full v2 line to main (was v1 from 2024-06): - Modular scanner + Slack reporting + whitelist + safe teardown. - Slack commands: /seek, /seek_cost, /seek_whitelist, /seek_destroy (+/v2_seek_destroy), /guard (service allow/deny, e.g. Bedrock, + group membership), /v2_seek_destroy_plan. - README rewritten to lead with the command reference + deploy; GUARD_* env vars documented. - Integrates PR #2 (mmccla1n): CI/CD workflows, OIDC/build/smoke scripts, Slack app manifest, operational docs, and handlers/services modules (present, unwired; flat worker canonical). Verified: /guard intact, cold-start imports clean, compileall passes, all modules import. Deferred (feature work, see docs/INTEGRATION_PR2_NOTES.md): /v2_status wiring, scheduled path. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/bloodhound_ops.yml | 343 +++++ .github/workflows/invoke_lambda.yml | 245 +++- .gitignore | 98 ++ FEATURES.md | 305 +++++ README.md | 399 +++--- assets/bloodhound_lambda_architecture_v2.svg | 211 +++ bloodhound.py | 94 -- bloodhound/__init__.py | 5 + bloodhound/app.py | 304 +++++ bloodhound/attribution.py | 103 ++ bloodhound/aws.py | 38 + bloodhound/budget.py | 208 +++ bloodhound/config.py | 242 ++++ bloodhound/controls.py | 329 +++++ bloodhound/costs.py | 240 ++++ bloodhound/guard.py | 536 ++++++++ bloodhound/handlers/__init__.py | 0 bloodhound/handlers/scheduled_handler.py | 42 + bloodhound/handlers/slack_handler.py | 60 + bloodhound/handlers/validation_handler.py | 66 + bloodhound/messages.py | 631 +++++++++ bloodhound/report_format.py | 108 ++ bloodhound/scanner/__init__.py | 7 + bloodhound/scanner/ec2.py | 210 +++ bloodhound/scanner/elbv2.py | 69 + bloodhound/scanner/rds.py | 80 ++ bloodhound/scanner/regions.py | 39 + bloodhound/scanner/scan_all.py | 46 + bloodhound/services/budget_service.py | 74 ++ bloodhound/services/scan_service.py | 121 ++ bloodhound/services/status_service.py | 98 ++ bloodhound/services/teardown_service.py | 264 ++++ bloodhound/slack.py | 75 ++ bloodhound/slack_commands.py | 250 ++++ bloodhound/tables.py | 23 + bloodhound/teardown/__init__.py | 6 + bloodhound/teardown/executor.py | 130 ++ bloodhound/teardown/planner.py | 49 + bloodhound/types.py | 36 + bloodhound/whitelist.py | 76 ++ docs/INTEGRATION_PR2_NOTES.md | 79 ++ docs/SLACK_SETUP.md | 326 +++++ docs/architecture_overview.md | 122 ++ docs/bloodhound_v2_plan.md | 495 +++++++ docs/configuration_system.md | 298 +++++ docs/demo/cloudwatch_log_navigation.pdf | Bin 0 -> 454865 bytes docs/demo/teardown_validation_workflow.pdf | Bin 0 -> 99959 bytes docs/demo_build.sh | 175 +++ docs/future_improvements.md | 475 +++++++ docs/github_actions.md | 326 +++++ docs/images/cloudwatch_logs.png | Bin 0 -> 119221 bytes .../github_actions_invoke_lambda_scan.png | Bin 0 -> 122014 bytes docs/images/github_actions_manual_ops.png | Bin 0 -> 163639 bytes docs/images/slack_command_preview.png | Bin 0 -> 56723 bytes docs/lambda_packaging.md | 638 +++++++++ docs/quick_demo.md | 1175 +++++++++++++++++ docs/run_validation.md | 359 +++++ docs/safe_operations.md | 304 +++++ docs/slack_and_lambda_validation.md | 701 ++++++++++ docs/slack_app_operations.md | 40 + docs/troubleshooting_slack_commands.md | 493 +++++++ docs/troubleshooting_terraform_lambda.md | 717 ++++++++++ docs/validate_teardown.md | 459 +++++++ env | 75 ++ env.example | 139 ++ handlers/__init__.py | 8 + handlers/lambda_function.py | 123 ++ infra/.terraform.lock.hcl | 45 + infra/README.md | 657 +++++++++ infra/account_guard.tf | 17 + infra/alias.tf | 23 + infra/bootstrap_imports.sh | 91 ++ infra/build.tf | 126 ++ infra/function_url.tf | 44 + infra/iam.tf | 128 ++ infra/lambda.tf | 73 + infra/locals.tf | 15 + infra/main.tf | 23 + infra/outputs.tf | 19 + infra/providers.tf | 13 + infra/slack/README.md | 245 ++++ infra/slack/bloodhound_v2_manifest.json | 73 + infra/terraform.tfvars.example | 59 + infra/test_resource.tf | 81 ++ infra/variables.tf | 150 +++ logs/validation_history.log | 15 + output.txt | 1 + requirements-dev.txt | 9 + requirements.txt | 7 - scripts/bootstrap_github_oidc.sh | 365 +++++ scripts/build_lambda.sh | 193 +++ test_event.json | 1 - tools/run_local.py | 41 + tools/run_validation_workflow.sh | 103 ++ tools/show_validation_history.sh | 25 + tools/smoke_test_lambda.sh | 272 ++++ tools/test_event.json | 3 + tools/trust-policy.json | 14 + tools/validate_teardown.sh | 680 ++++++++++ trust-policy.json | 13 - 100 files changed, 17065 insertions(+), 346 deletions(-) create mode 100644 .github/workflows/bloodhound_ops.yml create mode 100644 .gitignore create mode 100644 FEATURES.md create mode 100644 assets/bloodhound_lambda_architecture_v2.svg delete mode 100755 bloodhound.py create mode 100644 bloodhound/__init__.py create mode 100644 bloodhound/app.py create mode 100644 bloodhound/attribution.py create mode 100644 bloodhound/aws.py create mode 100644 bloodhound/budget.py create mode 100644 bloodhound/config.py create mode 100644 bloodhound/controls.py create mode 100644 bloodhound/costs.py create mode 100644 bloodhound/guard.py create mode 100644 bloodhound/handlers/__init__.py create mode 100644 bloodhound/handlers/scheduled_handler.py create mode 100644 bloodhound/handlers/slack_handler.py create mode 100644 bloodhound/handlers/validation_handler.py create mode 100644 bloodhound/messages.py create mode 100644 bloodhound/report_format.py create mode 100644 bloodhound/scanner/__init__.py create mode 100644 bloodhound/scanner/ec2.py create mode 100644 bloodhound/scanner/elbv2.py create mode 100644 bloodhound/scanner/rds.py create mode 100644 bloodhound/scanner/regions.py create mode 100644 bloodhound/scanner/scan_all.py create mode 100644 bloodhound/services/budget_service.py create mode 100644 bloodhound/services/scan_service.py create mode 100644 bloodhound/services/status_service.py create mode 100644 bloodhound/services/teardown_service.py create mode 100644 bloodhound/slack.py create mode 100644 bloodhound/slack_commands.py create mode 100644 bloodhound/tables.py create mode 100644 bloodhound/teardown/__init__.py create mode 100644 bloodhound/teardown/executor.py create mode 100644 bloodhound/teardown/planner.py create mode 100644 bloodhound/types.py create mode 100644 bloodhound/whitelist.py create mode 100644 docs/INTEGRATION_PR2_NOTES.md create mode 100644 docs/SLACK_SETUP.md create mode 100644 docs/architecture_overview.md create mode 100644 docs/bloodhound_v2_plan.md create mode 100644 docs/configuration_system.md create mode 100644 docs/demo/cloudwatch_log_navigation.pdf create mode 100644 docs/demo/teardown_validation_workflow.pdf create mode 100644 docs/demo_build.sh create mode 100644 docs/future_improvements.md create mode 100644 docs/github_actions.md create mode 100644 docs/images/cloudwatch_logs.png create mode 100644 docs/images/github_actions_invoke_lambda_scan.png create mode 100644 docs/images/github_actions_manual_ops.png create mode 100644 docs/images/slack_command_preview.png create mode 100644 docs/lambda_packaging.md create mode 100644 docs/quick_demo.md create mode 100644 docs/run_validation.md create mode 100644 docs/safe_operations.md create mode 100644 docs/slack_and_lambda_validation.md create mode 100644 docs/slack_app_operations.md create mode 100644 docs/troubleshooting_slack_commands.md create mode 100644 docs/troubleshooting_terraform_lambda.md create mode 100644 docs/validate_teardown.md create mode 100644 env create mode 100644 env.example create mode 100644 handlers/__init__.py create mode 100644 handlers/lambda_function.py create mode 100644 infra/.terraform.lock.hcl create mode 100644 infra/README.md create mode 100644 infra/account_guard.tf create mode 100644 infra/alias.tf create mode 100755 infra/bootstrap_imports.sh create mode 100644 infra/build.tf create mode 100644 infra/function_url.tf create mode 100644 infra/iam.tf create mode 100644 infra/lambda.tf create mode 100644 infra/locals.tf create mode 100644 infra/main.tf create mode 100644 infra/outputs.tf create mode 100644 infra/providers.tf create mode 100644 infra/slack/README.md create mode 100644 infra/slack/bloodhound_v2_manifest.json create mode 100644 infra/terraform.tfvars.example create mode 100644 infra/test_resource.tf create mode 100644 infra/variables.tf create mode 100644 logs/validation_history.log create mode 100644 output.txt create mode 100644 requirements-dev.txt create mode 100755 scripts/bootstrap_github_oidc.sh create mode 100755 scripts/build_lambda.sh delete mode 100644 test_event.json create mode 100644 tools/run_local.py create mode 100755 tools/run_validation_workflow.sh create mode 100755 tools/show_validation_history.sh create mode 100755 tools/smoke_test_lambda.sh create mode 100644 tools/test_event.json create mode 100644 tools/trust-policy.json create mode 100755 tools/validate_teardown.sh delete mode 100644 trust-policy.json diff --git a/.github/workflows/bloodhound_ops.yml b/.github/workflows/bloodhound_ops.yml new file mode 100644 index 0000000..841cb4e --- /dev/null +++ b/.github/workflows/bloodhound_ops.yml @@ -0,0 +1,343 @@ +name: Bloodhound Operations +run-name: Bloodhound Operations — ${{ github.event.inputs.mode }} + +# ------------------------------------------------------------ +# Manual Bloodhound operations workflow +# +# This workflow lets an operator manually run Bloodhound +# tasks from the GitHub Actions UI. +# +# Available operations: +# scan → run infrastructure scan immediately +# validation → check configuration +# status → quick system health check +# validate_scheduler → simulate scheduled EventBridge execution (debug only) +# +# NOTE: +# validate_scheduler is a controlled validation mode used to +# test the scheduled Lambda execution path without relying +# on cron or EventBridge triggers. +# ------------------------------------------------------------ + +permissions: + id-token: write + contents: read + + +# ------------------------------------------------------------ +# Concurrency Guard +# +# Prevents multiple Bloodhound scans running at the same time. +# +# Example: +# scheduled scan running +# operator triggers manual scan +# +# → GitHub will queue the second run instead of running both. +# ------------------------------------------------------------ +concurrency: + group: bloodhound-scan + cancel-in-progress: false + + +on: + + # ------------------------------------------------------- + # Manual trigger from GitHub Actions UI + # ------------------------------------------------------- + workflow_dispatch: + inputs: + mode: + description: "Bloodhound operation" + required: true + default: "status" + type: choice + options: + - scan + # ------------------------------------------------------- + # NOTE: + # Validation workflow is temporarily disabled in CI. + # + # The validation pipeline provisions disposable Terraform + # infrastructure and performs controlled teardown tests. + # + # This workflow currently runs correctly in local + # environments but requires additional CI hardening + # (Terraform variable injection and account guard handling). + # + # The implementation remains in this workflow and will be + # re-enabled prior to GA once the CI validation pipeline + # is fully stabilized. + # + # To re-enable: + # simply add "validation" back to the options list. + # ------------------------------------------------------- + #- validation + - status + # ------------------------------------------------------- + # Scheduler Validation Mode + # + # validate_scheduler simulates an EventBridge scheduled + # invocation using: + # { "source": "scheduled" } + # + # This is used to validate the scheduled execution path + # before changes are promoted to main. + # + # This is NOT the production scheduler. + # + # The real scheduler is defined in: + # invoke_lambda.yml + # ------------------------------------------------------- + - validate_scheduler + + +jobs: + + invoke-lambda: + runs-on: ubuntu-latest + + steps: + + # ------------------------------------------------------- + # Pull repository contents + # ------------------------------------------------------- + - name: Checkout repository + uses: actions/checkout@v4 + + + # ------------------------------------------------------- + # Authenticate to AWS using GitHub OIDC + # + # This assumes the IAM role configured for GitHub + # so the workflow can invoke the Lambda securely. + # ------------------------------------------------------- + - name: Configure AWS credentials via OIDC + uses: aws-actions/configure-aws-credentials@v5 + with: + role-to-assume: arn:aws:iam::388691194728:role/BloodhoundGitHubInvokeRole + aws-region: us-west-2 + + # Install Terraform for validation workflow + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: 1.6.6 + + + # ------------------------------------------------------- + # Invoke Bloodhound Lambda + # + # The selected operation from the UI is passed into + # the Lambda payload as JSON. + # + # For standard operations: + # + # scan → { "source": "scan" } + # status → { "source": "status" } + # + # Validation requires additional guard fields because + # the validation handler enforces strict safety checks. + # + # validation → + # { + # "source": "validation", + # "mode": "seek_destroy_validation", + # "target_ids": ["validation-instance"] + # } + # + # ------------------------------------------------------- + - name: Invoke Bloodhound Lambda operation + run: | + # fail fast on script errors + set -euo pipefail + + echo "::group::Bloodhound Lambda Invocation" + + # operation selected in UI + MODE="${{ github.event.inputs.mode }}" + + echo "" + echo "========================================" + echo "Bloodhound Operation: $MODE" + echo "========================================" + echo "" + + # ------------------------------------------------------- + # Validation Mode + # + # Run the full teardown validation workflow instead of + # manually constructing a Lambda payload. + # + # The validation script handles: + # • Terraform test instance creation + # • Lambda invocation + # • teardown verification + # • safety checks + # ------------------------------------------------------- + if [ "$MODE" = "validation" ]; then + + echo "Running full teardown validation workflow" + + chmod +x tools/run_validation_workflow.sh + ./tools/run_validation_workflow.sh + + exit 0 + + fi + + + # ------------------------------------------------------- + # Standard Lambda operations (scan / status) + scheduler validation + # ------------------------------------------------------- + # validate_scheduler simulates EventBridge scheduled trigger + if [ "$MODE" = "validate_scheduler" ]; then + echo "===== VALIDATING SCHEDULER PATH =====" + echo "Simulating EventBridge scheduled event" + echo '{"source":"scheduled"}' > event.json + else + echo "{\"source\":\"$MODE\"}" > event.json + fi + + # show payload being sent to Lambda + cat event.json + + echo "" + echo "Invoking Bloodhound Lambda" + + # invoke Lambda + aws lambda invoke \ + --function-name BloodhoundLambdaV2 \ + --cli-binary-format raw-in-base64-out \ + --payload file://event.json \ + --log-type Tail \ + output.json \ + --region us-west-2 \ + > lambda_meta.json + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Print Lambda response payload + # ------------------------------------------------------- + echo "::group::Lambda Response Payload" + cat output.json + echo "::endgroup::" + + + # ------------------------------------------------------- + # Print Bloodhound operational summary results returned from Lambda + # ------------------------------------------------------- + echo "::group::Bloodhound Summary" + + echo "Scan Summary:" + jq '.scan' output.json || true + + echo "" + echo "Budget Snapshot:" + jq '.budget' output.json || true + + echo "" + echo "Teardown Plan:" + jq '.teardown' output.json || true + + echo "::endgroup::" + + + # ------------------------------------------------------- + # AWS invocation metadata + # + # Shows request ID, status code, and other + # Lambda invocation information. + # ------------------------------------------------------- + echo "::group::Lambda Invocation Metadata" + cat lambda_meta.json + echo "::endgroup::" + + + # ------------------------------------------------------- + # Decode Lambda logs returned in the invocation + # + # AWS embeds the last ~4KB of logs in base64. + # ------------------------------------------------------- + echo "::group::Decoded Lambda Logs" + + if jq -e '.LogResult' lambda_meta.json > /dev/null; then + cat lambda_meta.json | jq -r '.LogResult' | base64 -d + else + echo "No embedded logs returned from Lambda." + fi + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Detect Lambda failures + # + # Ensures CI fails if Lambda execution fails. + # ------------------------------------------------------- + echo "::group::Lambda Error Check" + + if grep -q "FunctionError" lambda_meta.json; then + echo "ERROR: Lambda reported FunctionError" + exit 1 + fi + + if ! grep -q '"StatusCode": 200' lambda_meta.json; then + echo "ERROR: Lambda invocation returned non-200 status" + exit 1 + fi + + echo "Lambda invocation completed successfully" + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Pull recent logs from CloudWatch + # ------------------------------------------------------- + - name: Fetch Lambda Logs + run: | + + echo "::group::Lambda CloudWatch Logs" + + LOG_GROUP="/aws/lambda/BloodhoundLambdaV2" + + # find most recent log stream + LOG_STREAM=$(aws logs describe-log-streams \ + --log-group-name $LOG_GROUP \ + --order-by LastEventTime \ + --descending \ + --limit 1 \ + --query 'logStreams[0].logStreamName' \ + --output text) + + echo "Latest log stream:" + echo $LOG_STREAM + + echo "" + echo "Recent log events:" + + aws logs get-log-events \ + --log-group-name $LOG_GROUP \ + --log-stream-name $LOG_STREAM \ + --limit 50 \ + --query 'events[*].message' \ + --output text + + echo "::endgroup::" + + # ------------------------------------------------------- + # Upload validation logs + # + # If validation mode ran, upload the generated + # validation logs as CI artifacts so engineers + # can download them from the workflow run page. + # ------------------------------------------------------- + - name: Upload validation logs + if: always() && github.event.inputs.mode == 'validation' + uses: actions/upload-artifact@v4 + with: + name: validation-logs + path: logs/validation \ No newline at end of file diff --git a/.github/workflows/invoke_lambda.yml b/.github/workflows/invoke_lambda.yml index 1cf329b..0e4c851 100644 --- a/.github/workflows/invoke_lambda.yml +++ b/.github/workflows/invoke_lambda.yml @@ -1,28 +1,253 @@ name: Invoke Bloodhound Lambda +run-name: Bloodhound Operations — ${{ github.event.inputs.mode }} + +# ------------------------------------------------------------ +# GitHub Actions workflow for invoking the Bloodhound Lambda. +# +# This workflow runs ONLY as a scheduled scanner. +# +# The purpose of this workflow is to execute the automated +# Bloodhound infrastructure scan on a fixed schedule. +# +# Manual operations (scan / validation / status) are handled +# by a separate workflow: bloodhound_ops.yml +# +# Lambda behavior is determined by: +# event["source"] +# +# Example payload used here: +# { "source": "scheduled" } + +# ------------------------------------------------------------ + +permissions: + id-token: write + contents: read + +# Prevent multiple scans running at the same time +concurrency: + group: bloodhound-scan + cancel-in-progress: false on: + + # ---------------------------------------------------------- + # Scheduled runs (UTC) + # + # NOTE: + # GitHub cron jobs only run from the repository DEFAULT + # branch (usually "main"). If this workflow exists only + # in another branch, the schedule will NOT trigger. + # + # Bloodhound executes twice per day: + # + # 16:00 UTC → 11 AM EST + # 04:00 UTC → 11 PM EST + # ---------------------------------------------------------- schedule: - # Run at 11 AM and 11 PM EST (4 PM and 4 AM UTC) - cron: '0 16,4 * * *' - workflow_dispatch: jobs: + + # GitHub runner job that invokes the Lambda invoke-lambda: runs-on: ubuntu-latest steps: + + # Temporary debug step to see what GitHub sends in the OIDC token context + - name: Print GitHub OIDC context + run: | + echo "Repository: $GITHUB_REPOSITORY" + echo "Ref: $GITHUB_REF" + echo "Ref Name: $GITHUB_REF_NAME" + echo "Event: $GITHUB_EVENT_NAME" + + # Pull repository contents - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 - - name: Set up AWS CLI - uses: aws-actions/configure-aws-credentials@v1 + # Configure AWS credentials via GitHub OIDC + - name: Configure AWS credentials via OIDC + uses: aws-actions/configure-aws-credentials@v5 with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + role-to-assume: arn:aws:iam::388691194728:role/BloodhoundGitHubInvokeRole aws-region: us-west-2 + # Invoke Bloodhound Lambda - name: Invoke Bloodhound Lambda function run: | - echo '{}' > test_event.json - aws lambda invoke --function-name BloodhoundLambda --payload file://test_event.json output.txt --region us-west-2 - cat output.txt + + set -euo pipefail # fail fast: exit on errors, undefined vars, or pipeline failures + + # ------------------------------------------------------- + # Group: Invocation Setup + # ------------------------------------------------------- + echo "::group::Bloodhound Lambda Invocation" + + echo "Building Lambda event payload" + + # ------------------------------------------------------- + # Build Lambda event payload + # + # This workflow always runs as part of the scheduled + # infrastructure scan. + # + # Because manual execution has been moved to a separate + # workflow (bloodhound_ops.yml), we no longer need to + # inspect GitHub workflow inputs. + # + # The Lambda event payload is therefore deterministic: + # + # { "source": "scheduled" } + # + # This ensures the Lambda pipeline runs in automated + # scan mode every time the cron job executes. + # ------------------------------------------------------- + + echo '{"source":"scheduled"}' > event.json + cat event.json + + echo "" + echo "Invoking Bloodhound Lambda" + + # Invoke Lambda + # output.json -> Lambda response payload + # lambda_meta.json -> AWS CLI invocation metadata + aws lambda invoke \ + --function-name BloodhoundLambdaV2 \ + --cli-binary-format raw-in-base64-out \ + --payload file://event.json \ + --log-type Tail \ + output.json \ + --region us-west-2 \ + > lambda_meta.json + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Group: Lambda Response + # ------------------------------------------------------- + echo "::group::Lambda Response Payload" + cat output.json + echo "::endgroup::" + + + # ------------------------------------------------------- + # Group: Bloodhound Summary + # + # This prints a concise operational summary extracted + # from the Lambda response so CI logs clearly show what + # Bloodhound discovered during the scan. + # + # These values come directly from the structured response + # returned by the Bloodhound pipeline. + # + # Sections displayed: + # • scan → resource discovery summary + # • budget → cost projection snapshot + # • teardown → planned/allowed cleanup actions + # + # This improves observability without failing the CI job. + # ------------------------------------------------------- + echo "::group::Bloodhound Summary" + + echo "Scan Summary:" + jq '.scan' output.json + + echo "" + echo "Budget Snapshot:" + jq '.budget' output.json + + echo "" + echo "Teardown Plan:" + jq '.teardown' output.json + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Group: Invocation Metadata + # ------------------------------------------------------- + echo "::group::Lambda Invocation Metadata" + cat lambda_meta.json + echo "::endgroup::" + + + # ------------------------------------------------------- + # Group: Decoded Lambda Logs + # + # When --log-type Tail is used, AWS embeds the last 4 KB + # of Lambda logs inside the LogResult field of the invoke + # response. The logs are base64 encoded. + # + # This step decodes them so they appear directly in the + # GitHub Actions output for easier debugging. + # ------------------------------------------------------- + echo "::group::Decoded Lambda Logs" + + if jq -e '.LogResult' lambda_meta.json > /dev/null; then + cat lambda_meta.json | jq -r '.LogResult' | base64 -d + else + echo "No embedded logs returned from Lambda." + fi + + echo "::endgroup::" + + + # ------------------------------------------------------- + # Group: Lambda Failure Detection + # + # Prevents CI pipelines from silently succeeding if + # Lambda execution fails. + # ------------------------------------------------------- + echo "::group::Lambda Error Check" + + # Detect runtime Lambda errors + if grep -q "FunctionError" lambda_meta.json; then + echo "ERROR: Lambda reported FunctionError" + exit 1 + fi + + # Detect unexpected status codes + if ! grep -q '"StatusCode": 200' lambda_meta.json; then + echo "ERROR: Lambda invocation returned non-200 status" + exit 1 + fi + + echo "Lambda invocation completed successfully" + echo "===== Invocation Complete =====" + + echo "::endgroup::" + + - name: Fetch Lambda Logs + run: | + + echo "::group::Lambda CloudWatch Logs" + + LOG_GROUP="/aws/lambda/BloodhoundLambdaV2" + + # Find latest log stream + LOG_STREAM=$(aws logs describe-log-streams \ + --log-group-name $LOG_GROUP \ + --order-by LastEventTime \ + --descending \ + --limit 1 \ + --query 'logStreams[0].logStreamName' \ + --output text) + + echo "Latest log stream:" + echo $LOG_STREAM + + echo "" + echo "Recent log events:" + + aws logs get-log-events \ + --log-group-name $LOG_GROUP \ + --log-stream-name $LOG_STREAM \ + --limit 50 \ + --query 'events[*].message' \ + --output text + + echo "::endgroup::" \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..df886a6 --- /dev/null +++ b/.gitignore @@ -0,0 +1,98 @@ +# ========================================================= +# Python +# ========================================================= +__pycache__/ +*.py[cod] +*.pyo +*.pyd +.Python +*.egg-info/ +.eggs/ +dist/ +build/ +pip-wheel-metadata/ +.pytest_cache/ +.mypy_cache/ +.ruff_cache/ + +# ========================================================= +# Virtual Environments +# ========================================================= +.venv/ +venv/ +ENV/ +myenv/ + +# ========================================================= +# Environment Files / Secrets +# ========================================================= +.env +.env.* +**/.env +**/.env.* + +# ========================================================= +# Project Build Artifacts +# ========================================================= +.build/ +**/.build/ +*.zip + +# ========================================================= +# Logs +# ========================================================= +*.log + +# ========================================================= +# OS / Editor Files +# ========================================================= +.DS_Store +Thumbs.db +.idea/ +.vscode/ + +# Logs +*.log + +# Local dry-run reports +reports/ + +# ========================================================= +# Terraform +# ========================================================= +.terraform/ +**/.terraform/ +infra/terraform.tfvars + +# Terraform state files (NEVER commit) +*.tfstate +*.tfstate.* + +# Terraform variable overrides (often contain secrets) +*.tfvars +*.tfvars.json + +# Terraform crash logs +crash.log + +# Terraform CLI config files +.terraformrc +terraform.rc + +# ========================================================= +# GitHub Actions (temporarily disabled for safety) +# ========================================================= +#/.github/workflows/ + +# Lambda local test output +output.txt + +# Ignore Validation logs (these can be large and are not needed in version control) +logs/validation/*.log + +# However, we want to keep the validation history log, which tracks past validation runs and their results. +!logs/validation_history.log + +# Bootstrap script artifacts +trust-policy.json +lambda-policy.json \ No newline at end of file diff --git a/FEATURES.md b/FEATURES.md new file mode 100644 index 0000000..d865856 --- /dev/null +++ b/FEATURES.md @@ -0,0 +1,305 @@ +# Bloodhound V2 — Features + +This document summarizes the major capabilities of the Bloodhound +cloud cost monitoring and automated cleanup system. + +--- + +## Interactive Demo Guide + +A step-by-step operational walkthrough of Bloodhound is available in: + +docs/quick_demo.md + +The demo guide shows how engineers interact with Bloodhound using: + +1. Local execution +2. Slack scan commands +3. Teardown planning +4. Controlled teardown execution +5. Scheduled GitHub Actions scans +6. Manual GitHub Actions operations +7. CloudWatch log inspection +8. Automated teardown validation workflow + +The guide includes real screenshots and validation artifacts. + +--- + +## Core Capabilities + +Bloodhound scans AWS infrastructure to identify unused resources +and optionally remove them to control cloud costs. + +Key capabilities include: + +- multi-region AWS resource scanning +- cost monitoring using AWS Cost Explorer +- Slack-based reporting and operations +- automated teardown planning +- controlled resource deletion +- infrastructure validation workflows + +--- + +## Resource Scanning + +Bloodhound scans the following AWS resources: + +- EC2 instances +- EBS volumes +- Elastic IPs +- NAT Gateways +- RDS instances +- ELBv2 load balancers + +The scanner automatically evaluates multiple AWS regions. + +--- + +## Cost Monitoring + +Bloodhound integrates with AWS Cost Explorer to calculate: + +- cohort-to-date spend +- projected monthly cost +- dynamic monthly allowance + +Budget alerts can be sent to Slack when spending exceeds thresholds. + +--- + +## Teardown Planning + +Bloodhound generates a **teardown plan** showing resources that +could be deleted to reduce cost. + +This plan is always generated before any destructive actions occur. + +--- + +## Controlled Resource Deletion + +Deletion is optional and disabled by default. + +Multiple safety controls protect against accidental deletion: + +- dry-run mode +- simulation mode +- explicit confirmation tokens +- optional allowlists +- resource tagging protection + +--- + +## Slack Integration + +Bloodhound supports the following Slack commands: + +/v2_seek +/v2_seek_destroy_plan +/v2_seek_destroy CONFIRM +/v2_status + +Slack provides operational visibility and safe control of teardown actions. + +--- + +## GitHub Automation + +Bloodhound includes GitHub Actions workflows that automate +infrastructure scanning and operational control. + +Two workflows are included in the repository: + +### Scheduled Scan Workflow + +File: + +.github/workflows/invoke_lambda.yml + +This workflow runs automatically on a fixed schedule and performs +regular AWS infrastructure scans. + +Schedule: + +16:00 UTC → 11 AM EST +04:00 UTC → 11 PM EST + +Authentication and execution flow: + +```text +GitHub Actions + ↓ +OIDC Authentication + ↓ +AWS STS AssumeRoleWithWebIdentity + ↓ +BloodhoundGitHubInvokeRole + ↓ +BloodhoundLambdaV2 + ↓ +AWS Infrastructure Scan + Cleanup +``` + +The workflow: + +- authenticates to AWS using GitHub OIDC +- assumes the `BloodhoundGitHubInvokeRole` +- invokes the `BloodhoundLambdaV2` function +- prints scan summaries and recent CloudWatch logs + +The Lambda event payload used for scheduled scans is: + +```json +{ "source": "scheduled" } +``` + +### Manual Operations Workflow + +File: + +`.github/workflows/bloodhound_ops.yml` + +This workflow allows engineers to manually run Bloodhound +operations from the GitHub Actions UI. + +Supported modes: +- scan — run an immediate infrastructure scan +- status — return system health information +- validation — implemented in the workflow but currently disabled in the GitHub Actions UI + +Validation mode is currently disabled in CI but remains available +for local testing. + +## Automated Validation Workflow + +Bloodhound includes automated validation workflows that verify: + +- Lambda deployment +- infrastructure scanning +- teardown logic +- controlled deletion behavior + +Validation uses disposable test resources to ensure safe testing. + +Validation can be executed locally using: + +`tools/run_validation_workflow.sh` + +This script orchestrates infrastructure smoke tests and controlled +teardown validation using disposable AWS resources. + +--- + +## Safety Architecture + +Bloodhound implements layered safety protections: + +- destructive actions disabled by default +- explicit confirmation required +- resource whitelist tagging +- Terraform deployment guards +- Lambda version rollback capability + +These safeguards ensure the system cannot accidentally delete +production resources. + +--- + +## Deployment Architecture + +Bloodhound runs as an AWS Lambda function deployed using Terraform. + +Key components: + +- AWS Lambda +- CloudWatch Logs +- Slack integration +- Terraform infrastructure management +- GitHub Actions automation +- GitHub OIDC authentication for AWS access +- validation automation scripts +- deterministic Lambda event routing + +## Deterministic Lambda Build Pipeline + +Bloodhound uses a deterministic Docker-based build pipeline to +construct the Lambda deployment artifact. + +Instead of building dependencies directly on the host machine, +Terraform invokes a build script that performs the packaging +inside a Docker container that mirrors the AWS Lambda runtime. + +Build process: + +1. Terraform triggers the Lambda build script +2. The script launches the AWS Lambda runtime container +3. Python dependencies are installed from `requirements.txt` +4. Bloodhound application source code is copied into the package +5. Terraform archives the package into the Lambda deployment artifact +6. The Lambda function is updated with the new version + +Build flow: + +Terraform +↓ +build_lambda.sh +↓ +Docker (Amazon Lambda runtime container) +↓ +.build/lambda_pkg +↓ +archive_file +↓ +Lambda deployment artifact +↓ +AWS Lambda version publish + + +# Benefits of this approach: + +- guarantees dependency compatibility with the AWS Lambda runtime +- produces deterministic and reproducible builds +- prevents environment-specific packaging issues +- separates infrastructure management from packaging logic +- simplifies future CI/CD integration +- allows user to force Lambda rebuilds when packaging logic changes + +Docker builds are used by default to ensure production-safe and +runtime-compatible Lambda artifacts. + +If the build pipeline or packaging script changes, users can force +Terraform to rebuild the Lambda package using: + +```bash +terraform apply -replace=terraform_data.build_lambda_pkg +``` + +## Lambda Event Routing + +The Bloodhound Lambda entrypoint routes events through +deterministic execution paths to prevent recursion and +ensure predictable behavior. + +Event types: + +- Slack HTTP events → Slack command handler +- Scheduled events → dedicated scheduled handler +- Default events → main execution pipeline + +Example routing: + +```text +Lambda handler +↓ +event routing (Slack / scheduled / default) +↓ +scheduled_handler → run_scheduled_scan() +or +bloodhound.app.run() +``` + +This architecture prevents recursive execution loops +and ensures scheduled runs do not re-enter the main +execution pipeline. diff --git a/README.md b/README.md index 0e09461..27a335c 100644 --- a/README.md +++ b/README.md @@ -1,286 +1,243 @@ -# Bloodhound Lambda Function +# Bloodhound v2 — AWS cost-guard scanner, Slack control plane, and safe teardown -## Table of Contents +Bloodhound scans selected AWS regions for common cost-leak resources (EC2 / RDS / ELBv2), +posts results to Slack, manages spend **guardrails** (which services student groups may use), +and can optionally tear down resources that are **not** whitelisted. -- [Overview](#overview) -- [Prerequisites](#prerequisites) -- [Setup Steps](#setup-steps) - - [1. Create a Slack App](#1-create-a-slack-app) - - [2. Add Bot Permissions](#2-add-bot-permissions) - - [3. Get the Slack Channel ID](#3-get-the-slack-channel-id) - - [4. Invite the Bot to the Channel](#4-invite-the-bot-to-the-channel) - - [5. Prepare the Lambda Function Code](#5-prepare-the-lambda-function-code) - - [6. Package and Deploy the Lambda Function](#6-package-and-deploy-the-lambda-function) - - [7. Create an IAM Role for Lambda](#7-create-an-iam-role-for-lambda) - - [8. Set Up Environment Variables in AWS Lambda](#8-set-up-environment-variables-in-aws-lambda) - - [9. Test the Lambda Function](#9-test-the-lambda-function) - - [10. GitHub Actions Setup](#10-github-actions-setup) -- [Conclusion](#conclusion) +You drive it entirely from **Slack slash commands** — start there. -## Overview +- [Slack slash commands](#slack-slash-commands) ← the operator interface +- [Managing service access with `/guard`](#managing-service-access-with-guard) ← e.g. Bedrock for a student group +- [Deploy](#deploy) +- [Environment variables](#environment-variables) +- [Local setup + testing](#local-setup--testing) +- [Whitelisting](#whitelisting) · [Teardown controls](#teardown-controls) -The Bloodhound Lambda function is designed to scan AWS regions for EC2 and RDS instances and post a summary to a Slack channel. This README provides detailed steps to set up, deploy, and test the Lambda function, including Slack integration. +![AWS Architecture Diagram (v2)](assets/bloodhound_lambda_architecture_v2.svg) -![AWS Architecture Diagram](assets/bloodhound_lambda_architecture.png) - -## Prerequisites +--- -- AWS account with permissions to create IAM roles, Lambda functions, and access to EC2 and RDS. -- Slack workspace with permission to create and install Slack apps. -- Python 3.8 installed locally for testing and packaging the Lambda function. +## Slack slash commands -## Setup Steps +All commands hit a single **Lambda Function URL**; routing is by Slack's `command` field. +Read-only commands anyone in an allowed channel can run; **mutating** commands require the +caller to be allowlisted (see [Permissions & safety](#permissions--safety)). -### 1. Create a Slack App +| Command | What it does | Mutates? | +|---|---|---| +| `/seek` | Run a scan and post the report to Slack | no | +| `/seek_cost` | Post AWS month-to-date cost breakdown + budget summary | no | +| `/seek_whitelist` | Post active whitelist rules + all currently protected resources | no | +| `/seek_destroy CONFIRM` | Destructive teardown of all non-whitelisted candidates (requires the confirm token) | **yes** | +| `/guard ` | View and manage spend guardrails (service allow/deny, group membership) | some subcommands | -1. Go to the Slack API website: [Slack API: Applications](https://api.slack.com/apps). -2. Click on "Create New App". -3. Choose "From scratch". -4. Give your app a name and select the Slack workspace where you have permissions to install the app. -5. Click "Create App". +### `/guard` subcommands -### 2. Add Bot Permissions +A **guardrail** is a named, two-layer spend control that `/guard` edits as a unit so the two +layers can never drift apart: -1. In your Slack app settings, go to "OAuth & Permissions". -2. Under "OAuth Tokens & Redirect URLs", scroll down to "Scopes". -3. Add the following bot token scopes: - - `chat:write`: To post messages in channels. - - `channels:read`: To read information about channels. - - `groups:read`: To read information about private channels. -4. At the top of the "OAuth & Permissions" page, click "Install App to Workspace". -5. Review the permissions and click "Allow". -6. Copy the OAuth Access Token; you'll need this as the `SLACK_BOT_TOKEN`. +- an Organizations **SCP** (e.g. `cp-org-spend-stop`) — restricts member accounts under its target OUs/accounts +- an IAM **managed policy attached to a group** (e.g. `cp-aico-echo-cost-guard` on group `aico-echo-class`) — restricts IAM users in the management account -### 3. Get the Slack Channel ID +| Subcommand | Alias | Effect | Mutates? | +|---|---|---|---| +| `/guard list` | `ls` | List all guardrails: layers, attachments, denied services | no | +| `/guard show ` | | Full detail for one guardrail | no | +| `/guard members ` | `who` | List users in the guardrail's IAM group | no | +| `/guard allow ` | `unblock` | **Remove** a service from the deny lists (grant access) | **yes** | +| `/guard deny ` | `block` | **Add** a service to the deny lists (block access) | **yes** | +| `/guard enable ` | | (Re)attach the IAM policy to its group | **yes** | +| `/guard disable ` | | Detach the IAM policy from its group | **yes** | +| `/guard add-student ` | `add` | Add a user to the guardrail's group | **yes** | +| `/guard remove-student ` | `remove`, `rm` | Remove a user from the guardrail's group | **yes** | -1. Open Slack and navigate to the channel where you want the bot to post messages. -2. Click on the channel name to open the channel details. -3. Copy the channel ID from the URL or the channel details pane. The channel ID starts with `C` for public channels or `G` for private channels. +The default guardrail is named **`cost-guard`** (override the registry via `GUARD_REGISTRY`). -### 4. Invite the Bot to the Channel +--- -1. In Slack, go to the channel where you want the bot to post messages. -2. Type `/invite @your-bot-name` to invite the bot to the channel. Replace `your-bot-name` with the actual name of your bot. +## Managing service access with `/guard` -### 5. Prepare the Lambda Function Code +This is the common case: a student group needs a normally-blocked service turned on (or off). -1. Create a directory for your Lambda function code: +**Example — give a student group access to Amazon Bedrock:** -```sh -mkdir bloodhound_lambda -cd bloodhound_lambda ``` - -2. Create a file named `lambda_function.py` and add the following code: - -```python -import boto3 -import os -from slack_sdk import WebClient -from slack_sdk.errors import SlackApiError - -# Adjust based on the regions you want to scan -STUDENT_REGIONS = [ - "us-east-1", - "us-east-2", - "us-west-1", - "us-west-2", -] - -def create_session(region): - return boto3.Session(region_name=region) - -def search_regions_for_rds_resources(session): - rds_instances = [] - print(f"Sniffing out rds resources in {session.region_name}...") - rds = session.client("rds") - response = rds.describe_db_instances() - for dbinstance in response["DBInstances"]: - rds_instances.append(dbinstance["DBInstanceIdentifier"]) - return {"rds": rds_instances} - -def search_regions_for_ec2_resources(session): - ec2_instances = [] - print(f"Sniffing out ec2 resources in {session.region_name}...") - ec2 = session.client("ec2") - response = ec2.describe_instances() - try: - if len(response["Reservations"]) == 1: - for ec2instance in response["Reservations"][0]["Instances"]: - if ec2instance["State"]["Name"] in ("stopped", "terminated"): - continue - ec2_instances.append(ec2instance["InstanceId"]) - else: - for ec2instance in response["Reservations"]: - if ec2instance["Instances"][0]["State"]["Name"] in ("stopped", "terminated"): - continue - ec2_instances.append(ec2instance["Instances"][0]["InstanceId"]) - except IndexError: - return {"ec2": []} - return {"ec2": ec2_instances} - -def format_message(resources): - message = ":dog2: Woof! Woof! :dog2:\n Bloodhound found the following resources in use: \n" - for region in resources.keys(): - if len(resources[region]["ec2"]) == 0 and len(resources[region]["rds"]) == 0: - continue - message += f'- *{region.upper()}*: {len(resources[region]["ec2"])} ec2 instances, {len(resources[region]["rds"])} rds instances\n' - message += f"Please stop or terminate all unneeded resources!" - return message - -def send_slack_message(message): - try: - slack_bot_token = os.environ.get("SLACK_BOT_TOKEN") - channel_id = os.environ.get("CHANNEL_ID") - - client = WebClient(token=slack_bot_token) - response = client.chat_postMessage( - channel=channel_id, - text=message - ) - print(f"Slack message response: {response}") - except SlackApiError as e: - print(f"Error sending message to Slack: {e.response['error']}") - -def lambda_handler(event, context): - resources_in_regions = {} - print(f"Going hunting in regions {STUDENT_REGIONS}") - for region in STUDENT_REGIONS: - session = create_session(region) - resources_in_regions[region] = search_regions_for_ec2_resources(session) - resources_in_regions[region].update(search_regions_for_rds_resources(session)) - message = format_message(resources_in_regions) - print(message) - send_slack_message(message) - return message +/guard allow cost-guard bedrock ``` -3. Create a `requirements.txt` file with the following content: +That removes `bedrock` from the deny list on **both** the SCP and the IAM group policy at once. +Bedrock exposes three service prefixes — grant all three for the full runtime: -```text -slack_sdk -boto3 +``` +/guard allow cost-guard bedrock +/guard allow cost-guard bedrock-runtime +/guard allow cost-guard bedrock-agent-runtime ``` -### 6. Package and Deploy the Lambda Function - -1. Install the dependencies and create a deployment package: +To block it again, swap `allow` for `deny`: -```sh -pip install -r requirements.txt -t . -zip -r9 ../bloodhound_lambda.zip . +``` +/guard deny cost-guard bedrock ``` -2. Create the Lambda function using the AWS CLI: +### Which services can be toggled -```sh -aws lambda create-function --function-name BloodhoundLambda \ ---zip-file fileb://bloodhound_lambda.zip --handler lambda_function.lambda_handler --runtime python3.8 \ ---role arn:aws:iam:::role/BloodhoundLambdaRole --region us-west-2 +`allow` / `deny` may only touch services in `GUARD_TOGGLEABLE_SERVICES`. This is deliberately +the expensive-compute / ML set and **excludes** `iam`, `organizations`, EC2 instance-type caps, +etc., so a Slack message can never loosen the core guardrails themselves. Defaults: + +``` +rds, redshift, neptune-db, dax, memorydb, +sagemaker, bedrock, bedrock-runtime, bedrock-agent-runtime, +eks, elasticmapreduce, es, aoss, q, deepracer, forecast, +frauddetector, kendra, comprehendmedical, healthlake, omics, braket ``` -Replace `` with your actual AWS account ID. +### Permissions & safety -### 7. Create an IAM Role for Lambda +- **Mutating** commands (`/guard allow|deny|enable|disable|add-student|remove-student`, and + `/seek_destroy`) require the caller's Slack user ID to be in `GUARD_ALLOWED_USER_IDS` + (falls back to `SLACK_ALLOWED_USER_IDS`). If neither is set, **all mutations are refused** + (fail-safe) — the command endpoint is a public Lambda Function URL. +- `/seek_destroy` also requires the confirm token (`SLACK_DESTROY_CONFIRM_TOKEN`, default `CONFIRM`). +- Set `SLACK_SIGNING_SECRET` so the Lambda can verify requests genuinely come from Slack. -1. Go to the [IAM console](https://console.aws.amazon.com/iam/). -2. Create a new role: - - Choose the "Lambda" service. - - Attach the following policies: - - `AWSLambdaBasicExecutionRole` - - `AmazonEC2ReadOnlyAccess` - - `AmazonRDSReadOnlyAccess` -3. Note the ARN of the created role. +--- -### 8. Set Up Environment Variables in AWS Lambda +## Deploy -1. Navigate to the [AWS Lambda Console](https://console.aws.amazon.com/lambda/). -2. Select your BloodhoundLambda function. -3. Go to the "Configuration" tab and then "Environment variables". -4. Add the following environment variables: - - `SLACK_BOT_TOKEN`: Your Slack bot token. - - `CHANNEL_ID`: Your Slack channel ID. -5. Save the changes. +Bloodhound v2 deploys as its own Lambda (`BloodhoundLambdaV2`) so it never touches any v1 function. -### 9. Test the Lambda Function +### Option A — Terraform (recommended) -1. Create a test event named `test_event.json` with the following content: +Terraform builds the deployment zip and provisions the Lambda, its Function URL, and IAM. -```json -{} +```bash +cd infra +terraform init +terraform apply ``` -2. Invoke the Lambda function: +Terraform builds `../.build/bloodhound_lambda_v2.zip` automatically (via `terraform_data` + +`archive_file`), so you need `python3`, `pip`, `zip`, and `rsync` installed locally. +After apply, set the `lambda_function_url` output as the Request URL for your slash commands +in Slack. See [`infra/README.md`](infra/README.md) for details. + +> Prefer setting secrets (Slack token, signing secret) in the Lambda console or a secrets +> manager rather than `var.lambda_env` — the latter stores them in Terraform state. + +### Option B — manual Lambda console + +- **Function name:** `BloodhoundLambdaV2` +- **Handler:** `handlers.lambda_function.lambda_handler` +- Build the zip (the `.build/` dir is not committed — Terraform builds it, or build it yourself), + upload it, then set the [environment variables](#environment-variables) below. + +Smoke-test the deployed function: -```sh -aws lambda invoke --function-name BloodhoundLambda --payload file://test_event.json output.txt --region us-west-2 +```bash +aws lambda invoke \ + --function-name BloodhoundLambdaV2 \ + --payload file://tools/test_event.json \ + output.txt \ + --region us-west-2 + +cat output.txt ``` -3. Check the contents of `output.txt` and review the CloudWatch logs to ensure the function executed correctly. +### Wire up Slack + +In your Slack app settings, register each slash command (`/seek`, `/seek_cost`, +`/seek_whitelist`, `/seek_destroy`, `/guard`) with the **Request URL** set to the Lambda +Function URL. Creating the Slack app from scratch is covered in [`docs/SLACK_SETUP.md`](docs/SLACK_SETUP.md). -### 10. GitHub Actions Setup +--- -#### 1. Create the Workflow File +## Environment variables -Create the file `.github/workflows/invoke_lambda.yml` in your repository. +Set these on the Lambda (copy from your local `.env` — see [`env.example`](env.example)). -#### 2. Add the Workflow Configuration +**Slack (required for slash commands)** -Add the following content to the `invoke_lambda.yml` file: +| Var | Purpose | +|---|---| +| `SLACK_BOT_TOKEN` | Bot token used to post reports | +| `SLACK_SCAN_CHANNEL_ID` / `SLACK_ALERT_CHANNEL_ID` | Where scan reports / alerts go | +| `SLACK_SIGNING_SECRET` | Verify inbound requests came from Slack | +| `SLACK_ALLOWED_USER_IDS` | (optional) allowlist for mutating commands (fallback for `/guard`) | +| `SLACK_ALLOWED_CHANNEL_IDS` | (optional) restrict which channels may invoke commands | +| `SLACK_DESTROY_CONFIRM_TOKEN` | Confirm token for `/seek_destroy` (default `CONFIRM`) | -```yaml -name: Invoke Bloodhound Lambda +**Guardrails (`/guard`)** -on: - schedule: - # Run at 11 AM and 11 PM EST (4 PM and 4 AM UTC) - - cron: "0 16,4 * * *" - workflow_dispatch: +| Var | Purpose | +|---|---| +| `GUARD_ALLOWED_USER_IDS` | Allowlist of Slack user IDs permitted to run `/guard` mutations (falls back to `SLACK_ALLOWED_USER_IDS`) | +| `GUARD_TOGGLEABLE_SERVICES` | (optional) override the CSV of services `allow`/`deny` may touch | +| `GUARD_REGISTRY` | (optional) JSON overriding the guardrail registry (name, scp, iam_policy, group) | -jobs: invoke +**Scan / budget / teardown** --lambda: - runs-on: ubuntu-latest +| Var | Purpose | +|---|---| +| `REGION_MODE`, `REGIONS` | Which regions to scan | +| `COHORT_START_YYYY_MM`, `COHORT_TOTAL_BUDGET_USD`, `COHORT_LENGTH_MONTHS`, `BUDGET_OVER_DAYS` | Budget summary math | +| `APPLY_CHANGES`, `TEARDOWN_SIMULATE`, `TEARDOWN_ALLOW_ALL`, `TEARDOWN_TARGET_IDS` | Teardown behavior (see below) | - steps: - - name: Checkout repository - uses: actions/checkout@v2 +--- - - name: Set up AWS CLI - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: us-west-2 +## Local setup + testing - - name: Invoke Bloodhound Lambda function - run: | - echo '{}' > test_event.json - aws lambda invoke --function-name BloodhoundLambda --payload file://test_event.json output.txt --region us-west-2 - cat output.txt +```bash +python3 -m venv .venv +.venv/bin/python -m pip install --upgrade pip +.venv/bin/python -m pip install -r requirements.txt + +cp env.example .env # then fill it in — Bloodhound auto-loads .env for local runs + +# Run against a chosen AWS profile: +AWS_PROFILE=geekstar .venv/bin/python tools/run_local.py ``` -#### 3. Add AWS Credentials to GitHub Secrets +Requirements: Python 3.10+ (or match your Lambda runtime), AWS CLI configured +(`aws configure --profile `; profiles live in `~/.aws/config` / `~/.aws/credentials`), +and a Slack bot token + channel IDs. + +--- + +## Whitelisting -1. Go to your repository on GitHub. -2. Click on "Settings". -3. Click on "Secrets and variables" in the left sidebar, then click on "Actions". -4. Click "New repository secret". -5. Add the following secrets: - - `AWS_ACCESS_KEY_ID`: Your AWS access key ID. - - `AWS_SECRET_ACCESS_KEY`: Your AWS secret access key. +Resources are **kept (whitelisted)** when they match any rule: -#### 4. Push the Workflow to GitHub +| Rule type | Env var | Example | +|---|---|---| +| Tag | `KEEP_TAG_RULES` | `bloodhound:keep=true` | +| Name/tag regex | `KEEP_NAME_PATTERNS` | `buffalo,fullstack,vetlaunch,dont-touch` | +| Explicit ID/ARN | `KEEP_RESOURCE_IDS` | `arn:aws:rds:...:db:vetlaunch-dev-db` | -Commit and push the `.github/workflows/invoke_lambda.yml` file to your repository. +Legacy single-tag config still works via `KEEP_TAG_KEY` + `KEEP_TAG_VALUE`. +`/seek_whitelist` posts the active rules plus every currently protected resource. -#### 5. Verify the Workflow +--- -1. Go to the "Actions" tab in your GitHub repository. -2. You should see the new workflow listed. It will run according to the schedule and can also be manually triggered. +## Teardown controls -## Conclusion +By default Bloodhound posts a teardown **plan only** (`APPLY_CHANGES=false`). To actually +delete/terminate non-whitelisted resources, set `APPLY_CHANGES=true`. Safety rails: -By following these steps, you have successfully set up, deployed, and tested the Bloodhound Lambda function with Slack integration. The function scans AWS regions for EC2 and RDS instances and posts a summary to the specified Slack channel. Additionally, you have set up a GitHub Action to invoke the Lambda function twice a day at 11 AM and 11 PM EST. Ensure to review the logs and Slack messages to confirm the function's correct behavior. +- **simulate (no deletes):** `TEARDOWN_SIMULATE=true` +- **only delete explicit IDs/ARNs:** `TEARDOWN_TARGET_IDS=...` +- **delete everything not whitelisted:** `TEARDOWN_ALLOW_ALL=true` --- + +## GitHub Actions + +`.github/workflows/invoke_lambda.yml` invokes `BloodhoundLambdaV2` on a schedule (currently +disabled — enable it in the Actions tab when you want scheduled scans). + +## Project docs + +- v2 plan: [`docs/V2_PLAN.md`](docs/V2_PLAN.md) +- Slack app setup: [`docs/SLACK_SETUP.md`](docs/SLACK_SETUP.md) +- Infrastructure: [`infra/README.md`](infra/README.md) diff --git a/assets/bloodhound_lambda_architecture_v2.svg b/assets/bloodhound_lambda_architecture_v2.svg new file mode 100644 index 0000000..515c5d7 --- /dev/null +++ b/assets/bloodhound_lambda_architecture_v2.svg @@ -0,0 +1,211 @@ + + + + + + + + + + + + + + + + + + + Bloodhound v2 — Architecture and Logic Flow + AWS resource scan + whitelist filter + budget projection + Slack alerts + optional teardown (with safety rails) + + + + Triggers + + + Scheduled (GitHub Actions or scheduler) + Invokes Lambda for scan + budget report + Recommended for regular visibility + + + On-demand (Slack slash commands) + Slack → Lambda Function URL (HTTPS) + Signature verification + replay protection + Responds quickly; runs worker async + + + + AWS Account (single account) — BloodhoundLambdaV2 + Runtime: python3.10 • Handler: handlers.lambda_function.lambda_handler • Deployed via Terraform + + + + HTTP Entry (Function URL) + + bloodhound.slack_commands: verify + route (/seek, /seek_destroy) + + Immediately returns 200 to Slack + Worker invoked async for full run + + + Scheduled / Direct Invoke + + aws lambda invoke (CLI) or scheduler + + Runs full scan + budget + teardown plan + Optionally executes teardown (apply mode) + + + + Core Orchestrator + + bloodhound.app: load config → scan_all → whitelist → budget → messages → Slack posts + + Config + safety rails + APPLY_CHANGES (default false) + TEARDOWN_SIMULATE, TEARDOWN_TARGET_IDS + TEARDOWN_ALLOW_ALL (dangerous) + + Slack destinations + Scan channel: SLACK_SCAN_CHANNEL_ID + Alert channel: SLACK_ALERT_CHANNEL_ID + Posting via chat.postMessage + + + + Multi-region Scanning + bloodhound.scanner.scan_all + per-service scanners + Regions: explicit list or discovery mode + Resources scanned (examples): + - EC2 instances, EBS volumes, Elastic IPs + - RDS instances + - ELBv2 load balancers + + + + Budget Projection + bloodhound.budget → AWS Cost Explorer + Cohort config: start YYYY-MM, total USD, length months + Dynamic monthly allowance using cohort-to-date spend + Over-budget threshold based on projected days over + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Whitelist Filter + bloodhound.whitelist: KEEP_TAG_KEY / KEEP_TAG_VALUE + Kept resources are excluded from teardown + + Teardown (optional) + bloodhound.teardown: planner + executor + Dry-run by default; apply requires explicit flags + + + + Slack Workspace + + Channels + Scan summaries + whitelisted list + Budget summaries + overage alerts + Teardown plan + results (when enabled) + + + + invoke + + + HTTPS request + + + + /seek, /seek_destroy + + + + async invoke worker + + + + direct run + + + + scan candidates + + + + + + + + fetch costs + + + + chat.postMessage + + + + Safety rails for destructive actions + Default behavior posts a teardown plan only (APPLY_CHANGES=false). + Apply-mode supports simulate, explicit targets, or allow-all (dangerous). + Slash destroy requires a confirm token and optional allowlists. + diff --git a/bloodhound.py b/bloodhound.py deleted file mode 100755 index d6288cf..0000000 --- a/bloodhound.py +++ /dev/null @@ -1,94 +0,0 @@ -import boto3 -import os -import json -from dotenv import load_dotenv - -# Import WebClient from Python SDK (github.com/slackapi/python-slack-sdk) -from slack_sdk import WebClient - -load_dotenv() - -STUDENT_REGIONS = [ - "eu-central-1", - "eu-west-1", - "eu-west-2", - "us-east-1", - "us-east-2", - "us-west-1", - "us-west-2", -] - - -def create_session(region): - return boto3.Session(profile_name="bloodhound", region_name=region) - - -def search_regions_for_rds_resources(session): - rds_instances = [] - print(f"Sniffing out rds resources in {session.region_name}...") - rds = session.client("rds") - response = rds.describe_db_instances() - for dbinstance in response["DBInstances"]: - rds_instances.append(dbinstance["DBInstanceIdentifier"]) - return {"rds": rds_instances} - - -def search_regions_for_ec2_resources(session): - """ - TODO: modify the parsing logic here from the describe_instances() call, - https://serverfault.com/questions/749118/ - Instances spun up at the same time will be in the same reservationId more than likely. - Instances spun up individually will have their own reservationId - """ - ec2_instances = [] - print(f"Sniffing out ec2 resources in {session.region_name}...") - ec2 = session.client("ec2") - response = ec2.describe_instances() - try: - # Instances spun up at the same time will be listed in the same Reservation - if len(response["Reservations"]) == 1: - for ec2instance in response["Reservations"][0]["Instances"]: - if ec2instance["State"]["Name"] in ("stopped", "terminated"): - continue - ec2_instances.append(ec2instance["InstanceId"]) - # Indvidual instances will appear in their own Reservation - else: - for ec2instance in response["Reservations"]: - if ec2instance["Instances"][0]["State"]["Name"] in ("stopped", "terminated"): - continue - ec2_instances.append(ec2instance["Instances"][0]["InstanceId"]) - except IndexError: - return {"ec2": []} - return {"ec2": ec2_instances} - - -def format_message(resources): - message = ":dog2: Woof! Woof! :dog2:\n Bloodhound found the following resources in use: \n" - for region in resources.keys(): - if len(resources[region]["ec2"]) == 0 and len(resources[region]["rds"]) == 0: - continue - message += f'- *{region.upper()}*: {len(resources[region]["ec2"])} ec2 instances, {len(resources[region]["rds"])} rds instances\n' - message += f"Please stop or terminate all unneeded resources!" - return message - - -def send_slack_message(message): - channel_id = os.environ.get("CHANNEL_ID") - client = WebClient(token=os.environ.get("SLACK_BOT_TOKEN")) - client.chat_postMessage(channel=channel_id, text=message) - - -def main(): - resources_in_regions = {} - print(f"Going hunting in regions {STUDENT_REGIONS}") - for region in STUDENT_REGIONS: - session = create_session(region) - resources_in_regions[region] = search_regions_for_ec2_resources(session) - resources_in_regions[region].update(search_regions_for_rds_resources(session)) - message = format_message(resources_in_regions) - print(message) - send_slack_message(message) - - -if __name__ == "__main__": - main() diff --git a/bloodhound/__init__.py b/bloodhound/__init__.py new file mode 100644 index 0000000..e3c7188 --- /dev/null +++ b/bloodhound/__init__.py @@ -0,0 +1,5 @@ +__all__ = ["__version__"] + +__version__ = "2.0.0-dev" + + diff --git a/bloodhound/app.py b/bloodhound/app.py new file mode 100644 index 0000000..d2f6ca8 --- /dev/null +++ b/bloodhound/app.py @@ -0,0 +1,304 @@ +""" +bloodhound/app.py + +Orchestration entrypoint for Bloodhound v2. +""" + +from __future__ import annotations + +import json +import os +from typing import Any + +from bloodhound.attribution import enrich_creators +from bloodhound.aws import create_clients +from bloodhound.budget import compute_budget_snapshot +from bloodhound.config import load_config, validate_config +from bloodhound.controls import get_spending_controls_snapshot +from bloodhound.costs import enrich_records, get_mtd_cost_snapshot +from bloodhound.messages import ( + format_budget_message, + format_cost_breakdown_message, + format_resource_table_message, + format_scan_message, + format_spending_controls_message, + format_teardown_plan_message, + format_teardown_result_message, + format_whitelist_config_message, +) +from bloodhound.scanner.regions import discover_regions, select_regions +from bloodhound.scanner.scan_all import scan_all +from bloodhound.slack import SlackNotifier +from bloodhound.teardown.executor import execute_actions +from bloodhound.teardown.planner import plan_deletions +from bloodhound.report_format import LocalReportWriter, markdown_to_slack +from bloodhound.whitelist import filter_whitelisted + + +def run(event: Any, context: Any) -> dict[str, Any]: + if isinstance(event, dict) and event.get("source") == "slack_command": + mode = (event.get("mode") or "").strip() + # Guardrail management is its own flow — it does not scan/teardown. + if mode == "guard": + return _run_guard(event) + os.environ["BLOODHOUND_RUN_MODE"] = mode + if mode == "seek": + os.environ["APPLY_CHANGES"] = "false" + os.environ["TEARDOWN_SIMULATE"] = "true" + os.environ["TEARDOWN_ALLOW_ALL"] = "false" + elif mode == "seek_destroy": + os.environ["APPLY_CHANGES"] = "true" + os.environ["TEARDOWN_SIMULATE"] = "false" + os.environ["TEARDOWN_ALLOW_ALL"] = "true" + elif mode in {"whitelist", "seek_cost"}: + os.environ["APPLY_CHANGES"] = "false" + os.environ["TEARDOWN_SIMULATE"] = "true" + os.environ["TEARDOWN_ALLOW_ALL"] = "false" + + cfg = load_config() + errors = validate_config(cfg) + if errors: + return {"ok": False, "errors": errors} + + run_mode = os.environ.get("BLOODHOUND_RUN_MODE", "seek") + whitelist_only = run_mode == "whitelist" + cost_only = run_mode == "seek_cost" + print_reports = _env_bool("BLOODHOUND_PRINT_REPORTS", False) + report_format = os.environ.get("BLOODHOUND_REPORT_FORMAT", "markdown").strip().lower() + report_dir = os.environ.get("BLOODHOUND_REPORT_DIR", "reports") + attribution_enabled = _env_bool("ATTRIBUTION_ENABLED", True) + + local_report = LocalReportWriter( + enabled=print_reports, + output_format=report_format, + report_dir=report_dir, + mode=run_mode, + ) + + def _done(result: dict[str, Any]) -> dict[str, Any]: + report_path = local_report.flush() + if report_path: + result["report_path"] = str(report_path) + print(f"\nReport written to: {report_path}") + return result + + clients = create_clients(profile=cfg.aws.profile) + slack = None + if cfg.slack.enabled: + slack = SlackNotifier.from_token( + bot_token=cfg.slack.bot_token, + scan_channel_id=cfg.slack.scan_channel_id, + alert_channel_id=cfg.slack.alert_channel_id, + ) + + def emit(title: str, body: str, *, channel: str = "scan") -> None: + if print_reports: + print(local_report.add(title, body)) + if not slack: + return + slack_body = markdown_to_slack(body) + if channel == "alert": + slack.post_alert(slack_body) + else: + slack.post_scan(slack_body) + + discovered = None + if cfg.regions.mode == "discover": + discovered = discover_regions(clients) + regions = select_regions(cfg.regions.mode, cfg.regions.regions, discovered_regions=discovered) + + raw_by_region = scan_all(clients, regions=regions, rds_final_snapshot=cfg.teardown.rds_final_snapshot) + candidates_by_region: dict[str, list] = {} + kept_by_region: dict[str, list] = {} + kept_reasons = {} + + for region, records in raw_by_region.items(): + enriched = enrich_records(records) + if attribution_enabled: + enriched = enrich_creators(clients, enriched) + candidates, kept, reasons = filter_whitelisted(enriched, cfg.whitelist) + candidates_by_region[region] = candidates + kept_by_region[region] = kept + kept_reasons.update(reasons) + + all_candidates = [r for region in sorted(candidates_by_region) for r in candidates_by_region[region]] + all_kept = [r for region in sorted(kept_by_region) for r in kept_by_region[region]] + all_active = all_candidates + all_kept + mtd_snapshot = get_mtd_cost_snapshot(clients) + + emit("Whitelist config", format_whitelist_config_message(cfg.whitelist)) + emit( + "Cost breakdown", + format_cost_breakdown_message( + mtd_snapshot, + active_records=all_active, + candidate_records=all_candidates, + kept_records=all_kept, + ), + ) + controls_snapshot = get_spending_controls_snapshot(clients) + emit("Spending controls", format_spending_controls_message(controls_snapshot)) + + if cost_only: + budget_snapshot = compute_budget_snapshot( + clients, + cohort_start_yyyy_mm=cfg.budget.cohort_start_yyyy_mm, + cohort_total_budget_usd=cfg.budget.cohort_total_budget_usd, + cohort_length_months=cfg.budget.cohort_length_months, + budget_over_days=cfg.budget.budget_over_days, + ) + emit("Budget summary", format_budget_message(budget_snapshot), channel="alert") + return _done( + { + "ok": True, + "mode": "seek_cost", + "scan": { + "candidates_total": len(all_candidates), + "kept_total": sum(len(v) for v in kept_by_region.values()), + }, + "budget": { + "projected_month_end_spend_usd": budget_snapshot.projected_month_end_spend_usd, + "dynamic_monthly_allowance_usd": budget_snapshot.dynamic_monthly_allowance_usd, + }, + } + ) + + emit("Scan summary", format_scan_message(candidates_by_region, kept_by_region)) + + actions, _manual = plan_deletions(all_candidates) + emit( + "Teardown plan", + format_teardown_plan_message( + candidates_by_region, + apply_changes=cfg.teardown.apply_changes, + simulate=cfg.teardown.simulate, + targets_filter_count=len(cfg.teardown.target_ids), + allow_all=cfg.teardown.allow_all_targets, + ), + channel="alert", + ) + emit( + "Whitelisted resources", + format_resource_table_message( + "Bloodhound v2 — Whitelisted Resources (Kept)", + kept_by_region, + match_reasons=kept_reasons, + ), + ) + + if whitelist_only: + return _done( + { + "ok": True, + "mode": "whitelist", + "scan": { + "candidates_total": len(all_candidates), + "kept_total": sum(len(v) for v in kept_by_region.values()), + }, + } + ) + + budget_snapshot = compute_budget_snapshot( + clients, + cohort_start_yyyy_mm=cfg.budget.cohort_start_yyyy_mm, + cohort_total_budget_usd=cfg.budget.cohort_total_budget_usd, + cohort_length_months=cfg.budget.cohort_length_months, + budget_over_days=cfg.budget.budget_over_days, + ) + emit("Budget summary", format_budget_message(budget_snapshot), channel="alert") + + exec_summary = None + if cfg.teardown.apply_changes: + actions_to_execute = actions + if cfg.teardown.target_ids: + targets = cfg.teardown.target_ids + actions_to_execute = [ + a + for a in actions + if (a.id in targets) or (a.arn and a.arn in targets) or (_action_key(a) in targets) + ] + + exec_result = execute_actions(clients, actions_to_execute, simulate=cfg.teardown.simulate) + exec_summary = { + "attempted": exec_result.attempted, + "succeeded": exec_result.succeeded, + "failed": exec_result.failed, + "simulated": exec_result.simulated, + "failures": exec_result.failures[:20], + "targets_filter": sorted(cfg.teardown.target_ids) if cfg.teardown.target_ids else None, + "planned_actions_total": len(actions), + "executed_actions_total": len(actions_to_execute), + "allow_all_targets": cfg.teardown.allow_all_targets, + } + emit( + "Teardown results", + format_teardown_result_message( + attempted=exec_result.attempted, + succeeded=exec_result.succeeded, + failed=exec_result.failed, + simulated=exec_result.simulated, + ) + + "\n" + + json.dumps(exec_summary, indent=2), + channel="alert", + ) + + return _done( + { + "ok": True, + "mode": run_mode, + "regions": regions, + "scan": { + "candidates_total": sum(len(v) for v in candidates_by_region.values()), + "kept_total": sum(len(v) for v in kept_by_region.values()), + }, + "budget": { + "projected_month_end_spend_usd": budget_snapshot.projected_month_end_spend_usd, + "dynamic_monthly_allowance_usd": budget_snapshot.dynamic_monthly_allowance_usd, + "over_budget_threshold_met": budget_snapshot.over_budget_threshold_met, + }, + "teardown": { + "apply_changes": cfg.teardown.apply_changes, + "simulate": cfg.teardown.simulate, + "targets_filter": sorted(cfg.teardown.target_ids) if cfg.teardown.target_ids else None, + "planned_actions": len(actions), + "execution": exec_summary, + }, + } + ) + + +def _run_guard(event: Any) -> dict[str, Any]: + """Handle a `/guard` slash command: parse, execute against AWS, post result to Slack.""" + from bloodhound.guard import GuardEngine, parse_command + + cfg = load_config() + clients = create_clients(profile=cfg.aws.profile) + + text = ((event.get("slack") or {}).get("text") or "").strip() + sub, args = parse_command(text) + result_md = GuardEngine(clients).run(sub, args) + + print(result_md) + if cfg.slack.enabled and cfg.slack.bot_token: + slack = SlackNotifier.from_token( + bot_token=cfg.slack.bot_token, + scan_channel_id=cfg.slack.scan_channel_id, + alert_channel_id=cfg.slack.alert_channel_id, + ) + slack.post_alert(markdown_to_slack(result_md)) + + return {"ok": True, "mode": "guard", "subcommand": sub} + + +def _action_key(a) -> str: + if a.arn: + return a.arn + return f"{a.service}:{a.region}:{a.id}" + + +def _env_bool(name: str, default: bool = False) -> bool: + raw = os.environ.get(name) + if raw is None: + return default + return raw.strip().lower() in {"1", "true", "t", "yes", "y", "on"} diff --git a/bloodhound/attribution.py b/bloodhound/attribution.py new file mode 100644 index 0000000..f4e41ae --- /dev/null +++ b/bloodhound/attribution.py @@ -0,0 +1,103 @@ +""" +bloodhound/attribution.py + +Best-effort creator attribution via CloudTrail lookup_events. +Requires CloudTrail enabled in the account/region (management events). +""" + +from __future__ import annotations + +from datetime import datetime, timedelta, timezone + +from bloodhound.aws import AwsClients +from bloodhound.types import ResourceRecord + +CREATE_EVENTS: dict[tuple[str, str], list[str]] = { + ("ec2", "instance"): ["RunInstances"], + ("ec2", "ebs_volume"): ["CreateVolume"], + ("ec2", "elastic_ip"): ["AllocateAddress"], + ("ec2", "nat_gateway"): ["CreateNatGateway"], + ("rds", "db_instance"): ["CreateDBInstance"], + ("elbv2", "load_balancer"): ["CreateLoadBalancer"], +} + + +def _identity_from_user_identity(ui: dict) -> str: + if ui.get("userName"): + return str(ui["userName"]) + if ui.get("arn"): + arn = str(ui["arn"]) + if "/" in arn: + return arn.rsplit("/", 1)[-1] + return arn + if ui.get("type") == "AssumedRole" and ui.get("sessionContext"): + session = ui["sessionContext"] or {} + issuer = (session.get("sessionIssuer") or {}).get("userName") + if issuer: + return f"role:{issuer}" + return "unknown" + + +def lookup_creator(clients: AwsClients, record: ResourceRecord, *, lookback_days: int = 90) -> str | None: + ct = clients.client("cloudtrail", region=record.region) + start = datetime.now(timezone.utc) - timedelta(days=lookback_days) + event_names = CREATE_EVENTS.get((record.service, record.resource_type), []) + + lookups: list[tuple[str, str]] = [("ResourceName", record.id)] + if record.arn: + lookups.append(("ResourceName", record.arn)) + + for attr_key, attr_value in lookups: + try: + kwargs: dict = { + "LookupAttributes": [{"AttributeKey": attr_key, "AttributeValue": attr_value}], + "StartTime": start, + "MaxResults": 10, + } + if event_names: + # CloudTrail only supports one lookup attribute per call; filter client-side. + resp = ct.lookup_events(**kwargs) + else: + resp = ct.lookup_events(**kwargs) + + events = resp.get("Events") or [] + if event_names: + events = [e for e in events if e.get("EventName") in event_names] or events + + if not events: + continue + + # Oldest matching create event ≈ creator. + oldest = sorted(events, key=lambda e: e.get("EventTime") or datetime.now(timezone.utc))[0] + import json + + detail = json.loads(oldest.get("CloudTrailEvent") or "{}") + return _identity_from_user_identity(detail.get("userIdentity") or {}) + except Exception: + continue + return None + + +def enrich_creator(clients: AwsClients, record: ResourceRecord) -> ResourceRecord: + creator = lookup_creator(clients, record) + if not creator: + return record + meta = dict(record.metadata) + meta["created_by"] = creator + return ResourceRecord( + service=record.service, + resource_type=record.resource_type, + region=record.region, + id=record.id, + arn=record.arn, + state=record.state, + tags=record.tags, + metadata=meta, + delete_supported=record.delete_supported, + delete_action=record.delete_action, + delete_params=record.delete_params, + ) + + +def enrich_creators(clients: AwsClients, records: list[ResourceRecord]) -> list[ResourceRecord]: + return [enrich_creator(clients, r) for r in records] diff --git a/bloodhound/aws.py b/bloodhound/aws.py new file mode 100644 index 0000000..0318846 --- /dev/null +++ b/bloodhound/aws.py @@ -0,0 +1,38 @@ +""" +bloodhound/aws.py + +Thin AWS session/client helpers for Bloodhound v2. + +In Lambda: credentials come from the execution role. +Locally: you can use AWS_PROFILE via environment variables. +""" + +from __future__ import annotations + +from dataclasses import dataclass +from typing import Optional + +import boto3 + + +@dataclass(frozen=True) +class AwsClients: + session: boto3.Session + + def client(self, service: str, region: Optional[str] = None): + if region: + return self.session.client(service, region_name=region) + return self.session.client(service) + + +def create_session(profile: Optional[str] = None, region: Optional[str] = None) -> boto3.Session: + # In Lambda, profile should be None and the execution role creds will be used. + if profile: + return boto3.Session(profile_name=profile, region_name=region) + return boto3.Session(region_name=region) + + +def create_clients(profile: Optional[str] = None, region: Optional[str] = None) -> AwsClients: + return AwsClients(session=create_session(profile=profile, region=region)) + + diff --git a/bloodhound/budget.py b/bloodhound/budget.py new file mode 100644 index 0000000..a4f8996 --- /dev/null +++ b/bloodhound/budget.py @@ -0,0 +1,208 @@ +""" +bloodhound/budget.py + +Budget/projection logic for Bloodhound v2. + +Uses Cost Explorer (CE) to compute: +- cohort-to-date spend +- dynamic monthly allowance based on remaining budget/months +- simple month-end projection from daily spend run-rate +""" + +from __future__ import annotations + +import calendar +from dataclasses import dataclass +from datetime import date, datetime, timedelta + +from bloodhound.aws import AwsClients + + +@dataclass(frozen=True) +class BudgetSnapshot: + cohort_start_yyyy_mm: str + cohort_total_budget_usd: float + cohort_length_months: int + + cohort_to_date_spend_usd: float + remaining_cohort_budget_usd: float + remaining_months: int + dynamic_monthly_allowance_usd: float + + current_month_to_date_spend_usd: float + projected_month_end_spend_usd: float + + budget_over_days: int + over_budget_threshold_met: bool + + +def compute_budget_snapshot( + clients: AwsClients, + cohort_start_yyyy_mm: str, + cohort_total_budget_usd: float, + cohort_length_months: int, + budget_over_days: int, + today: date | None = None, +) -> BudgetSnapshot: + today = today or date.today() + + start_year, start_month = _parse_yyyy_mm(cohort_start_yyyy_mm) + cohort_start = date(start_year, start_month, 1) + + # Cost Explorer is effectively "global"; us-east-1 is the common boto3 convention. + ce = clients.client("ce", region="us-east-1") + + # Cohort-to-date spend (monthly granularity). + cohort_to_date = _get_cost_monthly_total(ce, start=cohort_start, end=today + timedelta(days=1)) + + # Current month daily spend for: + # - month-to-date spend + # - "over budget X days" calculation without needing a database + month_start = date(today.year, today.month, 1) + daily_costs = _get_cost_daily(ce, start=month_start, end=today + timedelta(days=1)) + mtd_spend = sum(daily_costs.values()) + + remaining_budget = max(0.0, cohort_total_budget_usd - cohort_to_date) + remaining_months = _remaining_months(cohort_start, cohort_length_months, today) + allowance = remaining_budget / remaining_months if remaining_months > 0 else remaining_budget + + # Run-rate projection: assumes current pace continues to month end. + projected_month_end = _project_month_end(mtd_spend, today) + over_met = _over_budget_threshold_met( + daily_costs=daily_costs, + days_in_month=calendar.monthrange(today.year, today.month)[1], + monthly_allowance_usd=allowance, + budget_over_days=budget_over_days, + ) + + return BudgetSnapshot( + cohort_start_yyyy_mm=cohort_start_yyyy_mm, + cohort_total_budget_usd=cohort_total_budget_usd, + cohort_length_months=cohort_length_months, + cohort_to_date_spend_usd=cohort_to_date, + remaining_cohort_budget_usd=remaining_budget, + remaining_months=remaining_months, + dynamic_monthly_allowance_usd=allowance, + current_month_to_date_spend_usd=mtd_spend, + projected_month_end_spend_usd=projected_month_end, + budget_over_days=budget_over_days, + over_budget_threshold_met=over_met, + ) + + +def _parse_yyyy_mm(raw: str) -> tuple[int, int]: + try: + dt = datetime.strptime(raw, "%Y-%m") + return dt.year, dt.month + except ValueError: + # Fall back to current month; validation should catch missing/invalid. + today = date.today() + return today.year, today.month + + +def _to_ce_date(d: date) -> str: + return d.strftime("%Y-%m-%d") + + +def _get_cost_monthly_total(ce_client, start: date, end: date) -> float: + """ + Returns the sum of monthly UnblendedCost between [start, end) dates. + Cost Explorer end is exclusive. + """ + resp = ce_client.get_cost_and_usage( + TimePeriod={"Start": _to_ce_date(start), "End": _to_ce_date(end)}, + Granularity="MONTHLY", + Metrics=["UnblendedCost"], + ) + total = 0.0 + for r in resp.get("ResultsByTime", []) or []: + amt = ((r.get("Total") or {}).get("UnblendedCost") or {}).get("Amount") + if not amt: + continue + try: + total += float(amt) + except ValueError: + continue + return total + + +def _get_cost_daily(ce_client, start: date, end: date) -> dict[date, float]: + """ + Returns a mapping of day -> UnblendedCost between [start, end). + """ + resp = ce_client.get_cost_and_usage( + TimePeriod={"Start": _to_ce_date(start), "End": _to_ce_date(end)}, + Granularity="DAILY", + Metrics=["UnblendedCost"], + ) + out: dict[date, float] = {} + for r in resp.get("ResultsByTime", []) or []: + start_str = (r.get("TimePeriod") or {}).get("Start") + if not start_str: + continue + try: + day = datetime.strptime(start_str, "%Y-%m-%d").date() + except ValueError: + continue + amt = ((r.get("Total") or {}).get("UnblendedCost") or {}).get("Amount") + try: + out[day] = float(amt) if amt is not None else 0.0 + except ValueError: + out[day] = 0.0 + return out + + +def _remaining_months(cohort_start: date, cohort_length_months: int, today: date) -> int: + """ + Remaining months INCLUDING current month, clamped to at least 1 while inside cohort. + """ + months_elapsed = (today.year - cohort_start.year) * 12 + (today.month - cohort_start.month) + remaining = cohort_length_months - months_elapsed + return max(1, remaining) + + +def _project_month_end(mtd_spend_usd: float, today: date) -> float: + days_in_month = calendar.monthrange(today.year, today.month)[1] + days_elapsed = max(1, today.day) + return (mtd_spend_usd / days_elapsed) * days_in_month + + +def _over_budget_threshold_met( + daily_costs: dict[date, float], + days_in_month: int, + monthly_allowance_usd: float, + budget_over_days: int, +) -> bool: + """ + Minimal, state-free approach: + - Look at the last N days present in daily_costs. + - For each day, compute what the month-end projection would be at that point. + - If all N projections exceed monthly_allowance_usd, threshold is met. + """ + if budget_over_days <= 0: + return False + if not daily_costs: + return False + + days = sorted(daily_costs.keys()) + last_days = days[-budget_over_days:] + if len(last_days) < budget_over_days: + return False + + # cumulative spend up to each day (inclusive) + cumulative = 0.0 + day_to_cumulative: dict[date, float] = {} + for d in days: + cumulative += daily_costs.get(d, 0.0) + day_to_cumulative[d] = cumulative + + for d in last_days: + days_elapsed = d.day + if days_elapsed <= 0: + return False + projection = (day_to_cumulative[d] / days_elapsed) * days_in_month + if projection <= monthly_allowance_usd: + return False + return True + + diff --git a/bloodhound/config.py b/bloodhound/config.py new file mode 100644 index 0000000..fa259b5 --- /dev/null +++ b/bloodhound/config.py @@ -0,0 +1,242 @@ +""" +bloodhound/config.py + +Configuration loader for Bloodhound v2. + +Reads configuration from environment variables and (for local runs) a `.env` file. +All non-code “knobs” (channels, regions, whitelist tag, teardown flags, cohort config) +should live here so the rest of the code stays clean. +""" + +from __future__ import annotations + +import os +from dataclasses import dataclass +from typing import Optional + +from dotenv import load_dotenv + +def _env(name: str, default: Optional[str] = None) -> Optional[str]: + value = os.environ.get(name) + if value is None: + return default + value = value.strip() + return value if value != "" else default + + +def _env_bool(name: str, default: bool = False) -> bool: + raw = _env(name) + if raw is None: + return default + return raw.lower() in {"1", "true", "t", "yes", "y", "on"} + + +def _env_int(name: str, default: int) -> int: + raw = _env(name) + if raw is None: + return default + try: + return int(raw) + except ValueError: + return default + + +def _env_float(name: str, default: float) -> float: + raw = _env(name) + if raw is None: + return default + try: + return float(raw) + except ValueError: + return default + + +def _split_csv(raw: Optional[str]) -> list[str]: + if not raw: + return [] + return [x.strip() for x in raw.split(",") if x.strip()] + + +def _parse_tag_rules(raw: Optional[str], legacy_key: str, legacy_value: str) -> list[tuple[str, str]]: + rules: list[tuple[str, str]] = [] + for item in _split_csv(raw): + if "=" not in item: + continue + key, value = item.split("=", 1) + key, value = key.strip(), value.strip() + if key and value: + rules.append((key, value)) + if not rules: + rules.append((legacy_key, legacy_value)) + return rules + + +def _split_patterns(raw: Optional[str]) -> list[str]: + return [x.strip() for x in _split_csv(raw) if x.strip()] + + +@dataclass(frozen=True) +class SlackConfig: + bot_token: str + scan_channel_id: str + alert_channel_id: str + enabled: bool + + +@dataclass(frozen=True) +class RegionConfig: + mode: str # explicit | discover + regions: list[str] + + +@dataclass(frozen=True) +class WhitelistConfig: + keep_tag_rules: list[tuple[str, str]] + keep_name_patterns: list[str] + keep_resource_ids: set[str] + + +@dataclass(frozen=True) +class TeardownConfig: + apply_changes: bool + simulate: bool + target_ids: set[str] + allow_all_targets: bool + teardown_mode: str # delete (future: stop) + rds_final_snapshot: bool + max_delete_count: int # safety limit for number of deletions per run + + +@dataclass(frozen=True) +class BudgetConfig: + cohort_start_yyyy_mm: str + cohort_total_budget_usd: float + cohort_length_months: int + budget_over_days: int + + +@dataclass(frozen=True) +class AwsConfig: + # Optional local-only convenience; Lambda ignores this unless you explicitly set it. + profile: Optional[str] + + +@dataclass(frozen=True) +class AppConfig: + slack: SlackConfig + regions: RegionConfig + whitelist: WhitelistConfig + teardown: TeardownConfig + budget: BudgetConfig + aws: AwsConfig + + +def load_config() -> AppConfig: + # Load local .env for developer convenience. In Lambda, env vars are provided by the runtime. + load_dotenv(override=False) + + slack_enabled = _env_bool("SLACK_ENABLED", True) + slack_bot_token = _env("SLACK_BOT_TOKEN") or "" + # Backwards compat with v1 env var: + v1_channel_id = _env("CHANNEL_ID") + scan_channel_id = _env("SLACK_SCAN_CHANNEL_ID") or v1_channel_id or "" + alert_channel_id = _env("SLACK_ALERT_CHANNEL_ID") or scan_channel_id + + region_mode = (_env("REGION_MODE", "explicit") or "explicit").lower() + regions = _split_csv(_env("REGIONS")) + + keep_tag_key = _env("KEEP_TAG_KEY", "bloodhound:keep") or "bloodhound:keep" + keep_tag_value = _env("KEEP_TAG_VALUE", "true") or "true" + keep_tag_rules = _parse_tag_rules(_env("KEEP_TAG_RULES"), keep_tag_key, keep_tag_value) + keep_name_patterns = _split_patterns( + _env( + "KEEP_NAME_PATTERNS", + "buffalo,fullstack,vetlaunch,dont-touch,do-not-touch,dont_touch", + ) + ) + keep_resource_ids = set(_split_csv(_env("KEEP_RESOURCE_IDS"))) + + apply_changes = _env_bool("APPLY_CHANGES", False) + simulate = _env_bool("TEARDOWN_SIMULATE", False) + target_ids = set(_split_csv(_env("TEARDOWN_TARGET_IDS"))) + allow_all_targets = _env_bool("TEARDOWN_ALLOW_ALL", False) + teardown_mode = (_env("TEARDOWN_MODE", "delete") or "delete").lower() + rds_final_snapshot = _env_bool("RDS_FINAL_SNAPSHOT", False) + + # Safety guard: prevent large accidental deletions. + # If a teardown plan exceeds this number, execution will stop. + max_delete_count = _env_int("TEARDOWN_MAX_DELETE_COUNT", 5) + + cohort_start_yyyy_mm = _env("COHORT_START_YYYY_MM", "") or "" + cohort_total_budget_usd = _env_float("COHORT_TOTAL_BUDGET_USD", 3000.0) + cohort_length_months = _env_int("COHORT_LENGTH_MONTHS", 7) + budget_over_days = max(1, _env_int("BUDGET_OVER_DAYS", 2)) + + profile = _env("AWS_PROFILE") + + return AppConfig( + slack=SlackConfig( + bot_token=slack_bot_token, + scan_channel_id=scan_channel_id, + alert_channel_id=alert_channel_id, + enabled=slack_enabled, + ), + regions=RegionConfig(mode=region_mode, regions=regions), + whitelist=WhitelistConfig( + keep_tag_rules=keep_tag_rules, + keep_name_patterns=keep_name_patterns, + keep_resource_ids=keep_resource_ids, + ), + teardown=TeardownConfig( + apply_changes=apply_changes, + simulate=simulate, + target_ids=target_ids, + allow_all_targets=allow_all_targets, + teardown_mode=teardown_mode, + rds_final_snapshot=rds_final_snapshot, + max_delete_count=max_delete_count, + ), + budget=BudgetConfig( + cohort_start_yyyy_mm=cohort_start_yyyy_mm, + cohort_total_budget_usd=cohort_total_budget_usd, + cohort_length_months=cohort_length_months, + budget_over_days=budget_over_days, + ), + aws=AwsConfig(profile=profile), + ) + + +def validate_config(cfg: AppConfig) -> list[str]: + errors: list[str] = [] + + if cfg.slack.enabled: + if not cfg.slack.bot_token: + errors.append("Missing SLACK_BOT_TOKEN") + if not cfg.slack.scan_channel_id: + errors.append("Missing SLACK_SCAN_CHANNEL_ID (or CHANNEL_ID for v1 compatibility)") + + if cfg.regions.mode not in {"explicit", "discover"}: + errors.append("REGION_MODE must be 'explicit' or 'discover'") + if cfg.regions.mode == "explicit" and not cfg.regions.regions: + errors.append("REGION_MODE=explicit requires REGIONS to be set") + + if cfg.teardown.teardown_mode not in {"delete"}: + errors.append("TEARDOWN_MODE currently supports only 'delete' in v2.0") + + if cfg.teardown.apply_changes and not cfg.teardown.simulate and not cfg.teardown.allow_all_targets: + if not cfg.teardown.target_ids: + errors.append( + "APPLY_CHANGES=true requires TEARDOWN_TARGET_IDS to be set (comma-separated IDs/ARNs) " + "unless TEARDOWN_ALLOW_ALL=true" + ) + + if not cfg.budget.cohort_start_yyyy_mm: + errors.append("Missing COHORT_START_YYYY_MM (e.g. 2026-01)") + if cfg.budget.cohort_length_months <= 0: + errors.append("COHORT_LENGTH_MONTHS must be > 0") + if cfg.budget.cohort_total_budget_usd <= 0: + errors.append("COHORT_TOTAL_BUDGET_USD must be > 0") + + return errors + + diff --git a/bloodhound/controls.py b/bloodhound/controls.py new file mode 100644 index 0000000..a0f33b3 --- /dev/null +++ b/bloodhound/controls.py @@ -0,0 +1,329 @@ +""" +bloodhound/controls.py + +Spending-controls / guardrails inventory. + +Answers: "are spending limits actually locked in place, and for which OUs, +accounts, Groups, and Users?" Pulls: + +- AWS Budgets (the spending caps) +- AWS Budgets Actions (the enforcement that *blocks* spend, and whether it is + AUTOMATIC = locked, or MANUAL = needs a human to approve) +- For SCP/IAM enforcement: what API actions are denied, and which OUs / accounts + / IAM Groups / Users / Roles the guardrail applies to + +Everything is best-effort: each AWS call is wrapped so a missing permission +degrades to a note instead of failing the whole run. +""" + +from __future__ import annotations + +import json +from dataclasses import dataclass, field + +from bloodhound.aws import AwsClients + +# Budget action statuses that mean the guardrail has actually fired / is enforcing. +ACTIVE_ACTION_STATUSES = { + "PENDING", + "EXECUTION_IN_PROGRESS", + "EXECUTION_SUCCESS", +} + + +@dataclass(frozen=True) +class BudgetCap: + name: str + budget_type: str + limit_usd: float + actual_usd: float + forecast_usd: float | None + time_unit: str + + @property + def pct_used(self) -> float: + if self.limit_usd <= 0: + return 0.0 + return round(self.actual_usd / self.limit_usd * 100, 1) + + @property + def over(self) -> bool: + return self.limit_usd > 0 and self.actual_usd > self.limit_usd + + +@dataclass(frozen=True) +class EnforcementAction: + budget_name: str + action_id: str + action_type: str # APPLY_SCP_POLICY | APPLY_IAM_POLICY | RUN_SSM_DOCUMENTS + approval_model: str # AUTOMATIC | MANUAL + status: str + threshold_value: float + threshold_type: str # PERCENTAGE | ABSOLUTE_VALUE + policy_id: str | None = None + policy_name: str | None = None + policy_desc: str | None = None + denied_actions: list[str] = field(default_factory=list) + ec2_allowed_instance_types: list[str] = field(default_factory=list) + target_ids: list[str] = field(default_factory=list) + target_names: list[str] = field(default_factory=list) + iam_groups: list[str] = field(default_factory=list) + iam_users: list[str] = field(default_factory=list) + iam_roles: list[str] = field(default_factory=list) + + @property + def locked(self) -> bool: + """AUTOMATIC enforcement fires with no human approval — i.e. locked in place.""" + return self.approval_model.upper() == "AUTOMATIC" + + @property + def active(self) -> bool: + """The guardrail has tripped and is currently enforcing.""" + return self.status.upper() in ACTIVE_ACTION_STATUSES + + +@dataclass(frozen=True) +class SpendingControlsSnapshot: + account_id: str + caps: list[BudgetCap] + actions: list[EnforcementAction] + iam_group_names: list[str] + iam_user_count: int + notes: list[str] = field(default_factory=list) + + @property + def locked_actions(self) -> list[EnforcementAction]: + return [a for a in self.actions if a.locked] + + @property + def all_locked(self) -> bool: + return bool(self.actions) and all(a.locked for a in self.actions) + + +def get_spending_controls_snapshot(clients: AwsClients, account_id: str | None = None) -> SpendingControlsSnapshot: + notes: list[str] = [] + + if not account_id: + try: + account_id = clients.client("sts").get_caller_identity()["Account"] + except Exception as exc: # noqa: BLE001 + account_id = "unknown" + notes.append(f"Could not resolve account id: {exc}") + + # Budgets + budget actions live in the global (us-east-1) endpoint. + budgets = clients.client("budgets", region="us-east-1") + org = clients.client("organizations", region="us-east-1") + iam = clients.client("iam") + + caps = _fetch_caps(budgets, account_id, notes) + actions = _fetch_actions(budgets, org, account_id, notes) + iam_group_names, iam_user_count = _fetch_iam_principals(iam, notes) + + return SpendingControlsSnapshot( + account_id=account_id, + caps=caps, + actions=actions, + iam_group_names=iam_group_names, + iam_user_count=iam_user_count, + notes=notes, + ) + + +def _fetch_caps(budgets, account_id: str, notes: list[str]) -> list[BudgetCap]: + caps: list[BudgetCap] = [] + try: + paginator = budgets.get_paginator("describe_budgets") + pages = paginator.paginate(AccountId=account_id) + except Exception as exc: # noqa: BLE001 + notes.append(f"describe_budgets unavailable: {exc}") + return caps + + try: + for page in pages: + for b in page.get("Budgets", []) or []: + calc = b.get("CalculatedSpend") or {} + caps.append( + BudgetCap( + name=b.get("BudgetName") or "unnamed", + budget_type=b.get("BudgetType") or "unknown", + limit_usd=_amt((b.get("BudgetLimit") or {}).get("Amount")), + actual_usd=_amt((calc.get("ActualSpend") or {}).get("Amount")), + forecast_usd=_amt_opt((calc.get("ForecastedSpend") or {}).get("Amount")), + time_unit=b.get("TimeUnit") or "unknown", + ) + ) + except Exception as exc: # noqa: BLE001 + notes.append(f"describe_budgets error: {exc}") + caps.sort(key=lambda c: -c.limit_usd) + return caps + + +def _fetch_actions(budgets, org, account_id: str, notes: list[str]) -> list[EnforcementAction]: + raw_actions: list[dict] = [] + try: + paginator = budgets.get_paginator("describe_budget_actions_for_account") + for page in paginator.paginate(AccountId=account_id): + raw_actions.extend(page.get("Actions", []) or []) + except Exception as exc: # noqa: BLE001 + notes.append(f"describe_budget_actions_for_account unavailable: {exc}") + return [] + + actions: list[EnforcementAction] = [] + for a in raw_actions: + threshold = a.get("ActionThreshold") or {} + definition = a.get("Definition") or {} + action_type = a.get("ActionType") or "unknown" + + policy_id = policy_name = policy_desc = None + denied: list[str] = [] + ec2_allowed: list[str] = [] + target_ids: list[str] = [] + target_names: list[str] = [] + iam_groups: list[str] = [] + iam_users: list[str] = [] + iam_roles: list[str] = [] + + scp = definition.get("ScpActionDefinition") + iam_def = definition.get("IamActionDefinition") + ssm = definition.get("SsmActionDefinition") + + if scp: + policy_id = scp.get("PolicyId") + target_ids = list(scp.get("TargetIds") or []) + policy_name, policy_desc, denied, ec2_allowed = _describe_scp(org, policy_id, notes) + target_names = _resolve_targets(org, target_ids, notes) + elif iam_def: + policy_id = iam_def.get("PolicyArn") + policy_name = (policy_id or "").split("/")[-1] or policy_id + iam_groups = list(iam_def.get("Groups") or []) + iam_users = list(iam_def.get("Users") or []) + iam_roles = list(iam_def.get("Roles") or []) + elif ssm: + policy_name = f"SSM {ssm.get('ActionSubType') or ''}".strip() + target_ids = list(ssm.get("InstanceIds") or []) + + actions.append( + EnforcementAction( + budget_name=a.get("BudgetName") or "unknown", + action_id=a.get("ActionId") or "unknown", + action_type=action_type, + approval_model=a.get("ApprovalModel") or "unknown", + status=a.get("Status") or "unknown", + threshold_value=_amt(threshold.get("ActionThresholdValue")), + threshold_type=threshold.get("ActionThresholdType") or "unknown", + policy_id=policy_id, + policy_name=policy_name, + policy_desc=policy_desc, + denied_actions=denied, + ec2_allowed_instance_types=ec2_allowed, + target_ids=target_ids, + target_names=target_names, + iam_groups=iam_groups, + iam_users=iam_users, + iam_roles=iam_roles, + ) + ) + return actions + + +def _describe_scp(org, policy_id: str | None, notes: list[str]) -> tuple[str | None, str | None, list[str], list[str]]: + if not policy_id: + return None, None, [], [] + try: + resp = org.describe_policy(PolicyId=policy_id) + except Exception as exc: # noqa: BLE001 + notes.append(f"describe_policy({policy_id}) unavailable: {exc}") + return policy_id, None, [], [] + + policy = resp.get("Policy") or {} + summary = policy.get("PolicySummary") or {} + name = summary.get("Name") or policy_id + desc = summary.get("Description") + denied, ec2_allowed = _parse_scp_content(policy.get("Content")) + return name, desc, denied, ec2_allowed + + +def _parse_scp_content(content: str | None) -> tuple[list[str], list[str]]: + """Pull denied actions and any EC2 instance-type allowlist out of an SCP document.""" + if not content: + return [], [] + try: + doc = json.loads(content) + except (ValueError, TypeError): + return [], [] + + denied: list[str] = [] + ec2_allowed: list[str] = [] + statements = doc.get("Statement") + if isinstance(statements, dict): + statements = [statements] + for stmt in statements or []: + if (stmt.get("Effect") or "").lower() != "deny": + continue + actions = stmt.get("Action") + if isinstance(actions, str): + actions = [actions] + for act in actions or []: + if act not in denied: + denied.append(act) + cond = stmt.get("Condition") or {} + for op_vals in cond.values(): + if not isinstance(op_vals, dict): + continue + for key, vals in op_vals.items(): + if "instancetype" in key.lower(): + if isinstance(vals, str): + vals = [vals] + for v in vals: + if v not in ec2_allowed: + ec2_allowed.append(v) + return denied, ec2_allowed + + +def _resolve_targets(org, target_ids: list[str], notes: list[str]) -> list[str]: + names: list[str] = [] + for tid in target_ids: + label = tid + try: + if tid.startswith("ou-"): + resp = org.describe_organizational_unit(OrganizationalUnitId=tid) + label = (resp.get("OrganizationalUnit") or {}).get("Name") or tid + elif tid.isdigit(): + resp = org.describe_account(AccountId=tid) + label = (resp.get("Account") or {}).get("Name") or tid + except Exception: # noqa: BLE001 — best effort; fall back to raw id + label = tid + names.append(label) + return names + + +def _fetch_iam_principals(iam, notes: list[str]) -> tuple[list[str], int]: + groups: list[str] = [] + user_count = 0 + try: + for page in iam.get_paginator("list_groups").paginate(): + groups.extend(g.get("GroupName") for g in page.get("Groups", []) or [] if g.get("GroupName")) + except Exception as exc: # noqa: BLE001 + notes.append(f"list_groups unavailable: {exc}") + try: + for page in iam.get_paginator("list_users").paginate(): + user_count += len(page.get("Users", []) or []) + except Exception as exc: # noqa: BLE001 + notes.append(f"list_users unavailable: {exc}") + return groups, user_count + + +def _amt(raw) -> float: + try: + return float(raw) if raw is not None else 0.0 + except (ValueError, TypeError): + return 0.0 + + +def _amt_opt(raw) -> float | None: + if raw is None: + return None + try: + return float(raw) + except (ValueError, TypeError): + return None diff --git a/bloodhound/costs.py b/bloodhound/costs.py new file mode 100644 index 0000000..96a578d --- /dev/null +++ b/bloodhound/costs.py @@ -0,0 +1,240 @@ +""" +bloodhound/costs.py + +Cost estimation for scanned resources and MTD service breakdown from Cost Explorer. +""" + +from __future__ import annotations + +from dataclasses import dataclass +from datetime import date, datetime, timedelta, timezone + +from bloodhound.aws import AwsClients +from bloodhound.types import ResourceRecord + + +@dataclass(frozen=True) +class MtdCostSnapshot: + """Actual account billing from Cost Explorer for the current calendar month.""" + + period_start: date + period_end_inclusive: date + by_service: dict[str, float] + + @property + def total_usd(self) -> float: + return round(sum(self.by_service.values()), 2) + + +# Rough on-demand us-east-1 monthly estimates (USD). Intentionally conservative. +EC2_HOURLY: dict[str, float] = { + "t2.micro": 0.0116, + "t2.small": 0.023, + "t3.micro": 0.0104, + "t3.small": 0.0208, + "t3.medium": 0.0416, + "t3.large": 0.0832, + "t3.xlarge": 0.1664, + "m5.large": 0.096, + "m5.xlarge": 0.192, +} + +RDS_HOURLY: dict[str, float] = { + "db.t3.micro": 0.018, + "db.t3.small": 0.036, + "db.t4g.micro": 0.016, + "db.t4g.small": 0.032, + "db.t3.medium": 0.072, + "db.m5.large": 0.171, +} + +# EBS $/GB-month by volume type (us-east-1 base). Provisioned IOPS/throughput excluded. +EBS_GB_RATE: dict[str, float] = { + "gp3": 0.08, + "gp2": 0.10, + "io1": 0.125, + "io2": 0.125, + "st1": 0.045, + "sc1": 0.015, + "standard": 0.05, +} + +# ELB base $/hour by type (us-east-1). LCU/data charges are excluded (no metrics here). +ELB_HOURLY: dict[str, float] = { + "application": 0.0225, + "network": 0.0225, + "gateway": 0.0125, +} + +# Per-region multiplier applied to us-east-1 base rates. Approximate — replace with the +# AWS Price List API for exact figures. US/standard regions ~1.0; others scaled up. +REGION_MULTIPLIER: dict[str, float] = { + "us-east-1": 1.00, + "us-east-2": 1.00, + "us-west-2": 1.00, + "us-west-1": 1.08, + "ca-central-1": 1.05, + "eu-west-1": 1.06, + "eu-west-2": 1.07, + "eu-central-1": 1.08, + "ap-south-1": 0.95, + "ap-southeast-1": 1.10, + "ap-southeast-2": 1.12, + "ap-northeast-1": 1.12, + "sa-east-1": 1.40, +} +DEFAULT_REGION_MULTIPLIER = 1.10 + +HOURS_PER_MONTH = 730 + +# Forward-looking rolling window used for projections. +WINDOW_DAYS = 30 +DAYS_PER_MONTH_AVG = 30.4375 # 365.25 / 12 + + +def region_multiplier(region: str | None) -> float: + return REGION_MULTIPLIER.get(region or "", DEFAULT_REGION_MULTIPLIER) + + +def _ebs_gb_rate(vol_type: str | None) -> float: + return EBS_GB_RATE.get((vol_type or "gp3").lower(), 0.10) + + +def get_mtd_cost_snapshot(clients: AwsClients, today: date | None = None) -> MtdCostSnapshot: + today = today or date.today() + month_start = date(today.year, today.month, 1) + ce = clients.client("ce", region="us-east-1") + resp = ce.get_cost_and_usage( + TimePeriod={ + "Start": month_start.strftime("%Y-%m-%d"), + "End": (today + timedelta(days=1)).strftime("%Y-%m-%d"), + }, + Granularity="MONTHLY", + Metrics=["UnblendedCost"], + GroupBy=[{"Type": "DIMENSION", "Key": "SERVICE"}], + ) + out: dict[str, float] = {} + for period in resp.get("ResultsByTime", []) or []: + for group in period.get("Groups", []) or []: + service = (group.get("Keys") or ["Unknown"])[0] + amt = ((group.get("Metrics") or {}).get("UnblendedCost") or {}).get("Amount") + try: + out[service] = float(amt) if amt else 0.0 + except ValueError: + out[service] = 0.0 + return MtdCostSnapshot( + period_start=month_start, + period_end_inclusive=today, + by_service=dict(sorted(out.items(), key=lambda x: -x[1])), + ) + + +def get_mtd_cost_by_service(clients: AwsClients, today: date | None = None) -> dict[str, float]: + return get_mtd_cost_snapshot(clients, today=today).by_service + + +def estimate_monthly_cost_usd(record: ResourceRecord) -> float: + meta = record.metadata + svc = record.service + rtype = record.resource_type + + mult = region_multiplier(record.region) + + if svc == "ec2" and rtype == "instance": + itype = str(meta.get("instance_type") or "t3.micro") + hourly = EC2_HOURLY.get(itype, 0.05) + compute = hourly * HOURS_PER_MONTH * mult + # Include attached EBS — it is billed (and deleted) with the instance. + ebs = 0.0 + for vol in meta.get("attached_ebs") or []: + ebs += float(vol.get("size_gb") or 0) * _ebs_gb_rate(vol.get("volume_type")) * mult + return round(compute + ebs, 2) + + if svc == "ec2" and rtype == "ebs_volume": + size = float(meta.get("size_gb") or 8) + return round(size * _ebs_gb_rate(meta.get("volume_type")) * mult, 2) + + if svc == "ec2" and rtype == "elastic_ip": + return round(3.65 * mult, 2) + + if svc == "ec2" and rtype == "nat_gateway": + # Base hourly only ($0.045/hr); per-GB data processing excluded. + return round(0.045 * HOURS_PER_MONTH * mult, 2) + + if svc == "rds" and rtype == "db_instance": + cls = str(meta.get("instance_class") or "db.t3.micro") + storage = float(meta.get("allocated_storage_gb") or 20) + hourly = RDS_HOURLY.get(cls, 0.02) + az_factor = 2.0 if meta.get("multi_az") else 1.0 + compute = hourly * HOURS_PER_MONTH * az_factor * mult + storage_cost = storage * 0.115 * az_factor * mult + return round(compute + storage_cost, 2) + + if svc == "elbv2" and rtype == "load_balancer": + lb_type = str(meta.get("type") or "application").lower() + hourly = ELB_HOURLY.get(lb_type, 0.0225) + return round(hourly * HOURS_PER_MONTH * mult, 2) + + return 0.0 + + +def estimate_forward_window_usd(record: ResourceRecord, days: int = WINDOW_DAYS) -> float: + """Projected cost over a rolling forward window, assuming the resource stays as-is. + + Built from the monthly run-rate and prorated to the window length, so a 30-day + window answers: "if this stays live and unchanged, what does it cost over the next + 30 days?" + """ + monthly = estimate_monthly_cost_usd(record) + return round(monthly * days / DAYS_PER_MONTH_AVG, 2) + + +def enrich_record_cost(record: ResourceRecord) -> ResourceRecord: + est = estimate_monthly_cost_usd(record) + meta = dict(record.metadata) + meta["est_monthly_usd"] = est + meta["est_forward_30d_usd"] = estimate_forward_window_usd(record) + return ResourceRecord( + service=record.service, + resource_type=record.resource_type, + region=record.region, + id=record.id, + arn=record.arn, + state=record.state, + tags=record.tags, + metadata=meta, + delete_supported=record.delete_supported, + delete_action=record.delete_action, + delete_params=record.delete_params, + ) + + +def enrich_records(records: list[ResourceRecord]) -> list[ResourceRecord]: + return [enrich_record_cost(r) for r in records] + + +def format_age(meta: dict) -> str: + raw = meta.get("created_at") or meta.get("launch_time") + if not raw: + return "unknown" + try: + if isinstance(raw, datetime): + created = raw if raw.tzinfo else raw.replace(tzinfo=timezone.utc) + else: + created = datetime.fromisoformat(str(raw).replace("Z", "+00:00")) + days = max(0, (datetime.now(timezone.utc) - created).days) + if days == 0: + return "<1d" + if days < 30: + return f"{days}d" + return f"{days // 30}mo {days % 30}d" + except (ValueError, TypeError): + return "unknown" + + +def sum_estimated_monthly(records: list[ResourceRecord]) -> float: + return round(sum(float(r.metadata.get("est_monthly_usd") or 0) for r in records), 2) + + +def sum_forward_30d(records: list[ResourceRecord]) -> float: + return round(sum(float(r.metadata.get("est_forward_30d_usd") or 0) for r in records), 2) diff --git a/bloodhound/guard.py b/bloodhound/guard.py new file mode 100644 index 0000000..909119c --- /dev/null +++ b/bloodhound/guard.py @@ -0,0 +1,536 @@ +""" +bloodhound/guard.py + +Cost-guard management — the "/guard" Slack command. + +A *guardrail* is a named, two-layer spend control: + - an Organizations **SCP** (e.g. `cp-org-spend-stop`) -> restricts member accounts + under its target OUs/accounts + - an IAM **managed policy attached to a group** (e.g. `cp-aico-echo-cost-guard` on + `aico-echo-class`) -> restricts IAM users in the management account + +Both layers historically carry the SAME deny list. `/guard` edits BOTH together so they +can never drift apart — drift is exactly what once left RDS blocked for IAM-user students +even after the SCP was loosened. + +Subcommands +----------- + list all guardrails: layers, attachments, denied services + show full detail for one guardrail + members list users in the guardrail's group + allow remove a service from the deny lists (unblock) [mutation] + deny add a service to the deny lists (block) [mutation] + enable (re)attach the IAM policy to its group [mutation] + disable detach the IAM policy from its group [mutation] + add-student add a user to the group [mutation] + remove-student remove a user from the group [mutation] + +Safety +------ +- Mutations require the caller to be in GUARD_ALLOWED_USER_IDS (falls back to + SLACK_ALLOWED_USER_IDS). If neither is set, mutations are refused (fail-safe) — the + command is reachable from a public Lambda Function URL. +- `allow` / `deny` only touch services in GUARD_TOGGLEABLE_SERVICES, so a Slack message + can never toggle iam:* / organizations:* / ec2 instance-type caps, etc. + +Tiers (phase 2) +--------------- +Each guardrail carries a `tier` field. Today everything is one tier ("core"); adding +2-3 tiers later is config (GUARD_REGISTRY), not a rewrite. +""" + +from __future__ import annotations + +import json +import os +import urllib.parse +from dataclasses import dataclass, field + +from bloodhound.aws import AwsClients +from bloodhound.tables import md_table + +# --- configuration (env-driven; self-contained like slack_commands.py) ---------------- + +_DEFAULT_REGISTRY = [ + { + "name": "cost-guard", + "tier": "core", + "scp": "cp-org-spend-stop", + "iam_policy": "cp-aico-echo-cost-guard", + "group": "aico-echo-class", + } +] + +# Services that allow/deny may toggle. Deliberately excludes iam, organizations, ec2, etc. +_DEFAULT_TOGGLEABLE = [ + "rds", "redshift", "neptune-db", "dax", "memorydb", + "sagemaker", "bedrock", "bedrock-runtime", "bedrock-agent-runtime", + "eks", "elasticmapreduce", "es", "aoss", "q", "deepracer", "forecast", + "frauddetector", "kendra", "comprehendmedical", "healthlake", "omics", "braket", +] + +MUTATION_SUBCOMMANDS = { + "allow", "deny", "enable", "disable", "add-student", "remove-student", +} + +_ALIASES = { + "": "help", "help": "help", + "list": "list", "ls": "list", + "show": "show", + "members": "members", "who": "members", + "allow": "allow", "unblock": "allow", + "deny": "deny", "block": "deny", + "enable": "enable", + "disable": "disable", + "add-student": "add-student", "add": "add-student", + "remove-student": "remove-student", "remove": "remove-student", "rm": "remove-student", +} + + +def _split_csv(raw: str | None) -> list[str]: + return [x.strip() for x in (raw or "").split(",") if x.strip()] + + +@dataclass(frozen=True) +class GuardrailDef: + name: str + tier: str + scp: str | None + iam_policy: str | None + group: str | None + + +def load_registry() -> list[GuardrailDef]: + raw = os.environ.get("GUARD_REGISTRY", "").strip() + entries = _DEFAULT_REGISTRY + if raw: + try: + parsed = json.loads(raw) + if isinstance(parsed, list) and parsed: + entries = parsed + except ValueError: + pass + out: list[GuardrailDef] = [] + for e in entries: + out.append( + GuardrailDef( + name=e.get("name") or "guardrail", + tier=e.get("tier") or "core", + scp=e.get("scp"), + iam_policy=e.get("iam_policy"), + group=e.get("group"), + ) + ) + return out + + +def toggleable_services() -> list[str]: + override = _split_csv(os.environ.get("GUARD_TOGGLEABLE_SERVICES")) + return override or list(_DEFAULT_TOGGLEABLE) + + +def parse_command(text: str) -> tuple[str, list[str]]: + tokens = (text or "").strip().split() + if not tokens: + return "help", [] + sub = _ALIASES.get(tokens[0].lower(), tokens[0].lower()) + return sub, tokens[1:] + + +def user_allowed_to_mutate(user_id: str) -> bool: + allowed = _split_csv( + os.environ.get("GUARD_ALLOWED_USER_IDS") or os.environ.get("SLACK_ALLOWED_USER_IDS") + ) + return bool(allowed) and user_id in allowed # fail-safe: empty allowlist => no mutations + + +# --- low-level AWS helpers (best-effort; surface notes instead of crashing) ------------ + + +def _org(clients: AwsClients): + return clients.client("organizations", region="us-east-1") + + +def _iam(clients: AwsClients): + return clients.client("iam") + + +def _find_scp_id(org, name: str | None) -> str | None: + if not name: + return None + try: + paginator = org.get_paginator("list_policies") + for page in paginator.paginate(Filter="SERVICE_CONTROL_POLICY"): + for p in page.get("Policies", []) or []: + if p.get("Name") == name: + return p.get("Id") + except Exception: # noqa: BLE001 + return None + return None + + +def _find_iam_policy_arn(iam, name: str | None) -> str | None: + if not name: + return None + try: + paginator = iam.get_paginator("list_policies") + for page in paginator.paginate(Scope="Local"): + for p in page.get("Policies", []) or []: + if p.get("PolicyName") == name: + return p.get("Arn") + except Exception: # noqa: BLE001 + return None + return None + + +def _scp_document(org, policy_id: str) -> dict: + content = (org.describe_policy(PolicyId=policy_id).get("Policy") or {}).get("Content") + return json.loads(content) if content else {"Version": "2012-10-17", "Statement": []} + + +def _iam_document(iam, arn: str) -> dict: + ver = iam.get_policy(PolicyArn=arn)["Policy"]["DefaultVersionId"] + doc = iam.get_policy_version(PolicyArn=arn, VersionId=ver)["PolicyVersion"]["Document"] + if isinstance(doc, str): + doc = json.loads(urllib.parse.unquote(doc)) + return doc + + +def _statements(doc: dict) -> list[dict]: + stmts = doc.get("Statement") + if isinstance(stmts, dict): + return [stmts] + return stmts or [] + + +def _actions(stmt: dict) -> list[str]: + acts = stmt.get("Action") + if isinstance(acts, list): + return acts + return [acts] if acts else [] + + +def _denied_services(doc: dict) -> list[str]: + svcs: set[str] = set() + for s in _statements(doc): + if (s.get("Effect") or "").lower() != "deny": + continue + for a in _actions(s): + if a: + svcs.add(a.split(":")[0]) + return sorted(svcs) + + +def _remove_service(doc: dict, service: str) -> list[str]: + """Strip every Deny action whose service prefix == `service`. Returns removed actions.""" + removed: list[str] = [] + for s in _statements(doc): + if (s.get("Effect") or "").lower() != "deny": + continue + original = _actions(s) + kept = [] + for a in original: + if a and a.split(":")[0] == service: + removed.append(a) + else: + kept.append(a) + if len(kept) != len(original): + s["Action"] = kept + # Drop now-empty deny statements (keep everything else). + doc["Statement"] = [ + s for s in _statements(doc) + if (s.get("Effect") or "").lower() != "deny" or _actions(s) + ] + return removed + + +def _add_service(doc: dict, service: str) -> str | None: + """Add `:*` to a wildcard-resource Deny statement. Returns added action or None.""" + action = f"{service}:*" + target = None + for s in _statements(doc): + if (s.get("Effect") or "").lower() == "deny" and s.get("Resource") in ("*", ["*"]): + target = s + break + if target is None: + target = {"Sid": "GuardManagedDenies", "Effect": "Deny", "Action": [], "Resource": "*"} + doc.setdefault("Statement", []).append(target) + acts = _actions(target) + if any(a and a.split(":")[0] == service for a in acts): + return None # already covered + acts.append(action) + target["Action"] = acts + return action + + +def _put_scp(org, policy_id: str, doc: dict) -> None: + org.update_policy(PolicyId=policy_id, Content=json.dumps(doc)) + + +def _put_iam(iam, arn: str, doc: dict) -> str: + """Create + set-as-default a new policy version, pruning the oldest if at the 5-version cap.""" + versions = iam.list_policy_versions(PolicyArn=arn).get("Versions", []) + if len(versions) >= 5: + nondefault = sorted( + (v for v in versions if not v.get("IsDefaultVersion")), + key=lambda v: v.get("CreateDate"), + ) + if nondefault: + iam.delete_policy_version(PolicyArn=arn, VersionId=nondefault[0]["VersionId"]) + resp = iam.create_policy_version( + PolicyArn=arn, PolicyDocument=json.dumps(doc), SetAsDefault=True + ) + return resp["PolicyVersion"]["VersionId"] + + +def _scp_targets(org, policy_id: str) -> list[tuple[str, str]]: + out: list[tuple[str, str]] = [] + paginator = org.get_paginator("list_targets_for_policy") + for page in paginator.paginate(PolicyId=policy_id): + for t in page.get("Targets", []) or []: + out.append((t.get("Type", ""), t.get("Name", t.get("TargetId", "")))) + return out + + +def _group_has_policy(iam, group: str, arn: str) -> bool: + paginator = iam.get_paginator("list_attached_group_policies") + for page in paginator.paginate(GroupName=group): + for p in page.get("AttachedPolicies", []) or []: + if p.get("PolicyArn") == arn: + return True + return False + + +def _group_members(iam, group: str) -> list[str]: + out: list[str] = [] + paginator = iam.get_paginator("get_group") + for page in paginator.paginate(GroupName=group): + out.extend(u.get("UserName") for u in page.get("Users", []) or [] if u.get("UserName")) + return out + + +# --- engine ---------------------------------------------------------------------------- + + +@dataclass +class GuardEngine: + clients: AwsClients + registry: list[GuardrailDef] = field(default_factory=load_registry) + + def run(self, sub: str, args: list[str]) -> str: + try: + if sub == "help": + return _help() + if sub == "list": + return self.list_all() + if sub == "show": + return self.show(self._need_name(args)) + if sub == "members": + return self.members(self._need_name(args)) + if sub == "allow": + return self.toggle(self._need_name(args), self._need_arg(args, 1, "service"), block=False) + if sub == "deny": + return self.toggle(self._need_name(args), self._need_arg(args, 1, "service"), block=True) + if sub == "enable": + return self.set_enabled(self._need_name(args), enabled=True) + if sub == "disable": + return self.set_enabled(self._need_name(args), enabled=False) + if sub == "add-student": + return self.student(self._need_name(args), self._need_arg(args, 1, "user"), add=True) + if sub == "remove-student": + return self.student(self._need_name(args), self._need_arg(args, 1, "user"), add=False) + return f"Unknown subcommand `{sub}`.\n\n" + _help() + except _GuardError as exc: + return f"⚠️ {exc}" + + # -- resolution -- + + def _get_def(self, name: str) -> GuardrailDef: + for d in self.registry: + if d.name == name: + return d + names = ", ".join(f"`{d.name}`" for d in self.registry) or "(none configured)" + raise _GuardError(f"No guardrail named `{name}`. Known: {names}") + + def _need_name(self, args: list[str]) -> str: + if args: + return args[0] + if len(self.registry) == 1: + return self.registry[0].name # convenience: single guardrail is implied + raise _GuardError("Specify a guardrail name. Try `/guard list`.") + + @staticmethod + def _need_arg(args: list[str], idx: int, label: str) -> str: + if len(args) > idx: + return args[idx] + raise _GuardError(f"Missing `<{label}>`.") + + # -- read ops -- + + def list_all(self) -> str: + org, iam = _org(self.clients), _iam(self.clients) + rows: list[list[object]] = [] + for d in self.registry: + scp_id = _find_scp_id(org, d.scp) + iam_arn = _find_iam_policy_arn(iam, d.iam_policy) + scp_denied = iam_denied = "—" + attaches: list[str] = [] + if scp_id: + try: + scp_denied = ", ".join(_denied_services(_scp_document(org, scp_id))) or "none" + n = len(_scp_targets(org, scp_id)) + attaches.append(f"SCP→{n} OU/acct") + except Exception: # noqa: BLE001 + scp_denied = "?" + if iam_arn and d.group: + try: + iam_denied = ", ".join(_denied_services(_iam_document(iam, iam_arn))) or "none" + on = "on" if _group_has_policy(iam, d.group, iam_arn) else "OFF" + attaches.append(f"IAM→{d.group} ({on})") + except Exception: # noqa: BLE001 + iam_denied = "?" + rows.append([d.name, d.tier, " ; ".join(attaches) or "—", scp_denied, iam_denied]) + body = md_table( + ["Guardrail", "Tier", "Attached to", "SCP denies", "IAM denies"], rows + ) + return _header("Guardrails") + body + ( + "\n\n_Two layers per guardrail: **SCP** gates member accounts, " + "**IAM** policy gates IAM-user students in the mgmt account. " + "`/guard show ` for detail._" + ) + + def show(self, name: str) -> str: + d = self._get_def(name) + org, iam = _org(self.clients), _iam(self.clients) + out = [_header(f"Guardrail: {d.name} (tier: {d.tier})")] + + scp_id = _find_scp_id(org, d.scp) + if scp_id: + doc = _scp_document(org, scp_id) + targets = _scp_targets(org, scp_id) + out.append(f"**SCP `{d.scp}`** (`{scp_id}`)") + out.append("Applies to: " + (", ".join(f"{t}:{n}" for t, n in targets) or "—")) + out.append("Denied: " + (", ".join(_denied_services(doc)) or "none")) + out.append("") + elif d.scp: + out.append(f"**SCP `{d.scp}`** — not found.\n") + + iam_arn = _find_iam_policy_arn(iam, d.iam_policy) + if iam_arn: + doc = _iam_document(iam, iam_arn) + on = _group_has_policy(iam, d.group, iam_arn) if d.group else False + out.append(f"**IAM policy `{d.iam_policy}`** → group `{d.group}` " + f"({'attached/ON' if on else 'detached/OFF'})") + out.append("Denied: " + (", ".join(_denied_services(doc)) or "none")) + if d.group: + members = _group_members(iam, d.group) + out.append(f"Group members ({len(members)}): " + (", ".join(members) or "—")) + elif d.iam_policy: + out.append(f"**IAM policy `{d.iam_policy}`** — not found.") + return "\n".join(out) + + def members(self, name: str) -> str: + d = self._get_def(name) + if not d.group: + raise _GuardError(f"`{name}` has no group configured.") + members = _group_members(_iam(self.clients), d.group) + return _header(f"Members of `{d.group}` ({len(members)})") + ( + "\n".join(f"- {m}" for m in members) or "_No members._" + ) + + # -- mutations -- + + def toggle(self, name: str, service: str, *, block: bool) -> str: + d = self._get_def(name) + service = service.lower().rstrip(":*") + allowed = toggleable_services() + if service not in allowed: + raise _GuardError( + f"`{service}` is not a toggleable service. Allowed: {', '.join(allowed)}" + ) + org, iam = _org(self.clients), _iam(self.clients) + verb = "deny" if block else "allow" + lines = [_header(f"/guard {verb} {d.name} {service}")] + + scp_id = _find_scp_id(org, d.scp) + if scp_id: + doc = _scp_document(org, scp_id) + changed = _add_service(doc, service) if block else _remove_service(doc, service) + if changed: + _put_scp(org, scp_id, doc) + detail = changed if isinstance(changed, str) else ", ".join(changed) + lines.append(f"- SCP `{d.scp}`: {'added' if block else 'removed'} {detail}") + else: + lines.append(f"- SCP `{d.scp}`: no change") + + iam_arn = _find_iam_policy_arn(iam, d.iam_policy) + if iam_arn: + doc = _iam_document(iam, iam_arn) + changed = _add_service(doc, service) if block else _remove_service(doc, service) + if changed: + ver = _put_iam(iam, iam_arn, doc) + detail = changed if isinstance(changed, str) else ", ".join(changed) + lines.append(f"- IAM `{d.iam_policy}`: {'added' if block else 'removed'} {detail} (now {ver})") + else: + lines.append(f"- IAM `{d.iam_policy}`: no change") + + lines.append("") + lines.append( + f"{'🔒' if block else '✅'} `{service}` is now {'blocked' if block else 'allowed'} " + f"across both layers of `{d.name}`." + ) + return "\n".join(lines) + + def set_enabled(self, name: str, *, enabled: bool) -> str: + d = self._get_def(name) + if not (d.iam_policy and d.group): + raise _GuardError(f"`{name}` has no IAM policy/group to enable/disable.") + iam = _iam(self.clients) + arn = _find_iam_policy_arn(iam, d.iam_policy) + if not arn: + raise _GuardError(f"IAM policy `{d.iam_policy}` not found.") + if enabled: + iam.attach_group_policy(GroupName=d.group, PolicyArn=arn) + state = "attached to" + else: + iam.detach_group_policy(GroupName=d.group, PolicyArn=arn) + state = "detached from" + return _header(f"/guard {'enable' if enabled else 'disable'} {d.name}") + ( + f"IAM policy `{d.iam_policy}` {state} group `{d.group}`.\n\n" + f"_Note: the SCP layer is governed by its AWS Budgets action, not toggled here._" + ) + + def student(self, name: str, user: str, *, add: bool) -> str: + d = self._get_def(name) + if not d.group: + raise _GuardError(f"`{name}` has no group configured.") + iam = _iam(self.clients) + if add: + iam.add_user_to_group(GroupName=d.group, UserName=user) + msg = f"Added `{user}` to `{d.group}`." + else: + iam.remove_user_from_group(GroupName=d.group, UserName=user) + msg = f"Removed `{user}` from `{d.group}`." + return _header(f"/guard {'add-student' if add else 'remove-student'} {d.name} {user}") + msg + + +class _GuardError(Exception): + pass + + +def _header(title: str) -> str: + return f"**Bloodhound — {title}**\n\n" + + +def _help() -> str: + return ( + "*`/guard` — cost-guard management*\n" + "• `/guard list` — all guardrails + what they block\n" + "• `/guard show ` — full detail\n" + "• `/guard members ` — users in the group\n" + "• `/guard allow ` — unblock a service _(admin)_\n" + "• `/guard deny ` — block a service _(admin)_\n" + "• `/guard enable|disable ` — attach/detach the IAM policy _(admin)_\n" + "• `/guard add-student|remove-student ` _(admin)_\n" + "\n_With one guardrail configured, `` can be omitted._" + ) diff --git a/bloodhound/handlers/__init__.py b/bloodhound/handlers/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/bloodhound/handlers/scheduled_handler.py b/bloodhound/handlers/scheduled_handler.py new file mode 100644 index 0000000..0140110 --- /dev/null +++ b/bloodhound/handlers/scheduled_handler.py @@ -0,0 +1,42 @@ +""" +scheduled_handler.py + +Handles scheduled scan events for Bloodhound. + +This handler is triggered when the Lambda function is invoked +by a scheduler (GitHub Actions cron or future EventBridge rule). +""" + +def handle_scheduled_event(event, context=None): + """ + Executes a scheduled Bloodhound scan. + + This function currently acts as a simple pass-through + to the main Bloodhound application runtime. + + Parameters + ---------- + event : dict + Lambda event payload + context : object + Lambda execution context + + Returns + ------- + dict + Result of scheduled scan execution + """ + + print("Scheduled Bloodhound scan triggered") + print("Event payload:", event) + + # Import here to avoid circular imports + from bloodhound.app import run_scheduled_scan + + # Execute scheduled scan directly (no generic run path) + result = run_scheduled_scan() + + return { + "status": "scheduled_scan_executed", + "result": result + } \ No newline at end of file diff --git a/bloodhound/handlers/slack_handler.py b/bloodhound/handlers/slack_handler.py new file mode 100644 index 0000000..4b70330 --- /dev/null +++ b/bloodhound/handlers/slack_handler.py @@ -0,0 +1,60 @@ +""" +Slack command handler. + +Interprets Slack slash commands and configures runtime +environment flags so the Bloodhound pipeline executes +in the correct operational mode. +""" + +import os + + +def handle_slack_event(event): + """ + Apply Slack command overrides. + + Slack commands never directly execute infrastructure + operations. They only modify runtime flags before + the main pipeline runs. + """ + + mode = (event.get("mode") or "").strip() + + # ------------------------------------------------------------ + # /v2_seek + # + # Scan-only safe mode. + # - performs resource scan + # - generates teardown plan + # - no deletion allowed + # ------------------------------------------------------------ + if mode == "seek": + + os.environ["APPLY_CHANGES"] = "false" + os.environ["TEARDOWN_SIMULATE"] = "true" + os.environ["TEARDOWN_ALLOW_ALL"] = "false" + + # ------------------------------------------------------------ + # /v2_seek_destroy_plan + # + # Preview deletion(teardown) plan but do not execute. + # - still safe mode + # ------------------------------------------------------------ + elif mode == "seek_destroy_plan": + + os.environ["APPLY_CHANGES"] = "false" + os.environ["TEARDOWN_SIMULATE"] = "true" + os.environ["TEARDOWN_ALLOW_ALL"] = "true" + + # ------------------------------------------------------------ + # /v2_seek_destroy_execute + # + # Execute destructive teardown. + # - executes real AWS deletion APIs + # - deletes all non-whitelisted resources + # ------------------------------------------------------------ + elif mode == "seek_destroy_execute": + + os.environ["APPLY_CHANGES"] = "true" + os.environ["TEARDOWN_SIMULATE"] = "false" + os.environ["TEARDOWN_ALLOW_ALL"] = "true" \ No newline at end of file diff --git a/bloodhound/handlers/validation_handler.py b/bloodhound/handlers/validation_handler.py new file mode 100644 index 0000000..f2c4333 --- /dev/null +++ b/bloodhound/handlers/validation_handler.py @@ -0,0 +1,66 @@ +""" +Validation event handler. + +Responsible for preparing the runtime environment for +validation harness executions. + +This ensures validation runs: +- are only triggered by automation +- restrict deletion to explicit validation targets +""" + +import os + + +def handle_validation_event(event): + """ + Prepare environment for validation teardown runs. + + This function performs safety checks and sets environment + overrides so the rest of the Bloodhound pipeline behaves + exactly like a real destructive run — but restricted to + validation resources. + """ + + + # ------------------------------------------------------------ + # Validation invocation guard + # + # Ensure validation mode can ONLY be triggered by the + # validation harness or CI workflow. Slack commands and + # other invocation sources must never trigger validation. + # ------------------------------------------------------------ + if event.get("source") != "validation": + raise RuntimeError( + "Validation events must originate from validation harness" + ) + + # ------------------------------------------------------------ + # Validate invocation mode + # ------------------------------------------------------------ + if event.get("mode") != "seek_destroy_validation": + raise RuntimeError( + "Invalid validation invocation mode." + ) + + # ------------------------------------------------------------ + # Validation requires explicit resource targets + # ------------------------------------------------------------ + target_ids = event.get("target_ids", []) + + if not target_ids: + raise RuntimeError( + "Validation mode requires target_ids" + ) + + # ------------------------------------------------------------ + # Override runtime configuration + # + # This forces Bloodhound into destructive execution mode + # while restricting deletions to validation targets only. + # ------------------------------------------------------------ + os.environ["APPLY_CHANGES"] = "true" + os.environ["TEARDOWN_SIMULATE"] = "false" + os.environ["TEARDOWN_ALLOW_ALL"] = "false" + + os.environ["TEARDOWN_TARGET_IDS"] = ",".join(target_ids) \ No newline at end of file diff --git a/bloodhound/messages.py b/bloodhound/messages.py new file mode 100644 index 0000000..13f149a --- /dev/null +++ b/bloodhound/messages.py @@ -0,0 +1,631 @@ +""" +bloodhound/messages.py + +Report formatting for Bloodhound v2 (markdown-native; converted for Slack on post). +""" + +from __future__ import annotations + +from collections import defaultdict +from datetime import datetime +from zoneinfo import ZoneInfo + +from bloodhound.budget import BudgetSnapshot +from bloodhound.config import WhitelistConfig +from bloodhound.controls import SpendingControlsSnapshot +from bloodhound.costs import MtdCostSnapshot, format_age, sum_forward_30d +from bloodhound.tables import md_table +from bloodhound.types import ResourceRecord, resource_display_name, resource_key +from bloodhound.whitelist import WhitelistMatch, format_whitelist_rules + + +SCANNED_RESOURCE_TYPES_ORDER: list[tuple[str, str]] = [ + ("ec2", "instance"), + ("rds", "db_instance"), + ("ec2", "elastic_ip"), + ("ec2", "nat_gateway"), + ("ec2", "ebs_volume"), + ("elbv2", "load_balancer"), +] + +_ET = ZoneInfo("America/New_York") + + +def _et_now_time_str() -> str: + return datetime.now(_ET).strftime("%-I:%M %p ET") + + +def _header(title: str) -> list[str]: + return [f"**{title}**", f"**time_et**: {_et_now_time_str()}", ""] + + +def _resource_type_label(r: ResourceRecord) -> str: + return f"{r.service}.{r.resource_type}" + + +def _resource_detail(r: ResourceRecord) -> str: + return str( + r.metadata.get("instance_type") + or r.metadata.get("instance_class") + or r.metadata.get("size_gb") + or "" + ) + + +def _resource_table_rows( + records: list[ResourceRecord], + *, + extra_column: str | None = None, + extra_value, +) -> list[list[object]]: + rows: list[list[object]] = [] + for r in sorted(records, key=lambda x: (x.region, x.service, x.resource_type, x.id)): + row = [ + r.region, + _resource_type_label(r), + r.id, + resource_display_name(r), + r.state or "", + format_age(r.metadata), + r.metadata.get("created_by") or "", + _resource_detail(r), + ] + if extra_column: + if callable(extra_value): + row.append(extra_value(r)) + else: + row.append(extra_value or "") + rows.append(row) + return rows + + +def format_cost_breakdown_message( + mtd: MtdCostSnapshot, + *, + active_records: list[ResourceRecord] | None = None, + candidate_records: list[ResourceRecord] | None = None, + kept_records: list[ResourceRecord] | None = None, +) -> str: + lines = _header("Bloodhound v2 — Cost Breakdown") + + lines.append( + md_table( + ["Field", "Value"], + [ + ["Current month start", mtd.period_start.strftime("%Y-%m-%d")], + ["Current month end", mtd.period_end_inclusive.strftime("%Y-%m-%d")], + ["Period note", "MTD end date is today (inclusive); sourced from AWS Cost Explorer"], + ], + ) + ) + lines.append("") + lines.append("**Current month — actual charges (MTD)**") + lines.append("") + lines.append( + "Account-wide charges for the current calendar month to date. Includes deleted " + "resources, VPC, data transfer, tax, and services Bloodhound does not scan." + ) + lines.append("") + + if not mtd.by_service: + lines.append("No Cost Explorer data returned.") + else: + total = mtd.total_usd + rows: list[list[object]] = [] + for service, cost in mtd.by_service.items(): + if cost < 0.01: + continue + pct = (cost / total * 100) if total else 0 + rows.append([service, f"${cost:,.2f}", f"{pct:.0f}%"]) + rows.append(["**Total billed MTD**", f"**${total:,.2f}**", "**100%**"]) + lines.append(md_table(["Service", "MTD", "% of total"], rows)) + + if active_records is not None: + candidates = candidate_records or [] + kept = kept_records or [] + lines.append("") + lines.append("**Forward rolling 30-day window (projected run-rate)**") + lines.append("") + lines.append( + "Projected spend over the **next 30 days** if every resource Bloodhound found " + "**live right now** stays running unchanged. Region-aware on-demand list prices " + "(includes attached EBS) — excludes VPC, data transfer, tax, ELB LCUs, " + "RIs/Savings Plans, and anything Bloodhound does not scan. **Not actual billing.**" + ) + lines.append("") + + summary_rows: list[list[object]] = [ + [ + "All active scanned", + len(active_records), + f"~${sum_forward_30d(active_records):,.2f}/30d", + ], + [ + "Teardown candidates", + len(candidates), + f"~${sum_forward_30d(candidates):,.2f}/30d", + ], + [ + "Kept (whitelisted)", + len(kept), + f"~${sum_forward_30d(kept):,.2f}/30d", + ], + ] + lines.append(md_table(["Group", "Resources", "Est. next 30d"], summary_rows)) + + by_type: dict[tuple[str, str], list[ResourceRecord]] = defaultdict(list) + for r in active_records: + by_type[(r.service, r.resource_type)].append(r) + + type_rows: list[list[object]] = [] + for svc, rtype in SCANNED_RESOURCE_TYPES_ORDER: + items = by_type.get((svc, rtype), []) + if not items: + continue + type_rows.append([f"{svc}.{rtype}", len(items), f"~${sum_forward_30d(items):,.2f}/30d"]) + if type_rows: + lines.append("") + lines.append("**By resource type**") + lines.append("") + lines.append(md_table(["Type", "Resources", "Est. next 30d"], type_rows)) + + return "\n".join(lines) + + +def format_scan_message( + resources_by_region: dict[str, list[ResourceRecord]], + whitelisted_by_region: dict[str, list[ResourceRecord]], +) -> str: + lines = _header("Bloodhound v2 — Scan Summary") + + total_found = 0 + total_whitelisted = 0 + totals_candidates: dict[tuple[str, str], int] = defaultdict(int) + totals_kept: dict[tuple[str, str], int] = defaultdict(int) + + region_rows: list[list[object]] = [] + for region in sorted(set(resources_by_region.keys()) | set(whitelisted_by_region.keys())): + resources = resources_by_region.get(region, []) + kept = whitelisted_by_region.get(region, []) + total_found += len(resources) + total_whitelisted += len(kept) + for r in resources: + totals_candidates[(r.service, r.resource_type)] += 1 + for r in kept: + totals_kept[(r.service, r.resource_type)] += 1 + region_rows.append([region, len(resources), len(kept)]) + + region_rows.append(["**Total**", f"**{total_found}**", f"**{total_whitelisted}**"]) + lines.append(md_table(["Region", "Teardown candidates", "Kept (whitelisted)"], region_rows)) + lines.append("") + + type_rows: list[list[object]] = [] + for svc, rtype in SCANNED_RESOURCE_TYPES_ORDER: + c = totals_candidates.get((svc, rtype), 0) + k = totals_kept.get((svc, rtype), 0) + if c or k: + type_rows.append([f"{svc}.{rtype}", c, k]) + if type_rows: + lines.append("**By resource type**") + lines.append("") + lines.append(md_table(["Type", "Candidates", "Kept"], type_rows)) + + return "\n".join(lines) + + +def format_resource_table_message( + title: str, + resources_by_region: dict[str, list[ResourceRecord]], + *, + extra_column: str | None = None, + extra_value=None, + match_reasons: dict[str, WhitelistMatch] | None = None, +) -> str: + lines = _header(title) + + all_records = [r for region in sorted(resources_by_region) for r in resources_by_region[region]] + if not all_records: + lines.append("None.") + return "\n".join(lines) + + if match_reasons and extra_column is None: + extra_column = "Kept because" + extra_value = lambda r: (match_reasons.get(resource_key(r)) or WhitelistMatch(True, "")).reason + + headers = ["Region", "Type", "ID", "Name", "State", "Age", "Created by", "Spec"] + if extra_column: + headers.append(extra_column) + + rows = _resource_table_rows(all_records, extra_column=extra_column, extra_value=extra_value) + lines.append(f"**Count:** {len(all_records)}") + lines.append("") + lines.append(md_table(headers, rows)) + return "\n".join(lines) + + +def format_whitelist_config_message(cfg: WhitelistConfig) -> str: + lines = _header("Bloodhound v2 — Whitelist Configuration") + lines.append("Resources matching any rule below are **kept** and excluded from teardown.") + lines.append("") + + rules = format_whitelist_rules(cfg) + if rules: + rule_rows = [] + for rule in rules: + text = rule.lstrip("- ").strip() + rule_rows.append([text]) + lines.append(md_table(["Rule"], rule_rows)) + else: + lines.append("No whitelist rules configured.") + + lines.append("") + lines.append("**Manage via Lambda env vars:** `KEEP_TAG_RULES`, `KEEP_NAME_PATTERNS`, `KEEP_RESOURCE_IDS`") + return "\n".join(lines) + + +def format_spending_controls_message(snap: SpendingControlsSnapshot) -> str: + """Prove spending limits are locked in place, and show for whom + what is blocked.""" + + def usd(x: float) -> str: + return f"${x:,.2f}" + + lines = _header("Bloodhound v2 — Spending Controls (proof of guardrails)") + lines.append(f"**Account:** `{snap.account_id}`") + lines.append("") + + # --- Verdict line: are limits actually locked? --- + total_actions = len(snap.actions) + locked = len(snap.locked_actions) + active = sum(1 for a in snap.actions if a.active) + if total_actions == 0: + verdict = "⚠️ **No enforcement actions found — spending caps are alert-only, not locked.**" + elif snap.all_locked: + verdict = ( + f"✅ **All {total_actions} enforcement action(s) are AUTOMATIC (locked in place).** " + f"{active} currently enforcing." + ) + else: + verdict = ( + f"⚠️ **{locked}/{total_actions} enforcement action(s) are AUTOMATIC (locked).** " + f"The rest require manual approval to fire." + ) + lines.append(verdict) + lines.append("") + + # --- Spending caps --- + lines.append("**Budget caps (spending limits)**") + lines.append("") + if not snap.caps: + lines.append("No AWS Budgets configured.") + else: + rows: list[list[object]] = [] + for c in snap.caps: + status = "🔴 OVER" if c.over else "🟢 within" + rows.append( + [ + c.name, + f"{usd(c.limit_usd)}/{c.time_unit.lower()}", + usd(c.actual_usd), + f"{c.pct_used:.0f}%", + status, + ] + ) + lines.append(md_table(["Budget", "Limit", "Actual", "% used", "Status"], rows)) + lines.append("") + + # --- Enforcement (the lock) --- + lines.append("**Enforcement — what is locked in place**") + lines.append("") + if not snap.actions: + lines.append("No budget actions configured. Caps will alert but cannot block spend.") + else: + rows = [] + for a in snap.actions: + lock = "🔒 AUTOMATIC" if a.locked else "🔓 manual" + fired = "ENFORCING" if a.active else a.status + thresh = ( + f"{a.threshold_value:.0f}%" + if a.threshold_type.upper() == "PERCENTAGE" + else usd(a.threshold_value) + ) + rows.append( + [ + a.budget_name, + _action_type_label(a.action_type), + a.policy_name or a.policy_id or "—", + f"@ {thresh}", + lock, + fired, + ] + ) + lines.append( + md_table( + ["Budget", "Mechanism", "Policy", "Trips", "Approval", "State"], + rows, + ) + ) + + # --- For what Groups / Users / OUs / Accounts --- + lines.append("") + lines.append("**Applies to (Groups, Users, OUs & Accounts)**") + lines.append("") + scope_rows: list[list[object]] = [] + for a in snap.actions: + principals: list[str] = [] + if a.iam_groups: + principals.append("groups: " + ", ".join(a.iam_groups)) + if a.iam_users: + principals.append("users: " + ", ".join(a.iam_users)) + if a.iam_roles: + principals.append("roles: " + ", ".join(a.iam_roles)) + if a.target_names: + principals.append("scope: " + ", ".join(a.target_names)) + scope_rows.append([a.budget_name, a.policy_name or a.action_id, "; ".join(principals) or "—"]) + if scope_rows: + lines.append(md_table(["Budget", "Policy", "Applies to"], scope_rows)) + lines.append("") + if snap.iam_group_names: + lines.append( + f"_IAM principals subject to account/OU-scoped guardrails: " + f"**{len(snap.iam_group_names)} groups** ({', '.join(snap.iam_group_names)}), " + f"**{snap.iam_user_count} users**._" + ) + lines.append("") + + # --- What is blocked --- + lines.append("**What is blocked when a cap trips**") + lines.append("") + any_blocked = False + for a in snap.actions: + if not (a.denied_actions or a.ec2_allowed_instance_types): + continue + any_blocked = True + header = f"_{a.policy_name or a.action_id}_" + if a.policy_desc: + header += f" — {a.policy_desc}" + lines.append(header) + if a.denied_actions: + shown = a.denied_actions[:30] + lines.append("- **Denied:** " + ", ".join(f"`{x}`" for x in shown)) + if len(a.denied_actions) > len(shown): + lines.append(f"- _(+{len(a.denied_actions) - len(shown)} more denied actions)_") + if a.ec2_allowed_instance_types: + lines.append( + "- **EC2 launches capped to:** " + + ", ".join(f"`{x}`" for x in a.ec2_allowed_instance_types) + ) + lines.append("") + if not any_blocked: + lines.append("No SCP/IAM deny rules resolved (insufficient Organizations/IAM read access, or none defined).") + lines.append("") + + if snap.notes: + lines.append("**Notes (degraded data)**") + for n in snap.notes: + lines.append(f"- {n}") + + return "\n".join(lines).rstrip() + + +def _action_type_label(action_type: str) -> str: + return { + "APPLY_SCP_POLICY": "SCP (org-wide)", + "APPLY_IAM_POLICY": "IAM policy", + "RUN_SSM_DOCUMENTS": "SSM (stop resources)", + }.get(action_type, action_type) + + +def format_budget_message(b: BudgetSnapshot) -> str: + def usd(x: float) -> str: + return f"${x:,.2f}" + + lines = _header("Bloodhound v2 — Budget Summary") + lines.append( + md_table( + ["Metric", "Value"], + [ + ["Cohort start", b.cohort_start_yyyy_mm], + ["Cohort budget", f"{usd(b.cohort_total_budget_usd)} over {b.cohort_length_months} months"], + ["Remaining cohort budget", usd(b.remaining_cohort_budget_usd)], + ["Dynamic monthly allowance", usd(b.dynamic_monthly_allowance_usd)], + ["This month MTD", usd(b.current_month_to_date_spend_usd)], + ["Projected month end", usd(b.projected_month_end_spend_usd)], + ["Over budget threshold", str(b.over_budget_threshold_met).lower()], + ], + ) + ) + return "\n".join(lines) + + +def format_teardown_plan_message( + candidates_by_region: dict[str, list[ResourceRecord]], + apply_changes: bool, + *, + simulate: bool, + targets_filter_count: int, + allow_all: bool, +) -> str: + header_title = ( + "Bloodhound v2 — Teardown Plan (APPLY MODE)" + if apply_changes + else "Bloodhound v2 — Teardown Plan (dry-run)" + ) + all_candidates = [r for region in sorted(candidates_by_region) for r in candidates_by_region[region]] + + lines = _header(header_title) + targets_filter_active = targets_filter_count > 0 + + meta_rows = [ + ["Mode", "apply" if apply_changes else "dry-run"], + ["Simulate deletes", str(simulate).lower()], + ["Targets filter active", str(targets_filter_active).lower()], + ["Allow all targets", str(allow_all).lower()], + ] + if targets_filter_active: + meta_rows.append(["Targets filter count", str(targets_filter_count)]) + + if not all_candidates: + lines.extend(meta_rows[0:1]) + lines.append("") + lines.append("No deletions planned.") + return "\n".join(lines) + + by_action: dict[str, int] = defaultdict(int) + by_service: dict[str, int] = defaultdict(int) + for r in all_candidates: + if r.delete_action: + by_action[r.delete_action] += 1 + by_service[r.service] += 1 + + meta_rows.extend( + [ + ["Planned actions", str(len(all_candidates))], + ["By service", ", ".join(f"{k}={by_service[k]}" for k in sorted(by_service))], + ["By action", ", ".join(f"{k}={by_action[k]}" for k in sorted(by_action))], + ] + ) + lines.append(md_table(["Setting", "Value"], meta_rows)) + lines.append("") + + deletable = [r for r in all_candidates if r.delete_supported] + manual = [r for r in all_candidates if not r.delete_supported] + + if deletable: + by_region = { + region: [r for r in candidates_by_region[region] if r.delete_supported] + for region in sorted(candidates_by_region) + } + deletable_records = [r for region in sorted(by_region) for r in by_region[region]] + lines.append("**Resources scheduled for teardown**") + lines.append("") + headers = ["Region", "Type", "ID", "Name", "State", "Age", "Created by", "Spec", "Action"] + rows = _resource_table_rows( + deletable_records, + extra_column="Action", + extra_value=lambda r: r.delete_action or "manual", + ) + lines.append(md_table(headers, rows)) + + if manual: + lines.append("") + lines.append(f"**Manual review required:** {len(manual)} resources without automated delete support") + + return "\n".join(lines).replace("\n\n\n", "\n\n").strip() + + +def format_teardown_result_message(attempted: int, succeeded: int, failed: int, simulated: int) -> str: + lines = _header("Bloodhound v2 — Teardown Results") + lines.append( + md_table( + ["Metric", "Count"], + [ + ["Attempted", attempted], + ["Succeeded", succeeded], + ["Failed", failed], + ["Simulated", simulated], + ], + ) + ) + return "\n".join(lines) + + +# ---------------------------------------------------------------------------- +# Formatters ported from PR #2 (mmccla1n) so its services layer imports cleanly. +# These are used only by bloodhound/services/{status,scan}_service.py, which are +# NOT wired into the current worker (bloodhound.app.run). They are kept import- +# clean so the handlers/services architecture can be adopted later without a +# second merge. See docs/INTEGRATION_PR2_NOTES.md. +# ---------------------------------------------------------------------------- + +def _fmt_kv(key: str, value: str) -> str: + return f"*{key}*: {value}" + + +def _display_resource(r: ResourceRecord) -> str: + """Short, human-friendly one-liner for Slack.""" + name = r.tags.get("Name") + name_part = f" (Name=`{name}`)" if name else "" + return f"- `{r.region}` {r.service}.{r.resource_type} `{r.id}`{name_part}" + + +def format_whitelisted_resources_message( + whitelisted_by_region: dict[str, list[ResourceRecord]], + *, + max_items: int = 50, +) -> str: + """Separate report listing all whitelisted ("kept") resources, capped for Slack.""" + kept_all: list[ResourceRecord] = [] + for region in sorted(whitelisted_by_region.keys()): + kept_all.extend(whitelisted_by_region.get(region, [])) + + lines: list[str] = [] + lines.append("*Bloodhound v2 — Whitelisted Resources (Kept)*") + lines.append(_fmt_kv("time_et", _et_now_time_str())) + lines.append("") + + if not kept_all: + lines.append("No whitelisted resources found.") + return "\n".join(lines) + + lines.append(_fmt_kv("kept_total", f"`{len(kept_all)}`")) + lines.append("") + + shown = 0 + for region in sorted(whitelisted_by_region.keys()): + region_items = whitelisted_by_region.get(region, []) + if not region_items: + continue + lines.append(f"*Region*: `{region}`") + for r in region_items: + if shown >= max_items: + break + lines.append(_display_resource(r)) + shown += 1 + if shown >= max_items: + break + lines.append("") + + if shown < len(kept_all): + lines.append(f"... and `{len(kept_all) - shown}` more (increase max_items if needed)") + + return "\n".join(lines).rstrip() + + +def format_status_message( + *, + health: str, + apply_changes: bool, + simulate: bool, + max_delete_count: int, + expected_account_id: str, + account_verified: bool, + last_scan_resource_total: int, + last_scan_whitelisted_total: int, + regions_scanned: int, +) -> str: + """Slack status dashboard used by PR #2's `/v2_status` command (not yet wired).""" + if not apply_changes: + mode = "DRY RUN" + elif simulate: + mode = "SIMULATION" + else: + mode = "DESTRUCTIVE APPLY" + + lines: list[str] = [] + lines.append("*Bloodhound v2 — System Status*") + lines.append(_fmt_kv("system_health", f"`{health}`")) + lines.append(_fmt_kv("time_et", _et_now_time_str())) + lines.append("") + lines.append("*System Mode*") + lines.append(_fmt_kv("mode", f"`{mode}`")) + lines.append(_fmt_kv("apply_changes", f"`{str(apply_changes).lower()}`")) + lines.append(_fmt_kv("simulate", f"`{str(simulate).lower()}`")) + lines.append("") + lines.append("────────") + lines.append("") + lines.append("*Safety Guards*") + lines.append(_fmt_kv("max_deletion_limit", f"`{max_delete_count}`")) + lines.append(_fmt_kv("expected_account_id", f"`{expected_account_id}`")) + lines.append(_fmt_kv("account_verified", f"`{str(account_verified).lower()}`")) + + return "\n".join(lines) diff --git a/bloodhound/report_format.py b/bloodhound/report_format.py new file mode 100644 index 0000000..3355e77 --- /dev/null +++ b/bloodhound/report_format.py @@ -0,0 +1,108 @@ +""" +bloodhound/report_format.py + +Local markdown reports and Slack mrkdwn conversion. +""" + +from __future__ import annotations + +import re +from datetime import datetime +from pathlib import Path +from zoneinfo import ZoneInfo + +_ET = ZoneInfo("America/New_York") + +_MD_BOLD = re.compile(r"\*\*([^*\n]+)\*\*") +_MD_ITALIC = re.compile(r"(? str: + """Convert markdown report bodies to Slack mrkdwn.""" + text = _wrap_tables_for_slack(text) + placeholders: dict[str, str] = {} + + def _stash_fence(match: re.Match[str]) -> str: + key = f"@@FENCE{len(placeholders)}@@" + placeholders[key] = match.group(0) + return key + + protected = _FENCE.sub(_stash_fence, text) + converted = _MD_BOLD.sub(r"*\1*", protected) + converted = _MD_ITALIC.sub(r"_\1_", converted) + for key, value in placeholders.items(): + converted = converted.replace(key, value) + return converted + + +def _wrap_tables_for_slack(text: str) -> str: + lines = text.splitlines() + out: list[str] = [] + i = 0 + while i < len(lines): + if lines[i].lstrip().startswith("|"): + block: list[str] = [] + while i < len(lines) and lines[i].lstrip().startswith("|"): + block.append(lines[i]) + i += 1 + if out and out[-1] != "": + out.append("") + out.append("```") + out.extend(block) + out.append("```") + out.append("") + continue + out.append(lines[i]) + i += 1 + return "\n".join(out).strip() + + +def format_report_section(title: str, body: str, *, output_format: str) -> str: + if output_format == "markdown": + return f"## {title}\n\n{body}\n" + return f"\n{'=' * 72}\n{title}\n{'=' * 72}\n{body}\n" + + +class LocalReportWriter: + def __init__( + self, + *, + enabled: bool, + output_format: str = "markdown", + report_dir: str | Path | None = None, + mode: str = "seek", + ) -> None: + self.enabled = enabled + self.output_format = output_format if output_format in {"markdown", "plain"} else "markdown" + self.report_dir = Path(report_dir or "reports") + self.mode = mode + self._sections: list[str] = [] + + def add(self, title: str, body: str) -> str: + section = format_report_section(title, body, output_format=self.output_format) + if self.enabled: + self._sections.append(section) + return section + + def flush(self) -> Path | None: + if not self.enabled or not self._sections: + return None + + self.report_dir.mkdir(parents=True, exist_ok=True) + ts = datetime.now(_ET).strftime("%Y-%m-%d_%H%M%S") + suffix = "md" if self.output_format == "markdown" else "txt" + path = self.report_dir / f"bloodhound-{self.mode}-{ts}.{suffix}" + + if self.output_format == "markdown": + header = ( + f"# Bloodhound v2 — local dry run (`{self.mode}`)\n\n" + f"- Generated: {datetime.now(_ET).strftime('%Y-%m-%d %I:%M %p ET')}\n\n" + "---\n\n" + ) + content = header + "\n---\n\n".join(self._sections) + else: + content = "\n".join(self._sections) + + path.write_text(content, encoding="utf-8") + return path diff --git a/bloodhound/scanner/__init__.py b/bloodhound/scanner/__init__.py new file mode 100644 index 0000000..5e0629b --- /dev/null +++ b/bloodhound/scanner/__init__.py @@ -0,0 +1,7 @@ +__all__ = [ + "scan_all", +] + +from bloodhound.scanner.scan_all import scan_all + + diff --git a/bloodhound/scanner/ec2.py b/bloodhound/scanner/ec2.py new file mode 100644 index 0000000..c382353 --- /dev/null +++ b/bloodhound/scanner/ec2.py @@ -0,0 +1,210 @@ +""" +bloodhound/scanner/ec2.py + +EC2-family scanners (instances, EBS volumes, EIPs, NAT gateways). +These produce `ResourceRecord` items which are later whitelisted and optionally torn down. +""" + +from __future__ import annotations + +from typing import Any + +from bloodhound.aws import AwsClients +from bloodhound.types import ResourceRecord + + +def scan_ec2_instances(clients: AwsClients, region: str) -> list[ResourceRecord]: + ec2 = clients.client("ec2", region=region) + paginator = ec2.get_paginator("describe_instances") + + # First pass: collect live instances and the EBS volume ids attached to each. + pending: list[tuple[dict, str, dict[str, str], list[str]]] = [] + all_vol_ids: set[str] = set() + for page in paginator.paginate(): + for reservation in page.get("Reservations", []): + for inst in reservation.get("Instances", []): + state = (inst.get("State") or {}).get("Name") or "unknown" + if state in {"stopped", "terminated", "shutting-down"}: + continue + instance_id = inst.get("InstanceId") + if not instance_id: + continue + vol_ids = [ + (m.get("Ebs") or {}).get("VolumeId") + for m in inst.get("BlockDeviceMappings", []) or [] + if (m.get("Ebs") or {}).get("VolumeId") + ] + all_vol_ids.update(vol_ids) + pending.append((inst, instance_id, _tags_to_dict(inst.get("Tags")), vol_ids)) + + vol_specs = _describe_volume_specs(ec2, sorted(all_vol_ids)) + + records: list[ResourceRecord] = [] + for inst, instance_id, tags, vol_ids in pending: + attached_ebs = [vol_specs[v] for v in vol_ids if v in vol_specs] + records.append( + ResourceRecord( + service="ec2", + resource_type="instance", + region=region, + id=instance_id, + arn=None, + state=(inst.get("State") or {}).get("Name") or "unknown", + tags=tags, + metadata={ + "instance_type": inst.get("InstanceType"), + "launch_time": (inst.get("LaunchTime").isoformat() if inst.get("LaunchTime") else None), + "attached_ebs": attached_ebs, + "attached_ebs_gb": sum(v["size_gb"] for v in attached_ebs), + }, + delete_supported=True, + delete_action="terminate_instances", + delete_params={"InstanceIds": [instance_id]}, + ) + ) + + return records + + +def _describe_volume_specs(ec2, vol_ids: list[str]) -> dict[str, dict[str, Any]]: + """Map volume id -> {size_gb, volume_type} for attached-EBS cost attribution.""" + specs: dict[str, dict[str, Any]] = {} + if not vol_ids: + return specs + # Batch to stay well under request-size limits. + for i in range(0, len(vol_ids), 200): + batch = vol_ids[i : i + 200] + try: + resp = ec2.describe_volumes(VolumeIds=batch) + except Exception: # noqa: BLE001 — best effort; cost just omits attached EBS + continue + for vol in resp.get("Volumes", []) or []: + vid = vol.get("VolumeId") + if not vid: + continue + specs[vid] = {"size_gb": float(vol.get("Size") or 0), "volume_type": vol.get("VolumeType")} + return specs + + +def scan_ebs_unattached_volumes(clients: AwsClients, region: str) -> list[ResourceRecord]: + ec2 = clients.client("ec2", region=region) + paginator = ec2.get_paginator("describe_volumes") + records: list[ResourceRecord] = [] + + for page in paginator.paginate( + Filters=[ + {"Name": "status", "Values": ["available"]}, + ] + ): + for vol in page.get("Volumes", []): + vol_id = vol.get("VolumeId") + if not vol_id: + continue + state = vol.get("State") or "unknown" + tags = _tags_to_dict(vol.get("Tags")) + records.append( + ResourceRecord( + service="ec2", + resource_type="ebs_volume", + region=region, + id=vol_id, + arn=None, + state=state, + tags=tags, + metadata={ + "size_gb": vol.get("Size"), + "volume_type": vol.get("VolumeType"), + "created_at": vol.get("CreateTime").isoformat() if vol.get("CreateTime") else None, + }, + delete_supported=True, + delete_action="delete_volume", + delete_params={"VolumeId": vol_id}, + ) + ) + return records + + +def scan_eips_unassociated(clients: AwsClients, region: str) -> list[ResourceRecord]: + ec2 = clients.client("ec2", region=region) + records: list[ResourceRecord] = [] + + # Note: describe_addresses is not pageable. + resp = ec2.describe_addresses() + for addr in resp.get("Addresses", []): + if addr.get("AssociationId") or addr.get("NetworkInterfaceId") or addr.get("InstanceId"): + continue + alloc_id = addr.get("AllocationId") + public_ip = addr.get("PublicIp") + # AllocationId is required to release in VPC; for classic, PublicIp can be used. + rid = alloc_id or public_ip + if not rid: + continue + tags = _tags_to_dict(addr.get("Tags")) + delete_params: dict[str, Any] + if alloc_id: + delete_params = {"AllocationId": alloc_id} + else: + delete_params = {"PublicIp": public_ip} + records.append( + ResourceRecord( + service="ec2", + resource_type="elastic_ip", + region=region, + id=rid, + arn=None, + state="unassociated", + tags=tags, + metadata={"public_ip": public_ip}, + delete_supported=True, + delete_action="release_address", + delete_params=delete_params, + ) + ) + + return records + + +def scan_nat_gateways(clients: AwsClients, region: str) -> list[ResourceRecord]: + ec2 = clients.client("ec2", region=region) + paginator = ec2.get_paginator("describe_nat_gateways") + records: list[ResourceRecord] = [] + + for page in paginator.paginate(): + for nat in page.get("NatGateways", []): + nat_id = nat.get("NatGatewayId") + if not nat_id: + continue + state = nat.get("State") or "unknown" + if state in {"deleted", "deleting"}: + continue + tags = _tags_to_dict(nat.get("Tags")) + records.append( + ResourceRecord( + service="ec2", + resource_type="nat_gateway", + region=region, + id=nat_id, + arn=None, + state=state, + tags=tags, + delete_supported=True, + delete_action="delete_nat_gateway", + delete_params={"NatGatewayId": nat_id}, + ) + ) + return records + + +def _tags_to_dict(tags: Any) -> dict[str, str]: + if not tags: + return {} + out: dict[str, str] = {} + for t in tags: + k = t.get("Key") + v = t.get("Value") + if k is None or v is None: + continue + out[str(k)] = str(v) + return out + + diff --git a/bloodhound/scanner/elbv2.py b/bloodhound/scanner/elbv2.py new file mode 100644 index 0000000..0a6deb3 --- /dev/null +++ b/bloodhound/scanner/elbv2.py @@ -0,0 +1,69 @@ +""" +bloodhound/scanner/elbv2.py + +ELBv2 scanner (ALB/NLB). Collects load balancers and tags (in batches). +""" + +from __future__ import annotations + +from bloodhound.aws import AwsClients +from bloodhound.types import ResourceRecord + + +def scan_elbv2_load_balancers(clients: AwsClients, region: str) -> list[ResourceRecord]: + elb = clients.client("elbv2", region=region) + paginator = elb.get_paginator("describe_load_balancers") + lbs: list[dict] = [] + for page in paginator.paginate(): + lbs.extend(page.get("LoadBalancers", []) or []) + + if not lbs: + return [] + + # Fetch tags in batches of 20 ARNs (API limit). + arn_to_tags: dict[str, dict[str, str]] = {} + arns = [lb.get("LoadBalancerArn") for lb in lbs if lb.get("LoadBalancerArn")] + for i in range(0, len(arns), 20): + batch = arns[i : i + 20] + try: + tag_resp = elb.describe_tags(ResourceArns=batch) + for desc in tag_resp.get("TagDescriptions", []) or []: + arn = desc.get("ResourceArn") + if not arn: + continue + arn_to_tags[arn] = {t.get("Key"): t.get("Value") for t in (desc.get("Tags") or []) if t.get("Key")} + except Exception: + # Best-effort: skip tags on failure. + continue + + records: list[ResourceRecord] = [] + for lb in lbs: + arn = lb.get("LoadBalancerArn") + name = lb.get("LoadBalancerName") + if not arn or not name: + continue + state = (lb.get("State") or {}).get("Code") or "unknown" + if state in {"deleted", "deleting"}: + continue + records.append( + ResourceRecord( + service="elbv2", + resource_type="load_balancer", + region=region, + id=name, + arn=arn, + state=state, + tags=arn_to_tags.get(arn, {}), + metadata={ + "scheme": lb.get("Scheme"), + "type": lb.get("Type"), + "created_at": lb.get("CreatedTime").isoformat() if lb.get("CreatedTime") else None, + }, + delete_supported=True, + delete_action="delete_load_balancer", + delete_params={"LoadBalancerArn": arn}, + ) + ) + return records + + diff --git a/bloodhound/scanner/rds.py b/bloodhound/scanner/rds.py new file mode 100644 index 0000000..40cb450 --- /dev/null +++ b/bloodhound/scanner/rds.py @@ -0,0 +1,80 @@ +""" +bloodhound/scanner/rds.py + +RDS scanner. Collects DB instances and best-effort tags (requires list_tags_for_resource). +""" + +from __future__ import annotations + +from typing import Any + +from bloodhound.aws import AwsClients +from bloodhound.types import ResourceRecord + + +def scan_rds_instances(clients: AwsClients, region: str, rds_final_snapshot: bool) -> list[ResourceRecord]: + rds = clients.client("rds", region=region) + paginator = rds.get_paginator("describe_db_instances") + records: list[ResourceRecord] = [] + + for page in paginator.paginate(): + for db in page.get("DBInstances", []): + db_id = db.get("DBInstanceIdentifier") + arn = db.get("DBInstanceArn") + status = db.get("DBInstanceStatus") or "unknown" + if not db_id: + continue + # Tags require a separate call; keep best-effort for now. + tags = _tags_to_dict(_safe_list_tags(rds, arn)) + delete_params: dict[str, Any] = { + "DBInstanceIdentifier": db_id, + "SkipFinalSnapshot": not rds_final_snapshot, + } + records.append( + ResourceRecord( + service="rds", + resource_type="db_instance", + region=region, + id=db_id, + arn=arn, + state=status, + tags=tags, + metadata={ + "instance_class": db.get("DBInstanceClass"), + "allocated_storage_gb": db.get("AllocatedStorage"), + "engine": db.get("Engine"), + "multi_az": bool(db.get("MultiAZ")), + "created_at": db.get("InstanceCreateTime").isoformat() if db.get("InstanceCreateTime") else None, + }, + delete_supported=True, + delete_action="delete_db_instance", + delete_params=delete_params, + ) + ) + + return records + + +def _safe_list_tags(rds_client, arn: str | None) -> list[dict[str, str]]: + if not arn: + return [] + try: + resp = rds_client.list_tags_for_resource(ResourceName=arn) + return resp.get("TagList", []) or [] + except Exception: + return [] + + +def _tags_to_dict(tags: Any) -> dict[str, str]: + if not tags: + return {} + out: dict[str, str] = {} + for t in tags: + k = t.get("Key") + v = t.get("Value") + if k is None or v is None: + continue + out[str(k)] = str(v) + return out + + diff --git a/bloodhound/scanner/regions.py b/bloodhound/scanner/regions.py new file mode 100644 index 0000000..ae52cba --- /dev/null +++ b/bloodhound/scanner/regions.py @@ -0,0 +1,39 @@ +""" +bloodhound/scanner/regions.py + +Region selection helpers. + +- explicit mode: use REGIONS from config +- discover mode: discover regions via EC2 DescribeRegions +""" + +from __future__ import annotations + +from typing import Optional + +from bloodhound.aws import AwsClients + + +def discover_regions(clients: AwsClients, home_region: str = "us-east-1") -> list[str]: + ec2 = clients.client("ec2", region=home_region) + resp = ec2.describe_regions(AllRegions=True) + regions = [r["RegionName"] for r in resp.get("Regions", []) if "RegionName" in r] + regions.sort() + return regions + + +def select_regions(mode: str, explicit_regions: list[str], discovered_regions: Optional[list[str]]) -> list[str]: + if mode == "explicit": + regions = list(explicit_regions) + regions.sort() + return regions + if mode == "discover": + regions = list(discovered_regions or []) + regions.sort() + return regions + # Fallback: behave like explicit with whatever was provided. + regions = list(explicit_regions) + regions.sort() + return regions + + diff --git a/bloodhound/scanner/scan_all.py b/bloodhound/scanner/scan_all.py new file mode 100644 index 0000000..81715e2 --- /dev/null +++ b/bloodhound/scanner/scan_all.py @@ -0,0 +1,46 @@ +""" +bloodhound/scanner/scan_all.py + +Scan coordinator: runs all per-service scanners for each region and returns a region->records map. +""" + +from __future__ import annotations + +from dataclasses import dataclass + +from bloodhound.aws import AwsClients +from bloodhound.scanner.ec2 import ( + scan_ec2_instances, + scan_ebs_unattached_volumes, + scan_eips_unassociated, + scan_nat_gateways, +) +from bloodhound.scanner.elbv2 import scan_elbv2_load_balancers +from bloodhound.scanner.rds import scan_rds_instances +from bloodhound.types import ResourceRecord + + +@dataclass(frozen=True) +class ScanResult: + region: str + resources: list[ResourceRecord] + + +def scan_region(clients: AwsClients, region: str, rds_final_snapshot: bool) -> list[ResourceRecord]: + resources: list[ResourceRecord] = [] + resources.extend(scan_ec2_instances(clients, region)) + resources.extend(scan_rds_instances(clients, region, rds_final_snapshot=rds_final_snapshot)) + resources.extend(scan_eips_unassociated(clients, region)) + resources.extend(scan_nat_gateways(clients, region)) + resources.extend(scan_ebs_unattached_volumes(clients, region)) + resources.extend(scan_elbv2_load_balancers(clients, region)) + return resources + + +def scan_all(clients: AwsClients, regions: list[str], rds_final_snapshot: bool) -> dict[str, list[ResourceRecord]]: + out: dict[str, list[ResourceRecord]] = {} + for region in regions: + out[region] = scan_region(clients, region, rds_final_snapshot=rds_final_snapshot) + return out + + diff --git a/bloodhound/services/budget_service.py b/bloodhound/services/budget_service.py new file mode 100644 index 0000000..6fde08f --- /dev/null +++ b/bloodhound/services/budget_service.py @@ -0,0 +1,74 @@ +""" +bloodhound/services/budget_service.py + +Budget monitoring service for Bloodhound v2. + +Responsibilities: +- Compute budget snapshot +- Generate formatted Slack budget message +- Post budget alerts + +This logic was previously embedded in the main pipeline and +has been extracted into a service module for clarity. +""" + +from bloodhound.budget import compute_budget_snapshot +from bloodhound.messages import format_budget_message + + +def compute_budget(cfg, clients, slack): + """ + Compute the current budget snapshot and optionally post a Slack notification. + + This function retrieves AWS billing data and calculates the projected + monthly spend based on the configured cohort budget parameters. + + Args: + cfg: + Bloodhound configuration object produced by `load_config()`. + Must contain the `budget` configuration section. + + clients: + AWS client container created by `create_clients()`. + Provides access to required AWS service clients such as + Cost Explorer. + + slack: + Optional SlackNotifier instance. If Slack integration is + enabled, the formatted budget message will be posted to the + configured alert channel. + + Returns: + BudgetSnapshot: + Snapshot object returned by `compute_budget_snapshot` + containing: + + - projected_month_end_spend_usd + - dynamic_monthly_allowance_usd + - over_budget_threshold_met + + Raises: + RuntimeError: + If AWS billing APIs fail or return unexpected data. + + Side Effects: + - Calls AWS Cost Explorer API + - Posts a budget summary message to Slack alert channel + + """ + + budget_snapshot = compute_budget_snapshot( + clients, + cohort_start_yyyy_mm=cfg.budget.cohort_start_yyyy_mm, + cohort_total_budget_usd=cfg.budget.cohort_total_budget_usd, + cohort_length_months=cfg.budget.cohort_length_months, + budget_over_days=cfg.budget.budget_over_days, + ) + + budget_msg = format_budget_message(budget_snapshot) + + # Always post budget summary to alert channel (keeps scan channel quieter). + if slack: + slack.post_alert(budget_msg) + + return budget_snapshot \ No newline at end of file diff --git a/bloodhound/services/scan_service.py b/bloodhound/services/scan_service.py new file mode 100644 index 0000000..38442e1 --- /dev/null +++ b/bloodhound/services/scan_service.py @@ -0,0 +1,121 @@ +""" +bloodhound/services/scan_service.py + +Resource scanning service for Bloodhound v2. + +Responsibilities: +- Discover AWS regions +- Scan resources across regions +- Apply whitelist filtering +- Generate Slack scan reports +- Produce candidate resource list used for teardown planning + +This module contains logic that previously existed inside +execute_pipeline() and has been extracted for maintainability. +""" + +from bloodhound.scanner.regions import discover_regions, select_regions +from bloodhound.scanner.scan_all import scan_all +from bloodhound.whitelist import filter_whitelisted +from bloodhound.messages import ( + format_scan_message, + format_whitelisted_resources_message, +) + + +def scan_resources(cfg, clients, slack): + """ + Scan AWS resources across configured regions and apply whitelist filtering. + + This service performs the full resource discovery phase of the Bloodhound + pipeline. It identifies candidate resources for teardown while separating + whitelisted resources that must be preserved. + + Args: + cfg: + Bloodhound configuration object produced by `load_config()`. + Contains region configuration, whitelist rules, and teardown + parameters. + + clients: + AWS client container created by `create_clients()`. Provides + service clients required for scanning infrastructure resources. + + slack: + Optional SlackNotifier instance used for sending scan reports + and whitelist summaries. + + Returns: + dict: + Dictionary containing the scan results with the following keys: + + regions (list[str]) + Regions that were scanned. + + candidates_by_region (dict[str, list]) + Resources eligible for teardown grouped by AWS region. + + kept_by_region (dict[str, list]) + Resources preserved due to whitelist rules grouped by region. + + all_candidates (list) + Flattened list of all candidate resources across regions. + This list is used as the input for teardown planning. + + Raises: + RuntimeError: + If region discovery or resource scanning fails. + + Side Effects: + - Calls AWS resource APIs across multiple regions + - Posts scan summary to Slack scan channel + - Posts whitelist report to Slack scan channel + """ + + discovered = None + if cfg.regions.mode == "discover": + discovered = discover_regions(clients) + + regions = select_regions( + cfg.regions.mode, + cfg.regions.regions, + discovered_regions=discovered + ) + + # 1) Scan + raw_by_region = scan_all( + clients, + regions=regions, + rds_final_snapshot=cfg.teardown.rds_final_snapshot + ) + + candidates_by_region: dict[str, list] = {} + kept_by_region: dict[str, list] = {} + + for region, records in raw_by_region.items(): + # Whitelist is applied before teardown planning. + candidates, kept = filter_whitelisted(records, cfg.whitelist) + candidates_by_region[region] = candidates + kept_by_region[region] = kept + + scan_msg = format_scan_message(candidates_by_region, kept_by_region) + + if slack: + slack.post_scan(scan_msg) + slack.post_scan(format_whitelisted_resources_message(kept_by_region)) + + # ------------------------------------------------------------ + # Build flattened candidate list for teardown planning + # ------------------------------------------------------------ + # 3) Teardown plan + optional apply + all_candidates = [ + r for region in sorted(candidates_by_region.keys()) + for r in candidates_by_region[region] + ] + + return { + "regions": regions, + "candidates_by_region": candidates_by_region, + "kept_by_region": kept_by_region, + "all_candidates": all_candidates, + } \ No newline at end of file diff --git a/bloodhound/services/status_service.py b/bloodhound/services/status_service.py new file mode 100644 index 0000000..5ad1988 --- /dev/null +++ b/bloodhound/services/status_service.py @@ -0,0 +1,98 @@ +""" +bloodhound/services/status_service.py + +Status command service for Bloodhound v2. + +Responsibilities: +- Handle Slack /v2_status command +- Compute system health indicator +- Post formatted status message to Slack + +This module intentionally contains only the logic previously +embedded inside the pipeline so that orchestration code remains +clean and maintainable. +""" + +from bloodhound.messages import format_status_message + + +def handle_status_command(event, cfg, slack, compute_system_health): + """ + Handle the Slack `/v2_status` command. + + This function generates a system status report describing the current + operational state of the Bloodhound pipeline including safety flags + and deletion controls. + + Args: + event (dict): + Lambda event payload representing the Slack command request. + Must contain: + source="slack_command" + mode="status" + + cfg: + Bloodhound configuration object produced by `load_config()`. + + slack: + Optional SlackNotifier instance used to post the formatted + status message to the alert channel. + + compute_system_health (callable): + Function that evaluates system health based on operational + flags such as teardown mode and budget thresholds. + + Returns: + dict | None: + + dict + Returned when a status command is processed: + + { + "ok": True, + "mode": "status" + } + + None + Returned when the incoming event is not a status command, + allowing the main pipeline to continue execution. + + Raises: + RuntimeError: + If Slack message formatting fails. + """ + + # ------------------------------------------------------------ + # Status command (read-only system overview) + # ------------------------------------------------------------ + if isinstance(event, dict) and event.get("source") == "slack_command": + if event.get("mode") == "status": + + health = compute_system_health( + apply_changes=cfg.teardown.apply_changes, + allow_all_targets=cfg.teardown.allow_all_targets, + max_delete_count=cfg.teardown.max_delete_count, + budget_over_threshold=False, + ) + + status_msg = format_status_message( + health=health, + apply_changes=cfg.teardown.apply_changes, + simulate=cfg.teardown.simulate, + max_delete_count=cfg.teardown.max_delete_count, + expected_account_id=getattr(cfg.aws, "expected_account_id", "not-configured"), + account_verified=True, + last_scan_resource_total=0, + last_scan_whitelisted_total=0, + regions_scanned=0, + ) + + if slack: + slack.post_alert(status_msg) + + return { + "ok": True, + "mode": "status", + } + + return None \ No newline at end of file diff --git a/bloodhound/services/teardown_service.py b/bloodhound/services/teardown_service.py new file mode 100644 index 0000000..42e5417 --- /dev/null +++ b/bloodhound/services/teardown_service.py @@ -0,0 +1,264 @@ +""" +bloodhound/services/teardown_service.py + +Teardown planning and execution service for Bloodhound v2. + +Responsibilities: +- Perform validation safety checks +- Plan deletion actions +- Execute AWS resource teardown +- Post Slack teardown reports + +This module contains logic extracted from execute_pipeline() +without altering behavior. + +# ------------------------------------------------------------ +# WARNING +# +# This module performs destructive AWS operations including +# permanent deletion of infrastructure resources. +# +# All safety guards MUST remain intact. +# ------------------------------------------------------------ +""" + +import json + +from bloodhound.teardown.planner import plan_deletions +from bloodhound.teardown.executor import execute_actions +from bloodhound.messages import ( + format_teardown_plan_message, + format_teardown_result_message, +) + + +def plan_teardown(cfg, event, all_candidates, slack): + """ + Generate the teardown plan and enforce validation safety checks. + + This function validates teardown targets (when running in validation + mode) and builds the list of resource deletion actions using the + teardown planner. + + Args: + cfg: + Bloodhound configuration object produced by `load_config()`. + Contains teardown safety parameters and target filters. + + event (dict): + Invocation event used to determine execution mode + (Slack command, validation harness, scheduled run). + + all_candidates (list): + Flattened list of candidate resources returned by the scan + phase. Each resource object must contain: + + id + arn + region + tags + + slack: + Optional SlackNotifier instance used to post the teardown + plan summary. + + Returns: + list: + List of planned teardown action objects returned by + `plan_deletions()`. + + Raises: + RuntimeError: + If validation safety checks fail or invalid teardown + targets are detected. + + Side Effects: + - Posts teardown plan summary to Slack alert channel + """ + + # ------------------------------------------------------------------ + # Validation Safety Guard + # + # When running validation mode, ensure that: + # + # 1. Target IDs exist in scan results + # 2. Target IDs reference resources tagged for validation + # + # This prevents accidental deletion of unrelated infrastructure. + # ------------------------------------------------------------------ + + if isinstance(event, dict) and event.get("source") == "validation": + + validation_targets = set(cfg.teardown.target_ids) + + candidate_ids = {r.id for r in all_candidates} + + tagged_resources = { + r.id + for r in all_candidates + if r.tags.get("bloodhound:test") == "true" + } + + # Ensure targets exist in scan results + if not validation_targets.issubset(candidate_ids): + + invalid_targets = validation_targets - candidate_ids + + raise RuntimeError( + f"Validation safety check failed. " + f"Targets not present in scan results: {sorted(invalid_targets)}" + ) + + # Ensure targets are validation-tagged resources + if not validation_targets.issubset(tagged_resources): + + invalid_targets = validation_targets - tagged_resources + + raise RuntimeError( + f"Validation safety check failed. " + f"Targets missing validation tag: {sorted(invalid_targets)}" + ) + + actions, _manual = plan_deletions(all_candidates) + + if slack: + slack.post_alert( + format_teardown_plan_message( + actions, + apply_changes=cfg.teardown.apply_changes, + simulate=cfg.teardown.simulate, + targets_filter_count=len(cfg.teardown.target_ids), + allow_all=cfg.teardown.allow_all_targets, + ) + ) + + return actions + + +def execute_teardown(cfg, event, clients, actions, slack, resource_key_from_action): + """ + Execute planned teardown actions against AWS resources. + + This function applies deletion operations for resources selected + by the teardown planner. Execution behavior is controlled by the + configuration flags for simulation mode, validation mode, and + explicit target filtering. + + Args: + cfg: + Bloodhound configuration object produced by `load_config()`. + + event (dict): + Invocation event used to determine validation mode or + Slack command execution mode. + + clients: + AWS client container created by `create_clients()`. + + actions (list): + List of teardown action objects produced by `plan_teardown()`. + + slack: + Optional SlackNotifier instance used to post execution + results to the alert channel. + + resource_key_from_action (callable): + Helper function that converts an action object into the + canonical resource key format used for target filtering. + + Returns: + dict | None: + + dict + Execution summary containing: + + attempted + succeeded + failed + simulated + failures + targets_filter + planned_actions_total + executed_actions_total + allow_all_targets + + None + Returned when destructive execution is disabled. + + Raises: + RuntimeError: + If AWS deletion operations fail unexpectedly. + + Side Effects: + - Calls AWS deletion APIs (EC2, RDS, etc.) + - Permanently deletes AWS infrastructure + - Posts execution summary to Slack alert channel + + + """ + + exec_summary = None + + if cfg.teardown.apply_changes: + + actions_to_execute = actions + + # ------------------------------------------------------------ + # Validation safety filter + # + # When validation mode is active, restrict deletion to resources + # tagged specifically for validation runs. + # ------------------------------------------------------------ + validation_mode = isinstance(event, dict) and event.get("validation") is True + + if validation_mode: + actions_to_execute = [ + a for a in actions + if getattr(a, "tags", {}).get("bloodhound:test") == "true" + ] + + elif cfg.teardown.target_ids: + + targets = cfg.teardown.target_ids + + actions_to_execute = [ + a + for a in actions + if ( + (a.id in targets) + or (a.arn and a.arn in targets) + or (resource_key_from_action(a) in targets) + ) + ] + + exec_result = execute_actions( + clients, + actions_to_execute, + simulate=cfg.teardown.simulate + ) + + exec_summary = { + "attempted": exec_result.attempted, + "succeeded": exec_result.succeeded, + "failed": exec_result.failed, + "simulated": exec_result.simulated, + "failures": exec_result.failures[:20], + "targets_filter": sorted(cfg.teardown.target_ids) if cfg.teardown.target_ids else None, + "planned_actions_total": len(actions), + "executed_actions_total": len(actions_to_execute), + "allow_all_targets": cfg.teardown.allow_all_targets, + } + + if slack: + slack.post_alert( + format_teardown_result_message( + attempted=exec_result.attempted, + succeeded=exec_result.succeeded, + failed=exec_result.failed, + simulated=exec_result.simulated, + ) + + "\n" + + json.dumps(exec_summary, indent=2) + ) + + return exec_summary \ No newline at end of file diff --git a/bloodhound/slack.py b/bloodhound/slack.py new file mode 100644 index 0000000..82b3269 --- /dev/null +++ b/bloodhound/slack.py @@ -0,0 +1,75 @@ +""" +bloodhound/slack.py + +Slack API wrapper with chunked posting for long reports. +""" + +from __future__ import annotations + +from dataclasses import dataclass + +from slack_sdk import WebClient + +SLACK_TEXT_LIMIT = 3900 + + +@dataclass(frozen=True) +class SlackNotifier: + client: WebClient + scan_channel_id: str + alert_channel_id: str + + @classmethod + def from_token(cls, bot_token: str, scan_channel_id: str, alert_channel_id: str) -> "SlackNotifier": + return cls( + client=WebClient(token=bot_token), + scan_channel_id=scan_channel_id, + alert_channel_id=alert_channel_id, + ) + + def post_scan(self, text: str) -> None: + self._post_chunked(self.scan_channel_id, text) + + def post_alert(self, text: str) -> None: + self._post_chunked(self.alert_channel_id, text) + + def _post_chunked(self, channel_id: str, text: str) -> None: + for chunk in split_slack_text(text): + self.client.chat_postMessage(channel=channel_id, text=chunk) + + +def split_slack_text(text: str, limit: int = SLACK_TEXT_LIMIT) -> list[str]: + if len(text) <= limit: + return [text] + + chunks: list[str] = [] + current: list[str] = [] + current_len = 0 + + for line in text.splitlines(keepends=True): + if len(line) > limit: + if current: + chunks.append("".join(current).rstrip()) + current, current_len = [], 0 + for i in range(0, len(line), limit): + chunks.append(line[i : i + limit].rstrip()) + continue + + if current_len + len(line) > limit: + chunks.append("".join(current).rstrip()) + current, current_len = [line], len(line) + else: + current.append(line) + current_len += len(line) + + if current: + chunks.append("".join(current).rstrip()) + + total = len(chunks) + if total <= 1: + return chunks + + out: list[str] = [] + for idx, chunk in enumerate(chunks, start=1): + out.append(f"[{idx}/{total}]\n{chunk}") + return out diff --git a/bloodhound/slack_commands.py b/bloodhound/slack_commands.py new file mode 100644 index 0000000..3da7f63 --- /dev/null +++ b/bloodhound/slack_commands.py @@ -0,0 +1,250 @@ +""" +bloodhound/slack_commands.py + +Slack slash command HTTP handler for Bloodhound v2. + +Why this exists: +- Slack needs a public HTTPS endpoint for slash commands (/seek, /seek_destroy) +- Slack requires a fast response; we return immediately and then self-invoke the Lambda + +Deployed via: +- Lambda Function URL (recommended) or API Gateway +""" + +from __future__ import annotations + +import base64 +#import cmd +import hashlib +import hmac +import os +import time +import urllib.parse +from dataclasses import dataclass +from typing import Any + +import boto3 + + +@dataclass(frozen=True) +class SlackCommand: + command: str + text: str + user_id: str + channel_id: str + + +def is_slack_http_event(event: dict[str, Any]) -> bool: + # Lambda Function URL / API Gateway both provide headers + body for HTTP requests. + return isinstance(event, dict) and "headers" in event and "body" in event + + +def handle_slack_command_http(event: dict[str, Any]) -> dict[str, Any]: + """ + Handles Slack slash commands via an HTTP-triggered Lambda (Function URL or API Gateway). + + Responds immediately (Slack requires fast response), then asynchronously invokes the + same Lambda function to run the scan/teardown and post the normal Slack reports. + """ + + # ------------------------------------------------------------- + # Lightweight health endpoint for infrastructure validation + # Allows curl checks without requiring Slack signature headers + # ------------------------------------------------------------- + raw_path = event.get("rawPath") or event.get("path") or "" + if raw_path == "/health": + return { + "statusCode": 200, + "headers": {"Content-Type": "application/json"}, + "body": json_dumps({ + "ok": True, + "service": "BloodhoundLambdaV2", + "status": "healthy" + }), + } + + # Slack request verification (signature + timestamp) is mandatory. + signing_secret = os.environ.get("SLACK_SIGNING_SECRET", "").strip() + if not signing_secret: + return _http_text(500, "Missing SLACK_SIGNING_SECRET") + + headers = _lowercase_headers(event.get("headers") or {}) + raw_body = event.get("body") or "" + if event.get("isBase64Encoded"): + raw_body = base64.b64decode(raw_body).decode("utf-8") + + if not _verify_signature(headers, raw_body, signing_secret): + return _http_text(401, "Invalid Slack signature") + + form = urllib.parse.parse_qs(raw_body, keep_blank_values=True) + cmd = SlackCommand( + command=_first(form, "command"), + text=_first(form, "text"), + user_id=_first(form, "user_id"), + channel_id=_first(form, "channel_id"), + ) + + allowed_channels = _split_csv(os.environ.get("SLACK_ALLOWED_CHANNEL_IDS", "")) + if allowed_channels and cmd.channel_id not in allowed_channels: + # Slack surfaces non-200 responses as "dispatch_failed", so return 200 with a helpful message. + return _http_text(200, "Not allowed in this channel.") + + # Route based on Slack's `command` field. + # Non-destructive scan command + if cmd.command in ("/seek", "/v2_seek"): + _invoke_worker(mode="seek", cmd=cmd) + return _http_text(200, "BloodHound is on the hunt...please stand by.") + + # ------------------------------------------------------------ + # Preview teardown plan (safe) + # ------------------------------------------------------------ + if cmd.command in ("/v2_seek_destroy_plan",): + _invoke_worker(mode="seek", cmd=cmd) + return _http_text(200, "Generating teardown preview...please stand by.") + + # ------------------------------------------------------------ + # System status command (/v2_status) + # + # DEFERRED during the PR #2 merge: this routes to worker mode + # "status", which is implemented by PR #2's status_service (part of + # the handlers/services architecture we did not adopt). Our worker + # (bloodhound.app.run) has no "status" mode, so wiring this up is a + # follow-up — see docs/INTEGRATION_PR2_NOTES.md. Left unrouted rather + # than silently running a full scan under the /v2_status name. + # ------------------------------------------------------------ + + if cmd.command == "/seek_whitelist": + _invoke_worker(mode="whitelist", cmd=cmd) + return _http_text(200, "Fetching whitelist rules and protected resources...") + + if cmd.command == "/seek_cost": + _invoke_worker(mode="seek_cost", cmd=cmd) + return _http_text(200, "Pulling cost breakdown and budget summary...") + + # Destructive teardown command (/v2_seek_destroy is the PR #2 alias) + if cmd.command in ("/seek_destroy", "/v2_seek_destroy"): + if not _destroy_allowed(cmd): + # Slack surfaces non-200 responses as "dispatch_failed", so return 200 with a helpful message. + return _http_text(200, "Not allowed. Use `/seek_destroy CONFIRM` (and ensure you are allowlisted).") + _invoke_worker(mode="seek_destroy", cmd=cmd) + return _http_text(200, "Uh oh someone let the dog out ---> Seek & Destroy Underway friendly assets whitelisted...please stand by.") + + if cmd.command == "/guard": + # Local import keeps the cold-start path light and avoids import cycles. + from bloodhound.guard import MUTATION_SUBCOMMANDS, parse_command, user_allowed_to_mutate + + sub, _args = parse_command(cmd.text) + if sub in MUTATION_SUBCOMMANDS and not user_allowed_to_mutate(cmd.user_id): + return _http_text( + 200, + f"`/guard {sub}` is restricted to allowlisted admins " + "(set GUARD_ALLOWED_USER_IDS / SLACK_ALLOWED_USER_IDS).", + ) + _invoke_worker(mode="guard", cmd=cmd) + return _http_text(200, f"Working the guardrails: `/guard {cmd.text.strip() or 'list'}`...") + + # Unknown command (still return 200 so Slack doesn't show dispatch_failed). + return _http_text(200, f"Unknown command: {cmd.command}") + + +def _invoke_worker(mode: str, cmd: SlackCommand) -> None: + """ + Asynchronously invoke THIS lambda so the HTTP response can return immediately. + The worker invocation will run the normal scan/teardown and post to Slack. + """ + # We invoke THIS lambda asynchronously so Slack isn't waiting on a long scan. + function_name = os.environ.get("AWS_LAMBDA_FUNCTION_NAME") + if not function_name: + # Local runs won't have this; just no-op. + return + + payload = { + "source": "slack_command", + "mode": mode, + "slack": { + "command": cmd.command, + "text": cmd.text, + "user_id": cmd.user_id, + "channel_id": cmd.channel_id, + }, + } + + boto3.client("lambda").invoke( + FunctionName=function_name, + InvocationType="Event", + Payload=str.encode(json_dumps(payload)), + ) + + +def _destroy_allowed(cmd: SlackCommand) -> bool: + """ + Super-safe by default: + - Require CONFIRM token + - Require user allowlist if configured + """ + # Minimal "are you sure?" gate. + confirm_token = os.environ.get("SLACK_DESTROY_CONFIRM_TOKEN", "CONFIRM").strip() + if cmd.text.strip() != confirm_token: + return False + + allowed_users = _split_csv(os.environ.get("SLACK_ALLOWED_USER_IDS", "")) + if allowed_users and cmd.user_id not in allowed_users: + return False + + return True + + +def _verify_signature(headers: dict[str, str], body: str, signing_secret: str) -> bool: + ts = headers.get("x-slack-request-timestamp", "") + sig = headers.get("x-slack-signature", "") + if not ts or not sig: + return False + + try: + ts_int = int(ts) + except ValueError: + return False + + # Reject old requests (replay protection). + if abs(int(time.time()) - ts_int) > 60 * 5: + return False + + base = f"v0:{ts}:{body}".encode("utf-8") + digest = hmac.new(signing_secret.encode("utf-8"), base, hashlib.sha256).hexdigest() + expected = f"v0={digest}" + return hmac.compare_digest(expected, sig) + + +def _http_text(status_code: int, text: str) -> dict[str, Any]: + return { + "statusCode": status_code, + "headers": {"Content-Type": "text/plain; charset=utf-8"}, + "body": text, + } + + +def _lowercase_headers(headers: dict[str, Any]) -> dict[str, str]: + out: dict[str, str] = {} + for k, v in headers.items(): + if k is None or v is None: + continue + out[str(k).lower()] = str(v) + return out + + +def _first(form: dict[str, list[str]], key: str) -> str: + vals = form.get(key) or [] + return vals[0] if vals else "" + + +def _split_csv(raw: str) -> list[str]: + return [x.strip() for x in raw.split(",") if x.strip()] + + +def json_dumps(obj: Any) -> str: + # Tiny local wrapper to avoid importing json at module import time. + import json + + return json.dumps(obj) + + diff --git a/bloodhound/tables.py b/bloodhound/tables.py new file mode 100644 index 0000000..b54c3be --- /dev/null +++ b/bloodhound/tables.py @@ -0,0 +1,23 @@ +""" +bloodhound/tables.py + +Markdown table formatting for reports. +""" + +from __future__ import annotations + + +def _cell(value: object) -> str: + return str(value).replace("|", "\\|").replace("\n", " ") + + +def md_table(headers: list[str], rows: list[list[object]]) -> str: + if not rows: + return "_No rows._" + lines = [ + "| " + " | ".join(_cell(h) for h in headers) + " |", + "| " + " | ".join("---" for _ in headers) + " |", + ] + for row in rows: + lines.append("| " + " | ".join(_cell(c) for c in row) + " |") + return "\n".join(lines) diff --git a/bloodhound/teardown/__init__.py b/bloodhound/teardown/__init__.py new file mode 100644 index 0000000..53b7079 --- /dev/null +++ b/bloodhound/teardown/__init__.py @@ -0,0 +1,6 @@ +__all__ = ["plan_deletions", "execute_actions"] + +from bloodhound.teardown.executor import execute_actions +from bloodhound.teardown.planner import plan_deletions + + diff --git a/bloodhound/teardown/executor.py b/bloodhound/teardown/executor.py new file mode 100644 index 0000000..47f6411 --- /dev/null +++ b/bloodhound/teardown/executor.py @@ -0,0 +1,130 @@ +""" +bloodhound/teardown/executor.py + +Executes teardown actions produced by `planner.py`. + +Supports simulate mode (TEARDOWN_SIMULATE): +- EC2-family actions use DryRun=True where supported +- non-DryRun services are treated as no-op in simulate mode (safest) +""" + +from __future__ import annotations + +from dataclasses import dataclass + +from bloodhound.aws import AwsClients +from bloodhound.teardown.planner import PlannedAction + + +@dataclass(frozen=True) +class ExecutionResult: + attempted: int + succeeded: int + failed: int + simulated: int + failures: list[str] + + +def execute_actions(clients: AwsClients, actions: list[PlannedAction], *, simulate: bool) -> ExecutionResult: + """ + Executes planned actions. This is intentionally minimal and best-effort. + Caller must gate this behind APPLY_CHANGES=true. + If simulate=True, no destructive calls are performed: + - For EC2 actions that support DryRun, we pass DryRun=True and treat DryRunOperation as success. + - For actions that do not support DryRun (e.g., RDS delete, ELB delete), we no-op and count as simulated success. + """ + attempted = 0 + succeeded = 0 + failed = 0 + simulated_count = 0 + failures: list[str] = [] + + # ------------------------------------------------------------------ + # Safety guard: prevent large accidental deletions + # + # If the teardown plan contains too many resources, abort execution. + # This protects against scanning bugs or unexpected AWS API results + # that could otherwise cause mass deletion. + # ------------------------------------------------------------------ + from bloodhound.config import load_config + cfg = load_config() + + if len(actions) > cfg.teardown.max_delete_count: + raise RuntimeError( + f"Teardown aborted: plan contains {len(actions)} resources " + f"which exceeds TEARDOWN_MAX_DELETE_COUNT={cfg.teardown.max_delete_count}" + ) + + for a in actions: + attempted += 1 + try: + # simulate=True guarantees we do NOT destroy anything: + # - EC2-family: validate permissions/shape with DryRun=True + # - RDS/ELB deletes: no-op (safest) + did_simulate = _execute_one(clients, a, simulate=simulate) + if did_simulate: + simulated_count += 1 + succeeded += 1 + except Exception as e: + failed += 1 + failures.append(f"{a.service}/{a.region}/{a.resource_type}/{a.id} -> {a.action}: {e}") + + return ExecutionResult( + attempted=attempted, + succeeded=succeeded, + failed=failed, + simulated=simulated_count, + failures=failures, + ) + + +def _execute_one(clients: AwsClients, a: PlannedAction, *, simulate: bool) -> bool: + # Map actions to boto3 service clients. + if a.action in {"terminate_instances", "delete_volume", "release_address", "delete_nat_gateway"}: + ec2 = clients.client("ec2", region=a.region) + if simulate: + params = dict(a.params) + params["DryRun"] = True + try: + getattr(ec2, a.action)(**params) + except Exception as e: + if _is_dry_run_success(e): + return True + raise + # If the API actually performed the action, something is wrong; treat as error to be safe. + raise RuntimeError("DryRun did not raise; refusing to continue in simulate mode") + getattr(ec2, a.action)(**a.params) + return False + + if a.action == "delete_db_instance": + if simulate: + # RDS delete does not support DryRun. No-op for safety. + return True + rds = clients.client("rds", region=a.region) + getattr(rds, a.action)(**a.params) + return False + + if a.action == "delete_load_balancer": + if simulate: + # ELBv2 delete does not support DryRun. No-op for safety. + return True + elb = clients.client("elbv2", region=a.region) + getattr(elb, a.action)(**a.params) + return False + + raise ValueError(f"Unsupported action: {a.action}") + + +def _is_dry_run_success(exc: Exception) -> bool: + """ + boto3 typically raises botocore.exceptions.ClientError with error code DryRunOperation. + We avoid importing botocore types here; we just pattern-match on known attributes. + """ + resp = getattr(exc, "response", None) + if not isinstance(resp, dict): + return False + err = resp.get("Error") or {} + code = err.get("Code") + return code == "DryRunOperation" + + diff --git a/bloodhound/teardown/planner.py b/bloodhound/teardown/planner.py new file mode 100644 index 0000000..84e675f --- /dev/null +++ b/bloodhound/teardown/planner.py @@ -0,0 +1,49 @@ +""" +bloodhound/teardown/planner.py + +Builds a teardown action plan from candidate ResourceRecords. +This is used for both dry-run reporting and apply-mode execution. +""" + +from __future__ import annotations + +from dataclasses import dataclass + +from bloodhound.types import ResourceRecord + + +@dataclass(frozen=True) +class PlannedAction: + service: str + region: str + resource_type: str + id: str + arn: str | None + action: str + params: dict + + +def plan_deletions(records: list[ResourceRecord]) -> tuple[list[PlannedAction], list[ResourceRecord]]: + """ + Returns (planned_actions, manual_resources). + """ + actions: list[PlannedAction] = [] + manual: list[ResourceRecord] = [] + for r in records: + if r.delete_supported and r.delete_action and r.delete_params: + actions.append( + PlannedAction( + service=r.service, + region=r.region, + resource_type=r.resource_type, + id=r.id, + arn=r.arn, + action=r.delete_action, + params=r.delete_params, + ) + ) + else: + manual.append(r) + return actions, manual + + diff --git a/bloodhound/types.py b/bloodhound/types.py new file mode 100644 index 0000000..e8ebbf3 --- /dev/null +++ b/bloodhound/types.py @@ -0,0 +1,36 @@ +""" +bloodhound/types.py + +Shared data structures used across scanners/whitelist/teardown. +""" + +from __future__ import annotations + +from dataclasses import dataclass, field +from typing import Any, Optional + + +@dataclass(frozen=True) +class ResourceRecord: + service: str + resource_type: str + region: str + id: str + arn: Optional[str] + state: str + tags: dict[str, str] + metadata: dict[str, Any] = field(default_factory=dict) + + delete_supported: bool = False + delete_action: Optional[str] = None + delete_params: Optional[dict[str, Any]] = None + + +def resource_key(r: ResourceRecord) -> str: + if r.arn: + return r.arn + return f"{r.service}:{r.region}:{r.id}" + + +def resource_display_name(r: ResourceRecord) -> str: + return r.tags.get("Name") or r.id diff --git a/bloodhound/whitelist.py b/bloodhound/whitelist.py new file mode 100644 index 0000000..62b3b48 --- /dev/null +++ b/bloodhound/whitelist.py @@ -0,0 +1,76 @@ +""" +bloodhound/whitelist.py + +Whitelist (keep) logic for Bloodhound v2. +""" + +from __future__ import annotations + +import re +from dataclasses import dataclass + +from bloodhound.config import WhitelistConfig +from bloodhound.types import ResourceRecord, resource_display_name, resource_key + + +@dataclass(frozen=True) +class WhitelistMatch: + reason: str + + +def _name_blob(record: ResourceRecord) -> str: + parts = [record.id, resource_display_name(record)] + parts.extend(record.tags.values()) + return " ".join(parts) + + +def match_whitelist(record: ResourceRecord, cfg: WhitelistConfig) -> WhitelistMatch | None: + if record.id in cfg.keep_resource_ids: + return WhitelistMatch(reason="KEEP_RESOURCE_IDS") + if record.arn and record.arn in cfg.keep_resource_ids: + return WhitelistMatch(reason="KEEP_RESOURCE_IDS") + if resource_key(record) in cfg.keep_resource_ids: + return WhitelistMatch(reason="KEEP_RESOURCE_IDS") + + for key, value in cfg.keep_tag_rules: + tag_val = record.tags.get(key) + if tag_val is not None and tag_val.strip().lower() == value.strip().lower(): + return WhitelistMatch(reason=f"tag `{key}={tag_val}`") + + blob = _name_blob(record) + for pattern in cfg.keep_name_patterns: + if re.search(pattern, blob, re.IGNORECASE): + return WhitelistMatch(reason=f"name/tag matches `/{pattern}/i`") + + return None + + +def is_whitelisted(record: ResourceRecord, cfg: WhitelistConfig) -> bool: + return match_whitelist(record, cfg) is not None + + +def filter_whitelisted( + records: list[ResourceRecord], cfg: WhitelistConfig +) -> tuple[list[ResourceRecord], list[ResourceRecord], dict[str, WhitelistMatch]]: + kept: list[ResourceRecord] = [] + candidates: list[ResourceRecord] = [] + reasons: dict[str, WhitelistMatch] = {} + for r in records: + match = match_whitelist(r, cfg) + if match: + kept.append(r) + reasons[resource_key(r)] = match + else: + candidates.append(r) + return candidates, kept, reasons + + +def format_whitelist_rules(cfg: WhitelistConfig) -> list[str]: + lines: list[str] = [] + for key, value in cfg.keep_tag_rules: + lines.append(f"- tag `{key}={value}`") + for pattern in cfg.keep_name_patterns: + lines.append(f"- name/tag regex `/{pattern}/i`") + if cfg.keep_resource_ids: + lines.append(f"- explicit IDs/ARNs: `{len(cfg.keep_resource_ids)}` configured") + return lines diff --git a/docs/INTEGRATION_PR2_NOTES.md b/docs/INTEGRATION_PR2_NOTES.md new file mode 100644 index 0000000..725f90a --- /dev/null +++ b/docs/INTEGRATION_PR2_NOTES.md @@ -0,0 +1,79 @@ +# Integrating PR #2 (mmccla1n v2 CI/CD + docs) into the current v2 line + +This branch (`integrate-pr2-cicd-docs`) salvages the **architecture-neutral, additive** +pieces of [PR #2](https://github.com/codeplatoon-devops/Bloodhound/pull/2) on top of the +current v2 line (flat `bloodhound/` layout with `/guard`). It is **work in progress** — +the coupled parts below still need decisions. + +## Brought in (safe / additive) + +- `scripts/build_lambda.sh` — rsyncs `bloodhound/` + `handlers/`; works with our flat layout as-is. +- `scripts/bootstrap_github_oidc.sh` — one-time GitHub OIDC role bootstrap for CI auth. +- `tools/smoke_test_lambda.sh` — pure AWS CLI checks against `BloodhoundLambdaV2`. +- `infra/slack/bloodhound_v2_manifest.json` + `infra/slack/README.md` — Slack app manifest. +- `.github/workflows/bloodhound_ops.yml` — manual ops workflow (see caveat). +- `docs/lambda_packaging.md`, `docs/troubleshooting_terraform_lambda.md`, `docs/safe_operations.md`. + +## Outstanding — needs a decision (do NOT merge to main until resolved) + +1. **OIDC role / Terraform.** `bloodhound_ops.yml` and the OIDC scripts assume an IAM role + that PR #2's `infra/` creates (`account_guard.tf`, `iam.tf` changes, `variables.tf` +96 lines). + Our `infra/` is tuned for our code. Adopting theirs is not a file-copy — it needs a + `terraform plan` against the Code Platoon account and testing. **Not done here.** + +2. **`validation` mode is broken on this branch.** `bloodhound_ops.yml` mode=`validation` + calls `tools/run_validation_workflow.sh`, which depends on mmc's `validation_handler` + (part of their `handlers/services` refactor we have NOT adopted). `scan` / `status` + modes are architecture-neutral; `validation` will fail until the refactor question is settled. + +3. **Command-specific docs not ported.** PR #2 docs `troubleshooting_slack_commands.md`, + `slack_app_operations.md`, `quick_demo.md`, `run_validation.md`, `validate_teardown.md`, + `slack_and_lambda_validation.md`, `architecture_overview.md` reference `/v2_seek*` / + `/v2_status` and the handlers/services architecture. They need command-name reconciliation + to our set (`/seek`, `/seek_cost`, `/seek_whitelist`, `/seek_destroy`, `/guard`) before use. + +4. **The refactor decision (blocks 1–3).** PR #2 restructured into `handlers/` + `services/`. + Our `/guard` lives in the flat layout. Either (a) keep flat and skip the refactor, or + (b) migrate `/guard` + cost/whitelist commands into the services layout. Most of the + coupled infra/docs work above hinges on this. + +5. **Close PR #2** as superseded (with a comment crediting salvaged work) — only after the + above lands. + +--- + +## UPDATE — full `mmc/main` merge completed (branch `merge-pr2-full`) + +All of PR #2 was merged into our line. 5 conflicts resolved: + +- `bloodhound/app.py`, `bloodhound/messages.py` → **kept ours (HEAD)**. The deployed + entrypoint (`handlers.lambda_function.lambda_handler`, per `infra/lambda.tf`) calls our + `bloodhound.app.run`, so our worker + our formatters are the canonical, working path. +- `bloodhound/slack_commands.py` → **union**. All commands preserved: `/seek`, `/seek_cost`, + `/seek_whitelist`, `/seek_destroy` (+ `/v2_seek_destroy` alias), `/guard`, and + `/v2_seek_destroy_plan` (maps to the non-destructive `seek` mode). +- `README.md` → kept our rewrite. `.gitignore` → union. + +Verified: `guard.py`/`controls.py` intact; the deployed cold-start path imports cleanly; +`python -m compileall` passes; **every** module (incl. mmc's `handlers/` + `services/`) imports. + +### Chose our (flat) architecture as canonical; mmc's handlers/services are present but UNWIRED + +mmc's `bloodhound/handlers/*` and `bloodhound/services/*` landed as additive modules but are +**not** driven by our worker. To keep the tree import-clean, two formatters +(`format_status_message`, `format_whitelisted_resources_message`) + helpers `_fmt_kv` / +`_display_resource` were ported into our `messages.py` (used only by those services). + +### Still deferred (NOT done by this merge — these are feature/architecture work, not conflicts) + +- **`/v2_status`** is intentionally left unrouted in `slack_commands.py` — our worker has no + `status` mode (that lives in mmc's `status_service`). Routing it now would silently run a + full scan under the status name. +- **Scheduled path is broken.** `handlers/lambda_function.py` routes scheduled events to + `bloodhound.handlers.scheduled_handler.handle_scheduled_event`, which lazily imports + `run_scheduled_scan` from `bloodhound.app` — a name our `app.py` does **not** define. The + module imports fine (lazy), but a real scheduled invoke would raise. The scheduled workflow + (`invoke_lambda.yml`) is currently disabled, so no live impact. Fix = add a + `run_scheduled_scan` entry to our `app.py` (or point the branch at our `run`). +- Adopting mmc's handlers/services architecture wholesale (and wiring `/v2_status`) remains a + separate follow-up. diff --git a/docs/SLACK_SETUP.md b/docs/SLACK_SETUP.md new file mode 100644 index 0000000..6bb997e --- /dev/null +++ b/docs/SLACK_SETUP.md @@ -0,0 +1,326 @@ +# Slack Setup (Bloodhound-V2) + +## Table of Contents + +- [Recommended Manifest Setup](#recommended-manifest-based-setup-v2) +- [Slack Manifest Design](#slack-manifest-design-architecture-notes) +- [Slack Commands](#slack-commands-bloodhound-v2) +- [Internal Command Mapping](#internal-command-mapping) +- [Teardown Safety Workflow](#teardown-safety-workflow) +- [Create or Update the Slack App](#1-create-or-update-the-slack-app) +- [Install the App](#2-install-the-app) +- [Retrieve Required Secrets](#3-retrieve-required-secrets-manual-step) +- [Invite Bot to Channel](#4-invite-bot-to-channel) +- [Capture Channel IDs](#5-capture-channel-ids) +- [Validate](#6-validate) +- [Legacy Manual Slack Setup](#legacy-manual-slack-setup-deprecated) +- [/v2_status Command](#v2_status--system-status-command) +- [Validate Slack Command Endpoint](#validate-slack-command-endpoint) + +This project uses a Slack App to post scan summaries, budget alerts, and handle slash commands. + +Bloodhound V2 Slack Commands + +/v2_seek + Run AWS resource scan + +/v2_seek_destroy_plan + Preview teardown plan + +/v2_seek_destroy CONFIRM + Execute destructive teardown + +/v2_status + Show system health and configuration + +The preferred setup method is **manifest-based configuration**, which ensures Slack app settings are version-controlled and reproducible. + +--- + +## ✅ Recommended: Manifest-Based Setup (V2) + +The canonical Slack configuration lives in: + +`infra/slack/bloodhound_v2_manifest.json` + +## Slack Manifest Design (Architecture Notes) + +The Slack app configuration is managed via a JSON manifest to ensure reproducibility and version control. + +### Design Principles + +**Least privilege** +Only minimal bot scopes are requested: + +- `chat:write` — post scan and budget messages +- `commands` — enable `/v2_seek`, `/v2_seek_destroy`, `/v2_status` +- `channels:read`, `groups:read`, `im:read`, `mpim:read` — read channel metadata + +Note: Although the Slack commands are `/v2_seek` and `/v2_seek_destroy`, +the internal execution modes remain `seek` and `seek_destroy`. +This preserves compatibility with existing scripts, validation tools, +and documentation across the repository. + +No admin or elevated scopes are requested. + +## Slack Commands (Bloodhound V2) + +The Slack interface exposes the following commands: + +| Command | Description | +|-------|-------------| +| `/v2_seek` | Runs a non-destructive AWS scan and posts results | +| `/v2_seek_destroy_plan` | Generates a teardown preview of resources that would be deleted | +| `/v2_seek_destroy CONFIRM` | Executes destructive cleanup of non-whitelisted resources | +| `/v2_status` | Returns service status and health information | + +Example usage: + +/v2_seek + +/v2_seek_destroy_plan + +/v2_seek_destroy CONFIRM + +/v2_status + +## Internal Command Mapping + +Although Slack commands are versioned (`/v2_*`), the internal Lambda +execution modes remain unchanged. + +```text +| Slack Command | Internal Mode | +|---------------|--------------| +| /v2_seek | seek | +| /v2_seek_destroy_plan | seek_destroy_plan | +| /v2_seek_destroy| seek_destroy | +| /v2_status | status | +``` + +## Teardown Safety Workflow + +Bloodhound uses a two-step teardown workflow to prevent accidental +destructive operations. + +Typical workflow: + +1. /v2_seek + Perform a scan and generate a teardown preview. + +2. /v2_seek_destroy_plan + Review the full deletion plan for non-whitelisted resources. + +3. /v2_seek_destroy CONFIRM + Execute the teardown plan and delete resources. + +**Stateless HTTP integration** +- `socket_mode_enabled = false` +- Slash commands use a Lambda Function URL (HTTPS endpoint). + +Requests are received by the Lambda handler and routed through +the Bloodhound event router to the Slack command handler. + +This keeps the architecture simple and serverless. + +**Non-interactive design** +- No buttons, modals, or interactive components. +- All actions are explicit slash commands. + +**Deployment flow** +The `url` fields in slash commands are placeholders during setup. + +After deploying the infrastructure, retrieve the Lambda endpoint with: + +terraform output bloodhound_lambda_url + +Use this URL as the Request URL for all slash commands. + +### 1. Create or Update the Slack App + +1. Go to https://api.slack.com/apps +2. Click **Create New App** +3. Choose **From an app manifest** +4. Select your workspace +5. Paste the contents of: + `infra/slack/bloodhound_v2_manifest.json` +6. Click **Create** + +If the app already exists: +- Go to **App Manifest** +- Replace contents with the repo JSON +- Click **Save Changes** + +### 2. Install the App + +1. Go to **Install App** +2. Click **Install to Workspace** +3. Approve permissions + +### 3. Retrieve Required Secrets (Manual Step) + +After installation: + +From **OAuth & Permissions**: +- Copy **Bot User OAuth Token** → `SLACK_BOT_TOKEN` + +From **Basic Information**: +- Copy **Signing Secret** → `SLACK_SIGNING_SECRET` + +Store securely. +Do NOT commit these to git. + +### 4. Invite Bot to Channel + +In Slack: + +`/invite @bloodhoundv2` + +### 5. Capture Channel IDs + +Right-click channel → Copy link + +Extract channel ID from URL. + +Set: + +```md +SLACK_SCAN_CHANNEL_ID= +SLACK_ALERT_CHANNEL_ID= + +``` + +### 6. Validate + +Run locally: + +`tools/run_local.py` + +Confirm Slack messages appear. + +# ⚠️ Legacy Manual Slack Setup (Deprecated) + +The steps below reflect the original manual Slack configuration +approach used prior to manifest-based setup. + +Use only if manifest configuration is unavailable. + +## Slack setup (from scratch) + +This project’s main `README.md` assumes you already have: + +- a Slack bot token (`SLACK_BOT_TOKEN`) +- Slack channel IDs for `SLACK_SCAN_CHANNEL_ID` and `SLACK_ALERT_CHANNEL_ID` + +Use this guide only if you need to create/configure the Slack app/bot from scratch. + +--- + +### 1) Create a Slack App + +1. Go to [Slack API: Applications](https://api.slack.com/apps). +2. Click **Create New App**. +3. Choose **From scratch**. +4. Name the app and select the workspace. +5. Click **Create App**. + +--- + +### 2) Add bot permissions + +1. In your Slack app settings, go to **OAuth & Permissions**. +2. Under **Scopes**, add bot token scopes: + - `chat:write` + - `channels:read` + - `groups:read` +3. Click **Install App to Workspace** and approve. +4. Copy the **Bot User OAuth Token** (this is your `SLACK_BOT_TOKEN`). + +--- + +### 3) Get the Slack Channel ID + +1. In Slack, open the channel. +2. Copy the channel ID from the channel details (or URL). +3. Set: + - `SLACK_SCAN_CHANNEL_ID=` + - `SLACK_ALERT_CHANNEL_ID=` (can be the same or different) + +--- + +### 4) Invite the bot to the channel + +In the channel, run: + +- `/invite @your-bot-name` + +--- + +## `/v2_status` — System Status Command + +The `/v2_status` command returns the current operational state of the +Bloodhound system. + +This command is read-only and does not perform any AWS actions. + +The status report includes: + +- current execution mode (DRY RUN, SIMULATION, or DESTRUCTIVE APPLY) +- deletion safety limits +- AWS account verification status +- summary of the most recent scan + +Example: + +/v2_status + +Example response: + +Bloodhound v2 — System Status + +System Mode +mode: DRY RUN +apply_changes: false +simulate: true + +Safety Guards +max_deletion_limit: 10 +expected_account_id: 123456789012 +account_verified: true + +## Validate Slack Command Endpoint + +After deployment, confirm the Lambda endpoint is active. + +Example: + +curl $(terraform output -raw bloodhound_lambda_url)/health + +Expected response: + +```json +{ + "ok": true, + "service": "BloodhoundLambdaV2", + "status": "healthy" +} +``` + +--- + +## Lambda Execution Logging + +Bloodhound Lambda executions emit structured log markers: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SLACK][request_id=...] +[BLOODHOUND][SCAN][request_id=...] +[BLOODHOUND][STATUS][request_id=...] + +The request_id corresponds to the AWS Lambda invocation ID +(context.aws_request_id) and allows engineers to trace +individual executions through CloudWatch logs. + diff --git a/docs/architecture_overview.md b/docs/architecture_overview.md new file mode 100644 index 0000000..dba0822 --- /dev/null +++ b/docs/architecture_overview.md @@ -0,0 +1,122 @@ +# Bloodhound Architecture Overview + +Bloodhound is a serverless automation system designed to detect and safely +remove unused AWS infrastructure. + +The system is implemented as an AWS Lambda service with multiple execution +entry points. + +--- + +## System Entry Points + +Bloodhound can be triggered from several sources: + +```text +| Source | Purpose | +|------|------| +Slack Commands | Interactive operations +GitHub Actions | CI/CD automation +Scheduled Events | Automatic scans +Validation Workflows | Safe teardown testing +``` + +All entry points eventually invoke the same internal pipeline. + +--- + +## High-Level Execution Flow + +```text +Slack / GitHub Actions / Scheduled Event + │ + ▼ + AWS Lambda Function URL + │ + ▼ + Event Router + (handlers.lambda_function) + │ + ▼ + Bloodhound Execution Pipeline + (bloodhound.app) + │ + ▼ + ┌─────────────────────────────────────┐ + │ Pipeline Stages │ + │ │ + │ 1. Resource Scan │ + │ scanner/ │ + │ │ + │ 2. Budget Evaluation │ + │ budget_service │ + │ │ + │ 3. Teardown Planning │ + │ teardown/planner │ + │ │ + │ 4. Execution (optional) │ + │ teardown/executor │ + │ │ + └─────────────────────────────────────┘ + │ + ▼ + Slack / Logs / Reports +``` + +## Safety Architecture + +Bloodhound is designed to operate safely by default. + +Destructive actions require multiple conditions: + +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +CONFIRM token in Slack command + +These guardrails ensure that infrastructure deletion cannot occur accidentally. + +## Resource Scanning + +The scanner layer currently supports: + +EC2 +ELBv2 +RDS + +## Future scanners may include: + +EBS snapshots +unused AMIs +orphaned ENIs +S3 buckets +Deployment Model + +Bloodhound is deployed as an AWS Lambda function using Terraform. + +Deployment pipeline: + +```text +scripts/build_lambda.sh + │ + ▼ +.build/lambda_pkg + │ + ▼ +archive_file + │ + ▼ +.build/bloodhound_lambda_v2.zip + │ + ▼ +AWS Lambda Deployment +``` + +## Key Design Principles + +Bloodhound was designed around several core principles: + +Safety-first infrastructure automation +Serverless operation +Slack-driven operations +Deterministic Lambda builds +Auditable infrastructure changes \ No newline at end of file diff --git a/docs/bloodhound_v2_plan.md b/docs/bloodhound_v2_plan.md new file mode 100644 index 0000000..787fb25 --- /dev/null +++ b/docs/bloodhound_v2_plan.md @@ -0,0 +1,495 @@ +# Bloodhound v2 Plan (tracked implementation checklist) + +## Table of Contents + +- [Current Reality (What v2 Does Today)](#0-current-reality-what-v2-does-today) +- [v2 Guiding Principles](#1-v2-guiding-principles-keep-it-minimal) +- [v2 Configuration](#2-v2-configuration-environment-variables) +- [Target Architecture](#3-target-architecture-whats-implemented) +- [Resource Record Schema](#4-resource-record-schema-current) +- [Resources to Scan](#5-resources-to-scan-status) +- [Teardown Delete Policy](#6-teardown-delete-policy-status) +- [Milestones](#7-milestones-tracked-checklist) +- [Open Questions / Future Improvements](#8-open-questions--next-improvements-optional) + +This document is the shared plan for evolving Bloodhound from v1.0 → v2.x while keeping the project simple and readable. + +Repo: `https://github.com/codeplatoon-devops/Bloodhound.git` + +--- + +## 0) Current reality (what v2 does today) + +Bloodhound v2 is already deployed as a **new** Lambda (`BloodhoundLambdaV2`) so it does not touch v1. + +### Invocation paths + +- **Scheduled**: A scheduled event invokes `BloodhoundLambdaV2`. + + Scheduled events may originate from: + + - EventBridge (production scheduler) + - GitHub Actions validation workflows + + These events route through a dedicated scheduled handler: + + scheduled_handler → run_scheduled_scan() → execute_pipeline() + + Scheduled executions do NOT pass through the generic `run()` function + to prevent recursive execution. + +- **On-demand**: Slack slash commands (`/v2_seek`, `/v2_seek_destroy_plan`, `/v2_seek_destroy CONFIRM`, `/v2_status`) hit a **Lambda Function URL**. + +### What it scans (per region) + +- **EC2 instances** (skips stopped/terminated) +- **EBS volumes** (unattached/`available`) +- **Elastic IPs** (unassociated) +- **NAT Gateways** (active states) +- **RDS DB instances** +- **ELBv2 load balancers** + +### What it produces (Slack) + +- **Scan summary** (includes zero counts) +- **Whitelisted resources list** (separate message) +- **Budget summary** (7-month cohort, dynamic monthly allowance) +- **Teardown plan** (always produced) +- **Teardown results** (only when apply-mode executes) + +### Direct validation (CLI) + +The Lambda can be invoked directly using the AWS CLI to validate core +pipeline behavior without Slack or GitHub Actions. + +Example: +```bash +aws lambda invoke \ +--function-name BloodhoundLambdaV2 \ +--region us-west-2 \ +--payload '{"source":"scan"}' \ +--cli-binary-format raw-in-base64-out \ +out.json +``` + +Then: + +`cat out.json` + +Expected result: + +```json +{ + "ok": true, + ... +} +``` + +This confirms: + +- routing logic is correct +- recursion issues are resolved +- pipeline executes successfully + +### Scheduler Validation (GitHub Actions) + +The repository includes a GitHub Actions workflow mode that +simulates scheduled EventBridge invocations. + +Mode: + +`validate_scheduler` + +Example payload used during validation: + +```json +{ + "source": "scheduled" +} +``` + +This validation ensures: + +- scheduled execution runs exactly once +- recursion does not occur +- structured logging is emitted +- request_id tracing appears in CloudWatch logs + +Each invocation produces a structured log marker: + +[BLOODHOUND][SCHEDULED][request_id=...] + +The request_id corresponds to the AWS Lambda invocation ID, +allowing a single execution to be traced across all CloudWatch log lines. + +This workflow allows engineers to validate scheduler behavior +before enabling production EventBridge triggers. + +### Teardown safety rails (v2) + +- Default is **dry-run** (`APPLY_CHANGES=false`) +- Safe testing of apply-mode: **simulate** (`TEARDOWN_SIMULATE=true`) + +Strong safety rails: + +- Explicit allowlist: TEARDOWN_TARGET_IDS=... +- Allow-all mode: TEARDOWN_ALLOW_ALL=true (dangerous; relies on whitelisting) + +Validation safety model: + +Validation runs are executed through a dedicated validation harness +rather than Slack commands. + +The validation workflow is: + +Terraform creates validation resource + ↓ +Validation script captures resource ID + ↓ +Validation script invokes Lambda with validation payload + ↓ +Lambda validation handler enables controlled destructive mode + ↓ +Teardown restricted to explicit validation targets + +Validation runs enforce three safety checks: + +1. Invocation source must be `validation` +2. Explicit `target_ids` must be provided +3. Targets must exist in scan results AND contain the tag `bloodhound:test=true` + +This ensures destructive validation testing cannot affect production resources. + + +This prevents accidental deployments that would enable automated deletion. +- Slash destroy requires: + - Confirm token: `/seek_destroy CONFIRM` (configurable token) + - Optional allowlists: user/channel IDs + +Bloodhound always generates a teardown plan (a list of resources it would delete). +If deletion is disabled, the plan is shown in Slack but no resources are removed. + +--- + +### Validation architecture (v2) + +Validation testing for teardown operations is automated and does not +use Slack commands. + +Validation events are invoked directly by the validation harness. + +Example validation payload: + +```json +{ + "source": "validation", + "mode": "seek_destroy_validation", + "target_ids": ["i-1234567890"] +} +``` + +The Lambda validation handler performs the following: + +- verifies the event originates from the validation harness +- verifies the correct validation mode +- requires explicit target_ids +- enables destructive execution internally +- restricts deletion scope to validation targets + +Additional safety checks occur during teardown planning: + +- target IDs must exist in scan results +- resources must contain tag `bloodhound:test=true` + +These safeguards ensure validation cannot accidentally delete +non-validation infrastructure. + +## 1) v2 guiding principles (keep it minimal) + +- **Configuration over code edits** + - Anything that varies cohort-to-cohort (start month, channels, regions) must be env-configurable. +- **Safe rollout for destructive actions** + - Default is dry-run. + - Apply-mode is explicit and layered with safety rails. +- **Simple whitelist** + - Primary mechanism is a single tag: `bloodhound:keep=true`. + - Optional escape hatch: env allowlist for IDs/ARNs (keep list) and explicit teardown targets. +- **No unnecessary infrastructure** + - Compute from AWS APIs each run when possible. + - Avoid DB/state unless it materially simplifies the system. + +--- + +## 2) v2 configuration (environment variables) + +This is the canonical list; `env.example` should be treated as the “source of truth” for local runs. + +### Slack + +- **`SLACK_ENABLED`**: `true|false` +- **`SLACK_BOT_TOKEN`**: bot token used to post messages +- **`SLACK_SCAN_CHANNEL_ID`**: channel for scan summaries + whitelisted list +- **`SLACK_ALERT_CHANNEL_ID`**: channel for budget alerts + teardown plan/results + - If unset, defaults to `SLACK_SCAN_CHANNEL_ID` + +### Slack slash commands (Function URL) + +- **`SLACK_SIGNING_SECRET`**: required for Slack signature verification +- **`SLACK_DESTROY_CONFIRM_TOKEN`**: required argument text for `/seek_destroy` (default `CONFIRM`) +- **`SLACK_ALLOWED_USER_IDS`** (optional): comma-separated list of Slack user IDs allowed to run destroy +- **`SLACK_ALLOWED_CHANNEL_IDS`** (optional): comma-separated list of Slack channel IDs allowed to run destroy + +### Regions + +- **`REGION_MODE`**: `explicit` or `discover` + - `explicit`: use `REGIONS` + - `discover`: discover regions dynamically +- **`REGIONS`**: comma-separated region list (only used in `explicit` mode) + +### Whitelist + +- **`KEEP_TAG_KEY`**: default `bloodhound:keep` +- **`KEEP_TAG_VALUE`**: default `true` +- **`KEEP_RESOURCE_IDS`** (optional): comma-separated IDs/ARNs always treated as kept + +### Teardown controls + +- **`APPLY_CHANGES`**: `true|false` (default `false`) +- **`TEARDOWN_SIMULATE`**: `true|false` (default `false` in config; we often use `true` for safe testing) +- **`TEARDOWN_TARGET_IDS`** (optional): comma-separated IDs/ARNs that are the only allowed targets +- **`TEARDOWN_ALLOW_ALL`**: `true|false` (dangerous; delete everything not whitelisted) +- **`RDS_FINAL_SNAPSHOT`**: `true|false` (default `false`) + +### Budget (dynamic cohort) + +- **`COHORT_START_YYYY_MM`**: e.g. `2026-01` +- **`COHORT_TOTAL_BUDGET_USD`**: default `3000` +- **`COHORT_LENGTH_MONTHS`**: default `7` +- **`BUDGET_OVER_DAYS`**: default `2` + +--- + +## 3) Target architecture (what’s implemented) + +### Execution Routing Model + +Bloodhound uses explicit event routing in the Lambda entrypoint. + +Event → Lambda Router → Handler → Execution Function + +Key rule: + +- Scheduled events must not pass through the generic `run()` function +- Slack HTTP events are handled by the Slack command handler +- Validation events are handled by the validation harness handler +- Manual invocations (scan/status) execute through the main `run()` pipeline + +This prevents: + +- recursive execution loops +- unintended handler re-entry +- ambiguous control flow + +The Lambda entrypoint performs deterministic event routing to ensure +each invocation type is handled by the correct execution path. + +Example routing flow: + +```text +Lambda handler + ↓ +event routing (Slack / scheduled / validation / default) + ↓ + +Slack: + handle_slack_command_http() + +Scheduled: + scheduled_handler → run_scheduled_scan() + +Validation: + validation handler → controlled teardown validation + +Default: + bloodhound.app.run() +``` + +### Structured Logging + +Bloodhound emits standardized CloudWatch log markers to simplify +debugging and operational tracing. + +Each Lambda invocation logs a structured header: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SCHEDULED][request_id=abc123] +[BLOODHOUND][SCAN][request_id=xyz456] +[BLOODHOUND][STATUS][request_id=def789] + +The request_id value comes from the AWS Lambda context object +(`context.aws_request_id`) and uniquely identifies each invocation. + +This allows engineers to quickly identify invocation types and +trace individual Lambda executions through CloudWatch logs. + +### Code structure (current) + +- `bloodhound/` + - `app.py` (orchestrator) + - `config.py` (env parsing + defaults + validation) + - `scanner/` (`regions.py`, `scan_all.py`, `ec2.py`, `rds.py`, `elbv2.py`) + - `whitelist.py` + - `budget.py` + - `teardown/` (`planner.py`, `executor.py`) + - `messages.py` (Slack message formatting) + - `slack.py` (Slack API) + - `slack_commands.py` (Function URL entrypoint: verify + route) + - `types.py` (resource record schema) +- `handlers/lambda_function.py` (Lambda handler) +- `tools/run_local.py` (local runner) +- `infra/` (Terraform: build zip, IAM, Lambda, Function URL) + +### Logic flow (every run) + +- **Scan** + - Determine regions + - Collect resources per region/service + - Apply whitelist + - Post scan summary + whitelisted list +- **Budget** + - Use Cost Explorer to compute cohort-to-date spend + dynamic monthly allowance + - Compute run-rate month-end projection and “over budget streak” + - Post budget summary; post alert only when threshold is met +- **Teardown** + - Build a plan (always) + - If apply-mode: execute (or simulate) and post results + +--- + +## 4) Resource record schema (current) + +All scanners produce records with a shared shape (`bloodhound/types.py`): + +- **Required** + - `service`, `resource_type`, `region`, `id`, `state`, `tags` +- **Optional** + - `delete_supported`, `delete_action`, `delete_params` + +--- + +## 5) Resources to scan (status) + +Phase 1 (high value, low complexity) + +- ~~EC2 instances~~ +- ~~RDS instances~~ +- ~~Elastic IPs (unassociated)~~ +- ~~NAT gateways~~ +- ~~EBS volumes (unattached)~~ +- ~~ELBv2 load balancers~~ + +Phase 2 (later; only if needed) + +- EBS snapshots +- AMIs +- ElastiCache +- OpenSearch +- Redshift + +--- + +## 6) Teardown delete policy (status) + +Defaults (as implemented) + +- ~~EC2: terminate~~ +- ~~EBS: delete unattached volumes~~ +- ~~EIP: release if unassociated~~ +- ~~NAT gateway: delete~~ +- ~~Load balancer: delete~~ +- ~~RDS: delete without final snapshot by default (`RDS_FINAL_SNAPSHOT=false`)~~ + +--- + +## 7) Milestones (tracked checklist) + +### v2.0 (refactor + config + deploy) + +- ~~Archive v1.0 as runnable snapshot under `versions/v1_0/`~~ +- ~~Modularize into package structure (`bloodhound/`, `handlers/`, `tools/`, `docs/`)~~ +- ~~Env-driven Slack channels (scan vs alert)~~ +- ~~Env-driven region configuration (explicit + discover mode)~~ +- ~~Terraform deploy of a new Lambda (`BloodhoundLambdaV2`)~~ +- ~~Slack message formatting improvements (human-readable, consistent, includes zeros)~~ + +### v2.1 (resource coverage) + +- ~~EC2 instances~~ +- ~~EBS unattached volumes~~ +- ~~EIPs unassociated~~ +- ~~NAT gateways~~ +- ~~RDS instances~~ +- ~~ELBv2~~ + +### v2.2 (whitelist) + +- ~~Tag-based whitelist: `bloodhound:keep=true`~~ +- ~~Optional keep list: `KEEP_RESOURCE_IDS`~~ +- ~~Whitelisted resources posted as a separate list~~ + +### v2.3 (teardown dry-run) + +- ~~Planner produces proposed actions~~ +- ~~Plan posted to Slack~~ +- ~~Full plan logged as JSON~~ + +### v2.4 (teardown apply-mode + safety rails) + +- ~~Apply-mode gated by `APPLY_CHANGES=true`~~ +- ~~Simulate mode available (`TEARDOWN_SIMULATE=true`)~~ +- ~~Target filter safety rail (`TEARDOWN_TARGET_IDS`)~~ +- ~~Allow-all mode (`TEARDOWN_ALLOW_ALL=true`)~~ +- ~~Executor posts results to Slack~~ + +### v2.5 (budget + alerts) + +- ~~Cost Explorer cohort-to-date + dynamic monthly allowance~~ +- ~~Month-end run-rate projection~~ +- ~~Alert on `BUDGET_OVER_DAYS` consecutive days over allowance~~ + +### v2.6 (slash commands) + +- ~~Function URL entrypoint~~ +- ~~Signature verification + replay protection~~ +- ~~`/v2_seek` (non-destructive scan)~~ +- ~~`/v2_seek_destroy_plan` (teardown preview)~~ +- ~~`/v2_seek_destroy CONFIRM` (destructive, guarded)~~ +- ~~`/v2_status` (system status report)~~ +- ~~Optional allowlists for destroy (user/channel IDs)~~ + +### v2.7 (guardrail management — `/guard`) + +Bloodhound owns the cost guards instead of CLI scripts. A *guardrail* spans two layers +edited in sync: the org **SCP** (member accounts) and the **IAM group policy** (IAM-user +students in the mgmt account) — so they can never drift (the drift once left RDS blocked +for students after the SCP was loosened). + +- ~~`/guard list` / `show ` / `members ` (read)~~ +- ~~`/guard allow|deny ` — edits BOTH layers, toggleable-service safelist~~ +- ~~`/guard enable|disable ` — attach/detach the IAM policy to its group~~ +- ~~`/guard add-student|remove-student `~~ +- ~~Mutation gate: GUARD_ALLOWED_USER_IDS (falls back to SLACK_ALLOWED_USER_IDS)~~ +- ~~Additive IAM perms for the Lambda role (org UpdatePolicy/Attach, iam policy-version + group mgmt)~~ + +Phase 2 (next): 2-3 tiers (Core Lab / Extended / Locked) via the `tier` field + GUARD_REGISTRY. + +--- + +## 8) Open questions / next improvements (optional) + +- Separate scan vs teardown IAM roles (read-only vs write) +- Add more resource types if needed (snapshots/AMIs/etc.) +- Optional: separate scheduled scan runs from destructive runs via dedicated workflow/job \ No newline at end of file diff --git a/docs/configuration_system.md b/docs/configuration_system.md new file mode 100644 index 0000000..4d65243 --- /dev/null +++ b/docs/configuration_system.md @@ -0,0 +1,298 @@ +# Bloodhound v2 Configuration Guide + +## Table of Contents + +- [Configuration Sources](#configuration-sources) +- [Teardown Mode Configuration](#teardown-mode-configuration) +- [Deletion Safety Limit](#deletion-safety-limit) +- [AWS Account Safety Guard](#aws-account-safety-guard) +- [Terraform Deployment Safety](#terraform-deployment-safety) +- [Bloodhound Safety Architecture](#bloodhound-safety-architecture) +- [Teardown Execution Flow](#teardown-execution-flow) +- [Related Documentation](#related-documentation) + +This document describes the configuration system used by **Bloodhound v2**, including environment variables, teardown behavior, and operational safety controls. + +Configuration is primarily provided through environment variables. + +For local development, variables are defined in: + +``` +.env +``` + +For AWS deployment, variables are configured in the Lambda **Environment Variables** section. + +An example configuration template is provided in: + +``` +env.example +``` + +--- + +# Configuration Sources + +Bloodhound loads configuration from the following sources: + +| Source | Purpose | +| ---------------------------- | ---------------------------------- | +| `.env` | Local development configuration | +| `env.example` | Template for creating `.env` | +| Lambda environment variables | Production configuration | +| Terraform variables | Infrastructure-level configuration | + +--- + +# Teardown Mode Configuration + +Bloodhound supports both **safe planning mode** and **real deletion mode**. + +Two environment variables control how teardown operations behave: + +``` +APPLY_CHANGES +TEARDOWN_SIMULATE +``` + +These variables must follow specific combinations. + +| APPLY_CHANGES | TEARDOWN_SIMULATE | Meaning | +| ------------- | ----------------- | ------------------------------------- | +| false | true | Safe dry-run mode (default operation) | +| true | false | Real deletion mode | +| false | false | Allowed but uncommon configuration (builds a plan but performs no deletion) | +| true | true | ❌ Invalid configuration | + +If both values are set to `true`, the configuration becomes contradictory. + +Example: + +``` +APPLY_CHANGES=true +TEARDOWN_SIMULATE=true +``` + +This would instruct Bloodhound to: + +* perform destructive actions +* simulate destructive actions + +This configuration is invalid. + +The validation scripts will refuse to run if this state is detected. + +--- + +# Deletion Safety Limit + +Bloodhound includes a safety rail that limits how many resources may be deleted in a single run. + +Environment variable: + +``` +TEARDOWN_MAX_DELETE_COUNT +``` + +Example: + +``` +TEARDOWN_MAX_DELETE_COUNT=5 +``` + +If a teardown plan contains more resources than this limit, execution will stop. + +This protects against: + +* scanning bugs +* AWS API anomalies +* incorrect filtering logic +* accidental large-scale deletion events + +--- + +# AWS Account Safety Guard + +Validation scripts include a safety guard that verifies the AWS account ID before executing destructive tests. + +Environment variable: + +``` +EXPECTED_AWS_ACCOUNT_ID +``` + +Example: + +``` +EXPECTED_AWS_ACCOUNT_ID=123456789012 +``` + +When validation scripts run, they compare the current AWS credentials against this value. + +If the account does not match, execution stops. + +This prevents validation scripts from running against the wrong AWS account. + +--- + +# Terraform Deployment Safety + +Terraform includes an additional safety guard that prevents deployments when destructive mode is enabled. + +Variable: + +``` +allow_apply_mode +``` + +Bloodhound can delete resources when: + +``` +APPLY_CHANGES=true +``` + +However Terraform will refuse deployment unless the engineer explicitly confirms the action. + +Example deployment command: + +``` +terraform apply -var allow_apply_mode=true +``` + +This prevents accidental enabling of destructive mode. + +--- + +# Bloodhound Safety Architecture + +## Execution Path Safety (Important) + +Bloodhound separates execution paths based on invocation type to ensure +safe and deterministic behavior. + +- Slack commands may use async self-invocation to return immediately +- Scheduled executions run synchronously through a dedicated path +- Validation harness invocations execute through a dedicated validation handler +- Manual operations (scan/status) execute through the main pipeline + +Scheduled events do NOT pass through the generic `run()` function. + +Instead they follow the dedicated execution path: + +scheduled_handler → run_scheduled_scan() → execute_pipeline() + +Scheduled events may originate from: + +- EventBridge (production scheduler) +- GitHub Actions scheduler validation workflows (`validate_scheduler` mode) + +This separation prevents recursive execution and ensures that scheduled +runs cannot re-enter the Lambda routing layer. + +Bloodhound includes multiple independent safety mechanisms designed to prevent accidental infrastructure deletion. + +These controls operate at different layers of the system. + +| Safety Layer | Purpose | +| -------------------------------- | ---------------------------------------------------------- | +| Slack confirmation token | prevents accidental teardown commands | +| validation harness isolation | restricts automated destructive tests to validation runs | +| max deletion count | prevents mass deletion events | +| Terraform apply guard | prevents destructive deployment configuration | +| Terraform account guard | prevents deploying infrastructure in the wrong AWS account | +| validation script account guard | prevents running validation tests in the wrong AWS account | +| config consistency guard | prevents invalid teardown configuration | + +These protections are intentionally redundant to provide multiple layers of safety. + +If one safety mechanism fails or is bypassed, others remain in place. + +This **defense-in-depth model** is common in internal cloud automation systems. + +--- + +# Lambda Logging and Traceability + +Bloodhound emits standardized CloudWatch log markers for all Lambda +invocations. + +Each invocation includes a structured log header: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SCHEDULED][request_id=abc123] +[BLOODHOUND][SCAN][request_id=xyz456] +[BLOODHOUND][STATUS][request_id=def789] + +Including the Lambda `request_id` (from `context.aws_request_id`) +allows engineers to trace individual executions through CloudWatch +logs and quickly identify the event type being processed. + +This logging format significantly improves operational debugging and +scheduler validation. + +--- + +# Teardown Execution Flow + +The teardown process follows this sequence of safety checks. + +```text +Engineer / Validation Harness + │ + ▼ +Lambda Invocation + ├─ Slack Command (/v2_seek_destroy CONFIRM) + └─ Validation Harness Invocation + │ + ▼ +Lambda Router + │ + ▼ +Teardown Execution Path + │ + ▼ +Slack Confirmation Guard + │ + ▼ +Configuration Consistency Guard + │ + ▼ +Deletion Limit Guard + │ + ▼ +AWS API Delete Calls + │ + ▼ +CloudWatch Logging +``` + +Each stage ensures that destructive operations occur only when explicitly intended. + +--- + +# Related Documentation + +Detailed validation procedures are documented in the following guides. + +Slack command validation: + +``` +docs/slack_and_lambda_validation.md +``` + +Teardown validation workflow: + +``` +docs/validate_teardown.md +``` + +System architecture overview: + +``` +docs/bloodhound_v2_plan.md +``` + +--- diff --git a/docs/demo/cloudwatch_log_navigation.pdf b/docs/demo/cloudwatch_log_navigation.pdf new file mode 100644 index 0000000000000000000000000000000000000000..d367754d03d3075948e3196fa7add17a2d0a8695 GIT binary patch literal 454865 zcmc$`byOVA(kO^$aF^g7EV#S71$TG1;O_43?iwJt1b3GJ!JWa~*~#zTZ}*m3ehwkaFs;;iC?vkm2LQz!wD-%5n9L2!?^**rdCVysN2#$rAk=WkI3XYeTm_gjq z#>LbL)Y=%jn2MSj+nbmYGsv3SnY&mJvvRNy^Yg&B2h0Z3dRIX^nT21@xu2rOVuOSq^>H|y)?hTTsQ>X?~5D% z5iD_IxlTWcTzTeG6ofX$mR)%orfv(UR-GHyM(C=6aA>uaf1rFpVO#` z(}e5xd-O)j9%nN`zhPTV^R}H*&t3M5pWk#O&wd~ER%I6pbdi|r z^%&gcJn3r`_vyTDUPh9YleycMsQxkvbbMQ?Q5*dpd3{VXbnZcPMW}zkhZQFL1+!|0 zTE6y7M9w*T&AZ0bzR`mX^Idpj4`VdGf0|Rnp?OKGqE#+_5qTVlY{-= zOGoVD^xYKhKlk&`K8P8FEnS=yO`SySZ5{0G{>q*6|Gt@=9IRab{oVb~`+BBpuAw@- z)Gcrx_wwg({A(K%fg(&-h{p%{VSX*BE0A>Yjr!tEMs0c$OY&5^)~F5E!D2w?n#CJ!dpxl zO_kxB4%8+^x%9(%bY098t)=|BCMGT(MH&>*+4(xIr_N#XK00cOW#N9kkg>O?60(=m z@jwzp_T>w<*mNJ;C%-qJ*hA8|mE5p6d#i$!_}GI}g3vR*oKdQR`|?v!a1B*{$z1M~8! zSXh8Z4M{R-HU0|SAH4+&3oePnA}ig-X~1f(OBs?n#lZ2jv*d1=DGz7>=kzU#89WA6 z$I!5lLi@wJ%82q#(a=}<9DdrKZwTL`@zV$0HmWFkOh@YNLoTQC+$1FWHmzav<>wx9h#iD)h z&ocoIi&bfQ`}xM{l&a;>m`C~Ch$f>GbKx>kNX{!7R28|`Gs1+Rw+kgKg?+E$^kY-6LCSXg?^L!Sz*o+MMF zsM~FD+x9M~zL8P1y8xk2zI_eUfy?;8u&vcgnFuq_U2;UG-;E2E*=(ht@Kg1L-gKGM zY62>8;N>&cr#QR-B$NQ=Z6(q@NnEHlt0h~oyy58!Lx)S{uw!~7z*pUFxWpSQx`J#Z z-F6AF!Cu{9WzVa*l&%+~L_&0{HxXt;p0*4b(zn1r=q?5!X>&KA`zl|>B5d$MyJ?8HxY@zC~0$7NI zJcgAsU=LZW=}Xi>eEYIdq+rXsylPA;2unEF*bIcXr(8E72&IgqA1#}4O5Mb1-sK|w zJ(Vh73}vN=pZX&gT~-=okdxtZlFJQZn3x<34V?&mxLi2*jql6K6X^H%&~Onbp^T8^ zYsvkWW7(-S%g<(qQ?J)t>I-DK+P2nVM{|7y$fVrYNzutM@6K1ez@8}Gq>t!09PjN8 z1`w~3I4CeMl27`RtAe2c;M>RF&sJIxWNURhs0mr;gwb+~-IMwyzjX^a6#xn(m4x^D znskpuSx`t48uJ6$JiRuF_nU!iT0NFkob}A|PrxO6tgiSkdwZ2yMRx1Ya+qO^N`X3( z@$v~GaA|KE*Z2OzSy{9mp(P2{m+EAaLD@RtXNr_lqV!2TVrNesT?aRVOxII1a|&e6 zA4X-z$Dhw0l}VFiz+++4(otv7gGH2v&KwK|f{v)ZGeF z(ex3CLM)*pX*7ynUBxh6B2Y>?u}QyvNh3`ZWPS$fJOkp3I}xF@phqdxAC+wjcz;*+ zY7{PUd{6#c6;vDP&doDj_=-2p_t}8GpXcBD)rSVZ9QKo(9-%@ztxQDVz6N2)bz#M? z`+bv@8wULTVa&n2r@Pz41R(aOgYh@A8L>}$`M>}cDV+|WH~w6-=1@A2Nr}yIT~HCpGwiF!>rlEyT4C?O#iafb zxCGX>O!=f?9qS&>L-adSR>w(r-fd$jQqz#sJ-dvG1tYZHtMg0-#p8QiaO%=S0Ip!` zV8{$7TBWY8V6QvSnx$}_EG>^or`U}aG)U@Afk?OloKd<;l<`p*krt4l`!b6b^F_#P zyYtgMDh4f^jY?HH?RW^;hyagxEF>4(U_$afOnLT*=WM)AUsjPY=ujq0gF(W4`DBP*S*2HWP_=C1 zFG8hni`_v-BT3&h(=$dRLLg5hR02FZ z5|gtSs;&{AB%ua-qK?t1ctNAjp&g^PMduaUd(+wADaXNav-fK%*5k^Gw`k_CF#J&fy{|IzimsV)#z#> z*8ww@CNUcIL41WPL=!~!C`w)^I0*{-<<^(>zkqYDf*IoUDq)yb)uH3FB4DYq^kZ0mP8yI!|=$CmxK-$rQ_WVh81a`c3=|Z6?35&Q ztfY)vqg`I_9QMzbzW|+A0F7I>y&sKE!nvU@k5Iv3yXrgNA5Sd4&E9-m3yAk}qtv6c zT}EZ1W~PU|3q?eXLPJ9@1yDRBqCOHq(FxT~M4x{0jUyv7y1BXeC}Zw6fU1TCZ%mRY z8^66nl$Domro?Egi}nYHnvki@&erkk$!}V4fn;;UA~P@rq$lV+>In+=qW{!XV-IZY zC?PcvcM=mD6cZmx)k4Q+gis6hZyNzA1@M9>n7ANidwAUxN?NQ}XAcf>miR=^icO~% zpg{y-Mxt(K$FCO2bohh+wRJdJumX@CqSMe2fh*@y@!bKO%pm3Oz%QYK-|HqRkB()Z z1C&r1;oG**jW!Mb1E9t3h2L+A$En5%%&|;HqL*&3Zxbn54>AqJNhDa(xHJ*3+uAjN zv5hW{Y1yCz)TzGx<=pZ$4m5X-~wd|k#E`|zhkl4wl-rgUaQqb&%>iV z88`iF^e*p0rQh*-fhg7DaDaMV@}sb1e0<5i(`3c-RwgMiu>$do`}-n8b7l4z#WLs> z5s%I2v;@lc;lt{XHvW;A$(NGx42*Q1S3BE9M;q&U!vti%@1F8pEcRX9T85WT&Fwv( zJ&=`Ob!idlb?C*KE~K&kHkftVMVF-yP~A_2S22 zp$Hj;9wijvI_@&?0rlqFtm&I|stVoMw8WRQ?~q}PE8w4!l9YpaDJ~oBks%?ja0PsK zT!f7ZJ6ZX3-L`l3oAKD~*WPb(cpgMi--&NG_=xbSspsM@gG2dvZr8REvswzlg(*2W zuvw6-rnkw4iC=rCiAvzc_dgi@RZLAyBfMr2#uh9{MJdr%i^<2*8Zn>vyOF7S>gyS~ zxkKk7v}#%(4rEOT+E!YPRKZ62>BbPZWpNZ;Wxu&8|a^?Vk2BTgBrOnaOG93fZBTmET zbuRoy`E^gMU&1#}{Z+>C>gp<4pns9z`lC`wH(c&#R_t0=t@}rrm0W^UMEhM{XOO=<|}!W49Vc&&~LuGShiyP;%ug_O~(NfPf@9fk`Po zcmEPPgwrT9E&|1VU#r*jJI$h1l$KW0nWQD9`o0!DlcXMdfdak2N7${b*Bww{bx1y4 zn2XPIO+M#91=t_jTD@G(C5r}ic@i2!2A-YOa;(uM|Hcr8B=ODR65U852Khvx!7W%A zO}opCPa3+7s!L$CP4&9rKI2r`l|6<1v}qz*+aD*1M4Mej+V7xy|x4f}@R~8k?OCR2ZO-qFgX8 zkVLdJIMlY^pGM(llTeO8%l|47Me3Z%?Xs2P$`(`t1s~YSWDh$SdwnrAt8SqR#Nu}KJgioK@16>NolLg#=1NOF51^H{TnNjkU6!oT*-TSDNBuR%2g2qFxsR|XVU2PA*ZAkSR@+Z_S2xOx8mzUq)9LHRO5#tKCKw8c z$_Q`TRAusALn!Q$wQafZQU|7^(6)Pl+}s^PTr0Ru(u7F~Eht!sm<2sY5R{=R749We zRFM09Nx|d`eURj~a8f3?jeo+)#x~>&U_ufDJt0EwnpMJ z{UJSqF&}f$od@PcBCvJRD@XbiDyN+Q<2W@sTA&Gez<=EluXn#o6P}T#qbR9Il`X6C zrZ?Gcq48O!x9>fd(___fNEYDtJ3qs{Y(KRvR#4 z=>xO8l8!IqiL_Ky8Wvz8mhnNjq{^}|>UC?9CD-NMC`C|oxMIAFlQwfd2=>-_4`4t0 zjD?e?b4{EQBcqWh>np{}Y-~9hiYB9RZwrHARgRlDt;3Fmgqnsa2^Qu9Mn|E7Ry!mT zRvUn5@pW>v10_KDuX758()i!d6t|xyiLw2mBP>kh-JAyZ8yye_!F=iuHcETNG#+m89St)Stva2DnVK zIhAiDu!t~tI`q*F;}sHlzV8$>{aIFTr8UXM-hx4N*a^Ter4cqyIbJ|YCP{+z{W*Ct zk#)Mx&M2N_x+CgmbgSU`D~&6xk}FCbToa=m28avwuDT-X-xOj)vEmRp)X{Mxc!7tc zM9!{G7{@vGXyNYkbeeg>$F+PfqTRos^iYq;jvJ0wB?>*^$rY<`-)a1?Dg>i?7tgBqRl#w{8o@ z*}L@aK?-@HGxrFCUHf`F^okl#_>zP#$tX$5n^9b3npgv``%jn({dfon-qFM)t`3GQ zhHY?&>^N>I@MNT6?$!m?`)c1%1ENn0(~AR__tS=G(sVF?J;k(PV_^A#L6G(^z3s#@ zw$V5uY^lZ(2VKfsNm!-)#;ILB1vz&UNEKIb+qRLgsO*Zr0$AVmQdI;XWNW3p#nVTK zrQ`g$<}1nc9?;mEg68@v6`;h(}_FPcuI;s7s zY}#B9vh=h>V1InZNqYBw;Qy>%8ACO2(tHBjI@d-5r%cui<0(0AR`s-_k zeYO7S1j1M22Wx#v6#Rihr^RqkNy8`>Yc(dARM4V?TiJqA6!bt|KM zW@We8v@3ObxfwnO=0W;zScj|hqrmCCAAcAPCrgR*VVs~@GelqE> zmxe(>qrqr@YCw5_4l=Inr9CTk{^*{>B&ER6URB6IUH#P5u@?ho@GxeHiAhd-60fng zje3g)UQ4jiONp3wkypdp$$ka!>tqkgCS%EmH!_(46V!qr{U*#VA#3K=vODP`<_rc# z)^l-`bF96^0ntNYD1Gb^ACJ$?XkqZeX%PpCK=Ofpz5Y6HqUVHs;%k3fMZJC(ABa0| z&G_q^yr_#4e(zKcKYeC?g_|GJxBF!1@cAbR`#oOiDcZr2muCiV><+QGe^2+^k9DeL z+x>F9hv_tp^+THHG{^Bdc8}<%Yws&iQ@d#zX&uh&B@AN*Ex$gnEDB(-EW~|}JJLILQ&x5p7qGGgh#qSkyAL`g3 zg<0~lZ&)(a-QS1o8uh(ySUmWG~xl8D)Z!MO>qj*up-}Ltb_)E1zifD zSR;f1-rXFRi?ef3#q6K0RVa_MpE zYvf~SI1z5p;_vTQep#i|bSl18TJp72w!hYpGHH--4+*r~<8ZdeeN()-_Q(*uBrt8c zD10FB&ZqX=31DS4vJL8^9Z7MS4xy^TT&KF?zHoi{T3C&iLW zw4!$+p&?57s*lhoa1Gkx5bf|$TzbRVa;)qKom?-O6N;a?J$0;O!nx>mIDgMZ>nwr8 zDlYJ?{boD8Fq@a?8ae7vU*kiX&w=ah=uY5G#PYp_$ARKy;p|ASF%S5|sJ(UYyZGx2 zUqMy})66e%;?R5s>MzT|h_K<`x7L=(584<$7d>m*_*(99J9EH8)U%N@K;X7cOnil4 zqL{ytG}3YRe*Y;j_p9PH@DSv$%CDviwiKIU1-Ln&E)yt({Jv+II~>8>gP=7`AAv9F z2-hLaC#g$=demwA`!a5@iR+|2-VvOtKa1t<^>1`fQieZz8wy*E^m@#_Q=MLX)zgoy z&rwd!xT#KZe!bkEd*7gEY4|{SFJO{fwUr+@lAERW`NGv^pxF!9=C0)@MSL92?3^1B zqudQth!|BwxSqA%VZzq-lZ?7;S5ipLdPYsPV*BBYD zv!lm!=!rsl1wBPxp%f2HgFmLS-N#}xbtZ*k?C%RkauJ~{{Wh}VsD^gwOBF&V$XdLg zD%0xW!1K+8<8jakJShrH{Y(>auU+RXi*_;8Yx(tFt0tkvDkj+PXx<~!4>`?WK?hY} zLDv_hWhbBYBk|r|7SYNsuhrde>TKB179TY)j%tI5;w;iIe_+a zdS7o%UoZdnFX$N>A9JOcq@Mn)r1w-}RFKXT!9w}?4}Aj$ORisu&38vxMbC&s{b3H2 zx8%D%qt-jVbh%veCMbX-{()9UN#k_QP0Hqb6^VvO`w4G+lvo)m{87)l!P2VK$dGu-8SBOVX{4(C^mH`3~>k= z@sdh**0SXd_0Kv*YnIG)YEsB3_W*05L|x)i+8UP?x8#dg5lb6DbDc-I^q`h@Z?10cL1z#L=U;nE|+0guN8kKu)Piaikp_#!^XmKDa2U?^kVT zs31E@-^qjU3OW;D)kVKR^6B!V*4FY7&v#S-QE%TrMZR_sYtwsQig~9;$Kj(Uk>g}E zTCp*rvbwpT{Pb6*Q15B`ESykRHG%`xVdO`DVRsb7N30;8iYcvr0EmflwMB*b`!1e8 z7*mp_BW|I`MuY&m59RzcW^}Ft#Wg&>BB^VV9qLO%d zO+VMq{AiFyU)S>k2#T?462k5Oyc*o*cy29gQ1i#Vb;VfvT@?T362KlRJMw+-o$KQ- zjuB~ibK3bd1}KO7`x;HG1x7));)yjSG*&>_5+)HO77}9=AM7Be)PTf z@4R(U0LL-%hBwuv@2e(VRKdq%4FB$7{^Rlbw5OZ%A&(^StrG6TA${3v@G1s3e7fH^ zCixWmwZGkXL}1`uuV?4&2K>>-KQ)|ab@pAvH#6G5@~`6}|F)SAA|m`lpW%_>DNMa8 zrd7*&;Cr>7;fJ{HX&gHyu_;LRG{B;ipxC zZG#9M2!p(LdU8!V!p6n=zfk3p6XvHfxcu=EvU%e}NK25Ys3ZwK2M-Q)tm=tg3<#uBZ6}^9c8e$N zQpXg_bWtgG8<1|!#~8eS>#|2eT3(<0u|nRFwYT?O|0UDwJR^f8k0&pKg@uD94ja}( zhe1pbRS^mU{D0Jpzynlj=cWIGQ7Hlt2w7zQzZfGNfTJ(mk^ZFl04j+8abtoWFdP}o ztIOPJaSS)uzbhk7o zCbV)tlLGTGLRHt3h}BMcYr*%Y{8rxEMDt={4c8Va7^|LDSYn*mSHx%79)#2oP8%}m zSoI^$5G+%)0AjxKw5W!9j|PHE+cuX@?Wc+8j#q*LuZhcqAAM7`cZ2a6dId%FrOAH2 zOb#$llGcwQExP*UiY(`+wt;huTcNa4u13E^yTQ}x9>ww`{Qy~ z$FNZz>%bR!YA7?)Db0MRlN^{*RW4O-xi4ubBP&+@*qqvAMD>qZ-~=R(ca~%b6|k@M zCft2DlghAu>t%e~R~ zr%dtBEsbB!{XDi?8i(yC2>j>{1o~XEUmIhLdI%Rjhh)K1eqKUP!+>aHKBQCRx|4^T zugs>&DcvOuD3VZk_{=!b6+2$GQpa8w=LwuEsjJifh^X@3Y2-mC^iG9rCb_GTlc|da z`n~Md1jFLjJpP_0s(u4*5ZLX<4gIR;FMEF8yUi4lh}La(y*Zx8R>FmU`e{9YDd?0tNUrt7T`m02|mXkK{yW ze>xnl#u7~ne>|VhJgm|%T+dMjg!ZC~$tZ`k{;<+;twfCFNNet7ZH)Au0Y`}!Vc+K7^CpWynjHZJ*CB*giklX!g8*rO+4*XMG|_5H+KtC^e0 zF-5(0B|Pk7B>~;}kRc*gu1cwhzlBORlY0&4)T7rre4Y#kBC9*d32|MQZ5WEPS~pF(WC50s~$m=V>&$qf!Ydd@a?dto7 zsbK9Ja9^3CFX>Ph&RSq7{mMmBcC=Vr0Vahb@ek@6&+ky~&0o?9N7`%S#TiGPABj-iCqN-5gaZ76n!O=X%1_3+A@#(3g9Yvu!0+ ztrGhu`xWsn)X;@*QQ;}P(F(t(HaL0rM@QP;vrR!^>wGOFk}pR4WUrX zGA9Xe8DgS@tKN#w2R%`0^`$P6;;IpOw^GkT0@Z&wJ}_@qaW@@$bfQR1)agny@p!s? z$=SYC&309>Cq|9qKc(__x!y?GYIDV}zS-XQ^bdy(6XJW>RIQa$Y_kD3DWb6lE;H7i zW3(MasM3wR~({a>_vkPMk&iwy>XEjr^sXPLdLkN~8_G8KHHlk~V@$1z*ETYF}sN zGUHSn(9;r!y4xT_%Er~C^)5~4`syrOBfl)b0~z^!b}yKM2-_>{&_)l6%A~~=d&@Uu z{*(pf=)_?n9e5VjmwkAhCkCCf>{PfdiYHFe4eyps4Xaxp?S8cJxSk^1Z>}l8DVt{@3=<%O(P+(ir@->l#vcWU*(eH}RUjVO`;| zS-;$=t0zR~FitvqiO%y>F&p!-%4RzwiT9p2v9-`5`Q?51msW{|tIOudYJXUdRpzyR z)otOa0nc@wJ8h(vsgvk=oMG%3vT2`-P7*J>tDintvumVMXxmX>Zf zNH4kuj=$8;lj~8j<|g-RAxbFK9$N=9t?`z)NLFu)8wKsP9gg>~W^L9l)$QVl-swf> z6s!G|5}0LJD@Sgrkf{}W&<(8^q*)XtRBA+LSNttqXOCF<&Wn}?Mq0Al5?*8&3FZtamqZF^eZ7~!|q>t7tmF#-noIWK|^7{D$*j0bB+DtUk z;y_(>o)M+Zt+==L^9*YlcXSd@VEYh{02xv*U39F8D=M|R&wtUHE-sTkmyrcQ2dY)9 zb${J9`0U+3jI!V$M>V6N+hjjgr4vqs9cKARqZ^3PCwcT4cIyzmbhV$eFQgxBoE=Yc zTyPS(c8O5EK(;IQchZkbJV_xJ7zj%ld(L`(sxC~M!sGm;uPICTZ=?w+pKlV8EQPnr zq}BcPDH3sERBc5vw+V*0sAf#(iIe>txw&DJ1cKVg6FVO(7a;~z;47DE6Lf98Rwen<#&DsNI*~x9Er;(VM4l9wsJYUc3)9$B(cIO>{hs)9Bp&3JtnY`CA zv14OeEVf#k$y;^{wlS<7JDE>I(kyGW#L9}z0~&)YsgQ;}*As`m?Qercg-=U ztB4l`z2%!-;PiQ(<|$rFB2?E#7_xVz&LFh#Bw6z>sWaGRblt+ACR5s9y?8Y|tqNy! zBLf>jg}-{cGUPpP(3vx!FGL?SS)tKFHqoeK#@#Y;-us}maGrHOh0LUiM1&)nzyU|G zp~Y!Y>ic?|>*tC^{BvVT3*5_SpEpERI=)f8q0bwwkTEzq?%C* zX(kW@8*f-@Cb&m`q8u|+-^NRl&*l9X zEU|}6asNG3s$LgnNcCTuiB9PGSkv0f`x*_+W5Y=3+h6*b@I6MmTFBiZ`rFM^+70g*ms(h;SQRtofHT4Zcnon(y4objAD%H-nq)eG5nNry;mc~gGe{CLM zh9EKY5!UQ?8p<{UpDfhG5EHHTbD3g6s|mCjiFq=zG`h!-da7M_lp&UezUKDKvL?(U zZRO|Bgt7IxPvT}9?j~bmc~jC*j^M$qp?9oy0Qi)~cUvfKbTbsge2ZUCP+i|-;qRd!{8(A~a8?gHqkFXjWogx1)g9sSp{~eGu=}yw`S5K3!8_@VA`LEKK@!}SdK|#Ejr%ey3oE&GDd^*)r7p!<6fyq%6fI{fw~a;G(VoF>gi$CEY}fz>C;i{nvaHu`NWD-D8v2NM*3Y!ZsqYTnLT zI5f6IR*u|pF8j!pYUeM1jjeBO7iAdYaCt)H9ZAN9NGIp8JM;Gy)WxBaTQ6Ck6flWT z@>Dsvn9|Ff;PwCRD}XK5WWM97k~VjLM2LqKI0epYNbq*O_wIFJY1XT)BKiRjn{(xOjg_`sdtIl_nWCBYIwR|!B~M}S{xi^e!Om&_6Wtco)X)6g!fq= z0|2@ZyYp@n_ePa}tdqhy?SCopsL`qk5cjp;UGT@7KfbaY(xGKF-hw=jL}(v$bc>xL z&s^%p=X(XuaQVC=ly##qfv+|FWQFr`8+ zvC~&EI~5x%BQ3=DJG1_S8ufJk9*-ym*Kap{j2E(`WZfgCzP@X*eEpj^ap2x$qHYW_ zuz%)W>^Hk5dPeScV%*U}HnL6GthwlbNM#Xyto*WZcs+50Jf5!Eh&LliU^m%x;U={i zzn-Jda|u5h%2?NTg(Ypq2&JL<1(Lv~)PCu#;RKg zNfp~x`=?WRqjw;i{~^62234xcUrv%K=K2pXXz@?xF;)M4&g2mg&_@zy{@3T6l>udF zUIYCdW}YX9{NUSTt2))7FakP5{oUjO^jGO8RY3DjSm4XLZ9(>1-?Hwv{NDBi-fz`G z!w_KL%f@FCKlqcx#kp!hOL?GzR}nk{>w4Z_4=>`Pdp19wc4fS}KnWn?50Xpd-4B=i z*SD7*Y#PkkG*CWfPXKhqggtyq^1`mio?jnon?)o2i4DxVa;|&cT=hwmK#X`tfK|7= z+&|RxY!$7Au$m-qF1R1YK;| z9AutUAfRCe-6*wQ)W@(pWHq3PDDwWrpEm8@gxMWhh$l>N4STnX&r{CSz#AZN$%z_* zn7G=_;o|rRbODMUL0KxnZc*Z(yAQ3>v{*gOJO=$1ENN6Q@P1G6+k2s|A9__`r1AQw z^^JPsx2wyC%WgIMN>EVXVHLb0Px`)XH7L~oP!Rl!Sp~v$2=f22fyntRi8_)7==Dq+ zcRkrY9AB;hi9t|Mvu+WTJhK2$0pVBimal0b#yo2vBL#&-h|@Im$y>cORM6C~m}g<; zetd(Kj0_RQjd0Gl+f`fRUuAJT!9SEBl*an1+x65Hx9WOyt|UNzw{ocE8ZA}6b6o+4 z84&32U%&Cx-)S>-pekAEdUNo#HdfaQHhR&D4NEGh)OH<=$9lu)8+=5#NX^GqLe~qj z^QIzavFqKKoYE1`<@ZldRd1ob*P~2Q*_%<=J(00h(MV^#y#+`Lw{9mG-r=Kg?@V>g655}V!|DxgM*DW-uuy!4NHb3EYdwY&6 zc0E7EUTe8{Ivt6y@9x%Pdiv~i%wYj_eb#Z`;m1Q**`^?xM*|Vy@2{_sr_ww%wf>2J z_5I3PWb@JeV*BQ>N2lvtHyCWL(np=p*2B*$##64vZtZLJX3K|iFva*FqaF^I*-k)^ z#8CyR>(TWOgWp}tV8Ph*-lIo?g`Br{bv<0)_GUJbyz<`r@_EE_-J3uuIg zj$I3a2{bm#J-ib9?iLrXlFTSnYN;RVHk%d+)3oRLaXeDY@wlr}sI-ML;fsEn3~Gh@ zot-?02Tp=tr!FFh^~U=9X$n}K?lqa85OBV7$*y!AqJ(~4V!0a**TY$8eY#0WtV)Bc zakx7{mV`kjLdRD-zBC_(Ww8#+6Woeo=(hb`O|T1?bu{p4nEOU#_oAV+i*4_B8hq@I zgqc)XqiHWzrmaw=mZtsZ{lKQKwe_{ zt8U}OY|YwZx8RAB&U8_q5UT7Efxve?wC$F)@wWt)7{TAsz^KsVvgU$ay#}-Slnc8{ zz-F)JSxiF`IRPD)(_V3~HHVGV2fZN-^_Zsz*)yI608}Y=d|Z6p!*3Ocp~)=~+>G~= zk+8eo_x!bFglN(gS*YCgz6XEA zjJW1~IP6|Ue^UU5*szyF%2;t95fba(K^ht)NZ*hPq1XLNz?K)A zF2rhWa^cgeYyrWB;J4n`ZJG7ShwqtuM60KmnB`USa_vbsYrBx8M2-I^b8Zjg>aTut zg7|H&H_m6AoAs7uDY(ttwWp}+?)Rg^GDn!!E|)87yNo5W&cCr}$Q_au!^7tZGI6*F zRjZ=WLH7U*oC|bzWkiPiBU*(!byNU8lvCWDwxDVB?2Rn))*mQyXBv?Yn_bocbry;8TRfl23;}&4N;K<{KY~Bjj0{y%)s~ zHrhi6+A_WCW;=QWP zuWg62Lw-opV;JPXPv`Bh*i)h%12eh~Q$u(OM_UQ);H1$@CsMC?^nBWmM6t%Brv))6 zXVSAJoS#pjH+_w{_IOPR;w6x(%_9Z9kw??QWnrbU(g#F|9NX&ab;}5=I|_!Xw;Ga` z3JFErSqT>6<0)+u$VV6;5u<-ie<84Aa-VptNDKj;4S0y)d4pag?8AKJ^5GiZ)6!Jb zk4E<4{9Z!T=iS=j(ghS`eZp<6-R-qS{64B1AA(&wZ>OvNGdKjIz&@HtsL2V0pH&6X zG72KWObL#blx!~Xi~$DZxFE|37x2f-M-Wpj<{QYAp(rj{vnfKs;X;f(2i^}gcSidE z&;$CDD$amru$wq)_f?@>FZi3h9)9U|R9hcTL4s02n+?XB_h()L&lYikMIhVzgcjiS z;M?K#u*~De+5Wt7w&v#dv_Ca1u-W|`n3m`J%%z{I4qpO-{0|F3gsv|3_bZo6CI~`y z{k8#5WM_4@zn}R)P@BfJTr?2xVuG3%`mbzmV!aO_E8`Q_c2Ev@#0EF*^1E98g9*M# zmS6qAcaT{`x}^`5eD^-6@2n2x9S1U559!vik^X+DmkhulVcL|4=oT^*d@OBxnpygW zFprb`X=QRz!!Hv*2|7$ISxzn^sR=r|CtSVn>G1nxj-JBLLGyJwCtiiS%!MEedP>Y_*2hZY>fl~IE-FlFq>$I`-v^6iGLcn1 zY|}W{<+bFzM=_SgZp)@vy?#lUczbeZ`OIl|u=p$S1-bWx4NZS*IM=v){PTE6WE(Ep<|MCRd~ zZ$gUW<=%(c^A85c86)c5*eAeDkD^H82iLX1=ykKxD)nJqjb=xN=MU>;-zf)bUH+-I z`o|5GvNN9hop3u(H|-jj$=PiORwT<+ze|?qBexd2G8oe0mn=q)rEbVPLhjqAAF6mK z>~?(C8$7MeDmFA{Lvq>`Ye>iQGCwaCAj=*?YP%H2oqgVTWR|__Z8^d;2FgLq+|M#>kazAvUlKfJ|TRTN{5%*(2{O$N7HLFBO42jBNC9o*r47{ zJ?lVwcX$~VC$d5(WOvHe4fFBbemR&Vx=dZUB81)`hV$GvhPov5nB`nk8tM;=Q+fmR z%k8Y=kPRKah}LH;`^HIM(aDK)+lJ9*DgvH zbL+BMTzU84aCMqJ`@d)B0moZMZH2p4=_Uja9?5t3oT^23%13QxLEi;Ky_Sl4HDFlv zjyZxEzbK=evl!qQnlH`!!s+2e%xuYGmMmswwwRfjnI((aVrFTtXWpB5 zvojI1u^X{}eLJeFtGnw~o;;O#@`|IvOsLu`QqZg-bewYq5vOV0(a`RBB26a8*QdL~!^b*@$)%_*7f!QSv);Laz__@hKBc4NglJ2I)b?V5-QO6Q z5J8z8ip>C;G9~~k7o>7eLw$C*IVy!>$xc6b(hcirKQ$=}gFl>H9%a`n5eo^P%Qwm$ zqKc;@MH!9?bCBRJ#{~Sz7i8=7S^s;&>2g3Ph=%Rwhk}yg(ve18hLh=#2e0_`V(FKb zUHDtaJ*?F6`=vsyYs=}IpBLHJxvfSC*>SZLm7tq_wZ`T%{`V%!En1%3%yy-7vKu6| z_1Q#aQkfu?LA8tu_1Vfl+vR&(gYIbuz^kcpVHmH3LZwiB(&mv{ah6!X1B>BdB@+Oz zBrhHs6-Q6hs3$kd_H_|5rSh6u_M4JE2+*fF){8>07DM+=5el4kyYN;46GZDm+dbq@ zG7RKUW$6-yf?GsenRf&>ll(BJV*Y8wq|BeR6>izXEK*X0)%EyZCel#>{T{`N$C_C8 zJZK3z$#hfMok7_27!+1v0XR$GHy^fV**>n5 z4vXT2r(eeN$w)+X6Nk0C{hHNsp?1uK2Z^pn0Sr2=*)0=;Op+#MVNA4vE{-Zthf%ly+i0;M{CLzt<1~~F)(VApzSfUP9++%j+$TyUyT7`^1rF0~E0elfIezFnf z*=yj;b!JoZ(3S$0V&~3J4_prz!2FcUG4Am@ty`&_?_Y_>QnO0A`dDi!k|eDf1dbU; z>P~0=baj7+a-w&48}sm|A^5zRGrgOXDUr!v?qMnEm}sc~6NF5VU3NT^2S*5hp5_)0 zD^k+m5+7YEH6C3DBI-iQ8+?DIZFW|A%quIP%zk#y@^_Z$9 zs>@SIvRyQw;JrXaDtUU)wBeLLrGo!{ui0ITZPD7B`@K@fjj`=0e$_9<6X}MVE$SEa z{&xsiu+uc7tZs|eAL?(riU%!lam(fYYX-T)n9+6jvsk5U@aH=2^DC9 z8D^I{(EJ5~ZXf})y^yUUgjX2Q@TOQ;1Hlv_VQvLdP;)LjFjzs9P*8LFP#E`FiKw*9 z`v{pG@!(hb9X0|k$WHfOy+>@32rSSG+Xsg*L})jW7%Vbxr1df9qnNMF%Ccb?V$ewt z@}&y4A+c#{q;7OLW-n=fm{!RR(ImRf@TXe0a0)ZR1trN-v>xjX3l$V&sz!WM9{ z4)m_+c_PlCDbfS@xHCbiGn8(jO<$KDGg+hT{SXl#*Z00||3V3cxK~HHLImZ4B#BjM zF4WEJ6KO2jdhCewG3h+>xs+9oPAWvRaipp^3i3$XO*rperCFKsh=vi=dgwS11WbJ` zL=o(DhEP>O8G-ko&?Mk2(Wx6{_q=glARo3gRfjciCD5AY-=S|e^FrURSqJDc97S$# zu4^%r1g6akW727f>ApT=PKl|95pNTLrPcBa$~VKqRt}U#s6JKky?AI6E8UU+JseRd zFz7(X_Ffy~aYKR>{5*<^6p^}#Q8XuZ`r(kZ`Gp$dZM?siBg;4MC-Oy`2i#=FW-QJ< z$K9t=n@c+Cr!r;qA5%eZaHA?{c3YfS-DNagP*Qny91%80BFYB*eWBulngo6&I?RVj zh|ymkb+bWEyGA}t`9i&zNC6ko58-!E@l@?(N9e{sbIX4eAeO1V6#~dhxt^jIqzJtXc$x`f6wPg zso8{|vs|JipXzugl!4|qTF`000R!vDJ>)op{QE>~V5&_$yc?6jk+AO`u1kiY!pPz1FMW;R=rfn3*;HQs*@&{sNNXD&9N+|KK&vUrfr zR%(5RqrHK|#QSjp->ScG47MupMq4D?MCO-UpYP3E7oRVu_PUQ3?;ejAoj~xh+2wtd zVqoW)8c_C^_SqB$(mu_bDca@GCIrA0;DKoY4amj;2gh&U$zGc@(o9JErTLTTg)~^EYGs#|D8U# z7~lrsDPdE}E&_GgbeB_^T_ZyV4^b7S^PZ3EdUcDN*?gfB(SYIT?5VRv8rK71+nYOg zLnDE&33$yTFHhI?XM>Mxu^e?lsWPV8NX%n%QV{g>N_oVD&@BQRsCfSY!FRv^h2Sl~ zxp{U>GZEZp6UbmD5Px5p?Hi|wYsdC|X#M?5lu7vn70Y2QN6WbKx|Y4b*LwW|b<#dS zI=!(w(SB_2j(sGHM2ve}fVdLG+28)-y~$T~)49ENgT9aH=$r7FAz?A8ho5ENv!dAq zOh&iBoJ8a7Jb2r3QW!ZvlMm}wtv~sAt<{rSnDf~dWQMKQo{rZc2}nQ^#Z~Cx$E^a9 zx#D)sMkCJV`rD?&?6q1;@J8mGn9QK5I8;LMb2wDgRl81ebCd18y>AIN zq6q}23E;Yp%?Kd9$lbA;qL0->2gPBtRhxp{a9Kjg2Q1w zZR_xZ7Qp4&1hkRxbX>#kKtSN4!&{_Y&+-NY-@8ooI*tAbzs)B-p&)ss{`O=lM8+4pA&3Rrnb;M>3HwYoy&B9G{FVV7sHI2^wS z^PEm{X`PWFrXD+JW4RpSc1}c(Bv!W0?w|2)rWX#;6@VAR$!BpZa29FnG4Fyn_Cau3 z#U_V}Nd00zn(`J}i4cL6lwc4buJQdWfkMJZ0k>LkkLHNb`KC^kc99f_Rx+81#KC2? zx+<&*pfr-zJnQcXpx+?Z8Vzl>mnKn0~MG zt(kZq*Sw5!Bg$Eyc(kCx;A$!y`+J5kO>}uN;e{5%@V4;zgrMM*kai0nZh#1obBSYN z0V$lDbIMpnN$c}i1NiGH>(qHw%96n2v!{z*olEuBWY@IryP!tjvY;aD!$9cPWmowx z%V}Jg;fD5yA<`DRB^M;0gi+o+NwLIOpMd!uR)jS`RQ{WLI**~bDG7% zY?xe6On=#f(ZM2mk=fHaq#$~?|EFy$lFZ9#G}_E%;{!;D+CF5 zJ`A|epdxlF-9vWD#7|A{J+&_Lt>s#q%RZ|YZ*f95786h2+Eg;yczV4APf%qlg@DJA zTcN0U(x4%;l&JMvHi`KYgB}vTaC7#1+=|vEGl@$J&=IK3alY`Aq$gtAXui$;HdZiS zx?Zkq_5A$`G?j7$^^}E&cph$P9&g5OTmoA5$*`<$^P~7i^xG24U2-rHOBF}*{QXbN zBd3;0lj;QkqMA8VmP=~AurQn;?8F1IS=Usd8Pd<`=|npJaWysiUf}z5YcA~d?xe?z zRnuobWf?T5BWVs1aJj8^6SeBf@+;ha1p52Rpzo3~t9k*^bn!j3%KX*l^Hsrcc{ShG zfhjK6n{wBS13g@|&L4_&-lRgsEgh4kB+RDS6y*d`ZLCtkAHsgi!|tVCOc#bA8}u%& zRmO-`7xtx=iWzIx3zD(fO+u`v8`#ZzME7A8 z^bf*%oG{KatTR5;96jzlH6c~!&0prtL=lC`_iA95h039c2*!i>$-FUQ|387 z?6A6@FB6-)kuSbR|L|!T?<-S8p@fD;i;_eY$BdA4)!H19|Eegdcc-`8u$RQ~n8Ax>y_3t4CmEx^@Z;%xvx6l z%EM)B;Y^g%bP$OOt~=V@6c86VZxazRG>o{B*mNiUC*K|hnZ{>7RC#lbjXT!o;9#p@ zy1*!I2_rb3na;%ImE)^&rSD48`;(Di;X0 zoRVa=Cq6u$aN1{hNrH zw0op_#IWMB0xSWuWs#k3TjyjT5qh_#Toqe}6az+uioqb9>D52^}$0)Pzl^fETqUCi~BS~8kLV~(x&r#2r?vbO&r#sHE))!fS7q9d>k{SuV z&o{6vJkSL#ZK(aB8*(4-B-?!;sCqVS+6JWtX4u*0fkMuT4JLNvJWntd1Tb zpF+u6a{Lx?kM)uiVk0PDPIIAUvP^|YMRSVq0m&PSb?Q&nanJZ-S8C~4;I^A9t?5(X zIT6=OrKdc1#)6Cm6N6fezlX`4AZ+r8m2YFk0P5j-h;ZDoue7$t!?@vpkN%>$hv*!K zQW~skNp_z$VCp)4>vp8Dlmd&noL<_bJc>}8rvD0Bt?_9@;GNNhzm;7_5xJ!?g6oig zV%Uk~{yT%mf*OkkCAllR7ZLD9MQlv9XOv>%;7pA2l&_lcSw}@Pr)?j5(8N`P8h-CZ zxK~N?c$Z*;(DtpsqO~RWY3(8$kEvnziCtP^RwMZ5aI_ zl3Ta!<#sn>7eCSGK}dIw!sz;jikt*26_n)oPKwU%H@=60OP$Me%6)@&3q1x}#;3f# z7n|)~PSA4_7k4Orno}?bo*~uz2E%9eC|{TIyF$5vnOx`P0VO&J85THVIgw9@17z#2I_qBA)2!j zsOw^mXqC3{l5(#(n7jFrgs4J10SIqowN`I!dRxA`7qsP)$I7`QEU^u`q?~^ddrY6E z%nlY1l8Ir z(Zee|_2X0!7t4^agYQ84=(6!0RS84==>~L5DxE)VdfKcGTkmf~!amYciuFo_!V`7% z2V@Qb(qtsc%>m84FcsLUD4}nSzF-Y*VPxx)jZywAy8m00ppTLFhmVRjw-{jw&}bi_ z#ivIT$7=jNOyVeV1!lMWb#_Z)7hHgTZvgPHx`V0_NS{zaIECGNOyvUOMu1irDI*wY zxkFpa)BpYV|CLo9^Z4AYZl(FprvAAlc^U=iFR??tBd+|eBcr68!{-OCTP!&nHhw{lPK82 zTPI&y+AqnW`iBd8Ka=)#+HOU1=cP~IIARVF(k~#eVvFp&KIE7OV2LXAgILU;5My^q zRLmhv%ouqv`4z-_1JyPUC5JTaqp2z6`+3+}Q&=6W*^%vvo9Sdb1(6VWx~XK_<^^6* zrk$!%=^zJ>l=JgXnX({^XlVu$N91`nVa#G^SQlY8U?9+m16&;k7mU5tF})T10~b4O|ytQuf#n+ z*IGKXc^_Vt(@v6>Kj49wx zB8ARkDt1s@QY<4nF#(U5GHvqyi2S+N!(}-++E1IA(}Q^(e5|H)oCp&XX3-wZ>#rG0 zZvq?SySU@~jhzAt%O}ek&EmTOh<7j-F#Ql}#GVgCgan+_PQU}q`&0*+33jBb!=f^- z+Bt^Vk ze3K9)$WIa(JQX1!QW#BLOy`q;fpSWMh}7m9K4@| zAZ$pl3?t~Kza@0Q6*79hP+2TSAyS&~5;Bf9w7ZCqA}1R7ph#FOa=hU44Ee8b)PZGr zB8q%>Bre!((0YL{xll8NtY6+iy@OCv!R7%7D$4ajr#$V>L-ZQHZSLhzr3=#nNLD3vpVbB;y?S z!M}v&0aCwV3}NksYDMlCsRNdbq!|}ejZ@WSF%Q|zkXihn1B#3mYl}50Dg<0%*ikZ~ z=myjcV+?g_Qfk3h0B1b7h{HWtySNTME#GvR?bxaynvs?x+x<@a5q8M0e{@i9qFn|c z^*Ub}c@cHN`r`WHZ^aM{byLK`XhT>BAQ2@KlG>1}B4a}zLB9u~^sy@W|59)v4ncMw z&^4l}jb0JzkisRGPe79jA;nZCrAlk?SCz6N)+6U5?<7hX~yeiKn-74rV=q^&EjPT2DL9;BiElXRWQ`B49n?WLhCFM3{Z?rO@ zJkC1lG{uulA#pjyEyaL7hr)o!SNfy)tp!Y}SFl&bzo14vPkg7Lk1tqCEImKT=%-P- zQJ7KSF593ISx3Bod^4&-so+V?99a<&w(xwB`&>(dTm$!-=^7)R1V`cPe8S1#9l>$u z9gHcNsm=lA0qz0zLH(HWmp(?rCl+O_qR52E_Q;r9*2C86z3FxKYD@jk4yvSQYCCGL zB;q8qB+#UoGFdhIMYP4NGTSnR1x71!D}dFi)$1aCdDL{tv|ILcmI3SM{#)punzk^H zmKUr0{y%(w60p;;yRfma)v!}ohuE;v?b1in57LiVhZ`)k;Tj>d544XO^%;}WE+$mX z$m%1w@+zy&OXz0#3pdL7Dvf{DYnm6x*H3-bi>KG&5Ng(KR&f(nkYUhdFsN3#%;Q(e zsmv+tmgv^;9qXAPTr-Ri%IN)-7oOJ*$OaVb7?YI6mCsTaXczDdaT+%{hF|mV>5$ii zWl6S>?#+{~ zSF?f9F5f==fcQZCO8&|O#TWV`v=i}h#l@AfJ;-|z<@9)`W$HR|4~oK*qIO=YWGhQ+ zifRgBssIii^9pl;?wixB<4y~%QyjeseWbw;hr9)~^`t%R)0YXk<)|aq0o#F%6~5K? zmRA}i8KgLgh~dPNgd^-}IQ^d~)f#ac)y?sbMweEXCH&m{Vf<12U%Onp%Dow$0PkS$ zt}h$6%U4G)%dZL$oIst@W7t9naR_xNemG_rRLJiT{k@>Q?EwS~a|Wck3m9O+Zz8V2 zyfAF=dgw3C-{@&sE6C5>ThxB|{BVPyGZGUO8EBV`8JQcAh={_F!Eh5Fl^7ITl#mni z6iX44NztU$s^1rn)Q%)9=EESsLH8tebt-+F+mH#}JKKfbyP#*$O|Cy%b80*&9iOg> zHR#oHq{hb~z}rIp4Ex$wdLUbMXVB_)0I{6V9{L)8G(>Y0b*=Yg`W6R~5>yv7E1EK( z7iKI~C50}v2c{s@xc$A(;KqNyG%+@@fQqGbwsg`msNtz$UYHCJUPGhD!bj1`(9c@H zDAG1&xp<-WHD7QxPL|SH%d9;$`a||!GLkfdEKm!s-l}fXT*5SGOlbn;@NPeS-)shs})5?YnuG>qp32FWZGRVrB4BmF{}0yqjKc+s=L0X^btQt>o&}xcGRKDbAK% z_~wFAu2M~xp+)`W;gE2vu+mN^-INZZ&7cjs&H08|eWlfU3bFp|z0vq?_^txk@A%U# zEpLtIjfsb#^Uk7&qF1+VS7^828z*hInrTK_`l~Zl+j^A;6F2!c&FvazUFrZGM?)mb z7?YR==3jN4($!WHizR;w|M+9aq#t(v@oYZNS{q(p?%uNXod=BqAB5t^N5k##9eGr= zt`xEz1pMBq=$}5#|I^lO?rY#HdM$LVVUC>MsF`I_0HEfwUl!6DlR=9?=0`m^N{zbCH(g6WP>vw%ag`S+s+e*`uF6$ z%IGdg@1qyJSBA}pHt&Pz&nz79h%YY}^j)5x`oH;3yf@!xp-PeT1tvT=-!0ya&-U^u zU=^sd%LFRl7oV2RN;~h)a+eLK>wlWZgtUk-d?r0tEA&H7mrm1&H;Dg{sFawFe2(1k zsJ$D!8jnnw-wW=h`e=Ggnk~=qaeM7FHyRzdvIc6^2uN@K>f(A?dayk*Io_Xlv%D-W z3EwR55_s@`&wDk#8;(0UQ+QHH%83$i^MZN1`9W@LcDVHzbo=^Wf$86Z7k}$%0Be6p ziHHaToJ~y#nf|?~h~7VIg)p)IqtX9ZwT6-XZ>^4hsahka(9a0p`KZDBB@$za-Epp= z^TyHdYXY&OA+91Dgavq0@8_@-`$I1)IlG#))$;evTW4NjOp<-fuVH3jJ2_JQ^l@>B zu0NQB&Dip=c7GG2ry&;_;-t<=To(uV6;s!V>@T5`o_)PQ$-yO;B-_=`tYNqy^WnKa z)dEu^y7;k2Ie=HPX+<#$euhw05!!+>jT=N|qK>kN2;&ng8cC`Sb9SnJ0>;-VJDr#q zr|d*0v4OY}K{c9rUO6M7JIVDTJsN4EMO)zZ{r4B|2FfYem+(`gU##6M^}^OO67oz5 zeww%^_s9Dkwe@Nq^#>hb*VpW#B_oHTMP;Ju)xY-LopwHyEz>KZH^wqlI|}O*&8S-u zCou`$NYbqLRGlgxlFRptVJcgAs-)39$JNR`3|b{EvcG)nUQWanZYp|mR7nSv{*g@z zVGP<8Vq+=r=XlNzsRqYvH{{zxv}ehg$qmSb+Y|rYa@l>*{O$-8+<5cA72U(+p9pS| z->X@T`7rFVdA?WNxyd?GdBic+K)v{{Q-JB8bKvji{XeNW!}O1`F8@(<=HDjBzf_%p z{ZCbA{7B`XCB{e-M;JI z8Z@Rzv=I8i@4`QiBVeklKZpD5IRoSZ+?u! z+1uR-9KCG49UAoeL>mP{B zWR3Aus-j1kFpl-i%aFuY7js9exI9S|{GEEVO;#*ty^jS-!!s&%)Pi}?wmZao6cq=+ zJ=OV!ao}ImRU!v=4alBO63*_I*gD(B0_}g|uUcz$US{Y}A9rubISd(+m zUO8MSk)Od@l^sq|leKg8&>;D4j-kMCk7q zYd9Mhbiil*(tnj=U_IMLg5B;}{UPvaRRoX4{^uFf!-vC~-c+f(5DFfboZqDBa;4Fy zKz+mGp<0_I_s8t5^Wg+Z@8GV}@eBi-HKuIys7hC%YRo4154P-aMfM^Dl__wOns) zAW*Ln3V%Q6Wn?gfZ9rO0R52znd>ReRd@A$2;L!*_t3m?Bc^G2NVZq75-DM2AR)s&u z6)g(Su+eK!dZ$BsGNfwZ?qut1y*a0D-|POqc|5t2(0}TP-{i?cnu_oHANaZL%s1}) z42|l=p98lHcf|GL=Ym>pOo8NbFMWLRAV-L|n{P<`xC)N1GF5-4gh3KK%;oVqMjfY3 z!A_0I=rq_6kTLVV)1P3_Y|%8aSYWeWVzb*!9-gi46pM36C1ASwZo!x!NXPW zBAIdl%Gmue#1nApDRGYV#27Ym6kjg;n~3U1Wed(ce^wz5{$Y{ zE(#5)wKQ#XN-b%8MZ(=ihoA-RLR>T6MI8~F0RP@AB_5ywtv>;m`3+qnT6<@OCGpSF zt=Mrt0N)rq9YCUwuFxEM;P|^m!9AEvz-7e()exsXXkZ`=H0oWpU7otm_tVFT@t5L; zHgiLr#n5Or)IQoy`uBwvWuZ{_bHJ9zDL8aZ`rXonRAP@W-g`t6z|0nBp_q{c&_`-8 z-kC}u03bF&$lxVOpDozhR~i!MoDf)Ug<{o)qdXY&>NzW&^^0<@Pd=|zn^^?c$Ci)Q z%==V};539TrG@BCb-Q|)(n_&ReT=f4Balhv#qv$6t($zpZ#u7M04ezrrNgt5%Zr4| zNjWhN|8ddIH3I<*S0$mKK9iLyI6tZI8@uK?8BHjO-^%~qlP%GoV7HtXf%w*$YF?Ym zz3HR`H!#7;=aj=?56bn8dMqxBBtbuQIsa;PV45h<{k{bJ6}Z=re{Y`psfJ4R`PtsW zm~&k}<}N_%@WU96>h{}qZ7FFEE<6r0TK>1L9$vS5u~NG2?Wxrb$#r z<3XgD+oW9H)v;Z6PlYejNS;?HWU-wN1Pl2kCB?le)o(6hHl%yQy}9 zSuxjk4^pUllRgT_CS>!#wVZe^mnRy~vqpD$;ygkfkd-=Lh}aINREl1b<&^oZfNz;H zdd_9f<(!{TTs~)=Yrg^nB3?CX?DV7HdJ9gJL?FLoYnE7^uCPgST z0r%i&?FpMcABYxJQHwy~Kfr`!9*Jx7n(BjZ&7aj5_4A-a8!T+)wyVi8z8}e(Tf!AApPj(AMt90B4hz^O!L1h2sr?I$yJoPXdPrlnfL4=* z#Ta|p#Fk*U$Q=ho_o|-(7iEIXC61%KQ{mL@HrlDdXY0pv3U<4+EvR=~^h9gYj zElX)&X!O~d+X~H9%8(tymL=UXM}#ttgw4@rf7!2#+^EejCcK@t%M4bU1wBXyhmYgVHWLK76qL z^=tZdy~@5mz5JaFk+VsXJ{`V+f_T%5B%1V(?zW7+9hurl?gOHv&0I&YUQzU*Fc~ zjhmvgTN1PseP@P{%pe4ls3z>UyuVTGSgjx8K@u5RW?0*<&t_yXPTRLBKaVdHxTNi% z%HGbOR{M4B81{Q{5)CFGZCfu{dhO92d<}iC$qQ6*u>-IASStjfd*@$4{1))p2k?3P z=%4pp;kcR4`lT-GU4f|Kdg)I>X;PK5j4wjCgP-VroMN0<&VlD)zji@HaQU?R>J6gP zl4J|s?5VF=o;iJlk*a24cHq$6Y3yHAYj#Uyx+}BQ=>LcR#pAIChR2Zq;*`$@<99hh z@;Rn=lK$x;DMv{z5ufo#ms{~gz*$Ox%4Eq=nz}_`ioiy#(_ZZ+*P$5u4hYhj6a{4{ zi*yS2Mav$l32I%7%8i?g=2z6KMA$I*86Wp@HAEj$5Nbjtx^1~?{PV`m#R#SfS;9hD z2emqVfAXWnMqBlW9>C_Hiy40zw0L`g3A*8C+~;UBq&l+PLENgF$U2z1(MYH4UQ&HB zMEavc3>eKwC-L=~QUoymoWy%`{lPc-!s4#Ur62un5P(k;VS9Gn7}MB#@YC2jN?Vil zaukx6S$4x-To))Oc4-60q1l@%F$;i)L&sz@P%BpIk>BQS9+k#Gd=d?OcJHRvfz{ve zK$l(zi~{fz!<`$ua12k`Tc`S-Jpdp>tokNvruAc2BQ{3F%YV9i<;ePsh2Rf`>W)t! zqmDdIBlJ2vKJMwpju4}WYif`=Cr;^}HQu-eIz~Ro@UA3p0#xKbE_Vl&iRS*i zvs>UQJ?%U}8E1dRPx|wAxbzMcZOESc4(qhJ0-IyOXs|aJP-gIE*j|Ar3(4e|I@~Z5 z#NE9ry&|90j0Dyb=^@bQW0-82GHE58Zu?YK@C6=jNx>Rvj8>_nf!j~PlvzbJZaI4x zeqKBq9nd$yCyP6V&-nx5;F1w(0keu%kYA0n{dCX%;a76Ly8`5PoXO`W7nNA5@BVTy zJ`2h3SV-d!`$^a)5E^#0Zw)LM5HllcdCr0<;(_iMkjJ1k>(HER7mP?W9KaODS_ew7 zl@Z^Xb?!N~S9=hjbj(LLJfr$bbG@xNLf-1{>lVW$s%mW5=M?$sh3ife-hFBM*LEXNoiw z#!E)p_07icAiyRKf&sT!liVN1>EUX-qn{|Jr_uP{sT2u&aJ`Yc`GDJBnW1fv@bIC} zp6$5x99~E4HjGq#t8hP26Jk@37NaDP0Kc0Y4~BY%t94v4ChBB#zF>ooAbom#3vQDWdSZEWISJlr zHYMWY*0& z-A~JbS>%MDUz~@LiE}FHtzk_qDROumI3{GaQ7)uHz5h&6pFqMUM3pdZw}azDbCx^#bifcCKDUf@9^^{Bwep-# z>QoE$x!H?OL-=p9CCLJ^^;p=G_N0W51nm5;y3!x|`TIK(+=E1&00wzLwOr}KtH&B# zZ-?E=JqrYm5?2uWs}{exLnKB&SN#*s5L~pb*KoM!?KHMNPh~#$DSdb!$NsDBy|okp zD!+V2q=e^jBty8-8iA5o*gM`NWuQ+MjZoz89(<2)F*Dn}OhNFvG_W=~++{yBTB34~ z=H9XF@wl4Is9+gwcU+x5j4%4CzTflvS{`bG8UwQ5%YOjw^~f;i$qh-_YW>G+?@~OG ze#4C)kARDPZE`2U77YP3VCCw%T)rN!7F8D1CeZX0DWC}2mvJX`P-_o`(%1u1fuA;+ z38QLzDXZH7vb*S@!p_d_%U4Z#P8g8a0Z^pd#5MLEZ2M<&e|Tv^TMzy~?}jotFnu7V z>71)^Q365|b}>L=Wz4^v0d!GD)&Us>|8=|0K`-wgkVYpRDS}yRjq;p3K^>RH-)Bg- zNfnDHa^!ihMIS9-5(GD8Ks-MNzRFD>y>se7#Yk;8sQ8+v3Xmhppo7Bvc0W2dTSxPE zY@)|c5S%BEqMaIHa?~t?mIPTR7wZnC1M91&KP-eedu8Y1vROKYAT`YCCnw~kNl!p! z;HII^!`U4)% z`_o>$D3;dqf+QhAYWG2O`=`%I(&nkd9Le+h>z12F%jLqHIUeT^WG>s4mg@}rF1e^4 z*duNrkMPO${J6)Tt;lH!OBs#Jb#u^gqSI_A1A3`i+p$x;Ufq7ZRB9kEqXzjo%7O6U zm3B+tag&bo@<6apKXf3V6BktSxcT|ZGiK9h;b_pm`?EhMzK4|_BW;kk9G>N(J}hC^ z%F_&X)==*}$D1F4P7>*mM&Kr>nE?)yp4xXB+_!7nDAxVf*0jWnKdBjs|Lw=*+C84u zw7$1Jjm{3xJpkrQ{8DS)dB)WHIJ#x*l=BjB8aYBt~n8?dS3>z zET=1_+k3BG;u@_v`nv$m*(O3IE+8t-43~YJKrzD;V@`}Y~~Lqfv#1+ z&5f_FMu9rt7Ax-i*y(4-$6@_g=Jd@%uH$V~2D=i_7s}~%m@A|@px*SIGWc*cZ}pt{ zwSNmG)R_K#itkdmMa{R3zVY?W%OOx{P%+zW$MmjT{(Z>v@dCYE!@%=v8eyg`AsG5z&x@Te4-}spj{>3=3qGrA%X9Av0vTwn z8D&g+ZlL;))^;6ai?9MDsh|7vVUNE*k;Uy(s`#*e`))W<7}+n?O@8tfp_zq+fH10h zT%pW?z+3tqm6R=ioL@?_q<6pFjA!$Cj=cGH(|C`am zkCtT5)=0rsfkPp}V{wBS9m>RHdw;w<%B1PW`tQ$Aah7OY`sgO!r|HMo1;$Kp7>FZV|LHJg zu-0%o(=f<#cRI;r-w)NJ@^I$Nkb7X^XWyL>yjdKhq328zMWxfFJi7G>Sgz9B{Xzzv z*F6ErX|q~~PIlGPuQt+s)D^nz=a1Q%A+etQjDzr?N2T^;S#wlt3vzoY{jRjEVc@-& z#7vmi9l4y@x|Q&a--*@Ud^%0$CChCqN5Gc|#;=6ff(3tA;Yl^{W992&=FT5RB-8g0 zxz46ZGL5&}p^Qu9P$32c$Z|@xtA4Ov?)*1sw-Le+!PFc!&*+~*%cbU-axX`wd%zE_##G|Y(F-UZu4eU^U=oAG)Pk`i>A3X+EE?B=M<}STf-&TPbO#+Tid3+P!Mh* zv6G4LwOFNi*2!P&!qvntSUI2CE)1HBeleZQ-fHN2dtds1yX3VT!?~SB$?LTlYs?sE z(Z=R6x{nK{yclDtI}D{XUv@qEw@p(|lX$TnPj}BuhLPbOBH?idAr92^!tS2y8N7^^za&$K8C8l>#VriydU$3=9tBi=Bt18m z4Lw9r%%Zd*7g{yDHCs*c!qDB4Da?{bS_(Lh8)Gt>#R(2c+~ybKS0VDDyQ*404$&H^ z`8+nwrwig{G*;%&Y1EQ|9I>&P#rc;v%`z7)Yd-RZwr-PA<)A>ZeH@p~kbYk3EaH_f zv=|p_wZ;^{(oQ%rvr{^%u<&ZZ7c1x!XlGW@f${?NvL+Ki0_$69i?|2M@sAhm3Lhej zWm5L1e5GMMp$ZQSatZO>h|+nl-yLi(j7T}q8!n9|?EZIN8q&5IcgOAohfJoc7kNv_ zjp7EW2JNnR>d3L;U~BkRtUPY#c|vi;kj7m?N0msoD}U^8SHm}*B)A@rWg@@b!!Clt zr^LX3Zr6q;f&U>k)>mJ3&T0?ej1U~2Up8#AROL3@Hk8N>a-H0ig?G9GkH0p1X>qqk zJ6vUQKaqlRo0o{~m0;Mu{f-33Kh60%{S9VoGTmFEHQYrjRpRVS)1R+|m0Pm6&XmZ| zc}xg)2t0#rLNC&HD_3PE!ab7UN7utks#Jo2IZ}iah=MGbD-?^F*ZbTyK$fEz2{yq4 z3K1Kuc7CqL$WpMmesM6|OraM=&SXLbQpb3thfy4k1v`Z3+}%79(B!D=ykn~2h**DD zk|Tis31eQVIw@LUbM6skfioYg(Z~1&$y>L#%~4&n%g*>Yy6BflH*w(cwEoZ}r!ch;a|rU_UTr|(`8Ed~^k zQ+CAzYmW+5v?HSiW#7aup#@M5=-A4!$8|ULXX(IP;G`fq4wOr2xjc;gj}^$<I}JPYuD?#d8wFdSOKt9+@?A(s6$vY{%$?1SV*{(auIlt15PLpG4_ z^3M&q;@)^N1JWk1hovs|E;@~R{+$;^cr>Aj(b1IO?8S%QR}cKGGpAo!lQu2vel)ht zc;0z1@+X}V^ucrU48;`hH%d2Y0V-e~V)d5P3Cj{#7jZ-N?#t^V8}P$KF}L%%N4J_D zOO3jJp#!GG9DD$?37fd7)FLipggpAZ_ClS#VG60YnA`DM?C)p}&KYmtBu>TdfLMi~vm%mN;4il$Ff{9d(g|!nJ3dBvD*^;9 z|7i3}@#6xOEIKB8lTr?>l^*oOJt9mO%?MP7fDE+W)=AG=>(w~PFH3ERnyFy=`(G;P z9;M-7m>M{i3RIRC-4q~RYvm7E`q2D41T`b^oYTKl&t z_IRqec9hJWfJ_0tcG~Cw^#Rh@0@Ri=8}xp!=;$mq9)6faTCF)of}GLs8P$t<awI>rIy}Crhw+*#a0GT;K1pk8tA!*BC#KzbbH8 zy~vi4sg&Ez({H@~!XQpWz~g_(us17eQ{KzbL6sCZ?0&H_%X*nK_u*-Gylq0i^sEp{ zSaLr4Ak4D`ZqsO$KcG|dX;+#B&Q^D5mFuenPp`K+Ym`)V;{SLml}6&9tuzI#(o!&!4Xb6VF+8dLL14PZdTg+)N`eEiU4@_p>ARZy$exXA9& zvC=RL8v5CD@l4@=XYBJ96vnZs{E^Ia;a;p)0+gQmt^d$PKDjPkLu%Lcj=#-kGf?h_ zRd+D1aTD$i8c%fby1SiWSN^m*Km|;;>*!`C0^oq15Q#{1aUJq8Zk1o=>ReXbtt2!` zdOax-R&g{%^-LG~ts5&WcsR~59xim-(E%531!Pf+$aIs(w*=(-57z85pBR;KSUBH|o6_&aVPEox4Bt zO0uiwgG5_~IHhIwb099NmMb-DUEbJh6ekq2nbF}DG9DU(&KMbjV~7^oFA4RGH$4cj zD?BQ&;nAf5aHXn}6CyAOIG`L}3hLF5qK$35*oRrN;qtq^t_3kX^mzQ*aD#8*=;eaN z6ZZQ87kdis1KBw&=J;VimYs1w*U!ATAJ1*e7r0r4?Dve>hMu{8b!>y<3Z;Onhd1)O z-i_h8a*bDFjWGr}e9gd=(bp@C^{!2E!q~>RyuKYG>OALkj9epic#A~TT((Cpy9yjL>Fkk(nNgKnf?+o1FJDN5SEx|o}y(a)OckRtY zX*`{Qocc=P4eAfzM-a)eRVzflom}Hg&08dcjWz#yhinN4DP0ItJ@_%Lz>LxT4O|K zef0k#?yZC3db+OBK+q7}f)DOaaCf%^clY4I-QCF~cnBfE-QAr4!QBSeA-H^ppFH>d z>bbY-{qI&y6~mcnIen&g?_PWD)mH}JsiVKZG1QZ!kuK5@cA}9z4(U0zKW*2Pt3GBf zy3!CR(dV-RSa{G~HbIgQn2hf>4v2-G{Y`wT-{Q#tMbEd0LXEBvJ|Qks@+ zVv49h4n%`Ick;~?>l5Zq5Zs}M`adXlV%^DN&u<1wZsc#ufbIM}IKyjI2w2m3K9-rH z-*TY#0Q3z0MuMHCG{As+^pEM1=D>}$Z}iy<&3$WsCktu%|1$pU0 zcIx6?Xy^gz}4>T#B|=ZhIrrI z%6kXU`k+RiTEf zAO=r$*!^pxF4pa=ZPE@IM$*2oCqBIP5yJ`Du3V|%H`d=$vAL`=HE4v+zI6z$aAzty ziG?iqKE!zp5Qsc-5@T*A#cJeQtp<7CV-Wafo|4C&pb>kl4N1=(Pqwm>4(9eGj1oDv zp%k1ukIuGCSF?3$M7q8hSWG;QJoE2pX)Zsu|dP>o-J z@Ea(dIZIB7YQ?M3(@sRP5cZuRTn-Z~4@HJxnGZ-#pmN{)P&%>#rMCBeKm#lCotzgR zj@OLgJgzV>%0qpLbEDoMS__(vN4Q2EZrkkHr;8%6C-|w?o1lbtTYl^e?hV949cMDG zSAZ&V{nj4c+$Ta{sCGuUVU6K91JZ>88cpujc$ z+}8GHPnsF={bMH{iSi3EDl(wO;*MopGE)+hU@q&W=sq|z;R-FkUHXOYGfZbPFioP# zX{c*d=Jrd6QCBS4!fZrN{mf`5RT0l!*)fFa*KWdA;VoT8JTi0~=g3Iz;}04GJ?|LR zCfW8Zis2TaLsl~{%yy%GcRy-nb~jS?y{lIwyhMRB&Bp;>okhGX%Ene(alyE_M-h?> zym4Yl%93SH+QyP4f=~{_v{e3l{hj<0dxxs?hTK*AEw{r0@jaiGtVa(^j7G_JT>N{f+m|K&OD!KJa;9dHn|GT?jx1$qi5w{EFV_u=_MRr{bzGVpXqZ}c zKbBKz-0J3y4m6n&rg|rZQDrmzIUs5E^hO6I<=Kq6Y}+hV8NphxG>qJXEuPqb%XBbM zt*t)TjCc@{$UEn24=0fBOx$P!>ke8;?d7_P1g0R5gjXaooV@p>gsn6)Jo2i^fO0b z?e*NFi!i-7^_1H{OQfP^g-l#_9tV^A08UzF)mQ&BgAg7^(lbc(R6>98Oy|?<54V5= zt>GK8b};E|`Sz^oZM=)Bbo(V9QojS!1yzIW8dVCMuv{0r3GNS_W@IkrMZpN{A}8~$ zYK5?o=1D$NdqG1#K@%)KjKuJ{R_aQhD^krIKx_4V@w`)q0wo$T@2=m0lFW}@1-vRe zq^~FOpY+PUO+|V29RSXXD(D4n&LUP4K9qbJUIHQeY^`6hlal>HFu6~Jdu-_0E#vy| zB5L!6>e<3f#)b`b%<{)8b^>>t=<6to9Qa5I zfSPqW(I7*htmx~aTF6V@kIK=iYCt8448w=f989&(W2;eaq96!0UVb0YlxJE0siUB^ zHj=YE7@OQK>Zd?iAF+HzgixC#|JaUm03z=vmIs0>3zz1rUi>M{RCFltu=8NHtleof zPBzCySR;T#N&nzEnrZWX3t1*?-dM-FmPWvRYsd4^@Efr#oy*9Wk+$)UfN<+wD;)LX z{$S@LIrF^$tYcRmCMxEduVw6^fObdOXKA zRuX*_IN<5@v(b`HxoS4LA8==)d+e=PE!32|uT$e<`z>CQ7>-1^;m5w&>~7gQSt67n zMa$~uu~~`l#+KRR`sTvccZ#PB8TnjIf*O@n-Xcdc3}-_>SbH$zgWO`XdaPd2FMKtF z;y18N9gYe?twY`6p5u1N@#`F(&$yi4@Y`03D53s-?Af?2&o2bt(I!P@HR?=$UC6iv za^2ub0^P&plT8}1T{s&H&y_lFVZw;4eLPQPZ8aAjf!a<^j9X;|k(&}ojp_<1c=9U0 zrx3-wl~l$wBK?D)v_EeJa;A{=ee*~eB54aeW<%%aMs~O}>(|z18L?BRU!sd>a5#+dxsJ=8b%sKn8lghju&Wu{U$_>%nUQr>*wUf z^kA-t{wdI@VdbUlec_uY?i3%8?}4vRr-Jm=!)_`6>V?VAM4!P81;`uZt_r}a>56?q%nz9p(e4XgnyAK_wi)3`y$XNUgW$G6m@6RYDS=s}r5n<+h| zAB$~~CINA_2~Qn%??#cqd^+6*Yv37mA;4_b_#%c3c1RIh*PAAIcEc%6>*YD=fE5iP z%u&Ni64r9uO7c+C1_3}k#&b_g_hX*}G?5HJN%66mE97~VRK3=8m!<+L_~%Q9H?Lo<7L7#$JA!{IPmBSt);q2y7l^DIafP@* zHCsK;65_tp`MQn-Tt{DFY4aCTC1Q>kIsf_d7G$3qO z8FxSSeo(5<@!cm#e0W3;2tGgZSaF5hlUu9x1OgMI_aD=X%QP}BYjyx6-H9)Kz!JH~ zVI2EB-@7!tdS@i2)@A z$T{kcH$J3JxWHz)>O%+(nLpRqwl+luH3kpl4C`mi8X>!Th2E8+F=PqKvgN-y>ft#o z-EqHT^H*~aFaoaaQemCDjTX5EqLk#YI~V3 zxVNt|>yGPpzSpC7+>n8A|1imT@Ya6+JJo%j@6Phos^3XSh9jd--+aJ#Apm{QW^BLR z&*1+b1>s%r4?4?35K=tSh7PeS9PT+J?&BUwXBn7iqIgAljPJ zMd9I1AY?I00->1dF|mU-s|Qd;)cy1_Qp}_U4FnX};_@cYWz_vQw zL3Y(!%S($27BW$c;c;|H#@FRiT5@v;GVH^ohwwC@{z~g-w zRiZS2v8O*?R3jZ`ze1)`8^>?@O#SLx`kn3D17pD&hgmgBVK;5i8^(Zjw((-UV>(3k zrdzu8N}}(qHzWe^8)gV*k9+*6o(eiERrspzD*|gf8f=g#@a0-}f~zPTyCvTh9eaWp z#bXJqE%hC&%LhiiAQ>`->1DEGjY@po^u3L5QE29IM96D-66Ni3EFr+c~CW4NM|W3_@Eqj1v1kRQ*W zRLKsA_j>slZOhQd3zcuIG^0Zm869YAV^XKr*~+o0nDF{L?G`KGjU$w$n9MPZQ;JcK z_}w-tRYzj1?&7o7Kq({Brcvf{pbsP1GHGlu6J% zc)Q|*y`+iE-xSe4{sf{c%;9LzOrJm}%!;eupSOOqqLiR1gZPkrcPD7&jQ!uuM0mNd zN&P_D7Bv0MxPZe8Ac*H-U!0HP>N#S_FHN&$lwMhDxAWpq2gQBk24?n-7V$|g+=~{p zeDjLVUysR*K@CSY+8IGf9lK`Hvb4<`U5i3Mj8_>Lx)+D#O%UmM&L0~B!^_<|O=jC{ z<9YSM1!3Avx?IHK`wh~$+li8K$bEvt(H!gDHbC)YBOD&Gw z1?zG@4{vVu8$LqZ{8>zeGdo(r=rU#i4WwqC+XkZ+fEmTdLKx2F#t-z`-t<`_@4#@p zn+V!L2Of8BgPxIvRi|l@@eIvz zQ_N()R{&OKTV$dq`xIbh{`b;_ZxOZqeYFy7VH$%$i|3iWU0Q8FRU$vK{=1)+QP|4z zBmtZDz%~pymBH`(-i$aF<1iZH$ z=c}eOPA1n7pZw3i!EFOH1mxqfmUwkPe;fVI*EAGQYgxZU_N(*{u8FU&gJIxhP=<`# zCso~-tkTYUXFByx24(Wa*eN{alIu+-uOF3Ks;`M>L|r{t)J=#8prN{;S0S%9$dB%0 zShNUFR9N=K#!N_ggn`&H>L=@SpOfwu);Fq7HMu?g6d8Oyab7!N0^R{>ui?tNMRAln zD)5|!B*(hKVw{$C#Qmu#81Dl+_0@b@;%h0*43*cMK@ixdbt0wsgR|oAms`XTKhq17 zm8-fRQYg`PzAGl#lBxbt$iX07c}2LKIY5>fYeD2r5CL77^lXa7Xuc(mI1K^T7pI#z z;zy4KrPwcweohX^6F^SLE7xgm%cmvJNqI%tmCyE+VD}VeG9n&`uGrGkJSy7&=4Gu|;S%?a}-D0-Mbw4k@E%QLL`#!I6iv z)G%xhSI@1B8f~Tnr{{nZEV5b*Pa?*L@!oey1b*NvgqN@4@j@TfbZ!eSefb>t`M4y+ z=u$s7U-kTHc^Q!RsvY3M1XF)F>ynGzMgC>{G|<%7U%vF?l{1;^p!a2A8>vt1dzl7+$S2~4V>`B}xze;2$qrU->2C?ul_I0ztjn#AK z5qS2x&asihCBg4gBD0v8bjO7I|oi zm3fUzx=okSj|A@D`~1rGZIE^Vu>~EOY|3VFmQd~r77UxYA~Aukr!qpNn`DM0_hE$# z*aIeTfNJ#h#)f$mO9%1Pn4N4Q$ik&4Xmxu598Yt~|5p7X?!SmOkhZf$v9 zy>MRiM~2!r#H&{7hCdh$emLYC^Y7XY#w{Pz>~WrUjbflc7nENqA1l*b2>(Ww`Zb_L zrhs6>WJp2c1i%fLq?L4AwgRva0)36G%(><|dNNtWS><@;%*ae}eqNe*J>ecn4?%kg zVl3#^rWzSXDz^eI@|fe`Rzi559lGk|za0)D(C1dGOVdSc&WRanhW}yKtm5#Cl`;oC;FbI&gm@L*>U^#PiSCxA~ za-xk@f~u)Vk@e@s)}#5w$8Cn~n5cXtfnDjMkA4$sUc4j2A|jpU^U11jQ7|%*+rLKA z{vqPtc2jWH=rUO$lBIJVX+MMLafPHXmclMbdP=1>@1c~pa*B=M7p-JD@&5cJqZazq zC#c$n57quN@R<_H-cm~*nQXtsn-uU2D7aW`6VRk^msvR=(=URP8<138A^znbVMQE| zh!b`(U;I*L$%=0HZaY?0-y0{GBP@Ela!1x!FCW@1sEI1z!Q>VEt%AaMP_(=wm`mD1 zM|Ewl+jl@zTzI59;XBAgw70)Gf|{0B7vr<`yAq3r6Jy@p8UR~y z;ie`=h2VBuoMX3ikr-Vj*;*e$ zC~Xo$_?Vl&D6xDp-~OkUj33E+`4Gbax=QCnaPE476N6ijLXdFUXT+<9afZ!f0d7G( zHIJ6?hmO3=m_P|@^rK!XhmLZMx3G{P?4D3dDEFWkN(>hVgueIq^_>oxWoNYLx_y1C zQH$EqFFH-$xWdsxS9&5A8nhx(2`Ll|!5|itR~Ka_D?%l@WAWOpmmgSu=voSvCVyV< z6?9EBBUVy(1d)?LqE1TKYHw3VBfMsCjA}r&{iEYs@d@I7yQ0OHHHHIm)wT9o^_+pP8;RyA%{{vLZDCIY^+{BD z`6ab&HwEW4a~%Wb%%^X^)BI_|Z!U%f@9ehh%6#JxIfb8IB%DsQM~psV*5g6y;l{?6 z0AN9{Vy3wytz%+U?t#WG!wQuXnabeVL2yeV>}CSU5l|gr(V3QS3IGZ)DP{Y*S|8vv zRQm>&c*%VV+`IV}^ZSiuBjBz4`z^Md|L=m~H%w$8JHtu9^-*b(jWbDqrcC_TCAOUH zm*%4iO+ck`_&?c4T#&aAA%2yP*HRfgRf-!DiEiO#a@PSJdx&idEp71XT3N-j_zwNs zGRig9%V;?az?L5GGn0IC@Po!GmrNSXsBbaRT&@ygT*qf+*^ zECG8ci=E-@J191IN{he6CNOQHQTZl|8}W6EcO-=p{b^%Qe~xbi+Y+7-Ps}S0s!8I( z?>zGIk?sMjIEgp(8-BMDX)lRTh4&xAS*M={(1Lo0Pk)rVSu(*sjzI9J0Jj)8s+>dnd(m#c~ums@NAeOLEI zL*z8i>z}6?4Wt#m&CKAKRmS42ksMyM{c%4TzO5=JW^>CK9P&9u}2J<>snQyrNPAC

MXAz4v2#n#enw%TRooR^$(mY9%uG6(F|g;l(01# zScZB^3y)9|*TS5s>pKEmVzI}Z2?p~??gfz678Zm&m#JXiVN#al!N&AnJ@mMegt(oBnl-u0BCI?>mOdf|A!=ap^1zZ^7 zv=*FQFWUi+jLYt!Y!3n%Ck~Til4mEWDk1LSC=|8~cZnSv{=tK(YDgR`**T3S7d;Xc zjqet$O_YnLiK)MAn3DSq4Q!V#l}^&@vW&YNhX3jvv9H~35+d(~7)<;Va}O_qdIyL^ z%G1C?42X$?kwWc>qy;iGM^Pvq#5M!>54~8CYTr+wU`mXaY^iBRmuERi^FcLXs(n#k zn9VV?Oox4$CY{kEkrEYv8`Z1TaBhsbGBGqo)*(qr)j*gvXEX7Rj#Bwu1pAtkjtw*J zN;wlVdb4K9LOR}x>V2`%G0VxelM|Ts1O7*RipdrltT@wXFZS}l59D#8vtTfmT#s*F zhR(=)f|nz9=>}m7VxU*P($#)1^WGxTPWY0_#4XY;q~C@#zq4ggqp^X?7RZ)_ub)EcLZU3l(;A^CgA{~j#gPa>oRd`w zKeUxHk(fhe`H3MmZ_?kSBQz7?p1svrB<5CS5qa*P?hbcZq=F~A%AwS#2aPbC@CfI{ z2>h2VfkBUw4OyzP9Tbg|G7aL8U!KA`u9!~R6$4^KyRpjP**u}FwDlsSWHbeGi9vv? zjVx?WrSS=$^G(O(x^bTmPD$@?8}!}{Oh{$WdS9;-9A}SUdSjP*uikYCT%^s*gt9DU z4S?k915Mv$_!3zs@oqko zf?#rv9H;TH$d3N_;SQ4FIJl#pXhE{sF-kHiei&zkgAHlLyz&#u}7`|Gc(@^PYxV?<`pk4s`3R ztyUf3#I7~`q45S6NILkW?K_<$_dBgWr>K)ltlZYw9I9vSZXcORxSp!Gh^Nt+oL9;- z@sXF>?4042mV=5v4-H-FrvO%d23M_Jz2TOq3Spj?js9wsRVven-BkapV*~8gw7w)| zB1pbX1_IJ>ocm|y!dV>Wb2tT%pgA4EFH$iMr*4+>QC?eT%-11$yAP&vr+Qz4CZYb{ z@f5N7A`tT1c!yqYh2F#~9Cfu2>5UM8H!MQ^V`Tbn=nq z%B;ROa<3GoAUj%3A^OQFz)r?Q%nAuvg?ONm(HTcy0BIiyJGQfSaHrbY$=8kMsgvCx za}}{8!vn6Nscj>{*_pO#d)9z}YI2 z-kRJ1*%kcXjE^1HzZoC7;y29-sl39NXqq!riF(h`u=>7X-HZmnZHyZJ#k-Xb2OR8O zdR8?+bT;b!^NWGe zX$+JS0CeU5Ha3K05D$^p@RoP-mb%RqH!{b`Kb*K;0o%W?IGhh()R~LEQA$2dm{VAY zOvXM7%$6X5Y>qqW>a&E^F&{&WBzd}lMF#!td|4|4mf;vvszlo20p9~D{9R{s8~1oa zuDK}w>vk%62@QK4sFnb5eELd*&e@k&q}7OI@p8w9RW$IpHi9oBGQ#}#xL{dhFVJSwKU2g0X|o1*Pl%Jb-37mfK9xs zrWVTmVL`I+G%x}m|9rk01mml<(e#T5QAWzmqYm{IjL7(q{lW$TDZEdF*9Ajoh&7e+ z&8ch5iDW-*@K#=45*O}{4>)%~vaH3~Q`U0zF$6@HTI~_*>l{p>HTtz9`gFG4C_2F{ zGx+P(54WX$Z2jSsWI&WB>`5HA4ILVbMp>Xuq^ty^aNCQsmUeZ!w`1|O|7CmhS_Qkl zFEKA1Vhl0?mrU7LW4ivw-vfflFSQ|AR3o|){#T@}UOl5|lp79nbIzL*F6rIu`q|OQ z5_0s7Bs4PIP^J21YRwn19oXlNKw^Z{OfCw;K`RRMm8eAb3uHreXRkPPl~L;mFIeKp zMqig?OICVKOe*xCuCEiug1k{7&30pWL-PXC!mAlc#g@rMEJ|Dj+x0Vyp>R_Gov8%S zK5}L|+xPkuPpn5v1vz_&VN?@*I|w6ir}-O6w+RTSx)HQ@(y6m>P_rO8?aF8B6Ay%R zB%V2oBg6!0`@qe)(7~t-WcqL|T~;{-t^jFM09ummLq8UYK?}<~`i)XuT6S#0IJ<2V zi&&%vNCJtI4&&U<3PGD8ya{?@9|-%zmQav~Vb6qdeUT3$)h{>-^AfyE8ti>vkY$|4 z^)&@*F30h0s})>GEh{G`$R|n}H+*5u>(ft11(DE1Mc|sZVV00^cbNt>mW(tmE2&HY zBrhuw+@JX?R>H&NiE2DZ)d`5+cL4;tlO-A(C{Q{-D!&QeV_3!Rw&R4^hZg z=gCSwQPYe>#3W#IXe+XDnDw@BCEynmW*LuFnr0(W?zdf`UH7golR%u& zO5Qa88pdzMhw5_awCIcJpm;t}_D6W-Y*CsC(~SMbC4jCJ5peujzKK`Hgq%1E3ARDK zti}@~9npz&&L?(nkj|VFKRQ)_jm`U_Z-VEf<1z%8=rKq5G)DjhSy(hSr%wW(ou~Om zQl_f4jDkX^q)1!A{g<1#izc|{tIYC8J(LQ<91yb&#iI$cl|3(fcp!sa zWISi8toswml^cr;U8pX;OO1=-ya3!HBE#ezRWuD1F(I1ex~MzfXQawaWDksvPe!X> z@oZKAH}@q*{IzH>^2lF+K zsElYC%;3i1n_H~ok|;LYHZ5df2n+-}H4t~46!}!=W#x+Mp|y`+QDjg*EzO{V$3M3VnYgM%YO&5KW0&FUd}^c07Af6+<-|s=n`Z%k`Z@ zH2^FL>TX_YvYuC0E}2 zrit?Z5p1{mRE{fXvsEluYBbLZw11h9RLjU~rR%l3EV`g;*&gTg%@CrG;zy^^a}?JRJ!zSl1M3+$Du>r* zJ)d`uJhZ4hgBVSL9B^JhpzLPe6~dQzht={*OABtK{b9_9<4=}C4r6(v*x1JDr^sr_ zl?_%kXo*^vPE#p$D=p$xZ$`T~rv#u+CeyPM)w6i_27NfO7}F z(&5D{0kn(Jpbgb{5a&V0A%K9AHGBvY(C=CWh=huo*RE32!p0tr)BeyF@yS=3lg+^d9#LIyxIZK*062EUKZ_ z-!_c@DoYjVH8=BP`G@VOcnRS&DbVzWdB7`E0rx#LYUyT*g1UoWQ8K-T{ZhaLAYJc{kbi9MSwoSt`TU$VqMCOP=r$0Op;{o=T*u-%sBme+o}b&; zBj}lG09hkdM&mm{iKQqy)Io>!JJs^~GhjeyY42YxB({Fb{&|K=S`asH2nT1{7hvKtbvS;{b^o zaT5@1G6Z;OGOUdGBk0I;H~*C=_~_PY(Ho6BoY1Dtst7wFyH-@CF&T10v`|_mU~R^w z6rGF^zQbeCXxc5t`e0RknQqfkHIb;aGNP|ScDs%Au+T6{45qcB0{CE`Nk=}})NBk2 zAEZp}=Ia|@1FDO&S0j`y3#)S<-+q2;xRlrv%`s*>-xT8ZYR;;K`eq{V;MnK(8jJQ@ z9xFL}z}7&!(W6_x!FZ`q`}~l+!HiP29$N{J&a!uLn_jF}e!Ih2EYRNgCyDf6^>fqk ztn8b|oTg!z?xh^G-RX>XA0NISpKk{A3hr0lR46&|0y;UzfFu!16*sF2AO^we=4mBqe+0Yn4&%!Di2A$|>vlW0BwRNXQ8;7RE(hZu~^VDRlm~ z`R;e&6Ni^8Y+@$j$d|G?^G@)Q8ejGY5FMv)9daoYDUogiaKMxxqn^M<%O})tpM|%e zT6xfgNmN(|Ykqrd?4wdv*lP9HtPYLQ^Du{bJ72>}Wj#l4@It+@Jrgs1XC zCB%wpju!1>f*!1mKs|EQ&9Gi6Kn}>GtO=MHdf6et{q)X{hYeF3{(7;FF|a8S?8s@$ zX`5J|vU3RkmCkDf*d>%JLRit+$Zl+2EQ%s2a>(=$H*galu3GCaTE0C%gF8`1In8No z5EXf+3AS=3f9f@wjjtLn#my#f_^Kf`Ogp-Q5=VnmqB?u{R#uXZsLEvb<2BeJWHj$BF(oKdXpe+shM3oL>*AJiAC0MF{c<^i93|qWJL1XjUGwytH$P-vzt;9* zSDE){Us^t^W%gTHMZi8JKqCI2al#j;Y5ld51pL@7tVsVIT~V75WXr${kFI>^r??}<6|k9son zCZtEGR?M&1Jiq~d=PYl|2Xyo8*3|Uq2uEbzr8m8XB9Y?;5cCKx!=(JM{$mG?4@7+# z?Fn}u;83N`Jsw^fF@RpULv9)5>2N-#(zZ+~j0TnHN90B^@+D&neCtfHd!vy7TWehq z_&AY$5azY-uJ{A#PSV?dzr}A0olviWRdaeNztfk?!eqO<dxIhzKvt9;u{C2>hJ?*oTt4biPbNq-@;BqMJ%7d<0zLE6uBDf z_8Hbg>PseuR%wy2DgJx=!4eEc25!qG_hRH7T{P`HvAOW*FD>reaKpIw_ z8e+m?r!!&%u0fxDSYS22Q6XD8uiAyh`R+3*Ni!Pkn%s@11rBJLy(L<}%WM@zuc?XH zW_t%kQS$fce@i?Z$tNxBxrq_JubswAuP!V@m#H2t(w|q8;>!w!m*E*3%Pzzl_{xOx z+3t;vvc3F_-q>#mv&fL;&2%8|mn<&~6tMRtWX$qXtxf2yF`w(zw#?0d$>vzA46Qm2 z{N*8#v5Os__>sdod)MzUEf0#H|@!aOi4u}DJC;qB3lnLt!ni>)3X?K&AZOLroT zukE-IynM+(VkgpYW-|aYo_UI%Q4!)g=3|INd>+7N=0Uh$%b-ph6tNH|e0+`dbCZnB zN_mG3i`U;=tiKQJdJ$4|txc^R?bzs4)srM(y;Fw$2C{gG!k~>D>N8{Ja%)d7R}>lO{##|5gYADvD@)rvpMC?#9NPm2 z;7D4SIhq5<;QVv;4G$;#|1Bb}x%lBX8;0MwmSTO4d{LjBKppm!IOZorPvHDAbS89b z4Y(gDHDOOXu}90J7R94qZ3{g821hdatoj-Y(A^ZET36BOS5)06{!!HQHBkT#BS+ox zeLLE)?!7#DLD>(3i+1B^wR4;Aw8|YjTtO5#Ghxc&UXN z82z%cU7g6_maJLy!&`RrThK*0FhPy~xx*V#f7wsv3KLh}{TBH7c z0lqDK*HVQ-Mii$3mSQbfB|Kucn)h@=tifLLeFU5kiu8DJWy7Oji9X2-2S%9bAJSZ? z-Fpg-(Xi@Y?Qw(=O3&y@B`1Spl~SGkYmAhZziD}we4iY2cGh?LK>h{Z-wI>!k#M(> zz{#!!yKUxeWqF(1yhNVp0=X1Ble5(~Ra_U5y790!a)NW?I0mHnH<2-oKD&cY+>%$fMh859-p9JzRK& z=L}<)X*qSoX<~V#B+I-f>tkwHTzry=DB^EJbbFt&7rDpzzyLF*%X=ewtGF*Gv-Gl& z%spfJ(f4~ZCBL+@TRDpb^Q->GY%Pi+!_E$Cpds~O$-yB_pW30xLpo4i1 z)I}|!5Q9|foK<=(CDjN6rMIM7mw65j=CO{w>Nf~mLh;PZ6K!O}>0L5IA$8Y!g)>|B zl(sP^8Mr!>JX41>im10CDRZss)migAx3VI$c5^TyMd8MK$NYyQt46EL23dc&!)mj?SKutdV%QE9}O?bDAP{@(Bi)8B$f_1|-Zo$r6lk^hYnI|ut;8s@D3QDXmVmi=#( z*#9c|uhRMduS)D(AP$bd??TSuEr^5julIl?`~RcL{@3UK_Vs_I%FfNh_a9Yuj<-C( z*#;i~d*kHzY;HhqF76hufFZMYbb04wVrBt)*1reFOx(uJRn@{p!qLIW@q@(&HxTcC zY!U|--*b)sZ)OYV=6}vRILh)!)tCm-07SAyR{oUyDWNS-h>~McGvlJ^>%oev?1}zC zM?n`nCncH~4{F8#If;q!jWIaTEs;S<%)9*MJ7ci0A{n$LN1%Oh>};&nW1oa&iS?kQ z`EuT>9y-5sc=GsgDclVi6?lab@S7Z#0`%9*X&!ryX<{~022N7+`SmpaYJLJCI~A{!m2*B0axEQ!x^EW#nWIxc~W7^lQ1*-`@j@h6YNC$n)#g)BjUBmY>ke zf11IdhNHSwo1AD;!o+}iekJZ65d8fPBZ!V1G?9=TKjRSncPoLCM&tjyLjqFWqWn|c zYCgRCr-M|t-UxqpRT3l*^ez8ezI(<$t$-$GIsd*b5UiSb?iZ=2ezE{2rhBW@is^qV z7nQ{PfiUrOCi7G99SO<5qmYCgs&^5ico*ZFfTjOW7cpRvLRBs-)(&8>|LQVEP$UJ0 z@B}MeVi4=U!-pXT*F}4a`Lr_cbE>h@Q%&-FhwqyD|A_l>(x zKOCoqL_w^qBDA!uBJH^xDxi6K$+EN|w)ck5?ME`eYB1j3ik35>qnj=l_&oI~EgsJM zN)AqD18rQb00NZTJ3mF zF*5ygn=r`lf9^iL`$~pU#euN;iA*N!d$?@r(D=J_=Y@yO^uBwK(**(B zMatlmUd_I&XV*8IbmO(P1U`edd!kQtF9c4eRU>0D)s(u&>i5=i)wm>tkgubX6O6avj{=6U}0kb;Jz zMAM@E_tGCfLGc9t*k`RSxgC%_ozEh~tq20g5aUC>)EwYpl&Jk`c+KkShQtS|c&TQf0!ca*3 zu5g^9FU^Yqav`9kyX3M+(*87+HL6#qq%!WLq}yWdRgG8b*!1Vp=Om!PqWChS-rn_- z{#uMzOyZtgjl zZke0f&r`pm8f~|MhdBg`YUCHApGO49nyDmSKL!YXn9dUN89V>Dx3Xwk^KQW&=FTEr zy@T|=i;Pw&dq0kLsaA%Jap+FqH@RR6&o~vx`g5=XclG*pYfX2HvR>;_ii1BH8Su?VQ?`aYt z&6nEjfTSrS!@I>wY?`B$>IAs&c`#BUZl<)isZK!F!*9>qMiv8~^o2l<=tmS*?jDp% z-`=8#9M2)$0ebtNVecR>>`eu|FRr_!6s)D?AVS{g;`zXE?6VYn|6WaiUMNHa9mD&4 zseDmg?dp&gFgU5f^6*t^nBHXMT7}tiZ7nIYYJQwr^j?t)1D?<6gbV{M=p{?8m>)T4~hotoGXxC*RrCHXzVNO?NZQ(q?($A)1d)D!5VhMIm72zC7v-+t2j7 za)yL={MhnsTozj|H;fCv|Av)j*OrPO+3_g&ER0e0{~FJnZO4>>h6XshC};#HYRBvP z;)mM+b1jKT|DRD=y8=PqM}DD##Jr?(m}ZxpI7iF0+A-JRQShJIjr7et&fJcgfJs9! zdE%sS+OLvXrEtJwFI~m{t;`8%OzeJKQ7-;y zfaJJZxoAN}eRnxO+t1>suz7z|SAJ3)CNfX8#=-EfNskw;jq*=ec~C-K&i;7Ws54S` zQYY|#xO>Z>xVETU6b%+UL4pPi?iMt`f+xWVuE8}p-4Gx+1b0Z#;O_3hEx0riEI2gQ zO~c)slk-)*_vgK;`{P#Ks{YeeySvv~d-qynjxpw(F$li8ech$k4-0}C4%&V6wkS-3 z;w>azX8n!d( zQ2$3a5aE7If2ymy;9In#7drfzsmhB>sNvf2cQhqmR;#by*ZBDTe3g`r!VtOf6a=G5 zE8>>X@VM%9sZ1ZS)?+Bs-`^k4#3(T87pP{usGQB$asQ35d>$y5=}#tv;dF}q_ssUE z3E&QEAIyhah-Z4+gGFOK`&Q<>fXu~uCLZbQ3rEmSb>qdUe-6z{XQ@f9I%MgPsM^IF zX=I`MQ?7DGP>z~dHrYwxBX;C+EaEMojLtr(w$b{ch zJMpW&g++%`LVJ_~-Whym)=$AmAsyB|M#t8Z#Z;;;>YD9q=YsRW(hPV^u$&XWYpWg{RsJ4yT{FbYYF_sw*-9g- zNO#K6nJO{TS{h@k{&!x68$C-^i6 zOO{`-lk05~kMB23cEG_(Z{_|y9)Hjgh~$jZOgXnZ<5U*KNG8%$iVh_T8)I!nl>&R; zpTv?`(_^#NrOoJ=xTPMgf^Z0C;x6-0XFo&j~dxGl!pI@(_Uf$IIRZqY3^UR z_3n*S4oz@o`3I7JJ`t*lLWI~o@K~w)7h^sl0x+gY;eOJ;7&9jxfR!)d1|A&$JTwHs z4@h!;ui4_?Def`=;BgEzXAtoZx{`Sg;Ke8I%?`T%PU3&_r=`%sK>*wWj&Mn@Gq+Ic z!JmzlPU}-gZ5XO4P~A{-WG;>mccY}|ByX5%(igY&e`{V1s%*Q4DHQ$aGPDYa<#q|5r_NAJY(&H`P8fSJgR6HwcjSy zBAnv(od1XuAJMzr;@%@%I70bj|Dqw?_0#a|F-H}|F_{|iC7R4ORw=ohZtJ_Wyh#3P zJyo+xreMg)svm~+>iLDC-(lHR61%~cHcFu~NU!1eec@`!@>;^U<>qH57vR7;iL!$` z$hSnV7pUM`x3$L4jQT$G58RaLqRF8!;Xxm9#7 zMyK?~i6)>YjA^SBlqq((QRx81dXJoi#X4ikLlyc8_k)(Jezgb0b}7$G)I-rfJ*Qm2 zHawY``&=Yb06t9MwWn45b7Z92#dui1d!L4ORh%P;3Ndgcb_M5ZMsi+0v))8I9L9Pwqhbs*k<3lzdyqa|Sjxf8lQK&pG~?YNI)w z_cq7h4y6`0{|%&gZxs9-{-)@i7sM^dV!}`Af$RajY~eU{ee=*oE@+i?Yc9j z{<>@t_v@RyaQ(=0eSx-qnyES~@RI=kH+-jtllPubW@EQp#BkK=cieJw?a-#HK+RgO z;j3kVL|)lf5QyzUm!dJ~wHblm3FyQ`ts9h+osuH+JEIAQU3{CnP!OCe)jeWT*`6vu zXxQ#j)?lJ>wJplgC_3+g_ftO`hFp^dR$p&}eMZMmZk*QK zs|E~7qQpN5yu9pE#2TT3_EK^NkCCrx3Gik?mMqYBnWRSP{1*M4T{Ja1ol!nG&qqF^ zk4i73>Tx^MjVzB34Fq-tF36xoPH{@`kfh* z9!jZ!BKIWtaP*1{!k+am(^-OzEnPhbHGXKLt)tL%>}#?(NG6FDmRIF0QR_oPAI%HC zHo+JA%!kYZ6p|D2N;TtdR0fjoDMT zP;WRX>3M?b6-%KgO@{@pu?%EO^?z!bLsLrU=v|=s#B`QFZeTeKUXA8SF~kUiezwR% zlc5a0(2^muzHGiyh*`Iu>FZ;hh>X+K$1UHUz+-z(tFtKwDE5@4auTWK}$ws|7+J4tW z4j8(N#YVnoorK)Xa*a+IsXoC6qpIp|(icpqT z%Q8~(DDoLXwxI|+SeA;L@&n-#>Vl%l30p<~sI2FEK@c6KBE_joFfh`~ z0OeG0O|;jJ)Nlx%3zM)>5_52cES`4Y@g241jHj_Pu}V`Kddmc{AJBc9FDCK}Hzh0N z54YI*b$M517C<;-NlJG2qtNy_az@E-7mUw8QyfV+V=ZmZRdTc|!tj}3!ZXfsW<7N8 z*|(cbIo3EBbYvS#*T=C%C44`Kzk%$w7UtC|=XAi0du2<~X*6CA3^l*Nj*# z7a4W3!Pt{0%I42FRkH7-b+$YT(d>#o3y?<0!?x}B+>-;|eVfQM*v__SYV#f~BKEVBo5g%VFjuP?0CnOb+XEHwYmYYed>S{Rz|6g`p9Bdd}s(uSmiVeq|@R!6$^O5GDfqM zO2f|ODwxGte}4LrM_lUE=Mr&c8Y0jGuSK(!RHe|G5}{qF{g_*jZm;+Jc7rKr^uRNS zEav4p5dD^71Spd{>)h`Vl{GM&+?h1>ieTMkhlPd&4WwV8FiR36rL2vcIOEQRx1p44 zKHMo8iU3wpzb{O9{qB*3f~+lNT8}##r3m-^gLp1^wtoKXj5s0y9?64l&U#*55-W`c z3;iKyIXa?+0%>g<269tHj_p;e+g@r0A`UZtx$h}_Z$&>WkW*x$4|#@mzZbqU;YUwj zY#|@1ODZPBYzfkMS6TyB2ux7_Tt_U~c}dlxFNZ@r#NSEujdz=bd(wm2Kh}&Xu78TJ zHSlxUn)}eU_*u2ca)plS%@ZnS5&IhZ9b~rGFGfqo4Lpvw((hAtYs8U^_&*#ITG4fdqk09zgw{Om+NwsvOJb6xd!y)bDnbom`I;5@DEE$Whr1lD z70oSQ)S`NzHfZ%Z*P%&RFQ->aWFqOdot8uvu9Y{&uoBkD#>aGvu6Xt8{WdkF&`Z8i z<9j5kfFe9%yg3(A*nO!5dHGyix^&?$U!!977 zQ64mY7=06|Q%P0>N^juuR(Ga47eHg%P6;Ay<5_(qJb5Lj1r{c1ek}To3l~S{HXo&u zcK2s94Yoe^!I1Hu$z_Ju{N{DqL5V_#`Ih*n9HZ4pML@+M$V4lC1zmU>HJ5f=NT;Hv zbm__cq0xNECZek)IwUF4bctWb{vt__PznFKM@fa`2rYKP!qag+b-Xvy0uOZKBg}Z5 zChJw-!hLLE|G9&_Z#z8Bnw6mE;4^~z+JyD1wk{CS=6sbB2$j${%^$ANSubS!rq7O6N~bJ92Xus<>hYK54@sk;zljt<)>w;h#h$0of^)6dePezG!W$Z z_Ml;vL1Cs*>)~r}t#w(ACCs8`Ac#a9m0FsOi%-$lPXe9KP&bcvJ@vx>Q;bN1k)8zs z8p@9;_~w}XeBjAF*{J+XxWuD7b-&GLcq$*c8B8{+p@;G==Qww|I@cXA=D$;)QKMzd zbvhng4pW-m$5oU{&)R+3V60vs)1ioIyg7G3rCs8vpS>{1Ong?-;i{SYcRpwg1nC+R z9`4xK7s?RfU&V?V$M4zmirEnv%dcBujc;M23WH;CE2-`9|M;5-Sz7vic{iF&o0pgR z?y3pp$J&XzoAcmCAG?)+(?Vj4O`}p~y^DXvx*$6LwwP?1y4N+FvZ8Hg_T{XTRu%1z zRA6iG7t75||J}Akq?f^Z-*pp7CzPs!iir?b@IJ`&%}9HE6KNfvX4BuX0$-;3UCZ|! zh(*zTYe`=-XZ-5=e&*~6oI$#3R^Tr~*7yT$g5_6u?iq?VOVV4-97k}#PR`};E!~@F z8uz2swyU#Np_RmkZ`6N`a@&W*zyChrV5p&~SO#+U=XH~}<3hNAAI4+*#a3~70RM<^ zXkWfiXgyt0f%tWZD>`WXD_?eD@>97wY_4V)Yd6V!Hr7ULs8q6YeM>gQB9(;_6UTpr z1A^Q&m5j?^g-6cqlgXV>7tChAe*zM2D|;qI1PzBO`Y%7aCK;5tM05==SxGiFc+Rem zs;UD}UV66Fz$m!R=*gr|-#{~@&ejn$DT$K7i?Q}zx0&57O}D0lObBGU%Wu)z43O6C zs1kI}h9FQyJL+s1M5jM8QO#0Q3CgDSp7CLpkI=lwmGOSSRZkV(_AjyL?(S@Dsa^k` z?pXGNjDtV|9e{W=GCErE8o}}6#d4*|^iAGxV+%`j^Si6Wjw4B9r%JS^p%tLXfvA{9 z`qLk64S~V}D_kwv9sSeeh?}Dh=Uc@00q@H{4IU5>Tcra+`+@Cl4b~Q3ZZ}Id()SZz zsHv{@J;A^&a(cHl`Vkn}@UY4rK;Cg`qcDEzKncgs00f1AwysjMZF+vdBzVA4<>N%W!)VP!Tojx?ro${U1&K*irpDwtcQO)2Wl(A=Q<>R{ch9xWgFJkG2^&bV~=lf#dm)A zjv-D-3Y(6%+1Gk?`>~z2d+ICjvZc)rjptc#`N(Isd(%@>VI7CjJ|OTC zRYlu^@bmT3z6KjOau|m%Cr|8Rhu*b7A&vXtLcR|dY`;t1_QaUqs{&9x!x`Ch>)8G1 zbAdP;nUEW$0M4|0>!N4K`;-6yNKEuR*&x9lwr@c|kVLp})CT+hD+qkI5BUY&x+oWi z>3K8ITJ)O}hrwd7ixCo$5F-mFBcxfKe@;?n7?z_7gps z@EHUrnMVU-ei{4Sl>5-MZWP-Rk2Am9W+pBqP`e2X@f%@S-;#4ASZFpFFf#C%u3XO* z2BZUPkVNtEy%Dxt&aMzw$S!b~S-H55ufyV(X{RfJ^r$SItfdrv?d+Bv9hwtwbbt<3sl4B>4JWU1ZYjnfZFDiDKnG5gk)I3Z-T3H&N#J`iFQD33!(5;C+rNmiL z%`Q2g;%Hb|Prd`hg}g2a#w;rDpiCbc59GpwZ5Lf-Xp7siJ&&uz{S;&4`6@<=na=Gz zRy-hn$SrTr-9(hJjwaLVgVN@1nXwT6^RL4J#Ds!;c|m0u;C7 zM;=GB@dt%!*(QUJrm2quEU@ZhV-`^Mk~u#F3}kg`Vfgo3-H zI)^?YN3A0G+B`a`anHjdQu&~_nL1%|3;qG#c9?j71}#Y$N#|tlfH30YiBmD~AU@nKd%UY&}-@F=z9R<4NsFe^ilsXTJV)dM`Xfci=G z1N3}+#H6^3Lo9e+DU=evy__>XO@zY;5fPC#?uPZG9m$S;f_+Q-{2Nc{LIs~wCl%5?`>j5->XlzDe93-8Z~~z zs_uSy7e-v@{X`)$Ok(LK)GA#Zh6^dbvoyd2DlWxjRN?vy1Um}Z zQ%RceE}<8Wr;O6Xhebuv@PX)L%kODgHkdp+yJUPgrD#p3H$ z+2B~*bLlV9#_ABZiZ&Io{Mfs&v~f<|W=bycVdT{)-y>1Kozs@4M%cn@ ze{jFx^}5NoADSg|+_7e10e_a|+JP9h(k4tIGY1U(^WLe_rfg6oo&5ok%Yt_+Vto3IBb6^UquU!9P6j$h;uq2xsGQEK3^`4jOH6l|93~j{1 zY)*W8zVPz&6l<2Da&w(Ii^^XZR~c%b|1EDfehYpmc|w?-7-)u^*x-_)t%I|mJyBpF zKeWF2inFSEEdxKJy1>x~2P^qu>*0RbdI(0*1P=z~iU_Za36!rCNZ12}+9Pv}-t({# z6O$$z4|gT_N$47QM5C1m9;)2iI6| zQRUf=0aK)|&OTRyY4u-7R0;4ZcgqB=( z%*tM|&Oc8jAfLQTw5PHk2B8Fz~6i z8{L*FlKzRHfJ+PCvhkP16?=qPRbe#V>$Nj>fte;lCqxg?@DuqUu^cS{kj4Sc`XolV8aHQgU#FUA0-??q5 z-SsSo9(o8U|0}dEV)imU{Y8=B55WB7A2!<63!02Dk*46${w!O5{_l{CgoD-%Nmo+) znE0cAPDB}6Q!I0H#5@q1yqs}65P>i|2S}K896YQ9avjJ+YjoAQ4%UB>n(52?>Jro| zacz_Gfa+zaknMb*&;)xII8xetT8Qwequ_>9_EcCCF&B+<7QX70cs6Tsp`X^UK4I2KTl0}gUE{F?Au7%2$Z?A7?_6Q?z^2a)_ zMPFvsO9p=X2m1i<=Z7WAM*_tl>hFrjF`^A7YS6`N6M(oK9p&i#ZRN-SkvZYWL#$-k z9DUUMFJS99CO9{*m@l6m<63opPSq7N^vUkj2o*b7{E{;Ww4GbL|t~ zKHkb&gLk#|iXWbx1P0?CgF(+e8TNqT>fvG|{@Al3b<4i~{(HxtUX8TtYxIsdcFlXX_d5sL*209d4)P`V7!srAV9pB#7CA-25uT%c&9}XEun1V z5QVF*yY5AV1etW&wPe$q|JOx~d9;!T%Qe1Ri;ayzp(r|tsHULiQg)}^x6PV4l1@K= z;iBAv>B%=JKDc1;C@+shJ*!^6eu&RygaZmV7I_rW#DE(9M*aQTVV^a|JwK6$ zN+5_TJ3>phIX6!MFTxMN3NVmeDt*{;b-=ZWs=hVI0Q~{4}vwpfL^wS zHI})X9f13&qV3{AhNj|ixt$<1gE+3R2nmfF)Jb*nLq)?RsS$%fu=euPA)kH!4uix~ z*X=-jABn4OHe5qL4?sy45owaKG}ouKNXIiMtF`9qSaUU+}?whpp53Z@|opL{MBMo)l_9T$fCcbW@pSSp#4k_C=C8`?B0f_VUrma zFOhi%m=>~&5NAur^$Z!AhZF_8d|Z*)!WT0_=>i{rH6Ht$6cz0;nhm{Sq8v=)ccgf3 z(7$32cfg1u=kL4s0y0|JNI;QB&fyq4+U-JA)=S>O^p!L?8m z)4Zw^g4nK<;|Ogq!yXGn2Bk0y8rm;62J-`b64W@^bMaqZnWBlhGL@Sv7b$lqe>2BO zjAW_1WZmPnAqR{RI*be%J*yS!$1|<1zH};t)IMik{pStowcf4UIC;8Nrnt$U6#^}u zlZ$^Auqj7X1#B76;ABH)W9-*h$Suk__~g<4IpeK3{;u1cv|XhOMnsl)$|;4JPRAf= z%o={PmEX*;uBpbmG;u5H7$aq6c4Wm(j@+Q>!p+@Rc+`>aWx;#ZGyMMS<~uBOrP9Cy zP>SYM4Ro7vnC-Xmx@r^5Akw{5ERlIt?AvNumP+xeWjtGL+t99WK@G~|ejsS?WM+h1 z*hn|n2)=(V|IIwI#qAvm;gp52oXw1be>@uIH`K*#4hXS(H~|efdb)~OVhd=4+TOO` zmDgpVpfpaaJKjzcYw@RcA?SuAi<{c4oAO~+j!r1;GHT)B_{_?%y0ak4yqN7nRf00CV>XKZs>15t{inilNaRba=hzG zBv=OhHtZ8R*z1CGWlJ(CGX&kBaBj!DIsIoE{NJ&ea6!7twt(44-kMo0i^&I}y(*aU z@5lkaTRW+`t54i`mI@k^q2G4r^=~XNk7Mi>?hD{nTwjnfLU+YOr*>`G%Djg0h5OXC z-6scFWJqowX?+F(CsDV2=S_&$o^VDswgF zR0{lE_0785F?g!*RKqSPXu&dFzp>0o)5RgvzIo% zQ^M-@1vlb6=xK-@@3g)jzNn89nz?5!k|P8haw_Q!w#&7j(2v@%WjnA3N&+!r<_&o- zH`m*;g}t6N2wD$4?$0186Fpk4n{&@Bv(JpEis+>`jT7V0-HTFNs?C+n-DMU&Xx?zzE`6ua z*crd_!?Xs%8~IR^HZpt;WW1#a3%wE-KZm~Xj4Li8oGufFMU(w$nH--%aVl3W|jN=kb7equ$B;t1XE z`*B}><-?ge#P(*FqV%_CVoFMHcTPk2!2zYmkdB5+=PUjB!-G$sk|LcM^}_?4Jaj)Y zb>%&Gp@Z6G2HDZpI|haqg&@8vsu!FI0!eN z!v9^k#ergO=z2;}4tV4)Qoz3P5RB8xKR)bJhF z!oKVwb2G!9rs*RO-0gA%W8JEOOF(s=bJ$Y=@iw+%>C2!`>S$ES@6);K_C3>2(oe44 zP2PHxDEAjx{+~z=0v;HUjUueQErjK5$OBG#cuAQPO^p1P!X!ic43ir_?90+G@qaZ6 z;0hpz>G6Np{-4ib;tbzCUT*RjN=TLd5{c*h)!+ON?O!xc5Kv49Fn2KtYMH!jf`WHo z={tJl!92L;%p~i76D&4@@~kUq`ljQ3jqIJ7l^2cK{zXpKanORJX}H-~q0R!ZD8_%n zp)nnbMZPx{>{jdBBUyZL*w`TUy8hc+8Y7CV2{YIY0n0f)I9;GY{cN16Q3*SGDtiTo>Kgs7ah{P1Esrr58(f#pp@@ z3w9KX=UNw- zH6Jgw#8_GFJV|Qk{6p%e4|}e1o2}2_>~;L3drvaM>wO zpVzYea9R9L!5*9>m?zhi_Ke-xCPwm|-cfxM!y5`1gGrvG&IW7Dcp4<}8J~n#R2*11 z&eat@t^BpPI4Q5z*BCEV8+LG1;LdX#BdM)hKVl8Hy z>0UlUoufa~%x*v;zjhKwefUGP3?!5XxuxBHBsa|Yb2ME!^6Dt^Sfp5OT8as=ua;)=pW2rlI-F73&C_X@{uGb#<%n`(xyyUD?E zQyTtKHa3d@^>TXIawq84y9?C4xugKhhbgC8W4QuZ*0VXE(1+Ml^W%yQ1`imQT#E({ zL}LBy(^Gt!GxkJ9_ogkZb4dy=(_%HM(!F!E^$+hP0K|Lbd*?4Qh@oooC;4djq9Asc zBI<^MkNhUtp{4TPe5|C0_-M~}d)uAo;!&R&O8i>XI#y=Ela_X?iqRjU+yQk+8|P=( z6nN1CW?(^)Y*24FxYbHOWH3xbc=c|EFiJkl;$^Ji@0rtZfi1Baq39+^&x)DP$eSFD z!Rj+OI|<6R{ZDgNPapYguz&bTv*Z+ClG#u=KU5Q zUEx225jeXy$fwIsl0cp5E*$17$bD9qZz97$HWi`=Hi}o0FuN1YT;U61#Aj$8PR&x@ zCE|lk%+l0AyM~jCk8=Qe@PaLK0j?Ka{ys+|y34GeUZ`}*4|^|B(n4I2SpE{=YcW!` z@jz$v;XsVA9Gfe9qT@@!Laoj(ODoyY2Rf8!)MHrR!yz6f?n~W~<{LOf(fRlleeY7% zYYJ*ep>!EFAZ(M{%b=QM+`+6l#!sCHYrnfR#Hag>oUs8Q7y0YdA%0OHwIUUiyDmMS z<}Gx6!P$k*&T-Ev&1hAfE$?cCfzp*wH zL(w+&AXc#cit9Uwt=tpMTn|cmf0e5lO86|n7exmmX^WU0;Wrg$LR+hOKU-S~{x zUcm=PFszAG(C&6N9A-KCl1|}X`LMY+J>Tf<+v`=h{fqTQ3dfu2%qu)<-fkifz!s|w zK?W#%zw6UN$<$q+V-(AVUf7o3K(eRAj8L}^zMSP3w|vt?|J8s)MPeonEm>@Fv5x%0=ak`IO9JaPaZK6z6Z6Y z^EOY+QXQcu$Xch;7Hhtrl0P-ZSh1(cC|?kbMw_^+NGeorG@?rKk4wW| zBWH@#rmWYlec4CEfx!x1H`-@ERk*ot*kUQy<1m~o`~V^UlmxYBW_tf~URFXkwT>z9 zM6=B71ig;TCz^Xedc`dD-SX1bW6eBESW?i7kn0xF>{tFN*#!0Z>%^x`%G{pZ1PSi( zM7m{bL@`>O>D5f9qMPY%ab+Cdzm=it&A0Vy(5wu{!c_hpngyBa>`>4vlf{WN2}ys^ zm->m|u^oe2^ZRH=cuj_5KVdda&9tJDjYob5UL={RPvZ0lyM1@5B6*(63SE=REDBTJkFbY zjsik+XhU#5X|k#S?GQzb63BF@z*S}LF4{vdmG7W@)o#a=J7xXH>jV#C?KT#@+|6p& z9^W>BrNOsXxk8invzY&gn<*)L%4BcdU1GCxl%WeEC+1}@6BI5Bvr5i^L_NPV^T&Jp z?Y~aIKr&ozu%4I-lk2k}mZ&a2z$ zz>(f%O;TDeK5%vpSYzYxe5?Gs^vkD`Pch{|lX&8SE+?KTnG!Am6v{+lo8con-lG|R@;F7+To0uS!G9V1~2 zRHVW8&8y1S-Bv1R@td5=*2=>9aGKEZwCQMWI2tyQ8cAMOAAToblI1HD;(DXhYs{RL zOUuWxe~yRt-Up&f<{|8H&K_a)=zZ~S;YEAN8r1NavFoF=YNd(l9ebm1JM=*M}z zxMeF(<#UXP8ilqu>B^Q}mkSFi2gZKqY%8axMT_HT7N7}tR&Ac-Y<4hOUf({6bbg6L zJg%jqQ}jGb)tuTQ(?XVK@AX#ZfwydSJ~HL-HSv!K@@Lx&fLN=GT7A%Ht7BWqUHs~) z`TDO9(V28YKLp2+BNflz5F8s!b9t$29egK)P&wDQ>$Mg@_Pm!jQ{y43N1jw0DHn<3 zCc97lGA?_W!Jeoj{K*rxs;51<+i1dPm*sR4;45BH4rMh(3eAv{VBNmqXdvtHX~wdN zE;g@vM9qku!aMYvn?b6It@mU7mg}2O_Om@V z!yghgaR;ZJOLBS1Vjrwtg;-^I;u-3QIielpyHeaZ?Z-y8uLX1+2Ko$4o$m{tq5G2Q z^Pm=mpy9pjFOW(ZOiqCJ|rmIQ}=f<1E+uDM`R#jbsv1eg$g(Y z1iI}}YwgSneZ-dUc^vO@sKw#Y`H#vBGRh1Ay~f}g!UC{ zgU~iYo<75DLG-87OcYTNYPbaA3yY0AjWt>03td2PM!n+|?RMuAlE5OdKPA6VuH~+} zVT{}*R+Fzp8z1n9fri!%Qalp4yF87E(DpfflwyRAjv=bcJwNCG@+nzdN*{TV(mnHs zR83X~nn;LX%Jq}|&Z3Os%+zw>2e4HR;aWWL-(!`rN`pbRFp-jhoW#qtMjoj_cYBP3T@1#Zun{*X%KEapms0J0G!G8xv#C6>t4bo@ZHzW#gR4 zT92{HOa)N4+y5AG=#fs}%d`Q?fz*1H04d;?r)lF7@Y@J&Be3hoNpR7+?HuCrs{ID8 zCMzi}9+-b`>(F=;OiCef);s-6zN*Tmd4QZwWgpvk;fWaKJ81KWw@kX%XV`uY zZxOy2LMsGXWdP~DRcB=Pmnmbg z@6)qyzkha)yxgQO4&!QKh+BBJMG*GWMNzT3(yx2w$ou@)f>>PBXutvSkI3B`d^8AN z-I`2}&IhWsU%*h(O}#slBxjlQaS#CiCoeH`bW-xURgBp0gS|%y(hb%C&iVO5mOO7Z zSV9sa_UBRrd>L*6{3%XsDN*LHgQg!z%DvMVSQS%kqqsSU7q7@4e-^+sJdvgWNa@`2 zt65vB&~r2V_ZqO>=3bvU=!!>hDU%b{7Vpvp@iN_BsAIn8x7WwLDl_PFk|g* zjdZ69_0J7{D-(1j>Hd&&of)XsO}p`EHd%qs}m$0cx9R z2!|cor_f$MZ5c$McQ9U4*>n4Q362)WB&fgX`;V>(l_6M?RKNHk9bj zBK1O1kNv>`Z-^s=$LkLi0&&N1xV-hvHX>BI9rHOhYH{cR{BqAHbgsCByaW9_jK)6r z*HP<1=gJ^InZ%b-jJOO1eSgnO-rhJY{cLcWBnry6>Lg@Vku{IQzf&J5()iY2n&x!yDKfDi=gh(8($m2?;vn5aMmu8>3+pc~ zp(eH@&t63yA~usNMX%ZH8wpQ3%?_&XA>JWT9}-3k9pVDNtmqdCTma5awPkV zZDGEzLlaIIF$KUZHo3Ti_c&@X-G=^{5A@UdtmU-6yk zBX@1fNO0=wMw=YREU?%~yQ!JGu3^GTvc=3tN^}xw5+Flc^OabE_au|=Hfn<0=Zrqo zh$&J8`gapGU0$m_*P(4`Q5C9de~Z&_iEqoVn5&uNEl49wE`nH+!X$p{LaMs2p4y+d z+QRJW*HH;LQz^0&TFVkT15MJAntC<9;^p&iq~4odERkgT;|I><7!f+5&HuPx%T=pJ zP$RY|+Pt}h7OO4N4Km?d+IHpi)K;QA(qBNgfU_)my5-2vU+vmf>|89iz5oog6CR%W zuC7h&p{ffT=uz{=?(%UwwWD6ck=RD<6#~3l?ub;MZ13ZydqTEe5US-BQ|K9Y^Y|Zb z5XjKi5PZNpqU@GUB_a6J3Crr+VZkLHuag}~56It#1BSa{Sua(RcscY>*A|6RB_3OS?e_QhFAl(*`?rn+L{s;{$ zitI7grtEA}zoWw({##kvigQVs^)AluT!w@7<_Y5?K`kfStX}G3pBjao+&tqGpK&(6 zZPi_QPr{J79w>Z1?{iMKAUw4Ya2&;;|25ebvT)NEBFq?35zcU5K|Rm^lLX~T9_e+$ zT3c@t=-7If8!Xn<9{V_xeO}Yhok+rB&WzQq;>>sDL!L%5d@eQ|sNP*?R_o&=X!Azt~V(ZCh_05Vwb||?| zWM}nVIGk36FX641$o}IF_s0xML>i9ub&19uj-yirWwbeTHJi5q%w;X|%D^iA>HQy< zFtnKyqXUzORQY^{RK78}~nyq8C=eiR`Rn;&^Z(TO7l1k+`Ug+oKhCsU9#H2c>RJEIPk)e)0d+p7 zSvu-Jb^ZjXjT917ruc7i{6ogMZe=iD9`V1IP;&zz? z{>eoLL=;vvz#s4Rh4s~6&X*Gln2=IV`mZ;Czx9V0Fyk%qVzj^S8ySG{aD_R%r~f;^ zZ)d=O6Rmy_{dG93#nA#DeTHU*sQ(=2|33z?mJ@n6mg!TdoGN1ebC&=E>y6e8g$CAN zS3h7i{05VyVaa}Jp=D=xd;jHD9wkoU>f+m90$56u@CRUU4&u^0wSOtaOQb!MnWQ&1 zmMikb%PIW&UDTD4}Dsa_yc@V8e ztylc_Ck?u;q81gm^Ax)4PGeIsFUr<>uM)ogrBB)P^}P7D4|QasL?{Z9gv@lOtjwSK z`)ys8z9+^{Pd>X@jC>y-{DvSqAv;~0j4puFAPMd4>%#bn4r?Cj1_DVOLD&63UNPeTFL zqQmj2FTXHni(UE(FRzL7w;a-y%4@%?5y`=ZHD6m0S&bemMv-T?$~~8)9BgVrSTnsz zWSK}8V&R}kk={;}XlW@j7=dq&d!09*#F816G^@e~`R#hL?C6-;6}rE;}E#b!-Jp;NmAI#L^*8I|O{LjwHPgWD=L( z0M(lAH~#Fi>1#07Xg99D8S~_QUa>Im3O@2oBTZ^p{rwFE_wJ*^8Msz>#&lVv-~B*c zk)n;eu664TG>VM4a(}76^}_kJ7jjbCYV-E+g+yR^q^W^Tss(%DK@P;byD7T?NMP7P zRFVlO->uo8@qC)d4T@j9?{>R)d5Unnf-#BBzRHi|Qu@qF=*Q~)!{;FC(6p8BMm3vh z>X(_7ONVH}xdx>19gg~rGmqFc&b#1Af)7 zv1a{CRN{J@sg@ji+Jh^aKw4~So1(+>9P9;GI{2a>&;R1?t%K@ZzAoWFNYJ1Gg1fr} z*C2sl0fM_jaCdjNgIjPC9D=($1b64)?#}n*-kW=KfA3o}HB~cTP0fGQIfrw)dv`zG zz1H4qUDqN=Vl{9ngp87)|@Tx(rvKgG|j zSD%+N05@Dsb!|bN%ei0^p>(kw7kCTrRQn8!wI9@3(KWW#b1Oaa^^3`Tmt8pyN*^nx z$3{|5rMvxOM(sOm$U!e;Ol_6UYF#nV@488LU%#YUe2n7S&YTcLl5bGCg%BY~ z$D^QVzl=xBzX9`By#tCe+RNE=J>V>t@zRD@x|b{X1MAi_2+}jP zAKmjT??aBBnhb?y-@5cLLC$~%X&=0hp4&RrkI~CO;2WOcczY8>A!<%*USG8!L)*o|65_& zHc5fVqOtK{=MA7%Y?PhwRX`_8BTGrv9fSL8B!?fX9L4{}Xj|WyQhOOCGHP1SXpZi_ zmiUfaz_X-86Hhk%G=KV9>0ko5XY6rj563hg2xr`|IYi4S8W#5vx+(0vaTBELzNO_r zq~$YwedWL@g#IR<-ow9HF@g^BdNPVC38w>NZnB zvBZkF1Np6K6818pE@LidJ8fB}y;plroZMMgwM9$Ja_{Qj0V3la8|?B$d=L z70@~_hS}+m((LAH_@`?dGAqEdIk6tr$lpiK;%&= zL^Ozb_`0=wzrUrF!Gk4qThH+JKBKTCw*VUdt6)-FMXVh3x3;}tACR#3nk}p=gtztr zdE-ieoT!+HQwzHN1jp>M$%_U+!r*!{`5cfue z``qg36o77rxfo0axdl!3Tpv9V+0}R)2PgzyHeXu6Km@x!iGV@ z7lV=c<}ZvCG`6ZN(n3MaixogY$7;%4(zh|+DE6E}$Lmjt(?c;#N*nH^W?7M2Lu)5X zQDM%Q`7-BWdcJ|2K9qhDGLN zPlWBT`^%os(D2(t5>U1W2X!e>zu^rwc`ge@PJYvfykj0+ZeE9O==twZU4BGBN`-7F zr>`07MV99P!P7elS}B!^yEqKq{5SB8kBO^fmRODi&D^w7^sBiPN#QRMm>Wkgr_P$Q zrOf%L(peU!!3YuRG$B}!0Oq=k?;PLfOXU;JkNObP+QdYFX#!4P=i>!y550bC)IVXj zuTsEF*6JIA7l?`XM90*zm9HH(u9E0f-QND;)rlSP8RbztHMvGXW2{E$b|tHq9+oGh zJ(EyJYR+dg_bIO;vj0~RU9saXu8gffbD}{CSbN@TC-$16{s2&D{t@>}Vm#kD&?CzH{?_tc!=gtw1AoiR295D&cAo^>3Y zktvAKB1U;=S-L`!7_y^1@qBp6WmCj_~}E-71i zC#JXOj_Up#=Qv>&r8=eVM7+#6bfmy2%Rjn{K}R^liOYw~iLco;=Y5gX5@SJmV>bi6 z=0O*Zwg>ua+|Y6XT?lvBvF_m9y-uM<6u z-A_zx)Njl3VN%$=Bn(g=vS=mwi_AB1dsSGPakG}UET}Jnn-|5{Ge*3#KaJ)?&kDb9 zQEu@qXwMp%ACg39>VA`tyH%2pb!d-x%@{>USLwAwHV*6XA__C#yK32E7E_os<)$eb z?maAo+mU6f4Y^q65B^hw*E)y#NhMUiER5+;MtR$Dd~ z+btV0Vuq$5AyVQ2DyqKrOIW3bJt?&k`;_Oi6d$ohd)h)R168evWgChSt#*M*At@$a z?EwN)v=aZvtd?_H)bOwNhACj8J76=cd7iYU5sn7 z{MT<0fkJ?G6JLUC%5Qp>`1wGs%q2jaj~RuxCKwn?eFLOV6G<#bY$$GT%Au*K-R(5i znoMsG8{R3R)%tC39jKYl(!ry_N(%ucax(%kFYx+n5`IQRnm>ful7G>UyLYsDnscT@ zyDyQHF}#P^Y7Y{_a+qw>tc3MNR(LB=e2BaTWCgBwqqzGm!F2Xee7Od8$BOa#3oTf> z+kIrKSm+84i3};1&Ur(ANso32x(DsqVuy!hxmulBh_<5E1k?PYai$N6drN(O8q^Bs z;@y62?0m0_Uzg!a$qtV>Di}*GM;mqEl(;6UAz)xtqf2bxkE#rF9>Ezs>-j7(L`m3sj)Zw~KDm=aTe`hY zX=n>`_ySupd^4kF+mSa4ff|S8pxMydA07@9 zchd73(VQn2K1B%f=D3^WMd}qTCAK<>Gy`#5+bHm5$wvdtdOFr_BlELomO4kt9^yZd z_5PT0*o<7L_OHB_41>d+XCpj*ghKh2u@kesN>OeqTG`M5+6*zRj=TfW zE78*L;jHl+ne5Z}1?FcvoXy`s&3qYDy3fG;(MVyeE1)M`ImIip#Caav(=n0>Nr>gcBXP%Tq# zCY8akPYWN*T5YWA-(OV7F)=YM@pP)4gc3Jv1k7M}W{;!yrZ zQ6^D0X=yU%?^?e zK@mO@F5@7|W4hdvVPSsSZHnhg&6~lY816xn`oBes-+CM-XqDGRIHewRB4FK~lzN_V zOCQx=LGZ1Xo(!G|&m}*$`3BNT0Hxzn3!DZ!1W5clR8U7vU6syW4A+TB$jir*H8U4R zhwi&gTaWLHkndh4E~XIncWm<&c3j^$t2sZE4=}Qfx;tFY+zpVWdRM2+ard@{>vT3m zk5KslnZCX}18)0F9p>EI@EI-BkLNTNqLR-GK}j#GRzgc27w=FmjGW42p82%xxsyWx zn8tK*m@9)nOr=AImTYDCENMq~e&vV5t$gJS*9Nh=>resBEzh8KUyXNKjWOnZlo?5| zj;lior+H4hR@N)q$K*6`)vZ=3G6K;5Z-k2RC89D{dXv-#AplE{cH8MY;czV)C{BUI zMzB)L_WKFXTHm)l!UY>;>R6i_;4?P_E47DGec9CkiwuXkWd|57y1!6WpkP2bLjMK{ zC!S0s^`66Z(Z{~erBLhKRLbmEIDiV> zTp%J!tr-l+5%kdosMIJ!EvPQ{mvV6+xinA-a>-Ud@0eTsrz-3J0Pg#L0rdR;L=&!` zFb*@G{a1^PKl~;Bm%JpHnAq9>Hj`jyVf&w$NiehiWo7|5P5>Sf41lAAo`IE}y^h)c z&|!j!=`9m8C*1$kVq!lnFy(dEZS|A?kz+)``f|6;o-wUGq=lK(}I!`m%`mctojU(!|D9w0E5H1Z0w@5E%Z!y)Fm}2g8oQI9Z~p3Oyxl3^ zBcn0&z`^?N*OTK{A9^pL6fJ6%Tio3~!wplkXwF}Q_ZSTCn7;b{=O{*{z;@E|KiMw| z@ww1l(;wE|42*0UQevn4Vy*s6hxdZf*Mp>CQ@^hkytPaH$}^GbW;=V``OWk{zOOD` zV6Csvem($OY3C@PWK8aC)8-&S==pz)ac>Efa!04ums}cX_*r`^m8sH}N7Z`M>2z9C zzEU>Yedmio(}jP&I%*4sG`&`}`SHn55rdLo{!2&sidq%<`$pABMv11(*1Jid%+ao< z#M5s7hy3T^P_nrl#&QZWGQdsZ{Q3kfde^A)Rlsuj^|fBu$y}A`YD&zD-$u;4h>X#^ zjkA=JL?drFleOWy#U5FPYNI9nkZMWm(sS{3!?YdVwT%sDqeyb~+4?)?Da0roKEBUr z`>N1lx5NCx!(@TF3Nk(;(W%j9a_$v2TZ_lTEg(s}Ijq)OZ8zJ`Vr22?)Ui)dYgO(xTKzuP=u3{9k2_j%*fF5SCU)u)}KB!feXu**PNcrnK zj;?`UFICvz)mqDoMkJTnPUBw@d=en(|BF=nSu6Mh_IS#YK=x9$tM>9C0(u$yx~cLR zHxb(h*3Ef?tAqmUFNy=%S`T){_xmj5;59^wK;yRj#8{iN_%tJ0?kh6cl?8uO%Y@kx z_|qcB+n`03El3U$jMClaDD?AK%!)fll95d)er||z{bvoc zCS%`UvF}17<=q;<%&1368vS5x-+jC1`x?=PQc6W%u4Hv&$oI|aj}0motd*QT7O@)R zS?}-W3g4zwz8hmD>0F}0OKaxN8o>qLY|U{w(0Y5bnoqGw`kEl}*Mdx!Gocp~`8}iU z^={8O_b>PO?QX+Be)H`KsXB=AlYcRf0#G)uyuYZfI!|TUN=#|iI_>27hC>z&>0YuQHM*_YeYoA7d@5RY2-YWr3`Pc<$o6el-NYe^(t_Beba^N})`*IL{*Aw7fbsmOVISgZE3r#DuFy2pIZ`KC4c zHJ$U$>BVFUgYM-<5=c?9UzXNz_U0jQjE-%bh6eHjr}FB{wB}=6y?lvFN6wwwtVv8o z%lbq&Fjv~v*%8T;cS@Y!6O8_$2*LY%2qyX!_moC>|TKaOTv z$-L26VK5nqp80vT1k$uwGpkV_Cq;bCQIljc%UjozI(O(;P8CHjTm5+X!gm=)kM_eK z?=tWTQ#OrU%Jr;{nw2f8)gGpT&--HY6^k|5EtlT$!N%}79`b0$)zm$2IV zu{~FX!)Q#8A1l)2iUbHyu~bFihUdpWm@k)`u4+k`Bn+p3&T1^lPC8|um8!pc*DsG5 zYXhjU%+}em+k09}#7J85&x%ayy3L+WvT0V@UhdbS(@g)UdAM7r4II&f4F-{>)=Eq- zDWAE3-?Xoh(e#$LcRDcNCnk#EuvyggPp@?^SDSNVk@QI<(0dcJT|V2reAs{b23) zKH1IJ$BQNj5RJ>;@! z)Ynk5&b4PSr?l7Rv~(Dy9$&`2)@i$LZmyuq6e~8pRf{8Zp{cG+CON((6r{&Q+ErNi zJ@%Qi#cs~*H}g7mdC46n4EGqV+biy(ec?HPl;v397)jajDi^^4~w;YO%SP>QZQ4|+tF|`s*gi%XYhg1P$^WAOQPsQb6?2(Tv#RG!-XLxE?kEm)RoO1xCCRG8Rn z9KA%biJof|q&jr8r^Xk|W$#&Kx9B4EgHN$_@|$LMdS3w+%T}EvDmnQ6K+SVdtVf#H zd^!iW813}^Vt311an931#X`L# zN)EUbnjst2njNz=Z=oRq>?lzN+XDHmW$`EF1{5c(B6NIKC#WQdc{ob2n>4Zg_=Z_W z&E|FI*M5~e-2p{B4RY96U|L0oAowAYJX~Y1>=m8K>rp6`$NI1uf1x!v|D`7Z?68?= zgsDhGD~rr*O7xv&t%^;k{S(qB7EVu%a)`M#UmRA2_tZ}{OXM>+^8VACneP< z9Mlnq8{wGyDQ=W}bbA!?YqZ5oWHe7Y^^gc0Zik9RjF+Wg25J7tUDXnel2VNnUz)^4lKCzKL(w*_Y{fg8`2T^!t5%eFf+i?V|>)-rEAO zYYrx3MRXth2DLmM!c(mLWU{qXqm38y1~P@HZV_d$N?1|T8tx+k;bHak-4R^KP^l3v zgmuQ%or)xNwb3YEqpg*(IrWO|vs{Ig3Lqbi)klOe6VMS^+*6p1puivmZpgPbRACI7{vsuiANM?&j?{(t5 z5RFU^+I%~?o`c(PO+U1s$P~M_E>BEkf^B>-=SUKMgj)GkoD;4{qsAH#Js|xt0IUl| z0je!eRA5#-q;i;WQMA7zJq+kUbEMOPCH#Trdt{k$c(Fg30crPUm=y59ikG}w-}9?@ zPPNqCa&}(&&$-V}nG(XRsK>&g>rg;B)+!UzuL`QI<*Wv{x}WQl{ku4s(w?-gCIAg)i0IoIu#Cb5)lnt zdFSWxk$x(R42wMJQEqq>e+|4*5NAiyg@}P|&o%X3Eu;m>ds7<1-InLU`h{5npPpY* zq*<;h0j&~)!7OgitJz-J*o|J^G0MFa1t9&Yfe+ey)047kM&-F5&QY^_VB%LgwQ7>D zT=s_sOH2!2fxOM!XM3v0!QFxaLun0Otmq8toix*_c1^cZ!5&c9o_sHxP=mEa9D*x4 z5UUJFk}Od>6yGLsnX@I)CU~R3D+((*!IwRfzDRy+X;cA20y-a#JFAg_;8MvpXT+{M4hWp^xS1h(i< zfYPmyB9-;nQftb_QT*hI)$$l>v9d1BeLL`O^P!-K!J<+PbzwO#lyw8G1gF?m3u5sN z(NIq0Q?h4>!eW!OYRjYER8zyp))icAfyP-d(uEdoBsk-3Z%#zjbNA9?NjEs$S0i4^ zQbC6%?6$m*;n=*HmMugenNpAt-p4|z`I0=X zU3Re(1?Sw<7I(NAR{AU<@%apstg|io`?=@P55ZD)1$z|bJ_?0T`lmzKx5f4!7;~uJ z!XL4!BqTbuOCBsXETda#a*pRq_pjb%6UADR?-`Dy%g~8sv5H?qDa$2FdQxqT$G3ps zolwWgz*fv-T*-5{!4lEw98{P;_+BJ#1Zj$5KYc7D8b^|vCdrtuI*NFEp8^`q_$Oe( zAp&>J%{0n}l2bs$=!u$P1>cbE%Ta1^$ zVLj{jk4A&u{QRcKTU*b3cMHM&nX!ZN099w<$5lj zgsNP{24AN9j4r4#+qRHbgUR@J7gc}G3ufpUpscg#ate3#u_QCiKPDCr~3N=%`|z+psA28ssS_kC7_++K4PD&8E^2pUy+ zRC@`xVw_%4up?fzkkz3_gQP5cAJr1Otl=ra+saYYxb_82Mm?gK8!UP=`Aaalw(Lt~ z%o*4|19`o(E^ikCZ9Ru6@X8Ff%pp9Xe7>TpOEh^LjWA>Ky`&m(qw#w)7YHV{K40-} z2i4urye;>NjflY*?tzTVk&=|1hC`MRM|(q*QRnn}rrAA#6K;obARrOAR(NiR@eIwj zlTTFe$NFuICmr(MR`8JAEO}%pN;b*8l+qulL#8y=$K-PCNim`Il_1mNr@K#o^N7i;s$5eNBR zMmITih{{CYs&FVduA%_m^L)HreuzAozKQ|X-+Dlm9mc;&_Ktru#@3x=6;b71w}oyP ztHLnoP7`QUTKhz&wa>@lJE}|6jm-yQ@5F4|)G6vZWH{P(ap-+Kdk92V(Q))D5I=Erfb=;h5!xt>NQDJ*f>s|~gYdonoGJ8#@v1mRC z(Vi(c3(i^EUw!R$vd+5Ezdgze2#w)8IE{f^<5$`0To(JxnW=P=o;FdW;sHFNVR{zd z+O(Qt-H6WQuv0iCpH@5Yc0yuzf{kwBxk36UVJk16(P#E=>$^+YND|DV-(WW*M5eT_@z$$g?8F7#S7SlH0ZP3VP>F^L zEgEhv;1n9I7Iz+xl6|&7JRF7ry~zYg95cnL6qDzlg#LlK0BftLN|>@S zlFE`)E_mKHwM-=oF_lh+&Xyl^M)NU55v+P$?{MFSW;q?O$kKO)=wR4}hSpC#Xc?jy zq6vO$5RLn%Z+{?xR#3`J%uSyU=U)cu#s_jWb-m5;`)Awug)TzDuB5>8j#XI9U!(7w z^oW#YF#i%q|EFy$WUY;yih?I9<6{(?#cmHmw2>ofGmYqRerdl;8X3yMMVc{{Qm|3Q?Kaj;i^8{V~o^ z0pas6VL`wp`+8En$wlfvFi?RYsP@L^O7M|&-#>@c+YSZh z3{ibjgpe4D6g+lOsi5;4b_r<8^}5&o(PmQcxo7mhqMH*ckm$JbjUEz(h>$9wB%>Ja zPe;37ffqjPFc5}nCncoHe+vC8mHtmFQ$mg3yK47frtqhO-!G$6VjBW_5@KX>2yxB_ zEz-Xv+5hax4l(j3UhOwvEMdg@bN7r2+y6BX$kBIJSSY~C6YJl3BK}uT#4x=Xk6INp zporfI$kA)?tD*mEZg~eS1P%nj_=yY1Nk3u!?R@;RGXnK6e$LP(yTr&SkfTvHvH6k& zTxO&Ia+E)IksYMH>VBtJj0FFr>IUwgBzeC!yS5%FQWor$C!NNnXP(CINu=#P!Mu~A zkW=$D4mLeQb3ZBAKm87YvEz%6P|(UKV3jqG#p!-42{n{A{V703o^8j|rKj-puZ~5L zzzA>fsfz-#a*!wqHqc1;k6SIL4=tWcCo{1l01Rz38CkA)aC`1;-r7nO+#{oWoB2K? z!ohR*?RD4OE+Cg)Kj*TtN>NOVO`(BaT!wVXVl;d>TRCEWciE*`Yc<+qW~iHKk^y1( z1~fvMRWqM|B*0C=&;I#yac4IkV@?9SMucVqUp$Lj^8MYB-fY9(L;E$qCzSzm zH4OG@bug=6pO$s&XOBK$CRxF4y`|b}COY!?*gIgpo=0~%R0kw5FlaXVf%IyuqSw|b zBn?G(fypERqBVcPM}M1ClQs5h1%<-;d7?%5Yk8O(PXCC}0xi~>*viR`mHYYS4#ZQC zlH0Jl==RWnjp3CD7mbh4O4$l5X%x#f7wtznrb{$PY#;Ca<5_H{aA{)awgyU@rNqVS zCa#q|0Q_zFsZ4o~EzK7b9&D_iiz{2|kQIo4qrMkI!vv~%1Q_G4^SGPm4jMwxh-_FwUQx{R;{QX@&lMshc#S2 zmE5}fe^4N5m47iEA^}D41@rZXN{Q)o<@G&pT6>}|hSXwesqoxVlG8Q^!|7;xNe-Hg z`7zAnMuQd$IWH(8`oa$F)HEC#9QG8N-=Pz~y8e8zyEtuCS7&450`_s6H_<&=Gq5xJ zv7(dXcrZ6!FBNFnT&%v=<6@VHd;V6--rd)CRAXMx zBfSP7wE77{D(Q^Y%&%mlxl1o=Nnp332Eam2}BH-bJ`lRhrK`FmpTZNZ(G) zAM!aKs;`}_3;W5vkgr*`=O;>NdfI-UwAgUPNaD*3ay#r&GD+58sWm#{v#`{3e!%m? zPg1MNoB1wUhlbB()_F&OG3ZF55sv_GN!Ulv2xY|wL2K` zI91<-ce;eo&<=xa)Jb+NJw|Mxj_z{m_BgEpfoj<#|K(HCQxauoap^d-bSBS@q=zLP z4>r#;>tdl+*ViAa6%mrE_r;G7Ik`#i%VT#Kz{)l3Mm_eCPqRgO zhpeLn8O(#~>zqPC4>FamGuDS@SCj#g&_j1#UD#D4%TL=zizT1x0{%4@+FOu%?hG-1 zvrzq6Lg}qHbJr_-||9n4FWCuvri;y7NUkC;98#9HN26ZWIcq zzFe!5!yX>?){Lq&S9Uy9j;DkA+&!Zwt&f9&ct-2wXMes>y&M1^qWHIe##ykfpoT0# zcD)uL_c3_%X(_tj%5APV<)8Rw%IPL6g;3Gj3|^_{inkhn8hAx#?aL#x;sD63E}cCx zcn>_Aex?wmG_0~|5zv&JJ85}v=)O|^jsUapLH_ySq?XGCooT^I=@8TQx2Rw~x*L(% zF@u5m(g0jk%f<_c4*j^{l&a+KWfryb_5sJTK(fK~{mF2H{080p_(-#U3C7k$9>NG^ znO+MYjiDU9(^aF;WzVoI1-Q0BvqGQq4UL=9(0=xp;(DBHO!$uPfTzTLToA{+`(2Yy zsucCwC<~%nJ3*!N>52sNKqkTu@AgNMNPc+eE!G^_%2-3SofsR|PR!C{3bHrZ?nr&! zVO3r1ZKC}oB)6hWR|Fc{a`e45X^M?Pn|GVGOGmE9Cvpb;Cu)ot%)C4vYot{RCRwhL zd?&b7$SqR}e9*73@O7Vj0aGKG*u}vLv>2z`eY-P-8V0X8Kr_hfhEAC-wT@m3_SYj~ z5vpAYtAMn@%O%ZJvyxA4SQk^v1zdcA!*&RehB6qFb-~26v8sYOxNF<~I1#~0%TA7W zmw2?_$MTP!na<^;HrRGRvm03;1pcrno_8SBNq>7bUUl@tKL7^8KnG1dBuB+^JQXt> zo4vtqM^1eKf@S`+ruuyZZWW{KAyJ>cM#89Gce(E6 ziiX;$KV;nz!x|T&Fbc?K;bD$S`MdGgyA#x<%`s9ldeW{S{LakQ0~!<3IRB8OrvZyf zqoH&O=hvyT>UE!o0$!!ihIby%o#!q3LLPm`b7a|{q~*iwC^qcoe>ycqsHaBaJAM5~ zYno+To+5wz66s;wW;b5hUyPSEiBR1LFaF*7$Hsa2JlpyfJm z^A79FbARrUVLpa*mPxNFy&lweCNvsy5ezu(oi1Xe`4_W(#VKY%3)R7XuSwpF_4`qR z3)XC>8kZd+>WQun$CvBN^>>Eqa_`xVk$a84C09w%QZ_vCN=4pZDPU7_(D;((NCpA> z1n<7pm{j7~eOuP&wCn|Z>yO<=g=#I)7dac428+mU{lGF6~mMU45J{r7-W2NtTpH>^Ea>`|ahs~Y?kv^}x4 z@EU$A)ASgg({8lpKz3f%KYFoYB%Y9pn#eEO0TG@;3f~^IUtCkyKe0Z#vfyqv+29($q2?74)5$Su zqi?Zxq8N4u_gAV8M{ih6Cxw8yyj06|B_oN)zp|b2s4_j(*~Al+xenWW2F?iCbcdJL zVO)_s+ipH$X&@n0RsJ-mOd_8Wy76{hjWB{AML73nDC?kAcLz@m;-?QLSG^f0a{MfVV5 zgtVHF;psjV2T#-+z1MKsU2ul)CBm2xc;WU0Ij(U)DR@U|%??HO*Bz5^8V%+t!0oW{ zb#Z4v1NE1;r89!IDyvlT`D!|lm~=+BVJaI?(Ke6v?m4)V2P(WW#=z{R86++O?rTHE zcqs43^F~MmO{n~|!G-Yd&iMLyiGab;OEPQY!2%bo-e4>gYvZ?}LO118#tyU6 z%P8p0667kKwh43|Nh(QI<2IE~xiYp8*Oy5mNJ`^t$W?1X$swXRq6 z?wu|Rww%Svm&_?6jEFC>@p-W&TcmD37g$}$R~<*W;d4wdN|9fT>Nsu9y9j=ac&>6t zUYAP;Dak}9mfGa&nF%hLk68)}751*54cuOCmzo-nN-^rshEMD}&Ci`&&Hs3pM6(rV zBNVt8M!KPJ`W?q=1uM#?t>xfRXt)fNJp%RV%^BcNMHj4k?I0!p~)@)?e4N??k(oU>mNZ%`?wrdKj6;tp3(3a?hiRy zCRNe~fowJFN)}yIH9V<|;8i?7uINFIMOj|v*}(76-iW9q8{+X7&VRG-=jHFZy~OE# z-3VAy1uahG;I4wE4y4l>Zo)>nxe&oFR6TF9GdGEe!N&tLQXCLAw1hhzjef$()ocEX zZV<<9tN0aYpXCk#?wx#!L!XbqO`sQ|UpquVie_KK5(47gMDE%2N{SV{HtLlz*qxa1 z;VnF`oo!Fzj&D2j5#wYw5ja&3J}p$#wjIMFA}(?ac8Rwz4%;E(R)UlHs;3)^z+->^ zR?m7#2t%WsyfN>yo7Oz1Z|k9baQzFRwKc>54gpUMAvH}Z%nxeOF*dY~disq>#A7tz zvHR*fBu-qa9?K9ulDuc=AD+hd)6=ZisHK{jwm@X;uO#jwo*wv=nevz_#z6Mknv(rA z{NMiqDFo7qS4bq8s|Pmh8Yb4ZbZxLihcozPT1nf(&jVkCT7eQCqYN)l8w6Ow{rfCx zyQ!CyUwU&xqIp04B=5KQt3~U(7FQF?B;8m+c6)_R&uN3}zt2Cv(tM8V+&JoWIw%st?=VO^V}uW~ zLEu^YOiwHq;mUc(S2h)XrL-T0&)^loK;X?X%_VY24E3W3vBIV^@A%t60BUPZkkaeI|d%!zMO!s#wCA%FA4n zD#7ro=)>n3PVA5UCy+02NMwsZCq3;kkBZM0&83d}3JGXqYmmzJmP8KkGil%JF-8~U z9gX1$>R(jeTC8h$73}>ElIpDgWgN86J1kIF)bKYB54`gfK8|Mx8 zTFW7l(62zt8`}1krD&plSQGj#8PBSdFi(vOM*wcNNce zqil6w?<>ZwVMJFW75Evd%3Dknsx5V~rD@j_wM}#lheLoI?4d{dy3hel0Zw)MLMj`v zS@7;dnW+{_s^H}^B!gBqBV4(!Wb|aN3tOTQ8MiB8yjph$CK8Hgq*HS|-Fj z0#%0yW%^YOhI{h!&WM&0qVf0rxw9A&{fQwt5o*0uk!{j|GuH5k1i`-1WulJZE^CU&fntab7#g$NZ55{B1s44$r&e64X!> zQ}kW1a1XhE`{=-sG=1vOgn*&O8lh6+{BjMR`ptdgHCw>h()t#E7374+Uc_JY67mdvMO zccE)LIYjW9VgSQMjZA0L*N~Wn+GHvA@`wftOzmKbAToK%l~lwuF2}3Owy^?)Y1Yz9 za`K^}x^+Ql+rxc$@gy;E&goQ%vNvDs158Y%Eo!srA);6t0@Db8Ml+RV50%G8P!Ou~ z9eF5Ceaw=dT5FW!SY4NRj7 z2M8~NF@&D45$bJX2PS%MP2eUi_?$jM(h3XrpU@H;KEAs`^tmr>+=)M|(X_sGs`55b zR(&5>ug#XDp1hbXfV_`;kzfO3?sK9{{^FIf`^q>0eA4xLs@zMMfl4cuk%OkfE>-_d z5$+R-B;t(t^WZiKTd&9Zmv?+}5vi>6J}kUBNM<}t+Fll`5q9F7b8Fly@ohRUb5mTf zvOp4N^N0K!z{~Zcwc_xuX6<4sgfRS7+*Br){6mM%Qgzz~9?aKVO@XA~Mpn?D=y-1> z)GsvN`#3k%RfkEw9P%+0NUQ7#eSVGL#M+d!@W70YsDwvk?o?XDDcSNuN{Nb{^Lvefs?j(On&pt59Lr; zz$FSA7P)LKiN#2%SaYE6__I((OdIsJJV&p^akUlXslN7Ey!qE?1l`#u^Be6To9a1I=G|_$!4wG9q$l61D*5e~ zG+RaY;EZ`&y_;|p%bF;{sG=~K5#1LklI8RD;+hfTvV=UOhQ48L1(R-iGYfB z#q+9C@XCzlv?rtfAxQMu|E6RF66NR{9*QOi{>4WGvHeCl(9gBl&HiO?^anB1Yw$Zo zqJBvb8bIpM@&`X-+_!LEIi~#k@BSR^U%Z|-rFh-O1`UuY%xiN! zlfGDNDP_r4G#^Zh+Jyew_>GgL{*$a=c)H5(jk&Gs`{@<+%hD70EU zcn77w)&Dm9e^pZ?2#p@(?A5G=3H@+ZlU4mKz<;uAgg#KjlwjacYPndkcYgzq zvY#&bFV^di@47|{0)e>gj<+KYT)|;y6h*&B^N+vqZ^0AZo%&K;#&1~CZlV)wwv86 zUX?al+)GV4Y5J(VmH)E09AK`aKRGU6_4)J;~~l zjH()MxQxewm+DPy|KIEz2?X&vTX6@gZRlKnJi~Y04%TD zsfoDZna=FIUuZ7vryQp$?5ZM-1e1o_FnnOg*)ESW_-$c9poqnKd3upyha-Q8uh^ej zcZ{`p^HsivXbt{px(2wlh2e`-D(j2?kG8*zs5f-tWBcI6uy>^T**Bn|<#)uKQYZ%{A9tDtMA{C8Ish;Q6xO zC4h5;dFuDJ{zaqh)ky*f|#-(L=s)!F<1w03|FyWl6sf%OIP@$f}FBQbUh zw`d;G_VrvHF2#h7fO+ruI8)!E>Jxd6ViDbI&D3;)Q2geHRR7{knPUL<0#OpAdLS=m zH>1-(O~1P9yz;0Lok1M$x@LKOSX&H{0`o`}&!_s{8Pe|&>V@+u4_!1^8 zP-@UqvpXj~0?I5tNBCEWF`7j-%Inx#dck$_w#Y0T?w%p&nj;Q}Uaq-YxW% zG>jI!U?S5Krmys>7m5oco)Mr_40(Sf{`NB3!r-Gy?e_VgdKI%fV@u@E5R2||a`c1K zFHQJSTDe227JZ75obIZ!-=e9wF9aft;@i~yHX6@~ZVMPDSju$OtIepoMf;dX0gdl+ z2UY11X};IdiOqm=2P^$=^)^67YwWN&PwT1f!R8rB{dxEAxB87Txjsusw{(0o%Yyp5 zrdoWX41v_YnQNO#39dS>;FSL!+}Bidx=|6t7Kw@POXYb&~&z{ z07qgg7=CK_ES@JZ+1W=(jDy$uek^DZ=kEAXIb=eVu-He^7K8M~6?$q{5PvP)MG7&Eg9ey2?wLtO$y!O}mTM-d zZ;(OdatVI612qI`UCc>p<8?#Ir~iwNj!|K#pu0FTpguc8_#Re`4*CjrC&lrZ6MS779y zSZ_|*Y?h$Q=p5+^FCes4h~nw8@~coQgth@uMdxy*<(Oeo;uT2!F9e8vFMV!`6)_@u z-YLg&KqAMol9j$s+;B>;=xbq$FXxUKqHP2p1fQ7NEp(5oaBRPk6l=-<7ApAd#~t2Z;n+nMNPF*k#Y^ za6D(A?5L5iGF~8HRXu?&dOddV>yc7_YiI9OPAnzY?_J{ho})O3QS8Z)f=^BgFnGqNq?bWVY(3FzfNT$r#Rr5^lKBWy5v*@odG;H|~X6h!`txUk<1=^(zDa ze^HkH@BX#l*qJ>4*yZm3?+T8vm z$j4sJ(`&+~h#1A8#|w<+b-wT~43!jF`NV6x9Y|x&|9@499t}e7*tEL~*E{C4U4&fm zNKc1R6+(4f|L)m6Z*caB=A87qh)awn8y$Xi+~&yo5Q+QM8XXyeDnHjrPQI~aV+R~2 zXny+Ino*z%*_&Z!y#s~zZ=q1>De2 z-W;2h&+a!YcHSAZ9hL_~^SWGFj~N!qq{wt*_{;P$V}{_S)iz7UG0lD^x(G(J?oj%4 zRBw#{0)v~0Bq{~3&A#%_ zne&NucP(xwD2!<-2Bl|&fxedOUJB3}rQ_`6e1YTtQ5_}mzcrNl3?5z5iK`|(GkiIx zo9I0;3aEZ~`&2mRZ>K%~qO`8KoH|Plz_K9*sYZsKWWEAY%Qa#OuzqoD52j6A8BMNE zs}~kaEThT?3fP?Np5&ibn=baQ7=gMMVL3~VATHT9eGS|J?Ar~pqvQfNUE`rFg1a&R zN1YbG9iCV*m6K=x5s5f5gRS$+NM_|kXeKAD+CGV`UbUqD5j_i9V>_tDMY0GCBxmeq+|G=i7t239P8ked(=B(wW%iM3v5W^(%o05oKT@p0rZ zbLn(K3w=X7$eha&ZZhVcBrW;3WZ61-9_`%}GZD(}@f%ZDud{6K19@EXUU?n@eEhg< z7C~A0VA*2AIKzug3D+fm_P8w!#+Fe?ypHHHn|fA>k2MePtLl3PjnMyd4O^roMt^b4 zL=$-1H-3<`gPKlK_%F_dJNFB^HT-N{U7R_GbD;~Ghncg;Xh)r1)^GCu;?Zcebrxo- z5w8bIrT+cPLASpH=8ZmqQQ3{G1({vLyCAL#PapnHpXF2bto(f1Yob_hQ5R{OUa zQXwS7gY=uMc4$3b3ZWum7miNVOcHK{zpJqwdk>qRM?#ia|BnDY08YvuokC;-cnS2b z5idv#bXmV4$45DjXvcVF_N^dv=;SqBdnBS}{prc)C7h)rGzLksde!&qQW+QTbO!&8 z=d=+*NNXQx;)I5y>;5-$5Kf0=?=yAzcS8*(%r2^Q9m#}VHH!k3OF2#N6a$B!1kq}@ z2I(dL*>hLUHku=7#A+poLj{SUe^&+)%2j7e^}Z@#{M{~U2){o)BdlAKh;%TOi-b7r z1)DVd?+tf4&|SrUq%<_8jzu#RSEY0a$vlP9@AL%h5#J-Ba=!Q6fw*XHAZfCtY1gQ| z{EO?za0p9}TBzRa5$Ml1@vi$tcU#PXi(LG1LFV25wU3+|I3iCJGi)T}^=kI#|NT>> zXcVwqBld)EQ6io8SYLG4BlDm{KGVpVQ}u0)a1Y&;dN{}%*N z9{$2JDu?8s$omZyxV&{-pbeK6emn*@xGoJx+3D%>uf>}6u?wGRA4yg;017FfhC_+0 z-!FQAdRxTyn{-lTAJF0fxK8>_S%J~>t%1bDiIpLF_)FGytaghA6O3i4N%EcVg-M&n zqu0s+q2or8(;EO%T#XAa)^LF=dTT?g$^Ixq*44irj64;RaHMol9457^F!h5KSbcS9-r_Hg3V)4X z2&i~hK<-GdT0>o_97@1_H5XKTw@_b39w^D3=W+dzQEFUo9aE*=S! z>R`HlIN`m;($bVArgE_sK0bc6;~-Dm0mf|gK|F`c`u=;T-Xkqi*%Y4lOon%9WFNab z=)sZlV)(7rcgKxbaqcSP;keg|RZERW*NiH3;cxgA@$~|>pM5@+IAj7d6(uJZuN~b$ zL%&t5@YLR`5^jUXRgv{TmCk|U-4BzRm8Hv-yb6bYpNQ1U zSZc2JiMaPc`{N2X_~NJ@I3f#ajarC}0)%B!G>?eib!Btp0*H7Cd935-0iU4oeQcdU z0|rn$`~dHvMhMYmZOH;=L@t=J%4}X{}TDjnM z((Z4{wig3A>JFWEStOHve~lq3A2F^w4oIO+^Y~=vPCRJ%4nOzZDutrkMqk; z5}K)N%tAHDcOhAOadAPF);rwk8A2UO(tg*0IN8K|{Qg@4(3#%f&qIENLATl6Dl(lJ zKR1liLA84B>v&I0J83`Nn2bcK-=z$*@LxAP=h=r&E?64u8t>?(&5w6&X3gCR^#V_z z#$;=kKV3mJ+clqt)NSv8W6&?AcXrf#uTj>%&$-eZtx0olEqeb~fniB_xWk-_uHApu z06^XYkoyH3g$QNb8^|ui>v#E1wAC{9#U^Ixl}2h0fM(l!mv2hwKBd&Xkmf{RwBIqc zYrdPfX82sWj8+yD8TRgOH^q*Bt;noH>-g0e?F^ORFr$A?o_idy3WlS^Rm&GdjolmO z*<}|?^efV$5q+lN0e0Pt^@s4>?*Q0D2i5H{xBH{J`NX?NdROe3$1WMvey-c?n*V;3 zjnWWi`P|#{ZSXpSVv(}&I+%OAGt!-Q8UeAbbli%mw%-^1&DVMZ4ox{M;^2PSHA{2@ zq`gS=mmt^_fDYfY!(}pm;k=Umn7Cg-7uO0&gDKh3`EwVCxcmh4DhI!xL3NvR-8MUN z^MU6I2{ceSU}x(7qBXOZfFdNV2-sdcm-z3gs>uM^1#0f`5}B-}v<{uZN%?~|xP@4u z$n;u9BYok%?ZWOK#f3YykHKMvkv#X|zZdzIHqCYSTd8;ruQovRjYo{j3DAdp+b87$(A>BF`cq z_H#YL&lR3j`X}q-Hh$a?x89o=`*qK^YGX=6@-Ga4)}v|BK5Y6Mn)_wUP{I3vYAWgA zzS#q8avf%Jz~T;y_C3fOGl5dpLg-9_yNF(@o6<2Y2&L2iQ$T>)A)p+W)i!Z|Hm}oA ztPG(--7W_MqO!Tj_yXjzG*TvLj>x^b(*#?YJBZ#vnG4b{i#D7>$vQ{cFoj4d3efS&2xQ@n0`u}4((7edwg|)?l?9&U%RODA-V1ccB*~A1U9ku>hnlOUWI$F%&W*UhCZ<{LZpt&u)M8wvux( z^OZuVuKjsa@hRpoL%{8qi57rSXbz_^hvnTb5r;xK(F3DRe)FZ$>KP_~Xl0fkqJwT% zh7>QHAd1S{5@Ii-&+ntp@-earctVIdW9Siwv(!Le${N(GGB?M0|r3p8=ibZ;^Q6Qr13i#W|t;yR2cf)8pL@sEdSm9d82f^ z!GXOgMq0JV&&NuOAW3+oLeb}t&oA)VbyoRrfKJsCrj1Bc6*2CuvP|~925gUT#F12( z6j3n&N>X^QNR$|Msxijz(ITO*eJXhhdaa&56_-5T)8I zbq+>mAf#RO6f6Oq)OegmGIh>AefEp0*xnUMblqMOjOy>i$mP7dW57EUSbD(^t$p|6 z6_-BXQ27)yUE2ZFas3%9Bmw*v^NbPBWq_WW|=AbnDxw#8=`Fn z{&Qprhd#vmIXn$GZ>;-WNtC}|R;F%WzHe3XwU0ZI*r?5i8^%`VCK-L#9U~U zmK$+vSXlp0a)21|fN93-L_Z;oLFbUkFXjUU zsido{8res!bb5Lt-0iiw!ziGF(sWzxm^38RrWO9%N2k3(2qN%Wx$0aMu86dAr~lG+ z6$0}VQ8taQU0!AC{dahG`Nmq5e!BOjAa}K(vQeh6s>1nA+$TGph$`w0dsSA@K=JYk^@wnnO1c)caYBekv*&c@)c?1JI-2aO6 z&ttD=&j{%4gq&HhAK7%o?bZCx;6)tNAo>keyG&qYN3wltg?UFA~B7 z;y~?fX(>qG2EZ~unn^mi1>Hbh!GvjJmpS+UT~eArtXOTnO7TL(L8~nxkJDxHd#AI^ zuplr1z#ItoahbF_WUDR5)&ccOe`CT7rE$1ChJvzDM40NTfz@u^L!JrpY3OphXma%G z7PSGTY=Z0dxRFX6To;gveOOTygoS6+s3E4=cuV^)WIFggl;`KKLLPd0inuhg#Q0Bl zCD8*odU<~dkpWQR-ZFBb$NF_Jh&J$#$;3I)Tlzfd9(zNK9t@i9C)%#3dtpJbT=s|I z_`9G%X-Rxt^BmNcFo#JNfwj!XiZ$K?7hzQ9aID!12Na2rXQ^1ke-k#eYh7=7E@Se> zOPnE6eR~V#=b!^=J@0Cb_44SplZe;Q2GDRa9v_5!r4x8=@6BqXGMU!gZiniLB2|V` z;Qwi>iNnyq#_Duicn;L=dYhofthCFkYC!wIO_g3@A~}Ws>Ny^# zYv7(t0?XfDbs_U46ySjrL_+#wi|s*YlQ}5bvS_;m{Tg_iu^#{a>sD44xg@<>-Sg>~ z@c3_#?_C4a)LhOM8q~n!zzpfe1Z$znv>rGSkyB7bwF`}izHzI%cW+g$wu;*i=nhj~ zf5|`5Ic*2+!!BxW<}lSU{ht8*c*+3x-EWR9{w7(ec?GP|c*4TR--1;_D$*j(t#K0& z&^?^iTw=TDOUP@>d;N7NS+hy^6d1z|r|`O+d~1M$s=34bmGo@YfpsUMrh29E{QkUC z?IZ(Qy8FablDI%eNR~o03EEkSF(~?7j*Ye$)T^UjmuMcJ#+f4Nr$@6=_V%hEW>v70H!2hX zVdDe$8Ijoqv3yPnMR@Th5CcRYjEUrEJ<|b@_-cc28jSZo772wDV(PZ*a4)Rx#$U2=qFZn=IpfcdG zZYjOjZzCC|a4KgPC+h+Y02|ZS`hDhR$C)h>l&PI(D%#sa1!z|5V zM!AliAr+4mvT#vEVdcKpY#9Jn5!X(^hi zhexUBPFNB`;iV4kK*R`bVr~yrvmxIeH@#8ck)h9Mn$uxb7@>8S2kMe&6Y~gqw-^6OiXB7Tv>AVHO`|9E4TW%JhWC;`N&wdP; z0i|l!sL%Wy1(QE$;Ny8jmne$gQmf{Wn{jF3bAG?r4CANil%OoID%0OW?)wsp{RtW8 z>ihJu5}9b|R~sxAwezwM?S`Ljeh8F;7FyTCC7lP`&8E9D2B63I?qod9{0JmA0dDwD z>*CJ=14l>_U4*U7RLZVE@26&dvEI;Xq*8Qn0}zP^$+_K+ z&r}BxZ7BHZ&mU4TS{N;CKdMl%9z6D)WxKz|)lz$Yc>OW}RFsWP%V|FXBbESwDkwda zS;6+{tdo7eg}^G?j9TM$-|B6IeGw8H#Fl<9)D(37X0n)z$c-{ z135h$NNYo=@o_|E&jSyd;Heh!c#6Ui;8(Gh`~FMLY$?F?XbuNoJ-VWx(Sje66VFY4 zglCKoR~sag?MwQQZ97DRufBPIgje6$4xuEX_>$;rc=3CDk+Gkwc*m>+*83%Gq~ z@Ob3bJRYcu3>;`rCV=PhzM;8*?~Z&e_)kZcAqg&^&e=fo@dDI=$4GzdFOif-{3!Me zoRf8ng8btmnR_tMs7@9S`FFX;jNrotr+s$FzdO?o?#%IF@8oY0;v@_%>&>14wZBuq zL%7DJy9mH6->DIoYhC`!3Twd?OY=+jgaz2wlCr5RtMz@AEXpdCq%z>xD`Ez6k0)~d z@WAdi#NK0hG<^KBU7<#VL%on=*$={y{e8QxQvPH>m@FcE8wgO;Zftk))fO#M<{rU6 zyF=0x*7Fbke;x4&%{d5S9NUHJcFt{Qn&q&--dL;B znDCP8AlaDLX8Qyf-9<)5(yX$a@6I=y-DcCN6sd~v0kHQls%{YY8P!6@j^e_@Yk-fk zNKh;Qi$j6Sqz(2*7!)txypxiFK#oDLs9ca1jUN#jFUhv_WE}=NImn*Pwkuu(Q---p zlj@Mo(VvpLGdP&##N3zbDrO)H)F0A5jKk&ya<6(o*8~$kOZX4nE5d=kn6vIKR6>pw z;H^ifw|(r(a`bTfuMw8w3?Z0NS)nwcD*Qb& zPSXimAjt!?YRUQu4J>ywh%3zATFvL(;(l<~RvoGo(l{>u@&L?zfpN4IhccmjrCd1h)nx4;h%t^@}xrEk4@7M!AuoXDe8S3^U4sDNR~zot6{=U` z=YalnfW~Zr&~Xls*@vUse@p_@NJ$Mqd2GF*-u_4z_(0SSguLcW4J;ZM$vlc*SrNl_ zk}*s4f0h)z7S4_iD0SGc!>I;#{jsK5wRD+J5KQjm{4`-pxv=o@IdxXn63W*tA}Rw7 z6YLp2;eVu$0w#&8i9s!E2{#p6toNTQI^ga0W{D*4A1F@sg*OT*Bv$?dz{z~-N#QJ- zYLoNN*R7$lFKbIRN_GEa^^TzuaBVsYw*88_^XiNai+w|^cP6=lpNwbx#t%WC&zESb^ z$t=9KyBstdl)qihE;%#1rPi9`V2NCOoy$Fv3dp2Y4bR`WIG*gP^A2(3524OGg$;a+BF2B%T^L4jc^5e zTP`-2E_%8zY2QkLrdM~+_UMSDgZevi4(PG(Ihe|&<30mjp%wOvUSW%%BB4Cl5CY(> zZoM;x;`W}-q}ltu-+OlRvMaNJN+kj4UDp?iOu(NLt=-7zdal-_`gG1#Iu=wqc((Xe zy-Q-4iwTB+VApwJ7cDsOt#>dPm<48FhN^JyFK|Y-LjMd4 zIIMteZ{oJK%pf^x$OCSiLi^~zb8X+VUtC<+kWsZ}>Z2?og-$XxukiGgWfYBjH*j|S zQ@H3oq>4=iof46^-9P4SO`yA*@Kyepmhh1{KZ{@(;nMsJ6eJQDuW$OJnexQB@A8Y) zn@8}?-2`BQGT3M)ufts7^pCY~LDTPiy42I3zK^jUg89HJ9OR9!wT&0w6El&r!Cyh= z&rwJQ5xLS^&h~hvvK!Ao=p@?#PXJ0xLhoO>AZN)sN?cwlX92?GX7Tb^Am!V`miR{c z3CWB}Lq?3XD4=4q*esNSyuxf2#tVoYaVJ$36ck$9(iGmrB}1!?CL;o~-2<_13tapd z*|vEOfEmTbN+j!1X8~v6yw!c?CU2dz`RnXzKR~#L7@26~9*K+s5u0-`@kGOWjk@pL zKDBf$Ffgw-uKyln-G2cBkYgOh9?o~ZNba(e;hJh1GNpQ$}fiEcA2G9I8hARr!gFoM7U6vh0By#~!&pf_Lv>2QjahDsK?9OW3T%5AFDI|Kc@ znF{zV(Bm0ln7}l;z_RP;gP|}q7~=#~u%Ec?59I`G^dth=RZG5PVBCr&I&m8(Ae``& zbFJMuXC<3N1U?kxI$iV5S&cMo3OL&$4T}7PT_ero%$+{%WF>hUYG?o!*; zY9))Nh>F~q=e0%20*k*g*2zPu!1u%YDu}c{Yy@4JsBdjrru`qdPY-%>_h_NqQj!(b zFW%fHIPucf1`!$BkpXrCSp=g1UphWX6i1u`0`wa5&5CSOvmjI?PIjQU|`D~f_E=s7XwU1_9D}?UX z9qR0mprb?i7T{$lCocFWOrIj4f{er7gQf-Zos;8w7D17|Cq+SEmd3(Om+|;R`~)6o z5it_R1idZl8~CeeQZ&Xng!}F3PXld4*eEANED+0=G>zs z%~d7TmD@~}CLMou8JAt; zN6mugc=VH#I-HS46cj*)AF3mzRH^OjeKDL=$KeNKz3yJ8v6rB}qS_+F^RF`TmbuJo zqX_78y|p8!BQ7JCNueeONV8XuQ^-Tlqo5Ir=ch^e&{`pi`Wi7>!5pwNu$f7Qv+# z!b^%YX$8ipW?EyJ2f+GoZ{SX4TL2zG8cA;)Pquh$@G-cj)Adv^QJEqjPsF`qxWGo|D z)HE_Zi|-trX4N~wZwnbV)5Ub*i@;Q*zyUk_d@Y*>S_4=9EkLu$IqLEWBYStas2S&#mwm(D&^3Kpo%e^x zk0dOlwn)1AArj^+Q^orf`Rg@!YZbV z#vQh%{|EvtI@0BqJay;0(&zgP*Ce(?&TBM+?%(OJ9%h$#0QOxHu;xqI|AZtUFZ=dj z)c4T~{-Y|(2)>u_(1OeLh_cZNX+>`%CGlVzXuDZp5%2A-*dZbi5svLA|3EGUjGz_* zU&~+`i_nL-*-QxPlvEg84Na&VF|9)y-s`Jjn0Lg{twteoseZ1oV^r0-$pYOLmJ`2y zli?4HY56!FMZVk*sin+2lkM`yq%R&WgB;qntHhWi<4)1^Hs~+;9NXPgsm5FC7atzh zYZ(>D-F6+c#_1k2yBv`B1z~6gH_yM@O#q^+D-w42-r?wA{MsUsMrz5xe@R;DiR23zQ$@cZMkOwOB0} zSaj!hHqHyO8=1P3Nu z`vDk4{P}G5J?p^!5Q|RQ?a9}wy1MO8e-z&RR11Bjrecah!0+m5kII3^2Vwg~T&PhwL-?+PTNv=~YjRmoI%S99dh=SuJuNJvfruNL-#)HF>d2loJiN} zmY%CNZ|*;yLtz3TQI%2o$5%?h_{oF`TzMnm>X^M><5)H#MY0 zk1?^TgJSTE$?j%#k<)_ISVLl1KV34ekXpX%yBG;5jSSk{lbJVPkIbL1yY3!+jqh}b zQp!~hN}y61(s-$9Wr~{AES}^XO65vaby3!cHht}p^^V)DyoYpp^NN=ckP^71(|4=3-S4C2bTSoQvM$w6kJ5b z*NK0JP0R`=mlVxSmwn0iM=PI2pb6x2r!j#Rx_9~^Pn{1Mu05QYnl$Qmc_$Yv=$wC- zHD9|r%xE?1topri$k2suYbEqf9WXWC;5DwAiuks3;cv|4bV|m0{6V?Y?u}2T(?#sh z_98w;U#m~FAb1;q(yZ*MvYD+8X_DV&=s*3I`pfBL8~=mgn&|D-%M}AMX~WNWwTMm< z2W%!Ii58`kk}CP~REhNHqZ*}uiZuC1oDYhIEk!pNjkIyDSA!gO2y4Iep}S(L5~)_3 zJ-vxgf%UypnGn8bqK(^ppLK-<^YBDkV$j40X#H4FX{*lOiHuaTOzsG%9Oy7Gj294Z?w*Jn`? zwP+A2O?cJ}zGxFjvP{U1oMKbdTBiP$^OhMDt_*y?8^fx|O4jPMQ`XFO3{%dUrmFz4iTb>#nOf8N8aQ$c3zWsGn8=Q- z(UOB+&2-|P#c8{e>^AXION}9(-Y;;jTms!HZZUzTK+0YcK9(7crt~JE3GtD;z*H<^ zLzXWSEV6PFy1U-=<@47LTcZ@NY^oWS(cP8N#`Q!|;nPB{K`)RU9ric=Uc^}Z)XPF9 zKCy?R#oc9jQla9B7n#B*2>a@D6uMbqc0$7!E#9dw^`33~MXGzfU$rdQomaM;ZMHeq zINHo%Z%=`>rROCf_rdUUOIshU6!)CDKdov%5&tbbfeDiEZ=X;xHcWOC%-v8#p~NOq zB?(4v^BeZNW(TPKxu2hS^u9C3HPk-mJEWHE6V4DW5iz�L4%-8c=i)hVf?fb>ItF zR+AEmZ$8SgO+k=aHEr^{eKqHCi68W5)AD%DrOF`Rwu>-+wq}dEme}&sQ&NG#)IpVS zHOvUTE*SwV0XBw}slCGccf0aB#1 z9+!0{)u|Kuft8#Fs0dQ0H!`VQrK9Qg-+{mIW=(th*mNqFeVx$}>zRuEHjC{*m}1A` z0uwtO;S7cZnZFlrwNU5gmj18KSze|uiCYEUHAPe zc-mI7UhamwS4u9|D-(jVSm8h?3Vo6gi?<|)fWg{K@p|`(Gz^V4&2e2=-x1=QjUaN# zkk6+*x(*J^pqP$qW(~K71;;XWplo{HOHPnr{bI~e>*cukyOj`^n}7}fUq}|1JaJF( zr1)lSHl<(@QFVB2;y5s}|D2`%We|vv7;yIx65Cp^qAL~YuWG3Cb}4?(jJ}WoSRw~) zCrtPVVbhsxO;Iz#R+0hU;mHs?_k$UKc|HGSr*4MImCo#+4To@MwYP8b16=ITI_*3T z#M0Y3rCcuqm5kuWpQs|fGDk+HDy^o}qV2|w3I>!|InS%wCl#W{?>e2@s=YYT7%*go zKDN1hLp*qELtHx6H*dSqc!C;|QFW$=!QynN{{7EVf2dR)lCvrzX(T(cFuIpi)4_5D zq?M6%6B&m#@_K~oH`!B`W}`E@?(>b30OxrCyqZM*(>iPU@v zQArAvTu3J|J7uarz8<&^JVk0}%zcaC;oaYG$~cGl23cANS3nBr4Bi?%kDV=aV!|`X z5Oh`e>W^SQqo^Wlmflja(taEh%!dBd%Zq@S%)n44AeQ14k_#D`KF&VEu9Rqqmmc~v zb|F0L06`-k@uk0kpF$NjDK`&iDtDymIDyECrA>QkQ ze?J2L zVOA>LVGxhgv^4|fc-~3ol~&l)oA=jfs7+^Jd4(4*=KV2ohqn!5V~Tl7pnH)?7Kr8I z_2k9(@fz+$MAjH@Jq00U>>k&{-#XX(hkIlc9f3WX^|tCy_kOO#ie*AREUz6;bmS0l zwNTm@_r*G;!QIF|%Y>9jBI4zEJ~78#L`?M!UPD1~VZG%-W-V~=1f7Z21U2h9o+?89z>mz!EKzer&I%vYCc7%M5BZ?5@jCJne%0j% zcGkb;`z*JjdGsU!bH{2)$sC6x8@{(04+vxZ9#q>pdK-5xGvdvg`dWa zviQ~0Wl&`Nsmy}2P{R7|u(Z)Cm+C&Hoj*C3;>8PI>x0_P+n)^QbN3b+&D*?l89v(< zsO^mTrd4cCG%hwc1i3^tQk%rn_eLi6!5n9ZNXBytj>S8DVG<2aszpB=VogcMIy!sy ztHt%@-ph3%4t9g0{yy$)jEPd_3L&btGHzN7Lt$04Qp#cBk#S?U-iukW-~@8|mQ8%w zkO?qrQAzjAa4TI?|7-Tiaen6rikxY2F1C?plz?{aE{oUkluran^?35Bl^AtHFdoZ@ z=UD4|BfQ=0IbI@2`iQ#&eE+EechyF`DqEzo`g-!_`1dmt<^@^GsDa*u6y4`YDC_8K zI4>xzj?ein;wN5fqkd$G%N~+4NYKyV{9x&hR(3F3o%SRT&ijY1`+Utxkr-6WC}}C) zhE-DZ4qWUKVmLc1*NHrLB7%AaM3Y8!G_r9;+iB%u#VW{wYQ0{{H^C^WG5=?EEnBg~ z$!)0d@F`(GN-;KFFWW*E^9$QgL#FSAERmSj=gD6DJS6>K(I(Fw*FP1K09T)_qku?P z5yx;bBWfSyT%3lqMyFQ^ow&wsFF~^s)gn(^NAzK>&Q#naD-&2j6dEJ&rHqyFThLVv zBJKUWH&2I)CBtYAl(FgYU6eSTZ00|vH|vPJBY*b42JahI@BtSbtv0m&*{B1*L_fflwBR95NSEcju%!geDpsAz>&;i zW64Ok-hPkplRapv?P*3*_9MRvW{5$#^QJ_{%F9DTgB2u(g{4z2$dxO#-C%UdQ#O$+ zb}jEueSwY+@p0;qWBIy&gYY7WtX!x&6?827TCkf=gsQ`8?@wVfu41pEtLLBn!lwIU zG+n2757X{={#v8?!)Kat=j*d(Y-*M0C=DdA=30~Df1GV`hKsY5@1H1euiMZsWqN*~ zYfTR9)Mo@XNUQr#Q$3F`qD)0iiRq=-6Mi|E-p?iXabaok?ZUV8L@8NXGY+(vPQE(& z2t|DB=S}=Y-Zvy;55G(Uk?5Fzp0wKVi+GDVzl0lc&&n&KUeVes+vhvTH)*s?$_} z3jcM{H#aTPf-f*L~JvtM6W<|=CPH_GZu>eXfMS0mhexgR*HG1#eNZZ z)}bGv11GqKqLL$d_G$>)$kYuq*BYiIlUQG?TPIU5EX>iv8j6Xk8w>?txF`p)r2`sV zr#>EI3-Bg`P?!V=)}UZfMVx0B93+eKwc%|p?98;?h64GoqzzlWOUT%XoIj0>PYAbl zs@~|ZA-xXJ+D$nh#hQzaJoj@q$>n6xKMP;fRe4c{Z?YPbc|A87q8)635ZlUVRZKJr zUZb9&AnCsFJrH|;8XZm}^iOuw)1wWV!%jy*nW{c9USKBDbLFH83Lui>!BYPMne1`` ztDD&lA1LseboQm*?VN2-o{e=C=1*R%ZKMq|d~P5xWYhaN)Arr>etjS%EIhRl!EB~s zaL_}|l(K1=iea{5ug=77CfohwE}~H(rf%NpM7x>96vgY7nKPdCt1B3M2!>HLeI34Q z&QRQTo699|m1*L;q>E3Sjk4a0X@AefL$Fd45% z$m8rShNU`?rZ(FhA3{Ti$2j{Jp8c&CUADTuzH88`;{saJ-zm7r0MaO{Xx?>-_IHLY zld98(3UJGw=|5t~a7W`mCW=OY>;uT}rpN^tMv$4qItxOP7+BS{Yg^-9$_V=mriKKt zVRI0{OIZhqzV~30=on>DWgOJMeq(yHom7DMS=5vSg*vrHOsFBB>JM4usk1fXE8t^Z znUu@Ls&x{K#=I+O#9~|-9?|1)-;PY)Vu7lJ^8TCpjT}{JoS$PPI)?H0PFgDwT2Z|% zWyDFay={KTWO&Q|$=kLx0g;ekn+mfhd18cG_xH<;Kb|gfL?%qIgKIB6zWM)fZ6Nuk z!U`Z>#dXIFnzzo_H~-&f2$c|GB-Da8zj?ojm-MZsO#f|el(brRg;Abbm8Z*uP;=(K zQMN@>P5!GG=ro*u-ykV{3%reQ{OF5Fvta$ZQn9yu22bcZ{d_dcolW7mmu2 zcC!B9$;@c=y}$%q4y|wZ?`IWG0)s&wQVUTJt91FaijP!){YghW`e$0$8;LJWAv1}K z$aSw2wVJNkNc73Im8@-@gT#C5@jUu`9`-y%x$r)8B3I%N+Yc9CUg3Q%Q z`ZLlY@$tueLig#h05@dU{9CUSZt(&_MU7O_!gtao8oj5l)oJ52OjS&MKv>m>19qX2 z&0mf_c->p4S}e7Yn8_x;!;a%|ySo&O$4yh_sS3iTn=GZVMA&|smZw-OK56C>Mks0J zyMFhbw9fg`xDWEePPX_}OA&?(!Mpv7qh`XOT8(em%&VZhDEm&+*%)p`21*e85qhW+ zkcN3sxg((ZGIoH~GPs2;Mh$IN)$zuhF5IrKWA3Rein4ck01F)-seCLm4F#_i6{QFG zn%9R{_-`?m{t$?GO*=AIdrzlN>jZK+4Q;5tWLfUOf1(^zwTEIwvz|qaQ4hN0NtVZxt3Ht*2QLd>cP2!lRHEyw zrjlneQEZ*&EGJyCKj@MmO7)W< z*0c04t}@O&ViT9k%KFb>a_FQ2qc?e$Q-#Yie+RQ_#(>yZfgg)-NR#-6gf~i-ZpMJ> zi9F^H)wiaYhR5ZAzkF@7tNXAh!40^II0Q?mS!Myo0*v zi9a1=PF}W_q4LLw${Q_=AHw*;0PBN}EWG)y8t(gx*2ayg*Md58u{r;<5_PgR{z&{) zAW6>1WsrP59=jk)*o7|`eBLiM?}-rmn-goX0YSgwR%1<9+SmNqRuB%8$UC|>BtF;1 zZPWrd^;3lbcZf2gA90+i4SIf~9}WVUL8SW|Z=r-bZhi86qE}*3&%=!p<+;r#Yaa4l zuSH!VEbHo0jzmK~(~C9uszyiyQV|K9JH?cN7Ome|tV%TLg`UBaZHXsq4)3Sd1K_k= z@kxcM=%|x-Z%W4nv@Xi#k6&MMwo*uDxaVkK*u>`1!j-**mEv8bzBC(K-;-#*BvFLN z+y4pa*j;q9=Vt6IrmOFXnYG2K?#YDW+2w_k^t0V8Dgp;B45ND8uWHuQA4_)8ZRtV>v+btmiS^BylD(uj!D#oY*4h zm)oLYt6j^;2b%5#BqNqEocb%pHssoVBH3hF8oWwcCcAvuTjC>csgzsXYB` zD%ff%$L}(Jo-DmiPoTOQ3wYv{V!g$NzBQI4~t?2aoT0^Je+3ikAV#AEyj%tN)?@6TOrnQ-GUvIQc~a(qne|{ zDHiNBvIk%)aT)G#R>jg)B=Dd|3J(KSbiS+AO3Y6N#v0VW?s-ngv3~n9zwPe#Tq)7= z{5hS<|3lYX$3@vjU86`yBOzTwcOx)@NH-FqfDA}V*Pt}g-7$cOASK;OcXx__Al=de zq6nUAgy%c&?>*=Hj~j-W`@ZIiz1LoA?E<}Gwb?tW2oHMblcFgm&D~S@fv+Z_D~uDC zix)pnK>53tub|m*46r3ev|->TJ2k$VBj|X9tu!?9&MS;k!dz#S)jmzw-d5i`a|>sd zUXhsuUNq3w#pd-pHJkAKGWKDO!{r3qS&C{3#BERf#5j;HHlUi|IT5zkTQMDny=2^P zA@736Fv`n1uO!hqP2%x%1wNwL&6#x4rqO=HTTbAR>?W);Z8iHCeua?`tcsJQxnX(F z3<8p^Ap+(0`MU=!?TVCP?YNr1aGnUp32f*S=d%hprlA|%Lzi1Gqx#ILgoWk5MPxNz zWY+u0`U*Ww#5OWe5!Hxu6Bc7PSCiAG+RXsbte>!u^h5c|Q~+zek{z$hDhiwjATX{G zT0Fy_Q&FT67xN$zj=kR%{@97e^^F!LA7ZYaE7|~`BDF@p|FSYFwgKNQzRP=}V7*}6 zcfZgLo7>M!nI?hIsM=Nb(+++`ZMxtqvI&L1h^x1bkDSCE{@hI=Lcl&z;ny1imRPLJ zSJ(TMfEdDz^f~wy7_zm#3Lls9vU>Z69st|wqr zo_tA+<_CT-X5}O=9JOA%O&A1Cut89DcioalDn75@#U8Tq`PzRX5_+jw2UBw7%_B#h zrMab5Z+C@S@Jj}Ai^$mF5WcLPqo6TU3d@25i>UqYbS^4A0%}RJm}-mfDN259 z9Z|{Lza|Nt+uD{T0w(L>Klj9?hC=YIlM{9B+anvMVCI?Hs%R zek?Jq-Q8o$Jo~K;yxBZZ?irXH|e;O{nrz===+|#wi%|@+stj@Vfsz( zP=Q@rYO$@qle6{adP1f_*5Y;1!^=h!-_u?C6G;2?TNtDLztW53efpm3!D-e@A1iZT zM4Ee(K#o5FFQVI>)Y^_GR}ej!dCwK9Ro}XB_mceIP5avgfgN6C$L`(}EM{!fDI4L# zt&N|GPopLcoE6G?)mVzC)$U`_v=()EqR!0ZA#ZaP!drSovYGCm(T z@sFoEyaE^UpNOw-pIaVmTdK7vsGYsyk2RN_2eTRQj2>5LVoT^} zfPPFdpZW)Z<~R|L$33fZwqtAIlpf$Uged;f0Bc9t4SC?ko53Tq zE7qw!-fg_2Oy#DEf|-!c@QB&6lhWiw@)LiA5FYF7*PeQ`mVB#Tr{~IN`qeFmk^%Cj z{>l$0%4M z{T>oKAY$M6xnv3}1A<;f z0M>s==hFlb>Jp;H6G=hC6bI@v`6$F41oNi>xiBIc9$zi@E6Jq|njEu==M)%zarfY= zj-7>BS5T{dZHI5_>GeCA27r01W}HNbEct*U9206b+!_73Jnr>?HX#R;{Fqbs=GDRA z)g^IBG}o_IVg%cBLP538lk021sxE*j>D}c(z7-*AVKlh3`C0yq4SC&1fE6}i5o+|5 z`rl2#0(*c&NW#C{B1AnxPSBR~;+NN-6o!ku zPk+PUoBzfGua0C$C1$z)t@6vrMwI0fl>n)Bz!J(`ME9h;_sgypr!ZMh2{%~#vcp7-_gS8F7fX( zdiO~lC^b|x9_3P$?o%|F#9^`91 z4EsK@KFGY`a+F}f^Q>kMc##6QwCTL$d8-Yzn-2X6;9Ur z*007sygDSy|L+-TQIE3Wpxqy*!TzQ1pNrdWrG|}?W?Rt|_coS$Gv~C z*VNC&zlW#Oi*_>=+dmh5EytjqClu^RWT3kf6f3DsTd#g|6(=RKYOFIph$rWTomY6X z$oYs^0e6EXV&M$P=_tY6dXhrQdwxC`eX zP-*WV_PyA1v%(99dYu_?D)`jNcK}MXCM&R`98va*K29>{Rk(GtUewU5!UjzGjt>5A zxHFGF79pcRn8n$AZ6Xzewfy0d#jAzksRf4Ou^sMTtW!o&I4AQw-|ikzU8hK(2pKzy zZxa=CnE&X}*)yDcG*elww83H}&8f%{6~(U}F~Y2I^5vL2DR2{iwG3?>hAfoxqfdOkU&!| z#ve{=QI_*uVA4PNnE#nlJ}a^CW>qjlQ1zt&+q)z}c@0$k9y%Sy-J30#_bqP?KEmKq zRCu6(L;dwV9JF6qOLjH~1;*DGd!qCzF$0xDeO9OCf9HiQ_sQGikAOoSr0a_WGO?SP z^v^q)z1o=G*VW2qm9$v8a6_mmP z&S)DolS%zCSaTLuH6#?9-n`Shr#HmB(H{E4VWH|2P$eWeL#5VyVU<+YHq+Kp&N{LD zDpF4$|MeJ-#!}Qh2Zg}n=JTpr!~b@-Y=$^eofsm2+qJFAvPy;Zv`<#*-fvxL>An6? zegpx(p1(oCJm81eW37rz``qc=g(;vatV{l`6U<@2o>5aYcQQBUL(!<*Gxs1FIk#&G zFk)CPpt0WnwfK8Ybdl!g2VK4E{U-s-zfKc+*d7y~)!PVH%01#HW5YI6Lxnc1pLu0? zZ(s;1nvg@~3PCy4vH8;9dLNWL6$S(yn!JqYg9o`8WMiU0a5Q-e-S;D| zda0~Z!y|@`4seGaaUFQ>PkZ6RjVCuxNKE7Jt_7X*woenpj87R5sHO< zS*fG0GX{+svsq`vPL&2>W+i*1=o*v>vP|UP%!}n`ZLW zzcWDwVnWo1!x?H*V)6ZBG|H|V=*dNF@20aK>494j*Yr0_qOJsh+@W{OqoV+R=_;VG z&VQG|jOu}ehu~VDlIL+kh&2ABdS<<<7-w%0M>oS4()@pG0V0HDWymhHWg+I+R4^a) z#)U$z4zzS)DPbwrDGuHw;Tz4C-)b^;p)fF2>Ob$ZVb0*x_cHf&1Fk6jwmM}-fg0FM zCM%YSvGVpS>0yeX|SC*6mo0BAc)T6M8j8izveGW{VA3!M_jnL`*1GCWif#g zQ`gM9WjZZ|oBaU?3oIMi!KXXJwUjUQ=5t7620RSb3TPy?#cchSvAyo-k(!ZhT=M2= zL9Lzvnm18jhM0s8hN8km^{F2^49}al5hFk+hIsZh!6{R-tLw$mL@A*XA^N$qak6cQ zO_>TiL0A`UW~B427ZpSPn0PcDcyA6qxu9$jo4-QYB>ht~^t^(-7&pP29(nTU1Www| zP#Ncpmb$I25z5Eyp8cBe_$VXJIpq*u^KK>ULkx zt!nrh*@gEU{w85{R<9b@a5Y&AZy-}n-e}@a{UFGgMXl5ku|-(z9^S^M1Oprk3X5l3 zswD}E4~E5)Q6zGqjEA9>+> zJgvHaY~E0_Ft75&>5IA?%p@~f>&ii5bVhc1&P1aWI;IlkL&{rzrwL&=E!kO%VL|E? z-8&~x}HCI*iuyjJt|{TY|F(|HFC=d$lCQ48F>Lp?0V4F;$OK8FH``DU+J z(Fy8}O{~ECIHw8?{M8mfM^KyU--wPQ7cMnl2unKE5xkz3gs1{?5a|NghCz^-TD7i# zOZ*US5;}4WgHbkBsSvBx-oa^afur*@y9`mPWoN>SXct?9dx{_pVpW(|dqt{0&u;!B zhQN!BXd1h@nK1Kt!dTFjg2YT@F!Fb~=WxTA6m!!LBaaCnH~$l!|HEXer-qe_+@EH{ zqE!gc$%y9S!%P-QI`q{$Ui+b7et`JTfmmv;kV_1$ORSyqMMAxWD2c}`mR$=bw0RxD zSe}@n`e@0JO@R_bpTz7eB*+L5%U?$ZVo^XNKK!P}InLiPTpV#<)t(4dIl?bxfHMF4 z^uys-vOy1pACJ)!@Gev1ueZ}sMW^Q7QC?RXt%0NxVVXfJ**C)4_tPlEM~K}>>}ZRg zRhmvG=>{?J#t~ ztq>(6Cv5!r35e9?V-ean!Sw(nPEd!}!cz{P2(>U&DsDh}3n(?nv+^ci3?L?|LGpIei}Shwr8r z-6tnPbKw%EmNfl`;cHz4^a2qSC1l}8TF~_KBdp65+Fbb=L&qe~$PyH4L#QN$?yXa1@bh*21Fxm7*aucH3carwY%78(p34R4@qFdh z+4Xvk6D2IE=LIxx$06!seTEHo82-nk#Vc6dS3^p3it9taok6hRPV`YxVLij61!ZcWk+0Qlb+bB~SIkAW;iuam_i@o=hoE04JD4DS z*`1uWDI^RdM~xXk@aO^t&XjJ+Z9qr&<`;X(F`h(Z#)b&Wfj7GDwd{>}ji))kVCmIN z=6+W*iyxZoN|2%jJ?pKMEmbJ>bgxJ6ng)kr!sp#xlWR-v1 z3_$0)4K62nWG00b|KHZNgG>-TeTvAi{pDnrI=UnC2EE5hy%zfh#B}$jBM?F7?xWsa zX3PS=aLHKJ!LiE(lQxaEHe#7&#AJgTX+{mS@2cr5wEa;?!2L$EuNgNQyk8Dj_j11r z(!~dfFfI7A^2^u3&g2X`RX)>(9>YHfg)`)eX;pUp zjv__|9xvQU4{)~4>G zL!u737mb80jg|itPUZ(jubha&>u25hZ*8Q|_-@CzpRtC;;mXuHE?%jo@On&!;yxCQ zIGmDznRa^-g^?pV*)+;7=$G|y($ms9pV$NsJ{F@Q@5;PH=&v?qjx~=1!EDlo9SW* zq_NsEh52=(b6bypfpWU-&qL+1MuhD799#+Lp(_)sn21iXF_dhT7jF6Dshz|XeHHc> zDZm0|J>CGb4Z($4NUG7lFVP5(VC1mJ%}*@v$1o$L!o2^RB5a-T&Owzk|l$0MS1(28h^QiFfqVbEdT&Thuw+ z^?Z)skQby{XG5a`EB5AvWlhUzf^UEU0d@OO6|5$p&FTWInSWI*WdNSq}FVnD?*d{Stf!xCbYh>>(*VcUudkh^{~U(m2@ ziKHU<9r9qa((HMBs>_~ojnz1D4&0sIl&j#~gBTW=j3=T5?nwEjyF;K7d1^@2Ft?Pw>PQyuW@fnnZ~eT>#BI3vN}WiTY;cy}X?)#=ZBsUYtPd z=+_TG(>}VZSmLfAFZNsfQG45?<8|H093R_5&1E0pxkeN=*8_Mgg4-uc2|-oQ-l^%=>#y)W0CIzff032>rw;56J= z_(Ar|)1UwByzhQ1;PMFMUHsqH@H};4ASOrB?_`BN&-N{K9Cqu%lW@D4qI2Ns!Ona5 zwa*mN|HKh5mOcvmx5NN$9EH`Dj3j>`5}oSj#Sl@c1tZrhAP$Dihn?-vlj8`>auj2o z-=GpODRl62Jfb!~m;(Syv+>GS)y((2Bb$I*YiRZKp#yt!we+UlJa~~Lc+ms#EE)@z z2lb+EQ#+rqa}>qlYwQssbN3a=*huC^e&bVjj`P12<_vYR31(Ll*4iWLH-fsapNf7P z;Rt>B=g{m2nSGp{jX0a)t?M`k>;R^!>j`DQif#ayTohy&yek&SUO!kfSg92wgca8H z5WBbKVktQC%_@=P_=i~|Xp*yey<{(~o>s!QDktLyGHPx$CaW*{$f@o}G0$pjBEny> z#1|YIhvkY+b3Gq2I8=$BKFSHGid9O5=o4Cz22PqdZj)yJhxz<3T+1D~vHbYbPTdoY zjfvxK=52Ct`@WZ4l#8*c0H_}{lF|#5P~z<{|5timF>s7p949d zRhY`{Aoj@XS;Q;}{y%(C@xNImrvT|LpfT73)r*I*^E+4?&=Q(FBhY|>kd)yKGF}BI zo0K*aST3KxD_{dKJpJCj*`3eNQxtLE@+D#DM19pi)3WtFkuu&Nab85R~a`K`7J7U4B^QZq6 zG5}D^03K$xVsgs--)%-9SG6f^(Z27-~7gHQJqqNsoZHzkGdZ`v~P9U2K? zt3!U?^0?FQqQuoEogd!MJiIzLyGRkgjYp%M?;xwP=)3e@Rp`ZT5P%Lt(ms7}Of9Aq zbK9rMTZCUcXpzZE2EBeD1Z)U0s@kd!epw`f{X0Z;6fB!0ofAHT?de9K8LogRc#b3)kff$vq5*Ba`A zFz*B^fXH&K_rzU~y4fyD0ml9F{m#v_qeOYhz*21#jK(1dHP7l8eRfj?(XRKe}`1AuKXQ zeHp^lp|5;m#EtKh(Z>utxP-l)@Iv@Szpa6M&_+<13v>Pi$QCeP&|<87m45L{VkOHE z7;|hS_hG^xw!9d=&zP0T8jbTjqsph-8w9H<$6SGK*&$#?`_&M0v{FMfnZcN9wK zuv`JQn93Jd7p+i0)CMw6hYTw9#;Xr=&$*r^1i0(ezGjNp(26l|f!7ODcA zN<)Q>6&xJc)CjNhN;V+b!TrnVyswxEp_5Uh;^ep3d1L)uj0v0 z?NOTNht|0Jr8%XLYW&$T7Ah_(FE}i9!gqyUjDXT7M;+1YyuR!(b!z4>l$07CYSrg{7yJ)Z6O09$+J?Zt?3Lt{4MplsmV-oZcGqDe1Q%g5T?~Ny?@zJB2=nQx0b7rea3tASmh7aWSFY_@Y zE_RB`m0iH;O%?w!$xeWYIHbFDoPP6c4M4kxVd#^VL#&!hdAcd(dKUFqgg@F9Neel7 zpO%4|f#{-VEJ%IchbBjj)-GO#B{^}eKK{J;KqelOWsSpYKJ4Vv-TVDHG4C3Wwg6pS z*hy_d98I+?ORIp~<8zG<8{IHyC*U-389u;bm{QmQCIQ%W<2=CDFBqG}41Ol0^pDeV z=#IFz46iK3+avyn`c)X#kfcBVy8zZbFy#@nA0>+e5MFz#=8kfNnCmW=7;9`3 z`R!;We$HC={;G$0e;5BQM+KX|Ydo=|D{P7-+i9VLw?-Vka3}GB$1yWpMjLuId4z?lRs|B=i`^2Hk+uYb$$>1tYDMpr zuNc_wyUbp|=g!a@jsYr)#jQF>u)G>?Z&i2SdCmDG^(c%}r;fq` zB=aD%?I}vcdEfp0YbhI`V1y+p^PzrKVH39+3@(iXZ{6r7kvydjDTOs=GV|4U5 zPtaQ|fg3$e3Z=u!YYUh(KAKToC*ye*z&@693>0ZB0=}sZjB)PdW=F~=9RJtKu^2ip ztVyq72=iOR&sW}@Fcn7$I*67#Ww)QjdrhH0<%y*`=;SeS@XEXxd#mMw`HE%hkoc|7 z>E_-Soo>btD5OGi;LJVUIQIqhC}wBXZ~yw24mbZb!O(dj5xnx|A=$3P5sEV2E8a8D zZF=87*iftQPH{5K-yd@Bjx9xL5hH}3>3 zn6#h{{$Vz$Z@v(x}qOa3(C z;cY3B$2|HmbPvdQ@pm4TJCZ%G0*P|_DhNtd8=Im9OX+v{%vW;5qR0_u<&2(2ymz~5 zZV9O_2Yg;7AtiN6PG(%bS^wO~l)(gH9!Rw*0F<)#kDD;q=4kvsT8$@IRj4c+ae3I% zskgEtAsyxDwg^PA*sGXK)06OcUr<(i1A_Js)bjcL!6Ia;U!A0ubCartIv(JYk20b> z`v&@H>7$<1dt`dktHNZP#?)`h0~_qh)&-!+#L z9Tqr3AMzmh{PqX8m`X;cI3BN>i$_E@S;(W&wD9r=6F0S+TxMkPZl)=g#PQLH1&XO^ zi@~HhKci0iJz`@l!C_n1)(hwn;$sfjB24;uH(PrqP*#fT_C`H}G=-gJ*z6(+_ zg7R^c-ux&1rfAQk;8AoTljG>9cAL0y1C7K$Qj)ix6xz<=ghSc!)29Kb$gjqqTL#ji zvwv~m``)kyBO#uk>O~_fCHkypf0>#H&sQ9_%(_q5tPt_Y%w6xGBYl;SzTil*Mj#aT zJTGQIdC*l@NUPJ%etF=?tpnpe=e~A=$9sq|2akLa7xg#5MPp*+QfG*q8=G z9Hay^?g8oG^N&{8XO&5j=+vKqCkmx%nENUN6E33byT*0FPn*=AI}a{W!vCV(4Wd6^ z_3{@8(GFEGGtNGTEvWLf_9(ps;ysjr>qq0o>0h5MGs1 z%lOoyF84tzvLjbYS!M|WL%I!KcUDnF`=|bl@{4WHMTrBL%$z7rr$|z8Y3{2zyK^hf zhN`RbM=BUODzg7Oiu!QSS3uo*`Veb?J&=K=bhQAtha<*)$<*(BYjt2of!NPTe=ZO^ z%rd=0a*{ZX!d9)rb)ZQca}1wd2@*Yju z6Yg;TaA*9#Gu#pZxzsPC-Z?w)X()GY3AubpcUqnH16oDnj4w`?>ZygnD?~mxjiSD z|1oUhG{Fvs=Gjuu9WgV`>`TT$wVzeIQ+5Usupk2otdNM7FV*bTt8 zDgig&s0H1_?-6P*?YSw;S!<*kH15O@j5R31e~qk+cIofM&2Olb55dt<)A)U6f9T`|Fv zaAW|?QJvRkRRD;X+NQu~jN@}-XsE3D`ODeqdl!Vij3lycBc>Tw-v`a zr0B8l9`_b!N?;J4=1*FH>OMmqe%DQ7Xk2~yuzx9o%a ze4vJFURzM4-Z`58Vj6J#Z1NBF0-RRKv&HoNOa$QJ`-PNcnqAvMmN4@^slNDegXp-^ zCZ}c82KfW`o#7Q8_FQjA)c=sZW-Mk1Le-HZ$>@5q1xa}l)urk1HouBA@jRdlqKH7S zU&m!i=tu}9i(Ciu`nqla%bWzs2W0oog<04=Nxx3HV6@<6WdtLf^4D)jjN@-7vrdfT z@P7`A-?sYcz@JeYg^ssvIwdL~3fR^XKk0(@m zg1#cZPR9F80`&L|-O1`y{Gj%3-(i(b%;n5(`0HuwuMPKk+iaYF&k`i{6hi32i5VOC z>2wPUdfV@%U%hxG2|ON;PIp9YXNx8QK`am->bd(JFt*jw#q5s~NFV#C&?@f$QW{(Iv++-v$qkie}XHxSJaw?dUR>T%DI9n^c6UDSCtnJ0*4s{%YTW~WKp$h>O?>|^aF+rRt6|HZ&N~l{ z0OgCgqO0q9U6)o*ubfg))$2b;`B)l4hg*Ms{qXZMkrnpP$hiLrq!K{bBbO-FY|Z=p zigXzS$LfwfecP)_>t*#Ky`UmrlLClPZQirT2x<|BnzV!2YI0l>+`lK28uQPPJ|#cM zx#0(!|F0i~UTST>q_xC@*MEXoAW>&~zzbov(T!e!P;_AZ6Wh=xFrz4V>orjN1ntSU z&F4dIGEEj7H(6AF0N~xxT&zMYwpKgt`2x-+^P%Je&y(T^#E#lqkvT?S55BlH`Gr>e zbnOg;C|2J-;C3Ch`OCrpG(szE#e6FST8@rfRbWbxal<664lC+2M+eo=dZXU?Euaet z1@W7-046~F{16l^!HltMAb6VFux4eF6;Svb9@_s_V_oYKs{A|c>riA=?QnaCj8_$~ zwNOj|$#0q1eRa{JTq0bz?3sOh>))#ja3pPGnc2L0HLZjq$ziJwFOJMSNB^6^_@_#QEY06uV zKCo;Ev6uSv@`6S~^hXsne_?Jv$gq}E#J4_?AGaPab$TGlPaQFSOTmZCjH+MfinPJMrbC z9|cDy69r;?=(PV6RM=(wVz$gDZ92(jiu$wTOnRhJk|&_rf7>GF0(*m06@=e(t&V4T z+9RM;>My~j=|(^I^y?=9*4g1l+E8;rjSZD@I6dddmpOVpXG*e_;=S>lUigM**zE>e z;P#L^TW2lw<8RrwiKib;Pstx30t2McjSb4I`U0jZfS(I5d}`-j*;g|5pCh4hlEixD z?Nq=gYjKH|`C=(2LJn9zhCA8S+t3ukibeL=G~V163J`^Iih6ey0H2tlVpLYbX0U)M zM6ar;;qxBL9l-!%UG<-j{kiv$aDyOE9v_nx7+w~E*4DQQV1Q-iU2n$LPva+T&8`>! z9N;&EJtKymaT9%ML{6#quyXuBBv|j)6MP8w zA={TTUc(EimibSwebVCl-v})duVPrP^&RQyc$#VM#BYpc3D0H3yz|WJtIjWd=9Y0j zE9|K9Z)TIBw_Khz{=tZJ!Kad79JtR1m^j<)lg5(G87#1~gO&@rVj;KhsE3jtN%y~~ zuETOg{cMI*N#DpM(z?i{grKX{t4FUe`rMkBRCu2IE#aH~7Y`C);E(VDNm$V6Z*kr8 zWL;Q5=T#H3E@?c)sOSlTxHDBQ%Gz#3V{1dqsoG6nlFr|6wgmVI4wH`^|%|f%&*WTaXfjcsa-H z<8?F$ubj^YR=w|QVW35}6mUG;Vp5s}Eyli-FP;NjG;0#DaPMFxZ_IjQWWDI~A2{8b znhsUaq{2SiosB#@+ul5$YY5VUe!=ACYew0X$87jCvD=VI`EEBh~!TA3MQJ(5ro6Le>Uy7oe*qA53SmvPSqX zF<$uB&cD_G(8?P+U_(&}-3K!RR7BSVt<_#4X_THioI}as<^#jtZ+De=^$M^!IVU8} z&V{=8?LSzlFuc*lvPP!**mYo6_!ENvR>}C3TdRs&BFsbFlNaZ>5S99#!=q%tQ>cpV z-!aPsqEcyT!2bU@7ZRPOEzI%eRZeNn(=IezYe*o5ktag2z{~Dxbfg5BddTBV1KO_u z2pLFL^56yjQnCFKDdU)`W|_&ffe#vk*8(`@I>Xr1x>lkG#@QRY6_SXD`v{4pze!C& z@?ISt865P@jAW=CAE??|H8{u`fA4q)hk;T zKh#?2g`w}{-c~nv^qbs}TsTAC5y4pC^k!Y4?p>5-9fEhX$%$4EJz}Ix`wdYb~=-~O?k0)QM2jk zGX*UuyyGI|qBPbCv!dS5NtAZ0A9yOrgxp$HUj zmjTeW*kB(DdWgmkVf$~tk6R(Lcv^ZNAL2(ydDrNv29C^j2)yg=laWyd;&WMXGn(kz z+69x1!>Q2Fl|Ch^4?ly(4=N0hjEG94gwH?|T_Hm{ zLs<*=&p-erNs9<9fY0SGwzaB^?EbBL45dOz%+pd>XI0NoIj{r7QgRAZi$=)o*zIqf zUp|ZQ949#8N;d7GI3y=C6v8yA2JfEm`GHpPF}1XBm2;5%ag$vJwL_N#pEFV3R?v`j`iOWF~NJN{?2zJG7gLEXdU=;iQ=6xbP_##>QD zuTy$zYMqF`m!_gJbu9vVV;j^}1=V0yB6WI+U}1ppRu>!Qw?AjGJo9ZTfC2L24437n z{9oLXOFKaZMp=MSliLruodp88!aQkzTmjJsf&wKBe#F+AWwUd12?H2;S%>Q~9lFnb z)DJqBq6V6Oeeo)=ik}5=Y{mrcXMc4Uqj$7NdOu{K+hTRhd^OYjA^E>=7;@&)kQ$x+ zlkMtsw2=kT5!yorlvrvZS7JHGFVBUCS&U;stCLio>>Pi5)che8)}RQ~wxWZez~UB* ztT98v39*#dpO)y6lwr?g31D=`5tI9VFck`YEg2Cc`YHk8`NMwAeHN#d{n$MyD<|cY z@IWsWy2!ttQhXaVi_Y9UVlaQa7E5O&sLf3cmF(r34BJX^es?Uzy&lpv{P!8vtNq91 z+-glJ1Is@M{ZnDYp!RiyMWrNIKr@gA5PV}+4Iu$%X87pe^aZbW|4mfxSj~B1`-K79 zvtK}UKzQe6&pl(p+e|9L_fZo%9@_>pbpYVTakhxI=XDGL1tRC^2Tvwk;rYH#VEbZN z=)>g@`b*BoNnXFvbf#I_XRXQO(e&4Pwxa)HorMBKz z=eYPv1!`}2>4$}^lzi+olrugIW0^59!3h?#`nH`EmaYm=GKNrzy5Y@l6XnFAcC1ClgCo z-fC^%kas+Y!k`GWh-R;!t9$4x8_gBPa`faey)1lw|0>?&kfj3HEPNf5mS~~4`y^R- zj{;>)C6ov!ecOz4l&s!q-dJuP2EOA1dmRGugTozadIig#n z7l+sjcDRmrFNG65^1sZ|VlKH-%R%q#C=6o};`})=Sl)hb$&*l+3l~ksozSjtWDm|A z1+%*)G|GmhcqE6X__Fd>q=9Smw~MwMh4rvdS4#UJeCO|^0k*jAjQVwB2JKl&ge(Xl zp+|#}>V>qHOL_3Hj$x*al=H)`ceotGo4KPlp8@mkZq8TcoSK3mEDFSG$^H52_p@D3 zN#1JLJU+rYIkc1^T6iezC(#jzxgex;2YOnC_MM7d_C>)wKsT(!cz^p?vbz_@FH{u3 zJc%Cvmy+KCfP(gWk|}f~TyUt({F!iT5H=S*uuM%DKsbNvuD?vSUB}Bwk8I;Wy)k;M zyoy?^Pw%)!$c+=J>eC4qC!K0_Nbgbdq7SDi)tQrx#t12qokheaYH5i4tbb>_&^1#z z$8(Y_ykH3DrF=;&u93Qwry8-cCR7W*QCXTxgX-M1I9vt=y-8;T zGb{(*a-Q4L{hMgm7-*lxUdNyvjNMM#HcJ-4>826iaPrF}&1(~Y9`a6K#*QHblE5}0 z%g>^6jfW&)06fHen_~(IjuJ}M_lR)O@ZTP{I#ed1b5?LY)H?22x)m~cghR?30%gpQ zm|aS4vhSZriyW}vXd>plo*Cgt(Vpp9q|FVTWgL)D$R9jaxslFsAW5wQFY~DWY0~;Y z`;h^Qxia0(Yb1&i+`#Vqg-zo>5aAw@KKK7ms6aycz;{-M_m;T)lbhivQ2^J)M9JRQ zu~nZ9_^zs`O!{vmwg3C&FOh5*-nyh4-G??B`0USHil1cufkE#8nPYIIxxD7znP0_& z+gQNzK3?4zl!jK#2<$n>JO&P(TQ!lfh-SBRbk=J>LDs|Ur3Je2@VxjhN z{`(}ryTJ#aEccygO7Z$@0D{^7%bY`gwg|E$`?eLursdxlc_H8X!G&SzKlXAiF}Tmd z&u?vR$WL;}FC$5cUZ# z^nr#Y?o6aNr0U%eBm~0rbxUBiz9;4_XlSyN>3ap8J=&e~T~e=IgH<>=SBc7mkmZFx0!=GX$wD8e6_aJ@V?!z)l!3o@@lR>%M^=Q!4Paj6VIAUO<73eg^b3;_y# zsr?H2t_3v5^us?s>OSjKP!IpO(sa~*c(lq^pw@a77!Z3G=y?C7t1;kakVKmKFoh*R zuHiGRVWg4Mwe7oDrb~fO}|uuHVDFbzGc(X6+G}x!s8gYemVmqRe-tTWE!@CKh-*O(5Gho+Vt_aGI;R90X*@xZBnYh4Z=n zk1a=k{rSPS@fUDH7JdJs2?G9=`K(X7ijfM8!|bv+`hQnE0>yH3#(8PAIDl%};JAbzR)GgUDMR}8Y&-M!ukhRAH ztV+n5BEwETpbunHzPmHJx&FBZys3hK5Hdn{bds0yT-H08K6#B~o!U(CQM9smAAHC8Z^pbe!s%jy4+8)i$WXcq4Py z%vA!_r}+zPE!?GFKW-8YB0h&E;WZ``N7y{Rw}T|)$WZXm<&ZlLBNuTSq45J|-}V(4 zKx)HoCpziGbdycmLV`Y#v*vkQGGQ?vfn#(2Youy8L3d&8SRf>Hk?W^$vp+D6sOLs1 zcUo^FeZ~d0aVmIU0?Qd=GR5_MuS0?Sy8h=C6_>}LMp|)bu&H?*evG>1bC&@9y^F2> z!ig>(CNA(;k|=F7?TKOu!$ss2(TckXNd_C$IZu+sH3IT2sb?PhWk&?40QkJsM zTfa%COmo>(6RHCj5p1|`Y#gXE(pTvC@s+wJ*qvO^&x!asdo6$A+!J+NAfqJYLwIdA z9}kIKoKW`>NBHE3+AnlCVhr#()Em11SavY>_ARo2RP3CuZM$)PJk^IR^1!y-LJzA+ zd+k*nwQdXf^A`(|$EXZ{QsdrL1;CAbSJml`gk;_ksn&rKX3!f7U*Lzgz}EK&V~pW= zwddrm0a=(*NP&|_sTPIf!=smyFV2sVqc6dX$o?N^3Y?ey{dBW7wjMd zl){ywr{(I6VV3>4UEE$uC>}wai7HRao(W;0YWRN#M!5_Tk^K)_qvdY5GlEuz>3XgAA;A%g={s<*w^cRsn>k_fgSIm71#toNo(X5&CKDp6FsNLfKEvnMjH zc;ex9b1ft$s|fG6>{wo;E0xKG2CYQ57Vg6e>rU~B|ErM`(<8rqq{{Y|DbUm`wTU== z&|@E=sDM~>x%ZMgykV0XNX2Sz>g!I+k{uP_sSN6yMCEH9cw9hJ&8kWUuQPv+5DC<4}RIp3Ic}8%(u@%(*f{-=!UCL@s+c4X->OOA z`Z0H&C-dhZ+%%c4fTNuPaVlN0>>xf4*)mT;vfx<^6zKESuOVfp<@u_b!jfSmRXtR#RKZ9i4w z48^#cCiX&(!cwp+Q4ENIm(%jqHvOhmb7TloB#p>ucxS))Wk(k#edm4-_Bu@_ZCM2= zZNa@Pf@`TTfn3CZfB0396yg6tgiV0!Mf9W2dQR@ zMO$H_Tyyns*eR8Fg!~(eE{V4kmd2DxBr!3RhJvpU;VYBEwj*tVFrysZ5raMeq86aN z3Ix>V(CA~Yb#r2V&QSdTkCg1I+)$Y`g`NT$wKyd%s=X|1=5hon`j{4U;#^9vQm|C= zEVB3UN$R||3Sl|~flJnPM|?JmKdeLe9X~r!%<^+s0ZlpCa6ayPE#Rl1-l)c9*^DM@ zXf)kZJ(xisV(<@=^oe7N*sTj)O?0daPHT~l4}hICNG_8 zDnEOC&b10md9Y#LJ0GkYP|om7Yv%vq?5m@qeAjjrQA+8OhM_@PI;Fe2OOR%e4n?|K zx+Dc8rMnxXyBQGa21Ps%>TiF0e`lY6&RVQl4i59a?-O@D*L_`j1tUvzVLrwQvCk2v z1;URjq%b=bV*VZ!gP^|h-9UR)IVxKtb$FQN3xF@jm(ePFxwTrD2Bh~|yr__tY0q(; z@T*urS$~>FTdMZCyYAZAcwuxWRik*4HLHy>N31AnBD!2?5B)1}7L$~6Rmn{+$#6&I zJ23J7j;a9HNpSVkgBTDS|Ll?RiKRe~9r&bGL9OQmI>vMGF$#%#Ockhk>1?jAOe#@3 z3u2x#HrozjrcirvWG|mo;F~fS@R08$jfqab^Ri1B7l(zPD;cLssY<&ZdwwN&(WcC! z(H~xE+!?}7D+wzRdyya^a>ncrd*rcEIXA{RfH7p4!CU_(^krr&;s7$#Dg zit#d3x!&_&*j7J~;<2tOdssJaV#QlGb~0aE*2j*rhe_Ev`_Butt`#51_AvLz#66(f z1qT%6RpKMu1onIzucYWL?5PLwUPqi``=jzC%~XCdW^Fj8IXnW!zR2^zRM z`X)y1YT@{g42PngB?|tnhS1&BJpEYf+Y#+48EM!K{2sW3*R=Ho{saK^QO>}t9=sg2 zaMwK|5vk|_{!qj?ilBASZ{qO$=NOuFbkQ$55OxFca8^*^=W#1rDrb zr{>1>v2ISDCdK7_8{CBeAejkB9HpJxQFA zEtBf0f412HPt06*v3;t$UPu&D5!UHHs(|dI7U|}rkI}K2#^OQIab-ll_iS*m{4Sq< z$0{;mO3^<3#o;G5JPiRjVcWE%?;ODYpb|1LM$~|0Dz(h&5utl2*)%hUYKlvU328mm z3IXJMZMBl)JUy>tz3fmZk5 z{TP(ocZUHO1cNNS!dtp6)XlD5Yw`D2XkWsmKSR#Rc6E4+iwAtgnOXBZ6)KNjW!-+l z-r)MlJff5d-fx7_zm=rCyBU)Upj%mf-R}VnLUKf{GS4K1R?3b%s4&NG3+&#(`a!W%_Ut0tW#1ag&tjr5LkP#UxAlnTr^OzdO(UELp(WvS%7{{Lan=R9D?JC1C1FxK4}EnP{Y@q<&VBJe6hOev zdFWp5$C zSPCST>S@X`(z}WW$N$Es1I!DWZ*CU!BSNDN7y<2bX3a56 zAgIawKdMY1A*6%b6YG%`A~8B@*8ZCC!A33IT~rKag8C8uFA#G5uIuQ^JD1?^`@8Na zijACtzX;h_@a=hKwMELmVVO2}z?qtFcF+IvM?Jo;%+q{_-YT&a{Q|_t^sYpY#o$0_+vX{ddvMEM}UYxH6KnH}!hGUgzHg|u8 z6j9!~;v)pUG&IYEWKQoboYCAEXQtePf}jO}5Nq zK^$LD$_w#yI)O_QzNdwXdi;z15es{cbes`T_LG`dd*Leb3PwN3p z;qmhyfF{YcuY)je`CW`-*vhI#|undnFR*W z1npyY=y_D38TP&oKxXEsECf1k>j3YJ={4PZq|~*9C=ck1XXrmW0jb1U+&9 zqDTq^pw;{bw=Z!k0|=A5xY={RkLGFq-Bqy!cMv+zk5*35uimKOmm4Ua@VD#;=z{>+ zhEj(sRmniIc0=E;UDGE}opAZ_Dh~IGf9}ny5w{UI${i8PeAf~dm;BZ|Q`OEnKZqZZ4KJ7u?SP>g$; zfy83%$ZVh3(DczyZ;^&Ytmg_gta7 zqA0Lr0(VD9DrltDfAMu7F9QA7oCDc>eyjo@9W0EyACQT4W+?`JaX&B;*B!84VQnzg z3?6^YoLLOMlto}xI{>v2r&=bZt7=TaTAJwRVxXer&jC;I~aI%Y$^w%(&W7Q(8TQDgn{P<@o3M4Ak*H1{_SIzR;Vy6)zwe+b$@)(xu6 z*C<(AziX%}_kc~o{wnrdQ{`vMgWMB>TA4aSD{|N!i?%LV4k<0x5 zo;3gOO7j0IH2+T>8jyq-O@4Ju8$UlC6)I54nS5U&3hKnWpIUUAN_{&o$2Px#uN_gg*R=PlJp3=9w4<_-}nhuPP=3%1{@G~gS|_l{R^*D zxofnDKQwu+gxE#w`)a~sn^}wB4TnkP`;6h6C)&-3Y6qZc6i7{60YW&hr;6!<-az)p zkh1n}6>dLA*uaUCxikMN_C?SBEMs&k@W9G&d1m0P*(2Wp^>2?pE}lJg>gazg4I9Z6 zGOYI4w=Ny_?Kl8xRX`5lOJydgm3G4ggfv|Q>JDlaLIHUgK+Yse{)%coJ&IcAy}WEa zYP_Vb=jz^3SU=m$*QDX>>4{jDKWx4<2>;k~W>vJ)Y}&>#!P=~e1RqR4CIWYG7-I*WAW&&^;>P3uuPxQT%v$T%-r6dbx}6{s`yQ->Jki=*chw zeapF(`We9 zCQK)J-fvQFBQIOYZvuzR*96qbvao48I@=NX$MWZj1nvT zl3*ULd(;H}h?l!jgX>sOsK9}Fz{ivla21Rlmm6qSZC3D;7~XT*n?0Vk<@?ZA-t~l# z^*fEwuP19D^HH7$baseBm;0n@pEQ0fta$pC^JuXJp$ZK>w-z!cSbF1gO-Q4d5t?h2 zM;8um9C@Sglfq2bElzp>XSqUkP#i1} zuq@=jz>I#4R|cy^1o1H`PyUs)eYNG(!Eo*1y43aHub+O)NEu|Jsz$@n@eC}JMN)rO zmLpJRq#DsGqyi7<4k@?3%m9A=*Tv-qHmJX~tTs~aRdJ@9;>{V~Cnu~eryP`D9Qe-ECUdT9W2#K_^Zsf^djr)X$z;pSBn4EiYbl|A-A((W|pW z(rmu}UPIv2` z!(UgIpnCmi$vURiZt45UFRxRJ)*E8x`74{zWjvqnyCVQgRqWkcI@xFfv+4kJl)t9z zZ~NW}84rvx{ds0eGIU+K+UtpDB|L3YU4nq`HsaA(P+b1)YJg$MN_ohOrWrwduZ+P= zc2~iO$5n#$wLSbZv9;k1$lDRAQ1GPK+Hl7SP(67i^|qB3?*jeXw0Kc>W4?`KGYt(+ zq;Y1$+bvh0VDyFRU4Uz4&dbv$JGwgF0O;6){0u&?E80}W4E_p7evh-+N*F_PXt+KA zIDZHQ9cXdmf&~hhv|f9zivAQHH?^>n*&he z{EuEzd(XafB$nx2yA3xG^SLMsvc8TUeu#qCSn3#&@6Hk49E3_tK2*&|8 zfxBC8tB75i1KvBWnZG8-O~!S|`{77I_^>YeC}jN1vrn`zGEK^F6QNy-}Q z-5&W&%o;n2xpz>+CS=cD72y8wyhpS!QQqR6rEOi%8%fe=V}28)u;lQTgRb}WJ(DXK zpk5%mU#iXD3u%Mdk1l)bG0MGJi|g+WV|W(_<=3a2JG?#O$`Cjq8_Uodw|>w2RLB^! zv8YKk4D&7lo27xdLHincg0~$hW=u#z$2sZOc{UAiZ%@L0c_l!b&ey-bFkxEcCo^Z& zB4K~DuKriq)dVy6Q~U;yQ6jw!4}&8um469AX?maRf4x0ORcFOwnA%myUaHYj91>^K zVx1Y*`kIdT)0s*IX1RG0oM!Rq_5@t9)23o3k1S4Z?{=<5nJZFi{Dw}*{h0B(p`VvC zEyMf|4I_SBkb*vSzI?8&gg6u~98Kz%b%$QRdew%fqQjog$YUjdb0tGyRwj;IM6QPt$PbMv%!C>9C6!p!`pwLx$t;)4$lMRnAcTwWap#0{Q%&Z&F8fQhndOQD7>3!<=j%~K{l}%BWigr3 zKl@6?e2$Z{Z`M1BexJMTOfp1a@y}I}QG91*cswE&C{=c^Nq?s8!ZClNqCV1j2}H5S zjmIg>XAYX-%BU48uS>m|GCBs;OG3S$QBj>U82-e?t<9Rkc=ZMZ6FH^E5Q(atbcP^@ zjmo}F?#49oIj`p@ELb~1zryQtSmtgF#cxRkKg3^OzQJ{6Jxj#Le#$yzOA}u93ZHI! zLzwAMeHN$q?H?6h+B+-sxyX29OD}xB=1^`{n&;(bN2In$&YwBjUT!8kjdgBRI8W2# ztLW|lLIIRL`%RS*>VaffsYuSt=|J~WJeB-113me`CZWB6%$v|@HdV56m2M!q4t^-9 zeUoH)cBz;BhEP^Nv{enXS!-v-n|8~xeJ}mzDH-J^@^LeyPa=3B)aAU^m@A;qgIqh) z^#_)V%E7=?F~1}%gbJ@x=;wJRC1N}@zwb*bfVu+$^nvV?I;&sbYu`YtwH`#yxXXL}bScy@?M*f)*%u z-nlwdfCkKF=lKWKL=ruW zqiLh>F00jyh4Cm&Dct>AjTiN9v+FB;{13l%B#bR55@@9p!jW*so=6Ja!oCd#5>bJNNsG@M^@5*=iH(y66M)ErQDn>*nVcf?4$T8pQWO?28Z!#eLR zep8oqnn5=HdS^PWkD&S+tL8h{AYx-Z)K_K16UQY&^Y=CoBg6J}ldd=EUJ-V<)`8^` z$p)|9jG_sW+PG|CowOe*-^DiEyilqW8G2+^y51MM{&Ut0g=AfImJRfB10V>A#4q!s zI*8|w%hf71m&<|3HsnGc1JJ$0d#rJL@uU&8#P zjIOh|@-&tG6Pmj2;V8w@3TX<*J!W_v?6e5TXZiun&U7F`2CfEOip)TTshrA}HEEWm zxWcSrq5Dv1nc9wB?Vft~3xk;4&zNqAJD6A_Lrps}K37NN%+HM+U*c_`=+!xlExcGU zunqlZ<%6C6z3+uCKjGP@V<|5%I@~7M35<6VWHH|A}tMqWe@79#Hb+ z)WQ^<^5m$$;AQ*ZOy!JSGrL8%e9NJbm(F>z6B=GgOTG7Dv+75*esdH8(7yFXSFo}1 zXhRo|X&bw5P%^D5MM^_uD_PC5iVr|)V z8DUi*KcKJXKBPeMy4k_oZH{ZpU0f+nvz^|>OnuU5cq2K*oV!^5aYo-@o!wsG#W9BJ z2Zf?A$=#R=wHzm=eCO7*52z$>jKnd1)sDi9U0fo&te3aLBz!(o#^KBS*ygi%<(HsT zx`QXa&y!Xa&qOgIL*{#Ky?Rybug{LCR976Szp=eYmUG(#R!0*DHtz2X_}|uwQZORC zOuZ9cRWyqf`zBgwI14V*kS=`mE3J}-mN&@`S@8@Ski3~AhP{-N`icCHluqSl5+s2v zkKOZk-g`p_bM-!<;wf3Zhh9zYI*5KrmvRrTF16a_5S#nN7Zs$?^3vQS)icK+@=Vlr z>@nN}8a+{**h=W&>E?6s8mC{)FhaYkT9v`mNj^6dg^S}VCv5HWnpZffnXMihW5KU@ z#!t)!M2kK8f@TWi^~J`uc@^#{heSkm1z2*Rk~8vYUilD&1W>6(pri*^32 zUa_`2(RwMcFQho&fI&2&9vw{<;Cgc|FE-q_Gea{}FJd%(LbQ>%la-~yMD=X1iCdY7Y8kTfo#@~O%Y?`UwhanX?D7txO}5my%wRJ zrykkyVzHuDE{;f)P-SG2Vm=}XPl&5?4be&^(u~8;>`5a`ZlcpR_UP+VuA@B4x7(E3 z%Y~^Bq!}-d-rTfL!{f$AyfMMk3$CPCv@48~B;S~$L58z<7WMLHZ(_@BVr%Qo{$cY` zhoVoy`~3cJUq5i1c~{5qy}3*L4b9X`LB?r-1ST;rbJLP^lTdtq`Kc^>GKC~1=W~iq zDV__LU#rMgrN8Qmw|enxos%M@3n^R>veadibm=s;6^i$lC(Sv0 zP@fh(@le-cgb+s*4Q~diqv}hTvZTqUWVW9$np(iF6ay2Xl$LW`1@Q26*4ah{IRzr0 zpp1ntNTow`^FOVx?f0eP%|{c4jns6%odB@D*Yd!Qw;~mLfhD7b;g)pn?|iki zdoL-Z2b03aVAQRP01^y2Txf%QJR4c+ZL%bbjqj`FyA;&4&MaujxTZZf!99sMmn*D& zamt)uJ|^XIZ4iduf;_pNS3K9$dT+wuDqc!TaBTv6xEYLTqsyVlKwiG!xd)JZ_*(Yn zN5O}F!{$F$C-^Qlt_OTV33QstiU0<%K2EGo4@aT&8u5sL+YDQSUU#Tf|JOTRA&0RP zqNp5h3eCKrI)8P$_WEh^JvJ5u8jFkWDAaOk zLl(F1#HB-I(?MNEiU8AYBx#q8mrF)C@}9@8?UThi zFEE0`;&WK-Tl6mue=)YWuG|7VrWeRIPl<~HLh=4C<0LGQ^Mtvds%8C-tKTB>$K7pI z0HS+y8PsZ=`eT&&O^)Nldu?ru>s`SrKAC@JAO<*xF#p)`zY#MVh{t$Lp=%x8y0vyx zY^2rle-b^qyDAN=yh!!VWh&*~WyCmili$Fu0r7_L`ki-9t5A~t^T;OvnZjhh7%%(# zZ?lxJfd857EaQU;FYW$NsJCwW4jcW{*$)-N8#3= zg3!NiBUm^VBUoi%f7y9;`qP4RkJ!>*Bl72N?rsR420bsH&tp^VdtNcpvgC8c-y`s^ zD+t5Kh6~559ISUU&?u(Kvr&JG{5xHLE`rVC`}uR2^>j&;bY3E}p?1C1{#5adiHgqE zi;*;G_tSkDO~Ep2kfnjJA0^Yk(^QH~hVJsncsgSgb-CV&D^OlV`AfelP~hSYPhR1CVcJD7sa7d_E;w+DKQ>F8e3 zSxlJBQsPkkjrab1qj-d{65ZwMS|@04vstO&gPi6+fSzuBvR!ZmDB}&#?vu!r*XV`< z3PXi*b5{C|t-38H&uS<6sariS58~W*r-^4u^wvq!cnJav zi7Rm3yLpTf32T7D=u=ZUZJWLMEV>_;#SacONxR6p{JQlM@I)ix@mS=%_BmQ@2W$!o z8T|4n`nhmp=)nd9=H}*yE3TX0&%-TKvhPa5|MR0154;dhyfP3C`?8#+%?RuA`m+H$OXDZccNI7z!dfG4c(cbE4^OM-x0|hnfnOEPxr{dh{OzkD8 zS;+zxqyqgqDSUkiHaMxKZdncZ1n60wan3X#yQ(pZ=XW1? ztVWVLP2%0_FD#c!WW}_9lb0i@_-b5F?vZ%F|7;#ma(oVgol?<)4C)nO-;z#_zz!3( z`Bier2{f?iG8_*7oo>DvcE5>eOXU4$_CGx9GlhYgJC0c2drWzkHf<;3b~ zoPAen31n41#B1SZhm!)s(SI~Uo~p@uCd0V17w|`t3@!~NpZdwvUl4n$ebgxf#O7Y* z72l zqv={UT0yIt*X3J4S5==dU2g}ZkE@Al-!FQl-uJUk-t5F5E z;eaq*&>4e9)7heXn6^z7bgCgcSFddOfszvfDoG8RPf~pN3>CGwjr)T~s8urO#8kfc zGJsWOs+jBIK%k4BmTgp=hiQQ6-`8<2A{p!m3P@67y|whsIs+9e%vj4Jt{vr5Y6t~Q zh=h;a%wh?u#>*#+H&3)-;3zI=CT}A!*J`SPJ=IqwQtCBD5qf&H#i-BAHu6RPZRy0&PS5B$~vmi85NLeZas7?1&!mNq-Trl^gH?*q)a5U|f2DGUk`jJ)L zAbw@`fU8J=7V_ZMO3T-`5hA;-5ZR-(I-hcyKC7MmDk($t?{iPddOw#arO(@H>eawx z%>}Us`soP+Rq>2XS1jap=8tb^H1cJtW$vjiODRARvc}uBw`-Bi^-axa_bQ3B0q%!0 z86IeMft255$GFAwiv#w)gV|=fIha$qSWLwI?1A-XB>^Wp@Apdski|qn{)+m%H^}@MJG;Gplf(67fBb_V zQFbdeiJ@ozVcC5_wS9Qs)$Y_}yyFEP2i`l>#O|y{ig2-D@wc{Xf6_W7K2N zrTiD%szt!lQ}E~}Nc@MVCAuGih#>_JzVjen?cdz*pK(X5J+|@#DVR94hCbpy956Q= zCI&?`;{RhrG3+*`9%20VsiCA0Bf|jSS+A<{uW;b^KZ5;*eHMEP^7QqpUN+Zm>Nj2j zx{YB%ENQo&fx`@%pU!<;_UEyZ#&86k=SzSlBLcOO+&YMu{@eVYY*4@1sZ_UbQSaA1 z`Qx?MBSI(_t7h)yYA<;V8`5i3zB;||?~P0)y8FiC&YdTOwMcSVNnJGmeXg$^<49>? zZ0zxtKB=Ux zKeBU)oSnaoH)?q)Jwgf$LzL9{Ic5pMED72M>vb*Qf2nVD4++;CLwANVYrPx5Z_PF=F3wOm7GwWIl2H z$W_ysPFnlZICrr?wfSSPTt)XkiS0>JR z`gK>pc>uB^vsCizw~Wgz72Ko!HU$pCYW=JiIQ!uAU+UlY1Ui_Mg8AHAwr@Ciuz3D z-(rm{N%-B8+)r_3-C+0Uml`koWRcwaQiB)?wDa|kLWq{GKZo7%SqVVSS4G~NoAn{b zniWptZq{R+GHu^Cvg>8S<_eqX3*5%)H{c2$yLlv`qC7NF_dbaJdL%u~a4QHcGvg#X zwwqG0h6Xx@f%5GY1y=CBGVygt&Gwh(dIt8WjDf+QTAS6_J@M`&F;O!mhUG@dhgD`f zMel;5x0$|7g6LmxzoWyv37P%bzDj#-E1C6TgDswYkg@sdyN?_x*%i3?`T2AA>iPEH zy{a!Z2eidQDEJ(1{$U~fEJmv=C*S~{>4ec;L0UhYaU*pb6Pm!95~E*pW7>1J`H_8@ zz;%CKcJpGtu{ow58B(kLEJBg8;m5bBUBF;fy#q?CdY&K|YP!e8zyMf-8^u7%EmK-F z64f<^o-Y6t7|UJSzo7LTrS6IDTiXsbrUi+zYMO3ax7xGsNWQ-%;qfpzXrh8hC?xUO zAA@Mq8{VXHr&&eplrU+#N3S)e9j)VA)Xa8`zZ7aKDzPUt<#4f{rZ!-k+?#_2G&*YT zpKP~aU0)d3GVsEG;3+zFz^rHVqcQktomVx1XI__dgZO#J^#n$fcaM&$1;OBiO+)^A;-u} zZgJA$8B6Thnj_X2BA>JL4iKduX?184zqZd%G?Up-t|GKV!6vTA%AjWRwT%3hRUqvj zvzE6AE7s<@RgEI?6mmTf9H_ev*L_#aRase;xz!Q&t()Fr<(2ocu9Ok}WoDa+{nAMO z6W@@K?3=SSC$Z%&rjX9-x!LC^$Y|CTHB`Fv1Cf-^ zXTYl7c^4He-s?FuN`!Ky#f?dk|J|v$L`yQ5tpMrzF;i;LSi99JO`5=9=+|;IEvv~_ ziHgTqM)PQkT*ItLy)i^ql#C_WwG73=Y_Y4l(>4%UcxSnp`KIgLw3LBfEG6?S{MQXq2j1ZT|g;K)|VBC>npa@`Xl=ju|| zm4@+p&Q_<*llHsI!=+rR_zjl;-V=Q|xU|5}y@VT2f_UG?xtZ;NL|FFeVr*VfI6luU z$o%!3>Q8tXV=_--j$FGNR)kUgvNRnM#~;4S;NE+3I=FYDLlz&O1M_u75kXVdBnt{X zlx$;wH6f_bGOi7};yiq^c`cUD0bm4`8+tX06f4Wcw&Fp;9FopoCMY}llvM0?8dA$< zq`QqSFX=5BAJ^}RP5+21{n>n?y}oeKs#envYR#E~-(99Y%{mmDgq>2lRlgkYpW{+t z<}X=fvxw6xo0Qt&=O(6-%3Am`IDu>4q|AkLIil-Ia!%lw94a;OVKmRL*Xbbox(3>( z+cH=GusCx$S+&EuTD51mVT7wuhEp!Rf->htRT}+rQD%d2FY!r!u7J(r2F3Rn#r?=z z+=l!>G%+EHvSx$Gu&@d2AXHM%0*?nKSF2T@-Hws1@1YXbJ;MMspyrzW#@1sEaj)$< zjx$p3y;oid4L>e~nyXP(Ual-#HW;bc^$ZovKXFCX0W92nY9b3dH3xbnZm&$rIiYdV zL*M|#O+o7Mh|O!?g6|@6?z(-SFz9q^zJ))fpfNojcN2&S<1i~Ytb1Q^!;BQH-D2`& z@KlG*PA{843({}5(sF9oN{%hgKL2_5kyEkb&p<_E1($}mhfiA6U+xLpO+4}l!lLuN z{Ek+A<~xO<$Tl8Ma+>X)b=>o`w-+jYOFaBVX>j@z-%gl-x%qQb*GtRAm!sNhHC~b4 zL6A^g0&Ddok|*wOuxG?f`9Qq7&v&-E<^mi#3(Pks+j3s1@c(@4Bf=PSgnkyIl0H7GnA>qo>?vB9iY3lX%Zl;?m!*BFHj@!UWAW z3qy$fyG|)cNcdjwE{~FAzYU;v3}?-U$2T0W>VMV!0AalKT7ybhd!fUj3O?qIBztAy z;}m3fHx-EDGo{_=+-ik^X9ktyJ#c~CcrlFSgDzPn0md`MR0EE(k0`eB?=4T;HmIO9 zmQc(z`W!x~HvEKHmRLY_(Vj02S5}I|?=6Ks%fi?Gil-NCoA?tfF(Qum)(fPn``?Du z$wvLrh`8aTQAbelehrJm3!Y)yBU?XmnBDxTG;OYA)C9@7Le$$GJL4M#vBs!DF_&dhzzkR-<_*mYEKIS6~x+KUj^coLwG-$S{T@W zIfq+YhLkE@g;b#-CR%&gEe{M`_85@sHQT1ts@RpGzm+Nnhr+|!F(DeDD9?qDUeI;w$p0VEqzFauMWPZU2yC>$21{|c2vDLXEJ_R8T5 zvJNcF{T@2I_73wK!PC@H`IMiVP?Uiwua2%)6GAE0RsjWadKg#9`%|8)^Uj3zrb3SE zudk*bEfLD&d8tHN$6c2mao|^XM+vnA>oKO(_9+{CUJ$Kjf2hB49F;Jf#o@PeZavzplP#%m|)% zXQ$)|g{RYb$V_#IQNaN)7-{!`&B=^f*9Ja=`cF z_E;OOQ)Qb5$TR9Pz3P#pl&(`59u!r$kWWnfb0yLj5%g=gDWbu;s4`UxM#yINtI-c5 z8Rug1@&+|>KJ=@;99J0R^XX9Q_?)>FK`a#TN~w^&%683GyugiMG$}UlIFIQy>6*tA z9ixb9PaG%3C*45H1F>@~obg$iRy}91B_+bMRvdUYea01P*wqvAq3lM-35|mle8$Hd zzWOz5Z#jEu(qY;H#tQcv+9sS&?``*O2L&Wjxc?B3P%nn@+jUH$2#i2FZfIkA7+`RU znORS&7}bU={2y=A!r*g-GxAux!qaQN^>w;a4>4m(Vmw*BeBUc_p(@%;WH0t&dA_X^ znbZ9d<~M{;wj@eCzA?wOM60q$exO z&ql1MMK!ZXlvvr9M&ZivWzT$iN2w&h5)E%mZhcvoT=4n+Wd``e!?mD-Cw2H;-C>%u zanhyXY8Yq2$e~n6*bdLaS)#YGl27CZ9Oc&}!$(2Y67zo|RS3W1J8Beq*duR2U%QSp zqOz#snW|{1=U85{GC2kW98maO&_ZfQ8h8Shebua4zQ>}ya6pVFoK zs&U9>Cf&kG9RP^%$k)DOFE`P=HPJ&J6)}}VWiO1je2s| zgiZ$@^Y-Ms>}VEhp^n!eWmrz^3-b{J8zk^}EkAxiHnplO^}TPup5z{ze^E7l zX<#XBV^&=r{TI|dHVdh)hsJh2NBfUUVo*p)Ni%`YkD=TKeDJLe;TWFIN)! z^Dp6ui+CFyQn{hRO@cwoC!Ik#PYE)*Owd2`DIPre`mnBqcjF~H@llK^UcR)8_&9`! zQ94Sm@&m#1e(fI}eBF;@iJHYsIv^2=kL1^nR>wGwUE<0eO(S1JGnX>=ArMZDuw!1W zN5pI^eNfzJVxG?Ob%E~Wsd`z`P&S?|8!U~wr-x~Nd6$m@mz5*;JEY9aV;Qiy7+5q{ zeur(-_?y=f1x(GXLD_iR8+v>zq`WCCqZeyNEs6OMFa4VAwWq<>^>GheP&UoNWLMz; z@$ZLFVm?90BYTGqQ1jIXQM_g69(-@%=3@C%5#-HUSVutGwzK;WF;RS3R+(g7!<2Te z%j?hNlM$|kq_j<fP&LrXO)Y!`lK0o1?W54okeKM;RYk%s3JJv&7xrJop%9Vaee) z=urp>3Pkg0ED2u73ra-xp{ zc`W8cv2ch#T!Y3r_W^=CIUz=kKCDc<7J|j0twcBDBOLi!r}lhje(x(IC$oP4w_A}& zvH7cdEK?;qNu0gzN(r_Wu6@w{g-j1)`K;}UZcTaNokSt&EHCI9+vO8f2Wj6?YmFCW z!BoVf4Rv?&mmf%PJu8=y!dRGWy5M5wB)gbY~6LX@oaXQCgH);uGGGhpYuU7 zTLg!VsvUwalo#!z+dM5gs4w^TbXt9?V6d%BdAILY9NFzmhd~RwUqM5-4Y+0V<=1w1;7$wCc9f34(7u3o|~4 zXxIiW`Ab*Sf?u=04k}C?C{gYSY|efTd)V>Cb+c-a%jJNQ?V8`hE;6pXmg6vFl<6{L zt?#>)89P{K@7Ue#qR8|TPaOt+Tp^%-xRhDr8#}^TTkKjV`WE~FuvjZlwhoo@;UYp{ zd(m1AHaK+NLA0y~M;lF@S))-rXp|vnR3NE{y<1`-LsK*X98_H=y|!qWemj>aM(cQ%GNbE)d_0X3udG@6!4M{1eSB4@1JlD>6bXIuZtx*}h$5N#s+}aP|rA$AgS z1IvUm36+z=G|Bk*$BIADLv~T9Hd@7Iz4u~6k@`)V@V+WdT{A5n$3opA#))%@s`9SB z7;@UuDKK*#25`rc1jIreUQ$0yhdG!BK6HMV0IkV~??rOWND?8oKrxbm>K!|MeGJ!sh zBat>c`>`d;_13&7S#3d66acq-lwr4EMIc3mLzqPnoyEpTeubP~zv%K!4bc)VG z*E>(vENM_NT6tdULfRAt*HO|lKsoHWomA_fo$El|Qo)Awvhuw*^BRkE(`Y-U(`?}m z57s*8e$%PP(xeVCH0{_SSF9w)@n&zAflDx*VLJi(vu9Jz$@<4~9@Vbh2V6Q|y)DZA zZw!s7i`D0f6p2u^E-QKfKlFQ)yIi&XYrj_Dh0Je5myCk!lvYo%phtcX@hV)NYlA7V zpZUUajEM1ic)OiIb^NM-c!A=2>~(uCQU24CXBRigL2fmHfjnVo(l3bxxR)Q!RHisTnc@3BGx$|Tt4`5|^X zq%!CNBbvr_F- zR6)CCz6L1|Y?%RLy7C|DTe!z$?;7L==DM-pa!zE<*Y}%oNZ(WBY$nzC@i`|LfxvBi zKAwtNEtdLg^tHr$&ea#4ab`p9LnP?}p4nW?+o-*x@gJ*__@#XFu^L_8B!>2VZT77| zfM~5BDRlKm=Rf*h;9l?Eh;GcC5;r2vW3LZ_wcF1u+XrDGI%%$He!hTOsF2bD+9oyb zm`i~r2S-y9(6A=?Y1T%A8>_}?AYD*|5Z8@xi1~rfr$QP92Orw2?9&U54u=dR$TbiB z+nz?kp@Wdybz=h8+%16-Wq5Qf^W}PI3n{IHKPhgcaHLoKyJsHuK^2#OL(xp`w6>=Y zv7(aH$X5AInoWD@q8!t*H~SwStlyw2H9lk7{Mr84`5tiAuM%n{I6*kd(Ux)HV08NV z{w{u$cby7)=7Q>SuaEWxnxIYS25XXZqdwt-xFRm2Qq#JgV^vxWH5QYh%$zNb|(U z|9Fg_xlzXL>Ap2Ml_62%afvDWQx_@opvA9lm!C3SUA}K!mlRW#cpde;i)qM#GbbXP zJ@F;kOk=d1~b!6YRVq@!3++!u1BoAB0WyX|G@+z2fXr zT0+Aj{TY0fON5nXo6d0XO8aFfsY)D_8~Nml*bk3=LVo?2F9g$AhWS+;*H-MN?o&az zs^-QIJMTcHtStys57wzkjq_QrLxN&=RO6s(w$?PzD&Go-9Gi8nK2^3^)Yll_MWY3# z6>qqhMemCEv}%NH-deBPT8UUk)6S(7s*MGK_MRvG2h)~>yFAgcTVr%*bfjJBzr)QH zVyGT4u9G`>&kABL?mw(WKSR-E{T~~<38S|^;*sGAlpk2jn*b-`-^?BPt&vQ{7HrD8 z-CEtXY{P<85P9Fl*SwZ4ytB1)w&JL4(ABw0-_OaAVSZSWkR|iO9>G2xQpzeq{lh1Z zw=s6+x)F>4>)Uh(%VLv$FeTBj^rak~&>S`EQE8^?7+)+N1;6dQObAlBUKf8*ga zwbl0WC)3MKk#GbL zbagQD81+-v9*-e^Dx(f&-7;cEoE>?58zWD>okgacyTkRo>af&fZHJMeWT(@z#_7HX zLs1a><(K{1&#qZ17U9;MMxxxmL^_PErHl~gr@nw5ufv+;y9ZjC>fWEK)MvrP37%~J zO753hZI)T*>~|7MWU#zv$KO+1@MRgkgQLpj&)a!*z0`a@8z&FmO_UoI}NT*1MRDDcM))@sY1|64Wf-0XzG6O<31Yc1x zMp_?ER%Z$jfad8hTfAt@7~D^>Tz;Ad?0YALRq|yO$9*vj4pSEPmR)4Y@9aT54It#Wu_VCjAxCo~0XbXckHX2dhbO_MLyWJ9`C=oUd zNijH}742GA5dSQECZ(vxFPSDR-bI~=Lzx+dENtI~{A9mzR>=VtG$&tinxjUmL;cTIjz0mhhdix?S^M1v@>^F)XgNIMimT$>$N>7+8j*0N& zUG+KUuWZMM)-a~_LM?lDrz{N`M|%1VEY+u$Ud5)KS*Tvj)i@2O-W8qf2TvHaB0V-T z|KEOj7T$+GF6T=dKyaON+8gR=*nZatny;n(4WI5{3IWw1#_CwPM5{f$%e9i`?Njn~ z6=YWCvs*C7!+DAHaNS@$ip%-vvy=N*&RzroeB^euDpacTr)8&o-WQg3_z9=37&iMIpx4H*^g zoodtfJpo0;6&=`USj?shSw^dHZ}OrLFvJ(1i0VuhR5dV08Zeu)LR1TO+JyQ81^db! z5lN4%T$PBp>`vJNzs3JlLuNNS?T{U`*_R`zhJIW#>m46*{wuwFR18Oep9@&!JQuG6 zQ@~49zOj6vp`T4tvTM;WhCewKPhm=tP z&jtgeMrV0UuTz3?-16aGV6plt8wZ{1d<8BrrhWY6-%>($S5&j3?JP3;=@QXAiw8iXTO)Bf2d9^Tfr0+_avVEoq_ar%>7EGm z)#cC<$J=EjEzf50S^%jw+L~%<{hyMrsL#9>);+~c+4H;BN;=EPHyU+zA0NeoN%W+M z=4#Qo`+nh=BH~oq1F7xkekrfKlT_E`<%gDidWlFbwWO1|=a^|5V)T1sfGj*3^9GCY z5SHzQMDD^eOP$fapI9_^W<8x!9jSy8L*gs3o-vAlf0PcvKE!0ZVvA^d&teCqG!xj{ zteu(2@e)h6Piln z_T`PyUy4h~ZsNg;^+I4ER6+R_UNG1i6+vdLzO=W9&#A${FjlbOq2dNanj1xFl&Zq9e(MfvJzE6TKR8#*S;tVt@^|Fb z(3vrI20umqA%6=(^_pIc*eqb0B58da^|OUO67ltb#(F5{acA&0fET@G{nQ6Wk+o0n z5z)#*etSP5*RT}jEnl8d-W7KfZFS} zmRdQHC_)`PbLCv6ib;Py`eSc;_Ni;ef_XnZnij6pus+KEaqa$p@ug419+mFKMvL{% z%O~HWAurDH7n&?-(YF67o)qJKyo$vGr>B(WQ&tJ=_V<2>X^XXy$k9QL`->d9D@;L2 z?=6)Ir&9Fgjq>?{6+o-b%rd{R=`v&>*?S4!WqpTPyTLM*J^Ey0E|z~EF)1fs$nIU| zd3kTUzv?###<{yA-MYo>U~)}mMMWy7i~K}>LGzz$PErc4^KetU)Br5Z=2I#Vx&u|ocdtxBfybnKZf;c|4eyy)?w`fxfFu|H_Ar>DX7Y&M0%iRT8W_w>mFNf0Vvmn*Nv zEjNeqkOfRH4i=gn_un5UCbG_ujAd&$o)hmmOg9vL-~DOLRwr1l(h4O(OxhOIrl2sa zUV`&`aC5m5@-42Mw`nKxK{<4 z0y11^f2?>g1qLaB%Xm52T9Mz_MM8j7v2YPdK@)f!j#wT&4sLP=z$ZYXT3`mO48cH8 zxmVlUE%TM=seFlK-Ok|$YhElzFhVFp<#=p=)+vqNUMo~BlzLU2loHI*%LAqclGJ7$ zNF=dvnDtrRVAxR$Uwgg7KDG+hSm3F_n%hat+ia$k$xKCZJvuTJeNX8=Rj3fFb;_ws zZQ!Wz7yh5vA{V#`&MS=-dgs2`AI57#RBN<;1F;iwp#8Vl&u@_#b0{-DwJSL!N(C)c z8b6$dZ+y;i34R57{A{)-r_E||AMU%w`*Kp69rmV8->wGr*=BwE+w}bR$=VUq5^*6y zXy7gcCN9bs@_ilXg z8jmkU_k|z~(K}7opGFpDBy2WEbiO*DL4Q;mj)ZqmD(NdR`Bgi@X}j1swFY#vKG8aZ z)jX%&rNLD5K&}u{R{h_`?|&bKqex&fA`#S}GQYnxmsAsSc#+$W4``gP2W7_O8O)1- zfxst)s=_&YzGw!4YA@E#s$?GM*JLG4@{PsoChh!*rz5c zAun-*#dtKAO~Xl@h^}1Wpt!aMV!7=AbH>W6tt7FAtZr%NoUf(O1xMm_&k^E@7?F$F zjO$rYQ+QA1!#dwx9C8pf_hs4--pQDnEb+t!N>LP@ep?70c$8@)j0 zZ2J>1xj7(tk}0aW7R&~yJ4IrZjsvm8W9qZu@dUmcyt|J#=PAH66;mqvhCPuL;}%|YxFe`_L>~w8EC0NhSA3tJ^QyEyyFpchN$aZnjZU03>$KHM#!&1!D12V> z)X2ZwE`Yg(U8Ukm>mg&!@GVj{D3Kq>y-!9L5zbxB_(g$uWn@2&6hal(rbcAg|5L|S zG}^9dY-2#vr!&GRefy}!z`7(G2f;Kdei9<5UfQhcg`P>lvrvKiT!a%bowvw`DpS7n zQ*hIrA5tKBUJbl56y$i>pciAnMsmsfS^p<_val>GUzst~$YzS1`J7;7c?G*Ej>)t? z4%bI7;3>4q2WTGQWHzH5Liw^RA^D2p;fH~kgsz5lMoUDuMAk0xqc}gfm&90>Zbr+? zZ+r^+*ZB|FGj_nR#Q__uZ!%gkEjOs{a6vsrz>2mNsnGDEA)rj2^&fjWFSMTY6SSFH zvAI?O;nS@vJZnlFw3r0t$e8ECkafqy_XLN1*_?C}kUv6_zihJ&WjY&0S5(z+Yu_1p zRb`AQqUOZRRezL8hg6U7$$J0Kn+T@cJUad&8*R>%i~q6a!0rp8LSR>f_RjxDNDnq4 z;Bx|YMazy!?SH)c|Hpp_-WK7NTyWB|`9{F%P}a8p`(2k23#?mxlA+eUzvGBw43Z`$FUs5Lo;_n8LAEtU07 z-FG~$n>YGtsf{q%xv4dp6jh0go2=%Gt&UX|lP(}lsy080kP|$ZaU*z*D2x6-7XX?> z7CJ{`y?|LRQouh{vSs;*c^jOJ6csR`YD=||x<6oE;`mWub6B0sR$+sADI&F+H+arE z74fX^DrT}xe*h^-SQ=fd%^gg!befp%Pp@bGGkX_{vf5X(e@1}7U_y}%9h4q(bBF(+ zrII~=eU==lv)Uz7p0x||HjDEet`Qd7jJ@e^tn_T^E6RZZ#CstQMnho68$+O2pf{-- zr1fOyZ}ifC%p<_YDk=%7F+OYpD3sMtR|}huo2?;>)%65|%U*3@^G*9w(^U$7lu>8j zByj6i^RJsNLZdI%Jn#Z0()~q^=ci@z<^r|i^A*y50M7#FyIe^?Em#=QPU&vS$@7tZ1jbYJ_Vj$Wo4@FIotM?jV&Ob{=j|U>Hsjes7q0^pbnH<3 zlJLJ*Vbk~KX~<@DW6fua8apLZSdyWqPc)$Z=_2BVhNty{j$F$iD%vuhLcf)B4Aa6g1jnmdK9u4XQhzKz4K*ha5}phpe>ZcLr~S zdP~+Rm5_63xWC^vH=TUPK(`45g&pw~Faus)FX^Icvq|Q1VwPS~9Y`d7RADA7=;o)}^nXE_46?bW>C*UB-%!dgncb(#~z~xGQ0^F4b+U0tP%iH*a zXK|%v|Fi!Ql16-%AHpG^_t{^lc>oi9REi?lRci6L-7kS}V^71P>0ZgSNFT&`=CcjV zz>@b08|T=h5%Ay`nB0jERHE^NF^}C{FFX!cIwe5a$*@$c&f4?P7eI6nahM!-zP|;e zwFHypP_8slU8O==@O+|2MR+u~UVQbX5kLzKPwDu24&wAxJ6e|WmU=B&RvHriG!{Fz`)qUzk3)aglg ziy)^jU!oTJUWsh!kuWr4ZXH8Jn`XPpWANr#n#AYJdcf=Y7$`vY1B=CKh=zPU49CSx zq#Z805%U)n@lc#a=Gz$uqVK~$?vP{ST5dcxhj2SE(txW8Jv=G}*kkFzjGmg0RM@Ph zH@(+`=ZjBo>FB3b(GM?x3ArZ>j3~u@e}1Zz@qf9kCh}Gn#%@R)?r~I_R-#S^^Op3m zIhsGx4m2yz-^^i)_mw-HOl$|x_6PsY?k$AP(U^f(q{_Oux#78e+qu%()4)PjTaJ*G zd}ZJlWw&(GDkFyep--38{l^CvO8njB^j3k!rpPqq(|o>mr7c>cMpfe)i-pz=pTKdX zs16+`^Q8=Oda#bGq4T6ufS?_&UwJ64`SfU6AC_xT%=pLA7)g#gLnqN0^&h$NW9>~8 zjwC6jeRyPIunaj1aT^R7r8fFmGW@l8|1P85(i#&Y0yR&(giSYnIzjtz@w!8hVm-p> zgW7FXO|`|s1~;3#Jd`k#BjGOHBrqhbb$T}S8R2E)2xasrc{WsAT;)~RPFXw%Ru5@j zr#IUakkESqqq)xSt@1b3y%#{b9PpOeH8a@uDP#NDHpjG{orPmsb7u>w?08)*tNVbB<5+wyvqk}$ZRWpGY+RaGvnh}8@vrM3%}O* z=Jb8YmTY+M@gk~`-Ku+NnCjEk3;hWF;P@hkUUV8Y>5#_amU${m424abHUkVl&S2eF zxXBF}E$fQ^*N-gFe928kzA}}+MhZnXFFIc7G;~66ORdo`5m$9;^fJaSVIV?|im`1M zM)F&^Y_@56{aJDZ#**kFv22CI^FHtofYG+%Oi{%>>Z9_AdGo_~aB0IeS)eMd?_R)2 zs{nWYQrS0Vve!!N=yn+cNmaWFJrC}895L(w&BxAldOMi-qo;6z#d5aKD67lTKOD1J zXPIG9kT)U0CYj>xLMV^)ikRF3AknC+m&wf>lUud#R-si^RC&763 zOU}wE`#=SQF(yaFKphi9OlrRygyz{k+rqj%Xyyk&YX3?t)teO8;1ky95@Bb+SEzPH zp>)e4W$Madcc6iF9Smn{H4~>;I5krd*YVqQuH2&R2t*yd* zR08Z8h!vub?>!!f5*K&=g$(-7?n6NZy+XR4+WX?6eYIN#hueLEas|r1@!C~v0;&H4 z%mEP$wf7f&NKZ>60CyYR^|m-`za$EXRRN;g4N9LXCYPVQ>6a&lo*QIs5mtU;EEbn4 z*)w6dG9FZ7aBmlBZBEt_3zbXR12@HM9q+n2CAO_bC4xP7H0!pu#TjVI|M}n%K>5b- zwu#rta=NUlgNbn}OLn`}`_7uPb2VUAH~u>h-Ebb;6DIkgVy!6ugCiC$E!-jbI4jZt zPSi}QKXU`{8cryEM6B+B>pDRp^M*!y8<&-sDr35|pN8a^dv)e@>fGpyI);|}wRhvmVUy)F4Sm_LirkFR;XkSQGGOImvJiT)Y7 z0bYp;h-%?Dn9LIXdEkA9^#KSSjG&NzQNsT1BW8y!vvVT}t|1pO4wj|`^sgb6!hfWX zfs#7lFk9{N?3t@=2-RrTeG>_=tt+7eiV0@}X%C~rS4cgI!lcqRkMGOPYnJ-Q`|=W! z(z*17XcQBL&FV#-|6HV4zwR##ZN9mc2`Ezi(G>jh<&jYdAlTs>59LB15c&Cz1UH|f zr*W1B;C)vS>UxAA&-?Qt{%7HU7oyxyKTDSYAw!HCgox}6)&;rXBS&Q zc>qLhV$JR|>PBGdo|xn57QMB><;u1;y=T7c#Nkp zkz(vkyA$S3#>4l<)%cK$Gi&aL^@l5?M7vnA+h48T`1hCbOZSTiT7{2u_L@N?iSj#n z>F#;AM3f?c2|qFz>9su$+zdpr0EKv{rs;;5lkwqb6GPjxkjXR^1W}hN&(Nv0&V#id zyiOmF7m-jr|8#S}1KbY0nxXZqv7CD)k$d>)1dhMd&qn|A(MNp`1#~M(Rufx+%WhsV zHz58R|L$V`VRF&qrduXKF#Vy0&^=l4l{v2N#LSo>rFeX?&lk{rV%M8cVcY~9z7nUU z3p^vk*kV~23pU~j{JOW|@1hRdETlF73StVZpRi>2K6$mPoGwiC;?pJC| z$^lcG4f3-<>P1_0t|aKfgkNb5C2_?=J;GH3oL**lvs?_abawuF&dQ^dl74wRbC5L(38scco&!I_tklCmFbN3C8ZU_-6mbaLE$ z|MC}rpE4XDP{SC-0ui@O8;N0fs)xrKt)@7@sSy7F4xP2RoIxK_Bw9#~{bnj?G@j_f zm{`RNX*L)L0e`pvA(z9JXl%h*nf7o}Bf$qOZTCCBVssjfjo^^}jS16AwW@>Lfr2bk zx?o7-m17R*7Wx;Ewz2s1Y2~kGJyp-=DESw}2W%D{Uq44bmUU;qLLph_fNV;EdQ_Tw z#nY;@=H|QK09QJk+*}6uXDn64VwFlA$}V|R04S+?P7?CiMdE^}LOt*8N+KVKZEpoF z6yO2J;#_;?c)VY%xeS!Ow2+^#wPIC+Bn z8=J*SOpM(au1t)5CLljUeq{lXlbOYO#`frjxHk;*JJmt*X+o-H^b;Y~%lW$Rb2Zj) za=#bPIYtc_9>V}zGUJ_k_Ba%reirx!J`rPH|Gj(#DFpNp|;muh00l$m4tUdsN^!{;8Tkbde2;;dgr zkZ?SX|xqw=bi zU_X$ce;=Mkhvs#@p&nbi=|2fZzSfnC$go>+YUQhZI|m)qU&T1U+rn6g;{=kINm}i4 zbkd2U1!!$OpJ`wUiwx-jk<66!NR-CeP7TGm_&3n>&ixMNi`JNpcLo9Ym`Z#J`=_=8 z7`%t~@?$S6UNqh4pMM2`X+wMDFutY9oeMkD9-#gck#a9oq!gIq&2)#Rt*BW&T_fZw zP^o*h6rHy=AT2~cS`GY^@*J^5M$}_Pc8~YSzDsxB9kg4%zo_XI@DG>o5n5B+*Sii0)NAmnd{W>%zG6M3!x`*!KuVoR*#XSm!ie9;Z}Qqc7@yCiTM8G(LDWNoz@`S%6<2&e7|rP(-sS|I0dfq6s$Hga zQ6na)xTxm|XzwN~7QwOM*D{w=aJ2P|VR5Iew%=9v-JeDB2ubJ_iuGD+5y2SeEU31p zd=5YqVx?D}?uBtRl5NUCYfOT963Qe<%I8$aow1vV?aG(7I@swxP_9>VU|Jo9@Z!cfWg?F&_dhhJj0inUjz&a(XZ!JJbB-TsB5@xsrVKZ7Zt za2J92W3Pdh@G*rzRn_Hu%Q5hLF4SMFenOk;I6-3<8xW`UqLPnVxX@?qS_m$xzdd;cIDUu%M>h&q^>HWxPLZ!A# z)k_vKwJ)c?jOKPdYOYsh7M%+-uii(YxcC;>6@=<(hBrj&n%G2J2W9=miK2k+^y&5E z@chc6Dr3~rqAS3IDJ5~lV<3k?8Mz=xSZiSuionOY#o;g7Iy4h_Mi1)+j6!)Q?pT6EwG??Uvov z{HRPs0_LmCU%$pdI!jnK8X91aYE;D(X^;tYpuSM-ruo;5fWO0LR0tGcd|H*@Ts+Kw z(^G4!P`ItC=)vJ689ZO^g7TUI13Rj>t$N(f@LKk{Tt~P!;x@8zNOdmT%WVMq1$0Xu z`1|h61A9QW+IKOVr?F4d!o`y6101j_7rkUf(kid%AuBzB|@*jHmEjPHYgYfm(R zb?B0g3w{atWgqMuXi1c+R;G5NMvAg)e*~DaziEE|x)ivNmts0Zh2x7VzX?;3W)}{R zK-@K-!IhuRSavuaJ7H4Uy^Vym60q2_#8GQMd-mqq*IE6dU5s6cn6D?j7>Ra1F*ybh zVaU!o_LN|e1QQ2i+ns$VDnXgAeedQ#2Zg{L1h--4X*Hx&T3*ixPrT|A;(Wzmt4yX! zN*0z3`J{K+M15Y6N!h(sEqa#WUzXV{nU&?ehxm@(MC&XmRMgrr32r=8(6sxs5*hCs_PAnuV%~A^NS;gW9;~_d-<8zzO>bB!7>HX%dQVfTt)!3}9no2utF8@%c&4^DzFA1D^sKPL-FsmrsTh*k3=R5Lm73 z^F5Ti3_F5?#W6JH5eO7}4=ezsG{kRSManojzR3GW!U(d(hQ|4;q5DO-*ryFQ-VoNRyy~1FlK4i@ z6rpdzO9Tvn#Gz6hWE2?~DnZZ+qjAL?bgwELgGxyo#=<5)1Q;xfz>7qvLCuB;XZZ#o zgy@mI)YQ5b(n|`;ZC{FVwrWuAX+vQ%M|L_9WlWyxE|F!@@J9AXfQ7`lj()BlAYP1> z^@XFD_Vp$e%6PT)Dj5h;a!9GD^cCl7cA4K?e_^4bFzerqwVTH0Gd>o@voCu&D|#)B zV2U#IHMezXmnTL}hZ?mM{`_5fx+O0Gap@LDdyp!N4eA$1e{>k&D^ifGAtH|DzxvDh>r) zEEzg>Z~A8gGtTuKY~EyPU{NttI|l?G!;}fs8S+x${S-O)+UV-#Y+asD$30NFIyH-~ zc8rcmCYdl(XrDg?{{6@wj~cK@Q32J&NJ( zxEV7E4hthU;;-tr3y0W~V5Evf|H!)m5Ho^J{*|Zb2EJ~LE|wY*Z&#xIRvG=VnONp% z0EWL$fz##?7odk}Sps_4c?aEVB$R>~v;Rb{e+RFkIFGvl#6M44-fqY;PmmahJqft* zQY9n4(%J4LRbkJ&cR}SVEB^f?|LbpF047a{Uu)zH2}XVkn_D+^1pxizuyJ=Q8k1bO!Q|K z{a9HbhUOA#zIz@COjVRUw|L4(Z*mhtF@2<|Kf?T_ICU5!-_zF#Z85(pc#t7-}qYK6jo<>trbOr;Bd1V}+vei*AR8u6c~UiBE4!+8L>;-O|`Y+Mg&K{GMxWpEWOa zE#~_A@o-bs{HA9YaMb@=4?#h^{QP5}YAZC{zd@vc^KB0d5z1$z@Nmg@h%|7d?X)IeAmn~kAs16Sa6xCW=Zt0 zS;JbNppCXQTf7NIQT+l#g2snNDwg6}AKsO_l0j zpD7(0`B#mf_E(e%9cD##?}gcQ z2)^i2hJrGNLJP0F{7E9C@ri_n4Mb!g5u3Hr?v;qp!-f;<^BfIFX=y#ZsPVie@n{A4 zHm$x=^GNjr%K4OywKY6;yNMJv0#fElgmI^;%QP(v2&>62SiCrNPd2lRzZO1kAXx-b z8k>oZSFQ|ceX>~t$U4hOKRW^|nA0Tfj@4oVwVgtwo#*xM6wlh@DUQRd?r#biAI-FY z$GUq+B+VH;!{K+a(`3ob+4guIm?Yu-nuNaj$MP`i;%$6jbZ*1lkUum!t*Y>%Bkub* z2QxqLmwOd*kxQ0-VYh8{s2|qGYxI=#rG2ux5sZw7Zubkn&L1;wepscJ8yzK~dm#~G zrP7ywnkN+8d%$fJ`(ypw&FXU8(u8PbcgkF}glEaIrn1k_z+j?C^RTA*^)^TSRLuiH z|Gn*c0m*7is@?YCgS+$i2DL_kRwd0KP%3GanQKss_M7%f)y((uxtisDw>yk`fe~Ob ziEZ6zJXOE8wq~5_=3B6BF-dC{F~F<(TfFb$W2D_e{W&6K<8SY{ILEb~Nc}5KMR2A5 z+A@4dTdWbA*>q_ke{D-8PoI{?FiQROY$=01BU-<|zVNI$oPHiSnz`Gz)dJ1s{L-_z14aUj?Oco()I<8MEbLP$6o-!pMg?fQat7KX`!_*d6=b zxU{LX@%WXl0l~3iff6z2Z~vLr611{)x;#hpdAXz+bT|bngMqC&gKaw+uYe$vt|R2E zG`D5NHqH8Tk|qO>5@3wW+J=%(;?{S(D^2!1HslKHTKb;KahL~X^nu}DXUwlr^Hxt= zpT988L0@?vYiv!HGu+KVl6@JeWnao+_Q9|;Kt9nfhp#){HrBS9u64P)4plkeE|N{O zQ_&D^urKTAj8w3Y!OSl6&1j=bTwV%jXgl)3W0Er7rq_u~2(q)cm+G6$KZ~sz6h!L! zG0a^G245z3x;0DnjpAh^p|g?@LRhV50F>NBhUj8%Mnd?UpHLD5HaUiIm#~X_Mau3y z1PrM72|sPeaGi~_!9#RamIsffdq`|?jk+Y=#^riW2qtE9VObak z3b?p8cWc&3-|sWk8Z+AYkIo>m&`0FqzbZA~{V0+Kd%T7v)brcUy4gY5D{z7sM)Rsb zYV(f{CY`XWyxf~m`mw_D?w7sn8 zG^exVicP=XK}BHpkq^AU#>vB+knBq|4RJOeUU^qBdP`2bR(lHE*pouySObRS>j^)R z1F`e2n3AwMQAM#zW7NwTvgK(h*TFZ09|qQPZE+!>T*~3XM6xaBbUMJnET%Fv2?x2j`Cq;)a&}R;%yd{Vsb@8#9*J@tXFD@Q@AwD!7-H$WAa<~_xaD& zI4)y}R_h2Q{v z`KqeGE5sl#q6d+pXEHxOK{!F`Mw!7@#Av&J=-}aW73G>_&TwvuDwhb} zRW09bf0|Hy;oBR1;geJM3)pEnHw9=~FJMckeXANYe&DD**r0|G@|Pv$`j# z&G&EAQ3{81rISbVmRgSAkSPph3Q0teJh&dop{FE9&4MZ;Jx+CR@2+)|1SSINTz15w zq|OJyYu2StX%ZX93289`EJ=GS)X$oX+;YBNL;(-AGD#d;TtWHEh#jMWmv05(iPq8Y zD$Ji-u=`>FX+929Ojj8P{9HqsT|^lURiig1q5BNJl7%s*$x-1;^fAvC8=B=2?1r__ z?Vp|$L_^s6=WKdpGKqn3e(@i(b90%kN3A+~Y+t+QWqe4kUifTy zJ+c@{zRy1cT_stF>N^@5FIV=eZsv&}c9XLz;b(M|y90iq>eDv?r>F^0NnJNlY$LH# z{ASs=<9XxWlUHgh=8k2KVT29;k1aMwGV(3w9I>W#t`-;N zporU?N1ZqbTDCemI#kPJ!V@RepJUmd?VOQ(W;wQ*t2ul^FYJf8lM@M~(>A5Fr=eti zXDJ*PpTnqFa?=;<%!h%Pq*&7WStbvhX z<3nrSg4=1ZMTmVJm@y&BawVcyd(l^{`QtwA;r=x}PCloj2q9uL4d-h)Gn_qsQz2Cb z#`eU>SJ8=uhG431!cGxR1Czq|SZz#N%<5Qgbl&~lh<^6re2zb*4=-OfjthOes^*p~ zmOd#eFh>4RiilJA1b(c*hyJpnuk@;>Sd~x|p~^eQ$%fd6_NKk>Q*00ERQGd)?Kx|T z_@Pupsb9qISf1nX7*f_y9VwP?CyL#gmx-H1AQRRjUowF%V+Ods_88c7r|t^GZeA_y zPTcw3DIOthm;tQdRVvTJ*ifNFd`ZWmzx=Q9(uXnt2rUaJH7XXqxxmkU-_iLKQH{yu zl6uxBWOTH=1W}_vGtYL;aRCS-=?(i{Q(&OT>PP2V${I_=7Z)hhh*hHR2MB%ySlv(~ zhplPvbuUpCc-0C6p+Pl7G2Sbwt4p5gn`KlB+0FlALJ8q>DQmjBPA) z>Ktu-C?Y0=jV&{iQKK-<^(VNj1n#QE_ZI^c0|XIn=v<~a=Cf!hCOEgq$w?ip0;g{NVw!xC~+?%RaQ=ZtgQed*uZcc2er4C z+<17_>`t|q+IO-C#>>YsKsBUW z9xi$q>Dg-vyqk4p!g#~}S^T}tuk=Pg0=qt2P!Ho5G|y6ED0AvA6CX6&Yf}vb|0#A)@^azVR@53-oQn}vP94Y#n-Hoz zkr0Qbnq=?CpzlH)Cs(1EYS3+5f8plO9>PCx56g-=pSWjXCK7OVz=+v{fI(whOf*uV z*xl+aQkSsk0duy;9ML3`#N<5(g8=!0A>L6dcN9i8_Igkv`s>*~|8FcSp#5e*F5{%J z@uhrJ*o?uUO81Es3u0b;X<2S|ShM-$JCNKQ(Mfyv;-yxVE8+v%s*qp!n;$f5@%OVG zl_mj*_@68pRc_kR-!!3@%q3kphEBuaM!yy`wud{ObP=5`>dbKRIZnJ9hfHYfa(}Bc zrX8e#mHFzyKt}lens|?Vci>7KaW&E(ZFjS-$VVy{WY%6#C@lhKAOX58_(Y5&s~X|_ z(2NI3U;qAjT|3#JQ>jlEqn*HayBocV?-_1)M=Cpy8UX_iC#IMmX+R?93wyUWPSsa% z@ivWF&{N~|ziTp8zA6?v68oT?Jk4pb@C35yg#9mQgt|5%BzSLqb;_Z=VZsHW%7|Vs z=nka?@CBV1i9`}kA$e>#2l^9Ix9$#))#|Z#7WuJc*mPh)Axcf;9U>J4#YHh2R(|># z?(_1a!O~Nr8jBfeHe$wTI&{i4lBe1qD5TF-v8;kkIQ_CFHPunv_??o+}EAtR}ulHT(cv)2(b0Me~jgkZ}>U**9 zpx=4-mT)Ua609Q=bJ7BH@&=*w{sguo+@o%dq7J$wH6}P+X<8-uV!FOvsT9@N&!UgZ z#Ab_7mycVSVjTnp)IXLRZ$1gl*B>+5NdidjkP&*EfI4r#`uB88W=0MN;ZpiE)=`IsnXhJ9lKhOMmIn!@tA9PutJK5Q2 zw9J)gdwV-txRx>q8U(B+B&Y@fuVOVk_e)!)qhlE8#Vq9rjZSJQK->Sk()es(ERr!F z^CjuPIs3XziN{r|AWT%hTkKozw=!SZ0@Lu|M>no|kc>UwGB_~t>r9uGyIuHoAmi_G zZ$S`#SmWUly-_OCka!}~VAwCvuMDT(qrdv<_NA>WiJy?=7INuaMr=ex!~|edh1inl z$YF1gzbVMaboI|HAA?o+b+Jlz$YT?LnT;d--f@*Aq$`_v`VFh*RzUHnKy>C|5xgMj zm!EBmJ5*#Am5o*E3^zliz8cK2-ECYJzD=ZFHkB~4RQEvv5bGf0 zdZ@7D%v7!pETFMdZ*@oJbKb&7%%UAp&ZbUe?bS{?mOK+G-V#IK)DEocCVYtKG`(dCCz(H_Cr&e2;R~Bu_QRNvbZ#=XiU!DAL z-VhW2^H-4}DG53Gi%p#(H|;W;$h-Nf1KK`?8+1@*j6Rd|;pf54#IaT7K(3)h5hT??LSsq!y5p~m7vzj+x+#3< z$1fu!VnV(M9G1zzlF^0Os<r@MD8usm2)tAO6L!PK>5#XT-jk~0P2Pj&lYed1Qv6qTI!^Z6)Vv6^Oa!=M z&&{e|p2Z&S;?~J()v~EMR#2(b`YgFJ;T~TG6Wuk0&09==xkDc8q-dXUmp#rflq4LM z9V6Mx=y60}@E6t{We`6PBO6>bf|Yvq3a8D)e6Vu;%00T%vPMs83^ct!rNyQ(8;3UY z%uXPTosbt(oBJLg^p;<|e;(QC=}JRidLcwiAaj`(7n4vZ+8%`-{~6@K{#P>LuMh2l zf`iFn)+>(kI;EjIyUA_dgS7lSBshnZf;mLQShb|t0rPk+i$s_YvWH7HrGnYRA3H3%wPlMql{%cPDr8=J<#0xdlhtrEs8@nJj zwI5195mz%mA=VXd7wQYDI0U*s-AlK<-c75fGn(p#EceCy&imI$&-g*HLNnC!VY5A^ zoo3fSa7FI^V8Lx~r@ypu5K@YAZ+ouc7~P^H0+_I765^)>=YmX-$cAW2lUTRwED9EO zTPb+8brc0VP+al%pS8v>jd9CUqPkBURtl=HlxMLR#-TsE{2iN>Mu9Kno+aJ;O~ihw z2>oWDTdwp&=(5{FwZv3o@cK5eI(RYgrGs&+*w64|;tf|vj+Hj7#BR16K* z(^Su~CrR*Poa}=SZPV_Kyl2OBOyy1xXFEptMy_AaaV5DHaSe=-M zZxO>(U#etw*p}w->NVlBKHn(XV5G8Qnh}O6HV(};u>PHn=vaD~Q>gstvOp0}PXNR2 z#8%hERZ_~H5>iIUf$plF7pA%+F%sS4Tdl9JBVRi$xba{a%v7MA?`S!G*JpfB>luUb z-dAd$YMpVok^k3l%|d7%QZLfy563-OG8rMVOnYquZA?2WlXBDWpy(UebOUOq#JWff z7DOWG@CI)0OQL+4i7#B&18Jwjyj*jyi3rs!=CC= z!G~W>hmxN6gC0`P`@?;u~Vzu2-2!p5fb77`y*XT)MP^>VN54lx->k8wL5 zH(BK1MZba0nP0BO$<|04b-4+N93WqxMHKBHfQQWfa|O{KD~vV(Q$kmT*{X~?iCPlg2tn3*w|R#v%luY z%d41ia+&r{KfPKb=!hfTR}Px|ry2;bQSnt7o_Hr!=_3aq8-VNBW+b(DMpV&#v^#s2lgKG%HpjK8Ut5AWj6*S%q#em;u#li9gC+CsG%sM`X#? z%6o0*mYK1+HZXfHBMZ5w3;!9uvaL$vS(qELVM9!if^{f`-peddR&;#QsBFud^F6ik zTFulw8joY4JGM|QM>l8wQk7iRtih>e46v($H+J0PPo)P{4nM_m7it(lE~MfOs=L3p zx$Hi*F8u-UfGekuS5FC60|WB2*j)Skj>0g2{`lw}6As6WL#Hw0J43D%R!?NgUu}*- z#e6eVqgkthMoB+v5L?#pxFSZcLAu9IWh zHIXRMcI#@*z%r!~Uc1{>)Z&A5D?QYbo$vF&x_mj*mhC&P*ZPXxXy}SSg$2QgKJ14D z47$i=G{%p!FR^6I8^?OZ*d={TC_)S`^L0MAE17hOzqAx>&}|pVa8WIWk#SdQ^ms}D z=l2qq4{ds4U>t>K?De}3{2U5o2(OEUtBH&!)tjGsw{-qi5t*CA6Zb>wi}aHtW)ZYV z0gCiCssLs3^H!MxcVvgM5Q)ClR+QD**TMYZDWj@4nH6tn_hi1f?=p~lZ(cuwxbP2S zJrrioH>~H)Kp76kNmdJgo2N@<#dU_G06HUC$Hxo#*rCz7({LpCw`TdLFRz*SY`PcW zMVs~wBqF9?yO>~odN!$1WUu8(H+q2NJ+hTW+i-G7#IqtL^Xb~RO62HY5@Q$<+j4QJ z-UtxueAg>R5Azk}^zo}f&{{`}vDQr@6UDZv?>Lv4@*BE1tnN21f zmo?16Z>YuHEW(#)gcGXdhhdSC8}qY>iv`Jg(j}c&2RRq|uzmLtB>vI-I#e36>Kts#p%{+AIz~n&b`%sF!GgqJvAq1{*K&r;W97B_7(9iHVOL zN)1_M?MhR4p2?C^)bu$j3l}&(A@u|~Y)~z(|8cNSzij0i-8Rs|P*&lXir1f@x0w93 z=T`t1iiS(p(JIhdeZPODuo^MFQne%Y>Wbl&qot?{kzy%IX5J{oF2ACF{*P3w%-MW@ zC3HA`pH6r6CJqi#Jk%iyBac%WM$kPTo%&!GMHD!!(|NV+`Rd?Zxs3iNeI;~IMFVLP zDylzdO&1nRwF#=6fv((-yg{by%{yGWiZ|9Lx@fxgi}}$THlmf&&@HH?fO(Y7d>>B0PE36|&fk>dpIcA-hbH8s zIZWxq6i-!dC9oZF0%j0{J~HV zGh+R(9nZH9S&avylW5_u6Yi*9KEzC#pu77zV3@ouqPCwR*D6A<-!LL3O)J0>cZn8K z-z|K3+Q)COz`6IWqP8`M*`|NhSB~85?020_ndp(e^?&LBK9WI}iV&~g7-91ov$U{? zDdxicH5|-mU22s_n%nyXDHX^(l~3ZzvPvgDz$_B^3m_N!ziOd)$feV%<~duS58Yub z*HHceJ8Q-@169Lyl+;!G?T__4FJy5En3fk%(Ei1>UR3=)ic;Qtl}M;m!Vpl;teN8# zCL{0eh}_!t6{Y{gsOHU%wt03HZ@+ z4DhCaamhaIKz~P(frEozI3AvU3yCmdx!Pi9uEK;Ay;$a@cKG8aCbrreoz=Dhv^=4x zTdWl=XNviN(QLy*L-dmGx>)5ZFpBzBA2uIu&$}vI%)Y-|I)OcAXJavY&uN7Jc^ZK3 z9;d3#^?Dm|0A=NIDHjxwRaJ{G|4Sk#C`HUut?Vta#$tXs?U0{cDOEi|gcpc;#npHdZZ&0)>+1)l2Xz*2EK)`T!;+@{{?xEZJy zJeNxQf)xy$4?gnn17DcG6o6~;P3vf&>qCKFuWSYnN5^4cdM7Y+N6Jtw90Lt4 zKFP6j92u8CZiQObv+xYaBUubVqqMUdQ7n9n@b8b5mz9=w3_x48zdrK7PE5quGn113 zutpSP`{RfHi$Q8A=WkOamWNh~p9f4oROGVPID+igQc|M&D)#VBp`Oz^;P-&~X1 zNcAD_jf;bF9zJ)w<~;hu6+SPjH-M)*19w@2fcP4VrRpWVx7&HQz*GShNn>M*J?fN+ z$x1e>Tg`I9)6GpoPJ_HnFM*5Mm$eVWabbrlFBgvQ*vz6+&183_4$6=42Am%LbNUx)S8XR^@Z0TG5 zy5o7rpBGXN@PH|z_j5!0U;ExiUl>_{TclU;KL(B(qxUx)t9o8uBF8emuWU4D{3hLh zdULV;`MCTRkasLL80~ZX>OQ*^XlaV>O}4B81z$?io(5LWtoIg8Vj>!pPWkP{;HpbuKqE#s8RMYEjCu93Y# z&-dVhF1azkDuMe4T0lC2soJ}6>@LYbb9Yg}_P|}7MpUawwmlxNk#dS!-N~!K=uoLry$%CM)CD{v+ z$lp=9<}VCR(N+x=0ERoRU_s?90*T@`xS|mj3(ec;FN)@e)JQMHk%M;V>}+pZb>-N)VQ0G-Ishp%@@- znFe`jke&}Vp09CrJ}ENr@p-Jthi+`3m6{L-1Aq(T9sUqmol!wG*RuI?`8%jduU1`s zwe0SnGq-4${-yd6OAW`~0*lVH)pdZ?{9S4L*wa4 z8A(u`K9-L>=yC7~rw~MZqhK=neF0IfTuwsl{d*^_I_o#41E&=dA9?R_h2;{o_(@s| z9||t+j*MT*PVp+u2%g!@W6}b`^}xc@nX100Q%CyPCD1m(=5R;%Ii3$pqa>Px5jfjb z@~;!E6)!3|s=xLex04@E{5&eatix)ru?U#lZpF!{w&tt%ziGBJ$AAGBj@w#}(~VA( z`g!&2fOQO6xp7e-F#V7BSli|B4M`9ZZfatpSW-l)NQ;~)<^#Q4|7Fw3O|%Rk8|_NW z78|(2qeI-CaAJynSd&kBZvccyIQ;e$5vKuC_zZe1i<2ynJR}n6vWYVy|31rqgm}wX zuYMLg^UI;f_xeYEHXeJiRzsSY89uL*h@JAyuF@wgXcjv4-eNvC;gWJ-2}C@h3z=Hu zk~?M{LKceMqEe*oXFzs-XvY2HDNmqQs_)`|j3OB~a|6~coYCLEZeIq!VcqfFml+M+@Or7lGA!`_ZDJ_WNA`l-{R!^-S2rFCeG?&6J9C?=!FWw@<>-6`PS3JyK? z_7UN-c(V9fPDVxsqQKO%McwY+pKDlAy~NGjJ${}cy{!^DB@YEAsaiGqDi$m4Xg}=D znbl6OICN*l1R2!If%=5G%ireUMTdm+HMt@So9L-*u=#>FK#G<}jp^H3T!8Dq-}*ko z{kuGW5x32_JzO3Ma0D{#{VCf6G;vHp7@lWvyBelTj5O3W=C{(H7J!ARzIwx2?t%gz zc;umO#al==u*|iytLwfK%NlQia`1MYjs@q7{G>2MoMIk@0+39!6O0vLe0Kpn`supQTY|bDiMG~;C4b{-z71{!p z`gZRK(_~0O)nf5GR8o-v!2XVP;I2|P^>y0LbaEH=Ezn6eiJ^@B`O~!X;(!ljDEORA zPpS^|sG9qi9S+@J5Ww7CDUbUP&BdbqYhbP~Crn88Dl1QZ35zUx%Pr5|>RU`^M77o) z2UB?h@w3JL0Wy&M`5#Tkevo5rXht>{YU54??jf#77Ft~$%wX`9^$r*6=H4v3lt3^F z>2iDsHw45%d^aZ>vpOFmxLoQr+^aAbX*ivhA(FzWgBVub>I`-mRC6I_y#Eq1^(wOl zb=F~?V;cljZ25=8!a5@#kxNshfHxv?s197C7cvUSeFXuggpG-ZL&~&Rswd-L090vH zF!3+)uY=Y-RO|re;SY0zh9k?PA_$F`v*2=#@H>&f2=T(Qz~RpnF^AzbG*JQJa&Zh= zedNo&*K<1#!MC}lU(>+@eSNppMsH~e^W@C!vU_6DN z%&kL0q@JBuQT1n8H=FMXNubvZiY?UyQ@H);rBB@NC(@5Ej*vsR+8u_Z4GuwK>hKnC z&~`|B2q>ICXt1#U+@#zRk05ZnPxZP#Jhswj2G>+9&%-lpmBOk#)P9?i*(e)w8TfQ# zhIS&w?bvkA|29~Yw?T=;x^Uev9S`E5qvK(Mzq-FW8*hNV2(O}lZo)6aFQ*|q-F2H> zx+9Cr_OM=qn~SEP1a+}`|+skJOU#6rh3ewKw?*j2~zp9>B)*+(wwctWZ{!ok=k zRX{pAd$@wz@qY1o!%|hj+R$m@jTHvwa9>!Xm)R{;m_N28iuTafsG+e1Fl4=Ddl+7WQTMCUnE- zK0+&aXYCb+cJ=!$-DGLHQu+6f5H8Gn9A75EsZ33Z5##1PG7!le5@!~)ejT4|8#K*x z7T=LH%_~O4x0Mx#Ymuwd_WZ7Wn9@nfGQP(rlrn2vp~`@|c~#+tzAK$cxS$7N3j#-}yvzzd&Ub-^(HLXhHQj|NYN@eEB4xK=__J_DSc@?ex#zei&d8$HFrDJNI9k z0f-i*R!tID^7z+#P?5fDhF-yf!8- z+X0aHq zM8o3$Ou5a#yJXNA-Df9H;;Y$3%V~6h<6_te-smL>eQ*14Fq=qOk1SAb?jio+NX+5l zd<56Y@bdYI>hwG=-Ej_<$<6DB`=orq1Z)r4CPK1%<8^-4*J?wJq{I7R*%Xg){08K- z)9uugjgTE$2@}Iqcn(I^{l)H8;u4+@fF_1fBlReJrJOgkQ<7C<*tZ%6FWjVZonAsRJy&p>hA;Ei8slaS_P}AJMEgOlaCszDejA!&PrrAn z_u+hISXwMPL|c*!x^E+RtL>f>VcJh_`YJ9WaL%pBNjw&0OXV;N%W1x(A`Vfe=pF6WrgcBmC@*J(g2 z|N3BxlZGd0qOg!Iz6*kFJf4}KKl9nU4Jes`-b+>kI>&hNhji|N&lJ7`>x>IO<&tZn z#&SlGBffS>eCNN`Zr5tH7&VD;&#=K?LnKXzkun%c>3}~5jib0QO zCd`9t6To`^M9Tg<1uP;Dg}}KD`uIq{o|#<#^?s)VL5xa)!;hL1RHevR%z^pL*@O6B zqAiN-&{(Wj~ zRun8-DPG}Wo5@;h1~1lA7W8w%f=AZuYd9MMP!o!)tlY8BA1E_*21~P0ROtNiJ9X*X z65^T^>zGj_!hE&J1tY&40(y`6rApS&2)nN~l<(Dv;eO)M`D2{`;4F!uaz9=A?!g{I zKW^aw(3WBu{rWP+dmIlwy(_g$LEUBJvhVm9{pL(+WAxRWUEr}7m)<rXNMrN`a$x*NXZ6V(`@#>PUG3$(kz4Tcdf3Ue*l%6 zAU5U4hNGG5hr`$Y-CEbn&&NRoA~CNF53bRk08JWEG35Sa5B0ESSO-3ifjoVT2>xThiX=k zBielfLM29SbJ+oUX zR%AfFUA$hC-OR%%C;GIer3F^XNS(yq3`pIvYP=+nTW4Z1goW>!Dz{qkyld9mFdmN` zC=eukI##lncUY`2IWDjQZ`9r|-|tlgcxhB(G2f2>!iwC_NB+xpjE#4IodrDCY!L6o zcSE(!t=jx@%>ynr=S$E4u!^)e zzBo-9@Wvd#w>_KIN{cIr1hW|L$#zMJE67$*4hs_3IIe>M10t{?ywb!e+J3CZ8+QJUNtGrAJ#C#uNw_w|m|8)m@aybL?S! zF-`s2$%BEc+JnZGS};QEJxK4DyM;D6vA9rPFo$Awj`LMcg7Jnq@H? z9a1#<-V}Q)XP*TN758HTX>b%ho1aD@`I{a>5%dX-SX+A6>`#{HED*MC87(Q^XYT@L zYZ@ZJ`P^=nt*{OyrAttg(bT? zJL|D91(&!oFCyO(04=M42GLi{!D^qI^}lnL3uWa-zQ02c*HaO?0aiBUf=nRg;6_^) zQxF8)L}r)&A^NZW`jEatnVGbg)v=Byd`G*@7Ux~=ZR|*6uc@cva1NkZ9s`s-7I`NU z&3r&pF3eX(@KqLpGUJ138K>e)-62)?aP-=EbZ97#;~nDq9#8& z*jk-Bh>@0q)cs?sGE&KV>5f6wVq?1Hgx;Or4c~2&ri%WyltxLi1I-QN$Mv2W@gYNW z3-|~Kzko^MK7GCH!Awj%(hejNgp~q(nIxyLT`Uoc(6jfw0m5yQp;(6QV|h3IAiuSk z-(M(ovEgmiaRDYiS!$4GFp|I5Q`hee9V#py4TasV>|dRzUuKut5MBRXF@vGMXE@lk zJy;eCRRRN7^h;}7-gn84AV*sR=SP8%&Lbd>q1W--52sH%^qp>Rp%Y{G3*c**DhwZAPAKoGo1eUBmJ-%I>Dt(>3b?Ed|iB4U&^}Pj^$}_%LaB&lL_eg>V)R16evl8tE9{T}NAe~Wq7nfKok5DJ6Z<3!|cbt@B zDs~zb8Q%t8NBFe(yx>UoVkH!%Pd9$Kt$}#O5p^f)V%v`|2!O^yjLdeHhnD~XWh7`J zMh1PrRX!UJE_7UNUMhR3VDXbb_vlmp<;S#8LRXwtTWvtg&GIP_N7b>d}D znlb+l^A=2ZxsGpU8Oy-S-#3drBphTkktE@>=xi*7fQ#*D-|mYzFp99wA$YT2-~Cb~ zeZ+t%4cr%qxb`1^jnn+aVI6e%6)0)US}p~aM$?IWF1N4CasQndzbp3r*VN$fcb&Xi9DEPcVKkL~mo?{wzy(9V zy%=(AT&+|oq^D*wl-7S&sqSf)C@Ox<0Tp{-Gpjdb(7QZ=* zJk~ScBI)O={)N;&jD9_Dk>JF_iYikq*M#Q!5Rz(y=^^!|S*V2aq`pY(v*I^^q5xSg zJJC@CBIPcDW8q<1-+ib;viUxY|89PVId_0AM$GI(H6V(CJ$YrA7Ix6ygc5=-D~NMN z-=^Ucju0sXM&C;%ftTjaU3AW|<$|XmFO`GqN1qE`>lk_N3<7Fmk?rCg_fT2ce{W# zbx;;X5zE^TRyZs8Scck<3!T5@(6Ho)D)7D=H<;k7Y1NIG{(1+41}3WE@j_kXuEtK|fz*WLWQP!JMN9R+4$Faw=Fv*yl$w)ba+mKl^ zI9uXtsS#X5YN^v(%S4?itIqjKr{x0Ow*^z~;(R8g2KPvlql1LTKrU^OxYmni343Gx z%rnjSk?Ui;ik6j`8GBHekxgk1e`pgCfn@4=xj* zxu~|>tsB*;u+hkvFG5wIX8P+owcpA(T9z@?7BHLuFqGE);wSG*!saVro!-3QJ%>M# zf%3(8aGi$b8!Qv=le+Zw@4;?ZR(zxJfqKdvWK(`Ct|y!Crj*lBuoWWT!oG6_6XnjS zK%`k&Uc=I{qaQ8!6Oy8S_Epmd!d1e2hbjych^-xP->=0Oa2w-nFKl;7B$Y}dqJfkr zUZKm)Le2(KL5}e7?m|)E7BEw7C4d%kR%?o8S)LV(#iMN1-kBoDy3dPG!ANzt&qIsT z0%Kx5H}p*#6_L=fE}IV%AuJF=wW)hJSc28_p#?0_8}(ls4VC`j1TJdEETXZr-|B0X zWtY!}5Ie{zx2XKn#sS+ihT zs28(SXi?noqK`8DyOQ@Xx(xHG+sBUd;-kG)`xWqq9PceOSb&`*j(gzMX?^8|<4)EE z_f}-+=g=T5$G+>Kl`J>sb%wg$)!oulW3^JDK)R-E(#1^_krC;B?nby^L3N_ma;~fQ zWsjge#w#xLP9Sx-=vYUk5E>(6X`W^R;#yi0|eu`MA9F>uzbZW5#h5)9j@A zhV%o|sg_}ujEvO^71y903>8`Sfb+WOZi~kkqVuImpj-|Hs`22Dr&|oW>SSS|N1f1B=xH- zBz4fLkrWu;nN>fNR5qN8L|@Oa!#zy8kiP<-&TnHq3GhQ#|B49fwTsK-rtVqw#S9XU zr#%3!a!kdm;lG|?A&Z=)Z@Yx%Gkwb5EJ;>}l)KO?wcCG_sc+9srE%D*;p z!mmL&nM)ybo!!P#!e~&?Dy4E<^@rt8MCpJLgIC|^KJ0WR&cafG+vNA>4p3s>rZjiQ z+NKI$i0MH>KnypWM3JuUfQ^sJr<*2Sy?4&RTe#0?RBI1eAvLEjIYvSlSiJhtHY?pN zo*IMAZ`P&|r=Yuleb2j&J3!?=o8@Tct$6zMTKh`k>ikWe449p61Y+TGz-Yldc5qqt0>3t zNbZUZba>y&~?HQ`3Z`S3W8m27;v2hm37A@V4^*}q{N**4pg+A_+? zq7I;QhK185p@w@Ou|jYeCgJ8)^w;HrPI%PLuwI`EGiVI3@Kj(yhmyd{m0zD`mdrH< z*fO=xOIQA;7Xh*wyk$3v5Ji(_B~Z`NeI?n@*TL*xrm?cgquc9!N3G83lWf%lkDJ14UWZo>?;}q3JJg~Q0)9B&~q3e*+! z$Z+7cWnIw-&`+t3Vd9D0k!&h|gasLp-;Q3L(||!Fym0qMH01IdH@vO#MFU&pqVZ7(%?OuuX6em zN^SG4>O~|t{~=l|Id#?}H7NF+lTIwrKeFL>k?eq%0y6N0R}e76#5qBg(s~jr*vcuI-1Knh8r! zP8-CooyR69E3#=Mr|eaqFSUm$Ns8^xM{|EjO}K#+j{BpB(tuY!IqvT{PPGwnO<{er zHimZF`2*2=ANy+fUmE|qkfo^s-;IU%8^sr!=y;vKV?Dulyy~gBrb+&dS?X?8JP^oS z=5j4rcF`=Eod_#Ze1>G{ibFR&1MI}=ObKV@%&kJOXAxF1QrwkMHN=J{K`t^1rEKF9 zSW3Q{TTAZ4-I%h4Sg2GLFMWFhuJsKNFqo>$x-F)(=guM7{h1SE0kspEz8$`igbg>q z*C>eokui0v<8UKy8e3N|NH*~kiu$;cPCa>qVfEL zi(c+zkb$VSS>4%7!cb}%0NPZl{O?gPqQI7o0yjwODi{8}UH<;MntVVpsTx@%{V%$P z;!_|hsCY!!_%)b+^fG%1mlN=`rHn3&z9j%3Zv+9R?kQ` z`BnqveE z(nAhT^X&Nwe+7i0b3$NaWA{;0t1kbt+ZiS&BTF-)$pTb4t&FgMh?CQNc2l!gXpQ*L^mx zBjNjvA>Oqfv=P;a;a(n0b8X{km-qpQuZ(e~+s&+XC{;$e!+YWeOah&bv(3$LOJQu^si;YhbVPZ#%UdFAp z27nnMy0O>EtcwLQuGNDuV(3Z*m}17w@L0Nwd6_m0BUX=`#bmO_2tA-hvbv9hSXuyu zC)%oFh9!SYGaX4v`YQ!gkI2j7@FbO93kWt%NSqGf5&1a1YcTygkmNl3@}Wu>%VcJZ zP^zKdk~-mYiFEjqzf~d-aG736yQO`o1u5E6n=Pb`)|MSI1f2VUa3O&%#) z`S>>(-7&mqg)$~lxV)YofYhRShu!yj>zfmKjE_Op#zXZ;sr5*BY;4rjb3Dm9{gahI z@U29R`BdDoQr-usJ|NraLke3CAWw|VlVwG;1@y0g9;m@!`5~Z9v-4oNDNi;132-Qd ze~Z{=qoo}%Dti@vVH6fAzbl|?4Wu0HvD8Hl3ANK9efCk8YeV+d-Ce zx`*Nxyi8(D(r>s2o2y0o&oynMpR)px@!pG;4-O7;+wFAdZSI!wIv(-ZZ4cr*EpeI+ zUKc~Y6a!%|#}b#awxhScLCH6Iil>7lU?;?jWrkDPg~ez7co4fQt%fRx7ftdxv!%WT}EFp0S0{7gQBLcmHoxCFS>@ zsOkfw8tkW~YMtHZR^4;O$h4}kE4k&XH^RQX{0gVsorUvYJw?l|z|rSHHQ7-oE0s_& zjq%BPi`d``irxYDQ$lo%046C4eJ^{*!{ZpPRXMgR~;cftq^4kog{uVGc03|PBoa*8{HwN>C_0J%C2hFFF4_c_yvqBA-h767|HA& z@5)8j9(?~Ml21h+p?^ZbMQnHGedkY4tA#U}?gURY&In?+8Wp-hdKsqiY`p7=8rk+X z@S@~20mB$p;6i*C?Uu%sbk5f=YDa83EFZ9WK_{PlY{lhAaGOi7y=KA75YbwT#GNNj z(&6Yp4x=IvmLNhANJci7UVvVYHh(E^6fEayIiDz&(4zS?iiP>g6`t&%|Dx+9q%MOE zHDBv`-|gw@mGDNf+wt?YNMyj1)Aq>oJ?!)O0xqH3SsmcY*?Gz3p%yiq1qT zHSR?KlEFqm$%)Gua7s$@7;DNvR&*(u-vzir!Pq2<_`gSttD`@nC|fqJN5 zvh-sV0%C9_89@BMP#nKttT#iU>Ec;+-mC2VBv>t92<{RqknQe|?=)Rk#mTzq%rd1g zV>RzEmD_VR;YkL%lE82HSuN1MU|lAhESNt}bi?992YRaLLRrMt19KZt)v!`cVR3aX ztsaFt%-S?W*DB&QU0=yK^cs>hDI(1Y``ozKSF3vq(djS_Cn>ZFiJl?jc_CZ|P3`H* zawH{1WKmE>>5&{9ksK%`P>eYV$zYH-UWx4zzpA4$T>EuFh?#yiwh|er5 zHf9vN#-COe!hHyxZLyFXz~HDj40pZse4De0j0jsTK(o-tkYHV4ZLm{y)-JF}b`{iz zZH81Nks%fd?hhB1_qo{@i5s7UHx=<}Y-XX?{)27B{LQxdtp4xV7BbTRiEV9izpHhI z$j6P1@_#;UB@IumJkb_IAeoLUQQHbPAI;w*jpP?INKi&;K7IS@iuZI zZw2HqcrT5E@K0($#RaJ9+`JR%m6W#6XER}H)k%_&vSK(fDWE^wSG$W)!Q+IRR*wWk z{$zryu~Phb5CUHC@n9tfPAO3flW$ZzS!6cM`l{t=zf6 zdK)s*aMhoQ1(XZ{6kCOmRuEQ+@T$34qP@O3VbV)E1Jc}!v%5I8?o?F7zF-4-;_;3; z-XE*2GI3UJxvhw*^0Oo^vc)7@rB>?$67bBZILpgfktFZONcm$?NQ1SID}L@nyr%P3 zE3tNTP>lG+JnfC@7oiTT<%+A*iOvjM-VrQ5Nk=Xhqb}qtovp(5e5s&Cp%;Ppz^qFQ zDm%1&1GKl#zUh@qA_RxE_aLsH(qu<}QBwtTVj~lNaZmRA*?SU|a!VJ;OKhGk#SPLG z$cY9I4xw@6D2uXYgu@r4#$Xk&Wyy-4=Zp4_L1i;HXly;wGs3Ca;YFgjW{9c?iC-T0>B3m;u7V?VbSPB}Eon9VYe$cDUSd|!uCE!(5= zvZhd!)jf?dg7NQA7z31$WZv%vc@`cPrbpgif2-MGAdkih>kd!%hu`Xp)zhSv8qN7S z@|NJCWFP_-Sx1N$pUoMo*%wH7vR3VYj*5GUOFZIpbt}=2?D(=9PW%8U-q*WLqZ3+p zp-7m`$>1&+ot~GHmlmkkfmvxm4px9PF%DWPcnj49i#SvZZh@)Ld{WX^hkWbHd#%>T zsn0(HOy7IvwK;daG+%)9SjP(m!hFh#YGzzykkRNJ=$_v%9(~Z+d^(!D#l3+QL zBb$)nEa;^2zU;BhEV{V zvp&W(C}SgP&usjrokBQF{%0a4$n?ondS0zZ^q`I4~ugv|xV zS+|B4sF1DDzi%kt~itF2GgkZIaJ;;?$h zUhB8cN{TEDqm&;47A@5=OkO@KWO#>_zLcx??-n5*?Z2M{L z%9d%RMu9Zbz;vRFPiVS`GhPI4cYu|ALPl1LDtL3VQG$<(5y7PRdKuiysi<#tH*^dP zNj|y7)PX-bP-to6WNbdm9f+tgj5Vg`7GsUsn&v&S7&~ha3CarYJD&LEz#BtOvHiFk zbpUv|I3M<^0mJu&kLL6yB>Dx7P3|YaXs8E9dDp}Ru*OOF#Lat9BRu`oG zh$1;0{p#Bo41akxIzyeDgkTd4DEJL5-{-9e|*GBIn*>!%Y5A z7R5jtKoLAjmA3?u{jz}Hh_wxamxm^@`VN7DizbZ`ipvo1UFEF9l3@3} zxXcYl+oSx6otdb_ZyKZm>mihZvO8SZ=vR!1-4M!snewmx0R zN#3LVd-Ft(41%NUmhtrH6FO#O+sih*PbqCNLdG(Hw7FhuA zR&bT+aieM*l1jmCnCq~3_Z2=}Ve)Nph;lfMbp$?L zOYW#~hj1J7cldSE1IpJ*#0C9XNh=1OyaNz6Fe_WkNiBNkGp&Sgse158i5|KyYz*X| zv`an5-3^~^uCA+owYa{uf$&oyki&8G2{@^~eyP7K-)uY3`3Yy#alfDN+&(c^GNpEj z0T?<{tT;tqA*}6F)b?nA2!(3mO1ZO1`#}_mfe{)>F#UBAWbS^E>yF&;+-OXD;^{p3 zefNcdlFNTp#;O!O9@61qlY`Dm&cNLr9iM&&wNR9mZeEf5vVdUE>LyV@!Zm8Jwq;# z-0?d2*h!5)38YM*!d`8l{g8q4~{3g^;RrXsB zvmR*^wqL5P>RbbecyEzT%YBv(73T^__Rw`FJK@@6gXW8(LkO=}kQQY9OrB&nY$#b-Ap=<#(qB^t!IXo)Kq3`d z!5|(;2SXXxRdYh2iIsdM>E_)&!P=X>iN2*QaQ^b{6Y6#??P}xPxWuWES$s?)x@Uy8{=6%W#;8UBRyt{P1(27TSF!g?A zC|`s|fb`uZ2}y_N4+glaGy@oC|EboZG;uykA^t1uG)XIul{REnh)O}cLdS`8$E)Ca z8^z)HK~3^K7Kn5!qE^b6^6A@F8`Q{aq7DmyG)ae#W$PWBN4kI=_3^tUCDsmvq#e;Y z^*R~lwgP)3%`A`xCKz0xG-mHtVond``sU@I`kl>v@nhSE+G1Kz%_OKRl;FOCELLzA zzuKr8TaX%rTVUGP4zOGt)V8O3TOd6hq)6TB4cJ%xkr{XgQ|dut25~I(9>hHe5kS&m z0V3vb9ptKhT1}1!lIw%M-vtBm+ts(hT2`|s3jCrl9nbe2Lxn_uv;!{n67UH63a<@) z>1De}N<0CkBvlLCZ@pcSw8vZiKF!oz77z_dF6l?T8Q&*jG8yry^AzN^vLVkG8P3=u zNoUzBUL1IcJ}{AwbUl{VbYE824}?ZZas%kgtxaf_jx2bz6iBNn8=?egw}`tsAj@T$ z&sLY|oS(K>2&suw?MLmx3vgjj1Lr-uK+a*M$Du9$O28V|9xxwgE ziUif`eb_}}y~v>%-;3sB$QhaVr?Uk%%S@lshDdE&GPFd_jsMxGP<&3hLmNM!S{E$w?x?n zlU_i)Q+J?v$E;@kn-8P7J_CZG9$gVU$2&+ES;uq#y8-ZtILD_pNsJ0f(ue9@gSM9$ zm_sXqIaBvZmIh$HaKJ@CCiE>@reLK-A&ZuS;D&;G$w{{=0-$`8oQ;nqO-aU3WyeB< zC@M;zm`^faf1x6w_P@@mlcsN#M77dO3O^^K#wH>uOGS;;Xj2~HMS&s|4b$9oU?0|Y zO=9@S?+Tf^wNCHNKJCuWEw&Pk@NRoNqq(jm*svBh!OoNkdvA`WryCR2{C?R#oQ=BY zv0DzFaJj|U0jeVF*qlu-bkfL4TE_Igew0k5KxlBYRJA`~%hV-$q}KvIsOk9-v;x#j z%on^4W1u6!SleA`O_M{bZ}US17;Cc94cN|*dSCB!Bd)0tw+Z|P1E|MG{$np(bl=yS zU0u`zTyI)1Y$T{G>|bX(lEiyDa>K&I4en7Df83O=1bCF-S;lcL+Vh&uavRQHB%%jI z>A6YipS-8LwsbkL5h~^4jA?b#y&{?OLlzj`f91Ou(zX@jL_!qN+g1F%x{}_UEMUV~ zDy}qDKNIhms8o26DsbEo6F^|+1H$h9fy8gh$kvslS^SADDm*iLYelo~ODm)J6c?$D zdG%MtT@U;u%^8Fu`2)2?c35bDyzZz!tZRGm#-(~aMnEu%-bRTw+1YE>9-{#hl@QdP z++ecqSsyZ+`}Ep_gna8U`#i{AVew;9o(obd+LK&r-C4&ad)%eifiTNm#xT*!DCBo~ zkrmdjL+M3X5J--~mv4zU|DC zIfnm8G?$7v<}~G|5hZkyTf@ZpM!dK^I?v){^S+#LKY&qvR&qSUs8RTPLMe4!sIOXv z1Ja5$xUu-Q1_^3gr=X;Q|{Lg6DCT9Oripxhibu!LO&Kza*L4s;oEAc0{DwFP3{t2t(kMis6%a{(JfoeRflYR&|l9p=TzUa{AsW_rG@QQ_slsMORNMB7bUNn|}G-|Wpl;1_pR@i)Oll8^6m76I7M z6PfP1+N!twhG085M4~4ghr3xc3>_M21^Ncc9GH+58+#b2&`QUEoouk$)dQaLK>3@0 z^`-eRv^gN?Qk7K`?-m=deyaML$Oxi>Ug#J0WpU}?#f3dx-a_?pZM!X43sRcUXPtUW zn$YC(A5``?arqVn_*^k5XusIMV60b=jnAwv5j}t7nl9jBO=diF_P;YC{y{Y)fEOxs zP(tv7;sfsB(FTQL|Vv44N5KVmAJEVv3V{=f7u z{}1^gsJ0&!{Cfe|Cbu?f?=Ksx(DQAP6_8%7m@n@bFhk$QMv$Ld~B*+Gm1+jfdFni*zW3J1gzV08`|Z5;owdTM|VaiA)ite zn1fG?kV0!Nuc%?U)~c=7)Su>d<*sN}ycEt|w}TDiWP(AT5}P-Y%H@D>S@h#DK>7vA z`hX;eNJ&Y#$+!BGJ&qRZ{QWyCWQ{HWm)i~b%WiM|>%oY%Bc-cb`yF=sGn!p|>JjsL z?`9n(s!;Lz_hc5=@b@hG{WgZtVg%ftjt7HiOF@L{)%<=T`7(7j5-QKfkstx9TT@Ia zZ}ok&tt?NC)DK(~#3r+w8%+}US{39IMN3$L$VVuYQg!1ooxOqtTH9d!9 zWczZMwF0wG50k4r|F1aN;b~vpvMYTUM3Xi3$=}GYZm1LkpfyrtgOKxu}NB5EfEbQT%gGKNP7Esc|3O2Z^=h zU)y(cGmLHhFW%lcIpRcqUYxHd=fg^MMy+}*@JE95P}$x7 zq{w#SY+UCGJyIaXOc9nrWE;5aJkY-VOZQ14g(560^q({_dB%%jHUYRhK4NhvgHgtM|6Z zy=FRC3Ff*wsGl zM9qAZ@~rf-Nv;_NY&=nGkS>@^0Q}RX!?2wDx680OD}-oz9kgQ#MApoZRagZ`~EBkICbQr znTsZ!;an~`X?YjRyO|z)xxdz&k;g%o)CBYF(yTy*?Mo)uCGT)oqRWErBi)oJi;@u#E7L+1u!Q4j$lEPK(TcgZo z`DbHEsQYFB-3Zv>{qx~s@U-@L4D_j&iM6}n%QxlLG#Ux!>W-9-S*3FA>bNhhNWyF6 zRH>#FHM{CGa?BkgdB>T^$!%n;sd*yRAr^ani4jvpCM>Mh0=;~-=Uj(f_DT7qwVSs( z=J>B?w`bkC@9VFz@9)03-Tsm}Jh(WZiaEu+&8^o@C)S^8c?kgy({cJj(oTm`Y8*JEf^6%y z%|PS1PENi3lE%RSbKGZVw}tfXHFj_9)fKknH`)@Ic6FcXoKh>_|Xn@+3o{#HO%>SyHoKG)>Fxp#A{nNvsHrWizm{f{FN+TzJCMp8dnkJ|}^&ns3j3q3Y^ z+N=66?K;e*Zw+wl(cw5k)HQ9j<5*Nui)&Z<;O})NNuh*^Nu5VV?Qi!oFnM@1X8AJ? zKTNhazjL;_Vk;630A$0|$^{R-0IsZf#~H(Aucabz=%)V1#$h@(7ba504ym2f+B3hk z$1kcMgNr@p#|qFhBhi%uZOS@iR7(2vns)@~wGpL#E?DkQoDlHQ2OrDkX7*e}#&6u=iwp zdb|;46#@k+B&t~9QTytQh#G#daNVB7sfCeI@*k{3sqC1jco&b?ZfD zvx2>it}DDh#$T-PdF{j11_7VJ|8^3JqIOr|t3f=D?2=sS_Q9v-eGDI6G(97-&+v5I zcL{$=buYX;SF3We2eCkXJ#wZ7I*rwNWVV4CD3(`=geADWsqtohNLXg>_h?fWlS->m zV1Jk+2vY5R-c0_q?ui-mb*d@FvroFz&v+BG+@?FQB*n`Abu|)>z}u(mu1H!DbC*z$ z10@kK+^P>#L!Xs6RN4Y|L#mt^t|~4Mkh+rnEpXCzCXr zJea-6g+DuXE^EE6@~81=$D7TJ)H;@Nxu&CPh>gg8d(gSND9;jj7dj2zH0AgAc>c)0 zhVs9&o$P*Og&7nIDjQm5j*qD}Gvh&)0!tdX=YXVhqz5_QE)bQ@6EuvRMNX|Kh61ZU z9#c*(-ls}JA@&)BL%xNfPBz~5TK~?koFc{a%zEJR5l-TVLQ0CKik<8Oh6LXPRqGe! zeNzu~_9LlNB96}Vn(NvOMmyUiYmNo=bz1>G*t z1`f#z{bv(c>>x9Iu(jXt}rWf!k6@Uo1^K_kuPb~rd$m^Hn2I&hEn!Vq_S8LsmVZSZ|vtr zmUUzmMi$MNQY7BL8--D#?XwwGFH)iplOJ~G%U%sQ^;~ZQc6l5DuA0HGUl!_Vn@vdo z?a+Y~Siegkid53eV!YDyja&pgxc?bbziCMSRSlRrjRji5eciVfX@qmb0=n8HfXcRa zm!X(TPp;}K-v%J+n-REym!-DnYUYm|j&+|bT7R$D)=FCjD~n>M2r^5#%cZ=KEZghB z89e5CnSGMp%wt^hkzMTmiF45GautI$lg4WM*Ju3Vm884|%jsS1FWhk7H2Mr=`N@BJ zI+pG;|7*Cao&|dSk)zPrgz9PGX~S;usICdKA&M$P-GI*%AU%vsGpsD^o}o(f)7VhD zFV9_Ur6N@h$r1&^I4Eu?cfC{WBx1>QtZ4%F=xN`$W~ac}h~l;sL#`fUMT9tqYs#YU;{feOlo8d&kA zU3+=K4_jSNXr~VSmcGlj1tqovRnb=iDZYi7BsIV(W2QcO)?^kFvkjz7z^vJ;LUm#( z--!x~#k#XVX6I6*u6{+XQDnall_-R=Nt}0u1piTcvt7ROUQcpfqC;l?!utt6dE6jv z0X}d+J|O);C@yHczEUkc9xzi(sX;CE->0tk_zmP0-oIQ^QhY^%#klh!4e>;tfWc9d zy^AI9J~qz93m`x5o&+9G<`2tpd=PlW*Nuu!<2&ryCUBGx58>5kdfO3{^A}gJ&qc=6 z8?o8wdbXa?Rh^O9hwyu)%Fi+Uio4P#NytdAuBBt2p<0K{YW4s;ap8Ri8%v1i?W4ko z%E5gTMLXZ6u6i*&l%r(mFu9{fCM54)WqM#tGPMsymTIj4M5~kKex!xWi`l0Y63bjN zr>QDQogbNYXVkyL+=7O@g;cKzG_=7cJGE4YYF31lq*P>^)NlYd9FKO>*VKCXx;POv z$HEI2LTwZ(R`20b+g_T2BV|9D_Q?qzC5UOThVxne*sx{5LzHq|u@Ts`?Xv%$% zT2ye_KXNRj>qEWJJk-mx#RV{e!Ig#_Y`?4N78L-3HiQsEutci6L-7}p^B^Bhxh0G7 zZ{&Cl`(QH3Mq9N##4RRN5sebSBTX3TQu&hcfiSFKiKr!y%#XA@z_tq*KJh&{%rrrx zS1m-j?HcPoMQ#o4N|PR3)30GT7mBY_MivbqRU^7zTsa@{^oXI&G-ERSNSgGeI$)t0CABQX}%BWf`Z^$^gTNmG^!h-9>$L#Q@KP@V<8E z>?#u5^ptMu4HqW(&nmAV{$u+X+0>C`JWS!#m}#Ch;Cbm%nGvkMTQN(50-NK_4p`IEHZIq0 zas7xPIYBd7vLWB-5EXUr^Nc?m-@95~_hCo_>;=8p<+p0#|6-@nu*w@c&SVr~;*CtO zmRHr-syg0KZO5@A2vkWKp9v959Z|c5_d3g}{L}uGX(KKq2~aNRAT5L3w`3EtbBq-HA=@1OtPa-DSUokQkt-K0RWzs%MbhER zW>rGC23dCFO}Xj zm}%57iL5RdrEQf+ieC^D$ycgb*mZ8_?1RyRc|Sd=#lvjSAl6Fs2g!L-ewY|&Uh9e~ zK*bDEq>`G#u*ATQ{^-3jI1JI8-0c;4iemLu;!bUKE9C~G)0r0XloE-%4k3dOCJ@($ zJCd!f+DdYMoo2&V?ULCaFzK7Rpoz(WJ5zD?rYQEKCa)5m)X|=>FiMAw!LO$$bzAE*}t3C)r&itx>Lfx+Ko{ z7hqct3)n@ihh`2m;nMgmjg?U+Ep`^id+8Jx&a0_Sk6#yG%GGLsN2GVTuqrVRG~g?6 zeGHG!K@xS7LTv71^&ZQF)*BO6vTaSgop_RY$Sm-@N5-e%V#;-(fU0ZjJna=bavjKU zz?8g$`wVAG7jG@HZ`XE>!ID8zy|py`OO!ZIL(jQ;m*;z;GR-$Em$}E?D``ty#K8uX zgOHdgcJT$gbgh_5RfUpZX2H&342wKb%el$(x)8Zo`ZOGtL?{<}kW;!;ot`s(b4fNx ziWpIdYLk(su zd13Iinxvu9>2%KGfq?5wPf-=1@nRqgS>!q4hchAuzl-NPVASG;=j~f%Lv=Io^-av|kH7y#6c)%JMm)exvqKMhlL=p>cN$ z2nfl(v6|Kb1PT2S&<%l+5aQ$;2G-{R@!rh21Sn5%{FxcUVs?!?H#vii4>6isx z^iD5Fpc{4Vf0Wo{<2h}Kjxb(XWtP# zM%kSa2slq3+rG<|U`nUnEq4rtXXhjdcE89PKVo6gq9jt4S8Bq|A(SEjWe z#E<(?!=^Rh+uQ2oGY&a23_`x!y0vpuMmw?^mJEJ_9@n^Jg>>0B=hd!^>diyBTFa7m zKGUXWW&MLXP=QypXxXg`w#^5!1f%rWongp|o?vdd@c(A`XFe$~0V)9ORZDEDrlp$|H`b~ zo(=l9lKwop$AztRAF`h^4ZCqGV;V~792**{)I2m=`O z-p<9N(+*Pq#>br`SdthS$SDZOA0kYi9D)D(Isn-4N0y>l^dDm2SNxAE`3D;{;zZ@T ziwM4MeE({Ne{l--!U!V0|8luheE45qIn@k62B$0elW~7EzyHbd=bsWk@jLJSyTlF* zzyg^b@7?nCe^ty;@1GKTjlbpmcZrK6fL5>$7vTM~==gtMcjYg-l? z;$&)Q`{&Ny$O?vqorsC(&kY|R5u*YTD-olxjf<(1ouP{<5u=!?o29X-vZM$RqnxRo zxr+r63nvFV5u=3V9~!{b20$ieYHV*}N+civ^Usn!fUCcmYpO_N4jpb}>03bOOF?%- z&p;EA-vP?HGW7B?MATfk^1) z$o0j=z(HDM9HH}R39JDp>>QU=_bnEE2qy9v5bXj3i5D!C`(QKT?vq-)Pb5n@0|_ZX zP{2Bq!SsZ)=tV(9+~ft#4q*k8tPldlkOP6ie4~|z4A_Y|8PnD0ISEIJ zZs<;DL@CsbXmEFX@DUinr_w3lKuJOW&?^7DO8!7Ra8gMXXkT+7kFN#Ck5s@TN|J79 ziyk8Q$dz|X!y8}JtQXRWQo=!redw^5@SDsgEHQCB8H<3{3#qXS3cX2agFYC3o7Rns zPcqwP_E3`cP(Jykkbtjo zencT&7HJH8#+2vU@DsSvLy@9Z0SiYD5s^cmK2e-XjYiULX|`+b(NYw+TVB88WP-A0ZASkfyqj+ee08|HvI15}L6rheuXRzogez<^7pJAhN zD!uf6lfqJkAA1p=ZYmjZ4{R1639YeY#xpcDDO{w2OvBU`YkXnScU-FEuJ=bf*^t^MEyYGE8rL* zq>%73B>0&?IAYe{5KbYQ37lw9p`z1DC@CPtqDE2(^r7m)l+U>FjA02U%+iinj>xRqm6NnE8!XTn@aI1>p>ke*|H8d_jc{KD9c zg#I~T=#dVdzMrlv$8N@0f;}799(gm`2oUkageppRT(v4*ec{`jGa)kA0F`?N4|<$bPJT zf*))j5IuySkwO$$D0tAqAtpiTNV1EGR!HO(0mS1|t4b!Ch8`G)&Br2K_Q zr0vrPg$#wr#<06wyCAz1yF(OYsAlFgEoFLNI!w(4t&N60t@K0AC*05^5s?Y`Yg+-gM zxEi>L;}}^NfJV4b8B{qf*=R0aYOr;-#kKK1$8y_t19zi$t1Zn?kj-iF(>`pvd|-Ic zdgweOMkIW2)ye)bZM0>ma!OvD`mTI<%WGl$+C%lacevXCT*_ z&XC???Unnj9&^z;TqB-ymUqy*(>*>u5pl6};;_6nl5x|$_0qWooi`Y;Yq&DGp?Kmx zcUjmQ{>k#m3M?h$Amk{dktgw0_p9qxGSP0{U0zsT{?~6?WB@APem`B?zs6B z_|2*2=v}ldB(ccpD5`kQEZbb$*t%>X_()xTg<;2=Wsajw+C%~&XGg#z$CJ{NV2TmM z_lb*3%!~0yyG7{ZtYeEtXJ9rm9*9;M*l3;gbB%I&>Uwusy`4S1JjFu;L+?ZLN6w;r zBiEOnkw+nKrr1s1O?Ib5oP^14c2xhg`L-Wq) zPHbv0qG1Qt8poRr2)Znfzw>+xa2#;$`;7hu9QZ9y_lj?vwwmu;yhGz9><&0TzD}8o z>IPFSdc!2d#Afs<9Xqj|(wU8xxRN?6;d_#=Tov&In)?`Mdas3F>wttZ*|FAE{nyCqXr_To24Px~5oJNb*!&}&#kMr8vseHYjI`yKY^+(YpF_b#x; zkk%sK^68mWS?_Q4-_A7==oR%gdiqSnx1&DZw%)pFrD<6;KD56YDCuAMsr6N~h`jf` z_4N=2`CCvaQzv1p>z%iIt;VMliVM0`J8Cz2jz1dtUGJm3CXFQ37I)2z3Ua@x-p?Mb zG&Sp))|l!nZZAYGu4`R3`q{U8dFp#^hGFAo(x#&iqF-`Ota_Bsv^%X*%uqa+1d9-q@%2jK3(gT9(y_WBWR30W7~ z?#59_s0<4`DEVFOGg9}iaih7Fy)&IU>>@XkHcMJcMrY+8433M^_od}56fImB=MSx{ z@~y@ZwDR^GhD=9hCTCKPDkLhP=iu;vclUaV*&EwhzH9V7zg;2Bk>zu*B&{es^;vq3 z#tdS}J~eUA={a(}9w3jG9b#x?Xw`M>p7ELAKbbbr^W$IHUzztAKi58WeLS^YpY2p! zziM}UF#9nM+sf5ivzFu8`Kqw?-P_%K^Sphi_i@K>;hhuFi7`$R$C&n})6uDMT%7qdItW8UxX-W$BV_JnbGemBIg{lABH6nSzV z{LFkW-jc5NpMUq&KGmviR`oRdBEEiDuz9T;#+Z8g1WC#7trYn{jNj}>XPn{%TgpWg+QSA4@&R5#0Ad=26oTECYWnp8vNSBM zHQgG;;^(fBu;K^QVZO}!GAKxIp$7Fyv-{|!ni=uh%in=B*IDpZ`3ake3ZwkLXv}Q? z)R=XM7^Ou;MGT!yO^E(dqm_yD{;gJX{)bxqzp2arR;al-{)g%unkcB)&xADi=o1Br zlFB+z&-lSR(+7l_O2@1Ofrbuj6+m(IUcZ|Hk{ZRLyK(#M*V9R#wp5@GhjI?Y>?ev# z|5MuZyMIi=8tMwdZGemeahb4%;aNJmC@C0PJBdq~D3Mf%;&1v4EE>Bb#uLz7otKUbCy8^JJ+96U|{H&Dr9UGE;tDCrFnI>+3;fO$I0kscAFsJ)H7lZu0( zu_@6X#3ky?O!NnVDZ>Z|0Pqxmm%ox#RRM4P2Ro{&Y((6D-TtA_R5Y?OHU0;Yv@Hh_ z%fBD}2Y-Lk{>9%vs^VYS7*$-2T>h$@zc?de)UY%GpgLx5c5Wg@DN{>x3l}0zHZB0e zfJ$+4u>XVah+LdpO=13%ah5+l08mqZhyV;TDwzUm)WOBo(1wUn#L~qX@LSa0*1_KH z&r?8Q|H6)}OkA97F#k{Vc=kQK7kz%d_cL_!wdZ)6t&oC(Idj0mh_3z-qp+T~AczEt zhAId|M#BrTxRC8w%6`WC(!tx_!8`aZr=MhXcr4p_(pKtuW70?A;Y`c>ygRr15UZzg zBGdm<$N%q#DF1bo_W$Q}cu^w$POFco0)0}a%oauOI<1+_T!pqyX`{xtWB#ziF+KhC z?;7(=>%XJ_ejfL44sF;d0;|?499dyAyOQ1dQK6^f4p&Ozvc4qfD6OZ1Cffh~;Ojrn z=>9q0_UEq*GZ21NcJ*N-ro{F2Wb-1i-A>1{`$fh0|B=rE4@7nmUGP@DLUB3HSLXL) zgX>@{E1u`y&jSDJJ^y@dAPp$Y$aS!7N@^}r78aR)a26O6JW`v{~e(eVBfGcd4aONJ>8Is%U%Z zWQu`-iMzk#Jlov}F7nPD2De8#^8}x##!iK2KP$Q$dE1?b->(+%o5)F=GsifzUWHih zfQKqAC}5$dC*|ajY>48RT;7;i=vQ*v#RUkoq|DRmxGp0&sI z^rQWs2&HS%TehC2q@Nqp(9BFU&bd|NTIa@iMh+~s)YvxbYi%BX-caAh=kj@a4M3vO zW>21VoebZ`nIFt`MEf^M?DcC@36qr_#bD5t*e@6y9UWC1 z9n4RI+rHW^1Vs77=k&XYLa(f>=<(!f{JK5!&A^i1a|F&N2;uhT29r^1JI-{p_hABp z{b}E8l63{Xfx@hUso^VSV_WI$T#3tS`D%m9=GVtIo2?Wz~O#C}NmS=Dh3U(vrIO z-aou@bd}GVc|z9NZwlKmU8yTyEc#2iE7#DdFy6h z+zLmy`IW_#Te^q$DV+j~IHUb2Mq6 z>z(~GegRKAqtu^@9KQmC!D!g_9y+RLq zlywN7CF2swiD?5?S*kbYG~1<=3oI=>JRKcca91n+@2UFxL}{>jZ=_tC*j^v+ z*8Rr)<66boz)XlCB`ZfpsKol-@Yk$;NdbPwOG*mH{pRm_eqLJ`*Ti-_F6}_yFT;^p zIdT>^3YpE~(g$}QU!?Z77qes%&I()uBRI{x@RM8Tga?hX{r!1}SH3d*cv-4Mg(*T< z`kosyC(|;ONl#u=A`m(~3wzui!CwyeAP}6!J`>52ABFBjoYLg#9#q z0-xE>Y%frO-(HB%0rDOY;C5!)uk(Jq` z)>ftt@G$25cUe%#*dnvVn(mr>+B-s~waiW&nBVKGE$4R&aJT|tOHTH&sf$(1b-qJ( zoqOor*Ff+9v5Osv+z3ac>{{5#Y9Hff_iNe&1l!EIjTgk;vp!XDKU>?ym2185ZMS-9 z>1?uo)Ymv((I#$k&y_zqzCo|NM&!(iuPd(;?lda{oa`ex=e=}uGd|iV%=HF3cjkJX zL$F*w=r$W)?V72Qmyl??z#liv;^b}9r@9IbnvzFHoU!2Z1#Ow#dPnK#XGVy-`VlC) z!HkIif^A0O)z}}r{=5VMuL_9o^0!%Ai4?eraW3nH@Tt6>5e|Vum8cm$C*kn@uujpJ z1hGFzO}w%-B_-{9T=GCbt8M0|9^}YvocPFFqxb3t%b3zAwqW8$=pbdntY9u`qTPZm zZE;dhLOz%8|r&P(M8SUO;mCvN2<+=mJAzp@Z+zPzHz$z zZVy*xW&fYoC+N5`3-*l7KA>3k%lM9MKE94x;$RKztBZqSK`Z%AqGPv_^$aWiQ zEf%hc-ce*Pp;F`DKZ$NaGIpIc-7Fx5?|Qne$Lmou=_1wbUJgH7!iQ56q@dB zk-K5G=$bO1CDc+U4~K7}X(rE&$>7om>VKWR*#-GF9SBVl;&)SS0P{dx?N~2&2Z)=} z=4+6FOGBn5;DD@QQ{e8PHNM0P7`HpuPuk%LJ;)=07d=3Y2)k&@_tFff+f{rD+^_tu z*@pt?M}9m7)ALbFu7>>N+8wF2NbLq~>w+SZL$WgRkoBWl7K>Gz@BvJmw19*FC0aIwbw#^& z0~8fC+50XgqU@B@2BBFj$M)ky$G-Iyh&wKjn5m#~845bCcw16WaGPz8ScdCiz&q=J z+xUQwlRaB3Wzwv=5fJ*|m0T+QN}HFbXEQbq5X0SKyxUg(?juhHvD4&+DA)HDo}2{( zKkLP!;PI_CZ7VGp8Uqs(6*S&!^4hPIKotc?J_AV4`eSg9aor<9F@v4ssAC@;T`E%( zrEv6cqZ|1

7H{-JIv~jG8LXbk+e?_nZUQH0}hgLic81qKaY>X9qL*p6^bwf&DT9 zGogKmPpj9i-tMuO{jVQ#U$VIK##6pzty`4JWklveqn0R5g2JkYAQ@S8xSfhR2&9&T zP?8rTMJXE0U16^9-d8P#!Rr75XBux`jDZVdA-D|9@9d!D5N%~k!gW4oyA2jXT5(-P z#(r;*fD0?7pUWzqL{A$_!5`I~@@CHB}SbfA~vwP z7O3CPb288p8mLiiB4?tRfm@Bu(ePxd^0?(ASS1lDlakSB-Fp(G;t_i@V+118A0`)* zuOBR;_tXi+{c_`u-oG}IWeVO{6>U&!bEJC+d?}W?7&ojCKcmPm;B;(vc~`pq4J4KI zmB3>}=mZYMfXV5kJ3}Yt5Y@hj2^NZ|8^sq!uEYl5;DJ)oELKVSUG`GEV67V3Sxlf9 zMGvi*IRbWc%5U=+KhheUF1M0Xa>ssKqW7^oWk9)M2M)qFb^Mowyf&DFq1|#A zox$VnG!To;?Fhb$o!nq4Yh5}q`*a7`t!zI@`A7?cV=cA0wFeuL-qfv9U-lRwCLrX z()4Pp$r$YeMbpLE!hyQcl`p`)8OV#-T z`H)ki#wOWGXG25M7)n`0+Ktip3Vh0N{gg=^5nj;_b&|@{P-ICzSW_EVi6dLgTM!E(!*<24ELN4~g z%O5YJDsqEQAWzN+wMOC73Bfda`>}ne;vEZ^dP4+Yo{E5omhE4#!wl;hK@f+1eJ&YC zrmFsOo9g+eANKX?Np2WWJ$dlpzBK$CXfwd7a1RfUb2wj#Z6irVTB~anBvkX$H$=<{ zvZ+TjimB)Sm<|5W_`mKu|Irs2EI`WCs1!B|?YO&lLr&8D)Tw z+Q&fsIGzL9)51kbA|k;uYQrV&&|1vr26LOifL=uV;?ADaH-c`h)K#kR-SjgjcAbpM z%Y0wrMg(#0&fN!g&(}_8Y$4V2@m<`mq+6TR8-soS;R^wPa^Wry9Vvq zL24C++yF@{^i!*h*_~5(gj^udhPUcoBsGY_$g4~+|l{b^9Gd}fKs z3zLOo|6@yU`0G`Gd5Zo8^+PIZcW^Y84T0$0gKgi`pV<(BLF-K3qR~uIB!Ez$u7s}+ z>Kq|B&-v0;M6$;oVy%IbZnU*p(E|?iFL1MG}Ir&ry!M(Dk9fVd8cRt6aL+Rx#b72kg zB)>tX(v)#6jm7GRB%&wZ>CW@z)@>Crf>^Szctgy7&YPwFN)(9XN^9rqCD^TwOq%Ja zIxl$ok=#;(w`^QH}Q;_kO7aEn2is8Nxg4ulW}zGQ%igUWM4Qf=5ldOiQ|o{N;HxHT zsNKW(KRuvq_i5URu*{<;j;U%erbh%7GB68xes+Md`g5=+Rjtxi8rfu4cZ7H|$qvb!6;7 zBAyElzvTIoh2c@J(gTya@CCPtyqb=25sUH;p;oKN9lNe68MRv>G9vw=zJ()kL;ba- z)XBUUF=4HwbGDH7sFB$-PK~?*`fLA7zf=TpNm$d8*aHjrjW&@$WAtzHK2j78V$G#i zsm`v>Dcx(>(A8Yoq74Q7SR!S{=c&P)gS(beh~GD2>5Xm&YsH+<473nEi9$JqrVfon zjfL5_{g8IpoMBVAOieQ!&|1PaaCY5ma^d8aznp@=xejgj2)>>(m|ir%gT$Gy>?=1U$Nas(d1Vv5pnxyW&)Nw6=exA zvUjuUbwwLMl8M!x9fJ2DnVmFo9IEW-*ecCAu%XR#7A1J1D*d?jstz5n6b_P!4w~M` zLyg4f@pu-}bgo`Zy?EVf7SHiY=@baIUW$d)p8K0ea_*|GRHiWPD=9kkGAoj5{hHUw zdpd>Jsv5~jIVBz6QfG0+L)hA6Rxgxs<}HVEG!P}s`d0ESShz}w1WP5+ajCfpi**iN zo}XmT8U~|z86HMx++iLq2Mxs5ekmA-cGq??7@ZA=dds*DzT-qiD32Jixp6W|_>qgm z@2fl$XE-~W6JM##(<_7R>xBeG!pW_#1?!AW_v>2uq$Yxmnr+R8m{rv9@^>xS8#Y*G zBB+M=0S>Is(4#^ydQHA(L>&rg_b3K>}+KCa9wid0=<|x5*kL9mKf6&-h4$K@IFTfO^j$dFu5l6ycS3t)~#E5V1(maP-vO7N1 zKhs7f{0uJOWIXcORaHlI9xR<5r{Xo8)Qi->#EvOHYic}`IiWmf zp3+d(!aaY&lHEpGpo5e6!bio?%758&UhJTe$K@rr!{f8HMQ2gfU`DAk24l8lT!Kf( zy<(T)plL_-u*bU*795Ao-K+eWMM@e)K zAqua|4PbO5CwKE}XZ)~4?Uo)0gnT5C^e_y56{SD?7`@6h%Cl>P0OpuXDMjRmmHE|RI)zSqzF%y4vA@wmG zdlr*7w7Ng_NTPgF-rAQK8_4;k;F=_@K)Xr5k2>th?!ron#YZljI&(gTvO(W3!a+4U+A@ zdRI;~4v@y->+gO{!|)<$Cw5|^P>--SRC>jZ8NP+s-p&P#aICYK(b0&_m2*)3T@dFI3~ z8KZ4TLSukLF6&9HQFs}PMwy*pqu76j2%2)B+!qZBMI5A-zsZ1D%+-Y_=20&ZJ}Y{~ zj|rO~klf4EPK()N;6LNn)w&PY#mck5lMF{bA8ru0cmFkGbiYdUu?>Ir>l;xof64{o zmj1$Jx~n0(`2NG=LQKe!v;B@@EuO==HR9)ijeUm%>mj$oq>6zsLusqx9YXgk0KXe; zFuRvtO~~NAq|rT4u-#NaRm!1|_1HS#uIM$r3yJdVe=}Mn~JAFB;NQo3S@>2&YQL&u(B@@Xm+L;1_b8g1S1$st8rJ3pLfasn88h4ZA zw`l4)V&=*+&!TA|UGd5yQrQUk5>qet<5;gsD|l^y!NhIAhGMKWA)`7$d%Gd|z|dpsDM@On z!$P?iJWd%FUT+QfpcpZ+zmP9N0*qKlfY}A)@63FciB(xJX+*s#dvHK+_5xCVe@ca& z9N2Eyei8=`$)?qi6=a3!PiN(#v^~!xPz&YQkX3;+(2ou<6!5Y==g~T)PlXWq6W#iR zu>5?W-~|NK&6RS3{blwnf`5}K`#`{#fhp~=Bu)q454)~9_nNSBiyvZIa`&+u16I3VnVCpzIoKodT z0f=biJr&D$`j%CEQT_Jj|ho7YvGs$B-WS;Ck!-F{HHW5qn0~^{Nw)rJd zg+$Aj&YQazY6}vIjQ(&2U^92wxo2@>htp>%BOwOsTCTt(q!J2PO+~Vdjb;Zd0~+zh zb7)F(2s(an?ODdnI~X`{W*p(`E^JAyLG_tcwwVirGHSzmej%k~CX@Vyd zmnAr8Y}eO^M3FAbs3x_Yc(69k3Vjz0PYW1Gu)GjQ?d1ZPjfn0|aJ1U3==miY$zH*3 zxYD|85<>_ylL&)VU=iF!;d$0N9|OSQjAKSdXwjG{Fxg7+dE8v#3-7J(yI5wlAXWj@ zHzyvVm7>`pWYqlai(m6s=+X_)=~NX?zk+6XaWk{Mg}9K2UX*F{>dmi!9T&XhZ_L4R zxjmv&dgDuC_IH|`W-vXNS}WwE2)5kaUyQu(&f+=IzIuC;cK;vp-ZCoAEn6E+f+s+5 zcMTTY-Q9x)OK>mTCAhnLkO0Bm3k&WVyl{7SxbN;h-#zE-&e#3>j{6U46oa=`tu@!2 zkIczRTV3(pRwY_AoT8y#AP`H5p3DU6X^6%oASCay?RT!V-PzuzNdNineo}BiH;vI^ zr72bj5g-DId?dhklCbFSE$;g=l)deQ# zj_fZbl!xeiH9XKA=+tA_em!3{M(ndl+=F?R0FH&pe5mtq4(GS5t*RFIJxzOPNWfCI zpQ3}6AD<|kzwxPem4Y?X^#DH(j|hdk2dwa{m|40KD3`N+`a1(74rR(x@1X#pwuK*# zXhX1NiQnHZu8>#jXs=WCa)OGc0fKW5j(wT zny@?A5!YzaT+2!UXQT^CCf<4^jl8w>xC(tVF_bz>GTTU-5t3&r$V})_>*(D4*mcdD zo$M!xAOaV>mTxBEOV%7xOZkr1Ij1%!y%}kQTe-LmlY7CCj|1zz9dkBZ19&@u6m8M9_Q8thneQrz5boyQ`&%#6K$r*^E+qAh@MVs#igY+}45KPX(Z40UH>o>}6aK!Ja91}@xzG9xDp|RY;2y0v zIz@h~YFB@idRG6NwVtf4+^f)ZOv)2#YEMh*Ra0CyD#cCF;+)i~ki(67=Vxw&`kwcY z!%7rm0+q_g$vS(8RBtQkbdag=a^!UQ(%%Qe{G*51bn2_U?~B(F`Ta$U6ZIMe;F$7J zD5YNuXhK<(ggm%SeWM>%`LpV*^-LdthvIp!iS+lbW&fug8c>vflzW5kk`PDOjGW7P za=Tc`fBvzZ>t%nuXZ|&XMqYI6}j&D$}E#4`Q=4+5L0R4*loJUgY~KX z@Y7*J{wHeO|2F|aNPNd+T~FN%Sl=wU*-_Un7qzL5`r&;g72Kl~ln1A>u}#)!W1 zw56EB)U`Q<_4C6Nf(yH})o*5S-)TnEP`Ld$g-iC6WfAHhzmUHvNd7 z|2-J#f9#6?LTgqZNo)n+Z_<7>NqqAtY`*_nC%L~#U(9UZ?4;=wpJly=rf}!Hjie9$ zdlCCTzGI11&ln~4V28+WVj!=Vf3sw4Xub~eA7@<0;NGBt@%NmQwEyp4r|*TZ$PB?K zJMhk{k$*YP|NS)MQqZI9O`kUSiQ%O#ZSohjZ2rv&8HGbobKsf<-uasom`e12+W7tb z2O)A)uGvkM$Qw@*l8KgB8`GwLBi-QwY-uBFI^-l1+ADnj{apWJeg64kq}ZxXyevE9 z!uOlli9~bemiph}=l{ml{^x>T{Qc?v$5a3Rd_liw+3!^u_5rA@(&x|nkF{p=+s6+? z#|z-(67!-ipdIbmu-$4$XVAHpwqPV@%Rv@M)@cD_je6h`t8e-FU=WLPX)n>lT*JoDe*+Y9^10c;K`j*DPu-2)E zylBB5X7@waoz20Lik`zXOOP#lPM~OTv?thI-ooPZt{TXAV`Ox3$W1?Kw+uw|Z;pTj znG&2=;_k8F(;cXQ+e1*J{BvYOZ+sv)_h#B$|MRTAT$Y6@4wG5Y%+kwho_c(8GKk%J zWe>$8O;O0c9h>KEWZbv>9qVNs|4?JzeDg?M|;xfr?7-eohq_ zh*Vru)IT_?SL3Yftbh!`Q^dLsgItQca{n^Bv5`#gddJvikk`Chn4HOF=QjwT)|w+4 z@34BZw(ESF5M)CkRWx3Y1K+hlK1JF$0#zgHO|<{DHO_QchUr3JZ?p3 zIg0&CP6tEoejQU8#6zGx4t7Udh%4)p1~wlA?{PVR@#uNgiYu=Z+8_M0F)%T=Hn-!V z1F0JC*TmaN)&|DEl2>s%?w;aXFBtf5&G_8E({->weoxGOKS{?>-tufhVMlv&7*8^>RBK_hYDZ!0pjI%%$)nKfY1ae~x$y7Aazm>F0bVO9A8c z0u$+{hbNvd2A1dTE8vhfs0$R-RrT#H`(x9!7Ekq=*GHV=^bDUodWYxBbAHY{Tjbur zWeTic24m~1=;}rm$lrynJe}o85*20}|3hsUsXICO%URk1^YhTka~o*ITQ8H_ zv%BzjT`1(^B7)s=I2Pj;8m&tM5tv4^w!X*vW`8+3N~)u)gcd=yQ0MdKFu6#r2jtAb z!NIt=xRIk^U61@iQ_Z-fbepDl8OSuZ+hFZR-#c_PbXHbYbIY2R=U(mEa&3JrE%D37 zy1Han1KZ~(_QrK2vQS8*Bkxezzqtpj#XlGFRRGf=YRfb(C4@NS8v$L9iCk;#%;5q! zI1MM4ldML|`Q)yu&WW}m6w<$q6~S*eX=KH8ENBa#D)Hg*s9P26&!!Fnm_djS5qyyMg6EFE z6p8_8DEC=0tNG{AMSzX%p8|$2s}Ko!i~UybdTji~;`Oj=ksBIZpmO}h&rKD7L=yHq zgZbv%ukq&#jzf(nKl1Ujq`0z?O}blC2px)d4!#T%p*u6+Bb_B=~a021Bvy z=VzF&c-MZS%jW{on0~y(Zh!MONli@+h-Do#i8z|QiGbE5sceyHqf&UG|7ePr*8-UI zW|p*5vJ2ins0)GIEZyAJAGNd+>}%QBPNaKsSv{lAs5JdC6BzyAs|zQi?JNzt_T~w@ z0Tgl4=84n_kLmtz3P0H+_-8)I9*}5j#WS?Xra8%3UMcsQPQCqY#V|5hMoahJZA6E^ zCk#}@%{a0lHBj`q9h|^jzZ=)-*>G6STP4pctLM&G<}@3@tdCW?sGgRo;gy9N4%U=Q zqG7cwcps3wP-wlRrLuFRp{J*%q%>XhrXpijYE@I1`JHl!cm!D5Pa~R&B5gQ)l%Q26 zQUgmtL4kSWwSQ3BS;Eh$vfek9h9QuTlP&r$!oN8_xC5i>5J3&gb|;LCFN7kTZnBlN z0kqKq*BHrJ-q+%m56TT$83r5%o2L11+wYQExFV_Ck@+i&^i9FF!9Eu>5@>CZHbny@(UClfLT9v;XWkno?8B6jU%siOBRTg{n?O zS@Y8jptLx!Nqwh|nV6KRA<{6F<`-DJAFp3VFS2>U!PZjQSghV1g{|&{oA6|EGb~;b zK1BBs!$3Hw92WljD|pRss&pxU6fm$))?yma%Ll<55!2DrmxXCVIeL&hcd3rCG0UgS zna6#Zs%&gbaio-5N&vNA2$Tz)@1iG!wm;2Nwr^i{1{0IhaIXDkY@5zdg~+%a&e&^mQAwJMGdnwy$TZOf^7N|kI5HJ-Nwvw>bZeSySGU|kIFfR*67G%nbL~e`s+N|z zc{cX<-H~p5of{k132kP`9}_{-7@^Lp;)0{8`^W*=kWRUWuX5;ky)=B=+ZqD1 z98RmZt+l1aW;SCR_rn>*!W$P^p!BqKV#cbB*1;WsQ{*FMB!3X0z%pcg1x?@aS~+9! zeGd?;PZ0;2WRlQ0U*{fcrMY4;_j-pohYIb=etcj^t0YX)OlR3^GoJ*m!Gwv73gF_B zShfH5a?h!uf7N$Tiomhm>Xcru?*GZ=B(qi(9UOXAKb8IXXm3y>-&fEZ3gKGIOfm7N zyWnkKnQ@^qK0B{p&-8Eyzf6VB|m7oXdiuF(A1mgV$i$8ax8Op`aw&ZKX z7&lRQwUxFu-#wUb-ZOpO>3XD)MTA~`6`2;AsMbD7YCU}UE=}{$>kR=)4;1=>jJf^q zx6hmRQIa=NVBB2Yk&zLPx*mM9i2}qt(!Z`A>Ac9N9MRwtuT@m&&Fq)+uzn=Bb!cfR zZ`U(Qle=Z&N9d=f-1AG(jw4>@T-L=OyvNNxlRK)VR=J!I*TnpuFm(5kMOyhAAPxF3 z_uHteo6)Kk7+zJGw(_#Z!}*+$@W~Hcc6SBL2sxZdn&X=ASiC08hcmVMixptC|70`t zI*JlJmcfn7W{TvTa~TF`3dKxB zG;NkE-*>|vE}}#h+X;(qbTnv&`kCKWhltIB;;p!y^T+7Y_$17QZhi_ z-C3>VJ*zWeh7eGd&WG1>E<&dOT`$!tyF zr}Z!EBiJ@eLeH}M9S$aeIkW2JpEDB@>}`;=^ZvDnYaEA?N#XwzgA4H9&gPyiQ0oyRk^J7d`Z}U*?8?2lGipQ1zr5hR6 zio|P-MuUz|2JtnzX99_@GK|BjLUh7Fy!|rJcyU7f;-Ie9F~Nz4(84V0ScMgDe}k3E zX4*f%CM#sGyIRx1*?Q_k=j8WxtWnFiVsF;3p~p{HQain9T&_xA<(^|i0KX%3M&g=Uc-F+9te?qdm%uL z0m3(Ob1R*V^S0!bBh>GJ-luWD_~G~*3h{X!ibMm8zBuH`{7Z)6TNB*zt*VKfdIyd& z(vJ0QOx<7bkDckymd|QV_K(9-PyCEjZsH(B+esfQR|{j6kI`u=eGSZU1TKq^YQl#{ zbJyh69e) zSl6oXrK`|xKl2SHdf3`(Z`rI~c|I7}K_=ws`tci7pC?_y32`=A_V5-N31*Effp-)QK2^qf4;J%bhcq6k;o zUq~RX(X_cYGd_>u4sA{c*Ul%-kH6SwU-mgQ1h3@caang7iPZjv;QaNgFDOtb-bH2B zistOeBfFHUz%@@3NKckDC!M5_aa)`A(ZP0pCF3-$rwaQEWh)!?C0rFsf1Nvb;zt0 zL!ca2m9rD6^Qu{o|41AXcJ_z;h(0*#EL58%<+o!S;@*A}` zBrmR4h778`aupk@?|1l|eUW;h(v(u}?gE|SP2=NPCp-j?`TL`k$@^wU-j_Ka&IOlD zPnYs|ge==msemt?S-PEZrS*K6|}86|uG%coqe3TLNj z8IJksy*+;?iakMVc=B2o)3=vINpT`wL$f#JQm@&n$ED4O`3+0oi}wwgzzb0CXYm;~ zTf1U_S^_>ifr+1|2eDrct5^A}Z6_vQ9`w4$Kt4VrV;}F>16Opfb^u8+ON`RCijAH? zS#fbOBluCqg2(Yt?hYt7zYo6}2h-R_;Be#Ba67c;4!gF!N9N2#*^A(gQ0gK{5Gl`&a&+DUe3 zHy$;K@!dukW_0C$4fPrqOg}4ysHkW;#ch3YzC899m3LRiv|F`F<0E{fjJc`sj9-is zaZ5%lC>ci=_VN%LT#+?^Ha&8Iinl;)E-{=4FhI14ulj;k9kkPy{45@`ZJhUgaF~Me zBW_gqws4pn6t}{i_iY{n&8N0WTohATEEntf0VBrAyhBL6x%oWqUK56j3QJARyHeZL z4rRLZi|J`AvF(5WHr_3Vi7w1W9#)v8m_cF6tk5Y1g+V5$ z2R?g>p7Mpg5Y!F$9R=xu!QtUwSt9D{&p$<|*qtqsJ`wS!p(U)GedCCtggWIo3xlwa zb|DdoNeu9AyAIN;@4AGj_12&pk-tHb{hpP}sm&R*YwacyQVj?LAKISaY?_{k@;8RO zpB^SBtHZ)%y4wGdkyck%hlhnBfVbH`T|Q6MaoUDfTIX9W=y~_3WsIirGcqvz>OM7} zGG&PaMm?#FRe6lH0WK(|4tx$Bvf=cp15jgPbtoj``Z-@;LV^l5#qRz#evB-iSY9fB zcw#H>n1;qYHC3zI$svqhUlT`qXpEYL3x@CyyXlkxO$dSrD}J#pbM6ZF1F9f?s-;3^U4C^!72qtPaIRhXV9)8rkv;Ur2c_N2-I$1bB|x7svbi zxviAz56i_l@bSMQrkt6T3F8}mHQIlE3Nkj?_NX9x6HUlFPu39|lFXnj|BVeU>})ji zp-QL4nY9p$APPl(WW9&(C}9j?qfiCiYO7hZ)pZ64Gb}H+!mh;3p7cmG08jwKim`XL zQJ{%LE^KNdHTp8E58`wD5IQwqgN=;)NV8m~S(P+(w0JY={PLXlD>#yS#(DhQ*ixr3 zV#+Or6BODIiVogL4Mg%@>%#OBz#W##c=?Pe(k@y$c_e`;wi|&@C4kzlJ`RFv&1LTZ?4g?KSCG#jP0oUjeeO;9vIqATNhE^CK$}QYX{#TLWc#!K zk%fv%*vyi{$}iU%0vc!O>_2THYg8d~#4re_Kx#)iong`2ZnP6Ym1Fjh9G)QOHEaAb zV9*D%^+562T}DV+vy-COJ3@YbG;2U^{E@jgc6ersx^Or;Ko9+G+X=t{c4Y3#uQKo7 z9O$yd7^RMmC{k*sFz4Q6GE&5SOWQW9tZl(#DyZ=5jj3F59 zY2i#SyAN1}s3HIADRJrfoxlV(pjOWVF zH5bKS0?`wEK%Q+CM7o6jrAxG}XPP-DyHd1?u3{iQ@}Z4X<6OCZPJd=f0uXU@*kkvq z6$%&_z!8Bgm(rkEDGq(SXu6v*AKnk`#{{W3sq6_?N1KU2vF{kma7$EefTT`qwR z&LpmJ$xbTiMvFt?S3qeLkJEn2i{{^=*Y!Y>x4fRSrtA-wJI&wD>V%dAcCcmB-p5TT` z-8)t%FMeAmTO~+68nt^$AhohO*e{T2N$E^?GJ}K5O%|?F7{ElqKx^P=C+#7+XbDO5ur-s2d&?7bMAvz2JIe~o{a4M=rgwcyEL zIy0~3^(oxmAJiQKn10SzEv>sTA2%2qYz94vdh1EYoy~1!#Y4_Sm!+$3HHAV+m>*|= z(PfxgN+A?G>}ieQ{r9uVd7^*duG+-kXZEl$@v!6#PR6BbV zVwK4`BS+|BPYmbIaNdT~>q>U7q1TP(y;kXTT_dprJW1!O)++t?2EMwFL=TsNY7-laUgU_c^yX{kt-hz^S64aDLO0t{kx0Z3JzBD zt?&Gs9I)b-{7+BjmBmiR)yv;i*bvaV=kbxdS7_t!#r}FzynzZHn3`-~u^p;dZ*~Y= z2!rJOwfb)5YQ7Coy|*lmygD$bT!zqia+ht7GI6>d?_$x;)$?pDRcO`e|*Qpu<1 z;N;2fY+>4B?xm=*cr)r((K6GdCM;yYPNl~@E!x{Oc-IiFEgd7Dt_sh)A7sjdeen{ zL53jOJI1$N;!-Fk7SGU~snQ|+Qq`2RaUw|NGMylGzx(-VL=SIbhI))wLB$MNR#U#e zLEOs)F9vL`v9~`$dApeyqFH~C80sk_gHG+9x0@Ruf0OPWmx02jr-SDvZCtb~Pn+l! zJS6?QvsLO6bxet20HF)S*DH*lB1DydV?KN!geaX|WWKrEH1rna#j!Sl6>H|qn2``6 z<@rpVz1@`~-wjGUf$b`fSzj-Y_jyo;OwPmDn>P})`gQjFBMg)HNEzqnTb2W9XbXc*`!kWE z;wNR=E*lmD>uRlV@x#<`$Q0wwn;~}ouu%*3PGb{!KPSk*%n$bWe9&$N?b3pyB^^=)LIwDJIC}xVB}QR9Bk|PMy|`LxMZt&lIv;ST(W*`)gS+AQ<<_jN)DjotIK>6RT?fJ`)!knOY1>-C zV$&s1Uu;si94P!Tb_XFGa)0`L_~aNT_y7%^@O86Kyig?13vkvENc)`4*Mc0a(l(67 zI;+P!PXv@CSR%h*3pBK;8tqGoxpeN$8pn;NE3BL(2TCkdfv~>zX2gXoem=7i>*^Yq zmX9(6>@WyhkM*YHC)#3XRChtR!C{crTGS@|A?y`-a<~u>(}V&#RO;7Ut^0k{9sMT~ zuUTJPgBIij5k!3blDR^tzAfPh8Ybg&`xAc8&(+smdwfi2)QVQl5tmfEb7PtALp$31 z&vX?n4OyGi(RFe;jB&m%7gt8vyCYm~w4HcoOZgHL_!~3YGPib}a8EUw`ku#g8ZFpb zZ^HIoF*rV`C1~_AHoG&pNp5OfB**#S#{wsmqI?t1T-GDtDCb!1D1*B!YNx^7(9x zxMCL+YVgdEPq~@yk>*kHI2$|0u|OI3`?|hZ5dc;xa1~tN=RJttU1l}A`=y3*O3=En zPrRjo5@wBduKRkB^Ew`vL^OFUz97rA&#kBd+8O96Xxq{&9vSpQF;;n3*D zSDU0(@9Afhv3cD(T^J!>I@n=9zubl53cZK?d_-tlP-KJLCdWy_CQ@8E+Q#N4qRakU zJ?c*NQTnVmv74=-lLs-=E4LAa))p4^jHa@O>H-ZAg#+$)`t9_p5#pPZd%C$VsJ^UH z-=A|`4s}P=C=S36$cIaHeRM8x+RIL3{zZdgc5sYZNZ!Zf!}|y= zme1*yqq~3(5)O%k{uf8Pox4+>+ zq#h3lVvF9MpLtJ^%=<-0x7pS!lNctS_dG`ES8S*{$;M5`nVVQ~HZgiMbGSbOW-FiL zZvG?C>Q;JT;{^&iB=?8JjUNMTv7yO{M55c)66zP<)&tDXQ9g$KD$sag9StAcfe{v> z$sXNrUmj;!A&(R}4WYDuWcUbt&%-Rv<0CS3l<1c64bxg7l;GUlg{Cld5_xj~*7a0g zNBSX~LFcWIamxw4iXy%6*^BI2SzY}}Cb*V)s(m2SyIk%fA`+d8Bn*zK=pc2od!UAv zjmsAgJ$)|IzV|wj2ko`wsx}6AXppX7O=R+fijm!?@aZAIv+r3ksQiz@GH3)0f|7M` zOn`Nv$^At}qtCO)yMJ&$u;9Soo7)<3Xc^-=aaJC>x+KPWdt7Fo5J2_jaIry|6p!sz zxVehphC7c&BZ<2lWP**=SK^94w-KnO3v1jy&+jm?zrKo3+g^t275?<* zHO8yg?`$pVo=`O2MJG?I=Br)6QgqmN|8%VxUs*3#oyDeq9SW(tk4mii13!>a2kp9N zH1u(A1VX(i{rpdYmSSu5JHQ3&bdg+_KpBqN3?0Xr5Kf`^4qR24Skj!3MdVavhZ_tH z#J_C+otEXcv}3bLcTQ@()cbr;j%(OPuh~$>##?dEM~>x@m`bl|vMxsq&se9p*cji( zz`hwAYNDj4_wy4q(g&T{5lq<*5i#w&araG0LNcJL2{@Ke`{Ng!5f05#O{ZZ)FR^a3 z$hwiUElq$SAwOCeCyT_AHysgXd=M5SKWI6{u+f$rXX8q?=E;+SdST!^9Gl7kUzKnf z_QNtfNN(6;BQL@uEeq6bQ2GqS)D#wU(|aK^l$6B88DnG2R>8Bms`b{T4JTEb8Cvf* zLa^)|Lo#%J)y~U}kKq0yNa;lJ zek6@QdfVxAsB9_^a<|aG{d5{3f z7Qypc+QCG*<FFz6z*pjTKw#%*@x0WLX zG}u2LRBzD{KlinJmW`g8`yUpu@@SdSk7uSpFdLxjys zo(OBOns0Nz;&C)gqoDjjuhVGMJIvkWR`}wp_=;PXfIp4P1>!e7?YQFA;PcX%vBX!h z)N=Ce2QFzI%sDyU7vWC37O{3{ZI)O14v5FiJDq@oegSMs48=51URvroFo_9i%VigI zKD;G#;Xn0^*D$k@1h8k_6yhM?rARE9Th0wc!qAbZw$`r3c+Q5CxxeI*y@u9#ouM_{ z3h?44PMTB>yNMsXEaB)<(s5yaPYga>6Whw7^9aL2?E_80YN~&Cd;M3X#ymWU_gTvky#2?^?mhFmv9lMvnudBngelv&v>niGGb8P zqHlCrE{PBg13bdra#I2mjuszh{>BI7u;O>`Onwb%`E?XFJX|Usp6u55C5f-%ZduI- zHsQ#@+oyATzS6D+X+{!_8c?ICp(BDg>Ia04u653r#nev(texoxA1kodNA^WeNNOBg zra3L~><<`pY7>4iGDg$$NS;R3qygXyE4=qT2NNuZB-gj)`gk`1dx}nWIP5vCJhhVF za@ow5V~{830c(cdASAY;zG2+kQ+sx$eTm6fPPN~Lnq=G%O}@z|iUM_` zE%lGO+O;;?p_azhM;2~wSH<$N^tftj)F_cV6(9KG9Pfv)Y623ZkYHn9*fJNA^j@Z+ zgN;l)Vf##SU1Z#01i)YCI`x#wYU~wO;6vuP-4ge-66GP%M{}H(50J?&vTK8YSFGz8 z11?>|Z{9k8_vW2QXZ*tYYU0=*bvfM}pa`qKsF5ZNhk_*32R!$%H%3}yz8n{vq)(r9 z73ZK|9DC4&>Io4NP%x#^e;FxbrbZts$fS%Zw0w2UtHJ@g0o5#5&FxlZ}o$o0?Wk1ng+Rk<=>_9qa1G{NzDff;k&7nd?xTwPyW(|vY^`E zV75PyhoPU(0?N;W_uh{VY_=-=rMeBi9%V+2;SM>d}FE6Lwu&@g@-zI-T(>oU9yKn#$tbzc7Pxo?5 zovd*0`Br8$(x)9N*r)x-2G8F7I^z!Us=}vbD>qwj;mrR%7>WcRO5o?q45(bfOuYJG zBl|^Seo-T08-Cl>#ENb07SPW<3h$KPa_+rnCdM$!N!IfQG^>xYyHb^69EGH7>o#Ag zK$8JluXX@Za#e+m%Z{TD>M`fO0Utz8PrRIhhff{2x^P9zw27Vk49kuf7^by!vznJe zy2nbiNk2%?i9qHu1ry%I1F@Yt`XR;if=afog?;|3(!r*AOF_N+8%|iui5GkXAesuE z8=`$V&6V|jS`@SmE4{hU*RvaO;$%XF{k`_|v7GlUWCoY>`C|N^C$}D@WO&XSXbblx zCmdVfJ<(TLQC{h?m%A31R_M!UQ2yzZ{^P#lEJSE=6*$3pC&x?}V)ZrLV8coppXoa4 z-L{LTaNITCqZLVy*1yon-rF&srq~@Sfw=F6U*>GbSnPjeR~~ZOz|s4M8-ra1QLb{Bl8*4C{_Um)l{>}qK#NVXaZ%W+$14}_tF`I#J7ubN8V zGhlEH55_9WQAtFFYIFUjlqS&6$LWNy*^qSgp_g^6^W=5K?uY}w#PeT_uj#A}*sSYp ztS@`J{444mS^Kp?(rHu#2+F23}r$Fqu zgR2qD@>dO1D`Lyk2!7_t2EKS9he7QdF(PxXy6V${LbPKa?oho`ApxZ9m(`ez3p2x( zgFvw$$A^p127&Z1w2o$s03v_ydAuj~;ZneIz^-7RZ8 z!Dj#$ssnxuE0Gh(g+zUa4hRVRCK^#&cTec%Fd;Xx`Gk_^Qla36sm9|*wj!Fwm zT!M2>BRj9eU&|~-t6%Jy8oD`m$jp~@i`+`3kyrr@duVJAu{K^KdHaQL9rX_mmjfco zJ--jej!y9^KM^5idi|YRQ!!sz6=uaxIo2d8bp`g15&Z&JVS9tP&m(;u53v$tylFZd zaI=0ZQ>6|cxj+=xJ~3Ht(gk|V6HQKV0NUbi{0tb#p{*s}+rCs%VZnz-*^KJ&nD9Gw z#O10^5MP=r0&lR*TTki>O(bNUb>&zuxbRPX^beYB0vf9+38fv{Q#Hm-?jDnj~^aU2go`3s2B5I+)vbXJ*v5vTbxBz8y%6%5O z{RdTBIE`2}hSgMPLI$2f^8Bg&V{CLuPt?1;aXP{&sVb35$Im7(BFy|MdsoB+aSlY* zR$$3(rUk=5HK`UvlFy6)eLGaRA}4I*tgGqEbseJ9%5XkJXi!GuAr7JqtuBa5u^5yK zIL}eFn_UhzZg`^bpx?A$Ne6+TeEdHa)BWH)GuPW_LO z^a>&#+YChQHnnztmIFwg_1wf!(;(NL<6b74bIHI=3EGG3rU&3?+|pX7mpo+2+Q0LXenAt)8;*_?*$UrAk`Y1-LeXCr zu@kX>WyIgDXCNls7%31@zftY1*{%?`j&an#by?qLVRf9SW*831DR1THK`u}vdQwyX zIZCaUH{szc9BzLo64QtB^>0+iP(JY#okdPR<`)3E#WL}5h+w^j$ft2w&NP=Dg!pNU zRwMA_EK=~A5{xy+VEWo|_>|26K96dZ&A`)K5^)4olE&#f$7&*W3KQz4;1(m82A+vt ztU?D)XmI7XzoSwR~mbS-)6a|s<`wRt5*F0bpPb|G#CD8l+IlcP$mahFWO&Z z_?13Dwh<@8j{z#jxq;LJ>gjibCPcak7>~46W99wPjc$2)zpT5L)AIZmO8FR6_}5>8 zTlnOc9BXc`s~K)iid7Z;mT+`P9icpScIjzQvR{TBET4ld)(Df zS5t%{J8MyLus?9~oI3CPo*wG#v`cc>_722TR3OTCJ<(gEH5Sks6g|&9G^9sZ+)hKk5Iq^{wZ>{r~Z6rGVN1o}Jqi$%=#tL2; z${DdNuo$qQj#A85ZeJ=`p#F8845y6Y^#yIq-8$Cl;YnX+v7F$utA{yB&|;)bykKCiCW_214AvVBxjlM`O0; za(-RArBHx;M9NH%ENU9l`+E~!Qz+m2q6&aDxow~wAaM1;?b}ck&?W|zALaa#e0KlE z(Bg9PBM4*U5o$%(V!A6PhdibXukIZ;=Nn*CJ3Pd=ywO@bCKs`djVp~<^0kP}?V9m8 z_UWdbP?*nEuU90)&vxB+)9}{|t7W$xSE^2^L|?}MGmsEa!}GG`e{+;jw+*n#9d{u2 z&1@ICBrljiE^j8H;gSxk*5GAP3qu*78_6t{xtPm!DWU^K+kDdVikrwSWvReh>$Xua zqeB;FWrK&N_1M90c0O%Cih8&;Sd07t9qh6@hihjKVE5(ZZ}qstm23^V02h=wZ1;O~ zghTdnJ6%^Z5jn=Q%@0Sy6N|6BncdPZaEmLON-&o8#qhO1yv+Tw^~+ZvX$6lI4_IZR{p9C04RK!~m3TSLS)4ws|I z2F{iqbeZJ`Wr&&Vq)&Xmg-5sCBzLVvqKgK*V=kusq4zjmotW;zUXM;#4*N{UB%^xY z^>TT)qGYD-$b4wF(rxS1d=sI&IF)`?qUGB1D@PWz?oqJKE}B3^ zh!kBJyN)YeOZe``DrZ)5<;7mX=~l%2qslL=31{TcrM(bF?W~h8#J~q=|LD0SqA}jCRm!=@2z}T;<&UpI{5A@R#`}@i>!pEcVsRn6iKc3KpI&-NN-$v)RvRtEznLx z_4?aQ@!;P<6l&l5{z@u$My=*yZf?6bc3);QnlA2cXh?OYPj-47n%qp300RTf79b;2 z)34B~b)^wrcBbK_rsn6*%g;A@h|1JiZUFhfyueqK?sI-&IwvpG=|O|?&QeUst6Q(B ztxb46PBY-6OBuMnz7CY$qbclt?)kmVLPo1s7TWbT4!w?I@+vCTVxYeKs&|p3?usw= zSh*h%nBkS%uA)3vEEcnPqlRmt)5yxcH|2c47dshHEy&|Nvk+II8!z@4Q-D*gMN73D^JOYm&I zi4ELkt-F3eZ;+}vZb*W#>#ODVEKi%4Xa5gHAFAk6)tYHqc>CXRb6Fm%tH;+bvBVUj zw931BQK+zTVwArc_3=ME!|HVou=#RAkVy%XaykTqu|2B|9-z@jEk*XgEDqTL`T+Kb z+uOG#@1~Ume05+wUkYX+M_5N1?YhD#+>Lw+CcgSc5xu|bH#JU(|JeI$Qg-g@prC`^ zb+yM3h69$7on-4Bv@0Fupx}l0%67eh9^iP%(Z?3Bam3J}VRWE&_h_f|)3!VvM?Lrr za{N{Bt!;V#mt%FpTx`64=(Aiab0| zo^<~OG?t}|8_};iM-cIyN%(3oCN)^bXCDL4wN8^ilklqdOf>{ULBjqA1qgNx0 zYog3?;>&u#{c(dz6CNi&DM(v=;z^Do4yC%UE@Arm-H_=h9Q`)k5{+aeU~tY>Gf@kj zQ+7w_;m3%c-H4_N^TwrPJu)!1x&s!|Il=y(H6F0xQr?*Nk*!VDxh50oG_17O0+xf7 zH`#bO_=$>_&R4X5qvtY4p!dl^u;Kt1dr4jOYouYxX+n{aTnv53W%*$|oRPgj4{~z3 z22k&~NRRJlJukXCk??_vAmXP_+p)x@^z)hJc|QdF(CmC-%qaPA1uFNx0l!x&tGM5A zNd>^dty%%wLUV3W$-F_OiG3YbBADgg zgXy2cLdTmfGx>t1J^FBtv3F!V=epI40*+Omvp*zG5V|CTX!dyp3xui+5()W{AA~4g zN_?(L{y71?2D28z*_cyZjimGgeyrDDV~o^wF&P5g3GMNSt`U(U8bl23@b>V-repQT z)z`{Vc+Emr;w&OO7v7}b^+_>v$H~%zuQ6MiG}OgsPNsk0k1Ag)6*G{a%V)9NpvEbW zCpJiO(%J~6eeY+6v9Hmr-~8*|8lBN2zUjeljHwvtJ0>*UUHIA|d))6L?Atn0OL+iq zyt0-_LQ9AGeE2#FThFuS!IL!0iS*|iRg(av9)CtK!V_AY%x~n6IkU0SSs(_zZ)O{I zZ_`~|Au|Ys|G2tHOp&2hW8V^<=>%o=?mfMKLKjfqgI#rsiev;!@BT9@tE>Q2RA58f z<(&CAih!tFX_$#2qy6uQa*oqIvVb#Ssylp?+MPV<9xL3*C@raZ#i{Rb?zEl&a27K8 z(I&U5I=hrKuy9$5S!Fo*e;3g{PFuC^qGd%L?yrgTllj6uroJTg;U9+++?$}qwaO%4 zBB^I`*T{GqRXr@IvyPgzb>mDSPq3XMhXS(2Dwp&Q!;H9ew#~qWIk&n{+x8|#Z8r2@ zab>$ib4CWMt|H)}8x0n%81XXW=N{kvM6NiY7|fLIpD1StT%CnU6tL+`JZHIq#2srJ zJO#-^PE6~u$X+}M$@C?U%_eB#P<|0^;tO+m9SJ5%E$wC_&}`-J^#);UsZ^Fy=^?nB z2Jn&9j_foFxuc(`0qyjrbwB4QT=dG}Lk%eQw+jE5^#Km&<3#VZ`VFE7h-%&TxvIZr zc3cl$|K(vSb`SkDq7w9a2fCL0A@6fbJ{{ZGK)BgLTLuI%@o}eUi{h+z`^j6Y)iRD# zfs6`0MLw0PRp2~c@u}(nDD>Uq2{Uai4};|*ULj;+knyFe*h*#LTDAHwwU%^4%0f*P zQg{^UT8EjhyEaD>^EpZBGw9joSX+sHk)O0(5>dHN&B`84we~HP#d6y3|Bc_`;zgL2 zoMW4KVDx$5oror|oGqiaSRep28-u}e@?r#^U!ToUD`ttw67V^4p|SC>PIC5!#Ej@! zOQS!R-IvgnuP1MOBH~W#5cEX_|2&y;d1cUeN5F4FV9)b$X7juB~#@?qNl&f&0RT3?9|xb`)Frmef(?9$EE9= zcV72(N9z3;rz?Z4EQ%qBBf++Jn*1$?^D8c_oVu8D9A6^joGXdW&-<+aN~b=wvQ>@h z?wf64P_f)*1lDag#$LM!QsX(~ywUoD(E$}zy*zqb8ODJI8;TaIg)tv2ZL5YT;j3F} zPIdLw+y{9A$GzBB>u~nTujPo!qIBD|c0D9<;8(-XW~aY0jm{>$M%_b_qj(OrmPsn8 zKHFC^@YyV!dUkBke&5@k%l1Uib+zrl&*}qG0xa;}-tYi38`QtEAo6M#jb)=NZTO|= zM|d$hxS+JJ^pWYS<)-df<%6U984-+o!3bx)dyMmRu`vI6kZWa1-maNj40|8}N?M{( z{&a*8(B7nG@LzvyNINaw#KM}8lE&|m@*wo^o z_WqN4g^pNs&T4!J7w3)Irl#Z;koyozMI`_s=HhoXu;U)O7y!EXI)-OHlHNmsed&1| zyTy6Vs8y;<`OMkmgvhqPf^WLflzB$`?)Vj(7l5FOp)WKnrwp9pf zuw*lCt2St-hEh-ZvWn9+k0tn}y5Dl{(-W&{{88tKqJI*I;7s(u|1=CLr-CBethLPP(NF zc5KB@Esrvj6GIjhPGal59;h0798ZtnerU!7x@X*HC~VpOqoI^!8y>1O6dnqz6SiC^ zw>C3d|E%o<6l}s`-Fdp57?HiyYmL^d1}n$drbUheo@GR(_ohl603{nsMcb>z$IAw)j1>CR@OKCKY3ZK6oNX;*B;K`N77yL#7oLP?-5hT93r%82#r#44%Y$#aerR4EBG2 zs(e6OZEOl5I9Oec)eY-XBBx%gXXHWKEsdpECY-a8u~b^>C-(x=6*S6sh|k#-Zwapn zcbeQT<;a%y{&1Qu0-@+LG@ab_m=CA3rRpodIolLM8~!~nm9#>py_C`f{xIS+2y+bT zEfYzqg$jz>)T^r0uMYbgzs_$rRuYX-1r@!Z2-OLJ<87@#=(*qRAt{1E>~&ElsF}eN z=#wg~NAT|u7yj7{xa*$9$y%t0#hbQ!5H#He@4UsL`2XOW_U-xdoScZM*|pqfr5Xj# z{rUB?-O%(^fAaknqWilhWY$4IDzYs)G{Lg@fy2ih6e5E1TMxC^ZHQzDZELQX6;E5zx<5O1pB#%BU+}0E?gt`7NWpY~ zPE48>>&{WkTW*}%eFbs}u6m7@X=U;`?@Aq$kjqg@Vd<$&nt5ke(ZP<7nf67YPnkxm zy~;8~PugP(dC*JJE@?ffMO>}UiltF-D8eI^-47R^XYuJ1{*hh}mc&JLw^>^HC`&?R z;-14Lu960Q>FI2rQbQHBQTh3TXLHJps$ z;E0i{{l>nUug@oG&Xc=nHBQQ09LOe5DZLQUKbOixM47d$2B^2IC}QiQ04h!!c9KarT@LT|HAwr$-eI)rLsae za*9s&bb~c9yspi`DCK6=28QH~`gA7gxRAxIiIsL(d41$9YgZ!;rzZbdy#j(WmoX>k z#c__#UUv700#JUhiwi>Ec((P7vfx_s5c}t02--(OKqAsZ7lwEY z@E4SY#K!&<^EywH@N2tSq!knMnc9cQMo|TTbchu?C4N%@LepgJ<$fjx| zBZJI6HpWfPZ`Z8Byq^#1fa_%ha;juc{=q_A9KE(FPm}!9aK4{W&E39Ita~!Om6B+l&MFofkvsHloUdP7&RXCyblE zQDd(r1;8*`QSKW?@K{3!T@ z+qGXPDzaw__$s|R__gB6R{_*wTJ<_5kn1yO_G9MBUmFpG72d0MPT;{76B}K?F3BAqd;GCNnS;x{eerTEQE!rGE?hE$bQwZdk^k3^zG)J<#?B|@E|G3~9 zVsbrTov$(T3=7^g4V>D)tVJ*ecR%Q z`rkXqPo5tv+#ikja+_{rx|S<~AjUVT?|$CS5ED*EM(?q6*XUI^UjkJUA2IkL)9JNskS zqc=zc>%(t<6gnMz3V*Ad#?OR{T3&wiwr0O7W4vI5fss);m6ssrC~;aa6ym|g`o%Fe zzZ3UOrK{SM-L1T$+fTf|9Z7$C8rHeH6XGk?dW5_7!)?ENSKI}-VTpa@ACRu!WpoE8y3KBuWA_<#VFnJHl&qoovh zbsyyQl#NE(Js z>OVbV~Y?|*xZZSjm?LL#gS_R__ zz;tiFbDNWKmzu`b=z1VMIA+{)Wd30spT90u1Z=3Iqcg+B=J1Nl+Y`LdJg)u1#)hIG zB12G4X7$LR>Ec=byyDk$@rzivgx9{-LGwMDaDB$vrn@GiQS*EoKPH%Aaw#S+ugLXuF8JITh->M#QHRCX2@39}TMX zT*VT0Ff^8X>ehP>#eRY=m9H?)Mgu*(8v@CDlW$ylzTWom9MAfAzb9GoJDIQZQdHNi zDUNkKcUU8;HRl`%2-W|l_cI~9k`fej2j1##9M+sUL~*fO-KxfuY{jo5+GAR)J5r0P z16-Qhu7rtinqbL(y~Zx$LcQJ-+n;oN|SsN40Gpe>xLqs=QWt_a9T{2x*t5L#H@#sf^C{Y zv@4u7%3uLAjv2I@M+cWRaCk9c2vdFi+}?{+xpx7!DLy}RhWIm+#;u~d>q{qkLe z??vy?>gxNZgdQgP@0UuV__e>xgcZ*dt#$F#ic&5jLQum7UD8-S7|8v)p;H?fuhwLiXo zCGk};E=4Hmnuh8lKv|J~LtoQa{5qY_gJCzvWCPs1G6g*L2^67y0{mt-i?h7xu?0#Q zZIhk=C^?eaTw>V7%uK(*Iq5;m{5p&HrZ{pmo?E^}@1C%8d3G%@sSxl?1LZ;C*47qq zWxFakzaX42U@7YdS5@z1H<&!i@&MoLP*UZ*lO~BvfACeVTf)1XEGq!z1)1XYNgmc6 z#u3mWjg-<1@M=GfV#1Jk!DGndZg5o~wP5x=R3O}MZ9?EPvb8jr%+l5AWT8zW3 zwS5Dq-TUsYODkzra1qgU;4+!r+2m!6uB-o`O~*b{a$D zGf#45BYo!gNV;i_aA_x3?kE11`Z4)?4=ga;)|T@gY_?8+bx6q@(1e;G>JF_$R%5VO z0z5P0#U9td$ZBn;(gvP?u2j8a#-ZR1J@#nhcKCtGiH@~Si4rozV6R#5{WqD8C`*Iu z&wx5cUW-3+cf(*UZ8mGRrh+|H3Vr|MW7o4j&$E8lWdZL_i`0y!6If5@yCucXa`!+$ z?lt5)xxmNAn*y!{nsEMVzl*UAzq=iB-qT+W!p_1ST7ZV4>NU>bd?*Xtb=l~2;5e>a zgYlhwhg6N*fBpZs5mYY55T#p@~QOnty@NS9^lx)Q>A34To z1m*+8(>wqtiJKbTWYdBLy;9;ENe z?pJI@sC{aZdT|-%BqvRf<9v*x)p(kK(4>C#X}Zuvu@>gqQ+CooL}VpJdf$QO>sLJ# z&3aSFzID%qzSSxQ(k+MrIQUV2iLatwey1l5in2p=QLg` zxRfFi5tn|*(NoP)`i{q`Kubq9&El>q5)NTb&ZVpKf>Ql(Ug@EvMiSf9%G{0NHf=9w zXZEO`2-8Mn^h0Whq@!$nesx`w3*15kdvXqe6DsQ;H*ZuujJd}@=OxvOKP2X(?IOesQIpOOzsWS zo;rLwdb?a4`>K>~o*T(%0h>X0Mv%*2C=dKMEBhfHYO*8^f&y-~0CFpHRjH5cK?tBrt0+-|a}EOvVhp z)UU2>eQn&GH4M3h$r3Pu_$G_KIt7B{SM7$ge`XE4?9axa@K(x^qPg2VUt8I&-id-4 zVbFFD*aG=C-W8x5Gw&m=1*F%7wTc5XVDPBQm{@CL3!sthF$f z3xm%at2c4e$nwkfRZR#z(u8+M3h0BrAFY$O42j^(GrfqAMA9W37W)$e+$KhL7NVaC)NO zebh9<+DV=lo>DXY!yEZUto=Vi@WdJOB94};j<5023KNrk|t zl&Z(iukOANW1W=tB+*R$iY`7v4wo9I;&taGrsztsPl{wazSUT3u(aIj)ilt!)X8=$ zO?ZhG8ZY@g3pYpAm1w5`4yq*xu|z)^Sqh zh6AAzCM&NISCOES`sll(wD#yYJ$0yEKC?~l>lMA~$~!fdb}mk}R6e64ara)56YUzC za4}O)hqZneBa26%?0{ipuf~8gSg{An?sQJ`!bP`>g~FK`e8&B!4XgAaQ%*t%_fLT@ zwta}H^^@S~{^8tpc23i$Ap!!~jNKEWTtCY3)Sk`@gowCo1uWp3=dC+dDtwS@6@WaQ zMuRH68)5yu8XL$_NWDXQ0hftWDs zZviJhisXi58eZy%zCX$a%jQs<57n@?_+Cg{LS?N?z&Q$@Ygv>xorP;l_?#gj3U6QC zX54);F=yqoqm~TZ1j^QFmp;*TQ)!6t6*%`!1(kEBy^P^eKlUE%ida`i?J-)dZT9#!@J6y9a%@2T^1f zn7{Dik3sjz1)Z&a1aBz|q|mKIV<}HKY8e12m*KdJqwa5L3(PQn?L@#Nebsj7+g3A# ztV=h;;(1MaR!qM;+H>5FqP6sDGG9_O>F^ttZnAwZn7No__-45WuSw`w=mo2&SrX@6Ghf z2kobS!7QScOv$u`5PF_i9y6v>etimr`)CD4#z{;`uFbt2-uMunyxZ*tRj{a;(`hTG z@Sg+RRE%cFtJ)S*!!J;&B^;8GG0Ca?`}<4sg`kk02R3n0`j_kT49J7iBtVS<-y#=M=_cA3VEO^lRao66P@ zaYA=e+g&;WnzKSH97A9hDVRJpvsGx`^2uj5!Tx(F`+k#)X6qdVrJq5T;?iKH`Om(A zUoJd4Ql{)o?_1kgJaJNzO?YLNqp+-NaWvqr^#a^jD~*d%V3a>T{%PGR{gAlBKmma^^s=)>7Cn7}*YOT#Hy zwimREm6H=n?OuBSA^w+qeL2(nL%tt%ih0nY3%C!yPqbH31Jy2=+(Kc3Kc3)&MRUuu z1@Hy*eJ;8lDs5eIBcKI8KYAxSbw_}|;}W_rB&;IK(ES1yo57|J{%|wfi@!4-Dc;Aw z*X{rE{$U5&q6Y~MCSnAo2%q^rEdpQw_sK1vb$g{0k>D{~Abh0p9RFAd@apN&8W@j< z35Or|J)w@Zzo$&)^%p3G8FBYR zX7fs)xEpZUq7+#q!-YZ?qPO*zs8@&@#holeH)gn}Ck!y7qbonm4Yp*#1bDA|f_Ef4Yh>Wg<3!`H$2L$fFS zBl&LC@qpiZEb#ty+d$j&w7VdQ4^*3_SuMD;H-l)o|C9A|FU`9Rt6BYNGQz(n&~Sl( zI3n$L#3!Bwd3j4Hi`4hN#9;DTyLoZ1v!axE)^NZwty6mfvvsEFKF6_L}4>~a0wP*X!m^zcaS=OcJm#-Vn$Geriw z@sOFwRa75$S#B&rN8v|kQBCwOpLU9-T&S=^qIkKa#dCR^)AZ@kmEh|T!u|I|oI33a zNpasMmj$4f1AF+8@@BK<90}uiYGUfhmrn{#i6i9Q>nnj|cBP-``*_$Zf;Y~}Nx}i7 zQkEA&a&mHAY=Xlb<@BpBMNOAC0z~Atu}{>=rPQ_1oDfcdiiS{xcMDZ=D~vpP6n*{GVnEm?{}Who*R9 zAHAb?rvpn#%(u`Svhy*J5hLxzi8vqXUI z{3rt?f58ovw%2x@hB+=P6Nu#C#|OGDVD+Ic1x;Z~#q6pKdJV@gSkPy@pjwiCU-^c>b$wZR z<4cxtU2N}^;0rg#Gyai}v7KQ=Wi(tOmc!|ly-maR8vQ$%7hgUZ#_VCOOK6RIpryvK z{+@4mj{9F0L_WjDh(W7A+AxDkRl3LB6y6F`md#35GD&U;0H(b^19C~jFH+iDQ#iPe zUP)F^-@-TQt~pPR#6%?q6aG`z= zLLoc)73J}6$0cRVu2r@xFL&TQy$BKAy)~ghIS+4)b|6T<6D2A;R^PkHbUNFU2o4tq zEnV)z0*!K(sSIhubb_e>lDw~TQnVHX-G_uN3^H�cLFN6b_cx*wm(`Y=PGid6f*N zUF)?<2L0YQ7xzogKj43VB%36qPX8P?+fCi(j4Ih1x7Np3(A1SY*E{3hn-kl=7#Z^? zn2fLX&;w#Rc&5nlX3>dN{K;E8zWWOwluwh4Vgv16VF`CmjMsj#Rzz6&kCJ&Xg6DgG zM0yc8Vv&o7Qm1@RzX4KqKxFGkn!h&{Gy zNi+raP}g~GZRJ<5a)*TS99&Q|QXzZ~Eq?$p znU8hPgq4Ll=CnkftoC=Vx~zSOUOQl)gNkygnmA>6*b2S*yfO!+`oq$_R01L^A9;QE zp|=8Pml#fV=C1o+K}2?+xKpa$))It335-X!S_V}eiNt$nhYKXe9fFf=Nfpq7jHW>B zdfbPu{NzWY!BGC==j(26`?qDhqLXxPP(Qcvbb5M`h`o^ak3_9%DRH6M;0Wr+2c!dz zRYYdPSGp9znBUPb)nVR3Lp8VN^rlMV8F6iX`Wfb9Y^8dUQsGA)lTt=Cw)|gDW4cpc z96f!Txt{#26H&a}i(xWf%-C_ZgSQh|)cr!@(R72rQV^yYwZ_{z2V*1b7&Ypcfppr| z0kS5Kl{y%yw!I;cdQ@PkOH8gN_dA}^>TV_PP(p9hhgVi;C}J+4uJ|YD+Cu3)TA0j^P}qRFnWZdOGA$jcrv z@mSHjtb(`>=yVC`C+tlgbP@95epI_eqE5`r&E~mLNF@68y9OKeR7#pCA-=m2&3gnI z*b*9N` zWUBiGnB!XKN?Ap9#E23|-A9Z*j8_-mPWXM0*bn#nJgWLmFMW=4wcYX9QyB}10E!`d zn$}qJWiR3&Z@ic7SpiEkpB_w^IO*9NQgSm1Z5WJfyd=KtdRXcbk>T~FpkmUdMZm?O z{}kFLvWeX!+<+74eYCzuxtAlOTs1k52t+gB`F(thht14+sH?;PsNo=lz8u7xbe z@wd?TFSh+dwExP8kL><;>VHWYiery?!+i($1x`AXw~mvQ3%7 zUlb=#fLg zj$d#G|F4JuNLH`G#6?|QQSkhgEdXmmO?xn&+BY0~UjK}qsbDw>!pzAj4i8oT5cZ&v zVK}`Sw_Ut%({&`>iOJC=Xzx+(fN@O#l%iJiETQBkIFQi zM}E7Tg&J&AJ>Bx>oLJUHSHF7z451Hjo{0`qhZC=*lhnuHN?i&GSI@5FYI@H3*5mqfW*D1RaggnzHLz++YFk(hQnj1pVU3X; z1w7d+mG-WB(Y*EzFAFxwD05Ss<2gmp0&N8|P(niq{2!oZmIsN`{W6)Y*V_Y7B9?z_ zw*@o_o#AAL%hUemrvTe`DfhmIh)Ul*aOwG{o}?ym0>ck={{wmwF`XVo^#M+nJmy12 zKD87ys^Gk%kd=asLH*QQbavMDJ_7jhjc&fYhBnSKs?IJ3Nyo`SB&LXrzMbS<#f;O7 zzLLbCx954`83}WM(N}b%*nWN=1)h$c5Z4z<6Z0e~_ z5u7Ug2@w11l7*&9CVtJdk}0GG8tnA~?UsL!Y5e_KFvLj~{?Pd~Mc~!kQl>v7$KN4( zkA?i7zJ5OOSydXKDT-3|=KDV!LVpcFp4DG9uezwx@CERyoSyQ}f8UXk*%84o`$G|F zUMSGGk2d4N>fZqb-=oH=Bjm|jYnXQg0~+gu)A;itvllHe1ii>CmK7jh3iDq6_V9nd_{S2f zsG`NPmT0755dg0$YO;&LKsQL@%TBFFe}4C`h0e^yXV%d9 zCJf+>=sgpDo=V;RiD3H+V&zZE^go9SK)D=;lp+6pFMoTMlw-hcm?R@7ZZTY$9341P zYmdrd0_f^inEaIpx&EW^>#@(**iKzj$74V!w9p8chTb&TREOw7JYNDpUZMJd1?ou_AiUrCgVMbqli=ZjFo1BjS5s?d7UPQBg=V#P=1t=HnAsX00EZA#*{Nq&5NZ`*g?X1i)8Jh>_>u);u{ zZs=&GV4drYPOU!Avuxj~((%=pk!HZQb)Dh*mL}%r|0?4Yzs%22;Xk==qb`8c7fwq_ zogtZIOqWk%K=7u@9f{1{QwDj-u!HXNCd6#7n-K&R_c&f{JZQcylGod91*obci-)po zaT?A)C!Gvs5kjU)pr1=4;J2G&Ii>Sg0DDv@VlWKmX)A;t_{9H^7}C-5k-G)ly0ZV3%K3H=ZAQBjQ9fcGVuNBdadwe zEH5}kFN(+^5=MevBawFL3y||M0Ek+G1;WLp50vyg$+J=rQ5Oy3%bpuafx(b`8J{2~ z|HFh>U?h3wNNUO)5AVb3LHU1Or{5o9-4X6wqDQ4)-)FmRaQdhefjBhb`{Qn?4d+`t z8-plr3-qlUXl6?!zBr`9pI!pVg$&=9UZe9vXlk7SbKQ5nqy3l3vvgi058fxmLIkhpI=C#74xHAdy(&d%rY#=j!oL7?5{1Ws+CR zbOC=T26+d3;(!8)vOdZRjwXu_53zj9=s?=XT<+4FTWMbKH z`B9=>Tkm*^48u99CnD6vC{RorT6FforV^b6x7w#pOLzuur{QFuXLa-d9Y8`XlDP5; zzZgmVYmRhj!sljhB1nW_`J}=&?A!pIXgT+vbs_&P`6Rh%7Y&$L6!ji&k)try$eiWy zHtHvn6u&D!cilG)F=eMtfgyj#1l+5tAoRx~2yJrx9%;^UeTDj6DJ08I9ISOjjEsy1 z^^Uj8dEa_N7I>|s6P0ylZ$;b=NW+E2#5xcG5ZdJ^X6)fNEjj}HXqy<469KS{A+Mb= z>bod%;)HibfP{T{IlT{qq{t|mt-qAdRJE2%x8`7cxK*at=&-VGYc7o*#PjQPXT+0_ zU9Tv&ghndUYbz>>9uTBuyUBDv^7ZU^<3hAd;nK;(RPbzjw~>6ednBXfF(tvqAU>%_ z7>;GMnko+ub&{H#9Lw<0mSWlO$@IUp0HQ2#TUAFrw*dd6e7_qO6*phf{DU|K@F|_)P|54S;iZNrxI5vX-gGmyF z10HiO^_wE>m;2)*tS8n;_;oUr+&4P@Sp)B%5C;KSTSf?}1SqANhf5b3ht$?+o9`mN zboAEc%Jw2+)metFFWtj`rO1n<$&>qri_65(*P6V1(=j|06S z?(A7|0LuR*rfg%k3ywd)eI1=>Vm_kRNp{m64xRRL+n-HHe1sBdpBN8-2>JP`jKM$X z%v4d6YwmRvKQJh0y+#;5>Dz>#?Ph!)CVKL(v+?PPCl8EKF*Ra;NX0PYqjn{+dXa8V zFwFY|IgtCi{g|VY;lUo6OKpx3$!nXs)<_JJQg!Fst8f5wc~XhQYpawd>OtgW_sL-d z7C;hCClk(u4^YPo{uBfpE@W1)lP8>FvmiB7W#1~Pq zkEkyh*Q$2}ihf=odx4wLP!h#riPl*?GelkD%}9VEllB~5vVlW!pCBUwSc$BkxD>5X zhLF?U_{g_+U1A>n?6EJOVN>v;OLOmgNf1(`3;RSsbj^o#-Z#ABH2R#sS3qR`fzMh% zm26v>^c2kr;f~k|Xg-`Ra0Z=r^wX&4Y{70_i@<|~bLth?sUb&R#_Y!IRSd9p z-SVmy{IfYmWB*ID;OFNTiFAFCWR7-Rq+7^Op1BHMr%*u&t!5|-Kk6TR=eT-k5|cn z3O9^sv^bJ)?}#@mwicUTn(=C##j|=54e>9+qVZ3;d-$m1BxG_Y{q#z(&ZJ zWFgAn&s8&SgissrMBw@=xr}~u_|);$xQSaZ#SfZgb$TWE0)Phcali3gfrOs(3GR10 zpzAk>tcHJn{Zqts+vTRyQWu`-FG8OA@8lckmwapgsqRwn1{YOY72A_`mBskKc1UO! z=JephlMFyl1^ci+%b6)U{>EwmUP#{)LGWn=OuJX3+VKxjML z^e7}H(UsEkFnkk4UuHAyLx{5kxyF2gzn1#Srsb%x{YeI3b6r~ID*dysAi4NU8g;#( z)1Xrz@mHZ=YnAn7W(lkLc)mYxUNCTd&Z9_tcpc7AV~sHkhZmU35dexnc&FuHvOs_z zQfGaZ@y5I(2v~m6PS_lFYvb!=MP#a0^B9&yI_IlmuE@XqWViQX>N*T(OczOLBl#)?c;lKD$nl zDY2U9<0lh9UXq5<|Fh!=_%?qNCG7^P*!M)AD)dc79vM_248T;-U&Gp&7X7%nZqDkg zIx+fzSN|}L$h1*KyKo5J7L(-zyzYE1bo;_$)*m+g?DgyDo zY^D{+6?Ojc_kaKCPrz(wRn(xy4p8=Ddw*ih`=^=x_x#dP|3~oBdu~`pv;Gs^^M9`k zaCGDolZ*BrV*u{lql_#di1_!f{`UNZ2_efm_x0;vwLEK;fbPa1=92Ke5o~={X3+8) z$o`;($PL5A>C(_XV3g@V?ovK+1PpxBy;S;7R*lA4%xP#g9PptQ^4=~q7zlU)1|(ou zgoG)e=1zapDvJ^4=Y%Cqo9FU8w_gHKgIZ;mAbXEEwgohxJY}JY6omF~boIX$B~}N) zm-le=R8i^xaIkpRQbpX#txl2Wy|5P#0j~$>;XDguKO?9mPFMQ~VrY1HP7aq=I*oDd zPWJ$}Q#OLa@8S^8(q?tSI;uxG72tn;Mhak5m6)*WE`39T8oawE)e%8`-F6RsmF}Tgb_RE$+HY(8hbqP8 z^&gE>EZ78Du5>GR9g>%O!fqJcxh#KFaYVZZMTiM~%)H&&&`9P72Z1hrT2_WP{{nac zX4IE_nUYVNtBe(zY2AEQ{5P43_3O}Lx8IH3s;z^zfy%5X6u0@Dy z`26YZ^;TdICMAy*9MK3c)64Y2*tN14&0uVrrA`e3Sy({$A-CTBC=?G;l5-GhFagm2 zAi)&+y>;=jpjDHoi-8WI&&+mn0VGk8`nTG5ZO@EwA;g?IcG1;V9SlABG!wj}>8DCgR?~2Ch!h4@n1hnjQx zV~u)2RJ`3L0KOr};sAi3_VD$$-GAL=3~$B&LLcD!N>%g!$9{fb#BCT3*$i*Nqp-*j zce1+(4hA%2U@@rtw8fH}-{=`styHhJFBk^o8M|kCbNhINc4XoDO(qOToO(6r+Sk9z zf+oL>ECMdPvE*<~;^xFpKCj^yx~`RlYnK=a_B(ro5c9#rbJI(*+#b6o<%K8RkiKy8 z+QY^doHp$ngL;oW&oy4)0)Z|RF~hjm|2Ehu1+YobJXX*m0(g*Y#e3&%NJGH3H85K3%xJ?sg2ibfBo~E8K~-*m8h$8gGR$3BkwJqyJ|T zuy5SKWEe~eO1Bl&3(9^sW)nML&Bi;;>fHl3D=C>S@hbB)|5y=iY9AjuBc%!+Rl|QU zYEjJ*K61Gi$pBiHa@hLAtmZK)$=G#^-wnl!(ycT#c(b2`4^UqLVB^EXln>A5y(aS> zWC**sF5Eq;wUY**u8PepUz+k;2eeAFYh|UofSU3yZKSv42h;V?+0+aPzbE2P#^`}e zQb!irHT&LdbuZxasxn#vRHA}L>Ydd0H?#Fl8vvD{oI+!Z$4Lzkfm~u5cx==R+-ZpA z$s`cvYV9SWGJ{4-o9HOW+{AF0F&58b#K)nxtDNv7w zxBpadG8F_#;PaB+-kVl*s`DP#8yob0@T$L+Q+D&Kg2F_yzLc7(GMLxs=Zhe}Ux z&h&rF&jBweH1)4N|5x-Ih}q*oP;f{?_QPdB3niQ3j@R1@_m?r|zL(1ieytLHK!@m5 z6YunD^rtL4e&dfzt^uUaL7djY_iQ(SHJCNA5 zFaH$yCO!NnUVgRR#qCRVV?^-F{<{XJpD7x23q?eIGn6O?0=r}{TfJdrJ^`I?J`wcR z;FpEQxvySV(}hSyGu`M9^~!4FL;gWzXKtcBZeA=T1M)JpYM!cZ5Ydx?eNj#mSIg0a z;7G8h#GOw63grz0z1QzUuaeV`G99aR!jrvsY(9@v0%+$}^4G+4CKahdPQ$^l#4tK> za)M3%J>et-Jja$Iofu@5Y7RdDvQ}7&`m0SFWn;31R4uHyYhv0(8Rd&0BXaOJF(JneM*qpsEe}?xY9uee^ z+Q2B^p93Jvwujt%4n9+|bEU4gDWzkCDf2JNd>cJi!@mxecC371^StQ!JhF1nk<71K?6>e(7Wbgm#jY^lYpkq zi}~yDD{NTh=o1q@Wb>qJ5I?yo8`CM-)I0jNt+~la6=qZ*ftz6tBn=Fg)orp~muw}R zZVg2wy-@=!S-uQ`g-cxRluFe4I%)@(mKS+ezu09M*UEfPdhqCaXx)sVP0lm@zW_m- z1roBMBh|dT-U;)3)$fKP4EcY+JLSex=a+uQb3lRW$^@qv@;=J(fcY6#9kruxvcyZ~HhuGBu` zV9LkE_lcf*3ky3FGdcpaXI|B`2lFG(CTFRq8fU)0eOz&dQcZU-H}I^qMWQre9z#6E zwIHhb{-Pk=esplGflF3glEkl3#-s*=s9xY7x}x|$rBS)~P+;{KNU;6*D3$pXpt4Dk z2S{h6aAnx|$+ag-roL;YUFCE4*1u|-CWO{piUPG}iq%p1;VX7*o;mw>Ky~#Ozw>?Q z$Oe4NDR%v_qwSJQ^BwX$lzv4-SQwh+oKiy>)h6P+Ei*x}u9FNjp8kBHM9OC-io6O+ zuCC%UQj8GB^1s9&qSM_-*aThn?viBWoUH^yH50yV?h%y50Bw@7$%1X;(B7ql7whHQ z)x_Rv2c*1lW1<&paK3Fjw^J-7s5FD>#r&wdv-`;bJr&3p?pS_Rd9bMl-s6ck#7!^p zS8HGW`0OM;srLW4Y?5`jUmmaliFx3HMn%Fo5I(*Hm_v*&KMz>^RHyRE4)G^nbTVFJwA|fJ+KR{}SzBtt^B=ajADQYzr>6E(C4_{` zAh63U0&p?Cw=1n}9Y<^Jr3rB2T9^#n)vSsI&0DkP#Vt5FH+L?JPIH3^X1z7^DMc_S z>rDe1*4tNrHdJm>($pUl5u|z7_7EeXqh_yN1HQLo;5HavL0mQhE2x-Cyx6P@vY49C zF};2#2TfUaA7 zB%35BCI>ABf1ZSE&V=jQlwr<|Ld-R__sPpjx4}--)Oq^G|Bt)B42UaSvW4LU2yOv_ zyIXJ#?(V@|fx$Z{np6ty`m?G2f1fb0#fy8A_ihqWwf47a4nc_46`QJ$gZX zGOOV`zdyf;qQIrUO<)Kb9?f!QGBEe_Hj)?b!+M9;kHjNr4}%E<%g+rrkYpw0C&$J1 zq=R8kevDP$!y^|W#e~K>u@hcD}!IdN9iT=%p3v6jOAbX=w&SZ$-LyE&sb9#-I zA}1X&_IRlH=*-AsNbFO^oN_}pnin0h_s$(nl)71(2PJ3Zml_iqT`bgF07dqE6@?cY zPNHLJSzRS1UKSR$%XJ8+r|Y8)@xM<01ejCjIMmR0Hjt#tsXnv65@I<}aO|RKhtOS+ z5X2RFrJ74zEgR-p{BwW*?+Z#(zZ~jpcA|pe|e6?0A0AKYHqCZ}I+#Xd* zSE~CjB7!yq+Fz0XfXheO5s`mQ(Psxy|5hl5NXQ3B4WFK(P~ih}skcJVQm^+#nm?4W0X?9^oNf5Mw*aZL^{Keq086cfAgDl4EFH zfF`_lFBnwKxN&0);i>y?D?3TA5Iy}^CXSM4)(_>3hvZ^@iJI7iUE_f%qnZDfYZTuD zDvJK>ZS=>n=#(x)c0LVhAFQDSb7g<$=L9t67VCgqKngOM6CJc+B7@K*hq4TehN8<+uR>)v%QalikP`vX% zHwGWK(LvjG=cPhpkN!Z!#(vh-`Vqu-I~~@5UWa z?~*N++4X0u)w~2?K~1M)FM8K!dh9ligq6IH+j>a&~L0YCwIHmSo&eSQ5O&rBZ2=~Bf8FhFQ2394i^(VPIRfoF%atVQJA#W}OIn}Fw^ zLnD$l??FXcXV${kGbqa0d||BJp>o(C)9rENf{uZv&(So&zXdM4gQ94#1qb!qcB#=4 zpt2m%6#rdf98N(T&*p0 z72-|bwYQGW)mjp)UC8Gwx@>+V3@f1%36nU4##Qz7_?Nb|t020@#n^!NkN;sZns^D_ zs;SI4L3+JzZf8(fbkUDvkvl*_=F2Coi^fd(oOhmAL0nt$_OBrx}HTptQXW!X6WwJ(mGgKM9IdW~wn>D-0fHdiV0wM-qC`>%Y?);`qgF52fu zCxdFvHv~LSo=q~LoS!e#1?&)u)jOOZKm#+~_CSJT2OSUAl!NaO(e8Z7+w*~Bz)K(M=M9!NiG z5YKKmt5H>(t!dddj;!MV48vWU4$A+-=lw?~tZt8jSHBAZUm^kn4r2^6vB*{9n}I#b zqsj*o(jU*akASWMWT4A%pjRNP?M7H4<0}7P{epzadt`o)9wR`qIz#m1VaclBxelJq zsk?=exCp)V{nc{MYM}4r=JN+6=cF|y1Oi6uMa6typru}figS>DzQz)3>kyh$F_RhS z?P0fE#9}U-BdGM^8+Z;2#KXFf-nvK5^qnZQEx=J6AZ?Ft> zM(g}GG@yZ7eb7$!#)$@qIu*VG`EobZkflB$_)3fHVq}1c2hyp4P{_+B(6d^NOWr(C zetUxYNnF`6i$&K}F!_J6D?fIfvf=??I5|`yz|iUHWn|B_=}XRc(IZIF9-Rg~*Vb_KvWy{~f8X^E%WI z@CA-b3hDo7ALWBC^o|*4ef_wS4h`0r=H?>z-iXpr1~i~tT@}y>s!cRH`su|Wbta{{EC{&#mesVYK7`MAQ4NVK$PK;q?YFKPM zu1cKXT=Yii(yQczNHo{!wPmQ6tMv*s_k|f&cD;t^Rzme!!0@oJn=d)hdwb~-5haxd z$4d(CeK*QdR*FN$He8^a1$Ts{msa z{3PG&`Mo=H6EUa^dlg;U#az`&o6BirZkx@xiLn26TiNj7pcf|jyL|@T)#5LPVX&3J z)yE(l??NAybe6(4d_wSDbq3xyuVQRPvmuVeTL1uTm%O77zm98vy9N{Y=)F5Ax~b9#M)6Q(426@5I|U-x!V8^E;uo|7 zZ}OY4al50<*fz9hNV&F*qh6ef7Jqun!Qc!x&r-rt5^EU=rmI{l_dQ6qBlPd|I)hd z9o`X$F6UCU9gwH(vcTum+XsNW1YGwtdB%&k9UqVS7GeIpU%OoKRwj3g9ER zSp5KS1vTpNdy=8cbo?Fvx(6sq*C{ax8xwsVUWq0Wny_KZT?)k{dEC)m@xI#W;M?-f z?0JG~WP{saP`%XmR)~DKUZnWL7PK{zjs|)-C(92b74Yss7u3xFQm6~8^c?P2e!0qk z*u@>7T*!f0Hv3~3*=x&w;b+j`Oo@`3Y&!}!x_sa7yWJ^vfVLe>>H>m)W1`Uu*BQMQ z1E)mDRb11s_K$t;&nyrT>86XZ1VGBmqi>{zPX+rkP^QJ%;n;^?@ds#eo+n3qjSNwc zcyC|V%*d%F`c$7KLZX;A!eCm>{Fkj^(XQ;QA1(O-U`j5oBjz>Z3%4OcdB3@1|8~3S zB{juAS5^Eg&zp5;V?02g=@X#7=+%et`l!8dg?IB?i@Hwwzz{ zLoGr~+bv>Z#(96Ca(Mn>)vYyRYMJ!K^3f~e1RCr3imgX7`f=7&@V%7-R8ZfG>cj!% zf9a)=C4;6t`2xXV^))2_&-`5Fnzdc$442n|cZMqgLFd!e9S@fja?7D@TNtUy6(}>mE^}-9508;Rz)Z%mYn-@O49ha z>CI7MA?~3H$ z!1EF|+QHw)KsRS9t6OvR+lR@Y?^h8ztr^qj0cZ{<#{e2p?ow7S7zPm(^6Sw%M)0QG z|6L-)A0TR(6_Vycd5r~aa9B8-X`n&A-x?8F-VZK+5I4Vb%kwsK{E5)#3*Thb3<<9G98eqRc0aZoG0 zpE5NuZLufg6y|V~QjO-vxMl{mYlRweC7#-D*Co_hv#%DAfHTQB6a>Y+r*Gj-~+AK=$ z*?l2AjeXMR?Qp>tG3mYe4P!fqe0@{~Jx)@c%Z|gCvdH@AZnWJA9y_=y%h9)OiOsmZ z&zRzmC|NL$*EW=XLdf<+(BozvEAY&3UbOcf;f)ck_-y&|zy<@vdecnsHZb6%?ux8c zgScrSS_H0=Cym4PXjMT`xdl0C&QK`S1f9e^k^%fFDG}@4oAGIck%n%{V5Ciohh0HL z+K>~Dv+=+VultXz@Mm&j_q{+(t{g?k(vgPZ(R7f4Et5g@66;mHi4;D#;yF_m{g8!uBqHq8fX(%5yrCbl@#k% zOp3NMBr2z_K_a*!JVDC@u|Vm9{=+Uo@6Nj{Et0I$Hv1iZJf1wa83WAH&TgKkbZnj9f);h7k78 zLKg24*gFIc-1nM2SrBKI?R55Is9@D=mT63oJ9L+sb>U6Vj~y?ioT3jZ6TQpTVkY+D zzvWlwQHHj{A^05cdW%8ZWDGO;Pk^xNiZ4+l@#!FJy!K`u&N!z2RA=lGDwP=8`nui$ zIW4MpMZ!5p?BNFO{w!7qyWk#|VLYC2A`$dX2EV|rYYEx)epAc+3i{w{*_PZENL12$ z?`o`=i*d4jhHJ^hYd`s=)9iSBw5rh0&Hc?5}FOik+N_hL>IxcskZ<1t#xrY?d z?RoVLsAkHHZN3;QS1Ybn-B~4Fs13&F>3Vc%<~)D12q=xXQyln50zTH43F3dMiVEer z-kr%!7ViI6<6CzVu@(@KX_NHnGRDv~!01=2qe(yEFr#Wq(Wh%oaElLnRujfc69JGc zQ05IZE4~EMqi+)gmyq!?c4PV`OB_0ec-y_)H1l7YTcFy0Z;6!Am6n&TSqmT}iv}m) zzwYNyYhZFBwlI0_Uj#CmO~rnQ@rTVoa~g41T)^Eq5G`d`Ee(7#aU0*}PL0{bf3;x~ zkmG3SeX_gnAhYqD! z!XV@+*FK2lBlzB=fvJM-1p}0?4;(Xp+58%g>Bo4FW~-LV8P<&90T@qq;GBGQmZTwg%& za6Q~k*AlSd!c}F(rAT(@Fo|ha+J17ulc2=DmS3}lvpVIA7yv?9>h_5#K;zzh;JXII zS|lga*5@{I=Fnq11`$+b`_|4cAk9IzpVw|SGNem5!yL^jXF*|HN(9TuL{au)d+>T{ zoaJO}Se~wu{&f3?4eW^?=t>Q06@xY5`I)bGycfN zMf!8rT#I#OKxei-(MOK$9^S8#wTgH24m7nW4%h%?wDeF$6r(Rd#xKK8lDLQN3EhVs z7gqNhp_+|52`;-|DZ*h?jjFv=GpUjDH6eVF=G;l++nSf#*$Fw`I6DK@X|=!}%5@(%=1hcZBfBl;wRNzj4r6 zvdsTLtp;-wH?PQqft^Z=BaD9Zil6WBt^D2-{aD6`>X@*Pvj33JNCcB z{DQ)M9MjU!lyHGJ8h>jc0|L zBQBcY{=yHrZW$xY7jzHmF`N!~469aNs0$v2|MC}kz)WSielq&77mg!xc%{KcB+gS4 z+}bP$l_JDsujq>G>eQSo>C=;wt#j3zAInZ2^HGyxiwTeY+Biists>o)#j1au^?xa5 z-bO=db07#@-KEFiSQu?O7{{jhx;6^_AOp%wTN&nn-fW~yX`wS2t5ElOx~8`*ZM(7$ zjiLw6I;~l2x(w9Cwcv8&(}$l(|0Gt3KIk&H>6#9r!p(iLjo|ThQAtZwd}JfV3)P#w zFg25@$7iig<;-VIS=Rq=@r!r@&~-`XoLKco%NFPaJzg(#(6;vrg7B{dqd8%onGIW# z!C`uRSUNf}8v}{8jPKaQ&4!N^t;r(me=-Ckh?p#q7`_H+`N*!yhLezxtF{z&=7jOI z_3Q}38E5w^fbdDWF(wUR0ams1^2eQ7SaPb61Ud9*w-%C3#E3=Ds z;TnUpnorfcD=0&WgoQJDfV(YEt|>32=Jc6PXtk|fIL=Zn>J{1?fz)fuJ(cThJ9G@n z^WA=#5fn^K4h!V*0d!9r;$%{w@a&;WMPQN?i-~r_HODmbyDjHW?9WG95lt`0xKOy| zun`k}r!&bC7n0`lQ2S>Vt9npXvW_3hGuqw@SD%c?$dX_AFs^pP!*!I3Ye?|db-~%c z(L!HNTnILQlOMY;&~uHJffXcN91)?|UDc~F5=>3=SwYMCw=g-sx2&uvHR2vtbX$l7 zX%QVdNHk4Y;?oXU0mmc|Bu(Kn9$%>*|vstKiKwk1zbymc{`X zTR@R2H!6oE^}35n{S&c`dh_^J1YvKqxiUQV(r)`;4p76e8c6{TYls zi49et6_E+zwefKnRKkaSkbIIvu&&Qk=rnxKP8W@BlT@b6fPU(xk-O{I64m9t}eSFe7y++R3Os zJ3oSghuOO*+Tj&_hrOdahb`uGDOujD^!juHaakX;V@tFl;$dK%Au$?R;Ph`F!uSVc z?hy6Y`BCj@Qctn)L^TPzzXV(WAOw~{SL@=L~wCnK~5FVpMJ#Vld13Z*JIy3rD6 z9wf^&mHusjx&Nl;&5NK>A!s~>50-qly6;GKoYzt9ho5jz!Cl8jg+l{XNb2OhT)(d? zL`9O+`i+IjiCgFUP4^=U3<-1_`A=kmV>U@fsfj$wCQt8c)T>7_Lb_T#PUgZqBVKV}c*?WO^hum?ouPOBW!Ahf`W0Nh7?}s8N6QN*W9!L(s5;n@p*o zHU`V77X)1}i(WU8U2ksFyH`Lyn!_5d$PaFFKp(7QX)W6oWE1%HA-f z7_9tI?=mJxJL^vSTV6($uL~YZwrLW3XnZY*t_RwQ)#<(@(jy7+gD#dok3=sxgP1SR zk*1V{8XLWiM!NJ%p&u8x>dIF=Eh}DQEn-RG+%+%8L#-P*&E36R-b|I@>8F%>3+0VEL)eL%ZyC=)-Fz7#%_isKP)#v!g(~2#@4q1OpGW| zM7?N^aAdC3wX0rV-#Zg}EsucnS^tZ8B2*mO9Ea zEFxVnq5)oxVAxOzXUa2UnroJx9_sgAnOFsa-DsU+UGO#Xv?d_ACwQuUVRON625$^O zfmXrYIEri-HI~g{M4Ng>mIP$&$=bI$x+y$>oqD>4WV@y#R5k0DFPM{(kiv947TJw( zIc=H^?V%)Ba`w#A9rPF@BG9?Bw*5NO;6lc?cs))3!@Adn(sAQcE5TJ?dHL7q6G~_5 zij|iZvo_h}i4aA5B!c(um;O(6`pU)~65ya$d!J*|$R|k@Ipn1C0cjjGTa3NYR?RJY z?yoNllC_IJrIc&C+(^oG84M z5EmuUXUrh^QW|Rgoe;ggeVqn+x@e?6%iU!GRN827R=O@Z=3(<1p zUqG9`2dZjWL*!?f?Q%l|*6o;@Ro1$vWVBv>fYej)fE%hgurng-9Hj~SuBf>O z&ZKeL5OTP?Xs9BZSp7WZYh^I@mh0INScOnbDDa`%QO0j(aUk7AoVIK6Vzy!V;b)`j zVRcP!oENyc*iLw74qxZU)M9!wmKm#%k&vDur{`QeJ(r$|&G2})Da7DRE+UpS#;kr9 zdxxnu!w)k^$7wW|aC%GHL0ckT3?{EC>0(Uw8-V3$N*AQJocAPJx9WXWB$W6>$;22P=N7$+D0!43Q3f(kkY)4n-kw%Ac;Jwjv3LH zS^lP5%MOme=!4%V;VJF%w)7nmmJ6(rAWE*15LW$FO*P-dPe%IbN6UO$_$0~V2M-oO z-{5#6C5pq`!m6Qw-$dn0vV{W+5%#=$%kymc1q*p&!)fA%So@cIWr^r=rn5LZBM39o zwwCYqMUDqrA~^MDoH4M$VXwoONCva6$O>|`zu)s%A{ZxcJu+pdQhhJ3zz@<``FclK z2WR~r;VL!ui;Ya^~AkxI7q-cGzSwILENx0;r^dS+$t z*-)Wja3ODWj{n%L0qaJb$;Z^Tx7&0gkE&33zOB&#zRMx1meTQJ0kbAsTba};aa^T7EFc} zX{F)UMjB+x7QW>?gCzR*$~gCtiSTsgOk4i3Ymk5MeAv;d?e#gnyi8LWbS}g9X0B{n z*T^boB|@A!9(jZrA@PD7lnmPEPEr7E+^2U4u3V4o1(9M!7RTT~z7DhuJCf>}wcFP+ z)F!;9X)hlZxLNCDMN+=p2y&Z_)oxvwGC~L-oLM!-Qyh5|Zfjv*yI>HgIt@YbCf#D=?*#m+l zOMUS4nTWGdL9)e{A@0uL>W{Chw7Gb<#_(>YiN^ZYeg*_xTvgLwm3qEYfW1)3S?hn3 zT3S^7@dwI5rwZRPjw`cSNx1#&*jkk>p4MlGPObFp%ZvP!hD~I{1C^#Wsn_*<M?NRcdh(vIKPqQ#c0>a~%Lbym4$S80 z)G4546$Uufgt!;S!#_bl$C2Cyr3-hAs)?3#d|DKqtlHE52oIb%j(OJy%UG`JUtZ7J~H*ReHou)RQ!QQv>Fuw7#eCMSjSF}mP z76ENRONI<(ME1vw3YD+Ty$P-HP{e!#a&}@G;^SU@o68EE#x)$Va>ss^UMdJ@{IC9C zj@H;Z;5-UwO;54%gI)Y(2)l{D(%*cZ-oY6xncIIh*Q#!4ghk@yoBIrK-U^jF- zH1r0ugk0)m5|>^n&*LL1uWz`J!+ng(y0PLpjr?q^kq~q=I&dsPz|r?LvYdGFgK6s~ zDLg`Y%|+)KGF=`!zxD#wyP%ZCA9zH31zwh|S)ngCEtL0BlqZU-6r1WXKt#yZg5gzp zel!YB?}$y3#c?gGI;W^sc*Kmp?+_1W@mU#&mGvZK)b{C{e2W07%pI!EtX|RWEoxH0 z_u2kP+(;t&VWObIGaZ^U$nn^HIIU^GS_~DIUu3(&B?+(l5^_BznU8G?PNjpW-7FjAoJ_ zg!G~bq)-8qS((Uzr!M!%fyafh7b9;IPPm^ag>q4r##OjiHmUdf0jJ-rI9?FLa>i1t zNVm4C`FAlrgr@J;w-ETR65(k-(WI6AQcFp*NJEuNnoSDZ*Y`)bvyf@wB7Tj?Q7XV_ z)B8!_xYI9k(zC~aX$!%AWoR;{!Bflhna&YNgvk4WaxxU{dZ4GZ!@0= z#oS2_BU^G?m+H&01?8u=WaqyRR?the+vu2Z-m)twBcr8LPOek8DZg!U1qX2^eEn4D z5bT>``(b^Pjs9hn3H_09^ZKigO{|_G&7b-uG<%1>1QLvECg@;)xQ$+M0i&$Tw5i2q z5~5KzmHUV^_rtVnQR`N@hGUes<6%Do(Dp`I22owX@}QGGNwv2Qxogv?nhxJ<4WtqD z>n-B_-WT4w$3uI5zs{hhSp5-VFxUx3nOuC!uI@63@8TRMTllEA6DtY!wGq@Qx%<*9 zV`Y+LC*q}uc)RU^_Hr4+Hlg$xx*-P8(!OtLPbJNjGA7 zP~MvC7lqZSAC)N~jMjw{5#h+GK_B(}v|NeNY07Jd_@wO!b9&tj6Q6K5E4@$z-E^b1m73C!_XqTSFVQ8sv@sQg~dR@ltWNz^iJLvB1lTF&Pa% zCYXfkRdgmK@v~ILrvNJl6EYuniBgVNHP7<%vr<0V#hpptqI{6uW7<5MK%lX@Nd9g0 z9;j;+De>Zr)qz`qs9qUaNruUS?gz15be-co#r!0wU&;|~Z?NLqLqdyY>a^49z1P7g8h|0{gUF1(WgI1LDaQ6nk0OSoWVrN`tUj-;$mUZ9+HFk(;MLagoIb_v~{jAjM45{((>={=gNsn>p&E}Uu@QO|17b;B(CG?(o;{G zk^cba_{|2#!OpT1C#!MgD3Lo=IIYJAGuV}kyf}+$VFS^8fekWpb`p&n=bLgUF`b5u z%xk>?BFzh_CgQ@6-O!gTwg%ns4z0VcN{_^ds zmH^AaslfMsV+^hm6b~Vt~ zjrf#A$Kq$x$fwNUcn-d_VfE7sop|}pAXTcAulhg!d{;)vd-v@|8QwDcLeUYUA$k!=I!jzF>YcOC`yU6F=>O!%4^t0D87WR9bcH@aaFe76M6)%^UaELW!_v$(^9dB{9D#Ckw7Atm55^EU;sc)y%@1rY9r&nvF zAc-1AF^N9046vbr zZ#Bj$jcjuJK@EQrO7~LywXc9D0CF%y_CCUg6Hc~c*NNa&y|@-T_UG)eAZA`|g+8DF z$(H-4`^A>T)aS?UdAXd^<$h^lDFP{|{5BqoUZ}9boql0#d2g+?=pQN~%dp8y(JA4j zqO|t6mz?PBUtjQ#m6_z)$-}ITWWjTpK{1KsigWPg%3m&ycj8ZP%(X4r_b*ZXr7dSU zUmb2|q7fxr;(b*-kEOj68s57^NZ?~dKh>B+G;QU!x*H6nkSdoep&;^2rgbc>)%_H0 zC+ttiAH&fYbl*6gkKp4!>Q2P8NtyfC76lxWsmZiJ;oG&k4%MwO0=&WGT46Weu!H%>%C;Q`=O$Z z-@_IEpTJ2S=bnfr58%ct-Iw{1S$T5>(MOJ}Jq$%D}*Z4B^ z1SP`nj_`C>4lP(yy$Yw_fW?RskLYFUWsshco)J=uK@XnFXRzkZYz#jXHH?}&oWvjx z+kw_MMez(hn(QTq1$1A{yT<;-tdLHT<+y#HqQ#G{Q&8lB!79(FU8DlCyf%MJ4J}nr z6FS9>#%6XN&Oy6|RlOBUxdy`0+0A^1hE=)BZwCxTx5lx3k@@2ANuD3Uzc%j-ZAZS_ zPh~6lp@_G0f}MH!ijn6&GkwuPQw!8UsOm+$?1)%itxK+%bc*U&a-m{sSuc9_gUnFldY2z4OA@|=dX%n z5mOxTIEs*J^t%h!i@wziezOB{&AkBE3Ck>Mv*51DIwfcwrdXNGNFc4A+AB{q>Xv{& z+mhQ#g~td*qaMkU2jZqi{$A1M4dZF&C{5wNh1 zPE;`++%^(YKUs6JMgJ_3OiYv-#K>zw!(_Iu0rg5M=x>x8BrG_#-vuv$QxJEcwUOK; zQH}op=gE4ZYv5}&v&e>Jartsm^Xo6Y&~FAN&8EHRrPBqGN`-Oj@p-YzP&2ggcei|ntP8rq^X@F z=?g~`|DN|>U-ke0EFN|1eltle#*H5YQT)eFluPd?{WT?j$&r8gLzxo6nt0E@GlYQR zqeXI za_1mh4`^&)ZKc5xUx0kc5l5ueR{0;drH=$|N*qk#KcX;a;_E-I9gA~b75I3N4f9zE zgjiQLwLdPix8GPK72Cm|CjX@!$FKP}vfdS`XLON#VWP zscYg>7>gJ1a2hx}4R+^e%LVT<*&P^~-VMp3Lbkpd9t^yDSXW|S4t$13t)Nl5=?o*c zcNQeuy4}fTha)1S0oJQV37=R>|37RLEgW!4fb~-NU(`@S{6RMjZ!252f7WoMn?Cn# z-)w3HoGPuDKAeTp4FXH%8m<&S>q$~&N?deo$|t-HPZ-Z!xf=sHHh!qy1!Z1~Y)#`a ze3v$0+ge##Uqp64GrgG%wPL$nE>wD3x5O~3cQ8~|8R7Qf=1C^?-Tv;zfZtOTN!ybO z2=~0GWrgb8CfEOCl1dY{zkjehEG&K*@#38Vg(tXxaC46UyFPy3;!sr%8~4EKf4E{lW7_hG4qu5-D^ zuOF^jIz&1)+a6HM4(nhq%PLOoxD5RcTGu??6iPMl1s=VW^1&hUCzfoeL}O!KUUtRXaoeu5|j6^z>c^PlI@J0tyELC z1?b1cBkF`5i!T?L;03y|g|~32s(1Onbou7f*stH{8ig1?AMUhEQ_91(8JIXX(~d4@ zpWO=R@Y&Y4ypu96WD9Vk3}|Uirw)}3l^kTj9d(yjFvvBC?HpA4 z*Os>FM@%#PkG2$WBqP|9zLN#RvgW*V&t1BlzsBCUN)9NNl~X;Gs0H$EA}N5HvQ||N z&xWg57s&lbTrIMQsEeo|{7|b}L*Cr|BsD?pyeGdq?pzv*0x$I`w&&Bhd*Fz_MT&d4 zc364%$={yxP|*aX51^eS5m61z7YK8)kf;ds+nUMDVt6#?+9EHw7P($J@S&OcD0GO2 zGPtv%_rG=o$_#suIVe)hlVOaS@M%F^tv@LUhXUxg%JuIFjFko>sTfnBciE7HwH;lF zC6-b_$TE&*fq4nNumCXyv+fxF%c-xY1Rbmk@le;Rftvo@n}Phez6wf+*hNB|Lco+t z69T89FBl1BJbkHxCRR8!%@l%H>0YS-8~EJh#ULnZZkP++v^_s4q)owES!r3)ub0+fHnZ+LOX@DsxokS}Z8F}bgVjBQG_ zr0Ur(^ppD!D?a~ z{3>I-dyh%RUS6m}uLw-aZTFX5`?G`3LD7Gm)n|11(u{xYrT)!kNAn{TeZ2@czTKJA zzh?10@?YJ>goZ$k9+MpM!^wm-En?q+&m`zr%9~5m668TmmF?RGHs8#uQG|fb38R2H zE_o2Cw}2TMcI?Bg@BL>b1;3jlSnc9?4}U?EmKMG@%mU$oc8k~{Ko&S9WtHuHYT7@O zk2d0->*yi5erHUT%g(pzgH=|tuAab!ygf2q?g7a7pTYqMF;O<)3eeH3_^UIQ)fV;gXogRUQ%~&BAc(3sJ zS}I+}E&2Tq*dnN7qnE&xwJRTCwAQ-DbZ&jNw| zTmn&!)BpMyD@#w_XSt8x56J2M0UWJ0Nd`Yff$ab8TRjkFZx3~K^;}0aMB~JsHg^S; zkCr3k!E*?9p*CWF(ZU~-th4|5el^Qb?jBP-xa=f|0w-}KT3b{Bwh+gYv#XX|aLsdl z3V5P5;NaP3B#oB_1NLEA3QOc&nIZ+Nmr=>ZZvJ!IMr;S>z92@zxbXP{P27V!F^=f% zCO7ds53OV3lK(ZNX$dTct8WVR-l&*cadCeh=;*kJa!v%gy&NZ>jch zdsb%cm@}2WDDd9yU9K%XEk#LZoJl=jIZF(!I}GxC(=SF&x_2BLp4%Ak4xYj(@~b^~ z2zu)!z_}TH){uTHtl-%JVk@HZK29C%J5`X8?{0IO&wT zYkl2aQZ$$}YI7}{NFic!-*!IcE1S9p+egc}z7jgF1TBLXvm3hOsv9-XqUjFx?}}MC zLkk#k)G65casvu>HA+1l65|5&OV1)0a$EL_7G()?)|U|rO#&jDC00v{bDVIlsxLTI za8j|v&Tbezd43-4yJu2yLKK0p{*@h-%A=}#alG~vQf5~EMJF3}lWdpMZ;y*{uCI{? zS|61E-Dz=jzZM7Qx7v6&=3Au|TuT>++lW2dSWezcQRur)^rl9PJGa6LE!nOoQUZOU zG80k+ruO>D6Z}m#stNiw5O#~8;SUInH?y-rB6mWDpmP9ffOmYM*9(^&%4XT)0pC=c z56@U+N@33~VO7pIG00*UCze#_oml=C4yMmV!^VL>ZL$?_ejb4Kqw>=Xl~^AWc<1g8 z^Tcy$Esk4Zp8>Pl*m6G+R{_4@WZ+5A^7L7g>3E)3EK8-$1l=y>!Q%#xCU=(EBi+ z0*}K*WnG+WMa|d0YFuzGj^TqkCf7Su)je@hn3$)i`IUa1c)gu*PX<_BUot@q^O(S= z5d3V|GR$}ro`TeOij2ltYkH^coPE|6-*8=urQ&Wd_qhFfIAHP)v)*g^sDVB=<@@8wfkkc_e=O&J>^!QCBH=X|=dQTQC!~dAqoe4d|Y*fV* z@X`9>)#gAI)Z2bfwzMPIn+B-%MDvO^sJ@o^z*1lI`#ueW?=DpJajVL?Z3lXv8Vskz zUiVO#`lPU$;ZS92y%0CrvHIP8{G2W5{lLIfuvNz+R>W`z(D(x&?z#QSmyD^1Re!?> zs@ZC7WRL~)4gG;N0rjZh1~ycDvUd1H;i2c>PtKQniA zoK*}d)wz_Dhj@RdO%FO@Hx=R0w3}aAYXWE{_Gk7ipKgd*s9c#@xs9lk?t$)>?j&)t4>C6r2t5u{wD zX`15idcEYEJLC`RQnGc#7H3scE4IDMo29nNcDQ|`b9*2X$X+;SoL4nO-jtv$H^>3! zugwSNlm72Mazq&cbNTekwpRv=wJr4r-Tw{SLf9kqA+Trgs1Y)wc^Q_8ny9TFi^OM%XA$?CSI|~HZ@S*I z9_b7Y`Uf=AKkAfza4LV^rkkGMwOB$Pe!*k0gbRIrQ`oy5=XIM-*ahH$R5#ocrb_jO zQHjK)n*AEl$DaM%N>B`W`+B59d`t{_MMhc)1mTcm8!U9JBnf2&LI%I7!C2J}MXh_} z2EU+5bXo|gW$Ruhs^K?5ZM>$K*Ap=j)mu(!m1x;KdtBT|(I3bbg4J$&s}9WnEQwE?avnR# z|EQZ6%eV*=dj{~WBcjE1gr*T2f8P>3nd#;4 z-FN&{=g$FgJJ6_oTl*L*=ISsGxst1oEfAk5z?{~$1M}s}!z^QkP^27uc|>1Opfni} znd7Qrmw^2|<7fUxbW`I3hO`e(_lqcg4rQ=~k9Kb1N-A4V_Y^pxgQzS4 z7JrXIQ3fADu^-cj2osURPsp{%$yBbs>5(lw z{;CW79}PJQQ@39bnzs!^Z885Jb8i(ESGT5X2Z!JiB)AiTyAvR|JHa)O;O-DoxH|-b zTX1)Ghakb-3zx!ePgeK$_4@bf-MtR~!_-BtVot^wuieix#LarRiO5QF&$F};A*He{ z+&%8JDp->HDrW9!!dsU#mg|W38X$|wPPDu`0oxcg%G0Rf3H$fb5=ctnQQnBBty{hU zt?%?xm^%N|GZ8BC1xH?OW*jnQh73W?Lq}(lQHYJ(D2Ja_1c~Dl(zJo0$v^on(pMSb zbnL@<)HHiXshZgwRV|Wek8v$N1&8DA)#6CIDff}6mSe4SSmNokuXo_y+koC^9$>Hc z0dbSO6*EwajZ+6$9_(C!Pu}U&eW1Pb6&1haffa`E+}wV1T3Mk762YpCLrDuN&m+fg zWm){bCe^kvM*YcYB-HgDViO#0Yy%R%OY8a;v@q{uy|>|^y3Q$SIZ;L>=xdNt%aP}_ zQJFXL(PPiPD0M|6@KfE=tj@)L`&@W$=d@Mg+4p1jW6|AWb$=vC8Kgtgk)zJx%`#Mk zYGu2+Z~(V4AMC!JPu!~&C-2D{_SY5#r$B5{>Wvg~F6sT% zL^cwz1Sypd5ismk2}O0ETaP9!c}Dt~#Hh}e(Z%c$M-EnQW<)*kj4;5nOq|O*@_x}@ z)ItYT5|~;AdsGNYImQ+&p=q=;zpNM*>?PDhY#$-@P5mY#+s#M!&|>hQvx8L9_IcHw z0D<_bL7b*742)r;_O@gwmIdaoDh41*GNV_BS^{hv)-`O9E_d$^Y%!y-GL)OB!GiZO zeb|p7I~$-Y>5ror~pp{NZ@pq&3+?~9oAvIU?HbJDw(FL!#kj(ab ztyytpH1gfxkzrd}5$Xr3es<1iPefBq6;ojehb(tdX!~T>{h}g`ai~K(C*L&5qFN*) zq|CqV3p_i^A#Z}o@*6tMUFk(*?FpFuPq z?o4jIIKlBW7D_>c7wAI_awHb@qk@lE!8zAwfsE-Z_$2Fd1I6qNM*PI-czB_GC_7o) z$dvEETR|I0<*ne4k&kDhf)Y{(38A->u>=U^@D_$z@g&qKkihIOr@tJU*3Yb@c^qF= z&S)}0`-kHm$9(eX6PXeZr5J?DPJ;z6LpnRMM5I&0twp9?PeUiO#XgCnP?^2D{@!V8GOzo+<5^Rj$% zfCRPYch{ltqKbmUOww7IwgQTscH~>9kPe&=M>4%U_(E!x$#ZnG?RFvQzoG%OW+!Ku z?SMfg!P~m=ooIFEOyELW;n#zu3c3luN|>I zzy8BaN+9#6A3vtnlrc0`=ydjqL)_&9UWL5kdux?IMCq@KC+xTuJ|o0*7KFL=Bi@L> z!7_KV(TU0=LEYm(N{MvZ7?VR6A&(L1<+X^XY`9l>wZqh(-g(GIe5mqAty^yM1P|Hs+8YvtwgPnvduA2q*^$Q z*#KEZXSg-$DJf!AQ=UBS*?QZ)HrU&wDXpz=C>QtRLvmyrGNf*pC))xBgBjY@Y-0*t z40APZC6=tX76IBLyQ#u2dm>SFn=pYQqlrG^k}ql0o9lOVYI$Jz5iM{3&w>*iQx9r) z&OLjEqI^R3#eDRk3!ssHUsU`AEr(6JupqhD{J|hW&<4jsPV%K>0I_Gdtvo3FHDLJ+ z4Gpl^877AN2|xu->#X`bftfrdWm|2z6|#K+w9QMf_0cdRzJI{MG5Hg{GUt4vMp4X| z&q5{QL781@CKoPS1RO0hk~5sWCzZRn3>XZ`rPHRvgrg4z9kJEIEB;yxsEBL0zl+>p zkTK-i@|rF);kvGUDq7jO7@aHk#K-y85ZW11sA^QuG+8+~B}C~-Im&BMWMBvE@g|7d z+_gTHH1~c!64NjCx9d>o`AWGqp#fImP9d12G?Ui{f~JiS7?#O&`dbF;bX9h80Qkutx253z3~<$(|St^ z02K}L{?#<4&LaFo>ll~6!lkHp10j(pB3YM#a@|l8xp_A79^9p}-F2pQ7uih-#{_5f ziTjC(Gs#k~9zJY!2fWELUnfm^tbgOJ7FYZA?2M4o#@og@+@LrRe4Ckbu6}&(NC&-532{D{XcT8ZyrZV@-3|}NwAh9njqz;{ zE75e=MQdf6!pHEf=m~0b?%+p7Cvsum%Kq8J&E-}QyXM`h$f?DKYoI(R$OX*2GCC1*HzfXTEzK^( zLAA`9*d_i<-|t`U3~)&(xwcFG7?9V>F55+ZaBT-l-P!jb%1JR zvN~XhCcDFD^^3dL=dJOjt3kqJ$8^fnGZE=>G1Vf_T7bb$AA-*oB!=&|2`*jHj>9@G zRw@21dZ<{rFSQ&UpE^ouRbZonL8tmXHr2X+!wub944zv-2meNzP*B@swI#2&i{OJS z4K!72PN#8_)Fx%r@!kT3vzB{ySj4hbGyDwqO`G!<&jGK+4-V09u&s5u;!VZ~__ori zB!X!A)cn0#owwQawJ=U667X^VkRyzXa_3fd;!KRvx!b{n(g&mRpZi-*>d^Bm;jr+L z)h}BcQ(=~q!2L3(z-<1UIdg9}wy`;tY0A_I??I&awMyA#%M#9G3BZEsPoB`h5n?W~ zG+G)^g5SwsuiqTMua^v=>JAg@(<8Jjp#a9~>TJcGo**e#F5=$Lg!W`supFgqpr*?i z{_q0rLRxjRg>;c3%@Am-fQ8wvBRqWhJEq@@Oob>+HD*$OBIU0-jp*zwq-=Xxdu!R- zU4CI#3M|-BeNn@jSIa{JF@|F>t?u|2m(^*2`MnG9)neZnn##~%0u2Do^%43{ub43M zSG9>N^O1wU6ggnj_c=l6FVzW}VIl(msRO|AG9E}n8*O%khIV`lwr)BYK$fLdeblP` z@qnyTH=Ss{tsKSuF18`_lsqIEShxlQGy8As>Fus~cXj+;_oPg0P~&SN^^1B;5nu<{ zzfQt``fLI9g)t2yd>u@@6f7k)C&KB7Skr{EJmfmcGTejya25w?fkj-k>mH2{S5Kbj zua)hhG4$&OE%QNtvr(2Fi|s+^55|I0h#OKJ{%MZ(b+(D;c!qu*cPZ3uOmoIV#6$9( z#cAg2R4WAL(kTZ(+miz#GQmV4pV9DWZsXv*fP;V?64xDXCoTkcSH5*HbK!c=e ze`MyhIc=1qQdw1o^IWpsA<`I>x+T21g-)_=9B}4eWGAAxp0uS}Qe+%vW!Twj)&isl zxQPru0=)E8Q%k8~<)KG(E16VL!I5+FZ2u`6gF`daQ3L`H?%zEtx z^aHj?ZYX|Yw=Y;q8d-OZKi(*wv^lR^m$)AYD8J_fk76(CCBP}hT8y_LPY=rCcat&J zaiQg9sjP024TiN*VP=w3W)_fXcVg9lO*rHrF(OxEI){yzQqxT{_xJpdjql#W zu*oYisbg*qb!Z^9Cm$#3!Ts5YLFV{jGs7VOHK2Qn(9B=T^q}KA{W@s>m`o<7=*i}- zfUTk@1}qEy$h*nra$WTj>5nvA_B@4EjA&xP_^8s7goWrc;>eCW;quZ7!|Py174(hC z!kLYNH_ik{z^&ckwx&sTPAN5gAP?e0P^+KyVQSUkM#9KubXg^2YUiEq6>b}8vWFwR zQF-jZKem4vlFiZ`7C^7U6A_DWRJxzG>$>uCCqBY=>|pcXVptY<95u$8u?Cy;--eUn~rP z%2avVr?`0aZR4z%B-&^~lx4rNASVoJXvWkuFKTaiJLKyaf$h75nku$Ge&gNf!ZST| zU2>pvQ@Zd7HGVDC9DVt`$nPrgSXS+FUxBTSc*BwF$~%>+%2)T}8)o&>a)ij@pB$VY z_ZqI+;!efz^)YIpH8`26yvdB{)x<|c(j@E{i8CwpDU%a(F5)P4^#imxWJ|7oD=u$p z;igMijqUJXR|Y~>Os5z(XEhJx{MGXwksA_jvVmAUaJA4a9P1X-U-n6w1nLLkM_?DL zsBTgH&fUK!>*YutEcGaJ&mQK`%iO~F8uydJM&^Z99g1~_|9jy5BMO)rIYJkvj`Q$A zJCcD%r;}}UuoT$A5fc%;nc&Ji8T+rbE_7u@!IJTayVRsO)LcMyF;v_1u3sZr4==^_ zH%j(G3Ey%RUzjTL4MBD<12qG-z<^XPwdN((+>FlfMTG4c`NZ+K5i=@gq<8@~ZfP{VMPr2>&}qqW{9 zM$1w?2n5kk-4DQ4W9UD8OZIx>avj4)Y5!Bo7mauLQhC2DWryi(l#X5w84I;!s4?X_ z-f2-Prv=(7rY=D+s?K|3=|dbTaWX1Pdg+mHidJ_42P?7rfvLjM2{^T~Y{ox~w7tb5 z{_vlfIo_=nb+9MO`T;F<6jb9Q(il*~pK}uw1b10{Ym4njz_gcBTQFvpNL`Y=)jAAT zk4Qh5t&rezk|6VftDlJAt@jt7=?Wc8Xz!>4>65uW3ftNIma~ap{&7Yw1EWTrkq9QXd1nLR6e`WOE#)bZ<&DgI1)jS%m3aX8ldD(T6cTvJvqk&T}!5+~nQls|U)^G>oh$mq4G4kY~gk-?wXr>oZOsq8|zMB?+|G z&e7ZW;S|WReHaxexBiH6Il_;^ggHIKy}`F1nb>>#iVh6Qf;R~`uT5CmoGH$&?oXAZ zUmixbM~M_%<*7z1CX(zUNMFiJm5;N_K30!al(VuZb0=K*M+7yVfa4)q`}5^jybu2C zy|rGFP_RB7>y z0puupo?9iRfst8I`I>G}0|u8oqm3t(`!J4-2A0p-wn?j@yGEktCJZ zVC$@1xv1d!{EDg%m~?bJ95q<4>1g%^8v3L>rbOrqHnl^uiC9AwY7 zY$Q6Qv+5FnH(8bWdJGW~;CL9tput>p740Ie$X->B)nw}^RSPXw-e!lH zSfnobbX>9-PG@?#7@5v>9U7&~-yyX!TTwjcTBk#yEV$en2c1Z65%s^}g6&`Td?|K* zM;#70zAKaGaBhm;^>kq!t)gA1kpkxDswmwaM>h@Qpbc$0e*uQWt24 zpl8WDP!->hy{ViMsJAQvZlCIQgVlwao!3wj2U&=tOczbNQ+a}EJh!H!s7INU1wX>&5a(M z&^vBGpPNy{K#PR3p@Bo_`AwthwYyMumo}!0+G=OhULz`4ubxRzYIvga^80{DuRHr& znVudNnl>Ol4l?*A$>Rn4Ki2Q`%Qp603y$e4Zh}iuH{AuGJG!M+&Lybtkv&iYDiQYM zI}Cdh94LS56p_>ym)(WId>19TP%UaGAEI&e$Ev9{#Z}Cs4DhICiH&sz^=t8grQVAk z=B%}R&mzlbwqjtm&<-I$%Ij0&K-IrcE#)ICf^GB<1;59G!V(l67Lk9CJlmrbyyZH2 zNQm<>avI?P-nLjFiGyqX`*%p6Dr+MN#=y_A?I~X(#14{B^N0CAWP_-i7 zQjay2YFJ#XKu-x~Dw8)sy83xGUnYU<)Zp^bhnboFhP$ zuEtYE6TpnBL7`!BxN2Q^YdH&}+e6tpjP`l8WsqfI;5jzrTYcQVwNRbtC!;ss)mvIN zMeSqgmjCWV3V9X{5V)f1LkT{%w)o@n*9#{ z-e|=rtTG)0s5WKJzA1e_k);=_yUf^yuB50C7c6$#))nL$0X9Ro?QK@ zF~^BFz>LHhhdO3OckGq=7F@i|;F4#BB4*wfB_vie0xjLF(6>3o@*`sQ0Y&ccF%5+@ z`KDUX8dKB)*w72Uc3@R?T&+X1@K{r-B>)Upug^y`+1df$>?v52lFH)YPrHN)Dj@$f zmIUen^RLb%)8-5@swFZ%SX6uZVs$8|xNj;sPDJAK=QiE&x%|y@!e!^K*Z@30E((is z-jKo(*A~Ze<^Y@3o0N#7Lbb*gbbH-!$tvHa>1j9#r)IBbkuzzizJP}Kl@;rIitsZE zm}Y9JbF(Oq@HLFX;PMTyW3a4jU%hnl4Az%a9Zo859KP@ zIZ^mL;o-Fio|M>0f-);Ipoe;o9W(Ub z{@mXm0$&15*Ko-NXf0B6uY0P<3$6d(zY*|FEM*wU-O?v`1|HxL+H|j{+gObgR28_9j3*t4TwV@V}7VxX|nokT!q~2K0G1q(?Qwto>x*%LINCL~1`1a@h;>B<&=}}AZ z0O`s36qYKqj<4^ciVbWe|5I)QzmT+TaB0oZTOpv`*V>Rf7j2H6uFMq`0^D;JaSoPLlb+8o=;Vz( zD#H|^89sMkgeGGh6Wi9h!txk%xrs^s6OlHh`{rmPgLiwg`RoLdV&v+ppdj(t!Zc67 zxlQ>Ee^@;(q+^rtfl-x$(ry84?ok5(K9bnN6U=dtbS*Bb+W&*5>p|%U$mv_x zXX_evQV#N^Dqpz8hWXV;pUKRviGHH%nfmtB4ur&;=nLtAHJ{ao8P~GfD~}fjy4-ha zu_3s;a>x91Jmvv_a;S*V#%%$5hi5&QGz6mmdH&77Y~=O}PMuutYvPCmf;|0}6sqg+ z#KQ*X#yE}%Dhhn}06^&Byn$<`mL9VtJtiz=(njTE8#1K1|q*3XV5>h05_l zn*r=~^!ohn!^|hvInTlmR6Fqi`aP9#`}0He?OKX&miVrF{{x-J54ng)vf-T*?PRx8GfY5w8esTEGE#`fjTfvSZiB*D_U$$DU1| zljFW34oA+jc!_osy}~yUqjg?e6Osnkef16>`}Hme`(@j=txrTZPnw@a_z!PPq}#4R zM+21gc@ea5Xe2)6t=Guc&grK%S$E`0rmw;B)Pv(Z7l&cYPsB_9nxBqT`JYYe+jU*N z1%~UNy6X*mZWC-u>z|UgS=OI`cV^>-rEjD&;Tk0l_Ug! zVQu*4-pG#HZRbUnr;A;*84h2SIs?}Pi!6`=AMn5;*+T; zT6q^v`b>s*dCTl(G>$>b$l;cvf!`SR6a{ayqP*}76Y1|ug(Lkt_OHOqn zY8I68ki|0pww4hVh^7`34XQ~7+AeN!woSdH_q|E_3qJj6-LhVP{><)G8pVdwQyi^}Y67jK2wa^KXX-c5v&;9icuSSkc5twUKYrFs733K+ol#fK7u( z>VzlTw6Zs8-ZSG7Fj1cRIlT@!1fC8+$d~NreOju1ANFUQI({mx*{3aJ#R7X@jMnq0 z20#mRUoTl2Y|B&uabigRAFz3Z-HO-niJi=D)Z>!lIIsZoM&9XRowpH_Y~b;x@jZ20 zyE^@T5#XF(#3?3-DSCu0*#xC^wd>I^<%xUnS1r0P_mlW$qgYM?x3r?y&5L0Ea`1S1 zniQ6zAVYwf_V{_(dOv=J3vl&eOidp(e&;-J&OQZH2qP2>D0zj1+#o^H{@wINd-A?< zH^abux%{y9+AqMJ1Uc1X-Ym&68;uQ@bXb}{@_ozApmKM_!(dL@FoTT)4O~);#N7^v>gica|(w~wBf-3>*y0fSl2vodJ`aDP%_f~ zJKK2gVNkL30?=~}1|c+LwBUd@x3FQ`1^}&#BsW1*!uOvpSW#fDH~luVx!00HO|jkG zgOt0(RwRm=QnpEC*<1@h-)bIh;{V*16BtcDaF+Ie41qD<@yoaz8T5?>@h9~Jz7fO7LwO5{(NBY{B|S`oAY&R zqxd3ix?5F9%kvY$)+X({)SGwuG7cxLzJ$^vfEQ=EHJ34;|NI5Xyt&unNpcG={mU+MU#{<} z9~GLzeAVyOKBxbWl@b+nHHP0OS)b2fM;d7MAc)Xr$!gg}BdYg|o^Q@g&o+U1+V$7# zh9rZh**Ha^Kk?^>j^neeAU28&_nmp|5_I9~CFGv{n}2MR!V`%bAj$b@JmyW$8nFOk z_3oS6#|lEfhfIx+bWqS3Yk(@`dJuk)q@6S!lut#8tup_DOv*B^dMqA^*SF!Y zdKhEU`Aw+5HQDvvFD&rAzL)j|k~ENbeAQ>E51&llnPKE*cL3Tu!KM!}hcJ}n^HM9% z9UweiyEEt6)!#kMYM<&??afJrRpe9~$u%^W_UH*PpPsILQ9cXdV%$NQu@n$Fyp! ze^l1AKFg)I)*9A&A$X!=6=G)7xUJFqX(!Bm92(hoe=5WK;f%Hi!iJwf>>SG<4k~t{JPgmM&Vt zpy%j~Wf^J@flOb?3)kShyZN}zyfOUM=<`+med7Hd{W+~&H!8REpMD7S75%d7>Z9`x zp58;VP(tzx&yIONPjVmpB_60#q3WXN#ubH}3(XRl=jq2T+PvG~44;C8pWY4KZI_R0 z?LCHdqqZ22@jrI~`fZ~iQexxkv+Il}$gW~Z+syZq`woGV zS>L^!fPi~Ijkh%uE6ZFzvv7dfaGJf!S*XBs7Ee+$;1!Z5l--)*QF6>4#>=KYvBOkusU-7 zxkF4svTE#T&qUF%jcaa?(BS^=v$L1Kadb^0^x&H>UykD2Q#nb_r_G8Di0VUBu! z|JNw#Nma8N7p2BiPr=>ROF>4?wlS-B66OqZGjRSs?D+wYn=XbGhwI8ZJh6zG&*Wc9 zA43;W!i;CA+Q^Q0abIQX^?N~06`1zJfgMf?#4h{AC{$Og%V@hY|O-DhNG2%(}UzA}2a{&?z;_2anSid(%q|17az(0zs`!64OU! zugi9Qc1;efB+`e|*V=He+JVifsk1qyyZvVe*b!oZl9i{KF#9vBs~V||yXo!Z;+$&K zZ3`G#rZ3pK%)2J|UZJ)j+9-kjxw-9k^|1MIkYivuwwz|aFS$XgS#%t4J#8HKH3Rx8 zNw3OovVur48y?QzKi}8d+IWckn!b+j9McIchIwhlG(S0wV^t64>l{ABEoXDfx6dBy z-xFo_nbG;WeSHP3sqcIV=v@1m^vmm-b28Q952a5QZQ3b41mDgdfBQZcXN+)YofRo5 zS!K%9!4|%uCLrYz^f9!PQ?wO+@{Mo&Q-h%*V306wtJcXX`VyZ_qbm$;aXWb;i{wATqA+J4uAk z^vgPHha^P6cIl8@MhK%5Dx_OqvL~czlE#4 zd1>oGc*W3Da@YRcePn+KDwLtZI%l-?Ou9ak4NvM!`gCP7*BC6qL2fjpm%cyXu7*zY zQmF^OEXU7t`Ma!qn)Fkv@r{SAHc$mrw(U--`D}xmH7uvZcK>k(a>zarI?G z{rQ2~GgmTl5vC#GulR6q!nbaB4X7}5P~_F&!QMv(Wm6AUyS*-RWH!#*5>N8I36quy zEqEr^qb^y*1m%ga;G+cWh>tn}i)1o@&cNL7#K)GLx{#QvPdQrf&#W>Br>WOx2$1uzX3YP z*|6g$tIE&4(C}K`{H`XFev7lQAZsP{Ljsa+KP)esv!MH9Ulvx9bbPKBzOTkC>K~2$ zFyLZxgN+g~-fdUqf543OI>H#!BEvzYA>dx=Iqis_+03*@JDurM@=E^oK^oM-e-OAG`1cEeLY#fTAZiKD+hGFlH>jwOA`M>^#Yj>0EC2?F~=slC>$o@Q|ZRO3T;w zZq(L(F%Sh!;|a7(z{Vzg6HTeqAZ6=~`sd`#nN*FpWWyO{UIo8S*`s_?>Ls?%$aD=g z3ZCW~MgK@P-8PVZNO~dsV)Z)bUkK&!4j8^7Mv)+ttkP*Q|{nK zapf0YHtLsAt42xfOIS7MDX2Nd`hCyxXQg|(CzF_%6rVvrBbf#k7u0g+Ci}VBwRJRP zM%p@Xe*m~v7U&odLLEum&f!sVS*!v&N0}#rf0aqkWBpgkYC5_2eq!;sA@$_POn`gO z`u2t{Tw8uHo)@MhXUzv9S;+U zHZswq9GE|%WPdcijdF}s8#6=g7htNQTg@azMr@D|a-Nk`oW`M}Ko<5rqi&asU#GQK zEl9K1zy={RHvaL`r{3xYK&Mc05wZ0n%XPl+rHkpME@Ex0v)0&JFQnOAZi?P7D-Fak zl_0Wjm>V$zc*=4ZCtrgQJV*Z|Eq$K-Hj_tSSPWLP<1;Ud@VRXycgR2r1TE=2IEwNeg}`0Cn4z6hC;Ww~cm|q_Io$e%nYuy;55UnY zMc!CP8*9Wo9P`1#FnCzv@cmL*RlOUtR4mYfpZ3`LOc}oF>Ay)>cWitJg4-svMTd@c z^I^K$v z@Ccn-H3e{{KJH$_-fC+ijdR@uV#WkpKNa-ICk9I4}@m=qTpO8cP9oCyrf@-GW1iw#A4WH*S{L;t zWz^C1F{1b+Du&thfAoh!Se?&lbc@w&=8@^5K2fB0j5R-SD7{sy!i)rHp-B8Z)wwGu zMOkWzKpS$|ZDzwMKV-`_Z0Q|;+vxMO9Rp%?omrmmh|1eq+eE}btcBR*uJv=ni*gRVdx#ad>?llZLE;K49tqO`yc$h;j zJ;FPwV>s9#IJkCNY+LndX3URu^m<*0*mHo7LBNCs$Gh|ud)M5PRRcaG9Q!1L_n~eT z{QTRLSBOfr0OgMk6e91h9fkK2FTA5}JjO__m7;a#@5Z$1bzExE1BsvfmZ+ z!@1?BWecI{?VBSq>}neg3y{F_gRzc3Idco8f`zCJPhb`a=KHv*4?sQQfeRqI%deEJ zyi~H{(j!GK)ZrL?Ws*;45iw=MM=?}0gn}`Er?93O;5H&&fpjHLL9_~2-{x>1dZ6xL z#recrMW4QcC4mxOQ437OW4El|v)rd>SQ& zurf&}(kDA^adh>SwyHI1s?%I>|5`(dQnK*z@~XQsH=J&CqY3W=CK0JcY7wWvJk=`C zq?HoLi|tO|5xG$cBn}hAO5>Ocnq^%B{oE}vXJEP~biS9fF%C@U;=2GtfGe$df*h1_ zJ~F#J!mtOtHjZ0r8w9Js)A!{q4mX&R#led<&8<|vYkmm5J-c(8icYvrjm}GFv?1-_ zd>xtaZ7LARiM*A;Ok3A@@2wRHJklFpi5>RP1?X* zcZcBp0mpzKxF3+pfFT03KX6(PsONGUjikS=57@mi<^XE8-9a7&kqJbO`kx7%-`D3k zu%Jre{0iMItsFk|_ab#@d-D8R1ciZ^F~BP}hzSi*eV=9AkR?s!J(`C#b!j4_lw=C; znlL4b?)b;3W|x0^t2t53)lZW^UX?upB6ewe8&CipOY>o1=1 zDJXjI;8H;gZ6a5(Z|p5Hg#qsf_`NabDL*04t^){RaTTCT@j(rtZLblu0mwnX(Y$7<|leKji>=>Sv#w5 z&>v2+lNFFwwDuoSa(4pNHSvjr;&N8wSQ*G-L==|;r!Rx8EtXK*93mHP-z31z}Pk_>l? z5ZSqCG4X+tYp_P!_JE~@pY2Zt5FlR+*0)>+8mI}K248;+7SwVqe?s}LjNFeJi!@1C z8<_;SHHB+a!C)`uUE$MnM zV{AqGDu`Ri)_Ug4Z|6E3jvtVx@%LDW(u(U9IG>>6K9tuDkmSXxBNt-PG8L1>%aV6nAdlof&wf!?%j|EWPVCG+B5%N@ zB5Wrq^^YmPt0fDSW0Qp}R(Z7}SCoYfiD%whYl}yGY@z(v^J@M*qlgXiboxrL>qyH( zEjCDMp5d#>q9S-8g^_WZ*{Ke@UNqse<=tD1ls@RqW&TZ3|+)CmC~HoD*H(cjCwh} z(fA*d`F!F}#qsov&&~lakt^?=Pv+OLQNmA(1ul>?U>3B|9VMW$VL90hTx$^igNk}* z_4%oOEAfIl@Y|b>SW?}x9thNVdSw(Ib%7DUQM2n7@3Tn8=jR!S@XfHD0^heq0#aI2tDs^ColZEwN{Vr z40`r~QJh4Uima$)N_Unn7u2oc=gjHM(Lt8v3<)2!Mm4wrMUvU-Q+Lc|k(@Wg#;%lO zkjQ~1X&lxEQ@zciInXpKmDyP8va9qT*d_WJ{l-5WU04PPqJw<-Cu33ydN~7#mVWx` zbgUphz&AUcE!ibBrU{GqZT!QGQE9v6;e9BBF7J_(u|)+>6J3OeF{d<1e#G zrqhsI$)`LNJUa-?)q{OQN67!R;l%(AI;7U;25$Kw^sx@JENiq;Dv5+Zv!y@)P-U_n zq_~NDhj)1w!a1`sL7RTCR^NUP!%^Few!L;0a?p|ARQuu)*e`sHw;H{&;&&Oc6g^^D za{I&XWc`lXA;TMe%>a+LykYX|Qu-jz?+++=%;N6@w9=4%M0q(;Lkr0=J;ng3L&}G} z!CO?55xlUIn(uF~&q=MSK~yhf2{LmF#$C@fz|Uxipe0Ah>Ia9?fW57mOlz>vaoH>` zqP!olZO*uW1|dwZf%_lMpKU!ir+NZ_4);gHXq15+u zcYrioq6Yzdl(jL5#3-|5eJ!X*(F%tD^KE)+zHyC2noP=;P1$=l&DV%3sOwtd59+mCOkyKD-t|Amybah#41tZmGAa97VJi z>eE-;X+2B?vDp>OX-o1P*IxUqBaon2pEk9j3m!@#Bx5*+mQbOBBYgYF!*(eGa%cj- zEdwcV9WeKa0U9sS20D%y)J5}*;e1J7+Pi2DT9+2>XL+5V!Ko>*gZv3PXf`V10dxuE`m1e^4O2IP6N^s(iRK&S?)P5cpYkRCpH`gkYH#FxPpYA{;VnrKXN>8#dZ_Bu2Ace z+NwyMNc-MwZt2MSQpE`+*Mn%W zC=B0ggA>dbw9Nk?sEXMT)KTg{g}hBn{yh_ypk3$_2;`1?@=+-$bhzlL8JN2-)1NlI zX_xHtCU!rT!_q(K3_|db^6dX2Dn^fvRnP-84_)bxq=1;<){%8|E%U|eS` z^zI=307aL%L-FTd6Pka1M}5N3py_Qgu;7-(j;N515nKsn$x zv|a3rFbA7IEoHJ}>o&Zfb9aJz@!I%&6j+Ihdiyg_VrsDN1SwZVoT5ZMBx#b@rH;8T zbNNo!#0Ui`p8)&Vn^lLW_GjI;$C(8G7pFc#PH=0dL~5|>TFA|dX&=T;PxOj{(p0`o z-2UJo<`D#QJJJ8JO4)y~HHE7%>G?e+Ozl4|YWwTi|L^k${}~Y_HZcIAZ~KVKoCYZn z`GMsQlwahUVVV_g!Xb1!Yhq~VY(Hq(5jF*{7iP0&ZgzoG7J;qv3^16yLxVZ9jM`Ej z-2kQQS)G}U@m>og1(ff=l9UYxf0F)bL)aS@yu&q#7vm zct#V8qxka1Zm@kKBcd{LQ6?A1o22ja%B}qMu5kb`cp7k@L}C5GKlu@Dd)!td)`_bD zU%2PpVNGJgfg$#Q>~}0uWU$^jj)m084OlU#dzx(u8+cI}BYH8YyyIb2ct&KK|3SE(7an%S9z%|sd)=?8PyC*+ zKw9!si_#Hchb;Buh+=S(M&ZFhuW$K3O9Gx}?i!md6rKZgS|l86w)@~<=u zZtYu^_5PCG=*D}yC}$X+>q?Z3^(AfZ9DsXe0b?7cabTPkl;L$YOnB#~5F0s$JO6VY zIID)4+hZ4cEQV2a{?qCb-R3;eRV5T#Zzsi5s6KNSkA7R@`HbGxvVQs63vj0#%sJbn z{U}CL^cg^Xe~?VxuS=4gtzERsTi-cPbl3Mqp7zfM4cDnlIM{Lc5fUcZtRd8W zOvZR`M0#Eahth>2W(Nlof1wb^fUUg#{u){X2Ll84V+v%&Q}X0Quxu&ecJxqH;Qx^K zmSI(H+uyJv3W$J&(k0y@-QC?F0wSG@?vNJgu0<&+-MK)TMJk<(jzxFJb9>Hn&iU_s zw$FY(yx04Fc)xgg>Amhb=eWllbBy2kjWNwKI|MhH1&?>kb~&s{bdD8yj)u&9slC=j z9@xZAHyg2a^66;Wtv9*seonY#dOtRexjcK!T|Clsu>WjG838N$BO)c)LlkM@|M}PP zcwrI+Q&-*-A)vWY{`GzlmE&i`2jTJ4-L8V-1JK9DS z9rtmhDHX;HuKkO}{hGqlOkqVDi(Ewd1mMBHkwk8z0#cH&B7*F`rAL$9%)eIfM~Pw4 zdLi(n=Okbir~?nSx3Y1I{buFrY6uBioW$=Ccu;5|MeyBr3%NhY{@?GK_j)E1;-jc z{r^aiWO7-CU#auQ3$@xSP5NuC%le9-aLST+;an_b4=vb>-QIu8{EuIv-~)n)>%#cb z-E!jYtgGf)JpH&0Z#|*|R>9$j=k^4>x06PKYj`Ed>hg0!kyaU#=QWtA&SoK|WC7wi zTs-ag!8?(YgU@yEGunsjRl42jD%a7x!3ul($C4S`@O})TE93b_w5}ScmOxXhkyIqH zOhjg!s`c@1^CcD6C#I^$E}UUpv)0G!Or*YV){iSz96sDvU?+2dL@d8TQ)BZx8(7Wu z>Zb8k)m|c-@H})t*N^O@l1miHBO>k}32H+^BYB&cxMtpQpSv?t(?mqP`|8hX!IAu6 zgm7Mun=ko)tA%nv?)g;3$}rFV7opp={Z_t%ANDIPc(-jmzCu?9(6#9e{pBNr^7oht z2J*=`wvY8lcH1Ta7ZTnc#^UWc<+(ixl6T3TyQ+1WPU}V@eTjA#Wu(Y`3`T8o@qA{M zW)ruN%0i=r&#~3Py*?_IsWjx+5gcLvB4~DY{?vRj1DZ;zq2KHVhvsKE_hw6#2aM(q zOP}dgnaNPeGrEHMe{V)u^d>c5?e0LQY`X=E14#T&xQRet~TQBxlMA!v^%8_r+Am3q^ zk_*$a?+umlJ_wzgayscqiqyBS?RLdbs*-}JZEWVC#x?WKSMbO@apCSR3e?QQIBUAn ztpI-OxITnhl;M8X<+8g!#L3_}D3HF_x)+?*2W#13>WRwyUctQ?Eo9*CTy^jR@#FCZ zi+sev%r;1kG~;oguJTdwB7OZ$UtY!fnwEY(U&u$+?9SWWik|BiuD)_My=8yi0Lp~O z;&1`mxz3EJ)9s0`N|Cvqnf5F9HXZb7GP#X|JBth6=fuIr)0Jz}8WZudA89*PXX9tc zSOVf36JiO+-ow2o8gQRjG}z3#SdSz!=^oB*=G|XGeLCAz(X(^BuLWcjLL$$DQJZ&( zi2>;Rwmm4U>D=umsrAl#Q(|Rw3p`q-W$=_oEN{W%dfqp~Zl+J8Xn|1hXyf|UcEBuC z>ueW+&*PZMW?A#VVrK~7Oz-t(VSbfrwf{(yM8EFL!g!30$ddqEE?II}Q1uef6Hr_s zs^{wc2JLg+Cg5JHrv_fEhpoO>4B}L4^?`J4*cG9psB-3PhRc*01m$BOI~{)J3M0nm zt1I1&3}5>jkB*3vJKu%;3n%T5xw2pCVG( zW@qqI1shNBu;|wMZ{Qm8oL#8td%?%8(XLX_Sdl|6z6W5C3Vu*0dabb-Iv^J1B&R{$ zYD%O0rfxaMRVOcA&4bi_titXQHHFZP^!e)C2luUNxX8WBHY_ZksX|a^kri>$s9>qB zXE8rhp_ECAhrgdzst2pl?)aZYwX@<;tfYki!=W+zah7dQC3C zJ&6ouEp3nZo-&G$WjghxuryyhrFkHSyxVf$#w-o$d)A+#Gk04O2yc-6pYFgf?XaZx zqlI{$>=3G^uiorjPGM_^Wf}A6bk_hGz`l<(nQ!ZCy`j4ykYgCYr0Qy|#B`#nE8erx zD%M7M{?Y-v)BE!7dLIb`Uv};0F{+WtG%AIZ_rd+$#w1rwW66$QC6g{}E>#4NzUdpi zm1X$}^-G-j_(r!18}J$Tu69%x6&W~dSvlYY-5=NRdNgyN^!Rnwk4(?IwJ8P-VGn?c zho2pLVAQTd7dN|f^^(hIRhv-Lu;5C7wOr&Y!xoqI&0>dMsFRI{O<4J7W{AiAwdSbr zcQtGDg|K^Lra|St&Z~*0f~BT?h|=I#p#k>HXBi6NbgFeOX$6O_K8<8nYGH2k@RMMf zZBEy~i1nMf7H=9h!(ed^q%ve8adsa<)VhT`q@ZT}0y%2mGk4rzX%OW>IR3)x_in`> z@1p`*FDLj4h7LG5r~*mamM|T5L?1@@F4H-O83|fVSf4F_E=sMu7D1)}eSI9U5>9Zd z(jlqEY2k9aN@oxx>#{mAVG}yqvU6nhlIbm$E;Xun73o!eD`#tqNj%JuDIcwA7}?9j zm&TiiXPSW~*Z5H%w;4M7q@bWsI5uJP$&uBK{Kw;}KmzK6?FABf|ClLio%i2?7O6>( z(69s9iYi0i@cDt~+(>5fcGHzVIFgU>>0)!HgRv_1_%9aymj}FjS2xKZ`Cc3eV&AbJ ze!0@|IZYEPkGgsJ;M`N?R?_hKGB{LmgJDw6AyKc`1c$ zrCjC2*&G^a_Y%{LgfH(Y5gp0-^JHQcM*`zqE~Pc@vU*f1Qlmq$P`B|PVbC0ZnEUsK zK%IKp&MgxMRjceDPx5GC8?xuQTn}OKW`n76&&(WBcpN!TX%D|;tAMwNj({%NdGZXl zHs46{{YI~Wj)-d%rTT8gM~UBku2qpPGl;FkvBULKj*loo^I+*%*%@I%z9_ADG?OGT&#e6OhX# zGAVSu2KuQf@+qi@n<~hkwIg-8E`U$MV>C!xO@2O|crSF)r;n!RN?F({?#gJU8oyvi zO$q1{D_PHxBG9WY?DMES;LxvHyp7m*8O}}}P86WvkC5{L@8O1v!ss?F_P2;qsrO%M zD!z_ovHr|PW;dqpi%jL)+mU|HqZqENl!zyu4yJ6!e%!YvGsR=`<%D_^`BJQ1($NRz zHd+!`gY7hPc^9(zDen$Cd`45j<`NGPJHtwpU&eKL>KE0HHj)ORHYI76c4lTK2y9Dv z?XKd_J*bFc()X1#XRRygon*A5gCMeGwXywS9U=;;;~ez4Y4Ewg1v0T=my01n-TSJ; z>cE&P3T>&kBf-$;bP;{)jTCw^Q)= zbxCjBI1FC_*utGJ;!1*6`W?}*GNMmCruaH|c<__?Qa^Co2wz+L(#G@3{$|z|G`yxH@W5SMLLi^Z-RKj)S!+F_ zs2ugMkHAk~<(*_Ey9WD==zc1}ls;LIqKcwv#w+{W*O{-SH9d~SKjy12B07%-XR_Hb zvsPRPhxCozGVzgG{W)yQ;(RVGvu{1&pTMBC?+8~I;BXVNRhcp7FdLgF4%J0zw1l!5VIcPNU*W zm7vpYF2IFkn5B{h`KzbcncKZhuc{g$WR&iersGh@dheiN|6Ewhvf0}KtUY9FK3i+E zqh}qxAc~dlIC3YhlBZy$G zzazFEEj*#l7UYr1!Jl+P{=)3(fvw80xap5Zay5Xusdhr-a<66&Z&;O3dDH8+%MbWp zRg*_a9Tg%b>@Zrfp0)X7ISai_cZ6Ga8%tSmF2B_K^tC#45DQ$UftOJYE!dQp086Tqy zY;bO{t^5#VfS??#ze78O@l&80ndWk-H*D!}ABqx|3cea~uRORxy}!eh-MZ6EgilNU zmlHwaXGsp3EY-u!;mRCLtxE+u6hVjB=pbeF-|+n+A=hUcnFlvt`2x*j_X0j{WqH|u z2+Utrr+ZE{bzA}CMvC=OUVLm^y<{-zyp_Rc)Gg2X`Axgi(uuaB;OT(-F)rB?i-5*# zzS+J=F*m}ZawI1+?Y?uN3uKd>lXPNU!;#G)#7}Y?Nb48EEq4z0k1V>CyH3&gB)s6j z4LDvym$oYHe|S$ncx8Wcp)^!VZM5_)2+D5VCOF@dkN9ZO|AXFbcwo9uR?^vQ*bVY!o7 zK^{*wagR6{qMjuGYr`+>WGn1_1pT-#WBH%Eh3`Mrv|G%|56e0KoS>4Gy)K%=B~m^> z?(%FGK7=B6zIcvD>e@G*kt*X5%f9&PDHZPK(bG9B<5|fU=Z>_5&rkeXn?U z$al9LqRF@Ajyd?i8naP(BWv1rzZN%01SahT)ley+FnoHKOC{3!KD;}P;3#78K?l}R zpjt`-%#dM@sNPum`XdIS17&C_C3DiG_(-_6j9EJxtCQI*Iqv@%tc`Rm29S$27;K7Lvj8V9p&gVcI$B3UdsHfgi z^2~9|&$+pCOGr7iBEbjaP+?Bc!WWVZdvRuHH^LwJT-@;DAH~DEIK?Sxj5qdy=mMZ@0WAFJR|YGI?bP}81;^aE2cbG zu5AawVhG(#?;uKROeM2#2t+1-see#}nGy=_T!SOco6L(5vrNy!CFXfNKR8tdB3$9h zVBmh?&YnLKMI&{%?{k{<={V;j) zgF!OQb&v$KJ)1A!wK@u6d*)~`v6sW*`!5ga?vDf2;ykqu9TXB^y`)DHA%q01P*yfO z)u&4*ZbzblOoq9u6W`;PB?3R}Vc-<8%5x|gq>zRJ5i7ai{Rr;YmGT<(*lT}U zO>u_o5^kl5O1)}AnkPN+7fM4Tw`W4Hr9ngE(LRV_5^{~lQ=dL+KQ$M?5>$Rqt|o3* zvhz5DN1ZyCYvfr|?@cDb(KFr9k+iW+N*|Qns!Z}Y9;JFg;$wWZS0!9F$#`uWIQ0W! z&p8O&-yioQtNQ}CyfyrMl2LElf)G704plJD?`(PG$NB8BjW{iFMO&fQBvj-B4;947 z-}X&r7O%yVS0~Qg{^pY50$l74;^h(~F5d$KUP$%7{NRDT7_#ZDNW#4cq6<_9E-OG} z=@=1^qvJER8v9*=8ur6$dBtK4>>pCQsk}jM`7)26Y4KC$> z8i)nB>T&511+p=-K5 z2_(T-nl5HCT%t4-V%X*L0P$PliRldSzI!?MEMPhiIY-@2kVu!24y@zrKnsfayDy)h2quN_9K6gXZiQWiYx#Mb zP~6GuekI>X&GR6xB#_NJ@q52#619$f%2$Sq&E8|` z@Q4EOtR;VG1Ep}2Pw=(%mpRJMy;sGAN4xk)j?jdN04Ki{PcN1{@ChPH4-rCz9OL_& z%+QA#lr-LnED#}|GP*p$cD#fmVrVLdQ zljUrcGrS!)M?10+o(hw<>b9 z&Dh*{g6Oh=z$Q|>P#TQdOxZ79p*KpLisN=i-zj4mMUWk9X)?`?F-%+#bZq&9R!>%r zmTK`w(u}Qu`MElNek1ezP#5J+l?;-?*{Zbkgz$#*`qRQX!@)EnkD(~qYj^Hm?}VNp z@YKzP|G|EFYq4ysOkzVPcfI@@P17>&NKaYd`pd=aXIiwAik}+u`C@kYmzU;{mAHPu z!w1^dR*4Sp%n8KdgB9yo=(?+3dAQLlh^miYP4STPEYxQqkL3%X(KL50u@jsNn2Fdo9*HMkwVIpb>X zjr9fPok5;Ec+iZd1xkYid&2Rxz$c7~9!U7Q{wI>WU96#w-Rg*g?Pfn_P;r@GNv4+F z6y5B3@?sk%9zoi+se7Pwr2*2wy}r8DMW1J zL`()}YE(QzF3Z(+Fo^>sgjNQQX=!p@vEHMM@C}4;kGw|WCvl|c6F|-9hNsUxM?u^q zQO%--s3n;d8ie|Gi(%dCSoZf>eO!M^z+~$`W!j0O1WYh5qkf^D^QAPkyk*eE3&MfO zAFLCB2>PszqhsF=I4-7E>5CnPn5busJ%g%;m(V=2sbbkU#FjfMy!aWV(G!^RpKQEd zB1zGxU5hGN(s_a{t>UlLn@c3wp_L@hxFPBO=_4{4UA@?&NMw3$et}TE%J}7P+GGN5 zpJt;t65dMxG}WC(F>bJjQM)GUPp5)MhiuVj$dP$!H?)uYCRg3t12Vi=q5AgrO%>k_ zWvNdhPoW5o>&qXijZJF9>q5+G1$8>EW!xWGS5mW>3^|gFIbf}uup`C%DZAuH0B~dW z0R-8oA+A3hWNMfU;9$BOp6Ti}72sIdyywaMq3?c7xJ_)(XF1Sag_1D=x$%va$68;4 z^dw&YVDP6rYJ;Z#q$hNGrH;g1uq>J8*SexF5jWnsOm}W-er`be*E37|3FMG$oT22uf z>wT575nU?cA#|XOtLh5?SLF1`#g82~eB^j>eDal2G*}=vmJ{3ho_cbPaiBm%;x>yA zFbshFB0Q|!>-M5zK$qKPt%fYphq6=+#xiU}M4x}H{{#rkKFSCR>+enK`^FJb-?R%r zDd`|_fNQ2O;=rlk9`bH zE}<_h^Z9KtWA;y-vVMl+Pk8yLPtymAaQsi!LyoIyz9Msk^Z48#O0MKOtWxJvYcDTf zQA;=_KbnWG$w|HJ_BvRS67#-b3_Dpzx)`7d|0uK(l$;H6&;>%^x76eZ34z_stZd=I zqBLh|eT?8rX%KIVkORApZdr4q&i%sxyyI21;hZ;7_v2$=Sb}#AZ_95op_Iz>zcR6( zF}idaS5O&N%*mr%d%cMnWEe#2oo`a<)=mLdD0c3^p_7Dte=9<0{5Llm5gHi=!)!Q62%4k<0+pEeVPxz;7@W19GjIc%#?V1Vyh(-G=)9j^H1o>;F zqa^cFMTy^{u_5zo#s&uWFr4`lg83h#L`&+|d@YX@FIO#PJSJQ#P$52O~{OdpdJYC^SzEWu~O6*X@8Z;yJlD-=9==0c4MiR+P1CJWfmXnp6|K=Bq7^ zBZ>JcPbbDGf!DwFRl?8d?hAfyT~xHaOokIB1}J;mAJ`1oFfb6=p+V2`PO?nak9?Nfp7v zcs5#~UqAc%sEjBz^pUih_}Oa6=-eVzRw;hbH%X5uqFbomIse!pOe(g2{#;PhyNiWE z>W{ko?~U>i@$7})kql_nGHrGr9d@1W3S*hBG0i<6O6Oyp61tqe^E}_n-3Owyjct6h zjGoEN+oL*4&P(7@)B+{h{UB7_bjLf1?8*6aCv;*tSgBPJo!_?@7;q_HbDPPaHUVb~ zC*#ugHmF5w8h54EhHtWXI(nwBJ3=>>gJ)K`!RI#5xXRjnG_QnRZlX-TN>C&29bsQu zoi&T|sx^zH>gbS8+^%*aor&jKMV=R5S`P|${9hUz;WbR!x)XF6MOj5_tQ;#%54HPi zp&OI{0nam{zDG!C* z9InYR2!<2d7d{_VHTTK4cnvaDFGEOta9W)%wioVsoM)cVOGR9LN)vgZzv2R3hgU0-8sH`Vrb-`^%UINaug%$W zcenSw7f;VQj-T@okMrwMgFD5`!8({>HO&=9PPlIqz*_)_D9U~05R`@% zsQ(+wlaQS2JKy``?FPqIrv5w|HDVO?l#`6>-S+2jVxhvqo$Zt33hYl!rVRymCcFEM zA%j5wvYrDHZA+kAX*?1MedXRXCqP1QZ-<%{zlB7ans0&QygW8h`LWt>TWf|b7~%>`IW1q5`|s5&%|e~LOQuv}mSWVr>*_HJ^)fv3Ba;B7f>GYWb5Zyz8;abX6NwhX}ua0DX{($>D#jK@RYfceKt51xSJCm`cSD$g9nuhHr8lWr(eul z2GG#ej06cuQ*EXzZ_iwa?RI!PyZRa&ac{2be3Ln@XSK!9qgRx;Z91<>15;JL3Uv?n z)QEqh*ofImJ^*mN=PKZmY}O_hiv%}$3QICq+;JKLo%y$`tV z-DMTgsm8?^K`Cq-&nbaRjnTfGn1bmH6wG#ac#i8c8FeaOxw!9LCT(YUKg5pY2y8KM z?HD{P`Y*8dANI}9QY7nXjw_18i&Fu!p*es?v1aWE%}p}Og^`@uYKLKDUhnc(xo;S2 z#L*Y2dN{_^+AQGj51MJ{motG{N|sEtmW*W1?XU1RzIe$@_~EZ}p{oa{baI+cW$vCg z4V??z4Ev_b&b_(hbx=IrTu~$t{BRPTJ)G$X>l!R;E%Y3Qv0FJ?=`PnDZW$=t@|u+? z%cviR=8vK2ePCns*yh|_nanu>NK-sKmzYD`OV^~E{xaPW`Ig9;c`Qwi6Fj(Qa6Yog zxKyml^ab1U09^gKPqf=pJ3~#pG3!)5x7!Pm*ZY}wp9AT8?XVg;uf`~iyep&QVTc_< zuqGjC{E%6>_$7dbMalGxn%{-;ea3UAGxmwGF$DfgOc95rKzW~BaLH1e!neU-c@~nO z=Z%@xwT2z*)`N}CgmE_9gjF0SDLHEN!m=cNZ=Ks|NC_s!2=lK0=&`EfB3x^Fm}%^; zcxM!NPF&Vi+sd^gs!zrE^11Xx5>J~>jJ-$DV1&q6I7|v)Xo!4>b5kPgc!JqQ?#bB( zLnF|eE<6rceR8>;#zW48!W3uoI)vNM!Je#CrbYzkyl#P6{0*0tkCC=CzbI~dxy)Qd z!|m0!&gO?4=7egm)0#TzM~aD9JJ=lD8$Y&Zw%-O{Sn{s|Ot-O8Z>fpypm(n*w@rbo zY-B<596mm)1sE|0Zna|fPGbyZkd$wi7ja+0r>Cj-sQ96kCJZvU{z2WdW=(+v?`S<0 zw7F&EL={|Od9JB*&&@J@ML0pKU)At4$=xJCK!Smr}Z-fSwOme%5>F-sz=Hb z->_TiZ`3(fG~xPx^hL(QgtKM#L*u9y##Z$1tjZsj1~qARjWm5` znR=*%PF^AN8fKk(Lx@ClLX*SlF8YZVAQgM4=glaK3B?pWhBp@>XEnQ6gNDDgwjhQ}#`TXZr-DetrwSgE zqCMNp`N#l=Eh3-F=t*ID-1%pqb-|Y&BkzKSrEc9%hC|cAt}OaqGDb54nXR8TL=d%T zq>xQweO88bI2DaG=&bUUm%@2GaY85^-$-4~)R{a<@+;NYcU)jc30T#`y(Slk?0*V+Gda zd=y4K_qYiKyFS}tWnC3#Bz5Y|3~0CU?3w32;|0QwV>e^IS1Dn6CmmiF&&t{7YnvWN&T$~hRZ8f@YlKvSN502Qbs;}1)vgvhlq&X&AH4t8-0()$LjRRa z#_TN)!eYAi9Cq{D=WFb!Ju>NGzR%kOtv&Ig`4NRRqS9 z`g973PT0SVRph_SP|gscOnJTWIyLjJx^>4jK0uU$)bDDRXT&cC9#M;3S8`Y*#3?;+nbUNUH6}>mwtxEk z1L0FIg+1gq;0M;LzLg3?Z|DY>q8(o(go{z~$IIsFy>s3EjT4pmafHw0-EHGA%9toz z?}F>88STI0x&PsT19-xgs4yHdOk9R7jS0}4lbS+~e@B~t2*4fr;Y9}LJV3Dg5Jn4* z{Y!uNBjPvIhq>p1uFZ;M5;2us8ewrRyaFpJC$})B;sMzK%=;zC@@ba1&0`I zoR2jNI$-zrad?`4H-A>?F;C(@PzYu{U&vlBn%Kh^aM|wPw^?@VDfI<;+%4;swYFN^ z#P2RJ&q$Q*`xd~O&V7aM9cBqBxL9;G*vak{(i;K}j&d1XTW{OepEoI@5t~sh4~I(R z_s4@=0!7+etQQV%X|QX5TAen2Nq<{yeQu$}T)%iFVIB6<2X8j&9?*%u*#uKGBTc6P z4E~kt$1_cz5i))*M%e0LG0=tISoiy~Z{FX5qG2=~`gV>RFUA(^hL6;k@1sukIGpr$ zZ;1Q0t3XIG zni1B%x9#yOnaCtl0vr?qH1hLzdp)|^vzrrC)^)R4U-pz*)K^Q( z8olAUC5gp4t##*Y5?DTa?Rtiz^O6jyTgYo7h>=J)%S1S9W1 zkDmNo>D796M|}dyG@C^8au*1~U0`}zfZolWf1+RSbS{(h;_+K-Mu^uq$x{)JI8H>! z+!1U|t4>#T4Yh;w2|Pl`OjzGvhRPxB=%TDvZF;Na#m4Po9W-d9-Z>^rGN9^gIZ>i* zR(gMNykc$)d?RMgWuXnEy6{J{rqPJQMndDN107m7CgY%i2<~#54tq5cM_yxQx&SvB zG~2xLGeP~!d7brjq-a1|n0Vv832}kwE(Cq4}(s^MdHc^=CCry_iYI0~YZ2DzRhg)he zbHVQp28Np(SXZBk+`I}2SSLP&zr+fTeiW!BJaQLMp&NHqXK`&}#;KDGc=h{9uz7KP zOpl-oo0j0_X+)pVAa;u4tiYD$tkJlGGcn zi*Yo=*b|$PmQ9;9X%MwMc?vA>W{DlyQ$+vp;*0#7=pHbvP#PrZc6Ey8T>7@xoO}?K z;|>>4h@$@a4);G(l>dbqK0r~gJ&B}d)0nEcz6K25{?w^=0gVwSOVH|eBbukX6(xcD z*^OQyGnMar<8G6NRoIb3(iQ0!&+RkP<}(b1Nt?MQ^GjQCE>MAS6PoTV%{XVA@r(T) zM(2U42W2fE1~W{G&Ym-qFgU)9-eu&`8b6Z#TgiG;LDckJM-#ue@?l-dXK@78Mit9* z6f~ECBI%!wql?U2rvvwN)-g#j10KTPoZ@~6F)&2w;pC>{E>})LK__B&MN$8lN@SoD z#&qopU#uU7oBi$gq)A_a{7vV?yE@R{?I7UN8D<-Yx9J{Kj6nSn{X%coDgARe1jJON z%R&nn&gD|g-*{7$%Dc#j^YeE@*PnGcZRb)K(p5ch>H9x9n`pwhoze*>BZk@a)_q-dOy!kiYm=54xrUs8R{fI9+R`J-_ z-f|)O&2M)c5mY=}cPD6ac%hfm5UB+(1r2zK@ju4&(wmQ@_>U#|pXj=uw<4J=2%(uy zDO1pDx-tQ3GE<#0_O+FBSUp%fximT55wh#ucjQ zbm7{(Zg~{y%PZdpJ^!6^P=DwbeMoZ$4QO#Xy|ri**EnU3Y#`5DgX?aKatP(ikU2)Rx=ZO{`kQnlvL;V)ssrCDXO#MBgiQH~hDw`pYvliTP4n zIE`re?S$mEjizL_T8WvqepRclLn>TxTt4+g$0e-ez{u{4;Dg@F0B!kn28dNIJ4Ajgmg)v$suQLI<3hGWu24$amBbCbhrBC+f`YKz17uKk$Vy!tA{1}IZDSQlMOLaAHW%pT!)nBpD z|7opEl;uh}=Rla&+F=k+mQvrf z`E&lM#S!WS-+S)@%5bmiGh%iUzO%3ztI00r_@2nL*WOoLo@YA>wK<0uhuEQb`3^&K z?f}Z{Fj+dE-L^Gub#VpHH>$Iq7FAI70L|5hq6L}qx$J=XO=h^*%tFe%_5cEDdmz+t zW5_7DVnkE|P!Ox7h+e(K|5Cnxeyx^YZcjHk(7p!EEZq?*aau+h)H}&$`bs*qu-hWj zV81eN5;k}7dA+W-h0R1EW~x}P)kkc;Y74*viXlf^gsGfOaPTn!r{!Gn5I*h`Tm`u& ztvO5M&clrtK<)iJq)FOpwDQuqj@^1J(4*VpXC+z?DzmlMDF;`j3pCb*-ITUFn`K#m z4wC7+G+va3!!cWKxB^s1hB)U>b13NUO;?4Onq|&L|HLy}%*r;@^wEq4LT>}Dx|Kgd zZ2wlLte02?9`M_}CJGjtF`Uzg$d;mxTMSotD1|qCjq6}!wic8>SEIXMe6lxo86(xm z-#ydBCwTB(Y(79U7q#q~@+x&|AK;hZ^RK#Z&DJ(;{49lhYNDp#5(IDB(_2i}Es)X6 zpeVv(Cl~M}lge6B72V;LYw@g8>|Z}V^WEM(caR0C*3A7_uHA3BW@a~9C07!P!q~7% zj>>c=2kc!C*DF_@-^6;Cuar+mt|R&O(Y_Fhe11SPM}Vs^vST~%iDYsme&0q1SLlmj z8*VY)WMffGKXY!S$>6=7dm<9`wbH-~e)?lOPjeS2ffDU!8*1kMWV;pcAV1nVbd%(G znw$RTd^|3rwz&IpClo@mfA6+W6Z*t=DQMC`cHd=}kE5m8y~mT}13B|;5UxQQP}>X% zW2PCnj^JA0fS}+VA7%bu$bA0tP6}lf-Q{F_5+?Zun+`b8hk6f`0e)$-EY?qj(%ACo zCF6@vKiL((?T|sBFBMy2q6A5>gBu&hiJR}1R>7Vo!fg*r&$0W%>7kskk zWq{j!UJYk!7k!B%Nxgw$xYZfr>RzoiRgn4OSEc>m2=wtt8WBZ*VhJ+pe%Q^$%J8R1 z>U&Q2W?k6W*&*zaUCt^Yc?#!rRp>3X9q$YH{Ly;tDt{>bi%Xz-y6GY{0jB<8>~I4Q z4vou?EhH34w*;2c869UIRHy%j;mDZ+g3I_$yb7Pq^e5N)$=zar(iT^}$3$_1wg>gF zF1LHg`ud;*OABQ$*m@P`rfeB7yqArQ#8SUefSPFG7t){|`**4AO`$k*yL+4BgK)F4 zrmfVM&Ei-JpCthpx(cY+upF&5D$?Dnhs+E7Ob@1{jBB}}pNIwrwiIcWD9VC73^ObO z;;B9Otq)tSn}P#pp^3$^xm;~}$7k{gy(q`)RB5YB*^{SCZ?W$p_wVv_H~FdU1dG{asL{_MFhG zp@x^I3hmM0qCRc>R~68Gz3wyiuc-U=&w}~SUY+qJ8u@A2EzhoKsk*NWs1dKcMO_21 zmA^R^&Js=(8-Ac*Q)AC7e2XL0g(>bhjnL=6y{hR3fT+oK!k8w;-<+LZn6%H~3hU2D z0-h1EJB@8dL48$MAfk)w9FWVB+~N$U*x!A0;6WR;zM$4t+5P{MAN&@;A@we>>T3tff!gp@ zwV9gVs1Z;hO07KWRCKM2{A;q887nQnSq;#S1IHi18NDU~IQdmsERlZ4lKKDgh3fD8 znE&a@#IDHy(_4w|o^@&=q5ZQK!{@B~M+! z!G?B!uAyiw2A~hfDDasn)EWWR?7Im)sYkokBs9wAV!Janot*6!~H|CO5&Bp zfDDhbV8U5rLT$ARM1XkH%3&=Y(4ShtZtZ2G-9A|t3^6Fw@~&FvB01Y=yDy< z48t|dK+G?NMZft3AeeseB9PA%3;?*-J1?u$mK(Gk4lo37xM#yskC_Wd(*$N}XgCUG zUT(-4xE&@KMF~-%_peVaJVNJvw*ISmhy4?N9_~o_r9(lbW+4Zs%HStF`RZ}>m>Kt{ zakp>l8YmbEIj#AZR@t~K^T&BMBKi29)G~o=Z@0EVROh@z_KM|WJkiDQ=^~cbz&*P; z07oX}Xk5J!Ad_4JZ5w#P9pNTgIowGuveHB0(O}8O6nFOM%QJRmcQtr#J6icA3Bh+ zVf7qs0vd`eFXD7Z5-&6<`9@OogM9CMxL`zy1mu^eKxW)Qfy2T@0N0{YFdp#xG=|R9 zz0U-R2%CZK2B*xHc&)0RkV+ZV8Vkp5*yUV??BeM zodFX1aXAwVxW)$Mc9^NJtUsJ?aTHA!=QbPl3<2CEZ#GAlA%&`^aEQ-saJdT*wy5R% z+#b?ovb?M39t&)vV}Lj!6u(T+pnx<~^9lW6`m}c;qhMligiWouTy0jkuvm#syl>(t zMdZB0w;!4Hr0V2=V!jYs+lHC$CaY(SGI(L;GbHm0OG)6?T6_**-CVDg`6?MsSH3Vu zBB0O)t}vYgLjY^{e2!0X=bxQBa0Z_T7#cR!iy#~zKlWN1=ej#dYE^sRrdDI_j;b2g z%{>4#eGw)9C#fnt7;K1cxP&!y_T>o^M(&T`PYRZ*aRbvuKoxKRwkOasC%f%eCztb< z5ZVqzDRDo#u54xD0+L@OpSXOlARC6Jy?&k$OBLXr0Ece?)rPd?;=^*MjKP6gn1%awE*L6;5Yi(LbpPqJ?cU24CfnP;KgiF#vGy&+v{X(7w%y?=lP$Gi3WTg6 z0Rel_W0gPKPL5wGypB6HL7vW zarNf<#YA3d+f|GUoJ<*48FtleAb)+ zq;jOdzRD`Kb`GGpS|ZTFz2{Hs^k)hzj<;8+dM4%feclc|2cW32nx<{qnXwqzY-0xD~{!y zbkF~cL3;I0`S3vkBP3Ky${tCFpm8-GhO8UUh~b?~G6=vQZ7&Fbk;}*+K${QZ*-n(4 zK*DE0K_e>A53>miYak9m)J&`lpq5!qZOXRWs%!$e$imT?YDnCZcOrPsBrQ(6XWH72 z{}*Fd9T(-cwTY4Llx`3a5a~vcZjew~5R@9ayFt2<7NjMW9=cmPhXw~}hOY1R+;hMC z-E+^m-}#f@Zjc!M-CFiYi)0a=aH+52-gEfW8i$1Fy1{zbGn}q;I81r=k^8=t zmAWd zBeY0L(9ov2M|GW^ZYn8?&Q6{NOcG2!e#g-Rb6cH6%2wepZt;^ zaeE3<43qWVJ@P5*;3sH}(vc1BPM$+D{E@FYf@QGwIs-YH-bYyh{DcI*vYwQONDM?6 zK%qK?=PPIAf@%>T*`chA{_5zLSkW%63h^)jzif4YnR$5L-H|H2pcFl(*-PtWfN-cv z5=r~P7w6zs@~AT|B0so2s5crkMCe1AVOdsI9Go#u(H-%jN9#?^+)*Mt1dBib zX%)d9uzx_?VEh`OVy}LSEluT6V#Pd~?bH2gQJELnBj_hF$O`Fy<4?Ap$Y91V1L&g$ zxyuao^d~-nsDD)Q>l~gUZCtsnj)UId1%|KsOAYbqkj%&}f`Vxw4L;~^Ri`yo(CZT6 zTV?ACvir}U{LqI#W1(oRkvOkPk8IiwG-hP@WS=7I z8A&7V-*X|MZC|@?+)yTV^Mf!8R*BK6G{(D?j8wuM8GFTulZM5$OEvNw)@qU0|tD0mw6_GY+u8<*`IuKMFJz2!9361BvTzJmCAEf_;?z#4v z*wBLxM)$38NbmY{4+~s<7X`{^C@i+w6Y1#)xbzKQ-R*kH;{?K3h%&6_THnpdhr~JF z-6|La_Ak}_p(=oYM66T5BzG_>M&on(0|1Gb zofm*g44chhKs5yZZl+hBz-I~j%lk683Vvy{(Jzu|d>!OOteHPs%cVcTBrxpF-R%eo z`k74kA=p>)7;O;iy?l{s?Q_Akp#Eim3_6}oN`b$2?p|iw~ z*9k#GB0{2M(IemK0z_du>+g80V>LYzj#G*ZG7QmhRph}Vh~um;$TQe8kc-JjenCaH z43O{n8JABafbBa@uwlmP?pK<%vmZ}S2vuJ3tQk+Y3MFL4(x`?PV9yXCLb}9FUtNCG z^dRgVx$NP{nGoy;1P~*Zan?geeH9P5M_ClT#`&xHm=>$Y(-lJ=T7NQ2L)kmJ&xqRK zF*lLzo5z>T>kN@}i7SJfdn}TW6U5So%@P1uXC5^SkGqwx|$P2riRRM@8wal)+o7z+)8^swCTw@Ed;vggEz z&+cagdw9LY^AZbAg$6xak7Yw9rHXk_ruJiTQ+Kd~i~t5PZoFus95~B7Btm!_z5Rh*W@g$XcQs_@Zyu=<6=y`;3zV($iwA zSaQ-ofFAPyuyHUPw7Pi1Rt?B*W_w);F3=xR9EjRnMOFfUq8P6~pn1V|0SHB%0<~}P zD>tRWkr;qeSXOc{^EerbNx}{rgPDjWSomxvsasq$8aK~jT=Ms!P+~p2|0GMQmS!o1 zeX70^%MdUo`$?!u-lRQw0!6xia9vW{PVzuk`mOF5Q7X?9RHHbzDu%})r^u)%_Z!+67ZGl)&&wTMqb-20}xdgde@6zthYk=AT`241eVpwgfxI;a4H zBE6Iq4%9lQ)9faB1(@jD61#R9aLac7mC$bHs$BO=6>vvPKNihw{HIXIm41Jz0Es+;4};HH3SBGnUL;p9CBm60 zQ`U)PR%%|ts9rx~E+GsDs=wS8Ba)_TSF_$2W<9iw#O~>d3&52giM~pM7i@B=gkDz$ zXZ8`}E0D-SJ>wTaTS>rs=YviVpSGgz&f^#7bNY=xd>RMh_R#;5 z@p~#ef5cdp$b#JD21(6kB4El0V0j6!evT~1$I|i!J}hE-h+yJku-(#2dOpF#cV^?D zV7{QMP|{b&Nt)4$sVIojfK6qfYZfvI@xSm0eSTrqdf|>{LB+4J|B{YEMpsd}xs{2K z{xhKT{CLrEY=-i!#x!awrS154<9I1%n2~NuJ$-rg z2Ob?QK~cScv`4n1q0}8Z4T+&HSzr~J7XbP^1P3%;x(XSIU#uitVV7s|T5-UXFTP)e zM5SvG$|->FF8dYPzpq5vKJ*@y&Ox z`&?4@bo4XKxBIxy=cz*;$jOC5R9`Al^8KO<|ENAp>gxDK7mneS zTwg~>2%Ow?0NiU{X9a>}tcA9RW0w@UdqC{EU~CEcc)C3r^4813*d!=|?8Ff~=p@$I z^wX`N;g3Z;>LC!+%~2QV8F+dEVgUrqC=$u-E4h|=WlPLp!}1Shwz}5ibM3V~)&Jg6y&?Q zAZ@&+dnwF8NrXe#LaHdwOjz*3O)xYb>3x5DF!q*OwE^``l~ul~2{2w|wJ}f}%(imZ zHnSUrUl{S=0cXr*0G#=a;81cYF;OB{)#sKkv`zp~DC3+Gk4uWYGb16&f?ou0)$j_a zQPyYn^kSQQon&D_ZX(HwdkeOwEU0W{`--X zvJx?&R!^rlp8RIeGO%GnCbXdpK{ijC5Mok>opgTau~h&qsRYH)M{dnRe2!N8Kz5xUpv{R5NF}v4GUw=TX%a$J+L@ zN)q-!5}ZrC>T@O~9Ol@tw@5^R9Zbw5NnNFLZ>VFeIeCyYF-}&wX9=3g=A1O6(7lyp zJWMIyaoUHzZ7lZ60m?+#XzrEo;^5`jkJ(07pzFOWkF(RenfKVo`n zpYM9Kzu(Sa%+1}!;i}4IxWovCvy8qQ=aZ;f<($CP3Mfj{=ES$c`R7<9~|%c zk^&L{D^+1sLC$}J1`Q#Q59ur>h+nnqdf$mJp9RDp`TP*O4$85^XT5_J*5r9I>WjK> zi$1yZe{RFKaHO<-LSGESFUfegu`ClT4M;P51#CZ6{x}xzT_)Bb=PQqO11{%!r;(!A z$Dxj_?p+OueYynIC{=>x_~pVFHynYi_!=X@5@IA<@|?x(*#GIvW5T83a(e|lf}yt^R{XC9 za~V$@MG_YgD{~g%vv0>eK(Jw|a6Qyf-ueweJ3+7qaHWj2aiXEM0o|bZ^==<*0|8mr zhTd9%{naRh)vuA@17($GiSJ3M%a3@sMMEu6DYbLB1mdQ6*2|^)xP&`E(V};WyQx*o zatC$?1JJcTo^IzZvcakkxht#+_C>l99*!i)F(njs~gtM ze!S9eIzXiT78e*cmDiIt`hA1{!PnKHerRYzTf;|zTY>7|gK-g(Ri*V>fT41^(2Gn| z?anPAJcv$NJz#eK=`Bmz$$`%7#3XO(y!RgkL1$T95@Rd1O0`q$C%V4uK_S8x>k!X# z00q}+NA;$lvX zxQT*w#dX>_a_!ui04>bnYE61G5@FOJ0h|Xd%&wr^pxN-;tp4QUXE5fK*pf&ivd|yO zkCK#xYb%(54DE75jtN)0xG7t7ZSJE6Dmu16eIL}!bkRA?P(?dgZEGdu($UNQpo-~D zatcd`)@r?@%BQ8nsw(9$xA4(sxgUnH3%A&## zsU^Djh~CLK*;j{1#VY-v(zdtjOy_7oP`~PDViZ$|#v8Cln$zn4IEl-q`ye~kk(E#J z8=WRkiU`+e)$MewApFSr1PG#yczWcO zpYb}_&ls1a8U29^L{v@gY|EP@!JY_(S~6CG(N_?{>7x~=%k~#wN%lWq-1is=+(tT@ zauPfv{6en%`Po!2pF8VH<2p!^AnU310~Wl`u7=Do;8t%3MKqyU9da~T{aalE5IdNB z`DMq4_!kT6cVPnFc!a9WVzgQEhV=da>;}#mK>Phy0g&GShaLZ4wF%72lVvIk8hkj-|gu zCbV4qo9O-!>i=^|C;5@Q;T0z{Cev4u^F(~^Df!;zJD;`f4-60ThQZj znG_BKG0RC=Vj32~4q#9~NX)~`GS&tWcp51{yi(Io|7rW~wuj^E|DIfb zNO?9Ab}|Bfd1N2Y;C0x}0*p3D0lv}8BJ|qOXLERMUf=x`8_?zUu-x0|*IZco&Z-5Q zDfz_#`hPZjEuOm&4sEcSNvtS{x_>hc1iEX?d^YnUwl`hQKc~TS)y~}!Nx43!AHRX# zSLing@#W!tJ_iIDNZDT>-<~gze&jv>fNpfm%d^nnxE+L^usxDl=Xzjh2}r=Vub51& zbt}I5W-&_LVCKEdzK7A}Ll_^qHN?VpvySPB`CG6rf!ZDv2cO)srzum@5B zIK6-W3f-vYL#{V)fESbZiy}7Nba)JiR-`E8pKHy0H4c)AN}m#3?*N;R6mTtwt`B`E z-dzBz*-wO>RK*(o4NKwRt{J~xa+L+p0M;EqB4NqZx&D5YLv(IHk+ap`3tH*g*IaPk|N5>-vFt!WgGU7KyfOGx-`8@js zfEJZ`;QLi`TehRGqUFq`Q$`uB%GTGy!pyBGay-4_p>;>)&n)L(w8nKag=8oX!1H6s zU1yYr9lzsj0j%($;J7D14l~K9Rs_#)XUIJ49sMQ2^Z$61mx~tkkWs-3x{7$LL4Y4A zc6Y%|UnQTZ9ON>XJ}(CKM9`!A`0>edmk!~za;!@j(3@h%#j57^g)vPP7~}9+AT9ng zKWF=5vpZ%~_#Cs8z^{@Je1(ynjQ482JuutUk?Dm;>+P9cybr^u``p{VWk!}y5j(Q_ zzpMW?=cHuuHeyf-0Nq^sVwBHzU0j_$#n)RwX&cP?pVdlM^23_knck+?QmIb>ICH3i zq0FoEvMYfT3R`O_hj@WBKpFU|3=#$G>_^l4j}`{z3u=n8AYPlR6_z zQU?GVH5x3jEhDXQ+SO{UIel zh!L5y9QzcQu!3bZ$R9-@;Mvl_?MIpWxG}#r zFl5pjZP5LNUGer`WRqv6J^WQZ02L%ROAx$JD_YCynOkJadah2Z zn;mFI&lXBFLCRO3Z#?Z4ogNB*2TXJUWGTailc*9<>}{SLmVSIyv)xrOhqS)C`06UH z#;bckJx?r>MZzURWcpBYBZDy^eIn~b|oE&PBCUaX|e>Uw=Y~1b~bvF>j(oO zmQy=7(KIqYue&tQUG~TGEX3(|78ZS6-&%KYvHh03Rd3$RsGeCZZADkcif;pQ{P(v% zd;v&&iLKmH0fV;uwlGA*ab_tqo*$9gnHO>v0<=J{0V4t302SI-Nnd_(F4if%cjW=E z`fRhb_^bO}aEjjYG)Lsb=6C8P&$EKX^(wK*&hfkQ=toZ&x8(~n$mWg9Q;~UlseK1Z zrmTvvc!|mzw_c+ZX3dowLP+>2wwB@ZB*271BS}}WgS-1#VM5=`lC%4J%vOt{!o;n_ zEuQyY8ZU!l!?xs*H69OZJSNA&4w1u;lawY8N*s7dMG84?Fez>Cy7Dsl{sV zS`3(>DOTv1eR4EkVY+8k@$KxJ*w5E9hSxRako|JpOm7wMCNmGH`}u8erds;Kx0W07 zL6;q}?K0h}0pcpqp3Oozgz(d>!MT&@aVjBhx&6ytmAdEO9nVjf?3 zZ3DGa3~VsG_`oftm5T)6=xp7WUm36W_-w8kUY|-Ov)>Dipa^iA4@GQ-$Kw`wJ9T|$ zq4eppSLSR<6uK1wH(zQen6t+L3LS;Ll)eLqs52skw#YT*7T2P#aC;WVUEi_QidL?6 z&eQc6it|}3amKGmZF>T+MDD8b_cSWKUjZC<(sBy7Amvu$`Bk?GL!|~*-V!!d{p62N zTjeDzS-TWw957a8f!ngi8uQ`Ym0A1s2K)l8lfL!U**LH3z1Oas1eygZQeo|;pK{Dl zXqNF&+**-wF*jzGXTMiONJr?#lP9bghGUqu4?8E6_R2e`!;-$6K4d5_V~UUtw~kcX z#eS+PaOo6DIb@T=`wrkDSS>st-g$|JhDb*X3i89lLz0yE{SOI0KZai|7Zc~jh>$C| zqJYPFI+vrZT4kh)qN?$hE^_O$er?84T=#J7y19GCUJa(`6x@C9Yu@w_Q9`=3V~3w( z+p6+^A}hFhd*FB@@8_N#VV~<1YqHw$Pi= zei$h(ksti-Fb}5Uf2@jd@k6JV#M9_wMrz>;pcZj6-R1gl%bb4lC-3t z5^|X6VFMkO9@4wq0{O1|^WnNhmDyVCJxmJTK(|OHU?y_;^-#@d`o)KLm0%YUqd{`0GkL+4(v0QTxquky~G5oVkdg|9;34B8K8UO2HPf8 z4&(D&ODpTqvRtI;{$%kKeVfu2dy|h29O>I;U}*49@je%;%i}@%HRx(ocsi3cg^$nl zZUaEYfPc?Yjn}QWtD3^QVM54K^TKg*Oc67xJUrt#$6IVVxZ`~$?NP%p5xC^ZW9xw4 zeC3(IOgPm%>J!=_F)k}HU*^tc8JJ1^^w2$7eMF>*Iu07!7BsM65EA3InW#DH;>u{> zn|ThMTqQ|pQzT4R?kkt}kn(U$d0|d1L{+_1(fj$;QqHR9K15s?8vFDOq5r*e23zCMA>Ua7|Ubq3P%B=2%e1V2M`qt&lmh(A;-#)v{uyPsa< zsHj9a_Q?J4MnKdR$3@=D4fQljNhC_hVIw3CvzH3ZNhe?`D5)SYJN=T`WNh%ntL>fw zHawf(RHdaoMgUx%&es#8IA%$!@rs<=Yy_bQm#@%FzYoj5@DP5K_W^da`Z$raqTuEXX!OqLao@bf-;7fyMUt41Fr+9lo=s&-2qLDvn>hTK8~6X zO&K8aHMv1~ACN}`X(4o>x%0E$ND32zpHtz?mPFmN-W_Ywxg6nJr>5ai@N!ol2FW=C z(PXq=RwLP493k;eplxDAgj9^oBh7fl73xiMoMx_pzCmr@ap=!OVw=G(U`TNybW=E` zIwK-(_V7KXeWAe1)gm23DWp=YrGaq-$|rgim8fXlb27+fa$}UGbQhSNf)@K0zRRXY zwM=!2Jcx3Lhz<|6X_#_@i-)OV`=4%n4PdvOwLmt%Xn4+v!0P8W)cJ){wYff=>ca+t9==n_dLzG_3{$8OO|!~l6^V)7mtDUFKV zi-0;STMNr*tu7kPi+sd@c1Zrv071tp(}`TGiU(m2Yf|nFqlwxaziHnG&MMijrm)+O z@___(hIdmKE6(}+r6L=lH?myEW26Yz6_%*_Uh-B$6zDEfd%3deWn1ds9`ZgE=~&5; zy%<1PYzrFMJ6mDkKu&6_k~%Su1MH~&H#_>!#G0I%)uNE^Uv$kNTE!tYU_9eZ9vqY$ z?dct`hm{aUP-^PM+$QILQpit**kgd=KXx#gOultOpfCLMpr(6B%6BgMn1$k4Do(+4e9!|Bi`7E3*N2~ zqLt-pJ4l=*9$Gn8*^3~@8t~Po&hjC+F_Km{FS_A@Z1h5U8@urMLcq|MdK)lO%HXFE zVUE^nY&dh|XRat~4s4imwgYFM(p92>6DoUwUA1j2~= zk1%bvZX+7N8n{_k)@7LN`MU|KA3Uxyjn6BCIWa)c8S3^zbfwp>gC84P+ zhoCl!D#>2ZuzUcK;sW^tQXFhyQm4HB7MW;4}O*( zNaz+c;M7|A6-F_M!IX{JpV!2C9)8k}h|*lK4#n}jtQFqpLvOW0=hS)m6;wb}f=4H9 z{57YY9rUr%L~h9s&Wu1IGjB6SWjDeFvpN5yf+@JgLkm$y@F6(H*3JM4o91A>C|#do zeUr~`CLmrSCsn3$P4NgX0lGLdIx2=+*D#J|(0+j~LFtPZ=Q-`18X3}v z(^Qf0o{cgGHIIVjwuel7J)zJ#kuu(gFy%*LP(QuY#apfXxGb5G0&p%XEgeKNqq3|W0Tr%#%kbgP=9yIS!kJPsQ4j$li{j58dF6Q+WY%_eYd zQQK7>JxOGZ%utUWv)_HPCkIAKr4#WUPmhvCyLBew@_Dk7fjmy3Fo)!q%VhGdUn$NH z9-@&a`NmZ+=Of+c{?4t()&{mW>~zb3tbtz85BU@C9bUB@-SKpT=PN2U2Sk#Y{z%CL zI}g$IWIC;-fXsh{@l8yFFxQTpA9)hc28fK_hDuLBBB2uCXTcXnTP5s$ZO~IjkYF9( z1&pUw_W9IXOk&+YmCw&lzqLpu0s4Zyio4uLO|?-anhbl}ky=diY&xI_##saw!!WKR zWPo5x9ark`&B;mZR6|#-9*|<6;5J)70O#{xzt(%shh-5JIQzaxeSva;Gd1-L-S7#C zOp5i>1-sKT;V)eAIoS3JsXPXqvWVeRLb(f2(9ch=H$d;D?%y0z>XH-8cl1#Cg|s7+ zHXRus;%(K6HkA$#L_3DyF~6ZyR#MRw9zN$rjducenT#zqOm9)SicuSV23eQXM&NJ^Z!IH-O=3~;|OKAg)LvHpNn z?g0Ab`K4&3Iwg%dEjtEYZk%3PvJ87$D#tfj!UX|4f@;ayO?LY~;ykNWMmN9Bb$5(--eeJx0cyQF_?(qivc@ z#)FW0DEZm1>>(s$MQ_KX*EArTE&^YYH(l)MYAB@(&mI$nWsOvrZ@s8qJr(;~8nD81 z!H#d^k5p_t2}=j=F_)Al5TbCHkg~s_mrL?FaJrlo2)I5Ez(x=#{MsQ0Zlq|Er13!- z_fb#m#(Bzh6JAtEgo&t2OE(=<4Fqp@g1Y1@$Vlyb8|^;UP1bBbdRHB%#QV&LxFzvc zNJ3CBW~0}*;(3CsbxGUzbbXqOQ;fv(>$;}`k$Ii~lQ+_Bn#wxI#_>Y19JFa7>rfHT zde5+-6;V7H+|$x<0b?OH=@w7ttx+Q}=SyUHA*HqQNMgAz_TLUaXm#|QygryZ=CtGG zMW(hKm|NV~-jk&JQPs^0&vxw6B5x0>1?ubobA)|Ov^IR$-jf%9e*6(y^&31+_s0aT z=>{)OjXXV4#8FFylev+Svf#{Rq<0hQIj<-KnqC~TC>=DOE?dOaE6x!HO-i0!xufkc z4^8cN&GA z--Bu%RPAJEP^-$isf{XlV-ieMl^x1+!$`Fn6qIvK;gO!vLqITUMBkqazh#&W=$w+; z+KpRHo=9~1EGHq&p

X5GW!$&cAZ)wm6KPR>02<~TFM!}u6Ex9OuN5@T*OS3{1R zA7k8EyY1fdyDm+5SNIFX4~|>X1g>v$B1cm z^pR5?mWfWWNGxrPdPEYOt@oWxPJ4uvDwu}sbMQYy?|Uw;onS4 zi=+*F9*8wgp1Em-|KAeGe|$F=(x$50PPC*%zN-iU6aK%7CI9hBNm@>{Fh63X%^2V^ zYsNCvqW_cJ`hQk5T9S2Al{+O;~Zqd2#P<(ALeRd|i-&$+a8xB@|tp1JYRn1mYec#2=!J^BxcVB4p z)3u(nx?VB@rZh{%q1_#sM_vsWyNq{tNIgZzUHo89^5XCjqlCsOf4|U;WC>uL(qx?2(0d5 zh1tG0_MPBXo6Fsr(Ud2zqGRdt`qa86#IveAhU?^tY<^DL0Ig^*?oLKq?IOnH4h))n zfWZp_mZdhpaOP;;g4gt=>+^l+50p2Ty=r2Ra(VbI|HT}kyyT_+Gf6Gb|v#h9qR=Fthx`4Q|(g4+#;}Qz=d)w(7g|n-R zH}?2CtL21h!1Qjt<`9{NQu|N)W_3+p8&U3_j#x?i=WB<4Sr_RV*`FcCF8NTOg#oFSq z$)5<>h601QtsD%RRBXzd$msN%bg_d92(R`n>+gC-c+xaWGJ$T-uoR;Q$trb=&hmq$ zDeU)GzF&(T-+%af2RX}pZ>dl`5v(@a6`rtCm)n9K+5&W8d5S?(uwtQ4SC@TTg=;U< zEKsFr6AsbMROlcF4HefqMioJpXY$}@U}!Vhs-Hin{zL(?py{}9QB;#u7NK$!r4Pk? z2AYj&esS7`qvd-1EvDRos(5Dil=O#|pkC%$$_~n_rA=2M!b0Vc;1494=+BqLU{sS5 zC~gO&q5I6x%Uz`nyd^!~i7plVdG9jew zueK7P&#@OfSRlO+F+@pfkL)k%88})jzzpHPbuvFW-vqgiHm$sIDLO0l__4~;C<;%N zU#Xi*2AK3g}Ub8Hp?H)pf< z={^pn@iD7O6yEpp%jh&DceX!aqsv&W0?N<9q7eM6Z-8HeJntlVI+f0U&-d;S;LBC` zyQ#{0ROr>+%^2}(ieJZ0XaIj2G-Y`Ynp_lmU&zm(dYHw)%~6kKsrQ0AZo0Nhv`XhL zf}_UX9~|Q66*nl{62dZ5+DjGwB<1~Q?cEPA48IR^WctvZ&FCyx4%M)4{YxYI4eHjBhoLA%FTUNOzBiKnk`}? z?|}H;^effdZak6*evx%jle$;lx*10e!LN>q@Ws?Y7Myz?OmoEeHQlDCef8#QxH!Q^ zk9Mcw_2;{Ac(m*%#{a$D{^jKVg)wYA@E39Ta-+o96gG=8qs{KbQ8m}F_~!a-ufdFA zalRsZ?^}5L8IyLn5rxSV$UIMvWSe&jbpf^TQ?`fPRkkVm)i0nzV|v z$M)O9lK+0)y#bY=4ZfBc4g!OhSECIf*?VWkqbS&V$4$v^o$?g4zx*wOD>AdTyyUm| z{)tl-^2}wUh-=r-@XnQUOgQ3ic{HL&R*%17lK;KfL~U%bIFVBg^x|*59Y!K=()@!c zAmaEt4(Z+g%K_3ye>3iRFz``fFF=OY2#_<%Y(1E*vRatV)C17qM(0o*IyD&nY>SP~ zXK)_*qrZrA{1NTqU<;noAK`Oc5-&6u754LWqj@JLC_+Nv(CuqBi>R1N`zpti(yvGSKvX#)QAt=W! ze4-+O*;m(^@9n>y^e0C%#}99|)>#&Bo+^XnA3Nx;5f9y6&m4S6$z^H%VcG_~JG(jf zsluVZLgc@iJ`o5BaS-?x9@od4m_)z6r6I_jn=iCg1Z8|7TBkRXbM$-T+rcv+1Y)gU z9~B3mF@?M1+0Mg1WV5T>9}j}fPBz7F>RDqibl7iyZhh&Vrc99}D9U^kj=A+oL;rD1 zyi?S09#VoR0SDM8JV`z!-@DcmUNUyhxzVZiywejM+LL5`k#XDBo(^jFQTgy*mTOz*nGj` zll4UL0Q0HIT9oD>ic#%&#;A^wgi>rRX}&OXuVmBZ>$zWG48jQj$P&hkGx>- za|rGVNwnZyB0n@EY-4ibr^xuaJfnTq9WqL``j4b8k;KJ*}F&Iu$2BS2?_V9!f3f(;;k@E@)LwwRjGIpEF;s zP3De?^9;!x0XRB#h4$G^NV<@7!%v@Q%k!5bGNimL_=;=7J&)BF?og?saa`~~)G3lk z?6?Za+v(sIDS}67x;uBM)MCYFuX?9SME6h8lUJeFG&}Qq_~XV%HOfdy`dVY_42IOo zKP3W9r*}usX02Ld#IAU%9MJzH$@~3^dd&O}BmVs;3@Ce~)A+@ObcGZ!AG&4V;`k3R z?_3y7;aHFFYHUB!r)Dh7xH|9;G_*@0Alwsn@u{Af(6^l2h!;JF`d;;NvoCB7>mAge zhzXo^X{gkDT@HAki#zp?-!H9Zh)Sr4pDemAr@wKBW{Y6^KsQ-5s2r#@sF<5yp9a!J zn4+h>pZ}a&MS?XS>e}5LR zLBVgcDhJ+4yT7C_=P)=sy}y?I1_;PC&~wIko!+33=2j-)UHRNb@i%EQ{fRU9eGxE_ z{%9wgO_1=0U>v}{t53BKtE|t}&znQkTCArLxreA3&;muqDm}G@S9147RfX3n*OKQd z7{1qKcGd&pqx%)&YR1r!3Xvy9y%=U?5 zqTs*V-EJp0mFG}U_>2)2-&n0c*4+9|_Z3yaJkuYp28mo+yvoJ)_x{xd8cjL)k7&lP zIdA9`U1n)N&AN;-&o)VyvNegqA9)6PU2Z;GNCq9OZu<)c5t?)2gjvrk$sy_!S zqL>;Uu_isHRoEGL{Pr;ItgwW#T;t0hFQ=T!fB5j622EC@9JEASn2orZyJ;`S=E-%^ z2s;+JNMe+7SkQeM>jMOsfSKr(ObA+g5U$r}p+kG#mU5KPz-R2Z_X2vB16imiTe^``rL zv!|RBO*dPdV9>t0k=tt;ZX_ai{kTD~>_NS`kV&lDA)xD{@hSefx$vnxIKj@9$oz7p zGe+#W=uiq9(&Di!h4^40Z0wznQfYoASfqt0>9RL)i9d*i{a2BaIW>JJAcI`&1u z(Y_0$Be&MipQMR-hh&F#C+fz3h}S4a`jlT@rhzg#Ly|NuU!wj;hfYNQZ$9dn4zemT zxN5eE!5Vcn&=`UTeGzm-*DyFrdP4P388mRhBH}qo^l!N&v>(W+08-3qo;UiC-fl znn-|=5hxE$UEa~*E0zh6Z4Dc}gXuDT4G7qJEIx+*VgHQ6B*F1oOPK>7L#0!GjIvg= z6*36PCrmQyO|rPguFgJSjG+>P?U76C^LMpmR#QZ>ljzHV1!mK1Z36=%k~co(zbx^4RLoYI*uHT7 zV&wese{wx8F!6tj3jSqLw<%ac0iWi6O^y)Iir!*(Ihoy+YqO;|?Aev*sHF>cpCt$? zwMIl_zkzcj6DEax%WOV z;=M<{5M_vnSIb`r(H(71fvq!KKE($mjc4e{#C!|bos+x~+?%IT@qNiIr(VCmZaKxA ze^X?tT5ZtV-|w<^cMw#KvT7PIqMd$+f%sQ(=09Vz->)?VB@c^ZbiAePVZBsuZtQXb z&dgg^;_xu@Ww1DI>!`r}iFDe&o`RrW0O7#T(6ep=TSQ=jL~WB!8G-t_XX5hPbcE+UFN^&G27=$Q5>a zV=2HXUI3!O@WYRMGr}er51-l{7F$fds&dfsLhnClz4!6C?V)5O;Fi+`oPQRa52}~$ zIrts@ml6DVz~cWn7~y**VmDQGPZ_KyDt+Y3Opxi=O779r3jj)0Tg)CweNUF<sG3|f zm-T9OigUm8{Pp2N^DhZR0Ik%15jH_uMK+BPPVS;)rTis`0T4JR0EYFNh(8FJ-g1kx zWLj~{(UQ-b0@PuBX7PKe?Cg}Y;Xd|16o2{LctTaNKpWLQm&+uZvqeu|Mo%5_)V0bv z9sMbn`#>BEqr~~bY;Tiw^NnI332dCEB?@qhv-Owx4e|OO^;=Y|fGgYOBkf}b!K?ZN zfZ+Ic4qms$5X(6(Tx%i!=WF--sur!Gb%BaiJt(f1eA{9L(mDO%VgTV3xE8VR-0!wA zQN-`*!+W!S3>z&#gV5~84`&IX9!;-KwC$F}?{5ZcZnJBE!RSJ+usgX?Dq&YXushk@ zU6sY@YnDtG%}~Ai?&Z6N(dF~m6wp+>A2rxjsu$pd3SUiefm=_g(<*E{J7?{|B6Fn& zpEyabAF~?7{X$T?m!dy%{>7gE`rQLK{;A|q^5CL_a$FJeZ6^W-h)((I(@|e7@Z8lv zUbHCs^i^qvj=*@+$)0PRkNxZ+fH};KuvA3)M6DHOJ99YHK>!0ufM%~*y5yfzxk433 zJP!`GIPfo`^7q|IeRysOSzZFx0Q?pghS$89zc1Dw0~X+L`ah1A7>Z+#hXRAj!W@Nw zZ_R+twh+GH=^bQ{t$2Nkjs5}N^7T}U+11yGTrB=3JpX(WSImhQpwC#kIo`Z*4evWF zUuq;IQOU$6=hcIFL^b8VcpwX)F~qLImM#CqkvtLxy>S8P9iHc~R^ZqITW6oo|9$C& zM_t3dOfAv5{DGdZtN%wIt2N>K%WPlmn@Hao=@vKpxXjo2uJo{Bl1Cf60Qu?8TmDz& z51^K8jqe%kqjSK%cF@y~H|@%NwfwIhh0;Hj)H&a^bZ{P6t_cCDC-(VuzWpqaLX}Ju zPVWx+!gJX5P-<1hx!bP%LO@gJaAus5OZPYL?EPNcSLSq(LZwT;jGH2+4ZhYl{aH|J zaECUOaM`C$=b*5@%jkYzLB|Ym!aDYKd0YQ&{i~&D3uNkS7p6aL@2&Sibx$mf9xB|V!;(% z48+#3q}KYN$w$yy^!|g9&*c;>57>y-`$Zk45oDF}T2SHHDh?Nx4C* zX>7Yet@YBDBEbpm&0Zb5PptsN`KL?urGpO%->-rO#QQq>ja9TF9r~n7V%Gylbykif zS^37EEpzD*=001Ok?H@z?u{-u?CZUZ}&YDT5qcRY#RYo4B#CuRll{eq^c&m zfls7$<3Q`(gp%wOcs6=z_^*hOa7Nlwx?n(a4GIw9>3#$HtOYDw5%hDB%&n(_x<_1vlRlT;mV#yvsGj=5l0G)5{Q~HaD zvDZf=im!xRfonmewqE^>P7g*`ywl_EQ`*(4^bU4LZDLHt9o#P=PFasL zA>B(vifb<2@i}bVa~k?j6F|Ixf|YVXX+s}!k^}47G2nhf0cAbq`wPN^jqlJ!_T%&w zGJj14%GS@#>ILOWq4GjMtC_8#H|fjCPAJ(bHuo)WGdY^dhYU`fG}|W`I1F^gGn{bv zdgy$j6bd!omwoW@y}vDH)A1oJ)gg&r%KYZ^s*1NTb&6Eaf`e>aFrp2K`?6f0sEkZB`cy<)d-&vYMYO@~25VK3USLZnmA8#5Rd8RPlT-!pM=fsEO@780)r^^k_e^%TNf-7E~u%pC& z4&%_001bq~eH=TQ*k9LezH^^*cA15x6GGW0OlE5ht{I}m{F8DBRm3uB-ftSxC|#rV z1NEdC_?jZW%@vt^M(FeQebLYdy4h0*3i)vDG8>c7O!u zbsI&c__Ax%3+QJUO63|%F;kUdeX8;BotKiCAdS!eFm_f^bv4_z#@*fB-Q6L<7EW+? z2oAv|xVt+9O(1A+cXto&?gW=Rv-dey9?pOFD{Zz0tTk)Ys8Rjv{nklCGsD7?HGP|5 zJs*G+Hkagecyi>%F59v2Ls0OPyHEP?oP!u@WHd#&P7lBVFXDXv7R<16dLqH zZ_Qs#vZ4@fl^>UOzHdptGjtH-ydtG4{#_MmRdC)y3sECGmC+Zubh4$Y%GmCm4QI&F ze7SAKu5;q!*%ErDw9+Il6bZBwjQiV@YTiFw?{M7Jm?Cs>iCL?q)xin)Y|DpT-(Y490*% zs%k{q$OiLec()-tr!?t6c$Nq|>Dy81+Ux`S&iXF-kS!7Ig{z|F<>Rqj>Bl2X@q_&u zMzxbvdxmtczDND#+WC|TFqxOu3Fu#e4)ZnOo%|6f3zJ4in>o}IXq_LmNeqjd)M;dG zPFl{NP}+2_gpPq}BPiuSQ&DDs#QRLsHitR~SZw6@5J5^zs%~)wU7gEoKz&=_%t@R} znrKlS(=^SIXBZX+c#Cc4cf0Rd9Tj@9IZ?=Oi?7oLA6;8JQH5)te>Q;PmRb*||ZzA8MOOOE{Fjg8X9)?lKDcc&QG!zDymWL##Dy7X-Tn!3(6^VAyn@OL=*V?{EKz=_wdXC*Zt zf*lLZn$6fv?(a|%v}J%V9J&wyGuZZ+$Jy^(^&Zh!MkHZzH1_M~Jk)t=iONgGB|u=L zmV_pz*5ghlrq;et=aAf=KQnz+eQWoq3c#^2dg}2hp8fMdAVq6A3^#|{yOLh%MM#Zr z2H6+@$|fJVv~Bep$3`H6wwEOTjtdS{j90#U!R`rvat~JqWyM@ z>qg|@=rbNRJT0i*cK$MnTWxTfnHo_BvXsvdNW+6)J&d}m&W}1MhheG zoRYMH`vNw%a9Q6HEuP4VI3IkznBR5KP0u&E+{~v?t5OaT3CRYPXDH6b@O3hJMr?lA z2Lhx!k26nX&|D_k(;<*Ojnn;SrC?7i$%s4apz!%(3=5g!s(^clB&wV*Th8#qbknQ! zNf6DW?-DbDJP%rDwcbe3Z{zkkQF5N@9Kb%q(C@>o(JGaAs%BNrz>0bzR^DeX7p7|~ z-z^!Y3!4bCC(rShKfs}zufFOBXM%RsIePrWT@68@Y+uBy7xTfZwX^tzi~GJ{yp@59 zhl~5h*g)TSEL>pya~@m6wafnaojq8cz^inPuY@k1n#e0QlpOxAZ*8>S@r|2 z@R_v~O!)52Cn6m*U%v#zis8|H#YWGch!YWm(ndeNT~=J+t{_{bsUoakXJ@R=uGR{+ zzkUScafl*_2(`(0?X!@qcHL``*%NIV%kbbT)H3U->| zLV14ZxdwTh5MKvfP8qXO8mol1x23nC=Pd)Mk3HHWgSPnGzCm~Cg4^)BJSg+S_eY82 zd)N;D2y)Zdkm<-tC-Kl<_qop`moEE>D08tYCLytT?E@O{?6voD4Y0<{V+?~RPNe|f z)!j^h)Z4)813%GZ(O;`_*+l9hRWo?$5MFJ1T!wA?A62ueF z=GbaP_Af&#uYQ7@5k#kUPE{F%mb+F!i=zrA198EPpFWAXpXM2G+TlYtTp^wn57u~+ zP&AQc^Soe?9%&tL9Poad2?Z;!JSP^arv9NI40Y%mIH|v(lCqIf;>h9;nR2P)N(32( zQv9e9w2`7k&whr-CWR0s=ffW9-Hm;-$iaEsO-=%#hm1r5&p5{?FaXzU35>BZ#;{76cw%B7<#N}w7oV3HskdmDDLv?CSjn>|>NeW@ zKP?9^O`)yX{49)vLGtMUChALZ(;vJ_FCPK$Cs8)AS=l5?tJ-2Yq4V6v$YH2ERT?R$ zM-8JqcFlU#DI%7li^>m)ow<)A1Bb&#W|KTeL!81w4sz8brL0@H!wJ#WUHQ!(yfX&Y z6vBEEHyfj4bY?+JLcG%2#dk_e(KIOTrVj%s8?0UMTCND?W3I*ihMl&XLY@L>(*fX{ zu;~()-_i9=U67tfHEo?VpRjcV)DB?uhhJjgFokF-d)#v?CHCXfTRv2i_3_zpK`-PvJfiNmBY*I%VinoXe4H2nFedrr)9v z*>3xA13$%vf!85!TkdCo{(zyRriF{iT#^q$WG6@Yu_qkG?VD>3g40h|o^o1ZMu{wq zYuCHv31E#`v))chuqFwLh33FLBIZMIb+qpuKMuO%Fi0=#8C5~$bkyZQNiKq0=nn@7 zQ%IzA*)QL^2N%rm5lAHYeA<_Ez9UZC^#A&xju;StG&7!O)ot{P`J$ zJ|2d2ON?yR^Z2%liXq>BGmqD3^f7^tzv#Lvi#$SbVw}AeRDjQY)hnP(vL7JEM-a~L zVput_Puw{$ux2*@)RaNBMn&s!sQigZ9Iq96qXiV8_x5BTfQ#UUmmh!?9AQE%R0FfV z7Z98M5d2Nll-{MAd79Y>MvC@&=GXwZ*i3gfhBlKbRxOs!UzKqfK+MW$V!NnaU+N>x zZS&^P?IpiV92JB^)et!e#kV-ZDcE!M^r(0#{|yc*Qxv?>vruS*e)!aUOJABhUKn=7 zi)c6IkmqFqmZoJ!;>(`o z8Lq6}LP+viCQP>3YJK;7E^A^*NQ+5^gFo@ZLZ-p+v{{5~9m+897b%yf6-w-P%%#Bk zWwUrz?^EP_{R8hd8nm%#0HdN8iH{N>+d4R*Qh!M@C6Wr;GDceD)GZ~O?-q>#f>84^ z3K*^To_^M)PMOky#BWM?oKtQJFom@_?rU_tsS)WM2e5fy-HZEBx%cJu(#cSMxm z2j~m?T=hfype`Oj(reT&geb@eJ;7c5h?Ez<*-*>uirn)t%<<9Ns^gP{+Jq>K_pmVV z_LHE|^@K43m$q1B*wl(MsQ9Kb#4WAg2I!WHIgXpeWCsxMCK+krZc0Ms3yNcJ2eO-V z095DFTIF8ai$igFDyX14if7h{#B!mT=@dq?%WeX53FD`{Fq8*NucN@B43z$n;YcEi zdJi!=;>fuG*J}C<7f*E9apoNL(TUK{p^ShhLFrf6uvv9P-i+X)l%0cJ%17 z*{I!j%05hdCSh{}NhluLl_7UEm7s$g1$IN~Bq$ehL;tk>?{XWDdEhX2cK`Id zw`+&>WMH;+C(q}mq=Q2ynbYS+yOLVz_L>Hvg2@UYw_wPdHgv^YzCaOD;Y8%nZWOZn zo9e@m1|r{VmcR>v__YcK_Ba+JTRAF){?^loqyU}LIx?|Sb^=Z4`UjafTF}HQi3w)| zOC?MPBK)OEMw{TJl|?M9$giF}ghX1N3!@I3`#lG?ZRc!+0ex*Ipzvw6nFtwj|Fp{Y z=5_LVirC~HVd-ah{J>ER6jC+!b%<(wZ!|SXzpMy$)(EypB&eOFpjb$MlD#p{YTe|T z2-j1^9a>6dFf8sm+%ko9Q)%?pkfwG}ZiY%e|L^OT!JP=9fJB*a_8`aJ2~XYw_$;f- znlH;|frHAi4ZFHVY%m!!eQ(Sf5v6Rbo4-QDun2~pP@c>Pf&vmtJZt=YPkLOnv5ej( zbqRY{^Om3f^!@KL8r_cX4llss6pOA@uoG5aRb6aMc)6n7+NQ&?{1Gq9{e^(gJ!yV_ z$089cDf^)SQ@%`Sn)zYD9AWpG*AY>yn~_Q~^j;j-0duZb5qe5l$j}iHha(x$zDBo8 zWD9mlD)}`Z5Q9Lsqpg;mDl!Up{(#W{h8jt?7N@SwrGjm|{-gFp(A;%CW2Qa1f^7%2 ziT&QfQFZaO4b1S5uR;$XKI6OXt{cwjz4_2|-a`%phBKob^vJHQ%><8RPIvQjJ96D! zGrt}^T<6I${Gg9N$X=g8JBEZ!HT=uy^z~~cxj<9 z8W#h~yD@6yJT(29kS7P^rAnwxM|#F)ZD`a%i$8y84R0E_9V?M#1aR(b{~;~V6*scz zNnSyfE_L6W@~IT5*_WdXz8xU(7;(}1g-2t2g%>}mML*Ch$n+7yuBRMs}2c__?Xwy!s)1!5byjt^XkymkvVVpw~TGl`p&SJxtY2&Y2DZz<@ezP1Tq;#&&^ z=^_(&Q1xN03%)m5mGdI^mOhOsHx&xDakTGH2j(7^aqm%{(-X+4<3r#47^($c;)#U+ zjXRx@U}%gY{~GSdOk*-euYT;37_d8@L2H#t7Z^A88bj*iAvca0gZ|XAT@0E+3ht+6+-yik4G!swo= zrPjf9>u-xfdYCj3{pHj+DjaaNbLD|Eh1SLhV}!EYF%D9X7}1`+g*-@qT*;14>sXa_ zI0oh?`e!CCFvQYtTCxj6WM|rkQkJPCct0IG*;XEmUpV)r=necbgjUX$h;e7KxN1P% zcQkKkbkldI8ZLL8e2m#Jalq77Rj>Gq;}MdZhK^l0G+j6LiYnRG#|JJLzENX3$ad4l z-iHj@K1nhjk88DNU$_C6<-jzcG319Ki7p07_?)o>h{g#n);{JUd`lcGe`MchMkB8A z)cua|hu5)mNi~{EG9@f6gTfW+ZaCdsZeRu9u7K2{Q6J z<1%`49*hJv?F2%{5$)i3QulTCdU#gn1u?H zU(85ib5UAkJqv>wToWr1zj^F#4{A6XSt_>ilvA(_d!yyZcsaFX5O35{jw*v62S;zP z-X4aF1!eocD%H|DUMNUN>!g4I$N!?eQ@4VO5VOW4>eVrVH8I~!*6{%*&q_b_=dFJb zyOmmIS7$#1{*hgRMYO%a;SgqA_e}YLP1hQ`QWw4eZ60tcf3%^nzlx^FB^p>q;)Xbh zJixoc61XxZ7F6;j)VnR>MN(-;v~Q0s!oWLg8$ zCpnlJX(b;`DA7=R^}R^XF=`Ehrn?m^4w4}_4Y-K`_tg2GEDbf1accqD@Z9oe*TE)E z{aax0F8e1(#-Bc;13|rbY##+s-E9!B$;9pJq-KKGdZM>toUYxL82Q04|^EMhyxOy-(QnmK-7~ z&*&T@GQvJ2_9s1(f-dXxpWRBfO&934EwgJwzM`5EtaKiOLC!n8dq19VOCuVy zM}GcJMBcLr=eT220p_{XPeBIXvPd2U|h(xwQ~qJ)O>{^Shd3^ zp36SRA`QVb$_ixakFe`Hz*`(|`?b`aRs7>Y^(%%cj%aUDZ1$Lb4etwyw;|qOk0vcs z*s=!ym?nJS7wmzB{$DYREaA9;8_^D+Uo1XM4Sivdb7O1zA&+uKyA`D9+;W2joao9L zoLlT#U%ttiT^dqop_Zx?Fr)L3Tv~?flmE1NL(=2(HKAr~DZOh6Yd$&go zu4g&tNBEg^Tst?f?l|-%**^49-CGeYZFC}NMB^*8aOB(<5PWp{7lk3Sbq|^CLffPG zu>et2fyMcKZ-#KW0|YWLt&QmM73>PWh^15$swYBDXWgq<^mQcH=v*xP2Aee(jn;Rx6m%ps6oZA5Z z{#29!qoa8jZle~^8~#_Gcd6X}w|+#gKojFmvTxJ7ZubhfMmfSA5;HGr5U1 zG#$=cQW%o=>_a7ni!>pXeEfpw!EA8raoA)`vh$G>7;)gPnlyGDh(dkEw*utrl+8bW z0LsoikXPCaaY`AVA0)1glSU=kX*P2LCq9`oB|EB5ny>MAVN5#jkbveYwZ~SV=mEx6 zMm#?n^psVbTvEUvLz3`{AFX37-JA*X;vs#x?Db-pX)#bYpLp>%u`C9*70Fq&z(L7c zP8^q9zg#OYbgt-j84@_F4~4*)X=_M*kgTjp1n%ynTrLAZk@2()@b~@Fj(w0?;?E~a zWcr2SC!w=-YHoMc{Sc#*V+dZ%?ksbingJ!IGlXV`_PKB8nlcZLMHQ57mWo*^+W&*ff~QZiQMBA z^a)$jxI`)%gOv$QVfR1{VxdR|tvrZ#^DHz)kPCpTFW#aZ#TXYFOinmvvbKF9;ILDJtQhm)6gZ&^WPFp~%G!5HFa+xka(Ua90CC97?mX@2Z>O2vm| zh@zLO4-qx}&NI|CA`}bjEt0N{Uk8`Vz?zUB?3V-VATX)%qp3U`0&g81Y)X)Xqb&E2 zx?=Zs*>j6G2*=_Y<&+TIK>hSXt{zE z$EC&79DU zOgLq|5Olucft7Ju?CctkjBpJ*wP`H8XZ3vf$`DKJZTcEArQOMs7Mo)U@-iJ8OFlIf zW=#Lis9(>5?ruMoGKOFa4?{x8dW--APh!x-=UN9Bw$w62`pojI7%%VB6gjSy)2+_N zbJ6!`lOLD!l$70v6d}Ph+pNF=Rpd?sOE{+a)8aj+pQ=Od>a+Sc5xCKzmNLM*rhv$k z)NG*tv>oVo@E~^K1!8dpLXnbqfivQ4?!Wty>xV+W{Q;%~Lg4Z`QmRqR?hTMH+hSkn z-yZP71tcPAr3P#+;ZHNs-6#aiqv843>c7Rj{MvBp5K35u1^HU&#~pUHfv zj^*Z^$()IiI7I@d_$A$!WYrUp!}(DUB@_%gK@BX>jC~`t~p(u6UrgIQ1+bD}?4! zlN(HJQe_%>F5Zm5Pvl;R*F17Ou&|X$bxTGIxi;Mgsf6I2ef{+NT#%Z#bk#FOD=2=1{ zN+$b^CPH&)TmNahvzie^GmgZBkU0WZ? zgTkcE2{vKftXG7cmSJ$BMwTia(*?BxBCD~~paN`p3J0>##dCY*Ed6NO*B%khprl&$ z2X$E%Hs-ZhjI$1K!t&`qYT$)On*R~`&Y@%XNZ+wb1r7|3F6RMPf;uO46D*_bw*{gH zgv^T$-LPWI5pbF&ly5l^jl6DYx|mJoL5ttFXvN@JavEU_(}maeDxW?4d6PD)&ZvkA zgXLT?C9y-Zoie{Gmg#d%Vua)2Myr@K#}}iGp~e|+6kKk{S%RVUI2{>MwtH@U)2*R4 zFtDW|)xv#?lKWFY9iK z*TzS9lv9R53f(#{cHBoM4wg6hv8qgNMf;Db)RbE)b2g!6!(={~K%j?05+1doWZJ)K zQ_s8>?o^NmBobsjiOS<2^%Aj5-1o2Dt(Mx3+*e%Ff7=~ABwZmAu3Ec4 zO5UC?TV41K|LS%ITOM5s9)8GfX5!J?KVez+=4!V|Dv6K`>c?}sl{yWoD4o(lfH0g2 zHvv~4jtdAn2r3g_kOZ$WKavaL?cX6#kJZ{vR>sdLa(dFnO#&0!AaE3i=u-2i@gHH( zJ?x5}A1V7LZ@#26V$;eU3#7-fQ-AfzXP^MXuZ!r!BN0@hImW7yaR`^ry=dq5wXk?coB$jlc z=65T<=P&hdSNIr+yT(JQ&k- z8v%|56<+Z*^wQQ`V~4`%HCsG0U)vEb_&nL`vL-*7*e=a50t}qQM|-n=3?!;Gy6>RO z^GyFp>~!XQ9YV0br6{}m?Q7n~OdEqqw&Fzl_GMj{vc82VI5+H(l#r^dE-u~X;?WEj z52AzZa{6azQjVr=ZHzYare*I`+h)B;6%%!w)}yOP?DF)F`>OtTLeYjuU9hAZJ%q}7 zk+wXB_3{x5DOw}E4jwzBRbwBuwUC#66@74%zQT8xz0LRKGB0dei@csJ_UeMjuBx7n zz^LC7i*M$gY7(#7P2hXGFQn1};Mg1S4uY34sfi()5TA<#yzAZSvsFyMGh@bc>Zwoy z^pHf@9E6zVWB3~Lht*Sh@}5&Rm+>^{#tiSQhp!7!sn2NMS;R9Zp#Tw?S#*))`dR|| z!83Bw!RP_33%R?RXg5@%qxQbcavqshedjHHt6Ha`C^26o9;RrWJSYDchR=B|bi`?s zwh&>QgF#t=kIEP}D{SNDIW`p=7){L^Q4msvRCR!HJSX3H+6ml`J+7piXqS>Ctd(Xh z+zBcY-2QbI+!Kgn6H@TzEcbj>p<#HABEj)pBbV>Y%JhJ^s-oz$g7M1j;gLzaGvWi< zz&Y21Y<>48h0-P+Tb75$g(mco0-x7*bkF3+Oz-~5?ygOjUzPbgfrKfCTz3wN)T?AC z5M0PVUj$r;f}nz$HzEXFkipo`V zh&$sv&&$$qjV!lCOi^y9(WwPOK2lNn<%|_s+VJbXUB?h+iyadnRFaWCqdkx8eBb0^ zP3X}=-|)Sh=O;g5DfuPEtzI^^cOk%_ep3v}pddTB-ukkV_0Tht0AR@ax?0ow-72>S z7OY1$WoE_ccdZxF4BE35{LlwDTGvLev7eYt8pAcmG@&$Cn^Us%KAiw36pHqp1iF8D zb>usu(-nSstc47A&{~@Ak3*$z_5QS*iCDSwhQaoZksNMAnari{J-X30?RE@Hn!194 z(THfWJ_BB?ij4-2M`BC=z*7xzoDn7GA8|7Dfqm~g6x>kDi{frU{B|#9XDC8eDC(|v zuj?`Tg5s5{Iioqf$Yg-|&t!$VkHgGn$E%UDk#glDf0oQC#m0sBCy6~K#D9H>04kg@P`LXK&x*k%V+4#SRQ~vajR`zmOw_>eKVt=e zKwOLl>c4w1igwNz>EZtw^aBLZbkq?4=X00mxBaB|PulhX5S%(lRbA(kJ)lUnB#2A= z2SF;p1;{}$@HYQg_yhu;PIF%R(ew{0-oI|7W$8s$*1w(}4*yk8BHx*c6o#+C!XEm@X-i|bLX+GN?yOMF2`_3e?K%*9IU zYEXmsY5hhf_eP6gLu&zLPv@%(DJ{Lq_OO9(oWNaCbKZENdP~Xc+w;Z2qQjW@H>pOJ zzOn!8`;AEczmR}z8EeXR@|dtVJag=UqIgfe{%ZAg~LG}FB9KWOK>#4(Qqa(p4CXko`oslb_~zJ6>64*p2~S4yu@}tg2;SK+82anYuR~H&oxx zJj?%+pwZrsPiBC(1>7#pQ)ZT8E=NlCdEN&vQb)(}_IqKtJ3LRoTp@oBAaTzr+8b?` zX8;+@`^%y|O?HX!$~!-!U;ih&;Q@N)y&3kwyzAw*N4*w61T>faaM$WI+mso#Z>0(l z(L}ok=W`2ykL)G{#V?!HU5qF&!%n|f{x5`%p9xkP))dS*^Fi$rkBl>dvmVL+yc$(0 z;$@PaiW+M+0P;b0%vwU`f-;W(3h=lU8(4qul7u5ZQc&j^yCe@I9>>`LQ0fn%fR-~y z;LGojn5=}#jcRM)HrB7hXbW(H-Nb6iss%(RGA*)osYMR0JN7dGnXq1=?IP2qp7h>^ zNRZI+HV|u;uQM~%^H(G|R(JB#pgmMg#=&g>pjSPMo{=9|4HYb&EsO3=m2UTK8evHv z&s*!!MgckF)2R!KW6{0v{g)jEY>X)Tmpj1=#cv)rscGbvlxZDG!YhCPtcZLp!Eogc zW(IKY#^Ys{9`DX>tz+k_*KQNA{s9db&%Yb}mezxyun#6+ZF^8%yJ4Yv?Mw1az+Dji z&*~z^@C;y+^>qH!RTzXDL75o=IxbAYuT7Caq#QP*hfZ31isW{`6J-Wp0XOzahvJ`eAn(czt>^;yyN@dLoy=Aeu}1&C=_UJD^a_O*t3LQ9?) zpm~3s^dDlKX+=QM;@1Ah4d)cDD`(&xVy4wS?@h{Sa5=jVNN~2DMQzwG^HgV6EcN9h z?rAvtbGBuDmiPKln6TcE7cp;|l~>(-PhXm&5Y3ygZfm2k>{Qh$8wz-A$z}@6%Dguj zLs~=hJSGfE&19V^EHwrT0kS=+w{B@b&WD|4(P-;SZM6_%s1<7 z^7x0Mdw@FYlaU+)YM&c5cbrh}gPGefiQsvRejPH;o5cK~UEZ%LiFiWxvv(2$pY6Qa z|EFSa)^)J7e_3e&9CMD=N)7M89MU#u+tJsZ4%*{ufT&mjm;F<~00^|P>F<$vdt+rJov>#@uUD|`7(WX&P=TDM5na8a`QgjQ7_U7AB*3MjyYy4gR zmk5zc3=H5;Os4*|at>`8$Dtv~Qsln+OOLDcO%JF#e8#3OZj_x>CqbuXv7tbrKWMBZ zn|UH1{ZE>;W~ZXhi

yX5T~XTC*g6taL0ZCJKY+wfQ`1X7Rix3+r}NO8BzsHVCbg zQKvlxm8691+kQX+Oc)QE57i2;!~dhLO}U^+nO=8Y8&wK7zZL|GW;p<(Z z2Ur{SugA##qcX3Yt6qBk$qQ-+tY=A=hBk`1VXnqm;q(x}$Vjaaiax6aGd4xAPTmUqZ?7oV1P z2ho3|_rALBj1=voPr>iZ_ei!7;VJ>hH zfFLM-D9+!(@YOWnDoXUB&uA5) z&Z*ira4E^=8#`4yeBV|+4*Nm_?c*sRo$&kMV3fH?ZH2%f-`@DF<&Q@lG$QWfTAHvv zL2~V4MY%sS1Ynf8=KmArZEZB~a*jAejGCq$pjO5KyEx;)@~W7dK^@sy^+ zsnUGF8Y9;h^$G+QRCU%Ae&RUmJ)&KFyT78%1;(7+_wK%QNhrR#$L;_k{x^EVePd<5 zeXX=NSTN8m@(!lO_q{g`AWYEVUe(}0AmUiKEkwyML(ea|?>2X?Hq=(;i~yXd7|3Ja5*m?!>yRfZP>xCm-R@hH!$GY3;=RA9MXMkd`%W140mQ7RvS_zR}qtQ}e$ zY~~2gXAIlgf5(pe#@$a;43o8W&=z26CGgYi;I-x`UB0pG90^K!JV@G*dhBG>^w8*r2g=*R3z!_nrghjF$hRUh0*q zdT+`uW?yqq%rl3kyHi~?@}edJx@mD_?d1Ii&9C)q1jj!VYfZM%;cI5eCYp3)e*dw$ zw_G}lOez?x_J@E~W<{Ms7rUK38mf11O+ioLFmKQKe(omXcx(_|%nlN%kNU zgs}a##rLzk=O#AIPG+d18YnRkw1W%Uex8p&Z)J(v*AFgmW7>7{&uD<1Odvq3tu1oO zVA74oOnCyCA*cekLm2(@MH;m?cJ2lMbu}BD&gIcRNOIue{X)DY`kdmq8BUM@;bo zujHF^l7JJ7?|1@A@f-s`w+xcEH5H;U;59P2e+Ha)v{PYTRQXFXx+J}JT-aoI*V(71 zt74fOLa%StBkod{oce#9xtl|iw*zn3{DyfrDJX)j`K6f_gZKkW|Ep6b{kz~rM;`8s zpmHtIsszxDZ>c=4hL)fowY-am^}77-UJB4Q$?eLHET0nL^N}ReKiDs4yBK-rZRgVWlXtaH7}+f-n@pze%h12 zKEY8f*Uz^P5Z@Bnm}t+MDM4Et8KWS>@M&PxuEnoXJaT(7|2m7=fn?c*&Vt? zk)Wczn$NLshphDl)cj>O%hy%*O-B~nnh^$U+++rulPCI9>0h-l;5=QZoI@7_0Ne*3 z`~%#Hxu%}Hod#9X?+c~3eDiWfPw;@@ANi%TTC zKO-)5gwrwg=vadQ%PC*L(kdPLnrCFbt0npt<_5?|wU^$A46f)) z&2Qdb_-AhsiS#ORZ|oMAu<4)!_LM=mUjV{1tO+75ubabY^9INl68Fjf;04Q&fSJQS z4J2eqo{(u(Frn%D+O=AY>#_&_HLgdJxsXa8+Gn&*Ie1tcq&nwg5cl|ez;a8eHJ)*^ ztbcz>QU~B9(Pc83%YOpSn@|i+PTc_58S+xLjvdjI2(qjAtLOziSGFv-h8#qB1Fuvl zrz9AZUbT~L!1pk)*C^cU!4Cq-5Gfcc*R6>SgLG?49kW9!RRnTU7myH;Tf+uQ8BnBw zRg}bdLKsWV43^m(K4Q;j?lj;XDc=IrMGH2EZN*)H5X=?4lBi&On!-0-{cuWy@ERol6N>il%l;YzO$CyhHwuh^j=9L2 zO@&7c-qy44vKqKwC>=cK^2?_ci0o?F9#j@m{7HVbkxq{c%vR*oF_u&-%(Ppf13e=8 z&F{8lE+A3)drnt>^8p@X+%_bHjlAcpd`jQ?zEE3n>U780R&dOwWLRi-jG7x~TA68S z0?LYbm zOF=<5eE|Sj&Bu~B+7G9Sn0e7PLC8eV*fbNz3cSyw9>%cVL^E== z63oBhk489K`hMUd3fS)y)FU#;^OoJ3nmK1p*`!D{B&{IoaQBnmplFn5!sz6GH?l~W zq=#&K48Om`8{Y-uqyb_hcKhz6tKPVh!C4X;l#)Oh;Ga(%#mcm;VJ5#t^`Z29sEwm- z@>RkWWgI4@LlX_Hm{?LN%G!lOC1!}Db{lMKf;K!OA{D679fIav6=9vb1Z!I?d~d&Z z@1^atCnqU2i*3bV{BxkcOTWPE=$?(oS`9^(Q0)=7lts<3S!lL-@bJwz<4D- z&?d{OUHcM7%JU$tGOfC+yuCLI^p?Zs1PVnPrDA69Sit)DWQp7DZpm;UL7Q1#sE5A6>H zzvSJR=w(EAa@u4{_kfmC3oF2%wJt(>#qI3p50HOG-IXJi%#yj0&Iw(n6tu}|Suh!U zk4k!Wz7T@rIx3EpY?8SKWadO9)BK3xC4kc%MPo$68gq@L zZj#@jZ9_&JfeIy_i;)YIp^*+!@D>s;7X`W*^+wN16fhV(P>UYX2&I z2(JgnmLdli`USafJS(ryzrr^w-lyy`+z22!Z@NfU6^w`P4c+=FeNH%Hnns80kR1JUK=iI2vyZUHAaNY7)l=q|rHLoPF>I&Gx% z(7I!&4VgdB8xr=B4YV=6Z_Ff|#;Z1_WfrDdWP#TqG&aSMidhA~sTlDASoQl?QHaa&yx~ z9h=7(FEfM$t1U@lh3Y+DuJlZIovR6=%8e-(z<7BJFC7vNafZ-b&4r4u7;CsX!lg@# zw*)TPYQ8veU+T+rrGBTW4(ha1)42674cu)$i*0p^{uK-UnKNlA^>pFC%3itFjG$xn zD)EX((I93C%ndRhkvuSB>vf+OIO57Z;=ycC-LudK>Aj13-*?;TtL!1ZGp>3IF4KKP zN~bKt6YCGhW3&9w_x0zu^bceBY+u1KEmYVo`@d=<8BxMThC@VZV~IcCdHCO+RyNv? z|Msq`n-mG7o#VXYE7bUj;4+@c-P^gZ6Bk0siIq>PVRnHf8QpxX_Q(N~op2Bj04{`)icY~UP0r$7hd^^mFUIwI#QH!+Ua5L z65RqFtD#&I*IJ$Q9$pJ|Ju)nl386r=$&Ct}YmssJjMqwfn*f||eRR~{xe+?#7v?Q8 zz+8FsR5{tFrkr0I%uu-Ud7D}b?$SDi9KNn+q4vh&^Cm&A@EndeZ?isrAgGgq!wa#S za7ef-0qaAP68rH13hX0yw$?Okebp&vC{tP>`Z1Fe_v4^G|Lx^sS(+F4hcFuiyn-~C zgOy9JRSsyZZ@19k;H^@Yzr(Rc+#CBepl=uWlE!^Q=1=xuGjQFddW@rOTeQRNGg`2M zBLh;?GWCX_%sQNIz;YAFA?p%Xdabb{MIH*CogM@8*g5WSrU)x^rkJgdHONW2xl=!@QcwDix04w~PI*(kUWSLpHc z??qp3V$FuXk=`a-hU3IQl50*SxJ3@C<6z3tM@;j0Auj#ELKo#J(cRh@D{f29kPipn zfx-_qB+-Ovuj~5k055j$8s$^8G#$7gQ`-1*+fkZxMZv2mgzj;7TyRd?9h$vsJ@9mT z1!C)gZ)PXg5iK8*NU9UvIfmIDyuI)O=em)6Syq+>pHr>1tiae+T^$;jW6c3MVZm8GLiy>vnlhyC zG1{(@@rmWW>yelf89Y_9>n5V(1-6vD>9}^3cghvN?S_iA^1-OAf~! zsn*=t2w1}Km9fnYAQan`e0R@1A@%q=MYI}DsFjlkG7DmdlQxmLI{_UAtBg5Q`OrF%~El6GqUzvjPQzIiZI6sYK{5G`u-PXe-&0& z(6sBqxD(u6gS)%i#38r_cX#*T?(PsYK(L7icXxO9;Ie1lwZ3cZ^`E@^zxr^_aWF=A zJzZUOS2Y_?sCKxlFRDnj@#aYZceS`T;}%=OENRy>f0)C%0GR(Anz4WvJj_jRLaT1b z=H=i?h;D(K?8y!>tc?Bh=-1-x#B^Ya-VP~+!DTjQ@H$LnL6DmZd=$&Lb$6L}Tc<$uFZ;>G*xg&;~wh?13w{m|`YBXU_yQ zD8KNHG1fi)j0r1Xr10XrbazYFMLxE3Di(x6caRdLR+{etYtfnplJQ@Oo;#yrpg=q$ zO=pY94XVk0LLKMYnWa1E=aPifom^r52~|hc7PQqU*ALmGiDJ-id@$-%ngDDT1m84H zge1YxP7LxT&!?7#4{K8{#CPjy>zyNQyu1KR`1_K9S}4%bMzDfq;^RCAiCt9<_KhEG zuwb>{-oQ^gueqF28b(X0WN4FP1zy-i9JbISO@>G-$GBOH@B|baIPB+xv&?B1ICgU* z=fe$dF}K;urp?l7E$5Dz%J4L`Wu>idp_*>0^hFVn@sYNa9k8k~6UQ1bi8TM>q#p)s zmdLBqYfZA$4eptUS=FQ7GciVDrx)nemeeb^kIxq9uJA9E-P{o^jhf@oYVm($Pqn%& zSef9(CS%!ZVCvUx1}UQH|DYEy)2@fx+CQSL8Cdj@a7Q_bWB#+%W<5D8~4rvw4K~GgXOwb)IM^Ml$9pjL6O{Q4Ew6z;fgY*69aV`%l7QmdTU8C5$x{>h?H4 zy(N}bR-UGjO-&RUw`l8U4gi5E$m#V(l!7mxE`BOeqq8%UN&Mxk)BK1XUO-}?rt=SO zJw7;g9f?szN-CZK`_iuJM3~kKheiDv520hb&SR$RLQ#2os2H9gmoAboB6QFdIfE3b>6Ax1aspPB?QNVs%)=8dDneve+~+eGmJDlA4Kz zMzz~H#@gv`>DQA+qmyudIzjgm#g(pq@879H&`v8d`QSGjIxtu)-7dWh#^e3v)>s>C z*7f)HqVig$*bk=Dh9ran=T>T5Ml9(4tgWa+bk^(|W@B`-k_$;KcYPO}HbCmDdj!Ts zE#E{MEB$gcjk(ufP9=n61r1sKePQm|gZmZMggvrDl%~tvVBA8qCkFk$5^ik%zr%hzEA`ajwn!He=gGZUt{&9_zdE?c13v~+`r+sK{jy;ynWQU&JvE5n!*+~iA z|Lvr33z#^3W2)wWz|B4=u`mY-@-?|m{C}oP6Hmx_=HwhTLmQHw#i-0Eze9kMrc+RQ zq69sotjWmnI=^>R+C+gL^F2xjPI0loLo?e9VibKo?5`*0U!G#$k^i54w8c{2KE}{g zRE~de73m4*$vB5tra@8@4S(YJ zy`nKHq3^?giGTT>e+Suedvh293MytgutZSLWpl?-TCvoZz3j2bpd&wTF@{jmbgq~= z!5Oug{`NV)0phy3_EQ1iv$F3jCu+V5|INI~olS_krP>Jx$n4tgWv}$kOpqST4r!qV z#;7*dgDp6)bw;LjSSEIzN6VO?KJhd4qMo$&vxzuR{OKVR*r!B~Avh8H`W*~Y$9pD^ z5-y;9mWm(l2RL(Qmeh2Q{caNmBsl0Wp`YXnFQKdq zgUPlBmiL5<*n%A0E`WySX^K?&=QQ=&iTG_jy2=ycX0)>ZextgPm-ryNuLU9sQqX14*#F1L`&AQJSFE`JA5|OkGfPMAP zeU@0FEn#OynBbm8rZ+EH$-!9;JP@af?XjWubZDUZw#sZ;c8;$qZMEilU&6v`S+>yW zPu@i#VBK&TWqzx3fr-CRy5!hTp`!Hol7t1XSsdHj=|H^I90fCBxCkrzi#uD_rrlIX zURqn>Ds^O$`%095qnXNoUW_n8)aVD(VkP{vk075g#(Ks2y2ymsABnsRQv7hiQl^ah zYDFN-#&&FxWr@uqarI-RXuEKJMT2~bxU7p^j2pF88pDFbBsuL|eW)2jhzJ3MgDZp> zScXHI%sSC!(8VCrQ!CRqlt{YHtUetq2E75P5Kg?I^BB!Hl*WmA?StSx+?%A6i(*G7 z2&{(Ms5J_SgF;q>j^3FLs^PKAK!Fi0Qnj}i=BGY$cc?WbK2vMMpkER zwqSxsJB^K1g&m{E1M@G_S-V_kt-r%rKc^J6|NBHsj2% zn_?B~^78Yx39fkSZD8!`Q)`~(_GZHQ$=LZ^&aMO&mD;)HV;NZ0y#$i1V^wvul*z{B zt={%0j|pg}U$5f_sc~ z9*s5XnefWm*@foI&TYhB%W-qrbShUM7Wy!|R=$77sDr-AKe3)}ksh-qyPE4rS-Hw8 z!VXR@+F0gv%KWWOUBDo!uN5z?63;%G&H(#1m1>de#)ZEt+(0>kEV!2q+SnEOD|E``h-)@I!lqAIX#(UGiuzXjGSb!bIB95qe$!8kV?{=n zO7%*(1kYL0_JoQxmbidzdXKB-^>I7QF%x2oFQ(M%!zFnAhT4*QR2|k!GS@TEWS+=^ zAPjsZ`eN#0Q56jfq52u&wtc}nBechqwURt%z7$()ePl+gigV6D*f{1695E;fk z$usBE?`A@twNyb?X-{GnztvOI=$Z7&r8kPK@!Ju~rv`!S$B7(2QozR=_Os}GwH2b) z{fPxfn(B}FTvvruFIwP6A${OwAD)dVQFfXd)aDu?isy7!Da8su=w5h47=u$}D(;aj z)yBnOK^sS?S45bU1$G;#Bt6G)Z9D44*I=jTq_=*i#w<>sddIG&^2CNTt<=dWx|VTW z1Po*h@@&X3soXU1Y_VdRGMRL=w6*fsU-mSa6aeHzg(2;98&$+cm>X4s``UNG}^o>>?bgP8~ws==kU6wos~?odCh}W32AY^^!@PQS6p%0h`Xb=pk03M z+_m2`k%>IYVeoB=O|E5{81pLE&OPh}A~dUDwkCGIc+(WLV5HId!=3c)wAVG<*zohH zv}c9c4C>99X_RxyiZ~Dh_7KQtLr^=OF>0nYCi90kB7Mj96k6(vqkl4r$?+{w%8W>B)T}K*v#61fR!hG#04>Shc-RM?2|6^_@V?>1ki$lxEDG| zArWmm+ZquTaC?(Zqwm)oQr0Dfg*o;cq0479b;qMtjoHOW(S?)M6~g-%5~Ow170M0k zn>1nH^fl>Qtj@1jr;cuF2gh~b-M824dn;>qY#vn zpU_~(M9i^^scZ6?oXie_)hC6`;<~)~!Z%*Y&vwnHKygOfg)#0QTk>BB-JcSBF0{M< z7(Ta8kioq1_=iB!@ASC3Zn$PsY?`F?2HC|xx@Em<+*q>pzokp@`nXh)`iDu_yCJsp zS>y}Nr|kbaDORwhtz!Im4T-!sGyj@*54pvsl>w&Vp>2Wpd&qAGkR9@iVqr3Mr%^FW z`jIgiGMfQFFdABD1iI00?Ri_g-5R`rJIzzHn%Ee?^y<8a?(ogC$e2Fc?C+q{-K652 zkxe(DwXuz1ujpr))ArdG4|oIe%cSt%t*1fwZ1EA-0_P?|LM<%N=kMeN`i!&ju>6-% zPvmU$jpY#6!qJHD-%~_Cvu=h%AphIQ{u6W}a$w2JQ&0B=Y1+rd{V~JL(dfSo{{5bx zM&qoL+dZ!Tp5j;M+)IRoh50XoD*|#ZXmrNe(dZi?Zo%W>`6cVvcF%ts?!!UfdNWLN zdV@~>J>_0uJxGD_1?j&G+b^(Xkg3H7+dV&d>g_@{k3McS%ky4}yWb9iCsz8*we4#W znOd*=5Sg=-_6?byZ05F$qCYeqU)HuhE{&)7&TteO!_u>-O2bP)x^*XAp1Y~e)bX}Q z^11I7@P4+%WXoIL>k#nj6Y`WB@R9#-i9B6(ziyD6W*v-%zfXE}x9Ayme!MJ2e_Tfh zr(J4T!%L-Jx*#0oK4xETWCd=0exNX&nU689Q!zRGrEnd~kf)p!xU0V0_^rW|QmPi< zx~emzXYpF+cR>*F`5I8|mT-V=FZg;t74R{p6M5cTZe%rfS;L!ZUWaAdlvA`*xhti= z=dQ+XvFUuaYhc4|V42s~GI-3;(h4BRy^YcJF-{Bb&S3v+tV=(fbw+S6)|P9xz7S0i z*mh1{)MM*I_c3krTACZXTa0(8pk2FA3g8o_$4E7No4ql7UtPMZ5i8W)658SaxAuKg zE5`LkDG##PjA$9kY2+UN;^3n!29Ck|76bhs8uLL}OK%x{c-ii^1+Q+ttEI8T8BXyr z1i?+%>3V-B_>H+<}U56d>jexXt*qiK<@%G!yax2TE4h0G3-1nx&K1N z?{7F=_W|#Jz6d{$D4Em|-R9t|JEmt3TnRn;IIaZdzn?qNSq-bsVRrq!z_9li0(PAr zL`c6!2;bhYO~$%+^0FwumkYhOWpBPMrUQ2uE*}FUCJ~G;ebaqX;#jjp4!a%$h9{R= zH_hrC7bxO<#n~P7@a?wVi97E&>jDPo4fkB~KfkLJdoNejdHl)NJ9O5hRfl)^xG{8J z|5S;;_`+7+urr&JcGf*`1G;kH%5t#nkAVm9(9M1xw8$_Sb=F%t-!~9-C#|kOOoVM! z>TdvsLS6RmXM$Hv{liduDQb!}L(k(DLIE{rm#RzEm2V|qh2JHay(CX=qr?sW_P}20 zGHI%Aza$Y72G$;7B$I;OQrC7o`jOm^DET#q2dC?{PNcL%GVtC0mR@k05WKnz+^~1b z=HGm_#{f<_fV8)DuD?}OwB(_M)%)i57lzb?nUHU-`_S9xcia)%5LCuwCKBTCuuf+FF9$jY{tplEZ z&rfv{&v;XO`#bTT@+pGnc`aM7t4nKcLt};q_OI)(B@fYtIcm5?*Ux)QTqOF%jqAHi zcCNwOu}^0SiK1IS5`iX@v)76ypC_v6u}lD$N{#yU7%jQi-Ng8hmTSIt%7anc4Cicf z#C;fR|Lc%shpyK=Jv4~2&e+JL+*)tO>@!a3j;=LHGj|`ku|BFYi$~p!ouB-M5#nZP zvqo(YhLgmZ2g-QKl0KJrhN1a)D^Hh?9an?E3pAh<^I7Yae|!TKuWg~hIWzwy0>6H4 z*~=*C`<6Zo3G;?fx2-PJ0nVJ)`Ne^4K`#@+j%C;LKCo z`bI=gcCu|DjFRY5=1zZCV-wyqzME@vIQ4rK7^|aou}zQ1=ny1eyM$q)`v<!I0Q3PW_)<3KU1?mcg)A z0V|ajJan4!>5Xn<@+VJRZu|m-c5*D&o*pe1zT<@(w7YV|p^|+Z9<$K{W^~#xw$lP16agn{n zXKXwch8((vd@KmSJw&0J_P=5!v0P=~P7#F~@LVYIPWx?duKjYGaMXnwj>}rwE(~@(8t^C5{$s2!PKPPRJbgv&LDB|T$AX4n?S&c&BT^{@ zN$o(kDd2kF!fVR?$35uXT~HmLs^ZiO?rn`{zbU~+IwOd`sZR#%?0%s5;!+v?Dtcvn zY!#Frd=4`dpr{Cn`^M$=J}V)pzj$3OzHg>-^7%@_Ohg1Sz&X(o0ZdOi=cf6<8aZTF zxL%T%>mgJydS(AP-AxS)46{P)eSt6EgCX1#z*zWpecYo!OuOwUeX)GBO>BHjsQ5V*Ng5Q8E0=`A|vDwq>nj)42%$K zmOT3Jnc*ijUKNTsyR3r363c?!Eq29~ROadt?TR7O2&E?Mwvw#(J1m%ec8=deTU&b8 z`9q3%7$9C~`$oxUu=kYc5-bQ1a)1y){DI%Gdp>d6b#!rgj-;8r%(G$6V3OnOw_lw9 z14c0y>}THNGKzo7R_XP*c;08uQRnc+9|JEaxK92r!m)o2(?Tx-R(5VB3$@q1(SVdI zsXiB-N_brV$E3`n+7qxO4rDpmWxR(2l)x@R>2M4W9WwcUz zrM&;wZs>PABHS@R+(NI5evE8Io34@|!N{%jG>5GJ8*LO`H^+OafID}q33gAWKg?v< z+ZwEit@!vV^vbtIFF535N?3m|0#i<*g|w+-@~^}AXX3!cn?8XP28*Hj%#4Fiy2Q{d zAOYP-rZQ92vb8_bZ^6dEBi?6gYsS|&ok7|Y*vdfa{pT=i%Ks7(VkAQFEph98^O2M1 zG}a;P8u5&fNm?gGCc=c-31a*}bF;?honZ6r-a-gSy|7Kb6?Ro2_Hic9$eVmyMyVtx ze1@JN8zpNq{aTW&7|#5>;K>B z%XqJI3^{K*JT>ssqGCdUY7JDvfeq>(^?QyBQR{y%ADN<6<1x(YhIBB`Y*b2AEwpcA znnFp5v?SC8{6lrX3`{XLWO}Hdr#u(QzN}Kx4^~FxDs~v&&i={ahby?9w`NNO`{u)f zFMJ6PI|B%1d=f90^z+b!uyxW3FN}#})9iFqX=N5? zuupp(!g==%R``CVopl&O({8H0fz|@q5FeGeotp`y4!rqP%pBg8v~@=n@YC5v8qJj# zl}yJ9V%L;`kGMlW!w#LaMI0Dz= zGzTlImYzx4uRfk95^)s-H)PV;inkZz{m+vPs@j(PNZ{ru9$29I@Ko^wwjAemUGIyq zlci%i-3F-L;qPe4%vb9}N8{O8F%cwnKU7_f?Fb-{%&r8UE2l~nLnt}DP!91L!KjDjhC9Lj{xX?ctSqG{%c|XUP?Z zuQP8z{lMy}k#|aq;g#*$)euoSvf`(TpC>{cS*>GvSC^cPz7NgOe4XzOiS%WByNiaL946@i)w}O*kcc1H)}*Y@=|Mg~&cd39z*l zG>B#xlKT;K)1TEjDY3@YvPMHl+DRsIeru;YumbGD8$6FdnKj{?k*Uyj7W@g5wZT{K z*dB|dCWp7$YQ;vKVMRsFe6`6AZEM5oUYw|}HL|CC5t+mCNrgP>o2p12iRW%DV8CMV zs~H=!c2~h)1qf6Svc!nbI5R&qa1lSsA!)67&zRmUVC@{0d0`hwp#u33goWizpMqHZ zd71>|4Oye`5lu58?#(-(G{$$UTUFBs4ZqDvh_4tQ&LZBQf+;WqH(3SWrSgk46q-}% z&hk6uAtfeox}MBT=r9OuqF^+LllSbY8;GTOU#sX`O6Km9kfgBIobrYlyP&3ovmKgm zZ(xc0`+aP}vju0^(%Mc1wdeqaiKVoK5nZvyyM*2-t6c@;9Wi?eDbgvOFBwfYGze68 zh_PHYm|+>XqSgy4;dZSYGgovQ z(#GPvEJPKAjIgj813`8K_hq}*+bKzy8DOma1M5g@nJO@(EcB-qg?7Krc)_6W%_EK2 zdZ4bl!T`m{>_=e~c#T(|JrU-#2(3kN<4i4?opYLb#2)I$PdElKoUAEWw3(aK2eyH6Hm&g%t!E1EE&Y=WMO`~d26@Bu;}A??VC~R99sJMM;I+uK z@ChClp4#so7F@z_6hbF=e)U7UhDH2 zGl|OI=;@lS2JUmEE=B{#;JPT?i_aO(FpMr;mlOOA4>j#K1^P$Yz$l_-`xGq)5M5Xl z{2}-tJIw5+zq+yl{IgTGx7+R5M9p(4uilvYZJKG2T$n6U9Xua3w0sA>1mD2}IA8~r znn`!wVBlU$K^z7bz+v;|vS#QQx^@lQzwb03NCPjRF5wI}@SV1i0X{_lP9!E&+#Ge0 zLCrUBcqFmBvAii}UT$>A3LhN%=O5#CC{uFYXS5JY6oud-xZ?U@ZCzgHQQ&NI-$HuV zIm3)XRiHjfF@FQt&%=Yke4?0I-ZL2bz9nU=TTQtnjuNJ24Oe?=S!`YB$+6dSQ; z)h^_+TU^hvt&vHP8JZHyZ9M5G<0QD;ViIhsTQ982F*J=hg#e9Tv80rbWJ^ z^W1`QTOWHMCRn3Iz@NHD*%L6Jg0D#Pec+CGoZTE5h4ip0viFi6Tb$9{qW{L( zR?7cYTJBZHke^7)KWCm_xTwo)GU_G$o(mbNCv*#_2lcaHyF?jeDZFu+cX-qPz*A61 zgrwM+?LFW&f+lTX4S|D<0-EkutJo?i#tyBUjAM3DyGz zg4R^NO_RpOd91L;5_Udp;BzHDwfx;Q2?Tgs(h*+k=^uus_OW} zaLO|Kj})4hME!=Jo|TBD&yXGE)Q0b$TZj@#mG{$r~7{z&x9=9pxbVn&a~)51W4(btPtx z?X_w{ru^hbiymAYIP{r%pB%h;<1@9%1CMMybdI7sqY1lnTlJ$+B|{hkKuru~gWyj| zI*WwfxoGQwkdTSAR+#niFh{KP4i!=aj9R@E92bus7LZIduU{* zqV;2OFngGKBOG7Uip2jlZOnLmVu*w(fcev)yk0IKHV?B5;qZ-j_Zdez5BVAK+<2SZ`lGS*5y?9x4Nf^0x&V2IuN;$+nE4?7 zwK`G>%dmJsWgC0BTA2%km=JrNuuY-j7V!rp71t(!gfr`Tp}=F_F#%#d4zNiZK{@*2 z-d17|td{I-6^VGPVBWe5-sRLzsuDzy0r*h@d@SZ&Kv?%=mzu2`yS)np_pT!Qli)Q6 zZA!KV>q#t4oTR^jKq542wzJt$$)?DpRr#`A3<#{K$x+)!TT~Mdm(>>?u|SV1k*o&7+=>K87Uh}!wKsk)Q10lc(Rs&~u%cc!SDsa510l}0hX+r1- zC#E>bvnPL@n>Ai4Z~BEin8g@wCAy(|qLzbgrz8;-jPYKt^x!7~qNoGL$aUf4`Gk>X zUY1;m`*3&Z4x^0-BtPdi((6pqjO4?QIl^8FbutuHYkXv-5LtHw4e9JK{LN z_PXd6aClys}-Bn3uFmAe|+fEyF9K!!8T>NohEV*>tsB&m+0`L&k97;{nomfBz) zI<{b7$OP^ZL2O@BS=P6SM3167{gNbe08dTJGm^jwV2qG-(g1biInIW!U+gc2i%HuM zT>eJ%JA5h82)38F5bE`G>9f(eW*Zcf`Kk)ZJ;v8<^Id)em)Zw`L&twRn6z#MVxq4t z8qCIOPHU9*3NWf(GV9--HTg*w;oqOJ^H!)!2(3Uz#8In@?rMSPdW_vf+R9jWyS>W(p4?lVwtHfxUt9Cm?Bbkat|d zJc(RW+feumlB|Yhb0DPjtKceF&c(}l@^`-Lx-pR%MhqgXwz6@LMg5F%zo^SN zTu(Nr9`^7OEa89_-E}FCgjQR;I4UzUnwOwvO1if-uucV2n)Was43mH2X1!01Kl;Tb zF1&RjOB;W0h`Y0~#&{U{@hjcS6emD zd%nKq4{rU56{F_S`B<}aZ_Ei|20sAVm@4-@%|&qnGKMKngMt9uRpQ=}z$E&$`{{Hs zo`qm~Y|$`rSnpk&+R8N}!C7q&cTl)fR%widRo|~_pa>Pi??H5D&+IgQn?_vgw~eI# zm&160eE$WxXQq@6k7wvc4C~V)$x;z7j|Cvfabv`>mjmY6hVY#uDhq25pS3#YNPADB zvxCSfzcpkJ2TVWX1dJ)GtGW$IH#G;@%XJ&Vn3FpO_8{<^#1yELQ(9NbHB#b_%kMiP z`0sYkNY2Pwk!m;@G2QjhLf>$y1rotXB*;Cno4YwC_@WAVcoRn_;iraxI9d3x{^J*zzhQ`m%?12>6R zPPn$k62>kl#}Q@>h=n59eV-f~d$(;~tX~))@VzzMXn|Ay_aEj+!^yvBcOxX}dP8m^ zA&pWT!H(@HDz+RxAvylsfpr$fY5X*uyAil(z@5Vw&@FvyXY<_N!IybKH_!wl9vU>frfs83hfa($3hES zvq4GLn!H)0{00^lS3WnbzV9j=EQAeXs$1dWHMXYdX+;G`M$t~Fz2Z$>_XVA_@711DkenTx{w#b#WTonz^L~V?Uz@^DnTc!^(H6nJ!?4gG{ z5YV}{faMxKLPQpnBNZjU7bxxOm&{fJVSzu37q8prD4jmO*V#cG6FD-;gQ7eCL`iu8 zm%2}!B9#O$8n&(_Fw1<0g(MvUoov6K);m+ZcQq{7+SaTovU}%&#)9c4D{zDjwHk+B zR_=c*Qhl)FsjYiTLZ;SW3L{_Hvd zR^+&v=q&>q*v`iPI9jawZ^%>yIard7jxLyzJMhxpafq>uJH$s}Ydk26#hg*!7t6Mb z`>YAI0yBbnV^4pKroJ5<&bWOKB?sl@|1yL*tRR`)Omc>UGza;c72`SdYu}Ug|E)Os z#ZzsBuAb*?iwP2LvZ^aQ{|>F_ZbJpf^m)4@P{$W+{=c9Z{G50cdQmNu{d?2O zkEp2s-eb8;O^cj2UPAO@Jq{X2IB2-O`?iZAg!W_oB(>Z-ER-u4TCdtkQB8G@hX&XJ- zc0&>at&qdOkA2dci9j+@5FzA<2$WXR|Y>o2E7*feB9B9cFFt)%Vag zh57!4?qFg?n?@OF^Ucgu6e_M6yxiaiV$!z5tPRB$X#>^i%5!^o6<-+nal#W8KkXP*<)A1;3*Eyn%&0V>r1XCY7BNA02v!}1w{ z>5xQ5k2M@r8GeYAvS#v_V3G zB@5tB`lSk(D1gHZ#K3CE9>Mj0H?ScpXeoEW6_uTY=mcjoRv7M(*8wDePLH9g2w#-v z-37&a2opNRQX?UD9hqR%k%micT;fQsOs!g?GkJpg9M(ay^(4jr!Py&HSk){wbaN0#t;%DKpV?OorDmeJa z4%XA)_FKM>Ym*?$k5@s-9!o<9($KiiWl~?7<<@C(vCMFC4$}&x~pMA&pB+bbckL-iO&2>@}bqKL7ElNYp%MWr6606&=~Vu zm-84@e_br6%bBOL68}LfLY3cdPN_*qxk?}&C3M5dGGxlsc)LG5Ks=vUO7A)Lf0RfY z-c)i&Hakp>9iTEV0M8VLg^0uVznvgSB@Ik3wc&*!>{z>RUKD8f96u?D89!?}Uwm71 zG3@hPWY?gUOBJZu?ijNR**wv%>=g{;COSU9yO)2?P$BwK)4uA12(;hIB3HZn%Q&$@ zO90ZIg{CDiKT3pe|8vI6aXg&GG#DsluRQL6mRE>waGIxW>6J!n{2FeXp!00Wf&eT4 z`9AVsc2X)V>%nMf-{C|YyC_?5^J$xCBq8rkX|ZYA_k?4u6k+sxe=)RxJT?l`?y4J2 z7my$w5+d(#tcJO2S4;(!oaQ232B<2zc#K!|(n>?bKpUsSfLIPH)nMDD7IiY>w~^00K$ zW4%G&oQ!}FokW6v1TEFma@PzW+&uXO5-JLxSL|`c^j?GrzJ{6%@~Q;(fGt8Xql2l# zkWw^2CdtqxgdF*Dty^sbp$84pxCDvFcAzzaLc1(>pJ$nEB~85uPe`m3$4O|+hTc%w zh$E802}i>oe@`onI|m2Qvi{Z_;*MG{B@lV)&ojK8^&S}Ek~B;R&TY;)r9M~8qLU`$ zrrK~|NEFWzJZ|ev668m9e@z^myIC3SxaLL)hQDDb?P6ltB1gNC(dX?RC+j!Z2gm(; zU||kYrkF?os)->xjhYq@Qv~~C#jgUP7dl8}SSV#W_H=dUDgg%uC)cKwO{uS3H@Q$B z?ATuJwbdTPzbpM95no~*{B=vT1Jua|BfAOfJ;UBW3I78|46eSI;XvzyWG#w4AQfGm zpC=?X>QqMwJ)7}qZ?Ub}5o*F3H>XW1w*l(N5jj3AzKGH8CzxIM!P5?zY#Ox%#Sb(} z1}loH*y2kl(If+&(?uHp$)x@a@Bk}Wp1n^}8>u*eRnIgM8woK`PA_TEQdOIqNix7! zMM*kH=Hui`5&FGof+;CRNRpxYSd!;-J#pq5jPOz^P#(-;j(3ujj?I_DC2GbL)UuK- zkz6iYZ2NEke6=!gQ&jxjti)XN7D*5q!ZIWHc^@x*xt#R}X2b0-G+?+$T3F*!0m3zn zw2C?`56&Avk*4#u7_Wz#s&vJ?Wo-W$5zjTIP^?dKP9yZN`w7rJu38&c1ldv+LzNVBH}L$uTv9{{ z|52RVGp=p>S2zb+)n(c-h;HcZba{vM5Jpc_8+-uj=esC;SBBzvZB_^DnYLWp%yp445;x}=FYLX&Zw%XN4umbNlGp;M2|1Na z$;@-R1x7I&L790`2Xq#UlPt88rYFyNTmr`Eg{-#JY3*A)d~D5myI>~ZNy(@JI%y3Hh#GY$025uuRKWzuS-Uhh!63kbDTl-`$z> z@6N*$KYShT>*1WGc~KIv3QURxhyZx~_MDzI&Nnrt633~ss#e${31V*z|2rIJDrx*? zzB6wsndpTcy1?Y>9{<}4J8lrAK}Ck#g%VKIs0fnSbSO)A0jy z8NW(em}huW!o16jT^*)wfS>LRRG+?D|3SF73uziOMQH}A9#f;>wkG4}eNbFHf-4)W z2_}rWRs^NCCylAulK1hD0phFnw%|$(4&bIC{cS0({!h3o7>KE3+6e3=nS#WlL1NqJ z34}j+&X|Jx-3qBBRBy~9B9OsZn3E8|#_l*UT?&N!r=8`fM>zz#;L~ZAZ~qFnG;A$A zRq=vOgzUS#5mHRx_-s7mdFe#yj+5{wtD|Dpv^|-~1A*jhdX^DzFto@;)2NjVzd$m1 zA;mXQ&qRB19acgJmEZXMkTFR`Bz1?3z|%3!=Kg3T&IN(5orUGiftZe*tRCcOGr)}2 zVOl37+=Z{Z*{7ng0c@me1f2^dH=U%$d~IU>GJyQGSSDj$LK{~cS&9}3ol8SP8t$LP z{MDl!j*U8TFA5-v?SF7PP~lFCK0~qiD!hl;N8DkuOVDAHF~jnN%pmRC5G$6>IX+Y0EjIrMIAA*(!c6Gh^DbX%KD1AbaQrKv^r8 zZVLzR%RGiQHg5&mx(-eh*1$T9=3&~df&OFqWQ`4Sw*oI*lFud zg_i2DZl_I`zE)oPniD)h1wj{cJEBmb@+|2-lyiB24KtfeHT#GzhewH!sQPVnig_O2 z|BLK*gVS~mKhNlxTJ>@ANZKIYaaGK_lj>* z;|{i0m^&xU=jfzrM8MMrz`3XhIHL~AEF<$hYkQ}&+2V6Q(n{=pYmP(4?eGSE_!^o! zUJgK{-C8By;CGFLlDiLEy1);8akeur#_u;YMgCpEHLr^Ym(EMbMdv4nb-63N2?LdP zmV{WGe|>_(`|@?XW(g*p5aw<>=4=}1mlI4Y^ya=nY{;I4%^4LHS%#ms|F0m7-Lcck z2Id2Qcac?xvKz?lpYsz;*Y9E!G-^zll+VrKDrUs=e9NqpG3n7^ly`D|qT~oXqQX*y z8f^=i!A_bN5PO_8K-}UHajk5ZKwjuq+2l9Irlb-Uvw;FJ1lTMDS4k| z(fVs*ATMkHR(Q1CEW-D**u-ctQ?;zAvGMtr|7tR-VVuYlcCc=xMY?kOMUH~XgUHr0 z)J$oa*D*JB-a(nPkbzra63!`}&jt|GY})>;zdixFFRPtj2E)>It)AbFXYrV+poImG zJ-bUyUD}}4Ji)2WiZJ7gdR$rvWYuoZ1B|!Bs{5uGb&>)l$^$wXOdnx>3{b+H+lrcW zNl&$@#>(JVp`P>#W<%>9!II7CCdUIA(Z~*R^K=u4sX1qNx`S$$_LgzrR);uzv}smP6QfX%M$PCpVFrst>8R z!J1ynQ1CcQVXG{i`D+vP#z1TElFM?C^_*)QytR|ky>OT7AqJHHOHI{#w>$T0sT$J8 zis2o^Bg~i#0{3=UlQWk~8ia8YDN{=}XcYz3ta4!_*qHy_C_1GQe!7p?l6#^xD;got z-uYt?eB0btzT8^K60o-mjHU32=>XBZ;#dRj!&CnY;uW<{ zP0h#KV?aWD!^;mpMIb5_b5ga+o9VSzmMwJaWcW1u!md@O#I0k$MwpP-nZzC0%)#X5 zmaepO!0p=1F$yb)_%GI!vo#wX8qs~rsU&c0<-q%L@ipIf^lfnO(*55nFt2A6_x?9L z_uuc%gc)I7T_F6=@5<-vM7!?N=hmmsO~A&bun>)KUHAfW)@{7M>#Bl%^AN$-{bHHF zp1trtme(2Rc8^bp`(KCFa1hh7O0E%507>P4Z;xkYCS<$Zr{#LJncEtAM}8Armxi$Fa3X+0kJQxDs%YvU+!Orm%1v~R7>U0|5g6C z-V5uWHhk#rU-^A@qunAhcPPIrYIZJyK+im!?t3i!jMEB{BA(E&4fTts(cZab?OWeP@IRAfs zPsB9yX@Yyd>qf(6yXsk3c}nNc{D5|(jMXg=yoQ=;DD+Xq^p6Jt(Z;~7mqqyW_Is>L zmu}dqfM@zInubCSY$W&o>lj~V2f79A{a`zNQ3RNVwra8Nh!DEsPjs#BH(rX&L5u{*8A$SVhCTZ)-%%{v)SNZ z75ifwh-ZuB=s?Jk>G>UxOn{(KkC8l_?i__%8fcuQtaJI2-j z9}Jvn!%vWix#POXA^$peuj{&W>*L|^49_C6OPKG%mEQR<(}Hov!#mw&^8LW;=-u4^ zRrupZN%(bTsyLSIr#}cgpS+q~e+MDzwK%Lcr%SG0z0f%L{a2bt@7@YT0nb%;i>qb| zdk)Tf7)o!Cpp}Y}EpYO7@-Hp3%h#>Y1w`LSjo1jq*SP^vd=x zt_PTjJ{Riza(~ey$0)n{SLPTFOEjz^Z#kmVXF1_tN#Zne+og30e7*@U`JrhGoBP=) z@+M!<-pZLNn&<5scx^^Ay{w^2;Fpv2==qkLztKW*=<9(zMbK~7_(|<{&SvQ{QJ0PR zf|upO@7hgMv#CRwG9~87e>ACrr0knTs8tmjq32DLoQIgwPt5_Z`eT)I-lvQmzN{Ah zt~zASZ88?TOlUP!dX^1QQ;u! ze0}Tf&;xmez^_f&0}G<-xdsEDg1ANIe3sZ2&$mrXiqd)FEiv7(Fnukx8ihAgXnDrS49&8V-;0ak%k53N`tUlmBEj_Q^q;u>3OC)u(d>0wl;e8~ zVGqJ`{hggx;lWQ)yiZ>^$ycyWLlEj9wKaS%bWA(tm?`X_%GT-8y>Jox5bNMeKgDC+ z%=e$=cW3yd+VGN`|Hg6ke!@8g`h=IRN72Gi>K=tu|3hl)^OpMV+r(Ro!5pc5Nh-U) zX!e>-&i^P%?!Dt&D1}8qWg6x-uK_}HCOn`qw7`B*njR2q~TUIZw^vF#%Q5j`48ntP#c-r z{QVV*fvxf%z*vGy=SEObkKFqOFHo=82!S{fe)gv&FU! zo;2X%`kbS7=klL(Rj}T&FcA*?27%Y@qmxT3&-hFHhkiqo zuGvL&!@9KZZp`&f!VJ;Vuc53aMeySvl@6l2-%pp? z!Gjk9wwL3VDSBI`jRM!Dg2ZQgGLIDUvrL%#*fTr{ccw_H_`AD6d^1OI3f|-O+>4Nao2Ks^zTU=;k zpuO(Xqy1s+6U6ihbt{$qc>IS=tzg*Ydyqe;9kqpg5y$ z-4+eOH8=!!cMa~4AVC^vym5DzAOQjd_u%gC?$)@wYjF3|`Oe<=$F5toPw|uLD(GHo z_FU^7&zKUQZI&lG%fQMSBq_4Fd(6>tBXRrre{G?;m=4^S3%_#yQM1%Ahc8gXv&pl0 zkhF|XigHfenHJBT@d?iliMxii6?72om9;vi6>a6#B$PE!rmYs7 zbi0O)g-VjzC~*_S3~^s0==KC>G%==m7*6^Bp+~4x8srAnH1KZtOt5}_PoQttptjQu zhI}s#0_|!9KNn;)s#K*5(;+Q*=B6mmK!zN*)%mYOh^O98@0W!Z8+qzI?{|bRV+ZnG z3%@{>W{-i;rHz* zmiA@8u`TjBPuFi|#jTC|xp7crSW~U8dGiPINLy~zt)s!phjuB~?bKU4v%!J}iKP;i ztdZ1I`XoWUHwKEq0#Fc8X)j(uNAE@O62)P}e`aO#6hh2!w!e<(_+F`Hu1$;DA>!}$ zZ9Qv$PCTJV*SD%%U4I{{vhiOh`*lxx9q{7sf+{gUI>$XSdOBi?k)-x3v6M)cTP9W0YIRJtU7I zbBHPOH$O^`qczIpA=Z)1^%sed5< zCk{D?^`^~5?40R>;KsEF{t25eFc<_%Uh4rKF)Xy5lAK+|7YZ|m4#Q-Mohz!|^f#Ub zI6}8KFTF{mFT&L7Ens!?^YU&QRtmvjltZMIjRCW(`wd>j|57;{WEW#2aehD1$adsbGS6e>}Kv3`TrB><~;$ z;)qic6eDFSnhHYPqs!Ye(QA_VeDP2yykpQOa+y`gZ=^hgEYlw_!*A@2>5*1DiYENR zO}a6SPwR^c{SRVZJY**k?rWBy*@WZ^*wA3UTupuJBTLB}YaEL^Y>mznKTiLFXU*J> z;0GyS3Xw7j&);FBhaJbJ6Z*YyW5BcMo zxD+^!w*CDplkRk$CKjp^9QiA{C&lF>$^?s&ZKjK+ZEgs>Tg3Rv(YpH5twF1#D`ps= zm!)hXRI&oV7y7{|;<@Zh%@s7`<|KN)&;glyE0J1k2CPtCSKLzae!GCMp?e%ajj9O2 zq~C6u%huZ2$mx0)3!UpH>*&HaRg?u(?oPW+gX!%La^P5H%-*XMYFWwliHtT#Yoqq9 z!aVyQ{_p#*cgF)dPch#$mGeY(l7Q{gtR`2?VGP|qJ){FIW%e`%{~?~Z^U#LJ%uJ}# z+w*JZ4*C~SPY|;BdyjWlCkb6VhDr(lKk9w=qf5#ZRt33@KaMZa_cV&tE^U zLgYfkp5hl(Eht(@i*!l!EJw$h?fWhx55`-15aK+7m6QL>lnBA8)>8Km6e{s4fS%qk z9hE?NN&yWDx=XKCGUrW3-QPFNqYL6O^S32zq@0Sq?cScQos@#t&vfc731<=kuyBR*+qBEKvUskR= z!8eKw=9G1wAMbBX&)SlD@=lKw0ZKs%SG>AUpE>}#76uSMQu-_ki)3syCU&|qHpA#; z4_>G4R$d&-_|vFJCVPO@5@7iOfW~aB*%EOF^caP!O8YHxL6#mrCrxFFIa!1@fhOE5 zHyx#o+fXW?EY6hqHfFZ)TQt@tvxO#!XzkO6U$mdP==pTNfIJLq5|RrzZR5$+Gq4M9 zl4zy{GpAf^vwJ~T45`lv!huDcCyvN+?2^h(lpfq3L(as`&Oq$FJsv4A?+-DBI5YWg zp-)Q_KI9WQ1%MIrILM>%_*8Do>>!jZQpC~*MYk4Hbk|!C6`Th07#;|a%}WKk{1?d? zV1p;H7Bfhgtp_<;_|Ut$T~~YuIB`ge^7ops_U)B*g0_kr#MM*9tg2;Ek#l0PqSdmEs9iT5IKti!1+s@_Kl^-u5|Y@4K!=7_2UF}6Wg*{rZ1aQajrv| zN`wJA)(6lKn>jnw@lzIYcN<|038c8B`N#mkBA`+&nz z6PE`)=aPY815?XPboL(MS64hVqb!2Yh^FH*IYFp%OvIk)XP3bbu)NJnsWee7~y z8f>83iC}VaJN2M=lUheo{Ac{UKU9XOmx!H*?}9pJ*q(9{G`($Iy>vDX;E7>Sv2z(1d5GVV#+7nfykZiKG%FYoSr}QeiGB# za{nQ?TPG~kqNs|-g)-hZNs41^;&~ujc=DY$N*`m%UT#l2@@oV()lx{C8u!bE{q+m# zZEV2p@8>CffU@DeFnXjLwS zTL#z+k$Dkg=HvSut*&(~6&DNyVNjoB80shI$dOT?-CcEHZ9e^J=c+WJ6z#^X`WYn2Ep(~UD3P)5%rEws38YtK>RVQ zuY;?1Zyu?})u+$5jPFmHnQ||`Rh{-zMAXz+KCNGl-(#QzB$z@n%56{cbato2 ziw$CS%Vkj~{b4ugH~wg0?f~LbdznzN!Z3Rq4}qUwH;ItT;I3k>`h=_C!^JV2`NXg> zXXhiauw~`x13p4iIAbR9Z(eVIiue=x;aBzf*LbpMB=JwX1PGg^cN|Ur@m6^m_u{`w zI_GT84%@<9*h0w~>vr)k1h!+%7~PQbP=e#Kzc0_i??4rEb-~?!t%S-ja;5YVASa!i z*x}_KlN6SX*MEtX2tXO15*oVJd%#MFeMO-=!om5AlDY%-C&b0p(yO%C2}4-;wcvI% zsz(rGzaYdxvbVQa)Ch-}Cc!2|vfLJ~jr<9BfDoWDLfikt!U@AnZ+VW9uIdB}xeEiPK$iTEbX;peub zcgTh+c9}r0ulf+JS2i7=Z()6D(WM=PQ>01@#~P+9lUWfhrCjX4BHkZ&$Y#-{%3Z5)G7u5>Wg!yK%L5#`#JtJGV2 z97s6E{>&`&-z4~%Fl^mL;RJ=)zzO@eN#bLMNeF#@3(Zco9(T`(6#fiLk z-)Tb3E*%lz8K3BGW??q)tq__b=&faTjS6eIe>5G2euBRlhp`KsbfM{iJ2aT$*ee7VFXP2UE=48e-GEr>`I;nas#3R7MhdqAw^yPW@t7`xVE`& zs<|2~h-PIVfDGVMh#rCjKW)#!N?aKRr6prfRumoAi*XPv0d@XEQ~Cu)RCxwN4tsi- zFQfs+lNau=Up3l~Mb|)*Vn$I^h*j^?WUE4~Dfb4)H=0;D&FX9>0a|8=hLf7H|IpqP zrc@mCxSVPa0L2Ku=((cFeqMH} ze$ro44i03b(5TccJ@G-%w7b(z$Gln4M z(9;Nzs7Njtnr0Z3T16NW`qV-*s(RP=v0-gZl;RdgT8$!ucxDmso8`a z@|MtWh1I1eYi_)7V8ZK(+RbOqV4+1M!-Se3LC$JM$W(3+djXmMAk0&!?p{%Vi6GJAkNw^R$?QMtq;;t1axZV%v z)~pr9Sts@zU=*bO3T%p}`C%Fe9h{jyz+rc~A4B|NcCuDq_QDR|XRKgRxry}z4bSY6 zHeH?qMrmhbSVM^l@;0Ee2!6d zMcibF*;fyA*`LW?#9j0p9{sd0Grcrs0J%CU-^7cewAamrVny8z-f-Y!s;1o2o|ef% zixG6q2*9HF*|x);!PK~7@V{pS|MfbN3_^TGMQOE^idFRxCWKc;k_tzb(r|{v}BuQSCn4t;)(g% z>lCv;oGh&w`TOXv=V3A<>m$C%!r0FNP@YE%BxMwoMeVpFyO8TQ-3<&I@ddNxZ%X9C zQ`_&>2P?uH-RRd;zun1-r*E0UkHV<3?j~9?{1j{W(A#YegMKQXD&w|o^IR2M#8Fe& zg>>uc5SDF%+g#S0=!qWwTM>@G(945K5z2Z{xnA2o466d>b5}KMESn_t=MQ?oF)LRK zh>H|*q>r4#`GtKvRL^qp6)YFXg?wLb_os{1k>MvkT;TR_ttq%?ijDY_V(m85pARXr zVl0{g13PNf`_vIOAG^MFb3gZ^!--5Y17Q>cG@0VXUkGD=grwS~&|=GN*C`8vC?E-& z@0m(6%UkQg45Lcz3nWBG;X3v1W)!uMnkYGRi3I4OYh@j%ru1$q*cCTfn=6{BAQ&m3 z#4avaf&s=7c7U}DBEYUyqm6%e@!Kws zHLw1HFl-A&Lr@b;KPNDTh14+ZDK9vW!+Ai8DSz;CzC|i{8mPp{@1L6GpqCcNm%&nkP*NS#QSB>?MQUUzLGhj8+%s`zrG~JPe)c8!WmKYLL9r&5uc* z4X()nSb-l*%V`^>9KN$my@Nk-l#%_Q);NUwd<>BAx%qzel1VWvB%>uO4~TuknDk%w zcIOvy7*&q8p+Of`!S-w37?&nd`=QECE_xm!Yxs=z4*R#)iAwu$)Hj${@Av#7pU3{T zE?3`g<1rERF%8yU%UG?O1!Fxz!#WDEeBo5@&r_mCGbQ0c97TQC-lsgEyIfQv%d28*OD=v>Z z4njNV$yeqf<{~xP#IbCoLR!QK0v9)m!2HWF(gdSZe}aw$|#-m7`) zt_s?Bfu8E40Q?e~tWp6eL2YSAcvaY&@seDOhFI|(wv|!;Kc2fSAp%%tOL%YF%!3n& ztdYfp-ATb3ubxLfi=>LhlFP5alLDy>Dsr6M~)gKH3k71wk=GKob;@bP_~ z&bi5fFH=gnxBZ+2R8H6OpR(3H-qZ4=TRHXpqEP79mR!f=^9A_l*wU`qlD_}S}9C>s{#S| zh5FdQq|XGN$Yv~R-0{0MLp6>$faMd+0l9Spm24zWND4xXo+=}K$5j4Hq;P1&;<*6^ zk3vfLe1Qfsi_P?6)kr$D57@{paA?GTDL+gHtXgto{`O&MDg?oZd8`K&5ZthE;T#=@yS3XdafCF51lWgmB{`99c@HMC z4weD`yL7>VQDZ#*a|AzO0oB6)kor&Q;*j&8m$TTZbTqAbpVWee<29u_c@cHA#*Q@P zxO@-eq5?b-n=ALkv_Ni1)_aIS;dCsuYLPtyhAbot`iHT73s@yVH;MF?6s_q@%(>CS z<2q#8rfc<+xs%lZzWp>BdbC=ctdNXb-PnBlS?G+IBb&N`;&C{WO1(o#0{<*GUPHWbH(*!F=X82E5%Rxq)sA${wQyu; zOVS*GcO=|As`~qSktnK;u>h1iO0nX{FGQqN{RUuw5DCl!7Mwx!HTNwjNEq} z{*+Mg>mSYhODFMZ8pYLB$2)XORuwUmmIm#|=?^|k_xug826W{K*%onkSDc(~Qy z@T^aR7yBv0&;DJ2gCfK?+TtM%nkn?vm}i&{EbV4rn2bu*pTl}YKi5)8DNM8`Ily;syStlb-d^)NQKV`8qE-Dyk_W- zH=r;IOY9c4t>sECb~hSYGelO(IaD9RB2MDUiKC)+ z{wmSLe!+21sUNwz(_BiQIXRftHqO>;_u}*6E~~3rytD?1^;)B{EqT8Yp`WCu0tbd= z9|GcFMJS6o97zHdqP^{nygSI$5|UI$QiKePat9iIOHFt~7Gkg5+FntgO4CK;_rbp! zoSSM}t_8G~iwusF{CcNu`O;l)r%NR^M(Hv$jx1Ud9!yBEF zliN6GhfVMg@AtJY3w=NVsxNj%TQCe$n2LC!jo$9XXt#VLs4aWc$h9*1Zl_s%ZMozm zsc-{B!oSd2nx)3d6gW+rcPW;?>^T~Cx2;M&?oQJfKHOL~D!9=TnenlLG>|blh63}E z zO;&JW>KZAr*@i+)udp$6BB?yuJT3NB%NX+@(NUtKQ!7elLd0YC`NqN$E!rJ z(@kwsha5h2(%kh%G7T9v_)7Qz%XIO<#)mrzj6e#rFRaA3SpFeEf4d$%IOi}fj#g<+ zy1q&p|7OHVIk&i;_WEHs$w9)KaVnQbQ!SrS)d9Y@aq?kc7yJcVyk+t}lY-Ii5XKHk z0J}stPnKIEOCay|8W55=RKlbGffn5BXHWL2GBN(=NDE`>%yd)oe~z3U$mVg7OTzzD zC?q*0!}5^g6Ug--WMqQhZS_06C-0ktF+8Cq(Dct|FOi@s|MiqSV)KiFrb`YwVlA~c z5X&BamYeH~{9r*<(9|$hHb&Dyaay+(q&m&6YyJ+GJC23K!S(8oL*?*1aZC#9p&|3S^|&A&a6L8H*Ku`3S?8PcXely; zp{Plo%POWlmSkigiAZEBNRX5OBsvyZS(0Z&V>n@8m#$&}SgewyLACTPEu}Y+Fs1Df zGjxKR&B)qNSJ)`a;TrYy@)EKqV*S5fi#n2?U_&h2+cfFlGgClfOGfgPCEjwres4aD z9Jpc^`ikX&{OyDhjgyv^s6aX4hs+lGN4hqSnK|fGc!<##jIVzXs7qodr&`vU)!1iY z?>YI|&mjxCy_N~&(L4MhmrYx5#P)A4wMD#@%GI`|XU;}&QRH# zhHzU38AxL%mgK?qgY>*&l)4+^7564NQ$4CR+vJ9;Y*i%MKeqq5kS3!k$u|a5m;GuR z*%o1AM`5HMyJoE^|30EblVN>aRQdjcMkp8n=kozwVK5+qHBqz_#&nGP zmMouX>}PMh!dM@BTY?%Ax+beVY)j$?q_J?~XNWjC&ER%THKbjKW-Q17J}EgN{V0+@ z5o%)_OwzKp#4-l=s?3)=m(^Hy#fFq4@&Wl5Q}qLov(mVifGNG|YhQQHWnE-M{%Rpq z`=i0QtJLK@wUJ4n4)Tlz8^Vn=Rff*?l`}H3S|XP6jx0Q^2NPN`G6&N+-pK`(fgkRY zBL)w9lCGN?Hfc_%BkO|>lg7&PRrOi4ld4KArA z86J;Alfb@TuZ1fs8o9+y?UFJC(16pL{E^iI39-88fc{<7?c(B7PjY@IC?qEX7ac3Pi?uF3Z4{7~6m*XaONC;B74!JMG{xvk zVg6j2_cP&%AKoM_I3h+1&63z|?`|#M8V7Qbyu)SLO`x1!7>&EVYnuUaVO!ro9;~2s z!f0CGG{>}3ac|qm81r#c&&7rRa&cqOHuEGZSxQLxTO>w>%r}UA=89t#-Sq=jN9M<_ zgL&-G{djvzP5d6X>Z@ERF=SANNx=OR8)8``_Z;&&ZIB7va zb{cs^DJ%sI!P|*xfSegOHMSFMbKhf$56_aFuC_I(?Q(CROgg2zIblgypOt%-9OlTn zXesK$5A!SLHL^06heb(mM6n@T2uC8q5kp37?H~WaiD#9QdmH&)z{8r}*ift_kQp1s z`YEk~Tvh3XNki+nsSGiztSV-)Dton7G?^26{fbPysoPNP;?t#~>b_1AEwbEn7Z&BT zvm$57tOFyRbmZ*|QxDcM1d@h` zxoWbp`NLM+A5~16#bJ&fIee8&lH#--IhKNDtBZy+b`DO|OQVu)!)0Rd#sO8}(eUc! zm>Sj4N@VUBm)CTThp8|1_T!s9awh_FsL;U5j+A_&0bD^X-PAIHnmFU#fnwYJaD|g? zK+nNno}mO>XUGH|Ba?C*kb2J@q@b$y&P)AoLUUo(*+oDp$SVhNxici8U zmYOD2)F9{d*i_&!091eKW)C+$XrXDG9A1(a3GXlJ==8`9t$oMdHvE-jXe7!bkjgU-+19+WQ^oxao!TrN!1+8k>25Sk~rQm zd+zXTdiPrSR4`%o>;Vv9n*b9xsL7h7fXAlvHrBJ3!O;QKJ=wLzBQA=pujdhj ztAy~SrUATDSn|F8fP*+cF0K}2L#ggmRCq03 zY`iD)?!snhcd9L1EK0?{#c5WeF35743qU?gK)!^IjBY^&=Ifs3y{ciHd?lQH>?JPO zVOyA2!jlxlAreT{0&{#z{on*?-s0f3M`NS%J|-Olqh&^?6IRA3YN{g=d!4U&6*S$L zzZYVw%dG$B{znNgGKS4PN>EVo?>hVfGGJ%+?U?vIy8#ARQ+Vi2LKJI`PPxE>YZW|n zhEvO6Bdibx`zDZ4`p%eGFp4Gp(~E!#`jW<%b1AQuZ&+27)vBZgdBHlM<+aSw4cUB^ zDcwghV2qIJm^0>jWf0iQBhbBVTIh)c?a`8|kl~!Dz!_{8srKhUwRe}>wQ8lT0>@c` zM%WIRGI|>r-|C^6sH4)gsQ8U{*5xW=C)BiVpTjPkz6F_x{G|#YTN!LSknWcf#uOU# z$@#C8Y$|(e4ctQg9yoaO1Ec{7&htd{Uth0FwbRWp-d9b^<50kXYWA?_@*3NRPK#QD zD!*hG+9CGX!E$;`H8cZ4I@$!@l2%h7${Z7QtmWl3QZkcUv2F@tFxHP#x)Cwg+$6|$ z04;_E|97Xs3z6mMnY1JdwiSi1_VAXWSy&gI+~S)H|s5Q`sno% zE{eMuwI~*!x=O=N8`n+O)1o&{d=Sp3WWW9Kn{U4TvY+Mse+ArD2VK-w$qlOSV%kmj ztR^X*YoZ$beWt-iUFL*N5Zy3p*+d7S(5cz%2lfLiZ-EOb4KP-W4+K&>LGE7 zF-0pC)$9@o+sh^&%$NBk*LhlwRz_n?;|VA5Z+F1IADcATq%y;0h_q9$;+;LuX@zuvw7p+pb!vUf^-eLa7_OhSHZ;dj~tK%nul z&wpG!EA+JjBOy#arw*051DL%U zm4CNMsj0i5Po(s+VEN;|-T8jz=BFi_@L~7BOyt?4PWLNhe4h;?qaf&bRa&2G_ldcD z{|7Ql+eOc>2CkBM$q5Mhz7Ij#1>CBI@xCle;l0}Ura^@0+N2(aVE%*j=d_KN3X6GJ zO~^rcuZ%T0T!g;l2O({D5GCiflId}&kECgPY{=@rP|0}-vNR$cRR%A|cduz&mL zboTagVD|n%Yc^(4HLfFcH{pBNl=*gJ#y*b2YDKO4G?O_lay?d?Na-7XtYy19cbBul z1J0{Ryy75~X(@#&e5lhM;s4!P2epXCKlG;-VYJp6*=4eYOKvSDiDuZG*88CKAL?aO zhu=(7Be)Ph0#M*DwVMJm-fN~2aE6OJCchN`e43}I=A8B%7xDqAdHlbgpEusgAF9$v z!0~n>+-d0UQ3MDG5DV7xBdhn(`_oU7#b5==$S&7)#~Z=pVh=nBk>0(~bcb5$oM83k z&fyzmeip0W1LbEC$mEQJ#$h*3=;c+z%2wdD0Pjd7-u&t#%YD-xX`>%RpNe*U55fF@ zH`;kUx8k|3W_>{YM(VdI#=E*_df7VhO1i4(8JD(p3{mzL$R|F1eg_S{e!g8S=zsQOYE#*EJll-sv_XXH3zEKvy`Ni8*3L<|M~77<@-~A-#~n6} zS&UYrZ!Tnn_8~lUcS5D>Dbe2=o%Ye76m7>iq^0J9)#XE&-QEA8VDFXw*0}ocQ|JIb zxX}ZBAQ=I&(oAYdH;&I8cXag5LwJ`A2N{J=HV@_-kFOxqW)C6o^mxH%nG@}-;z|;_ zXfT39{RM(qZ_M&e&#nG(;3zrDt?Sz5m1gtGmwRY#=dg`k z$i2!xue)NV{=TE;<8;z*J6muwoXT`gEg|3Fd!Yi*b$*TdIEm6RENp%@|Ad%_a;zpo zsaB~YJ>TFUj{W~zm0zBt4<_8`Gug$36NBJf8be>QBx+2|Hb_~(|cDE`8 zIL>(VG|qBNAuAPP)}_@ujM8WDyZi;oYHL2cIOwP63g|(YlKZvusr*XuisExy^G5^` zzQ_I6^Ja+8{#*Y)sNMQdR{=fabxvru+}25E8@O<7R^hS+d|`3xFZF?t+vRo%9O!0{ z?`@u`JP3hMYS-}{wl?dF*_<2y?(n;AL}bK0nY`5&q2m`dRi=tn0d z&a%;bIf};Z!$F}tMA|>jjwm|VDYU8TGZ-mJjv9kStSwgRZ^xvK9meJ*2*SHtW|=+} z0F%&D-%`QoIHFTeCmrcX)H9Z&mX`!qUkK1T%399te--e}JKVICfD5BrD<{@T@D+NrRmw>{T}*e9qfxe1F!dw;#^EzO98l@Bp?08g&@;Vk^IVe!GyN zdcF8rxT|)wP2|q?aV7g_d&_f#69X#%@btdedfjPL=;*ik-s5&|njiK-iExTaQvSO< zEab^x9#(z;7p8dJbk;N-xe68%HAueB!^Dy&VLH#^{le#D(d%?hVBTeI!D+3LXrflH z^4X<*zIoiG;+jw7L~HN@a3XY0|3gWHyK(V4dzR@nSN`k6{%{WE)}j9Ulbuey6`H** zup~G==2~*cUB|FL{MRecV{UFT?wk$tt-)j7)o$(jG@!7&vxfZmdj{QtqKvP_1QLgv z?`cI4jvNP>!pfuS?cE53{rq$8`^`WQl6{Dhs*h;jFw5|`^IN?eH+4vqu?{P&L6vT^ znL73|^A>4LQGvb+22ShLYPVjg$63;Vo3yuRfvpBUQvV@eKp9GY6?_=|mf^S&oE3Xs&|v2`ufw=3>@)9woT9(Zn&lik zD%!^QaWgTAZ1JD*VQAIMokKE$vR}0$!tj01@7wN+a({zbn6qTs+vXTZYZw!`)wQ$N zZ&B^$4O$P{7k^b)6DBedcJ8~h1{(_>?W$$8pCbS5c-Zm~30E6x$7|mO!9<+C*T;3A zuw_Et_P=CO$j`qP4$iCZUcbK07f*fhWv|;dEG@kYmy9>k$1U8E{?QAGuHkyF?m=>p z^HiF2qa%?}Mn`0hl^y%bcy{lOziNTdtFzZUCLf2PYYb*(hG?$q+m$->NfFxa0uXF3 z_mB>|``+x6;S5>YynD~=g0ax4Jsp_C2dGIeW`6ptXMcdsx}q=i{h9eG;*u$cPc-}F zbR{zgaUc3Xt@Ae^WZJZ9@u*zqZCS?xY0qxs6>S-`ur_MgIC&VGoMOEq^xQn*J$`M3 z@RieE0P_X5Z)c^{*exZs05w4WF8t38u^U`yq*LXh!$EJSa~{|Q?!&LPuB8vug%R$$ z!AChLBhJIFZi~xUx{0)e)jP2OU!wTb?tTHJLXSu0h87jhNK7!7=$pC4T4y=V$rtB9 zRZ7*TA@WT3`G$$c!Ggaxt_@Sv0dW9&c2+!Bxk2&XfEE3%Lq&drvkCRguurq)nV`=QnkId<0Se`N@F=?5b>WUT9c?S;XCjqzStvPzlx4n+-alsLkS}3+l zPH8{G=nW3bN>gEiZ}ySb-^P8k9@v_h!ra&uMOS+0BO(T{+22OKxlgOLODb35M*#pj z4?^&wuVE7CrRo$D^5#i^VvI+FjD*PSp<0e-v3oE@F-`@WM%f9nep_I#5M%Mr;=zVw zwJqGjG5NQ6RfpEbXaFFW1jJHF(~kH3VetsuT*Z9TsZ1R}^jpK#ld}f~e;^2T;$D3Q z6|FrSMxC5^!EaY(&^g%JbJXzn2ZrF_yA`4l8l$jLVT(!3^Hnc>L2Izl&f$0Ct+_F* zKhl|xjh7Khfdi@hzhq6ydU|-zvN{^7?doQ)kearIY4$_cZ2O`{iC}f^`P)~uYB>-n z`NrZX7~9^6PL0;33is<%@ZHYG)lk21T*hcZ z8S5+Qi7&N9F@qym=hU_wBwVpp7`(c7!p6_(_!1-W50HPKJQ5-F%i&Z2?kuac!RDYVvWnXV~h6NKRp8BXT+KCN~S-ry|U< zZ363K1LM~)IzBaGZHPl_J|afc8tJ-?ZdY9IJmbDaMB``5rwfAw;P`WqCI*c~9K5~$ zdN>rtK>K>NnWhLSKKcg z4FLCkwor%ZgH3u{@&-oNyoOFwwr3Ed9+u4Z5^EvNQ<981u`X^_7IWX#LVq81NGnbI zwX$@h7D=&u{EjBnj?((SPy|psM|+_F)?9rj$A{D2vTcUJRropGiF<&k?Gopp45O4j*e1xf{(>|k5(1ya8c__HZ6#m&2XHiacd2SWM$A5lKOAtsx zS0Nax?~VdvYFOB13OG4%BN3@NgO#GK*gm32!R3?oX;2q))!_K;O(_aU_`kEC|F{`f zBTGXg!{0tvI|BOJjafR!bzFJ%_Y;@ha?k6cgMVb z!UkGte&ipuPciRI~OQh z7;p!Zjn<~d`fW>XQu%IdMx8gf1c1V;T+8p=8BYwIn8w;VB7?Ey&6ziQ0&6AFn=w)WwCZ-q~u8o~4pkk^u{m97U zG+ovwVPs3m(HuNBl9QgV9JgLe_X0`+8dh9>Oq`}`OE_e)y>d&#om>tjo5@?PVAuUn*U#GvXKtE5 zOkIP;h@>BhRyoqkV=BglU$6pGoi#;@{%Qi7CY1wJ5=aalqactENCzWs2)}xT2r9}% zX{J@lh`1c9__fB?3>#A74Os+ZDCCiUuNr5uHrRE_nd-yGwV%2wQ%a@`3qe0${4FVE zK_f@i>76cq7s&8BxBQ8__GMnq3Rlh!#T`M;SRq z>E{Qf_=MnD8gvj()sky4KEK`{%4+7kMt3b!%cgVp124&UU(`}6pfoEQZHW)wUc5L> zd#$X?vm6M!^MYqBz)IIC3B%l!cyiknkOzQNK;9>I9e(;%6_0T3zpDI5Y8YC+Jx;3* zWL1`N>tJW>imEwWElj~`o=6M{Qu%L-!a)sp)#Idi1EmuDm11fNj=(*1yIy$n-!T0o zh@ALyO~kzFe(P{EjC?p)gMiL2(ZMc=Ft{s6jtRPm0$;nwou;I?Y}Z$hkjOM9+Z1;f^)6sHCqaFQ34jQY$e!XNKi7moek_kVyR6T}d(3yA3*KVcB&HQ2{ z`w&ns)_cO5+PWpF3)SM*J?KV#@BkR(zXF7Feft6~H^E&5@VgR{@I7DU0!mYPSl$=t zDnZo!q@*LmjTBFO=2UHTI59@0($d8Wo}=>U>L*`;#lj+M>G*|e%3kQp&K5Px45T^^yNcrCd|!Dz@oY`(!mD(h&(a1G8#h2}rhPXd^;(0PdcSQ{C=qaNdV+mjEv| zi=AFE{+f-vT}gU3M5Y1X?4B>l43Q(zu?z<8h`BdmiNLmE(X!fdY~$6kAt&fl`K$6Wxk-9GM7Bi`3B zpX39B3>?5#t!psU!*Ixr?Y6q>oYOEN+;p{Rc_|IS5n4K5o-csgc0m#lnVn1&=S_}B z8BFfMgkmvCqPxDTVILRSW8*O7;-O&5msL#@KhCEdODsZYZ6LN|a7GnIjjgQZPH}hptnof(k z-JOM>tcovXphyR=#EAFndL)+I{jZZ!^yzV~|_!0(vTex9JsHmEIO-zF^(cN3W@inkGz^Pj6pfuA`r-t| zfFcvV-_nFvKvit3+rZNO%8P_@$mRF#$GXDAu`N4y^QxkxUVn3PqazRM@2ZBbuhRtB z<$Y%zM_-pCAfUbx=a;|P#!AVx=Zbwb7-m8pI^VVq43oF%t6p`sm_z~1vc4^RRr#)Z zWBkpRy!|8qyEsSEsFQKLTbUxYCGZ5qzEbzM1t;J{ZFWmDavi1RkT;iV;*&-&l2%)#NdyUT)MTvYKTj?^$c74eTBl(hp26nf5Bo<>Y< zJH=(H?o24ZY7@Vw{I?iLdw6h$0EnBypMaeH0vzBGY zsaa!E)l4$6p&p(t$C>U!JdI^b-7mvlf%#^JXno2=^U>xqN)(`ZtX*r}swl8BQKY1J z!Iam^MWOUro?>gOvh~c(11VH0kae222TUV9WQtkj!nd<`IaVP)e` zTBA%>0YA?z!+~5*!jt!yB(L%7VeR^4!udMnc77muH1n-fupJ<^@jcAS0+a5L|KL-2 zxP$ht+CoxgPwljEPZeD)iS2BMAft+KnI}_h3&X^SH651~WUx|u8sLaw+OUrlt{Pa_zFW|r|%;=Z@!`oYh#nq+V z+6ln|!4d+&-JReN+&w^WcX!v|1b3I3+MvzP^9&x6l4VE~;S7 zsdxCVuy`=t%XP44(tRHfJ)0i1KZj77;&r>uK6Q36aBEDAD&^dZFbh9XuUybJG%)YBgi;zVw?Vd5 z5VvVo%}+eX^G(P04Y0uraagBw4fmB#ROBaV(B$JtRDCjh-vit9zEQ-WDh~IvXMibn zdIS$R8HKX&5*2z__w}uh zTKUHpRhoebGtnQvx|GZfd;-NH*M1Z9I%I46e%N}HqA6o2i*FzG*ATa%hI{>1YSENy z&uVc5KFR>(woH}BZgsZbdIYWZEWt|uIxu?J`U7`>3?_|R~3DXyVb70K1))B zRi0gSxA7w*%Jb5Pxc2UT($7Gz6M!84-XWQjdRg^bP6Q4ZonjpN8TaBhRABKXDN&|V zKQ1$EkSbU!9$R`n-#cUKk9OE4sfpXr9j!uP76>{UAN3}?TM0)@Yxp4TStaVR@!su? zHAQz+p`zAXcoXp$8%4ZLe05M1^sTBq(tcZQpuNTke#c%fGXWyMsRsFWVyxU0*d530 zK&CoQ*m_Ym)q$v-XB0D|>R>f=;HI3Tv9&ReUS&g6qk#GzqZVHIk9c?zwbBVCpLA*& zE~+vX{-l`mS7_AI>hH|1p-&II1Z{wDuXlqRFG558SkdffZs?4ll4qx)6sS%mAzfpi zG7@=n83#VIiTRr_P1WgpEG8a) z`=~WZ8yD}u4EwE*o;L(g7 z95A>;*D?YxwIQfY+_qY?i>OdbSSoxfRAaueF1Uy8)L*2jhhr?{_RSN@2%r!7b??wr z%f)Td%|DnRFdiaA%M*rmv%N!f?#agO6H`876m|~_V^m3IVhFduDBW>ZTDNJv4;~hF zsZh0JvhG}Gz%|C%mN?kr%iInKQ-Ui%?R!;w3!Z2WtZy;}?2w-$W*uHs6k zTWOoz&sR;MsiNO;%u0Q{QWZAMYL|NZO=sXy6GkeEe)n2ji0p0+#!DGE;FJ z-{{I-ckm-!8oKL=&}x0>$VE^ z15VC&5@pBcIfj_vYVig1UrBRp36m&v3c4j)Wb!DybSSvg)BUjs9;+Yi@wVCQFlk_T zZ!wIdb`Yv2H9BlG!hXY&9ndoHsY zYNS@x^lC5W;x;eJqWbzFdiV^V1ebs1(D9C-sTC^zjD*X^aR(K?0&z4v^*Xwie?*U^ z8Z&C`Al6msr&Yk0R2F|X3=6&sNxwiZGWZHRLtC&`7Z^O}eN-yE@j%Dj3i&pskKk(f zIdT*ZbN16%&MWNMp!Hsc;KdiB?c)2}+%edthju$k|J;uq&^C}r4eVJM25)BNPT}b* z#X+om*bkiE4Vi?kZw*fVs83k3;~7ExIb)CPiK)az%<`@^v(UGF(%Pha{q`*jqeAx2 zezhIMlImu~zBRd);EixK$gpI1k(*a;7qH=f=IxT1uy9gIV)Vdw#e0x`TxR)BBr`$l zYP9CPQ}0q`6FRT>2@g%xqSDfkq^9aPx|=eya_wCB4uJD9D-IL-tCdnB-L&xT<=SHe zw(sVIeMxogjc3ql7;MmMNr9nEi8`bn-%k^5#K8@H`*}|b5o?ysPUXY3sed!D*6J^s zcg#2e_0qVemqAHHyXvK4Bk~zI&R_EVB}iNYO?lN=4VEjy?XW!>arnMa8x`a~miqU` z$<1fq(`KbADUNl9TwDO@Gg-AX_w4agv9Bq7Tr$^XalqUZBu(b9vPgpDyzPp7;&?_z zLSO64h9cUg3&|70!qy18ouD##8rZx)F(At6ySBtp5~oFi`Fg>b`}Rfhv$|kc%Cl_r zftE1-Qo9vSqak9WBl}z)8Z3w0I$(3du)_+Uzk=1clMhpQ0|!~Jb>(?C-j=*46> zhV{0|m>X{h9}4cV^%n@${G-B=!5_5LtvT8s{AnNAJrm8ES1*K3EM`m1t4(URVQW^* z`OU!~}tQoTlk!{&TklRDW!Qr0Q1 z3od+_a^4MTbEhKQ5;jsdey6$^W0?XjO{E#V7>gamDSzZ`;4%Hxb!ogfA@y{~4x-cc z%+>a=y`Car0*rEdJ};uY>~tV4zn8LFBATa%;tH<4TM?QP)`_alT)$=(wGqmw#cZy!Y=U23Ql%V3 z7mE%j{?gJ=isI`}sfcP;q;*sxo*^zLFRRZD;x-;I7q+uW($s0JRdTut{zW(WoocBv zC!|?{X+NtDy@!#MOA5Z89Lr-r-9mxmGfgJ)aa`84PdEHH-DNy^Grl{mBttQ~Bf2Ru z875CSN~3Ye_Q*3M8a+W(I^)a$2XUdRo{CQJ@0=<4nDK?3{Yt>b`>Jtk??&}KCWaw6 z4nalp?6WXHF~;rJbdC8*eBK~;;+1-$ozExO|B9knzr#d>qq@l(3t8vI_)KHMgg&y= z9PG(r#lE|BLGGs96pfj=KGOWfg(k^O**(spvzRNatH!rL?@8EKLyKfT&03fB7&h36 zB5siLm|9(lo+x|Owo^@QK1s0d)N_({!fa1ZGMfpiM)h+m>l^l5uY=H~e$iK@ZzgAH z(xh;MOf2_JQqXHmRVI%PgWXn*+nwEq%4{YV#=MmoZIS{h-LItzei=6J<8f%+Eah1? z)??L5@l6Gh@A^LcUN)&2ccd>s5c2gBIZCWS3{_H>We9NAOO9Dq2Or^9jK05?ZkI|o zQWds{fSA3Hu;x>?E!%LEOOOn*6WA!ON{GMZHEgs!_JfBMs_X;Vy5asfvuxMp$CdG4 zc-6m|ntYesq7B3~`bb2fm5F3I>%29zBW3BpcPX*v3er-RF!Hx$HpPcm>>`{kyWKu^}7JhFLNM6pzKRq&` zE@Pg~!{F68m9)4uZ5k-WElVxm>2v-1vRt28MhUU2O7&dIcfuX%*OEyTJ0#PH(Phi9Vzod}VKZmnDW;8xq$Y`nZu^>~E1fLNDR zAwbl+)BIS_JZO!DTe~``zO#PfmvgC14(oKLC3B+J+nKQ};Wg8yztUGz#nV=-kcGWP z1z%m&I#$YQXwUZU?U-GkZwFy(q3SE07EN2ZiTI(uV&4u&XwxJc zeV3KAOz$=Q(fQ-r>a-8%M~>jb;(jaT(o|r`Iz^QkW&+VL5i7h~zw+k;r&}{*Ft>#6 zmtfgd@=cNw=L@Qppypufl(Zte6JP%s>%1TDigsC=yXK$aPC-RI+pNLQ*|;Gl*@mzK zy%tMK%MZ0ZE&`lZ4z-+%H(|y<+At2S6yDh2(mH4}O2if{N9tr{z7bU9Tgje#cX*-I z4D@<98fd0>OnKm-XmA8qO5m&|?2kD4+iEqL;pcoi&Pf=>Pc*{3KG`Ef!$Q6B_3hx- zC1gbX1pn@T|7h(5Y^41IP56{|Q$8yH&KK@)Uk?jaj{yz)nj2_9L&NTQSyZ72jsCy? z`al17IkN9x%R>LlwrQ+TqSOD^)%t22Hbe|4bSDH@}9^yzZ_KrCPs>@j(;rjHJX;HfhdW{yGM(ZsJ!;_xYOP(Ly-~*BXYk%@N!v`^^{}n zyp^Ex1dyMl7Kz!9NjT438(O102kD@hEx44b-#zRP0Qu+rbme1uuU35bFr@Q*Up-V| z>YnV~Um0AJyj;fl0K^T~m!=M;tw$TPO?ra0lDVV!_6{YdbsQ%`55ut?+-D#=>5kxf zAT(JAq%<~h3pBN__HoCUjyA_j6(#JYRO^aVW*S9}?;ag2m(egT~ZI5uDk+5;X zaTo7uA|I@syDLjQ{??eU$2`dQv^RE9oL_#XSrY>NI*Mm+#$9z7Jz3;ceWu^QAi__t z36N`1fpL>~oaV4&{JLm-xoc}tij8utZAxxgv~#}q4hFMp$;>kI%10DkQWbbEV9mq#8JR4@>vlJ2BaAN@r zJ&fKyI=fQph(fYR|Ds&oX(M@Vyu~)6nei0p^XP4-LUue_vi9%N?L*^UaZC5HdT`B< zoNFXEGPJT4_(99#oB5Wm8d88#wC&&pR!Zh{fM4i_QlKL&tsXS z7Zu)4TVeG+cXeZ4U(JBX85Jf3mX`sIFJ9#yd>wPFnbFJ(j~rLWfxC)!xUaYA~Fi0z{M7rU6?DS$Mj4t|dmI z-`|Z-K`p&}&pF`|kGJR&v3eVXlg;k@|(&03a@*a%*Y^pU$r;+?HrI&S( zNu6Li=F(z8FsK+`mrf1Cc`gbBZSx+KN!5>(DP$oEPaC%);m?lXUib^65Ipzy^)xxz z0ALrlnA*SEl!hu$gyqt~NXxmf9gZ!(YoT*`j=#a+E z0^~h1s;DK?&-BI^F~~3AnA(U``vJc<^#FWRJ^BV8Vfg+vj)SCG)=SsXtg1tKf|e0s za!S{(Ow1|ym+9e#J?q`%3hyH`IUnc#&sn}1Jqmc2&;BP)D{xCU-Y7t3;B^_3i;h8O z&v<~!VZ&#FPU(-O=isE)eQy-cWJH3xdbFe5R`L3#xV*N- zZD+#Zwnwvker<41yKI_YX(@cn(zug0#w%du* z%oa`5?fJx#b+e*wD-s)RY>mfmyyj;Da~-Y4Z*XSk*5b~ks%Mg|yz{$-ZgDG7J>Z%l9jFigGhPuC_i$01FE)d3Nrd+tw= zeg&krPO><e?96u2L*cS4c)jFqSqJsP@Q( zjXPc)MFTg?#)eF>qC;F0#ll#wzdYcpqV^UuH#(H1h*IuS1r(#W-I4@ic?vHUoh4`y zmD8k{^7Lq(*k$?iJysFxY4yK$02MEYsfh}Obs@nhGA(r_;oFaLghg+iEA(UV&YCX% zoGSmysUsd&OG9BwyNqoC@&dRg%mGZ=W@n*HsU9Zftzk9JiGpOVLQApWC7vK z)aM6%J|8Rw%iGUnJb)lnZc5eEG1mE^J=vFKEJ`R%fq~rItesZfhq*7+v)tFn3_gc; zeSO7`VF|HBylWD2PJQ>5bcR}dtvu}Hlg$}hmX^n{2~walvzQlWhIBb`G)(=$$eG;> zhpd-abh&o~KBfUhE8CE<>0#vb<8m^!o0i$9dVoX?IRo=|-PTrQp*}%7grvHjygn&> znX?Q8SJStgf2(lYX7>+cm~mzp%+p%lq^9MwwlST@$N`DOobC4 z&jqkK_C(|MUEH2x8-zo^Vnm?tq*+G9wxcK0Rd4PQ6Bo$`=z0CkiEIxPeI4u-|*>%9F*=?uO;yo(6GpNARJ_N^+>2M1y%E~nlOmZiIPY(dl(%n0KGJ0^5Ek7ZpNO@ugm z@tPI+dGUP+p5`bZALtxLJd-#3hM}bU%HJvOl}rs2D>yUN{OtbmNz4V^@ds&`OQwyo z^N65ZIs|c~Y#38P9l;>-@wA2D?SO4;<49g=V_+E*+V>wb*GngaOqq9c9I4ElQ_r!I0Y z%Y&gALY?6QwBpVu3%X!DO-#1bnWK_o&G#`)LBu#?_6OnySf>k%-ZD@{e4Dw!sWmhY z$|`SRj3h9iE=iu&t~fFdX_^Jq;{-`g!-0aT{ybAD<}(7P?kMXB8M52*Tzb&A<;%Ak zB`MZxQYf4z=_38W3egZT%Ys?5k(?`?A#Y%QT4r1_R4X7$do{`wk>}&1j1A9|Wzwbd zz$Gv%XVvfj$E=LQTD8`jhFMcN1ZsAOA*yi~4 z1Lht$FoZ!E^b_jqUew62m8L1u8B%lmx3&VKO7=dlBb#Siw}vPNL;{qhw1)T=F-i0_=%hK0djwDPwkD6-boh$~~BsD5@AMlUad zbX9L>qnB%=^Dkf!k;t_zeU9jxWBLT$%D@QJ+Vw*?mO5fGea*kYr>mBCZ7QwzPSyhW zE;o+ejcKlDI?Ct3K?1{pfFc?=Isrli0g;=3tj6dxk6#?px+J-SF(!gw6KQd8bU@-1 z+4=@^siZeTtgxz0GNa?fZPeP4UR~A@wT^M#1aG0CANCQ}z>j$2@5yH227RWw2>MZdQr^>S zq4A(hkfn?zZNiO4asE-N-Wj*S1+vR(~ z6gkc-?ulw$p)cyUVH=qEWM znZ{uRb2?(z-0++;X_LQMjBh43vVI*Kj-Mqsb^FY};fSy| zqB*IGCGU{S;i$~DIw6iPmH&>GsP*a%77Mb!oDdIrR1lL;I69uL7L}-Uho$b-qU#vp zq9GH<>o^+KPSF)$)7{D&UXJsw?B3{fUS1d{PYu;{sV_^(Y%nQix;HvSryyHbcdWiu z5y^Xx&f~CWb$q%Sxr^S8%yD47nhkRIA~+dv zv7}8Pu_l&G(Eo}>6}Lfcc*;1&V4Kt~!oU8wxyG_@rv)Qq%Bp4)+y`*zG-`-nuEz#rEm^2V>58n*NX zS&5uU6gGmY!}fBf;MLrF0~WWeZ`vMxbjB==jm+wFv)K@jYjxAJ48nnS>n|E{o2vYT zu&!>lAVEImw^Vxl(r-uvY*i8WDi4Cr<7SdyAzbt(OfG|&Q8YUJG&&rp@?Cx;yK?B^db_D^FZYiWh#ZhG?V9?-WsX)2!^XVY6ttpF-}xt z*xzqVnOI1luPT(2=dF#jHc)#%cVR}k4&i%zJSflN3W(HTAs)#-6`AUlFBa5i^V=M>CF#BDC9C{@LXP}boIoddefr`a2-d^T1Q7H9Kd8OWL@7F6HYX4NFJ2B?{ zKybN5(oWnKp|ZjE{6ntP=AB6N@)fa2ig9! zNaoQ#+4?LiZan-vqGmFISI!Mks+Zum9~8^A4v?EDKvUQXf1~0Fl7bGk$4K2SKMjd6 zVnT;K=@yYCZWVfUB=OOxeM&2&38f41Tj| zwX4^d0b5cx(XXRdEgKmpXol5;nz_umQ%7_vGn6rf(2u){*|{e5XkTYY_yxt9Te#y- znbx%juan~yKX>-tM=ipCgV}Ut>25Gi`&>Nf1#YlN{#q)V{a^7`Y&=~{P6Nk1o46t^Mz^@HR?r`>?Un)0x2qb5=6 zmJE6~BT{ZY+?lDXI)e>1twiEmDIV;QeuZ(4*#@=+Pjf;Gwjsk*;^|!i4GVLE^9i91 zMsK^-km{x&H?iZM(2rjJ)NH@&P0P6D!!0S_y~Yvoa7%B>Dp>p|@j`BFCZUvjnEy@! z0a5NK!#o|iNUO_aApVQN=0tw50>5b*lyNCYKYuLeQ{QX;yVVE2TePd?=p36MIb@@3 zvGY$!8roEv?f_8v`TTo#P`RS^A*-j_KP5G0MNm#gYbHn#C%MLzrgn?jy%!%{UoxU` zj5C!1exDIh)dCld?f1s*auVA*oVHNW_n44dqGqC_BT-}LP0g~Z(rSP?-!Nz2?6NFY zVk;0D3AZk)Q&MY2)t_|6~5;*_M zKDlR9mIAb{7Zbd;E~S#+5hbMEf#E#hkNB4H?H|~;Zg-M}u34KuT328O^%ghILMqrv zfQL}LgV_yLZWG;0*LFA744(^#1_zvIgulr~3t)fl^X8@(@|*oeCiyj#EeKLmlRgIo zmD$=lBbaJ7pr}?Hf@Fjl_jOQEbgbq3)*g1Rv9f3lfN|F_O8t>i9-10w0GY8AO-J=J z5+b60=*|x2lMIV@E^v8AUs7;Dq*XD@IQ#SH1=5kMeNKr?pd;5-;~}A*=UB^b~^|2bwKOL8+HkC z??H1dNIbK|s=7EW7Ks`B-~prB_d}Ru<)~K@G}{QyQM)xiD0hEUQW&CECP0@X!!##% zlhsDY;ginJzDa^(4`%VKlE+=5GhStF@URm{&Tb|iDLic&3=%Xl;5lGXp6N|~_{_qq zK!lDqWE40SMBF`^O;{c$AWw%>T@hXiY*5DwB%5~WZs%B~!*$X?Jq{CxK{h0YT+K)IE=OBc*CQci(4gOK%s<*d=^VKxgn=bng2-KR^-Bdx} z75zChYLM18{3?Dsi4X4MW9VFS2%`UJyuIEpt>{rEQlToGTi}=}WgBS?pk&=UqD8tC zrgX$#%&x_G3)O>~sVA5^G?d*vGAi-wRbd5~KMn6XOBKE22{uI@JISvKHc$$lcJN!4 zh2(|^hW)vbJTx^WrlVqj_EL6$oTYelR5x*C$ES9RVO4{X+A6C|yqmCkQX&PiIl8K< z0Vy(RjhX=}a|0>?UyMdZ{6Z$guZ>FW`YH#=>xSGIIb*=~@~^oD;&9Aka{~q!O9?vW z)le&RCe}eoBvB}#MCGYfPXS?M-4Z(>`4A52nte1HqKcpa~XBD6A$-7Q#|fz24y zZ}PgNx>Y;yax|!`C0W+}fI5uy5!49d{LLI!5CPcVf$Tx=S$W2+DINyx_?b9vVYav? z6H0r^rf|c9_#=oeI6Qrev-8dL^YrWMegk`vCWc=O-HPy!u1Hvq_tR=dI#}6s{Lf7; z@0#tC5uFb!^W!P9Qd?nH6M5z^nwNNZdCDv25JqVmJUj`f>>FVez3el9Qhz4sxp|NP zcDl%DAwT#Ss0Za|6-J&pCN+$Ys`a8YF255a5M+MDKP8u@XL1ZI$)8SVco-ASM%#=c zGd^v5RfvkUOIkHOD=U_jj@Lt9`cYZe7uUz=46#|ey?KZFjUi?t#H4yPs|FJl2mXzI zOuxRGG%+GpzJtDMNELdK18tnQW|#I}IvU3NhTN99?Dl!J=8BF1E?Id>Wwzg9s{}a? z#+?S+RH#~Nu0|cj;Y2OqzC%2fm586 z4K4RpVGSGWJ|;gd9KzSyfYt6i3>m@)PxVi|pzO*z(^{oBGZpelVLl-68zaIX2{EUO z4kr4I97wZ`6b4x~ zgc9yuXZ0%xVz*aHK{Z_I(g4mjs{31! zee6)nKT`C{k_w5A;rYhvt8WD1XBwcY`=dn^)?8xpc>>o7)Hp;`*;wX8bIJB)>)?0d z$jLw-c*FQ@wo{K*tk^5#gg#G|N!44==AvSUUbO(0r=HE{clDdD>9rV$#4M-i>o#{seYl|@m>j|=2dI0DFV_`%MciRGC{ z4&UY(stJ)y;&MOWB$ASU1=Va@M~ql{lEG;~uet?7yVXyRh`ZxZ5h1-MUFwa*=~C*e zGem0}=_RJun6zWf^urYWK@;+A9DS=1J+HUwce|4N2|f&Z7>qZJt6fQNL{v>2(SG?9 zBE!&@lZ>x zE*4w)y1or3vkwyZ?jWCZtq-$@7muW_26oh6{uY!ECB;rVW-m+B%36T)iRf4O zfa&OrbAjW>GY3v3eo}Yy7d~XFJpQ*|#3v*yLbiOcl9LNeysQ*AsIb#2stW7w7B`Z- z_wjQM=~Zu<@QEzP9ExMOdNApx;xm@Dgua@DY@HWGiM!ECAt#UKmjVBpSlTSainHPFojQ6dU`b@6pvbLpDr0(PxhY<)Z_Z;LGLx z8*-;7D8}-2-C;GCzjVHzT;|}`I$U>T9J5wwe=3I~XMgUhIjAIZ-M~1r7=N46+F`bG zN3Td=RYnfCM<+#>p&>~kdaDWBM@fTI0dA~;WmgW&VNS2bZwVK&TY_SJ~J8YR!I^qCY3nRUrT&Ju|G#4}o^EY)L$w$f0TD4>wtXib{k7 z(ZnKJfSbAFwWP88^0Hv_^Szo5u{hDGwT@$*B>ZnN*%CnkH-PKRcI!N!nvwQeMb)zQ zR}9Rq`|Em;#0l=#PYtZkE@6SAL-rDQ2tkiX8X(MVaz=C5Ay-z zQj`j8Kx>=LtgIv10E+O!x(>mfUfs?PIlCsC(D?%b*r%Y`6Gz_vkmehkAcEId=rzJa zQ~Lu|6)W8Vps{U6UySmbi4}vK)^mwA$;d6p27~AhkExOG%mE$x6wRm$04j=)) z^$iL7Wal>r2q1h^%kUaI)3dg_`*(qhqS7=sRUk}@vYDqq1OYsazIvh=>t05APR)TJ zM4h#Wz3LM#_I}ndqE?Xvr(ldQ12{9S;>GA?EutR5_nX^Y+vBs0<6<&fm%jydR;m4u zQ8#*2M32h&dm3>2MdSDcG3AI`V*>n;T-ddPz$CZQMU3AN%HTrv#)V>2ttfeAjrFj; zD0?(RxiIb3(I!BnR&riOAg4PVX*Bi&1H+z6(x6u=lCY5zmQ9GoL{I9?Jr5zJD?Q2!W?z#3OYt^j)BBWgqMJP&WR=Gb$2MTQ!imdHVh{gqvD6vhWy) zn_~-cC!Qz}SAh1zL2KxBZ;kly9!_ooPf`v59&Yt6redS{^eX!o18Qe<>)g+fA_(%> z@xs1Q3zksGv1^(Q3u17apLfWZV_gM-@gFERVg~2c47hl(zg@0o`sIW1NlX$*ow56t z=T}3odNF!D-->p1OxO-uhBPM*redmo7fP=FP)y?tfcf)eLm`;jlyWU%(cDCD?uL-Z zz=Zk}9O=UD8>o`_Xmn|*gsm27CrB}Ku@r5A{Eb@W%ZyYw#yPJk8Gjqiwo1;xP6$vO z5$41xxyNP~eeT{Z7bvDt_)RzN^H40j%6q)#Y@DBMmL6%Hv7UW+xxMiUr{02PToU1$ zc^Kx)#5*MV+rlGz2aU4kyc;5dFD&rCcPDKC2b&3PK-w11L)jk+rPRjV0+xQ^(SAiH ztI`OvtxhfVnl_xL>E{$>|KL(RNUieSY3k)nX2A1;ACwWi4C+T$L-KwondoH*Qq_B7 zQ)yyJ6m(@K= zY{U+zf+!Ut6+&$Q^uRk^#m{1o|5$XryRkAhngJ2E7H7?Y(c!6SaS*hAD6yVin_h5? z=p6;6DlQ4B4=N!HQ`RLp(uO+&Dx)Cde!znQEaZBb8Y_XXp>U8B7Ic6WX!0%>IVRY< zhMtp#$j?8?OO@Kr9=}0C5Fv40h$Rkt)4gsYU>$dj3fB024N$-c^Rey$t}!y-9Nr>V-d^l7XFw(?c#zt2R^D&}l2;|*elgF~fQ!YD{*f0a6c<6# zSwBt2E$2_me*Qgb1?7C_w?+9}n?LP(yA^D9i(RzC6#X*FK%h7Ql?Vxh&Tod#I|kCq zsblJk2~Yjiwl6qtrytYf(p;7qFNg!^XTX_<_@_j18QW834=W?6i9hJ1ODNUW`>WOD zL;`Gr*UF4S8Er~7>>3xc&rEo~)$lJf2-WKvE&2s-S_*6b{lj71+BPaJGw(nWV@Dt{ z{Z|k+GX1VV0&ntnqb&wM>4SNuM}PTpPwK{ng5t||k=ym6G8gv+9(nN^j)f_H|IK{% zGaTf`<*Chhs~qUwpMxjp>npV^g7+*bil#zQW%4%h)EQy|h9DW>+=ya{VA1Y*F8xka zXcwY#(OY<}hTA!MqZEEs)9?}thSBqtE6N;SscipCJPEeo#jmV<*Jm3{@LpAYI&ptKa zHSDBJ!6YNFG@mm>(OB^0WWG=R=vO(yXVbtL$8C!M(HFHTeA{!^adY0OF8=az;|mifso)JC}Q&MVB{lua;vy^P`A)7SLP@CRi)mpoT3$tH2$E(9y&T@vuF*y#~D= zd5>#<4Yi12b1d*~(s72#SpL!g)-8C6!9rKG!OVF^DePn$Z*F1kM9YvS@EDz6Ni<#| zb?Yxd+g<;&_A>nU$_w3nB3=Gfdrudpr=(uwEl@D=^?kDIb5|}g`!&=;$Oc}ZqOrrh z3H^v^BD7ZaGZib(cf#tX-dSh~w(&iLUUmc1v|*0i(-gk}B+i0Su5~~B&!w21o4>+d z4gD~at=5=n0V4<6!9L$X>}_-uBgXaHQ{?Bs#@D+B8p5uou1;E-=zqMj`1_f ztIt4n-+WVI(QN0A>F^zsC%~GY6jU>z3%Dn(CCWN)Jdy{@ zplq3etE@4KjV@;2Svxp?#&cOdDxu2df(iE}g#o|~DKVPyOIpiA6x zLofrKx1>!Zo;6Vo=l(u+k=A^>BVaE1v6_~-*u>KhsWfi1gd$V7nW!K{OLfxTiX=}e zPd1_ra!DUamqh8Rhe{zotBRq**$N~k8QHH#Rx33cX>H6v?KO!)96vNpCrk!cTVok{ zrS1iFY&^_Mtc_*l+aMx`8c*f2A>LsiB5Sq;ArT9<6qrqNON^)_c2 z+F8O2(I_peIaf37rsq>ANIc@5QY($nhGS|et~2X+NGU_amn(EH1GnT5u&aCaSvWpj z*wS>p`|6^fcPC0m4}Wh?IIgFyb)t8juHz9J7T+T#0!&_bzYT6 zkLcxn*CEV)&DYUH^Cl~*FD%LNK#E*Ffu^nPL38{$EzzYXf{yhB-Ed~FabN{Ei-rTG zDtploL}kV#m$nP--E14-L0TFcu5e(K6>|oqNRo}XFq+J0H6>3;wE9Kw%AG@)Xs`6_MyHaoH zL**wMQ|r62_q@l63_Il_f{WE!ZuO{Ut*55kSw}3-W*JKYNM7!UX!cI1LiSb^mF$S5 zHBz@N;wMHmcfaLn*E+U9o-xBgS;k}_Gh>U045v1VAFxz~rtwcrG|HNq=7}vpW(I&L z@7e-XEG7J6&U!HMbiCh4+;edXWA1anL;Q8=ez6e_$MwpP{9~X>%HTm$DRoH=-z@WO zCnOMy4i2h@q|&m$03${;oexp6=9k)EPq8}i6mM~1W*R9+vPngD41${I8(+~ZWE<(= z>?mKCOnASCx+aw2a;lkHuvimfZ==vP=^7#KXxNhp?y#SK)T6X+veT3vV_W!?+H+aC zTHB_j+c)JmBI^GKvWS^JP{FBGzfv;?VANbT0CBn`ysNt6kGN-An95 zp{M+9%7~f_Z051xA%?QAKf(~DR(1aMIh%{Pk8ykutNCxxF2AnCzd|MemY6K1B{%NB zzJ-v4@!#|@&j+!Q|AP7I5>}G_2YnnXy*x4SU*8gq_7}GM$EN%v*ZBXAHU9_dtNI=~ z@tuW#vxfA=pmo_nl&tDC+iuW*gd)BYe3>UM6G^^mi>mhRxATJJUhoYLZ5T4=3EedBZT zFs13TbfQ%~`b1zq>#?}AisC~Hx(e%@d2d#h9{2|%1=V+M;Gdt0fvUFEJr3`Xt$3a0 zb}|7R5>MOt?qhx&7UIdgNBfIQ8Y_MKW8wS@z)+J9gkzdtr>$tZ0LX@uf`{R=)k!7! z9R=&BtG{E>VSzxWe@8np?zIAp*cXol%%2WuLwa1^K$OYk8 z%qLCEKhQ9)_wj|!{5{r~TGjgc?VsRQ-}h18kJhKV5hwuDsiNa>^yS3q#VWHFuY||_ zb~5W(bG}8tFGJ@kb+*)JTxjNHepW8T8`QFI&dT6AA@wJU5dgJ)Hi9c!uj}oAul}Lg z3I9|csv#+rmelwm)xu{3UHuv0!gdZSUW7CoARn^qrzZMD-L6+iqMoT)`d4G~$y%L4 z()mt*qKwiHoBln(UP=9LeElPN>&9oiYa&c=b21`Njm+wnd^YHAvyiVDh(+{R?3JU< zyK$)V&^sNwA{*4APw7F(zu2lG1r`UG<+u48_^Af^+5EY9@Yh zYi_=MC0_ia>zezp;UVn?aIkY~AYuVM=qrmqDR^LAfcbrutBq_ztLeHXf@9s{#)1rf zXd%e3Y1Qq^(6)GJa(~rkoy7jiFgWQXPvBSga-2h0d0h}AwDzA=z7K_MZtDYZtuL#T z23PIgkLnR zjM@!&2s8)4mwuOjK#R(>djKFk$!GBRsNOtBU|Ba7J4df=&b)W@fhNjxn7nAu^kQ6$ zM^XjH>YTK@qI_w7f#4a~(i90=NQyKE8h%G&U#`#EAC|6={y6Yjfpg~(axh{T$6T6* zz7%@uHTOf%HBEKgmDYdR05NV~Z*DyUuC;A^>hEVyuE}w40ha!uM5X;$ZGl&3q^b|k z2LNxMfD}QFt*Mjl9hv3oKJB*S_Zh0pw*Z4If(13=?t4?*UYZP`{k*RSEcJA#|7yz4|b=X8G^0U61N@h4ix&L_9JtD}wAz^J> zw-07LmMsAQ?kj*e$t&=jT%geLB!Q{K)U?gEsfmB7Y*cU|i1>Rqi89l_yd=u(U=JV< z@yE-fYMGeU#>QNmK!zN$cITv}KQ4;`@9W>UEfT*d@=lsu&4t-#w6=7tZ)sHN8!zo&4$pz0UMZwRZfAFz zlkb+JqzBr|UdsT$j{pXwo_`K4rR&EQvq@Pz%Y+TIp#yk!0@Kmr| z$D9J)&4_3Mo?FxxmKv5wzvqeVv$IqC{r=oYDjjSp;J}-}%WL0bI6h1NKPCX|g)r-z zWo&J8m(Mwu0v-GS*i<+ramOmW2kAOof$+a{ux>i`-w(~`-`<%( z2^*b(wv{&oL0s2cN9QkORn=GZGOAIUAIM?$j{K(w+uDyF@Y|gIMkBmtssG@&ymq^K z6JQ3=T&rga^qaEP72XmaKqM2#G`TOc->={k{iyJ{-LFOQFM0$F4_Du!`)sZa1-(zg zPfCBZ6Sn$Ws!YP)1udmmJN`J}VEuJa+lCbJA2+?VjQGAzXBrb^U0-M&l4-~mjG6Gx3o z)=%L(bDi4AVtRjHD0~#v{mVoK$QDC(`RT_4f(#$uC=c3dIa0R4FT5WWn$97o7Yw&m z6(RAdoCu$sUKA$9zIq0?v}uyvH-S>}rIWkr#XN#h}09%r=dzzi|-(ScyzwTfCwCLs1psP6`J=PmAV4O)D-Sz>Aq@FrG>=J`(GD@d9 zv^vj&DitsN5zDP(&+HR)qV<12AJ>ciPwn(DV@hM3!BYkZ*`S+^n+p+)sUo!|{ zs|wr#bEe(je`18THGuQ+Uw$$6AwvT8zkitj{~iY5C(v=aV#Nds$o9vrpx*C~fLE;L zmLh2?;g5r>0C%PkL(Tc1eerbmj%z^wWlzp$R7=bIPA;wQ2ODtbc$nT=fbO>#e7qoA zDx2N~Q;&e{%#tew>^fNd$IZs~0AVO#X%NY1`m4095ZPbXWdA?By=72j(Y7>*yF=qz zxVts(u8q69yVJPSxVzK1yG!HlZjHOs*jL>9Cf-cM%-{J{0ReS5n^U=St-UfctxlF4 z$Z$XHa2ZvP+qk!8?Z4irb32e}x`TVSh(Gld-Sa$D)6X#J{(`30q)a1$qcL^4 zX&zAg2sUBwtMQL)dIRbYTV=B1XAun_XUH(#cOEG+j_WJ`PYGvF{wz~CSuE-&ZmFUT zr*2$DEXeD${KO`LXW(6Tlj+$fc>H_^3gjkxWUbn=9v~C{cAn6`>De$6Nf1?c-u~YH zcy#CNXf)5d2|^Q)MJ-QvO!A48OZ!k1qgCU;$im1zT=xVxGc8XmH5_!;kAU>bFmzSo zr}PI3xpEFurPkO4oB+in(R@jcS#|GplfV-k;qsG<61$MpGOC|6g8rHdJfbw~TFWsFWwcD0F4-vhys^{#L(rE| zHvKWk=l>2IZ8tsneO_@`!!%@;|N9^Q%}yh5x5@})@uAk+M*(NH*Iev9 z{}z)o`EID6G+zClymtn^L?@FWj;&ALTd&s-gg-u}fP>>-UdO3=ZbL#>0?)uvWu!43;jOpLeJwmOaK$h@7_4qrLbdbpP$itNZw{D$KLx0RiFPK572KhLSaiQ=*xoD zQKj+xW66lf^In~(_L6i7C?RuMVf(_Tmyf6E34rfQnQ^n%DTjO8dY8iMl>3>?R`YU) z9uTJ_CV|94C5IO7t7PYly`{*sb3C>DT#Dcy4*^-AYY#kKn)a9ivag!M)%EVYMkNm* zJAONipcJqi$IJCC{@9?kLsjnrlGaXO0)nMgx67c?)oX9qW(df%?}yBn7G+c0XE#dX z9JsF!Q-cvbcO#cGn<(AY{qmQNsULA$Kk9~A8)gvykpa8=Dsa5(u5V3XVePylL`0|1 z0wmGVgk_>CId4@z7H!_1>7@xJm@wdSyWf#&I-kCuZJB4gQj6%g9%>$WWR<-EwRymM zJzFn5eFPS1DTkd;Kc7*p5YVf1cD`kmL;Nv)+H(si)pLoe z`Y^|^IRBCJIPpdBTCcyva(=Hp_6?IQPG!zo64N5u6G>mj-L(rX&p_?m9r2fY1!B!v z;fAV57NuP4vMQEGzkf$CNSO(nG z5A1#JiY|MqMnB;1-#D6>r;G8C|I1_H*HlklH{_XgXc+HX zyme(8=BBe1<{y=(TA&;dO(gms$Jv#4545vY7D14>ePQwF6hQY{9}Bc+C5|guOt_?L zM~u-ISbDL-Z+-UtvPgM1K+Tg4Q2v318=o~swRlmOC1$nef+#jWyo-hWdHdz3r1(_h zxoP)B$OvP)Or4iHU%NbM-#~o#X+2lmuNwSMNWA&LtsHRB$A(EQRy90gMS}L0w%eY% zzd{6x2igsEG|ckTDjO4P-si+r?ji(l0bx6&h;2=4<9YYr}%KlL7v# zSqR}GFf4o3e@Z(r$0oW1w5IU|6(^5!c&#B(DkU$Tj`_51NKSDvF_I*L@0lTA5=v$} zJ1gmedPwAGZC@$fFIi$8>z6F?nfN3AW5K-R?=YfRCNKtLKcsXF;2Jg;(zv`Sq-!_0 zTvK3Z*i^e;Kz__^v zPibvHe`&Qab!j~Vd$)4tup5DYe}ra{Q)+u}kHbcBXm;_Q>}_TcwL{Z2ly9eEKh1__ zC`{VqBux)1e}$1#+-yvrg+CxJt&sT+Z2CrPe=6Y#xSpBAf}EyvL6ST2M;WF`XXPI4 z-09WwjiYD790>AJ6Y!iK8&4MY+okuv)%SF4-gV1rPW^IOmuou6VcxUDcmf{0neIa_ zWI3I>b3y(aRu2T=McQ->delb)YOi}qlQtxb$e$b~(=>fd!%sN_vv?h>G87f%+>VQL zl}B*7WHyou|DC5j-&4#UM=pqBB;xr$0m#j5NQ18 z09T^+00S=fp)SnG%wBuHv-Jh+*!}KD#F*`ds{kvETE1}p$U*(V4=Ekr+U*=#BknT- zsw6?dhStVvO^&_vYuay54(k zONY!3-3Tu*_d)Mpy?R^Ik9A&ao?mL)fk+sJr~jzjzY+2gT0;;$&yYO3(SrhPpa@uS zimc)qu|tnVt4Yo#f@lYY&(cZ1QZZI&ENX^-4Cc+4oFd}4WxB#C-SEE>=EbA~oD}Ut zhv}V!BX^l+ZZYWphGyiGPonbC;uW?s`HkC*flJWa`(fwo2 zl-?@=>a5vV3wMct06s17*@JDxX<7lfc)U?5a~LQuoN99a)qHB9T~OoA=2BZKk;`$^ z+;&puHdrbVl8TW{d5_=;&HoAO)=z!NjKM$O=Ee@~?SGhV9+sar#Jngh&M)~*?oPe? zl-(>5hyJvgTh0n!ZF6Dg_c7rHE@Qgbt;Iwhb>4JsF(GA6#d9A(FdeM81fyP3-ZV-2 zRe1!E{G*s@yw_8Y^$9(U@Ue@vdz$!%rB~CQ{?_(>8bOJwOSof(yqC5-d+Yt5F;Y&5 zxZ!?0(G^^Hg1}f^M7?Sle8>S?#b;49c;IvD%hAn(2P%U3+yQ5-0M&l+o3{EnJ@Zsl zGw2uoEi63WEX&Bja6eXux(vBJeZJBPC*Lv0Kb0ko^p(6Q0j+qkNdD4wPTL)`{!p}f zt$c$f-Z9N{`~#Et40(Jr5^i>ic<7s-yzJ}B=$Wp_dV~iheDW%8IEU@NNqC$X$!Z$X z*C}GBNaTIkR@R1fQF$BTR>@A7)YGkB@gKh!R|IpI7?Y}W^x!nfN`Z z3!4KxcbuYU!w(`n_&(ILrt|+C#^Ec4+cRSe;}$IeyT2ux`X-rrBTAT@B&rc@6M#0I zJOC#By9+6tIo`t*c&gIaC680CS=w0DSwG?@p~`Y;0dEx6F%-9Es!N(}YG*yf^vk7g z(pQ*LZNu`&+`mutAImq`pOF!8&7bYn+^fc4H2-se$vvyM8V&^IKe-OdZnB9+9$nuu6U8zx z4i=_!%9ZFT8%0Rh(%z#dK93SlBoLcS49nYXtW9X zL6Toe=l@l|0(Axdv0xv>U4Pdsj=UIT2!mu}C*p_Dg&oR`bbEYUR?EjD zMhrE*Q@?s04WNs2c-xbuf2xfkWmXV$R;NiIz@CxH!HV0q}HB~&)b_2={@GRi+N zT%-|TfMXJ$T>FPSW@QD<(T~2F<-6p4f9JUBjf!qOTZNQ;2{Kq`P+a9DVm@UpHT$uS z?cT4I)7{=U0Ga0jOc#?pSDjNtpahJa#2zE=uQFM_{piPt6x4{5F|Z2hEm1$)pL=w& zDEVU(^??(*ve*Zu!g;5ckM!1w)iJHve{p4^8Cknhj z1Us-W-4NkuJL-OYpS}z)3qX4-+;~$Ko-V7;7cF`$0PAos;6riH;esn$;zOxNg*~~5 zC_q#qU5*m*jeMFR4wMR_CFF2W9$G;JY6WDp)-04Buh|T9pqII=)RPF;dym^f(6mm` zY&um*NJ9h*&45`afyI*8x_zC(wV0E=rXkC{(X1$65?Y`q1<&bHO>Gl0l@aozxEQPhwSs7)x%`J zk#W{oW7*DBiCT{GytrMytjBW#H<|^%a?4z=k;=w}Cn{?3c5GTmGu^uMWQ;V)x?#>w z!&nMs=sI1jfybFSPl+hhc^#7y7nA{~e>9NUr=bhR^Gx9?+A`%)Twuf80x^wW(QvVt z%%An&3H!=8CuTAk#RJ~i7yxnT-JbQ-M0JQLX{e;(h0Ry9J|^35C!hm1Zu25pCY@y=RrQs0 zP7V6-=Mzb0F?cLbx^|aQQWzunw+jF96o(#UiJQA8vd{DH# zH)qV&bJ}u1Ly)e!Uel!dSERc|1avjlV|TwQjS-X@h{fiaOvpo)ewu@6z22ZfwutTe zRY7&vxI|a#OI4dxkqD4d%hwkE)ffu{s9E$6CE-$vLWp($sJrR!l+!}5dN!L85wd^p zak4p2(x``BBr#7{D6|5{cW91msFdkTu^qUnhhk;k#yEql)a*im>So;7Mo!ugjiQH< z;#?#7!jfiPx3^n@_)o1XMRBi00VB&@xJADA`>To?-(sd3Yxzv#KNlGR=nNeB2H^`_ zF3ApgAZ%ew5Nh)l2C*HIgxpEP$_78F*pz(TWY-QvMNCPR(Ur0s_F8cNnD8jZ?shn; zlO}i%>BBlr&{<8Cl(#_t%m*4bPc5Bh`;y0Nh#jV$(7H22Kq%sru*kFL8;DybnA<4Q zxWkgp#844a7lc1q{e9KvKD1tChCI;)hR~6vvHh3LS4+zMhEJ^2{X2WASzeC>DT8+- z0!(w-_%1Xr{%Is&rk{t$(-njWgJ*%3?1vG_T|6xpw_o}G7y0L0RKmWM`e_Uo-oDe9R73X&6#0GGZM*57 zA_#K~@XusS(*{#^j{e*+;x$1i=W(!6f{n=$1xVQ_`w`z3*~q3{!D0HaK^F5$B-Y+Z7~`x z7vDLJ;(YUnqv^e`buwH7d{5XJyo;RYH5k1zK_8|?fnlM~>9=>JLL>*Ih@S%53yWPA zoBjK0tH+vvY^tc`y*feD1}~;6C##5RTjX#It}BbfY^fwjE_x7HI&o|`{Zu?~UQKde*2_CHty%Om z;B3B1a1G*DrRb^Qt=1w`fA`HU|xJK!1X>F1)gNzeXLgwjRzT@J|wM( z;$Ie);Yag!9IG%XcfFkycIxxwQnV@SrJh%D99-Q_@n1RsdlBbS*^En$ zn4q4d{Y2(B9Cppr#{4=8RMphQ441}K)o3j3nO}rqaHyj``7MT=_=h;D50fG|Ixk9{ zLj(LUY30zvc!~?e{Qk>%Mb2#TwXAH4-5?6h*>)Y}qvJ(0+E&vEGT&EZ>2fRffKh2G zro@i0=+Uf-m`nuuIh zWI;)-#~i}daL7j9#MFzRimS0KM4d=6O!sN;dWELtB})>T%(cNlV}F5x2&B*yBv|#) zbZ?-sf1l>*;tSm6NLow6NY*WQX}6{0tzr$dP>vvZ9W@;%&`^5P1y0JgA)Dl-+Euz^ z2|KCMQONkU~N41J{cjijQtsu6JN93@XK}DFlnuH2&T=kZB4mKd&k1z8R&m zqSoH7kIp(MlFSX2IO;&9&VDl>2oHjaOa`xpBTdaLT`~A=!XsLRzM0=SE)i(@onUQE zVoCivZGuCZ5=L~?$E}$m;xFq-+s1$jnsHUj()QMu-h_$)D?CWE2Rc1seseOM#0qBM zQ8A2oL&tCg#-dm$1?6y?C!Y41H1-T>6CLEJ4=Uj%;NI%Xna7!&f1K) zHR#k+7Oa!*w-M8TV_rp64WZz|D1VRHcuII33{#_DffEH5^z5Aq6kSpw^>-NL$7Ah9 zazOc;^?I^c!K0CqS;|{H1vd56=13@5_{Pq34l4y6$fn>FUcH^-h1)|f4p>7+EHfMM zpAjA?NH0u0br>!zC_l;NIGla~H&61BAB@n{CLR;t%ciL^s%SB7tLr@3#64yd(mSFt z8>VqPQsgckVG!eW6fjO@`b2=df{;kXxq)~!kSvk;OfSSv=IQ1LhD9fgUSYy$@OM1# z8GU#Du7Jih4t!p7 zoghqAwH8a*aO_PNENs;*-=PBIQegW2Qa_U}Spt*#f_C|K@{l>Yl~>{>Es>n|giZs- z^9>p;@!MUc(D9uu{-v#fniU3cUnVf#{hZDBg|EZ=9dX)V9Qo*XCOTmFwZB}qtul+L zyCT$-M06~$0ftoN;z)Pcenlf4Sn6_O*erCM(b6AZuO&&?;M~vIQnO32i$cQwdyV`!D)x`xB(M8Qz2VeTLZ54mVbR2!o}P9}3Imi0iQ>(zRF#vD!H z#y$>Ay-?f@5#o%6^(TI3k47W31g4tZ6=QP=g0^K^QNtxfynb6I@%|L>etIv~Rw{}4 z)c4qSH_O7oK*wg15M?%;LUqPuHV_B$J?AN4wDmX0Z>$EQ5`Dp%DB$7?=~u|x$U3Y| zR=?ezPUerYN=}?>9xC-77OHh$t1B+s2UH)<-LSd?%Q4U_r~^&W#PVfl=r~r3xY3v& z!{TH)6D>M;`{RNma>T||Z!|RWd>&Gt$V^^;Gl^~LkO3Fw7XFxE#0;DgC}$Fq*bl|z9WtsWDSB1M+aD#Y;e+uJOH|Pl&7fGR zF^$7XJuB?I>$S%DF&Ep?UF~^h^8-#OK<-g+yZ>pxyP-U;INSfu%y=s{j=3kKU_dO3 zB*lEEAFGhvkT#k|#{&A-BmL8{+zb7wIqtXT^DQs(C=+Z1z-|C*8kNGW<=Sj^d22{c zrcZrzr6qdHCB1%`aiSwLkyICqP}zfDVDhI zcig$xh;xr9Vf$DWSXTCqq=p4a7BRmT~E9tV{Vf|#(n)L!f0u>i{e3#v5J2;QbT zys7m10WgFNYQhmAwapAQp3ak=r({|jP!@#YB6GZZQna1G!hlJaiYxjzI%Nn4l-Mvd z)|opxlZc{fu06JEy3r=fCO^DFU@nPcgME|`(gpmU-W(;N>B%KO>ZR#&kDm&}aE2eJvS(G!TAz7>nbB&{sesroB{}nIc5-QCKgn)IsFLEtJhsQfJ6qPEIdB3qpd|noMTL0Er?3${ciw%M zWSF6`+!VLplXMhd zo-`pzbmU#tw}*?-eGB<93dT3x@J2AltW-z({ZQ#3f=rh6J~gf+yD+VR5x2tV(4z_Au;`_lKGbtkeb4 z>JZ#=&eKsOclZ$GK_$Q<(1D8R40w- zai(fTlWs7_SG4k_XwZwMA|54PU&8PTxz8b(#~-L6Q_ek|qMCfP#XJFe3%+NaPOUA5 zF4agU`%Ug9hA4x^}2~*!bFsPqHW z86}rm3w^v8Du+pEwopzvsMW5riMrP|auog2ifQ4#vrK7y6UFXtu3I|f9on2WOzKqK zJ-*x=obN4|nUEYC$^MXp5)|XsmG@rghO$m5;LPloLnJ$~_xrW_;9(RV zkqE`v4QMD<0#U*DOX6ull6HLk2Q~Qm2*y7hCqe(5#EZ^K+KX1Nzic-f^8|aINVs4e zE~#fi-lM=mOlj~Rr8PTmxGr$LL%>U*OO&@@5vJDJ;`d_X zh;vSBW8a{(u=Xp4T6$~ppk5Xi`odm%GKC#d+G_;quc8Sr`+*{{xM@rfxMDHIF7|OM zi*QLN>@^NCTuJ*R;_)nby2z}1GfXl~C8$(0UFnj2v_y-)TDW895uLIuBZ?MrxR_1x zqgIFCN}Xmnv&a&o2=&%uJe@OkZ)05ig>5Y(*dOpF38HxGksxYN^$+(4ErbhX9f9bVsk7+ zHW8+#fD!KJzNHd+P;-9Nsq&VRIPfR{BGsgxAaal-SMaL36^CpV?s}jGSTM3~B-tb8 z3)o}PMUdnuc|+UU2U0m^jf8x#o`TopC)7OJH4HE%$Zg;xAvzkd zROVa&vpC&RuO@z_t44%>X9OH#6XW%9x9{ew)L?if`ct&tA85Ml#(;uHA=5TvZbVD7SyKWgZbyDG1lZt_ZqTS-7++)Qf;?=dHlm!parHe7k~Bcb z+0WsTLp(CgP|gw4(s9J4%qooJh69szp%NKXq3BN+V`(Qb$Pp3Z1E1f>C-4x|KRR|H z|C2;wvS*a4fhJI!Dk%7l|ncYJzYb6 zqeyRi{F>k|@mt?>3oA!P5tY2v&F8#Pi%G^ZDDA{8-L^gNndF?P*3J@koViXm1Fa;@ z7BWVKMk<-SL8%EfG&Xrhwn;{mSkIJkIoFeG_)ZYXcXJ6$QnUU(!i3{4$ZhBTa>v zGkY;G*u-xPfk_$}x21MT=zS@tdoyqe@VrVp#P%bP|EJ9o*EC0%}-h|!DY1Fnp)e=q(mzrEyGOSmmm;dsN>Gnvf265j(1m6 zfeylrb}lo>EG%7Ul;YL+9WFp|aIQeyi&GhLpEB}M)q^8$%dLA5k9!}Bl(=wrvQ0)b zR~UOr2TgtjQ-M31)lpuL{GUU)JfU)dWH$5fwDDU|u}H$VlE&b|_Fd+4cw7fqM%>8(X=0lOqPtfcg)v&} zF^D2a7OVE;$n4h`IH!@bm{c_3V(~GA0T+&p8)T^T3MW$b1(EZOQsGpf(^9;e+@P&# z!`L#|`_V|bl2=8IbB2Z>FAt+f6dA>otE4->P>{YK1f3(L2|*B4jbPd;cs&6^?$wN8 z*q}dyMkYa(V53HzEZrt)M7(IRU0+e(jnbB#;Wc=Qs5S=anPwXZef~)jv-7#Pb2$d} zcSK=R$Ok~XV?tusB4$+L3p=YW?ayAsE%LU-+(R`D1_-xXhwq;Jlm`*RgA{(RK9qsyP9$}^aouQZNb74H&^u??h<+DJW zJ7bg!XPVB>^L|GWR6k@>B60{l zc5#!v8ysR-MR%FYGz_lFfu38Z${H-8$>2W0WpG>~=S1puYSwL#1jEM2^(G-Tnx59) z(;2iRv~`KObO;OtYt$F447rDrAu^r-#IM#H@wVY*3W21PM%t8V!kDe<`TN=Kl7%An z4d!Cr0!}vZrK9S#;)23V{vh~JbeSiy;VpRQw2CD`Jyj9q8fIi=nX7KtS&($GmhqR# zH>RxPo$z^p{*bD>J6mYX3d+(i_MX#5teoJvR~(~D&cGqRtQmUYcGz>|$9=M% zsYcw!xQa7>8JA|8!>gIfH@NmeY0fDNFyJR~=@2s<2~Dta+{2gC5szC?7F<7HXG#V> z6M8JBKj8`pGU1~_`&A3A?Wl@c*yX>qwZ(1u6pW;AMXng$u5Z8lJtjABX9s0@?y12+ zLWkK2M9q#&vuS-7urSc3pugOsB~M^O3A6cGGHu}duguR))^guI*W&qmIGY4UgR!)_ zGeS-Gkgnx?R3rAmj7ft6C$KLxV?@PO@kEE_L@c=KE13UB^Ht37QB;=sl{YMqHh;l; z7{Nr)k_jvd6_RYAPJ^NZ7|OEqzaSjJyZX;Y&p@e2Re7^SH>v^+#+Qm}Ba*Xmk|rBg zROGZzL@H2m8w{Jmlzh%xkVO|!C>G=!xH0;mFl#bU3d!@)0<$7)u#dU|3|kXVv#cK- zT6N^pZ0O`jP%KHr9hMNEMtzR3z6%9EnLOMNzZQOBIy9njQx)yYr#0CYc!wWND@hWw zBRp^{%g-vnka^v0tC&)awBch8jz&oh={qjqG_TVn?E6U^=RQ)-l%qaEzqdz#&tO!b zjwTfg0$La)`B5MmjGwcjmlSYpt&{=jNt6%=4;3$!;1%MuY1w@S_L zl0b4?Yo;4|bBtQ!k(>4%ew~v0GODX}-7S>7??lEQAX8fOSD|%hGB~ z=Z)wzL4sA5-G{F|0w-0paX$n6q)MS4D21pn54x>TP&C*NDak9LoMTSr%^o%)`4uHC zIXMWDz$nxa5FR^G!XcjtKC{){7LDKQ#z;nyk>_gcZ(F=qX4WGdM6gE1|uDLtV;$fSC z2#94c^+ja%Nil!cAQtHrvQmPr3)WmF4-}8?cA6@cg*Fy%76`O7gV^jRL z@ufj%Utl3fmDMNhLjOZ?>7p$DE6-S(GbJIbc9pzr3Dul4|l}HsM(Q5R@_lLOvOq8Ik1QGHg5S6XAc&T=!S};VD=>=X+6{60?h>RZhSJtThp2uKCvJ{OigWCieg)D8Hy-;^Njfx4EswyiOZX< zv==rs6fwHXI0J}qWbTOVZ1CkViH~)oVBanrGbtEKvCc{FFdpgHz-0zj)p5l{G&(V% zByAAevhNQa*zq>vaEaEpxrnTP#5GVQa15wKidz&?I}`>M;-1iiQcXExN@W@jIif7p zg9IH!2+Sjo*EkzLxsu0+{`5qG+?3J2-Wuc zaTe0RK^0@J3z*xXHD70sa@mWZ)GReqOuK0G?1$2YJ#sMZOcs=R6V&x(-{MEW4m|bT zJH$3diI6cuO!HMRS&<5?(21tPX66qEIHoFtUx+1BEUUn+W9vm%c&|&@hg&j9Xxi|Q zTGoaROPz#qa<(@gY_b;?t>$gr4bm5|wc5WwBg_xF!FI~gvW|-}KrQl}Owt_zaS*Z| zegkR`VjTZqqWwPIn4f3R3{^RgVNGFGUpB*xE}0rVkVS`8`f#Y3XPzW{lB6toDGw!F z%r=|${v<7zu1TNFGp?x@Mp4O+tdLadlAu06#cG#>oZ>#RTM0RITr{}YW&c0h!?1^C zM{T-svP7i`mDf7?RGk$dt%szmJdrpC6qG;`%lEI1{1LHvPOI@RzF3MQM_(!~E*CU7 z$>19YViAjVA@HNtsAVXY)T4`3qu)9Ac1rK(X)vsmxHQo5hv7yJvUd5p(VzGO9SeI5 zrnx}&9)wS^TvjDVFNRAuVQGGYZJ;#oG_2WW9&babnPZlyLSLGvvP61O?^jm?Y_EhT zNId1ts^=0GufouYW5mf~iciX_?S1w!PcpyJq50&=?P~vCKi3ukQuZjoWcg(!aHp6H z`llGjhXqo5tyZzwCCFAvh(Nm8EE)0+eqx&utj(HmVg=)*k}yvut-ZsP6*@+L_S$h1 zY|dAQ^0imMC+?a)g?<~;3BT$0s|9~XtaO!Z$p4Gv*OWQ&+yY{J(M2D50il9aP(;)x z2tU5Ob$4jP{bp_`Z06>sqt$0VJyzW%(wW5?aItkP>;KR9Qu=x)%h2h?ZBgY^!oEtJ z^<x zGY!XJ8>sx$Qi<{!dsAF~Y|uE4-wo_%@KLdrsKrCy{%F>Ut+P`HNnRV4XhklMb0i&+ z*Yd|hB_0F6H{h)Pa{5O{ZIuSmZLfH>zoyPvo2K6WWDa-z>eS3kF0iL;_hR-fFOH&v zvdW3-JlvPn@f!cT&ih#bklhIwX-E}q!En)=?JZGy z5;4^u|X82u@0u@?;yL^iI4D&5dul5sb|6}qC4-;2wE$lp|Jy<*<7D-}B$lhmR$M))=nz zr?%NnRK58Bii~|>>V_kS%#{K8?X`+`|%&|h)nT9-3bUp ztsp4drXp9jhWelKq9|n~FSZ3Wf*fs{~E?$HPk|@Gp zfMvpgnlBSHKK@RWBUgoWjup?_t9G8b&yFdtZrIif+Y4KKM^>E@Kjz4}uB5~S6Z6WA zk?AJX1^y-Mx^L38>2&*ar=!s)-5=%>Cz*UC)Ly8qs5p5)bJ z?W0Vna2^U31YE%X`-_1Lp!UC?HL5vp8Qer%mH%Gmzqj{4clp0BwKynLV9h8i9uSfD zTL{)YCjZ~>{B_l4GB7*^k0o^Y06RP6IyDtSwuCBlIbKQ>*_LW`lZcXQuv3@MTI8^=%&Xd8#tIwUV^+iM6&vWx0 zN%gZ2bCx5n}$BymnoPe~Di*E?PF-$JAQlacA|A&eney{7>jQrtBbGv)R zDvv+fq#Lqb%Oxz$AKLcc8zW@YRlHnhFmqewp0YcLuakjMQS-SkbmS+mFSEb=c*AG) zH>pjbOq58}Z*}m9=j3sgPqS^DVJrQ-{axwN*&1=WAG@lQDek7=oL~h1s(CHte%v3i z4<}lyTqP4OEKdWfkc+#g7suDn{k_GE3jUMs_A#UD4z3!yYzn3dbMr!m}*Y_e(KWGeFGl>t3%)DDffPCP=hq`p?h)# z&lB2HW8~f1mN|j<`Ax;sV=*H^$0YkRP)L1rnmwU>L2Td9^(zxn(O8GRD(wdcqWt@V zrHEGD%5+K9+oik0Ic&Nv$jNQ%oQ75sw|4o$s$tjq( zzU-&|^Ioco)6?fs?&I;~E6@nx{@Y`h)oUkksP9PiY4ZwqPVZv-dbowq<@$Z$yyX*= zIa>dHZTZTnB}fNNRqsxVvvY($wR zGqacXwFvT;I=I|GhjL+X8>}`5`ri^XB ze6T;QAn82vC3@>aR_LC7Cp@m0X7u-j3;xA(N&C`1wmm@T>45@OD53wRtiE#ApXxCq zLio{%)p-#A%TLFSY!`I7d-loyy3mL3v`hhSO|bOskhAAC)t{#Z3g}QVu0wvBed#m} zlu$vi`=GBdc1{;RwLP0|KU_W)C+=SD=U!v9$B!-d+|WPq9SGeGwzbP82|}+wbzh0# z`k!fU&wc>)nxqqqp6R~6Q|^6H-Jjq@ZV|7SrLYaD683jjP1VkYZu{EXj|><3FTa;B zeB)(up1`o$o_vXF6SM`c-Q2C*g@$$AJO1=p9q)=D@m0RG3he^5>MfSee=GFP%vxH3 z!FN7c9hZL7-aUKCH9)oc>ocXjN1`^sUuzo9rFSt*V2`=#)-a3@m!caEO2=yxZ_8)7 zV_T*#nDD*ac4`rQ*a(c1{UoomOu z!ly`%Q*wpwy3XsrAx7Wy;by^mHRvsp#OF~3zp=q4!kowGqkAW?jFlX1d z`Nlc=sD}ypfBC&NzVDfs>l4XQa00RnLhSm3=3r(`BQ+O{TwXEIrcoIzG2xp?6Vd^GQiGH!4Tc8eip}7bX~=eu*8@;^(}a znENP;WZ@?390%S=GL=iu`{Ww~ZWot>zQ`z!G41^kwO)XJ35Qg!7G<;jmf~K^)R3RX zY}f}p{k@n)B^H{(cc+g8Dgpu(9hizvX#AJM=AZ@cmE=j77hx&iph=Fp`o-cg3+MH6 z)GpCuFputpBJO~G6pUbh7QnB4uLM}H^~TMag|s^)-$`Z3*VAxEQSa8P`JX%)jR<{X zuq+zVHL-1$3nVXNxRb}2e|K|)sF$d-uALfJ=zcTuJsu$X(Qt`uhhD49p~nx~UjP#1 z)?}$gPCz=Bbu!_Ebh6S3r9KLHSaK4dhwzu*j>cYiBVON#D!)WooaXSKJ@GkAo8CnU zPAd6{_1N0yyHAA;JCw*sbt6MnXMh}gXMB23_W`q6DA-{VH+&1hL>J#{5UHp4Ko z9j9+ST6$C9I<)ie08~%421{1*0>nFcOR0zBfnUcj=&5Qil_4$Z=#8uDTQAkn0c^;^ z7A9t4M+|cmL9ZqDB4Z_q+*R0(*36e^-Yrswtk8zHs#%P7vfSmDMh&)V3>h14%T-97 zLHI-+fU~1t%8abHgG*-6@M67~V0gcJF)6xG-7Cwc16sNY(=eTH?T@+zTd8N4+orwq zHTHiIc`lq5acakKv~3~UZ`5<`1+IhLh2|TjQ*E1qK0S z$?}Eki2Wdg29AYfz@sx)W5A=L{f0p2s(bW*Kg0RF(w{cUHMpw-x8W&fMKeTa#mOAfg@wVg-Z@`re&3mlqnO+8rid>(@ zRzd`TQvYmy+Mae63UO1Xor!dQe|;%h*GaHMqwipo&B|!XBjXoJ41}aaSGx$d_vMKf zi0`-C9Z>RA`sTlU`NV8LGZNFAuR?*vL(?^sS}l44pX&tAhhc#OBUn4Oci{~*nu+K# z55cOHl5~}yMCrd2mIpXs_-v3{%vQDKxt<85LVOd?zy*Jrh0-)v(zzDK!lJPd|7Ph2 zB_Acv_ptn(`{f|lLP}|V_Y14X^*&B9VR_%vr+p`ki3FBKf4|A`OGfcZQdx)0edpAI zw9;8bpc{*MzF?o!U}0#Wv%!;3e?&eVhw%q*aRV!qp_Ri=Z0ag%(Rkmy^7Jp6dsNFA zzr+z{9N-u~hFLQu(4_c$%AKyNoz$K)PPv#Bdm9%i=rjz$*Cs_A^U5Ja(bz8uBCV+I}aZ>*s{qFcUrfocbYEQAox# zxGQkf#(2KoayzbngX_jZk99Y{RL?j;RaJfc-c^yRew$pe{g>u2V7WH8m=4iI*!G)a z4IRC^Y%1SOu@O#GG4~ z&=D(^%v;i&z#DwYtHn)s(R$d|z0_`iLQ%|D8sJj*9+xAwI8<|#XXAmUA0$z%fu3Va z*MM&Le&3iBL<-ZXlD_}8+Rw`MXhr(#SjnaVTgl)yo0l1q-zW0% zSgwMRGZNcYc_P$kc#x&epvu~$vfn|A|G&UGIB2S1UR*0sUj<%Vdl@dlhrPy{^U~?E z_^FFw87u#){m&`aBK$6$r7-0(f0LIlIMb7pZB;ZWzsI+(GcB)5x2Rj;hh-_#5&UdO><^Gs*FLwgc`2h@`MuAM~nJ znG!w>5#(a!l(6qSFQzZEYA@9cl|6Po2Q=NrsLJWzB_&V{e&BG?!wbFteJUp!?}J5A zqcg+x61kr0*C(Yup|Bs^j_H*ZiqNUwCO7<@bM{R}kMagSoB;#Vbkdyc^#aoj=rCPp z9Jg5}?A8cShM&TVr(2Vo)Z@ko$NCzTl@D)x43&OZngI4-qM?C<^%j(Ijk_N^ctm&ReCfGAB@_SVPTX{y@6N#zzgu z&I({17AHv``4^06jBTFjyjRnXFF?}TS<9+Vs+S)rvo<|la29toIm(`OQ1C*a4YKm7 zs`e9EQT|p^k4u93P^3K6RJ0^Ek^Ms-#i~ccdpz8xhvjF{n`Gp@Bo%nXq;@xQYG?~S zu^``3?sE*_Jm3>bx|NS&n#2*n&j^jmlftOF6Bp0SrudpBMfv;l6s7wq^)(vN)3)w+ zOcoc`7eEB|yqr~lOWs-fx+rq2YD80t0V&+XCe!z^ zbBMmQAL|l6{f0SdDwcK`S9xsnnhHf_&jBVv_hI$qrCm*&%#JdAZ{q2EQf=D=RNB?{JM?thY{hv>24UHZQ>WDnx`Ydaih0r`6)c=49+CRdO)a z*B2#l^a^sey589ex1_gf?}Q*#7&MI(+Fq-yFBCEvd{Y&!mm?LwZ@I4W^w&>SK#YVX zX`yMx{rssi z5jxu?`GS}pTe8D!d25XMUZ|R%`#!opAg!lpqIE`7qBYf!H|?bkO>u{c6i`c7>e;1a zOF-USn_ZyUtG0{+4y`$pio{13N~-fEh`Ex z#IV#0)q@BeXUk-3;FO$m$(t)~^{h3tdHMl8%j6$~3=B*(E<@DNaGIZd5tmd_#AF=i zAYx-|=5p0TV1V%Q8L<)NW<%pr$_kC?`1?SnE=5SQl7C{oV(u#IgYs84S-cTu?r8?e zV9c!{d<6V%?&|v-^zSqbj@Xj@j-@@+KZ(trtc-dNe$e%O#60%JKqSuD7(J+LWYCxB5FdwB+dKNuN)^Wl|;kPx{w+K zWHaR-1Tu>I@PY=I`CK`OT7#5Ze2}hRZ|wN)j#z%fecR7jDnUoZy`81 zceRPm=IwKIW)_pgpc!Mhp`>J1S+qrIg@_ve?fU%H{3;HVu3zH|yrt%j4HVxcRo5C0 zEeG7yi)ad0)W6!v_iyul)g%zujCJ@f(bH$G2?@r^)LIt!!U%hJVO4q&4jftMx@}C` zFTBZ2oQoLQNbBrqZR>2M$!VOwMVWjDQ8!}lRdOH;Ja=5!?BN?^Aez&jw9im%-Ly`Z zTe<^zDX)q2W7=R%Z@o4*Msj0$t{6&vaiwnRAlyjCVYS1Qz{(YTjD`AIwp5VVJ4b+Y zX!j1GGOoGB=~Pk_=e(UJ@w2u*O(0Hmg>=s4@gkf5(6${dl%99w8OLJp)k5)mN-u>* zvW{rDTeNcO3GXu{V+DnWZftF8C_1(EjuVDCru@D`J>(TGJr^GCfg|hSeZujKSvch108*0WPxG(y5+#Nir1Qfwo5eV3W1)t}!)o zO=AYN(}ia1hTX#3Av%(LypFvZ3Skaocw5F%%E_!IEtX>Zk~JK50=R|rI^}%4G=aBh zp;0uJKOu}}s_oG`=Rq{G6?u#F)_q(tbjp&{sQCiyFJ$tMjqP(Bqq0dBJ3xpH_E8ja ztd>7JvdX3-{IFU8qDtLgC_V)tNCD+kRVMIg>I2gXuaknF{ixTXiHVQ*tDD}D>$00 z>7{K(DAaGLSXev=6m)b&>lrYV6Df)BqO`b++*@85e;;(4XnO}Ma3#D^>?ZS9j_dRj znbFCvh*h9soA+z)l@f##ucs9e`z4B*=n|yF?NUb_`K?#j)HRG}_iPE}wM)gWymL$) zQk!0S9E=_@Aw~XN4;#*qCFgfe9t6MYSxtC0wEOuG2FijQ(!PW~Ndes(2pe0PHV-TZ zjY0FCGZjT~0FSy>Gb(7?+PfC#Y$sS}(d z+pjFZkt(bJ>R3~Fil}jL702KQql6vv zzoJYQ@w|E{^e0u9Z1PU`&V0vjah&ix+n-*69}V!BO$26wmeK>jsqbE`S-I(YzskmJ zJeem7$TSyjpp>>1sW|S?Bb^+5q1kCalqn?pvfa7K+nj~4ahR55qyO~;eMpNDEUC1) zVL7_Q=yFNFBsf6beuDEV`^xUei5oVFp#txN*I&L8BuHm|{MBXzxoJnx7egPMvQN3RtR@+2kukO*uWd*+B>C(*LvM}g zl2L7F050&hZ{u|=-r#V_w+`c2luGQuuX`a{@$FR(G_6>gf zb)eT@$s?(*2ZTX`lSWXK?N!fg38Gc5eQTd1>uxJ4P;m;AlCIrFjO0NO*hXQtXwmSt zi&*Ch&3~PZgN*u4n+D3PK)G3gw{t@fz_3I>i@HDbtAE?dk@Kf-^N3{qS_1)b^`r?(q*w;o;;7v{uX zJIjl*2+@f(yzFGRElHH}+yj+X0waj~kx(4OVt)`Sv$`+*%ZE%?SEK!$wgnT-bh5|)bR0v7uxP6DQeP)n|& ze2{_;^j^D%znOC9js&(CC4EObtvSh1WutRPEbsKLk39^;*+4x}AaEJHfHK(i{tT8o z5;-b*AOdm|ht+=|3Ygfm-F5-vayLll(@pgyzvRO9?f-jv6cCP%s1n6r8Ajj_(Qa%hF2SKMbJA#{MP z$O0exC|#QzGB@0T)hh{$9)g6VkzMg9ww=j71wSue(hEw-|ajx52L>LWEfOc5~c%@#EGK_A@GvsNogO95Yy8a!bJ?Q%pm7(yTE2*KB^mPwauw9+H<+kRKg zANftJQp0fPk$8D*E!VO?)yvN{DNO}Ela5pEw>xWk#zr|yy?};YZo|vrGhQeZk&SHa#MFr_G?>XZyGK zq00S^T*7SdpWe_yZ}n*CCvOZ31V-_x*@~Z3JH}|p7Mjqq%81_=1pJ9SaNLf4TYBFZ zle!G0;JyinN^@VbuDe~v1V+52!6l(VBrry`*<8Csz%PPk&P2;U-5%gUS1izPS)kFa zcc_8ulRtY~79#pDdW)MyL-cbMaWf`)n*>8NILu-At{sybV1Wr@fh8 z)3oSrUV7y~_+FXvSNfwKe$bF&xR>Kre2J*?j;*oOQnJH`g}FsV7QHvC(C&kdY=Hqd zCdcep_jg)}X2oKx!hkN@yeI$Sfa|Ff+IgG0H@PD5#hzTX# zVq(8wl)c7n-F-D0Pv6J$p4**Zub@7_Uy4I+0c$T_e%;x^6YDvvX{=Y$C51FBbX%L5Lv)&sgWr;!0&4}gmKRkRC*w*Al>_&hmif* zCW$n*i%$#g&Mu z?^qDmnfO^|BZuS%WGf}Xm`y;65zKvfO@61ee$j-xg)nU;6XiR>6CeA1ttnBF-Ab9#TBkycjMJ4%3DdM+!KI?N ztT5k++*U&K)sz+Gh@esp8l-q1`Ke$6EbEr{D2RkbTBArS+ktXsR+dttQXwUlo~tl2 z1{tnb6{ALy*u)=OI6iYwyd$;-GVV=fiQ2p$U_ga!NiEj-mfJ2v@uTRm866_W8Cui~ z@ZEZC&^S>3KxT~BPv86z&WleX-TXY+N1L*TJ$s4gLPvF0-pK?T#o?!Z4*B1-mqF&G zy?I9d3dy^F`?N`p|b!ynHcoJ5S+syZprlgT=fVoz7O%QbW|m89p{0 z!$keB-ul#HZhnHiHkPU!HE_|e#XQ!=07NX?#oS;d8ng%w$lCr_XB{Z2>S3|ZQ(c@LQq?iVRS__^w4D}JEE8xrVoi)IdQiCmf0H=T;@$&iHad(6vr4Q-U|H*A8pG|^gJ-- zcEQ4?n<)}ghPRSoP>1M4iGJ!lD44kP){?s?ET0R9`Q|4R61?ToX8i;~GZofLpDIp? z22LBoZS8vi-#{ObqThTLg>4J1M{R9J(TO#qcf`2ZyDkbbGznk-Zc?-lw%)E1xwZcz(Y!!s+jP{gz%l1 zvpP1Tvur280dnkGXh3tMX49!dD|Ma)dL~cWo7pKIjHM}V6a-5tyh5i7l3bwf*ZkN3 z>q}g@h^~J^BZ#NMY3l6lF;}mjdMUlt{*$h9P#aQ9F?**`)5{cC&MDyl-!$|A){d|Z zDkGLwe9sO-tg)RUrL{u$>nxYd`TWg}xUrk16_`dGMW6^FwxN3CFJrdx65mhV;0@2# z17IkSU1((aL)cXo*x`wd^f`-&fe{LfIIiQg1lOKSzI&0tKNLH%%@YS8NZL*_L08+! zVFa;hZI($e{91!QG1pStFaf6+7%1?4YF2S%Y4-Z5uXBJERc-O8kNH#g6}`##^16Vj zaz_9I!#8945Gg6l?Hl|@rUvBBbqp~~@XP~*7n5l{7}%H?fbn=f`ptj*(;AJUqq{t*QcCHs zS1--8e5U7eWs->I5?B6;`*#8pSUYGr7gPi}+BcBq0Y$&BL^ zX{-XI@=v9!uK$v^#~kustRC)U*H6WsBbIUgw42g7+VgL)lEHp3FiI2T2KnswEsg zD}I#ulEpa2bL*kdEsXAGDfv#`!vMr5cLg2&n1`X5GFkevo9)%>iP^)Bo6b9rNOS{* zV(Uctx_4(*y|@YA^+qJdf(#aR*o*MUiR^W>9qltN#_f}?%X=|}dDVK`>B`AR%6ySw zz6H|i@Q!pX>FO$2qG7kLm9fk~DN z7M`oeM_M2g8EqP@ob%D#v4u3oYZpS8uQzls*E;MHB%YcS#0_a~adR#5D*G>yJ)`(Y z!3iPYsgZXvsrz3;LFLISXV~W%rV6N^^tOM84ZaheH^z=k4Yr!#@<~($W2o=!rDG=| z+>%&P4?9Dm6B2t}!VTXJ-!)nl<&xoc*?mArk7$DHo2LlVly_>;MZx04DLRrJ{Cb_q zwB?*!(NLEuVS)c=Oxv6Ci$pVm~ys{Tw=zk2JXiieV3W z&*>mW+hrDnYx`HuWHr396-sJg(#X#+P((<(LMHXIhV>Yt)Z#Ik;wMqVEJoEF;$mQN zg#mL=y~2WX$lwNKechgOoQES}U^S~fyd~+Uz;`&*&v4Ho(SQAbOiu(0K%y`*pS|GU zvQaMUny%QoY*cZG|4K;3DI7l~aohy|Nuv66JvWLv3Rg1bMKv&fQh-)LexlR6gFEh~ z&_)1TBqPRy>!F|O+Ob0-#i=nI^oQd0XK5=MrQ;x3-?1Z1z!-wf(@m{ zCLEa>Dw4rMVnYLe)y+n06m{tdlX|y$jUxP}-DP`Ubi;`OV=cDpXRnPwSbtBi&D!Lj zu8u&2&nLHKrBNo+J7Uc@14Y(BQXsT%sM&hivS0%SOF5$Ss!Wyobd!g5^vj}Pr^#Qr$vaN~R#gvr^zR68PRCr0rp_W~auMOi zs8`eDOqJ5$8!ZK*SZkE&&@me5H%T{LI$33EgW{ey``_S)MX8Nw_Z(b^No?2%Jg1qq zqjEH|@dGA0(3vVzwO@85I~tfYLAeNjkI~%1qxCU#LQwWpM*VoUv6wLf;rV>X3fiNQ z9oOrSk_^*+R(=O!baOFdea(m-cb{3fvZ>c&dI$HW@<*l;fHN8A@!& znjn{Sv9|Txpz8FXO6R^_a4DR-FNSNkSY$_`??}fM67h{BQUn3aH@jm)R z-BK-r$kUOjZPG3!Nen&vX~7cXC@3&K2AV~bD4xqMFj*~`tnhD+t> zcX`LmSj?ntr=LbD=E*j#L2F33Gn&w?u5UoMdND1{PLh{Y{zNpunfGJR)`H-jI(DLOj?otNnCs#Wj}co1R0|K zV8YYVGP_CxjiFpgMzMbj%Mp5qp8K^+_&zM9Hql4(>ZPT@g09dgoeFD|B7tsJ7S7XJ z?z~9On(drO8tQeymSMmi>pM3`YD0H7f(Kq0zQY(dSUvx^n#}|6qc!NTwjsNd|9WoY z5?3KCgBnV|U`XvdX7wHIRHED5BJWX7nDl--8Cbh%ZY0fKFHfV~i|sYYHuP!fYAu3d zMip-jL03ND$J}?uSm7oXo+MK+YBQ7Mnwm&tN}9I$p@Llu_p^JuAhz2OoU=DSW$G!H zv(Mz_W7GYG`lnUF!#7#hNFQH%>LV%vU^QM-rs;b^gV@x7-d6c0X^G06E=OzIUZp;? zw``<)ai4g}gmrV{3s43&IlFRi@?{ivy3^W!i~x|<$aySIe0P^hToFcLOz&bcSVVp# zZh{(B3KVTEgW)~C$!6ssxD=i_&5tVe>e7itrnDPQCn8Zct|oYa3Rk%~4o-CmVg5Ds z+h;5e!gvfSY|L;x!iZF!KDpb|mfGG3A=X)nSga@SYI!z8N$xKpUIzlbvx$Y#4w0#e zi^SZUAC_js&zBM-qP+Lo(?!e$P&hVZiS0*I62}&OaVAE2A^6d{it;u?vTbHe-3)mi zvS24PmYoi+R#|Y4=#N@B0Y-L$w8f?~8s)?lSp)~tV-Sh!J%4mmz62SqJ z_S`(#vKdnrS_;oOzkmZLGfx?0lFhy=R1n|?xVZWzu^RU;?WoKokq$tZ-kZphDv`&?qGiRWzFxQ!_S|sI9nWIJTt!% z|J`<(M!)cc<*ZK!y$r2}V5+S9^h63qLSW8o<^;P)M}_z$BRcQE+_6a7xpKR~fwlNd z8kz!;4W2inv6L%NnOxWIxN{|O_4dT^Ae=F<&N4=Ov&NJ>^lhN7Q8D{j&{)V8l@?IW!YZ`V9+-7srKeKGig%#R~EHa5ropmqE#Sppa1DQsRzRE!EXZNCf&RYA7x^a6Z z0?rAXwiV!V&lS_Ut&>U-Mi4&I#|4zV%D0<~qIY^WnrelHb9~8Kof)e9$4vyW^%%M~`5+ho@s_ zQi*37@q^0{{g~}Hp_!M$jwRAO;?f+ye%g+kl}!CWjh22x<@VEX+RR<>6x6_k?LGWq z8^Pf^jbg`KCbB_m%!J`tH+7=bg2jY?TP@J8DGt{D9FnOBXSoHG^Zi#Y8Pf~h_V7_i zZiRr2jLw#$Hi5xtHE)F3kReIp8}8oIn0SSHKeD{&!6BVRg%=QmP;z#A1=U8R#zE}4 zFOZw~3b`gegThxH-NPKxA*Zs)l~b<%SGkeqb7sT8J=09l?uWFE@m~0{=DaI3sBfYA zMmWSU`mwr+g(g zhwSQlrLFH8BQbL_jbyQ&V>zxDE6SyjXMU;DeR!rk!~E`YBijz)d7ETP(#qE|nYiVu zsDtp6VIdb5^p9ZsYO{f{FbAl7%&TUnn)2Zow0TKu*>P}cW8-p4`;i?JSutnE`?VHkT#hJ^HZOIMV(hcrFphjqBbM@Y^U4xP1y6Jmm zHVGrS!?!%Gbz zaph~?D7PmuD$Ms{pni*90(^fvmrhnfs~m7B+cW!(!bw5gR{d|%sf$3iD?x!=>Z(q( z^!4MV2U>!=+=uPm3b!xFMH$}SluE?(Y4fbG5U+i9G`n%yO+*6MW;$uVmTf` zxm(T4^`qB9uy;zXUwA*O#EU1b2-R60tVkA6uQhwOEyy)kRTjUK>VyVcupO0;V$e|4 z^S5Cz9u{mawl619cWyP`caEk{{}+y|3GUgLsyF7fHoCp%5CYJ|YrB%{Jc@oIAGzit z_=w&$Q{N7&e?)OFjlDbE@13~0rmd@2`mp@aa;~^PWxW11?Z>+V&nt{6hKOM&!3VSN zLKKhLmO3%5gYy$OPD(WDkee#w+3CRlnMGTqsi7B`CYfT815mf+nYF1d0PFiN|KxvX z-i+e97_8)!+S#IjFQ5%7x|MTy)u{|?L)~b|naQ#EmIiRbew*y!C@Bj6GKGEDX zioL6615gU0*gL@PJAWTM-2;2s8q(8z4{Q6M9#5Whm4?yn>Q$1)_%}|FzHXc!N~ivT z*&I1y7p3~Cg^e4Q$d5v>+f#lXACkAdeYAFr01&QHH;ceJWkWS8W9}(s=hGwQUAB=?NkrQnw*Qm+A>_orvs#b!X;)6nQ4mzr;5}UR zSs0+J{xC*Q03NrBpQrQj|NM^r`svUXAPGzLLl-tt>`h_!#y1^L-(UOOq8VLkW~_QW z0WoAR#^mlCV764vpBz2b$XD(=FyCvKCye_B$M|jJF#fu$>7jU>X@z}i@yk4aUc0K5e2qxeljBblOSS5DY#TTYOYPruRz{wMq>D2*4@;UNhRS(^7vQUYf_WWyTzwNzw7pfWCG#rU)^gE@0mXn8ANkD>C61#!x5b=)7*=Ldizad|YB`~iR% zff?oiGW6T|@c?-7gVZ|W3h!e?Zp+)UAfdCHXQ*!Q{=`; zt^htC8EY=v5mH5;Wl(T7VkII5xeIP?(@I(T?7{0tFzqWFCHx25lmA!=44Y12($umY z?J<-2Y-)@`8U`K6uMvlT;I3Y7H{Yb$F+bnO$>=a!JztoGp6x$ol53R^lLOSHr*(fK z`lb7f{Yi{r-C$5^$0Pa4H7oU@Fnd{>tHqr% z;j`Wp?aueb<<)^32CTL-R{-MTb~{`85AVJk!M`I4AVGQZU@ULCtvQ@Ty2$tzhKink zOW;8J%DV-;w<@F3e^xYRap|7`2%5|gU(0-@*j=q!1E{h9{d_&6Q&?tH#VMcwG&EpJ zx3YZfQq%qCji33-Zg_LYC)4k9c@p3S-golP5$d@1a5`LUaK+s_?H5@GyemeCRVnRr zkgRX*jCN!rOKzY~Jx>AoXe@s{@QlJ|Wl!!^A`{E`A@K~hfxqjc!V>K_cb*=1+=Nu( zqF-!)mt0IViVjx*;_z$0QaG#^HqK*7Xbo|+UwI7m>1u(RjtR+1bUhUW4?2%cGjf!Ei32$fkcHb6OJ8ijrypbemb3of) zxNI>p@(t!~^6tFIJ82E?ZYHf{H}^T$`uM5Oo#{rYfY-pwlpJys3)@%wSn7%#h+@uO zaWq}^d$(2p|021=yGkVgt~UO#QuVE8=KM4eJ^7Qil}F?KBqt_3$jyt@JJ1a0M-J%F z^S!tVx0wYalvi|_p=ArXJAQ-#yPp!&iD5$H-JBHXK@pHc_SSRk1aJi|ME=b~PBvCT zJYkh2c$|hBO8Gmozrhhdcfld{pyl_Y-{(?~m{dnnMSj_VcS6$}bZLLwvABDddh08L zdeL6(3bXAWel8L#qJ(%YTr#Z}8g+XK+&NOoJ6Tn7liwaxG`3m7e2-|b;Yy<^XT}wo zTEZrHOO4;x$b)wZ$^rm~v4pK2DZ#NLZ(H*Ojj|7uothi8lp?V8Q-h^_Pfw|(@G*~o z=~-EvF`D(_YOkIgyCqT62j|&Jq#Q*|a&bU|SfoTTRda&eAYOOq3Tfv1dgN>Us4Qm` zz1_3$zFe1U$j1B3)F-qvJ<)P>*>(Y)e?c-uI+4vhY_ep3a5_Kk6D;!Vp0_$+lr;CI z13-xE#|O?V#d_7FFvpchUk*vE_BBeTfu+Zp+qw7mPXCaj;U6_@6KDbNM=kkg-ORiG zGUM&@`{FGtAP*Xldq+( z=S`xfIKH3v)8JNKV%6+*vs@HZoR9Al2QM1e7Sth@#7S+}atv|Ui_r}p+1=U=Hb3S$ z`5y>n_2vsd0W7xPz^8~>OAy*2_Ac&TUdnBN#dF7!Mm&X}!DIPm*6nH{iqPi`|;oJvDE}m*; zePx_dN4XCGStGs}GxDW<0@%u^3dW?_+s|S2i=;S6d?P7w(Ar!Kv&KG6q8Z^6O;2VJ!MIhLSIUN z&0VlVy@`4=D8JA`Yo%0K?s88;2)_es=;rc+FJ(*Dyvf_$w{Z>fLGm2E}e?84Em1E!Tc2zL{;J+F)C<wP%M=|9?^K43Gg__ z(R{LJ8UX(~i=qeV(@*1GE>3~xQ; z5^TzxbS8DzeM&`YD704Y-tarLjsD=VVq?qqwlR`YVov1KbAb5Ps0YGh_@(Ul!mk20 zhu3#eIWlz!13$Qnx%VpJiA*jQxC7~)`D_ozfN6ZNlzff?O;?yMS*!AgW-yBz_sl_J z07SU(TgzN;9$2z;S1X0Vv1rhc^sP!z$!XcfytAi^8270iE7Sxj|F)*g6r4rkY*vvS9dJ}ihL5Uw6-VreLrD^tHBqS$&)UBf3`+zwj}U}+o-AV%&5^|5*@DgO$bYTmKsj)CBC z5q#HQk?KgMdu#F!0eC+A-=~*K6|j&+r0WZ`uwUJ6G!)2Z6? z8>#uNYf&f1I9gvCIW+@a^f=S!hR~%uYG=E{WWw0{XsX7XcX*fmIzvIt%G?Ode}Zb> zC4|pb&}q4LpS+=O2;8QmZx*EyS^DvJKcK1L=6@vd9(Er)jks;NE`wKH$uYJM9^Dry z!ZRZ{|NQ&f4NmQZ(UIWAR=LV}Dlo++Z#1l8UTu-3rpU)LV^mOl^w6ZbODDOQbk4B? z^fltu77+`CJ$0w%7zPrg6Z?P<-5%h-=7n(NS4aMO@%76P%m(Hlcb;_#Y#5Mw)b75sE&bN4lWhC{c;5bXy8e^!T^8i) zJ&!pde4<$WTQGpTS=|=OBcfev_{7~hq#G0Xdsd`2+_b7Yk7o2#U^nKv{_!`YS;w;g zeQ|zlPtf~ACBa4Y?OpT1D@Y6az@QGqQ>gDHbo=3gMiHT> zsHxAIp4G5}=I#MawO)7ArPt6X%>t4H!h<$ttbRQN67ga!C7>bZ-3+%;R9(%l~ z-o*#X0xoBajoHpcY8~HW9!N77fz~y78y87zTLpu~fyn|G(^dfmnhHpre| zT-)P1U~ex>$mtr1)!Euo{zL*Wy@a*sun2Hh=kDAsssVXB`%0PF-&|REfqrdqKZvpb-Z3i zcOFYYq>EP!gb#!i9)pag7Ek7we8|5S*LoB95}Qka=>Yox*G85Z!iU7`q^b)%K@GGK zaRV_)kN0AT5fQaX4zbiw|LKGaC@^6B)p3sEHmc}M1B*6U=L(E0W1N|YG5e<&U7v(S zO}1pd))FfUOLBXWtm2xAmmTw9JHjtoX+&b|RHp(XP21srB}p0u72G?*R>^4ZfV(*e zhq25`fQ2Tav*f^S%UKqTmPvh!GGHMy2jow)b3a<(+~a5GZNl}Sm3ZuoE=X`@FZmv?V zY6V-|7@({V6281nb}l{ks91jGDCyA(g(7}u1L}#_S3q=19eYgeQgG_AXIcJpJ8b>H zB~xYZBCdNF?;m9rpZV^zt)RuRb}cpjnk@hfrJ~1BhPDAgqHp7Ky z3b-FiFk|fMrFK;HcGg;N@U|TGjdy<9dOla7;XcT~t01me3th!{B>g77(76Ixy#eZx z$Jbrg(ksj4h_WVf&rQ?F+AEVw%f|QXq~8gM~}AwXSJxYudlTB4wS)K!fCxt zpMXIFg2A}U)uv~G4R;&+w*SyG%)tu&yKP&k2;NaH+elKqyZv?6){NTR)0h4Pq=UBV zS+sIFsNndXMF}6vW?YBr7B!twcdY5i3gF;l_TDWQe?64Q35aK3p5)R|-trV6eO6L# zqaZ7o79fy850OU~oK@IEnO~{-v{D)srf%!tS}@^On~g%VX))$otp-piQnHD%aDm9M zwy4doW#^-gE~I!W{FHJc&?2hmXE$gjzv?)f0>D6(`hx0+&PU#<6qr%&%b7i`LM#S$ zq{;?6v1lk{RTI-2ru6gH)>aSjR9BpJ!^>s6q?vYdW6|02&-uxK?-^qqVo`OOp}b=R zZs8hUcX&FnkuzO*T5t(H=gdThtjU(fuY$dA+^w{*9R;=*!g?b%`j?KkSU#I0?nnX_ ziOofaK-e^ph)|HdS?4g)7v4MK7wo!9sUHQVAaxfv#KU~2;0B{K8b&`+ew2WgsU$$W zqNs$Y6FH1bua~x*U4IKOB%PZm=4D)y!gpzI=PEVJt)W0Wjf2g4x{WlvLkpcWywjd5 z61jeUHhQ-9V___-nYI_BDnh@1$X5J})!FGYhF7#w7!G-pM1j?a-=ugqEn81;=m4JY zMZ&DgIPio{Me31NuY0#V3cFD7MMCHb&m)bb+53IsRtgAMznmT0{qlokDW)_Rt!JC7_NuseDQrrenygVoy66<_T-|tv zo9zDnwY`%J8@YS)^KQ|D{-mpGhTI0>l*@nx?zA2HA2l9nE0+DE@0f#_LvdOc>9g1L z4l~oNtyEMD(wyxKG(zRwabyyjn{&);J z!7ISs5j4QZD0ZR$;dXzYS4f8LgxiH5v@@p@xK!09Silpr$y8Qm7y;+~U6!qC<9g}m zXMv<2+jBa2tDaZp0eOkzvLl|${Cs^P+01n7em4DfGo?yBZs;?^<4`0zt5138eV?15 zp*%C&y|`*5cmd*r>&BaboobxIOeRNH-t2O}j=m$2nzRrk<*t{GK<6-IHrAU3jGrFx znuJ7|Fll=B9}8~W8rpa-7SRu;lp9G9=|CZ^)wN4lYyP9H!&7kiN1o5-?5z6_r>)*L zAu+$Cu{kOJDV1|uj*KoS(5$C~&V#hHG#z7M*ELRN-`6NI)97yC@DIK6Il6y0$q%<7 z%_(8V@7EB_1M)kGl_jDY()H%Tm`2TnSoh)fC6Fn9$~SrOkDz}kp$-~GOqFU8m|xs4 zuZip`74?7FvnA}O%Ff=TQ2d0k=iT%e@^)dWcr+o%Yk}YGc5@8&cXk=#GDBBTym~0x@`(AAlw|=IM`18 zL+1XE*39L=@+Vqqk4Hi)SAgZvhX12n z+}-jF$^RyKu>}EAmq9Y0s2rv(a0N`i-GRlGGvf=nM?hZ#T!K~uFLEX$N*~rS1CQ+p z7C%1#BGMdR&T!zvh6&HXf!h7(NksN<+o8a_3*yB?pAMx_s%x`RzYTrq?30Bk-UHG@ zRlI^$mj6k#@<74c^N-(-Xoj4UN`XJR4mnx&8N}TgH7{NIjr)?<0muL58=2QWfF801 zcn8UiYRLJ^j>^3D%*t8a_XMPc%H|A)`t+XBufO$>ML_@IFHunY(!3|&rvz6_*+;jfI2 zTy>VjJ`SJwPM3;4&L7#K(mes5h^}#VMkY@rf9#oDXAQZ>IZLL*Rd%x>lm^TlV?tZH)qdp?R(D|gDpZC*MoW92whTca9%N}Qy zP|;HO?jAbE?2#Mk2c`9zg*pkgr^oIX-a9>HISpB_ymSsi83{i#LD>`OZ@CG5SHwsk zp@cY!8=<8415lPY;oxRV-*pD?@*g%oFgaOh$4=|i*R9+{=n%>t^E9d`)AH5#exa?1 z2ZJZJl!X(Ylb26K@1DQYkeme-({;nveG@L2!Si~A^6eG>66xN7lF3~&zql=r`5end zW@%ac4+f%R`;USKOp|@<6T0c(HoO3u&=Xp@-EJ~?TE6kS^n13B&3SoDbQ^{eBUT=)>~8-+=f3yN zc@QY!ED`;mT8Ibc4*@IC!8?X@DkOecb5~~N;n&fzOZCO_Go8a+x=%+Ssaq@GG8)-| zE7@%GvVwBE;fz1wbqrP#R(^v>clO8F3!%NivF}3~Ra=X-H?9mr%_m7!XJ?eLzTFwi zZW|fP_scgvs~3i+*bvgkaVhSf(ONItNG~-WT69@9?f0)|#~8m6;y;at3bptg$(-ao z9culVHo_X^UMuFm(n&R6yj9+~t^bU+6T;QLC1-S9HZummu6=rW8ummzO>SxrRGaxW zZ-(v{FxysN1(oxpmlL6!1r&`q=zGY-J_5AejCN%lLf4EQ!CC?8LeeLaA$|`FG+vCT z)NM<<9c`4mlD};lZC+>lijVuzn!jjxR@S^{ujlb;8P*KTfAIM;-8-p&(Yo@K>mWwF zliq-+Lt!VHXhY{tAAG`v)>PJ6;rL(JYdd)0{$-&lWgHGJHL842CKguE^y-$Y*Tfx{ zvyZB8>`p$-((vzDFQc6=o%jk>QIX56z&nTGTr;8fG-%mz_da!#J;M%qSAAX)B4Z|X zj5M1wT#RmhihbcmGKiYeDBb$J{2)^G`X(9sFo7u3`Ir|<$1reb!@n7A?^G@&c#o*H z(BCTFRgA5weR0#>n%>;OA1gfJ@;5(Gn)Ny(HXnL1!0UgGYG;5hmii=ON`bPiBbWAV* z{K~;2k|g2!tS%ts=Xt|Xd6y}K;HS6uisYSZmEVQ(hR@ZPBl?`HLxK@bms$tse!dmw zN}b3!stIcG(juoO)!U?Hr3OxUi|GIQPBE$jeN_CQ^4xH~{0d6FlzjBvrOZKnYJDAf zqfzA>NRSb9cFldV^1Wl3K#J(IQkYsl*Y{tH>gaY;CGHb^>jqauv%OUJRq@)p-ql-7 zBv6m4XJX4`0L=koGvJ?-W=x6$VbKF(}K;{^mL zfh@r^H~$H&hhLRK=u?$%*6QS}!{E7l`^Aqxe5X(St&aD4CAZ;5$|O(#!E*$(C5Mb zvK>l91w|ITyc}h9%EGANh8Pu<1Y01AFvm^xX?#DxD+mt9{2@*y-e{eozB(lFLHXmL z@~-E79~o0hb6`FFRjA2#=bgp1MJ30xu`{7!*spIl#=8JnznowMY1E=869ATw|qT|h_u=Do#I9~xF((_ehH5iRyXJ_hUX`6+M_ zIiv0IXS2nATc0jtVimkm;j7N5HeBF+I0?j(eC;jypY!xS^50!9Dp|GMU^t>qukMXF zfL&x?;=n>f4fkCKFXC%Wvu|)%UjL`%RtyIJhn6ar;l9GR>RkmD4s=r7xA~<`nN#c} z#8NPepz&x&Kqshx1zryG*z~nOgSV@X-fg76mpmE|-Y~HqANZ5rksQZ$cfRiFnKS_f zo7H>B#ae}Cs>c^w`;+Z}Uz6*y4pUB>UXLwj#PKvTyxll)r7Ek$Ry$t0=@Yw0Z>C8Q zUa1y3TVNJiQ-qH-YvvA4nkSsQ%C499b6WonmQmFlawGlBtQ%&9aC%<7(>EC9^PCRP^C0A>XXb88b(2M>TA3-l5YD;t1|hs^-M zEau>9?*iZeFw0q+I|K9ptkAQn09MYwH#~nf$ZVj$_6z`mg8$^h{^u_LIU_L>7ZY0t ztABF*QxesGPx0r@|D+Iumf6MH!Cu_N#R5Pp&dbKa24Z1n<6>duWMSjcWnrO#F7KhY za&jW)9{S0Cx7j zT8LTF+R52P?1PEZpCiojCjYSm;sP*hS)03j_|q#KTG|o?8KrnhbP*pC#7*ekk(wv8(0idyyq?Q+oFhJ44}Mv-Sky&@sTJ_4v6U`v&;~4Wo+i zH_ym`8;#O^bhr}~=5NZU?e*ITxT!}PKH~m53ndc%WsI)k{%RUF$I4&RzLw2*7$9D%$ZGmizh8s3ic#%CItkQ3B4AJ{z4hk^(D_KMP%WNxjaGmKRDBdC z67gP0;poIpnvqX84yQ9v1VkHKl!HUwd|k*YE5OQ>od$E{oi(Q&##DR=4k(`o%u_g|LORD zDayYD{%-|PG_ix4p#NS!Y)!13{}`S>iXsZNOvrkSoUA+mMs^M!04p1a4ZzC6&I7ej zGElQ(Z6;!GWorQyHf9lLGYhCj@^C_>>`!)ob{N?}JWx|+@=4ml+UkP~GU$&8s<~L$ zY5qx}{r6D-$DfNt+^qi6DyWEqpjOeuJ}WER9}WKBM1L#O(^!4_>K6J@1(CPRkzxCooHl4qJq%<|5FjV_ zG^a!%M;iP91B(snM1!RW$eU}CRH3KSC|5pEjT~YDphuV{{nnNErrL0Nfe=KmbcqO3y!^wkHB>^pnrZad4^&4P9iD{!Pc&ExO zZ$Vcq?6HiBev}(wDeVDCr6|+!`Zv|?XrRaPlN26VB$6?`4Mf24{xtADxnU2 z=5YhkG*hvZ@Yt^iemzFd_(ygztCtsSh7eyqY#)4Vr)~tkuj?25vFqt}@t`M(Px{%c zLf%4YKj6Epbf8e2qT|jSaZpJk>F14IJi69IHGbs)uDng5tmIBEVQEeww94625hp%G zDOf>aeE$k~9z=@MU~j=vAbLAMkt~O-)W!Vd&CU{_Rrq!;VRdiRdYN*mfG?w%ar2`z zm63wzBd#%CHMaI^2886-a{g4pTr4QNFuXEhw;ousF8HnIYOJXG)2k^Ef_Otr#TNSL z)|gjt;Gvy3$v80peXBCVVDc=bqxpA^I`WF=$8VEvLBnHrcHy&F46_to4dY!a)OTr|v39K#ep zkN8*cuK0+!3&0Za8_OhOWej zDi1~_hE^<*LKd?(j6z%)Mu}2WXcJplNhl9f<;yAgIhJRbzBqbUD8gWg#G)wsF#ECkF{Q9pD4s)ZCA}D)%GD|FIlV|lyn}DC z&j@-0$C7R}_b>c|%4lX)DDaq$3pO@u~*x45jA@3n%LSatCXY zqr)fcGi4F_rzIR#2<##Wt1FBzJ}U%f5sx+eOO9#cx3?B3lFc~zi~c4;ovBUv2cRfV zsLZ7rv#%$Im7<)t5hknz%>{kOioB$Z@_f_RM(SwLGljMXG9CGdH4BiWDD}Z~a|Je# zebNBBGOZ3t@4s4&khURSJ(u2p*J1JYS}f}BO_WpVcal8P87`jo@dobY$q^TRxO2HU z8jZ<61?0;hhKultdZ>Y+pC4 zHB31Y4}1d%!Ox>Qp$tHvmctgN8EaDtz(t$FTZzz&ZcaJS0GLc%bUdcziRS)p)=}6a z!W>@E5hueO1FS>;PEiYXX^@M0bC-Ih!XothO459Mk|vih5>^p@+=e>33gryArQjd zp>C?hDG3XPY!>Y@)>p3D>oupA!w>0Ad3V;XF|{RpR)*zW0T}E+kf- zJfM)A;hD*EViK+p$&7s~2~`>ujQ^uG8X$62toNv&J+gNw@-~iXJkUYz@8&VOE?|e9 z$ny~NeDISi{_hHCPOh)*LDS_wAZ`wrz_Lc<>k6qhMksBR9i7)h0sevmdkYnN&mlSHP!jZT1ely;DI znD&>qqNo(xl-uO+n9f+vm~~iBVS+t-VUw8T;>;9ZPV>u9u;38MD9GYN2P8HDZHO3+ z3ZSm&IC5Cn*i}s2&p@n`0Lcjds6cPn2p_!78vufc;cHLAO?LpZe;eXC46PT&z*bwo zBjJhrW86K7(1&@<7MF#PaVo|GF#-oYGS#Xo!>qe$k+D4+gWcE>Bnbus?W`DS-AGn(@vWxoW-`+6aT(%B=$T+KARn zmZ_*9s8|u%$`$@q4y;{WWcoYEigPExN=j&5=H|B^5pQt6A zu!)n5CL53GvgvjW!S7#2^xy=`L)VmGg6S7Ax`UUn!qy+M$?)I6kT>F5PoF-T47{NT z zMfAyEb1IeSszjz+BM^hZ<3bt|%|)JeAMarqJZ%w8u!+-a9l4o!ltC{i*5;tcIDL^y zpjLdj2ti866X&LGZM?ozB@I^`Sv>I|wG&Qr+M*~Zfh<99&~DRhe1l|Dv6hOoZ_&N$ zgi)0ir8#m@?wAJSm7nA>^-bKvz*y%K%J}n}P4ZJQG8Z94LA^nx&Ktw9ep3NqQsBZG zm%LjX;=GKTNJcK-S_GJ8(Ec1T94s)N9vlB-)A1a(ej{PLR!PQpgl6seIrZ&}b#2aL z1izTCg0EOM+^|OszY=;J!9e8Z3ew%QI1@u?%D~CMu<=KP!IQ!AP0n+Kb864fHo0X= zKiKkzL%y{tu_!LU=)#%yiCBeDd@T7k?Pk!Oab^=B_GVB@6&->6M9gn2x zr+(cN{L*0iq~Gxk%XZ`T?s8t1M>Qmi6~W2}6?UYsSwe_M!@40$EBFr4p@3ub@sFaD z^200B5R|hE0Y<{l4v%v@9+=~w0b?egd|uBc_$Xc7g?NiSOSV%< z1VFH~JX*Ot%6>n=X>68hRx>J+Ilhh?R)#Y5(F^2Ja-;?i$ zV{W*MDi-i!6(yd_6usxb>ytxiP~}qybYu^-R7G(8#o$FT0>WAk!sLP!Wqa_}B~F0i zXI>A}%JCE6bH&2%5q-Ze$$?*O4@;h4(-kT2D8^juUCo9u5edI4h-3g*CFIw}e&5N} zFJ&n^KdAfDR7U$aLtBFjeNr<3YybA81Y_ogsQj)m$ir+3p%yISx{8nF~8{+ zg2B;}rNZ0VigC;ZYI(?7Q`u`5YawU@i=m*Wpr~?ZRLBu$negt~B6H>ZbSbc|uBrZV ztXxjCh!&|43}+rHi`HcG9c8CQ>+oxHgL=!FQ%2F@sx&xR05tMBJp@0vwdEn5Xi~q@ zcQBSi+B0|y%_KN6#aZX=kbEWdEy=@a^LL3q!`n-1{AL0)$PvngSlovo2O`2|HrvbK zi^b@*HrLRKuN}Q>Fz#k*b2}jc4P)sZuh541;hUT{Kf(mN$NIt-W^c0N-o$@KHNwFk zDC5p8Vj+=T#Gxfl#N6L;s;Sk-!5f766vX9nle-{;Umy|o_Vg;W85%;yoT3NUl$;ow z9A^+=>FYeT`=s&X$z$QnX$ahC7t9Bpy)hhoe#~Rki{(x@loU2}Mp8#EQ8ba1f+l7L z=!*e2u9oFwjPa{=3^Y-yWL8d>o8ULccx&qJ0yf0_034;s+HAr1NcW&%HR3MwPbT~t z+~cs;o#N?|+TGPKwQY+_KA)v!4u6moj@D;U6(nBPIR!z`#%Y&};@c(Ux?(!(C5&_A zGJUKotLHHG58Q7UkFCCKf`TrV1N%EMIKCz#@4Lw!ikp|XX|KsRT{~KP3w>lf{RHan zH86VfI;8qtR)xgD$4noNXkcEa+B)mplFZ$gz#EQwVN(Fm?t_f8zoVSc%U5Y@?bo!D z+}3&WFu0;_dGfcJCyYdWmT*JPAV&L4^^OEKxKQ;D4|~6#neQeg^a+)NfHRql73jfm z?-u#Ux!;e72v9N4L}*&2y6`+KMlLc$n}ziL-n&o2i*5ld%}Ki8>$)8m{*`8|(U$JHOa^5Gial}nhwBdA-<}!{MnQp$_r^XiF}8>Y3mZW3L~ow$ zVSXK48t3XvOMgn4h@3_#pm`uJoir)WMAO@vB85K(YyL&?HGwxHIaizq^`!xiw zRM+<$ucNvZMkOjdnf8r%+2+Q030TF{y2#Mf+!>Lak9E1V<34uL-K^hN|27zVJV^B; zxgSpZ*=0ahWQjZ!-j&M1wj1JzEMFO0@XNOv{Y{;I6o;NAFyX-J4$BsFVkWw1N3YBDZSDeDEr^iN^U(_M-ca zovSP;h1ZL#J0R2umZ?BHjJKdYGM;Hl{(dd(IG3_2&2v&hnTh8o*pe#X5iB_Y#V%ql zGd6|3I0%`uAmIh-C|Nro>HB(~mW+njVpuxm)BEp!V*5e;VLIepS|&#Ed!l^JsV6jy z9d05bzi)S>i7xV2;_8H%l3%{)k1UFY;_jFpyM`Hw>o!{%JNyt}Ix=T`VPF;W?)nyR zvJ%tZ9&&zp){pdHh>1V(DR}JE7-I>}1&d1si?Ral3P{rBVM>KQXYesBxu8SKeGrJ} zc0~w`^Z*10q=skBt!4Nv{49opuWMezCHzuRydHXLU0yK@g$v>m@p?#A>~@ zwd*n4U4wU1O@pE%t?(}oaz$G>e>9jD zkYL-t(0=z`My8EY?clxR{sQ0PR(7L>c!@%kkOSGs9T5K|>BAfap7V{&ed z-Vte}ti{>fqyPi+m^SAJTS{$Xo?WJd+f|f)zBwdYL`?>C`^j#%hQR`Am1CNC7zdd| zJz|vw=e)!f9rc2Nm_EVZg)@_c^D6sTNg>Co^v+4pP>15`m)IY(e5SOx_TLD^X#VQ> z;Ao6npQ;b1E5C4dvW3mCUtG%Dc{FsMOei-jr~g$6=VQ2hcJe(>)51VH`Bu+2+tRGlYuHnbH)8G8+aCE_21SrSk+Dy5IEgE^CYM zil?`WHgOTBe76T4tgU}8oXPGDDHl`{v~$Ud%rXw;gHOH8onu?pPw$0NeM%9IRowQ=pAk{3QyDAvVVg})3Co1nz|uXP`dyJDDaagc7x8AhPQ2R(QCp&e zrfN#NMdfJa=?-UrLP}X!m*xnQoQt>9qP3K%Nq8>6i;bpF`y;PztxASb$WCVwvWRT( zJ|xe?YwgX)C!1wVJree#TSwCw7J*8FFU`n+^-TJ@s+I0qTV!M#*3XHyKhRY>vHe|o z1(WB^NmGxU2b^p}eSk@yk&9O3zn6tE3igR8WuaL9+DIPhV@!*dCt5DJ`+{aS;&lC3 zjwCF^vY*2dJ~W3ZWc@Z_zUBDwb_Q~?GJ)P^H~Emk*C*ucX8ZQty-3P1k6AY+rTef_ zzdNeSva8DiNq^Ucq93(){nus59 znyZTzj&APE!Gdkj(8)sxqs~y2kDDf)G0odsvtE0|QgTd|1h7lJ%%!`8TeCy+*mvw(CV?PrG@V_oI}xM6|7Zc_b8~ zT@YFi7ARQ~FehrdTRU7oG*uwdv%rkbaa}^r%L{Ie#ykC3DO1uwEsG)nsprr!jMZUd zbWXgM=s}u<$%?s;;(jDHh8N(bgTRf@0_Tn2MpJXX8>g|3(p~F1^iGghF5Hh@xVwp_js`Sswx(^} zno8l7Du)s|vCfF7!>bdi;-K0@J%3hHoJt#BTkhN{MXr}l>H7(fG*wFwT#_gV*4FpyJ1QE5}w#`DQ0oZ~T3`OhE_ za+m!VH+cb|4KJ)ITF=dETf`u(S8v{2Ak5tooT6oN@qQv5fqy8U^NLPOEqPgCME$s| z-dK9!H9WMQ!8bE3H?)4C;7v&*tyT?V1#p&e^n~;CEn|i{scP4p)$e^UP7{Rr9X z%e3xn35G_Gu*ui0ly%5%YV(?h1j4PLDhhmC1pTP2SUDLd#6=FY_j3JFe07+dR{pzg z_~PJPZL)5{)vc;GK5K1Meh|fg^(K1r5L>HI8~sH%mXe@f5I@WoZjeT8P~l8dqj`vI z1Ky-`cY_Hhsi%OB*%_(U*mN_9QL?q~djoZ)9Mvsn zu;%3l?33uXA`%HWFbqmwJ)xT&7{;V~J7cc#$chi6(e5FZ4a~q= zjCE@f8_vz!M=YfCe%oh_@zKFv)r=^^)v9Zuqfr>&qKQK5i_%oFw#(o~|FA^0 z&uh*;mrUhL@hY&o9=S)c>XEBXm}ITxlam7@NRPTvh`+*{`Wp`Y?T*Gwo4i$}!cx8G zF*y3EnF_@|bEUm9gt17VI#p1&y}Io~%UELOthNm^-Fx?SFoOI?lLdzAqTrFuB26`I z#{8`4Bv2zRL|0$a(^9EMu$&^r`Wsq(BXOSr+519%8#^o6h;qOXr?_{aXyP8Em!JUm zlQo%}$0db_SvW}-F(ItN&Il@3ASI+#z&JyV-^vs$l z%O#Pe7gzSBFX~tL<&FtIud+L4+eX6eu>8frW%<>I)>MU!>NS6og_lVwxiMC}r?P7KPfXxPwd?^CmL~75HY57OB~)d3R6er_&kFQTAC&r6Z({ z_gcSish^pi@l;W)0x#Zox?%BMiNG1{+0$EpZi#lU|J8Vt6HJm2Vv~K8ne7S@uyC{g>nJwpM@1dO8q646hlb?ceP*#LmKXjite#n z283Jkv-2iPSt{dMme_h*EzGtE_kg+9jH+d1d8!=^^|pZ9%r<23SErj8QU6`*NQlLD z;zVxwXCHQj^hE3zGRum+YXzMjJ|0_2V~B4JL_(RBkDYh47{1$R`i4dp5h`rNx;J>y z2@D!c{z%GB+)r-Fa+8YiK3gnH>s0q;*=)k>6*kP6n@W23t3l<D)bc9W=I?rd(03;{_1~v1P$o$r4+zn?Tw7(X?-TdPa@{DSdD%$kd_3 z#=#hoATj!xD~(nc%<$H$6WA>MVh=pkIfmW}_>tgBxkRqc#NW%xS5wLk5b?n~SC+=E zC^T2Z(NxuW-uxD1y|Btad^W7>-{^|@5J4>oUDv&8fxeZ6CI? z`U!m;%i1Bsn`xPRzsK6H0TP__Etp+V8}pETU5y-dMB~%Dj+lYY7~cotHE8S3*1r0(8gg)dR8+{&qlxFp!a2mp6FKX64Q;P z<#|=5bEylzma`{+Rxa`6DvoMsk$r7}Dl%s0ukrI$3-{Kgoi?uzvEbb$1ije74yV{*FJb2H zFzE3lv;8R_R{5bPK+thLUb~%UCO1I2j>&5+{d9k*^nkSaG~l#s=!{j(QOUruXvuNT8v=dhq4BCyn5~9e%5ds!$yzlMRF^~=iPvFt zzh<|mGcvzXTl2QVrBt+*ni|aI(xi&p4{GwP-bn)C8w~a9*?C zP)+?v@(y#gvWk2Tuj`d$jr;&BbVXM7MMnH8w?@=lOe(l8V587k(g!U#zpvYr=yRlw zb66I8V;b5a5Y`Y(4119he#G{nUkf3f=n74`IQjy?JLK2vTfV&k6_@7~pE;z$mtmUt z#S{&>s)P60lh_;|SHCNiUWezNSJY;zk4?oK$CPHTdum;8yGOvimw_3h=a7+g(D=+! zK4*P8TS*q!xp1B^y4V;A9MR(YhYG zG?{=yOJy+kE#b*B@N7{?seExO_++e0F#12S)gSvz&rF(KSoU zXl$$u-ZOY;X4J7NEU0yzOWQ})ZxZMo;pE)1hH^1Y zTB;9BJI%KQ2qQDNwq+5Fq|7IQ z{neb2QQqeZae{3_L6u*Z0iu&PHgGnr$yvguV;w}sI^N=H-L;Ve>UH{R)$| z*+*UJCBD;dXou``l`f_a!d%piC>!NLI~%QmXLet6Y`g@t2GKg2r27z6N^X=1y!COv zK!#qA1pIJ`@gwWfNdLAG2&$WxY_f?WB7Cxp5K`9I)6!Y12&J#>mUZNWm zn7!mx`38LhqH=t(L`8Z_r4j3tgX4OLqtY8Nr9M`^_R4PF-pnFtQYQ&Nr<}0R!EOQ| zKb4%i^-S6gjSKP8^YP9!Gj)~o?E@wZZWnd=uQ#`<4B8y4l%E)c5#T3QH;M;?14Z}l zUe*J130DWtLThr9d_?@WHD8lSW;tau^{*xQsP+n$z2fYO>}4&VPb*6#wk(oTm9WLH0y16V}|0hdg4)ZQ8R% z`yP4I&d?7lgRxknqE%IAwu^v0UBbtFtY*;^mBf=lrET1el%aXQ9|)jC)Gpu6>QS1> zIiyCe~S1YXl6F3i@^ViWj2WGwC@IB zil2D*k|v13UK5gQlv3P{gUS*xI;tDvY=l30pRN#uCCCaK`loraFbKJyWVs{VCI#%V zcJ8)O>37M(n{*6%&eR)c$vl+WSkA;`BDpd${%9XBvYQ;>`+6VvM@T+_6;}y_my+ zuD-ABIX?Y2-Zg)<`akXTude)8zx>@#|Au=1_a6Lz1Kt5pz&q5ZgOMHTgu%+j!2$)m zvw;kd|9=490sk%F9hn0Jh1dTJ@Xp5iKLOtVc)t86f1Q7Kh4}~Y4t3Arfx_nhLqtGa z98mQ8|Au#;&T!XH*!kUmLSqtyg@_m?sc?!_hQ_^58zT#gE%FY~L;W2)x#a7>r+oE~ z4c14MOEZcK6K9xq5`6Wa7iNy_W_gN>8(IYf8V4R)b0Q;c#`Zj4JcLemCUMRoC+-F} z9>-@qrAzx$jYp>)s-Bndk(eLn~Fl# z&kV^E(Hf@x=^}co#vL1^l`96GL#Af9s){_?4m;GF+G>lvy;;}8?mPCgHzIE^7gFH% z%S)ewn#>o+wU^W?S3Shqzt+B-mVO-pScZT45hJ4AgIJ>x*5epb<0Y9a6-DZ!Hic$@ zvO)7id!KfB8E91DCz3wv4*SuUXL%a`s?hpf7wx44bA9CE{8bF*uU20kUvI6c6wzy! z^WkwUi%eA;kG|8y0en#Rq`-aq0H}?UKcp$wL3CyR7uVM+N?){lx=X}Myj_u9%JI-# z45U~@_BQ&yFKot#t{P$Xa8>@FYH$VKQ@|hL#hZJ`ZwAthqgK9JD|tX1vX_XBs3sm= zB2FrkuX87YK8kv_-+}CGLACQ8MM)4Z(7{}VMO_HQ22?&*VLsVal%{}_foDrJ$6!?# zr67>O3zC~>FsVybV9b!PwV6||D>YRcEDBKg5}gD6{z91>v0{&f=!3Rwy=~iUM=jYy zqeB%4GgP7ZBv!w-WRHZ%gV^Wft<-ufi84e%aJEIYj&+VTgH{Rs)F}{LkRpi3mb#87 z5&{I_%*z|IXDfg**yp3n*pne|LHYBUotC&6@wSrHgrn4v3e?018I$vV;F)vO7+%<+d@^p23h|TSHUlR7j+)q45QO#?Bo7 z@HQbxsm?P3l3<%{e8HX3KgU0`jhPW>OKNh#k`X$`Kd}8O1ZRan+VKx9FTw(0X6HP+^J0Sa$2wrrDY zO0CrTE#GHQ+2YrgTGWLppk>&AG;HbS)vJ-J&+2prEMI5b*>2aQ4Hsob$3~|>=54pD z&#K>>sSR0zGE6~rb0g;LSqfMg*0#v=xYcPxeUQFh>Kuh-(mT86$xrql#?6V_*+b!} z#6T)8iXX;d#qDtIfb*C{xRK`c5(hFf@fB1$I7HlV8k(W-+aj9r6+r9UTFZ!ZX`=Vd z6dWuBXhhP<2@LskS3p;woY))vlI9?DRvE@Y3UK=P7jN~_qLPRLa6tf2c%4Q^y7tR& zNbv{KL4B|jHd%PerY)EUND5{HtAgi&RKQ+fowOx*1dyhvD$d4e&e-z~Sq52j#yYGB z{9SB@LcB80l^2);j0L6)6)E%4$e=f5$UET=0?T;f&0#pnl%RZM)PvmMnyLA>;9pb2 zgur}hNmVOK=@7M62CzIf!r&gTTRH@sDQRF8SD=<7Can(coN^@!&-y(t4IhsRBosEK z+9TT+!ik)Y1#(XL;pepj-zUmb%jB7pfyKeFbain(YHTq*^4M|~tiWGD6?IFBa9}v% z6@A~YZm}m>fC*4imWWnWI*3V@YY^#2#Dv7JD&Wt!cg3}Ss+a78LejnzcdUuJmIvy- zh=s|b?Zvx%U+N92z2Km&t>>`#aJlUsiY~{D2l~;J;W@QZXH_L%i(uU-oX=QEVPN`sK zaGUTs|Ddz_mJZm8_Kssv4X6a>7dhvi_KwPvl0lDuS5PY@OAHW20$)VE56bcV(H4_+5_oIs^*YQ8=Fsf5`5B?z~+DN}RH}_Oryump-F&s(PL-(tnkU8FnYJ1J7d6;fbdXfsF4vsjHZeMP z(=iSW_-)Etpg~Wn7L=$TO!u+m&IYUjq?gf^PM1k9Igqqz4=5l{)DJgIRSAy<>m1o8kA#KLb4zh+AODo_r<_$3ZT%7yhL ziKZDur;?X&v83%pAtaEc4UHV{i6IhG1`^S;G!~vdNZ^8UQ*f zTNNju=8ygnX0QmDR5q@hBS^eZ5J4@+dMYi;t0o>b&+Uy2e4Mt-eZnP*&UXITRGh`@ z0*8TGOt2_e9xOf)3XCTLD!)OY+K^e79s$;H$%ZaYD&Q{i0d+&31 zE|_CvjO5Mt&pPJ3dH!#{NHsm_h$a;l4HhME;~N`J;YUJLEDu$nRa0UPPgz&v$_utc zM+#T!{HF+Mt@}}Ug?ep*`U?5lc+gj!4e?2*`cDKgXS!`kEXVm>*~u>Kc>OKxtx5JF z`N&+f4~;x2f6(I?S(<$&Z;~&StM79A2GzRj{gfr}{g5RCXNm*1 z(#8#G_mezo+mWp`@PZ0C#zUUH(v_~nguzsZWVsxo04--{VeLhBmtWoQae#V2=`NEz zW1xC{W3iY6V>4u!FY0ayZ`j@PCF&G7{~DwJu5LL8!YhV0fFV6#*J@yJ`O!`Ls&h6q zOUsFdre5!k;xU}vnzVnXC z$NUlA08WizF(Z|rPRJO2HUIVL{PXh2m$pL^5f;`Xd_FIh8s3*Cr*C1Xdu$=x&cMnfKVLO}(PYGQ{I08rno8kj-uFEFTZ=cRZqD2st!=+w z@0|J?;BZfCEziMeH5e^~232tS-O(L3eYVGru#U815|3y1iUgDo_08KMoz}x}leluV ze1JpdfO}bw!0EX856jA4r}KmGI&(W}rOh=BrTD(?T6}3<_E;$exmj{etKLX$t6r@6 z%p1qTHGLZ+cd{Yhu7)q$sgz6K=ubcFaR zvGue$s~}j_3aqJV1&UYI>kV2Eo+mABV5B?%_0sk7^>?0-C&EYsnGJ>AvOe0$A@^~o zMe>rq$9zoW93LMTm%3P+_EaV}t)zM!=gYAP#O2gJLpo# z7j@`75GFTtHDJxAyp8JeV9dnx;2K8o8lTXxI=$UUuIF_bt75)@2W zD;u1YcJq!B#}V4XpR?U|#!XLGrT}gVjvh*P$+@JWtku5-icmY0D*FkpT@aUUq7`7*n=#fPQoZi@dRM`5?UqjF9!J!wwtN#qfM%2Is}X03gZN4=2eLVT zND;FGNj_Z8n0g=(3r*^)o1-SN?r-4 zaSr5>;!36z2?&RiaWa-*pTl`LX>tBN1Uf02C5g-c=D!MSb z1tKHY@n(LD~&}rg@Un7)CtpGO1h8 z17{8lE1vX0&I10MN0sW&^Bw&Gu{qoSZO>FIixBD(&dOGT$Hl13_t8&e<^!LP~U(#a_N z`7ct?)_Y4azNeh2r>-VANKv~ha-F9vRrA`d@uH~c55M`=GOaZxE_Z@z2D}kO1&`FgtR?=#c-=)6;L>2FZo<~WJj~oYQbx! z7ZU}{RZUBiS{dQ$&83r_dM5k)L9F%-i>i6|(!!X0g6HMOe7-a-r2{W7XT6^Z+X)`> z>p+>ltJ^VO&Sgz-Gu1+=2}Rtg$scm2sPQR8x$?IN%3MjTYH1rRVw1N}=&g7ntBrTF z+PuJeo?ST8>^&`y-l-pTEk~>W@TtmeC<13HD6lD&lwx)S+qqOs3LB zjz^g{%fjNe?EIY;!mWpBl5e#z@sh4) zNr2l-`@P696NH6EYCk_$u{B=ef^$hJXz^TaZv~G8;L(Rqb7HfNetJUsG)k3K%DC0wKs-BL?Fn5FMH;EG#%xP1ln$eIoI{n&eas5_rzC(!2{mk)+-`i{lVX5-lCI}$#A5;rfwJkY)FYS7$3`E9OK zeA7b?@v2la!nQLRP;o4QY(+}2HqG{(e#LkJVhdeFhfWvJ#34z->orc+*{HYsAbC3_MksYqSFfK# z4(t_V$09Fz*^9F83IQ&N^)2668jjq4TcdYDa<##!%gE=!QsT1hy!=IF#`hn_u|FugCzWX4YPZhSyOUm4b*KB5z+IUgPhR2uZO!c=u-0LaZ>%@j7EWL zHXg>EiOV$lcFn>TMzvt^&YU@w)UgEiCpoGMK0_S#oTbFeqn>!2cel(@)!*VRHb5G{ zQ;mRB-RJM1D1%JV6rqr7ou5MT_d#s5#`%c1+Y+4_R&do)FUIsc6Q9{X^6lxuR~CvT z0SmFx0jbwi-p#0=p`AJ9m7t+V_JtA`!ffShXXkQ}19eH2k}N;JNwe5o-&nZ;)-cgW z=X=v7O!KK+N!BAx&lkG}d3lm|{8SP7{fe$S zoh@|5@tN;)Vc#s115%q&u2DPzJERIC#l{lK;YQpUkUJVkiF^plywE5b)1NDok*BHI z-WOa~k`o7McvucqHB+htxcHYyqMNF2MJ>w@18|O`K$9qDc^HGZFyo7-6EvQ=NYIOM zlZW3*am(mzJ1zeBt{l%?AD0CENXVD-451tl9jAwt`vnjqTp79*6+3EQblS(IBBrQn zHDgxmN`Pu)y3X>QWuYpgVw!@Gm+Sp8%g=n7IQzcQbaO^zdr%I5lJPr>3UqB(S?i@h zdS4S8q{3FlaVjm_jTyRkVd<6+j9d>i$S=Rrqu3$w^4#5=0=1&&Z_?3Wg(^xFKb#Tk zBXLqM)&Rm&J+CfXy)|cTeo$zVzoVb5{K2Xa&r>j~lXNDYio#TsEt5#KR2S6w#(%mf`88RrzNJCs0(}W(UJ3F%p4DO9LJ8 z?^+GB3o?O*izcvm72T{;aWk1>L9I(Vad(AzwGgIum2P#aCw9xFom&0J!Mpc;c$IZ# zN1Zqt-q_Mhi^Y~im{XPH44t^<>9gpY!*tivE-|%xs$ENU9`-gk`K+ic{j<{f@0X<4 z$ziL9TKW${bi-r4PAGp+sf4_hE6XWADa?M;MUkKsc{5DJM)rGj#wPI++B3N+{mcv+ ztec9SHiQeC%i(PEw+>YvnQb?S3!&NPIQc*lUU8QX2X>J`zG>B7VW*OF-NlkJwb+xC zQlgmEn~*(7*8=vJv+dr|@8@*nugnU5G`p^$TQrn{`AoGh>ez(IuHL#I%9vB9YB3gq z^0IYvdoHu2x(K*+x?tNQ9iOWTTS=$YP7CqW6ZXx@LEeocg)vNEYp#uX(unzB1}l~I zFZ5@2E9+}BzMdEuX>edyeAl-DW?z7UbyH@Bt z(wS@FnVuolF1iMhTH~U^G`Cq_S+pB7Pr}_ZTe(zmR?~5!5u*DK@-BUNa>J}+y(lbx z?u_(D%v>l!e^JHMi{@c+JU|Y|ldnpz9_p^i59HyU3+1j?)GmuIHEmw`ihDmFg zw5L)T^PXaBFDBHm1tl2p$BjNiMGP$<@w+qW-<4G}je$8FR4b^L8-Ui=LwHV~=e>xl z8>cLmTPpzgrbtTdU+v~A&X+_H|4@JGPaUW;NLMIOH_zyatQF(1_yUE2FZ`{V8GZd@pM{!>&O1|iu^iV;UyYgu#PW7bZBUOY z@ibX*DFQthHh45lXQ8h&%{XWZlrM&vQRe3lE^iL)Zz114bMNcT!<^38Nb;Z6CtuUm ziJF=+k5Xq5VtST?S(!*T6lY<~PEtfCg-|oN$orUo-^ccRE@2*k>(C>29@Rf;pO+_3 zFwZzu&CP>MH}QRlTm2G%tjXtY{Ai>e-L-Jzp19HNGM7<+8!xn#W7aM0k^!1foB0=yu0-kU*-U*1`JS+O;i84R=b89V;d))7 zrXyf-zQQs&&)q9Srz)t1rH~;}2TVPZfXhPLc8y&b9)@|J`Day)lbN<$YrH@EO+Um< zZYmUamyJc$*Ii^h%Nji%2IhK9s8Cm9zJQD5vdYF>9hqE_54LS_cydE*YUxyC0uZWmax5(*7SqDkAgXiK?RM1@8qHJ zP~Rp1qG^}kXXVMvNaM*V^{9h+^kcP&LW0JA=k7u`D(_vPV;;cDD+O>yz1&Uh;|!Gk z$;e{21~U5Pp=HYib95sEYKjxqo+FecJTKJDbyhI;Y(KV<{)%q=|A53FQ`Te3dQ4f5DeEz1J*KS3l=Yah9#ht1%6d#$k16XhWj&^>f6(${%6d#$ zk16XhWj&^>$CUM$vK~{`W6F9=S&u2}F=hRQvf95Dl+>xfWZqjnB%zjGvi>V(b$3D7 z&`1e@05nqnQv@JjFflXIM&M5kOmvd^`LBTE9~wv+0ss*K?T_-O_T#%W(G=@P`9*`s z9E~Gd0m%@_>5;e}PyMD5+W-;WtA5jd{x}*3ghGj!_TR^WAV4sYME)qh^bZOqIs^T# z!DOIE#w#Ta1Ve~9wZFv?{k4eBTt_wF5398!aWJW);~+Yt{bg)KZ>}Ho@V93{Fc{I+ z=ywe)1tq$L9nk<%M60FWH5mv1dSqSzFc1)Wq&@%)0G2+|E-{YiCii=NMD2&m*l%qR zH7LGC5CjVNs|F@!*#2H0NJa|$%N(FwEQ#(?Ejr-FBLG(zn0!iY zTW42#yDznVczFAhvjGm@zhXF>i>MyvRX$th)vWI}(A}R4&V`M0Deg5@0Oig)kC)ae zrsXa^XWLG9XYHsyWYxFWlS*X~FYj+rkuSFyUW9`0is{!31@X--+Q;lE+nth+c<#?)J{w^a+8r)FY8nldqwDV8`vu~U zSJg>prawRM)~$m`?Vxa29YU?f!sMIpOl+|m7uc;-(ud3}t3*uMH$;)0=*$zalZNq+ zggMcWly!r7-l~1x%y|9H{vW1OMXmtFZ&)sj%W3euhDHk67F0>(eU25d+;(G?q={$oab=Bp<@51!7 zz-r085-82~T{X#YXv1&O$1pSPsFF)%fwo8c`lk>V0{y&6jCC^=u}t%in(e44_o%2S zqwRf|lWN?LhU5tF@x8)4E3g|<`10)=OJ%Y4;S|~tb8q!aWNsJ`9*1^ImqIvmx=0tu z%0zOv*mq2z5_kQkb=7Vl`!MG{@y?hwp&ng8k>-fl9GxC;)NhgMICD|jQz42lLWQPd zYC`RL^$Q_XAMU}SFk{XMfu2sGB38nX1W@5>PG&Dyo@bC_1@_@0xb&b9;9`)}sPLF$ zhjo#K5NKOM6K^j4=}J=(unO96rWqqBho&Ms`{FtUWW=qo>&0In>I5+OcW>-*0|d52 z@XHyNd_#h9?djp*_jHkhYXW*t?8Z2>`J-(}=ANI1flkA|ov70iXV(@UdH^&_46`CZ z)#l;%-30>P3_-i{!jND-!axLk83Y1t?)t@`kYR?fYT_|>@a=N8PUZGz zp-`@HtWeMrn#jqttutMD9&)YssnF%}L+tMBBa z@#GIzE%Ho%;Gi3kW3m(ok69xIW0y3{ON%E27I(&*wYHsnMKtB6QCn6Ipu-iRjo9Jz z{CxeOGkfJfhB2}>{QE!pAHV+O0K;E+py+1%2LNRCO#b$1Z)EL=&-lk>d3-u~BL^EN zdjlf}eCGdH5VWy&{NuU<{+~Sg;|3`sLo+=A8&`Y{`ac#}85r@|I2g5H{s73|>-@Rz zAKa0(w=qyKa>Up8qnMB|KAobGt0TS^KAoVArH#FUt)77q{-1afbYQ?|`P<`pc>aLY z9~J+$tf=_M!~a}{p;J_3#^?CQ9sgB};mlyBn$&mfpczzC|qJ-f!nU?ML6K<3iX5E8GnO~JtR>u1~V|C=R)UI z5bh6DTRs&ZQMHezrjQ=wVyR7i?_kb~Y?s|iC)v%91k2S-CD}2__k=X+R1`}GI(#Od zpMUu!2}F;YrZaI&nrj)x2tfUQ6?O*#1eG|z(P57e@ycPE1>{;}au5y{CZ=D6yqs!w zcrs%Ac3ZFTs?R``*e|sk>MA+?&;S=rkKtQwlMDbRQL{=jjk~PGxx7?cIx>CjUfss^ zR`}!|aer63CB2x=;*ZQy+qS%@pzA~jdLmZO_)*`Lqy*Gp1;KZ?TOo6e4|E3()UfsI z9yi!hJAPmfjtn;9;=V)k*+uvraJDB4+ZT#w8`DYOZuOE>Z8j}&=u&B65 zLTF+F4k2aQ@bekz_kItD+2m+H^{?z6jN70SCApJC=)f@3_8=}l)mU0Xm_VP!T^~$V zGRW`VnHH#~PC7tdK^(FzVvr*?+(3dvpv2a^?jT<08b}NB11)<&P+}n+b6}YLXz4+yb>VS*nQTF~@PPt-MUg<0 zL1{%n%=p0S_<2@szQ9%amZ3L1^y7*u}m9 zq7KsOOMv1VfdZWsR)xa86%vS5B?d+&u!tip04W8e$08J9w?>J^*&TpFgyia_VxkXy z-w#oX+|^gsThbS&UraSfRhGm!Vl_r$@_Y3!)L*PEQYEY4b%tg|&WNHJP}Ysn)u>6S z1zpj*_=$rs-1B`8$JV$!$PWpQ1K;g}*}# zhg3QNRVwISSSx)V!fbRmfDu7F4HOGCGJHhlE9R5pRzw%nNS{Qk#wHoK_Zj5 zoZ^zALz_*eL*OI+RrJvUBG=2;tKgSkqnswL}H|INPdWO zh;>*$CJ)g^ulvFz|Gh9WA+kL(=AQYeb$Wk#oweFb`*#OL(krDkrDqahl5rAnQcRho zlFcIOVrH3Dnal#cIjOmx`KtN*B5irpbn&!H)^w&0^Y4R?kh7Y$F!z=>^T+-(?z04} zbgV9{?^sG$Da=DG-_xzrN7E0}kC}%XOx0lt7p4x6m^18V)w!H>jT~+B|BkET!3Y?!NT;nXXl{iQX>VKK+F7 zMEFkn&H%|B;u_M4@Vw&aOx_;owTOIvvfDCs8@Ufj=0R3FFIK#rsWwG11wWM!3x{!o zu|R`qKWn$!f@2>?Ye*ZZ<7%6`ptPQ}uYUeEA+;QJ>^xvKu(`s$`q}bMg(!g-ClWE7 zSe$T-H4UpBno_M2r&8S<|Ezy)eqGGN$rHvC#q+JpxvSiZ?nUnttxVPOOk8VzfSaSg#MBqcvIfx6I1x^d?%>k2^ znz@4X!mUNg)!Wqtj7A?IBskD68Z$CCA`%gWE`jbMJSs8>SQL>0cmPrW5-F1 zZ`^UJ)4B6IC{2t_%%@-~oh_X-3v764m=_??3$LNlV&W$2r0ZwSrx$D+Gh4h;`j*Ex z8z)Kbpk~~j8vP~tC>lweK@y+_TW?;sWg=pfJtjASeDrXTeqcTRWAuLX-J8Xj#l^{_ z%lRw#qnG8%0--W!sY-LbRoX?Xw{7>a>paE^-%51#W?XnY$_RVgI(%zEE=R7WOV_mi z`e;a?RX}dHlV(Z-!E(?N&GK^7xW3YSJ%vzv_ECR)FMLmiWF!83Tg^-5b#vk=@UpY; zsqo!p#~I3HWAn7_UNuc$O?!2wYDcT`aN;iSuDM<1qDxs%!%i2`EXFXVfw82nQ@q+- zWU=_H;LHyzCjF@M%%k}-b8UEixqI8nXC62TbP$pU7Zs<&XXIJdqLSZgP;X6Pi#c^Ui}wS?QAm8^5&ZFbstZPj^dTmPB7Um4v6?sfd8^-j0- z)aG><{W}vIGy>x7inhz+xAq42sn^!$EMzI7Ht&Qx`={xr!NqC$N`;RfL|kxG&2$k)hC_u7ZSoAJn$`Td}7 zim#^Uq}lRpZ3z-+0r0ghO7f28!29?AF1G(vvw!N+KZLKCprC-BgOMTr-^8js zzScj4@*i6Czr^dma%dRong7|LX;jy6_{ECpb*xgd&+g|O7Y76^J!f`F+(}%yZ@j7T ztEiI6>qHWFj_cw2+4Bud)U+Aa!iKT`iqH<}*i&T}aZlb8iR>6JspXX%=Kc3Rd^Wq! zp>zi)hImubi;8LO7vw!`DHZNMU6E|v{OF{IT@!jytzc1d5lb7gkzA-aMje&yqlaCc zwu(U5qYmLG@wfBt!FiS?S!y5%!^P1lX0%;S$xHfjWQSqSdja$yR(&rf>hB|}&T`I_ z!rnA<$IEJ@iZpZ6cajI<1&DP*yZg9P;SZeebKY5ZshJv~51~H#TCGD#sq$ftkG|8K zzZO^Rl96)Sof%)*Q>j(bPK4a&wil(mTiT}QuOMX^zu64DX&Ad<6A>y_^PD z6H~8&_!F@+0&kXf#;KM$6Qc1YQ3%SGJoLrA%*;Y$MT&NV-V*iB#XW&5H0d8s9h8B% z#f~l`+4Hl=o5*eoY_5~E0M=+*f*jfG=eVF6lJ)cA!C>76o8^O zGWfQh!!fXa4taOyNeI0WRUuKxfTI$YWsE-;dOR*`agn|cPQzAMvKkoOu1Yz6 zIpdk#!wzR-z4UP$ZjfxDI1xX`5}t4e$FH9ams5($lc-MU$G|trHsLdDZ3!zo(xCMd z)pe|yv2c}-FhyyZ(S!PLt151ZouMMtu9S!|XBXvSYL0ab!Uwb8w!$ct6!2t|pfVMA zRRIG8NA&L#c;7_$&GEAh(7wH+B*i)b>yX=6^Nw?j(Wfxigx%~}@Da&W-^3LRKR-Vu zpd?A?amMYx#txt?WC#YYWa5GZY@udK<|3Ae1$LzrKRDY&C@3es9(z8n36rCzupAKS z3_;V{rp(G=?z~|UJ|5i;c^`WQTVS`4_YnqfQg>l*`CD@YgD=7DW=C{}}3l@@lHXsYrd*ZU6)HRgxHW3qCT0559PanXg9LLaYwMg;+nn>DK^& zV9G6EgzYBwIip90Zd8#TM#)bT;##B_<<~|~p0W%+b89!mM&wIiifigc5&d_S=L}r+ zGtYqu5l++9I_@$sq9ryOZ`_&=k6C9T(W919khi};>*?i}D#E8zrLtDK zng_Kj2#7v%MP;mD9$#WRB3y+442evH9- z{E-5YPpA#u)N{7U5~Ub?5Q=LVy$V@im6#9qva1izSqbflv-+(phJ)<=k~hI~ zP`ejP^A<8&AKWeZ9)GGkUtzFLR*ZUXyMqWi$O`D<5+2m#>0QHu%;xfW`!bGh2)QbF z+|*$Q@#oD&+^6n}Lf40kNBFP}HLA{3z9u^TMU)Fewh6lnEYD%9gTVSkMsrkt8Q=NX z2+aGWTLsv~@spEZS(~2EIZzOAZ-`vl#qdg5#`-))GB+!<^s{%8G`~Yh9*23ITg~H+ z{zaF9!%`mv#Uj5tYw2v#_UcbpkQp8yMg^b&g^LZnXSU}w|4R7Az6ws8cjo{`DBh6r z2`CoSsmQ~304EoLEBKsJ<$@Go3EZ5J*CQ~~OZ;*9l=>(iwE`x;0N4b3=a?Rk+N-aF zQa#G00=t%tp10rj#X3yIudFJWW~&}-;^%foZ^yNV!cmekgiU8DXILc4xDT6=w{qD- zvi6zu(#k>jEdNLRnuuO8Yt471C0Cmx+fFaJiZ(u`WTKQ_^%_Jw=3xzkj8gRux$8-8 z=Fve`CI%NJ4AJ05he9Om@$SY}Y^5>u_VDCPB=6lhgC!|7u}W6`?O?a<4eS67-THEj z%2qZjk|?Vq*7SF9NGw%u@R!1&=o@m4j@D?5tcg?9Px=7%AF4k;C;6))^yR~g zPu9yfONschFbz05NTYXiPqwaQvkbMv0{o%AS}FmdTLymo8>>`G$;_JKDYS(1pi&m$ z0RG|?>HtdQ2n1zw^PUiC2}Vhsv+y)JCpxSBajP^BJqE?c4Jf?r`b{*vR%p6TrmCY_ zAE3k*($87}L%^Yj``Efxmi!Z4&5^S)n!lLBjK|JNnpa5c2jYvAefWQu8w~$n%{_*{ zyLtcV?)^=S{Kejb`6qkt&wS_~HsW7%rT<%h@9(DGpZ?z8t-e1h{k7OXbkzSb#A4!L z_@@x7QB_ajj}YtgN+(x3e#n}gV6@IM!6HYK!YTnFm;JJVL%`pRbN)L|f#=EgwMJ#6 z*Ap-gD7`@@&8gU0vyICo-JYr^@_Gan%^6kh$8V)55pk^X=Z}608VRB^iCUeow0Lnd znlkm4jTnIhN|FkSyfb-Al_cboFKYdWZXw0rp#fubEFf&xyPOjgnyg?xbbI*$La2ma zEWP%(??S0Z&s1E!`PW{V;e%MeiHlk&!hxl&% zO9!XcLCUdA(n7b`!nv~)bD2G9YCeksSM~tZ)}B%s=lq#wC6GPW<7KM0yN*mYB-9N_ z%S$!10nKjraH7v=KCKs%+B|Dg|ClPqgiD#LY@yGT4)jTS;A8qb&b95*JP z=gBl&^IOht`f_fXKUp8u19BgG!rFit%xPr}A_I~`c3y8o|0kN9NHb}Q^u%J?ZC(=s zL32hWmXt^$nhoHd!Zyb&6TA8p9kV!}nVpyW-PYUAnWy@ERxiJPcS7AP@tfE9@MN&a z(Nb?PlS!eVD>l${%J}_!{oB5$cD7F$vVcg@jq|*4VXGtU5B+V2c}3F+%ht2)o8E{w zXh^Bg=yk3Jvr3oOFmW(>sg~E-6a*hR8Psf^kby;~?FWR@Lw6OYgVg}XLkC|cds zUTHR27Yj)rg*s^oPD)ahzcHu==p8#t(jOU)g5k!6L#-M@LQW zWYf`uQCP!XNer6ytgiVa3pwH)c~5rgN!vO-u1 zZJ0k>AA$z?OryG1p(F~bs1rgSOyYL(%Lz#Q{^EC89N@-{7K&ylgZaAiz1gn`(;*M@ zNdO}Wmt3gHwtqqH5@iPSr)~uwb5HvKY7J)(q4%lZ?nQ&+dStj9vi6p`fw_Ubn2oaI zQ^u!von(X}Z?t3tsz+OjGZ3^^dZ6$VNP9(Q<#s)zV^XdD*~~qspaJ#~3g|{b(2R zvzv^^{^5uTz^7E0l*uLg@Ik9)H#~u@piPxR_NE{W?{A z;dgd(VEd*q377u-y0s|#@A?7vz%o2&o0AGV2pxp44Hbl9pPkqx#b9B4ZA=W<6rPr& zv5|dEc*NMJ%=Prw%+z1;!LL++0F?w9$?5|2$Ty4foS!9^#2`r~j8r4^s*hP+bMI5V zN#zRtGqQCX+2-D_f-?mIzkUHZ!H=Ot4e_GdedFgi4I=23!8|k)%}MP6M6t>-X#_*_ zb-s%!DMoFL5rhB-$ik(p`@w+WCVwd9x?ue*n^7Q=oq* zZDL^kqZ$5#KmP@!{|JQsGjICe1L@D5|Hy#;Z-MlG44l~iQtV&#>XK zY&N9MdlmY|_=_g>^o{Gr^@7@cd{YmxoL^-*e3?(O_#ybe@lHGh?RiNo3L(g)?Aax{ z(%hKxZQcUDimI=>e}2AbX}msvB10 zdcO`%_b19{N;lDco;~t-Wm1lXe7cm8)@*&(jCerP(TWRqs8& zf@d*gDDGpSGi6@PTC^@NG{33TFwlSy6(yp>ShzV64f+r54r+DG=o>(AWl)t=Yc z?KxhBnk>GoJlZ{iSx#@Vbb^i@o~<3);9r*`GP2@Pa^Da)k4h?HWj7`vu@j@hX^wAR z0$FdNuZw?<+*iJH35S$X6(cFHXuu!b5+@Q`Y@J|_8l#3(0guS86c=sk0Y4(nKm)Wx zO~f<{#KQeV+2cWj0R=Fa(}Q_?0DEW5n6M%3W9Rnazm%&qJVv+}V=sMwmTh*se9o;V zGizDSik$G81A(Y}!Ouxx=tPi@)9x%GTbz!G zu=?H5cutqC#pE$0~e^jD|_*kg1ou$l)9#` z9HK%NQq-`z0@Qd*+i7sH?BsH439_Tp?ngs33>wk~x><&|NUR(S5`G&?=C^tHU}Z8# zZaAj2a@4p~dMUja*?m5CjKvRMKA`$Z9)BfV=(;>Uk{Z>elY^;i2513dazsdTI>t_o z7JYVEe8gQ%)x^k93X31KkOaa9IUg?}N^`DacO(cqO637!?2zCyfexAmm1e%85DJoE zWUbx2<))6W6%)2nr;vi8sD_K>+$WZTTC$z)dg$ENyC$ETO++#COl3^hUO|pqhlo*{sBQ6yl}`~mD}+0M|6e$LkAUQh(h#A<_#^% zcPAH>6XXHlqa?4Zv$4SPX=WebyW$ajImE-3GBds5@v63&VGwqU&BS5Hy1m8xy|KlT zeA3b-r;|+ILwOeJr>x$yp3_JRPb{J}w8%PyU|>P59X}(L)GD(Nkz#8BGG6dULNXX; ztu&pAGkl^@Ws?lIXZ!BE?s-JDl@$(^3>0XP-OUHU;@gyyp_#@6jnr?uDnY@YRa1J0 z=}Q11Yu2I_`gKBJiQmtBfh~Xm`>`dI1ENcE>7ags;o*%>)+?AIjb4z6$O zvt7|ZVf8lQEPUiJ=!NpvM&Z2BT&s-<)BW-*oX;POJfaqB0EOXVVZt#CkCq~5~X z<-d0S`}M=gzdC!QfA*5 zUHRa6O?6g*qO_KO3>21|AOkOZ!C)w_ebbyN&=0egluwFIq9Krdq~GX(19I;@t~eHg zWC0ZDz>yL`Gk!4$N<3(v&8zMS#j&A+vxI8d3PFWl zR#lt_Mj^pZ(S{}Nl{=~@!qx`&k#}qJA>{&(`SWqPy;fqz&#<(iz4LDgbHSgJ*^rEO z^5(p0F!>%P%Y6eUz{viQvR%~1PpSh_t_;+^)F=|=Yth@tLa5qt%#P^!f_K(lX7xYd z_Rleie=zXh!tH+yQ~U+De}e7b>i_=S`Hxcnf8q9@nm)$AHnabVv5c(r|Llu*rfbA( z3?T6BO~g|^nUW&^-9?$gY7P;&O6Wu&{h zu+$vJ?T@A6!8Z{et0w;VeDKv|F9GB*4Os)EZ)XE{n6CL=vQ%%_+t2beZ$VnKcyC%} z9b;?+BJbl@7$qb=A4i0|2N|(>vz*&2gru1;3AaQV0x4|qfbMm4jm`ySOXPXnGi)V6 z^A_SE*o!ZIOy}Um|lvL4L#4A$$VL_Osegddl+#{pz z6r6y`;{9Ha$lhHe+m6{LrAwETtmLlFq}O|!f1((YN>5ade})yHO=L>I98C?{*&c)V zMYLzOGL2^I(vpMn_+9KS6i=Wve7gc0mSJSW#`_f*iQk{S``G|X6euTM+!2hcNc;cN$7Ql+LLAcIdQ z4BXF>rKu@B{!U19aA1qA1$OAroO6xs_hXl+#Ky$ zFyQZITw~})MS?IxeJ0a{l*U-2@P%dfB()Bl-jk;S3cP&C)6?q=i#F5e3{m5Zcf05i z2fNJ5S`9C@U=CNpUV-%PZwSjvAaxnMV$dGVdb>URAq4Ji(sKZ_^_^`aVGWo4!%WzwByr}vtk zI@I4s-zLGfSJMO1BElz_l2Zz?9Km~rXZO*4n<>VqDC0?xrhWlyA7(&8uSH*EWU%<@9}Sr= zvjMbNakfe;%T}*KF5PvcfE^&^IODoPuoHA8N}H?@$d(Ba_OT0>x6aS9E~==zB;@qh zzab}XJ_iyiVR3(AEqA1V8G4OZzbPB#+9=_~7XwwX4(YtQUSL!fK6Xi@AV7x)DKm-@ z#!WbfvMLV=HF`{`rHcc>CYa}iaONou@+gZfCeh4ziT(r(Gi9e*jzR!4d}ZDK_!&%E zCfe|I%mS5Om|k{yo_7fqjWa`BkoG)9U`i@u^x9M|Q~w)=K6*}hTQ+0@so}hcfen)1 zht<$G(NXt9Pej{<53KoyhV4q8bn6Ls&%JAYmWdz5(VvpO5g&SlE%Wj#>Lh_|Nypc!XMJqfP z&4xZ`TP9sKsTpI&zWMf(!cIUrMjp+O&X%UAi3{kKfWw0~aWN2MZ8n1(150@$M>1J^ z5$&0K^ZvrxS3QW0n!!jU>t|Pn_#oFrULMGU%_Nc!BCr{puQ=V1VS>iVJUR5@sxL!F zj>5tCFfB*NtiW}q^Vcz{)>j}S744=&&@@E7Qh-NLK)zwDDIynJ@T5Wa&JaeE;f|8) zv9GFn1UNaZm8J-WYXYu!uyq2v{2TBS2Z`y|0shU9Qy^LRepM@Mv{qD_2-SoJ676XR z7LM|AEaY*B+e%7(e}{ZeuLa>#tsG{~0IT&JrNqomQXKl~So5To+P$m$%CW{%wmqQO zMvQP?@S^f=qAdN)8Dh3f=*d=V!qp!r>h5*~imJ%D0W~iLyl|kAsy#(YvkFOHsw2%Ld9z&7T6B-U=93i* zR$MGm-%0z>K8Y>sMr+vJA!%r8MI{!GP*8uAO+I>2NYAKq>FY;!H~-YZw6O2})xv7Y zs%i}!=Dm+mugHU2JXjJwTniB(PKnEclo1$~JEj|nLz3b_>KKytp?K&7hk|A$FZwPG zF=xXc!1|UVrT4%kA^hkC;P3MN^@C(L7W@~9O+mFe2!$k3eZ~W9cwQWYn1yVw_LS7* zfVKweJ_M=q`Y1h~Ue(QOgOemkdlhvVXfqOSytL9HLsmO=6zuHah4v+4{~!f7C^Feq z>Q>U>Aw&nhklsUb{egrkH!BaIL=V^-*w1zRI>`~5RWb$A%(E>b-8tNfn%;1(O|%k7 z$8{}&BzQnxVZ^Wwf4=V&1nCHzmnn)`(oXLpf>r>`VC%U2k!Y}1q1WGNK20BD9NerK zYEr<0AOOwS$sa?9b_lz9J{9y=C3^Z7eQtJk?FCNakfAxo zsAI`-^I=G^kMx>lk5)s-gmq*K$S}R3XTU83z@$j@CP;ng(8g;V8=A?SdM{pxCK_Kg z#bi=^Hk$XqbM_DDT7^Q_&SrxZV&FnU@iXua8DxIS_H#ufkn8KkJ-Kvc%gQ6uceRbI zDn0!KBP^n4>&SCR4nwCA<}6N?5J9;z1G8(ww+l4djYGodVz){Ve?7t&R9yU9@vKb(ScfkUx(q6Pr&<3?@XjT$O9sK@tdaAwO)0mK zMsU`GX7sO4MQXVc0!}JNRVaL2HK^L38DzGW9|F5U<*@)|MElYigIpKwE@qbwN?Mw% zql{;psszvqn z=yhR~Kjups4BRA12q%xUn#hC=4eL~OaY0UK?u;r{wRD%fp+0`|O_fs0cbEmwN#cTl zUYx>4EG`yHD>Z%;zi)n?YIpv=+WcylIM{yX4vuG^Y^?T442xMVUH5UwsEmkb7h`PR zY_E$4nAQ>7xwRoQZEuucvN~;9{XYM))$34iYlO`ncX+fs&07d6PmwsD)y_TFN(HQa zH8?iH>R22P8}+pQ?wqNLN(aK$`~=~k-54mxb6WJ7;j0?;a46lx$)kT`LO-tjQ2KRF zo!E0C0O;iKtU|5iK3H!y@-@>^Rhrru5BlvQ$P;S zskZB0ne(lgR{r~2Cmmxsp{`7-^l&LZQrDKF_EOlDg3eO0xA5<-xaP0zTD=<}dPLg? zCAlFb`L?)6SMv4toh>3apks=ICNh+b5C>q#I>#hfcoYal!4lvVh;3?Z@)IlcWa98D zD^Bf|9$Lj3ELxZGp~057G=W*-C@w=IcU2~&Mb5~cRwvBc0VPZG%j9cChWCZsH29|} z{>pN~s`AG3?@0%_kSyCSq)^cM>ke%xF}BkDu5%otqd2@|wJSX>3C9f#eQMNumbI`h z*W zJ=U$TJ_-$MAD1&-pE>kR)dSHA^wt-%y{_8mc78X|1`nVIIH0_I!g1AQT{HP|&*a#R zhBd1+I&`2>p2XiWYBq=QaV9=tNks-UF9rH({eNP}V4`nSJNSHaGc-d_ImgQWV`KSr zttH!?bd5+N$^OXC%xUTvy=U?Gprr3(SoL8f@WB$GxRw~|L1cOUkN$r!0 z!+ZHhFsae&@9BxMkplvTxN-3Uep(w+kS?TWHcUm2#V;?{9MRXtgf}GIrZ%eRtULZF z;DaL^*DH$(PBRLmeg%OiEoBzIZV(yI3u#D@i0!k7t`mETeXZr+!bIbz8X}F;v7bvv z?9769t{==dihTV9EY>Xe1=OPCwt^Wf*9fQ_OY@S$gR( zv1i`#u><@&zn2z?7falGS3x5*A@l*nckTUO$CYl$1K&TW`WSD0!;Zz%o|rnN+!-H?@;Nq%pZ$XM`q-# zQP?`72-4i}LgW_ennRvQVoUsLf6T+&PzO04U|__){IeUeKg(n&KcwqM>WKWtypc7h@r z4NwGGGjtC_{2A>aeEOu0EoNO>iaew-lqPALt#2t42D88+_v6kH^jac~k zQ0;k=nueR2K-cev-XfEugOCmmk%|X10G{6jPwy0TvQ{!?Svr%lF&drJaGlMTb*#a! z3Y%Km{W^7~q9~)TY#Q6ShQjK-f@F!UI7{}YVY;DP-D-5y`|?tlK}F@7ba(ejwUhjG z{V}G(*OWz(Hj0mZV+V_j8sp!u_ihJgUP<`h>iRE-{S-!>?(BP24%uh9JGFsR{G3O^ za)hZ=P9C9-zo7*ggQpV3<>V&K;Kv-EKY@&Zf;~y4{u1*4u3@6Ye%dituGk?tMwC)Y z&WH&S2k(N)_*g;U#&4`KH?G9jUC>-++9iHq>zUkK)3g! zyM%NXY<$@$Lcfl9VoN?-+)_cSngY@Jd%}+2f}dsAto8?|z>+Bm6yKsARWH!K%Leh1 zoCO3pGz9s)TSlMVT9-!C{KW;ERlT;p3QEI17Fn%q0OnWE*eW`^?NyuTUPm$rxQ7q% zF@j`xdjR`0w3;!shqND~_=Q(InjJ|8OR_80zO+u|i&NZF6i^+vd-GiYX^Rw4iXynl z2JUDfz?0T@|DF|v%{GuJMqB1}fPQQ8#`=sXnJuhJ++#1!?_$T2-+f3kk>4TA;y`pq}} z9f3q{?(MAVlfch!oCE+L!elZ9NAcUTi-|WwgpNnu;ePhu?s^|S_^zTvbNh4lfb|^K z;l5WhTQc3GbrRd5jX{d4ekRe)x-2h78gC+hzLb9H*O$eY)t*6C>O%SpaQfCjx5#`N zyHjWW`6sf}Po8&5hQcsJv4JoZ>pg?zlXaO53&`aYRJ7N*NzcQqQ`li*e;7Oz1wMjj zq2r{gVyqKJK|&^mSt;FAvwBD>6VhJBA8Nlo%ZL4AQNfTprIqVkB|Y~eNFVY z&q40~uiT=tyz0{QHk`+N6v{Q&eoagSbwPCJFr5#rs60nJy#N=TjQQ<}Y#ERst8S5m zZHM*hPwnJJwYN{N^e~vlk3Lt~V;E@wX#dVK_t4N#96>UI%W>BAlBK_%#-f_mVWHY7 zYPaab>E~AzI-q5?skFYV_eA}!e|V- zif|leCU2o{t2<~B7%v#IolkFU*q>#J%$}nMI(4`PqA65H+C_#4+LAY7AFkqc-J>A& z1=>H-hQ^8Hi{i7esoK%$Y)f)Xl+wwC{zxvM^=Jk@o1@%do5b^$1`~8+O)tY%th(Kc){5DEp&g`_d;Bbz=Pa7C1PoXJiYR)A6Id4Ble%3GXh6alAHb%_zMH#PXV zL7@>gxyJbLkQpY`n#~H%KYy^}qK?Cjg%f3rB!w>irq9Clupn*GSJ*%xY}U6bSZIrk z{fb)Z&@kJ`Z1eJbnx2M}S&+``KbXh|!v zY_>N@Ek**}fj=mvpz0OHT$@suFurlnHNE&-ea5-ux5!0#F^y+4SY;KqaapoU2o;|2H`bg>Vy%Dlg-fo)(} z&|ek;dtXZDWw#Y(WP>SZOF5^AeGp(ebvBGr5m%L($F4ca*5wq5B7Su9omMoIp z_M?TgKH7Ga90I#k>f>7xsMA~Msg?RksW~02(5*+fBY-j;js&h9^x3uAbCy|c{u#+X zo~|T;RtmF5Sk`g9%7Q7wCM+1z;RqA??Psnd1$2LCr6pxYD!d=%5#i^TU`VKbjyn zVE8vs4pc^eY-}trJD_O_H{OpT1@Yna(r8wo&VH6qZinz8Yt~;}7q0r!G_A=U*9kkT z;;o_*DNiE9hxTM3!6T0xfl0(OWq9Wz{ zq&Bi$JVr34RxuzQUzUSC8`4I84tMg16cIHT4}cUugBY?O`a#__)4C1~+N~`=6?(bz zxoJlb+2C{~eU1gK2YgVI(>n`9+PXK2%}HoS^zDO%%d}f4?sOtpM;&F7w*atIAhyX5 zmrrj79K-d+5H>~C4FeG&kzZjWRpJzAk;hFkv8rm?2C)CMXL+k8LRXaViJuV+8H#{_ z;eh8Sm_-sx16+GsGmk`JT9CoKcbJB{60~~3vIzDV+hsS=ToIehA^`)t06>YHU6?

r@xgi*c}WDAgEdQilDalB@Ch|@qz{uO*Ln8Ar^H{i_!+3Go4yHUS2JyDK?_8y zl_ZI^i9duBaFd-e6>47wz0CDO=2-T?9ZZu7<&i>JDLxcWmB#V1pZA43w1D!!4MtL5 z=d=tt3DNbXC>TkCJ3Xo~=E6_ms1qqKxO1jGm1!&)V~m3?gAHy{Z$A@MxmDusVHra* zg6G5)-nLE6wMIX$XB zjGiB=>8>9_7gtMc96JYL`~b(pxbo_Q7O3e*;TAv|qcd;7IF^BDI=nxG9?q=1_m+F> z^^$MvH)6Bd?t0%noyXJm@p(_)8AOsGX)*Q18(qS53ncR6u{;3DWC*$KC!j+7mBPJj z{?7TcN&DejkKf`a!8$;y9BacFkbMY0oxH-&SD_P}VOiTT)Z&q+;84Dz^s{2-Lk7b=tHptb1-R00|NG?yfuc z;9Zal-R2(eb!3q1V294oLr*$rgL&9 zKDc3B_mw2}T)nv55#~z-S=ncvRF7k+h(3nn_M{ys4e=Y{x*wpFe=0bFlR!SEYOX)3 zIiPr_7SSOYpComLT!ohXn0LbP!>FZKz|IC#fz5>kg$*Ji2I1U1zoC}=`Yq}C*+ZV1 zv7Hl3BfF{_uzpI@dLfZP)p&-N8f3#_yiC^quy@Ya{>V*}r{mk-gh~xB*MS5-{)#;b z@ZaNR+nJ|n+qd&T3<=qt)v{E{T4t?P#2Nur)g2zzu&f5@z`p6y%wl;~_i=&Po)HVS zM$dmIeMF4oG77(K9QRr%WDhKPv3m+t>Jd%cK!Hl)WJ53clm|4cFPwa2&P+fjz0Zo;)F6#NHrRYf4Ty0a=}v0 zjQWOzl7GejxZiBm1O4H19RBg`5u_xMb#kHpNr8;WPWglHf!$MA^#RGtL}K8v>EvC^ zrE|Ab`|cB;XROuhJH2;P>aZ}SfJ7DvP!5+{w4Y(~hr{NXbfvuSszu5W(X3)sqve|# z-Usjqaev@;$|{fe(J5Kf()geYG(DQt9&(ROOP4?P`O!P=;OPeX#R~hw%jS^{ z$b;+8Y)+5|zpFiGv><)$B7K_|;17V#3r2?cam{|rj@_+t%U|gi9{mRIN@=y1XI7^s68F-;l)g$r=V%)g-wEvZG;I-@3hWo)#|hAT34B(^j}2P+Qa>n;Y6PQ^Ev}H3 zwk|#j()5)&-oqj1QOvbjVME!#e%W!orA*)J=6W0jw~UL&JA8B^MUsU-HkG^Sw)JT! zU->k>W9Kt{k^VCJK$GY%(&{O$53mq-%gO*EHKM~aR~<45wyx%ts6W2u;aZr81|p)J z;3yxjLv88{4;}oxU%atwV5!AKoknL#Dn7*)8)Dv46OA6ye-?YZ=o<^lJYp_FcuJ@%<}bWH$Hc~e%mk3 z_Q@G_M1T!uoTSc43@OP>ak9eyte z3jwSc?S~aLHZz}(^h;qarmDk4j5VJyVyYEPaPQUJ$`_=2j2tM2+@vMYOO{ReN9gU6SH=sn* z0v-;$#$tN@LZ&J?j~nJ2>6R8Ct6InUas+C$IpzR6sL6JGkktkyu&u8TIdw*xq#vl+ zGHQc9A(Cx?(?Qro4lkB$;3p6bmTqAv;hYtw+iOUZQ7a%o-m$(lpsJv3QC~C^!od-X z;3z2a;r#MJB;|gQfT-}6Wj92fJ{Hi|mJ}QW3x-G;ZMFHZ$UvAlbA1KDE2uimTBK^n z=_N!yGD7Qcu79YGZ)RaR>!KfwX%|@s;4uP8FGcavI5(=Bd&R+}v(h=bZfIi$%@p`>YW0t7LcQ_V2=WSJGxAf&zdw z9~yh|U{aMbnyC~o%Ot<()^nK*VC<=)J|)Kcj>>yEt)dQzi_dZR(1r#(1_LIYN8xRp zAv=Jfn-SmEod=ovt5MunuNq$6Kwn>(}2! zgempMSpvs#UqL(Fo^AkI=5`9i`_`;=j=F%njz&l&ALgkzjXW0N&9|>9>r*m=Db9Dw zgrk87X2=4n$}I_O9Dor;@u}FA7lEohAZQO3Ad~eSJfgCXKH$h5)>gNZoe;^Ad97`RPxH8c8zsL%@Yy{T+uL>^&BR)R9SJs@6mr+e{b|PU?jUB?@MeniHw3GX%J)H>v!zmZDl1|Z zv0BUsfOK>;^fwq#&pXnS^!VvD(uz8+p#ByxB9Nkf7f?qXW0cNWj4EXZZrynQIAS(__Ii}Hp9tx+$SKxu)btJ@J2Y()`+40`L z+J~N8{-%d_qn;Hm|6b``;+*B`$Kz{k^-MX@$Z?!`hOe?&QgNev$Vx7Ve$HKA_Myk% z`^p|JeoL+U%)JWj?pSX!+4{ZakZM|dhPC@qOY_w!tv;cVb&<*rS*h{ycK9=s6hpAe z*C%q<5$$&6a{4_enZ_rWz2KEib#;sE?GQCR;~r_8aOyP&>+Sxff=OZJYu`fKq6#$f zaZr9byXC^*dw{%6KQy#Sw0>AxU)nYS;z#d1{x%QURm`<7l*4d;W0$q?%Dw;Z)L5?w z)6g_P_Eh5$W?wGm&gT2M03R}T?8TNxS)WHz!Nka_@!%!U)!tK~!OQ{Hj-olY6IwI3 z0pY;ol)9Kqn~P_jOZG(~AyCNH!&B2MiEk)2 zp>UT3eb5wx1Ws>|iDf=sZ_Qi4uwK0+sZb7x@H1jrI|UisNicX{rVsl=7Tv z!0R0voopnc*9hQ*RYs8m>lX-T0%k>O7G|57teWH|^S-?pXHjTLf&$3Z@-YfLRUr^fRNvu>2B+^zifLXkFm^yQc^zBu`+dg3(OC;HOIbGkFvTP7$hi(P|`KkWH9pR)~yFggx$ z?ij-V^N(Hu&3tW`EM16b{swG@o@ZV+kvJxsVC;6-J(u|p|MML(;2 z2Q6lFH$f~C-wt`kTe@zBLKg||Q)~0HPkT?>vmtY*#|0@c%sA1Agr2vDP zKK|ZG=K4e-Qq?Hu6R<5wi^3Jt|FTXEs5HtAUDih0@DZb8C5*CS{R{m~WJreDWskyG zXl6*f2wVW$K^ayfSWAgTLq|Ux2u#hc#HdI|2Numn8wH}R@!8&bQ;y+eTR)5u^DW1a zMt&s40u&Z1&fU?**yr3LWp!=1^4`gAo%E=xj4m_Q{uT_)q9K-K7E~KqQmlD1%+fkE zS{rF*z}K(}y-Cl>H+l&N8}P)6pT!R)4jRXrA}PruYslhNz?5_;hsY&3HdN1P z4RBPpI0MV{+H2ql+(oQvK1C&&6?Z``_rfG0vf-CQN*@RtL;IbLe)Y&NxOHIM83ATl zS9!BXel(eioRw=dC82Uqmh_W@%th9u@Po;!3!midW=FpX@gH?x?hDVH?n48m*A-QY zmdlQVOs`8_P8@1a`hvh3tI*@~{slk2lO1ls==d561p|I!C^&R=)VIJILxoft2l$7> z795rfo)=(_xZ_}!p&vttd1_{jV&9E2;jk8`TGCJp?Z8^aP(aUx0-Hqm#b7M6a#LBk zKyW#LTaeBoPe``+?TV9}G4bgMrp!Wk_^CD#n7I>p%s{4b9Hcipyu^Dtwng1;c63&S zxUtuH*E*{r*Ij5;qeOV*Rtj-yc|3OS{M@l7p9kup*zOYz(XOUeDG1p3B-Yg%m<`E3WnGDcT!y{VCC120Q+6yh4x;_;MV9708wCYGy)zRWwicg1qWa;G5NY^H2x-8*GJ% z|1((A$}^hh-94NI8W8zCN&*Wlz+)y?NdHdBp3Wi5Sj1X9(IUB}h0Ny_eL|SI<$qEH z^Ir>f{sl$+ahm=C4gb|~$^73fw13R*zl9P1b_S?t$8m(?q1QP={wR)q9+;iN2 zicTQEkL9dgZ<@~FCBFR9zvW`xYjDQs_Jk3=Y#3XJNacjdXwEP)+lD6Zi9Hy|JWQq+UuUJ^1MB+nHSTZAflzd2{6ch(OCoPSsg*6Z1S@% z)#pa^nCR6FbMqsM1xy&bln`mfoOrRY2)d^RtpQ_IVGnwfVGz53RzSR=FT_2YW1d5c zmJX&+*^}u)>(&v?oH8JBOqU~0m!eyg{1O5Lb&DPHy%ahSc7Qa>k2fHlEPcPKH#^YNE}IgtmXHQ~&U5_82aVmZz;~vREQ2 z=@Lz#EzkFlQ?hg?JrPwit2Wm$ug*UTT+tL-)AX!$Yn$e{HutI{0F9kJjkeuQ;1I+CgAoprW+tl{YG5_!?p(**W^AB~K z?i(yR%2%hm!?@@t&_MBBt&UB1Nl1Z89Do?ZCCE$YKASqnb!4SGH9uv2EnSC(LVM+HsK};6xy18ar z8C{;`S_I=`eI6s7i6l$bxV|I4<5QndEJ5O&M>i~670_^L1*u_4?!!=GWW~sn6h`Cp z04nBEjx`w6e+B_uIl5eo1HQ`Vx;7|)%)W%wMQGNSB3ym}IV)m>0R|m%0HGV8o~%5r z2N}UIjX`PHzee%d-3W-d@1d>RcB${_V}lL*n2ZLTF~EA_n`D0V>S3;v$(-!8vefT< zAX*j$)Cr|NHH>b@`SnvW_jEg-Q@o1ts_x^56ZlyuCL*u46~g>F9*GK{tyk!me(~={ zSfCh2lW^#MTiO5xn&l;;wVF=xwUvdj`9#BUZnM#GES&%o7t>7r^~by-N~#&j`tk`% zZ1cx8&vR(+0FzyP?kC6!%-|Fy>j}ln--SClZhptrn^?;9FvYtqtD)1;%h-wZv85T& zJy@Tai;B3>?CJh!oyPOIdxU3GTFs4uN`X1ru5WMb&8qNnn=K!9MzTkBp6bbJb4oMJ zQYFa+bc>Tq7w%j*oARCjfqG4dsLwZ%zihy-b>&mBE^&{P*1n#9W2N;7TBPy5iQ!N*uKBInwE-u&e-7N(642&Q-OXt>n3$g(p=; zlf&9br~c9y3K#r_+X11`OvK-8u2f6O?W4--|MgBsn1yY1t|!G28OJJU)jmOfoKb%n zqK?uy4Sd^VwBaLwUIhpfX6wX&Kx4nQpjU)W(&D7=<`#BaB9`vqskIpvY9vy%CWtIe zoG4xBwc3LmeTSbE9P+5lhO=Vv+XvKiL=tM26d8^t%d(%81Pp?Y-BTmH9*p4?+-VSF z8RkO7s7R}pHmQ~Wr%fK;K%o^a*P_xT$C8T&QeyV5Il_CgfbnxFiZq$WQ#NHWrLpEp z9qt5e@AaN6X*G`n>4nJdaHbfAToktxFlnVCA6eQmWAfn<6G|zMbr6D zJuNF>-?{L77Zx_smH>E%oC(2f&$S%fz{kTM30Cm^|6=6*Kg9WeG4lSqI{%M3^S4Ic zzg?YY`Mc^o=YKm{u&lmmvBiMky{aa?&Qj0bLOh;8znQX-l%hB$)Hf%%SQ^ZeRKjxf zolhK%qi0-8zfH^H|Eq?6^m!_s+4Kpb^$tSqHW%b7*KhN?l=tQ!T=^-p$5@-BIOr2t zTP^PR8No(zMqnJM0^CJK1qnp?1)&U~0{CJ#|;2wIwC{Vz*4#q(w2>$u0)P``IoPZssV0fw3>=k9L;2eT>b}-DW zYic%k+U~%0pOO+pTX)~JLn*;euzoq70P-ukGf^tz6H20?5m@gI(>8aQeQxDk)8H0~ z1bM8%tP(PAD zZE=226ro{7~4oqbw|Qpb{O`8ST# zrwR8?PretzaYS++k)+MuiaBJW`%e%`&Fir&vaqSR%Ti zXbgM?88&Xhn#v67@x65lH8#g}q@pvOHR*sBt8DwGL5PW|2r7w%qMork0(%1+^)R5OfMPAXsyLGtIsY zFg5aW|2*!;{SJZ=IK^0&F`p+;R>~4SF8Ej+|fbfBWMPM3+EFi<+J&>lFa)kPV)zl_1auKN6 zHt9Bjl&`gIk@`K5vpJ6V`e3UmniDSkbB*ake>$B>6e95=#fgSwx6KJc#Vw1E&Y%lh z8Ubunl39l>dN3k5liDIzev!ffdBV}ifF%gehQ={ep4)o`dHkY0kR^pRoBv3YoNF?U zK-caofB-Y3TJ5b7b^BsHs1h3 z7Q`n1;-&k4NQD3MrDOT;8sR^lm%sDU{o~7jt47H3*RbFJ>O-<~{&PO=TEo&7g&pOS zuXlh1dc9b~X!fd$EuS)9LP14XAo49gumDLDbwgR?!?*nOb!Xk3j2pWLt>`}Hy8W5= zWh*p$_N4i@RSwVh!SpZm!+~%5)iVb+-SN(kv8+}Ts~X#>-y_EE7=no$rmFS^Z0z%i z(`0NrR$mN{%L7(?>5(!BKBYy)jWfgH>)J0tf_6>qjL~y?(;q|{`u@M|-Bcszvi8G! zei2u-55)>~aWm%z3tW3PhA}8k3+?Vpm|e7r$)TTQuYYiuw?^-XpluS-@&KOQIO-kO zzxzM%$-N1_1UoG!W^i1pLBcGd!)kvkWX%9G!Gnqm$mg)ZK)fv!-t|KSsgB?yzo)hE zODXZ_Mo_S-Y}qL_Ck`y+2$%my5Yyj>U2E_MTg*q&)*&izbvRL2OPDD%QxB~;ijLb~rIjh$A)gxks*n`^BCWMke+JteSfn>b zxQzE;B11d~kJ6tN_#q5sBTZ7YC8F$!PSyolWgLHAEiA+87L1j`QC`n!VhB%ApDVFIPz6)iH8^vGc>D*h?PVkH(bHn-csIU+&73Vjg8;D+#g*pDr$_kHI zK#SMSWqTDJwO7~W=XEm&#vAXeYI^TA0d)EMbu&qc9TaYwn^f~CK@;^eX(ZGDbtbf- z1{BZ=aS_09W?+K1-$y~lAV~DfCwsJR?7#+q>bwwpengSkV8cH^7f}aj`M%MNG~@Im z7R*%Z$qc+DZTSnq<_uI(&z6GaR2J%+xu(As(&bgA(SGX$c%+CSqL2i_59GAqF9Frl znF_%-_-iE^K|6Vdr;4&iP8CYWx~X?Q@+@P_rkYrI1D3Sb{ZYL5BFS=QvE2P(IH`8| zFiRpjvSErhJHAt3Y%8!b60d7VloNS!i(MMOos#<=CxHwqHEbeBXC5yI1i*N@q;D3MbbC=uf9xCE}j zZTZmHy>ncj$7c5&2q1oR3pCP-=HLY-9tfO0?vK+1L#plnCgj;|&PjCwek-3zEciO( z^&n2+aJt_WlB~D|m;=B4b7`cq)mPZI8v=>IXOdGD&8sD>4y2MDhGnqqrH*TsW;Y0t z6LS#pyb|7oybn8fB1~CxG}4T{BrxeHvIvBkdCVrCGN#T}_M#s06a|MBu`lq$c3-b1{B_s8b}}0fsAAoZIdTz^FDHoG+n2-upvL(XfAlZ&Yr@~ zjh=gmZ_?^Q{obb;SF{o*x2W3^_v#}sfUgqm4f;w@BczdO1`+EXPIr5fAbqkrHWCTT z;M_)dy)g_wR;hBpxmYk?>rk29NT^ZuZ85GH1-ue%nj$J<$%7J@uvv5;3B;$Y@tUA6 zeuzJ+CxY`uzacgeb>_u*lYf{uoreNhpk}GVOPS5PL5p0}nUhhMT=pPXIBSL!%?23S z&Pkd#uf3AZjFU>c=dvsTjd_%Mf8`p31sgWAi#N#*3Tp2q^29K{HkD(pP(c5uc7hin zGPi_(J_kW?yD>0UQTxfU3K|Fx3g<&oTzB^(j6J;<@c348lrMUR4g9M%3A`g;&?!kE z3{mMUBBzvgE&V4zJ1{yYUi>3F+e&BT!A@&~8M(zz5XuqaDoybCNpbeXp9K(8l zenusY=NrVAIMk{in)kyy=-add&AS!lX2Ws5VpVObO4=34D=ZC>0pso_^j|K$y(35N zhL21l+00wIT9>QefVv}CKmI2eu>Aj4{aF4pC;xu~O8=O~e+vx$YVG}70!l1@{h|9` z!GMXK+BWXX)^gw)n=TzJ6HEClznBnZ6WHDQ}pycPHX& zYN)nAlg%=jJJD`(+pn}}QmyYyP=uSj$97rJzABQal(;9W1tDK&eum{O56PnHtCk)B!ej*J_gGLO$*s?&OX=ZZW@-|#tKBTW;d zpmR!jV03fbW@SrwHEW%gr^@fP*{v3x^R&&i&%^#&A(H-TQO zbSmajeZ|1kLa282SM*4s$Tag*#W3QYc(8Yr2R~_b7Nd%0>2*_Y(Sc#(fkY%6Oobr4I}GWHX1I^0<2?F90w6m5g?tL`%bU( z0ml`P5@$aFQ_lZ8K&25uYK`+Dy@kkTKXrUa8eAtTjrtUZ0k(1yxdvJdc1ra z^PJ#?9*$}Trkdx?>Sxo}S##FAwsib0@_q@`C@ScHu3|0}f`5AHagQF$fF`gY(>~~x zQ`YuK39en2M40g2vew8C@7dV-4e{l(Yv@<((l#to&9W&oGrogrU3zp^kRQJ z+>MkFizc<=nH@50T)PIe3UPxlHvVOff_J6#!Zc=ZW1yKLihJ(e@+2X^&S z@NtxPl+9J!A%gn`>z|*~3KeIeQiYXbO+iX>*jxY_RwF+USa`djvQ{bf2ehq77vhJ7glwYLHLXESa zz>lq`c^QmbG~fC+~461r>f^c+=m|F8EAPCIizD0n3-I!>Y+H2H|SZKe>3-1CY=ag z);o>0N_XTq6!Pojny!BIV@t)%4}(Ge>2v_kxnSqNXZ;bF1Nr7Dj8!sd|>19Vv>Uk z-BNdKW9!X$o&NF)3|+g)wU!Q`m(6G#U2tLS-RZ&Y-u|&8j275Bi=4h=?Y8DYbbP3L zTFZXI?)bXX#d8;PvK%Y?S-8MPozYY+xv&+*65G3-HaIGBFod;MYYX>hbwhKBIl&Avd%%h;gI^v}S8)V}1C= zNod})x4~_BG?R>G8cw^xP~Ra~=NN+8 zNPYU!j($ycf930kCbOR;gRtvpaTc%!;PM@&EG*7B9bJ&hzHQhUY;u_ah$wCQ_~9Wu zm77g7fz>=~(8BW~3Nhg}D}VzWKSMQkn)rQq!#*vHw1uVSvBdV9MydyLbtjX~kr2n-=ZDW7 z&2sOVP;GaZO6On4;DbJ?rbT~@VNj~UT-8Q|T_@wswQ zA8aa}{or&W)h|Fv46m=HfZVf`Vbo~OczwTay!nt0=OZb;a@oa0T(a4pvtK@eeN!QO z?_YkrDy_IvdkRlGx;h_#`)3~+L+M;r`1w6IjIMSSZHPud*Bdr;?y339)Jrsl9L^3T1Ky#KDihSZ9w|iXa)eAkz^;2W1VJ48((-6| z+eynAHWTB?|nPdXJtgl4F0? zS^-?rB29k|?p!6o4jyrX>*ft4cNh`cJ|7N3a(Gbdk2?e+f@fS8DbH^>O0cf_ZOW9G z0Jn9-LWwp2>Rg6YGDs*yc0Y6jV3_g=Sen-+J(c*%$txEvT=&Bu(2`%omMcx}{tspo zNf*w5UJZtz1%9pILfc4I%J6gM6BPEyrh$=YEk{Z& z9NjCdHHgE|18xAF>SzOy`0u9#72L*{Q!p)}x~n_Ph8m#64%~t0#v4{)A`2Ybu~dga zM z$!G75W@Yay)D~N~QtJgKNyzb%RB#M52aXo^)+a>WFbU94coS^R@;fgh0zgGssjjSd z!-5sbTZ;)R#VuGIII#Te*Yg{e$+zLV`-_;&auJ%eKMi9&j{8wfCp|r2a@#Q$DS@c> zc}5>TYm=V$Dim9hrMM^WQQ;-tHx-Nq3til6a4FB^bh^9PQd)sos-#soh&tg=`^z{qj7 zDlsvXSv^S635$*-Uqf#ZAphJP100BA6P*XcGYGh4Gd5mBNfG!V+Mjd8!4s!2_a|S= zl}HmHyJQjwn4+i6qLJN#*18UE2ia}adzSNTNoA)GWc@ZK;2k;ko9KD) z771B5W;@(%X!!`%4<>jppf=2?+>WfFbZPj{F*-QkyaYS(+x3Vu(|3Dl{+JvSpYI$x z^b}1FF0!5ppnTdfUP9+sGBO8E!vlqGHEC%9axKeD|3`lP0e8JYD1cyjEFJl|p7OCc zpJ5nj!O)c)eDI$~_rSali8E)MOa-3N{yBc0=sT6X6?0I_^8&$cBnBxDOOz3@53S!^Do-z zd1v-7DWt*AM?>YRd+battJ=pFhm*I zqdMeZD@$6WKIk~vKjk16%Bw1}g-;+GZ0@}RCxhZ6j(+QL_~`b00MZUrSm#D--|IzV za&b;`&$vEfh`!oq5fIe>AOMJ`JuU=qQ^tj7@iW*rdw$K8L?Pj~Fc6p8|LE-IbBsN< ziw!mk3P#1lP)&TS4Em2g*|*!BGDG7mu(+gyZ~erzF^(3Wk(mDIA1&2ZwhFwSLozDK z=G#lK&)_1Wx+jU3kf%j3teYJ6iY|o?Y zhy2pC^A}iSjAs&c%Cfx|5ebOpeY=AMGzvn1u)?E55j-mn53VWh=11aZubLIgW9)zo zuG;ad^8~80nn028oKg09{d)2Z1t}@{7sU8id-HD*BkO(Sf5t0+0}i+l4+V&9rP=k!zF z1N`+Z<+VFib*P2JUP^#6j(l5V>S}7*)4t~0nY+DvGhQhd-uZcC_}jZfL`xK~c+;JLS5Py2Q6e8W0%DL7Vw zIX@bjy^UJu^>8EKa=7M*;iz~Ee4oAOEVe2ae*f7YY3IJYR=nTM^u^lDw`Jwt4tES- zcBIkU>@z1`)>Hpz^xen%PaP)acM!^@yTQ}M>#=CB7B@}gJH2tK&-+%OBq;>`dLt$! z+u`a~O?5x>i}dlI{RN8n(k-GdH;t%r-?u`U)6#n_nySz2IsTZ?$@@>+s_zVxOb?rv zo?h$Ko9I9H%zJhtC8sat^4=WfGg!(i%4QTTVzA9*UoEbm@zLuGxkk)cRYqwhL#6X$ zW<~DktTtP_QNc}FzUmHmCJi8*Z^)*chx;V}pI|6tFZUxJ3&I+z=-#q`ZACKIO>&u+ z1{)$f!W%lsZu5ib;vIdLB{;R6G1(QCm(G)zgS=s#{o@CH@+4h(-Rbq*k^$We%MQBL zas*Sn`zj(>CXg_ugP2vnlvh6lRBP1wB5#0JUmm_yYq%7@cdP6TS>Uw4+st|;6j>GE ztaGZUf?#tS!@eX;2CtEF7u#@h_*}3IKKqRHsT9)N05R49svyY?Z|J5#=(Jz2HoE@*eCGR6c&tAMiO$+#Mc6*5zIt+UAm1u1i1x19)K>;A=)D3px27K)9Ai|@ESpQ z4<`m#a%Yjjpi2sn>#rFd=F{7m`W8%PVT;bSPI5w-Z;Dl5yB&NW{&HsXM?c%7NOsAT zPJTW_ivfQeu->moDOW9BfnX1DX;$pEn5PAh7q{tl8qQ z`ptDF>vrxHfiO`J>(2F}q?5;21^-m*#Q~8VEL-?(Yy1UmP((FR77!s<)G9pvF2+=N zvPm+Fb`S<2+U1hGC>~lz=waOg>qlUydDxg-p8E^yqpRh{%mmh2-1-_Nu|9!64FJi` zzoU&=wNfRidZSK940lcZdkrf@ANff>WUJ4qo(#XsMln@GS((#?CuJ>_Bcw_4#uFy? ziDkoXwFXhBVj9`CYA^^B5Qs&SoZoh1E(qFhZx3@E43G7T6k~RQhAI{=J3CQ8^oT8aJ8a zXC~qi60unYQAOp5LWPjGj)U@PU72|4jR9W?XM_lupn%`ZUA6rqbrJZoUb7{)P@-oj zy7gEfd`9z|5>0U48M%qYoJZIsd(JH{c=sW|X24+M1U{H86zC>yS zvAM0f&+v$~yA#$q2vHLY$Q_XU6*0mnokQ93U;zTwK=+~x(V6nzwut;U`iVOazPzwW z2zR;(Tq8!o&p=Pnr_BolN0;$~_(p@P9)xlPh@C}L{5Yz+8AG^o<2A#g3(jQoyNemn z+SB^VTeJ&>4vKs;o#-iOAA?8JR8&CnvMC6cw0S><0pt5nZeeot=#^LxF_}?ZDGH1M zD3}lerejH@Qyr1<;4FN={?7 zDn5fI3upq2Za4fMkEsVgDOFtnCmQdkn@TQNnc*WqLBe{|-9kv?w_O zhw9V}KBzYcZr9K?H&@ z|9}oOqqLYIhCxzop(MuZ#c(mO0p{F99i)R8Zn41jFaEP^#Yl6*uz+O>@D9`{bJ!JS z(IqM3Pk|qt^1`Zx(xw1}a>{k=9lu^8ks@k8Sa6VZSUJo=P#gQ(!senT(o1>Df1Iym z=zPkJqbfscBP`n3*!_nQU>%Tw=_=1}8qrgcl^>P~fIM2!;?eKu9K~^Xgo> z0cO4o+CKzeB8Ak)q-`LcJi(;=-4Ov6^P%L^?+LmDLZ8?YOz8V<&k9VGt!~5Ti281_ z=$rvj4}XjZ9Tff(SVCSegGxnZKr9Oe??ezVrP!N-zexiLie_OfoW1H^l2bzeYty)4 ziIi&nal28^#452Py(cZ>lTJwQgBX_gmrjTZv%UV1d=Ei^Wgl(cnk+`Ornr&Epl%G( z@*poIf!Y+-^!6zhk_#601}87u0!u9zi$RXFKIKFsHls!9C^^& zCX_B|6R9FBd*0J(&}UAr!5LWuYGo<;4g;ZuNi+xv$Ca^Ov^gKWg-NCq$-3$v;4@oU zl-5S4Z)VsGj-Ef?C;L!$m4?K1rPXyY0nc8!s^M#Xd;@>)Ovi?4H$#hjARfN`a|lBdC?+~JHzDG7pwkdV;)P~7O@Fq1lI%{%J)HeA zrDe}GG5q>=53CU`Zuf5ara-RFP`0r-Ue_E6mvmB`_$8W>j2TQOg_K?zt-d=^_=_u9 zv*tVAcib$Q#-z%`DXb)Z-qp+kbNJcZBv&`Tyu(#4l__!FkkV|=ANO^O?c-PdrZ7$=d_xmyiYYxDyeUpUrTIPmyVahN zk&YZTCio`qcb^s$UYN=*d667rraDTG?xaijNA`@8FVV^ddH3)gyAxCP#?l+w>PBG| znJ+sj=al!9m0(r#gwy=uy+fsdVp*ETCcum^)|q#$EUrDFr#!JdhLTk;ZN6PI(D50{#2Iat~L{cnqtZg7a2k6tdBLcN_)n%aO&IP>VIjDkBuph3DZF z3Ooo6B@(LIOPVzfC+RDJbYmQS``D&$&v|y`8p@`<>&0-z=5OZ24%x7vK zrVKa8c`g*0Dd#AAZ3I%;$_C+D+$sk}D;-@K{mQPv<&;PCL-(A-CgPg2WR;pF#Jv z_SQ@HJ+zx=hCa+MASqTwy~pdsK=kcpNtom5!TVDq@k92m zZwRh9+vFL08*$aR z{RYjjxDETGuN69r?S%IyW&NX}jHH$H#EuMbAvESE^cbM~M?}S#PkxKZqdRCKf%8L= zv@QtL0vTr}veOS%Z%Rb2S~@8eAaAFco|LQfIWwG$Q(m3b4>A_BZT3P<4$*D7 zIXOLCVJ(rd2im;OZ)&I%>ib0PJ(v%yt)~piG8^HW+){5&))S7;~Ri-bx6EbMh+%+YqP0Or5%& z<9f?#(mv6XwoZV0Cfau=&V%?ATs|ulmClL0i~63@>Vw$|>|k~;{IJX-=+CmF7W}X@ zz$lHe-zg-2tlSts0!)owE+D4Kl0>hO_V*LYIDbmFb8rTvQF1QGJIwW3ld0oopcA)V zD9ryu+dD=_)_42bu`0IhPRDjSwr$(CZ9D1McG9t}j&0jMy`OjE-upabpZopre5y}t zRIRG9MqP8x>;Ib-{F-iQ3m`_MlCIj}Sof|2;HH0!%}9<8b%vy`GTq=>P9H|xB_~~7 zD*m9`PV>tahTgQAMK!x10<2`9)<71 z_M@n$2_WowZ-!{PKaDNh@Io3ghWH(?KZYwEXl-FrFD>|2#}&g%;JhQJ{TPK;lPUgc z(s-O?D-vF@b&Lan)Dy$d8v?KtQM+k9=}2gUya2GzEgx8zbNqpS=}X#B8)y_M6px3OGZ*= zgnNN?Eb>H;7E44+E1@^sM%la{_3PwT0*1;`wHkBEl#NT!Xa9_yTqOW3Qrb^#AL2O4 zNv-*Lc+Z$#xc=o4*N>O+V5etcOIAgR+}$e1%4D#9qaqtorD?eLyr(84xaOw-&AK)R z_{J^84XGf5vSsgrR^g3PgSZ)mV^B6P=Q9#kEDk1v$YWWQRrNn3pW5E_A@>Sj$eR}$ z9WYgH&NA#{Jm?Tp9%WreHzX-D7^MxR0?p4IE!!_p!bMlMe*&9-m6`q?Z2tR1{J&uH z-_K9}KNCk;{;DT-Ua=&ut2-oK6@ z*BRAyUM;^wjja|BPx|RjF0|X((#uzowlu2KGCV!G_ zydQXEUS?8nc!^tItc?|A;%R3(-Qlfr%CccNMZe{3v8@HwNV?aoiG@m90Auq#N{~8($b?fu}dFR7MvImoXoshpff3$0;$FUc5=C-f!qfd$@-m0%JCyu&oB1KxbpzZv)F%39 zBilM+x|5L70F4AIZDfYC-W2Tx6JvQLDx)-PX6cK|qY?^MgK%|1ahq}~axn)%Nvqy) zn>WaJa1!F|yq7!HCW8PsDfGa@e3Aq;ZXdzBl!xQ3m7Dqz1G%fJUleIv9#{h;cfI2d zu2*^O)*=>z-aqxgd*@QVkHPO5-NKv$u@!M)VN}ETq}0OA9XKJXr3C|Pk2n?iYwOdZ zG}=fugZUvF>=2popItxV;NP+WjSPIEmK}giS5?X%Mo#>mZWoNW}*4*21w8~RgNBgi+t z@ZpK7zdv~U`A8M0M9g(kzQPxdpBJf4{CMjLR^j7(_`KcsjnC-M@c|MC`#mNG*d5`n zluwKC))^$(!O`ACp63G%encQI6{4$k|jo%0>TKr(kMG-G0T(C!^LM=CEadr-6=Mu$`lT1Ex)fW67y(Yxlwsw#t2>3qHyn4p(c`lMY zQr8@fr1IUkv!AM#LjgW=$x_Eyqq~?DwBypTx1RCMjE-FCTXRc4t*C8ya_qoyq z)E{$-`yA(Rr$GpiP4Sake1UkzGl<;OZbF}~_}=eN7i6z|-k)`nW|kPzP>aIpeqc?E zNd%mB@pn5bQ#~0)2bRaZn$@vVOf6#56#5r4Gn=eC*N{4eU5GnwITKv_&G|n)h0!74 zeRdE8CmLA~>rU5|Ba&#Ikzt+RP$o}Z)L9^wN9oD(Fqo8q!VD%0f<%yGNW4_`vSQYp z(c`=#qNB(U&Dz(MH#947NhVc`v|5p!$JNmO6j@FM!9`vK?{R}xWmJiV)4t^AzfGRg z8c{{sIhwrl){5FJn5O)&JjYr1n5S?%oJcGh0^9-LM5C-UV z)r)gp%2V>!o@D$+ZN%!)X5clvjHsM(Sk72+^Pvaq8LvWdWZvBDERt!&oK6*MsKz2w zn5v%K@`B5npgfirtyUyYqE-YXS~=&3REa&g*+)o@AUPuxeFpw+U4K<(3o~`a-l0C{K`o@oqv+KJaU5}W>6;@s;nxMKI;;IBi zeZSum%r>U2BJ4kj-kZ~&F6`>=fv&)&tl}V3^nkd-Fyx{3m`Ya6w57$%1DGwn5n(!Z z*r#LJ_HW3|-oR{=1cy@&F+@rD^W*45O`FtS1uAyNI|)|LWd*;)Mo~8fhsI@xL0r>zMP$XLzA3I!nYSo~Ry<1lft{0l%dmADvQL z;zcNBOlDD>d44;)cck2!mgS4~ApT(9UO6uL8Cy)?CYs!_OlQ1Rdov2*)>8CJbVD)D zKO5*;?Qwd)u0sj>YD&|Cl5`e{i=Lj{$B^V$JhTK;t|V$1E|pEa0M!|*0Ec&@rL#94 ztS5W&E|pY)?d92<7ddK$C^oI)s>;6U?lWfoJFE!fs}}QydD}m!|LA6z8Y~!2Tc-es zpV!+xSP7q|eP{ZEPJkdztPfYgJ2HFH(n~=If$?rRB=CrcjvL&Y5L5L4F)1Gp+0zY3 z%WkCK%3g1~RQ6L?F#rQKLd4RYd@6ZpC#zZSi#p2@o@RI@b<}EVv~6f25{h=}NPwnPD=3#;-5%c0ch@-B(daPjtql&PncD({zgt+uz?9A?+0?k%g zb1GV->(=Aq7W+RfZA_G{15kuK5Wco#m=`15TO2|=u$Y>O!ReoTH>oEbC5ppRdKBW8 z%eMT0U_2DTNEp8G?P&UA^Rc!>Loc-Mohjd!J#~vFe;9&E6B?SMzNr4Jz`g5dOXu?)2Yh_Bn0hINDWp5z#TLiq)7>5E-Xb8pbRh~8 z8Gl}9u~l`!gqBk}D7&om)4gPdhB6K>eNDAUe6@@d_)LAh|0HlhU-3T!wVIL z%8dSSQr;5YR$|OLaou~;Ol~?Zs^qxcy1V$SUDGFRR(;kyT!Vub?&_S)U8&*SJZ-T2 zaBcPZGD+QGZAV<1w^r_A!GJk(2$*b1{`6cv1=WtENUzYja9CG8XY?{4FwMCW(6t1b zytpsr-14dEUfvT~zr_}87zVZY$m1Pte)7?sNVa`IdurWh@O>U1C`+-P4=Y#p0&6)@ ztU7{VJzFWX>JVwv2E%f^(_Q1@qIY@!G-{9PKgcl(ffp@E_FjlAUu=$p6l%3HM!zKO z2-62PBkoWWtnk;yWzrwPS|6c>4;APd@UGb^SssitJRh5C7;jm}Y^xM6)fRE#%P~iv z;L}8^T=eN>6;@=}{`z7*sFLo^G#xCj3O?n$nDY*lWP`UJROT05SjrDXiIFa*&ncYA z*{|)Oz&BwAPjxrzPw4M2whgYdcoMiSL5)N9*cRcqlsEcjv4B`laH=y>;ABly$h@7k;imHn#SV(9ceHMO~AmS3|xlxyeKSc&;`ywk(I)|lWE~;~hB9|jF`Uk>V?-L4U zuAV5O!up5%Z!0hz&(N(>MjNr@uN-UKrCOmfS(>>PffgVQ9EQYp;07$J)uOp_((I;4 z2W88&>IUlUp~wWn!TvtowVUxCv`*c_yGyCJNGk21R(0Nw21qQX#UnOLQiFVs91ryFKnZY>mQm5eovEpM$m#!plu2OHr>OQKa6KM&&J zoL~=&-SCXR6NX9%PRw~}?>Dh}ek&77{R*oe&D)?0r`p9;Tu6C>xPXpVZ`|@GD+><# z1@RI&^cCh;;uIapOX?k>LlQL)Y!eJG4r_d=q@qlgQ4b8p)azs!j*(QZ5f0)wl~;gE z*1|6AemkOr0heS`LV($d6E#J4ax(OocE7HwjFC?sA-nin-b;iZB_w+%`j#nxt?oV9-&OXn`7+HbS4e+@@+gY9q~UkA_SF`)nQ-*UxH zAsOw~4QvTHaU63!W~^>(UDY5a`hmA}Qj!Se(|)04n|VMNGogs*PO^tP>8K?k9aDy< zl-NpB2nT9FK9K$POBFZ5n;30B*I}U+k|ssE(-uXxp9#`8b^G)B3k)WhreQtP9`GZWay(pL`YAbnVFj@6JMy1AUBqIBv-wE z=A+M!qVZU|NyhYd?E>ari5577^ufkvWU{ajdsr{~zNilTE~`Kf%MC@sC_=*!_|R!) z156(-J-!Tk-!4y1T>LMh%Pwx8I-RjcriFODaC$Bke~I7HurDc3bZVPal1aueg`M$v z1q<0!vkbL1<#JbN?N1azA#l9h$g>Rq$>QM~IdCDLt$QRll8%O?;JNv!(vzQJ($Y&Q zznbVIFyRlmW2T^f`iDx=ONY2RiQv+8dbgkTI^mIU3LZ{{EwV>n8&wZ@;Mgx~$M-X| zo%|X(7rhtD5{WGl@$~E$t}V^1r$u~V85TDVAHS&&N-U4d;5-E9*{?1&YE0gy$&v@n zOQhZ@)F91+uV-23qK?oeW@unU?Jq2q5Hm3WP&pq#;p3_SkWhOwm-xvn<@?n|fsSS* z%3(AScj10zGWnIC2zNAk-;AoLxuqyqo^79O%r9NRQo%PG_A$)gxi~vj*PA0*GxHe0cC$87GIJB~N1g(U4ry2}WZMW&tp8Rw(vdm0P(xp>VT}~CB+7dQA&n%YwXRASk=;HtTz36>=Pqe$ zQkqGiocP7>Xess>P+oy#Mcp%DZmY=hV*#-nX`-lq?YA0rVLtdUMC=tlK`3QGuqUfG zf}N`Kk6u>@gfya;R;Q~|8Gh|QYyRL0ZvN17S3gNyDA?o^@;+0<11?gNM{2zW<(BQ{ z8F*BtZ+bp~3R!IdL`6(#do!maQMaY(>?maI&RVNc>n4_jj>HOJAr3!cmPPaqa5N66-`EB>e`Ug3)G z!*{T5L#YXFE7DQ4KG@oTaV3FenCQfk$&6K3ui_TxsjN!H=B>0vC6rHQ| zsV5ZJeJ&)B3B!(s{taj02i$xg`EU&9p|u;w(}U2MSHJk zvUFkkXj>YzU+<#fusNgE#KA%p+L}gozp%nP)7#o)jB9zNA;BBP$48U<{D8`u^<>Z@ zlYQ_VFOJvL#lz-r&`F=yZx@c0k{QmJk&%IhJh2LEkW*VGYleF`@~P1pFdewLDz&Hi zeOy|NN&R^R`x@0^7Br~TL?1Ys@67EQA zMlw{$Av|%CHIhVqeKy{k%c(8ZTRVo|6s_oo`o6A&GVhq3IoRX%tTad$-~rlm`hux_ z^h=aj{nRvYr74s{wFRh}_}xkXnI$0xZU$K9)aZ!^j9T#N5h>u}LAk2jbjROd5p`fw zd6HT){ycE7)o=MJ86B1>zc_#gE8iBt(JAoPS^?Fjx_%H~qM4z*8Y5UK81I z0nIK^*DFmK0MBJ9n-B}o0iBSG^D!qqXLZM3yNHi5EkBJ)hBlsv*e9$+=kBLownS;A-BTYv0-1!%!K`+_fD8fxRFdH8ByD z{D5O!Tg)%?cJ{i~8QMxh7U0=T4fl%lz;QYTSD1r3Wwb>B&RX<@_Phq0WFR|OP8)@j zN;q{E#ERV<&3DLg0n*#9-@DSv;ad5;cag_J=x2iM-%`**O0-hg{lL}$94W>nAnU*u zku@I)Jy4T{jOM+T8YyXqsmzUoA?>R}#AIib&J_%y0ZZBDtvI4Q8wBTiC-58);Nn2| ze5n?wpR}}Xdz$-VMl2+O_knBjSo*X8EQ^&S^TwLcYwsm7N!4WuDzUOV2Hpg|Hx89; zZCm$#$i2_@p@_5ZF2S^pm@)jz2S z|EEgzk237v-ce?H8As|Yp!GYqtKf44IWZ#-p-RrLo7wuGbu82W1- z24!d54+%5D*RK<%xo77_OLtegLjU>IGjAI6oOE{)h3-<<(@2lU(+ZU*U1gIm@6O>W zn#t%67lLxB66@+qzKT??WFzww^D398^70Esvj`eRa@+h3(+8`TakQ?_QiJ)g7Wod@ z(~@lO9f5n`xg>RsGwP@9E>4K*#j>f2K2Xzuo%Q9jlVxeeqV_7y@b``gTUVUqif4~N zs&L=N+?EzM{eba)>Be_4AQ(P_UWqkmpR)@|&xhxD>-DYQKC~jPmj<5pEp>2Rz62LO z>gHnF%$(n&v)x(9#ZW_W5=?Y5y*Tey5g8<7r5WxpG&79Zo}izx`Rp5F1ePUXIn0%_ zZph$nI_m=?N4|romsfE1Z;w1C)={xFQwH6A)+t+u)SWOm7;RW^H%qb=11#u&ulc}6 z=Agsn6leaz?JmCClxqol3;}}y7)I6rpyL7Tf}(G6g!Z6mq&w|#gge`$lE9HW@S$M- zQbYo7I;fCt_?YjY=am37TYVSCr{FNsx4@y_FLXJzrnZ5UB*iiq?b2uK;GgNisxsLW ziO213h^u1jiDo1_Q^Gj@UOKB{FW(1eONOw80SD!r6k96FYn%Pwu#InT?fth`<@DFA7#4TQ>E>1X!G%S|IeL)9AAb=>_7YY3@dK8M*50d{C@x*9SU9!T znku#QpZ03vOJ!a==k1OzRolYN(A)Jpc_OAYGO4S)?g)@GL{c79)Wxfr=!(LZL}%KU zl<>C;+&03g5p>+X;47%1rC)ATGc~RBe!S+<6z&EoE|TuqVVUF(Fcs!Mo{^7(7Z2qE zmd27=d~g|}p9pUEiKaX`^*HULS%-+SK^-_aZtv6i5i9B{WlV=Vpz`Q|E_gd*U`4;6 zHJC%iDz@#1g(1l1Z58Kc8VLuIVbEXs3&BZ%{nS-$lfod#bVp`|SIR$EYByPU?<(eE8vy&w7BAi$3)u_BDcNFF)y7xs47wBZR}mBYrFBs7AU67Rew=e z5Ck4U?Q+S}29uI zEEzZ&w+gX*vh0DY?;guWj|IL8*aa`hYoKNIll_)Y0(lY zafkfk_Z3?A$A-{O2CitAWUvP3UdoLc21|jy3>Rg{P4j{}ubF1Gu5=v710Qu(-R1e> zQpN0-pPidBXpMMT)+xipLTR*_tX0_7!?!>W=9;RGN@rK&m$dDitsP)+cCP+xtsMgZ zJJ+EG0UV9d?k@+cndI=h=-A-$7lBC0868@)#gWwe9FooV7B+Shdu1`EB>rpTp~Hv@uq()=3(N z#bLwk0l5pwz3oRm#AZ00t%!Qp_SDEeD)G7cjsZVQ)Gz(tD?@S@iZi0fyl`BlShq&u zh1w?QmSr875iEKJ2(FnCwk1@@gHz5H=g3&4UXoa+l_sj~oZGxFRFK^rlVx#9r=Hxp zFHXT0Of$!}OGD31ZDj4%aB$ z{2Xp)m%Z{$P+$I4G77DO&SlprvXPfFc>W4rkSg`g_^G>JoH=bJ$vLBCI}yRYDt!>& zK6??X8J}l)6IZkX!m_b&WJ%edMBQ0He#kJum`<&k2L5&u8s!&0y-15gkFEMI1MCrc z)i1m2k0*prdLE}?s=@5Bz~y?ZP*emFZk6Mqh-^#0p_Px7V*uh?jBG?GtGSr zsp1H{d(sE?^*=eTl40K>C;?1)alP_6LXrBRt@%KO{YubAIHl~9;NwH4G)Hb-O@yT^ zz7fzv`0qB9WZb1YK5RhnO+k=|BCt|GF83@d7at2j0}vd#icOJo7_UJYmSC35q;Ayb z)$I^o`4w!JNYn_|P|u;=sB^P%It0};EcP!>C~YK=&+ijFz|u+lM{B{*>&7&n98dlX zCEm}GTp^d2!X)iW)IOfLnN+-iB;i@bXhyvJJ;gtMq}^r|$cmXDO);J~S%iC`LPJKA z0Lzl;y9RN_XMgC3jhvskM?*;{Qwi%2Yb&k(#MgC#HA%VEHX&SSc1x-eyXx^yd*vCe zDsZNMhxM^nDgw+mu_E?6G@xSegU7E8RVXWGmIw<9=;(Pm_ncTtL^H5sN^@=-;lHBk ztW702eep4Zg|5nCl=(Q5S^E8^XEEQ@L@0cF1cYFa46HVy; z6BPS@h(`Ye#r~&g^bh{|TPXG~7mZl|dQS9zv)UQh|BMv=iegO~+LpL%sNT7{M0UGV z?O4WzvtA=`Ndv!=exQK7sXP_YQlU!W%zepDCo}7|uWC=Op7|Z5&t@e%P4gT{WY+99 zJX3FOdMobUWR`Ap+s3vkOIp7-eHBzBH)?S6h9h{&FVt5jBfp8xK2&356juk&3fB1| z+dg@IzkZISjDA}Q|Jd3s>3pj#7y+_Wa@kohsFUkH$l`BgdJV?$DfGJ66#s z(ujG_q`dN7)+ZVZonv9Ue5%Nv$sY(*NwURo#do>fUHxF~$nT3JaNTvS`!e2Jg>(Lv zY|acPex4g)%*`spiev=FiDeYw#QKVBHosV}noSNO+-eHmuBvcSE#7kwI|bfuS-_8w zt<>Ctn+_6PsuE4vy%sK$)Y3|yFZ8PnD;EiHoBujKN4K1DH3>{!mrvR$_?HlAenYx-hV&nrsboN{y)1Pe|mcA&H z=3^K-VJ7HQ3zjR(v^g`B+%f zenf6(TKZ>=CG4>@q>9WJK(}OJlzV`crGW;3{owNWMiBr{B8sG zdT9|`KYzN1^8@9_`&Gv^Br<*^dokaL0O^gB2MY6!=nOEMEl*yb=RloCk}OH=anl&i z0i-J(C3KQoqF_|kqR zVXU#EYH{S(%`zWy!ee>y(N6_H9Z@&oa@sF*zn5|Zer?>noziXP8&QqL`GuFG2^L$u zvm4LdXmt0`8XT6CTLwzamHx!0R#O%6%=js(EpeETr(hE;F?HcnzjL%B^QdjV4NHyt zcm<{dfu=GaTSm{x9!gFv)PaJ0z|6zV@FPy%FW<2B8I_q$?BwjUb8S;eHO}pKe`(O{ zQo}il4u|$?os>K_{(6FkejCZlnA+t*4vWk8q6b3j#DK22ZnnULDhI`Is`SZ$evhS9 zL1zor=YYdROS@&*wQc5HtH8a3c`y9jyJ(&H$K4`uLwc!@DKr2z@;Zmepa9eIxT^gv zTuf?rMAvdO>(jhA1OauuK26GH=Un%rGX@8UOWxL1kZ>xF?rvxUoG(()4(G9OieRm} z=E7K)^$y~6j`JLm6~d0zJms^XOz&U_7Z(^L@3-SU_?lg}X}H&YL|6|bCzu9GzSer4 z^ZBKsm)1Xz=w0s<0#8jDBH#CSE3~T91G$0;Ba*wd_C044KS`T2D<-ij&SUyOnNwb@ zy_7xZOMMojp9Bz3{_&y4V0I_^;-A#YYz$U}*X9SN1=&vk=ylkWBfrFZ3ZT0q0`u;< z=m?5zp0$4R@{C82ju0@55ajFRtbIPX6NVG)gAq6%+#Y|WNFPw~hezbm* zsesaCPyL>#{Q9eXAQ#NCI1n>fh4u7_{c)8I}ShN=T9RQ;zdUu#9WXgpd`qmbY`uk*q#F{J;4D@nNz44$~ zz2kT-Bbspq+Buf&L8LQbRFEGrEPhW z$7Zx<+8=&z1IcX|Xt=Eox?p|+2wb(pogsB9N(0Z$P#10=S?K*4b{z2DiIV;Jd|N9R zuUxTOQvJ$`&i)^%nSOV_gj?vxZ>)c2@A(v8>|j8U7yv%4o|wGpq;vn=_?t7_uXQx< zG-;Zum2!{P<9WM#%tzyhE-(iX2Zx261SVjp2&-p@FEIy)b0r6llu)fA&KZoa5#dz- z`30Ui%qHED`S?Sb#dtWwO=S28KBZ_{_s_5dGb!>XKC>9ot#t(UaG$e%8ZYZ`AELFP z*%|a;hvg&6?D(uH`4ajP$D~1}CXI2M9($Imw_`Z{Z;7(V!xk>6n+CBuYkr-@E{vj7 z5t>s%Y2Kw%&Gl#YPz_nqr7ak+AMbq8d*yTg1TFsm&;9>>%>SPb^FRL2{}x*O)iC~- zILvH+?OFYAXu-(H!uH?LVnbui=FiF(@2wg_?4?Cc^zRD4C!yt-1?Kbl4ZxOLY*vXO zZsiCO1YW<6u@c(tDI+~S%>hCwLfHp#jwbM-@8rA@w!5Dfu4Fk~k$sstgH}t zp?e20D-+=;pFv%&8E#{fC0CC_Wr>H7tR>SPHD@-blv{GfyoZjA)o8}M5_=xdwzQTS zv~HMQ-T=N@eZB8$HcXn`%Nw@!OM4#_b#EU%;>seb^`+lkkKprc zKuksaLSE@a00q9f;)e93ej+GH9CoXpjkao^g1Bj$FX9?TrqC=ygN#vda3m!2=FO0+ zr;TIOc=OaJ*C^T7@KBV-3c%+VUtIA|z-80_&7mbL4i8x)Ce=lYyKvXTS;!U=r9R;; zBuuWLVf2&u0OpxOSRKP^%Ri!3@U^#FjMXfJV$x(&ZFT9Ms4KU(6~Q#tr#||GExeYn z`sm^gL(azP`Phfvm9VXEIB&jC)+S4#$%ZJBctl<% zez2s7<68W*nN+ebs_{}aQH~%rN;&L=DjAlie(U&$N^}S;K%g5p&_u#~wffKu+Q|Sq zv0i=ibY^+q=lf}pRv_J7+Jy)`mIrQ6{kOtdZ4%<2&^qH$tmSdmD@_c)?gbi)LnCmA z>lMo*2m`@uY~t{dj4Sht;sh(Z3PPJkHZ`%NdZC$zd3IrfV-3C$#@D>3&LG~;usyJ& zPH|#1UBl}tqI~t*LVbteyPe{BpwlOP*z31fS3lEmvBs;59~jgS(lyl4Ns(&CkDGcn zda7uGx|W}sKWc#5^gj%pnx|W0XUr0PZMzddIio)!Erk2{c7?9`R`mtoWp=;N21$p{ zh3yK21wCqW{q&dZv{l18o=cI;MJZW*;tOjY9%)ywR8Ntx<5FDIP=qwFteP`hNyBtv z24q*COR0_`!vtDED=%|mEf#9qoKg$%_`%YAAgt1YWbs49u*DJ0&Gt{|l7b2jN#SFW zQkC1Vlk5sO;2RYk4JP5+Fo1h38&C1~f1vMc9D(CV6=iCiBAdsgXZ1yv(VdvkCMRE7 zs27m;?9CnT6 z!I+T-QpOJ1qzj9YW?0fLL45*tcS4SD6pQ)Sey^(dE6jjV@24GrO8g)$)bjTiA-VTT zMovnSkk!uKj!VckfTpF|Ye!dmi}M*65gH1AUk+Nvn(+zv1<{AfqwHN#!k|=|Q>-Sj zhTwXRVh`?un#|_56hisFo_}ayJBvfLDT0~|-s92}^9is|eGcpnW3NfiNpVD76j5aK z2XBY@xypY-Ie>(_72=7Z0!v-xRd{}{4>J@sV^+7XoE!0YCys`q`Wb)se$qWY&=)c1 zfN^-Fr%oNJ!Y0AC$6em6P(N5r%1WOWS~y*R^C)-S6dj@#V<4)|jO7*-LbBgR+Zb={ zzY4F;bYv~DV~8D5kbvMRLmk93Z9o^0MgKm%pAV%65?xGE+q%9tlQwk=qtJ)3O$A2- z6^B79{>%5k89I5pE`|t$Z}`AK@6I4n*YE`f?(t|TJ6V|97`4>&XNDQK`X?vlA*5oF z6!f98yqT0TJ4qtA+#GaCN%JMjV<+9Y2U7@EPx8H9xm=iRWDEZh9A#9sS4RmbD zp^+@o8B^!U(lP3;We!@v(;B)v*ppc7DG56IT^nEDL{Kt3JVh3>`N9;<8o+ z(tI0XZ>;V^oD4W350;*vHMPoD_)%7;I%&!}RxFhL;W(6#Tu^uo8W1-^#ad6UH6h$V z%;6!g!?=TOU@?E~ElW>CDyQeRw~{S9v7{V2Lk5Kzc^{*kkIhE_M!R5#A*Esxi^|Jm zX)3E@3vW83uyVh@JX9W0j-hTCWBYNT07uaDiPOXF4d3@|IK=-O^w|DQ*ZdFZ@^1;A zZ2u-v{^7d+1igRI)!zZVe_Z(=@Aa<%y}x$E{#Vdr_@C=PG^}kmm{C7-boGB%j|b~a zyKJ`fHOdG=Sx4o4^A{3Xfk9bK)5G3T9efbYJMWHNaw{qv-Dr3#Qqo`*(dx!X<*HLwpsE_Y)JRIk3no{T*e{lGxf<-; zn1XWZMl#?0uo}3ma;tAZ!B5(ZoB)u0)6Rfyi(Lw_Ws*Phf~ zmLYdLP0Yiw6=qE`7i!jse1g@I<`^k0b+l%b=X>&|@9Ut4&sJ?Wen0*alloGudnsA> zhAx_hXhIxYTW0>Vo{Qu$Pd}DETp(x==ejkNttu(OIL~~#bAKQJ-t#kd;YZ=1x%cc6iDFh%t{0|jo|FKiC)xxnKxEq9}$Wm#)>@B*gF0B>e%wu!>n_U zq$%O;!i}05eBOp?9NGQ#@}*6xHniUnEL|hWZ_uyv&OG!WYn8d{MvQ^zSO~Z05G@S> z=&Q{x)ZA4JZRHk5=7^GDCAhxWHg7{ypqql_GypQ$1R$Tm^i;7Uq`4JTkre8Z7ZIlz zpuV`NM156;logIx<0Np)3olV#bey`AJmxD-5OX#~t+QDq7gS8Z5VQ~QjP2Pb8RFc@ zOT6VJ*H^ENQ6$AJbpq$g_w8AbXO${P6-S4V9rR-NsR~RQ@18VL#`QVQapP>q98T3mjY_K5&q>ylvWLi#5Qiyj`KS@5{sO!@)uYI-i?r_`UA<7oZ|%|R*=UCNEzImyG6wvAwKi=hN1 zosYNCCA=INqPJpo7W+@$0&;OA*#yr{7F88@sqzZH(qAE4>+_DJ#{0hu(oogDS=Vc@ z2FRdFNkBYQKBHv2uos(=t~-V$i&M*A^c6S7+nXM9IMTONZv>GPAOaWX$)~|^x2P{J z=y-iEq?or0=m(zI*EyiXTM$l+{7^?uLaS5v72piU_0_$m%bK(sJhEImo6C0efi9F2 zaUzJv&&VPqR!~BMqP)7`+LyYYY6ptfS#{-=?hEW4=FU!>06hp{1fzK5m3<@{3JDz< z*XwVnuazL^eLgt&^CTRhS*t@9PgANZK?p$)=38N6&BE>Xe+(BAGbat-OF=hj!jx$*6A)L+iK*xasRA0sG$y+^mnj0#nC>0fsumTpL!*ApT zZDE8+U z_6&c{)0v=BNzuUVq;~P26x|YbU~}2$JX0Mn0tosv^~Jek3W4kjVZ2f?7@ylU3C$DK z<_ywp8FCthqH~109Ao!8Z&J*}zBx+=b4voidS9U7Ny6B~F6bn(wwc*LwKr z5XP|!jT)I#^90$1OtWpCf&7=pSzbgG#iZG!8drF*t-Ba{`Xj%9^7$Ct{t2l4)rI=m@GuWbTk-lgw#o+^c@%?E^yP7Oi^_0*`Pe^Mk=)it70sAr9)sTCBmzvwz z`Dumn`Q{Z}JW$m3`#?0^ZK?3_bxNn&O5GkKf=1jbXVJykG^a+T?7`(BHTrhB+U7#` z8@f+Tq3~`3X@BKeyc`s31y={sYelq=c>zV8wi`}%jc>L@e@k6weMRn-?tGN1?tc0= zZ^b(Xh>8oxAbwn`epRfb*|jI&1R<I>_8R8R$+6Co|61(@{U)y>mA?N{pcLt+Z9V?4Y!uS|V{wBW+;OH(<@cL;vy)so! zeAAMXub;K?G>m&&jXXG`0T^|?Y0U@4(yoRim0f;~wyj4A-LXRU6!j=(IEqEX_Fvqr z9W2;Aqf6?bku(?lsUh?axBOCYSHnwWaVhoNK&pmoKO5r7iTx~}h(It4!|Aj^3^8#7 z!u4YXOWErgV=eIz1v89_#v`Fe>6^e@yLycE=a;#|cE`?%gZRJ7=pHazyiP@jjr+6I!B zI!H{>@S`4LTLV&*>dU`ybRi=5K-iL8RgJyHgYXZ9jxy64LjMiBHiS@4S13nO*u)B9 zN!PPay(X&I(}cvGZcX*^)K|rg&~F z)!qXprZgVOek<)RT8aK? zh64dKTLpxTu@!bsc^;UpP~P=R#^qyUFto~MU};&AR{ z%jM9|02d03LUmjh%n!Dnn{1srWLvb8IN*l7gh>+)S1QjvkYF0Tz>?se1}}E_L}<9I zxg3{!E4OiilJq)-_-zgEJa{=Xijz2_&5ZyCo!34W*ZvP}UmX@lv+Rw_;;>k-CAhl= zUEJN>-62SDSO^d#xFom)5`qQ^z7QZta0za~-JNgq=A7@m_q*r$?)m5PFbvbvQr%ts z>zb*Ws=A*qe)ZRpXUStxQOIYA=Cl#uC>r0!$e9A!2X_kzM9(MBzQ-Tsu@L&K*FNjQ zxD-Wr8te{lso`Ny>D5t*cfypWf$Br;;e7JZ%pp&6E)4K?I;6GYJyrx5`&JChY74`R zKR?D!+EC7BE!<`8XCnlWeb*~=KIsl|zvBzBDZURLK}V4YH+Z7-u{`?N`-^ke-3YZ> zERTfCY`H)4NwjvU0Bfa?JOQ*6i|I(P&DS zFh5>W_F8h|W2@J5HP#dRWI_gA7Ae^qBHx#5#i8 zfd0IL_b20GKlk%P(W(&I0&SU{3MA4dobxLk5;~Skn^c%1hknQRE)8QgWHg0%aWq;l zAP$A%omI=nyyvxTRe0c2RdrEvMr0sWOLi$CzYy+ z+;Eq@_xTkS7|SL&&1e(U+k@^yqf8v=-FL1}RxYLk}BtWqkKPgjTw^qxucd6h7; z$@+e6|MbMs?@$4qA{6bCti-|H=p>2KY%H=R!h7$Y_2AJ`L%wgav+(3yz;7 z48OE0`Hoxfz=%Y#`BqLUCY%cEq9b+U8cM0~=?S8)$>D}_111?<%X>*Sm>p{~!|pJn z1;?Os!5E)gne=9OhZ#o;LbmGU=Mh`^)I?HI)GJ=M55N4NHpgf|yp@G00K? zMhq$3GEJ-#5aDb3^6egbhC)@xsWnISby+WK&AG`hgI>5Hb1xW07Pmt_A3Y*=*5>H` z8UEjXkY(1Yb>E-&Fv>NJlH)2Y`GP2#^Q%GUY&ta z3gip>)z$~*gD%aEUe>tXFNQpX+(|YW+@(>qrfzMveCddPfO9FKl6LAij=K8Q#^Yx@xNo8uf*y@lSS5JtIIBpL-0b)Oz(!qO4t4$h=nRs0 zzLJJ(bo_DI9{Ne!q0s3xlWDTFFn`aV*$xa-C$kots3DU2<7jv70vaY}pKL7r)_a#9 z4xegMx&U1Xm{i<)aKPE-+uSv7-{+Og!4YV@w6jI?DgTnwVcC~R~NpKJkX!g zRw4Jc=$ppRma?BO_%+0qJje-)DBR$fa{0KBNAajSNx2};5+eB|tTARCmdWOupc?s! zTd{9%5i}rksN{6mZ?7c}=GyaV^cqT$CsmkY2utIA%#C7XFL(1-@5cqWI{I#IC@o@d zVmJtH;N4?Q7{^2Eg5XF(hxjqIDQG{ey8KK=ZJOT|cUg_JV10>3206^97dh!LgqPl# zZh`bcM5r2idy1s?yQkTsOCxkVZW!6eUfZlz*VM%gR#G6&_Z)I?u(==E6bBjRha{)7 zkGc%T*DnuDKp#voSMX;$tp#O8%v_e&$&W`c{1K3y>w_*GT(EXsmsY=%ee|j?2x(|H zB;%IRgcxL9)2JXH5&cvL_65OGP`+#MQ{SL|uqgF^scYElpiloTvK7KYAx)%JN*X>I zX&#v&RbY|ccj_$YbcHLY03`DGCVJf_&);WNE-2flkobkqz>IM^q~FS)*J35R;T5Ft zLZ1_PmYK7U-G{{S)G>c;DBfF|s&%$Y;c4gQxwkVXL;>%oA4Dyl zMw6QO=F*$okc3r>j6@F$ZHgUhjtbj&RQM9cMOY_Daw~-Fl1N7Lx3V3{sgsG&ijx+6 zGr9~)pXJbE7cu80H4bU3BwxM<7_3ZZe&|qKxqnrW?GaaouwMHX!}UZ&O2wiKT_1jH zcYYEq^}euXp2YN%-9xnhC)8Gz6Mc8o= z;-dsna``;^eY(Rrcegy8aZl!LoXJ=@g+0voYXk_t!x+jhJwC*0)uibMJ4 z@s-Opk>+~D3k5&$s~e$RZu0Izru`+c1u-oK+m{AzD8ga2pI#DX)Wh`?>&D^(iPc;Q zN~L2zwro6G+~m;acVM3ZO-D9X6QM~(W6O#6$t*twsZWdFF_RMZSjC zOtMl?4L!R#mDSrL+rbp4Xus;wR91eb0j9Alx2jcSqALE6r<@!WmWmrZdO11I-wZf9 ze&O7iN9E!Y51kQ4#74fBOMV*~=*7m9h6=AhFKxAmlVg<4;2sq6@WE)*@@Z#+HAA>? ztrv(lPVlijm^XJ_Q_b_Fl^hp!e?2GJBS75m`)0VLW0m<6n@dT8x|H{pd=NZ4qU&DW zwcA&m^KC(uUpqaJ$T&t}6UN-nWQE&}>WqlfGaSw|K}5IOnLnnJtf@y8M=v0FS9!12 zLABn(=z!Vo*LNc=9!a9RpT8PgP80s3&0vg$kM8ZdYDTJ$Cdf=#m=}!ba*wqmbtbZ9 zV%#Q*L+EY0-1M$_q8yESJ_6;H`=K@#bm(sSL!F!F^EP}hLWa;cjd68bdg;^1b6eVH zc3zxbeqmPNVqa?Aek4{&I5{y^Zv-szP>aA5+wh1d?BWCoM1}WxIdYikB+>l zmFdI2O_u3@kL|9VYwV=F`O0R@x5Rp@PnE69;U2yU*-qQCNHA6L>aH&RP}!q|!LdZV zC;;MG;Qi3t(DHR+OWo}WzuEMdWimm_efMRVWen4X;xuwwi-`Xm+hkwj#Q z*u~={r)+R_at>PGr@gZ`Xbc=waqiF5{5kcTiKNjTpRs?b3F)&ch?E>o_S1T0tuSa= zAmDTN`7?S-L(Q@G=r%s7Z5K_lYat**Iikvycmq+rmL#egQF|i_p01l|^#v=P4ET=V zjw`{g-{Z$F?RUwRFS1q510J@kiUOvd-1=!wZbP5ASl$$)v@PZz&keabbQ_%jKJoD3ah!l!+{Cw#RSD>h+dbI?)31m6%V%7E&5kDCEI(OIF0iB? zqW+4Qe!Gn}No$5uZ@e?-R{x~CzPT=u5Vv-=&ariNO(?hN6ZUOUQTW4GPwZ5e*P4tY zx1~S9KY{+Fy+W(DQDxW0j5&p@Qh_2_sX^0iHB5E1L-Mq_9dl!Hxz8mz-vQ&BE-J;( zR>nc`Nh@AdL0dN}$x11my-{NR%q{h*K)hP2SLjMT=!H0tONS4ZrSZg3C;OtTNW<2g zevoS!>I5P>QBh$X=ae&_=v`xc-nPvk(*vK4ZIB7N0kg0}3M00(ynb|BYxn&M{y@7r zwVqUgMs^JfU*ift7;x0BpOlnwYCtp>D&5mqv|RR!$V0wKXXYEwWlrQ-@Wj_{Ia?im$ zp%$68pU@u3Hf%hse`|pd^RqfzTz`rrK0>3>jPG5Jib?m@F*)=hH&=5#hEPJerZ52m+cJ{Sqs5(1Ehz~y-D-H(7xH+vH}(5+ zB!lIt!Pd+k+H}|DC0WJ?n5atz2VrK#sjsoSk1qxA32lfH7D73b2pKK1%(<|%G@uhU zTx=M^1D12mkrF$`sI!>ZmXtXThnouV*wv)6d8E#=(yP^5g^Q0OzS+at->!+j!t&_B z{^!g$Xz+?0R-d%w=ix>H&DM}Q7bVWQE?i%WH?$aK{u@F5?-qFfksvSl+oJC8O5new z=l?{I|EuKxsuEc6KUD&A3Bf$+|6P!uGH^-(@&O-~I-akwo^QW&D_d?G1hj0&>S}~0 zKuRLQTVlZ{VTA+BM?wMu6NztBM>>h)Du!v_FD%Rm37{VhX`TIeC*tQeeDNyfd&kub z$-sE4chFVQ59hgGo41wC##yvVJULUgJ}$emwgpVJL#h76l}p(vQ_KR>pB_2IbFKxA zvU{?x`LloYE;J|s*3 z<%&t5qqb<`{Mxc(Pn0#Z*_33{vO_K7m}a=g?4DhqaB|v$z~jKH?shuxOLFz$8w=YO z&L|lTWUj#Xot7Weu_nW8>Qi=$grXCwaciQm8b=b}4G<5aP1ArfS81D0yuOlKae6jD zgGzm5-p&=md^ns$lo+(-y0m}!HGBV=dA!2;Or85w(8}Bd*McCNOYiK%%z`c3%WXwh zb6JV3@_^#)!Bg8$!ebf4Xj@1@0z(>px3|9rmrWPi?$&NN1UPIMlQAK5PLan0D#8Yz zGK4$QuW_aHTlI^-g`bVz^@TFavQMn{#)-Amy_a~V zmwTrbR?E_s0|o+bH3aBX3ud4f)N*o+xTCoD$nt?j=fw*zk+*m{epMwrfLwl&$8I+#y4z!~t1Yt@ zEmk;jQPf5ZkALPOcn_Ho2cn=ceYb%7jKeZ4-_f73`GktCt&~`G!XznKXih-;dR`oW zkCYQVb3u*&oN@;HL9=2#J;n{fUOUX1fc9*sGP` zYkNVeVCQ}sXUR;(ZRHEH!UvnP#r{J??Al0wMZ|Ej#bA;QOiP0+|Bu`py7% zZ;WD8A-<-X@li!L>qo z22erv|K>MP05;_+6}v-VM1T-^g(B>R+19^)!9yKQ8G*uyN7W z-6fxc^`Yh-@ zyOTXOG>feEet|E zi=ZjT>Ta06Nx@!X-z!((l&DUPcFPXyCI;9dr$X6@+iay?6wJj`>qp7l2R|#7{;}3i zBD`UDLN0kCaGmL0e@V^CQhottRu;wd*>M)CiY+b>V7R%ym(7zmuQw8>WT$y*RvZHy0mT)uljEj zBN+#Ax0fp+Eu?qDRbs|1Kbc|Q7#kFSIe^29duSz<|D45+jwGC+%_vm_7VD#99&ENI zlg`ErP)R_|=u*NqLv;_FJb5&b>-~N&&stikI%?g62=d2h`)LZ4(GYD2ZQh~3L>x-= zfV05vkcqffFkBYvfH2S#EGKid8zzO6+~_&uc7`^!+`97irGt?7%A61;Y#;z%JL9>@`knp z`i28%+z2us;U$*~;!|=4BI895W37Rfi|hQ*NrRNR)&q0A21=fRb`i)u=4#^W=tM80 zRmuGqa1rm1@2E#g>xJ+oP_5HB0M2uH@#gkMtfuK{gfx^Dz(M6)JhG<5$3#L zhN=?nFEH+=Qn_$-R~SE$)S?`wVnUYXMH7O9@!BOc37e2Kky>ly056HsQ!~=j=(%9G zCs*plITcB;Wb1zyT?GH`((m7hE`tAXKJhOHg@XUDTJ$e@;Xe{x{@2x_g8#8vlv9ZJ zzlbiCdMdDZ?uG zemQ>g0eOr+eqR~4o7kTZQ`S-Fp6TOaZ-6&YUnw$t6jszIZ~bvaFdvoU}kWa&W43W*rq;`>8;hCsD z?Zzk+iG3Cidsp_LrQ0q}Utr$X8ekQ+o#sVz69kh?;&}wY}Ev>+?+Kn)QsW z?O;r0JsGXf;G$Daeu^EhKj?CBVQ`vsUUHOA5fo6?y?p*bxUn?6vUE+kXUI5W;F3lw zh8K81@RZw~Qs73|Um|v#E5{A+Vi(O~prT0lf{JNZe4|oEgPvrSnzVXNncwv980H8KZC2wYRA7Dsi3P`>Yp#ion82 z0MX^SuZerhIpxO|yvCH~+37Z4uj+&yp^!!EfP@i1Wll|%mYt{=>$p6nLPns0eG-XM z_w%vc{yd1lRyX*KcTj+Sv8|vG>o}0{k&1#SrewV)0TZKvxm1GM*RVhf>pSDm@^x>x z@$w(vbz0LwgO38_S?=8^!X(>w)Y~uYSS&k^y&q>LpA*lOr+7X~;8@+35(kAran# zpmE9I_3@pRc41Z>;+=Z?B$^qwsO?}V1yJP+;KU_EBN?{db(7-xlrC=zOImR-ZJEw(BoZtK9uD#vo3|r zo=75ROQB&Yu|-_b*3=!OBy+t%sYuM#ns7y8@Q|F^fiGG3wV7IPoh@12ini6{=Pgs) zN+s%%ID-xa11VJ214%S{EBha5@u78~V*w%3UrOyIz z|7nK%&*sDZdlWT6+<)jW`CHRG|K6zQe{P%Sj}bP{pPG68)Xe)=B7pbL2FLqnCjJV2 zrwQWwL*L&U|I0nVKcB?^wRQf_jl;f?``w?vJVC)ue`@Cc)APUV$u&U&e|j$PhdzP- z-t)gW=Ra?p`~QymUmLzANbpb1fA7y<^Ym}4{AU;ykkRjX;fDog77*e#`EA1fdq!c? z^Uo>$$Ef}x{*U_vz(08WzqItdUx%oMHxCJ=5Ir(@v4LLa(V82YTx;)*ieXMLeL5waIR%%)xT^mm? zSTPvI>^$sTAY(?bkAt%{h?`HEn~Ph}m8*GF)w0tbR{oQR~Ysk~b=FbhVg_q5ro07kOq*$aZoE3&E!PCoI%HF~g1X~Oo$`=2);NpTU zG(87vZ~Na%jT^>YygZyB9$oAYK^X@xt2r zegCg?n6M`RTMxXj*He73CGb0q8#dp+^YZa?0r+4%Bg6^2hLz*vgdM-@;)LaaF)km> z;TNv}FNhbmiUqm;+~fJ37e+ZBY%TM`DCC8CqTu0zrSS;?ggAeSm}n}?h4uY(^33jDCRK!1&gkRX5u#_qq5zxo9muixo{us-l}a)JH}Q~zDM zRkm@p^R@>G!06!kce?Puzcn*S9dw=N#Fe?a1+Y)Zm>WJnAi+gKVnXm6L*2bZJkQ63 z|H9gT3JqEI>T@u(_8`)eO4$67WZbqde$;2-@$u-aS+w}uMfdFRj%WK17f%&oY^#PJ zCIaFHzBt&=}rk zq(F{d7*D$?z3iu>W3GxDl-%>Kvpu8d-EsRiEf+&8P6M$QL@1WIwllsne4n@p&pLe> zK_I+>mB$s}CG8^ZL36Fa7DFbU@!W~sRKZ2M$;H$#h=ue)3uABzn%$Ns%AF*r&5E%ihy6#>1 zxZlMf7b^8*;M@o@=(*m!t_KwR7~7l>S(JVLNN zNCCEQI9N%#+Bw_6Ad*AU%jz$g0~T(U<2Qc(zF_0#7lLh87Vh#k4tDn50N7i77$ke! zxaj^aq5mfp#QQswXTafV&_aaAh)kkicgU<0gsUzV^`x&eTGeZ%vY2nL4&E!Ey@@VMjs`3cbBzxzt zY`0XCv5GsEuM+bPnnw=z_xFd+M9zkIMu2WhO*VYV1xmPaYb+zr=0mT=S5-s1Sw

IoMw%-|<`Algfb2NtDIcfMh|EdW%+Hv`5 zcx&u#R1FWBGh*DqebuUtb)p9Id188ax4q?lB=&0m(-iMR8V($h^K6sw6*&&IbzqLz z-HQ&A-1vN+B)Ipe7gkBnzKt@1Pdiovn!1mPE7FurL)vzCepO^ACdmxhy*$1m1_$BZ z<{7>GbbtP(oV#3S0nvf(82bV7DCRIX0E>F(vzpn9V94aaR_d$%Zh2YgV{mT7dmOcj zpZ>>pg!~DIk)5D~_yQeVeknmfm{r_Quy&ZSvj#SevqdTN7wk)>qlju^gcm_*&w~m! z5$_?3iz04xMiI=jj=cT4@VW@PaOsGpaD#A4@F}5U5*+!cqwy#jkt$L#KR_MMY(Xf# zQ@C4pN~3T{Q60>~i$Q4p)S_hIc-*D1PH?$YQdF-q$~|{v4u~9bOpU|^T*MGchr*sj z_M#?T{g$zAS_%$b{kr2LhZso9y7|7}v#q~@3w-B61b?3fl>>?uk352p9+g+sfMWT_ za)6M0rbG?DJlV%w=n-S9+-f5*SZdV-&{2A<+RGFMzK>mcNQTanMiV_>9uQ=ObF(Gq z3N=&ri-3+WwW_AH${q#Fu9g8!OO64Mrvmp>=pfLv@R$G~UV2Oe5HE%Zf>&h#9O~Eb z5BpaR14kNuxlk`)yV5Er#EwZsYV`#WTf;AV^9BfUo9Jg?A}>Bhf*=CvnfA-76QS$C zOU=yuq=IS&D>XReJ|>a$8iv(F4M3v0UnbNQfMc^ym$V@Xz!|-2mst%4EEl^|LEO}v zGTI+~04#JB0 zLehY`>Lf*+iWWi;8=x#BYe{t^)DqB5sw4z6_k}(OU@&27lH`x76(oW=Ae4YbAd&iZ z;iy7E1o#DnA5aN2WaQPdFC3M(5QCrq&KQfCCbd2ksVfykf%zcJfHYDsy2+|=un+_Y z;RcidlY#g^MaCX~bB|tfh_NLvw_-si7!QI50Rt=m$UrbK9Ed=w#b>=)wlbJ0FLhb~S8;#|FgAo9G2JIXUjc)aRt3&q9ofDSo1uN=gZOgG+6!Il0fV!+ zbUPR4flC7OZwva5E$V8y!NG$;#i-BUppMaeNY zB*WfTyx`~|6Pn0)p9IANaA^94wO=7-!(zP!CK5gR14hP(RXD1W%+Lido~QDoocArd0Eg$yol#6TLWZNw%4D|y7g_w+wy zQWm6A7F1FeWb%UIOIuTx7A3WoR9E?Lp_M?_?<4`Bk(`}90ga}&P^@}+vl6DNGN!5` zcbDE#jH82MrmBKtLcj~|TWY_TKCA@of_!`H?`WuZ=QG0fhLg$?u&+te4syOvfn6;W%pyoCw@ z`PKE+R-FNM8iFZMQlM&?x>SL15q*}9#)o2c$%1#_STHF>6QBTy!Nm2$&rpA@HL5wP zuCAr7p{}WJ9m_X7!_9H3VC z)h%4p=;LRRdGJQTfK?qdHOXuKNCs;1$YZ3)mQX^o2+kOeg4Ct-v7}xPF}ffAzy?jh z3@8!cjEPrWc&I3;R9&qg0nAoe8y21$p3n)OZj+@v=d-NEiWu<%g(9l6_I3I%1i(Y; zUQoSt8!&*;TT5S}AP&p`!3G=v=NRiX?F&Yg3u3@D$Q;NxY^^!rap5W95#jH{moN6VhFo?F1DskXMl+)u_p%kJ0-(mqCG;t5vvS;m6dG9dLS2n5$~I!HBCSXdO|< z*pX(E*L0DMVJ&i?RklkxMzo|541*H0J8T}r-Y z+Sff3iS6ufHyCZC|BxQW_OZcv$#WvT2$%Y++u#ygbYpeOMD+L^8{yP&hI4Z; zMp5(@=3KZA?OdHqsq@mpR}c4z!}y4W-tl zyQX`97qPC$uihh+5spcF8Lr~+%?!5u8vL~{>iI4mwR<=uRaGgg9!Pnw!Odn-N=H&N z8{ef@hGPD$GpB8K#nHB7xa9~5ZGCS{qS#84cX5V`{m_6rq3RjVdCIc)(VEAq&bqz( zNpgWGiP?)*RGu@`-V2JhxSfYzFMOZNN%b`qg)nv>&i%3{IV9EpdmsvrD)~evv`D5I#!*_ESyM`N7V_eO%7=9OncI4C09$XdA zWd!1lDB7EF*2iVpl-h^9hps0(Gnh-MXgoCTw~oxGLY}x5a6*gLrtNQhz2XjK8DFiF z_g$52Yo7DflZhteN-Rr?OK=o*m@{23aLB0@nH4M-h!?39EXG#D&wKd&c=fbubEydVaEVRg0tA5uGF<#IPyb#N*NRGt=SVyhdxiR=}2_P8>LplpUfs+zQtm z6q=|)Ww*Pka^W4jz@wM!^r%Gj`tXNXdfQepz*&N9j40Dfkjh1hIR9Y#xi{A>{#OK( zn9pE6L^k%Qy{detQB`lYuh=Gu?Xj*B0);uF!`npOEMKt}6AmSO5h#wpzD2J*NBSQY zkFSUxnfyIDzEX+4rbM|%`HB-n5QHHLcZCCgK_#0ACXX+;N|YF4KlgdvMm7Fc8>dKa z)auxm{6LbFH|!E&WIO256`ulpHyX?vgAFHuQ^+vZIHuLvC)N4W?phE(rQ>NWmG_}; zoAZ`E09!P%J-Qty`2-;Vk3v#hS{(fJBjxDF2H5kO>lQr#-THv>mg*c3K=^>!mJl4a zB<)sU7Czbbl(i)e0ai(73wV|#<9M|eo(JQP;~L@yXgWTUFe>}Yp87jRt#KTC4;+&R*+vo98H0Ff&tDP# zDnC0D;=Sh!$SA`sI8^hWdkDn7KucSO2jH_OiKvzyaIBgPP@J+C2o*RyQk?GdHHF~R zci%}kgm-KSoxD2F$=X}q$fc4BkqD8dI_aRw7Y`G=!MMded;)M$buLn^UTw^3S&7L~ z6?GJ-je4xCp!4!=xgPTQb3!S&)yrI*N{iPq4rjNWC zyPe8Vo5helB9ay4beR=7A{XbQk8?X7IXoNdk}p6p8)GsX(dKuVWwRMWmU~@Ih3a`k zdLzKbbM&?I4fiikYKLyYghr?vlAH(TXC-$g_U>Oz_?EG&V(?cw$E-iB5O*b6Mzgk? zRvL%m)Y(Pt(?l6|+Cx@lk8!#4O(sHeT>F<^T+p`Q;H(gb#VYb*k&BX*jj?xedq^(FjIajXyO>Em_D>eIz@oVH6SM*Ve3hB+x zKD-hU6#ju6R9X3LV@Uu7&&un$Y~Ld8RG??Jhk(BuCguB7ZY-vmcgfr;TBUZHmS0*> zrhvrFIe~{KH1T3rw5AI$kY-+x1$7^uSl#;&hYZ6!StBp_i5y3@d~aPS4jZ%+~$<=3m%?R(4@7v8^WjdQg$~wsUUaD2b6K#jX+(ae+&|`$3Es z?=owQ-*DzXqP>kSj^(j_)@OC&gk%$e4}K7#)J(5ZE*%3jk#-dOzFuk>0~n!{SiN2K zuuT;aN)53jp;cr5E}rEdG>Mw(a>^IK`S`wNS|s>8z}ExMJ^hK8WDDVVLG%ZToZcs6 zC3oiwY%`ikT>BW5sNRWq_qUXTcy$hHA}Bk3vIY2iXruwry;kj5>j7qnCH&G7^kJnw z4^sCmybTV<;vwYmpNHD`D4oK6C8e`p;`SyXB)0~(NujEH-d2j1xXw%CrxjXgCU~p| znk!a2^o>^Vt$)^-XHFX7JEYFB6A{JSAiKn>q@*`KE${1g>)Kku;YTNa7iGUXF^E$L>$tvN1R>mS)^wSx_vqPGi?R zGu5ck=W>{g;hEKSX_Ey_ufv=KM2Hf3)YZgd-N*JR%(}tRgsnVK^P(8Uh@G1>kao-SJ*XG zMIop+O&l52o>CYHn`jX(R%Yd+>0m1t6qy|-%CqLF!%YgSl!=T_vo#FwmudV9>9?7SUHR=`U&n52)dklgeg>w7tlYfoUnd>Ah{<5*2dEWE=^CEHmHrh8}@4;(2mOgo*Q4p`sIQP6Rwv(h?lv%@s#j&WTb~Uo_1|k<^}i%!2EMpyP!O{JcYM zIOs;**)MuJ0~C&>&{q=1f-ax${2}CZ@9YYZ7z!X`Ql2(Cx$3;DD6PnK1uk0mGU9`l z2{T<_MCMdJe)Ec>n7m7K^lR-ntbX9QhXRm0GGxP$2!gqqXHW7P%sjGelBEQ$+^@+}g zSyXEeJig4Spt6-r@up|~3o??-caP~ufrap=A+d3R#a^KB7-v+8>apVlEt=j8>DaiQ zvR>xvZHgB?u_Ga2<4T`0CHs**6eEulao2)Ttd=mwR6nEmU|8ET+>xQ-6un2la3ts- zQ|-kVk%c+Rm}43O2NFd3e28`my;h=reDxvsfh8G(d5mvC(i&Kz5y>Lqc**ervL``Y z)BS<4I)b3!8=uZ8ZmoOd(oa){e7wXXdBg&0bt&MnRms$jrA6wa+gy z^T5G$AL9M72kuF*!g;x40QRB0TXoBFvR!6x6N8YNe^P;H$YfNK1S}7wkGLJJEeA%~ zd!rlb$Z)%z!Bd68=X94n=L|zK#}9F%BwjDRVnCm7;wnn&_nD&j=SsLpREbHvSb>W) zL`%bU4d+C%zzwH@G9sO}5+f)~z#XN6x1%Md!B7xgNfVpWEr5}Y9gfX)4 z14&u|XLh1y|C{^%sI?E|$ZyGRR@&&QD}IE&k&oMF3=hzt7zc4|Xos@eQ;thY)j*jg zQSl2<`b|QaHCPcCk>)2IzmBjX)WFuD>VnCMqBE;RB9N0sjV= z?*kfN5fP&S0-LPK2Ryz4RiK2D2ENcuZA1pV@5)tHT;_5$u@}mrPFG2|f<^POr^d%^ zf)moUWqH@MOG&Bve)c4?4Pq8my@Avg?J38CTVa(in;%{_t5ynZyNz}@k?`LS+4DRu z)I+@|TfbRWFW8&7JWSHpnph{!ecY#d!7m)VdS5a4>uc|U`-qp>*5hZnRi@Cxr{^Q= zBfhQpZdF%?M;Ps{%O4-}pIn}n5k^pt&`gYQS^T)}%~uKDp2ckvej$9w-!563k9{Ix zdy|XBEBRApe{ZGPB1|z&y#?8RMWMLU7e1`w7~>Tg*|%?nWh?2DuJ;J)fc2Jf;RKCY z=ZkjkRX*pc(n?crES}KaGFZ$QuVXK1BhnY)R&M04eq{#i3aQxa&yHE0;D0)?zs}d= ze*RW{`%E^gR-H3VnSM93c07ONqxE&uxVAqU6|OYDLhRlE9ld_c$~NqqJs!y##7Mm8@oanCMt!(OOkq-Z*!g!1g3eVhOZG z=C&;1VobSh)$F;c?j^=lUW3;2ut|A-viWtI)O~a&R05zm^&f_L>Qj5cNFu#?dmB($ zUJFi{gtM@iO|Pd^GFNi``T9owdGo_ScXZ9oaV=f|DF?io@b*Bnjo&-qs`#~TD=j`L zHc5P{9rZMgX04bTXC`xBss{br#0&RV8(=FLh1zkZEh3xBpm$IWqL}nuh-ct?^@EQ} zx&qO>P`l&c)?i4-D9D`75qYyTRhX24m+-a;gAavtaNy0?E%P)^j9{^z5((z_qn}wu zP5kG+W|C1g4q&2?W?Q$XGXdxsvd(z8o$T@J2ty_r{Or zaTtRe9S>mD3}Hox6w!^b>cg+G0_DvqCaKNmhHzx~eTN077Ru`*W1UDXO{PrJMttkR z5T{i1W~7W7;d4&ghGy3d4H>&>Qc$Os@qU+zQHQ^3ypXWCrr5Z4QqU~9+sC&1-hp1r z^+3C+wdpERoh6M!sF~|rb@gWnV&=7JA_yRWgZ%Y{Kzc<<%;CgIPQlk|t{1LxQ))q) z3;2z;RRV+~42EA`-Cn&jUWwoj;wv#l@!rrHI?KNt^21Cu;FSBgLQ6TkeJeyFeZ&!W zh7_l^MwnG^O-((ky|G;raEf>?96*A0vC(lOrp}zNHy&kHp;D5sf`MKlPsUKWobL;M zQRebKr4Ht1G5C9W@1R+8iQV?00J~b{Gv|5*2rGk*qV`zB)Ue4G4$(IvlhLWxQnu2h zfo}^IaU+F%H=@1mZh?MB0$c&!HPd+Y4hNDgb)(EzGJzLHhh{A&Mt14`fCWo0Bw-2D z0qn3;2g$*zGVOq8JNZ`9{R0bdCgDPIG-tF4rE~+PWNMW2w3PkD$aSaE@>15@o#J;0 zY0oxk%khTZzLla$3_f+gL^cHrQ{7Am5Zj8sX6?ASAFL8PD@~&tqR1*Yq0lA?IJ#LB zNMCC6Uy9jd`QZ=OgnbazhT^ClNm+71Z8^MJPR17Fp=R z5%~()Z5p=NZ*^_Ug!8b^jSIMvJgZeib4d!L;S2?fCVPa!Ie|=R8;wi;k6NG1mfe1i`p;XHK z=xd{Ps{?Qt~~p}5MIZQj>i9Sa^KlesqZYNNTurvoOKL~@uE1tNl>mfC2DLKcx? zNyLf<*d;>Jp|8RO#BON4ta>*x;6ryTnD@`lCaN{d2|E|uts(oGJSgwvH{>FK?=$`M&_>q~cvudk~N#$f%LJJYF&$+5RAaZNOIw{gsTB!&5uEpF zZpt!-XZX7oe&`2fS(_@eO!VXKp2<%&h+Vv4(l=0$ccY7k-`_)G(l@;HFSk`B#f&=M z!sWATBRvP>^~%!dF?f|g&zRW?_iyqF_K}~ry})B;^!ffJec$9-NmfC=^euWxX9b^@ z@6d->JDb$Q+VVUuNr>z~7{Xh}`vPZY$B^0HJ)`YBl>AHG$@H=>@ROC83fe&^rr201 ze%7jG5ms{7%)w)4fo$aud^DWa_ndHxVcxr3Y96W*z-!&txbF@y=Ql>V7P5)M)SejY zBAM(Www(O-w{7vctA}v~`YE9n$O>&~L#TY8QqZ+-H);m@f3f4_&5T z5_eePeKKCAu%u+)GjCU+*XwF;GjID~{m?(}DP}l8alVlbZ=h4bHzd%%N&8Y`t(k(< zF7{~lAfKxl$Z}?3*&~;QdpV4U#r@2SoBkbbtt2}Z)XO@-ual~AFl&G6-8A72emF{*%66NGu3dI*c%>z2|YK>QsA+U8PjJ zeE>?J#mfHa^keF=?q|78dSpYA3^jH3eT?#AjWk8^@2R%$#*jKqH$H7+5Li0tNS5*# z<6aC*Z78x6RM4MXK2VoKyrCLRxp;IWGCI29&1R%yo!>q^#=?I`ui<&}has;P6kK;k z8Xq;1thZ&Y@*PCVzR{DGqdkxC6|3F4xHCCuz|_W4P}Mf>Hb~=ReXF@$HShk+drnzE zxZzN(=c~!1c*9~PmHfuEuv;Xar^OV*4V+=_NpS!NlS;#hV z3QzQehWWVbHLi~Ef%z{zcLe21aE`RAA`)@r9V;-S>yco2a$KSABx1F$m zGJh7ejIVZl&3V00=5CDj#_b$tyjlM>+3wz-(EcKzqv$1>{hZW-h^+s!H>tA=d$a`q z`~3XCjHkAYw8QcDhcr$UK*8;kGcZ!W#j)P-rG zvx$7Lu707QO6P70qja7EhH|}NUI4#?lBWn2vO%vYnHlLqnePJ+AOO6B&dp!u^<&b= z)@LL4nrxqSFOmP2`~+nz9tHhsK50PDNG7L}C9##ACf5u(_${XM8k6h>0YH2w6G>hQ zX->}As5s#MM(%uTFZ9|&rf}brXr=qJOM%v`?>6YNey)_>&F?f%dqj8MW3`a#$PTN# zd5j%HlOmDlY<(}=bM)%_F_ajqwoT<#Z#X-U|9 zoG=@*7k;-Cc(NQ4b|4_FUQY5PPiah7E;N0kE4EhT^P~<_U~ZJgAgp1AkSK_h{EcP) z%Hfy)5VAl}XbxtviUh=$C7Miy`=9jrUAJ1;C*?k-e zC(bmnjGEUill7dof)MCJL*&e4{oD2@B0MGz}ac(!tiUfU3YU7m=9m zR4ZO#<1BZ^K9!IVihI|IwIPF?;#c% z&_qZal#=4528GNfr!0-gn2PisC3=yiXU?xRYUpmMt)M@Rt|Sf%{T_Q=E!QwiPF|C2 z$Y|7pc@{5?m9FT%o=oQq!n?2Yh_e3u*j_|?WH70N$O*ZHf(4D8kSqhH+4n1L0NBRd z*8_C}vY|!-L&}6v)i$-hr~k?cTCJR2_e9YVpRvcV_;F5MAtF9`f{jZVIAF}cR7$SX z+_Ch<$~K$N8l{#o=rTC$qim`Y!5+HdQyA#YsY!wW0fPugkcs7b6TnO*ob9n`W@tM_ zzHhr1Lem%^_xQV!nFjuTHF%AeVA~IA>QALovK@|6kKp~vrxG3#P|o6KL-aCc%x_~# zl__L@<;=Di&6{uGqiyztvKk(ZTZQm4c0ahNT3&~0o@0tA<(Z5l&8JT@Bi;AAkB3|V z^y2=~6%)M3I!f`H$U`ia*;&XK&>w>!E5NVs+Gz$-1Y95!C#QL7hQ*}9|`7dNq<8p+ECCi_{- z;~e@M*{Wj(!WZ-v4yk|L8?)~lcCv?cny!itbZ{8|IQm-5jRuDK85_SqUcH7#XE|B# z9t>S=g0BT|z&-(CwJRVs3kf%T+?h>oh#E()62CikI!HqX4u+I@2Oq z|B$E>VLNE0d?q|FhrE`aZL zU8ZT)FaOXDVRKYjz!c3wN!dQGeSvlm>3}LDHt0v~?MGSB>zA463o;+DgK)28d0U%d1;um=D;Yu9GV91YU5C zA?sZOM6HggX(*JbrZ%Py*Au9%2+0hs@eURZ#U7M8b3~>AS^(Kk_B%qRdC0Jc?KEkk zcQMSHgtT0_9Wh1yw(EHqUOH_KGg9O{Lg4teavz2JMz1OAT)!@cQ3sAgk0G!j=S;Tes){GwOWQck%i>&N0^l+X@CV4X#^G!1QY z({n7>GgV!oI7f~3Y(t?r(YAi%#pvFCPq~G#n6{IaRlj)#rcb@T)-+~7as!>@q(MnX zFQHYt%SlG|0N5xh8}-$Sst^tkkUc1lT$OZkqcC92-l(jJINedH5KGv~#0y`1UXswU zX%R#8wG%>vQ)O*MbFQVma_{~#cuY%|zjO&sc^$%&El`p{s*E*%-XoGU{Uu$Tf=%N1 z&>+fLB)aNYBbHnn`8g4>DrLMmUxR8_1F@+(J-$!eaDmUhWQB;P`GL zUSkHPEuB%f9#e>X$Vp=G66URBt6AmOgq8XtnwrGEVao1cWcg4gcC&1jnvUCLP>Efu znasP8>*%e!)I|Tz-`Rq(cn{rd39|2GLo`*Pm^qV~Wj$x5`{88#`=E2pL*5T>KN~-Q zW*69_^#&-18&1!gP-fOGhw`X5tOpnYte6DF%N4>N$r zPHqj+d{k}j7j&GacOz+L>lC!0|fsj1EJ^$+{HY&jk?QC;G zVc9$qAby>)bUv#_VlP%}C1qDMM5q+OaXH`~AWv<5f&Wgu$}80$I;2JuQU2YOGNJ%{ z6|wfJ)t;)|RD^M>mI0IZ5mXf5XNvut2d*%kL+Tvo0gNL@`}0ztE-i5!Uv4PMQ>!C< zWU;X|pUmMxW=N%$2343CV=E zM3@r!gb9)9e4~Ez9rch7Zk+0Ca+I7%`__%BnMs1YE@FDM5#a31j+h}ZSuzZ%>!;zu=_wo3Wg&#r8 zGkMHEbyLTe0lvov>3C7U5MU}lV@+`hRDGiCMDMAqW(wtJGxHH9RZz${tljqNDL(Rx$OY~LE z?t*u!5dx!Y*Z5_gVYEz^_bO6RoCqU?Y2(Qc2pQ}6hl$ZvcCSh0O;|L$$u?y*i@lqs z!z9&eQrO^0420{w`%6>k(gtZPPHwB6t?HY~$JC`Y%esnjM+K@$qpJi3NxOXlU&&;W zCFf@c>@$OVxjqj8O0uZ9w01)Zl!sUZ?$bxCrdyGPmNaYurG4-|qG~QV>)5B)6hqVs zHi9ujAmx(A>KSt`_-#%7We@%Y0e#wdH!^8p+1+Dd#0zzk@9}_c{ z1l<${5@BmoFxha*%++Z6EL}&VEZo@ajD>2n{j7~ahoj$*!vMiMuKTEXy^o|kcRL&K z<7+p3pO5DyR#>{$`mNxVuU@%fHHR?vb5CN=!2Snt*+{JqFOSFoC;=M`84f=aU(HsW zVbR*?nD>O7G4osEaO6ZyjZU27-eOF}z{JEJqbrv3WlWc1BQrXr<9oAgEiWRK zO#Jowo3oN3=A2e4Bqyb@{mkLG4_7&@Ji@#S3n*1k=f$cAWYtvJR!@tA zz}6hx7_rHw9I&G&F@R*q_Aw;Ap?Z8zA2XBi~HaQEJQBjo+sBUYjzH&0ZnLGu%zj0m=Qpoq4 z@ti=kHEnPQ)s4hD8<%#?&Wa5wEpUw-Ukvn&cXA}TRy~%_K&1CiOyyR?yCPj8;E%?y`#$KszqBlEb9v3FDhc8OM4pe40W)<4IO)u0`k*pq~PyV`> z=mP=pc+7dL-sX3Dys&kG(8PiR>0-3oocq@;*-Q&nknQB@-}eSJ8OaYs*@hp#XeyXA(a zmop=DEP#H}q$USSG(?w1X zOC+zJ*l~66XqzNE0;p0V!Dy>k%u~iMoX^XNnh2ZzF6pppQzu%a|6|}BEe*E=i46?l+0|m2rG@Xq88K`A@33%la zt{UN`TeRje$hmhKyiCG$e$1PQCx;~C(NuU`r|{huu)1Ms~G=e)~a;dUnAH8e_;Dr9|OFU^;-oRBs8E!IuaFf zoPFnkT%&tNdMKV&Z|6gjs5YDcovXyLA?vO3cv5`BdVC~VfIQ$v3*Iv>#Q=TgBv5ktk!=LAF?JOgTYAv!aXZ#FGU(OZ*aH|fbBx77h z%9r*mcgxw8vrT&;uU7<-&GOO%Ar2ixD+GOUJ1uA2e;_!PT4Mt|}5!-7lECVScusSw&=DHc~3BZ9Vb3;*n)WC2a;!(z4Rq_X=3`+P^usvhm z)p^p~XonwIC+jbNer(*vD3!@RsL6XDD7%q+vGm5TV33`3I$OHN=XKK&SRY)#x;|}c zYtyaqC%W!CgfmZiv|eSt8KkS%7vIbb86sFX1Ndtj>bnol%w7`a1v(dmuk9ni38?2VSQ=ezyrr>-MCy;aM z!NOCKzDCL?BlU|X*EF;JjqkzYGl=>Sf$&~K#^RYUm$Wq{CFF2%srAlM(Gsd7YiAwc zLVf(J>L>5y-;C?`V6b=TsruQugx`c9yv+|MRGKQ)rBofvSB87O@pcqv(3S(Q)l`gH zRLc*^rQvdSO)oYPTP*y2vFDTLQ5?{RJT9~v!S1Kf3JLC6fB;qvo57*7LJxe1`;?us zhGw;Eyh-TR?`KlCo32B2_tVeG?<=d77BUNT^o1Kv>Y?{uQb|1%Gx6O6A-$*6aTzer ztE;Q}&e81$GGtH8He6PPJj!<=xJf!e(%e?ddMOxF$cWqn%cd`*yR)WaTfWkQ_ zKZEw2AcX+O(+ppw&QR$=I}nMH4`?OdodSTr<5^zZHJaWosHmHEL+dM11ZKF?si=9wUz6;si=WM#i*D$j>zBY>3Hbt1M z`YX1KM@H$EqZ`M-tF4 zH0gBdGzARSQ$av?%!_a`{HZ5wQ%9;i5BEa0b*ZiHXz8F0&(6+74^}2^$Zs9lWeTU3 zt(eo)cM;uiwNvnP@Oh1%5^P(_Q^eFJ%~YdfOoNrIkh`LEUgr@xF{p)+nZIIMcJ$I; zUQ(m@^=QQ$c}jna8f22dKoNNtgEjnB4W(Bh6#q+}UwC*y6WA7bg-p=QyO+ls6gZZo z1St#|>lB06Kho)Oq9*}D9{HWddGUI}aIX{l4yF@yqKUBz{?L(2U)wJf4h^}YsARm? zO6=Wj8o^=lEGI_wY!eOkSui-zMucH=qBQ%Jp~pR(k4MIQhy@yrUO*W*y9iQ+=?%yO z%h4fkms>eEVp1tlKxptJnx9Lr`xi~rgq4aIP{cc~_IzAeQ?RHlU)Sv7T;98DptRgR08*}o_~&&Fy2n?@VH)#g8#7 zFBn>x?q7vJlBHUGYI#v{{zRDEx+KYG-OEQ}a+0uC79f}cq8TDoldw1$`(35_rv;E7th7*mobnt4A30N5UrT}iuQ|dTqiIdhg9yEjYhVSl2NX&)YRl{zfm%NiHDs8&m z0`?~sh;+(8xu|b*aMHX$L1sWqrQR-lq*~lO+yg>xl39PiW!K%lqb zOb8nfO}@8Ao=j4Kmad*~;^jkd9~0I7;JKhMzZG%(_>C}J#57w>RqJmJ+yG4bmd}rzkxQA0zW`Z}-yi9P z$v!e*jQSTwaQ8_)ga-{USgH7k7ocdQob!ySQ9&Gsyj zGmqEa{;G|3QdVZKbhns(q#6y$$u^WuYLqX5yvK!>N|vi%s~e1EH`2&E;EWzc9MiLy{Wmy-S~j7kiSL2 zm5v+)R0NFY80<jM#qkl2V@4R!*KPu*%Z=J1*XqY(u^yrOeu$K zFZH4tfERB@`(W-I)q+Oqjl)C>92+J)@@~|F;wWkqri$$!9q__2SL`Eua$95%9#`>? z#zjtS1gv6fj<^7TV=VOML?lH@mv;1p%FUi*YUJA?8%J?rV{Pd|GzoqWQQy*7LIGom zqW$z{<%T8>B_)%=DxIXjy}nVkV5C*Uv?MB$I{&wnG$qTq+8i7t6hV}YTEkk__vyrTrldPziBwTEg;A*v9=!3yf zZ)=b`dS(S@MboHBPw}(WENu%bZcsVktS=!^&!}OlOeFGkEz}+KK9QD?Qxn*j2ydnY z1fC;?V7l&*oJ-D1ofG6&mvSpwAe+H!MH4n@1Q7{FCD1&80SwVpX=N`=hbyt_RxoP$ zCo_6)-XI>-0pkg$d5b41Sxwy5CVmgDiJj`VZ3V0Z->H$S3?R%JG#IC5QF+4k=)?{hJT)nPs-=pA{Wd>+T)=tGQ{rfhg*|7^9KYZTA`EE(Q^7}Cbd3JV(`Tn#2}tJG!T?!cJ%MrY1>aW_CKZ=l zAX!pTJH;<;Sp|<%9xLj~>k8%1$bRu;y{bnwnI<&Vgz&Nce#^kcqRaJs?x(-NpqULj zUx&b4_*i6>ADP)Dt$tg*{GMC-ey^|b&L1=N&O9Dbqo2V#Xsq*1sZUhF7A6zJsm={bK7axVwXD5DS0ONY!GcXS+MwEg+2BZn!e z3Th{llOCj=Nmh{SVJJQoWJPxc8gATYj2SdQYtmz+MNAwVOhmXNukXoLu{liJVQ%Gl zVuj~^@%P*ykCY@0jWBTjjc`qrH8Xs|bXkQ*itiUL2!BSK8rd3H0b3r3Al)j7N5zLQ zl8)gE0FhERy$k+s(7{;*+5N2>0K)Q9iNHE(IV1WVOL~P5(d0!`4%a%`LVve_mw;Nh z7JWt8y1Zn~u;#Y=7-%P`5-Lmdeay=x$lw)8XyI8`eW~HhK>aiNwT;}xG*l*n z0;i8Gm`%}3noHS+D$T%Ntt;f`dX4t-y_%6Av@1pv)jWxHId`uWbTuJ?_J-th2Hw+W zHM?FpDj3P~7P!05xLJ@zkEu=TF$0kM!TFwCA z_Q+b_BfY36`JkA+(5=J!2WSJLTuD41I?xt7`Zr48ksZ+Dz|)u8N7H9_jSh&@ zuq+$ql=QCH^XDU^{lL-qO)n#buLhlr7XNhVa65UCo51;ojsf z%M&I+WOQ-uQHTU1v57honiN9@1|nMYs(i_4akIVRc5?|6M6}V~c&M6cCWKwkzG~3$ z_M|{_Bq?0B@ocSb?gjh>D}-Mo%<626^pL4#*;d2CAUIZoC)z+qTM48&MLVYYP8*4~ z>0d~oth*Z~o^S|K?D9oH?x^G4Gv(mVh;8gSP2*)Uc#xs>n>=6*+3%Btr>G2SCV$=D z%+FZdoQc-o$;L8a_-onBD?TdpiJ5b>KU=WVpOUh7ON8qMgQQ5_z|Y^dm$p|oHOb;0 zOaw?APIZ|lV-7$8;a{pS=o}6Qv4fVtV>ug?6&$s2CLc{xgEY}xg%QjiwWg%K zMN21ZC;@uRLC#+ji)ilRSAEVuZ5JTN>-0q;LU`8Qx=Rg9Z>*%$GlrWz{(| ztE+EyKy_04@IQP6{;EZA5k~-)VFCZ50+~UP#RMJXHdQW#33d7@;EFNX3Dv5}U-y2l#(4#7ls0gs-Nvgo+mF7bZ*sd`OGyAR$s`*7>qVRRzSWp?F%=6s`X(z?h? zo(Q|9HIOWba&e-izW#W-$GE$vIGa#7B^cwx@cuA;bqAjTKDx)`D-2=<(~Ah6nd$M9 zmvM}ypFgJTHVJ=>Cl_8epy15-!?zY$yE;!7!T$qy zXD3kE6X;uG22cv?w0m7~GRQ9?eyfmQI0y5_OCpXYLq*a~_tCAK(1S4Ar*H)|y7~Di zgjM^FvUh&A0&n5CoKI)w7lPZH4Rk&Ijxn`D9+EibEAa;xLci`l|D#uKA(rSNapJPe zu|r4q5!8ty>o=U1)CjVRUXAEIj170~6&31Mj6&pY+igp^50ZDc8uA(U)xwqPf1zlBdd zdEfihfsob8<~#yZx#VHkLv<lg3Jro-*kFj2<&Raca6=r>_yqY1JX3HJ@ zq-BCMH5?b^vLyF2Wh%?I;;zZ7MfAYDf7^j_TdMIxc}i1`6n{L*r52)DPv4cJ(lZVWb* zSRi4`8p1P^F(Lu4A#VAD2jid8{eUZ8C%&sI0+Kp3aKMt{ptkPoH>I}j?-!+}{?m_w zmSSK)fks+K97!^yt{6;$NKG*)2yeQn4lbfr_oeATPKKya={AQyv3<|*l($?MQ;M7XOOm>K{!Lq0ZXv7RK-L1 z?Y$K>q$BRn;&FT(WZ9g%XOmRE=HEZx>K1k=%db`4P_1I>9_Qp`>XgU~tK06LpX*6F z_&(QgYa#Hj`--`ioBMquW8kwJ{@ySVrU)OENAXi_f=-%f>jMkv6CQ~ui1({2`VSER z!s-Sdsa7N*7Nq{{_CC{RkudKvkN2kEM*SgBEDVA(_tM-ugQ-|hC-q0Aj!(bC$&-zE zrNBTIi|zFV!FcVHrobXlG?U640AmN_rr(j=2KW(j5l#{@XU4~O8j&0=%LtZ`7v+rK z^4kg^@OA3{3DJL*DITPk5sdET`&ikZfyAs+jEwu+vd7 zyxgd}QOyEtsl5h>txzIoMtbL{_nJNDdCcG9^^~-a>;YQ$AJdli87(G&ayicoN4@!~)MxOuTKZr8wms3>t$9|y+8GJ5} zGmf8iHY44h8D_r(LGQ>9y~Fur3W>@^SD{_r*Kwc*wVAAQC zgcuMGa!`nO&6V5CHt10L3?&NOpy?+|wUa-KmhHeww=ph2W02$du+>;1m%%jvijk8Q zi4z)N0O~zG7zJr7+<&88VKmtd3eS{K0H_G=RFgBiO1F}Q; zY;v2TtD*7P8q&!&^Mi8{@|)Qk=JO|Slh|!I$hc5OwUD{ImjW~qnGJFxK2*J)rC_^= z)nu7rb<-VjD~tL~$9MS3jZlhuKNhTu^RUC76&ony7>hxIv;?qX#smyiq*z_}Y(4ogM# zJx6H?2VA3+0UK!$+L$oUi$Gm7oN&N?+Q(KNpXPP^K_)q!pZEIaP;|X@Jm8Z8hY;5Z zK;VMhet;QSKww(~!wf=YSG~5-&jvc-%a@oOr_vgf8M>eFonKG7xg^wbi|-p(qlvWV z0&r;TCg{*EwV!2`Q+?q#@V~bhF-9DH(5xmU5#4?fAzdHKf}&VLQ7NV~pXZKSWg&KG z8`A_ToTmUq_+WV^v1b{5Ko^e!Eu>+ivKm6%lj>#jOOkN>wTorYggs(B zhcEJQke1sEglf@ZRx>tutgrPG)$D6TI*=7Ko2mS+j zp8kg^S6|`B6nKTLq0tZ7MkniJgoJs;`1QWh=7=zvaDnaT^X-P-E);#}V=nnrwAOP7 zO#!I>NG_wn{Lq~Nu5`KD8%X<4E+`zwA342H+?Dqz_9<|!%`ooaMI>y((NVLJAgx&u zqj>I;#MjzH&xhgqv<@to7W(4}4B;^Dl=#>!KbL!4dR0m34?vkBndpqB40ph$^ha$C zc8t&uwm_^cKMxUwORiP{ng{2X=GvIPMKxl&ubV+GnQ&p6;m9tLR z;`j}joH9?3)3DBt-y4|c=NOrm7QsRku!Mfxv7#aC!=-GD{v0Xli3!ls78m`&Ztjc5 z>;R6(4DoA*pERXI1)>-Z&9MhXWcy~r{u_;v^&1QO?=;4L;F150#`qrt|MO~L_+C=q5Z8ag7@0V}iMId8 z#dE=-Wv~1vx#X&oc+y-qqojIpWA_wH?HEch2!dhGJec2~grMB?r-#n}!-6?(ijW3j_XT>NI04`}4m zbD%j!OVN8vVISUl<9#I*MQ;VHck%woWt;-f)=+2pS0IYqp^?r)kBPZiB%QN?%~od< zTNRzP2(Ovc)71U5J&?z4{w0kMh1aw}<#;pCM(R=`J-@1v{JjV{6hLe&7Po!f0L8dfWI44gMnVU@{2w zP|UC9T78vh5!SGy_lY`-+=26s+_7=>#Wcr-C(>wwT`;MIXyZB3XXj~tHSi+zYvmja z8v@Y=gMVS!?(f?xyf58$*XDO9ec=PhX9znd_9-D}*qYga zk&YAl;~kZz|7Yd)z@nguMP^~SB%+>!!f@lDAO;V!K|NjHyt6VII&?T|DoJ0u#%%EM zCJU$B!+pb2W>K`z?zQoi&tYsH0CQ^fw+(Hfj1PZ)-JIxQ(ZRRbPQs}A^~wC9=#^?v z#lkx|}ltSL}0=6LpC7}0Z>k2 zcUwBqCVN?Yb>Sg;&wf#_m~6|Hk#X(K^H90vQpB6#F16l{Q1o!|e3tVohwLk2ztbOP zbC!=abk?w|lM>}5I1Jz1qiY@B-zhnqs{8rCJ~iVP>oZb0Jfa<0czmkbhnYY37dNw< z@BZSPpjiC;WWYgl+es^dR7p1KsH0M3;H^xUl8L+Z`x$U|jFc_)xZV)u6VNgPd%9uF zD|fa`I;pz7>UMISSR=D*yv;Fi?Ee>Q>h6vwOL@_V-aP0gG0Pc=W9=R!G1=utl!7w| z7d?6^{(V;7-cAQ)u8^2BYx59bg( zRN{nw7ky2~#q|xi!=-yu*@|sprJ>?tjk2SB4i5EkSg<~v+kae3&Rd_@#h3s?K<;!G zD3~=^kEm2ZF)V>oJuDBHNdq+4{ExDPTw&@y0#EZa;p&R6l=F%&@@Rk3ERpYzeAr!l zL|TFk{+R+&2(PgKL{QXOaOm2?1Vtl_GK*?s>Qw0l5uL0stSowBJ~+8+n=i_dG3!o;in?izns=B#>5l??(Vm@Prot{pqKfEgHe?dE^yd=N34Rpw6>C%Ew(%i+rGEO_A>InYc@RYn{UIg@I6 za%RhR=OD`87DBP7-iSt!8gD5%lTr7B@4@w&d+#cT-yQIZ=n?tdD|M~Bc1ZHP8qHGd z2l!xmhc`%SOi;Z)|B;BBed92^KaDg`5Bq0V$q~!U)$N7X8(*X+Sg+St9nLCW=&tV2 zC@EwY0+J!?uId(#=!Dv>zwnyfndn@u;t3=Mk%o)l;o_b7G$#}h=Ot_(L>)-z=YSNH z+!!REm`GZnK%-8;2cQ>|J;3N9K&JH*ts0V=Qe1ZkkJWJF>-CoSzQ2J!{n=xWGnRG$ zZe_?P<|P2X@zg9)PXN6!4?a^r#P+8GY;OPb*K2-vRq7Vk>^Y|NHU$g&zR&jK>2lmI#qZCqy5*)pFz$I1#xr5bv_9b z0M}M=*QY|I)<~nb)ZR$4vVfsJSG)4nOQ`qJ-wt+X^`9)N!(=I^qom{%6!eIOu0S(Y z1EAb1R}NfPt(-+eR!k?@*Q|5uY}G>Jvu>uS7ct$!yWU zZm~pfRRde6Fak3hp%@rZuH_X-aS#B=18l)WgWX?@t)2S;JPM;fqa2^y`XkG+vm=Ab z*%!8pQ5u_SL=ZUx5H8S<9od+K(d8f?U>NqxY*6Y}qGhg<#y@-%GDwLjSqo{oFnIT~ z_iz37v54frEa7A;Lfp+{K<mAZ3(8%cLXvp6@!5K`Soqw6$Zeuf1h1PVna<=lWBwWH_=|ej@$H|%?XqDF? z84~$emls-Frqu|V*QNv8gs;L|)jq7*m+AowxaUC(`D?q%pD&wrYxYvi2h^#Bbt^A3=+cSwQ6xM#QSZYI%AlSqT9~UXY%d*RWnEY!)`ELsKx15HZ?B9`)fV&_^?J2qI{v zK|x)aA|vZa zde1u${in0!joP$3nu&EMVi1Pr-aWlnDL`%F!8x;l%&NZ?-qRsGZUW&FzH@BXy?)fC4tr{;X zc$7*JlXohq$DxV*hTsztEfmbcZMb3475k8TI>CJ^d?*;Vk9~_Py&xpihjSe&!P-P@ z0HoXlCWG#TXy!>B`tZ9TGH>=$+D6&TR(hnLN9ff6V4Dx?bXF>=LP!-coT}h ztI}od53~>U(OCA`pfKHST=YYvbyC)hL<5bmMZ)f}=ZE-WxZSfEdxRVti12X(70aP= z=|I5)I=c+9_I>6`#Ja)l*AzfMdyCwU&}|9?EeYkp?F#Bz7-*wb?@EAwyrrp5f<|8r zy=jt4Vdh8k)9G$8rgIqm$(PPf080btQ6Co|V43GYWVBrukOG}GiS5920%iW_Q~r3HRBKb~(WqX% z*{&-*Rax=$xwV>f=sZgNaVsf_Het78X@w&jHeeCb+0I#X!CEDoIdBq9>EJ415ps%o zMBOdSn0_(*z-PH3qng!FrJ-ME@u0QM_wgjfVb!hgnqsWx;#x)2|l80VbiRdY;(HNh@o9o^2-_W5vf{v{KUDq{agKhQ47{wA)m~M-Kgc?i;9K)#AesgxqLk1 zRM57x^Dr@Md?t#_=2peITEb*}qdBTL5uq9O-d|6nq|h*{L#-*V z;}H_-eSyPtrHF0`=OKzb+C?V5$&jdV;hfUWox!2n#c>ug2vZ`4gr2k9L6eoHXSGW* zo9&cjeC5Z%z^P)6R$d{s85LsKwUzY2>+zZOwR+^&EM32-DLGWm-4XVOiaqe`J*!#@ zL>^kcaxt=jsuk?+42|}FYPhMa;vr>AlW0%hs?cLtMdvs}ZQs7N#5T)Zx2`~=%XjR; z9%a%ARkdTpoOk+&D3?r}R!-&9O9~q+r8`yc#6jx2BP=@(=Fo#16)cTW9a0_9d^Qj^ zFFqx%vEA!<{zrVp@U40I&!PWae)a8i_?Ktr+a>ewvDH5g{^wQxGq?H{;`|?@2c5V+ z+ku}5!dKoyc!@%wkC+51WrQy?tmTRDy|vA8mi$)U*W2jfiIP0$0qGv})O>DN*=|tJ z$$=*feaD?7+WnH?2EC&mOO5*35^rUerc3cRfT#5Y`^$F>eo64&9;SNYwVi9z0slV* zKJg-szJUWD8*0URM(=%?KEQoRz)?osmqLH!c!;heb2u}7Qk#{2eQ$N3DA>TS88m4dW5CbDK z{dcIy$f^VV|3en?trYrBjs90z2sHDzwd-H;6bs{bqV>O(g?#_^f3Bc^|i+!1*~y z+KQA?nm1x!sBG0_aZ$awB)dL$gJ2`V)#$apbZN89QBu;>!Nb!$^45_X6=gYn;_>Cq zcXc$6d^>sNrt{=}c@qt3<76b&6pm=qPcEvu1c4R&iNyy#*W+l?ki8e}P0){DZlSI$ z=Ri7muCCnjJ9O_xmmmqYX)%B@a;Rp;p-Ei6^8YF9JAj((nt$mi(t8sS0#XD?dq|{9 zuTmAI7?6NK1Vm7}H0daYPLL*oN>4=Kr3eV2MrmRqRhlS@pa_DZH@^RGzI#pX+U z;(o#QcKpSfoBD;XZ?O19Bj;WTe|z8~*`v5^bn;2s4CUKx-m$i5WOU@Y$-L7$!C!_) z`OrmnzM;g;>;Ylm`God<=K#YC z4nf;hh%pe<#}LP4f7bfgz(zrBC0VvlLU%nwEtlh!M>*>l-ah!2ozlS7i<<99SpUpb3d2U!a;?<2lh&SzslA6T*m-Pk0m3t+a8c z01L_qcS63ED$WSwOLibU@~|JQjI)Z#C?TB&j*v&Zp?63wzzQZ3(~f!J1x?CGvJ%7D zQTb#yD0xBCNR|MUZ0T*^>m`mm4X|P=@mC2~8wb6!`W5m>f`B!E#3&GuX(SLJK(RzY zi>&}0l#+f4noAM|?o*1oy##T0F~$vIFBH2ABY%!J? zS&Cu9VQ&E@F9cK2BO?!Kney@O!sNSApN2U!l004SOl1JD6zHS8d#9a^&!; z1aOhCmr4Qy7x8;>qo0Rh$r-(6(7zA z!$A>jC>SD=ha@-?tO+*kev3ISOdFuOc# zP4EPpsSe6w3rAxj9UfIaOs&9H#DVk{kDoWi$Gjm`U6vYj!3Ob5r{pbTut<;;7J{|I zQb6*cJ`lmw3p*lHU~OjzQT0^qm83pr;`EeHawWFKU`p1oE;Hm5s04Hels8mqqj}tn zy9s9*Bs>UujJ)f~1eZR8wF*)gL|_{yDWcf1$zd_jeN$sQZ#mOM`?eEUOMdpj_n_yd ziP$1zSMSUU`w|0F2WLBk8P2!=UUT9nfA3_H$Od$rrUjO^1~$sdKVn z(8*nlBtR-bN9vRuOL~ z*Lr8!4I5#)q2P18RV6#FtuyHOw;=XGf91A&%K+Bd%>P(x!LkC@6{KP3t@$WV!nCdm zziwJ5-l-L!q-k0QYKHv= z`C=VGDrOf<3(X22t{eMy##J24c1dx|wf7!==%sCTbkGhf4@!IFN~s( zXE93)B?AZPGrC>W+n#JPf0>W}Y_p@f7|`{4K_!rL?_{@#;t$Qmm)-MS7rQSm3R85_ zs+*!XbQq=M?__Fn9Pmam%$fX@+IHRK4wYy}yZJ^;XbtVKZHHXD_X&P2@snd9%P%3q z^BqX&VM*h?w1Ey(U9&dNZ^@s8&6oLkzNG`hYi5=~wValdnAe#C{JY{e>syhwW1lbVMfgFTv8-A0AWWjg0etZO6Sj zK5gWmb&eQen|58W4rC{D`Lj3oc~bmu%`y2K<8Y;I9=UJ)6Xp-!WNwlAb!t0Ab^jl> zDA$Y`M-+PtzYC)pdtTY>gSF4twSuQ<_q{19_|D4TsCeb0?R!8J zSEwocmia1QbbfwnUj0O8309-J1m8YSj279260171eFH1GhlBffqaJ-uih8yoG1X7G zK@My-ZLA>Mrw<1CD?x{rXLc%9C_-$7eKfqEbMum?;>nbr5;}$DbgbJ55a^>MOdoBS< zC+e6J!)kmON==bnXMxo_9@)h_q^Cq}{M7^JvwFpep-w3>P3Rp{WU!BwXwlOdU~WZm z1jb3Kixsgd#HOH_M0xPt1t>|;BgB}o1x|I2bQZa;z)V(1EOQZeVr7NZi@x=P`-ACV)mD@ z-rdjzpH0C~el12Rc4~C#J{HKU#U#bX6U*Ms*dQGo7q!3`s7pSw6T`d4Al||=b7X_@ zM*Q_akrsg&#_RFZ-B%XQ1|De~*ZKW2(FVci@P%=$2pb2;?Jk ztFeg0$RMOK%+B3msI-TLXZ;GB#<)gX9+F->39iN#kB{*WoB zl!+xq`UK07u1IyB5!RJ1_VxvgI(w*|m?A4d|6e=4FFj<*e5;hflGT5KX;0>i!@*#{ z#LbS#PDn?e4 z_Y){Lhl8E}dA9GmQ7w>n!`V967?gUsgZfZPmX4_U;1KD4IgQi#ZT*Af1|c0c-SOtT znrCKic){ z?Mk`+36YHQ^G}ji(dIfyQ^X^ zl2m$gJd#?(-}Qwo?$4v^$G^T#y|-vw1jYB|49q-iJG!X6l^JS2b8siybM zct3l$N(Lm-Y13C;phCA&l2ZJU)mRbg!;Id~0X`J{>#L^c$<)N*s(%YGFLL zVD&w_T6vbVx$HlAFt~TGBjm<=baS$E-xYG&?CDcyhh}ci_+MqO`_yLG)*_+%Y%l9* z&Ya4|*bQreqq3l#&J4RUY^g-5Dso=}6HQzQJ_uu&S=6v*A?rJ4bh-*0S)oWE(e9LuP zs}RS&9@ek#NUFPG+UN%ai&Sq?5xC>>1@~@;W)T| zNv6`}+)p1U$U7~Pz+<+R1Ie4}a-AjK|2QZCz$f5D^(Vh+ST2ixL>iov|jEY~p+Rf;*mE(K@_o`MMO}x>mx7S3;qKGRG-;9=V z-m6(7s!zhpp37Kzg*lP(H#i)8`sCftb;4CiRqqUo=kkQ_RvCSWqKNp35?Z?E?uIFb zx>p%Fd_UUg=f1k_1?iUMJQbz=V!C)uJEosgcS&P)39Zp3=*2 z-wVH@KJ*K<`JwS7_(K*Xw%F3}pB0m1M^*$Q^33d+KC%)M`8=Y1e1cAh1fMcuWvZ?1 zwPcnn-wtugU>>Zaqa9x#+iogJSR}n|j+Wrf=xH0Tcaap%>EmbdcPt z@;o@~TaNH*Ul?xw!mY0a;zm=YkF|8}%c}6|sGvNDG~lBmcajKT6L72bpbj`ke9|-! zoHgs$ARZOeoY~N}Rkmt5`rXW3_n2>-FW1RH2t zJI~444QeLny*Q>a!4P25Xa+?UhnsJBJa!f6yIy~xcHg1M;Dty1jAZN7{x9L2$6sDo z@B8l-$)l?b9g3~cg{CUXUxQ?BeywOdy5Bi;<<-)o@EHl=pLH#nY1F5B_jRKjlhiAR z?I~}{))cfpGnD|tZ|$2nk_r|23vwv#{Ea^7Us^65{xe9&8+uL7A2(2?gtl5)^4nlG z3721Q4!5Yq`MNvWsD88VS^c09cXs^(GS|?yLNI5gTqSioXP?#^&x{WJ zcnS#^h?$4~xE6KPz-DzeK&0o9Hy1=D3!m!BhOeR=vJ8(}kFMgq67G{vB3&U36vG$Xyr-$W*&j;x(=*M0BPDurQMAbp|y*@4KrN!dQ?G8!tX?-U}_OLTEC}$_{K+< zv_~Wh7FCC;6qZ{H7wX?j=QHW`9rF#T6TZJX6nT5(osG`vRk>F#R%W&hlzT1j*$$Nb zds`~ozh6t@sd{GQHkTM2;eF#qfyO7Jb?`;;y1lT{nQ9~CX6cbLC5hqo^3fGlzE^S> zk=$>)J1pnIIaH!r$gKtrN|WWI1`cO<9=@HL9$4qfP`+CCHeqtQ`Pk^2$ikP$cs{tE zF!7|8kK2}7kIF(GzTD&tE9L7%m4_#`2iZENS3d}$yy^WlcZ1!X{hAU#iQ?^ zmk$iCk4+VGAf6hfbtgltFANp4IUN-g8fskV5Q@)pl+KyW4o;@GTwQmfK6IQ2 z++V8660vfAFzXzfb#!=XhkaIGve!*a4;se3BWdQmig;k*BEnH;a3a}-wYHYLu}eAl z?)x}9bYi@wMZ9dMFlN<(`HQVh`qGkXx(PpsH@m83^KI!_ReqkzLcONKM0V~Voha9D z2i;@u@qAM#8!q4djINBKH67+W*D}F&2}$453(>cTTOVV6J8C7KzdC1f`{f6_tE%TN zJqelxpZqz0vHWzj1DoSEF#oyB9K<3Jzq6%36ZdZEJzuUZvj2`rPNXd5TP?Q}pS$Z3 z^s<4816bMhY=wp1?aH|^urB1FIlW!DX@&bSW;~*Az$>E3!@uI<8T=GSlGhq8<8-=% zz1Px<#BX`KN+;Yx!;j^@PO*Qf>^u!;ma2cE9sc7qMX;Iejk<4Q`Y+zGlVB~-p3n1_ zWnpJ)-b=3q>J{g}J53W~e)B}F9xL#dI5gU_G$-Ja*dZF(?{2HiF zOja&ScC!09*QGPVq8j1bVp&|5`aK`UFL8$ZkF-FKOPG{^2T+DqLzcjR6Ig1mX$DcP z($k<%DuAAfwE6uVbj`5EUC-BJsv_9p{mi!6b9Q5KIl1(=l>=qotK4djuW>~mhq$AH zhPn*1l&+%8zjP%G)ZKW#bo-`=)UJh_)9lG}qH+o^hQ&PEPrdOxl$N|Enf>PTc8brf zYl}aedOY@>`0Xt3rW|fG`1&s7UY?fT4p;_Ru>YYj_FG;=_Mv4Jrr*jU_RD^c`x-@ z?|EPi1VBpz064uYe>A083upjzGz1h%Co_Pc!$lndgVFM(CIzVt4KzFua5yawsu8GN z5`WJFQxl!E7=YDbFly=lpYdOu!B7a4js{17Y3&AvLh1Ac!;#c9C(V8cI5p!bKPUvELAMr$pyL6hCbemCrk-Yc z`842kegvb6Op7T11=Ga{s0KA6(8vcen>DKrf{mW(&9%AFLdz*07GH4`cfka zgq{cWAkfGHfMIZ2nE{9f-L(e*!{N010T2XTJpCW-|Hgpoz0}U6ziCuN>2Lv{a5@aA zG-?qE&04rRm`-09gxc;zJC7PoXlMvH0!h0c_3}X%uMkvFY3+to2LO5+l+J&tNA3UA zH#o@M2ZIjc(9)uo$oPb#|NKCZIcXOV5G?a2JpU=AGV}KekU>&?>faBBGR`tuXaw>S zOvBy79j%V=@bH9r{dwyNrC!zm56GoUP#uo{|CIl!vbq-R9u)lVZxf`31{A>|FK=|l HnB#u|PP>)( literal 0 HcmV?d00001 diff --git a/docs/demo_build.sh b/docs/demo_build.sh new file mode 100644 index 0000000..a135702 --- /dev/null +++ b/docs/demo_build.sh @@ -0,0 +1,175 @@ +env AWS_PROFILE=changeme bash -lc ' +set -euo pipefail + +KEEP_TAG_KEY="bloodhound:keep" +KEEP_TAG_VALUE="true" + +REGIONS=(us-east-1 us-east-2 us-west-1 us-west-2) +TS="$(date +%Y%m%d%H%M%S)" + +say() { echo "[$(date +%H:%M:%S)] $*"; } + +get_default_vpc_id() { + local region="$1" + aws --region "$region" ec2 describe-vpcs \ + --filters Name=isDefault,Values=true \ + --query "Vpcs[0].VpcId" --output text +} + +get_default_sg_id() { + local region="$1" vpc_id="$2" + aws --region "$region" ec2 describe-security-groups \ + --filters Name=vpc-id,Values="$vpc_id" Name=group-name,Values=default \ + --query "SecurityGroups[0].GroupId" --output text +} + +get_default_subnets() { + local region="$1" vpc_id="$2" + aws --region "$region" ec2 describe-subnets \ + --filters Name=vpc-id,Values="$vpc_id" Name=default-for-az,Values=true \ + --query "Subnets[].SubnetId" --output text +} + +get_al2023_ami() { + local region="$1" + aws --region "$region" ssm get-parameter \ + --name "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64" \ + --query "Parameter.Value" --output text +} + +create_ec2() { + local region="$1" subnet_id="$2" sg_id="$3" ami_id="$4" keep="$5" name="$6" + local tag_spec + + if [[ "$keep" == "true" ]]; then + tag_spec="ResourceType=instance,Tags=[{Key=Name,Value=${name}},{Key=${KEEP_TAG_KEY},Value=${KEEP_TAG_VALUE}},{Key=bloodhound:demo,Value=true},{Key=bloodhound:created_by,Value=cursor}]" + else + tag_spec="ResourceType=instance,Tags=[{Key=Name,Value=${name}},{Key=bloodhound:demo,Value=true},{Key=bloodhound:created_by,Value=cursor}]" + fi + + local vol_tag_spec="ResourceType=volume,Tags=[{Key=Name,Value=${name}-root},{Key=bloodhound:demo,Value=true},{Key=bloodhound:created_by,Value=cursor}]" + + aws --region "$region" ec2 run-instances \ + --image-id "$ami_id" \ + --instance-type "t3.micro" \ + --subnet-id "$subnet_id" \ + --security-group-ids "$sg_id" \ + --count 1 \ + --tag-specifications "$tag_spec" "$vol_tag_spec" \ + --query "Instances[0].InstanceId" --output text +} + +ensure_rds_subnet_group() { + local region="$1" name="$2" subnet_ids_csv="$3" + + if aws --region "$region" rds describe-db-subnet-groups --db-subnet-group-name "$name" >/dev/null 2>&1; then + return 0 + fi + + # shellcheck disable=SC2206 + local subnet_ids=(${subnet_ids_csv}) + if [[ ${#subnet_ids[@]} -lt 2 ]]; then + echo "ERROR: Need at least 2 default subnets for RDS subnet group in region=${region}, got: ${subnet_ids_csv}" >&2 + return 1 + fi + + aws --region "$region" rds create-db-subnet-group \ + --db-subnet-group-name "$name" \ + --db-subnet-group-description "Bloodhound demo subnet group (${region})" \ + --subnet-ids "${subnet_ids[0]}" "${subnet_ids[1]}" \ + --tags Key=bloodhound:demo,Value=true Key=bloodhound:created_by,Value=cursor >/dev/null +} + +create_rds() { + local region="$1" subnet_group="$2" sg_id="$3" keep="$4" identifier="$5" + + local username="bloodhound" + local password + password="$(openssl rand -base64 24 | tr -d '\''/@" '\'' | cut -c1-20)" + + local tags=(Key=bloodhound:demo,Value=true Key=bloodhound:created_by,Value=cursor) + if [[ "$keep" == "true" ]]; then + tags+=(Key="${KEEP_TAG_KEY}",Value="${KEEP_TAG_VALUE}") + tags+=(Key=Name,Value="${identifier}") + else + tags+=(Key=Name,Value="${identifier}") + fi + + aws --region "$region" rds create-db-instance \ + --db-instance-identifier "$identifier" \ + --engine postgres \ + --db-instance-class db.t3.micro \ + --allocated-storage 20 \ + --master-username "$username" \ + --master-user-password "$password" \ + --no-publicly-accessible \ + --backup-retention-period 1 \ + --storage-type gp2 \ + --db-subnet-group-name "$subnet_group" \ + --vpc-security-group-ids "$sg_id" \ + --tags "${tags[@]}" \ + --query "DBInstance.DBInstanceIdentifier" --output text +} + +say "Confirming caller identity (profile=geekstar)" +aws sts get-caller-identity --output json + +say "Creating EC2 instances (2 per region: 1 whitelisted, 1 not)" +for region in "${REGIONS[@]}"; do + say "Region: ${region}" + + vpc_id="$(get_default_vpc_id "$region")" + if [[ -z "$vpc_id" || "$vpc_id" == "None" ]]; then + echo "ERROR: No default VPC found in region=${region}" >&2 + exit 1 + fi + + sg_id="$(get_default_sg_id "$region" "$vpc_id")" + subnets="$(get_default_subnets "$region" "$vpc_id")" + # pick the first subnet for EC2 placement + subnet_id="$(awk "{print \$1}" <<<"$subnets")" + + ami_id="$(get_al2023_ami "$region")" + + keep_name="bloodhound-demo-ec2-keep-${region}-${TS}" + nokeep_name="bloodhound-demo-ec2-nokeep-${region}-${TS}" + + keep_id="$(create_ec2 "$region" "$subnet_id" "$sg_id" "$ami_id" true "$keep_name")" + say " EC2 (kept) ${keep_id} name=${keep_name}" + + nokeep_id="$(create_ec2 "$region" "$subnet_id" "$sg_id" "$ami_id" false "$nokeep_name")" + say " EC2 (not kept) ${nokeep_id} name=${nokeep_name}" +done + +say "Creating 2 RDS instances (one kept, one not)" +RDS_KEEP_REGION="us-east-1" +RDS_NOKEEP_REGION="us-west-2" + +for region in "$RDS_KEEP_REGION" "$RDS_NOKEEP_REGION"; do + say "RDS Region: ${region}" + vpc_id="$(get_default_vpc_id "$region")" + sg_id="$(get_default_sg_id "$region" "$vpc_id")" + subnets="$(get_default_subnets "$region" "$vpc_id")" + + subnet_group="bloodhound-demo-subnetgrp-${region}" + ensure_rds_subnet_group "$region" "$subnet_group" "$subnets" + +done + +keep_rds_id="bloodhound-demo-rds-keep-${TS}" +nokeep_rds_id="bloodhound-demo-rds-nokeep-${TS}" + +vpc_id="$(get_default_vpc_id "$RDS_KEEP_REGION")" +sg_id="$(get_default_sg_id "$RDS_KEEP_REGION" "$vpc_id")" +subnet_group="bloodhound-demo-subnetgrp-${RDS_KEEP_REGION}" +created_keep_rds="$(create_rds "$RDS_KEEP_REGION" "$subnet_group" "$sg_id" true "$keep_rds_id")" +say " RDS (kept) ${created_keep_rds} region=${RDS_KEEP_REGION}" + +vpc_id="$(get_default_vpc_id "$RDS_NOKEEP_REGION")" +sg_id="$(get_default_sg_id "$RDS_NOKEEP_REGION" "$vpc_id")" +subnet_group="bloodhound-demo-subnetgrp-${RDS_NOKEEP_REGION}" +created_nokeep_rds="$(create_rds "$RDS_NOKEEP_REGION" "$subnet_group" "$sg_id" false "$nokeep_rds_id")" +say " RDS (not kept) ${created_nokeep_rds} region=${RDS_NOKEEP_REGION}" + +say "Done. (RDS will take several minutes to become available.)" +' \ No newline at end of file diff --git a/docs/future_improvements.md b/docs/future_improvements.md new file mode 100644 index 0000000..2e5e78b --- /dev/null +++ b/docs/future_improvements.md @@ -0,0 +1,475 @@ +# Bloodhound V2 – Future Infrastructure Hardening (TODO) + +WIP .. HERE AS A REMINDER + +This document records security and platform improvements that should be implemented **after the V2 migration is stable**. + +These items were intentionally deferred during the V2 takeover in order to follow the engineering principle: + +> One axis of change at a time. + +The initial goal was to successfully deploy and stabilize **BloodhoundLambdaV2** without introducing additional infrastructure changes that could complicate debugging. + +Once V2 has run successfully for several cycles, the following improvements should be implemented. + +--- + +## 1. Move Slack Secrets to AWS Secrets Manager + +### Current State + +Slack secrets are currently provided through Lambda environment variables via Terraform: + +* `SLACK_BOT_TOKEN` +* `SLACK_SIGNING_SECRET` + +These values are supplied through `terraform.tfvars` and therefore appear in Terraform state. + +### Risks + +* Secrets may be stored in Terraform state +* Secrets could be exposed if state storage is misconfigured +* Secrets exist outside AWS secret management systems + +### Target Architecture + +Secrets should be stored in **AWS Secrets Manager** and retrieved at runtime. + +Example secret: + +``` +bloodhound/slack +``` + +Secret value example: + +``` +{ + "bot_token": "...", + "signing_secret": "..." +} +``` + +### Implementation Steps + +1. Create secret in AWS Secrets Manager. +2. Grant Lambda IAM role permission: + +``` +secretsmanager:GetSecretValue +``` + +3. Pass secret ARN to Lambda via environment variable: + +``` +SLACK_SECRET_ARN +``` + +4. Update Lambda code to retrieve secret at runtime. + +Result: + +``` +Secrets Manager + ↓ +Lambda IAM Role + ↓ +Lambda runtime retrieval +``` + +Benefits: + +* Secrets are encrypted +* Access is auditable +* Secrets can be rotated without redeploying Lambda + +--- + +## 2. Remove Secrets from Terraform Variables + +Once Secrets Manager is implemented: + +Remove the following from `terraform.tfvars`: + +``` +SLACK_BOT_TOKEN +SLACK_SIGNING_SECRET +``` + +Terraform should only provide the **secret ARN**, not the secret value. + +Example: + +``` +lambda_env = { + SLACK_SECRET_ARN = "arn:aws:secretsmanager:..." +} +``` + +--- + +## 3. Introduce CI/CD Deployment Role (GitHub OIDC) + +### Current State + +Terraform is executed locally using developer AWS credentials. + +### Risks + +* Infrastructure depends on developer access +* Manual deployments increase risk of configuration drift + +### Target Architecture + +Deploy infrastructure through GitHub Actions using **OpenID Connect (OIDC)**. + +Flow: + +``` +GitHub Actions + ↓ +OIDC authentication + ↓ +Assume IAM role + ↓ +Terraform apply +``` + +Benefits: + +* No long-lived AWS credentials +* Infrastructure ownership belongs to the organization +* Deployments become auditable and reproducible + +--- + +## 4. Restrict Lambda IAM Permissions + +The Lambda role currently has broad permissions to support scanning and teardown operations. + +Future improvements should include: + +* splitting scanning and deletion permissions +* limiting actions to specific services used by Bloodhound +* adding explicit resource constraints where possible + +Example separation: + +``` +BloodhoundScanRole +BloodhoundDeleteRole +``` + +This reduces the blast radius of the Lambda. + +--- + +## 5. Configure Terraform Remote State + +Terraform state should be stored remotely instead of locally. + +Recommended backend: + +``` +S3 + DynamoDB state locking +``` + +Benefits: + +* prevents state corruption +* supports multiple maintainers +* enables CI/CD workflows + +--- + +## 6. Add Structured Logging + +Lambda logs should include structured JSON logs to improve observability. + +Example fields: + +``` +event_type +command +region +resource_count +teardown_plan +execution_mode +``` + +This improves debugging and monitoring. + +--- + +## 7. Implement Slack Request Validation Monitoring + +Slack signature verification is already implemented. + +Future improvement: + +Log validation failures with rate limits to detect potential abuse. + +--- + +## Summary + +These improvements move Bloodhound toward a production-grade serverless architecture. + +Target state: + +``` +Slack + ↓ +Lambda Function URL + ↓ +BloodhoundLambdaV2 + ↓ +AWS APIs + +Secrets: +AWS Secrets Manager + +Deployments: +GitHub Actions (OIDC) + +Infrastructure: +Terraform with remote state +``` + +These changes should only be implemented **after the V2 migration is confirmed stable**. + +## Future Infrastructure Hardening + +Bloodhound v2 currently prioritizes **deployment stability and operational safety**. + +Several platform improvements were intentionally deferred during the V2 migration in order to follow the engineering principle: + +> One axis of change at a time. + +The current architecture already includes operational safeguards such as: + +* Lambda version publishing +* a production alias (`prod`) +* Terraform-controlled rollback support +* immutable Lambda versions +* Slack integration that does not depend on version changes + +These mechanisms ensure that deployments and rollbacks remain safe while the new V2 infrastructure stabilizes. + +Additional security and platform improvements are planned once the system has been validated in production. + +Examples include: + +* migrating Slack secrets to **AWS Secrets Manager** +* introducing **GitHub OIDC deployment roles** +* configuring **Terraform remote state (S3 + DynamoDB)** +* tightening Lambda IAM permissions +* improving observability and structured logging + + +Yes — adding a **reminder section for the AWS account guard** in that document is a very good idea. It belongs alongside the other **post-stabilization hardening tasks** because it’s a **runtime safety control** and not required to stabilize V2. + +Below is a section you can **append to your document** in the same style and structure you are already using. + +--- + +# 8. Implement AWS Account Runtime Guard + +### Current State + +Bloodhound v2 includes **documentation and validation-script guards** that verify the AWS account ID before executing destructive operations. + +However, the **Lambda runtime itself does not yet enforce this check**. + +The `/v2_status` command currently displays: + +``` +expected_account_id: not-configured +``` + +This indicates that the runtime guard has not yet been connected to the configuration system. + +The guard is partially implemented in the codebase but has not yet been integrated into: + +``` +config.py +app.py +``` + +--- + +### Risks + +Without a runtime account guard, it is theoretically possible for Bloodhound to execute against the wrong AWS account if credentials are misconfigured. + +Examples: + +``` +running teardown against production instead of development +running validation scripts against the wrong account +``` + +Other safeguards already exist (dry-run defaults, deletion limits, Terraform guards), but adding an account verification layer provides **additional defense-in-depth**. + +--- + +### Target Architecture + +Bloodhound should verify the AWS account identity during Lambda startup before performing any scan or teardown operations. + +Runtime flow: + +``` +Lambda start + ↓ +Load configuration + ↓ +Retrieve AWS caller identity (STS) + ↓ +Compare to EXPECTED_AWS_ACCOUNT_ID + ↓ +Abort execution if mismatch +``` + +--- + +### Implementation Steps + +1. Add environment variable: + +``` +EXPECTED_AWS_ACCOUNT_ID +``` + +Example: + +``` +EXPECTED_AWS_ACCOUNT_ID=123456789012 +``` + +--- + +2. Extend `AwsConfig` in `config.py`: + +``` +expected_account_id: Optional[str] +``` + +--- + +3. Load the variable during configuration loading. + +Example: + +``` +expected_account_id = _env("EXPECTED_AWS_ACCOUNT_ID") +``` + +--- + +4. Add runtime verification in `app.py` after configuration loading. + +Example logic: + +``` +sts = clients.sts +identity = sts.get_caller_identity() +runtime_account_id = identity["Account"] + +if expected_account_id and runtime_account_id != expected_account_id: + abort execution +``` + +--- + +5. Update `/v2_status` to display: + +``` +expected_account_id +runtime_account_id +account_verified +``` + +Example output: + +``` +Safety Guards + +max_deletion_limit: 5 +expected_account_id: 123456789012 +runtime_account_id: 123456789012 +account_verified: true +``` + +--- + +### Benefits + +This guard prevents infrastructure automation from operating in the wrong AWS account. + +It is particularly valuable in environments with multiple accounts such as: + +``` +development +staging +production +``` + +This mechanism is commonly used in internal cloud automation systems to provide an additional safety layer before destructive operations. + +--- + +### Deployment Timing + +This change should be implemented **after V2 stability is confirmed**. + +It introduces additional AWS API calls (`sts:GetCallerIdentity`) and runtime checks, which were intentionally deferred during the V2 migration to minimize moving parts. + +--- + +# Resulting Safety Architecture + +Once implemented, Bloodhound will include the following independent safety mechanisms: + +``` +Slack confirmation guard +Deletion limit guard +Terraform destructive-mode guard +Validation script account guard +Runtime AWS account verification +``` + +This creates a **defense-in-depth safety model** for automated infrastructure cleanup. + +## 9. Terraform Execution Timeout Guard + +The validation harness now runs Terraform through a timeout wrapper +to prevent CI/CD pipelines from hanging indefinitely. + +Example: + +timeout 600 terraform apply + +If Terraform becomes stuck due to provider issues, network stalls, +or AWS API delays, the validation workflow will automatically abort. + +This protects CI systems from stuck jobs and ensures validation runs +fail fast when infrastructure operations do not complete in time. + + +## Observability Improvements (Future) + +Enhance Bloodhound runtime visibility and debugging support. + +Planned upgrades: + +- Replace stdout prints with structured logging +- Add log levels (INFO, WARNING, ERROR) +- Include request_id and execution context +- Emit scan/budget/teardown metrics as structured JSON +- Enable optional CloudWatch Insights queries +- Add CI pipeline visibility for scan summaries + +These improvements will make it easier to troubleshoot production +runs and analyze historical scans. + diff --git a/docs/github_actions.md b/docs/github_actions.md new file mode 100644 index 0000000..49bd967 --- /dev/null +++ b/docs/github_actions.md @@ -0,0 +1,326 @@ +# GitHub Actions Automation + +This document describes the GitHub Actions workflows used by the +Bloodhound system to invoke the AWS Lambda scanner and perform +automated operational checks. + +The workflows provide a safe and auditable mechanism for triggering +infrastructure scans and validation runs directly from the repository. + +--- + +## Overview + +The GitHub workflow invokes the Lambda function: + + BloodhoundLambdaV2 + +This version contains the V2 scanning logic and Slack-integrated +operational commands. + +The Lambda determines its execution behavior based on the event payload: + + event["source"] + +Example event payload: + + { "source": "scan" } + +This allows the same Lambda function to support multiple operational +execution modes. + +--- +## Architecture + +The GitHub workflow acts as an external trigger for the Bloodhound +Lambda scanner. + +```text +Execution flow: + + GitHub Actions + ↓ + AWS Lambda (BloodhoundLambdaV2) + ↓ + Lambda event router + ↓ + Execution handler (scan / status / scheduled) + ↓ + AWS API scanning + ↓ + Slack reporting +``` + +--- + +## Workflow Location + +Bloodhound uses two GitHub Actions workflows. + +Scheduled automation workflow: + + .github/workflows/invoke_lambda.yml + +Manual operator workflow: + + .github/workflows/bloodhound_ops.yml + +The scheduled workflow runs automated infrastructure scans, +while the manual workflow allows engineers to invoke specific +Bloodhound operations directly from the GitHub Actions UI. + +## Workflow Triggers + +The workflow supports two trigger types. + +### Scheduled Runs + +Bloodhound automatically runs scheduled scans twice per day. + +Cron configuration: + + 0 16,4 * * * + +Schedule (UTC): + + 16:00 UTC — 11:00 AM EST + 04:00 UTC — 11:00 PM EST + +Scheduled runs allow Bloodhound to continuously monitor AWS +infrastructure for unused resources and cost anomalies. + +--- + +### Manual Runs + +Engineers can manually invoke the workflow from the GitHub Actions UI. + +Location: + + Repository → Actions → Bloodhound Operations → Run workflow + +Manual runs allow engineers to trigger specific execution modes. + +Available modes: + + scan + status + validate_scheduler + validation (currently disabled) + +Notes: + +- `validate_scheduler` simulates an EventBridge scheduled invocation using: +```json + { "source": "scheduled" } +``` + +- The validation workflow exists but is currently disabled in CI while + teardown validation infrastructure is being stabilized. + +--- + +## Execution Modes + +The selected mode is passed to Lambda as: + + { "source": "" } + +Each mode triggers a different execution path. + +### scan + +Runs a full infrastructure scan across supported AWS regions. + +Identifies unused resources and generates a teardown plan. + +--- + +### validation + +Runs a safe validation workflow that verifies: + +- Lambda deployment +- scanner operation +- cost monitoring integration +- teardown safety logic + +Validation workflows use disposable test resources. + +--- + +### validate_scheduler + +Simulates the scheduled execution path. + +This mode sends the following payload to the Lambda: +```json + { "source": "scheduled" } +``` + +This allows engineers to validate the scheduled execution path +without waiting for the production scheduler or cron execution. + +--- + +### status + +Runs a system health check that verifies: + +- AWS API connectivity +- scanner configuration +- environment variables +- Slack integration status + +--- + +## Lambda Invocation + +The workflow invokes Lambda using the AWS CLI: + + aws lambda invoke + +Invocation artifacts are stored in two files: + +Response payload: + + output.json + +Invocation metadata: + + lambda_meta.json + +Metadata includes: + + StatusCode + ExecutedVersion + FunctionError + LogResult + +--- + +## CI Observability Improvements + +The workflow includes several improvements to make CI runs easier +to debug and monitor. + +--- + +### Structured CI Logs + +GitHub log groups are used to create collapsible sections in the +workflow logs. + +Example sections: + + Bloodhound Lambda Invocation + Lambda Response Payload + Lambda Invocation Metadata + Lambda Error Check + +This improves readability when analyzing CI runs. + +--- + +### Automatic Failure Detection + +The workflow performs explicit checks on the Lambda invocation metadata. + +CI will fail if either condition occurs: + +1. Lambda reports a runtime error + + FunctionError detected + +2. Lambda invocation returns a non-200 status code + +This prevents CI pipelines from silently succeeding when the Lambda +execution fails. + +--- + +### Example Failure + +If Lambda throws an exception: + + FunctionError: Unhandled + +The GitHub workflow will terminate with: + + JOB FAILED + +--- + +## CloudWatch Log Streaming + +The workflow optionally retrieves recent Lambda logs directly from +CloudWatch and prints them into the GitHub workflow output. + +This allows engineers to debug Lambda behavior without leaving the +GitHub Actions interface. + +Log retrieval uses: + + aws logs describe-log-streams + aws logs get-log-events + +The workflow retrieves the most recent log stream from: + + /aws/lambda/BloodhoundLambdaV2 + +and prints recent log messages. + +--- + +## Operational Benefits + +The GitHub automation provides several operational advantages. + +### Auditable Operations + +All Lambda invocations are recorded in the repository's CI history. + +Engineers can see: + +- who triggered the workflow +- when it ran +- the resulting logs + +--- + +### Safe Operational Control + +Infrastructure scans and validation workflows can be executed +without requiring direct AWS CLI access. + +Engineers can safely trigger operations through GitHub. + +--- + +### Faster Debugging + +CI logs now include: + +- Lambda response payload +- invocation metadata +- runtime logs from CloudWatch + +This significantly reduces time required to diagnose failures. + +--- + + +## Potential Enhancements + +The current workflow already streams Lambda logs directly +into the GitHub Actions output for debugging. + +Future enhancements may include: + +- attaching Lambda logs as downloadable CI artifacts +- rendering scan summaries in GitHub workflow summaries +- automated cost anomaly alerts +- integration with security scanning pipelines + +These additions would further improve observability and +operational reporting. \ No newline at end of file diff --git a/docs/images/cloudwatch_logs.png b/docs/images/cloudwatch_logs.png new file mode 100644 index 0000000000000000000000000000000000000000..2369fc8fde5a14710dd603f87f50b37aa1c30b98 GIT binary patch literal 119221 zcmaG|1zc3y)>lLYlopXjQmLW4q*J;}x*58=8|iN8?i@O#yBnl)Xc*!fZ@hbb@7`~I zXJ*cvv*WDTd#%0xYfq5$XJJGHY=kFIo*;^f2*^Hp0tv(lzh+TPFS3YRT{nY7PEt?C=i>Ez)wZ1Xv-d9`P(aV&o;(dOegX?UdkTGHL*GxHJd5&w@)G)u z27L=;!2Ed^7LxJo&-16Cp9Me3@r#N=zvXnT_4O@mjDWU`gf`XCre=)gm2H(JCD?U= z<}})RKplM=M{~=cRi1DHI@IWNk`A}OVz*K`tPa=Hu~25KyzrHw%mV-=8t~=e)ErtoPeLC|BV&D z^ZB={P)2hja031#G;RdnVms9*Pk5h*3Vf1xe0q@j+*Mv_q9@%EMwGA}-fQ*fh=w}H z4~E*#skO1GX-w7&+s;9?_zhGvbx*u_16@vsQhv}Rm%~R&imWEy*_Wld{O|xOrlqoN ztgoETpC_c+jApwyn5|TxGoleb{g=aQT(qsm);<|T_HQMgqJ97DsiS32wD_+@yky0o zB|d^I518SucvQ$Zy%Xt zxSN~T)-_)2F6%#aV5!eb^H=I(b_}3-(`?M9;30Z&^+wA7#rjyC$&@vMTYMMBCgJb$ zKoIBkxK?d-M`X7@@MbU^CJahD@)PVo6aAaCPCvC_?4Ix0bQP)J#lnR;JzM^mx*De_ zD!_wT|IMk5R3r7h0`UdozJZnr8i@f$>8-YA^~5B7dtd<J$I8?A-Hgh68cSOzl)9+rdza)X-G89utc@CZAQ!0yM_`| zcOiG``fP?^wAdJ(AXm+Ra>=#?`nM0PM-O%J#2y8{xWV)pTCNs^Z$aMNQza zp|Cg84Cy{IT=#HTG@(?&rQ{a1lcw8acKqhtMm;6i#jWI25A8{^ixXMJxnnBOZGCK; zC`(JMku&ORS`=ZH7TS0e+FI0`2tCw$oqZ%gIE_{{GlfE7=;&xRW{DfK#2-&h8td7@ zvj-sw`$f%zqdoUAJ%((=T-=#3*SijAlkZzHEV z+IpmP4)OS6NZw=X{rNNIGBqCs@%RjdfjIx!dSq@|$aIN%_%g^j$qm5um@-$VeL?Y> zfVo;)&&|~p1t*!OjN609<8^}x9KQR>drrs4XYUv-Q5de??opiR{XQufqFCD5b$dQM zJL#K^0I#0`h`uR`WEM_c3A?3#`(rTuK3;gO&_)yF^JW8dd4^=AY~>lc#57p z0?w5N?Jczo2utpLZV=`d1X(xJwu=KAxt0&i<%;Vh&IyTnf1(IkNSy;W z-GdH)pQX6Y-bVBfh3OW`P?<15^Ro;)n*g^D zM%9NObi>_h2u(Bru zm+ZYjkvN*yNH3gw8qF?T@jxYG&g==ymC8FU>7lS>VSgIP8$X;%5+R6C zYrf(|Dz4PlxwJI6kf*aUIA>xP7`YD&iRkot29e=!NoWXhT zA-x1n9e0Fz$1`Qk50%YQliRMqF(Hxh8iysu_dakhD~;yXy+ zHZyJ0)dAD`vJIex0%lZ~zHY${ZT*G`3BSLoH@>72rbMI?aU&%D!?K&csi~W_#RKhe|?6ch# zLPsr3JuC*8&F7Q$>5rl-wg!wZEB6kS+EN^!=$VTh#M7izF_$#Ce(T!Yb zz)l1Yj$wZs`g_S}`5zARFNG0zW8Uml#D6&3P@OIoWmqK9QCC)e_c@)-+*c42Q>i$X z%`Dwxm+dBHOnj^OP#0sQvKR~3%(vy^`q0&e6wiEk!$3sj$B!Skgue@hU~0z>T0t6I zKO2uVH65 z-^=l#duFf&%Gr(5$EGDX&w;oyMo1E)MPM{}XBbO{|FivOw>|T(UoDS(Kp&NTrFKR9 z#T#qMz0*RH!8;+GsotcIf*o=KEsTjxK#_E@{F(CC-1nvg!vZ-QCu6Ww$}YHg$?|@! z@jU8+Bog8?uR#@9-dd=aGli~xTzbbqM?kIcY#%L{9N{4SMf|x`gt4nC#J4W+X^r& zF1HzM|8>l#&Hh-cyK5`gn<32l{oy9kAI<*o_p&3MqS54ho&IWdCO*TdjR`KA+m_f6 zQU5mc{U^UMJ>v~}{bAg~(EjFi88?e}dP}Y*hiyH{RHH0x`yng3RZp{f8kI1WA|No*72r^s#fZ}9SRD{2hAmNtDTegRXl`*yv-+z zVPBQh_9h8lUL7r%HX}(sb=o5;1BKzRv}0<8)!An%6io*P2Da5p^(KwHs(t3964{c! z%h?%saWsWfw`7eIj?3je!u|M~yenA^5=C{KJ?>QWF8+7B`p2iV4m_*i!36CR&%^CY zDei~zKqsHBjRG`obg5>VRQCQm18PZcB*YOe%M%onsn>7YjZ2U5iMLak~Pp-!;m z2i(zCK$_Dj9WElGUvg2hqqIWz4jn;Xz+t(L&(1p0*-}oEn9ClB9GO_oSiZDaT;S+C zYAm=bx<eAE0u^{C8Hs5mZLg%!n$KbH?eT`V#$uq&n zl?ZA(y<{bLJrW9(E3%q_BlLXfNP>cm7dX?I{17Cg(Tq&T?J`=PlpQ*$8!IWTX9{g{ zPd{%P98OkLCDvW#;#l-BgWpazI4<<7=VkXcXXho%C`tOGlCHHsxVuM{oBB29e&(AQ z*65ySO=V+I4KKLPOPieQ^r#vz&)Z}O^gr3VD@m?1>u+5(bhbO%g*M1|Z$go!)7s(& z9sstcaeQa`)iOMX6*w4psA%{Ca{mF&11}JGyyxXipEjTU&^jHU+rblUd3%nf=BI>+ zXWa5GpEbYM_6EUrXMDgBtm4<>e#e%3&w?(Q%*cFpP^?jh9}t0CgM>Liufch$p22S9 zZUAL&`SJ#Ib;f7#B}$$xSm(%7L!n+Iydl_q zR72t}UBK+37IxO#ckey~NxGg)0C=#a+A8%2`Z)uJ^h&=InDM3CD?a~ZZj zt}Y_!W~3>94F(DB8Q9hMm5`9yV=^sCSa@Yk=}ilHiz&|Aj}fcInx)0j^_A?LlpEcpFdB$DUx`8DzCA1ST$U6Y4zK>Bqz}`wq!|) z^XNd*14RazdnngJMcy_Bz9LL2u=n8^L@yW?V=GrB0FMTT$wY5UbjtEejpTZe!^Kxq zvn)+M9dFdz^927_O`_wZOw=BCT~>^!?EsNnrG!??G-}Gyhn>@VsTKZC|EB&3E+s9y zu*77As=c>en$8!b#HYIuAA^t?f^2rXJ-yo~!U@UI|1#m|AF2^H_tg}m-pY3#ExDw! zPZugsWCPPRcRs>%LY19nedTHM!?Y3n%;MpsJ+4w5AzykjDn$Mq{pyLMb5loCsN-(8 z)B5DY8&3C-&>0TIUHx&ZPCNyD_w+ruf;HVj8_@~cW%_m41S-^KeC7zAUUN3!vA17H z2C~Zp+wHkFP_5PiBOgsXHFS+X(KS7+JkYE-x5+!QZP@F48fbo?E_!cZvPmL9{Y{bj zb;F(sZWIYA#i{Z2Ng_jDrWXCwu#ixK{^3`4dcz6r9lbM3MVbJE^`+_?b(omFDQ}W0 zTd)md>IVAHnAV%8PcbHKTNZCGuth`;4AfrT`UJIv`x`(|yC_x<51+Xmg1#E-AYz=H z+o>&#olUNHK{!|@ZqCj#HSMvNO;=dVI7*g^2QYwRHG_P1Zx39vuSUi*A0L z0XAo@Qa@u!VZl$#)w+?#l_>i;+nH?4q_=cS@jNP0>1eT|`2{DtYJWdDSg1dMEp4dc z?g1Eir7v@N`$g-lMr{RuV?<1q?DS4F9Ba^ZN(6jYYVM1waBx6dB>5!VC>}hS-N%hk zQm_@YD?Y+Qu4#e=&#vjVAsKC@^t)$ull#-NT5|0~B(g_j)~e>ldGw>zjLf@Dl`-1L z4Xc05d`U7{OKCDwYJOX;B)~h=vyf|t1NAu0w!qUIz-@|ag%VXnkjo`=ben0bZ5rs< z{chUUDp4;4m-P!uqurqa=P{Hl|B{8;cc|b`@E3@&H-uB2QVcAG3h|AM+5!4W8T=5o zy+)ZHoRja7#AM?78NOvIDsC4cg~O&8&Ibv0*uOa<(tGeb)v!hSY0b>Ph`fO2))x#41fu0D38@wLl3PY=K5z<&J;EhmiTZZ-AieXS2^tNGYR#DC7FKLeIt zXo78A`C?D>=2Kyk-RT@p6EQ72FNkS3(^o27j=3dL7!|g_H&R`(#oEnI<^rA6KHi18 z*X5=XiY;Th+>H3jYPI^l_djaVyyI-3Ca}|<8uC!W#A?Tgl#Orh-OF7ZKnV=$nJFXa zjr8ezcj2i2x}hS=k)r;~ax=sA$ppU$+dd4i??VFB`@#Z?y*VXL9jGgUm03Q2Y;V5s zu0pEn==Zs|n;YX6o25VDWr5VOW;ey9ibOn(7MTq*O%?NyEa*o5M-^=A+DzDY>qU2d z^1zt@|3i~pZOS13IF(8>_~~Lb;xyv4^-Qbbi68e7J@1a&t0D~#i|E(1RP4X^9D6+Y zf0QFnrqwMvGSqVHQIueiS^zE}S^E8q3W~9L6+C`M1rK8Im*JaiF-%=KT_jA*2)Z3s z4K56*ZS^(v-R)!%t@=yi3}%+BgNsGk(_9Zk%@*t1CE_z+(vu8orW#aUe&=)t37kwc z=83pCb5c{|?Vf%gx(uw(M|LqK)C|P7D4Jj~a!YDg;yOLm*;~5rGfdYRTkozvyX26# zwkS&jK|?;RBvcJ8s84Hz&)yF9meB*#$*i+}jmwFWueuK?EP-!NLw%q5?H)iW3u`#T zOgd;R1Kq(aJ6;Ha2j_h?njDgEt{7h{ZLe`q*_<2igzN9USK#*rsn(eE19t328{}Tz zj4q?@&0S5+tY|OhX^CX{)kYNnlN>SLL|`f;6%AIAYq6?NXh^V@Ntg!|tN`2jL_4e| zbgAi9d%lDwDieS!j6ZDb`@3;$fOmI@qu_|JMd>TjBZ{uif=2UTz9gAq%c`U0q-E7j zPBI!Z@PDg*mp4~2&2~FktUEU|)E;uD2k*W|7lk>&mWrF`o;eu++Kq2K;7h*;AM9Jv z-*EgEucdhj0}bQF5lF#Ed?-QyqLV)oV-1rBzqBDuWIT z)6O-|C)9M4kxiel=wj!jvB@MU$yfNXCLd8+ug@VM1D;+ z#&XFVX(=XcoI9?Xp5i~L9*o_insE0GNbi?Tb;f7TUuioSI6_Rw`LgBTLOz_pB-h*- zA3UQCV7Qzzoqn@-KQwn75q>-5_RC`LYpUk})YDIY*b0%#;1BrxIT<)&(zUW8MRrq~ ze3Kt=d%-YmI`x_vW-O9em=xDA{jkDj#sV5fo%20Ywqw;*Df`TIu#|oUOXNj|C{0?K zI#`#N=C=27n_8S;E-I)?Lyt=X&GNf*V@Q0l%YeI-lgRbg5FFX1iLN4mMu)>hB$cLH zAO1_!wX>ATNC!Hq)_c1b+1}G*IdX=@(O>5h5_Y^5+s}UYgv7AC!Vfu;4(i#r@u&@9 zT3XzV7HUC`5^3l%HZ()TztFXc3v(pgIZQ~myNJsIksvk7-q^zD45NABJ&!Bv8YNF))Lr^P)Y)6AIy+Xm;6;HN80* ztChB`L!$4kurga{8cWVFx?c?_*XM|{#q-0Rd1yA@A@x6q&miG(hhj5%OR`?(aEOJ6 z{(-@q3iIZD9Q#Mq!4mjR7DHwsmBCQU%Dy>&LCi+3w(m7l%qvU8 zL)(JNX~EX8><&l4#Pl8$i4$vNomrpTKL24oy#~BI0|H+5$5IBgwFSc=l^VOlOMFfagvJJaySfInXK{)D)+R4J$*Lv{RQ=a7A1t64sg|=<-N5B9PX6C; zN9gqw3EnR5q3lBBU%ByjHTueHOh%|f0J;@Bd#?AVfPQV|X9sOWZEO%KH1)sZw7)j< zk$g36?9rAg;Y{lz0Ya11A27`?!u<_}iD!8_Jm=t~C613 zkH2BW>dUb7To4){94^=2gz~on(274ti0Mqe?Z;3b-M{$%cc1GguLsgRAs5d$v{%Mk zLtwiy<@%H>iIIvfdvrJ2VR1R4y#r_EuN@n+wC$uAOV|9uFI-3KoK#?+8*Cwbj7lq) z{Z|RqpTpOu2M2lw1SHD|JD=OqKPbQT6E)4MxRLH~vLo-!(-~@UJi9g?Q(;6M1L~1` zEG}l_7RKf6IN;MB{rlr`qF9!_Sq<>*`oZ~TNG-BKO$WSr05`b!Cb|y&+vH_-kmKR8 zoN@&R{?$2hn`fNiW-A58<-|APsl8~gX_eT-!bpM}J&3^>7>X)UaBsSqq{PHJ`sCJ5 zPEYxAf-!<^>$~R^We|T{gK59z=43h76k6JiFBS++DNT$2&+w6EhpTr|Fh4huy>@Rt zUAK9@2mUrScCEcOcQ#z2(D&?2v(zs#_5SQUUtu9*w%Q?GNgW9z7XztIsrLgN?Bp5NE=q%C>vCQuh*+6vLF+8$HvN zp`k%gU$2+acq2`;9yM-$SipO`kyVxdb~W5uA7Lh-hd%CGjIFK3R|oB>F;7?5W>j2U z-@^raoq_4YeDwx23I&P;^oDj`16uh9-VRwx%n$B6me8@f7_X$$>-T>Ncf?6&MJ1bInw^t;&m)0Jt?7@c z>5Lu(A7r%LEE?{X$YuBx3agQqrDB-R&~V-{zNOZrxsv%{5-{1ZMZG`^Y}YaSx_`90 z85E2Gvk4+P8zSmWa{8a?^z?JaD2+`~rPGFrWO}Grd*@1eIWwT1lLjV%c;Xg#s4_g3 zseWZ#`IUv-Kih=OVX|b;3kyf*Yf4ghtsT8DzXkw-<4szqp$8)Wj6b&#DUrUOI(B2L zE6R{JsQh3EW#UH+)0pGhm0Z0{^IMzB$LZcL)g%-ur_McWY_Svfec@x9_Q9RH@82_7 zb%qh2K!6^)9lm|fFHh8}xsU)4R%lnquPtYh9M~gx-H*_POW605)a;5rWKCxaW11>O zQXekJ%7{>t=B#S==X&#T=j3jI?z_d~h&3J>9gfYq(smgPHb&QoYw_#r>(_@DfPCr8 zOXd)o%WE^dkN&Y$hQ!eLvB&!l`Rt7j`|5hs?9sc0Q>IY25Wl{mL5KH|J9k7}@JZUq z$Q#?;$)}MrV+ki$dJD=1Lx~YC$1T|+y@sZtl>cQ|;t`>FJ_y?~<^0X{xGFJ$>MH=& zm5mXZxy8#(c@K+iGxiuymIwG=A0L>Lp8S5x8l3fcHx+)rnl!HU!#bhMqCBmL9)0QQ zg(>+meIFRE(3fdP$~ENpHIyzHm2iO{jdztBIPk~7#zbV!NvF4yWlk#fqCOOk1+#hE z-$Y-;l&tIL>)*So4^`OPflzn$4KDZJZFHZNIaJZZm9Bby_?Y*8NVr2z0te%MNm^UN(E>fj{H>ty zixH>Ck3LTHSGrgLOj~pL7dV&X88v}bnn&9-U(EQDv~#z2?UwDR;P2I9Vx>jCBu=Uc zb@W0QCrqD^1oviZW_J>`QCxXZyRB{P!W4y1*MKVYgmFLjeoJDfl9B=`&Xom)6W2ZT z9eQ?K4|NjB(PrqYBx7#hK7)rt1UF8tgdtJ6%atZ{NtLP2<^fH*Knn^I zWrgBDclUQ0hiPbKP11Jx^zeHD$o-q%#@r8pNLF3oYWq5dx|6@AE%uy2QPd zzpSl{prey1T^nA?b?2JSRd^+jf?Sx8pnSk%iNYkn%Z_S~)*GJ63$ZWB)C|XAG5=&{ zhO1g<5p+7PH84IgUT$$OloBa@MHYrb^nKVynhQL6R;;E~3GeUuKp#l4z*qNK~t$X%v|aw`Ut?{)=Bb+sR($Z#hqsi_WP;KwZHDiZ@$ zvC2N}Ar{XFK~MoUZ6>X*Zf={6Qyny@t&={IWeumY!0u^lE>2GR%C_wso;k?Q&ay1h z^M;nOF*<8%#e|2tNSEqRsUA~VZ%1&+N_pSG4BedC=R=3x#r8lq9A=A(Ah&**64Ur_ zR;pz;mL*y=JdSFntH}tSM=!sSIGKa0fC0N-?Yb8qI!eU|I3CnIU91yAEaxTZ7vG!| z%mfxajTy2ov7}Egmt^BYExv(N0P6?9~L_}RsY{r1m zLcQ}3V+%I)S40`39gV?1pVkfqfe>wKzvc9b?L@#JCWW*xOQP*+<9PbOh=JBoaujG80NMOHK6c`6?3BI%1 zotEOKs}D=x6;7W)`t+ROPyhWMm!kYUsbEkck)w|}Bt=%n&CW+jL8 z;qH8bpr`Zr0rD6S{5i?vFgJo9eB5XxPkn5`mv+2|djq^D7Qiyi^@W5O}zj)KP zHSbGLal+(a7@|}>F)UUgXCbr1I~Gg>8?(pXscG0 zs$ybgWu!LZzpWO@>T4Lk%L5ydQRCjdz;`ukpyFkk20P_$It;l=wa*uZ0K--{-tEz% zRT`LKwg_6t#^pXm4C3)l0N|+f1tO`%{ki+#;yWMI)M2N~+4vc|3vRj0<11m4)xz4A zSxee>I040mPbK|2p}wd^S1Sl$s(s2dgZb!9qPv24O+EEO@Wc4%aybyYP0m-8T5a14 zMBn;_ak;)FYPV@vyZ*4VF;^9%WHQ=x0AiQf5e>RPAE`wKmcS68LQHtdd(Wjn3kbS< zY&p4FJ5$8{SoY@<2)WR>BH!%jWryo$UtdTX{RS5mQLeL+Dqjvl?M#SgTy#Nxj_#f1 zym9mC%txGfNGqFmPuVsXLp6~mwx(!HeW!Yvwr==4y3ss|!r4h`$L2Wb#GzNw-U#ywJ|>8%7Unf}4iD2}xPIYK%uHweEk$7`_OU;p#+e8|n@$29v#d4aXZx5o@L1yf&F_;$m>QeYoD9XR|>{LYCpSFilj6OUI`* zK^A892y(#I9+cwjp2V%uN1ElbJ6gmyU#RsC4xV^O*7xPP7_Jg9y-;r2xWwtUu^@v+ z76Lw}&Tj;J-RrfqkD%J0#_WbDXxuy7S#9I7Xs>nTjFyYzrd&mNGRL>ihDHkju^;J8>@0Fz2Q(Xe*j<9?p$QsMFVNg|c`nRr}r zn6rz^v&ApSiqJp-4 zuQ`iOg=5oDe8XmKKWCcrko=AupgkGbIP9CXw`l7;GFjxXHsf?b>ndw-Xs;sR*Lsh4w^D&h3C>XkC+lll-bol- zp|cDMXwE;#F3s6ezQD3$cuvAplFq#&T+5>1rCz~6zSwcm*As;QD9Nyp^ff!lv8JYY zlUfVrX=nz36;v&1G&Kzf!!UBgh z)$&j^Nd}gp-gMP(jwTN@X~}ysyB}wis1^A#sZA+#iU@@d#jvzTL=)>OvQ6n-gxV*-*iGrFAF?VQ7v%w zy0{UEr(v0rls|QI4}CRF^v5jfRZr)JiXbnu7^IKSg~&5?Hn}g^s}E$WDbug!F`X_A zsEcP|uLkORB&p2MN+If}ak+4}Jc5mP{#Y_ zJ*;}c(z1}ojo=#ewT8IGkj9l|YZI+wH^dnQDD37?aU)LJMd*lMwtk^en@selCPv@zcd@(R-VFHxf-llRfI(vjaCy z;*LSm8LckfnpT0=AjrUm;{|)4D6Vm#<*ab77> zu2Z$?a_37&KvjBCpQP(RT&(4yTu-){O)i{CtlTjjixLZQ>0V2HeW;Vj{XIi-WJ!*5 zY=Me+D#J)+!fc9`X)*n!xcHmU5wiibio3%t=IRdj!;yh~XZPFa1yJnFC2nk0X<1!e z9T*l!*<(ddV2JyW`1)HNiAL5U5P-=Ao}?G<4?_wos_x=>L1k`OriXQcT* zaXw3CFTNs*Bww9u--@@f#`iZh$&K-yO>!M{@_Zz~sL(ne(n&=@P5|oeB0X30WvU3h zO@r}=9jTDvB&SP8x=uy#yo-%|53cG{dY&ZbZH*PuZeM@Z4y~7>NSUH6%W-C{*ii*( zU*;r14=vFRSB;Dxbor<``q+}bed>%oK1@e_TV&H4i>VC`*W4s|FYGN!uRSGK8d?OW zRUlM+ik`W$B9=DFvFIWEe`^dOg;=7vW4jzk;cWChO+scwX@Kvb{CW z$}s)(9m{>FsO-38lvRFwvh&K)eYe%?$coRZsSah*MMDPzshOf%jhbWqm^@UREDq|I z)|U%x8t4~=g9RQ+BD1w*`eS;84p*;e&%nm{_U^?Qc6zN+h5F8~wrb1`)on0%7+kSn8_&Zd=0%}TCjci{P?B(6FId;+Z@pkR=3p%`xZuH#qe=7TE^iR=f>%Q z{vM+CdqZmU&Fk19c^XhpVDQe1-5;8CF@HYS@~}8x$LHvxH*9X?kybjA!ZzagXg*s$ z=L=#k)*4}U$Yg3EqbEr7pK`xHlp@piPn(fxrkG;4GcygpC$Z`E3+$a=BhDl{PzJr7 zdL_m1Q0O>cDagQJn8vmXBSkUl{@7WDHs7@P!&Y`gi%F6(Q&F+2FF*go-NUwkuV|pX zCN%V!bfg7^oR#bK7rN=M`1K3qsp&_ zr3GL3?3r{A^D8oEPe0*te$>=r@jwfb|4O>L&%LN4 zr6`d7kc9u>)r?}y&HC`_*_@#S4ARBH`0MgG<1Hl&NF#IqPOJZ1ZT_a8c~lI4)lp#q z%FXua2iTQ5;V5RuHaS>2jIc@hlUsvjm1;Kwp3?n;hzN_aU=PJY@>RNM*__tFXDr}8 z?A+q}X#bqIT|@#YD#Yu-qLZtz5!|Uh}b;<3&1_-lJogGSzrog8eta|H3k2@};pM6x8q zjCrgZ$r>)CK&O*MQpYuQWz1H$MbV!Ci#Kc@Ysx~-NL%P**Z{98sB(YF;z-xJJOT{o`O;4(^4b0Nn@|?waKRo zTs5-w5VGr05)5-v{?g&+tonPQXY=Ey6ztF-1p*EWu)9ER&A^>K72SL=AbqxSd(YMC zR=O%qu|C(Fl(nHH){p zu`}gL#PkM7^*25H*3EUr%q993Gc$^L=<1R4Vv1$Iq9RI?Qpj)-TKqe|KgI@J- zWN!we#iG#{KVS*7;Pvk<<=G4jIltc!m(yf#6x&jm7_7RS=G&@)9Ig>g7RJyKB;Qvw zmy+jxBj%)-atzmZZ)MEeYqpR3O0u#h8K>p}4;thaUd8G|D8hG&#q*6bS+b&kseWm5 zI?qC#hi{pQrc;QedI&L`%Dh-GWSVBXkILbpKw?|y(4#3wz<4HE`P6X6Tr1t5XWuml zJL^!Nr7qPiG5&$muOV5Ngu&VzvUH=VnV-vyi&$CByd(ysB$QGz|ZL* z2-Dh3Jc68jz%?ihs|=F@ikd5b;zW97%08p+?fb>Vu>@qCTtW0!f2B+xx8@O=I)GCl z!GK)EqU25mxwch9=gL<$@td2U!9+(l-FlEa786&m3OAiKQ)!@?yHe}5Q8l@)s4eJ- zaW0=zlb5eXy`}<)Lv%4!0U{mI+;ri3IuWt=qLTDCT^z4X4eu;v@22nHUayDDE)c z-bPL^tEDKXiT|oR#H^+)=dOQ>b$GCo^drZEz0_Hu3W4zE(BsqoclY!kH5yQdX>Y1X zEGpPw8{Ta`pu@nrmWM~Z!_UT4+>cUxXQEbta58{laA^sz<@CG7d@gaO)Bu}_7HF5z zwbmsUQ}goHdSRHGd#QFi`d%Gl$r^3hde7#Py%Jbdo)6E7n@HR~Cc`ESK^RY8>^aI0 zTf9^e)vt`NXicvqurYwl?Qi|hj^#K0yqR2(YB2Ho($#E)c0$cZVoGCecD+;%k&Z7s zjUa^L;-YDH8h|9s`Zp37t(3&8&s@~P_NNXBPS-kNE#Iz=b*!|T{wrMn`%lu4wwqFl z=R4`cW%etcPtXyX?u~SwntXQ_%ihzh7v7`HAKiA?A1=nw^j90>VQMtWrh$7TEepsn z?WEt*w&SFt7u*u3N^!_nP|}W1f7D`H9M4vddoWJ5%kd!3Nhj^5*|GzCd_9Z&-&PFj zch#rBvvyaFz~sY|EGJVWvb}nL&4hf(+=o81u;2&5cFFxGQnkI(zzM3ZM zf#51)gg4_0txhV7EVL;1YI>=#D~0L*AKIA$uNUk_FPaoxTn1;4Sm?AqvdNv$Om^Gc zg%_S=jD6sTig$0Ndu2^#TAEG2_8VUv`1iIOT2pmu@8O^%<0~>$$U_WTUs;{lfHbQe${vWWJm1K23%lxIIlM4su z_tbyXh~F>f1bFW66m$IfUjU}Ib7CSkc9dLP22y|DS^Zy6j*Dh#_bI9K+2WsDME{`& z=|;Hvyu79){4$j)_zF6!oT94(>VFrtXP9SGh`7I@7UYuJoTGschGf+h<`rf!?-f2? zswz0DyJ)n?!7y*Sum7)SX`6#Z!spZ}d<_q8Z$DKW@#mV45a+4Vw`YUB$zcdA|4K#1 z8#GJ5kTHmu_RO6Azp|U~sS8Z$?(X`$@GmK(f0?D9H9uUy>J4)TyX8DkSU(|IC4r$- zD(UGE3_(Rf@ig^+Ei_fAkSfnm^#0dcf5;OF2CKj^B%8GM6Lddf7W~~Ugy0>g-iO?g zgdm3%7Xr6iEib4=Cv6-#!2KugL4kOpOFAxLMUq7#uYm|&F)@T?XNbn4%gB;4qX*J- zscJZMYlO~Syq1-R|*BHm@Q{&8^Lx7J_hv}6{p-nAPFUTs1j-^yUdrGU@ zYEJ$?ai!lzff(b{E8B0eJ4lr_(3S!8bseyQWEDlA%xr|4%tzH@Zw5ZPPZndPRI~tj zpgTHaO1;YK{zF4NlNWSTJ~2K0I4vC92M?91)z#lMhDHnKNW?)qIDFvh*5(Jv7dZI> z+2>1*cI~FX<}gpsCuVbvh|pMLc-@M#kMCb9nK6m-j?PuNV3(3Z><>-}3bri?qS?|4 z3d^kNgGi*E;X?0E+!ie-N_HlIDC!y-v?h~w@9dVok25^EjQLZC|2{)JIogcQT8&E+ zdjoy$cs4Kg8vb&V8y#E@dt7(-meZ4_!63`)|B&?8iS#X8eVJOr8+ds5oU-i$I{2@= zktk5OUo~=aKU0@cCa5R)P9f5<=rMWHPoqjH{q_yvS)C1 z4bIc5v@KIuK+1Iu7+$J67%|sfX}MQ!G-KoAkJwZ^Xx7CHnQ+2eL;8mi^piziX#8zV zy8SI#=~YtQ)fQY3or8KQ)VKEIF9EHy>5;z7Jai5lJvb^s-u(m z`_g=DR#YNoHH0PezN80AOQ)x-((})ELB|i#^J5oFlUHbbJ2n;h@LInV!Lj<6FSNP>Py7H(%G#v;L?e=QFJs@&=T4{rx&S8Br zdiH;53PnUlo)JC}9=tvh@$)+N!q9EL5ickg8m>ALaMcJMW@qNY5qZ8BxJPY$Q+L4G zQAa6lu<`(}Ibcue2Fq~yC}2b5d36|~uIEW}(?xw+_z2R4ZRuzEUo`dqP^qvfVQx0e zt#-?GWj@MrD=d5T+ib8Uwe!K^v1kRv=GeZslq)Xko}PvuOf2g--)21Bz8!sMc>Au# z_bR21*Kv#PV5;1PDAATxw|U7L;EC9L%3#NNZh;7E>wYhI3eWAKTI8Dv3)!>;K0lV5Pbj;4;9l#V)3|ity@_vw2@JI0; zZ9iqVoG$&gwM8{Idgpe!MzKdJ*Ofj!^Gl<=>6)L4it2|AXrk$5Dvwndu(ZE;{m28N zxy*iRBxEEbU>KvQ3@hmTgZ|gT*o*6{{A@;1X zQz|k6Y~*ZHO&J+xE3VN&vrOM{BoIU8aHaqjVJsUn(P)|Pz z9ZjjIP|5)o7Vhj0m+Mel+^o56{u(I;EXAW>9-#)C&8nu_nZPO#ruAYgDb~~d@S)ei zJYK|@dY+t#_t_mSFC9py-4z}|pYNAzR5_>30{-)(0CINd_2#%VDQABaDQfQyvvy7V zX5Ss0T-z9}#QEi=sI~P>#LRAVyx0GP$iKyS7QDauPob$KU_s$fzrf|pBjU;+xP)Zm zIl`rmE>@Dr9HG7(nN!X)ohImk0*Ly5J0;M5%IJCeaOME4Drf&pOG?5coU*gmBhlq| z3j%P``F63MR+r>1y%z2=8^hJ+D@YB^?%sTN{OswLt!@iBd6wYEG+r1U9-dmu=?UU+ zULu2oGPSalG6i2>kVU?WciQ6V^s*s5X{q1Y?97tVl>Pm;slU58 z|K7*&`eVLhuLO*3>a}_x{^n*E$Q;7mXpe0DRcmQsXqri=@kfC{G*W)+GP$_uu==Z4 zWm8DSwv5#x90HX#p@9i{$r+w04+I?FoaT7s7VYmSyQVy8WA7`%_oqX}1`MCeZQ_=IUL*5-AtR=Im%!d-5M-dcKdg zezt^fmrG#4uVUrrpSg?C_&bUEKP4U`T0}{1s6VcK6oav-Q2qnlIQ>LTIp?iC;D+(KV`?F&}RI;Hdo>%E;B9ZxV#NGY<{fAbo9`js6_ z(8~e35~6U98Ymjr5aalMH67n`cp6}o8w_ZEIzF~Ny|~~?&F+uVZo$;a38A{9v#Kxn zn2vxdl+Tyhkw<>JFO(aw3Xl;;5PJy!5K9076N&$as*1ff=!*Lz4xAbir{C0OnMF8v zA*l{xC&krxj=JyAj|9w(1>M%oDIjVEu`GMZzKL=cgbsZ-UES!FA8*#Btv#7S#iCVU zgOWC$kec6?YK@XE4?Et4CE(lls+v#Nzw84&B+r{YUv_}pQWa3!ZB~j&Ja34Cv~63u z!C!53Iabxmb&xGA2qHN7LQT}-&=jzL&XlP4d4rl)+N}C`ffPR&z27GSO6rb3Sui># z!96+D5r}~HZc*R&f|=j>ILd&soM*)!(DfGrj4|#Mq!OQ(6`Y%Qmo;bg7fs6Uut@=H zc*HsiJCPCZ-EWh-UK*hO&xriDEIlv9?<LA``2vIr5Z<^XVfaBTN z+$8!3~Gi8)ho)2%#IeWXp(!)G9$PauRlc#K9C=`?XqmL;p5;$f}q#yMYLo*PN(xp zH8Wm|9*1={iwg@j@)OwtmeVL9p6|5sLHlFbBp)-;`cv&9xmUtxBZ&=2>X}bkZfr02 zCtukfAJ6%&`Pn?byjcyO)d&4XN(Ml5pGT?hNV%rNU$hCzc|-l$)^1K}lShhb@vX+2 z2q80N-^Rw?oqdj^?@OG={^PVsmU3-l)l$QAD5^5DN#->~d z@}nj(k046Z1QNhHJ-%n=WK|t84!9-$a8^U`)&V$Hq42 znq88H6!xPXpM2;b+6X3t_djB;mc$2Gsd4|v{noLCqr29%RZrV&V?t_d0o2$(2n&^R z_zjIVF^I6jH~T-mrJ+G{s7_Bzbk($9BmYBZUvs2f)BEt-ot3AYm=!r53Dy=M**`AK z3d+3?okRXpp6ve?u=~rct8x6(hyR|V`x{aMx{x`=8j62BhfWK&T!wW4K||mVh4UZ$ z>I?(G7>YrkAHooMwEt%o`~Ls|{y!R&f6I{qdL7~#A%|M}^#iD1G&|9=H(BB6!-&wZ9zw<2ir}pLhp}JsWD- zzrm*72|A*GEN+-L_QC*#nOzVHkY@HD7Bqo@(l4^33!c#$@;9jA@0H~LlN_iaf(($P z5+CG$DaikR7EnjR02))IbUL`!VfN20rwvXgw%nlg!-SG2D}~p`KOrjrirxfpI{Q=o z+WvpS1pZZgEU2&>^KKTegL3{bOaJ$s`46VQ0OUJ20)Csc02EsYm&l~&qO{109Qj>L zwh@K81-(^T?)s|fvsXX#c%rqswLEFZg?T?`1EfAtF}6J`vhqFYnrjv^Xx$3@-`V@8 zmd8T*7Y-G5!`{3?%WVy?xTYbwyLUXm%CBzEfQ5hE;$ViEjwA{S>y`v-hrIMn6>jT`!3_+8RvrwAe`*g;6R}^pr|iUr}Hr} z(`vI2O-O%{Zg?lkImz(EH_m(Q)~ah&bHT;UslN~+Z92a@6bVdN&vvwP&Mv=4=XhRO zj+8FYyMUm}=(pR#bp7`B z%tM77ZcaO<)pgfT=kn^ECU?r_8ti=gDs^-eo0KJ|%2bE|NV07zM2l)uv&j-Q!{Z4@ zhtK>)hR4D9TZ^1rAbU5b12}VL%}!S_jO)k8ddkhNdLlbR$ z!4&fEiM%=p_uAp9LsJuk^y;(MkCuOa|2{m=39c$!?&j z0%4|GBuS)zurO(F?-;?eQE*cxapdZ_@QPbh;a02NZn@B0wF}Y5G$e^>2Gy}brI(y` zGgP}+VQVtiqo^Z3?T)5Nl$1H|?4HCgnz^!kGsRWYSDyhgC+Jm)T3Iim(TX_K)dpqS zRaQ{*DzP^_DSeh}T2HINGP&aB=c_8M1|P}{?|Vt-<0+UE@Wq0M&Cbn2n!5iXzRxl< zU`*DZmaKAqwX$DW9$xoJcpA6eOkc;EnAB$r888ui?T-UHJl7^D6#n@zT#)En9b|@L z!#W5P3aDTLqD3BwpC7KEy@r{2x;UaaKZ$*1N0noUs1)DB(Ue8?&0dUd)Wzbk7SHjV zcPqL#wyZUTmf(%cur6Er-fz1B=|Ru>i@|tir}?j-3p}R2+~3cp>uYa+uGV#jtUW=G z)%f3b4zlhxcI} z(9_qe58qhW%3F?8qwzht|9Jc;&ng@W26--8PUDpUh8vrwv6QFZ^^sd#j$nbw_u)bv z5l$~hj`)|5cZC^@{ZS;+-65zEke!q|$WXNlM6FOGJD}*~vpcVHoXSvWpODv0wn5vWZM5Fe|Q7zdl)Nk{^iYASH8faCnPUEg< zA>A2VRHlO17fl{_kF*mU;-nuTJ@L+Pzs_3ciV8n}zH|!Qd)F7IGFkOSoA^NO>et|Y zenfr25x*q|zc4DBW2x3%n*PDW)`ilKh@!A~hvCD}YsQXQoa33Op_TWtpbT4<(`!NB zLyu#7OkD4ygx%P9f(^Il?oU5vJEDc%`&;w(t%^*l&b10EtY#p2b^1y7{%4oT96MKP z@YRR;6_bEKBX8r?T_GgYD9fFRS*I5J`D5x|s416W7ix~wTu5Fv4dzChvY3y1wOOu# zrPZwMJ2C{DU=DRhep)X+=nN)m_oSmH=bh)V1# zij6uM6CST^Z&N=z5zM**pdl}ijE;o8Fwg`z^=#|WWM#ul^3tFIWl`=+p>YK`RXd9U zs?=(oN_%A3moKw2sGN40f2kf$vcte^+Z-PDC*rY~ZA(i7YPm(BtXc7H#Y>KWw*BX< z#H$!+?<^054eAK5*>Eu9uw@)|oc(Iq&C?h9tE~*=YJBgxxw&a1P-`;C?XsS&_Chtt819P{lKGdBKvDO(vmfBa+ddr) zV@g0bXPUztGkwqf>yk~1W>q1h`^`nWK?^aRf!45FZmZsjc~OT%QF@7qU@d?qebCY2+13v#Z@KzR51+aR;p0T7?X zIp@WE-{`2iFyvA~|1Mipq<_y$(2H@;sxSv)r(f~tX`4xO`7GQpns9wJSFwAo^>h3D z9BiepuQ%(mRJHMAYcI6m@Hvq0@l*P@ukW;^K30^e=~q9q>U{OMzAp2WTc~zD!e~8P zcvWw^k1pBN=Bl&D5mfe8bG*8ETIZKzGxvxgxAd|{ZV8*cvPA!LqQ_GSlf*x;D-Yu512HxM>7EuAHr8VBjP7MFRQH2o@?B2 z{gjAxiG73CY&)03TJV^UKg#=ypVfO~(_ynpGAPpJDatt{ZP@k#MDJy4nKiFxWFnUS zxQP|OSFUj#yu2{rnHT6 zIbSa!^#(*$%7DVK6UOk8$n%bV9-Qf}8uIKWpRupd<~&2^xVB^@i_cif1W7qeQ2VIo zD}6uQMnPLHm}rhElxwoDacTJuQTNZL& zwLQ4O_Cfmq9ZYV8CLC{?*%R+uJKR8aEAxP#F;Q&IM36lbSx_z<>pm{1@XW9k!O+ht z5^E==8&}rfI((n}T{1>hq;-L{<{iF>H6of|*R7WBm!MhY2V!1#4bQ86#@$ilcglB=9WlieI|UG0UBVnq4>pWl8v5 zc*1^69;m73d%OJpPFrw!Fy6b*e=UbZ=UDu?qU5E5#SouAo|oWWhia_?q+)1LYnIG& zFp8ul&n$Z6e0R-Yr_*t)16(bt%NY73)TQBNl>RpO)qva46Rq3y{i0Hf=kwfjBf)EY zUJV?zl1p!QmL}&fMY5Z$&VCGS{&2y&V+NGlKl@g?URnowX3D~;3O;gpM`#NBOngpe zx5=-yx`?b=*`F@R#8$P+7$I3q-X2*9GP2sQ#_4N*0SbhLW$|@avbmMi6#}p5xuZ>1 z^4!if+k`4r`eDU)LN0@suK~i6h(71-2O5Qpa+IXhfQz364Abj0@D8E!MRC2;y$60u zwg$d4(AFq4PEt&3GFDR@)!2#a#R>%w;FiOP1q=)*D)GIp{Iym`Vh|PY-vF zshf?a=?Hywj^{l}KD%v28Y0(w;5)H0-U|Kp>`{{6LuWS3-Pq*}QBm3W{EGXBjRKyB zK@XRMcK1WB6M}%}_kC6EeRC6E$Z3b5^{shwMS02To=hU=w}-<1`#m-+7^8Yt1Bn@JM~dY=~--zQC>*6OW9DSNOZ1zs#N}mbe2f)?UIK7!_OPyr9g5E z<$}2NZiIPmw)fr*hIZ>ZeI2j$j#cvH)@Qj}6@Anys@y$#6V8mD*e=>_W|aVL!OwwC z@Xkt5@}~^J#2L>|3r$Wpj5lGuo@fyyJinJ(94d-+Yl^++E5UqG#OX$riM@~g8T3m+ zHlu71Vg}vf#^X#$8eGZ<$}huFNxEjcp!qPa4$>te_ z*2mFrO7Aq(k*Loqt0;=BOgn@gX&zO#A-dg`*9C=aq8(-OdJxj=2tz%V7j{~X5J$>p z+W?coE%Rr$=}PpdC}!3Q_j~XC=O!4NPKPMyglb)WV2f|k$0KJ&=5~TK2N%6H4Hs8t zhh4ChFKPtI;PaPnLbR9kPCKtnMcuz0;CpA>%R~`tnuxY%4&Ch?5(C>eJUxxjFX;=o zJdQ7IIxu%QVJ|@)4i|;dnYF5QGG%=)Zgkco_%hDYY*y>ZDE7T>PuGWpR>2C_vuNt0 z7}pT-&Y8{r%&V1p71Y9?K*CqP+I@Hv=>l$PMvEj7k*%ovJ}e+Uk~R;QkyO7?+J=9* zUkWARCwX0dw9ux`?*bTxZx7j)7mUnwI}IzWYOy}^p09Q|Vhj@o>{Qov#E51}by)Pd@5P_e*(Mj_tFk&C zY*J_CH~S)u$2am!=lxa@lS3ccTIvUzrx|mr%B3m%W8}VERE0{-=M`jntFzT_DF-j4 z*|_Cx=9c9DMjR1}GZ?g!i{s6hsK`j7Qeq~+C|#kae=OojlTHgQ=lSU&o|7ey zBa-$$3_~i+_>!dP8;&H7U!I}d9kJ3d4hm#w#Z%oU1GGFvqQZ>mHQdND$-NR=G0+nq z%lzioQ%!WiIKJz2Q>vtLA=oX&t&c#qt<;~`E+bmDxkZsySgw!i`$} zpUp4)y>PIl75j`8gB5CMP$MP#4*4#&e<`ivy?xCh=75riN=ldI9qarZghfJU(=SRX#C7xxf|GiC7_nefeaLoe0^0?5hK^Kg6~Z z_HHZohElWPDUUIu&NoXGUY+he29`yJu$So4cD2VKH@yyByV9k2)$3r6CHYf!*kICl zaz!Lj!LA^sZ7+`;<1)RvI5cw7xOvv42nCqb=r@+VFvoy5KBrT*aa(?1DpIT={cYLC zT#}IIlXbmHwl@L2dVc(ID&DM_&)}}6JMjy7$$4FJN}WN`T zjX>KG*)A+kPyHAiF|mRk?8qf@&7sA=;I)wkoDV0uUvnCNHW|W0J&*%@@*i!8MC^~g z5zWqOBMhh?(h{c@_7@NOP@BzStAnb_6H2BAaKpY>bEN3G^%pw6f`F!fe)~oe29p#+ zm(0mch5%!KJgu6icS8yq;+nOD)a;Jxy}KY`>hZQ~oAF!cfMmbl6;j<6=O;<4X;;r$ zTBGRx;IiD}!>Z8!ApV9{&e%slpg)bRPNcuoX|L5&9#lrb!futuL;Rh?Y}m=8y-Fw} ztMRyW);~u&nkY#|kf@^?lNDS!5Tvo_;L6MutmoZYvN=+(TYs}Q=D6g~9L0w;@=5xf zW>(Q`7G&0sTfWGv<`6ND^4iMsbA@#Vfx*N1ZnzO&)7{CR)eiN$L*2yZ7%>bUO)cKCkN~#!;M+A1w=D zn{jy@TDjER;9>|Ne38Pl0xf67pzL|JYuoe0aFzeY zriS(b*C**AH^_Ko%L*rs$wJxbB9$8y5=CXJc9Z$_zM67Jvd}U?u9)P=6x&Dk4Xqku z2vYS26afoq)?E9KEpoSwpyjk=-}9=7x%?79_*x)UpXW<-Ic$#AlAn{ zIR|Ay<(My1itCnsGg{VF?$k@P7-+zIiYPTu)nT+k9zPu5MX|(E-fCroRQdBGv^?ZD zq|mM6{pRSfK{17vFz${rmLjtYAHSE&q!k+EIUbuA_h9-@lj-=KSfs;GO0xS#I}2#k zd!M}2tc7F{w_IvW(0cB_nODO}>Q!|>Y*-?pZQK6N6r1M+&}WYCRgx>O>(eHDL^BG{ zF&vedAG8uC@n*%dIr6b}`c6ZM)bLf=MUi1{CNE(`D@{G1F_TqY5)#oXzc*@wd&LL$qd)xni9|+&Qgz2Ua-xsofoM~p zhHax%_xa!(b%=(EbwTAur#yBKWohU`nHqm(z5i7Zb^F6qH!B59X(~Bai8`Cwhw15* z(&8xI=LW+%ExB8U&%||B^S+FcuodR9(UHnnxa^h0fps%Kdk5jrnN+6(CN0D3jsou$ zQQ*y3K#Km;*l;tx_0<58_hM2rwX~WHZ@}yTQAJ}$qAKhNv5v90u8k+TYXc@sNQ1KD z{K81Jk78tVVw({z(Y-z($qsJfV-8AeddoFk=Ada+i%u4KKO3C-XS(a3#f#-8zZ)E{ zwCcQhnUX4W*lbf0!}%J;l0!p{iN8m|4I-jGEsow>UL+pnYcy3;>(hfjmF1io{!o@q zFUw`D)Z$VDH_8=%PM>n8QK%Le81mA1~k7!LxV)foe~n-W-p zs!IFA#Xi(p*4HK+rEQqp1v>M}eG_QM{wnz+m8=IhM7!T|tWcPwD5CCR2Tf$CNCdUs znWZQpZSpYLQ0!h3Kx_E9E7!Qn|MoypV1r+rxiJo;Qt zEiNO+I6KQQDDf?BSDyEx4DqZ-yBm;0;_g>eJsCwH9kCLJI@R$Akb0%4UXe;eY!#u+ zN@;BO#fnyc%Em%~5!{Tou0R7%jf0Kf^MMlY>TyujumDC!HdDSx8j5 zWNwX_qVK+JF@cX$btEu%ddFQ>=d0?pGVw@cS?Z#ynHJuSd1x?S+dqDLGhO$y@2;-r ziX(0sL48)VB;t`%Zi_AeiUWu2_O2r`Voa0WEKd64h!~Xr-8;1XsqC_*g6_IyIeTO6 znenEz2)?+D#um_`4cxAqpxu`jm;q3{46-Bmf2XS3z?LLNrY`%p=}jvg3(M8Q4XluZ z2Fh!?X!lhNjnUcXC7xWQjD|Bo1mwcDGO(>_MoacsUk6LZ{HB)&L2y-#4=$_PR@uqo z7u9PqB{QO$lM*{ENZ_Td#qxm_*UeSk1B}kn3#*yJd`bnUOMkkm&vfcDbhq#LEs2s| ztgicn$8L6@NF`6^%I0(~rlzX0DI~B5Hy8INDG<&4nksshdxr7-G3PCTfO=U%sz$KQ zsLHXhkX?|^qtv_HIZFpdRy`D`;rS@8g?yS;A zrf9|Np)5cw;MKwkO*hK`u1m|65_PDV#%hwLFT9OU&~!6}8vXR|+wY`x8-(z*Z+-w# zaZv;7x)A3RGtC3et22=`sqvc8ifX%6F(=CE@&tQmZS|~Ykykk-eeM7T-P`=)651vG z8k51&WBenoi`32Yr~{-C55VT1gU33ewpX3;_0repd#|9(@N69Q?WPeonu?kz8{OaE zsX0WB$R0``{eqFsUdWzxZJ?FYDmscfm}>ea!*Y`;t{C#=ZqM3SCw90#Hz8yBCns~5 zoHh(Cllj|V>G^;>?uE&lTGHJ#ZOgQ}#nut)f6XC4u#q-61E_Zv!)*@VGreNMTYR*h zwh=);7JiBNXu|G!Px9T8U`u9=0W}ZWdKVt4ii*u)Z$qD@7Itl@>DS>n84Kt9nokRH z77K~V@XQRE315+HDFYK1KC#Rnr!+cAv-OwwHza>?Ovmkk!CeWC&EC+*rz&0C2{5fP zqaIyCc4eR_o0%_@jz{NB!&Be`7g?eQ%(sGqi`_4+&Z2rZo)}~GB+PCFtoFP0CSyM> zD6u}_$ho)Li=B=AoKM>MVP6}$mWC*=MK^9hFAVA<&cO&)wNg;MZCbz^S+Mr15H0N@ zbN*7S|11)jxBF`x3$8rhV@gXX%V{X1sOCuX!az6bVsGoW%Fey{up3w1h;%E5CTzF^ z9kkSB#@p(?d_>hPN}!gWlhjRdX43;5rSvdp+I3D=V`q= ziNg&T%DnFgET=Hd(6_mCf1>wr$q4xrAoU*cLmb z^Mug+w8_AMdSMM0(d@5Ogzl9Uir}=WdWp63hr4q^EDt#R(7X&YjZb$wki@WR z8+cp{nW6DQgO|Fjnc#<(P)@t!B>JJwLUJ0ML`)K|71m~t?y8YY#PPlV740j2 zn%F$uIN6ykLLU1wh51sJj%)>tMYEe@5Dm*>TJm=;OeNQL7URK`UO`^caYQx^)A?8I zb6rRF_q7g$yR|=y5N%Vk#ZDbtjf+m?xund;@gfj5OqeRPIEK=MJ9`Lfj>7Y9ubf<_ zf?>*xTEICc`1B!E9_s-RjYpDG1II<%19d@6%m zLG(`*Uh2=Tbcx5Dkjt7XP}lUuI2OT8nM0&VL+h2 zzk2Sb!`4YRg0blychq1LlMOP03q+0@@q%7$^j@@?rF%Mzb~!?xa6WBfgB9*#q6J8Kp?Xd{PN6$(ICT~lE|4I_ve?AjY69tK{_$Oq8!=_tSaC}6D<1t zQ`m?VmQX9wZisrAC`h_b_!J+PH~6abc6X8osQ==}-7bn|6KBaEpS;eJr;P zVNtGJ|G>1RWq$AJ2DIzY0C%yWQwwpj-sXvR(e*IqfD5uGhWSz2*m03%=Z1$I@Yofb zuQbSM*7dzZsPk?t8Ci1tgqGoZH>OA>VO*5Klj2Z8a<*#oJ=kpnBR)JPLP4ULM^;;J6FT%75 zc{^@?$u>pD5N?zVfD?1 zOqWC=DoUVHe}lp`q4{mUnk45!0L>w)pP=9}K|1w7P*cFYa<NP-7-7n@L1D!3i>x2 zf;ei&?!VnavvZma#zP-NG?YmMZr z&c%uzTjY;mUhYptl2~!w(nB@oObTYRejQUJ69aGk zqf5+?AS-^mv$vMNQ6Q>~YLwqT%}-F9s9+GuZOzJ;q-?Gnhy{slD0&wwqI9T^Yw_CEzIsd;hNG)~+}|Zo=GH z@6=O!Z0K2KYCIhI!9Ab5BK5@vB8DH_?EJLypvg$S6MV$&z)rD_U|VjF6*830wQM{s zc`73qBo>CpSe%Tdot#9|gHszHY`PvEU6m7(im0RUN{cm6!+13$aX7Wutqb{4j zqo4JXNT2VUZ9#E-VVBd!#4$lBF-DG%_vf>36u8LfOTCkYioHe7!nA&97=2c=vD_(_ zYuffYA%gHm%;YKHuh8u&!X^f+T69H-;I2$rx6LXD3Y!gpGm58Lvdddvxh{P-@$xo8 z=o-c!0OJxuN97ncaF!?OaAWUoT;Qvo5Lm&i=%gYX1HbBV3}qMKz+suQWgNUS5`Hdp z7+GT-;Uess$v<>i2?KkG-ifpq^DxrAIc5L4T^ZE<6^E42fijRC79Fs884JwOAF2Na z-atpka(`h}Zfl_C{jSGc!n+GFLQDBzDQUBTk}Z6R=};FF?6P$GdnXU&>|UpAvyh|^ zvFgQoGwe1+DJABw*<^CPFN~-M57Al%Xi&3w`Vho4JMB8oRg$__toqE_oZKvER-w5usM6rdh2O^C1U`WVGiF2kz zRU(fai!X@zhe$=0Eti8Pi#~ECqu4O~D14^X+gEgODcsMQ-zqFLhqKt+*G9_{3m2~> zVF%pOa$>@827bV?*b7zZMGe8GMt?o18*4FB{~k-|kcQF1p*ny~qZh?iGE-gtFTj)? zX0wwB{TGG?H)r8<(Ondtk`7M{1+IVHxCrAJ>Kh?qr97l4^&YBPChXxbR^b#Lo5E3< zh7bC&u{aKrnCcVU2tRD@ZjJ;D)z&@zFL2f7G3dOQ+=Sfl`3(ae$K-1So+jMh5=l`&Z4+ryF(qg9~5y8lF>j*#~9fE+h8)ql^>o|lp zje4r&<_zE2`UHJmKf>t}B&Kx-(lydJA#L3D9{w4AnYe1-X9}#+V79sOR~AMH7+A0pT9njGz51g4p(lZ&O*1 zrDOa?UYX6lQ6H7b-ynbLXbG!v8uL+cXOYq|?-`Rkeu0ldVatB3fBcnlC)wGrZ~3UD zCNf4D;pQy>Q+_RJvbf;B0QO*(fv7QmF!wtWa3grd->9@X&s9j}3tpnZepx>K{qhHM zepoXca_dkFM*Vtm+nk8v`waqA6yd$Xg}RfsA`s||hy)`45p4!!-5FijSs9xRidKgpXcnjLT5oiRLYBebV+v(a>5$f1@EFTG< zd9V~rv7^t}*yp&=e4nvMT#8M~l>(a+X0m2?8_MLunCMnFRxmVYV_d5BrX)0W8^E)g zu7GYoU|9;rY7k0bX!ZbjRzh2Xd;dE^wu;?mNIV zyoAe;%I6To=ErKyRWDWUrxQtJ&Dg}FMg9hd(Zg#wMK_{`dimfs+)?lUl|E=l+nwBr zY7L%|acPSg*_7agl0fjODn^}z6iX)M=pE>`c-GvN#PX* zyEp%vLq_f3!w2~Ayc0WL{N9*^weE4xnbsD!6N0?ht3@BeF*ajg;V+=q7;7o(IIJ0b zU~5Q_JXV}T&xDxHYvMVS`>@UNge*Pd>uz%9(v+3FprFkWez1MpwQ`ay6jCqnI-RY% z%J0!g9IkNV*ahAtOINW=V`DGnjiP?3OBuaReb!+>aA=9uch!|;3q@7vle)@=#DUn#5)824Rl^s$V`L|Ki8ow)d@TS8r@)Y2@$MVY67RO0}Lz+JAby|G_jb z?78aT%1f;R~UY8zZ4J3%P3xP$mZN~yYavq~OT88ufcec)d1D&N4~>d}LD1yrZp zNOQs%Z{2O8$-Jy+1`{R<)X}x>+9>QB5BaOj1&R~xuAW-SHRGh-;jL1)oTO^7M#}S! zvPT{^-#Sq>FD@xx8tC@y4aW4i#gEmqOvTb5m7T;yP|`taY#=QUQK^(V$|SPdB*7>p zB$C&3je6uhn!^mL4{gQ<^H8cvQG4n&laf7&dA}Kl&t#-BFDcy}Tupj6fF?vHC#Ye~ z_oj4{X(hSr{MUH%54^ux%nf)H-I7Jor%BmQ6N+*yR*A2XgDY97SEk$)pk0{l>`Dzo zB5}R@@}SFM`*1EGU}T&@M)@n zMuPaX<&B{xcAGb$K1=iL!R$TB(Cbt^iRIqlfzC5RU?3XW~*<&FZZAWmcN9kKz1rjzlGpMa9DeS8z&yY&h%j|tSsK<*N z`iG`B>PMjTtCbzF%R~NAae|H%Z1z__oJLPTX{4O1LGMDuj~k{%=9z+`KJR$Y>~(#w zqS^H9?~s~4LsNzQVRylh^78Vu+uXt-GL&$HBh7&|AYnEs@<4ttQ9(Fj1kr(2NU$sA zht}84_Z0pOVrw%;i!|JdgpvNUbxvMMC|wOzpcz1QgVBsk?!#y(0zOLG9aH#LMhkO; zY&;w{Zyd8)R^@_;fH*q+67k_+lyLQNK_d=sCC$&OZaZ~$lu(9z4!NTlU9MdYXHdSm z)*_%y=)~xy;rp4_jdd%wGj%ty+A*EYkZUJ{rv zt?$>O|0O-FkjT0U*Ql(hVVMO44ekk|eXsZ7eX-vl(ZiX~<0)UmEuPIFy^p|9Lb!ZZ z?TaEko2l;%`?K7FoC@Q#vbr)jsIL;03IiLC#i|1&&rr;@ntxT23vfzjm_Gjbi)(Gv zS+=dL9A<3|ZN~k=bg)Pt$=D3x_UCh2I4zd;0uKZP{-`fHHNa9dS-n6{ec|=Ig1NU` z6MDI~!qxGC|3tTcp5jmX2!Hep(I0z!B|`0PUy^SHTcIo6d)M93DNp>dwbm<_Z6}NZ z_~%If9!!4YofG!q{!ziw$^#cbZMq7qC2swS%|Y16mI&Rxk0jcG9t(My%%4B^0Q(M; zt)=qV{RZ}U-CFCEI6s`{s5$HmM65PF;-3eDLiIIE^y25MoRXNH?Sj9MZXGYTXt@>; z3wyt>91cY%OS!{i(TNBA7Jtvz><-!a{G%2@)SP;a-e3hZ1g4aZmIWvaxuQ?r)ee)U zcWu7<^Ua`^p&xwO6Zx{tW+Q0{$eU7w{lO>$fMvl}xRk=@-#0pjeGwESU@OM$!K8!< z6GlSGjDmuK_W-42rc{eXt&M=ghlmy2$l{CkB+qU-L=H%X0`mS}54F=Yql2=z& zz~!wwp~KSMtOxQ*wj#d(2rYM-M_)EO0Ny(BoDn&Q6gHh!KcQ*yL_j{pkf<#;stISh%g?Jl+dhmj70LArbq3aoMa((K`SB=KS!EY3*4(||U}s_gj~D1PF|{1F#cFw^^TC2{v-62T=^Y`LHF=xY z6FI;gqK-`EP6D!*`CP&He2cn$v0n?++Vk+6i!>VSNg2`e+yEwFTAw(Qs9qBe_8Yp$BBES#pR&Gtc^ z)f*0}56F1O+Yb;P+h5&?=+v@tJ@t~hKECH$MVhwLPB+K89=E62?j9aZI?=CW*A#%= z$NtKUf8XR!+k^fT5&^ZEoG6#sXgZ7c?5np@5$1*`d<(XM0wqH6->|fG*I@VI&FJq+ zZQh6DDx6CHqv*|l?4zjB^<8sg$aPfZ<9|2Q|L@3YHWm^lGQaR;ddJiM>*Dr58gfO9 ztZG&|y6S&2LxFjN1OxYZ9?#M6I`{>t_5amj{ogD6=S`3nY{WdCr5g#+Kda!LkjJV= zMbMxA+NJxCfBuT{er!2(sJDB- z$|9=pC4G?mN6B7x;)?`Ow(D%w`ak~ATBcvYl@nxU+3|VhC4{!%A5Rp8&5rQPtY-a` zVVzyNZ_R=n!~$EQX6wC+dVS_Wb8{l1DES0xDwy;t9`ntbG#kxmyQsGh{Nv^9GW{5! zU9FF0_OF1?PvZTeqodOV+>}`K!8Ce$4pbl0G&XQV%7b3*(i?Q0ruh~K1QPwh@XFs! z1_)=PtLr<9NILU<4z&{l{IX32L_&i?N!cab7c*aZqqG1^kom4I)!op&B z*ALz74+%g=sAxwZ1ynd_c}N(10%yAlrfjfXj&@_$(S%CNe!W!pf2KnMg2 z?(PJK-~@Mvjk`O+Jy>veO9<}n?oP0cySux+l|Hxo+LV%eTofag*Vv0>Vf!%1_@*a zF@ObEVBB^&-amYpAF@NrC&9C$`E|W3iVG^_&GAwqVD{T0{y{VGpPs}j4>A8x>y4>N zB@F?-FCZErR&Sd@pxrlT@DEo?2oVHa>hE|2TLYEBm-taH$&g~|nC~CouCGb2mR$TW zDU1GL&Hd|@2Y?0Of3Fgc9sRGWcl=1G-;H#TUK=_7OhWg5 z)&dnsW@7SWGbOV7qk#mL1clWcZQxY?Q=6mBN(0HmHC|lg7j6I3waw8b_ZUh&$f`wP zulnE=M5^EY?Kdgf>%hgGFGj2BM&fXmk<76$?&}I=BC)Fir|Wq&>C{yy1_Nz_!_KM3 z4xmRMa`&bv6vZ{e5Th*M=k# znPa!Qw*)o2By%hEXoX=iZaxOUpM%m<&K-xy@9n)oDJ&LbvPxK(D>NAurX64UGuzmWg`_)xFP_to!6gHor^-?R{NKGk?YN>d(ShUjJtFE|#3eRU%uD!G zQ#b@P#kF0>wW^H$R(o8)VQ`HeS%zZ?!p37-t95iHM;A2hzh4BK_*b+K%g&%C>!0%b zTLZC*>)jDXjZH>Fh|CNCHS%2X#9HB|Dy8uBaaj|?8SsAt5+8Qpnm_$~O@=|Hv%EM_ z>1q&^4@er)!l8C28VsKAR@`LfeTGf@n@YwBqc2j-;$}7ztOHx+I8zYS` z1V^!2%(P5QdW(d`c|eDXg-q>9-wB5%N^F_4ZdHxpG%J8pDgZt3y{Vk0%~4e`CgTAj zU=TCG^#TLaVv+6WQ-5$Qh4eV%26xg#21qICUOOs9le?{jNFFo}-@ z?pM)3axA`XSRkDmh(KUg`hn8+=-zQ}?ty|zy*X}AHY>Y;)W)|nrQXCJL_nZXYt4LB zXTGFzeYj*Yej_1hvHX8#9Yj1|p2HOSN zUWi{Fa+4bma@j8q`8xgKNCltJpm>#A7mP#SH!TDpdYpcR`1-)kgX3HGa zNG0O>e^X)as$~$Wa3@KzhiGKdW_wwkqZ@Z4@Yuxx-8^coPc;r|L9D2bt`@lxlB){1 z04MY86juI|e35HfOgk4vx%riP!IhcTnd^QL_suCR$-y+Fb5~$EljSZ_0qAFn87i75 z9+xBY${I?W(~=vgLO=e_s;HQqS=&QXF0@)gxp1h({RVnRe>jQJXsuJYmz4m^tgrCv zSd1ce8=|)}3kce9XH=`wdBscl_T~GeXRc=h3qBsWNd0H6<#Mxfr(0lrwVA@ukI$mn ziaXZp1=cU&ZI+a8SOmt}`CwAr)_cQgWIZ#mxAaYvKatBONDao*(an@QypFz)8d&iY zM+6CY*bHT$*j_J2fstMvk9H%B^{o##J!y%k?$CM@*})^72QxNFW|zC;+UQPa2zFRR z81&lq@*$yrr5}GC2$Dcd>+j*1!X`fM$J9FP;A64tg}{Ak^XejRLkHjxIj!*s3#5nB z7*WYI2R8&ET1dInl!PuZtGavWvRzW624XRSG50}$1+gb5x zXUk)ovVzb7JHvG?G(h>`m4n2aCPoNptu~wN57`Pe+Gw1PQC!+r&Lao*tdAAUdcq6d z?F4~xKfc}>-Hg)N@6Qqy+}xSa7g(+QC@n19h0lYdiXt>TDYde{o?>)VJ)+K$jE~b= zV1FoCDV4UEYcmOYcYD)sX?@%m@+oXJSEBJD9=*Xkic4tq2yX17n3g zeqmVb%Tjz3Lfj4}vWW&kH$%~W?wglqT`{D=Whe+LUu(a5U7y?(;quwbv6bleMiVTt&gqtTPcm}_v+h3zVf==3Z&`_Z-*QILBj{B5-#5;v$ZAg6=NWi3|b_s zg;I2Copti}s|x)d7C3HQf!B9x@o*R03`}s`9~s=LP07z-Dy3zTIHW&#;gipaG_kED zoyXI}CqlHnPk0+|E}5yl6h{0WL`MWYO@?@EHKJb4c5&9JBUy)FH_fZ)LqK|(feOH| zDY%^WQ_f>4Mq|6s_+tQo7U^t&Ts7u-~-R5z1+rI%(VWz%ivTb9~nMM z)x!jTLsEkgY*s1=CchLEw_ zEXJWxDTqlt`T4*XbWI@VwCsJ_J`8vl z)~>9dZ%LRd{1_nz$*-)y+>O+=5_a?Jl4@(Nc-r5c$F~>vR{lM${Ncl2-guTk57MO5 z55bWdNnuf{s}1z(-=8YX4QBDsg46?cooQL>pIB>pyRe z#7bgMJt)x^K|*%y(j9PHmI+mK8gpf2WMC&Uv`xJt0<)@9dtT8O*ii2p|M~g-?e!SGf3bUWO}_=JE2|$w}EX)gG?gwQSUX9 z`(;O0knt(xke!vFe#8fwnG~s}S!)HnFrSCx&YmIC(m*=cuUY9uFt2Q= zBLu?mDbk^0QBWG^!k3{`}2-M?iX># zigdy*)`A{-X&8k%ug`N0M>z*x{EoBqkvL;BU+KyMA$Nf}=p$n3+YJlG*}9ciSiBx_ z-SQT7I^KJ9XDrq$1m4eNO*(3j_ZoYwUW9YMiuV+M1Its5Hr0=H`ZzO-gwm?HtgDTS1A)v6K2D`pf+lX#YA`W`M-5 zVlb>fYwQeB^I$DhPUtreex0}s?T~j5I&Dyo90EQHDf`N94?mx#;E90tgjV?0URjN3 zh^}}&fmX|y4TV?GC44IpTt5RC5DpKgayzCBOu;A40y|lQ<-7f_-H`-3tu`w%sE1*U zZL&p7$Z&4ltQ|1=Cjz4uOz)jZKi^;GVlu&!%!vR4S5MECMkD$OC7`-dDVjJM8fhGF zD&-<2r+wptQMRL@?>gn(pBFp4^JL=mdqR?k`%e$VXm1Sbg_~l4aRO80)u&!)PWRg3 z(va55;X*DwLFxx>-!82GTnR{naJM%^@ITUhi|A2|{^)|7I>Bj9&U%Q) zJ)B4-Xw_$L_owR+3wlJ9Vo?Gm$=(@pQY7*PXrQ6&cH&Cc?vl@OYClZNA(N-9* z1tXmlP3~wO{G#a_pz$8GfdVjc5B3SvWQF)33IYL`LgWt>jLO0TI z0!>+PUQk%QDaQIUz`T@wi$P5ah^kKdV@r}ItG_qEs(ke(-f%QQQs2yy?-IV5)>)rs z`^S@$Zg{iBjdp|Wno;f|9+%V5xA6@!&&FzV ztvvsf1~tOw8xaKjE&&%wer*nkOkDIGlkXugH3*Ieb#wGbJhb%YRzbmW=SnB%tJudw zVYyZ`o5hM4+ht=^oEKMuS<=;^bEh!9%UuBD&*mW3xi^|Vec@PUXr7e6iHB73SxNrN z&NHYKvib>(VR zc8m;MU?{#b9?f8YwL+5YLhzW`wiw7{sG~A?SzBAXJ&)kq z?%>$-sht8K-ivew!DF;z69dWy%4E~%8zNlZ$5MG)Yxo|kt3=|7Y~hnoDE(hTF`aH5 zRIN?Hi?Mk!SY#NLYx5L&{E#s~-$V>x&OOD29)pi$IP00ZSU;t!??99G*EhM3@zx|* z>R0+}Y;`=X_YD0m#cR;R%tjEWzD#WHRqBo_6sR|Rohk&8$sJUF{5y!yPqB*i_T0hW zBgB#j&O;X}N~|+}!W^Jf+Y2q}F&ho$C+lzYpTDT|Cs?&I?o+GKp2VPQYB`vqYpbHL z7TO&0su~?8_C(-Gp6*Dkc0RC?1sjh!sun6yo5Xp-D^vZRCuy5*=P^^bIXKfe>q!KV z4WpjI8WC~zTq(GRo_|<-r}#*)ALd+EUXLC^!gwk>0J5lgcsZdUvt#IM^c*&h*Ta%kgjxaNM#~P2otpTM6{tYK&{c{3?Ds}&X zQNVvj41P$Wpx?;iXsfQI*lG(Al1!}A=3xBfV+(t_zUW`k^xp@BXh^ncrHp7SY101} zEw@uypF!Ri?%UA6p)h}vSGx?QI54{pSSQCs{;XZdzVm z-e>IH<49mmS7Oh8dUJ5vqO5q`e2yl-&$M?KbdfFa6J0t{FovP5U07o8?L-lT8KyV8~V+cgZXCd!wG-Ac~i2&gHl# zB2LurvD=G&_!^8#7H2VIBbF_OEd6BAD;*;~p9okX47%3nK9<*KLuUMdTe$^6h^bbV*-}pXk%kRc} z5Q$~^H$R~WG;#a_9C{R&%e#g)fG80!U*FMLsy5y!vZq?-g{nL?a)pt{;JB|O0+IAl z4^nXqfQN_C2vl&}X#p`b8WpJxn0GV3GbG7zVgei*at382!+{uit)Q7?H>dm|o0pX! z%o%+(&LyBqD{DQRs}xINXrdcOLhbARe8p zLZcNj0j&DI4Q^0{d3f3<$6jjca{emE=(fTm`?#n#AvBg7Qw5V>ojSKxqII9(8>J;r z@fONAFO#dhN*@w%c)@mLm|ys3eHHU`YH<>J)lM>~W!JX7Pk$i?DMJNTSwRC$g#I{4Jk}0i{zq@u#^smx8kU^?a5Zo{J7()53L;YeJbuBg-xMD5w6JuNp)Y;4v55K zOE?a22Gt&*ejxu+^;c{^vlqPKTyL8X{rL+X>|_-wZqahF!;tc1gyCeS1o{Fs&YMxM5U;`yf4Vaoxs>|%bbbE zF}E`j$F9jvW%2T-1*A-R3qub9HTN8+kwWnLtGsV#Z)m>HR_KcZdL}*0X?d=5)hd@> zyL9qdLW~S5z)V0Cz?hZq5tTx97^61eL)gKR!RPiUfUVZjmRv|65oJr}v?%phsEvIr zPM|2q&IT9|WIh;O|&V=WyyfMqu$M%{%T=2VFk$6jrd@9L_P6dj;UUScNZP@rZm8AU{GpQkUG4 z*fMu$o=-)l5hec_SWLl(J{e*ig4w%)X*zZoIh_k142`1sWyU>eCXv zOS7$=Iu8hOfSONmqAIuV*KGN&v7CWK1Vg~~veM;@$)F?X7bL)7i5lCVVww4{@M&?& zvT3wrp)RMvz6F4a0ujDtpNV9Oy?A*-y~f_4kg~&sfjGF?y$Yq(sGU%=>uem3=2-t` zFZZbby+<^bn1~jFw%jiKOKqecmK7XY69SGm8SH>A)c}y^n#UE_Z-15Ux_8VG-+*bf zNxvE4W$9$sVUOj5d9q@gEPEjg#^sEWO6BgIFHW8h(!Tw1aDx~rUX773U;Z(&gb3&3 zuD>l3Kwx!n!R1(JBV(-=N}BwLgAJ|my~_-^_}(7RQ^Pa zh`D~D-c+5;Z!2y|pPj9t6Fi)L__98HsaI*Vv?bd4QvN zqSx|<{RRvB<~*WzYO&I&=^fsp4p4m4ZVkmJa57UQ*SmYaztb`vNuvDS&oNh~9snlz zANTEchIXSrlUnUh?RRP{P3?(|2f5ise3pl>sQg)odFi!Ta{TfpEXLsie1v_$+^Fqc zIq94I%!7+MZ61C`pkm9V1+!n-K=n3#S#f&hxhy- zRnICx62jyC<~hY|sRESqv6a^&OtJN`B(br z6YS8f&lAT5ka0R9!CzFo9IrGn7)d049A1?`I2d#&d{=9Ox-qSO$?-qfXufr#t2qNb z3k!imDQhCi1^aoujr6V)*%SAv=;oXoMWp$PO^xp!4f2PR>*Oj;M%Gow0C}$h;ZYXl zTUShr1ShN3GYw*fwMlrG<2VKaFEfKJ<@=!y87(gs#=BFT0p3dE z0YiN+0k~W7Wa`4pP?EJN$d6&Dl49NHi{7VE6^rmic73`a1M!ngFXjZ13_Tt);Sj^^ z0I+&56`VgQB&WS$e9CkYX3j4mY3j+Vpyl(K%%^bucW<-S_XS^823fIjE-qA4000*+ zB#di6a5hJSp$dP!tD~n@uEV2j>UB{)knphCas8NW^B$|{Ii#V1u@@nByb2P8Np2zm zAei#*&hM{L0xjpOr|Yk~;y=*$lpl8zzG8CxTmZo?Q*1LJ;%Fd*m(XJ!tS_9sV&nJa zm2Mstq_DI{IP+WaY&Z|gF8HM6dk8XYv?vI>+ChUxi7tfADJTKPX?>(~yC0BDhP$wQ zl0{^N%>lydz#j70Nl1uKLc4OlJzxY5&b5LM<2aDiy{_mX)^6rlNAB%X`<#Vvw%*G) zW8&dF&F(LP$>NeE4pst0dC2`C!Ej>5zu+l%id*WG?LsYF24q9-di;g!-lD&$6ZoF*KnsYuytt+^py-?<}5#hbU(g(ZSyS>&R3b{ zxaF+b!@En6(eE}7NHL_RUquKg*O!tu5QaaTHcU0SQ=plhH=1qj^UGPq0%tezBY-^l^AUT3BM|x0HYxu%lHspP!TmvyCI32)WK5i4kx=SQDH~ zR{-&zY>gY<-gE%KKc8r{68(wk$C?)ZG+#>qWdA>ff{U%o#kVFuu?|xwk&CDGJ2_t9 zF+R4MPs`Zvj1mPX+tmnu2)#L8_6ChM*c}Zq`QEBDtLgpj=?Vqof=b{eu>zLRm7lHT zhg!AyoaCXsIi#`IsR%4+KX;$|>)O7ekNXWc$NYfpCJ=nBi}X67J-TMO{To-B)xm33 zf4p+20p2KRTtA$)m$Sq!z?V(KM+gVtU|c!lRqwkj6*N7}F5PQgjmVq&8=CXrVcLPU zDLvK_?v=1WGj`6Ae(jbkt;I#p>q(9FSA|d1WshE3^rLEoBHx>S&}y3vhhjy{8&dV8 zmvr6zNA+MMLO8qR^4gqNAF?B0P+M2}l~Gy=L5TnrEB-oT=`+Yzft;_Vn`X16s?1e5; z>uI|+s9kR>ut5!<16^#a2jTB9t6i$yWL*4qZ8X^a8wEm^!}8gvwqAh+S`ob@TLsq*<9bz8@QZ~61W>2QrfVpc9Ls5gpp@5 zn_cZwn0EOV6X}dnthAudcNpKYk-md$^JZ0gwH`6AemkE~*Gls6vG~moT>tv6x!SVw zY9V_>(j@-dSBF)^gV-}PCVEIrCc}ih`w2W|gKdFVjaRM5b1JEpdDpmBiF4l0&IAj9 zqg-84E9cvAA7AWCoS~>;VnX0a97?L$l8BHlR&{)M7)ak}_ezDR8Cdd6=CiS$YjB9P zix<`Gzrw*ishZhZ4-?iE1kK(o-5=#k+fuxkbYr$baj1a)lZE~@@Hb`wEsdcD4;T|f zA<1Rl%sHSZ@sYawOl&mOmOK`gY8EuV!#|HyDwYG=WE^1t8Gd|kbERfVDqfa;5_3RWrM!kl@&+?$ZVbR_U^XLSM}-YL`yA_V8aIUvanqtt6gU^916 z9u}ze$&JY?O%@~+N=Sh5HWB%t!>(`0_eyljAqiB5 z+dpU*g_@jB=%&rV%qm{Ns1z(`H@bjq1q^Zu+nr$GGmiq$yj@g-t+kmMq|8)$*_?Xf zYwLvlwhhF1j}YC!w_5NHKAK&1Wo^KkudXCX?% zMAKp(Z%2&}ZAp#hHdVO@Mz`N8QeK%?4lG8vgpNkMR+WM@k8OHDu`{q)ZX^Sg1elHl zvM|y_uh;1@96I+QOCgPa_HBN>TP&6aB!}@;hDq%Z#S6-)Qc5_Mxa%pa+Fp>=yYn-AWt&<3pq=|p2F`dt^e5L|iQWV;qKWizF@J(8lo zz7E=Y%^V;}zxb%91#3ZP0!bsNMnO!TZl#eH-{)}&XI+<|KZrMa?b(tu7m7@PfF4`B zUQ&G2MW{9;4*=vxCCMdQ;Hh=fqQ&Y2&XmTcNW78*(~PQCtWdExK>cN+X4ptGIv-je zGt0(wuD*V3ryF0FTROja+*-ZgSq-%MAcYrq3cuARvahXwgT6ncj0<>j(t2{5A~$U4 z{SNsDp8xOSif|XM*&G|`azQs7xHCVJ+V_}Erm1ZzhNp!%j~1R7+B51E@RNm5S{q0; z!KgsR95h6C<0%S%6mOAW|F&Y3x`34!MYp+>ANdXYiw_hLByJD!mzs>NQCv*m5(A)< zNqi@UlGouK{S~*2`1S4H<)_swE_qtUzc<}4wt)@z;d8eG>pa+lZA^{=Ai*l*LFdQ# zZ&a4RQ_87}bBTX;;#6+3?d7UOGuv#(N#iQ^>(X1{Fhps8nb1H49XUZ>EXk+l@4~+m zNcf)#Qaduh61HttOM&9$fc#eV=1%5=XO0B=d&j4-bef=5hHOdG9o&h#!0l@yFEU#8 z_okL2^_S>$3S#l~$e$e&XPy2HJNyAL)`|I8H`^f71I8vAkUy5fXKEQ9|B*I~#01wY z<%q?!(5Lbb?9e~id-dV~zRNC9f%y+u-M#07FMAWi5n5>0D zdiwU<>V(f$toCG zDLYmnCsY!k?~y8Ge>-Uk~UR8fG zpHFLnvyME^g;FV1r;$u7iHe-ai$$f78OR?;Rf0ldJroLGWJ4VVf>y>!lnD}6A3`{j01X{5y1UMNW>3Hbo!t9HLxyn|8*e` zGK5k|A7f}iC>M!9uO8Io^wa6Cf%?(D^+e0$<-g*?Y6%J~@*po|VXgHF)!q4K3;^w= zAQJG|DX4obsgQ@^&}%bnw%3f7CahX7iY`7pYx>FQ92K_*S6_;U82&=krgg*j~3P3hIH7D~;do8>&oO}_M zqgs(gAPG^kUIm5jWdSZuBpXs0ES`fW6}*Lwk^kTu_e*rOH(aAq^g~aM#D}~rhRY+~ z+NA%&jRbjoNySmb*E*pM_a;8Xd~%d%ybQeO8ASZo(ubmekp6}IXx*%sI}!&FX9-_M zlQ#O+lgF4FykC58fv*wxV4dwz9a@0?6-ymIC|;c}pCh%05<_YSAl%N;nlrN|0%UIx z@e{}-pA}V?BC};m%wtqVx#@%nYLPkZNr8r2vr>sdhuUI^X3cRpJHm{X+GR&hmB5qi z6ELIbdZ@-Ya&10SOr1CVwBGiiXvHP9n9v2*a<+V~{;R>4^#A7i*CFugZQGZhp2~aLeC9+SOJoz}#PIv2}&)QRwXh zV3#cO^YJlT2pM=U3fhcrrdw*q#-5C_8{a2VYR^7et+WoQna`m^RTWGc4>;pB4!q}k zwse`LuX~BW^t4?H5Z2L0NIR4Y!FW&$L8s4uFiLDhK5@^%ycWo#=gBeHA()0ve%qn? zD!>P;FCxQbtNty-h(79HTN>|2NSDzb2e`jBy45SVX0cz$9$-&^dKphqxVwLCYQeBE&Fa*dZ5AVB(3{TVF2ht1y5IiHH^ky-q19rXzS!z13UCeSLNSIv z4$`W%=;5Qed^1a=6-R0C*b1S(&&b!{mrCZ=%Lb^_nkn8(A__TTL^lMBssYMGX5){N z57Jyu2*Lz$VORTLHi=%ppa?PA8mFRMup^C1DQkkYTx*V4#$o&?k;rt?nX;9SrL{u| zWii!eijp0Wt~yjEBR=t3`gljfK(9JEpta{4@{$L^^%!P@?O6;OgLe1hXf#i#IJ&*W zhY;8=mT>z?T;9cmR417j>y7?phvN+($WAUpP%kL(mR;|Cx>Qil5 z63r~icDG%WYyVlxtO$I&SU*D?xJ)liekOfzZGQ~7;kG!nkbXNM>k4`zf;kdL%c zg+YMoykaZX0kg>Xie*1&?O^?Y9FMse;|2g4Wo~huY{Ox!g$Tf@2ei`#p0OBvPlNHe z5~yrm^qNNOHu45Tlr4VCq=zxp==ypDE)CCJWXq0~qO1(C=}E%{9ANCj-~z67`ieanRj*Pg*vzVj-D>u6<8q{2gWOh65;FBnflB7v4Xo+hD3|Lvcl`xP8i z$SZDn+=n};LTvQ^nrQQVpW-80e=ANZrN(*+57Xd&lTkdQre}*ROb!a$ERiRh0yYgD zGlXJ*iKnT*s2m-RZr!57NqTi#FXzQ4OrR2hLs477TZQ7q4*_E&!p*P(MQFSAn};lq z2`*U?${kC?$-njaHt1_cdt=2rtwsXQTR``Vd5cmk7okB2=-E%nJhuv~t zFj{ptbIgMc`m~y8+OrU`Y>CRVKR>KBa@lm~k3goWV0(jBXuJBlf?7jF$1p-bjUn%`J~1g>1%!Kg z!?x>VgZt3_$TWO^iN6|~`q%OAJ~lha>K?7ga;oyd^1R%z;`G=XwW@| z1andD%FC@JVnM29%h&K-5>)>`GW6t_0l zi&{5l2Uc9sl|7NH{i6lv>HX06eTa1EnHDjm)N^k%ZtWI%z3j{u8VlTZ_|ho-;Web} zE4XuuEKq8eR`}X6Bgdyl%B7E@_*O_EYInKZkBJ8r1XJ#>%u`16&f`F{vc$aJtsHvc zEdeD)V`+?$cl|S-6WOI|)rMri4k$za(y{xj;r+;1AE|uf;vQ)PDia-p(6v}iF|?xD zS|DwQOTUGHrGOvYP7Ww8T~ekDA`d_CbVQ9gI4a^IVLY1(q(1pTUeA((A;xi5kJj+wH6*)gm*Wst^J_7&XIz1x4VUws-19dyT2Hgccca!1Kl@~Q>lr`u z4QPEL?n8<8^pw6>_cq`Fjc*2%tgRnHj-KQ5J2$YjE&cZ z76x5c{}P_Jk~b_o4?Hzp0*Jg9YD$>CVW5^q0aSN%*(PGhn#Y??bWsAc2tDtsO_yrn zfsu0|boS|wfnKy_S}z!t?#8UOdUXPC?oSlon!IS0+hW04M@W3zpKnOlT1w+_h5&@> zU|{inoC?|ZSs4ZO5&gZZ$ABvun5g@!!-w{}-~#T4YcO8VK7&g$Sc zA+3JJAg&^fF5Yu*(T+-NhQeXX`=_>|DeTi@rDGMU7M}-Ra>4<-hwV#i*{3|J-4(`X zz0Mhi%qoh@U%@5NcPq^FmdM`8ql|oE65=XzxD!61H3wk^2^o2Yq6|8%LMm=Poiofj zqTDLa^lPn^zZ|itrU(QJ-S0^L6>Kv3`JwV;eb6DKliU~UE5=(rLqEE2+#b-V6bl17 z2m=cPk99&x;W>i&P=aETcon1XW9xXkF4}KS#jvr2nMJx5Zm>re-TZhkURN9)N>~=ix9HMG3#pr_b7sFHNjEsz8<65Hyw!W%cU7eJgGHrm?i=Uk_Th$u zqS4ZpAujIE$dcmOtjGXfbOOov%i4M6*Y+2WTRYUSKL~1aJACn@)u<|sEUVi z;G3X@%ne+b45yUEpjM=M8lpVS7MA3z3gCXS*MvI&+95qrD-Y^;s2a=%WYwHiHC1~Y zePQ>RC}a&saRpUfX&CU91B;8l8kJEU>*aq^P|KGA#HIVSY23?;F1UE@s2t;Dg`T+S z{H?PRJN?9Cig2|oy*&^C!3DP#fy~Qbgjlm%KJmL=Jsr4sq=RENglV~+;I&rTtIHH z@$^JZ%OX)UlDswk$gWxOz)$|ch7V38YgXpl`s106ZmfAFC6s?V2KlN`TUOgC5pS8h zViBPXW=GjKT1zSevo&Ou7b|tvp11dU&)tz#OO<=By8#9dAR2CVcYod%E5M%yDV+Ar z9G%O|vFCoy$%gZ2;Sjp#79~v?>kwWGy$1B0hP~kpDG^cSCvub1C4uAA+yE`-yCmAn zJr$wchbtp=>>LjQs9A~7s$=!unMsqrGeThg{kuQvv&WpGTDIN~lbhuy!z06Q3p4fd zTGMYreQ3!Y8iW&c4oAnnI)rW`Fn;w1TsJP26Ra7uZw(f^%?9aKnoNlv=YO`Lc&HI> z#zfG*xP3YKwmUv-qd)sKl5Rxp7f71^-ja;nW0$a!G%V8V^-EC817e{!iAaoG54y=n zzw{lT|4d3fLaH|^eO2>VMa(! zl~rFqQ9GYX%NO4KI+VowNjuI_GL7O9jdFi{Qx<>KHArfiJo;=VcwUUIAVj72v@lWM z2Z(3& z=S#;sx8RpP@R+jRL>Kxr$P_4bYZDM(d9TKB2w=TR}|qgMEBC#+@7#K z@X9G?Gm51n@wv>J5lb~&a_9GFKpz`|ZuTFz&K1I@d&3W~>28dN)5`FxmC97awT3*> z4h#YLm*2@FArx_j53CIG*wizA7schN-^}W&vz}9%(E%G18;7)tpI!exFU|SRkmP&M zvhSJ!)Ew2`?>R*7>f|zhb@i;gV1^toHF|)POh!{ai(p+;*xW=!=C(Xp66V@?2P$MR ze*7*X=#m>2_FWgDZPfdlrdd{&-uUdUHW@EUZ-{@ZB)&m!#7=)K8+97Vlf&`X0Z7~Z zS`*52I+%&r1sl^XWjWa9H;bJ)?gCCAq!dG|#kI6iwlJEi_A3T61E+5juZM{gbKk9EXmBk7cIoRl*bxH* z9Jiun+`d&o>o>}Iq`^&Tj)}2$wqd+Z$y=R*D^q3;r^ioRAIc_{K~=UrId0Pu->wD1 zHa6*LUCvlDLKf8tVp$0^%Jz;+czNsMck@GMaK~b#=Eb~be&wwY*yb`;upWA$jMvNf z-PaT&2GL!sA+6hob>q}RNnH|IICnz9DJi6F7!C{xs-vP1&b7osQ#*A{?UXnliXSK8 zuql8~e~`rUCvt-nwy+1mLELXzP8sJyIBhaC%~6BU#M0;Snw*YEIxb#?LqG(K-QJg#ab^d;FnqA>!$d&<$=83=;O%TEhlE|Has7E|T5^1B-b%gv6GS_ZW0 z4tg}QJfThVgx>!ub_gNi9!b<^CkuGKPDZ3Rowm=+6gLegGmSfIvQ=5FbcHydP2?-) zkuOaq@#R01ZG)?v`N%9k(5uNUok*v#K#L+C=e&s}qJ9S(v~sI52>%w&;jtU;EyBfN zRd;J$N5{U`+Ivr+ zEiab0M%)foz%3hNGS;d8bmu>aTNR?C;LpDmVg%SrcG`ipWO~;GR6w*7<-!EO)8uFX zh?>wxUwhCsX{&7oaVG7rPvFhtmjucH8PABZfwRN&wcjs@obNgV&ZC8AS+lbk%fDx@@5s|iqF2&N zezIS{wF-so(P@`J)~ug_tPlQA@|dN^R?S4Dg#eau-SeWwOathL!tUoET2ke&J{Yq6`{ z(^SD?{Ay1^lt+5GMuib051)rrgmb^ja6(^QPw>OWK~RA5QcT>;mBT35MWgn(n!9+; z4M5eEAMW52CL#k~p;0Hv9_`$QCGQD{{)DNChwd1jgI8*6+`6o>2vm#Gocn^`Ji0>< z-E+=d6UZ{W$19OYJ*phHwWVcGx2;yA@UPXhxt}d|+Ut&`|z&G;pqXmizy#}s%B*W|1XMxAEt%02@KL8u&>~i{}c-FKM zMjo$osGWYvY`G4|-XJf{#4g08Mo*l*$=sa!)4jNxH!EDZ(y1bzsux{Gh+EP0TI$nR zz@+saKDk=YOAR+TxoT&(>gMCA{*;EN0?&$-q+$bryJ+G)1)8ok}BKPKUXc9iC8F+VA z00IJ#w^!GgHG4dU?w+HYjPOCRJ?Z!kB-RdGRM)Lt5PL@YT8f>No)+FDXP2%0wNY;qKw0pvX;i1# z1^R(<9H#G=ft`#q9hhqyXFUT1 z;usINv$fm9#NYQg8gwR6z|HlgI1OVW!MM~K5XMctcdOoLMoDv{N^e+tmUVY3s~JD|RcM?GcBUZyZUAa*cLW~l zo#{Kvj)AY{X&iP_$MZFX(L*l8WJ>lNFzC2Cu`c~PF$Rwnp@8Hg%z@O<0WE|PB(L+b zt-+Y5{ULvCGnH(QtmJ4GT0oS0V50KW&yX~p1wo7QjNb4V)TSOBJ$Sc^&EhK>&h2ZoDC5qf;W)gPs|VEd(H7KvVn&RE zK%goh4Mqs=1?F6Y-m^2u7`ZD{it&lwh(yM}%F(F3xEanFN}P61R9)-b_wv&MFfvX_ z@tjh{ux1)+ID*LJx+=n+6^FSh*TT(!d%HQe!&TqU`)k%Qq%YrO?w`Fk(g}9SBop5K zAHKdiAgXTNTWLf zm4wfDyNF}U;#&x5?Mg?0M-@&NX6}&Te$MHIa5D{0C zKJmhb%*$L`J^Dm51))>k_pn}WlYwW~MS9OMVbDnge?%wyHOr*be#-sYa_W%s&i3>3 zhub&gmF@#z%jlycx^ z5$0uI!bTU9<;v?l!`zU3fAY^{l$b|CD7_0u0}dC*v-HUQM3|R^AL}I(f)wA@I$&ZS z`eKc}Vg2w9Pm&tSbeQ%rN{TGI83ic2w~@Fl(tb#W|86I)VIctm^l4xwJX(wc5^jf3 zTg_bUi+Kj>Z(SC2OjXr$l{`Exn*j`{o2tCRVx3hM+mfdj zUS58OTLq}kb{cQ>Qx(3smWDl{pks4mp$Qtmlvhsv#Qyagsd>rKWGPoT&biWIT6$U( zbN-Sfpw3=l-9u=-0MH4SfkAo(-~U3F35e z9F(+gG^=bWXKdzj zN)C8y>Ub`!VR!8Jt|2o zU38^Cjh7=%XTgjZU=onEbOY}VeSU-uDH?9Eo)}gOXOwnC*mEUmWUx}GUD(`wvx7UU ziBS$C4R<_#!?k^@8!}3V0ve7Nw`8ufTUE{^Sbos3i5L2-<134)(dvi;j3}bI5U3xrMwSq>@~H4QI|vzTV=oKjTtf6_ZM(Fa zqL$4#qK=(5T0tYC!Fl)>J(^7oVa*=7hN&r?de)h|^!?_?t6x8J`@qyFQ{(`6K9cU8 z#N%j_{A!{0qgISggX4bJjryvlyVYVVmgCkyxmZnWiw}EM#eI#H`HN-6a3cmX(VK7~ zx-52wjc$#KPpr61NyS$q>2-e1EC|_FiE`3GidU5Uh$wPPts?QI``)9KI*!bjMRd|R zc}+snTtQ&;Si;@pjl^NJ;5+cOht+NLCH1TGhIMxzU0#>(h_%7KTCy5IeBrginUTqWIY#3ba-#e_cLw%j1=nm~p&o0u0l&b|K0isWG?ThwHWKjzB^SkA*}Z7+I}u z0rBT3Tj!|7{xfMx8K%uf0hFbXi~_>qGhSqgUYDQnD_q{)?xo6!8H6m_xQ**G{V(Jx zt(dBGw`{W%an-795*V-p759L`tOl}uzrQeQlI9ko@Nk&ZbCJ@;;fJ^W)T*4g+1iYcpY#I}R+X;`&O+*9) zAC=h|1W~g0wXQ?1f6gx|L|*?mlA-ySWSi@@nEJ*$wAQc-cM<24{5MOEce5si)z&=c z1?q)h92L;x(KWN8M6q&tR)T=KpbfNt!jezm728!EV3fk7C!!v;#6NxQB{I9Uut7aE zd_=eB{{xrHzu5J3gW8zyXRwY3iX|0hkr%4txr&Qaq%sJy=qp_6M0USSDt1k#1J$Dw zrIEMk9iF!YO(i*Kt-$D6CO-}9*ME>Xh!xKcE$_8yZttTg=Duv{d+;zB&3ia)Gch<8T14GoiCK}SXJ)|jFvEH zBE~vu5BaKDjr*+NU*JvGr+cNmBnKk3Ib|K=VC-o!(MGuFKX|^ClO&5Q5lX4mL z5SpcC5afskz<~uc37Z>HzxctH0OMrx<5-oc0I6{R)j%~EhrW38OMCHcZhaeJSd!L( zD~Za}z4>IkMT&VeKk(fLTT&izju^It!6-bHRym;$kWjOo*3{7jqW3yxL!>vrIVF z>6U0PTP`{eAebe1K8~ZfUc|7+XWLe5!yRd12?v_EuBi^WFQ*fFl8vf@RDXy^Svn7K zlv?rP{ye;5UL=gO@EYPtJwmaWpJ|4H)mLQvUU(t)K)+C95mFLg->qdh1gIw&dB;!B zY3YJenShKz-eb3$(DMi0&nsfY3Gm5jmvYG^M#hzr`kyV3RzVoOV3Z$NJ<*$;r?d4H z+l%pGo5B>>)FbB#mD}!jsa)?(TH2Hv%pE_W)H-jxC5My^%&bfoJ(yf(1S~GlLwbk$ ze(HwI3w&!ET3&i-oBZD7u=h6Foif(_xz1(m1i4qBPRaY6)-#6RSMj(VlmazM<-+LxAKB@4lu1 zU00rz=Rv)wWw0ghqIKi%oO54ntAc(;8&3*EC{xi^Th8lf9-g-XQiO%{ z5JB(VBV94aaIt}bE5gm|Ygptpqk+TA5$1mES(CqaSm)_Q>vrc+rmAmI!3K;Y?uOwL5wx7P z?`8&i8pVO)O&N;HX+~Vji6~bwS>eNE)nt$!%j(Iav+|O=m9Xujt`?6i zDT)=Btpc&&i>Hq5Iz7-^he;K89Qqs)m%aRNWTXyCRR+?vC)9%prHdyh4flB;lQDU! z%+)u(mu`wh;mS5#E-XA*EFLQUrHp4(nmaf5oVVDd`YUxx#V_d!F zlfJ26>|c_)Cjo#r<+moj<#LnWxl=5~l1~`aB@RoXU}CE49cePusJj;vBJru5WL(*y zh}6$nyBn=mD~tEzbfXYs{rXukE=3Xo=x0{m5yH}Kx?IpDwG!6YhuxpRwo(U~)5xu4(!&;;5PYcSjO($Gq>;~Y8(E6{|H=l)jUYM#t zT4G$2tk(>-0M;$XJVnG`X-GDf`{RPr5*T;!$4z$ zNPW;KEk%+6Vne_sjZqb%P6f9PXiyfQoX1(1Fhm}G@0-A4~2u+uaY>fV^Vbo96nsDAx}YHhvc5;06m(@gUiG6|(#bZr~5_j(ndCzg;#P z^{{0wFL#Hrk5?GleB0~H7)2xDMR?&F8W3!~TCPeRYdV$zGFx`ppOZ7~+KysKWP1E! zF|AE)@mUl`ZA=fO`jxd7ZmG#lNRF5fsg^$VtpnR5KJUx-Tl+)v>eq)W5^CmQbcz~? z_MPaXV9)bgob0zf54)r4NT~bM??bO_JaA4i8x2>MlBFw})}62b?4=5UUUuxa2l;7B zKOCz|XtiP4P)2o1n)E`aduM!F%CX~zgBlj-cSrRVG+pJDjj+)UIubk-f8aAdx2a)W zmU93+V6kcCh^b*xkGuduPAKsrd*U*lp5f@x?wmcvv-ii37@&qWXOjVSN?*ozbfk!3 z#)}ydzbd<$?&qFbcx@-^<(x-57q#|(*KdVz#L`#kpktkUN#nlX6INqH9*T zcNv19=g9TxnnEDkHhpRP7svJ7a>VA} z%_EqHItg6n!7Q=j#9X#rM`@YLb17r9*W^9ya@MN&Rs0Crj9`~6($FKP=n)%0?Mdb| zy1YnG^dN%i_H1Ver^p^x>#p1-vv98O6z%B%{7}-7e)U-8_E}^G#CWkyGt|U5Ac|-F zbl@;_3iKbK?_i``@%$ftu1PVFpR~OCjK_lJxO36%4;!jjpx}dX-7C&sV7>u^(DCTpKR z;F#d!@ULf)QW z?smM=SE^k%00Xfz8A^cnINL(X6^FV#>;))8!=xfUQvkXg-qlt=>3=lF`TX&PtW&Jz zfKS6M^y|M%nF4Eo*)PjASNOAjb84V!uGR&Q^vgjXQ8*>#UqhQeUV|a~8c=Dpr^Zv} z;!;;BR%7jCyru9=o6LL##YO72w%0^uH^>NesK4c0IpMJ3B8hOQ0KbL{5)Q(&e=}{D z;cBmh-W;C80hCRsz0>u31) zTmQ$q{eIwYm-?*XG+cAF4)ntG;y?cV{C{q$UATS1|K(lI{T&<-q#hpv2QmKafc;+= z+iC?PH{OaywgPCZbnfoRQpu#e+#XEe3~Y6te*r~=W_wN-0YBEVc|njkB}xwmJXOAIVb{m2*|JS??q^%bfZA7BapGu4PfyR>Y6V92+NKj05S#1h zt{!HZSO6ZbsdY9>Bndm_<-yF1`qSk#;0I&y7!a)S){axDp{aPYsVP4wHI-+LajbjVFetyrUGq+p2B%?Pba~Y64u}qexYn&w01Y9EFCW(RS>x7dVADtAcgx@m` zKlfXAqqGaM((GY8lV9?0XWHM_{1-Ito*V9sQKn1f5Gh>VkEza{p^5Jf48%eXgBf{d zE@~w@r89`Ad-*GuE>+T5C5*bYI){gIS*4icfLwFdlCjn7eQ-BFYOz|m>Rlp}e%RKL z#YC+rt;z6Ll4S6XSjt6mg~hp=@iB1B`z5*|*9d@mOQ=j-dxjEOrXLZaQpr`d&><^T z=S_||aDJ{aM`XR}2x6(0yJ_=!94q0NIY5x{-%X*ub=!%03{@q>0iI^8*MXO3i1u2AL30ounwy=+|;M9)r-n3 zCO7N^CjAK@YdUlJ^{Yf?eMQv>Pmg2{I<1@vEg`u8;zXe7j`Y$y7_h_rE?bQIY3@5I z%!mGi>Au%&2=MS(K3%;hASlviUzCVdQI)~EQOW8_qUF=hB~i2cdQ7I(jD*6tcFu=n z5zS2xJf;9c(Wmy$hEH99rpC$cNvy%_7T{k@;aW0RbjZR{l&u=EWAEsyrsl&R4eWtJ zkng=6J}#41_(xJwpq+y!7Db2yxWVOkuHZgQL^!+DHZJEC8A}fPY-nlp4 zTDsu81K|PG_a&$=-9H>vGX8i_$;ITK%$K~awqP||g2TMy{NY-vAF0cz_jZ=CQo{fK z=EFToKwvhdD`Y8`5x!i%&A+x(+h}0YbWps(^gQq6q~8G2{>5e+#)t?jCwN zzF8-zQR@v4%w$bV7Rue^-M#SMCom>EthJLbHG;Gce=bLXyuHT(G1jU|LZYF7|Gw+p zSV1!;3>h7l25kgp+#Aq`C0Rw$zhoba;r` zDuMAfFJ^^3M?Swco!cWEZV=JZV`Sm-jcP3g0NE@lIpI#ouyAm7xKS?ft)Z0Q3l%TjcH{2{f~(Qm8|^SXUxGK@nVX$hp|d zT&Z1m>{k_0<(Mwu2$HE8(3xkD`=FL>F%Ve2Ke^2s)Xx@!7V zp)xsOE@FAJyRUk>wXVBqb%Pn$RI*@kYCe7}+WupsVBL4)g(=1rvr=~nf;NLAa%D$y zFrOS%=S-M2YXA1WYT(+h{r#euuG=o$$b;Fk&V;s^4t6WGk4fC{0EGpmI2rQa!zOeT zi96PUjDo^af1?|DB1@OS9gm}XpepnyuVW0V4^hdInfVBmc64=&_U^g^P__QkR*!?7dX&^6r>;iSu) z|NPm$ZiYiZB@FR-Xbi1Op2C9xP}#Jycg}?@o)>#-P{-gGJIW&ZQw55h@P;>`8ZN~7 zW7R5e)YZa3038J^0~t!1fE`L?Rtn>sDbX&6>&9pOk!=#TfiK{QzY)8gX5rxA&`}>2 zcMAE%PK_X!!7WGKv&LIxE+=|WOY+uZ@ZEG!>B}b9qfZM<)(wEA5Vt3Uo7Wjq^fkg> zN01B?<8rdV5R{f%???2s5E&RRmhIEhc+0%$wYt)BlBDA?Te|3H+$Z-&rVkL({Nb1z z-piZCq|@d@0@yuu6swnGaM==5+XC}rnra%bJd!utbKF~Cm7=Z=wS(pn`!;ndjY@Tm z^pn!1;QuGd`NwW}{SgKY2XXYLYs|5~U*F7TSMYq7x|)C0IpBIt#ONv>jy+)Q48Zr^ z-=XQgA^4yhNi2x%BcHiY?dK(o3wnHf{E#w*%4*d8_Mp#^nu#k;{keyxCYRxK1gZ$XnuJqzYb{wtP%p6yar=-NHTnKjuI)`6RdzLQ+)6F)uF&y zxptRq8aIi}B4?c!DFF4Sv|4mFoWUDveT(s*_aGSSr*Q?M;I_Du#e5w)CSM1+BQ*bQ zT(sQ_fWbARzg>s!?CGWmz09jHYBWf4Jg~Jm+8L6no z`A(x!Q2Q|%Eu@r^@)bOGoL}Y}Jvh?ROT1?0t?{4p)gI0j@*_w_L9vKy51aO49j*id5_bl-@ls^L?>9%8`UZ@O%a28yJs)nXVwgz031H-)Uzo0joS$4S zwaTn5PGo);GD6JHWq;ZqKf=N(@xOOXj=`h`V<6Bjt#?zV6@-=s1+E~>V;|Wn)%$&# z_z@dy4>SEZ^~(vn?L5fytRJ@)aNP>_6@F%ZHZxj+0c#^P};w!Or?MC%1-XXRcJbw9W1+JRmtI%Gj8>`^xyf zsUt;w3h1)68}@=tMsu29z)BH&W0^qHH^hu+LoYlZH{gGWMZX*^ZhvrOQ=-lP@Ifl8 zw|>vXs3$UbZLJQ_-nMgBFj9UT=?Z4TaXVaqT@7uW8V&2kR<_v{n(5Wd^40_*?eput zVBZ7#5A38*K(J^Z5cOar9)&Ed&c^a6OH?VC68jti5|87W1#(;RL71-z_`R7uFg%@q zef*t@oUmXTu$B*%w>a!iX}YL9V%{0s>u(LmqRLB|Sk33LAH}`egFs%6z8#e>;k3~( z9Vb#1h}lV@BWT%aNKSrN8-S+=ZGU=j6Up1u&>xIdtq(Esndx7WW;RYyzB4n5~;LHUHKSYi6hO)l^2nA0nOjLjLc1W3d>=d3=L!5xuY zeGIgJxJ6av(hXt6f82fb&StXTS}(gVx{pjWq{s#kZS3eiHC8Ek9Mx?yhU{U)KdVN2 zT&N~MCF1I<$nyQJx4clGm(BT5#x2rDL=2d_$(86;VgmqtasSShH+oB{KFY+B!q0ZG zKSw`!xlSHOQR8!XrtwOwQ&1}uC_FFGuTm;K&kWG(5hUET!aTU0fF`o&eg-Vpvvhjs z*H*QxzqIpUZ^W{S{8FM;!Bmo?BII*rB<88d1G=W2r<=42`98+C58IM31}4?E)5IXJ z>vyE`xD+9Nn=xCxM6CTec)&^BstOa@Uy}&H#3yN@$+9xEm^A7?%9>wiJV@`|MFmv_ zpXbF*us@uC%Du0#NX5L(lO>37DaOmTJtU0hY2tr@+h1%ML;T3s==MMxcpVmJ9{)-` zc)ud)_iYZR2tJp=8}03hP_M9iBA+gEE!|HNa--)g(G4F?7T60hNcRly<-4)aI!fc& z%QL`TTKcL`d)DIoa~zF5KT7?s)@HTz_RC-6=GSn4=E-Yb#O#yiNTy09ZrNSHE{1)+<)P zixcoSL1vEC-CGf&bhTa#qF1F)2CP0;C87xffzIgqOjPlpv|VorPk~xZIHvG?deTsW z&7!K%bg?RRmIER%?F~s^j^3F*FSw>W#t>~ESVwf+jKVjWi~x?vReFDbdj9qEuAdf1F$4Pz zP@V_YwR|651T1uvH}o6WsHeR?dQM&j46ifETtPH3l68E6jRuQ*LdaPVRj>snipWrN zFjT$>+FI~B-?6FDd+keFZ8@RAbWQYDEV*_pqe-E(3Vsz(b5$%dVZA+*i?-o&{fRp4 z6x58am=I!ZTaE`1sJ;N;Q2Vp*fbJWmTN$w>vvqKP*~`D+ZGUF~?bi~1!7U-OTAQ<^ z4^va&xO6%E=B+axdGd+44E^E9$PFv4=pHeWTcdXXnPqVS2`P+-2X-&ERqaC)bK^f6PA!~^A< z;^{-ZWBLL|rS*;U$5c*H^K1UbIp=frKxKlJ z%w~446#`w347{JBGFx?X;xwfYS<@#!IpinTXgXpsy|R1zAS8WC75+w~%8cb%(_sd; z2jR`xP9DqFr#CwNCsc*UenKjd&5LeFnzLxz>&@ z0-Vk%TV`6s%f5$D)rRAvMc-#X&4%B#dJmjMV_9II(&vCLdZQm=o_7>YTg5wceCdG2 z2*WhrJ8g@L-5tFo5}X6O5K*r-nYv1}v_uq%5di8n0bYagCm%9NW9d*>@ya`c;~5yW zPb%%zBKI8&bqargXPP9DpI4a;1mu+2#xHeyx>HQAb&2ZD@cbRQ!f7*Pf z1~%>pj${E`U;+VSDLVOL$UHyYfaFJ0KSN2ULQFImlPChr=zS&C-ywVLd&w$f`((|Z zJg}tYk`lbKRmjfj38A{ws(WPF8c2_8MQVwEHV5$ewta?d>vdk>42L3IS`|06AbX0w zH!&{CmrK|*BrnISDOIc@htF&gWp0#J`KFW`PVQpq1|Sn*0r`On>%5us?GbVPM|f7J z8Si(t3kf>@cS^WLZBiF91wipoviw*U7z$&g!$vs3rp{LSw*R}9-%$|Kd6^aFqZr0%`FK{vs_k%UB;Jwi_(aT!xzZ!E znaF!-5A-{xX{v=diqyq>BMHWR*N*WyJJ(>WwS=l2Qf8{m8*EY&=y`to2CS=AQ}HT- zF_hJ=F34RvY1R}>Pbh5q=E{)Vy@enPN}@n>SDvQAYnI#{XW)9^u#{t|?i#5%0;i(( zAi{>v>k39rX)+83{!Bv_)y~rZ_jdFvwa!pN2n+j9P{Ppg?rO@A%@+Ld9cnnTD@CK_36ROm7#22}D2@ZSz?^EWRhGAro4`JO{2fFRk!8NpEs19K*l3BloYNC$m98LTaZxBX*=NZu@j`*SXSZ zTuofJ!dc?5e+dDZGkkD$*-7%hJ$~!8DBV(l%*`Xrc-PrW#Q{X-ab$N-Gd0#jKt$!m z;|6kRckY~7Xx|1p&TeJJEv2eeaDA85_*e(ZIUs00*~?ch_ym9A4g~dosMp z<3_bwC+2NEY7^@D5V$)AZ`Luc1Q;#-9rphSB`2sDAL8G{PEUY8o5_AK&SH31IW#|y z3~=s%w$hA*+(t+F39i-V&pRZmG*1DqRVFO|xkb7CdC7LU;D1`VqD`N8{a*9Cj3lF?7hl=eu5Au zFhSvdoP(oqzp@JqJOvVMpdpUcAt34P#xLjl^emO64RnWlKN(STn^iNrIMDQ8@29;@ zv|UQHUmc_BxU(mM+vlDNFxNx9j;H&bs+nAz_*GRY2gTL{buypZq0$3~<#>C^F<{HL zc`;wrAIn4p2o#!LCZ*)9-v>tkN#WZvy_OK`3{AxXgXe$=#Da$JP58G@t63<7Q{@q? z*&#%AzBVZS{{A1n&A=5#KU+&WaAr-A(iF2r zL37i|t-^ioCCM|B0ma&nbjEIggHzWY>*hqM3~j2>s$I*S5g_%_%X!;5$4aT#W@`hw zY;t#Vb(PqkIdXj)Cr>jSpadAqKs65pdeK7aiD^xkjs`t*w9U`BZ{$o*oE z6&P`t(p>$zv~H14dMAzy`Zbx`lY?v=OAg{C=JkdvU2qi!1~Y3ZRIJhoZ)|7M`tDBF zMLF~&C7s+XaK|#*+)pRC8v=p!p3?K;lf8oj>%pxNN;^9FfM6>fnWwmaHOBnZ)D4A6mtr}{qDnYEWB#b^xG#=p_)f1SBJl@ZYFtP3Ut#_*oZhc7 z(@p1h0gP34CGtvmVrf7$F8pQf!wW8u$Z7&MN}xvVPhe+3BjYJr$l&vRuD3$1@^C>= zRdmzreWP?}HC~^b@^mC{r!YQ5^sPvRGS;~)#cLN(bs%}{0XD0NLn1Ri z#F1l3Cl(iosTiATA-(X77*zFD+mwps1-QEt%2BZgIXNyq^Yk_gZYq7ZRzGov)9aoA z-fSwWk})LZwJh4Lm_oB9*$H*WbA?xx{mJv}v`YCy1!A(=puaJf|G9UN{7gRTr~7u*BP-iXyq(!ywFv)C%y0*G&w5>~+LCfW-0 zPqMJ@jHHKQ(|ygBZ}X?eK!`B+_b;yiXkXMTmxq@`8-4PApgS}JprG%CW!A5hW~w@1 zZUbCxP;m<(bi{2(fP`|9r6LPU6%AlUuXfNUpZ0F?@yztK)|ZO8iuVF=Ukql8<%Mc| z&l7Aksz1?%vhUVGOib;+BNNfBV(mcmwwT5>a5+A zw{MxIHnKCFQl9YkAP$BY@;jhZ`~lba<;yE-da#vi@?>uNOi&aci2^he#!IA(aj;^S za{-O{CIfe~k?>ZKC&l}FXcCVVGXPu4FRB>FPkBvvLGz)~_vta6mo}N7t-!UxX-BLW zcO;fv)DzR5p_rHV0Pyx%?|{|E?$1Pb*z9E`31|G@q4Zxre{Y)S`7totAhXaV?_Xfm zdf!z%(a;O@nmWlC)T0d60qN0!fiIu4EzT1pBFcgGgW=6&uttMr&HnE0{`6W3H)}W! zQ-E&MmBD#JX@N#o+5#TC*~j5DL2)MitT_i1Jf;o+gz#w@#rmNy0Ke&l`Di>cFum@G zOm=FAF#x7~g`8Or9%tR?Oj3aTbW> z_c)6HA;J?-%;*F}xV{j#-GUEynY{Y zjvdzB@jURcea2?-n@g@mOGQG22OfMx6(BzrlBiC8Khu(G`IXs*@B%WeemOt{NZsYu z&ax%P{SR00-;b8RqqtzIALX#<0LV4e6A@U3DLk82T3R{*@y3U-h@0rQ_xZS=0s-|-`8C<&D{~j^L82ynF zZ;MozV-B@vete1*F^rDKQgHY5Eb?SGA5lDp+z!kb<)YJ8-PclpqTr2d^-zM-y8*pqL(VFg3O(u*X|>Czk7|$|~i{iHEVJ zu~zu%rwM`5*k(9Y5?lep8xc(Dla6g*iWYUg*}$w1Rqxk4 z%yfLDq@+DBf5pHdZy4`a6PTbP$Fr#S*6ZsVpa=-WodP=gzcV0E;;De-m9?eE^ghRD zQYQLv>{A%K%^(^Ab~6QJaqfH>CTUBG|Bl81*nbMct=CYM1{U5PuLv?BQtH|M{GiqX zMN|+bf9wGYQ*7(h|S% z-1tnRO;7jYhtqIE>MiGxaew1~Pt12Q>4;zhirRp`4>659I$moSt@mn%; zM|Dn9cHa()!Ko$Luv*WJSK5bdvxiM?BmwHN-Wa?sf8a(n{E-fo0UX)ir|sXl`5$Lc zt1e7V0;ot=zgs?~hfglVu=vCWckc0^v#i}Z3s=q1irY$rtPaH{qpVD-pMLaJ{@W7c zpqk7c5ihtdC{Wu>e_I%H!0n=MEPgk;=)3kBmr1jT4dFbEkjwIwn$!Ff>Z`eW2L{`v zdIG?P)*fK<4vy;h89A9fBA8K&V*g*)baDs?2#kxgK4|v8Y}JDCF`2LTy4I^`vL9RZ zsgZHNx1^{(hpyk;H8e~9A-SJ`U#`WyUR-U!!(Bifoh%K?{;l;O)!kR@{LJe{ zFN#C1`h$Jc-D;3~1v~?^CFE{wgXpzbB^WXni{ykN}NJBcE7*`zOUW z&glYrNtwLQXb}-zYvTT>y({9L{Om`W8A!7s<>ZW`53@JF{TqLsrFio9OVVy?I5txYV=omWo& z?hl-B4N8*l(>p6idfg7B-iDcSy)BL+@);#VQI}HC_UR{kEEiFrV7N?VYAo`F?pqPJ zoi3EvJYGzENxgl?^wW*M>zE;Ptv9IJU2-9-h6lbCxdXDiLonPBb3wKC?dlz|{BhMx zl9xRtxwT1PcmLu~#8_ey;it`&sf#uIY^!K^zuk7Hi&0|K_%f360Fk#=vra1g1aV@L z<}D0WZn$W5X&zx`JVviwjPRDcZqbTkZd0cx)Wglf%j)^vaZBu!j^~%NzgI}UkyR1HyO1jajbs|TreFGik|&JwMFB)J0B{#P+Bi}S+o(!I&XU{L^C|2bH8{~5+ehdaW+$`N&5(ZdhZP0Q=tYnk_T2~* z6P#6kCz;uuTyfYpMmqNT^aQ9%SZNq@l8CxP0eYnq6z{=Hvq=FGQ-;zK{hMw2N9qg3 zK-Ot=CRlWXdaFaQ-ay3T0Xa>2nA5BwQRn;lMafT)8*YGN{F}-3g;JYyf3<5N z>l85W+!{_N!|IKaXsoty_;qIbJ4LQ!KG&)~zW?M2%%7c>};M>)agpP=3~H?H!Jit;}$03DK9IFdv{a`ADc4ri4|;-!=M3w@%oH3{bxOtEtey zsw+B}tvH!Ir2ZI6UQO;kUN4Glwcs5W{OC^Ubq93c(92+*%0*J-%VIH34$Aq)j-B+gWbQ-Tn|3Hh`rqevp zZ6?YA^jBOjK4QT8&d3C1sA9DjugY#Nq3L)8ADxq}Lk_ttwHqL;A0X`A#5FFcIc}(Y zG=-sN!^2#;w@_z48t1+IuyJCf* zhQ;><0z1q~U%%%^fV`s;o>pxz6**ke51TGt1ha`zD(;f4k81Hf2zSj2bdVKieE0eW zm&tf_*Z_So9kTjfg7?~=icx;<{-x7mL*eOOA1lcGef-cMxe=U3kVr_dORfW~=`$LjKe2kk7!KXtu!_EtPlF7bZ zwfcQYv2ER5SPpQjvMx#ey>x`))7M%+I4`PXs@jC9+%kO^YI$sNZT#e>wZrUdWn<1i z9uOc}O|q*;h`wr*0qEas6yb_oX0&+cQ`@?VAGASYCGy8D*FBfi^XFSFeb4ExYanfU zv-dD7g`D0muQ_L@94^qHP@V$0C`Gqw1JW;2i!9D<+jS$|V_3)v^5dt^+wSw1;d7z;+PX?AW-EMF}?uz51=+LaL^ZPUKf3E>!R z=Q^%Q-_^JDO@BGwU#jC`9sz&cylGxPiZ;p7n;$r))k#UM zdm8nr-O$~CtJL1UdL6+PRk9Yz4c;9rzTBIaEPYzY&R6?xuXs3LwYvax-Z}KHhhrs~ zLT7A;W^A;6GpY-Jnnyk?Xd$7Y&9IpblwI!s%=9S^`sCvyU$b=c!UB+Edu!zgnR8&$ z9DKJhY05BMn_6bCZ^B`|H08TyzyvU>HyeL-0?l;}0JdKJy>90^B|cs`BDGzWQbtrY z{ch7mP%zPmddTv3<6$Vz7dqD$lc`{RaR?v-r@!WXD5Z9jFOI_JkXW@=C(Ek5ZtzgH zn$4a21f!R2XIQ2Mfz{D^i4XS?@GO9=6RQ7Oypv( zd{PdzT#6FO&-w|IERozItwpr-kF{cuA8`m$;~23Ug%{Moj`WrH(^a?>5ek?#nsk?= zms>tpKOUfFN^sPd6+Q|#1^2W+4wbKo95q^3=Hu1kZp_(P-#0&x8O!< zC{iXj1UV8NZQ?eF%rF?)$MQQK)__wY@VeG82NLw0uKCq*Z3vchPQEVL6-U*>ayg2o zuL>4|d8cAVj;*Kr)HL+SbO>!m2C7k6Vkn1tF18-E!k0oWJ7@SImRiLIB{9)mE|{^~ zspNFN6*aUcJcx3WVvsg!2^>-f|mXY&IG z9jPRTA&L<5MTH8ED^INps(r9hpxvfyg#`1;R-^FD7g%4Z4@Y&U!W%EcuiA3C#VPCz zj*c!WrasH5CF&r=HF0Rif?bkF%Qzckt58lk^by}B*`o{iNc-iH_4e2>j!o~TZC3i; z#9sbVhHLp5?{$bvh}e|kL_Q%g61MEE{x#wq-cIG^g^X##VA&FX+ZML+c(sOA-`#vo z6F~zF7x~bv@hoaWTyuKqvxqM))Y^UET&+9JV|z1q%lf#xI;Jvf_`%HQ%)>RG@;>2< z%mjGLF4M>;m$!0F&)rnDGw0s!4zO7; zZQphoxPLid_uZK}8G0mTz|fk@WBE@`+wT_%*_+IKUkDw=32}LYqG=P|F%>=Herq=TSrV?n zK1YvvDS-<}H&71+9{x1WaBdK+32S6vpa_0LgJsQ9>Vg``?!GInhzE$j}kQ5gpgK<9}Xs(3Irt1(q zEiEm8ov>c|NJ0ITiqoBwfNQdIan0akx*+UG3a46vRoXsjnwm;(Eklp~Q7^ z1;D*0yfY}Jr`{MGG$ye=-K1AI&Du^C{d@+1)5QS((iE#!wPgfN6cK4)|Cddm@BzyM-?IBKyPl=qR8+x0%@S00kCYvf1P zJE&yFAL|0(k=EdQ1`leWvEglfwoR=U*=aH&anS$A*jq-`v3A+Q3Be^m2<{#T?(P~i zxVyVUaCaxT1$TEg8r*&3?jGFX);Zm$-}m+^28I&fY#sX&)VvgFxd+Q@8EOK{1fO zed%*s`GFz46b_jo*6*EP;N)jPclv2m6cH|oxLhZBbBJ93&xbNxB<)nn?r8aU zI>Jc20un?ouMca+G40!D3Zajr%jZq$5eSjth&b=$84QNj+ss&%4ha*FT3Q<2v~j zDl@@L8cDPU?8?o9LNI_w+{thTih6$yq8FF0LKTUwuCg|Y<7s+uR`}FvA9CSN{60C z#Sz>0G>>pr@=za2y0rPIlW=FmO+j{b+g!e~6LPqhMlSq~>q60{m1QWKOU0S8S;Nxc zxTT(5?gS||s>u5?&vE-1_U!z&I;G#{WbTKzU$br-y}|&au!bOh; z*R!X%S9F(*h6oA@B;W>VN{ciKwN&z?T zM{j8>=OP1yTpB(Ag8M?NQTvn2_2|#H8T7BJs4H&E-b;^(T#@Oi+P*jb&L0p49iz?X z8#L)JZ$_k8k7x77G#g7VFL#Hh%dr(pIMDoK3B@C~_%#N;U>Yd@@{kIR4m7Azd>TGX z{Mx@x{)iP>#qv$ByTNjPaDu*R49p4WM*)gcV~_I{cGAasL@>sAe_BiPJBf&3VIki5 zVSO38V!UFRm{SjYn;Grjg&7@F%8=w5j!B@z+TQ0Z{}SOsuR}hK4SmOS%G{`9C~yh4S?z&GcmOJOzfVA;SJ+HBZ?PoIo^F%T)GI0!!t` z+4iKkQGqt@Ser5Du+Nk8OKI|zLrT$KQ=;LLOfbTP1w=@^0iu0l#SLH8S!H}UB*ReS zPE}ET3hn!t$oiKUw0=nYmVksLr_v<9*gp^#Q?ap-koe^kr;_N=@1dpGL-Q)l*JF4- z4+W=$p}oNtT1zYWYX#h>J4kqXyaRixeHi3WOA2!2;fDPrv9f7|d?UW5G{1nRA!g_k zebcn9sf&K~hmyhus_o$+(d#J%aWQWhKzikPm0XV17*;#@lI zz_)wQv@WI&MbOl(Q=WqPp=AfMnp7TR69@GA2Xy{v75)>MSi@yEuS)xg1n*3V@R~SD zc^H%Q3n2&8P+F}TRl<-yYAKZ!LzIK+W~qUR9`ooXwP3V)vzjeEYjdgv%A+~fbdrqk zG3^n(=u#e!DDf70gv4h%k+S_0?|IVGf`~r(k1jl>&@zzDUFrY5_{*{LQ`X#3uBwBf zBwW>ANWzc}>@~t0CI~B{8X9uP!5InRy63uQ)VVHyD4+BE08N6wSAf4Sa8MK1!yhm( zWS2|hcWtB!&a^C5`aBed#iFmO>q>44-APxl#eubztgGFuWS%`O4ya zz8Dh5Oxm4H>fvHBRUS5tj*4nNJyhB7GkgGSv~|xYJY$T1>4^4P2OAsLfi$NR1E1mRd_1x-zcWL(!F!qA)0)xp8@2Eo(;ne6fJ zC~#kd;)}3>$$UONRknFO;EPu%-L|;+hzK$NjTZZZ_s)|W*6N#oN?R%W5e1q%9SdnR zk%)&;bx{8P4z77>pzo6bKgGeH9z2Mqwl5SYn*`->S|s##4)8K`kl1fiA?bvWTo*z~ zldK`aiMuIcx3n8ZnCKjqwB@@jH4PLM1YnM13%E}SU9`@^ zZ+M@(Fusd(7&3f{Ux+973Hp+2Ll5HIE*N5>dm|aAR`^=SW3p8fYd)XWwd?*4t>|Gv z;c|wmDX}5hgwedh%V7BA^u3<4YcEo%#uuc7c60PY*F(W!o- zbzJ^ghM)=GpGDLvr-i(4#QuHQzj6DT`%f^peL>U`6~#Fq4KkN^G%o%3cpW%pDphzDvdN;p8{M8zob;4g?PPL`#bf9 zw3{<yp zcAWdbOoa&IXClRY9$^>#`$6d!NZcj8^w#2Q<>x#RDXWgo_`d1evzj=Yx*7+P`mHY< zBaBNEBBgBOuPw`NoKxX(X?X0eRP8uX42Uhbn%T)$m_~OYME2%BlD$Q7d&mz=Qz{xp*9p|b%`3`tK$QQjXwXArib(BVhLCag-jn{`7GY7-2>5{pp zMcFe>(SAjk9+pC&#pUcT$AZn|M^O2~@D$8A_9sl55DK5%x~;M3dNXze`^Y_$nOA@R zMu9LuQ|Dx*8q7zoMP@fbkQj6L>EFPnvhsC3jfcCw!QNw^X4GnHifHj0b#1zsvMowlOj4yLH}~ z*ZUfZknrgst<@2ki~x%r(F!%ZIYD>ss(KkYDbGC@z7pKWG2_7B_z`juQK8jRUb@VCo4F2iLs(ZB#T(MCNPwkzfZ3k4L@URm*i z#YZ{EOffN2wQ3ta)WTYwo|`nZ^H}bI@!4`NL0<#gUHwZJaN~dl-U+kEL_zxx@Ykdy z4o2jGKExact4)~N8@xBcZXAqiweqgBvo31-3FdTeO(UjFc>fvj{)GN(UQk5?1e#_x zxnwuJFMnC%NB0&}y|4v;W1Y7ZlWgvMtE>xd9;`6%$M=Vn70NfVmezOD0NmQ07rC7afNI$7|pCd?2MxF-Hy^~Fke3#Im!ncLLE|7cZ3Y{77V#% z|F}1B%?Lsdke)^OlD-H$N zWX;n1tj>tobX2WQ-#5pQfN@Pr$W0qNs8f1GQK_)1=nP?La3k5gQ?GW^ViwSd{2DlW z49aNGO!@6RImC7HSZiFX;@x8yqazYNH0!4wl$ zk3IEUDz1*uF&C>mPp5`u)?a%-&~x#)=&%P>#d?vWJD8qw@|`+j8AI=&|bR1-b=Pa)>iMU9ey#r z1D<#vC_-i@C02`~M%*zVa`N*QuPzqOhpcb#Cpd2J%q@3NIM(-S5em!T{I42_rz{1T z&-VU%zJ(PwSFNZ?nVKFR8DuxJg5v_xZY@vRkc?;H!s9ci-9yk=!%{j>2+iEW?7^$L z41%6%%qk~J1=jwv6oT|?!t(2rO8V~R#*v_*I4c!EaLgwbB(0r!9u-T7P zJm$NKJ>wK(;Dry~EAOu9;A%9Nkx1V&j7EC{;IV{%d!=~#z?g%tmJZnnE zFMA`<+@(`FvfOW9!}rG1A$Z^+5e?Ke8vNKs)v8FO%QPNy>O zo1NUlN!zF>hw)sy&lJcM(O{u+BO93rIW6?)RN+d>{Hdj&qoWJo02D&myZaVmB-?AO z+ByHEch~FXpay8Qc$)8BmzbgT)I_q?> ziF^DNiRiKSHd5ypmMn418F`V;6gf~{VZffO)Wi&{elh?4=$`Cz#wUX{fggBCCUr(G^8Wvq1WWRJTW*u zd}y5hG3+~8TSq6pKE+Hr}kwPN=9YWVo2Go`F?#>M?HTRcT z6`#yini=oet4VD`ucofW;l|CUurueu z^NVF$!oWu=Rh^%tm1|MQ>`Gc9MmUXPXXY;z_;LE2NoXx*$Ko`7I$j;QiUTq7kJpX7 z)#ZoZ%u)@F;Kfb+ojY03mK2xZ{v$N!2tg$-UOZf3!d+mUgmI@+0xG@3Ite}%z`2E? zqZrshfk)6}>Hd&|_7(jMJ;wSvKEXgOMT@+~6pGt@#uGZDz1LJ5e39@}NTq$=?- zMw?ha-Wq+iq-dr>IG2ADQyq8XS;f^i+KCd5m#Pg3_x&{pQBj)Mp%;Bro?ryILp`HjuAhle~taA`a00l}7xH-TZSt zemlZljMqOto65wccn!gnn0`9{ZF}%+y!7`+Da1tlVq+Vz2>;g){RdG*^^XSSj-=^AA}6zu>m z%J7;-Ym((Foj%#IHjhg;$6=?BOQ&&a5Qc;iQp~SQ@S=YIs^b4HUH(FK{`23w!N78u z+&bm{e1lnZYqD9E^_#D>PctDbRjzZd6{_>>`*s9wXK%2X^X~`z(J~m6ZE*=J5}ZpvmK16(fqrJa=)FJ<GrgwqccNT-s+KdH>OA6bur9NW7r#;4oo^%%Zn0+9+~>1?4PqEZKm z1$}uY>a|;%Z4vFj^D~}R-O%Ww$JHQEY_J$z$Q7vp&$4q=Fz5dm{T*B&vtle)=_*_!GYtFn~<)L z9ulzR`j$u|xGzhXhji?%n!g83@+)h$=XyOMqv)iKX0q#|dM&X=BjLv>kkw{fWdz6<{XdjDP@ZltJout;HU6_EHuzgg6q-8dU;mQw*|7?<$Ry1}11&iVDdgO`q7>LXEygi5r zajCGdFlA99^qG8FnZuc)ym<2PI?K{3>h(VZ6s*bgtvB-XZpZ9;D7%A+;`;OTKfby! z(^Z1~T8&3kOK$^$5tT6lI=p{SA;<9BPk&aLi6a#+F$-gAD{NERSiLKesEL<88&`D( zuT?T!l$@a%CT0%wdR0?|Y=Mz6jbsFBE47<+TFBX7cMKc*J!E~XR`Qk8qpS0;FE2@A zy@4*2{4OAN#xPeTdny(!8_fdfRw-kkq6#Jyy-EX;LhKFQVa%G&dn4(|xv6@*_J9v+ zrq=(xeEMrAp|ZF+E*kl5|yy z)3&KBDHeKg_~r%e>Uy+N^I>@C@oh608Iq_6AW^zeyh%|0;~)&jGA&r|s8ZI_cCzfT^=z4$%&dDbCTOsD67#*G&d z5Rc0(Py zu#i=3vH%yTuJ>LQW)xfi0Z|*|qD`K5|Ko^k4%)E0&xsQBj`TYune|dVi^tx?(KEz6 zy;gl-Wf@Jwu5#+FN=CwWtHpXhcb`R7)HJ&g?JnygnJj_1Qtw}^%)rzvCT+fkW^T z%+arEwe1{B8C?3G1Ee22>idEEN~#ndW=ijPOX3C#l_=FjlNM*7v3sRTlC#Z=TjFLYo4%?r{&Ih!Y_LPq-nlTm87;Zlo(7JyLObsF`BZcT?jZ_VSdUm_ zF5oZu#gg07Xg!tLRJrMdk59uDBp!KqvL!V7T^VuMYOo8;#Rn4QjOstEzAsqqxzH{d%;Qc%UmMJSS2NBhl~Mt5{ZI zTL#^o%>W{{uyFi%3S5(C{CCyIyIy54^jZx4rXz`8ljj~StvI3CRp_fm^C|7EP?bX8 zpgG-7np63j(_Id(IeGU3(VuQl^3lXUrpz%*6;v7;8jg)PtE$(zmz6~Tq-Qj>Gr`)v zIrH5x-rvKv*P)xG%RtIq;XbS(T$gn?}W&qp#1hkxu**5aN}|W|X?HYOuskU^d&9PG!raV<>5Kn6oV{mbEr? z2-WK7IC4MNefo)DQIR&+KzF2;>-K#(zAs|c#8$ozqhb-gIhO?I>G~+=2%i(XA0e97 z&2B`$&YRQGNOe)G$_}w(lT_^MZ&>?>YlSwo@96aBJe08qSIYdN4t~!NCCWK%EfJL+ z*%girVidOy%u{fc_N&4CN{Y0&RmS|W+MyThHqRoWCM4t91|p6lGTmI`ncQ-!m1!W* z-mr0G3wsRh#RhbH1}zgWFE4D0>E$1JL(|)97Tixso<#GqnS8=TChhHYli|%CY-dGr zN>yherMxSyS35o-w>8U72Kz`*-qP@NI%eFduuG7&5v;xI>vH(JGXIaDjr~3(MGfX# zq-N=^fubV~FLF$z^yF-A(3L59%0WQZ?pGCR=g^v>WUhutvP_H~BM31xMiKwGs6z_{_PN?0S71Cq z*{}n> z(Zpf2S&O=3U5SFMoyoNDN1f@H+(`#IxE7uM=I$+EZ{A2eJta!EAm zW>fyU#hwoi)O31)0+CW;US0yY_Y75%wtDZ3_i@q`pI^1NphI|D4kxb4RyNTHN|H{% z^W&~tIAD664`o7rD*gn(lD|6A|DN~#{i-WH!Z%Mi+{{5@^G|>IyULtf$eN9#i~Lh&{sRTPK|n;?lw>GrHN4ID`EpPz9cX_`r)U_X+8aKV3L>ye zuWy9oOwWAVMz5AHSI~g%mH++3KQR0(MS}Q9rTF~z$;)<3J2nXZf4K?&@#P_3-|d;$KSuJT)WF~0uolvLc^q@P zIbubhn7VDf2nqb00oTd`+QO_~mA3eA7wErAF``8jJ5M|u!70X?p+fo3e_>=kxbIQC z&dv@?G@GI?=vY`-B2~)OUR2_|lFvjGf@i6Qn6-!9F2bt1BP2d(d!R_RFmWqV7k$29 zjcIyan=ym;LY3lV=0@Esk?bg^qqaw`jJQS0Cna?>SGMiF;Hx_RZWftl3ElK_=k)Ae zZ1ib8#fV`$a1fusT-V3v75C~5G|+az5YANODxI`X%ejw(Zuslhz|_y4o}ue zbZn$xUa553nF2oiw*8x9$Kbc9Zv}Y~(#5pvm_o!8hKB*J>gyi;BEnDf9lv^1byIF= z(Kp2U)QWUWY&@j-%RMDjDW4Qs9GSu3&lm(!j;?%Du8RBbr8ku6jj|Ss5ATs{|=AzF?SNCId0bXU45An&j#fLLW&g(g;G(_!EKr@EK^x{?xIHtwpvkm18CN~=44 z{G}U6KDDhSVHuUheT)=>c)Ha9I&GRSf~5YV?hirB=)iba zXz@~29@+;ZmNUO+-YWT!QtaZpkSY_`>=8?(ZPw!giV^Tj;d z3~fJ5!fgqU_lx(@smg5zc3>X=4)CI=u(`?y}9E4jH^u8;Y0<87U#y zvtjd|h^J<2+aA2xj|VZsGU?Ccc5~(rcjUaQPG~)xvF)8L-J#t*uDCo|Gj4S~D@$1LFHU&e`?IMewT_b#^k=;_ zPC+cMKd0aNDN%&CuA`Sh+L^0N%wqUpmrkR$FBf zsg>o2c<}M?U>$iKPEx?5PS3v_j4yB5q6^T)L@(}q!1kM4qQlwrgsk_)1jLJ_6jM`E z_4Zd74$_CkpF%BmAGa%4eWu4Wo1{gtSD6(~HCSgG+PNw|*l{~Q*1MEM16mI`&kt86 zS4DEd2Qg9U2d^(rk=C@AS9Pym=Rl=!<46?t3@ z7L2c;FDDOW>uiAvc(+j*u$v51O?#Q$;^=~p=V@J!SCi-4e@tJ&NoIYs-B z*OuG)CfW@teG7U7AAtJa$B@Kskv}BHqPG&kP4d%NQ@~95jnJpWIvP(OVn^u`N}KlY zs_e`KB6VMn#XtSzPmdreD712yUJlt&3Y6chs*LA&!eZ=Dl3-{vb_t|1fuT-8y?GgVt?I>B30ncovxFv z_A<#+KVwJdnYWPYnb=e_n~tvNQZx! z!GM{rBm}6U$HZ$0!m2#KuC`x3cSo>2d-ax{7?Ru)By^yh5UZ)OeTkEe^OBrOoqWp6 zMwE~WZTBj-t;+n6zSg;-m~V}UwkC}8Bkfkn?WbT|<2u`IzHA#zrb6K_Y|SVm2T31Q z8K^m6l;PTFy#yC^*6Nvd`0(&E{bKUMgGGSF@m%GNxTUjPDo+*XN$`>>R2>LK;zHXr zdq#_5kr?iW%8lU$Uf>ecS{V^RU4Pu~B=~?73CkCj z_QoTO*9RqD+_H{qV#?R;fc6OtARY{WJDM8#>wo+^L^6u{mo#0&Q#o29wR$`O6wJ)z zdB{v9z9wKo1V7zyJYOPK(faJg7Ti|nHg%BQKV46iaF8H|G^E4-y!kTYf^YWn$X^VM zcm5pe32+vfNpAN@Lnd(jOVr?KEsq_YMol2j35`OwkQR4dvC&H1oO$9Lz;#M@fg+mf z{=%^IdwZI4Ej<%ce0UO#FyCTroT`aj8jCZI^GhzX7m$c(!y)D?cUG`PA=jQP)NEfr zl^O$!lvcAT$9maS9+1X2e-4zacR%HNbY8QXyPJoKI4G*wKHMAARH`>aO*dM1)A_Kp zGZ?3RGm<$nFLJwBHbdbS566lU9V?DZ$avuz-2cj=5a%_K8v9kDoDBV|#!n`XAJc$B zo%wkAp~^m!<+v7rlNG~uo6i8=bS3=habAF2ss726{N^3}1=swQ8uH=LOp(*xC?|zW zM6KvAw7<|kfQ2az7;qFKNpE1#$oo#)Ujm+7CR4W+xFu5ivPzW(=v>}g`O|q7#Og81 zpeW}2p@TjTslW2NS6N6GtG5x9F&Z(4j$c>VNka*y6c&SBUB_V-*?3W|86TOeZ!#4c z?w%cm(^U2mHD!Zw7TgCmW)5?6=G#Ef6vBweLb*s#9=dE!sm=o^sOXjpF4VIu&&gNk zIJGWqW}&+-F~WIBI@#I`i0UruT}_jvzwn)IGCWl0T<$4s8( zNP~#f4P5qQx-BGzN1KL2bF^3kjR%(~Xj)D?e=izlN_b3v9=&lhGEawV43-= zg`TU?2e5BDOxStWy60zOHIMt$%_@Y6Iq#6H=$U|7=SsR{#5`4gCHLy4TYFp{7{hs9 zh5cr^9#vijC2R|CTcwa@b{^rrCv8?ED-WGhMX%KsP1N8ZA3ny6c61wR*%MD>ZMN|+ zT4tn${Z2we#=s5+KE2x`mHyKN1i^mZ;hh={TrlB!UHAav735m?vzD+>)&LeXeY@@8 z=mduymvc`u1rI0%EsOm0p`M){4aJ^vGWF_8>S%4@*tF{7gc0`I2w_xf&R*~YqDMCE z?UB`~hvrj{1Fr+^zseRd$c3%3E)_cp4uH$2f3W<9>-?g;{u(^JON~Ro?`;qo7RI>I zDj&CXw4&1qbegev+Uszm@%iDdtOwV

OY}UnD#nX>?&)|UFO#rmLxqZf2#O^uU@Ot zU(IBTlsbKKD*e|cXBPy{bICB$hi&-&=H(rNhwRC|W}k)(F|-1QT0n)CeYyOS8Nw(r zvF=r*P)IKiJ@uolfbfma^IZ$}77q0|^+f#g;`6)>E+JoRY@EnOJ9xH7?@$_L`d17I zVR9LHdAU~#5{iTDP2Dnhd8-L4gIio z$C(f_;J48p`Fe$V4e^q5S>wzrJ6?$K0KtHv8r@S7evo~JkbwE8Sd2kJ`T)0MsgNp6fKvv>ih9Lu2yFhXO zu-742SUFtEVN`WTE!}4R*QANfrwXSiNX?Ga%@x$4&{CAVN&*B zJl&YCW;;P;lOVc%U%qh-#dsr+GcKpShm7|QD%JIVqGG{Jd>+?mxIxTB+28q+2?b^f z6eBO^-xsXcpx|eJ_=iVE#u#f-Ttd9P%tV=u9V_|$JW}CcOYHrqq4!fxCAnQraIu>n zdEMjwH0Goa*(jsMF(04TV``AVTVN%*>W;#d2+UA@sb+8YDM*^>F0-Fg@L>y(g5+Ma zJyR;tR2x$AM;`!)qGuuxsy7$&?S+eeC!n(oH$biFS+y2$KJYf5V1`;DkhLPdCJI2$$aWW?q;;-t;mhO(2<}|3z#-CqtOVZT zL#TgpHQ2YFs;PI?*}=ZYLoRO`6u4Z2O5yWa*Cetl?HhEcX#dg-tgtI1#OL&XM8>r{o=kICkg$?0j9v2;SkG^A^-LH`M?RRI~(>Vd~ zhe5DAM%MS_ll9<#9?sZxl1|V?N>NsYtF0H~l9T&(vhvximZxIL!VaJ9=6UB1kG20R z&kmtMYQ6{)qLzb!6k*ZAJ5OTLqKB1tsSOzx!apLTr1xU1YfJG22bEU2V=sQRzSGRxH?Gvl%^kP)or;yO^^)Vq#StcP z_ya%RX0V51GJc9`Y3Pf`x5O07{xC8r@fwxVz5a;_ip`@aB*?jjmmhc*z2 zwr$__i%2Nbmv*fSKh>-9l!5dF&}=h1Pv`G9I4{xbE!KJeA@u1n65|kCoDp7ELp>uW!G}b`+Xaf`3cJz40^&k!u#j2>n{iSFGLUwZY8X8K3v> zJvcjDUJp})0U($uKyMe|ct^EUPQ6X`M%j6g5UGFn_{Dnz2-k`@7{60df3Q2N6*qMj zIjJ%FX8ORofCjQc_9LXXvreSDy)$;2;Qrb9(-w9kgC7SEAjjm!CTM2EqImum?`?lZn?@b>mjfa%#vW0q@Z=k;Bh|LVx)DU9I9 zN)6Afic@}HKpR?WXV9C%pw|O?x4l}6+AVIaK4xe^pOCW)@&dq^l4_TAfgIkkpV}AT zp?^G?xBrWO{x_YVN+D|Ba3LR8ffh1OGBpWASC^h^)IMQa59S^PBsTqz(PgGEIMZRg zW&jt8TF-E8$52UZNYT|!2-z50gr;rHUcV5BUu4~S=ibTd4O_Ss_Sw80!Nfh<6)Dqr zLdp{`^CQ--%^fdQ_5Vbk^5! ztHLiZ8Ns%~s!=+yJT$rA7@0m0ePrzU{Id!YJeXJF8(PicVe>ucK3!pWxW(3sScCzR zqYK_~Xj1QwJPc?Pg*_a78cjPNw8A|@F<4P)wci?wg-%E~NYn)-Le}vv1_$G0#9}~9Z2RzE=f$H8;A~i>W04T1UH$0lU6H6-2%K`c*n+hY zg0eBLG;}@G=M{f2!oc|N=31Y~H!1HGo=4q^S#XGLU7~3enHqZ~1rE!i8`7fey+ZvT z^;#EM0NA-d6lIAl)MH+OVy?e}1?Ao-u6BSE1LSb%YFW*}ig950X+o-fEaJs$N+e#Y%pl_U!GTHU7o|r8RA4f)f+OegugM521Yr+(H~|Hl->9Ie zu50srxr&TXU`s^M0!?3r_?IQbXN@A+I$_A>mG3xSTU*f6#7vysL>Qifaj>p&J#LB! z)$!@Ouyo;``InL3xZ-x}(wH`J;JCw^LcY5!)%9M_2QT1qR?XbNRL_JiGj=DZ$bL8i z*&X=z*~QXan4ktB1o$dCc-UfA50h+u6q@qy4X9`hH}F@$NB-{c1M{aoOKC_>_tyJUD*U`AYj{yCR0zcEmndj3OJwt@9E_j?UZEf)JXCq+>(9Sc0w&`yL0rfxC8t`Cob?0*`5IBuR}^IilkN z-@-rn8R8Ed_x81)aBBHUodeNYzRf^aJEXsbkl#DM_2@UG5b))-9T*QQK%k~(p`8+D zA?&EqOfX^Q_9InQFZ`>zm@9ZL3BePPR4Cr6JE4 zCmNBRon34x8os(xsZv}^JFYbbDee%4D_AHN$^8!s8X-4mnoBNWK517EqEk8^lQ48D zAu`GM_{*#yBm#XKm9S_gPLmiICJKk$0cqrNWLH8zU4JYR5&P5zYdWKy5NepVVx`hZ z|2imGO+fX%IFNlUWQQWJ&FxwYk%CM8H^?H46_?juHS*Oewb7I+Gm4zR6ljnS2Vxox z<)N~VW&FAuQZo+bbbMxsJk7ZdPEx*HiCXs6np*lL1(@@XG;U zTo`ZLS%syYSIWsydZkG_zMjKwr>%%f0$Jnn(UoAsegzM;0839V!gq9~-J_86qj?l# zFCk4#9GVEtpMY(32Y4aeBwDr5^}XnE^3k(bq_>~FMjqPGwkOYtTX;}^E#gkXUdqJna&)&-?!Vf^ztIMoUm&|u-NPO=`ir4p;bDK!^IdNC zz(;4JW1@%$gf-?Mld0h#{q=PN_{tzy*g~Odgd@v8n3CVRujN)oIt8F-%Ahz#FRj(N z+8YH3@8zD?aWLh=bKsPJZ5y@9IZnCHR;`(;b6&7<*^!=5T4H_pMyAdHeauz(H-Dcj z46IEB<|8hxwiZYYt_O9uR}4|-hz9WCiMK5tA_(1Iv(m^NEF3pfJYQ_E-O$j=HAorEoDg@yG^;=emO>c- zf94-P=;|SWY4*jDGh#1%EYhwF;2n6BdLqWy-4vC|6!Mo9`q$=}@hS5GCXeXFXaJO@ z-fW*9ZC!xi;V%UR3*2CQ`psz-lRKkQ(>t%Sao?ob{Ks*myb(S-61S~MOn}tDnq4r| zTh(AnU(~1_M1;_T>o?gLxCz-EZc%KzrHXjO{k?}c4Aq9sL0Zujg1ox$0wdjoC4muc!IB9!n!f?>bL(O zJIGUWgAiRX8iwTg{wzs$>2g0H$YJ4pEyEhr9F7F~itK^iNEbARs2m-HNos6^$Q~g( z?5ano%9Q6UbKdHEoj#yaPVG!c;9w24F>F!UDfnl}PxE}Tnx$Op1UAN^$7si!>8{nr zo_mb*{)1o?^4c1pnM0Sxu0V2E7O28x|3bXL2)dGpB5H7QAB%xV}{PvW75yMht zt3D5G5mNi`Pc=8SGGg#J>OsBp`Ur$NK;zLTGWUtdjnRL_8+WHIfnG~Yh<~uZAHEr$ zK?OjE8IYJ*pEOwEq>=lfJPCeWU(yS6K>R8*sI!;?mD$$GhzLyT3iwnssj>_1>`YZP zN!}p)XoG1NgPASAkkZ`PAz(0Q3$^rI&(Ybm-Gw4I?F@L+_}@5@SjQVj>nRjU6|hPj z3zG&>dzg!fiVas^3}mQaX%9AOZ%!dZX^`ODxnDs*fLIkpqKfn8`cJeEkc#;6#7x~ zbEVt^iSz#4eS;Z4xyh=p#FJ|H!h%B-y{s3#&tUOWHOdcL^Nnea5`Pz zx+-(2wbEc!TI6%JL=pQLdx79Q1csCL9-!-7!d*pN2s17Oj#~Hx8QOa6G;GYmJVmBB zuhIM^g7+VQ>jOM+B01ivpFo)F3q8vSUNn3e*HV3LOEXZj2M?Sh`p2o@Kmv(ihUVt& z%-2e?XzHfUnW{bux01_tA5!B6HW4MzuB6$)h-VkMzD*PL0(NqQc zVm2R}NT=qiM{$Mosy}*U&?CzIrCH>|UKS+LkE#lC%c9C`QzQfgj3|+f2HmJFDjYNg zRS=bMYSS|@g(dciZ*)_0!s>Deav4!u2T2f1&{KPagQp+J>pDWE|AalXw-mYt1)F%5 zVfnRuYNN&0dK2g9M9|#v$7jB`A-qOu<;73!Wp|fi0ZGN&?}o}x2g}eGYOWnU3iB>j zmwdP7+)0nN+O}4ZEgiL=x#cA`K6Wl{u6B)ZQXH&~vYQUcmT0xow*!qYM5a&fiA~gn zA*p?0X0OYDi)Il#?9x)E@7l^!TYcq8g4mjXKq^1=O8aU(=(2PrpTJsOdtym zoj9F%{_lqm>^(EZcfB`0>>0OBQue^fLko9Z%>O>A*IbCtsvS+^7FHZ3f3;*@b3EBF zogd}j-4nJr{Yb5FhVk~9Lw&Y}^wY!r`6ijgTA4<<8V_Z%8p}d5W@S5)sWL-Why9_} zfo^DbI=MpCT@9-eKA8(lrMfrvrctVeu1tIGHhSA2@^_iE!raz)tyYbsk$?BAQ3C4A zI9xS5R1;he1+&${E|Eod;25D)1GjfHRO4g6sU&QD7g6arRZjRRw{D!(`Ap(X(j91> z00k9Hx^xPMAz9q%CIRS)vzGTzBYcN+oQU6|_oe|9UuX8mip@P)se86AFKv%Ldeolo zUjo?6%IH;{$T{_Yuj%RKAZtjH1^z%0KUM9XF8}-i)kng!4FM~$DIj9|i?8FhxqfE1 z`37&|9(z}ZP#>m+JiW}Ovn;Zfo4t#Udzy{gvNm<2E@OYg=Z`!xHM?xn>h;$e{qN13 z4A!(YzmMQfCl>X7t$Ec@lZ;+=bqiBQwi^{nr6%vWFqGPDx~0zDCM#_SSiQ}MYSw`4 z5aeAjJs$UAz|Ymn*ODj^4X>NEKmQn*bN{cJnXnS&k{E%hnP}cM3JZg1F=sittf)15 zx>7}rTKS7#$Ahzp?96N#rtqtKLM}n!S^n6H{X43&Y+P|Ha2#LqkwFPb-$o;*suGQn zC@1&%?g9^HtNYRM)nY>j``p-ff98gX)%AGfz5900{*oj4K~G1Q5sAwy6@-YNLtI_0 zSSjdLvhfSNz2*d}r&nbck=yN0JeoNZfo>uB{{TD%@Cg~S9CR!8qO07#i|lt#JBEh& zgYk&D*cWXyI~ZTr8wE&pNEAS_(gpACjU*1;gSj~={VO5^vf;Xhj*lQE3$P30|t&PLUQi0htr(XZj?@OMJn|j@8GHQ8;?r}Bn z|E7yW(#o?kmZ!Q=w_W04qMWof#j5RW&uOCP)EgGdJ6@MJGG(jB-&GwP+jPE3X>f?+ zv_XWU?;-mQF+s;-7@jKi2F|=RJCJRpPEGyC#7FZDRHoj%{YNLSf>8#A!~KTxwWm3Z z0Yk7t@BhGI6J`-b;|;?(a6;x^nL25zJ2ZutLM!Gyiz^i(q{&Quzo)%A)}o_N75i8! zb)}SZbUB6oDd&+cEf*^d8-f%HaUtakZskT_Z@I=-Emxh;Obq5W@n$6W((Y`BH>cRpoE&>uTf4R$%~=8O&rZNV&7g> zwYcn<6YfsG<=vHk3mrTO=Ej4Q<9VR{b zGS0-xf~+lnL9WJ+^GbBaA6?6?=e?P(K`4NP&$GEpxYBOH4pdZ8Vm>$E?_FQV?ca1i zaXTN2WO-dd1q21a>H$6+ozzpGKH469EtJ&6#n|>V(rB>WYV#`w7cZA<=V}LJ7Nk%B>vaY z`T-vahX3q~JtX9BXhd8mAQ8+%CMhE`A+*v;MOy~O`xwOqa2JKpe3r#$ObGtS7ip9- zii!qIH}anru=6hxYnP}Xl?>&XQMccn8&k{C3I)#wWvbITxSYv`c4Sng4M?vFKi^Tv z5g>}cR0f$V#6gQLdN>iZUv(S1pJzE8)mFMpm$?NM8`qmwK6)ahKT@1-KeDe}tK{Sk zDtId0s{R!WKODpeKjYt}4^Etcxk=Um>c~Hi=PPAeIW;fKQf6xFIMIe%Y#43{IHDu* zcn7qr)X?gTHzhG>B&!{dm>nN3^{D0RDF4F405zR_tFx8aZUnom{h#Kw8yF-UTGA5$ z{W1lRpnLg$-K88kWx;^jZs&c9&1wr~v%Nf)JFGOiaO}p$Qg}6%0V5tXS((qkjx<2v zf=@*jaMguC45~W1=(twya<=++KKZYw{MUDE=m2CWTC;qy?y#$U#eo1m_1ilCEqMNu zk^w01xFw>n4b$`5$?h~?J=ytO8ku;eGzO{RoJ08Q@R8$fSEyp8a@nqOMxXyF;Fi=; zV*fIj71Y;zo7$aFq&j5_ixdtWUEhpi@+O#2q-{0vqT!M`JZ8Hr4m`a#bI?N|;<)px z=gin~N1D|;e6BATgd2H8+Ls-66S&E6e(#Yl6cUr?z_M;qPelP(98l2kNCR-augVgh zo`5!OGtFQE()obT&>g15QVtaB7Ek5(Pi%QG7oAx?52SL>hSH%M#;N$L-jklxi=d`UweGy=o$a7JQr$G0w5I;T(MdPRCwca{Ml9L^ajqOBDuNuQY}zp(-T#E8~v= z&s(wxoSjEnwVK5v{ECIRp8=Tv$IJTrMK>c$QZ{bzb{? zH@!(4D<%oLWA(!=X16_`o2|vUnf+!#hFfXI@=TH*cN+^=jC=ak-S z$g+?39?P8XBKJ-3Y9~G2(SGY+T47~k8p~2I;JP<5ZCdVj6Gn; zF#A~kj~_$G0&&E-oeUSfD$9c85M!a)*bi^>)pM@I@y_y7`9{^c1v7Gl%eoVi)6sN9 zDkIKH%01Po*)h4=l-~WhmSUBzU}s+5f-g9tbUKINhSxn_5Z&9?FX|1}WFFD3S)O+| z0pvuBETet6v0xD&0Z#uF(dRz+D~+~B-8 zjl*XdG^+i)-}X$*#~R)^>`=?KTN7p3ZMr?pC#!z2tal0iG~LP(tqBAipu@(`TvoU0 zIv+P0P4RZ#Mr$Xgf6tZnHz1_3&9q*$ixVbC+?=nak;|k|J22=p$6{Wq+q9pt&Cqs& zUaocCW1BJQv`6pCP)=)zUB*@!I&N|fKj@S-+jP<#H6LUZ-hO5e;k8((%xyhyp($z> zkosWbS}SC1i*1f8JnC85`3POE)|j|Imc@|A^_wF|%yyms^~GV3eDed3zCK)-WVcYj zVLki$Ci^g3uvgW!Mu)e+Dj@B=L}dGC_N#iUF-EzTl^65$bdg*x`3uBX;-F@}`>MUA zvC6amU6lXtJ1k`I6$94IkAcDUUzMZFv#k@S=dMPoxgVQprdXop(IzJSPW7HRCW@z*$j>buKZ93<0<>Nv5e6*~IX^q=c+Bld zzxEonx0`l77p_?py>}QNs~^Bwp)}^M9eQVe#UvKt(A2Wu=}pi3=Z4zjjX5&%pXUP< z4z`h%11GQPS>Hvys&8G0BTe<~md9pPA*Y_hLjs@QIiA^bdvc*dAqftPeiZT$-Tk?o z{qW{!#_>;|-Lj2G%_l|YvsJ2o{r<4D63w&kO}cG@ij-Wb9S_?M$5Xj58C-6$n6#<_ zWQ$=pHutOF?%!Vda0qO0x=*UV&X6m{A0*;tr8P{}0U9(zF(f(HfZo&;MV6;j2rTT) z?u^V7o=bR6?5SFd?H0uH;E5?SCgEYV!Bz}iBbS`ylOMx7mzRcfx+n^y+%hk0B7-{N_z}MY!8*r z;-YKzU8vBYIAH8BZ#&d|s~qqYU2Ap0nlMYJ*!>EIpUaO=$A!fIhf&LEPRU*i5ZRUv zerq^ep8Cvoo|E@kln?}Ye93G5P*3t88i)RL6F2qJpsSDEuK52H3IINyg#0AB_;1hk zQ{?(6TT_2b15`?VqUISo*8~lGR_U5mb-Ww0ca6$rD+uW{-NQQ`y^}V!}Rth_E1{a5b@efbYhXS-rG7cS*;Y~v*0Oe?^Qu-b_P6a_FlNWo;Ker ztMBdCm4}>!Y2*&>@=fpgI6mf~*|)Cqm$Z03-BF(0*zNmt5Fs?>w3)nVed1aK{|XPB zuV^v|92}h4XuSB)q)XSEXXh%LLS?5!cI}N!H;42>5gPAb>0d`Z<5<_D(-sYo^8hXF zL9(n821wUuXw;saT`^>_28V-j$9@d2yyxwJu*2USUd4z9a+>YtWKM^ZF@cEqQY2!U z6aGVLcQttZ{J}hh$a&h8_`GJ9zCUhyd@>7LlWkYq%;LgtAwAsQo>NQ!Q&!WK$9;{w zcc+Dqg+xE06`mW;4(~U73ibO#r-DCQUoyW|ixcFYYqd@RG7=|BK7bX%UlQI^x_64K z_U~TzUk_J0(w~{g$O6n~i>UNMXsTQekZ=obhAA?C3BJNiVt74G9-L;wgS#Ck^1nU& zbiefEZE-48(Qy+^t!VlqxwLWH=&{(!>er#mFk!9LB7dRXe#AtsOhi)ADc$BIewB*i z?zT9Y{l#$z`FOe*-fF!~ZD>omd?ncW*VyjYxFW2efb-s+3e9TyS%F0TOz_v|DL|bm zuYw4z{qp0ud4+nt1^nAegLNF=Jqy)a4?Kg!k|m=yz%hr?*zI-vw$Y&?TdrOY&?w7i zv$Z@pWwf}Q3Rp~}6}ZRm)d6VtGSd=*+vXe0VTZ@NwAb@ZKHvvAje57MBnRmy+LdPb zn(TZ5_cCHvWl#dxME`4^`9Hnqzm#+P#ld7Ed1a!!POFE(?#_@W6lol7HxHI=+B!qL z)7+v%2Lcreo%0VLLKL6wX--HBOD2ZKw}7(LY&DNp5$MM7I||8fkJST>NBKky2Gl09 z3SJws?ikhJa?sbyF1%|J5OJjnfIcpov3Eonpa=@-y%s2Z@#sb=Q723NI%ob8&izx{ z)8a#ZzRBd|8-^KST=9yF+M^Cy-1HEO&&LU!Fn1>!i?Ip(7V3Yb0>dD%!^W9HnW;X4 zfvG8ypjw5A#xp%PGc|}f)%5<=DuWM5%C5cx{e#?2 zGllPhfF+t;af0l(DXRO(vqmzTlj6gt}-h6za&+!H(`@dWtin$DM{%;u@Fv_vk*lCmW(H`q|L zfJROeZ8~2Ar#bwoAYbu44~a^YY7=qUYpgtu`jd9C)0lL;zs{tje?N$xK=?e1#jsd3 zL}|WMli>NwfDs@lp^ViH%g;Xl<{+mcO7=OLCJPr8PUUf9ey`Deod<_N6LCck3gTO6 zW}Lv1Vk^wc%SryaSr6~_zIK0z9^@L}8*a5wKqqQ1z1ACqI30<{9pE1XbHZ^4K&Cy$ z-)mj)edUzY2>6cxZ9a3Z4VOv3j*6wLA}k-mh2z=T*Qrg@7s z>;6dz@&)@pE=75WGDHra8QSqCNsYQt!KhkT3=CsASCO`r<^0nlEH-&XLu`$#`8*0& zop}R_KdZ;C+bz`rVGB2w_y2 zS|1!{oulT1GF2xAIJQbEZmvhldcQc_=}8vh7axygR?q($0EWO0FA%I99tajzeS%<+ z+Oiu1!xVwab06E(9@|m$mgtjua~k$M<1?Q)QUxrItXjorL-PSh~D&EGf=X3 zo^dAz$IA&TjsqXG#iR=$B_wEQ21wbiIbEpwy5w97Q z`{UPj6TQ<)t$vAjQT%Tla}^pvPdDenapY?id=yK|Pa%W&6n13cU=VL0RnhtTrE=Hb ze8FXJuGt?U1;GA~iy8?W6C^@#Sx9OAD$vGK(o`xa_y!w#hpcXNMy&t#dUQ+w5gZPV z_*a2RledPGlWw2AL)hwWc$sA{@?dSI^hvv#le&nm&+F%%R`1IBGh0Y-WH9jWzX)|` z58L~dnA%SGb&+jcnq#E#`727FIqW@N2STGhVZ>-v2$eP+U}QT@{vx_rYt(5iSD{ti zL&L%8-p;-Msa+H3T2EJ<3s=Nmr0frvOcrC1)T^(KuaGr{Hd<=J*BGIYn7mZ@^*p46U*cRqr>Vyz0c*{yMsfuz;TFiW}Zj2$eXAh^QFV&%QW{ zP&Bptj?#=;HwoMar_?|2fHz^`&R~=r118_ef{RtERmP8uA?odufLwZc(7P(*hI;$# z6+qA~;tNE?lLow5^6*w%igx4I#KoaVJ=CEAAd#-n-8}?>WyIW53V$<74n6BX>qd za$i^0wbop7&P6+>cyYZyUkA1L*s%y|h86nPjGQRvgtcl`?*f(SrJ*MzqLE+&#qYIvb5#)FAtjflN?=c6vk*ll2ZS61ne%*}eNyxGFc zpoZ5L#@Z~zi4X4>OYj%|6Z=5W_NY+G&5{vgw91@J`spjs-EU>R;b_c%zQ?4m$C0%K zE~-HBpmO@p%#JLoU&*v;$o~Y!U&(@`0!N%1rVwWaIN~l2U*YuZ%W;7DX6>O(qlUV|1c z(fu?n|25O%i3yL~-=bj%5V$!OX?*zkb~_Z>nzJFDSPZiAJm1e=;&l6cz2!$Tq2?#p ztJ!Krh&Y6&>TWbJYSpIMG(ULg=`?P@l1^9_xlh=2q+SwG}L zD~R+D(dbWz%EEqaS6p-&+eT~5;yf{&Um*ehfPUukwdZ6uPJIh0Bq*rLTsej=S!^2( zAWERk{rLe9BZ-N*$AM1ey&H_`4sskE9H>G%3$A5q=pj)<4mD=+xIpRB*k3PPRl=CGVfvq^P&?rd0L`}pwY<}{SiYVUeLMjm#oVze20#q}_^ zXZFzS9+wm+N+A)EcY{GRzCT-Ke&@UfUn(*;U*$=;B;ebbGo0N2_3;$>=zz=pv?@ob^_;$J(mLiDm(8N(4*9D=~)duT%mr1ZG2Y=<%pw%WO{Kr{LX8Ze(Trl4sn= zEhGe978KRwa*(H`uD(?N&2RCu_gU#}`#?qwwv#TYA?TvNuo@V!`vMcQ@LT84YvMtV z2WA$Q$?NztI;7pdTrl4C+W471oT39%FGYmo^D6a9HzqcNIyh*CTVrHnJYQOwr|oI> z>;K1!0gJX0M!KS8ggZQu<0+-woV8;|bKoi^aKqB?4MF`A))a8j*0)IV!*W@uIUMC? z>0zhZ^i6Wo(@N?FUqRCoElwa5xMtUcbZ=Pxc9Gc<=J^L}gU}8`iAV(obf47(l`aUL z6$%Y7WKsY35ty+}U-2_X5z`OIJ7VH)Bs+3rW8>3|JY$xG`ut(WKE}j*-nH3uTNx)- z^!S~D4%Qij)}FLpG~M^YimYAQzBxcZ9*-!5avR6%EvS=Mi;Ia>TIwa*z1yBqRCHLv z@p1?a5C6tg%N@)K;Pp?_pYQq#y5nq*ff*s171i2-kRYZ(XJ3MUJW#W+vF+|fZN`Lk z_Ero6Yqd6B&@c#GoRyha7_yA)^|w{g-8hzk!{6Yqj~}@5{kldkE-(Ks5D=FR8j!UM z53-T0fP0=6@`;JVo$Bl`=EMqYQ94|MEe9B0aKm^c66=ZivIrr(b0vA68U4!KETK+a zoF%sD8zn~8D+z;kiv=b-Gx4^nOcaNpqLeabH4)3wdIw9Li02xMxok0{3X-UOIy#~a zv(#~kRe`7S)_ENZ))$Ujf#c=h@JA)yH_O?>Elaq+ow|fvmorm{<9)hKZ;ROr7(3Fd ztv#wjZt(jV28=er*Z8>ssv%~^+`EdoIMi07R-100GB4F=32^~Lpdvpp3(Itxl-j)S zA>F%}sj|%++d#L<>XOq5tSuhg-0a2evae2vFmcL-unbl!y-)Ag&C%c=_%WQ&8iKyj zP`lbgL$eC>6Uf1(OacO#m#;2b#wvpjjVYV)d*5vQ<01L?lkxuF?~V_p1t+fMe#?8e z(a|YamNsxw)ATJ0C7*IJ=)T`DbQY#YT(41mo-aauY_vT~ZBs%$R@~edLVrp^-1zCK z+>RJGQ+-SViFUFsQIW==tOH_rvNZBbGLBt(0rL?Nu?O~FR`TTWd^+ER!QZ8~?q!T& zQ<>gZ8Gocxw}u06d4AKmkQf8fF}k!3WtY|@fqzJ?|0mxTRQd4BBX~-aFHbo4SMkq~ zKFuz2@ViA7(a;rgMJ>eSvv;%!uXrj{oVRj^X2YpnxOhm?ObH-Y`%nKxamb?RE0OO)LS7Urbg4ch2^Ye|B+)~Ux2rP7>L5lG!ll(~ z!kJ%xmgojbL_emr`by0>enEv$rtzfs{;MKU7DoDZ!EZtHTk5m%KYd7F z8Zkld;kpTYFS_w;I`B*C3F*{}ylg6QZ%+ z1%#-R4@s{<2%m-LCy=Zbd>!zvw%(P-jn~mluwZvQ)>X$HI^o4vu?trJ>W*!<^kw&( zNlS6*$?7J~j2Lwdw#7xk-GX79i#3FG2j zEAv;|lSFyi7ba}GN%`zp*ZsQul@eeCKIo82=E7!!H{P0}+@Y9osGxh2<*l3O&;`jg z_l|a=T%#;}h?TsNHW$rDTGaHWXfGNP)0jLKsS{3mX7tK%Db zAZZ+0pDYD_ORM{b!y5wF7k6?^{#O;N(;OlE4hhh#rVA?Q{QB3Dj2Yj+i0s_wTOM%< z{O;Q;-i|6=9rgrmMr+DSDqB)tYm!sFr-aSu@3{mq|3fqaE}0TNxu(ykc^ZwGRx7KE z{L)gLve$u6#O!mIws|Rvsy)VjwWf-|FwIsL>rlYeNs@9 zfk$2?AG?)$WLdM<8_-2}B;a=$&Aj8a9pybq-hd{1zaqW%=6VNiedlM)(wg~O0U2rI zi(m$)!*d=1skFFyvdYsv%6ItD@N4@wcG`8ni&*>v2w~#ss*7CjO`^vn-)KRw;1+hT zx<5JRCDm_MyNp5NGBd4JG2>DFrxdtwlAizbdjD786Qm?vdGnG^DjQFc?-MXDtnV2# zA>^wNb;R97vyvGuNBk>}#P)?Y?6+wle$k&B6Uv-wqjOvN#1(D=W!Z93@XrOn&)ICJ zzMw(;Mh<14K0nVv@u922)y&P!-Hr(rA1zjDc!CDOPZNlghHFK6bT2-Vd`sUZjiU8qhhNAH`om>schGS;e5NJ}Bc_FXs zCM1fkQ@zKM-4Lf7z1}9tGm+88+2uNyc7eZb*AY8aG#dO&L&GU{ z?cVEVYl)}YX=r}Xp+$Aj_3`qR@CTG^Hc>g`f+zovBING^P=OG&UQ|eJ$a|@h13XSL zWUzD_DQXnH`mWYMrR;}>{z@FSWjt6G@1v2tx~W~gMxleO$_IKcWCrG&i479x{FaIQ z!d$Avk8PJs=ta_I-2=|eH92(zt5hMIHw!_K@jP$)Y+wE6tMv`Oi3$hVTn%g0 zos;N0^8Mpx;)v$&o5VBkL|JK8`9rr>NWbm86Zn4P8}5^089&j$H4GNKEKL7?mP`)& zXkRrbTr$_Ij0Pp=87Pd(6fx)@U`#Fg6f+s`*2@)?q()J3Jgm511LU+?HiW{op%AH;Zxo{f zWGID$IKjA#{4``Dg<_K{zXDS~X-m*+u@`>I^o~9~JypIaLLbR~xc8U{eRNO9#=+Tc zv@FY7UoVJDPL>@^fabyYA0wI)TD!&*P(<+LcxsQtx5D0iv79c;Z(h)b+bnG47MsG# z;$mY(95)%(Z^#KY9q-?T1PA9^LJ6f88(ng?x6S5SLHI3??M~b-cgTyNE&9m@rMDrd zn7O8zH?;Jc&0*eG_8%!ZY^Ct^oJgDx7kn>{1VpPghYAJo7!(~D4#6seMvXTmObZe$ zBx{_*DSVmU_ts?=csMvBiIFWy9*FIpvycMW)VeW=3I4+BY9}_m$5=7leePU?~9*lZ36=ie&&$R-puqLG&=^4jgpy8u)rPy zD=RTv3vg^(d>xX1-@f-AD1Dh7AM!F=4OSz6bhr@cr^5uzhP7QqpyYWG@fHc_*gc@m zmD{5uHcx>9XuJw`U&qNx_1yQx2hyA(-pH$+-j1S9GKP`v4i!-~`+yM`CxSc}wM?4< zlOFAE)o&q@J8fV=+UJf_fp5YoV{hAPZ2+~Oz<(-=mp z|G!=U?|0{$Sb*6rn-r65Olu;DxG$lCgbv0?|W0_|4G>6~gqZivO5}mJ}0ebGQ7;~+LpN`Px!+&BB z3r6xk&^6IMOn3%Y%9sX4M&?fIUgL|2`cG6E(-!N@vpY>KALgg+)8Sd*kL5mIz14zU zpa=TEPJaEU_G@3V8mS~sj^M|?&7i*k-Jiosb_zK*g z?LMe-ZI;G0CQwnZ((66-OUTr!5!=t>f(XIch$JP5t z8ZyL@k7pF%LiR3!4nyebm+w8R@$T~lm=pGN-=oK&`R?=)9Z4?H{ZYJH(MPR_S45oO zA1*E>CXH;H5GExmO&@`FtRt)Eh_=N{`4d_1Ta3ot0VY_G0_hDn&xj||^zI2pzp6$`>PSz|R z0guCm!g>j;qFJf<0A;MM_X8@<^paB{Q<-041^g-RK z?vwrb`t@({(AC`Wq{_U)6qHFBDU=`n%C0%h6e;~Dr22p0>#PM-Gqm=omsZY{`Jc-_ z^!_ORt*XSFmMm8x);eL5E&V1n$46lS8IM?W$k0O*ceZ9b&>PXW%Vu| zK#Idn_c`P`AN9j5cQ$jTtdvSd%_)`k2*BzLbja|7a6PY_ajVtT^g_7p&Q!EiD$~=& zA?5>tt~ae(vth5U6!Bc$8pud(EK*=NYq9BabbAcnk>WY%Y}l2qk_gm%x@-C2JsO~v zQP=?byGrKvW3(Mrs0G;KVFU#cB0pcQx??EY^FdSCVvB5AxLF-HZKaIjI|T6Q3jh-; zt^f)Zz7?p;!CXlr=;pkj_dN^pHb2Otn73jaF4TkGzv9mIbNvHTaR}Kj{6G&yf4#01 z)5Kace6{u-bSi^I8ey>aPeS}yUVQX)SW-x`>umS{t>}NQ4uPvwEJ#vHs7gp#-^Pr0 zl2M*f7SIezV4-$@RTfnZo)0b^pVHmAG2Vo}!B-1k+_)$JY$_&NTd1q;Cq6EHs-b8> z^jJC_)Tk*rI5^r^S10nRg=gJ53aEndz&!)Q@g83{S3sJ^0!q2MoJTD;fQ`Xux~p6c ze~SmTZz4JfIkzRK0^2BZTzzSoja{{eRI~3eq9zH+Jnft2v*Q@3S8mm+geCO#G!pEse67-w#o+q8+oyGzh8LRCQ~@U+cjg z0k<#h3020dH+?LTjAc^Zp!OWNvo6-t{}{*q^8JNs7CtV2kVF1FAao-^i&zymZli>( zEW}bHv2Ry(jDqZGBP}*M9$lW&<;G|@N0{1=-SvJYmDGp*0S;!Gm`n0|{Cj>&b`{gm zDS$Nm<7?!*4F_28UbUag{z5*$7F-Nft*j~auev!`l(@E-B~J#lT%zcBckP~~{Kco4 zo)^>;Qj^=M(?hGdLBZtvAx$fx42@AsZhO{qO|F?16E)KKlujXg-+Y8NbqeLIJ@yV< zcdqeuSMSxIkFvmcg(xIm7D8Je#MyA`x(#+{ga)2h&ad_>EvcFN=xsL7s6e@(Wj)QW z&N86nKV0^vR2tslS*qK+FI1c3V4tW7d+WAx*V-(m0E+hl(XEfNDGHjJDFb!h*2}FT zlx=r6mH={XzetByhf%CDm{5yQLGkhxH2y%!7*#%MvEM&%=)bXJs#)Ebp+{bg*H;C7 zfs6`KS@~dq_Mh|1Y%#$P0Z4e;3-p?lYH5}s8;L<-9JoQ z;<7vATh`Q5o&Ya%b58dQd{w+Hg82||DRCdXd3q-v-Wa8Ob@@0Z&*EJ$S7SLriLcj% zm!4`4FwT}5p@%_{Ewe3$IFXOB0C{JC!OzF!vc36|CUDX7az8>2{q6(LZuiv>Ixe$jQma=r zYqpa*KQ9y+bRhkK7cxvuAs@54ri2Uo24EcSQx!8MrRwR^QO)0DV0a4*J2g3cteUMzQ&L3 z9aWhC#v_A85|K7e^N_moB&-5D)*A4V5*~g%`P6Pya=h51*S;h$l9?l%&@mZXV{0T8 zmQ${{w%#8Lc!9(gdk8x>ZX}?6NT_OZIaJ-43xL+M;5~67I3nb+TbZr)x_;rYBk;Jv z{i@Nt1A{fCdkC>NJuv~}H+9+#Tzl_x*Y8>G4NIt|-)6*IklxB*`4O-oustE)Mw)yn z;^XPhUb_4Rzaq*L0biq{pztHvxHdI0*`*w#-nf~ONx@=+Ceob|9i&aO^fW(Qo>~sH z*e8ypZ(q#Y8Y@yQFF;keHR|oK?jLTg0Asvp%|!KP6JwL)`@NtrM)G43pWElwChcxR z`MEp5aFz85T~T@d`_j2fc&Q~9BR8}o!eK<(TSIlGn#r!{^@{1+Hc@iMID)dlMO!C# z2E275)!*67YcV4fbWFwkHt{jzB0PUEwW2O$kMmt=uqqw>G_G=2(nh1;%V+;opDLiC z)q9gq|HzpquU9{^rwPd^AueE!|3!sl09yi?k99O04!<}vA07SXbT@;B_fT1{gB+T5 za#!3#K2QCy?%=tkH%VsTXZgw|y`FL*AVe_4=yB?}+z$H*+YCUxVXGC41e~Lkgl@5%4kCw4Fiv>8lk~|jy}NE zeDc@g$%M(xu7xV1$N9?rkv9(mUNT+zC^M>`{UwT(WyIi`k+wtK7CXDU3)_WRSwTAM z1x=O156i+YrQ{%GA|liuWr71&TaWW5l;B7jn~SM3=D_eLMLst@ZYa&{`f2# zj*iCsKRMSwW@MzFk@$^~7{18!NFrt}LbpHc6;;Y-f5E)_Myphj^di@;_Bf8D`U9B+ zvDbx_^0C%_odV{HeRXX`4`0c(tVeBCS#Qg?fropiX}-%Q(~>yT_ZjA?A9Xd@t*t7X zfeAiT&dSpV$-+<`8B_ON)1Av6TbF zq}8g2XMwYR|1qp8lRgp2WKtn={P@jkEIv89?1CDiNKZ;v9O;@C~3B-#m{Lr)l+K6YpN635(+X0W>lw0zEBO% zA?*mf**(6ln^^Udr6>K+?zC;06>~v$U=$-%%>hoqs;Yr)q@a|sx2hUs>W#aMYyD*{ zW`u#WH%UIF6`sq4dA}dBZb~2>b+fk8k^%Rgv>G0OiMW>;=M^$ZI%bPIBCHclsb5u4 z`A@y(AxnDopCN)GoY!Q6{?FF*d9?5}9UUCZmopXzK*vihx9U-SYb6FdxFh7EFS$e| z;u(#{XjXrE2ve6jI1S4fma~(t7Xa4MErjQj@MGi>L2**^aa?gCX+0tq;l4JjiFQTGP3*VUWxd>X6hib zVH3++@xn8UM**Ya#uOrB(CZV>H~hj@q<*hg=E6_ISp`9q+Ur3U_NY3wRp5QDj6kz@ z-NV@3c)KUTkkpwDE_>3Oq9&u=AX+nt=JLhHf|XiGWU#zl456;sF=1}XNFsUJ$~V7V z?FpGkqzOF<+3BpEVV{68-%r;u*1&4sf4FM&twAkKxK>bvk=_!fG#C_@&>eJtgxjGF zHI+Apz|TT^H@4C{qX&ONt;Pn($e4Vwv9Zku6A-*Ij_eG#v;H&9m&9oIXSC ze`*2!cT(*;ApaflmtLc&x*MmliOG1v@Y`Yu*iu}k-mgP{77e$)P3OVZ(tW8J^WPQ( zYLyDvqWl%uj*V-R5}&98r{33>L~w^nx!DC%To7L|sC9&BRcLkWkG#>h3bke#t`+|f z#Z4j`BAxM*A@ptK)#-~2<>Z$~MyEoJjpHexnt zbry%gm1Un=o=<$5hO1u6p?h%*de)A+2IaS^S8&qDHwRk^QmQ?i|n=l&rbMA*=Xe#A|}MIw2GhO5=yBx&w= zzRq`B{Jq#sF1uq~^&{n`g0_fd1Dh@$m|^cBBvpwpTuprO4aYn)quLoe1Cb#b_B4L< zdOco3lzMs!yKDhsPi^$!o?1oR2)E$1W&ofp|DQDPpQ07Am>@DrVw67W%c<%r7Cgmn z2U<#FM%*{+N~yI6MdIN`+%X<;%$3aPI-K*=;T^AOI+S^AXeF==xCoZZyoY&Bd5S+q z@QT&P(@k4(Zc1_TtoT`M$w)P@9hBr7FxWPZM5O6(&#cxK1zD@YD}o}Io^ll)?e{h< z7*c&0O#Mqv(j5mXyr#iOVyT@#AkI`V7N<-RtW!9hjo4Eie~1IgMZ;m81uNiUaU>BUHjmBX%si5J?7H%zED7W#|#)cuZ90h2NygwnLd#une z7GQo(tY%PhUMP?gkK7D*2_|Dyi+vfaR zoTPx}o2h}a6klVaGKXSo>Zm-^W2%cU9#agd)t@>lci=vZ8{h{#TFsvS!Zm{xk$q=>oZaQ0-)IY++p zLrV|U?MqaMG3*WB-)Vjvi*FK<;^cKg!eqIgHB_K*ZMQedi|7I>YYnxMdRwrcGpX`v z!1yPd9P0^omll>d7xx?$V(KgB-FjtcrbAor1lrONy^!8)$eluZwsHPpb=c(|vk?z7Zm%*W)?+p&E9ynaRcFFYz+KK4IXU)?H16(OXo2EfKkHm#Wnko|D=}=B z=n--&b#?ogyo2sdSH5fo^@S4QZxKmP|Lb>s^&x7MHR9$W_o)i_?OIg?Ly+xjY0$%x zFFU9?)y3OK(Db=eSXfw|=TTGSVbi0xl(clNe4)JB!8&9ZbbB$@gYnkv`gFrYuM?n+ zU<%xP$9P$D(2heqU2h(G-&3VMK4CW=F!ETf=-r8xFI2ib@~?{wHrUWUKpiUGil4%=}tFh|gInTE&&|3lKn{_Gmmy)O}7r0A#X zv*zrr^*M#1^$L4;sfPA3fSqD}i&zThyjf4+ZlyCTsr91g?e0wsoAd6d@A$-oh`D>A zHG{z2xnTppe1Z3|P%xKg##)Hm$IMzB--y4v-G8UbG)dq4@SX&H_DIm?3sdh~^8s&d zR(!TUCjh)x{hLNX1QL6$pBMMO{fj2+J0bT=*%|_U!O0T;nr@XQv0~2&cj%_oMAZsK z4}+HVy|87#YVXS5xj;S{X+o)QNU6s=_noS>E29DF!NNHAJIv(2MAY!0qDJwg9a8`` zvRU)tYAy2ouh5FZt6>Ot&1_@s4-r7x5Z7msE>7$+t2pbo*ysf*=GHp)zJ{v-F72P{ zXn^ZERWSZko5pLC#)}k7v;Ng?n~m%gH=r8MzBrf%?=0HgBkm$ka)C0;_7z^`s1yyu zs(`Q^GVjr}e)3eY(&=rBDJHP{@eP7Yi_)52j>6T?3lJ zACGLAe*b)HcDn8gR~$#pr%=d{!NJBEcATrXj~$nN2l@A92Ns_uNDvJfsZG`?``y8+ zNAkmfQ@UW}R7I)vIYEqRxYk7LoaQYx(Cow9OPb>BaZSh6+Yd3cp}&L&#y7CNdRT!% zpMwszs}YSaSanlseIx8|cH46h=M`eGzt_Jo`p=mY&ZqJ89mSS9iCCAvlCtw!B!6%n z;k^G;OB2g45^cB%FwmJJ>^+p3=+wKAvH6@FgOFJ{|M@GTFYhZorG137XD@c)p*I=M zc)_Ee7y3H98-O2LkpB-J$qnyDDHlu%f+V6iAQp9h+3mtzkP7Ue+bJUi~4% zryYeRqvJ3hpFz9mBD7^aMta8h3n#r^ZP+dxDsg{{nY9ZCgZT{Gu5T=tU}U{%B9c@2 zZ)AKd-bGur%GNRe}CVq`|-eaIlIw$??jg~7-)A=vj)*?Qw9ZmORcqzH$L6h zsM}m03N#8l!&E58u;m@xW!Xm`u7k zKM-kXR<&-YQmy0jMC2t{S*OM)cW=2<(BC*l&n>H!Rke%!ENa-PU?k+zY^caMnUDuY z{5_p(HfMnYzJBZqLa>T30n-)K|`G^$Tz&yhq`0; z&pNo0Od}7c57igaN-u+;x6@^M>;LP_{7%+&Rc?XHtEm-5gMF!?qE^j5ZtWE(sRCPZ zeW^1$m#LGHuZ=L3Ohq3*;EgD0mB>&VpUY&Z-qctv5s)TYv(&$k=pJnCi?`e;c7(Vm z)bGM#p7~%5Jrudk;x{-zc%94GVAyK+8soSlda!BtYPsRuK0ZP_u}c%OxF4fL!k?Zh z{hdjnrU|YI?IUsg5(td69m&dv+2ncfS$u^(pG)y$eWwsO)m9h!E`a}$(r^la%hZ*2 zT`+1dw>rTNKg*%Yvs4;Y% z;&%ZWj!brqVy^i4sx)Kq9Wa`jyjr&x39%;6n|*48nZoV7TT=gkoj8QA@gVYn*TVy1$gRr2>UBzxqMYp+F6q?pgvKddC%{av^x#8 zt&Q!IW^DcPczfidlJVK&ewahDG?}k+@^UG+mjtA2tTj!qTEkr6KQ#2xV`D>YJJ~c7 z;HGQC602{;0Af6uaX!tDYLjB3(`i5gT98AlUgWd8Qy4G32j~MP>XyB7PoMJnOf}%T z%88!e9t}R`qBFAkJM-alh5Y5Z2dNt$qmU?_H72p0FQad{xY;XN4hwVIoofiCzSD6$ zsBwa|T$WUtPw*F@oNeI`y4>F&Y8|T$xgTy$&KDl<2O$ptR;u3e`FBEpFbSW>=v&(s zN!b)u1RZ$;d&c_h%F^xOACXt;2Iw|J?DX3ANET~P>^$>f)>O(09&ZFSjcaMDzza#C!QOY>j+xPFs@OQ(DG}tad*Y$Jr{y(u;jzAPX`Zm@IySg_Rwm z=e>aos2yI2ZlB}xim4Xgo>#%5)PEPdeRm9s85Vl_a&8f#eECL$Ql3Dz-u#DXvPAzB zrFDR;Dc*{cTm0?mO9MocQSjhtotCS}@i=+Wv%`a7wb9 zkY(Mum{%EZw6S~yNdLLffHoMhf1?&!YG4l*d0MLsI^8LpBq=2yz{ADeC3j{$4OuvK zA|JKvmLytxWc)2?1=G~hdE8NmkV z0$Cmw>z1E&O<5_(0G19|dVC^ZzhbL^RfkzpQDz@m#HKnrkg#>R`)bJWN*v0Jf&Pi8`{1+Cqt1xE^-R92ai`WH1f1vqhwD|};HbeSo4EtFIB1G(AIPUG_ zQJ$0pe|E|~CkpqcJ-$`<$2mkO@4o>KzAUld&0b#!NqHsC)sDd-vd$T-<(qre?;st4 zT^ojKYL^>(MYrP{F&AN46JHsgti655ihkUS_;eYJ(5)zNZrxJU6X4bx&#<@D9H5N5 zy#M4_?mhY8$Mtx)pE*v7Gg$ZwMsa*-24E(NvCM^6H`ISnXrZy1Gj$cb1P& ztncJeha=5!V_qa+5TAq;ubv-*lBM(dvYFe-^#z2Rz89DQG{Hr;6t1sU@ir|Xk~}EH zQ|+5mXE;aEE_qIP)2ai1CUG1}37#m_lvV{sx^-+{D<1D0X)ry&=W&tsM`{HV!Q}sP z;C9$KBU{ctZ2+fY$mOZFgiQ@u4jr!ZN@vvPB3@GR`8&U}-A#Yh7t4ha6aE$90`+tLRYd&Cz5-RY++5bxgN3k^${u(^E7+wZldq zt@QO`jHVepGgLA`1{l$jv!LLKl4fhJOvCNXz{Vi^*tIt)|q|t&SnW#;Pkxd=@ za%GbDcVp8Clw5{$?8H#d3}g=|a_4NC5gNI%^J9X(8SB482t_5x9iptq_yb>*%U>BD zeC_3n^pN6SPD!X=mo6uPID@*K-|8Ih6>+;>FgiPp+BfAMO7Gr;Xbn0MH|09>Qcnx@ z9z-<0FW#fIp`UQxkC-~i(|%4|$Fu95R|c)Gk(sXG(d>!8QReRmnOWLJ|EtA7ii%X(TfzpQ58{Ilwy|?{ zHN7C~o%IWu4F+|8H7t!i#5tZuK1j6MQ(%hUFFaK6v+bew4M23UP7R?fc@@cjD!);n zI*$2(fL2=|EL0}byQfF!@Wez3d_+Toa&@kymNR8;yQ;I|8>c{m#>+kUGuW~nTXfs! z`o3}t9XBsl8_#Dd3<34>yPLDffC7Emgz|`-obOvJ;K$Wdf!lMI8V<G#0kkcfbEr6)}DXwBD# zxbDwL9^4kgl$@McVGX%AUr?}0DOs)OWFQihX?mHb{1rzh8Rgu(K$ljMpS;6$XI$)H zBSoEJY@HFQIY`f7jKB9u!gOg3E;skj}a<^2EH_&1h?p_i5;G9 zjOx~0J|E!Duhx@KH}Lgt_Ie<6QD>h#D?AKm~HxiVKybWAh&f8mDKb&9EpO4qHYmy5Qof>}KA zmeneIQ{05-_J3*FdcJ@F_ai%=R;`3jrhC!J!J(3Ra_}#YOig=;ma3Ijor?}F?REY$ zVk5m}zvr(!8g@yBJ&Qs@b=>WL|AiRtC=zY9d^2@k|ek=a=rq?iLh!B3Bf7JiNLzBm4pLMY& z<~~?6~B>H;~pfUe775x=0n<8=J`Z;f~v}ph3WrK&wAu6)}LQ4WA~GL0!KC z-Hr8{B*NDgGpS8{CAvHozeJmIvkcyI?H%c&{j72(0+PHuozISy5o_*`nuD*O{~ILF zS%nq^&_W+dzY3P466SBC$o@fiNLc|o{^V#<-7mfv1uDB%9rHWv2% zm7U*P{OxhhMrq7oF9CM(b+JrRxe)9#oz}}?tf2d|Vyjq7Lg=HYllgd_c?CqY59hah zhdZ6B`DMk^*={qS8XZ{fP>ltqohjL0V_WiLDX_4x#G@Q=Ss{u#iI$*_%S$cXk|IA} zDGEpJOVHq@87Qia>*ErKrusSCPI%wnMAuu#kJcS&P!ea*YwINB0h=KH(#QR14qcsq zcOan?I8r*$C(FNy#J>S+%ZIAE&)W>mFy#e&`dzGpWcy9J4Gvb_DVyYKI*Z_u@s%vy z*sU1U=E4U|I8JC&UJ)|S?3;F#|E3$UQL)ibtKu}@8c|m(18^W>Zl^Dw79-lz+VJQ# z>uV5++ugSvA%ES^L)*q3Vf^5-Ixw{1C&?zrpYlsXA);K}Ye2WmnArR3!P8^4|5M!U zblcGt3p^~idUwvP)gba=Em9IJBbhsmFHeYRO#-%NT;*p#_>$#T`GRR(_U^m6?! zSj&j`*(;*$i#zw*bXTfmXrl7crCUch$F4;;31m8#clmCSw%snFCE6MFVisp8P3mmi zFXR2cy08j>s6|3l$xZa-V+&PCq@s$sxwk04=+K_uCYj$ zFMalBH;oV=J;x``uT^8uzj{_-V~JN$)9F0Ccl3>Q?z3&Z+h)K6rbg@=Bwp^m zAyeqWL|YYhJjoGrA_?`#5V|0OuNLmx7K_DOLYt;a8yz-Y0K~Gy${%s3J>hRB;);)o zTd?PAENw#)S4&j<`LRw#KfH0R1-Q?J^6rc>I}}_E0phr5Kv_ziI+=9A%R}x2qb(pE$XlSM-_o%((JTUjfjv6(K?A$-`>^7I>>oK`2tvX|vYzi*c8r&t=j44E4qF~|5zY7H7y zn{+Ne$FAAQD^>n_171e2mwSqb$WJ#d&zNYZ8(ng~Ts)sO&5Y({JZHPywSD+$(cHTW?t_9^(%hi4$k+4r;e^)E*b949!Zwjx2RSe z)|QQJeINOue;BXNsimXy{B|GBM6Mfx`7aHt-AAmTu#m!_BF+bv&v!DK>{A{oXno7Y z9UbJ?%WBcJQejWKao_E2h~pdacz*5Y$4 z0r1xZWw~i4FvbHboPbNXK^^zodF$IJ)EsdZ@POt`dz}^ z8?A;2Vj|gOK(;hZt{0CKV`&YJ+oyw2h2g{2EnQ1T=vAaucQIrS7#S*aO311IU9Clb zBvZ{$fY1RW^cU@K)!Om6NH#A7JaKB>JksY3!C@l|PCIL9_5r_YFNa%u5sOWdfOgE5 zrt2V$8N5(*OP&h;_(X;-B+cEn>x=m*gSz^Cp=R4RndH6Rgca5-$N;B;K(+^NEM(xurP32!AuC9xX2$P3gXB>ApO zO~Kq)sscu8Iov^S746q(@H8uX!T$HRN@fFb{f#e(tLlf?SU{pqi-KFEhoNGllO50@ zCI4xTWjB#vS>~|AiQcHVVS~JCMdx(S$%O7kZ$tDc9@{n%4K&XPdQTxa?@OJVw_2HV zC|Js33fN#}GzaZ^JF-QGiQx~2c9cO`?B=TD;Tf$lgY3Oa-+1~B|mVMebew4&7wTf*qGGw|zm%}(VUoRWA!473c z_j=wZ0Xr_5Wz^I_hR?CsaoNcG)@WI$_)`KHkPQTI`MVg>|5yf!sqR~d4clOj`ie3v zRLh3U9ZT?HKb{oS@8htj!|y_eUVS^n?kkGK=i_JsE8w|m)u`}lXgox?%Sp~kT$Xnq ze3~dgVNNT_J-Qb>0zyP0aP(}aA?ec5{0lF{{YZNFgF@X*>@VL_a?;T&ssR1$Z@C2Bbl&^5`zxckGdg9qbv;`aaxxo0P;akE@h5i zb-Sa%a?jnppoRf%rx@ls^{OZFf#@o^tfG*93o2;g8;2NEB#zC^?DN_3{^IeXrcG|w zT{>5rK_{}b9)TBD&-s$J#k02*XC(O%E)OUbb!2szP7=%ccUOnTtY4{0aMs-&IOaU; zV(Ak@=7?@k)w~G!x;28wq|kLTPSy5{#D4GJLoilN0d7KirY7z!GU0T%|!ZaHKPE^qEMw zCwR|x%zFH})jpEe_+V-61m#i*c1&~F$YKDxoj-`Fu2Gu%sPc1VArr8is_YVz2f5a$ z+sd2WqM-eJELt+Cf6;S~9;Od??*&*64jEFXMYuQ{mrXX|U@w}H?*)YGXKdT9+q~Qs zXj2w{k;DxlLG@#jsTgRIL*?AU!r`%X@3TY@O?=A!p-GBDhKp*J*h{3SDNyR{O)YsF z>9d-R6~;KWh)#TxarG$pOK)rCkCVdJh_~9^;YR?P1!Ti=e|0I!-}d8D zrmvb&nIzmCcZWZ5tZzHbJ^~mPU|sy24a`{Z7};;4-HQjHu^N$^@m?woS1BooGR!4-=l8Kk8MWNjziF_1ns;lF zHzIb^{YzS5uIkmYggQqi?KaY1ZJwK5O1vRc-ykWgRCTXJyKLWKs6NIR ztzCbxoD> z*LM54pm}(xc)Dz8LU;dKUp#aTRC$tzV%LG2m)u;x@qm=)=)9=g7xVdOLm#UJM>E>- z7$(AAkUcaC(Y)N}4m+|+WAtIUTGu4e6Dsg|b)ZC<8>kCrVOsj&G|y&d0;3WNDqvz5 zDZ9;lcq>gQ+0?KCDpYipwWuk>KGl1_`sd2-s7<^Wy7V^Wq8#uVE4`Zbii6P<*qAgR~hI zWZjL|R_F4rt?9srWRaBDC$`pnrJx5vS3}5>B z`e2sWrX|ZFK>R9ozV0eYaD0Y+zHNsxkfC_zLk^+#>55{d zPrDaAYBD-dNZUoBXk?(x$z`5E_jF9LXHykz{4Cudw@ti^JYg_nMTJCGZ!r85E}N?J z++m?M#mw_=gU);>gw}zQ>BK8HYQ5*4dIhr59m9eor)D@6qSY@jzLqBeGBQ;W&Mcz& zEF7nop1OzI+Xc~|Kch0_$WfQ=xh8bg+D;M~wnBI;rid&3daus2hT0zsi}WLvD3HxT z-0tBd6pee|(!)y6DoT%Z^8P1WM|_3hM`k8SsPA8`cYpID)>Lu3V@HNBVH#$fb&bSq zooZXd`~mH{|9XnKQ6HK#Je;uUmHgtY?dw{9^nDpXIjV zOrdW<^Y>A!spjUF`e&9eNlE`=17gg6S zbO7GD1Gl%km)N-*OhD6~>AG{R)EkarM|3SX*b^7(AR z+8atEV;}ISC_WnK-YJC$XWo8BVI~N zsE6sXIi`8T+qu-JFq?XPYtz9=&a*u+e?^ty-SY2|yCn%Q7jgdhOY{0Q!#`f*Z=-~? z5AVBRyYrZbmDg`QIW#8O8ep8%f=qw+tHoxr^CCn*O_M5&>Q=lMYmq(a$RW={rjF{; zW+#ucOfQlOSxxp>?0i-TDfQH9IN(+sMO2e@A7^iMs-ECS$DrpS;cRvEU5*gd=osZ!>Iwm@n1_Ycz!zfq zUL-6rmB6(!xeq%6-{!>Yw2rW}S^)W07ZG_HFvKLo!JYcKx_6sWTB6maBpCC24fbx% zGVCkm_IBy2T&nt!jFlEwNpfAq>B6BWu9VU-TTYW&%+ZK}@rkZ~tfv0Rn717vhCwRT ze~qj7n=goGY~nc(l{vl%gdGV`bXh6ZMBCN(rqCZ|Cp9LXsHs_jTwB^cJs^_xa1O>gRc~Hjv_#ibVi>0?~Uigb{Pa-vt zYaD0PYS3t+mN&$$=<=;D6Q7&VJq_W)#G!GfRmUjLWrBe?Sk92`}-ZI`u=k zz|)s4hd+%uE_lDo&mFqBY*)a-$wt=9RDSW3zhCk2{PWhOq5FrnKr$633H9)>!mL2e z5E)Ctle*U8t8gesy5t3)kCBZ%U4a~PWW?0EH7{^}f`^22`;J&y2T`Fsq^Y3)eM@VW zhuGu`)-Ew~HF6J4$Ai%Dm&=dKwfl}qYHm|9#DYCAF%M>rofDujLt`xAV#u_*K3IP# z8*5y>$%-_+#vE_ z{E=4b_3u2owP0LfF!#M1815-Iu(r+wXsLSEOnub%kZ@`=7bG zia(ke7fcdrNQ96Ld>Zj}ss=W6eurz4vvx2<0HF7*OQB}&7nNxWhCU1OZoP^ocggFt z>n3D|)*6@L@~z0zFg;Bgjy506RLpmAFksEz?qQ$Dc+G?4MIVsDm)A@goAFN<>ECp} zg_F+b%D$n!z|AD70b8;zmX)OKc~ypMlU>fN^KsG%4>$5` zCXP<5dxeU(53M`uup~ukwgyF{!!*J35rs^kyheC53KP4Fe;zdeec36%+os zMPIvIv&A`-C7lYDuH3Dz`Vl4Une3h1`${mHb>7#gGWAC8O1@F&()*1IPImO-HrQme ztN}=~22%Ct0qL^;%G}GS$LIoST%F@)w6sX-)|%~EJ#3WfR8mJaVAO?J-%0Bk;7ocf zUrvS)uBgDmL^rx>(<)Jl!N-qJOk6FLd$G)KJN15`?wh18w;z@5WIYT0>N0?U*P33{ z&=*uI>phmgd6rh^l07=w8t-|^&8w`GGcjRJ3!GbATFN)L!1hSworC1Z%Rh(t{@Al$L2s)uN#x;#HJ$lyPx55ZIZ&OHmS^&uD}}J_ z0;Ld#ulZg6#pj=DkcihDSpkzSYK<83__F8(V04)*S66$2wlgMuFG+?#U^_r?m1(pyfO zOgp28aR!vbdJb?C1sYgU)ak7u52?GP5c9WmaZO3XMCVq$OG53kLIt(92 zl|QK<%0&B`c z)2mk5NXwnnNgltQ)VC99e$C9}JRax`Vy;hYr)$RwBhiPDMJlpcb{iFu?tt&CT(I}Z zNTsZKzY7fvaD&%LwxBCQa~*g9IYzdd{?O;zd2CC2Q|@2Fixx}0C0OUOT>!Fw9z~Ja zy<1P*g_n2x=X(9M1vCQ0vx<*c(r53ir5Dt4nP?spCKz?C1TrLNH>1yAwXz_?woFbrBOR`fC(|he@c;k^WEo>!?$5@#v&|ZobIs|adK-?8E zmNi@FHUzcR%a=95CKs^eHh6MgUQStr*1(%L|5nyWF!=mLY})2(twqf8oQZm^R=@REDek#jg=hswHE`#$PBEnpA>JAfGv*CIyZkstq0JTBAaoZ zFIH?6X!wvU?$qp}AajN#7WpPPL&>Hao-4cQO-bschX>6kj}>~@7t&SKYTH7r$ASwg zUO+8icAQ3v8ylRYwYF2xETuFdHVK>l4WhXHdp2oFt=JR-JmhaIbQ5Be=?OiO~h|WjcRX=gRVS ziSY&0mc1S)^G7`eWXP6>k58WLD{O{7WMha_q-Wxb5OJ*=LJ6!_mAU?rjB~#GKu-w> z1QHPv0tRlnVp{t$*=*-3V>C;2^VzK~4n-n1M~k!IOa~Ly#v)-KSOQ7{J+ZNxk#)OI zH}^L6iAhLUf?w@KgSC^~Hl`vu#H#Xm<(ulEwU8dJRn?H$=i{FT3~E(6qtZT(d0I~wr#VGFeDL7qy!X)^BdLu_ zr1Qbm=XiZgJ~F$>`Y|kKEmi(ttzWgswNW%YVs>VRV*1&-pzT>L(Mg+?6_YCoEVuAM zmF)7A%}5TmO!-^J@%J;gP0IAsC*3wjbqorJHCH*!7k9J*v}3DQ-F}2?<_;KmC|5hI zywTc^jg1}U{S>br*EXy@<)yp32|Z_~yYat$ZxlEL+#e2{>2xyCeh12`e@%N*P+esR zaSEyxg_jr3XDP+#8Is{)S~{{BsHljy21jRrz2{cW@glatdVGb5NzYxq&X{U#)!qX- z+Q%^^@6t8}iM5s)KJ5k{A@TuLc6~hIiClU;nkSz&^_jl+VtI`@zeylBEa4hFAAS)C zb3-PetR-s~+Am&gAd?*n#Li+7^{y#UZ!XypLug(iVuUl4^evT$SAG(TQd&Ht)iyD(T`SSW7(aQW6`7>Ma`RFU7;@^I1jRnnywFrF>jEG!O?7G>>q$~LKr45 zStO(tIm+d91NA58k8R9tkyar!N)La_eo25$JW)<#qb_TLU7y-XvMU zg;$Q|k#rtm9+yKQyK3q#@yShFJ}i=;)H=eg&)R4?$k2DK8t;KOF-%b$Yo13tQb_m7 zCxRZ`@|4#YVHjcbrV$?>1$-*)T5WKYDdLO*zo$J~sc-KfcebC;%#v%m-s}xuq1=i^ z7JnWcRVSGsh-X_tCV33Op8BdU=`|r^kMp%(fY8-zbkyJsGyj){%$a%LHHe+(m^6TVin0E znpf>nNT>GWp^qQi=wWTk3@}ntb~2x2GE*LMQ*^#kI_7{%iLa;up|7Mj2QS|C>D_=P z-FL9mjLCAm;xE!6aNDYT#usC%CG=Vh#|)M|BPu7G6IJta@$M&H zCf%{^j9k-}tZ^ax<>p2qbYZ8uH$z#5P$^uIzJU!_JF<5>S;(q>Q=cr-wv9jBkhJhp zJ1)n#9Y1Su#sCwTA>iPLftq3c^Eb`7wz-&_`Mkd26oJ0q6aQ`aZ8>E;O8|%7$|r8 zu+r*yU!E%vz~r}H<6_pED4{<#g%G-opKq+-r6&mYpX;ZlTfKLO~b5g^Kr9T;`F=0nJU_70B%X|_RV{&mX$M7eKUeb^ohQ!RLNKOubACzsf^EpK6AJ09 zdLLpJ_DoHaaN%vvBgY;>&AB(b%HAatOYeQyw6bg_$8{F<*p)dWY)xi+h}pKDk%m01 zem+-E%RJvL~% zx4goP+vjJsxioe$xYBE7QLqh~qkjR9{pzy$rod*5kn_ zJ%75HkYu8YN4D~y@E~rwZ{8Xef1t+(s1<8Im7fL z^$u#`Ms@7jPXTZ2?BUA?ofq!h0}^v`oc->-sRn1?loS-O+t1yT`Pqb%Tej`50KYQ*&ZZ4xL-a>o-d)0Brt!zZo1_O z<1M=Eew^eav8Iai8`6KE`xcs9%B}7SxfJFriJxfCX37{WK3E;V1{EO-5xEcT?c;&? zcH5%6j;GYSbbxBb?l6_0JBcjx1@%W}_v`W<8VO1m75fOX)VYjH!@PjqQU_^{_V*+- zO-2PtNe-r>-cw5O#9Ok#>4MMG0WD-y|y+XmTdrsrkYfy-mjI;qL{ro;#l-HdAA4O3zDPrOT59Am%1g_BQKS zM=ZryCz`&~s)?wsT_PU{|65)AoW zAdG_6p0kf=N^VY@&S5QlSy?Ial7eM*>}2c5Z-B1@&V{MZ@8@xbghl_RpTpQxb1wb(0tDM2aCK8 zd=8ycxw+^g0;a5$T3L*a2QZ`BLpFq6ZcS)qt^l3!%f!?hjZOlOEZY-@q9+(y-G-mA zD`eOmH3vGD>m$1_1hp2_x$4&mv|Rc%y(SD-7&yWb0&Vr(k4l7#hUl$D&)SwGUTaXP z^W{&XOA<99m5 z6r>K*6d?I=_O#&z&-b+V^o%`)dLJ1OyZ2j#m&4gwMKUfJo;tf5=Q3^{zG}6B85dDh z?GxFLH#S64#u1`E8{)RINWxqU(%G*zsnehTM7Nsld`KY9<2Wb)ne*Z`6w@L}$LwKC zEfofQaWat7RQFn8;q02`xj!=vUG>(I%02TQbyYo*Jqgrke2tOoiT}Ae(Yxuz`Yhxr zV5?mu-R)0;=P95i!vWT=fR)Qx-`*&W#Kvb0ElOpEU{5#1GqFl@L?bje_fljY$g}qh zcf+#=VmaEv=q=hTs`nTc>{8d#(eE=oOrq3#LUErKDN(n$P|?8`5$sozznKk<1f8cC z>z1WqoQDIl;O%L8mdMNwX{K(boq6w!mtDo0LOf)jqTqfLOY^sN(K`(2_e7|YI3?Fwd|?m1#J+cpJZpRDm3ugT4-_s|Oi`&vhA~c;`bte0 zmA-BavGSqY8h3uI>a1Ot^Q}prbqkEP@)1{Ea%m7yjJd|-_d=x~7T&74pn&-_NO^X9 z@tY+qh?UECQ}#lcR5$e#(kVGQ)4>85^bS6U7|K|EQ5~ZDDCaxRLre`NYN0V zKx#a^5YI(@;2`TRSU8Lrsso=sumS<$&%*eEwk@|jRWp#C#AtJirugh!O1t0b!Dk!H zAlJAe9!96vU0xUP>GGY(!Hf^MK~)-2IxB`6c1!CRhFvUS1zqYunXK-oo<@pup9!wa zLnxdq$;RbiC>+yCd%-wz8&WXHQWW4}eb$mZ^?in-)Q0hgcG0DM z_x)xot)6;~w)!9@883#S{mA!6f^UodtyleED*h(;9@iZ)$Rcao`nC*}IMiNEkvChj z`YXf>8E>pP5c7_2`*ry0#50eY?p+Ni371EhZ}pT~aTbBRN4pnNg9@9(Ey3s!ePpyM z-AGkTv;2;^;7|0H`eAf=9bGn)-i?uHiAR$Ms`pfImGpzI%FKh>goOfg6RMH|wJ_3= zZO-;Tls%wT&u^mzcI1>8+A_I4WATWW8G4@ioY={Ay%Zry)taUMRi$excH%j8|C5z~ zgpef*s(tOxp>1qIc!||@CcwlGkD}X>c>#B#J6l>(R^7K_qtpUQBvE>$4mJV7HG}6t zm;pjQHnx(YI>`34nMzAXqneok37zW5AXyOSK6gEV7t#LFgz5Ceik9ID>XMVtq>OqH zfu>Rq!{jqvQ!z(2d_DMx$O}EF4Y72Ub}qQ(QVva{aVSD07wqJ+iY!2|YMXwdy`WT5 zcilmg*IV)GB(%-QKqwrzN6}xVx+H7dc%PP|SwCkcsW#V);G-+oSjqg?InRSgyjT3{ zry-K(joePsr-Z$g4F_6HdzX2;ULKoencB3uW6!55^J(p^ou=zA?l-Z+;A+YUV`}dY zB=u2ot*UJ7<=4y#&^CSyfQYBBkUjq$s^@#BGY99NBsZYPNhG65l6QNTQ9RWV=d{#i z!r~Xl2&30VKsNfR5=Yu=;a$Cjx}z3xN5zv=C)9LrIexvk9h1hAPc5Rmg+~v$xr;9N znyO%k>G{seNfO|k+GOKiecesf9^KXOt=2zV#vJwu@&V7>wXj1g%nf1m*U< zptX;}p0Fd~k=l~n+!fzKVb69}^0$UNgB8jrA%>u@|BApx!caQIQ#BBjd<>vH4xion z_@;Aecc5vy*ux~$2g1j;ue#^Oe#0?MIW_0zTQS1v;gVrH0d3|Koy^iO{sA@|Jpb6M zS6*-LcANiTamYi%O4!>#r=b{0#r*ZqXOB0G+x z7S=m9+&+2EhXifHVWsy=SW#Y~CMtj;?vG7&G&Bi%QoT&DpQ(PVwWA7&7$0qHYc8F= zQk-bKf~Pb;Ej|b{2%yQCiGOP0{TkVl&Ll4>Bi|H*lBqf*-zkH&(x#6#Wn)Qchil6s zger2J71>Pv`6P7@j2W>->##D*sCGIS{ifdu7nVdws~{ERr{F+a?sYOEOl=3Ik&Z$} z!qcb}T<0^TqnqS8xme>6v>5u?R{CrLSsC`b+$;{z?_FoQ0(NMf89-ImV}i>*2}uB~ zG*(*8XU@voL#>l8-3b*u`<&rmxIWa&eaE3Tb5Lx#Td3pNi!X?2d-1OB8t=1mk+#7J z!J#iIjhG8%}sH{d`Ok0v6g|4;;FCVrzb3dMoK$O#at9;H3BZr~(1@qe&2$;yl z`)+5!DI`$mDmK}6tM^lkB(@m>uP}U>y<#BGC(C!?SGh@& znl&LiV(Dkki}B`7GLqB|%R4uy26U+gdY0;3tP*p*QcIwFXN0|nefc{#^m=n=^y6i? zf9Uf51>)i+OGb>siM$%_CO(&&OyE{y%9)Xac$&t!xeKP_)h+(5vFPVPd<|14&}IY9 zNrI0rg)9?q!FlHqR_5`SJ@yq%zIGW4Ik&Ci9$B zhJUJ$;prB2+>M=(+jeOq(_zJR+TE!ycXp?%qPDI25&TutpeBa#BO*C`*all^w3QP$AiC0k=+)A4hqAv{&Rjg7h~=*Y|~k z?*BZs=V77Mrq1-g>3_jCl1~u|NZdfftkLdc&{es9i9tY6y}ybdX;9FJYzHqf7-r5e z+oSd>)0DwYCX=-WcO_8q=rKK}Q1?;$KIhDb!qHiQgCW85)b+jq zFGF}h2XpZKqr&sc)sMLdhdfBkxVa(j@Py{fVJ`RMTxMulNegsec6P(?Q#Viq6VN1v zFkwav*9M<<5!TQnV!dr=FCfBLjuMDsyuO~y0$291m!mf0#qX~6aBuX!os*8GJ4N;g zRg_+2<%z~3c(rC*hnAk!6!UbX%*;3Lu$7bvAH*HdcZwbvjQXgLUKP1{+7TUYMO>8y z{h`}`y=M4uKnOhcYOmp18}pQSjEqC@V(}&Ff%I1v&w5R?os`qvG3TARfXP!+s@N!x zp7`u_doQ_2JlkYCFLXds=hsKQ zovp()@pN2-6z!#Jsd?uc*qJWZ;gJ`qn$d-a%V(qQ87DZdr0A&E{AI(-y!xBr1$e_z z{_%oV#a7~)9n@Lq5DB*Hs>swmYOk|a((N)f>Z)@HBIGfZ`auTGrP8%Y?A2vZ`qUs* z>sBp@Kk)jfd@b=khugNAlx>?LSMXpnfdO^>p)!0gREZXA|GOjZgb3*zVBa!SXR1Y}p#LCi6<6R6EYo_G7*lcDQBc4QSzM6F{ARjLw zzJYgtKuKJKPK6DUgDvP-YB0D$cah%QR28QOqR0{J7g3itiH`DXJIC5J$Bp!%Np%bM z@>_*e%IH{02vQ9_3(ZN3?h4m-3Gga{7pry(0&Cc97t|kmF9u1N`Sdp^F`yY;u3_42 zC-TCVKH3L;?)MWs ziLi$j0ji21h3WNl=-{&S>W1@5KtR`dMT{7R$%a9R8AiTVn&9XvM>-${YG1yDE7n|) ztzJ^VTHYGw8)k|+9`ELdu@-!3lHS_*oG`p?*x?pY9`wF6^C`o_U zf0!o2p+#O8txWQOb>0?O70x%eKM=R~)6nvJu`KYRr~PfwqYhF#^SO&+tmw-vm> zZS-m4m@loDR@3k>o;*F<4c?}ux+_r9?aXVcC5xvn1YKWVw6?u)nWT^hCt4fmx?!yJ zqzgKCE1U@T%MtSIzr)W=;Y}H_O%3^;01+$lnb?$C@FTt!n4F>*?x=%+McnW&U9)#lxVflqInFt^D9IC!vX+ojyuAyhfYeG>jlalY93S=^L|s zzs7m(GO#tgZr608I@D1&@9*%33`4$sjf+}!jqq|i0W@K+5C}5)?fDk-5lCifDCbkT zJKGZTX^~XbuvXyGm&@7M4&?=hYU8)IX zYmC!WvMzr=w1Leoi~ckOf1vhH%?0>E;{T-EEmY#*ud_`}RW0u!mG?Z?xOSMgIXC{= zyg%nf9PqYY!lLG0{#GB<;-|dhPxGy~dUI$1eWd50a7?r9aJqNF!-ce_RaxCc-L@G@ zmN^c?EQ}Z?)oqHpl4=^MH$0vUhe?LMj?Rmv1}6(CCGaUojQ zaH71mwl=#_^M*7KKs?Hq*c+$O0(Q#XglPei0v}UMeN(~JtA`KIR`3Rk?aW)f7U1CU zsD?w3Qpvu5_K{}h`*C{%>N+#bA9z;zf#=0cg5P-lHI0y4CZ_E=Y_j)%e*B9&NqpPG zhz8<}Qn@LG%>Ce$lP!l_QWLYST zvpyDc+6aVU34fZSGv1qrqjs-5`NReiYsm^68iFvu&WZg{qz=Hd;ww@mMSYQuxl{J= z`f(rB+y--;dEL}~)ee_f7=G7<+zi*~IxiyUKseAb1WyS#GgH-SRmfM2_1U(N5o`ll z^SN?5BGv3{<&w8dXx|I@b@U{XcstlEbL%ttpHuubr+=oWVu)dLz}+y^=rH8amus&R ze&eh&PP;Qy+qy&TZ2x^djmAfP9bx6g>=tal3NNj#oI!BlOJH!%=M!rpedLmo z)@x|+AN8^vhw$${#z-M>kGAqH@+m(wt@CNKrPB4NOWrcRf5ukEGu7bR*k%&;dHk@N zkH~(y1~T})CXA*Tjo1Rv}fOn;ry2a;s0Kt zA6NJn$RGoPtik*he=1D>-0PRfc2b}*MGQCz3kD}DyoJc+G>f7YFroy)3u<=y{u|(W zX#M*E{Cbg_ygdtDWUro}fMekIk;_oP_v7M*>prUgGMyfL|B|($(s$Nyj^~d|n9uMB z$*sWL$jxj`h%}B&Az)j7G3NiUA{i9;+Q)lxg)yqPOW;nGjKB~&d(HpPr(MZHr)3b(*I`KRSrbE>w1V_SO0D_P_QzPY;^2Yyj77zSoc6}*jNB3sjpoIfU(~W?- zAGV&^Pj$VMFA6&xe#qhEd|t4dwXM9XGCW$=&)PAv;4aD=3>0)CX(VxIp2SQ2Fe?5V zQU0bU4ju{y5J6&F+A7FbB{j`og>3ktv+W7N8MG`oHm|auGk!R3Qy%1;G_|j+xzMc( zvA_2Q*IyqEPuF?j+kd+;jfyBbGY|N>@8Oa885v&Ij}fTkV|>|qR_7fa`!FVp_tV{r z|9f12qfb16>4S+(UXc59Mjn;i31@(^nCE5!6xt;5!ZFGY_!)n<8BW0P0a_)mKXjS4LWk1c%W)hpo_rPtM7 z)^cx-ece83dE7Ei(mb+P(QZ{0fZs!w8P#{Yi;W~t#v;KBBS^s_4k+e75D?h|;ssB? z5C=vf%cP_Yw5xzo!mQsKVR2S=eT0kklisZK{@93dd8vNlqyjG-=XpoMlRWTJftevpNgY$Fy zWLy$X)I5DeTe*p!&XD&eEPp7DcbC0<$}Ax^ic8xJUkk;UROhxw9EB`ycXVh6#04oU@z7Jj9z?0NX8GI5*S zk@vqmH_r?W*&3XKfng)*M2=4^=cjVLkN=|V`_^1%7;WXwBXOlaee!>d_~+9LWWP$i zVEp{zjjpV0Ft6ocUV+5x#vg-VW%m!pei&rozG%F|)n}&DZI~=!2`;U=b^E{F?g`Vk zrslP)2gouPuJAn7r6<()Nq?@mf5W2;3n*xIA&iP@vnG9u#Y=eOpb1A3aIMe$-vk4z z6wL|lR*bgqu{>|Q0NYD;HE8K>4Pvtq90%pE^$}Z8j+PF@|;TjAK z@jZ@f5{SMOw#C!!HMvuB_djr#zo4v6g?cUJ6&{iMsrjB{?w~&7?Wt60gC0_^p53e3Im;e9( literal 0 HcmV?d00001 diff --git a/docs/images/slack_command_preview.png b/docs/images/slack_command_preview.png new file mode 100644 index 0000000000000000000000000000000000000000..86ed32a9f91bfe32d3178cc98bf592a34abbfeb6 GIT binary patch literal 56723 zcmZU(1yEc~ur`cKa0u=W!QGa{-QC^Y-Gc>pC%A;*?h+)p1cC*Zh2XA1zKy*1-unNo zI<<3Vrl-eRPWKa~tSE)@hTshZ1O$qVw74n+1Y`mD$w7bv*SwDr=YfED(_$kgrYs{S zMyBlQWNBk>0RbT$m6idot~N?AyuY4fXpLAXjo6Jii%3R&4Ix|0Es9B&iU%z+6wg@G z7hOaF69?|Yd}wE>!Mye zVByW##%m@0CF}tJqQE$H=i#7>GgYbJL_mpg6aqp7|0mNly3%<->H#LFNNOYvuS+r; z7XS4tH7gwQWIwSe9`MXpVMuVJJvw~*je1crD9FzVvTEX(P9)X*jv!SPVWa(1Sj=Jw>fJl(LK{ zP|~U;$S!X(vlgXV&})y;e2_mzQT>)vSuBT0w(*AyhDYrP2RH_L)(XNJs!apLHI&( zz%a1W;Ow@mcd1gy%a0j1eAA;fb`=N2EX&);+4(`xoSuKj@CgdKbQDGIk989C4a_Ai zP|U$Ms$+&|20^eUTlq(jTl2$0a1{YAz43gnstkD>8oG(V3zyx8?~I`j$T?YI2SdD}o*t`3W6GHMEHwdIY&4LOYRR7X?B$|0HYJLOFkrxt(wq8b~0j6f{QN- zG;_uyh=^hv<~4g_#lR!6#J6NBgHVg+`(QKJWO8cy$U2aDru|M6+AhMQ-?i@BlK8Q! zJ#!15UYuZ5ckD?&s=9N^X!cWqd-YPMlg;PbW$aBxS&b-c(r#VU{9wj#?_YrIl^H23p zTa|i|S1HO=1<)hWtB&EwqJW@4kRZV{S+0@}HM0u*?@Zry52+8;4r%$abHjVJ}>2lIS zubIfSv{Z*Q$}}yy4ElVHQwuU=F}TR2F*!Mm0TJ&kc_=jE{`_I$b(Gjq#JdpCIir zZNqGH)aeNMFGEogGG z#u!an*djeR-Jje`_|y1_`OP{cJ1{zyJ5V~5uBCk$yJ5PCeXD&39)CPuU27dJ9td%g z5!4|kBYWaE5ylb_;7j5=vfH!!+mzT2vW>BS=J2(b=knw*wA8oopN6sOXP04HHgjEh z%iYYOz|O?cZ2_0FoP#)do9Qw2b;>iBDcgXnb2!&@ihG)~mgB6^SQ|#yT#r+yE2~(D z)^ngufOKF`{d z0D^BdQB32vv}gpCMDDujBB8$F;NmzW3LQ#*}Wgh&i@$ zp^uXv)pF7JdUNeKwOH@^Rs(SjaBJjB`l1U9;VJj1Sp zeVhPJ1n!s|kYDf~upJ)kwtu~PkGl;zO52~`s@^5uGB|wxF11Met$fOAX>rOc?F?3^ z$|!h)yO$)MCUUp}g#1h3zV^ZisQ@MnHWdzl#EFs$(=rjd|1iA*JiG7@eJFZR5Fz`3 z)g<^+rcUL&VRMeWEpaokA#uM@v#?TZWx(1*t{*i#0QnAq1v%)g2@!dmbzEwKKAsLC z9{~tkF<6bvuzZygOB#U3rD7oq2(->FckK(PsHYHL!XpjL_gib6A&`M02Sqi1p!`^Ly@$-N%ea?=J!RSTB5e5ymONm)Q4 zG4#H_#i*s6yxF@+Ly3)eD&G8b{j<_&JMaLA<6L#ad*uC$7>Wg=wV}NtDEyihH=rP+ z&^^gE`LX;-skw!>H5cIE(ybOKK3^ z<6g^DQoZBa2ddQauhF-)YR&IGbiJA2Dz_`IX{_N{tLy#dJ$Je{YIG7PxNNfV&3k-H z^U7g(h3TW4!1S6+r`tu%;u^yp@13LjJEui{wa6D_vxdcXTQfYBY4+5wS3&(nLw3avyY%G zk^Cg;T6DXT0Dk*z^UGr0Is7FG3EVYhLBnUynoNZ=9ZcA+oXFs5&7O*n=He zO$%)qO9cgpci=Jt1Z1QQ1Pr(Y34RE`4+I2sas&iC_#YGeh!;Tp*9uus0R2DZoZlTq z)Wl?D!2fDyt`-)KZq`ojxho2e;Gq_5)V1BU73BHNoE(@<%$-avn7tjGf0IA}y!pXJ z2Mc!-GH(ZaM>l?NL5e>;_`&7h)hrZbf4aEa2~ub)D3ggfxmu8MGqWL z-6;PK^4~b(7H(#)HqP!gPL5>1$2Bo^@^BZVp!m(`e|~@GY2j`2znmQ1{w)i9mjC7We<-#8FD3W?rTjlF z|6fWCHw#xWCkHS~ci{h?%s=A)+xU+V!18` zq^6!K9;{k_{i&PqoWD=Jk&sZY5h?F|Zw0wxwR6dYt|ut*@xM!WFvw7^h~U>}+PWNhlz$|wWOMNU$Tx*V`dABI zVLVeRz(f5Zfir*nJ?!uD6D3hJSfhV=z_2qx)$r)K3JD1vtao?5eWxz% zdGdogg;ptDrC3rXj)1Es=WTDh=Bn?_q0C&F0<~N^BfHfU(QXKeGosx{v1YoM~XYxw&D{(v~yib#@r$Pjfl0 zYWF-{%0+$nkXWtPIyR>yRDG~mp*Ea^bJe&ZV3>*YZzo6G5mq^&FR!mt2M5J_t>e=|ugCYmpqHlxmmSIB?)Lu< zrjsxv$5I#`l_+tcT5r5OKk(g00k3rbhf8|V@17+7=OS4=PIsCK({hpVo zsA$*~ufs}<#-8X>JgE>f?3=fVRXUBbrLt*nM}Pjbez;jQ0u7)Er3ME>z<1a!)}+M~ z3&<)fC)RvE`d*RJQ@lJiFd+6ylr$Os@7|gF{^s;;klSv7F-yR!#(ud$;`Vf{l8gx8 zt*li&naiifo1c=JN_DkAok1xTPuIAupU4G2XlJY1?R(=2aevafF}5`jX|X*Rl^wX; zU_s5ytf;k8tz9pAKg{`H_5MFTfiSs_AZf>`9p_TQNlRpNM*Yk_D4o; z=Q*0T31xaU$$z)0?Fxex`R9}qrJCrU8fPsEW4sxI<*G8(Ki7A2N(wBB0=;qah<^mN z&mbz;MA*xsFr1y7*uMaG5x(3zYcIE3Yvvy476@p7$7;+eTz#{=R*SUo`S z_Ol$VqgdyJ9;-{vigiSS0?<%86@x6Imx(A?$tw2F(l2rzt?sLe!=-#acj}rJ5K2A(!SeJgF@?AfJ9d`0l+M z1pf4+T=MwhLL=dW1eE+pQv7;(G7bgb_NsJ;%}`VaI@6S*mq&&|^XPmi|_ zzHF2;c$u10pdv->Q0S1cd?m(f{?=B&T=Ol~0W zOoa~EA0A#oqAjsph0**mxkJ@1yPNz@=H8XiD%Et6-i}s-TqT==LEEwJc6bFcD;ff7cV!vvwqrq}(P%qWs zkX!{j_0ag79Jj+dV?A4a#oksN=Xg3(oGZ~67m#16dW9-)!C3*!-XtZESHR{ZyZMng z%H`V(g|F*zSzOMp=y%v%E%A6slC<}*NN>2BP+sj5W1?_HE>lX_6+gzoH(p;|VFv{T zjpi{$wpqHQh28IlQ*wT>m`;j&6BRN0U{E6aA!hd)V-!D;E~bTcY%#%SWK1w>JHm3+ zhf^lqQ7JK1HnOoXrE76a4CmwnmJ%9mR?|C?vA6C?P{y1th!oF1+Q-$zigsTbm@%^# zb>j2ol4k%l?8dIhkE3actS@!Uh7JBoUBUU|$p(lYST4VYo;F-S$Vbr~4RRs6GQ;^2 zv@;wY;1j!9Q0z^SIpb0YCsB~>7a8=m+hzG|%`|84l}$s-I$-A}wDKU7C*;B_U$9k> zQh8O2uEu*s&G?&|nqCJBkeEu%DNrDIY!AU$q%%*^(-l^un{6KNnL-Wzh&3GtAl*?oT*n%kJM!xbeIC73f! zEMw@KYp>A=Y$kSA){WcOgk{@I4rk`U{$&C6{EDv)MK>mhJ zsq72y1)Uy_znx%XfU88n@$_V~$YzZwMCicU0Lt~SoMIlJqKSs`Fe9mQ^937P7K&{= zNf5r|6o%RtA2NP);ICG(L+}>$jR~Fc-Fos-e@-s($`Kxsh7;eq#t}>Q_VzZGg}n8% zhNSuJdVuv>--$>tk~2WWDFt_HhS}LGOwUr76Z;z{HWu~{>%l5g2g_GRf_tTJa# z&b(>h|EN`A7~WrIOcWi2=)1EwSc{;CCeP=Zi2CJ!D1uj8$8WO+6%uH`Rf4U3p zu;{dRBV`IXed=cs9`qIc)+7XfER4Gp*}&i}FHzOC^@^1F^`{M03!nh%*D)_OC23Tm zm)ixx0EBeS2BwcF!LtY;yTlX-SV1O%C)di0<`9}kxnuV ztW|_2W|{cyNhR7~NCVq>pDjG{==xG}=CaYIn}XNGzi`AtUM!s|0%0;oi0rIq(I}y`jAjRPKs_yVSLJ^J()z4Ys?WL!GrbNP&q%3R>yQ%{r{c_l z@j0q~9c=(H?6z(MW@K|!%9T$kjU^AsQ7PpCE@h{+sQqq_FTebHHh;YCy+J<6ZFdzN zIHEKPxM|jJL-)W^FfRIiQN7+l)u02_W@E13F_e{uAJCG0@k>Lrz=M7tAU~;D*zP)# zwWCMP%mz{Z>svGLjFPa2l=-_G!tW^+b7c%-E^clq7`-nM z4|&t>Y{L5bUB8{oNlO6dS>rU^NGv`_noQ|@*2|M!19G3f;_kQNOU2&1Qfq4rL7tmZ41HSytXN^+7g#7{#6=}5B;jRsz z$72&4Qw0L-ABC9b?r>y`hX@40yYc`R5!2JFkqio4dFIjUcrM>$}@A9qQ6{BNcf>BahUV7GO9e0cXuKKHj zezwhPELOj0PR@nzcF%p}mAu zLQm%(yY5Xd^%H7q6KEbl8Afv9uAma%=FfLkvL7+^+?>$c^w7_5F2b{3bZpj(N;x}f zD{^74Tn2L4nu#6Z>pAmj^ZlWAgmmim-Yxg_b)j;Q;L@q^?)h`rEO(Qz%R^JleCL!t z?)KLQ>F@GiOdBA^L2wW)k>&Kum{QjskuUr9OEu6w8sqoRhg`(q&{I$bz3xN@h^CUY z8JjH47!9rr%UP%UU7dKT>(-ZVZ*4J)h=da*&@DS}K?$Vu#CL-HG4ZJfVpwj%;uf%p zX*5?aVnL*Udw2_G<~B>(tDCE|cN(_QJei4&YF&WUJrx&;a(B1!?U4cf-^MtLG$cj_ zw^X?hN_N21vO!x=@%&2)OzHH3jv>(@QhtrggU8sqNKhq zA5a|6MtUB4w2e-MYI}0i*?ozw7P}C8t6?aznQ;1YjAffyl2nQLr^@4)SmNTy6pEcPTYZ%bUyJ*O=l%nXyblO`30)^wvnvPN~;;n>haUFQ{Sk zw={iTW0RYdAa$;Mu#wfYC{#ugk_($a~AT=Wfn9;o@?Ynfgn zBGwd8l1-4UFOsQI32nIT2|T6h2!eZGU;7I=pv`(g!h-=)}DHN*eG~ zkv%(0=se&&OQ@2PC$f1e6&zcN$=!mylcwif;Xt$HJ&x(ip(81-EF zOGO@Z|G)sX(aV!|#a{SV`Mpqet(~2sp~(Tg9+Ky4C>*gFYb*Dy!{Mou6kvE!U3mP;RYLi5+QPjb34vT zk955i5cnlVnI{xvn9is}v(oD1HSwiH1MPD!vL`)NbsNtkAj!tm1(K&+_uzAOoE6Vu z;YuE^0KuFIJm^xvv)~$ekP}iALLo*|`fE6-)p9+Vr=uSEsdM>Jn^$i`?_sr~_uBr8 z#TBEIB&@0VO-9b-+)MRy_CZOPm0zRb6KJD)&!^F%OKWEZf2P{hxOus`r&kMKIU;Kl z0SK?ishJ?32e{F7C_Jlzg|Ly>?PCO|PBCx5k(|^httCMd7je ztSSn*$H(O4;n+ule*M=OAUbHjeXs`unpkeMmE4^Dc5}qT`?OS=2ApFstfFIenL|`B z!@v%(a>}k$Y0L(PWo{w>sxvpLPbjka^lU}+8BlN+r8bt6hs``|EpMg4p&^g>;Dfg! zE8%Br^A2EoRK$P5Hlk5#g`xv*?0^W#tRnf-25VoIo6f1Vujl!dA-VFLm%|II!Ata?H(MH)%E>_P)FrE_ExXohKRJt{*s0fX)g+USKIT z?djAc6S2ANd)8h#tFaV0y`tA@Y5M$~&kc^3hA=BVjd{+jgMMzG1GD@I_Hy9msP^UO zPcde4wk%^Ekn{u7T=STXfnG2D)n+%+ttfUV8h>TV)!kqe)>7iHw+MEZeTCyiw+X<{ zh68@?XP^CW+q^3LT5B}fW}iTkUFl4u?`=3qxR1RL9>!v1@2l7^#gLGWvTTzoO04Gx zUZR=$&s2LF^K@KJZ1ffv1dbLT%cQr^hixT~bjEnQXt5mEI!YbiwXBy{A?2@JHI9v1 zDdcc^`pY%S+PYL*X?75d-YR|MZ!Yy|gzwulnBRfh$9?|>dlq1G>GM>N8ZSt>3RK1! z&QuRxq09ETJrg3+_^cthVx&0pBdEXUi*xm(p3(BkxS`h3kH_XiXG$CXSw(4*$c66k z{O9$KmP-?#8bQ@+7RNJ|UxCKPK@37|sf??{#M%Ec5#oW3=`?J@PjcmW6!USxK%|5?O{ImzGPFB)*<>lcc3i2g31V}SBg!CE)Vn1 z8Jk9mwde6wd9?`&o|l4naS!1NKe>XUm+HFoyUjQqSEctRvS?A1nWx-NL#=MtItPx2 zA|llE14(ZpSJ5nQX)o6rJaRZYd+C4pM8d#grzRCk$}P{9YQ)sQ8%4%sFv7wWHW2<` z8fQH^YiI2>B>C!b1pX*`S4e{On#+iCRQy8rGpE%tZD&|X`b3vYgVl2W$45jr1D++W;0QMjR!xP(}hhR2oa6(!yc`V3k%{djLQ=ICMH zl{I2G+#12PFf>1d9Y!-$TFqfu-}Fc*^gE=QNYe3Z?#Xg1J|`>PELG?tcP)&vhO9=* zQGfKRv9>)9ei$aBp03!4$U{K;)z3bb4{;{i*5s6d4+^%%7P8LHiO@>2*(kz*laS6V z0Z(sr;PGo-ZiH@^^_JMM3zj= zX8ln_p4Q~S+s)c~)%urxg4L$0bvmO_v+M>NaPIEzZtfYjQmajpFY=e z5p63YNjgmXR710`_ur<@KOJ+ zz)~bPp?nBTe3@Q0l?{%CE}9r2!Obw9h2fVk;fe5j&xzcn#;2CFA-U`x1ex;$%gt`B zxxfH8o5{uN=(mU=QS6ci&57-9QOx+nh(OwWt0zGu-n0c*y(QnmQ@{RxGHHp;pNX=M zC?AjDit}BdIrCi@pnh?!^eTUO|ACa*ZEtEIFL`ga+>3?vm%pa#qukSo^lKm9&#=d{ z)n>UY{${S%DxGE^BT_gxwgJ7hEU0`m$iDbVMdKIAT|b6VJR19^@pU8xdLT`KU^ce{ za>yoW)p0iB>xW+@7Xc{swP$S;*&JFww(j5Boe>XXpnZJ$b++8_X5!;;2H@r1>=4s# zbhdP?q+dD1WrxO8%~C>s&nm6oSotkZ&}%>wKSWQF>FYNXd@lSenrojo@COgAsG?W1 z77Vl3^mn8hd}580smLS4!%|V^4(JXfSAAd3P|@I#huN0s=_AGX!66yp{F4atuXRov zfdbBR(Aei1N}nQs zkbv)2#Hw@jVHg6H=J#Ol7mR#0)k=*@oCzhz#Lq7(@6|fwWzyb7!H%yMCz|=3PLZ}Y zuqO~z9-sd5-lb4X@)T`{1)q68+q)a)G~ts2TUhZkK!m6QQYD(Um=Ot!9*vEW=q<8n zt7I0#(TD^B)l$0)BYbl*m)#=8B!U6WFW-Ev@I6L$+=V&azIwPH6bYeLbv)4HN`=OV zO=z~>=JHdC@$JgtKj3>!_-EV-J(T7i3T!nhN8U)^P@R)3?do@WqBLn;+JZr$SN1vF zXmYuRdYOj8#9L`rlnN1`Wo#2098aAjkWTAgC_tYy0$DrLF_Eo_vkjb3L zCxF;+d5J+z+__go{2sPsn9CqPEo5q3F6bp2z|laI6%Uy-qxz@^UpsfjMh8|5WP~rv z9|rbFlquwuU;u&SFsi#rA1I?sJ%Wjv3sYE?>WevMzF!8uLOy;3wq2vaLzKERS2k^5 z&dVSh+iF5)q7?}gq-Y1Wo9!#2_xHcs!iL`}$x0Y!kwI@4;1}2nTKa~US^2U>TBA%U z!iZKKl5FE5y_h<}myyUpRxTUHC}kT0{3LD7%QD0VZ7NzOV7Et9Jr|C|#?MoaY?%_^WWGRrXsTsnHGm`)Md3T_{A2ggF!8bO6z{s%{A4?)&*x`9lRYt=umY#4h z8xsa6ZoZltg1kRU%RiPNggPHiM8Bhb_e8z36tr3JmNAv|$|9adsaV zlg6M`Nq>lpN0LQ*G}5wD+|3z*zxqasCgvHluE6K0D4!;yVESimh@|}2*6C8Z#F>#j%`$nS!)w*NfJ`{gG zP~|9EI0AvFMZSozThACe!G1&Eo)t0ba`?oG_pM;XO2d-kjK)CV2TdUF+`%I^9o8Kn;uen9FIIynL6m-?nlG zDbZTtRP;VPb^fGCG{}TEmaZYKRhD9fV#tkzQ8FFnNPl|jBhp@y3%Q}FH&FrH$2k*z0B2mtbIjg& z`Ha_k&>1n}*ETRjq9waf=<#Pjg^^HJ1qXAMX}O}($Pp`6JfV;XZ0|BFanIE);idO5 z>P))XeCp#5J3$ZNy9Yu$3X(~yf-+mMb2m%k$7`7S2hXbQ@-PM=NBcAcQa5V6 zJ)*>hc(|YfhmF3r9!`1V6q36r+F_<#jHXr@*OKNh zZ|JzFzR(oJey__Ex@uYs^@vbVM5G!&=^ON%ygt5ZI-J^0wy*M9@EV-% zkG9eN@)&W4W9a|YjscA!{<&KajltmSj$7rFCVpni{FJ8ArT~~--cv3}(a{gA=LHm? zJuHnMHS5YnCQck|oun#J?mudv`4QY&X|5C8sq$6(vN=_v-Zoqi-b{ZmbeLc14?p2a^#`c zgk9XOx)i0*q+w|f4fLTZUFk6%AMK^iu7tMB{7z_%@WPyO!@28lPVpi;=_%@y*rBC< zw(jKl@-NwS3V?}?_uFrdqEGspT%$z?!yNLgE!AZH!W{O=!7zu9i!^28e_;-J!eE$# zUs09<^2g969%)c-PKd9d@hbT+#w0|%M5~x>Od~Tj(7usgT{}O7yFbW7i zb<#gEzzxRbxj$L|hv--}gpqavF`Eg0h4J$H6)Us$Z_Jf7WG;-q!saU*UJbRYCYS z*C|YZ@KhNfY*XShIgIOKZ^{_I(;UyLh@UmA)!E*8Q2&j7qtvt3Zs(#uu)*B+!f~I2 zg!Fhj*Ps6|ZcmIzd-1hlb&=ty`umZuP4?a2X^4^ya20&kcsHKA%t5t%{-XZsd9q3& z*x}V_(oghOU)mLBx9-qw-U+9baeM!aHjjivt6MGs9x)0L{Jm{JwBf&_oP3~Oqb_p^ zvnP{4v6{{~LUvSah!fh&l$9wC-i#1Gf)K*;>{raPr8aFa7OOJ$#jGTi&hRPvd)pVU zoprni^HrCNi;JY!n-j_un)q(!i>vF))DWWpax2CBb_&5G8l`mryZZ>*<%JaK*vN*| zh}-mC;{83$kw?dqq?E+?Ff{Nj4{HY@%G8wN<>few?EE_o$7`&p==k)z^`QMSyfqZs zJXvwuPox3YAyj;YF7khIOs$Y1;F$4H3~tJz@13hUIWxHojw3%y=nFr6t-qHz5Z_0> zC46|KX28XDYgd;ZKU=QDJy7+NNeK>JVPr(a7&vnSqTtmww8l#38y^~yaNQqe!e-D+ zydmV4E>|?zt#17#Ge;9gZKt{MJz1^aknU4~`FNg!wQtex+1?h7|K85gj&Z~V;)QB~ za3JCcwsVEOA}cLTMv}#38bkTL)s@#^s}&9|Dec20JcXj;b41TI9%dqG{{GZQLJyh1 zuST|Bnz}=xF|y#m9F>)D@NZy5pT7@?qK85IQ!snfeHcthlG4$nYa-tYTVVuFCd*7x zPq+SHw1;K3=JNxPjT}Q#6eC@L%nD)*tK{OIxiUy|NWd@tIJ@>+>WApxqR=-T(TD zY;YcQX!><%NaoHeFTHicN9pOwA4F@-KMlC5I$r5D>Hs{anqS>zpuzi7oa(F&j*lb7 z(pK(~5@Y#c1F3pKd-3TYSwTL1>UZnENJrMYe}RTc;fn2Dwhs=-S$eLc#fkW$tv1LF zgUuna@B}S$k%=E0DZ4L0V-*WCJd#ZIG#t@>TIsQbLKHHFs?+eb$=J%x{+EgH4%(`vCb0< zB%o0%SL{4!XRRdKTLi0@wmb9@R+JC&#$Z5=E8}Hil`d|L_|fhtOjNw=dvz2W0hMdt zv%-(b5JmZP%T!YF5HhmzYcT3X;x6;3iuwH1Nl8f!-lM8EvrYAh1+CWW@-&K%a)8xU zF47>@VlAT+M9cZ=v?e8?W8;XwClGn$^0+KYoCLcEa|4BLyNGV;pN8 zvM2n_%4I~Ct8Oe~M*$nD@x(vmG<&N)pX^57eyiQkyWG<|lU7$x74+$zLPRM-?K!(S zv=fE%*qgwo{t3nas!T>cbX~hD9bE73s5V(+Siq28lairv`YEH5@KPC}Jn7Ck%I)8=?7we!HtpmZ9$h ztcCq}dhN_Fma!Y^JmKh2U_$qVLUV@dKNQ6{~hZgrAj8lXp}upC6nB)4LU~G)g@ zOLB#RNU~+fA5L16KFc&a-X!Kqc7b7_<+|K0lLu<$L)Z)t6!9c!PY+kcvDUeATA*LeLdDN=waV? zBrGcBIuk*NH9tQRCCMlvAyFpfMSVL#f%z!&AhpUQ1oSS;!OwoG4ouL1(JpY?{vZx+(rVX?g6_N-^Ot5LNU91X!pqUuf zp14x2Ou|>*S?TbINqwiI3Ro2!Tp8EvGHwxY|CyN11OO1l2z7iR;sI!!D2*fZY`wo^ zealS5IGjKV%^|WwrtIgxf5HR0+jvb(POH|S8;iVyGBa7po#2tXzwe|#$d&5lP!oqr^6f{!7(U{ z)uc)C`SHlf{9DmbCM{yP%%K(fmH2XupTpynq@9T$CFQ+j_;6L*Yd#xxfk{kQ919L>Z(U9<8Xb)BOo=dQ*9kNC zRpEv{s|CeAY8W0Y6P5`HS-6|$F%DnjbM%=H)8|o2J(GjsylM^!u{%1fpa*G6B+k0; zP`FHh)s9m4i1yRttVULrp2BZW4UeOI)@tD7T~Y$j--vCWgb5ed%H_^kX~7qL4*w1a z?D-L2QRe>DtJ@H|~b{JKM) zaHCKD;#2tvF>*tt&FkxI=yVQ{R`0e=?m_CS^tboG8NBzb7-t~qY=-q8O*YhWePr<> z0(I~;$~!b#q)w#NQ@BOUKV_Nyh|n16J}DQ9vJVU(u_rs|wTAW?^_fDmuohTnW&&yoLc-lg2${ecz>}>mC#yEWa0h*o7} zkvNtXRhQ^u+n=PFuWYz&km`*tA#Uh-)^Gnn_>r=&K21=Ho9mli#lVZ1LD@=etJUFq z+YSq3xt|ShO#HkBSgv+QDWwvKk}oX)7K?@2=pO3n6Y%ciLi=nkU;IbHV<27G`909B zPqR2LYSm+;`yFH+>=`jnQ$xb|5yY2l+j!Acr}DL3n6}5ys@hSt&c<0?B=Q0@NUq3} zEH|6cCXAjyfN1y$ALQJf<@0GtCPMEyjSysp82yKS(+Tg_#IH?QqYi(I6Run)2V4Y(#PKm17l zY`48f`uA&t7zPZl=y(k&yF4kVZQ>>5aZJ_s2?f=!cT(xCL-6@ALb{=;sP^8&(Px~8 z@`7xchX|jPUPQX~m~;(9yld6+34JFm7H^GhkZ!GBZ}}-N+mhH_(a^F|O6gtrc(dT3 zUqSt$ysQ>ltdzFie?X32G*CpXlF%JPEjp}0km))DU9c6oSSvM(E~@pp(mls2v!7CO z-qLF;GZP8WCE2-t=nVR_H(R>_f6lt;8N*lhynJHJOYb)R0ie2<^`kpr8f}9iMW(R1 zvy_b|Ro8bf>yO!!X8FA^(~x#5-_ar;T~B5^X5|91JuKGN_w874uJ38 zM^3#*ZdVC^jpZT+E5S_fG32V9YN;)g!Jd382Y<1np1_b#7TvLhPNQ%2F(Q(j$6QG_ zLi$SfH7D`1f>k<>nPB7TiACEw7wyk>|7<(hHt9ZKkbAe2)2^TZ^?vhlwxVs@IsQc{ z{i)@VS?TcQ>br%BE6sDcD9G`C{&Fc@`njG3!4>A2h59Ulsa6a*i-VnQiiucE# zTHSkh`pd)fAHqXJP5LK4%T3otXO2O)&}T%sz0Ov{vEN%xo<`!{`NTgo>M0!QZlp15 zVD^8JU_@T_skY{MV&>83`1ZO17mLQ6LmNoM(`>icA3bcL#a4DiJ<&60aW7A6VNCd~ z629AvNVa|}%V#~Z8qsZks@L}ET)?O*ZNdQ<5Zp?!?foaYFu@4$5SB^$&nu> z;!(B@8xm>*L%vHWQ*Ny34m~2xcn*tG0kCl_{fTLNxu-c}F52puJx{QXh^kH^I*cv} zB!C$ex)k=Kd0g!?{)G-RdJ%U*(^s-yGM3)!E@o_{zQbPJyfYVxEPNgd<8`!V>zdPe zR1yFJ%Q_2!7KW}z^XqIUbm+}QN7>uJ?LqqL&Yk5_PZ|7-GyLP}_NZ2karkDG#sM9B z!~4k{SARbuLp@&V^28^nsN|tiMucK)o@Vdcv*U{@*O^EY>u*IcT38mjsTWmkqwR*w zz1WMl=0mcGWVKPs$?mUws_V=&u^r zbuOT;;NM*}oSvL5^IY|V(?iF^X2wJeg0?T<93JKL`162lsEh9a5&{=#y3^}R=p)m{ z%A9monWgIish@7ekXenUPSu&WQ-D=~S$E^*UiXc`Si{nW4mfyJ?RVuD0K={h-4W>G z2#_q5#h$;Q+fR6>Rl~@jRh9e(d%RL@`YGgriW{gY`Em>Y)Hl@r?G9@YGbEyW81cE+f5qVNn_i#Z6|m7d4KQy5AKg= z&Sd6f=FHi9KkK#DL;Hg&hx{*OUPrS*UCFnnU+b+-g(&ToIlOL)15r68AIs?+K3}r` zh-^b|=e}{7gB;mSS`28e0+E` z)?41^;`-6xOIDn(HY7mUa%yyG^Kl`<|1pj0sdZXK=zG=tbzc8ffj{JsG**RBhAV29 zswdZJzD!d!nO?Kl$t3-dAu~n7M>Y;HDTx%^#tlqKD#G^lTQ_chi5{>+8jQwUd{@0Y zkVgYgyKqn41o+Rw?-9nWIc7xcrwf(8l#IvI3toe%RZB^ck&$&Zf*eU`u1)8vK|*Cf zPne`m7ON;mbJc4t&sX?C7ljOddH~w5zqzz}^;w5dKs!yZCOr&Z?@}CZa9L-QBOFd-&pK1-39U zb--0{!R`cxKL+T)*Qz*NE<8&$8p6Q~1Zs6YgRTX!dtPS37_vYe47eT-u0y}!r!jl> zRo&Q@CAWfP80g}&J8{@N_&)gcB0Z?&w&PmdDNi=)1UhqU4l za(q-e-Vb4!{&StS)5NDq?n0)}#dq&9B8f z{!~7D-yCB|QpO*)R#y$pDs|$$fnh3H!}$_&Vs{XDgnI60*gzV{D-RG-(geYv$>(=V zi~O}c3d_JoAY0Dy#*P+RfWnb~-z&n%Nl_>mq^#NcLL4`qfB{}1NI3TMq88WtBt8EF zx9`r7&v^};&F5^TMXI3);e6GPvAiw+Vk{v-cqEx>d~_7V%;DDD&;MDkvn+VLY_-tw zSds9d?eEk_{9%rd%7LzK9i8^+x)KM}EhA5`yVHqjd##Za&Gq@4G6m9-A$n4la2HI{H#DBM#vL>fvt-)rd?huZX+{H;G`Yk^@W>lyg%1nwm* zXUiR808U#Rn1kPeB~Iv)+gT>`MYTeMPLB5h^JR<`Kpomq$kJ_81CZZY?@XwaS_>;D z3T=fBtIAae5n_6FpVjCX!jL)8nk-g-1S5XJ!y5jejw@7J{t|r`f`q68^Ntq~rT5M6I&T=>cf+V?+1&YD( zE#~bVak<5!Nx6S1Ps|}*^|&$&r&ffCe(9^DloN7g?Nc^30@l+(g{BexN`PCPRk%KH z97xQQ6KT6CDbG>`7|X+-pB9E=OLmG7#`cd=uZx@^4>z!rG}(2=6Ds5B2e+E{eldT6TTfmWIw^Zz2Gng8`pX);-AwD zzb~oR8jTiTv>XJaIUs5Ql_-VA>k(Q4kM@9QNM`(n5PZI)bAG@IdvgBH6S@8!h5`8StUY zJh+`-oJ7LUVK+m7Yqd2;Y`;aDsYuvIda@>0XLf6RZ~5zwAv75p>A@k>ASicXz}?Zb zIGO(I1KyW_KnaBSebZwkFN4zxpM)QplPtLha1+T>SJoZM(DJ62?%n)kY~ARH zIC3&8nyFu?pP>rLwDh`}WJT6lD_27`QUz#KilTgu@|?Q3=I(9Imp^>$e!}}%$#i*5 zPcyBs0|U#H*U!WYt|mv6bkrbxl)nInacYM{I->M@e2O_IXig?7IMQFtLe0-L-kGgRtb)@L1{3>r7gU zysuaY>lAj;L4F?)!(R|_Idc{HA@DB7Z-W>`g9VEx_!F38{g5y$mib=^SK}hXyx!pg zNgpP4Q%wW(4$2^-!f>)mqZk=KhYaErOBLPJXh!lrUaumt3v;WQ^JExo^2tf|co|=@ zv8aBD2I*!hNo|0V4|$gVec0z5@wX#DiWLcBcMqjFKw~Cmx_I%qs#LC2lL#8Z<8d)v z!PyF75~z18%TYhRPJs=f^mNy~pk-whZE%%ioOxPu-Cj1Pb#!99q|0ccp2g?!Zf}Pa zh(%GwjmeH+S2M3u#cYx1B+gZ|9WOmvn?^ zJZ=|0r{v@mhs>GZCYQ;iz5EMOvhSLp7UyWx>t}zr^!M@%EUvil?fFJX264_$4D<={ ztvZQP0d&ycBn4)F)ByA$HZUmYSojNb`5NI7dauC?TrMA>HoZpY%9Jc-6)tO_&la6u zG5bLVD&&Tn!IpYAHOr-($jsirGys+6W%oBkO503ix-q+ruqHL`b}Mdu*#Ey-0Hy~M zS%^_*$f>LglmVn*7PG|-Xd%nNm3~Ky^hQu2%R8?G!CDH&2YBe{^sn8VEh$now#OnX z=jtZRI+6pV8>D-g;x?-fdi{gTRLj#;7`d68-k^Q@-^P?83>hZSXWWUr(gnp`xwZoA zkaE22zz-2J1qHb-6PRuLzja8*woIn8U})1hYtL{e7{tq8p?ucm>BGvb zn8qNZ$gc|w&$&!Fd?9ZPgL}q?>3nRt_$s>D9=(r3@l~Zb@iaX_Xs=&p>AqN<=qu*q z*A6}5!Ws_r1^T%L2879fAqt@VGB9X@_Vhr&TY|sd`WbkTy*p32(5X1f!}SHGN$y-FEWP@Jh5#mAs5`pwKv*^<&Ue~nY`)zBXbWSWat%d>c#4ZQ0) z0`uxSo^%wn9SWcdP5XHWzDfS^V`QTBFC6Wb-5Ioa;oOxZkhJr1f9&Cv3`}QQ`pw1l z@?uf-N5%(nZ9>hD-nN8p8H}vrm8jp*eaCJows(J0AmPx_G=HhX196N4b<3`;&7468 z-alZbUn)_p{pKdZ9_Cg!G4Q~^Hty(JR27B7*;!IQv64&Btc!vr_3cpEYw>m;Be$kp ziI^2(1w$q{#>uj(ER56VdvT(#0fidIOS%XOCzMUIds$3Mq6Wb882J}-bw})JehO5 z(k)U4$Qe1AuSqbsntw(`kZ0+5zsqcR?mF?k_?wV2(XYmWrS`o6DD{+n@-GE?V~>|P zELZXn5q0p!pnItUQL`Ll%5)hs6e434HAwgf<56I4&|C0mdc4pO@y}am{!n1U$9%~cG_D7lj%VS< zihA<5QPty-@7^K_=(AcO&vY7alxK0J)#pcdjc^Bc8*ZoYd@w|&cj*QiuOLv3wxl-hP=hP12Y!gE->B+ z;)QPO4QQq$7`lx3e#>N(9vXN(@Bdcp^7cAE<51fZwW#C z{JENi?kD%v6RP4kwh_cmZ3{u!P9$c_6${e-;G|6+rqiP*aZRPmm$mdKz z(14!2=th7LmmS_LOd^=Afka@A5N8oMP47#Nul^c--Z{r#={QF81V;h3uv!l7ow zm;tQo&_%`Tc|x1K*s924-{6z%mPD@}G|V>$Cr90>dgJ$l#lD$O$_>_KMXSc~>TY3s z<6r}0!>&b<-u^HrI)Z01b7hi`xtiMLQ_QW3VbMUz47FZ0C* z?iAwlFFhA*JG^*-!|M-|4z_eqTZ2mj3I4RoA8mW05YHCirN%^eIS=goRcD(#Jq0|lz9oxW<>j;mi z=QT{pG=>GERp|qoHmaKcRS5x8qCVh99_foR3I7j=U}gav%ti+bEJpvq4{4YHlfi7a zo0k7S)WL5o5@0scTJEKn|MSX{{{Zj`={48lqyJ$Gge)WgOkr%zr{w&6xk zuiL$a^Y>w%uJ7S(85!+&GqB7~H-$7ih0Y=eH+r9s`+e7_r5(wj5Vxc9dyBsx%b52D zFAEaq z7huwtBATvLEQ_&7Td7D{63fZOWA;K%Pp=46$*6w*Nu*V)md`%E&TPMbXjA;{OgDUz zGOzIU6{3qug;v>qd(4eFvEA)foIg`&Qh=F+p9WVE)2F+qJu54#NU!&6XpWNo;RM}8 zXZELuF) z4t8R+Gt^ZgFo=fzAiuAlEDY66EWU0`+esLI>?KH462YzYRP|>6uMKI$>HI-+b2BF} zhSc4?Z)!5uxs5yqbj4Xu^3r%bUL;*iI-@cm$~~L@rAU>tUpxi!Y5v7$9335%VQ1Yc z2ndVV2R!VbpVR4ha>>7Rex#F4erKB?Fc=v5@Omv;279!~ zMCp$h#?43->6kkZ3q~!IImz$?fHtd*H>m*ooKk+ZW7Pd8kAlh2?(v#*D9$4 z-2U_QU$B8QM}oMyyAJ^a9N7;~qw|-7cpe?0)QO#bDk^mgqO0jGambjnMDR(@mLq(^ z<+nNslre|WAYknr5fc;h4~~x{`(ZqpMl+tymXs3=m++dw8mH?1fG)>K6b$6B+?ZFX z7A}_QQZtrv(KNMXQnUS@nvy?8kTE-5uo}5)<(n1pCU~Z)&n%9Iz+TAa)3d)jQeY$S z{(NszY_kS)`vOPF%c})YlJs2md$CWhbBFP=X-GM_D^mf8jj?XG2csrBo>bb|8^O<7 z!RuQ8#JopNP%LAA2hi!sWV(z*`pjQD`7xv0y>{_XENkBxvw#qhdk*AT7Pq=UDQV?M z(&t3+Iy27CnL-HzEWiuknNlM9zNq7qfIhA%UNrKJjG9^!01dF;Q4hV%G^FCeBV#+(39h6SZs?6Df!LNZu;PS_|Jv3HnM>+Jif^|TPjuvLu&2n_Qz+!{x$KX8 zmCKGOGI|Y|*1sVP5&?fo%gf7)jF(<$!@IN7@u)+j7KpLKo4+YR#+U?palPyoO0m? zK86b@qM*}i&nk5)d{j{~h0ArnFK`nhpc)N&Pk@*uyjw0apc2jrcU(Gcs|WJCjI-fz zClH!IOKnoi>6y);{rWE#MeF(Y+D~G13PTVFnaRJh!@Or3-xPcMSA5I%1@W-7tn>LF zSbxe3Vpr0CcG6?i+{Ar?;EVAvdwsajoR2h0ZuB}?Z0b~5g@TQ`uq^#z7;oF|=o=j<@2nG?)?UDv{_D@>8Dd30I4~!*aL(p- zGC!rR-yc;usWp9l)oeKkZz7kum@S&QzS>6bbjh*YY!snRWQh4`!(VGU9G`Jgein!* zuqN5l+p`at5*1q=p`TByN{@w`D_)+TUWRsKoMQC^K8f!-1$Wf2`L9Z>D%CqwAis=G zm*{ydw>y=I8YBQYQ%*G+li&aOrhjh{AG!O<>XhjQFo-iGciAW!t9E*-r?FXFbYbh# zS_~`p&!^yXpo!rNkn^~lp#z~+P#G>9RvY$8(xGGJibXL0aGhG?@jupS`8B0ne1PKt z;UL7O%ScLf&AztNo8SHc?jfoO)lR=x$Pe^6 zu2Xk&H4kS3;6E%CTNJ;i@%VIVN!Ms3ec(~Ok?D4Fc7QPrhrGKd#XeSMwGm!jNT<*q zy~YtCuvVJSQ>WT<(zUsqOQh6aE{M*!1Pg#E+(2wwJr4EG)btkYY^Sx)z`aX?@nC*p zDt?^wvVPcgZ)5}Egt}=4;L?Gw`@w#C@m|MFc6w3#&tn7si@^H7)Pt{O&FlO?3sA#)yy8-x9 zF0Ozx?u2$5*NI_~+dPB2_$FWt7#PnW;w;Ay;B>hE8-EMPNPm*!HPXsi&o0XwYc{S^ zG-SV9zVO-Y1k&o%C{icVFu-HaDJ_c4#a3KaY|?bfkO@7_O^r|79j1WcGivFbbZj&| zJU&>^>4ft>Wm{pTa#VFtx?6c!ycb96@|nEWo6jr0qiEOxC_A4|g~>wId)EDiyI9ZW zO&)qQ<=OKBkG?dA@?3mEmxE~APEWW`zsOqQ1Mfb|2C9RNrH`)nL#&2YCk4W!z#^FS zA9T*t7(Q#jKl#t*XhWVd$lN7Gx74-!n)pbSPCLD541-)wLxm+9z!11vnpwY3JWt|s8sVH&RnXURwMK+o_D$)Q*Yzsa9ALekQ^zvd#L|Un zBK*vlF=rm5v)Z;n^g(ZEh+_ac>5xH`tDQ!-oS1Zb8RD#IrDCHMgI+0)g_L+v0IFMl38J_(e```wRfB;Hzlf;e)SfgrsgFk4m zr^Hw5t?6*r)-0tNzD){jf@M?wfFk=qAI}(OAn{f@?;ah+$?$aHxhY&u!T}!2W!j*j zCHiSb_d3(5=1%ah2lH;-IzD)%*fysNbn}RWT{s-h`IU*5i?5Ttzl+G;i0vm_1~ysd1Na^vk=w3ODe_`Cgt+;a z3@{K8A7=}p*)zlj`-WDWPK!7*-=pzZv>%u4q-C?1e;tOWEqX=ah)?)xHHReZUMCa+ z7H>t``jU%d95#2>hg~wzoD-x}n4^LF?XEW%IP+6Xx2Nq8c>$Maha2T{2CFHKc*cR< zDRdy-GuT#H=p&u?dxM$#?Iu`vH2yPOHT5pju7DX+PcS;E zKURc?3!QYG69!?-0m<B?1Cj+i}gMdZYZC zVsAD^z+W|Rc4Vpi2_XJcUa{F?C%5T%Xf3PSZ$=_!Fu`(dw{?#{w+FeKR|Hm6!h&OB zn(jQB1fWhKJQ4l`2>vbx)YAMOjoDOWciFo;PwQ4yUHVJihW|JhlXF z&d*!@>C23fexA&rWA}Ys{fD{7&%bLGf;~_79Gk;+>p5{LI-c5x7p6CPi}TZ0FtVVU zfa%jrzABqpf*IPqy#)BdM>)yltn^<|Y_$CN!>9Z=cLVZxO5c|D(JKmD@*jW?DHwR5 zOQ?CS0M}QiJdDEZ`4lP@c%x7nMZ)&iAn18&KsH}3UzEu*ls}3kCs=5R)A`tgB1`Pe zev6P#F+lWH0jUqUD@NF>6C$osPC-3uR1qpqWaW+1Jz#Pqg@(dMHa$PEny&sV^GL*y zSj6v9;M3ARF$PnCCAxoLPoZF-L}V>1w!{L|hQ6>A2Dim5%^wnLd528O4s+KYDIbc6 zh%}CZzF=D+K*I&#s*?03(pV7R-LYBcO!k`M3g#YlI|UQr{d$CkQOFGE|I7o?E^)%e zjfTgH&|tIgcs<`~*VJlsJU`!&%mN>DA}Zj{W`UeKW!1zRS7d!zpI{K%Tum(LbT|)E z+Zqcn!x8`kCeHEUmrv*L5VR}RD1t%%DieR%`HKAB8HeKZS^jZFDxkbj@d;TZb#W*y zP@+p@WL_{BmGTRT-BkY-djI7u!Vl>OzHg~hivI08qJTv78CRlT6h5D98mCNVgztPL zR-NM;)6WMg=D2pkm9tqmR=RkFPgcj&DG|PogsDOf$0ge|HjhT$jhcYQZ(XkktKC;W zx-`QB(c-?*sFtQVW4_E!tb3qgXh01?0Ym_akV;aaJoxV_sK}0+hxP z7<5TO0iClS-(OJiJLL{~uCJ=P-YaRmy@(1MJgd3Dv*=E$Q|m)yV_*r_fg|^xek_{X z)zETklzN=yNDuoSt+xt(fZi+_;OPZhkj%k(=6$eaa=IzC&7m(5eesDtYI;zBnn{@bW8*P$VaKcKTC^EpEY z@E!Fh)UDPVW#mkX`Whi_=@PH#bti&K6V&hnz7AN>SLdpNOA3}PmQUNYxs9qICGT)g zsYfSnV?vb`)$C7Xc^V_L;kla*kxE#Eu zgbq(PHM@>#JoNsThQn?7r=MLI+u>Y0)8{uJ^UjjsKq6S5N!;5Nbc3@5+3Vw3Oc8o4 zNji9?)Q4Rl4M8HuIQ4wW`d``nUgs#>Ti6DRv?K@?;|Kn=Vui*}r#~KOR>Bh5(mDRH zd=|EL!)AqY2`r={9r*PtoBJb3+V;NchW`M^z8_m4(K4~}#j-YH78xr@g%rBNZ| zw`6GC{Y~IgaxN=Jl9d~D?^Z!^5(+_lRA5YF2ndK_A~m9BKTnPU($Rib!;8DjD%gy*7WMU?Z0@aF z`UJ*m&AM^CUmZTAkZK+?=rH60(P5KZHeLu0x?oIM&3kD%R{b{Q zILVhyV)U#Nyh1<;2I;XV*(?z=S#M=IoB+ z1`y1olDDjRK(4KN0}6c!rBZSI-b8{_j-A`HtSN-iXyUXV1{AR*kMoG2ztC_U$lSG{ zcvF%tw;EWF*TWhY$;hRv+<0VG7R9Kd#_xK`{2#&-22`f4xuWc_a9et* z!<2LmMTlvLhhwId(5r2#BS|zKKW|%@0iod@+V2 zDP7{wyn&CAF-e*hGk<`8-;{?vjl&bK@hfk9kCC3z%29w2w~4#wvFV2V>u*!QpSB^%e-vWMJj^A zRYiLk>A@YJujm(yJolro`Uw6y+x0nUj+~n--hHuZ)3s=?PF1VrIQjkDpVPLIiT&$f zO|D!l*Oa5oc^BymG8T)>CLAr#A%cbQ-~3pysz=8+&3f_LpaRcldwT?j>;<)^6uO2} zLDS&5?9b(91$LX2VrgQAgO?%N5@@nVH}AAH0j>kHUv7^9hzg!mA> z4X5n7*9vBA3bS{{{Z5J7_AV~Gtts?cw$VU45~XcUIDH!VKe;10aej&-6)S9pFOgmI zUu7ixv*L@vS2Ve*|MZfIQMt|NC>83vmFt3STTbP6t~f3F>Zu(NI8(o(NTb+E-Vo{X z_J;@iFIk~8Q!z6jq<+@9e6v;gw)tuKIP*&?#4&}E$e%J76AH>dJnH_|#>GW1*B^>K zRFYa;3fs|Tu(r?n^3!wjqP^qw!K%Hf`=XP@GudNv&4Z%T<>GmQi^bt<2c4%Q<0_e* zoYf45&WIs|4mxE3q|W#%-V6s@LgpBLngx9Sdj(d*`~8*mOw%>~=fG4%R5x#2uz61J zRy=2;qrV<~44VYEJ^wJ;rP1k>9la9T@zrW~@8Z%;dKc3LR5w`Y^6g885XQ&z?>pkx z`%@7wuB@U=jBFun6IVT!2_})#p_&3_bieCpnkQ|}@}LL%)ZNRLQ`uuPovnvD;2AJq zFaB0>APYZ0GliwrV>#--0w+-$obAH%tj)oQ~5@1h-7NW_CzaMPaO?;^DhY& zQ^>ukgrP_WYbq7=c?3S0R4a5VU$~hJmeAnOq3}RbWu_6>t(RyGL5Q^*(g%Mn({eZ- zv8}ni$TbT2sk-wLjNG^GM%(d{&jx$zUfx}mai$M`*Lx6Y6LmMmN$rM-!p@3W9ayK{ z#25eKgvSO$&Z@?U5H3IHI@}UErk;V>L_K&gZf77i`no)HFnwE|)|(mO*_qD$YvAna zA~!A%3_=RLUMhA32oVt_5#sS>_soVKjbTfjE)bjA5lE2~Gdini3f%{_|9bfaZ`^9t zIkeboKk2>yt;=LmJDbTPw&ObI0Aa%xA1vzIIpn1gT}IC|d+;xgz|}eIv>_#i@=8n7 zwA5JAWPiN114fmk9A5;YdM#A>oF0Tu{_-qzr7KE$lfoc%f;-y^VN|n%MRs2taCg_K zaHJ`ve%A?YYr?V?qAjCk0SXR{kGe~~j8~cL2Ql7srA!I-->hSGH%aOzhIC-rY{$Sm z?gt#v3!HE4-7mB|UVrC>0g*k3`cG0sna;wv~ zp`)k#S{xwHtD81EV|<(%qh=ih=SYT8-{%;&iBj*zSr%T$+15;MYPu%f1uj^+u`em{ z)=XyV1vt!>bU3aLOlR00xu`QFR(TDg7fkT__f@>tat^vTxop&q&rf9-_#ew@WjUTT zXASnzVd~GbmJTh(DMlSk)v)yThPEC3$4|GnO-fWJ@ynmRXjdXzq6T# zTDh78G^)}Z?Rj>dYY!spl~Lqn8K4gkO1g}bQMA=sZt^TuWk>W2CXU^rRKa1w1zTfF zD6?0h5FFtrX%_7r!ZoL)sU~Xy0E>bDM&(SYy3WI9J1&f@q8w&>fvg9j3qQ1d? zuu_8d2Yp$=MSnz3%B8JzPb~Dzl|Vn}`6cGmy97Vxj~$Ky5=m|$4~_=%T@YCwJRA>% zELT57i$(drEnh$-1y>OM?@f9b;1vdh^SCmw=f7>x;;X*Ixj?6r@W0=M1fh@e|5m0^ zgNFZa8;BXs{~fiN5{eS!7uph=(*I6@20}(?1@_-gpcoLq`658ujQ{*Q3h;;Eg;xJQ z2XOSQe8OCCM+MzQ>2LpiwnX20`2Ti-(n14I^reS6OE3NJ^u8znO!42*{UZDYYc3%J ze@X7{?6~^43~Em46L?q#ot^GxFbGzI8F@Q%kE`m_ZzN{MOD`p_qIbCw}A=0Yj)ny^NgA zdL|WMn)OITkvvRWs ze->C&wZ*mb);XA|y}RE%XxdBxHT_cWcgB@gD;z$+UA(t@zDvoKva_>`V%qcmI1MDz zQjzu7sF>t1*7KeTecqPq9B=srJfz@#M2CeH9dAnKwOwWlngxl9g0zoczg~98uvsi5 z{^BKiTdepD$#y$XCmMppZ;s)`QjLX)t~;D47}k-_0~Ro|eK8xq5e3r4Zx27|S9E@n zKbhoshg;(_rB`mbaOn5ha(ms>&ygkNbiH1@9)04!6Ig9_X7N8eqVU~qf&bC&z$POn zR|Hz1n7%fi-_6ZVD&+8|%pPg}nEu4~ihQ_OHX-TL?r@)Ze_WT6M;i{q#w48?7`^H>zNwyF|C0`S< z>ALL{=@CTi07k;Q(W*MPE>|CzGK?Q>k7wVuBRA~dU)I_VvhQrV#`73DGo^u6EkzvK zK0zZX4024Eo%dNX%xn61cOwdkpx1*|*J@BjiGV15JFwpOJ;}e4r%S_iZy8>8OZ^ zBxdez?og}>3_=hbZ{{SpozFNMY&Mgr6RZ9@{h{en=mK0KcJAknM_~<)?w5FyqYNH^~BwnW0kC7b_prD{?0XPyS#Ka}U77=-Q`=Xkj zdvTChO;oG~2a|meMV(&mvp`=Ti3oIhVkDRz5k!7L3c2k3@r=eHo5rA(p0q0#)|Ul4 zb~vDDXSrw#Dy&&&jMs5{;W797asTe9AZDpvd+P=+VYx(eV94W3Wm7a3onaCg@_XLD z8-)Gu1|iT&Gds#WKP$n16dn@qQ|I9e4=9!Z-UVY9r5 zxS!uQ;iAYZDx$2jTf;pj5>OD}Gq``gyO_RZJyti?#a!grRt@!VYkL?hPp*@5%8#v*Pi&Cz8uOXU3x> zsM)^Gj&!L^^IW!5z<&|Gt<~;OBk@oMZ=L5g(ipO+>XaVO;3#l7oPqPY*ti2&`&pW*&L26RZ+=i$K=i;& ztVPIllTsJC9D`g7q{nL4-A&ouH00&<`s0QikIO}V$c2Y|;79Rz#w>K`bzAM{x4Rb{ z8`PHyZV(OzX_%q`!C^Dc@NQigg=|*SX!} z*`_oHB6n{xG>QonQclXLKtlHR48y}CN8G_aL63o;k9dK@tf74-Y(qoCLZlP6MJ<`z zL%Q5m8yqQMA(jhxiEca^s3(14GQ0|nb#hB2^1$wf~v_HchrI%F^ z3lIn#D}27JTEbi*BI#)s{D5~)^*BWoxS=d!K3;}IWDg4p3YtFDkuF9q_%SQ+`8LXT z6LO@wP^scIHLbe&qS)VkqNTy`6Gxv@GP-8*uj>Od@L|A@wwd1T&ZwOon?F2C&N z`xRJJ*E>7W5zWhe9v~*Kkh{1tr2z?O(QKVpw8D5spmu**lmD(HLKDK8@(|?_<+r$9 zfrn4>zh|;rZ%7izy$Oz3T=dsSCXKLKouIwElnviq^&+Y<40GKaJDJI)b2~9dVY{*L zy^h_YVc<|KPPIH;^~Nlram2gPMG1<|7RzCP_S?V%pG<6+e0QjKAhVDC3yTQHKx9I}h?sD$^s-|7q42L{;&y zGK-R%TZ0v2O|`-N=K?x^A@F>K$e0aUk>}Bd)kz05I&OBj%yQ`Xd>LM1R3=a8A*f*A#VMeQ!8 z0#`{5Z2qINYlnn>r;2bS*Fk^zoy8~ndk7*y9+i%aQPhQVI@c~FsN1rzM(fuvyiHb{ z-RUC4^E)>eK->x|eB`(8In}7yci@H{$0w&ug=W~Gpc03U1)?oT0u8r%iW~U#qeXb@ zIoo3Z&LQkT4X_S6@SwJEG?=f)f4n|+-9ck$!I^RqcwXh1%Jtf`D%7Lj{sjP8*1J}m zqgFkR87YPi<9sWz)GfecH#q4dn&bvY$xg3wGYDU@+S>IADBp;)WmWB>nvK>)U7yRk z9x8IcWGL5?P~H+8d|L&O*tor!Gp$?y!*mT>8ilObVK(ffyzeUlRS6KrNZY9&lT}`F4jQ zC-28K1D^U(EcdEH9^-j)ZGzT^N)F7S!v&Xx3ENoddtUTl=*GBZES?oWALsHwibw-o zb%S>W_z_{(#h`~j(6lOxd*gkFa*y90H_5Z(Gq|dw?1DEx)hJ0>Y&JX>sN;`nK0QRi z`HUUjpL(0_-d$$Z+J>{~$INZI-pR+`j)5Cgq17TOtqmg0&f@cuP44wjGxi25A(Qa| z@5OYil+OQ7gMZtiT;H^nt4jnHsXD)1Iv`Sor=L-4N$tl}l;fRFgi3_(y5-I7ae=FM zaCugCNAgYg4p#JKWt!!07rCOLHyzy>5U*sb!fSWHY;7L`hnEer{XV;L4u ztkzqjI-ehSyuD#MJ}*}9fM_8}-0GK)kes8w;e>LbHv-M|2oh;d$D*?TL@-5PIjQWj?w$&+#3o*)fYjs96?$Z_qie< z?%AbziPA7TafnH~{!PX8&t&N?ctaKVP#!CFS>uncDjaTLl{LYUOKskbZZpz{Izd50 zORe;hfO*OJH&J&6=S^od+euX5Nn#uzK+8fY!&Y#frMoj{2Z4Vyivy7<}h=E~SOlBfTdXg6hbecwQgMGW9 z%Z6dRQt)+)xtRSog&}C{m+AqCF-CAW&RJSwy!G)wb@?{e9q#%0rA~rIXu!}GKHx@s zBRkVNzFfesx-Wlrk5pT91T@WOBvq0Wu{tCWJVG#f+flc&)tE6xjH!l5&>(})qtcX+ zYFG;&y|M(7l|mXig*8o(OopBly+OF{#y}4q6{r3i(hr~+%2?~I5eNY)o&^cfo}aoE zrmB$k5QYX`w%g%4huQl}*Kx?DPmk3y=vbm%&9yMxaJj!eFU%wnp-o}PS5Q!9mgSk8 zFjT9lHQ1RRxb|FMK{o_Ee?k7HukDBo*_3{cz)ZfdlUycsD|Z|OY|HAC_Qua_K8M05 z*BToQ#6{!_bAf&ljAJGRMVdTXg1tW|GaWK{PCmEsiefl*NTeeOKIqrx7(6b~4tM3^ zPv^e6sq6jkA+)N`Rf_$#H~K`WXG$T8R2{!Fuba=m2!X@*D|~6$LIhbBvR#FQdOb4D zj!R-n2JMd0y$Jfk-fgP3;3Pr_S+)o^2fG*G>i{K-TTq}c3M=ACZLDtV&G^d*4RN|r zH;0^FR|Q+xSM>$iEd7RXV=v4B+yZOXAT+3fASj2Mj$9Pg#0R`oxK5C9Db1q~Cn%sX z^+S3gsD}_D77;W%!9+$FOH7I4jny?nvpjIOguX<88y)y}zvrI)`>Az2n$i=ZOC6*@ zQHOQae=A~rL)NZRBuOQXCR3~%m}br0_m+&3E{?WJSC|d%tPhsaKKh1X>|3qVYS?mj z5=Z~?QjDRa_DskZxsN%I;^t}+xr(NO|11HSK0aF2S&1#;{dWeS>AvSKAp--fMx!HF z*3O12n{!4$e=d~-(_EV-_IxR}9N#5W?h3CSAvbZj?AvUhCp9|;VYb%=1Um)SLLiJk z8Wi#RkaDcDy-y?O%}@vUvFf~55<%h}{`Xu~!Y!g+I0;_M*bOK4PYnCzh-vUc1uX+X zUnmQSWIA=y0}|R3I9S-as02(Xqp{%SZJ$q%NFa~gB>%qTe~WQV65s6rkIR;bYI#lW z<|A>FH+4TDEuo&KO=+5;U0J?UP>`aSw5!~&TrAMti7-l5+r*H?&5j@J!G9c;Fv%f& zGl_{O4$QcFbU8r>NMUGn8P~xX;AF4cL~$jL&wI8w0A5`LWCffYT5T{!njeBo-x7RR zZGj0xteFtOodElHseyL`Ndo@J@bYkApnqZu;bi_Vz#$MgmU{}@W ze%>nP7WZE#J)2TOLCW5@Vp-RdFP-I9Oihkcl}z}duN9Mr50M2HWDp)=Mh@f%YCU$B zfNvWU5iw5UcoL(~$e6*e%B5I(!n?uNpnVB>?{@qO1-021aM_Fm z%mHZ6@kB(hw`)82)G!#USVm_8R;HlyTi_(e=fq_XiOt>kNB^ro!$( zlo1gHI6V4@w%0vjcw{&l9oh!E#x>uSM@WBN3&fMx>H4d^_Tj9S=P(F{=NDTs(>Q^i&mHU6U2pF-sb=`Qml+%=m=3l!m$a*Vz+IK(Ji~` zshHe!4by=$8OX&b7{&^jQe~b&^4MdQE|qQ0CDM?M{87Qy*lq9A?m6#Vp?Oj%6ZH;@ z*4i$0-)Am13Nn!B7McYyiBefBCV9epoyu(;yk|`~1vs^~=46K|O0(HJ(rZDZ5 zx{z|j^g-`sU390tF~ER75;tpuY7>om(Ir-Fm9hCSnc?ctw}7*-Z2R!2=_Bx$AA~81 zx2yZ*Y^ytflGDJM1RXa-tk9#{HZl30>-F>io7=*e24>A*XZ-!43vb=vqCtS$o&EiJ z%#(2H_5NJO=c7gR4fh}^xPVp9)E3PqC;6Tu8D;2&QEE?tT+fxvuK^5?|Mu55dIJB> zmf}bXTQ1;lTjAzC;AU+BI<{U}j*O|7-Lz+k_P*~wt@iI+uK7zWt|ctmIOtdpw$D^| zWov2}-KWncAgSR?G%syAoy;k;>lh?!rO;=Y?uY-JYtY2Fc;?7op^eS!^kKb5Jz4$D zQC0m|v{0c@J9t>PgT=$eF$!0PU&u>k&a6!NOyOuG)T8}mvn=4ck@R5 z{yy*j_xIyJF3j9BGiT1(d#|pS3dn&LaF@6LLsp7g0w*JA{07y~dk zDk#qOi7@dHLh)$^Z@Ja<1@0Xx?k2@j@3J=cYY%1RRk_(bx7=}Bjce#- zn|;#_(LX*E5H(avmtsn*&mm4VGnospG5O3LHyUkS{cPPgs_!b1UYTy)mpkJ}(#^S88 zVOijv!Sy6rj}93O=z!pw8@d8>XWqMy(Qn(Px9oMZP*+o>>=JX6`-v24W9fL;c+|uw zyrC~wnck1EMO_+i_;$&`XhpctGFsbM;>Mq~7FRmDWPp81tYzhzJ9j&J%CK&|{m5~_ zYsYjgDe1Xo?3D{qgK7N$I=D{llP*br_PWKdYCBQW<#xo^ie$qlzu!!(O&}t!SziOW z>(njcSU>)4Q14Z^m!+le{)Hg$Ip{{nPnKymoJUa}^Wt|PzSB!wL+I}Bke@LEo1Z`1ntw<4;GF;A9bFLeQYo!P=T`VDxC{iCSz{lOkxKZO za`@e+HaRVJUsL7ky(rQ7c1p}am@OSBfuBp*`k;L2sIxk1o@$34?F=2FWkDZaf!(Ln zCTCr7@B6D+zUjCFimCjO{MFJ=*N-9Br_}X564yu@QJv-O zF+8A2>zg5Dl`YU$M0Na$GN(%DVksO& zKMnj->^=IHugB<=3rh>l^G=iNF^!_6ars-wTcwE9PP#?3W4JD88(nTg^%CU(07*;t zAWso~($#Kx8aU5zd2 zhJh!q;}R_~9P36_f+H2EOFrX^c?}Xz*DNdeu<1Z7ZK(A0+2ZN^js6JjcL1ahcZ7&$ z4w94XM;XvZS-qWu-CgzPIrWxXXW|hyLdVmXDwKa=wBu491mtGK)sRkWp3A#Id*X4L^ejB zqT*aZS`r?gDmN5~XoE#i6r@{235J4MTu<|75!_-+%vf+dn_bY0s)gpy7@HR{9BY$Vhml1gH>s>{Fr$s4{ zp4m;B7b`yKSSRpFsGP+jU^!d}=s-&6wjEB#<;HM0nB2azOWcV<6%1Z$hQ-@8>v5vn z%e)ab^Z$fUaAbl?47xxU88zd0WVnAEVmL?P=e^i|Vh+{_`Sc?pb}BeuKUi3=?WFA` zcE$Gu)+q>Xr&n#xdUErN0ocU zP(e`Gr%iflFsKc4C=vZP+V-nMK6Ciiu@xalR8quRAy*KY=Poqa)K$*6C4*Ovq-Rgm zmj|=SD_ibP$4lC5kqRaoog7@Y(*?)+&1W-gF1uh`e*n*r=Be@T<#XAoL9Sp~O7elE zP7z^{u~WV+Ps{Fc>z1-Obws_XT^;?O764@gl$btq@N$Qv=*d8~5D|%pr?@aYSgFNT zey4X1&Wnu-)OebxjnOI01PZA51WUA|#9=Yf*7`6PyRE#^`4NnKq~?q|s;*R}OB{i^ zMord_CQ)TL4*gu|GvEA^`I%z;dq6WGm=ME6u;Lcs$>X#gs9ZYTlWl15Lyl&x8g>IH zm8=*EEC=a7Z&^N}x6LbyW6*#RX;8+%?7UfLRBNhWA-=5;Hp)vzO8LCJyj@OgbodUj zY4@mh{lUiva^xD+u+2OEkNYy7Q#~T4Kz)Sdx&_rZ016eJ>}R&`J>q?Ucf_uFwlOv? zP{R_iGg^;!uQuM4Vn9Ef?pPA`c<>0X3}y|K!gJyl_gcZo0UQJs+B36*G@D)LozEtr zUYwv{f`iUQwOH23PQIQ_F_I)#+vX;l<+qo~$AAL}g|`$huCxsBHQK}*FI|~l@=J+T zG_MPyZh|20foz{4-L7NEr|mpP=_dtrC>4aex1w)&amkqdP8F+)9V4pNHP%RtS7|SM zt11cYFrW(%c;2NL!IrrKY9%-yDbu=$rt_;xadR&&d78z=ZNIEDvBP*|zo`|vyd{N; zq3Sh)eS&2OJHe0O^N)GUo?bHk9ezIKLd#I{SStt3F$B&qh_;)q`%7J@EaUh_&Zi@R zO2hNdGrEaf4ATf46*)k2{q66!1{*Rd6~-TM#@-5u2{axz*)k-w_xZm(D6O2xmcy=0 z?M)R=;R{%D!ZDV@ube(43oE)x)y4wiP>zeE{44M_2{uVI ztkce$0=-b9aOaVXJ7jmiG$b~YPL4qorhZUFY6kB|@fGApwXAiwkf*^IwEf3LhYRq7 zapvz^?e%J%>$UBs zzE$2>p>&@ZW3AWG3N0=CunDIS=(J~)uXu5HdwmZ81oQGjB`8FWTCM!03biI2?`vEu z5D9+-E0?~nFTZr9oHH&8Dhe1mW*wc({6T%#)@1tNMw!>-!{X(PA$Scf?#q%~A(B4O z)zzgHen9{5&{6O{+kf^qdxzT*eF1iAu{;uF2Bb!5u~4S_Qh)ipE)K>`oUuRX-i+BCO()zgVvc&zGVOO z4z`F%$&dkLjRJkPB?k{Ysl*E|`^PSVLBq;RKU{beJWeq&X*XIDr{KkkdFC$DL{q59 zt+1|$gAt+0%`ajT5|>$xGo*sw7=|bbBne>g$`L+FlIr}h8PE;s9?&8lZXMDrEoc=i zvgqxFV9NWR-b1@E@-xU_A4lY<)2CZVEd<^Wy*5$FRrOqvugojcmu4r!D8TR;=NxjWAR|qA1l5xAwtv#Da?8}I z&0cKCmz+)k!PLz7aU+^$Am9av1;L;5IE8Y>l`TCl_SeVgW_jS>qK(fyo7y#yID8Jh ziAE(DnIYNsTnbVoaqN2Ny@9^agQ=JFAmVdfV~t)u&cpS8dZm@i5gLW8Cu~eDB@IJ% zgdCqcUXfRoHtHFLBJLd@8)s|Zol^;QX&+gCGWy5 z^*hV}lpFamR@c(`Y?+{Pz7v|HZ6M@9qna86pT`?~Ap2A`|8M zx>csp#?C?6!XHqbLi-5vO!Lhv$T3!~j|4se0_Fsx20!bO2)mkjL3=-D(TdE6G((NZ zIJ^?TDANdOv^*Sm$KE|#NRuJ+XhftdsQnJ$Xkz2$o1Y=k)!Lg<6YnZ{aJ;@zJllpC zP%r3Q5&e?r$Vo=d{zxso!YJenR^@ep`x@2Y*IRaHWhm`pNiCELb%98b*zx*CNU#{b$neISh;%_$pL{jJYllI2RnxAlN~i8|e;q zIObV)4RY;fwFoNPTxWQqzy`7MKp&yop{2=;=y1(vGzH1-Kq898Sp9E~ZYDQF5HT7$ zhy_D|#^oF8qfgP}S~*U+JLI^yOqoGJA!vvO4I+Y%5nAM;1r&-)u(oi$n?`NAtS{)- zO$GsUV@nhZC=1|PNuP>JL6VJolT!EonD4)d0Xnl#eXENgH?LyGC9{58#^M5aMwtb> z;%c$}XiL#pfh?Is;=5)AX6mP#&ub&UW4Q-b(H5{ci4J8oDh!0~dX3)&rGEIe|Km`> zkEPEJ?~vHpQ}{lGCwlATP|zL6q4i_!hs;2>xu*y8P)S%j@*_MBH0j7D?R}(hsJ0%b zO?zC`rG5bd(|XfsI8$TYx(^%`)MM14Z+vG;8gUI}*5Q?|HMI3Qf6jj@QDNH)GB4pK zLa!5}2bL<0m*=No!6L;>W^#BLSQykUVj+u5MF7z-hlWN;S>=1?21@A8P1@fX)!!Y& zyn%^v+Kn+XtdLjHyk#F5nzC|j#4A>2=2sBq2F#)3<}OPMFfhg;zQk_!rbuEW)4G?> z=7&(2L^uKL5U60xnQ@~xDEU`O0XEjS&SE)?Sjt~Bf@7ux0>2Ik8%-p^OXiePLQRV8 zC=C>swrbyeQ_?hT=lICtGcuOCbY<`#e@8V6VoRjlOMt5j4UF?Yo)9zT8Ygrip%R$c zycnI~f1mDwc@;$2A7Hk5e)-j+{`WBs6m)SPq(i{Q>kZV#eaU|WA&Rv$_ylN!Z9P{> zwg1>ln2u=B#at9SakI_;F^q7a`@pVA&;IYs0VEiX1E3J- z9M{JMLrV_6IE*eJ&W=@PZ=|=6fT&Fc^zlV4S zULzY@RrNZ~QtTl7RA3e&0wI~)h~l&^@m3I;u?-=;vI@&FOu$DW?vq2p*kcd6`u z8a6QO^ihtl(&5SXm`6wbq#v8d}rx%Y{|rt4?bD*QhwA>MH-{|Biy5 z#XL2-+b3V6(@ix+cKP5PWjD_8c5fBC&l*Pjx95=e8G>ac)EVd&fnB*12M4FSk^#<~ z8%s#-&+X{o15G{&c`KWkz-02dNbx^u5A-!&zT01B#>9A}@bEB;L#fT1o>p(_5a6Vx zp-Gr-vS|bk11L-%!A47@3(7M_F9HX@CeMc?VFpXGs%p)RIxnzNQYI_*T7oAhLA4ow zFzQJRR%cFuvxM3>yi!3$?3i_uGx(j@!FbFRrw_4^H$eefZzun<)F4!ABrx2BX`7~m z?A(0^g*$;$AhR+rBF{lHP{f_qrpi-`7^4t{wd~)g)^H1+lba7W%nMBF;4h?FwKku% zOR+cdpZf1y%Kc!`x+I0WeJr4Dsk(zoL_VVN=b3j$@F)JO{kV$k?4QJrLNuHSUHc&_ zfUARfV9-xuF4ey?hy9D_vzfJZMUxyTq5YjM^sv|Q=B8Xl%O%XKZqr`98Qa_C23gbl z-Ta%cvYWk^j~8RA?Qib+TE-@7h>}T_dL-B;xRn`L?16VPZnqUGTVOkdGy)sYD9J>B*P613M#RTCIeU`N>l6k($*(!PnQ5^s_0dC zvQGTC%m01-9Yw5q6l z&w6n9{T@M{-d-wNTKfEc8x2cpgHS$Ie@GvPe<-^v3YaaWvF!jDTtkwxV zz(t*1pC^g9s0{Q{cYGKG7Nkc-!EtOl342q5IGXd{P;desDb_AI4@<+Ml%u!u<1x-*>sRvs5k!qJ z9Md3yus*{z+EG;#JHP9b<@hy{3IGq#e{Ur*MULw_Jd5`CzZjONtb{0H2~8U=Q~ck* z+d}}RC~=EfS>E4YUtt35)3{sBTKT^tYJdj#t@fvJKf?b0njis?Oy6zjPO$&oS=QhI z8f#;x+|2906jx;|Ol6qYUmPTd3jU4^_+rr3|Nr9u=Ue@b23n(3D^@C+Ouy6v(BDx7 zumdC}C4YZ^K$TmsZPI0X#phKC&)-L(jPz#~r13Z?q6=Lr2YlBAXhldUD6T1^0P*at z@5A+oTNyw(yS$uInvy2>m8f5K)2%yz`%?10f($UaUNpvv7CZ;%%8!DUUH~tworBn= zV>q@b0=B>vzXv<7vmX4tI63BAAc2~Qp?v$ndhw-BfBfJ2@s1Tn5nDNuh-(*M@{Fjy za&S0dY(M)sJIkY+!L@O>lU*DDi=dPLVF#lhkca>A#7zgVHH(2Q4zRw!UUpygovyJ| za$#7+G!H!GhTfT34Ryz{Jgz6>`7kF6z!=q%zppcZ?(!qy1H@XAhZuaRhL@^7vV5Q! zClk+0A0nysZ;Yqdab zK>HR?r^W*H)924v!TecoNshDG&5?R~dQ@a&WRfgLqC?32Ql9S*SablNA)whL9ncDv z{H|FR$1Zfc7UZ0s&#MO^v>(mjqq4=GiAC{A7}NY0duDK+8Bd+`{iLK^0s`fo!P)fS~_-j5s8@$~dm(a|Al1;{`+fQu2)K!I$$#9P3k ziqiMtsGiC!m+9{IcCHp3tN}I!JH!BOs2tT>9>C=zI~^|k2xr!7peSl6DWQM&?p>ac z_jP~ktbsR^r-w%<)Y!RWZ}jui!xW&PXg!f932;H>SaTIpSj7g<0BB}%`m0(^&(rmy z0}cj;XtvKe;?Yv0n#^bcsvXi*kD;@3b;^rq9$*-R7uW3z@NJWu-hL0V#sr09kdi7W z37!R8*%|s?;a=@d1m#EuiauQKy#+{Sg*iDCfz}sKH>=6cL35Z!&JtPUxBntzK6QnaR&t2^>^a? zFt-5j#X38=mmB{VX`l(4Us6IMMY@IrAm_>hQ)GDrS8BX9yr3ZX<3q z!y6C9$z?@1CdpuVabbYiaO(A2ODfX>cF*6Si84p~QV(ExJ*lad{#g-m0oP%4Y z-<a{cn{e1R+U?!oztRFMof}0_=NO09o@( z44ev=)wpOa8HZFLaL!t4>>Sj!n=srrG)P4)%=%5^xbOAEF1APVf!F-YXP7Cn^7-h! z6jz|opg11LnqIDwFC}il(sBv|fPw0qTrt$(QKAsb+(h|wZUuP*ir^)fta^AWC5i@g zk;fSOrajulS5|!Ej-q+MZHf25ummQmWOL*Gx9>D)!5~!hZkzp2&Vj6KD;jM+o`If| z@}Hp;DR|x>F0lXlZ&`o_mIVw@#U000&GYBeZV!xJ-y8;rJZn*46>)_58vk)fDx%Kd zg&<)k2>jj(YCHnN?PP^X{H`Ma7NiOt(9y!>_viu0^tA6a?qqR9Tk!dvb|T~ni7n2x zcyfqQ-vi53PwmZFA2~9^LSL>tm^Fx$&sl<#Hom0MA}X}6@rp;@e*95XoRtX>0TqPG zgX;t|L*8uwym$dZ><2(vxq!I=pH|B19fkb#6exnucnNH(L}3u~`uGzembFO+a_5$1 z*3^G%2`O|mtwNgF(cn&gHwC5@D?zr5tZXdZFkdJF>=Odu`xddB0>uPH1V3!NO?bIN zDSt*x1R7SSz?bJ{?X-fu*1;>MR&uA5}{Qr*balB3z|WzR{Xv6mM!sKe;EN`;gwwL@f03~rkR~f zy}!Y8To^_!ivU46?zXOdXs?=IU;52uNg`I<&HU9RBM+6$^&I#N%DWj1n_t`DRV&TX)8%d z8vi2vU)||2*l4B*oqa75moJY3BR$0wbWOUr z(f2wa?eSLq%PXD3kdc=!Fzt)R*Y%r;ShF3!C9dr~XrxkB27(`?upHqEFb+0MFPj6K zdGS0wjARrL++mQI6crRy_m2AOeL%l!?;oll{F}2X%Y)7AzkL~nB-g)Z`>pF%!+--5 z=mqpwZ~^;O;|HEdJG`}D^Xc_+<9}l{(LHIX#eSM0O$N4><-ypuA=X1Pb{oG9TPK>I z-7>E~N6LaNU~@Uia!?QvbAiCTGIB27?RZXhy=BqzUGHb-a(ub$zimo6AgY*cu{OUp z^?F4+o9PBhWA{x|Vs2G&lQ_E!6tB40*r?HEk zhlRa+zLGov$kTuF5!8lNJs$vRj{TVkhg5672YwFa1#-x zPE{S|ZTO62&{CKMoMi&mcm4Kxz^-qy;lx0=BllhD-)-!|;O*WN1B456)?z5QTMLO- z9c#1FsnU5b7MG((IS|t4a;$+JH5phzz9k{!sD~RA>&c{}AbXTGU9QoyqVMVHe>#Z*gGhv0OGD3gm>y2c`RQwOJL7ZZYNGZWI>hY?q zW)_`Pt}zKl4#hwBV2z40huMJ{>lAJzDHZPRdWr|ch?XM7<;!p=&yE)jviS}+Dl0F` z%YYq&r0KFkuL`jo0bVW5YAAQiQKMx)bws za6MHrXCS4+23v)13JJGp1u5p_h6eY#nCT{Axn*SsoEZx%>Se++2aiixht%KhNp|%2 z4^t1jq%NrJm1(ahFLAvWRGiZE>NGY8jSL^j#Uo=6-8uTL6YDH9jfc7(B8z=Zi*~8Q z>an}2&&xbXY4oOg@zKSSw7KHu>}vhdhn~6al+LjL+5K8Q;GNTHSBDkluOaw?a5{Qj zBT))C1O&C#`;XQq$G$jD+=0tnjn8dtx9JH95_8{j8j@hZysIo2BqN~wowb6{^9GozodzX&{pEu=}ZdT~rdk_vpTt40S}+BGd3HOKG8SU>;zE)Dc3D?md- zi+?-SxLR~@LE<8RKcpS?K0KOCC~QCE7jE$nr$Z&%d!E&aEFo|G*W@e40BL;h+jsc! z%e~dfFPn6QR_FFEsn%OIi(FUb+BNW~B)kxd(F{qI79~X)t5Bn;U#FjMM_PIF1phRt zd|1Z=A9{xs?AKHecOeReq^<$s;eB_!mI32l*7o8US{EJNFhoT4Zb zHL5>cI4rb{1&wRA%peR&NWkHDp$*)?-e~OWaFOa#!fTRWxs2CRW77YwIKCzwG#vb$>ip zsLb%D-YWIWVfucxL2?}VL)kr0Q_#mchhxIdLcsg|CZRZ%IwX9v7sxZ>^72isPGiKx zrvWNbp-@ZKa3bUiAMp%v^7AS1Byg?9a{|!5K+T>--5d#set*_EI)8`?3$vJ9GUbRD z8wy6a1^m(}!#_aVJx%XTZE#f4*BX?voLL-wlN#A~J=|sU+8lY$K+npm%cty)G2NH# zL))Et1RqIH0Q1=BecEl5zn(&kHL}-YM3@v=tWT8_s3{~YoaJ|WMz`?8rCxsL+M<5@ z?PtBWu;qs=LJMOe*?POJl3>Kky4Hrog5?ycVx`O?u2MTVc=-MTq?Gk{rVxn3ObY|R znKD|ab+Fp(RgmA!qN2#P2DTu(cUb(-z_Ns@N3*+e&CjwVrjQq73 zN?*ZG#=RQ)s+h^IF2eYy*)EyddMg28A5h)UwE5NaN+3`^hOH1}fa39Zi+HSlduBQ> z0JVE)WXh8w7Vk+in20d~s&(CS?og&GeJ>JQUvZE$ezW zdLS(HB3iL6#(9nMOOO#76aL`5_jw2blba7=&{~$9H5%?~^_=)(#RW9&T}~$78lu{xUNlCDua_aSjzP%v z(QY_P(YTl!G8~7!J@i;A`<9!b;_PY5M?KW`r{Gg(ue{rhi8gd{;W*RJ6h;Z}-%e1) zv>pTz^ekiU0|BKGV<_UNCioIhOJ?2BD5pIox}`;M?`9RBkA%8f=sg5G01IHkt(-&S3_-aVES79Tse?$7$- z=TPvO#K%QCqW7x==&Z2IU3pK3SN&h8{YxnP@OcK3Qs9jkWW@S^#mQ$CcPzFk{N`aE z>z3O@WgP1`in8u?`e0pZVVpc~4HE~0KWjQAgJownR^2?` z7L}!=0`j3)$>8w{W1XGz7nO{)R4GDK!?J+%ba#hp@AamaTf)2q#m&EQU_TiEb^U;! zCWhUSBxEJb6O140kL8h*-uQ_wQe^Y%yXyBOrmwm;%$)w6C+e*_8eWcFPqpr=en3BC z!%$D>LoNKH)N><%3s{_G}OvQ=bmk@P{ZE9cLf$z%>JsBUC$> zv_eu&?Xb_zfZ~~Imf1=|ncR-zbiD()&fTnGt=BJ|Jqb6f)vWvL1EzR`;S_@lypgT8 z$QHvT2FBp4vl zMc15_mRC|R$h`6npWS9_qUe~qT=i2J=kES@vzaY8vT1ZQv<+@=(oPf`rBE4Ir-PY_`bgs6 z3HHX_`BM|$H01WDcAUGssHCBfj1U}1?uJU|&xJ{r<8?`T$IF{+D3pl4$uBp#uCw)x z;1CkZlJW!1>5)XL6>{E_#@A?>{dT$LLvkew2b!g+-V=j~-@{6me`~IUe;mO;?FajR z4n7>%GfAu{*g7DB{w+MkG1inTeT%TT?|!oIQ%G9LlW$HAtd_7??;w}L{TXI}( zEPG19VLRgu4HE)MF5G(Py$N1IBP|ckhCe~yca`t_%fiQ+{N0-v92Sp^YMl;^=E2|x zASg5*DG@{^88@t50@`k5ot)0#sK}>@B~V7tJUXWF`#CyZzhBojl7i9N4{hpm$tsUS zkAn&L;}{z}00t8*-X|6}nNmgOL)Z-(Fti!B#acFfOEsuOLZBQOS$SQyBU*^1e~-Kw zU0u!o)6op%zYXi{kvQbUEJdr5$oNAbgcM0J;c+y;jd4sOMI68%8LHiq-+P81dBOiA z2xOCvZ+~*YJ~@`21(!fd*7Jj7dWk+KB)D?_yX=eqIojWL+Y@stI_r2N((J#-)ahP4F4wg+%KNhrLT6;JAr23u+dsM` zneIzcmY$_H$4hs$&nNzpqPXf8on(y5O&@b%5zx-vPMf<+FE54-Da`N2pkX^-3D*Y& zf-vsqLtW}EJW&&`VxYvYz-!>kXjWSPv1ItC`-2vzRWkeV^8e zOmJ4!MWRIjO`us}pwL?vMaGv_Sd7R5t(DUB(gCf_tF7h9|C&c0@+(!(Qt@%xjj(GU z&S(AW|;UT;IDt%DL-Tvhh zyEna%##`YTL6EmCC|e+`rn&IL<5m%zN2EHNv^sO~MYYOV;IA%VNmiPx^5k26)!8)# z$RUNlhe=UlwMVJZ_0CcZzv4~#^~s=_u)W{C3(dZ}3ETAZH_fuNr7G_mGPdOoZv7PU zS6CrN5n)kzf4chsK~*`}d&5r8Lgo8~VnTKT;{GfoBo6i8Vo$c^gc2f;r`SL*yS}_C ztF-YiKQK0|d{p_h$Azw93@P3xlWh7Fk5dE8*-B$rqOpas`qd}V#kym9oO7{Mia9(M zeJR}e()Wp(MQOY#Th7>CtZKNyP_b?>6?R<`M75-MBL^{NKiL>0uU}ePglgoMNByMN zyVo*jQNL4{=NziZuYX|(i6*g_$_0Rlz9MBmj-i~@&4%zGtv9H+@1o49FpCjOa#+Qo zjDBBh90FY(Ble7hzehTKQD~_$5TkPj)Y`BD^fAN&>S52VyJ7R0(s*`Oz99TUN5)RS zjLDtF=ryggTV>u(@1n{jAVX)(lxK7m>hTw-JHlZ?4`fTihcPMbxcv!>ceYc_PlVKu6H{riq9DmO$4TCuRqbG~JCB!NZLd;pOHUl(J%c8lSM~ z)G=P~VCZi@SYdHH=Hca@sZkh&nyiBMaWe zCEsF$IeY)gf#E`fbe&MgaxAm3Cp;-MhnfB^C*zia?WtZdb3ye3*b60Qwp>H5JXe~& zOQeRtIs45^z#&jXqVG=4-U;X#&1~MQ8EdC_fnhca<^v(KQXYzKq3+M(qneF6xa^5! z!G!Z~=%~QQ-0I;u#>V1Xktor2MlhB(WeZs{KV6)(C&Ue_B_UU#q&)ld;QE>mvh@Z~ zjbQDTkCVyf-5D(vzrrqz|#6Ps6l?~yJgf~{5=iDz?MLpIS{ng#gooV!FlR*oX2 zm11s}xY!e{w>`EX$P<0lZ?20_`5Y3m)2zSN`mD#*>uS2YCw$`cII z%@aZz)8KFU7i*BNvzBb_z)A1zIQWD`ge-g? zUEs=Dgpp+!?M>H*%@2^AtMe-pg^SAR5lvc4?7_aLs8ETehpkQR_YRmaH5bGw9SIeunh0oBeWi=C2pp>7`@Fj3M4kwEabj*sVuS--%CY zrLWHvZG)Sn%-o5A>oozn^SrKvKwMA@!O)tXr-PSed^e*&{iGx*})Ty9QLlsv4#;;#X zEh+IAOn$ghng4=hK*>1(SaSe-G?WXabTU{*%yox0|Kp!> zU<(E$qIOXBz|&x?Y3d`uqkxiDa6F!ts4WM|Ffnv6!>lv1V9k78#U0P0J$Rl!KruA4 zj^y7$;CVEZyrUqeF()ZW*$yowwxwS)5W}I;hkVRDjw+ln1PV|~xX`S~@i7x_!;E1&?PI)dpK`OXzDBb|r1tPKEw%*3E<&}_w`t9(X40 zEMJD$f`CKpk*YLxfpZQD!VEK}WSDc+r}FD=mhNmf36SgOVO<5UjVeeTlmiInJcf}) zRXJ>6k!daI!^MZOCZ}Ma%IZo~M_f-()&zXT))$DzR8`i_T~7M)S{(eA1%dU)zs1ac zKhmMk%LlC>1q* zTRmf^GlaLMU9rmo+!;q?P!6;?FEuXVK;o!i(aEuyUo#xpU1`A-h-U8_d;;7`N{W`( z=8t3s;n6$PrD~c2kw3*YSE`Oflgwac{x>R*g>GLUMxWnU_1htD1{UehjhPNDFTvdN zR5>~MAm8);>Fw-T#*E1gL%}#4TP7v8efpCkr>#})X#&Yne;?0D>x2_aUHSF4T}*3> z-s|!oZHn2{t6m=u;*ympk6eyi5ikE@|7YM1P~Vf%6kHEm@dcJ)vI(QnnVf66US`t| zYd{YtuD#tqO5@XK(7MQF6XoT$ZUvyo(JnV8bc4cWy^x}@+%?|mJiOorou&jh+yW{m zE5)x9->4a+#T<$KtFMVe=6hE_mIVoXFc=4o-q2eOb-;=YmC`IZ=%h$k_4TXubfF8~ zLX`_X0Nf}$zjLm8z)Vibkoc3^`+6HH8v3xM8u*-<^Ly-K2%Vq4P1ugTvF+}L&?x@Q z;yfijYp^FL(SPe{YHG^B#Z@yo@L1~GbZx!o@aH)wfhaN~g5QZ04LD%$WR>ui{{WtV zP2rT1xyA9on88Xj50idV1c1}XGwIghh_kvwd~`S+q%^*(=LX+`?$>@sTQAlfxgOp+ z-CvBoQm-d{I0e1g#~$on@ElMQnKt&}gcpt1s$pPw%$hgb%Q zGk|^NXudV1MbPu{)kx5{_Z5R?iSoeq_G*j-K5xT=cHu3$QjTSoXV{+v8(ZWa0yrMC z{BGP%6T1XZ7!@Fc8ULdigf4QK6Y+*}RgUFIR*lwQ@x6g3T%U+2i{Q%#yg+dn)+ba# z!Ib0H9cF&_XF*Rd3p)A`+*ujmM$<2XE9pD*UPU*K!S(1`mOS*L|9 zn{Pa;FL%=ZLJ0@DovO<3vt92^brg*M-i0yJ#Bo8#pY^mLG+=N0O^ z2&LLF1OGo1pJpm33**M!5;>d5nyltG>N8%=QliXOqO4^f561&WOwVcoiB%*cm{W9c z4v?*8t#~~s05(ENRy=@JNdW?xPfCTkqB5k2(`|{M$&oV7FI|XE`Un9xd~M{W3q0SI}^ojUe4!9nNR+Ul8EbCW}6kcK9zhx#6A%?UfOx&x&#b__&~U z9vWbx9f^gFZQUJ;`N7MUinbFdtQFasYtsB(K$r0UEU*|J^qcCHl_Ktj5R%y?E*NJq z*mo9F^OXmm0o{uinYOkzRU#HL41UK`jH8twAzqiez1yq~GrVr9d244!noMvMC5+8L)(W8uN3 zv*pVsNI&P$M%g+$f_~&995-k4yYEW?dA59g6e%?ej&0EP*h^* z^o7(zwvTXsEy9MY|AzpcrUW1am|~L!)&Jw{GN?0ixwoqAde)&)aP}5f9s37*VAQKM~XZ5K`S9h;QFuSW8x! zEzg|WN|Lah8+O}0r6h|!FaARAF9pyhFzpb3YyGg{I-0AB7Z(rOOE&b+Pe~!5O!suz z371m;uBpK9ea-0E37h+mtI3Yh&rDv^N3XT_ms1A1%s9coPNq3$qV$7k~aaBW|>3v~or@;Ztf+Iv`0T5X@0G`^G zML75rd`bdFlz!mEj3)H7!rLaAgbc7e>AW^H#TO+k;_aqZGJWQ_N&UK}64BZ9>B6c5 zVygvR~I=iKziRO zZt)6c32cm>o2?ca8M$7SVahH3^9k@)k7roWo~(8iF16;@=`ua%=r$Q#-^~2cneyQL zI=%PLT9i)N;oN(O0E#vBy5h@hCgkVS zOk1^rcgEXT(?_R*Emd6Z ztOdMMbreP^5)>38$?2pa0j!>{nzD9f(Y-7CupI2ZGuTEi8G*)4Ya-yyq8eC=FFsf|7zYE< z0ZMs1#!}^1t3+U66w;s+^I`s+!y8c>9c%gr(qp1cPH2XR;|2BFl|SJzIq1-wrbRK0 zm#foUa{LDy#cbAKTFtZSUmU!Y0t%a?CW4a4_D3m@fE@@OdmUpXme7IR?U;4`h9{v= z9N|t5JcwLOVKsWWuNuOMu z(rL_yr=SO(?CZj!0#zjP`1m-F2m3zmUtJ*4DPY6_RN|twFzDyj%AZ=&-oHYB-nMi5 zN;Ozr5~qL|U9@FK$H4SDs>V@NJhZwLc2EZmYJDxWl&A4G3&0R(#p?#`Y#zLwTN{ZV z=xgKhI{i$P)q>1`^n2%kjwT@{ro^CVx!T&MP)-P@Eo*DBl>d(N`=EHfE3#2VW!RR! zFa+yGNPM6;-|Xiw<4Fi#Zxgw4lI=TT?e)q>XKO5&l$Cj?NID8u$m8Q9$Mu<51;x$U z=7C&5OV5vJ@)MbT9a)z#(F%adC>l$-hPftZaP|7MURRKuMc!8uZ_Z~|gDs}z=j+%I zYBj10Tg3xNY22unftfjzBqF}t5M*ZajGo$cDaQ4i?q5ScBZPPO7u;wV~yVyMWEi zFWY3g)wfmq!1$a#hiHFu^DO}A7ou$dWaD=-@;ME+ym#TzN;w5v1ymewicS$i9|5fI zl}HM!%I6GPp9Fr9^CbXX{G;G=UaB}gw`@L_?$@ydOyQ)W<&}2Tp zW?xBo^8D%<(4(vj^a*4z#1}`?-PH^*i9jzX7>G|MD>#1@6r*IIWDt=xnD&-%G2J)< zYTP#S)vtbi*G+C|ZDkM?1a#IGWc(Q)9S20-iYg>Db#zkE$XcRb<5)9SFR-fuZ zf+_EF&+^nRgV;YS;7^3iSx~Oe5BNIk?g5|F8tw0RBKiLo5OW z!-g*SEL1y?zv}gNK%n*~@`+JNSRq(gSXQ&gLbZVZgT3#Pob61;LcOihN1NH)#tZ!M zXWs{gSA|9vurbbyGj_Z82O+X6fKp{{;+vPek`fu4r3S>02MdX3N8%TFkIZH`L>dge?^ia|7(ZBsp9B3x}gYFYnzZ5$ z9GBP4ClhI0w&!IG3-~Y|wGN9>QcHpvfEeaT0e7_Q5k&s7gQv>kh+o#bf4uV&=uIv- z@w*N1d$j&+WSpJ!tO*Lk4(NbT5KWiUEzdEvM7APhLr#MrN1K`clqa#YYUNYse66G53ffsM^eC?#3@91+Qt$Qr z2tR>B#_zBE)#9ZhB}Es%KN1MYj#QF+d-JKd$wB9QQU9hKJ7Pq-8(F_nq(-MSpoPLI zsKnu(iAc>)o7Q%3^ZID1Dqd=p{T*lGa_Ou2zr}pLZ}4hX0mZvlM`S`xQ(xlgtXEfjFJ}RwXZs88beY_H zevea(c*m8iDm?fC&!1Pbh@K7$)v18KCOt2GN|x_71HcW=z<4cuj!MjgTG#^Dc1|gBR+$k#!LCIhC#y;lB^USrwl#Jk}^6BhS ziW9Ce>BE;D??W!!_&j``q>S=ZZ$}|s*3dK_TPgpVYnRgwG0I*@hwBv?3`qgUSw8x1 z5wSx~Zz(CDyqaZC&XbhWX>ONA`zs@wRlsCZ99%DMt2o zwPv8qrFc|cR8}x?Ioa>=jE>n91MZYpLrh%83anA4*&}5{_9zV8J_+168nvzXYr2It zxUUU!NyO9uI;|FF1BPc(n|^aYQR45%i2!QrrwhXg+#@fQp7TV8M9b)fc&Q|W^D|iX zT>X4aSM7uH4`Q-Bxe$;0y8U-bC{3TtWByM7^AHU0bDcn2mdq?5H6t@{%<0_rjGlv(v!e*(4r0;JV?in zAJ3MaXFgV@LI8GX(~dBEZtc4DtQCaP@e?PgU*A3~n17UUnVW|Xr6(c0B(DLmo~ zRjyQt9)0wGG=OK4&HCk6ne7 zzI{9S{pe$lORuq9XgON>*D9XyP@6H}sqp+_jvqfEy|ji68_=m!r`Wxf^O`E&*8}(8 zM^sm zz&C6Dpu>^p$)DS&2?^X@#&^Gx8u7I10KWiw`}#ZS!0BT=M)WWJxN06n#W?UpU>?rL z@!**g^wzLDsY-Bp`hM|Dx^2MCG`dSadUEzx@{Qypi9BzyYC6{QJRfwk8(cHNBOkdg{^QJ@j*l1* zf%)yPRjbH9z@G(SGR>VkkN%Gd=Id$GnSgw0(idOway z5FhG%?AS3OLL>kZkL2mzRjQ;-pqYTd%(RsUzqf4N&XJkqgr4->caEnSKhF|jmidHZ zO)C9*=JVG3%{f%6z+bw8WMFmb@xe<7r|@Y)$? zLjnu`Q#|&A^*#tNa}6GRH51@!I(GD!d|)+e)}&sS_7ozFjg1rHO-f3%X-LlG>B%jA z-~Rm+7FLfoZQjh|TJf@2_p)BS=szCw0{LJjV*Lj7nS>%Ge~i!7s9udu@;DSe7*|4c zR1CfH+Uv5m>2D?$OrF@!<(NF>D@ktCrp@BH0%KkC7A&CS$Bxs^UAvspCS56)K2y37 z2nq_JPe(mWZR<77wcsmvZJ>v~|B%hdiPDC1y*VEjVF^g$#o9Mde3GW$^Af$ed=72c zy^$w2IV}z|bK`Hxx*t&H1)M=vx%jbVO{mQMavE{Kn0F_E=d8F`8CA(g|x^#g}e**_xDam4e(&LZ)A8Vg=xt@Q~cAkM3 z#3n;m0^aMvN~kzJoi+ho@{8wh+e*yOAF~!E2A;9NB46XswEHj5;ID3Q2x`xrTZk8W3|2 zi+}4*==mv%bN67&hMWivDZvzm8E4T^QKA7EA5kF2iWMr*xUsiVc{cm?;PprI=FR8z zItzs`@GQoGpiMX%q9UW||J%E|*gA?Ud}7Bn4n{zv_9bzZRA4y;3{e%KR5C%LAx&EK z=OI<4KAsH*XVgB>gt{qhRf#H?ghrIuX=2j?B2HqF5P|Icxvj5% zbJO$9=6J{J-MxGF{w%S-v94!!X6MYzx3hD0&YU@OJ#{LfT*Vym1wb=qxs z{f}-yeYm$*Hg4D;Zy!G{@4WL56$j4B0}npn$YX}G?vC1&5HRa$iI`c5V=`^3%t1#4 z;t+s+$Bpa1xGd?^*oX4#fx~k0-zTJ1`)ON8=dye16|q*=nCjy6o7t2QDt|uLrNk9M zB-iMWF8l&6dajQykVgloG{gdClKs&w%%@uqXji*&8&ur&=D=GrI(k-%4r+}~a-sF2 zT+{WE?c2A@=-IQx^lghAop!JE0_WJ+uM^!KXkzBua zU0?+PVzJYwM|3S}t&~b7xuMVE9#zX8JTc@<8G(7EF>j+!p9nM(0Z1e8L1^xSPtMCr z1N}1c@fj&i|4-W1HIDIEnT_(TRd`3^!i_5TcB7kX#ZAYrR0lO}s2FE%R{R406S@4-Lge~`9f!L#A*0J)2@;@F|8hW zi3bM<<+D#elNWyRbEmzxa0?%3)jfac!t95RjNkwYkS5X}7!9m3uw9pYZs!H?~ zodLl%95ltCx{dp5ajraFN9ybQy6oM%*NGo5PfRHGt!{k?22e-d`BcceK;Lza%XOS)@i5)hg4>zzVyDbYPkMj`;&4=)w&yLJpmt! zrB_d4fpf6}uz<2{+t*Zq>f^=t9Eo_V@y?rXah)CU>t0A-Z7xKynwD2s0|F_C;4m9# zZ*8wg8O#bsJ7Jq3O*Diws2NvcJ}CFH?&&#pO!v8HN3k!FXho(jmUNI_qnl3K>jF(zkI(?JnqFa3GDv<)yjO^5tVd872i7=wKQKqAU#Jl?K`@10%$G zbE=A&=D>Wuxoel~c&tyqs?x=DX>`D~u&?HK2M?-EH#MuH?Wxwm$STBOqq;70Mn!?< zoaR^ql)^w4KODi}ifMJ%$)O9VsS|0=I%-oFX+NX=Fu;wxF)={TYU2PfB`!U_dOs$vEP+pIZ$T>9u`IaZIK zj{#+v0r?QllxC#;j&^7I#*fb$#@-w-pR(GF%iG%v_Z$Cg>w^fGqV59@P#gs&2Zo+ zh3$U&`fZX61brAVFlmRZWu<}R2C$BUb)mIwY9>ZEQX(8!&JK>`#__z^x8m+qb>do7 zl(W{0_YnaiP=5q&&Me6M`=5%a7F^qgd!*$~wUKC}a{Y^I97T*rS4uK>enM_soLnZ7 zcPitU9eGk0@LRvBw>$rB6u7w=$? zR5b%~TwP~CI9q4Ojy`8)z}L81Vfe5)M1Tm?ihwHfKowaUyhKxLHS^}j3B+(P#pTa> zLVAcL>k07)LshQ<0Y-59aoyZFK5zazOX#@dDULh6CWphzue6M1TmaL^QC06ER@|rmIVj(N!C8?uodCJH0#ZDS(K@o9`1w9Gr4DZO}~$BMr_^ z4`PygK3q?Kdkn;*@C>$G-8`?+71 zPctcOt=Qw3m&MKIMyG;*CvCwkB2)(kg#H_tRmYLn zkc%#g;jClefx_V$LO;_au?KDGb`N}utCS~NhS4zExVAEVnuxb+_^4CXJbs=0JVwuG zN85>dSbfd6JU&g!k2p(5T%|mf+G#ZWI;Z9F>lDr7*CnoS^(yV|o0#ARW%qEzR;L|XONkEKWPv~riRM9khCYB< z5Z1w4_2gsqw3yJ;junaG%=vK$a|UF{2YbF<1>E!eDeJwvq@C0V2?71RxcqBLYN#2oM1x&~yaIfSL|D z3nT(WfCvx)AV3Dhen13>01+Spg&;r%R0!-Wln4+3B0vPlfY=9!01+SpM4%7^$bbrg zorMwsB0vO)02vVb01+SpM1Tksf&dv%A+WPhB0vO)01+SqVjmy^M1TkofkF@<11bb| z7D@z&01+SpWI*f#M1Tko0U}Tc0%Smiz|KO601+SpM1Ty4eSioM0U|&I3PFGjs1Vp$ zC=nn6M1Tm80kIDd0U|&Ih(I9-kO36}I}0TOM1Tkof&T*za9tiKk8$Y$0000 + +SLACK_BOT_TOKEN= +SLACK_SIGNING_SECRET= + +SLACK_SCAN_CHANNEL_ID= +SLACK_ALERT_CHANNEL_ID= + +## Step 3 — Confirm AWS Profile + +Verify which AWS profiles are available: + +```bash +aws configure list-profiles +``` + +Example output: + +```bash +default +``` + +## Step 4 — Verify AWS Identity + +Confirm your credentials point to the correct AWS account: +```bash +aws sts get-caller-identity +``` +Example output: + +```json +{ + "Account": "312345678432" +} +``` + +This account ID must match the value set in: +`EXPECTED_AWS_ACCOUNT_ID` + +Safety Defaults + +The default .env configuration runs Bloodhound in safe mode: + +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true + +This means: + +infrastructure will not be deleted +Bloodhound will only scan and generate a teardown plan + +--- + +# Scenario 1 — Run Bloodhound Locally + +Bloodhound can be executed locally using the built-in runner. + +### Verify AWS Profile + +From the repository root, confirm which AWS profiles are available: + +```bash +aws configure list-profiles +``` + +Example output: +`default` + +Command + +Run Bloodhound locally using a valid AWS profile: + +Syntax Usage: +```bash +AWS_PROFILE= python -m tools.run_local +``` + +This command is useful for: + +debugging scans locally +validating AWS credentials +testing pipeline behavior before deploying changes +What Happens + +The runner: + +loads .env +authenticates with AWS using the specified profile +invokes the Bloodhound pipeline + +Pipeline stages: + +``` +scan_resources() # scans AWS resources (EC2, ELBv2, RDS) +compute_budget() # calculates potential cost savings +plan_teardown() # builds a teardown plan (no deletion) +``` + +### Important + +Local execution runs in safe mode by default. + +This command will: + +scan AWS resources +identify unused infrastructure +estimate potential cost savings +generate a teardown plan + +It will NOT delete resources unless destructive mode is explicitly enabled. + +Equivalent Slack Command + +Running this locally performs the same scan as the Slack command: + +/v2_seek + +### Example Output + +Example terminal output: + +```bash +aws configure list-profiles +default + +AWS_PROFILE=default python -m tools.run_local +``` +```json +Bloodhound pipeline started +Event: {} +Bloodhound pipeline completed +Scan summary: +{ + "candidates_total": 61, + "kept_total": 1 +} +Budget summary: +{ + "projected_month_end_spend_usd": 3645.4766142570115, + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true +} +Teardown summary: +{ + "apply_changes": false, + "simulate": true, + "planned_actions": 61 +} +{ + "budget": { + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true, + "projected_month_end_spend_usd": 3645.4766142570115 + }, + "ok": true, + "regions": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2" + ], + "scan": { + "candidates_total": 61, + "kept_total": 1 + }, + "teardown": { + "apply_changes": false, + "execution": null, + "planned_actions": 61, + "simulate": true, + "targets_filter": null + } +} +``` + +--- + +# Scenario 2 — Slack Scan Command + +Bloodhound can be triggered interactively using Slack slash commands. + +### Slack Command + +``` +/v2_seek +``` + +### Command Preview in Slack + + + +### What Happens + +1. Slack sends an HTTPS request to the Lambda Function URL +2. Lambda routes the request to the Slack handler +3. Bloodhound executes the scan pipeline + +Execution path: + +``` +Slack + ↓ +Lambda Function URL + ↓ +slack_handler + ↓ +execute_pipeline() +``` + +Slack returns multiple messages summarizing: + +- scan results +- whitelisted resources +- budget analysis +- teardown plan (dry run) + +--- + +## Scan Summary + +```md +Bloodhound v2 — Scan Summary +time_et: 8:23 PM ET + +Region: us-east-1 +Counts: candidates 32 | kept 0 +- Candidates: ec2.instance=15, rds.db_instance=1, ec2.elastic_ip=4, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=12 +- Kept: ec2.instance=0, rds.db_instance=0, ec2.elastic_ip=0, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=0 + +Region: us-east-2 +Counts: candidates 7 | kept 1 +- Candidates: ec2.instance=1, rds.db_instance=0, ec2.elastic_ip=3, ec2.nat_gateway=1, ec2.ebs_volume=0, elbv2.load_balancer=2 +- Kept: ec2.instance=1, rds.db_instance=0, ec2.elastic_ip=0, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=0 + +Region: us-west-1 +Counts: candidates 0 | kept 0 + +Region: us-west-2 +Counts: candidates 22 | kept 0 + +Totals +Counts: candidates 61 | kept 1 +``` + +--- + +## Whitelisted Resources + +```md +Bloodhound v2 — Whitelisted Resources (Kept) + +kept_total: 1 + +Region: us-east-2 +- us-east-2 ec2.instance i-00339b9b5023ec69e (Name=cp-fs-curriculum) +``` + +--- + +## Budget Summary + +```md +Bloodhound v2 — Budget Summary + +Cohort +- start: 2025-12 +- total_budget: $3,000.00 over 7 months +- to_date_spend: $6,261.11 +- remaining_budget: $0.00 +- remaining_months: 4 +- monthly_allowance: $0.00 + +This month +- month_to_date: $3,057.50 +- projected_month_end: $3,510.46 +- over_budget_days_required: 2 +- over_budget_threshold_met: true +``` + +--- + +## Teardown Plan (Dry Run) + +```md +Bloodhound v2 — Teardown Plan (DRY RUN) + +mode: DRY RUN — No AWS resources will be deleted + +planned_actions: 61 + +Top Regions Affected +- us-east-1: 32 +- us-west-2: 22 +- us-east-2: 7 + +Services affected +- ec2: 46 +- elbv2: 14 +- rds: 1 +``` + +Bloodhound operates in **dry-run mode by default**, ensuring no AWS resources are deleted unless destructive mode is explicitly enabled. + +--- + +# Scenario 3 — Generate a Teardown Plan + +This command previews which AWS resources **could be removed** without deleting anything. + +### Slack Command + +`/v2_seek_destroy_plan` + +### What Happens + +Bloodhound executes the full analysis pipeline: + +```md +scan_resources() +compute_budget() +plan_teardown() +``` + +The teardown stage generates a **deletion plan**, but no resources are deleted. + +Bloodhound always runs in **dry-run mode** unless destructive mode is explicitly enabled. + +--- + +### Example Slack Output + +When `/v2_seek_destroy_plan` is executed, Bloodhound posts multiple analysis messages. + +--- + +## Scan Summary + +```md +Bloodhound v2 — Scan Summary +time_et: 8:36 PM ET + +Region: us-east-1 +Counts: candidates 32 | kept 0 +- Candidates: ec2.instance=15, rds.db_instance=1, ec2.elastic_ip=4, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=12 +- Kept: ec2.instance=0, rds.db_instance=0, ec2.elastic_ip=0, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=0 + +Region: us-east-2 +Counts: candidates 7 | kept 1 +- Candidates: ec2.instance=1, rds.db_instance=0, ec2.elastic_ip=3, ec2.nat_gateway=1, ec2.ebs_volume=0, elbv2.load_balancer=2 +- Kept: ec2.instance=1, rds.db_instance=0, ec2.elastic_ip=0, ec2.nat_gateway=0, ec2.ebs_volume=0, elbv2.load_balancer=0 + +Totals +Counts: candidates 61 | kept 1 +``` + +--- + +## Budget Summary + +```md +Bloodhound v2 — Budget Summary + +Cohort +- start: 2025-12 +- total_budget: $3,000.00 over 7 months +- to_date_spend: $6,261.11 +- remaining_budget: $0.00 +- remaining_months: 4 +- monthly_allowance: $0.00 + +This month +- month_to_date: $3,057.50 +- projected_month_end: $3,510.46 +- over_budget_threshold_met: true +``` + +--- + +## Teardown Plan (Dry Run) + +```md +Bloodhound v2 — Teardown Plan (DRY RUN) + +mode: DRY RUN — No AWS resources will be deleted + +planned_actions: 61 + +Top Regions Affected +- us-east-1: 32 +- us-west-2: 22 +- us-east-2: 7 + +Services affected +- ec2: 46 +- elbv2: 14 +- rds: 1 +``` + +Sample actions generated by the teardown planner: + +```md +delete_db_instance +delete_load_balancer +delete_nat_gateway +delete_volume +release_address +terminate_instances +``` + +This preview allows engineers to safely review what infrastructure **would be removed** before enabling destructive mode. + +--- + +# Scenario 4 — Controlled Teardown Execution + +Bloodhound can perform automated infrastructure cleanup, but destructive actions +require multiple explicit confirmations. + +### Slack Command + +`/v2_seek_destroy CONFIRM` + +This command executes the teardown plan generated by Bloodhound. + +However, deletion only occurs if **all safety controls allow it**. + +--- + +### Safety Controls + +Infrastructure deletion only occurs when the following environment configuration is enabled: + +```md +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +``` + +Additional safeguards are built into the system: + +```md +TEARDOWN_MAX_DELETE_COUNT +whitelisting tags +Terraform deployment guard +Slack confirmation token +``` + +These protections ensure that accidental deletions cannot occur. + +--- + +### Why This Demo Does Not Execute Destructive Mode + +This documentation intentionally **does not run the destructive command**. + +In normal operation engineers should: + +1. run `/v2_seek` to scan resources +2. run `/v2_seek_destroy_plan` to preview cleanup actions +3. review the teardown plan +4. enable destructive mode only after validation + +This ensures infrastructure cleanup remains **safe, auditable, and intentional**. + +--- + +### Safe Example Output + +When destructive mode is **not enabled**, Bloodhound reports that the system +remains in dry-run mode: + + +Bloodhound v2 — Teardown Plan (DRY RUN) + +mode: DRY RUN — No AWS resources will be deleted +simulate: true + +planned_actions: 61 + + +To execute the plan, engineers must explicitly enable destructive mode +through configuration and deployment controls. + +--- + +# Scenario 5 — Automated Scheduled Scans (GitHub Actions) + +Bloodhound can run automatically using GitHub Actions. + +![GitHub Actions Scheduled Scan](images/github_actions_invoke_lambda_scan.png) + +This repository includes a scheduled workflow that invokes the Bloodhound +Lambda function on a fixed schedule. + +Workflow file: + +`.github/workflows/invoke_lambda.yml` + +### Scheduled Execution + +The workflow runs twice per day: + +```md +16:00 UTC → 11:00 AM EST +04:00 UTC → 11:00 PM EST +``` + +GitHub cron jobs only run from the repository **default branch**. + +--- + +### Example Workflow Invocation + +The workflow builds a deterministic Lambda event payload: + +```json +{ + "source": "scheduled" +} +``` + +Lambda is then invoked using the AWS CLI: + +```bash +aws lambda invoke \ + --function-name BloodhoundLambdaV2 \ + --payload file://event.json \ + output.json +``` + +--- + +### What Happens + +```md +GitHub Actions (scheduler) + ↓ +OIDC authentication + ↓ +Assume BloodhoundGitHubInvokeRole + ↓ +Invoke Bloodhound Lambda + ↓ +Execute scheduled scan pipeline + ↓ +Log results to GitHub Actions + CloudWatch +``` + +The Lambda pipeline performs: + +scan_resources() +compute_budget() +plan_teardown() + +--- + +### Example GitHub Actions Output + +Lambda invocation completed successfully +```json +Scan summary: + +{ + "candidates_total": 61, + "kept_total": 1 +} + + +Budget summary: +{ + "projected_month_end_spend_usd": 3645.47, + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true +} + +Teardown summary: +{ + "apply_changes": false, + "simulate": true, + "planned_actions": 61 +} +``` + +The workflow also retrieves recent Lambda logs from CloudWatch to improve +observability during CI runs. + +--- + +# Scenario 6 — Manual Operations (GitHub Actions) + +Bloodhound operators can manually trigger infrastructure operations +directly from the GitHub Actions interface. + +![GitHub Actions Manual Operations](images/github_actions_manual_ops.png) + +Workflow file: + +`.github/workflows/bloodhound_ops.yml` + +This workflow allows engineers to run operational commands +without waiting for the scheduled automation. + +--- + +### Available Operations + +When launching the workflow, the operator can choose a mode: + +```md +scan → run infrastructure scan immediately +status → display Bloodhound system status +validate_scheduler → simulate scheduled EventBridge execution +``` + +These options are selected from the **GitHub Actions UI** when clicking +"Run workflow". + +--- + +### Execution Path + +```md +GitHub Actions UI + ↓ +workflow_dispatch + ↓ +OIDC authentication + ↓ +Assume BloodhoundGitHubInvokeRole + ↓ +Invoke Bloodhound Lambda + ↓ +Execute selected operation +``` + +--- + +### Example Lambda Payload + +Example payload generated for a scan operation: + +```json +{ + "source": "scan" +} +``` + +Example payload for a status check: + +```json +{ + "source": "status" +} +``` + +--- + +### Example GitHub Actions Output + +Bloodhound Operation: scan + +Invoking Bloodhound Lambda + +```json +Scan summary: +{ + "candidates_total": 61, + "kept_total": 1 +} + +Budget summary: +{ + "projected_month_end_spend_usd": 3645.47, + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true +} + +Teardown summary: +{ + "apply_changes": false, + "simulate": true, + "planned_actions": 61 +} +``` +--- + +### Example Execution — Scheduler Validation + +The `validate_scheduler` mode simulates the automated EventBridge +trigger used by scheduled infrastructure scans. + +Example payload generated by the workflow: + +```json +{"source":"scheduled"} +``` + +Example GitHub Actions output: + +```md +======================================== +Bloodhound Operation: validate_scheduler +======================================== + +===== VALIDATING SCHEDULER PATH ===== +Simulating EventBridge scheduled event +{"source":"scheduled"} + +Invoking Bloodhound Lambda +``` + +Example Lambda response: + +```json +{ + "status": "scheduled_scan_executed", + "result": { + "ok": true, + "regions": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2" + ], + "scan": { + "candidates_total": 58, + "kept_total": 1 + }, + "budget": { + "projected_month_end_spend_usd": 3138.03, + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true + }, + "teardown": { + "apply_changes": false, + "simulate": true, + "planned_actions": 58 + } + } +} +``` + +### Example Execution — Status Operation + +The `status` mode checks the operational health of the Bloodhound +Lambda service without running a full infrastructure scan. + +Example payload generated by the workflow: + +```json +{ + "source": "status" +} +``` + +Example GitHub Actions output: + +```md +======================================== +Bloodhound Operation: status +======================================== + +Invoking Bloodhound Lambda + +Bloodhound status check completed +Lambda invocation completed successfully +``` + +The workflow confirms: + +- Lambda is reachable +- IAM role assumption is functioning +- invocation permissions are correct +- the Bloodhound runtime is operational + +Example Lambda logs (excerpt): + +```md +[BLOODHOUND][SCHEDULED] + +Event received: {'source': 'scheduled'} + +Scheduled Bloodhound scan triggered +Bloodhound pipeline started +Bloodhound pipeline completed +``` + +### CloudWatch Logs + +During execution, the GitHub Actions workflow also retrieves recent +logs from the Lambda CloudWatch log group: + +`/aws/lambda/BloodhoundLambdaV2` + +This provides deeper visibility into: + +- Lambda execution traces +- pipeline stage logging +- AWS API activity +- runtime performance metrics + +Operators can view the full logs directly in the AWS Console: + +`CloudWatch → Log Groups → /aws/lambda/BloodhoundLambdaV2` + +--- + +# Scenario 7 — CloudWatch Log Inspection + +All Bloodhound executions emit structured logs to CloudWatch. + +Log format: + +`[BLOODHOUND][EVENT_TYPE][request_id=...]` + + +These logs provide visibility into pipeline execution, +including scans, budget analysis, and teardown planning. + +--- + +### Example CloudWatch Logs + +```text +[BLOODHOUND][SCHEDULED][request_id=17774179-8cfc-49ee-a503-c2e9d091a1ee] + +Event received: {'source': 'scheduled'} + +Scheduled Bloodhound scan triggered +Bloodhound pipeline started +Event: {"source": "scheduled"} +Bloodhound pipeline completed +``` + +```json +Scan summary: +{ + "candidates_total": 58, + "kept_total": 1 +} + +Budget summary: +{ + "projected_month_end_spend_usd": 3138.03, + "dynamic_monthly_allowance_usd": 0.0, + "over_budget_threshold_met": true +} + +Teardown summary: +{ + "apply_changes": false, + "simulate": true, + "planned_actions": 58 +} +``` +--- + +### Viewing Logs (AWS CLI) + +Operators can stream logs directly from CloudWatch: + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ + --region us-west-2 \ + --follow +``` + +This command continuously streams new Bloodhound +Lambda logs as they are generated. + +--- + +### Viewing Logs (AWS Console) + +Bloodhound Lambda logs can also be inspected directly +from the AWS Console. + +Steps: + +1. Open the AWS Console +2. Select the correct region +`United States (Oregon) — us-west-2` + +3. Navigate to CloudWatch +CloudWatch → Logs → Log Management + +4. Locate the Bloodhound Lambda log group + +Search for: +`BloodhoundLambdaV2` + +5. Select a log stream + +Each Lambda invocation creates a log stream containing: + +- request IDs +- pipeline execution stages +- scan summaries +- budget calculations +- teardown planning results + +### Console Walkthrough + +A visual walkthrough of the CloudWatch navigation process +is provided below. + +📄 View guide: + +[CloudWatch Log Navigation](demo/cloudwatch_log_navigation.pdf) + +The guide includes screenshots showing: + +- selecting the correct AWS region +- opening CloudWatch +- locating the Bloodhound log group +- selecting a log stream +- inspecting Lambda execution logs +--- + +![CloudWatch Logs](images/cloudwatch_logs.png) + +--- + +# Scenario 8 — Automated Teardown Validation Workflow + +Bloodhound includes an automated validation workflow that verifies the entire destructive pipeline in a controlled environment. + +This workflow confirms that Bloodhound can: + +detect infrastructure resources +generate a teardown plan +execute deletion +verify that the resource was removed + +The workflow creates a temporary disposable EC2 instance and verifies that Bloodhound successfully deletes it. + +Validation Script + +The validation workflow is executed using the orchestration script: +`tools/run_validation_workflow.sh` + +This script coordinates the full validation process and logs results. + +Run the Validation Workflow + +From the repository root: +```bash +./tools/run_validation_workflow.sh +``` + +What Happens + +The validation workflow executes the following sequence: + +```text +Lambda smoke test + ↓ +Terraform creates disposable EC2 instance + ↓ +Validation event sent to Bloodhound Lambda + ↓ +Bloodhound teardown pipeline executes + ↓ +Instance deletion verified + ↓ +Validation workflow completes +``` + +This confirms that the actual destructive execution path works safely. + +Example Validation Output + +Example terminal output from the validation workflow: + +`./tools/run_validation_workflow.sh` + +```md +================================================ +Bloodhound Validation Workflow +================================================ +``` + +Step 1: Running Lambda smoke test... + +✓ Lambda function exists +✓ Environment variables validated +✓ CloudWatch log group exists +✓ Lambda Function URL configured + +Smoke test passed. + +Step 2: Starting controlled teardown validation... + +Validation Run ID: 20260326_205446 + +Creating disposable EC2 instance... + +Instance created: +i-01fee506f85a03005 + +Triggering Bloodhound validation teardown... + +Lambda response: +```json +{ + "ok": true, + "scan": { + "candidates_total": 62, + "kept_total": 1 + }, + "teardown": { + "apply_changes": true, + "simulate": false, + "execution": { + "attempted": 1, + "succeeded": 1, + "failed": 0 + } + } +} +``` + +Verifying instance deletion... + +SUCCESS: Instance terminated confirmed. +RESULT: PASS +Bloodhound successfully deleted the resource. + +```md +================================================ +Validation workflow completed successfully. +================================================ +``` + +### Full Validation Log + +The full terminal output from the teardown validation workflow +is available below. + +This log shows the complete lifecycle: + +- Lambda smoke test +- Terraform validation resource creation +- Bloodhound teardown execution +- Instance deletion verification +- Terraform state reconciliation + +📄 View full validation log: + +[Teardown Validation Workflow Log](demo/teardown_validation_workflow.pdf) + +The validation workflow ensures that Bloodhound’s destructive pipeline works correctly before enabling deletion in production environments. + +This test should be executed: + +after teardown logic changes +after adding new AWS resource types +after modifying IAM permissions +before enabling apply-mode in production +--- + +# Typical Operational Workflow + +Operators typically use Bloodhound in the following order: + +``` +1️⃣ Run scan + /v2_seek + +2️⃣ Review teardown plan + /v2_seek_destroy_plan + +3️⃣ Validate teardown workflow + ./tools/run_validation_workflow.sh + +4️⃣ Execute teardown (if approved) + /v2_seek_destroy CONFIRM +``` + +This ensures infrastructure cleanup remains **safe, auditable, and controlled**. + +--- + +# Why This Version Works Well + +This demo guide now shows: + +| Capability | Covered | +|---|---| +Local execution | ✔ | +Slack commands | ✔ | +Teardown planning | ✔ | +Controlled deletion | ✔ | +GitHub Actions | ✔ | +Scheduled runs | ✔ | +CloudWatch debugging | ✔ | +Validation workflow | ✔ | + +It demonstrates **every major capability of Bloodhound**. + +--- + +# Next Step for You + +Now you simply: + +1. Run the commands +2. Capture screenshots/output + +### With supporting artifacts stored in: + +```md + +docs/images/ → screenshots used in the guide +docs/demo/ → full walkthroughs and validation logs (PDF) + +Examples: + +docs/images/github_actions_invoke_lambda_scan.png +docs/images/github_actions_manual_ops.png +docs/images/slack_command_preview.png + +docs/demo/cloudwatch_log_navigation.pdf +docs/demo/teardown_validation_workflow.pdf +``` diff --git a/docs/run_validation.md b/docs/run_validation.md new file mode 100644 index 0000000..6e7cba5 --- /dev/null +++ b/docs/run_validation.md @@ -0,0 +1,359 @@ +# Bloodhound Validation — User Guide + +## Table of Contents + +- [When to Run Validation](#when-to-run-validation) +- [Quick Validation Workflow](#quick-validation-workflow) +- [Step 1 — Run the Validation Workflow](#step-1--run-the-validation-workflow) +- [Step 2 — Automatic Validation Invocation](#step-2--automatic-validation-invocation) +- [Validate Lambda Health Endpoint](#validate-lambda-health-endpoint) +- [Step 3 — Automatic Deletion Verification](#step-3--automatic-deletion-verification) +- [Step 4 — Validation Logs](#step-4--validation-logs) +- [Bloodhound Execution Modes](#bloodhound-execution-modes) +- [Expected Slack Output](#expected-slack-output) +- [If Validation Fails](#if-validation-fails) +- [Safety Reminder](#safety-reminder) +- [Recommended Validation Order](#recommended-validation-order) +- [Related Documentation](#related-documentation) + +This guide explains **when and how to run the Bloodhound validation workflow**. + +The validation workflow confirms that the full system is functioning correctly, including: + +* AWS infrastructure +* Lambda execution +* Slack command routing +* teardown logic +* resource deletion + +This process uses **temporary disposable resources** and is safe when run as described. + +--- + +# When to Run Validation + +Run the validation workflow when: + +- deploying Bloodhound for the first time +- modifying Lambda code +- modifying teardown logic +- modifying IAM permissions +- modifying Terraform infrastructure +- upgrading AWS SDK dependencies +- before enabling destructive mode in production + +You **do not need to run validation for every small code change**, but it should be executed before production use. + +--- + +# Quick Validation Workflow + +The fastest way to run the full validation is: + +``` +tools/run_validation_workflow.sh +``` + +This script performs the following checks in order: + +1. Lambda infrastructure smoke test +2. Controlled teardown validation + +If any step fails, the workflow stops immediately. + +--- + +# Step 1 — Run the Validation Workflow + +From the repository root: + +``` +tools/run_validation_workflow.sh +``` + +You will see output similar to: + +``` +Bloodhound Validation Workflow + +Step 1: Running Lambda smoke test +Smoke test passed. + +Step 2: Starting controlled teardown validation +``` + +If the smoke test fails, fix the deployment before continuing. + +--- + +# Step 2 — Automatic Validation Invocation + +During teardown validation the workflow will automatically invoke the +Bloodhound Lambda function in validation mode. + +The validation script performs the following steps: + +1. Creates a temporary validation resource using Terraform +2. Captures the resource ID +3. Invokes the Lambda function with a validation payload + +Example validation event: + +```json +{ + "source": "validation", + "mode": "seek_destroy_validation", + "target_ids": ["i-1234567890"] +} +``` + +The Lambda validation handler enables controlled destructive mode +internally and restricts deletion to the provided validation targets. + +Validation events are routed through the Lambda event router +using the event field: + +```json +"source": "validation" +``` + +This allows the full teardown pipeline to execute automatically +without requiring manual Slack commands. + +The validation harness invokes the Lambda function directly, +bypassing the Slack command interface. + +--- + +## Validate Lambda Health Endpoint + +Optional system status verification: + +/v2_status + +This command returns the Bloodhound system status including +execution mode, deletion safety limits, and recent scan results. + +Before testing Slack integrations, confirm the Lambda service is reachable. + + +curl https://YOUR_LAMBDA_URL/health + +Expected response: + +```json +{ + "ok": true, + "service": "BloodhoundLambdaV2", + "status": "healthy" +} +``` + +This check verifies the Lambda deployment without triggering a scan. + +# Step 3 — Automatic Deletion Verification + +After Lambda executes the validation event, the validation script +automatically verifies that the resource was deleted. + +Example output: + +``` +SUCCESS: Instance no longer exists. +RESULT: PASS +``` + +If the resource still exists: + +``` +ERROR: Instance still exists. +RESULT: FAIL +``` + +This indicates that the teardown pipeline did not execute correctly. + +--- + +# Step 4 — Validation Logs + +Every validation run produces a log file. + +Location: + + +`logs/validation/` + +Example log: + +`logs/validation/teardown_validation_20260307_143221.log` + +Each log records: + +* validation run ID +* created resource ID +* test steps executed +* final result (PASS / FAIL) +* Lambda request_id for traceability + +During validation runs, Lambda logs include a structured marker: + +[BLOODHOUND][VALIDATION][request_id=...] + +The request_id corresponds to the AWS Lambda invocation ID +(context.aws_request_id) and allows a single execution to be +traced across CloudWatch logs. + +Only the **3 most recent logs** are kept automatically. + +--- + +# What the Validation Tests + +# Bloodhound Execution Modes + +Bloodhound has three safety modes controlled by environment variables. + +Dry Run Mode (default) + +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true + +Behavior: +- resources are scanned +- teardown plan is generated +- nothing is deleted + + +Simulation Mode + +APPLY_CHANGES=true +TEARDOWN_SIMULATE=true + +Behavior: +- deletion calls are simulated +- AWS DryRun APIs are used +- nothing is deleted + + +Apply Mode (destructive) + +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false + +Behavior: +- Bloodhound executes deletion actions +- non-whitelisted resources may be removed + +The validation workflow confirms the following systems work together: + +```text +| Component | Verified | +| ------------------------------- | -------- | +| Lambda deployment | ✓ | +| validation event routing | ✓ | +| environment configuration | ✓ | +| resource detection | ✓ | +| teardown plan creation | ✓ | +| controlled destructive teardown | ✓ | +| Slack reporting | ✓ | +``` +--- + +# Expected Slack Output + +When `/v2_seek_destroy CONFIRM` runs successfully, Slack will show a message similar to: + + +Bloodhound v2 — Teardown Results + +Deleted resources: + +`ec2.instance=1` + +--- + +# If Validation Fails + +Check the following: + +**Smoke test failure** + +Run: + +`tools/smoke_test_lambda.sh` + +Fix infrastructure problems before continuing. + +--- + +**Resource not detected** + +Check: + +* instance region +* instance state +* whitelist tags + +Ensure the instance does **not** have: + +``` +bloodhound:keep=true +``` + +--- + +**Resource not deleted** + +Check: + +``` +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +``` + +Verify IAM permissions allow deletion. + +--- + +# Safety Reminder + +The teardown validation temporarily enables **real deletion mode**. + +Always restore safe mode after testing: + +``` +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true +``` + +Then run: + +``` +terraform apply +``` + +This returns Bloodhound to **dry-run mode**. + +--- + +# Recommended Validation Order + +Always run validations in this order: + +1. Infrastructure smoke test +2. Validation harness invocation +3. Controlled teardown verification + +This ensures problems are caught early before destructive operations are attempted. + +--- + +# Related Documentation + +Slack validation: + +`docs/slack_and_lambda_validation.md` + +Architecture and configuration: + +`docs/bloodhound_v2_plan.md` diff --git a/docs/safe_operations.md b/docs/safe_operations.md new file mode 100644 index 0000000..abe4f6e --- /dev/null +++ b/docs/safe_operations.md @@ -0,0 +1,304 @@ +# Safe Operations Guide (Bloodhound V2) + +⚠️ Bloodhound must always run in dry-run mode unless explicitly validating teardown logic. + +## Table of Contents + +- [Core Safety Principles](#core-safety-principles) +- [Default Safety Configuration](#default-safety-configuration) +- [Safe Validation Procedure](#safe-validation-procedure) +- [Controlled Deletion Procedure](#controlled-deletion-procedure) +- [Full Cleanup](#full-cleanup-use-extreme-caution) +- [Terraform Safety Guard](#terraform-safety-guard) +- [Lambda Version Rollback](#lambda-version-rollback) +- [Emergency Stop](#emergency-stop) +- [Summary](#summary) + +This document describes the operational safeguards built into Bloodhound V2 and the procedures engineers must follow before enabling destructive actions. + +Bloodhound is capable of identifying and deleting unused cloud infrastructure. Because of this capability, strict safeguards are enforced to prevent accidental resource deletion. + +--- + +# Core Safety Principles + +Bloodhound follows a layered safety model: + +```text +Detection + ↓ +Planning + ↓ +Dry-run validation + ↓ +Execution Path + ├─ Operator confirmation (Slack command) + └─ Validation harness (automated testing) + ↓ +Deletion +``` + +Deletion should **never be enabled without first reviewing the dry-run plan.** + +--- + +# Default Safety Configuration + +The system ships in **safe mode** by default. + +These environment variables enforce non-destructive behavior: + +``` +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true +TEARDOWN_ALLOW_ALL=false +``` + +This configuration ensures: + +* Infrastructure scans run normally +* Teardown plans are generated +* No resources are deleted + +Slack will show a **Teardown Plan (dry-run)** message but no destructive actions will execute. + +--- + +# Safe Validation Procedure + +Before enabling deletion, the following validation process must be completed. + +## Step 1 — Run Scan + +In Slack: + +``` +/v2_seek +``` + +Confirm that the system reports: + +* scan summary +* budget summary +* teardown plan + +--- + +## Step 2 — Review Teardown Plan + +Carefully review the Slack message: + +``` +Bloodhound v2 — Teardown Plan (dry-run) +``` + +Verify: + +* resources are expected candidates +* no production resources appear +* whitelisted resources are excluded + +Example: + +``` +simulate: true +planned_actions: 36 +``` + +--- + +## Step 3 — Confirm Whitelisted Resources + +Resources that should never be deleted must have the tag: + +``` +bloodhound:keep=true +``` + +Bloodhound will list these in Slack under: + +``` +Whitelisted Resources (Kept) +``` + +If a resource should be protected but does not appear here, add the tag before proceeding. + +--- + +# Controlled Deletion Procedure + +Deletion should only occur after the dry-run plan has been reviewed. + +## Enable Deletion Mode + +Update environment configuration: + +``` +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +``` + +Keep this safeguard enabled unless a full cleanup is intended: + +``` +TEARDOWN_ALLOW_ALL=false +``` + +This forces operators to explicitly specify targets. + +--- + +## Targeted Deletion (Recommended) + +Specify the exact resources to delete: + +``` +TEARDOWN_TARGET_IDS= +``` + +Example: + +``` +TEARDOWN_TARGET_IDS=i-0123456789abcdef +``` + +Then execute one of the following: + +Operator-triggered deletion (Slack command path): + +/v2_seek_destroy CONFIRM + +or automated validation execution: + +validation harness → Lambda validation event invocation + +```json +(source: "validation") +``` + +Validation events are routed through the Lambda event router +and handled by the validation execution path. + +--- + +# Full Cleanup (Use Extreme Caution) + +Only enable full cleanup when the environment is confirmed safe. + +Required configuration: + +``` +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +TEARDOWN_ALLOW_ALL=true +``` + +Then run: + +``` +/v2_seek_destroy CONFIRM +``` + +Bloodhound will execute the teardown plan. + +--- + +# Terraform Safety Guard + +Terraform includes an account safety guard to prevent deploying Bloodhound to the wrong AWS account. + +Variable: + +``` +expected_aws_account_id +``` + +Terraform validates: + +``` +current AWS account ID + == +expected account ID +``` + +If the IDs do not match, the deployment fails. + +This prevents accidental deployments to production or unrelated accounts. + +--- + +# Lambda Version Rollback + +Bloodhound uses Lambda versioning with a `prod` alias. + +Every deployment publishes a new immutable version: + +``` +BloodhoundLambdaV2 + ├ Version 1 + ├ Version 2 + └ Version 3 + ↑ + prod +``` + +If a deployment introduces a problem, the alias can be moved to a previous version. + +Rollback procedure: + +1. Open AWS Console +2. Navigate to Lambda → BloodhoundLambdaV2 +3. Open **Aliases** +4. Edit **prod** +5. Select the previous working version + +Slack integration will continue working because the Function URL always invokes the alias. + +--- + +# Emergency Stop + +If unexpected behavior occurs: + +1. Set: + +``` +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true +``` + +2. Redeploy or update Lambda environment variables. + +This immediately disables destructive actions. + +--- + +# Lambda Execution Logging + +All Bloodhound Lambda executions emit structured log markers: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SCAN][request_id=...] +[BLOODHOUND][SCHEDULED][request_id=...] +[BLOODHOUND][VALIDATION][request_id=...] + +The request_id corresponds to the AWS Lambda invocation ID +(context.aws_request_id) and allows engineers to trace +individual executions through CloudWatch logs. + +--- + +# Summary + +Bloodhound V2 implements multiple safety layers: + +* dry-run mode enabled by default +* explicit confirmation required +* whitelist protection via resource tags +* Terraform account guard +* Lambda version rollback capability + +Operators must always review teardown plans before enabling deletion. diff --git a/docs/slack_and_lambda_validation.md b/docs/slack_and_lambda_validation.md new file mode 100644 index 0000000..8872665 --- /dev/null +++ b/docs/slack_and_lambda_validation.md @@ -0,0 +1,701 @@ +# Validating Slack Slash Commands and Lambda Execution Logs + +## Table of Contents + +- [Prerequisites](#prerequisites) +- [Part A — Open CloudWatch Logs](#part-a--open-cloudwatch-logs-set-this-up-first) +- [Part B — Trigger the Slash Command in Slack](#part-b--trigger-the-slash-command-in-slack) +- [Part C — Watch Logs Update in CloudWatch](#part-c--watch-logs-update-in-cloudwatch) +- [What You Should Look For in Logs](#what-you-should-look-for-in-logs) +- [If You Do Not See Logs](#if-you-do-not-see-logs) +- [Optional Fast Path](#optional-fast-path-sometimes-easier) +- [Success Criteria](#success-criteria) +- [Validating `/v2_seek_destroy` Safety Controls](#validating-v2_seek_destroy-safety-controls) +- [Verify Lambda Environment Variables](#verify-lambda-environment-variables) +- [Watching Lambda Logs Live](#watching-lambda-logs-live) +- [Common Failure Scenarios](#common-failure-scenarios) + +This document verifies that Slack slash commands are correctly wired to **BloodhoundLambdaV2** +and that Lambda execution can be observed in **CloudWatch Logs**. + +Bloodhound uses an event router inside the Lambda handler to determine +which execution path should run: + +Slack HTTP events → Slack handler +Scheduled events → scheduled handler +Manual invocations (scan/status) → main pipeline (`run()`) + +This validation confirms the Slack execution path is functioning correctly. + +Use this procedure after: +- `terraform apply` succeeds +- Slack slash command Request URLs are set to the Lambda Function URL +- `/v2_seek` is expected to produce Slack output + +Note: +This document validates Slack command routing only. +The automated teardown validation workflow is documented in: + +docs/validate_teardown.md + +--- + +## Prerequisites + +- You have access to the AWS account where Bloodhound V2 is deployed. +- You know the AWS region Bloodhound V2 is deployed in (currently `us-west-2`). +- The Slack app is installed in the target workspace and the slash commands exist: + - `/v2_seek` + - `/v2_seek_destroy` + +--- + +## Part A — Open CloudWatch Logs (Set This Up First) + +1. Log into the **AWS Console** (the same AWS account where Terraform deployed Bloodhound V2). + +2. In the AWS console top-right region selector, set the region to: + + - `us-west-2` + + Important: + If you are in the wrong region, the log group will not appear and you may see “Function not found” type errors. + +3. In the AWS Console search bar, type: + + - `CloudWatch` + + Open **CloudWatch**. + +4. In the left-side menu, navigate to: + + - **Logs** + - **Log Management** + - **Log groups** + +5. In the Log groups search bar, type: + + - `/aws/lambda/BloodhoundLambdaV2` + +6. Click the log group: + + - `/aws/lambda/BloodhoundLambdaV2` + +7. Click **Latest log streams** (or click the most recent log stream listed). + + You should now be on a screen that shows log events. + +8. Leave this page open. You are now “watching logs.” + +--- + +## Part B — Trigger the Slash Command in Slack + +9. Open Slack (the workspace where **Bloodhound V2** is installed). + +10. Navigate to your admin/testing channel (example): + + - `bloodhound-seek-n-destroy-admin` + +11. Run the slash command: + + - `/v2_seek` + +12. Confirm Slack immediately responds with a short acknowledgement message like: + + - “BloodHound is on the hunt...please stand by.” + +This message indicates that Slack successfully invoked the Lambda handler and the async worker path has started. + +--- + +## Part C — Watch Logs Update in CloudWatch + +13. Immediately switch back to the CloudWatch log stream page you opened in Part A. + +14. Click the **Refresh** button (or refresh icon). + +15. If you are viewing the **log streams list** (instead of a stream’s log events): + + - refresh the list + - click the newest log stream (the one with the most recent timestamp) + +16. If you are already inside a log stream viewing log events: + + - click refresh until you see new log lines appear + +17. You should see log lines that correspond to the `/v2_seek` invocation. + +Bloodhound logs follow a standardized format: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Example: + +[BLOODHOUND][SLACK][request_id=0f6c9c4e-1234-4e1e-9b7f-6b9d3d3a9c2a] + +The `request_id` value corresponds to the AWS Lambda invocation ID +and allows a single execution to be traced across all CloudWatch logs. + +--- + +## What You Should Look For in Logs + +### Important: Recursion Prevention + +Scheduled execution is isolated from the generic `run()` function to +prevent recursive Lambda invocation. + +Correct behavior: + +- Each invocation logs: + - "Bloodhound pipeline started" + - "Bloodhound pipeline completed" +- Each invocation runs exactly once + +Incorrect behavior (indicates a bug): + +- Repeated "Scheduled Bloodhound scan triggered" +- Multiple identical executions from a single event +- RecursionError or timeout + +If recursion is observed, review Lambda routing and ensure scheduled +events are handled through: + +scheduled_handler → run_scheduled_scan() → execute_pipeline() + +You are confirming these signals: + +- A new log stream appears immediately after `/v2_seek` is run +- The first log line shows the Bloodhound event marker + +Example: + +[BLOODHOUND][SLACK][request_id=...] + +- The same `request_id` appears in all logs for that execution +- Log lines indicate region scanning activity +- Log lines indicate Slack message posting +- No errors occur + +Common errors to watch for: + +- Missing environment variables (Slack tokens, signing secret, etc.) +- Slack authentication errors +- Slack signature verification failures +- AWS permissions errors (AccessDenied) +- Region mismatch (scanning wrong regions) + +--- + +## If You Do Not See Logs + +### 1) Wrong AWS Region + +You must use the same region where Terraform deployed the Lambda. +For Bloodhound V2 this is typically: + +- `us-west-2` + +Fix: +- Switch the AWS Console region to `us-west-2` +- Repeat the steps above + +--- + +### 2) Wrong Log Group + +The log group must be exactly: + +- `/aws/lambda/BloodhoundLambdaV2` + +Fix: +- Re-search log groups in CloudWatch +- Ensure you are clicking the correct group name + +--- + +### 3) No New Log Stream Appears + +If Slack shows no response and CloudWatch shows no activity, Lambda may not be invoked. + +Check: + +- Slack App → Slash Commands → Request URL is correct +- The Request URL matches the Terraform output Lambda Function URL +- The Lambda Function URL is still enabled +- Lambda Function URL permissions still exist +- Your Slack app is installed in the correct workspace + +--- + +## Optional Fast Path (Sometimes Easier) + +Instead of navigating CloudWatch manually: + +1. AWS Console → **Lambda** +2. Click **BloodhoundLambdaV2** +3. Go to the **Monitor** tab +4. Click **View logs in CloudWatch** +5. Continue from Part A step 7 + +--- + +## Success Criteria + +This validation is complete when: + +- `/v2_seek` produces the expected Slack output (scan summary, budget summary, teardown plan) +- `/v2_seek_destroy` enforces its confirmation and allowlist protections +- CloudWatch logs show a corresponding invocation and execution path +- Direct CLI invocation returns a valid pipeline response (`ok: true`) +- No recursive execution or repeated scheduled triggers occur +- No destructive actions occur during validation (dry-run / simulate mode only) + +## Direct Lambda CLI Validation (Recommended) + +In addition to Slack-based validation, you should verify Lambda execution +directly using the AWS CLI. This confirms the core pipeline works +independently of Slack, EventBridge, or GitHub Actions. + +### Step 1 — Invoke Lambda directly + +Run: + +aws lambda invoke \ +--function-name BloodhoundLambdaV2 \ +--region us-west-2 \ +--payload '{"source":"scan"}' \ +--cli-binary-format raw-in-base64-out \ +out.json + +If successful, you will see: + +{ + "StatusCode": 200, + "ExecutedVersion": "$LATEST" +} + +--- + +### Step 2 — Inspect output + +Run: + +cat out.json + +Expected result: + +{ + "ok": true, + ... +} + +--- + +### Step 3 — Verify logs + +Check CloudWatch logs and confirm: + +- "Bloodhound pipeline started" +- "Bloodhound pipeline completed" +- Only ONE execution occurs +- No recursion or repeated scheduled triggers + +--- + +### Why this matters + +This test isolates Lambda execution and confirms: + +- routing logic is correct +- recursion issues are resolved +- pipeline executes deterministically + +This should always be performed after major routing or handler changes. + +## Validating `/v2_seek_destroy` Safety Controls + +The `/v2_seek_destroy` command has multiple protection layers to prevent +accidental destructive actions. + +During validation you should confirm these protections are functioning. + +### Step 1 — Run destroy command without confirmation + +In Slack run: + + +/v2_seek_destroy + + +Expected result: + +Slack should return a message similar to: + + +Not allowed. Use /v2_seek_destroy CONFIRM (and ensure you are allowlisted). + + +This confirms the confirmation token protection is working. + +--- + +### Step 2 — Run destroy command with confirmation + +Run: + +/v2_seek_destroy CONFIRM + +The command may still be rejected if allowlists are configured. + +Bloodhound validates the following environment variables: + +- `SLACK_DESTROY_CONFIRM_TOKEN` +- `SLACK_ALLOWED_USER_IDS` +- `SLACK_ALLOWED_CHANNEL_IDS` + +If allowlists are defined and the user/channel is not included, +the command will return the same **Not allowed** response. + +--- + +### Expected behavior during validation + +Even when the command succeeds, destructive actions should **not** +occur because runtime safety flags are enabled. + +Relevant environment variables: + +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true + +The full teardown safety model and configuration reference +is documented in: + +`docs/bloodhound_v2_plan.md` + +This forces Bloodhound to operate in **dry-run mode**, meaning it +will only generate a teardown plan and never call destructive AWS APIs. + +--- + +### What successful validation looks like + +You should observe: + +1. `/v2_seek_destroy` without confirmation → rejected +2. `/v2_seek_destroy CONFIRM` → allowed only if allowlisted +3. Slack responses generated correctly +4. Lambda invocation visible in CloudWatch logs +5. No AWS resources are deleted + +## Verify Lambda Environment Variables + +If Slack commands behave unexpectedly, verify that the Lambda environment +variables were correctly deployed by Terraform. + +NOTE: Ensure the AWS CLI region matches the Terraform deployment region +(us-west-2). Otherwise Lambda may appear "missing". + +Run: + +aws lambda get-function-configuration \ +--region us-west-2 \ +--function-name BloodhoundLambdaV2 \ +--query 'Environment.Variables' + +This command prints the runtime configuration currently applied to the Lambda. + +Confirm that the expected variables appear, such as: + +SLACK_ENABLED +SLACK_SCAN_CHANNEL_ID +SLACK_ALERT_CHANNEL_ID +SLACK_SIGNING_SECRET +APPLY_CHANGES +TEARDOWN_SIMULATE + +If any variables are missing, Terraform may not have applied the latest +configuration. + +To fix: + +terraform plan +terraform apply + +--- + +## Watching Lambda Logs Live + +Instead of refreshing CloudWatch in the console, you can stream Lambda +logs directly in your terminal. This is very useful when debugging +slash command behavior while triggering `/v2_seek` or `/v2_seek_destroy`. + +### Command + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ +--region us-west-2 \ +--follow +```` + +### What this does + +This command: + +``` +connects to CloudWatch +↓ +streams new Lambda log events +↓ +prints them in your terminal +``` + +It behaves similarly to: + +``` +tail -f +``` + +for Lambda logs. + +--- + +### Recommended workflow + +Open **two terminals**. + +#### Terminal 1 — watch logs + +Run: + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ +--region us-west-2 \ +--follow +``` + +Leave it running. + +#### Terminal 2 — trigger Slack command + +In Slack run: + +``` +/v2_seek +``` + +or + +``` +/v2_seek_destroy CONFIRM +``` + +--- + +### Expected output + +When Lambda runs you should see logs similar to: + +START RequestId: 0f6c9c4e-1234-4e1e-9b7f-6b9d3d3a9c2a + +[BLOODHOUND][SLACK][request_id=0f6c9c4e-1234-4e1e-9b7f-6b9d3d3a9c2a] +Event received: {...} + +Received Slack slash command +command=/v2_seek +Scanning region us-east-1 +Scanning region us-west-2 +Posting Slack summary + +END RequestId: 0f6c9c4e-1234-4e1e-9b7f-6b9d3d3a9c2a +REPORT Duration: 14110 ms + +This confirms the full execution path from Slack → Lambda → AWS scan. + +--- + +### Why this command is useful + +It allows you to immediately see runtime errors such as: + +``` +Slack signature verification failed +Missing environment variable +AccessDenied +Invalid token +``` + +without navigating through the CloudWatch console. + +--- + +### Optional improvements + +Add timestamps: + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ +--region us-west-2 \ +--follow \ +--format short +``` + +Filter only errors: + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ +--region us-west-2 \ +--follow \ +--filter-pattern "ERROR" +``` + +## Common Failure Scenarios + +This section lists common issues that may occur when validating +Slack commands or Lambda execution. + +--- + +### 1. Slash command returns “Function not found” + +Example error: + +An error occurred (ResourceNotFoundException) +Function not found + +Cause: + +The AWS CLI or console is using the wrong region. + +Bloodhound V2 is deployed in: + +us-west-2 + +Fix: + +Specify the region explicitly when using the CLI: + +aws lambda get-function-configuration +--region us-west-2 +--function-name BloodhoundLambdaV2 + + +Or switch the AWS Console region to `us-west-2`. + +--- + +### 2. Slack command produces no response + +Possible causes: + +- Slack Request URL is incorrect +- Lambda Function URL is disabled +- Lambda permissions were removed +- Slack app was not reinstalled after manifest changes + +Fix: + +Verify the Slack command configuration: + + +Slack App → Slash Commands + + +Ensure the Request URL matches the Terraform output: + + +Lambda Function URL + + +--- + +### 3. `/v2_seek_destroy` returns “Not allowed” + +Example response: + +Not allowed. Use /v2_seek_destroy CONFIRM (and ensure you are allowlisted). + +This is expected behavior if safety checks fail. + +Possible causes: + +- Missing confirmation token +- User not in `SLACK_ALLOWED_USER_IDS` +- Channel not in `SLACK_ALLOWED_CHANNEL_IDS` + +Verify the Lambda environment variables: + +SLACK_DESTROY_CONFIRM_TOKEN +SLACK_ALLOWED_USER_IDS +SLACK_ALLOWED_CHANNEL_IDS + +--- + +### 4. Slash command succeeds but no logs appear + +Cause: + +The CloudWatch log group may not exist yet if Lambda has never run. + +Fix: + +Run the command again: + +/v2_seek + +Lambda automatically creates the log group on first execution. + +--- + +### 5. Terraform changes not reflected in Lambda + +Cause: + +Terraform may not have applied the latest configuration. + +Fix: + +Run: + +terraform plan +terraform apply + +Then verify Lambda environment variables: + +aws lambda get-function-configuration +--region us-west-2 +--function-name BloodhoundLambdaV2 +--query 'Environment.Variables' + +--- + +### 6. Unexpected teardown behavior + +If `/v2_seek_destroy` appears to plan more resources than expected: + +Check the whitelist configuration: + +KEEP_TAG_KEY +KEEP_TAG_VALUE + +Resources tagged with these values will be excluded from teardown. + +Example: + +bloodhound:keep=true + +--- + +## When to Escalate + +If validation fails after following the steps above: + +1. Capture the Slack command output +2. Capture the CloudWatch logs +3. Capture the Lambda environment variables +4. Capture the Terraform plan output + +These artifacts should be sufficient to diagnose most issues with the +Slack → Lambda → AWS execution pipeline. diff --git a/docs/slack_app_operations.md b/docs/slack_app_operations.md new file mode 100644 index 0000000..cf52d8a --- /dev/null +++ b/docs/slack_app_operations.md @@ -0,0 +1,40 @@ +# Slack App Operations (Bloodhound V2) + +Slack Workspace +Workspace: CodePlatoon + +Admin console: + +https://codeplatoon.slack.com/apps/manage + +Only Slack workspace administrators can install or remove applications. + +Current Slack admins typically include: + +- Francisco A. +- Julius B. +- Mike M. + +## Slack App Ownership + +Slack apps should never be owned by a single engineer. + +To prevent orphaned integrations and loss of access, Slack app +ownership must be shared with multiple workspace administrators. + +Open the Slack developer console: + +https://api.slack.com/apps + +Select: + +Bloodhound-V2 + +Then: + +Settings → Collaborators + +Add: + +Julius Bautista +Francisco Avila \ No newline at end of file diff --git a/docs/troubleshooting_slack_commands.md b/docs/troubleshooting_slack_commands.md new file mode 100644 index 0000000..b7bce68 --- /dev/null +++ b/docs/troubleshooting_slack_commands.md @@ -0,0 +1,493 @@ +# Slack Slash Command Troubleshooting + +## Table of Contents + +- [Common Causes](#common-causes) +- [Step 1 — Verify Lambda Function URL](#step-1--verify-the-lambda-function-url) +- [Step 2 — Verify Slack Slash Command Configuration](#step-2--verify-the-slack-slash-command-configuration) +- [Step 3 — Validate Lambda Endpoint Health](#step-3--validate-lambda-endpoint-health) +- [Step 4 — Reinstall Slack App](#step-4--reinstall-the-slack-app-if-commands-are-missing) +- [Step 5 — Verify Channel Configuration](#step-5--verify-channel-configuration) +- [Step 6 — Perform Direct Command Test](#step-6--perform-a-direct-command-test) +- [Preventing This Issue](#preventing-this-issue) +- [Force Slack to Refresh Slash Commands](#step-7--force-slack-to-refresh-slash-commands) +- [Related Documentation](#related-documentation) + +This guide explains how to diagnose and fix situations where the **Bloodhound Slack commands (such as `/v2_seek`, `/v2_seek_destroy_plan`, `/v2_seek_destroy`, or `/v2_status`) stop appearing or stop responding**. + +These issues typically occur after infrastructure updates or configuration changes. + +Note + +Bloodhound v2 introduced new slash commands prefixed with `/v2_`. +Older documentation and logs may reference legacy commands such as +`/seek` or `/seek_destroy`. + +--- + +# Common Causes + +If a Slack slash command disappears or stops working, the most common reasons are: + +1. **Slack lost the configured request URL** +2. **The Lambda Function URL changed** +3. **Terraform redeployed the Lambda** +4. **Slack app permissions were modified** +5. **Slack temporarily disabled the command due to endpoint failures** + +During Terraform deployments you may see messages such as: + +``` +aws_lambda_function.bloodhound_v2: Modifying... +aws_lambda_alias.bloodhound_prod: Modifying... +``` + +If the Lambda endpoint changes during deployment, Slack may still point to the previous URL. + +When Slack cannot reach the configured endpoint, it may **silently hide or disable the slash command**. + +--- + +# Step 1 — Verify the Lambda Function URL + +Run the following command: + +``` +aws lambda get-function-url-config \ + --function-name BloodhoundLambdaV2 \ + --region us-west-2 +``` + +Expected output: + +``` +{ + "FunctionUrl": "https://xxxx.lambda-url.us-west-2.on.aws/", + "FunctionArn": "arn:aws:lambda:us-west-2:ACCOUNT_ID:function:BloodhoundLambdaV2", + "AuthType": "NONE" +} +``` + +Example from a working deployment: + +``` +https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/ +``` + +Copy the **FunctionUrl** value. + +--- + +# Step 2 — Verify the Slack Slash Command Configuration + +Open the Slack developer console: + +``` +https://api.slack.com/apps +``` + +Navigate to: + +``` +Your App +→ Slash Commands +``` + +Select the command. + +Legacy systems used: + +/seek + +Current Bloodhound v2 systems use: + +/v2_seek + +Verify the **Request URL** is set to: + +``` +https://.lambda-url.us-west-2.on.aws/ +``` + +If the URL does not match the Lambda Function URL retrieved in Step 1, update it. + +Click: + +``` +Save +``` + +--- + +# Step 3 — Validate Lambda Endpoint Health + +Before reconnecting Slack, confirm that the Lambda endpoint is reachable. + +Run: + +curl https://YOUR_LAMBDA_URL + +Example: + +curl https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/ + +A healthy response should return JSON similar to: + +{ + "regions": ["us-east-1","us-east-2","us-west-1","us-west-2"], + "scan": { + "candidates_total": 41, + "kept_total": 1 + }, + "ok": true, + "teardown": { + "planned_actions": 41, + "execution": null, + "targets_filter": null, + "apply_changes": false, + "simulate": true + }, + "budget": { + "over_budget_threshold_met": true, + "projected_month_end_spend_usd": 3139.02, + "dynamic_monthly_allowance_usd": 0.0 + } +} + +The key indicator of a healthy endpoint is: + +"ok": true + +If the endpoint returns a valid JSON response and "ok": true, the Lambda function +is reachable and executing correctly. + +This confirms that: + +• the Lambda Function URL is valid +• the Lambda function is running +• AWS permissions are functioning +• the infrastructure scan logic is executing + +If this test succeeds but the Slack command still fails, the issue is likely +related to Slack configuration or Slack command caching. + +## Step 3.1 — Run Lambda Health Check + +Bloodhound provides a lightweight health endpoint that verifies the Lambda +service is reachable without triggering a full scan. + +Run: + +curl https://YOUR_LAMBDA_URL/health + +Example: + +curl https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/health + +Expected response: + +{ + "ok": true, + "service": "BloodhoundLambdaV2", + "status": "healthy" +} + +If this request succeeds, it confirms: + +• the Lambda Function URL is valid +• the Lambda runtime is working +• the function is deployed and reachable + +If the health check succeeds but Slack commands fail, the issue is likely +related to Slack configuration or caching. + + +--- + +# tep 4 — Reinstall the Slack App (If Commands Are Missing) + +Sometimes Slack will stop showing a slash command if the app configuration changed or the endpoint failed repeatedly. Reinstalling the app refreshes the configuration. + +Follow these steps. + +4.1 Open the Slack App Management Page + +From your Slack workspace (like the one shown in the screenshot): + +Open the workspace in Slack. + +In the left sidebar locate the Apps section. + +Click the Bloodhound V2 - Seek & Destroy app (or the name of your Slack integration). + +If the app does not appear in Slack, continue with the next step. + +4.2 Open the Slack Developer Console + +Open the Slack developer dashboard: + +https://api.slack.com/apps + +You will see a list of Slack apps associated with the workspace. + +Select: + +Bloodhound V2 - Seek & Destroy + +4.3 Navigate to Install App + +In the left sidebar of the Slack developer console, click: + +Settings +→ Install App + +This will open the **Installed App Settings** page. + +4.4 Reinstall the App + +On the Installed App Settings page locate the button: + +Reinstall to CodePlatoon + +Click: + +Reinstall to CodePlatoon + +Slack will open an authorization screen. + +Click: + +Allow + +This forces Slack to re-authorize the application and refresh the integration with the workspace. + +This process refreshes: + +• slash command registrations +• OAuth permissions +• bot connection to the workspace +• request URL bindings + +Note + +Slack may stop showing slash commands if the configured endpoint fails repeatedly +or if infrastructure changes modify the Lambda Function URL. + +Reinstalling the app forces Slack to resynchronize the command configuration +with the workspace. + +4.5 Verify Slash Commands Were Restored + +Return to Slack and test the command: + +/v2_seek + +or + +/v2_seek_destroy_plan + +or + +/v2_seek_destroy + +or + +/v2_status + +If the reinstall succeeded, Slack should now display the command and the Lambda endpoint should receive the request. + +When Reinstallation Is Needed + +Reinstalling the Slack app is often required after: + +• Lambda endpoint URL changes +• Terraform redeploys the Slack integration +• Slack permissions are updated +• Slack temporarily disables a command after repeated endpoint failures + +Reinstalling forces Slack to re-sync the application configuration with the workspace. + +--- + +# Step 5 — Verify Channel Configuration + +Bloodhound restricts command execution using environment variables. + +Check your Lambda environment variables: + +``` +SLACK_SCAN_CHANNEL_ID +SLACK_ALERT_CHANNEL_ID +``` + +Example: + +``` +SLACK_SCAN_CHANNEL_ID=C0A4YLV0HNY +SLACK_ALERT_CHANNEL_ID=C0A4YLV0HNY +``` + +Ensure the Slack command is being executed in the correct channel. + +--- + +# Step 6 — Perform a Direct Command Test + +You can simulate a Slack command by sending a request to Lambda. + +Example: + +``` +Legacy command test: + +curl -X POST https://YOUR_LAMBDA_URL \ + -d "command=/seek" + +Current Bloodhound v2 test: + +curl -X POST https://YOUR_LAMBDA_URL \ + -d "command=/v2_seek" +``` + +If the Lambda returns JSON output, the endpoint is functioning correctly. + +--- + +# Why This Happens + +When Terraform redeploys Lambda, the following may occur: + +``` +aws_lambda_function.bloodhound_v2: Modifying +aws_lambda_alias.bloodhound_prod: Modifying +``` + +If the **Lambda Function URL changes**, Slack continues pointing to the previous URL. + +Slack then attempts to call the endpoint, fails, and may temporarily hide or disable the command. + +--- + +# Preventing This Issue + +To prevent Slack command failures during deployments: + +• ensure Terraform does not recreate the Lambda Function URL unnecessarily +• keep Slack request URLs synchronized with the deployed Lambda endpoint +• validate the Lambda endpoint using the smoke test script after deployments + +--- + +Step 7 — Force Slack to Refresh Slash Commands + +Sometimes Slack still has the old command configuration cached locally, even after the endpoint has been fixed. + +Instead of reinstalling the entire Slack app, you can force Slack to refresh the command registration. + +Method 1 — Edit and Re-Save the Slash Command + +Open the Slack developer dashboard: + +https://api.slack.com/apps + +Select the app: + +Bloodhound V2 - Seek & Destroy + +Navigate to: + +Slash Commands + +Select the command. + +Legacy command: + +/seek + +Current command: + +/v2_seek + +In the command configuration page: + +Change the Request URL temporarily. + +Example: + +https://your-lambda-url.lambda-url.us-west-2.on.aws/ + +Change it to something like: + +https://your-lambda-url.lambda-url.us-west-2.on.aws/?refresh=1 + +Click: + +Save + +Change the URL back to the original value. + +Click: + +Save + +This forces Slack to refresh the command configuration and invalidate its cache. + +Method 2 — Restart Slack Client + +After editing the command, restart the Slack client. + +On Mac: + +Cmd + Q + +Then reopen Slack. + +On Windows: + +Ctrl + Q + +This ensures the Slack UI reloads the latest command definitions. + +Method 3 — Refresh Slack Command Suggestions + +Inside Slack, type: + +/ + +Slack will reload the slash command list. + +If either command appears in the suggestion list, the refresh worked: + +/seek (legacy) +/v2_seek (current) + +# Related Documentation + +Infrastructure validation: + +``` +docs/run_validation.md +``` + +Teardown validation process: + +``` +docs/validate_teardown.md +``` + +System architecture and configuration: + +``` +docs/bloodhound_v2_plan.md +``` + +--- + +If you'd like, I can also help you add a **very useful small section to the main README** that says: + +``` +⚠ If Slack commands stop responding after deployment, +see docs/troubleshooting_slack_commands.md +``` + +This is something many infrastructure repos include so engineers can quickly find fixes. diff --git a/docs/troubleshooting_terraform_lambda.md b/docs/troubleshooting_terraform_lambda.md new file mode 100644 index 0000000..bf45a72 --- /dev/null +++ b/docs/troubleshooting_terraform_lambda.md @@ -0,0 +1,717 @@ +# Terraform + Lambda Troubleshooting + +## Table of Contents + +- [Lambda Runtime Import Errors](#issue-lambda-runtime-import-errors) +- [pip Dependency Resolution Failure During Lambda Packaging](#issue-pip-dependency-resolution-failure-during-lambda-packaging) +- [Cause](#cause) +- [Diagnosis](#diagnosis) +- [Fix](#fix) +- [Additional Verification](#additional-verification) +- [When This Problem Commonly Appears](#when-this-problem-commonly-appears) +- [Best Practice](#best-practice) +- [Terraform Archive Creation Error](#issue-terraform-archive-creation-error) +- [AWS Rejects Lambda Deployment Zip](#issue-aws-rejects-lambda-deployment-zip) +- [.build Directory Issues](#issue-build-directory-behaving-inconsistently) +- [Validation Workflow Reminder](#validation-workflow-reminder) +- [Related Documentation](#related-documentation) + +This guide documents common issues encountered when deploying or validating the **Bloodhound Lambda infrastructure using Terraform**. + +These problems typically occur during packaging, deployment, or validation workflows. + +--- + +# Issue: Lambda Runtime Import Errors + +Example error: + +``` +Runtime.ImportModuleError: +No module named 'bloodhound.aws' +``` + +or + +``` +Unable to import module 'handlers.lambda_function' +``` + +These errors occur when the Lambda runtime cannot locate Python modules inside the deployment package. + +--- + +# Cause + +The Lambda package (`.build/bloodhound_lambda_v2.zip`) did not include the full Bloodhound source tree. + +Bloodhound uses Terraform to construct the Lambda package using: + +``` +infra/build.tf +``` + +This process performs the following steps: + +``` +rm -rf .build +mkdir -p .build/lambda_pkg +pip install dependencies +rsync application source +archive zip +deploy Lambda +``` + +If the packaging step fails or does not run, the Lambda runtime may deploy with **missing modules**. + +--- + +# Diagnosis + +Inspect the built package directory. + +Run: + +``` +ls .build/lambda_pkg/bloodhound +``` + +Expected output: + +``` +app.py +aws.py +budget.py +config.py +messages.py +slack.py +handlers/ +scanner/ +teardown/ +``` + +If files such as `aws.py`, `scanner/`, or `teardown/` are missing, the packaging step did not execute correctly. + +--- + +# Root Cause: Terraform Build Step Was Not Triggered + +Bloodhound uses this resource to build the Lambda package: + +``` +terraform_data.build_lambda_pkg +``` + +Terraform will **only rerun this step when its triggers change**. + +If no triggers change, Terraform assumes the package is already up to date and **skips rebuilding the package**. + +This can lead to situations where: + +• the source code changed +• the package directory still contains an older build +• the deployed Lambda contains incomplete modules + +You may see Terraform output like: + +``` +Plan: 0 to add, 0 to change, 1 to destroy +``` + +This indicates the packaging step did not run. + +--- + +# Fix + +If the `.build` directory was deleted or corrupted, Terraform may attempt to deploy an empty Lambda package. + +The correct recovery procedure is to **force Terraform to rebuild the Lambda package**. + +From the `infra` directory run: + +terraform apply -replace=terraform_data.build_lambda_pkg + +This forces the packaging step to run again regardless of trigger hashes. + +During execution Terraform should run the packaging script: + +rm -rf .build +mkdir -p .build/lambda_pkg +pip install -r requirements.txt -t .build/lambda_pkg +rsync application source +create lambda zip +deploy updated Lambda + +Expected Terraform output: + +terraform_data.build_lambda_pkg: Provisioning with 'local-exec' +Prepared package dir: .build/lambda_pkg +Downloading dependencies +Installing slack_sdk +Creating deployment archive + +If the `pip install` step does not appear in the output, the packaging script did not run. + +After the rebuild completes, verify the package contents: + +ls ../.build/lambda_pkg + +Expected output should include the application and dependencies: + +bloodhound/ +handlers/ +slack_sdk/ +boto3/ +requests/ + +You can also inspect the deployed archive: + +unzip -l ../.build/bloodhound_lambda_v2.zip | head + +The archive should contain the application code and dependencies at the root. + +Post-Recovery Verification + +After rebuilding the Lambda package, confirm that the deployment works correctly. + +Step 1 — Smoke Test the Lambda + +After Terraform completes successfully, you should see the Lambda Function URL in the outputs: + +bloodhound_lambda_url = "https://.lambda-url.us-west-2.on.aws/" + +Run a quick test request: + +curl https://.lambda-url.us-west-2.on.aws/ + +Example successful response: + +{ + "regions": ["us-east-1","us-east-2","us-west-1","us-west-2"], + "scan": { + "candidates_total": 56, + "kept_total": 1 + }, + "ok": true, + "teardown": { + "planned_actions": 56, + "execution": null, + "targets_filter": null, + "apply_changes": false, + "simulate": true + }, + "budget": { + "over_budget_threshold_met": true, + "projected_month_end_spend_usd": 2753.1269, + "dynamic_monthly_allowance_usd": 0.0 + } +} + +A response like this confirms: + +• Lambda successfully executed +• Application modules loaded correctly +• Dependencies were packaged correctly +• Infrastructure scan logic is functioning + +If the request fails with an import error, inspect the Lambda logs in CloudWatch. + +Step 2 — Run the Validation Workflow + +Once the Lambda smoke test succeeds, run the full validation workflow. + +./tools/run_validation_workflow.sh + +This workflow verifies: + +• Lambda deployment +• infrastructure scanning +• teardown planning logic +• Slack command integrations + +This step ensures the entire Bloodhound pipeline functions end-to-end after deployment. + +Expected Outcome + +If all steps succeed: + +• Terraform deployment succeeds +• Lambda responds correctly +• Validation workflow completes without errors + +At this point the infrastructure deployment can be considered healthy and operational. + +--- + +# Additional Verification + +You can inspect the Terraform build state using: + +``` +terraform state show terraform_data.build_lambda_pkg +``` + +Example: + +``` +resource "terraform_data" "build_lambda_pkg" { + triggers_replace = { + handlers_tree_hash + lambda_handler_hash + requirements_hash + source_tree_hash + } +} +``` + +These hashes determine when Terraform rebuilds the Lambda package. + +--- + +## Local Lambda Environment Debugging (Optional) + +If deeper debugging is required, you can run the Lambda runtime +and Lambda build environments locally using Docker. + +This can help diagnose packaging or dependency issues before +deploying with Terraform. + +Simulate the **Lambda runtime environment**: + +docker run -it public.ecr.aws/lambda/python:3.10 bash + +This container mirrors the environment used by AWS Lambda +when executing the deployed function. + +Simulate the **Lambda build environment**: + +docker run -it public.ecr.aws/sam/build-python3.10 bash + +This container matches the environment used to build Lambda +dependencies and install packages compatible with the +Python 3.10 Lambda runtime. + +Using these containers allows engineers to: + +• verify Python imports +• test dependency compatibility +• inspect the Lambda runtime filesystem +• reproduce build issues locally + +--- + +# When This Problem Commonly Appears + +This issue most frequently occurs after: + +• adding new modules to the `bloodhound` package +• modifying handler imports +• switching branches in Git +• manual modifications to `.build/` +• Terraform caching the previous package build + +--- + +# Best Practice + +After modifying the application source tree, run: + +``` +terraform apply -replace=terraform_data.build_lambda_pkg +``` + +This ensures the Lambda package is rebuilt with the latest source. + +--- + +## Issue: Terraform Archive Creation Error + +Example error: + +Error: Archive creation error +error creating archive: archive has not been created as it would be empty + +This occurs during: + +terraform plan + +and originates from the Terraform archive_file data source used to build the Lambda deployment package. + +Cause + +Terraform attempts to archive the Lambda package directory: + +.build/lambda_pkg + +If the directory exists but contains no files, the archive_file provider refuses to create a zip archive. + +This commonly occurs when: + +• .build was manually deleted +• the repository was freshly cloned +• the build step has not executed yet + +Example directory state: + +.build/ + lambda_pkg/ + +Since the directory is empty, Terraform cannot create the archive. + +Diagnosis + +Check the contents of the package directory. + +ls -a .build/lambda_pkg + +If the output is only: + +. +.. + +then the directory is empty. + +Fix + +Create a placeholder file so Terraform can archive the directory. + +touch .build/lambda_pkg/.placeholder + +Verify: + +ls -a .build/lambda_pkg + +Expected output: + +. +.. +.placeholder + +Then rerun Terraform: + +cd infra +terraform plan +Issue: AWS Rejects Lambda Deployment Zip + +Example error: + +InvalidParameterValueException: +Uploaded file must be a non-empty zip +Cause + +Terraform created a zip archive from .build/lambda_pkg, but the directory contained only a placeholder file. + +This happens when the Terraform build step was not triggered. + +Diagnosis + +Check the package contents: + +ls .build/lambda_pkg + +If you see only: + +.placeholder + +then the Lambda package was not built. + +Fix + +Force Terraform to rebuild the Lambda package. + +terraform apply -replace=terraform_data.build_lambda_pkg + +This reruns the packaging step: + +pip install dependencies +rsync application source +build lambda package +create zip +deploy Lambda + +After completion, verify: + +ls .build/lambda_pkg + +Expected contents: + +bloodhound/ +handlers/ +requests/ +boto3/ +... + +# Issue: pip Dependency Resolution Failure During Lambda Packaging + +Example error during `terraform apply`: + +```text +ERROR: Cannot install -r requirements.txt because these package versions have conflicting dependencies. +The conflict is caused by: +botocore 1.34.x depends on urllib3<1.27 +The user requested urllib3==2.0.7 + +ERROR: ResolutionImpossible +``` + + +This error occurs during the Lambda packaging step when Terraform runs: + + +pip install -r requirements.txt -t .build/lambda_pkg + + +The pip dependency resolver is unable to construct a valid dependency tree. + +--- + +# Cause + +A **transitive dependency** was manually pinned in `requirements.txt`. + +Example problematic configuration: + + +boto3==1.34.x +botocore==1.34.x +urllib3==2.0.7 + + +The AWS SDK dependency chain looks like this: + + +boto3 +└── botocore +└── urllib3 (<1.27) + + +Because `urllib3` was forced to version `2.x`, pip could not satisfy +botocore's requirement. + +This caused the dependency resolver to fail before the Lambda package +could be built. + +--- + +# Diagnosis + +If Terraform fails during the packaging step, inspect the output for pip +dependency resolution errors. + +Typical indicators include: + + +ResolutionImpossible + + +or + + +conflicting dependencies + + +To reproduce locally, run: + + +pip install -r requirements.txt + + +If pip fails locally, Terraform will also fail during Lambda packaging. + +--- + +# Fix + +Remove the manually pinned transitive dependency. + +Example corrected configuration: + + +slack-sdk==3.26.1 +python-dotenv==1.0.0 + + +Do **not manually pin** dependencies managed by other libraries. + +Allow pip to resolve the dependency tree automatically. + +--- + +# Best Practice + +Only specify **top-level dependencies** required by the Lambda function. + +Avoid pinning dependencies managed internally by other libraries. + +Examples that should generally **not be pinned**: + + +botocore +urllib3 +s3transfer +jmespath + + +These dependencies are automatically managed by the AWS SDK. + +Additionally, AWS Lambda already provides the following libraries in the runtime: + + +boto3 +botocore + + +Because of this, they usually **do not need to be included in `requirements.txt`.** + +Refer to: + + +docs/lambda_packaging.md + + +for the dependency strategy used by the Bloodhound Lambda deployment. + +--- + +# When This Problem Commonly Appears + +This issue most often occurs when: + +• adding new dependencies to `requirements.txt` +• copying dependency lists from other projects +• manually upgrading libraries without reviewing transitive dependencies +• pinning versions to resolve security scanner warnings + +Always verify dependency compatibility before committing changes to +`requirements.txt`. + +--- + +## Issue: .build Directory Behaving Inconsistently + +Rarely, the .build directory may appear to ignore newly created files. + +Example symptom: + +mkdir .build/lambda_pkg +ls -R .build + +but the directory does not appear. + +Cause + +This can happen if the directory was deleted while the shell still had an open reference to it: + +rm -rf .build +mkdir .build + +The shell may still point to the old directory inode. + +Fix + +Open a fresh terminal session and recreate the directory. + +rm -rf .build +mkdir -p .build/lambda_pkg +touch .build/lambda_pkg/.placeholder + +Verify: + +ls -R .build + +Expected: + +.build/ +lambda_pkg/ + +.build/lambda_pkg/ +.placeholder +Important Note + +Terraform references this directory from the infra folder: + +../.build/lambda_pkg + +The correct path must therefore be: + +Bloodhound/.build/lambda_pkg + +### Best Practice + +If the repository is freshly cloned and Terraform fails during plan +due to a missing build directory, initialize the structure with: + +mkdir -p .build/lambda_pkg +touch .build/lambda_pkg/.placeholder + +This ensures the archive_file provider can evaluate during terraform plan. + +During terraform apply, the packaging script will populate the +directory with the correct contents. + +The placeholder file is only required to allow Terraform to evaluate the +archive step during planning. It is replaced during the build process +when the packaging script constructs the final Lambda package. +Additional Improvement (Recommended) + +To ensure Terraform automatically rebuilds the Lambda package when source code changes, add a source hash trigger to the build resource. + +Example: + +triggers_replace = { + source_hash = sha256(join("", fileset("${path.module}/..", "**/*.py"))) +} + +This ensures the packaging step runs whenever Python source files change. + +Key Takeaway + +Most Lambda packaging failures fall into one of three categories: + +Missing modules in the deployment package + +Terraform skipping the build step + +Terraform attempting to archive an empty directory + +Verifying .build/lambda_pkg contents will quickly identify which condition occurred. + +--- + +# Validation Workflow Reminder + +After rebuilding the package, rerun the validation workflow: + +``` +./tools/run_validation_workflow.sh +``` + +This will verify: + +• Lambda deployment +• infrastructure scan +• controlled teardown logic + +--- + +# Related Documentation + +Infrastructure validation process: + +``` +docs/run_validation.md +``` + +Teardown validation workflow: + +``` +docs/validate_teardown.md +``` + +Slack command troubleshooting: + +``` +docs/troubleshooting_slack_commands.md +``` + diff --git a/docs/validate_teardown.md b/docs/validate_teardown.md new file mode 100644 index 0000000..d620113 --- /dev/null +++ b/docs/validate_teardown.md @@ -0,0 +1,459 @@ +# Controlled Teardown Validation + +## Table of Contents + +- [Safety Warning](#safety-warning) +- [Validation Overview](#validation-overview) +- [Infrastructure Smoke Test](#infrastructure-smoke-test) +- [Automation Script](#automation-script) +- [Step 1 — Create Disposable Test Resource](#step-1--create-disposable-test-resource) +- [Step 2 — Capture the Instance ID](#step-2--capture-the-instance-id) +- [Step 3 — Verify Bloodhound Detects the Resource](#step-3--verify-bloodhound-detects-the-resource) +- [Step 4 — Invoke Validation Mode](#step-4--invoke-validation-mode) +- [Step 5 — Execute Teardown](#step-5--execute-teardown-automated) +- [Step 6 — Automatic Deletion Verification](#step-6--automatic-deletion-verification) +- [Step 7 — Restore Safe Mode](#step-7--restore-safe-mode) +- [Step 8 — Cleanup Terraform State](#step-8--cleanup-terraform-state) +- [Expected Lambda Log Flow](#expected-lambda-log-flow) +- [Success Criteria](#success-criteria) +- [When to Run This Test](#when-to-run-this-test) +- [Related Documentation](#related-documentation) + +This document describes how to safely validate the **actual resource deletion path** +in Bloodhound v2. + +Unlike the Slack validation guide, this test confirms that Bloodhound can: + +- detect a resource +- include it in the teardown plan +- execute a deletion +- report results back to Slack + +This validation intentionally deletes a **temporary disposable AWS resource**. + +This procedure should only be performed after the following validations succeed: + +- Infrastructure smoke test (`tools/smoke_test_lambda.sh`) +- Slack command routing (`/v2_seek`) +- Lambda execution confirmed +- CloudWatch logs visible +- `/v2_seek_destroy` confirmation protections working +- Terraform environment variables verified + +See: + +`docs/slack_and_lambda_validation.md` + +--- + +# Safety Warning + +This test temporarily enables **apply-mode**, allowing Bloodhound to execute +real deletion actions. + +The test uses a **small disposable EC2 instance** created specifically for +validation. + +Never run this procedure against production infrastructure without +understanding Bloodhound’s teardown safety controls. + +--- + +# Validation Overview +... +Terraform → create validation resource +Validation script → capture instance ID +Validation script → invoke Lambda validation event +Lambda validation handler → enable controlled destructive mode +Bloodhound pipeline → execute deletion +CLI → verify resource deletion + +--- + +# Infrastructure Smoke Test + +Before running the teardown validation, confirm that the Lambda +deployment is healthy. + +Run: + +tools/smoke_test_lambda.sh + +This script verifies: + +- Lambda function exists +- environment variables are configured +- CloudWatch log group exists +- Lambda Function URL is configured + +If the smoke test fails, fix the infrastructure deployment before +continuing with teardown validation. + +# Automation Script + +The teardown validation workflow can be automated using: + +tools/validate_teardown.sh + +This script performs the following steps automatically: + +1. Create the validation resource using Terraform +2. Capture the resource ID +3. Invoke the Bloodhound Lambda function in validation mode +4. Wait for teardown execution +5. Verify that the resource was deleted + +Example validation payload sent to Lambda: + + +```json +{ + "source": "validation", + "mode": "seek_destroy_validation", + "target_ids": ["INSTANCE_ID"] +} +``` + +The Lambda validation handler enables destructive execution internally +and restricts deletion to the specified validation targets. + +No Slack commands are required to execute the validation teardown. + +--- + +# Step 1 — Create Disposable Test Resource + +Create the Terraform test resource file: + +`infra/test_resource.tf` + +Example: + +```bash +resource "aws_instance" "bloodhound_teardown_test" { + + ami = "ami-0c02fb55956c7d316" # Amazon Linux 2 (us-west-2) + instance_type = "t3.micro" + + tags = { + Name = "bloodhound-teardown-test" + Environment = "test" + + # IMPORTANT: + # Do NOT include the whitelist tag + # bloodhound:keep=true + } + +} + +output "bloodhound_test_instance_id" { + value = aws_instance.bloodhound_teardown_test.id +} +``` + +Apply the resource: + +`terraform apply` + +Terraform will create a small EC2 instance used only for validation. + +--- + +# Step 2 — Capture the Instance ID + +Retrieve the instance ID generated by Terraform. + +Run: + +`terraform output bloodhound_test_instance_id` + +Example output: + +`i-0abc123def456` + +This ID will be used later to verify deletion. + +--- + +# Step 3 — Verify Bloodhound Detects the Resource + +Run the scan command in Slack: + + +`/v2_seek` + +Expected result: + +Slack scan summary should show at least one EC2 instance. + +Example output snippet: + +`ec2.instance=1` + +If the instance does not appear: + +Check: + +* the instance is running +* the instance is in one of the configured regions +* the instance is not tagged with the whitelist tag + +`bloodhound:keep=true` + +--- + +Optional verification: + +Preview the teardown plan before executing destructive mode: + +`/v2_seek_destroy_plan` + +The disposable test instance should appear in the teardown preview. + +# Step 4 — Invoke Validation Mode + +The validation workflow triggers destructive execution using a +dedicated validation event rather than modifying Lambda +environment variables. + +The validation script invokes Lambda with a payload similar to: + +```json +{ + "source": "validation", + "mode": "seek_destroy_validation", + "target_ids": ["INSTANCE_ID"] +} +``` + +The validation handler performs the following safety steps: + +- verifies the invocation originates from the validation harness +- verifies the correct validation mode +- requires explicit target_ids +- enables controlled destructive execution +- restricts deletion to validation targets only + +This approach allows teardown validation without modifying +Lambda environment configuration. + +## Terraform Apply-Mode Safety Guard + +Bloodhound can delete AWS resources when `APPLY_CHANGES=true`. + +Because deletion is dangerous, Terraform includes a **deployment safety guard** +that prevents destructive mode from being enabled accidentally. + +Why this exists: + +It is easy for someone to accidentally enable destructive mode by: + +- committing `APPLY_CHANGES=true` to configuration +- copying values from a test environment +- forgetting to switch back to safe mode after testing +- running Terraform in the wrong environment + +To prevent this, Terraform will **refuse to deploy** if it detects that +destructive mode is enabled. + +Example: + +If the Lambda environment variable contains: + +`APPLY_CHANGES=true` + +Terraform will stop the deployment and show an error like: + +Deployment blocked: APPLY_CHANGES=true requires -var allow_apply_mode=true + +This forces the engineer to **explicitly acknowledge the risk** before enabling +real deletion. + +To intentionally enable apply-mode (for controlled testing only): + +`terraform apply -var allow_apply_mode=true` + +This extra step ensures that destructive mode can never be enabled silently +or by accident. + +In normal operation Bloodhound should run with: + +`APPLY_CHANGES=false` + +which means it will only produce teardown plans and will not delete resources. + +Update Lambda environment variables: + +```bash +APPLY_CHANGES=true +TEARDOWN_SIMULATE=false +``` + +Redeploy configuration: + +`terraform apply` + +This enables real teardown execution. + +--- + +## Step 5 — Execute Teardown (Automated) + +The validation workflow invokes the Bloodhound Lambda function +directly using a validation event. + +No Slack commands are required. + +The validation harness sends a payload similar to: + +{ +"source": "validation", +"mode": "seek_destroy_validation", +"target_ids": ["INSTANCE_ID"] +} + +The Lambda validation handler enables controlled destructive mode +internally and restricts deletion to the specified validation target. + +This allows the teardown pipeline to run automatically without +modifying Lambda environment variables or running Slack commands. + + +Expected Slack output: + +``` +Bloodhound v2 — Teardown Results +``` + +The Slack message should include the EC2 instance created in Step 1. + +--- + +# Step 6 — Automatic Deletion Verification + +The validation script automatically verifies that the instance +was successfully deleted. + +The workflow repeatedly queries the EC2 API until the instance +reaches the `terminated` state. + +Example output: + +Instance state: shutting-down (waiting...) +Instance state: shutting-down (waiting...) + +SUCCESS: Instance terminated successfully. +RESULT: PASS + +This confirms that Bloodhound successfully deleted the instance. + +--- + +# Step 7 — Restore Safe Mode + +Immediately restore Bloodhound's safe configuration. + +Set: + +``` +APPLY_CHANGES=false +TEARDOWN_SIMULATE=true +``` + +Redeploy configuration: + +``` +terraform apply +``` + +Bloodhound will return to **dry-run mode**. + +--- + +# Step 8 — Cleanup Terraform State + +If Terraform still tracks the resource, run: + +``` +terraform destroy -target aws_instance.bloodhound_teardown_test +``` + +If Bloodhound already deleted the instance, Terraform will simply refresh state. + +--- + +# Expected Lambda Log Flow + +When teardown executes, CloudWatch logs should show something similar to: + +START RequestId + +[BLOODHOUND][VALIDATION][request_id=...] + +Validation event received +Building teardown plan +Executing deletion +Deleting EC2 instance +Posting Slack results + +END RequestId +REPORT Duration + +Each validation run will include a structured log marker: + +[BLOODHOUND][VALIDATION][request_id=...] + +The `request_id` corresponds to the AWS Lambda invocation ID +(`context.aws_request_id`) and allows engineers to trace a +single execution across all CloudWatch log lines. + +Logs can be streamed live using: + +```bash +aws logs tail /aws/lambda/BloodhoundLambdaV2 \ +--region us-west-2 \ +--follow +``` + +--- + +# Success Criteria + +This validation is successful when: + +* Validation script successfully invokes Lambda +* Bloodhound detects the test EC2 instance +* Lambda executes teardown without safety errors +* Slack reports the deletion +* AWS CLI confirms the instance no longer exists +* Lambda logs show the teardown executor path +* Bloodhound is returned to safe mode + +--- + +# When to Run This Test + +Run this teardown validation: + +* after major teardown logic changes +* after adding new resource types +* after IAM permission changes +* before enabling apply-mode in production + +--- + +# Related Documentation + +Slack command validation: + +``` +docs/validate_slack_lambda.md +``` + +Architecture and configuration reference: + +``` +docs/bloodhound_v2_plan.md +``` + +``` \ No newline at end of file diff --git a/env b/env new file mode 100644 index 0000000..e1a70ba --- /dev/null +++ b/env @@ -0,0 +1,75 @@ +### Bloodhound v2 environment variables (example) +# +# Copy to .env and fill in values: +# cp env.example .env +# +# v2 loads .env automatically for local runs. +# In AWS Lambda, set these in the Lambda "Environment variables" section instead. + +### Slack + +# Enable/disable Slack posting (useful for local testing) +SLACK_ENABLED=true + +# Slack bot token (xoxb-...) +SLACK_BOT_TOKEN=REPLACE_ME + +# Scan summaries channel +SLACK_SCAN_CHANNEL_ID=C0A4YLV0HNY + +# Alerts/teardown channel +SLACK_ALERT_CHANNEL_ID=C0A4YLV0HNY + +### Slack slash commands (Function URL) + +# Required to validate /seek and /seek_destroy requests from Slack +SLACK_SIGNING_SECRET=REPLACE_ME + +# Optional allowlists (comma-separated). If unset, allow all. +SLACK_ALLOWED_USER_IDS= +SLACK_ALLOWED_CHANNEL_IDS= + +# Safety: /seek_destroy requires exact text match to this token +SLACK_DESTROY_CONFIRM_TOKEN=CONFIRM + +### Regions + +# explicit = scan REGIONS list +# discover = auto-discover AWS regions +REGION_MODE=explicit +REGIONS=us-east-1,us-east-2,us-west-1,us-west-2 + +### Whitelist + +# If a resource has this tag, it will be considered "kept" (whitelisted) and excluded from teardown. +KEEP_TAG_KEY=bloodhound:keep +KEEP_TAG_VALUE=true + +# Optional: always keep these IDs/ARNs (comma-separated) +KEEP_RESOURCE_IDS= + +### Teardown + +# If false, Bloodhound only posts a plan (dry-run). +APPLY_CHANGES=false + +# If true, never performs destructive calls. EC2-style deletes are validated using DryRun where supported. +TEARDOWN_SIMULATE=true + +# Optional safety rail: only delete resources in this list (comma-separated IDs/ARNs). +TEARDOWN_TARGET_IDS= + +# If true, apply-mode can delete all non-whitelisted candidates without needing TEARDOWN_TARGET_IDS. +TEARDOWN_ALLOW_ALL=false + +# For RDS deletions: if false, skip final snapshot (fast/cheap). +RDS_FINAL_SNAPSHOT=false + +### Budget (dynamic cohort) + +COHORT_START_YYYY_MM=2025-12 +COHORT_TOTAL_BUDGET_USD=3000 +COHORT_LENGTH_MONTHS=7 +BUDGET_OVER_DAYS=2 + + diff --git a/env.example b/env.example new file mode 100644 index 0000000..764d3f0 --- /dev/null +++ b/env.example @@ -0,0 +1,139 @@ +### Bloodhound v2 environment variables (example) +# +# Copy to .env and fill in values: +# cp env.example .env +# +# v2 loads .env automatically for local runs. +# In AWS Lambda, set these in the Lambda "Environment variables" section instead. + +### AWS Safety Guard + +# Expected AWS account ID for this environment. +# Validation scripts will refuse to run if the current AWS +# credentials are pointing to a different account. +# +# Example: +# EXPECTED_AWS_ACCOUNT_ID=123456789012 +# +#Update Your .env + +#Now add the real value. + +#First determine your account ID: + +#aws sts get-caller-identity + +#Example output: + +#"Account": "123456789012" + +EXPECTED_AWS_ACCOUNT_ID=REPLACE_ME + +### Slack + +# Enable/disable Slack posting (useful for local testing) +SLACK_ENABLED=true + +# Slack bot token (xoxb-...) +SLACK_BOT_TOKEN=REPLACE_ME + +# Scan summaries channel +SLACK_SCAN_CHANNEL_ID=C0A4YLV0HNY + +# Alerts/teardown channel +SLACK_ALERT_CHANNEL_ID=C0A4YLV0HNY + +### Slack slash commands (Function URL) + +# Required to validate /seek and /seek_destroy requests from Slack +SLACK_SIGNING_SECRET=REPLACE_ME + +# Optional allowlists (comma-separated). If unset, allow all. +SLACK_ALLOWED_USER_IDS= +SLACK_ALLOWED_CHANNEL_IDS= + +# Safety: /seek_destroy requires exact text match to this token +SLACK_DESTROY_CONFIRM_TOKEN=CONFIRM + +### Guardrails (/guard) + +# Slack user IDs allowed to run /guard mutations (allow/deny/enable/disable/add-student/remove-student). +# Falls back to SLACK_ALLOWED_USER_IDS. If neither is set, ALL mutations are refused (fail-safe). +GUARD_ALLOWED_USER_IDS= + +# Optional: override the services /guard allow|deny may toggle (comma-separated). +# Default is the expensive-compute/ML set (rds, bedrock, sagemaker, eks, ...); iam/organizations/ec2 are never toggleable. +GUARD_TOGGLEABLE_SERVICES= + +# Optional: JSON array overriding the guardrail registry. +# Each entry: {"name","tier","scp","iam_policy","group"}. Default is a single "cost-guard" guardrail. +GUARD_REGISTRY= + +### Regions + +# explicit = scan REGIONS list +# discover = auto-discover AWS regions +REGION_MODE=explicit +REGIONS=us-east-1,us-east-2,us-west-1,us-west-2 + +### Whitelist + +# Tag rules: comma-separated key=value pairs. Any matching tag keeps the resource. +# Legacy KEEP_TAG_KEY + KEEP_TAG_VALUE are used when KEEP_TAG_RULES is unset. +KEEP_TAG_RULES=bloodhound:keep=true +KEEP_TAG_KEY=bloodhound:keep +KEEP_TAG_VALUE=true + +# Name/tag regex patterns (comma-separated). Matched case-insensitively against Name, id, and tag values. +KEEP_NAME_PATTERNS=buffalo,fullstack,vetlaunch,dont-touch,do-not-touch,dont_touch + +# Optional: always keep these IDs/ARNs (comma-separated) +KEEP_RESOURCE_IDS= + +### Teardown + +# If false, Bloodhound only posts a teardown plan (dry-run). +# If true, Bloodhound may delete resources. +# +# IMPORTANT: +# Terraform includes a safety guard that prevents deployments +# with APPLY_CHANGES=true unless the engineer explicitly confirms it. +# +# To intentionally enable destructive mode during deployment: +# +# terraform apply -var allow_apply_mode=true +# +APPLY_CHANGES=false + +# If true, never performs destructive calls. EC2-style deletes are validated using DryRun where supported. +TEARDOWN_SIMULATE=true + +# Optional safety rail: only delete resources in this list (comma-separated IDs/ARNs). +TEARDOWN_TARGET_IDS= + +# If true, apply-mode can delete all non-whitelisted candidates without needing TEARDOWN_TARGET_IDS. +TEARDOWN_ALLOW_ALL=false + +# Maximum number of resources Bloodhound is allowed to delete in a single run. +# If the teardown plan exceeds this number, execution will stop. +TEARDOWN_MAX_DELETE_COUNT=5 + +# For RDS deletions: if false, skip final snapshot (fast/cheap). +RDS_FINAL_SNAPSHOT=false + +# Optional: lookup CloudTrail creator per resource (best-effort; requires CloudTrail) +ATTRIBUTION_ENABLED=true + +### Budget (dynamic cohort) + +COHORT_START_YYYY_MM=2025-12 +COHORT_TOTAL_BUDGET_USD=3000 +COHORT_LENGTH_MONTHS=7 +BUDGET_OVER_DAYS=2 + +### Local dry-run output + +# Print reports to stdout and write a file under reports/ +BLOODHOUND_PRINT_REPORTS=true +BLOODHOUND_REPORT_FORMAT=markdown +BLOODHOUND_REPORT_DIR=reports diff --git a/handlers/__init__.py b/handlers/__init__.py new file mode 100644 index 0000000..3c64b66 --- /dev/null +++ b/handlers/__init__.py @@ -0,0 +1,8 @@ +""" +handlers/ + +Deployment entrypoints. +These modules are referenced by AWS Lambda handler strings. +""" + + diff --git a/handlers/lambda_function.py b/handlers/lambda_function.py new file mode 100644 index 0000000..9e06a2a --- /dev/null +++ b/handlers/lambda_function.py @@ -0,0 +1,123 @@ +"""" +handlers/lambda_function.py + +AWS Lambda entrypoint for Bloodhound v2. + +This handler routes incoming events to explicit execution paths: + +- Slack HTTP events (Function URL) +- Scheduled events (EventBridge or manual triggers) +- Default/manual invocations (scan, status, validation) + +Each event type is routed to a dedicated handler or execution path +to ensure deterministic behavior and prevent recursive execution. + +This file also standardizes CloudWatch logging, including: +- event type tagging (e.g., SCAN, STATUS, SCHEDULED) +- request ID tracing via context.aws_request_id + +Terraform config points at: +- handlers.lambda_function.lambda_handler +""" + +from __future__ import annotations + +from bloodhound.app import run +from bloodhound.slack_commands import handle_slack_command_http, is_slack_http_event + +def log_event(event_type, event, request_id=None): + """ + Standardized CloudWatch log helper. + + Provides consistent log structure across all event types. + Includes optional request_id so each Lambda invocation + can be traced end-to-end in CloudWatch logs. + + Parameters + ---------- + event_type : str + Logical type of the event (e.g., "scan", "status", "scheduled", "slack") + + event : any + Raw event payload received by the Lambda + + request_id : str, optional + AWS Lambda request ID (context.aws_request_id) used for tracing + """ + print("\n" + "=" * 60) + + # Include request_id if available for traceability + if request_id: + print("[BLOODHOUND][" + str(event_type).upper() + "][request_id=" + str(request_id) + "]") + else: + print("[BLOODHOUND][" + str(event_type).upper() + "]") + + print("=" * 60) + print("Event received:", event) + print("=" * 60 + "\n") + + +def lambda_handler(event, context): + """ + AWS Lambda entrypoint for Bloodhound. + + Routes incoming events to the appropriate execution path: + + - Slack HTTP events → handled immediately + - Scheduled events → routed to scheduled handler + - Default events → processed through main pipeline (run) + + This routing ensures deterministic execution and prevents recursion. + + Parameters + ---------- + event : dict + Incoming Lambda event payload + + Examples: + {"source": "scheduled"} + {"detail-type": "Scheduled Event"} + {"source": "scan"} + + context : object + AWS Lambda context (used for request_id tracing) + + Example: + context.aws_request_id -> "abc123-xyz" + + Returns + ------- + dict + Lambda response payload + + Example: + {"ok": True, "scan": {...}, "budget": {...}} + """ + + + # 1) Slack slash commands (HTTP events) + # Responds immediately; may trigger async follow-up work internally. + if isinstance(event, dict) and is_slack_http_event(event): + log_event("slack", event, context.aws_request_id) + return handle_slack_command_http(event) + + # 2) Scheduled events (EventBridge or manual trigger). + if isinstance(event, dict) and (event.get("detail-type") == "Scheduled Event" or event.get("source") == "scheduled"): + from bloodhound.handlers.scheduled_handler import handle_scheduled_event + log_event("scheduled", event, context.aws_request_id) + return handle_scheduled_event(event, context) + + #3) Default invocation (manual CLI / GHA operations such as scan/status). + # Determine event type for logging. + # Most events include a "source" field (scan, status, etc.). + # If missing or event is not a dict, label as "unknown". + if isinstance(event, dict): + event_type = event.get("source", "unknown") + else: + event_type = "unknown" + + log_event(event_type, event, context.aws_request_id) + + return run(event=event, context=context) + + diff --git a/infra/.terraform.lock.hcl b/infra/.terraform.lock.hcl new file mode 100644 index 0000000..6c39e9c --- /dev/null +++ b/infra/.terraform.lock.hcl @@ -0,0 +1,45 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/archive" { + version = "2.7.1" + constraints = "~> 2.0" + hashes = [ + "h1:A7EnRBVm4h9ryO9LwxYnKr4fy7ExPMwD5a1DsY7m1Y0=", + "zh:19881bb356a4a656a865f48aee70c0b8a03c35951b7799b6113883f67f196e8e", + "zh:2fcfbf6318dd514863268b09bbe19bfc958339c636bcbcc3664b45f2b8bf5cc6", + "zh:3323ab9a504ce0a115c28e64d0739369fe85151291a2ce480d51ccbb0c381ac5", + "zh:362674746fb3da3ab9bd4e70c75a3cdd9801a6cf258991102e2c46669cf68e19", + "zh:7140a46d748fdd12212161445c46bbbf30a3f4586c6ac97dd497f0c2565fe949", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:875e6ce78b10f73b1efc849bfcc7af3a28c83a52f878f503bb22776f71d79521", + "zh:b872c6ed24e38428d817ebfb214da69ea7eefc2c38e5a774db2ccd58e54d3a22", + "zh:cd6a44f731c1633ae5d37662af86e7b01ae4c96eb8b04144255824c3f350392d", + "zh:e0600f5e8da12710b0c52d6df0ba147a5486427c1a2cc78f31eea37a47ee1b07", + "zh:f21b2e2563bbb1e44e73557bcd6cdbc1ceb369d471049c40eb56cb84b6317a60", + "zh:f752829eba1cc04a479cf7ae7271526b402e206d5bcf1fcce9f535de5ff9e4e6", + ] +} + +provider "registry.terraform.io/hashicorp/aws" { + version = "6.27.0" + constraints = ">= 5.0.0" + hashes = [ + "h1:emgTfB1LXSFYh9uAwgsRMoMIN5Wz7jNNKq3rqC0EHWk=", + "zh:177a24b806c72e8484b5cabc93b2b38e3d770ae6f745a998b54d6619fd0e8129", + "zh:4ac4a85c14fb868a3306b542e6a56c10bd6c6d5a67bc0c9b8f6a9060cf5f3be7", + "zh:552652185bc85c8ba1da1d65dea47c454728a5c6839c458b6dcd3ce71c19ccfc", + "zh:60284b8172d09aee91eae0856f09855eaf040ce3a58d6933602ae17c53f8ed04", + "zh:6be38d156756ca61fb8e7c752cc5d769cd709686700ac4b230f40a6e95b5dbc9", + "zh:7a409138fae4ef42e3a637e37cb9efedf96459e28a3c764fc4e855e8db9a7485", + "zh:8070cf5224ed1ed3a3e9a59f7c30ff88bf071c7567165275d477c1738a56c064", + "zh:894439ef340a9a79f69cd759e27ad11c7826adeca27be1b1ca82b3c9702fa300", + "zh:89d035eebf08a97c89374ff06040955ddc09f275ecca609d0c9d58d149bef5cf", + "zh:985b1145d724fc1f38369099e4a5087141885740fd6c0b1dbc492171e73c2e49", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:a80b47ae8d1475201c86bd94a5dcb9dd4da5e8b73102a90820b68b66b76d50fd", + "zh:d3395be1556210f82199b9166a6b2e677cee9c4b67e96e63f6c3a98325ad7ab0", + "zh:db0b869d09657f6f1e4110b56093c5fcdf9dbdd97c020db1e577b239c0adcbce", + "zh:ffc72e680370ae7c21f9bd3082c6317730df805c6797427839a6b6b7e9a26a01", + ] +} diff --git a/infra/README.md b/infra/README.md new file mode 100644 index 0000000..3f202c5 --- /dev/null +++ b/infra/README.md @@ -0,0 +1,657 @@ +# Bloodhound v2 Infrastructure (Terraform) + +## Table of Contents + +- [First-Time Terraform Setup](#first-time-terraform-setup) +- [What Terraform Creates](#what-terraform-creates) +- [Deploy Flow](#deploy-flow) +- [Python Version Requirement for Lambda Packaging](#python-version-requirement-for-lambda-packaging) +- [AWS Region Alignment](#aws-region-alignment) +- [Environment Variables and Secrets](#environment-variables-and-secrets) +- [Lambda Versioning and Alias](#lambda-versioning-and-alias) +- [Performing a Rollback](#performing-a-rollback) +- [Permanent Rollback Using Terraform](#permanent-rollback-using-terraform) +- [Destructive Mode Deployment Guard](#destructive-mode-deployment-guard) + +This directory provisions the AWS infrastructure for running Bloodhound v2 with Slack slash commands. + +We use a **Lambda Function URL** (single endpoint) for `/v2_seek` and `/v2_seek_destroy`. + +## First-Time Terraform Setup (Existing AWS Resources) + +If the IAM role or IAM policy already exist in the AWS account, +Terraform must import them into state before the first `terraform apply`. + +This situation commonly occurs when: + +- Bloodhound resources were created manually +- The project was previously deployed outside Terraform +- The AWS account already contains earlier Bloodhound infrastructure + +To prevent Terraform errors such as: + +EntityAlreadyExists: Role with name bloodhound-v2-role already exists + +this repository includes a helper script that automatically imports +existing resources into Terraform state if they are detected. + +### Run the bootstrap helper + +From the `infra/` directory: + +```bash +./bootstrap_imports.sh +``` + +The script will: + +Detect if the IAM role bloodhound-v2-role exists +Detect if the IAM policy bloodhound-v2-policy exists +Import them into Terraform state if necessary + +After running the script, proceed normally: + +terraform init +terraform apply +When this step is required + +You typically only need to run the bootstrap script: + +the first time Terraform is introduced into an AWS account +when existing infrastructure already exists + +Once resources are managed by Terraform, this step is no longer necessary. + +Why this script exists + +Terraform cannot automatically adopt resources that already exist in AWS. + +The bootstrap script ensures Terraform can safely begin managing +existing infrastructure without requiring engineers to manually run +terraform import commands. + +This helps avoid common onboarding errors and keeps infrastructure +management consistent across environments. + +## What Terraform creates + +- Lambda function: `BloodhoundLambdaV2` +- Lambda Function URL (public, `authorization_type = NONE`) +- IAM role + policies for: + - CloudWatch logs + - scanning resources (EC2/RDS/ELBv2) + - cost explorer (CE) + - teardown actions (terminate/delete) + - async self-invocation (so slash commands can return immediately) + + ### Execution Model Notes + +Bloodhound uses different execution paths depending on invocation type: + +All events first pass through the Lambda event router, which determines +the correct execution path. + +- Slack commands may use async self-invocation so responses return immediately +- Scheduled scans run synchronously through a dedicated execution path +- Manual operations execute through the main pipeline + +Important: + +Scheduled events do NOT use async self-invocation and must not pass through +the generic `run()` function. + +They are routed through a dedicated scheduled execution handler. + +They follow: + +scheduled_handler → run_scheduled_scan() → execute_pipeline() + +This separation prevents recursive execution loops. + +### Lambda Execution Logging + +Bloodhound Lambda executions emit structured log markers to make +CloudWatch debugging easier. + +Format: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SLACK][request_id=...] +[BLOODHOUND][SCHEDULED][request_id=...] +[BLOODHOUND][VALIDATION][request_id=...] + +The `request_id` corresponds to the AWS Lambda invocation ID +(`context.aws_request_id`) and allows engineers to trace +individual executions across CloudWatch logs. + +### Deploy flow + +1. Apply Terraform (from `Bloodhound/infra/`): + +```bash +terraform init +terraform apply +``` + +Terraform automatically builds the Lambda deployment package during `terraform apply`. + +Packaging flow: + +```text +terraform apply + ↓ +terraform_data.build_lambda_pkg + ↓ +scripts/build_lambda.sh + ↓ +build mode + ├─ Docker build (default) + │ ↓ + │ Docker (AWS Lambda runtime container) + │ ↓ + │ pip install dependencies + │ + └─ Local build (fallback) + ↓ + python3 + pip + ↓ + pip install dependencies + ↓ +copy application source + ↓ +.build/ + lambda_pkg/ final Lambda package + ↓ +archive_file + ↓ +.build/bloodhound_lambda_v2.zip +``` + +Note: +The current build system installs dependencies directly into +`.build/lambda_pkg` instead of using intermediate dependency or +source directories. + +This keeps the packaging process simple and ensures Terraform +always archives a complete, ready-to-deploy Lambda package. + +The build process is triggered only when Terraform detects changes to: + +- application source code (bloodhound/, handlers/) +- requirements.txt + +This ensures fast incremental builds while avoiding unnecessary dependency installation. + +### ⚠️ Important + +Engineers modifying the Lambda build process should review: + +docs/lambda_packaging.md + +before making changes to avoid breaking Terraform packaging or deployment. + +2. Configure Slack slash commands + +In your Slack App settings, set the Request URL for `v2_seek` and `/v2_seek_destroy` to the Terraform output: + +- `lambda_function_url` + +### Lambda Build System Overview + +Bloodhound uses a layered build system to improve performance and reliability. + +```text +.build/ + lambda_pkg/ final deployment package +``` + +The Lambda build script installs Python dependencies and copies +application source code directly into the Lambda package directory. + +Contents typically include: + +- Bloodhound application modules (`bloodhound/`) +- Lambda handler entrypoints (`handlers/`) +- Python dependencies installed from `requirements.txt` + +Terraform then archives this directory into the deployment artifact: + +`.build/bloodhound_lambda_v2.zip` + +### Forcing a Lambda Rebuild + +Terraform automatically rebuilds the Lambda package when +application code or `requirements.txt` changes. + +If the packaging logic or build script changes, Terraform +may not detect the modification automatically. + +Engineers can force a rebuild using: + +```bash +terraform apply -replace=terraform_data.build_lambda_pkg +``` +This forces Terraform to rerun the Lambda build pipeline and +recreate the deployment artifact. + +## Python Version Requirement for Lambda Packaging + +The Lambda runtime for Bloodhound v2 is currently: + +`python3.10` + +During deployment, Terraform builds the Lambda package locally using pip before uploading it to AWS. + + +Dependency installation is handled by the build script: + +`scripts/build_lambda.sh` + +By default, the Lambda package is built using Docker to ensure +the dependency environment matches the AWS Lambda runtime. + +Docker builds run inside the official AWS Lambda runtime container: + +public.ecr.aws/lambda/python:3.10 + +If Docker is unavailable, engineers can temporarily use a local +Python environment instead: + +`terraform apply -var="use_docker_build=false"` + +Docker builds use the AWS Lambda runtime container: + +public.ecr.aws/lambda/python:3.10 + +This ensures dependencies are built in an environment that matches AWS Lambda. + +Legacy step was executed by Terraform using: + +`python3 -m pip install -r requirements.txt -t .build/lambda_pkg` + +Because Python dependency resolution can vary between versions, +the Python version used to build the Lambda package should match +the Lambda runtime version. + +This prevents dependency conflicts and ensures the deployed +package behaves the same in AWS as it does during packaging. + +If your system default python3 is a newer version (for example Python 3.12 or Python 3.13), the packaging step may fail with dependency resolution errors during: + +`terraform apply` + +Example error: + +`ERROR: Cannot install ... because these package versions have conflicting dependencies` + +To avoid this issue, ensure that the Lambda package is built using Python 3.10. + +Example: + +`python3.10 -m pip install -r requirements.txt -t .build/lambda_pkg` + +Your local development environment can still use newer Python versions (3.11+), but the Lambda packaging step should use the same version as the configured Lambda runtime. + +Note: +The Lambda runtime version is defined in lambda.tf. If the runtime is upgraded (for example to python3.11 or python3.12), the packaging Python version used in build.tf should be updated to match. + +See `docs/lambda_packaging.md` for full details on: + +- Lambda packaging architecture +- dependency caching strategy +- Docker-based builds +- Terraform build triggers + +### AWS Region Alignment + +All components of the Bloodhound deployment must use the **same AWS region**. + +Terraform deploys the Lambda function to the region defined in the Terraform provider configuration. + +Example: + +provider "aws" { + region = "us-east-1" +} + +Any external systems invoking the Lambda must use the **same region**, including: + +- GitHub Actions workflows +- AWS CLI commands +- Manual testing scripts + +For example, the GitHub workflow must use: + +aws-region: us-east-1 + +and: + +--region us-east-1 + +If the regions do not match, the workflow will fail because AWS will not find the Lambda function. + +### Notes + +- Terraform invokes a build script (`scripts/build_lambda.sh`) to construct the Lambda package. +- The build script requires `python3`, `pip`, `zip`, and `rsync` when using local builds. +- If Docker mode is enabled, only Docker is required for dependency installation. +- Putting secrets in `var.lambda_env` stores them in Terraform state. Prefer setting secrets in the Lambda console (or a secrets manager). + +## Environment Variables and Secrets + +Bloodhound uses different configuration sources for **local development** and **AWS runtime**. + +### Local Development + +When running locally, configuration is loaded from the `.env` file: + +.env + +Example usage: + +```bash +python -m tools.run_local +``` + +The .env file is only used for local development and should never be committed to Git. + +AWS Runtime Configuration + +When deployed to AWS Lambda, Bloodhound does not use `.env`. + +Instead, configuration is provided through Lambda environment variables. + +After Terraform creates the Lambda function, configure secrets in the AWS console: + +AWS Console +→ Lambda +→ BloodhoundLambdaV2 +→ Configuration +→ Environment Variables + +Add the following values: + +SLACK_BOT_TOKEN +SLACK_SIGNING_SECRET +SLACK_SCAN_CHANNEL_ID +SLACK_ALERT_CHANNEL_ID + +The application reads these values at runtime using: + +`os.getenv("VARIABLE_NAME")` + +This works both locally (.env) and in AWS (Lambda environment variables). + +Terraform-Managed Variables + +Terraform may manage non-secret configuration variables, such as: + +REGION_MODE +REGIONS +APPLY_CHANGES +TEARDOWN_SIMULATE +TEARDOWN_ALLOW_ALL +COHORT_START_YYYY_MM +COHORT_TOTAL_BUDGET_USD +lambda_alias_version_override + +lambda_alias_version_override allows temporarily pinning the production alias to a specific Lambda version for rollback. + +These values can safely live in: + +terraform.tfvars + +Terraform will inject them into the Lambda environment during deployment. + +Secrets Policy + +Secrets must not be stored in Terraform variables because they would be written into the Terraform state file. + +This includes: + +SLACK_BOT_TOKEN +SLACK_SIGNING_SECRET +SLACK_SCAN_CHANNEL_ID +SLACK_ALERT_CHANNEL_ID + +Instead, secrets should be configured directly in the Lambda environment variables after deployment. + +This prevents secrets from appearing in: + +Git repositories + +Terraform configuration files + +Terraform state + +## Lambda Versioning and Alias + +Bloodhound uses **Lambda version publishing with a production alias** to enable safer deployments and easy rollback. + +Each time Terraform deploys the Lambda function, AWS publishes a **new immutable version** of the function. + +Example structure in AWS: + + +BloodhoundLambdaV2 +├─ $LATEST +├─ Version 1 +├─ Version 2 +└─ Version 3 +↑ +alias: prod + + +Terraform automatically moves the `prod` alias to the newest published version during each deploy. + +### Deployment Behavior + +The deployment process works as follows: + + +terraform plan +↓ +preview infrastructure changes + +terraform apply +↓ +publish new Lambda version +↓ +update prod alias → newest version + + +The `publish = true` setting in `lambda.tf` ensures that every code change results in a new version being created. + +The alias defined in `alias.tf` ensures that the production entry point always points to the most recently deployed version. + +### Why This Is Used + +Using Lambda versioning provides several operational benefits: + +- **Immutable deployments** – each version represents a fixed snapshot of the code +- **Safe rollbacks** – the alias can be repointed to a previous version if a deployment fails +- **Deployment history** – all previous Lambda versions remain available for debugging + +### Rollback Example + +If a deployment introduces an issue, the production alias can be moved back to a previous version. + +Example: + +prod → Version 2 + +This immediately restores the previous working deployment without needing to redeploy code. + +### Slack Integration + +Slack continues to call the same **Lambda Function URL**. + +Internally AWS routes the request to the alias: + +Slack +↓ +Lambda Function URL +↓ +BloodhoundLambdaV2:prod +↓ +Active Lambda version + +Because of this, deployments and rollbacks do **not require changing the Slack configuration**. + +### Viewing Lambda Versions + +Lambda versions can be viewed in the AWS console. + +Navigate to: + +AWS Console +→ Lambda +→ BloodhoundLambdaV2 +→ Versions + +You will see a list similar to: + +$LATEST +Version 1 +Version 2 +Version 3 + +The production alias will indicate which version is currently active: + +prod → Version 3 + +--- + +### Performing a Rollback + +If a deployment introduces an issue, the production alias can be moved back to a previous version. + +Navigate to: + +AWS Console +→ Lambda +→ BloodhoundLambdaV2 +→ Aliases +→ prod +→ Edit + +Then change the alias target to the previous version. + +Example: + +prod → Version 2 + +This immediately restores the previous working deployment without redeploying code. + +--- + +### Important: Terraform Deploy Behavior + +Terraform automatically moves the `prod` alias to the **latest published version** during each deployment. + +Example deploy: + +terraform apply +↓ +publish Version 4 +↓ +prod → Version 4 + + +Because of this behavior, a manual rollback performed in the AWS console is **temporary**. + +Running `terraform apply` again will move the alias back to the newest deployed version. + +If a rollback must remain active, the underlying issue should be fixed before the next Terraform deployment +------ + +### Permanent Rollback Using Terraform + +Because Terraform manages the Lambda alias, a rollback performed in the AWS console is temporary. + +To make a rollback permanent, Terraform provides a **version override variable** that allows the production alias to be pinned to a specific version. + +This avoids editing infrastructure code during incidents. + +--- + +### Step 1: Identify the Working Version + +Find the version to roll back to in the AWS console: + +AWS Console +→ Lambda +→ BloodhoundLambdaV2 +→ Versions + +Example: + +$LATEST +Version 1 +Version 2 +Version 3 + +--- + +### Step 2: Apply Rollback Using Terraform + +Use the override variable when running Terraform: + +Syntax: +```bash +terraform apply -var="lambda_alias_version_override=" +``` + +Example: +```bash +terraform apply -var="lambda_alias_version_override=2" +``` + +Result: + +prod → Version 2 + +The production alias will now permanently point to that version. + +Step 3: Restore Normal Deploy Behavior + +Once the issue is resolved, remove the override: + +```bash +terraform apply -var="lambda_alias_version_override=null" +``` + +After this, Terraform deployments will again move the prod alias to the newest published version automatically. + +## Destructive Mode Deployment Guard + +Bloodhound includes a Terraform safety guard that prevents +deployments when destructive mode is enabled. + +If the Lambda environment variable: + +APPLY_CHANGES=true + +Terraform will refuse to deploy unless the engineer explicitly +acknowledges the action using the override variable. + +This guard prevents accidental deployments where Bloodhound +would be allowed to delete infrastructure. + +Example error: + +Deployment blocked: APPLY_CHANGES=true requires -var allow_apply_mode=true + +To intentionally deploy with destructive mode enabled: + +terraform apply -var allow_apply_mode=true + +This guard exists to prevent accidental deployments that could +allow Bloodhound to delete infrastructure. + +Normal deployments should run with: + +APPLY_CHANGES=false \ No newline at end of file diff --git a/infra/account_guard.tf b/infra/account_guard.tf new file mode 100644 index 0000000..0df8af1 --- /dev/null +++ b/infra/account_guard.tf @@ -0,0 +1,17 @@ +/* +infra/account_guard.tf + +Safety guard to prevent Terraform from deploying +to the wrong AWS account. +*/ + +data "aws_caller_identity" "current" {} + +resource "terraform_data" "account_guard" { + lifecycle { + precondition { + condition = data.aws_caller_identity.current.account_id == var.expected_aws_account_id + error_message = "Terraform is connected to the wrong AWS account." + } + } +} \ No newline at end of file diff --git a/infra/alias.tf b/infra/alias.tf new file mode 100644 index 0000000..b8cc2ea --- /dev/null +++ b/infra/alias.tf @@ -0,0 +1,23 @@ +/* +infra/alias.tf + +Defines the Lambda alias used for production traffic. + +Key points: +- The alias provides a stable name ("prod") that points to a specific + published Lambda version. +- Each Terraform deploy publishes a new immutable Lambda version. +- The alias automatically shifts to the latest version during deploys. +- An optional override variable allows pinning the alias to an older + version for rollback without modifying infrastructure code. +*/ + +resource "aws_lambda_alias" "bloodhound_prod" { + name = "prod" + description = "Production alias for Bloodhound Lambda" + function_name = aws_lambda_function.bloodhound_v2.function_name + function_version = coalesce( + var.lambda_alias_version_override, + aws_lambda_function.bloodhound_v2.version + ) +} \ No newline at end of file diff --git a/infra/bootstrap_imports.sh b/infra/bootstrap_imports.sh new file mode 100755 index 0000000..5b524ee --- /dev/null +++ b/infra/bootstrap_imports.sh @@ -0,0 +1,91 @@ +#!/usr/bin/env bash + +# ------------------------------------------------------------------------------ +# bootstrap_imports.sh +# +# Purpose +# ------- +# Terraform cannot automatically manage resources that already exist in AWS. +# If IAM roles or policies were previously created manually (or by earlier +# tooling), Terraform will fail during `terraform apply` with: +# +# EntityAlreadyExists +# +# This helper script detects existing Bloodhound IAM resources and imports +# them into Terraform state so Terraform can manage them safely. +# +# When to run +# ----------- +# Run this script once before the first `terraform apply` in an account where +# Bloodhound infrastructure may already exist. +# +# Typical workflow: +# +# cd infra +# ./bootstrap_imports.sh +# terraform apply +# +# The script is safe to run multiple times. +# +# Requirements +# ------------ +# - AWS CLI configured +# - Terraform installed +# - Appropriate AWS IAM permissions +# +# ------------------------------------------------------------------------------ + +set -e +set -o pipefail # makes bash fail if any command in a pipeline fails + +# ------------------------------------------------------------------------------ +# Safety Check +# ------------------------------------------------------------------------------ +# This script must be executed from the `infra/` directory because Terraform +# commands rely on the Terraform configuration files in this directory. +# +# If someone runs the script from the repository root (or another location), +# Terraform would fail because it cannot find the infrastructure configuration. +# +# We detect this by verifying that a known Terraform file exists locally. +# ------------------------------------------------------------------------------ + +if [ ! -f "lambda.tf" ]; then + echo "Error: this script must be run from the infra/ directory." + echo "Example:" + echo " cd infra" + echo " ./bootstrap_imports.sh" + exit 1 +fi + +ROLE_NAME="bloodhound-v2-role" +POLICY_NAME="bloodhound-v2-policy" + +echo "Checking existing IAM resources..." + +# Retrieve AWS account ID for constructing policy ARN +ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + +# --------------------------------------------------- +# Check if IAM role exists +# --------------------------------------------------- +ROLE_EXISTS=$(aws iam get-role --role-name $ROLE_NAME 2>/dev/null || true) + +if [ -n "$ROLE_EXISTS" ]; then + echo "Existing IAM role detected. Importing into Terraform state..." + terraform import aws_iam_role.lambda_role $ROLE_NAME || true +fi + +# --------------------------------------------------- +# Check if IAM policy exists +# --------------------------------------------------- +POLICY_ARN="arn:aws:iam::$ACCOUNT_ID:policy/$POLICY_NAME" + +POLICY_EXISTS=$(aws iam get-policy --policy-arn $POLICY_ARN 2>/dev/null || true) + +if [ -n "$POLICY_EXISTS" ]; then + echo "Existing IAM policy detected. Importing into Terraform state..." + terraform import aws_iam_policy.bloodhound_policy $POLICY_ARN || true +fi + +echo "Terraform import check complete." \ No newline at end of file diff --git a/infra/build.tf b/infra/build.tf new file mode 100644 index 0000000..556030e --- /dev/null +++ b/infra/build.tf @@ -0,0 +1,126 @@ +/* +infra/build.tf + +Build pipeline for the Lambda zip (Terraform-managed). + +How it works: +1) terraform_data.build_lambda_pkg prepares ../.build/lambda_pkg by: + - pip installing dependencies into the package directory + - copying our source code into the package directory +2) archive_file.lambda_zip zips that directory into ../.build/bloodhound_lambda_v2.zip + +Notes: + +• This build runs locally on the machine executing `terraform apply`. + +• Required local tools: + - python3 + - pip + - rsync + +• Dependency installation uses: + + python3 -m pip install --upgrade --no-cache-dir -r requirements.txt -t .build/lambda_pkg + + Flags explained: + + --upgrade + Ensures the newest compatible versions of dependencies are installed. + + --no-cache-dir + Prevents pip cache reuse which can cause corrupted or inconsistent + dependency resolution across machines. + + -t .build/lambda_pkg + Installs dependencies directly into the Lambda package directory. + +• Only runtime dependencies listed in `requirements.txt` are packaged. + + Development-only dependencies live in `requirements-dev.txt` + and are used only for local development/testing. +*/ + +resource "terraform_data" "build_lambda_pkg" { + + triggers_replace = { + + # ------------------------------------------------------------------- + # Rebuild Lambda when dependencies change + # ------------------------------------------------------------------- + requirements_hash = filesha256("${path.module}/../requirements.txt") + + # ------------------------------------------------------------------- + # Rebuild if main handler changes + # ------------------------------------------------------------------- + lambda_handler_hash = filesha256("${path.module}/../handlers/lambda_function.py") + + # ------------------------------------------------------------------- + # SAFETY TRIGGER + # + # Terraform cannot detect changes to application code when the + # Lambda package is built locally via `local-exec`. + # + # We compute a fingerprint (hash) of all Python runtime files so that any change + # to the Lambda source forces this resource to rebuild the package. + # + # Only runtime directories are included to avoid rebuilds caused by + # unrelated files (.build, .venv, scripts, tests, etc). + # ------------------------------------------------------------------- + python_sources_hash = sha256(join("", concat( + + # Hash all Python files inside the main application package + [ + for f in fileset("${path.module}/../bloodhound", "**/*.py") : + filesha256("${path.module}/../bloodhound/${f}") + ], + + # Hash Lambda handler entrypoints + [ + for f in fileset("${path.module}/../handlers", "**/*.py") : + filesha256("${path.module}/../handlers/${f}") + ] + + ))) + } + # Build the Lambda package locally using a shell script + provisioner "local-exec" { + + # -------------------------------------------------------------------- + # Build Lambda package via external build script + # + # The packaging logic has been moved to scripts/build_lambda.sh + # so that: + # + # • Terraform focuses only on infrastructure orchestration + # • build logic becomes easier to maintain + # • Docker-based builds can be supported + # + # The script prepares: + # + # .build/lambda_pkg + # + # Terraform then archives that directory using archive_file. + # -------------------------------------------------------------------- + + working_dir = "${path.module}/.." + + command = "bash scripts/build_lambda.sh" + + environment = { + USE_DOCKER_BUILD = var.use_docker_build + } + + interpreter = ["/bin/bash", "-lc"] + } +} + +# Zip is created by the archive provider (no manual zip commands). +data "archive_file" "lambda_zip" { + type = "zip" + source_dir = local.pkg_dir + output_path = local.zip_path + + depends_on = [terraform_data.build_lambda_pkg] +} + + diff --git a/infra/function_url.tf b/infra/function_url.tf new file mode 100644 index 0000000..8eabf6b --- /dev/null +++ b/infra/function_url.tf @@ -0,0 +1,44 @@ +/* +infra/function_url.tf + +Public HTTPS endpoint for Slack slash commands. + +We use a Lambda Function URL (single endpoint) and validate Slack signatures in code. + +AWS change (Oct 2025): +Function URLs now require BOTH permissions: + - lambda:InvokeFunctionUrl + - lambda:InvokeFunction +*/ + +# --------------------------------------------------------- +# Lambda Function URL +# --------------------------------------------------------- + +resource "aws_lambda_function_url" "bloodhound_url" { + function_name = aws_lambda_function.bloodhound_v2.function_name + authorization_type = "NONE" +} + +# --------------------------------------------------------- +# Allow public HTTP invocation of the Function URL +# --------------------------------------------------------- + +resource "aws_lambda_permission" "function_url_public" { + statement_id = "AllowFunctionUrlPublic" + action = "lambda:InvokeFunctionUrl" + function_name = aws_lambda_function.bloodhound_v2.function_name + principal = "*" + function_url_auth_type = "NONE" +} + +# --------------------------------------------------------- +# Allow the Lambda service to execute the function +# --------------------------------------------------------- + +resource "aws_lambda_permission" "function_url_invoke" { + statement_id = "AllowFunctionInvoke" + action = "lambda:InvokeFunction" + function_name = aws_lambda_function.bloodhound_v2.function_name + principal = "*" +} \ No newline at end of file diff --git a/infra/iam.tf b/infra/iam.tf new file mode 100644 index 0000000..6401656 --- /dev/null +++ b/infra/iam.tf @@ -0,0 +1,128 @@ +/* +infra/iam.tf + +IAM role + policies for BloodhoundLambdaV2. + +Intent: +- allow scanning (Describe APIs) + Cost Explorer reads +- allow teardown actions (terminate/delete) when enabled by env flags +- allow lambda self-invoke for slash commands (async worker invocation) +*/ + +data "aws_iam_policy_document" "lambda_assume" { + statement { + actions = ["sts:AssumeRole"] + principals { + type = "Service" + identifiers = ["lambda.amazonaws.com"] + } + } +} + +resource "aws_iam_role" "lambda_role" { + name = "${local.name_prefix}-role" + assume_role_policy = data.aws_iam_policy_document.lambda_assume.json + + lifecycle { + prevent_destroy = true + } +} + +resource "aws_iam_role_policy_attachment" "basic_logs" { + role = aws_iam_role.lambda_role.name + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" +} + +data "aws_iam_policy_document" "bloodhound" { + # Read scanning permissions + statement { + actions = [ + "ec2:Describe*", + "rds:Describe*", + "rds:ListTagsForResource", + "elasticloadbalancing:Describe*", + "ce:GetCostAndUsage", + "ssm:GetParameter" + ] + resources = ["*"] + } + + # Spending-controls / guardrails proof (budgets, SCPs, IAM principals). + statement { + actions = [ + "sts:GetCallerIdentity", + "budgets:DescribeBudgets", + "budgets:ViewBudget", + "budgets:DescribeBudgetActionsForAccount", + "budgets:DescribeBudgetActionsForBudget", + "budgets:DescribeBudgetAction", + "organizations:DescribePolicy", + "organizations:DescribeOrganizationalUnit", + "organizations:DescribeAccount", + "iam:ListGroups", + "iam:ListUsers" + ] + resources = ["*"] + } + + # Cost-guard management ("/guard" command): edit the SCP + the IAM group policy in + # sync, and manage group membership. Powerful — paired with Slack allowlist gating + # (GUARD_ALLOWED_USER_IDS) and a toggleable-service safelist in the app layer. + statement { + actions = [ + "organizations:ListPolicies", + "organizations:UpdatePolicy", + "organizations:ListTargetsForPolicy", + "organizations:AttachPolicy", + "organizations:DetachPolicy", + "iam:ListPolicies", + "iam:GetPolicy", + "iam:GetPolicyVersion", + "iam:ListPolicyVersions", + "iam:CreatePolicyVersion", + "iam:DeletePolicyVersion", + "iam:ListAttachedGroupPolicies", + "iam:AttachGroupPolicy", + "iam:DetachGroupPolicy", + "iam:GetGroup", + "iam:AddUserToGroup", + "iam:RemoveUserFromGroup" + ] + resources = ["*"] + } + + # Teardown permissions (delete/terminate) + statement { + actions = [ + "ec2:TerminateInstances", + "ec2:DeleteVolume", + "ec2:ReleaseAddress", + "ec2:DeleteNatGateway", + "rds:DeleteDBInstance", + "elasticloadbalancing:DeleteLoadBalancer" + ] + resources = ["*"] + } + + # Allow async self-invoke for slash commands. + statement { + actions = ["lambda:InvokeFunction"] + resources = ["*"] + } +} + +resource "aws_iam_policy" "bloodhound_policy" { + name = "${local.name_prefix}-policy" + policy = data.aws_iam_policy_document.bloodhound.json + + lifecycle { + prevent_destroy = true + } +} + +resource "aws_iam_role_policy_attachment" "bloodhound_attach" { + role = aws_iam_role.lambda_role.name + policy_arn = aws_iam_policy.bloodhound_policy.arn +} + + diff --git a/infra/lambda.tf b/infra/lambda.tf new file mode 100644 index 0000000..490c40b --- /dev/null +++ b/infra/lambda.tf @@ -0,0 +1,73 @@ +/* +infra/lambda.tf + +The Bloodhound v2 Lambda function resource. + +Key points: +- Code package comes from infra/build.tf (archive_file output) +- Env vars are provided via var.lambda_env (often sourced from terraform.tfvars) +*/ + +/* +Detect whether destructive mode is enabled. + +lambda_env is a map of environment variables passed to the Lambda. +We check if APPLY_CHANGES is set to "true". + +If the variable does not exist, default to "false". +*/ +locals { + + apply_changes_enabled = lookup(var.lambda_env, "APPLY_CHANGES", "false") == "true" + +} + +/* +Deployment safety guard. + +If APPLY_CHANGES=true AND allow_apply_mode=false, +Terraform will stop the deployment. + +This prevents someone from accidentally deploying Bloodhound +in destructive mode. + +Engineers must explicitly acknowledge the action using: + +terraform apply -var allow_apply_mode=true +*/ +check "apply_mode_guard" { + + assert { + condition = !(local.apply_changes_enabled && var.allow_apply_mode == false) + error_message = "Deployment blocked: APPLY_CHANGES=true requires -var allow_apply_mode=true" + } + +} + +resource "aws_lambda_function" "bloodhound_v2" { + function_name = var.lambda_function_name + role = aws_iam_role.lambda_role.arn + handler = "handlers.lambda_function.lambda_handler" + runtime = var.lambda_runtime + + filename = data.archive_file.lambda_zip.output_path + source_code_hash = data.archive_file.lambda_zip.output_base64sha256 + + timeout = var.lambda_timeout_seconds + memory_size = var.lambda_memory_mb + + publish = true + + environment { + variables = var.lambda_env + } + + # prevent_destroy is intentionally disabled. + # Lambdas are stateless and safe to recreate during deploys. + # Enable this only if the function ever manages critical resources. + lifecycle { + prevent_destroy = false + } +} + + diff --git a/infra/locals.tf b/infra/locals.tf new file mode 100644 index 0000000..ac36282 --- /dev/null +++ b/infra/locals.tf @@ -0,0 +1,15 @@ +/* +infra/locals.tf + +Local paths and naming helpers. +These keep the build/archive + Lambda resources consistent and easy to tweak. +*/ + +locals { + build_dir = "${path.module}/../.build" + pkg_dir = "${local.build_dir}/lambda_pkg" + zip_path = "${local.build_dir}/bloodhound_lambda_v2.zip" + name_prefix = var.name_prefix +} + + diff --git a/infra/main.tf b/infra/main.tf new file mode 100644 index 0000000..fc78831 --- /dev/null +++ b/infra/main.tf @@ -0,0 +1,23 @@ +terraform { + /* + infra/main.tf + + Terraform root settings for Bloodhound v2. + This file intentionally contains ONLY provider requirements and version constraints. + Resources are split into dedicated files (iam.tf, lambda.tf, function_url.tf, build.tf, ...). + */ + # terraform main file intentionally keeps only provider requirements. + required_version = ">= 1.5.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.0.0" + } + archive = { + source = "hashicorp/archive" + version = "~> 2.0" + } + } +} + + diff --git a/infra/outputs.tf b/infra/outputs.tf new file mode 100644 index 0000000..02bb3f2 --- /dev/null +++ b/infra/outputs.tf @@ -0,0 +1,19 @@ +/* +infra/outputs.tf + +Outputs used by operators when configuring Slack commands +and validating deployments. + +To retrieve the Slack command endpoint: + +terraform output bloodhound_lambda_url +*/ + +output "lambda_function_name" { + value = aws_lambda_function.bloodhound_v2.function_name +} + +output "bloodhound_lambda_url" { + description = "Public Lambda Function URL used by Slack slash commands" + value = aws_lambda_function_url.bloodhound_url.function_url +} \ No newline at end of file diff --git a/infra/providers.tf b/infra/providers.tf new file mode 100644 index 0000000..e8171bc --- /dev/null +++ b/infra/providers.tf @@ -0,0 +1,13 @@ +/* +infra/providers.tf + +AWS provider configuration for this module. +We keep provider config separate so main.tf can stay provider-requirements-only. +*/ + +provider "aws" { + region = var.aws_region + profile = var.aws_profile +} + + diff --git a/infra/slack/README.md b/infra/slack/README.md new file mode 100644 index 0000000..81e19be --- /dev/null +++ b/infra/slack/README.md @@ -0,0 +1,245 @@ +# Slack App Manifest — Bloodhound-V2 + +This directory contains the Slack App configuration for Bloodhound-V2. + +## Source of Truth + +The Slack configuration for Bloodhound is managed via a manifest to +ensure reproducibility and prevent configuration drift. + +Slack configuration is defined in: + +infra/slack/bloodhound_v2_manifest.json + +All Slack app settings must be applied from this manifest to ensure reproducibility and prevent configuration drift. + +--- + +## Bloodhound Slack Command Interface + +Bloodhound exposes both legacy and versioned commands. + +Legacy compatibility commands: + +/seek + Run AWS resource scan + +/seek_destroy CONFIRM + Execute destructive teardown + +Preferred V2 commands: + +/v2_seek + Run AWS resource scan + +/v2_seek_destroy_plan + Preview teardown plan + +/v2_seek_destroy CONFIRM + Execute destructive teardown + +/v2_status + Show system status and safety configuration + +## Manifest Structure Overview + +### display_information + +Controls how the app appears in Slack. + +- `name` — App name displayed in Slack. +- `description` — Short summary of purpose. +- `background_color` — Cosmetic only. + +Safe to modify: +- Description +- Background color + +Changing the name should be reviewed. + +--- + +### features.bot_user + +Defines the bot identity. + +- `display_name` — Name used when posting messages. +- `always_online=false` — Bot does not simulate presence. + +No presence spoofing is enabled. + +--- + +### features.slash_commands + +Bloodhound supports both **legacy commands** and **versioned v2 commands**. + +Legacy commands (kept for compatibility): + +- `/seek` — Non-destructive AWS scan. +- `/seek_destroy CONFIRM` — Execute destructive cleanup. + +Preferred v2 command interface: + +- `/v2_seek` — Non-destructive AWS resource scan. +- `/v2_seek_destroy_plan` — Preview the teardown plan without deleting resources. +- `/v2_seek_destroy CONFIRM` — Execute destructive cleanup of non-whitelisted resources. +- `/v2_status` — Show Bloodhound system status and safety configuration. + +Important: + +The `url` field in the manifest is a placeholder during setup. + +After Terraform deploys the Lambda function, the Slack Request URL +for each slash command must be updated to the Lambda Function URL +output by Terraform. + +Example: + +https://.lambda-url..on.aws + +This URL becomes the public HTTPS endpoint used by Slack to +invoke Bloodhound. + +Note: + +The `/seek_destroy` and `/v2_seek_destroy` commands require the confirmation token `CONFIRM`. +Slack sends this token as command text, and Bloodhound validates it before +executing destructive operations. + +--- + +### oauth_config.scopes.bot + +Defines bot permissions. + +Current scopes: + +- chat:write +- commands +- channels:read +- groups:read +- im:read +- mpim:read + +These are intentionally minimal. + +Do not add: +- admin scopes +- user impersonation scopes +- channel history scopes +- additional permissions + +Without review. + +--- + +### settings + +- `socket_mode_enabled=false` + - The app uses HTTPS (Lambda Function URL), not persistent sockets. + +- `token_rotation_enabled=false` + - Token rotation is not currently implemented. + +- `interactivity.is_enabled=false` + - No interactive components (buttons/modals). + +--- + +## Architectural Notes + +Slack commands provide the operational interface for Bloodhound. + +Command flow: + +```text +Slack + ↓ +Lambda Function URL + ↓ +Lambda event router + ↓ +Slack handler (bloodhound.handlers.slack_handler) + ↓ +Slack command parser (bloodhound.slack_commands) + ↓ +Execution pipeline (bloodhound.app) +``` + +Supported operational commands: + +`/v2_seek` + Run AWS resource scan + +`/v2_seek_destroy_plan` + Preview teardown plan + +`/v2_seek_destroy CONFIRM` + Execute destructive teardown + +`/v2_status` + Show system health and configuration + +Slack only triggers execution. + +All scanning and deletion logic lives inside AWS Lambda. + +### Note: + +Slack never performs AWS operations directly. + +Slack only sends HTTPS requests to the Lambda Function URL. +All scanning, planning, and deletion logic runs entirely inside +the Bloodhound Lambda execution environment. + +### Destructive behavior is gated by: + +Destructive behavior is gated by multiple safety controls: + +- confirmation token (`CONFIRM`) sent in the slash command +- environment configuration (APPLY_CHANGES, TEARDOWN_SIMULATE) +- Lambda safety rails that prevent destructive execution unless + explicitly enabled + +Slack never performs deletion directly. + +### Lambda Execution Logging + +Bloodhound Lambda executions emit structured log markers: + +[BLOODHOUND][EVENT_TYPE][request_id=...] + +Examples: + +[BLOODHOUND][SLACK][request_id=...] +[BLOODHOUND][SCAN][request_id=...] +[BLOODHOUND][STATUS][request_id=...] + +The request_id corresponds to the AWS Lambda invocation ID +(context.aws_request_id) and allows engineers to trace a single +execution across CloudWatch logs. + +--- + +## Change Policy + +Allowed changes without review: +- Display text updates +- Slash command descriptions + +Changes requiring review: + +- Adding OAuth scopes +- Enabling socket mode +- Enabling token rotation +- Enabling interactivity +- Adding new slash commands beyond the current interface + +Current supported command set: + +`/v2_seek` +`/v2_seek_destroy_plan` +`/v2_seek_destroy CONFIRM` +`/v2_status` + diff --git a/infra/slack/bloodhound_v2_manifest.json b/infra/slack/bloodhound_v2_manifest.json new file mode 100644 index 0000000..79eb3a4 --- /dev/null +++ b/infra/slack/bloodhound_v2_manifest.json @@ -0,0 +1,73 @@ +{ + "display_information": { + "name": "Bloodhound-V2", + "description": "AWS resource scanning and teardown automation (V2)", + "background_color": "#2E3A59" + }, + "features": { + "bot_user": { + "display_name": "Bloodhound-V2", + "always_online": false + }, + "slash_commands": [ + { + "command": "/seek", + "description": "Scan AWS resources and report results", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + }, + { + "command": "/seek_destroy", + "description": "Execute destructive cleanup (requires CONFIRM)", + "usage_hint": "CONFIRM", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + }, + { + "command": "/v2_seek", + "description": "Run a non-destructive AWS resource scan", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + }, + { + "command": "/v2_seek_destroy_plan", + "description": "Preview the teardown plan without deleting resources", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + }, + { + "command": "/v2_seek_destroy", + "description": "Execute destructive cleanup of non-whitelisted resources", + "usage_hint": "CONFIRM", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + }, + { + "command": "/v2_status", + "description": "Show Bloodhound system status and safety configuration", + "should_escape": false, + "url": "https://kn5244cyenar6pzgexnrq5oh2m0ohyvb.lambda-url.us-west-2.on.aws/" + } + ] + }, + "oauth_config": { + "scopes": { + "bot": [ + "chat:write", + "commands", + "channels:read", + "groups:read", + "im:read", + "mpim:read" + ] + } + }, + "settings": { + "org_deploy_enabled": false, + "socket_mode_enabled": false, + "token_rotation_enabled": false, + "interactivity": { + "is_enabled": false + } + } +} \ No newline at end of file diff --git a/infra/terraform.tfvars.example b/infra/terraform.tfvars.example new file mode 100644 index 0000000..8d3e7b4 --- /dev/null +++ b/infra/terraform.tfvars.example @@ -0,0 +1,59 @@ +# Example Terraform inputs for Bloodhound v2. +# +# Copy to terraform.tfvars (do not commit terraform.tfvars; it's gitignored). +# +# NOTE: Any values you put in lambda_env will end up in Terraform state. +# Avoid putting Slack tokens or secrets here. Prefer setting secrets in the Lambda console +# or via your preferred secret management approach. + +aws_region = "us-west-2" + +# Optional: AWS CLI profile Terraform should use when authenticating. +# If omitted, Terraform will use the default AWS credential chain +# (environment variables, SSO session, or the default profile). +#aws_profile = "" + +name_prefix = "bloodhound-v2" +lambda_function_name = "BloodhoundLambdaV2" +lambda_runtime = "python3.10" + +# Safety guard: Terraform will refuse to deploy if the active AWS +# credentials belong to a different account than this ID. +expected_aws_account_id = "123456789012" + +# Non-secret env vars can live here safely. +lambda_env = { + SLACK_ENABLED = "true" + # Secrets (OK to set here if you accept they will be stored in Terraform state) + SLACK_BOT_TOKEN = "REPLACE_ME" + SLACK_SIGNING_SECRET = "REPLACE_ME" + + SLACK_SCAN_CHANNEL_ID = "C0A4YLV0HNY" + SLACK_ALERT_CHANNEL_ID = "C0A4YLV0HNY" + REGION_MODE = "explicit" + REGIONS = "us-east-1,us-east-2,us-west-1,us-west-2" + KEEP_TAG_KEY = "bloodhound:keep" + KEEP_TAG_VALUE = "true" + COHORT_START_YYYY_MM = "2025-12" + COHORT_TOTAL_BUDGET_USD = "3000" + COHORT_LENGTH_MONTHS = "7" + BUDGET_OVER_DAYS = "2" + + # Slash commands (non-secret) + SLACK_DESTROY_CONFIRM_TOKEN = "CONFIRM" + + # Optional allowlists (comma-separated) + SLACK_ALLOWED_USER_IDS = "" + SLACK_ALLOWED_CHANNEL_IDS = "" + + # Teardown controls + APPLY_CHANGES = "false" + TEARDOWN_SIMULATE = "true" + TEARDOWN_TARGET_IDS = "" + TEARDOWN_ALLOW_ALL = "false" + RDS_FINAL_SNAPSHOT = "false" + + TEARDOWN_MAX_DELETE_COUNT = "5" +} + + diff --git a/infra/test_resource.tf b/infra/test_resource.tf new file mode 100644 index 0000000..0750037 --- /dev/null +++ b/infra/test_resource.tf @@ -0,0 +1,81 @@ +# ------------------------------------------------------------ +# Bloodhound Teardown Validation Resource +# +# This Terraform resource defines a temporary EC2 instance used +# exclusively for validating Bloodhound's teardown pipeline. +# ------------------------------------------------------------ + + +# ------------------------------------------------------------ +# Lookup Latest Amazon Linux 2 AMI +# +# Hardcoding AMI IDs eventually breaks because AWS retires +# images over time. Instead Terraform dynamically retrieves +# the newest Amazon Linux 2 image published by AWS. +# ------------------------------------------------------------ +data "aws_ami" "amazon_linux_2" { + + most_recent = true + + owners = ["amazon"] + + filter { + name = "name" + values = ["amzn2-ami-hvm-*-x86_64-gp2"] + } + +} + + +# ------------------------------------------------------------ +# Lookup available subnets +# +# Some AWS accounts do not have a default subnet automatically +# selected for EC2 launches. This data source retrieves a list +# of subnets so Terraform can attach the validation instance. +# ------------------------------------------------------------ +data "aws_subnets" "default" {} + + +# ------------------------------------------------------------ +# Temporary EC2 instance used for teardown validation +# ------------------------------------------------------------ +resource "aws_instance" "bloodhound_teardown_test" { + + # Create only during validation runs + count = var.enable_validation_resources ? 1 : 0 + + # Instance configuration + ami = data.aws_ami.amazon_linux_2.id + instance_type = "t3.micro" + + # Attach instance to a discovered subnet + subnet_id = data.aws_subnets.default.ids[0] + + # ---------------------------------------------------------- + # Lifecycle rule + # ---------------------------------------------------------- + lifecycle { + create_before_destroy = true + } + + # ---------------------------------------------------------- + # Resource tags + # ---------------------------------------------------------- + tags = { + Name = "bloodhound-teardown-test" + Environment = "validation" + + "bloodhound:test" = "true" + "bloodhound:test_type" = "teardown_validation" + } + +} + + +# ------------------------------------------------------------ +# Terraform Output +# ------------------------------------------------------------ +output "bloodhound_test_instance_id" { + value = try(aws_instance.bloodhound_teardown_test[0].id, null) +} \ No newline at end of file diff --git a/infra/variables.tf b/infra/variables.tf new file mode 100644 index 0000000..5288b09 --- /dev/null +++ b/infra/variables.tf @@ -0,0 +1,150 @@ +/* +infra/variables.tf + +Input variables for the Terraform module. +Keep these minimal; most per-environment config is passed via lambda_env. +*/ + +variable "aws_region" { + type = string + description = "AWS region to deploy the Lambda into." + default = "us-west-2" +} + +variable "aws_profile" { + type = string + description = "Optional AWS CLI profile name for Terraform." + default = null +} + +variable "name_prefix" { + type = string + description = "Prefix for IAM resources." + default = "bloodhound-v2" +} + +variable "lambda_function_name" { + type = string + description = "Name of the Bloodhound v2 Lambda function." + default = "BloodhoundLambdaV2" +} + +variable "lambda_runtime" { + type = string + description = "Lambda runtime." + default = "python3.10" +} + +variable "lambda_timeout_seconds" { + type = number + description = "Lambda timeout in seconds." + default = 120 +} + +variable "lambda_memory_mb" { + type = number + description = "Lambda memory size." + default = 256 +} + +variable "lambda_env" { + type = map(string) + description = "Lambda environment variables (copy from your .env, minus secrets you don't want in TF state)." + default = {} +} + +# ------------------------------------------------------------ +# Optional Docker-based Lambda dependency build. +# +# When enabled, Lambda dependencies are installed inside the +# official AWS Lambda runtime container instead of the +# engineer's local Python environment. +# +# This guarantees compatibility with the Lambda runtime and +# ensures deterministic builds across engineers and CI runs. +# +# Example usage: +# +# terraform apply -var="use_docker_build=true" +# +# Default behavior uses the local Python environment for +# faster builds during development. +# ------------------------------------------------------------ + +variable "use_docker_build" { + type = bool + default = false + description = "Build Lambda dependencies using the AWS Lambda Docker runtime." +} + + +/* +Optional override for the Lambda alias version. + +When null (default), the alias points to the newest published version. + +When set to a specific version number, Terraform will point the +production alias to that version instead. This allows safe rollbacks +without modifying infrastructure code. +*/ +variable "lambda_alias_version_override" { + type = string + default = null + description = "Optional Lambda version to pin the prod alias to for rollback." +} + + +variable "expected_aws_account_id" { + description = "Safety guard: ensure Terraform is running against the correct AWS account." + type = string +} + +/* +Safety override for destructive mode. + +Bloodhound can delete infrastructure when APPLY_CHANGES=true. +To prevent accidental deletion, Terraform blocks deployment +unless this variable is explicitly enabled. + +Example failure: + +APPLY_CHANGES=true +allow_apply_mode=false + +Terraform will stop with an error. + +To intentionally enable destructive mode for testing: + +terraform apply -var allow_apply_mode=true + +Default is false so deletion cannot be enabled accidentally. +*/ +variable "allow_apply_mode" { + description = "Explicit override required to deploy Bloodhound with APPLY_CHANGES=true." + type = bool + default = false +} + +# ------------------------------------------------------------ +# Unique ID used to trace validation runs. +# Passed from validation scripts so AWS resources can be +# associated with a specific validation execution. +# ------------------------------------------------------------ + +variable "validation_run_id" { + description = "Unique validation run identifier" + type = string + default = "manual" +} + +# ------------------------------------------------------------ +# Enables temporary infrastructure used for validation tests. +# This should normally be disabled during regular Terraform +# deployments. +# ------------------------------------------------------------ + +variable "enable_validation_resources" { + description = "Create temporary validation infrastructure" + type = bool + default = false +} \ No newline at end of file diff --git a/logs/validation_history.log b/logs/validation_history.log new file mode 100644 index 0000000..56a5a99 --- /dev/null +++ b/logs/validation_history.log @@ -0,0 +1,15 @@ +20260309_213031 FAIL +20260312_225332 FAIL +20260314_095824 FAIL +20260314_103717 PASS +20260314_105140 PASS +20260314_105737 FAIL +20260314_110435 PASS +20260314_112239 PASS +20260314_112636 PASS +20260314_171204 PASS +20260314_203853 PASS +20260314_214337 PASS +20260314_220557 PASS +20260314_230130 PASS +20260326_205446 PASS diff --git a/output.txt b/output.txt new file mode 100644 index 0000000..bc6f823 --- /dev/null +++ b/output.txt @@ -0,0 +1 @@ +{"errorMessage": "The request to the Slack API failed. (url: https://www.slack.com/api/chat.postMessage)\nThe server responded with: {'ok': False, 'error': 'invalid_auth'}", "errorType": "SlackApiError", "requestId": "8c5f6d13-e264-4dc2-8ba2-ff4ce7c0d6b5", "stackTrace": [" File \"/var/task/handlers/lambda_function.py\", line 26, in lambda_handler\n return run(event=event, context=context)\n", " File \"/var/task/bloodhound/app.py\", line 98, in run\n slack.post_scan(scan_msg)\n", " File \"/var/task/bloodhound/slack.py\", line 30, in post_scan\n self.client.chat_postMessage(channel=self.scan_channel_id, text=text)\n", " File \"/var/task/slack_sdk/web/client.py\", line 2564, in chat_postMessage\n return self.api_call(\"chat.postMessage\", json=kwargs)\n", " File \"/var/task/slack_sdk/web/base_client.py\", line 155, in api_call\n return self._sync_send(api_url=api_url, req_args=req_args)\n", " File \"/var/task/slack_sdk/web/base_client.py\", line 186, in _sync_send\n return self._urllib_api_call(\n", " File \"/var/task/slack_sdk/web/base_client.py\", line 317, in _urllib_api_call\n ).validate()\n", " File \"/var/task/slack_sdk/web/slack_response.py\", line 199, in validate\n raise e.SlackApiError(message=msg, response=self)\n"]} \ No newline at end of file diff --git a/requirements-dev.txt b/requirements-dev.txt new file mode 100644 index 0000000..15ee576 --- /dev/null +++ b/requirements-dev.txt @@ -0,0 +1,9 @@ +boto3==1.34.3 +botocore==1.34.3 +jmespath==1.0.1 +python-dateutil==2.8.2 +python-dotenv==1.0.0 +s3transfer==0.9.0 +six==1.16.0 +slack-sdk==3.26.1 +urllib3==2.0.7 \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 155ad8c..a51b5b8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,9 +1,2 @@ -boto3==1.34.3 -botocore==1.34.3 -jmespath==1.0.1 -python-dateutil==2.8.2 python-dotenv==1.0.0 -s3transfer==0.9.0 -six==1.16.0 slack-sdk==3.26.1 -urllib3==2.1.0 diff --git a/scripts/bootstrap_github_oidc.sh b/scripts/bootstrap_github_oidc.sh new file mode 100755 index 0000000..80f3181 --- /dev/null +++ b/scripts/bootstrap_github_oidc.sh @@ -0,0 +1,365 @@ +#!/usr/bin/env bash + +# ========================================================= +# Bloodhound GitHub OIDC Bootstrap Script +# ========================================================= +# +# PURPOSE +# +# This script bootstraps the AWS infrastructure required +# for GitHub Actions to securely invoke the Bloodhound +# Lambda function using OpenID Connect (OIDC). +# +# Using OIDC eliminates the need to store long-lived AWS +# credentials (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) +# inside GitHub repository secrets. +# +# Instead, GitHub exchanges a short-lived OIDC token with +# AWS STS to assume an IAM role and obtain temporary +# credentials during workflow execution. +# +# +# RESULTING AUTHENTICATION FLOW +# +# GitHub Actions workflow +# ↓ +# GitHub OIDC token +# ↓ +# AWS STS AssumeRoleWithWebIdentity +# ↓ +# BloodhoundGitHubInvokeRole +# ↓ +# Temporary AWS credentials +# ↓ +# Invoke BloodhoundLambdaV2 +# +# +# WHAT THIS SCRIPT CONFIGURES +# +# 1. Ensures the GitHub OIDC provider exists in the AWS account +# 2. Creates or updates the IAM role used by GitHub Actions +# 3. Configures the trust policy for GitHub OIDC +# 4. Attaches permissions allowing the Lambda to be invoked +# 5. Outputs the role ARN for GitHub workflow configuration +# +# +# IMPORTANT DESIGN CHOICE +# +# The trust policy allows: +# +# repo:*/Bloodhound:* +# +# This permits GitHub workflows running from forks of the +# Bloodhound repository to assume the IAM role. +# +# This is necessary because contributors typically run CI +# from their personal forks before opening pull requests +# to the canonical repository: +# +# codeplatoon-devops/Bloodhound +# +# Without this rule, AWS would reject OIDC tokens issued +# from forked repositories because the repository owner +# would not match the organization name. +# +# +# SCRIPT BEHAVIOR +# +# This script is intentionally idempotent: +# +# • Safe to run multiple times +# • Existing infrastructure will not be duplicated +# • IAM trust policy will be updated if the role exists +# +# +# PREREQUISITES +# +# - AWS CLI installed +# - AWS CLI authenticated +# - IAM permissions to create roles and policies +# +# +# VERIFY AWS AUTHENTICATION +# +# aws sts get-caller-identity +# +# +# HOW TO RUN +# +# chmod +x scripts/bootstrap_github_oidc.sh +# ./scripts/bootstrap_github_oidc.sh +# +# +# AFTER RUNNING +# +# Update the GitHub Actions workflow to use: +# +# aws-actions/configure-aws-credentials@v4 +# +# with the role ARN printed by this script. +# +# ========================================================= + + +# --------------------------------------------------------- +# Cleanup temporary IAM policy artifacts +# +# The AWS CLI requires policy documents to be supplied as +# files when creating IAM roles and attaching policies. +# +# This script dynamically generates the following files: +# trust-policy.json +# lambda-policy.json +# +# These files are temporary artifacts and should never be +# committed to the repository. +# +# The EXIT trap ensures they are automatically removed when +# the script finishes, regardless of whether execution +# succeeds, fails, or is interrupted. +# --------------------------------------------------------- +trap "rm -f trust-policy.json lambda-policy.json" EXIT + +set -euo pipefail + +# Disable AWS CLI pager so scripts never hang +export AWS_PAGER="" + + +# --------------------------------------------------------- +# Configuration +# +# These values define the AWS and GitHub environment +# this bootstrap script will configure. +# +# The AWS account ID is automatically detected using STS +# so the script can run safely in any AWS account without +# requiring manual configuration. +# +# NOTE: +# We use the canonical repository owner (Code Platoon org) +# instead of a personal fork so the role remains valid +# when CI runs from the upstream repository. +# --------------------------------------------------------- + +# Detect AWS account automatically +ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + +AWS_REGION="us-west-2" + +# Canonical repository (not personal fork) +GITHUB_ORG="codeplatoon-devops" +GITHUB_REPO="Bloodhound" + +LAMBDA_NAME="BloodhoundLambdaV2" + +ROLE_NAME="BloodhoundGitHubInvokeRole" + + +# GitHub OIDC provider information +OIDC_PROVIDER_URL="https://token.actions.githubusercontent.com" +OIDC_PROVIDER_ARN="arn:aws:iam::$ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com" + + +echo "=======================================" +echo "Bootstrapping GitHub OIDC for Bloodhound" +echo "Account: $ACCOUNT_ID" +echo "Repository: $GITHUB_ORG/$GITHUB_REPO" +echo "=======================================" + + +# --------------------------------------------------------- +# 1. Check if the GitHub OIDC provider already exists +# --------------------------------------------------------- + +echo "" +echo "Checking for existing GitHub OIDC provider..." + +EXISTING_PROVIDER=$(aws iam list-open-id-connect-providers \ + --query "OpenIDConnectProviderList[?contains(Arn, 'token.actions.githubusercontent.com')].Arn" \ + --output text) + +if [[ -z "$EXISTING_PROVIDER" ]]; then + echo "OIDC provider not found. Creating..." + + aws iam create-open-id-connect-provider \ + --url $OIDC_PROVIDER_URL \ + --client-id-list sts.amazonaws.com \ + --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1 + + echo "OIDC provider created." + +else + echo "OIDC provider already exists." +fi + + +# --------------------------------------------------------- +# 2. Generate GitHub OIDC trust policy +# +# GitHub OIDC Trust Policy (Strict Repo Control) +# +# This IAM role allows GitHub Actions workflows to assume +# the role using OIDC (sts:AssumeRoleWithWebIdentity). +# +# SECURITY MODEL +# +# Access is restricted to explicitly listed repositories +# instead of allowing all repositories named "Bloodhound". +# +# Currently allowed repositories: +# +# • codeplatoon-devops/Bloodhound +# • mmccla1n/Bloodhound +# +# Branch restrictions: +# +# • The upstream repository is restricted to the main branch +# • The maintainer fork allows all branches for development +# +# CONTRIBUTOR NOTE +# +# If another contributor wants to run GitHub Actions from +# their fork of the repository, their fork must be added +# to the "sub" condition below using the format: +# +# repo:/Bloodhound:ref:refs/heads/* +# +# Example: +# +# repo:janedoe/Bloodhound:ref:refs/heads/* +# +# This keeps the role secure while still allowing approved +# forks to run CI workflows. +# --------------------------------------------------------- + +echo "" +echo "Creating trust policy..." + +cat < trust-policy.json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Federated": "$OIDC_PROVIDER_ARN" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" + }, + "StringLike": { + "token.actions.githubusercontent.com:sub": [ + "repo:codeplatoon-devops/Bloodhound:ref:refs/heads/main", + "repo:mmccla1n/Bloodhound:ref:refs/heads/*" + ] + } + } + } + ] +} +EOF + + +# --------------------------------------------------------- +# 3. Create or update IAM role for GitHub Actions +# +# If the role already exists, the trust policy is updated +# to ensure it reflects the current repository policy. +# --------------------------------------------------------- + +echo "" +echo "Creating IAM role: $ROLE_NAME" + +if aws iam get-role --role-name $ROLE_NAME > /dev/null 2>&1; then + echo "Role already exists. Updating trust policy..." + + aws iam update-assume-role-policy \ + --role-name $ROLE_NAME \ + --policy-document file://trust-policy.json + +else + + aws iam create-role \ + --role-name $ROLE_NAME \ + --assume-role-policy-document file://trust-policy.json \ + --tags \ + Key=Project,Value=Bloodhound \ + Key=Owner,Value=CodePlatoon-DevOps \ + Key=ManagedBy,Value=GitHubActions \ + Key=Component,Value=CI-Infrastructure + + echo "Role created." + +fi + + +# --------------------------------------------------------- +# 4. Configure IAM permissions for Lambda invocation +# +# The role requires permission to invoke the Bloodhound +# Lambda function and optionally read its CloudWatch logs +# for debugging CI failures. +# --------------------------------------------------------- + +echo "" +echo "Creating Lambda invoke policy..." + +cat < lambda-policy.json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "InvokeBloodhoundLambda", + "Effect": "Allow", + "Action": [ + "lambda:InvokeFunction", + "lambda:GetFunction", + "lambda:GetFunctionConfiguration", + "lambda:GetFunctionUrlConfig" + ], + "Resource": "arn:aws:lambda:$AWS_REGION:$ACCOUNT_ID:function:$LAMBDA_NAME" + }, + { + "Sid": "ReadLambdaLogs", + "Effect": "Allow", + "Action": [ + "logs:DescribeLogGroups", + "logs:DescribeLogStreams", + "logs:GetLogEvents" + ], + "Resource": "*" + } + ] +} +EOF + + +aws iam put-role-policy \ + --role-name $ROLE_NAME \ + --policy-name BloodhoundInvokePolicy \ + --policy-document file://lambda-policy.json + +echo "Policy attached." + + +# --------------------------------------------------------- +# 5. Output IAM role ARN for GitHub workflow configuration +# +# This ARN must be referenced in the GitHub Actions +# workflow using the configure-aws-credentials action. +# --------------------------------------------------------- + +ROLE_ARN="arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME" + +echo "" +echo "=======================================" +echo "Bootstrap complete." +echo "" +echo "Use this role in your GitHub workflow:" +echo "" +echo "$ROLE_ARN" +echo "" +echo "=======================================" \ No newline at end of file diff --git a/scripts/build_lambda.sh b/scripts/build_lambda.sh new file mode 100755 index 0000000..bdf86c0 --- /dev/null +++ b/scripts/build_lambda.sh @@ -0,0 +1,193 @@ +#!/usr/bin/env bash +set -euo pipefail + +: <<'DOC' +scripts/build_lambda.sh + +Builds the Bloodhound Lambda deployment package. + +This script prepares the directory: + + .build/lambda_pkg + +Terraform then archives that directory into: + + .build/bloodhound_lambda_v2.zip + +using the archive_file provider. + +--------------------------------------------------------------------- + +Build modes + +Docker build (default) + Installs dependencies using the official AWS Lambda runtime + container to guarantee compatibility with the Lambda environment. + +Local build + Installs dependencies using your local Python environment. + This is faster but may produce incompatible binaries. + +--------------------------------------------------------------------- + +Usage + +Show help + + ./scripts/build_lambda.sh -h + +Docker build (default) + + ./scripts/build_lambda.sh + +Force Docker build + + ./scripts/build_lambda.sh --docker + +Force local build + + ./scripts/build_lambda.sh --local + +--------------------------------------------------------------------- + +Required tools + +Docker mode: + docker + +Local mode: + python3 + pip + rsync +DOC + + +# ------------------------------------------------------------ +# Help helper +# ------------------------------------------------------------ + +show_help() { + sed -n '/^DOC$/,/^DOC$/p' "$0" | sed '1d;$d' + exit 0 +} + + +# ------------------------------------------------------------ +# Parse arguments +# ------------------------------------------------------------ + +BUILD_MODE="docker" + +while [[ $# -gt 0 ]]; do + case "$1" in + -h|--help) + show_help + ;; + --docker) + BUILD_MODE="docker" + shift + ;; + --local) + BUILD_MODE="local" + shift + ;; + *) + echo "Unknown option: $1" + echo "Run with -h for usage." + exit 1 + ;; + esac +done + +echo +echo "---------------------------------------------" +echo "Lambda build mode: $BUILD_MODE" +echo "---------------------------------------------" + + +# ------------------------------------------------------------ +# Step 1 — Prepare clean build directory +# +# Lambda packages must be deterministic. We remove any +# previous build artifacts to prevent stale dependencies +# or leftover files from entering the deployment package. +# ------------------------------------------------------------ + +echo +echo "Preparing Lambda build directories..." + +BUILD_DIR=".build" +PKG_DIR="$BUILD_DIR/lambda_pkg" + +rm -rf "$BUILD_DIR" +mkdir -p "$PKG_DIR" + + +# ------------------------------------------------------------ +# Step 2 — Install runtime dependencies +# +# Dependencies from requirements.txt are installed directly +# into the Lambda package directory so they are included in +# the final deployment package. +# ------------------------------------------------------------ + +echo +echo "Installing dependencies..." + +if [[ "$BUILD_MODE" == "docker" ]]; then + + echo "Using Docker Lambda runtime (Amazon Linux)" + + docker run --rm \ + -v "$PWD":/var/task \ + public.ecr.aws/sam/build-python3.10 \ + pip install --upgrade --no-cache-dir -r requirements.txt -t .build/lambda_pkg + +else + + echo "Using local Python environment" + + python3 -m pip install --upgrade --no-cache-dir -r requirements.txt -t .build/lambda_pkg + +fi + + +# ------------------------------------------------------------ +# Step 3 — Copy application source code +# +# The Lambda package must include the Bloodhound application +# modules and the Lambda handler entrypoint. +# rsync preserves directory structure and includes new modules. +# ------------------------------------------------------------ + +echo +echo "Copying application source..." + +# Engineer note: +# rsync preserves directory structure and ensures new modules +# such as bloodhound/aws.py or scanner/ are included automatically. + +rsync -a --exclude "__pycache__" --exclude "*.pyc" bloodhound/ .build/lambda_pkg/bloodhound/ + +rsync -a --exclude "__pycache__" --exclude "*.pyc" handlers/ .build/lambda_pkg/handlers/ + + +# ------------------------------------------------------------ +# Step 4 — Debug visibility +# +# Display the final Lambda package contents to confirm the +# correct files are included. +# Useful when diagnosing import or packaging issues. +# ------------------------------------------------------------ + +echo +echo "Prepared package dir: .build/lambda_pkg" +echo "Lambda package contents:" +ls -R .build/lambda_pkg + +echo +echo "Package size:" +du -sh .build/lambda_pkg + +echo +echo "Lambda package build complete." \ No newline at end of file diff --git a/test_event.json b/test_event.json deleted file mode 100644 index 9e26dfe..0000000 --- a/test_event.json +++ /dev/null @@ -1 +0,0 @@ -{} \ No newline at end of file diff --git a/tools/run_local.py b/tools/run_local.py new file mode 100644 index 0000000..92153ff --- /dev/null +++ b/tools/run_local.py @@ -0,0 +1,41 @@ +""" +tools/run_local.py + +Local runner for Bloodhound v2. + +Writes a markdown report under `reports/` and prints sections to stdout. +Set SLACK_ENABLED=true in .env to also post to Slack. +""" + +from __future__ import annotations + +import json +import os +import sys + +from bloodhound.app import run + + +def main() -> int: + # Default local run: dry-run, stdout only. + os.environ.setdefault("APPLY_CHANGES", "false") + os.environ.setdefault("TEARDOWN_SIMULATE", "true") + os.environ.setdefault("TEARDOWN_ALLOW_ALL", "false") + os.environ.setdefault("SLACK_ENABLED", "false") + os.environ.setdefault("BLOODHOUND_PRINT_REPORTS", "true") + os.environ.setdefault("BLOODHOUND_REPORT_FORMAT", "markdown") + os.environ.setdefault("BLOODHOUND_REPORT_DIR", "reports") + + mode = (sys.argv[1] if len(sys.argv) > 1 else "seek").strip() + event: dict = {} + if mode in {"seek", "seek_cost", "whitelist", "seek_destroy"}: + event = {"source": "slack_command", "mode": mode} + + result = run(event=event, context=None) + print("\n=== JSON summary ===") + print(json.dumps(result, indent=2, sort_keys=True)) + return 0 if result.get("ok") else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/run_validation_workflow.sh b/tools/run_validation_workflow.sh new file mode 100755 index 0000000..4226b49 --- /dev/null +++ b/tools/run_validation_workflow.sh @@ -0,0 +1,103 @@ +#!/usr/bin/env bash + +# ------------------------------------------------------------ +# Bloodhound Validation Workflow Runner +# +# This script orchestrates the full validation workflow. +# +# It runs validation tools in the correct order: +# +# 1. Infrastructure smoke test +# 2. Controlled teardown validation +# +# If the smoke test fails, the workflow stops immediately. +# +# Usage: +# +# ./tools/run_validation_workflow.sh +# +# ------------------------------------------------------------ + +set -euo pipefail # exit immediately if any command fails + +# ------------------------------------------------------------ +# Disable AWS CLI pager +# +# AWS CLI v2 automatically sends long output to a pager +# (usually "less"), which pauses scripts and displays "(END)" +# until the user presses 'q'. +# +# Automation scripts should disable this behavior so output +# prints directly to the terminal. +# ------------------------------------------------------------ +export AWS_PAGER="" + +# ------------------------------------------------------------ +# Validation Run Identifier +# ------------------------------------------------------------ + +RUN_ID=$(date +"%Y%m%d_%H%M%S") + +# ------------------------------------------------------------ +# Workflow Logging +# ------------------------------------------------------------ + +LOG_DIR="logs/validation" +mkdir -p "$LOG_DIR" + +LOG_FILE="$LOG_DIR/workflow_validation_${RUN_ID}.log" + +# send all output to terminal AND log +exec > >(tee -a "$LOG_FILE") 2>&1 + + +echo "" +echo "================================================" +echo "Bloodhound Validation Workflow" +echo "================================================" +echo "" + +# ------------------------------------------------------------ +# Step 1 — Run infrastructure smoke test +# ------------------------------------------------------------ + +echo "Step 1: Running Lambda smoke test..." +echo "" + +./tools/smoke_test_lambda.sh + +echo "" +echo "Smoke test passed." +echo "" + +# ------------------------------------------------------------ +# Step 2 — Run controlled teardown validation +# ------------------------------------------------------------ + +echo "Step 2: Starting controlled teardown validation..." +echo "" + +echo "Validation Run ID: $RUN_ID" + +./tools/validate_teardown.sh "$RUN_ID" + +echo "" +echo "================================================" +echo "Validation workflow completed successfully." +echo "================================================" +echo "" + +# ------------------------------------------------------------------ +# Workflow Log Retention +# +# Keep only the 3 most recent workflow validation logs. +# Older logs are removed automatically to prevent the +# validation directory from growing indefinitely. +# +# Detailed teardown logs have their own retention policy +# inside validate_teardown.sh. +# ------------------------------------------------------------------ + +echo "Keeping only the 3 most recent workflow logs." + +ls -1t "$LOG_DIR"/workflow_validation_* 2>/dev/null | tail -n +4 | xargs -r rm \ No newline at end of file diff --git a/tools/show_validation_history.sh b/tools/show_validation_history.sh new file mode 100755 index 0000000..48a284b --- /dev/null +++ b/tools/show_validation_history.sh @@ -0,0 +1,25 @@ +#!/usr/bin/env bash + +# ------------------------------------------------------------ +# Bloodhound Validation History +# +# Displays the full validation history stored in: +# +# logs/validation_history.log +# ------------------------------------------------------------ + +HISTORY_FILE="logs/validation_history.log" + +echo "" +echo "Bloodhound Validation History" +echo "-----------------------------" +echo "" + +if [ ! -f "$HISTORY_FILE" ]; then + echo "No validation history found." + exit 0 +fi + +cat "$HISTORY_FILE" + +echo "" \ No newline at end of file diff --git a/tools/smoke_test_lambda.sh b/tools/smoke_test_lambda.sh new file mode 100755 index 0000000..b30c0c7 --- /dev/null +++ b/tools/smoke_test_lambda.sh @@ -0,0 +1,272 @@ +#!/usr/bin/env bash + +# ------------------------------------------------------------ +# Bloodhound Lambda Smoke Test +# +# Purpose +# ------- +# Quickly verify that the Bloodhound Lambda deployment is healthy. +# +# This script detects common deployment problems such as: +# +# - wrong AWS region +# - Lambda function not deployed +# - missing or incorrect environment variables +# - CloudWatch log group missing +# - Lambda Function URL not configured +# +# It also validates that critical Lambda environment variables +# match the local `.env` configuration. This helps detect cases +# where Terraform changes were not applied. +# +# This script is intended to be run immediately after: +# +# terraform apply +# +# It should complete in a few seconds and detect most +# infrastructure deployment issues. +# ------------------------------------------------------------ + +set -euo pipefail # Exit on error, treat unset variables as errors, and fail on pipeline errors + +MODE="${MODE:-}" + +if [ -z "$MODE" ]; then + if [ "${CI:-}" = "true" ]; then + MODE="ci" + else + MODE="local" + fi +fi + +# ------------------------------------------------------------ +# Disable AWS CLI pager +# +# AWS CLI v2 automatically sends long output to a pager +# (usually "less"), which pauses scripts and displays "(END)" +# until the user presses 'q'. +# +# Automation scripts should disable this behavior so output +# prints directly to the terminal. +# ------------------------------------------------------------ +export AWS_PAGER="" + +# ------------------------------------------------------------ +# Dependency check +# +# The script uses jq to parse JSON returned by AWS CLI. +# ------------------------------------------------------------ +command -v jq >/dev/null 2>&1 || { + echo "ERROR: jq is required but not installed." + exit 1 +} + +# ------------------------------------------------------------ +# Configuration +# +# These values should match your Terraform deployment. +# ------------------------------------------------------------ +REGION="us-west-2" +FUNCTION_NAME="BloodhoundLambdaV2" +LOG_GROUP="/aws/lambda/BloodhoundLambdaV2" + +echo "" +echo "--------------------------------------" +echo "Bloodhound Lambda Smoke Test" +echo "--------------------------------------" +echo "" + +# ------------------------------------------------------------ +# Step 1 — Verify Lambda function exists +# +# If this fails, Terraform deployment likely failed. +# ------------------------------------------------------------ +echo "Checking Lambda existence..." + +aws lambda get-function \ + --function-name "$FUNCTION_NAME" \ + --region "$REGION" >/dev/null + +echo "✓ Lambda function exists" + +# ------------------------------------------------------------ +# Step 2 — Retrieve Lambda environment variables +# +# These variables are injected by Terraform during deployment. +# ------------------------------------------------------------ +echo "" +echo "Fetching Lambda environment variables..." + +LAMBDA_ENV=$(aws lambda get-function-configuration \ + --function-name "$FUNCTION_NAME" \ + --region "$REGION" \ + --query 'Environment.Variables' \ + --output json) + +echo "✓ Retrieved Lambda environment variables" + +# ------------------------------------------------------------ +# Step 3 — Validate Lambda environment variables +# +# LOCAL MODE +# Compare deployed Lambda variables against local .env +# +# CI MODE (GitHub Actions) +# Verify required variables exist in Lambda +# +# GitHub automatically sets: +# CI=true +# ------------------------------------------------------------ +echo "" +echo "Validating critical environment variables..." + +# ------------------------------------------------------------ +# Determine execution mode +# ------------------------------------------------------------ +if [ "${CI:-}" = "true" ]; then + MODE="ci" +else + MODE="local" +fi + + +# ------------------------------------------------------------ +# LOCAL MODE VALIDATION +# +# Compare deployed Lambda variables against local .env +# ------------------------------------------------------------ +check_env_match () { + + VAR_NAME=$1 + + EXPECTED=${!VAR_NAME} + + ACTUAL=$(echo "$LAMBDA_ENV" | jq -r ".${VAR_NAME}") + + if [ "$EXPECTED" != "$ACTUAL" ]; then + + echo "" + echo "ERROR: Environment variable mismatch" + echo "Variable: $VAR_NAME" + echo "Expected: $EXPECTED" + echo "Actual: $ACTUAL" + echo "" + echo "Terraform deployment may be out of sync." + echo "Run: terraform apply" + exit 1 + + fi +} + + +# ------------------------------------------------------------ +# CI MODE VALIDATION +# +# Ensure required variables exist in Lambda +# ------------------------------------------------------------ +check_env_exists () { + + VAR_NAME=$1 + + ACTUAL=$(echo "$LAMBDA_ENV" | jq -r ".${VAR_NAME}") + + if [ "$ACTUAL" = "null" ] || [ -z "$ACTUAL" ]; then + + echo "" + echo "ERROR: Lambda environment variable missing" + echo "Variable: $VAR_NAME" + echo "" + exit 1 + + fi +} + + +# ------------------------------------------------------------ +# Execute validation +# ------------------------------------------------------------ +if [ "$MODE" = "local" ]; then + + echo "Local mode detected — validating against .env" + + source .env + + check_env_match APPLY_CHANGES + check_env_match TEARDOWN_SIMULATE + check_env_match SLACK_SCAN_CHANNEL_ID + check_env_match SLACK_ALERT_CHANNEL_ID + +else + + echo "CI mode detected — verifying variables exist in Lambda" + + check_env_exists APPLY_CHANGES + check_env_exists TEARDOWN_SIMULATE + check_env_exists SLACK_SCAN_CHANNEL_ID + check_env_exists SLACK_ALERT_CHANNEL_ID + +fi + +echo "✓ Environment variable validation passed" + +# ------------------------------------------------------------ +# Step 4 — Display deployed Lambda environment variables +# +# Local mode prints the full environment variables directly +# from AWS for developer inspection. +# +# CI mode skips printing the variables in GitHub Actions logs. +# ------------------------------------------------------------ +echo "" + +if [ "$MODE" = "ci" ]; then + + echo "CI mode detected — skipping environment variable display" + +else + + echo "Deployed Lambda environment variables:" + + aws lambda get-function-configuration \ + --function-name "$FUNCTION_NAME" \ + --region "$REGION" \ + --query 'Environment.Variables' + +fi + +echo "" +echo "✓ Environment variables retrieved" + +# ------------------------------------------------------------ +# Step 5 — Verify CloudWatch log group exists +# +# Lambda automatically creates this on first execution. +# ------------------------------------------------------------ +echo "" +echo "Checking CloudWatch log group..." + +aws logs describe-log-groups \ + --log-group-name-prefix "$LOG_GROUP" \ + --region "$REGION" >/dev/null + +echo "✓ Log group exists" + +# ------------------------------------------------------------ +# Step 6 — Verify Lambda Function URL +# +# Slack slash commands depend on this endpoint. +# ------------------------------------------------------------ +echo "" +echo "Checking Lambda Function URL..." + +aws lambda get-function-url-config \ + --function-name "$FUNCTION_NAME" \ + --region "$REGION" >/dev/null + +echo "✓ Function URL configured" + +echo "" +echo "--------------------------------------" +echo "Smoke test completed successfully" +echo "--------------------------------------" +echo "" \ No newline at end of file diff --git a/tools/test_event.json b/tools/test_event.json new file mode 100644 index 0000000..5cf32ec --- /dev/null +++ b/tools/test_event.json @@ -0,0 +1,3 @@ +{} + + diff --git a/tools/trust-policy.json b/tools/trust-policy.json new file mode 100644 index 0000000..27875d5 --- /dev/null +++ b/tools/trust-policy.json @@ -0,0 +1,14 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] +} + + diff --git a/tools/validate_teardown.sh b/tools/validate_teardown.sh new file mode 100755 index 0000000..cd84348 --- /dev/null +++ b/tools/validate_teardown.sh @@ -0,0 +1,680 @@ +#!/usr/bin/env bash + +# ------------------------------------------------------------------ +# Bloodhound Controlled Teardown Validation Script +# +# Purpose +# ------- +# This script validates the full Bloodhound teardown pipeline. +# +# It verifies that Bloodhound can: +# 1. Detect an AWS resource during a scan +# 2. Include the resource in the teardown plan +# 3. Execute the deletion successfully +# +# Validation Workflow +# ------------------- +# 1. Terraform creates a temporary EC2 instance +# 2. Engineer runs `/v2_seek` in Slack to confirm detection +# 3. Engineer runs `/v2_seek_destroy CONFIRM` +# 4. Bloodhound deletes the instance +# 5. Script verifies the instance no longer exists +# +# All validation runs produce: +# +# • a detailed run log (logs/validation/) +# • a history record (logs/validation_history.log) +# +# Documentation reference: +# docs/validate_teardown.md +# ------------------------------------------------------------------ + +# ------------------------------------------------------------------ +# Ensure script is executed from repository root +# +# This prevents path issues when referencing directories like: +# logs/ +# infra/ +# tools/ +# +# always run validation via: +# +# ./tools/run_validation_workflow.sh +# ------------------------------------------------------------------ +if [ ! -d "tools" ] || [ ! -d "infra" ]; then + echo "ERROR: run this script from the repository root." + echo "Example:" + echo " ./tools/run_validation_workflow.sh" + exit 1 +fi + +# Stop the script immediately if any command fails +set -euo pipefail + +# ensures failures message in CI logs. +trap 'echo "Validation script failed"; exit 1' ERR + +# ------------------------------------------------------------------ +# Validation Mode Configuration +# +# Default behavior: +# automated validation (CI/CD safe) +# +# Optional: +# --manual enables Slack confirmation steps so engineers can +# visually verify the scan and teardown plan. +# +# Examples: +# +# ./tools/run_validation_workflow.sh +# ./tools/run_validation_workflow.sh --manual +# ------------------------------------------------------------------ + +MANUAL_MODE=false + +if [ "$1" == "--manual" ]; then + MANUAL_MODE=true +fi + +# ------------------------------------------------------------------ +# Disable AWS CLI Pager +# +# Some AWS CLI commands automatically open output in a pager +# (usually "less"), which pauses script execution and displays +# an "(END)" prompt until the user exits manually. +# +# +# Setting AWS_PAGER="" disables the pager so AWS CLI commands +# print directly to stdout instead of launching an interactive +# viewer. +# ------------------------------------------------------------------ +export AWS_PAGER="" + +# ------------------------------------------------------------------ +# Load environment variables +# +# This loads the .env file so validation scripts can access +# configuration values such as EXPECTED_AWS_ACCOUNT_ID. +# ------------------------------------------------------------------ + +if [ -f ".env" ]; then + source .env +fi + +# CI fallback values +APPLY_CHANGES="${APPLY_CHANGES:-false}" +TEARDOWN_SIMULATE="${TEARDOWN_SIMULATE:-true}" +TEARDOWN_MAX_DELETE_COUNT="${TEARDOWN_MAX_DELETE_COUNT:-5}" + +# -------------------------------------------------- +# CI fallback for account validation +# In CI, .env is not available. Use AWS STS to determine +# the current account ID from the authenticated AWS credentials. +# -------------------------------------------------- +EXPECTED_AWS_ACCOUNT_ID="${EXPECTED_AWS_ACCOUNT_ID:-$(aws sts get-caller-identity \ + --query Account \ + --output text)}" + +# ------------------------------------------------------------------ +# AWS Account Safety Guard +# +# Prevents validation tests from running in the wrong AWS account. +# ------------------------------------------------------------------ + +CURRENT_ACCOUNT_ID=$(aws sts get-caller-identity \ + --query Account \ + --output text) + +if [ "$CURRENT_ACCOUNT_ID" != "$EXPECTED_AWS_ACCOUNT_ID" ]; then + echo "" + echo "ERROR: Wrong AWS account detected." + echo "" + echo "Expected: $EXPECTED_AWS_ACCOUNT_ID" + echo "Actual: $CURRENT_ACCOUNT_ID" + echo "" + echo "Refusing to run teardown validation." + echo "" + exit 1 +fi + + +# ------------------------------------------------------------------ +# Configuration Consistency Check +# +# APPLY_CHANGES and TEARDOWN_SIMULATE must not both be true. +# This configuration is contradictory and indicates a misconfigured +# environment. +# +# If APPLY_CHANGES=true → real deletions should occur. +# If TEARDOWN_SIMULATE=true → no deletions should occur. +# ------------------------------------------------------------------ + +if [ "$APPLY_CHANGES" = "true" ] && [ "$TEARDOWN_SIMULATE" = "true" ]; then + echo "" + echo "ERROR: Invalid teardown configuration." + echo "" + echo "APPLY_CHANGES=true" + echo "TEARDOWN_SIMULATE=true" + echo "" + echo "Both modes cannot be enabled simultaneously." + echo "Fix the configuration in your .env file." + echo "" + exit 1 +fi + +# ------------------------------------------------------------------ +# Validation Run Identifier +# +# Each validation run receives a unique ID. This ID is used to: +# - name the validation log file +# - track validation activity +# ------------------------------------------------------------------ + +RUN_ID=$1 + +if [ -z "$RUN_ID" ]; then + RUN_ID=$(date +"%Y%m%d_%H%M%S") +fi + + +# ------------------------------------------------------------------ +# Validation Logging Setup +# +# logs/validation/ → detailed logs for individual runs +# logs/validation_history.log → append-only validation history +# ------------------------------------------------------------------ +LOG_DIR="logs/validation" +HISTORY_FILE="logs/validation_history.log" + +mkdir -p "$LOG_DIR" +touch "$HISTORY_FILE" + +LOG_FILE="$LOG_DIR/teardown_validation_${RUN_ID}.log" + +# ------------------------------------------------------------------ +# Logging helper +# +# Writes messages to both: +# • terminal output +# • validation log file +# +# This allows engineers to see progress live while preserving +# a full execution record for debugging. +# ------------------------------------------------------------------ +log() { + echo "$1" | tee -a "$LOG_FILE" +} + +log "Validation Run ID: $RUN_ID" + + +# ------------------------------------------------------------------ +# AWS Environment Configuration +# ------------------------------------------------------------------ + +LOG_GROUP="/aws/lambda/BloodhoundLambdaV2" +REGION="us-west-2" + + +# ------------------------------------------------------------------ +# Optional: Stream Lambda Logs +# +# Engineers can open another terminal to watch the Lambda execution +# in real time while the validation test runs. +# ------------------------------------------------------------------ + +echo "" +echo "Optional: stream Lambda logs during validation." +echo "Open a second terminal and run:" +echo "" +echo "aws logs tail $LOG_GROUP --region $REGION --follow" +echo "" + + +echo "----------------------------------------" +echo "Bloodhound Controlled Teardown Validation" +echo "----------------------------------------" + + +# ------------------------------------------------------------------ +# Step 1 — Create Disposable EC2 Instance +# +# Terraform creates the temporary validation resource defined in: +# +# infra/test_resource.tf +# +# This instance exists only for validation and is tagged so +# for easily identification in the AWS console. +# ------------------------------------------------------------------ + +echo "" +log "Step 1: Creating disposable EC2 instance" +echo "" + +# Initialize Terraform (required for CI environments) +terraform -chdir=infra init -input=false + +terraform -chdir=infra apply \ + -var "validation_run_id=$RUN_ID" \ + -var "enable_validation_resources=true" \ + -auto-approve + + +# ------------------------------------------------------------------ +# Step 2 — Capture Instance ID +# +# Terraform outputs the instance ID which is used later to verify +# the deletion occurred successfully. +# ------------------------------------------------------------------ + +echo "" +echo "Capturing instance ID from Terraform output..." +echo "" + +INSTANCE_ID=$(terraform -chdir=infra output -raw bloodhound_test_instance_id) + +# ------------------------------------------------------------------ +# Safety Guard — Ensure Terraform returned a valid instance ID +# +# If INSTANCE_ID is empty, something failed during Terraform +# provisioning and the validation workflow must stop immediately. +# ------------------------------------------------------------------ + +if [ -z "$INSTANCE_ID" ]; then + echo "" + echo "ERROR: Terraform did not return a valid instance ID." + echo "Validation cannot continue." + exit 1 +fi + +echo "Instance created:" +echo "$INSTANCE_ID" + + +# ------------------------------------------------------------------ +# Allow time for AWS APIs to propagate the new instance +# ------------------------------------------------------------------ + +echo "" +echo "Waiting for instance to become visible to AWS APIs..." +sleep 10 + + +# ------------------------------------------------------------------ +# Step 3 — Slack Scan Validation +# +# Engineer manually runs the Slack command /v2_seek to confirm the +# instance appears in the scan results. + + +echo "" +echo "----------------------------------------" +log "Scan Confirmation Step" +echo "----------------------------------------" +echo "" + +# ------------------------------------------------------------------ +# Manual verification mode +# +# Engineers can observe the scan results via Slack before +# continuing the validation workflow. +# ------------------------------------------------------------------ + +if [ "$MANUAL_MODE" = true ]; then + + echo "Run this command in Slack:" + echo "" + echo " /v2_seek" + echo "" + echo "Confirm the EC2 instance appears in the scan results." + echo "" + + read -p "Press ENTER once /v2_seek has confirmed detection..." + +else + + echo "Skipping Slack scan confirmation (automated validation mode)." + +fi + + +# ------------------------------------------------------------------ +# Deletion Safety Guard +# +# Prevents the validation workflow from proceeding if the teardown +# candidate set exceeds the configured safety limit. +# +# This protects against: +# - scanning bugs +# - unexpected AWS API responses +# - misconfigured filters +# +# The limit is defined in the .env file: +# TEARDOWN_MAX_DELETE_COUNT +# ------------------------------------------------------------------ + +EXPECTED_DELETE_COUNT=1 + +if [ "$EXPECTED_DELETE_COUNT" -gt "$TEARDOWN_MAX_DELETE_COUNT" ]; then + echo "" + echo "ERROR: Deletion safety limit exceeded." + echo "" + echo "Expected deletions: $EXPECTED_DELETE_COUNT" + echo "Maximum allowed: $TEARDOWN_MAX_DELETE_COUNT" + echo "" + echo "Validation aborted." + echo "" + exit 1 +fi + + +# ------------------------------------------------------------------ +# Step 4 — Execute Teardown +# +# Engineer manually runs the Slack command that triggers deletion. +# ------------------------------------------------------------------ + +echo "" +echo "----------------------------------------" +log "Triggering Bloodhound Validation Teardown" +echo "----------------------------------------" +echo "" + +# ------------------------------------------------------------------ +# Automated validation teardown +# +# Instead of requiring a Slack command, the validation script +# directly invokes the Lambda function with a validation payload. +# +# This ensures CI/CD pipelines can run validation automatically. +# ------------------------------------------------------------------ +# --------------------------------------------------------------- +# --------------------------------------------------------------- +# Build validation payload +# +# The payload is written to /tmp so the repository directory +# is not polluted with temporary files during validation runs. +# +# /tmp is safe for this purpose because: +# +# • files are automatically cleared by the OS eventually +# • the file only needs to exist during this script run +# • it avoids shell quoting issues with inline JSON +# --------------------------------------------------------------- + +PAYLOAD_FILE="/tmp/bloodhound_validation_payload.json" + +cat > "$PAYLOAD_FILE" </dev/null || { + echo "" + echo "ERROR: Lambda returned failure response." + echo "" + echo "Full Lambda response:" + cat "$RESULT_FILE" + echo "" + exit 1 +} + +echo "" +echo "Validating Lambda teardown execution metrics..." + +# --------------------------------------------------------------- +# Expected Lambda response structure +# +# The Lambda teardown response contains execution statistics +# describing what actions were attempted and whether any failed. +# +# Example expected response fragment: +# +# { +# "teardown": { +# "execution": { +# "attempted": 1, +# "succeeded": 1, +# "failed": 0 +# } +# } +# } +# +# What this script validates: +# +# failed == 0 → no teardown errors occurred +# succeeded >= 1 → at least one resource was deleted +# +# If either condition is not met, validation fails immediately. +# --------------------------------------------------------------- + + +# Extract execution metrics from the Lambda response JSON +ATTEMPTED=$(jq '.teardown.execution.attempted // 0' "$RESULT_FILE") +SUCCEEDED=$(jq '.teardown.execution.succeeded // 0' "$RESULT_FILE") +FAILED=$(jq '.teardown.execution.failed // 0' "$RESULT_FILE") + +# Ensure values are numeric +if ! [[ "$FAILED" =~ ^[0-9]+$ ]]; then + echo "ERROR: Invalid Lambda response format." + cat "$RESULT_FILE" + exit 1 +fi + + +# Display the extracted metrics for visibility in logs +echo "Execution metrics:" +echo " attempted: $ATTEMPTED" +echo " succeeded: $SUCCEEDED" +echo " failed: $FAILED" + + +# --------------------------------------------------------------- +# Fail immediately if Lambda reported teardown errors +# --------------------------------------------------------------- + +if [ "$FAILED" -ne 0 ]; then + echo "" + echo "ERROR: Lambda reported teardown failures." + exit 1 +fi + + +# --------------------------------------------------------------- +# Ensure at least one resource was successfully deleted +# --------------------------------------------------------------- + +if [ "$SUCCEEDED" -lt 1 ]; then + echo "" + echo "ERROR: Lambda did not execute any teardown actions." + exit 1 +fi + + +echo "Lambda execution metrics validated successfully." + +# ------------------------------------------------------------------ +# Optional Slack verification (manual mode) +# +# Engineers may optionally observe the teardown behavior using +# Slack commands before the script verifies deletion. +# This step is skipped during automated CI validation. +# ------------------------------------------------------------------ + +if [ "$MANUAL_MODE" = true ]; then + + echo "" + echo "Optional verification using Slack:" + echo "" + echo " /v2_seek_destroy CONFIRM" + echo "" + + read -p "Press ENTER once Slack teardown results are confirmed..." + +fi + + + +echo "" +log "Step 6: Verifying instance deletion..." +echo "" + +# --------------------------------------------------------------- +# Adaptive termination verification +# +# Instead of sleeping a fixed amount of time, poll AWS until the +# instance reaches the "terminated" state. +# +# This makes validation faster when AWS responds quickly and +# still safe when termination takes longer. +# --------------------------------------------------------------- + +MAX_WAIT=120 # maximum time to wait (seconds) +WAIT_INTERVAL=3 # poll interval +ELAPSED=0 + +while [ $ELAPSED -lt $MAX_WAIT ]; do + + STATE=$(aws ec2 describe-instances \ + --instance-ids "$INSTANCE_ID" \ + --region "$REGION" \ + --query "Reservations[].Instances[].State.Name" \ + --output text 2>/dev/null || echo "terminated") + + if [ "$STATE" = "terminated" ] || [ "$STATE" = "shutting-down" ]; then + + RESULT="PASS" + + echo "" + log "SUCCESS: Instance terminated confirmed." + log "RESULT: $RESULT" + + # record validation result in append-only history file + echo "$RUN_ID $RESULT" >> "$HISTORY_FILE" + + echo "Bloodhound successfully deleted the resource." + + break + fi + + echo "Instance state: $STATE (waiting...)" + + sleep $WAIT_INTERVAL + ELAPSED=$((ELAPSED + WAIT_INTERVAL)) + +done + + +# --------------------------------------------------------------- +# Failure condition +# --------------------------------------------------------------- + +if [ "$STATE" != "terminated" ] && [ "$STATE" != "shutting-down" ]; then + + RESULT="FAIL" + + echo "" + log "ERROR: Instance still exists after waiting." + log "RESULT: $RESULT" + + # record validation result in append-only history file + echo "$RUN_ID $RESULT" >> "$HISTORY_FILE" + + echo "Bloodhound did not delete the resource." + exit 1 + +fi + + +# ------------------------------------------------------------------ +# Step 7 — Restore Safe Terraform Configuration +# +# Ensures the infrastructure returns to the safe configuration. +# ------------------------------------------------------------------ + +terraform -chdir=infra apply \ + -var="enable_validation_resources=false" \ + -auto-approve + + +# ------------------------------------------------------------------ +# Step 8 — Reconcile Terraform State +# +# The validation resource was intentionally deleted by the +# Bloodhound Lambda during the teardown test. +# +# Terraform must refresh its state to recognize that the +# resource no longer exists. +# +# Applying with enable_validation_resources=false ensures +# Terraform returns the infrastructure to the safe default +# configuration. +# ------------------------------------------------------------------ + +echo "" +log "Step 8: Reconciling Terraform state" +echo "" + +terraform -chdir=infra apply \ + -var="enable_validation_resources=false" \ + -auto-approve + + +echo "" +echo "----------------------------------------" +echo "Validation Complete" +echo "----------------------------------------" +echo "" +echo "Teardown pipeline verified." +echo "" + + +# ------------------------------------------------------------------ +# Validation Log Retention +# +# Keep only the 3 most recent detailed validation logs. +# Older logs are removed automatically to prevent the +# validation directory from growing indefinitely. +# +# Note: +# validation_history.log still records every validation run. +# ------------------------------------------------------------------ + +log "Keeping only the 3 most recent validation logs." + +ls -1t "$LOG_DIR"/teardown_validation_* 2>/dev/null | tail -n +4 | xargs -r rm \ No newline at end of file diff --git a/trust-policy.json b/trust-policy.json deleted file mode 100644 index 942abb3..0000000 --- a/trust-policy.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "lambda.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] -} -

PsSsmLznb{a zFiAMm-)+@ba>xz;Qn)t`m7>K34H!BfxvT;Cy4u5^PZku>nkw7vEcN@(jt(Xf*lH){ zmqdYYI0JN53`Q%CuR#u{C*QeA2gbs4ohqpk3zESY;s?#IMBy4L46R%Q&DTQeW9BLf zGCxLjU3kA^SpTTwQv3p1XL~-R&_v~&s#>k3Didz!Q@iO-gQv?x0ru8i_k&2IRv`Iz zRu^0_TV7Us0{d_C zrM-dA<7W>Qlbjc@rL=OHaD|`E-&25{p#G=f#rIz+_6zb zCH6XdbBS(iy3km~xp?Z}nrTEkSEQl!x}i7t7Dns!-%?#*;^1<3#F9GD6eet*{n)Y$y62X$OInLrm=EI?Er8YT8Z)lz9}D}lJ*}vlc;}$4(e{L6L-@(K3a|^jwF9eVhFbN=TpPVZBwhsWw9CkGPg3_=kgSt zIa~k3QUl~po=B^hHvbZ+&{CKSh~#}=s^9CRw3<^t>f+I?w~->iW}Y5BRFtXg1)3A6 zTRW#q?IG04G!yr$1t*JM*CX=#W>*{C!i_1TZ{M^H5L8||f&qa<)4l$R`R~63__&<0@&Uf|3os(#_l689V1lUTsoS?6uzaR1yYud1w(oo-WBhwx*vteL za29lu$_+KTAdf zcoMc%tZ4STNNpw7_uao$Y-arpAvD}&G%F>K14uR9shW)cW;%hskZ_7iMO&K4IMiBR zO1O}|I=u2y_!^k)oX7lpDs5;?GLA^OFHz<|5)|))u&IyLPDLXb;YiAn+m||0-Z?HS zMKHMXnweCL%l*-+TS!-TUbmNe?ZGg6g!O6+F#jhJ_bA4FYT$5xh025 zd0)m6?9NnnH3|yHTk+)i$si}ABTnh0wnj)c>>J?(M3lo54t_393ib!4LlY|S*#nD9 zP~~_ti~$nb3wnvsq8uo=?D%!FnA^NZKm*gKIGqgE5Z@S7WjC~H3p-9f zNr(H(_pL0c4*lXAu<~l`y=wvX(ee`E z9s_{x*K{tqREcBJ$0`=h8VB_5sHW4R3f+>P=F~+fHF`Dn>S{{BRIxyvxlqBL0+QIS z0ceh5K0NLgq&Xi=0Vti!sx`1b?jQEC>(k-dVNNu-UDrI}k&#uoEWpKL0Bz(~a8#Q7 zB7EZER>261nVwIA_vy|s`u6!JFGR5lx|#vY`O3ve1XyiO&hc%a$@Zy?t@{)|m*hT# z(%U}tZIu#6%>hoea8-$w}54gs1mEoL#wC z`{mSMX&;WMYDP-US2b`)NJB^PGwR74AAg362x2Jq(gKx;d*`0k@6kxaAOzjjbgKqR5o^7b9;D(9o z`0omxrFn>5aBm^vlLUZm@~8mzK4K+ODTWIy)aX(=Z!dU8rLm}1t?Ay9H*sjAqQ+5Vo@hvwxLL^n4h+JU-n!k3 zMl)1W?6JC`l*NbL_7CC88jh_4Mn<5IndrpO5rXY{A44_g^X*BEMT@I?IKdd$=2}H6 znCR$3yY%~ciN`SqA-$O6y%!-+J*SjMmRNJ2f&S8{fwaNTS=z&dROiJ)12457Zv_o#?0wRukoD(+IZ z)Tb>9t6(+1kcf;cHr`Hl9a zDy-=&35ASKaWdEhJJ|=-6ul%-oq+j5ZLr=_X2XH^mp%mrrS`#Jq$jBSzerE*#@K@l zYIYR|3EIZ@qDkxh+cqWA^{>*V_UBQpvwe+3Ft$6|isqSzpqg}z3bWc6)%2keSoeCVFg4#YpQ+e6 zuNJy4K4dO)YgOyIc2t`MeXY1{JDfLBhmn$LBU-ovP4MoYjEz%}tS{B2g;luu-6!Ah zaEvs@k@a0!$uL!0vha~Y*A|pebYw(veHkBC{aTlSIV||x6K-dZynR*PFh^K%Gjnu0 zmlO3jrjX`+YSwbz;P7vtw7@g$bBigx^T}*b{|n3TPZ5ar+Nb-;U5;Z0EnSllTDKLW z5esQDlQP2ErYv69@t+wGN&c4La>XIm*!CMLN?+e*kSP&iw$;(|@LXBpZMDPjPLx7KLpOq#ZS&H4i&vaHVlu2CEpk^fu39(33}hFJ3W;OT7b}y5JG&f-ki4 zrA(h~V7$iC0fjTxVg{;Me*T1{#^Y;?I+GiUw(t&J5p|Zz=TldU)zYBa%d#hZ>&IW; zjBkWgR&Me6i>f+LtoN8QM%arKLPUtGlLEQ_1i;`~gbWFe8CfFj9$wGm#qtxuNXY&v;(P+LrGyPgo z$r?r11Hj;%E^Cg{njpcVcGet%i*CKXg__du$iqa{0@B^xy|IblBq9W=KmN-Mq0q7# zIW*;K0C--_5a_$W<2_~u9b?)2O8jIeJg!uxE}Pp1mtb)~NVs?x7)EV0H`g1mO=)m~ z#sgh@O+rkomAa}}q*Sw6?*hkZvcad$k+tlg!yT%r=9}3{kn?B$@f=_$oqZjg%*+_N zNsnPJ@qmY@^NnE^gjrD*{Mda-U&7UJQNBtzin=q3H;$*}dm)0cLDcb`@;-yw!ZMLUjskgC9W6(56r(JCyY9_(RTCb2YaY{xV%J?XEHG=xgbT;Ayvi(Y)X#3D<df{jwelyR>WayrtX4PHI0e^2PBlj?;p0h zXkz*7-!J*wZCW)Q72KRE1k5bgaa*oK-O1R`{}(w)avKekqQlz=b8fSYAYQj=B!j41 zLf)$^y$m6_VILCHt^n%&O3HpzCU4mM$4~KfjipAYJ*lu@nwR)oG{**4AC#hsxqPD1 z=TlbEjKfv8)77hv8)m8u%a5R(6(8}YYlSDJ9%zokn%XuPGj`J_!^Sm4RY=@VDu^~a zC8092-Q+3>UeeLs3YA7$TPS2F_fFqp-7%`UAvj9wTBb@rPPVnirs|bDON=L5X z_RDPnh4VvdcioI${ly4~QWHvuKK@ald<PpipEEBxOk0PrC(=+z4i09hK2ps)(6!X!cVDg`MQLf+Au^H%5cf{qV+BbWk) zVlnd8CpTq^APmi4|IR~7uo+1Jcu2V>8NPYn=F+J3HD?N=Wb8ix_L;&(6B#)v2Ux%F z`9Hp8T{1tI%0%Pw%KjxMq)h%TnVmJ2#~hEyYJ(-mN0&!&$#X=}&&g$Fz@|6B@|QJB4Q?exA3?E%jVE1g z%03X$&efaGC+h0z$UhtP_AGaFkNfjhl^a&E?nkv%t9}LXR;YJSJU}j*`3R6F$d(^M zGRE87d(21HIi9#Gg#W=QeFJn6B+4!g7E_BgYBd^#&XqD+-Myo=`wvrrg9Y+`?7f%% zgH(Dj?KO*gZhm^FP@?|G#7NX}6h~gWKP8n~3}57Tz1nz&03b`8_!4gu%vD*w@t=Y! z{Gd0ZSH7c{$B-Fk?(rwvCpBJ?Lyq6M5vP)0cR_zx;HB0;+PH+u`CwTSG*=)3?1WLk z)D51TyyXjJq9j~^k{z<bZdtQ#&=JXIpR&@HpGv(r{sUJ*F= zF_G;9SEQ$snsainsyEj&U=n9NMWd4MXHS;4W2rIS(%YW9tJ^QCHAj6APQDmL*$jL! zCvP~sX4hp?83J}pr?F%U7~dk`-Ho5ps(BqX)oK7OtwFfc8`$e&Kpi9uU z0~JTBl>*2x%Aq))ce(*DX}d_t49*u%k=vhKEY+I>`e5qbHB9Z%-M5n8b46-M!&88-P1#aWFYVjl^cWbAgQ%8lTUt%uAB6 z?+a%hop)W!q}48%yMtvh^AmP4LD@~Qz5x&UWnq#TKZojpYCyX@v)skxrXk|?aiO$! z+UTej{N#9MVeu~EaYyw}-CIn=JKYfzo83>j;5~^M&monS)b#L!_~(zL;9y$1wezYK zD0Ckzg3H<4;gsQaN20qEp#94`+Uo;=h`D@-w4SZ=jobp~u%J>%rS&}MWyc%ajV?h9 z)~vO)Z`V3y$h{bjEb8;sL3}>A`~3-aK&2sU_&1R0V`$NT1)1~(e$dGU)Y;Qjd+-mk zdgqn+d>{gm>3W_-O-+|ynWTL{@OrS7ea(rE`uqnr)KT~FCV*#gboG{r6sz)wlWlQIfH#_3A zz*ZYE5Ng)qcBJ}UBQFCHa6G0d-=X4)0%Vnxo^}pDt?x3<%ZKzdgNcuG2+QJD1Pd%0h)M}2^RYSmb4Pq1COZ&lBFgS zG0BBv0hqn<`kC$eVb2V@P!El&DAaTGLEbWAeLkhndmS$wG7`L}4$o!n#h8- zEg39E-)ct4_4>lh9g^b#W;&%$gvLA@sf8}!FHMBMOh@v25xI$>io^l8 zbKUWuZa30OVYg6>xtTw7etUH{a447|gc<61fn=@9!E`u!^e5NOQM7UaE52FZ;CFpw z?5Ppe=tg1Wi(o5J-Af!{~wb~i_*mCbI{J2KY$>UMl_2Y1&S zY2aL#s?$PecLAh~qC3)&TIkPO_uqy3uVPTFoNaeex;c6=Z6sXp>#Q$qO;;Kiu(@ri z1|L-$U&3r3_HxOm3glKn{K>R_cFE@{i?9O{WLy67XI=-UwW_MUxRtp~faI0Jv$kG6 zt(9a1h?mRpJGjv_E}?XOrPXKu0a~l~C7MV4>~5!NDN86MR{&U(HB`Gd#2;TeOQhTp zPp&0$&}n}VGa39aKe=`uTTn9kTRAEj7VPrz%_gn|;)2=wS7RK5)4Rky89Oe!TPi^I znDIK_BvSv7@PL12O^EpP@_=m%cBC z6o_L;W!9UO%94%)w3LJqV=H_&-+8MQ|7AXFgNYta7Czu1cd?7YDsPETrW*qn3Y)!{|)*a|bPFw12Uk z&s|&`3&*_O7)A{t2aqJ>$`wi?R^8V*h_!s*fo8IrNziuqK)~1{JdpZlNBm!J3E+_R9t?{=Q%G9ee3JUfT&K!@fdU%3 zMT{^2zIvv|@?qWk1&|;^UypHso1Cq>+rRX|+B%JYb?-dn2aI6z-*PN#*A{zxe7Ha)!2MVB_*XD5H9BdC%|J9Z}Dl)L-1P*19@?x0i|Ne z@WB*GDVwXazC7Jq0<{(|lbJjNQ@vxQc)Sg%N{znEb~$mwZ+vmCLZc8^fL>osig{LyB!DUxij2cYsmY2L>Xj)e< z+-5J}BaX1aa9j?MvNZ8TEIPGr)u~5G_oS?R*vLYwyv*f%9)*>TRV*CcLrPO!xHLF1 zD36V7FO>e);YzJg`hY)Eq#@P&ULcLjZL&hb>~df`dlvq((kyX&G)3<<5{H{0Fb*z` zG_tc~IB_m$<0K2Owqa3F_cVSM^0X)FnZ1j_(_@RZar00*6a9E%)t1I+EKQKk;O;_3 z$mPFH=zvNjCut*IocT-y3Zlyh-P@HlZ8@36P%G#HUhC8ASr?> zWg9c%1GB)6z~Ojp)i8bDL_h5QM!Q;B~@?MBiT`s2o=5NG?9FSJuqH;*V!cwA^6s2kHI40VXB< zKxHp@#A2S;$tojUnm|p)?Vh6ff_Rk1;RfNpn%^o4;ltjvdb`2YR`C&o)eEPJ@+^hv zX#ZC>pL#gWzA=aO=)_>x<2w1k?)R4KTWaIBlpkT2%{b z!=WgRsj3ly@;-Bqk7R6*s5ssDJm5e0k$jjatgq+nQl%y$^81=_;Go(dcFa_>x!UR! zX={6{Wn{G1`?z3urNnn0CbvEo|XLtV@2J;a00;dGpPi6TmJ zB>i`<4@t%J9PvLF8UK1ttLk7_dNG#Mci+k|@)D^xVZbtRTMtx`i2Q;g_xX89C4anE z(sl#!`3RN<6mM#L*D6!K^j2q7hX$qG#XCSYA8}iZn7K}AW1DzIH6vFdtyZ?8#o`nP zI1Cwq4Uq3e!Knuj4s|59|D7IK4;T9J6CpAEHe4&1>MKH(@4L;dud)bV4Y%=qAxQE|um588^lugC zdN}V7eE)7t2BqYp|33ZxQ7z5${_uX?qI)_n)A%0;0gOG~Z^$5UaeVU~Z`0WEz5hOy z|F!aJtA`3QSW|O5GT8X*$N&B-Z%klVa;$lHn{R*9o(PkH9L-r30C9oQzP{~QnN=8) zygS2*1$_R{B=Yrj|83m&p8NV^;x+PS?iZB?F#WCb1iuU7cDlQsE?4V!otPU0^-W+XB#w9Pb`>x zY@@CLE(cN5KNyFS|I9edwO)B zrgU}bnVgQ1K3X1f;+4VxgaejTsX6;Avw?$C-ainBV4l14OG_zuZ6Hjf6W6ss821mt z!FGFS53!ojs2{21%0qQ1enCXez!B_c^ML@_3{6actsC3a$-435iFS|*=1GpO_cU}O zM`UgtfdkcXYRJ%z9buHi@Lk}q8Mo-T{w4pRZHIgUbr!cLB>z?w(vE?IiQq8?9k$TDg~;x97Xb3en{++4Ydz=(T@i8!{+4CWb)A zoh5e79M+BYLorVEt#Cgo+h;bU!{vf@+nIEyU|XC}*M9rZG;d2EwkQRY)2~B!?eHSb zxW6S{pxFe8d9Pxk$js%Ew*xz1d#uV@&hbffamh5g8pgt~*`p+pa)X7}~{dfHiFf$CHcsTxJqOCn0)6h0}pCmc%_5A|dp$+UwEB zWh0vGlae4|WUA*9le9NfW2Il`je4~=aAAfR*Ei#h5hpBmwnxvs^mM<_U;7DDY}$(_ zv8oY&pF!_Pk3oU>S>pq(o5RHkl0&rkX6w614pwSwZ)Xu@T%v#<1N~UoNn#dMrv)7x+W^le1bR>{I!DHp6w>s9&#dFM5 zss+~Q(|JH@0&6O+TD%wx5BbdH&S7WmkwxlOAKSt5fq;`07! zs`+ZKSjRU~T*7NE#o?$(vRpOnjRxB7_3&=IY;{#W-a%v=R0{Ivp~LU03Z+Y|Ajh4Y1917rnA3Q^dkt9Wy{a{3+n(jIVLN)5|m}QWhEmiMVhLQ z`{+gHH@}Gces!$wuFLN6aqh|f@>`RsTB$V#$y3@)b9p1rxWCMLdt%QtdB>fOIIH)u z*gkjFw1t(GN<;XW>qe#&%IP1R0d_SkCwKa%9zO+Eq|RcLg~p>}J5$z2lAXOLKPK_j z`y`Kp6onHRwJk3Js;+Sb6%q>uh7C=-dsq^^_LEN*Qps3DM5mV<`ZU;L2xRua_Xz%&? z+oM@#G=JiLq^A>UIUQgSy!F;UX5|W^*mjbe?cAE>$q5Iw`@(E#s2%5PnvvcBM<`nOs|l4vDt$1w$+R@0bi?BY{8?th(buE7H(o&hl_!paQ%0E5 zalA5h=!Z(9$+zNmUEl*$Ofi;SJ%e=yTdqKBh04w8@mkON6qb!KdOkYc1 zp9qCoCE$CF0b%7x2BXO#yjrRadN@SX*6zTU1Ab)4#(XveQTPYZ5tm{_K~ zPEYNc!$Kg^rjU?Hajm%GmD5RU`245JNnh*4- z1Sfu>u+;Inf1hD3W0Z4e_>g^wb;+b-eBr%EWusM7BAq*^Ta$&aN3p9o*xEhAqUBu^qMQNQGkVWvwSa zn^{=9tj#Pj)!nf@{0kSl{P|o%*NA#zPyS>2yDVQ zf4^Rn)QIJ&gk$I#xU|klg~-ov7e}Dab(&$p6Xv77KY9F(;~}&r3371A)L&VRQXq{J z=a)mmJhDzWv9m3>9HmZh7qxLJc#tb}H23Xb`&$pCJx^AG6K9z9IP9NXXJDzt60b~o zq%z%=s-;}d+BtK>v=lIS?g+2#wb5Cfy=G;UC03aX&^cm8gq+PuV3PqXaY?k zIE1ER>DgLmB?^V2=#%5-cK;#9(>XlUugB{bbq@ReD#aFa@KK{NPP@j4Di$SCWir*A zx&U|o(UjfV(!hUs0dOgu*zrZXayXr~Eq2NkN~J0tJz?2y1-PtGWwNP8EI&-&CMjW{ zVz5|b-<&RuSCJT?Y4rHB2sX6{GFe8jZpUm%YY_A8c^vRjJZ zTp=E}mfdaj6p)bJTJTRZ&|2HNR?Z{sWJCwARdPp=duWnRP2{+CJA%1Etomg7Q%IC1 zd^==BnIO^l(d7l!&OXS6H0U-jlliPzsY!P5HP6G|1WMUa&SY~luVx?mV!)o}e{p-t zgNF4qtg%HDEpR<%F2kJuCT=d%T5=j0?#sTQ;sRx~lYY!xg1KxHtDCA^-?K8+hNCI( z_=ET{euX==7UM#sOdBp%7N$gm48W~~APMgtN?Y7M&?IT3Xqfbr zq>8?W5RA`#@b1$%bS~n~I`{pohdqmFrxL!CyqdfP**96lyilaIHByrCYD8Iz{W8yV zE2JoYxND4aUrkWu%)`UPk}ZolVA;?;KRP?H3}Wc;4SW(svDwAQCZF#+)}G_INc}gk z61|T~%HPj$GnJ!IBIn{bYOJb|94?!`fv$~;YPjH5dnN%E-PkF?bnbHTlW{UN`EMJrKTr_9Um z=MGQ!5$I$krt)6V$DP~V4@1Y;Vpx!BcAK9lEzN59P+8ZuPM)q?o!RM%vmTPN|Cj^* zSZS^+2xU26=o&(8Zfz|XFvr+#4^+%z-yh*InM-GKa*E%9S*SJU2!oooirPD`k}dTWpCCRs(6Q2DeTmi^Zyh5{2@d7WFD)I%<_$P>Yp&n4Qs7p>p3=TQbTw?vocf zz;8qLkkMph>0P6y9xh;-p*6FvEnh_AbdIsK9u9GWm}l$vFD^C=hFcTCL9!bLnNwW+5sqm#{yn z*5F|t))u4{5ndU!OJE2zrRtR#2}i^Yxh`$x>&93J_t)3wo{A9>It0qq_U|*L%Swsz zNIkTev-GJ1f}z*#!tH2~NV<(&!6)l_P3L!CRHuhSCkvUI1#@r_?5%?Zuv$C|P;z4B zk_LpWAterlXg6_Hm%_>$Kj&UwW3(3he$lqCg#}4T(1_Ml z{ELM&qObnho2yo%*%$yDh~FHP;)#B&I;)fsS z9Sd-~@z8vC(emAMuP8yTlRV=H22vCUvI6`$*!pZrBoZ2d_+s2W+C%%WD=gYpl zkSW1yss6m+FFz^8<&O*X4D<^Gy<>wQDBD~YlP?+VSN_JM#10Q?y|YByvU)M zl!_l3GPz*|^UDOz{oSQAKgcV(*k2luREX#t9w60iK<>FoIdlcXheWQ{gGM+-{ow?O za(K88GG~vtM~-toKCG+hv?$~yE1UCTah85*H!=jwEN z`{&kR%#=>#fZP3EgO-p}UKyW9ZCpobWO?43uxVVvOCKSM{Yu_?V=`UzxkRDrtIT0^ z-k*DJ)zni`8RiaK(gp(F-SoJ4c&6Ng=^%2eIoXEaxA6dh$#qLaxcx5IS68)auXW(h z!pT-Xen)PqSoy!TESyGAUViU>zSGsiN8+xsw=4+723b8qMSAIQ zwWE{AzPCgbOyG5AiPft;(a!kFZ0NbF5mEX|XN~tG?*xj4U;@rAdW>iF;uJaqqB~m(WD9cn<`|KONgbsT}!FZW1o4)Dn zbsRu2n;t7Yj|qAO6)dcHbEP=QWi8Izz-Qo;IAf02oT&R; z!{OF8`{4q6J2#e1px&iDI{AzAj`j-W2j*O$GDthzs z799=JN9*JM(m+`2-(Jn#Do`4k{3$NEuV$M@?=2?>XC+X%G0+uBRIrEyagR2Cl#PT$ z6}v6&RQd6bOS7(m|E_UT3Karr`Gy&O$gE>S2+tFpzW5O0vWFuySinn7yEa%U>6e%U z%qJ+m=_w6x2AfORsE-<~Hju&u2)rYpiySkXF#lXtQRxZMC(+qn zhO8^yd2l62+t2aI^9R!>%dKyAjPPMMRqaW3Y|1Bl#+EuB7z#Q2-M$*3(c1cCr6d<1 z8}~XV{U}z#1=S&uD?Cbi#dxK|QPrOV^2o6$Wr#x_N?cG$ykW?8&~`~bReTjRwffkk z&$9cmEj&pb{4@7UZrV^jmgQw;4JFeqRnXj|3vMws9f|dFPl-SgQZ}a_%7(iauLVR6 zVu*NCzwf|yl55FF&#!I1P{&h01Ts=#j;Y=;>^{fq{%Q#+zZ#mj=)35t23ZI(i25!~ zu)6L?@TCa(i5gah2cX;~1$Tpi7{MpRMCcB@F-sIzm!TtQq)~_ zNkG|nu14-upNX67PQz9xNN#WFy1^I^S_zVzt${<;{U;! z=m4AvE&NTVij!QguCE%^GVhv1lZp_@qHATL(h&1Z&|BTcy)!x_k(5ou1dHJ)b;;Pp z9YVJmOX)_Mia10Lm;h>=ggZu(dO+n$@ZP-3oe6jU4~CRncRsEjQr{57?d%EbtJ5AZ zK1xNl1%{}YA262P*7%wcWnEZ_Rg7!r{5nve)xjfWE%;&-HSmr4;CU5k0xC-;N(yfJ zsSf%&;z4+&6_zT>AA+jcg1v_(L${l(4Q|CVMWgjy+w|ai-9i4naYqsCaD6 zd(yBV;q(`rTDyvf)KQbkpmj%d@G6f-;T3+4;bJiqfiGRs35B)ocq+%F4{){x&p5>L z3|MYxo*3h3lOZJhct)yhn3x&DfZtFd&>p6!4+mx?~KRr)V$5)^VS=49B0t zSYgceICUMzw4DR5-2?X(ilxcJDal2mxlwVu+U9vJw|v681ihrD+QpOa-VS`Vq&)3O(nr z!PuEHX`!A%Z8bSngrrR_b!%W$(}dGqUel|cg)1|CxJ2-Cu;PY4>o=B<8&~OhtaZ?2 zV_ywl8z>t1)?}oIv&pKBYlFQoHWvOVpbQe%r0|g=Y>dIG9lirsX=~ecS-T zbrv7bru76@Y30L%xuPWYrxr_;DobkKxw*Pd{!Z5cc9t0}kI@xQ<}5m820!((on}H( zzj!2v=v^7^h?-)yI6e&IQ0iB?S4y~f6s3vw-tiZxpw~?JDEsoZEAN#z78y?v9M;}s z?n zC@9K>a_|-c`$hN?%NEJ6M8IgPFO|ddeRf8ol4N`GsFOZZA17~u0T~%(bt`?)dJM5> zQBqi%S5J0o<)~zA^&~ip_uslkMA+|1L)P)?KGSoGzS}4|xjDj*o3)bX=c7ydjjdj)>4AZa?&FeRq8Dr6e2>$i<%!Vj#iBB5w7(bw_CcH|ID_ipW?bBiv;!&_bbntPE_vnjJ+KLIM=O7C_BYH<58@6+aFeX55-b8dnz!B7+6m;u%|ONWF#3TpIfIhHcvpYVnJLk%R@ zXLWv^h+WiO*qCVT)2q5HR|EQAPPlI5b4#eP;yeP;ejrzDiG}$?2qpB`gkhi#SRYF` zM&z0t;Z!_gErohYU;K_(#$c7@GW3$nX7%vcpw$DSuixv>9z9I{I*`Fk_Kaox%I>N@gRGRJ$@=?)ZwrxDiT3%%!{6wqAvHRon;B*F(^>p!)m!}iEOsk{Chz%&I zcuE&dl~Izh+gEhY=O#LNpFtiq$Lo0;c8_O2iW2$!faZ|#GLvhM)`pVIcDJ{zdY;NJ zi7K>TgIV2n?GNYP#C{79^TiSqb{|Kw%2dQV4UXeaR%;^*Br|_*8)}3YDc~7R5|bUO zuc*gU*gVFGv{{XbUmFl*s!SC-WsV0iz|=lYs3FD%g&QB|^6?$>nBzim5(e)AJD#kTF8jjJ6|(?YoBV<95!JY)aLWUA;< zM*yC1d%`7Lzg7|h!bRL38cRCd@CDV@>G&qK*Anw7hbv*G?qk#%-DuNI@>0TMeYuOd z_LlqPmZ<&(Rxz%(CQEu;K1G=$3SVf!0Q0ll8cl4*U|yaMB%r9H|7 z2sj>6%{wFouQleqog4G0OE28%a|;tR=F z_oS$Muz)7lM3rDjU4-O-@GVjUDt%>-fnfD0w$A~|A(@^R#OdrFar6c?XWsE~9Vat3 z8yxIz25*CpxJlSR(VKH?vGk?Yq?rC*iuo%9pkngY$CoY;Cnx6Mb~^P5>0d9ZCWXX4 zS-b%iQpiyGynGmAhS#$WZC>|9Qu#}k3TmnV?jf&?k(dJHW?u^}f;jjBY#n7Oh+G!} zDMIi!)7p{=;~-dwUbIi5F&C zT)JaNBDXDB8m4ABt5!YS{1Sj0d;6_EXEjqaMb}q;YB=^1?y}!?6=P`u=vQ4kt6=Wx zvU3EEARZXPBOSfQUVXk=ok*H>2X5f)?OY4|mXUU;Q2=vAe@!lZ`)RDU?vb-jS>C6U z$N5W|KTWI>pa2$}s0}!^j<9Vd-IJ4O7hyQ>IZqS3`(uOZdL_g5O7><$vsO8qZ>!&3 zaPQD-PrDVDw#(cKH8p^a=4Wg++YzitM4KA~-!qZX#oqhp2N*{Cfh^DP{ccD0_Ep0y z$5T(3OyPySy*(*2&xIm%QBu-j+zY2uYi)ZttOt`b9JmX>WmN6B)ctv%7bR>`$ABCe zOj8?76V+f1<~x-B)PEKedne+&cSNRpaf{)4dAb)_tg6}at*px$BWW9?WR1aA1h zugniSpC9c84O`Egq^YE-e|+>$c17FYOH6;8D}SU`H8U@=eAP@+&GRLEEc32jrSpz- zB_m{?|64*O1iS(-I->fg5APv7n7mv)m*v9IK7Hal^Zb?k`ufD$obQ-h5RN%fxztcf zMefdXGPqrNi+?Z(%yd* zoc}cU{flA~xPqVF?>Qs53%B3;DK=U2KISR0oOVq^3U@M^$jYs8liaKzIhLlBYt|~Z zk7pk7`zlYctcQ9O-0)P&oGr15L5~>i%E#9<*>ndS*1nQ5Gb>U*K0V3RmnazD|N7|~ z-39~lAJ6>nAJSrjjBT4ID{qP1R&_s>7e8YfD9A;5xIbOXUfg8l(Y8y7i-(0w?TsAZ zha!`gDWcITinnXQK+BpWj%V;xE<4p4j+U_0I^$m4NRvFQ<^h`zlbG=(zvc*qN*z(- zw|)N{;Qn1a2pqwA4Bq;2+>pQBB|F#6>Aq-(YJCY1m=vDT!b5a-K5{GqkIPBK(#0bj7FE915cctE{Kd5W)o8gfmQ1aIN*>SCVj7EczY?)Cz2v zXJ|m^1(HIeT4E#_BV(N7@v`8<)ef=KU09uNuc@t_gTju7hXGh3krNwDU1ED z-+R7^zuxr`9r(gEOt@Yg&DmWBBOHs>ns`xUT1k&Ynu*sJNMwBFvlI5+54 zDwyAo3@gY1LmqKk&wqQX)_cEs)n0J#iD!a-FO{zl_-&2Lle~R(2fyBfCtm@WVV|XccD*8?=P~ z`>iJr@TyH!GbOOulA!yVPxwFoGSJmrf0kBv&P2JTulV1Gn*(LdtSK@Uof9N#^!Lm1 zpa1#6!1tqfrq_Sd|J?1{`EZrbkI>*B3Diq~X#1V5qoZRLsPOZa0F$YFHlW~TD7}&PVnU5lj;n?CUi^N##iKoJ8-#2?+>HrZ8b@lGlvixl+00NeM12 z%Mpi2>7wN5GC?#CY zwX0$o8TJ>yOW^pUYM_=|+*6m;R|ZzN^oAVMeqlaJ#j-OQ3`A{c9pI+7u(EyHeKzYB z?FWANJcj^b9alIU(@AP_*JvOrqeQ+qDX)cGh5R-9Tj}e^!p@i6VrfYhQx!JC9c^3w z#Ysfeq`TXd0RtwzD2FljJ~vIXwEzx@gZY3 zBO6TIj^-Q`f!vwY`E&3cq}Dg?$4Kdf7@hu_p)hR3gtpnLLoFi-&VcB*(j-NB?r-SAblZzOd~W~1k(ywq)66t8avLVwej>U zSx3UDH&q5vW0fu^OW3_L0NPf@TN6;1m)6;aC=4-9d@8{n9@Fg=kT+H_y{=@Bd!`=& z8IVae&Wqt#R7k>?Z_#1#6Wm1yyvdU)9)p%Vh$1XqTg7^?!_9i;fjjk(XLP6u=xnvn zZ?TUVC5N#i)L6rdgrEmhTMB;Tp?XL#^aU8yI}djFWCr5hf)?t6^g~ zsc&^Sdtd&1Rnfa^G`i1sQqrte)*a}DX(R9Ig=>MCA~o8(CizWvu9+7ZK~+Vo zmn*w*H0dX2_vhzs*Tavnzatn*G+Id%Txx4B*Si{UUY@K%JeBEEb}kG3Uw`i*G^-8MwN&EiFYqoeALAn zfAk&hn?~C3aOh#1f?7SB{XJAVyF*Hjo^FwIb&hZ zz{yllbaWL}ltXA+E>8+ram(nC@MaA?WqgPlvvT>RPtvDd#Ij$AFqAqIf7q6gk#N%d zguW1nY2l=pz(k%IJ*FO{lMVt#qYphJDJghu$Qla^K zU~Idj!FLKjJUy1(5?2ifDEKjq4q2~KM%`P6MY-B(+gBt>=sCV5>k~Zz@1g?O-1tlT zjp?=A+Oqhjfi%$q$C`RJrTBGkA6MRZ0vILJ#xAc5S=tkB+jGF9dE{|w-~DS9OW3o| zmhqwx+dgwFxmrZBhqjkM7qcRjJ^}Vu`cXZquZD4#9*iuLEo^ckuOI0tGDKQg02MWo z_eNdn9r#jPdN7{(Ft*~kw>_xJ`+B|PHWOpM{$s`_LB)~_2QQa3h|6l#dpGnMisXpK z6PnRC>bO@7C9fJoMnpSb=ghAIIJ++NrlS(B4eaSS8$j-7|L6<(ei!o`3j%O=jO$J22m*lz&)NlpMfFieH)H37fp&yAQj$cgPEnx;0o@OC@wRaDqm@Hi^jycd}2RY%8{tC=@^U zaCQ^NE3>cNGu01Ua@iXmb0dxFRk{CJk5?jt;6=39ABk8gR){yAEoaN<^-W}Gbjlpe ziOPJ{#+$L4kMkVo#;Z(YGoIWoW^}rx0&LER*-Qf=&u|?NB-I+8BUfEZQ4L08{GWmf z-@iO9^xPJrQ2t&67RwjMgyf~tO$B;9Il%0UrH3|L-D-5=lr5&SUBRz>fK}*8qOPH3 zW=`SMCvZd^CSR zxCoGw3MI;GAn9LRhxCu0h7TECz=^Tr2+GSRd){C`9xHDxcFLX8Ih#j3*4G)i+ z(}8lscgcCRg16La;Bc_$z3tJwqmffklA&u&RdBM2Me6r0=^B1=kM%e{ylOqGCCgsdq z&aB%6AjCZVKYg8rLsW~}^_6arZV)L+L4={Zl#=dlWawr&!|;eJI&DsRolwj z^AS9=EpG#H^SqDpzs+2ze*68i^=>4EZoWvnEv07kxAt@_6*rvgj91O>OiII}SDkl( zW>YP02K5uisA<~=euj3hcvVa&MgipIJAt(2GvQA*SjvxfpOg=0*%9v_n~WN**|t>S zUVKXj(r!L*8S$7~XL(?qn$pq1zAhkFn z7Suo9gOp8%f=kFTT~Kx+PlNy?r#}-fnO;=Vv~3r8WkzG}@~sTCZ@b`tDwqAW%)0e! z-Lihp%x$lqlfL1o3NmSVW$37#wOxF0EIrw3VevKe)cii*k)7_lYoLJbR}}fH$;*~~ zXzR}%LCp<)^BRps?}Hq7k-<89aO~<`@pqRUIJ!&}3h*~+h|T4Msl{E3ld}@lBea1= zU6kL*U779QDVI@INblo>+6^Fnu6vmY{AMrf(MjP#xl>a=3P+hUHf|VDPQO0z7416@ zq-)iG590jB2yWoIF1>gU>sj{nZu-|va3vi=8TF(#GJMw8Y_ZxPqT;IMc2EMeOI6!a zh{?%|;I4GBo*nKjmJ$ou!{6)5;q7GE+uJL2myQeK_4V~S{L19%P%MhBOBUSv#YUJl z5sTJjC=QLy_$IsqHp8P`VxeT(j%|iQG_O+F=Q3R@hV%{GJXjNbUF&4BaHgYsqFQOk zRUPL?Q*ak2dTE!V)5fDoUIN|4&E;w@;Eo1u4!#djRBbdn0Hf;;O>EV5b`IOJnbE`^ zYrr*f+i5S^eNp2)lhJ~{&kS$v=CtPE<&x7PqAb&OE;~O;?|-+kc-6O$l~MClW^TQf z9ZnF;b>IDIaw@PPu~Eccw+y-^(<hxp*tKofJJ_jTEO%h+imSvWJS!`$!_ z1%$L5T@d?5@hBY?RFGtg!;$loEpX`{gWC7IO=`Sn!c}gQehHg#XVs+c6}cr2vq$*P#Q+d zkulp7^&JN+)loBS>Z18VB!Xzf#F-$}7T*b@+`u?-VMkc=Nq_Y_vm-XfMgvOOVwC*i zK=HPwN8h9jT$?!!Lg2jP<&1s*%wpMQt0Wf$RbRUid$bhN0ILz?-HxDPrel;LmAz<40PJ#%2+XmfO-vQ;uav_qaelp6YWM{)FMxZ>@7xL-cf==PCBn5U>C zN9SQ9MN65xNyxrQhqb!b$f^tu$$n0mcE|)iv@fHq3aKA}lj}#K%*06atbO~kSo++ za}9dWN@E0SH{)o`an@+6d6B}ft`D8bSz2A=KB72~>U3Of(Ruj>R$IOicAq=8gEZot zlIC6O@gQhR(m9(--h((L)Ls9y;^^jlYj)!qRQG+TK{;34tDW=fh^^yd)L^em>QbG` zDsDAVYLztve{GfvKp4I|Who#4@ur$D$A)vW@~?aNV_Q0vR!^?e*nxq8+TjoMTksl^ za>3(SaogWvBc5qT=nD-%=_q1O4XB{(A#d$xT#gQvsIC}w2M6lGDm*+qxvs9~Qx*1h z?OINsN79AAiQjwI!J7?T%1?JVRTgowtCQCJ%b$#xGcUR-qxovPJ@i|b} zqYHW*Htb5SaO`h271EQSoK|3MPR{ToR< zl@BbS!hEyr9dAiWbxFWvnW#NN%o~)L&6_sDgI|O+^dV^X!|DcSIGHKZboU!=z zQsN8}nW`vGK3Y6?O&$6P$Jtr=)b-rTXW6Z4N=)XlfdNy&;?P?-pLbRd6v?GQQIK@7^s8@9<4Q-s-q|SFRstoCh1VDcDVqPdW zQVHd*s$we(5N`}4p!j!5#WnlB-j^4!%k3g+p z!CZ}Fjl`0;=#7!*q?@~7gA#pWcJ<`WZf7o#neU8C!Em7#mYx=4s#=9Qz#nWvAxTVB z*t0^MH+dj{+wI=-Y#64y&l^6jrgQjl&o2gtRknHw^b&2dtvn7FQUK8IvihP zOAwQ~mv1C|*$8Wx+1|ZttSI%*0S6%Rzt(i*7wx{f0LJTZuDj&QPj_0k^Iofdd+~8{)plm>u$2%0Oz7L<~~-V4-mT007o4AP`^dn;Zx(R`a1FCcp2;by)!g) zLh6sr6=SO`aJScGrT+szzAac$ny;}?+YgeIV2iH-dayHxZ!BG_Cg2x-Gfu!)uahF% zy09B(Uh6qGo^<$m0Pl57MXu;YEy_u4w_Jxr#pCTbc&0y@bfFW#W%x}G4paxLG;Z0y|ZnU z7l}RH-Py5fytBd7FAGLjUNov%fNhKIgeUW)IY_XOnbIeWmg}xhM@i~=|`v7`|ab`Mukf$AQ1AiPHa{n&@2t0H%O1kMzzA+ zgEwf{n06ILjD$7VcywA(>S-4~j~djB$=gU#I-3@ckbk~~``q{5Q41>3X-{R383 zA+L@q{`UN_&%G1Q+1pE!Fk--QWjrBY(vdG12+&J=>t-+6R>626Opn2-s$RKdGFa3F zP?0B?$a?{iZ>b{EBEX?AZaZ9Gh z>nSokY^WazAcyp{kPJU^)qY@ zOpGH+`bfKz?h+) z>`q4;?^mzIl3y@lW@?k1J)Ou@pmmDR_R0S;}1n8o%8o-r{*VDrqNpdOBoH&A`2M(GyZ=5Q{OhJyUpa6 zd~K!PJc^d|lD;|{nm*r#X`FLs=je`W7hh&KTR!r^UShPCs2wG>6+fd_PL_06zqW@Y zsTLYFK>fYF&>m)F19ED;#`MXrulPMuXDalRsRZ1LCYfSY;TBo!E88l=kURk?HgRpV z!~}!p%g>tZddz)!P57Ku4&Ng6!miv^p6OCtu)|XjN!d9#QYMNNd*lVO4pZ{8xlWK5 z78h~oTjzdop$DZAX7l!hDY>vo&^K01hq3#f+nbT-$FhSHXC7ML8d;qD;24Lx6d_p@ zNtL5K;ud8 z<4YFb*IQ#1>?#DC=2|>@p_wnum!*E%noIOfIuvwipaZ=F_!ODmA^wm_Wr`|Q4Oo?d z5DtpQDjmmdI%mz}1gx110>h$%pL@_8$0)HRm#cQXlz8IBEcUCGmAuA?ZkP!nPSQSz z!kyVZ{-lvu=@O?C-5^_6+4BUB=VvJY+(5)G!z8AvKX z&GU;)ZInZ-@ft+vVrTn!-&c!JXBQ$AR2eK)yb7(HZTDAO)su+C!0u3~$npl(`9plE zrCi_p-gkUpGpLT)x!Vlv4Fg}-yukz{C0W63-a8t(iVo&>JPdAW z0xG|5JQF#N^;;#!2*l+8Uvczal5g({xnConOr9;WmY}1_`+7J-1Ttoqq;i7jLrQld z$EaV9cczs@Mc8_rpkGNbyWB;26baDtHT%)I7@l~t8Unk|ISsP@aC`7}9^K-lVbwN4MRC)|ja6$Q zy+zu8AfV_0ApbjgVeg9~n?xqng3$BPmYjb>v)eKRwKy~e3_jzEvoVzn_bW zyX_D^GeIJ$>gP&>_YJlURF}C|{Zek^!}y}X!9)AhE)MO>J3i_qse&J$4V#MDTMXxG z)bGIF_$?hD4}unPO&Jb8U=ZOlG31@V zth8+F7_-s|d4pfK&_%If^%AUa;?F(hesQ#PcEv{!axPUyoK)j3&Jvs2KWRUEpgbgi(gMi|t%TDCUy%=z zFtwx5ot6nBzC>?b<;ChoN>|B`XBkZg=D!LKnBxhRV(!Cz5f1`0SY=HoCl-h8lP)mH zT!d63;NVKT2I-=kZRBH28Gv!RljmQ9Sft(e&OhDYq)HVx0=SSBmwdzWOkwJ*1YVB* zp0ALQ>EsN0Ert5%(PLwPKKuk6vHal^OLwal+TCvWzy#Wegx}3l#rtlOet_VnC+oFe z8Z)6ZvsU_-PUR@*YAnhkZFXDBEeT7y{+oap+E}}q{nO_n542WdEIFG^CH@RA+?N;` z37Gujms)YCg!dra4pQ9+Nrx}|+rJI+kBE+F#GaHvGFH6Vsmun9!00HcP>ihiWJjIN zU2UXX4B|kjdrE{Wu4a}SoYauaa=hM;`iEYRJvGlbv1(%{KPB+R3i9cetwD;ki>FRc2W!B3_CT16cq!0eN+T4xnO zCF*lXnf-XNU@TlC#<|*rtOXLHhj?7HH+gUHakGT5K!P$~RinF+z3kF5dYfL{;VRfk%dwnaWGN}9u@JEix^prh_Ry9CjLv_575H9alHlvamOt zCC6F%^fyahr0n2LihXXH-MIW2?g!Scn-=A9SO^XU2}ib*^CWq@FdCVo$dt9iGdIT( zV{NP}4;Zbg4XTW*Z4r_4+73V7z6u}ZE_|nEt<8Kt0!TJDok+YKn;SqjGHMw>uEx$M zzw;Uu$l%`715MKSaB5e5yjh|mB`pr`drKMiGr|GVPR19|ez)%OW*KsgiFV%Fs?Z%c zARw!3Q@BKGOJbzWNYYrt+#%yuJH z&7^fZ8UJ8~f}>UB#;p<_2;7yn%+ItUwxTZTcz7r&psB&LmWc{ERx;J1It!vXrtNjL z>jP?EIboe6`7!sfqw`UC)nou6`5$yn^BbL)Bn69+#4oO0&sF(i!1DG#Y-z!@A=Ma2 ze8u3kt7Z*eH$kF_vL{cl)8(ba)i)-rAw2nUVk6UR}EMNE>k)T>at za&DJ8WpMPE6~m0rfhHFBxV7Bbcyy&h>?eax3tVXJpR_#Wt_V)cCw+J}E*62V5(~1f z>!aDB!xQZ6vIbwc<`8^I>ZR>hsL1LkmqS|Z-INUW-eYLnck%XV*TlU$L18UZzy%yr zy$Y&4?YBpj&min^BbCCg_@?u^`6q_{DSj2%%JVQf7Yva1`U2gDB4eBXc`Cb5Hyjx*z0+LAQQIbk{ zcOS`2Zrp8HZO~LJ!i03wpc=cm$yl$gM^G z%o(kKcFGUDt;96N+@#R|Y$At`@R__KUk1^nHB!DssBC2TaIZxF?K#(By?EIG&`n5( zoua$fEdB-<_??J_C#{V;%czQ$anSChhcABVp4{sF$}p|#VSSLZVXjpt+4m6#Kxj6m z8Db#~|KxzRV1E>HCG z%LkUSgtw(e#G_dPI+i!D-!zxoD49_tWT8c;JDmEW!XHRxLGGSDr-O+Ua*;&;J9T_omfv^?d)jX|vd1Lk9b|^-DwW zOlxbDZ*PB1@~nc!Cs)Lc8{Wl1=?3LpUBObCsxY8%fpnrL7FA{LlQAw(s0;5%H zg=f$!0p14yDp5ZPB8`$?a);Zm?a13!D$1c&uw~J?L${FfZCe8zrCqN78K1x8yZ82B&(YcqS}s{gHYAWSe@+b%*z8tS?hWKBkP#!yHYNf;lcoXF= z*X?ReVP-pZz{0Z*^a^D}KeYEJWqB3pozPaN1HWG{SFo_wz^`eWKfJsx!NF7kcB-_l zp-?IBpY%M;^#-cnV2Yl<@Vl*Qjnuw%zh^Jp42VQl?l|e8u??|2m_+FH7n zK>|95FP>49`iM=5lO2yuYj1Jij@3zg$42=A&(;f>Ry)VPzndCmO#-PXMOy~q+X^zr zI0j)iE(^Yk{Pq#1g14-vss9b11*`c>&Is&EAeWBmnHm}&H%+ww^3!!E$&8o?ncmeN z-qmf2iXK|}4p_Ec--}=$a{ZYG?9l-z{*TtV{Xpko!PoWiIE}53vSey_YQCXR}LX#Q3edk31V zcM^I0vvQ~4%A|K<$%Eh6|G68e`UsN?lJ_dGd)S&bJid)2I4VJo`F4w;ko#2LQT$DV z{1G?grUd(v3GcpNp$B|K`xHh0eg5bDF0M;4S22F<%c0Jukm;Sx*i_YX2S@G%ZNI9G zQQLwqq;mA}j&g%1yjDrmOCI^!5~ldsc{N9vE>Fx$k8lSIVD34du?l{ znUdxko3Q0pH%YeVCo!Y#p z0e)HQVFy0bGjjNeV=>3{;yU^qVCc9L+B~M28{04G^E(0R|E~x=DFfgv3k$WLDU@?R zC47ze*|V;Bkm6gPedql#aq(GrNI%wH&4~0zZ70X5(d6Ob=An)YGBU?X!xkC1*qsP> zMZ-LOEar?1#M9tstH9O*WU@a-7#ByH(x;rg}NLQQ`A}eIa~(;sI#e;I&Q|%K_ManBdtY*0ME}cSG=^h__bo~ zTy}4^N>pjZECRrw@HkY~&J#zm3j>QwJ@8Lb#T7ngvQ=9o#HSHjs@Onl@be%+oSfEu z6h5AKPz0IZTogKja->)cxrX&<26kj;Pa>|Y`@J_>wvg9N6a8)3n4;`$e(G9l5Np+V zHvoM9(NgCir-v5*LjwA$df9Ea8}>+va@sN}SqZipvlQGkhIs?n$M>N8R_3jtWw zvrOh`|cT4@F%O^*+#+J^!SOa`5Tx6#1=da8LpF+0*0NsBzah-k8alWaVUiMxRJcp`AZIA8_ zCYWvi?&Ppy^{I5z^T|z!hFb;4jPmj&QSR-eX!=c+@o;4BqlakX9cjmmug1|4F!?e? z4>z>cT5&kQRm7A=%v7QwVR~~ynzzpfMewcZ`%*4`NWb&RwAD>Cm`zLS@kEP{O%s=| zHr8Ypdl}yOP`Rb3SnWd-Fc&W`1TGfW2n!~69GWh-xsIkp6Ow9L&!bv5T|)C$ub6c? zi=|Kj$956zVG$&vZTp32kZJD>PJDGzWkJTnP$Bs&vQ7%OgAIx2DWt0gYpJsNKeUc9 zjHf2qE8Aw<&@dc+(^I`cysiU&^iVBf{Dz}%ds4$&Om-MkFz~e&cq-&CV@hb|oV4Sm zXR-L#RQwyzU%i%oQqtB`YxPh{0Wd$-dbEAqh4dvCQgRtjEo5fCWatX(TEEB40Bx4jJ!=>`}=_qS4#Ot2f;WD#eORnsNvXp=BZ~n?R(Zp zEl?EJS!1NLFiqSDndneZ5EN#EMJI-Isa%0Rl&atRrTu?FjqlMD z1Zfy~LfnN>xN6tda24hU)1%VI^PIYJXa!-Qzf-6jc%}W++k5Nc*2p0&n(1E_qW|KW zk8Pi?;*W{sja4?lPJ*7k(F>8VnchE{*fGQAUVc7Vkz;>(J;ySS@vouqw|w;1Ssai` z_0&qKpY`9r)c-tY@DK15;RmIv(m&#F{(6SLe+R!Ok0An5mVqiifxg-QZDfH1M}0D# z^ASTL|Cm_+_2&K{)lZ%|%5Qy&lv=o4r;(dS6koN$3y%)}96nh5bx&g9Z&K_(4o;`b c$Ii#6?&(@#r`z^KPv8%EX(g!&3FE;32YhJ#9smFU literal 0 HcmV?d00001 diff --git a/docs/images/github_actions_invoke_lambda_scan.png b/docs/images/github_actions_invoke_lambda_scan.png new file mode 100644 index 0000000000000000000000000000000000000000..a267bdd66ef1098baf170864cb4ff16661a9c1ef GIT binary patch literal 122014 zcmce-Wq4f6jwtFFVrDyLW@ct)h?$w0nK3atW@cHm?ldR z5k)Bx5kf^LdoxR$&vwb5Nhy#j$|KlAhrkRy3+Oya=uYTaXhO1E5b0`mVHCndOfaE= z7}~0yhtcMMjw9U73j*lm^ z$#E`yklbVEfgKf%F9EFI!${|sg0b*W$9{K%LJ@+Q=7PGkbht3_aB?E$vTuBB@VkLo zmIettQR?CI}+Z6^%Z7iG`q z<(Em2E1!X-UqcVlxDUek%iJf7$buUJB$IwmiY!gJYot94f|L;Pk089o7d`{H@tN1t zKo$py`g=$rLfqd00|Ah~1hL}+_6^vUL7as6mtow3loY?*2M2FKaehtj!E!*>`NGj- zI}L#!sK*GR7i@Tm93_Ml5?+b~uN2%s1U3v;7p4(Mvj-0$oTmtf21zDNED2K?#xDG% zh^zvmD%?2DFirJ`*aiML1Ygj1n(!9k8I*((qPRc3hKLu^tk;GU1R)%w_va-uC+uWk za}SvVx(}vZ2tyyo7JUnbAABq!2oVXKC?u1F#t#aVkl)16KfpC3_lO20(UoEw2+xLf z3o)>S`HdYgvBQ2c4RIR3G9qK*n_-#J6@w^8aQ(3S-C%fb^vu|wdZ9tB24)@R+UHa= zvn+b*WJBMCsU6Mtvoq?f55YiS$AR!X}77j*|Ov(zwkzgOo%-B zT0?vieUjEC-ete%rz-JM!BQ!Wev^jZ2i^a&&zB_4R@kO&T!uAIH?MU}cC36%!IhpF ziYpPr&@5jiTlM`sW*x^fzax-W+ppFq*{Al^@k#qy1V$7>1VRC#s!uDFIaC>j4~8Uy zRg7kUaDa6HbU-9x2~D4RI|(kSBk56^OZp{=p6YH6DII?zVX(lq5HDA^7=GH(g@iji zTXw31AkTd|JSi#BHi;xjoic?gNA=v45KiQ4c>E}(39hjVOIN8yd5tPKb%yG(>Un8Y z`J|GoI(q3r8GET)ncsKga!)`}sjafLl6QX0cMes=@A_3;>Th+=)3ndDhngLlp7k*k zUZr2GQ>{X*DrT3f9hHqmm1XACl`C4cZ+;!beG?herO~twU*xJ3vQ2LSG%0$A-+P{^ z%bJpBq>a)VHZg^}vbwyw6mlnV<8d3eiMJuQt+c_nDcnkW(RPA&;(1ki^*^sZ-`uL7 zEFB535@OfD{epADYQTxY#>NuIvSYSk_OUFq`pq=TT+ZTUBg^K-qGzUK>N5py-p4G( zv|{YEhQ{8=BF9X}(rNlNVoQfWmFEiR;X{OM6wbSPQ?#$E3()-#*E9!RT&sbw1r(*UWb+%xc%TezJJwpt3Tp zvd69Z%$Fy9gSTDItKnvbNY*(2xZkef5z!Ur5!3O}UhCjZ5XR2_Nz&oMcI6)4w(jxUyu=d4Ov$AA^3tSx z(glP-g?_*$dpCXzdH7J-KHLk>WA&9iY%X{RMB-OoSXTH%@TT$L!>6e={);Q0;HUg2 zIU&Lys11C7q-wrj)@{uZwZv`3)x{m=spSDg*7_|BW%>|8ec>LU7~uTT3~`B~Eus@+ zbucw?xUl!pRnZo3_$a*OZlf{pFb!p$Y5Ccio4DOf0w031V84D_r5o2>?i{w5i4a@* z24Ila^>O?8igNyI*KxU}v_-^Gzg1|R`dpHiqKnrr^>AcuzQsQroh{ zS#%km0ka()#|!2XQ=Sxf8Bo%NBgN+ZX6d4WE zucxbztP`+_T3!BCkXFxM@&UO?aO|}2MApiek;$R@`s3;Qqw$bg#zZ@Z|J3fG?o{(Q z!{mon4^7K^!h!;sK(xKo^6YmD{T6o`JAj4t1ADVAWF%T-UBq+q)EclQxRu0yC_GEX zO^>FDu4-9qm26`{8%1NbL)-shaYJ7wLArgEcNBY+ZImM=_I&%IwSLLh-Z#`t%x@sY zx6k*1#+L>M00)S8*u6JD_xB^b7JQki$gu`20B!)?3qP#95X10o0IsE#e1(psH3(G+ zi}3h*9*_6P)g%*l2X{&EQDLtITcx*u0Qx(ANBrL$D(*N>Jl>##QTHhXy29u)u z<)q{~CzvL(N?sKjn>d>@d2Jor4x%R0>gq?$VW;9J_cL(>a$NoPf*$*(2YyGsRmx}) z=tgw8RMQn!?mG4C1Jr%0bgayqbGnb6?#9_ltV^out2j1lx@SD*&JRZP&;0mS3^!*y z#|7=;j!$F$bZyqxlsxc%ypKVaAp-fweK_we z-i%LoJ1AfjB66&FE1xI!n#1&7fc3t5z8pEBeBSd@C;o5V&lmcTPT9&i7~Ru;-(O~* z_tS)Ode^GIbzpnY`SGzQzJ%`(?Au3eWo-}K&#oJd{{ z&&66242j?Hm-%u(rrou^$;_u<7>{-DbSL|;JS|@HZN2PXHC#C|srO~kLLfEtLPLXe z0KNoZgMpl}gA_t2v)va8DSyC{L%&jFm-kb^SLz^COIXLlf;_f>)gZcJS-%sXk_o|!beQ}7oq?B{BxY99+v+_$x1yzosg0(nrR}G9K56i?vU2hMqyN9P{1?Ul2C4C1 zkW8FhEdL$!zcu|UsH(H6lZd_TCruar|C*Zr0RHcd{{hI$@E7a^FL}o1Y`{Z^MpL2Mt}A3A>Wzd2=w~-Mzx@4D4JY z;cOA?n^O=Vv+sUuy2a;Jdw)BD&5H+tj{AF;3EUTj_>d^epOt?T;IkVkNp60{kMMAb zI(S;bFDQTWYViXFPRb>gug_@ zSJDK7#pO(QpV?MCp-y@J7p6_5K(l}KOb=*YkJl*wP4Zkp0SAe4aj^pL8aq2XPQL>< zq5dwz!_wfq$X%)8f0t9zI4*ErKFlso=ixflze_|BG#eWG{|_Q?`r{a&|BHbC^A$3| z{-R*`xFZ`p7A6${F8OyZK`~A2zl%Oj&1u}mB}^xVFNnx*_T+VY6BwlXqw0zE=2NLtvkk(%g{eDa(o!xi4ew%7 zqM{)>txjZ>6D|7sJm)0|j-a47(t$ytd-Feci!Z9MFXeMfDro3wN&Xl8*$gcRHH?8q z8jg6LQd&xRb$Q9?ucxPH*W4TNm)zqrpttH-lse@}i2I5}f6gATpy}10WAlecexo76 zpwH|s9x87?YgJXi(>FFU8qcZD$w8yj>!Td6daiUt{X>58O+}43P)CgL%2_Dq5jvht zp4SXItxUL>$BfR}C93oPHC0F>LMte0)-&|9H;`qrodiXlK69IPLsq zqS7tS)PX~Er%7Z2pD`Mck=F27jz%@f8pHtX*tEQh2+-@z`<=8EFr{{qz|$uPR#9xB zO|Dl>D5ZC%F~DajACbmT{DC97{jqa8!OOtQ{y#584e*F>4D^Rn;nFViWOO@xIFYb9 ze=RG*PVoE!;{Cp-`eRQmofv$sOe>awd692Kky)YBD(>T3Fr56)f$t%>T#1FQ5p_}y z4x!*qG=Tsk8v{#!Dm6eZT9uk)5Da*PzFzk_44F(c54o`Ua%MMaUi;K&+1cUV?2N@3 z!N3Zw>#t?3|4Ca1>c|lKzZ-Cw3)?8gO*ArqB4mD!Dj3>Ba<52c@Z`3%kbd;*(cxt% zECzE6;*m8yIlFjJqrl{W?M+WUMkWhpRf6C-kpZd+Dhf)W34mCsQx~H3lz?HzaRvq3 zUA!uD>^JywE9A9n?EGB6vQMyYk;{pZQk5gsO5>kgT>U_e=V7^^DTnv1Zo6Tdf2`Sm zU){4(JreyG5|;R)|J1#LgUCIH)cpDzOa%J+&3(A-bBlM2fz7nfyEZ`TAMTGr8~lGOJg$HMia!0>zp#;fS@R|c(wm70C1t)>vI~i;9Ex%da}Ia5U^(H^ zMx>E(1Fo%UzrMXeOlfXRE4-Sr-Q3);yg5Zp$E&`i&z$N+^A*H87Oag$J%psBqj?ImneC^v1Hy?JOxDTc83OuW;c(+1sMgwU2h{aPfp0JS)m+YYk_3?O*rY^5 zF=^eQkr-I~1|i)e-5>PT9na-1r}I>r`o|ol_Rl}NfUCuFb!QxaT!(n#I`a?yx#oAU z=L|cOg)TEz5_MyRBTUW<&Y?N;Ni==^&BSukpVtIKu`GwqqdER&8va0Rw$X-Gud{SG z>je0JHDCqRC=?6C<&I_>GvKheb;4pjM9(`;?8>yOyEx^ox{!@2HR}>J5=@vZ*(oWz zx425M&c*g!MF=i$Zxe~dBBZ-~guVv0zwEQ>;Ua!+B7-O`hV%jpO z*Vk91cu%GQ;?teYdD6r)C+sZyhKdoZRcWxUF8i4+cSJq!lGOLE_s7gWgBle*JS>3JYA=2-ujPZlr>7N6v%jRr z@*mRs94UK-@7?RbpxL{9VdC>It=2oe%c-8Fw7c|1J(9A!z_ou}XoNhdP@_5e=WXpN zDgZUzDxFqh40@euZx{7K$KB%D3QbtcmGZ{%On$i-0s%MO{*adC-Scd!CMJKN4wZga z&@BO@B)k18W%tKDfYll(+~(S?%>QwU%H_D@5%FR+1Rso#NgNpHxxX8$vFiB8>R@KJ;sNe1o=V@QlFF>G#u-r!bg(;%PFmbpsiUT!1rvu)V1|Iu&)S-Sv+pT3IcD5CtS$? zlUHPd0s3?UIcBWDOXdlBJv>VmX*zISgo13?e*Z9)AR)GLFq@}r?&+{Ba=nj{GqN&0 z?Scr8-;CtNl*dEPPOixl`HePin#DZo(fiM|Q2hppqfw*dpJ^12oBLz$SlK7ry3^H0 z7EPR$G7w@{tHnHH3YJ!%)g0yh;cb!PHlCNFMf&EyY@2{)Qj;#~NW}N{i!L6lv-Sqs z0?`$tfyfi4s>#PRCfhdM!~xm@f%iv|^YayDBjf!2lpKHgMT~F%Va*DvkzO9tRF_kF z&j8s({adOxeXl3mKUhp{*BT2btxNhL{)c^P_!<2Cd_fyx1td+ty@^)4jZ`YUpdjDm zXE8GjB4SE*=ZkdrJJ|jSgFs44OAG1UY+If25PRCI%;>{FH|C3Fgq)WZ<}NR`*!aa) zF(jE<5)KP6C1jyoy=J#Ncy3}ukxwH<8_MEwXWTu(cCn%?ky4WxYwjM8J9YVXd)siN z$<(E{UO~WCn3s5-qHEdWQ?-2yZ1DYxHmR-Q)A_dd7+RR890V3b=AZqFf{jd_VnnYQ zZQgze6G}7MDfcoGl=U&39$e+`!A8F+x~hIrx(ok{0mGlj7SNc$3^6u(2rG~jIio&M zkHhiUkkyZ~RDDZOrhGW5lrIXsQg7aT3T)Iys%myjApa#{9(lgjtZ-nJ7#bIcmqOqAfqkC4X<8(m!fyLs`6Q^2$!VAzA6{fRS4`e)?GR{S>mIFVL60)p8lL2|-Exjxv(+e+3$iLETuP(SYT?(~ z>LxilwOV3-IKo(v|3}iN5!zOsU04xO%w@4sS2SO#y~LmkO1#_K@ARb96-Z@qQDFJIC8~Dc;p7gMqr}8zKLvT&*&l)pk*~ ze5sVaL?J7AB7@`T#NMv1=3@iq=D*O1E9@8=Vd%g+jKArT`_SODZ#Jo64eWamq6S3mY?J4OuCbqT$K;^!Lp^h zqmrG4%_a9|Ya}0)I))F=w(EsuEACHqMYH*0G*sm=s=NNLK#v2hAxf==RG04h@Cw~} zt?CVqj2)-_Q5o+$HQjczq}FT+!`5r9V%qmN^DeJy{KXf9q(Z;9uf@2a_knLOx7hT13xSWA6SH&L}1 zbXqDgczo16?&mc(?aliBKReK5`1$L8d_B}+BGr-X0FV(%BYj9Uu-rn={3)t>5^*j)gb#}o1J+d&r4aBE}cBF z>D-SbQ0!fJ-jK51MwJC;_S&v(kSDR$Q3`YCaQTjQkRwufL1sw%5C-B(f>is`;AH}~ zb**0-n_8{LT2I457|vJfQ*In5xSgQgP8L=D-WKkKwsoMlvFv9UqbIajQx3dD=GD!2 zZ00heTA(?c2jO1ifJ>V`B34Uv`v&!^9>+)KdolR#qdQ`ermH#rqhsmL)f!huW;eG2 zB_sJ_krm}ANSKt(e^gztzcF@|xQYnGlefR_@I9;>t2q{21E#tY z`P+cysxoh&l;(CJJH_uy`o3wj`t-uIh?ty`FXj3jUI`rh{PJ!V%OjQAO`}uk7>v}R z8Ci?9PqLtzfjxWM%D<cpy&89wA-?Mx=+_KNJq^$M#~-^lGOFt zf~Ni8MPiX|kw$UP(hjqeDDb^?2!qrXrsihsyKUJ?hK^-E9{gieA%YgnjRi1#4sBLC zR({kyUcVk^R2N0Q|8Qm9v+VTY(#!V0=R!5?b<6!$D#)nFJL)|HpFy$w6??w zAM;4>a=SI)nV!GdjAV)je+aYLzElVF^#YVGu}MLlQ{;F_cLOj+;~>ADJeYR)J~YIb z-tt_eMruG+Oy=99F`J&^52ZRrNn%fEH`H`z6CO0%tc?2ESQ`#p?=w5}fV3O<@EJF+ z%3iS0M|CeQIjz*~|6&VV8YDbB%o7P8XFu@`jRb6MfgS{nuUal&ZZk_wJv_Uf>~%f} zFkWC-uZfU|55u6_5@51YrZHx4=m;3uMpStDoVM1$q+*Y|od#d@C>i5a-xXCm+=C5Xi`)<68WP?(7;=)Nl` zEnKU#GK;KaD3WHQRiiArsqbyJRFQPj!1ulS=Whk^6qQnKErbd;U?QmF9teXV+ejpaOCy-G)Qt%?{!MFVc(=W#7lt=ind(|T+DK{~rM zUK#E8Cbcu}Vu2R5AyR9NyJI%lm4-6^KYRt!*FAB0DAf-R2q$a|;6pK4b}85B)T6(l zccYefCTrhR?J-}s6tiyilsbP2H&su{W(OLp$59o;`>J(X_G z)yj1=j~4;C~KyKBWc^4#SBr(ChA4ie>?9Dl9umfK9a3 z7!7pYSxgk@!@X@%3rtyWv{pyai*{9#u0NQFA^~-g*aK4lczRnr8qu)(Xt}$UbX8Z! zx-4X*Cr7_rNw5S%aG4rHQJqRB!o!R*DBprLiBA-AxC8!Fzzbrr`=r9nPQ$<4f}MPZ z>63h(f+|E(554YApx;3t9G;ISc7;P>(rkwoPzO;=!S2YfFSCZG|WDHj|fi5H`5#gBO=1m`KwxnWn zMl7ylI+kE$p2;*mo`ttLZs73(V65e8_sqCw;G5a^WNOt_TtL;k$J6!@fr-J#7qhR_ z^d0;-JnTOSy|pMiOUa}nI`K)?7osy`j0}=wD8-yt&&rDyRtTzHimD?0)cw>n zz)#hA&c6i&yl_ z0dT^;yA9zX>O{SU*W)ta_3^D)JUC$Jj3ico$bH>2g?W|Ko9$V9qwOwg%SUj?JQ{j8 zu(Zv1$PG^!!g;*Y>&%BPc-rO;@j-T-Z5=1|b`G4RX%{#VAcTlX2ZjLmomy~7NrEHF zeI0Q#gFMoDzD?WS);e=}o$u>Oyr3INfJIanf7gK?-FenFFv(Q)_Dxl^Kcyf0*q2t~ z`?rfc^0w;O=GerUDG;CJ{wt!&gS50DT5jhx+cVc<>6%V`=Y>wcs=?9b3eB5?AWhtu zFp~pR^0!3UIM<5cFCS%wD2fkSR=4|O>bUMQb(s?OXbP!}L}`R48qkK1ely?)rmki` zX`Ina@R~(Fx0^1%`+N?G7+K=Idpu&2{`qtI ziu+?F$zBPOK*rg97%Ilrm&mTJ%@>kZfS-bA%UOZhXV)ZCn{I|8(f7g}{pHkI$GO#y z-}HOWC92%*H8Jm!Hu?G?S*$9I#BeTm3xL%VcR?__%k4||A`n6QagYS8 z;awsk8*VBwjF&y0R)rWs%NOnT-E8}dV17L<%s-CqR8KoAZFxxUwOk1sw3D-IHC~Dj zv8vMyMZ%>;;KNn)`IIC&?~*&ys<4m1l97#@InoD1W3sqcAv8nqt28^q8m1X#CR`SQ z=Ns*^){l-y$2-2GXjyT^M1k5?rA3D-%PtLA$4?Qq&80{@E|*AeolYw@gWxRc->TyU zw#2ln#2AM7 z&mh!N;;zoEYOGa9)$tBTg4dMRVzDibb^O%7#suT`p#^1szuD*<7MisjB3Ea}B$rrO z-BmZ@>7{M7ZKmxZ=KYwnCO4@)_Yv+CW#Yp0zibL2ny)DkT6QHH)^d&Og4uRP9>vT{ zL`LvfnH@0u<=c9VKF&fOaj_BU6^M-t$c09YlA2F`d%4&&oAKj2g#p46~D9b={twB|UC`Z755~_g` zkSokWE=E$}ARQ)kZF!cnu=oUfcm|x>>h@lepX+wQwuKeuV1>DCtMrv1smYmT6@~IY z9W`FHN|+*z+khtAz=p%G8;ZeGV9qR%h+WO{t?*KV=m;c_YA1LsX}oAoxtBrGiW-hNfT0c@%>hcrGrSvP zFYSD#oj>CxrKOVaNl(9ci-9DO7!2}CMU7$HVTNHp(cKA7Q0HGt+a~XOC&v6)!?R5B zZV#wKj6T(dD=1VN@;6tZRaJWiT`LOskBBakhKoP#z@#q|kkVzKMTLq6L`QRv_#`&Z zmi$_;e=78g16gU;hT$5OD<{qHc4#ZQV9J;AaTR+iv=N7ww3z*+juh(?1h>XdQWV(qc3?LYVm%6c2v%$pP90qVUS@ijj~FIYngmPEoFu zH#(Ibu1~pBm}Mn>r+vDxq_o`QP*ux69KoLsIq*$lcs#wmN<7vHKM0#&E|$&g^ujP% zRs2b{x%9Swa=VVA@t{D-*Od9|(23B?j$M~w&KKKi*SC3Gp(NCUb1BjFn>QyVpkRpo zIJjKf8!=@~Gnwg(eZyRj-J?Lgx{~@|O4I#9K9(eq&FCnmI=zKUCuORR=|1Q?$ zxGV1Yrke5RLtodkQ*yd7AZAwK(5 zW4TL?Rkj^?^-%FHUrRshnC+K-nb4`aXY9%f4$1R?KZn`M4q@Vlf?2He&F!$AS`XwE?DDC>_^KyM*2 z(x{i2g~+et{Fqi8X(0d&r;^PKe<(x$IXfC@)fibb+CuMkaD2QhDPmIeC1U>N#gYwx zXg;NvWe~-l>)$gCDPt2F&LEsG{JLK7+;4X`94Z(ob+Uik^)2MUIt}oy59r!$illzz z#(oCBQIz|7zqY3@3l8{x8@pS)YtNtdB{P<%QF386em5l1Ug(@tlq ztc`F|g-p)ij=(E2gHZA=ZLyW=?&r~Ra`@w=W(JX4Tz;FDFh)*;(ZwoVnlbEo^}PB* zP5XtqqE|NOWb*4K+h(`lOb8bAeb$;_;Tgl6lZ@~LHhAVY#S_dj_9)ufH8HMuYd%+@ z7;+vaiH1JfE;{en&md~-OckPjZ`UpjTcEvzkudmL)up-ZJ}b=iSo+xGG$)b~W12~V ze+F2tueyy@e0&tL&mS{wU{(?f0gcj&$;IgDBY`ZCdwEib(wSc0eanq3I+>}Pl5GjC z5h|0tGwu_(sof?w*d@di*1Wsi%D8tf5{CB7#e%I7s-$P>)zk=d=#bP;63c0Tdi-wR z8>F6!uMfkh+U#{((E!>8v6T59|AGSly z-0T_FDef0QV~k!}sK{^hiA#F^8x>mHCh^|i@+tTM?N)Y5G$D>9lUZkZktJ60-!wI%B8np!_p_5rwzczX6PLlXAWp0vrt! z7Hc`Pc@FP4H1#XcQqkgp2baQNwuMORnX&f$gm zbrpAVNkdde)v(B#|JK{}{$Y;P9+|dFec~}sGKl~^oNo`G-E!viQB~RHBRA|P zH00Vig#>X>uB3qd%q=S)2l-lDmCWXTqAw4-RYM&tGI3%hZEj~qc4%67AsC_EevExJ zHb3jw*i1|os8vrrwNC(ltXA3@PfmrYM)T1nIih897>4h+y$@VwS11?#&Ura3=BM>+ z-`eh^V!#}4t2O;s#5C7`3`NVEYnSfUz`a!H)GCRvui1q>Kd9`)rYE0sbGhu*S*-VP~%*!>*<=`)ayFUdc5f zbq*6{I~Hu#E0Y4FNKS_%CD~5vnI^49Mvv*Fq4a9Nxz}c7c^0F1lD8X%u4x^*W~gTm z^H}`r`U3=4(?v|&p?!_1T3lD(j=K_}e4$)t)0c+}mI|U|Vce?XdNsosTdwnF1}27f z1w)4r83$LNhaDt+9c!Qb5K z-3J$_9R#|a6nImf3s$OR^!HZnRg-iG5x$vXnm=mweczJOe#BK6|68VGppB%#+9I7( ziz$uebWLs8&kc$UcJl6zP{ZDg>u(b?UgztYD=mg^a(HFvD=?_7bUYQUlCT(5Hn@o~ z`0z{v{QUgXoXv?htB0Q_rJAZ6USR>yc_{d`kr->>LLSNND)LCUj=Ui_18kHX+Ie)e z^CRa>*y3nmI(04P&ZipJ-f)w6J-;uCWWHrUk3k*zT=>43zQ%6q-#jnXMjQWpU^?co zC?v{=O_jU!sVq5)HBci!N`6Y#UXyIU$J=|XH6FZq2mmSv_N*V>)06Maclmlx@SpQ* zBwUYKYaFrxY!lX*9C5eHvM2=g0dgUMRi9_=M@!rN;d>!4a%)X?$%pzrnqsR;ORGt1 zpUDnY!95E+)k`yy((Qc(y)%A__Bn|a<`;U`-R=u7k^&v&DrHvHVTj=7JigBjVHG@Q zI+?|;?lI1!S77My1%8cI>MxFyFs%S-EE~Q^C5u z(Zp`v7p~7OCwn8|H$l ziwAqAF}8eQ_ffffv*HVSIqrQ^8BcC*+RW27W_I`0X6`_3uBSqi<&4O^UnN)UTr-5i z&GZSEp0T2azUnyd6z5Lqv~tt6g)%@)R3}T-Q@R^*OZCWRxbt~Rz#o=;w{QtbdN<1* z7|-=H?;eN4GBcktWAQ4#%an?xuC{+%YW%XJl*P6eExV&?e3UA}b}=*);8m7X{K)soK$~Gb&apwz=CW%@-d0!?4idUf)KF@z!YE3v)dp*Ie>%)g7 z3}zeIH~8=~fckl~X!W}QJ-x0v8_vt%M}>C#s!j=;#j+&QqQ`OK=G?j*RH|IYiW2GVgM2nXFkMWZD(d35TWtA zp~j+0Rlj@blhL_}yCRFOhXicMC_~{1_{qlMV7}GN`nS&EgRjeHsbVhrUq*zAfUJfv zl~nM6f94I&O7yV!wik7&J5Kbk3hUl%G~&B&n0A?5Zl9;-wi^TrpR>modvV4XuRjH) zTMNErR};U;CcQ~vcIyK^Xt2RCsoetOYN1>fH)1SV>9>0{`87S-QBVp7n+x1 zn^la)xRv%9u?y3^h~A1W^>5)sI^Eo;GV_HqwFd;1nI`qI?71c%I6CU4hHy?h-KTH$ z8>?n&N*;onOL%(LA)DX%fb3jW%BAUr%T_!^e;IY8(M|(&pimgbpCjTZa2kp#hozdqiZ75=|R84u@QumRhJySmElp_Z2@#Piv3~m`;{{Vry0$5D@OX_ z?=vL}%8O6cO-&!S2?`@<;k+&PS+g|`>`V&KZh?%+zch_Y6?;3cwC-l~r1SNn)7kBJ zb$Q&=A|q|rZ0hxq`7toQOsbX0+j=9@Q_fkdZBnZ^*we-gm6fqrWKE0`?CNAE-{G*i zsr$Bdj-A~b?MaANJ%4$7&ftCUc-w&Le;R}bH?P+tp@bxfL|p_>botfTV1aAw$%kn& z#1G1)FGFbV<=I9>n!ro(+x$`V6nFm9c5Tx1*RK9Axy7HG{H65kRk%IbX`kmV^z(1! zsZneD4zlVlex+=`dr#C=PFayX;(131_#VLS41bcJ+DJ#(>aCW)bBnuxm80QzL$M_?)bZPv5iLe&28Iep z6czjFtt2Bqe;%5SB@YYuPoetXA%)f~w^%BpUVFT@5JYj5t4?Jd9?cbF8`i6yXy5Yx zI0FXW{5C#xi$k&43AysBY*!UQRbTQ}beEKZ|I*<$VI}9vIiQEP+uLH$zHqX{>;ck$ zf7ZAm(m1-|DZc5ac8+9#!)|5MLh=hokESebU&>qT1;WsMC&UpOf?kK4reCk~C4IdU z_Wf-wilnir<*$rFUvTCL<)-k1pP`2#1!s=Wab?F_$dRH;a<>OKykZ=->!exs%^MaK zOS#zxV7D_FUF-~`4dIG0s^x3KWb&9CdSf_2j?tih`q*pQ9wb0mm~A*#SD@n(JPeMCS7eTZlBaN^x&rJ$3rH#3Z#tlrYSE{ z2Nvj4-dd3^?fYoB_I)C6jwaj<;*x#^shbG8y}1|u6yw8KsiAZ{xvu3BKX08*u_Y_L z6}J25WWjdnP>nsOP$3Pu5yC#=c_z3Q;qig1h_C1g#uzba0wJ{G{F-}ZZ(4i~B*r9i zKa4{l^ct)UrRCPfwr98%L@;8#4f2r#2<%=`ea?x)D}2L$hgNdm&&Qm|e`Kxgw|RrV zKfWOzIm{Xjj@+eMoJV5_*M z$ni5u_kPH7*Y)$)9BNx+37IHSNvyNED^J{Hu*74yZV}uP*VuU>XwiS4u9=S6HiJaO z%IBIJOA{%uU3Np?Xmh`?OYL*MNlMXY-}exFTnT4I5f#_a8VWKtVrL-d6*3TS*-xOb z#c*3*^zQ-T)lJzbt!+OxdAe?zlG$5Kt87)TjHKC1I`W>1z9GhA^J=*5zTkhkLIyp0 zI@GUm$4bDw1Pbyags6CJ1w!sUjC3DW?1(?5I{d!R1kwXuJ z)%$n%M;)|9@6BX9d~gi;=nX0GI3gndvPx7^JES<&7#Vy8o6RcyP~Sh>qWj*-eZ57^ zXTJ!rWKne={7__^g+7*I6;fR|(|s`cF7uwvv9x~EOdKZU@Ol97B`=C;27*cGsok#B zbstWlzP1`OF)>{~0~p8v&l?>2WHcgQI(V)ya+h*z+ZaNWBxH`3_5Gh(joDD&P9tk` z$fPBz*9)NMORXo%N-DmRzq0~AUBLb^O#iZ#R79Y&=6+A$+x7bg zaPdVU@Y$=y=(qJ@MAdz0&6!8`%p^rR>hjc-eur-d3+rKxvww>`D5(KSoMry$2KA^` z7|#6N$>IWHIKWV}wo>hEmD&E?2apaV?Or1vJ)W?YNfdhwSlaYZ*7HAOL&dIs$#Rzz z2+t_}cz=tv^$$n%MkAzku-Z8YgU3w+S&=kt)r-z{cO}KT@GQ4<0D?_p7SYc$-p7zc@Y)?QcR0Q}pMv+AujS>2>|O zmB?5rMZ_Rx7(QXqORjzEVt#veAKF|b|LJ4^(u>h*Ys{un$1~(w@^KI5NF)dTnU-YX z6e&m>$_SCcZEE$4{hLKs{9(5LHVB$9<}_F9TA`R zPx+CF>F42WHT0Jdct7sq9Wt3eaD$Wg(0r8oZ6?s!I$BNr&jg9_cSJaRo8NXRSu)0k zUW0XFohc`a0P`4D!yQqQY!Y`WKbZ#mP5x*;Nj<*$L4J$rT(o`!qR{?zF6Z$RcrK03 zTeer=%f*<_n_TErTV8*dv@-mfOF@MyK<&D-YjTDHw_9P8-|a%PgMn~(ha9Bo;dEiF zE9E$&cO-os-EqOo@6X( zk=}7bSM)!R>1ab`rC-ckxT?-7pnGF%MHB}%Cm5l6Ip!R?1;~Wh>tB+R9R`+;VXv=& zg>&wec8)mEdy=4O#G`66jBaYLj*8kX28PT+-}W!*p`p2mO-B<4%3V(U!Xv7y$9Ov} zAO0A}F5kRu4?0Zg@yQ9>`)4&8V)0)V%Vn6U;qmD!f>dXI8Udq^SG#)*okHiM2U9sT zv3&2Ptz19OI1xe&L#AP&pc*cMc4gD9!+rTGVQE;|J55u$g4f$*QfS#YT9BJon0=rb zwCl#T_CEswQlOQa*4Y*M>MC(QkB8e*quZU_K0CoduXX&{{N$&MPH3E~y815eI&4AZ zfcpfMS@aNYx2lKk)(fb2+_TG-{_E-Ad4nSAn_l7}uIn-HTx*GU{!s6<{k5xp)2muZ zx)ko@JonE2I(HhP1E1T8-NzZ^e$W~?BMnLraR-;7$Any(6Ppd(D1!BJ2BhmtVU9nO zFfF*sE7vOhgf8=G?_M?H5I2o_RpLy6c-l`9q=4>)*E(Ic(f%=p&cbcIQE8cpx1d+T zi+6^n3UR1LZPvp|p8LTJ`(h1vPbt0U?vFXFh8LxZgzT%X&w~@CHd!nZE#X4^r$z0N zRsYXuCRzQwA;%9G-`VKQl-q4)Qtta@^KX#vwiz-cx)BQ?2LGS{KuK!CO-^NTz#2==+th zZXIfXrBcI5k%0(w)7v$B9<^o$Z3g5HM55!xXx-iI+N=%>4 z=YLrC3dOJT|CyU^A^Xp`){<`G83R+3Ow?hp)?{m%6UK*Gk%t&VTy)bW`UXK4FY-f~1zgX6+`&koxv=KL!?jo??*&ZKSEF_)Z!` zJNkcUd+Vq;lD2&~kV$Y4?!i5{dw^g;gG+E3oZv1&f(8ig1W9mr2?W>RgADHO4qs>Y z+2`4J?YIAY=WsYZJ=4|I)m3%tb=?aDyvnA7Wp0l(&qj~KS8lV&8JRj*7vCdc;4P6e z1^9+v-U9olG-xq`fP~oQdwB{c^JRbQO4Mg?IO27F zwUKL-|C;)!9>A9z*?C>}<{RfiGphs~7F0@ehr7K^XQfHCtE|Wa;Ltwi(J$kS3IvwX zMj*5r%)2Lj@d`+YFhN5lrnmk23JGa~s2l}T{JGZbk~|0Hk4DRmYm`y(4km3b#V3mx zXu`(VFj1O#Es7ZJ$FWhuuU%|J3%!J5MYP}-O}X!*jjFp7&oLdC>+L?ppKDyKqtmLC z6%DwW`ng(ot9q7bWH4=Q$^VM=Ev)w*8;>=a<}M^7=8qCJBwKV=%Z9Dihq|jLk06f^w)?O7QI)Yi z!>@xWET#4KF0UOI4XpOHt`M=q6+fV(A9nR2_vdhv$y&Y^nLf(tR(;g6{Ursz+bD%{ z@k84irSlJ`mz!J&yb4N_*!e|zYI(jNDu$U=l_q1et<;1ycS-+fw*ItYMIxyb^*enB z2`BZ`XVQs~f*=2cEBc*cDk{~qe5gp7v!ia`I4ozR?2A`cnyg=dcFA)!zpxqcMvp@M z!u_Q&2)%6!<#B5KO5H5!hWjCbz6C0{fo5(W>m{(}F^L+>F>RLFsL)=h9_uUuVUTYMJ2*lwIK=VQ3C92Y(9 zhKyJD{faQJ4}ByAJ4A|#Maq&f$FWPqs+P+B6ElLMlS{lpZKjyEfxN^JV;Ad8v-)>cjBz;l`RWMyC7Vr_Lq{+C^M+z3X$Q5v36Z25O zwD{El8PM^1KaJ>Bz>|#9{pl|%G;&%hu3w;X9Y=QncI?icO92hdl*A>d-3haY z6J({8o;vL;*_6|?#gr29TA<0;e#mbBl;bBP?Jxgqp2Gz83wWG|1JKa9K-QK}-KDHw zAe6IMzGT`(t_Zv?T;qFo-^*E99ky5P5k`Aif%p#hdl--=5$T->FcSRVT>F$0ot}08 z9k>FKtx*-YbX6Gn~9_G=?P!HF4UcS&*F$lc+} z5lD$pU}ywvlRqPgqX!XEQ3NRv5D=8}blmFgmYNWBLsO2Aj+&<82Njqa6##e%1Qh-_ zDH!2#RLJA20ROdtBo)ax`TndUUStNn?6{XwQak!_SI8|6Ycg8N(%QOv{O#C)Hk@+U zi*8)(&BOiK<(RIAPkf0FVHF29#67I8Ha%U>;T=SJ#a?rzM#h1cOfP#Sn~FFMD!eOvvbizD1pb6W^tkq;#$2hr;CBh zB9qlF@%d%%C?+~OEfhK#c>RvMpZJ$S@5X8a#rO2cV!Ca`5DAnGTcc^3y+D7-5)_;= zyaWKEd$G{TgrGu06Kqz3zrviW7cej#E`87WxjJjEtfQY3*Z{Ia3o+$2Ht5> zny$R%nHK#cn&MaGsAmg=-go)^D2LZ8k?5D5!&nnm^UN_Z+bZ6xx6Fvr&Io?G+2qWQ zg#K89C?dX@JlJ?xAC7bG1I}pDeOGG8cw}}m!w`16yhp**?i)1CqWl{6Um#F_1<(5L zI-Qe)g}U?WbK-tw=02f3oTjvML=YM8Fng44?Q%X$*w)tZ^=$|&k9#~M*7JR~!A=pL{Sj|Y0?9F_IxQB|l-d=lRL}oQ@ z=JZ*Xgq3WY&FS06VTndvosz~g_JYlx-&qvMLqm}P;LUR7s(p0Mv~XF$cS-%|{-YmB zligKZo;lOG)%r!iGWtW`fA?{Ve9;0)Jvm*s9>7liGE_RGelc(OWN$=$q;rNI8e4)! z>uP-j z3mWy!rI$PX^&IG61!6jbaeC+QCFVS z>JQrs2sYb-K5&q(xOc^^2iU{?Q_DTZu$m{Yt*FtG2Y<>HKq8~SE}32Q`DZkkL=2VT z{=<0u{3==+)Fj{D6DVhyHW>5k^l9US2Z27tb?FMl1!z;t_6#K{XYDsDH)wG~%8ymP z%$b)x8}Y3Cfst>r5M=N0?t-XSy)2t!lSeCZFNx)b`*m3@5uVOuponDJ;}mM?^rp^S z!vH_!Dl4R;*$C zxSg%*G6dJkf2{1D9h5yS0aiQ2uSl({A!+z2Kg@3yj)$nxj)e9R4YEd)DvK) zIln91ZR?XC0JV?p+O%-Yq8%mo?{ftudjA=@Sp4(I882jt+$Oxv!FN zsD1W^9)w~K*&A~wi-%K=6J@g;TyIoQw92@@{}r0?zs6e+IjD*1n|QF;8?N9~1=N6_ zlCJ_Ah9%<>opMcXDqq#yDgO%}P0`4)c9Z0F8vZRI?<5qd|q-R>Unn}yCWq0B~wF_Idv`@_H81DdjDjTEY8DdKYZ3uG-86~ z^J4c16`0GoqO_ADh)(`sm~!y6Yyy?RqTOM*1IrAESq9+#h^n1k_M^v z;e8CETG!4RQ+@bK_3j0^A>sw|F0>!)b>{L2@XSVi%(^^`R17YoUWEO-EGd1T7>>@3 zYU_3gL&Fdf9BH^@zb!kx(XnRohIwytbBrdR7L*44=uqt;YkbK{5fWeQR2x?~G1elC z^Wjb18?B4v%()@i0>lx~Ckzb1!Qo^r4l`wxP94Mh>~sCJ+EPk2F^J2e^qbkG=&|;Z zNbv=wD+m+i2l0jgrC+>@PvIR8IZ3)6J@df`ACqd+UB=ez7xDfWqF{!9S}{O=CXi=^ zSOK}Cta$ik{fxmALAl;=-QHE;tJTjmkEfhd(7icx#y0d})61Pm7Az7oVZw&3P2tP^ z>KvQcqsZ%K7dqau=7vD8^M;Fsi0)=GihY*+v}T`EZ+rech%v*#2UF+0>Y??7M=HkS zgnOvMVtHr{c~81PnTFc^RVF2+&Lmf%bmP5>JR!Qvm}QSq*ln@LloyLOZYy{Oc|c#% zhO}lpeDFA4qVa|+e2VWNQC!5FNi(-Hat)4nj8so($XjZ z^WoWg9U9e42^I2lm~F#XZtgVN_PQ=~U&rD0XFR@OzAMh4EJ)nRs7 zdMQtGU*`Jj;+ak!Hc!ct0$nASy_6yLVR021>(m1{HV({I`cQOp08h!2eYEu1%CtM8;KQ|N%7}p z<&yWb7om@!H~&yjiRYni^%XNs`;%S%J0VCJ9SiRYpox}2?)~eZ9sA0EN+*%4CKSIp+1v@ADK^i*RV|Tf zP)e(ye_{$qL<);)-Oh4fJD!N{R1*~7k0LZkFc2l^!zU>!3ps%ss64Yfn)3$#5TKZ| z%b8u^UJAm{;^7PkwjGRDkfy`##o)p>bTgh-iVdE$*AIMCGe8iVLu1{(#sg;m#oqZF zGvO6kH^yNeS<1=~9o);G`T}qIBLV3h7d#7xVlfahf2GPv%s$78WQ%Ixnp2H{)>DiZ z)Z03k7^h`H5GM7;C^E{!hWcTe8v8kc(xkIG!Ix}^0^`~oOERf1w^&Cl(H&CW5gR#- z+g#pI@%o6J%y$J!2a8rx$q1^kx2JZe(J0+UG`O}y1-4%X&2|Ng1#&u9QO|c3m{}7; z>W@`;9bI!@N~M3a93=U8>~zhiR>?x)Xhlg_q*N*wad4G`a*SA>J;bh zZZ~03KHhuMUGRx(mgG}=6D-cI>+R7V7wup6Od)FBj34q7qIwT3wZ+E`SYj2p1>Qwr zn2^`#DVM6RPCId+4MreE8TYr5W;>>Fv1DQJRt(}8&ddy%{iE8m2WrCN@U)klM;_XH z!R!6&9zZDm2wFnJIc1eZ;PSP{T{Chw)kgU6J_76WyR-e#+aZ><#dv*A4*R&c(s}JB z&&MVg+oii_MehR{jw&qIb4I;K7{9p8g1dIOIE<@%J+uIkcQiKAzM)_>>REO6#DD!u zK$yvJvTf1)ymycWa-l|Rt4<4%5on|@g5-q>{+VL7vWEra!~=!6sViiJirxu*)fxqD z9xU)~IAiW>Hz^sk5B9mWGe7-oaKjOtO{}1W zh=(S6I4=1ZqeipB{3HH#&(yKGG7MZ)UbPLjf71L{-C>h6S&W(-9R#Ie|D$_y!@%cE zv8nT_qSrzdtuMY_K7AIq*Dq9-%sC9dgscGRi+BnS*;MLEIbU4Q806Y< zRl=Z&$Y=X*k9T}TGRr>2sJ+oyv?(s;zc&m578df(O^RG(re{HY-b0FeO zvxq@NWTgrzD|=C&D-Q>$>Rs=RormkX|MjxZ5x?>BSdW8ylp&I?Ms z()T%wj|k-}T((HPynG^^`!qn=8f|%l_pD6bh9voUYV471cI z2z{ro$qN>g70aYF@rGC*r7*laU$t9B98cdKeQfsZLFLI30o%sTI%c6!&L7ERepSzZ z`>#W_=;icL_CMN6bS3=vZrz4`m~S39=~?ljMMX~ij+2%jhM_GmbRiW8n8fz8?V$;c1^w@6vmTjXFI^rsaNJdV}vN4m)u4A7p0Nm{+;dr^ZX(` zKt!jmX&3q*SBx^19UbFKQ*Skz33qko?mR6T8r1@g($;6RYTBsQce*t!541GMp+^5z zZ2#iG51B?piL2vd#jobNU+U{c_jd9P4laf~)FBJ;W!Hb|5LpL;tEp?4RrFu`hW_Hx zw%25{Ar;j-FA#AxX;byi5C&dq`Makbv7J)$<&pQHfxIm~3C{&0&GldGGqywA?snhEy8DFEpozX4LQI`8cco^FjzwRq;> z9j11;uMAy^UiQZ1%^+hNnGGh=bx%-SYN-{Ov-YkW_!QGy%*4}>iF`<) zB_|=#6!%q7+0ab-SMRfe*N+jS1&>$LtEt)KzRAtu>e!^dQVQ+p>`WS0%g09;;&Yg3 z1#NgEAZShJ*dNb81BXT$FRxt_vStGQH&b@KM4{<=6K{DSaO{5Pvh3nkwK3R}P6H?S_ zn!=h%I#KwB-DsxTqxRe_ZFi(X=zni(q;Hu0sJfK>gW6O6e(ObF^JgoJ>b$-=ErdJwlls7bTj57Wqu%BM)N?( z-3=-aiI#srfXT6KY%T!kudsr!{RA!>_l}xWc+GODu&^D+45aX@V`9d5(6rvK6CRI< zQ+)nOuw^=E32-pgaeyb~x_}%x)vr3zlV1uxtN;nwb5(EZ>Pz*7RWklj^ZngOB`LIxbx_ocBwhtKy9Zjn zDU{jcb6WfSA-Yh#^dpc)mK4$KJ{vew$T_dC)#Uo|%Ureu(uq}QyheF^3YCp^g=_h` zo7cE&ly`o%ofLM!!6sB*&-31`@*q}0&>+1y_+(>Pb|W(FvsqN5@vd2hRws4bQE9Bt zr{ro&!l;ET@ux_jWf#e)cz}K+#ob8wPL9Ow(%{OrQ|887!#9!7xF-M;V28XrXjFHf zpI6bUwW318VSE95)+QQYeANEll(cZ+FtNHFqt;?}(h59N6?z2Ht9Tb0r><1*8X7}C zq!*p;vXJY4V26Lbs5ofGFAt!6z}qMPU{L*DStdI{aHXCzR)FYvT_-BN&S33ujUGzl zR{$s~*J@CS!^x6JK21cI{YM`fS^FD0Nh3o*lhBG6F1Q(Rl>-wdL+nPeGtQ zqCwn7WkJ=QiPC&%QT69{TWl3-C$;V#ZYhf0hqMtPb&0EX-H{~hJ8KMawF%zQ{ z916qjh=8LLka>Kv4q%eSzl`P%EH8-%7iWWoGWcCy1GIW9IZ~}&gYH9wXe2_$A7tX0 z(~M)CJi#~F-^&I%g3xeR<8yQ8CL#|_uh%{OtRi`NF`m0-R%-V7f%4Y}(N>~2)!RkL(Q3eg=HH%fXGcxI2 zraIROo9KAPs}&U#*aP+QkmqfZblIP?h;O|lz&HO3=poteYlS|O2QHZ|~x@;TQPEB;2 zYQg$P&GUB~6SsV_HnsD*dVoXjmEWS9#x)QOSIZ!jK zH+^Zo!Epms#m242@CkXiK^XDNSs?kb-zZAxIe(4qm}g~mu0cQ$CZ@wnsGCQX9G)M$`)n>EwxFj6c}vXBuI%U;DjFL1F#aelArPqUu?G=wSkePLa=rE|%f5f1AOCKk zUoDzq9jXb&uZt|2ekfPtM$hA+*lT~1l3*)Y(_8cZxc0Yp<|r2FxamC0J?4#={+;d& z^b!i}OaFFMfZ;L50nCyliTJ($#4`R~W&O`s`eGhFLv#3_y8fqt)gQjMc!~# zE>`IN+lLrA>_qtdXA$#vXMm6lK%O4kR-yTCZ}1340WFASo#9`KcVE!Yg#!!lUK8kW z$^AP4Ap)CDLK66QUH)&;hP>!xrR!Ih|gSjlmbt%Kk0!wBLi- zflymcLBoqj8Slgnntv%&fQt>}Ga8EeNWd`AhlDh{JQ4l+OhWYQb275#S4ho4P;FRg zc*=*XeYXDHJZo44n3n!Z$b1t2-uz%i68nY@qM|SCv&=_NXhmRt9@0^@Wm?JfIyC?8 z+}|Inwk06``mJ9TSv0x0WUqc%^k-RIS|I>r`U%JR!_BX){!I%ZQe=|(`ppg!&!4xi z^<)J&92sf|2;#>@;0Ce((jT%j5F$2eOn4HztcH0(DzBFo^ZVeP=nYn)Gl4TbSeww_ zcl{4Hi6MK78P?Q9>Gd}A^Ki5%A}$lP0WNdTx5qatI!Np$E5=JNe|h#-On&VE4Q)f) zsl)9wYyG<|WlQV$*{uJL$RC>h*)K}%N17F{m>UWNAwfEZ$@%xOZ)AUZsVRZl> z%)0OyWL*AEOR$`Dr-#SymlrYG`loyR_ws!qm;*f1KB!kIUsU2h%(VY>4u7+Va}zPw~E?w9{< zKTWj%u1&u<%(seMxyJQ+e^{@-HTK_M{&Hjb#XTy$z(3#e z|NiRNYyF;K9!4%DR?xldpZJF%{9iXk@``ZTO|B&WRrArxuuxW3x@yakgnu!DK$A`H z*TSxt|6SXL|33~Olis_3)d>;c)f~p-Nt&o2ChX+?Z@)$qk@0j7yoxH9c9~b zCmrZtz8PQNTHJozleB-;I9VsC$w;Gxr_-+9@Lx?TsGeReoY)Rv1^{$_Un(lMMxVUO z_t^i4*(sa2XEL0wyI+5y*PFnt|JCY2l1sT%)XQSLuDrXjCz-Pll&5fD|4=nr4xTFU zCnWr*&Fj}yJlf#vGQh;BKX><0YISj`W4*?BtJQzDsdb|lSKo`S8a(AZLypIPoS*So z{Xi;hO!@fR9hwj&z($i+Wi>x)m3MG5+{?Y-&4A7DMy_`dde~5D(oe0Dcl*4w>DbbL zhhDX=tm*7rF{#zg&k9;0QDZer-Kvm5&C+z~56Y8GSgiOWI5s@2&=*ffAu18Z$E{oO z65;A{OkuFtHFSAs%k%#|#(q__iww18p7xWBnrYPd?8eU?9{KcUkM+eflqP+>kh!oy z>;GWV-`U;W4PoIVxoof=?&f!@&6qPfJwJc_PRaQ0bt;FFzdw=a&`NhCAfQCPXjaD8 ze^R*-QV^m8hdy-VvnKa0>YeBL*YQ=-pXvBP!{qfA4QBg#EsRWJRtp94! z|KIJ23<4V}brjQVIgIORHvQs@TJ=}e5#P6k>w_kDK0BSmQ|kL;ZB~X%MqP6LB1U3^ z>QkRse7uijGS%28V*y6nK(&=r;JphSU0gT{x%e#hp3fzO9=Jsk@q+NnjyOR@C%Cj^ z(|I)36LoWfb6BVvXUGe$hRT6Bf- z{+~-w#1q!yIW2gh-g>sSKf`B;GuC0P*C=D{xDIfavUv>YAV3==xNM+|4~%+@04YOX zE*h+lQC9@J*H5=6A(wSbY3rRNoAJQrZt!TGiqDOF|K-#EhO-?LfTmNq)JAZ_^Ckd} z#8Yw7c8(T2S@Ox6-?{H_i30TPWg%6KV7Olc3+2o7y_?kPkopIYZ=Ravmbsa#EL}qq z8Pc&d{mVWNoHtE$JQ_HR*HSVG^lLh(qDu-wH*!&4u|--N-Gwy!iDO!ac!o2PJGANr)9|C;k8fmz#hJ?q(#?U;80aiep}%5)1j zKm77Y>V!ZLk{?y1Q{8vUpx)wdkAInLL|SV#OV4gPhbQo&|Cbtc4&oBup4o$ z%>wm&gOg)PzTDR6x>xnx%f3y`gmfC8Q`|=NfOm$FLUKzwbIRfe-q^npAud@WA|k%VJ<&_d0uCe&mhi6e zdPxKx*|V=oZBH#HzV-rJ!`qrV!>ePSTAf;N!7IsbPYHC##-|g{+bITJO9K`>RoXi! zjBo48sRs74S`Jx37eiV|8-i7 zpvU1{^DZi{pC4Q?{q)Owcg!a^xhn_9{f0u{uCtg zqb&MzQ^43XTOj}dR_{V8E8NfMzi3q_^F|6i++;MlG96w6)TXkygE-BeR}}!5UkeeN zkv8glpLoMt8;e2xt1(Flz-fYh>ud|qClw-lTo6~X^n9p3|LLE>bXxmRq+6?YY?;~Q z@Trf0hnSpr#wFUzNz=7Cm1_-Icc9vwd5RXVOmAP2)FXo-VQ^rd^+=8Fh0C{(skKo#xq3xGQ%y6EEBus0k9^_gem*px+vH!(_` zdOldnqqbkU*2H0m6fGUmq`#Pu!6+0BiwvEd9;Aa5_Ns;qfBtlS*fB3xw9PMn*hom= zjk~`yr@3OevIYR1Tsp`XMvdgKL?NO9aQ(8SO^o;6_d~vGL1%=<<2@hkmjzA+DyhkC za-QBny}<=r0gtHIq;Af9pdgdkYA_f!snPi$CXzs)2@i+*$?5mAxt|f22!f>D95$2w zB;Q?laTPkix^VUQX^II;~6nS26(X8Lr<-_U76zW2AI@o^V z=bUv5RkyY(TpWZ!CMRoyW~k-Hy)o-T&8XxdAeJT^mHd19Mwf%vSfG7rCkw-TWjh)G zB5j2^V>wllR+P!Oa3bwtKl)M;r?E*>7AYlMiHSE=%7?d5wfK2Ja1)(vGcV;N#+!zC z`>P~VK~3wvIJ(h?_b}A`>22qb=)fF61CoT z0PJ26I1{j$+(QRQu-HlaqE+E;9%Ovv32kztrcK$<3N=xv3C_&Pw}y=7Qj>+C*{#r=TeWE{e*T{8|c2B?j7GJLL+ZUyY0r*}a-z3v9y-NKRRH)1+<4zwq> zsELbU!f0|BCwbpP@~LUH%l#?r!WN&-to17mVUAu#OMoF?Kh<|f9UjWEX+9WL&PWfw z_1=fH_=~vG+$k`JnR=P@#y|!l4?esAYu+@|oU19~yl%BPBp9Th4bQZ)XeKaz|CIBE zuxxzMad&tUo8vn2mAdRJBT~T9^s8d=9ZuVyCtmBhI6(WDpzkfgelH>PaLZ1Yxi$+_ zIH0j@xr(pHbod@ZD!@nPiBKs+7914B_dpAzgyxsbYBTFKncHaK%OFsMJq#qVuV>@S zi9hiJO3NfY@YjIf!|JRWR=2gi(<&#g914p**?mf$7l+#Q?w}corz3PY&%9QY1=R&2= z)rs{A`78b_4|YBek51kbn#u8Nw~G0%y)+lj>78!HAp5T{8`ZJ&#@4#c{?5AeJ0ZQ~ZMz%baT}P{#@m*!L z0o&nfb*~Jt6wB6|PmlX2#W$MozQ!QoGV?sf-b62GU0g7Stf^j$5Ntc}<5_#KMg}4>0RU*MR5WLIx5wPLHPVdGzV(@mHX{iF>Dsucjbu%unNq z)blXQ4GO@VfRZH!m|3C_YwcQ#FV|m9uRG9OqN@2(2)RZ^zjw%wxB#gq)QOs6g|r&h z$&rIzIuH7mBbgsLd)=b;R-)=J&!0>@6}nvX8hh}ABZ-O7LflIC;M*#1G0QsxG~@W# zjQmf?+dYY_!buhv3lEuUe0Fik-$2N4Wmb?@Q<5N9ctrYaKTUmnVQ>FM*i_upY&y_u zz_#2$mK#oFod+2nX#s+LrvBFFp*Z0K-`peE4s)sMIL`xUR0{diL#k4r2X8*_eXOp9 zcO#^-@r*ynZVRc&Y~)u2|Fpj^zQ$_n9L2k~4%WN0F5L}ADx7uM%-mqD?d2=R3uzr= zT?LA{baH+tGz!YpZg#IeX?I8spv@1Z2bzu7sn&QCPOnj{A4b&#*GsnS$vM10t@$(wskPI<=xp-#=6eayd_u1jXrBrmmR2X zyI2Q@_NB`S5rPUQcp^rJ*AanPL`rk36A-;8P+;VhryTP10e*40wxi*CN1*0l4D}Do z<5g*Yq#r-*41Cm!gX-S^Rk{y^yX~~#QH^NDb$TKlx9Zw_&XV6`vn&xq&~LTtEpzev zSfyS|aq@rno~gEF0k{??$qA9RJj%oxO_#0^h--fBwdT19 zjGw-l5v%eR_CKwDd8U@?q1EE4SwsnnJ1bUeZZIB99z?bXJyF;XMV#cbo$_FS!8~}F zES`N;f4t^o-tEL3955X4K}!?6w3AA{i67lTBo-1+d6^y@+fkpFPJ_(0aU}*Q*6zf4 zgCB~iPPH0$+lbF!!m&_KE^ku0_q`BxwWE@@me3Sx%!(25)z0JP z+1X=9QO%Qdt6<+FHZZDX`tCR;Bwd3@jm@35Cnw4cPCj@n;^LR~UKKMH zvV>QDnCb|h`uY%BWidZv%&FhfabjdJ{ z;$vnk=ZYXBflW5QEaEG`t$e#{50dN-$KOdcJ9BB3qTY>PWLgh{E144)hrA8H_@I^_ znG-135^dxOu9|PWFjqWxwD^%-?-nWS{i23RW*8`3WrXR*tIUAvX|TQ|)!_SX$hXKb zdr$N|;@Vn@Z3~zFe+7?^ zCPzU*(P$fXg(xevX~|r@9G%`RQzZEedL}Wyb2zVX%$wn2Tn4oP%K20Q`_WV*sYC1y zKl^=rpBw!K*WPJ2H;<(5A5;FJ>AvTaCk6G@$tF4|DPB1hRW!xRkNh3w7VY)}rRBXmTi8@No^2Z~9^+gl9j80b&X1F=u zoA_$`g!9#;7VH>Ya%SmPTu)ThcKV1-0==e8Y%Of33~k2^F0(63JL1ZnWC1xdv^%j1 zf7I+nIdSSq$NMMnu0DV!yWXT>cmPi27e5xOwV5A0=vFE|3^GPQzJY)EVI-L{4S&uZ zoL<^+0lgtwD>`ci5ZF%~%iCQRyud?JRPW>_o2u^J7X?FPoGx`=<|^r^`jQn3(uRRV zbrR9Bh>e5@(GxlpqeUeGj88W+mc524=<*tw6I59A+Q1<(yAy>|FFH&k@dam^4puyh znOXz)#~Q4~ZuTSEG_@@2#6G9#?FINU&Y%v$JJ{j{KeKK_dYoEG;<_jrOXVT9(?*eL zj)HUdIlW0fgFIj>LH}`uZi6#tl)cID`rGd5uU_{TRh0^K#b(egs7LC~*{L7RYzKmI z)zb)qdXnYIZePFhRbx?{MT&>;PBZ@wVLnf13)(Jny6n|0ovi1(tfH-~ZM9fxI{+aQ6?EUJuVwwrF_+sv~2fUB(+-^n-qyzEw=VjMIHneGm#T7FD19*=&K5FmEe} z#u+4=z|5|z7=-sA1$i9L>#)jU5{NNSMd06|CUOo~)6&&nIXTRyU-l#M)03TUL&iMg zweIYr807h#8m8hb%b7F3owmP6>h1X`jMz0Tl4miT-aLpq3`aU{KQ4R^(v<_x)qSb5 z7#nimZt5mg4c$YMLC%?DPsVobx`e6~YENNgR!0I`{@~G5-*V*p&CS^hw=deYEl*=x ztJPMH1lhc`t1XMy^7s>X^%c|OisWD-Yln_p1btX=_4O)H@Wm81vFAg_$|4v+_SeIp(SU6sNkGhLf~G#-dnBKcu8y^(QX25XDWfrP#>ReTP3ZFWZd zBfrMsDd2hoRohIa!Y%@;lV@nJ))MIaAI&dO1k1N!_m}E5%cxnb(-5#Fm6Lc#mLy>e zqk-^#beU&@Yg(KE;)l4OREcL?!z~$19xGi%7$>k+o*x11i5~~dSvn2sLW$`J%U4qLUl^xfyCZjOrh^D zP_1C@&^n+kQ><@yEJTjK068&F0k1%v9-UHd#Y*5M;1Dor82W+c0y4JG?QE5On215; ze@6t7p~iZaR7a~F`tbQ$=%Of&QAs)8yn)j{lvXoEue9cs<%zKeZ^cG5?cjL(xmvMi zvAU0y(^LM~isnl9>Vap?$AIIWnN76Yd_KSXqjW&#lX*6+`Ki!{Dvz_>+?Cv+=&#A4 z&x&#}ocE_~{2$|~W2?&-PgQ&jfa8VzIC%{JJrbXPGO=s>)c7|pfVJLOZU0jl?6}Bu z4ukA1|It{$8!<+973O~2nu{9k-5!V0=JOKIhpVM#UyHyKaHX!Q-$fD3mRk1@wL3^v z8=q#0!wr@*X`DuRo-PIZTd8@Re1}4XTe=TLEkL_cf_Eb!<5msF?z!+YKxwoA!Jo^c zHma?krFE6a2*;<)^Zp9Acjn5ZKYmMNRUw7NY_0FpL}t+nQt~I5uuQ<7jZ|)@^-;-e zJA0@Uy18}4YWx1ll@=`UN?4zL^S#))mGbU5P_oiY2D$#=trW5CtYwtod0qX7G57sm zFTlA!Y>BXk6p29#F@w@q=cDwMG&$~zE?06z5lP_pm>Uq%>`f2DqiX7lnO%lV`0I3zd#6zBqXUSM0>dXRnTr3^zyeX_A z+OH0BTveOR?N#Ez^~KCBFn6Uu@p}a_AaVPg?^r;$J4;HSh}05q_l{zx^`l9GWzi!@ zTU|(NVEVAArrKOPMLQ=CHzYMI()P~o8_GsA#x&9hqA6`~xN?K5*DiL)vbL1xSTUmc zD-G>N=QIdf>cwjr+5Y|WmBSMkP}@goqD9iT%y=+sHumrvrHz*S@xK+E;#9dq`c!}aHy#Us{M1-<_?c>%Yt{o%1|}Hlb7!{Y&`r? zHh^vi&GoI5=Wa)WuXk#W_PF!%la4zJbfbb8^Oy*d^z&Muk%Au$ zL5DIN<3x4xoZ4@MZo*GJ?%j&*b-y*)|J0*DhhhzWLeY3i>MMBqAuLMh{*|o!B%3;X z*7$x=68jq9yJ9mTP~6YD$Z1~FCFU+op0t!&y-ze%WV$yiui6=bwrpuc9hr7s7p?c6 zM}lzXR0Nr`e(sY3ihJi*z`4G>Xp}7g~>ILWfPb_Wr;&a_2c0aOyU9Lm*=#G zX8k3V+d=b%$wm5n9;yG_UAoU}{a7=3bgZe+ub&$KP4gsvo&5Gi_q8J-FJHS9lC2yBwX}BI}CnG z&=oGRXws7+{@FAld0m`G2mE=(lFfLq0&s!UMm>^&oNt|ch8To@n`yjQLGV_3wb}Ec zi>}4^t*2(38%wc~ZI0Exi@P6s7q>(-u!J+o--Zg?6$J_V7Mc3!6ex;NnY_$^GxbKKUV~x8 zL|$RPSN2}Wbh~Pan6(3MBCZZqOfNhQ2*_PFyg`VbZ#+8*ao z?h6SDN7cd3P%&Xx+xApQ@@{+}7#2|!$ci7iAuwrH$lxUg+uyJy;^R2~;Js%_*FK58 zzWJ!8j|QqP-rWVt|16=WwcbQjg&zSH2S?DSez{s1s}!2+#~D~^I-SYu-e_ju7v^U1 ztEHrkkxxuHFQ#Ua)2F?(s^zU(y*lGqS~wvU3)^^ZbySmz!_Cp&BM`z0D*MU`%a8S2 z&`9&7Cm_=!*$?9mao$z>d%pLxrb{&N9I&KV2$^#Hr zK5`k%bq2elpf~dii41B*;Z8-5Q+>r7WW#8-au`tn?E~Vrdj69nf1h@2~m#RVKe`j^#$toZIhpa4?bkrA(L( zr&84|A)*s8JXLk^5!Uef#W^nT2RNK2?A0?^`D=~3QMV=vU9$C`Ve(<>Fa|yZ11O&& zY=Y~=BZDK}hPU6uu;L^#arBXY03N%N3_qBmiLBcfT`#0Mj0%_fUhITLa59zO7<2?# zDmuqjj@udDvHBc9y@qTM_WHl5aRRwf2Cb{4w8ZBd zzhn{pF82H}ZgNxwGl;gW2_gHZ=4pmq3%5V|M!fAGLEzm-Ez5~L*%njw5y;haH)k8I9J@^q@`IFHZPms|H zV$aM47R@-u|3}+f21L27@5729pdtd2(kU(7A&Al`4TIDm-QA!dA>FN%Gz>8G03tbb zH%NCg#1Q|-efB=*{LVgSpYwirzrirfJkMI|S?j*9`?{~|$_cw`8cC^6-rU8vY*NZF z(~y;%wRcw=dE<6TH1plJ3Zsj@+Hgw$k}6SId>p2z_Yq%He0(0gOv-2+apM-w%v}Bm z1#-yK=z{S|_g1@OVgL_$o=~mS8O$ZhZ_|Nng@Jyh=c*cu=B&C4WedmspS=Kp`tqY- zCP+&2W!X*rjcMCdYa9CQ&34!0YS;^!cOmTl=U3Gzkn=0;I)`{-igBIY7XPvo79Bn7 zseC00u8RQBE4;7E6>h^X9`DWAVsq)MaIOF$(F@}WHweq6)wGj{U&=!h@AkU>oZ^SMCg6dL0(wd3;?!gk+S^RP z_jkM)Mf3d263U;sD2s}O;&nqsLx9fdoCiIZ%Lx6O1eSEEXme;38iQ?_Q~;uby~Y2HKRDbRv8LD0`-&REHdHKY=@xGF(zDH-Iqq!`VbD(rb!F7Z zX#1qJV>0vZIiECpk=HISbR-UO(-tIk%iqDWn8-osuAU=Q(G+jSp0<9+rIY3Nq^?Eg zWYho+G|7(BeLhj+ph($xrc_5S3d`InAdM5WrSTy(d`z~^d3f{spsMPzK4WT;{VqTC!zJR_wxs1t zTky#}o8X&#;ws{;Ep;Xajn!=#;MmHvJ&ooXRX6pb_KLk`&j_NDTm|Wn0WgJx5Fh`^zhgQ3cZLwkqZFs z+BveWF5{k^?YF13)-$|Z#QrgJDegL7B+x=4LU>;a7u|00SUPnz9~}Y3-<9UmTN$nQ zNtg(#Hph-$Vhz5?J&sx2pw|Ecp?d0m$7y5w3;`KerF-StaG^6Z-k{Jo$rn^|?rb zZL$A(C`nfDm)vYZHm#`9vAKk6oDUuQJh+OpmFtm~Yv({cK;iz)Y@MTmhTAjm1tYHw zz&FFvjyJvT+g-vJi&s=SdixhV6QaS&DIQIau?X>UGpgcEa(3)k4r$bVW6<`HeP zyl23*+@1xei9Ct=g-d!aC)w}p_34bqdbdIlenrkKT{rqo9-ke@fK?P0u|Cj{a1Pkf zM>dK$C1Gai5MY1}MjznY^PH^?p=&n@DXdA+s!rjkvsHHFTS0FOI^!#L;>>A8nq z(K7eHiNa{!p`k|K-S%NFY-RS8yn|ysuqVRiYn(aA+0iV2A=RHIVm$8e_u$4SgKwW* zjeZ>V_^fkCGh3g&WH4-4lKn%<9bPHLJb*G`$41iD>WUtv7oN+o$HR3W> zs2=cW2Jj|*4}C|V7UQ}J$;JIf*tG229wiSysdLUiWlj=ujo2APEqH*>EX#m}Ix&>R z+Fu}_>f*g2Qu#$_@lD`;Eayj4L8{dj>LEi9lDi&}^El*SKGBI7O2M?T#W(^cinsNL zi-mzkaKfu`mK09|qyreX>-||aOO0MBI+nz(INKN#sFROA>OAiZ7YnaJLdK7aCdP5n ze>`v)KQiAWZ?)!j>lm|}=MoP#ljJ=lxo+~~D%>!9Uqd2TOk21_)i7RYK{DYF{+pQ;AC4*MTz z{l?X$H1sbVv+TZfF2dV$id{EK1%m6QZc7E-qRP?($?izqIh$2j)~KRO)7Fz#bv*@- zY%I-JU*kA~$jf0r<~9WDg#S$m3AcqP4nF^BLq10Nq;E|_Q7N)`3p0pE4{@Vi)M zO`E1ck>N*EgbNj4tT_73Cxaa!LCO*x4qjOBMKD_FAog}o5=S;8rlmoqH<{M`yZU;) z{l{c3fQY1CPNZr*25QGyN;`;YkI@bL{QR81^Wt*@VZIKEG@zDg~JB=W{(R<+C0AX7<1Gp>YnN6Rb+f z3U(!bqcQ(qM&qB0)u6k!qYmKz{nKHA9czljRHgBMIu`y7^RopD!!2w>dhRc|>;JgI zDC++oiObBOOD;5KBIM;|NM`fAmv{Rc+xH-F_8QgSpjSV1lp(=8ZoOkg4i~aLo zfSdW@J4Tm3&+|V+wUn$F=d$uWQl=wl_hkid?;IiyWgd3+c>jWV>}DRgd2X6jgC=pm z)!ez(`}`?9>eIo&48pB;`L8C&zd=S^O;e3tf#B}ciT~z4y&O3+@a*`%#W_GA62z~= z+t*!RxxFg1ihcH9F75(lo>4`Hh%PL;yZ!ZV=F1sOnr3pDFm4~EDgEabg@0ZFi}ijrYuzB z-?|t4pAs&vTZiH~-uq9(^XnS?pAigZvHUsQ{?nuS>vD49?gT;@>42U2-~RcZuM2pC z^4<2Pr~s7Gms2@d?5P0_?dt!UF#eyh`eRsXxlr{2A)o?J0rQ*{TZKaj2QUJUadyts`DqfNsBK6yQZM|mY%}v+@ITKcCxNy ztuIvw8UI}SyMPECMdMWu9GnW*VBt!w!$;cDbZP>m*L-b&EW50Se`P4TQbJ|lue2G$ zcL_`3yR~%;mz?)t&UKC7&i}U;_)oVejdpk8?d0pm)UFiP)TeBEle1UXS9DhvZjIiy z`NS8;gm!yu5d#)KcNdA9V6=P(H+H+ zz3I5tOI+u%8tM+ zFdiyk^e)L+z!`h<)w-+%BSf7yPsvh={N(hb!`R{pHW~C0Q4xuP*gM-C;2Mjla|1xlH2*) z18@Dv?8Xm!V#wH- zTv?B*1$~M=dL@y$HxRP{8-mCP7}K-yvWaVtDdISrvBKQOqb>37_!*oHQRkyLQXw4I zEPQ5nfHae<^Lb0L4A4~VavTs|e?&_U?E_>@k|3>G6PERJ0*-5oUxbhK3^vD0QuX+K zK_tBIpHui=MUR%MbvBYG*_sj<)Zx`q}@F?l#@j)6EJgh_uCg2-!ZD?Rh?g6CYQn!SYuZ` zw#63F){$JV?sY_pA!_9)DauZ@yv5W@^`=+|$#K}46|NOTZw_cIV>!?JT8Fb-c^>i@_QB&_3=~xpPl5sy#TAz_q1@#o-IMlz$X&XAlVtgd2p(keph>^tfnUNZ4pQkHgPQl zWd}M2nvkVjlwnwFqwnm{`Viq|>SZczq?tU;is|*kC2#nSM`NvZ;O-ug6KxN=jEGT1 zGB=KMv}ZdfG=ahw7gleg>t1YRWEr>BhFiMG+-tpSFXy>Tugd~1O3%Y#sSzyyp|g2k zrK6SZWr!BQzDm2R-TTd;83ydd%xwEgs7HXh%rb-&Wlckzfa`#Kdnh~DY4fsta{^g0 zf7B9)EqD)-^l5?;Xn_I4PP6wb2Y?s4U>!(`{q2ZL(T(Biu(8i)|9vvvw&)rQnM2a~ z?Ird$2W9s5XSENAO5Bgv=<)3Pws_Xu1Mi>m5N%oqWXG49(%f837!21dSayG*vmJun zY*`k7a#I?whT&@hD7M(bCt2=R*Wz~$vXw*=0FWnHhQj;ci+rZ2K0w?uLrKQ)fbqZc z8!gi{09=BcNAdx{R<#V|ZHaF`Pm@&R)@^j*Jyv!*Oy zDPSVre7E0*|30@8bW`s+CiZ=75-Wst2F&LDa|XRqJ$J@0xnD~ri~$juVNfJ`XK2hA z-*nVagXI}pU%kG~JmIOuL_8nJ)x^Mf4$w|YHfBP+r$@QZB4WoR()m-h02T^g)2nv+>*D?h1&M%6F*B@@w#X zZH2Mv(f}UWHPc(}GYmi8F~5U`6e;a89}zArF{ZZ;s4VGtOKx^2lPWK#-g!dz1`TbK z-$6WGneU_w`WRmg#pIIa#sN%gNvO@7QOESPJeOFB#upxJFDwBTX`=gZiYw$HaMc^b)c ztMtmpL@&;b)tE>+FWb)AO1isY*qE3cF9#2eJ7tuWaokN8i-zl+E!QuH8{)Auc#QMv zUfjw3sFYzB&J})#cRtn4o6q(!FZ@0#zw8rTW(mxlngtSY$Ivx$|KeyO^SHOzs68yz zYBJ#CgOqikFhVbPBI2XUF6xFXsVQksKMPzSqIL7e-g2wFMn9S0oEwk{Iw9`$+Mb_E z#{MH1`=R`ouB^d(6P+TTD zT65l+IW%T)@^C7)Zs+;ABJ<`o=Ng%iN3Zt$#E5lAb^nLFI;(+Q9w>qWP9fm%qb?;o z#oQ|!%QV0F*^OlJqLQ2d7g|G`z%uu9>xhit$w57#9rf}J5 zXl~Ao8$BAH2hD>suFnDTa0&5XG#lM#qATT ze-uj>Mwq+^9sw)Rx$fzKYu5Fce>T`IfEd;5<03Rul$2A>xA5Og0TcN!)rSgs*6Eql zm%EKd*clj*_b{3Qrd6o<<-c8d*CEzL z01aE4+`B5@9ne@&>|46ge*C^;Cz8hZDGU6yztGDptEtJ{=KT-LOB{b0f3e*Cyfq8D zt8Lk7HjrT)0Ku@)v5rubeE4|&>v9h?x;F*qVi?Ze-GxJwYu&)xFRo`-o;_P!tp||S ziOZah%GBhwCkYKaWaP+fUznQf>N8vFmUyTqbGnDdvFd6BHF3#b@yMOc*uuC>ol8z@ z7l18M*I~84t)q4N%UbTm5Roi>8!=@+hbc4!zqW`Rwl zl*+5m3s^=520c==a+b-!4#pO{6c4iOUL7{=k*-YW>l1X@ouRaKBV4V*N?gOd^zC%%bh~C z+M`74L5+3coGL3;_@NTciR4VZa}jYMK_ti8j-)<0=c;Ri`8czUMjNNtt#GS{#U95R zGX#5qSWq4aX73#yAIC?EU2A3d9GS0sfZR{j-7m&8eu0#2E1oucJNfy>6A)u zeg~U*8$H+HYPra-mBMYl#5pi>ePe%)ad8D7P#|6gybya#$t*R>qN@cF=3O^W+-p7g zfT~hamE}VJteznKVF<%acxWi+axt}X#5(|@Hjb^0-<~_$pE2veeeG_6s`BPN_`Rxb zu5A2DK1a4bL0eL}mTbmV8pt#RV1O`Pw}I~s<8{V1L%D#%$)`sfw*gjDkoMkAUc~MkbCE_Vgx73u z?yS``ZxoUZh(oxbbNCOmroV-uJ<}Vq|lL9{<+=eU)FVw!rd|}?Mm}==GXn1V(eJYY6e?Y^H9&KY#Jty zHG2zIAo7SE84Af!Q#8Iq%#OIe(q#{7<)D~~ZfjV5hSgLh+>|x@VNsk-#vWe}9)K1m zi)Y}MyDZcIX|9EUu>oGOOJ-u)dWIFAaRHDrcO`R~aW8IQKA8t8M&pz?m*9Vd`YD&)d4KSs5T36$19HZS@`1bi|x4O8%$5A#qFJ@@69tGQ*zshP4UQw1hF2FFl=DV?y zgBX-D8h=Xus4ZmR+2*QF$wvYPZ}e3Ld_teryLkuFolQJ}-!l3efP~uQ#$$S6#HUL` z)a$%Fe=c@ze<}Ax-w~FaojbE9{})BW6ouZu#`%DJ+71a|h3@WiKAwFd|GnA#*FU6U zxLNKR@&1=Q{r6Btn(D4?T^oSVMLqj#Z19grsDtA2fjRyd7 zN3*q0{|dmNH98qXVZAThF^>ntvalj3pjdxA)UN% zE^aRcHIZ17F#L8Zw)7F!dVI{R;WLQ0{7rP`Kh5i`-d%%`mv4DHmaD0sgaKJ36O*i$ zw-?^lclY0tDmy&Xucfc%K2+P`|86NeZVGmb0k;PJhgw+gimV*a02brd~Xqj8lN$NviGhW|p3^LkV2H2$~e z;0adGFT&kljmz(ANn955#q(5Eh#vc2t@giv6#hHq1Y1CT;O{T|=N}oL17cVYmK?_Z zhpV`Q<|Xs{VAralL7u{&qmit|rQuh~)|1{W;VrU8n`N(D&A$+UUWSwE+sl3}`!QP( zJh1%rKSR3y+|*GkSymOexx-zhj(opOV2hf6Q-iC=^l8KfVN|;kldy{X(O5Ut(yE8_ z<}oUU&BfMQl&b!N?gSO&%8$#+(sb1g?V+zy?Gpn^ikX6R0E8;@rG&O|TH@nFxq7F~ z6+nLAm(W3X9AoTCU!oE%{c9isi$C~o?pBJl&;6;d5U+1JQ<`37Goo{IdCZ zH`=gQw##5H{cn(}ZOT-xe@wmcEi1qJCLW&CKU4 zWKX6k@k}~Xv}tytuCnU=ki>(hEYELlZX9+dIRL4L>?@$%=fj5&v{h~?nTd3A1Q&<~ z+xCG01Hh(|R-H*bW^izjyLn;u<)2neOFD~ktu&5%tu8ik$-0SR8bA5AvZv@}66lAo z4!G}}W?Wbi*n;*R-8Cp9Vhn<2HYekno3(*-Z8djB<$^X)3x!aITc z^FohN;R?*ZL8Qj98_eg*0X)cDpXm77Gn+Y+v7UIgeO z;UHUC4zw~9zC;v}#Ni(k5k4sYH;v|gP~W*)K}>KzI%=v${->Rr{U6iF@z+ApyJE@b^t z(9-9GoHi(b*^Js7cM9eowwBG_1PFYDlXK|^E_h~I zEx@kFcZ-8{*;F7ofVlG1$!i3!j+RyuAc89QOXm4_{n|PsmH6uApHCa{!Uv0buTDvL zasg4{7{CFua<@YvRfZ>hZ64+79&Ip4_*S}X-a#=qU8mYXDy>!bY}ID`m`S~;8^A?Z z0Fg94%lHBac^X`%Y~8s(qv`O=cR=o$o{%jqabsiS?Ubv{${rqYfGjmcetIMS+xOQ5 ziYFKmlNon;)K=o;vxh19)ts9;p+XL7SFX`ak0U)r^x95sfTrL$P^7RC{mRIpw%E-H zp80HTi2Hn&Vc@Gk$n$)lv(&jjy#cxyM%zPP2C9|?#EV_MX(q@G^`@ttx1{SFR!y4k z2Sg76sy0w90|K0^qP%UZ!7Tso1ieZR=VIqNr4|Zwg%sZS9(5)_prq3z*XLrP+$YeJ zPsWPkg`)K@`j3O$?X_m}AO&w^w90IrweInGRDv4_YL!g900n@JrPW6h;EgMjV>GziIx7U7nMlrZhJmYaQ9!14zdSn8~>BSsU+$>`>>G0G< zRHkbCkn+fqSgf%Cjj>}nCIzbW%kDn|(1umc_yBpk#}tCJZoAlW<|rvs!@a0|~NqpUXT0;&SS&FLnZzxx*8p znj5NGYlkD?aq`VwiA}q4vhghK+1j5EiWYtP!EZ8Z=F?SmaFrSM4cFu^N+{ka)zli= zTy<7;M@QXn_B#dF1Ct}gF5-w|x}BVmI384QMQ=}NY6?Qcn#zvv9j(t!6_CWSYJH2! zxYv`j{sP+35XetBny2q6@x->I*-9WjS6P5Rh#rSn(oW79pzS1^yH%BF#o^z}7C&YE19JzII z{+RFppVfec#lS1LxmQ^D*Msc}6Za3&2_n4Bbsy}v!j2!?w~3!suav1Klod$q(qzv^ zy{%F*Dy46pWkykzBVf0`Z`y=ARRBCeT`LAY_FxMgAv`iX)&Y?jP4LxWaPmsYOF-u1 z;`I|ZM_Y_7XYX%edW~*Fy%Ne!dH2_pVa z!-3?rO;O>QnzF?pgx3Cif0otF)x|2XwegIYZQoEmpOFll0xG9)c_HVmoR!{WxG>Zw zi^VC}Wmg_*<`4nb!QR8+ubS?n@QqWUd84Cr3P+H*7Y?W$0T+b9^2DjH&K5Ddw@nKy8T9EDTsJRZ9$~e)*{?Hj71Bzj8(2O>xSrREp_duAl6p1h*c6}kvC8n zO%}CIN#5JsHe0Cq0m9Q$KDbCUkQTaL?rNgSLaxLr^)Oyb2LBn)v*UXZH`2ny$qwMZ zk}^F95`8H(qYu|plUuf1@1YwFu_9eVP`4IV-ecTcoS%1n^(9DIS5fIMLNOyyT%`bt zW$_RX6%VhMQ?qr)(twIF8gX$KZHK+i?w8>D6i05nj>s|bEh&X38_z{};OBFOl60J$ z5>NcFFfc}G{nT~l`jrId9m_y*1|xdn5$hU~c4z+R4O>yl3<^)GwGMGTKxGB=ETr)Y z&x{$E7q1=w-Ex3R(l*R=j0vosBR64#n>#iMwOs(0=xmMI5-~pyv!H#wKj{Hp9VYw>Z0VSBEp^8@uA z?Oa)PVjhpG<1nD%)El3fGRy}flzw#f9%MskXU;WkIoYiq8^I36w8lOzj%je)A&+Y3 zCOY*g<|8kBa}@Cqz9i=fl$H($tIC}9_pqjZ6lv%WJTKMD4c#MDXU>mF+;1}`gE$% z2o}7qKgxBy=oc}(C1AhoM0HY0f20jNV8VU-qd4Dr29bh4BlF}{I}C7Leo3!D%HG=g zn8MQ7d22Kl&_GGPgg?a-zqZ^XovN`do34h`|8Q?siKVq`6Mb}hqg$EDPw&Z`+o27q z&8RF^u83)RNU>lFC{xm_A=rd0$k~3&9A@oNHXY6zNbv$nJ15fdXLb9?qe>1Ph`ZIN zPUUbebKyAeoX^h5jXg>iYE^E=dIx|Ysu$I);$TH4wwD!#KX==5-OpYD2;xO;0rm@Z zoTetgh6Khz-S)8XBV09UINR9M!-8mr5inAV)VofwA8GcUTmp@ejI7mwkeG}4)YfHU zM;Yu&)xv^!nGpTa6O#q{(Y4#_nzutm7!;dBl5AV}LGS11MK5!!yIy)CfE(QgG`>&tbo z1ViZfCwnD$EfY)iKdY3z@k}H|ym#r5z>{2}aZr^HZm#ER43gxA<9E)1;6j>! z3Rv^iK39z<$VXdt8^$-L+CFai*`epTuD-@?)^vHR3IY1|kL_@C&$B(}g;x-R<_{n| zs~n&Mq~98goLhQ&^QOjfq$AEM2>+(m=+9id**-wm0}Mp7GJKD0ooPxU9%GHI7ntQp zwD)+ldSY%~ytl>Es~!(wnSJ9aR@%lBp8yD8_1tE7gS@=T%)X45s%et@evOQKt}Q#@ zh#!w$CGo811~klM4K$04I1=&{t0y~C`h{ebc(z@ntzR}%I&Y69rqwyfglUwl7MNW= z=$P)y9Z z%>Ii1!h941uUEwW=!4hs>benHar(o}dylR^R5;AwE zvTAeRvF0(E|5`|f0!Q4RxrZ*X6MKHnhCAqgQkq!|3yVk%mi;YybWOU`@u9kAq;=i2 z4>{AzU#X5vjB#velkYY{HOGnS)8D;Jq(wT2-jr@v49IOQ|DwQX!dYXqE5Yq`&pGu< zc+Wq-%zMk0(R?*52k~jU&s7w9--7w=w=B)eP2Z_$jS`(r7KU(Vr7QQZTwH|SyUPis zx;2WTH(eY-UF$cnd9trVK*0V64>?E9_>-L@zM)UFMEHoy$(^x z1PT(wa)j3%5yZxvuMdd~7U5eI7#eb0_J(!6f*B=a66|^dpz1vBGa}b^i}S$lCajH# z0aP$YlR@*k=}o}LyoWtFhL5zioxf8M0`0C`d`{wa&q|cPd|z|xjkOe`->!v zkQ;50sC;@dIu%AzTnMW*mgMy9*X87Q*Sfl-Eu&xU#~zVG%2>Wkpk6C(Q4nc(UVrB6 zy(t~_<6tA=FUZYYw&>!`_`2V@0(Gt8u5|t>;V{v<`e$gQfX+|8ThriKoK7kiA(+Om z-lfkX8G(FTId>oH*>+OFt^#;hyGfaBssbRfL@)Rv$9iqY>OW&bb%a8~M+7R(dLX&C zDKcmCuFY@9kF~hW zQUauEO1~_qO8s)u3u)Ee%>MM+$^Hnhm5dxlC0HX23;%RG^?{M~9^G*@|jIOrk5%A=wipx->i% z@{PPeoEJ$;<30?z(i%+8sd?>vy~_vQ z8Lh3w`BABJP+cr1+)0#{Uw!gO_Is9|HL&d$+d!+iP}5o$AE)#c1EjXiHygcW#mz@&zI}1D8d*bXXT;oNkd@V~qhDuKSGm2V&YYvr;6hJ>@2{M;U165YHW997 z(xPL10m%gm&*)TdCk?|^ou!}0owqw|-y)UpP|3&SCuZpzo+d-X%08P}vf9qkNQWNv z(D5u2Xjfnie>LrjYTa^ZJG*;#Q=a~X2Df@(dbjyrLD&#S1mm{|0)y@26E6B?e8Mpr zxw9PbvQe>tr)~*hDc`7{+myp3egUvtu@yHuWd|U_se&YR@r?Jp-MQ8Q2fd z;88OnyP#}UmTyNmaY=h`6B2?*2AT^jZTAKwoefIXVB}}s7zfSdq@9E=MQAwgp;t!Uq#n?^M7uGfRW4^7y>H>dFg(Yd{4r-cu6h z=9F-NaP&?hHL_d&&;mGi^okD+|Mavm1Ho&#Cci$CC%CrrB@o@&Dn|bj9cZL+60Y?a z8@owAn|Hkb!?@~eH=rH1x-pbJEH6jTP(!zRT4_u3YhQwHO5J^~Ijb)Rs2zcS zqjVGD)!8r8A6*|%tlS_4XEe=GrieUw>vlJWXu9>|;D4YoQ79<$qBl#scv*zcFE^VE z9#~Ob6otb`a_JtPy6~vl$~2#IUg)mH{0*=4-$r?UfkeK2^Lp#F08`9jxXK+82pPYi z+`dACez4cJhi5I<1O*4Dehv;c7$B7*VC;XXwL9N`CI@sUD#(Cnv9%;63~%}Y^DrW4 zSCmMeZ}zhAV9@DyiIn~x{5^g}>D-H}adm-WLjO)$&Z-3XcXHuYsWTA|L`?A%q+419 z-Tzoj16~qe{{q1RO;wg0B=T4Hgy(IC4YllSj^yve>XYv;G%H1Y^WSpd*R1fIU<>*5 z$!;?+ri%#jh%U@^f12@Ea?-qhUBEz9rrW^M!rFFPSOspGwKW(NJ(vpP6A6^jtf5Pm&Q+3{Vvm}(=K zl1j%C%SxNh>KXTYO5$OmQli-}Q%L~A!Qp*yPdnh;fsB9v%;~6W!J9kAyLJ8*9h^Dgh#(mAgNFa6wJAp;FHzv!C zjGsPH$qAv(`o#Sb`1^$T25nS^muI>i1v@)?{0CIM)CIWpdWPfPEiB4&K+qHDk-eOZ zFm-MRW%Yi;M$~Ch`Shm>O>j?4QU$-(xGXn2W5piZ0VRs;WAjYd@ZsYeE?Q4bx-P^6 zfp8_Jt-%{5ZDFp{?FFSgAEB|hyGqO~hd$m^6~1>{MLdr}806=1p9T?ff$rO}Ki*l$ zENz+2Q?OJM^Klv^We0BY1v}2n+b$;p)hVWM!k|jC0i9IF1noLsfG;3#Z{zU{i#w9_ z#}*(u)(u$27{UM=+IiNM+%b8Z-RuyvfLifGr24z0Rhjf{YUOlLlHa=rnl0`J%m>NTYq;Sbw(Ar9^8`*ce@_@!M-|M z7iUb}MnOUa6AVIJ7O~HCn59(*4z?d4q>{|T2&p4pDmxRH_7xfreK+|0+|oL~TCdrr zB#S*=&=vn9i!S$EQiJ}@d{zJQjc2T%5ZaXIamP{NubW#Ocui@wi&ntYED@3v*Jt$n7t6LM&cqPJj}lqE;NvPWPo@mg6U1?@nn{f<945UAF?HSVW`-h9U zE9+gFE|2r%7eN=-)RZI*mIj7T!NeGcn$U1v8$Sf^} zzQ%WFhhBX%CvJ3RetW_vplNJutN_wQLI4fT(ee&7byS<;j2xtzTm5vRBXquI;SL^w z8$f927#TZqX*aR^fUDTAtxKu@lHjy-Vz6H!l`qlf-hCiC49iu`?NQB@%ihX?yypSs z48{vSomc5W6RUByc}ar}eW^81ymoeT2|=U8{_DM^gg5)QD@|t$eA_(Ec@&~GmTnqd zRusHeE%(4xIAT^b%$Vv7#0Mf{m!?ISHb39NxkWNawZ+vFsPfk#L8!_Hij z?iO0`WPQLT<&lK)T$5$Kb@Ou1K0HCz-1&w0W1SQG-RUvL@0|P7b!rSyzVR-Tdn+{` zAFf2=!^w)utr;vX8MXy+;){F&SDwD@nqqQEIUJ@7d#k5!^uc(h+l3i}&&oDBCE~%) z+=jCqy2#Hy5>fYvu4f_cvECdr9sz>yS{5mzGqk|hBzOL;=r^m?69$Rn*3%o3=H|!ZuB%7*>A5wEAfH1z-5Zsa0y2>;4tKrw zsl})#>6`mDTXU6`HNQy5FrephyuX*2OP*+|6l+UjZgm<|S*T$B7xoe1UM4v>`ae(W4clJ3 zub0#~1)0|}B0EFzIl(7H#Mu)RxFkjrNa|)L;iOLAn>w$Hc0$H2C+OkQZBv#2$Sc>l zGoq(wY_=KyQdKq2iTD?J&fOn!)Xbt)-hxpv=XvrXqxKs%JN-M2Z^}J(bIDD<{g)rS z`}Z(Q(a$zF%`$j1rfMf@LFJcAz6KbLX6C=UE{da^k>AyHEfXSu)Jhk43^y*I3V52- zS%J<6W&$uHwNFGic=w=NKf8Z_e^e%h{H={e;hy*lz>az4ZTk;ew}R!@n zmRRmq`JgxaAowC?gY`DS;m{#wIJ&r28joYWv(^i9GN}3TeaF&WzqSXBE}h=zFt_cT z>+@81Yr-qx1&s&SS0=N;d71sx2~!WYdYIX-Gp+GV4bIPwp}WP!{Kq?U4Q4fqYK^Zj zv1+{N<}3p!(^Y0PCe4Zrd^b?Nyjbpygm0DiIJn#5*r_DiEYpXfc9l#!#aYj|%<5`( z6#*V>z>4d7>OXk@v+4F4Rx(qn+DC_?K8Urf^js%XSgK|RTjfF2N6OSE>B4Z<{8Cn- z)40(q^7Cx3mu<~UhJ37nn$|$Inoi=l$B5U!V{Lz*9j&nm?SjK$m~#gG6XXfOVfp?! zik;AP-Q4!~hcW>9t=CF{-8W4lg~wqOyZxx|7Njm64_Ge z>#NA1+tBT4ywI+sHTbK#RERKdAI~cC37fd%7qw=z|W!x~{&eGA*cIP(X1du{%@F4sQ z$nbhj=2@y53oR|Jyp-Ui#OSQVf>6>2rci7RY17~lThC*cvWH*!UTJwjEDr2mM~sI* zS~3Ce$5z%;mVy!O_b2cQsJ+3gm1pdgr(a0v&won(-Gi+5470YjcCI2UJd~fg2GpXWv?SFu@^uJ&r&daIOSHiO8%Nx!<-><_?lKHK>P42H zy_|v*Qvw1N?5oe66-T=S{|Ndho_vBmWfo!}jn+3HiKM{2iP+AJy5P z#_f)_^pNGee^>rvw)VMMWNB0vywj@l0YMp?X`u_$I#aApku7cd{S4xWktsePxGSW| zQQ`VVin+VaxQJFy>>x-1&bj5Ovu-c;yJe+G@EvNacot#+J4DNWhTm6VvtlUqsQQH3 zNg%^9AA0sa$-wJ9ZB!y^3a=#_;K>o|NHS$}l!M7g-Fb0w(cMNv5&!*TSl5-i7?2<8 zsyS8vhMY?>0EN5{UO*Je{c+|g!|GsAL+yKo^WD7P-4k0xr0;+#G#?kBQ;BlpcHQ?k zlnf3{4SLrvueE6Pc0ld#t5te2gGM=fD%Rn8OXl#1ku8@A8a=sDR1cDWa85AMSbobn zph5Obu>p@9sj#l!eYSShj!~=m*hYRZ@bsd>41HsyRJqkjtd9deBpMEVi^QTs2 zbov%oII3|xQ!l62%fqOfoliO^s*fnX=}POQ_+#UmKpijBWxlsZK^sUx6th}ND(dyT zb410o4o}!0^@!0QI8j0p^AiDH!pp*mZ;V2&RyC(pigO;gL|W5UG^5a_=V4FZSx-Z` zHoJlLDwcRAO+c9sG1K3-i|;D)l__;5O8bvVh-#UW0|>v)uD0t_j=wL%Upo&CN|9M) z+)*`Bx)1Cdy*hGV_Cm+osUfq3@34Z;WM=rbD>*Q%7Y4=dk8!B>n0Yk?H*>`hEl0Gi zCFNF9XtM7lmV|-c?q|Qk+&nKt{e~g0GEU66_qS)E>mkaMKt)n9@CS-dFO#d`iR^G3 zeA8dsd_ShRwDsh-3j448J}jmw6*MWOETW>IS-|EPvsC)7%faHyf}-!%fbxHus_m4J zISDMu2I7j#KSTX*tr`72lf`>K%WX}0NPaELOicO)-)bkJQi=Y#w6Qz)nv=)A47@u%m-|R<)AU7C0}JD1D`RIqC1~c7^FKMsX_N z+=JH4qR$l$xaYA?l8%=FPh9iBG%;V$S9QJWnu7yJPQ)%BkC(k6aB6F8Ju2$$-CXES z87tyGu}}K(V|L2ybr3sr4<+&UIsd;;B=DkuIHfVVUx!Gi%+N5E!{G@yM5C3rp$tQKB9Yqk{ZH-*cHFlSb@sTQvdxo z9puv}e|zQ3r~)gn(mo0JK&E3<+HAf*aO*_s*80!?;>(7z=g!#WvOT1x1GQo`G|XQe ziR{d!zCFkDjfSlDbOZe?CO5O0s$}aCCMc#o3Go0Gy=RCfcr~Ej;va{=Kb|ij-lS~C zt@Syr3L=b1@XJcrqVrS~0ZZm;CEs`Wxgw~WDAIVK#VlBz2cQ=xTJbd_wg$6%>Db$-2gz@=_iQ%42_iFEb-yCXX zpm6q!ad7p*lR#?fty68_9~t%^@$auITvWuBmX&?cM@L7$m85o5?~OdHh=%yixfSU7 z)^^|Z+`aO_6oWEJ(bo87Y2eQO#Gf(8-+KJi%c#^KicZaA5-~H88JASgs{69^cP~+K zQ7UDibBp+Jf_R>>sX^7Zc~z_4bHvW_(N@8pGHEHh>`YPt z6{B(Dq;BlB&Gbmw(8T9dt*un5OfQrbGx!usx%tIcvICJw@u z1_lN%eFK>^;y!)Cm}+({+gWHHs8X+RFfGvJ(|Sxk$=+UNi_e5gtT+R;iUt^(=HrbY z-xj}}iUV#gB#sIH`9q(dzVr7ne19LJ|Le!P!tej%1HZlVv2^9U=>meM^ZR3Ve6M$A zk8i-DU`b!nIS$E)-88zr3>YpUp5ZQ(RcY6N@;t{BC-E_yJ(Ewy{(L8TL2Xw~MVxQY zmE@0Sm(Jf3XX33TKjo@(@xsD@K?JENOTM~U7H~SuB2h=tc=pk>-<9g;mj*r0VCLW$ zTKf5u>NFrwZHPUWdSh8hq$H!##$mYw>+tX}Itc4o_s+gq&p2yp?(04s+#K>6{u=SS zwvIl#f~O|GjIbTr9q?I3#G2oIkvQ7;#<8@&U&bX6o1;-8`2Q$->#(ZUynk2`1q5kC z=@3vPq#LABO1eS1yIUG*q+99k?(UG>G}7J8Cf=JlbIzP+=FD%-dtLsq*lyT+t-HSQ z3G|e(&(ndj4>40sE{}NWwZ>i_+MI`VZ$mPKPUA-e8f2TUm#mjFj82JJUkPw>a&?S% z$Qg}gzoC|UN28RQz9|DxKN&WgrSyk=hfABQWGJC7vQ>Q|vNq)oPEH~bckv6=)T?p(om;BhP8&TgPy-Z82qu<5Nv?i;(UAdJs@O+S?~> zKwQTh5gEB58#b_WIrYY`@%QyiM2nybTt_p-Z{!K^*j0f^3h8K50;QA`%TcMQNdj0% z$Y>S~{JZHh{lL4feY8zxD<=#gFV8bAt9GwQt&F|H@qm4<(l$^m;jEzk@G4IzNbn(i z?OCPsxtZf>2DZ*^{R(Hftq}#`(8jgifbt98v+hOy%v(#s`mCjWTWD^EaFM!DSkl!1 zbE4mfXJ6CK!?LK^u4tbpD=y{lqTD`mfE2c*Qjff%@ZC%-aaO?rw&>F?)jZkFo# z7IvyYg{2R-sDXsA;jZu&4v%ck=>%0lfkh=riY4{i(A_UJQdLqv;A$?Y(|NM5v)s9o z`1aWCN^0J9oqC2%^|v@39GL&-pGP8j*b73^uU`+@)JzK@e%xvMe-s@eV87eT*1p^= zH7L;ayi<_Igp8$&M;!aqIRCP8gzoba_&%G{UogF zlKB3`?o?h?B$CM4r-6-YP$Np91QN79XhOsxX2a}2!^r%suCDIGROxEJlXy~#XJ{05 zm8a9sXDw<=VS`DRO!1HlbE&^o@M{As=?(0q~5htRflNc2c{F;~LZpIRo zcA7S{!SQ?PbMKW$NK&oHB8iVKbfN$q58a6Iu>l}F5z1y2zqXyGq#n;zh}jx9?nWC& z`;G$pBsyA#LbBIQd_e?+8`bvkD~M9y1fO?kt~8kXxHXnX!HY%tlv7N5S(^Jb3s8Z+ zIw2&YxuR7)E_HIows4}*(*CB;)!EVcG1a%VgsN;^WpzNh?S;zPs%>5ai4USm-N4c8 zrS+RijHPe-K_p1@RCI^(TxYIFho^L1QdO==!l49MELAEY{qWl+N@9%qw#ro1ul{X@ z{Nu;!V_5X1Z*5eybx{96we%v6g@_;(u@QgW!$X$#E$dGGV%XoeEj*8X{edv4v@VfH z;vFy0(0=3~x<>*hvRKRj`L{l@<{LosKcI}MztGkgqVq9KkWxfJK_R#>u2S!de*$D| z@h#n9w7gbD9~nYea}rq?t$>p1(ONJrY^urK!*g7i1e=+T4zkC=Pl9n1@Cty2)VD`) zXNXp1+>A@%n7Sh~-5b{o`hzcMXD8zCPRDvM$b0NuZ$d{(x8wPrC)c{UJr^~gPeKy?j-*>iCQv+TbB>}-h7bRRM9*DHu5Q^#_27WJ+qkgq`ZY){HQB@xY%zI zVKoZ^5j$Un5!0)kenSRh`l=#ycdrCyW3yCllb`UIHM+p2BO1s$$Gy9iil@DmD341r zF4LO2Ks_I4}+T&rf>K#xxBBKHyWJS#f}_n*N}7zCEc ziri4-vjPh(KH)I0CQE4jo^-$&2F6m5zKNEnuZqNHnkh_+YH)~yD9)k_o(Lu@A)(IO zCn>y$+%0FmBqv>#>T8I(9| z)ToFT!rPsffr0rL$IN1;N*nn6HeS7gQwRhIeXvKtubm~}dI2cfOrV>A{g=zyiQyZW zN|S)T&>(-t8ETb^@FQN{k!-05%r1s$FlbD93UT$7FN&|v18D;j22X-U9tt|oG@9lC z6uJb^UZJkD+Y1Ze#mcaX$}M$;%EvKj*SZdi73|N~$nY~(MH1kI)HswZEfq4T0KrnD zqs~SSX6sAMp(JsF&n7uq^hawn*QYUJ6$5;~J*+8;FBWH{!d&ECA$Z~DnPP)(f^nQ> zL2Kyyh3;>|%<+Gin05U;?@GB2%xR66_5LbEA(stZU3c`fWnp27fO){cYAqAl;hhis z@_GPe9X6aM%#NsPrXQID>c$>WYTsx7!;_n1k>dnfn(;<`q_p+X5~H+;%fTLpwAk@4 z&P#~?N<)cxU`KkR5EHLrCZEsKI9YT*WV|p!y&-x-;(WU;BU#MZb-;7$Yp1=_-<7c6 zT;HdCv`?6hF_jyOV0nn6tDD8`H!wQYQG)Z5jI=Gi2@rT!vtQ4Ea`bV3)Jv%|yBYK8 zd>;w**OZvL47H=268{+WFl<;NJL!Xd#3Pf4f5el&%!q&HSS#G9#1WM>rEJQEogN-W zJ$$qugU?a9%>hLp$ITV7Fvz|>?6S(*FR{RMUK#G{zZe(;W#kWiz@H()PneU^y#6+K z>g-T3$!oRM=lJM!<*VK|JKS-mL0_MqklmTR=QcYO2(#9(W*uDvUZU1EF$?8}X`7Gh z^>zm+t8|9>@S71??to+P+(h+7TB57LXXr5=gn^xh&$?0KV!?r-xstyFlCnM&74lmstH|h7aIfq7GAcCrip?^Hrz(%Z}aRmnT&Nc3<5{LgJESLuca{GIQYe; z_aMHFD!%o5!YG8y>JHt;^cx<;6T~zOAAXtL(&!wan|Ac(bgezclF`)di;CIEHb@{+ zDUsI20A5f+3~>jm4sks8g|Z{qJp`1^t<5XJ~x zSlSG{b0rsLY86pCb=w_2ZWK!#Ao=IA{&T_=#sYh=hnF6r2G|kIp4qOns2NDZ--Wo@ zKZ5kyuv0G#8BIc=kfv~?UQiUeRCx-p2`_l<&hq2P+YdqCx*yg=V1()=>gQf2)9Klj zOu;xWcFn6Q4eajWG~qGCsP3u8Ub8oC zr%GPsY9HZrGwIt-?3ffb=h>~#JHfD|Odxtr^{+MS7n@5A^ zG`&IdN)vetrHdOdRyaDCzR$w#2Ui3ntR|~*JSH@MrWEAt@oFKuK%+|jprlHPa%o9h zDU$rroz}HJxtND`w|*YdKa2Pg-H-(&2*)1c|u7TrE$bGwcm4bko-B}i90edyM4q-!PE zHamuh91iLh0a@JMgrjh~)CnvZ+ky@k2gH|dYc?`Gd{ft_aZPd9KIOO3M6am%D&>F1 zAc*04cF`1e#lQCs`1Kfw;mSQb-PgZrbe&<2sA{kE&vk037J{Fi8I6nknvK={ct4k* z4(KUGCUMv)%BA-q(9$uTJfiI-b#g7%8&DDH`Swt+(ojsyr1reW=vCQGd9QwXyQoxJ zr?{9bk^{`L+x}ETU!pHO(E)qM&C`N~_hG_%RovLWMr*}YtQ*#C^|k|6oBB?>SF(xM z1YCXjli-DIE{}8>MzI!{`VOqHa?cSB(Iku*(VVXwBMOqj6P&gIL^?hy6<_9DxgxXV(=hTjx^{*}47ogc zh9;Q=#+8VM#m1Jl>*ib6%DLTXd&cvN*_yIS*NKl-8piPpEd9!zEAZ*v#Ymdj%}>vD z7v>u#%xM1TF#S;j*rSJWSnvaKA|!%CV9R(FYLq;sB^VJ}q*}v=+JoWyI`t6Y@M>O_ zvx9BoNoNrE%kv)pwH8mzX`iL)+BqdnTmm{j1Mwv)!S@1Wc4c4Q z^)|n6aCQZ*sQRQNr1=AQN_?sf`1~mcKYlA7&N{*nB;&X>evtV({(*nbY>&L1(rH+> zWAc2#b%v8@xjHK=OEEPc3*8=gcvHT5d|#u)l0=cjIID0v#UY1W*~>JQ2>KQSL6gA) zKOqseBvV6#(xf^YCQl_#AwB=VPzH5xREnmXwQVG8b3UZESg}-QN#ibSgSXM|Z3qs# zUz4JyKJ)J7%~tj%xIOgS7l*JLXXAOddJxxB3F!O#YTWKyf0d;xsSFT9LBh{GZh1#4 z7UYkIZ!L<+z;O!KzOaZAii&cs6FToiiPzaF!MtQEl-Qg7>&c*hzUJ4`@kp|EbN}R+ zB2|fVZnavQH={S@R|&)P?>qV_Qkg!G2~ObUd8s<_*diLerDLcL6*l#JIz;9#YH-&xlwD{ zN#0>?t9>yFysVcU7^(YNS0nxiu&BDb&uBdx8{LlfILtHAL(!61DcO51U}(2}MgsIa zolwo3yNms7_#RlTCBJhFAP$hYu?rA?EhzBqMZsHT3ejKZ=n$R5_VaSdgko{MGG z?c49SmAli3t>T)V8lH_W(&`h|U`vr^3k}CGoTV!Hvm_|TgaXoD2QDPR`5{9-^+&Ca z)uQl34JbRaH7XIl zCBX=T(L{kCY7wz#KYsAH#P-jd;Na@zV5omo1-UNku$5*eF_pM<`es^c{S}?8oo;Rr zE9vJml-X2DOh~qpD8;FB@5K-|T|_7yjZ}l4IO(L8nBRTy$N@XM&&1r&y7dn7|D*PAftdw#T-;S=o?~Zu*x_r$9K5_az6D3MX^lWUqNG2iGjqFJLetkv5D^jt%D)|n0E_9 z!^iPldfQ$|C*sQ{iZme}GiiQBzBh$v7_bLcU%5T8yqBvdSut`EF5|;%VSJ&Z0M*gf zGBY#d5BaQ{@WsL!-TO^q2jRwBPBRMei&pOtPY5)^-BEdF!^HdZ%8n0YS3f0)q5hyQ z#2D?z>jc3us^6mDKgCjx63y`!A@4dIgsYH-<9Bvy|mfb9h6l$3|aXYWYBa|2I+|DzVx`BsA-08Hk)kCPwMQWmFiXDOS zQmZRJk|&}UGj^MASFo!x0wb*Rm$+N=SFN6z;^)v>Uc8s}uFBR$?K*VzW(~nB0+sKO zo6_ExH!|`?%egs-i?NHRu2*_aaCu14K#7qa1LXkSKd$nCM6Kco1xk`LK~2Xv?vcPj z)XeAq3>krLzF0hgiKWIinnuZ_Q4*DAaWx1a^~;0Dkk5SIHBXpm_;;Y{9&$X&yukN{ zlytx~Ssy6VNTsG=8bZ~ zmuEv7E{<{(EwW|T8E6E zUKgV9`PyLGeqmZb4QgEjCUF=8?5toL_PUbvRASAO3BG?Mb?;#=eIIZNQuB99Ik&Yj z3cT~qq|PQmGJ&2IbYh^-{}_g($#^3RRV#Vtf^u+0QD;8?cY$O{@6LA&15^~w5BuEaj3^4Akx_2Swz}os8&gGh z?}rhx*W6kjO~mmQGiTC@6t}m-mbHhz!g`7SOw)ndO9Z8Ci^f9cz*fGKU4QbxZy^1l zH%+Ct&35cfsljk+X9Vv2aPgh{$bjW2F>&%aP}xp6Ti(NjLntX`+QR(V3J^#WFL+c{(( z2i73=6pEGcBa7Or%iJz)0COVdb1ai3%yu;#YVhGrXW;oWxKJ$Dque*sO? zHGJA~w?|4fT0VsuRknDBMu{1@hQp;5ZywPq>igPo7N}H3eZXjX_rp)>NpjUYu~gsJ zfrqI$I3X|ghhkqNw>h9l!)UgaMyVr4BplKNUqYA(a?1B$8$uL z$^Tx*^-zI5+nLvG$6nbzI6hVwY7DG&Nq{d1cp2p2;QQV;k+dTKiv_nQkclf6efLol( zeBgQ>q3`%)?xd5;`YKXj{v`4la8y?JI{;0Rn$ny#;BHNh_m+>T?GYNvMb;^vLw9Ou zTm>%92otG<<(1aMGOLx=NAzz^iA;8O&qfcO-fd&HzT>aVyFn6nx%99~&2g_xruErZ*N8)Xk&)*phes)u8 zsqjtSxlM>ASwj7RsB6D>ijaYZzxQP5%gSN^sg3(78V$#C_JfmC_YmEG-_j0Ay?D;~ zj9xRW?W7L24RMwGw70Up`0yrQxuO=0k@^SWV$kA4B=eIKq#Vl6z*(-;kzm;elZ278 znOcgFVDsX({)^@XIbnk&6jR5yP+!35`k)~>tyXSI(2VN)X_O6Vd|qNNsxNp z=yQ&cAG98zh@Dt5`FmUcPrajAF4%YTr8N&vqu2YYw6#V?!OT&&p5Z?Xsd1uh)Z6+9*(Y1lc`&a&ozI6EBthbtHRMzz}>xG#~ zgpDb>Be0r@PuDdjx(z@v-(!~aSF(WQ)NEQ`{6F)W=8y;NWev_}u@?1{U~glek#guK zq1Zm~6Yh08jrIBtOZP-Gs6dtIb&%h-Pt&c|Q6NdbVW|3foJ+#u;(CAEDOgNBHD#J3 z?|t5T3*1N?&nOePS9Y2eHotw&hr@Y%@D2s-MQWHf4F={yg|Q!+Ct4|%qc~Cbq6Y!V zc!_q`7@~9obp;AMEmG(VA|;iN_XG>d2|O>7*Xz0J4>FD-9bDdPfCl7=@WBLG??_lE z5tNbQ;yu0i<%&<}Yh>};PIbm)?VvATC@ObMguls6;n}AkJ<`(elQ&Iwxg;_itNsu` zKQ;Fy`{p9TT?&m>^)W<8%5G?HE|a}Kz;q-(u6%^~(Z?tLRZeeXXf;|UFumnxjR`df zF^;C&M%%pUDzS=Hc$K{8eY4&i4UwGC!X7=_x(P^Rh}N_-k1?AI>Y}XYUPPO2`tV`6u2w0 z;o42qKVUH*mX7~Z0y-X=jk!?({r6HgaSOb zy?lhJpidKmC-!^O;zMfC+UoxZf?kE)ArLvq>Wb@nl{3Y{^Q?CfGO9^g*^uX*$D$%> zR%ox&pkv^Zmg$Kx?C(xkLdojY4sU1cBsE^1PA;#ZcIr1KTm_>kmOL^Ha!b5vh+Day z+@OHXNu4NE13C-l^s5R6wWRgN3p^JOF{Y3(#)v1EIKkfeeh-Q;n%L$u* zP@G|C;fE1?qOxjxegXPNNp=;OCaeYB|eUOiIXsq+SbfqRdN#uqqCxGHwP@DoV>U&v&duVn0D>ZCb;@V4Xrg zBbnDUf&RnX()4U?Rj&CRbx!MRfrIbg14?cC^dib0Gkh9l*iPn%E;-wuu8{FL(UPvS zJGz-K)=Wac2s(ndEdRBBIil?2=FqN{xeWlqfK%Biv?8qj8NPF__MEXsiFkI|*}HV` z$_KU6!P5JeKenI)$=%tuC#IT8!xqZ3yX^wn@PZ8fuE9)v_~3=1#PC!+=6vX9{MV_c zZGkwp9F?K_&~yZiSeGsoWPCFT-i=?{!lCgovOBCA`AAORSrMK5Tj(zBRNOg}UhV|-0>pJF3;A)#!gti8G`B$cFTjb5I&-5Klf zueiWJ8tK9Ky%qVdmLOwegb`}PlIa2-Ss?jorhd(A9!UW-~4xiim zrvaq)$8$cq+r!(s{n!ta4l$i8hQehdh`cThxvA8hFjQXf9D+V->0NxUwYwPE<=O5_ zK2`u-<`f!>#*5ThVKgdLX<8R$!mgj7W%^qo_A>6hfmdg#?XfS%bVt3xafte7W}G%J zM!rq~A)$2iEP9zFKR>@7sX#wVVavA+>-w2Ut$1yH=*dlkNGK;8aNg?rzRReMJJv4j zZ)4^ggIE`RTGgPxb~0WyIPHe63h?Z1KVqqWphRrE8#*`0zV%pCG{2$A-94PjnDA9yt~S;^faDtSF>Djv*w}PSU|qwM8Df{psD(cq8B&J zz3Y78oYTjWrHEstxy2dT0G z?G+~Wa7!T!z@-_BosEvVrI+$)_#3W8y0m3^u1#u&CD;~L>S5MDZobby!F4J>KTCm@ zHG`}>^_lf-kI8g?`M%gba~INR9}|G43ONii{-+PVIX>gArz zxw^#LTeivp)87N5Kl+#+9Fh+--qCMrVPGMfX4P0t8g0c@`J-b%Bzu)kgEf zuOT6WOt14}{|fWWqGTi|jJgeJfW;bv_4C_!voLSooHPTb+cIWTo}e z;w!{f1Ir-r`P7e@rXTH{9X(r7Z*`_dGQP#ehRIMVqWs-Qu)_NA{1rwc>%Qz% zuUu{~KdI2iRLV9W*B=EKqdg^Q!m>f))Rob%)%kKE`DB2LA8xnH@i9DAa1|QIV1@Ve z?O);y{uq;gU3est{K|DJWs_5=+%lZYEO_XMq#`ilp7aTL{ZrgLX&8aI1|V`FM4-Zom69T$_%AEqU!VMs zH&hEFWWP?RlCS=x8RZl4ikOCb6yHO^l#j2JqTuZkt$s^AB4$|A-SR%Y{k+Rmg?`n} ze4X&EVuiH2!=~Wj$w@b#_)Bcpts?jEd-biYiM#|$&FFvojQ{pyH3dTTx?kRrg?$X2 zBsbYMq#%L|RF_tIBI4KO=k)RO0a#1AK}Z}3q}4<|eN9$pzZ(fs7PiQb&ZB~lXHmGX zM4ZmHbf3;uTdEb)zRpe!dU;&UXfh^3fOq{xV6Hmcj!cPlX>BXoXN2nGKkEp8p0$5* zZ9$9Pjh$*DW)dVIEGU{cVcJi@&aPaj+CTy(FjJ&uJupD{3dE`3N7@d%A8wJ=DL1HK z-&7Kbp06BIBr|%NBu=myt%zI#KUgw4I;nVOQ=-cT>*FwQ&<%Np!`MxQ=-}MvzTm)rhCfM*%VPS?6?)z`vJjI2FNhQltSsJ;BOP5m z!`0cpbv?SgI3!mna3y?#ga;Jx%vnx%=G@;metJ0B*EcE;d+Ks}3MsWdH=8PUjQC#Y ze!HDgxjfI!-PvYeboRLG44?HigZ{ubfN`Dbweb0STL+Ol7}Dg@_g;7sI@1T*>}&0{ro!2NedG;Q2)COO1?;n-&5|350Uf92HNIu zfuDeYYQ(*O$%w9KhG1VbVH{LIj1KRr{tY8!@0F$IML()MH#SH10e`@+39boY#U>Yi)-86M;52xtD3rHKx z=kp;dgQh<%Ia}K>4b+AgHBqYevNr~&{Q$8yt=s16v^?ERsaPESQSaL#krMQd45>CD zdcFSTHETd0bv#{FSb@Vb{1=PtFE-#mg&dbLUyRieOW$Ky?#9=j4<;P-4IKylR4&!| zfPjn~RfzL^5(0q;p+MuA%nd7xG@8ung}uD^Wpz%=qdpjuQL-x|6LRZte&Vp-jn7pC zMc&mu1dJ6x17u0v4Ww-_fSvjfLEihF_gr*_xj_7d_I7(3$PUM?R{K=y`bTEEx>ml5 zmoOv+x51&rr*-28GUrRi3?>a+Wr`=WGm^7)bl7Rh)aGkC^UTp%7^{zZkV*{s`GA8{LP7mx@KdR@3P+=oS`pJ z)Ibfi`m+P3LZ14#-5^kI=)b~{IPlfYDbKEH0T(1Z_sJ4lnwF3Z1-wSmm6BS-#x@ZX6y9tL@oaRF_3lHld&-$ zbhVeY(u>WdPCwfMVIWxCH=;omcK6;>^=#I#xl~8Rz_Yi_KNC0@lp|EhPnAdS*PliM z@luiHPH~-0z^H{*?xGjgXe2NiY6*ELEyb;%o z{Z1s1of64u9w~Ld<9_DqBJXs*M-4QUB7R=|*kW=PYVdPy@9PtV+RBC)FBtsS;r+i; z08Hh)z`g>P0>|Nj2Iuqa$xTv};1{}_;-g!S1g7tS&j7jJ(a|xEsZ!z+hsRn>TOcF7 z8yXxOAr;C=X}x}{BOv3S2yg&s?(XhNb$Y=zdt+1HPlb?Y=+cA}PJvI(2Y{bg6;q5w zQ;`Dx<`7xH)!ckjOMRF|6^Ma{L3WN9o7#(JTk-UM%ev6Z5ZzV!ciO?gUAt zcGyZ)A4`dieJ#m(=nWbS5+7q|NP}@$qH&mvdjKJKz*0r-W2J{mmgG5kfZ68*3mYg zcDB3lmZfmv6Yqo|2r%Uk5IIOe?fxCWh_DAa8BOG75M(6-AxG}7@{+3h^2MKt4-YJ2 z0)c`Ghsl|vgTo8W^Z2#S;LuRXGF2fsPA(})-kL%PK0ba#u7d}RI^_fCOI}uTa^`W% zz5AflV}=-Y`g@7VT>YY5Zue1*kH2o4E}@?vSj)TnV$>U6*T5P;fzx%_kz@$UtV579-$i5C1z(S~cE=K3=KMXmp@6Wr#x_s!!SI#vz1wY}V+67kpX`nT7c=Y*S?K78A2 zR4?oLn+xofMGUHiAhN>$iU$7m`S15oEyghm|4u>Vw~6hcO7e^HK9M%~`-!xF_G{6< zS(yOyv6~tOQ`b6>YWsi0aKA4!qK9O^C}~#y?^g5wdSHOrq)PTR*Tk$vx8eWwzCZuP z?~8#EA|8J))CQB1CFXZxW^8d$PGy?iwI<43; zQQ|1*q5p)%alu~qU5YH<<-M6FtEb;7H_w3?*;ruG-5=Ao(wUD#>YKr~u(yxNN^ulQ zc05z6aXQWIkL8}jlNgDU0Hza>Ty^$9t0TcA3s|6~()Ov>P64ex(o&nEhkp;J#bf7^X zooS*3Y6X!%c&8VjrSI`Is~3mMn@P$0p;(l%BKKx@hX)6d>J57lVNR#7NJvN)&J*ze zqJ(nKBfWfzwc-Ki*Q}v&0@Vm~XC?`W0#@_gK?@~G9~$`5cmAK#x`IB~4gz~MDtDPh zW?@) zC|p>l+Y6=l%63~CZ>R`&-~GS?L?3N7`#%=jRz00GDPFzG?oR%mnjdQ`hI!9*`_GBE zLhbS8i?lR2+}=o~ddo;Xmuhx#bv>?(Fi8UIO99kte&16(oV_0KJ=gE#XC5Cn@?WkE zm5WB?DEfGkF)8cEP_{f-qD|>pBMQ`XOgjJ(=*_*(HJ}2N>@I(tNBbhYqY%;b5#%!b ztmMq{F0S7+oa*cAb&enr85${#rREEb_1h-oDuqBZ0>FToGZq`31qKC0qJb0+pTqte zS>W>oQ|m80e>p+-UOx;HWHgu*p;X8L1SL#5(<(!V`qnnL@bS^fH!XHYw@H4|m4M77 zWuP@Ab2xEWpE!*SC?Fu~{&u{$$R@Xnp981O#?4-6eQ7nA@zi>_K4l)qaJTbx+kORS zvOC2Olx2B_8rGuj&y;2^@$a9=npW^i2oBs6|FS=$ZOTGpzu#m19 z?;c=U$uJ!$&jAkeq9Hk`NTGuue*37Ur4>+$y0K-PM6FWEIR6co#YDt%cIt^b@^qy! zMGJ9@74uGh{;1y_Flo)8jF%z|%c^t^C0MHmu7X>SZVbziLzfEYYU562aF!fTx5mkv zc3scsC};``OAVKW-n{%I9nWM;WU|mAuUD_{_E6heaPX>&jjq?rSuXi6eU6VY__}J6f08JO@`8J_B zL!Sl(n$P{S7_ve8IzZ|@!{zcRI#3^LjBw9a)NFLF^sV_F-Sg+O!kr$bV5Ty{ZkIj1 z+6anp^9Fgtw<@7Zs6E%v4w5gYGLH+D&!r>8bI});QNzKRY;-23&AH)JZ z!zDs=zgZ0l0HJTxC>@bIe%oY(9vt2CF_84)lNx4647o?#vvEqfx8yi4Jcy-pq;);~ z1IEMwJLHWYGJ!}L&G!5IPJ2UU1-m#G82QHp@z4KgLY^n5;e)`o&12^$Ir)0rQ3OF-y*|qEQ(OmZxs*y#3OBczRM8* zAg0%zpi0Qf9FJ>H7r5+;knE|i>2VY|s5%6K;#lzJAy1^t4{p3xt_G%@Q3coY-uZ>q zpV_U6O*>l8&2g<{IUb+zR(`vAbJW^&N4?;396S{>#m#v+CgX`>vf_`%ELCZC;4HPjuR^@G`a`Wa#IXX#fA^6vDn z7zN_42J^4e2yv;)8dJzVKOC+|e;U8Y&SA4vz8~}{uyuVfDdNkQ2Q!X}j&}{`D`_Y^ zjL_zdvcu)a>LVe{Kv!pFHAbDjZnp?`zSaQa`OBBYgrQKyTWBXPJA+-do3pfAPB`?r zdNFDdb@ZCR%^`54OBf%Z+-f?z+9uCG1IP197MpedZT~zEv{Bba^4*VLZI*-|>|NQc z7~yNvgo3{zt`Bh#EHVGZ7JdB&9&89Ig=%$_`%Tag9kPZ`P~;?=B^PJX`eaT^60E%O zw|DQ76Ima$3=Is3N8dH}M+OG=sbf~l2G4rnx3v6_mZ8YVBI}I?q8s;hCm%#?Gzau$ zcIvvj+ZMeby{#%4o7Nj!ThtA*w(-7;V8|UQpg>D2$b>pNI_6+Uo z>l`OOChavM+6zyr{&8{Z{NX)En9D7iHjWH+3;&=oC4xB{3-Ha=XpGDlua7uSA^N}^ zazeU9iwwWI{xr~jXn|Or=(ow436EK%!YZ>$#mh{`{h`-ZWK(csbDzeClH9LkKvtIp zkywMus*JC@&iyCR%gh=sYL#5zi1<=q)I7^A1`s426~yg0_LeQLKF>`j-d?%iZOevr zw1kCyieq#v-EFa%?IO%V*O5X_HE>#c-JQC#ZGH`j9(q;g+WbgYZ{TT7;8BPt)tSez ze>iDzE@!E|8Y?!+E|Adf$Ssj9rxEsIIlMZp;tcTO=MzH{eb?ceMil7k4((dV07iU@ zOfY2)M7SU$-suWOBNgtA?IL8EIfIyL+<_6vNE;l(D{Rdp>u!yJluBNphSdV2Ehy((+BW%>cD;ley9<7n*EePg$Xfv%(|}@!_ZJ z663%`*@Hr_Vv8w=CC3$CE>DhyPp?ZtP4+~Lt58123JXwE5>7U3Q;5px>ZQ=sYh3+8 z-t=nYJ%pk@?vMMi$Gk-c8bmw*t{3$+#MkPlXHXU>1hX~q`FxknVlkQ(XkHqXuw z7gR!VfTjyT&hCo9k?`)sUH`&+GU^%DnJetS=ayfiFoWmz|kN`Z+2 zwKTM?klvx=^?2xG$;omgh=wpzeiBDjp53b1)oQ*8)2dqbr;mf6`eH2~3Ek6#scH;% zbO;CFy%;|sP7=wxT|#;QD?(4dQ!<&WovNO6Kill0H(s+@rWg^|f5Uk-`2zp?I_pxB z2&Jw+^S4^)(Mu1Q4o;a9_|)y1ftbgleLIh*e22!v&|BURdVeYek~?`0nK9j)HMUSY zrJUrH`(W&n!#6@-EX9o5P;Siqz55LRj>jWt2CqT(SgsU*G?kK;goh%F>SJ~92z+`Q z{{kF`BKa}DmLL4S8(y0AQwx0jyYi!`bq)?Y>18)mP={Go!*tD{yW5>InEja(lb)px z^i-7aHeckZZT2=)z~dpWu<6v2zY0^w-Ng6$GS#HPV>q857yPhS+iGH06?-dNxgvKB z`>-W9ZVnzrTHhD7CE8~eQ@6mBDqO!(#t(VqhpY2cgK-QS?4ixiUoF1F{3tv+XT0C* z-G4o3NMQ=r&m&7lR@he%ZsT$hY*4kF<6^A0Hn{n8Z~1Y_c{gh=eLzjIF?xWe+)UT%aD*}Vumfr9d&Y^FW1Y{c&g9HAnd&`P#+433+eAYeT1~ko5 zZ_G%?Zr7u*nFdCUW^O^-Anvr=U!*J%Xuuqer_;*#*F3{ve(v97?G{_GOqJ8slPQ** zj&=||vz1@COoi$sX^c}?o}Zcd;+WjCq__ZKb)^i=p#svLdr=9KoEvKg28{5u#tINyvl%(XRC<=Y*PK$yVl-M&v zH_L>jwlmDuuLXRjfobN(qt8bvJEz-_saAxvJ;Md@GRL*leAoGrfdrPmI_(H+|Narw zo*!2%Fh2}OOYaO`XkPDvqjbMiZ`>%M8WCmY)qqmM6nDCuyAV`=FxJp&Gj$fQsF?}U z6uTa|h`aI@Q{_Q?j-MKFtMri+&K;>&oGFQ}sFfhmiiMo*j7s8aK8L2bT@{t;Y|_iX zF8YT(n$Yr&2?RlI9Lm%8v%WwPcV0Dgs`^sf_jcg+qxGaR^I1}fCyL&;i2@bKO7gv| zSb>@UDQc{?mR7zDy{g_ShmMAl(>d(w;I^ob?%jDSVrJ8}?7L2Hk7JyxskoLIhfFuZ zGUL1PpZyc*7epgg(Ff8<{>j4g-b~nx;$2@)hRg}pYf)>)$3is zTvx(fv||tF_oY~FF^alx$92yIB<2HiGv>O247pBVcGhRZ!nc)@y*vDjo4Qt}8;;D`j6dt9@FXkUH0 z&aaIrO#HoXQKnP8zSLckELf4$E-M6wb;N#n_zyO%VI?6J7MVp|*ZRQ^uPf2RYR2Iy z0z~ZVZ)KDgPYeiZZsKj&q~Lx~d(}0CI=#i8(Ab%r zTse3+Q8J^HIj$~b%g(VscfKGanX?6Req%}K8YzW!PuaHcgU1}@j04J8BNM8Ll@8Y% zXbD8?tk)aG&>0r#UsXX7d&%rn z)_l0!rE~F9lN|5k_ouP0(6cCy^96Ig8`q<$EOPr?pb596RJolAA*&4c!qAjOMSrqr zgv(@Rf)xQ^!qXEarRMturekn)KTGkq8jQ_nWH-b`BYh~=L660x!+w7rC<-3Fdupx( zgwy!t+xhY&r~s^7XJ$4H2(@FKKChs93(-v~(`aC(=6`|f9ntcrB&{WFg5JSt8rQ06 zZ_2ta;yK&CWkGC10Q+{1a8bj}dIe;M#dI5-;bjHd9Z%ot>{4Ye7B7r*R)FMsa{!doQZpjU2u`MG)ts-b3MW21cdjJlH}*1P29Y=g?DiH1rnSf=6T z_B~4rBa~V*?)TzH8Y_vW`SS(B$b{cU?Uu>pd3ms$@{A+P1)FY+I#*CV3IOoi7aP{X zdFFe>q)HB}dYQcGv8%ysc}^)?(XuAoZlL820mZMqZ!07pu4s#pydW>ky!}k{c2{~Z zgs7+s?&x&8-WkKN-F@!fKf86_&l0KU{QT>^?6m^Ez{m|$7S5Myh8 zDFBouY%b2(fkj}k)pAo_1=IVjNqjOQq1uJ%R)KAl7rApm3@l0 zkIx6^XK{&YeZ4n87{0;T)5_Ua`avre%5WG2kZb88B#B;;QdlK0o9bR;-$mTILZ=iA zy-ik<2MT?Bl6v-XI75H0G!tRNSJyfQ`7y{O07&q zN}R8^NrY2x^0Va}TKX0lsdEftch{kodam9(x}@Gg%c|Xq&@6^Td7qbz;cjE2y1wsT zIzcj6e<}elO_4lCmHXv4-4=AI?@ zD2MOAGYp9n)Z0Ii=hv5Fs(wk{*4D>RAXCE=0Xt|`{mNtD+hd7sOwrgmo@4LGYz4&t zNF7$|1f_OUeK`xC7OAwebKseqDj}wdBoD6q2svL zqn*Ke_&mSJ{QZnMub1`>C{8m$2)2gJ<+$Wsk;8yD6ALHiE!o0vw9oBo(p6fkMf*u_ z3=XQAkIJ(?kYpU+*5A4_ojg~?DO={Oc2>_brdl@#5WXhjeVvWaLf|uI^@8&=K9?>r z^VxsZpf_1!u8%#W|Ke=<`R>-{@dUG}a>CVNn%9~GTXs0d0eXqJkC;AjR6(oY$>WuL zZf(}G{Mja;ufm?!y4m<7zU#Tx>5^dJ$^gs!yM-z^0+&y>8IGZvta}?#{~u*%0aewy zwrxca5Rj6RZs`(`?ohfx5Jb95V9^o+(%m6Qr_`cB8l*wGySw{;+57DM?Q_mP-*^5o z7>wx>)?%$W=lec!Ki5rAq#GRW67#3B!1@f+`e=W!@q~ZTmQ6*(y_U?s^_(Ktn1I+r z1Y^+>g@3KGp;X`>>wlOMY;zxloFStov>+f#O}c{eC2LN$tYU|#5uJb;9${^bE#<|l z_L2hQcX45}^LGgJreG=cR4**5a zvUoB+_)VH$?aI04Y@HH8jTVWx47Um#tw}{1_GY}hddi{Ta5~MU2$gQ#_T`*)714G&!E!pAaanSA9X0VQiCp8EbM$! zmDQf*l>2f*t9j1XuYyM&rc+JP@Ko0BHd;h~u6&kLl+7@_G?FMoB} z1owR+*c?w45$Ns+!q4a885k?M!IPl8eLA5U2Lg;CN%C z#*JikJ=l@zAB|L%>3*i^yFYvnst|x4e5-Z+{N&L4Nh4YYdfwT+tO&CijVfETWN}ni zHkLH*_!$?|cD&KstuvBs6;4!I$nDgva+bhVh-VPQ4A6hYh*`sio$M2R{3o z+w&X8sXgM4&2x8NN+DS`}W$2vIll0oR z4)(WLGzxi9+;}lq9pC%*S$#Xq4P<(&4Z5l9tj2Ho6I9^AE&9-LaKG(~!M^Kfsq;E6 zkBOR3*G~Jt%6q6f^KjaKy~Ydzg}$nTYJ(&3WVmo8RR-cx9 z%|P8<**K``OQWonE%89r9CMFv9H&*0`9zfl8a6IxtL~Jec`WeJOt6P|A^%G3ncWyR z>6}Mtx61`WOjd_!Nd3l^0i!IHOgufMRP?XJ6`o(ijtv)RxXkar{)lYV0JG!fk)$Hp z5k!1038g@N$1(e(6N|@w@+0|t6?dPEm^vimeGL5e4XQxc?G3zSyL7z%a8~eYOBHZY zVAU2|aJ@K+XGODIu$ThM?&=)kaa>Mlh4F-9o`m~&!)^Q4kai3AoP6kvfU=}GnK|Um z&5ybYU(!@b5=K~(P6uabqWi5+=c{BfgU{{$QiSv_0-oP_fD>wuje^CY=l1nwx2=s) z>-G=$-1qCio?=Z0nf>A=`b<;locN6)l9ahcSqzZhM1b@>F1AyO8&uqTA8~QL@6_=` ztCIYSbCV<Xd}e zW}_ub=3D^}J^JC|$I9KA-YODb{v5sl8(r3+qeqX|9k<>Mqd?lytsvt_rEEq$VW7YK z(?kuuv`Q~qc2)PYVY^kp9+?v9cxpDd@WO3CAE9=y-Y9T@#d7=Aloeh!%6j{XgTOI- z<9S4oDob^Ovm8%Z<62*ZMG>e#UAXsu!;ucbjy+m~n13ujAcAgJyWi-iIrq3<&D00t zT^s&SJC@fC7AKdXzoJ-YyOjNhki#?k%L8E;iPr)dXW>-qKJNaJgxvi3 z7pg9aH%lGCEHv@*4u`D=;tzHT&Vp);&*$nlrC|o2`O3Epn3o#$litABeZ`zk?7Xda z`6hbj!^tSBJwD5KMxfC1xHfyGJ0>rCn?2GSsT%1HSWz?wFp_1=@5+cOM+B}tWER8#xi8}wW{Xu#ocej0vkhfpX zk{F>qRGqpzMqGNcQXnVeN%27JY3{t4mA|DQK{*(JhFU=TPsy_GvP%_xO#gYohQVB<6FnEOgbph3f}3C`odZZ)aoM6Ne{iI$M5&_B46g^mexi zbS)!+&ra)}6x*%#MSffv>gr}fVc{}ZxO`fi`gNXU<7<93XDE^HkBQw~Kvkh2=FUf$*rf?lSMC z#q6|sv1&yg%~@mY9W|X=0rS%J{!-|2dSl}bLOC_(|^FBS*5-K0L-+BYS@l0x9_yv4u?A-Ml!gO1qa@XN0P6)BHx zLr$XNu_EnA(9G?;+G{XMMDyXTxJlijex#BlmV*`Asg-qgx*csYoYf_IV_s?Ae!M{y zWS-rZOevQ#eMz{OmZsX*DSU#w^KGXI%~Akr7#(auj3$h?xQ0WkY%~~FzrXnTY^|z9 z@1(=kqaHnmqWu)Tl(?DEM~g0d_Z#lmhm#;T-T9*g)MXi9MbY-q$t+tYnJU%fC8E*e z1N+m|GJ6aqtH@YvvJ0RM0i3f2W*qKUhSB1~xL+gF9LGW(5EH+- z%rDFPX6|yfJ6C0X^5xzd<1{M@28Et!X*DgOHd<{3wu3-#lJ*`{Se;A4VO{+ z2Qm%jHUo66{}%Vk-e?VWsmaOtHFabY8~)n!CAfSYiCfzJl*~T`6W|V==KF|osrS6} z755~#J&Cf=oBohv?w6y*Wy$J>JZ^eM>K6VKG2s(s)!P;8x%aL80vq+Pkce4!bPgPo zkBZ$S#=GMUGK%Xrh|{Q_;$GRczcj0SKg4YwXo_9cxbkzp;%ez^EHOvENgM`Jw z2)aJ^*~^bjgfK>f^lRZ*{zq1Rq8QJ;mXNl*!0wLJPZCuJQTDf40eic8k3F$;T(X^0 zn^lcF>+77{dJ24N9ruho7b#@nG$6Ce`3f`35`6C4#sxJ2sHqN{JBZ#7%os?2Le1v- zpuOAvZAx98)~#K~-bhY|1zJuqiLPA{na5d|;zvS}9EFwW_6tr(q>z0i?{o{@9A{0^ z!I!*_&Iw_kO#o%xdnoHmkO{5@N;=~qWe@!BWQCdeLj1wQ!yCuB=L* zZBVhz4HyNee3NiiXIEsl^os|O_S+(DrmfL}XigoEULOur`dAUKlbb~s98~!H^yp93Q7t%9~+maZ0SC4URA;xXe8iPwtKwxQked7 z!#MEvM$IGY&J5PTC#hYZx<|HxQ*B8c@7F}}p4}=8{2J=CW!0y5iU@>9#KOrEq;E^$i8vm(X{4p%`gYR`~@VF1IZcPDY zrfK3_>)!a2iJJXjKTB59tJ{HO1Gs-=cl%+m>6p?A_TRaas#&KKYckJL2vAID^79?@ zVr4UQDh^Ys*46uN?Z5i6g!FybH2T=l-ofwRpvpgco|9^S>xc;Puf9oq^#Ef5U*>E3Fuw&>q7Z!?B2us+BiFGs;mTm0Hf6=BiPdN^J#aUhocG#ag!K)nEqYMT-sZ_dSXm)TQ3mrLm=+CI?+=&2?T)AZDz^LB#+KSCTvdXnZvbhVbxFt+9G`e@X8E-6VPa5f`{7!J@mcl>tm z{Z}Ow<0*~fqkgszA3j_~kJVF;`J<3E-$gOM8bi^@I!+6pLmjOO_B45E^z;N$>0$gC;n!r2wNw*RrSYI0-*&lE_hNO+O20dX!S?-~J6>k>2Rr?KY=vT~QD2Q60|jibYBSrD z2eH&y9IbUT!69KWuM|+L-ISm1O;mLJ@+5%nW6YMDL?RmTiXJsLJM7d^OKWz#(iHY- zk9%Y4wS6|{B9|qbObbZVQIGtd#-k-5R5}6Jgpr>uK4RD>j320s6a}fAj?iI(Qm_@W z8X(ZQBmAH{okTw&Y4sL|K^6R}IaU-QD#F}i7yV~d3!E`Dwuf_y{cnsr84mgsl|y#o z$TSW|!^fV9?=vomvW^8wI{GqfXk9EoU@tNb_Z&yI@#boLF@d;;a6&mF;h02EtfDpy+W%T_KjAn*_*z` zx)n_yy#^O50oOnN_7Rr0Qsx^5m$U5HYi!D+Z8iyA5SzQOu^Gh06;4 z18J!qmaV@4gH`Inc4Z|y)z2)RVW`Z-G5)1ZI>|5QW>Tw(@`-YVEOR`<7Q&0m{NkX2 zp>hp2a$i*yo0qScJIg&U)e6)-+uU~CfKS+J3rA!?@*Ta_3u@*40b6ICQ~0)GXo8m#PLId& zG-)+RN*8tla}z~cXq1v0Ojn3Jh?En*=Ixl%zrrYf^+FGJA5Ibmw03F}}6%UuGE8{yfSMK`Nm^qkQ3{ zapl5P?Vy`Fk=oiKRi|jkyrto0+MPV0sUSL$(KYnND!wRUq!LzL zZ}9LcMxWoY$f!LIemV#tgi~982Y~l67_`%i4X(o3c*l~`LfD^3elT7-rttzu?C}og z03bfnnoCqCEnFy|!kYkAJkA0Wb=@5Yn3>~`t! zFfeHEdUQxY^DkzTHtCkzHlt_6Rz_J`?CCiDL}`Map>#51TL3m&vwkwSeGdmDgpA65 z*iZ(JD0g@BwH+8Qy;%1~m65i8_WYIgC)cmlYIIS>@7r;3AyfXDa~@~OxsQmTr#l9H z31W|Pj5g(3{O}*LH~Kp8XDrpPHx8Ghqgl^v*sL4vG?Uqyhe$RI%8oM`9 zN*5*GRjuB((tL(2)$O{=ZLyq-LgI7koFFAjg+ zX_p8D-G_jG^Ys>>5le_u5nRCcWL?x=yB-LyruOeaUuq59t zXKa}!MLwK(??n6<7JYx3+L+I_LRFok;D~N9I?JfF9}B9dMGJxTE87z;3U3Qo*|KE7 z-0PU}`qB|-wwPPUhGlBjeB4mReX3?P@*r0szhQeE{lJ@3=xwE$=oM-7%f}y2&ABK- zLqh`+ElYK8oKf^#g-mlFBya>*c9FWM+9d+XBb}^Q!8dRf}}UDpr{KIGRZs=k(mU6x}oJ za^vuH9$7zoSLhJdJu=a-6|SA9%GE(B{8+*WRgrqr&LOGH;lpNXnI1tU92^`H(ccM^ zz^!d9OR}0MgOzyqVxufJrrW4857$LVgu8~PnAW$j$@7e=eXbt!nTW|Q)&I=VfR(6~ ze4g}6oZRTh_nW@d$b}a7fmd4>FX2sXxtzAErseyk{|wLnMa=gjQijALOE`kY(O?3) zPRQk<{{>HaMYWN4!u!MCKMn1YJO=O){*=d7zsM8JWBnMs>5g4E$K_JvOKhb0u^$0&Wu^kC2OXrt#%1e18RCI5%+2rPEpHuJO*?fSpQhx zeqZGviU?qOVLK8g?B;J~Del+bI}Fe7wP}kft-~u}EiHQqZVTKCvu`VzT&b6{2&S2Z z52JS&xt?%@Z{eW+{ETV#GG?m&d&m8rta!rzoiHX_)TN31d^GcglgZ8&Dr%tdm_t}3 z)^YM5@9oQL61Ae~q5M6&#pqw%A0N$mY>gI$!+G>e^;nhwl8q-U$^2?^-_-Rg3Iamd z^NP*x5W-rFuNoY`J2>oDpdt)*hjDW2GMj`Iczd?+ou(A>$0flYXy6AG1GGoA;Zzq_yG*}DS`7%NYl>%`G zDs0lsl|!s`CB!&D0j%DtrTe1I|-mP_F6WX z*QAEU;-~(T(l1WJ;~a<-Bo9$^T$x@Mb5GErbhC zPe<~OJ`yRK;BmAJ99iqADckoD!&-bQP;#D#!ywxBSeb<-7&j63Q?E&hVf)x8YRPzg23xP6<6L+j|Az-rQ zw~0m~JD7M@qZlCD>%Oov>P0<1-z`c^OuUc5cW3MA5;-jWD^~-aF&G;9TFy17z*x=6 zhH((@}$OEfT6q^kX@8n@94N!Rpo7 zI{t$N&_s&PRe|<&t$dX={_ac*^EvhF2nqn6ptCDMOHDTi3glLxJPRSzRj#fW~=03}E1Vs^FP4$orLh;#K_&KP59rT@uq zepPL|5_8Xo)?Im{FuF@&9sS$MAW=XR+|HPf&&mE2{QFQK?ZY!mWzJ0O<%_S&z&hOa+J5=pj}5}6d4d0#XJKPNp}?LpV+ z4Ih?nbL+mhmII)6Oo%uL+9$RAKa5(^o;(N+ws(i-``Z6BF~qv#J~RSy!|L)G%b=1KbYLA^ zRMsh{3GDkcDr~D|zc=D#8n=kc=x@dJ9*%7bq?>mjK?X*1HRawyoyBQYias>c%&Ga` z_cIqigJP#IlcC}SM7R6R@0;VT2y9(l#Ooz0nP8)hi83SU5VU1@Kp81Z;x?I`ZJN_L-J7BV1B}*hSUx-BjponE zGuN7~1Q<}k%5*7aQhMCNL?|06rMz;No|?rdJewc;o2HVR)y9lCM;UL{X8vM0VQ4k>YdKFqj3 zazxVn$|O3}fBJeezkj?8>!G2sgfnyrMSw6 zpm5yWhE(b_ES|V-8r_63n|W_3^R{B^=Vzo_7@G>vCT=Ik-U7-y7B1`kl!TkLz10EC zj!-FnECai>F1`FGZ0-jQ=SH`4hEr`wIQpG*#T#6Cj6ja`aw?1m{*EWaSEJeKa5>sQ zDz-DGH?e0|X>%s{z1+mdpco+v0L=dGl-lg=*y!tX$m20PX%PcSUAkj>`BD@heHq-{ z&rV(FJhr>Pu5Gq{Sz5gto~6TD_y+i0ma|LnrxLw8kBT?0;hw~WDX4n41;jFI*CTLk z8>721kgfMq@^!>ffUJcn>6tJC4uh(+JX2i&AyX;g){@!3?QEVMfe)x&E+wFjm4u9C zRoz8^QuxQ6*_P!nKHKH*h$eOWsTZv8=Sgzk7S>#!tlgyNu{Wz0rm~zpLPO90koj}e zuq=t&DLspc+n`8i$8r9)^V1r9yjeehQN>^JR;3IIK4-t@!3y67$lK1=93w1UjzwyZ~ft|Ql@irlIy+`N3p7lnfrj{Wf*6Wke zg4OTECN&jGD(yG67iSQ_Zayt)I+CY1imr;?j4j%t zK<*KqNK1vSM4E3mX8D|%TKKpv^cM8o@)4&n7Ol=w>RX4&o4-|NJnWWWlL+yIPfNh(W2Ef2{oy9lihUEu@}z?oYw$M|B#fV(+qqI zoK}mZ5O#6NuA_TF!Mn0a-tQ=&?^YrkDj{D!u}{)1;dDX-0Y`L7FbmYvi{n)SAyH5L&U5^6qfrC~k_<2j4!QUe|^ zZt=V(UJRnFlbh){b#dnpO3DJXmv32Jig($dC(9Z=X78lEawGHD* zu%_SI-y&1=Zn<}7qBfLkZyc3WeeU_cXFi_P{tt@SbhF8dgA0qYUq`B50{<4|4f0c< z_*4YbIeHGMJT9uc)Af2(NSZ5zu~pd-a@4CLVE1?~(ZXKBMptk~65&iaV%DG9BkGRO z{u#{d&X!ii-g{>I>--ZlkqGOde;(SW5MXZel#nO4LmM4S=}nwdMGM0)>UIe<|JRy&QT~da0 z{F|epr>tbNfF2tJPYpZq{^Tnm*M}-Ch48%kkVeQsgkrrRgGSZ+hL`dSVARdfx=6dC z88}mDZW*JE8unk#Kq8>dS%pzUNGL%|U!7yUbj@FJjc%MzjyS#jh9gw6ldYFrq^&o) z1*X=Q2htw3(_zkjzc<+trfwDMCVB3S+3vqDv>$Q38Q34Rb|fXD&C<;0!`)5NCxLbOG=dHX(XMP-l4|sMGxEmIart2;PKQ)m;r$E-ryvSZR2H$vGdZD9HOh!LW-gwxl{h(=EtJRrLY>J(#rH6+^$fV2Ya6qbHBK|wX-@b?|xJbJcQ@N z(fqA}{9UC4&TTYK8fM(1#3y+y`V8zfwi&Z{E++-jZf)vsp~yp{kmDQ@{V{pe3g2 z^Zv6Ry$^6R;K6SiKfv{w^3)xr60X)(3RUu<@=ZhWmtgh@_zX{Gs8;l@e$u?f9pMc^ zb|4F*X3e;NC4e4QIPoNSh0B4dal>mg2zmrg43*4tHZwM85?Q`&wY7c9;*eZyG|%=Y z+$z=n{7Oe|&m6S|VKF5bUFRK(4yc8p16?y#6Uir?M)w&le<2{)w8N1*DTi){X}=OG z5XqU#48)1=ogm{&DO`DiV&SILc6zkd7az#JrA|*8vNu!P;qQS)4nP0|R|XuLN+7Cd zuT%Jxi#nUNf61R;=18~`7j}Rp%wwi`9f@mmAGtE2R5Vt+*;eMdJr=x& z&0NTLnzI{q!G4@RT0Y6XD?!hK7Ygg7t{wB&fP5ROzK@#0~t#1d|QV{tF zReGgg&jVYEo&f1^vP?I2Lqej+&Lc!m#54s45q?GW@4j%p>TC3z*(#^&3cYt15~8R>~ z%jb9T?Tp6Pl#S{1qum)RbkIu9t~wshqsyY?CAuH1Bm9B}yYO(UheRD;NrA{0ttRGk ze$~3Mkb{#N=}=2SO{Cb9hQ6QbCm*+FhyBA4-XW9DL}$vS&O(fvd7hu1*6!iUnG`f$ zH>w58BZOLX&&OLh8R<>iZ;r$US{Z{vlf=@k?gOto&e)q#KqAeEC?942#rGcxzvTQN#(1{&7qoXzaA-`0 z!-O+R4=u=C>04v(z7LcbJWl6`64EI%cq|xY~!QPuvh(gpPMDQCLE{+%S)8fe)UmS`*QCsUv2~VuF zOb|I-?KLx06Yf0hjqNw*$<|IlxCoH%-M?%@y(x2+1|@45V!|oglS}9*I%f6&4|JW7SH8v3x|(s!*jeWu4G4N&$G&Jq~=_=bJ?=- z`XMdu{+mQZ=!?vKq{6S4yztg=4V^L)aa@1z0smS1x-WliBPQ`Uj!IXF(S92Ntd2_t z%~U3{j}*KFg>O$13^CK?x!APICUq*)dwBNTa>ho@UUE-h82ODu*^S55X^jK&1Pps$ zns}1zFQyEr1pABM$4?#r>$H^0qWQ-Qi9Bfj2~vOQ5M}f6avSepWM0GY$O@PKSzGxQ zL=j1^DsSd?v{ww?B!L5kPRiG!kYPiHw+Xz7IE?2~x7TnZX5SNi4f&W>lo3Q<{Gv&i z!zMLK#;f~4nxT72X=pAC>$|^<%K_g3;2zxwO<=WSC;d2&hY*fUwt?8IgYm>lYUfci zQp*x{O6dLUm%w%*S}R&6ooXIEpYpVb@hq>?VO&^i-{q>QrgYLZ*!=urXjR19=$SD4 zItJN>Rc1y{;dhKc160L)$3jIf=4kcSpw+l8NBdjMa$oY8PkXT9`a>PTU*hYtfXtRN z|D5#a?o{pAFQ{C-3Y|(W8GCsz{qu$w)y{MP@z61f;iH za2O1i(~0p%3)!xuOmE*4u-X4?y#o3yvsrwIpX2s%0ljL!Ryn*-xoO37Lk_0PFL%Xn zH`$T)CRFHDsY>&u0Jqj7#nFwYlMUfcZz!$N~f9%o9s>1PA%`$e_doa zoFGeraGxBDjZ?>AVOOX5qR&;iC!eoVJVwaP=^mVy2?|q6ekpN0$(|qF8QdV;nZoT9 z;ro8HM08gN^`b=JgNbad9eTz(4Y{!#{BvM|1N0acbL`>k58Yl zv`6`u&Ev3qIS&1pm`SJ&X|PfX?90;S(BjcJDwH=^spP1d2Q7j1+UoU5Hq8gbGWBMB zRDneu+~Wx49QoHzbLDw}-pphyE%KQH(=?Ej#4)!Z0drJ;yFolrMO;`01PLkZ8?!@o zGG5l6%fY9i+T|1974*nw(};nu)k}ftZ~>ghOf$gJ1MdLUi=mE8jb0~fHVwY#_QIo| zeZc^|xmxr~gdvY@7WZm>#bm1xLWf>Vc$%x;BJ2U$Gzo(DBf|``j(`**`ef)`Yf9@guAqiPqi--r-{PPa?N(sPiuHC2ET zytrW7)sz%9#}DhlI)D_+Rn85F`ZfJMF6Y5xY^AGHQdW`ewmapywaYEZ=3wd*oig&< zwI*lK5|z5~4bHG?d?-FW_f^;`ns&te4kuh>{&!l|A8^6@%XFTF>QfZ|#UakXesg9| z#mTn7-S>C!nltSc4xkL&!~Wh{{(E&_8^!AQBu*-54ZomDX*?R;g1VvUQU~GdQFW2C zM(RxxXbSx%m_>TXx%Y9l3SQr`eI!Rk$6DT{%4h~xzCT%oQZ>> zE7U4K7$YB*2HmQ;`)<{#HIgG6+tE_3&8XZTU0s(B(>8T17cR!=S6=Htoap3AeF@?s_`%Tt4;QlfYD^UDCqf^T>y zf-u&1`Gvb!$B~G2iZ=8thfN6kN)K>Y9_s~IYQ0!`!`#*ohpbnXS?2dnLwXMdp{WE* ze^C768roI()!+0s_m?q#*v|pO`b^2e^r5QPb~Jf|^#L0#rGTQW@eMsEhEe-?;Eb(+ zyBc&VA=d~HT+WG(Vx8^Z2}u9;q5btU;=H@C zmibVd3KwHF4U z)Q+kQkNWQc%pWnvKfjpgImJABihoL}rKKhG)kYV)gY#f|+w%B`7pm*#_;qNc~@RWg!j=i*OeQwN?b29p~IeA=`^fOLYEY z?pF?9Go+)3>WZ{71AbZklAo+Jp;IG+Tfn8$`@0YAZ{N2+9Dt(|qfP;VmsSl#p)ZNc zVrwAd^%A9BOaXLkG@x}viKu;WG{ciN4++#N;0YFNK3L4{F!KX!f|ZCLg284Ya5 z<<-RmZ)mcE7yds<0RFnN{_`#FT!+yLy1t@}$Pb$8!PEv1MrGPL0ty}V#Z zDlZMO+jYsr>5^QF{$10f)srGV7yYFy8QcAR^b3Plgx3kb*hUTH(LU_Y9pNBsPSiVw zY7}c$7Ue#YQ`MZiJNMq6X_Ona8h_uq-2C}T*EQT-r>8f(!4Xgv&JPGVt<^iiH8cF# z;ri#d^siCQ`~k`Q0#(A8${j|__03Hyrw9MV{5LtGoC}KAWUUecg=@O>dhJ20*2nNM zqHVLs8^cm>t*okDFG?pK%c-HFqJl9pJ#7&**=X8|lcHvPK6?qs(i5 zvlx0!s5IPKTsPR#wcR;{EfpuqTw=Mhls6Pv4=WXhvh2-fpdG4mzz}ytvvpm4%F`HiGx&iQILsHlGWWHz)KKbm!8I+8C1CPnm*R(qj(|02%$ zy-EBx-@~e4dFLMnFgJhEHK`x&LPx3Qai5NZH*J7?i5R+=DB2uMV3h43NB;gzCZ6{- zV2vzPakY=J8A@|{y?Da-w!G87^z#$!09&n(2AjWf^?nK)?~FAzYIJaUf;4G>zA*dC z(mgi6xZgxp3t`e^*tt8Y`bdAauDaCu#1!wknI!+!Kb-CV=8ya50zl})hoPcFdc6bW z865~uOolU}Syz5`H+f&J)IACL4oKfpKu}EfWSlRR-~P?h+_6MBi@`?4WaYH_ITVgO>icjBH6>7@`Qt3w=UAtpZWR6J!etJT`-< zIio)2T6|73#&|XZ2YTAhn@i^O?apxW;Qd4fGY*Xk%iw37I)VutX0%AFO#VZvRK4sj z+v^HtC>I9A6+*ZTc55MBDpTq$FW}+eCKEt>5J{(2Jg&{7sj+|Ns!=shOao@Xf8}T> z-BV`80-i;m&3fpx5S-aMApA{W@;}%0Uv@wW=HHf7%|^>);3y}}c&Srvzh0^15stjU zHmR+7?>AVgN^I&hyH^)tf`>Cim3D1ur}dtq3b5H^CZQJ8-a4+Y!CV_X zP6eu1AeP4fRXX2ptd4v5PnGXTFKquQeJgn4kx2qZ3L56A#v=^`! zM)|76j7^?GiUkl+Vj#<1IDGXRlKj8e+a%Rth`d^h77(X$MkZ(LYcrH{Sr2dFi8T`! z>yYa)O%Dg!SAT4cSxu`Ullpi(=a9bI_Y5fI3wpt0a7YpPtpa$rLcJgf-${ z1YiZ6T_eL4uAc)U*o=zcO^-%*5=#w^47nUnw;vG_4-37HbbbRWLCdFwnlLQv4Gf^O z;KczP^9)5t$DwP57nTcLE;pC&v;d04_nLrR)vdvUk|yEWIFc;<50o@L`-_3sV2zkSD^ z9g&}E5p}L1r@{6Ab?8Q&@~KwyRmA^~YuTdrCkY6dFH=b9!xGuwb1UjV!Jo>xDFsi< zD*ulq6-@$!pPMi6Qy?Y=OXKgbe>akXOd@2wiM}+!$LRQHjp@HXn*svFCvm?`+2EV} zKjK7BSn~NjNB*YC5C4~c97t^dmB3yHb9a;4Wlr4kZ^OF3eGu{zRypc_<^%sckN@eQ z73X0<>48|x$$wJ&{p&A&!ua~4yYk_G7YTsbQ1bidM~GGV-+1GHSy;m!h-oyy|7*zf zp8_fpB2beKmZ&O7_=m3S|NO=2wqUgX^N0TYfyKc4i%w%MYcPAH6e6o(#0dH# z<7Mb&_m#Teyq##UaB1e~8~yY0``-@c5lQD$#=XpcM*XHuix7vK@WAPdMQ^;O@Ow%a zMAqrG!hRCMmnB?C+4&d_t{cjbxa8wB?Soiq+H2|=w{F}vf{An0fP49Qsp#&P8K@}H zC{}%6J~{YeGd)w|7+X2(F4b^(xrN(Z`Y$K?Km7Ar4H3-B=VqHjAnC!4fcs1vVW=#0 zN({tt2IV*R!-*k8l?b3^h{b~v%f>$>VhvzKSUl%6- zZyO#tVh|($(xU|IX~lAg4c9l)Ku}I1Vwkytoj6*{FxVOeWdIe8dRk`|&dC7161GTR zwWla3_cB>7h8+NX+h?wa9HbB5jQbN*Ra(x)03C7-edNpBY<(&7*hMeHJM80?dy2jOkajslHNpi`?vh| zn=ic%v>IF|Hg1<`6cH}x_ts)_B4LsoLhxUc5Fxy@98wOzW>_sX^s&5KS<_`av->}< z(jSphg73sJ`=y{C<83$DR)K*SLv`r;w^-bC$^{f?ypNQT3l;LAB>E)>VJbq{t4onO zZ(^hwfHb|DY5Kqoi~onOQL3A&w%ZPSSB4ku_VxtZA@JGl0zLpeTciEF!MVFR^UY6sNZK*e-@M5UeGceN|ER*m5X-7#HuZ+DX& z=h&x!n2r%lV@ByngoLH(AV;@!g#29a_FD#6O~n#LN+692Io=(SYB!Ty&sECmxL~*+emDRryB&nkVwaFx|#5_pvCU+S@thh;QQJUFyx65eAa9uj{5M&rNe+ z32JHF6N@@8PGTvxWf$F0sb~o}{@uU(ugPB6d)VF3rNs9#`8j#QE6F^LD?geZDZKqm zz4~JfUJ4|d7E_NNJ^F@FI&K5(ok6aXgf7;f#BV`&^+NS$EEAKCX^}EQ;?do$CQuzw ztEh<*O4%XDN+l;9#O`Q88*Av~zr5LV zw-!&q zTyC4?(#oEoXba|rwl;ek?lDgLK>AAy&>(|dRG!d&*eTf}-j@%H%TpBVii`F03%FVd z$;7ie7bzk7`4K`-9C|2SItXHsri%GLCYI#>=;)B(eOcOUklYH4-=fC}4m-P-euk$A|clLXK+!mUpZ%PX5{Rpl%FKt^CVk zYaZZFwdF>|N+u6m(M00WVm_&?)&}6kkZ?u**S04#75%dz!FQr!xz-z#yg8(8*KoodVrk=$eeo(}LH1B4+Cov+g|9rCgF|ZgtpV{<=IAolj7j z18Pbpa^&c1)WjWhB*gffXHjQtPZlSG9Fk%kn|5PY&@?)(XGg z{FeGJ=Sx>un4NhKM4PtT$O7)sEl0;ykGsUZ61G3n)=b@Z_?X}8~ki^yheH(`swOQrU6M; zhEc3&-TF(EF(*H8PK{M>FNq}JF|mrQ(XO`7r;9oToJgY`5xDHXA44wstK!|SvENr} zY5+eo~=qD(MItt9`P&D9HewFj}G9 zG2I`Aj@$L#Fi_bUU%;XCd>;t~6mglv?-ZdHnXZc3pR$NmkXX@N2h}`VLr5of(2ut- z(Ut17bYWni6If_;_TRgdRpp5zVF67@6Bf~`7l`+q7%`n}(>R5hM&2HTAAfKgr`_6;#{97c|KEy}l-d^%=EK%O91w(jKQs$@m#9Qy@h7(X z&wc!es7P;TJ-^!Fq|9vE;-fY=KbFRdXT$bKI*nrFurq3Y)z6(7q*APuA_uVaoLA6K zkMoAkIyKLmPS4%0!;_RvZ=tQ`O6uJR<1Y!^NkC%@dP#uJe9-l_YABN=c%~uN-3=Q_ z1v&+2i6{1V*(?0+_!_m#HfNXx$3;tb55Mlx#-~F!Z?G4xK zxt(w<=5~ha+e5U4ycd#BfE1Q~{{>C1*(l@*4pz}pug=dHT=sOhtOrmJ_qkD!`f-=v zPuDvY9{Cm&F3D|1zx)J`3_!{?-_S`iX(ZV8iV^qv;Zrk^n~ zJip*`c&7*5`iLXqaYi?NiWED(=QEJI=n0_5A`ZV%vN;7(dIw|0!p4p@RQibj>&Yc5 z`OTSFJdK{v)h@%=v#i|5FF3|EW!4U?fJy!+JyEgc_8=ccymGi7;W#6-F>-+H#$ts> zDjTF&@eOTuV0D8K<0B5Suib1k{=S{ih|rBjo5WAesZ82;?jU+QNX@U@r3N}oV_cz( z{p$1*JM?|d0)P()I5PkcWWAc*LHa@c7J#Pn8@>h@@?rPYAZDc@$t{yX%Bn|LO-gype0r$dr<|hM_HzYda)`M&&OMCk8p&XxBDZg z$0OrNJ|Ic)At*lWY1yQ@Td%i}T{Mhk@I>vk)6pz9Sg|ZS>OR5ggC;YB@OZbdPqJ1w`9U^gSH9hO-yVqX7t%55)f2;HRcP( zzR~V6q!kP_9l5|ch58UY=-0VF(gXF1Mb7qZo|TA~NQDT~CQG-yOay?U7Dj$=C*<*_ zk1=u-ZrX|osaK}(fd-1ECTv77KI`t#0#DYq#KS)_@SEEM7AQij>K?6O`7i#_vqAuZG49Da@S?$n-@k`Fezqb6gs}k#>QQ7tYlcvU20?V=oeaH1%p~)oSB$0gHn;1e^C%W_Ofa?%cWPy2r9RS>V^&b3ZsFEb zaU6wJU-ZHP4k+@|GMUF6o>H~}6wG|}%YAQD0Uoh6;6YRKoC^cZk7=2FoBI+}&t<|b zg4_?ZLmhF@9R`8x{0~&(KbEwo4=}T3Iuaxr^I^>PK$?-F^Fi2-R4gt6#Pa6g?U=gW zip#_Yur0x6U^m0zb1nkl2J~ooch|k)!~+;o06SEYY#K9{!L|s0;b(?5`Ha?($|L5G zF1PJ|gg+iFF8llFV(ds~1lIiQ+z0}eB{Qw7r5sLP# zc(EX_*YZ<5JQ@$NjJ+5`e27`EK#H#Nsrmuf$?=Z7`QpkLp%eQ^tufpergqKKsbb z_I{Em<#~YC!3GXNL>WLzhS9cGa3l10m`+&Jc}!ZKU2FUJlH{?p+C2w(zFPg#NI%_g z2&RZG+6;@4K+my^z^Ok2Z)h|+N4RZ!xRNR|U3%9GqANc`Igmjmb!>_qt%UybiK9FygLlM;}<_2A@Hm;{wC;mOc zXs&*$*qe3;n>|2T$0thIwr4>%EH33jC6Xlp(Ut)v2DQAWh4q*1JrJ%<+n->lL>qwV z7=rlWrr@+_Dwj>dhFv*Rf%Jm)W0w&;O)xFw;tZnSi5$9?@T_vwoh_vO>?C8`(IpOU ztNlih<)dYm5q+He@Jr>-(`ZXomf_6m0kWqve+3Oc!uoH!)M=E*7$SwzNmN!>DPJ;E z)l7SOdSzWf%?^9Xa>-DjnTyTG?cb+ZX)RSijJAE4$wmuHv8kvnFrgO zn^Zny8KnYc=W=*G)#ql`7e7!bQok822V=fR_{jUU-Ki&nY}jPM^JM+N<(*~69a4^^ zI(n_Z{e?*F>2!WrER&%qEW{rPI7W-xOu?SSwSV|X$p;ze;KT^vl!=|YE|5sn==SRU zY`j;N^2m2;F1j#EZANU>y;H0VL_*cPyu8GU`5Y`SH?Dh<2zb7>FG7k7L}3wK#5&j6 z84jds-~6@~uy#Gpk^2nq=MO?A9INlTK-W|+IM1JC-o>7gyQ=M zDljSMwwKI!I{|1Pa#8^zXqc-k8RGzwjsUGtDXB}D6SHi zO8Z^k<}8v2EdgKdb@l`%YktM5JLPNH(VJ@NPi&EJF&qm0nY7vF;RX90^4JGkp*1PD(717kn^L{DO0 zpaxz8dp~xv0Wu#jq-MCwO0pue+g4Md-2n`DK{#2P;an!!V9+W|lJ;$mI|{knDUrFC zQhy0PSa=XKY^4mS_!9v4i8RO9srjPPv$w4=vK)n6rU6`rg&tzFo)6w#Zi=k`X_n_> zu`;0I0-~J_I|RxIB9ftZfIuxg(W!$`#b~ib1%B`>5UkbU6>=s~VhFxNO~8ZFjPK(F zC_u)D9+P&PU#qBe+X9L|C2ku>{J!f{*JDCqtwQu& z)QuJ+g&6^Ux4c&6Lu%69c0=XsbpFVmM{_G|Wg?+PRsm6|dzbgk(11w~4&+KzRT1g} zaYLY{oVaHH-;d$DN`0B=zPvCZ z(j;p!=<*#?Y6^71v7ddr4vy0%Tz!NO9P5H2QV)LJjB#T>M^Uz3nP)ULzC}{v95`94 zR|b@-)ci5yaLClhb2fykC8`_)szn-7T^{!e0-~4FK`s`GPSok_PO+D)5z`^Pa4WBW zL{ld!13$*n*pJ%RF5f+uHn}fyXZHTiWB`-@F<9rsJr^5(X>hE@Q#S3Zw@@pc*+ARg z`0oA1Sz^HN@{hQeBxyV@%Sk&#V6Ii=|e7D{XQG%B#I>(m|`jiV)! z+&!O4VqLpeCRf2U0W^;303S0W5h{v%O$KbX8vktdk&=KoK~=w8nk4G&G*>0Q_@4mHsKP`XN^frfF@%Xg z08T)`$$WlkF-?Rwr7+=GEL++o?dg2IRy@*MhiHDy+g_-(nl}_g^yjBxl)=cc4DFo1 zJ+aVebXQ#K4fc93vVw|(Cy>PZ)gCdv@9`?s9!vOq*6jw&E zy~y>X_vOPrv+*=(91F%%SG8aNXyupk)N!24_)BV0pI4oLeQQ}OI{_HpACMP|EL;2f zdm|H?uMl&%{4E3&MR7x z%-)vHU0-WG^Ny4X7y$K&91GHQ&ye!6vy~Hut|$SbIdqJ@@v!7nPoVKoELj2Tua-0F z3*vM@nV@6I*5xrLL4xCWIxXfiy3Vv*dT9Es+YgG&>+xnu0t?}6nP~l!Da?Z-&WI}=D_wXK)DxQ0&(LU z_Hr*kYlc_N0l2Jrf+rrUxlLZfWgvj(WqnQaySkmD%@e68U~aRpqry)owz`}q?kj(J z?yNjJTbrKVvPLh9pT?j(llT3+q7#QK{IZ{6M4vX&J|rgzeU-T{bvAr5dSX*~GS0J) zx4_;SoeYZRdtZ5}gL+a~2~wPozROOy>zr!`rACi^4U~NQ-};VCaWGw_=mr`FFNBhh z27t7jeXVA^2D&@U4u`(gBsu8i5!R}M@wTTwF(+zAZmdWEx$(Wb8kz5jeMrj-PT|hs- z7gz=$7&y_ECp*qk+CrnkBNTn@78W1R^A^PJS;O&I`80= z<4L}Y)c!uG`im?0k4?0!QoC6@$Qvw|j+XY@PDO;m=k}pc3WFNSg0&qWOV}}A+`6Yk za=oBaex3|a2r2}Yk5itVV}`ysj(WOa3l5!67(|Gev?{-?_bjMUpeI3%?u-RW$4j*D zvweU-BG|0*JeybFqfmb34_FJS*d%A|!rt?VM?_%@5FhR=+ODY1#6D^de5h!Lt%c^$ z7Cr9997jZ#S`}#8+(fxrqNzN>9J3&QB7jse%~S~~)*7_A#!@|U%HueR9dK<7Omgs%>T5BouXi!^n6vGxpE_S( z)aNU-g2mc>%X9EEU5+D^ziaAMGz(jD>d*3duec_e(hqZAClZ(R1`~LGjqC-vqoZFV zr_QIfSLkLABJsagc0v-}m;Z@oGehv&vLI-i%bL8CLZwL2ZlUCm&i(u~=Oa84BG7zi z8M#mTeci(Zoo$GK8q|huZ>rJT8{5kFyb~v$+;>NjZ##bZ-t#ltF?|b!xTcHX^g1K$lv*R_IfQEbcMhTfAP*?5Brmy9 zk3oF@h5HJaJA#?$nR(qwR_KFsX7q3-{S6?v!&yCD-4$0MG-D9MG&qXJ#@x(=$F6%o zL?isa%(j&x1Tn@e9#5_r@+H9|Npx)Z(HE3rO}fyj(B|P)oz3<-5y-)lZKbTjzu!d= zx+~7;5iyvb^FOnKEK!^aLQ_@{OiL6=f^>2den;{se-a*OYBaW(+3WWIAR7~&Dqk8P zPs`xc5T3qp36L<3iYWG&gz(i&(HOM|M0*x%O|YUAEG?ER{8f~Y*0E=N5~p&-u}sqD zmS?r@4M1pi4Y~&i;~m6-U_6mSF=CYDc!nh^?+ud1;R5vcKNBZfnbD za+~uiRwG{Dx;Jwq=-vJ#k*Ekg8GinK`I zt;2;=h-=-dSglvr{_t;Cb%@BEM6wJRKM<7XXbQz-aXWhor`W42R(5O%KKG9~3n6kB z9+VxtcpGSYIL6pY+@Ex?^id{}UNI^q^QzPIg#rMCI=G2s@6;8~Y$Lm=yZ6iL;>KjxqpvO>OofP{quA@#L}GpVT!V z%1)<`!)EQ|qp_U`l8vSX%q5ohv1cT!V{(k*O%>Bk*cU9hLRHFHk&F#AJ7 z8VtsX$u++=sX*=@zmn3FAH7|!MEzaX=OXvnqz3jd!-<>*@`M(MTYC-^a5a8yx6OW% zP{tr+sGPaLr^`m2jr|r2uFaTBDQ6(fN5Ee7B#MQkL!aF3liv!btz^6hRJd&jr- z`2M>_`Z>&mN7?!GzHj27xSYUWzetpw>hQQohXg^CX;jyY=M;S^RA;KiY#0=d&^)tx zFPaWv?U%5~Vroub|3W=@mt-Iomg0Kk!R8D~U+f$Pi3G1f@)=?N(R6Iw5!vpoU)zal zz6uHyzsPE8-gXPvJDyTqBHctSh+vTBpgg`NsDD6t) z$Tx+D`uN(3s+!W7PGmR)26Q7-Bb55#=G7e<_Oucj(Y2|UbJ-*U1B&gvhq9nou{tOV zc8(Ao7lC=}fl`lINYJgrlDfs&Z4-!y^Pq(D41VfknIiQTi)q@~Okb?KZUdjF_4fm9 zpdlIoiINAxt~Z*>5p!;I3j~?hAI<43&kwlMEF+k!42ofW+?h_vn05!_bW#NfuDlvkjK27ln?5Jd%fg32Au7S=TLQEFm5*o&PHCcE?S zhqwP+$p7zWBM9}o=~2{?Q6iSb@1h?HIkZOsAhI^u&EhZDnM*Y;=lGu_Lck~5Y9ww> zZdm43IkNX_W*M@l*6dN`VCQ{q@@ALg%MhcnL^buc{{rjPJA#YuQubo23(j@uU*V*WYV3V7`i$7M zlqO@z*1QowbG0D*@#!|gLz^#1{(w-|H55eDjQgE2OyDn*j^OY|&bF<*oze^vc@nkc zRd(~roswi#d$l&49(MWe-wAPA6GQn9cGsU>sgowzT@i>uV#4pIkcf%O0%5h-1FZNE zyt0VAMrHe~jv|`B?Mf@Zf88L1u14pGxEQr6Sc{*ZxA0apMf?#RL`1Gae^t0u@Zj5E zWi=(*$qh9e@VGJB2Yc!8$k3U5_iet7V(N4WqQSD`C_8ob+WzWA#o@F;1qG#6wA|}r zGdPw(kG~eyM$bh-b0^YjJ-dDH6Sl?h_d*1ja6Ay8IjL7ovA8SR(`?KkZ%cNt_^qoQ zcDmfqM^hCPz-l`;lc#97m>t7syWJ)qD62q}V6|!aDCl^9q2G$L&&IS+sZniU7a3ub zpSo8asPPP5X}*dquo5)e3uYzjbw~wa1wEhX4qc>+ooW8t-_&&~)FmJneP0MO56%(v zLTD?NKay6-TZ=l>Qwew><0l@Mb7DS$|9dXyO7tDCL=yZvPl|;~y#q-2V17uA1r>1| zrOcS_0KrkrhUgbNo=-zfF>MuGgH{mz*)6=Yb0K}bK3Lz@px_KKh9tgjxAMsDo|?ti+Assnk#z|>*p zvZPe;+V&F|0V_}cr)f#j6)dQClpCv|o>08JqBTm=6Bnv=AAtMO04Sa40@pRNfKnOs|6!t zxGqlTPYXi{x`8Z=ELiL4h%J<9(zUWmaJJD@cYfcC#$q>U+FRBjH6D&f zr*S0KrWF+m@kT~NQQ~kp<7HNKaLI`TR7O&&V^nD>GO`5e_${Bfomu4ohW^G+At@_e zz%XgIx(_vlyTxJs#MEkgm(Im}4obe@a)|283eIb zk4~eS7@5&JsOR&NJ!J$s;M8|E_qLHCX|P_Y8h3)uxg!d$$cj`JuA|Eprk^esDsypX zZ$;ebK_IhL4z1yce}nrM_PU7gC711> zb&$pmID5Ud=VL1-7LQ3dtNGHe0Jp%9$JrT$0V+S-ailem^%cjSWBb_yMe-YK00_;d zAhybBtml16mXYoH%hKaA5OXItN`QR?H~^qN=~Qm^FD&o_o40UJZ*Rmsj9rUI6#l|; zTeD*4+Vz)OlL&Zx&d=Uh{G+Z-Jv8&m>*NZlqy%lRz61OuMwk9NEx#6B07>Tq@F#T^ z%y)`n_PFaU)^#uT>ri?n4j`1Ch-zM^RS-V$I5P+Hz5I$B@2%9#nqkY+r|VCXCvoSVW0BPZnnWr{6>hKkaC;OP8>PHN{>OJ z--p3jCLNha>R4@$*aogG7m-zZWH*At488T*j0u8u`t0R>*F zArP@9~fT&_-nWjK&o!lMjjLw8|`;MI}>ju)aYW z2j&Gj%49v1B;Ss_K#d7+AqeI|Z1;_h_r}Cs>jIPLHS@;dKkdY1dO5D_dTob%1-ZG` z6QuxrgY1|#gPcRBlbf&UIayv;F(}ddFV5wk!~HgPe~8r8gill)G--M!{yyH-#SFM% z;$EAr5Rr&TUFZ>20TP&9JN$U=v_z<@gIoK;`-B2k0lV7h!twbb_xF^->w2e4wg*7y zE$3ZO7W1#mM3?|g=yEb&-J0(S%1Lcr1Ieeax#`Y(eL4cag^3r1UL12LfngXTD3rVY zg2S@?2*eE8v^^BCLc>g@Z9bVeFCQuw8b4eaUk%GJv|dFKE1Z4@rY+H-wLt!|T4g|T z)&*S}`$zx`s?kl6VudrgT)J7$ptIWn5tUM2Rlz&xXb7A=qe%ClyQ#ac6nOd`Iv?CM ztBk!)A*`W^ygN#To$wJB;TUvXeIl{=wQcG?U2tsPhtBTY}l97+kh#H|FSb3%q}vi4u@H=WmZVfUR6Wr%@XQ0+B3C0&^~U zpx}%)zWXwNp6Iks7$&b{xGL@OcN^qbADlej+Ef2ABX|OQs5Z*MAqGgk=}58p8UK0uPh5wL#^y)e9r|`<{Frcj4hUOrzo89VMh4 zW$yU^ChS5Yv^sYxZaq!aYtD8auqYSGm<}YHB21M8(<<}j%hAGe)nEQ{j-;gs zCVXQvKK(Y){6VQ?ooddcJ6c;Q+XqGpHN9#CP$&=$iU$siGRhV^+~(^BICe)}*&)2* z=t*L@&JlC;bG0w>`J8FDshUnl)0sO3tuP^w#ij3A5D*RvYy9f?s6hsqn1IRl=(RnhSm+^6^lZ``|*;pm0ukz4nH722}FWuUSWtoNL4euy~ zA4umn62h(_8y#S@P1BJAwBv6BYbzHRn7o3Z!}&LS-w?C@v#|rm4>Dw|culcIM~)rH z+TC(WrzIbT;MWX>(*0kbEajy?ATwV&U$GT0bCK3$W~&Fw zVWS4mgArp^Q|Chg#I)@($_4A)r)?95;|w?tz?}at!KyCIiJq-&qzx}gJ~vvtr<1+( z=Yl2ymnp?5d;4RqIFUPdVGNH`!H+KY)GI_!BiSOsp5LGhbcOvg70{c}uj-N5^Jz))%#GU>Lk$4lvh6Z5G~?!{ zh{_Wy2YFtUzrW4V7ja2O+o0Fsg3VS^nQHi0_TV55xT~ZP<)odHOgQ_)6=S9U&&MSB z?yb*jQyhNW=fH{JfD9hmumavKhlc>zwZRUGSkYpkwINUPJ>E)Dac#gA415@zR$^)2W%TK< z56MCB*0nDaQ58w}X-bk12C~KFnB1HdvX(*LH|{eZ64AenSiZ}Vf|t@r79ksOv1|%% z4=$^mL&|j>c_Z-(&Q{5km=h;188#gssL3yx0TppJoau4njQ5U}t(Oq)VKh;jTr=Qjm?L}uIBCzhf((PKqv00=i*1X6p z<}H~GA17+OSC=?Vr-05eAcL3v6G=l7{JNpq6yflhxg7Fyv>bVC*}ply8x5pYo{Kfh zS8c9J|1%$pR)QR!_g0}#U!>?hbdX*%AhM@=3a8(XuEVzfru%zews!ZJpG=I#Q7PLg zVTbaw>hLTMZCK%5?2JTX^0WCnKQc}c#M<;m4UuL%H=;;N+<5jhw909@D-0V-@1tg1 zY&$jBL@Sckd4*`YFaef1)2vSZ;4OmQiV&maNAo^~;6?RQ0J7;GkX}xTrl;ER8eBVA}o<0c-Jbe5g>deF* z0AbV~D7bmoi&@C3|3A=+|CERezH`Cy?Nj!U*=${sZeEHSdAiKVvwdi2Sz8m^yvh%& zIg47@-H2>9(drGRkjcJ6Y7$*k4(5P<`5MvsYNX5e%;VshR+a&d4GL%@PDtw@cT<5Z zpgjJ8_P0Ma592L#8Gv($xQqVs{I!+TmIvi~^p|#Vxox6WQ&0tG;obRo24D{~2JDQ; zF5PV0++To_od{i}2>}i+?)iw$gM>~Hppr3qUPc&=H~f2B`Cl(K8px3CF7wqK7E!zTV!cm8FXYwCl3y4hCItp65>$Kx#9qpIz+1h9~I{6T9#m?|K4 z@+~c9u}t{`!2_m5tT&fLKSG+SLE&$`y>YsdsfM!v2Uwi2WJ4KaEr3=FX9OgLO3omw?F^U>5 z8!cgKW=(N-hSk5168}pb+Vx3_P^N-8w$zqRlLaKkg~mO>SajRP;X(?R$@(8}tSdu= z@OyUHd3x9w3)#Pyfd72qJ4rR;OUxdvhwqpJu|80*x0xV7{->yn5 z+9d&qbg059b=QAU{B*S#N-l9)KQM zdQ9r7!7{KIaD4xsMc%^Z(gu+6VjhX)j8|I_IQ|{8U|Wk)q*Pu|rqjL^@HqL3tg4Qz@5&XsPKjA-O+nu!>U)B2+4Kn^{bDUq;`paqy{I?-_LYeup z>6S4sr6x(mp?IdalND_0QuXrq+v9n153RCj0F- z(4t~uMITNQj?Y+*nqvHDmqgb8@jFGQLjH*q*dBz6H;7hgQ2U$^6g^li}*sjg8rqnKxHRbY8i)2Oe-5)MD-2TK!=j&Pg z375U(^LvDRAQ~W+&jWEL;*}5FcCywEd`ew1Ad?{a531s{<<-I29n7-O}L>{y3#VeRyAPiPYguOeZ;^h&<}GN>n8*+iWKwIgMpv|ySRHvo*v48xpXL*GSvOqSI^7%b{JkSFg9Je220VKB`=%yn$j3bHkKh&eg5_lRNPws#2FlY#FxViwmgNMU`;)>|O zqP%bQNAH9PjOpi)GoF~rfPu#D)SpCz`^s6wjs3yKTNVpusMHW;GV242xr$t_#vG%*D`UGmvVH01E0+{oK0x`9SQUn8Bbg?3 z*jbx}sm$g0S!o?E*;osZWG*(^D5MA10zl+pahO zKOT<;*cwY208d8JisgCO!RkAq5qSIHVmIJ=ho`OBf; z^J54dM7NtCg*!m4k2;d4d5uASE(h?eu&1oyT6p2$oz9Xt^BrSd-ow?8Qr= z?*6XM<=06JPhmdf+wfOvbCp8PJOo0VY80Ax0*NWqe@8ej?) zjUROrJ4!wH!fu-Q1dP8dHpbnSE*iSB(2aU~NsJ=ArB=e#0RLgJT74=cRAB;vPx>BC zQ5!bcodQ%00P^>4DCBoWfATzdbpcg=-bcZ4L}-P#kM5;F0EX3ZB3-PSG87t}?#d3E z??Iqu8tXdD%J4bV`UG=<5z*}|ulGr^CY44}RX}iH>zPAI@doyEQT1pVI1L3MhN95h zADIitQ!CSI6|XTKu{JsVbIulre-(N+w_Jbg1(IpR=i3dN;E!a%p3v&VcW+7)ml-k? z=KI9wE(*9x3s^$ZEFzmmDn7{B4A}GhNB!{67;nYwovU+yEe)?45&<__p_?exNGw?? zKc;|z{a{eg8RHT(`3oZ6O)_9lQ1Djs>Ru(B1=g~{im{?X?T0J!$}%q#y|x3J?ku)& z5E{L<#@*?v1^ecr`^Lt=AHuu+)4iP#T2W{M^$2Jkp*r{iD3E~V1~OTryBMqc{%u5D zCW(YRx{*&pARNXok5G9b42b?-Z;h%y-*MQM^G)zcHT~mcJ!#b)=fM5X*OLm+VlRo+5+k4L_FS3r-ePC zo!KZd=8#(D-P!EWio2P{GD}I?N2)wZ6v?b007oqN`uRqSHwK_?S-$V5ADp z0k-yxBZR3oSmy9y3y;XGQm=Eoe%0%(zH_Ph8LH3i@6{T&TuaBD_^2r5l$zbVvX^d; zD?L5|jZ_t##RWNUp%bKi-`R;Xiei)2jB)jq-XXfN&Ex$3#~O8?%BL*4rrJg;sr8h)D=n?e-W zpJ8qP{z*(+H&zap184I$ewONkA;Fo#rDmYImC??e2W%UMbON;%zgDRlePeKny0$?2 z%$?P1Qv=7hm04|zQEunPttn-2zTAr!@keUr+=^rdSfhUBDwxOFE1W|6|8NLmVnn*kX}NEeInn)Kgoy8@g%Q0h+CYs zghoAw?dh_LbE1+H9;ICRh{f{d9h6b_zD?Qix?K1#lS_x59i@4~F2G28*BklUx^)k=sEILs&X^FwWt!EaBu;N^w{VCG)z za_Z+ARnG&5PHTq21P56wzOPhnJ_~e<;HFM7!0A$G0Q$(T1?gyzD6W(sw>(MuRK_w zsn$K80~=RYyy1|c;bG%bL9?+k)K`#sFpSx%Q>S03`@NqwJ;V=wc?ZN*=aeD*Xf+-o zkF%&TJ?{XxR7O1=iB!sJRX!`fr>>$xrRDvj{V7oc9UJn|jnW#M7NAWAH?e_AiCU$| z?AH(z^>??CWAozx=rj(!@FJ*6aan46j*#*8#~YS+L`Nbou_e^0TP`;P=E|~{d#RnI zqD4df%HHjJIx&kIq8ibs{xJ z5GPI_q!WL0I4uJZMrD8J0D{)E#WL6XVvXh+lu|oBLfVDW^{#+V!mFGgLZ$@ZpXcXP z5~$}`1-^Y*;2sAr+jPW|1S8?1R04ccoFAlNi&5uU7Z*)sxNO$Me_{j-=++v|Af6we z;-XYJ`HxF5;apaAgi4P2vCeW+2ViS72CgRszv8jq@GRz|!legY{Li4YpsRmW$WwUH1S_X5GevOWj_+lYHg?Cucu)6@np> ztF_JzNZ2bK)Exo9$&+y0oB0ovQ~2B7X1(&!APddp%bD_W7Ruh?O}Fpyfv^;j*Q%SkC!&dR_wv0) zS4IJ0!KkaPaCF3Hq$QhR&-_j*ioCeY*Hstwc=tzeXmFSbHQu%h0hipXF6TNBsX}yY zeV_SkKCH5>b1&G6s3gVr-46dk15!kfvw7jLi4mtUE5 zQ!WZlejf^vI0|dmy`RELw~f3glP_J^@poBg&zw-;2h6HX12*w&PX+oIw8BWfr~&tY zw0tA8I8mGI)l zzmZAQlF>m*Eh$!`)DhR3Vhq%4_a?}E#e zf#wikFi86CZ$8)m^qYKDNWM~Zn2x2&PonYE`?4o zVnmrKF^WzdEtXcM?6mhWAqFrJ@zBo#MnUu0ykc6t1{Dfan>eOiamia8HYY7q^ZbdQ zlpNkGSe1rXm$!jn;B4#(K)ukQJ$XnUq|s-doRSzMh6Ij$H&{br{byyeV-RV3;2L3rqno8ggyOjT~m)(60p za}*^2ur*Y5oX#eN&K8e=IMgE*E0;LhFKxe1dhf7VOox)~wny*kj~7O49DI}~NuO$+2> zLbPr}+r*&VVD!&60vc-QugFRbI^aldJDAOyKG%1tPz0fxrU107+1VuS@(zmmGo~(ZXLRE~` zwoh_m)vv@iEWX#lU18B}RR9|+4Vk;cKD2!JIIQtFKH1y7e8uX+udY6Kol8NeYy>1; z#+6=9s|@*-E=aPSXkVc>!Rk~d1H!h!UD!pL^Ya&zLBW&(kHC?r*~EeWna+Q4;Q?pq zv5o)NCvMltkRK+dCjuecX}2Iu{E2_1;;ewtwX|W;D9y-!X7jtI^&Er02dP{cU941S z6vxV@aWA&1e}4bGnw{kfAnv7Jef^Cu3>B~@l+#(xuD`mzcGcn_C1%3EI|=4aL40tU zi~`d44tBl|PFTiyCU((L-|(y2vhm^ZON|kgG66r28C;y>1-3Y)DHd-o$H9Ye zbYS;2rqBPiG5Bf)cXjf(q>f{RL~NORAX;sQDF`H@^!h{}9*u6YirNX^P=&*}GK<#w zdHe0#TOhmX-*I7>lW48Gbgo+If=(9c%;%)uOmwlw;^M)rc^xCL=;Lm`bG`cma>&E; zeItONhnFF}8CH9oG-8gxhgl9`B2S}L(T0unVl__dl(w$lgQm;rGu|}IGt$kH_igT5 ztXw-ydaZ1_v8QIkS|kw9%A^YmB*HO6#7Q{*wBGKQQ_}2(;lH~_^nxS5`2-- z9t}FnA7uHJM?-}0`G2#2YU8uN4*}d}!>ZJ2hDoK#A)c0lbnM1UQ6``NUt{MT&(_|@ z@hT-YRV}J&t5uYsh!MLrTBB%fMG=(LXlhi&sG3!yHnsPRDuUP)RU`JOEk;n(eopUw zp6B)%_r7la`n__JoO6<2&iH=cpU;Px%@eRrvL|kl({C!x3#?ZxMhi6@b}>`af(;=h zG*q(y71iI=TeO;7`2}>2<|+{A#UcF+f5rbTeyn!$^k_)hDg^L$O4X@#7d#jP5Mdiu zuud~^25>fbp$YMCetbMqwmq@a*PW)|A1e9sl%C&IBf%~nZOox^CntOzf|!DO$&Z_W zkzCs=2P=r%^^4O!N69OqsDL1|Tjy~*Lg-vmb2!&C+b4C7ySQ;xpJd3mr%baItcc38 z*pO-Nz127_*T0b=*rdiX3wEFCW8kt7MM|Spdl)^EJU{|(LqG2VX(XJI#^-x4j@o7d zVq|XQ%$iZfGkj$N_oEX2R9-+iFBOmY5kcg|_HzG4Tu^Pn6SvL@Psl`7tx!KxiPusV&=!Bja!ywf|Cspkqkc6;FLprmt?EW**j4F?uZ8LzO>irA5Tbx%&~`W~y) zWx@OdQ*c+uAa8W0_Vg+DL?uKv-9Y1k{3_Y;tipDB@nq=7H+l@gVwTDp&byK&kgoXG zA_zzP)GIa^DtYjw8>kj9Tb)`Vyj~5ij2S$7f`kX&9>-KQa*}?(Kt1yWYuD=|Sq=X; zCiU;q;LIZDQ~V6U4lF3w$hUx_AMgS*~wQ_gtA|qqpdr#t4q>a*`5+9pJZ*e+PYb9^ACMRDgcFr@?JLC6% z^vg^tPA=6rytND4+G<>6(E!2-8VSiv4*^_rRD0u*SQLfn$%z%Qu}DYaC4UJG6Z)Zt zRrYpNW?7adi2!KBTB}~4I99!Bj;^$KK#y+C@hq=J`)w~=Nv%x)AoO>Y-ZKO}Mjmc$ zWHKgEhDX-BECKgmNT3TI+I|lk^r-_V?1kl$M||dHx|{}JYd`fupH{t2YnH%k3s110 zOgz86ZXe>X&khN0wYDf+>L1XCa5WqsS9JQKp!IsR=Y^7~X6Wyg^ryPH_aqEC=;0Zi z@;!Hos>Qq%gg7dp@2ZG@^WJU~UCPTz9WF(l#XN8vW4P~*w-TvvRBDpdu&Y4v&ITTRn z*WGOY#@OL5)}(wd2_J?lr(AzK_t9FltIpYeRh9#zLSpoyFf3|tko?28^$o2 z4w@8M)$k-69V(~T9fx8)hVUjzccApu)3XnhOD;`>HbWJwyMry{;uk_!cN6#xoahp! zU}`hho$88$I5D-Ku8!RR^uVX|*e{<&8eS+{)w@u$j0i0WB}oKb8rr<85$G4GU#CP` zv7UyoW2fMUf}3$yDsECQivaoq3GZjl-Q$PKMI3BeQGCZuG$-c*(J%c=Vwq2#Ig_W9 z(FD@kGo%#7oA0Xi$!@e>tT(MR6yb2^0J3oCn_%Hgp0A*5{6!5BKO7a0K(>yQDeZW& z)&n2>)cB(81(w30{Gn21;}V*^9F3IBeOhm#3j0}$7t@4}VQR0}d9;jo?OPRX?$*a8 z9F3Q>6^!Y>zS-Daqfz5p4(q%aJ$>cq&T2imEcw=J42sIL31tsY)i_(=F$f`k)9g$k8?+?rwwSDri;lxc9^*p7U!6d`g|hMa?s z9-uQ=7eGYI49R5XyjXcJu-PEN#6*oH26MZ+$g~DSA-=yhi3R#M?KC(0Ct;GR9zy2< z196CBVO-zlj*kT42uRVEWQ6s`X;#MMo7MNE&5Z^g^sGfq9Hjn%4Cku$;ua0yWaaL) zJ5|suG8@)sWqa3w6eqKmRG;lKT5H;|J|-CfovX3+wGXE-wk@C zNtz3Zn+;EsXJlf0=JrO!s}AGR&k+=~XsrfZlIEPEWIbcpqZ%jm~;Did^x?K`e(w zX%ukkWRe|0KMYt5ubT`XD=UC2kp1Or(;e#{3-{ZX1i+*W}M(dI5_^ApI+8gNzd5 zOvzHw(K!Z4DMqtJ8Q3^yt3eh3f&TEf^sjhUt-V1?5=qoJ%MQI{o7YCSfG zmnl~r^Soc;i6b5%CyI=-@(;AC*@D^bVC!;XWir08K=GG&by}1J@q-f1Kn5_GW7B@4)Ze^KNO2VL_@TJc>rh zslXuK?Y@l>vR8L2tcLb+%Vly-k4B6S37+!nQ;Sw)>a8TQlnbf%YGp%a~d1m__RoG(W}TL{^Uizdq^BB-oO>wg^N33< zs`@wDPOfv;S`YNGD33bab0z%mD%`{%QDk!!GP_h^{)PtfY^B|f+d8IVAYOyg8Jm5W z#GFohn+FHay;kiJThZ;Q1sJXE_w2}qx57USq$#lG4{gGIMennxLs+lHfP+gv=#2zy z_~lxl?FIHce**cOVe;~ofkF@73)`uhE#2=>3?z_7ipb^>It)|cW(I)nYbFo_{l~?*xM+sHJmR?xnmfR1A{&&RJ*S`--teO3E7A+sXi*Bdp=i~ zgRBsCO}f__#iXqHE9o#*_q8@z)lB)e?;bTQ`TRN%s=e{t$oT=;hY4c z#6s!v2%5wC+?Z1FyH&X~&}HJL%ck`^Zs+M-^D#8Nmw(Gi zg9e1yNc$YkI4+BgbEAyhV;!JL_p~5|q5;+%e zEnLDqMVK2(ctBUu`7k+{Xwzt-xy5!bp*F5;T*A)Be*S$8t~ef7Z`pdQ$)AOSE!?Ir ziH%ZkIY?CiLk(mXK=Tbs?250kw6HQ%!-iCpdk{cH?g(TJ*(GNS-I@s|z3VyR&$I2^ z(5AsqaZ+%Re>G#Gc@i$FMd>A1J8Z{Tvv~N8vC>QF24TgX_nifaMo@TC%G4eJ0Fs!1-=MI^#;Z-iKC4lWeVy0@Yc%7Z>yRnufc3wN0 zixBa*yy35)Ki@0;bS6!Vf;4I~h%(wj>c<)dB-9mTW_%Z-Ymd#hCibH}^xU53y=7Jp z{^YS9!rnGRFXgaT!hPNG1?8hshdvg%(~?htC-8)vb%)_%u*l4tg1C3!7fv1ptVhGr z&UYVCnv{ASxYFCIsx70|zh)Z2dpZx30=1ZVh4Liuab~{OU6lj)?t(!M`oPj|2W*Li zMewG>z{6q35p&`f_j7dRmDMyU8m;7?f6G)a*Cp9Hdh+D4gP+~`&oisVleOPK?d}aZ zC^O$V%IN9KyNy;?_HqNYRZ>&E_l%m-ii8~5yj+It^|KUC4%-Tdc0KK>$E#NwA;@*I z1nI4HkEtk@2pP*UXtA*aUcfcgPR|fhyE;_Ff9?7jjOZb=G1BLpW3pHM4oIG2 z73*8-6KA3`3ya@ccGY1h#4yR+@MVx{sW}J~GRS+NJ6vq)qByP@ChojU%AGFawZwX> z8L$a3hU#19H)V1tX*N=*Ykzxaxw`!T2%=+ipY_IdvMy&_r$Im%_nOH^Ak{fJO+xhjchu$6^xcNxN%F^pJy*C z+Ci8(s@Z8AZx0GxJ(WVcv%a()K8n&kj9gv!M&4`0&xAYMlvRs2a(M?*n98Ys6lzf- zSQ4F=XpA6A&) zQg3I20i-4}hCjCZdPCo?)RZeOiR%TBb$sr8N*nq_myQxchV}GxeV+Ikw&b$%fjTM%NqJMm0lmQ!Q?sihl@`&AmsCx^ zCV(9hnuWjY4-TA(bYHa`->H%{>x#Lz$vL9b<1ekN+%?HWEX0}VClu7iYh@(QP&J%& z_sVEyIziB>um-%sQEVyJOpydraiI{8O|wvZt`#u-;t{Gm$Yj5u#4(S$%&s6_v2-tM z3m_5RTl$kw-!kPj^vl`m(&x7ZqOaNMPC zVM8J49=pi2a5=v!oZKuhTqu$wb%CB0t43-T1HDaZ?oPpu44*-qdSt8Y(``;K%j=)l zv=s>CvSU7;^&5CrB5-llaF^j%R*j8LdDo+$1ti!0v ze}t=lMgum4ch3|EHGKve^zkMo7>@1ti$gLlPr4buVdD@YrLwLqpp~K8>d-_)LC1a{`S5ISO zxIPHcIvfd?>M%2Ew#Ur$gp`t4sYHmgWb0;YMgsw@Oq<1g`UUX{OVn~d8sBM#`=U{R zsokBt;#s=cYqhQmd@G}K_CH#F9Ev=uk3FJX76L?|(H9VtXZ>E`9tOGQP!l23$_}Kg zk9>Vd6aA9MJxI3bV>M^!?TrT!=APSM)f%r7Adi^0cdtyjxAU7mhX4r7zbh^OGjLKr ze?`bNGFe*Dxf5M60Q?l{Jdyb+<;!~jq_3e>uJQhs`t&JbRsxwl$ZomwC**!YLM48% zN8{|h`Yv8_Eu{-F<_@5S+KF>8#qckH!&N7sZ{mal*eoDk>Wr31{aHQyTK~vn?zJmm zW)25nAs2X2TV6-mcETe2$!yT(Lg-?eAW&Gn#Aj^yzz$t&%5+mgjMS_yXVSG!D&f|f zp8-`Xa@!bjyRR)sF5pVJeAM=6!-rzH8Ph!Xxy1+ttC11+EQO7IQ~(^oIEKV3w{Q2H z>=y?fUX$Qf(eMG>f`*QqKPC;~v3TM@^BMyOt7(~jw^-z`3M=uMX38w zCYvbMr??0jJW(TMR{e8w`d7@_nMenmQ&^!JGe}tBctiyd519vdwYwke>dCkq$G7P; zJcc$yLHyZMSs4m%Bns3d9ak^W({Lo|a~`<@0T=Qkbx&vO0>kd6pl;drvPZ>nIIErZ zQ!wdB8p2lDSl%I_6b=nE|^KWnKU4lYcc%BRW25iD3PY`Sw4@)nAwD1i$nZ zgLh@qJbZBX7p2;tZ2#}8#=qPBkRvb+`l}83^#cHP)bWQ8y7~6Qe|r_2_%jgbIXePB REqe}ls4HtJ6+_Km{R1$5Z)gAj literal 0 HcmV?d00001 diff --git a/docs/images/github_actions_manual_ops.png b/docs/images/github_actions_manual_ops.png new file mode 100644 index 0000000000000000000000000000000000000000..23ceaeb6334015112c7b1baed85caa4b861dc08c GIT binary patch literal 163639 zcmeEthd{RiHBKHuczoa;K{I_Emq{C;|^p+t9;?J5}=8J&vqb1gD5 zY6CJd3brd$q?%7}HGh+lU9GiKRD7+XsL1`=4Qy@aXhlY*{3$V+`mJ^sTgM7E&BT`G zyD|-uW|)SX?||$TO#B%mcf##U3T@FsPI+DW#{}~W$_?78!Us5W zg|~09l=SbtXMMLbjxbMBW{F!87bn*Jy-!Wave(_)=HKd(2Z_E3zc-2wW#zcp^BYBR zh5M3KHibuhlgDFeNy+Qk;+PAJtk)&mA1DXe@A&Q6ixPo7$~76XY_o)gleH$%1kLPC zX-%OnGBO3$RlvY?&7FXRHAYc|goyi+u5piVN*x>vFIkKCicEit z?hk`33Z8<*zC7vkFV_uHJln~Qf_OenDWpimc8KK!+%RbE7daCtwHq>vApbQ zUvF*kPg8HHom1TKd-()pki>2}w*WU8Su@FTmwwKICd7Yf~Tes=BG7cdACn9h~0k;ZCTAxs8eB6}2P;~#$4R*I4= zU3gK2FGah#3lUCvkDFmtp3asWWOl80=xihSiHlP8A+-Yco!>!iLDX^bY_UO0W?~a$ zZVIv!SG_{CUXve&hR$7)q)KgJb-7_gF45vNNXZ#&@`%hN^!?6_FACQ`L=;}9(+aJ* zd#UqURk&WP;36I6v+u93-J<4u#-n_-EL{BA$?F?$ufBT*9|R5xtnzr!t$*N@4;bV= zpg*PHeMFhxnp$yJhT8h4qa+!91k2A)J0g;_{lRrDd@fA>x1B!#e@V;<*RurD#c-3| z<-PWt`mvJUM}Ec+zjRfUN_x$BnF*Naf!_85+_O@XZ=o9kG<}Z3P zxp@~!s{Si0LHn(3b8)UEE|m44da4;pBmQzOiI9$ku^nq47XRy+kpnF&^WF;#3j+(= zbJROoS1d!sf2PhUe&qXjW%7ghue-mV{^IyW`|I|bU|V?)9;zEBzY~8yncbjM%MVsPh^exke ze-f`HHYFavdisixC@g>cJ}&k*PLN!1djGFd{KA!6}h9 zQTIWzK-Rl0EADHGR1sghA6VY8@OaW(Xj@$I?()O5ckA!A3cnQhYkBH26)qQv7kU*1 zzOg9wEy*i%(st1D`w{&{;vK^q)AD9rV%6!O(5cXhev`g$b#x!3klf*${RjKf;R%?l zw#9R8)e&9o(gwr*xaC-8#U5ipeTRtgr)3IGskJ4wul*tpeK&R0tnR0!bPK(&eH`H_ z>T%|gE0rk4A!X6{vhhaaWFuXp=7BOq2zeRF0V#vDo=%Kpr@q6{xKHYS0 zHk{JWH{h)Bx6HF#0w+3+ndAGXMpJE!tpf(a?H4Sn`|~H4%gR#9TD)MJ0n(`$8HBo5 znb+(F#|Gaa{xFpOl-`woi5?^*CHU=KOXK=S&jS~u6`%Iq>UgAf_{ie|xs1LH?R18x zsB{NW-A6|)Gl49|Eaj?ssxZM3v3}1i2UuD(JG!iUGX;?;J&T+oQci!!=#}jaTzJ2B zcUN-l@%q|gL;HRR%lr~9ab@gJ*&@du<8|Vw5}JRgpxm5Jduwx;#og3cwj4oBj3PSlaNBC9^1)(uQ!>q8rO!5tA9s$M37wSe-87gKzg zF+)bZ;U+`q(KyCbHU1T%Tc(?>TdZ3mIcDq6c0)Bf02~lz{UWd}Ip9~okzjxzd&#wu z&qoV~He1j@?mcM~4_uRFb}7Y6;(UlSp*NTK?fCcEzPBevwW_PABl{lrWfYug z!fPe#(q)`n8<)TIr&LvU+t3bt?O#e~m&@`DTnst>HQ4q$l31o{z-9co*#id1En9GF zSt`->FE_HcsmnsGyWxAq3LFZ`tIH)Y6{sPfk*(z})6GE8JSa`x!kUf+mbZJw>JC^(Y6IPak@V!+Dw`b!?#5-m0sn)t73e$KL& zDLd_3tP3|GV5hA@1(l%kOJa~j6n#O4DC z1c@gQBIdc4z+Yz5k4K0DX{|%8m%x1Bj#;KAT|d+PpNEP#<(j_WT~FnF?NZ$ErModcNRXb~5$5;tbh9N)T` z?{Yh+pE7Bj^XouW+D|#B;_?es?8Qc~8XinUk)__ess+B1?MPB&b*%JMtku=Y9+Jve z$jBq?$S#vgARM1vbQ6T|oTew+S zIlJ3}J;Xp2yQHqrc5n4O^wia)EWl2}?=8XRR>D3`E+j}YG8rE!QqjrE<2|>JlcTe{ zln;pK9}rTc@?X_J9`1jDcsPJ~^weK-D}vpuxW$DZ2|wbIy~@qaE#qcsEv5DR<-eno z{(*RGJv>~bfIx3=Z(;8z!eBQW;Nz!Hp8_9=07XOqBnW`Jud~N{AAqwv@4t2OAN@SH za<_1^bMdePJ9Gcl?|XBwrw53K=dXeO^Yd@>wDPh0uaTVH|9x4c1p@zS0X`Of1pLpw zNvJY^)k?j#^RaT&e{SbQA`fW{S+OUQGXH@8mzMt;@t-jD{tNT5q@>6{qyAIV-%;PW zTe&HMok(MP$o|*X{5$eLH~u@K4Dhd|{}UC$Rn)Zjki)153ic*enx_De$6Y@$w#0pq&GQY;&pD3 zDES%*MEb+M4`j1Xy`S{l&voRE{cr}e_V!xt@6DJMO4~?pSXmZ$*E~e?ojZt(WaRv> zUzY*b4VrbbvIVtokYBzoPxill$=}ob&Xcz`)GbX;g6j;UP*1Ci^L4jg{>8fzd*gpZ zmUIt}eKLF5@P7pO&jz<-vf%L<&*rBF|F5}pUM8m~O9|?{|NojZw>Qmo+dku!w44|J z`{Kxg)vj|7rqX%Nga?y}H=LBHX5$ zkkDE9;M12caf7dg5i8vi6x2~<6s(M-n;`bvw^l~?SYnHn9T!^EMBG?27->0q+D*w0%yFW#m)s!h#T1BkdWC(0eA) z9MVaK^jQnfNoX3H+%X@|x1BWvURT7vE!R>%+?ZUFRejQ^fEdbCo7`h$VJVQSWaQug zbi{BCtXhY_U~~*Z8SAhKqdA6nI!%cUaly!@6W2TesWl+|TUcD~7Sv9w}~a zb92G&ESBnC&v)5e_&i-iZkh1JA}(umero9~mcz11KJor!8Id#Q#}!Z6q`8_QGcH0= zKKbWtkm_HllKnPCqzXLi{3#MtdfTY_4@WSG3h71iMvh-LX6uwT_C5F8>DHXfYYr{p z9zU5kdb^)xiwWWdu*^8WeP4YfT@Xs7swq9am6k67aPpYJhs@iR>&Cv^k5d-iB>mbkY)>R^iiy%>x0j{`polJj~0 zE|=u#S+0zX{;ZTL=cfE?=eYMTZ@7=inuZFzKiQ*9G?)D5l%c{wQD*a_qw&h3Jh>_p z$@P~M8=gFtfQj%{eWvz|UM6lI(bb`O$NMLkHYj45&U2+3QsbP_Xvi=VQnqrm>+bQd z;!xg;xkB{`|BRxSGoRC6Eadi0{v%x}ixEw&iHo5$(csHqz^Pa1Cwcl?J5fl3>{q#? z4fUxTPn(n&qi?mwQ;6o2P7N!2k7m75;cm6k+n<3~u60*Y_@7u? z{;!=Ri7n5=4c1_Hp}ELj{n+xi@Oj3Y(BnJXS(uEXpo}Nd-d^+pZGN&NfR!(JMMXtE z9-e0#Po)z{9N6d;78Z7rmS{Y^4mP{5p6ju}it!lw@gnc}C&pBIX~aE3=jx60K%&1? z^yPo-%D+y;tz7=F(IDefv?p#nu>^*ESqq*PHuc{PyAvJV|GTVO;Idm`Q2UaQsBVqc zjmajcHa+O$%(NqJ%%D+=)tlbEIE3<5#Kl?lD0r}i<5yf;Br(EmW8$%XwRMz`QT^+e z=cgr()3tr5-uto~B6?C@8~5Cod%p?_qhz|OO8s{?+y}b)h=iVUW9dBo`22E#NqAYx zX2Nh~K^+6Fu!-wZqFZZ}#Ajl8f0i7|kWW_DWW3y1a5iv1%0EYLD1tt(uILW(EJ|WF zK{kNUy^SK?52d2-9qM?t@HdSngr(51F7s`X!MpAx!ENXJv&{i%rKWWn%mAb7F75$4 z)6$sKC65a)z{2WKj=6-E(hH{8)`*<8@_}^CHiVs=RK~Hqvhv4UK$B?-$T#S zh$DvE{#EmO*X8F9F83Q`!@bH3_Sy}>>um?&AokkJp-r)G9GfSFfapD4CwPBijq>z8XZf|xD$ zLrRyqB%NUFV$MRkhikmvv+i}*R^{ZGh4sv;jVtB8ls*3tfmqqtyPi3bx#MC=Fk-K^ zGkh{FlxLyoz?G+(oTN$3;I;D97vu*XEz(xXgq+&3dh~FwLEWMHa5t+x`={%kUwK|E z21jrv$ehl4w}yAk|7NExJ=#wUAkLlbcs2U#GDC+PH4?mKfn>ZJT?>c@vamIr|N z(HNJUMcN*I)g+-fm}u?wUdU7CuyEcW`TVQtaCwKUlJY%j{jxUoG_l0~3`A$)n;elP zvd>I{_ci4RU*yK-9AM4&9pL;4i4>Gqm5YY0&Imv5&8N?a54!+$ zGwZ2NNKd4E2?iizaKX7g_&uk0jC1O;zWY>49`e6YT)zGCRTg2Mqw`JjF0K^Q^K{WS z`5GtMO_^~wQrC(+apJ>yhTaWJwbF|iZ)^ex;ceqcO%8Xm<)pa8Glg8 z5syP1XDYDo7_5;8wLNYmGlGM{hHucGYgyOcpk=X5i_%&r8}5-J(iju(y?k~y;sVVc z+oC$%LTnqs3XgeR_r{VFh-dD}TD8wV#c81e z1E4MsD>z4~*YZoh~)gH|$5Py-LuxPemZecb2o5pQtPGQY`Y|M>F zC(%XNZVqUlWl0t`7Mk@>JoVi5#zJ^iq$x~4*gpJocH@Lk=COtDT-Cm7pj1gIe^NB}qbIyv)!p`oyh36zQHUtX25>Ju%O9F2O1VwD5G#zK;Zt$Kr$*{BXO)mx1cd~topRi zur@Z7n!eiu7UtQ9E7^6;&)aPzTwgS?*!r>bOrk!4b6jNDo5`XQ3?&6_vF zB$Z3Ob)=n=!Db*6pnYF+Tv|z6qwVHK<=bK-{f^SjLhr)+tM&P_nR}F_Ry|2tnwQ29 z-rK{E!AgzG9yqMA&^M&p(pCLR|1jxuW`lut6){1aRfF9~(Sk(QRwXr?5ww*KtLnR9 z8nedIldGU(Snq%0)`07mUWx>wVq;^QhVvYB>H2k&=-9RHj&>uX z`5ePJ;JRgb%7F)57dvRD?Cl=wzEl+q1V7VAx^tM>d46JVnyi(ifKo;6=8*{+8PW(l z>7-9L?{|i=7~dN!)}NN>K6YIo;vIP=j^xe!`f|NCr-q9?9g4K;qBmwLwV8#!!B#vD z1lH!AK2lCYb6(P6>g5l&op*n{fav18q>JN4KeGHc#wVjF0GJ^a0ih$ktRtEXcP#$afd)A_Zz0vhCL8~cKZ6ea$u*Pv|JVWF}6UjWR@ygDo=x$cv24oN- zE%2_m#t7mIP7!ktXHOnqHaslppDOVf?_HAue=jj;_}s4@DHq69f>e`G93<+84o9;BD-^edlps zoM@r6-Lqi_@>(ra32bclJwsRUB?4YAO{EE2C~G~cyoSvwplyfgBfA}A*M}c4(O{EOQT!Zib$zFt10F^7S{(?QfN|P_Nx#VV|wZ>W;F##Su-F&{Mj&(({&3hAt~45FMF(6CQaHv-gck zUo}}^bN$-IE`Lfkix`rzhy@9B+} zu84^BBN(q0z^35{dAU)+p8Tk^nYNRoS-+!%T^j&$H%bCi>NIAW57~Wk_fMgaapPO4 zzEB(x-l0=UUrGviAZY#F2}g{a%)$(T`w}V0_erP*bWOd6v;DMbCIN59im?0w4b(`p zHEC!#u=gn{ord3UlXvI}$y-begsGa)o!ctf!AGq^26o|@&#@;8wPwEI4_or)}X-iWr8|8me?1i3dT)h){ z*ocFnvu&GZ3ZX%UE)o@%i+WOaWIGKjS>7d@sgi36WNR%7p^H^Lz+?_-uj5N)7lCK4 zEHj2VMTdYslF{U}`dx`L35D^?IurLQMd=s#ZJg7sKDVJ0fmm!r-+8Lltg^ICX4nzP z06qR0VZPG(3Z@Dit5MljW~bAUyZA-xY(h&{Y+8=mzckPh$^gnGpTxU`1?o?8#F}@7 zeCD#>wqvIitI#7NPpt}I*3&x_d%=WNxop&E@w;hMH>yUd+zDqI1G--~>ly(Kocmn@ zYvO?+Pm9y=am}W`4kA-^H~c4KD7^uL_S+far%R*f{WRBVtQSGoC$J{ThjFyRwkwVR?1w(KHUq?(-+F891$zAbJSBzzzJQK2O z{BsmB#iWwm7f^3It2AJpEv5z=(S?~PQe5&jnU1y%@2vlg8}|Y&xp>r=9Ldf*KiiVq zVdkiU)zJDI%^6w#bLr;C&ZxX~iqGV!3*8v@8_yms58Jg#V;pQdJk6Be#J$B$(;Jy3z+c7R+f%paUg_(oh1p#lD)k&O)M0B~; z$V~adgbwVDBAb}=yt7Hx>FOCdUm+r+rriU97^x@Xx61`PAD<_O!*ME z>#MvUSVxm4J=dq@7Dvt_><32{*a!q0tFG_nb z4x4?=gNLMKa0vzwjCrHreazgmHLjtf!{6GpFkM!A{FYnjcY?!As$T|46SMh#!Eh2ln z{0^A6Hp{^S!K{XS1#B!gT0%(Y`c^YD-j;NR@&Be0I{F;N>m7XfaXsJr=%D#b1PV^p zDKqFoY@-TTDtmn1VXBEC6`RJM?@Sx;v$e zG$pe`Qt?_y>B#sw-^KCPdkJxS=B&7VucPtEfk36R&2s|gu|dqh30uOe620QdpNiqf zp{0irDEyp|X>*8S+1GO(BI!b1%x8B#nEi7+%VMg=XbG3MeET*RG1)=k4Mgr$Z4Aks zBIlCvL1)_+CI{4bN3KI9IHka5j5R@}Y=R?2Cz?wxANm}2Lp8#v#`X%z8ls)M#OL4J8(uY&-JfmL}l}^pkCnkprXCiMGWX<65HiPWx>+&^k_{C8rWzMD0(liOM z+se;oqe+(7?^)3M$)=E$3v1!Jy8$~PrC!M!8UZmAvn-dW=t=9s6iHa?gUz zdK=3@f8>bwp5zY}DuxslC#9i-7=#h?^hBY+p4(tgkY-o(rXiye^;P;Z&ctqn#ulzdq~*M z%H=R9A+U*SIvNEb#-a7u#)NzDjqrt~DcUDx=E&y^cO>VUEi|(ZlZC!*Bg99_2z(G? zcBzTq1r~o9?o@-?F<%?1POfnro5Bm@YaJ96O1yvli0S%lm1I!o6=hvmyl!g#Q>ny( z{2f988xqg_9Fu3!HHC+;BgV)5wlnIC1`G@?< zb52f)kTC0L`;CxJ2mEo9Mb$#3{MvAy>cKbv4#(NHk%!DOhf}&a)_pa__w|#M_BvUz z=sd|iXg|#Q?31zdJa}D^{oDR^L$jAj^#aFPSBEoF1Oi(65h?Z2Q!R(vrTMC!xEv1d zjAqz$x3OwLp;Aw`OLFt+>xR`}_zaHI>6o$AH$*g^oL{5 z9`421cg2WI5*t{Nbc8w6HSXD@xW{>nw=L<6oP(zwUoMsyA;n068~xDw3Yv>6cz2$_3e(~Hcv z57ub|Jz=x0$mY`BC1>BFXL%SLIm@+IRm6}Rl$f&uVZU~{3scbf=5iuX3){C}J68Yf z=I+$aAN8zGmbyUR7?ZtkZ-HyH5A>HhAhLhPk;EU;OVtXdjZ5cr{2F?i?;LO!<&YQU zw!=zW>n<^dT1ZPeU)-s8p5vd~EYsRYaH4e$@soO|m?rbtNx+Qc(S9=aq|ON1h5Uge z2M~UKSEM!`kOC4_?H|CJ4^#7Vk1#$@EO*T8^ia(;LvmY&b}=3AO8lWU24wcJhr`vw zFSI92{V<-+QxvAjw!jYNREpZ~=ig5jZ)(<`Fgpe)g=!r}R4_Tjqo3?9#K^@_u^m@? zHrfOGNTxPI>M$GSr!6!dy?m;KqJ&M^ZyN%w%B@^0M%zrfRx5pQ8C&}vVs#77MbPIS z+AKZwW^K(M;iG9`rRi&xh^SRXvw_K$gGTJ$;z01)57neSVr6_&Kgl7Z!b>!^Uuncp zvUD!@r5PpaK+eI9C)N^9c2IEB+IJpB^|O#%UB7au8Ec~=2dWM`CHn6D{-8eBLl zHYJMSCLvjnHm#$+Z;!QKt{t11R0`veu%=&rYne`Ws+m(IW(0fim&}4p?!hCW;wI_3 zLRY5p99Y(-iXvxxS2(baM`s7xnq6%qOLRa6?-6$r3@jhaEM{KCcYkK;!33V-H+d~y zW;y2Ip9RQw_^22CZg1~Iou2?3jxzl$=YM}vDXu|_w(4wXTnEM=k(|ZIvh`Ktr%~{Z z&TZ6%bG6aha9IiMIRxhWk{fYVukrJxNy6&Cy?exoYjiZ~ zo~SUMtCX1YdvskdfTh$~#ECvpW;1+uxiJE+^d7Kn^?6|20v345RNi*HH^m%9EwuTC ziQRoKDLB-~fZ5Lp^aN8)wbW#uwO}$h(0rgr6%Iz7v;%6n3pZ!Cj!Se}SxV~yWG*(` z&w11M%eb>Zqsdc~$UT(}>mW%P>)mJFWX3(QVW1Ychrm(}sB3a0$*$l483U zv5h(ccW-TVf3Y|cw_OPFvFckN!&(*(jE@XM=nVz5?yaqa^chz9RG#e*DG@DNCiDPx zvt9_*GK(H$!vkUU`gKp*)=)KA#JF|ea!|v%+@s5!BVAE@+P`sG$@>)R# zrUvB?a^FPmliYKk@y_sJ`Ae_@?fwJMqvMgE=O`;7Wk(B+X^u{vjmUH+g2XZ=&t4+m z*Ft-O1tk3&Jrwn{WQL7Fk{v_$ zMbnOBTozX|;jl)+Ay`w;dv;&qVqnu7ySdB+H2DScV>m>Lmd#`CfEBvf#2gTFOZSlD z&XaJV)&$RxD)zauZCY%G@=^^BuL!k&;x}G82tI}c$mO&-v}S_%!S!`c zK4`yEIuo)n$h?7+7Oidh=yB`S&8H3uy0o1-<2V4bj7CZB=y}aLwXk%q!c2>~Q&pUj zg@{fwaak}qugpEU+-;V~(4BJuFrWgHUaqjdc11|s zsHpGa6bG{`#&X9s>G``&RDdy_;@bvRds2r|qIoF=(gRv6p5yX`x{lda2p=2YkOD^Fi`LLreil%Qv|Kt?0}^D5cD5GgTD-7>r7(CS{lz2J?4j?GV9xv79Dl3V+5a# z(CZcDUa~e6C`Dbrr26&83nQ!#4ul8O4Qr&xOaf|6FMkBrt#Q8^WDT(SdqS#fO=95LR_VLHR3RA=)xo|AXqapjcuG&ZZMyR-PQr z)^Z2wlRzbsR*z>-06)0#{siMwAa1eTxTaF;0JJVmyUYB@Nw4|qhh@5bYAHh^tqn;`>P1pIZG`(}Og5qh<&xz1I$L$qkm*e4=$vxE2%(LDT^V5~R@6ENI z<@VTt&FWX5ik*8Wm7NAIq5>7#ZKccf>{+Cp{fOho5;ILL5s;RO%XH>);^iKU)o5{bxiaP%aF{5PKgcWeU%P88#a6L&IRpX6$0Pg-uDu65WheAde;6a` zwlO-6*V*bQ0CMF%bNsuv0y-crz1GcZRCpAvq8eXRgv$W5K+YE4? z)8^DJxTZ3SJd@jKvI7npXlgT!4@a(HB@5L>W7iW&fdN8jmN-y@p(=UV7pT{H6x`@w zGmLoIgb(p`o@z=#r5elQLrTR*C^Ave$75W!@Lina%*3Kq6KA}xV+Jb!oG(Ml)2(_h zj37IsQ)aR`Yyz>U#cu_K9c*|O2^mzpUhYp@XeXvgS$&r43#tQU-stS7h}Tt*yFnZ1 zsxZJ03@~7J)}I4AXNa73geKYZm2_R4HqYk+I_=w%0zmt!pEN&ulfR?=HdPN(trNaM zt0g`rUz&#lK{g6|F_P%Ao5yAf2DCK>8HGC(Q;3cF(uvAvsqdW22_?c|`z&9(O3rWL zqU^0U;vP>C#?g^D#M4%zYKHFR_PWVx@-tTeGw^<_`t3tr^pnk*V%I54K- zghB}&KP^1u8sQ9YDARkr0=)>>O=#T;Xk!w#Dx;j@B(CJ7{#u;YUZ1!|%j|0f58TRs zJ6@{4Nl_+FRh0K*cf4{}OZ#E)ewp*Pd;|QeIT3Is2sZv0sZCqsJoNZiJPWOtelZQZ z<|q!Z2JdkKc3P-3W4<(LtTB98{5dcMw?C2amFn0s)#u;n`KBur+id%0%JlZ74l4|6 zMR{G+yH5*+elVnsLjk3x!)W23kOTZW;XGh!kHF>AQsUKJ9UxGuS7{!1G9=*tr-}^c zCv^^4Xy?ChR;e0hZIT>0l7F-^ntD`Wy>a}?&v_aZK?)T%)J!EAOgFzJ9!`Vz_AX3@ z5e~W;KfhKy{AULocaVH`i@7=%;!lXzaE(5#`cR|6@_;n{GMNMuz=#~bx<@O8 zzSI)QSWpP}KXn~MuhiK>-UzCvilaTc*fBNu*G{FaM|!(cW&&S6Ah7$V-C-} z7ETP1;#LX^&dCQZ=wKaK|Ae!woL_9`Aj{B}!%Kr`98hVI1pt zIUW0Wk2oDCz@$e0{Cw4dlxv*TZP5FYEZFR_hKT}wzL%6|skf5Z$@7jL)v|+zV%XWy z#W}9AciM-f9zz$qdipb@#rS6X7ptEfOvxS(PY<;JW>A@~7=sxTED?^Gn3RRQKhM7efXfwXV~2Q1w3BFu+FcHeZXV(4^p^O3OXW##=-qUIm@>U7fh3noX?b{#_jEog5CqlV2Qjm{3GOk zBR9U^a85b8eiOPL*klDLsY#lreASt`I_JE;Q@gp@Q@fx(U1c`Cy_se6H7kN4nUwX= zn5I{noK0ERBximpfc|o>V&z+uKw`+JeZWUcat*@*pHGZ&5MsP3w-B=XE-`dMkn&Qq zkK~pd>oAZm>F>_-8O5M$*}lLXhPz;L)Q;=v>QkP#9n$a>aI^J|$!gIO z^ji*LSmlh2S!{2nSZkhy^Hgbr^@Eb^)*Ey^F4IB}CX3YqcWCWh%En6zT#0=Ci zvbJ63gQ=xHQh=;_j~hB8j8UyXx7npKiG2KL<44d;T>!?09W^%PpfIHhIfx_qn{yG- z?<%slA;ikeB5^EEhi+@?8(hqO)I-5_J6#{t(_*!m_2`_T&WV=UFal-(x9@q$vHe&F zrfHSCF4{^mtn@15z{bA*={Qgx?}01-X+j);z+U3u*QWEC+HL7x z#!6ku6`oV=&p6%7PEHtdRiC!6J2s2N>s6WFISl5I{ODQvqb(HkJbZmJkYc}{WrVyY zo<;TDZ9T7h3|s5sA%L8h(Q%oW#x5nUfYmKVmFCPP&x>dKvi!3)dyuA=+|o39+y^N) zG&6>C-%0B<`i`JA;+4Wd4;UEysG#0t)$aC?@RD zgS6Uu@sMHsaFX4+!EDPNY3gFpoUbL;|cGWR7dNhXXD9F8K2Fn#-E(3b6(m81#a^byuo-8k&Kj%bHrgnjqCd|qk;uk9WvXg zSiSOK=m_f#gPyDoS)7evpNEDw11Yc$ezlM1aC-Kf0PF-JNn_$ORsR0esHSu z1Ds!?(GOIKQ;LN1C&Rm85zGL?)6i0J6EH17YaEH7S9B?n$wfXN5PjrJ($#LIrmqW0 zj}L^?GfAIAPS271(bH}1YjAT39*?czr(>S_e@n`XbtT7vj@S6Px`T-XqnJJvXs1GE zceHx%IDVirl;HxC$0VD*W(VkVd8c0BhoO^b$joG&)ove`^xE+GEOgZC zwhdE*XDWWG8%`O+)KX+r0xz7tJh#=Ezt_s-iywh-o{umH>rIvu z!yt6|%_a661;Y=;Wd>FhBUU|syhvrPkG6(2_0my`IV@k}u-@^zDE5-U(k%$qc$e#z z7L=3H7yQw$k)+)+B#BsW+G24B?5_qc8J8BM?y%wPl*LlLtYO9B{`b(Ox!}-YV>*I~ zC!C$udxi`3iG!My7^h*%Jp!pY9Cy{-zx7=BvFwVb05lGXY3P!>Y|kZCS*{1E2r5zEk)t5NdQ8vG8$rxIWA%F_scq5 zPtRMZ$=pD0QW_UHxQw;Ggq!~y9{o(I1L&(@GDK6<)S|S)UiBmq4QFEVXlr-%oo3KS z@B&9Q|1YXQM*&}cp`$!56(@rDEF?2}sOD!Vwf|N~qqk?hE>`2c+W6wMUT#MwHZar< zy0^K!j81x3U<1pHHp_~3eeeB*q@Te|x7*t)ZWR)#50baT>Ec^5<1bOu4OdnRBHpd= zQ(0|JRskm_$~9$)31_$==&6LUUWY}%&Ub1eY{d=}aEfSgJ1~5eM1F~?vjW^aCVd-C zz{#91-V~s6Br=7hOJ-QmY%EPTxZALnEQI^DY3-pM<_HoCeLbtyQGS{FB!~M8C_5ny z3z$+wJqYh6aQQz-K3w;FrD;XL*iAla;_QeNYpY-pqI0~UlbCrh8z9}w^%`!K#5RGY z)nNwiQFgKj>189ufyten$_<1}zs1cutXt3KPv^ta*CVLb-Z(Tveo^e^dbanRq#Ah!>hT+y2E1eO9KM&qT`; zxP!GfwZ4a>a$ZO`NJH*TPdq*)UM%8iz=5v@l%nr^<>$IU3q;DE&LOpzC$Hhc?Bu?t zQb?Gf;d3@-Do(T8D1w)nSaS4nMjcjJWV@jtOKoq;~NyFlWA z9J^b$BaY5dZY@#Q6!N(3p#!>n=ue%=b=3=ppRNw7dvU{!%%$`)1GO1w&o7vrohvkS zw0)zG{p0H*&{r1k2dmN6m=uu|#yhfi0P1XF!_Xb2CjG6+b}RNLUZqfMVnF!;rNIht zhuWYFcOI_^0%*$ae(3ocSdYo z^EeKh>3!kuX^)pZo@i4b@N7lSS&Z<)9iFd}DH{;(UslA(a7Tul%m4T*H2yo=+kEa= z45fKo-T~2n>b0FVyi6{@<>0I0-k>)_rv->Jxt%H17V^iMk%I-Wt>HgOslRzVzGc9R z5aR&TsQ2LT%JA$pH~v5Cv-=!634XMBG!>hc32QiH)6e|I)_$%G=RAkw^HY0-5k}w-T`Ldr z)iTqUeOQyM>rqtlfJYJs`vV7CgPQpMZjiIkxb)Tm=9(EuK!A|V2%3Z8MK4+;+Z$#=_a}sXG$O&&w)wv(GeP)U` zRf{xO`ODfQ`-z@0x4_a2ILrz8mJYjs$rAgFRYwn0DMm09nxdLza$6~L-yY(kC`=mO&Z6V-L>bKs=1PRJ_CwYHhTNK{ znq{Y{`Yy^hihCbApA3L-#iYZfJ7UT*X!85$L^mUUVL)m}kg~#rEv*>Ry3ZLIZilU2M1bDLU;$T}mu)4lbw&R-7n6Ho<*UR*zf`l`q5Ja_fk3D+s>5i<^ zDdBU&ZcA846w%yirsAu#P8~Vtb;(GI!{%Bp+@DFpSbvq>c6)V|1UpPj=w5H$89e<$ z{|(QtJ%ngEvmPjU$!Md_yzAPl zAEHRS5D2$fhsh7F!IZC8Y@_09oq#S2b_U%#f`=!>-GZ#oERWou#DmU=UzOs%(AXnS zn~(Pdp^qf=Jz35+bF#+7xAK{AbSEPNas{cwXv5jz%5j(>8mU%PW&-ldEDfG{IHfqO zwN5`g_akxSX;R&+ZwJxDm0fx1XGkz0Rm@$L-!A(v6<)-7Mv~QKzfWbnVm9RvG13ja z*uGfIsGF57v(T&>vIGjb|L$NbtVMW@JWN_YYWCY6Lzrn|)2&c)n?56g1G4)y{(7W81cdgC$4^1Og;@AV3lZn<&(l9Bs=9iuRkP-rYs@*uqQIzVIl4Ke>oeU|i*T5g z(;8)UwZNlNtF=ts=!UWsPH*|G-(lrBnmgru&gc*W0JQsAqqMId6-%Xs(=GTG-7iu- zS-=73an+hinh{gDs-I`z2VNkKP{E;D5{GbYJyskoSgk16AGME|3S%jRCM%5ORW8OH zd^@Yr^LCa<=M?u0;J%-?wXtvYxFao`;&5Z{QK%*ba%?Z{rimPlwf6<_NUJSoJfSfC zotSqgWnrmTp@!JVG!u788{d*~*Q!Rf3#|-Rd(cnLm9+Y$*yfioD(2k4i=?+Vcba_D z7DZO2Ejd%}S2^+X%JG0D)kMjuxl6c(Ll~S!SugCu*1che@rNvrh@1#PSrcKa)6dE0 zN8k?~LZqrBwhv?)uc%%x8%NnoZ_X?{mUB)3Zg4hv)-G7hR&b6gtw|HQkAd%1Rn_7B z5wv!GP!F@5W|~U2+U$~h3WiaB=rbLp3L&9)oc9PoqXY9cpBhOUPO8bHsYOf$Ir0{T z8Li`P`7Hb#FSXLDP0bQny#<$B+->^d=}YR;t6CA%q%|)d*29ReBqk7urZtahWF$uQ zC@6az$@`WQq8(QZ&v=&hsdJ#$&}CRH)+KS-#Zd75ZRu{PnLRfK8avo|yV$c7Q=jD( z>hEB$2zz*_`?yO*%PnXZQKj;Lxytl7bS`+d(#j&8A3$+%z{H7e94^3aZEWLSw z_a@-}&hdfEKtMQua8`~sf&sbrLWHJNLyAC!Q`Dejlclzg-c9$DkZ~+GB-&Vi#%Y}7rgjEK0?TomXDtv8EGIlI2YI%9ta!3ko z4)Es}{yEXrUnbO8)C63*c?Tt8->DbVhlFH zJs+M}?Up9eB?#jJL)G4 zot942KUN2nBY0+5k;+vHeosrT7ic@LODat4sG!VHEBUZN`kbE>4|VOi$sA3cWXNoe zh*>V8DiiDr_*372LO~sboT~1ApWlfNz7)sDI#>*w-|dxM7NdBFmIAV86l!%Hz6tbePooM+h! zDH73mpbdC4Bc9nfVxw1$VCeR7!3ZHy=yFf;xV2UAd!6WTRrrmYq1R7qln1&dq}r1s zZxO+1Yv(k#KXR~vh*1Nv=}Y8n4o?-i6WoZ#k>cb7Kl2Z9!AM-&uS@bIhI}s}5fVev7H_xpFaQ;c8s4oW}X;#81L4;=K8s5ym0kV?4YkT+V}t$?ggdy8pW9 zkAM}&wzs$MOPh`Z_rPA;BQ%8{udKje4dQpe`Oa(C7usxQ5{V&_&e>w-V8OQkhmN!J zAw46Up_k<(MEe6}u4koea2lgFo218%}4wBexY#Z4J=U6Xi za%O8}oZf!s-~|R}DFyk(TjkHFICNytD}2e>a=l~%Ic6=~Cu#sQ)wbrRPumsQQt)Vh zO?TrPX4V+ZVvemQRV&4ZZl5vB{b6u_JFNKJCZ_<@Sxbn=zFU<;Hqw!wVF5f~X^ zpDMt=nr$?49Lx7w4JV8w0@sSaZeFI)YH?H1)&2-+T7Hg{HWJlbDGv;GFFaMJ?N`_E zzDVq2xoVwHffC=NSE<6%S8K`|Ly&zpYPlE7{-p(g9*ZSQp?^H1P~qC{fr8Rs*sN0R zS#fU81F&M%oo8Dt249(bEBt|#_F!%E)R+X=t0ki`)LI_}Iy=@bk5_G0x==1sTou>> zh7CU{GTiQq-051{Hq{~_v3DvJRgk6%Fp{c|GFYpdH$cYNEla3hE=s913v5(&v0554 zi#_Kcp<=#jC-Ui&n6aT%`u=M#ekjgS_xed4|H4K;SYx!WA+=zzybm#u3!my3^1zE!MBK2$RdmSx^Amr)V}igBjt!>=?7J8y*CEe?9j4U5WR% ziuL!R`q`Rx80!_TbRH7cTL3jUn_ocSTUQrh9KcI8SeTpoc%d)Vas?Dh^=J4zS=hAB ze$0C+A}p?KtbAgc2)#D$kS%{?HMDFzTctzm4U&vD5JX-BdJpH^fwUvQtX(UH;0T*0 zieL;C7t5dP&Jild!qOxq6Cv!sg7lI9`f6i+s54uq+i0#;C;!YMZ0b=xecuijlxcU^ zr3LoY?GKPKaM)IlRmR)_l#%l)HR|#GcD^66;>0#V%`7VQsV13q3)-b?^^W((uQrXd z4R)1kljfou`&5Vg=|retzYAPEXL~&F>u{(g&usLR++!p6Q)9T_&1}E3{(22BelttY zC)PLhpWEQ=aiz{fk4>D%Sj?PtBc|{ScwU+DaKxfzR4hffKmX!Ms4yCeq;UT0T%hLh z)wiNMe3da_hrr(_Uw?OdO8y_Q7jW?Pa&35Rr}kR*I^4k<^&c~BDMVO#jM2Wi`aLS7 zYG?ZE=FJKM&4aRIRKa`GU?D%PyLOQt4`2zF{#3EhfLX{lvXd^V7##oKgZS?zMJT`{ zs#c1p-I7HVBVr*qUki!StEDEKRxmu5rC6W&rObg(lDc#3w}u{lbkn^qI%LV=!Toy5 zC9%4#r# zZexofvlbN^i|ymf4Tp?or$!cB{a|;HLrf@Jiu{NID`mFHpLf_g3FxZ~cG%Q!{)UlG zo9BbiJLi)%`zh(ZdND&HtSIJo!8FXpJ0BA>MUWWepvYW8ai1$MrLgEkr}Z!H2}S(Y zxZ)0lj>i4BoA^VYy$Puzs?cP@%y`j-A7+@oKzLAPwZkq~j=;V|x67LY<%_(cG%g`s z3=4^KYjH($a-3a_*AxS_F*95H6=ti+Q+zE1rLm%%Nra*k?z*LvDeKs$P@^)=w`N z^=GxL1~PaGZxzPDTElU*CTes2T6_>PDrrL7U6sbU^V=`1v?Q;0aouPY2s8?xHS2F{ zS&4>jAmkWtKgPmqmgjjqxPg;(0~-)+yrs_hpaYFds;|nGpi^$jC7u?Tt=Vy$CN6au z)GV!M-GdaFq@BMcLyd`ANH!d3@Y5QESe!PS%9RK!S=`$3o5=;8Zu^Sr0xebGzn}%jzb5r=D4}2W}C?m3I4xid#r$ zKQ~Vs>G!_RdtuOEdvbcMZNxyVrW@^#Q~Cc+K1=Fon8rNQD|^40CVzq15BfLE>3a}v zwGNgUmBJ|^xdL(5#LFoKn?2*bcLEeF)^m3S88$aFva^*2aclI-iaT1D-(!Bxh~Hi7 zL=f_&kzSFZO29nQ>whfX?W0lf9(X-|VHF{cpOSj1pv6(;SPZtTw7icTKre|(@KIY^ zD#4M?#>wJ~?7UlffakbfuC*1m-c}Ne<>(auf__mTDAuZk*W&Dae2BRh$fU?yRqHc&L?_l? z35L)_MWi|iDLzdR^y7>dkCZ!qQz80^Z4|0dBFu(fQyUR^SYxxv(;w#aAiwbYaP)r; zQv?BxnN7@Ojo(6$OT-iZ_4xiyOKTo!i!h}7qWJvtDs`6KEcpag^^>T_Dys%Jo6Q;# zqwksbubT?B#C)=M@z5uTD;y;qoLE&CK6ztGSD-sLQ2I2;Z1WMckeoZ1-f3yqOM+Ov)%k0g}i3u`UJ$LbWrh-3{U+kl6mLID)D-ibQ*0MS8|LL8rj)M@y05_ zc7!}HOkBIy&>M6zXFClPbBrmTtVNMI)GXw9x(t|aRy<-YzHAXk7Tr|^d zPm}CjKf1nJB=wU30kqTRbEn^2%pXeo9u7yU+wzqJNA1yONFE*n5W~)tdj#?InLcT? z8!$_f>@4Gp%J4^zv+fu!p}IOR}-q zBKvGlg~IVfQ!QM(ROnDGeeKfXE~9z(4R=AdM6!AN&OSaSol<48y3;wH&6WFU&hYwS zLrf=x6+WGf=BgcOh<3)z#3wk`;ypn;`n3C{+4(erOyE2 zk>3R&|2pJXd=PGW?+gtFUe7gM@9*#iQH1W_q5ea8JW6`cEF>5gHD{Cy6i>{87Td7! zaVd1JP_N_Fcq9-~nr2*ju~yc;hhgI<*WIq2pWsQ(rLBQQx9vZ`PC;nHc}IVQ|( zRSvCy*m2uuaC&EX{IS*K67^rmVqo^=0~5UMPGZ)=gJD0zeXCHPx;wQ+B;eN&FCi+L zu(w#>mAvlB+vJ(`_#7%xkFUW}rrO5WDtAk*US_!n^|MUlQIqM9ik-XO6~ZZb3rxKc z2wd?EU+Q6wmo-}T9$KD61Zq{f3y{0%c4@@QR`NM&P*6PlOs<5Yxt`3c_lZ*n?qIz7 zTg8&;-d0bESL*p`s;0+rV7r!^?rh0wY1VD=cHOBeJX36rGPA@M-VD7esGS~2Rc0|% z!ZYgKBF5M`UR_!XE_FU{(n>3Z!Q|4)lKPLkBQt<>mT+?05lr`6^v9ICFh zaZv>g(nH?ENghz6+L0t@!JKc8k7(TYfmzy&b459SeCa)~HWE`BavGhQtu{$Qqf|7r z$x^15N7Gh)RBN0l{O*9QII(?ilt89RY%?#%seWTF_htUn3ABned8J~=^x|NcsoSG~ zrCCg%6K&_1K5ATn&Q7mruKvhn#3j_&etWmV(p%M(9`qi)G_EP*d4&x~#IhVIZ*Xd_ z#CsJ~;W{B1_+Cy0HNGHE?@)TWsux9-O}$}}@#8JI!5M5{-PD-CvwAAWs_sPxS`Xju zzW)Ol_1~*_;GGsh1#CPrFI4zplsMG1hv#3*0h4dO=kj8;?HbB#tzJ1z(&aZo-m-Vy z2x=U=f++pTGCuCN+3lb1BUVvF^he`37!NOc*ZY|A}Tw|MEV>T!RHP#pJq+t|sf+sc1PS z6Gp;C#s#{4XWPTO6Gy`5A-SUKAkm`dr@mvDTyKAFWtqrhF8(wEW|YnFRiJhq@Eg`? zwIP2smP_iWYwx~fp9R|13qt)Krt}CN#3WWLiqnlD;I#&p1U4`}mo@FNedKB4GLh9R zmNLBb9Zpscv$P0I4wtph`1WKP7*Yg{=aLdGu*x4+LSMv)s2sv;U|X;D>6rH>9g_9V zbJ_A5H6#`q9l>r&qu;WZBfG2f^68tuE)B%bvx&Xqb1&rHtYpQ&GsLF_Gu=G&Z&7>VLay(TSOThaPPh+s0F zWfzh){SE(e=YNQ?_!ZG2IN1wFAHhU`u2qPVa%Ddo$rLoI{fp~?ucwrISshg|L7o!) z>AUp1_sb@nzXrXE)p&-V4p5G{PuzkuH!@p6=I=QRDIY{!noH{h00wTdAvU0dLc`;7 z76FIwM0|nM{>{w!`21V6e_B0}sv+yE{HO-f(-kIzxEIk;T}$mg>%(k|Ho-J)*Fb7W z{N5WuuE0fla{*QhTLTCQk^Z4_Bxt2T#^Gf5XXMFpFUg?oC?7o$mt&kZh%4_&$HI*v)_X%)m z4r+~ETYF5!`ar!YpP83^*Jx`WK>1Bpe5X-RwHE$ev{2kXZaq9ChS6Y9JdN9#v5GkM z9|w}%n+Bz7?q!}%Mh2t9&`S=7y@ZEsJ0OpTs~#LZ74#iBo@E!*|Ls%on>SsK?6L2a z;_L}n`)>TuZku(Qok={-BEbTqX*>pNKYvv?ZDZ9Q_=-iZLAef&tQLBFt1WIASCkT2 zT;qmPnAFmo4^-}LtTK&%WilG>y;Qnr4zZw@O zTU(434khR>P@p!rYq|o2OB9?}`l;4)lVOb(%2uDj!V`v4IilsdbTbWx=W}m{-^*ox zcRSr@lLJWfiQLW=O&14TjN7CA75c}zO7xT)Wg)M4Q~?hYsn6qj3~;3Ti2y1(g?L;{ zB9l=cAl#Az=zcM-RgPx6gzhk^A>`ED*I0n->?LB}F3*{ra@y@JZKznO6Hr5qZ)7>F zm%QBW*6~Whh(_O{w-NJss2?<)($yba?`pUc|DAO{pckaJh$GIwX=IK6&>^2K@$Lr5 z2Lngx9yTK57w@%>&h4I=0l24SHPCh*dZt`=L)q338V{mOPjj(Y^iI}%=#Q@Ppf|5qXYt31aIju2i0L|X~ zHo~^xRw+ry2Ps~y2D{X_6CcJh%wr$sO@VlBd zESuLAiAbPSi7aMug`xZ>*U{pc(r$?*ZE=Tzq)6%j;!Xqy)owg@)g3%b$ zMs!q;CdCQ%t4&R8z-9#ygCs0=RysvayREf2mC-Ta;(-_YAHhFm$=MEpRF(ZG^k~0! zaR4BRX4`Eu>gwgX7;KX`&bR1)pF}wu6&+! zd3X>&JwQA1mFDr)7sG zGlMkq&T|C(f*2)w1<{8IcE+EojgD?@35q$?8l2)@G>A{Vzq`UMk}UMyM4K+xIn7pB zk1f43C6Yg^$BkfAW5zdj`BM0+D&Q}Tg+A2x9{|O z-o5);UT$;Pe9;%S51wb>yX(T{)ZDW=0h6>gLQ2FOy8a3r`nQ*0C-=6+H@5Ix_PgsD zN#NDM9no6yXi9wW)KZ39S2N{$y6ru>oN)!AuBHYzmtPq*<&RaZFG#|9cQ#a(P5{Zd zlDxe0n~?XP+lDWQ2bA6(QnD2-E)9#HIv+xs$Fohao$s#j#*5KGfS(&YSZLIEWaGBNp2s>Gg!HZ$&2d0r&A??}EcX zJoWBhFXR8!ckiL+>_*;-yF7EZQ4;Ef0T?7{+2>!sigfjuR@*47yetuWk9e#*-X(UY zid{|hGt?OTB9_x78XBl;^#0f5 z2qfH2{2RmRo2(`#VMe1#`?VX_W8Y_-+PzoTbRc3tu+O@(2n7i*rJJaCwMNj%>?v3okhnFOiT%@JpG z9Wj43)7n}DDmQCp{CXqA#^F4kZgaLJ%eGIHj%2<$lDfN*xUJ#1@D9l8#Kr-7S4jJF z+cUK~bU)0R)&59G|1WnG;SBGLiu2B$?36YBwC2kX{*Tkfy9`MR549$9ozS0MJze_Z z*g-Get+<>Kb32Xk7!3%|A_LK_BmDoWX{R~%cEkO()3c^S6d3K6t~lkbU~Jo|R}NYl zqJdq&TviP?SZ8tnVkPnK$s*+iyHUQ6%t6$NsRzVdU$p-9Q0pOt$z&Wagl*5 z;qCr5x%Aseai{@+)(Ed>74aXk5&v~q!4F)C`=e6gpW4|s`v9{*ud>en>skD}*Z+f3 zL?At6mmZ~Rkp1Dr9}oFQZ~;lx%2ATyhsDXi-rhg^%bVswGaPAa59`m){^$Q}Y5-~T z6!$x0o_~5o`rg2mH2g+?mni$K#SxWA$WoQ;1{OYpnyd8g3w z|6nmn=Ti;;!!!P`LlsiYBqW&r|F%-}%NMwJN*S3#LTm9&85vPeu>X48D$3hXEWqWy zh=IYuvBk-3DBd7*w+dr?U|;~1lP^VIKB2yN{|1m|1=Olt-%zqDu63c5YsvjVPv$=d zw<6hVmnMcPTxesIK2lazF5i>|zIb;3%`al06-#b-KfmM`2nh)f0P`*dCFO=2pL*C| zqyT}-xiPJY{Hi*~bec={J)V)^_89YENYey73^~B(>g$8YQuz4;kmU|0HIwErslxux zhWzJXF1>);6&3n%{sPzVH~UMW^$vrCg}aAdwK)$oFr_6oY;ufBW`b zJQ|XNlJ3Qv4=)Y`E|6@o0AJse1*U#A2exE=1n)Q2bgjcJj8=w_`)2pOkwjN|l!!-v z`4M^s|CET3qXfbABm5hF_)-iwDO_oCI4sh?`FQ`7_7X7r()w+W@8P~e4Dc~3Su;p_ zj$&SjqJRBS$NDk0gN4Qx_1CTWT|@bg5Z_ik9`$$qn|uE5R2u~xYB628HThrm_ILMx zgn}po^yA39F5vH){hvSa|3?>O;?>givhs|c20oY9N=sYGpjT$T75Se>Vx8W$N+q+_ zpCz(#F{X8Md$YFO8E`-{6a_rGzyHvu@YkUhYnJN;D-9`QEp)E>Ii{dL3`bj`B&iE? z>W|E51>IfhI9?@plFOjd@Xwisce|IoTpZg1=UUqROGM|GKzznMqVOL*k=1DpwoRCT?kgvZL% z|MX1x6Oes_$AVIdh@avSQXbJrKK!H(g;&|06J-29pW&bWO_s)giCoOUenfH{AH@S0 zzY`I1*AJ21UF$^Wu)iN!Sug&d9IDt9^wcJdwRolMChG_LJ|~Cy`8Kl6fwlG>!zG%hRuM*M#)$>|vJvdR58WETD(2DVO+^h?H6s<^WM|Mh1z zso-CzYULFU+fw|E6Zwx*$augPI+4h!U;oEH|Hc71r6M~CgQ6`!P4z+(lclhW{rG0r zih{Ln|I7vkB~q!fUY6MIJY`;)_jKG5Ph`wdZ*-6% z=5^bWJ{DD=bUE8PvAs{H&;SIB^jbYC07|y#6raQYrO!)K6i0G?AV4EeY?{9H12erk zJ3YW!h@%Q88LU6uG?)%cWpqB#PhPrMSJDza+ad-qwV8OzDv!%!ktniHsEJ%gCC>qk z#A5QP0;TwgJn2s;8B_K5?F%*Qi!KtTprY4)!7n1a0O@gk>gdKM`ItG9f`%DdmP!~Qw4@2&_1!M!=Ue(sbn zVAdfNXzn|aEoP=Bo&MSY1A#(^VibquHlQtzq+DDW9}O$oVZ-8QcrZkl@sME_s> zzZVQqvtZ10u~>%pTA7&pC>p4E7u{torug{H7bv|`@qXzF?8pGi{20e%IP@kk`c0hR z6N~{sq}*q(_wi&jtr;taD>OvC!LHvRQJFzcEG&g%&A-MGx~CFvu*YUNl)XyfS`+&Qs zFFb5I7YFk!y_?VxT3+53{E^E#?ju)isETLD-2HsL?O^!(OaXoOo3-+xOLzahnHniZ z!vPvvRaU&Sa$rqmbFk;UaKRV2kE6EI6HbLOxq1%W2S?F3+lVDohNiH8?I=>aErVp4 z6m8O|RQ3^kg+u^#wBK7>TdS!>HB994B450de;LQy!i!JInUpP_C_dhDm8;%*oSwpI zuS$&M&m`Qs(i3V_NNrNF)6Kph;JiOA|N2&f1uI0c1ow!cfNc7N?E1SAU56OPKD8^pXS#Y$=*sg z8c?3jrveZHRC?3Xnq9<;=j^)%spDpA^k5FotD)>Qw@@?`EXs)b(+$&9l_A3_F5@NA zL@1cK@>zT3V)$*gWW5a*wW4I@K9E;nG=dV!KO^V~BcPtO)sK&*RuTtj6Oym2tgI5b z?SoW2?wc>xBmBE=Vd;-XCD#asQ^9JwKiSb5?XIHij2Ayjr*fNsI>$Y2z3%dr^P{># zUUe3Q5p#(5gc9M^?UKya+vbI&e~{+p=FSlw-Vrt~mM!!@yN0S^t2*7z*~{gN8^{xH zh7;Cka5_Z7c;N&bPjQEHZlCOjDhCU+v|v1_u%Bp@T1h1==GpT^kc&K%XmPue)Htj$ zF@s+0U-&#{9`0#dg`FMH2IJ92$?6GL{+N2MIuYL6OKfc3dj0;W6CX__U!|J8ll4J>wy>bz8%6}8Yynp6553ZPXlb3^git9&T8$94n~(DV-uJ(!N*j+-mus=V$n&RvX6DmOwZE@*`3O& ztfr-bEpW&!7A?$tHDIhjWwCkdPTA9N@g^F<1Ld_OjcS|NW9u7dZBJ*3)3lBv)EmGB9ulF;!=+LSii)HLZtk_syW1%>*0Jb|JD%0&XmErp=MFdmz;|{?t02v;BDyY* zk$Y-_5b!!|XstD&WYh(1oQOwRB4Gnd8LbJYUYqBMOnDTx8R26YTPXEb_i@(5EIRrNckqC+Veg=r(^@8)_k$$wm}nItXHgeDg9@!Jthb83p({K zp>f-(Rd|Arp3^MK^HA0c_s=&P zm6{;RvSz@gayttE%4<+vd=G!sQ)Na4FvC8 zniLCqX_7e-KVRRfNE5y8SsLMu@B~#zXl8n$g%uK7((o;!22*M|aI(mR>7C-wpDtW< zte>9W)qY+UkkjB{ppCS@EL)a)>-mu!F%#3bQCJE;`2-!GmHF`Q4kPqJHzz1o9}o&K zRI~Pc3?(520Bu?Nso7lQ>nI7o!77u9IUz--={Pz~@dCvXvLiQNmg$J5ms=Qx8ud1x zc0dK>=;!{uj77TLK^wO!*Wn1ZCR^Gw3^;Teeyu#YD`ZcLDva56Tz#l4QdO&SA}cCK zih-FJi{8@f$5Y~a&1K~eIn@6|7JKJPZ>GJrA6P;S`Q7WP+sV=g1)F9w)a|(FF z8TCc2G&Q}`HO`FNywcaBWq9L4UNP;+zfTHG@%p?Bm~~7VPitU;G@o8!f{IeHs)8-E z2jB5SyI0&x<7UAZZnGeTRMVa5())^J_l*5m z`ujL$%Xy(!W&?bDeAtl{#*vxhB?~Y^^F`C98crAYw z9doC*8wAK|T}r31lwv89xWu(qtu5oZQ(T6^f$poAI~9h5x~#Ng5kXHdh(8SaJVB32 zsy0nBIOK*<#*itNXtmO{N+)P{b*&G^i3Q^hzwz|`wo)vhmooE}8N*oBb}0RHvwyDI zY}h9K@OlPOzOwxQgZpisRI=etGKXFq^V1hsSXAPfkZ@;n3IJMu?Z~44K{J|4Dynp{ z5cNu&X~#1`r~1=-vUEjy@fps2@;S+@Ov@B@ox|3Ap?gvhnmrxu1Nlnbi_Hv|ELFqU zYS0r5eDguApt8=z^KA=L6RbSc^IqVQ(;sWu`o*{w2b3x?VTDT-C++`n~g!*rv zn?D8P;;0Kc^|T~HrPPku+kI_oaLUx2;>?bBeFJSoP8;v8Hq*ziPDdz}tX+otIR#J4 zRY9^yi2y4JAEREYS1Q6CcA?Vv;2bc$5l=RTsaJbKQEHy_M^VJ8df$tX&O0u)@NEfU z(R(YswV|KRmmf5DJ==;DBno8iWwS9RAFX1kWYBDK`Zm`27PjaKm$7rq9ab1E6+wMd zqLF5dTrb8_0Z$n_v-!LiZ%E(Ux$bbjJ}YC6XA+Gq*}wLFI>X%zX+J}wOT5nUuq9h2 z9pa1DbJral*LRp?1oOV*!;e~4w=tf%p2!>RYrTJ5DHRm3xKFdoJBx==fdtH1B0nM6bz2E(4Pw1`%g=#^q`f=kt&4s8i+)Zkd&M zrJBu#nV+@CQP~%poF~fo-TM&2pnK@<((wmUp`RmFfuu)i<^D)x$_IVVr}2LReUQG# zP z4d7s-7!@_TCQZQ z+!GfBfo@eu%-cti&#nZX53m+LOUgrku~nkpvhv}P>$aSiqY3^(IA--Pd(u}9$19&s z!}$7+gPJlGM-;)&G`zSP*WrTH^Pz@;H8TzrW5H9-vpey(UzMM2XSkn>^QX%m03wy; zDcmY2A1+9G+rze&*bq0D41<-yB)n(wtG!`d$k}+zqs0c$`3Of4#B{2_09c{Q7d$ev zdP!PK^YI%Zqv_sD@^5P3wDVh)lJ2QOI7ml037_KVa-p#CCs^I6$1m#%l6+)BAnH3$ zpflI(6Ab1q>8nKh>Lm==>Q}_0PmgLOvQV^bf+_>vbE`QX%o`vM0|ZzD*onXT?4hyo zMcsQ{GOOzF@T@UZ`Wc%fTY?V#*@|^30zv~D0J*C~cTDVM@8JHotwfX4+nn$6sy=p$tkY(2fO3h!S_2Z zo`dEm!3GQ0EF1Sxf!I|2;n$vY*EJrus;BqcE8P;4tF@I^e5Tz&t#3ST5E(yG(cj)w z0vqr61{{JfTszms+64_C)6H$q*9W_RpY>$gZI3J9(y1HAaoJx>s@7T-XYSFyQ?L8^ zbn0lY&o9)YeLP!C5Au2odaxj3xW&;q5c94$t^d|Sy?h@K%$^(BtkCF$O#BIWvZO%a z#o)h_RI}f=+;B-gR*=&nQ5Iu!G+Qp_S?%NJn$R!e33Pn!er z?9{e#C}-1)=$L%D?d)T&3aLRtZl}*wYr^L z>iE&T&yRrqjW{9>8zDd}WiVt=n_vWQ^`H#c1*LC+%h3SRRBuQmJ0A2i`g28g|B$bX zubpP4OLby|X0D`)+CU=^3==#*F3pj!zu_r-HIc}$>X=;O6}V@$J2TRb@WigkG%ugv zn-v^UX|J!7q#|F@wDWEaZG!E+I6h+Yuo|m`iPU2J8!U2!G!le^@gkfF7d|> zyw2pNAHp+|2_GWW$Bk{Q$AcwbhZUbXr#Z5hv{~N+Gw!g^$A$c7@1g#iAA$0nv-$|> z1K50grO`+MWd&=OD{%@uJKisb(WgCu>mi(22XoEf++;ty;(c&<(BN~*D%G+jqN=@8 z17YLt8k)pPKf$o+dqba-wV81ayGBJ&17t@25%YC3cq?*TM zsk2Mfagzwc+h`w%X`Y0P1sx4k+k3e!e?zLFWCGTD27~cTyS-t=(;ra7H02T*jpDF- zWfE>*G4ihaa~7K+jDjP{g%cTxiGOuVG?yPNH0SwjZRXg-4%F1_;YDEMruCHN1mg{! zta}ztC&Zt@wnbpN&jx=fq&ONJXrejR%cL=@2!0xk9M2gP%@9D!F+DeZ&)&u6tp0rb zC59_LN(6t`b9Tprl$*1OQ2>>BLEgi0fe1@xG1FmP4M1rjT$^rMI^UUM0y`YeWswz@ zp6US8ATD`T?l=iiA35CNKnH#r@dnP|Aac-Uxg6<-c-EGp=|UwX7wB~lrKzfOSMZB> zWY|>F5w(k!2V>HP?zyUuml?jU2!RTm9|K4T$nCWV&qC{gj$s^&#atKEGp)2Vyg%U9 zeZ6`FA97`@l)pa7U@;m|k75uMp3Pj1KAIB>6Jvkb-i|cF zb2RC@#c430f7-~Afm->!Etbxmv%X-2@`9NW4^cq~x66sOC;8BfnO3=K>(|i9D%C-u zy9KyriXr9^J%`ao0za=t)~7kHL-u%Q*~X1caRWBH}s)0E(h3 z4!uxEKFqf+eRF+Y6hVg;`T4oUGY-w?3}-`$Og)kC(MY7az`|`nC?0LUMHrDYgqFn$ z(&5JY1HCx1befF#}sa8iI< z`aF27FL_d;3;OPoV1BfAjD2d}mK`>J&D|ft;3JvD%rN6h{EUJ2 zj6FnT1)uDjW`=;@d1ZXBkY~3$$$WJU+*6&`6_ueMGH@_FNK)G)K9MLM8CUOZ{UQft z?h`?1ky(O2F3;JUnxzd**(e+By4^}SswLiXuEJrI7fgM5Do@{EqGcD0g1=Gi5^Bo& z8bgQh_U1O^ZL$i99Wqx)Q$e0|S`;AbG^41bj0?b1R@9K3-A$X4RSvNP(u^h;q|uPe zaA1kAkox*_zy(!Pu;~`fn>7k|8NJAWskFTNT~J9h?#@>nsrz;x_AuUTpz_4J9^RwuU6r60W^qYti9DbT?FfyIyAg7{(Ac=V8w^AY6`eoNFQnYJqV1 zr0DK|DRaNjMp>9$fA9g3z|!+PwU9B3-oO2o)myW^!(uvcQxC@!WKLk;zF;O>C#nPM zRHqaCZZg{tJIiL=#(zGyLrrBzsa#vym}pVbg&vRd7045{p^WjG80 z&3Y0H-RIZaZZc+g2jkIO7LtoaWm8%SYu=8Vyc!75Pgq7RT?WculTj z?@XDkfvsG(?<1#>qSKq2ZIh2EFjaH}1D?emuX@I!;zX$Blqbdp(;JVx4%L_%wfGaD z7*hpBn>)i~qSnXG>U>9ma)+4vRy>x*fRc#31Di&vM18}Nfy^+LS_>i+1Z=XB5qRx) zOCcT;0qh1;I40XC`L>sJ2FM!gmvc6@ooozJ+3!xW)Jp(j1eCU$BeI7z>OHRLgF5B2 zl}2XSrJ!fOep+*9A_I$(8|3FIzj(XSrV1#U&OvH(t%^3gP+D6LU^7`Z%?`z`j(See z{Ev@4E)^q{fmwlA6rlbcnEjA$HEr``<6*Or&=+KHAm)&jnFR}1_0*v=qdKBz zzBaE2QhG_%k?mlv`UV#65Utb7?YL3Nv`$|1hgzeSF16mNnrcaQ?{hJJ z@{^(FQF>2A@NIQomZ-Cn#Y^SF{`%=Fb8s0?HVj|-i*@$pW_s&XuswMY8lv6z((cJd zf^>pGAmY;Qxhc~W;Ul;@V~SEuy_E)YfK?1Mnnj?y-lt)O+byh?Guph#0ndn-b>DJJ z6*FtHTe(?MNv9ZNXGFHLd)~oEz0=#!KD+|ys`PSH;02_{J{g6iPFYYy*AS(sUb8K>P-y_qJ8Rv#Ii1%%X_n1?;LB+kCZOAX z9u;^ENB48*y7J|nZE`7w)=Ml-desW$+*{rS+;0v;TfZo|+gfY$FrgMqV*l>^~ldeW@eEjjP08(dBi+Yj~!3x9B9pUmVnonys4{Uz_)XL^qJ1xjyb zI)9-NcYXhEn4=4b-L%|h)Sx_`*>clbW#5vH>kDE`_~FH@Q>a+nRlp#0DfH4}5ZFxJ z6c?LH%-jO?oTowyBSePmQ|`KyxjXAAqCd93?W;6F%o1S6d)? zZR9=)hZK!L!<8RqwmFiK z5c^sHVbHv+_lp|CVf^h}2;css2Dh2RFh?E}m!(-<_i!?+#Gw@|!Oi*p)=`Srcv{oN zV_IHt4fjLZ2aH>i?a)fC#~6hACt;Z-SErkWg-$lBUlReXGxPvV4MiHYlGiVT@MQ?U zSCnyae!%eQuuN=qG3Fh^J8^*gdi9}3ZVaK&JH zWV5C1P;X;^lwtK87m7>SjNxgG) zSY#t^CFe3Nst(?BJnOV9;ZV>`5mD%o>FrpB&}_uDu9OXGzN9s*1kvBP{Z8WAy$v!3 zfc`KEAkPx|He}a-8qnC)Z^3iBT<#r;x4;N_X!ajIvSE)XdBPQ*#4kO)diy+xDc&DV zv)U$SZ76Z#g&!WtQ`rpdmu!wTU4hZ;<`pD9J#~+IENG7hGM1Q%lm(Ev)m}gDjGn@> zNy})k=2_dDWx}^V3CYLa{!V)G(avirsTLhK zN~O`LP7|J2n@XUOs(tn(s5-0@W^aID6jb+hb&iz_ zVE=}F#wDXxvxDWJ7WX*^#&ao>YI&1(#}$GZG(`*0MnS;dYV7kj>`NU$<}kzk34nCz z5_ZXTEjZL1ulAs5_SIjFY3Yrb$!Qtw7B1@^SFpuU7X)_iqqEJ8^4;lcqI@|HSO98y zTfV1LVneJZtobSQ{ri0}%EUNo!VO z`2}eN?b?dqZ;XhdLSHcn+rGZjH{6+*r&pxDFSdWGetQfr<7?C8zFUJbVZI*_k!qzf zX4~0mc3GywXu2kfeYbM$IgO6D%MQB$U?kZifx88&op-@1vfaUmPC6><^Yysx=Q)x7 z0cEu;?fKv@f>GYT_^esG=TqNL|+yx>pZ?JM#Szubc1wA8%h76<4-xo#1W>5ZobX1$PJ@ zAV6>n5Zv881b3I9A-KD1a40mmySr<_chY_Dd-wJ2+qZvxW7J?2MR97^Is5Fr)?9PW z<>ER*2qlE0orpnudQjCRdGJ2v%9PmF!xp7Td8(hcgx&9UqCofDjNf)G+qHIG;+c`z zS_4AWT|g@-8=75o9KEWnz|FUoucX!X+p?%xl|KRk3hfX5f^ldN#dSg1xflGsrcF)4?Cvg=7N)gLjZ)j0F zu$JZ(y_qkKsHud;}D|<6zZ0V{@6w#NgoudWHhb0HCNGfjgi?J5St%DPMJMBPe^V{9hUyH< zo&p)jSfG+jnIM%8V&O7tj&*h_q7m^Kw2rDTrA;O3BUHL@5dVBbU4D1D|CR9jjnL_$ z^YUDwIG3F>%2OL~uP8?;asZLJXQ;Wmsd|-c3HbMzY!0OGcg?(NPBjOM!?nGe45%;!(5ArC#sTaEsk3B zFwAQi_Q}}$5n(*E0zHgKoy>#LTHH_0Unsxl2CavC#nVmpJVZFCgTuXw2zPt;6>Kww z?o_rjLub**5~&B78NQ1y!}j$PWCWq(1V!|z!z?=3-NZ8x7c>|TpY3R|H&HN1ZdXLC zET{7k-uOyoHfrffIhqLSQv!p!MK|e8>vC&LgsO76CGxR+fYg91Tqv`9@M&UNwT9I z?kU^M7732p9qZ3cQYQS{kJB;j-Jwr&c7W03%f|9s4dFG(U&H_nD0-C#Mg-|lLVTGN z4tCJ}Fu4w5GmjQt>$4S!=U#E`3}uoCC5#$uobx9XJy-@3W;^!)+b;>UJG|;es`Q=c z9`rgF3fKE22Qzcq{pvvl4xQM6ME_9+qb6L!EI_2@f-iOWns`mD5ywTD8GQ`r7 z-bGVni2{T;xYtzkVmk;V1!xKY2w40G$9yYCnW@^@gN)bdBFO-pFm%#+Flbz()#M~S zWs%JE_DLq4Z|p%$^tJOVY6b3$&Z^qZ^*@2ANxvhka9WFnn{8U)PSSQK&x9|}^*W|@ z%+G5^xeX;7gzMK@%~Llx#5h$M4H<5irrBK&Yf-F_Mecv`M@}t5wIwR>iL%R=iZ9F! z_ZA8M@=DJz`V)tib;8lL*i&R26tI&1-J<@#8fd#r?8aP^IriaesTL!XEqsfI~UgC8{o^`=13>*Wq+yJ%eUwe8y&9m2;y z;|w47f)Y7(yk0!F$%@Ep-NU&mz%1jzOwR~!rzUbJQ_jkD{o$JgRAGQPEgslHG~k#q z;e5)qTka~Y7I|LKP0vMw;1HrU+q^^q52w8L7qz?Q%XMRCQN~`ns_OPJMu29^0S%C3 zB9qn-I_blT4??K=Cjj$^Mk5kH`8mvpT4rTE)#yl!jLS6fq1*mFrpKz)d~JAoq;-_r zhxS`FQEZd(+!9iFj#uA6C-23yr+_}~`wZ=$NBI$kpoH+?jDVf@4fy0|&0xAu&5&E& zomt6zoAcg;nDIn9d&;Q5T!j~mMz1=gcI5Q4diDx@ry@!GPFL6Mi?U%;o)vC!+Ly-fHW1h!lQu~%3r^*Ja%v_+|65t|w9R;YFlRT$t zI@RF5i+8-JebC&LX`~2iC|)kt)^qRXn9f!zP~cJbXu->>zz67Z!GzpyU4AH~S!-6d z*m`oQTx38^qb8)88P5ztnm~ap%|pLvg20SaQm-pG~%KxD2F`e(Z6c z!-U+9e8<*R^9{w0VV73kI{K*=TVY@Al)Jmul2htDZtIjDLdm?DZpKe)BW%6u2uFzF zb2sdkNaCl+)H>V8<8|M^Q5jV0*>_IyVrs{Wg^Q{!D$hOqLV?`;spMoHSl!})e)YMS zlgtI*KHi=sSB@{gzxv#cjC`cgw5O;vkHhHI@lsBB&mkD!-S=Rrx{G-_*Iwa}6y65< zw{7BWJ?2}i)01*2|B!)FqEddI&MYrg$8SRbB-S{0DO^WJh+>yuHi3INA!rTOyd%dK zOG2r3UKbzbTLXP>iP{s5n4+YUU78}19A=#o=3#2S((Osj%L_#MIc=$vn_gqJq2!}_ zlEzyXzVlFgdBXK4lqnZwL{gg9Ffs1e><*SeS&w8GqZKb)JcX4ig#7|O@C+P4r2y=$ z(2Qm1*gK|rdy&3Ren(=3yx`{M=0Oe@9C%|cIFNLhF!zLia~#)jtH3>v4T|U-Kw0I# zo(cABDH~wvnR!DDV+*P`-#ThoBW_nySIeqv(0nRVVFEDmVeTX^ zh_rE$6GwlXs0al?0~HcrEBzHCY%?+*z?@LwlDX;xs1v7vvPwqh+7oZ+RZ9a@4*U-T zX9%?e9*|we{$#oR4D<2D$@#e=+1SXXtaIJosG?0rNRzT?kKKyhYRBz|COGC1^_Pyu zXFSc943Ydrm=oA@YH$&VC1J|T`!^BHEhlT|3mM_l2T*=&70+IOTs)t7^sg^=M8C}^E;*{+Jl-auv})k(tw8zhDgYE%V)IrRK5NrIB#r<6E2bRjN584S zJ>ARpW1+4LRQKN!&9c`%G-sk75D(Z9&EGHVAHt-6{q=3v3xqnCwpIawEsJKoo|qkC zVoYzNgXh17(o7Bm$if*~(LK7Sd#|y%DbnG78{xnH|Nnh1>It<H5K@XP9;A0 z3afKmk?#UFH22Bm_u(JCaCs2*RAW~v&u}XTHopRzeUWQ)BgsFxU;Yo8<%26r`q5wI z0!Nqe6zRm;a}{C?{qHB_&tEzDiRdRCF_pMv&hg(A3IB5d%y)oB1g67y{C{5g>nHND z&-|zIT^DD}|JyhDJ^S%NpnRLj4z*fk`ZwR7F9{52qS@+z{l8p;e+0#EVF29?zR$@l z+uwZu#IFIFX>(pB|Ghhm6bkW!N%-3vi@*DRvtI*ZFC%c5`6C?i=cg8+9lfp=C-va? zyYFZJHK63_@D}QS&oKY&l^{U)`F_TNV*{G5;?COh-p|MWSBgn9)bxdZnJL-Tv@8Djoaa+{*%4Qf+?Rl*g zjKi30`WyFo|#eWuQ{qMrGvWaox!94_19rH#=7$6A8Qoc(%G31~p z9^>z5X-Q(%pW6$&7yn36Of8wL#9}c2BaRCA7N zd&HFNc_af2s}!Tz_V^{x2iA2OS;u>J`oup2gW&(%;D2_3fH$~UK}8fU*sES2V7EiR z)DG3wu1If)0pKD;;Z1=^s&`Ru*LvkvoUogmj$*#RBE9o@xXt<2DjrE}8DTk79_>d> z?B?bsRX9;#xl~q)@0f?;_qJSQc9g-ePzj6GDC|>c!?<=iJnv!9;U<*{hzm`3w@z^~ zvy@tiSx~*wfGh!sK3gf3Z5NhoAZc~8$Gt2^k)zFuij;C>)?MNI9{HVa#cIq$j#*Lr zpZ)3od>;QR`iDVp;%Hpr>S!6H3CNo%dLzKEvFXX+06DpeY#KKO zz+ZI!%|s;x%X&sDLIbbt!CNehpU@jdLbK%B zTp}XkA<<^PIn1cl_RtaMn^#l@#4!3RsN9F%<2e8WdCh)Vg2Qs*HM5?JREyiCVRMM( z$!lO{(;ZD8OZ;jf+!aA20r;-aahB;Ma#+s8nZ6(>EFyI|UecN^`_9mDGL^5a*ywP( z5a(FOf59k{8-{i%5lK9Bfp`2y4qcA+L-}XKjAr+1rUs|WLO?+r?|$(hKEm1_%fSF~ zGGT~|UszgV@#sQWr)u`>b(+nC;^33B1;x>7P7#JbZi1q80InjfCWkdn(0YTNJD9|N z3t!i<^X?J|0$n9ju4HZv`!E7=LSHg{UjoCzPG14Ie+;WJ6JGA2dV@FMm&kYvFzYB4 zbKl#E(qOD;)9JJ}8;qoPs-PdmBF0inj(zWb&r85*5d|o%QufbFu3~>nIRDGNhr#~q z#xo<+Xt2vsD*Yf&r&>(u3x~#*Vm?twC7sB`zV-VT0{@04DUg`He1cXG)A44gC^+{;YImHT@=R*^fm9 z3zbFRc@;tjv-aTTaBKxoLRBW3o5s_Nctqx|fR+_N7lX@en@nN5cl_aGTWcPjbH`D0 zHcN@({Qlb`88j_!S8;cads5+hlZFEu{kdwvSlvV+-dD4EKdU8Qn0_NJPjH;NU$Mk4 zHCHJk^YZeFQ7(JYK{BtI7eSOGd#ItHLIcGhKQg1XSF>=nc>O*ajl|1@8tLI~AEqGt z+P&%==WkMbz; zzbD~$GvI0Y*e#`YWicBru|tkswIZpmCB~|DsPTNMr0VIWvv_+bWx5%im}{naeFUKL zY(CuD1ByE-q0;wYxT3)C&gsp+*j>BdGW{VB4?|2Yn6#j2VjU;_0^dvjtC5 z7fLeq<|HLWL09rMAGXPVQB~WCi1}MU~S1NUicK(tmHEWEG zeyNW95kctez7=jYD6?yvOx+hqY=WC0Tt;=qIN~Xd6I-&%P;Uky#4?pjr zC}wCCA_gGU-*bIMn*ALO+z98^p|S50ID->I7RJyl$>>|o>$+z^vC~>YoCj>{)lOfp zQSexjuFr9qxGVx^kUG7b2X5}}lFx95VF`^@F3>xc8Y{txk2RJ~MhCL)wZ4mL^|5#>-uo&tn?b3S{ zNQc8a?@BXeJd(yPW+Pi4iIFgOtL<^N5ghWkEt91CG9d5(0b8f29^(WPD*5lOJ4l)A zluAJ1ig~GkN;*C!ARPazO>3LEfQ;WmH!_(sX2ex^y{#qj_k57d+_Q>90QN(h)S2eX z?Hik|J4Qd-Ow_?2!&!A+W!Ee*Q!Y6-)t)qw``&*^FijMJZV9^@HeIT2?l)yITLq7) zF_Oy7Xqa7`?T7_E4pW-JZQrwDfm#Ce40=wklgv5J<3K9|C<6o2eiYY_)9jCCOU7t~ zZt(-^O0@mV5w$?2SeeBGP!ka)JSg&muDfScMfuIswIvI!p3+_!+|tQ4CS>kchq1eD5WuU(itSb&;0TcW zLW>-eU+)APvyx7Y;FXTR#Wmd#An;#q+LizV0AddIpNs-n)x2kSN_<@tHB?Nqm5Nx zXmPJYBniXzLl2mBpG`)65P>SA^r5jkA2?Dy8+1|l>y5Dt*XJFmdd+Syoxc~ML@nTY z6DXopm{?rok0~g0_n-^xkmgM8Pj3H!?#}?V&2n1ol(#F$Ew7Nx=Q&&NohHmfv1_ADJy_!gOrBb()**Nzc zePeqUX#X>-^iBI^_8xG7`T>RrW#rZYq;$ktAxlN3Kbbu=KzI06_QAQuD-MhLUpdzc zYA*AH;^gZqpZDo({Yu<`A0n+vbA7e-lTX~w`~Kyp=!V*>!_3HXAXn@o;n988@Yxn6 z90t(9d$n?E=Z$YR{I%Uh^LLo<5?!u9DVlZ0$dm0lKO-Zf^AS*i_j90DAf-Th6|Gf@ zt<~DJ1;(N(;L#5fKQ^@FeDe8XCu?tfb)Q-Ge#|4S)Z%AXFx}FluHVF?FB}rga72cu z*Z*M_7W{)J4Tf?9tI>K6PMveC;!ZX^{ElU1h6&b- zjZ};&by0xg%3OQIMWN8aw8}Hut*+L5T9))%qaqyqp1EpeIge9(4UiJb{_2eqX%*SPT(|*se8`VbrDR z04k1XA!vBBnJso|9YDf>O;r%G0F+)>7KPQ8R}OOBxSRB!Ok9>d-LEC1JH*1S561K* za`byg3`UOlw`>lM$65jdummW$?Ke5d3T?dsm3H^XX?N#i{1N?&^B>SUw1w$?80tV| zW8AE6-7t&pd^f=I*VF&^zk(9pR^K2h^0`*XG&j#h6TC3WAYm;o$%+8d-98y?Umb_n zsxE`V7N`Y`&fqRpYn7lpFRw>ke#5}CqiS4`w#Sg^zHZm#wys}oN73>XjgLo5gn zc+K0?a_}tzj>`!%Ecu0uUisLzTsi;xE~#k^G9Jng?LW-<$AzTq*Yq*#8bo z{--?KMFv6i-OkFiAER9C-$;*upkM`?>TTvFc1t-Q<9`{|KR(k3SEBvATX`t?A3~{i zY#&u>_WGjOb&kJ0fX}oafTvAw2%oe4`cKj`j36A>#*XwqAS-|TwVf5fnC`+>{vlCp zufhV%JgQ>WZU1@}L5kyG2^eMo;De37TVy+AmA&ik)e z!e2g@4+B2twbPFot-tyX|2s2$f@lEvZ>{Y4?-=r5pRZqk#pp%=&^A5Xu*JV=_Yvd* z*nLnu;+Mn!_k;iT)&75c1sCy($I7PP2PB`~9{buGj_)sm6Q6u(QgIYHfD2#h(j7so ztR@{3qkPq@3>_C`up2q|bA;VT zm)rZ$44wBa@N1@#S^bCeBcNIZlkg4PjKyE;iH~aJGc66B7V`mC^8a+IeEMYC$Hzrt zs6s)`w3XsV$d_N-;eCkC=#KpFuRVbzR$^pQFJIU^mti)&=sEFkrahD=XNakMUKg93 z12}&otNfpogfs^0T`E`WjcNTSw@UG!$QM{m{_fANp^k#-Rjv3`!9dZ6u-Kcal`rW( zpXC2N*cZgEP+WFFF>d9@oM<CMb_OGr0C5bd&jm2l!<*PG8`tI%4GKkTW+Da*rNAq*v;M%^A1^2&wiz5}IsQb!Mwgi)Ot~m!0`v%v1 z1;gXK3xL=vHY+Rp`xF3n9`6GUCn5QxMrk)D2Baf^$LrKAomnHF74Wk`n#O(@Q2R_( zOsgprImrN?z)$ql)dI^dup;oh9t`!r*J3f05eRvmgpqIyKDo;z^DR2GSTFn30xesg z9z6pUL-1I0v)_MR&?Qg_Kp~<)C8$ZToF}aor~&+UQ_fZ~%brY2BBc9csjxw1Y7qo! zQ>1EugOY~-dXlXBmr~&_;WoJpZhDM`t3%#b)lrK$=;-K@@pNMK8*O zxl*gj69F%KByu9 z)lB;7u|@d=^)Vf})RZsu>cy%MYt)LZkVw<{6643_e}{P z2p{27^zbBkx9=>#24a{eI0^@DfEjC~$}nT0cGe#heFFEW%z9lIA0wj}7)C~;_ErV{ zZBOu-PHCU3**6&2D5(5J=Ok#=?S%VT=m=KDlB#THj%@Y32NU{ue6n;0SyHQG zbo>8|?-JiXgT8`>yNFKXo$70>k)BLBA~Bt<3@*V1bWw_EBy)7#p|~9L0N}=8zx_zv z3pm~uj4t{pM#)Kq@rwZv3%@4v*!*FND^ZsWa=+;Cn-f4U?lkJGfO0!8}TCK+Vn)xdg(r~{5Jcc9aO>O#SItA~;r6VMiw&*SF9NKGae&!aT(O$Kw8vDPr53Gp;scp_ zl@Z6}a4NTahAq*MT_O`n${E0|sRd$mEY>n zdY2_d4poX|XjMHW=_Q=fsFogVoww@Wo6XkiHWW{7&qe9n!B(s0e4!28Mo*u1kzM~< zE|G!A-?j@V@mOx)HMKC}f0#AZ)_E-|ob!n-GumI{nZ<7d4Ag%H!2k2aPyEwXm^zEu z#H-z(4Mk!2+&wQr8r4CrPrG?uEP5MnG_irQW%QW7xYYhzvRdOZVk06l_q<0ANotu# zWfVBH-C7|AAPEp8yr#t0-eLF=*zI<`O4Azc53FCC#tre*LIk zss)kjj*3%I_m7{ivj+2A;)|AQ82k3lcIim$;Fi8WTlRkH7ch+CRYik9Da&Bd$iBw- zfkw=y2NQp=7w)n%ib<=O>$fY|yo%9^V}Wsnv+V_FF}JBL_Q@(F2=v9#V^DyKFtE|W zW{R(-sf)oT5^!4gb1q-Re}O&kNB49urcT0bv~11MbJQN~=}Xl+wvc zS4X_0vD7l02Okc5Nor!TsGwUdK-$$Gf9A?CV$;Q8Z*&~Y6r@Ds_{hBsjJhx-Qd zWxB8>6TK}z-)NS0=ybMfdfd_6y{eADOl|HgnTE0iahu&XudU8m_C}0YJJctXoy1jg#|RRn=CD;$L$| z;P1U=kl?CDm0f`*Dsz7P%Z-kKrpVWQGt44NK~^;0Pc0fNEg!So48O9|zisyGb@Q(q z*n!a4eQdcGDT3ZS;r4&+t|+MLvbAC#Fd~?4uH$$wOJiaYJ9F2`WITL;KX6-5DB$t_ z7Zr2VoPi$nfvhq_t2UA;W)PE@DIM4MHIXxHt@+( z??%MNo~@^H243H6axZVu?4{hT7YX$*c7aYGU6!!R2^gmgK_@JL}zjJfFa5e?3^ex%DM}rpu z1Fg|Z8WzVrwlt4aX%@o)liI}=cUAAIo=HpY&DLChjrvc~hg=Mw!k~HqD@oA#HYnZB6^lck4eM>Ic=(>(d5;Vc$jty|8YuOCjWc^!q*7-^M5|dF_IP9sO2 zMhho|ORNtB;y*#Sw=!!kL9b5kIugHeSPF6oLv?8(3O(qac z3uY~;MZLq~{pI5qn)QQO@8m^I<)qJ}Zd(VgyA!+S_aYWx3>LCV(nuO%>g6Wq9RGQ-Q0El2^QI7XK3VD7Qhz*a zpx0@bc`E|IpjZsj7)Hfa@xdZ?s}F3wrEa%B?&$VrCn+jBh4TEaGgv{W5=t~L?Ulka z^~U!N>T@Kh6z3yC{H0vqu4z!$q|%`8C}6y?ouVmL1%tSThejbD=3FF+P;2O*0M*4; zJ=<_Dfz~VZy7j{P^9kU~=+&RjXpWJIolzs;*_h&Pb({`8&=i7cwfZA;1VvaPag@cy zhg$#_WB-HBCB96U4GOc>-G!~2&izh{O?xWA8BQXTq81I#$7vGUNE8Wrk0VdU>v#Sh zA4$NZcQW^u#fZ}_Pwiws{Cw>;rBcjW-gk?GZO}iqd3Ac!lEJOnU&<2np4SfWv~`*{ zE#A{r?xBCfVVnmqwZOx~l0GJ}t9vJHa6sLMU>Ch#tf$@q%_M+y1|CQ?nw)$W#!q%K zCv|H=N%$}K>*9dQU9$UXSx%Kqy{X@1cNd_|K7N(yIQHF;$Jg<@W6~j!<@(nzkE^rK z-kt3c6sBCH%q(F!x4|{WS6vu@PEw$cHXhDto;bn_*0hdCC$A>vap~KTxxBjK zSm){v!KqP3MxQGJ)c2B;zgRpAOAU@6v!i51TN!``9L&SGCm+RRXMv&zI3~yYt3GqU z*)9!{qu!-e)zUXz{_~}JNs+Xb1t}Uaop^M?hc2$L1ed+{^bBi#;QFKEB%j8CSF=y<(<1WQrJjd zr*Jqpe%Z2V!F|M{xUhHoZ1lhkx6}Z2E#-2k$y89sPpWYc5xrb8gpiui>5--=) zlB{D*dXAbO7d}EZ9Ils`xPB$%!w`llDT_L{noPR<;lBE%gFm~;2k=HE?EY-k_I_g9 zQ>q4{nq!`9BK(}?LKZm-LrTcT$v3|rnxL$7-qJ(j%Z<)k@~78+V5#^$yi9mf{CIR!t|oeK6D0;SM%>R`*aj5Lh{NVZqMFD5@)1%GAcXp678fltc*~7 znO4JI0}3R$#O_*9X!f_$jft0wM*@9i9o&AqU#qqTIQj4Pa8Gy6irm;l>ZM|Na?(cx zXw?hzF}>{zZjd_pKVy_eX7Ejw55p7g*-x?!qi2>dM}HIYO%Q)AGP4J)@_UP=xsZlZ za^vaJ=d0E5sCz}M^wO{e(@2q!MQ6dUBN%)Ir`#c{yJV3{&(OPaR%@N5!73!L>HQ{*>unQ)I1yMknNv z#EgvsBzlN^Hm6_IGoJ6;-%RT~CApVKZPrZ`Ii{c5h&8yLC!mZA&4pj{p_C{pV=6wX)-Q8XZ82J_dRp!z1cxoP-ordv8W;{+_drh1bB5QdmP;- zZ7R~p?GG+=`w$n&f!ldqKmx{Q^+&)$>P}Z}rZu(wQ-lVU&ArKoHc$}5@U&RQx>+Au z0KGIlvlhDk&j52>($Qwuw_Q~GQIkc}ea#KeU!0X#X10I;*xUm!tI{B?#_j_r|I-T~ z_gyq!9~n@`ntH7>AEt(cK1RNWVY4%;n}$GK?jcVj-^pP;r`N1k(X0fk{Jt_^DD^gw znU15Zw0yuYnu+Ew-0w!U49taWn`?~M@$U<0CvhI#vVdrxBe zvpQHdV))4ENyLKE#<=Cq(ecbhD^YBF(dT6bg#hV68?VJ zoJ&K^&2N@%6FQkb>=X{@rbTjs*Ew^3|1GiU8Py z8)z%_?WM|dyiA@%MjcZ=KCqdIfrq?wEOm{=QnSq0Tb>DhcK_?B8TW$e^(Znyscxjr z19WCELS#rQqq01Tux4z}WsXXT*_QvC4j|x)CdSuz1(n$1YWiw(bgvq8Y<64kc1Qkz z+#KC9sfk4lo>e9tA$r|NZeV5y!3x7@Uol8~TB8EXyxTkAt`ykBbU{5av|qTPEtD>} zS+~)GDz#s3_h^N{qp)UX5rJW@uzI-(_ZRLzH&#c9G#ub-W7mH2@rs^a2jqq12sy}^ z*!QI3!o?ze8ZLEf9_RV516l#Hyi^Od@=N3jt%bVXL6|R8ZY{(&1=lqR8D+vWekxhj zaNGjrWwP_vhk_<|Jdme@Gsv4CGZG=+-u5ho@yF_2d+wfe)IB^$8Ud_Fmohq4+Q@b1e>@`4j+I+lKRaYkJ_4uk!H+1-{ zX{VpT$chG&j7st~QJTY2CqLDrIf~%E6o|k3$amRgz2qWUZ8DgXRZ@Jq&DKaCGnjXO z=dJ`!W?i&PNwQYYyjDyFZ{p-ZNR~Avm3994q0lp!x4>gXmbCl};}qrNc4s6?&aQrmiIZTaXJ!HNL{1>NY(?=}_jajfwgoa>#Sv@MZbgfaT!oCE* z9!gsTs@cXhwp!+`r@MU;$GbCdmePZgzLvOaOMn!Ic|PTLMjG2#dMj;CtGV2+uDrnH zB?~}z_o76zO+MHT^mVbrs;}MB#?2hlTntmaJ8i!!IO9Xxqi?=32xp5cSW`{1GU9qE zWw1i_I16*6MN~TBpcOk0+^;x5+Uqq$#@R%%zH zV}@F>9afQUh17%p;)j$g?UZWAGP9^*bWAg<;CcNt2LV6hI@#o%4HCkTWggP0#);hGqlyLBMZ451>qrOUcd>OtF9j`2xN{tHLw zNJK>Rm`0^SnGUIKby=5Z{6wu*R8Hu_x}sj|p2GxT;M{as>Lh#OvblcDvXG>X9fJx* z(-OKs?(p@&Y~J1}^lz8__ly6}pLQ|rRyZnRCXi&Ubt(M23k>W|r89D_kUXl2xA7DC z(fuwWX$GskwIv5a5sGEn{FAoxwTIRIjA{U3k!wQ*gGkWnBflVTkA&pmjA7XWujWrJ zXU7k{`n@uadz9fM>%DD7Yqd+Ba>i(;SMTsk6mS9BurjSM%DFzJsI>26{U?vE#HBz=tm1K}Qq*Hpm+CKMkbN$DhxOU#`3UrV(0?q}^}J0;-ZWwRNOt78HAfz5f<-`q)rj zF3*X9G?+k*(O}<>dx;IXw}(alaZDm3S57eH$8;vSred33@qm+dlMY9za@RXa++iIB zW^qut`K#Gwucc)sCouigfF4=l0wr%b6r<5xN~h0J0`=j1ol2=URjyGA$MslQ+oMpc z1=*aBej9%5B%gE26*)-sUCeP7E;+=7YW*Ci1{4-=BpE*H#~c@AM;zeX4NUHbq!DhWU-b}x zG#K>5Jt;v){TYN82qUu-wMg5f&!GPJSb5{)tx}u~*t49s2}+Nxch`k$=Dt?_u*+mFJpXEyt_Cz zACIBEnyY|Xx_K~&zU{g#xbWZ>S6qJFC<2n=dRfT+Fu2Cy{(?Y=)ks#^9`Gd&ME$@- z$JrZEx@^Xbmuh0GOu}lCPBUpkluDDtjEM008N%ncNY5E9v*R}24|A0=TN5s-r8{Xq z!ms+k9~tJw%1Rjo8`cq^&dQW#qdo=qnH&^_Ori%973#^J&AK@`(;ar*o!3nFsO{x2 zkduFbUV0Msz0rMIIBum3mVaH!Axav@g@o+=QvTi6==rO2v)AX526s35iVMRWCD6M? zWdiz{4&|8{Y~%V#P5B}$B|y}Phy`GA*~(9kxoc)2MQXv)^hX-kg|Bk@DQ&SFv99|% zw$^f_9|WC@Q2r0<>13av!K z3Dt0AJ#H;^E~2I;<1*x8*VI&Go+1a+K8D zLadH(rGjvxKlrh}s598KQfo>-n%sYm6D@1QFi0=er{r5il6xs3DsD5l;5y)0Rv!#; zp46aX$g7S`t*%)riwpUrJdpR&TW-IfR#U$&Ye1QlI{0-|M zK|M*k#VtG{gR7rECjJ{82r;PLrFLW`y<_6w)uCCJCvVm)`KbysaqOEygp?Mj5Q+*aC$4QIKS=6q6> zgR_pV2iQ=huWAzl_Xmm>KeA7&s~x4ie7>_dHq^1oJR0Cn&ua(9F)ME?UFIsxXXpjf z-+Me%_%OhEXSL#z*K=$pHR{RS-zrs@u!lqDkHIE!w}vQ~XU<1+SpoJ2D2H&|myMSp z@9(4Q>tX=5a_JR)M_X5Ntqk3x!+Gw-Y@8&W%2Bzo%r%!HuO?2TGmGUyy?^WN7H{|E z?Y0akVMk+8)vHWA!tLwU$i3iW+VM951)78nEO@oL`|S+&i@|YUt^^yAJLgR-DlX~4 zc_i$CqT^~whiP->L%BPF+YJh-jrdcIYBt1+Eg{=~52>E{upyd&ROS}Tnu{MM6Q6oP zLvp!3&?MijThnD&jXi{bxw>WyiqDr$bichFz?6Pa!sDW**6^RHMD>l|%Kk{ESJ);P zD8-^#H;{B@A>V;&xmYXX7#TW&VVf_EBLB9*k%D1TD;HQH5xKUVx87_H zA6q956}Qk>n`GFDs2;!fhnu;$P&OU4ywmS#&Rlz}F&PWfFI}R(%_x9feiCIh3et>< zvkkL1*_XpKudQ?}s^+y_tFH8W=`*~cH$CCJmOT=8KMxQTZNdh5EPgnrIGxYylX&xm zFaAtt9m(8|&Kf2#-cU+SRmf$pZrIZZpL$A=?y-N(1(A8mLOORvCfIeShq||7-Tz0^+ETatcBxg>t=k~;37_OEW(&uqgUjJGW zPt(ZG;Js<0{9MzB0drlVzr@QiwxQdBqV-*SoRqn0L`qIhPA~Tpo^S%r zXt6h#d8zsOfle29`}&hgXGBS7c*u$evUjTz>9y}k`kxf(Y3b+^8fdECJTXCTdm{<= z zU>WtQ`cDGjFPHEhkx}N^z0vnE9?l!-l>4KbEEeMW`D$egvdhQWk&Y}S&Vrh8U}y2E zpOoJ)Hqbxks4{(fj+@=4MI&DHHJesQso~yQqNC>kF`J{^9Y~4C=T|F!%|= z-(R@a_QavE|II0(5=hlw`zWL<2W5Un_};_j5OgWsD=#mv0tvTt^csjOpd?8XT{*NX z+wFGJqLw(#zP=bWo~(L#yIqPCkRz*I%~`5AKp9SSUrDR~$nEQ|ce}&(c<3xCz|$`c zwwzDmTiC4>On8($11c-UA<9LtDq6=ocaHZD+(yT@pJVIfZVx1DZmY}(k$wwIqGX_k zG~ve5wWtN3W(fyYk63_PahuRe2LnIk9=!r8)+H*UYkF`XxjQ}wK@*FBRWPQ$2m6PJ zAMzm&TiG<3m3nuw3IlG|U`N&=zNlz4haJB`2_BV1&!7p4#Qx&qV%#X*Q>Xf9Y*1nh z%f07|ePhh&!yNj=GP=ahM%gZzTc&<#cy$@9>CWEXlrQn^$t)oV4$DK380}XOe8~MV zKAmPRN@zJ5Eh-B4tu{^N3cY*$v7AO*=UF7lEk8!$Lak+X20{cGVJJJRbt-?@$6T-&v`2udg&N(j=8fPge2h;+`-Al)F{AOh0eAf3a|-Kccu(A^zF_y4lp z`#bxbT6v4exJ{H`WAdjnWkvLA@Uui~|aXV^@0J21ER zxwJgxRqey{bu^2DY8dbA4-xPedxqItv=&s@c_*ad7}r+9G^^BZcembKqyaedq+*S( zj><(@^G>#3UMP^P){~E`-Fj_xI?6DnuU?tB78X8g`xP|(bNPiLC*)fFXC zf@YYK{lQ~o;0U^Lie-BqHbcS>Y?{Obao-VS5zcy?G!tI%`SG^4#%omTI~0<7954gI zHm!T6t*95-af(Z!t*xyI(+0_Y4Q`mkZc!cLW=~2t)>LXaV~g66-iwH+j-?lxhMe%Q zfEy1FZEh%42WW1JY<6T7%Zk_u)+S!k>>+WpzE@*3=Suw9$I7g0vA3-*({?*s>drL# zF>Xe8lWCK@{`FLqMO+;^5WwneA2L@s9r9sgXe2mFfvxb}J7l_hMTSsw%=TntibHmmUFKVj2!T7J(G5G`6jCf8i2;r>6H9 z#UF?^kwT{_$}RSvWVFzNk?xOM06guE|d3p_Qn8lA*5 z-d*;efWO1LzTol-_kS6Te{P_^-{ZbP=prWV?0R0N;#L3ZqJr##xzmxn9%Vjn2V2DR zf1*9V3sw-M$zHMs1lHEzZgA*YJBtZ5p}~_oExSja70$XGXQ7kqWiTi+5A|-2C=}k* zMzF}myuZhKRMLgIil`vBlfpS1x3QnjXS6!}moT6r1Q0 zz23gH+uM2GbLstMN(J67<=hM(&9^tBSMHDd+0wFkK15-+G58jiwXB((CzVhJu=+We zjx`{~z)y1kF};xp3P0K|^SvZ3&*xd+idg{8`e1scf)7CAn+8>8R`mWF;uQMO4&I8w zA)DPD0|7Y1;7~a)X6=R#fGT75$8su&R?FTjFT^=0Rw+LkkXdp1j1JFL%So%FfCDg@wOwBI2{lG%daD>G?f>M%CTEIXQl5kgKEucTTj)y za*2w(mz#Fjg}m=m%eVL_XO=IQPR?|dPzojG4l&O*%_- zR=~Y6!f)v*S1+=rU6o?oW4XzHQBf1Zx8@681)kUD5x!1nNw%KEuSp` zGCt+fE*0LBk$vj^b$~%p%AB#bwpL+#%)(@Izj^4?LOoCT0u^_(E(DfBcp&f)A#s?1 zJ(ppzQbSdn!&3A`OH!Kwav|ztkN@e?|2~y}=Ex7o|B$czL-PqE5+bhG!2#`Xp^G)|6ivJJ$7osdpo=Azuv=-3FQk zAe!~)xZjsnLM_xGC_(;~mU|TjN7M$T5H9Mmbl0<;oaK(N;q-@(quVy#J$ylpWg=<} z+Z;@PcT9s8!}RbWM0sCev_>9>s={!z*<$)sLZ9D#i<0SD=RwRdeOJa-`HJSSI)*gA z%ZUQ{_SsRhp5$c9Xkg(7K(a&Dao(2Y20lVASr3rO4F|4zT3^jcyoo{MxM&eyX(zBa zo`_Q+E0ihP;i=^a$|En^n=B9VxLGx#*Q|RTqR(2Z9`>Tbw!@*viFJte_017ox7|gp zJPU1)3Tf(a#YP8d-nh4W-qWB)&+8^1hogoM|Hsbs66*GL_fwAQVoosMJ762cMBKwg zATMcaZH<(rV}aA|y`6husnk2UDl_S^IAKIMmZz%O;J;Z~dgwO0yt!2=7dn#E`c9Q{ zvH%@=xf(R+vT~r~Fh2baK^=)M9fUYMG4afywtim17|*dzM<-pWUPcq2+*M7t2A@Tz zObf3oWZJ$vM#of|nO7RL*@>00n1AkKd447!NbuxYy!>sr*ii1eY6)c5Ld7-q>`J3q&> zd<|w=O7S5pBT7gv#LLNV`rg-BCw91DsYOj-RH@`w?GHu}K1K}pJRz(InO$qAp;Te2 zFz5k~=H9(4pyMrlzHd+8Z-qZ0sXN6)=XGN;FC)Xc?@-YUi+`l3>v$G@A#rtp#Fb_C zWBiGci1@W69o^*2-RW*Ln!bi2$^dqLaZVRpe3`0<~;)7 z!n}mVzOQL%Z;XW@dH>Up{QZ7r5pmdwtT-q^#wI5fM#M9}XjkeEd@Ms+h*32&({i{r zPhDxYnffA@p^wNxw`Z(C?U|8V3&)&Jp_+Q~v)Wu$9rG;s1$Bj1y+;TjBADyb))U7v zv?>{w2Y7HWT5zzx(mDx`Lx$OvZ%F<&MBr0UFZz>pWZ+o=ZqrHHe6?#DR@wyx=6z6Yn z|Ly;NebxlpHO%6Jc1917PbGKJLxk_+9NHzsicXi?8Iv9vX;n*}iMapx$Y!;p-41+1LpQ0sJ9{=SC5U~pC|UGDA|pml&=|!3e)edUucLr zEw!02#pqK6GsmuG>hq~QRNGpf4IUa>?b%%8k(Ryt>le~3Y5ybzwrDgB^Din_sj^Ai zUikQ!Q62X2@-|=0kV4cxh-1cxNt*Hb?1bCv7)cD+xFvhNuM({fIB9lm!o*4CnRF7H zXe~N(%b^0!((-0^OpjeKld29?qFy{J=I<`-?=yufjPTX(xXk4UVh=e@M!!gWkDEp65XogJ+p1I#C^Ub-z@<=XF3mLw6QG)cvIZRF zOP=RlPB=unC?<4ou7Ud$rk;s4XZnI4U=b0$rCQ6Zv~0EI@`O81%0W-BSk%0!=Dkv)+QBahI;)I4LW&~xTc7|MbE?U!v?5%79_ zce#2y`d15m!%+c2StTpi@<<@%=n2nb@mM3uyG>UFf~T7)mIIz z3LAhD;vVenuQbg|3cKX?U36E!G5YV1eXSJPiML%)Xg)4zx%_F-qRJQef~I+nn}qXW zF5+yBbx4s$gXrR7x;bCWFmD_|=;FN(O#6U|Sqefc;x2tjLqh{UJ$;!voDH#QgX0q7 z_odQC>C>MX+pBZUO&fr{ClXDu=qz4VY;R7jM+(5L$Ykd?XPG8N37}B}KZR z0s$?hj2iZ20sCO#cUEdHFCYE_keU%!eB(+=)N^EwX+aQhvb~aQld>56XD_Qp@`_~& zd0OJ$tzjvws{3I0sT=;ver4Ov{}BX6{2{0kXSAIY9jUkuCTEB+E7es>WKtbS<$o9f z)Y|{VPf*DoIAguvgV_wkx>nC@Mu~m|RXZoSHeM8eo~1vUBdfsw9u!RVd-wA9;aK5# z(DKlspRm7xK$oISqNQwALjKbM$143q9c%xu&4Ehzz9}w=Zoa^y0XE6&? zDQJ9p{*i9Q)cO~NKi9=;hWz72ON=_sM~&aFQzzqt7H_-$oNw7HN|5}hXC7-d9{n%5 zmB)2)iHM>m#fN?!MY2@nPJZ>hSqbA9qcNEr*ZLYP2ZePT$8lD5Y3Gv>m0r&WWEE>8 zNUat3OY*4$Th6m&Z(>$&`L`?N8}r$v#u8sOst;qOZ(w27T1;42SZDV6*wg!+;7I(S z)~KgZ-Ey6=F!9vN*?|e&>mtXBJI>UWD2Y+yF&ZZ2@9*WWT;7W}`ZI0bTI*zVdGt4C zj>%#P^>-uRY z;c}fQo!VsoW(jDK5rIGAZRfYL6sfgNu@C)d~hP0)z3-o(+3o4e! zfK~7GZDqS(!G(UZ1(7|f>%HJY-MHT_4^sT+5Pwruh=Po&dQ4^omNkfe)k!_3OWrd} zAx1IM0P)Wh>kmX!j0ehLY;@$%DE4(}(x3%;gaUK1pkfVIwA{|-*kx*$ep&?n|!8_7f}%8vG})`dVcP|9Y0HruGrJ`nr0?7|{s zE5n{{o&>Bh``h?tpxPs|w=fs>uhbfgBDxQQ5P$y&|LX?7BlarfbD;71Is_J6Ej;-% zT}oTPk>j#GBAH$JNp{0AJ#!7%`7pG~|N78BLd$>sP&DOpUzBZ+N8eb1TT!91VwTFR z7%5Y7_=7)hidG8o9GrTa%(rUgby5|1#PS}B7+I*0O%Jmg{G5L^PR7E*0;k`U2AE4S z^Ey8St_+-PD{oGeX4=8etph_sDz$k3vZMbxjsNovSt?4_-6w%m0>8~)$GA*J$nro! zPx?wGm4#K!Y%E{2(e;c~* znmJGI5tSsSMIadmHtD~A!Q(%BFk3mjO6_3yZue_VCMiEgC^DVdsnc=XpuqXwZ)+y= zD8em(((>h(*xOs8WIpSkMV<6L=;$apA?95?dRw?W?w7a#?*GM2B2LCrY;)AbIfl|| zUtzPNQw#JQ{|o8Ph#x&TFTT-hkmx^Mj8NJiID=qWxX=rfU;F6*XYlN#cb9U&7o4gf zU~ZlyC5{q+UaVB09Th2sU))bT&A|?-@q65O-Q81h945HAu=vhyqf=+9(;`? z*0!%#?s=8F$1&RLqac<%aiORu(-{x`eAfT;l>dA$^p-mON4c?a0n)`108avYHrxbZ zt14x!arSoJ$1PxJOReBp$g>kZi|M);^z!WmGy;~A7>1^v<13e2(K&6jIJ zxW`y6=Ne2#=yw%q@C|aMk|hA`HieLk%*+qn*EeQ^{#XO@(Cd(lkh2ayYXgN8K=T0tAiWn9`hr)2R4OrAhjf~? z%+`|kj@PO=IeBrA00{5$u*0Y0R2};W(m9v~LUr|YApk@@O2f(dRk-CREj?T0EHX`G zZZ1I##qgPBjH037_edm(Z79VD)=SA^|WsW=}J2RGEwUDsEo!kDTWqlH0si^8)|51jH+3dpsm)_IO*ZR|7Bc$`=(anJ0oJw*h5?U zF|9_|k!vKu!9%@{JbO8Y9*xz>XC~93np+JH(w=ny(_?ngEB)@Pi=il4bg(2|I!r6^ zYL*Z63914p;@WL4Lg2K$%QRv4T9xGS4RFc=$sb&KK7r5Jm!#o6I4YMF$go=P&5%yI zT^2;l0I&w+kJYS#QZ_0e=hdy+w z$t&LOauYJnbkZgnEf-rO=ES7nczlj>xw)PSk$~mLa(4c5u>bBW5X5dj-W@aIF2{EU zd*tSP&Us+E{VtVI3f{FHJ%6-*;=xJ^giog^D*zJK6B`c&1WnUcdv3E>jASyqNM*7d zJDR&vtBr@RaEzy-Wla__(2NO!QXm$LFXly;M+q2X%Fy4^kVpve;a(jXCB-exoYb`D~qIZeHF89;c6j9bWdCd;G40k}Qn{Q_&x*k&o5~GOzaP!^kI0 z9j2=+l&Uni9sFJ;z7Km2ooYC}G<*HIO$~B)GTvqvp~+BfHlLDHMx_65BAdU1%P+#8 z-Nn|vPHiom@*J`s3Erv6(8#7{H(p^37EIda@ww^&jL7v4ukWr%H(I+!DolF7E}l!2 z@PmUvSnP5yOLK-j(QW2~htglgZK993ZJQM>02zYOi}|~PENpYymF4AksUDoZRp!%0 z?OHV(G+Q>>$~{gtO)k4UE=Psd6$wvMPf7XoAtTSNtgJ5WyR1xS0-^-u#2g(*rnKB| z>=UoMa_b;4*2Y@)dJO(g$vpNu{VdGid|LuNZ?hpIMuX`TVw;&^G*HVHZob8`RnL(G zTY`<$80f~TvKA;EEgL?$NTJkh!frThC3z=j0WMaRd|RkKLSWutf4xG-ImYw-k&4w8 z)dDgQ3Vr}K!}dqnCb~F%hC%;MWCnBcz`#Gul0;VARt`H%fRaQN$RuTajVRNRk`!3)f|YqSgs%^vbqyit_ylZYPlRzsWn@YIJ?GWpzPm-eJR!~@BJ%2|EKf# z=X;?SID;Aat!pC}d|F>pWR?P$FWez)xOJZv`C|0EQ~Vx1$pUcrp@(PlV$z9-g9FXi z-7lUuPB_ti?T%)We0niy_cZkAvQ;l^OJ|go@pUvXU;iE`kz{Lo+=~0IMA<%HZez`a z05d%K0zd(;159;kaENV+_bl(S+x7C#cYHJ>(2+Jyfs8yO$ro6O>a>|ji+Uwn+pr&qTbF;I10@6w0 z*}Q10Q+e~jbT%i1CvcDx~CY6f1+Pb06A-y~UsE~(ij#FKy$bs8RX-8L5 z+Zb^AvZu#XHn&WN!*Q^&L)uK%1TPOLs&d@@^m1aebH6@Gmmg?O69I3^b=OmJSd1y1 z+z5JY0DTnbOnMb+7 z8xE5hAId#w4cTe2ym#B;QGS?8Nhr}BXQlb%m$`+cBR@mOj(lvv{}4X`zd{9WN?t>~ zyo6@%SsTU5Z1P@4sQDoK*)+g{eee==+gmue00K{dzPI&l<8d4t-~3^Xxl;%6vGWT&e_TQ2t8Yz^j!kc+>j| zk6J$YAZ&ZQSbq8IQ{&bHBl`$!T_^}5k}H#}U?828;G-e=Q2+k^@x0thjisd|^v@7d zMvL$M*n;J$_u03_jgo-+y@71PgUXZ4wi) zjX&aX+DLPG#EcIWJ9n;eGR5ubbe``6eKELl*oDp9mnbbJYQ$G(XJ%lf&OvLG;1V8- zsS5Fc5;&jc3|5@Mwla!|GEnuc+b)t(%6u;k1GpYI%o9w?6lSaJ87$U3BAW~yYb;a| zEli3OeXsS_jyLVDCs^H0xlgxX>Z^X}&Vf%06vlK+!rxP8)}|U#&|^iBOo|aIPB7u? zI1XR!mwSPTVMUrr5;64IQ_@Cykk(d_OWido&O{f#6C~xJq1e}$I%*;sSoQYUL5u$W z$W{8YZvpi_a=^TE44vE~7`Sc-@M_^;Z7S|0bmuEY-7t^K!^g+tWrER8^lQfeM`!Ni z3991U+*|`zg|VvS&Ax=ZJla(oWvN}NJ(Krz)SR*N$lMS{(RzUcq5QR{L>w7bhJ6`l z=WDdWJJaUe^yJ&bq1BfMEe|2=%?~I&*%wIs~u<@F`Bco@BDF_8C*Y>wM|Hd5^W9IMM<(W<~r zvC$kOuiuR2M@4x=%POS{OYDHK&P2YuIemX8(TbCqDRkOE%POy2q*f@rT>C6I5YQ9v zAB!1>)zqIquc+zf$cc|P2AYVH=v@w1<6ws^7}Rt_@FJOHM*KoE)idXuoIK|f1u#gecSd-Lpa^p1%AwyHKs&UUAB^LZVc{Ft?ygn{Txp<|KaD?{oYAT*V;Nb!D2r9$DjlR97$qTyx2uU`7Xz@>qTCuoXw3QxT0SyyXh3ZPlhkjLcxM*N! z@a;e#UPVkHn5qb>QuBh}#ivNCRv3_7lAmquD`^dg8LhSwv>ycqZ<0xu=UfzF4nX+~ zubm}12Mlt#K3;RMBLzP+T3VSH%Dirvqbxbqd-`tp;cT7iPs+XNINk3t0XjoK=A0Ie zU9wNZMZkrViYX?LVlXj0>MOk!#mF8&>Z}(jH0pVMnpD;pQVSQPex+-~9lIfjo_?`xT30(Uuty z;QE4)_-N3RuOFC^q)ijoL*LO10LDeSE&Ymzy)gtnNFyM8nBmfBvP&p*lcYU+U^I}D zZri~5e*~)6FT+JMY5WLWFON;88eIv1M(aq!-s?y$k5vx1ZgJr1#2fM9C2bFIhmgnK zO;>IzWPJ_LDwJ+ol{%@moF&K7BVf7py*%BP^?t-J9zw{e6dMmHWq`r?%}lBp!Rezy zYouo51=)^sH>o_lpFRqTPc+!?(5v_;i}TzML}8_nH+;6?dq=p14kk_PH7c8&VFKKU~o9Qnc=09PYh4sv@>O`X zOO}9!~i;( zvVh_@#HB~*|H#R3#SwJf>z4ML>0Z9nY9qpn02QbJl-+FZuS_zgj;tg-vJ=>I6wS?_ z@E-_qt+Kqvi02dTSK+tW&_#(c@O{TkK$Zbb6Elyr)$qLdAp!l1b)-dZY?5~As@$%kux;>JkHG<|Iknc zm{r3qVSpBywRCP@Jfxe_C#^B->J3|U=2Zz-*zUEwJoQ6X_fhxuU=J_+o0{;9%nXRj z$(CC(w((?{pvgg$w^G!H(+xWD1~6b@Tb49&0Ej4U1M3s~lrD9eWkE&W*4lcp+W19= zp_?8-_4oAj>W!7dWxF7x&JRr{0bPwyNmd@09sfG<0E|oPWtu!L{k8stY@ZL%2PAwE z)`XqvynB{zM*gwoAIlt-kbx$(@UBX0Fl=UL9Np|Mu z8u>bWd^4(}KueRAhK5_d3+{b_EaZUv+UmK8tAoWrKW4&S5~;1BOT@A{*Xtq8Xz@dzl!@8`9>Xmux!yZxUeUR4U6$BE z>ekKSVC+L!${$H!*XZANn*0k)z$HPrN3NDy1MIjc2b$Pjw3yz%tBn9KGFv?rzxLjN z+7pDfcLuNOW$rszYHU$fY6tV>Qw>ND;Stpq-3R$J*gk)A0T7W=HA+O%)IUG?=nqF=@RL&HX!Lz6o zf7SDZ-XluDjx)MRdgN=V1yGr?~zR96k&}pmT7^atYyhA%%G?_o-F#aQ$ z_XolzW~XC1M{;F4>R-VsG5La4cMPGRVibK9T~fEUM*w_}GBwbmM`6|vI-JgJv~iiD zjvkUU`<}yeG)t$wQ&J^=%mCZu_peVKm;hT)hlZ*7pNMiG zwO1raQf^TFXsO-Vf`zwUR-9=R^QqY*o*Mlnjiql(b=!=4CrV$Rwh_=VG6v({ zoM-0a4?F=xk>#wvJMPVxY}%ahpAB9kp^aXwgb8LmA2Cwdg42&wsIp(`O{T8wtVrE6 zc%bYzNTPACIRm8R+_%mMu)MugWy!7~=bc@KMihXK^R4^UN#;Gmvq}%@?CT3D(rT0d zI$kqLo9H`&JeVf^Ofi>mwH$_VXzRusz~=CAiP--7V*;N!Uw>Je{;{i$$$8a z{q#U8^|-H?)Oe%#Q$aJyq3x}S6dc4WvWGe-cGm7C%>4(?zAwc9&BG!SgaW!E`2qlo zerB9Xa7aKvx(%@>U$bHYn?ZD^sfJjs&1!J2FPoK>wuwb+5R((Z-6aFCex3Q^g=&>~ z?pLR;k2iBS4?A9DTBuj6!3aj926Cj*f%F}^`qTq1j;dp}nUzI}-yfx7Ocg_LNcsyT z|80Upc7}4WZ1}gIr~QW5s#!u2TL5ub7a3idR9lg6X9C4!A_4IL5aKbbaqLf)(>#6l zW-$K=&4ri{qjGcdRbfmgeQbmLkbJCYZGHX7%>J5MtE8mpgTB!sML&c@P7rBnSuF1J z=i=`kVdPAf8$mL^{e3w834;9nensGcO2wLhUhl7`9gcQ?e%RXd?LX~I5FM^8?MW4B z-GCNKr`HG-Czk}DX?3|j4H6zPxWjuMe7mnI+OXFJdd z3}jO^3>>_m39?v1ACET|rPR|b)h#-{BJ~VM_Gy2;*T-dYdwr4LIm8j{a_bx!mX-eQ ztBTJU@JxqtQ{8jA@0Lyi1}_oOM)zgn)4GL)zd$s&wPVHwTd8aZ_GV*Z48f<_9TA!S zpLqIGID*!CQwn8G9tSnFq>{)8-oe>X(6AJ4RI(a8Zg||A4<1uBNh||(5cv!ED$@<+ z(PVDw@aTY`vcb=dpyDR-Qo|}~+vc0tx#xmfctmGR;7YdKtj2I$C9zFGl zY~~-+HVvR+7|SRBU>2KCarf-5pO?Nq$oKMW&QrU#qRIJ)`sQ}pDt~4OSWWf!<04wv z=WbI2RK@*-0@Ennq7d@3n@qYO__6-%nJ0Dy82ITns*1Qg6o+QhtHZ`Do- zxVgCvoSuq&>wChmtkL=J+&Hc@!Y2}q*ToDDe-5RHrU(HZ5q(!asGu4r3bNHWHs)bT z6(kQK9Q%?>;Vp3u3b3bNn)&WWn)8;JK`|F*{vZL2{nGBonP3*SYIY<0q;eijYWj%-{bLh*=OIFqWW5ag|9XI&mD(@E&D<;y&qJw`*B&^aD%PWX&R zC%bn&v)>whS?Ur^35Muyny>`8Y9%Ko_=4S;J2J(>hTYHRB+uq-F-UZS-iwp_3tV?n z1OmJTkDzQ=B#+UZ{ELkq8hGU+4be z`?ud8c59ZEXA5w#hZbdOH{b5W)@7*$*4SD0kH1N?)&oYlB|y~UWu%^uNopTe z=~}!mu(7>+_V4Q5X&*5^Z!dhYCMiMv)sG>C9sUg3ZnymL+3xv)f8g|#o4F<`|8vL; zQqTcCIaE7nlpK2OXkGrI!$hL|u-BMB)D&R(uu+fEfQt_DP@F5K4j-5aydz3nfcz(y$*@S9%?b0W z#dCE;C#;a=r6s$#Ct(Q}=+7TZ?k9ez|LAa5FrvQP4mq(jz*5mdKsK!IIgM07x@(>9 zD98!e!JnjU?RgVg^iG{lGPT;dajNjJrg|>J{kqJDGQhb3p6W?l_bA`{LhOA(utmh< zf0G%|CL#jue0|%2n)l(qPy`L8BZHSjv~1~nrs=%sz#lFK+fOCV7hd_M_$!SSZUz(} z0I7gmjw(PX9-HE(iy36nuM{EL1+aDx19aKqtyRypdzDH*>^`Oc`Ar6UU!Dfb)6&OB zPSrt-u}Jr!_ZK@n5^lHF$hcm4d|$iBLw%X#(w)P@rbtZTvI=>yMLo8$M@v*6Q)A0V}D>$$Z7!-W|y^?)I@59?)5Fkwz0Wbz*^+ zeJybt97I#v`IZS#tb_;{PNW+D$)Sf>-n!w zkB27+m{>43-mdcAx4XM1ZtC$?%~j#4k!bqKmk8?C#A2&EPmMxiEA>|i^;^5y-mv|< zU|cj72*$}>O-fnsj|=S-;!hbdHI%~sBAL;x%F7B{xO`pHIzD$jPp(-PyPWp`kpp(zTN33d$G+uLVyT1*YLhY;CU@&v{h z_kar-4X%2@ZFS$XRajSFsB}o-{TPJ7j+hQA*byzM$$hZ^kSl)04Skkl|^^}#` zT{#E~6e5m%5&A*7u($UXj~=|Xjy$*0MyjkluAm3Y%wRD@O9# zjiM^g0_&>lB@h?dB2#|-)%ew^j-XsUpA~2!ospfQ8dTWf!6V!BKtPF^tj)c^Qjc$r z5Bu#Q7Nn3k#Dcgh=(A$BM0+WnXeZ91?C=dE*yOB~gvX9-06QiB`kA`)-c0Gc)m1;0 zqkzx!2oWlSa~ge0AFQR1g02SCRr2-oZCNQT*9xHk)vxlPhH=vo3m!Tf%ERik8!5EySw=)d3}TnPl_Djzuj)QB`f!hoIxO-wBWY=I3- zlD}Q=>Z*Y@V}r8ORgSrN%Y!sSVRXW2Dq<4YaSiI#=IK|eqvg`rW=cV+*z*cLY~nzX zp(cA1kdoT~ynQ#S!WM&a5r7|fNG44XmTNU$X0=IL!{~)mk)6r019{a2o8cAydOF?D zZf`mAkUEU}fU`pw99wZi>heLF4qOXFeaz62kpLW;vPKrHGEt4AgN16(Nvb0_9)mHg z`7WP>V@)NmkGs84X1;_fN1k|e_0DzQeYn)#Rq#9w7`VA{1JHBSr%yqpAa$fi!%FzJ zqWbt;wZ%=RiFMQ{D2Jn2@_Lejt_kOF9JDoul}4(qNJB~LQolZVuB)scb74mag!HeC zPR)T9m`dg{Vs_h`3QUvDZ!+%@&1OBuxaJ3og9wfUkG+}ri!|#k<1(|~q8kuv`qd1K zHQO%Fc_hvMah4Gu|BUc-=TlJU-p-P6LhU2&3Zy5$TIPZIozTzz1x1!?cP4ap(2g%? zXb-RsgK87`PK3;v7?q!H_c9@nmx0fUrPFoNudQNhW)dGQ12x1f(a*ERUF=*ZGa;!= zUHh4o{)HwF>TP>oR?O9ozu>)hpkBh#3l6$$B#E|P5$4UmTa6ldFeq2eq%FA9Wq=ID z&H*jUU5A8|KE@!)kJFFlSyY719BP$oRq%A|c7j;cIJmo(mR7<9469YUD90j>)&>+U zt)?r@WZ|qihs$$0K*e!ZDgCqzinfbme8O_|Lo688dV3WOS+sQ`T%RR_=k-8)X|7#(8SDoW$dS^-(2AJI=(|(drf~_|arw49NN^H-FXiD9qf`*7-jTMara50& z-ObZhIHauY0bz7AAmleBR8)8!6frDT$ZYer$s6SQE)vpe;-BHB4??e9K@zawSnF@r}H@(pw(E zIS;dMb+^OX+RZ21;}OXFk(BQXRCFZN`ZE@+BxCcc=|B(eFqIqIYntkSv^jTr`o*qh zlvUHMn){tk2xX%-H^91owh{Fj(QLZ3+;tDYKpfW-a#M5Kny+=O%Nfn^QE-e2iAF8D99l<6a2%$dU|MyBacKyNAK z@ammz7d^R|g1JJ<-t3${APp@+fvz(Sg@ZNJ#2F6(A;@=F#JL=7-q*Y%BNXwc~iFl|R>g&dzkvumHZ}=FLk>-I@9vYIF@2O+2cQ9XrL`lLxWW6<>Q}uGI#V!rJCF}3??`0 zOx$z{mM;Rx0=g1O9Di_!h^dPjzAkG0QUf$Kz3)?MM7Db#V2A!xe*{3VjG^G9y-9(- zy(W=Pd>xQLg0yY`BdaXC1o;~tm*kxgsxJ`!9wk=`1HlN!2Hr&CMvu@?n%$ohzAms|^MF~KXH4hzt($yaOk zGu57{$EIraT~8QPE423HD8^UYu67O`zi|A4qc&+%d#G7FGzY`6Q8GSZR`yGr=Za{M zxGJY_({eA`$(&`Fj`@E!ef-dOH78UDaagPM#5K35lWx-Z5o8+JcpHcS>CAO8V< z6@ZBF9$`#2BZT8`G)m|tIi@Rn3VJV(^y6m!ciE;+kz%TjHrBQ|HR^}B9?XGD6jIFg zXhX3jN`L0r|4Q(@ULz~z*<;kYIE`FTH0KVH+grnTDW|Td%kwkd))RD&n;Rt7QAyZD zepczK+T-xnB`+T8Uo8$-sYJc|+`nwx0gtn_p$B+aM8AG^Vy$zZ#!bxWG)E6vGyD)&EFOjjxvU51kK_Lp|Y%BvXXSr`869=;;Bx^Ns*s$X_J zMnNnS`Z$Oq8;*9@96-VBT>gr$?q8)cAoHY3 z3yTYQic_>CBdYt=*02^!$j9R#6Tv|I&%jkbKA>8UiA&IqXErZsxi@Fmmm`BgiDAkx zRu|U|dYX}^zP_<^*i0v|7F(1PJSJa0xs2<4^xA|$b#o$Z7tK8Ts<@|-c84J?5t$23dT-o*$xj1aw7uCX$Vgu067&o0r`*_d+pY6$|3!q5w{CI@$VJ}XKT`aw{Y&#AkpmYvd7H!+Oz{J$2T)&~&|GCnyu$qbC4mzPVbQfg`bYGdz2 zLFto-h$vUcV{d#j1+&{+5(OGHiK(b_LNh_g&U#({%1n{IeXlCa@e@RHOHg_7U)@Q# z&k#Yr9yhyqbR#`c; zqhzc~f|efBeQEm`r@N<=xtVEaz8z<0bH)eyf1JGqP#xX2Eu0Vn8w;D@Zb=C4?oROF z?rs}*4I12Cg1fsr!3pl}?ryKYd*q#S<<nt1?-2fATrUr*8EFoE#+-l^q4eyJF08p0TSQ~t=8hEVTiv^-*?s!yfgblw)0Rh0|% zud8PO4REHY)$8!CkDiI93)N+MBjV210cE8u-h>zFkAfwp)jLzgPJ{9r2|yaw()#blGI&2akBi)m5QL8sYQ2 z8M5t0mwtKrti(B(a!qNO*O0i$rwVbz1iuhQBAd@oV?=Pqel-$Z9BW#j7*tM->GbEu zP=9K{yxu+dpw^QnZ2SmQo1-nYcaLA(9wTHsn5u;Ab1ylivV4RAhH5r-+H+C8e#rXc z-dcbRmEm8^lPx@-kDtY5fd)}}&nj*-2buHcf%k^LW3T5m#dv@|;i`i0Berq+Bi{pC_4nc6Nrh z8Ws_O4DkAs0k1TP%bk&YfR}94kcX%3_wL=z;c5a@GE?S23~%nS;IB;3 zsh9e>BvmtInt}e4ngC}^!lZACyyk87S*-e1aG zZP2VDSg}PL8ZXYDEw)2>E=yGtTro6PKVTdTdepCM0mwShAU{23wZVEH4$KgZZwYfF z<>a63UI;OyLaJqt%7YEsB11TV{_OkjnY*f7wRJ{uwl>8nU}M)i8om5av~@FavEv*H zq_Cd-wGCZewV!P4+z$_U>OQfI5TCgBUff;$j1xDAW7$w+tKOeDN2jX7*iEcIR#3J{ zq8i>(oBLvez4X-fvn8)~$J}HQY8ME7^Pjzy0}$KK%UG;b|BMFXDS$VePgYG`r#s$CxG`&4ZiwEd_LxmsQ zM1`ULB9QM26gMDXNX!5&^RG4zfF$=P$kf~ym+qZ4pLaC}t8rID5eS8eAqcfr=1rz^ zbq-rkzR0{e2njUfl;v&FMU6{qxKrh05DB%-f|Jwo!R4hYFH}0|3aG2B4&MCy}j7r3Gj?BN;4?yg+JwU&A1Y@Smvz>{3LvYe_eV(vHQc zni}N9EE+$39B~s7DD93EP2JA-7@9|fmQbUV$ZWn-RjT1jjnbT;VdCpebJ0);shW#t zGO7=V2Q$}SCt5-lwX9kR^_1qTWoE9l4+e#7Fy_~(ak&!NB|r;N6YBML z#E>RsNYfS${PB)psdQv`^u-ZkSHIeFyHs4RJ^AdX*5&teIJKHkx%Fx?{+7Ab`Q}$D zSB+Y$0wJ0ol61CiMz`NygkN<2ApSPWLUCPy%piIZl4E`qcA^`v| zbS{05<67knNy7Q4#~AO|RVD~3;g&(K@&UKo&E4`wn}^%A#0AnoJafvbL+X0~_@j=f zu{2k5*k4e5xY;jW)$DE?u64Q7b!itxb^&TOgPybXlcIMp?xco;@lglUMFS_A%}a+6 zhrZdDEVEhl*7khqxDZU5f#}|ltfJ9lz>BC-?3ZqKA7EYhJ;P1t1<>olU9;n4{ijRf z-w!&Th1LfBQNN5C2mea7ikQWFpR#wE0!Ba1Yy7@Nv7q+Bv|znBVXR@6-8hnxNjO>K z3mN$gDeI9Ty7+T#i1BU8pB_*(0dj$`ScA`EVs18x&4=MC%c5 z%MnPX!y0y$Orvf}Dx%lSi=oK-M5EurFTw08V5% zCQRa4j>~ZE{NaDG2x%Adfub2}2ly6ZK=?H{UT^?RQ-wD{*DG$^fIPbEM1u|K0AMA3 zwA?Jys{0z*8={%9JFDe3?bm?>0)d?iNTARB;9{8U%MKfvW}NoU3g$7eu)ZF$T0|1U zB1bVAcb&`vwoXx2%jr}7ar*|(4-OY2tgA`ZRo33X;}Q*+C~AfiaO3#&1rpxGS`<-I zX*Nj$gK?Cg&Bx2J&8@5b$sgcWet!Nct7q5yjmwq12%uI~q#ZP3FrTpi<{s+|Mv@hQ zSWct=`-N(Z=ds52tIoq~H?pr`FT8S-0LVF_VAc}2g6*ZoOEu3VM4T&Mjn;z)b=f>g z)5&r`_0P0s)ZK{3$=V9N>M^OJ6#(Ajw7s6CfXIiF378NxSnHZD&P>1TPZ}EljeNkv zSk@_4#<_s!ya!dTOhXm0fAlZWYVE@#P3&MW9{r@LxY*(7=l^oM%5K!Ui`&8pi+HED z=F_bITl(6H;48plVeTb46l`;M*)FYLi3O}2&Cn*`^4xu4u5+bQW&##>M$~hZ%aIX( zAI(?8`59jwNASL&X=u}>CP=4oh?lA{e>NP9HS(Cq`8LAhwX)*!NIek48gX^{8m2{9 zCI-gmPQY1j|PSUCpMuM7FT% zp6+NFztK90ard2EmAz>ahf9@4I|0cf@==UNr^~016*Oc*4m4__k*mC5Ty83d1ENBe z${&x&e$|=4*|TG2r;2Jz#4v+2&ppV#p&g)$rxGW1xs zI}_^#p-(x?99|j{b`GT&j>f7kvXdsz1coVHQ3XEpKk>M1G-$Npol97eTz?YrlE#}o z<5kx1Qs7!#V}Og~6M~9)d5~8souW0n)5JIPhewaEGCbE;|MboKRhvPe*zRwp#s6Y7 zT9}}>~hBj(f;?s(Mi(gF5hgsJzIP)~!_*JwPGGfGDUy_U+ zt5)4KSGhfxM~e&I8M*(8=ES23@5EGwcK$|{$#{ax*P08mHV|Zd9a*3wPlS&Gp;p?x16(aYAV0e}4& z6fli%aDW11r?7hUGu7BkeqkI*Vhjvco*pq@ZS$z|dVNbO=J|4OEP~bBl+0`{cDzu# zwH~-Q2;l3v_WN=N3bH+0uFHUPFbWqiAw)Zp%>4=IM#cjhP3V1{8i!Xu7p+%~hg)Hh zR!u4M=U=ra%T3reH1c_&eT?+AJe*#)UZkQm5Mg;H31lUiCSA*`m$sTM3Ui4`=BPUR+RpA?d%HOqfdo15NcHGty53<5(V#F@HItx`P(8iDV2qx*%%2GKa zp3e`-kv%}$Y<%}DA=hvSV+YUvWNA8R3~WEX3UF~JBQ}z6r&9P0L~3L~sqU((}uJ(_1f{#g1eflgFd_4_1SVQvy#sC?gPvD@v$0{xwSU*s7^SCRS?8MsmU zqaS9t{rb50oGuTsTqVb>7AmXMHFcJcLF^g33bZaqmEj`8{v97ERVpHrTv2yNU_8vH zi*mJmOONy#$b~ilzgW^G4w^_lNuVDC86e=M(9X<)-u*DMR6^MrfKb?O$neHq% z7+3z4CEz~P)aww5%%{c*)lt80J3F~H>;+oxG565E^2@cc}8*gu!Of^D`JuL`exlr%(aH>a#iv zWL|I3Vx>uV#p9J5HE?P11&7s?$_H?V|DEAZ@-@WqyHk94-`BFAL%MAT9{1Y`d62kb zCHie5qxRWN57jKI%b~c-fRU7KR(uyfjk1{sFGfBV%Xuoon}g5h4hEn>tNA+3HbOR8 zNJkmn0Ql#l$8)X4#EZ_O5fUx^OM>>Nz!ff2;O+h$wIiV+40mRr@49SO>iMHWm4WG{ z@X5h+kS|V_Rn%uOZ|Hyftet?pl}!zd>Q|>s3>;TfUv|R4=qp`9j8xr6XqUS($5G6$ zo+bARm&IRaW!^W_R2e^?e)0NR*G=>_ox4q{x6`2vU2BClo%<^Hn~pe;FF^rOYjWPu+vHEe$9z+2?|lK1qMhZ8|+|>SXF~&PN0uQQ2=26jZ zRmfl+5>||Kz-f^nl?`CrYB2AZ-qs%%we3S#gUtf6foyZvw zwB6`|D^-@d4B3g%>kYwOORZ z;woxyaey|vimV|~A>a>>6Xg(M_W5koU(8ZiDX62>)k9}+o#V!^tw%xo(4)5d`V$!2 zN9EeYKafI1UNZSCp;>1C+BbY0J&;4eIGlGC=wvMKXFfZeYp$>|{%7dOyNryXF9<&Vnh zHMrc7+A(T$A7J1YTQTD(f@PghELI+v5Dt+Vg0x?Tb6pNIs$s6XVoFprt<4rI%P@Q( zBu1_`HEiMW!eLb7hExv>qEm+5T861HZ|&!2M0wy?buPXr(P$TvDr-ecr*Rf9zOpCr zLejtGX#V2k$1e7I56_i)~UL2zhc?OS>i{W8_|M4$B$bZY*5nyP>&Ch~qjfi{PiQ zfb3Uv%e{2NJY}YIr0q@w>eCvbPnUm)ShFbMY?PL=;avssg-PJ==i+|3|7>Ooh6Qz8 z((878;&Eem%#Sz1ZNWMJfxmPU;iBt#zY5XOv*@j4-!C2Z7@ujDWWUFdS63FOFyIBJaWU#4GyWrM{cZ4iuuK4#(YNf99o4SKopSYuv zB#~)kKMF05d-UsgsnW*=ou1WWO3|jpxh9K>3#=opzF~3XorE#Mxchbo`t(L(*L31f z5LJeLO){H_*k~c`6~xCD$L&+GecyVRf^8c4PSxTR0D&>=%)ux{S^!hRK!a~ACSqYOzeG0NT?nE^b3 zOM`Q--*-`Qam|+6A$9nSuGOek8zsFE2{Bmw4#&4$>v+r9E`=Yl)(HQbl=4qF_GPuM zwMMoI;5^sCB`V4!afDE3c5TL33-Nm8mRhvi$H^9XHn9HzMZw{w2ITc46n>lmnI5UQ zpqROOLoP*TI9xOArZ+-IBnPVIvr;pA8Nh#GwAArB`*mG2U;WCAgJ_=^hqKd=9M5mo zTk!CPEqDV|OH_+*RuRK#p!0vAaNjZ(}O^kL+>2MzD~uH-)97rXbEs34v|RQLW3rk3!>wJ^X0?@O zpG6mHzK<*zWuq;V^S%j&vJ zcypf+fP>Fr5M+u;${$aqUX*QECB~0mx>1}_U_26(ubDw-^@wlp6_kPe*72@Cilb_m z-=#%g^!}HqjQSF&NKR=c6xr3|E1+F& zGrNljR0vbhT_GichV7oZzy4;)`F{&}K6esp!AsK>Nwk8M;GcTAi^?=2!-eo~t#4#T zo>$uCb*`JEMLUZVq+Lqj+V?28N~s+-`!uSp~6n zs9X-67juZyMTheISDlv~iz(NSLl47&Z~?Z1>K`$+tJ%P&zi<>t97^YIZvJjORg0GbG{>;Bmh3*@>Og?xkgj9DWFVQ9?{cIefpgYGo%)s{v}BW!p_NBuS~i zmm>ysgWE71yG8xpj9oZ?uo__x>VvP5CaANFr7hL<)dgf`8RQ>#xU@J4vA{a4&G|}V zwT2a)H%LcNF^zZZ@{gKuQkQ|pEYw+c&2}rTq-mAm<|@0AQdo+F7P!_2RWM;)lU=o5 z^hfS6Fiqi$fXD2vf!VAuOIlHs0P$a9R1yxUYCB5;f9m1^D`lk1r_ytwfSJka-9Qn% z`b7_^(z)O)1ugHLf<*_WMO}G58mBmp+NZyVpfse!p=I25jzLu^OQf~$}gX{J{)q{S@wr3 z%b)^BA(5XSKTGw$4Yh@X7uWY&IFaGC{K(jTwsa|Ca9!Iz#`~z@+O{e%Z1~@-T7u{f3U-3esdQ! zngXrbTspVg2pT~N$So9%3~9d)=v#OlF4@KXkH?E7xTI`Maf(^>$G<0z-q0H#-Uj&t z#FDE+exs#*W;a_-P)XWl;V|BK&!PEZRc5_DCdxubHI)XWUN9&851Vpihllu^3`!v@ zzxDe%)?xt2*imXVyRanTI{TB^-GYAE^dVDIce=>mMTO+(1OP{vv;ws#T}luq+)LXY zcD`TL(OS)1xzVwibP}=LoIE!I2teG=KGh~k)5gMArE)F(y2bhf=Ax8im4Iwi#Pq6k zqs4lHmT%FYq6XtMzaz3hR!G#Z-oN7=>Im3e&hl7nTb?!opcScA**YuD*%!Lg2;u2K zfLoPp6qz!E!5e4JlduS*B8ioE{v z_E)RC0VaBu5~C5dXjR@VQ6{Fcb_~3uCjMVfkKC?81@YqVzdLX9ygu1Y9Cjn;8WcwF z`2R>@v5d8nabQfZM4>nc4o~A4fK6s({;A&+RBszqiZB|tXu(qf@oLa}6ihgFY(C#x zuh8c`ST9_tHkSF8LGKIK99r?)nfQgBOV8`|nRO95A4mguKy1P@D6SEU<+mI-f4PAF z>!(K(+Uq>8g^JUt#9$VAKi#ev=P@(H-j@zq697LU`h=7OU2}rY*yt85y;q7kjo98-oT36| zpWR0#$nNc_E~vSG3|?jwg*2d0`9Roibj>G(uBBhb^{ zo1G#MpH6VGb7&zXl<*joN?ltBnl*piqK%#O!?CxpYU`9lQ`Y=jie}VIr4_vp(<>{u zakTO31i8)3O@A0a7Afb4Pfd^0crf*GTND8-VA-}GH5Mxx57$7d6pn`xM6=SP8Y_x- zcROW{Msf%^BQPahk>*+YeF+agUZ`F~8^gf4T$ve3??(U7WmSJjnnEz8a$U+4#VP=5 zzwX1WvbbkJm3Wr84wuR!6*U2#oi@0w{-nvY7<3X!m{>L>T_qYefl{`58y-*8j@6Js z#UgS4;Ii*OoeoUkG0BT`_szvF(8wh}`OeK5ONRH(j};t{a`B3k_c?UGDI;seeRkcQ*MWfq;#u`qucKD^% zGuL^;U&ZhnXd+L|W>+PDx@#81#_Pz29C0Wj@4!b^CSZ3JnP%~5Ywp*lkSfO!4%5Q@D-MSf6QO}wZMW{Ay06I1_T*GkCFWs=_$VYO@VCKvN0&wk z_N!-g4gr@A@!cNK#1S6YT-4m%2%HhdfKbH+;1-&=dv|6=Emu=vF<0?@#r@KfJa<$9 z?rN1{#Oc7ac(x=8@t_2#{^9IeRy`ln0OIH@nqZJ7B0;AOwTjLnuU?OYvsuz zZVDb9jZcyQ$48=5;Js9X0iCyQ8Y{}=vZqPnzE&$w^gRNGn7BvZyHm}e(|%E0%@hX1 z;KCms9R7!)g9|u*Mq3%Z2#pp|^>HFlP9c0Ht~DD($a{eZ@t-A>R0)%FaE5*h#<1zH zOoEd!Np%5s`I=KAPEeziJsNz8V_0&PhiKxEr!NeW0pMXWp>|pF0eIwYzTl>ku`QKB z`jM*fN|1LP_oXb-zKrxq;eM;KsaDDEqDCb4qbw%6-zD@)Oj!r4?Q&0^7IVfDJcbE# zMv{qKD|WO-(y5EdPaE5Z2T4?`wt$Bm+y@GEce(uL^W$F1<#9)KtgL?W+I%*JB@z{b zH5nK&O@=+AHBVQZQ)_j3)Ca>`OJea)Za&{SKo6+^IFGi$HV~5Aa*}5Qu=|+Z@UDXFdj=58}c@H?ca02^qJofFRT`juSX4~mFN|1K)?eV;R z7PSsRBPBrdxAGLC()`F$vFk`EH*Gfk{yRn;WR*hsI>g%Ii1EwswWEAS+Mw!Ez|-b1 zB7Q;yu^Tx7aINdlL&7y!Sd~9{*o7uBv_U@rCW3OK*fezA>0}X)0Dt+sOb-@zby@u*cET3r9{(wI)> z#o#`4Lx7=9hVydXC3ZavcF1HvShASIvlX-69e6%(6^RS!yO`Nj!Dm4S=tF7VNp9yl zo91}+dKV$1(L|b{rSD}L@1NhMo|mPwYX6SYgdNB%=e&9(6**lg##r8@Dq9t{@#4&D zM-4zEurJqJxA`m6MgM`c6P=JP9 zCYlz3m`pdPNs#HwCIJqClxQ%g&)Gv30qX-uW)1MZZM;R=t%5;1XinfZu4u1cab2vT z2f9b)vuB$TkEe#m^E?UP)}%iMIb=Ej?t~9-_G@CPwO6<#f8;A0WO@@lnw!{=Ujk zPP!GL?fyiax>|$7>F6tO7>;4r6A9Y+Mefir4>%h?+qCUyd65gvYANSuBev4_&dcC% z_%0qDU?QGge(c#J(?ur2)FdF3Lg$6sGI=de4FD)wiF4_;k5i1fuO>|a&AjQr^zK}V z*)j&BrLih`{d(9U?~uej5E-58mdxk|&+d6(O{44P#yUp$@tTkC1MG~0-4dYoBCM3L z)!+lI0ZsSIV9n{B`^Fgy)UdIxRS+X|s+Ly@Q;EbcPu=0tTjec$nL<**KqPED;|CmV z4mo+@89<#2I}>tSrnv(l7aBI3Hc!MOLshtIPKp0)hhe&s75B|a$A88jVFx$LVK*G# zsoMO(<8%EJr(67fH-LIE2%urCVJ{U9p^B{Gu^QFnjN@@ptJl((1Ex)M+n1PMzlL2k z55k8jRl07A4@5H;GffaqV%kF=uga69Fub%V7OHXo_!B$^C#0m(B~*#S)_W8KxrKSF zAv(fTB|cxZJ@VCM_xW~(O@QG2zo%lFP~bJIUat3iUW>NDu`e@?sM{7ivWqO~5#6Z* z#mfQY4`CHUFUiJ_>DO7VR(s?ft}_66x{7Db`Pb*A;LM2hXTQ;RW2^m$zMZ8B76#i5 zVbB{mJ}Q`M#6{At#>q7n&lLeHZhcEZH>ay)jP_~Qt{p*vFbC8=&Wk>o?27f4ixerW zjT+O>KA;4fIX^g560~*z9em<8EUK|w)k2k2jv<6WivFqg0U19^nb~fJDsS|zax=#y zDoezo=4ZwF`pLtDE4zTS1Ccxs{3OpituG&{jd`EioWPfqDLyb-Av7)D)KW|_7D0ai-Oy3 z*kpC)Es-E5^92QX(}oRjD?N>Nr3TOUdXIeN^1?0W=A2CQR8oa>j~msnj8)OWLL#7G z`e26#Aa7B#S{@_cL#qFZK-RA)bCvqdPaH4Cc56wBL2l>U%AcK1bQnAOaFL#*1U)Y_ z)L>Tf@6_v!t|{!aYq#kuK0{WXzNmE(AiYCA6+i@4!RR9TIzmOm?0uD4)!n`{Ve+fu z;QN~CI%Bm|Ax%nOQY)2+higJ=UU$^j447~t{qX1nOV>uW&6KKBa$eu*fJ9Tj*(JSl zy5$9&G*Tcr{6Q7*CSa>r4H~-JXt(WUaLR$7IT$^PId^z(-(8Om64D9vKU!@`kT-xMb+t|H2;=ZbiUu+N2ep7^AE%i#N z#P?c+f`VFp=5;&@s-n_ulP}S#op7FrFPHt!kTa$ej{H2=pxcVVKz!H5U}ytZ23D2N zk<=Yk6zfNND~NTGaHofGIpyw+Pe%c>T&`?Pv@N37ZNJz%8lOKAW!A_Umi5F6~FFR{FZ3EUS5i|1dXNkY&9}+ zhvFSrryIV>cb|^^NjnSe%i=9!GM@sn2Bvg((}DxRR4Uuz`{&MGy@S|q z5BQ}`CDS}}1yopcu*iEZuOrO9FtV`Z^wu6k?&mYqDI?dRgr#kWT2l?$ITPdEL3uw; z+wNAdV_r6@-yu(gVlyU*Q8sAVgf_s)q;rrDIs78-g3Q}h=svrWf3M0(_x)tF=#Q{F zvP-9UKs0ZDBB85WMdXe_rO>}LyH?uv?a}4#5Am(;x(3>WwX%-C-A}uXLtUSG^LN9+ zdk*K9a~bw(OYSe0n|EA3#ARbp93~fj0hwyWx5C=Ti>|5B|6b_*)qz9A<&eyXFlKEh z)|bn0(17;5)2-N9&y9g94|I#+D?upj2!d5{yCT-_9aQ|JK64aJ$)?i8bstNmRU<~I zgddlT1Izu@0q0W3C?;T8vmDtoo3u)g5Yl#^=c2ok()#jn_#>fqS3w04BxZ(j&W8=7 zd+{AzfBhxn(@z9+0>C+_m$H_}Sv+S2M;g<4Duuzc%4NNikbq=^KY!O(9P(IPuWz#T5vo*O9!zn|Ib+$N3!s}K1*`tz!U)X!jhPREn1 z`!>yc7Ks8Zo9hE>)Gz3b5hrx)jz)grW6xf6C=f#jt^U?Y(-#DmcZvw|{s%!yqY!7U>I-KOOt7y+6m& zO8v%!$?*`8N(;WQK9M#J(gR73alb~x-MfE>75+T?6>R7bIR$ACXBAK-z`ui*NTaBo zXYIiQ8JQq-eex?VnA0Qt8gUuG1foOq>$-4Sy<(-xn2wwR%g{ryC>|($iDl@ahpgl} z5R{m!{7M6Kn3CJa6Ms8IGnvX^v%44k-0?Xa!4cwoN(&@zaR6q>3}0GaB|SiaY+fnM z+`i8zZ#&O=6SUAli!o#(cohMTU=D0kWb4w=)N^Dd?Basio|RTNXsx=Lij&M8>TA*c zx7F|@Jfp8UKfRI^J|fSQLa;Ik0hO|1M|^B{y#lz|(9~JrTrj0g{D~00V+m09?Cff} ztJ?KyGHbQw4#q}_FTAj7-y*Pj58w1k6SHjK@x2LLZ}Psqi0(zOM7c%FP`|1S_B0Z> zVhp~7o>6fU>lLP~5m4x9>J7obAqHQ@T{Y9#68QURuoBlQm8g92dfIt7YIa&n+|SC8 zPe}kdD3_`bx4+(mponHKu8QMyA&g5~w{GGceXnHFY`WTcWG=H?f(3_T?sNT_y+Ef( zx(qg4$|tJXNQdq=#$PYCwrB|8FloqZp-3lXKw2o#%r6UlG0j1Vp%2P>oE(F*QU%Rx zQr~XeWK20;{Dd$&KN{lywkoC>1FPAIw0AGQ2LL z?w>e^YynQyzqgRB;yRx05v*$AX2<~I#c#MJ^h|U~Vrl7=197v|&*m&HIhLH)JJv3l zTGOzZ@?T_Pg%L2FJ*++QM}MNLa4$NAB}XKB_3T@2sloz!Q*&;M+6tCgnvm;?mB}a5 zq3ZBm27;S)VSv;@^!B4Qig&}=0WKuT9d%&p5Lqj|{e@waG93_s!ihrHDgi^&TW@3I zA3;Uw?@#oKJpJf*6>i0XMS4<_PG=)VK3whAJFroeveVf(HQ+`E6IYQ)9<{vgV7-NA zN8m=<_?^-IV&pfpL#=Mk7BAPgh~OfW!sO8(R3e`*84o0O*yVMBgr;O81ZF6uK9XQF z;=GQ@4_@`_059L*rKQpHcJc-{-Lb+KR%0VY^HjrlXwFjf17Un6#Rq*N6c`hJ&}eDa zwdwV!Z@;S=HzlkmXGhSl2y-n|i$EPjdJqgP*A|n1{Z~J+AZDzmT8BfUnDjSYhADxI zMNVcm*ria^T+$g+cub4+mWu0;MALTy#gk8l2*mZT${teT(fQXn-oFW2UgYw`O@)+# zBEeeg%kbleO~Jh@N52VS;4c;gK6P{TY_Yh~@a$jvJaWd!8~DEoneBn|O5T~sm4WnV z1|@(;>BQa;!~&awtUK`e>myVC2QDAdn_Gut+xsA)Uzqce)F z74x(z^0n&teNVLm_013^ZdUue{Y2Yx7u<2_8tS=1JjHX{C9!h}or%8tL8~uYG@Q=& z6Oj<_^fPu$J*HN(R5BAI$*t4s4eKs+`s;GK=M3KCH~h7=n*K5*=f#Jro^Ky<>G3z* zt(X(1IhLKPeL8l{f99@LG0vM&!vDAW76BT(;7~21;Vl*?ep$^k zQP+B|b-m;eE?X}3B<0JxZF-F;tfGU(1-D)bD>x_R?8)DuN;mddM3>XA^Xgz77I|d8 z+6apu!#7g8uwu_txlD^bi&#kAS*uH~n2eO`dMz`6g{W#{h^R*xv5$Z2z1Mrv8YhwN zsqT==i*1Q7!*nx-a;Lxdu23Cx;7}Xdek}cYaZY~jg7^7t3L*@NtN?#jF4fRwAzrd_ zG<+|St!shHWMOd;)n$$a6Fx%}Oj<(O^1Tx->kpJ6RApIIz@)zk$oI{DgmB>T7b)5| zJK*b^fAmMiEHwqdD3sEx~=fc`<%dNMy zrWZ5!NnkCOC{vF<&ptn3jqQ7S5VxhV9?8N8;Bn!vkKiRyYqrd3@Sb%AC>Cs81TCEq zTW>rBn!t`}`E~e5BK3`4hEz<`f$GkRMw6*iRKpLDe6fhucE+?jwr;3PR=Vh%TSScd ztKGkq>*F3^$vew0M)s~8kaWTGWRKH3TP(toE>62){6@NIvl#EXKarA9m=ZFv)WD_R zr#+!;psDb}!}QZjF^9XQISZU^WyXcaeTSoirSnD*7aaOdfV+w~50`fDkM*j_YoO2S zz#jk?-nLm)uXfEvQLWtQkLt$p$PGLXV1ADWdC|ZP-#Ag#xZHb(_}zBRGD8v8YU1BQ z@tPK~Hxv8a$TuKX2B|}zHQMJ@2CKK~LryS!*zD^21aY>av;N*BjtKUvnWgFRL3;I&6xn(;SsYONoGM0hQq0e|Oj!i6Oy zazZxHT^|t}xzb>KW)}>Re#84(Z(pq;!lPGqV6)?+bbv*z&mGU4h`M0wL8VDmhzVHV>7>PD7bAdB-k>@`9eF zF%X?=*mq?ryEDvlq#mMFn(KZaOc9z!r|WpU+hz3|?LMTG-L7xZVYE=*OB8FzF~X5< z_Dxwr3M+&y;Fk>6}v2D>5kJcVF(^Aw-3v<%pLcr@m3DLbD#@f-dwS6-5%g8cbE#V!{OEtHk`nO3^6({3LK>?@WU?V2yscLq{s zOE|F(JYbNeLDcir%>u_H31k;e59XkEA+k4TXVtn8-yc6dc|0KQz%HI|{+?Q#{wz0_ zS`A*zszwg-A3rAZQ^IP&C8kqjWS5#|{AeWjvS9fh0fVI)>;u3YIy>vs#_W*Qw&|dF zFirco7BcCXx5!0SO(J z%#=pK`I(rNyo}N>@fxo+^sT8^V4fyl@cXT3e`;-D;_W&d^YCX-OK$)5PeVVxIw+jM z4KDuS#rm;c!b2T!LFEW}Ut^unOPj$t$p8RtP8F~I0nJb{=NC*8H4!VYaQ%Gry!R(q zr5mZ|7*hQ-;c|t)p}A0Fy1YG+_iZ=5yg;kUSUQ6~Gsb4+HGM-|Vx0y&Fbr5mhSfV6 zqE|#M&bj^&mFsOCU=Ws8H9re&Q><qWB%p%c-_Za2=) z6UB&lK6YFZyVIQC=R|qO@agSB?SA`5dPYL_=5%_8S`9nut*$z;ihzc2#Bo!yBq21#_N>Q>U26oIe_;0+ ziZ3Q23nx^LV)r>0zoEih-tGfj2`)Xql^+ApdSc{gGqX0$kAp%HeQ&maB0wH^)`0I~#kwAk7hYx~i%F5g7g! z9y(e@){63A7h3I7wg%H=P=iyEFsHY*IF$&H;d)@9#PVY(3@I)fd;S($(A3hH*kt}A zGvR~s1bd&s34T=r@qpM}FM8nW-#-LkXQB__ z56Pm{X(*ROT_i0O&|)AJI%gUZ1!JEd{y7ahQ9TcUnQXuicd)HvMq(hFNgk`fuzerk zAY`mDAeS3P6tEQA-_E{X&O7V~N>-s!Yzjq_N0#5>TP`PvUEP;3FK-W-@T zfJBrm{H?&;6nTt6_D-z7Gh8#uU^mqs?kFzTB~kkBD89u-Ti4KZfV4k2B(*WFNP%7; zhtarj8y{W$kl1xoa5-n<|g6@$J+G?AwiRcG}K(}#-w?!8jEM&U|Tj1>FUQg6o_P+8kB0p>%c z{r*SOKfj{jGeab8j8`;k!Y-$dGBGBe_jhaBccJgiBnp0)G2>MmTFuUrwkk9qqkQZj?qLo9a+F2QK{8*_-WT&)7S1U-^@2!)@qppng8zS{o&FM z`>E<{Ij?6zprZHbnKK!w4rDwvmyKq(@utL=C2f)Wwo+wGYG}rCSmzzy;oLZHqg`5- zh2&$1hwEX;a(lgG5+E4V zyxF|-;cs7e^2KMukg~rBT|&PW!AU=(($zcaXn5!2b)45nts-y(*JaScmr8uCg3;6n z$CP$?XYstLaVKzdiR^YsNNUB;T4c~qT=@`FUKAXbOoEK_4_9;d^2-_Y0w%BJk2vM4 zd?P~##SuC|vNUri$5`CSEFo;HXJwaHM74&UNag*W!y>&ib?EbGD+RMtl$T1QHU`IT zR^7<{HTx4dJ8Yi$!eq+D)#>FfXFg=M_M;)y)EbXi+y{p(q|lewvZt!Xtpz*8W*8I- zLTyhQ@)^6lMJ#eTlBTxtB90zH(*bsz;pnp!^;`w@+3lkq%LiPxlO2qNS%vxQshcf# z9L9A|rCPXk_|pG;UHo-Z)@DF{+$6~O%6M(;%b{Wl(_`(QE~Y0L*mWlRH1yjl#6CSB6^awes`2>>5;yn!Y<5G)7EEb&qINg6l zPVqPG%Qr`kxiXE)5mCQ|{|bxeNpJjT?%Z$Yoc{g}Z$Ji7%`BzjGA~(JAVl51U3k0! zqewfK2M}pB=(G*c;?45+)W7sOq#qIfTmR;tw3;OvC^R()=C?Y*zlYsV)}o*i_2!-M znjw)>Z74FC^w|C6X0|pJ_d|&L`k?23hHC$Qwxu6`{c$aZR?YbLZ3Xg?;W@+?b^Z9b z?0lQXs_&J*MEc*INQZ}%x4@x?$Ain+UvTI@KDQs=28Z2F%x_ix^MwEPpvM6UZqpTZ zp7-A}ntx`p|Meiq9QtcbUoB(T%fEij|KqsF1-Lz%Pvm;A|Mp1#OXT?5w*TkP4V<^| zr8dW*6}hSqQ5njwKRC0apvQkc6aQF`|Nc_IyKu55VVC(q_@Dlzj`**4|DV74 z|FaA~^{WH18I5AqY6)ZU*lqhv>M?1wB0q;<4gmh4dI}kF|M@chr!`u01P3W*)_$wr zi6(<+vAgX^hCZZ|%NvYULgE=~KSt757EC3#iilbEO|HbdShmISLi21*~Gfx2P zRG_$8-f$=`K_o0?@L-y9d-i;DI4_XUiVT}6qBtL)+fm`+_HeV2V{jX9zWSTBH9=!R zqb99Z%O`TVJh~wueT{EIIvDCMRT~7 znt=P|=mv5-hF1RXW81%OrvErzLV>EJs3Ebi{%h>pN2A$M3Lt@^o%|wd+1MWX_(jr$ z+IbS7Wg3s()6HBEkcQ94-nM^vBE)HR9jP`Xn zl{{M{JT{%%RqPc4Bli4oy`6C0E>=8K`WZkBZ8!Unk{Dd7TAn6CY_AWP+XsKyfLZ`6 z(kwLE?@LGK%L@(@urabEs`=l}{?{+B1`C1kw{~1!z4-)C_ zF1fpbg#L~ct}#MCqZ8o+Ytz�X9qG!5%VIRB${n(GWv~E>rpk-Ws5J#xHet<{|n4 z1X=lSvt;R!mW%ZRy4O|I3I!ERZhOS{$FtgDVh1uww%daPPVZpF0s6n;b5pGd9kpsv z4&sANMUC0Gz-%e&VMRHMC4rL6Om>yUKEr&COZ5}L)`|xD2qW~(asW~46SLWLWPXOH z$on}D5ikq>Hb7H;1J`2%1@vJrg^Rf8$HGcGy$RYZB!}KF+CvGg?M%(DfN)^0T>{NSqaCKpbM5SsW-_C3 zIM@H-?yZC32-m#Pgpe>0Gz52d2$0||!QI_GxVr{-cbDMq?#|%u?(TX!XV2NMzTLfh z&)>Ids%8qA>7MTAedPVgL|*kp{AdhwIg$!Em6fJcweH(fxoT;0joF$cKmgw@>&Ez- ziUN-y;c=Gn=9&jy|0@aLKcYYhGBl%zRd+^~D7j2dWu|sDxZ0`1Vph*Z?sAt3u@ZOg zpSO@RP(Q zy`}%mN&m}>z>g4>hZC5Tr^($gqBz6=3?PO^jcJeo1xW`OK}BN&2Aa-$ST->h3f@fl zOuzP}SshPHV(GMai{wj9`QF-IW|!zqPxm*7PF;i|{6?FV4nxZs3a4{s7mqAkbc|Ny zQhaC2SnLmD)8d8`Xa}#r++?j>&(esd=ydb>5?Falax3}(MCi2YpSRTia;X3DtA^^o zycT<0(TUC88Q*Ge{eeVY4`5!oFkK-cHyBGFQ=OP3L_4E~qzVNG$Otc&s8kJke%=#% zb$iIOj_G5tADXs$8v4_y=6E`i;FcWxR?@pT;Z2Mr5lkeuOmGA)F zUJ9{zYWgSRsr*rzlVK$TY-WK;0I??4-u5D1IcXp|975Mh4Rw2#a95+XO3fmL>wHvN zum5ywKDjr{Rps_zv(RD^1B=TbP-QfHSPC=uKi>NPy_?r?m0lvRTG-;ey2ahca zu(rqg1tE)gwP_O&FmLZy<`}MC!P!H^kT4co8ne^ap0&Mb;+~u*ZV$z&0mxlKZg^a3 zs`&C)fK@f{nXZi(ppYl%Ed~$@hV( z8BfDdxom7Y1JunVK#LRq*N%CrSn~IvT+ujHTFnN0MB%fVJneF-(nFRfu13 zYBj|xg1R#~H-Hff!&!Udsbo)WQn6C`AdoS2OV#$kLe~v9Mtg{cf2rI5&ciW+r>nW% z>=a-g{eKw^Hp73b z!Tw7KE(-#E+8LqSY4X2!4)`8GzlzBX#&VVTx4t4`D>R_TX$?7VH2b$w2EO;b2+*cI zb66h#_+R7hKToVfgP14lhPG?3?BDG)|Nn3igt57sNB?z^0c8?iXIatPLkwd6i|=0& zxeAG4gvpg8HDVaq!NVJQWIN;8TQ*ydqk$-m{{J7>Is5O||J}Qi05jVIT_&+QM-cM;jU_8CRtY7@S(Rnz?A}Nh*3eVfSqN(+GVuhj! z#WG_(3o3qLwyHTua-bVH8+rExArFhuwNulzUj_rP)1Q4W&(#ZVavz5Qaj(HX0Fn<7 zo=zzNv%x4Cz`row)$^j!jd308u5Lb=LZv8HJe5P_3#l+Ue*kl$fm~xx;u?F>FBaPq%PFL@0vxy@9tjU|lOi!U}R8+>i-KRzTcAdzqJ8G!Mvn0YxUAev6%06L)} z-D7|zLCo)RQ`R~h52(@+Rk1Zk5%7Q7(``w;b5L)CC(d&@f4zM=1LU$MtOPH2N2vf{ zNL-l|2LTSQyL>#gCbosEy2k!edB#^t`2o9fx&Ck)_0~LoK0bLC1eq*_5sn_u|K1ky zP$LVkBk5AbJAzmKqc~W`fp~04`VYbYFrtfj*Y)vfYY=l||GHl4!or#4o5mz4EComYj`;pFU9-s#1i4{l!+DQ?H!3O`su^oR|&zzgz8EyT0WIXBwJQ1@EHl*_i z|5&rUjgde@F_UpIGho#ODfKvk_s}FFqH`HsBYT!<{If3&Q()At;L&tWH8#%I29+p< zt2B>=`iSWgm0@b7VoiykVb~ao^TXJD3qY5kNGV@Jj`)aZ<8%;BV)J-?0LqKntJTdD z1)3cs?}pFdVc;wWfz;g<_j_OQ=TeDcY4U}sdYzp~!^tY@WWEGdt?68Rbe`zY27iFT z#in4D%giB2Fz4{YWgC;lWY2U8pi}@e4mHBT;fcj$s=s?@=ClJ;+lg+K2%OiE#KMWv z@pNjWNeo8OLvh8zK#9-s1yhYu@yJj5kPEIB;*rgIuRH(1*MAJY96 zfCnYk7n=0l(%kgHdSAM*47aR;!C*-E72;#4(dDs9b#BrvGvKvnqy6U5*|=6NCj~H7 zB6JW4?6&&Cs;oBn7LGt7p&X634S>x637}PzaEUTBjKVqls&&Ua+IdtbzQ7PI)M`$b z+Mc=RoI|bJFtB~sYp9|p-12A^dSw7G>t$?anr_uI$ z=Q%+S5jzx1YGOt3N7&{68>bJ1mDIW-AzJ6ut>WR@m6fv>5O`eB_f4KGb9%3@Oh5qM zJ?u^VWASMriEM51@3^@-yB{3g(?1}?B9S|&k=>nvIMo|dCGjo6s}r;E?|FuT63Bns zeceM(^jGa~ct5u+?2!q1tc6Gq#rZT5(4mj@w#gvgp&b>G9m_+c8WvSW#t?)vK7`FXZh z46S}V8ECf-rs~U8xCNh}vTo>6{_eI z8C-uW&?I~9>y-{~2unjLEUsUP*G_Nl)r-!{=S96-I(y)ZnD;MG1AparA{-C@C`sLi zU^eP+l)~^XR((ggIeEe5965$TIdpZuj)FFE2N;|WM_}$z7f*0TwWUlNGVGW8qPMxp zhDtHzdiTz+geP)RoFx4bIJRYNL{}3BLU}`R2G@!7hSI*(jG&8`p<%kg*g-jBULQ!A z^bdj66FNJ~X#Zz3{-4Dez9|H~CliwMl4H@zz}-;k-?bIuz1AJVp3BIVbG)s_{hrz# zM9@I^M%m|5z*{k%;ZP@%jHMj1&`5$u+e@9rb<8QGM6LbjY`F%O%3I?^Lc8p~{JheX2pg$-ZQ;f1C8c#{Wm@nlRlBv80{M$-#c{?d!fe-}%)vzY!DXP-h z9cO7K9S#;}oW$W}31*#_74-$x`Xe$T0n(+Y5QI|#5V>yaSxn?URpwq;(+J1gbt<=_Hcebj*HDPuqnbQ73 zuKXtx8V(L@Ed}(XNwCiwP=!UfGrwU_LocywEEXu2okN4;_Ffyr|7!_~1lrF$ND^aNQeo^|=$15)RWGcLvUW>> z&2EejmywZJHk;eltoiB0yoGXNz#t%3`C@a@Xw7Ihi?Ky~tmvKV!)2c9gWLK1f80gS z#E6MpZXODt!v5LR_)wB5;jW%C?p?{K+GVWYBTV4k4^zeOkR`HESQ(T`RkjvlL!Tau zu7WEF>;#XPfFUJj0#A$m5vs{rT^h6$I}fK4K^?Ex(VuJ@$PQp2V8#4_ZmLqRUsM6^ zGl$KzFbWbfmUV@ffBo-%1Hjg8#Q^I1jE=id$P}=>-X8XF5A!-&-KS>+I{Uwat6Zm` zFAT=#2tVKX2Pz5h&zDVkOTONA=BTuz5r{gRPA~YS{}v)e?-d(_ek8G;emOvg+hJm~M=r zfS6QLvNw}As&xO1qO3v8u}sz_%Mj{?KXUV>v!dfoSt{?{E+|7q1lSz2Tn|F9~gtam1}jezdK#^ zJmbVDPS4hUDZRzQtzosrB3(E|tBX~w`J5&yjVeB%9TJS@Zb$}Pj#CYYfy%=g z5xR#Pb zrnL3#)Rk16CVtK7#a^X$F%GL%{$TPjNM!`{Yral@P}h-MtA^8IM7bV{W{B;|t4z6) z4`4lF&1|E=NvW%TWb-V=9X^-|q8MIdy7#2hFc8vnixH+T z_tsky7OJsWth#<`#=i$t0gkrg%|0#~W&Z4Q#q3xbr=$XFH>m~zXNEh{bxu0j~5Lfo=n&YVc|kzrPG#ZMx%=0IOv=D2Z~0gizYVAwD_aB zh{8yW?47dW$oD$PSCk_~E}NK&Wz~j#t=nkJ=L)IzS&8?PhF!%p@GHZWQbI|f6P7ww z)5HZ~CTG+gn`_X!(kock;uE~rKdP7ID3(uqO|ITvX5&IWkU^ui-(cT~u@;lLMy$BDhd6!Xx5`CiUfm5B+e0y_bP@8;n2mC1|B{xB#lMHCW1eYNm| z4=z%m`I_5Z>7d|YsR+n+Hu7u&vnK<&KSIm}PAF8m5-_r=NYS6_lQ?xA`K2f`fVtSs zRa$y;UZqjGSxT3M!oBElwrXBH1HT{}FG2SX=p1~^>(&?V!*nlOaEX|Z1n zXmw#lTe*7p{M8DqXZX@&zY$L#c_23Wq+0L6$;igK+=ospu=jkj*1p!70IbU}FWH;- zM9FyQ*>;h^3k`tEGP$8&i^t85(((t;ubhUTS49C9;-$eZ*sd_8ueaS4^OiQLV%v(R zZ#Q$Nw7uKd0=+{kEJpuzTJ{by)M(#+Fly^Pg?xiwDkmNxyJJSA7@AaJW>LFRmTuFG zG+ez&i{j0NyH9SJ^GoSzq$+=sOVpGdO7@+TY9cYJb;@Z+b;I1wdER(Ng`)Y#1ZK0I zo3>naHM**kx?0FA(Q=L30t;n~5y27+4_AFLnVB$CSAFvwGgUk<%Sw!6l4s|x*W1g%BGzOPtU`9nZ9zcxcrGg?aF1{PIeQE+b_p*2k^WJwk z(UblC%n{>kae{rYGy17s5Xm={$Xp3DY79pGNuwzCA8bp!)vNYvmHoR#NLp(*k~qz? zErL`c8C<@>C7#2cwtGLDYzqe1ehp{?=8UdR99m)915p}2zE{GV(h=B3jU8S*)xi9u zBA{jLl3Mz;cS5M z0Gv~jYWF*m0uo1nVm96k>eYc`)l1t|nQI(nEHBu*WIZYV0e0YcLd+xxD%3_Gr3riyF1`VLz4Is5>eRIo9{iXv-h&2la)XY&-7<+l+1mr)~5y zmFoCi4jkeEgTwEj3y>g=9D6PiF6Zc)$Bwy*;=i;2*4exQzQb;wKV0c#pc$pmvqAyO zYaQ76{~msNKY4jMI)cYP1mIh1Ty77N2?i^~bGjlF#!S4QA^LXDevL+d{po2-xxfJx zj%Ba%xJufa&`x*mr{$rPf#(p*9cJ3)YrK8j)mUev<(`|ox$7^4dUT7B3&x-_t8ndX(1kkcnH_hbS9I;(VBW^cx-M1N{pIwMuVw> zWBc7VVp#|t7hbqWk{O&^ntLipnq>ECo{GZ)bFu~S(O)U#j0e_xCu>CX%4g(EPTyfi z$YEQdisvI#PXrJpi;bl~RaaB*0c;=q@d_C|3R&V2qVcOl_%>LGg9TC~EbgYg8CwxlynrU0wZ)3}Xj_5_{W+je(lsV+^k&{2hZ)L`JcK1lzp# zzCWZZhx{W-^Ba}qh#jGe)TYgVRAZ12yShFK^&SNR$wqrtu3X3r{kh8WOtYE%huO^c z>@Sy5fVD$K>Q zzWp<{^Qvcb?Xe{))yaZ^-s!ldh=^*n79=^InC3%X1#r+U2E&Fbt(4TETw@EiU@o)E z>CA5}VT>jN>Zu{6YIVZ;*(QL(miUvCYlQ<2icx*?8Ah=}>NV=vJgQ`|398$UaoE_y zXL$HJiJz=Mi0KgUfD^eixL&rAZCh*SS_&-9aCOk@wiaz&5b!u%W zufv%~AY?QGD4wL1=@JF8Ro6FnMkkw&xfccE@CDXD$qbeFe@>oHQ6Qj^NoFFg-aod2 zvNocZsRDYp8bTn?QwRKn;2J5J`O5aG9%TYfb?<;p11sb}aZ{fCwd2D<)m$fqu+thj z+SFbz+0qR$t#frtEQI>ivKkFg{X|))?%{%e{pM@zg(5h^e!_T3W}5y8Ecr~86Xs9! z2fVCjv6z^Vc3rJJ()X08lnq6;I$Nf2#B&FqV#NdUGB#&u^GlBSR^pyWp|s={Q$i zwepX;1(ZL-!98$~9{m0m^^Kzh=lNxVq0G@Er!cA)bE)OG{_6{h2Q>zclBGs{Hqhl2aNKT0>p zJ+Ls^?dBvCip8$DJN6{S^{_2Bn3-NkKtOPr;i6!FHakkwz%(5Y{4adW_hyR|wu8C) zh!J46nLcTA)^?Y!qLph*zffxw@%+s=)9rO(ugZK6ejy*>iO%@%0Ea3WDqjOozeBSTv4 zH~Qv0%@OzUP1O8y)0@#5+q>dF@wbui&{=o!9r?v5gdqsZAlw z1d&4odl6cx;3J~qN@Q*PzBkB=9M8v^RICD99?x}rug}K~LYHI630f|ddu2#YrZs5YY8I19%nfe#Z zAKi}wx2Csj1G*!h7h~x{8#1Xl5<0!Z)jw;xG8--rKq~5OG_HbK?3miYQK>t+s~XVKO6U zBX8V~6@1?t_ok~f`aCd15kofIZSHjL*5RjvMd~FMODXc^{$!qHa}nM9bx;R%5s8Yx ziqr+tH7>olle|Qzbo7BD?T4*u|K`i5RQC^jq%9k{_oQF{gvKodvUba17 zWUYAfa+A>(GX8S|rI5l@nsx!$x$_iKP^36JIO>E;bbe=%5MkNiuS_Kb+3{8J2whnK)>Sv(sdnuMAO` zJB8PbYxO4$ZgICI_l{ej`&IaO7RoCT8YJUl2;GAx>uwGLw+$b}Q~1?Pf|e|RWFqdN z44im6ZC?{JV2lZILi%WF*Uf%u`|9jn0f^t!#YCt*1ogiOLcwE4Qnoz*1%-%Wuu`lz zQ>?h#$c_cUeMY0*He(k7Ng$359JrVHBv_BxYluA<1T_B)%bv(^8(C|XCYXI*xLv7V zn|y1%_VkeG1CJL6Al#XDgE!|ioo863GTdL2QVV!}p^&*O9M<2&hm#;Xs-;~sN& z>Ky7^^j`bX%5Lyosh z5#n|j^T7nlfK(3>QKYZQ+;mce9&!;ySH|g_W2P+ zYiZ@lFkHoPvB1#Ym(=;fWO%AO?OR3unS^oW0Tav_hoN@J0cA+JphqN;?!f4$B=HU> z$Lw~@Du0u%;jZiCi*md3Lf5>xji}ljv}tK|@RN2{aBUKE5f4zJZ<}(=|2RqL;Co3- z3=x|0_z7JF<9rZ~$3A4yb)d;<%J|;9-o@k91g7<67V8V{1ps0dA0hDb5fXRm(RC=J zks5AHSUl(dHPBG0XEKfBI6l+u9~5xV6NLR5$r(>sfp&y&oOMeakc2hu>E+k)^jrBx{jTlFPyaWkyUSe^c1ec& zBLzw*r7)4uDlzW2w;KKz0-+;~V`qI1nbDRA&PR0nv&FD7JxeXE#v{wSfqSRGAnAZs z*PHzQhOjLY3!#BX%?+Jik;R`RMh!r4K5`hbqkP}K90u;=rz5- zYJO;9Q^LNn^g_23s!@5)y_U0suFkuZt!?K!ji-^V_HXPud^f5Vm^Y8J*6Zc=H=GLQ zf$pVyuKUqBt*O=4Sul%J{-!3E`J#N2KQyOP72i1o7^i+kG9Xl*iQv1gTeLcR1;gtx(SnXB>#yVeMQ^618jtt?0^3|4PO)K<~?p3 zBBP-f1%)>ed1l1^BC9F5zsbV@VYd0KMXbfoeeWl(^7FE*U#rv$G-w84)iXmYRX0Ko z^>}Y2iNAi;EhI({<6&25gOOCaNTXI{Z5#w)+|UA-C}>8HjFL_dG>o=UgO zEsN?A-5;}e4;69WSjPiW)P2Tobu!^kU6jB)f;qTY0FvG}ion`VG~}G$6AvvlJeyjAJ(hDn4KU=YzGKcd>0ZrfSo&~q zf0W>P=%y6;q^GXX`Es>PWW%kt8ouG$R$^;z&S^fN^OBBaKR(d>3n-PQ=6jAS%Jz)M|j7q;sfWvN=Y5ttKOalTxAq8+_ z4-=n%5Kre*t+x==>-VJ7M6YM;{9M?X1@pEJ)n;o5MrCk73n2Dy=}K?feQ&-4>_&QU zytC-RZ3OAH1oD6JH9qMjE<^G|>ie+P6q*5@H{WP$bSsU+uh;e%jqAQGqdKUAj5J$? z8zX$WT)x9PV!-A~OJsDcdV4F#rM8Wf`rU-^1#mIsn8RcYJ4Nvx#(i%YeWSP7YDUKS zyw6RMg!kJ1utrW!5yZkOU6 zR}4W0vj+%oH+9Vkiy^WDxtyh4-!Ay7CY{TkGBSC3t2ghD&qtC)-uPhFU$C?O45UhI_Z?QyGJ>R2^!jlhBLJ5B2Yw_UfDLc9PlClFDaY+8BkobCwOY~A))!{ZxW1v+(~N63@-KalBLTo;OnNo?<% zkhz=QNFy~!gPdMT@1FKpnLi)+AE@xw@cv42DKndG`N5r#W`RYHS&}T7$11BEgZjbv zCdh=j|BUD|(tk0*NHzn;JD2%@YpzlI_#@R`P-I zS@f>_rX_<y6lkk*u3EO%#?EV+rh4D_VMhxeys32o4MqBv-*@= z?K}HL3AN1D`R=efjXI=kbE1Rm?^ntWL$J4f3#?7~+IFMXw@)3M5cT@pMW(4#5M@Ur zZJRKD0@7|XpK2^dsoC7N$+f_{No9?)WA<074J|n68h1YC`z&XE_Q!puM)m%`B{_oQZ zWHLWv!A6HPw)r5XBV?)Bm?~Fab+(f{u1RzPR`#r0ih z7&|mA`fwfIHgw-_xVpIg9sXR^pNS9jc#}v3Y3bU-_YjVu<{PItt;mnF*s_re(t9-N zH)5N3hvzL@5X9#_EZy1<2*Z3(>=pt3 zD%BI!E-Gpm9Y%Tw8;jL_KN)Mhs|u(E3xx*x)>f+-#==;s;`3{3e_G9Lm$;R^*fOP< z?tS%!ZNnoaCJyfI)DhUQ4V+C4kLA8@%@EMiPPzT|UMa%XiO}y{hMgKef7w%;TOy4i zsLAd`a)&au01j(*iVpDF7)*A$CGJgd1fQ;7R^xJ5Npq<3o+njw8;G08H+BRucxMGUck zFzRjh;EU87VfLcTMF&1Z0j3;Z6vE0W4Sv;Gp?4?(KuFrzGuG>jsDS};c#VXfEZo*^ zl9b!jQ(mtwWRwj^Bvo{0g0OX{p$R>2&!`_RDkt<@xStZ%ZK0*U-1#bE>$Pofe@$j{ zhI#pJpRDb}VKZkftP?49zTUc%pHh{~xAfIp4D&tn;Nt>WJlPRRYo=JoeQpj#&0$Vy z&0~zYJTX^twy1!tu>gn!Pb@2jeN1|Yf-3ivq~hxjnSWJn|191Hv_RY40a^yd_Ic-j zlouOM12QXz)@x90$(Cs!?H5=1^M27yWkN~!suOqxJeNMcBz%#=%j}iIBXp{Tc=J!g zD-e{!gXJ*fYB`0#DyH$&fUGL84gN~g2MmpKh*Sg;1cQCP^CxN}7Dk3f!or9c$(Hjp zIVq_e-1DTW;1L+9pisCFzF45}a!BM5pQ`QU9qvR3Q9mQ`+WA(=PR=GsYhrQv;>%!o0D-^HO zx6L_APB^7v>q1(KvSRKKrzSL(69#?8A(PagrTYFTHKc%M>2tF-*(@~&HPf=ltnUx& zW@Q6mM_ZctIZ$8cGO8p~CwNPRh1EDHuA(~?e#NUBbant{Cme_Kg~*)u>-;swuY6=~ zRyU?I2eWFHaRj@gDRfT+{Qk1wbk2hm%eHu{E)WGa1_nWT=?)9n_y?&o!P@hgSu%%p zv>(#xbYaeP(&+Mn?Vrn9g?;xity{pfcQEXL3I6DF)zn|viv7i-a)7DWJPA0O@&_HK zsZ~f5xLo9+Q83kkIB)lJYSzZO4Ij51xGhiBAsQC|8!DHRnK}JLQi+uDR?qf`!NZkQ z?pteUi3oo{a9{Y@(^KafVl<-G?qpG6z;N5koaM)j&6#Yw8vprw$t)E_0tbXsXVTw%E^dsjj~hAJplt|mq-R@9&*j6r?`Z2LXg~||uTF*@jJ4+ogHko0 z)?9E9;=L-tszV7Tl|4E) zHDU7RAwpgkNzue0QHsf1{DIxB-&?{-@id+|R6RI9cPdGa=_`#!!qD9QpuQkF&ioj` zfx`~9fvA4g7x^|9$6y)-wHCHJ%QVS?2y;jLch<_`OCbqn;s+)aUkvZo!&xQSVL&?S zWiHIYfuVUHxXgbdHN+RshKVYgiWr5TWUgQp$cS#zPl+!q$kblg+db|pGH6!qD;JD% z9_Kw3I}ODbO$TR($YCJS@r7j_oBvjWyRiEucZn*>FX4&+7X{D zU9#hFH_RTWmJWir9Gju%-+zuQ9`Zkz3}kg z1@{N+>U^Tex1wij&1hdzSr+BR6lGjPvpVsGjho=9viZOwPfH)v_mT1A+-G_!_e7^H zPZRMb%qZ($gm4Ckm6Lc|B6uNzzH;F;zJXtT#+q@qyg?tJ0|tMGZe>g7s~f3VNKq9> zGW31lq~Kp-{Pd~sk1;bO-D%}4_A+S?{xuDq1V8E({%p&bDi5jZ(K}KTljV0zU{o`W zy1XiQi}OUIX=?Tc?$9sg%A|7;D|DkWdut~IfY$VXQoNx(LblT$c3r#SCR*HeLC75|oo(=6x zT1QJMF`>^D;}H7jgo~x1)NGD5haNq%s8+0Ru_&5gc2`kxc~}PJi3AzhR3#i`{0ece z`7zz>Sk}9%``xa0@4yF_>wP5C*=)cRoH+r$f~>gwo=AnaO>^Q-^nnljY8!8v;MLFl z{LTAkc#C(D*y-fKu|ZR47au>XrU&C#tD-Q6QNbI%#$y77ntxeC6`lRT?C<uz(_5er@F^Z2q8!)U6IAQX#qPMz@$Ju6eS>y= zr-Oowwv%07YLyJ4-Jk9zEN&427}A#)Eo#J|Kb^|wtL&C?0Dj}(5s6vamaAX@ zXTHH2`2Z#xllhhE@iq?2Lv2<}Qasz`=1A-bP#*S4;m- z4dorll*T)bhrYq(_{F4u75vs+J; zC|DrqtE8<>8P7jZepL$(r{@j2kvFs9-1BY?861XV(DIdxunF9JZx=kcK3*XlY-tB) zp7=&Le{&&Z)}lpdc_76gtm^%uCb3%o7m8$*OIqeyD~th+u+?06|2KcV#TI8bSx zN>mdqM|EqSPm+A9=Yl?_RG~!$^Y&;e_IRo=yKY|YZ@Leq=N!)u>yx?O`n=oD16@!I z)o~$sSMuJgywLc_Pzz{9dY9lQ4$)IBp|dJJVT(B#&Z79tdPh9zXuf()|IWnf?*3Re zN@5(xbgXeRxx$5tT?|0E=?TdcPwlptkGe&c5U6e68cskYbW)>|YsC8N((k{ci z;{&Hl7^Ii6C^@@}9qV~=F1KDOEj;?~L`i@Q*bn;gwnI2C}zZ#}I|jz$q~57Gzk%1P>*=c{bj!1}pB~Ed z8EJ_Zdtfad&*mdqp8}iFul7pjNrd=_&-xQ@Z>%G(VKP4B7anj zivZCW|FZ7e0lHdMe058AGwOKi1#`$85ok_jO_NR^zvU-^L9v6O?)UWg=jT6>$&Br| zW83Sr!DcMtiz_LVH=n8tj%jbhM~(|IF;NAJ6W4v=+C4q;5IY8TFiT>~S7Wk66tlV8 zo4t2mtO`P-(mfOhf_e1 zH{ZPv`VWZBoAXn_WhSpV4xhU6s&xCLTkTs{CP@Rj-CI63{&w}+vSYwgU9(K_4VF{| zxxtuIm_{Ry#ufGs@yw`LqdvG}Ckz-Y5lGD|t>sX)Yn!fYMD$SE$In67NyIocxY>eB< z3Na`cn+MPLxeCuELJ`$=rRyn+CVCVpC5| zP*oaL!|V)W>NJ4q$(PB5+5VQt!BJ>}jn2W-)rk6H-(|6sEoY+;TolV_4i;`a*~8!! zL;LjJQ|Xgu%H)_V-F!V+alunCjANv4$h_IfL|S7=;VXqL!)k5;#1ETf3>obE=`|C?@&h7Rf za*gL2*Mwl3a_GlNq@I%`#)2d}5r@7D8vGV(5>nokDxIx9aeF{}d03wLpg&05LMk^g zv5Nt3mcVke;nUM@ilyIocm#y4EA3XLFFlc7Oz#7ueiDD#k5T!pD;k`)j zc|Y`%tjX8_o*-2K%5emx_4-;q`C-(GqM12s<6|LTDV6cmW<(>~)zwF*@Y6Lmxh8z^ zi#8fh=@z`ISB^TYO^ zd*lC%ZSUwBr5S~v>H91!rJ%SYDKh_f$c6n-h5V&^wF%Ujl7^Fw-2)K$)@CuXgTD3m z-lD7VUAWe386}$7@@H$KwN+*=VrsyAC3Tl?X%gEXu$LOEwS3`j7KyOf`ne6|aP~UbJbymTG zY7LXmcjt)$IeFiP-ba_c{$;@Jx0WjTHtPh8li?d{jAR;{$cKd-yYq3K=~5vn)&55I z2<%<00ai;LK)$7rV^2S$@nKU*k!ei;7K;NHQAah zSzQYqa*(0sDwQlaQ$TmPAZJ&#TX%jwtn&L842zLL`z_9RTndN>{u1b72}dQo!SLt zQ`)r&IPW`Nrt|Ho*zEQZ^QyKcygb|sRbu+SAC9%l94XQqYy{x0?_C#|ti8TW7a4pm zY(6@5r66HVQmrxmN%LU4e~y$+2UwnA^T4ruTzx^{phkru81z@w$117nnYTQ3!qtTz zQa58(?jcdi`VbL4W{VgAL))R_(*xQ@{0fE<|P!zAMf7R{TZl-7$;{DO$Mg7<3|A())jH+YJ)<%IK3kdEB?ykYz2_d+< zySqaO?(P!Y-Q6v?ySqbhzqPw}_vzE)e0PlcQ~X*~&9|mK;*E-_JgI}Wpr#`2JK(8; z_hOTJuyliQ+TUU|f_dDxW%-%SQmR~|@hTNuXV%GLVVZXQbBo1-bY;VfJEPMd^p>5- zl@!DFjP0FmGMF>z@rj3-S+kp|AcB3B+By3FY(oCAGyQj!LQf4bY!WGvIdMpwK)T8h zUaVTmz~B1aAZjWLcco@8%wlwhn|Dh&IyLfPmd}q0i|u-!<}7?Vql*Zwk?e|0 z8wnllOTBHF-5g>uzc**KCplb5ZQ-kogbDys@5tgQXT!f_$9+;_w%oReY7x;iPa%JD zLxX67Ui67E3{!-=xU4XV1~Q7oZjaG1a0JmPzGoxx;eIERL@yNl@H8WLXBiO{wPSKl zXEr=-baUF7g+=je#iljD{q9uo_INJA&ga1n^*-ab$f@A*az4wN%LcDvry#F-n`_7= z?g}UK&QB!X9z@yVn+JXZ6ygTQBl)_l5VcD}!ku*9Qy17Y8pzL!T=9EDdgo=&x%JA{ zs78|^ZN^i2qn8tEwWZ;(`C+C*xRY@_1wygv+DV|w({l!|yh4kg*^B6>zfP{`8+fAg z`QtLC10DPw^nG+|Sc6gqSu4=9ec$J`OLj?fcg?SH;i_Rh!a>9hjSdC%9E(+n$ern( zbM?lwqh%plSx_pC?aXuoV9lfNv|jXX5qh-Mcb4@Axz#}w-R2^r>wKe%QO?&)TrKY> z#J(F>Jw4IR-S@wnZy1|RMQDC;4QrPVEpY)-+tex@JVB(CwPSc@Fhbbx+HB_(FMb{z8BeT29!vW`E^bXDqt7 zz9?UBdYi>yVkVYLA2o9~XHd)-bV;YwT<_m23ghaDxj)$!9ZbpdGc=m9lY?(;%S*5f zf0;9@gsmgLNII+Um%$Sr%NE`^svJ=6S)-<_Rx(|>aB%gvE5$R#`plSR4ZQB@##3__mxObs-tY%*cq0eXfPIadgT{?l0vtxMgvFa@ zLTHkOWeZ9bS6b>JZYzA#xgyXRfd7b&{<5FLvjIyq?a5%%u|AVLB+SaA7SIQg4P%d_ zU9K6$HMoOpBn{r^^~@%ze=*~IS`0Vsbo6KM%WYwn*-FEid=NN=y?Nv8tl|+s#UhyG zz981*U|)pX`Ss(KgV_M3L?O+=*nxF=KjmTr&^V$bA`B(>JfKED6)$Q;@HgRd>zxohTHPFx+cdn1hAU8Z81KJ+yo!ZUoD03jK9)E8{Y?E zRn6(xuPuudj~Xb231TaZ3S}(zvJ&DgwPO1*Wjy|ZuR#s{gMvXc#1u5z>uiWx(Zlm_ z5iIpvT)JMNiWqXGh555@k5d=HqP~PI&P2l!@lm!3%AM-ZMFcVns`1$xzBCCS>82W# z2{A8PVUjZSQ%ngwynZ%5>ZHRpXjrt>U=vpgeT`H0+I)XT4p^o9dv0a|)0wy!t8 znile9z{a#lTe5#yH}O(oY1A@j#Y!+`)!j1o)hu}^`tKC{uO0VatL|MA$cJoN4Bx>Y zK1`4hLTafs8fbZ+m&379$4}*ao)!_+nO-?d7S6rN_q2B=TgA-=kFV-nW*7?6kV7eu zY_@rFOVhbFgnEW~Pf=RaLZ%DzVMW%Lmny$;#`nHCH@SzaU^(#IKd-p1CZuaPp_FId z`Y7fujVV^RBat)8%rq!%OeY%YeC6js*JQlHH(!0lF`s_js986FQJ$&M!FL&0tA6qz zvW@xHpg+dv7=N9EzsfXd<^o4AmCn@~oq;F2(yqsRU|%kLo4hHt6Wyhe=q){$^2<5v z1N(W0!=~%wg^a@WI)mJqvP*TN2D6pM6)Ofk=79|B2-l{g?lW!o$MtgS5IVKEvoZ#y zTW;drB5~sv8|)0;j$VZ=`mGiPIY@dZ$YfSHSnyVKNH54(nuv=eLS?xIST-V!fUTNf zs<2-*L;XKtkZQ4xh0}xT`B^RI{VVXiS+!U^v3c)b!q8F1{i)u+NlE0@;<8~AL*hzp zUD>qXlDD`oDxIFjOMPay%JJ_Lq3-?;+M?+ry61Hu|G_(%Lc0GbleO>fzKZ3~cwC0D zbW-Dz-23f?nYP0*9R{Cv#=Uyb^Bn=_VBKRsUbgkle?Qe%o=l zT?MQmw_I8^*|qI`&h=$xP9gKCcQu7(#n5R7+zezcg$<+d&fR*k(Rg$dUrNrQTX9iQ z$BBY_A>1vWjx)Lr&ff7I)dDt2@EI8Zt?E!5xCDrq{ z&Wu~}Hv^f4+4#5vBU(HWlp%cZ2@?BDu@wIke_P=XLu98`&eE>r>tC$aWB12Weqf4E zKSBk5w(*EGe&Gsi-FhbbpynYy!rGv9Ad4hb#c7yUrLEtk?NRg-JJ7Jc|45jxuu5Z_t>$e5CSvTEhCW@1t|=2vy|KSaEYmf;9E>-8CNYof>wc z|D`EvkXGx0xijmEvFaLD!teDVt&@}GsFkKHGSQ9CXb|q3PD5MurE?UxXaUrtCLs^g zpU$2URr3JDy%Rz0FEz$7&{^L%F>(5H&y*ddY~d`SD|jvNriZJs#65L?ngzyW-a&Jh zuFvVTgg{6pHpv7RJKPx?vLvu3CVg+HU@Z~f_(;U6%&w4Nmes66o`9>O8O-#PWqW%J zH{I(%VdOx4JGIFp*vhBI4wsQfp5w`4ZaQ_22?Lsq zl`X9(EUED1=PFJ%kK9-W9`y*h7L|Wu!#=~dh>EyetHlbKK&x9?E#@nakX zmbbSHeMFg^IZh7mCyi&CGyz@vC(@!QL!BVVubEY;{zi0NQCos_EiKKVDTzmQut)vk ze+ZD?GBA%mFw7TbzF=7`R>c%ZWr)?Iyd@b8M&i{uuemR`+7KY%F$WV9_w;i+3B1$n zX}^tgU(9q12Neqiz zi z!Fm<=+<7dWudsQ3UgJc`ni;Wxo@t)tZC!pEJV)E2-us|ZW!|py@sf4JDv;`#V61N6 z`yzYPo?pzF_jM%`i^ar5ZN1@Hr&@*%@v#HD$M9s2FlmsQK8PjT;{SXT|M(*z0kN-U zrrBvb=t3-^6BB~QqyW`kp$_#u+t@Af$S>J8oUyl{2q=qPw$49yhTwMiIqg%Tx zN2A$=6kPF;$1+)x$X_l=ZqGcRcx~S|sBSH($DSP6yspnUBzI-IqIjN~T#N78bC3@5 z5%WL5AWqU$whIbT|I4uaJVjWvO?Bc?3+cgP~>2=AMs`fBjwv2QwE`^q?aI zz2cU1mCBIPgsBZ8shu4CV0su*(2F|qF|l~I89k_nE^lLIk&w9ljhiya58YAEfoOy@ z%{Y#djv*R?@pLyfvj@qmrd$egM^;k&|B2-$PZWV4wO|MjR$id$_OZJ0AWV^YNAnBtN7g1$2- zxi&Uqz2EBIfJ|j86BMOPV{p-5f9W||A#(C4AUF8`4zEpSaj;!1p{+oFu|FR?b_oKK z5<`h?twE~zdS=_*p`MAy!|v9u<`->3UF7jK+abS*&2fcr{r!;PagEtX?$?(CQ)88W z|4@ocOeE)2|4_~s;!p)0%d(wqu1+W4hs3H+HRK*{efNx8V#2R${l$``rlw!IktR1S zJ*-0kc9`J7vME)Db2f1(rxI>df~ zy|b+YxYiy54tT85PThw2VvVR!EC#`mL^>k>)8Q~qhg$5$3|JFdq+o#^k->wsC zyKND|1W!4gVtJ$ExdXT-hk2>xDsQchDynD{(NOgK_*wL3F^D70^V{3cU-E$JW>OF_ zN{NgSf@kzz>WQB8>6~&|h7B8e;1)2vaF_*tEu4A7s!}&d;K39_L7b@A%Mc^1F&1Fy-3(UbCYB8vDEblCfEl2jM;BD(rVYCGdjBFvZsDmf1v0X+y;ME)+Sy>(Mf{ z9xMonUiYA4yqob6g^Eo5dPhwz?eA>y2M+>+MmdN3qC@;tQu=G+D-Jo5%h{qJ;ATh~ zA9Jz$+xx>Iu%g9^H?>;m_|QM7k`DkS(6$>`kf)Xb3mo&+CfEdeg+QMT zdI9lB{A?$S`AM0Xf~KB}UE@243x()j3Rc~m^M@;gI=fzIoGSI(W53s}-XMBvJ@(xa zJ-}EBr@L6Va9lB=GH8PTS;VqTz5Wvdjx#HUQ4Yq%;`w4nMhE^iS;jstPc)m=id>X7 zIb^)z@P2KS_{?|)HxCB5B*3%t;hCp$f6T{f6OtFiWB9y!-^E{KI2?QPV1NXJO>|Kb z^bt?2^YtkVxqK|GF%Mu~Yt3F`n(jR=H3+aB6m$snhx$9z7+n|q(k?Nbtjb>9K*Zw` z$>sOtXIC&M_^(0BW)E@Ku7JSy*gg@Quc8s}U~U3k&qgN>jufNqxN?{)#E5P%{EDF> z=e84Jz1ZjVWa1R1)4SXuPb*b9s*9ruLHU~69jo`zfxKYaLWed$DHZ-oF8zX zQjkb$loLbG)vQEa5OBegyG%=%Gqygf;Qla~S%j z&`Z{%mSaIVXDI$NG&kji33*o0Fs;^>>w%%jS39Lrc@lD1130V#88IK%V!ET8m6edM z^O@~WvRv=-^OeCjNQ&Ic(+{V??G zxKmCZgO=fPlDX|ivxJ(Bfj;yC_uJ2tp?f23@fLF>bfl#!`S_F&oFZWNE8ZWV0Zmyt zQX${xx3u1DMXmqZz%>bg7V}Upx)3&pFr?;FXUGwlLHHU{MUscQ4qghxX|5 z#pht&fLUWf0qlBs(WWO=ryodT=6-1dQ_gVRxA2l-gI{{pxBTtm`$Iq+MHaunxQsKw z#t!nI{6@F@*)e_lI6+#C8#F=shksUz&&UW@;h`U-axdQj%N1ex_s zC*HLEW+J=dZ>$d?63SwY5lh7DokdFZM>MwYg^b zfqmdi$jm%1>a{2Zq8+`LbSV;VrP+(~K>5mlvRtkfGfw@MikUbTsA$h`uIUuZl`}#@ z_S0!-;^!;W`nNb$xTyC=RHB)FU*YR10+vW54uas>JQgJB2PFwogw~0Cm+rJ$Eg$3D zI_2!`;Q*u3=F8c&T9d};k&uv(I>%w+CAVa};emUt)?_Xp~;7CVAD(_!FDC)LiMpFA#Zm zqs_|iJGz4Sc=XWlaQjn!$3w84$>{k?jc+4KbQm(rm~D9NUR4HXsdJFTX#Na& zj%s1HP{W__(C7}R>FBf=MLd)jds^!Rd&TO^_VIB||D^@61Fgm~u-4)AImk;}vJgi` zf(Wq?XeT@XoCz*jbPnYWzDkjLsQinAcH@UcNbvw&8if^dUX;q_bBVUKB4aEDQ{mbsi z)B#dBi56-ckJr}GTAmq;wvHP<%MUh2yLO8M=_#7t#raYdoeCxY$AB|zv@LIz)R^%4xHH*g~u73`O{8~tKskb+iQS$*v@O) z+wtyHtwgT2pv>lNmGjS9mkXR#>Ert5TLl)Kdbs&QG08nBoksV(L)$h(rBW`gGYq9J zj<>|l>nToP0ot}`WTAiI{Wxa zbOaXqUgP=`SsD0?HTWzG3NYM)^E2