From 4e3cddcf48f15117ad585be11a2c4dad8239be12 Mon Sep 17 00:00:00 2001 From: Olaf Heimburger Date: Mon, 10 Aug 2026 11:16:59 +0200 Subject: [PATCH] OCI Security Health Check – Standard Edition script has been merged into the CIS Compliance Script --- .../LICENSE.txt | 35 - .../README.md | 257 +- .../LICENSE.txt | 35 - .../README.md | 399 - .../README.txt | 362 - .../requirements.txt | 9 - .../scripts/cis_reports/cis_reports.py | 6971 ----------------- .../standard.sh | 748 -- .../files/resources/Example_Output.png | Bin 153502 -> 0 bytes ...curity Health Check - Standard - Flyer.pdf | Bin 169956 -> 0 bytes .../OCI_Security_Health_Check_Standard.png | Bin 213483 -> 0 bytes ...curity-health-check-standard-260708.sha512 | 1 - ...ity-health-check-standard-260708.sha512256 | 1 - ...-security-health-check-standard-260708.zip | Bin 104440 -> 0 bytes 14 files changed, 5 insertions(+), 8813 deletions(-) delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/LICENSE.txt delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/LICENSE.txt delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/requirements.txt delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/scripts/cis_reports/cis_reports.py delete mode 100755 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/standard.sh delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/Example_Output.png delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/OCI Security Health Check - Standard - Flyer.pdf delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/OCI_Security_Health_Check_Standard.png delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256 delete mode 100644 oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/LICENSE.txt b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/LICENSE.txt deleted file mode 100644 index 4c17d26263..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/LICENSE.txt +++ /dev/null @@ -1,35 +0,0 @@ -Copyright (c) 2026 Oracle and/or its affiliates. - -The Universal Permissive License (UPL), Version 1.0 - -Subject to the condition set forth below, permission is hereby granted to any -person obtaining a copy of this software, associated documentation and/or data -(collectively the "Software"), free of charge and under any and all copyright -rights in the Software, and any and all patent rights owned or freely -licensable by each licensor hereunder covering either (i) the unmodified -Software as contributed to or provided by such licensor, or (ii) the Larger -Works (as defined below), to deal in both - -(a) the Software, and -(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if -one is included with the Software (each a "Larger Work" to which the Software -is contributed by such licensors), - -without restriction, including without limitation the rights to copy, create -derivative works of, display, perform, and distribute the Software and make, -use, sell, offer for sale, import, export, have made, and have sold the -Software and the Larger Work(s), and to sublicense the foregoing rights on -either these or other terms. - -This license is subject to the following condition: -The above copyright notice and either this complete permission notice or at -a minimum a reference to the UPL must be included in all copies or -substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. \ No newline at end of file diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/README.md b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/README.md index 7111d5a761..8db581cf71 100644 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/README.md +++ b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/README.md @@ -1,256 +1,9 @@ # OCI Security Health Check – Standard Edition -Owner: Olaf Heimburger +## The *OCI Security Health Check – Standard Edition* script has been merged into the *CIS Compliance Script* repository! -Version: 260708 (cis_report.py version 3.2.1) for CIS OCI Foundation Benchmark 3.0.0 - -# Fast Start in OCI Console - -1. Get your copy of the [CIS Oracle Cloud Infrastructure Foundations Benchmark](https://www.cisecurity.org/benchmark/Oracle_Cloud). -2. Download the package - ``` - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 - sha512sum -c oci-security-health-check-standard-260708.sha512 - unzip -q oci-security-health-check-standard-260708.zip - ``` -3. Hit the Enter-Key -4. Run the script - ``` - cd oci-security-health-check-standard-260708 - ./standard.sh - ``` -5. Follow the instructions for getting the results. - - -# Introduction -![Flyer](./files/resources/OCI_Security_Health_Check_Standard.png) - -[Download the flyer](./files/resources/OCI%20Security%20Health%20Check%20-%20Standard%20-%20Flyer.pdf) - -## When to use this asset? - -The *OCI Security Health Check - Standard Edition* checks your OCI tenancy for [CIS Oracle Cloud Infrastructure Foundations Benchmark](https://www.cisecurity.org/benchmark/Oracle_Cloud) compliance. - -## Disclaimer - -This asset covers the OCI platform as specified in the *CIS Oracle Cloud Infrastructure Foundations Benchmark*, only. Any workload provisioned in Databases, Compute VMs (running any Operating System), the Container Engine for Kubernetes, or in the VMware Solution is *out of scope* of the *OCI Security Health Check*. - -**This is not an official Oracle application and it is not supported by Oracle Support.** - -## Before you begin - -To make the usage of this script as smooth as possible: - -- **Download** the **[CIS Oracle Cloud Infrastructure Foundations Benchmark](https://www.cisecurity.org/benchmark/Oracle_Cloud)** and consider printing it. -- **Read two or three recommendations** to get used to the terminologies used in the benchmark. -- Make sure the required policy statements have been updated. **Please review and update your tenancy configuration.** -- **For a quick and smooth run (including all regions), this script requires an Internet connection.** -- **Running the script in OCI Cloud Shell with OCI Service Gateway network setup, only the home region of the tenancy will be checked!** - -## Benefits of this package - -The file `standard.sh` acts as the main entry point and does the following: - -- Make the run as easy and smooth as possible. -- Do not affect your desktop whenever possible. -- Automatic check for Python runtime version. -- Automatic venv creation and activation. -- Automatic installation of required Python libraries. -- Automatic **OCI Cloud Shell** and tenancy name detection. -- Automated Internet access detection. -- Automatic creation of timestamped output directory. -- Call of `cis_reports.py`. -- Automatic output archive (ZIP file) creation. -- Automatic runtime protocol. -- Support for encrypted archive (ZIP file). - -This package includes *two* files -- standard.sh -- scripts/cis_reports/cis_reports.py - -It was tested on **OCI Cloud Shell** with **Public network**, **OCI Cloud Shell** with **OCI Service network**, **Oracle Linux**, **MacOS 12** and higher. - -## Complete Runtime Example - -See the *OCI Security Health Check - Standard Edition* in action and watch the [OCI Health Checks - Self Service video](https://www.youtube.com/watch?v=EzjKLxfxaAM). - -# Getting Started with the *OCI Security Health Check - Standard Edition* - -## Download and verify the release file - -Before running the *OCI Security Health Check - Standard Edition* you should download and verify it. - - - Download the latest distribution [oci-security-health-check-standard-260708.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip). - - Download the respective checksum file: - - [oci-security-health-check-standard-260708.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512). - - [oci-security-health-check-standard-260708.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256). - - Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory). - - On MacOS: - ``` - cd - shasum -a 512256 -c oci-security-health-check-standard-260708.sha512256 - ``` - - On Linux (including Cloud Shell): - ``` - cd - sha512sum -c oci-security-health-check-standard-260708.sha512 - ``` - -**Reject the downloaded file if the check fails!** - -### In OCI Cloud Shell - -The recommended way is to run the *OCI Security Health Check - Standard* in the [OCI Cloud Shell](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm). It does not require any additional configuration on a local desktop machine. - -#### With Internet Access - -In OCI Cloud Shell with Internet Access you can do a short cut without downloading the files mentioned above to your desktop: - -1. Login to your OCI console. -2. Open Cloud Shell -3. Run these commands in your Cloud Shell: - ``` - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 - sha512sum -c oci-security-health-check-standard-260708.sha512 - unzip -q oci-security-health-check-standard-260708.zip - ``` - -#### With OCI Service Network - -[!NOTE] -> A Cloud Shell with OCI Service Network can run the *OCI Security Health Check - Standard Edition* in and for your **home region only**! This is a [Cloud Shell limitation](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm#Cloud_Shell_Limitations). +> Please, get the latest version from the [CIS Compliance Script repository](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart). > -> Additionally, the output may **not** include the overview diagrams and the XLSX file! - -In OCI Cloud Shell with OCI Service Network Access you have to do the following: - -1. Download and verify the package (see **Download and verify the release file**). -2. Login to your OCI console. -3. Open Cloud Shell. -4. Upload the ZIP file to your Cloud Shell. -5. Unzip the ZIP file in the home directory. - ``` - cd - unzip -q oci-security-health-check-standard-260708.zip - ``` -6. Run the script **in your home region**. - -## Prepare the OCI Tenancy - -### Single Run - -You can run the assessment as a member of the OCI `Administrator` group or -create a group for auditing and assign the respective user to it. - -Running the assessment script as an OCI `Administrator` is the easiest and -quickest way. If you decide to use this option, please continue reading in -[Run the OCI Security Health Check in Cloud Shell](./files/oci-security-health-check-standard/README.md#run_cloud_shell). - -### Recurring usage - -For recurring usage, setting up a group for auditing is recommended. For setting this up follow the steps documented in the next section. -This applies for scenarios using the OCI Cloud Shell with public Internet access. For additional usage scenarios see the detailed instructions [README](./files/oci-security-health-check-standard/README.md). - -### Setting up an *Auditor* group and policy - -Using an auditor group is the recommended way to run the assessment script. -To create a group for auditing do the following steps: - - - Log into OCI Console as OCI administrator. - - In your Default domain create a group `grp-auditors` - - Create a policy `pcy-auditing` with these statements (if your tenancy does not have Domains, replace `'Default'/'grp-auditors'` with `grp-auditors`): - ``` - allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy - allow group 'Default'/'grp-auditors' to read audit-events in tenancy - allow group 'Default'/'grp-auditors' to read buckets in tenancy - allow group 'Default'/'grp-auditors' to read capture-filters in tenancy - allow group 'Default'/'grp-auditors' to read data-safe-family in tenancy - allow group 'Default'/'grp-auditors' to read domains in tenancy - allow group 'Default'/'grp-auditors' to read file-family in tenancy - allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy - allow group 'Default'/'grp-auditors' to read instances in tenancy - allow group 'Default'/'grp-auditors' to read keys in tenancy - allow group 'Default'/'grp-auditors' to read load-balancers in tenancy - allow group 'Default'/'grp-auditors' to read logging-family in tenancy - allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy - allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy - allow group 'Default'/'grp-auditors' to read public-ips in tenancy - allow group 'Default'/'grp-auditors' to read resource-availability in tenancy - allow group 'Default'/'grp-auditors' to read tag-namespaces in tenancy - allow group 'Default'/'grp-auditors' to read usage-budgets in tenancy - allow group 'Default'/'grp-auditors' to read usage-reports in tenancy - allow group 'Default'/'grp-auditors' to read users in tenancy - allow group 'Default'/'grp-auditors' to read vaults in tenancy - allow group 'Default'/'grp-auditors' to read vss-family in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell-public-network in tenancy - allow group 'Default'/'grp-auditors' to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - ``` - - Assign a user to the `grp-auditors` group. - - Log out of the OCI Console. - -## Run the OCI Security Health Check in OCI Cloud Shell - -For a detailed description go to [Run the OCI Security Health Check in OCI Cloud Shell](./files/oci-security-health-check-standard/README.md#run_cloud_shell) - -## Sample Output - -After a completed run you will find a directory with a name starting with your tenancy name followed by a timestamp in your working directory (like `tenancy_name_YYYYMMDDHHmmss_standard`). A zip archive for easier download using the same name will be created, too. Both hold data files for your review. - -To start with reviewing the results, open the file named `tenancy_name_YYYYMMDDHHmmss_standard_cis_summary_report.html`. - -It may look like this example: -![Example](./files/resources/Example_Output.png) - -## How to read the report - -The file named `tenancy_name_YYYYMMDDHHmmss_standard_cis_summary_report.html` is your starting point. - -You will find four tabs: - -1. **Compliant** - All compliant recommendations. -1. **Non-compliant** - All non-compliant recommendations (findings). Each entry has links to the recommendation description and to the non-compliant resources (as CSV file). -1. **Details** - Details for all non-compliant recommendation. These short introductions to the recommendation copied from the [CIS Oracle Cloud Infrastructure Foundations Benchmark](https://www.cisecurity.org/benchmark/Oracle_Cloud). -1. **Resources** - A list of references for security related documentation for OCI. - -# Advanced Use - -The script `standard.sh` supports additional commandline options: - -- `-h` prints a summary of supported options -- `-v` prints the versions of the components used -- `--cis 'options'` if you need to pass additional options to the cis-report.py. Always use single qoutes around the options. Examples: - - `--cis '-h'` prints the options of cis_report.py - - `--cis '--debug'` runs cis_report.py in debug mode with additional output -- `--zip-protect` asks for a password of your choice. Zero-length passwords are not supported! -- `--redact` redacts sensitive information (e.g., OCIDs, emails) - -# Known Issues - -1. Python 3.8 is not supported anymore. - OCI Cloud Shell is the minimal required environment. The Python version used in OCI Cloud Shell is 3.9. -2. Diagrams are not part of the HTML page. - This may be because of broken `numpy installation`. The following command should resolve this: - `pip3 install --upgrade --force-reinstall --user numpy` - -# Credits - -The *OCI Security Health Check - Standard Edition* streamlines the usage of the [CIS Compliance Script](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/blob/main/README.md). - -The *OCI Security Health Check - Standard Edition* would not be possible without the great work of the [CIS OCI Landing Zone Quick Start Template Team](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/graphs/contributors). - -# Certification - -The CIS Compliance Script has been certified by the [CIS Center of Internet Security for the OCI Oracle Cloud Foundation Benchmark v3.0.0, Level 1 and 2](https://www.cisecurity.org/partner/oracle). - -# License - -Copyright (c) 2022-2026 Oracle and/or its affiliates. - -Licensed under the Universal Permissive License (UPL), Version 1.0. - -See [LICENSE.txt](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE.txt) for more details. +> Start with the [README](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/blob/main/README.md#script_standard) as the instructions have been updated to accommodate the new structure. +> +> Don't forget to update your bookmark. \ No newline at end of file diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/LICENSE.txt b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/LICENSE.txt deleted file mode 100644 index 200b2828b1..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/LICENSE.txt +++ /dev/null @@ -1,35 +0,0 @@ -Copyright (c) 2026 Oracle and/or its affiliates. - -The Universal Permissive License (UPL), Version 1.0 - -Subject to the condition set forth below, permission is hereby granted to any -person obtaining a copy of this software, associated documentation and/or data -(collectively the "Software"), free of charge and under any and all copyright -rights in the Software, and any and all patent rights owned or freely -licensable by each licensor hereunder covering either (i) the unmodified -Software as contributed to or provided by such licensor, or (ii) the Larger -Works (as defined below), to deal in both - -(a) the Software, and -(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if -one is included with the Software (each a "Larger Work" to which the Software -is contributed by such licensors), - -without restriction, including without limitation the rights to copy, create -derivative works of, display, perform, and distribute the Software and make, -use, sell, offer for sale, import, export, have made, and have sold the -Software and the Larger Work(s), and to sublicense the foregoing rights on -either these or other terms. - -This license is subject to the following condition: -The above copyright notice and either this complete permission notice or at -a minimum a reference to the UPL must be included in all copies or -substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md deleted file mode 100644 index 42f27f919d..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md +++ /dev/null @@ -1,399 +0,0 @@ -# OCI Security Health Check – Standard Edition - -Owner: Olaf Heimburger - -Version: 260708 (cis_report.py version 3.2.1) for CIS OCI Foundation Benchmark 3.0.0 - -## When to use this asset? - -The *OCI Security Health Check - Standard Edition* checks an OCI tenancy for CIS OCI Foundation Benchmark compliance. - -### Disclaimer - -This asset covers the OCI platform as specified in the *CIS Oracle Cloud Infrastructure Foundations Benchmark*, only. Any workload provisioned in Databases, Compute VMs (running any Operating System), the Container Engine for Kubernetes, or in the VMware Solution is *out of scope* of the *OCI Security Health Check*. - -**This is not an official Oracle application and it is not supported by Oracle Support.** - -## Before you begin - -To make the usage of this script as smooth as possible: - -- **Download** the **[CIS Oracle Cloud Infrastructure Foundations Benchmark](https://www.cisecurity.org/benchmark/Oracle_Cloud)** and consider printing it. -- **Read two or three recommendations** to get used to the terminologies used in the benchmark. -- Make sure the required policy statements have been updated. **Please review and update your tenancy configuration.** -- **For a quick and smooth run, this script requires an Internet connection.** - -## Benefits of this package - -The file `standard.sh` acts as the main entry point and does the following: - -- Make the run as easy and smooth as possible. -- Do not affect your desktop whenever possible. -- Automatic check for Python runtime version. -- Automatic venv creation and activation. -- Automatic installation of required Python libraries. -- Automatic **OCI Cloud Shell** and tenancy name detection. -- Automated Internet access detection. -- Automatic creation of timestamped output directory. -- Call of `cis_reports.py`. -- Automatic output archive (ZIP file) creation. -- Automatic runtime protocol. -- Support for encrypted archive (ZIP file). - -This package includes *two* files -- standard.sh -- scripts/cis_reports/cis_reports.py - -It was tested on **OCI Cloud Shell** with **Public network**, **OCI Cloud Shell** with **OCI Service network**, **Oracle Linux**, **MacOS 12** and higher. - -## Usage - -### Download and verify the release file - -Before running the *OCI Security Health Check - Standard Edition* you should download and verify it. - - - Download the latest distribution [oci-security-health-check-standard-260708.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip). - - Download the respective checksum file: - - [oci-security-health-check-standard-260708.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512). - - [oci-security-health-check-standard-260708.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256). - - Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory). - - On MacOS: - ``` - cd - shasum -a 512256 -c oci-security-health-check-standard-260708.sha512256 - ``` - - On Linux (including Cloud Shell): - ``` - cd - sha512sum -c oci-security-health-check-standard-260708.sha512 - ``` - -**Reject the downloaded file when the check fails!** - -### Prepare the OCI Tenancy - -You can run the assessment as a member of the OCI `Administrator` group or -create a group for auditing and assign the respective user to it. - -Running the assessment script as an OCI `Administrator` is the easiest and -quickest way. If you decide to use this option, please continue reading in -[Run the OCI Security Health Check in Cloud Shell](#run-the-oci-security-health-check-in-cloud-shell). - -For recurring usage, setting up a group for auditing is recommended. The -steps for setting this up are described in the next chapter. - -#### Setting up an *Auditor* group and related permissions - -Using an auditor group is the recommended way to run the assessment script. -To create a group for auditing do the following steps: - - - Check whether your tenancy is still not migrated to Identity Domains: - - Login to OCI Console as OCI administrator - - Select "Identity & Security" - - If "Domains" are listed you are migrated to Identity Domains - - Create a group `grp-auditors` - - Create a policy `pcy-auditing` with these statements: - - For tenancies **with** Identity Domains use - ``` - allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy - allow group 'Default'/'grp-auditors' to read audit-events in tenancy - allow group 'Default'/'grp-auditors' to read buckets in tenancy - allow group 'Default'/'grp-auditors' to read capture-filters in tenancy - allow group 'Default'/'grp-auditors' to read data-safe-family in tenancy - allow group 'Default'/'grp-auditors' to read domains in tenancy - allow group 'Default'/'grp-auditors' to read file-family in tenancy - allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy - allow group 'Default'/'grp-auditors' to read instances in tenancy - allow group 'Default'/'grp-auditors' to read keys in tenancy - allow group 'Default'/'grp-auditors' to read load-balancers in tenancy - allow group 'Default'/'grp-auditors' to read logging-family in tenancy - allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy - allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy - allow group 'Default'/'grp-auditors' to read public-ips in tenancy - allow group 'Default'/'grp-auditors' to read resource-availability in tenancy - allow group 'Default'/'grp-auditors' to read tag-namespaces in tenancy - allow group 'Default'/'grp-auditors' to read usage-budgets in tenancy - allow group 'Default'/'grp-auditors' to read usage-reports in tenancy - allow group 'Default'/'grp-auditors' to read users in tenancy - allow group 'Default'/'grp-auditors' to read vaults in tenancy - allow group 'Default'/'grp-auditors' to read vss-family in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell-public-network in tenancy - allow group 'Default'/'grp-auditors' to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - - ``` - - For older tenancies **without** Identity Domains use - ``` - allow group grp-auditors to inspect all-resources in tenancy - allow group grp-auditors to read audit-events in tenancy - allow group grp-auditors to read buckets in tenancy - allow group grp-auditors to read capture-filters in tenancy - allow group grp-auditors to read data-safe-family in tenancy - allow group grp-auditors to read domains in tenancy - allow group grp-auditors to read file-family in tenancy - allow group grp-auditors to read instance-configurations in tenancy - allow group grp-auditors to read instances in tenancy - allow group grp-auditors to read keys in tenancy - allow group grp-auditors to read load-balancers in tenancy - allow group grp-auditors to read logging-family in tenancy - allow group grp-auditors to read nat-gateways in tenancy - allow group grp-auditors to read network-security-groups in tenancy - allow group grp-auditors to read public-ips in tenancy - allow group grp-auditors to read resource-availability in tenancy - allow group grp-auditors to read tag-namespaces in tenancy - allow group grp-auditors to read usage-budgets in tenancy - allow group grp-auditors to read usage-reports in tenancy - allow group grp-auditors to read users in tenancy - allow group grp-auditors to read vaults in tenancy - allow group grp-auditors to read vss-family in tenancy - allow group grp-auditors to use cloud-shell in tenancy - allow group grp-auditors to use cloud-shell-public-network in tenancy - allow group grp-auditors to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - ``` - - Assign a user to the `grp-auditors` group - - Log out of the OCI Console - -### Run the OCI Security Health Check in OCI Cloud Shell - -### OCI Cloud Shell - -The recommended way is to run the *OCI Security Health Check - Standard* in the [OCI Cloud Shell](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm). It does not require any additional configuration on a local desktop machine. - -#### Networking Options for OCI Cloud Shell - -OCI Cloud Shell sessions do not allow for any incoming connections, and there is no public IP address available. - -For details on OCI Cloud Shell Networking refer to [OCI Cloud Shell Networking](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro_topic-Cloud_Shell_Networking.htm#cloudshellintro_topic-Cloud_Shell_Networking) documentation. - -### OCI Cloud Shell With Internet Access - -In OCI Cloud Shell with Internet Access you can do a short cut without downloading the files mentioned above to your desktop. - -#### Required IAM Policy statements - -The following policy statement is part of the recommended policy statements for the `grp-auditors` group, for example: -``` -allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy -allow group 'Default'/'grp-auditors' to use cloud-shell-public-network in tenancy -``` - -#### Installing and running the script - -1. Login to your OCI console. -2. Open Cloud Shell -3. Run these commands in your Cloud Shell: - ``` - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 - sha512sum -c oci-security-health-check-standard-260708.sha512 - unzip -q oci-security-health-check-standard-260708.zip - ``` -#### Run the script - - Change directory into `oci-security-health-check-standard-260708`: - ``` - cd oci-security-health-check-standard-260708 - ``` - - In the `oci-security-health-check-standard-260708` directory: - - Enable execution of script `standard.sh`: - ``` - chmod +x standard.sh - ``` - - Run the script for all subscribed regions: - ``` - ./standard.sh - ``` - - Run the script for one subscribed region: - ``` - ./standard.sh -r - ``` - - Get command line options: - ``` - ./standard.sh -h - ``` - -#### OCI Cloud Shell With OCI Service Network - -[!NOTE] -> A Cloud Shell with OCI Service Network can run the *OCI Security Health Check - Standard Edition* in and for your **home region only**! This is a [Cloud Shell limitation](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm#Cloud_Shell_Limitations). - -#### Required IAM Policy statements - -The following policy statement is part of the recommended policy statements for the `grp-auditors` group, for example: -``` -allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy -``` - -#### Installing and running the script - -In OCI Cloud Shell with OCI Service Network Access you have to do the following: - -1. Download and verify the package (see **Download and verify the release file**). -2. Login to your OCI console. -3. Open Cloud Shell. -4. Upload the ZIP file to your Cloud Shell. -5. Unzip the ZIP file in the home directory. - ``` - cd - unzip -q oci-security-health-check-standard-260708.zip - ``` - -#### Run the script - - Change directory into `oci-security-health-check-standard-260708`: - ``` - cd oci-security-health-check-standard-260708 - ``` - - In the `oci-security-health-check-standard-260708` directory: - - Enable execution of script `standard.sh`: - ``` - chmod +x standard.sh - ``` - - Run the script for all subscribed regions: - ``` - ./standard.sh - ``` - - Get command line options: - ``` - ./standard.sh -h - ``` - The the region option (`-r`) will be ignored automatically! - - -### Using an OCI Compute VM (Oracle Linux) - - - Create a Dynamic Group - `'Default'/'dgp-instance-principal'` - - This dynamic group must specify the compartment OCID (`resource.compartment.id`) or the Compute VM OCID (`resource.instance.id`), respectively. - - Create permissions for the Dynamic Group - ``` - allow dynamic-group 'Default'/'dgp-instance-principal' to inspect all-resources in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read audit-events in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read buckets in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read capture-filters in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read data-safe-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read domains in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read file-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read instance-configurations in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read instances in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read keys in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read load-balancers in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read logging-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read nat-gateways in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read network-security-groups in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read public-ips in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read resource-availability in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read tag-namespaces in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read usage-budgets in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read usage-reports in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read users in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read vaults in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read vss-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use cloud-shell in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use cloud-shell-public-network in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - ``` - - Preparing the Compute VM: - - Log into the Compute VM - - Make sure that Python 3 is installed: - ``` - sudo yum list python39 - ``` - - If Python 3 is missing, install it: - ``` - sudo yum install python39 -y - ``` - - Update the link of python3 to /usr/bin/python3.9 - ``` - sudo alternatives --config python3 - ``` - Follow the instructions to select /usr/bin/python3.9 - - Log out - - - From your desktop, upload the `oci-security-health-check-standard-260708.zip` file to the Compute VM using any SFTP client. - - Log into the Compute VM - - Extract the distribution - ``` - unzip -q oci-security-health-check-standard-260708.zip - ``` - - Change directory into `oci-security-health-check-standard`: - ``` - cd oci-security-health-check-standard - ``` - - Enable execution of script `standard.sh`: - ``` - chmod +x standard.sh - ``` - - In the `oci-security-health-check-standard` directory run the assess.sh - script. - - Start the `screen` program: - ``` - screen - ``` - - - Run the script for all subscribed regions: - ``` - ./standard.sh -ip -t - ``` - - Run the script for one subscribed region, only: - ``` - ./standard.sh -ip -t -r - ``` - - Get command line options: - ``` - ./standard.sh -h - ``` - - When your Compute VM session has been ended due to inactivity you can - resume without starting the script again. - - To resume the screen session, follow these steps - (the output will be different in your *Compute VM*): - - Connect to your *Compute VM* again. - ``` - screen -ls - 1234.text - screen -d 1234 - screen -r 1234 - ``` - -### Getting the results - - In the directory `oci-security-health-check-standard` a directory will be created which - holds all the output created by the scripts. This directory will be - compressed in a single ZIP file and the resulting ZIP file will be moved to - the parent directory of `oci-security-health-check-standard`. - -### Checking the results - -The report results are showing the compliance status of the related [CIS OCI Foundation Benchmark, version 2.0](https://www.cisecurity.org/benchmark/Oracle_Cloud) recommendations. Please download this benchmark before reading the report. (For license reasons, we cannot distribute the benchmark.) - -The report results are summarized in two files: -- *tenancy_name_YYYYMMDDHHmmss_standard_cis_summary_report.html* – The report in HTML that displays the all recommendations and their compliance status, respectively. -- *tenancy_name_YYYYMMDDHHmmss_standard_Consolidate_Report.xslx* – An XSLX workbook with a summary and sheets for the non-compliant recommendations. - -## Known Issues - -1. Python 3.8 is not supported anymore. - OCI Cloud Shell is the minimal required environment. The Python version used in OCI Cloud Shell is 3.9. -2. Diagrams are not part of the HTML page. - This may be because of broken `numpy installation`. The following command should resolve this: - `pip3 install --upgrade --force-reinstall --user numpy` - -## Credits - -The *OCI Security Health Check - Standard Edition* streamlines the usage of the [CIS Compliance Script](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/blob/main/README.md). - -The *OCI Security Health Check - Standard Edition* would not be possible without the great work of the [CIS OCI Landing Zone Quick Start Template Team](https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/graphs/contributors). - -## Certification - -The CIS Compliance Script has been certified by the [CIS Center of Internet Security for the OCI Oracle Cloud Foundation Benchmark v3.0.0, Level 1 and 2](https://www.cisecurity.org/partner/oracle). - -## License - -Copyright (c) 2022-2026 Oracle and/or its affiliates. - -Licensed under the Universal Permissive License (UPL), Version 1.0. - -See [LICENSE.txt](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE.txt) for more details. - diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt deleted file mode 100644 index 41dea8d2e6..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt +++ /dev/null @@ -1,362 +0,0 @@ - -OCI Security Health Check - Standard Edition -============================================ - -Owner: Olaf Heimburger - -Version: 260708 (cis_report.py version 3.2.1) for CIS OCI Foundation Benchmark 3.0.0 - -1 When to use this asset? - -The OCI Security Health Check - Standard Edition checks an OCI tenancy for CIS OCI Foundation Benchmark compliance. - -1.1 Disclaimer - -This asset covers the OCI platform as specified in the CIS Oracle Cloud Infrastructure Foundations Benchmark, only. Any workload provisioned in Databases, Compute VMs (running any Operating System), the Container Engine for Kubernetes, or in the VMware Solution is out of scope of the OCI Security Health Check. - -This is not an official Oracle application and it is not supported by Oracle Support. - -1.2 Before you begin - -To make the usage of this script as smooth as possible: - -- Download the CIS Oracle Cloud Infrastructure Foundations Benchmark (https://www.cisecurity.org/benchmark/Oracle_Cloud) and consider printing it. -- Read two or three recommendations to get used to the terminologies used in the benchmark. -- Make sure the required policy statements have been updated. Please review and update your tenancy configuration. -- For a quick and smooth run, this script requires an Internet connection. - -1.3 Benefits of this package - -The file 'standard.sh' acts as the main entry point and does the following: - -- Make the run as easy and smooth as possible. -- Do not affect your desktop whenever possible. -- Automatic check for Python runtime version. -- Automatic venv creation and activation. -- Automatic installation of required Python libraries. -- Automatic OCI Cloud Shell and tenancy name detection. -- Automated Internet access detection. -- Automatic creation of timestamped output directory. -- Call of 'cis_reports.py'. -- Automatic output archive (ZIP file) creation. -- Automatic runtime protocol. -- Support for encrypted archive (ZIP file). - -This package includes two files -- standard.sh -- scripts/cis_reports/cis_reports.py - -It was tested on OCI Cloud Shell with Public network, OCI Cloud Shell with OCI Service network, Oracle Linux, MacOS 12 and higher. - -2 Usage - -2.1 Download and verify the release file - -Before running the OCI Security Health Check - Standard Edition you should download and verify it. - - - Download the latest distribution oci-security-health-check-standard-260708.zip (https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip). - - Download the respective checksum file: - - oci-security-health-check-standard-260708.sha512 (https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512). - - oci-security-health-check-standard-260708.sha512256 (https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256). - - Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory). - - On MacOS: - cd - shasum -a 512256 -c oci-security-health-check-standard-260708.sha512256 - - On Linux (including Cloud Shell): - cd - sha512sum -c oci-security-health-check-standard-260708.sha512 - -Reject the downloaded file when the check fails! - -2.2 Prepare the OCI Tenancy - -You can run the assessment as a member of the OCI 'Administrator' group or - create a group for auditing and assign the respective user to it. - -Running the assessment script as an OCI 'Administrator' is the easiest and -quickest way. If you decide to use this option, please continue reading in -Run the OCI Security Health Check in Cloud Shell (#run-the-oci-security-health-check-in-cloud-shell). - - For recurring usage, setting up a group for auditing is recommended. The - steps for setting this up are described in the next chapter. - -2.2.1 Setting up an Auditor group and related permissions - -Using an auditor group is the recommended way to run the assessment script. -To create a group for auditing do the following steps: - - - Check whether your tenancy is still not migrated to Identity Domains: - - Login to OCI Console as OCI administrator - - Select "Identity & Security" - - If "Domains" are listed you are migrated to Identity Domains - - Create a group 'grp-auditors' - - Create a policy 'pcy-auditing' with these statements: - - For tenancies with Identity Domains use - allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy - allow group 'Default'/'grp-auditors' to read audit-events in tenancy - allow group 'Default'/'grp-auditors' to read buckets in tenancy - allow group 'Default'/'grp-auditors' to read capture-filters in tenancy - allow group 'Default'/'grp-auditors' to read data-safe-family in tenancy - allow group 'Default'/'grp-auditors' to read domains in tenancy - allow group 'Default'/'grp-auditors' to read file-family in tenancy - allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy - allow group 'Default'/'grp-auditors' to read instances in tenancy - allow group 'Default'/'grp-auditors' to read keys in tenancy - allow group 'Default'/'grp-auditors' to read load-balancers in tenancy - allow group 'Default'/'grp-auditors' to read logging-family in tenancy - allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy - allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy - allow group 'Default'/'grp-auditors' to read public-ips in tenancy - allow group 'Default'/'grp-auditors' to read resource-availability in tenancy - allow group 'Default'/'grp-auditors' to read tag-namespaces in tenancy - allow group 'Default'/'grp-auditors' to read usage-budgets in tenancy - allow group 'Default'/'grp-auditors' to read usage-reports in tenancy - allow group 'Default'/'grp-auditors' to read users in tenancy - allow group 'Default'/'grp-auditors' to read vaults in tenancy - allow group 'Default'/'grp-auditors' to read vss-family in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy - allow group 'Default'/'grp-auditors' to use cloud-shell-public-network in tenancy - allow group 'Default'/'grp-auditors' to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - - - For older tenancies without Identity Domains use - allow group grp-auditors to inspect all-resources in tenancy - allow group grp-auditors to read audit-events in tenancy - allow group grp-auditors to read buckets in tenancy - allow group grp-auditors to read capture-filters in tenancy - allow group grp-auditors to read data-safe-family in tenancy - allow group grp-auditors to read domains in tenancy - allow group grp-auditors to read file-family in tenancy - allow group grp-auditors to read instance-configurations in tenancy - allow group grp-auditors to read instances in tenancy - allow group grp-auditors to read keys in tenancy - allow group grp-auditors to read load-balancers in tenancy - allow group grp-auditors to read logging-family in tenancy - allow group grp-auditors to read nat-gateways in tenancy - allow group grp-auditors to read network-security-groups in tenancy - allow group grp-auditors to read public-ips in tenancy - allow group grp-auditors to read resource-availability in tenancy - allow group grp-auditors to read tag-namespaces in tenancy - allow group grp-auditors to read usage-budgets in tenancy - allow group grp-auditors to read usage-reports in tenancy - allow group grp-auditors to read users in tenancy - allow group grp-auditors to read vaults in tenancy - allow group grp-auditors to read vss-family in tenancy - allow group grp-auditors to use cloud-shell in tenancy - allow group grp-auditors to use cloud-shell-public-network in tenancy - allow group grp-auditors to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - - - Assign a user to the 'grp-auditors' group - - Log out of the OCI Console - -2.3 Run the OCI Security Health Check in OCI Cloud Shell - -2.3.1 OCI Cloud Shell - -The recommended way is to run the *OCI Security Health Check - Standard* in the OCI Cloud Shell -(https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm). It does not -require any additional configuration on a local desktop machine. - -2.3.1.1 Networking Options for OCI Cloud Shell - -OCI Cloud Shell sessions do not allow for any incoming connections, and there is no public IP address available. - -For details on OCI Cloud Shell Networking refer to OCI Cloud Shell Networking -(https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro_topic-Cloud_Shell_Networking.htm#cloudshellintro_topic-Cloud_Shell_Networking) documentation. - -2.3.2 OCI Cloud Shell With Internet Access - -In OCI Cloud Shell with Internet Access you can do a short cut without downloading the files mentioned above to your desktop. - -2.3.2.1 Required IAM Policy statements - -The following policy statement is part of the recommended policy statements for the 'grp-auditors' group, for example: -allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy -allow group 'Default'/'grp-auditors' to use cloud-shell-public-network in tenancy - -2.3.2.2 Installing and running the script - -1. Login to your OCI console. -2. Open Cloud Shell -3. Run these commands in your Cloud Shell: - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip - wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 - sha512sum -c oci-security-health-check-standard-260708.sha512 - unzip -q oci-security-health-check-standard-260708.zip - -2.3.2.3 Run the script - - Change directory into 'oci-security-health-check-standard-260708': - cd oci-security-health-check-standard-260708 - - In the 'oci-security-health-check-standard-260708' directory: - - Enable execution of script 'standard.sh': - chmod +x standard.sh - - Run the script for all subscribed regions: - ./standard.sh - - Run the script for one subscribed region: - ./standard.sh -r - - Get command line options: - ./standard.sh -h - -2.3.3 OCI Cloud Shell With OCI Service Network - -NOTE -A Cloud Shell with OCI Service Network can run the 'OCI Security Health Check - Standard Edition' -in and for your home region only! -This is a Cloud Shell limitation -(https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cloudshellintro.htm#Cloud_Shell_Limitations). - -Additionally, the output may **not** include the overview diagrams and the XLSX file! - -2.3.3.1 Required IAM Policy statements - -The following policy statement is part of the recommended policy statements for the 'grp-auditors' -group, for example: -allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy - -2.3.3.2 Installing and running the script - -In OCI Cloud Shell with OCI Service Network Access you have to do the following: - -1. Download and verify the package (see 'Download and verify the release file'). -2. Login to your OCI console. -3. Open Cloud Shell. -4. Upload the ZIP file to your Cloud Shell. -5. Unzip the ZIP file in the home directory. - cd - unzip -q oci-security-health-check-standard-260708.zip - -2.3.3.3 Run the script - - Change directory into 'oci-security-health-check-standard-260708': - cd oci-security-health-check-standard-260708 - - In the 'oci-security-health-check-standard-260708' directory: - - Enable execution of script 'standard.sh': - chmod +x standard.sh - - Run the script for all subscribed regions: - ./standard.sh - - Get command line options: - ./standard.sh -h - The the region option ('-r') will be ignored automatically! - - Follow the instructions for any other subscribed region. - -2.4 Using an OCI Compute VM (Oracle Linux) - - - Create a Dynamic Group - ''Default'/'dgp-instance-principal'' - - This dynamic group must specify the compartment OCID ('resource.compartment.id') - or the Compute VM OCID ('resource.instance.id'), respectively. - - Create permissions for the Dynamic Group - allow dynamic-group 'Default'/'dgp-instance-principal' to inspect all-resources in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read audit-events in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read buckets in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read capture-filters in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read data-safe-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read domains in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read file-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read instance-configurations in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read instances in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read keys in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read load-balancers in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read logging-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read nat-gateways in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read network-security-groups in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read public-ips in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read resource-availability in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read tag-namespaces in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read usage-budgets in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read usage-reports in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read users in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read vaults in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to read vss-family in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use cloud-shell in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use cloud-shell-public-network in tenancy - allow dynamic-group 'Default'/'dgp-instance-principal' to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/} - - Preparing the Compute VM: - - Log into the Compute VM - - Make sure that Python 3 is installed: - sudo yum list python39 - - If Python 3 is missing, install it: - sudo yum install python39 -y - - Update the link of python3 to /usr/bin/python3.9 - sudo alternatives --config python3 - Follow the instructions to select /usr/bin/python3.9 - - Log out - - - From your desktop, upload the 'oci-security-health-check-standard-260708.zip' file to the Compute VM using any SFTP client. - - Log into the Compute VM - - Extract the distribution - unzip -q oci-security-health-check-standard-260708.zip - - Change directory into 'oci-security-health-check-standard': - cd oci-security-health-check-standard - - Enable execution of script 'standard.sh': - chmod +x standard.sh - - In the 'oci-security-health-check-standard' directory run the assess.sh - script. - - Start the 'screen' program: - screen - - - Run the script for all subscribed regions: - ./standard.sh -ip -t - - Run the script for one subscribed region, only: - ./standard.sh -ip -t -r - - Get command line options: - ./standard.sh -h - - When your Compute VM session has been ended due to inactivity you can - resume without starting the script again. - - To resume the screen session, follow these steps - (the output will be different in your Compute VM): - - Connect to your Compute VM again. - screen -ls - 1234.text - screen -d 1234 - screen -r 1234 - -3 Getting the results - - In the directory 'oci-security-health-check-standard' a directory will be created which - holds all the output created by the scripts. This directory will be - compressed in a single ZIP file and the resulting ZIP file will be moved to - the parent directory of 'oci-security-health-check-standard'. - -4 Checking the results - -The report results are showing the compliance status of the related CIS OCI Foundation Benchmark, -version 3.1.0 (https://www.cisecurity.org/benchmark/Oracle_Cloud) recommendations. Please download -this benchmark before reading the report. (For license reasons, we cannot distribute the benchmark.) - - The report results are summarized in two files: -- tenancy_name_YYYYMMDDHHmmss_standard_cis_summary_report.html – The report in HTML that displays the all recommendations and their - compliance status, respectively. -- tenancy_name_YYYYMMDDHHmmss_standard_Consolidate_Report.xslx – An XSLX workbook with a summary and sheets for the non-compliant - recommendations. - -5 Known Issues - -1. Python 3.8 is not supported anymore. - OCI Cloud Shell is the minimal required environment. The Python version used in OCI Cloud Shell is 3.9. -2. Diagrams are not part of the HTML page. - This may be because of broken 'numpy installation'. The following command should resolve this: - 'pip3 install --upgrade --force-reinstall --user numpy' - -6 Credits - -The OCI Security Health Check - Standard Edition streamlines the usage of the CIS Compliance Script -(https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/blob/main/README.md). - -The OCI Security Health Check - Standard Edition would not be possible without the great work of the CIS OCI -Landing Zone Quick Start Template Team (https://github.com/oci-landing-zones/oci-cis-landingzone-quickstart/graphs/contributors). - -7 Certification - -The CIS Compliance Script has been certified by the CIS Center of Internet Security for the -OCI Oracle Cloud Foundation Benchmark v3.0.0, Level 1 and 2 (https://www.cisecurity.org/partner/oracle). - -8 License - -Copyright (c) 2022-2026 Oracle and/or its affiliates. - -Licensed under the Universal Permissive License (UPL), Version 1.0. - -See LICENSE.txt (https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE.txt) for more details. - diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/requirements.txt b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/requirements.txt deleted file mode 100644 index e522d04384..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/requirements.txt +++ /dev/null @@ -1,9 +0,0 @@ -xlsxwriter>=3.2.5 -pytz -pandas -openpyxl>=3.1.5 -pyyaml>=6.0 -oci>=2.181.0 -requests -matplotlib -numpy diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/scripts/cis_reports/cis_reports.py b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/scripts/cis_reports/cis_reports.py deleted file mode 100644 index 563eab4b4c..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/scripts/cis_reports/cis_reports.py +++ /dev/null @@ -1,6971 +0,0 @@ -########################################################################## -# Copyright (c) 2016, 2026, Oracle and/or its affiliates. All rights reserved. -# This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license. -# -# cis_reports.py -# @author base: Adi Zohar -# @author: Josh Hammer, Andre Correa, Chad Russell, Jake Bloom and Olaf Heimburger -# -# Supports Python 3 and above -# -# coding: utf-8 -########################################################################## - -from __future__ import print_function -import concurrent.futures -import sys -import argparse -import datetime -import pytz -import oci -import json -import os -import csv -import itertools -from threading import Thread -import hashlib -import re -import requests - -try: - from xlsxwriter.workbook import Workbook - import glob - OUTPUT_TO_XLSX = True -except Exception: - OUTPUT_TO_XLSX = False - -try: - import matplotlib.pyplot as plt - import numpy as np - OUTPUT_DIAGRAMS = True -except Exception: - OUTPUT_DIAGRAMS = False - -csv.field_size_limit(sys.maxsize) - -RELEASE_VERSION = "3.2.1" -PYTHON_SDK_VERSION = "2.173.0" -UPDATED_DATE = "May 1, 2026" - - -########################################################################## -# debug print -########################################################################## -# DEBUG = False -def debug(msg): - if DEBUG: - log_datetime = datetime.datetime.now().replace(tzinfo=pytz.UTC) - log_time_str = str(log_datetime.strftime("%Y-%m-%dT%H:%M:%S")) - print(log_time_str+": "+msg) - -########################################################################## -# Print header centered -########################################################################## -def print_header(name): - chars = int(90) - print('') - print('#' * chars) - print('#' + name.center(chars - 2, ' ') + '#') - print('#' * chars) - - -########################################################################## -# show_version -########################################################################## -def show_version(verbose=False): - script_version = f'CIS Reports - Release {RELEASE_VERSION}' - script_updated = f'Version {RELEASE_VERSION} Updated on {UPDATED_DATE}' - if verbose: - print_header(f'Running {script_version}') - print(script_updated) - print('Please use --help for more info') - print(f'\nTested up to oci-python-sdk version: {PYTHON_SDK_VERSION}') - print(f'Installed oci-python-sdk version: {str(oci.__version__)}') - print(f'The command line arguments are: {str(sys.argv)}') - else: - print(script_updated) - -class ComplianceMappings: - mappings = { - 'IAM-1' : {'CIS v8' : ['5.4', '6.7'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-2' : {'CIS v8' : ['3.3'], 'CCCS Guard Rail' : ['1','2', '3']}, - 'IAM-3' : {'CIS v8' : ['3.3', '5.4'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-4' : {'CIS v8' : ['4.1', '5.2'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-5' : {'CIS v8' : ['4.1', '5.2'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-6' : {'CIS v8' : ['5.2'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-7' : {'CIS v8' : ['6.3', '6.5'], 'CCCS Guard Rail' : ['1', '2', '3', '4']}, - 'IAM-8' : {'CIS v8' : ['4.1', '4.4'], 'CCCS Guard Rail' : ['6', '7']}, - 'IAM-9' : {'CIS v8' : ['4.1', '5.2'], 'CCCS Guard Rail' : ['6', '7']}, - 'IAM-10' : {'CIS v8' : ['4.1', '5.2'], 'CCCS Guard Rail' : ['6', '7']}, - 'IAM-11' : {'CIS v8' : ['5.4'], 'CCCS Guard Rail' : []}, - 'IAM-12' : {'CIS v8' : ['5.4'], 'CCCS Guard Rail' : ['6', '7']}, - 'IAM-13' : {'CIS v8' : ['5.1'], 'CCCS Guard Rail' : ['1', '2', '3']}, - 'IAM-14' : {'CIS v8' : ['6.8'], 'CCCS Guard Rail' : ['6', '7']}, - 'IAM-15' : {'CIS v8' : ['5.4', '6.8'], 'CCCS Guard Rail' : ['2', '3']}, - 'IAM-16' : {'CIS v8' : ['5.3'], 'CCCS Guard Rail' : ['2']}, - 'IAM-17' : {'CIS v8' : ['5'], 'CCCS Guard Rail' : ['2']}, - 'NTW-1' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-2' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-3' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-4' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-5' : {'CIS v8' : ['12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-6' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'NTW-7' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3' ,'5', '7', '9']}, - 'NTW-8' : {'CIS v8' : ['4.4', '12.3'], 'CCCS Guard Rail' : ['2', '3', '5', '7', '9']}, - 'COM-1' : {'CIS v8' : ['4.6'], 'CCCS Guard Rail' : []}, - 'COM-2' : {'CIS v8' : ['4.1'], 'CCCS Guard Rail' : []}, - 'COM-3' : {'CIS v8' : [''], 'CCCS Guard Rail' : []}, - 'LAM-1' : {'CIS v8' : ['1.1'], 'CCCS Guard Rail' : []}, - 'LAM-2' : {'CIS v8' : ['8.2', '8.11'], 'CCCS Guard Rail' : ['11']}, - 'LAM-3' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-4' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-5' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-6' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-7' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-8' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-9' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-10' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-11' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-12' : {'CIS v8' : ['4.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-13' : {'CIS v8' : ['8.2', '8.5', '13.6'], 'CCCS Guard Rail' : []}, - 'LAM-14' : {'CIS v8' : ['8.2', '8.5', '8.11'], 'CCCS Guard Rail' : ['1', '2', '3']}, - 'LAM-15' : {'CIS v8' : ['8.2', '8.11'], 'CCCS Guard Rail' : []}, - 'LAM-16' : {'CIS v8' : [], 'CCCS Guard Rail' : ['6,7']}, - 'LAM-17' : {'CIS v8' : ['8.2'], 'CCCS Guard Rail' : ['11']}, - 'LAM-18' : {'CIS v8' : ['8.2'], 'CCCS Guard Rail' : ['11']}, - 'STO-1-1' : {'CIS v8' : ['3.3'], 'CCCS Guard Rail' : []}, - 'STO-1-2' : {'CIS v8' : ['3.11'], 'CCCS Guard Rail' : []}, - 'STO-1-3' : {'CIS v8' : ['3.11'], 'CCCS Guard Rail' : []}, - 'STO-2-1' : {'CIS v8' : ['3.11'], 'CCCS Guard Rail' : []}, - 'STO-2-2' : {'CIS v8' : ['3.11'], 'CCCS Guard Rail' : []}, - 'STO-3-1' : {'CIS v8' : ['3.11'], 'CCCS Guard Rail' : []}, - 'AM-1' : {'CIS v8' : ['3.1'], 'CCCS Guard Rail' : ['2', '3', '8', '12']}, - 'AM-2' : {'CIS v8' : ['3.12'], 'CCCS Guard Rail' : ['1', '2', '3']} - } - - -########################################################################## -# CIS Reporting Class -########################################################################## -class CIS_Report: - - # Class variables - _DAYS_OLD = 90 - __KMS_DAYS_OLD = 365 - __home_region = [] - __days_to_expiry = 30 - __days_used = 45 - - # Global Service Limit threshold - __service_utilization_limit = 80.0 - - # Time Format - __iso_time_format = "%Y-%m-%dT%H:%M:%S" - - __oci_ocid_pattern = r'ocid1.[a-z0-9_]+.[a-z0-9]+.(?:[a-z0-9._-]+.|.)[a-z0-9]{20,}' - - __simple_email = r'[a-zA-Z0-9.!#$%&\'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*\.[a-zA-Z]{2,}' - - # Start print time info - start_datetime = datetime.datetime.now().replace(tzinfo=pytz.UTC) - start_time_str = str(start_datetime.strftime(__iso_time_format)) - report_datetime = str(start_datetime.strftime("%Y-%m-%d_%H-%M-%S")) - - # For User based key checks - api_key_time_max_datetime = start_datetime - \ - datetime.timedelta(days=_DAYS_OLD) - - str_api_key_time_max_datetime = api_key_time_max_datetime.strftime(__iso_time_format) - api_key_time_max_datetime = datetime.datetime.strptime(str_api_key_time_max_datetime, __iso_time_format) - # For KMS check - kms_key_time_max_datetime = start_datetime - \ - datetime.timedelta(days=__KMS_DAYS_OLD) - str_kms_key_time_max_datetime = kms_key_time_max_datetime.strftime(__iso_time_format) - kms_key_time_max_datetime = datetime.datetime.strptime(str_kms_key_time_max_datetime, __iso_time_format) - # For Certificates Check - cert_key_time_max_datetime = start_datetime + \ - datetime.timedelta(days=__days_to_expiry) - str_cert_key_time_max_datetime = cert_key_time_max_datetime.strftime(__iso_time_format) - cert_key_time_max_datetime = datetime.datetime.strptime(str_cert_key_time_max_datetime, __iso_time_format) - # For Unused Credentials Check - local_user_time_max_datetime = start_datetime - \ - datetime.timedelta(days=__days_used) - str_local_user_time_max_datetime = local_user_time_max_datetime.strftime(__iso_time_format) - local_user_time_max_datetime = datetime.datetime.strptime(str_local_user_time_max_datetime, __iso_time_format) - - def __init__(self, config, signer, proxy, output_bucket, report_directory, report_prefix, - report_summary_json, print_to_screen, regions_to_run_in, raw_data, obp, - redact_output, oci_url=None, debug=False, all_resources=True, - disable_api_keys=False): - - # CIS Foundation benchmark 3.0.0 - self.cis_foundations_benchmark_3_0 = { - '1.1' : {'id': 'IAM-1', 'section': 'Identity and Access Management', 'recommendation_#': '1.1', 'Title': 'Ensure service level admins are created to manage resources of particular service', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.2' : {'id': 'IAM-2', 'section': 'Identity and Access Management', 'recommendation_#': '1.2', 'Title': 'Ensure permissions on all resources are given only to the tenancy administrator group', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.3' : {'id': 'IAM-3', 'section': 'Identity and Access Management', 'recommendation_#': '1.3', 'Title': 'Ensure IAM administrators cannot update tenancy Administrators group', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.4' : {'id': 'IAM-4', 'section': 'Identity and Access Management', 'recommendation_#': '1.4', 'Title': 'Ensure IAM password policy requires minimum length of 14 or greater', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.5' : {'id': 'IAM-5', 'section': 'Identity and Access Management', 'recommendation_#': '1.5', 'Title': 'Ensure IAM password policy expires passwords within 365 days', 'Status': None, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.6' : {'id': 'IAM-6', 'section': 'Identity and Access Management', 'recommendation_#': '1.6', 'Title': 'Ensure IAM password policy prevents password reuse', 'Status': None, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.7' : {'id': 'IAM-7', 'section': 'Identity and Access Management', 'recommendation_#': '1.7', 'Title': 'Ensure MFA is enabled for all users with a console password', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.8' : {'id': 'IAM-8', 'section': 'Identity and Access Management', 'recommendation_#': '1.8', 'Title': 'Ensure user API keys rotate within 90 days or less', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.9' : {'id': 'IAM-9', 'section': 'Identity and Access Management', 'recommendation_#': '1.9', 'Title': 'Ensure user customer secret keys rotate within 90 days or less', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.10' : {'id': 'IAM-10', 'section': 'Identity and Access Management', 'recommendation_#': '1.10', 'Title': 'Ensure user auth tokens rotate within 90 days or less', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.11' : {'id': 'IAM-11', 'section': 'Identity and Access Management', 'recommendation_#': '1.11', 'Title': 'Ensure user IAM Database Passwords rotate within 90 days', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.12' : {'id': 'IAM-12', 'section': 'Identity and Access Management', 'recommendation_#': '1.12', 'Title': 'Ensure API keys are not created for tenancy administrator users', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.13' : {'id': 'IAM-13', 'section': 'Identity and Access Management', 'recommendation_#': '1.13', 'Title': 'Ensure all OCI IAM user accounts have a valid and current email address', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.14' : {'id': 'IAM-14', 'section': 'Identity and Access Management', 'recommendation_#': '1.14', 'Title': 'Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.15' : {'id': 'IAM-15', 'section': 'Identity and Access Management', 'recommendation_#': '1.15', 'Title': 'Ensure storage service-level admins cannot delete resources they manage', 'Status': None, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.16' : {'id': 'IAM-16', 'section': 'Identity and Access Management', 'recommendation_#': '1.16', 'Title': 'Ensure OCI IAM credentials unused for 45 days or more are disabled', 'Status': None, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '1.17' : {'id': 'IAM-17', 'section': 'Identity and Access Management', 'recommendation_#': '1.17', 'Title': 'Ensure there is only one active API Key for any single OCI IAM user.', 'Status': None, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.1' : {'id': 'NTW-1', 'section': 'Networking', 'recommendation_#': '2.1', 'Title': 'Ensure no security lists allow ingress from 0.0.0.0/0 to port 22.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.2' : {'id': 'NTW-2', 'section': 'Networking', 'recommendation_#': '2.2', 'Title': 'Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.3' : {'id': 'NTW-3', 'section': 'Networking', 'recommendation_#': '2.3', 'Title': 'Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.4' : {'id': 'NTW-4', 'section': 'Networking', 'recommendation_#': '2.4', 'Title': 'Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.5' : {'id': 'NTW-5', 'section': 'Networking', 'recommendation_#': '2.5', 'Title': 'Ensure the default security list of every VCN restricts all traffic except ICMP within VCN.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.6' : {'id': 'NTW-6', 'section': 'Networking', 'recommendation_#': '2.6', 'Title': 'Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.7' : {'id': 'NTW-7', 'section': 'Networking', 'recommendation_#': '2.7', 'Title': 'Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '2.8' : {'id': 'NTW-8', 'section': 'Networking', 'recommendation_#': '2.8', 'Title': 'Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '3.1' : {'id': 'COM-1', 'section': 'Compute', 'recommendation_#': '3.1', 'Title': 'Ensure Compute Instance Legacy Metadata service endpoint is disabled.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '3.2' : {'id': 'COM-2', 'section': 'Compute', 'recommendation_#': '3.2', 'Title': 'Ensure Secure Boot is enabled on Compute Instance.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '3.3' : {'id': 'COM-3', 'section': 'Compute', 'recommendation_#': '3.3', 'Title': 'Ensure In-transit Encryption is enabled on Compute Instance.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.1' : {'id': 'LAM-1', 'section': 'Logging and Monitoring', 'recommendation_#': '4.1', 'Title': 'Ensure default tags are used on resources.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.2' : {'id': 'LAM-2', 'section': 'Logging and Monitoring', 'recommendation_#': '4.2', 'Title': 'Create at least one notification topic and subscription to receive monitoring alerts.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.3' : {'id': 'LAM-3', 'section': 'Logging and Monitoring', 'recommendation_#': '4.3', 'Title': 'Ensure a notification is configured for Identity Provider changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.4' : {'id': 'LAM-4', 'section': 'Logging and Monitoring', 'recommendation_#': '4.4', 'Title': 'Ensure a notification is configured for IdP group mapping changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.5' : {'id': 'LAM-5', 'section': 'Logging and Monitoring', 'recommendation_#': '4.5', 'Title': 'Ensure a notification is configured for IAM group changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.6' : {'id': 'LAM-6', 'section': 'Logging and Monitoring', 'recommendation_#': '4.6', 'Title': 'Ensure a notification is configured for IAM policy changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.7' : {'id': 'LAM-7', 'section': 'Logging and Monitoring', 'recommendation_#': '4.7', 'Title': 'Ensure a notification is configured for user changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.8' : {'id': 'LAM-8', 'section': 'Logging and Monitoring', 'recommendation_#': '4.8', 'Title': 'Ensure a notification is configured for VCN changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.9' : {'id': 'LAM-9', 'section': 'Logging and Monitoring', 'recommendation_#': '4.9', 'Title': 'Ensure a notification is configured for changes to route tables.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.10' : {'id': 'LAM-10', 'section': 'Logging and Monitoring', 'recommendation_#': '4.10', 'Title': 'Ensure a notification is configured for security list changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.11' : {'id': 'LAM-11', 'section': 'Logging and Monitoring', 'recommendation_#': '4.11', 'Title': 'Ensure a notification is configured for network security group changes.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.12' : {'id': 'LAM-12', 'section': 'Logging and Monitoring', 'recommendation_#': '4.12', 'Title': 'Ensure a notification is configured for changes to network gateways.', 'Status': False, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.13' : {'id': 'LAM-13', 'section': 'Logging and Monitoring', 'recommendation_#': '4.13', 'Title': 'Ensure VCN flow logging is enabled for all subnets.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.14' : {'id': 'LAM-14', 'section': 'Logging and Monitoring', 'recommendation_#': '4.14', 'Title': 'Ensure Cloud Guard is enabled in the root compartment of the tenancy.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.15' : {'id': 'LAM-15', 'section': 'Logging and Monitoring', 'recommendation_#': '4.15', 'Title': 'Ensure a notification is configured for Oracle Cloud Guard problems detected.', 'Status': False, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.16' : {'id': 'LAM-16', 'section': 'Logging and Monitoring', 'recommendation_#': '4.16', 'Title': 'Ensure customer created Customer Managed Key (CMK) is rotated at least annually.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.17' : {'id': 'LAM-17', 'section': 'Logging and Monitoring', 'recommendation_#': '4.17', 'Title': 'Ensure write level Object Storage logging is enabled for all buckets.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '4.18' : {'id': 'LAM-18', 'section': 'Logging and Monitoring', 'recommendation_#': '4.18', 'Title': 'Ensure a notification is configured for Local OCI User Authentication.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '5.1.1' : {'id': 'STO-1-1', 'section': 'Storage - Object Storage', 'recommendation_#': '5.1.1', 'Title': 'Ensure no Object Storage buckets are publicly visible.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '5.1.2' : {'id': 'STO-1-2', 'section': 'Storage - Object Storage', 'recommendation_#': '5.1.2', 'Title': 'Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK).', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '5.1.3' : {'id': 'STO-1-3', 'section': 'Storage - Object Storage', 'recommendation_#': '5.1.3', 'Title': 'Ensure Versioning is Enabled for Object Storage Buckets.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '5.2.1' : {'id': 'STO-2-1', 'section': 'Storage - Block Volumes', 'recommendation_#': '5.2.1', 'Title': 'Ensure Block Volumes are encrypted with Customer Managed Keys.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': []}, - '5.2.2' : {'id': 'STO-2-2', 'section': 'Storage - Block Volumes', 'recommendation_#': '5.2.2', 'Title': 'Ensure Boot Volumes are encrypted with Customer Managed Key.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': []}, - '5.3.1' : {'id': 'STO-3-1', 'section': 'Storage - File Storage Service', 'recommendation_#': '5.3.1', 'Title': 'Ensure File Storage Systems are encrypted with Customer Managed Keys.', 'Status': True, 'Level': 2, 'Total': [], 'Findings': [], 'Remediation': []}, - '6.1' : {'id': 'AM-1', 'section': 'Asset Management', 'recommendation_#': '6.1', 'Title': 'Create at least one compartment in your tenancy to store cloud resources.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []}, - '6.2' : {'id': 'AM-2', 'section': 'Asset Management', 'recommendation_#': '6.2', 'Title': 'Ensure no resources are created in the root compartment.', 'Status': True, 'Level': 1, 'Total': [], 'Findings': [], 'Remediation': []} - } - - # Remediation Report - self.cis_report_data = { - "1.1": { - "Description": "To apply least-privilege security principle, one can create service-level administrators in corresponding groups and assigning specific users to each service-level administrative group in a tenancy. This limits administrative access in a tenancy.

It means service-level administrators can only manage resources of a specific service.

Example policies for global/tenant level service-administrators\n
\nAllow group VolumeAdmins to manage volume-family in tenancy\nAllow group ComputeAdmins to manage instance-family in tenancy\nAllow group NetworkAdmins to manage virtual-network-family in tenancy\n
\nOrganizations have various ways of defining service-administrators. Some may prefer creating service administrators at a tenant level and some per department or per project or even per application environment (dev/test/production etc.). Either approach works so long as the policies are written to limit access given to the service-administrators.

Example policies for compartment level service-administrators 

Allow group NonProdComputeAdmins to manage instance-family in compartment dev\nAllow group ProdComputeAdmins to manage instance-family in compartment production\nAllow group A-Admins to manage instance-family in compartment Project-A\nAllow group A-Admins to manage volume-family in compartment Project-A\n
", - "Rationale": "Creating service-level administrators helps in tightly controlling access to Oracle Cloud Infrastructure (OCI) services to implement the least-privileged security principle.", - "Impact": "", - "Remediation": "Refer to the policy syntax document and create new policies if the audit results indicate that the required policies are missing.", - "Recommendation": "", - "Observation": "custom IAM policy that grants tenancy administrative access." - }, - "1.2": { - "Description": "There is a built-in OCI IAM policy enabling the Administrators group to perform any action within a tenancy. In the OCI IAM console, this policy reads:

\nAllow group Administrators to manage all-resources in tenancy\n


Administrators create more users, groups, and policies to provide appropriate access to other groups.

Administrators should not allow any-other-group full access to the tenancy by writing a policy like this:

\nAllow group any-other-group to manage all-resources in tenancy\n


The access should be narrowed down to ensure the least-privileged principle is applied.", - "Rationale": "Permission to manage all resources in a tenancy should be limited to a small number of users in the 'Administrators' group for break-glass situations and to set up users/groups/policies when a tenancy is created.

No group other than 'Administrators' in a tenancy should need access to all resources in a tenancy, as this violates the enforcement of the least privilege principle.", - "Impact": "", - "Remediation": "Remove any policy statement that allows any group other than Administrators or any service access to manage all resources in the tenancy.", - "Recommendation": "Evaluate if tenancy-wide administrative access is needed for the identified policy and update it to be more restrictive.", - "Observation": "custom IAM policy that grants tenancy administrative access." - }, - "1.3": { - "Description": "Tenancy administrators can create more users, groups, and policies to provide other service administrators access to OCI resources.

For example, an IAM administrator will need to have access to manage\n resources like compartments, users, groups, dynamic-groups, policies, identity-providers, tenancy tag-namespaces, tag-definitions in the tenancy.

The policy that gives IAM-Administrators or any other group full access to 'groups' resources should not allow access to the tenancy 'Administrators' group.

The policy statements would look like:

\nAllow group IAMAdmins to inspect users in tenancy\nAllow group IAMAdmins to use users in tenancy where target.group.name != 'Administrators'\nAllow group IAMAdmins to inspect groups in tenancy\nAllow group IAMAdmins to use groups in tenancy where target.group.name != 'Administrators'\n


Note: You must include separate statements for 'inspect' access, because the target.group.name variable is not used by the ListUsers and ListGroups operations", - "Rationale": "These policy statements ensure that no other group can manage tenancy administrator users or the membership to the 'Administrators' group thereby gain or remove tenancy administrator access.", - "Impact": "", - "Remediation": "Verify the results to ensure that the policy statements that grant access to use or manage users or groups in the tenancy have a condition that excludes access to Administrators group or to users in the Administrators group.", - "Recommendation": "Evaluate if tenancy-wide administrative access is needed for the identified policy and update it to be more restrictive.", - "Observation": "custom IAM policy that grants tenancy administrative access." - }, - "1.4": { - "Description": "Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a certain length and are composed of certain characters.

It is recommended the password policy require a minimum password length 14 characters and contain 1 non-alphabetic\ncharacter (Number or 'Special Character').", - "Rationale": "In keeping with the overall goal of having users create a password that is not overly weak, an eight-character minimum password length is recommended for an MFA account, and 14 characters for a password only account. In addition, maximum password length should be made as long as possible based on system/software capabilities and not restricted by policy.

In general, it is true that longer passwords are better (harder to crack), but it is also true that forced password length requirements can cause user behavior that is predictable and undesirable. For example, requiring users to have a minimum 16-character password may cause them to choose repeating patterns like fourfourfourfour or passwordpassword that meet the requirement but aren't hard to guess. Additionally, length requirements increase the chances that users will adopt other insecure practices, like writing them down, re-using them or storing them unencrypted in their documents.

Password composition requirements are a poor defense against guessing attacks. Forcing users to choose some combination of upper-case, lower-case, numbers, and special characters has a negative impact. It places an extra burden on users and many\nwill use predictable patterns (for example, a capital letter in the first position, followed by lowercase letters, then one or two numbers, and a “special character” at the end). Attackers know this, so dictionary attacks will often contain these common patterns and use the most common substitutions like, $ for s, @ for a, 1 for l, 0 for o.

Passwords that are too complex in nature make it harder for users to remember, leading to bad practices. In addition, composition requirements provide no defense against common attack types such as social engineering or insecure storage of passwords.", - "Impact": "", - "Remediation": "Update the password policy such as minimum length to 14, password must contain expected special characters and numeric characters.", - "Recommendation": "It is recommended the password policy require a minimum password length 14 characters and contain 1 non-alphabetic character (Number or 'Special Character').", - "Observation": "password policy/policies that do not enforce sufficient password complexity requirements." - }, - "1.5": { - "Description": "IAM password policies can require passwords to be rotated or expired after a given number of days. It is recommended that the password policy expire passwords after 365 and are changed immediately based on events.", - "Rationale": "Excessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous one (incrementing a number used in the password for example). Also, password expiration requirements offer no containment benefits because attackers will often use credentials as soon as they compromise them. Instead, immediate password changes should be based on key events including, but not limited to:

1. Indication of compromise
2. Change of user roles
3. When a user leaves the organization.

Not only does changing passwords every few weeks or months frustrate the user, it's been suggested that it does more harm than good, because it could lead to bad practices by the user such as adding a character to the end of their existing password.

In addition, we also recommend a yearly password change. This is primarily because for all their good intentions users will share credentials across accounts. Therefore, even if a breach is publicly identified, the user may not see this notification, or forget they have an account on that site. This could leave a shared credential vulnerable indefinitely. Having an organizational policy of a 1-year (annual) password expiration is a reasonable compromise to mitigate this with minimal user burden.", - "Impact": "", - "Remediation": "Update the password policy by setting number of days configured in Expires after to 365.", - "Recommendation": "Evaluate password rotation policies are inline with your organizational standard.", - "Observation": "password policy/policies that do require rotation." - }, - "1.6": { - "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended the password policy prevent the reuse of passwords.", - "Rationale": "Enforcing password history ensures that passwords are not reused in for a certain period of time by the same user. If a user is not allowed to use last 24 passwords, that window of time is greater. This helps maintain the effectiveness of password security.", - "Impact": "", - "Remediation": "Update the number of remembered passwords in previous passwords remembered setting to 24 in the password policy.", - "Recommendation": "Evaluate password reuse policies are inline with your organizational standard.", - "Observation": "password policy/policies that do prevent reuse." - }, - "1.7": { - "Description": "Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity.

With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that they know). The user is then prompted to provide a second verification code from a registered MFA device, which is the second factor (something that they have). The two factors work together, requiring an extra layer of security to verify the user's identity and complete the sign-in process.

OCI IAM supports two-factor authentication using a password (first factor) and a device that can generate a time-based one-time password (TOTP) (second factor).

See [OCI documentation](https://docs.cloud.oracle.com/en-us/iaas/Content/Identity/Tasks/usingmfa.htm) for more details.", - "Rationale": "Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources.", - "Impact": "", - "Remediation": "Each user must enable MFA for themselves using a device they will have access to every time they sign in. An administrator cannot enable MFA for another user but can enforce MFA by identifying the list of non-complaint users, notifying them or disabling access by resetting password for non-complaint accounts.", - "Recommendation": "Evaluate if local users are required. For Break Glass accounts ensure MFA is in place.", - "Observation": "users with Password access but not MFA." - }, - "1.8": { - "Description": "API keys are used by administrators, developers, services and scripts for accessing OCI APIs directly or via SDKs/OCI CLI to search, create, update or delete OCI resources.

The API key is an RSA key pair. The private key is used for signing the API requests and the public key is associated with a local or synchronized user's profile.", - "Rationale": "It is important to secure and rotate an API key every 90 days or less as it provides the same level of access that a user it is associated with has.

In addition to a security engineering best practice, this is also a compliance requirement. For example, PCI-DSS Section 3.6.4 states, \"Verify that key-management procedures include a defined cryptoperiod for each key type in use and define a process for key changes at the end of the defined crypto period(s).\"", - "Impact": "", - "Remediation": "Delete any API Keys with a date of 90 days or older under the Created column of the API Key table.", - "Recommendation": "Evaluate if APIs Keys are still used/required and rotate API Keys It is important to secure and rotate an API key every 90 days or less as it provides the same level of access that a user it is associated with has.", - "Observation": "user(s) with APIs that have not been rotated with 90 days." - }, - "1.9": { - "Description": "Object Storage provides an API to enable interoperability with Amazon S3. To use this Amazon S3 Compatibility API, you need to generate the signing key required to authenticate with Amazon S3.

This special signing key is an Access Key/Secret Key pair. Oracle generates the Customer Secret key to pair with the Access Key.", - "Rationale": "It is important to secure and rotate an customer secret key every 90 days or less as it provides the same level of object storage access that a user is associated with has.", - "Impact": "", - "Remediation": "Delete any Access Keys with a date of 90 days or older under the Created column of the Customer Secret Keys.", - "Recommendation": "Evaluate if Customer Secret Keys are still used/required and rotate the Keys accordingly.", - "Observation": "users with Customer Secret Keys that have not been rotated with 90 days." - }, - "1.10": { - "Description": "Auth tokens are authentication tokens generated by Oracle. You use auth tokens to authenticate with APIs that do not support the Oracle Cloud Infrastructure signature-based authentication. If the service requires an auth token, the service-specific documentation instructs you to generate one and how to use it.", - "Rationale": "It is important to secure and rotate an auth token every 90 days or less as it provides the same level of access to APIs that do not support the OCI signature-based authentication as the user associated to it.", - "Impact": "", - "Remediation": "Delete any auth token with a date of 90 days or older under the Created column of the Auth Tokens.", - "Recommendation": "Evaluate if Auth Tokens are still used/required and rotate Auth tokens.", - "Observation": "user(s) with auth tokens that have not been rotated in 90 days." - }, - "1.11": { - "Description": "Users can create and manage their database password in their IAM user profile and use that password to authenticate to databases in their tenancy. An IAM database password is a different password than an OCI Console password. Setting an IAM database password allows an authorized IAM user to sign in to one or more Autonomous Databases in their tenancy. An IAM database password is a different password than an OCI Console password. Setting an IAM database password allows an authorized IAM user to sign in to one or more Autonomous Databases in their tenancy.", - "Rationale": "It is important to secure and rotate an IAM Database password 90 days or less as it provides the same access the user would have a using a local database user.", - "Impact": "", - "Remediation": "Delete any database password with a date of 90 days or older under the Created column of the Database Password.", - "Recommendation": "Evaluate if database password are still used/required and rotate database passwords.", - "Observation": "user(s) with Database passwords that have not been rotated in 90 days." - }, - "1.12": { - "Description": "Tenancy administrator users have full access to the organization's OCI tenancy. API keys associated with user accounts are used for invoking the OCI APIs via custom programs or clients like CLI/SDKs. The clients are typically used for performing day-to-day operations and should never require full tenancy access. Service-level administrative users with API keys should be used instead.", - "Rationale": "For performing day-to-day operations tenancy administrator access is not needed.\nService-level administrative users with API keys should be used to apply privileged security principle.", - "Impact": "", - "Remediation": "For each tenancy administrator user who has an API key, select API Keys from the menu and delete any associated keys from the API Keys table.", - "Recommendation": "Evaluate if a user with API Keys requires Administrator access and use a least privilege approach.", - "Observation": "users with Administrator access and API Keys." - }, - "1.13": { - "Description": "All OCI IAM local user accounts have an email address field associated with the account. It is recommended to specify an email address that is valid and current.

If you have an email address in your user profile, you can use the Forgot Password link on the sign on page to have a temporary password sent to you.", - "Rationale": "Having a valid and current email address associated with an OCI IAM local user account allows you to tie the account to identity in your organization. It also allows that user to reset their password if it is forgotten or lost.", - "Impact": "", - "Remediation": "Update the current email address in the email text box on each non compliant user.", - "Recommendation": "Add emails to users to allow them to use the 'Forgot Password' feature and uniquely identify the user. For service accounts it could be a mail alias.", - "Observation": "user(s) without an email." - }, - "1.14": { - "Description": "OCI instances, OCI database and OCI functions can access other OCI resources either via an OCI API key associated to a user or by being including in a Dynamic Group that has an IAM policy granting it the required access. Access to OCI Resources refers to making API calls to another OCI resource like Object Storage, OCI Vaults, etc.", - "Rationale": "Dynamic Groups reduces the risks related to hard coded credentials. Hard coded API keys can be shared and require rotation which can open them up to being compromised. Compromised credentials could allow access to OCI services outside of the expected radius.", - "Impact": "For an OCI instance that contains embedded credential audit the scripts and environment variables to ensure that none of them contain OCI API Keys or credentials.", - "Remediation": "Create Dynamic group and Enter Matching Rules to that includes the instances accessing your OCI resources. Refer: \"https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm\".", - "Recommendation": "Evaluate how your instances, functions, and autonomous database interact with other OCI services.", - "Observation": "Dynamic Groups reduces the risks related to hard coded credentials. Hard coded API keys can be shared and require rotation which can open them up to being compromised. Compromised credentials could allow access to OCI services outside of the expected radius." - }, - "1.15": { - "Description": "To apply the separation of duties security principle, one can restrict service-level administrators from being able to delete resources they are managing. It means service-level administrators can only manage resources of a specific service but not delete resources for that specific service.

Example policies for global/tenant level for block volume service-administrators:\n
\nAllow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'\nAllow group VolumeUsers to manage volume-backups in tenancy where request.permission!='VOLUME_BACKUP_DELETE'\n

Example policies for global/tenant level for file storage system service-administrators:
\nAllow group FileUsers to manage file-systems in tenancy where request.permission!='FILE_SYSTEM_DELETE'\nAllow group FileUsers to manage mount-targets in tenancy where request.permission!='MOUNT_TARGET_DELETE'\nAllow group FileUsers to manage export-sets in tenancy where request.permission!='EXPORT_SET_DELETE'\n


Example policies for global/tenant level for object storage system service-administrators:
\nAllow group BucketUsers to manage objects in tenancy where request.permission!='OBJECT_DELETE'\nAllow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE'\n
", - "Rationale": "Creating service-level administrators without the ability to delete the resource they are managing helps in tightly controlling access to Oracle Cloud Infrastructure (OCI) services by implementing the separation of duties security principle.", - "Impact": "", - "Remediation": "Add the appropriate where condition to any policy statement that allows the storage service-level to manage the storage service.", - "Recommendation": "To apply a separation of duties security principle, it is recommended to restrict service-level administrators from being able to delete resources they are managing.", - "Observation": "IAM Policies that give service administrator the ability to delete service resources." - }, - "1.16": { - "Description": "OCI IAM Local users can access OCI resources using different credentials, such as passwords or API keys. It is recommended that credentials that have been unused for 45 days or more be deactivated or removed.", - "Rationale": "Disabling or removing unnecessary OCI IAM local users will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.", - "Impact": "Deactivating OCI IAM Local users and deleting of an OCI API Key will remove access to OCI", - "Remediation": "Deactivate OCI IAM Local users or delete of an OCI API Key will remove access to OCI", - "Observation": "User(s) with credentials unused in 45 days" - }, - "1.17":{ - "Description": "API Keys are long-term credentials for an OCI IAM user. They can be used to make programmatic requests to the OCI APIs directly or via, OCI SDKs or the OCI CLI.", - "Rationale": "Having a single API Key for an OCI IAM reduces attack surface area and makes it easier to manage.", - "Impact": "Deletion of an OCI API Key will remove programmatic access to OCI APIs.", - "Remediation": "Remove one of the API Keys.", - "Observation": "OCI API Key will grant programmatic access to OCI APIs with the same access as the user it is attached to." - }, - "2.1": { - "Description": "Security lists provide stateful or stateless filtering of ingress/egress network traffic to OCI resources on a subnet level. It is recommended that no security group allows unrestricted ingress access to port 22.", - "Rationale": "Removing unfettered connectivity to remote console services, such as Secure Shell (SSH), reduces a server's exposure to risk.", - "Impact": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another network security group or security list.", - "Remediation": "For each security list in the returned results, click the security list name. Either edit the ingress rule to be more restrictive, delete the ingress rule or click on the VCN and terminate the security list as appropriate.", - "Recommendation": "Review the security lists. If they are not used(attached to a subnet) they should be deleted if possible or empty. For attached security lists it is recommended to restrict the CIDR block to only allow access to Port 22 from known networks.", - "Observation": "Security lists that allow internet access to port 22. (Note this does not necessarily mean external traffic can reach a compute instance)." - }, - "2.2": { - "Description": "Security lists provide stateful or stateless filtering of ingress/egress network traffic to OCI resources on a subnet level. It is recommended that no security group allows unrestricted ingress access to port 3389.", - "Rationale": "Removing unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), reduces a server's exposure to risk.", - "Impact": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another network security group or security list.", - "Remediation": "For each security list in the returned results, click the security list name. Either edit the ingress rule to be more restrictive, delete the ingress rule or click on the VCN and terminate the security list as appropriate.", - "Recommendation": "Review the security lists. If they are not used(attached to a subnet) they should be deleted if possible or empty. For attached security lists it is recommended to restrict the CIDR block to only allow access to Port 3389 from known networks.", - "Observation": "Security lists that allow internet access to port 3389. (Note this does not necessarily mean external traffic can reach a compute instance)." - }, - "2.3": { - "Description": "Network security groups provide stateful filtering of ingress/egress network traffic to OCI resources. It is recommended that no security group allows unrestricted ingress access to port 22.", - "Rationale": "Removing unfettered connectivity to remote console services, such as Secure Shell (SSH), reduces a server's exposure to risk.", - "Impact": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another network security group or security list.", - "Remediation": "Using the details returned from the audit procedure either Remove the security rules or Update the security rules.", - "Recommendation": "Review the network security groups. If they are not used(attached to a subnet) they should be deleted if possible or empty. For attached security lists it is recommended to restrict the CIDR block to only allow access to Port 3389 from known networks.", - "Observation": "Network security groups that allow internet access to port 22. (Note this does not necessarily mean external traffic can reach a compute instance)." - }, - "2.4": { - "Description": "Network security groups provide stateful filtering of ingress/egress network traffic to OCI resources. It is recommended that no security group allows unrestricted ingress access to port 3389.", - "Rationale": "Removing unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), reduces a server's exposure to risk.", - "Impact": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another network security group or security list.", - "Remediation": "Using the details returned from the audit procedure either Remove the security rules or Update the security rules.", - "Recommendation": "Review the network security groups. If they are not used(attached to a subnet) they should be deleted if possible or empty. For attached network security groups it is recommended to restrict the CIDR block to only allow access to Port 3389 from known networks.", - "Observation": "Network security groups that allow internet access to port 3389. (Note this does not necessarily mean external traffic can reach a compute instance)." - }, - "2.5": { - "Description": "A default security list is created when a Virtual Cloud Network (VCN) is created and attached to the public subnets in the VCN. Security lists provide stateful or stateless filtering of ingress and egress network traffic to OCI resources in the VCN. It is recommended that the default security list does not allow unrestricted ingress and egress access to resources in the VCN.", - "Rationale": "Removing unfettered connectivity to OCI resource, reduces a server's exposure to unauthorized access or data exfiltration.", - "Impact": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.", - "Remediation": "For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to port 22 through another network security group and servers have egress to specified ports and protocols through another network security group.", - "Recommendation": "Create specific custom security lists with workload specific rules and attach to subnets.", - "Observation": "Default Security lists that allow more traffic then ICMP." - }, - "2.6": { - "Description": "Oracle Integration (OIC) is a complete, secure, but lightweight integration solution that enables you to connect your applications in the cloud. It simplifies connectivity between your applications and connects both your applications that live in the cloud and your applications that still live on premises. Oracle Integration provides secure, enterprise-grade connectivity regardless of the applications you are connecting or where they reside. OIC instances are created within an Oracle managed secure private network with each having a public endpoint. The capability to configure ingress filtering of network traffic to protect your OIC instances from unauthorized network access is included. It is recommended that network access to your OIC instances be restricted to your approved corporate IP Addresses or Virtual Cloud Networks (VCN)s.", - "Rationale": "Restricting connectivity to OIC Instances reduces an OIC instance's exposure to risk.", - "Impact": "When updating ingress filters for an existing environment, care should be taken to ensure that IP addresses and VCNs currently used by administrators, users, and services to access your OIC instances are included in the updated filters.", - "Remediation": "For each OIC instance in the returned results, select the OIC Instance name,edit the Network Access to be more restrictive.", - "Recommendation": "It is recommended that OIC Network Access is restricted to your corporate IP Addresses or VCNs for OIC Instances.", - "Observation": "OIC Instances that allow unfiltered public ingress traffic (Authentication and authorization is still required)." - }, - "2.7": { - "Description": "Oracle Analytics Cloud (OAC) is a scalable and secure public cloud service that provides a full set of capabilities to explore and perform collaborative analytics for you, your workgroup, and your enterprise. OAC instances provide ingress filtering of network traffic or can be deployed with in an existing Virtual Cloud Network VCN. It is recommended that all new OAC instances be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing OAC instances.", - "Rationale": "Restricting connectivity to Oracle Analytics Cloud instances reduces an OAC instance's exposure to risk.", - "Impact": "When updating ingress filters for an existing environment, care should be taken to ensure that IP addresses and VCNs currently used by administrators, users, and services to access your OAC instances are included in the updated filters. Also, these changes will temporarily bring the OAC instance offline.", - "Remediation": "For each OAC instance in the returned results, select the OAC Instance name edit the Access Control Rules by clicking +Another Rule and add rules as required.", - "Recommendation": "It is recommended that all new OAC instances be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing OAC instances.", - "Observation": "OAC Instances that allow unfiltered public ingress traffic (Authentication and authorization is still required)." - }, - "2.8": { - "Description": "Oracle Autonomous Database Shared (ADB-S) automates database tuning, security, backups, updates, and other routine management tasks traditionally performed by DBAs. ADB-S provide ingress filtering of network traffic or can be deployed within an existing Virtual Cloud Network (VCN). It is recommended that all new ADB-S databases be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing ADB-S databases.", - "Rationale": "Restricting connectivity to ADB-S Databases reduces an ADB-S database's exposure to risk.", - "Impact": "When updating ingress filters for an existing environment, care should be taken to ensure that IP addresses and VCNs currently used by administrators, users, and services to access your ADB-S instances are included in the updated filters.", - "Remediation": "For each ADB-S database in the returned results, select the ADB-S database name edit the Access Control Rules by clicking +Another Rule and add rules as required.", - "Recommendation": "It is recommended that all new ADB-S databases be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing ADB-S databases.", - "Observation": "ADB-S Instances that allow unfiltered public ingress traffic (Authentication and authorization is still required)." - }, - "3.1": { - "Description": "Compute Instances that utilize Legacy MetaData service endpoints (IMDSv1) are susceptible to potential SSRF attacks. To bolster security measures, it is strongly advised to reconfigure Compute Instances to adopt Instance Metadata Service v2, aligning with the industry's best security practices.", - "Rationale": "Enabling Instance Metadata Service v2 enhances security and grants precise control over metadata access. Transitioning from IMDSv1 reduces the risk of SSRF attacks, bolstering system protection. IMDv1 poses security risks due to its inferior security measures and limited auditing capabilities. Transitioning to IMDv2 ensures a more secure environment with robust security features and improved monitoring capabilities.", - "Impact": "If you disable IMDSv1 on an instance that does not support IMDSv2, you might not be able to connect to the instance when you launch it.", - "Remediation": "For each instance select the instance name, under the Instance Details section, next to Instance Metadata Service, click Edit and for the Instance metadata service, select the Version 2 only option.", - "Recommendation": "It is recommended that all OCI instances use Instance Metadata Service version 2 (IMDSv2).", - "Observation": "Instances that allow Instance Metadata Service v1." - }, - "3.2": { - "Description": "Shielded Instances with Secure Boot enabled prevents unauthorized boot loaders and operating systems from booting. This prevent rootkits, bootkits, and unauthorized software from running before the operating system loads. Secure Boot verifies the digital signature of the system's boot software to check its authenticity. The digital signature ensures the operating system has not been tampered with and is from a trusted source. When the system boots and attempts to execute the software, it will first check the digital signature to ensure validity. If the digital signature is not valid, the system will not allow the software to run. Secure Boot is a feature of UEFI(Unified Extensible Firmware Interface) that only allows approved operating systems to boot up.", - "Rationale": "A Threat Actor with access to the operating system may seek to alter boot components to persist malware or rootkits during system initialization. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components.", - "Impact": " To enable you have to terminate the instance and create a new one. Also, Shielded instances do not support live migration. During an infrastructure maintenance event, Oracle Cloud Infrastructure live migrates supported VM instances from the physical VM host that needs maintenance to a healthy VM host with minimal disruption to running instances. If you enable Secure Boot on an instance, the instance cannot be migrated, because the hardware TPM is not migratable. This may result in an outage because the TPM can't be migrate from a unhealthy host to healthy host.", - "Remediation": "Terminate the old instance. Create a new instance and ensure on Secure Boot is toggled on under the Security section.", - "Recommendation": "", - "Observation": "Instances that don't enable Secure Boot." - }, - "3.3": { - "Description": "The Block Volume service provides the option to enable in-transit encryption for paravirtualized volume attachments on virtual machine (VM) instances.", - "Rationale": "All the data moving between the instance and the block volume is transferred over an internal and highly secure network. If you have specific compliance requirements related to the encryption of the data while it is moving between the instance and the block volume, you should enable the in-transit encryption option.", - "Impact": "In-transit encryption for boot and block volumes is only available for virtual machine (VM) instances launched from platform images, along with bare metal instances that use the following shapes: BM.Standard.E3.128, BM.Standard.E4.128, BM.DenseIO.E4.128. It is not supported on other bare metal instances.", - "Remediation": "If available, edit the instance and enable in-transit encryption. If not available terminate the old instance. Create a new instance and ensure Use in-transit encryption is toggled on under the Boot volume section.", - "Recommendation": "", - "Observation": "Instances that don't enable in-transit encryption." - }, - "4.1": { - "Description": "Using default tags is a way to ensure all resources that support tags are tagged during creation. Tags can be based on static values or based on computed values. It is recommended to setup default tags early on to ensure all created resources will get tagged.\nTags are scoped to Compartments and are inherited by Child Compartments. The recommendation is to create default tags like “CreatedBy” at the Root Compartment level to ensure all resources get tagged.\nWhen using Tags it is important to ensure that Tag Namespaces are protected by IAM Policies otherwise this will allow users to change tags or tag values.\nDepending on the age of the OCI Tenancy there may already be Tag defaults setup at the Root Level and no need for further action to implement this action.", - "Rationale": "In the case of an incident having default tags like “CreatedBy” applied will provide info on who created the resource without having to search the Audit logs.", - "Impact": "There is no performance impact when enabling the above described features", - "Remediation": "Update the root compartments tag default link. In the Tag Defaults table verify that there is a Tag with a value of \"${iam.principal.name}\" and a Tag Key Status of Active. Also create a Tag key definition by providing a Tag Key, Description and selecting 'Static Value' for Tag Value Type.", - "Recommendation": "", - "Observation": "default tags are used on resources." - }, - "4.2": { - "Description": "Notifications provide a multi-channel messaging service that allow users and applications to be notified of events of interest occurring within OCI. Messages can be sent via eMail, HTTPs, PagerDuty, Slack or the OCI Function service. Some channels, such as eMail require confirmation of the subscription before it becomes active.", - "Rationale": "Creating one or more notification topics allow administrators to be notified of relevant changes made to OCI infrastructure.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Topic in the notifications service under the appropriate compartment and add the subscriptions with current email address and correct protocol.", - "Recommendation": "", - "Observation": "notification topic and subscription for receiving monitoring alerts are configured." - }, - "4.3": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when Identity Providers are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments. It is recommended to create the Event rule at the root compartment level.", - "Rationale": "OCI Identity Providers allow management of User ID / passwords in external systems and use of those credentials to access OCI resources. Identity Providers allow users to single sign-on to OCI console and have other OCI credentials like API Keys.\nMonitoring and alerting on changes to Identity Providers will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Rule Condition in the Events services by selecting Identity in the Service Name Drop-down and selecting Identity Provider – Create, Identity Provider - Delete and Identity Provider – Update. In the Actions section select Notifications as Action Type and select the compartment and topic to be used.", - "Recommendation": "", - "Observation": "notifications have been configured for Identity Provider changes." - }, - "4.4": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when Identity Provider Group Mappings are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments. It is recommended to create the Event rule at the root compartment level", - "Rationale": "IAM Policies govern access to all resources within an OCI Tenancy. IAM Policies use OCI Groups for assigning the privileges. Identity Provider Groups could be mapped to OCI Groups to assign privileges to federated users in OCI. Monitoring and alerting on changes to Identity Provider Group mappings will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Find and click the Rule that handles Idp Group Mapping Changes. Click the Edit Rule button and verify that the RuleConditions section contains a condition for the Service Identity and Event Types: Idp Group Mapping – Create, Idp Group Mapping – Delete, and Idp Group Mapping – Update and confirm Action Type contains: Notifications and that a valid Topic is referenced.", - "Recommendation": "", - "Observation": "notifications have been configured for Identity Provider Group Mapping changes." - }, - "4.5": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when IAM Groups are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "IAM Groups control access to all resources within an OCI Tenancy.\n Monitoring and alerting on changes to IAM Groups will help in identifying changes to satisfy least privilege principle.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Rule Condition by selecting Identity in the Service Name Drop-down and selecting Group – Create, Group – Delete and Group – Update. In the Actions section select Notifications as Action Type and select the compartment and topic to be used.", - "Recommendation": "", - "Observation": "notifications have been configured for IAM Group changes." - }, - "4.6": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when IAM Policies are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "IAM Policies govern access to all resources within an OCI Tenancy.\n Monitoring and alerting on changes to IAM policies will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Rule Condition by selecting Identity in the Service Name Drop-down and selecting Policy – Change Compartment, Policy – Create, Policy - Delete and Policy – Update. In the Actions section select Notifications as Action Type and select the compartment and topic to be used.", - "Recommendation": "", - "Observation": "notifications have been configured for IAM Policy changes." - }, - "4.7": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when IAM Users are created, updated, deleted, capabilities updated, or state updated. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Users use or manage Oracle Cloud Infrastructure resources.\n Monitoring and alerting on changes to Users will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles IAM User Changes and verify that the Rule Conditions section contains a condition for the Service Identity and Event Types: User – Create, User – Delete, User – Update, User Capabilities – Update, User State – Update.", - "Recommendation": "", - "Observation": "notifications have been configured for user changes." - }, - "4.8": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when Virtual Cloud Networks are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Virtual Cloud Networks (VCNs) closely resembles a traditional network.\n Monitoring and alerting on changes to VCNs will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles VCN Changes and verify that the RuleConditions section contains a condition for the Service Networking and Event Types: VCN – Create, VCN - Delete, and VCN – Update.", - "Recommendation": "", - "Observation": "notifications have been configured for VCN changes." - }, - "4.9": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when route tables are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Route tables control traffic flowing to or from Virtual Cloud Networks and Subnets.\n Monitoring and alerting on changes to route tables will help in identifying changes these traffic flows.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles Route Table Changes and verify that the RuleConditions section contains a condition for the Service Networking and Event Types: Route Table – Change Compartment, Route Table – Create, Route Table - Delete, and Route Table – Update.", - "Recommendation": "", - "Observation": "notifications have been configured for changes to route tables." - }, - "4.10": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when security lists are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Security Lists control traffic flowing into and out of Subnets within a Virtual Cloud Network.\n Monitoring and alerting on changes to Security Lists will help in identifying changes to these security controls.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles Security List Changes and verify that the RuleConditions section contains a condition for the Service Networking and Event Types: Security List – Change Compartment, Security List – Create, Security List - Delete, and Security List – Update.", - "Recommendation": "", - "Observation": "notifications have been configured for security list changes." - }, - "4.11": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when network security groups are created, updated or deleted. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Network Security Groups control traffic flowing between Virtual Network Cards attached to Compute instances.\n Monitoring and alerting on changes to Network Security Groups will help in identifying changes these security controls.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles Network Security Group changes and verify that the RuleConditions section contains a condition for the Service Networking and Event Types: Network Security Group – Change Compartment, Network Security Group – Create, Network Security Group - Delete, and Network Security Group – Update.", - "Recommendation": "", - "Observation": "notifications have been configured for changes on Network Service Groups." - }, - "4.12": { - "Description": "It is recommended to setup an Event Rule and Notification that gets triggered when Network Gateways are created, updated, deleted, attached, detached, or moved. This recommendation includes Internet Gateways, Dynamic Routing Gateways, Service Gateways, Local Peering Gateways, and NAT Gateways. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.", - "Rationale": "Network Gateways act as routers between VCNs and the Internet, Oracle Services Networks, other VCNS, and on-premise networks.\n Monitoring and alerting on changes to Network Gateways will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Edit Rule that handles Network Gateways Changes and verify that the RuleConditions section contains a condition for the Service Networking and Event Types: DRG – Create, DRG - Delete, DRG - Update, DRG Attachment – Create, DRG Attachment – Delete, DRG Attachment - Update, Internet Gateway – Create, Internet Gateway – Delete, Internet Gateway - Update, Internet Gateway – Change Compartment, Local Peering Gateway – Create, Local Peering Gateway – Delete End, Local Peering Gateway - Update, Local Peering Gateway – Change Compartment, NAT Gateway – Create, NAT Gateway – Delete, NAT Gateway - Update, NAT Gateway – Change Compartment,Compartment, Service Gateway – Create, Service Gateway – Delete Begin, Service Gateway – Delete End, Service Gateway – Update, Service Gateway – Attach Service, Service Gateway – Detach Service, Service Gateway – Change Compartment.", - "Recommendation": "", - "Observation": "notifications have been configured for changes on network gateways." - }, - "4.13": { - "Description": "VCN flow logs record details about traffic that has been accepted or rejected based on the security list rule.", - "Rationale": "Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic.", - "Impact": "Enabling VCN flow logs will not affect the performance of your virtual network but it will generate additional use of object storage that should be controlled via object lifecycle management.

By default, VCN flow logs are stored for 30 days in object storage. Users can specify a longer retention period.", - "Remediation": "Enable Flow Logs (all records) on Virtual Cloud Networks (subnets) under the relevant resource compartment. Before hand create Log group if not exist in the Log services.", - "Recommendation": "", - "Observation": "VCNs have no flow logging configured." - }, - "4.14": { - "Description": "Cloud Guard detects misconfigured resources and insecure activity within a tenancy and provides security administrators with the visibility to resolve these issues. Upon detection, Cloud Guard can suggest, assist, or take corrective actions to mitigate these issues. Cloud Guard should be enabled in the root compartment of your tenancy with the default configuration, activity detectors and responders.", - "Rationale": "Cloud Guard provides an automated means to monitor a tenancy for resources that are configured in an insecure manner as well as risky network activity from these resources.", - "Impact": "There is no performance impact when enabling the above described features, but additional IAM policies will be required.", - "Remediation": "Enable the cloud guard by selecting the services in the menu and provide appropriate reporting region and other configurations.", - "Recommendation": "", - "Observation": "Cloud Guard has not been configured in the root compartment of the tenancy." - }, - "4.15": { - "Description": "Cloud Guard detects misconfigured resources and insecure activity within a tenancy and provides security administrators with the visibility to resolve these issues. Upon detection, Cloud Guard generates a Problem. It is recommended to setup an Event Rule and Notification that gets triggered when Oracle Cloud Guard Problems are created, dismissed or remediated. Event Rules are compartment scoped and will detect events in child compartments. It is recommended to create the Event rule at the root compartment level.", - "Rationale": "Cloud Guard provides an automated means to monitor a tenancy for resources that are configured in an insecure manner as well as risky network activity from these resources. Monitoring and alerting on Problems detected by Cloud Guard will help in identifying changes to the security posture.", - "Impact": "There is no performance impact when enabling the above described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Rule Condition by selecting Cloud Guard in the Service Name Drop-down and selecting Detected – Problem, Remediated – Problem and Dismissed - Problem. In the Actions section select Notifications as Action Type and select the compartment and topic to be used.", - "Recommendation": "", - "Observation": "notifications have been configured for Cloud Guard Problems." - }, - "4.16": { - "Description": "Oracle Cloud Infrastructure Vault securely stores master encryption keys that protect your encrypted data. You can use the Vault service to rotate keys to generate new cryptographic material. Periodically rotating keys limits the amount of data encrypted by one key version.", - "Rationale": "Rotating keys annually limits the data encrypted under one key version. Key rotation thereby reduces the risk in case a key is ever compromised.", - "Impact": "", - "Remediation": "Select the security service and select vault. Ensure the date of each Master Encryption Key under the Created column of the Master Encryption key is no more than 365 days old.", - "Recommendation": "", - "Observation": "customer-managed keys are older than one year." - }, - "4.17": { - "Description": "Object Storage write logs will log all write requests made to objects in a bucket.", - "Rationale": "Enabling an Object Storage write log, the 'requestAction' property would contain values of 'PUT', 'POST', or 'DELETE'. This will provide you more visibility into changes to objects in your buckets.", - "Impact": "There is no performance impact when enabling the above described features, but will generate additional use of object storage that should be controlled via object lifecycle management.

By default, Object Storage logs are stored for 30 days in object storage. Users can specify a longer retention period.", - "Remediation": "To the relevant bucket enable log by providing Write Access Events from the Log Category. Beforehand create log group if required.", - "Recommendation": "", - "Observation": "object stores have no write level logging enabled." - }, - "4.18": { - "Description": "It is recommended that an Event Rule and Notification be set up when a user in the via OCI local authentication. Event Rules are compartment-scoped and will detect events in child compartments. This Event rule is required to be created at the root compartment level.", - "Rationale": "Users should rarely use OCI local authenticated and be authenticated via organizational standard Identity providers, not local credentials. Access in this matter would represent a break glass activity and should be monitored to see if changes made impact the security posture.", - "Impact": "There is no performance impact when enabling the above-described features but depending on the amount of notifications sent per month there may be a cost associated.", - "Remediation": "Create a Rule Condition by selecting Identity SignOn in the Service Name Drop-down and selecting and Event Types: Interactive Login. In the Actions section select Notifications as Action Type and select the compartment and topic to be used.", - "Recommendation": "", - "Observation": "notifications have been configured Local User Authentication." - }, - "5.1.1": { - "Description": "A bucket is a logical container for storing objects. It is associated with a single compartment that has policies that determine what action a user can perform on a bucket and on all the objects in the bucket. It is recommended that no bucket be publicly accessible.", - "Rationale": "Removing unfettered reading of objects in a bucket reduces an organization's exposure to data loss.", - "Impact": "For updating an existing bucket, care should be taken to ensure objects in the bucket can be accessed through either IAM policies or pre-authenticated requests.", - "Remediation": "Edit the visibility into 'private' for each Bucket.", - "Recommendation": "", - "Observation": "object storage buckets are publicly visible." - }, - "5.1.2": { - "Description": "Oracle Object Storage buckets support encryption with a Customer Managed Key (CMK). By default, Object Storage buckets are encrypted with an Oracle managed key.", - "Rationale": "Encryption of Object Storage buckets with a Customer Managed Key (CMK) provides an additional level of security on your data by allowing you to manage your own encryption key lifecycle management for the bucket.", - "Impact": "Encrypting with a Customer Managed Keys requires a Vault and a Customer Master Key. In addition, you must authorize Object Storage service to use keys on your behalf.

Required Policy:\n
\nAllow service objectstorage-<region_name>, to use keys in compartment <compartment-id> where target.key.id = '<key_OCID>'

", - "Remediation": "Assign Master encryption key to Encryption key in every Object storage under Bucket name by clicking assign and select vault.", - "Recommendation": "", - "Observation": "object store buckets do not use Customer-Managed Keys (CMK)." - }, - "5.1.3": { - "Description": "A bucket is a logical container for storing objects. Object versioning is enabled at the bucket level and is disabled by default upon creation. Versioning directs Object Storage to automatically create an object version each time a new object is uploaded, an existing object is overwritten, or when an object is deleted. You can enable object versioning at bucket creation time or later.", - "Rationale": "Versioning object storage buckets provides for additional integrity of your data. Management of data integrity is critical to protecting and accessing protected data. Some customers want to identify object storage buckets without versioning in order to apply their own data lifecycle protection and management policy.", - "Impact": "", - "Remediation": "Enable Versioning by clicking on every bucket by editing the bucket configuration.", - "Recommendation": "", - "Observation": "object store buckets have no versioning enabled." - }, - "5.2.1": { - "Description": "Oracle Cloud Infrastructure Block Volume service lets you dynamically provision and manage block storage volumes. By default, the Oracle service manages the keys that encrypt this block volume. Block Volumes can also be encrypted using a customer managed key.", - "Rationale": "Encryption of block volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Customers should identify block volumes encrypted with Oracle service managed keys in order to determine if they want to manage the keys for certain volumes and then apply their own key lifecycle management to the selected block volumes.", - "Impact": "Encrypting with a Customer Managed Keys requires a Vault and a Customer Master Key. In addition, you must authorize the Block Volume service to use the keys you create.\nRequired IAM Policy:\n
\nAllow service blockstorage to use keys in compartment <compartment-id> where target.key.id = '<key_OCID>'\n
", - "Remediation": "For each block volumes from the result, assign the encryption key by Selecting the Vault Compartment and Vault, select the Master Encryption Key Compartment and Master Encryption key, click Assign.", - "Recommendation": "", - "Observation": "block volumes are not encrypted with a Customer-Managed Key." - }, - "5.2.2": { - "Description": "When you launch a virtual machine (VM) or bare metal instance based on a platform image or custom image, a new boot volume for the instance is created in the same compartment. That boot volume is associated with that instance until you terminate the instance. By default, the Oracle service manages the keys that encrypt this boot volume. Boot Volumes can also be encrypted using a customer managed key.", - "Rationale": "Encryption of boot volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Customers should identify boot volumes encrypted with Oracle service managed keys in order to determine if they want to manage the keys for certain boot volumes and then apply their own key lifecycle management to the selected boot volumes.", - "Impact": "Encrypting with a Customer Managed Keys requires a Vault and a Customer Master Key. In addition, you must authorize the Boot Volume service to use the keys you create.\nRequired IAM Policy:\n
\nAllow service Bootstorage to use keys in compartment <compartment-id> where target.key.id = '<key_OCID>'\n
", - "Remediation": "For each boot volumes from the result, assign the encryption key by Selecting the Vault Compartment and Vault, select the Master Encryption Key Compartment and Master Encryption key, click Assign.", - "Recommendation": "", - "Observation": "boot volumes are not encrypted with a Customer-Managed Key." - }, - "5.3.1": { - "Description": "Oracle Cloud Infrastructure File Storage service (FSS) provides a durable, scalable, secure, enterprise-grade network file system. By default, the Oracle service manages the keys that encrypt FSS file systems. FSS file systems can also be encrypted using a customer managed key.", - "Rationale": "Encryption of FSS systems provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Customers should identify FSS file systems that are encrypted with Oracle service managed keys in order to determine if they want to manage the keys for certain FSS file systems and then apply their own key lifecycle management to the selected FSS file systems.", - "Impact": "Encrypting with a Customer Managed Keys requires a Vault and a Customer Master Key. In addition, you must authorize the File Storage service to use the keys you create.\nRequired IAM Policy:\n
\nAllow service FssOc1Prod to use keys in compartment <compartment-id> where target.key.id = '<key_OCID>'\n
", - "Remediation": "For each file storage system from the result, assign the encryption key by Selecting the Vault Compartment and Vault, select the Master Encryption Key Compartment and Master Encryption key, click Assign.", - "Recommendation": "", - "Observation": "file storage services (FSS) are not encrypted with a Customer-Managed Key." - }, - "6.1": { - "Description": "When you sign up for Oracle Cloud Infrastructure, Oracle creates your tenancy, which is the root compartment that holds all your cloud resources. You then create additional compartments within the tenancy (root compartment) and corresponding policies to control access to the resources in each compartment.

Compartments allow you to organize and control access to your cloud resources. A compartment is a collection of related resources (such as instances, databases, virtual cloud networks, block volumes) that can be accessed only by certain groups that have been given permission by an administrator.", - "Rationale": "Compartments are a logical group that adds an extra layer of isolation, organization and authorization making it harder for unauthorized users to gain access to OCI resources.", - "Impact": "Once the compartment is created an OCI IAM policy must be created to allow a group to resources in the compartment otherwise only group with tenancy access will have access.", - "Remediation": "Create the new compartment under the root compartment.", - "Recommendation": "", - "Observation": "Only the root compartment is used in the tenancy." - }, - "6.2": { - "Description": "When you create a cloud resource such as an instance, block volume, or cloud network, you must specify to which compartment you want the resource to belong. Placing resources in the root compartment makes it difficult to organize and isolate those resources.", - "Rationale": "Placing resources into a compartment will allow you to organize and have more granular access controls to your cloud resources.", - "Impact": "Placing a resource in a compartment will impact how you write policies to manage access and organize that resource.", - "Remediation": "For each item in the returned results, select Move Resource or More Actions then Move Resource and select compartment except root and choose new then move resources.", - "Recommendation": "", - "Observation": "resources are created in the root compartment." - } - } - - # OBP Checks - self.obp_foundations_checks = { - 'SIEM_Audit_Log_All_Comps': {'id': 'OBP-SIEM-1', 'section': "SIEM Logging", 'Title': 'All compartment audit logs sent to SIEM in all regions', 'Status': True, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-aggregate-logs-siem/index.html"}, # Assuming True - 'SIEM_Audit_Incl_Sub_Comp': {'id': 'OBP-SIEM-2', 'section': "SIEM Logging", 'Title': 'Include all sub-compartments flag checked at the tenancy root compartment', 'Status': True, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-aggregate-logs-siem/index.html"}, # Assuming True - 'SIEM_VCN_Flow_Logging': {'id': 'OBP-SIEM-3', 'section': "SIEM Logging", 'Title': 'VCN Flow logs sent to SIEM', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-aggregate-logs-siem/index.html"}, - 'SIEM_Write_Bucket_Logs': {'id': 'OBP-SIEM-4', 'section': "SIEM Logging", 'Title': 'Bucket write logs sent to SIEM', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-aggregate-logs-siem/index.html"}, - 'SIEM_Read_Bucket_Logs': {'id': 'OBP-SIEM-5', 'section': "SIEM Logging", 'Title': 'Bucket read logs sent to SIEM', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-aggregate-logs-siem/index.html"}, - 'Log_Retention': {'id': 'LAM-19', 'section': "Logging", 'Title': 'Retain Audit Logs for 90 days', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Logging/Task/update-logging-log.htm"}, - 'Networking_Redudancy': {'id': 'OBP-NTW-1', 'section': "Advanced Networking", 'Title': 'Scalable and secure topology in OCI', 'Status': True, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Network/Troubleshoot/drgredundancy.htm"}, - 'Networking_DRG_Upgraded': {'id': 'OBP-NTW-2', 'section': "Advanced Networking", 'Title': 'Dynamic Route Gateway (DRG) upgraded to version 2', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/drg-upgrade.htm"}, - 'Networking_Hub_Spoke': {'id': 'OBP-NTW-3', 'section': "Advanced Networking", 'Title': 'Hub and Spoke Network Architecture', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/hub-spoke-network/index.html"}, - 'Networking_IPSec_connections': {'id': 'OBP-NTW-4', 'section': "Advanced Networking", 'Title': 'IPSec connections with two tunnels', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/overviewIPsec.htm"}, - 'Networking_IPSec_bgp': {'id': 'OBP-NTW-5', 'section': "Advanced Networking", 'Title': 'IPSec connections with BGP Routing', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/overviewIPsec.htm"}, - 'Cloud_Guard_Config': {'id': 'OBP-CSP-1', 'section': "CSPM", 'Title': 'Cloud Guard enabled and configured', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/cloud-guard/using/part-customize.htm"}, - 'Cloud_Guard_Problems': {'id': 'OBP-CSP-2', 'section': "CSPM", 'Title': 'Cloud Guard problems with Risk Level Critical or High', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/cloud-guard/using/part-problems.htm"}, - 'Certificates_Near_Expiry': {'id': 'OBP-CRT-1', 'section': "Certificates", 'Title': 'Certificates to expire in 30 days', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/certificates/renewing-certificate.htm"}, - 'Service_Limits': {'id': 'OBP-GOV-1', 'section': "Governance", 'Title': 'Visibility into OCI Limits', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/solutions/oci-best-practices/manage-your-service-limits1.html#GUID-457D23F7-98C4-4F74-9E1B-A8F3BCA60C6E"}, - 'Cost_Tracking_Budgets': {'id': 'OBP-GOV-2', 'section': "Governance", 'Title': 'Alerting on unexpected spending', 'Status': False, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Billing/Concepts/budgetsoverview.htm#Budgets_Overview"}, - 'Quotas': {'id': 'OBP-GOV-3', 'section': "Governance", 'Title': 'Quota policies are used', 'Status': False, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Quotas/Concepts/resourcequotas.htm"}, - 'ADB_MTLS': {'id': 'OBP-ADB-1', 'section': "Autonoumous Database", 'Title': 'ADB Databases enforce Mutual TLS authentication', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/support-tls-mtls-authentication.html#GUID-3F3F1FA4-DD7D-4211-A1D3-A74ED35C0AF5"}, - 'ADB_DataSafe': {'id': 'OBP-ADB-2', 'section': "Autonoumous Database", 'Title': 'ABD Databases in the tenancy are integrated with a security scanning tool', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/support-tls-mtls-authentication.html#GUID-3F3F1FA4-DD7D-4211-A1D3-A74ED35C0AF5"}, - 'ADB_CMK': {'id': 'OBP-ADB-3', 'section': "Autonoumous Database", 'Title': 'ADB Database data is encrypted with a customer managed key', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/support-tls-mtls-authentication.html#GUID-3F3F1FA4-DD7D-4211-A1D3-A74ED35C0AF5"}, - 'ADB_Contacts': {'id': 'OBP-ADB-4', 'section': "Autonoumous Database", 'Title': 'ABD Databases have a contact listed', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/support-tls-mtls-authentication.html#GUID-3F3F1FA4-DD7D-4211-A1D3-A74ED35C0AF5"}, - 'ADB_Private_IP': {'id': 'OBP-ADB-5', 'section': "Autonoumous Database", 'Title': 'ADB Database are have private endpoints into a customer managed VCN', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/support-tls-mtls-authentication.html#GUID-3F3F1FA4-DD7D-4211-A1D3-A74ED35C0AF5"}, - 'IAM_Stmt_Root_Count': {'id': 'IAM-18', 'section': "Identity and Access Management", 'Title': 'IAM Policies are created at appropriate ', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Identity/policymgmt/policy-limits-compartment-hierarchy.htm"}, - 'IAM_Stmt_Comp_Hierarchy_Count': {'id': 'IAM-19', 'section': "Identity and Access Management", 'Title': 'IAM Policy Statements Limit per Compartment Hierarchy', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Identity/policymgmt/policy-limits-compartment-hierarchy.htm"}, - 'IAM_Account_Lockout': {'id': 'IAM-20', 'section': "Identity and Access Management", 'Title': 'Account Lockout 5 or more', 'Status': None, 'Findings': [], 'OBP': [], "Documentation": "https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/Managing-Password-Policies_set-password-policies-your-identity-domain.htm"}, - } - # CIS and OBP Regional Data - # 4.6 is not regional because OCI IAM Policies only exist in the home region - self.__cis_regional_checks = {"4.3","4.4","4.5","4.7","4.8", "4.9", "4.10", "4.11", "4.12", "4.18"} - self.__obp_regional_checks = {} - - # CIS monitoring notifications check - self.cis_monitoring_checks = { - "4.3": [ - 'com.oraclecloud.identitycontrolplane.createidentityprovider', - 'com.oraclecloud.identitycontrolplane.deleteidentityprovider', - 'com.oraclecloud.identitycontrolplane.updateidentityprovider' - ], - "4.4": [ - 'com.oraclecloud.identitycontrolplane.addidpgroupmapping', - 'com.oraclecloud.identitycontrolplane.removeidpgroupmapping', - 'com.oraclecloud.identitycontrolplane.updateidpgroupmapping' - ], - "4.5": [ - 'com.oraclecloud.identitycontrolplane.creategroup', - 'com.oraclecloud.identitycontrolplane.deletegroup', - 'com.oraclecloud.identitycontrolplane.updategroup' - ], - "4.6": [ - 'com.oraclecloud.identitycontrolplane.createpolicy', - 'com.oraclecloud.identitycontrolplane.deletepolicy', - 'com.oraclecloud.identitycontrolplane.updatepolicy' - ], - "4.7": [ - 'com.oraclecloud.identitycontrolplane.createuser', - 'com.oraclecloud.identitycontrolplane.deleteuser', - 'com.oraclecloud.identitycontrolplane.updateuser', - 'com.oraclecloud.identitycontrolplane.updateusercapabilities', - 'com.oraclecloud.identitycontrolplane.updateuserstate' - ], - "4.8": [ - 'com.oraclecloud.virtualnetwork.createvcn', - 'com.oraclecloud.virtualnetwork.deletevcn', - 'com.oraclecloud.virtualnetwork.updatevcn' - ], - "4.9": [ - 'com.oraclecloud.virtualnetwork.changeroutetablecompartment', - 'com.oraclecloud.virtualnetwork.createroutetable', - 'com.oraclecloud.virtualnetwork.deleteroutetable', - 'com.oraclecloud.virtualnetwork.updateroutetable' - ], - "4.10": [ - 'com.oraclecloud.virtualnetwork.changesecuritylistcompartment', - 'com.oraclecloud.virtualnetwork.createsecuritylist', - 'com.oraclecloud.virtualnetwork.deletesecuritylist', - 'com.oraclecloud.virtualnetwork.updatesecuritylist' - ], - "4.11": [ - 'com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment', - 'com.oraclecloud.virtualnetwork.createnetworksecuritygroup', - 'com.oraclecloud.virtualnetwork.deletenetworksecuritygroup', - 'com.oraclecloud.virtualnetwork.updatenetworksecuritygroup' - ], - "4.12": [ - 'com.oraclecloud.virtualnetwork.createdrg', - 'com.oraclecloud.virtualnetwork.deletedrg', - 'com.oraclecloud.virtualnetwork.updatedrg', - 'com.oraclecloud.virtualnetwork.createdrgattachment', - 'com.oraclecloud.virtualnetwork.deletedrgattachment', - 'com.oraclecloud.virtualnetwork.updatedrgattachment', - 'com.oraclecloud.virtualnetwork.changeinternetgatewaycompartment', - 'com.oraclecloud.virtualnetwork.createinternetgateway', - 'com.oraclecloud.virtualnetwork.deleteinternetgateway', - 'com.oraclecloud.virtualnetwork.updateinternetgateway', - 'com.oraclecloud.virtualnetwork.changelocalpeeringgatewaycompartment', - 'com.oraclecloud.virtualnetwork.createlocalpeeringgateway', - 'com.oraclecloud.virtualnetwork.deletelocalpeeringgateway.end', - 'com.oraclecloud.virtualnetwork.updatelocalpeeringgateway', - 'com.oraclecloud.natgateway.changenatgatewaycompartment', - 'com.oraclecloud.natgateway.createnatgateway', - 'com.oraclecloud.natgateway.deletenatgateway', - 'com.oraclecloud.natgateway.updatenatgateway', - 'com.oraclecloud.servicegateway.attachserviceid', - 'com.oraclecloud.servicegateway.changeservicegatewaycompartment', - 'com.oraclecloud.servicegateway.createservicegateway', - 'com.oraclecloud.servicegateway.deleteservicegateway.end', - 'com.oraclecloud.servicegateway.detachserviceid', - 'com.oraclecloud.servicegateway.updateservicegateway' - - ], - "4.15": [ - 'com.oraclecloud.cloudguard.problemdetected', - 'com.oraclecloud.cloudguard.problemdismissed', - 'com.oraclecloud.cloudguard.problemremediated' - ], - "4.18": [ - 'com.oraclecloud.identitysignon.interactivelogin' - ] - } - - # CIS IAM check - self.cis_iam_checks = { - "1.3": {"targets": ["target.group.name!=Administrators"]}, - "1.14": {"resources": ["fnfunc", "instance", "autonomousdatabase", "resource.compartment.id"]}, - "1.15": { - "all-resources": [ - "request.permission!=BUCKET_DELETE", "request.permission!=OBJECT_DELETE", "request.permission!=EXPORT_SET_DELETE", - "request.permission!=MOUNT_TARGET_DELETE", "request.permission!=FILE_SYSTEM_DELETE", "request.permission!=VOLUME_BACKUP_DELETE", - "request.permission!=VOLUME_DELETE", "request.permission!=FILE_SYSTEM_DELETE_SNAPSHOT" - ], - "file-family": [ - "request.permission!=EXPORT_SET_DELETE", "request.permission!=MOUNT_TARGET_DELETE", - "request.permission!=FILE_SYSTEM_DELETE", "request.permission!=FILE_SYSTEM_DELETE_SNAPSHOT" - ], - "file-systems": ["request.permission!=FILE_SYSTEM_DELETE", "request.permission!=FILE_SYSTEM_DELETE_SNAPSHOT"], - "mount-targets": ["request.permission!=MOUNT_TARGET_DELETE"], - "object-family": ["request.permission!=BUCKET_DELETE", "request.permission!=OBJECT_DELETE"], - "buckets": ["request.permission!=BUCKET_DELETE"], - "objects": ["request.permission!=OBJECT_DELETE"], - "volume-family": ["request.permission!=VOLUME_BACKUP_DELETE", "request.permission!=VOLUME_DELETE", "request.permission!=BOOT_VOLUME_BACKUP_DELETE"], - "volumes": ["request.permission!=VOLUME_DELETE"], - "volume-backups": ["request.permission!=VOLUME_BACKUP_DELETE"], - "boot-volume-backups": ["request.permission!=BOOT_VOLUME_BACKUP_DELETE"]}, - "1.15-storage-admin": { - "all-resources": [ - "request.permission=BUCKET_DELETE", "request.permission=OBJECT_DELETE", "request.permission=EXPORT_SET_DELETE", - "request.permission=MOUNT_TARGET_DELETE", "request.permission=FILE_SYSTEM_DELETE", "request.permission=VOLUME_BACKUP_DELETE", - "request.permission=VOLUME_DELETE", "request.permission=FILE_SYSTEM_DELETE_SNAPSHOT" - ], - "file-family": [ - "request.permission=EXPORT_SET_DELETE", "request.permission=MOUNT_TARGET_DELETE", - "request.permission=FILE_SYSTEM_DELETE", "request.permission=FILE_SYSTEM_DELETE_SNAPSHOT" - ], - "file-systems": ["request.permission=FILE_SYSTEM_DELETE", "request.permission=FILE_SYSTEM_DELETE_SNAPSHOT"], - "mount-targets": ["request.permission=MOUNT_TARGET_DELETE"], - "object-family": ["request.permission=BUCKET_DELETE", "request.permission=OBJECT_DELETE"], - "buckets": ["request.permission=BUCKET_DELETE"], - "objects": ["request.permission=OBJECT_DELETE"], - "volume-family": ["request.permission=VOLUME_BACKUP_DELETE", "request.permission=VOLUME_DELETE", "request.permission=BOOT_VOLUME_BACKUP_DELETE"], - "volumes": ["request.permission=VOLUME_DELETE"], - "volume-backups": ["request.permission=VOLUME_BACKUP_DELETE"], - "boot-volume-backups": ["request.permission=BOOT_VOLUME_BACKUP_DELETE"]}} - - # CIS Network Filter Check - self.all_traffic_rules = [{'ruleAction': 'INCLUDE', 'protocol': 'all', 'udpOptions': None, 'isEnabled': True, 'sourceCidr': None, - 'samplingRate': 1, 'flowLogType': 'ALL', 'destinationCidr': None, 'icmpOptions': None, 'priority': 0, 'tcpOptions': None}, - {'ruleAction': 'INCLUDE','protocol': 'all','udpOptions': None,'sourceCidr': '0.0.0.0/0','isEnabled': True,'samplingRate': 1, - 'flowLogType': 'ALL','icmpOptions': None,'destinationCidr': '0.0.0.0/0','priority': 0,'tcpOptions': None}] - - # Tenancy Data - self.__tenancy = None - self.__cloud_guard_config = None - self.__cloud_guard_config_status = None - self.__os_namespace = None - self.regional_limits_dict = {} - self.__service_limits = [] - - # For IAM Checks - self.__tenancy_password_policy = None - self.__compartments = [] - self.__raw_compartment = {} - self.__policies = [] - self.__users = [] - self.__groups = {} # Indexed by GRP OCID - self.__groups_to_users = [] - self.__tag_defaults = [] - self.__dynamic_groups = [] - self.__identity_domains = [] - self.__compartment_hierarchy_info = [] - - # For Networking checks - self.__network_security_groups = [] - self.__network_security_lists = [] - self.__network_subnets = [] - self.__network_vcns = {} - self.__network_capturefilters = {} - - self.__network_fastconnects = {} # Indexed by DRG ID - self.__network_drgs = {} # Indexed by DRG ID - self.__raw_network_drgs = [] - - self.__network_cpes = [] - self.__network_ipsec_connections = {} # Indexed by DRG ID - self.__network_drg_attachments = {} # Indexed by DRG ID - - # For Autonomous Database Checks - self.__autonomous_databases = [] - - # For Oracle Analytics Cloud Checks - self.__analytics_instances = [] - - # For Oracle Integration Cloud Checks - self.__integration_instances = [] - - # For Logging & Monitoring checks - self.__event_rules = [] - self.__logging_list = [] - self.__subnet_logs = {} # to be deleted - self.__all_logs = {} - self.__write_bucket_logs = {} - self.__read_bucket_logs = {} - self.__load_balancer_access_logs = [] - self.__load_balancer_error_logs = [] - self.__api_gateway_access_logs = [] - self.__api_gateway_error_logs = [] - - # Cloud Guard checks - self.__cloud_guard_targets = {} - self.__cloud_guard_problems = [] - - # For Storage Checks - self.__buckets = [] - self.__boot_volumes = [] - self.__block_volumes = [] - self.__file_storage_system = [] - - # For Vaults and Keys checks - self.__vaults = {} - self.__kms_keys = [] - - # For Region - self.__regions = {} - self.__raw_regions = [] - self.__home_region = None - - # For ONS Subscriptions - self.__subscriptions = [] - - # Results from Advanced search query - self.__resources_in_root_compartment = [] - - # For Budgets - self.__budgets = [] - - # Quotas - self.__quotas = [] - - # For Service Connector - self.__service_connectors = {} - - # Error Data - self.__errors = [] - - # All Resources - self.__all_resources_json = {} - - # Compute Resources - Thinking about - self.__Instance = [] - - # Certificates raw resources - self.__raw_oci_certificates = [] - - # Start print time info - show_version(verbose=True) - print("\nStarts at " + self.start_time_str) - self.__config = config - self.__signer = signer - self.__proxy = proxy - - # By Default it is passed True to print all output - if print_to_screen.upper() == 'TRUE': - self.__print_to_screen = True - else: - self.__print_to_screen = False - - # By Default debugging is disabled by default - global DEBUG - DEBUG = debug - - # creating list of regions to run - try: - if regions_to_run_in: - self.__regions_to_run_in = regions_to_run_in.split(",") - self.__run_in_all_regions = False - else: - # If no regions are passed I will run them in all - self.__regions_to_run_in = regions_to_run_in - self.__run_in_all_regions = True - print("\nRegions to run in: " + ("all regions" if self.__run_in_all_regions else str(self.__regions_to_run_in))) - - except Exception: - raise RuntimeError("Invalid input regions must be comma separated with no : 'us-ashburn-1,us-phoenix-1'") - - try: - - self.__identity = oci.identity.IdentityClient( - self.__config, signer=self.__signer) - if proxy: - self.__identity.base_client.session.proxies = {'https': proxy} - - # Getting Tenancy Data and Region data - self.__tenancy = self.__identity.get_tenancy( - config["tenancy"]).data - regions = self.__identity.list_region_subscriptions( - self.__tenancy.id).data - - except Exception as e: - raise RuntimeError("Failed to get identity information." + str(e.args)) - - try: - #Find the budget home region to ensure the budget client is run against the home region - budget_home_region = next( - (obj.region_name for obj in regions if obj.is_home_region),None) - budget_config = self.__config.copy() - budget_config["region"] = budget_home_region - - self.__budget_client = oci.budget.BudgetClient( - budget_config, signer=self.__signer) - if proxy: - self.__budget_client.base_client.session.proxies = {'https': proxy} - except Exception as e: - raise RuntimeError("Failed to get create budgets client" + str(e.args)) - - # Creating a record for home region and a list of all regions including the home region - for region in regions: - if region.is_home_region: - self.__home_region = region.region_name - print("Home region for tenancy is " + self.__home_region) - if self.__home_region != self.__config['region']: - print_header("It is recommended to run the CIS Complaince script in your home region") - print_header("The current region is: " + self.__config['region']) - - self.__regions[region.region_name] = { - "is_home_region": region.is_home_region, - "region_key": region.region_key, - "region_name": region.region_name, - "status": region.status, - "identity_client": self.__identity, - "budget_client": self.__budget_client - } - elif region.region_name in self.__regions_to_run_in or self.__run_in_all_regions: - self.__regions[region.region_name] = { - "is_home_region": region.is_home_region, - "region_key": region.region_key, - "region_name": region.region_name, - "status": region.status, - } - - record = { - "is_home_region": region.is_home_region, - "region_key": region.region_key, - "region_name": region.region_name, - "status": region.status, - } - self.__raw_regions.append(record) - - # By Default it is today's date - self.__report_directory = f'{report_directory}' if report_directory else f'{self.__tenancy.name}-{self.report_datetime}' - - self.__report_prefix = f'{report_prefix}_' if report_prefix else '' - self.__report_summary_json = report_summary_json - - # Checking if a Tenancy has Identity Domains enabled - try: - oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_domains, - compartment_id = self.__tenancy.id, - lifecycle_state = "ACTIVE", - name="Default" - ).data - self.__identity_domains_enabled=True - print_header("Identity Domains Enabled in Tenancy") - except Exception as e: - if e.status == 404: - print_header("Identity Domains Disabled in Tenancy") - self.__identity_domains_enabled = False - else: - raise RuntimeError( - "Failed to list identity domains." + str(e.args)) - - # Creating signers and config for all regions - self.__create_regional_signers(proxy) - - # Setting os_namespace based on home region - try: - if not (self.__os_namespace): - self.__os_namespace = self.__regions[self.__home_region]['os_client'].get_namespace().data - except Exception as e: - raise RuntimeError( - "Failed to get tenancy namespace." + str(e.args)) - - # Determining if a need a object storage client for output - self.__output_bucket = output_bucket - if self.__output_bucket: - self.__output_bucket_client = self.__regions[self.__home_region]['os_client'] - - # Determining if all raw data will be output - self.__output_raw_data = raw_data - - # Determining if OCI Best Practices will be checked and output - self.__obp_checks = obp - - # Determining if CSV report OCIDs will be redacted - self.__redact_output = redact_output - - # Determine if All resource from Search service should be queried - self.__all_resources = all_resources - if all_resources: - self.__all_resources = all_resources - self.__obp_checks = True - self.__output_raw_data = True - - # Determining if OCI API unused for 45 days check is disable or not - self.__disable_api_keys = disable_api_keys - - # Determine if __oci_cloud_url will be override with a different realm ex. OC2 or sovreign region - self.__oci_cloud_url = "https://cloud.oracle.com" - if oci_url: - self.__oci_cloud_url = oci_url - - # OCI Link - self.__oci_users_uri = self.__oci_cloud_url + "/identity/users/" - self.__oci_policies_uri = self.__oci_cloud_url + "/identity/policies/" - self.__oci_groups_uri = self.__oci_cloud_url + "/identity/groups/" - self.__oci_dynamic_groups_uri = self.__oci_cloud_url + "/identity/dynamicgroups/" - self.__oci_identity_domains_uri = self.__oci_cloud_url + '/identity/domains/' - self.__oci_buckets_uri = self.__oci_cloud_url + "/object-storage/buckets/" - self.__oci_boot_volumes_uri = self.__oci_cloud_url + "/block-storage/boot-volumes/" - self.__oci_block_volumes_uri = self.__oci_cloud_url + "/block-storage/volumes/" - self.__oci_fss_uri = self.__oci_cloud_url + "/fss/file-systems/" - self.__oci_networking_uri = self.__oci_cloud_url + "/networking/vcns/" - self.__oci_network_capturefilter_uri = self.__oci_cloud_url + "/networking/network-command-center/capture-filters/" - self.__oci_adb_uri = self.__oci_cloud_url + "/db/adb/" - self.__oci_oicinstance_uri = self.__oci_cloud_url + "/oic/integration-instances/" - self.__oci_oacinstance_uri = self.__oci_cloud_url + "/analytics/instances/" - self.__oci_compartment_uri = self.__oci_cloud_url + "/identity/compartments/" - self.__oci_drg_uri = self.__oci_cloud_url + "/networking/drgs/" - self.__oci_cpe_uri = self.__oci_cloud_url + "/networking/cpes/" - self.__oci_ipsec_uri = self.__oci_cloud_url + "/networking/vpn-connections/" - self.__oci_events_uri = self.__oci_cloud_url + "/events/rules/" - self.__oci_loggroup_uri = self.__oci_cloud_url + "/logging/log-groups/" - self.__oci_vault_uri = self.__oci_cloud_url + "/security/kms/vaults/" - self.__oci_budget_uri = self.__oci_cloud_url + "/usage/budgets/" - self.__oci_cgtarget_uri = self.__oci_cloud_url + "/cloud-guard/targets/" - self.__oci_cgproblems_uri = self.__oci_cloud_url + "/cloud-guard/problems/" - self.__oci_onssub_uri = self.__oci_cloud_url + "/notification/subscriptions/" - self.__oci_serviceconnector_uri = self.__oci_cloud_url + "/connector-hub/service-connectors/" - self.__oci_fastconnect_uri = self.__oci_cloud_url + "/networking/fast-connect/virtual-circuit/" - self.__oci_instances_uri = self.__oci_cloud_url + "/compute/instances/" - self.__oci_cert_uri = self.__oci_cloud_url + "/security/certificates/certificate/" - self.__oci_quota_uri = self.__oci_cloud_url + '/quotas/' - - # Adding Mappings - self.__map_compliance_to_script() - -########################################################################## -# Build Compliance Mappings -########################################################################## - def __map_compliance_to_script(self): - # Compliance Mappings - self.__compliance_mappings = ComplianceMappings() - current_mappings = self.__compliance_mappings.mappings - - # Name of the other compliance framework - self.__primary_framework_name = list(current_mappings['IAM-1'].keys())[0] - self.__other_framework_name = list(current_mappings['IAM-1'].keys())[1] - - for mapping in current_mappings: - for cis_recommendation in self.cis_foundations_benchmark_3_0: - if self.cis_foundations_benchmark_3_0[cis_recommendation]['id'] == mapping: - for framework_name, framework_value in current_mappings[mapping].items(): - self.cis_foundations_benchmark_3_0[cis_recommendation][framework_name] = framework_value - - - -########################################################################## -# Create Client config -########################################################################## - def __create_client(self, client, service_endpoint=None, key=None, proxy=None, connection_timeout=10, read_timeout=60): - # Create client with optional service endpoint - if service_endpoint: - created_client = client( - self.__config, - signer=self.__signer, - service_endpoint=service_endpoint, - timeout=(connection_timeout, read_timeout) - ) - else: - created_client = client( - self.__config, - signer=self.__signer, - timeout=(connection_timeout, read_timeout) - ) - - # Add proxy if configured - if proxy: - created_client.base_client.session.proxies = {'https': proxy} - - return created_client - -########################################################################## -# Create regional config, signers and append them to self.__regions object -########################################################################## - def __create_regional_signers(self, proxy): - print("Creating regional signers and configs...") - for region_key, region_values in self.__regions.items(): - try: - debug("processing __create_regional_signers") - - # Set regional config and signer - region_signer = self.__signer - region_signer.region_name = region_key - region_config = self.__config - region_config['region'] = region_key - - region_values['identity_client'] = self.__create_client(oci.identity.IdentityClient, key="identity", proxy=proxy) - region_values['audit_client'] = self.__create_client(oci.audit.AuditClient, key="audit", proxy=proxy) - region_values['cloud_guard_client'] = self.__create_client(oci.cloud_guard.CloudGuardClient, key="cloud_guard", proxy=proxy) - region_values['search_client'] = self.__create_client(oci.resource_search.ResourceSearchClient, key="resource_search", proxy=proxy) - region_values['network_client'] = self.__create_client(oci.core.VirtualNetworkClient, key="vcn", proxy=proxy) - region_values['events_client'] = self.__create_client(oci.events.EventsClient, key="events", proxy=proxy) - region_values['logging_client'] = self.__create_client(oci.logging.LoggingManagementClient, key="logging", proxy=proxy) - region_values['os_client'] = self.__create_client(oci.object_storage.ObjectStorageClient, key="object_storage", proxy=proxy) - region_values['vault_client'] = self.__create_client(oci.key_management.KmsVaultClient, key="vault", proxy=proxy) - region_values['ons_subs_client'] = self.__create_client(oci.ons.NotificationDataPlaneClient, key="ons", proxy=proxy) - region_values['adb_client'] = self.__create_client(oci.database.DatabaseClient, key="adb", proxy=proxy) - region_values['oac_client'] = self.__create_client(oci.analytics.AnalyticsClient, key="oac", proxy=proxy) - region_values['oic_client'] = self.__create_client(oci.integration.IntegrationInstanceClient, key="oic", proxy=proxy) - region_values['bv_client'] = self.__create_client(oci.core.BlockstorageClient, key="blockstorage", proxy=proxy) - region_values['fss_client'] = self.__create_client(oci.file_storage.FileStorageClient, key="fss", proxy=proxy) - region_values['sch_client'] = self.__create_client(oci.sch.ServiceConnectorClient, key="sch", proxy=proxy) - region_values['instance'] = self.__create_client(oci.core.ComputeClient, key="compute", proxy=proxy) - region_values['limits_client'] = self.__create_client(oci.limits.LimitsClient, key="limits_client", proxy=proxy) - region_values['certificate_client'] = self.__create_client(oci.certificates_management.CertificatesManagementClient, key="cert_mgmt", proxy=proxy) - region_values['logging_search_client'] = self.__create_client(oci.loggingsearch.LogSearchClient, key="logging_search", proxy=proxy) - - except Exception as e: - debug("__create_regional_signers: error reading " + str(self.__config)) - self.__errors.append({"id": "__create_regional_signers", "error": str(e)}) - raise RuntimeError("Failed to create regional clients for data collection: " + str(e)) - - - ########################################################################## - # Check for Managed PaaS Compartment - ########################################################################## - def __if_not_managed_paas_compartment(self, name): - return name != "ManagedCompartmentForPaaS" - - ########################################################################## - # Set ManagementCompartment ID - ########################################################################## - def __set_managed_paas_compartment(self): - self.__managed_paas_compartment_id = "" - for compartment in self.__compartments: - if compartment.name == "ManagedCompartmentForPaaS": - self.__managed_paas_compartment_id = compartment.id - - ######################################################################### - # Time Format Helper - ########################################################################## - def get_date_iso_format(self, val): - if not val: - return "" - return str(val)[0:19].replace(" ","T") - - ########################################################################## - # Load compartments - ########################################################################## - def __identity_read_compartments(self): - print("\nProcessing Compartments...") - self.__compartments = [] - try: - debug("__identity_read_compartments: Processing Compartments:") - self.__compartments += oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_compartments, - compartment_id=self.__tenancy.id, - compartment_id_in_subtree=True, - lifecycle_state="ACTIVE" - ).data - - # Need to convert for raw output - for compartment in self.__compartments: - debug("__identity_read_compartments: Getting Compartments: " + compartment.name) - deep_link = self.__oci_compartment_uri + compartment.id - record = { - 'id': compartment.id, - 'name': compartment.name, - "deep_link": self.__generate_csv_hyperlink(deep_link, compartment.name), - 'compartment_id': compartment.compartment_id, - 'defined_tags': compartment.defined_tags, - "description": compartment.description, - "freeform_tags": compartment.freeform_tags, - "inactive_status": compartment.inactive_status, - "is_accessible": compartment.is_accessible, - "lifecycle_state": compartment.lifecycle_state, - "time_created": compartment.time_created.strftime(self.__iso_time_format), - "statements_in_compartment" : 0, - "region": "" - } - self.__raw_compartment[compartment.id] = record - self.cis_foundations_benchmark_3_0['6.1']['Total'].append(compartment) - - # Add root compartment which is not part of the list_compartments - self.__compartments.append(self.__tenancy) - deep_link = self.__oci_compartment_uri + self.__tenancy.id - root_compartment = { - "id": self.__tenancy.id, - "name": self.__tenancy.name, - "deep_link": self.__generate_csv_hyperlink(deep_link, self.__tenancy.name), - "compartment_id": "(root)", - "defined_tags": self.__tenancy.defined_tags, - "description": self.__tenancy.description, - "freeform_tags": self.__tenancy.freeform_tags, - "inactive_status": "", - "is_accessible": "", - "lifecycle_state": "", - "time_created": "", - "statements_in_compartment" : 0, - "region": "" - - } - self.__raw_compartment[self.__tenancy.id] = root_compartment - - self.__set_managed_paas_compartment() - - print("\tProcessed " + str(len(self.__compartments)) + " Compartments") - return self.__compartments - - except Exception as e: - debug("__identity_read_compartments: Error Getting Compartments: " + compartment.name) - self.__errors.append({"id" : "__identity_read_compartments", "error" : str(e)}) - raise RuntimeError( - "Error in identity_read_compartments: " + str(e.args)) - - ########################################################################## - # Load Identity Domains - ########################################################################## - def __identity_read_domain_info(self, domain_data ): - domain_dict = oci.util.to_dict(domain_data) - try: - debug("__identity_read_domain_info: Getting Identity Domain Password Policy for: " + domain_data.display_name) - idcs_url = domain_data.url + "/admin/v1/PasswordPolicies/PasswordPolicy" - raw_pwd_policy_resp = requests.get(url=idcs_url, auth=self.__signer) - raw_pwd_policy_dict = json.loads(raw_pwd_policy_resp.content) - debug("__identity_read_domain_info: Recieved Identity Domain Password Policy for: " + domain_data.display_name) - - # Creating Identity Domains Client and storing it - debug("__identity_read_domain_info: Creating Identity Domain Client for: " + domain_data.display_name) - domain_dict['IdentityDomainClient'] = oci.identity_domains.IdentityDomainsClient(\ - config=self.__config, signer=self.__signer, service_endpoint=domain_data.url) - debug("__identity_read_domain_info: Created Identity Domain Client for: " + domain_data.display_name) - - pwd_policy_dict = oci.util.to_dict(domain_dict['IdentityDomainClient'].get_password_policy(\ - password_policy_id=raw_pwd_policy_dict['ocid']).data) - - domain_dict['password_policy'] = pwd_policy_dict - domain_dict['errors'] = None - self.__identity_domains.append(domain_dict) - debug("-" * 100) - debug(f"__identity_read_domain_info: Domain Dict is: {domain_dict}") - - except Exception as e: - debug("Identity Domain Error is for domain " + domain_data.display_name + "\n" + str(e)) - domain_dict['password_policy'] = None - domain_dict['errors'] = str(e) - - def __identity_read_domains(self): - if not(self.__identity_domains_enabled): - return - print("Processing Identity Domains...") - raw_identity_domains = [] - # Finding all Identity Domains in the tenancy - for compartment in self.__compartments: - try: - debug("__identity_read_domains: Getting Identity Domains for Compartment: " + str(compartment.name)) - - raw_identity_domains += oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_domains, - compartment_id = compartment.id, - lifecycle_state = "ACTIVE" - ).data - - except Exception as e: - debug("__identity_read_domains: Exception collecting Identity Domains\n" + str(e)) - # If this fails the tenancy likely doesn't have identity domains or the permissions are off - print("\tFound " + str(len(raw_identity_domains)) + " Identity Domains") - - v_domain_reader_threads = [] - for domain in raw_identity_domains: - debug("__identity_read_domains: Getting password policy for domain: " + domain.display_name) - thread = Thread(target=self.__identity_read_domain_info, args=([domain])) - v_domain_reader_threads.append(thread) - - for thread in v_domain_reader_threads: - thread.start() - - for thread in v_domain_reader_threads: - thread.join() - - print("\tProcessed " + str(len(self.__identity_domains)) + " Identity Domains") - return - - ########################################################################## - # Load Groups - ########################################################################## - def __identity_read_groups(self): - # Getting all Groups in the Tenancy - debug("processing __identity_read_groups ") - if self.__identity_domains_enabled: - debug("processing __identity_read_groups for Identity Domains Enabled Tenancy") - for identity_domain in self.__identity_domains: - debug("processing __identity_read_groups for Identity Domain: " + identity_domain['display_name']) - id_domain_deep_link = self.__oci_identity_domains_uri + identity_domain['id'] - try: - groups_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_groups, - args={'attribute_sets' : ['default']}) - print(f"\tRead {str(len(groups_data))} groups in Identity Domain: " + identity_domain['display_name']) - for grp in groups_data: - debug("\t__identity_read_groups: reading group data " + str(grp.display_name)) - grp_deep_link = self.__oci_identity_domains_uri + identity_domain['id'] + "/groups/" + grp.id - group_record = { - "id" : grp.ocid, - "name": grp.display_name, - "deep_link": self.__generate_csv_hyperlink(grp_deep_link, grp.display_name), - "domain_deeplink" : self.__generate_csv_hyperlink(id_domain_deep_link, identity_domain['display_name']), - "description": grp.urn_ietf_params_scim_schemas_oracle_idcs_extension_group_group.description if grp.urn_ietf_params_scim_schemas_oracle_idcs_extension_group_group else None, - "domain_name" : identity_domain['display_name'], - "domain_id" : identity_domain['id'], - "time_created" : self.get_date_iso_format(grp.meta.created), - "members": [] - } - # Adding one record per group with no membership info - self.__groups[grp.ocid] = group_record - - - except Exception as e: - self.__errors.append({"id" : "__identity_read_groups", "error" : identity_domain['display_name']+" : "+str(e)}) - print("__identity_read_groups: error reading" + str(e)) - RuntimeError( - "Error in __identity_read_groups" + str(e.args)) - return self.__groups - - else: - try: - debug("processing __identity_read_groups_and_membership for Non Identity Domains Tenancy") - groups_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_groups, - compartment_id=self.__tenancy.id - ).data - # For each group in the tenacy getting the group's membership - for grp in groups_data: - debug("__identity_read_groups_and_membership: reading group data " + str(grp.name)) - membership = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_user_group_memberships, - compartment_id=self.__tenancy.id, - group_id=grp.id).data - # For empty groups just print one record with the group info - grp_deep_link = self.__oci_groups_uri + grp.id - if not membership: - group_record = { - "id": grp.id, - "name": grp.name, - "deep_link": self.__generate_csv_hyperlink(grp_deep_link, grp.name), - "domain_deeplink" : "", - "description": grp.description, - "domain_deeplink" : "", - "lifecycle_state": grp.lifecycle_state, - "time_created": grp.time_created.strftime(self.__iso_time_format), - "user_id": "", - "user_id_link": "" - } - # Adding a record per empty group - self.__groups_to_users.append(group_record) - # For groups with members print one record per user per group - for member in membership: - debug("__identity_read_groups_and_membership: reading members data in group" + str(grp.name)) - user_deep_link = self.__oci_users_uri + member.user_id - group_record = { - "id": grp.id, - "name": grp.name, - "deep_link": self.__generate_csv_hyperlink(grp_deep_link, grp.name), - "domain_deeplink" : "", - "description": grp.description, - "lifecycle_state": grp.lifecycle_state, - "time_created": grp.time_created.strftime(self.__iso_time_format), - "user_id": member.user_id, - "user_id_link": self.__generate_csv_hyperlink(user_deep_link, member.user_id) - } - # Adding a record per user to group - self.__groups_to_users.append(group_record) - return self.__groups_to_users - except Exception as e: - self.__errors.append({"id" : "__identity_read_groups", "error" : str(e)}) - debug("__identity_read_groups: error reading" + str(e)) - RuntimeError( - "Error in __identity_read_groups" + str(e.args)) - - - ########################################################################## - # Identity Domains Helper function for pagination - ########################################################################## - def __identity_read_domains_group_members(self, domain_client, group_ocid): - members = [] - debug("__identity_read_domains_group_members: Initiating Group membership collection for Identity Domain Group ID: " + group_ocid) - filter = f'groups.value eq "{group_ocid}"' - try: - members += self.__identity_domains_get_all_results(func=domain_client.list_users, - args={'filter' : filter, 'attribute_sets' : ['default']}) - debug("__identity_read_domains_group_members: Collected total keys: " + str(len(members))) - - return members - except Exception as e: - self.__errors.append({"id" : f"__identity_read_groups_and_membership: {group_ocid}", "error" : str(e)}) - print(f"__identity_read_groups_and_membership: {group_ocid}\n \t{str(e)}") - return members - - - ########################################################################## - # Identity Domains Helper function for pagination - ########################################################################## - def __identity_domains_get_all_results(self, func, args): - - if "start_index" not in args: - args['start_index'] = 1 - if "count" not in args: - args["count"] = 500 - if "filter" not in args: - args["filter"] = '' - if "attributes" not in args: - args["attributes"] = '' - if "attribute_sets" not in args: - args["attribute_sets"] = ['all'] - - debug("__identity_domains_get_all_results: " + str(func.__name__) + " arguments are: " + str(args)) - resources = [] - - while True: - result = func(start_index=args['start_index'], - count=args['count'], - filter=args['filter'], - sort_by = 'ocid', - attributes = args['attributes'], - attribute_sets = args['attribute_sets']).data - resources.extend(result.resources) - next_index = result.start_index + result.items_per_page - if next_index > result.total_results: - break - - args['start_index'] = next_index - - return resources - ########################################################################## - # Load users - ########################################################################## - def __identity_read_users_per_domain(self, identity_domain): - - try: - users_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_users, - args={'attributes':'urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User:isFederatedUser,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User, groups,urn:ietf:params:scim:schemas:oracle:idcs:extension:userCredentials:User, urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User:lastSuccessfulLoginDate','attribute_sets':['default'],'count' : 400}) - # Local scoped list to store users per domains - v_domain_users = [] - # Adding record to the users - - for user in users_data: - record = {} - deep_link = self.__oci_identity_domains_uri + identity_domain['id'] + "/users/" + user.ocid - id_domain_deep_link = self.__oci_identity_domains_uri + identity_domain['id'] - record = { - 'id': user.ocid, - 'domain_deeplink' : self.__generate_csv_hyperlink(id_domain_deep_link, identity_domain['display_name']), - 'name': user.user_name, - 'deep_link': self.__generate_csv_hyperlink(deep_link, user.user_name), - 'defined_tags': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_oci_tags.defined_tags if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_oci_tags else None, - 'description': user.description, - 'email': user.emails[0].value if user.emails else None, - 'email_verified': user.emails[0].verified if user.emails else None, - 'external_identifier': user.external_id, - 'is_federated': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_user_user.is_federated_user if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_user_user else None, - 'is_mfa_activated': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_mfa_user.mfa_status if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_mfa_user else None, - 'lifecycle_state': user.active, - 'domain_name' : identity_domain['display_name'], - 'domain_id' : identity_domain['id'], - 'time_created': user.meta.created, - 'can_use_api_keys': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_api_keys if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_auth_tokens': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_auth_tokens if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_console_password': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_console_password if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_customer_secret_keys': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_customer_secret_keys if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_db_credentials': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_db_credentials if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_o_auth2_client_credentials': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_o_auth2_client_credentials if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'can_use_smtp_credentials': user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user.can_use_smtp_credentials if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_capabilities_user else None, - 'last_successful_login_date': self.get_date_iso_format(user.urn_ietf_params_scim_schemas_oracle_idcs_extension_user_state_user.last_successful_login_date) if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_user_state_user else None, - 'groups': [] - } - # Adding Groups to the user record and to the groups membership dict. - if user.groups: - for usergroup in user.groups: - # Add to the user record - record['groups'].append(usergroup.display) - - #Add to the groups membership dict - if self.__groups.get(usergroup.ocid): - self.__groups[usergroup.ocid]['members'].append({"user_id":user.ocid,"user_id_link":self.__generate_csv_hyperlink(deep_link, user.user_name)}) - - if user.urn_ietf_params_scim_schemas_oracle_idcs_extension_user_credentials_user: - debug("__identity_read_users_per_domain: Collecting user API Key for user: " + str(user.user_name)) - record['api_keys'] = self.__identity_read_user_api_key(user_ocid=user.ocid, identity_domain=identity_domain) - record['auth_tokens'] = self.__identity_read_user_auth_token(user.ocid, identity_domain=identity_domain) - record['customer_secret_keys'] = self.__identity_read_user_customer_secret_key(user.ocid, identity_domain=identity_domain) - record['database_passwords'] = self.__identity_read_user_database_password(user.ocid,identity_domain=identity_domain) - else: - debug("__identity_read_users_per_domain: skipping user API Key collection for user: " + str(user.user_name)) - record['api_keys'] = None - record['auth_tokens'] = None - record['customer_secret_keys'] = None - record['database_passwords'] = None - #Local list to store all users for this domains - v_domain_users.append(record) - # Concat the list of users from this domain to the global __users list - print(f"\tRead {str(len(users_data))} users in: "+identity_domain['display_name']) - self.__users.extend(v_domain_users) - - except Exception as e: - debug("__identity_read_users_per_domain: Identity Domains are : " + str(self.__identity_domains_enabled)) - self.__errors.append({'id' : "__identity_read_users", 'error' : str(e)}) - raise RuntimeError(f"Error in __identity_read_users_per_domain: Identity Domain: {identity_domain['display_name']}, Error: {str(e)}") - - - def __identity_read_users(self): - debug(f'__identity_read_users: Getting User data for Identity Domains: {str(self.__identity_domains_enabled)}') - try: - if self.__identity_domains_enabled: - v_domain_user_reader_threads = [] - for identity_domain in self.__identity_domains: - thread = Thread(target=self.__identity_read_users_per_domain, args=([identity_domain])) - v_domain_user_reader_threads.append(thread) - - for thread in v_domain_user_reader_threads: - thread.start() - - for thread in v_domain_user_reader_threads: - thread.join() - - print("\tProcessed a total of: " + str(len(self.__users)) + " Users") - return self.__users - - else: - try: - # Getting all users in the Tenancy - users_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_users, - compartment_id=self.__tenancy.id - ).data - - # Adding record to the users - for user in users_data: - deep_link = self.__oci_users_uri + user.id - record = { - 'id': user.id, - 'domain_deeplink' : "", - 'name': user.name, - 'deep_link': self.__generate_csv_hyperlink(deep_link, user.name), - 'defined_tags': user.defined_tags, - 'description': user.description, - 'email': user.email, - 'email_verified': user.email_verified, - 'external_identifier': user.external_identifier, - 'is_federated': True if user.identity_provider_id is not None else False, - 'is_mfa_activated': user.is_mfa_activated, - 'lifecycle_state': True if user.lifecycle_state == 'ACTIVE' else False, - 'domain_name' : "", - 'domain_id' : "", - 'time_created': user.time_created.strftime(self.__iso_time_format), - 'can_use_api_keys': user.capabilities.can_use_api_keys, - 'can_use_auth_tokens': user.capabilities.can_use_auth_tokens, - 'can_use_console_password': user.capabilities.can_use_console_password, - 'can_use_customer_secret_keys': user.capabilities.can_use_customer_secret_keys, - 'can_use_db_credentials': user.capabilities.can_use_db_credentials, - 'can_use_o_auth2_client_credentials': user.capabilities.can_use_o_auth2_client_credentials, - 'can_use_smtp_credentials': user.capabilities.can_use_smtp_credentials, - 'last_successful_login_date': self.get_date_iso_format(user.last_successful_login_time), - 'groups': [] - } - # Adding Groups to the user - for group in self.__groups_to_users: - if user.id == group['user_id']: - record['groups'].append(group['name']) - - record['api_keys'] = self.__identity_read_user_api_key(user.id) - record['auth_tokens'] = self.__identity_read_user_auth_token( - user.id) - record['customer_secret_keys'] = self.__identity_read_user_customer_secret_key( - user.id) - record['database_passwords'] = self.__identity_read_user_database_password(user.id) - self.__users.append(record) - print("\tProcessed " + str(len(self.__users)) + " Users") - return self.__users - - except Exception as e: - debug("__identity_read_users: Error is: " + str(e)) - self.__errors.append({"id" : "__identity_read_users", "error" : str(e)}) - raise RuntimeError( - "Error in __identity_read_users, Non Identity Domain: " + str(e)) - except Exception as e: - raise RuntimeError( - "Error in __identity_read_users: " + str(e.args)+".") - - ########################################################################## - # Load user api keys - ########################################################################## - def __identity_read_user_api_key(self, user_ocid, identity_domain=None): - api_keys = [] - debug("__identity_read_user_api_key: Initiating API Keys collection for User ID: " + user_ocid) - try: - if self.__identity_domains_enabled: - debug("__identity_read_user_api_key: Initiating API Keys collection for Identity Domain User ID: " + user_ocid) - filter = f'user.ocid eq \"{user_ocid}\"' - user_api_keys_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_api_keys, - args={'filter' : filter}) - debug("__identity_read_user_api_key: Collected total keys: " + str(len(user_api_keys_data))) - - for api_key in user_api_keys_data: - full_record = oci.util.to_dict(api_key) - record = {k: v for k, v in full_record.items() if k in ["id","ocid","fingerprint"]} - record['time_created'] = self.get_date_iso_format(full_record['meta']['created']) - apikey_used_in_45_days = self.__identity_check_logging_for_api_activity(user_ocid=user_ocid, api_key=api_key.fingerprint) - record['apikey_used_in_45_days'] = apikey_used_in_45_days - api_keys.append(record) - - - else: - user_api_keys_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_api_keys, - user_id=user_ocid - ).data - - for api_key in user_api_keys_data: - full_record = oci.util.to_dict(api_key) - record = {k: v for k, v in full_record.items() if k in ["id","ocid","fingerprint"]} - record['id'] = full_record['key_id'] - record['time_created'] = self.get_date_iso_format(full_record['time_created']) - apikey_used_in_45_days = self.__identity_check_logging_for_api_activity(user_ocid=user_ocid, api_key=api_key.fingerprint) - record['apikey_used_in_45_days'] = apikey_used_in_45_days - api_keys.append(record) - - return api_keys - - except Exception as e: - self.__errors.append({"id" : user_ocid, "error" : "Failed to read API Keys metadata for User ID. "}) - debug("__identity_read_user_api_key: Failed to read API Keys for User ID: " + user_ocid) - debug("__identity_read_user_api_key: Error for API Keys: " + str(e)) - return api_keys - raise RuntimeError( - "Error in identity_read_user_api_key: " + str(e.args)) - - - ########################################################################## - # Search API Key Last Usage Over 45 days https://github.com/tstahl/oci-remove-unused-apikey-cg-responder/blob/main/func.py - ########################################################################## - def __identity_check_logging_for_api_activity(self, user_ocid, api_key): - - apikey_used_in_45_days = [] - - def numOfDays(date1, date2): - #check which date is greater to avoid days output in -ve number - if date2 > date1: - return (date2-date1).days - else: - return (date1-date2).days - - ########################################################################## - # Inputs: start_date(date), end_date(date), data_ranges(list) max_days_between(int) - # Returns: List of dicts with {"start_date" : start_date, "end_date" : end_date}} - ########################################################################## - def get_date_ranges(start_date, end_date, date_ranges, max_days_between=9): - days_between = numOfDays(start_date, end_date) - if days_between > max_days_between: - next_date = start_date + datetime.timedelta(days=max_days_between) - date_ranges.append({"start_date" : start_date, "end_date" : next_date}) - return get_date_ranges(next_date + datetime.timedelta(days=1), end_date, date_ranges, max_days_between=max_days_between) - else: - - date_ranges.append({"start_date" : start_date, "end_date" : end_date}) - return date_ranges - - ########################################################################## - # Inputs: search_query, start_date and end_date in datetime, results - # Returns: Bool if the key was used in - ########################################################################## - def run_logging_search_query_api_usage(search_query, api_key_used, start_date: datetime, end_date: datetime): - if self.__disable_api_keys: - # print("***Skipping Processing Audit Logs for API Key Usage...***") - return api_key_used - else: - print("Processing Audit Logs for API Key Usage...") - for region_key, region_values in self.__regions.items(): - try: - - response = region_values['logging_search_client'].search_logs( - search_logs_details=oci.loggingsearch.models.SearchLogsDetails( - search_query=search_query, - time_start=start_date, - time_end=end_date, - is_return_field_info=False), - limit=100) - - audit_logs = response.data - debug(f"run_logging_search_query_api_usage: response is: {response.data}") - if audit_logs.summary.result_count > 0: - for result in audit_logs.results: - userInfo = { - "principalName" : result.data["data.identity.principalName"], - "principalId" : result.data["data.identity.principalId"] - } - debug(f'run_logging_search_query_api_usage: Audit search results: {userInfo}') - api_key_used.append(userInfo) - break - - else: - debug('run_logging_search_query_api_usage: No APIKey usage records found in the past 14 days in') - - return api_key_used - except Exception as e: - self.__errors.append({"id" : "run_logging_search_query_api_usage", "error" : str(e)}) - debug('run_logging_search_query_api_usage: Exception is:') - debug("\tException is : " + str(e)) - return api_key_used - - debug("__identity_check_logging_for_api_activity: Checking API Key") - principle_id = f'{self.__tenancy.id}/{user_ocid}/{api_key}' - debug(f'__identity_check_logging_for_api_activity: API key is: {api_key}') - - tenancy_search_str = f'\"{self.__tenancy.id}/_Audit_Include_Subcompartment\"' - search_query = "search " + tenancy_search_str + """ | data.identity.credentials = '""" + principle_id + """' and data.identity.tenantId = '""" + self.__tenancy.id + """' | summarize count() by data.identity.principalId, data.identity.principalName""" - debug(f'__identity_check_logging_for_api_activity: Search Query is: {search_query}') - - end_date = self.start_datetime - start_date = end_date - datetime.timedelta(days=self.__days_used) - - search_date_range = get_date_ranges(start_date=start_date, \ - end_date=end_date, \ - date_ranges=[], - max_days_between=13) - - debug(f'__identity_check_logging_for_api_activity: Initiated Threads for dates range : {str(search_date_range)}') - - threads = [] - for dates in search_date_range: - thread = Thread(target=run_logging_search_query_api_usage, \ - args=(search_query, apikey_used_in_45_days, \ - dates['start_date'], dates['end_date'])) - threads.append(thread) - - for thread in threads: - thread.start() - - for thread in threads: - thread.join() - - if apikey_used_in_45_days: - return True - else: - return False - - - ########################################################################## - # Load user auth tokens metadata - ########################################################################## - def __identity_read_user_auth_token(self, user_ocid, identity_domain=None): - auth_tokens = [] - try: - if self.__identity_domains_enabled: - filter = f'user.ocid eq \"{user_ocid}\"' - auth_tokens_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_auth_tokens, - args={'filter' : filter}) - debug("__identity_read_user_auth_token: Collected total keys: " + str(len(auth_tokens_data))) - - for token in auth_tokens_data: - full_record = oci.util.to_dict(token) - record = {k: v for k, v in full_record.items() if k in ["id","ocid","description"]} - record['time_created'] = self.get_date_iso_format(full_record['meta']['created']) - auth_tokens.append(record) - - else: - auth_tokens_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_auth_tokens, - user_id=user_ocid - ).data - - for token in auth_tokens_data: - record = oci.util.to_dict(token) - record['time_created'] = self.get_date_iso_format(record['time_created']) - auth_tokens.append(record) - - return auth_tokens - - except Exception as e: - self.__errors.append({"id" : user_ocid, "error" : "Failed to read auth token metadata for User ID"}) - debug("__identity_read_user_auth_token: Failed to auth tokens for User ID: " + user_ocid) - return auth_tokens - raise RuntimeError( - "Error in identity_read_user_auth_token: " + str(e.args)) - - ########################################################################## - # Load user customer secret keys metadata - ########################################################################## - def __identity_read_user_customer_secret_key(self, user_ocid, identity_domain=None): - customer_secret_key = [] - try: - if self.__identity_domains_enabled: - filter = f'user.ocid eq \"{user_ocid}\"' - customer_secret_key_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_customer_secret_keys, - args={'filter' : filter}) - debug("__identity_read_user_customer_secret_key: Collected total keys: " + str(len(customer_secret_key_data))) - - for key in customer_secret_key_data: - full_record = oci.util.to_dict(key) - record = {k: v for k, v in full_record.items() if k in ["id","ocid","display_name"]} - record['time_created'] = self.get_date_iso_format(full_record['meta']['created']) - record['time_expires'] = full_record['expires_on'] - customer_secret_key.append(record) - - return customer_secret_key - - else: - customer_secret_key_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_customer_secret_keys, - user_id=user_ocid - ).data - - for key in customer_secret_key_data: - record = oci.util.to_dict(key) - record['time_created'] = self.get_date_iso_format(record['time_created']) - record['time_expires'] = record['time_expires'] - customer_secret_key.append(record) - - return customer_secret_key - - except Exception as e: - self.__errors.append({"id" : user_ocid, "error" : "Failed to read customer secrets metadata for User ID"}) - debug("__identity_read_user_customer_secret_key: Failed to customer secrets for User ID: " + user_ocid) - return customer_secret_key - raise RuntimeError( - "Error in identity_read_user_customer_secret_key: " + str(e.args)) - - ########################################################################## - # Load Database Passwords metadata - ########################################################################## - def __identity_read_user_database_password(self, user_ocid, identity_domain=None): - database_password = [] - debug("__identity_read_user_database_password: Starting for User ID: " + user_ocid) - if self.__identity_domains_enabled: - try: - filter = f'user.ocid eq \"{user_ocid}\"' - raw_database_password = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_user_db_credentials, - args={'filter' : filter}) - debug("__identity_read_user_database_password: Collected total keys: " + str(len(raw_database_password))) - - for password in raw_database_password: - debug("__identity_read_user_database_password: Got Password") - full_record = oci.util.to_dict(password) - record = {k: v for k, v in full_record.items() if k in ["id","ocid","description"]} - record['time_created'] = self.get_date_iso_format(full_record['meta']['created']) - database_password.append(record) - - return database_password - - except Exception as e: - self.__errors.append({"id" : user_ocid, "error" : "Failed to read database password metadata for User ID"}) - debug("__identity_read_user_database_password: Failed to get database passwords for User ID: " + user_ocid) - debug("__identity_read_user_database_password: Error: " + str(e)) - return database_password - else: - try: - raw_database_password = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_db_credentials, - user_id=user_ocid - ).data - - for password in raw_database_password: - debug("__identity_read_user_database_password: Got Password") - record = oci.util.to_dict(password) - record['ocid'] = record['id'] - record['time_created'] = self.get_date_iso_format(record['time_created']) - database_password.append(record) - - return database_password - - except Exception as e: - self.__errors.append({"id" : user_ocid, "error" : "Failed to read database passwords metadata for User ID"}) - debug("__identity_read_user_database_password: Failed to get database passwords for User ID: " + user_ocid) - debug("__identity_read_user_database_password: Error: " + str(e)) - - return database_password - ########################################################################## - # OCI Helper function to search for OCI resource type - ########################################################################## - - def __search_resource_in_region(self, resource: str, region_values: dict): - - query = ( - f"query {resource} resources return allAdditionalFields " - f"where compartmentId != '{self.__managed_paas_compartment_id}'" - ) - search_details = oci.resource_search.models.StructuredSearchDetails(query=query) - - resp = oci.pagination.list_call_get_all_results( - region_values['search_client'].search_resources, - search_details=search_details - ) - return getattr(resp, "data", []) or [] - - ########################################################################## - # Tenancy IAM Policies - ########################################################################## - def __identity_read_tenancy_policies(self): - try: - debug("__identity_read_tenancy_policies: Getting Tenancy policies: ") - policies_data = self.__search_resource_in_region("Policy", self.__regions[self.__home_region]) - - - for policy in policies_data: - debug("__identity_read_tenancy_policies: Reading Tenancy policies: " + policy.display_name) - deep_link = self.__oci_policies_uri + policy.identifier - record = { - "id": policy.identifier, - "name": policy.display_name, - 'deep_link': self.__generate_csv_hyperlink(deep_link, policy.display_name), - "compartment_id": policy.compartment_id, - "description": policy.additional_details['description'], - "lifecycle_state": policy.lifecycle_state, - "statements": policy.additional_details['statements'], - "number_of_statements" : len(policy.additional_details['statements']) - } - self.__raw_compartment[policy.compartment_id]['statements_in_compartment'] += len(policy.additional_details['statements']) - self.__policies.append(record) - print("\tProcessed " + str(len(self.__policies)) + " IAM Policies") - return self.__policies - - except Exception as e: - debug("__identity_read_tenancy_policies: Exception reading Tenancy policies: " + policy.display_name) - self.__errors.append({"id" : "__identity_read_tenancy_policies", "error" : str(e)}) - raise RuntimeError("Error in __identity_read_tenancy_policies: " + str(e.args)) - - ############################################ - # Load Identity Dynamic Groups - ############################################ - def __identity_read_dynamic_groups(self): - try: - debug("processing __identity_read_dynamic_groups: Identity Doamins are enabled: " + str(self.__identity_domains_enabled)) - if self.__identity_domains_enabled: - for identity_domain in self.__identity_domains: - dynamic_groups_data = self.__identity_domains_get_all_results(func=identity_domain['IdentityDomainClient'].list_dynamic_resource_groups, - args={'attributes' : 'ocid,displayName,description,compartmentOcid,domainOcid,' - 'tenancyOcid,matchingRule,idcsCreatedBy,idcsLastModifiedBy,meta,urn:ietf:params:scim:schemas:oracle:idcs:extension:OCITags'}) - id_domain_deep_link = self.__oci_identity_domains_uri + identity_domain['id'] - for dynamic_group in dynamic_groups_data: - debug("__identity_read_dynamic_groups: reading dynamic groups" + str(dynamic_group.display_name)) - deep_link = f"{self.__oci_identity_domains_uri}/domains/{identity_domain['id']}/dynamic-groups/{dynamic_group.id}" - record = oci.util.to_dict(dynamic_group) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, dynamic_group.display_name) - record['domain_deeplink'] = self.__generate_csv_hyperlink(id_domain_deep_link, identity_domain['display_name']) - record['domain_name'] = identity_domain['display_name'][0] if isinstance(identity_domain['display_name'],tuple) else identity_domain['display_name'] - record['domain_id'] = identity_domain['id'][0] if isinstance(identity_domain['id'],tuple) else identity_domain['id'] - self.__dynamic_groups.append(record) - - else: - dynamic_groups_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_dynamic_groups, - compartment_id=self.__tenancy.id).data - for dynamic_group in dynamic_groups_data: - deep_link = self.__oci_dynamic_groups_uri + dynamic_group.id - # try: - debug("__identity_read_dynamic_groups: reading dynamic groups" + str(dynamic_group.name)) - record = oci.util.to_dict(dynamic_group) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, dynamic_group.name) - record['domain_deeplink'] = None - record['domain_name'] = None, - record['domain_id'] = None, - self.__dynamic_groups.append(record) - - print("\tProcessed " + str(len(self.__dynamic_groups)) + " Dynamic Groups") - return self.__dynamic_groups - except Exception as e: - self.__errors.append({"id" : "__identity_read_dynamic_groups", "error" : str(e)}) - debug("__identity_read_dynamic_groups: error reading" + str(e)) - raise RuntimeError("Error in __identity_read_dynamic_groups: " + str(e.args)) - pass - - ############################################ - # Load Availlability Domains - ############################################ - def __identity_read_availability_domains(self): - try: - debug("__identity_read_availability_domains: Getting Availability Domains for regions:") - for region_key, region_values in self.__regions.items(): - debug("__identity_read_availability_domains: reading Availability Domains for regions: " +region_key) - region_values['availability_domains'] = oci.pagination.list_call_get_all_results( - region_values['identity_client'].list_availability_domains, - compartment_id=self.__tenancy.id - ).data - print("\tProcessed " + str(len(region_values['availability_domains'])) + " Availability Domains in " + region_key) - - except Exception as e: - debug("__identity_read_availability_domains: reading availability domain " + str(region_key)) - self.__errors.append({"id": "__identity_read_availability_domains" + "_" + str(region_key), "error": str(e)}) - raise RuntimeError( - "Error in __identity_read_availability_domains: " + str(e.args)) - - ########################################################################## - # Get Objects Store Buckets - ########################################################################## - def __os_read_buckets(self): - - # Getting OS Namespace - try: - # looping through regions - for region_key, region_values in self.__regions.items(): - buckets_data = self.__search_resource_in_region("Bucket", region_values) - - # Getting Bucket Info - for bucket in buckets_data: - try: - bucket_info = region_values['os_client'].get_bucket( - bucket.additional_details['namespace'], bucket.display_name).data - deep_link = self.__oci_buckets_uri + bucket_info.namespace + "/" + bucket_info.name + "/objects?region=" + region_key - record = { - "id": bucket_info.id, - "name": bucket_info.name, - "deep_link": self.__generate_csv_hyperlink(deep_link, bucket_info.name), - "kms_key_id": bucket_info.kms_key_id, - "namespace": bucket_info.namespace, - "compartment_id": bucket_info.compartment_id, - "object_events_enabled": bucket_info.object_events_enabled, - "public_access_type": bucket_info.public_access_type, - "replication_enabled": bucket_info.replication_enabled, - "is_read_only": bucket_info.is_read_only, - "storage_tier": bucket_info.storage_tier, - "time_created": bucket_info.time_created.strftime(self.__iso_time_format), - "versioning": bucket_info.versioning, - "defined_tags": bucket_info.defined_tags, - "freeform_tags": bucket_info.freeform_tags, - "region": region_key, - "source_resource" : bucket_info.name + "-" + region_key, - "notes": "" - } - self.__buckets.append(record) - except Exception as e: - record = { - "id": "", - "name": bucket.display_name, - "deep_link": "", - "kms_key_id": "", - "namespace": bucket.additional_details['namespace'], - "compartment_id": bucket.compartment_id, - "object_events_enabled": "", - "public_access_type": "", - "replication_enabled": "", - "is_read_only": "", - "storage_tier": "", - "time_created": bucket.time_created.strftime(self.__iso_time_format), - "versioning": "", - "defined_tags": bucket.defined_tags, - "freeform_tags": "", - "region": region_key, - "source_resource" : bucket.display_name + "-" + region_key, - "notes": str(e) - } - self.__buckets.append(record) - # Returning Buckets - print("\tProcessed " + str(len(self.__buckets)) + " Buckets") - return self.__buckets - except Exception as e: - raise RuntimeError("Error in __os_read_buckets " + str(e.args)) - - ############################################ - # Load Block Volumes - ############################################ - def __block_volume_read_block_volumes(self): - try: - for region_key, region_values in self.__regions.items(): - volumes_data = self.__search_resource_in_region("Volume", region_values) - - - # Getting Block Volume inf - for volume in volumes_data: - deep_link = self.__oci_block_volumes_uri + volume.identifier + '?region=' + region_key - try: - record = { - "id": volume.identifier, - "display_name": volume.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, volume.display_name), - "kms_key_id": volume.additional_details['kmsKeyId'], - "lifecycle_state": volume.lifecycle_state, - "compartment_id": volume.compartment_id, - "size_in_gbs": volume.additional_details['sizeInGBs'], - "size_in_mbs": volume.additional_details['sizeInMBs'], - "availability_domain": volume.availability_domain, - "time_created": volume.time_created.strftime(self.__iso_time_format), - "system_tags": volume.system_tags, - "defined_tags": volume.defined_tags, - "freeform_tags": volume.freeform_tags, - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": volume.identifier, - "display_name": volume.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, volume.display_name), - "kms_key_id": "", - "lifecycle_state": "", - "compartment_id": "", - "size_in_gbs": "", - "size_in_mbs": "", - "availability_domain": "", - "time_created": "", - "system_tags": "", - "defined_tags": "", - "freeform_tags": "", - "region": region_key, - "notes": str(e) - } - self.__block_volumes.append(record) - print("\tProcessed " + str(len(self.__block_volumes)) + " Block Volumes") - return self.__block_volumes - except Exception as e: - raise RuntimeError("Error in __block_volume_read_block_volumes " + str(e.args)) - - ############################################ - # Load Boot Volumes - ############################################ - def __boot_volume_read_boot_volumes(self): - try: - for region_key, region_values in self.__regions.items(): - boot_volumes_data = self.__search_resource_in_region("BootVolume", region_values) - - - for boot_volume in boot_volumes_data: - deep_link = self.__oci_boot_volumes_uri + boot_volume.identifier + '?region=' + region_key - try: - record = { - "id": boot_volume.identifier, - "display_name": boot_volume.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, boot_volume.display_name), - "kms_key_id": boot_volume.additional_details['kmsKeyId'], - "lifecycle_state": boot_volume.lifecycle_state, - "compartment_id": boot_volume.compartment_id, - "size_in_gbs": boot_volume.additional_details['sizeInGBs'], - "size_in_mbs": boot_volume.additional_details['sizeInMBs'], - "availability_domain": boot_volume.availability_domain, - "time_created": boot_volume.time_created.strftime(self.__iso_time_format), - "system_tags": boot_volume.system_tags, - "defined_tags": boot_volume.defined_tags, - "freeform_tags": boot_volume.freeform_tags, - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": boot_volume.identifier, - "display_name": boot_volume.display_name, - "deep_link": "", - "kms_key_id": "", - "lifecycle_state": "", - "compartment_id": "", - "size_in_gbs": "", - "size_in_mbs": "", - "availability_domain": "", - "time_created": "", - "system_tags": "", - "defined_tags": "", - "freeform_tags": "", - "region": region_key, - "notes": str(e) - } - self.__boot_volumes.append(record) - print("\tProcessed " + str(len(self.__boot_volumes)) + " Boot Volumes") - return (self.__boot_volumes) - except Exception as e: - raise RuntimeError("Error in __boot_volume_read_boot_volumes " + str(e.args)) - - ############################################ - # Load FSS - ############################################ - def __fss_read_fsss(self): - try: - for region_key, region_values in self.__regions.items(): - fss_data = self.__search_resource_in_region("FileSystem", region_values) - - - for fss in fss_data: - deep_link = self.__oci_fss_uri + fss.identifier + '?region=' + region_key - try: - record = { - "id": fss.identifier, - "display_name": fss.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, fss.display_name), - "kms_key_id": fss.additional_details['kmsKeyId'], - "lifecycle_state": fss.lifecycle_state, - # "lifecycle_details": fss.lifecycle_details, - "availability_domain": fss.availability_domain, - "time_created": fss.time_created.strftime(self.__iso_time_format), - "compartment_id": fss.compartment_id, - # "is_clone_parent": fss.is_clone_parent, - # "is_hydrated": fss.is_hydrated, - # "metered_bytes": fss.metered_bytes, - "source_details": fss.additional_details['sourceDetails'], - "defined_tags": fss.defined_tags, - "freeform_tags": fss.freeform_tags, - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": fss.identifier, - "display_name": fss.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, fss.display_name), - "kms_key_id": "", - "lifecycle_state": "", - # "lifecycle_details": "", - "availability_domain": "", - "time_created": "", - "compartment_id": "", - # "is_clone_parent": "", - # "is_hydrated": "", - # "metered_bytes": "", - "source_details": "", - "defined_tags": "", - "freeform_tags": "", - "region": region_key, - "notes": str(e) - } - self.__file_storage_system.append(record) - print("\tProcessed " + str(len(self.__file_storage_system)) + " File Storage service") - return (self.__file_storage_system) - except Exception as e: - raise RuntimeError("Error in __fss_read_fsss " + str(e.args)) - - ########################################################################## - # Network Security Groups - ########################################################################## - def __network_read_network_security_groups_rules(self): - self.__network_security_groups = [] - # Loopig Through Compartments Except Managed - try: - for region_key, region_values in self.__regions.items(): - nsgs_data = self.__search_resource_in_region("NetworkSecurityGroup", region_values) - - - # Looping through NSGs to to get - for nsg in nsgs_data: - deep_link = self.__oci_networking_uri + nsg.additional_details['vcnId'] + "/network-security-groups/" + nsg.identifier + '?region=' + region_key - record = { - "id": nsg.identifier, - "compartment_id": nsg.compartment_id, - "display_name": nsg.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, nsg.display_name), - "lifecycle_state": nsg.lifecycle_state, - "time_created": nsg.time_created.strftime(self.__iso_time_format), - "vcn_id": nsg.additional_details['vcnId'], - "freeform_tags": nsg.freeform_tags, - "defined_tags": nsg.defined_tags, - "region": region_key, - "rules": [] - } - - nsg_rules = oci.pagination.list_call_get_all_results( - region_values['network_client'].list_network_security_group_security_rules, - network_security_group_id=nsg.identifier - ).data - - for rule in nsg_rules: - deep_link = self.__oci_networking_uri + nsg.additional_details['vcnId'] + "/network-security-groups/" + nsg.identifier + "/nsg-rules" + '?region=' + region_key - rule_record = { - "id": rule.id, - "deep_link": self.__generate_csv_hyperlink(deep_link, rule.id), - "destination": rule.destination, - "destination_type": rule.destination_type, - "direction": rule.direction, - "icmp_options": rule.icmp_options, - "is_stateless": rule.is_stateless, - "is_valid": rule.is_valid, - "protocol": rule.protocol, - "source": rule.source, - "source_type": rule.source_type, - "tcp_options": rule.tcp_options, - "time_created": rule.time_created.strftime(self.__iso_time_format), - "udp_options": rule.udp_options, - - } - # Append NSG Rules to NSG - record['rules'].append(rule_record) - # Append NSG to list of NSGs - self.__network_security_groups.append(record) - print("\tProcessed " + str(len(self.__network_security_groups)) + " Network Security Groups") - return self.__network_security_groups - except Exception as e: - raise RuntimeError( - "Error in __network_read_network_security_groups_rules " + str(e.args)) - - ########################################################################## - # Network Security Lists - ########################################################################## - def __network_read_network_security_lists(self): - # Looping Through Compartments Except Managed - try: - for region_key, region_values in self.__regions.items(): - security_lists_data = self.__search_resource_in_region("SecurityList", region_values) - - - # Looping through Security Lists to to get - for security_list in security_lists_data: - deep_link = self.__oci_networking_uri + security_list.additional_details['vcnId'] + \ - "/security-lists/" + security_list.identifier + '?region=' + region_key - record = { - "id": security_list.identifier, - "compartment_id": security_list.compartment_id, - "display_name": security_list.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, security_list.display_name), - "lifecycle_state": security_list.lifecycle_state, - "time_created": security_list.time_created.strftime(self.__iso_time_format), - "vcn_id": security_list.additional_details['vcnId'], - "region": region_key, - "freeform_tags": security_list.freeform_tags, - "defined_tags": security_list.defined_tags, - "ingress_security_rules": [], - "egress_security_rules": [] - } - - if security_list.additional_details['egressSecurityRules'] is not None: - for i in range(len(security_list.additional_details['egressSecurityRules'])): - erule = { - # "description": egress_rule.description, - "destination": security_list.additional_details['egressSecurityRules'][i]['destination'], - # "destination_type": egress_rule.destination_type, - "icmp_options": security_list.additional_details['egressSecurityRules'][i]['icmpOptions'], - "is_stateless": security_list.additional_details['egressSecurityRules'][i]['isStateless'], - "protocol": security_list.additional_details['egressSecurityRules'][i]['protocol'], - "tcp_options": security_list.additional_details['egressSecurityRules'][i]['tcpOptions'], - "udp_options": security_list.additional_details['egressSecurityRules'][i]['udpOptions'] - } - record['egress_security_rules'].append(erule) - if security_list.additional_details['ingressSecurityRules'] is not None: - for i in range(len(security_list.additional_details['ingressSecurityRules'])): - irule = { - # "description": ingress_rule.description, - "source": security_list.additional_details['ingressSecurityRules'][i]['source'], - # "source_type": ingress_rule.source_type, - "icmp_options": security_list.additional_details['ingressSecurityRules'][i]['icmpOptions'], - "is_stateless": security_list.additional_details['ingressSecurityRules'][i]['isStateless'], - "protocol": security_list.additional_details['ingressSecurityRules'][i]['protocol'], - "tcp_options": security_list.additional_details['ingressSecurityRules'][i]['tcpOptions'], - "udp_options": security_list.additional_details['ingressSecurityRules'][i]['udpOptions'] - } - record['ingress_security_rules'].append(irule) - - # Append Security List to list of NSGs - self.__network_security_lists.append(record) - - print("\tProcessed " + str(len(self.__network_security_lists)) + " Security Lists") - return self.__network_security_lists - except Exception as e: - raise RuntimeError( - "Error in __network_read_network_security_lists " + str(e.args)) - - ########################################################################## - # Network Subnets Lists - ########################################################################## - def __network_read_network_subnets(self): - try: - for region_key, region_values in self.__regions.items(): - subnets_data = self.__search_resource_in_region("Subnet", region_values) - - - try: - for subnet in subnets_data: - deep_link = self.__oci_networking_uri + subnet.additional_details['vcnId'] + "/subnets/" + subnet.identifier + '?region=' + region_key - record = { - "id": subnet.identifier, - "availability_domain": subnet.availability_domain, - "cidr_block": subnet.additional_details['cidrBlock'], - "compartment_id": subnet.compartment_id, - "dhcp_options_id": subnet.additional_details['dhcpOptionsId'], - "display_name": subnet.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, subnet.display_name), - "dns_label": subnet.additional_details['dnsLabel'], - "ipv6_cidr_block": subnet.additional_details['ipv6CidrBlock'], - "ipv6_virtual_router_ip": subnet.additional_details['ipv6VirtualRouterIp'], - "lifecycle_state": subnet.lifecycle_state, - "prohibit_public_ip_on_vnic": subnet.additional_details['prohibitPublicIpOnVnic'], - "route_table_id": subnet.additional_details['routeTableId'], - "security_list_ids": subnet.additional_details['securityListIds'], - "subnet_domain_name": subnet.additional_details['subnetDomainName'], - "time_created": subnet.time_created.strftime(self.__iso_time_format), - "vcn_id": subnet.additional_details['vcnId'], - "virtual_router_ip": subnet.additional_details['virtualRouterIp'], - "virtual_router_mac": subnet.additional_details['virtualRouterMac'], - "freeform_tags": subnet.freeform_tags, - "define_tags": subnet.defined_tags, - "region": region_key, - "notes": "" - - } - # Adding subnet to subnet list - self.__network_subnets.append(record) - except Exception as e: - deep_link = self.__oci_networking_uri + subnet.additional_details['vcnId'] + "/subnet/" + subnet.identifier + '?region=' + region_key - record = { - "id": subnet.identifier, - "availability_domain": subnet.availability_domain, - "cidr_block": subnet.additional_details['cidrBlock'], - "compartment_id": subnet.compartment_id, - "dhcp_options_id": subnet.additional_details['dhcpOptionsId'], - "display_name": subnet.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, subnet.display_name), - "dns_label": subnet.additional_details['dnsLabel'], - "ipv6_cidr_block": "", - "ipv6_virtual_router_ip": "", - "lifecycle_state": subnet.lifecycle_state, - "prohibit_public_ip_on_vnic": subnet.additional_details['prohibitPublicIpOnVnic'], - "route_table_id": subnet.additional_details['routeTableId'], - "security_list_ids": subnet.additional_details['securityListIds'], - "subnet_domain_name": subnet.additional_details['subnetDomainName'], - "time_created": subnet.time_created.strftime(self.__iso_time_format), - "vcn_id": subnet.additional_details['vcnId'], - "virtual_router_ip": subnet.additional_details['virtualRouterIp'], - "virtual_router_mac": subnet.additional_details['virtualRouterMac'], - "region": region_key, - "notes": str(e) - - } - self.__network_subnets.append(record) - print("\tProcessed " + str(len(self.__network_subnets)) + " Network Subnets") - - return self.__network_subnets - except Exception as e: - raise RuntimeError( - "Error in __network_read_network_subnets " + str(e.args)) - - ########################################################################## - # Network VCNs Lists - ########################################################################## - def __network_read_network_vcns(self): - try: - for region_key, region_values in self.__regions.items(): - vcn_data = self.__search_resource_in_region("VCN", region_values) - - - for vcn in vcn_data: - deep_link = self.__oci_networking_uri + vcn.identifier + '?region=' + region_key - record = oci.util.to_dict(vcn) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, record['display_name']) - record['subnets'] = {} - record['network_security_groups'] = {} - record['security_lists'] = {} - # Adding VCN to VCN list - self.__network_vcns[vcn.identifier] = record - - print("\tProcessed " + str(len(self.__network_vcns)) + " Virtual Cloud Networks ") - return self.__network_vcns - except Exception as e: - raise RuntimeError( - "Error in __network_read_network_vcns " + str(e.args)) - - ########################################################################## - # Network Capture Filters Dictionary - ########################################################################## - def __network_read_network_capturefilters(self): - try: - for region_key, region_values in self.__regions.items(): - capturefilter_data = self.__search_resource_in_region("capturefilter", region_values) - - - for filter in capturefilter_data: - deep_link = self.__oci_network_capturefilter_uri + filter.identifier + '?region=' + region_key - record = oci.util.to_dict(filter) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, record['display_name']) - - # Adding CaptureFilter to CaptureFilter Dict - self.__network_capturefilters[filter.identifier] = record - - print("\tProcessed " + str(len(self.__network_capturefilters)) + " Network Capture Filters ") - - return self.__network_subnets - except Exception as e: - raise RuntimeError( - "Error in __network_read_network_capturefilters " + str(e.args)) - - ########################################################################## - # Load DRG Attachments - ########################################################################## - def __network_read_drg_attachments(self): - count_of_drg_attachments = 0 - try: - for region_key, region_values in self.__regions.items(): - # Looping through compartments in tenancy - drg_resources = self.__search_resource_in_region("DrgAttachment", region_values) - - - compartments = set() - - for drg in drg_resources: - compartments.add(drg.compartment_id) - - for compartment in compartments: - drg_attachment_data = oci.pagination.list_call_get_all_results( - region_values['network_client'].list_drg_attachments, - compartment_id=compartment, - lifecycle_state="ATTACHED", - attachment_type="ALL" - ).data - - # Looping through DRG Attachments in a compartment - for drg_attachment in drg_attachment_data: - deep_link = self.__oci_drg_uri + drg_attachment.drg_id + "/drg-attachment/" + drg_attachment.id + '?region=' + region_key - try: - record = { - "id": drg_attachment.id, - "display_name": drg_attachment.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, drg_attachment.display_name), - "drg_id": drg_attachment.drg_id, - "vcn_id": drg_attachment.vcn_id, - "drg_route_table_id": str(drg_attachment.drg_route_table_id), - "export_drg_route_distribution_id": str(drg_attachment.export_drg_route_distribution_id), - "is_cross_tenancy": drg_attachment.is_cross_tenancy, - "lifecycle_state": drg_attachment.lifecycle_state, - "network_details": drg_attachment.network_details, - "network_id": drg_attachment.network_details.id, - "network_type": drg_attachment.network_details.type, - "freeform_tags": drg_attachment.freeform_tags, - "define_tags": drg_attachment.defined_tags, - "time_created": drg_attachment.time_created.strftime(self.__iso_time_format), - "region": region_key, - "notes": "" - } - except Exception: - record = { - "id": drg_attachment.id, - "display_name": drg_attachment.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, drg_attachment.display_name), - "drg_id": drg_attachment.drg_id, - "vcn_id": drg_attachment.vcn_id, - "drg_route_table_id": str(drg_attachment.drg_route_table_id), - "export_drg_route_distribution_id": str(drg_attachment.export_drg_route_distribution_id), - "is_cross_tenancy": drg_attachment.is_cross_tenancy, - "lifecycle_state": drg_attachment.lifecycle_state, - "network_details": drg_attachment.network_details, - "network_id": "", - "network_type": "", - "freeform_tags": drg_attachment.freeform_tags, - "define_tags": drg_attachment.defined_tags, - "time_created": drg_attachment.time_created.strftime(self.__iso_time_format), - "region": region_key, - "notes": "" - } - - # Adding DRG Attachment to DRG Attachments list - try: - self.__network_drg_attachments[drg_attachment.drg_id].append(record) - except Exception: - self.__network_drg_attachments[drg_attachment.drg_id] = [] - self.__network_drg_attachments[drg_attachment.drg_id].append(record) - # Counter - count_of_drg_attachments += 1 - - print("\tProcessed " + str(count_of_drg_attachments) + " DRG Attachments") - return self.__network_drg_attachments - except Exception as e: - raise RuntimeError( - "Error in __network_read_drg_attachments " + str(e.args)) - - ########################################################################## - # Load DRGs - ########################################################################## - def __network_read_drgs(self): - try: - for region_key, region_values in self.__regions.items(): - # Looping through compartments in tenancy - drg_resources = self.__search_resource_in_region("Drg", region_values) - - - compartments = set() - - for drg in drg_resources: - compartments.add(drg.compartment_id) - - for compartment in compartments: - drg_data = oci.pagination.list_call_get_all_results( - region_values['network_client'].list_drgs, - compartment_id=compartment, - ).data - # Looping through DRGs in a compartment - for drg in drg_data: - deep_link = self.__oci_drg_uri + drg.id + '?region=' + region_key - # Fetch DRG Upgrade status - try: - upgrade_status = region_values['network_client'].get_upgrade_status(drg.id).data.status - except Exception: - upgrade_status = "Not Available" - - try: - record = { - "id": drg.id, - "display_name": drg.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, drg.display_name), - "default_drg_route_tables": drg.default_drg_route_tables, - "default_ipsec_tunnel_route_table": drg.default_drg_route_tables.ipsec_tunnel, - "default_remote_peering_connection_route_table": drg.default_drg_route_tables.remote_peering_connection, - "default_vcn_table": drg.default_drg_route_tables.vcn, - "default_virtual_circuit_route_table": drg.default_drg_route_tables.virtual_circuit, - "default_export_drg_route_distribution_id": drg.default_export_drg_route_distribution_id, - "compartment_id": drg.compartment_id, - "lifecycle_state": drg.lifecycle_state, - "upgrade_status": upgrade_status.upper(), - "time_created": drg.time_created.strftime(self.__iso_time_format), - "freeform_tags": drg.freeform_tags, - "define_tags": drg.defined_tags, - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": drg.id, - "display_name": drg.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, drg.display_name), - "default_drg_route_tables": drg.default_drg_route_tables, - "default_ipsec_tunnel_route_table": "", - "default_remote_peering_connection_route_table": "", - "default_vcn_table": "", - "default_virtual_circuit_route_table": "", - "default_export_drg_route_distribution_id": drg.default_export_drg_route_distribution_id, - "compartment_id": drg.compartment_id, - "lifecycle_state": drg.lifecycle_state, - "upgrade_status": upgrade_status, - "time_created": drg.time_created.strftime(self.__iso_time_format), - "freeform_tags": drg.freeform_tags, - "define_tags": drg.defined_tags, - "region": region_key, - "notes": str(e) - - } - # for Raw Data - self.__raw_network_drgs.append(record) - # For Checks data - self.__network_drgs[drg.id] = record - - print("\tProcessed " + str(len(self.__network_drgs)) + " Dynamic Routing Gateways") - return self.__network_drgs - except Exception as e: - raise RuntimeError( - "Error in __network_read_drgs " + str(e.args)) - - ########################################################################## - # Load Network FastConnect - ########################################################################## - def __network_read_fastonnects(self): - try: - for region_key, region_values in self.__regions.items(): - # Looping through compartments in tenancy - fastconnects = self.__search_resource_in_region("VirtualCircuit", region_values) - - compartments = set() - - for vc in fastconnects: - compartments.add(vc.compartment_id) - - for compartment in compartments: - fastconnect_data = oci.pagination.list_call_get_all_results( - region_values['network_client'].list_virtual_circuits, - compartment_id=compartment, - ).data - # lifecycle_state="PROVISIONED" - # Looping through fastconnects in a compartment - for fastconnect in fastconnect_data: - deep_link = self.__oci_fastconnect_uri + fastconnect.id + '?region=' + region_key - try: - record = { - "id": fastconnect.id, - "display_name": fastconnect.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, fastconnect.display_name), - "bandwidth_shape_name": fastconnect.bandwidth_shape_name, - "bgp_admin_state": fastconnect.bgp_admin_state, - "bgp_ipv6_session_state": fastconnect.bgp_ipv6_session_state, - "bgp_management": fastconnect.bgp_management, - "bgp_session_state": fastconnect.bgp_session_state, - "compartment_id": fastconnect.compartment_id, - "cross_connect_mappings": fastconnect.cross_connect_mappings, - "customer_asn": fastconnect.customer_asn, - "customer_bgp_asn": fastconnect.customer_bgp_asn, - "gateway_id": fastconnect.gateway_id, - "ip_mtu": fastconnect.ip_mtu, - "is_bfd_enabled": fastconnect.is_bfd_enabled, - "lifecycle_state": fastconnect.lifecycle_state, - "oracle_bgp_asn": fastconnect.oracle_bgp_asn, - "provider_name": fastconnect.provider_name, - "provider_service_id": fastconnect.provider_service_id, - "provider_service_key_name": fastconnect.provider_service_id, - "provider_service_name": fastconnect.provider_service_name, - "provider_state": fastconnect.provider_state, - "public_prefixes": fastconnect.public_prefixes, - "reference_comment": fastconnect.reference_comment, - "fastconnect_region": fastconnect.region, - "routing_policy": fastconnect.routing_policy, - "service_type": fastconnect.service_type, - "time_created": fastconnect.time_created.strftime(self.__iso_time_format), - "type": fastconnect.type, - "freeform_tags": fastconnect.freeform_tags, - "define_tags": fastconnect.defined_tags, - "region": region_key, - "notes": "" - } - # Adding fastconnect to fastconnect dict - - except Exception as e: - record = { - "id": fastconnect.id, - "display_name": fastconnect.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, fastconnect.display_name), - "bandwidth_shape_name": "", - "bgp_admin_state": "", - "bgp_ipv6_session_state": "", - "bgp_management": "", - "bgp_session_state": "", - "compartment_id": fastconnect.compartment_id, - "cross_connect_mappings": "", - "customer_asn": "", - "customer_bgp_asn": "", - "gateway_id": "", - "ip_mtu": "", - "is_bfd_enabled": "", - "lifecycle_state": "", - "oracle_bgp_asn": "", - "provider_name": "", - "provider_service_id": "", - "provider_service_key_name": "", - "provider_service_name": "", - "provider_state": "", - "public_prefixes": "", - "reference_comment": "", - "fastconnect_region": "", - "routing_policy": "", - "service_type": "", - "time_created": "", - "type": "", - "freeform_tags": "", - "define_tags": "", - "region": region_key, - "notes": str(e) - } - - # Adding fastconnect to fastconnect dict - try: - self.__network_fastconnects[fastconnect.gateway_id].append(record) - except Exception: - self.__network_fastconnects[fastconnect.gateway_id] = [] - self.__network_fastconnects[fastconnect.gateway_id].append(record) - - print("\tProcessed " + str(len((list(itertools.chain.from_iterable(self.__network_fastconnects.values()))))) + " FastConnects") - return self.__network_fastconnects - except Exception as e: - raise RuntimeError( - "Error in __network_read_fastonnects " + str(e.args)) - - ########################################################################## - # Load IP Sec Connections - ########################################################################## - def __network_read_ip_sec_connections(self): - try: - for region_key, region_values in self.__regions.items(): - ip_sec_connections_data = self.__search_resource_in_region("IPSecConnection", region_values) - - - for ip_sec in ip_sec_connections_data: - try: - deep_link = self.__oci_ipsec_uri + ip_sec.identifier + '?region=' + region_key - record = { - "id": ip_sec.identifier, - "display_name": ip_sec.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, ip_sec.display_name), - "cpe_id": ip_sec.additional_details['cpeId'], - "drg_id": ip_sec.additional_details['drgId'], - "compartment_id": ip_sec.compartment_id, - # "cpe_local_identifier": ip_sec.cpe_local_identifier, - # "cpe_local_identifier_type": ip_sec.cpe_local_identifier_type, - "lifecycle_state": ip_sec.lifecycle_state, - "freeform_tags": ip_sec.freeform_tags, - "define_tags": ip_sec.defined_tags, - "region": region_key, - "tunnels": [], - "number_tunnels_up": 0, - "tunnels_up": True, # It is true unless I find out otherwise - "number_tunnels_bgp": 0, - "tunnels_bgp": True, # It is true unless I find out otherwise - "notes": "" - } - # Getting Tunnel Data - try: - ip_sec_tunnels_data = oci.pagination.list_call_get_all_results( - region_values['network_client'].list_ip_sec_connection_tunnels, - ipsc_id=ip_sec.identifier, - ).data - for tunnel in ip_sec_tunnels_data: - deep_link = self.__oci_ipsec_uri + ip_sec.identifier + "/tunnels/" + tunnel.id + '?region=' + region_key - tunnel_record = { - "id": tunnel.id, - "cpe_ip": tunnel.cpe_ip, - "display_name": tunnel.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, tunnel.display_name), - "vpn_ip": tunnel.vpn_ip, - "ike_version": tunnel.ike_version, - "encryption_domain_config": tunnel.encryption_domain_config, - "lifecycle_state": tunnel.lifecycle_state, - "nat_translation_enabled": tunnel.nat_translation_enabled, - "bgp_session_info": tunnel.bgp_session_info, - "oracle_can_initiate": tunnel.oracle_can_initiate, - "routing": tunnel.routing, - "status": tunnel.status, - "compartment_id": tunnel.compartment_id, - "dpd_mode": tunnel.dpd_mode, - "dpd_timeout_in_sec": tunnel.dpd_timeout_in_sec, - "time_created": tunnel.time_created.strftime(self.__iso_time_format), - "time_status_updated": str(tunnel.time_status_updated), - "notes": "" - } - if tunnel_record['status'].upper() == "UP": - record['number_tunnels_up'] += 1 - else: - record['tunnels_up'] = False - if tunnel_record['routing'].upper() == "BGP": - record['number_tunnels_bgp'] += 1 - else: - record['tunnels_bgp'] = False - record["tunnels"].append(tunnel_record) - except Exception: - print("\t Unable to tunnels for ip_sec_connection: " + ip_sec.display_name + " id: " + ip_sec.identifier) - record['tunnels_up'] = False - - except Exception: - record = { - "id": ip_sec.identifier, - "display_name": ip_sec.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, ip_sec.display_name), - "cpe_id": "", - "drg_id": "", - "compartment_id": ip_sec.compartment_id, - "cpe_local_identifier": "", - "cpe_local_identifier_type": "", - "lifecycle_state": "", - "freeform_tags": "", - "define_tags": "", - "region": region_key, - "tunnels": [], - "number_tunnels_up": 0, - "tunnels_up": False, - "notes": "" - } - - try: - self.__network_ipsec_connections[ip_sec.additional_details['drgId']].append(record) - except Exception: - self.__network_ipsec_connections[ip_sec.additional_details['drgId']] = [] - self.__network_ipsec_connections[ip_sec.additional_details['drgId']].append(record) - - print("\tProcessed " + str(len((list(itertools.chain.from_iterable(self.__network_ipsec_connections.values()))))) + " IP SEC Connections") - return self.__network_ipsec_connections - except Exception as e: - raise RuntimeError( - "Error in __network_read_ip_sec_connections " + str(e.args)) - - - ############################################ - # Load Autonomous Databases - ############################################ - def __adb_read_adbs(self): - try: - for region_key, region_values in self.__regions.items(): - # UPDATED JB - #adb_query_resources = self.__search_query_resource_type("AutonomousDatabase", region_values['search_client']) - adb_query_resources = self.__search_resource_in_region("AutonomousDatabase", region_values) - - - compartments = set() - for adb in adb_query_resources: - compartments.add(adb.compartment_id) - - for compartment in compartments: - autonomous_databases = oci.pagination.list_call_get_all_results( - region_values['adb_client'].list_autonomous_databases, - compartment_id=compartment - ).data - # autonomous_databases = region_values['adb_client'].list_autonomous_databases( - # compartment_id=compartment - # ).data - for adb in autonomous_databases: - try: - deep_link = self.__oci_adb_uri + adb.id + '?region=' + region_key - # Issue 295 fixed - if adb.lifecycle_state not in [ oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATED, oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATING, oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_UNAVAILABLE ]: - record = oci.util.to_dict(adb) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name) - record['region'] = region_key - record['error'] = "" - self.__autonomous_databases.append(record) - else: - record = oci.util.to_dict(adb) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name) - record['region'] = region_key - record['error'] = "" - self.__autonomous_databases.append(record) - except Exception as e: - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name) - record['region'] = region_key - record['error'] = str(e) - self.__autonomous_databases.append(record) - - print("\tProcessed " + str(len(self.__autonomous_databases)) + " Autonomous Databases") - return self.__autonomous_databases - except Exception as e: - print("Error in __adb_read_adbs " + str(e.args)) - self.__errors.append({'id' : '__adb_read_adbs', 'error' : str(e)}) - - ############################################ - # Load Oracle Integration Cloud - ############################################ - def __oic_read_oics(self): - try: - for region_key, region_values in self.__regions.items(): - oic_resources = self.__search_resource_in_region("IntegrationInstance", region_values) - - - compartments = set() - - for oic_resource in oic_resources: - compartments.add(oic_resource.compartment_id) - - for compartment in compartments: - oic_instances = oci.pagination.list_call_get_all_results( - region_values['oic_client'].list_integration_instances, - compartment_id=compartment - ).data - for oic_instance in oic_instances: - if oic_instance.lifecycle_state == 'ACTIVE' or oic_instance.LIFECYCLE_STATE_INACTIVE == "INACTIVE": - deep_link = self.__oci_oicinstance_uri + oic_instance.id + '?region=' + region_key - try: - record = { - "id": oic_instance.id, - "display_name": oic_instance.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, oic_instance.display_name), - "network_endpoint_details": oic_instance.network_endpoint_details, - "compartment_id": oic_instance.compartment_id, - "alternate_custom_endpoints": oic_instance.alternate_custom_endpoints, - "consumption_model": oic_instance.consumption_model, - "custom_endpoint": oic_instance.custom_endpoint, - "instance_url": oic_instance.instance_url, - "integration_instance_type": oic_instance.integration_instance_type, - "is_byol": oic_instance.is_byol, - "is_file_server_enabled": oic_instance.is_file_server_enabled, - "is_visual_builder_enabled": oic_instance.is_visual_builder_enabled, - "lifecycle_state": oic_instance.lifecycle_state, - "message_packs": oic_instance.message_packs, - "state_message": oic_instance.state_message, - "time_created": oic_instance.time_created.strftime(self.__iso_time_format), - "time_updated": str(oic_instance.time_updated), - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": oic_instance.id, - "display_name": oic_instance.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, oic_instance.display_name), - "network_endpoint_details": "", - "compartment_id": "", - "alternate_custom_endpoints": "", - "consumption_model": "", - "custom_endpoint": "", - "instance_url": "", - "integration_instance_type": "", - "is_byol": "", - "is_file_server_enabled": "", - "is_visual_builder_enabled": "", - "lifecycle_state": "", - "message_packs": "", - "state_message": "", - "time_created": "", - "time_updated": "", - "region": region_key, - "notes": str(e) - } - self.__integration_instances.append(record) - print("\tProcessed " + str(len(self.__integration_instances)) + " Integration Instance") - return self.__integration_instances - except Exception as e: - raise RuntimeError("Error in __oic_read_oics " + str(e.args)) - - ############################################ - # Load Oracle Analytics Cloud - ############################################ - def __oac_read_oacs(self): - try: - for region_key, region_values in self.__regions.items(): - oac_resources = self.__search_resource_in_region("AnalyticsInstance", region_values) - - - compartments = set() - - for resource in oac_resources: - compartments.add(resource.compartment_id) - - for compartment in compartments: - oac_instances = oci.pagination.list_call_get_all_results( - region_values['oac_client'].list_analytics_instances, - compartment_id=compartment - ).data - for oac_instance in oac_instances: - deep_link = self.__oci_oacinstance_uri + oac_instance.id + '?region=' + region_key - try: - record = { - "id": oac_instance.id, - "name": oac_instance.name, - "deep_link": self.__generate_csv_hyperlink(deep_link, oac_instance.name), - "description": oac_instance.description, - "network_endpoint_details": oac_instance.network_endpoint_details, - "network_endpoint_type": oac_instance.network_endpoint_details.network_endpoint_type, - "compartment_id": oac_instance.compartment_id, - "lifecycle_state": oac_instance.lifecycle_state, - "email_notification": oac_instance.email_notification, - "feature_set": oac_instance.feature_set, - "service_url": oac_instance.service_url, - "capacity": oac_instance.capacity, - "license_type": oac_instance.license_type, - "time_created": oac_instance.time_created.strftime(self.__iso_time_format), - "time_updated": str(oac_instance.time_updated), - "region": region_key, - "notes": "" - } - except Exception as e: - record = { - "id": oac_instance.id, - "name": oac_instance.name, - "deep_link": self.__generate_csv_hyperlink(deep_link, oac_instance.name), - "network_endpoint_details": "", - "compartment_id": "", - "lifecycle_state": "", - "email_notification": "", - "feature_set": "", - "service_url": "", - "capacity": "", - "license_type": "", - "time_created": "", - "time_updated": "", - "region": region_key, - "notes": str(e) - } - self.__analytics_instances.append(record) - - print("\tProcessed " + str(len(self.__analytics_instances)) + " Analytics Instances") - return self.__analytics_instances - except Exception as e: - raise RuntimeError("Error in __oac_read_oacs " + str(e.args)) - - ########################################################################## - # Events - ########################################################################## - def __events_read_event_rules(self): - - try: - for region_key, region_values in self.__regions.items(): - events_rules_data = self.__search_resource_in_region("EventRule", region_values) - - - for event_rule in events_rules_data: - deep_link = self.__oci_events_uri + event_rule.identifier + '?region=' + region_key - record = { - "compartment_id": event_rule.compartment_id, - "condition": event_rule.additional_details['condition'], - "actions": event_rule.additional_details['actionsDetails'], - "description": event_rule.additional_details['description'], - "display_name": event_rule.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, event_rule.display_name), - "id": event_rule.identifier, - # "is_enabled": event_rule.is_enabled, - "lifecycle_state": event_rule.lifecycle_state, - "time_created": event_rule.time_created.strftime(self.__iso_time_format), - "region": region_key - } - self.__event_rules.append(record) - - print("\tProcessed " + str(len(self.__event_rules)) + " Event Rules") - return self.__event_rules - except Exception as e: - raise RuntimeError("Error in events_read_rules " + str(e.args)) - - ########################################################################## - # Logging - Log Groups and Logs - ########################################################################## - def __logging_read_log_groups_and_logs(self): - - try: - for region_key, region_values in self.__regions.items(): - log_groups = self.__search_resource_in_region("LogGroup", region_values) - - - # Looping through log groups to get logs - for log_group in log_groups: - deep_link = self.__oci_loggroup_uri + log_group.identifier + '?region=' + region_key - record = { - "compartment_id": log_group.compartment_id, - "description": log_group.additional_details['description'], - "display_name": log_group.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, log_group.display_name), - "id": log_group.identifier, - "time_created": log_group.time_created.strftime(self.__iso_time_format), - # "time_last_modified": str(log_group.time_last_modified), - "defined_tags": log_group.defined_tags, - "freeform_tags": log_group.freeform_tags, - "region": region_key, - "logs": [], - "notes" : "" - } - - try: - logs = oci.pagination.list_call_get_all_results( - region_values['logging_client'].list_logs, - log_group_id=log_group.identifier - ).data - for log in logs: - - deep_link = self.__oci_loggroup_uri + log_group.identifier + "/logs/" + log.id + '?region=' + region_key - log_record = { - "compartment_id": log.compartment_id, - "display_name": log.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, log.display_name), - "id": log.id, - "is_enabled": log.is_enabled, - "lifecycle_state": log.lifecycle_state, - "log_group_id": log.log_group_id, - "log_type": log.log_type, - "retention_duration": log.retention_duration, - "time_created": log.time_created.strftime(self.__iso_time_format), - "time_last_modified": str(log.time_last_modified), - "defined_tags": log.defined_tags, - "freeform_tags": log.freeform_tags, - "region" : region_key - } - try: - try: - if log_record["log_type"] == "SERVICE" and log_record['lifecycle_state'] == "ACTIVE": - log_record["configuration_compartment_id"] = log.configuration.compartment_id - log_record["source_category"] = log.configuration.source.category - log_record["source_parameters"] = log.configuration.source.parameters - log_record["source_source_type"] = log.configuration.source.source_type - log_record["source_service"] = log.configuration.source.service - # Object storage buckets are indexed by BucketName-region - if log_record["source_service"] == "objectstorage": - log_record["source_resource"] = log.configuration.source.resource + "-" + region_key - else: - log_record["source_resource"] = log.configuration.source.resource - log_record["archiving_enabled"] = log.configuration.archiving.is_enabled - if log_record["source_parameters"] and isinstance(log_record["source_parameters"],dict): - log_record["capture_filter"] = log.configuration.source.parameters["capture_filter"] - else: - log_record["capture_filter"] = None - - elif log_record["lifecycle_state"] == "ACTIVE": - log_record["source_category"] = log.log_type - log_record["source_service"] = log.log_type - log_record["source_resource"] = log.id - log_record["capture_filter"] = None - except Exception as e: - print(log) - print(e) - - #### TESTING SOMETHING NEW #### - - try: - ## Active means your logging - if log_record['lifecycle_state'] == 'ACTIVE': - if self.__all_logs: - - if log_record["source_service"] in self.__all_logs: - - if log_record["source_category"] in self.__all_logs[log_record["source_service"]]: - debug("\t__logging_read_log_groups_and_logs: Adding log for existing service and category ") - self.__all_logs[log_record["source_service"]][log_record["source_category"]][log_record["source_resource"]] = log_record - - else: - debug(f'\t__logging_read_log_groups_and_logs: Adding category {log_record["source_category"]}') - self.__all_logs[log_record["source_service"]][log_record["source_category"]] = {} - self.__all_logs[log_record["source_service"]][log_record["source_category"]][log_record["source_resource"]] = log_record - - else: - debug(f'\t__logging_read_log_groups_and_logs: Adding Service {log_record["source_service"]}, and category {log_record["source_category"]}') - self.__all_logs[log_record["source_service"]] = {} - self.__all_logs[log_record["source_service"]][log_record["source_category"]] = {} - self.__all_logs[log_record["source_service"]][log_record["source_category"]][log_record["source_resource"]] = log_record - - else: - debug(f'\t__logging_read_log_groups_and_logs: Starting Dict: Adding Service {log_record["source_service"]}, and category {log_record["source_category"]}' ) - self.__all_logs[log_record["source_service"]] = {} - self.__all_logs[log_record["source_service"]][log_record["source_category"]] = {} - self.__all_logs[log_record["source_service"]][log_record["source_category"]][log_record["source_resource"]] = log_record - - - except Exception as e: - print(f'\tFailed to parse log: {log_record["id"]}') - self.__errors.append({"id" : log_record["id"], "error" : str(e)}) - print("*" * 80) - print(log_record) - print("#" * 80) - print(e) - print("*" * 80) - - except Exception as e: - self.__errors.append({"id" : log.id, "error" : str(e)}) - # Append Log to log List - record['logs'].append(log_record) - except Exception as e: - self.__errors.append({"id" : log_group.identifier, "error" : str(e) }) - record['notes'] = str(e) - self.__logging_list.append(record) - - print("\tProcessed " + str(len(self.__logging_list)) + " Log Group Logs") - # print(self.__all_logs) - - return self.__logging_list - except Exception as e: - raise RuntimeError( - "Error in __logging_read_log_groups_and_logs " + str(e.args)) - - ########################################################################## - # Vault Keys - ########################################################################## - def __kms_read_keys(self): - debug("__kms_read_keys: Initiating") - try: - debug("\t__kms_read_keys: Getting all keys in regions") - for region_key, region_values in self.__regions.items(): - keys_data = self.__search_resource_in_region("Key", region_values) - - - vaults_set = set() - for key in keys_data: - vaults_set.add(key.additional_details['vaultId']) - - for vault in vaults_set: - try: - debug("\t__kms_read_keys: Getting Vault details for Vault: " + str(vault)) - vault_details = region_values['vault_client'].get_vault(vault_id=vault).data - debug("\t__kms_read_keys: Succeeded getting Vault details for: " + str(vault_details)) - vault_dict = oci.util.to_dict(vault_details) - vault_dict['region'] = region_key - vault_deep_link = self.__oci_vault_uri + vault_dict['id'] + '?region=' + region_key - vault_dict['deep_link'] = self.__generate_csv_hyperlink(name=vault_dict['display_name'], - url=vault_deep_link) - vault_dict['keys'] = [] - self.__vaults[vault] = vault_dict - debug("\t__kms_read_keys: Building KMS Client: " + str(vault)) - region_signer = self.__signer - region_signer.region_name = region_key - region_config = self.__config - region_config['region'] = region_key - self.__vaults[vault]['kms_client'] = oci.key_management.KmsManagementClient(config=region_config, - signer=region_signer, - service_endpoint=vault_dict['management_endpoint']) - if self.__proxy: - self.__vaults[vault]['kms_client'].base_client.session.proxies = {'https': self.__proxy} - debug("\t__kms_read_keys: Succeeded building KMS Client: " + str(vault)) - - except Exception as e: - print("\t__kms_read_keys: Failed getting Vault details for Vault: " + str(vault)) - print(e) - self.__vaults[vault] = {"id" : vault, "keys" : [], "kms_client" : None} - self.__errors.append({"id" : vault, "error" : str(e) }) - - ### Getting Wrapping Key - try: - wrapping_key_id = self.__vaults[vault]['kms_client'].get_wrapping_key().data.id - debug("\t__kms_read_keys: Succeeded Adding Wrapping Key Id: " + str(wrapping_key_id)) - self.__vaults[vault]['wrapping_key_id'] = wrapping_key_id - except Exception: - debug("\t__kms_read_keys: Failed Adding Wrapping Key Id for vault: " + str(vault)) - self.__vaults[vault]['wrapping_key_id'] = None - - for key in keys_data: - if key.identifier != self.__vaults[key.additional_details['vaultId']]['wrapping_key_id']: - deep_link = self.__oci_vault_uri + key.additional_details['vaultId'] + "/vaults/" + key.identifier + '?region=' + region_key - key_record = oci.util.to_dict(key) - key_record['region'] = region_key - key_record['is_primary'] = self.__vaults[key.additional_details['vaultId']].get('is_primary') - key_record['is_vault_replicable'] = self.__vaults[key.additional_details['vaultId']].get('is_vault_replicable') - key_record['deep_link'] = self.__generate_csv_hyperlink(deep_link, key_record['display_name']) - try: - if self.__vaults[key.additional_details['vaultId']]['kms_client']: - debug("\t__kms_read_keys: Getting Key version : " + str(key.additional_details['vaultId'])) - debug("\t__kms_read_keys: Getting Key version : " + str(key.additional_details['currentKeyVersion'])) - key_version = self.__vaults[key.additional_details['vaultId']]['kms_client'].get_key_version( - key_id=key.identifier, - key_version_id=key.additional_details['currentKeyVersion'], - ).data - key_record['currentKeyVersion_time_created'] = key_version.time_created.strftime(self.__iso_time_format) - debug("\t__kms_read_keys: Successfully got Key version : " + str(key.additional_details['currentKeyVersion'])) - else: - debug("\t__kms_read_keys: No Key version because not KMS client : " + str(key.additional_details['currentKeyVersion'])) - key_record['currentKeyVersion_time_created'] = None - - except Exception as e: - print("\t__kms_read_keys: Failed getting Key Version details for key: " + str(key.identifier)) - print(e) - key_record['currentKeyVersion_time_created'] = None - self.__errors.append({"id" : key.identifier, "error" : str(e) }) - - self.__vaults[key.additional_details['vaultId']]["keys"].append(key_record) - self.__kms_keys.append(key_record) - else: - debug("\t__kms_read_keys: Ignoring wrapping key: " + key.display_name) - - print(f"\tProcessed {str(len(self.__kms_keys))} Keys in {str(len(self.__vaults))} Vaults") - return self.__vaults - except Exception as e: - raise RuntimeError( - "Error in __kms_read_keys " + str(e.args)) - - ########################################################################## - # OCI Budgets - ########################################################################## - def __budget_read_budgets(self): - try: - # Getting all budgets in tenancy of any type - budgets_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['budget_client'].list_budgets, - compartment_id=self.__tenancy.id, - target_type="ALL" - ).data - # Looping through Budgets to to get records - for budget in budgets_data: - try: - alerts_data = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['budget_client'].list_alert_rules, - budget_id=budget.id, - ).data - except Exception: - print("\tFailed to get Budget Data for Budget Name: " + budget.display_name + " id: " + budget.id) - alerts_data = [] - - deep_link = self.__oci_budget_uri + budget.id - record = { - "actual_spend": budget.actual_spend, - "alert_rule_count": budget.alert_rule_count, - "amount": budget.amount, - "budget_processing_period_start_offset": budget.budget_processing_period_start_offset, - "compartment_id": budget.compartment_id, - "description": budget.description, - "display_name": budget.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, budget.display_name), - "id": budget.id, - "lifecycle_state": budget.lifecycle_state, - "processing_period_type": budget.processing_period_type, - "reset_period": budget.reset_period, - "target_compartment_id": budget.target_compartment_id, - "target_type": budget.target_type, - "tagerts": budget.targets, - "time_created": budget.time_created.strftime(self.__iso_time_format), - "time_spend_computed": str(budget.time_spend_computed), - "alerts": [] - } - - for alert in alerts_data: - record['alerts'].append(alert) - - # Append Budget to list of Budgets - self.__budgets.append(record) - - print("\tProcessed " + str(len(self.__budgets)) + " Budgets") - return self.__budgets - except Exception as e: - raise RuntimeError( - "Error in __budget_read_budgets " + str(e.args)) - - ########################################################################## - # OCI Quotas - ########################################################################## - def __quota_read(self): - # QUotas are only in the home region - quota_data = self.__search_resource_in_region("quota", self.__regions[self.__home_region] ) - debug("\t__quota_read: Recieved " + str(len(quota_data)) + " quotas " + str(self.__regions[self.__home_region]['region_name'])) - try: - for quota in quota_data: - deep_link = self.__oci_quota_uri + quota.identifier + '?region=' + self.__regions[self.__home_region]['region_name'] - record = { - "id": quota.identifier, - "deep_link": self.__generate_csv_hyperlink(deep_link, quota.identifier), - "compartment_id": quota.compartment_id, - "created_time": quota.time_created, - "lifecycle_state": quota.lifecycle_state, - "defined_tags": quota.defined_tags, - "freeform_tags": quota.freeform_tags, - "region": self.__regions[self.__home_region]['region_name'] - - } - self.__quotas.append(record) - - print("\tProcessed " + str(len(self.__quotas)) + " Quotas") - return self.__quotas - except Exception as e: - raise RuntimeError( - "Error in __quota_read " + str(e.args)) - - ########################################################################## - # Cloud Guard Problems - ########################################################################## - def __read_cloud_guard_problems(self): - """ - Retrieves every Cloud Guard problem for the reporting region, - converts each OCI model to a plain ``dict`` (via ``oci.util.to_dict``) - and stores the result in ``self.__cloud_guard_problems``. - """ - cg_client = self.__regions[self.__cloud_guard_config.reporting_region]['cloud_guard_client'] - - try: - response = oci.pagination.list_call_get_all_results( - cg_client.list_problems, - compartment_id=self.__tenancy.id, - lifecycle_state='ACTIVE', - compartment_id_in_subtree=True, - access_level="ACCESSIBLE" - ) - for problem in response.data: - record = oci.util.to_dict(problem) - deep_link = self.__oci_cgproblems_uri + record['id'] + "?region=" + record['region'] - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, record['resource_name']), - self.__cloud_guard_problems.append(record) - except Exception as e: - self.__errors.append({'id' : '__read_cloud_guard_problems', 'error' : str(e)}) - debug("__read_cloud_guard_problems failed to process: " + str(e)) - - print("\tProcessed " + str(len(self.__cloud_guard_problems)) + " Cloud Guard Problems") - - - ########################################################################## - # Cloud Guard Configuration - ########################################################################## - def __cloud_guard_read_cloud_guard_configuration(self): - try: - self.__cloud_guard_config = self.__regions[self.__home_region]['cloud_guard_client'].get_configuration( - self.__tenancy.id).data - debug("__cloud_guard_read_cloud_guard_configuration Cloud Guard Configuration is: " + str(self.__cloud_guard_config)) - self.__cloud_guard_config_status = self.__cloud_guard_config.status - - print("\tProcessed Cloud Guard Configuration.") - return self.__cloud_guard_config_status - - except Exception: - self.__cloud_guard_config_status = 'DISABLED' - self.__errors.append({"id" : "__cloud_guard_read_cloud_guard_configuration", "error" : "*** Cloud Guard service requires a PayGo account ***"}) - print("*** Cloud Guard service requires a PayGo account ***") - - ########################################################################## - # Cloud Guard Configuration - ########################################################################## - def __cloud_guard_read_cloud_guard_targets(self): - if self.__cloud_guard_config_status == "ENABLED": - cloud_guard_targets = 0 - try: - # Getting a compartments target - cg_targets = self.__regions[self.__cloud_guard_config.reporting_region]['cloud_guard_client'].list_targets( - compartment_id=self.__tenancy.id, compartment_id_in_subtree=True, access_level="RESTRICTED",).data.items - debug("__cloud_guard_read_cloud_guard_targets: " + str(cg_targets) ) - # Looping throufh targets to get target data - for target in cg_targets: - try: - # Getting Target data like recipes - try: - target_data = self.__regions[self.__cloud_guard_config.reporting_region]['cloud_guard_client'].get_target( - target_id=target.id - ).data - - except Exception: - target_data = None - deep_link = self.__oci_cgtarget_uri + target.id - record = { - "compartment_id": target.compartment_id, - "defined_tags": target.defined_tags, - "display_name": target.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, target.display_name), - "freeform_tags": target.freeform_tags, - "id": target.id, - "lifecycle_state": target.lifecycle_state, - "lifecyle_details": target.lifecyle_details, - "system_tags": target.system_tags, - "recipe_count": target.recipe_count, - "target_resource_id": target.target_resource_id, - "target_resource_type": target.target_resource_type, - "time_created": target.time_created.strftime(self.__iso_time_format), - "time_updated": str(target.time_updated), - "inherited_by_compartments": target_data.inherited_by_compartments if target_data else "", - "description": target_data.description if target_data else "", - "target_details": target_data.target_details if target_data else "", - "target_detector_recipes": target_data.target_detector_recipes if target_data else "", - "target_responder_recipes": target_data.target_responder_recipes if target_data else "" - } - # Indexing by compartment_id - - self.__cloud_guard_targets[target.compartment_id] = record - - cloud_guard_targets += 1 - - except Exception: - print("\t Failed to read Cloud Guard Target Data for: " + target.display_name + " id: " + target.id) - self.__errors.append({"id" : target.id, "error" : "Failed to read Cloud Guard Target Data for: " + target.display_name + " id: " + target.id }) - - print("\tProcessed " + str(cloud_guard_targets) + " Cloud Guard Targets") - return self.__cloud_guard_targets - - except Exception as e: - print("*** Cloud Guard service requires a PayGo account ***") - self.__errors.append({"id" : self.__tenancy.id, "error" : "Cloud Guard service requires a PayGo account. Error is: " + str(e)}) - - ########################################################################## - # Identity Password Policy - ########################################################################## - def __identity_read_tenancy_password_policy(self): - if self.__identity_domains_enabled: - self.__tenancy_password_policy = None - return self.__tenancy_password_policy - - print("\tProcessed Tenancy Password Policy...") - - try: - self.__tenancy_password_policy = self.__regions[self.__home_region]['identity_client'].get_authentication_policy( - self.__tenancy.id - ).data - - except Exception as e: - if "NotAuthorizedOrNotFound" in str(e): - self.__tenancy_password_policy = None - print("\t*** Access to password policies in this tenancy requires elevated permissions. ***") - self.__errors.append({"id" : self.__tenancy.id, "error" : "*** Access to password policies in this tenancy requires elevated permissions. ***"}) - else: - raise RuntimeError("Error in __identity_read_tenancy_password_policy " + str(e.args)) - return self.__tenancy_password_policy - - ########################################################################## - # Oracle Notifications Services for Subscriptions - ########################################################################## - def __ons_read_subscriptions(self): - debug("__ons_read_subscriptions: Starting: ") - try: - for region_key, region_values in self.__regions.items(): - # Iterate through compartments to get all subscriptions - subs_data = self.__search_resource_in_region("OnsSubscription", region_values) - - debug("\t__ons_read_subscriptions: Recieved " + str(len(subs_data)) + " subscriptions in region " + str(region_key)) - for sub in subs_data: - deep_link = self.__oci_onssub_uri + sub.identifier + '?region=' + region_key - record = { - "id": sub.identifier, - "deep_link": self.__generate_csv_hyperlink(deep_link, sub.identifier), - "compartment_id": sub.compartment_id, - # "created_time": sub.created_time, # this is an INT - "created_time": sub.time_created, - "endpoint": sub.additional_details['endpoint'], - "protocol": sub.additional_details['protocol'], - "topic_id": sub.additional_details['topicId'], - "lifecycle_state": sub.lifecycle_state, - "defined_tags": sub.defined_tags, - "freeform_tags": sub.freeform_tags, - "region": region_key - - } - self.__subscriptions.append(record) - - print("\tProcessed " + str(len(self.__subscriptions)) + " Subscriptions") - return self.__subscriptions - - except Exception as e: - print("Error in ons_read_subscription " + str(e.args)) - - ########################################################################## - # Identity Tag Default - ########################################################################## - def __identity_read_tag_defaults(self): - try: - # Getting Tag Default for the Root Compartment - Only - tag_defaults = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['identity_client'].list_tag_defaults, - compartment_id=self.__tenancy.id - ).data - for tag in tag_defaults: - deep_link = self.__oci_compartment_uri + tag.compartment_id + "/tag-defaults" - record = { - "id": tag.id, - "compartment_id": tag.compartment_id, - "value": tag.value, - "deep_link": self.__generate_csv_hyperlink(deep_link, tag.value), - "time_created": tag.time_created.strftime(self.__iso_time_format), - "tag_definition_id": tag.tag_definition_id, - "tag_definition_name": tag.tag_definition_name, - "tag_namespace_id": tag.tag_namespace_id, - "lifecycle_state": tag.lifecycle_state - - } - self.__tag_defaults.append(record) - - print("\tProcessed " + str(len(self.__tag_defaults)) + " Tag Defaults") - return self.__tag_defaults - - except Exception as e: - print("Error in __identity_read_tag_defaults " + str(e.args)) - self.__errors.append({'id' : '__identity_read_tag_defaults', 'error' : str(e)}) - ########################################################################## - # Get Service Connectors - ########################################################################## - def __sch_read_service_connectors(self): - - try: - # looping through regions - for region_key, region_values in self.__regions.items(): - # Collecting Service Connectors from each compartment - service_connectors_data = self.__search_resource_in_region("ServiceConnector", region_values) - - - # Getting Bucket Info - for connector in service_connectors_data: - deep_link = self.__oci_serviceconnector_uri + connector.identifier + "/logging" + '?region=' + region_key - try: - service_connector = region_values['sch_client'].get_service_connector( - service_connector_id=connector.identifier - ).data - record = { - "id": service_connector.id, - "display_name": service_connector.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, service_connector.display_name), - "description": service_connector.description, - "freeform_tags": service_connector.freeform_tags, - "defined_tags": service_connector.defined_tags, - "lifecycle_state": service_connector.lifecycle_state, - # "lifecycle_details": service_connector.lifecyle_details, - "system_tags": service_connector.system_tags, - "time_created": service_connector.time_created.strftime(self.__iso_time_format), - # "time_updated": str(service_connector.time_updated), - "target_kind": service_connector.target.kind, - "log_sources": [], - "region": region_key, - "notes": "" - } - for log_source in service_connector.source.log_sources: - record['log_sources'].append({ - 'compartment_id': log_source.compartment_id, - 'log_group_id': log_source.log_group_id, - 'log_id': log_source.log_id - }) - self.__service_connectors[service_connector.id] = record - except Exception as e: - record = { - "id": connector.identifier, - "display_name": connector.display_name, - "deep_link": self.__generate_csv_hyperlink(deep_link, connector.display_name), - "description": connector.additional_details['description'], - "freeform_tags": connector.freeform_tags, - "defined_tags": connector.defined_tags, - "lifecycle_state": connector.lifecycle_state, - # "lifecycle_details": connector.lifecycle_details, - "system_tags": "", - "time_created": connector.time_created.strftime(self.__iso_time_format), - # "time_updated": str(connector.time_updated), - "target_kind": "", - "log_sources": [], - "region": region_key, - "notes": str(e) - } - self.__service_connectors[connector.identifier] = record - # Returning Service Connectors - print("\tProcessed " + str(len(self.__service_connectors)) + " Service Connectors") - return self.__service_connectors - except Exception as e: - raise RuntimeError("Error in __sch_read_service_connectors " + str(e.args)) - - ########################################################################## - # Resources in root compartment - ########################################################################## - def __search_resources_in_root_compartment(self): - - # query = [] - # resources_in_root_data = [] - # record = [] - query_non_compliant = "query VCN, instance, volume, bootvolume, filesystem, bucket, autonomousdatabase, database, dbsystem resources where compartmentId = '" + self.__tenancy.id + "'" - query_all_resources = "query all resources where compartmentId = '" + self.__tenancy.id + "'" - # resources_in_root_data = self.__search_run_structured_query(query) - - for region_key, region_values in self.__regions.items(): - try: - # Searching for non compliant resources in root compartment - structured_search_query = oci.resource_search.models.StructuredSearchDetails(query=query_non_compliant) - search_results = oci.pagination.list_call_get_all_results( - region_values['search_client'].search_resources, - search_details=structured_search_query, - tenant_id=self.__tenancy.id - ).data - - for item in search_results: - record = { - "display_name": item.display_name, - "id": item.identifier, - "region": region_key - } - self.__resources_in_root_compartment.append(record) - - # Searching for all resources in the root compartment - structured_search_all_query = oci.resource_search.models.StructuredSearchDetails(query=query_all_resources) - structured_search_all_resources = oci.pagination.list_call_get_all_results( - region_values['search_client'].search_resources, - search_details=structured_search_all_query, - tenant_id=self.__tenancy.id - ).data - - for item in structured_search_all_resources: - # ignoring global resources like IAM - try: - if item.identifier.split('.')[3]: - record = { - "display_name": item.display_name, - "id": item.identifier, - "region": region_key - } - self.cis_foundations_benchmark_3_0['6.2']['Total'].append(record) - except Exception: - self.__errors.append({"id": "search_resources_in_root_compartment Invalid OCID", "error" : str(item)}) - debug(f'__search_resources_in_root_compartment: Invalid OCID: {str(item)}') - - except Exception as e: - raise RuntimeError( - "Error in __search_resources_in_root_compartment " + str(e.args)) - - print("\tProcessed " + str(len(self.__resources_in_root_compartment)) + " resources in the root compartment") - return self.__resources_in_root_compartment - - - ########################################################################## - # Gets a resource and it's additional fields via Search Servuce - ########################################################################## - def __search_query_resource_type(self, resource_type, search_client): - try: - query = f"query {resource_type} resources return allAdditionalFields" - results = oci.pagination.list_call_get_all_results( - search_client.search_resources, - search_details=oci.resource_search.models.StructuredSearchDetails( - query=query), - tenant_id=self.__tenancy.id - ).data - - return oci.util.to_dict(results) - except Exception: - debug("__search_query_resource_type: failed to get type: " + str(resource_type)) - return [] - - ########################################################################## - # All Resources in Tenancy - ########################################################################## - def __search_resources_all_resources_in_tenancy(self): - - for region_key, region_values in self.__regions.items(): - self.__all_resources_json[region_key] = {} - try: - all_regional_resources = oci.pagination.list_call_get_all_results( - region_values['search_client'].list_resource_types).data - # self.__all_resources_json[region_key] = all_regional_resources - for item in all_regional_resources: - if not(item.name in self.__all_resources_json[region_key]): - self.__all_resources_json[region_key][item.name] = [] - - for type in self.__all_resources_json[region_key]: - self.__all_resources_json[region_key][type] += self.__search_query_resource_type(type, region_values['search_client']) - - except Exception as e: - raise RuntimeError( - "Error in __search_resources_all_resources_in_tenancy " + str(e.args)) - - print("\tProcessed " + str(len(self.__all_resources_json)) + " resources in the tenancy") - # print(self.__all_resources_json) - return self.__all_resources_json - - ########################################################################## - # Get Compute Instances - ########################################################################## - def __core_instance_read_compute(self): - try: - # looping through regions - for region_key, region_values in self.__regions.items(): - # Collecting Service Connectors from each compartment - compute_instance_data = self.__search_query_resource_type("Instance", region_values['search_client']) - debug(f'__core_instance_read_compute {len(compute_instance_data)} in region: {region_key}' ) - # Getting Bucket Info - for instance in compute_instance_data: - debug(f'__core_instance_read_compute get instance data for {instance["identifier"]}' ) - - deep_link = self.__oci_instances_uri + instance['identifier'] + '?region=' + region_key - try: - instance_data = region_values['instance'].get_instance( - instance_id=instance['identifier'] - ).data - full_record = oci.util.to_dict(instance_data) - #Remove extended_metadata and metadata fields - record = {k: v for k, v in full_record.items() if k not in ["metadata","extended_metadata"]} - - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, instance['display_name']) - record['error'] = "" - # self.__all_resources_json[region_key]['Instance'].append(record) - self.__Instance.append(record) - except Exception as e: - # self.__all_resources_json[region_key]['Instance'].append(instance) - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, instance['display_name']) - record['error'] = str(e) - self.__Instance.append(record) - - - # Returning Instances - print("\tProcessed " + str(len(self.__Instance)) + " Compute Instances") - return self.__Instance - except Exception as e: - print("__core_instance_read_compute failed to process: " + str(e)) - self.__errors.append({'id' : '__core_instance_read_compute', 'error' : str(e)}) - return [] - - - ########################################################################## - # Returns a region name for a region key - # Takes: region key - ########################################################################## - def __get_region_name_from_key(self,region_key): - debug("__get_region_name_from_key") - for key, region_values in self.__regions.items(): - if region_values['region_key'].upper() == region_key.upper() or region_values['region_name'].upper() == region_key.upper(): - return region_values['region_name'] - - ########################################################################## - # Query All certificates in the tenancy - ########################################################################## - def __certificates_read_certificates(self): - debug("__certificates_read_certificates") - try: - for region_key, region_values in self.__regions.items(): - certificates_data = oci.pagination.list_call_get_all_results( - region_values['search_client'].search_resources, - search_details=oci.resource_search.models.StructuredSearchDetails( - query="query certificate resources return allAdditionalFields"), - tenant_id=self.__tenancy.id - ).data - cert_compartments = {} - debug("\t__certificates_read_certificates: Got Ceritificates from ") - - for certificate in certificates_data: - cert_compartments[certificate.compartment_id] = certificate.compartment_id - - for compartment in cert_compartments: - certs = oci.pagination.list_call_get_all_results( - region_values['certificate_client'].list_certificates, - compartment_id=compartment).data - for cert in certs: - record = oci.util.to_dict(cert) - debug("\t__certificates_read_certificates: Coverted Certificate Object to Dict") - - region_id = record['id'].split(".")[3] - debug("\t__certificates_read_certificates: Got region id") - - region_name = self.__get_region_name_from_key(region_id) - deep_link = self.__oci_cert_uri + record['id'] + "?region=" + region_name - record['deep_link'] = self.__generate_csv_hyperlink(deep_link, record['name']), - record['region'] = region_name - debug("\t__certificates_read_certificates: Added region name and deeplink to certificate record.") - self.__raw_oci_certificates.append(record) - except Exception as e: - debug("__certificates_read_certificates failed to process: " + str(e)) - self.__errors.append({'id' : '__certificates_read_certificates', 'error' : str(e)}) - - print("\tProcessed " + str(len(self.__raw_oci_certificates)) + " Certificates") - - ########################################################################## - # Query Services Limits - ########################################################################## - def __service_limits_utilization(self): - debug("__service_limits_utilization: Starting") - - service_limit_name_limit_value_mapping = {} - - def regional_service_limits(oci_region): - - thread_pool = concurrent.futures.ThreadPoolExecutor(max_workers=10) - - for oci_service in oci_services: - - thread_pool.submit(service_limit_values, oci_service.name, oci_region) - - thread_pool.shutdown(wait=True) - def service_limit_values(service_name, oci_region): - - oci_service_limit_values = oci.pagination.list_call_get_all_results( - self.__regions[oci_region]['limits_client'].list_limit_values, - self.__tenancy.id, service_name).data - service_limit_name_limit_value_mapping[oci_region][service_name] = oci_service_limit_values - - def utilization_function(oci_region, service_name, limit_name, availability_domain): - - try: - - oci_resource_availability = self.__regions[oci_region]['limits_client'].get_resource_availability( - service_name=service_name, - limit_name=limit_name, - compartment_id=self.__tenancy.id, - availability_domain=availability_domain).data - record = {} - record['service_name'] = service_name - record['limit_name'] = limit_name - record['used'] = None - record['total'] = None - record['available'] = None - record['service_limit_availability'] = None - record['region'] = oci_region - # record = {**record, **oci.util.to_dict(oci_resource_availability)} - if oci_resource_availability.available: - total = oci_resource_availability.available + oci_resource_availability.used - service_limit_availability = oci_resource_availability.available / total - record['total'] = total - record['used'] = oci_resource_availability.used - record['available'] = oci_resource_availability.available - record['service_limit_availability'] = float(100 - (service_limit_availability*100)) - self.__service_limits.append(record) - - except Exception as e: - debug( f"__service_limits_utilization_{service_name}_{limit_name}: " + str(e)) - self.__errors.append({'id' : f"__service_limits_utilization_{service_name}_{limit_name}", 'error' : str(e)}) - - - def service_limit_function(region_name, service_names): - - main_thread_pool = concurrent.futures.ThreadPoolExecutor(max_workers=10) - - for service_name in service_names: - - regional_service_list = service_limit_name_limit_value_mapping[region_name][service_name] - - for service_limit in regional_service_list: - - main_thread_pool.submit(utilization_function, region_name, service_name, service_limit.name, service_limit.availability_domain) - - main_thread_pool.shutdown(wait=True) - - try: - oci_services = oci.pagination.list_call_get_all_results( - self.__regions[self.__home_region]['limits_client'].list_services, - compartment_id=self.__tenancy.id).data - - except Exception as e: - self.__errors.append({"id": "__service_limits_utilization", \ - "error" : str(e)}) - raise RuntimeError( - "Error in __service_limits_utilization " + str(e)) - - for region_key in self.__regions.keys(): - - regional_services={} - - for oci_service in oci_services: - - regional_services[oci_service.name]=None - - service_limit_name_limit_value_mapping[region_key] = regional_services - - regional_limit_threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=len(self.__regions)) - service_limit_threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=len(self.__regions)) - - for region_key in self.__regions.keys(): - - # Get all OCI services - regional_limit_threadpool.submit(regional_service_limits, region_key) - - regional_limit_threadpool.shutdown(wait=True) - - for region_name, service_names in service_limit_name_limit_value_mapping.items(): - service_limit_threadpool.submit(service_limit_function, region_name, service_names) - - service_limit_threadpool.shutdown(wait=True) - print(f"\tProcessed {len(self.__service_limits)} service limits") - - ########################################################################## - # Unifying Network information into a single object for easier processing - ########################################################################## - def __unify_network_data(self): - for subnet in self.__network_subnets: - self.__network_vcns[subnet['vcn_id']]['subnets'][subnet['id']] = subnet - for nsg in self.__network_security_groups: - self.__network_vcns[nsg['vcn_id']]['network_security_groups'][nsg['id']] = nsg - for sl in self.__network_security_lists: - self.__network_vcns[sl['vcn_id']]['security_lists'][sl['id']] = sl - - - ########################################################################## - # Analyzes Tenancy Data for CIS Report - ########################################################################## - def __report_cis_analyze_tenancy_data(self): - self.__cis_regional_findings_data = {} - for check in self.__cis_regional_checks: - self.__cis_regional_findings_data[check] = {} - for region_key, region_values in self.__regions.items(): - self.__cis_regional_findings_data[check][region_key] = None - - self.__cis_check_iam_policies() - self.__cis_check_password_policies() - self.__cis_check_users() - self.__cis_check_dynamic_groups() - self.__cis_check_network_security() - self.__cis_check_compute_instances() - self.__cis_check_tagging_and_monitoring() - self.__cis_check_storage() - self.__cis_check_assets() - - - def __cis_check_iam_policies(self): - - # 1.1 Check - Checking for policy statements that are not restricted to a service - for policy in self.__policies: - for statement in policy['statements']: - if "allow group".upper() in statement.upper() \ - and ("to manage all-resources".upper() in statement.upper()) \ - and policy['name'].upper() != "Tenant Admin Policy".upper(): - # If there are more than manage all-resources in you don't meet this rule - self.cis_foundations_benchmark_3_0['1.1']['Status'] = False - self.cis_foundations_benchmark_3_0['1.1']['Findings'].append(policy) - break - - # 1.2 Check - for policy in self.__policies: - for statement in policy['statements']: - if "allow group".upper() in statement.upper() \ - and "to manage all-resources in tenancy".upper() in statement.upper() \ - and policy['name'].upper() != "Tenant Admin Policy".upper(): - - self.cis_foundations_benchmark_3_0['1.2']['Status'] = False - self.cis_foundations_benchmark_3_0['1.2']['Findings'].append( - policy) - - # 1.3 Check - May want to add a service check - for policy in self.__policies: - if policy['name'].lower() not in ['tenant admin policy', 'psm-root-policy']: - for statement in policy['statements']: - if ("allow group".upper() in statement.upper() and "tenancy".upper() in statement.upper() and ("to manage ".upper() in statement.upper() or "to use".upper() in statement.upper()) and ("all-resources".upper() in statement.upper() or (" groups ".upper() in statement.upper() and " users ".upper() in statement.upper()))): - split_statement = statement.split("where") - # Checking if there is a where clause - if len(split_statement) == 2: - # If there is a where clause remove whitespace and quotes - clean_where_clause = split_statement[1].upper().replace(" ", "").replace("'", "") - if all(permission.upper() in clean_where_clause for permission in self.cis_iam_checks['1.3']["targets"]): - pass - else: - self.cis_foundations_benchmark_3_0['1.3']['Findings'].append(policy) - self.cis_foundations_benchmark_3_0['1.3']['Status'] = False - - else: - self.cis_foundations_benchmark_3_0['1.3']['Findings'].append(policy) - self.cis_foundations_benchmark_3_0['1.3']['Status'] = False - - # CIS Total 1.1,1,2,1.3 Adding - All IAM Policies for to CIS Total - self.cis_foundations_benchmark_3_0['1.1']['Total'] = self.__policies - self.cis_foundations_benchmark_3_0['1.2']['Total'] = self.__policies - self.cis_foundations_benchmark_3_0['1.3']['Total'] = self.__policies - - # CIS 1.15 Check - Ensure storage service-level admins cannot delete resources they manage. - # Iterating through all policies - for policy in self.__policies: - if policy['name'].lower() not in ['tenant admin policy', 'psm-root-policy']: - insert_policy = None - for statement in policy['statements']: - for resource in self.cis_iam_checks['1.15']: - if "allow group".upper() in statement.upper() and "to manage ".upper() in statement.upper() and resource.upper() in statement.upper(): - split_statement = statement.split("where") - if len(split_statement) == 2: - clean_where_clause = split_statement[1].upper().replace(" ", "").replace("'", "") - if all(permission.upper() in clean_where_clause for permission in self.cis_iam_checks['1.15'][resource]) and \ - not(all(permission.upper() in clean_where_clause for permission in self.cis_iam_checks['1.15-storage-admin'][resource])): - debug("__report_cis_analyze_tenancy_data CIS 1.15 no permissions to delete storage: " + str(policy['name'])) - pass - # Checking if this is the Storage admin with allowed - elif all(permission.upper() in clean_where_clause for permission in self.cis_iam_checks['1.15-storage-admin'][resource]) and \ - not(all(permission.upper() in clean_where_clause for permission in self.cis_iam_checks['1.15'][resource])): - debug("__report_cis_analyze_tenancy_data CIS 1.15 storage admin policy is: " + str(policy['name'])) - pass - else: - insert_policy = True - debug("__report_cis_analyze_tenancy_data CIS 1.15 else policy is\n: " + str(policy['name'])) - - else: - insert_policy = True - if insert_policy: - self.cis_foundations_benchmark_3_0['1.15']['Findings'].append(policy) - - if self.cis_foundations_benchmark_3_0['1.15']['Findings']: - self.cis_foundations_benchmark_3_0['1.15']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.15']['Status'] = True - - # CIS Total 1.15 Adding - All IAM Policies for to CIS Total - self.cis_foundations_benchmark_3_0['1.15']['Total'] = self.__policies - - def __cis_check_password_policies(self): - # 1.4 Check - Password Policy - Only in home region - if not(self.__identity_domains_enabled) and self.__tenancy_password_policy: - if self.__tenancy_password_policy.password_policy.minimum_password_length >= 14: - self.cis_foundations_benchmark_3_0['1.4']['Status'] = True - else: - self.cis_foundations_benchmark_3_0['1.4']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.4']['Status'] = None - - # 1.4, 1.5 and 1.6 Checking Identity Domains Password Policy for expiry less than 365 and - debug("__report_cis_analyze_tenancy_data: Identity Domains Enabled is: " + str(self.__identity_domains_enabled)) - if self.__identity_domains_enabled: - for domain in self.__identity_domains: - if domain['password_policy']: - debug("Policy " + domain['display_name'] + " password expiry is " + str(domain['password_policy']['password_expires_after'])) - debug("Policy " + domain['display_name'] + " reuse is " + str(domain['password_policy']['num_passwords_in_history'])) - debug("Policy " + domain['display_name'] + " length is " + str(domain['password_policy']['min_length'])) - - - if domain['password_policy']['min_length']: - if domain['password_policy']['min_length'] < 14: - self.cis_foundations_benchmark_3_0['1.4']['Findings'].append(domain) - else: - self.cis_foundations_benchmark_3_0['1.4']['Findings'].append(domain) - - - if domain['password_policy']['password_expires_after']: - if domain['password_policy']['password_expires_after'] > 365: - self.cis_foundations_benchmark_3_0['1.5']['Findings'].append(domain) - else: - self.cis_foundations_benchmark_3_0['1.5']['Findings'].append(domain) - - if domain['password_policy']['num_passwords_in_history']: - if domain['password_policy']['num_passwords_in_history'] < 24: - self.cis_foundations_benchmark_3_0['1.6']['Findings'].append(domain) - else: - self.cis_foundations_benchmark_3_0['1.6']['Findings'].append(domain) - - else: - debug("__report_cis_analyze_tenancy_data 1.4, 1.5 and 1.6 no password policy") - self.cis_foundations_benchmark_3_0['1.4']['Findings'].append(domain) - self.cis_foundations_benchmark_3_0['1.5']['Findings'].append(domain) - self.cis_foundations_benchmark_3_0['1.6']['Findings'].append(domain) - - if self.cis_foundations_benchmark_3_0['1.4']['Findings']: - self.cis_foundations_benchmark_3_0['1.4']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.4']['Status'] = True - - if self.cis_foundations_benchmark_3_0['1.5']['Findings']: - self.cis_foundations_benchmark_3_0['1.5']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.5']['Status'] = True - - if self.cis_foundations_benchmark_3_0['1.6']['Findings']: - self.cis_foundations_benchmark_3_0['1.6']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.6']['Status'] = True - - # Adding all identity domains to Total - self.cis_foundations_benchmark_3_0['1.4']['Total'] = self.__identity_domains - self.cis_foundations_benchmark_3_0['1.5']['Total'] = self.__identity_domains - self.cis_foundations_benchmark_3_0['1.6']['Total'] = self.__identity_domains - - def __cis_check_users(self): - # 1.7 Check - Local Users w/o MFA - for user in self.__users: - if not(user['is_federated']) and user['can_use_console_password'] and not (user['is_mfa_activated']) and user['lifecycle_state']: - self.cis_foundations_benchmark_3_0['1.7']['Status'] = False - self.cis_foundations_benchmark_3_0['1.7']['Findings'].append( - user) - - # CIS Total 1.7 Adding - All Users to CIS Total - self.cis_foundations_benchmark_3_0['1.7']['Total'] = self.__users - - # 1.8 Check - API Keys over 90 - for user in self.__users: - if user['api_keys']: - for key in user['api_keys']: - if self.api_key_time_max_datetime >= datetime.datetime.strptime(key['time_created'], self.__iso_time_format): - self.cis_foundations_benchmark_3_0['1.8']['Status'] = False - finding = { - "user_name": user['name'], - "user_id": user['id'], - "key_id": key['id'], - "domain_deeplink": user['domain_deeplink'], - 'fingerprint': key['fingerprint'], - # 'inactive_status': key['inactive_status'], - # 'lifecycle_state': key['lifecycle_state'], - 'time_created': key['time_created'] - } - - self.cis_foundations_benchmark_3_0['1.8']['Findings'].append( - finding) - - # CIS Total 1.8 Adding - Customer Secrets to CIS Total - self.cis_foundations_benchmark_3_0['1.8']['Total'].append(key) - - # CIS 1.9 Check - Old Customer Secrets - for user in self.__users: - if user['customer_secret_keys']: - for key in user['customer_secret_keys']: - if self.api_key_time_max_datetime >= datetime.datetime.strptime(key['time_created'], self.__iso_time_format): - self.cis_foundations_benchmark_3_0['1.9']['Status'] = False - finding = { - "user_name": user['name'], - "user_id": user['id'], - "id": key['id'], - 'display_name': key['display_name'], - "domain_deeplink": user['domain_deeplink'], - # 'inactive_status': key['inactive_status'], - # 'lifecycle_state': key['lifecycle_state'], - 'time_created': key['time_created'], - 'time_expires': key['time_expires'] - } - - self.cis_foundations_benchmark_3_0['1.9']['Findings'].append(finding) - - # CIS Total 1.9 Adding - Customer Secrets to CIS Total - self.cis_foundations_benchmark_3_0['1.9']['Total'].append(key) - - # CIS 1.10 Check - Old Auth Tokens - for user in self.__users: - if user['auth_tokens']: - for key in user['auth_tokens']: - if self.api_key_time_max_datetime >= datetime.datetime.strptime(key['time_created'], self.__iso_time_format): # and key['lifecycle_state'] == 'ACTIVE': - self.cis_foundations_benchmark_3_0['1.10']['Status'] = False - - finding = { - "user_name": user['name'], - "user_id": user['id'], - "id": key['id'], - "domain_deeplink": user['domain_deeplink'], - "description": key['description'], - # "inactive_status": key['inactive_status'], - # "lifecycle_state": key['lifecycle_state'], - "time_created": key['time_created'] - # "time_expires": key['time_expires'], - # "token": key['token'] - } - - self.cis_foundations_benchmark_3_0['1.10']['Findings'].append( - finding) - - # CIS Total 1.10 Adding - Keys to CIS Total - self.cis_foundations_benchmark_3_0['1.10']['Total'].append( - key) - # CIS 1.11 Check - Old DB Password - # __iso_time_format1 = "%Y-%m-%dT%H:%M:%S.%fZ" - for user in self.__users: - if user['database_passwords']: - for key in user['database_passwords']: - if self.api_key_time_max_datetime >= datetime.datetime.strptime(key['time_created'], self.__iso_time_format): - self.cis_foundations_benchmark_3_0['1.11']['Status'] = False - - finding = { - "user_name": user['name'], - "user_id": user['id'], - "id": key['ocid'], - "domain_deeplink": user['domain_deeplink'], - "description": key['description'], - "time_created": key['time_created'] - # "expires-on": key['expires_on'] - } - - self.cis_foundations_benchmark_3_0['1.11']['Findings'].append(finding) - - # CIS Total 1.11 Adding - Keys to CIS Total - self.cis_foundations_benchmark_3_0['1.11']['Total'].append(key) - - - # CIS 1.12 Active Admins with API keys - # Iterating through all users to see if they have API Keys and if they are active users - for user in self.__users: - if 'Administrators' in user['groups'] and user['api_keys'] and user['lifecycle_state']: - self.cis_foundations_benchmark_3_0['1.12']['Status'] = False - self.cis_foundations_benchmark_3_0['1.12']['Findings'].append( - user) - - # CIS Total 1.12 Adding - All IAM Users in Administrator group to CIS Total - if 'Administrators' in user['groups'] and user['lifecycle_state']: - self.cis_foundations_benchmark_3_0['1.12']['Total'].append(user) - - # CIS 1.13 Check - This check is complete uses email verification - # Iterating through all users to see if they have API Keys and if they are active users - for user in self.__users: - if not (user['is_federated'] and user['lifecycle_state']) and user['external_identifier'] is None and user['lifecycle_state'] and not user['email_verified']: - self.cis_foundations_benchmark_3_0['1.13']['Status'] = False - self.cis_foundations_benchmark_3_0['1.13']['Findings'].append( - user) - - # CIS Total 1.13 Adding - All IAM Users for to CIS Total - self.cis_foundations_benchmark_3_0['1.13']['Total'] = self.__users - - - # CIS 1.16 Check - Users with API Keys over 45 days - - for user in self.__users: - - login_over_45_days = None - api_key_over_45_days = None - if user['lifecycle_state'] and user['can_use_console_password'] and not(user['is_federated']): #and user['can_use_console_password']: - if user['last_successful_login_date']: - last_successful_login_date = user['last_successful_login_date'].split(".")[0] - if self.local_user_time_max_datetime > datetime.datetime.strptime(last_successful_login_date, self.__iso_time_format): - login_over_45_days = True - debug(f"__report_cis_analyze_tenancy_data CIS 1.16 Last login is {user['last_successful_login_date']} and max login is {self.local_user_time_max_datetime}") - else: - debug(f"__report_cis_analyze_tenancy_data CIS 1.16 Last login is {user['last_successful_login_date']} and max login is {self.local_user_time_max_datetime}") - login_over_45_days = False - else: - debug("__report_cis_analyze_tenancy_data CIS 1.16 No Last login") - login_over_45_days = True - - else: - debug("__report_cis_analyze_tenancy_data CIS 1.16 INACTIVE USE") - login_over_45_days = False - - if user['api_keys'] and user['lifecycle_state']: - debug("__report_cis_analyze_tenancy_data CIS 1.16 API Key Check") - api_key_over_45_days = not(all(key.get('apikey_used_in_45_days', False) for key in user['api_keys'])) - else: - api_key_over_45_days = False - - debug(f"__report_cis_analyze_tenancy_data CIS 1.16 User: {user['name']}") - debug(f"__report_cis_analyze_tenancy_data CIS 1.16 Domain: {user['domain_deeplink']}") - debug(f'__report_cis_analyze_tenancy_data CIS 1.16 Login Over 45: {login_over_45_days}') - debug(f'__report_cis_analyze_tenancy_data CIS 1.16 API Key Over 45: {api_key_over_45_days}') - if login_over_45_days or api_key_over_45_days: - finding = user.copy() - finding['login_over_45_days'] = login_over_45_days - finding['api_key_over_45_days'] = api_key_over_45_days - self.cis_foundations_benchmark_3_0['1.16']['Findings'].append(finding) - - if self.cis_foundations_benchmark_3_0['1.16']['Findings']: - self.cis_foundations_benchmark_3_0['1.16']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.16']['Status'] = True - - # CIS Total 1.16 Adding - All IAM Policies for to CIS Total - self.cis_foundations_benchmark_3_0['1.16']['Total'] = self.__users - - - - # CIS 1.17 Check - Ensure there is only one active API Key for any single OCI IAM user - for user in self.__users: - if user['api_keys'] and not(len(user['api_keys']) < 2): - self.cis_foundations_benchmark_3_0['1.17']['Findings'].append(user) - - if self.cis_foundations_benchmark_3_0['1.17']['Findings']: - self.cis_foundations_benchmark_3_0['1.17']['Status'] = False - else: - self.cis_foundations_benchmark_3_0['1.17']['Status'] = True - # CIS Total 1.17 Adding - All IAM Policies for to CIS Total - self.cis_foundations_benchmark_3_0['1.17']['Total'] = self.__users - - def __cis_check_dynamic_groups(self): - # CIS 1.14 Check - Ensure Dynamic Groups are used for OCI instances, OCI Cloud Databases and OCI Function to access OCI resources - # Iterating through all dynamic groups ensure there are some for fnfunc, instance or autonomous. Using reverse logic so starts as a false - for dynamic_group in self.__dynamic_groups: - for oci_resource in self.cis_iam_checks['1.14']['resources']: - if dynamic_group['matching_rule'] and isinstance(dynamic_group['matching_rule'], list) and \ - any(oci_resource.upper() in str(dynamic_group['matching_rule'].upper())): - self.__errors.append({"id" :dynamic_group['id'], "error" : f"This matching rule is a list: {dynamic_group['matching_rule']}" }) - self.cis_foundations_benchmark_3_0['1.14']['Status'] = True - elif dynamic_group['matching_rule'] and isinstance(dynamic_group['matching_rule'], str) and \ - oci_resource.upper() in dynamic_group['matching_rule'].upper(): - self.cis_foundations_benchmark_3_0['1.14']['Status'] = True - else: - self.cis_foundations_benchmark_3_0['1.14']['Findings'].append(dynamic_group) - # Clearing finding - if self.cis_foundations_benchmark_3_0['1.14']['Status']: - self.cis_foundations_benchmark_3_0['1.14']['Findings'] = [] - - # CIS Total 1.14 Adding - All Dynamic Groups for to CIS Total - self.cis_foundations_benchmark_3_0['1.14']['Total'] = self.__dynamic_groups - - def __cis_check_network_security(self): - # CIS 2.1, 2.2 Check - Security List Ingress from 0.0.0.0/0 on ports 22, 3389 - for sl in self.__network_security_lists: - for irule in sl['ingress_security_rules']: - if irule['source'] == "0.0.0.0/0" and irule['protocol'] == '6': - if irule['tcp_options'] and irule['tcp_options']['destinationPortRange']: - port_min = irule['tcp_options']['destinationPortRange']['min'] - port_max = irule['tcp_options']['destinationPortRange']['max'] - ports_range = range(port_min, port_max + 1) - if 22 in ports_range: - self.cis_foundations_benchmark_3_0['2.1']['Status'] = False - self.cis_foundations_benchmark_3_0['2.1']['Findings'].append(sl) - if 3389 in ports_range: - self.cis_foundations_benchmark_3_0['2.2']['Status'] = False - self.cis_foundations_benchmark_3_0['2.2']['Findings'].append(sl) - break - else: - # If TCP Options is null it includes all ports - self.cis_foundations_benchmark_3_0['2.1']['Status'] = False - self.cis_foundations_benchmark_3_0['2.1']['Findings'].append(sl) - self.cis_foundations_benchmark_3_0['2.2']['Status'] = False - self.cis_foundations_benchmark_3_0['2.2']['Findings'].append(sl) - break - elif irule['source'] == "0.0.0.0/0" and irule['protocol'] == 'all': - # All Protocols allowed included TCP and all ports - self.cis_foundations_benchmark_3_0['2.1']['Status'] = False - self.cis_foundations_benchmark_3_0['2.1']['Findings'].append(sl) - self.cis_foundations_benchmark_3_0['2.2']['Status'] = False - self.cis_foundations_benchmark_3_0['2.2']['Findings'].append(sl) - break - - # CIS Total 2.1, 2.2 Adding - All SLs for to CIS Total - self.cis_foundations_benchmark_3_0['2.1']['Total'] = self.__network_security_lists - self.cis_foundations_benchmark_3_0['2.2']['Total'] = self.__network_security_lists - - # CIS 2.5 Check - any rule with 0.0.0.0 where protocol not 1 (ICMP) - # CIS Total 2.5 Adding - All Default Security List for to CIS Total - for sl in self.__network_security_lists: - if sl['display_name'].startswith("Default Security List for "): - self.cis_foundations_benchmark_3_0['2.5']['Total'].append(sl) - for irule in sl['ingress_security_rules'] + sl['egress_security_rules']: - if 'source' in irule and irule['source'] == "0.0.0.0/0": - debug("__report_cis_analyze_tenancy_data: Security List has bad ingress rule") - self.cis_foundations_benchmark_3_0['2.5']['Status'] = False - self.cis_foundations_benchmark_3_0['2.5']['Findings'].append( - sl) - break - elif 'destination' in irule and irule['destination'] == "0.0.0.0/0" and irule['protocol'] != '1': - debug("Security List has bad egress rule") - self.cis_foundations_benchmark_3_0['2.5']['Status'] = False - self.cis_foundations_benchmark_3_0['2.5']['Findings'].append( - sl) - break - - # CIS 2.3 and 2.4 Check - Network Security Groups Ingress from 0.0.0.0/0 on ports 22, 3389 - for nsg in self.__network_security_groups: - for rule in nsg['rules']: - if rule['source'] == "0.0.0.0/0" and rule['protocol'] == '6': - if rule['tcp_options'] and rule['tcp_options'].destination_port_range: - port_min = rule['tcp_options'].destination_port_range.min - port_max = rule['tcp_options'].destination_port_range.max - ports_range = range(port_min, port_max + 1) - if 22 in ports_range: - self.cis_foundations_benchmark_3_0['2.3']['Status'] = False - self.cis_foundations_benchmark_3_0['2.3']['Findings'].append( - nsg) - if 3389 in ports_range: - self.cis_foundations_benchmark_3_0['2.4']['Status'] = False - self.cis_foundations_benchmark_3_0['2.4']['Findings'].append(nsg) - break - else: - # If TCP Options is null it includes all ports - self.cis_foundations_benchmark_3_0['2.3']['Status'] = False - self.cis_foundations_benchmark_3_0['2.3']['Findings'].append(nsg) - self.cis_foundations_benchmark_3_0['2.4']['Status'] = False - self.cis_foundations_benchmark_3_0['2.4']['Findings'].append(nsg) - break - elif rule['source'] == "0.0.0.0/0" and rule['protocol'] == 'all': - # All Protocols allowed included TCP and all ports - self.cis_foundations_benchmark_3_0['2.3']['Status'] = False - self.cis_foundations_benchmark_3_0['2.3']['Findings'].append(nsg) - self.cis_foundations_benchmark_3_0['2.4']['Status'] = False - self.cis_foundations_benchmark_3_0['2.4']['Findings'].append(nsg) - break - - # CIS Total 2.3 & 2.4 Adding - All NSGs Instances to CIS Total - self.cis_foundations_benchmark_3_0['2.3']['Total'] = self.__network_security_groups - self.cis_foundations_benchmark_3_0['2.4']['Total'] = self.__network_security_groups - - # CIS 2.6 - Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources - # Iterating through OIC instance have network access rules and ensure 0.0.0.0/0 is not in the list - for integration_instance in self.__integration_instances: - if not (integration_instance['network_endpoint_details']): - self.cis_foundations_benchmark_3_0['2.6']['Status'] = False - self.cis_foundations_benchmark_3_0['2.6']['Findings'].append( - integration_instance) - elif integration_instance['network_endpoint_details']: - if "0.0.0.0/0" in str(integration_instance['network_endpoint_details']): - self.cis_foundations_benchmark_3_0['2.6']['Status'] = False - self.cis_foundations_benchmark_3_0['2.6']['Findings'].append( - integration_instance) - - # CIS Total 2.6 Adding - All OIC Instances to CIS Total - self.cis_foundations_benchmark_3_0['2.6']['Total'] = self.__integration_instances - - # CIS 2.7 - Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a VCN - for analytics_instance in self.__analytics_instances: - if analytics_instance['network_endpoint_type'].upper() == 'PUBLIC': - if not (analytics_instance['network_endpoint_details'].whitelisted_ips): - self.cis_foundations_benchmark_3_0['2.7']['Status'] = False - self.cis_foundations_benchmark_3_0['2.7']['Findings'].append(analytics_instance) - - elif "0.0.0.0/0" in analytics_instance['network_endpoint_details'].whitelisted_ips: - self.cis_foundations_benchmark_3_0['2.7']['Status'] = False - self.cis_foundations_benchmark_3_0['2.7']['Findings'].append( - analytics_instance) - - # CIS Total 2.7 Adding - All OAC Instances to CIS Total - self.cis_foundations_benchmark_3_0['2.7']['Total'] = self.__analytics_instances - - # CIS 2.8 Check - Ensure Oracle Autonomous Shared Databases (ADB) access is restricted to allowed sources or deployed within a VCN - # Control applies to Serverless only, so dedicated ADBs are excluded. - for autonomous_database in self.__autonomous_databases: - if ( - autonomous_database['lifecycle_state'] not in [ - oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATED, - oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATING, - oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_UNAVAILABLE, - ] - and not autonomous_database.get('is_dedicated', False) - ): - if not (autonomous_database['whitelisted_ips']) and not (autonomous_database['subnet_id']): - self.cis_foundations_benchmark_3_0['2.8']['Status'] = False - self.cis_foundations_benchmark_3_0['2.8']['Findings'].append(autonomous_database) - elif autonomous_database['whitelisted_ips']: - for value in autonomous_database['whitelisted_ips']: - if '0.0.0.0/0' in str(value): - self.cis_foundations_benchmark_3_0['2.8']['Status'] = False - self.cis_foundations_benchmark_3_0['2.8']['Findings'].append(autonomous_database) - - self.cis_foundations_benchmark_3_0['2.8']['Total'] = self.__autonomous_databases - - def __cis_check_compute_instances(self): - for instance in self.__Instance: - if instance['lifecycle_state'] not in ["TERMINATED","TERMINATING"]: - # CIS Check 3.1 Metadata Service v2 Enabled - if instance['instance_options'] is None or not(instance['instance_options']['are_legacy_imds_endpoints_disabled']): - debug(f"__report_cis_analyze_tenancy_data {instance['display_name']} doesn't disable IMDSv1") - self.cis_foundations_benchmark_3_0['3.1']['Status'] = False - self.cis_foundations_benchmark_3_0['3.1']['Findings'].append(instance) - - # CIS Check 3.2 Secure Boot enabled - if instance['platform_config'] is None or not(instance['platform_config']['is_secure_boot_enabled']): - debug(f"__report_cis_analyze_tenancy_data {instance['display_name']} doesn't enable secure boot") - self.cis_foundations_benchmark_3_0['3.2']['Status'] = False - self.cis_foundations_benchmark_3_0['3.2']['Findings'].append(instance) - - # CIS Check 3.3 Encryption in Transit enabled - if instance['launch_options'] is None or not(instance['launch_options']['is_pv_encryption_in_transit_enabled']): - debug(f"__report_cis_analyze_tenancy_data {instance['display_name']} doesn't enable encryption in transit") - self.cis_foundations_benchmark_3_0['3.3']['Status'] = False - self.cis_foundations_benchmark_3_0['3.3']['Findings'].append(instance) - - # CIS Total 3.1 Adding - All Instances to CIS Total - self.cis_foundations_benchmark_3_0['3.1']['Total'] = self.__Instance - # CIS Total 3.2 Adding - All Instances to CIS Total - self.cis_foundations_benchmark_3_0['3.2']['Total'] = self.__Instance - # CIS Total 3.3 Adding - All Instances to CIS Total - self.cis_foundations_benchmark_3_0['3.3']['Total'] = self.__Instance - - def __cis_check_tagging_and_monitoring(self): - # CIS Check 4.1 - Check for Default Tags in Root Compartment - # Iterate through tags looking for ${iam.principal.name} - for tag in self.__tag_defaults: - if tag['value'] == "${iam.principal.name}": - self.cis_foundations_benchmark_3_0['4.1']['Status'] = True - - # CIS Total 4.1 Adding - All Tag Defaults to CIS Total - self.cis_foundations_benchmark_3_0['4.1']['Total'] = self.__tag_defaults - - # CIS Check 4.2 - Check for Active Notification and Subscription - for sub in self.__subscriptions: - if sub['lifecycle_state'] == 'ACTIVE': - self.cis_foundations_benchmark_3_0['4.2']['Status'] = True - else: - self.cis_foundations_benchmark_3_0['4.2']['Findings'].append(sub) - - - - # CIS Check 4.2 Total - All Subscriptions to CIS Total - self.cis_foundations_benchmark_3_0['4.2']['Total'] = self.__subscriptions - - # CIS Checks 4.3 - 4.12 and 4.15 and 4.18 - # Iterate through all event rules - def __event_with_topic_has_active_sub(event_actions): - """ - Checks event actions - returns True if it finds either a non-ONS action or an ONS action whose topicId has at least one ACTIVE subscription. - Returns False when no qualifying action exists. - """ - for action in event_actions or []: - if action.get('actionType') == 'ONS' and action.get('topicId'): - topic_id = action.get('topicId') - if topic_id and __has_active_subscription_for_topic(topic_id=topic_id): - debug("*** Active Subscription found for event: " + event['display_name'] + " ***") - return True - elif not action.get('actionType') == 'ONS': - # None ONS based notifications are assumed to be ok - return True - return False - def __has_active_subscription_for_topic(topic_id: str) -> bool: - """ - Return True if any subscription in self.__subscriptions has: - - subscription["topic_id"] == topic_id and subscription["lifecycle_state"] == "ACTIVE" - Otherwise return False. - """ - if not topic_id: - return False - - for subscription in self.__subscriptions: - if ( - subscription.get("topic_id") == topic_id - and subscription.get("lifecycle_state") == "ACTIVE" - ): - return True - - return False - - for event in self.__event_rules: - if event['lifecycle_state'] == "ACTIVE" and event['compartment_id'] == self.__tenancy.id: - # Convert Event Condition to dict - eventtype_jsonable_str = event['condition'].lower().replace("'", "\"") - try: - eventtype_dict = json.loads(eventtype_jsonable_str) - except Exception: - print("*** Invalid Event Condition for event (not in JSON format): " + event['display_name'] + " ***") - eventtype_dict = {} - - # Issue 256: 'eventtype' not in eventtype_dict (i.e. missing in event condition) - if eventtype_dict and 'eventtype' in eventtype_dict: - for key, changes in self.cis_monitoring_checks.items(): - # Checking if all cis change list is a subset of event condition - try: - # Checking if each region has the required events - if (all(x in eventtype_dict['eventtype'] for x in changes)) and key in self.__cis_regional_checks: - if __event_with_topic_has_active_sub(event.get('actions')): - self.__cis_regional_findings_data[key][event['region']] = True - - # Cloud Guard Check is only required in the Cloud Guard Reporting Region - elif self.__cloud_guard_config and key == "4.15" and \ - event['region'] == self.__cloud_guard_config.reporting_region and \ - (all(x in eventtype_dict['eventtype'] for x in changes)): - if __event_with_topic_has_active_sub(event.get('actions')): - self.cis_foundations_benchmark_3_0[key]['Status'] = True - - # For Checks that are home region based checking those - elif (all(x in eventtype_dict['eventtype'] for x in changes)) and \ - key not in self.__cis_regional_checks and event['region'] == self.__home_region: - if __event_with_topic_has_active_sub(event.get('actions')): - self.cis_foundations_benchmark_3_0[key]['Status'] = True - - except Exception as e: - print(e) - print("*** Invalid Event Data for event: " + event['display_name'] + " ***") - - - # ******* Iterating through Regional Checks adding findings - for key, regions in self.__cis_regional_findings_data.items(): - non_compliant = [region for region, val in regions.items() if val is not True] - for region in regions: - self.cis_foundations_benchmark_3_0[key]['Total'].append({'region' : region}) - if not non_compliant: - self.cis_foundations_benchmark_3_0[key]['Status'] = True - else: - for region in non_compliant: - self.cis_foundations_benchmark_3_0[key]['Findings'].append({'region' : region}) - - ### Testing ### - # CIS Check 4.13 - VCN FlowLog enable - # Generate list of subnets IDs - debug("__report_cis_analyze_tenancy_data: Flowlogs checking CIS 4.13") - for subnet in self.__network_subnets: - vcn_id = subnet['vcn_id'] - try: - if self.__all_logs and 'flowlogs' in self.__all_logs and \ - 'vcn' in self.__all_logs['flowlogs'] and vcn_id in self.__all_logs['flowlogs']['vcn']: - - debug(f"__report_cis_analyze_tenancy_data: Flowlogs checking VCN {vcn_id} for Subnet: {subnet['id']} ") - if self.__all_logs['flowlogs']['vcn'][vcn_id]['capture_filter']: - capture_filter_id = self.__all_logs['flowlogs']['vcn'][vcn_id]['capture_filter'] - capture_filter = self.__network_capturefilters[capture_filter_id] - - if not(self.all_traffic_rules[0] in capture_filter['additional_details']['flowLogCaptureFilterRules'] or \ - self.all_traffic_rules[1] in capture_filter['additional_details']['flowLogCaptureFilterRules']): - # VCN is being logging but it is has a capture filter we need to check - debug(f"__report_cis_analyze_tenancy_data: Flowlogs Capture Filter {capture_filter_id} Rules not compliant.") - capture_filter = self.__network_capturefilters[capture_filter_id] - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - self.cis_foundations_benchmark_3_0['4.13']['Findings'].append(subnet) - - elif self.__all_logs and 'flowlogs' in self.__all_logs and \ - 'subnet' in self.__all_logs['flowlogs'] and subnet['id'] in self.__all_logs['flowlogs']['subnet']: - - debug(f"__report_cis_analyze_tenancy_data: Flowlogs checking Subnet {subnet['id']} in subnet") - debug(self.__all_logs['flowlogs']['subnet'][subnet['id']]['capture_filter']) - if self.__all_logs['flowlogs']['subnet'][subnet['id']]['capture_filter']: - debug(f"__report_cis_analyze_tenancy_data: Flowlogs checking Subnet {subnet['id']} capture filter in subnet") - capture_filter_id = self.__all_logs['flowlogs']['subnet'][subnet['id']]['capture_filter'] - capture_filter = self.__network_capturefilters[capture_filter_id] - if not(self.all_traffic_rules[0] in capture_filter['additional_details']['flowLogCaptureFilterRules'] or \ - self.all_traffic_rules[1] in capture_filter['additional_details']['flowLogCaptureFilterRules']): - # VCN is being logging but it is has a capture filter we need to check - debug(f"__report_cis_analyze_tenancy_data: Flowlogs Capture Filter {capture_filter_id} Rules not compliant.") - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - self.cis_foundations_benchmark_3_0['4.13']['Findings'].append(subnet) - - elif self.__all_logs and self.__all_logs['flowlogs'] and \ - 'all' in self.__all_logs['flowlogs'] and subnet['id'] in self.__all_logs['flowlogs']['all']: - - debug(f"__report_cis_analyze_tenancy_data: Flowlogs checking Subnet {subnet['id']} in all") - debug(self.__all_logs['flowlogs']['all'][subnet['id']]['capture_filter']) - if self.__all_logs['flowlogs']['all'][subnet['id']]['capture_filter']: - debug(f"__report_cis_analyze_tenancy_data: Flowlogs checking Subnet {subnet['id']} capture filter in all") - - capture_filter_id = self.__all_logs['flowlogs']['all'][subnet['id']]['capture_filter'] - capture_filter = self.__network_capturefilters[capture_filter_id] - if not(self.all_traffic_rules[0] in capture_filter['additional_details']['flowLogCaptureFilterRules'] or \ - self.all_traffic_rules[1] in capture_filter['additional_details']['flowLogCaptureFilterRules']): - # VCN is being logging but it is has a capture filter we need to check - debug(f"__report_cis_analyze_tenancy_data: Flowlogs Capture Filter {capture_filter_id} Rules not compliant.") - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - self.cis_foundations_benchmark_3_0['4.13']['Findings'].append(subnet) - - else: - debug(f"__report_cis_analyze_tenancy_data: Flowlogs count not find Subnet {subnet['id']}, it is a finding") - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - self.cis_foundations_benchmark_3_0['4.13']['Findings'].append(subnet) - - except Exception as e: - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - if ".capturefilter." in str(e): - print(f"Unable to read capturefilter rules for: {str(e)}.\n*** Please ensure your auditor has permissions: 'to read capture-filters in tenancy. ***") - self.__errors.append({"id" : str(e), "error" : "Unable to read capturefilter rules *** Please ensure your auditor has permissions: 'to read capture-filters in tenancy'."}) - else: - self.cis_foundations_benchmark_3_0['4.13']['Status'] = False - self.cis_foundations_benchmark_3_0['4.13']['Findings'].append(subnet) - msg = f'Unable to process all logs and capture filter rules: {str(e)}' - print(msg) - self.__errors.append({"id": "__network_subnet_logs", "error": msg}) - - # CIS Check 4.13 Total - Adding All Subnets to total - self.cis_foundations_benchmark_3_0['4.13']['Total'] = self.__network_subnets - - # CIS Check 4.14 - Cloud Guard enabled - debug("__report_cis_analyze_tenancy_data Cloud Guard Check: " + str(self.__cloud_guard_config_status)) - if self.__cloud_guard_config_status == 'ENABLED': - self.cis_foundations_benchmark_3_0['4.14']['Status'] = True - else: - self.cis_foundations_benchmark_3_0['4.14']['Status'] = False - - # CIS Check 4.16 - Encryption keys over 365 - # Generating list of keys - for key in self.__kms_keys: - if key.get('is_primary'): - try: - if self.kms_key_time_max_datetime and self.kms_key_time_max_datetime >= datetime.datetime.strptime(key['currentKeyVersion_time_created'], self.__iso_time_format): - self.cis_foundations_benchmark_3_0['4.16']['Status'] = False - self.cis_foundations_benchmark_3_0['4.16']['Findings'].append( - key) - if self.kms_key_time_max_datetime is None: - self.cis_foundations_benchmark_3_0['4.16']['Status'] = False - self.cis_foundations_benchmark_3_0['4.16']['Findings'].append( - key) - except Exception: - self.cis_foundations_benchmark_3_0['4.16']['Status'] = False - self.cis_foundations_benchmark_3_0['4.16']['Findings'].append( - key) - - # CIS Check 4.16 Total - Adding Key to total - self.cis_foundations_benchmark_3_0['4.16']['Total'].append(key) - - # CIS Check 4.17 - Object Storage with Logs - # Generating list of buckets names and need to make sure they have write level bucekt logs - if self.__all_logs and 'objectstorage' in self.__all_logs and\ - 'write' in self.__all_logs['objectstorage']: - - for bucket in self.__buckets: - if not (bucket['name'] + "-" + bucket['region'] in self.__all_logs['objectstorage']['write']): - self.cis_foundations_benchmark_3_0['4.17']['Status'] = False - self.cis_foundations_benchmark_3_0['4.17']['Findings'].append( - bucket) - else: - self.cis_foundations_benchmark_3_0['4.17']['Status'] = False - self.cis_foundations_benchmark_3_0['4.17']['Findings'] +=self.__buckets - - # CIS Check 4.17 Total - Adding All Buckets to total - self.cis_foundations_benchmark_3_0['4.17']['Total'] = self.__buckets - - def __cis_check_storage(self): - # CIS Section 5.1 Bucket Checks - # Generating list of buckets names - for bucket in self.__buckets: - if 'public_access_type' in bucket: - if bucket['public_access_type'] != 'NoPublicAccess': - self.cis_foundations_benchmark_3_0['5.1.1']['Status'] = False - self.cis_foundations_benchmark_3_0['5.1.1']['Findings'].append( - bucket) - - if 'kms_key_id' in bucket: - if not (bucket['kms_key_id']): - self.cis_foundations_benchmark_3_0['5.1.2']['Findings'].append( - bucket) - self.cis_foundations_benchmark_3_0['5.1.2']['Status'] = False - - if 'versioning' in bucket: - if bucket['versioning'] != "Enabled": - self.cis_foundations_benchmark_3_0['5.1.3']['Findings'].append( - bucket) - self.cis_foundations_benchmark_3_0['5.1.3']['Status'] = False - - # CIS Check 5.1.1,5.1.2,5.1.3 Total - Adding All Buckets to total - self.cis_foundations_benchmark_3_0['5.1.1']['Total'] = self.__buckets - self.cis_foundations_benchmark_3_0['5.1.2']['Total'] = self.__buckets - self.cis_foundations_benchmark_3_0['5.1.3']['Total'] = self.__buckets - - # CIS Section 5.2.1 Block Volume Checks - # Generating list of block volumes names - for volume in self.__block_volumes: - if 'kms_key_id' in volume: - if not (volume['kms_key_id']): - self.cis_foundations_benchmark_3_0['5.2.1']['Findings'].append( - volume) - self.cis_foundations_benchmark_3_0['5.2.1']['Status'] = False - - # CIS Check 5.2.1 Total - Adding All Block Volumes to total - self.cis_foundations_benchmark_3_0['5.2.1']['Total'] = self.__block_volumes - - # CIS Section 5.2.2 Boot Volume Checks - # Generating list of boot names - for boot_volume in self.__boot_volumes: - if 'kms_key_id' in boot_volume: - if not (boot_volume['kms_key_id']): - self.cis_foundations_benchmark_3_0['5.2.2']['Findings'].append( - boot_volume) - self.cis_foundations_benchmark_3_0['5.2.2']['Status'] = False - - # CIS Check 5.2.2 Total - Adding All Block Volumes to total - self.cis_foundations_benchmark_3_0['5.2.2']['Total'] = self.__boot_volumes - - # CIS Section 5.3.1 FSS Checks - # Generating list of FSS names - for file_system in self.__file_storage_system: - if 'kms_key_id' in file_system: - if not (file_system['kms_key_id']): - self.cis_foundations_benchmark_3_0['5.3.1']['Findings'].append( - file_system) - self.cis_foundations_benchmark_3_0['5.3.1']['Status'] = False - - # CIS Check 4.3.1 Total - Adding All Block Volumes to total - self.cis_foundations_benchmark_3_0['5.3.1']['Total'] = self.__file_storage_system - - def __cis_check_assets(self): - # CIS Section 6 Checks - # Checking if more than one compartment because of the ManagedPaaS Compartment - if len(self.__compartments) < 2: - self.cis_foundations_benchmark_3_0['6.1']['Status'] = False - - if len(self.__resources_in_root_compartment) > 0: - for item in self.__resources_in_root_compartment: - self.cis_foundations_benchmark_3_0['6.2']['Status'] = False - self.cis_foundations_benchmark_3_0['6.2']['Findings'].append( - item) - - ########################################################################## - # Recursive function the gets the child compartments of a compartment - ########################################################################## - - def __get_children(self, parent, compartments): - try: - kids = compartments[parent] - except Exception: - kids = [] - - if kids: - for kid in compartments[parent]: - kids = kids + self.__get_children(kid, compartments) - - return kids - - ########################################################################## - # Initializes OBP Checks - ########################################################################## - def __obp_init_regional_checks(self): - for region_key in self.__regions.keys(): - self.__obp_regional_checks[region_key] = { - "Audit": { - "tenancy_level_audit": False, - "tenancy_level_include_sub_comps": False, - "compartments": [], - "findings": [] - }, - "VCN": { - "subnets": [], - "findings": [] - }, - "Write_Bucket": { - "buckets": [], - "findings": [] - }, - "Read_Bucket": { - "buckets": [], - "findings": [] - }, - "Network_Connectivity": { - "drgs": [], - "findings": [], - "status": False - } - } - - - ########################################################################## - # OBP Budgets Check - ########################################################################## - def __obp_check_budget(self): - if len(self.__budgets) > 0: - for budget in self.__budgets: - if ( - budget["alert_rule_count"] > 0 - and budget["target_compartment_id"] == self.__tenancy.id - ): - for alert in budget["alerts"]: - if alert.type == "FORECAST": - self.obp_foundations_checks["Cost_Tracking_Budgets"]["Status"] = True - self.obp_foundations_checks["Cost_Tracking_Budgets"]["OBP"].append(budget) - break - else: - self.obp_foundations_checks["Cost_Tracking_Budgets"]["Findings"].append(budget) - else: - self.obp_foundations_checks["Cost_Tracking_Budgets"]["Findings"].append(budget) - - ####################################### - # OBP Quotas Checks - ####################################### - def __obp_check_quotas(self): - if self.__quotas: - self.obp_foundations_checks['Quotas']['Status'] = True - self.obp_foundations_checks['Quotas']['OBP'] = self.__quotas - - ####################################### - # OBP Audit Logs to SIEM check - ####################################### - def __obp_check_audit_log_compartments(self): - # Building a Hash Table of Parent Child Hierarchy for Audit - dict_of_compartments = {} - for compartment in self.__compartments: - if "tenancy" not in compartment.id: - try: - dict_of_compartments[compartment.compartment_id].append(compartment.id) - except Exception: - dict_of_compartments[compartment.compartment_id] = [] - dict_of_compartments[compartment.compartment_id].append(compartment.id) - # Collecting Service Connectors Logs related to compartments - for sch_id, sch_values in self.__service_connectors.items(): - # Only Active SCH with a target that is configured - if sch_values['lifecycle_state'].upper() == "ACTIVE" and sch_values['target_kind']: - for source in sch_values['log_sources']: - try: - # Checking if a the compartment being logged is the Tenancy and it has all child compartments - if source['compartment_id'] == self.__tenancy.id and source['log_group_id'].upper() == "_Audit_Include_Subcompartment".upper(): - self.__obp_regional_checks[sch_values['region']]['Audit']['tenancy_level_audit'] = True - self.__obp_regional_checks[sch_values['region']]['Audit']['tenancy_level_include_sub_comps'] = True - - # Since it is not the Tenancy we should add the compartment to the list and check if sub compartment are included - elif source['log_group_id'].upper() == "_Audit_Include_Subcompartment".upper(): - self.__obp_regional_checks[sch_values['region']]['Audit']['compartments'] += self.__get_children(source['compartment_id'], dict_of_compartments) - elif source['log_group_id'].upper() == "_Audit".upper(): - self.__obp_regional_checks[sch_values['region']]['Audit']['compartments'].append(source['compartment_id']) - except Exception: - # There can be empty log groups - pass - - # Analyzing Service Connector Audit Logs to see if each region has all compartments - for region_key, region_values in self.__obp_regional_checks.items(): - # Checking if I already found the tenancy ocid with all child compartments included - if not region_values['Audit']['tenancy_level_audit']: - list_of_all_compartments = [compartment.id for compartment in self.__compartments] - set_of_all_compartments = set(list_of_all_compartments) - audit_findings = set_of_all_compartments - set(region_values['Audit']['compartments']) - # If there are items in the then it is not auditing everything in the tenancy - if audit_findings: - region_values['Audit']['findings'] += list(audit_findings) - else: - region_values['Audit']['tenancy_level_audit'] = True - region_values['Audit']['findings'] = [] - - # Consolidating Audit findings into the OBP Checks - for region_key, region_values in self.__obp_regional_checks.items(): - # If this flag is set all compartments are not logged in region - if not region_values['Audit']['tenancy_level_audit']: - self.obp_foundations_checks['SIEM_Audit_Log_All_Comps']['Status'] = False - - # If this flag is set the region has the tenancy logging and all sub compartments flag checked - if not region_values['Audit']['tenancy_level_include_sub_comps']: - self.obp_foundations_checks['SIEM_Audit_Incl_Sub_Comp']['Status'] = False - self.obp_foundations_checks['SIEM_Audit_Incl_Sub_Comp']['Findings'].append({"region_name": region_key}) - else: - self.obp_foundations_checks['SIEM_Audit_Incl_Sub_Comp']['OBP'].append({"region_name": region_key}) - - # Compartment Logs that are missed in the region - for compartment in region_values['Audit']['findings']: - try: - finding = list(filter(lambda source: source['id'] == compartment, self.__raw_compartment.values()))[0] - record = { - "id": finding['id'], - "name": finding['name'], - "deep_link": finding['deep_link'], - "compartment_id": finding['compartment_id'], - "defined_tags": finding['defined_tags'], - "description": finding['description'], - "freeform_tags": finding['freeform_tags'], - "inactive_status": finding['inactive_status'], - "is_accessible": finding['is_accessible'], - "lifecycle_state": finding['lifecycle_state'], - "time_created": finding['time_created'], - "region": region_key - } - except Exception as e: - record = { - "id": compartment, - "name": "Compartment No Longer Exists", - "deep_link": "", - "compartment_id": "", - "defined_tags": "", - "description": str(e), - "freeform_tags": "", - "inactive_status": "", - "is_accessible": "", - "lifecycle_state": "", - "time_created": "", - "region": region_key - } - # Need to check for duplicates before adding the record - exists_already = list(filter(lambda source: source['id'] == record['id'] and source['region'] == record['region'], self.obp_foundations_checks['SIEM_Audit_Log_All_Comps']['Findings'])) - if not exists_already: - self.obp_foundations_checks['SIEM_Audit_Log_All_Comps']['Findings'].append(record) - - # Compartment logs that are not missed in the region - for compartment in region_values['Audit']['compartments']: - try: - finding = list(filter(lambda source: source['id'] == compartment, self.__raw_compartment.values()))[0] - record = { - "id": finding['id'], - "name": finding['name'], - "deep_link": finding['deep_link'], - "compartment_id": finding['compartment_id'], - "defined_tags": finding['defined_tags'], - "description": finding['description'], - "freeform_tags": finding['freeform_tags'], - "inactive_status": finding['inactive_status'], - "is_accessible": finding['is_accessible'], - "lifecycle_state": finding['lifecycle_state'], - "time_created": finding['time_created'], - "region": region_key - } - except Exception as e: - record = { - "id": compartment, - "name": "Compartment No Longer Exists", - "deep_link": "", - "compartment_id": "", - "defined_tags": "", - "description": str(e), - "freeform_tags": "", - "inactive_status": "", - "is_accessible": "", - "lifecycle_state": "", - "time_created": "", - "region": region_key - } - # Need to check for duplicates before adding the record - exists_already = list(filter(lambda source: source['id'] == record['id'] and source['region'] == record['region'], self.obp_foundations_checks['SIEM_Audit_Log_All_Comps']['OBP'])) - if not exists_already: - self.obp_foundations_checks['SIEM_Audit_Log_All_Comps']['OBP'].append(record) - - ####################################### - # OBP Cloud Guard Check - ####################################### - def __obp_check_cloud_guard(self): - ####################################### - # Cloud Guard Checks - ####################################### - cloud_guard_record = { - "cloud_guard_endable": True if self.__cloud_guard_config_status == 'ENABLED' else False, - "target_at_root": False, - "targert_configuration_detector": False, - "targert_configuration_detector_customer_owned": False, - "target_activity_detector": False, - "target_activity_detector_customer_owned": False, - "target_threat_detector": False, - "target_threat_detector_customer_owned": False, - "target_responder_recipes": False, - "target_responder_recipes_customer_owned": False, - "target_responder_event_rule": False, - } - - try: - # Cloud Guard Target attached to the root compartment with activity, config, and threat detector plus a responder - if self.__cloud_guard_targets[self.__tenancy.id]: - cloud_guard_record['target_at_root'] = True - - if self.__cloud_guard_targets[self.__tenancy.id]: - if self.__cloud_guard_targets[self.__tenancy.id]['target_detector_recipes']: - for recipe in self.__cloud_guard_targets[self.__tenancy.id]['target_detector_recipes']: - if recipe.detector.upper() == 'IAAS_CONFIGURATION_DETECTOR': - cloud_guard_record['targert_configuration_detector'] = True - if recipe.owner.upper() == "CUSTOMER": - cloud_guard_record['targert_configuration_detector_customer_owned'] = True - - elif recipe.detector.upper() == 'IAAS_ACTIVITY_DETECTOR': - cloud_guard_record['target_activity_detector'] = True - if recipe.owner.upper() == "CUSTOMER": - cloud_guard_record['target_activity_detector_customer_owned'] = True - - elif recipe.detector.upper() == 'IAAS_THREAT_DETECTOR': - cloud_guard_record['target_threat_detector'] = True - if recipe.owner.upper() == "CUSTOMER": - cloud_guard_record['target_threat_detector_customer_owned'] = True - - if self.__cloud_guard_targets[self.__tenancy.id]['target_responder_recipes']: - cloud_guard_record['target_responder_recipes'] = True - for recipe in self.__cloud_guard_targets[self.__tenancy.id]['target_responder_recipes']: - if recipe.owner.upper() == 'CUSTOMER': - cloud_guard_record['target_responder_recipes_customer_owned'] = True - - for rule in recipe.effective_responder_rules: - if rule.responder_rule_id.upper() == 'EVENT' and rule.details.is_enabled: - cloud_guard_record['target_responder_event_rule'] = True - - cloud_guard_record['target_id'] = self.__cloud_guard_targets[self.__tenancy.id]['id'] - cloud_guard_record['target_name'] = self.__cloud_guard_targets[self.__tenancy.id]['display_name'] - - except Exception: - pass - - all_cloud_guard_checks = True - for value in cloud_guard_record.values(): - if not (value): - all_cloud_guard_checks = False - - self.obp_foundations_checks['Cloud_Guard_Config']['Status'] = all_cloud_guard_checks - if all_cloud_guard_checks: - self.obp_foundations_checks['Cloud_Guard_Config']['OBP'].append(cloud_guard_record) - else: - self.obp_foundations_checks['Cloud_Guard_Config']['Findings'].append(cloud_guard_record) - - for problem in self.__cloud_guard_problems: - if problem['risk_level'] in ['HIGH','CRITICAL']: - self.obp_foundations_checks['Cloud_Guard_Problems']['Findings'].append(problem) - else: - self.obp_foundations_checks['Cloud_Guard_Problems']['OBP'].append(problem) - - for key in self.obp_foundations_checks.keys(): - if key.startswith("Cloud_Guard_"): - if self.obp_foundations_checks[key]['Findings']: - self.obp_foundations_checks[key]['Status'] = False - else: - self.obp_foundations_checks[key]['Status'] = True - - - ####################################### - # OBP Networking Checks - ####################################### - def __obp_check_networking(self): - # Fast Connect Connections - - for drg_id, drg_values in self.__network_drg_attachments.items(): - number_of_valid_connected_vcns = 0 - number_of_valid_fast_connect_circuits = 0 - number_of_valid_site_to_site_connection = 0 - number_of_valid_bgp_site_to_site_connection = 0 - - fast_connect_providers = set() - customer_premises_equipment = set() - drg_upgrade_status = self.__network_drgs[drg_id]['upgrade_status'] - - for attachment in drg_values: - if attachment['network_type'].upper() == 'VCN': - # Checking if DRG has a valid VCN attached to it - number_of_valid_connected_vcns += 1 - - elif attachment['network_type'].upper() == 'IPSEC_TUNNEL': - # Checking if the IPSec Connection has both tunnels up - for ipsec_connection in self.__network_ipsec_connections[drg_id]: - if ipsec_connection['tunnels_up']: - # Good IP Sec Connection increment valid site to site and track CPEs - number_of_valid_site_to_site_connection += 1 - customer_premises_equipment.add(ipsec_connection['cpe_id']) - if ipsec_connection['tunnels_bgp']: - number_of_valid_bgp_site_to_site_connection += 1 - - elif attachment['network_type'].upper() == 'VIRTUAL_CIRCUIT': - - # Checking for Provision and BGP enabled Virtual Circuits and that it is associated - try: - for virtual_circuit in self.__network_fastconnects[attachment['drg_id']]: - if attachment['network_id'] == virtual_circuit['id']: - if virtual_circuit['lifecycle_state'].upper() == 'PROVISIONED' and virtual_circuit['bgp_session_state'].upper() == "UP": - # Good VC to increment number of VCs and append the provider name - fast_connect_providers.add(virtual_circuit['provider_name']) - number_of_valid_fast_connect_circuits += 1 - except Exception: - debug("__obp_analyze_tenancy_data: Fast Connect Connections check: DRG ID not found " + str(drg_id)) - self.__errors.append({"id" : str(drg_id), "error" : str("__obp_analyze_tenancy_data: Fast Connect Connections check: DRG ID not found")}) - try: - record = { - "drg_id": drg_id, - "drg_display_name": self.__network_drgs[drg_id]['display_name'], - "upgrade_status": drg_upgrade_status, - "region": self.__network_drgs[drg_id]['region'], - "number_of_connected_vcns": number_of_valid_connected_vcns, - "number_of_customer_premises_equipment": len(customer_premises_equipment), - "number_of_connected_ipsec_connections": number_of_valid_site_to_site_connection, - "number_of_valid_bgp_site_to_site_connection": number_of_valid_bgp_site_to_site_connection, - "number_of_fastconnects_cicruits": number_of_valid_fast_connect_circuits, - "number_of_fastconnect_providers": len(fast_connect_providers), - } - except Exception: - record = { - "drg_id": drg_id, - "drg_display_name": "Deleted with an active attachement", - "upgrade_status" : None, - "region": attachment['region'], - "number_of_connected_vcns": 0, - "number_of_customer_premises_equipment": 0, - "number_of_connected_ipsec_connections": 0, - "number_of_valid_bgp_site_to_site_connection": 0, - "number_of_fastconnects_cicruits": 0, - "number_of_fastconnect_providers": 0, - } - print(f"This DRG: {drg_id} is deleted with an active attachement: {attachment['display_name']}") - self.__errors.append({"id" : str(drg_id), "error" : f"This DRG: {drg_id} is deleted with an active attachement: {attachment['display_name']}"}) - - - # Checking if the DRG and connected resourcs are aligned with best practices - # One attached VCN, One VPN connection and one fast connect - if number_of_valid_connected_vcns >= 2 and number_of_valid_site_to_site_connection and number_of_valid_fast_connect_circuits: - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["drgs"].append(record) - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["status"] = True - # Two VPN site to site connections to seperate CPEs - elif number_of_valid_connected_vcns >= 2 and number_of_valid_site_to_site_connection and len(customer_premises_equipment) >= 2: - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["drgs"].append(record) - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["status"] = True - # Two FastConnects from Different providers - elif number_of_valid_connected_vcns >= 2 and number_of_valid_fast_connect_circuits and len(fast_connect_providers) >= 2: - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["drgs"].append(record) - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["status"] = True - else: - self.__obp_regional_checks[record['region']]["Network_Connectivity"]["findings"].append(record) - - # Checking if this there is a hub and spoke basically two VCNs to one DRG - if not number_of_valid_connected_vcns >= 2: - self.obp_foundations_checks['Networking_Hub_Spoke']['Findings'].append(record) - else: - self.obp_foundations_checks['Networking_Hub_Spoke']['OBP'].append(record) - - # Checking if this DRG has been upgraded to Version 2 - if not drg_upgrade_status == "UPGRADED": - self.obp_foundations_checks["Networking_DRG_Upgraded"]["Findings"].append(record) - else: - self.obp_foundations_checks["Networking_DRG_Upgraded"]["OBP"].append(record) - - # Checking if this DRG IPSec connection has two connetions - if not number_of_valid_site_to_site_connection >= 2: - self.obp_foundations_checks["Networking_IPSec_connections"]["Findings"].append(record) - else: - self.obp_foundations_checks["Networking_IPSec_connections"]["OBP"].append(record) - - # Checking if this DRG IPSec connection has two connetions - if not number_of_valid_bgp_site_to_site_connection >= 2: - self.obp_foundations_checks["Networking_IPSec_bgp"]["Findings"].append(record) - else: - self.obp_foundations_checks["Networking_IPSec_bgp"]["OBP"].append(record) - - - # Consolidating Regional - - for region_values in self.__obp_regional_checks.values(): - # I assume you are well connected in all regions if find one region that is not it fails - self.obp_foundations_checks["Networking_Redudancy"]["Findings"] += region_values["Network_Connectivity"]["findings"] - self.obp_foundations_checks["Networking_Redudancy"]["OBP"] += region_values["Network_Connectivity"]["drgs"] - - for key in self.obp_foundations_checks.keys(): - if key.startswith("Networking_"): - if self.obp_foundations_checks[key]['Findings']: - self.obp_foundations_checks[key]['Status'] = False - else: - self.obp_foundations_checks[key]['Status'] = True - - ####################################### - # OBP Certificate Expiry Check - ####################################### - def __obp_check_certificates(self): - for cert in self.__raw_oci_certificates: - debug("\t__obp_analyze_tenancy_data: Iterating through certificates") - - try: - if cert['current_version_summary']['validity'] and \ - datetime.datetime.strptime(self.get_date_iso_format(cert['current_version_summary']['validity']['time_of_validity_not_after']), self.__iso_time_format) >= self.cert_key_time_max_datetime: - self.obp_foundations_checks['Certificates_Near_Expiry']['OBP'].append(cert) - else: - self.obp_foundations_checks['Certificates_Near_Expiry']['Findings'].append(cert) - except Exception: - debug("\t__obp_analyze_tenancy_data: Certificate is missing time of validity not after" + cert['name']) - self.obp_foundations_checks['Certificates_Near_Expiry']['Findings'].append(cert) - - if self.obp_foundations_checks['Certificates_Near_Expiry']['Findings']: - self.obp_foundations_checks['Certificates_Near_Expiry']['Status'] = False - else: - self.obp_foundations_checks['Certificates_Near_Expiry']['Status'] = True - - ####################################### - # OBP Subnet Log Checks - ####################################### - def __obp_check_subnet_logs(self): - cis_logged_subnets = set() - all_subnet_nets = set() - for subnet in self.cis_foundations_benchmark_3_0['4.13']['Findings']: - cis_logged_subnets.add(subnet['id']) - for subnet in self.cis_foundations_benchmark_3_0['4.13']['Total']: - all_subnet_nets.add(subnet['id']) - - list_of_properly_logged_subnets = all_subnet_nets - cis_logged_subnets - # need to check for no logs - for sch_id, sch_values in self.__service_connectors.items(): - if self.__all_logs and 'flowlogs' in self.__all_logs and \ - sch_values['lifecycle_state'].upper() == "ACTIVE" and sch_values['target_kind']: - for subnet_id in list_of_properly_logged_subnets: - log_values = None - if 'subnet' in self.__all_logs['flowlogs'] and subnet_id in self.__all_logs['flowlogs']['subnet']: - log_values = self.__all_logs['flowlogs']['subnet'][subnet_id] - elif 'all' in self.__all_logs['flowlogs'] and subnet_id in self.__all_logs['flowlogs']['all']: - log_values = self.__all_logs['flowlogs']['all'][subnet_id] - elif 'vcn' in self.__all_logs['flowlogs'] and self.__all_logs['flowlogs']['vcn']: - for vcn_id, vcn_values in self.__network_vcns.items(): - if subnet_id in vcn_values['subnets']: - log_values = self.__all_logs['flowlogs']['vcn'][vcn_id] - - log_id = log_values['id'] - log_group_id = log_values['log_group_id'] - log_record = {"sch_id": sch_id, "sch_name": sch_values['display_name'], "id": subnet_id} - - subnet_log_group_in_sch = list(filter(lambda source: source['log_group_id'] == log_group_id, sch_values['log_sources'])) - subnet_log_in_sch = list(filter(lambda source: source['log_id'] == log_id, sch_values['log_sources'])) - - if subnet_log_group_in_sch and not (subnet_log_in_sch): - self.__obp_regional_checks[sch_values['region']]['VCN']['subnets'].append(log_record) - elif subnet_log_in_sch: - self.__obp_regional_checks[sch_values['region']]['VCN']['subnets'].append(log_record) - - for region_values in self.__obp_regional_checks.values(): - for finding in region_values['VCN']['subnets']: - logged_subnet = list(filter(lambda subnet: subnet['id'] == finding['id'], self.__network_subnets)) - existing_finding = list(filter(lambda subnet: subnet['id'] == finding['id'], self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['OBP'])) - if len(logged_subnet) != 0: - record = logged_subnet[0].copy() - record['sch_id'] = finding['sch_id'] - record['sch_name'] = finding['sch_name'] - if logged_subnet and not (existing_finding): - self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['OBP'].append(record) - - for finding in self.__network_subnets: - logged_subnet = list(filter(lambda subnet: subnet['id'] == finding['id'], self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['OBP'])) - if not (logged_subnet): - self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['Findings'].append(finding) - - if self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['Findings']: - self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['Status'] = False - else: - self.obp_foundations_checks['SIEM_VCN_Flow_Logging']['Status'] = True - - ####################################### - # OBP Subnet and Bucket Log Checks - ####################################### - def __obp_check_bucket_logs(self): - for sch_id, sch_values in self.__service_connectors.items(): - if self.__all_logs and 'objectstorage' in self.__all_logs and \ - sch_values['lifecycle_state'].upper() == "ACTIVE" and sch_values['target_kind']: - - # Bucket Write Logs Checks - # for bucket_name, log_values in self.__write_bucket_logs.items(): - if 'write' in self.__all_logs['objectstorage']: - for bucket_name, log_values in self.__all_logs['objectstorage']['write'].items(): - log_id = log_values['id'] - log_group_id = log_values['log_group_id'] - log_record = {"sch_id": sch_id, "sch_name": sch_values['display_name'], "id": bucket_name} - log_region = log_values['region'] - - bucket_log_group_in_sch = any(source['log_group_id'] == log_group_id and sch_values['region'] == log_region for source in sch_values['log_sources']) - bucket_log_in_sch = any(source['log_id'] == log_id and sch_values['region'] == log_region for source in sch_values['log_sources']) - - # Checking if the Bucket's log group in is in SCH's log sources & the log_id is empty so it covers everything in the log group - if bucket_log_group_in_sch and not (bucket_log_in_sch): - self.__obp_regional_checks[sch_values['region']]['Write_Bucket']['buckets'].append(log_record) - - # Checking if the Bucket's log Group in is in the service connector's log sources if so I will add it - elif bucket_log_in_sch: - self.__obp_regional_checks[sch_values['region']]['Write_Bucket']['buckets'].append(log_record) - - # else: - # self.__obp_regional_checks[sch_values['region']]['Write_Bucket']['findings'].append(bucket_name) - - # Bucket Read Log Checks - if 'read' in self.__all_logs['objectstorage']: - for bucket_name, log_values in self.__all_logs['objectstorage']['read'].items(): - log_id = log_values['id'] - log_group_id = log_values['log_group_id'] - log_record = {"sch_id": sch_id, "sch_name": sch_values['display_name'], "id": bucket_name} - - log_region = log_values['region'] - - bucket_log_group_in_sch = list(filter(lambda source: source['log_group_id'] == log_group_id and sch_values['region'] == log_region, sch_values['log_sources'])) - bucket_log_in_sch = list(filter(lambda source: source['log_id'] == log_id and sch_values['region'] == log_region, sch_values['log_sources'])) - - # Checking if the Bucket's log group in is in SCH's log sources & the log_id is empty so it covers everything in the log group - if bucket_log_group_in_sch and not (bucket_log_in_sch): - self.__obp_regional_checks[sch_values['region']]['Read_Bucket']['buckets'].append(log_record) - - # Checking if the Bucket's log id in is in the service connector's log sources if so I will add it - elif bucket_log_in_sch: - self.__obp_regional_checks[sch_values['region']]['Read_Bucket']['buckets'].append(log_record) - - # Consolidating regional SERVICE LOGGING findings into centralized finding report - for region_values in self.__obp_regional_checks.values(): - for finding in region_values['Write_Bucket']['buckets']: - logged_bucket = list(filter(lambda bucket: bucket['source_resource'] == finding['id'], self.__buckets)) - if len(logged_bucket) != 0: - record = logged_bucket[0].copy() - record['sch_id'] = finding['sch_id'] - record['sch_name'] = finding['sch_name'] - - if logged_bucket: - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['OBP'].append(record) - - for finding in region_values['Read_Bucket']['buckets']: - logged_bucket = list(filter(lambda bucket: bucket['source_resource'] == finding['id'], self.__buckets)) - if len(logged_bucket) != 0: - record = logged_bucket[0].copy() - record['sch_id'] = finding['sch_id'] - record['sch_name'] = finding['sch_name'] - - if logged_bucket: - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['OBP'].append(record) - - # Finding looking at all buckets and seeing if they meet one of the OBPs in one of the regions - for finding in self.__buckets: - read_logged_bucket = list(filter(lambda bucket: bucket['name'] == finding['name'] and bucket['region'] == finding['region'], self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['OBP'])) - if not (read_logged_bucket): - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Findings'].append(finding) - - write_logged_bucket = list(filter(lambda bucket: bucket['name'] == finding['name'] and bucket['region'] == finding['region'], self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['OBP'])) - if not (write_logged_bucket): - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Findings'].append(finding) - # Setting Write Bucket Findings - if self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Findings']: - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Status'] = False - - elif not self.__service_connectors: - # If there are no service connectors then by default all buckets are not logged - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Status'] = False - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Findings'] += self.__buckets - - else: - self.obp_foundations_checks['SIEM_Write_Bucket_Logs']['Status'] = True - - # Setting Read Bucket Findings - if self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Findings']: - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Status'] = False - - elif not self.__service_connectors: - # If there are no service connectors then by default all buckets are not logged - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Status'] = False - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Findings'] += self.__buckets - else: - self.obp_foundations_checks['SIEM_Read_Bucket_Logs']['Status'] = True - - ####################################### - # OBP Subnet and Bucket Log Checks - ####################################### - def __obp_check_log_retention(self): - for log_group in self.__logging_list: - for log in log_group['logs']: - required_keys = ['id', 'display_name', 'deep_link', 'compartment_id', 'is_enabled', - 'lifecycle_state', 'log_group_id', 'log_type', 'retention_duration', - 'time_created', 'time_last_modified', 'defined_tags', 'freeform_tags', 'region'] - record = {key: log[key] for key in required_keys if key in log} - - if log.get('retention_duration') < 90: - self.obp_foundations_checks['Log_Retention']['Findings'].append(record) - else: - self.obp_foundations_checks['Log_Retention']['OBP'].append(record) - - if self.obp_foundations_checks['Log_Retention']['Findings']: - self.obp_foundations_checks['Log_Retention']['Status'] = False - elif self.obp_foundations_checks['Log_Retention']['OBP']: - self.obp_foundations_checks['Log_Retention']['Status'] = True - - ####################################### - # OBP Account Lockout Duration 5 or more - ####################################### - def __obp_check_iam_account_lockout(self): - for domain in self.__identity_domains: - required_keys = ['id', 'display_name', 'url', 'errors'] - record = {key: domain[key] for key in required_keys if key in domain} - pwd_policy = domain.get('password_policy') or {} - record['max_incorrect_attempts'] = pwd_policy.get('max_incorrect_attempts') - record['lockout_duration'] = pwd_policy.get('lockout_duration') - try: - record['automatic_account_unlock_enabled'] = ( - record['lockout_duration'] is not None and int(record['lockout_duration']) > 0 - ) - except Exception: - record['automatic_account_unlock_enabled'] = None - try: - # Missing/invalid max_incorrect_attempts is non-compliant. - # Require lockout to trigger at 5 failed attempts or fewer. - if record['max_incorrect_attempts'] is None or str(record['max_incorrect_attempts']).strip() == "": - max_incorrect_attempts_compliant = False - else: - max_incorrect_attempts_compliant = (int(record['max_incorrect_attempts']) <= 5) - except Exception: - max_incorrect_attempts_compliant = False - # automatic_account_unlock_enabled is captured for visibility only and - # is not used as a compliance gate unless policy requires it. - if max_incorrect_attempts_compliant: - self.obp_foundations_checks['IAM_Account_Lockout']['OBP'].append(record) - else: - self.obp_foundations_checks['IAM_Account_Lockout']['Findings'].append(record) - - if self.obp_foundations_checks['IAM_Account_Lockout']['Findings']: - self.obp_foundations_checks['IAM_Account_Lockout']['Status'] = False - elif self.obp_foundations_checks['IAM_Account_Lockout']['OBP']: - self.obp_foundations_checks['IAM_Account_Lockout']['Status'] = True - - - ####################################### - # OBP Service Limit Check - ####################################### - def __obp_check_close_service_limits(self): - if True: - for limit in self.__service_limits: - # If the limit is greater than 80% we should note it for an OBP - if limit['service_limit_availability'] and limit['service_limit_availability'] >= self.__service_utilization_limit: - self.obp_foundations_checks['Service_Limits']['Findings'].append(limit) - else: - self.obp_foundations_checks['Service_Limits']['OBP'].append(limit) - - if self.obp_foundations_checks['Service_Limits']['Findings']: - self.obp_foundations_checks['Service_Limits']['Status'] = False - elif self.obp_foundations_checks['Service_Limits']['OBP']: - self.obp_foundations_checks['Service_Limits']['Status'] = True - ####################################### - # OBP ADB Checks - ####################################### - def __obp_check_adbs(self): - for adb in self.__autonomous_databases: - if not adb['is_mtls_connection_required']: - self.obp_foundations_checks['ADB_MTLS']['Findings'].append(adb) - else: - self.obp_foundations_checks['ADB_MTLS']['OBP'].append(adb) - if adb['encryption_key'] and adb['encryption_key']['provider'] and not adb['encryption_key']['provider'] == 'ORACLE_MANAGED': - self.obp_foundations_checks['ADB_CMK']['Findings'].append(adb) - else: - self.obp_foundations_checks['ADB_CMK']['OBP'].append(adb) - - if not adb['private_endpoint_ip']: - self.obp_foundations_checks['ADB_Private_IP']['Findings'].append(adb) - else: - self.obp_foundations_checks['ADB_Private_IP']['OBP'].append(adb) - - if not adb['data_safe_status'] == "REGISTERED": - self.obp_foundations_checks['ADB_DataSafe']['Findings'].append(adb) - else: - self.obp_foundations_checks['ADB_DataSafe']['OBP'].append(adb) - - if not adb['customer_contacts']: - self.obp_foundations_checks['ADB_Contacts']['Findings'].append(adb) - else: - self.obp_foundations_checks['ADB_Contacts']['OBP'].append(adb) - - for key in self.obp_foundations_checks.keys(): - if key.startswith("ADB_"): - if self.obp_foundations_checks[key]['Findings']: - self.obp_foundations_checks[key]['Status'] = False - else: - self.obp_foundations_checks[key]['Status'] = True - - ########################################################################## - # OBP Check Aggregated Policy statements in all Compartment Chains - ########################################################################## - def __obp_check_policy_statements_in_comp_chains(self): - policy_stmt_limit = 500.0 #Should be returned by the Service Limit API - parent_ids = {v.get("compartment_id") for v in self.__raw_compartment.values() if v.get("compartment_id") } - leaf_nodes = [cid for cid in self.__raw_compartment.keys() if cid not in parent_ids] - - for leaf in leaf_nodes: - path = [] - cid = leaf - total = 0 - while cid is not None: - path.append(cid) - if cid == self.__tenancy.id: - break - cid = self.__raw_compartment[cid]['compartment_id'] - parts = [f"{self.__raw_compartment[x]['name']}({self.__raw_compartment[x]['statements_in_compartment']})" for x in reversed(path)] - total = sum(self.__raw_compartment[x]['statements_in_compartment'] for x in path) - - record = { - "total":total, - "compartment_hierarchy": ' --> '.join(parts) - } - - #Check compartment hierarchy total statements against the statement threshold. - policy_stmt_utilization_per_hierarchy = round((total*100.0)/policy_stmt_limit) - if policy_stmt_utilization_per_hierarchy >= self.__service_utilization_limit or total >= policy_stmt_limit: - self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['Findings'].append(record) - else: - self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['OBP'].append(record) - - if self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['Findings']: - self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['Status'] = False - elif self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['OBP']: - self.obp_foundations_checks['IAM_Stmt_Comp_Hierarchy_Count']['Status'] = True - - self.__compartment_hierarchy_info.append(record) - - #Check root compartment total statements against the statement threshold. - policy_stmt_utilization_at_root = round((self.__raw_compartment[self.__tenancy.id]["statements_in_compartment"]*100.0)/policy_stmt_limit) - record = {"Statements_at_root":self.__raw_compartment[self.__tenancy.id]["statements_in_compartment"]} - if policy_stmt_utilization_at_root >= self.__service_utilization_limit or self.__raw_compartment[self.__tenancy.id]["statements_in_compartment"] >= policy_stmt_limit: - self.obp_foundations_checks['IAM_Stmt_Root_Count']['Findings'].append(record) - else: - self.obp_foundations_checks['IAM_Stmt_Root_Count']['OBP'].append(record) - - if self.obp_foundations_checks['IAM_Stmt_Root_Count']['Findings']: - self.obp_foundations_checks['IAM_Stmt_Root_Count']['Status'] = False - elif self.obp_foundations_checks['IAM_Stmt_Root_Count']['OBP']: - self.obp_foundations_checks['IAM_Stmt_Root_Count']['Status'] = True - - - - - ########################################################################## - # Analyzes Tenancy Data for Oracle Best Practices Report - ########################################################################## - def __obp_analyze_tenancy_data(self): - self.__obp_init_regional_checks() - self.__obp_check_budget() - self.__obp_check_audit_log_compartments() - self.__obp_check_cloud_guard() - self.__obp_check_networking() - self.__obp_check_certificates() - self.__obp_check_bucket_logs() - self.__obp_check_subnet_logs() - self.__obp_check_log_retention() - self.__obp_check_close_service_limits() - self.__obp_check_adbs() - self.__obp_check_quotas() - self.__obp_check_policy_statements_in_comp_chains() - self.__obp_check_iam_account_lockout() - - ########################################################################## - # Orchestrates data collection and CIS report generation - ########################################################################## - def __report_generate_cis_report(self, level): - # This function reports generates CSV reportsffo - - # Creating summary report - summary_report = [] - for key, recommendation in self.cis_foundations_benchmark_3_0.items(): - if recommendation['Level'] <= level: - report_filename = f'{self.__report_prefix}cis {recommendation["section"]}_{recommendation["recommendation_#"]}' - report_filename = report_filename.replace(" ", "_").replace(".", "-").replace("_-_", "_") + ".csv" - if recommendation['Status']: - compliant_output = "Yes" - compliance_percentage = "100%" - elif recommendation['Status'] is None: - compliant_output = "Not Applicable" - compliance_percentage = "N/A" - else: - compliant_output = "No" - compliance_percentage = ( - str(int(( - (len(recommendation.get('Total') or []) - len(recommendation.get('Findings') or [])) - / len(recommendation.get('Total') or []) * 100 - )) if len(recommendation.get('Total') or []) > 0 else 0) + "%") - record = { - "Recommendation #": f"{key}", - "Section": recommendation['section'], - "Level": str(recommendation['Level']), - "Compliant": compliant_output if compliant_output != "Not Applicable" else "N/A", - "Findings": (str(len(recommendation['Findings'])) if len(recommendation['Findings']) > 0 else " "), - "Compliant Items": str(len(recommendation['Total']) - len(recommendation['Findings'])), - "Total": (str(len(recommendation['Total'])) if len(recommendation['Total']) > 0 else " "), - "Compliance Percentage Per Recommendation": compliance_percentage, - "Title": recommendation['Title'], - self.__primary_framework_name : recommendation[self.__primary_framework_name], - self.__other_framework_name : recommendation[self.__other_framework_name], - "Filename": report_filename if len(recommendation['Findings']) > 0 else " ", - "Remediation": self.cis_report_data[key]['Remediation'] - } - # Add record to summary report for CSV output - summary_report.append(record) - - # Generate Findings report - # self.__print_to_csv_file("cis", recommendation['section'] + "_" + recommendation['recommendation_#'], recommendation['Findings']) - - # Screen output for CIS Summary Report - print_header("CIS Foundations Benchmark 3.0.0 Summary Report") - print('Num' + "\t" + "Level " + - "\t" "Compliant" + "\t" + "Findings " + "\t" + "Total " + "\t\t" + 'Title') - print('#' * 90) - for finding in summary_report: - # If print_to_screen is False it will only print non-compliant findings - if not (self.__print_to_screen) and finding['Compliant'] == 'No': - print(finding['Recommendation #'] + "\t" + - finding['Level'] + "\t" + finding['Compliant'] + "\t\t" + finding['Findings'] + "\t\t" + - finding['Total'] + "\t\t" + finding['Title']) - elif self.__print_to_screen: - print(finding['Recommendation #'] + "\t" + - finding['Level'] + "\t" + finding['Compliant'] + "\t\t" + finding['Findings'] + "\t\t" + - finding['Total'] + "\t\t" + finding['Title']) - - # Generating Summary report CSV - print_header("Writing CIS reports to CSV") - summary_files = [] - summary_file_name = self.__print_to_csv_file("cis", "summary_report", summary_report) - summary_files.append(summary_file_name) - - if self.__report_summary_json: - summary_file_name = self.__print_to_json_file("cis", "summary_report", summary_report) - summary_files.append(summary_file_name) - - summary_file_name = self.__report_generate_html_summary_report("cis", "summary_report", summary_report) - summary_files.append(summary_file_name) - - if OUTPUT_DIAGRAMS: - diagram_file_name = self.__generate_compliance_diagram("cis", "summary_compliance", summary_report) - summary_files.append(diagram_file_name) - diagram_file_name = self.__generate_compliance_by_area_diagram("cis", "summary_compliance_by_focus_area", summary_report) - summary_files.append(diagram_file_name) - - # Outputing to a bucket if I have one - if summary_files and self.__output_bucket: - for summary_file in summary_files: - self.__os_copy_report_to_object_storage( - self.__output_bucket, summary_file) - - for key, recommendation in self.cis_foundations_benchmark_3_0.items(): - if recommendation['Level'] <= level: - report_file_name = self.__print_to_csv_file("cis", f"{recommendation['section']}_{recommendation['recommendation_#']}", recommendation['Findings']) - if report_file_name and self.__output_bucket: - self.__os_copy_report_to_object_storage( - self.__output_bucket, report_file_name) - - ########################################################################## - # Generate summary diagrams - ########################################################################## - diagram_colors = ['#4C825C', '#C74634'] - diagram_values = ['Compliant', 'Non-compliant'] - diagram_colors_na = ['#4C825C', '#C74634', '#E0DEDE'] - diagram_values_na = ['Compliant', 'Non-compliant', 'Not applicable'] - diagram_sections = ( - 'Identity and Access Management', - 'Networking', - 'Compute', - 'Logging and Monitoring', - 'Storage', - 'Asset Management' - ) - diagram_fontweight = 'bold' - diagram_fontcolor_reverse = 'white' - - ########################################################################## - # __cis_compliance - ########################################################################## - def __cis_compliance(self, filename, title, values=None, has_na_values=False): - plt.close('all') - plt.figure(figsize=(6, 5)) - labels = self.diagram_values - colors = self.diagram_colors - if has_na_values: - labels = self.diagram_values_na - colors = self.diagram_colors_na - wegdes, labels, pcttexts = plt.pie(values, labels=labels, colors=colors, autopct='%.0f%%', wedgeprops={'linewidth': 3.0, 'edgecolor': 'white'}, startangle=90, counterclock=False, radius=1.1) - for t in labels: - t.set_fontweight(self.diagram_fontweight) - for p in pcttexts: - p.set_fontweight(self.diagram_fontweight) - p.set_color(self.diagram_fontcolor_reverse) - plt.title(title, fontweight=self.diagram_fontweight, pad=30.0) - plt.savefig(filename, transparent=True) - - ########################################################################## - # __cis_compliance_by_area - ########################################################################## - def __cis_compliance_by_area(self, filename, title, section_values=None): - plt.close('all') - height = 0.4 - fig, ax = plt.subplots(figsize=(10, 5), layout='compressed') - y = np.arange(len(self.diagram_sections)) - p = ax.barh(y - height/2, section_values[self.diagram_values[0]], height, color=self.diagram_colors[0]) - ax.bar_label(p, padding=-16, color=self.diagram_fontcolor_reverse, fontweight=self.diagram_fontweight) - p = ax.barh(y + (height/2), section_values[self.diagram_values[1]], height, color=self.diagram_colors[1]) - ax.bar_label(p, padding=-16, color=self.diagram_fontcolor_reverse, fontweight=self.diagram_fontweight) - ax.set_frame_on(False) - ax.set_title(title, fontweight=self.diagram_fontweight, loc='left') - ax.set_yticks(y) - ax.set_yticklabels(self.diagram_sections, fontweight=self.diagram_fontweight) - ax.invert_yaxis() - plt.tick_params(left=False, right=False, labelbottom=False, bottom=False) - plt.savefig(filename, transparent=True) - - ########################################################################## - # __generate_compliance_diagram - ########################################################################## - def __generate_compliance_diagram(self, header, file_subject, data): - compliant = 0 - non_compliant = 0 - not_applicable = 0 - for finding in data: - if finding['Compliant'] == 'Yes': - compliant += 1 - elif finding['Compliant'] == 'N/A': - not_applicable += 1 - else: - non_compliant += 1 - cis_compliance_file = self.__get_output_file_path(header, file_subject, '.png') - self.__cis_compliance(cis_compliance_file, 'CIS Recommendation Compliance', [compliant, non_compliant, not_applicable] if not_applicable > 0 else [compliant, non_compliant], has_na_values=True if not_applicable > 0 else False) - return cis_compliance_file - - ########################################################################## - # __generate_compliance_by_area_diagram - ########################################################################## - def __generate_compliance_by_area_diagram(self, header, file_subject, data): - compliants = [] - non_compliants = [] - for section in self.diagram_sections: - compliant = 0 - non_compliant = 0 - not_applicable = 0 - for finding in data: - if section in finding['Section']: - if finding['Compliant'] == 'Yes': - compliant += 1 - elif finding['Compliant'] == 'N/A': - not_applicable += 1 - else: - non_compliant += 1 - compliants.append(compliant) - non_compliants.append(non_compliant) - - cis_compliance_by_area_file = self.__get_output_file_path(header, file_subject, '.png') - self.__cis_compliance_by_area(cis_compliance_by_area_file, 'CIS Recommendation Compliance per Focus Area', { - self.diagram_values[0]: compliants, - self.diagram_values[1]: non_compliants, - }) - return cis_compliance_by_area_file - - ########################################################################## - # Generates an HTML report - ########################################################################## - def __report_generate_html_summary_report(self, header, file_subject, data): - - try: - # if no data - if len(data) == 0: - return None - - # get the file name of the HTML - file_path = self.__get_output_file_path(header, file_subject, '.html') - - # add report_datetimeto each dictionary - result = [dict(item, extract_date=self.start_time_str) - for item in data] - - # If this flag is set all OCIDs are Hashed to redact them - if self.__redact_output: - redacted_result = [] - for item in result: - record = {} - for key in item.keys(): - str_item = str(item[key]) - items_to_redact = re.findall(self.__oci_ocid_pattern, str_item) - emails_to_redact = re.findall(self.__simple_email, str_item) - items_to_redact += emails_to_redact - for redact_me in items_to_redact: - str_item = str_item.replace(redact_me, hashlib.sha256(str.encode(redact_me)).hexdigest()) - - record[key] = str_item - - redacted_result.append(record) - # Overriding result with redacted result - result = redacted_result - - # generate fields - fields = ['Recommendation #', 'Compliant', 'Section', 'Details'] - - html_title = 'CIS OCI Foundations Benchmark 3.0.0 - Compliance Report' - with open(file_path, mode='w') as html_file: - # Creating table header - html_file.write('') - html_file.write(f'{html_title}') - html_file.write(""" - - - - - - - - - - - - - - - - - - -
- -
-
""") - html_file.write(f'

{html_title.replace("-", "–")}

') - html_file.write(""" -
-
-
- """) - html_file.write(f'

Tenancy Name: {self.__tenancy.name}

') - # Get the extract date - r = result[0] - extract_date = r['extract_date'].replace('T', ' ') - html_file.write(f'
Extract Date: {extract_date} UTC
') - html_file.write('
') - if OUTPUT_DIAGRAMS: - # Include dashboard - html_file.write(f'
') - html_file.write(f'
 
') - # Navigation - html_file.write('
') - html_file.write('
') - html_file.write('
') - # Line - html_file.write('
') - html_file.write('

Compliant Recommendations

') - html_file.write('
') - html_file.write('
') - html_file.write('
') - html_file.write('
') - html_file.write('') - for th in fields: - column_width = '63%' - if th == 'extract_date': - th = th.replace('_', ' ').title() - continue - elif th == 'Recommendation #': - column_width = '15%' - elif th == 'Compliant': - column_width = '10%' - elif th == 'Section': - column_width = '12%' - else: - column_width = '63%' - html_file.write(f'') - html_file.write('') - # Creating the compliant HTML Table of the summary report - html_appendix = [] - for row in result: - compliant = row['Compliant'] - text_color = 'green' - if compliant != 'Yes': - continue - # Print the row - html_file.write("") - v = row['Recommendation #'] - if compliant == 'No': - html_file.write(f'\n') - else: - html_file.write(f'\n') - total = row['Total'] - tmp = '' - if total != ' ': - tmp = f'

{str(total)} item' - if int(total) > 1: - tmp += 's' - html_file.write(f'\n') - html_file.write(f'\n') - # Details - html_file.write('') - html_file.write("") - - html_file.write("
{th}
{v}{v}{str(compliant)}{tmp}{str(row["Section"])}') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - primary_framework = str(row[self.__primary_framework_name]).replace("[", "").replace("]", "").replace("'", "") - other_framework = str(row[self.__other_framework_name]).replace("[", "").replace("]", "").replace("'", "") - html_file.write(f'') - html_file.write(f'') - v = str(row['Filename']) - if v == ' ': - html_file.write('') - else: - html_file.write(f'') - html_file.write('
Title{str(row["Title"])}
Remediation{str(row["Remediation"])}
Level{self.__primary_framework_name}{self.__other_framework_name}File
{str(row["Level"])}{primary_framework}{other_framework} {v}
\n") - # Line - html_file.write('
') - html_file.write('

Non-compliant Recommendations

') - html_file.write('
') - html_file.write('
') - html_file.write('
') - html_file.write('
') - html_file.write('') - for th in fields: - column_width = '63%' - if th == 'extract_date': - th = th.replace('_', ' ').title() - continue - elif th == 'Recommendation #': - column_width = '15%' - elif th == 'Compliant': - column_width = '10%' - elif th == 'Section': - column_width = '12%' - else: - column_width = '63%' - html_file.write(f'') - html_file.write('') - # Creating the non-compliant HTML Table of the summary report - html_appendix = [] - for row in result: - compliant = row['Compliant'] - if compliant != 'No': - continue - html_appendix.append(row['Recommendation #']) - text_color = 'red' - # Print the row - html_file.write("") - v = row['Recommendation #'] - if compliant == 'No': - html_file.write(f'\n') - else: - html_file.write(f'\n') - f = row['Findings'] - t = row['Total'] - tmp = '' - if t != ' ': - if f == ' ': - f = t - tmp = f'

{str(f)} of {str(t)} item' - if int(t) > 1: - tmp += 's' - html_file.write(f'\n') - html_file.write(f'\n') - # Details - html_file.write('') - html_file.write("") - - html_file.write("
{th}
{v}{v}{str(compliant)}{tmp}{str(row["Section"])}') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - html_file.write(f'') - html_file.write('') - html_file.write(f'') - primary_framework = str(row[self.__primary_framework_name]).replace("[", "").replace("]", "").replace("'", "") - other_framework = str(row[self.__other_framework_name]).replace("[", "").replace("]", "").replace("'", "") - html_file.write(f'') - html_file.write(f'') - v = str(row['Filename']) - if v == ' ': - html_file.write('') - else: - html_file.write(f'') - html_file.write('
Title{str(row["Title"])}
Remediation{str(row["Remediation"])}
Level{self.__primary_framework_name}{self.__other_framework_name}File
{str(row["Level"])}{primary_framework}{other_framework} {v}
\n") - html_file.write('
') - html_file.write('

Details for non-compliant Recommendations

') - html_file.write('
') - # Creating appendix for the report - for finding in html_appendix: - fing = self.cis_foundations_benchmark_3_0[finding] - html_file.write(f'

{finding} – {fing["Title"]}

\n') - for item_key, item_value in self.cis_report_data[finding].items(): - if item_value != "": - html_file.write(f"
{item_key.title()}
") - if item_key == 'Observation': - if fing['Status'] is None: - pfx = 'Manually check for' - else: - num_findings = len(fing['Findings']) - num_total = len(fing['Total']) - if num_findings > 0 or num_total > 0: - pfx = f'{str(num_findings)} of {str(num_total)}' - else: - pfx = 'No' - html_file.write(f"

{pfx} {item_value}

\n") - else: - v = item_value.replace('
', '
')
-                                html_file.write(f"
{v}
\n")
-                html_file.write("
\n") - # Closing HTML - report_year = str(self.start_datetime.strftime('%Y')) - html_file.write("""
\n') - - print(f"HTML: {file_subject.ljust(22)} --> {file_path}") - # Used by Upload - - return file_path - - except Exception as e: - raise Exception("Error in report_generate_html_report: " + str(e.args)) - - ########################################################################## - # Orchestrates analysis and report generation - ########################################################################## - def __report_generate_obp_report(self): - - obp_summary_report = [] - # Screen output for CIS Summary Report - print_header("OCI Best Practices Findings") - print('Category' + "\t\t\t\t" + "Compliant" + "\t" + "Findings " + "\tBest Practices") - print('#' * 90) - # Adding data to summary report - for key, recommendation in self.obp_foundations_checks.items(): - padding = str(key).ljust(25, " ") - compliant = ("Yes" if recommendation['Status'] is True else "No" if recommendation['Status'] is False else "N/A") - print(padding + "\t\t" + compliant + "\t" + "\t" + str(len(recommendation['Findings'])) + "\t" + "\t" + str(len(recommendation['OBP']))) - record = { - "Recommendation": str(key), - "ID" : recommendation['id'], - "Section": recommendation['section'], - "Compliant": compliant, - "OBP": (str(len(recommendation['OBP'])) if len(recommendation['OBP']) > 0 else " "), - "Findings": (str(len(recommendation['Findings'])) if len(recommendation['Findings']) > 0 else " "), - "Title": recommendation['Title'], - "Documentation": recommendation['Documentation'] - } - obp_summary_report.append(record) - - print_header("Writing Oracle Best Practices reports to CSV") - - summary_report_file_name = self.__print_to_csv_file("obp", "OBP_Summary", obp_summary_report) - - if summary_report_file_name and self.__output_bucket: - self.__os_copy_report_to_object_storage( - self.__output_bucket, summary_report_file_name) - - # Printing Findings to CSV - for key, value in self.obp_foundations_checks.items(): - report_file_name = self.__print_to_csv_file("obp", key + "_Findings", value['Findings']) - - # Printing OBPs to CSV - for key, value in self.obp_foundations_checks.items(): - report_file_name = self.__print_to_csv_file("obp", key + "_Best_Practices", value['OBP']) - - if report_file_name and self.__output_bucket: - self.__os_copy_report_to_object_storage( - self.__output_bucket, report_file_name) - - ########################################################################## - # Coordinates calls of all the read function required for analyzing tenancy - ########################################################################## - def __collect_tenancy_data(self): - - # Runs identity functions only in home region - - thread_compartments = Thread(target=self.__identity_read_compartments) - thread_compartments.start() - - thread_cloud_guard_config = Thread(target=self.__cloud_guard_read_cloud_guard_configuration) - thread_cloud_guard_config.start() - - thread_compartments.join() - thread_cloud_guard_config.join() - - thread_identity_domains = Thread(target=self.__identity_read_domains) - thread_identity_domains.start() - thread_identity_domains.join() - - thread_identity_groups = Thread(target=self.__identity_read_groups) - thread_identity_groups.start() - thread_identity_groups.join() - - print("\nProcessing Home Region resources...") - - cis_home_region_functions = [ - self.__identity_read_users, - self.__identity_read_tenancy_password_policy, - self.__identity_read_dynamic_groups, - self.__identity_read_availability_domains, - self.__identity_read_tag_defaults, - self.__identity_read_tenancy_policies, - self.__read_cloud_guard_problems - ] - - # Budgets is global construct - if self.__obp_checks: - obp_home_region_functions = [ - self.__budget_read_budgets, - self.__cloud_guard_read_cloud_guard_targets, - self.__quota_read, - ] - else: - obp_home_region_functions = [] - - # Threads for Home region checks - home_threads = [] - for home_func in cis_home_region_functions + obp_home_region_functions: - t = Thread(target=home_func) - t.start() - home_threads.append(t) - - # Waiting for home threads to complete - for t in home_threads: - t.join() - - # The above checks are run in the home region - if self.__home_region not in self.__regions_to_run_in and not (self.__run_in_all_regions): - self.__regions.pop(self.__home_region) - - print("\nProcessing regional resources...") - # Stores running threads - - # List of functions for CIS - cis_regional_functions = [ - self.__search_resources_in_root_compartment, - self.__kms_read_keys, - self.__os_read_buckets, - self.__logging_read_log_groups_and_logs, - self.__events_read_event_rules, - self.__ons_read_subscriptions, - self.__network_read_network_security_lists, - self.__network_read_network_security_groups_rules, - self.__network_read_network_vcns, - self.__network_read_network_subnets, - self.__network_read_network_capturefilters, - self.__adb_read_adbs, - self.__oic_read_oics, - self.__oac_read_oacs, - self.__block_volume_read_block_volumes, - self.__boot_volume_read_boot_volumes, - self.__fss_read_fsss, - self.__core_instance_read_compute, - ] - - # Oracle Best practice functions - if self.__obp_checks: - obp_functions = [ - self.__network_read_fastonnects, - self.__network_read_ip_sec_connections, - self.__network_read_drgs, - self.__network_read_drg_attachments, - self.__sch_read_service_connectors, - self.__certificates_read_certificates - ] - else: - obp_functions = [] - - # All OCI Resources via Search Service - - if self.__all_resources: - all_resources = [ - self.__search_resources_all_resources_in_tenancy, - self.__service_limits_utilization - ] - else: - all_resources = [] - - def execute_function(func): - func() - - with concurrent.futures.ThreadPoolExecutor(max_workers=6) as executor: - # Submit each function to the executor - futures = [] - for func in cis_regional_functions + obp_functions + all_resources: - futures.append(executor.submit(execute_function, func)) - - # Wait for all functions to complete - for future in concurrent.futures.as_completed(futures): - future.result() - - if obp_functions: - self.__unify_network_data() - - ########################################################################## - # Generate Raw Data Output - ########################################################################## - def __report_generate_raw_data_output(self): - - # List to store output reports if copying to object storage is required - list_report_file_names = [] - raw_csv_files = { - "identity_groups_and_membership": list(self.__groups.values()) if self.__identity_domains_enabled else self.__groups_to_users, - "identity_domains": self.__identity_domains, - "identity_users": self.__users, - "identity_policies": self.__policies, - "identity_dynamic_groups": self.__dynamic_groups, - "identity_tags": self.__tag_defaults, - "identity_compartments": list(self.__raw_compartment.values()), - "network_security_groups": self.__network_security_groups, - "network_security_lists": self.__network_security_lists, - "network_subnets": self.__network_subnets, - "network_vcns": list(self.__network_vcns.values()), - "network_capture_filters": list(self.__network_capturefilters.values()), - "autonomous_databases": self.__autonomous_databases, - "analytics_instances": self.__analytics_instances, - "integration_instances": self.__integration_instances, - "event_rules": self.__event_rules, - "log_groups_and_logs": self.__logging_list, - "object_storage_buckets": self.__buckets, - "boot_volumes": self.__boot_volumes, - "block_volumes": self.__block_volumes, - "file_storage_system": self.__file_storage_system, - "kms_keys": self.__kms_keys, - "kms_vaults": list(self.__vaults.values()), - "ons_subscriptions": self.__subscriptions, - "budgets": self.__budgets, - "quotas" : self.__quotas, - "service_connectors": list(self.__service_connectors.values()), - "network_fastconnects": list(itertools.chain.from_iterable(self.__network_fastconnects.values())), - "network_ipsec_connections": list(itertools.chain.from_iterable(self.__network_ipsec_connections.values())), - "network_drgs": self.__raw_network_drgs, - "cloud_guard_target": list(self.__cloud_guard_targets.values()), - "cloud_guard_problems" : self.__cloud_guard_problems, - "regions": self.__raw_regions, - "network_drg_attachments": list(itertools.chain.from_iterable(self.__network_drg_attachments.values())), - "instances": self.__Instance, - "certificates" : self.__raw_oci_certificates, - "service_limits" : self.__service_limits, - "compartment_hierarchy_policy_count" : self.__compartment_hierarchy_info - } - for key in raw_csv_files: - rfn = self.__print_to_csv_file('raw_data', key, raw_csv_files[key]) - list_report_file_names.append(rfn) - - raw_json_files = { - "all_resources": self.__all_resources_json, - } - for key in raw_json_files: - rfn = self.__print_to_json_file('raw_data', key, raw_json_files[key]) - list_report_file_names.append(rfn) - - if self.__output_bucket: - for raw_report in list_report_file_names: - if raw_report: - self.__os_copy_report_to_object_storage(self.__output_bucket, raw_report) - - ########################################################################## - # Copy Report to Object Storage - ########################################################################## - def __os_copy_report_to_object_storage(self, bucketname, filename): - object_name = filename - debug(f"__os_copy_report_to_object_storage: Writing to {filename} to namespace: {self.__os_namespace} bucket: {bucketname}") - try: - with open(filename, "rb") as f: - try: - self.__output_bucket_client.put_object( - self.__os_namespace, bucketname, object_name, f) - except Exception: - print("Failed to write " + object_name + " to bucket " + bucketname + ". Please check your bucket and IAM permissions.") - - except Exception as e: - raise Exception( - "Error opening file os_copy_report_to_object_storage: " + str(e.args)) - - ########################################################################## - # Get output file path with suffix - ########################################################################## - def __get_output_file_path(self, header, file_subject, suffix): - try: - # Creating report directory - if not os.path.isdir(self.__report_directory): - os.mkdir(self.__report_directory) - - except Exception as e: - raise Exception(f'Error in creating report directory: {str(e.args)}') - - file_name = f'{header}_{file_subject}' - file_name = f'{file_name.replace(" ", "_").replace(".", "-").replace("_-_", "_")}{suffix}' - return os.path.join(self.__report_directory, f'{self.__report_prefix}{file_name}') - - ########################################################################## - # Print to CSV - ########################################################################## - def __print_to_csv_file(self, header, file_subject, data): - debug("__print_to_csv_file: " + header + "_" + file_subject) - - try: - # if no data - if len(data) == 0: - return None - - # get the file name of the CSV - file_path = self.__get_output_file_path(header, file_subject, '.csv') - - # add report_datetimeto each dictionary - result = [dict(item, extract_date=self.start_time_str) - for item in data] - - # If this flag is set all OCIDs are Hashed to redact them - if self.__redact_output: - redacted_result = [] - for item in result: - record = {} - for key in item.keys(): - str_item = str(item[key]) - items_to_redact = re.findall(self.__oci_ocid_pattern, str_item) - emails_to_redact = re.findall(self.__simple_email, str_item) - items_to_redact += emails_to_redact - for redact_me in items_to_redact: - str_item = str_item.replace(redact_me, hashlib.sha256(str.encode(redact_me)).hexdigest()) - - record[key] = str_item - - redacted_result.append(record) - # Overriding result with redacted result - result = redacted_result - - # generate fields - fields = [key for key in result[0].keys()] - - with open(file_path, mode='w', newline='') as csv_file: - writer = csv.DictWriter(csv_file, fieldnames=fields) - - # write header - writer.writeheader() - - for row in result: - if 'rules' in row: - row['rules'] = str(row['rules']).replace('\n', '') - writer.writerow(row) - # print(row) - - print("CSV: " + file_subject.ljust(22) + " --> " + file_path) - # Used by Upload - - return file_path - - except Exception as e: - raise Exception("Error in print_to_csv_file: " + str(e.args)) - - ########################################################################## - # Print to JSON - ########################################################################## - def __print_to_json_file(self, header, file_subject, data): - - try: - # if no data - if len(data) == 0: - return None - - # get the file name of the JSON - file_path = self.__get_output_file_path(header, file_subject, '.json') - - # Serializing JSON to string - json_object = json.dumps(data, indent=4) - - # If this flag is set all OCIDs are Hashed to redact them - if self.__redact_output: - items_to_redact = re.findall(self.__oci_ocid_pattern,json_object) - emails_to_redact = re.findall(self.__simple_email, json_object) - items_to_redact += emails_to_redact - for redact_me in items_to_redact: - json_object = json_object.replace(redact_me,hashlib.sha256(str.encode(redact_me)).hexdigest() ) - - - # Writing to json file - with open(file_path, mode='w', newline='') as json_file: - json_file.write(json_object) - - print("JSON: " + file_subject.ljust(22) + " --> " + file_path) - - # Used by Upload - return file_path - - except Exception as e: - raise Exception("Error in print_to_json_file: " + str(e.args)) - - - ########################################################################## - # Orchestrates Data collection and reports - ########################################################################## - def generate_reports(self, level=2): - - # Collecting all the tenancy data - self.__collect_tenancy_data() - - # Analyzing Data for CIS reports - self.__report_cis_analyze_tenancy_data() - - # Generate CIS reports - self.__report_generate_cis_report(level) - - if self.__obp_checks: - # Analyzing Data for OBP reports - self.__obp_analyze_tenancy_data() - self.__report_generate_obp_report() - - if self.__output_raw_data: - self.__report_generate_raw_data_output() - - error_report_file_name = self.__print_to_csv_file("error", "report", self.__errors) - - if error_report_file_name and self.__output_bucket: - self.__os_copy_report_to_object_storage( - self.__output_bucket, error_report_file_name) - - end_datetime = datetime.datetime.now().replace(tzinfo=pytz.UTC) - end_time_str = str(end_datetime.strftime("%Y-%m-%dT%H:%M:%S")) - - print_header("Finished at " + end_time_str + ", duration: " + str(end_datetime - self.start_datetime)) - - return self.__report_directory - - def get_obp_checks(self): - self.__obp_checks = True - self.generate_reports() - return self.obp_foundations_checks - - ########################################################################## - # Create CSV Hyperlink - ########################################################################## - def __generate_csv_hyperlink(self, url, name): - if len(url) < 2079: # Excel limit - return f'=HYPERLINK("{url}","{name}")' - else: - return url - - -########################################################################## -# check service error to warn instead of error -########################################################################## -def check_service_error(code): - return ('max retries exceeded' in str(code).lower() or - 'auth' in str(code).lower() or - 'notfound' in str(code).lower() or - code == 'Forbidden' or - code == 'TooManyRequests' or - code == 'IncorrectState' or - code == 'LimitExceeded') - - -########################################################################## -# Create signer for Authentication -# Input - config_profile and is_instance_principals and is_delegation_token -# Output - config and signer objects -########################################################################## -def create_signer(file_location, config_profile, is_instance_principals, is_delegation_token, is_security_token): - - # if instance principals authentications - if is_instance_principals: - try: - signer = oci.auth.signers.InstancePrincipalsSecurityTokenSigner() - config = {'region': signer.region, 'tenancy': signer.tenancy_id} - return config, signer - - except Exception: - print("Error obtaining instance principals certificate, aborting") - raise SystemExit - - # ----------------------------- - # Delegation Token - # ----------------------------- - elif is_delegation_token: - - try: - # check if env variables OCI_CONFIG_FILE, OCI_CONFIG_PROFILE exist and use them - env_config_file = os.environ.get('OCI_CONFIG_FILE') - env_config_section = os.environ.get('OCI_CONFIG_PROFILE') - - # check if file exist - if env_config_file is None or env_config_section is None: - print("*** OCI_CONFIG_FILE and OCI_CONFIG_PROFILE env variables not found, abort. ***") - print("") - raise SystemExit - - config = oci.config.from_file(env_config_file, env_config_section) - delegation_token_location = config["delegation_token_file"] - - with open(delegation_token_location, 'r') as delegation_token_file: - delegation_token = delegation_token_file.read().strip() - # get signer from delegation token - signer = oci.auth.signers.InstancePrincipalsDelegationTokenSigner( - delegation_token=delegation_token) - - return config, signer - - except KeyError: - print("* Key Error obtaining delegation_token_file") - raise SystemExit - - except Exception: - raise - # --------------------------------------------------------------------------- - # Security Token - Credit to Dave Knot (https://github.com/dns-prefetch) - # --------------------------------------------------------------------------- - elif is_security_token: - - try: - # Read the token file from the security_token_file parameter of the .config file - config = oci.config.from_file( - oci.config.DEFAULT_LOCATION, - (config_profile if config_profile else oci.config.DEFAULT_PROFILE) - ) - - token_file = config['security_token_file'] - token = None - with open(token_file, 'r') as f: - token = f.read() - - # Read the private key specified by the .config file. - private_key = oci.signer.load_private_key_from_file(config['key_file']) - - signer = oci.auth.signers.SecurityTokenSigner(token, private_key) - - return config, signer - - except KeyError: - print("* Key Error obtaining security_token_file") - raise SystemExit - - except Exception: - raise - - # ----------------------------- - # config file authentication - # ----------------------------- - else: - - try: - config = oci.config.from_file( - file_location if file_location else oci.config.DEFAULT_LOCATION, - (config_profile if config_profile else oci.config.DEFAULT_PROFILE) - ) - signer = oci.signer.Signer( - tenancy=config["tenancy"], - user=config["user"], - fingerprint=config["fingerprint"], - private_key_file_location=config.get("key_file"), - pass_phrase=oci.config.get_config_value_or_default( - config, "pass_phrase"), - private_key_content=config.get("key_content") - ) - return config, signer - except Exception: - print( - f'** OCI Config was not found here : {oci.config.DEFAULT_LOCATION} or env varibles missing, aborting **') - raise SystemExit - - -########################################################################## -# Arg Parsing function to be updated -########################################################################## -def set_parser_arguments(): - - parser = argparse.ArgumentParser() - parser.add_argument( - '-i', - type=argparse.FileType('r'), - dest='input', - help="Input JSON File" - ) - parser.add_argument( - '-o', - type=argparse.FileType('w'), - dest='output_csv', - help="CSV Output prefix") - result = parser.parse_args() - - if len(sys.argv) < 3: - parser.print_help() - return None - - return result - - -########################################################################## -# execute_report -########################################################################## -def _build_worksheet_name(csv_path, report_prefix, seen_names): - """Return a workbook-safe worksheet name or None if the sheet should be skipped.""" - base_name = os.path.basename(csv_path) - if report_prefix: - base_name = base_name.replace(report_prefix, "") - - name = (base_name - .replace(".csv", "") - .replace("raw_data_", "raw_") - .replace("Findings", "fds") - .replace("Best_Practices", "OBP")) - - if "raw_cloud_guard_target" in name: - return None - - replacement_rules = ( - ("Identity_and_Access_Management", "IAM"), - ("Storage_Object_Storage", "Object_Storage"), - ("raw_identity_groups_and_membership", "raw_iam_groups_and_membership"), - ("Cost_Tracking_Budgets_Best_Practices", "Budgets_Best_Practices"), - ("Cost_Tracking", "Cost"), - ("Storage_File_Storage_Service", "FSS"), - ("Networking_IPSec_connections", "Networking_IPSec"), - ("IAM_Stmt_Comp_Hierarchy_Count", "IAM_Stmt_Comp_Count"), - ("compartment_hierarchy_policy_count", "compartment_policy_cnt"), - ) - - for pattern, replacement in replacement_rules: - if pattern in name: - name = name.replace(pattern, replacement) - break - - name = re.sub(r"_+", "_", name).strip("_") or "worksheet" - - if len(name) > 31: - name = name.replace("_", "") - if len(name) > 31: - name = name[:28] - - candidate = name - counter = 1 - while candidate in seen_names or len(candidate) > 31: - suffix = f"_{counter}" - candidate = f"{name[:31 - len(suffix)]}{suffix}" if len(name) + len(suffix) > 31 else f"{name}{suffix}" - counter += 1 - - seen_names.add(candidate) - return candidate - - -def execute_report(): - - # Get Command Line Parser - parser = argparse.ArgumentParser(formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=100, width=180)) - parser.add_argument('-c', default="", dest='file_location', - help='OCI config file location.') - parser.add_argument('-t', default="", dest='config_profile', - help='Config file section to use (tenancy profile).') - parser.add_argument('-p', default="", dest='proxy', - help='Set Proxy (i.e. www-proxy-server.com:80).') - parser.add_argument('--output-to-bucket', default="", dest='output_bucket', - help='Set Output bucket name (i.e. my-reporting-bucket).') - parser.add_argument('--report-directory', default=None, dest='report_directory', - help='Set Output report directory by default it is the current date (i.e. reports-date).') - parser.add_argument('--report-prefix', default=None, dest='report_prefix', - help='Set Output report prefix to allow unique files for better baseline comparison.') - parser.add_argument('--report-summary-json', action='store_true', default=None, dest='report_summary_json', - help='Write summary report as JSON file, too.') - parser.add_argument('--print-to-screen', default='True', dest='print_to_screen', - help='Set to False if you want to see only non-compliant findings (i.e. False).') - parser.add_argument('--level', default=2, dest='level', - help='CIS Recommendation Level options are: 1 or 2. Set to 2 by default.') - parser.add_argument('--regions', default="", dest='regions', - help='Regions to run the compliance checks on, by default it will run in all regions. Sample input: us-ashburn-1,ca-toronto-1,eu-frankfurt-1.') - parser.add_argument('--raw', action='store_true', default=False, - help='Outputs all resource data into CSV files.') - parser.add_argument('--obp', action='store_true', default=False, - help='Checks for OCI best practices.') - parser.add_argument('--all-resources', action='store_true', default=False, - help='Uses Advanced Search Service to query all resources in the tenancy and outputs to a JSON. It also enables OCI Best Practice Checks with Service Limits checking (--obp) and enables the (--raw) flags. All of these checks increase runtime.') - parser.add_argument('--disable-api-usage-check', action='store_true', default=False, - help='Disables the checking of OCI API unused for 45 days or more.') - parser.add_argument('--redact-output', action='store_true', default=False, - help='Redacts OCIDs in output CSV and JSON files.') - parser.add_argument('--deeplink-url-override', default=None, dest='oci_url', - help='Replaces the base OCI URL (https://cloud.oracle.com) for deeplinks (i.e. https://oc10.cloud.oracle.com).') - parser.add_argument('-ip', action='store_true', default=False, - dest='is_instance_principals', help='Use Instance Principals for Authentication.') - parser.add_argument('-dt', action='store_true', default=False, - dest='is_delegation_token', help='Use Delegation Token for Authentication in Cloud Shell.') - parser.add_argument('-st', action='store_true', default=False, - dest='is_security_token', help='Authenticate using Security Token.') - parser.add_argument('-v', action='store_true', default=False, - dest='version', help='Show the version of the script and exit.') - parser.add_argument('--debug', action='store_true', default=False, - dest='debug', help='Enables debugging messages printed to screen.') - cmd = parser.parse_args() - - if cmd.version: - show_version() - sys.exit() - - config, signer = create_signer(cmd.file_location, cmd.config_profile, cmd.is_instance_principals, cmd.is_delegation_token, cmd.is_security_token) - config['retry_strategy'] = oci.retry.DEFAULT_RETRY_STRATEGY - report = CIS_Report(config, signer, cmd.proxy, cmd.output_bucket, cmd.report_directory, cmd.report_prefix, cmd.report_summary_json, cmd.print_to_screen, \ - cmd.regions, cmd.raw, cmd.obp, cmd.redact_output, oci_url=cmd.oci_url, debug=cmd.debug, all_resources=cmd.all_resources, disable_api_keys=cmd.disable_api_usage_check) - csv_report_directory = report.generate_reports(int(cmd.level)) - - if OUTPUT_TO_XLSX: - try: - report_prefix = f'{cmd.report_prefix}_' if cmd.report_prefix else '' - workbook = Workbook(f'{csv_report_directory}/{report_prefix}Consolidated_Report.xlsx', {'in_memory': True}) - if OUTPUT_DIAGRAMS: - try: - worksheet = workbook.add_worksheet('cis_summary_charts') - worksheet.insert_image('B2', f'{csv_report_directory}/{report_prefix}cis_summary_compliance.png') - worksheet.insert_image('L2', f'{csv_report_directory}/{report_prefix}cis_summary_compliance_by_focus_area.png') - except Exception: - pass - csvfiles = glob.glob(f'{csv_report_directory}/{report_prefix}*.csv') - csvfiles.sort() - seen_worksheet_names = set() - for csvfile in csvfiles: - worksheet_name = _build_worksheet_name(csvfile, report_prefix, seen_worksheet_names) - if not worksheet_name: - continue - - try: - worksheet = workbook.add_worksheet(worksheet_name) - with open(csvfile, 'rt', encoding='unicode_escape') as f: - reader = csv.reader(f) - last_row = 0 - last_col = 0 - has_data = False - for r, row in enumerate(reader): - has_data = True - last_row = r - for c, col in enumerate(row): - last_col = c - # Format URL only if the column starts with "=HYPERLINK" - if col.startswith("=HYPERLINK"): - url_info = re.findall(r'"(.*?)"', col) - if url_info and len(url_info[0]) < 2079: # Excel Link limit - worksheet.write_url(r, c, url_info[0], string=url_info[1]) - else: - worksheet.write(r, c, col) - if has_data: - worksheet.autofilter(0, 0, last_row, last_col) - worksheet.autofit() - except Exception as e: - print(f"** Failed to output to Excel worksheet {worksheet_name} **") - print(e) - continue - - workbook.close() - except Exception as e: - print("** Failed to output to Excel. Please use CSV files. **") - print(e) - - -########################################################################## -# Main -########################################################################## -if __name__ == "__main__": - execute_report() diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/standard.sh b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/standard.sh deleted file mode 100755 index b0a904da29..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/standard.sh +++ /dev/null @@ -1,748 +0,0 @@ -#!/bin/bash -############################################################################### -# Copyright (c) 2022, 2026, Oracle and/or its affiliates. All rights reserved. -# This software is dual-licensed to you under the Universal Permissive License -# (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl. -############################################################################### -# -# Author: Olaf Heimburger -# -VERSION=260708 -GRAAL_VERSION=25.1.3 -SHA_VERSION=260708 -FILE_SHA512_CHECKSUM="https://github.com/oracle-devrel/technology-engineering/raw/main/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-"${SHA_VERSION}".sha512" -OCI_CONFIG_FILE="${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" - -test_internet_access() { - wget --timeout=5 --tries=2 -q --spider ${FILE_SHA512_CHECKSUM} - error_code=$? - if [ $error_code -gt 0 ]; then - HAS_INTERNET_ACCESS=0 - fi -} - -debug() { - if [ $DEBUG -eq 1 ]; then - echo 'DEBUG: ' $* - fi -} - -check_directories() { - if [ ! -e ${ASSESS_DIR}/scripts ]; then - printf "ERROR: Directory 'scripts' missing!\n" - exit 1 - fi - SCRIPTS_DIR="${ASSESS_DIR}/scripts" - - if [ ! -e ${SCRIPTS_DIR}/cis_reports ]; then - printf "ERROR: Directory 'cis_reports' missing!\n" - exit 1 - fi - CIS_SCRIPT_DIR="${SCRIPTS_DIR}/cis_reports" - CIS_SCRIPT_NAME="cis_reports.py" - CIS_SCRIPT="${CIS_SCRIPT_DIR}/${CIS_SCRIPT_NAME}" - - if [ ${IS_ADVANCED} -eq 1 -a ! -e ${SCRIPTS_DIR}/showoci ]; then - printf "ERROR: Directory 'showoci' missing!\n" - exit 1 - fi - SHOWOCI_SCRIPT_DIR="${SCRIPTS_DIR}" - SHOWOCI_SCRIPT_NAME="showoci.py" - SHOWOCI_SCRIPT="${SHOWOCI_SCRIPT_DIR}/${SHOWOCI_SCRIPT_NAME}" -} - -check_python_version() { - _W_=$(which python3 | wc -c) - if [ ${_W_} -le 0 ]; then - printf "ERROR: Please install python3 first! Use a version higher than 3.9.\n" - exit 1 - fi - PYTHON_VERSION=$(${PYTHON_CMD} --version | sed -e 's,Python ,,g') - _V_=$(echo -n ${PYTHON_VERSION} | sed -e 's,Python ,,g' -e 's;GraalPy ;;g' -e 's;\.;;g' -e 's; (.*)$;;g') - if [ 39 -ge ${_V_} ]; then - printf "ERROR: Please upgrade your Python verion higher than 3.9.\n" - exit 1 - fi -} - -usage() { - printf "\nUsage: $0 [-h] [-ip] [-st] [-cf config_file] [-r region_name] [-t tenancy_name]\n" - if [ $IS_ADVANCED -eq 1 ]; then - printf " [-s|--showoci options] [-c|--cis options] \n" - else - printf " [-c|--cis options]\n" - fi - printf " [--no-zip] [--zip-protect] [--verbose] [-v|--version] [--redact]\n" - printf " -h -- This message.\n" - printf " -ip -- Use instance principal for authentication.\n" - printf " -st -- Use OCI security token for authentication.\n" - printf " -c -- Run cis_report only.\n" - printf " -s -- Run showoci only.\n" - printf " -cf -- OCI config file (defaults to "'$HOME/.oci/config'").\n" - printf " --cis options -- Run cis_report only and provide additional options.\n" - printf " For example, --cis '-h' shows available options.\n" - printf " The options -dt, -ip, -t, --regions are detected automatically and are not required.\n" - if [ $IS_ADVANCED -eq 1 ]; then - printf " --showoci options -- Run showoci only and provide additional options.\n" - printf " For example, --showoci '-h' shows available options.\n" - printf " The options -jf, -ip, -t, -rg, -xlsx_nodate, --version are detected automatically and are not required.\n" - printf " --exclude -- Option for showoci. List of excluded services.\n" - fi - printf " --redact -- Redact OCIDs in output files.\n" - printf " --no-zip -- Do not create a ZIP file for the contents pf the output directory.\n" - printf " --zip-protect -- Encrypt ZIP file with a password of your choice.\n" - printf " --verbose -- Print more details.\n" - printf " -r|--region region_name -- Run assess.sh on region region_name only.\n" - printf " -t|--tenancy tenancy_configuration -- Specify a name of the tenancy.\n" - printf " Configuration in $HOME/.oci/config (defaults to 'DEFAULT') will be used.\n" - printf " -v|--version -- Show the version numbers of the scripts used.\n" - exit 1 -} - -check_config_for_profile() { - _wc_=$(grep '\['"$1"'\]' $OCI_CONFIG_FILE) - if [ -z "${_wc_}" ]; then - printf "ERROR: Profile name %s is not present in the OCI config file (%s)!\n" ${TENANCY} ${OCI_CONFIG_FILE} - exit 1 - fi -} - -get_oci_config_value() { - local profile="$1" - local key="$2" - local file="${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" - - awk -F'=' -v profile="[$profile]" -v key="$key" ' - $0 == profile { found=1; next } - /^\[/ { found=0 } - found && $1 ~ key { - gsub(/^[ \t]+|[ \t]+$/, "", $2) - print $2 - exit - } - ' "$file" -} - -check_jwt_expiry() { - local jwt="$1" - local BASE64_DECODE="base64 -d" - if [ "${OS_TYPE}" == 'Darwin' ]; then - BASE64_DECODE="base64 -D" - fi - - # Extract payload (2nd part) - local payload="${jwt#*.}" - payload="${payload%%.*}" - - # Convert base64url to base64 - payload="${payload//-/+}" - payload="${payload//_/\/}" - payload="${payload}$(printf '=%.0s' $(seq 1 "$pad"))" - - # Decode JSON payload - local json="$(printf '%s' "$payload" | base64 -d 2>/dev/null)" - - # Extract "exp" value using bash tools - local exp="$(printf '%s\n' "$json" | grep -o '"exp":[0-9]*' | cut -d: -f2)" - - # Current time - local now="$(date +%s)" - - if [[ "$exp" =~ ^[0-9]+$ ]]; then - if (( now < exp )); then - printf "INFO: Security Token is valid for $(( (exp - now) / 60)) minutes.\n" - else - printf "ERROR: Security Token is expired!\n" - printf "ERROR: Please re-authenticate using\nERROR: 'oci session authenticate --tenancy-name tname --region-name rname --identity-provider-name dname --session-expiry-time-in-minutes mins --profile-name pname'\n" - printf "ERROR: For details see https://docs.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/session/authenticate.html\n" - exit 1 - fi - else - printf "ERROR: Could not parse expiry date of Security Token.\n" - exit 1 - fi -} - -show_version() { - printf "INFO: %s version %s\n" "$0" "${VERSION}" - ${PYTHON_CMD} ${CIS_SCRIPT} -v - if [ $IS_ADVANCED -eq 1 ]; then - ${PYTHON_CMD} ${SHOWOCI_SCRIPT} --version - fi -} - -show_version_json() { - # Example: Version 2.8.0 Updated on February 23, 2024 - version_cis=$(${PYTHON_CMD} ${CIS_SCRIPT} -v | sed -e 's;^Version ;;g' -e 's; Updated.*;;g') - if [ $IS_ADVANCED -eq 1 ]; then - # Example: showoci.py 24.03.02 - version_showoci=`${PYTHON_CMD} ${SHOWOCI_SCRIPT} --version | sed -e 's;^'"${SHOWOCI_SCRIPT_NAME}"' ;;g'` - printf "{ \"%s\": \"%s\", \"%s\": \"%s\", \"%s\": \"%s\"}" "${SCRIPT_NAME}" "${VERSION}" "${CIS_SCRIPT_NAME}" "${version_cis}" "${SHOWOCI_SCRIPT_NAME}" "${version_showoci}" - else - printf "{ \"%s\": \"%s\", \"%s\": \"%s\"}" "${SCRIPT_NAME}" "${VERSION}" "${CIS_SCRIPT_NAME}" "${version_cis}" - fi -} - -check_tenancy_size() { - local num_cmps=$(oci iam compartment list --all --include-root --access-level ANY -c ${OCI_TENANCY} --query 'data[].id' | sed -e '/\[/d' -e '/\]/d' | wc -l) - printf "INFO: Number of compartments: %d\n" "${num_cmps}" - if [ ${num_cmps} -gt 32 ]; then - printf "WARNING: Number of compartments (%d) is too big for a proper run in Cloud Shell.\n" $num_cmps - printf "WARNING: Please consider running the script in a Compute VM or from your desktop.\n" - printf "WARNING: See the README for details.\n" - exit 1 - fi - num_regions=$(oci iam region-subscription list --query 'data[]."region-key"' | sed -e '/\[/d' -e '/\]/d' | wc -l) - printf "INFO: Number of regions: %d\n" "${num_regions}" - if [ ${num_regions} -gt 5 ]; then - printf "WARNING: Number of regions (%d) is too big for a proper run in Cloud Shell.\n" $num_regions - printf "WARNING: Please consider running the script in a Compute VM or from your desktop.\n" - printf "WARNING: See the README for details.\n" - exit 1 - fi -} - -make_env() { - if [ $HAS_INTERNET_ACCESS -eq 1 ]; then - if [ ! -d ${PYTHON_ENV} ]; then - ${PYTHON_CMD} -m venv ${PYTHON_ENV} - fi - fi - PIP_OPTS="-q --no-warn-script-location" - if [ -d ${PYTHON_ENV} ]; then - source ${PYTHON_ENV}/bin/activate - PYTHON_CMD=$(which python3) - if [ $HAS_INTERNET_ACCESS -eq 1 ]; then - ${PYTHON_CMD} -m pip install pip --upgrade ${PIP_OPTS} - else - local _V_ - local PYVENV_VERSION - _V_=$(echo -n ${PYTHON_VERSION} | sed -e 's,Python ,,g' -e 's;\.;;g') - PYVENV_VERSION=$(cat ${PYTHON_ENV}/pyvenv.cfg | grep version | sed -e 's;version = ;;g' -e 's;\.;;g') - if [ $PYVENV_VERSION -ne $_V_ ]; then - printf "ERROR: Python and Python Virtual Environment version mismatch!\n" - printf "ERROR: Python version: %s\n" "${PYTHON_VERSION}" - printf "ERROR: Python Virtual Environment version: %s!\n" "${PYVENV_VERSION}" - printf "ERROR: Please use matching versions!\n" - exit 1 - fi - fi - fi - - if [ $HAS_INTERNET_ACCESS -eq 1 ]; then - printf "INFO: Checking for required libraries ...\n" - # echo >${ASSESS_DIR}/requirements <=3.2.9 - # pytz - # openpyxl>=3.1.5 - # pyyaml>=6.0.3 - # oci==2.172.0 - # requests - # matplotlib - # numpy - # EOF - ${PYTHON_CMD} -m pip install ${PIP_OPTS} -r ${ASSESS_DIR}/requirements.txt - if [ $? -gt 0 ]; then - printf "ERROR: Permissions to install the required libraries are missing.\n" - printf "ERROR: Please check with your OCI administrator.\n" - exit 1 - fi - fi -} - -check_shasum() { - local CMD_SHASUM='sha256sum' - local OPT_SHASUM='' - if [ "${OS_TYPE}" == 'Darwin' ]; then - CMD_SHASUM="shasum" - OPT_SHASUM='-a 256' - fi - local fn=$(basename ${1}) - local _error=0 - printf "INFO: Verifying checksum ... " - ${CMD_SHASUM} ${OPT_SHASUM} -c ${fn} - _error=$? - if [ ${_error} -gt 0 ]; then - exit 1 - fi -} - -install_binary() { - local CMD_CURL=$(which curl) - local _base=$1 - local _filename="${_base}.tar.gz" - local _url=$3 - local _binary=$2 - local _f_binary="${ASSESS_DIR}/${_base}/bin/${_binary}" - if [ ! -z ${4} ]; then - local _f_binary="${ASSESS_DIR}/${4}/bin/${_binary}" - fi - local _gzcat_cmd='gunzip -c' - if [ ! -e ${_f_binary} ]; then - if [ ! -e ${_filename} ]; then - ${CMD_CURL} -s -L ${_url}/${_filename} -o ${ASSESS_DIR}/${_filename} - fi - if [ ! -e ${_filename}.sha256 ]; then - ${CMD_CURL} -s -L ${_url}/${_filename}.sha256 -o ${ASSESS_DIR}/${_filename}.tmp - echo "$(cat ${ASSESS_DIR}/${_filename}.tmp) ${_filename}" > ${_filename}.sha256 - fi - check_shasum ${_filename}.sha256 - ${_gzcat_cmd} ${_filename} | tar xf - - if [ -e ${_binary} ] && [ "${_os_type}" == 'macos' ]; then - printf "INFO: You may need to enter your OS password to continue ...\n" - sudo xattr -r -d com.apple.quarantine ${_graalpy} - ${_binary} ${_version} > /dev/null - _error=$? - if [ ${_error} -gt 0 ]; then - printf "ERROR: '%s' cannot be executed, yet.\n" "$(_binary)" - printf "ERROR: Open System Settings > Privacy & Security > Security\n" - printf "ERROR: Find '%s' was blocked ...\n" "$(_binary)" - printf "ERROR: Click on 'Allow Anyway' and follow instructions.\n\n" - printf "ERROR: Run %s again and click on 'Open' to continue.\n" "${SCRIPT_NAME}" - exit 1 - fi - fi - fi -} - -create_native() { - if [ ! -z "${CLOUD_SHELL_TOOL_SET}" ]; then - printf "INFO: Native image generation is not supported in OCI Cloud Shell!\n" - exit 1 - fi - printf "INFO: GraalPy support is experimental!\n" - local _os_type='linux' - local _os_platform='amd64' - case "${OS_TYPE}" in - Darwin) - _os_type=macos - ;; - Linux) - _os_type=linux - ;; - *) - printf "ERROR: Platform %s is not supported!\n" ${OS_TYPE} - exit 1 - ;; - esac - case "$OS_PLATFORM" in - x86_64) - _os_platform='amd64' - ;; - arm64) - _os_platform='aarch64' - ;; - aarch64) - _os_platform='aarch64' - ;; - *) - printf "ERROR: Platform %s is not supported!\n" $OS_PLATFORM - exit 1 - ;; - esac - local __graal_base="graalvm-jdk-${GRAAL_VERSION}+9.1" - local __graalpy_base="graalpy-${GRAAL_VERSION}-${_os_type}-${_os_platform}" - install_binary "graalvm-jdk-25_${_os_type}-${_os_platform}_bin" java "https://download.oracle.com/graalvm/25/latest" "graalvm-jdk-${GRAAL_VERSION}+9.1" - install_binary "${_graalpy_base}" graalpy "https://github.com/oracle/graalpython/releases/latest/download" - - printf "INFO: Creating binary ...\n" - local _bin_graalpy="${ASSESS_DIR}/${_graalpy_base}/bin/graalpy" - JAVA_HOME="${ASSESS_DIR}/${_graal_base}"; ${_bin_graalpy} -m standalone native --enable-native-access=org.graalvm.truffle --module ${CIS_SCRIPT} --output ${CIS_SCRIPT_DIR}/cis_report --venv ${PYTHON_ENV} - if [ ${IS_ADVANCED} -eq 1 ]; then - JAVA_HOME="${ASSESS_DIR}/${_graal_base}"; ${_bin_graalpy} -m standalone native --enable-native-access=org.graalvm.truffle --module ${SHOWOCI_SCRIPT} --output ${SHOWOCI_SCRIPT_DIR}/showoci --venv ${PYTHON_ENV} - fi - exit 1 - local _bin_python="${ASSESS_DIR}/${_graalpy_base}/bin/python3" - PYTHON_CMD=${_bin_python} -} - -check_authentication() { - if [ $PREPARE_ONLY -ne 1 ]; then - if [ ! -z "${TENANCY}" -a -z "${CLOUD_SHELL_TOOL_SET}" -a "${INSTANCE_PRINCIPAL}" -eq 0 ]; then - local tname=$(get_oci_config_value ${TENANCY} tenancy) - local security_token_file=$(get_oci_config_value ${TENANCY} security_token_file) - if [ -z ${tname} ]; then - printf "ERROR: Profile name %s is not present in the config file!\n" ${TENANCY} - fi - if [ ! -z ${security_token_file} ]; then - jwt="$(tr -d '\n\r ' < "${security_token_file}")" - check_jwt_expiry "${jwt}" - SHOWOCI_AUTH_OPT="-is" - CIS_AUTH_OPT="-st" - fi - fi - fi -} - -prepare_end() { - if [ $PREPARE_ONLY -eq 1 ]; then - local _WC_=$(${PYTHON_CMD} -m pip list | grep pytz | wc -c) - if [ ${_WC_} -gt 0]; then - ZIP_ENV_NAME=$(basename ${ASSESS_DIR})'-supplement.zip' - (cd $HOME; zip -q -r ${HOME}/${ZIP_ENV_NAME} .venv) - if [ -e ${HOME}/${ZIP_ENV_NAME} ]; then - printf "\nINFO: Python environment copied to %s \n" "${HOME}/${ZIP_ENV_NAME}" - fi - else - printf "ERROR: **************************\n" - printf "ERROR: venv configuration failed!\n" - printf "ERROR: **************************\n" - fi - exit 1 - fi -} - -check_env() { - local _WC_=$(${PYTHON_CMD} -m pip list | grep pytz | wc -c) - if [ ${_WC_} -lt 1 ]; then - printf "ERROR: ************************************************************************\n" - printf "ERROR: venv configuration failed!\n" - printf "ERROR: ************************************************************************\n" - if [ ${HAS_INTERNET_ACCESS} -eq 0 ]; then - if [ ! -z ${CLOUD_SHELL_TOOL_SET} ]; then - printf "ERROR: Either:\n" - printf "ERROR: - Change the Cloud Shell network to 'public'.\n" - printf "ERROR: or\n" - printf "ERROR: - Please ask your Oracle contact for the required supplement file.\n" - else - printf "ERROR: - Ensure that the Internet can be reached (NAT mode will be sufficient).\n" - fi - printf "ERROR: When finished re-run again.\n" - printf "ERROR: ************************************************************************\n" - fi - exit 1 - fi -} - -cleanup() { - deactivate -} - -OS_TYPE=$(uname) -OS_PLATFORM=$(uname -m) - -ASSESS_DIR=$(dirname $0) -if [ ${ASSESS_DIR} == "." ]; then - ASSESS_DIR=${PWD} - PARENT_DIR="$(dirname ${ASSESS_DIR})" -else - PARENT_DIR="$(dirname ${ASSESS_DIR})" -fi -if [ ${PARENT_DIR} == "." ]; then - PARENT_DIR=${PWD} -fi - -DEBUG=0 -RUN_CIS=1 -RUN_SHOWOCI=1 -NO_ZIP=0 -NO_CSV=1 -ZIP_PROTECT=0 -QUIET=1 -PREPARE_ONLY=0 -REGION_NAME='' -TENANCY="DEFAULT" -INSTANCE_PRINCIPAL=0 -SECURITY_TOKEN=0 -REDACT_OUTPUT=0 -CREATE_NATIVE=0 -PYTHON_CMD=$(which python3) -SCRIPT_CMD=$(which script) -SHOWOCI_EXCLUDE="" -OPT_MANAGEMENT_COMPARTMENT="-mc" - -SCRIPT_NAME=$(basename $0) -IS_ADVANCED=1 -TYPE_NAME='advanced_ng' -HAS_INTERNET_ACCESS=1 - -if [ ${SCRIPT_NAME} == 'standard.sh' ]; then - IS_ADVANCED=0 - RUN_SHOWOCI=0 - TYPE_NAME='standard' - test_internet_access -fi - -PYTHON_ENV="$HOME/.venv/${TYPE_NAME}" -POSTFIX="_${TYPE_NAME}" - -while test -n "$1"; do - case "$1" in - -c) - RUN_CIS=1 - RUN_SHOWOCI=0 - shift 1 - ;; - --cis) - RUN_CIS=1 - RUN_SHOWOCI=0 - CIS_DATA_OPT="$2" - shift 2 - ;; - -s) - RUN_CIS=0 - RUN_SHOWOCI=1 - shift 1 - ;; - --showoci) - RUN_CIS=0 - RUN_SHOWOCI=1 - if [ $IS_ADVANCED -eq 1 ]; then - SHOWOCI_DATA_OPT="$2" - shift 2 - else - shift 1 - fi - ;; - --include-management-compartment) - OPT_MANAGEMENT_COMPARTMENT="" - shift 1 - ;; - --exclude) - if [ $IS_ADVANCED -eq 1 -a $RUN_SHOWOCI -eq 1 ]; then - SHOWOCI_EXCLUDE="-exclude $2" - shift 2 - else - shift 2 - fi - ;; - -ip) - INSTANCE_PRINCIPAL=1 - SECURITY_TOKEN=0 - shift 1 - ;; - -st) - INSTANCE_PRINCIPAL=0 - SECURITY_TOKEN=1 - shift 1 - ;; - -r|--region) - REGION_NAME="$2" - shift 2 - ;; - --redact) - REDACT_OUTPUT=1 - shift 1 - ;; - -t|--tenancy) - TENANCY="$2" - check_config_for_profile $TENANCY - shift 2 - ;; - -cf|--config-file) - OCI_CONFIG_FILE="$2" - shift 2 - ;; - --zip-protect) - ZIP_PROTECT=1 - shift 1 - ;; - --no-zip) - NO_ZIP=1 - shift 1 - ;; - -g) - CREATE_NATIVE=1 - shift 1 - ;; - --prepare) - PREPARE_ONLY=1 - shift 1 - ;; - --verbose) - QUIET=0 - shift 1 - ;; - -v|--version) - show_version - exit 1 - ;; - -h|--help) - usage - ;; - *) - usage - ;; - esac -done - -if [ $IS_ADVANCED -ne 1 ]; then - RUN_SHOWOCI=0 - RUN_CIS=1 -else - if [ -z "$CIS_DATA_OPT" ]; then - CIS_DATA_OPT="--all-resources" - fi - if [ -z "$SHOWOCI_DATA_OPT" ]; then - SHOWOCI_DATA_OPT="-a -dsa" - fi -fi - -if [ $REDACT_OUTPUT -eq 1 ]; then - CIS_DATA_OPT="${CIS_DATA_OPT} --redact-output" - SHOWOCI_DATA_OPT="${SHOWOCI_DATA_OPT}" -fi - -SHOWOCI_AUTH_OPT="" -CIS_AUTH_OPT="" -TENANCY_NAME="" -if [ ! -z "${CLOUD_SHELL_TOOL_SET}" ]; then - SHOWOCI_AUTH_OPT="-dt" - CIS_AUTH_OPT="-dt" - CLI_TENANCY_NAME=$(oci iam tenancy get --tenancy-id $OCI_TENANCY --query 'data.name' 2>/dev/null) - if [ $? -gt 0 ]; then - if [ $HAS_INTERNET_ACCESS -eq 0 ]; then - printf "ERROR: Cloud Shell with NO internet access can run in Home region, only!\n" - else - printf "ERROR: Permissions to run the OCI CLI are missing.\n" - printf "ERROR: Please contact your OCI administrator.\n" - fi - exit 1 - fi - TENANCY_NAME=$(echo -n $CLI_TENANCY_NAME | sed -e 's/"//g') - if [ $IS_ADVANCED -gt 0 ]; then - check_tenancy_size - fi -elif [ "${INSTANCE_PRINCIPAL}" -gt 0 ]; then - SHOWOCI_AUTH_OPT="-ip" - CIS_AUTH_OPT="-ip" -elif [ "${SECURITY_TOKEN}" -gt 0 ]; then - SHOWOCI_AUTH_OPT="-is" - CIS_AUTH_OPT="-st" -fi -if [ ! -z "${TENANCY_NAME}" ]; then - TENANCY=${TENANCY_NAME} -fi - -check_directories -check_python_version -make_env -if [ $CREATE_NATIVE -eq 1 ]; then - create_native -fi -check_authentication -prepare_end - -check_env - -STAMP=$(date +%Y%m%d%H%M%S) -OUTPUT_DIR_NAME="${TENANCY}_${STAMP}" -OUTPUT_DIR_NAME="${OUTPUT_DIR_NAME}${POSTFIX}" - -if [ $HAS_INTERNET_ACCESS -ne 1 -a ! -z "${OCI_REGION}" ]; then - printf "WARNING: No Internet connection.\n\nWARNING: This script can run on home region only!\n\n" - if [ ! -z "${REGION_NAME}" ]; then - printf "WARNING: Ignoring option '-r "${REGION_NAME}"'.\n" - fi - printf "INFO: Running check for region '"${OCI_REGION}"' only.\n" - REGION_NAME=${OCI_REGION} -fi - -CIS_REGION_OPT='' -SHOWOCI_REGION_OPT='' -if [ ! -z "${REGION_NAME}" ]; then - CIS_REGION_OPT="--regions ${REGION_NAME}" - SHOWOCI_REGION_OPT="-rg ${REGION_NAME}" - OUTPUT_REGION='_'`echo -n ${REGION_NAME} | sed '-e s;,;_;g'` - OUTPUT_DIR_NAME="${OUTPUT_DIR_NAME}${OUTPUT_REGION}" -fi -OUTPUT_DIR="${ASSESS_DIR}/${OUTPUT_DIR_NAME}" -if [ ! -e ${OUTPUT_DIR} ]; then - mkdir -p ${OUTPUT_DIR} - show_version_json > ${OUTPUT_DIR}/script_versions.json -fi -OUTPUT_LOG="${OUTOUT_DIR}/${TYPE_NAME}.log" - -# -# Tell the run options -MSG_SCRIPTS="" -if [ ${RUN_CIS} -eq 1 -a ${RUN_SHOWOCI} -ne 1 ]; then - MSG_SCRIPTS=" '"${CIS_SCRIPT_NAME}"'" -elif [ ${RUN_CIS} -ne 1 -a ${RUN_SHOWOCI} -eq 1 ]; then - MSG_SCRIPTS=" '"${SHOWOCI_SCRIPT_NAME}"'" -else - MSG_SCRIPTS="s '"${CIS_SCRIPT_NAME}"' and '"${SHOWOCI_SCRIPT_NAME}"'" -fi -MSG_REGION="for all regions" -if [ ! -z "${REGION_NAME}" ]; then - MSG_REGION="for region '"${REGION_NAME}"'" -fi - -INFO_STR="Running script${MSG_SCRIPTS} ${MSG_REGION}" -if [ ! -z "${TENANCY_NAME}" ]; then - INFO_STR="${INFO_STR} in tenancy '"${TENANCY_NAME}"'" -else - INFO_STR="${INFO_STR} using configuration '"${TENANCY}"'" -fi -printf "INFO: %s\n" "${INFO_STR}" - -CIS_OPTS="-t ${TENANCY} -c ${OCI_CONFIG_FILE} ${CIS_REGION_OPT} ${CIS_DATA_OPT} ${CIS_AUTH_OPT} --report-summary-json --report-prefix ${OUTPUT_DIR_NAME}" -SHOWOCI_OPTS="-t ${TENANCY} -cf ${OCI_CONFIG_FILE} ${SHOWOCI_REGION_OPT} ${SHOWOCI_AUTH_OPT} ${SHOWOCI_DATA_OPT} ${OPT_MANAGEMENT_COMPARTMENT} ${SHOWOCI_EXCLUDE}" - -trap "cleanup; echo The script has been canceled; exiting" 1 2 3 6 -_W_=$(which script | wc -c) -if [ $RUN_CIS -eq 1 ]; then - out=$(echo -n ${OUTPUT_DIR} | sed -e 's;\./;;g') - CIS_OPTS="${CIS_OPTS} --report-directory ${out}" - if [ ${_W_} -gt 0 ]; then - if [ "${OS_TYPE}" == 'Darwin' ]; then - ${SCRIPT_CMD} -q ${out}/${TYPE_NAME}_cis_report.txt ${PYTHON_CMD} ${CIS_SCRIPT} ${CIS_OPTS} - else - ${SCRIPT_CMD} -c "${PYTHON_CMD} ${CIS_SCRIPT} ${CIS_OPTS}" ${out}/${TYPE_NAME}_cis_report.txt - fi - else - ${PYTHON_CMD} ${CIS_SCRIPT} ${CIS_OPTS} - fi -fi -if [ $RUN_SHOWOCI -eq 1 ]; then - if [ -z "${BUFFERED}" ]; then - export PYTHONUNBUFFERED=TRUE - fi - SHOWOCI_CSV="" - if [ ${NO_CSV} -eq 0 ]; then - SHOWOCI_CSV="-csv_nodate -csv ${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}" - fi - SHOWOCI_XLSX="-xlsx_nodate -xlsx ${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}" - SHOWOCI_JSON_FILE="${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}.json" - SHOWOCI_JSON="-jf ${SHOWOCI_JSON_FILE}" - SHOWOCI_QUIET="" - if [ ${QUIET} -eq 1 ]; then - SHOWOCI_QUIET="--quiet" - fi - if [ ${_W_} -gt 0 ]; then - if [ "${OS_TYPE}" == 'Darwin' ]; then - ${SCRIPT_CMD} -q ${OUTPUT_DIR}/${TYPE_NAME}_showoci.txt ${PYTHON_CMD} ${SHOWOCI_SCRIPT} ${SHOWOCI_OPTS} ${SHOWOCI_QUIET} ${SHOWOCI_JSON} ${SHOWOCI_XLSX} ${SHOWOCI_CSV} - else - ${SCRIPT_CMD} -c "${PYTHON_CMD} ${SHOWOCI_SCRIPT} ${SHOWOCI_OPTS} ${SHOWOCI_QUIET} ${SHOWOCI_JSON} ${SHOWOCI_XLSX} ${SHOWOCI_CSV}" ${OUTPUT_DIR}/${TYPE_NAME}_showoci.txt - fi - else - ${PYTHON_CMD} ${SHOWOCI_SCRIPT} ${SHOWOCI_OPTS} ${SHOWOCI_JSON} ${SHOWOCI_XLSX} ${SHOWOCI_CSV} - fi -fi -if [ ${NO_ZIP} -eq 0 ]; then - DIR_PARENT_OUTPUT="$(dirname ${OUTPUT_DIR})" - cd $DIR_PARENT_OUTPUT - if [ ${ZIP_PROTECT} -eq 1 ]; then - printf "\nPlease enter a password for the ZIP file. Zero length passwords are not supported!\n" - zip -e -q -r ${OUTPUT_DIR_NAME}.zip ${OUTPUT_DIR_NAME} - if [ $? -ne 0 ]; then - printf "Please run $0 again.\n" - exit 1 - fi - else - zip -q -r ${OUTPUT_DIR_NAME}.zip ${OUTPUT_DIR_NAME} - if [ $? -ne 0 ]; then - printf "Please run $0 again.\n" - exit 1 - fi - fi - mv ${OUTPUT_DIR_NAME}.zip ${PARENT_DIR} - printf "\nINFO: All output can be found in the directory '%s'.\nINFO: Results are packaged as downloadable file '%s' at '%s'.\n" "${OUTPUT_DIR_NAME}" "${OUTPUT_DIR_NAME}.zip" "${PARENT_DIR}" - if [ ! -z "${CLOUD_SHELL_TOOL_SET}" ]; then - printf "\nINFO: To download the ZIP file:\nINFO: 1. Copy the filename %s\nINFO: 2. Click on the settings icon of the Cloud Shell on the right\nINFO: 3. Select 'Download'\nINFO: 4. Paste the file name into the modal window and click on 'Download'\n\n" "${OUTPUT_DIR_NAME}.zip" - fi - if [ $HAS_INTERNET_ACCESS -eq 0 -a ! -z "$OCI_REGION" ]; then - printf "\nWARNING: Your Cloud Shell seems to have the OCI services network configured.\n" - printf "WARNING: With this setup the script can check your home region '"${OCI_REGION}"' only.\nWARNING: To check all your regions you need Internet access for your Cloud Shell!\n\n" - fi -fi diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/Example_Output.png b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/Example_Output.png deleted file mode 100644 index 659ecb210ab4f2662dc522eb646c382dab396e4b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 153502 zcmeFZc{p2L_diTkwOVx0i5lA8EvjgZHAbtYYMx6BRW*ws#4J@s2SaO~X%SN;6fuj^ z(julHBF3sQLWwCdc+>lSp6B~q@7unA|9;o?bzLVp&e?mfv)20TwbxpEoxC*E*W%*j z<78oB;nKc;*O-Ncy_SWAZSC+O=9Qnv$YU%ltd_1C8iv{$8p4J?U?*1(M-~>*w|;NX zI(LkCJJBOY#qwkLF7aL9yQX`W%SSev^TOv>Vf`CTeK~C=Qhm<&@xlHJv3f|DaK#lD z50|6Y_}&C@Yi~-Q(b1Xit?|$f2?~@FqhvSPidRIyu>^RkT!||Ebo_!QOoM z6Y?XcK>=3m<8&}I1#&b#OF_oRqSPrG$zfORM$@Y_=;UVXDVG{_o1Me(EW38-9sQ|$ zvdCXTvR+f=@u1P?=!C7Sx%YeJDJ$Jo3EC&^PEajvhhMC{jKIs=fM?$uIhOPP*rL}D zE=yxrm%aZwaqrmcG>r?sp8%5&yMc!~1$BAzF7q5^{psHdys00v3gKLI~>lnelQ{p!M^5}?F91v&cK3kQHaJRwQ}s+az5p~O7@by@0? z@ZU{*-Bm9=)H4*;0Q)!!%S+ynym3j5Q&?D7#pj8WlJQ;5e|2a6r+Uf7*Vju)O3L5g zU(#Pj671tFbyHDMQR;@Yl(e)2vxNjC(9_pGK*AGp`JX}lJQ~1}o z_K(4SzN(il{UY?Azki<7F~IeID0xEu#TJu6sb6=bZc5&e`p?+Rt}4H-DjB*4IC@y# zbp*0MV&?a?rqZm)|Cm4rlHT1 z9qT9FNZ!}-5We=zn77+~4QGq6LGFwNuhGXUb|!<@xI8Q>U+0NFWWDXNIoTMv@KQew z^KGPRVMUP$R(tFtpQyc|C;yEhlWyrmsu?+a>(tmIH@{ zpZ@McT~ysGla2Lvy?o7NeJM=GdhQx!1J#h^-9h{f{ z)aLm3{JGyhK6CJ5zXJzr-6td+B2WCO&0$Z-vETE?e1IV()@Oto&(zAcKk(1O9AEL! zALPe+&@G$g6UnN!`=R}xWXv4@0^1)4uhD-x4J{`)ez@@`1+aVq#r=}>Z^avKC8F-t zI6{&(Kli6LPp9QOf2Y{Luc?=xDz+ew?1C%W+((e^P5Q(u(!+r1!v~sdj2DgyUe$PAIWWU_xrJVh41Tf`TMCiXWqTLORTI!mE{Qg1oA`hWv#Y@#UR7sg^oZ0XRqEa27X#+Y!ci?sRr<*53Q{sQfirtt(fum4qyt7xUW?I#ve~ z+fu3w`MpASO`bYwyS2WZ=6FsQ_Hi`Vo2&DYyKY`@B_gMjkn~-Sxm4D4*cbwdr|gOX zgzM9YnbnBMka?s7g6! zCID>Uqkt&~Ix{+v6Qr(dsrE``K6o`0+iz86%z1oVvM}tlBmsO@ z*+$P@Vv;@8re6_zt?;N-C)*E1Pr*l1AVJRHy<>xuGA(01EOx0tx|AqWU+*`7S^$=* zB?kL}*t&234#9cW?7y_6O5`v)Eh?!A5vV^{HUV#Zq?G3BYIu(@Dz{2^ib zS(~ImgZ<#Pn=M_Zw#nD=G?g6CI-$rLteEr%u~Lo>eS@8u7ezf4k~K55V4dpv3&ya{ z?C4keYtAgs=JvdA`26li(>O*wi{D`XlzeUTy5sKL9;FO2ZYNTkGh82%68U?Zxl$h7;8=Fyip6R!%yAz* zG69O7AKpHbAd3{&B9?3!B}&z=rrt^Urt*6W`^M%`dJWF%vRqqwsGyJOTXmI(*6CkF zclp4RcR@Dd>SaINo)iJ2axDVChx>#=4XALw=VGo6nJJ!&Qtjo)k-nO5*`6&Pxk55w z(7NnoiB6D-D|~_U_i$23cMJ#GOapk^ zHkIZbI*&W_anp3dnbe#@p<;~n`6&TOu33tQ3ex6%DlDgyoc^(@beRVnHE zIO4&)sj%6;_0Q4a>Rv~C$#a>AZ!x~PMdCnK&+=#>2N&JjB8ML?E;6x@VerWgt($5= zc+V{`eDFm=_bgn5%Pa>xotm8lz&ax?01Pe?lT736uFn2mhK6ZOyUIJ?Vg38t%w_uu zFO%n!->Y1HZzplJv>Q4v z`riLuaLoC}d5TFRjURIHPo74SA#;s7vTiB+r?pt!o=M{<#6j|pjGp{u9xkfA{-ZY} zs>`Hd@7eQ*xx{4j4%1_}^4WRdkK&GGx?GYyvGu=QuYUOn512k%mP4pd8VgCn!V#}#F$E5AcpTWs` zaO3Plrx{w{ZAR5ijz39+hakI8g~6V^V(EMfIBQ6Rmt z6p3)LXRX(R!_w_-ihwvdoHcd`X@@>sXngR%;UwefcmShfikQAV3MAUM|Q;Dwo1HKjFhAs0Nd_%X#595EW3Dd}ug?FKR@jehf8!*^%-c9ndw z(lzQH;8{>!ZNiT4x3Xz|3OIS-%kf?M&J;#TH7Fz5-1dtsXk=U#JRnVz++3_d)NhRd zUst|BJD!(9(_UGY5yoZ|;YNvYxLGF3sb&~=gIJCZr!3CK@26b#kUcOb?Dbt+B(vB3 zgR507$a!27%el~5noj^KcA^Dpqw#mPJFUo?vx?xY78QlOym8hLcuNcRiF%H{yLDY zu*}k#RD;vq#HEk@HIc=}tJ4~w(MGz*_j(~$$N4)nnNHUuYM~fb54WEg%fw1+I!^r!=$2Q?lP-|Z9(j-mU12;6Vp!5k6Eej*q&9acr~gh|#u zoY(GVEKE|<;??#_nAXq(xXz-EimLLDBq=8VAV_8l@tsc$8=1ydZTG_4C^1e`w_of@s4e?W; z9o3%w$v}~=8;*mYD_pAOH4#$Xwhr==<{MZt#hG>8?`^yN8V<< z2fBVajd>+r?!u^~Z_lhDI%4_Hf+I!$ovOZeMIA$Wux>``3F4ylw{t59F;0IS;&}~P z;hDh56NY?=W0+$Mp9;!!1W!*p58$z2=t|{JJAyo@=ZBcdig>(^dzzqcf4Dtqo}a3gwx#n}t47t&3pf0hd1bm< zn%8@k*D_9A)=b+WDejCB5eh-a1J+di_a&yLANo(&!e6WI!-M-5fzmmRPZ9iKUdlU) z-(ISR9dMJ`A1C)J_)moT-^#xxveMAq>tqs)t{TwfPtVobzmP-B37cQ~nWMF%+JGLS zM~poanUl<;j$Dqvb?Hi7wx=hF0|27I_80cQ1)N~t9(UOJS#HrRhph!qB_$}}101Sm zA#!$=%8+{j@5xm+WzDI~H=0dB2 zOpb=}(I~?Ctu_q>7N!an04T5ZWJndJ2MBJlUmh;owf?cKyn4eq#}7KBIsFP1)xKzS z8GAYtyHGm`ZB(RYLE5CZ*k*3>n@%##{mBJ0;hlm+gPS{({&u%Qlg-R;@{GfB@jkC5 zPLioYlD18wo0T0n>tLI6$2=#S>H|j@#aOn;f`X@1Rt`a4Xz4s0Kp`5%8$!wdWax z6YQ7o@$T*skr*_O;t=g;JCA)yFlozx{4;_lif4KDwULZ3Rmkg6SD=C33>Q_6qSv-d zqtT0=UVF4y{vdU5czk5Ds#lFL>8#=+p6T((vz~IbDkZc%&a~!0!wz~8y&rofVbykT zsVMhm(P-_tO+wEVIsW{4hx?I7iw_KAY9~*g>4*FA|6=fr?K#M$U)diTh<%v`s%<(1 zu5)7-^8NW~24fO&h^vP=3p3;^$}#;su{@JRFt09DtOS2tj}TattxJWHtWg!Q%evtp zN0rs*v+b>@4ltTD^0^fS&kkriVt?Fr_JNK^Yn`+M}wjo3IjV(9nuX$&Y5S zLYo*UDq4SVvn!*|ywgDUHt=Z)gvQiwl$J3^x-b>IlU*GSI*m#!A6Q=&mx`AAW;63e z*5A>I&n=ioZPzaSqiGr(g|`b^`jX_3cjv0weQ{w3Go83&Ss8uwtfX|G>Q2Ze*ppk1 z#KXX$d*a)p)4@^P7b~*cxh+GthB15F5=kD~3z+B?wht*1z`K@agl^cdN=EBpW_WDK z#?ISsPPUS)C>Negj0fbL8y#6L!$+RA3z%H_84tS)Ok8E|EwtV*JZO5`o;G^Z{@%$0 zgyi=+H?E70V-Tl*n|xmTYRJyPlEK7JBIUqvk~I2M|)(#2AR9dyvmQaBKOC z5WD?S{y3udOtL9|Lw|w3pT07E(`6gdr%1Tq_v7urRJtajd7iI|4kbidR&z6_!ed@x zgN(HZ9)PTY3gwBcw%jDn(m8u^&G&NYiI#l^^TiE6c*Iif-v}%?Q)A~{Z^Fa=4)3}JrKno1rBm- zG+zwzY2U)7GZ*0~vSS18h|Ev)gQLZdkCyBmqqvU_W~ou=~m}$2IUv27Fs+SWt$!;BK6HQL8|mOSPM`V5vV*{O*8T zw57m8%g?sg^LXc6nJL(QXrZ9-LSwqy-pa6rolN{_?eI`mYR0irL_v#Kb+du$R(0S; zNl}mTT1)02;GSQ(mYJlM-nB*h7M-Fj+5*sXbxl_zdxu+P`st1C@6Wlv$Y8o<4|eJ0 zIbW}%uXpAq5w3nz{Rbd_Z^z2Hq?TYRIfQ~lt@4|9CdHAx)4T_vwhLaF1m!u zzK^?HRoJ{U)?GZJ{f?N&Eh`kXJL7V5Iavj$+-@|F)`T+sk^He0Nt?~7*Rf+gu|)(= z^yMH`3#>khl(m2zf1V*b>K!f6_W0<;tCj? z;pN%i4u_0#3Yg1g;~ru!_|w+s2fHPCsE3wN`u4%qKp(p>9=}I!sdyITqXp@WH8XQi48Rk*%J6_q@Fpw3!OtJ+$ zIwN(hN&7g=UL2WV)wsh-Sn9V$X>^^DNZF|>jFGAx_i-YCP&e1M*K#)k5wOiA$h}wX zXl^A@oMnCp=cW*J@uI!**q&EM%=!5dAXv}!ly%L}(8~fHOop6HH839z^5V9#-HV`-!u*l~}>psvj)8mP%>pauC*K*V%tyrBGOe^n9wF&Pu9 zw4(c9*(~gPfwogul9*Fz=+WB(3HrHenBtVQjJw|20(trwvUuGpES%6AC~GRBTIRp% zv5j{Ir%GHX)to|ZPi?x&_xWbxxQhrgtkgBIwU?2cOK#Af7z8FXqa+U zw`2+CegW?Vsz$gDd(a{73s2PeZ}s=&$aVX!j1EBS8sb3Doc15CuE4rxm?%BWr4@VO zG*o4@)K47S4xJ7v0695FZj;1$FCj0Ynmr2fRZc~^LN}&mWV)cj#3GFR#86K~_))*> z;)&-`+PO}cfYEc@;xRL;TSo$>>me&xWK^GGn!5le!*AH zyu%UD)KzLyXz`X^7-fEbF+YxT!AJzosUNzHSI-ZfM1(41Ck~azDbBm(JE?sv^q%dA z%y#FhBE4`A^OGOK3tkRhscby20L@y0%q7ob;{no2Yo=PpKt|Zuqlhg!;8f?ZSY}+2 z0YKo9fZ9>=SCrO{pnL!d^u4`tS!uoowh4V5R~`-(aK<~dm=x(dwR0)lh#qBeX8NS3 zYQ-j^gBlk;MGMML;kg$&;`xPE%k&f`K3@p>dhw;++}HVNp{T+O8cICXsHwzu9_8!S zF(d0Y36d2psY-{esy)s_JwrB)w4wxx_K4DtKOfEy6OZB&vPU1q#!hw&R3;Gl6*-Mn zc4*|87Gp~#k!njJ?dqTzyC>$`v@jVQix2>M z)FgxUR_^5YYP^1HYO*KIf4^lf!@Zr@ygl&ctPO8Y?bg%4p<<)?D1I=f@=sOTi_5WY znx%=AA@QBQ#8UFmiR}v?+-nmu{FHm3pPL6Ch)0HkL$-#GLpsu(qd-fZj(Q06sug7A zW@mvoq5~F274XmSp6z7rU^-1&%Um9aw$$_$Ff3%vzARmM2PsmhcD8t)@g#Wa`&4{S z1#U2(l=-y5oT&B@w!fnbBk(5oay17do#iKKYr#t7$O%b+-{H8`c>YX%q&bw*t<+1S`Bj_1i%R^Z^aMp)i1%Yn@ z_+9%9!UpM1lG+Q+7d4_X3^+pE_PK7H>M%H*d3%WdbhT_2997b@tRy)+u(Dtma$<4~ z#tdPcC}$*e4g7OIlH^Y-;h}^w$kJD%%k9+A{l@&YX!kO^ouW|CsZ=&K{^Npur3d9E zbK*4##QH%6XrQD-1@2L3C#?Xrzt0R>Y4PW@{!W+Wy>D%!kPk4DCm)R^eG3Og-F-`1 zoErL;$T_BflBjEC80sn`xvcMYSFmJ^2Ft4rce)2wi?K^H7goEN$ zDzaG$vjIY6-R@Tg)W`j;NuUZ)b&*XpGwmVQqwL|2T*)1AWjbp2uaiqe zat{0UjMiQ_SyZON|K`56L2bF`?%dg24*6-JlzfM<*?lV7%a+P^Q{}3k^_arp_j7-h z7m2%1X5qt0qp}s?8wcf|@{j5ZvhnkBq9)zST1PT?y8HW~30C&N+0H_6qAa7kFF#`6 z*4L=oHcXH|4Qbc{)KUmpfPpzYb6vAh1SnzpMLQ3Vucw#e(pmxeZI87e%!TdMjE`L) zr7+K|JLP4dM`!sb=iIOiZ@TY=<;KE~B;d(#t~3sm$$0CblWlz-z{;7Q3%Qz(*E>P( z4Ku5aYbhV&5=HdyUk7&;ycFwHN7|}Jq+^S&%=>lo-Fl?{!yU%Lu}#WoRcku3**plv zPdojb=SNzI<}1ZfcqU;|6`xAIR2zJkPVS9GUkoP!FVb|ejGb-Z=@C7G6YPbSlM>3W zCl|7986N6&CUjNkl+yOxg7vszXKrp^Y$JKy9odqweQxmP41z}qxwPxm`CPn{iv(0W zokAM<#3d9m&G6b^ZbY~*QWmoLN5{&;mDftHQ(0syvpl9ETae9s0^Oe3^5c&pI34R< z`C8V4&`C?E+~~XFb2Z@Og+KfVNvZX#js6!ri{DO%|+s>eF@CcR$ui>|ITL& zSXrH0jk1{kS=wz+PP6mjJ6xY{r*lIexjxnW{06jxZxS}u{IY|wQH>r~Y|@D4{uIt3 zcziTkmnm(<QBZ;M$8)70H?~Y?1yEWVUB;wOYeM6^~Lr)okMO)rle(My6-e#V>8i z`N3d4^k#z2HC+I)N9F(_)i|&ZlBu?pQi~ ziJ%W#*y`7RB}P@3X3_E^UHz%qe^N{8G{3!L4Z~C%T#VcxT+DRDRar3;dBPU;3BkK2- zZ@A2jXw6v%e4-5avVXX$cRzGDZ@T?;AK>gEQpo;p<$M0+x0j7r{bEEVW2bYb-FSnC;^W2p z6Ee5jKtzZIX1$FXJ2dxN2$BJxt_gmc|L#BxqX`g8yICQ}+YW1~=`uM!pa;=VJ!kT0 zJ@cK$v#LHN8OO#d_S(}izMs@pg$*qk4WhS5BW8|Vj1a>v-??EPc>$3zbLaeN)PWsN z-%@M(Zs7OI&I3Rh>8|`Hl)2Ry2hXZ?o^Zu>GuoEZi5Q&SsISxID@cHw=;FR%YDICkR<5w=&Zy zZ|g$JBSxhsC+#EP%iM1I4g(?OBFK^;Nx$f)yA5EjYQ$Q~c`0ll};!+Uy{&yjhGL z9DrEM7A$V0HF#37N6+ITj#}iLv%~o)loOi~v&Gl&gpmQcGei9v91xX7B zZ1#QQUT{e65WrLFJPxOCjmR0@RuhP3Q0^@Rs(KhWXGqkQui>?X!j3PtvYG&z&5>wL?5fo3KRDYFr=5;ylB4sPq!Ww4Z@U8!JA>DBh;trt)ipa2 z9t%@_9NaP2jxEwop>ZF<^7kCa7>UN)W@dt^rNsptgfVV`_Vs9d(BXVY0i38(>>fI9 zvfyHqx&k~fATNqu72otS?#%7wVz9}xcLQkC^u@3d=-_!w87J2&V}wg6Z1EFkcPx?v zW)UOt=-H7@md@5G(mCNe5ZKhMO@9aWkO)`5om*-pwIA&*`H5r%h`Ud*M{be##ac^R zlieK5pxJ(xXH(0CY9dogGGXZJu~fN-9+1;wSV#%pVzJ?edk)dZr~V=?%m}3G{8p?E zq?{46;hN)1oSFLEFm`^uiStIiquV(iPbx)W%A-mY49{Elp9&F}Gf6LX4e3}aGP||S z`^aC;IN9K~JS>n==k}z2`W`b2b3kB?;j4gP$ql`tW);@3Wg5tUx@X&*_bj%$DQN(& zz0SMqLy_%yve;z~5>_yPPowtP^yKbi+0#~Ah`q%s><+Vl_Y*#JAra0OM2^@v1BD4L zWYhOo#VX~_=oX~e*Zd}gd|<<)lxOXdhu@YTsslnB?3trX+8V{)A<%T{CWEHokbA~@ zP;>};{CEUgD3a#tX?;7e7CDA;HJRZ+ZkT}(MB%Up7-+hje5hQ;R6DLoTG)oJpAKiM^ncYGw1 zuatxw8|hOe>vlDTDdIb}QsU7c3OLRojYCliWO)dkT5;OGDTmA>CCaHP{s+Rkqu%#txN9F6TJA8m0-pcZI#JX3DSc$9C#I z@Jq7I%B(T&@eb-{>zao&wb)um#_(lE(ExNTK`XP)yIZ)prZ*(&Gox?aN zHHr}mN8lN<9qyW0&*-gT)90qo6?1j62s{`o^V7SZC}QxyGB(*l-?Q)56%#qSJ-AMH z-=A?7m7P)jb%(hi(umA7ewm-Gs>fv$((LJss|Gn)((cBYpT*8g)9k@-Vz{ms{7Czu zXn-PJq?TMwrxKIX5*7wi)w@o~5D&$lw^|Bjeo0&^~ITiruK$Vovs*2$`Bsvb=PP|$evK;~188k?I z+*u8;haQ$w^BDEwdX?fqO8ekgf*Gm;5onS&&V-6YZn87cxp%?o!HSzhjx_4Ry}>-bnXQP$bBcRTeAMI3%RNy zHK2{p=Qnn}K!mGxN{Q|hsBBB`!ek7Tuz%UZe{`fk0Zrei0>O5a^5>i%oVDGwBX|J93sXlyzz)f!I+M(brNKi)@NvDtur=zkxP5TJKr}42IP?ji z+&vZS9%ykZ3IuY6G~wo(#tQTvSc#woX0%aKPXqQk0gMx&1@fOnbhFOU1%xcoJA=^C z;rfr|ORfacnxK>NVk=wQS|Z9|L5liRQ7w23JuLV$PMPG9fp0l_h>LdJLq`QPfBn>a zpWT}T4H6ZuL$bI};-B^>AcEd4%>zA;5agibvTUNq5@28LmK)M0)X~~+OAha(txRt_ zD)kDE7jDG+;cVWcv9ZO?0ja(%LF->q$8&2QFHY^aL}ua{%-l}55_3CH% zKcF|MWoTsc{Bnf^G?uEplLp4Gq1-uaxl^ruN^-BPd1uRj)Nc?&0LOqqk|sb#!^me7 z#LjuSbv~01MCb8>e)O;{y#{9^1g#SXPe4imiG8HNQFGgG4_C7NCj@MEBtPyfY`^o5 zq>ZhizSS&}yQ!NmJ0|W|#&`cps(JJQ=gN?gz5+eVA>J+i=zs>&Yjx6cXW}Y#gj7=v zJ2NrW#PmOW5sHl6**3<#p)eHa>P`GA%)M}H>wI~}Z%h^?+gMw;q zvKazOd$*rCdgg>Em2I%4G3vy-g+|I7H>(}(Qa42kV|FS8X6g!_-Z#GSAiJ<+_QI8k zG@-Cvd(V{5_GBj=<dQe@DWq=Z>j=1iNkrQzL08VPf1agm=J&(W-f3$O8qzdwy+0YcGl4-f{N9k%S6v)3FI5U8dJ5&}>{)vkT7tIZ+M)xOL&R(b zHQ>0ZfXi7QqE%2M<_#ZE?Y&(2uDPR>gaj}U?_ev?T|$<=Lf@?hPd=Yz>{rLrW?i;= z%P5KBG2kl9h!}-_Y&$t{zpt3BB#CE#FJC{~@qN7Cu|ndedG^>6Yl;pK54yh-YTZd( z)Dd_{xgD&4ex}^}NgnV>*6Sh!FK5>^*O>AtYc(P zmPd70JxPl2;#r?Eq1XHLxuyM8Wz9L$t9S*8wm3VpC=iD{sHidn!RBUG2Gr@L?+uY!;X8)l+mUP-0xkTZx{F$16meW*lg@DZY(j9KjxZvikHgzPkf_!$b z(%o)d0ab2JMug5@WJKI`+^hM(>s8W2;Ewz-`>Q@6Lr>0Fh8|#{i5^+bQiSL>@KqSS zv(%(bGkPpfyR(!xLlqndtlT=3U$qYA1P^!HU{VdQg5Hq-DD;+#M-kXEC2i_Q8KUV@ z$mP7gxm13FX+mW-D<8pHZ#Uokit5fdc_w}`f?I90_^PjptBuVD8)a1nHVVfKa(Ly3 z?S0El+6j>Cq?I9C_>vn(tZd$U!|rxgfcn&qb&bvYd%W2{2lKI=EfpXN*;Ro^9ghpl z%TpR0ul2#yOV=i1o|B)>;{pfe*`9bL@^`dI+r0ZK+|NI(gY9|Fp`ugdBvgfY^`vjp zf_wPz1V+tkp#HP`TZdQc!sg-8Z!c>;U${o-b?Z`lg&dVaGx$QEWV+l4sxx%i^ZxPG z#hiUAp*P;>5cml@a=T8jmsxf3IWvP$EV#KGLNspN)?u4pttzk&rn2-KTy6&a1RzUh z*MkLi9#uUg0+)%}m3{1#hEeYPd`n;JtIgleIEoIwI1rh?Qe(6eh$_kdY)q%doR<+- zd!wHv)*U_U9V<4xg`L`jZ*$#NO&bDC8SS`908z3i*OP$YF>m$~n?eEA0`infOy3WS zj&#*vlu_int^(c8Id$rrJ{VAppo(?_QaQ5#C$Z(GX z__AF`@$jX4Cw_w6OdmN$T)1ahA{!~X_=Iqbd!OsP^pMKt&-VFmML7>jY)XXQ6lDcj z?Un-7wEZ1Y^)Dc`q`wajRXOg;l_R#P)!C%OMa8b_#ajE_BHC1h*@8C<3j2e*MBh{wFS#lrxQ3T;A zM#exj-57!gyJ-Rr)T}NgJlm1HGW^&d%X$7Pevjv>IZ6+~T!Can^IJQjPPK=- z)R_$4a~o`BVXaEQbn$8nb$Z#2Ot-1Br3=HWeIk@_KTN87m2>IEG8pGAu`k_606iN3 zxruG`K3z%&F@6<^8guK|mU#no$}FqdVbPOWVx41d@5hiFE-gq8I)327CHfL=KlBA} zucR9f9i|FbD;XQVF{IA6$E!)lt85epZr3loA1*EpjwyhE9g#QXX7=i-o{bsI5(N28 zA`Y2LVb(j{O%ciQ{b-5yUrSQxfB&-b1PnOeo1M6B`^ahqWIVz1S?KELSADzA@YxLx zq@oH*gMG59@U(^1&93ijvx^#<|5R~^RNK&9f1d?x_?pb(&UjJW#wsk3Irdy= zdu9&cP$PW{%Tuf))i}N{N~{a3rhMDKxB|=R-rZfFz4nAmP>98KTfMvH^QUt;Ma0TWs|J<3?`;Q9$QM;s zgYG5Um;qE0M}W64qTzM>%Ra_oq2{kbLx~a!MY8yJTm6*j6d+jUS3M!#gDlb0NT(8K z-Sh|^%{7#GF4Ot~D<|BPS3Xtd!XAJ&KSrLe^LD^8+{dc5M>|T#EJ^DYjXh$Kr`LI! zPyA32ODw5Rx+IAjIbE0m4XSvb_t91hy*);3i+;XZ;{h`C3vqVtO>@n>gqJ(!;hxSE zbHaI(m)i(4O*PljP{?uJ+@Y`#)>Br2rK*tQ0Qn9kHGhkRfLuH`HIEMa@Y zIh`ANN;?!W93MKP)2^jOi!zyuNmuP$3=h7^z*KbJQxg+=VfTTWJ?5kOty6resljd| z^W;m5Ghb_)?rfBy>N28Dsw~}7?Wp%KT=k{`3*r)G=WuBmPEJ@gWRgr5dqYXGnfAj&+tkhwqv&094+(s5sNo`jpfC^e} zrFW6&$*@iVqZFw_JaHY6^S^c&+x5R%^MB@iLmaNxMQ#*|`>)u6I2)Ii>o90Vf=88J zJKuum-q#1H#Ko?XlJ?krumgFc8~GPvafyl~7ncK?mBj8f_C^06Fmteq+^fv*x5#{PPPv2wpZBWeY<&p$mqTC*{8Z(HL9uR5fv_6wZE-KQ z)Lp40l#FvupyrTdAY$$d`HN73UKPe^E(0D&cXY|QBd7^|Ay*`=8b3$X%PO%!q+eNm)}U_7Cd0Haz=lAy1jLkADm@y^JSoW_tszDbFVkw#YLX!mJ$jB zm_2dK#CH4DY&w0X^Qb&R7x|x8{a}b@DH`Se7=P>g&x#JDlDe;6$56S6Dma68me1rA zGS_Wy?i3aE+}%erv?eR8BYkEqN0;i};4hUI{Vg|)<_%xDmz}ayx7o*DZ>#fthXz^6 zyoH~ni7g*8I`_{Wxh3<}4`v*L=Zd#}$Brnmj( z32QA1Qq4a@BA2vCS8%@M`f?X$^_}*$NFFIUuOsaY!r%t>`{B+hbxnbDGRu3otEB6u0>mYlA5MD`{gX)l=hllb;Pg zYeP2d@j+gaZdfj`(I3I)=2EX&`_tAyzmUbOWrZwVNqtTSioSVYzzLd*k*NX`L<>%I~Dl)tsRdjEzB^dawj!t+6r%)i4aMi81ZF>)1(q? zidwNY?gX=<^(e*qlZRaLjN75L+NqZLUIN(Qh`jj@2EZ5Tl;ML}Q%wo=N+$4G<0;_Iw8KV{*o>c4$;JdZKCc9cT- z_ZFq;0a+d6Yn116f}ul3V!4wcWXuc^EG9JnGuqQ-OKA&;lDBs>ZjXYsoGh|>Y4RBK zsZiVkptLg%>2vWhA*lHy!a)kyduMGHHQV30!GC1(8t%B`OR|5S0!iEgl$g`FQ8KCk z8}Bd4j9kU|vI*;EPOA?Vp%7ay!SkoHe$`&Sl(TO1w-YHW&{jOCGVD~OGuCO-@Ps?6 zu}RLc*r5%aa?zHpynm}{y6yG*R#aF)Nxl-GqTGi*{egjqQ%_IHFQ~mvF_f6cjnH|Biqn9M{;K9VZU|QzWe5ES0O)G7j))xsI6K1w@QwS zrDjCj$|k{6P#LOgR<1cY*QG0<((uEdcTtV1%xxF60lT7Ml;foq9jBm$M#hk#0RJ~hnf%u-)afI^&!CssQvP2 zpU48NKA^oN*%xxl9n_S=`w^2qKhSQsKi;3OwWEs{SJmqtTYJiu-@5JDNOBSkTzr?* ziaPT#VEw&|<*;|lVB0J2*!8{>a!Y$9N9Y`OLhF zTp~|u(kLgdF3^m2{8H3ayMj!_|sqaoBSLzz%!LGlW9t*u4Y zcQtH{zJo~tf&^MHb0Z~h?2)$3@9~?4_p`q^=>)x5Mr%%$69&mpR3LpR$ZKF&c>zYo zD2UzG1|R{elWktPryD{PU}91G&eV`ww2F4)Gd5q_Y0N6;QR-l@F(O%x9+dELfT>#A zMf>uJ9j4OaPNY(!^uIf_@&g7DR2*BY_lEoJ1#~wE>FPFu-i7X`0 zaM8g#y@0xMM{9@Fg)#hy-fRSqT2lA>d=>u*KYv+-->voMv-xQH33k7}n(Uvu+H%7~ zlK}{AxxCF+NVlvq%jB`NYNUTvb9>_^?Wk1Uz~^^ivdx==Is>xwx>q8A(IVF{y|sWz zV|w}8OP#%(rFZuo2bu4LWTdZo2Df#y5r~0n1bGyOIB}Mt9p)#^aw%6nD-)nT`$`ZsLg)!;OUbiy8K6g;(wIbIhc=N&M2+9FN99H>>c-H{27!l>R8dUAfiPe%{8NL!mS8Qvsn zr(jAqpG@r67u3#{Hq3A1w%^6*DDe~$PZjl3k6A$9wf_SjldCwJV7&*9>7OFd$1-0% z*f551g~>SiPc(1VYBPfixPrl!Dp}}JL3id7S+~;>nWJhlDH_6{^z6_YYKH+=Z1`zw zFu0%SlQCvypPId-W=O z^A4+hsi2T=2>|1d*B`#I4*u(kNd|yf8P!m1W5&)gWUt>)z_%*-vp7RcYfK(Ks~yf@ z)+ENOjqp4zC}7c;3ZuW*CWEMOv$qM)B-|j?&V7Y79}rC&r7@kmyui$X!a$TvcEBs# zCH~G@ItDt#`5no|fRI=A=|x zAbuIUpiL|$$6Ys2qWsXU%8&;!jt%)P_P;YG0VGlMqr2JyR|<99Ql|iCmtvy>5{-jG z@c^M>c{J5N%@h&VBM4dXMvbSM^q$rZBvY<`Gbg1|1x}Y?Z`wEyUdh%O?trNASYnft z``hIJu=>s{z!R=jZ;V+cogIuBso2XBEz2aC1R%ez= z9CF_N&{R|Qrs?+f6_(CARz}yJAIz*du+W_bDC1u{|1^tMst8VX)%DxHxO)(s2JzN;wy+qQ4PS+a}Id8TMshakl7;<~S@CNCb6?230j zdt1g24IAsZU~Hh_IZKD^LpEL~T-}5~I2BDBCM7tpaq$ZMVwEU(J@7 zG;bv|b0>`*N$3Kz6~o4~Pg#LC?Pj$ls+f03{C%maTJ&9p_|vHN!NXdo$v^s`c|(iC zbao12&AanM69k77tgqif0@+1F{QSJIFhWsz&Mj(oSKS(2 zxQE|f`Dn4-_F{4oV{j2m?c}?(JSL_riR8iW#_6NMyo-jO3r~>Zry(tNMiv;al@`HMnz@D+^L;X3>Sau?*?FdiX6VN3v7^eFUc@yc) zu7c9*N#1(#JuwkjxGka-@ca>~Q_RNNWEhsk`-N9~*@2x62-0Ts47)M6L+``tK2iE~ zu7+6VTB9^Ac10KK!#ul|92qxF4pwV$?d>m|c4K$f{(Au@<^|D%?S3qpJT%{;!Sww?6kv4bkoBNyrC3 z3)btMTX)z}xM|ouQ73vU?)mLg_eW0UdeZB*dew2}!AA?D6IjCBAvXznhy5s?!D~10 zZ?M82h#xpJY=$Mm_ot)GNA1bOS81(Hsq({ZZpmVhU!S<~j|_+Fj1PJ?Nfm6dbBC$! zFhfXf0kOqtN3)Q@Co%eME6w1zUWx1eFx4_6p`L^VZ~ZPg!e>C6A5z1IRl)D&YPkEk zQiJxHRQ+)Rp*Azurp7t*_*1nm#vN+NL+TaHvJ7CHD|UQ&1EmzbKie+zErzDEU9S_i zdlc%|RSWHVq{$WFaCKYvj*nVbs|3gs5q+*+Jm4W;$FLx#9biyV3iD=E@o-Hpec4la z_Tys$F-gyGK~q2^v}Y(ffWF!uZ^RolBt(s$38aYsVB!bv^a6LR$qoXE4%AB_`h-i9 z1#e^XNT_LyeEzp!*SK!z*duL1_a6^CgX*~=L$aXcaB4JdB&eTV(kK#pmD!KpSv-?v zuZkJpevP>R5f`IAvet$D1;W_tH9 zA4ZuVTQIk|y%>RW0gK`LO)UN${BIGdmprc3HQ8Qhti{wcNd}A2KCudT84=FZ*xh{J zZ?aTlsQ-#K{g^T){v`rI649piD7W_Oec-+qCnPv#MBxxVaEvlBaVr8b`thleYivbX zbQu5G0gxq%dFz}=;Bs~=7a1)OBd(=pso>+i-n|TqWD71e$3ozUufVFNbkxeAd}<(!uD)nrc6#Usrfc?V!o#ghf%?f?s>N zxO7RCHjpd+34}oibQD+MR2vf?bG+wxXg`9fcxDxe)yvVgZf=gdDgq5#U%$h5&sB_F z?;{2Fl7p=`WRr_gxaQj;5O=SeDqUCgNyd{$!c1c)jdwclCm45Et444z@^59)kYO3e z6R4DkLs6mRI<0ciu)JS2We>TGwRbEPmZ&)C1ZD`jIRddQvSeW;uTAw*0BzacN?7P(fZTrcEl5&+us8lT|+5fklG2hYEnZDNs+?A!;uCV%PE z+Ye6M#BYy#$A(N>`w;1jCy#cBYJVIlG5iS#yBK5P_feJC)k&ws;muN zNiQUqCoS#|E5a8#F%M#5jraGyHf}-}wjqMaTEFXO$?s(xI#GSbng!2s&#gAYS3li< z+Eq+&nbFmVX~tWthvPvpM3JjdD)YwLm`e`j?arLmekgmaBKg4{5XQ@kQ}>k%jE~p2 z{CYcg3x~Dm@hWJN0+WPABY3VKiP9543-rl%Sxza){4;i1DqiwUca4v2ZbA|HRkNNr zWF2C<#D@zPem=vl|Iv{s1B&Zt^DXZNc6R-)m-~Ewaiw-h4YWF@I6yV&EbV*ftw)%W z5C(RSDWaoY^Cn|?)W27_%{=Q$rg7=uv|b@ciDCj^-dSuKez9=cYQOIMVo1U zB48k*r<=OAIf}`SHM6@Prp!2bSsOoDvlPirFe(kG5w!~z^!L4+S2|)Q9Y(S71Py^& z=1RkJTl^^?tN{~7?ZrlfKR!uc3G*F%EpV8!)KfZ}!#Fklew^#M6b8lITMr?v-4B=< zq3JIcYC~yi8bX=+({*O}lZ*>G5^<#qYGXoUFP{frukq11tjR?TBX$jKckJk$Y24lO zp9^8{o-q_`xf0eGogT1Ie`Glb<57_L*-tLOzCLg|q`SAZTfXT$3-dNPCse|&-wvW) z9j^9@s?XYffLCTbz9vz&#uYT-+qq6n=wq%mGjh)u$HZ3cDora*l@BZoCBlIN%w!p3 zYE^ynb9#)2Nn7acAfJLz&7j75n(9b+3M76-XmxGe7Chm`WbLs<@Z2~a^ofj6;0NY& z9ThZU?Ccm<-JITZJalW0OR#&r+ojR1Lv>7kRUr0YY(%l{5d$;%mzy#{C-+r0J6m>M ziLoC0s~_LUh6KwDWSnjMjE-#G01q({;>s-DVLk>DV=c2cSTGxpk$_O z<}DA1zasB(A0~E2ax8O8dOAF>N64K+yie29HFdNH0}Dz7Dbmj~eq{-VOh4%C9*w(0 zZ5u@taLmyaiwjI-7DhIe60GDMa} zQz?zM;%xkhQ|81>sWpTX^1nx~jhTJCsN1`5vskMH)LIs#5JZ+XJqx2lHlkm1 ztF6|y@kWH+%ppJ86LG?w{1dY7KFNy!JbkIQ;uL|lqn9#>#cWl6oun`0?8!gzANCP1 z--!Jph`@=KVIe~}?o=A_nO0hf0xVK^t)c#Bhw#-SjJ--wAExb~V6hiX>Meqt(sze$ zfL8^=k4w`jjD^&-ojS}dyeBkds8%GP)cmnU_fVZZpK3s#Ki+5h&`Rr_p*)0(Hq}H%QWwqZrsLh2B>XZsCFpr z;J<)vJj8Y4ft8y!jJ0#<6`i#*b2-!amcN;)FENMf^xCeu{eHs}wrJ72X}WxXSdgYS z{1`1Y4_RRuSv<*gz+s1yvi%*yXvHmA0EZz}3u;rn@t^$*`=l}l*I0eD!3Xr#H;NQB zr+DC(m^q=bkm~@eO%Dn&D`sCq4_mYe6a2XYgoXvcaH4&dxkOw=^Cxg?7&t)HL0FpR=OQZ<(>S7_|tGe2EKDd z*UPOvvCKjYy65|BOfofO!Tvic+as#WtydMRu+xEag@4YrZ!%Su4*Bla7(Q)Bim5?~ zUI8ta-`-8l!s&;)THG{zzKra{k%+m&1;)yx$+DBFL2HfHn0zDYhSgLhbZR?o2!+=O zSjOg?!IO4Ix9sz6YD%RHU4K=UhLFq*^_Eq?o6Fgx)MlqH4fwi63D=#q$ODh8cD*#_ z8gn!3_`-fZD0r22Ad-n$KaW^dl}4qi4FEPnkV8i{Noqkx9+2<+SuR$F+9jiT`V*3R z0aNfC)Thh$Q|^5bPGJL8goFd$*~-{VDgG{}T-G1TE29oH!j!Z4{1;>cNZ(_> z{tq~Rb14e}y!VaPrDo%AlxK}Cwk@5|5Y-NTG4|^rJ2GfMT_awBbdFRf+uJyR7tOwD zt37^_2shiR9DUX~*eN2M1gDhp)E21pey(m|lVk){?Q)Eck=nL$z3!Fe8K-MV<*g*N z$5imS>W$c64nPco12d2ff{b+q?f%6DVyT(h4*{FobiM8RhSaA+jhg+-=`}kJ-8HvT zwv>~8o(02yUa@l-F^DPk@uXVr2lUpc8c=42QUi2;hAxs$YzwRX=~m^leBP$$!fLR2 zuMpD>z3`t6R@M>P{4`QQ46xjTAG)u*|sl@jf*+2DxlFb0}rwXBGdVR!vUgK3Gw$x?`k|IJ4!G`CSwtZQj`DTEcEF zDRTN+XR1_O(&?>2YI&!Zhe6nRMpXYPsrXYvw#glxOCfqJ}IX8^Gosets zwQ8V>1LA%cRX;{@AmQ~-My(%f{!c0Fg~u2U!iipq(YM4(Hvy{q{JQpJL^-iXU)8M4 zV7SO-z9;PMU**_;A51IQL^tUp`N97>vHYW64J4G4zrHn$4Ly=jOa6t~-ng2n;MwuV zPZSoA88*LBE~uoQaq;h;{EIL7*pnUk&zm_UEB-eYtWfgcm(PTyr#k6UGkv zJD`a|43m3CiiUg6Pja#AAJD*^X(-fx_tgD2fV@BpSU6qkcUimHuyy76!;da!>0aMc zVaMq9jXO?Vdv~DI_2HP+wckH{Q|>f7i2OeA-2a7no0?|<)6|yU-(ritf~GxERe+wq zRg_iin2;fZSJa@O51uw1h-+)469A~3s?pxx0rzG>&GuE)q<5m7Eamd!1(c|z0o)3)1nCA7Bo zkHh*&SB(0pZS-E@G&gwl&mh#JMW3oLz;J`Ryh+(wrCVP~ire%3TW)JTb#95J@Gn1I zB-55ety5zG2=7!`Y)?<7a(5VGaP|dViHDHNn_;dZ1G1J#M+N`9r0ntSFr^!Nxwnz? zc#PFvbP={XVr9yeXSmVKe>lrG=Y`-y88}#vwd$fA+8Q?Om=dxSCjtEeR$lsY7b>d; zNTP0C@G=}Xzcv3AA9|obes@zB4FUcrSDH9)TGGS z5Q|ly6JE*-$q(o1dw0QKkFj>!WYN})7aBjk-*=hK)SYqvLhmhU5``%|tM=H&;)kI^ zK1s5+r&);2e5OX93Tfa{fQgl~e=D1FbfaNkSQghlf^aY%k2zs$oxi3e#d!Af+jplM zN-tP`AFYU`GWTG#?x$81$^H}Fz{=b2%a>Eo1}fV^stO+_)%bvJ6C|&3*Y7VTt6@S& z`#u$$B4o-Q$tV9IV`+!%HW%i9wTJydRrPIlaV~`Qi)+|#d&fy|?hl3@se91^AW&M> zQxJPznBKPs`Yc!QdZpr?z;F>I^?Inv$VOf8#%T)i$DmsT2&Uxz#>)3QZ@vju^{b0D zSTaTs0NHc?ax7A>$2tuGFn^BKmA#xy9>tPRsNmwxyTzf83 zd%1zD8-U@dI)6j9rPpf^D)!}uzxh11*tI*!t!^>tI3=3Wlj_nDOYiMTyV0rQi5V%W z?vQpHQExL$24Q)z{v)&EJ?Z2AhQn@#2A%eRRLwwKPnuT0N+mujV1S3z^88i{N-={u zEvv6-yJO%CJWUF?uvzNBiOCnRE~# zb$`d+*;;LnqDA{zE3s7HFX{1AW#5^hqvO-`Cf}qg5Bo*oPU^m4hWMB6BUmIc$%d8d zywqDoJ;WpYDzFOQqej8YD;$sdK1a)0+=SZ4O@;LZMl>0(_d5VeC&ssyF>S6g;~yFB zYp^;fo71;n3teKRF!1wJdg68aPMmhbwPLyhw(yoSd~M1^pdPI z9%j7>Y%j8rb^?Q0mO`=|uE|3BR(he34B9k3FC)-j6bfqVpIi z3%7VzJq@j5?WDblxM?V^2mYF(82%<@ci6}6r{A`L0#S0GDE5rxxKRHKiU?`Bvvwfg_$bgiF!^1jJ*Uir09%>>jAu>Nz!nqn7)cOjdJn z1drFmqLfBSKdU^VYFzF7E9qewPD65?Bgl(!iD5(fn>s0Gq z1$^NU;hUF&HbN1n6>J@t2$ID|%hngbDArHczTA|2Lu_KAge{)Ft`mn;r6Ch|BNi>qGbPLLTW3s?5(D!EpRSnSyY zK00gZGtl@hMKi2Km8tw?AnUG)GImWFQG*HEi2OdNy9?b}<1i}SBrNQ{o0J^y?Rc$m z@#4vd*`agXXOri>Bb>jBKAMwzdd)}*Gk?pvI{4F5+sN0it{moQpSGK!K;2*sLGJGA z4Ng_h+Q>iMm4ixg4dE?b10+VmW) z(IyA8OCGAWy`OwMj4TMv^8NOMto>3;&&#cer(rxqr~b;Y482}@EGq-)UHhX^rqhiz zD|#F!cj8v?IEp+nvuT4Y=M;PUgeyi<{~OrvGALD+ijBMPUh*mEw(Q2ug!?sjhHrQ- zC(#E(|1AAEW{!dLbKC%?));WqZ8MQKLcg6z(||NO$Wz*Ao@mHb8!KFyK3_F_6hZV} z)AFaENYnAH=Ryit#&;NMXQ78u_tneiR@YUcFCd@K*KNUN<=c4x!|Iqrfi8jOH| z*@JtV6Q`l%LgHzpa6(vbZt_E}ESCWf!q&>gau_e_J8dbX9J2EjjLCIsv>pP;+(;K4 z%hU?;KKilqfb-8f_`Vg<9HFy|X~{SEVoMV4mzOP%{B~~UlqPN|_fv49i%5)|&16t~$M|WoK`+2IJMR1)!S0%26H*_;@Bp!qerMtI zOp${+vDryJP2DFme5+^Q>zjoOFrHL%G-Xn}aSs)~!91Hbn3IEC&oWC3BmvuQ9RhBA z)O4veY1FG7Qd)nHD z3xLUQ$%p9Z_7u1h)e4Dv+jmgGl*rHHU%88=2MSODYu`Rr2xsm>Co-+4JHA7MWo$q5 zipXZ5+f##Q&0DRlt}V}uRpBN3Q+;~1+);TiQI+YVOQGieRYtF!f=js+Y=Q$DldTLH))#&pMrH; zhC+DztK5Zq;~0wMIq03s@dwvhH^1r`fb7q{h($C*4>=aO4-!RGJVr;BLbxJRcc2?3 z^9O8zd9WjdWe@4w`4yI$3a9Z}}*Sv%@PmiRW+)F}i^&Q$rMbwm`&%5GI zh`WT-w@`s%KfI^1B2+z=ZrPBJ{t4`x8dvij;hO^~4Lh76oba56$AebJ<&Jq0L-y&E zQ~V)z;R*YNxJSYSTyvl~u?O`eK{u}{+ld~j$WvYc@%*SP4LTu5 z^)EW7yqp8ncCQj})s#*OKIwp~{6ZEL;66YM@fk-Uk&`117Ggi1B<=k2Fp2kCPdSr6 zUM(&;d8x^J4{1ME)x=K0_w-6Bf5zT(ff}dOTsX7pgDEdE++q#{j=pmhd)31$7AU^2DCdR| z$!<}v#|6!*#kd!V47;^Q#lg;1kxMgmqb-t9y}_iAt4^Tmlh=Ubmo$D<4bJxfZexa* zdbuNprTpD3+g@k#m%Pm4(sXBlPTAar>UH2?1k-C}E1>ZJ^UF2_vSCG$vfsv2sE_RB z_u73m`C`#VaF_dA(rd45&rCjfOl|)lG+yIR7>mlWpp$1C2YhoJ0Xx1#14N??VbqVRa*Kq%`5Ba* zuUZ4gq&j3xw5B-|wQchn@DLl#*g3o4uzJ| z-ya59qWJGIP55E3g?eem5AtP*_y*%G?mm%D&Y4Fa?E*)8Ve^}i>w1}HslN)2x&g5B zf!mgFzy_9F6%_jOtw)~H(AIsh7hJ34raS0xO#_m&d~neqfA!ViLdlafH!%^QNTffl z_jn1oAW1EB^MuJqBZ-IH+F$0S9FuUUyl}?&HDOktJH|EMo*k*bO02k5wyq57x{@{* zF|gqREhjhAJFG+Az(Rl%C;$*daOFUPwBZI4k2GnTqt$C;nn9NRy5Z2m?*{@PjN9K$ zfrHxpmSzfL=-bnU9%s6VR*uNDvs{pcP3|qZ^_y^|ltlg+%hua`FJ&(49w`u}v1GTh z%B(Z)vF)T0159;fbj1oEiGJ5=WWudpYQdrvjFifxp?(}X{9Y$CIL}?6#_Or$Fwww3 z35_gKY6O1c2F%pAB+*#kKcABJ$=SU7Iy_u~PEc`2! zcE)uqtHVzZdudd$XgIebk|d^J@lp@vA+uynxl6gj#m*U+-1!KObijTH zb1)4oco^T2ge%PhDwG?)16Xz&r>XV6X`=Za9VjD!Mq9dP_Y}b1*O*_Gl!u#4AKk*L z&DA|BtETh`*Y%{Rw4Jpy?|ijN2)4S=gqp7_w!_BZ`ki`A%i^&b&s_T)mQG#uIo{-D z9A-DV?bSB0XZ=JC894&l6t*UAE4g}@I^XUrI>%vbFZKWjd4MiWMOd7-w~%Rsy3L&? zKVCP=ygO6z)f`K8X@;g9lV7S@_--powKr?8X@Y;?%BUglen zO0Vo>_~Tn{Ne&u{X$xRq7cTuqUBo@xiVm2n^=BmgC7l0RAEk-`fTui^_KTRzz$aU})}l3T{k zo(E!!?z}qyoyc1G-0@H{=m+;si(?Zf$SaAECrQgX1H9+?aWn z{W7=9`q~AnPpf-oh#*h_Q6yX&sqv+uo>=t5Pa5a@Q*vn%;KmnTHVmTE zqktOOo`4qw)$;1XS8;vVR~{)o2UQTbu@T=V=Eutf;y$R`d~#RDCtnZx>ia(VTD)#N zsRTfu75m=Gif%3i4)29q$~C{)7CRfY7{Y@so&I)c$}QQ)yyC?T(w*u6)6 zAfYdq2ujaR_!JaLpmsR#%PMwPb!~^}qXj^}wO7FMCsy#nosBR^-xcomerdqw;q~9! zPkr+)+X%wLy7Bm~X4vNMji=pToA-`(r>POh?gPF=GxG6P-*{Ef5{!~{m&PIy+$IvEFTEL+Pl&v#9%sLN05`c#4gL_JeJ6f`r`5dxeVgoU|g zXfsR^{gUB#ZhYpf!dq6Id!4CBaKLWA^wKJ;nD%T6RGU5oX~VI4BxC3^o5xeFssa%u zbyy;42A#ZJJgk2BJ95=l-f6S#e3`orw%cx3e9*8Fga6ury#2E1ol>jznMaF{HYd+o z;{!#3rfG^7wagei{QK*p8i^v7%fu1!U!I$PN<1<(wsE~L1b+9aaVI5pIQ2d< zh0W1V2kphNdwX6wT&%-*B(KRM^Pr>$%&G5U@-l?>b-w3Eh`sb5t;+!>8EbcuXSH_@ z6mz}ul;2!@AGsjYSc*iYNd0^)bJz^Yx?3e+ZU1D}3W=a-pBI^|G4{Y2Z&JkX_cAe{?gK zL0_|;FGw1CweHbS-^z5zx4Mxl+#gKVpDrqFnbnM)%{6I}JMwEggc5WZu#CM6H+`(x zS9YJXWr+BAB{#pf>2goEGC#dS1)j_fHOL|W{z;e$TIMm4w8+JYOq2}u&%>Pym5VyX zUTsOhd4`eiFX7lAu^g3r?hzM6wM0p>Yc*9j)NN>`_^C2TAmnOg z(76Qc?ZB!unfF>5b0w|`rw5xoZ0tw01Ple|rNT-zb?a@MI*pGx+fS&vH zFQSi1O4c{k)FI|rBeKO*>sPS9s%xPVpV%Zy%!-?OHS~|FZRu={- z?O{lx<95Sy(K@4V@hAHSLFJ|2{iQ{wjG&2k4=#-r12m3|5W$YQ<`FCfndyMbKVRee zPMkS=;PJ3Hc|%dFMO5-E(_%)PmWq<4>ZA?9cL&>=8n!p}uDw^5PAr=40B{clN|CbCK^tavMk%q_HQylRbXQ>eX$fu& zW_#Apg)d3^eBrEXy?J%g6SvAoKG)8e8{U#q<@~k);#Yz;y?TpD_6F%Jr}743H|x{8 z_c}sX@(r@TL(UZQAJjE>mAN>L72!Dgxk*D;!KPiDBsC8 zYU`m5pp-!EIvT_X59DIz>-wRnqZLvw1(dszWuhkV!+!eOH%Gs^Hz=f4QiX!m5Y}Vn zJseb0hwGgq)jl={2f)QVncPQ;B~g{7+gvdds}<4$Cf(f)B?3xtRU^?Ol&ig)^c53C zox8BiA#3&b2AZe$=#QrXoZhav3s2Xrh^85&0FTchV5`=%d;?3Kn#SC=GAG3d$dCbG zL=f+f3rA4M^hz{n#w9RpoqC|3o80r(Fke3mMo6wYEwU4&4W%73U-uFi1ok> zcp^O=GeQIT7K7(E>toU4I+!JcFP_Re-2ru6sb*=-DY#euKexb;_?oFQcpk)hMu^^w zcww95`G&gu?oI?xkKUg?{*- zvd6JsIC?6isvP?Kq`gwbHQy2#z1ELYs z(|TA@^))wrodbD5>El`qkn3?JqIrImXGC{%DR!fDate2!31YdVX=*0`GrZ@Jv&cG^ zB*Ii)O3X%pNBq{_c$=JXNj1w(c$_!GGxX#QR`WY-W+t&9Nh&G?^I0=f)TUE1w8cT< zVsi>1;wGQ;{+E1`c+;&Wvzb4P4{E!%@OoKwiwP~d-aIG3)q)J?oEBDHb9`?tSLqR- z|HjAH^cnhGzujYk@B`l)Ox>r^OY?jA{M_fIA6TjPclYfAECd_tpLls~1bxjcfO3@* z>K^qa2uxu%N!Cb|&(+xBETmjdLjB_b^QL>FqGK3c)B7H$fma(u2jS++hiTLxBuNx- zN)kTu5fV*Uim&q=lR0D6IuURV^=5lw6!1v&QONWn_xb2p(f!@wi5gWL5#f%zyzpga z`}5ExvXQ-2v5REr{&q7SCwQD}Mi^jCrB2+*5gyOhslv-L8-s2EC*7lxcKWJ6m%ShI zH}{I^68J7lqC?sqG7F2gx}C`*q#0xbPN6pZySe!X{|y?r*X1u?tG??mV`tZ!;?LX@ zi9?s%hlnRin1B{&;qBzhc7}VpbPtHQnMQ2}OZvT$;KIH z_@1c>Pctmt0$YPTeSn(P6|URL_Mk-YsveKdmke(px6NexG5d+OC_nD5>l-o7%xr|x zA-}=xtP^FC*HaveInbU2QPUSb6Un#&3xPMpYw;u9O6}*O8n|bqPUcjKUp!B^W#B5= zd16HaN`Io>l8(Q{`tqp+oTvlOw_a3K4sOPt#+FCsaevNF+i_5T7-QJx3#*Q4{x&$K zAKRY)vP3D(Wf+zC6Jg$2m1w4C*6q>Mb=o40te&0#OXb+CSjm6i)nRHwxHV_l;XIgr z*WTfVvVC8OX!}H;(%`++hB}mJoZUfJ&KCamp*Zi`<0JZCuAMABEp82I#_CwSurZQ; z|CLfi8wo8q;Hiv$m}4!`vBkhcFn0TutuR?L8LG?e@Mf8K0@cjKkS{gdQTN&-lGb zd6wvB0NW_FX8~5WJ^)_Ve;+^S-CK|aVQe=-n$hxocC&fUwQB`&mxqaiL>t#<^JFo@ z_h@LPcmY&PvGLwS5aFZ!-ITU2PvC58i{RzXXz)CJ>k4ltiM@kpN-zZsQznOA@shM? zpyZVoBdVvXJ`ri^2G%M+m?ZdXh`)K0Pw|@oGgn+^MoHh$72mXtCm9#+Zz)Zd-_;4- zOv_XAphvC)uQnNN)sMtIqUJ`8ZiIQH+oQW0v2ot{wJrKF*DfOz^h^Lc-dCB0AayE? z&Ps7?4%#EA(&43sUTM53ap9NUO3Q_3GENbw>gz^zo2eMHWopa17Vs5-MtUg2Ogk&% z6?a_%hx0=$l+Pf6BV2h}5Wn7rVqeAb3>}B%KPXxI_nOptGONwC@f80h$w5WMtYTws z7%WlaBiQb*U50+-DhvjNz+f`;=C0r2oKyW5Gfl4Y<9|TNg$ob!JXKXQP3C4%yp`@` z1CP_pp_tYs!g&m8VMhogr&ZguTlFwim3Bvm$yNVmv~oW3y=OrO?y4(;Qu{q5t&O+C7r8gZ#T;iq0JnYF`n40*FM}X-<@+ z_?INRd&5`U;>p_kID-u5eNA#XRdVe1eiV58tUP?MZerqbwpmV}yfzYpm54;KwkPF2wb1_x*1##*$dW(WJ*5?NL)gv2sV! z7yLP?&M(bDh^j+TaPHXGLlR;JJC-+p)SBP(tC#u+msRV<4k#y>!RkPi+iA*B?`s8L zfoz}Nxn8QUhzXo39LT98ot)ql$@)tE9DI*__;nL7?ub> zz))WnbBuv>j@zZ25VEgOG0CwZmf{bBKd?6&hQPPiMgIKz&xh0!X=&cwO#y~O+6o2v z7vT7A2B`AK=AZN4AhIT*QHTgzEP8sOR{AZYcE(dT!;4uwr2K z2Rjv2upzwKuyN_vQ(X64p;S2{zomMo${rpQ(OAt~?~RHTBT{60%5>@9qIzY3nOv}> z4^$i7~N3V(gd2(flZjP*{b)%)x1{)4o-D6?&pDKs*~lco7*L!o51BO zPYaQ;4nuxL#Dll(`jI*^K^5ZYuEVP9L$|phD#NdT8YF%qVD>t8Ct(r%JZ`=oQ@2#KtigH4MkS`q-ENRR2$;YXXs_#3 z?Iyf3I~Ocs*Zpkic#bp^mW1V@2Dmia9`qJPSK^N|3&8$m;bgKFh)MmddEYeh4^bZq z8;=aR@4@BA6dNL!YuGOa1{lBDOZr~M*bEFK)IQA4Y+8~c2RVfZ`_9xF>cCbclH`yLnPnu&(4MDOf; zqq07n*iZU-0)48KV{`=@4WSaiA_4$XzfJXp!ziSEIMMYpZn-WSz1H2ZksJAo{-k%e zHC&l&7s4~ORe>8DM=L4;VsRt2g}L{4SotuS77|+S^OLgJGIt`rOaZi7QoLewQayZ5 zP{f{LYlZjU^S>VgQ(fx}bSuHtHK=Z<&I14o6y^VuhQe<#&iv))G>Z+jB{KKY?NOK7 z_H^f|r+<36L_&WQh2vb>(xXpU>~p9|-=dd+Ps^tUAh_9SAD(_)Gfw9}gqf*iuwg zLO?~;e|-D5!j>&4?gjlNX8uoy#|vzP61LW)gZCfXXP=x}68c{<+JDKReK`)-0H&l| zqW`g%`B86wo`0A6{;kpe>u)0(zX!0EP|@~}12|k$cjSM~%-_;6&vdrXTPUb&%;|4= z;otB4>no9ywuk=lpR4}vqy9n5byea2(S85>RJ8(2{~qoCnuZ9W-~G!wGL!<(|I=q) z&Z=SmpCSMIT-^NdyP5ogk)YN;c9XyPA`S4r#`O1KvpU#f>Qdi=7}0-RMC{A2`tQT} zf5!RW%m3fY|KGd+zjyyXZvG>$XA1;&XWRIIbKhRWk(VdEt3HgD8j64SoJ*`2P{)P2 z=*0*N?cK*xRk>dCRJ{x|tA354o#Wp_(9pTXSyNs`o^*+xo#jj(s4l!4r} zA2sZ@%2U=go@O0WZYvaOSGWB5&Lq%csnOtv+>0eE_en&}^f^g;U)o~eOdbAL=BJAP z_!u~Q?Biy`Ia_WSi&Dt`w?Fx1Fp-xnYXY5Un~OgW_NL$HKEkJa5u6FQ5Y8IvUP?{& zt>YZR`c5cQr(*8@r;WKKrt%7))vTPhlx9^BE2_WxE;8Jwi5aNmJ==0H3428zEXGB^ zES|mhzBr`kI%Sg$Z5l(fwqKFhsJk2LPuTszpM~vI{yh8-5525MoNr^yrSJsADl3#M zhn)R-_kD>Kg1Ne8BDyF2zC%dL95U~Z(leU`B(5A~3a7o0^CIoNNxGv)YuDWnxAJM+=x8m0FzHTu)ehp2Ehh~q za1vD^S2Ol4WNZ0}r})C#E?b%Uq-xTbny|_>yefZzyWVxX`jLBaVnFtiM19J+XI159 z$ZSMbG>5BKvl~LA+gCmO!NvagCMr(duB-_|_DEy+CI;Dgx>g2Ln}XUvDaqI?8p}dH z16jA;0XGi+ha16h`Xt*XXzO1{+h@Q;A?=^k*f7Y`_rJcJVG}Z(-GgtciE8W41)(W7 zm+?+BY?91G0EJ!bMKRJE56?8r%*YF4clVyyR-bY_BWdu%{)#rvjffzn6u>GQ8x3d) zL2Q;PB(&wA)5NFyB2MCAyG}=+76@R}O82`RRzF7Z8O5n_I>|E@#7QXhj5oW7xx6BR zUDXxH?maodgWdnmZpPz)CxA;R4oR|L|WX*Y8o-P zd%3Ht8M0c@*#=por{NMTs~dYr;x4GRGKecIjQ;TGM80}qnoaZWH_Fa;fwt8jIdMkD z+<1CDVBhO14czCQ*kpb-Ar@tgeJdYrMO~Y&vali4^Fwe9-7s zo-1qEnRsShA2s_yeWskam-tB!|MeoR?3vG-*ukcz-n1( z?xyNa*+u{jp(~5Yq?Rb&NBy4A+EpbjM!J6&8{z9VdQ^|vIMnKA*wC+>nHZiiod67F z6S=-{l&zrlBe=$4Wlg1~jy9BQmv?v2%--vDTTdsS#YbS^7G>py9P@E{tl$t;C(9I^ zV)^uVRdx-#Iowl9?)}_Dh=NSNNAGAL|A!?1yAyG$q1#BTpEsauqzHv$ag7a%&GvgM zX)t4yNo{<3(uy9S(!^DwBm?}8=d8}4b_2Phz$4U^6Qv4|WU-N-mZfH2Vzso&5rX`( zxJC7bHvp~c8UT#fBpZ3WT2zpEoqr6YZBk%Zbp{&rxoLMu-}jW*f3oy3r+(YzHNy1VO;!VKUTMIuHGK90at88SUWZF*gs}n3lV|qBw4V)k&{&M6G_`=| z`B%Pg2`aBn5Lu_Mj%P=UI0xZC1v+dvP~f(iMT!#2B{cZQNqOnmZM+XdpFnHdN^>S{-tcWl*o9&|VAgRuH_ZHw`w$^DQt z!%d%ajd;e#>rW_*;r?q?@mH+`|D)fc`siil6}HdEPhK6zX9^Qe17aQpOa-@X|NMjV zCI7DWOjXP%yMaAff}_Q^qdA=M=794F5jH+zZKnf@Gw4bxJV$MbIJAnia5(OIyV|xt zQ%C=>u-UgiBqXho9>SF+i3qr(XXz&Yel1>Xl1<*4UqXa8>^vO*oP8%+a)C@^;Ns_| z1E-Pg6;g$)UUl4+gCh*_-~l7;jaMJ@N?joPQGB)~)+;kI z5}P?!i)PV@>$cl9xL_vo%JNhPz`IlF(&hWHj{@C6W&EHpS*vOVE91LI?88u6OZprRu(e4|=-q2BYL- z>;CMW@1g=0cHlhG&>lsnMCl;PmWiaPXmM0<9bGe{G&-CA7l`QJT{yOHS0en| z37!Ry^zLMaZ5BQ2H?z=ckZQ1Alrr7lRW7SQwD_EG?gYna?Ra@KHUs3n>N>4aB$a1auc24fmVU%hUbRY85tLjgJ3}9TH#lSt= z1LHH&P5^EmB)r!Vwmi6`8%`gSN8xm*p1%;_OV!=~cHC(uI(*`;fc?ogX3^l8#vUFO z{wo+BA&Ua3&^_4xp2cZX3-D+8=y0drH1+r2(U~fWlK*ET}PMVz(a$w;S;rV$z@31h>_a@kfnlgJe z=xO<5UY#k4O{}YY_VB6LuJyv1-7Uf4c>gpQZt93Q)HYp5yLe{ju011kb*$q5WA8ho zn%vrL6$Mn9QUnA7s320LN$;Yd(xmq$O-krJkWd6vs?vK?I)vUkLIk8q4FN)x5<>4G za9{U#&K>8Ty}!Tr*Ea@#U<623R@Qo+Ip;Iy1yA6iis#e+aqj;2Ssdu0_{aWDGI0q( zOMIgS$KY7)(x8}qWwqSAOF6l9{jQ+J=n~-Wmm(Rt@&bsOe0!#TGX^HL`xQSKJd_E% z2mVXQ^6A775+&>7Cx*3>`ihKe)1~fa{JijkTHpqYv;4?4->}Y}`d#~BbmK@4^p}bV zLqrF7+&ZcQ>u&ATSfc2Q{6uPRs+D1x3&nTs7D@Id+oUs9PPy^$^5W0ws-l?0;|x4n z&JJT;n8d5qLWQy_c`HiwDg;P%#%m}in~D^z&M=BXZI|mSR@Q@QcluBfhxUqcw&T~M z!N|Qu%)|7CQVlL-X%>r2T*XHbc_tydI37JcKxov;a8%PX*YRccpp@X=|I@AitBr4O zd<ZI2CYtq?*nQqs4w{+4{{G?}JNMxBsv)tupT5(@2I?lUpTJ!HRSH&fKwxu) zl6$n2r-;=yC(4M8L;AwIpmfrwWmzF8rFJy~Qer34pI)~2P}d0RQ(uv1?blv~q>ws@ z5lB3(uqI;==C0Xt4|Qv4JbbNse8tbR7}yYy7Aq-T&!bn5GBq62kB$2Cf>BJdnnBQ$4{gi{&X-Bq=+s1`fT-bMPqJ~DrOdoFpM^RC#rkKR~Pu7kc_(q?f`dZRkJ zXgbti*l3*FO7*hy+EPCL;(&5g!uMtbG~;I3FM6QDb@-Etq>?J#@?Elc|0`fu(fd}= zdhn;d>Wkz>Q>fUC@N@xO=-n{OPdEcF$aBry69cXbS(OLTznyLLs9Je}>>y_Hj#;^N z_Yp(!e0yPjngfux^6rQ7#C-%KB#lSS>H%WjO*`q^wN{toUrSnc?6W%7Qj^sitvXwc zxGjx9@VMtTvPzMIBnQJj@r1Wx+XN+9i*yrMabDa%5%uX?7JX-+hCkE%vMQK2^fGkx z8WleEiXc9;fWe_$u8>l4{gm#X;FS6z7C^U)&}>Sc734lE=f%C*YPy7` zN_dsk*v|G$SKFpbHFOSbH)FOe=jK`Gdb7yJ@|Lp%kzt=oL+Gn))^Q zsxb<;Hj=x<-JAP+Jo32(2ALZsWIw?zT~jGAw!P!TXyh|Ko^9FxR}q`;qfklu&$pXl zmgm46K67=B>!g^HzQWjlAaluVuizdkSWT3FEJS+jS`$#$D(7i?ngM-5?|nrkAIp#J zwd{Y)2ohR9F7MHF*TlsVa*1ZKR0@yl(G~K$D%8ZJYfcP~Nxg4$ zd$v&9%~ZcNWuc=gN|RfICQg1CAnWmK3#3^lnSm0sd`LFG^#=}{uC{2=w$qMAdJz~ z`Qvn7-&g7LovznEtBM}28%$LEe0d~rt8C7HHQnU60s8S3uv3J&Dya0;bdC*rrH?jO z^;2)EQHbvZSRR03_~IHz)F2VKwV~$VmuTX}0!44ND4*5Fn5f>Ox=_Ct%Adlt6V1_GrIjiP1l6xx90pgIn4i0fVFd*x62sO=7y&lh3;saF|tDy!(8!TBfv%2OB8<8@|UL&L(na{Q3AS^cY(Q z2DU6OzmwmuZ%VX~UvLEAmCX^gc;_EpzZuh=`Oq)+>mN%D>l|-v^~~Cj)}G|~xug*k z(x$;Ouvq#T`1z`~W;*sG)guGIX$uU%Guh9>?4IPK=9i+YdSf4jsi$jtG%ZPT&JO3i zkOM;TYEj=u@;1@(6k=ocbTZ)WmgCle6sdlq177+9R{S(&#!najS7O5u}O3%KTxHF;MT zgA&m+m2^}~r`Wjt#(p@P3sH{J~S@`U7 z&bR-TVKtwX(d9;B+f$Dl&HGzTM;pcP&~A(0O=V3%K|g&Y%r5crADPCLnWg=na}-xa znp(6S?SCm=Srw^!ba7f=XgLtZ41JgB%hwXzMg*3P4S;zs~HnDOMMG@h8FqF zf7sc7enW4PkVC1mEYm!S;@>@j7%-uM2S19JfA&xR0{Gd42XN6~&gg%i{CC;?zy4I9 z$D4rpBXMsHvH!Ar`rG5oi~-a8mj67Be{DEmH45B%yJ<~p%a|V`!rG^~%l%GWaTmC4 z@ONEP#spqC1?g&)@O&b7vM7ybM zTO6G&VU~+OKLD@)`c~{mX3aa~_P4I=#P)h$R2KdzZog`FgIwZbdPBrPD?3x3T*9Fy zEtDMpom^(`$GAZ)CvA$T?H4A%NgedzJbPw*5Ezn-2LT;i1s>0Q$>AkMlYXLkG6O;T zPqbPn8p49-YVo{KdeEWKQWfe8o6_bVj6bL|p|)Gc(CRmKc%%&1e~7FKU5(d2wl;K7 zFFO<*l1z1DD8A>@qi-_}_nJm-)$b1q*l5RiCmMT^?6(}xL97OKC*Bi-{DvnmGu`ey zYog1*^Fg432ub=39@4`mkgM;PwwhepEN6;{I3b`5PXv?BR8b9h1{MGY4qWq-pH+jk z4Q{JtcAC8he<}zfNAVwxp4;YzPEDmNbsW`9u$EXL%hRh@(uzzHsJVI@{-DqLRq=F} z+ptRsefCM*ue?;S$y=yY!(LHwsXRh;p>f8qpQrRizm6x?16C2wrJIl<0{PAhJuNP8 zNhn2Gs=dy@=qE$q*r&dS8+xX)NzKeOWU`H?6!`>eNGxXn{7J0i)&U&F@Sfk^b zIF0)inIR=MXHdf}KPwf#<iWMP;n)-C5Hz=n~O!hspqc{7hZycm93h1<0G(=x{! z*9Cd;n_ZyLTQ)5sQ(4rea1%`8J>9tvGNzDpW4~Uul>thD;%KogQOM%QNB!yWl8;q3 zL$$H0Vr+6Q~k>L0l6tt_}^AfGmX2Vyj1C+uy9D>!?)E)1`KY5dE`9z4>W&XLsde*;O_H zo~8;ciG%!j5Iwc6Ces!7(SJg0bxH=>nkeoQJUDqM6dx z2@r8LCTQlxH~zF0$cw>FSwvSPgoLminXWu$S57k1%u}toYjW(rniEC(P227(3xUf>VA z>Vc?V&sFq=^{s>rBT4T|e0D@og8xkLR|7SxNj&iRvE3bha!^U;k2{J~v zGG3H9EbUEamNoY|0{I2bs(q>OW?O)nk-c$d2l60ys2));KWdxvEdIkAWbZElE`fDM z9oUXwHIC0#MkDuT`A3`XugWF2@w*wVIsj&YH*opn;q-zwQ|mTq^aKT!8{@^gNeOr~ ztx1>>{j?pBm;MPT!5z&{o^OwN55dViHY6|4Njg}0d3lw?FK7MwOM5F_j9x_VkE#hy ze%CQ{ir@F3oyv^gHi}OcB zV#oebZPDqz2G$M2CYksaFLVVtlla48w^4}4yb^}&f z{Vz3(Pqml5{;(B%QWK@KPM6n| z53Mcyr-RAGzKgqWP;cDzGJw1N;Pl6(dnwm^K-D@q;fWn7?Vc5bz*Xl2P3NDuUdLZO z-RtKCA4?sP)_7{u>IpeCxnn>C&eQdFuQMSgE;_!^hYOkU{dS!CIfJ1J(ET6jUekpo z$UY|cPlp;$>@*S%J?*F5-)hmdMghF+=fWzs*{xo&i0O?x7E@v7MDJMdV6`nQBhzsuu%E^J2IrBrer z=>}HHyCh|L{mS(Bk5uwfn=m})qvhNPp7MuTR%s?FybvUGrZ{Q@XipHXCcY|M0@kKuXf`z@oRk=-rL z4__S}-cfNMREXkk4fT-9^dD?6*S5)UX~gann_9tZf37xOwFBN_2MS7{(_Bq7$Tvx? z=uUl>2TvAdj8@;bf#u!@7q0ioOp1321vw#3p$0 z{aW8fG#KqKz;u1r=S;oBr$wRd-o>}{m?FcBj4<ZtXLeDqrK*6eEe+`9tR92R7BLQi-hTDk^?Q5SYu?Se%L~@gx)4rZ(Ecnb?pBlko!$LIYHjs10nLBoG zKqQ%gN_ty=J(FgZT1`%iu+ZAKH{K@GNBkz`pF@lFie5r=P%@`SPTrFDM(-nsv$4lV zImDS3^mhnfYai>ChS>D?8_G=QkJ}bymio5Y6?v6JEceESSM8D9dQJR#Kh>sZ-LFtH zwl!@0W z6Gy8jOeDO{Pj;dE&B~$sx*4U#0o56%?h7Fc)_w-6Y<%Rq7Wk!=#IW&#gV3OWhLj-J zk$qbV2QIVXynuaUuNis)&DFtldo>xn`;Senk8zjHd#+{L+V9eWhMKloAvfM&etXni z9@Y+j=JT4HvGgI7tuhp!FD-$@pZ##OD#f9k+EfUpPeHQdr<(q59;7p_{XE%EYV5qZ zs$`m~6^?`tj4&T~m|m(-B#LAznl3G_NEcN-@N8Wccts4Qee&b_IqxBCKJ-SCKD56_u-UH8nsJP#d!g-xHm@ToK2h;h8Nbi%QugYDO(440a7=%*Lj6gkpn` zGdfyord;ucw|syQ%aIfwSRN#Bp;@}Od1R|@6V~&GS_WuST-I=Z% zwnwd#MXJDjg~bcDw_23HiQACHjz0=Kw|rIsY-{VD-E7z$nO#_;ezAdx$<`!Ztr_9~ z`d_%o)$5$B08~w>H_l&7F!3kLpdqygoh2t=e07GwseXXw z)28^kEkAf>Syr)Ml+1-Fs;~cZL7~N4Uifw?C7YcW+D+|;P8-l!cJ6OpUbxQI0QnF{ zC(O9>_f)XNxc*mg`I3uM_)Db z{tcV6)}#^o$B*$85w5Mt`cDRdz z0$!KelDph!59e`{SrlHhNEW=S@-opwf4mtvy5BO`l42J=`ZuWSFZj?zY0#8(PI#x? z!>S4vy%zvz&(M?vBjRaGQBo6H)?Wom%dL7(X%3`zy&fThU&w9kO$b@^99X)dYO!C; z$({n#$W4dDq&K~fRtT%K+$4#L#68zyN=|7dL zC@>CiT+EJ70F?S2=64{c#OGo>`qH>UAqZ7*pmHR9IB?zSCWf(ldScxt=VOo1jxzRv z)EbxR?2P(1>9UiyOOh&tn@AU&HBxhSjY>_FwWY|?+hedx3cBB?17rX=X3?jw)M{9MW%FtAwfb)kk(G`~JHoWq!oS*V3-N;9n-q5$P394_rx}Z#vQuw~(vm!It$v1{`?%@+6=FyIdO3!C<>2yc999u4 zu2OmYh~sQ!XCZs$M}BK`qxC5L@Fjj5*5$~F(m@XG^^dpG9feF93I^Rmtr z7{JsM`A)vg`-4r{Apf*7j17Q_hvZ|v%~35L99W>qaMQU*dUS^qmvgsjT1Q8PN(@#i z3S;d&P}yOiw}85`a;H%ztVbHMZCs?Oh-p1bDUPk=LV(;3HXNf?{&rxSk=+_I3C38D z+v}MjE3LBgz|9qNF{~6QF`G=9THqaHeiWz~`EIIQj!p)?M&z;ZivALyf!Vnj^uB4l z)hvu2$yE%?cWGtvJki!5dLe=h|3>%}-&YL(6g~}V+D_OEQ|L)uVH1oKyd6B`a@Q)U z6=2Y6Gtnik%P&`SZ5(sNoaY1hn*Ds(cgkGJDyoCoIrOBKKQESGy-6GV$R#$1b3AzJ zfM8Z>%ec@x7igZkIcr{D_A-I?rCm-EgAP0VS`TzZX#ApeGa5!(<$gRENHGTyu`!b< zv)I{1gvpJIMX^1h-jP8#T`6n_{I6sSw5?~`07ADs;-cw%kLybc+84UZmiW->iI$TO z*dE~nemCo_$;8+uvvlw^_nA<3?&Vd-U$rW!Z#EQHpp`J9yW`Zlw~a=(8gON<6jcJN za%`#!5p;K6fBFg+vl75qr`z3fKt$k-CZmJ)fKCdUbPQD2F9*X~3$rO7*fsvHA)hr8 z#+@9TujNMF+Fx%|WcGjflS+bM>?So_pRizj;p=2oN~=q@??T06S*VBlfJaMS_4dY& z*joFwE^d)ozp6<3*j~p8%zh9F@9Vz8%`G^7ZyJi*igou(UrOik1?NjtgM3dG-W(fa z-iXD6``1c1oEThEDm!_b=Yw{DT<+E?K=uD*MvX;P_ss`g8kyR7`{4zs*Xxud?-~y$Y2LW+Gc9Z9)1}Kk7 zWBH!ajf{oI_= za-oik{ckS-V!f*z@z{DGqIt6#o#}Y1h+@V)#$(Sc+wLh$JFcN&(gczskS%k09$xQV zub=(eg@eIcTYsieEFIcsXK*}Q*uKmQ+a+NTc1ZFEVjm|^RnNT8V39W4Ma0n-WIJ9j zq)(S)S2A&^YDf|cIa8s@^!bgv{lf(AMvFnWnbzO5Dq)=gP)*GNH=%K-C^p_fQT#Dm zrGt{gSSCjdV=6(=G{Oigu+3e+6SUtId6Onivo|zWO>Eq0@AOL|GGM@#fd* zjS@pSfoP**Nr5*wVHOP#@$fM z%f3damb@wQurWhquHLkMWbHw;v|acoM-Cq!^+&HNb6%6qK(_sR?H5VwG<1#$SJSui zhQcuCfNJ8F{umflU4sC@xGfv(4|R=C^UE*qNgu{(DsNNy$_$gegf*d|N1xj!79k<8 zedDyxHL7R0tcvj|wB%86DCx#Okfa?g+4z^PDTD zlvVHB9({#Ypg@8)ryTZuN3eVYDfrlsVsC>eg1@{4$Q(ztn9v%5o3M3)<84tY9e!4o zWsaK04zp?77Q6%5vTq$|A*C~VpcfsL0IkJyeYYA``2mZB$uJQ0@0~WGZ}3_3@B;G= z0Q#Q$Fl%Peo>Jy`Q!x8$h>pgHTfu3Zv2k)<>TPMT|BI~ zYD?nMQ*rIe$VGvmEb*`LtwRHFo1i4DyaKaTXjx@*_9m?He##kY=cJoQPQj`1LvKo?frvkqnkLW)_R! zK2y8eeW^5lQ%$WOq%*MM-m+#pnh&x4sECC*wa|!j5&0wlaq*<8M;0EFr7K!FivX!h zA(Z2>KRiGLzFX;OF?+P>Z#eE2pH~mCtDO!jK3`|G7IP{^o@w8$78n}O&WWP5a^j*h z`pl5D;b)6$T(=};fp645_19iyZ6QZ)c;q|0vvR=*33~7BvWfcu83U||iFRdedwpEl zn(|gJwImEYhIPl?u|RYZ#$4FSCjZ)i_-doi*J+>CjMVGZheo*EtXhFS8jd-?ssZpM zdQ)TLu*7HFz14IdyVj!Eg@Pz14CV*@inlco-r66|&eXHtCIxsIvM!N_zeI`$Y6cG= zp^nhhtsi|tZ9Rp#^K3&!ut}wBk&I$}m=DJ_K*uERelL!eh1cFc;%_REz>PnH!~PQv z|4twxoAv2BhmyvNn38`Sw)=xvWSs#mk#44t;lC4z+%C8eC`7cc_uBofxccwDsz?pc zX&>rWvHcAg{VxqpAm^V%tN%QWe=XR5R^xw4v;MOh|5=UyoEyN&@SjukeLqRZq9iVL_&-lhG5hZ|g3n zq9*&c#=c*zuFqZ0Uo))qt^fm}I68HXr%r~p$L~a87X%FA?gc{N6dOG5*z`fkv}3cv z`LaGX$Nu3~*FEIBiPtq04-_LS3pMi$w&xi1%+0e~jxTVv4oCr1AJ*M?4P}s*0exQjjc+vGD{4O$#+24|k;b}FX14xQc<2|+rs~K?Sd55~l1taz^EGCVU zS70X##0(OiB_3Nd$O%IyDL~LR z!zk7OnSJ&^l33TDiQ^JYL=+`u1x;oL>!3)o!G^IUE#E6T${0st@%*~t#WhV!=W z>>Htn&{x_N$SZ-tsl+PFan)bYw3DXT%}b;N#YsUC`zJNwn=K?7FPV{xnVgi5 z3}(vkTJ%K3v$b71F8TtGFJbPFd+at2u2LFzns1l;Rbwc!zIOrHvqnU@!g71|5Wl|d z;TB(LwECS=m-c_#NKV7;q%uiaN1XF{6n#fDF!Nk1c2!$-`PU+?zi@6zs7RrGf zJKaL(%@`tR9vgj^Gz44>D8$@P%G0DEIypHx%jsU|c&AX9{WbU|vZ}wQ?c&QJr}spe zwqeMiA1w_H2vqiLQv*;&)RD8lo|<=_<8Aw~nQ7A>!3>MjU{f-2muxdixk9AMrBf28 zYfzV9lL4LnzA1aS$5GU?0|?&P+_KgDyc@YaNxKuXh}D=Gp?%j1NL4eB>xqPsyE++1v5Bt7Y*J*S`JLtxULPG)1RH%=o%|u@}{4j z+GO@N?5}=({*iL>r!|iEu;q&dtF?s5nJ6=Qg!WI)RR!IkXp-PPYQ~2n{3E&=&nwg1 zHcwnm7yEfv4%P*aU|nuQQucyWEjHd+&PJ%0tw%`m3)ZWYELSOa3<;>~@U`~H@?tqN zU~prvhk=QWd$Z&KJF2+Vb}1cL-{ORp?oAxx(Lxlm5?;GA%4HtV@$!A$)}-Bsjt47g zzJ>4CwGfPAm6uhoeaV~IDlL0CgNdMaJ<|Z{^gzOME3V6KQ+`Ha4l_|2dk4s<4ijlM zWJ$U^cJ*e22r1t@cVjwYL@SF!=tCXf7ZC4>F2b4bOK_<_4`{uqf1lj`xZC#(9S84MBL3 z?FNk&@OOQ3<%t0g1jb~66=IU(U2BAh^3;oTeyJnWod=faIsXk?_2(u&r&f=R8>{Ij zZU;p(OFX$IgV&N~5*>cNkZ20+CDP+-RyWy}_8+%^=C_A4flLzOXo*Hlp@%j6VtEAheK|y;`Yq5D(_%q1V6?LifX)fX$DACsLShbf5 zhcVJ66p}_)w}yr2l3>RGUa45&QsD|o7vI|y9C|67e)j3Ae{@F6f%!}GQd9aC=x=-G zaelQt^<2e%z=mXH4zl$b2qNz51BuyHpBDrjT0~288rC}UtJM-Sd&`1+mKVY|h)fF5 zh!%)pn+l!GU@OJxrW+Mqd%bKR!Ea-eVjZ5P>3k=deMw?BBdR3z0N43fVS!JkLEn94ok(nO^yx4X%tL9C%Mc0rimjAc~x78`n!++6l`Pc zaV99)_fz}CEgf7jj+lAsXDy(;9`AJQQ0?O8S#AQOJWtP3;a00Yq0OEB;p^10=_AO@r+rt(o)vp~Ei{YK}etVz$x>*{;D&*6&hT z&eXf?$&Th#`XfABctO8#$D`~)(7kn8vE16xVtDgg&~mx<9Ck*(c7wZ(*0APFuV$Ve zWX=c2ENh-A<)g>KbOw3Q?=aQav*+FqWqF8QYZmOIvu2PpyX+#Si z(`Qx7kgSEPpgcE}U0<5`Wyd46${(YBt8$S#NfkN`u549G3y~Ma6Tqxg$3(Q9Es%cx zGx45~-AjzFDL<-zVYwNG9}uau-DhtC@sm)U@~A%wd7v2m?q$>FFFl*i?71Dg3_+VR zQcZ@-sI$Yv#!m?={kloBL=v=7*Xzllx`@P^RO~7HBzu_Q1rH3wyDVBm!g2Qt8zmhz z2ZhX-a>`R%2RzxF>a)v*vp^dmYmUv4+nksQysiHY+?`3{J~<}-YXl4LIJG!WIpY?!Mt?I03nb7$eNMVjlVcwLc$)t zl2ilhCspxLUo*aEZ-_R3Y15n19nl&Rez$iix`}X9Qhd$eE1LGaQI@?pi|hfJxw=9G z<6|G~G``{D_L6LZZ{K++ zfv30{h85z%-Ao5Tv@B$3b<|?m?7s7AZ2#65w0Q}P;ttR$`b6FnNibu&u{qX3P86wB z4Sq>coYkn&Qq9M*Hdhr!mc;M;BIwQe_@rs-RdPo@_YU9XI`nJx!|R<{^pEe~pP7y# zrlM=^=qEXR{%kGAI$Dx*)!j@_uRj2RobhSE6A&Z{J^5jNcyNgXDX?fo z**rU?lVw$-+b`%Z7|9*;p1eHsK)XgFq?DKml+~ehYfG$sGd}x2yT~V}P5k+;y0ln+ z{Bm#ZYxTjH?ZRz@n?3hXv-l6=;z9}-F?%Rl>+OeW;BM@>K6mU+u(s8Fg(lP}j1AA0C&oPps!=&N2I zb!Q4U_&r>%`$BOhSES@}bkC&lSms0e?FZ&H?Fnc0qo%$v$+xxCouRVlxR+hr0sT}w z22=8OGfRnu>B6SnYah?}?me4J5wah^`H$ue__hrdMbY3&p}??Et#HTwz1kNS=acAB7~_55mp6zS@qmSH41p)OO+SMG@WZWaUf*XcO_X+vxo{3JFsGAgI&n z`96D|h0NytxR6G(i3ip)ojn0kP0kDV-R6>tgG6fO_(H)XsSloo_)WbwJjlM1c74bB zx`!Nkse=GCDDVB^1EY~<{X{wQGn*mMY^l>s$qcOG2}$Rd_K(+;doc2m*N7?B2CvNC zEy7-mfLg0HR*8+c+SY^u-OL~lzO(Ep6ht6WMMMHGz9pKfLxeQIISkcNsVdC_xq{RN zbzu8!i(9l$xGM|>N&V-473-?GUFkUKc-3PHR(p@_*ygebjhL``C%7qgVV>aqw(CYYpVt(pzBv|L76FK;cevcU4iFKB~dX4>0 zCCn07tr+l0ei|bz>E^r3gIPlcsOIS>Gap66?7 z<4bjaCj9%t5i*M1yBp~w@EuRP^91#1YEq)J!)@NroNKkvL+wD~=f>&MjdD_t&Axa3 z2)jzWbT8*n&CdCP&#E&161gfra0RB?!ficxG9n3MIR}O$eiGd&AfBF5ZVAX!PI;F> z$9J}^v(4;%djI$Q9j4)SDq;kyISaBBMJ%w0TIjhJ{Az67@GvguUAWxcsO~GS$6Hdu z0qc`+xMXpUNHbzV8=G9t^i!9LINrC@PmU z@AOV3l2m)KoIY(mFkIQ$zSPefTKGs`m+M-#qXI@gybkR**VhAX_&3`f7Jc{3p51w!S~Pb;w$(fe8Z$HV z(2{Bc?mS+7kC+prjeGO22yz~=rO}yogMpfI}9H)I93=1IS9r%6L&K$(~ z{HH;UV^w7vpcH8$mL6Yx)kGmQ61M6rn*{jkAWgl?Nl^1ZKg5qRGw8&VP$0~e%#Eqv z2V?NNik?Fui5?}l%2YdpCT;`4|Y|1^^3OwAHta4>_7eBhX889Kxuno6$<{<`!XpURp8&>P85%tOTd+#B~2==AFuP?)HaFo64R|E-{oTVjV)!oeI4Dq89?y8S&G>Ko|9Z}3VTNkO4>nC)CfV-fn!wT}JSu(PvOjviy(Q(VC)3%m{KzAt z!(-W`dKTjD?o#MnBq!tPw?u}Eoc9Vs#?Ia3t}C)Rg8CO|K1=83d(vJ*grl2mwdt&p z^d6QiMJO{cvnYs6&&gx`&hyL#EflUi_xwr@uS?YUri8rIU30pz>kM)&6C7$jP5ukR zU;*FGTJ@Y>do;0k?{>gKymm|eF7#+dU(n&Q^d8?d|5Q+*n0o%YoO6iH?iznCc$z)0 z`}8%(wNa`Eg9=mC8l=<}WEnj>&>pQ($Jr)SA>Yx?bhA&m4@ss5+=wn#$gyQy$2-i1 zpNMbgUeL~mMl%*S1k)i_B5z0R=3#dL8R+5Qe7-@A;ZM}PjHcT{ckE|g(LJ2es44PM zF*jEvJ$G#QRzx3@EMSvhVW9h!X2XN*Gc~K??ZxXo_ou6tk7d$I9NrKNQGI6(n-nCH zzkv-5Ocx%G7>$W}D}4Kzr0R|BcOuOprW3Z`Iy&gN6NINfTz6vd^E@LpdBW$(-yXag zDbdZK#Laip;_jT%4tFr|uiH#hawT3G)=W3<&k#>hw`3QP$?{uGOIY>Ajr7Tu^sKFM z6hD~$^#1HE%ctR|D_n7t-9CLt`9Oku7SyBl{4IBb{T_Pz$(K`*kX1F(aB98jOW?^3 zb~_Fr4o?uji7hd1N;sryws$Q|a#kR7lWZQo@6WEh9!g8~9?xiCEyu(A5}6gXv)Lm- zNz}gclFO(*hHTD-C#0BG^6q)iZSo;z?^@aRfH3N_yP!G#X*3!pGkD!OpFr=tzjqSZ z@Y|o~MV@nsvbM8Z3n|=NTjs&BXe%#RWpd zpUKJAcS=zo%iqA@*T*rA>uOnfOUu{tQRRUX4q4>Ol(&i-uHKhG-I ztoZrSmc4HPw(FQvM3>+27Juh1lX>0zNdVIJ2g3id#aVJI_Qfaa+Dhl>?#{(>E9arG zrR$W}U1luq_!7*OM3vXNcE3hN%W#meQkjLf>pTm3Nea16ew(%XQ?ejI8slxmG&Uwn zkVKn1#EYAeY~CaCIy7mVNVR}Cjna&`U8ghUp$(;V>w?}G2?6_Hp>b1fO-qKjZk9Ca zDK+VI#QWCgsM}4b$B1M(8{&uOH%Z;~>DP+i_@6}Xf3Ayt1M2*i1v3v0aI+$-3VR~} z8DH;uOtCUKa%MS{(bepumKjwM!%{BxnR%1?(E@;r)O^#cU>NV=e0R=L(s|*!=N9EL zSK$xbgnPbWzCXL-H-_(&ZyyL2RF$x{EQ}SzWObHcg{Yjnu zekLgzuXKf$7j)PrmjL58_aK7o;tMQlEv^B2u?rKzIi?IrK2L)k6)kc7aAy02lvu4ccIa6K*2nCX%h1A9Cc z2dAXzGY8o6d`8Eo%g{=Sd>=?Sgq06Y?r#pBP@P@kp5gga$!5zr`+Y@zdr^+(sqvGw zA3TnsbgYltI){6Bq};+QYDWEJ#|GVbV0prgc^CoJ)>BQ1f29Peljh_#F2=gyQ>O5# z)3Xr5T>=C{JR7E!4W&}yC;3?FLe`F$gF|1&Fpg2*F7-6G>n=Ri)erUdnj@d#12s2O zP*JHG%5btD=I*F{#HEWAkcC(2YCiY7j$JJ5p_F- z6jEb;@ixF8d?Jf%uva&RhN`^)ACUqJkDBBi(b#3L?S}wpJFT!FZC-kc8cnH-ahJhkT$ z-i2(gydm_U_zmM?!5p>wt0R-X2zgJQ4R?PS_!Zf^XHK=%5y?=cI;caUb1yF*4{$*N z+7hFximKIJq<*l%MlGsIdAdmhY|kWNQD*$%52~G7$jije@LYVcQEt%9&_38aw7Mgb zPAD+6hH+mo`n?w9aonq3P%0$?ov+{y`8{FTzfaLOOyu)*)oJCMtqVIk?>H{Wk5q7~ z<6I5djDRy<_Tw5p+nuN?h(w#*wGQv7J3VT~Sh4o?7Ysaajk!+gBo8QrPHszG9oTFW z4l_E-xKc+UE>&vF2jBIVIa-OmFgAU^2sui938orHa{jD4=uYJLDxAAu5Z+k)o5bNb zS{HX~Uf)LL2Kc+=*N9oz4+6{3_lVEMR&+uyhfDAkaK`bSo3R6!T=p)Rv20S!NCOdP zy5KqtuX8qeI9K?(>IjPZNAJuU5!Bf(A=%58yZDTWH>kOlSr zp6g7f*c$Ov6@8`5uo6lei`MwAX($W)qB3fmFp{@AIG_dwl%=dVmV<5bTn`+hgX1Tx zP_*B?LJgyuk-iN&#^ec_J4+*KV<^tLIoRji9&v6u55T?sJppfjD{HJdaR5??$ z%v@|pEV?+#ipYap6gY=8Gl@gsWmtd8Ff9@}7u39nKPupJzYcvd$z+cq&)t*Vsjpxi z=|9nI0B#FJOTZu(+iB%U?_Rhj6eBReZM#|Bn_)WpqRwzwe-`folTg9aTn0^4b7ZVh z4T+LHbydI#6uN!q$Ie}dblQAFsovN8Qw?|ZLB>+#GJTG5ah2$c&h%!Vey5;A>c?Sn zhnB?nSLtfxEMjX=MXC`?a}K2$0m0Nay}R+>suD-Sr$6dAeA_TJO5!?Fl)D-q!_T~} zb?}^3o;YMz4q#mt)LHHb6>3LBu{s$zva*PxM!uf!**`n`*eNV}yRFLDkc}kBpVx&_ zC4^Xiz?h9xA^ic}@5FLc;pITGfbrc~Y``fbV*`mp7IGZj!QqZMg@*k>n7-AL#~;i0 zlTMvupX^RYn3=(0V*}2|`t33Q6UNyBJ$(;y0u)h~pEi(7XDxbopVpim7hjjphD<){ zQAcj4X_G&6n6K&2dgi~FbHOFPEnNUdyG(JneLOJZ z0?6LF5UpIzxZ@Im$W>X5uQz(*=FHh3ci42Q{n$+M{d>f@Pru$-`#RT>F*tFCk?N3m zLTmjTaS!J~`>KH4@(}c~0E?ZVx47wpwt+*l^*K2Qv#12f55(%j{#q)5Ax52IHryYz zw6V8Y$alc(1*ss(picwi9OLmjVqyjC)@%}Gd_Nib&9D-pOVlXb401pqAzydTFh@F} zXwxRlA8{nyW#`3x#0mJORor>-%X2!_Ue_Ih?9ZT-gSrTmE^2>B()|( zmMESqGp$k8e3g7dm*Tn8a^t5oVOjiuaAwHWZ79P%XbY2`gDCUvW2C36a)Fpl>9B@#Deb6LO1W;{+}x;|0egdT)S z^6PnSG)Fe<7Qet#I@-OgL#8^YyGu=8l+>?H&eMLNs7s(IPb)}-$>ZmU`1&MXl_uDt z|K2=naki$BzvuvirZb|(7FUAc+? zg1OrHb^%O3Npr=T9L_cD9QqCMF2-8|ADic^o#e)s3Mlz%GBX*4NDeFZV2Z?|m7ww! zxe+(&-(f@+oEwd{X*o>+2ZFXc4AUzA$aLTxTL4?D7_#c&4s<#)llON>@TxIftDp}C z$QNAxguKx6t#H zTyL)}VtW#VSQsQRV1}QvWggGy_Cmu}j(iA>r&SqMbqaLC6i)DB9&C$U#hI9cArfs< zsTWII-dtB(o5ZWkWB%CvHIhgA0p5EYis8AS*()epZ;`8FD4TO(uek+A?-!%pang%x{)+~ z_nVnRIN0Ew3Aex%$@fo}{s4`=phS1lXiHGXZ}cT3m|yVhA!!-H`jFH+q~6dTP?z9X zyOkNEX>@afa)HDxXYnM_LY*m>zt+8wsJvte{(L3&iI6%gB*Z`r6T90(jF{nK>V_N4 z`Fa~E1)^Tb4`g2&?etYTH3;#QuIXN!u<5mHDmg&}DP&S2JM(>8AN+^DnT8ZuR7H))-rhfUW1VX7u2P3oH}cn4sP4AL89+* zK_3@fe~xQt2Wb$R+z_JeiCu6;llsC-@;eNB5h9QhgcBY)I&7^?gXHe!&B6Q6^C7|u z7>lcQrH1sO2&>^23_bnbfbP z@>(?W5`dPEpvAGdYLJJ|%=D`oM>2ft&o+~uhH&LhGYQ z1hV^l7i8g?3@ZgHY$ox`lt-EE!)K(IJUi;}p{agLn;=3Yk_;mBf#c7}Q|QJ-oq2cR zfyCGOb`eI)d1;YMRNLb}bhPq88Mqje7$MEARN}-Wdl=a49b^R{D<2zw)^O{SW!}fc za-`raIXe1tj6rTL)8ZxdwPzGi8Pli!nS@yw>2JN>HW^yq@L+fGGN!Ci5QLmY5oF=c zE$8iN1Qdh$BAj--+!!3v>`=pP25ojWV!aI`nNsEP2DZwExU(i4$bWvdCxkWV%Nq8dWa9@+^rda z-)(xUV!-z#j6(?~Y29r!NQaX9ZI0suG}1_w-YKVqMr-B}5|lf)uM8j0@|?R!<#Tl* zPCEyWw;}+aihSZ)GNtC{z0z>LChRiwRNS{daTx62#T<0n(Z|0G{DlcM7b9?8;0)b( z*+p2Nb94Ay@WJX^7uX#h!TB57@JHL}9ajv{wAHz#tPvcVE#(Zh@z}!-csiM*t^2QAAE{K1iEZ8QyE%oQ-5-p1u}lgqI@q1_9;O)qcI*HagPRPKw;ZV- zvUk?ThgeRo*HYHjx7PhnN(N>k#@qnI^ypLVQtyu1Ju4jW?Y6yq5u%kC>v=c0=G;m< znFpP_m$m0e?S{oao?n#M#1ldo|ZBmLl(j<(ijOs{H}khZ6%@AI;c@6-=8-> z2~FXl*z~WZ7{}V;zB!(uS>i^U1IL)~*&yqt^~@aByH2u}y1l}`i30a^a^$+1J7IEh z?O%Y0PPMnx2?7(8JgJGd+z0|KPx{*${5>Uqk%LAN zy+4;LzL|`HD|!x%%fHweVWLxyk|9mF>rBMIrmnZu=G)AwLo2W6%(bPv1MX^;-kBCe zGkn$snHoE-E9QZ09mbwoIlq0#89Z~~uXLsws&%$>;?HV?P^yGqTuBmcrKX=Q+$`V_ zZ{Z%gFB&;}h}T<6t6q5O@=kB*TzK9b3=ZGnI2_9?hSu-yxEE|Wc~JdcRQ2G%hiZ$j zE*f#1m#pd|E^ZHY7uU?@a(XWu>XkYldvoY+@$CHmU_ox^uyJSkQV8 zO`ToZ>46TXN!@Aq=|eiWehBE-*tIKz_n0JvJAnn^A4vXl#1vqE#Td8o{g-e0$9Lz&0wyTWG8bU~ z-!_Z_=n?fmfa~uF;eY*9q#C(yeX0M2!M@-zpeORPyhSCm#8ag!iS6_0O zX@9mv16kk5cJ6ZQwIw0TJU(xv;$z1>GmRJdm*IbzVj3zaDCjk>v*GAmAcsX`t0Qz} zxx)6MO#kCMWYqX`w0e>a#Dv)X7p#3dsk<9<&RFY^?L4+gVbuhn&t75at4Ej5yB7Qo zGXBF33UX+O88N?ujE6dp){}i?%x7PT=4m1D@J5k#7+Xf|w~{Ag->z&;a%M-b?@b&8 z?q0@}@+Pt)M0(*s-$$%H@zeXg_Wb9Vn}=Iv>+il^NZwcuCdVv(n5WTg9SrQ*5(uj- z?ufvNqhddZMyB;(eRODoQkXzSNNUtr<1efK^&+wpL=s-vG2>WnQ7FLQ+0`K(PCv7L zTq{dSMk_4Fm`Gn*%4}NTP{07(N|Q=(X#fARm=&5H??-EE6kZk_spJv2u7FAnmR(9E-nR=)`k;V&z4E&XWkRD#Poze88aL^N1W-2H>%0iT&qyimqftoHpXMcIWBQqEq8=FUt{7jisaf*QFeP(56dwX}xtF&lLN@+=R^S#$M z3|mNk-GF>)@4-SHB@fT695;|Y^^1K;la5CCVeWi?iE%o>C0kTD_5S|Gs!#;Md9?={ z69eNo!r)B;z)I;&<8xgHL_i*@svja?iu7T3+<{YX44nZMyU>#U+^1oM{H^;tc=NgE z?^3DcgtSB|3SG~5!a_r3upEpj|7pP}Bj8egR2|OP{@F3!&qxPSlK<2Kpnw`Vijjx! zEv%Z1RmoRP)<-1eWnt-U-+KT2&2g&@q~_wal(KTHdnZRw3pzn53K_>>2M4GGkcWxy zRr!|mGT2??yKxls-Hl}1Q(IEm@)V79=)! zACkc!M`%Md*kUssaIyW;sZlO%kT-m;!8Kw&?@Xj&3358n{=IbQt?xO{hRY=URTj}; z>E(fYffAazxQYNVW&h1PVTRDjE%YA}4owVG% zHpi^aTqs4DSK!bceI7fO4E!$utIj8s41VD;Crpjgj2!Dvr8OTzXT=jOAW(2=YeI*5i)1tWT zHl>m)E%p;ND|Wlv0B$i*BXM%QOSqn!Zrqb!I5*u${6#JUD^}!~-;}jG#Z0 z?qxtGi$|+pJJ07vd``<)*TXu!-ne4@Vj@0QjfRW;ITPI#`SSOq14PcEw94P;v&17x z>su#8Zoc%?jk?#W{vx$ldM8gDUM8FPcr8P&_FhG89OUGF}}VG6le zQ1$#tHz=ePwUnUePT4VG_t24`8{a9LBz2}`RbdBICXnk0Y*WRt5tkcY9$6JKsugI{ zY_|c4wpUIZ_0l`zg>;@4vlK(%n-t~IUE|sEAMuRfRhtIo+ACwME%8tS)BgA$70Tc3 zUznbaN{=oV)#YfO;XPK3OfE+7AG~^bf$DyAv@9|JN8pwNwSfECMqQ^jl#!)+bIMCM z!n;VYvD<4(@I%d07?_UdUc67R9$ga!BQ(RyPxWq}{;@3H`a<36b6Va?Utb(DR+vr2 zYbkr}&*Ue(>y8|O8!aNXkE0Q|C9!I_ibn{sYPul1jBNI<<<*>};esX-$N>o;nTf8Ke$3~^lv_;6QOTxI07qIz zePZ>Du37|yx9bjdP3ONxRckZkFG&M*@WuAS#?#7oeetp^#{Dmqa^+&etr{p9%iVN~ zrs}WJE=B#1tj*Lei1@M#`MJKTmuC7u3!Y-RIooBNtJv3B@?6@9q*G(SDu=Cqx_o&* z8dCVKKe06W&CL_op8&Zi=FGE*Q}jjo9`>uWSfJ#kd$wX%+3Q~LgK{xL&FQ)-2gY~v zD_f&s-2hZV<5f4l=jkKi)aejK+l^kDGLr}ThFB9oxF_4dA8}Ncug&b+=P>@(t=*!! z!6JVl-@xjd3KRL8d!dU1+cuQfKV7;_%`f&A$Sr{S8@be_7}tXa`PrsPx!p3=091S` zr$y&LWFi*P0QX~mw*n(V0UP1P!%-FBxYsXJnos!zv@0zaXp8G_zq?(IbdA0#t_sHL z>;q00(MO}>ABKMtN2?NBpi$IG!^kk7v zU;E(M?o{#=v*=n3wR{i!LahcBx~9oM+N)Q}xUXGKg1d5RJ`S=P_eT~cp|y7b1q!o` zK&o4+6yGYgZRbfCoDiVeK)dOnU2Xl=biO(Y4v4pbQ~1`;YtP=*xR4a9mns6e7ZRW% z@VWT<*BOZVP1X`)8SOd}yin@>OcAEn+fMT}Ta$G1AzRsenJdn0LyQ=QfFsd)yfWdA8~1 z!1W5K9qh*^UYy$HEJ&zDFNM_}EtfRh&+7Ww(qe%00v65T3@PDwt&48Rffm%2SRG!y z2vLBN|1p@lsKQ(mEt3S+xH$~k*DEs)L%2cTDb%)D`$=rl4Y1#gREo0Ft_O(CieSzY z@RaU?%2hL5!#>WzI|F&twOa~`k z9)x9phPdECgyCTvfGdbrY6VHcXlpda1*P^pgGYjz7{4` z&Ul_K)TvT!ScjL0B6|%KEFG}OU-{C~ir{+g7FKN}INKExE}qdVkTfA)I=lla{;=x^ zGQg1vR({}_Ox+>$2GVh0CHq{e0-7ZL#9DU)dW#vky0%8IjfDMdf2t}y;6a@pkf7%< zzB=8iGF%?eD^O?F2|A5Ddx5*9jAl{qq-5n$@?;ACqjohm;3Yo`mj@UOn?Wz`p)U|d z5vKzu&sYebiSw|MB5Nx#TTK{TbQ}~><#J23&UB9^ChPAk)Z=zu7S2uUTV7s30TQs;O2=y6o?U47kEP;C5aU91bdj9yt&0O72VFd4&Rv`<6AFn3qcADO%+N4k?>(y{HGe zoDL-Kvr^_e1T0QskM%c52_q+0TMI@t^9Cl*!)lNtHmGEYBZ>HGwLoF66RuT(0d-!S ztUGI|C+~w$f_jfQ29sXp2d5mJqYR(CfsYMyS!SK}AF^_EYg<*~9EXfMpR7koJoi~3 zyY-)6$pJg}KC3A-mc6>KE5)9LJuWw!s969v9V$Y*ln20?7Bjcqe89y3-LyGGb#WBx zRWK0;6^E6O96B7lBV}LKxjW-rO5EbEPgr4hKbYq>JwGCkKD>6r{vt|8?R>h){>Ei+ zo;#Y+iXUmfwu{h7`>T2@bpi{lN$g0jlhuzeL_eLCDFUF(EhgO2!%{nNQY|d0ir`w7 z7R2B4wtE6K6t~|d@+(k8UcE!=^?IpOA@$s~A!|j0pO9^MHAJLa+yf0ftnBegK#%{% z?W?m2@r2n5e%KJo%B=gV>Qhu?dp#Ug_Lf` z2NAokg}u%JDl-)&M4a66edt$B+OTkl2D_B2{i-ix8OGJ+aAfC8Y<%OKvOZ=`u&1%M zx&gJ7bKnS4j!Kt|9A|OzfYUSD)$kX5Qs>`HtbtPBfxemq#HopI3kI$0YCAdg0Pzo4 zh)M*Z>2h@!=46-6r$1-77{lw0bAZwrcMW_wKLlZoKOQTM{WK@Z#g*Lt$q7TA4^OzS z1nS{h=4&e^Xy?q2E6G*n9EV31b50V#;qwe9_x_wrqSg>a5$ga6E!~bYAd#h^ecX$e zWLV448uS`}C@{Thm;&8(X}o%|!m>_w`7TA0uWZ*W6&=RtT%Of}x&3sf2jy^+mKK}b z_zckNVr6^}-WN@=Zhr>9J2!!k55rrZiJ{q1w!fVlP#Z~RV49VB6wrxu@o_87S+xx^ zZ)Vi=pljkP2=yK~m>{O+)FW!P;)5i#(ao_qF(MI_*T5Pc%et!0C6?Ru`z7}G*12aw zk44gL0b#Rgn(<2}B2TrrFu?tS+I#cY;kDq)W>}y5rOzR*nW&sES;3*rJ{iQO1pA23 zd$sh)CLQgS%S%Py<3M88gd_o(*I2u^DCysOuB(DNcZ)tVH;Rae^* z#GsjQwM5r7qjGq%GDPCzQfAEJG^6tuW6Q@)aR*9H>2HxvNUvmoyKTIL&?{Hxgw#Ax@U*1o}Kz>0^+E1Zx(|sPaQXX*j>n!aA z;_U>ieMvs96NC(*6CVrP4tAN`2uLlZx?hGT*wt^9auF@1{sdNYNs}qI96|wZjZ=so^3r;_7+3V%}yW*J_gcYS7WGX`S1J!tX4;=GL@$&yLlddi|L`ci?g_*4H8}J=J}%G=XP{yR$59I^d8CEj`td zRBz~6ZfWZj*rm9gd9#ul+oMqo4u);h@$5y@inwjqhh~Gn(14;R&@PsGNIUc~aJP|O z&W8EhDVL}(T3oF&eBa@_B|``pOW$T-+H8BZr|?rUXXH}y{0tS%r`8N@G#E;ih5WcU z-J*~)>`v+~+%n*C`&86Gsa5k4)8)RPoaj1Dv`b9dTEFDou(#~fGyZ<`SRs~gmtks^ zG8&ZP@#fKVW~e=R#q%?^Qi}x6*$M}{l+vC3swP!T2iOq>C_J*-CUePOeR%XBHU3rt zd%_&S01)&9B>2+4-RzmkQo}>B%-6t+Qn|DGA*aeU!Yv5ZkYVY>i9#y=S)`+*`axE7}x?hX;kX z(l9;pP>#CZRA|zhnWVvJ7IMY9RJrjCa`&woe?fJENsr!gz~Kd*3{0Lslpg}&?YF?U zg2Me1?Md8Z9QBRM?uBDBE8c|oHoC1G1u?^C`IPo;E(mIG@rg!xY$e@lIu4Q2tb?6h z+&~J)c)A8$h-q`wZF15OWxphvfUWT(tk44Aju&DmzV(!>3Y4JJc%SS)E*#{tkJJam;>rQC=kxIDws z^$Xk^-jl;STgOu|?k3M-7h~esZV^xE^$`(FhgH9iGkCh|coZ>x6&|JNqpxaqOSiV6 zTg(oUURSbfZ5AlLl=lFzWoQ}~_qPZ=ddgDR^>3<3`3n)R5r}@EpB>w}+SfJIkd7x$ zrz*hwL8SPN1{QgF&6>K%AL}=uWSMz6Lmb55PrODiaZY&}7`Iw2HFht&+ZMxx>VHVME$4VIXIE z=<95l%;cGI054Avb&QnT7fV@2(S*3rak4~`gXG^m(9t*N8X3Thz^2N8fUM|sGxI&GRi6JmZMI6g*uGk8ofV`@}#}8ud4denbq?&p6q|=c6Fq zU&K)B4CN8A&L-5&T|^=*e)46lX;{Tt zwX0k8rQo2NCG4d9L0|J%BY44$KKJITh^TZss$_6oozDH>Y4C+)f7srEu%z^l2e+Ad`+mtlAlY810*;+y0D*@B}i<~#@RYyBPO#E<{Wg+x9D zebvD$UYQp?GWZKkCGnO95{>Sr{PWT<9xdASTr-kiDMc>1fpW-?uVK1 zM}CIZNHv6)P)3bJecx!7n{l+RlF>Yg8K-wGtB1%V(IoD=AWTkgg0y`6U#?+%7Zpiq zH`TWM=ji@tvf0~{TF~ZZ>BTV!Q(_Iy4f4S(WYy4Mqd#e*mTO%mEU!V-z&s<3ZE;*# z`>q-iRz`?L9l}`@8#gy8J%RarW3abk{XF@D#24gGd)^}Y)+N=e%Im7$ymD){W{f$j z*rgx-9vgqz54^Cp0ET8`<*fz}0tKCS2wz3TOF!b^@c1BDSEH$Ae$4ABmyoybkIQ2! zsQTw)1m7uV)6ad^R5jP4Gb~OfBP4dw=*6a?dBH9deD=x3who5(5$ym%R#50pvvLWk-O_VlLsPO$1V;Oam+Phl(QIB!S(Ra@aPS#sSnlB0y#1( z=+0#`bhd_#t(dV#UNG)>IQUs<^Fdt$3X~qBXXZ~ILDXz_m}?SMoQO!Mt+y_-Rv225 z0SIv0K0khCHGj4Bj|jl(pHo}rrRkW>t$s(7V(LiJv`JzF^VIOv;cQz>53CiJV`NWY-nN1rHIO9m|bIu4xpy9sdPL1;e_g#iCd)3rGmsiTJ+ec25{ z@?J@>xEK@jH%lMTy-V)bs#8xhy(|H1pL+B}Gna)=Y45}p6WLxvkz*5G(gyv?QUW(_ zt{_AIY+!I7m}GWbPpp&AuV0e}_tM;TbotMImtcI%<|d>W^WH^6wW=hFGuA6BZv*AJ z*d}ag=NYD08~y3|lnk^VVcz5IT|u5Btgfw6YOa|_BynoQTjgbgbz%_r=yGtx5p)1_L?z;VZTL?TBFo!gwOll~O9?-q293vTUgMTC>t*R`C zq6jeFG~&^VZ}uxh@g`-SKeTbir637Zzfaw{n_4XVe%36f(P&X<|9)1gp}Oq-(i$G9 z(u_oP?HhRk!e0#vnEsC|oBDAPW5liQ$l;(s*QB`*;3-?*ZcxtpdzwaUS@XyGGqyd9AUD|TD&>iO<;sSq3nGQo{zTWV9A z^itO`x4l@o8+AQVn6a~O0^4n6VWyxLQN0u?Y2Sv8gzyCbarr-6>d)7=aX{4Kxvx># z#|WxcEF(SsX+KbSv#VbYZ7<%RK&3v&*Nw>Dj zKbGN{!CNUGHW^8C8Tz(ZZEoE($^X`5k-d*RkPX82og6)wpo~3RAwX!^T<0Z|{XXr? zY*|dZpTFX?TvLMoP&~PE&kiAe_FaNb>5Iw&TnP%&$|Zt+8;`Fchi{)qf4@4_M9g znThH;!(3@-^Tixmo8mBPQc$c{K0iDDobx~Yp$=Vs-<1YQR_cF zX0;}q^`UdN9)7T@ck<(A#{vDl-ICI1wx;hma5#w1AI+@j1-P+iUj1Z16oW9`8dXX1 zIe^rgGuFk_>ZUp*MYksQIEE3&fQKJ-)j|DI;|06tcXPgKB_4rU)$c~V-xlW>5XN_D zv618zm*u+DK*_)OWNHb5DYLYtwcR%5{DMZnDl9<=cU1T8kLB3=r>LNg$YTR3!a|FC z`89{xdkmq@%;uM+Xdc7+?~e})nSMnr#p^Ww5zjtqWbQfR@xBUSHW*EgiQMad4G%9U z6;y$3Q4Z35EUyy6>}hIM8?gughtVAV6ne5j2XYIMM@E!@$Z~D{s76by#VN3Gs}3rL!0r zlqJ4hdZ#CNGVO^TG=@$=Ei5lNb@;S9T9(d!q*%Sh;i)(N6yg7vKG{Z({>JvO^Z=MX zaGiqB@nok}SB}SfmyBGS4lr#lBRl5hPEp>$7I8zjPxITae*KvSmWj8}c?Ht&F`~3t zc(dHNxzL9Aw+{nY8_=1k2;M@Nd-davZBA-Xfk*t_HsrtDoM0_w^ApN3i>b1esU*S7 zlEUY~WB&Ky{fT5Zjf7OpTZ6j0-%8yC$kB^!&u5P8PFC7UM|TdWvu)0vMl*9|-LxPU z2|(=sTrz(7&1^iFneXr7is#Ow1l2zK$M=1rtV;>wq9zQyh}8+a0Kl*BWPgT&g^z*B zBwzE%7$tNJ<|r0CV<+9T#VZXAQf|nq_0CrkGoe4Gc%C2B z7F$kqxIX(R8gzn-9#^Yl%Ez!kDo-b&=}B}=dv8bUO&J#`qK~HvqJmDhkOi<-k!$IQwPq48;VnF{KTo7X=re7rwjJ}3`}qpV)zvjc`3-ffKjJZoCy(p0kDUJV zQ6LzaJDNrvuJJ#neMyuqAnk~{_sRxi1uxl;Xzs@vtps0TXwb)4QdaTa@f^Exx|g%G zPth#3bN`NOfUe5(74+?OfCH5K3$JBUF}aK-2pd{8e~++iDi~#EMJ1~e1`lZ{pUT`4 zcjGhLnX@ZuZSbg-E7*dKUh2s~@unMflZ85M>2>oHRz#m8r~nwJ*=@ne=s(*LphUkL zhy_9+W$D2bw73c0du31Dk8>UiE9L~h#%c3&jAfr_HNPvJ*9zt zh&D8XMwy{+zwTXr3L;WPg(Aa+Hn1)E{TaXu0|DLWnE4hv=`waDD@6bqca>qj`QegM zrW`?5iMynh4bvoxL(>IH4o}t@gQ-X;J}AVyns`p3t2?^6Q#74epowB55`D zP&I+itXpl_hp~+BwpQFXOD)ihe_lU2)5k&a|6JbVkId2!`!6Qx1_1xJkBH1h%6rmH zIy0G@oU&BMJ5UvZawHEEv;tYaB>e#laofwE%*p2;cX2{wSbn4M*(fkkQExDxKc_6k zdpaO_`M^g-CDz*3#yEShxAhMy0Wb{y_E~xHP}u88GU%0S_K`K7?Mw&)C2Fgs?}@Px z09G%RbvhTl-q4k9D>->V{CQ+&4w~s7ycbLazkq;V96b*jkwDa##|$h43rVEFooai z%A!rNC!Qvx-0E6*6(;6*#70~HB)z)&ktqfY{v0v@`o4$<^3_tEp)WR$fvi%s&6*LQ zbOs3g%|`R86^SyMf{z?2{az-so5i~ockx}VV@1;_eQ9S>kOQ%TMu6fFJ;PEx3b#&v z3Y?QMoai#bEqzY_`xX`Nl1L#UE<}Rmb*``&)6{GjRd9bTYIddvzvq3u{m#6`2@d^B zI<>-Rpe{+Wbd{1q@l>b5H0bHSu90 z$2B62O3n<-#_hftS`OJU&2y1vf8_lf?2=A=n~Gf1Jnw#!MIl}^f1*$pm;>oibUXlZ z=Cb2NJm!h9v^rwnlp9_r@!bZk_aw^$$81GUb9nq~c6g7Ad8N(e6^g5;v&lB+tl%$a z_&;-4{klhRS=tVfL6I8^Gu#+^?tL1y!t$;YM5C3R{cJ!@q5*Y6NrCUifZdYrkCht) z*FC_g7O(KU5+3bE^tQ&`BZl8}f44CZPPlQr86i36SS-0)x&Lm4xT){@Y}aTtyXU*X zjABm`d%pQ}^+@}sY%)jB7ujS=k$}*1ev4VQJoQqajjNt!@9%FSv>NU60M%E`*@p8Z zTQf-qe&IGWO^y{au|Dv+4U#Y2zlbXA^VfL(!j(JnxagTk!PQk)p6(DHXW>fE z@z#+ z<_Tbb`9ddQi>D@kMTh16kvor+AODucM=%x=}7(ixF%y+T2puKmrlsmUdxT}=FHI+-Pz1^Xq% z^QLPKBSb?Q3IKEh_6@M9?XJ8ILhZ4Cs(;lu*Ghq&XayKLVXWB`hMi17M0S0tDa+`WWM z%mAE*q#Sj{gY_9Bs}>+qo@6#=s$6ymM|UW*0ZgMan&^`XZloE8S{>C($cxbb+*a;Q@LcMjig49O4^N0^Oyh2z=^` zdAlk$^XcIkhY?;s#}t#TZxX5G;&O%ZPwA-X>16=DXs40m#zwepXYXso>VUL4JT_?- z{X(pNg)H`xUd&ZvMpb1aYRO*G4JAxm?J&_@oBfeZ)SisT$V=80%&bjjf>6v=CPkO8 zHw$&%Db3oXiYy!dUf!&+y3_cQe;!V8+8m1q^{Cg|w0B1-iZ^5()^6!ON;SUfoi1rf zr4mahRv%flHEij&HR|gz)%pBg*dI}`(p;k_Lw7+Uj#iCD{*a>SuBwyFS_ciS+ElH#GTZq zoWj`Kv?1Q{C+x-L_vDr3ZUi@4P=aY!ZRIwY)dZn3yBvVnHGPXmvd5=mPe@L?z=iMx zdhq%1It>t++zUdbO_|t_h(QF%9UW5!XL)j9Dx@EpM7uGv%W5~p3M|o-ZEzPSG`_!M zj@V~1pE@l?*)m}6Io$$|uQ5Jd513-BFMDKg_;B&3PduT>%F5h(&|8Ov#&>8gy$tt% z6{V2NRU!V}r0)yS>Kh*>^6)?o?A-o1x&#Yxj~d%ewxJ_dJccI@{dr4OR!eWMI(B^r zB3v(`4jUf;3GP(#iF}o^+lGgB(=;=p2DQ~pvIeJ|=?fYEj}kdn)L+z{>4W|Z`hcaG z!~x^;jn2*v+9XvN1{0%dm`La|9Ku(g@&qDpdBe^~^KTB}(9_nl`9*P=J)`X{7Ij&6 zT6NUH?1Rs{hIt>tBgBF5AL9J9QTB9HU#rwqWhIKKUmZli1YJdqCz&ayrQ z?#&!4X*+^}qbqgLWST>>2WVVQSOdK=HCFbC6$NM|95?*X8Qh!9;hyxUsrvd#ojVui za?YxehEuI5wC(?4=c+uib7|}R0HYD zQs+1sbrzAdZx4|!SEjcX&$XB1x_@u-mx{d zMG>FkK02*B$5<@jjI?FB9y$GgR3}6}MX>fyWScfEIH{o4Uy;BBe_B;J;`Otp=nB`q z`B?gtBC;P22-{N7h39Y^2Gl5mh|pS#_C+9Tp1$*W+w!-vxP zGsu4Yi1q8oga8IdTI?c1vmrhV=a>GpYr_nJPd8YGXt@_5WU1xE$5jdDnlyHkw_jqg zSNENuenA+&_F(tKFvqom#^b?;n63wV4>2f1l>Z2ZB}^W-LS?8Xb`PE~LGY#qX^5_G z#8LASM)b90FjpiKB}n+tgMx$OF`8te-Mdhenk~>=(W&G92dtnN2{jS)%x@s`*2~Mq z4Bo|$oEy9bAIt^u3X!-Ln);5AAP*H`BNvbw|D$h9O1o8r@ZwMyN9}(_>CYaaTYtea z+y|0nL~B#rrx!z;^IuSG-|xT$kRL}B8PVO7L(?;G+jTI0znF%`sy?o>esU6jLd<+( z{VVwMhJ*3eD3j`$T8fKQ)5T%0T<^r0lg#5>jDZShTxI_!3}}r2qfEvC9atyPoD9{< zNOB8W6*_pqFKUoQ)_?|-G)UmUty1cev4eX)|7hFLZs#^D<2~nSs2b~d(k%9Sy{1CP zr(WT~Klqt$wlN$Lv;K2d1=B-6J-)TXN)4a=l>F~@_atjpX}-{JOR(X6 z9}PJEA1=cS&M$4Q9wf2M0)pHAsa~b_?HaA4qc?+Qje>)0m1S_9lwx@ajw~zd-AS|t zCeg+{U$wS3mFB$!NOyNA-O}A15)y+nNK1-R zPvj>nF{o;A3>E+TT|XaA4I+?0P4I2gp}ZG8fLw+~K+G7N6Oq6f&fIrrvzYzxQu|+8 zPicpQ+28VOBWHRs@_+bG0{l;4wXlhvVL3Z)*z@Ts>Ry2L(KG~1l)|Ud3br|HQ!SSQ zz>VKVj&07BGbr4toC+^=euNH+42^vuV(~0S1@2%(z4VHX1fiBMOW?YcX#=;1o#BclJI?_L_!b@bi>HMe!t z-!I_(eI>%^dS-oh94ReRfIvF~f~bwnNUt8tFa@;?KLuYJC>6P`2mO(YpDDM0{#B#{ z?$t6dgy23V+{v^m-Tf-c;Sfrh>NQqNo<#n8+W;GGQs;G;fNCGd64=9rU~h-}Yf{|* zKF41dL##+hjFBblg_XR;( z|99DB%RA(NZC4bvC_yxgAt_2Z2>7_s&Yj)m>J<~xi_%_7yE8;u(J|ea3PL)LVzDi1 zhQ3p28jB*kTGVC-$gf+|M~1(s)-B58#bxnE|0u7yy)c8?Bsj?an_DH>f&qw&mH{4K zfC`ebJ3?=d<^bJbhA>Tx5kLarq=c8xeO%%#fWQ$^Pe^8P`gxv-rejCMpeOYwB=Q0A zm@!o*?V?(ibo*Gt4P`mz+?Xk}QsEel6K?s9*iwR~fF*-Q(h+SU| zMsAX%Y2}3%;e(zhc>hMd>7F~3BU8fxvxdgvOMj$KIQi#08|-(DIrKPw3%rt5S!i`j z;O;J`QM)${bC^))`%7X48GxF@dYq^lDLXVp9t^`2(k0k#T<-$?bEJrfiUi69G5Gsp zf$9x5wcRt=DiBIts|b}}yFSJNm!v6l+j+U$e6jly`j`2^D8&F4uKEn6bLkDd3g%o$ zO{3+Fc8!_T(&&NyvY${!pGJf`9qu<3a|wf7CJX&1^q&7>!+(ny4ym9$6#jh+TA@&j zbrNYAsHV{x!c<9F)>-=U!#&cMrX6}qRXZ@l@p=m0SnvbEiOKu_mxX~N0sO@sku$4l zZp1N5XwD+2RHxGAl}m|^v91=4u(&Y%jg0;g%Ov?CxJH?CQzp|d&!S`6JPZ5Gb--r5Y zQkmKBGPXeG-=P){R8&(g7{eDo!o?}<>4f+bnY1!{uAcVy_LqD7x^)3^G;&9lc5yL^ zW_=z_c6kXWx9k~}E*|eIGbDW4KRj>;th=Fo}JtLki)>DyLu-$^;1*k8Nvs4h`GT+ISzWZZ8vL7RR8uQ(Yk>n@$hh? z+_s7w_*SwiN~PwV);nRMFC2e214JGfFhuFz-cpNY?$e#sL+_&*2BphqHB>*>B}j^y zH{|JQCWO%~(%1Bdi|nfg1oN;*s;Zj`h*qel6N1-Z*S=J_W^12kyq%jIh-0pv!_&r{ z@uKh9apSJ2Js$j3^72QV^u+)zRm4df_Ei^oW5q?2R$Cs6QR{Vybp4?^ z6jagdiLSV(7kO!GuFEJ5jM%c|n+G237z!MA)e+dXbDDu5ti`&?GY&U?Gv_|!mxH)4 zh?vz%VK-MgYS)=jX7_!TKlhj<siHmAJ64;XDBKoVD<0lxmxqnGF33-;$cS@%nPW&@H)yg>vxy1^K=ElogCo3_(I2j@ki z;l2;%U`K0UsI2&@KJUs-c13ba~@>bhE6$&%9?_b08kZ_k+^wWPHNyGSxLIB_Y^; zS>fBOH#z!1x!2i2Zo2Gjn*?EK@a+)^R;V+0+r+Z}HYBlz^EM>fo8KOy4A%FN7s$hV!Q>}$wgP19@;jZ;AmD^1WwGmVHQy#Tpji@c4T#gMx{1lQ3O5ZFgPFEvK2hFnJsnR zQoUk!Wjw52Nm=d!CbKM*G_O%`aUshkvwef@K!=Mg)hcc0bvM<+Mrl6zxoBvZ4VA*} zHXJc-&(uEV&=wdcblsJiVf5*(0ONiz+pS0R%PudPg!P_Y2B}8wS%b`CK6D>HX{7o} z3^ji9_bCAqP2diJhqQCL4nMxAlhe>m=^p!;B^=8H$y7bou@jiq@wr+aVZ&ox25K%2;DoE7-4*?38RW{R z4&}Nsg}lI>kWTs0pOUg|ja|>tbCcYmL*2A6?|qtzKDfNRe9Nwk`t|tO_>iMf)D`HQCWU9Bs2OC0{o zW7b$We!GR1XRM(xi^(JL>C=x(;kBKf(4(|LKsx6rO6@Okl+D0ki+kfu!E=_;ukL(C z-#z3Fdj+i?P((-wj?x9e%KEwt%!$QiZ;oMVn5R$7yNYJ`_3I@tJTmeWMSLesdx{}n zkwh#auWM0l`)*Gx;eu0qO8vF;3Z9e0LTF3j`+mjD4kUleGOjOPU73)wT08qSVHBofOzgHHG@9_~6Crv}%A$AAE~HK&R?A35n<*Nz!mG9sW^jNz?x8hpz==}~Mg;Fn`(>451Ox^p?Pb0r z;cJy8VsFd;8Lv1XCbQXuu?})#D%|Y(aK2r6?r2pZAK^YAaH{=eV}Ab3Xe%JralQYQ z6kJkLlK64)CWx>>nW#;f(W!T2m!r1Uopa|Hd96k!@F0d3KXhP-27VM4ynbnUTIr z=aaGF1CAR3J6m;|%~bh)h3h>jubZh{>d)(Xw{=sWHq5A9^NpT(^E&2mEuQOa)?OC# z*x$IX;~(f$_*Z(*?lw5mENzuEwMVB$e8jBH?JFvwb~}oM@@TWRQ~{kt2~I;ISE}9= zfAfXAUgWP$F>P>H2_Sji%YVIMSYvdl5mQt&7q$Kvlds3~>Y!`?doRQpgX z`nF3lMyM-)nM95gkKZfN&7>NbmBfFq>cw#VMUFyBkjoA<({*pIW_v{DrCYat#h`g^ z+J{iahM~!{je{@X6EG#0o7JAj$+q8{&d7rN`Fw4B+&}JTl;A#w{u($vtnpEescfR} zQ~t9d&~Wlazc&prjoW%2V8r`vAH5)Zr)G%*qqo!5~e68RuN&-@I#NqZzK}vR*QeX z{!y4h?cUp(M5jss0D8t)aL05ovuoBlOls0tN<Afs7Q_gs?N1S5Nn8Tn4ui*>1GIf*VNtMk;09cz@CEDUoa7w8W|vjwEr z(!c9b4_bfxh8)oN7oyM$u)U%>6*JMB>wjEfbl< zVm?GO^dz0X@e(8^>GI{BWyDZ;RKcsSl8q*DMzpq&112 zom?VrrxrDq;mT`IFcg?VUE@b(@*+|cGKweR;F*>(s13>wXJuZyqf z)jlb&2wp6u7s0#9eNh%Y*lWHeX3(l?x2~Q8${#(6Nu<(^H2d=V3!q=!a0>2~7z4TI zn0_q7_N!^6nYbKEY6|bu%{Ue7{riAupCWI}r>hV+!q~EXWYmAf?Wjq<#FxOy>LPR; zU*p_}B6ze3F*7WpGtlz=}(Bi;nrCfwA6zW@| zQK&uYXn851zyzgYTFq#?aIRV3^IvckmKozts+nlPc+ z_1@ufJJoeIT+5~wTZ3gW2BxuPC&`nnRD818)))yk=OBi153lGr)E9Y3@{_?Rt7wTC z@p(zUuNoJkC;?gYjV|?|2*cc^t5i-vJM$+;DuGCip&!qIb> z7n0;z7v?m!0hNBtd9GXi;Bl_5$(m`IW?|T0Af#lAT#Krvb|uZLc;&lDQKx8-_IW|x zS6#@3VzgSQDFI)m60^F3g;SD;-j=6Mamk6ho;|dpxr;{Y^aRvhCkq{3(#Sd46j>gs zb8c*cs5^NwT-;2pr(vc?#g8@pazoYJF-fAaWo(Pr>&iM?Bz%02_b zi&xN%n{nvGDX_QvGigl|YuWNlSd&C#F>!A`2rzxR7u(3Nb5U+4fLZ4xu{H)>h>?YL zaA^B2p>RoV&pnpwO7$xhms4!=rc>qRMfq}m-d(f6GHFacoK;m&x;90l{}fs5!aYI1 z*HzD8-CqDfa|YbAz60_k5!sHOEiKaLk*{BWjTMJ;>2Nj)6T&cypTR4Ubr-ccEA2T| zyMZX*Tyu6?)NuXOk-krnHx9m&EQ`0OXfCxq-z@&I5f=X(^D$qlRm0Q^Q*!54cXf}g zs_xs>;A?gR%+Q99Wy{g*_83+%ZY_VOq7<7E6Ki#v8=ls^!nP;~tx5|cj0Bjc9_2{| zYP;y4`FfS{=JkdzEHz6E%J}mWytj&oQ)sBM8)oh6Dhf}F>M!`m_4c$}Ph9w56m_!I z1-h-2@02DAnDRR;T{popUcIUHk1fj@PdSj$=a1KJU72aeINo&0Two`q`NgZvfvg35 zB3}*i+92M>^rxVY)-eb#VU%8cz0KHZ-V>U8xJOzhVJqcZ^_kQ&`t-f=V@kV3#78nN zpG6rN#R7t4Hh%LsO?KOPVuA#mhKEZnIpYK*Wb7#sP%n*Ak9mSw>EQ`JsXj{qxU)1&*n zD)zT=&G_MZPF6sVpR0ZKrgaPoQQ6IHQoELxX!m48_NpVC&-S<(M=)O6+xK!gM z1sfwVR|%hOd4(J#N}Cc%PL@U3RR{)8@3Vl4URs~ogG}=sQDUof>07;GsS#PcT=V_# zpvZRElmNx@$P3BsX#{JV8Y1);a$eI6?DFsr$unTW^&cLs92L1kAy+*18E3T-KLJeA zeWZX+nvDK2ts%ROvhJp%2Ua(0td1N83nw4>{_r6ETF8K;nO$cL9~T~coTg^rB)J>4 zA#dXBmXj8G^=DR1GU_cP!t)h6$!%7&Ok^oDpTXtlvvuQVv3r_qBs{n`_j4!n0yu0e z5YMwdRgv2;3Ck8hkmRJ&8PNlyfZm--dP;p201BNTPIt0^suEFm{siQN z#4^4uEJ|*_x`&#C#HUlZ#4YQC6&@6UMEhWy{*OSM5%@Kt#9cFZbjrX7%eEBdsDK1& zN*JUnuNwyWTfwyz9m~v!{qlT|m6EJWFG7M9YrK%9*;mO=jzi4c`jAV5CAzc41uV)7 zUSvv1NpiVh#S8EfWtQ2O1_qI4eN~TcSv^`X(Cb6*_g-3&&vn)v%mzPG ztN>mJzPTcDDY3t_NonfU5vOt|@JB(ol=%~+yb}W=dp#7~_eGZQs_50B94mq(+(zRD@E;?q$N6e!zQDHEVj5GN25*uwGv4WNBu04d+z|eMjOQHWb+*qVWi@xL0idO30uE~hkKqivMbxL^&=!lcob{iWwdQVat=J@wq zt8ud#6C`dT=gDt#_g1Ss^-kphr@c@@P@u$kb<{+pwwQk-MgXh` z;PraT9cEjJz6Vh7NJv=wAxD``!dGu;Ipg%5+16?#DDd#@;SawSms7o619vh_SMJAdcYhmoU#8t)mQXwbyS(|=Y2di(F{tdhTxo-Iep9U zA50r!7n#BqOGHXb&&V2`#VQkZ=3gf06lqdeco;VDuyNv^M&K-xc?2Q0{_g!uZ@KZ}VwFk9z_HLwjA%Wy#c&*FYR zIzb&w{WTXIOk?jGAwh32mE#yOG2^2Y5d+4f$Qt}FZq~u%nS-Q`O2RaVIx!Wz88r9h zBIMf7+Y}@mtc2qNZpTbZ^rwQxgM>_CaX8mE>?g}SX>Lw`6g;P8=qzPKuv6}(*w=z- zdoiCryw3aVT3`H}k>T53@48k{f}G8&$zNsMcPHatd`E<;rEf=ss_XhH*_TEMSQ6Yx zsL=r?eAb9KoB0C?<*-^#C2Hby83;o~n7Y;k);O3#`>KPds#{prh>cw;-eV5d|D1t| zwH3@*zcGotF`UE7onuNSOFd;Z_Y&LC1GS4sz$Xm(eP@>Wdn`72Y35#t&79%{8L@-+ zboI;HRGkOq(v<=$-)nvqkNn=PUl)Rk7#aDvAKM1xQ<9MGzo!uHu``a$IL;r?z&Gh1mVIrz9Cl+AQGR=?M0( z4EA+K4(luHOU)$B0YriIUf<Fw5$ncvsXd zP8PpM$0iQxm5>(=74IJ+WkgbFD#!~(ZwP4`dDtEa z-IAz^AtVHg$w8@I2b&RK{Oh;2FrPWhMNU@okudf+G10!jIDo#Wx|n++YArR!A|?|U zs8c<@BsOJkkF@U4lRYtc^6GC*{aXNiZSU$Q8GOLIhVU*x`Jo#kYL+`X7RBpl6!c$0 zdS-MhZN8RmbAp~-*}fUhPyrD`j7c?fvcEAd-KhCo2dFi9KP5QiNWRIN^xnIj1+@d^ z2ZxJ}4&j{)?OQIx*3%n`YmzGYu4;!oGNYIwvMA{he&WacH3i;Z9e(`T5?U zn%b&k?>Bep3gX(Sa9g3)j?%ZyNa5I}8V3J1JoG>xckq|s;BW4szBE1ECe>tY>^L2B z7N8Rd5nPX^JTc46ST2}gt9k{ZGmBGfK2N`zEUZGTlJBzmz@+(mp!gxqxM$?C&Kri4 zYFXC$m?eyM`HpK$Wu3y?+~>q@`((Vw`)zpK$7Ztimo_z@7_Fe-{>i|Gvk{rIrCug< zZ2Uk>1;SADw&2f&g-=XVy-^=LB@P3IPiJN5;|>VidNthMT#6GmUu+f(u}~l|HJo9* zJ3qlChxqa(eH{NG8@T89^i8& zpRTqH1`r0gTlW?8Fk-$(0MO5u%x?XmM@>6o{#{C-yU$HXRu=gu*Khanc+H~dn_KC! zt_18?e&*Hl9>a6j9yvR}ftA-h^^tAhGY?a4cAXUzXHa(|;XHxvc|Xx*e!%mE(o9a} z?IF7zYFQ)U7KG}^;GFYQirWdozeNrKeeY(2=9Sjy%faBP*QK{G6j>w2vOCA&kG)6= z81fg5g@oXC8&7rFY)0@D_|7S_K7W?OsW(w8Nc6fSa?P?$=U1<{4g#3JsHr?8f$2Us_yC5DU+470f2zXN@W%iAY%`Rp)NGi%;pT!sy}^vxVAX%Z zlXZ?Gt71Abk(?}l9{gb(TD|8B{(5OMQ#t&pyZPo~OTE;NY|dlZd8KghTUWZ5KQ?&| zNBs7->zwz5k(cYn(41RlLOeI+B@cQTbJ?ron9w^>0@9=#9Rk=j&Mb!U3)C4dh7TRf zxNFSIPJe4NXQ>t*>MzdtWLxBLwrF|MvtTmnH#-m13*|}k#bhRFX%3*8r9@h;*3}-} zVYUK@Y>xHrZDV|vmYLRD$Q34%2_Y??$Z@lUg=Z#As)}dpU6*ej5{q8Kb`Ekty-#O+ z(#tN-wkrk~>0PxZ?y`qW{I`Taz0`1nyCd&OGY#|7BzpIN?uS$!*JO2I9`7B13gkM| zaO-2;uFggksCzvWGCXy^3eFdpDrD#6B!h)J=FB=iU{6+ACQM24wUnfLq#~`Akjb|n zYE+oK1sO$}8dr&ER+!Y7PP6rp3PfrEtyT`P|AZL7y-C8mX#@|$!*~$k;i|zpWHMWcOW-V_H22t}#QyDRhJfy9+UptYU)Y}YYz^N8# z1_D@rMg504+UJ(kRTpksE)mj;P(F9VK-u;eJFgTtTEWGUk&zrrZf>gqQOVIoV)xCl z`>TjgCW@o1+ONI)*xnpuh0@?Zj_vN23JV=4EMvUp3mZT1O5H4s>MmXkI`IBD!pu0ZoR+H<7AYU4sDZABtep?=H9SWP*707 zrUtK7PZ_ZV_J*Pq0|J8Zl)UFrzKnb0h9tN?TkAU~s-A!MP(1Qk$lJCce5Gq!0tdK% z9?n^mZ>>6gm!3<~^Vc+}&VzhP_4Ae_LH#+u`3wG000HN{-O!Zr_z10|nAm}Xs2Bx3 z*A!B&k)a%Xa#<0W(nDHBQ5nR*Q=P$7JpZdU$Y0Y|czseU@YUShx?g6Mb6^nlS}HU+$^w>BPKQsRGrazME8T=a_3& zxu8?;(>cRU3!w2G()j10^KJ@sGN`4Cdv&o+M?Ftxqe53ici%^zrz?B?A1#Z&MUlNP zGdmy$%5riv2haX31uYaIr6zwgI#>%wGJ8chK+G-AIB|3BU*w!+O!@mLf0Mm~?3`ZK z3BRl`m`4cnrC{qblC|iBWmz(|!UWbK-0#_16xEw}$n5PmF1`obiFWDF5RIw%gf4)W!dkr*%MLBaf;$;?#w8$soibrYr~lRWJ!fKoyv_m$#P+W9 zv8rj?&KJUV!K;R?uRY-fg`Bk7P0daDx=Pzy127sD z75&ixuk(phe>0t9I`yrWOW-pb%PGg`9#^(w(VOyK#fTHx?Gb*RSqz64=azZU}2&KT5p9trua8Jtn!BH)?m&voyqA>M#W6tyXHA=C!xd9 zZv)FA{@Y9fI5YrL#U2{d)|#;iu=&U*x5z$*YLt{ zv$uQ*Cx0`n1$U5!^ebIH)u{Ml@#Haw{) zU)P}Jec)(^=#-VuSQH@$YJ2Ol5_0(MU>Wkyc~?wFJa(;{(Lhb0d~e6HcR@J_{_Q-X z2HlHmc%Ru}jS%6hrS155rUxMi*kOiOogQUm`Ef=zG7nsLVRCkLoQt_%9&G5pNB6m$ z)0hp5%-xl?zto3w@Wd!Zg}c7-xa283*%ED?v&jW3KgEhHhH}UcmU|~mfca*NJ#P6< zi282QtexjKo!#S){_05#EaVE9v|{Z;BGl=ljyOZ}VV9O%%Y?i^=yO|sB+mpH9C{^1 zN)CCUkO+kh)5nmojcT1>FKRxj z#OJcBoPjjf^(e#hT$h@(f6vR$K*UQ3fP$Jb2G|)y1rgbM9#w?M`STk47eAiU z(RKMZ-^>&sBoh_37C*{&Ip-lJ2kTv2PpsCZ^KW?$icD<5b_)$08Ac07r4@J&M4fh~ zv4O<*%ggw^b)X6k-F!4Il^HwH(R!fr!UNe=M;~9ViVg zu7_#PxV4>_JhYZE9KNxfuR_^r?o=6XqCaYf^}SKZ6ng)Fx;U8R<|%M5=2yqdPrLj2 zMAgmAUb(c2E~!Fk6!cCsNHjIUeZG+Kd}Eo>cvC{&!RfS=oizLW4-$|-=|cM7cI@r~ z;Dz?hfS2-K=6FzLEP-)SX8jUjsWYaKlV@-Q1tGq=R+7YQeTAxehH8^+AFac7V58lD)_kt4f;D}Vab8NN5^*8cdDlDbd$#wI$3kXj9 z`H#gT2&twvd-L0uHsk8uKT;^SuMGm7u&qvS9+DV*HnJ*6v=()K3)`}7UPSzwE2oNc zfr957$)9Wvxn7T!$i$z%3$Z063G2dPdZCAI`k^gKesrBg*s?>(f|BHyU6;Rtg0zI^KqTs3#1k@L+Cd?=sTga`S_)$#qp+pY?fi(rcmH z<2vD9k2{7xn~1u#G-K^H3qYzub)B>4!RbqnED$3dr(XlQ{ST@qX?u^Wbdrm7m{d(C z9$oGw@?R4JJU`;xPb|caYgaaiwyx}swdh||2qC9pVq)s`j1Sd9kgjq;YYGBKPXK`O zU%bD*4BcyLs~F@91%d+Ex|P>#wsVB*>8`{MM-G-))m23O4#b>x_gdRpUoKyt9<;oF zx>RE*p{z4RH(4dqe$<0;t0`N*Wy5AMiG(YcY&5O%txhq(V%0vj{Ww?~spholQud7Y zCgJ;qZlmYhv(mRYP4&jNF9321)V4WX%eEf-{X>-2V{=zSfFhGfiHlH~_Ik=TT0Jq0 z_!Y(k$c+R8!{UsKj!F9Y?YJdm0bosH`!y0y$R-(-kG$$Ue~h!B`Bm?-5+F^YkI9^h z)ed_0h$c{ZA#x!!$_P@YePqHWF=`pSCxCGEMEUlK@|;-JU?j~vprFUd;N}d~gI{XI zHDlyeQb)(uAoV|(Y-7)o=^qcp@lu2N1JC9!fnIl z_H`f<16GQMo@rXE@1H&50Xp-D3Nm5&9Q9XEQjzZhj=2cnQ15pn=q()$HowI0d@TBM zXS{+&p6>*UlA3A>`dxPM6?rL6$dJdK8e!2L#a#job5 zxW3e3Rod#~lXbb6soB-M&l&Ng=nj4tTeeN-&>Pw)CM>;efJ+9)LnV&wt3rQz#UL#& z-}yDBj0ocydD2Rx;rSu9dZin)%kE4_tUNcmAyw0!&l%j77}mUANO*V$c7k4nmQ6iM zbaXW58o>CCFw(YEVsjbaE5#Ut8z_8Kf}_F|e$OqqmIAVthBeR!4TqYrGGP9VCMJD1d=@{_hn z70=`sdoX4Yk1x;HCk^u%HxM~cU_Xr;46QUcFte8+y@lG+F3YrMXI%77Tu_1D zy0mvC@CC?f2J6eY7UgC8AUC??;&#VbtN8eEaML?l6XfbIMu+)Cjf&a%g7VkWL!_PIy4L5EfWemPudB*N@DX?z8^(}lG4&F*BZ4BaXp1|HBvM| z$J+;|raOZh!=Ly29Cuxm7f!K?^jO<)8OM;xLMaWepT2R`)MPbc>Sr%eN#yX3y%`^S z*xv+MrS0452%xN$%-DN{P+x^KvPC({`+|8G>1w+8(Khj*qpN%w&9hTSW#w#h1;f#- zoh=a!94stSCXPYS;ck)T%>*^?_V*P*eT%s`8H8}bRnvugdeMSg%$Gl>zg3YdE+R2E zPk031W#4>V@3Kj#YLHD+L|P*U+V0v^ITr9UVm^2toSRisKBPjsSIhMI?vL@&k^*EI zc^fX5X?#*z=t?~ZCmVq(524hHMC9qp+_g)bNgb0tNzx4DyzWAOGhJO`7ER;iCfL@* zQ>Mm!-izKN=cQq<)5;&>XZ%_$MVOcvFLwbL0D56_yfZO>#iynO*^SyZNP1abB^z

dSJprnqHR)}m7~8b8o=0Co>y2Xj$vt#^%4d?;gE3KO&9Z28l9lBK zz@yBb1B8YgSzAtrVy=4GHr@=EZWlQx1!%?20!Q1d)Q`O@j6${?>S-6oKirtOFPYQh z0|hqMap=dmk~wa9glc9D$>ZLKQZ)E<=qE(;O@=%X0=t|}n`1p^I(xGmuHMrDoyOB2 zxiw9UNO^e)F$Xx`SiK(TIOrm=Ew3tRGI>O9RI6FROX@;RtGLBa=D<>P&HVI7iiiJ} z=qH=_-5xgQ)QI=sl1m+@#lV_X2-L1{tO(O}^Zt|Bpua*@z`HHH<9Dk_1lf<%!S&BT z3Mo>RS=_sk3f*^`pT|NSjo&tQe(Rh;w2Dc^NtzoOny>Z5b-}?+ESOzcPDeB#|NJuh zjh^fNAs_2J$L;o`&p;rA22cBGjuAq@H4>W0=NZxCWb<(ZiO=)+ zC4PHuss}9#Rcx(nL&f?)sws7}tc;8ZFtlR7o8tBxFa;hRmms)4SAoNYB6*e9W6aFS zY+mT75j0O9;2An|E(R=T&Q1CBUAIksV6&dCq-FPx9?rU- zh8gWKHDWA|HqS6Mx=B;ix}#y57WkGt%#!5T^>)rP=W|*6muoNG@=_lF^F0_rl>jD_ zsb^RT=YS5zWxTWri9L_e*)T0xu|qIL`_%k&ibT?)604rl5*9o??~bOyOW)^2ulGbE zn0?m{LN}w<*rPqP^x3Vsb{UNa9{}WWq0202IEer%ZCXK*bP6P?^TX=i}N&U!TYnUcG^?`e2M>yGB_|Ec3|Q)#4*9Jd>d!x|`WS2;xu%2^OLht%KjF-xvEkaGjrGfW z2VK48r)EpRg8nMG!MQ#zAe7XO-}`$I@wTuPuP)FE)@8ruIJnqcr)eQ`AUzZ`B=BC)uYSTkTAHIbxkR}!b{TE z>JqNl()cYw0lvCd@%3qJFXRo`bgj`!pj$F6#C)XaU&mvU6uLW%?=tN=h+Jh7SR zPHEtimGYD1JX&#~U<6@J+++JZDv^e~lWz`Zh#1Dg-=_%9cpC7Z*VzRb}R0y>H7K`%Y=c7xP_Oa4fdSps3y657|U%_9_3DE z{51UOzL&a6d(~|?k}XU~%AluTbi+{;7Tk#r19BkM7d-hI=5{(R@r(NYEXgl8|H3go)CWb71+4g;Iu%hxDm znrl^(TsD;&HWOS-MgSEiO7I$}AJ-B1H1#1JZQo5}b4T&e5_uIJx1D%3{bO7)m|x1~;Ab#y&vnyj7RZn_gVejqt8XWEBz1@bj*r9$Cql2H(4 zw_cMNzVylSpi^@)iLd>>gOOg|4581Y3Q0#TsAXU(BYWVwZAdR=L>k^7mhKY#_J8W2 z5&7Uwv!^|P!@5~EYjo^}MV}nWFz>ynTQ~Ti+@#4rO>w-{>3khT~KFwg$%h_-XH9eW)hUSaFyQB~ya38a2KrIxqT*WpzDES9Q-?= z8Q9}@?D|h8E)lf{944I~7`anA?f5l3or@14b@6O|3)V+P%^G2q&9SvNM_wyZm!y3s zO)AX0;bH9T_hCl!*t6p=l=GJ;-bj-IoH#l0)G#+7VIH^jak-1!Vo`5$f4~x8$6++@ zD6$EhzW!)46%bC+xLz`AG()-IdY9{+jbhff#e4~&j4{qvGctraiyBp|Jy%b&HW7rm zK)>lWdwh~GmRti9KDU}o4nF)&f1$s=WP7b96Z6161Sk^?uT}h3XzfEF1dz)9ITgRE zPD+{JB$U}OE>VIg$T2zy9MGVPl0dW5@`t-4$U#QCc}Q%$7o31o7+TbPBZ%@=&(})< zUKeOi0+rF%DDuIytNmmLsQ%O}FJCeTKomaAGvoNyft zniB#e&iVlFT}Xdt?o`$yOCbW9q?}EdVLhsgEt%nugED~@M(w{VWq)o6ggRrLeRVbO zIUV%KPFgsg{`BLcGQ+}2(DlpPLxecR<=5M!9pxmDEaV#)BMP5-G&#W%I){qXNr6vXSh zp%3Q=ZtpWDStob+0Dw0URmJ;s*FJNkuY?k*iE+PNO;TUvZXg5Rrt56a?d$oy_#c$H zg$#YD_RFz$$Q{Jxd8a8N87xun!DEw`=673Ea{+uYq0i_P(MQvdJ>~Gw@68^&=S_+I?inC}w2>WSQKFAq5V+9?HXHImaxiV` z+TP(NY#Itc4B)Ufq2AZ7WQ2ldoYnaX4q4!WK?Fb^K+q)iNo>`Q19xT;z*YSD=-}i9 z2Pap*y@A~$F?9hf^}j?DdRgC7adkI4ykuvjJarliu#sJG=DAobdi>1Lr#=lD;oAtx zOc~cURVGS$&H5S8%+2iQg%A8>)IhZeCni}OX7Pw6PfcffEpZk7szfgkkS_6yb$lT|~e@0ZsAMDF=7K zh$HaMbJLu${gg(hqOb}I zT8y&P`Xnj#PcdZ8oDwY6Kjt(Z8a3(#&IQc@bgB0d8#=31MZ_on#btjVZl{wa7ANG{1dJ*$7hDz=gdf#4c7%-)D;GsO2%DKYfEmgMu-ouB-NCeJ)9`0k~kE3xGp=b%@oE}7p9M3Owz zr$MNYQCf`V^j^R-gMo1x3%+TeA@}Y6Kla`-E~>5VAD0pp0TmIE6cvx^|3-Z%;q$f9Com~|zvm5)o*R7RxXBwx(B0zc z2~;yEN0*LhJtdT5SWjnw^*xq^S(+v2lnM~PDux&ri~8+J=Tt5nI)5*LJ+jsH>AHRQ zue789@v0L$vE9W)w18|)|AqBD9=|8GAJVMer0dxClKzgszhqQ8Ct7rbsn}YK_)84w7|85A#vuon%kY|D$1U(Up+#a3TdJ~Pk+&fzZB$*sP57&f7uL*Gjw}&+n+p+ zPC7Hx<8KUqL6Z@pX1sz6K&rc21kV`r5u%uh5Ng(~(@lJJd#u-hx52B6V1tuW#_re_oaElw^XQ_Ze zGyF?IAuoQOGwJXZxG(!uiOBt%%2wTXS6@mGr5qtNvmLgd`wo9lbZ)s}GUr$~7SSxz zlCY)MBcdU!5gfPuA9KaGo?>ORPUzTeB`DO%*nRFv)?6`(y-el(*Z-B5KBNHDfOP9s zMiY`H_^Os@v*|H81RK#HGwBkNPko94w@ovc!+B?Kj0-o7RoPBOkXyVbq1<5zcD*!a z^dejD9lzUHPMh^e$Kc8(_F8|1OQ^F)(b8XlCc~}~M9pc(H?xxU<;xR`O06xw*Ug8bof5f6x>T@5P#ph08 zyfSl@1uwd``w2GB$cb9s;|;$CfB17~)*{anHzJwWuXx~7M*3~IR6o@PMPd?I#}SwH zJriuvse!7b;!cI$=G?L(L7hF?R@{}j`AhN)6iU6l``x-GKT?a$x!Fi%#72*g{-k(s z(c{IPjEIWvN_~cUKdC$3l~JH~k|#dc1jAy+;m# z%*^Si?m>XR)>`jKu1o3lUJr6e81wl!n>H?+2(ur_FuFx@-7<3Ml3S7h5$PL>mLy59 z{>9xqsLda{Y4f_0J?fOMx>K0y$s3s){$p*o+ zUY$-LOkySc^wEY&h#0UcbPU~SO6=?DTi&SN7?LY^d^zSapGj%xW3P^m<@B_e7-D zf=S+U@Ecp<%+IxL0JEo_Tq{*HMlcaHM>ki={=x!y{I|TqPx2)V5ZrHkf3GLpo$I+0 zGgaI)Zjl1O0;8L34Z{;%+o1o&ARA@@}IQkb<}fMQ4W*31yX1O|VIcAmeTa zP0`9y?kp>31jL_DU7-4#!mEcYwt{}9#_e_sAcWr27o7Q;_^hUZZ7pBqL&a#4bzy-> zb3X8sMYC_1JH#~qIemUc50rEaKEbCwhD1i+>pAd(-8i$hXUQ~}H~4-{kO@QL8`Fg zIaI`jHdM5vP#}jlN~e7}?zj6j)%((ly?xarPLqi$R=z_{iM77TdiLi(t<54Iz>YZR z{b2KQrs(o*KPB$U^6VnS%2>bUvy*qJm}!lR%GB}FlOs{(72c;SMbxGKO)S^u96n|v ziL*#=>+=}LR6TB@SZfOGyz@s{_@x#Cztl(rOK$L@^OG!4BsrBXh4$mj`}Ck`gzZBg@vbao}biP?0m(tS96FToRr*>m?ntb6oULk_k# zI)61q`dje@0LaYkbgiDQ{!4#?oD|1HOFFyR>`+_-aW3Yg&Kxp-iq)cV2S690A7gqbn2ns#HXn4r|W`v;I>99mN&Jo#W9PCHC=PbS6pJqgupZehK&mDOcI z`u^)L0_j7pRgo+M6{=5rfdty~I3KgV*L8F6lPA2kZ9L;MNVu!a*(t7zS3p4E?K09W z4Z#bVxCsCYHI7>(0}0R1N;l&Sz0C+QqP3oB_S1D;cgTN|Gh_eBDu9|n81(ARrmI)+ ztq)SQJHgj)y?8UHaIwO9^wq-I2^}l`Ap6OP%@o_Gk3WnQdZbY! zP>B^k%USf_0j!7uF332&*t7`XM0n4QI%7E;f*520oRUy_ZbAUwM#9qap?S~A z?L=OCUM2vv<>XUkC4crq5vRR}+8Uo07EJRD>*>#`SEcp9tKZ&kx5RyZoctx+ck81A z?Y*xD$id8e0*_<~cU^%zTdKO_9r-fbc)uqsDIe8yHGm|~raU$PuLsCgR94gbJbN$n zy^cmpORMq3-s<7B&snhJ{426+6B~c^2>Xvr6;B1Y5}oC}j#I4^UsVWfG0}p%GW~0W zJCfs)`;HiM0OEnRmY>ds(?H4?g2OH@HtrKgd$l;~`!_5lQ{4n$j=YzD%}?y8?C6o- zG8V2h2HPuo!VlE6Twp$rR7C*LKbzfO{IXKK?*M^}pFEm|Arw-+rw&UphnUgnttt2> zBRBUAAQ?i18`init!Wrknf$INvKu$P44psO?FmrjRQdU{dB#S2^x?PbVB6`?N27WH zt^(^tX1ljk4_Khy0B*^#QPVLgKPGzn3p4dB-_#zL@a{(Gnv6e?$Z>(y1FG}^lpWecUyRtl(AHj^9&wbw-FV6Fh%Ftp&$azW(<`snz~0zw z^}SAb7cZ)j0|(ZPZcc4^pxLNhM4{__C}_kX$CQxCbpLMuXK?Yy!*KyNe}@Igs99p$ z7;k*WMz#i>!{V3S2PO!R)K|BwmG43EEua5p7pYU1E%)~T>>WMAIqqVn_>iFGl;GUL zcznuQ6mR@X728_doj$l7u$kXoiif8=&fkn`r(^baHlDS+4%26PMF5(B@vIMJF4R(Q z&R6HCM%<4_C_bRkt1WYDN4}A2kut|#B)yYxb(>l7jwZ%^H@5p{t0$0GBi&`khOuI< zdS$B}1vtrgi9utb;&uFnM6GjNH-L;ouXne9i!9%Y^DyTv?GbtWGw}uv2hEQSbWBkS z(qD(8eeOMba=nV7F8IoPFOHn@aC{B0_thyZ3nJR@cL!BMF^$kB((8o>>0xVuov#nY zn$_HGb18!+W&cxKJ@XX5ux5wVygNQ552hW-Q;TTsuhr$-O-e}kbds;TeX`4yYEhWN zKmYkMfXQO-h$H3us+|5|3w5*_J!AC&Ib@ zOP(|^5pLWH3NQ`_O2qm;Yill=Mv_$_`EmYieU@!otk?OCQrp_WF6->=v@n}D)S}4; z$?aE3zMN{;++(#Rr!>ZXS6;p+DBK~re%>huw4G-17GMSv;;9fUc#IW)KRrzJ6ETCw z?Eqr(pYmLFMjqbh5KU~k9Cq+|u-8sI3qQE|lJLpai^JJghV7D%bIVB(-t#Ej{3zXB zs*d4Y-KRAe$Di*8`%5iedz~Ip0a*=cA3uHKUguFgagX;>$(J13&(JJ1$mGDBh^}T( zY`6K)|0EYX`RIwRq9VD){uo8v__!$ex2^PU z|4D>0KdA5a=XFovA1{6=6nRLzr$&s>@ks+Nx@&rbde-C*eB$&At`sx$%Vwb>tx%6O z?x(mW1fjGIAn|rtCXx`91vQ{ z&tab!5#Co?b!YcZ@W6i*ubGqeTGFL+q^)jVnm;&LYUUP~q8R7?)+I?^c|MljMDRko zWJwFqPtZ+Vz3mdk_4)6`%bkRgwX;R=7V*b9;Qo=u);rjo5Z&rt2^f zY7J$%CPCQnVAF6=SA`+OdB`E5apcb_|Vy57sno^uao(EFr@Y_7}+xBL6_zGRW_OLrnx zA8J)M7e1}LcZWw>tLf%F%d;x$i0f7BbPnM>W6uPLqGXbT>GOr)ucP04yV4{vHZ`LE zt|wKyp|pM6(H_+upp+-oz)bOxmrjWOQTnUMBdxDp+XFCYeN#s({WU*C@_YOIkJNvm z2L3&z)Bi%A|KIx-l&eFGpY-bscgPgP<`Pr!t9k*$z-R=pGOfee7*V6RAWy3cA!o>&0}# zgd**Eg-31z9Dl+2Pte537=I@b#mXTuaTsLz%wGt4FU+MuBP4Z_J?^S8ND0OS5moKwIohKYsIn~=Z7e`WGuc3-RP{W~W2 zzQ?9WVNyqw&~a-}=*NQocu)w>hdU9r)3p>wLKRP);bdY}3B^cG4vLB-?+4PfJlF2d zePdNs4kD7RLd;2*H2kT6&wJg#Tt9m~ghqZJ{7BAeG~H;{@MBk-q+VcX4)6FNa-LHN461QtwB< zz)%1%vHbBCcIQZgba->FB@m9&vCPEDnmJ&oYx}aJ1F3!HJ<4|Rmx9+Q z-#||v3OlPKzWYWt3*Sw0@LBZcq#uB@N_2%wgLsoAK;(DSga6uj>Cx9F*ZW4-@ma5G ze*6~LG`l}b78E2EET6?#AWxp>gAusN-Wh9axvd7%iY-u_3+b>_e_&UC)@gC;?%K3* zc6M^Y4QWc&`C6N?atVna?jNVZCZ;$G=Bto@518kScQURZ*2DbPzMjTI4RpD`pJM=XZ9s z#m7O|;_cFS=?fK+KtBLdDN~*5>jot9S0bXIx-WVwvtfj44X{p7J5tB(2kAVg)N>a- zGZ<_loIj)p^liHkR9{K=i^uq`j5<|J!N%*q5WD|jJ3t~~DBu;FaGcXPC(IjxyVR4E z-2EB)&7efnEy1r}`*wD6K5kBut{eK`5wXQ;Gs9asqYR}p%OA%hI(hRxs1ka_zPOkA z1MHD*etUHD?NyNy2Bsz^1u4qN{KC@-R=YnwmVb^KF8=sjIaNsSuDf^@4?xY*)f^5) zm^#XTaM_tL{Mmx9IBOZMf?rfw`LPVH^ zu7#1vB>5d?YgJ{ZsY=V8zkOQ^nPKQ|Kix4XLqmX7t|5~sr!ufOIJ6(@DXz+I}A`UReVIqLWpm3E;3m!Q*DGl=BHKxi9Jln zL0$VmH(2UWVrp|>haft4sws!QvY;+4w;_o_{3m+!d(^)!2=4>i5Kka)L+$Z(haiUy zR%h8;ZkINg91u-E!k-yEyy3Ce6e{N3^eGT6ouly5l$knD#&Mikd+~BDaYEX8-A_Wd zK;tv^z)8)DLKtbW@{`CM5j+{UwZN^uB9W;H?x|PX3w!NE!7tF1Zod!Y-=^SyKK-hJ z-p_D!e2MgpY#;oDb~fq>N^tw!NIUa``BD1oe$7(^eX@BHybxi6L{Z!|sdaUu0_eu- z%HCDLeLx!Q|MhuZhpy(C-btPm4~;AUHc(VR@VEr~uvcmk|G>Z~NS>ZB-(>Kpm}*HZ)@DQl_{fG@u<*&6g9DBZ~IwgC;zFR`g*YzhUY}lkNfKNzl;SXXQ!sVNn^^%X2fTe`*`Kj%ZY3k zdAF0zO>~d*ezC-cE_l}S>tp^n$0T0r`5Z6SC+nP1RcBRxcf;CM8(!rZjOq+q8S`{% zmf9B7e2&f8_}DuHmH=7Dv~Fq8=Vr%-U&OYPF31hGD7Ng+PE9ku3|t0xPyjV;s=>C~MkMATWo=b+mQ z&8OuX+20sT`OZ`I)S}n8N-ho)KM&V;*oPktg2>Ni*EfaCtcc?$vZ@tOow}|iOh;Fw zE(Q++;E4wTXsp0s$yg6FL<>~Wp8nu;JI`0yNe zxw`j49|JqBfE&Ao|9_4D*L3c40h4fNh-GqUzWgw}+NPI`VQgP}@`@9D#wJ$Sox>-9 zS!4H|Andf2!L~c25QNL4hMAz&2*_L*1~YOteJV&sPRqR_Xw-IAzE|X@miv!Nk=!hy zU{$NgDUgb;YTh?fPWQuCwLxw=MM~iNMV`)y6)-L=m6L z1Uq4;xUBrd{n~t}NE0tkcodw6b(>BtC)rqfsMqWiQ@BDLH3@Tu<4O+0?$xo&(jSPY zs*E0$`(33n$TwPt*h0MCMI zXkaAdM%=gj&u(j04Dk%KJy-rUEj&U1j2|G>gI@3JFI(}iG^3|hxkH|!b{3^hW}>c4 ze0PzJ)r%Fd;A9)9&ZiW`Tt%$;BWRYoOS(x;i$KArFnr9Nsu{33V%{GicEWq_#V7)7 z3~^&+<%=BOf$uPV3yv;wl9JaQ9-zzzx6J1$%tmsy(eXXb7*SVMGSuGc7}^)Ray4itAqVGEc{vI`O7hfjS7r)%oZIgHKwbw_%zzeAA@kprgdh9uuXh4%P@3rVM}NM&|CkSj;@UKJkbru~Ow; z47&x4Huk9}nV6R8UU4fBMI*PS=nGw%75R%PUVk{luu|>!AR~bfACmMO;#%u;f*)g1IlO0rCCatj#mow!L^FX)? z>ph>MPD3aTz|J6v536Y}nps%IFDH$ZMy zP9P&%9k(};kuPV)iPOs6_*g_4Q3Ts)Mcz0^gU5z=KEjmxGu0(D7fMvNcVfld3_90B zMQlcFW0Cpu#6wp>xl{f?U|siV*qlOn!#mBtWsY70&RGBr9hAvxno@}Hc_JW)$8YoN zaLqgh*o|lxl`p_=W{LECM*~yTW1BU(f=C?LDmUcg55-Hd9R=9x0umoAqq9TL`yI-% zD=nSXXAedD&jO22=ikPyn-0P_U{>qqh)PhY4|2hv0yVaTKL>}*cvg50dmQ)M-K^|M zc#vr3jAyNA;p|%E4F7C9+^(@D=!5q1ZfIrS)?SimK-3@8```QIi8+fvhe|cRB`ON& z+DJbVo1(a~P4+*|+co|Ze8LLyGoG1C*Z98@dc}t#IUmwmiIPqPhTkJlWo^>^rnpyM zd2_vOf>Rh&RkB?6^@v1jsm0^D#QID32oX`W!Y?ozQ(CZbIAU**;~(WA9dU zNH3S0JuaHu+$P?C!rOdu?L_+Dj0||8w#UF5Jni~6Cw`rOhtPkALH0u&1Qb=d`|431 z-O9!wRpYwvhrgB(xcQ}Ys>it8NY1!`Mw%rxqQoQ@vWHyebwsNf-r$Ju)_V6_q&eIs zI;A;6J*FpwpO1QjQprg0l%>GsrCz41(_rIq#Hgf@IrA?m9IliKFcX-`G8uM%IVbk1 zF4_7NT8B-uOzlSukjnh~wgSSo$yb_j0Ra;KcoV;-yN?~wH)+I{J>zm}TW=K@n7g@F z_IzScZ9dg0UU8r$!~Ugv{6*g}ay)+o)~}iM*GW2mxPvLl##s3vxr=_a!{zn4j;NEG z6}QBr<(hlg3<05Edz3K%*rPo&RN+lB{~Y}VRa=rkDP@OlAAM~loZ;hf4mmaff9lz< zf4ktf$0pv5+VceQbN~MBoR;_e?wGM5Z1_a2j+_>Y)1stxzTH^NSBQwTDsuw|{C;VN z$M~jp44>~H{;9AuTz}x8H_i%HNWq7-lA1%-t2C=dMfOh*XL;ZL_;_zkSb+N1STiqg z0K4eEzG4s2Kld-0+)R_bSOqzYPl^Mg_VV=3pWV#}xqNN%mEmYW`hSy|v1n9%V&u%~ z59z37d=n7V%Q}u3e}4Pd)iyADXSP3c&k*vfEkGArGgvsu#6D7GK8w;J&Z)yhsnvT= zd+tld+SD4+(7jMWd>h%OLwox>iwyMcItZ2e{Cb@WelO02@5+b0-+Y@f{1g6_0#2Q> zwx6%R7y-q@<-0v1y*mr-$=04)rRE`!?Zvo}A_;@A?Kv0?>kLa8o85j{R58{_*x3j_pp7S!%&clou9 zOl#Vo7h()o0%Y5B@~J<9gx1^-z+yoJb74yOro0BZEqZK^b{9)wAjEO{1OT04Rpno# z6U(6sBixMvc0*4wD8Tlc-I`j9N=fkweOU!W96Vi$}GJ4_W zHG3?p{(%#2GhRZ=L(6WA$pIR}j>Rx@C*#2Tmh$7piLQ#JclH)6(GM(k@H6fwO z%c-~62ak`H>je$!yA(H_mak8R#pZG)ryuv_?iU^)0%>0c%Lv#%O#k3LcEw@?{s z4S!eXfRfmfpB+*licJDR<0UQh=fO~5XjzF2OlFh$$ zL}Rf0<%?E!)8&vzrxYUM<(W1rhh)Vv>d1z(x+!FBVEoFUyn z0O`Q7o~aJQ!=wBM`Nk=2F6LCiy^$>R;XzNM50lRbFDpH#LJ_l$-C% zmbeYX>c;Z4OE(f74Uh5`0KBQA+Q~5#Gn-CcHsqP@ms(tpQ0B(EpsO{av({r=D$b=` z*RF0{&~!%F$kFS2cv)GZiBI0s0Ni^%@FD6b42Bc0P?uNsKKitvJx8n@}x-|i_L$2Ys z!1EPWxp^Ju?lXK*$F0Lay|C?hmNB50bY3;dW1zeyU<4>owHYc()Aw$PsgrgAs>Jhv zCM^4jxiq*i5(TI`7*ScHL-kSZC%Aa71p)&_FiGVlvB`hsrt4Rf=p4z{8DHl_VDl@c zi>GQ0N(^c}u*1<+xTwwr?~QF1Tj1bxR>Bd)!Bo|Pvumo0Vmis-1oa%97P&Z9kPpXU zC$HV4saUnnR7Z_Qx4qd{wo;wJ=9AYS|UIZk=$}%*3NfX9nknH8DyEz=4l3tV^is%4#c*67rUccrF}#@sw+2ad5HSi zH1bvq)o&~m)}NM?pPjD9t=cFiJ4YbdI2 zNUo?b!vIMiws!Vl@rTzRQ9DKwUPb3=vj0ca7D4d?E|Qm^ICGCEG`%yd2BS_i!bJBg zYxj@WIZfQFMGj7OVE|T$;nxhcoJbACa9WBe%1ZQ8+#MaCOOz~I`IY2OFmnoQ!RcIS$A3e@XE%6@&z}rew?0i_C ze4UuSlkp_C)3Rsv*jlN+uKUZAL3HIVC*O=Ib-nj3&CC~KjWdyJ^6SI_LSW13#u)5j zUjfjDq;pm-!jhpQTqE|tibGfDKnU$JzA~)WAP`8RV6ok}%BIhIVCZuO(lm6=Cs$ej za*>>NB`(L1F4up>TQGN@fvS=(SSS=gCir;^?!-B*o_@ma&;aQsZamo)M~wFUUt2c5 zm|QvDFd1Ic&?X~FR=0a$_Tr|?NNUVk^;N6kdX1$r|7Posx)EL*y{d?Ly$ix$3M1)B z^n$L{YGf-lqHF>=3~JiAxZZX>f!VHdv+4H4@H;jxwggkbb*9m`uiV;mE#ZUvJ!aGV zzR(%Wu3z1J5W#0}P;uspPLexTVI{eBve*L(<}!5ZabMQnHSgYNI%F)n=%#i=L093w z(V~BJos_leVcpeFJ*#e-{!)H6F*o{8UFo@pc-b@y_LdXc=@O@>=n`q;Dgy~Su8RGn ztH)pQ)T7%p3Cmxhd-gH&;#SwDbwV7#Y_g$Io#TPH>-vAIN@DhUjER29Q@5F4yfa%$lWN4M#rFe^^>+N62?5U8Nd*1%8>7yi@s)IUQ9?2^QI$U3}tnU08 z_k2}l&nHuThnD2`j}6K!sq8jpnKsv6QpxU*547lm%S(O^vKHmxOu-LS_P(c9Tr72= zkU^Huy!&JMamNDwo6oMb{5rqS;JNRF(FV35T2wbmG{JLik)Ej14gC^>>%04VunYJ( zkHQ6bgwnbG@o(4KwD3DdG(^xMfGUdC7lPEeh zKVD{_+}9e!R+Ri8w-eHD6bT0(jk-YkXlZ|wph1}naEK`TkX-mPm_r%KLsiew6gn9p zg5|JZvY0Wv5wIeAjHo_0{h`9YZ12bSD!cXnJm_Cn;j@I7>?|tff8zb~&3-@s{O)U$ zOZ5MG=AW-^4(BHK2*;Ti8exrX-_|Kouulx~{1pn*9sb2xx{R7;T_VI7>|JTa{Q)vXDfA51o zCd1!XepgulFL#qZH`(p~?H=D5-h+QX^7mNcA1D|rlV>@pi9i2u_lP?rdj5OZ-(xX0 z0p@LwL)>SA|Cc}HuVrGa>=yagqW}5&f6M=W%m06;|Nl<^|BuXnbuW@bzk0~~c$G!B z+(W%u_&MG5clFiXv4IC;${tG9ulHWai{X2L2YbtBUj8>{2Uz}0A0S^C5)8lF)!K}5 z0_lRwdB*9|BiVp~>DeQoQDG+{w3}CI+cA`rQ(gFCbpyb+!nC^ew@_j2_H;6BwP{4X z4%1u`S77&KLdyWmCeePgKoj%C!Pf`N9?SY}s8UaTF@cppUpv|`vsusZi15dMml{KjUBnQGkSVapHm5PutN6 zxt0NlUDylyDK+kS=H2rg&Pxis7Cp4^tsf*nwzAdgg5}`S<0;6dKK%3p&AA85s&e=HNQX%`Q$@@=d>R-ah?=xpOPdc0~*d^N6fgF+9K}hC+`Q43(q`tX4A|` z`rcY@HJ_=5;wl${qxKOXe-ek~UZ_|(T$Bl$tCOEVN+UP~cuwNimMfklPq6`(eyOH` z_c*k$04q&P}Db_Kp zny{z@UW~-kZcQve?+yP@x_pEp-_ht=>u{0kE0LCS#6v`xRaED-O*4+yLfzJ*IUpc{ z)ihF|zg~e|Ne??YcAIq1Dz_W_$*P$%*ZK9~A^jdo^D6GRE#}_p(GQY+z-Nf9V(mRo zvz_)CUK`#xOyGe8#o%#XpezG$2!}Q;zL03?J1)j#&fARCR3Tjfgc30ZuPr}P2QlmU zpCP;Jc2hM1W5W71tXl5VxC0hX_DA|GpvfwE3wVZ&CXJwNwk!XcSMFSi%4@NC7ti(l zib#|$i5q&-3IJ~ZnmmdY_Q@|xMh63kkCHIl!r*IEl5=l4;4#w?akJNVA6AEX9qqI^ zp$xy7**R$MU}&BdQCJU`AnfY9Z*dvePQW06`x^PuuInDF-*|maz3TNHe2`=LiDKsZ z^-CN&S_fz(4jj?*f`TE zGJV=qM@9Df1@wTFWthY4bDz`d-o;cf%5`*H2#3Y4?(NG@cflDgY%R8KQh}x6OT@D3{ImXPm2o zR#Tpv^~+d~N*VGqg9EdW`OsbHx1cCy^yo5g6;>iSx2qS0w0AS}xpUMD&K=1gMAbqs z#Pa=H1?KBBe}TtKE`^yA%S(J|$kw~j*F%@hZ#-;5gl_ZI=jx3*@dfP5^w_fh$% zzKtP-rzegh$DsBD?if+Hzm#Y{-WC586%{5{Ov)KfNm!{ik>Rw+3Z%Z*k2Cn}6>A!z z*0}`^CW;GgZF*2$y2EYy5ru@e8mt`oa~PD2*;Co-cAFu-vw!jiR^GI5AL0s~PZYCH znOG_I(gwV(qJd+Rcc1wIiW|dLafhFl+gAdU$$@ zwP!<@j8?#BHoi&)d-+^xSe3#1wl`2vyL87BX*RYl47j&#EGl&-XJLGz590=0RluhQ zJx0A~k-DxRdh?sCE}y#-`KIYpMw_gMvS(|5KmxNUvo*SnF{b21u9v*DepDFF^MJ8{nkZLgrzEB2*iOZ0g@#@|@2`KagVkh+|!$D+oeuZi`}I z8~#L!`5fAlzuV*jWvy2LUR|1W<=!o*Hj!c-;t;hR;hug{$hJ|-qzU!I802u@X<&Ep^SLj!@R%^@*C z0+i3tzz2uflEB;6F0~jRV#quUG?~V2)uJY<*cu7KF36bqEW`=9aUN*rFX5&kn<5O8 zBLv@@klb+3dpVhbG(cUzPH=9skBy{+dx&zXQAHA4m2WM5^Ge$Irx-RAOxGThiJW{v z%>!YE*(1=U^+HvF!W5Gb-L&WLZ;J6<$s<0{-!hWI;TBK5t-SLApqhLv`%fHb&wi2% zBE;fWFnNln>I6kZqXPl?a~!C6W#QbRN#`u(mLi4-AQ!bf+F2?m;jCmFdr0DAj@Ynf552 zg#DC0FLEWfci$C}BV7<`)wS}3*J6L;WuJEq!lE+gHJ2 z>Ojja_yq$G*0cUp;}`I`Pi!aKQ?uODF%mRLvOPiErq5aFcma6pCRMaBW=Iv{Mv-i+ zqKIcr)TWlXwA(9lWQ4g!^;n}wOM4T5mMYIm@tClms<3CEIm7Vr4k8&i^gfjPzj-Z+ zQS&dbcO~F{bz7{_&>544&9E7jw@skw+Jm=8L5g(zhQ4*iGLHdOZ|G843YKG6x#)+p z^#1I{jc7kvImKyurFGO=*ZP>Z6S;Xo{i%l-*Rg1OGD}50bT8bZnFV_6>aU=Sqyb!; z2fHqLVU@PyO~`#6y`PR-;rEW;0%V`J$k&JejN5bH+pZ+OW?!@Y!7XXke{VTyaKuM9 zeVIgr0w=tZ_N73EGA>!zZJ+kcO?l(XCY7x!bEXo%xOzl2OQF0U>Vuy0+2lJ~ znV&tSm$k!|>1EpI6B0OGEIfvNTC-zt?s@{=Rpi4q^-uEtT z>n#z>`EgFH@}lz4vvA$POqTJ5_US5UyT$`=sJHP@As|DK8jeEg5TJ_O-CXejz^T60 zq0k%?@{toX&=ZrouB71|pOC^fbDI<*~QWtT<%4l-^u_}-68!7P#SX){j0f_x zRe`q6_7LsFR6V&p$iP>3lH3{kt?X4V|4bE{)%=SP2ix{q^X|w8C0Y`eMCmb*{I2!X zyc^n%*o%B0^j6Gn^>+cSRcvXH4|PN z%CX5x@+t{&rJk>jU0pR+8A_9x0;7l8(XQk_KHYpYw@gGX6@4__EAsG?PX8MzBtc1w zsEsZ;-tfh0orNPk4*S~CfbY5b)VD=k4u6P<%dR>P4yKS-PZf>=p)c@s+e6cC{c)<8 zw<_{G&g*DDfQc2vxnLj<+4Rl4WH%nD37Fah3%MiHBDl5NbNQ6I{ zfpB`0eZJGT4$;c|uGR&ALg6Ldhk`-Np-M!HlD_h)0K%WqI23{?Ka9Qj2a_uHI3E!{CfN^HgCl6rk{9mUakDNQkvY7V`_FotW~9(DdWC}ck#v(n#mBR7k#)_c!Wzd{qcU(Qxo z*Wp7UX%@O?^i^S;8{D!Ohv3m{6=4jXLOaxGf?;*DX~!e!lNA88szIqo$k{DF{5=U( z2SXIefs&$FKgf?Q(Ydpm4^a_SkNF0|-^?2?NuW;^UP8CbI44dnGv7{UtUk+_S~r&H zi~Z@N%97Iy3U^PQ#HIEY)s26Ba&s!wCwm{jqQpw@sISS8KeGHE5{eYxvA;QeR$*{k zAmyf^g|6#2o`>mcR{|69-;#^$rJh|mZ6X(0SX)^-2VF3sV0BVj= zxuju$Nf4K2@`~UpDAT_SzzGh(I7*;_B2>o4S-Lh?xuP^rirXvd z=c19h6=D{{5e!ekpK;q*hKLDFR`SSzeeBS*CdXADyC2v~b&l7BCojdmpQducR1Zg< zOrnEmbQ!;4XLSxjg3P-U#-npo^|ZhC;wps9s|Hwr@M=2Oc6!46pUkQMSd*bHewAun z_i*fkM@Nr7I!;(+9i@9M^vkf*K2}qbFON{y)rkL*JUO}*@VTB#A2?sC0ylVw^vKJJ z9&inX;YZxLq{#8jD9&H%iY?UPxgyP~b-=XivOd@&k=L8?1*jf@DX-^H_4;{qS^&MZ zF6AG?>B(>D=CX+{O$QXiJ6$`4Ij+fS-gBy&7J?^(gJxr_5A%4vz4Y8~D6Z?|DEO7| zsi!0*7H)yM^y^ImcB zGzZtDmK_;6l0>{25#KP?cea$Ejv~z}Tg5N1WE$nxlNI-YXtSlhzIGhCpgF`_r?O!e z=;5^{2UFPjX8cu*JYE0jTDeU@^~99tfj+!(n5}TVV?0lfT9cRgTW^AO$tbuHLxY_8 z#7e#wnp-c{NqT(8l>KZ;E;(aVqeW!0s-N^jPUe$~Kf@R{vk2s4tS{4I1d+qpBa9)e zjZT0cXMCF{%+1VgWI}}VaX~erSA^<7T#8`#A{4P8%6F`r=jSo}1Ij^anV=%S>YT{( zS}#6x0UZc57Sbj?V4S~q(5FPbe@F7|^BO;TCu=3;e+JC{I?XZx4QW!a(2Hr$1Z5yC zUMKIi0e8r_PGw=V+v>phvl#?GpHYUtul4usyw4Ium4=(6y`wy6@E}kj2GWJP^1oSl z$-u6LGB-oh%VCkjo3;DZ>t21iXK);ZIs0ObTIRAEpQXM^zHL>BcRy1cPT(i0OZ>E1 zgwJ7r;4MPPSAqsvO!|?#Uadp<>R=YOaN4G!DVn<#chPE_?PWd~s}f!k#)jwgQ`_QL zg?gfv`_sX)AYDgV%6tL5<7F3M`V_!V1vO=G!WOs)a$6u8$?;(e zP0$9B5671F(uBPePw~M)B^af4asL}wwIb0g2cVPa-a%@QNLA*Y#w%ps%i6YP8MM_k zFIwy;jdOmX;d?mcH_0*)hNdJ6RsSS4o@bHbZtetsU21lR76W)e?qPv^wOFiPs|aDg zcm_Zs2D1V-k}60bStiyih;4lb&;yQ~Rit6`-z9zMc$Cd-kscyezWBaINTRL>WFh9UN;c(zoPjWies$5fgXWkqu0J3Q8= ztk^WcrFMv2M_l2|8Sk{qt|B^3QWGj$*tHt1BL_uNV%{%uu_COL%&4lsiQblwdApZG+|8u4fu=m1QR%QFjkcjs9po zwZDGwf#EZ^7QH*E*^>&p;R%Z*)-N{;DDp2L$vFewW_DghqWm2sT#6E9vJVvN(&bN}{e1q|`Z%pIv(hz!Qfge8#aygdu*mS59a>PcQ^ zcxOq2*#>-N(j^fA-u`Bdp2M;l4w?^M{#ewzQ(ba>&_dy0QP#ilL3#xSau_g9Q&r!~ zKd%6d$D%zq$K^DqSZWC?)TwmDW-~Y5h}2veEkm!0R%pT{j9inS@muxjRM;(YhtFG& z%J|TKAftYhE)!M^owWGg`JU=nac@h;uXnsaw49d9!EeAp_H(LXEvrrasC?~)j@#Ko zPXjRt_-dvd+V8~=9aLjUnHOnEIt82$qqO=!GhL5o6T?@UMY6GuH)9eeVlG0zYP?x5 z)^N7+c6XuMq_F-tf#xCRHhglJ0y={~dmI~NtwEgsvY*Kgi^Vm4#~n>(-|Tpx&$T^m zeYtL2rPAT9W~(=-&uoFm>*Nu{j)&~I+(AHrzS}`a1eKvzN5r=FjMx1*2?27?8Dz?T45dHc}C#dScLvbzjeFNa|dR zJqpbCOBOpJ49WV;cC&{%#e$qfy)iM!GAmW+QBEONvp{A1)2&BqSW^6PA+YTM#y2LO z#?+qeFw<}P|6}hxrk442-3agB^jy0A*ku#C+Vt*7{^n+}J*^TPm zm{U(xagUSMURa7^{wX?xQj0L;Y7?lWYswYp8P<;6@WSOWe^DV6Lx8Pub6r_j%a;Yc zlgR3-&n+<6T)vKpixM$+5q>$TtM0v0@eei$=-WkMJl*V7)P%`+=t%A z^5Y?WJ1ZsBL1%$3(Ou)E_hxRs>*m0vH#D$j3r#}bqwC=0f=AHD~ z9`35!Zhx@>tJgxC_~*D4kkB_wb{Zc6x5UoFyCCVEpYLJIuX^mPI7i{W`H2htJ++|) zt#+B#$cfI)Gk&A=L#sMM+Kd#wUx+TSXxQoL{NNywy8l}#{f~VdmOSFy8QW)vng6v88%sOD(o*$-FVMMzp|IZI(5J6cA48Za0C$1`McOX|Gu zqfL|e>$~&YMfk>$D@R?Q`?B&+SNF@`Sjvb`gUMAl@jr3Vf5s@B{-O^W$!)KPPyXX2 zfIE@20*HG>sLK97+Ti$CUR8odPYiVl;lEyIA1we2jHGV;WD)%Aw4o{u`VxylQ-;ID< zRnv?3BOvI{zw-2W_x-&-+~rv)9EPKzhCPy2*w$)^{*Hfs%yu7>6fPWk0t@v>N^B* zEFp>9kbiANe|ZGF?yd16?Z4eBi}SJLn#=vpEBoD2zddn2Kpy$e6u-P6|C!?VVDz6U z{?D4C_*)IZ7{omC<#D(T$T1L4zshoI7y3kUsr1Ap41IY+#~DTD@yOeN%dlq1 zal(p*Q**1pdLX~7(qVpo(T|u+7j*Uy93SqM!N%R=1w1s11LJsY#X0rzb7{C$uMcl) zyUw1r8L#S3SB#%ix+xQK888ZFViL#RUgC$&qzBg>jg(p8kk|M|FERc@K(V~}&aw%S z=h18Dy<#On1ls*(Ui)=c#~o}?i?vDSehy07*h!bfsg`AfE~z? z2*{E+Fm_t%L#QNs!_cA$nE5h`i7_B;7u4wdriuwW;ev$hKcWPfVEs2ud{2HnupXb= zx-i&F=C(0gL@$s%I_@%IHlOIS3WqkzUQ(09R;)Uey=Rphk?`hz6iIza#4)D*$gOVM zb$9xaw}PU`_X|^+xQ(D9=jTDRVP=0I%KZM^F6sCbUte5V$}=qaMsgohvz-5ca8zUr zT=@{5Qq0&qaeM%vN0K@^SWX3&V3G5@9`}3shSZ7;#BpPrn)r$t=v0anZO{yuMOcF0 zopD?qsw}DPMS2%Eeg1sy5ev=g;&BojCt&*|THig3TetM?NyS}53MDq}*MDm(gG}et zg%qyGB2^Yght(a5RwHeoKZ|Kr(a2W+PJbuU7G)5%#>_M7@OhUs{WhZ&;27Mp9(s2r zY&*31wS4T=j7au7jIpr~scSv3f|22Ohtf@KCvu0y<86m38sLX}(L|ISu*z*gQQS&N zo_2RCF1PaxQ7Z8_FTB&Iw#Qq=Yvwn^7;Bj@e_yP8-`)VrRH8ngnYy!+?-EO)!6&;X z40qQEMNzZi)R#X1K?B;ENO7-&13;{JVuIZLtZ3VNqrqLKC;o;)-0pKS5w`v@aecIM ziD8L(XOih-n*K}PwMG)vwK&GZEkKBSMtI88xO~!id0NC^C*GIneYFs-u7^#k9eu`8 z_cF)d*VlKsVCgk=>w!(v8Nn_0Nk`1D$>`R)JNcJ~X;Fw{?{&`OPXx`d$**mC?08=3 zp4xdy!Eg*^f{nXr7TqH@LRR^C1j9H2Zre_XNmSq4+o(IW26i*hbR6hp1_AC>>r#K7 zHCab?o&l~v0cRiAo&;$EjXfA!)szFOB@$me6>UYvYgqgRnWs~dZq^Yo%-DLtn~PO0 zs_-QR{W0;)zn^l?36-s})5?n+I@sHU_NKRM*0}P4UU!6m^+=y7?VW!96E%k;mtDr}4|Q1)@LL$r<|@uo%NUk` z`SgH3zxMW0Kfa7SN(Q+)RMhya%1hpXkeT+Ta{bak){K?k;E=h*6E%ourp7Xnw|7Sz zWEAX)(33(|LtPuF)_Io?D=yh4GVhhJ9>LD z^cC1v(S=*>zg@zFt%7m04(lnEpK;-V%B`S-m}VTPhSmCh(!Vh37I71@JqO$#hURbKnA(;t5L0+X&HWWM(c*{ zO)4CA@GSIwM@r zm$irf+rdsvd6M~Y1d|OXLczeA=l{ z$X%-fiKlP$mQQ;2lHArqSebD&P{Ry(E58_`N7*(`u+m~p3z39;XOc$`CwLp+j=@!v z_8GOPReR#^job%&K|D0Y#tj73pr8uv%T#$i;M^I@pHaL0jbWf@h8XTMdZ7+Hot#}TP>U5MHY8LQUf(H zm2vCSfe!J4P{42;Us>)C#D1{Ek5_HH;asUSPrlO37~JUbx6JyHrq4;%aMa`K0O}j^ zZ&z{+syDCpK32%o|BgW(K0P|XM^o%i`9Ct&(`lxl7eG*+Iy=Tzm{$jnx&4*CQhs^C z2Uf`3zpC-f*-`D;)*hqiFiOktQf)KIDy$amocy}F^PbRssj7u~#6a)V>-KTC>j)$f z{>7;=@@S*ojhup&6~z2?`cevn5yB>xA*Dzz6{j_4_w+2;gPkROF=Ts-UrNYwqsnUA zis5jbEzGMw^Bmnf%4hns1oh?P6JE*nh$voroela|8y^Ch&uU@|swUVfMJ8VpBg*`4 zTZ%f~os6i=N%yf??j0QpSAx_kb*Z*S^B7o(ob4x4%Ej+57l@OKyT{7gE)2AfB*4Fk z`$F?@hdw98W0-0aCo<+BZns`G@G&mnpMTZR+EeB4_JwX|*pgizh^o$APH&GJHBa`6 zvM|;g%`^?(9}ptj$q10(pI)49l-Qwk_p`nI0Go!qB4FT*@I${YV@vYn==PWe7$t|~ zRzz6Q$x^ggv{4xN@2y+Lt7U^mNA-z`lZAu6j8wI=1CfW>&-(lTdN1WcWr=Yc9ManxWg1xB{$#nrbg$PZhiXyHo(4 z($e~aKcXzDMc0CvCGCc~nW9 zX_fzjZC#e$EK}d)Tk!VWHuG8*?<-Czvm77k^uYIP`Rm|nmN4y3tD~e+YTvwUqw|i| z*Fsk&JXS+Yl?#lJ6O;EF+`9`}W(OxPGS1AbPJB<6KpIJ7`#dnUm<*6=nlmi6aAmPC z>*My?BXwiZbyqf0aA!yqDDP^5)>sXS=I>kKM=Br_WIz8EPHblUlAj}};`TL?-Z~eQ zsJe-sLPLF)gs1IsvW@8!Ym`r8Rku+ztEH4NUvquhJ>f6%D z@?W3yMEhIm8jkgkoo%^#uy3uetg+dsaI&KFp(j1NM9+u&9?Y&9w0R@PT*1(-h3O0| zHu|XG_agTcWpFr`gV|9B>POL zk}rgKD@Q%+2lI8));R8BLx4ryajT%xiTU#4wmMjroHzE!;!dfXs*6i7u0j z!w*>5uSx;YgOx0{WJgMwC|sMi87UHbh!gM1^mt9eIQHK>99%ww<;p{DmxJZHM|Fs8`p0iu`Chn#oiyxU}&oH^jcR{X*yohU%!myDEP z-JkpC4uy*i?Xgt%H{V+Wez?$vot!}NcKOxJEbkp1^WoUlD@s8CKWgB~53kAUQ%RGJ zJnxvLyEEw}`h5^FNC3I0T8l}!+zqn8gZ*qR<~#jRrhER5 zzLHq+RqCImvfqv*uY$4^o8S9^l2ke8n=?DcaVhb*eu4w_Axm}y%|l! z$$ltz4WGNGZAdmlgDKxFdo_{sydpwu*X5EEkwCjs0~$>Iw1}U6Bnh>dtV^VE_SF#} z9`ToS@}mfM3vVTU97u8LsTZKgT0aaV938Rwz);9@`Hnh!;Fl4gw;gGWIMq##jZ}B` z@C#O5S7?tDfPUV!O`sNSMOX{X|=hWM5_CAa6h-C<1J_} zYy-Fvqx{JJuI)>8k)5GtF^JFd>}rnI{?@wL+pTh?$qMaC&q{9H-B9+%#Fu}oV4Yqm z0NMyRPMXH;H*~yVDcJs;!Rx0BZ)nG~#k0fKDpC?%pN1RXZm{lEz7%XJp(s}7r9EkK#NmemU}GAF1%>=z`9L;$0h^2PE zGiF$h98WN5S8#~9QbW-sgp+uEKABwKGE_P&x6io5pxT)voYXLsf_TD@cy9wmegoRn z!5Fr9Ke0>rSR%NNfue7BTWAKlvvOp`o72{oLU}4i_Q4B1WlFuxi17r-y!YJnw%;O) ziSzVl=>{(AK8s1~lmPlKd=}Xrm+ue@HA)Sxc_s$>y{~#kR`Ia>_6HIsUD~q=*>9yC zm3yUtFuGa8ppxhGN_b^Gw zJE=cUkL_!%!9MaxhnS8Ein`6E!Sn-6AaA)~(fGyhRUC6isiKXtC;;!lrdiA@?gScj zMiM>FisV)k?ADNtIN;4h?o5`w&JQ1Jvt?64$W<9GkqFDfYClCS)_nHu|1=<%w^#LT zn!a&Ks{u`$kzfU4?m8h6LM$)R>uB8cxC~)h4p7{|@|eySOEF+bcr(S=u2GaNsTNW= zjkeA^mHFw5a*a8scTXUbk&T%uwGT~;imRQHrlY0~?NQHD^<3SyZr3XPV(?8=P|lUS znW0IX^x?EEMFf|QYCN08?K4d0D?+Zds*_hcM3aZ-onzM7V_{RL^w^FQ2+M1nRDadx zNNv`7h|PQJwmBC_x3?(fwz103n{|o#jO!$i9br#M@~tZk9Q4dAr=63hW&6%Bh+J32 zh&H^b`5Vy$=r5gnbTL5Il=xX%u#aCaHJieQs2XCH73R}0J94~3U7NZBj|8GD1IO|M zvXv~l$|gExw$#?sCr3XMUO%<`(*ODE_8^|v^Bp1-1EKKo3QLnMt|K_=&C#h)PHh&L z&-Vvf@}}vh`l@%|=aZiL(P!*Tu{4PFePR|63KUYzWW2+h2NunvtYWYZ{``jLCG0X} zOZC0l%jzCF*hNg!ue4mQ+f60+mwsHwv8Mg$QCRbafc1HA*A(4$aQEAj7fzEriRM*0 zI8+JDHe)KS;n@@%JG*t*jp)XzS4b!@TO_|84=1s{=*5NGG(>q{I87Pik=BX`WjfGc zmA;C4rJwHH1*^sH5cxvQY6o-l207GojX5wMZVP+u?@(w;WNJkcs@B?gz3hwPF^Ef1 zm+xA9(>2epH1T3kSlis&XnR$ zAIbNivL62F@hCB)s38?8jPla$zEwv7Hw|y$tbrVCYnXIPjXHkz+_i@fTTUNrwDN|b zrb#1(PRE_fkP89=3dIjxO77N$l+tpzy0AcJn>(-iLL&uT3ywsccffx5cA)=`!p*`w zU)o-4waUN(eU`eTYRvxqz7ufUT0DZcKjqT2JBo}*#@ySQkwSA1h@9jCCPzMxi+waY zp^-x?KUcbr-6vMNdiom-Ua#!skrE$&R#z1pdg@yL)LSXexl_Dtr_sg~E-OQB^%)uU zh&thOeUFa-kRD44vrg$rF?)kFkFKohrPt@TppV#$ino{lxSx z3%_!x`C>T*?Ba&^+zULGjN_LUk8YtzdWEF#NX`LO{HbcytQahb=M-k!*vP1o!~=+_ zX~v=d8Yk}V6CDN-F?r1=<#$vpvqo#b6V5p?Cp=$P0%~m6x=qxfvo8DCP_F8^r5vwx z3s9xGx;f##j3$z5Hf~_Bt-B}Aw%_JITq=9?e@oafBMLqnP~-hg7V46Ii(S7q(>J*b7p=Td3dHJOogg?PX6Lk+yO zkA#33QMtwXq%k}$d5FaiP#vO-jF9Rg(uDfYUN{%NB=LZ86rC%r^D?5iajgL4=kBH= z&3CjYHd9a?iK9ULCjZ!rbt!kJ{EZ`tuv@+p@zY3}f(o0(1%xvi$!ZX>O9~2Ga}Ze?wCoLcuunJPS{DvdD4^hy6=+ zUwoH@IjxHui5V4i8mwCE>JF=x4;*v7*)0Zl5*(l%3Bu{V7f2}RZ47u03QE64YUxk= z7m+-_Jnf6WA)gRqd_uzPP10bUKl&AOmm(fET)Zb)rQ|rC@S%Y}(ms2GYWmFB10k|@ zc^;Phk;&->MjD$sAnbE6(9$+I6)RQ!BRl7yP9s?dy1N#N&aa+1mEDIss`Pkh#@2Cn z#xX~`DD_!vv7cVGPmbTfbCsjPiVZfY$M0y{vP#mMrX`4fBm*HdltZg9Tjg$FhfT2D|bZHUeiNP zbeEr2be<$qiK>e$t{N@3jaJuU?~uTbIb2RWfMxNqVXE^+>Y*!5mVt&#!SAXl& z{ft5EWS})Kom#5*K`y!jQBQo%qvAP{71_P)2e0Aht+P#V>oUx7EzdJ)ICcB>t2Zvs zmsw*-G7@e(WtZLEyMW}{*TNX`>Yzs~=^m*n*TNegb_YHoQWo(-F)=6$&tMDAOpL-XtKO+N)ymhSKm31G@rv7>?1+MS z^t)=_*!d1yYXPX7Hr_4I3G*YY_dL|Pui|xeCjEmqj!W!ZB|%J){;fI^qarKq~hDk#C{|7DI90ae{hEf0k=+qe|I zY}g^$&n7v=QGJf*()lg>xl87|fu!!t9ScXs^*GWNV)hyF(>6KD@wQ8}q<4;1t=vF? zVAN&!f7Gp>bk%xmXqMKopW8XD1RTyQJ@AsdWVm*(`6I%94rT9~3Qdq7y-J?7XfB=N z>m!j&g`Qi}h3X#45etejuYaz-zaGgXfXsh!?L7ylrr8PceTxcqocrDz6vDY(mviBE zq}&DG=@L;O=A=v`9t>pPhPN!$&?TJ@hm}g;#h}6+TkItl%?=$m(6r6dCFMutXyh!N zVt?D3q{wx1B2A4ghmLtFTW523E#K3aYe-NgB!M)F*p>;taE0y#k1eJaTgNMrDwz`^ zQ6y4Fb}HNSWn74s!uETAuLxeFiOybL;%DATLWAGlUNYfO*Z=_X3J1}KK@1G#cfirE zGDhqUD5BHlD#5l;<}I_RTguFio@fEBQQ7FqT+I$M)oTNgrukzn znw-nG;dJqxdYmnGwsQyrF!BE*rkFZHkCP@SpqQK1ler^pSR=Tg z4?byxrAn(ilSST(e-M-!so9T=*y-U&RedEpaQ%wM&9IibRzqieGKRmS!eKnNvT-a{ zbZ*l%*kgXoA!#!KD~uhhL~bTb`b%;h!^7@Hiu}7%a{#AKuTc;A=U4MI3l%wV>LTSd z#ea3`7&740?7WfxfadtssqX=&=2Fk1{#U0?KX&RCIn-a?>YpErs6dDy*I4=~u>6O2 z;unBs7HHSUY^VzV>-+tmDSk8Oe_rvsll*6j|Ffp>9V^O=5b3?~jtw(yspnJqFLB40 z>uR9`4iQrtku=KpBu({SV~h52Y)RvB`uEuK;CR8*&iYrBElbpKY{`-v|IPdV7U=ju zX_%2(ljGk}xM?7^XfLS>{cfwjoI_InILy9?l>L|6JxTN{Vz}>rffzo{9sV-~FfkSN z|7E7IXDNh^3gUpk4;1XP>jahu3$RE4kP<$t8||hrROyfbQu;Q4a54j0F&#B8ub0dn z!~XzaOdkEo^lg0yqv*kUq3QSc6=FATKlCkQDO8e7W)`7@j#oKNK1ljAufhKMJJFDl zdunHujlqs~0Gu2j)iIrZ*-0JFsa)uj=r$MY{GBy=Rfv*0m2P(~z5oh@MLO2cSMM)X zsqo%)nCnD5|0%pGat zk@UyT=GCIy-iHSyy3i;C*!qvJKvcQ>SOW;i)gK)=&w_ekwidG4%E&$dCA?BtF@y*e zUor#3K?~zyR%U?cUaZY1M7FYA!K1sSEjshI#l8rAY5cT-W8$m?E%FHd7E}#el9?FSR87*Rt>o~$H0JXq%6|06wGq6z1(*=8cszO{H%mc{-Ukd{#H?N zyr49{hy0ulC<+w-&6xLxD#&>|-)iceL#FV^ZMgg;b|C<=b+Xi@#Gvok^Zkh+V5)M`9cJFm7_DCt zFJKD;BD+eSI_1OOXoAt1rXvf9s^lP^y1VNFNnZ?&M-gaT-t5lk=>7?-I!_riR+sAr zQSHgriXg_N@4%*HoSLOEsPExyv^hbeB0?38T*;n2oz9qHsDO1}X{!P6P9vqnSUDE! zwz=X@DRFE2dGcL*KaCvcCu2~V+>m(aX!+N1#4}TW$NAPTq|^r-3_>s)jqC(lGP~um zy}ae=Bme4~cdhy!3DwG032+|NDCcV11J!8f;Z;a1EG1A`dhkx|w+`eKL9cz5BTH5N zZHq2RwYb#K@vr4)8CN&x*gg)=61v$sa6P=%D)z@1PjxIfJ7Z~k*;vo7k1UK<>rFsQ zBqwfa2R!4%yFpQxAnp-hBtv_Iec&DK zf>)qYpwCS`AIoR*GMEADpQm5hbGFl?B9gJ-3a{(wnkXI1;*1c3PJ_ zYcHl)7TQJ8tZ?Zeatma9iO1hSu;r6BUt4H2KRr6v8ZT7f%`Ma6B_wumu-REBb1;G& z963vOMs#k$1b`rv%D_91n@Ezt-|6PvjF)p+8;G~njgPn88Ljacgju`I1oJ@KR1n{{ zmzcoYBp1G3O=+ANLY|{lo~@CyZ}t&dlI(`@)}6$f)M1g_hNVLhPp2Cx#S0Uwo%iea z)7#@cJz%z@1Hzcmq%M)OW%DxzC)98YKr5=aYI})wxTYA@vbRM&=_NGMS1o!Pw*0w% zZMxCswVYXT@Aj&u5~j*&IhN-_rhL3${|%)$o2H5xli}ht@q)^bubUk?PcxF?RhV=5 zV;JnYK;|d&2_7K^a5rw|m=SE<&8OZ~Gu|bm%m9vo;2-lS17WRhb?s=&kQ4&Du(H3O zQy`BaA#Mn1bNNIAL1gwn&(ctI#uQnE#QPGSis>oMeEWRfUqTJ^KT*Fq3rjjI|j#i*% zReID-yi8~4I)MaJw==QjEdXb`)FU5U*bf`?sad^e5Zhyx8&)m(v2$~FVl*pJ2PWu7k)zs1{La6pz(^vV&!p-|!zf`eSI5M}`=Yg+fsZ2Ow1&Ia?gzXeR)~&=k8|m{ z7e{?wvchVs?aU1Yo0XxWoqnzR2Q}Fq{_**e6Up8OmOzYc$EYy6KpW>zfcP%c;E^X(deheF=nzlsIksc#T)^4?#fMBE$V%bTXWZCfG+Y4Eoa=?gd?47lxN`=Ca+RC^`_tnOoOC7z1^MDD-Vf89}ZSS*2HgT`y@w_#uBNBd%6d2#$*G4d647Ot@>GDgkea z;*O3nyn2`SV5Y-XBxLJQ>+y0?hMD8EwExGYRl-F6k;;Vqi2L^?D-r&kAEZ|=f127+ zlE9l9d9GJZN*Yk%U6zr8xai@-yFK$3pRmq%<|z^>?}dJ~YX~)njlDCqxrncpY{U3G9D9(I2R`H0k1gKJIAZ?%_Ccwz1y(9Xb?MlR;!j_%<`I; z>7@Mftz@3eT;Gm6RB1p1!`TU_@>AxfqulH82%IXUJ3GOFhVQ4D5Qz?wo^94W0lEk3k}`w~>=!RY z=;mkSoO-HX?VN|lRGNDgDnsJ>MfFc60DZ3>k~e)0PUBTbwefrc;`8niIfp6Zpt)8K z0IT1yafT}d;Y-p?L7|EM3p78q8xquA(U66IAYv=6bgr<{NeM7N$Honz!DMH5AX0i*32Lxh@#zVSt&TzE3ASo4ouZ=nX+z*qa>< zi*A;Ls(RHtD}hM{Rl2a3fV+*E7PFXQ;ly@XzAoXcKWP3Kx=(&h*6TJv#J8d*M6u&8 zNQtD#O?X=j=D>iA3`Qa?m9@htvg-?xd3zDog3oPA8HC?5+WokCQQ25eiZ}0mtr(DC zG#)ovfc-M6WqV4IkUM@1`0&=a%cQ-Fd0WZy7;byTp@Y;&1F>rWNyNbqipt|}o4r|- znNL$w;9y?4H-&=$vhA1sUr%qRYhj?{(DUww+6x3x zA6U7Y3=Ic6JVYnvL-`G^_qlOYjIxRv=AL$HlkM~m%6QECVRe)svD|Ump;bcfK%2fH z0Hq15AASR?*CEb#TJ7F5a5?$F-FBJ4-fBLWMWeS)0OOI~=}L@nYS5$W+7f!f(Vo8MQ0 zWNKAT#FOPO$>p@fnkU6pjIjfpPlCG7pz=Sh)lpeUIK7ONdwECId>v^d&cS`&0*x?)1*u<8!Xu~<)w+naA z~k z79G_g737(HHBqjV67E!s-{x-`w|w46A@sm0v(ixa=+ z8DQ1wabJmaf;9NgaJeSuzzhz08A*=Ao@JF^YNxD0M8CAaIB_a-WaGx=Ip*z4Oj!>c zCSH~5-%@bNSa8sCIrIbqm72xs?40vFxy~y?-Qy_bTkDrEwsl_nQ$^w3IgqjP-xDSr zv_HZpdUl!+>jhReboGVX){`C8svJD$g<^N6*|D>JOf3wMxoXUc?O-(oVA^&j07gibT#5Mn^m`AhIHRJn(jfuqNh^Gk1BUMsQQWIxOt3*qrBWoAo#7)&2VYw~B&p(Ic_&cVD#9&%ouhD)P9 zC0EW!xk}!0FxdMctg!mm1K^rg|UDux9b_G!!2&tu~PeRq?g#P z0iCd4s_#7~>q=Q=nYED*2d>%VJXYTA4sIj76;pnAK@GykXPIsf8J)Ho-8p--k6cys zT}vH9a6HB;w8&J1!e1TbbSzutSCKR$RubyJoczrk|r>kd|NsJR-%sHUN60AZP4I}o!_P`AOoPAJF*X2a! zf}g=Bhgid)(j&^bnhzox5!o63a^|1NXZWAVV_n=A6=~BRcaL)bW}SRY*wLSAc)n-O zKU&C-lj1ZHxWt)~l%h~zxulgnks?J|@B`)}N<%Chd9?k8(+bBtz9ZJL{lIWWHT(km z^W0<^Lcvqgo8Eh=fV#NOQ1n+!{ z9zzvW_FQV}#E%X26!ivagF9U(;^{MQEv#3YyWCp}>hs%_>f9A}*h#Yw+Y}qL)=T@; z`qhgC5sY{B7PC9|9pVRT?z+tW>LR*|+c3x477Z6rSW(SgqARE1 zpfl2Mgw>&FdyQkr+@T{0?{-W>84B-=ydUACheC9m>gwI+I{CemeQ9v8);?tsF*;!h7Zq zqo+88?09~T20U&CHCr4PKuTTD4A8~hzgtrt1q;9uk}JlUni$wg*HU-psD6FuEi{tB zObCw(~-O?^fmW-3P@3#i@^OhoM z56pn<{g#`1B)P}IF0)r0(fCqc!sLhA{QJ=g=*p3gsWl56a1m;;o!jW!@@S@_R^qLvgL?2vufPnXutzGy5uRqWC$A zKm61FIyL1Kl9c*eHPaNS@MK`+D9%YNEBLWT0LG|jBrCPPT9qmbP5*#rVXxMtsRK_Z z`%Km@!%ttZy83jno|Ug`WXD>AutA0EOz^x9HATsvT)))jiSUjE*-wg z1vAsf*if9$Y7pVA-BM+~qeUM(R{0#Ke>7sw(cmWK0wQ#FKR4YV($5 zuO}cvPM|^=z4CJ;%1^Nl%y+CeMcY9#m9{Znj3s4bdyicx04w^g#6r>PNRQ_<2JH{A zy=f3Nl4>|wE3w~vWKdY|1&5BkyEX8|*YIs{0YuXJj|d2soZ}fSRvujUJnnm#2Z&QX z%QHgyVzRQCjPW?{XN)3aW0z5AxZ zIHZ&u(HZ*rF7S7B@x>*g!V|nHXrnOs)@^K01)KS`tm}RbAEWwH-nV?st2VvYNj|-Yr<@z=eUjRDeHv$gPW^)P zS-ncSk)KmGlFXLq`rg2O*i19M?e%Mh6o+9M=IsqS37|UJ`(=@aLwyZWDRAYWcD!d^%TQ%0NxW8~7|3bwB^xKT>f`P;QJqfT{C$YxFL;?Rx-3m#fSUh> z#3DnwZMJL24Xy7r=f_QnoBjGomlEkkrk*PMt1=P!_YrR%%xsWy7S>LnTDi1SQW8B| z*fk4{8;s8#WsWY*SL-DR*^Ev3-_A&kqRORsrn(AE(^M88N#qIecYni)d8XXAsYkfI zD2GvzVMMWUHs`q0+@u`H0EIX~=mx}`oQ`M3Va#gowpq*d^bTdEM`kI?Fna5kmqB^5Q_@=3PO$y{Dl4Ld-4KuLTX`}19} zfbspL<#qNQ8dR&+8uYzf*wv;AH0P{$@-ji7?!$td^6H&fzfV$Yy1hXAeRik&p=b|k zT6}Pui2}jK4LysH2?aH-b^jm4kT98G`o$e7cn)Z7EZ7WhRPN-3WC+0O6>E*|q?mV& z@?CzA<izcFVEw{Fmn6M9&wxoS;*EJM-OGC<@3%$2;iG$mZ^W=Y z;w^1S6ZoEdbkq9-r=yR4VzuAq=f`Y`E1@6PHdS>)A$fYOnJQ$Wx+eY3sw9)fsV9K>2>?Uj7M_kNkn~b{KGfEcR|k+{QLi^ZQA^X zV0NtIjYqKHzjbeikA=AeB~A?e90mDjhzJWO=>PtAieK<||JmXfGyG!o72x($a@>@a#!^*~uRRY6yIm5GkL}ZL! zHdZBTA_ROiQ)3s@3_1S%lB!-{;ePx^tme-v#2;P@s?g(BlYK$gjeog{6TTOYMe3Rx zgMPkce>qye34mBkSTg7zMqmHDjpHN0AD(jl?=pTh@qgC%qpv+uVR3m=uyOVGdJ@q2 zJND|f!3MG)a>uT|-p``@2jH$G?S+(iXWB8#JD2_(a)0-^=2hU-lnvLwz!_ra$L;iB zZfnmS=(v^>&&1={soe9GXKTVa}s((g-(P6h1E3(p_P*lzD#*Ucf)y zMY}M0#1BSi=z{UnRTqRx4aalPAp3i4pG4?o55}**4&njBUd!1WN8T>>9@BeXZ+;o2 zzGUdtAGtojHS&imK3)LrUIC#-@h{GWe*D~ehPDoKZAGBPC|&C$(HZl^#c9D9BulT{ zFFkv}l5@HSt|8RwJ*0wo-fC6tG4v59fJ>S-z+1C!Fq?M{E)`EM%ik>}KAsxH?|mrT zKegTl)Omp1$YRL)kcmN_T(nmcYIWShrdBi>Ggj1CU_Df5i*Dgu9?HLy(A!%ZmZg3( zI=19l`fWPizpiiZ>VWBb2l>^kae#4`w;#}N^Zf^_O8NbU@cHDUWCH^%$FbN;Un}1= z0-eVxyDHMu{saDVaBD(u+>N5W`}3hY$oay{13A;J&ZbG%&Ku2;5?s2HGUaZ;ZctUK z5G&HolWRDxWLW(y509Pn{!p^^cf4@I2|`(>tAPz*v{oJ(T@E;}?JKE3??H65EXb-= ze0Pe_V>4K2B}|5?49o%^1^V(d{mOT9r$!P7=I#A3bAfh{=AGqh1!G#-kZ$D`J z#*<*NTn;V09U!Zl!(ULQ*I9QZr>JYfln68`EsOxuT;eURLH4rIXILdF>XpOcU08yI zZN7G859rmKLr2DJj?oJVSj{RUn8pp&BuSYCOylXZgD z16-rC1K2M!p?YAl5<2r^Nb&J(cc7l_t~TY-{H~#{4mO^I0R7)e!|`P_b`PmH-$8jj zUqM8WZqvg%$E-BiPOm(Df&5fm70zolu@t4FNt zHZjrnx36B_e+M0_`_4hbZ5yiZ7&@6cid?lB|5j_WIfyr7qv3#ZB65p`(mgE{aBM_E zLN=qOgP!o5?RZER0y6<)qv0`g80;wTxRzY3!wE}~mc$`{z zTBrSf@H%5)vf<}-4c)V<+xO7ruY95HE@155@W)W`r$8MbG|_Y8yCD2?sIz}O;H4(- zTSW}WE(5`@F zfcd{Hx~ENF9pivr2=8#R>y~CNvgM(+dX@UwI$z zJlmc)IFWOdit31Mg==qxd-2V4itfMqELe;(=dm*wng0P>v*g6tuU}V_4fo`Mz9#rV z6T)piGkRv-$y3-Rri{t6yjB!%qDE;iJ3y=K<1(^k$)gSFP!vX8K=MH*;i7yjd89}n z&Q`njdDD455uGPDm=9+HEoiEP=|HB^hWk6?#G7Ci;>aDBb4AM2pW))fRRXtAy-F@6 zU>7zDI^8SBQe5WAxMXiU7&EmNx{vu0WIgmlItc2wEDZ!!lyFIXqWU6PegR}7K*$;f zl!$jWmpbCtB@QhxH4MVdxsny`PRMOdCF`NgFr#$q!KPf*ue}DHn+4+r67Bdq_za)J zx0fVvIqV+aE%Sz$TUBi>+n4%0njCec~TC|WhK(0@L9p7i%+>DOJ% zC05B!^xOB(AYeyAN1(vbSC*qxD^|p<)VE@47Aib^bU5zEjGwXRkty$aFNOsJ@s{U1 z<)!Q+F?1n96e3x-&D+I1y0#DD&<&hsT{FAjhxWmpb|+@s;4ZH<`OP8yk~!AbzEEgz zPrz(TEpLAlz_ICvE<-@HhfJ2}E#B|j)L|Dt9&4Elzph*{`(6&9uHu~MfQrYQLOi9b zPjlm0(YCldu&4f~&N?1@asSOOgA`+_9D{1b!jbEtWPZGcHFx+5@nFV6#fcq9Zx!_{ z)q8UOFN4oxX1^~JjAtZjPEguqxy@B2O~(tuHWsxaG^M32)$jSwz^@+t8Pa!}<=shw zN`7O;TmrBbzvA>gs{upU&V?3>32zRe=S$^nM*S#)@S8>kQ$SZ8)#((pvXzQjDWb;? zQ=1r-CiS}GbgDw!COX9P-$PbZB6=(s~za!mJiz4GFhX% zNv{NtZ*2F;zj8E)^|%xlNo?MB7;Z4OH=R^PT@6@$iond_Zz9(JvaSq_ zIHo~W!Z#sP$h@}FKhI_1i$nnc!0knmiCK`>OIdi>KSYq6mM)%j1jiY=5jn#T$mN!sa&2Axsd$fn#0$X1lAK3HDkjiK=_4k0Wu};eYA&hX>{V5IQI+I^lxvD zQj%R#HYFAyXzyBC^WukqogBgLBjZN@(@!&D5@WiTsGPiql`oksfYutYYI?7ms=e`5 z=KmZmHJV?+?I*Do!#kGH-?Cbqv>!0a#%mo4z(!as_#rlY`{z{H5V(L*sWB}7MZLP| zOFy`W;iOMhtEd%f{(UqhkbJqB@Cqgd8`5z3^PQ)f6f z2y%<|Y{!xahrGhGYTTeSa9IC z7wpB7vlewWk20tiP(IG-01RtQn?RQ8#^$SkDO=xGcej1w96OyLlokZ!({DoKNvbu4 zmP-E{WCx6a-|cu__x(v~Q0KieUWX+Lt0cVXwj0{_t*nI+e+plzBQb?|tjH~mCdY#b zRPo`Vxe1HOO_M~=>0f^e@WT*mO8ChPRw_PO2Zb_!i?Jbgh{s>&)h4+8C8TdL2}sIs zFz!TqK~)VGC? z>1JhCLwRS$sQg)GMhNcK2FTslB|~Zpz^b;_Egg! z{tsJ0zxQGmx-g|9zi@#Hgh&N6-WhFnG5&2rePl7|8D<+#@p5xX-`$Lap}c165?wSF zB$z@fCkDIhhmR<=^OhlytdATu`&Z^_*sxkRWb9D6X$O#A72j}n$JUg~VdH;FWwA_bs4*vsEBbIa5++-1NWSXw?yso_tM|jl<3_Bc@8*N)#zZnS3;@LVv2XI z{`ynnkd7QKFNEO78?!^EHk^_%XbC)X^yD^o$@cWOV)QLKMXI0U;x-0ejl)U=Bwj;(A& zjcMog)K3xY9Us*>MMOidwjYPtEPA?1K4)|eSH%ikE3_>%zN@C-y;gYz(hXF3Wgo;| ztSq<1Y8bi$cC`$G?UX6<^nLq57mQKX*W(UV2} zw*K!!|MV#yK>Hc<^A#X&*zYnfd$A$yrowDbI?vwSRdYdxu##$f&E;n79?b_C>fMV& zB`#PvqfV~8;oJ>b+nA4<@U)bwsmjwikWbHw4Jz!Vx?C>{{ad{7V|WJ^q>;JtWdURU z|E$ZZS1sR##Fp0H9&;V(fdI+N5I|#WG3=;R_J8Wrv>l-0n)J{=PkTr|6d;~iGpP!j z-ZF_0-+(Ho`%lLB7XLHR{*1(q0;0_}Q|O;#Fjp&6JBr+YS+V**rH(Hg1*X-mD@K+5 ze{l|_IN%W^I}wSn|DPTIL1RE65IO(;S@r*%<@|T&3Y<*0AB9Y=XEpkb-TbeOc_x~t zD?z>*7$z5Z$UOhw0MAuh;5z!AQhj&lk3*G?`2!{95-`;r`+SAe?j-1RoaZC&c#Ye$ z_O}u#i-wWwewzVQEK>s72Qc?bbz%~iN-AElNFCAa)*f~8eHUNKjgOY!1{*{gvStj1 za~E#>; zZ)mV~e{gS_u^ zgT4OigX-$j{C~cx57@n24ik!?5&bAX&d1cGyEnst?#5}I$IhiXPZQ(o2RH)XUW!&E z{Ytxazo8!nVY=#!(<4}oJnPiL35RzA$S{;sRWQDGZRQM3F9Y0sg76Wc9vW0+}x01X3V z4nK!;T71*wD(WN@u#P}!ajS~H!o!nvvA219j!Mg_SW2*Vs{@cgt56=^tBo?hX}Y|% zj14+)c;{JLbA9Ga(&+VDu`3yh3w4JN%XSvx7Wb7rH%Z-5UHf|#UA43Wdc?Xm z#uMZ^YHq3gptx&awzdV@d*K&M#6{tT>7x`NznLgcgj)dl3outvVcgg$E5xby~xGw~^xVfP41I>i#daFPo(Rsk_T& zRxYT;!DsPq88JrPS3WRjEcB!5FP}%}CCIkuxTLwJjI#o3aw)yU*nIIUx_GM+N!y0fDWLo*7IHUwT)M$t~F@s{8>Q zNUM)r)cb5=GT)e=QPI5d9ppU+e2Y$t4%-U_x;F#A?X#|Rj!%Pk$^<0=cE)_>+JS>t z^|G?ONg3_X3Q077k&G6rN$AUGW~&k0|GsEOAW}l1egXoqd+`eS)5=H)ORe;qR1rg+l){8 zj(dqg($#jLbEe`0h(7Y4Qs<63Jox=HyFJPPyWdA_1E50e*cMk`>$&$Z22Kb92${nZ zd8hitb+r2CzKTK*e6c8V^TcjMZAt|5(6)8-sxPxRcVPtk|Jw<$udcUDZJY%!*z+3o{;ME0(x*v?! zBM>3c28NB#P<(6GVaa2GLswPi7QRBAm}3(Sy7s~EoOjnUZ~L7!?r1RKOn1f)Sk<{Y zJtM3XKGUG$M;K-q_B!G|aggZ=!}0fnoxm9LSfRTbVhG{vksP1uboo|oHQ2^#Cy*luUUC4qB z03KZ1#+0&yxe@Y@s=m4V5z&@3X4AnkRi#K`AibLkRw7)&Fh5U-jWjR|)|-0_raBD2 zR6PTj2%^~Iaf9pbM)h!NzIV|5?wb!uI4Tc)zK=BagsI*%xkaaJ(Mwp&S>WyB{XyUl zQbS zS)M60_7aO5FqvO*?!^!0E_->nbBG#_y@^!!Y#7zXr;?qr=-CC#i~pPgCdz*__IRtW zuT`l@Dx)cwnofEI_Uu945eeNLw}x=5ky>y5H*v9VIyzHGaf?9zqN72B>f)wAA- z{c|zuvEKs~zpMCB<3^8z1AcO%Eg50O7PX7Ky7~Ogr|%&cCu0?$O_^`MbvVASyiKWA z@t6wuRJ1cBGz+r$Tc34Em}hf}4#+t?p-)m+nucIe&H0gv3ffQcadlp;#lfbpyu75! zDS~KzYk0Hw?iInnNiF)qa4SHSj7IwPx9-I2fd zoDxWFV)z=mob==m;rUEDz`6PJd&MK{_YrI-Z>jlRObb~RG&I0TQ%L~{$bQbsMqAao zQNlX~Qs4P?*kd<^U{nH%%ec1jna=C5wc+bhg^59o>B2ov6SJ|hu4 zL$ccM<^SL>ru6n#kfhv52N<-WHRmo0jP}J1r$)v@XTSAR=?+y+@r zJG=dOQ%Em562q`rGngy(sYpXw4ifd1w|+Vo?cVVFF1w2t{%o)grfPcVx->_9W03y} zgH0gKUfTQF-Em>hhmO<88o<5$7cvMs6@5L1uN^x(J{u&NDDPJc^Jd@g_$^3;4t5=m zQup#X4d6coAf+^%fGEf{ym_+|nXh<-cfx$|xws(Hw-FcJedT)-7hZ_@QB8#A7LhWu z7)u-F!nQI$7%kz#?GjbFKo3qis8KX<+8@8paaG8HUR)Bnib&6m89p4 z`}L*jWFV=*zL73-7EHyW9vmDuTxLmvj;==gZp&gS z1vJjSudJhPS$?tGEoWQW0B}ycE=tD|HjLTkqQ*Y0_eAwcKBDm{Xxy&69-|~W{`81$ zUOlmo`d~X?y*(r}2+jg>*P>MBmI&n7@j09VK(3>+J8yBxL*(-V?Fsj0H1Q?4=H(;Z zS9}YR7Lj7hh}r!YY`8xg8P(7KX#}o9CXb5#u%Ly*slxupkZ1cuZG@^ua&>PR-Zp4n z`7T!KTM32WOFqUyKY7Zp*y8`WStnO0_9@7AQl z3Q=fU22<9wIaOUCdPO~U>Yzpl3DAl;3#%<>A}5-g$%li|w{tA7If^SzjP@fpQl|JY zjbE8&CT9YBGh4a(d9wjjl!HO5t^kkIVb(hS_i*D_t@^#3RJ;K(%WHSPtk#X8P?;T~e)!sAywAOVE}_U_P-)Z2UnwMu7+_EYy6IyNXtAe!1Q_ut7#B zzHkG^Bgoz&-?WmzOcN~5`}ghEDPawN5~Q(YvBXqioJmOZ;(d6V{HCV7*Qpt$`7}da z^3gHB2Lk|8%k0<*ql&J~ND{=)=Zj0q4ZrX{pXw$_=6;CU%7$H{DEF_C5=OV8Epx!k z5{T_Z_HKPjzA<1{0e}5o;>K5g1#=uA+=B>D#t^lC>KsLw7ALMga@}}g=*{+( zos@6Rf!LYPyphUS1y2F?yA*ZBCSO{PBvHFJz1;GTHkUD6W{sM7lZdk0M)=m_CkEg0 z#KeHt8)ybx-R2lhQ2$k&8as8{IL4E4TzxLJ+TbRGJVG~@J(JV2UOQqlmAFA*yatcf z%|B$dLVmzkB1D&*{fzbVfSc6XXT;hVJ0ga{ysATCKB%Cb;1iUEf-N+j*f(5`hHv8+ zfNHY|IY_=u8Zh&b**A#i^~3lDtFNrH>p%_pg3{gP(Sd4mEkHfzg2|y!ioY_`o6v4x zQhJITx{p6o7=L{L)9Rod{*D#oWi)*j{A-gznL@NL zp6+dGgK(dG_X9tX=i{S z64htJ`8QxI3U^kZtjdxo(HQW`OCr#V4zI7jWKs>N*-jJ{A41x#jLnIyqBLe423(e5 z*yjo?Kfh5GzZK`Mge%^RsUZ5 z8066WEFUC|+#`cNs;8X+9)bF$1-s8ehYjGL90XfK^%M>A~ zj&sLDD=yzYjqg({)hdDP4X_ul=X2`fBh`N<97%GSwjvyeCaRpxbBZuthEMdtvvtbr zAx3c}{_U&BsDg~{H}wf*VPl33f?ih7aa}Y(Mhk*?LtzF>i##Is5Mc?%3)Wp|vZ3^2 z08+co2`!gIDwkW;7Dp5C*VxmshU-OtJ6w<4_N@wrV7;lnV0rU3G+f>11yn=_ZELuB zgfST|jA|L+=lXDOpTX`G`O+^gBr8zIm|yuMh*on?x#_+-;H{@Ibj}-9w|pYH6xOcVHyEgrlF=iCzUKb|q?byJyt( z-57<`r~zFmGFO(Fl0N}olqt8Xf~WFX2qd`sI$ap#i@yYV_IE)lJm=G{pD!3Z`jEar{g|2R+4<9#bvP2giS1Z^L-p@d))#$Ot8i?-sUt7UpAnxJ zuDy;hGYTwb|1vky)9wJWcuF|D;Jo+y5xit^TnF$)&SQ#`9GIKCOpiQ9ck)tTI0pgK-;8gO8xQ?iQg)u=-P_4JMP z;uz)ETDqy{v>k({O3E8M>o8{Odf-?S6hN(b6WRte^qY?qnzvTJIjOudtC5JWSt7;t z#Pp5I7GeVE$1@TxDcuzi`Qd)UM&Ny~=Z+>SkQMM(GBR;IzzmzuXu__KBSmGsU1iPR zPfVfDpOe41HOd+D*<#^%J>1bwB&9PQC=s1g1C#K?I+Yo|8#kGYZe zVb)$|Jr;DlX#U(%W+;?pZ=7L{ZhMSjBlIqAT`PYtxKy&YvMR#;RoO{#js9t@x)QDxkcZx)i=-@ z{qz^NKIMyoQhU7&gTKgD{Mmmowy8WM;Lvr;iuh;xiDM@b&95UY;(&qhHW|tE^8^&r z9^frFx@Ncg!>q3nHtD@3Wl()4Z5Nc4u4-6G?-0CD=EmM#X#SjVvUPR6Y3YDeI z?K}Ot-nd_)MlTlLbVx=OpB1?O>Nw*L@r$B%^eS)jzyPBs zch@Vt|Es}T)Z-&~D{$<9$%B2WP>{#mJtl<2xNP{NUd(pn$w&!0Out^lmgJJcrwEn_&>=y-MX^ktV(`6M8BA9z~O=_hOuvqLgqzB=pt%D?&<+ zC24hQByXWlf?PzY?)BM=%Tcx!nI6H{G8r zA-Rgm;gn=wKc!_XE-L`yyEx8C0SaHAyys#|)-z)VGS-8~dp7VWY!+WP%&Ni$4TF$so4eXQ_UBf3cZty3Y$m?JvJ75u~ox0Qo%nM4nsf z%bK8_rS7ymyA10^(S-dbjQW_neUyw<>NSX@dkCA&j87MtL5lm7C2mxN{pm|^R1eNB zlk;v`b9D!9i<&uwT7@mvn-1Kfkxsfp6QH#JMdGjd8>>EZly^|95{1l?DRhBJO zPqCleCQLzXgELs|2zo-d?(9IK74onVZpjAawP6jr?a-SD>&^-J$TND%rYZ&lzJkhz z+j`U+YRs%McdRL*J+Zs^51yFh^JQPWB1ILaCQz*1P(wgnKIIn9CCsFlDby`o3wqG+ zqK5LhEFS8(SKv57^eJkDXd=#yu=IJ!|2(@WG2klnjKc%b$_H7}`>r`p@5@MdoT?9| zM~fX=r6Q;dY+gK%CRpB&GM<#n$GfLZ|B#(P{+!pG7H>AtFuk7f66Jo?_qS8*(Ihc+UD`ye(16e&%-=P(e+pHtr3zgD7E5ii`-F zDbWyj*i7i~XJIYfm^#Ohs$rO$$Da4Lj!ab4{<(&h_i#m0@9Ot&Esy)Ktwr6S!lUCk z$P_VG`NqOTU&sAI>aQLcQUV@8d~~yFJOYUBfZ8t~)za91qHZ_Rj^f?Cck|FYpu1% zV9pcV5FP@XN7uMs?|@%t|K+GNZx57dJReWFUTd6Z8S2Xb)&?06pM@vDd8#Ij?b(k& z^zsk1N#2IE{fYQpy-6CV3N}^IxNC3SGV{d3`0~}Y)H)bhJ!cQtEwG*1yi9+1oecsC zEACzM82WN{YM<;yy$c6=is~l-cbQMW@*CHG1BW{JD(U0Ig+TQ*Lq^c+^~S{UIa7a5 zpPMDi^Cw3FUZ8b3#>70WiuvcQXPwJCi8P(-j)51M0n6251JmDAtZ07Spf#m~i+a>6 z$+(P67+jc_3wP&ZUp65wj7;_h{w* zAtQyH-{)VkZQ2BmM{=b@0$18^5PqyfSsLFB!3?tzQ<+GEB(;mW`jXxOkqVflBcv!@ zncMmIbvHKwBZr2@q5`x8UY`@9d#c90<2}Wq#T?A+XA9&TFag+0O0AxF67!iBywR^=*KBhR~&lX78OVVcf7zp=Di zbC!m=TT~0@_-dSbhYG5(Y7;du^AWktVFm`V;u3_*qUIjy*wyJPXYC&F*3nm1^q-Pf ztY0ZQvUV{Lt*@Jzt@+YK;AKKUv((yzP}*^BW2tJ)qW<~;%NV#0pGGH&XfiAuQEvNcFIhi4P zDt>S#Mqno9@?e|~~Uy$%X3PbVJflnvUfh_ut%z*jXGWlb#%5izCB`P7H zpO#{mbjj_^^qAYBN_7y@yeAd)X-&y6rtW~`O#*Uax~iU#c85W<>k@Ev!N;Y5=Vi*w ztYu?^l0~j}Y4COEe|mFrISM{6D_plevH=o`hO@|jUiU-xI>~-b$(o?)9nQC@M~CEu zkku3q71w#huyxA|JDT9o#jjx|pLp5&8GV3P`Ac?+o%1(sL-mCVUB9{cy@<0lY749N ziq3=!W6WEBZ-@J2voo%^bR;+hIQwNS)QAOUg5BB`n#u25;Ek6%5u-W-13yQxN9qn9JrlvmBY!N_fYvhjT*muT>4U( z*&BfZ?m9L2V@)=m&A23b3a#cyW4TB;;A&O#76gt7BLD#K@|2!*1q(HoK4lv0bn=+c zuQZeW!G^DT#JT|vXY|{CSzc{F>kEFn=k4%frRV+cQ%*$9ZXFvuws2)az2toDN2jEn zcxL+2qrVNDG%pD{0zTa8s7n``?HpsRZ2YjatlabgfxA#Yj*wgL7g35(qM>09A($Hw zY`VP3Wvc>yMp&lz8mbzg;+-9UebCstJZwwtYnwR>TkwQsOwyl|eaQgllkQ~XO@`OI z8M3u1dQ>akLTf!e0ljEg*N9>-#{=EN?6KHoTd!5DbEo}nJi%qp)|pQNpUHyS%|V<% zyV=ttw_k>7TI~&+u-`*mSzotyr_|3w{D_o-S}fad( zkvC89;Hhs*QM>nWR?JbJGp}9xG#K-HI%Kef- z)5gK|;bFSM>Z~ss58^LfGBG~1m7H(D`7EyYIFp&w-#LFvm#qrqR+-+h0wvpnlacvo zA1<`q-S6u5`rf{?iNCtjr2e zlwq>kSbE^9Q^u{kyMM0z#a|tK8-F;utY6B8yiTFJy$k7(KoIUWtQfobic5zza$61f z`8^3Q>n^SZ{BuQ7xzYgo=hIjbEBV6=T+H9VG$1u)Jd{h6Qf<)867dg*SgFBcdO|C( zTr}sp%tAz2Zyhf#UT+cTe^*6+`cys!7OC5I^OC7}EetnvrNfFy5Tfxb1CxAKcLKZet?&W-+s=jxl2iWemA-6o02C5mdgC zVt>=~);EskN)0*`tLI3eIN57YI*&>eopwdEk^i-EZ5`%mE9;NM$8YYGa!$HegC%=; z{<+zX%rkYN8m#1|LTy<~l-5Wb9c@`5T$V?^SZH>3v8Xtt2L7J>$pv5A)E8E)C zG(cg$l_r&>kZD`>lM!dWY}$%nO~nA#Q`Jn zDA460PJ3dYWM0CCn*dDah*M{4Ag233>Y4Wv~|qz>Ai zatg>BGls_}+AjX)`?y5i&Ufr<40wy8@88R z5a?DLpOt)D4quZ4BKnjlo8FbbuSh10l2E{Rk3yrqGA+)zLW*AXvyo`8SLb9fW@bm3g>nt^~Y0SA`3cW*;yhx|IBn|c;`U2G>DpbcQ0#Fc&G^B5< zHSbdH6WoEJ?bRDvdw{DyqVSjc{3@pzm^Ao~&D3s@XAI@sB~i4)K&WSA_lvnBLcK{g zJNGUQsApq9OFm2fG0i7RGtq&Po^wePSoTZHcow_0MzQh}*3d-td$w|L#K=i5q7j%8 z)W?vn8UC&HC3b)>UgKSzHeiKx{kr+ZZSNn*-@=)RJL8G_c_Q9FP{}mAd*g8d8Ji!9 z8^k=o?)w_W({qZT17(Hp2GWU*E0)sAM;hQSr7VGPr$269pd%jQR(GAuMM~erXgnFtH5K23jx)xf+^uFbR@r;Gu2*|V&Y;ym zXy51IZ1f1q>vI_1Nd_RmGPQD+cVoj;4%STAZ8%E$q+4Fz;VaV@Ux6wlg7n5RZPENz zamR1(LCKIPt$Vi)*2z0ZE-_GvCaNNnwo`nM?o&T28%6Gc03seAu9pe6D@R7feX-#n z*!^y`&E**QTTxG}V))vw*0nf^XZfmU-l9TJ#j2K{m(Lill%S{&RAxz}W{GM5#ogKj z35&3NyL)Tdmp#Fy(g09kaJ@v7)+#aeoBVc--AW~8_Qbi?LcOJ;;RWPdI!1$Ss6?^P zKFOF5r)>{TH|(!C&jK#59ps9(JFm2t4Mt^aT{%{IpSqPu@Jue}EY~C4W$WR&blvN7 zVC90f4G|{}fDq@-ggG$@_`VGOq1HR2HjF|;{eWBQGAOR9z9tT|MzA&9}nDAiY zQk(7BhP20nrP6|ePb1D~9-r;5GBBit*d;_{{!Y5|!FKM_`5?&>JJ>PdZp?3Le-__v&FeX z!8`oE*n|t*^&9g4heQ|p*QHEbHj{{`z^;E6Q;$JY2}TmWGq-ob5vxasdu@Q*>Ws?{ z+;(vND7b#gPOA51gJ@=?HG!6W-{}k%axEe){?)$R5!4%d<-Ipj)OHAlDK9FMc7VBr zBcn}744_cyPQcXMikHjyZ5pbba_*cy%<-mkDW4Is4u&CRj5$`1neFX24@t)_bm~3> zUidGT=YRdCxe1iHZGt7{`rB`dt_;istwIAFmzhxKp{{WvZ BZU6uP diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/OCI Security Health Check - Standard - Flyer.pdf b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/OCI Security Health Check - Standard - Flyer.pdf deleted file mode 100644 index ddfa9f1a2c79275f1319f170f1146ddaaeff374b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 169956 zcmb@t1y~)+wl#{oyM~3kELb?f-QC^YA$V|i3BiNAy9T#l0fI|#Cs+c61l}UqIcJ~$ z?*HEVzW3^b)!kJ+yJn4=b9PnrC~9SKNoF7mCo1*!&h#8A5{L`H25>U9MHLWWmA7%U zFmbi*vhE?!O7Uni)?oO@% zAiJO-tE7#+yM-&Oq`ir|#cvT-8F4)UUXZ9HFS{rQw+K)SBmn}7vVlZIBsqCRBt#{^ zmmGouJYr%ZKoNFvadr`IkO(`tSe#o@l9z`=5+oreBEczWz$)WtZsDZ|Za9#Q=lROg z2>{{*YpBX9Z{cX=ZVdqPvOnwN`Ma4Mtg22@Bo0EAXas6XA4$sRSQd2 zEj=KB0{{dg;O6dXVd8*_WW8Z(YHo~SY;0<5EQmrucqT%XLKe9@0~MnkB;#M#_9D_; z1|r4SfXS|}fynrqPaW@c->ECxDvmgkWuQV91l}b?(%Lv6xsObQeG)!N-`jW@0fYV$ zRs1UOYxG5k#i|I^6LnpjvB7pi-~JOsQkTB-96{JxujM&RQdNcV*Di$4Hi|w9_Q??lNMu>Rm&{-E~r>=?2PuM}{kl{;)bv7umg;cnsPbl(dw2)9J5IQeN zQlESBueSWvr*7^huI^s07M7@NsMORFN|OJjm;aAW|Nr?C70Ai)ZzK9A>j1EGu>a{m zb~YfZ8UP67{Esd%HpVb9HvT@bP(ES#`C0^X(7XR{}@ z&c5Sb=zSuoAoMAh33^ME>9?G1R_uyc&fm*lK&TH8yi;j3KK{Uw{D_j0MMh#AiIkdo za}E*mKw2MGg8D!}K*PlLI_b2gaWYcR@Powg^#B9ei+B!%Qdu@Og-cjMXz^1BNH_?5 zZDF1N+Bd%}^Dh@xuy8jqH*q%su(SU%S7j3`3pW4=^y}i6$%=tX?VYUt?XDo6e*-J# zZ=PyA3=P&mFaQ<=u0Ozv+xQzGLfs5_;;kkQM4Oqooot#CTy!6;u z!1>^RPF_y%FAs>Fh0TCf0qo-@|JPD*PypBcM_E-1HzyBQGmF2%gp;e9vx%9-bIed< z1MvQKMlm%YfcKX+;E*BV4vrV#d!(N4`K8};ECDy_S&rR^4eav2p#Wb1pF`TS z($6LAU~BnT3D}u||0)521JYmcse|R&pJSOStGYT^oc&kT&*$I*j$b%DUw}(Eexnb* z06&=Hk2nzgV2(fX&jo+v!TF#+;^6u~f229V=YNF3;p$hcey*DveEvt42ON$5$nt{E zf60Pdt?cS#re@);#|jSktm+nC?yNEnU}F&beULF=)mAdKwJ>`|M#g~+zycq7l8iN!#tcyw8KkSimX*z~ z>c_PLwb`0*rW0>Bz?JSjU_4JxD!U6+lAIIK15v?)IzWiUI?`bX-nk@+4GF zfhWOw{{)Q5xakm-3*xFSKgcyXeMF3FTC0Sx-TamO1v@{#py0UG5Gts@;B|-S*j>q8 zQ1B?-9hCrMaz(&BHNOCHq|o)ps?qqV#)On31Htil^sw)(6D$Fhb}Rw>`0T_a(XQXS zN8t|cPoJ#$SQ@6$ZzaAxO5K|%?^`4p9F%YF_8i}ylkOVHJ4GKk`#sDpD*#y{_6DYx zOSe6F7)#NGNH^qr@Pw>FzTDmxZliq?EfI`pvoeg_#Cf+S==XkDwicjT;YEkcgC8=P=&kn}U) z`=yW+{!_=>{l!Al!~`pNsg#cj6=bP%1znE|1Q9Vk^Rm(zIcfLSUj95iq`3Bl4Q&r( z@AcDc+L-NlNjK6{Y`#fVcg+DOQ_`cd?1^${pV&f18!z)xZpLXSvvd4%{do9!r@u4~ zmo1Os*Q8ft&Yev9!)?BQQ-$%}6OXvIQdV*VO<&oW}q*gE9XJG3PmcR!T83%|Rv?!E|5 zRI-LzT)_(XuVwM`W?^{)Qb*~%QeTb9+V$>?&EB~EP$m|N#=8TqRQI7ny6aOnrP^er zGeTV1LAvvh?iXH9KZwTZzSrX{Y{{Puu~C;QQAu}3sbwg#r^=M99l1E{V`<{{MD!dv z#agqoz+VqBX!3d7FEScr`F?+jwa{lph_s5gc{o)Q<;Phm)cQGn>&{t#cq&gRVot~V z2Xh|RwV}=h(#F%|2@OI3o~M-lRl820&t3%gUh6V-zXZ7!8Z^$^P?&gz>N)^fPe)Tv z0(#93BlYd7YKPQ}BmyDgWno0j8HN&XXcEq{lz8H?m%3>7VVypC155%$eDZ5~1nHcE zN>QhZ5pq&JO8$6>tpQz_0hX&qOgL5j-pI&3o~o@mm(v(84%gH8s|v%CIj;r6q`Gp8 zz+C@mmydW~a=v<=Rdtg5Ff@FLwA2!2U6~lbAbEX^J81o~?^Mq?+-e4X!XLdh_s#CM z+SjSD{rEDt+U1!A@mI~q0Pj{9tZ2(I>SRk&X(s0n9-`h;Gs3;&Ev*~0-<9P{S_k}; z?5#p{W8y96bIT%`)t6=vacx7+nvH&V@{b;;HS6`o8Ysh-Yc#Oa&({QCv+(#MR5Zn> zSOIh}sC=6h+5K(u&BE~GNZF}6`fVs^SKgXqI%+4TLT+F~2G4hGd9RE1tm<%`ijaq|YSz=6HW@;AW9l^AWYYmL86Qec3Ea}- z{YIjkdSZkb(vzDIPip$n1w88ra~bU)Qd2{-EB!k>zQ=WX3^%Rw-BZ|mxE$#o%CO8d zFlx!U)@Vy=)|fsqCJPs>iLeiXSkBhHia|lhpLmABi#-2Co=Zm%<13j zy|H~;K`b_wnYWvrgD0}z&u=Ht07toNP02cjt63rN$VEBEOIB@GsJpN^B=(X`#)&lL z%o_6B1MMqCUZo&)-%`|OtN89Y$|i3HNUUN-CI4?Tui0T|_abM{u@5e*X&>zwzYC`* zvTZu8kXLZ0c-EB|d6jxz`KZ&wyW(!abY*AFqQ%drtRlARDe|ZjTc+4MJ14ozj&hHM z(*OYnQQ>?%aXz)Ir+Vl|RoMKB_)HBK>#aq_J$fX?=UZ8RE*Ed~OYk`8yAcf~XLY@F z(vR;RniFBFcmxB8dp4fvO1&fO)emFX%v#Cq^F@_n@7K+$%#KMImCWyvd%fA$=bspv zn=>PPVZ!roM!LCA?qgIWPh)$dD)b9WYE{T{+6F|W9wC7Kq0%1XF)2k|3Oa3CgGU-< z_htj3YAbe$?>`-RDTqAs`3oIAw0MT|lAb5aqr-b^bmV<`AKy}pYVJCGucklp z6i_nOK2wCA-9R6N(WOva;~A+S`#CFB)_H@87TXi=#w17U2YatOq&)LtU7kGd5AP(I zZmlvWf3$!L=Ub145p?q|qnM%lI#K{a@5}yocBShM=@8RcdUvegVe2At56OQWw*DHm z{NG0kf6c|%L4O;>OGoJ^D%cLNVT9fC4KbxiB%aco4I{{k_QgCZx56hD*E2>^lYc@lM+nt?+!#QVqkvhN~KWp7IpK+J<7 zi5ZGv6`~1Y$D&GMip#hAbq?>udSCV!nilQe>+)XVE%0@bf$kuRR$e^d8bhRCyh`~8 z;(ZRm>&JvDKJ>G=$_^goQ7}h^FcQ1@RE??pY~M zaR?&Q-OMd^UNP&Wn;3b>RtEc@>k{;cix-937ZN+&CD(G20 zOsA90j!Dz~FAK6Vs14esqnhE6LT?L;-wKy~EjI!i8s)01@IS!yJf8huz{T;OaP>XI z75*1o+lC<~?kKKHx^K=PN%Uk;V;pb}5?k}OQ_*PZwxphD17r+W7P;^u+f<}M9CL1+A}r-XQ30WjDmhMNX!3NmE$yg`GV)T9N%Hs^ zbx@8v${fMdq7X975Rsq>9Ih9kbC8b)=je|3=PhD$ypFHsBrhvCc^Mmrc3{qwj7S+> zvOPP~ArykAg%6~_=S7xPSX@Mv5@wu(6s{Z2qP z8u9H)?j6{;$lti~{sUV7{XF~65(yh8+uz|z)m(L4<-zb@)S4)SwYT07m+dVOUSwXm zp=PEy6|~1kmeMqBj?Wo)MSl8;##_YHftJ|}i7qpl-EO@UB>!iKi^IQYTui$2~n+v{op1b)J#eRU076WpXbVU>Yg#Z2nkzlElgF<^IAA^~XvpG_= zREwwc3L7re%>(P&K5Iw>w#-Vx2V;pVi>r84o0)Lt--Y%1*n}-C$Yyt_ZTXc|F!d3+ z4~WEn#9V>Z6mzhbv5SMwh4OdRkqgEWE!7?sAV8nh+Y9j6o&Ff&G~a)#m)%>g#$4^Y zHC1`D#jl&^$oABBcV;tP?c(F4VL41%a z*_Dfl4YZu)p!gO$4L$ccv*y)%Q5-dOdBTcIyVw@t{sE|5@vKwl4S$aW{@Is_hez~@ zZTSPRQFd*ii;2=_ok6?6AYY1{&n`mx4ffbE)KT!Nh@FmEMch<)uWpzWJlk+2^V+Pj zCRy|YCyQrc-!?h-Ib(+)(=e{|QMsPAnBjMKL7SgK-0Q|-DUypt9xgHGEd7uo}PS(-cL&!H%2p7(H$usNyaR&tK*Pr{MNc0|&vculyFw+e571_4;{1U{;R*OOr(KuA+7CM7^ zBGa}h8Hw%ejXYl%ScJvxc^S(hVR3uj$?o>eCG@-%jgF0JC-FzbOD6B02^dVSBI9q> zCD6RR$(p(5NyE}0Kj=$FHd2vhO*kUV%f->Od40r8(==3S9cok5Nt1I0D0j2|Q%DX&xM=(#+FXYbx_^iISf(7)K8EhK)MHMe#iv<|lc zhZ)KEbszMVl2h=_$+lv$ zaANb6bCykflwcQOPQ7vMqd5MfqzRRfwvC*1o`s37?=l_!r%!Zhgd2RQ@ygP1${F^1 zt7s1#EzUB`0-VK8n@n8Aw1$vlxTagqXRNc0_cV1ISv$elmm9&uZu(L67+l!x8OB1z zCXLr&`11?H#3mf^{B0{kL(B;Yq1-RAi&EMXHDv0>su$Yx2EH?(aYmK5V4+8Wv~c@B zV@8Ym!mYm_t1Pyz_AdS)qvj;~_$b@iahT^| z(}C6mmD{ZSq1$JJ^W$K^An4*#w5>@Lcl*KQtBu7$T>RD{#5RgeyKh}Vt5i5)3B-a6 zK*(>dBsRe(lqg@{w^9rky6t&$TlC5|B}L(t_!LgNC}gkBlV#1`U1>6AcFodkVyERY>}=iovwOQSc2hGqXvd#!6V^d zk~$)yFmlg4og5M#STnatlq$*m0J*=t2Lg>9fc4xU-cBaP`Bfy zy<6s-$}W78(>VxZyku%;CK*{ob)tx3aE5yKMR9~*ay5vBbNtI8!RCnd@-R+!!>2NL zPE8hF!5=fz$y14Wy8^>Gsq$TcK!G`UhP<1ga#60zVD%a#)ZuIquNlbgr4^;R0nL#& zN6u+4zV$DiO3StsiJKFi*&N$g6z^WpQ=PfiU46*)HbQdTzn7T_%}%ZyQ1>}Aei|Oc zX**VZec+wSh>UF@E3x+hk!oY~DggTX#q5Mrg$tIJispF#>Y1w9-WMXdkV#Qg>=^pu zLr{M9L?q(;D!*`986ATmsmhmu#UO9^NP!6*RX#mQGg;T-6LZ%tmrx6rFG=gMVF*8M z-GSB$Ku5^RHwr{8CZ4VnoP}ZsI9@}xioSYM&fgwxncLc;!{zx}gfLzCv!dVhwvo%9 zpLyN9tANHs=5W=tRQ7+1t&vQnl2LkOe(Q}tJycXH=SLxpem~w@a;_V` zQ0<=Iw93meJ8M7__bxuFJHMOC4>P0mB&=!v6|xbX-*IYtYwau8qQ#m(XFFE31MCO% zM$miFeLs$xMSCt6=da(Tx^}6pR%uadIo9MQiPLIK8@Y$d4!N&Dq8C_QFJwP2P?d9I-(HJ6Kwt2+)c_>KY;FEMx}l>-H(L zP`9heF6Y*<6*j`}W7^C&KHu!_1X>k4ohCsmIDhZ@W;OFObC!Ebnh>Rl*^9(trc%Ml zQ*s8j)7|hUu{DP6b$kLd`FwG0z(Cufi_8MKUZygqWJTD%M1_X*V_tyrz+n#){wr!n zGh4N_k%y_V+s~Ne)f363r|)2vDPj6YGF9aP^8xb-5YP~LCQb?efYbB$ssBY#`;Qs= zpoUz+92-W@f!2fzr3yBG0u6$T@epKaXrMF+1o@X?2YipL83)f#ucw!CT~t{+dm-~> zJp?#%M{XyV&a!qjvVKU9Lz!;~=cX%{6Mdt(hw0q4$TFw+fMosU9VV{%T_d9|egy{I zdqu&#BaIH_f=~{_NsEreZ#%+J(vA0?JFVe^&@8x)b76Y73l(p>zHZnmt)75dV>Y~j z5vEq=-F$I=RF^#08Zc*_^X)vhor^~ld8C{;hu@-iALhEG6>RD`(-~%Kt3&R(p|Mxw zLfJ&sG}=ckUJl@xwQjx^o9Jg(o zbkq>2-=uZm?<6tA&qx16m`cNmtJ3!7+1u397Ha<*!uh5TJ%sICSkJt7rw{`cE?R3< zDDI5xBmfI~p!H#exq8(01~A~@FL#eh%R zMI?0zD`ee)0ASn?Ji+z<22B6CJO6F``!bn6f5Wg|t?~zYBOwx{)fPy^GX@=LdZcVc z{CTu#{9;)v*P5Qa4H|3-o$mp!b1gFbwqBa=Zkf+m3zzWv+JVyBLs0R^&rm|6ecz(a zpuqX6aJ#D%?iO0P2`VHcq=#^pgo^D!`vBRq_9SaYH)cG-eoOLiEN&jzs?8=C=X^q&Uo7d1&ufbAe}bM^ zplIZ{G>Y7tY!1s9}UEsftFs1+c8I1WzR)(Q~kg(hFH=yp85xOeg2sG zKe{U~$A2t&WdC~%LI7Q9sS_}`hzHwZ&|xy{x#Z()&v~@6Vw2J|8t{`Y>827LM=WTj zpe&(CI^ftpk>;HOSr^Z{df6YNQxA= z62Mf>ixF(=>H-*wABC(i361i5ZQl4lbhBT0lIM;ayG%AT7hoa^Rp>nmEL}AGz{*bV zYkdU^x~)+taBb9&H`Nx_esqbvb)q^ahv6rp&XQ>urq(l#otl+Nw@xm%9*YW3g`g?c z*q-B5Y$<9jz+Yy3=YybRYGM45bg3<6m&|u3-{wb_0ritG@tab z((kB9>tK(gewHxJDW)YRi{vSZm<_f ztKTjF%IgUHCDceL$R1x^K8Yy~?-X~9$PAbF!A)+fRK#F&qs?t7uI-64eB`lH=JFy< zs|{3#ve>f=Bje_ORMuzg)h)b}-3~hAKZf9S+-svNnq?-{OEIo8le%IX+BI18Jtg0> zB!avpz1Do+#Wn3yz8y+rx<{Jq3MJ};(Ll?N(yT9waW0`i6_3~V z=C1pmWxunU!lDC3BQa)!f-sD`Z)y9-wo(YIid7Pe#Ck&uY`)@tl}eN|E;X|Ple8|W z^Qy#HZ;YKA-hg!c8F=cv846v43ZrnmB<1gx!#82p^}J01PA^sG^{QKxMEu10 zKCqwyx2>7$6K1R8_}QK^i}M3<|Fzi}#L>|JcZD|A>GmrUE5(Qb!#YNGpRM{BXFMO# zJC;_1W(8{ejb3jz<~ZQ|2kv)kq>Zx}>hS_yATj0ZlzEYQ}){A8>J=5Xq73Hz*Psais9^afi|Muqs46H zzWeydYE%O4xWiQ&ngg2JVMb|ti0##U=Sfq4FDrEY!b=m7M*qI+!~#cVUZ-FHK{x0s zPm$~Ut;O*xJVpNY#h*9y8AB`bxjFYAC@y8n&0l|r`V{QRDOdCYt1a|3n8Xy1a zZvNkM6aE^#@Bn%KK6dFgLh_n zdYB3@>2=&~(0tMM~X^ z>tXMCaTH>nFx>ssD)nUC_KUoCDTj6AkY@b$$Kcy}cT>kk<^SSnq{buh2&F;-%@r5Rg2BC2g8Xt6|Kr=0oAWhlMjPAWd|7*++dAuFDXjIbo%l zLTmcm+b=oG21rBwCc9W-#vSWt69P(k878R*qQQYbXtrbB5bt5aw~olI>Y|l;{h;FEjQJzDTMYsA2@G+8z?Ms@xZ$hD4OK^7^x+^gJhxXba-DCYjc}_1 zqD5XAX@7_`*FAnsBW^x%%q%c63}i(ZFCZ?#5w)by(36Q0^!r|C*={=PBhnoi5iCPc zWv3o2Vezha1{A<4MV+ssS=V*>3UE3h`x>J|RfvA1XcBld_EDFnK`}mskS2=4^L>hw z?|1Qa)rpkN;VoB?)Q695rBxyy@4IRu`PFqb`t74&1odxxS>nv~seDF`Y!IeOU@X{g za61-#aQS)SxaYBP<_0?}OIJ3-`&k!jir;#6W_sy876UrGsrBmysg4vat$fR+tfkGZ zIi;bSB~L>?e8t%yFPf*6_x~bqP~4`;dwW3izT?&kfbOAk_jQ{j1+Yax@hJ!N0N>YA z?;+XGQlcO_0{cy>^6UVWHU)L)B9;aLs@CAC7)|8UmQSP|n*!lN)=$gk($t9k{ExAv zTqoi`g{SZ}(?Ryhi@nOtXOu`^E&XSPjn1vr+rd~UB!QHh@I5i$yYO}5&UjFT9@P|(0q zOcVuEpr1*ftl%olES%jvOzeNyMv#$Z}t{xVD*m@kiTtHSu69+K!nN>}}#LW)C z^P4xQ=3(moOo;x)G5m`gt@Mju$f{*y4(3$zaQtmS|7q#z90E-Q%oewRFoysq$fs3^ zAqXtA=Y$LXBgVqQ!XYBW!y_bmflo+IPV$2C1tmGt^A8IL2L}tepeQ&AivMSV#KFSC z$HBqJAtD2il9B>wSSTqeX*g)<>FH@X1UW$9#39K4OXm0Qe~OEXL;Zh!z|%Se35)%>%6Y6OYvH;vn7$_*{=l1?iun>^YFi>#t2#83?kPuK%kT8EM zgoJ{Ifq?y8hyeis4FwH_h!*hY25>1R3^@>11Phl!#l$7)<18EwB|Avf)h#GFzrLaG z`I*>w_ymMRRMa%Ibo2}yoLt;IynLc!;u4Zl(lWAY>Kd9_+B&+XX66=_R@OGQ?jD}6 zyu5vaLqfyCBO;@sQ&Q93q`%F`EGR50E-5W5uV`#)ZfR|6@8};G92y=O9UGsU|Fp2U zw7jyly|cTwe{gtod~tboee?C(?cM!%OmJ(#jYUlQ(^xPN&{z~e5h$47jl#yk{iPo{ zV#}F%E*yJqCTvhxMGreLp85+XKaV{I`*=Z0w=(Qzfsk(Aq zWcae}#7u&iRzxxg#kXCCc%r5#D=}Du`66}7>bj$gI;dt8(=sE=#I1Q^$F&4@y#)ft zYKG?>v%<6*U}d!j6_!#wku1F<3;cFcYbjv+j~EWa@G$Y|7h(0+;F?rO>c`Q0w~#{X z@&%#_Y-p~$1zp-=1F>o8HWXFFJ^HPw$dxSzTW8UzafO?r+Z5X~laxzBJEc23Dj4eP zk_a&g+u}8Nin&p8FT=4o-W83Gj^(%0+{InS?&1txjJaUPZtP^M8X)j??;g<(UIyVv z7RZpx@?k~OZM$1)h*8p}nP1CCD6<(Of@W+&u_kiF6n5hlOOb$S(yW{qg{I-*;x}cZ z6Xj{QkWky0ifvRg%97+s$ebQw0{sY#?-C_hCl*3w)i`qZaA%dpH!-s>P($P?Y}4jQ zJkk`-OroS1JJ7vI--sk!Cc?{tJEX z_i_=8VR7@F*mzX}L?qK}TR6!SP+1{eEE^^0bLfz^Y)Uj$hEkpgU%$r;Dhds`qF6*E zn^(@u>tF%|MenvkzWe}7F*LMAgeee+Zy?(=$S|0I%^?-GiMxiPgphtB30DQ_f=-7k zn7W|ad{#s8sur6nuAt1e*$SgCghmGRE>92`^J+#mW7~LKhAuYVt1p-fMm%Ef?U(|I zqXND9AR7%@nu?kO1!{FVH>B8SJM$~FgmnQp%Ty+tRax> znD!ANgC0R{Vu#me@Z&T=7KpHG)VL2Ti(Um#*)NC9v#3o&RSd-B;mwMiI6xr)a>!!K zi&N0H@N6rbQYE!$AZnH?5|$TWQdz3-grg9Ss!tIRo8v0*hk7Q}&*6TSmKFo`s8OU2 zqY#ptH+aKYr+^4?3h`jfQ#f)>RYG70y`jj=Q zjn*Zy`R~>&bktG$$S1O}lpQS#C>T(}a5Bl(#TFi}^bcIXz+zmUA5q%3s~v*oOscbgI(w&jT3q3|$QL=!P_6)$322P78t zFOgS}s8bZvXsM+PMKOlwb67@yW=8#@N3A1Jq& zZPov7&jz8~nyyUzNVen~XMRscM+qC6-9%9a2@6U(k(qTcy{&AKabImp@*eNa^(ZhY zX^hS_o&)6|mVji<6^=V;Sh0hL-tbmBqX!2FI zYnh#>^~)*`5iPr5mUL=zvHT?P`vb5VJx)MeE!iAZk0R^XtLh|6lrk}~E$_6pqlX~8 z%wk#Kz6V1-r-;z9|1nb+lPTBSJi}_A64!bttfQm97RLmyUIRh=BpD+n8AHpUMq1;e zESELRhUplOXj8R}Ojm(ShPv+j_8D1k?zQEo>vFpKI9YT%Qsp`dgM1d*4tntqVIQU2 z$*G{t=sO`~=PRJq`o(;5W!NJlt1k{LU{J21rS$2uT`Yms(+q_OjOOi`;quC!#N2>M zH653=nKKVh;Abv*8W3~Z=cEGar zH+WuDmieXN!X?tSPq#?+VuslSCPA_y^{E@dNlD4NLsT;L$nvL!K}nL~t+w`Ns#qn$ z@<^(vwa6rJYYv_T!+3Z+sBJ4}60x>@7=7V@73T(Fhv7wACKD60z}2{#dF|n<=X}9g z$KJ7GR0LZk?%`CqR|r#%eduhUPBl{qB3UuWa7cQ%A*nh!m*SNy40T`V?C^A3docqv z$Z%@F5?Dt^PVk*b3C3@BbO)EhJ1_=NWJMa;8-fu+T=FYp3!}Km&8v!n_&}VUDrQ7U za_(3dG_dq=pTgpy9l5|+$jDT`mE|-JCoqZR%4TvVc4=OTA&6^E#lS6E3ookhL1Hq~ zMX6LDCNNcnPW6T1XeKf!uZNYY<6eog!!{*46hnbhMU8$|L9Uq#Q1*=5bN+=%I6-P) z*Gy)ev=}snoT!SVq5BwH9Y1$e) z)S_>B;;7mYzqmISgl@etc~A>RXtlCG0+(&+tTI?=;(8UShO!xRaFk@>p{_MmORGqV zOVCTZCUX8l%G6#=*(9mhqZ|1h6c?<*A-!~XLOIn^I9=9^8=orPacIdP=hrEe3`rDX z<`;dm`M;rsX(d`OuSaz!5BWFXf%{DupRjZ>_38a@pkM`zd%Zbq;X<<#XTubCmx3+0 zK1We3CVnJiu>~yZ*mKFMhqxdf?ngk`T{4B*m7y> z@4*U@?E4d_l2>x7yf>*!!#zQXeSupF)+9I0FUPYmk~kb;l3h4#Ji%ICgrmS`Dl7qK zRl`H?O%)=|Gg_fVcoJvN6e8^^nj_8GjF%K0`$(~f1h*6-c@++++h*&z$ZNvEZ5Vlm zqT1A6MCBCC=eft8TLw9od4WIprdWA*DI|3<5OXC?u`0zBLX?2b9^?z1nD}uK$zGIG zp^Z_3XLcr81JVBm5=C|a{3afgs^kC51i?7{^|XKE6xXy8)NE<}4pfZWk%a+;(F>cB zDQ{$3KDW(qQT97zKurKpD5Ql|e>*HVH)u%YmrtUw4Tch%qm2^?Vk+wv=aRQgY2sI(rbWoTjq^8;_Wza@( zlL(?44{nQpTRG&t&%m(2*N8=4Bi+u6Kq*0vFG;TvtZw=%41}sl1Yt)pMoUL`AtOke zV2MJdnaMUXn51HSaf#S6H^bm zhb0U#`|G!vg__cvsPe4Eryr23v5kT+no3#yC|5{xDa{ph~5`ersJbxAue(yN^ z9~Tk8do=&OH17qO_IBBERT3xsCtdfU1Z1mWn~bZTFfg5*np&9khhRWlPp}g*40B?C zoVZKU9&`K|72JxH%X_imn@A!)Pd0?%fsDo<*LfCA^&cN!bpZwBJdvM9YFq?<)c9MP z?R+L5`PB$4+4zx}1sI@^*S~l(O2DxGJT1ELLdF9dmWK9Wj@ykUKjP)r^>cmN3Kbf4=RV38W z+IbO^PC4yWXZU0E#U4vqP7UGAlA5F;ChtN0D?H!Q@k#a7c}uHfCsxs0CeOYnAN!X3 z^RF9|Z4rxW3WU59^&DRoHV|rQ(^W#tmtukGg&U=4=8yi3@Tet~B~wu7ti9KkYpiLF z(p_^fYh4RGD%}$1W~-mdUS}W(+I%K?5&bB-d=S;D>==bwKQgtT^C)gvei~CWGNszy zsAV~988mbjNV}?Nru6oW{U^cWC$T#U_qr{gc`+Nz0i=-04@IvE)^@hy2?%-9qaw5; zt7DEc-z)S)6woSD9|7^k1y$ldaCt=Nj z(Hxs2(31G3;=2+nD)UaC4^YF=@G_e?w7!GzYj&d1AlAd00iLkv7pmbp+>qt_b8d73 zCB{gE1EvPc9;^9I;dL>*A(5Nhm&Bi#+z~>N2>D~q%AJ^9HbW;KB4dcT&U-=1djMsQ zjLa*C#`X+AHkGC%md^}&qnw3IuP8IN=A;M>Y`6xbVgNrM&y3K|m&E8YGH-N?5}Ioh>)hFLfXa2|1ji&ah#k9fnhmS*e$6( z3DX7l&GIrU1wTJihN?rfWkwOYQvHQZqn$F$7;YS7o1}qnfHDX^Ls)Jp*iaWL`c$h% za_Vazq=~CQlicRqNL~n}KNK^}QF?Mj4&$sT@{Mz-o$RN@hn&X_J@x#-(tGH@#!Dq< z2oD@mQd@&emq!ZqYiV{isZnU0S9KEQE*LF|kh{di7SfF>`Nu+{>wf+|sxVm9?_@XZ zlwo0rppU&Q5Dns1V?oK2^W~K)PMDqG75h?=@d1PJj6q-PlMM38_|d+|8ZnmO&{$^? zPWN*|thcP9&1LKisXL-y4AIYNa(3Qx`?8r-P*d;$w`@;2<-Lexeln)1-$lL82Tyan zH5#H$n24N*v~~nlAUFusReOK1AI)WB9PxM+?WuDG()yF$P+o76*^@XpF6_J_Mk((~ zcHoh~x!49|6r$~C53&LVVw7R&I>b@LkV(qA*&bQFoj%3Bf+<&rVMRZ+X;Z~?hgdxL zB9Qj-SmtS>QrFqCEcW)&IKTL0N6@`j)Sw_KxRvLX!@FPFDbYs2WH>^0)8G-fZXES2AjT>DN^ zbisHZ_o1(!vCp>K-D78Az&ms>tIg6vamzowT;n+vRW))_-i!YFwT4&M86z&NVgF(O zyyL{aMd)4s6<5%~%!@W@dU3pzg+P^5;$*n}kG#@8Fssp9!i(Fs)$y&ofV%boPKc{Z zhRz0UEc~z+J0}rBFPT?>aBG<=qakvMsr|C{l6pE!uViN-Z0YB&^f{N9SnjwiS;M`o zu8}al!#3IO{%8qFV0>tk(NmQ1sNLntVc%uQxk>BtBx|+7iZ)JfC=L<0eF=q^+WV#_ zy?_fii%=tNls+^D49k~wRV{CnD`0X@^fGFabP zr!*=CqFwIzR+-tuS=z)muTIFmMFYQw`%HbJe3K(Ed7dmjYgTOSZ?%Xt!H6{5FfPg^nqsQu=a2@Whf-lP!`Hd=gxd zbnY43=~6T(-olNeDl-UgwbhTkDoc4~ksR_6(o&Jq*ieK*m)a_$c%?6@(>EGNkgBAN zG4R7s2xEe{1UDaPT;htdd(^ox=%%%r%cX6KAU|;`xP0e0r;$iCGU3Zk#}HFytmlT; z(*3BR`l=CB^4wi#D$g}b9^6>nOlsZZS z2~-is5Ier5wT(;0I!hD#dKo{Vc<$=#7GdbS`;}6{A78kqexRofruVDQHvQqisg%KM$Ce?#Rv)JI9Zc4rtIRUSrCc2%q zg_Mr|Dwi|DVHcNjIrmF$$I{ z$0e6r&yH;0#Fq8XbnkFewUfA7w$tc-*_~pGnxEoGu*aJybYM@IRwOlFgWz_#_`%1C zlWa|IP8-E-R(>oYkGjs;W_LpL|1kEBL83*$mS)+uZQHhO8@Fs%-Lh@lwr$(CZTEdW zGd=xc-bBCi_eAVJCr?CX?zO&!bn)@>l!!bgNohK|t2ZI8;;6Jk)&6Wv*(Z%f%s*1D z%p^zcMPe8eoKz~|j=&l+hIx4Nu^UQpYL8szKFs+nn3St4ifBhfaH&H5+i@Uw9M*Yk zA;-P`6)GoIyyMbfWwoz8^u+p4*j!%P0x1qg?+|(m{D=;0b>*yu3Z6e&gNrqbxVuX( zmsfK+J2*Pz>g&|Rr#(6wnKx?-=-QP466q;JO_@i5Avk~rohV z4vU_PUDzJGn#~=`HES7zFSbKnbGVEL^k`%7AD8Y;q||f&#eei4u>co|qWeE){Edvr3C07jG5qe(Dq zAYNJ92QjSY3-&ZNPQ=8~~a)QbPyD{Jy+k1{b2GA%rYPU$UupEtY3v^@$a}sCEN) z)WD1%ULDBK*k!3W;n_0fZ{jfc;kc3{5ewA-W&!W?C1S`_Jq|d3;pRH?3S0BT=m;+J z5eU5S-vPbMup8kqa%_Tr$+}^D5dMDGsn2u83tQdsJ!1;&JfnJW<$=CCECovdH!;QQ z<(;BxLkJx)T|lqx@(Yx%Y2`ub0bz5f6I;b&?~8h(z?s6E!8^?%mfZq?K76$Ca# zALgBgbNhlj6@n0kL$cemC#@gOde!b}@{vuC=G|U|P(f&e4H2RJ9&Nk-q zUPt82r_Oy`mCAPp)k4Q>zoq=bJv8R>UrXhnwFA!wg1_8uZjwL01a%7Qc5-v;+3qf* zS;M~h=*`NtT8*}9>HV?Y*jZDs^Q+%zDQ+-I)R;+4#)7?!gnkBn=d#HODFm_hWkf(d znkcI(M+xlzQxeI@GK9w@VhSkh-^|y5pt=>*oMZch<2|&P{peili4-^oM7zw^PY?AF zAdhk)sV^b)-pR*EG$tLfl|PmtB}yqa{AU=VU!Uy=*#rso%W-c=VFUl!utz3;huRbQ z;}5pUQ!oWu0f`-=GG>D*xFSf$@NQOqoc>fwayyhC4V_ysN$;#tvlt4td$LZ$3iV}@ z&H$krvknqd%jNmxBiLE28tU+{yLB#!6C;e2(~t8kgG(lYemtPnAXGhnW%9D4OQQ0tci1*&gL zNwyrss`?WO?1R!ksw(~mN9K~2hPfd0;J$>-h=LgDXvx3BWR>%dqg%` z76`zu@EkM{7!Ep7Q{?9+2&DSH2<(~yPXUPYRX!n z89$0tK-fyw{XDpk?dW+Qf!#1@w_HZ?>5|s3Fz8%t*Ef zOBCcxqjUn{RDy6wMxp~uM>okT_LkKN@6ACYuQGY1lIom<99Av3-JXc@1etDk0ASUW z}%7WU8e(}8)R1JyK$m@NUNty~sL5bG!zv3&=^rtTgT+iRId#AE6Ln8eIAPe>H zR~mj?hpwf{KW7Telf*5M4$0q|Iqc*BwdcOb zKPA#j;jqBcP$LluuLFR zEja!V%_DygKk}bPOL#@>q>~p;?q>Rx2CDS1GTyH|;Mc)W^lyHqxe#~l>8V3~e38)V zq>9TxQVcA?r8ZiQ8(I%cTwuG+eQ?$5sPE40Ij6}MYh};;p?a5fsse@q$i)5N6G=O= z`Zcr%#upj=OF#3;yXlVK;8vRcdc|^ID#!KK-agFvCzsgm6k@9VbmXM1;kmKs{NgHF zGb1BAt=RnEQ#7(UozcbVUxky*k1vrl%OiOtWMz}w;P;WVGfH-ljZ>@7 z=;gDjL-+-MWm^6jwZwoZ;I=Yn*uAr~pg~7mMvH#|60zI{8IW)w(nRU;uWwQ{5|FSI zigN^T1ZGpoKY%y_Q&@<{?vn#TlFxWG+rgG)$44%EY)YdcS4xv6)-GXjG)xhTfn|Z& zG9%qK0q&UjQ2A&+Yl0X5h=Y6LyS~7!u*mh+jI8jCZFxqsu^^cXAPTYzatl%q5)T3# zKp(&!Kpw!zk8nxqFM%6dOz1-YNz?>Axig?w;d$koHO6l8L<@N-n%?5L)WXpc+}1M( zv(Md%79+AAVY7D2={{$%Caa%rL!XgLl5!eBEmZIuQ$M;IAQe@tLep4nYFU?jOkxI= zYEz0qt+Yqq+kK+$Dvnvi|L4R``CUE#FIvR^mh+PFf75MAgkOL|FaQ9=0mS_m$Njgw zVgLC!E&v1r0Dyjg{{P~*|CWV{nVIGP)}}H3!xR1|1!Z7 zXr4lK0D%zfR+v_PCqW1fK0`@ZfGB^y-yE5i2={Nm99!zO)-peYmdOhT^CRf|favb= z4rlE9P1bo+CtHAo(6HDtXSKI($}T`w<00!N760_?7UFIlyA{e_uK0^%_5As}ibJS< z#wePZrUFR&e4Qulc_>E#x!Rx}M^`tI{v*qBH@bnKG1$;R{T);&5bj|a8wNSBySNJe z8$QELsOy{QxrOJaDh-s~?epWGEg!g7yc4nS*b2ycd9Gt{M|1mA=2%_i!k@FLBtbvi z<-8(Wk2Tqw4=RvNCqtv}SzP}J6_y}h-)w(j8hmUK#EyuYlQ06hdMRGwda-VbdbzEH zHG&=r(}#6u!uUU{wB+hpLkb5YJPi_se?gQi3gMvP9JhP{uvMMMX)Y3XzDi$d`vC9> zRhj>b&-351%rLQXu>Y^`!^Xz`pA0lt>OR)WtEl|1e4~((64q!;=#ky0dZG zdH!7=hx<#xLqT=sd54_!iG2^naRd`*3FS%t=O}Ej?KJE7;rJwaz|GpXl6xJxl=;z0X5L^9k~D;s8=`d0p+` zsF_N|ftp`ba!P(h^k_btt+2BKx{7e%R792$Ig1!)h9B}kbDR`ydCAJ`9W7rh4Mn136pCxor#`qxlw)2mq zX8`nNP0;GEi`Z-Bw?fPxc>dc8cHR~+kaGQEqadwu(x0H|GuWYL@=?T3%vVPYV!tR4 zdsDw#spL;VIdg|HfOoadP_fAKfhRWbZ&USF!He&`V-T1wkGa#oplaB;d#643=ThcR zL3o10BfV-|!K1-rF5VOTN4@WAT#3mX!uS!T=j;(!!gcnvB{Y18?HwIVT#s+xqah9NVb2IurE zc*`-rUGh*;*Uclh^seG96t%)V$NbPEx2HD}G3W8wC1YNP-kU-9^8oMKtLS5ObwRFP zfOViFjbNTMGF0xc@j0m97M9?yWp7Qgq<3P)6|99XzS2olHkUnCW5&wV>!~0uCFVanl&$SU`KNo{>Mm5sUuPUVxgMQvf zXoM7Hv&7;z-oB&b&0n3Ga1+)QrcK^G8hVF%*)aOMzwL%08o86hPMmI<{%|O38WNLZ zNX{I)V8gnYW-6y+$)F}S+~Ol>aiVUzuJ_dsm+O}rv4PPp63ePMMCd-j=T9VXiv z;i>*R>CZ;Cy|JgH?}r`qi3G8vp-pc2Gi}K`B%HhDfwBlE9(79ewo>ik9R0 z%4XT(B`NhMkTywQjJpXSsi4#2WNFbacRZB0qOOKdV~3lV8h?YByd4$A8KcS%I?v)T znxryt5(k-b2#Zw@oA329Ke4S71M|N#+Besg8{E>9`dev?G-DL$@dTO|+UrV7x)zhr zhx>r-AAx9wACC;Qv&2&x0Rj)<*B8- z=W1WA4;_w9EOcxav9irPy_(ds$=@8U2qXf$c$Zb*9`1`w9m$f^#?o89v3lgwoXu)e zN`{b6N_Xc2K@TQp=tVu8c8F+%X{?+di2gqeUmUj7rXL?3)>vQt&KUt{kz>Dow5*;9?GlXML6_ zGXbbQ6-UTGP2zPLc?cO9d>!3pmy&MNPIO+jKEm1AZRWqcGOMgOT(2J4hJ9#X{YIlO z)dD>;hj;fI^A63w3J!<76bL^vy-R-h-`fPezlL?Mz=u|kehphlKT)ogb<_r)e}^pz za*aiwT2r*mvWiUz-SSh={Imbe`2(v5yUYRY1{9W5gXRoq$P>!PJ^mg-o$i2~69L^e=<3Y@oxXK*>~u%Zt5;jPQNB-&f%A z0KK3dwHhu-pU3p{J=uWi<`gz4F%wJ2REbKjPsf2Q3BO%<@>(2e0$4;|TrIJa-A$iq zXO;ykfi!YWt4J@{u~IfMi0DgV5gjcF8(YsPU!i1kv7st0bALEF+A3nSY>$9hCLbq7 zp_HLYTmq!jj+A$&jc|A}HCSoKP|$V9h9qBdXk$PFOk8NI)Z(EKDF#Qj*t` zgo;Z_V3ka1Lg_%34Nn=eFye_}_&TtgriHt`b&k9LDP7TQBS^5@{VrqfG#!mH15VQV6`7lWh=O4HNUHU|ArT+tUOVW@as_ zMb54OQOrzSYy<-jRBszzhGKu`>^ZqOK3`)?gs9ILfq zJT8bLgd_wYl90q2sGtZail|6XMKaThjkB1%Xf|DqaW&kE&&2}pGsDFhM-$p=Og1`) zc($B*$>J^k?JMW2+wJZ4Zue{UBS0Q`aYgeo12jPNO5Utg)G!(QQSHzD|5!iaR8))wSfWR4zqoMktW%tRl<-ETPUztIdp0FwipBB|Lii`${5g8fY9 z1vAT|IGHR&5&7~S#G!?y{!dQ#srL!z#t>ArntvmudA3j?!@Xse`YL8J2XQ%v+j4pG zGl%~0dhtY=;^Eg8N~Pk&A3%X~vQ9xt`q6cG^A0|8>3~NdfHCJ~Zk-P}>?ByQ#bT1> z4zX@6RolL;W4ts97L_Pc%FD_mus{Z3vf89`)U+b4!bD4Kz_i}SERK>5Blq|~(fs~? zAwT?i?%0-CV3X4#f}Y@%2ccFU$0Otfw?rJDO>$2Bm0@I z$+PgUwzV180@kj9*U>!yJhVas94`PUHNo!s?>x~aCxA2EvF`5gd~MA_e!MF0^DP#t zRcAydnj9NA7WUZs&OT`Z0p$Ua?Ez97z-Re$BLMj!01XJTgn^F};2!-2szVtQ{D-#W zEd!^`!*%w@tHZMf8Z_X>0PgJfwMU2wjO~ZK6Sv3nhOF_|Hb9aI3^f4b0j(u~AQFTL zgVq#;i=#dQeHS*OK#B-e%BLvFVLt_%6or5X^zX%P<$DOl1d!17}1967y0Pz8p z6@<^b%}ZqfS~SG72Jh_esl$lzSKh;MhpY;)+9PX2)&qy{FTCS>WAFyzgVzrv-w(Z` z0YbnU5XV6zBoZT$;8F@pBJ?amJr@IuS2W>wgyD?T5hRNjAA?Q`b5w*uE!ej}%7~np z$7({o77d-(Ju`e_@dV8lGM`%o0qalM6NMm_fQ*Eo65`E|WRO^sd<(M=v5#hub(bPR zdKUp?3`!HBAy7le4DTMQ9s(XZ9FiXD9MVJzHxYdx5{+AsWJ>T~65SBm5dVmBPG^zz zlq-qH9s4-~aU|4~z9E25c#Y#H)hF8}?k%XJs7Ydw;u00KEP7HLp%|q=r(8@@S7B2X zh|W7vpf0;!BE0auz`U@zK*owb5rHl?U07;5ZX(>cwa8s8v7kT0=^)n?qA$QczdXZV zh+XV0;5THzu#K`1BOL707+ss@7=FvR--@z2F(zYGPHRq&PQzvEw0=pGH0)q9PLocT zof14DJP|!1MhiY3NvJcaQd@zzq__mLN|`o|Tsyah?M&?s^@;Jx6+UQlIN*emBR>V6 zp`6jB8*n+1YID4Sy1{sbamx@tf^=8X1Fa2x)!qTI8_6=pv&b>uG2k=$34bTS-|xIH z{-W~5|0Ve4`YjI57L5vCFp3`bjhsZArLmzYq)krQP64N>)$C~+s5+>os%F!O*50lc ztLCj{uD+~p)y%E;H5qJ#Y>nS^-o$BYw}jsG+%Q{b+w}dH@!`5MvqLv8XWlw|leA6j z)#KCT6a4-6yYvMfrwuM1?oTLS=q%1pM7lAf1}a-n_J|pd4Q?V%bPP8RIgUOjWR_z# zR~8({wnGV5WcFkhc$PfZY#T>gQF~L{l}r1%lmlvKN~f(W@8!po>|V-k%Y@C=bx)rX z0V)gR3zTgq^H$-O)t2~nttSHS5MDB#HgC^U5N{yQB(FFRy=T8(zuuqPYQ5Ah$esKh zty{%gY@rSYF%9x9>a2(T&!P|Kx2R8^7ngh5r|mtjmDgtdIQ`_^v|U<6@g$lH1YBgF z)7x|USN!{4tUd?{2n%Qqq&u5D^*knf?Y-Q#pDmU^PZk%|U zfT#AWnyBTxl0-efD?`#ae^i2!W2yiMGPJWhG_#F2S@(Vb8U8u(q^I*FtNw7N=g) z+VE_cZm({%@$@)&(7pc0#(Cj)d2@Mk^X?_`8?Kk@oH@>RQzxt0+B97$zU`=|@?L&f zKKt{05zY!|)l%iLU48abFj{L~cN(haaf@yxY8ATj(^g}>EuwF~+wwg0yz#usE@HE` zJbPnz(c8&rbGQ#^o#(apDLb4w0}BRcyDPJ8y~V?s^dS#W1gQO!)|O6^9+&==VUe+% zDU?~8g_9MY^_p#xy^tf2Q)HF z1okB56#umRjOncFTbu-#pWNwE#eLHt?ZrSee^^9$*XH;4Utjqe^!WMz z?JL>;BRS>&sFGm&2Rr^>Tg-o{LL8j`uL@Zr{C~wLxwh}J0Fk~1o z7}nzE-oX3}>?IxYCRvC3!DRBNVQm^{WSL2|Hd!1JXtkNj(;tj4*`8OEE(MfJEVWo< zD~M?0)m(%&VvDu7%M-;aZKju0VRyW0Y_JfnoA8y{SZjS|d2d&pc51z@g=c+fAxZ6l zK;lNsks9NQcLCyz4@2R@HB&+WB7WI8JN?KeQ*FTKXm0#2+Q&xw5y)OCR55a#WMX1dj0Gve-nY|EmlK^#F9_&UxEZ&(0d&RHng3&WS2(4}qk|#1f zZ>`P=ao5eA*GOXf;4|i|A8UlTAw~c~Ah}A6yo5=zFNYia!SX98$M;(tJn*N#cyqm_2p~6Z5c*^V#25dzrOQ^||5LFc!c=oCpSl~oFtvOC=x~Dn z%3T2d#Ho_=e)$czKPhx%<2_;LPxpBL9dqOxj}jGo6B*6JNW;&^(nij7w|4U*KIqe( zpYzWydbvaD;l{VnZ0uzoI=X#h{l|ID%0_!VWqLUoHRNHz$R}Q|l9C320#N)f=wX2p zwmQ@wO^T&4j}!sH13W<;L`4)Go5C=MWf>hC%KYOaENMzB%4!Xyz%@|aXgJ0`k>irw zaA*?_qQjr8Tv1U|$?ez5&j77tO3{%&qVS9gyvOLMNa(;)cXujO2(QF?9U8aBJw-k9 zfR;Xtwvi5{YwOk-Yi>v`!q@)SmQWo^zEwnPK;e+41VrFpXqBuL6Mdydlvue1s`W#b zc+6Rdi!qnwjnH5ik?ct_b>Tx{RS=NQQjq>C7pBDpg5~DE#Xo0W%V~~E4h((*mIe@L zJB^M2icmISWF_;2U6(@xx2t4A&5r4YSgjEQvo2xV-(~> zjw$GdQ;w)4=E5rZ4mIsLt7&+r8OR>f5nfrE9+g1%Td#L2&5lMg*3Jgc%eAn*W$38+ zYTc>+hgX?RJh zsacsy=gI_pIgd(Nfc&x2FhvJH)_-v#MUQg*sUPJ!WSgei^I!{j;D)aTOP0Wt9)^k< zIBnDW-m_3lBUR%IG_SS9Xx?m5;g|xZ(GRHnJ3oZbtd=s0=^@4wBFpDW&Tjgd z@(f5zt~hhCwN^5~Rp`MIe!PHmK(*4K8A4lpvyxVc+!#F1+_{B4k_`sQ(M?edRS<8D zn#=nBQZ$l8GG!533Y@gxYgK;3!Z+BPXsC5&XC~yU>ZtA37ffEGTnqxjuxUK-s=nhT z>l+GNEp>Y|r!Caq8AK2_;t+(D>w(&vkp9cdiLz-wWe=-mN0VWgCje6p51tCISJ6sP zYV?0wa*Y}EBv-OlxM?WczmD%U;Cjx{RtRB0J`{5O9{a9ZpV4Y+SWl;gW7rp%8Ht^_lwGbrdO7~&C0r% z(iwpMhpY!~@vJzv5WRg8iL0qoW@m75FV&&4sD{_*;U01q#r?ZucD|=+-1Wi7B^xD?0(p0`{V+RY-nDUjEVAt>1=83Mb8GUbO?g zFMQl{qq;=5=)~2JzZIa3wySrf0GBrCwH*-9d_?%_Ntj~P^BmRyq_(xaIF5Dxg{^h- zaKS<**~}=G^?7OenPu3MI3AlewI+I~rh5VD`{?Oh9>EZq$a;+M>;XbmX1aPtRaiC| zYkJk#2N>9g(Y&sP&Ry6gs-?@3md)`RDYl;CFdqfceHMh6)dVpt5+#1J{`ekyV4##x zPal7)gzT$!fV|+!<$7npTF9?2iOoPN*!_J>ds6m@){z!R4<>ZJ6atstP`-%+3cEO= zAWpB4P)pZ8#(=*|&$zTP5gr0>6BQGul|o8tCmhx zK&9$6cjcHJk)Q8=S?BT5!$R?4VW8K+=qxWKynJ?HWMN{pq0@D`_ECfOgU5~DF5=a> zlKBHMm&oogU)vn7kQH0>=Bo~~)dFy~>nbMpe>r_5;O zdH*f{xs0{#rmox3k@PGqJ`RJOx6}S!Y~gZ=f5pUY_RoxI74Gbdc3L$YjDfpwY&+_y z(Xpod(gfJ3;C=p{3!Tg@P zaOc$m4(`gEh&J4fnGLy8n(Xaj`puXQzCWccEt@N@qx@XB=B?K-TtE4p+ia;h zyWQwR+1bH_ci^wwr{1UByPWE><;y`(eXO$xt=bX$N2k4qXAN&QOH@BNHsrS>ctbzP z%J$2DD+#X%X>rvm1-d|EBN^|>@)o<{yKMC~_eeBmRKiJchAy`ndROIX@`A_m{MqC78QHmoH@Om?9^Jxduzm zMS$JQZYEIoZaBF{uOl_4mBfbMTCuJsLB&W%XG)=Lu z<@B}hG3SUKo;SItby4q#Jg+k~NqK9J5bXfb@QC;MYh@6B>F`9GR*7&Eh)zPETS^ti z3zee%ryc3X&AFC`hJ+ znu8PEN%KDVDd|}{LJ5gArxfJLWM_Dgwdlq~Bh(}~D(dhAPD!LnPS<3BW^tRiv_w^* zIL-4n_znC1?R;fE%Soy8=bJ{%SP&I}YT$D!!W+kW9&=Kg@=uNSz1(_VES=5f=4~*a z9sB0(sAOio?Ph0oV&(I>c(%N^D=mQ(eWxZlcGA$?U>GE5&iIaM0KvBlrfivlcl;7$ z`}}x&d;1Ux==z)&KNvlNycaX)*(oQ0lbQ;23X0OYgH2hn07&+Wpn`z%0GQIyNeWet zs~7jq`tG;u`C6>K#nC*yiM%1X{W;DO?~2B0Kd7Dm8Ikj2fY+!25v%HxpxlRY$S~6G zfmB2+&@gTmr6K#%kJsiYw;|BXhPiX-KyBimqdRPX?Aj@dbz{`J*=n4}zBq?@EswLU z&#cnn@thv=awc%F9C(vcSGc*krO?xrHj z#d*kY?`m_tR1$5qNG>PS6EbjC)b@FNf1f&E)OLBW-uPEk_$gZn--fUniV-CkJTjpg ze{vd9s8s`Gh%o!@d=LM|8i`-@{Vd^4mW8B;U}sdzewJ6Pm)L_S)gG~U4=IF1KW@%~ zf_aukl1M7j4u(M06>^*;3vZYZL@)uDmfk(*(I7F-2P2y)#MRl<6&A0|W2U=frn~;@ zV{k&_MnXDqF7rInxz>fQ_K4;>>$u=etggjTIeM>pcs=M8ZxGH~;;jGsQ5cLlm!wH+ zEPTRnFUiuo0{}=Mp2$yP1W3}JEe{R}sx;#>M2u|IszsO5lD_T(YS(fyc)VxV`|ECK zmFCPdT)9h(xp&%nU|R!hSwG;yqsz)Uq)2TL0j>PX+%;OM)=rOqj@a4K)a+_Fd|txX z=^MTiX}B6VegS!OMBha$D>W2sN&(tHm>zGyb$qnOfFOnJnZ~%4EdEc9Do(zlkuzb? zbj-CR6k^%%RRQ+Mfb({W&u0j=XEx=%L{V|YB;J+H_0{u7$q2kWDtdkwO{gQ2u+T97 zCL6M&$rC_D1A_ED%L&<&=S0R51DbL|8oiAg-s3`PyvL4Z;(*dW2h6RQ-;6xC9v1%Q zv;P}x2lq`hZRf&PjnK)S(v0W9S$ttE*2>T{8q3=9Jno1N*4`oK1Ek?FqbBZgMvfiv-A|&WrQ*lS^Ye4D0XG+VCr}0zlpvAdq?b7y<)>_L2SXw3A}SvQ%iSa#o#ox0Lj&_&iH;CT&3Jxn}MzYNEfq=0DA)r>uzmx<1>MNQ1 z<16tf-krw_LDwn8EY|=v{gekPpovsNR!ID`3?+yvACZ|tu&-F3y1$Qds%on~zhCJ* zcZvIfaqqWhweNGaP#?gerK@}=f2lISvzWHp)N(DEinX$!7%(-pNy$;*FYCU;J#M+5 z-S2AQwR&a#+=$of5WnvO` zbSFeBbJ;4=a?^)|KT|Bx=^>I?HY#H+#tqlGhTi_~dF6Svu6CL~AIIS;e>5!EUu-JF zF(lZ|t8wqZT5SEWq4Zt@WFK z*Wrx)#(`yM8311e6U?0VQuOWdB}R0*{EUo#&xVF9SkNL}M~pU<4?{~z;G%OQU|wF~ z5Ae4>;r`u`09s$^iV`M{_iZMMWv@)oN@+KUe^E8Yb+EAE;dL_BUhTvXxYp)(CwR$9 z&n&MXwu|<_-?%&=xYlwyYBAOPOvPR40@};s?X(t+d2aNulpAAaiZ;j&GRHf$mEM@b z(=^DAv(uwg)vPzT-QL-+Aq=%>E)JiLZdK#9B3x2seq0PKWmv34+M2h#QQstch91-9 z( zCQz(s*+@o)zh`la?&#<{m#V0WPLgjeZ||Q}Tls7U&)00%MC8n*YzHo1rnqWNS4QY~ zWu56?lT=f}6L5bjen^hetNj$ z4t_P4`|Dtpwr4e?=N~|h z79-CjB&q*zHZd=x!kw>9mLkNAy!dE!xn%kAy;DN@VFHSuzM*G)@o2+h0R<%}=J4zC zMaHS4uXEcuSYH-VT}Ucs)C7v4kya zaT5PoYl5Qnd?EL_8xiwKl~Hi;=}c3XOWXZ*R6#{DGdhia+7#>*!ua4Vk;Z%x*~VdG z3N6z`%89}&-Z{H)1}j`N7Aj=Pd8trss%O4lgyvJ&a8(nIH-#hWCsD8Q3e;Awt*FT; zmsaiNTH@Pvo2Apj1UABKZ5)WN^Viv9z?3Lmm>Qw?kPtvzJ0c=`&_SPmk&aK9+c5vfDz5&CGqjFb#68NEfyMb$^=#_29n zv~wa2A=GV=&i*qU&AjLX4^15cIsD_e%G-F866{jB8#GqIT8HG3oAK*BLCm;TgFvZ= zd?cMBb82TH?j@vU(Cs*I)*+X_nMF2x3lnT>Hpx=Ol{Qx9UN+k5ZhEp_p`DG>&%dg& zxFlh|AeVc+T8dNgC}TxL39@oId6j7b#cpte4bRD2 zT@9x>s;27WIP2@jah=wU$H4Su50T&Nj{N&RUbqi>2`)|CCYQ#{OcNW@4ae0saP84S znJl5+GT8HJY6*0!YTQSEHf7oiwg~Yl<&!5ZjWo-J^^7Nzr6Hx%W|M3x7msl9RN;b0 zgr|@OtO$eRSeMWbFeL?PxX^H5nau48#ykW2_ax%T!5;%*fK&m^4G0*}7@|NJa@%?U z>|ld{tsC(Ne<1lA-y*-eefjqA9~w)E{!B;*!d90u_elnqxpWGJFyRpgBW6#~&i;viz6 ztWn=(^eOs}g5aU0kf=xEC7nPuDK34VF}lFua7GE?;yv zcM#Hi4Cb-2tl)}!xBKqq3&&YDhB8}S?i}YUlvMBFxt_7awdpBpbv(Z`?QBhSui#!v zT$LcUZsKO<9gf>7RY_}gXg@K6qW;sksXN0I0pjnK#PLawTfD3P1q2Awzh3w+w*LPc zTlN1x#e|vRUo!ds#RO+0U}t7v`%g=Mb^ZVFM)JRQ8en5bTpQTmXXrc{0{0L7eMeS8 z+x@^N1A$26UzN1*?k6MJ*Z(UbnQSU@sb;p|8mU6Lv66ainn-q?;H+EFEwcR5K&M*j zV&s*UWLw=NCv2&_P^@Hi>%9slm?U!X(I@P9b-VL;%YEuL<90JVHJv3Tz&8a9e=rur z1B>}VT+=EhHw%dw?*-atZ|?kYCL%_c_HXBpkIT=k_3D-mgaQk6XF@|b8p-#a1EYW> zT3W)WV)7-eH!S_WHnf#q<&8=|@U|2-bxVw{_`^JL0{Je(<~JTX#YZVm(xdxljZH7Jv2_3>ko(a zbKAp{|4;9XXAUK7UrER#CjwX5ss~Y4=@hx|O)K?U#9L0U^cxiLRQlGQ`eR**$eSOk zVEB<(9dg%(@QTNGd|S8ctsQMrDFHJa!^7|VHYZr#OTVz`l-F75n z-0ju7{&AI)vOO&ueWS}-BUM_Mm2zE&mL3%h3g(j|S2;et4+&mF06PpajH&FH#e!2~ z$ds%|Xs0lQ0;rll%@={7yd5;1L*yB=b4qE(GwdQiL(wE;6)g>+B-oCbH^6#h5F7M0 z35bQ7gqnP-@{UtVg_38`dI(2ofeQ@*g^nB`b@rsegaK{PMH;vx{|)IA4W04?W&%4# zne6NtUb!_{4pR~Wug7-GEq?tqmFFAYV1SVDp?L#D4Jvn+)QOQA~dZ7`gG91#f?AjLXtfZKfu$w9hm zSS0j7N8sM^kUNdVSvk)U<>p^sHT2Au?-LC^6arDt*O_go*+n+M05#zqn-mX<(V`1D zuZycH5v6HcrAhNW#nfx2xrZ;PO@#5t ztf3RdjiJvTvfqRz4sgt99`BsXeW5i43uIFjo<$&OUm@b#onpp7DI%7N+o*+O=Cq7p z{VD=u_(illDXc-cK&d%d zDT*Cfg%kwY9~OWebb1R4ioJ0-#ve~l-7ja|WNkK`To14@pvna~vwS#t&awrxUqoSocyPT@E{GkJ*XLhT{ z3@w3c15vVJj0GDZ$fOg9qk)Jot8*H5{ggeZmK`gh+yF&L@?Fc*m!q8|V*K2|+8RDm zc=J#aD_+Zns!Q)&y9Hf?i`m&8*QW;yy~o>II!XIX6RACTOc3(l`o3tm$E6Hn(jFnbx};Cn`fnnEZx$ldrd#07dJOaiiN$6T6hK0^dIvb8@% zj6fmQZ)caN)gPSpNPpR$6W}KECbQWEFLC>*F7xVn3tox;Sf~7T?3!No*#z;mX@Ax~ zH{Nv4A2OEMMp`gij2;Q%gQ{~Yp~P%GxQ_y6g*R2#WQ9#%Zb0$ukAII zUJc$Ql}_!}IcecQiEthl!?r06J(A{nSD;-cCMstovz~`Sy4Eo_&V0`@Z;mWQ>$#+U zfH@dC*n2-uRJ+4x&zSeM<|pOfsK0NtAJb5$XD2pDkZKIT>yFsCx_D57$JK81hp`66 z5U|t*+WgQILD>jRt@yzjcJefRWl19fwn0V?=tw=o_^WIi?h+EWZ900{0AKe}l zw8%oC6nA^Xh8Yfsu?!aXp(agx3!=JZrXCDJQR8a3s&m>qedW;EG1o0eqwVRTeY|~% z{&C}roBMKy?_Z%T@n5??7el9>$h+Qb>$XKx=iXiQD?bqid1etYYYclg?&PuavW{6b zfh@@_d39gtq%|xnDFd%mu)fpT-Bxg;bZ#mCRK;(}`KXAM#uWQbhCj%eU#MfCF625L z9-%7$aSsXYF_f$u%{hIyb85k&IX+JAnu-NZgW6czzG(2EMFjRm)Rk4^VMVMC$>&tr zpH+LTKwakl56<4PNt8g_wyfHvUAAr8wr$(CZQHhO+qSvOw)yJ3j=0^o<95W0{sZ|j zGuK>W&5_T_yP^BEag_c-d5Pu90`}uPOx4!&@IYCsj7@IU4GH?KdkMCyd*GXH^3p3E z`@_@C{p2%4{f&E?8k!C240gD-Fm_@w_a2(1X^|CObf9v#-Vy2Tj=3QQoMnWX6i-ry zr?_{3qWsIFhuOjN?2)YwYs(p)<}qXj`oVAE0r6yH99b#hxHMd{yXOI_f`TQ0M#%54 zKJlD}!a4DSIc&>CTY?@$^|2A*1#A&b2|#a@$RXaqIy=91RCbyk#@`7E<$U56D=%)0 zAPet$6P8OH7#$)7n8V8wTkney5t_(%*rlne;~dTixMbV!10w~;jFSkJBFOyvcFA?hfrlcWbtMI~TnA zVVimuKIol4_wC6^T%4}WieM3&t8tUO_R913*t$w?oY0S@BPxhI=teo8ejK&M6MaXQYzqm8hg=g z9Jsc%C?+T{2e(J9j?awiy+X?%$&tvY8TF!;f4ulem`su*;P7#;Wt zDXmKS0*(_+k7}Lb#d`i7#PB}e)x(a>zAf$M8}^=!GL8iboML+z#tP<~L3gX}j77$B zm3j18Jd91ZySbkVEQ1`HXl*(9OX;a#<4Xj+s&hjoxX1yN=bs=rR*?xt66T zt}@P0)q*^$zEq*csj?UmOGQV;_v=@L%m*JUBI&tX;9{{K2JR0U<6@{c5*WqGU|XJj zv~RX_vaf+Gf~@Vpb2`h7g6%A%nK@M&CI1o|RjNJ3_AVNA)1I?uSP*y;tuFu0LqC7n zFieL1!2c$K@Q2m+ki<_B2rSn^)FoIjbQA5$n~5ZU%3>=W8BW76yuaDErJ&7GosF=q zv<(MG7Aks1)FaBv2H?Rbvb&E;Q(}j&WP(#YYzBD!y-e(j=ld(s-<^kn1r|QIN7T2a z+xOib$kyd2ck+fjm|p4OIMegM3TNmm?|9dMbc#mSAxa$$r#)D(Qr`%4$y8V0-m4|B%z68)R+^^hKD~|zAFm0+F4m;kp6oNKoZ)d3RXowO z&Iu($;v6xJCiRJI&LWFJB|$ZtO%|yNTYo6EPM zR~sCl79q|JkWjPSxOyQl=VRXjAvg6ryUx7m^qzEQ8RBxjwqJ)sQA8WRh zB*NdH({a~8&24|#HWGSwKk;uo-so0rkKZG zFhizaEca5Z2S~Ygz26IXxd%X+#LsRO1lAwiAYF&v(x)OcW}yg()Z!1;B?qo7_hqa1 zzMF4Q_4Sc=g3>=ly~oh-erUVjF?{`Y{7GFh%le}#e;EiE)`!Pc;qYNUymAWG#3{qz zakadd@G6cxkM8?S9R!j1q{(9{Ks__$8l%)K7)^7VfpL_q-iZmC@>?M4yW{ z=?CiOM7s+bXD~vU-w*SE!wu*C=OF54(Yr(Td})`A+qM=m5QW! z__!I|W5+&04&ff;qL_eE7kKfQWZ}HV$RZI$LMu2zL|DO?2Bxr7naRF}Bslfxin;`d zr1^4!+7OFb(zD;kdNl7d6Bc5>L5OH2YephL;)geT-ql zpnnk}8`ePw6P*BkqohRo_P$8EOAq9tj*PYe;X^8jg6QCqr_6zFfY|R|7$?9U*bE*5Ep}vstc`9>PHt6uo+R zp<+aK3o4Wx-tP?XGF}mRT(TAjK_tRNTTFvx&^Ba80#5;8RBtBbgZ=q-u?{-Vd=Uy7 z#)uWc7$$ue!gzn0*1-G^WB3gV(KuBzeqXJJEm_fih1f#AqV~Yv=1FK7(oxg2+hB@e z)e~6$Sj#KR`IjI9rfuqmMne#Y( z_2&UikQ`LHln>f8P?xKVD7Tx@&PT37&$FPs>RmHuEfF84GZ6-g{9YlVluH>*T zwd2R?6N|PiE~V&IJyKmiIh!{i~SKMCE4i zgz1M~--mW2l;Y{-b_ClK`*Sh#P*;hYTE8R6oB1lZOBQs8n5wU5HLNbrmAZt?XafTK zHY?u2hY-B%%cOct)9CtRYAHRx*Lv`K-{+SfPj0k3yn%E~o@Z5Huos(;d9Y>=< zQMt>o&}KSU-=Tki*65*!6{LMaveWzF+vhU#+ZOvICuSvm(bI?&1%-i>NLRS>a0RI0 z<2ZR&&7v_w*>qmiaHn*r#9khb?@p~fs~;G5lGc180iA$ezK#B+R>Q~k~ciIAxRnAE)9op(S_DdOG?p0mp`Fn?! z8_d{M;#QW+S}vdSU{cT$&n(Q{tlV#xuB~}Rliu55$5c3HD0yFWc}P9LNy`zke^T;B ze+%Vel-g)*V{TFF<7$EA$UN zh!Fl-yv5h_SBO@M8?-A(@qH+p?~__bLc*fcLP1lWY4x*O+ps5>x1P1w-@fi^)pylP zbw*{<`@)f%oX_1HNnr%@1BNX;A(X3zAXxMwt6WImK8q)7wYuEi?uX0I&dOg(rdN-T zciaqZt~D+P+G};jzK*v*<~$M=D9`<<70SiQ`qLTE!tmG%tjbc*w0dT5JyIV4LE585gTcLW9Ms?5!myvoGtH-+ElcMm@te zUth@JuyHpsUZHy)YF1-!7lO@jU0p>+bT?mBGgD`_x`6=!oiTXU+Ab{Cxl0-|FmdU( zG_Ke7b#*S0mOp}VAbf!xDFbZ|xrg-LbUtW%oviWv450&Joy-!49}Jm}f)6(%1{|z` z&*ak6gPV&91RxX)B^4p5;U(R(;?+4XGgxD9&S~UFlxLTSN2RFrDLG%UbVN7{DpE>o zvxeJb;|XjV+^f+~QjF2D;8ly8FrrYkp@nlNiWM^|n z%odf<=yv@rOD(=Ra1BF0Dl|~Spp)2WbC;H?Hi0tvwzQuLONs@6>xJ6eU0&p9T5mKa zo0RZl-w~u-pyD6u&XJPdckJjBYVx&s9nTP*Y*|XVDr>uot$6+%F9B`u>?Pf5pH@*N zM%N@dI9dvrRb*BpL9lAN6wJd`cZj3_a;FA7YiTD!;(`x%lRfFk*M} z1?gf{+?h8!D98{M8NQ;um08hUb+`o7^*XBm_Wn3A8TcM~mz-CVw)7R~|T8jOIb4K0YYJzsfVj=9|K ztZdj!5yJ*&WiLe0b**dO{Fjl-&82HJ3?hl3@)SFfjLUi>gg*U>csmiMGA}U^dvwfD z(w4z`eqgrFEFm68Tbygjl4kLQ1u%9g7?Nze%y8oF%A05nw+st90iN?|zs3>Gk__2eq2 z6jU*iA_QM8aEl?>bd}Bd0_Af1l=~nY@`#9Ro>?cz77Cx$t{jx_MCvQM$wtJ9-7dB) zH9CyB;>4W23M)9Rt7Zk{%34EdDe8WZXa&ojE*+D)e>Y5Bn3vcVw5>@^a=0#QdB8)D z1TFO&7cCv=Dbeay0UK6EmS*l(8V^SC1oOrs<@rQM-dlmXvor*Y*&<{e-(Vg{s%m+ z=fY!vl#lVLV>jlxqV9n5)OHnWFrqL8-s*gQlzKjTM4h53IGLyRx%i?S94RpS7cC3L z!b#1MAe}-=aAU|IFdbl-gmqa8VG@D0vl++9{t;Kh$71_8oj=cK*Q^!&ct6>k<(jZK zeprxd4)BL%e!EJ4`sq=C$w0>w z9;^rYF50;6Unm4z(gHlBg)fSIjE>xjMX<`C)HK#ehJNUiIHRx&0l!8+CIr;8>7eG+S1Ok+9I4doUC0fJ^t@} zN4c70(8SW-CdXXST2ZOix|yY>#r$4s8dIY~S`S+M2a|K`&lHR09}RCCEe7yEF?SRa z20m|B$Pf<-5Dya&j`B9QCMJtJLIp)G78F(We>a%lTT)Kyt1Yh5-|Wro)sr0=Ad1K7!Dok8~xy>pnRvj1B|g;^T?@C{}ysj-G) zUfRDd7S6C&|L%r$U{^w*Yus{8mz+WlY46)}2W5mBue1B&H`U!$;(>-G#EfQmC~a-! zeYx6k4U60G?}ZJH)vw??q>d}(zn=y1KVb`b6Mhf$lQ)G55B7L9P*c%@H!F9=al)}v zQ4(|L@fD^@)|#SAMe!IV(Ij;xMbR)d;TzV^lFA+uO+nHB7E_>NQqL4_qR2CLr>cu0 zD+56uHQJ*iJ1C#0(PY3Hw5;i2aJW>unbpB&|Dn$6bb2`URru-f&h*Ho8P4@5>So~l zBTes*MgCZ~i~Qz8D$IJ&nsWO*8n*hevV6tM(|JYu_H>1Lk5jH$YN{lZ?6Bvm$hLK{ zAR?q`O`Pj)J8(KC&}!19+xm|OAw5`VW&TfC!(m)(cZTGo5y_r5eJ*P=|Sh|7O1 zfJv*dwtrjrxr^ZBUm@0RVC%?-oipqX&<#H8H=u32%@iM*Fz(5`Tt1kIdk? z0QS_XemCTYr=E6f#h8tf&<@}9P|!peZt!icJo`FSDf;0HKJ_~APdNWD51&eb|5NVR z0G1$p2iVK0FCiQF3AIuPC%peI|3IIkYn%|C2vO)U3Wc96NSD4#0k#>2H|!S-^*(`H zFXTTWADrDkF^-AA?R-0?ZYAOA#ySR&Yj~UkIR><)sd1z`TC?DGHsFRIrrDEOe)gP>jD4t_`z1Y`YPrvaXmAMi+m{J=hWB1j;V zg=F9kpz~}PBHDJ${?B+|YCKUQb2@9-eB)|%jz#nu@X|0)F|e-CQkV8lFtL}|xMJTw z1r7g1&U6b<9*srY_rrpm_Vy;{v?S!v8wSY~!LL;U-*A*7yUJjg^QH4T(S!M9(5TEn zI19?K1$MzZ49y@T3aiV&i04?ABIWR^dED~0FxXVD|6cn}7)#qwHOa_8sgq(rR*~k~ ztIJ~1HsFLloh}Nllk=`rG9Ht583qY&0dqgbkr#x)n- z^-3x5+Ai{8J#mt*-m(TqR7g4r4hMjVw$c+rg9saeCnaX6K%jRak_$PcZun6+lQ$ps zvjpC}0(UbcljGulgPx70cmc7s;@uVPdiK8f$g*yecy2$fy)}gJ^Z!I9-QIMqY-izC}`$?nwurQED? zj)MMHSN_a3vLnX?f`FiO3_t-haasOkll4z!UfbIM>e$6s5Gbxr3VZahc63}`6@L!u)bXkbZ^VHqq`+%zXnAB zBRm|%!Xw=7(mzRsFd6%0V;ic6d)AJhr{ng5HN%>3r+4_sDPmAZs_Juv=WYXioOdKR zim@XGAmc7cv3j2`h=%k)wO#;xp{L$-i<)wLsP^i3xOfk6tAx)}Or|*WT#HaY(i>nv zaDJ?Nel$;e5HKG#en0A| zx5fk>a=wrLvbwV0*7v>w>3SvhXStHTegjjxw zwfL+L>y0&s>hYX;SUis-{XjqtZM;jUm)pCG-L;msrlOvGHxC}qZJRE=8}Ab}DcRG~ zoLRK1oGnXAwka&&%16X2`vYE*IyLFD^!7=9gR~$>@|E&TiqT8+^0P+b!oeL9`DO$a ze=Mz;%63Pg8}g=ShDr{P4&Kf2?zn;F~=;cB>ys zFto{p`fWsE=XH@^!ZGB9dQsT0W#5r;M zpYp1Hy-39Dz6@_YDhj2`5;~~5HiYD6CJ3N5eE!&&Y6}%Y2-Z*& zBI}1pQ4vyJM;MtF-cyb^bLbRHLq$BnYFgr>hwe*9CpZ>K!u4qHCR&Q1MGZ?v<%k;)B6Tc@$ z&}!mE5`!F3&ZV^{?$B)bZ2aBCA2^?*=w?g8@KuO`u?#SX+<(JDG0xO>6t(*xNWhA$ zBNtbxeugP&yg+xRy|m7LYM{T^(#ocsSQ-&tYm&nUy(MwifUnzcbBdQOt50Tgs>k1Po+Rl?Vcg>LN;cFD5k4>RjMB7=_A15jhU#fSjqyzR3fb{MD3Gn%Ym6m^N zYGUvQvWc1l6|;poWlgf;ir57;UF#jto@%=&_p@?IIPnw!lM!}2_l&^G55rZRe@9GR zUpP3~j!=)1iaJ7Fdd_8bdBts3d1K#dNOZ8}7&|$-rUZM_vPin?t=QxP#xuCRd|p{y zenv8rrRRHjbqOc8&au$V)ja<5^q`>N^-R)KX4CWhqtoT4QO$+x(xzQ97FQyxe+y>n zi~JZxzp=AvjzK|1N!^^d1pZY*-<;*?eX3G1b)E9^m?S0RXylMN#-o_tDUViewKw0L zlD)&pF>tPj9d38o#lY8bY3D)U$TItC8=2UdXz9z-Qe1Iq_svAom;}gwN>C%l`IgTD z@JJ_#(kb1>#B*q+ozl^jhevDc{qKEy=Ot|Tu841<-s~>1h;O>P`5A5rY`boLT4*A` zHjq>c)O|^17!Qkg*{HfS`yqZ?83>C4IF?cfK#k7Q!3$^)7;jLlQ!G}Up%CXiQq>+X zvfxj6Z!m+PqyAdhWPjv(l^DsPE|VJ$JL+$Y6N-WAgw7RAz-D-hbxw=X1^$+c$rbzg zWtUev+1P9Ilg7b>0a-pOv-C17A`@Lk~gfLn#Kp!hD)^mc;XhVd8yft{F?4RbENLM5Rf}C6%S~zfYyG#e|sS792Uk3N61mVe9Fz~`T z5d^~o^;!_H+o*i|@BX?RiOZ8BsC7hp;PW%v{XC2GcD3*(gj6bF?wN+% zF*!t1YsD_V67Sbt94xJb5TPyn&nuPK%H>XfKcKEJ5lYtP;gCXBfs1`I@q?>~U;bJsKXX14R;pP=Zz96+f*h`tF=2Y~u3 zH2^!k<0DZJgJ|B`|kHaqpi<-qC9{jz29-V5ElmH*W()*-w`{K zg)AOErLH?r>nOrQXe{|_uKi~3&z@A1LFf~+Uxob;=Skrx(vNcO-UxQs%;?W!r!G(E ztML#mHI^1v){*UcbY`0!SALadsct-67@W&iF|?h-ACJz$6i3HlslHPbYn6- zoBf4(3Zv`24#}JJm?`avS*K6c!Zkp|y-@KrLPJjb;FUYl-xfXwU|c;@I1f8(V8Jo- z(5uHWuTXcDl3+X`9f41h;}>=r&|sXh(CR&4RhdQ*RWK%oNV?SY39mrsdX*O7oS}&2 zfY5Z~cXbqz-xVxwKcO3N?4GV5fEO%hP%Q$T=g}se+fnn~>fsMCLw*$Hm+-qG*_2mA z?<~WQ+ZsG~0ImQ2)Gm(8UtMH8+&#r_9y5kq?n^Nol)v9&ONoh|FH&KKg@l9o`P!Ud zu28@qK$~AYwz@Zn0j8S=+?t)89Gn~5|KZ6rLci#HJS5x4&B$n$E}Af!DR^Uz|FU^^ z@eYW`ge9Hq0r`VQJjfFXt-=u?gcALDpod3}8Ekoo0}`9wBqB8=2*@O$wc(ta+d1&$ zB-(hm+k{I6332sa9t~zS5#)j$Ipzq8K)~0p%LP6plXhhZ5oF2U<4O~G!_#g^o;iDa z>HZeA1SQGDigM=^Y53p^TeQNz^)0=3C_)It@A2x1QX6o@-*2w#~4{^-fs;D z!Co>3*zsrSz}=z;;yV}9E7nR$z_d6)WeJtE%UePB^M6U`MJM49ib;I<8Sc8(0g3FI zz#It+stU@)OL)Ku7$Z`a4j&fU*mN28r$NQ6@9^)i?TmROn(bFwwdX+fF+z>b220qy z#OYZmt;5v}*>W4R%$mgo&?ZrjhuzX#!dbox{jsJQTmDiIWW zv=^%Cjrjy37-2xGcTcoQ({Ykw{1rSx~3vFyHl6Lp`di6N?lFwnZ`!;eS zcl6*$M+iC$piMX}ae4h#OTdNqta5N0+!wz9Kd%7>9qTi*4Mf!C=_b#~0xt%3FfkGs zdI=xOMn_hJI)h$3qm|VQcx`yFr`O1`4MrRnON(JqtBZ4k55L{yGkCQoA1H$$!p6Nx ze)OU(_9WX*EUqNej<&`}X~>ufYfEZxp~;PI+)`6(!QY~lD$g1U7K&m`Fg#>4GZczC z@WG``7qUSxU)sUIVet1?`Rvj)wE={*Ap1E&QDcm+`YEDpHw1qQ$ z2RdHqPEa8UhuG`4-B(T%q~6|~vQ#n#LEfTiJUQLMx(DPTat%X#+n}6c<3nuNw#iK2 zdb6{Gd)tr#8>DMB_HGHH_ZwZ@QV`J+lBAI-G4&aw@rKXy*!C zGR@}_yKmaFuWnlSz3^wPRPt&b++NwawrEaD$A;Du#MWOrbA}TY049H6sw6Pgal?*~=$W&skzPe_iN}M;s zm(}fhJb*-{(e9|LYiqk5H|T$=RNeKwIbXiWe>my!~DwtxrJ2 z8rveiVKgBF!?_eFuQ%J$VlP>4AU1IxX48Lis-P#2h16^^$V)V-ln0$YN|-EF=scTB zk5-$7adkN#Yd84US5scPKdRBf;nK=ka^dUTXxNl*%=+zT4-xWEZc2kX{;?vs1(B z8m;_c$p0}(o5NuVxlu!GK%7RtVWQ@>0ab@i5xh^Z#-vlGn3_H!zGIQH6ev1FcQT+5 z(kN_%ifxlY{pM`HZ1mAXD0-Y#*b@HO$ZxyIOJ2L5#!^e@^TPANxc19|13?t)`iC^J z4V^Lu#|7`B?ZZK>q4jXELERdVDodjK$8%^ZDwzK3KU z3VoIfWd|*5nk>ceUT%3ljERp~j>L{pKwcI=kyR>4NP<|_shQG)=#Mhx$ROo*_AXg9 zE~}JTfH>G&O9JV1UW8i94$bEH@TMXG1xkO9ux^VotL@ZJT5AO5P)NEfLb?~OKw=haLH0^CvJypK!b%6tj0v*1P`3K~ z^o%FAv(7ay%_n%KTg8+8_)LEfSz;))K@EGzS0aU9Vr3~aN|BVKRQLtB&jQIj1S%3z zqpt1m?X9qPX>@vCJj2jH|6|~5j`TqZ3(%=0U$7J!@xPOp+tKk`IbKpfe_7h>%Kzbd zzKO;4tV{=R_POQ1?&fqAlOe``BOad@Sg+LJ78DlzqXZzM+@7k`D}O^V^x0y8jS9az3U_%+A$W3pe7~TcwtPw}f7W%pWQK0*xH`=bDouWpLhB z*USv&u??4-2JHI!WqRob`}`s&oF(@9yfFnvyi@d z#`MCtWj}x!=hhjPD`qb($L`8As+!C`61JJMX3ykK3s__&5$ot?`l5PqU(r1!n?k%r zPk?Kq2u-HJpr4#f4S?q?=McmD*l}v$^U`I9mM&-*_8~fHH}mTNbQ~A@!g`1Ar?W7; z0Ju~G#%-WKLXa^8#JoNOSeNk6kk7w*Dr<<&ARK*#*XUc=Xmv+1VQpw=kV>?-H9&oa z8{Pd}NSD8JV^_tfv17XyAe_P;@Z(LbgD(MpaM1A1Nq}9>8HrASr38>d%veAg=YRn< zvIE%nL-a-Npxm~3I&De33>Y|&ax$zTgk-0sLri;m%l>$+`C!Kkur^yP!!c^*Gb{nT z#4mLNcOY-%XF6f~<1DO*a(FvY11|i)0sljb>S&3a<(?;Nr(tGs_jy)S&p7K4&B%!m zQ@pk~JDHtWaFldjK$thpi4l`UyisBzXqVBb0?a3h}PG9R) z;b^0{9KX4i+Pc>>@(opkq)JA(_oqc(vBJ0wT4Sg0pAmPCFFCDMu*0}TIUOAx&jDo~ z1aqd@4I2%;W@B9PY)a>6$m4)NCo1?}$vv0Xd_jH}D~zgZ|HDN8|3hSy0r(&DP&z>R z|M0l~Basm^D=YJV?P=)g=^6fC?o4kf&HuPlLVb2U7DaFM;|H5TB#cuo}J$e5o#%w-Xh+Gp93bo(I}n_}St3=l3%2s5o0fmdw|`RbKAs zPw7KnCP$}dHyPc+JtvoAH40l@OQ5|GG`TJ`Wd9s11A4x3NgheAQ@_A~P_vs-0W46u zeXBo>DBWs_ynw{N;C79b9E1zmU^37I@4-zF#2NsN8v@G!$y!v|)^96YMIVq(SqMg1 zFtr>Q&wmE|P*Af^R=Ka2qEQQPsNgLGBzsmnGj(IzgSNq(b-ibpMbp3^MWjx>zXfzq zU`#f!F|Qb3a^L8~^B?T?E`ppfPi45w)pd!~?WpajOzK$shg|opbiKZ2*&t07f!Jza zeHEmYzHluLjdaP_<37Q#w=_GTp>+n#aQh@}I60yHKWqo1k7+oIhVQFLfn$Xsx55P1 zdCzN*`qouHmcLt~bvKr{Hzr5KUvKB&h0X7m8)M$k<8QJNulo{Q519~8U+br;-q?=! zk{AwhxV-z}+-*OQ;6hKofA`%t?bUjBWo;{I3nK=&tE+QFeoX0xtCj60ik0=9ZS~8t z8@F-bO%WxRtD<9+}Bz zMHguTmg>iW0@0;ICt?OvN3&W*k0$k!0k|R*V;518_iEBZBnn#cMa0ON+kIZqy||OY zYgmDoV)IIQGgH+{&U-haqD(mtMogJAQsC2-_O@Rc2o5B25~ttZ*?sP+M1p(xj$u2H z)wqHdHR8GIir*R>{_%+mBNZ)m1YJZF2X3lE7eHZ6E8pWPv675Qh9zZ2gSQl8Z-KgV zYI$Ze1;NQpyLc%FFU8VF-TTH>Kju@wgy+$Gz4)_K2@(d($vF#Ixd9rg0Yk1O(e|F` zM^TixR6WBG@v^L`66e(fdLEx1cN#_;UoHWSu$Y#8Dtl%SKsB?+rmof>ysv zr-e@1CeRAy2-Sl?EPosuYOdb4fIr-DxJz^4K)}_4+RA*53qJvk8vUU5J&IK`2@FG5 zDd&h1m*Z7T`xdxs3=dcWWo&t0A;xv2F@HZr$rcZ6a7v?zpGB}3g%@rgGe6`#z{C8? z=y<)xA*%>1kfo`W@UZ9Yv@m+8J`?;!fudZ#Zk$;J30V$)y{&lK#iKC7?0FetVO77*?Y>eKC5gfUfsxpvaz7J3&l=NeufV{^tKT(yT zRL9I}_MdN&y9bd%aSFBHC`M~)CYHinUde>u{?G*_^f`*siO<5-{PtO5wq2(F%4$yZ z9klb@`}Nl^rRcztgEGGEj}P8UT4CoRC*fE`*)Q{Z1A{met1X0PI{fBgpb(FEX%+|s z8O|yXeg%+Rh;2S_7O8|N?OblMF?@(m0(*4mK|(v!0tcopZpx=IrK6cR`>tMNTQv-a z%VeU!kGzktpR9^pi4jGQS8V6QS4vihT`EXyHy6Zv!+T%@2pcTtRUCKP2b_=j zjR_qMSh;y_uemLKm^_6!l=|k^={&nKM1Bf@|0(T-Su!`-)Ymv`rvodj`q;7hm$5JIh(CfQczUyC=1I4Wj@j9N_&f-9{O_GU)q&=(c8xa#qNQz; zW4r{`^~MBc#47HfEw*|4Kh(C|U&D9+`h?X`M#Gzj$lMWt=KM?DSDb5>q&^d~V3B$O zvmMo=nu?d3&HYV<;MAFh-m%lI+CktH!O4~umfl^AIx1FkML|PzM@!4R@qc8E7f($K z7u04J*4F0F9_Gb5x+bn{0md0!#pu-&lWA>JIA#{m{(oK4lW#= zoHIyvn2W zU4$@*59l^$I#&aK{*6MhJo?A|>yl0)e?d|**UZcwtByw}{LqgT zoPaah`ZLa~ZHvHqK8$@G93OJd6HR4!8JRY3%G!F^KE8q)t9rM5?zSpx3D4OIe9+}F z`~IX@_7HAJfvPmQvFp#tfyTIfa0oXSr_c}k=Sv)|k4 zy5G|`A(joVl~6bK?$>3iWVPc|bTM5+M@u zJ?`2(+GM|b_p!b1`uyh3gImI74fXstEfpGuX(WV!ZX~GmVDI+Vu0nV3M+9wbEh3E{@nzBe}}mSS_!ttlTM8piD|!-SWQn;_6CLRAHh2 zudE3SmsoPKGB!p2nfRIn_4GdtcQkI-NFlDE@7wvd#zrw`y_POp@Dx1sg z>EZQqeHZI;QLEkYc$}F^qkX~V{y8LmhdU~Z0I|Cw=5=7_)A3t&7#;G3A=`xL~<6`41I}1uA14yPH3BF8IkyHmh&Sxud zdSw_uGfs{d8u=%a4Oc7Vlu|;(O}9_|t-7cp5EI1{ zT;WClbmQwWrT0txP!DDv2vsx*tE)j=i=qIFW+0^m*l>8!Jg!#p{2(qWBK{!d7IJcO zT~*esuvW$q$Mvh5!s2p$x=+8uK*ok_XmAX+rHZ_|r*(;{*-NRw-oeEhm`DguF7Jrx zq+&vFXr9$RQgg!fLuRrkh-EeY^{@>0w1ChiA1{AvuZX9rg%BEo)5=XKHdp{cUJt*4 z(9=MKj)y>eE_V?oP*MyF@K+!9J?wKW8@YmAYFg{0v7en5*e@hqgL zxo=FW4-qmRXF*d9JMvA2k!;xYXkP+M+b{5BkaDz{$iY*El!fG3#i@TF%$JO6y+zpz zC>RFJYu|m3k4Eb{H{Q2DCrJ$Qtcj{R#@x&Sm%f+@7zrkeia7gd1Dm^t{a#O0)B(5S z`gar`N4u>|wFK7X z^}yy!6n0*ADb_(=sw89(1jUvd3|2K)L#C!~GlHm0PWaMcld>tDOL%>G=FGM2RRIkK zwcSPec|1z>GYo{71&F~|(wR;mDgLWZFqIaH$ zxF@#HR0!7mi6Tk>?zpp)p5C3v$e37tbyYq8?6Q4#_Vw`aQ5q{60tyy-i#po_vZHzr zh-s;6GiJr|`&%Yn+vq^Kka7s$J3>`TQys0@XF)}_+C%KOY-to*q(e%4WML8BCH#%P zbaD2j)}1nzm|zDD^S@|&2N+SJZC$r}b+5Ksn=GgV`b|NA3H)($}zk#?X(!!2{I(CxU!3vc5sF>pgGkCZzn zUsOhl3p0)zmXlzwR~gtbm_ceSlUu;mE~|%?)2ddGx7j$@`U!Sw$ z$fXZXE6wb-COiWe;%Sy!*b3(6mh#b6)J$5vEd_*3q%GE|P3%+}^_FGTY=jrg)iTZ* z3)Olw7H5o^g&octu-+Ig=F^X?DGUXuKVjWQ6m~Qk1cV##r_|I?2GN*Mj&h%m>M7sr zDBru{F$}sCwvas#!#>Kx!a}!(Fd8PSCTZ|Q#HKbp1wVALgO=nCIhMYJPnYU!?R>X| z*{As4RnrTJBS})A3uU?0%i4tENfa;A0BO_gyaPGTVE=W$WKzOY7k>u?se1DD;le%hi>Vp>S>UGFDBs!bHYrz>ELM@8N7T88jDnsC0%+2*(_=M zIlDB_Z7wMp88>B0p8y{()`aDwI(RfM9&BPUy9;DYI4_UUUHGCr;$+R&ATH%! zHdIafRy11*s|T-@QAgT>l%wVq8n?JzTZ&P`tW=Y2lm99l84;Amq-4Tifzzw}<;!R* z^KLhi`yBGtqeh|isnI^#Lo_RHg1Kbkt5_@C$tbYYQ%t%O7ketb1}CG|FCLL>Xuz=E zutX~$k%lb$jNhmu#t)xqzv*vG3fg6PW1!9Rpr?9WYW?4DSYdWdSOX#`Gq4LYK3F^Y zr94?`j%)0)zNs&hqs8{;mgjPcaps-oONu>;eGahNq`L8Z2x!uu(=#R#jyjHbDA|&Q z$9)gI#vj~2kzD=W8UZ7nBd|XdPlR4eCd2JX8OUkWPO-=^w|#kwIhy&KN!(#ecRQ)@0xjaO1E)8 zzVnz{Kr1)>h+k-Amr&!SqVOZuPMqG_l4Zl5=jUK#DeB4lK!(XmP)vW*bghGukd3G8AT&_<|LLVN=cS6kSm-! zgXgFqYO7?MS}zQMMsWxdvbCQx&F+vRJ_b59x%DY!P)vm&$B9!Frg8;IkOd|(AdB68 zNMgrGo;I*!&XG7Vm!H2yPBlD0WbxHAu_b0oP7z5lh*jc|#UF5uI>u*7>9W^l>OKV$ z(xvYtgtY-@L`@I>s4Fh*9N{{UjuUR%STkbuWGqRCF6bnOZ5e~7p7DYk=q#gl$7g3r zD?;-__xO=6gBek^qUph&1Jx{85sV#n4{0;N3K$|$n?m23najJ2qDtY-Vr(OKV2DH} zmFpKS$CwujMau`CLM4d=Hp?yLCc`W9f0f7DNe#K7n;0$_VI|p#4XL4*7-q)ODKw8y z=qpi@tE7(g@UL~WNV;N@%#&DUuYd4mkXV^ritnqs*G!{jZA~?DCWACJRD7cBabTy| zZ20o0kZ7G)d}o%(2UWw!s57|YIfYCvaasPQ0132|(RKC0a|)%*lQrG!&Bg2wUYl`* zb-`rDT=Sg~E||>ag})&)OF+|Z{y1IUq9=#hE%3dA|`N(;dIXJ?{alN%%7;3eh2Eq zIDD;@Q{yppo$0XMPy&k+&IdU03wG~B&=5lY0j5I)RtAzRjuSHWdv;|ZJ1ns>0;m+_ z8SCXP)tl-Vm^3O^3oS+{UwGU=&$qlLPvM=FT>eW5)vgRZCpBAayl2?x=+~GbdVF=;zZ#M~?urpS`~M-R^1PCcD3c>zOX)rHvQ1?>%kqi=H9? z`3qYFpn%zA7hK5ZsMvj*YlU@P+59%fNWYTD@aJo&2xyROV)CQz-zGHiT%<@{{%)uV zSs07IzmQ3*1{0U@V>E!dT+kud5U+v{LR`21z84sZ+<~kyjYfM^U(BB(2<}q33heek zI@sbIsi-PALUcpO^iF6Mc)~vQ-cvXmpFmys0^JA<+2dOa&Sv?NjDjc92x#Boipu~F z>9IuS*|<0#({+~Ua-asX-pTa;UV)A2je#4*Pd$#%%|>i9THuLEZRrcR0Uo&_*Oa^p z2x;}vUnscoIvM)fDtULzxtjl$@V=>L4xC1?<4CHh+L61OtbjVsCPf!zPx)^6;690G zxw#j+yRL{j;ob}ikN45A0?R=rQ2Ak$Ab*v78aBmMqJ(wdTxs=lxIl@mxBPAa0cr8H zyGI3id;fra>CD!CJ|4`L!t7vibgI5Kbzxg#Vp>|YVrpz3(=?w!J-usk`>Bv)2{{I1 zbT6Z!9C@nEG$`@*K};|MMvl`!(o^G2vMGw83`AzpD=G=iHfV7RCzGK&7kl7mab#hF z&?X;A;Zjt^695E%CE;THGa>=eqqggC5uPj1Yd(nWzsz|BZ-{`>S$}=wx`Fwm+bP)H zoboi(C>0eub3~XClc_0Ef>3CUD2G-(wVt%YTVP;jv~?6Ec-ZTE@Tgk36q_HQO_W@D zmb55NsYlZf<-nhREB`Uzk0aa%{aX$r>LSsQ+dpHklLf~|lbLbkae;6d_cZ}sB6>7x zVLu6z6a;f6U5fWWGb0<~HU_YFzNn{qL2wQuN$Q)9HaRKP3UQ5r6OUOi^iiz}YJ9^V zjF5Ds0g#Lcl2-qfE;Kqgb|NV4P<}{%V~Vl?UBcNTReiOzbN9i?b%Sy`8cZr`#p|$s zH^`aq=yEr1*6s;AY_M!N;cT5*425eXG|sVVORxdxlTeRRpTpU8DzPX+=nLI`M%VnY023!}J!96jlWlxVeuZlc__Rt*1VsxRap zDu@@`yen(Q6FbfD5#qBelt21@k(kC}9<}4 zIQ2;FCMi;(>%ti3m;9q3Evqi7tu8m6RnghdfFRJhnP&D|4NNqYC6mdJ3XPC-(6(z5 zC8mHWnjPgD1rx(BK>5SXC#wU7vy|@{k!ci=>Os?4)7sh&qY@-zQP+xyBxO2o=&)kr zF(X*n8s;0)7a|3=RcNE&cZF)^@p3pumrjwAS(ti40Y28l!vm6wGdmWv1X>s?cvaCE zf=N~Q$rhfFPh*!31KP7)1j~60HlcB{7oo5x5+RB&Jb9ir<-Domw!I>P$e}}$rV$a^ zJDABC5cC7(BPFs6doZs0*~W>iY;$^K5jhjJ^499wm3f1L`3Nnh*sg+1BQuVcH_g(X zwaa5OR4WJj2GGWyZK08b+h*OfXnuQMox56Nm4?Z%GOyO10QJ}>`h+Ys%E`m$Z*?5W z&%o&boMU;4jtmV;VdSdjjjK|*9rp&)UcIi13Ns>9FD zGaoj!-k<7lB0Dwcat@Pg+c*(1rDeiw6(72K+K%mIgwiOS@W`}^FoWqkmT{^cPph{e z*+qw-*Mts|68mQYhzqvS!R-57FL06Iu1h^=Ck*E9LE!)gV^$vCO!mz1FMYe7befA0 zP9u;>sy1{aVrJhpWfjaS=H&R{X&tESv`kLKPS>x8)A=_RooqKd)04rpA2^E7<5*Hf z<(qlrT8x~9Z#W1QlhO(JHY{V!!h%lzaf1*hJM>`IBo#Kbf_ZvVlXEiMz1}KiQdwnX zeE&k@8XL#ihV1?s=IUdX!lm5uLv`I6bq|Rw!*`V1eb8ID{XB-3+TvDk8Da1oWOK8; zgjiY~MXla9d~h*>%$D3CCF-Z5Q1@gBM(@!Dqio8eD724T#`-7Bvg2;wB*n?})R)bS z&hN{7GEklFloy@*54G&fgVAL-`bk6_Tz)zkg_C19YUHZ>(gMBIICKt6qN#WU68zue z-|fsUdz*(o4iV#tAAp$A*r@R=tW+X;(6Xionl;1SRi#SM&PD4EoSDPK<-P^jl zZGQ=5>{vReHA+XEf}HfCd}}WV2oO+l%K!~$D{DgGtJI|$IsL(#(^w4(rOt+m5!Z`@ zdFDje4Gc)Eq}F-HBuf;A%gPdl%;umvKCd>DOiMmXLfAZ}xsErspINuB-(i~81-zVO zYOKg<>@2JAB3X0R-h&u=*yS6mD@qnS^xBI5W)|=m(TQ{ePprnJ+^0->FQ&soYPVt=TGcIB)2Z4pg6s1Jqc zJX$dses5awJA>bUAcudLVa`&wE77JFX_`Ckb(KbncWfn8~% zfYn6{#swqPwW5Lx0ZlkU^QtTEgEeHj>UHD78AW_VsqHB@gHZ)EVXMZ{)DG3aQ@6FZ zN7f%|Ra}e&axScBm7HKPUmmD58qj5F&kwes#!Zzx)#1kseGy5y^x(BkFE~L#`py2f zcD{^8BfJdC>LM7KAOa<)={*I>`oX$p4AzaH%VDuisN7`$*Bn}zQb$LV?xX1-CKQfT zGrlw3tgbT!QWc)uE(RPSJBr~bo6n_QiXqoXPD&=B#!SD%nOR=mV5*_Q*)t0=v*#ejl`R_EP*c2o|y_R}rdZP}*0%mNzK3$cxN6<<)u`Vk zB7c$;9ljb449TsWo0+WK#oTmMy4Y&WtnPcYqN$3;IV8gGE1Qd*x`8}!ea2|5r{~KL zg#{c0JaW|ErJ|Gzl*|u=74FkTYXBc5sS3Zuq~|MAPa%GH&BE1}g2@FRK#kkmM@C~> zhiJrTmi3&YJl1)1YPSqp)k(BX9X5rAm08Ru*WjRIQC7>EF@j7R;7)zoR~VQdJv0$u zrs*1;K*9=#r>M`*mc#}zu_vjQ9Tc8a=uE7DkX7u?XH(-lP)v+3I-mt~5O%SI@vw!& zi7e46 zhL-v7Q0v~o3q_H-N9!$+BMU7i+D9Wdy{9?)aGuaEp>3EU)o@_?T|nKxRoH-@k*L&o zobL%1{)SJ$_2F}bbP-j%Bb4h<r?Wt*SBz9HGn_wSpD8f4QpcrAN>Nt%0T5)J zPdj#V8Je**wiOcP&dIsi)37B`uD33iaM_Sj#nwara8JJOdmhe|w?L5{Fimy}PHaL3 zj;}+UKN*X}zr>S=J;Q6%Mxu;u6fT(#3sQyHH zcw=8NS|44qj`YpZufWd^%P`9#%aDsoLlN#o-6=TC-(0M@u+U$=9Z7YOeh{-jmdUO> z;_tsOL+C5)E_*#O1OLLF1pyDE!3AJCNf>2=WH~;;fH3g zg+Htc0;miikyWQiZv-R?%0=vh^P^q?%K!*8UCIkU{_y*x?tXU4@6ohfb#ptRugIZF zb(*qH!%ml)u&)Wuc=gviuBDxTf);!Q)S=E{7YbCM0P@~7l&=0ButVi>^n76DVn#U} zwte*MiQcZ$nzp%)xwGZ-@!NB{e@BHv>2baEJo1-6x5-+iXJBOD>F@3o9`0GNISgrz zvgYWBO1mccWNm1o8GFW;?G-u}+9hx>@@FLp1ZT&^zmM~Pf8z@b6aeF@%Higiv`oWE zFIHjSzAWS?0pDG|w37Szl-P&#pUQ4kntsUNanSKOg@nWbbiT3cXEuikO`|U^#Ui(;r;O!o@#Rl+p^-C#X3J{7Uc_ zKV}D^4Z@x0avg)o-y=w3%geZm35uE(Ppw`-MJym`7bRuuXeDmbIZ_l%^i{$qE)Q}8 zU=o011G?J~QJPl1jlk)Nj)z^aE2M3qNL6>dOW(1~$!`>0fWIKGcK;&p!}{;!edyWP z*#1{(BO?Pn?SIYtcq)6yDjp+$du_X1U){wE2^r$Mv#8M4=I$Z-{Uz@}6N(KvsmACS z_um033Wvp*r)6h$_8KUTURf!x8(3hELMQ<(aD|bRPdWwuM;8Dsk>=(A9Gl{yisz*Bo*%8dZ35AM=^4U4W6H&ipWH=ZHf| zq5S*fMxS%gf^c==V0&i623Ls2sHmrGi>@fkQw?;~B15Ih?6jrh<#pb0-z2A z3)*)9F9CqzE{jm|2*4!KjTdk24`|>{Gid{ou4uF20gOwch7D?B5X4xO3&dDu-Y+EN zK#0gB25WwQF8s-CU7J{29eA$iEc)&M0y(wFKCgl4h-EmScQP>NJ~q-ZD2+@qHs&je z4!g>NkMc*1@Gv;ETqV(DyJZ#16m_3oAy7aI?noTcXumiUh!bcU8`#d*5rizJ~5aKf2I8+w95S?DvYu3{W?wf^oW4_yB;O^vz79$Sl zrlhTEeaes)(*wDJl-SB;Q`_{zef+A~1KS$tSwUOswGO3uOn6iK+-{@*VoQw-0v4mv z9vDA(CjS~zy4Bb$<|+7=_JJ)+{FEzylj@YJyP^%6GywEgZ4Cads9A^+c26@klwpi2 zCli5mdIWmd<3JH=45R1_1?>ZON0>YpC5>ZVkj3;4uUg?#>I?*84L+|7WvYK(P2r4g zxwUTV)3m0JIfL=4oSwOsjZ|GBTYpuJhHktU`atk7Jsw9ouMup4(@#+2rZ8ksL-z3d zjO^;`K7{ek_8|cYbB!bF>?2_gAK%Lsf|&$w37I}cehVIXNCTT@8wAMY$PoEun{AFU~0ZG!7~d(pR(_j3 zGslo26h$^?sV=HA>e7$~ek$wYj~r|VuTpSXpWDVb>b;XE;dbx(E4O#}^NsddAhqN| z*sgvsDf0awf1PUMPtADEOVSDrOepm%;Z|I0B8ie{MbYFO^=Yi5q`S(SXggj^!u=s$ z9C1$KH-QcVG;>iZaeBFwmT^MS;$0h2wyB)%|$BMGCQPvC4yQXM+nC`ENr$`d}=$-2y80Y+X ztAC2aIVCv7u=gN})U3ixSawiTPTyZ6yQ|2(Q?CLoF8tkKj8GAVM~>By>Z5IcMUQA- z8I*MfOu|^fdjf|tCyEzDHGhkCN<%(t{; zTc^9VPVb+1loxvxuAXLUD83l-d2cOjko_zqXgLhl7pWJNBF00A1@rU5WijhXafCP$ zQguYIG8oCMjw3t379Y8-E2$@>5vzYB{J-7|+ZGXW@{8UX$+W!A$}9zxKMQYo3UACH z%EWOVXOVOUq}&$f#j+*3k54b|9bsJQE98CsFDM7A$k*Pfl}_~`$+-ruZOgQUI?#8= z2|5#T;P*sp*UduqaJEk58IKe;)JNNga@UXZ@7WFVBNq4GPA(`Ng@@rV1u~NhnO*7& z`BC&-<2h;)`VmCb%$OGsm*SOD;{1u{Hon-a^5^!Qi&ieTE-0grK^N4a&m5_?;O+SA z{zMv+FHOYJj>#8bSt_tMxcjenRF*!n>7OsKe-p$Ie`pg5`v>f`Hx}k-Vt@I>!Qg6M zxP9qagoCw*&?rICp?PZ0!YI4rG_OUqEK8WoXlE<$K_<(dTn6f!HSy2Bpwx&MXpk1_ zE9xsQs_1l`F*9}>g`*Tnt6&Cys6RNPs9$?>vJV}%1iL9;TUG+jm=85PNeY0JGvw^G%47A*0%xw zBj%R;#Ht{)k73@***wJAfYPA0vZ=|e(ol@j9uG-m)V;1ioFdH^`XX3Bt3*x%m>z)< zfxes|PaZL_2?0SRwpH=eXi09Sojl(M!0xIF8Pqxy(w0wc3zLH^7|Zp^!)E*0?J3H6 zYl^cYfu9X_8(eKcg+EC^Nj&gqDR8NiwNaZg=Q}5$?}P=5Xfr{tz$`pv^0t)`B}U4| z{uxP9HBC?2z`%utd8ilC8WiNR8%4EIW7`%K!|`l0c-ptlj{r z084lvPqx-;h$snNHSj`IInFndML_(|PzCrEQg-y%Owv_v=)2I2gkI% zTf3LXtvC3mOb9GX{)z2x=|0xL+x=(^&KTTkU$6U{D;>y>6oVtt)H}j92(K@Wc)b~; zI(%tH`9SKZSREN3F8)G6w-X~7gaaGIpSN@PhvKhE@MJ8rRBsfG*n4?n#T?3Py?#&W zIljh;Pr%iyw=>E{BeKs&<`+MH9t|q3_Yip(M+MKChq4cpdrNJpOA6|v3~xm4I^6y> zghzvW$BcK)r`daRy`VfV?B}(TkIrLF`4{q{kHq7$ z;Wv@6 z7<%K^-l+nN!x^*FK!DU0nhfQhP~zi>_v_!Y9rRhoa*bT6+t;V2 z#uc+edp{>yc248;s!59z8k;a6g9-x5f_TWWEW{I-IimuESm~x+5NwNzIU0?_a=W%Y zXwj%<|F$jF_UY(3=n*Wd&*x}-t6i#NT7xPV{vn(>riqpQNUjOh26K9YM|SF+c1&A+ zk6Jphp6NY0)d*wa>s7MLPvkb*BF{JDqwF8I5QGpfcZ8{r65hCUn(3ca&!6v%vKfew z+^ZpRdZWNaI1%I~Q4jGx_?6}rAgHinnWB_7f$zch@&WNJ|1|Bu1`q_`W>8M#U;GKM z{X2gGbpH)|vIg)E%~Tyg-T!ksR@#4OIz}e8e`==Kn3(==Y}%u{6Udsx@V$w3f< zgw#MfA4@z^WK&g2~z6>el)y3kiT&a1lvNds~A|;J7 zrJ>ROxfau=xu-lc9d-Q6@#;pU9C3Gv@=a%h=Z}3rzC^9EwPsGsXcO=6OKJhW;+*trXReek;n3jk}kr@h~F)A4w|w>I|@kP&X(ji9_O&9+B(p2z(<4?v2^ zd0(dFX{i;O90~w<(gkuV5Wn3#ZaZ2pB&f7o3vaJ?>~|;HRs+xN`!fKdg%93Q5K|go zqJJAZGS{Vk96!8V$N6Bt;?iWj4+V90Hv^`W72S(Xc0VxGgiqon)6Mz|Y^*t+_lr^%TzRn%M5z|iIY8^M{2Ma# z+eh%`?Z+wu11SO26;rjlO~jSQc)RUt!(aij?dqE>oRAh=FEyAfDPjkEvp8p=yMHGD zfAUO?@t2n?Xii=jFGRbpuhnS9K|6T_e_}`22hhZ|LMD{3*9_Q;q_4^S0saj?Y-2*5 zCRgKMyoHLn1l2lrW%QdPZ2+3<-AhllG!ngR5}v@Yjk1m9?|XXAe}MF|=b0h+bW89( zlR^)Cw1j(Wwg@?(jwR%%)9(#=#=W74+Isen6E=99G5#k=Z~W8g=US!EcWmy%9zd_F zge>8Dg+IUdOQfY`vQiUcqGFBcEgazWXXOK~D0t1QxpofG8kyRix8IjD5Ii+&(>V)7_1d)EXtdr_% zG9k8Th?}x~Cl)2PBr;R6C9HsYO-kwehK~X9Agi>EmPWoK^F)P>wYTHSJ^!XoBI6s{ z{fnrdOMZxoOic}vxHG884)bow`>p@NfPlHENK){7Icg?$W9`ENm%&l@Q+C9EvH!mAzkp8 zkqe~Rh|D?}{1MZG*D@6D-hmY@nMIi>l~1@0CF#BsjNz#RuMN`xB8*}36I$w!uDGo^ zZ> z7}`vMsM74djqLg@TH`cG=`K=44qSsDl@!`Q5X?hfU*M&@+S05ax7^W1tzNJkBV_aX z5h(iBDI^{8bo3j)v&ckT35~DeGA%MY@+XQ8F_NYJ*zl{Sshb5zDIe6IPYnQT2lZ0G zg-$L^61}FGU;E%(7AB?wgB(A66?8t9@=&KbaYa0WF-9>1Booo_5lR+ii>97_14mYN zvWm^6Vna{Nl;vm3v&JlbPgdVv;dfyfC2!e7mem=BvzuUb$@9}2)pWPwbOE?|z5j5z z@EGH0JZ1^~G1`-qo&5tcAGWyBl;$WLKPTbmdIoSW(C=WzPW-&85J06^c&4tt$1MDnwI88Ck|jQ z^ykuxe)ta>-w^W$E|H~N;7VDbs(39M3QDFRs1EB@Z$m;C%gjlTBK+tJ2tS<8^R34_ z?dOMx!>;oqZ3i2RjFP_jAK%my;N}?!a@VyV#*!xI;eEzg5)XCpN5HYq-O>le)j5f= z7o?4cb@$C4oLUC^9+w$n3TpD`WDl?xcJ_tG>a;L_m)2iC+UL+tL2hAAk3#v+?7K01 z2XI)A;8uTv8~3I4)k%Mj-&xU1?V4HGpTK&mR{rBc7EbNr5sTrwVi|7NlE(uT0@w`{ z2~#tC3TdvLYTYGcDMORZc^Z(zJw9Zz@@80NrI{~V7cZ;S6iZT7V!tf(1BuJp zX%CQF9r~2~G?BNEuE09+0AhZVttrRepI4&5=pEUx*NUOK2`M_QoVC8zZd#(q<3XJkDSgB z!UlU_q<@%kHt{cIGXluH-%(shpgRveNH4}_vq0-%RDxAm1vO!Ml{O~Ew?BFNUzRi# z0eAFfxn3r}544ahGM!05Eo8F~F1g-LcQZT%Q0(Sx8CyL3y+Ga`Jp34Y%k6i4r`z(* zjbD}RS(ocYhT`*zvwDtg^53S1II_9u8(*|wy~pSd=l6`naCF&OF&kqQeK2`Q`QPve%JCX@1tA%wci zWOmGT$|k1azO6Kza4LXw56O!{1j$;|@*fWm{TxyX6iP%*KX@or{%Lk?OGRuabHgfr z<}EWl)eed~pmD9kXQDMwnMSN{ju=jrF@c8z$FewyKq%Hqn` zP2cC-5Qg(`5E_G^FDbYGkV|d%cQY`*^!iz4n+&5_{#wZd9OkqH^{3MVXFi~{i3Fb7plc`<6Pdg17&bd>wY-*(St$y<#dRrYSR;+0JdV{Nqw&{muFO?>WQ`yQH!l zH$DDV%_4!a4l&u1&!WxtG8QPWRqNH3?I%JLj-%6M!!y>CdWX2??08uW7xQp#+0=^u z7Bgw6^zjK~uZp(gIb@xumi_kfi>l5HGAPHN>*c@i1d4zYgDDZ5A#PK>udN9iNGy|d zSRxUG8tM{CQ3)-|A;^&-$dpxMXb~5f5=yjQ6_6(}z z3zqbzBKMN13OgvP)uy(u^ao6^uG$_W9#f+sb8C_<1%nxHSA|qUOs*oMId*u0 zB7H8ORFNFwbm&qjVlUzD5s|Z`p!piHw07CUWkzwPp7ouXX=hkenBS#K0^o)MkcXjH z3XJ^PAShBdql}ad9wbd5)N2@GC?cq1y%8L;6Jul2jBZ|mSpp5P7jkG+n_4;7d>7{! zH9xa1;yPGVZ!W&l*RTsJF0U?Pf7BWYLB}#4#V*^<{naB+T^}haMxCER6dud!@6e$- zrqrhOfPD!*xyeUze?{7c1XH6k&?2?;IL%Cn@>d_3{I=f&T_8z3ji1aQ)UbZQ9A`Rs zRyifJK~YVW)&b69uPmg8ExXdr-|fo-R{lAglTXbo)t`}V>>VA2Y|NKIAR-<J}T#3oUgTHe*domJKCaKIsbJk3wG?nVpvWX`PW?-O%lB=IhG|>}%py!|C;6k0Yy5 zh2-z%XDkltdX?VE3YfOFIE`kq=(gSX`MOQ;qSDFt&^o&xQcMU9mBZ2+0U{jq%gM>I zO+FqDt!p_RU#ZUzTfq*)Mdwq|bl25i6Gnt8sG$&L@W<0~6iER{D}JN#qYN?iL2-5k z<}=lDXLniw#mxDf2W5n_L&*!ntKEJnp*TuLZ^4Tr=e3mnmF4^fg}lRGHQo4^MA_@i zh1GdqEiiAkC)Y{YT6)W=0kn*C)3}_}(SeBg%s|v*?f7_-K2Mo9vs( z5M62-iU*r0D>{_;6G>lKxCFQWm;mh&b=3N@7>|6Fbz zTo;S>=icSctI(HaBN^7~E0~1|D`>4;6!Q#Q7I?cGo2ctllQNBW7~MUAB!N3F0cohf z8==sEWFpQYmokoVk~PZQ?ghKAU4YK5)Q_%7X_I=PThvrx?sVjb0C0q0{^EPxuH||x zn=NlG7eq`nASR|5zaiRepmymbyLb@qn9XPAU`TFW+ZKKI1TZ+vhhg zOjflpXh;2#_2sv;AbZ9xSNyaK38gAYfm5p{_=b-v%&R9td!Eep;Q3U7JngO^2NQ) zS!kvuK>h}1Jd>mIE#!UVZGPdrmi?yr1o%mn%L6K%=ms<@K1Z9p8Mqiy`v&%j;dM*e z{~i4Kguw~nVh@uPk4Va^zGEGHuM%r_0(by8!3Hm|G2;InZaEM@{#O8#JGNWEnfG@k zKEuT})Je_=Zw!6_qey41H!%8*)xgf@h|roWmvkOXCk%%(u)TyFc6h=03I0^?uPr~C z9T`y^@OYcJo*DY~knAFdhZ1__qa>-Z>Jgj~w^!efPER((F#1O16?Jy73q34TG?1!^ zP3Rm_T6|XE4r>s$207mVKH(RUoGH+_&|ju3XMC5Xs0WYv;IRz;Lo=jjA+xOMf=#8E zUBLTvj!03Vew$pET^b%F!6HM#?;*n^79BbmI2`PE-(zw13EBzwr#gKX_tEu{usnRq zieZ)`F!UC&zUebCGxNWlT>`3Ye227=`1KY*-#}%7q4T>;dw8-OZuyyfzB2#HqNj=*iF5-`Hw5d5_L4w=vb%&EeY@+-)x&_cF9-J?kcS7}N8yJ}*WJ*S zz71$H>12Bj<2*C%EpebI`FeWkXQwe$QQ_&~lka&`W=Y)x< z1M_$QpI_ZRl*7xn6Jyy`T+62g-Py=OrrQwS9)oK%TA#ZoK23gA20#L)ijD)q!b9C7 zOIz9?Y9!at^}X;Jsi>5(PT>z*vA^_z60#Kx?ZnK=nwy<9>A(_w0YV`G2iJJx=34cw zO8w*ILx0+wJRGVdfY9GQJe&~#VJi^4C6IVsm{5?r9Vjr!F&b)+vgA-8Fj@e>rZ2O9 zkwv2WXBLUy%+W#C$X>w4%GSo($l4K)l}5nE(#BrFR?onQM$pLF%)m&*UeE2PYhYt& zq(Mtfi$_OItM#8_Sv`9z2To3!|J^hWcy#}m&&kUAr$^7o%*{>nFDzO`jm%6;9q||# zXvC}?e;$J7=ZOrAY#p8SEdS>jds`bzJx3!vM|&ru|J*Uhqhn^Jk=C;^qEV$$aME{l zvo)d-v(hs$qEY-uS5-#e+{nO@M#ap~(eyv>?BHl`q-O;UAsTkEPzT;83ji>yV*<T@HhsHx?E1@x5!5N;&W_+akhjvz64y(RaZ^Rb?B{G856JM_u zAPBf2)i)!3#e8ZPVuuzO|;h5fJJ0Pm@H^;_EO)!P*2x6!}KsaT^pj6sZ1NddFKXFc-9vmlwJ-BMxk~`=oC>6UA6GKIZsp11o_#iXlF`sJ4je7RSlOnBG};2HR}senAZ(+^)Qyub z{qlj;!bQ0?Ks?L_fgwje_Z2T+8NF=x{G#kX6#B>(N6n|6eK%b6nhRRT6#JM)lS`D$ zTcJF6WnD!+pxjH8zs38pR+ugo|5AL&+87H|=Ry;Q+GC|Y5XfbT?C@W08YiFAd)0f^ zhPOebo1%?w!*W}|Akh?C{oo?T$u+;CiRq3*=0~kJsg?C8T(@p%fpx8WAkRXwS+5UA zr;aQM6auHM{Ui8DeEBPak@S#~%2YPG#vwoB>hHT-dp1?zY>+^l$OqHgeC8{Sarq*| zAZn2_%f{0?5|JcYA<*WNWL%Pn-Ks@^c4U>w{mAnf7qUVsSK0(;#zt#fdZG93OY+_x z=}l5Mbm~6fm7_GM`c^a{ zh+ceJUAR%}Cp3No8sZhdV}!-}15JO2-WM&MvVNPFD!1?#ESn!<|22E;Y*CLq1Zo64 z@&7FoB}%)`^RwkrvEPjUFBZxF;{PLQWNq@Z{?pU3{c{-^7GW9|VH_4_8W#RJG7Jkb z4hu012{R1|GY$ze3<)s~{R{;e289?0h3E$b=?D4g2Lu@g1nCC^=!-Zgir6WN*vONZ zNRyaIl9-5-7)g^DNs<_elNd-6nMf0vh!Yt}6B$Vo8Hp2r&M*)sFpwlL5Xb+c5yjIJ z$I}tT(f$dfCJdw|2%y3@_=90Uh-pChb3`{Fz%U>{*C#~RC&1AE>ENU5{iC7rqayI5 z!tl5@d?;{yNH9D|FaQ96fAKQ@EeijC-+%f)F#A~l zEd(Gv10C)EDr{qB{O_}0sM!1mvXA?H6%8yHpr|4Ld4l2qRu)lUB&Ysm@SC4MK{v9) z)lc|bWZxUR!G6Y^|{O8A9_Zg zRW!3ctR^Uv06#WypfV3kQa(={zDdIXqN}`|7!=>57IMCK3}_4VzR{YVuN|%)<~ujD zhFf1iJ<#1Vm_g5@4 zoJjLkY*lmN@H|k5Iem;-jE~u}H^IK8+)&zkVc+#?tS^V)RfAoQbG)%Qdh(~JO$TrB zPI(J|H#;O{7neBd0Q@@OTvMs-=?M^fZsN!01bUolOl-p$7Isa?@e^1LSUnCR?j=s_ z1=Or#+R68F48h}F7I67c#Thqnqx@D|`}`60*PPN_pcwA#aM4xxjJkGrGsr9o@b*L&90_~Y0}GzGV7!Mjcod#XQX8jC-*DS2&YW6aEBudg z8?rj)nNbcw1BJFwHsK~9^dqD;5oLo$d$+_gbW^)rWbkG*dVP)gUkV0DJ3(l98shNKe+t^M`*JYDLedHTE|)Tp{>-=q7ri>KNv zpcw6lFdXAKi_s8P6IK$FGn$gAX|+5Oc@-oD{aG&z#QfAm1kbVsbY=D7C35ZNr-PjG z+C$a~l}>Ku65YC|sUmPNh9y;GHYQk6?Y761!)((n!X?#XzlzSmA|rlJInaY(s5+jG zEC)805`I_=OUB$oOLTWj9-u`zRAa`zxbX;4p-{qth!J^r!MgjZJE6PfTR(Ef*c}nCbN_43qVj$5Jy;dQ$;P z?zRf%USw2D!-b(#!N(0UOP0>X!FI2G;V7{8TJn{amr|Ki)zhUWdN$8OG$8j=QcT8b z14@qS?|WMwVAK@m6NnQk9<(xJ%LF`h#;LE)%~bsS z(A{k(1**a>w_26)=#C@l2r7LL+4xNY`(3w9OV2G_rH!ENOkOSbC50AgN&PHTdTvp2 zusFOvSypy3P97cBG->~Xv2*MZHConf+qP}nwr#DpZQHhO+qP}4wrzLcb#jw?bCUgG z|AqM`@2sl%)EG9e1Kel^oF;0UL6mx$6X+nEEkS^Iny7zfWld(@U)SRD*hlbHjjOKY zMNb=xcq^hSOOblV`_c5oHxQ*M1#4DHmoAs}8gq`8QUtjzZXN%9m$9)N#c>USqQnOM zw$NQrVZUEj-?RV2H$XjTrZ`o2#4mx zPpe}EV;)2LZUO24ak4N5o>HUEOJqA`Z1P?C&p}iG@vRw~;VGm=(-NOLk08z*WBAyTUYZNWak0We{a(}!!bovX= zv}`>fO<$X|d|PXE=l5BxjP)|EWJo~<+hL=0!CL0*TCIgObXrwrv}p14JZ6-*sjhb% z=T%wq*IXvD@KL)U-I>vuQbahHyjY)r40JnXake%6>AN*W2^;LAhjHRmkKDt-y;W7} z#s+mUqF6aIr-xG-x9RAGCP350)mg2aN-}8%eMx_)PHrc?FoE(Qorq4wP9E}5 zd9Cy;MiMDQMn-9j#30GoII(;;NYc?I(OD)DolK0({17C8YWO(R?{yqBdx*{+ zV*&@$OxNYwX^=eUdV0GdErC%D`N)lRerA{vtl*|cD>Qy>s7|jPplbU!^%ZPmFI;vS z8f~0Q)YDD^umRJ5Fky4kVT3>d2&iO}K>>!$f3QR#V{uWb9tZ)JkYJD?q5Xg(KAWwG z4H&@+SkeYz27o01F#^0qpt70t000OE;0(9~??2RO{}l|GiTQs;d354sEr%IkLSFeo zQkkO$GMcCKDVR|j&){Xf0LIjmgo&|7G>=|Xvkjn7HSXp=hnt>CdRkGK&fH>ahhT&W z<~YVeaE0QG2weV|9n+Ibh8peti?XD7lW9;8L zoyF&O5*Oj+BrvHMzwLMKDJ-1bL*R!m)i1I?bMA{gnI~@~{te{aKZpEb; z0~EHD`~IC4;jJUre>koGimSoM!2EBb^nY6bMgm4wMz;SoOc++Tvc^$I<#T)4f3982 z^?7gcopv|meyQcndW$$*RlXe}k-HGLW=0;HuW_9$QFs4!267oeb| zgg~TZunO!HMP&kkgiJ_Xwk-LPfLsdQcHK&+Q zzlrd}La5iMvfs98FSz#2z^ZJrTV4;WS8u@eUOz5p0YaodD0;g~1$g&fkRgSj4wQ)k zoNu|m)KMkhOYIMT%?B|OoI8vtU`Q%x{{_RYSjNKi76n^RK-p01PpaH+^%6FK8_`Gg zR(Rv@<*2pT?@} zQ$n~d1H@jiF$0XLR)iAzq1$}?k3FwD8XlnL(a&@TqY!Ee%n-@+0OfiKj==!}KD&cT zMsHt8_Jy!4kiDim(l;vS0l9eCOQ$=xcG0U~6RLDz4ZFG_`8^v)&|cWNy~7aBCI9ou z50{5b3v4G0xkC1sbJNW|8mE}^P%(?K@z~kem)6zP>n$NeCuN5D_4=0HTGuFrA*U79 z6x5%G#>GU#ytPBu2GNjNpfKLuRI`?JS(pHV1*sv&QX2ZbQx820rniSrj~SJz-YKiS z-nsGL{^CgRw@L7~O4%Pp*lsNu2=VemnBkwo0C8eH*fXl(CUA8oGSMVvA!jXWX!1jc zY(zv2xu_muEbRp!Gn|)tgxp4UP(mX&0%roDtqzz7UK!{9;X>Vi2Bg{2{1Z5H8Jpx6 zOj)gPVg#ZyNY>o0%&U*Z3@=sxCAN6-uy9jYE02%P?PfAk7L7fo0n%rg)DYo&0YN1R zvKONxr1mkGbjzX&M65B2>wA>4jD-%lFN*y_N;y<>j=~BKCBnd_pBkKzcY}8e--)^o zhiJ=M|J5)wANkrhS<7bU%%bW_z8Q--_=#6b4=Gep$`RNqML^ubrZX9Oyb={_sFPV^ z5CY7+0;^e)Grl6`>`sP~+vn(B@Ew-S!C{i0tdvTzBq5dziI}15O!sG7_R6olSO92jRfLv(UsM?)3;b7Td%neGRnv=A^_5 zIR$d==YxIJz$UQU*+rU`>i&w`0I`F?ig_!y(7GJU2@0t35Di4J8c?xNi;& z(61{NuxO^}ah|XMtQ1uKQOQzw5C_}hkl>K52u`*^F(a0h4$RzoK#yFtQz5lL;c@eG zLe4QK`|&=AM2vp#;R;g=;X~|_%%@OOCr_PzRmZ+Pz8ST)cS^%3-UXF3vB=*bPpYyt z9)pb|vt%5@FS5uhz^_s_D^kE=ZD1<0efYppFqWw9qgyqO)et*?%$^>h-+8`_sLCwW z_#_PS5*PmxIufPId(}eGI>vp(cfFw)H^^RMPiCMD{7DI8-&?+SQZzr#Q}H9wP=P@)1A1={4mU+q39bx z-0FgbUVVPNZd-*>bOEegdZpl81Zo>dX-7!l5`1HCr!tP*Ogh$=Zv0oCzv22srzUmP zlD@DgsxuBiXwj7)sytx>W(MbgfC1p3iG<^UH;7G%r00UVDQNC}xnz3z845)0FM!jB zqpwI9TKpbQL}r5npM@!mz}E*Wm+CH!w8LHQ>a<9KYHdqsZ~n3Ivpc|$BsbZ_X?wz7 zHn0-Dm#nud7eWp3l+#XhgLM!6Bb^v&8k@?KGU3RyR#imd$W~QbLM?h$dV~{Ie(BD8 z;^h@qRyKAUdNOppix}Z{HgMN;HI~h-!Jow3qocv{Wm&>q-usm|R0i#=twj!d9JOAq z-(;L|mt6UJRCTlHj~QR;_jq<@+;>{~CNf}$Xw{*_F z#ov-Ake?A^b@Gn&xZ*oyJJH&X9O<~WZBr^QH9(I#{vbdtbAjacgyVYlpt`xxH`Wp` z2^Y$%hL+~6=nWFk&`|MOIdaAHkykYUtt*f(tCrGH?NqfwbCyvY3r(9#L|}Im0TE-g ztS-+kGTK$xz~SIj=jQhiGsV3b5UecCe0C0!s8pL4-qO{krteR?FOv)2cieka(EV~#BSAHbS~mA z(J?SPKQ~`nMn(6jqkB5HsmFOn(_nYDuTX!zs`kSY*L0tNtSU|Q2y7=JBJzVr)=uW^ zNjRibA-1RLbzV?iGibuBEwRHW#APzQOb69^5uq3kd zoNa1XxuVs4uy2QihW$I9!c!RPs(Fw3uMVpsu`5TZGnQ72baXvR_PEDi8QHpzty!}` z6KL-keSC&3=*>_0H4e2St?>fYw+EivX!z@O2K`uxvQwZQJgk&CZ>^Xf=iYxtTwBK2 z{t=?R-V>wn-F$O${sD;Zsb4la)(4)chtU(`!GnvbS>i_}{TC6(6Dwds;|b1%I&H0~ zLs*Sh&hSe>xoT7{l}3wFI@Pd{lBmQsSY)+d0bHsPv*VR2?Q_Ob1Y8?!eW^7z{BDyV?* zoH4(&K6GRvDjF6raJT1-Htx9mgT@;7{Zyk&fGY*XiNbt;t?A&g8?=;IG-**jGXB<0 zhKdR3L(ccUkkB#44io)k)BT+@#O}pz>w|P2 zB0eXwmY^pz44HCk_R&K;9sUa7)IWtZ-~{cbN~`6=gt5#Or?y0P2^pn%98wJ0tQ>-N zL_KWqDBcMi+fO|(lo|&Swuj+{2R9`o$X6A$axzg^HZM(v4r-W^3ZgO$qo-FitYf#IETvv`bW=CW z(Nn6M`%XKnTX;0v{yC^rHKjUKV_M5-(p!^|i3U5g?I$SpK^tuX_XD~xKtmX77C9%J6d7YpmkMjBWIxuY)JN9( zYkM$HC4iZv1<-k1HVQC#fr!BpY*9p!5*s!ewA_CZasps8Z-EHPpn&TMC<_*ZstmPY zAA`14HYEb@Rs^CK11J(%z?LF;zR8MAxgwiGvODumU?CWCTpk3(*+&TA02!TYCr8Sx zHpy0Szuzu$ywKKk34>U| zG=Bbo49bjCe)6YqrTY!`87F*S+n8sm}hBe znd^!jv*x;LYn6{Z@#eV$C8(j!u&P)1fqX~opN}BRB4)WdEn85#pa13P(JupH6#_?8 zkFxGr^>}4$wS^)d*K+?cWS5CiO`HQVWVzy)tP8KfcytWo#+?zBoxVO3a_^DaLSD#& zYB*gkqb@MWjG(_ErH5zEloo_~@oxoGK`{xJY*bamSVS2_r(zz&vvdt`duqVdmlFLbEeE@mRGDJqEMe~B{H94pGeSShG}9FCh#m8$ zzl!n%)2I#<>;`s!1=+%EoaQ z#pCpFaK+s{t>AFd^g~LOIqpWg<^IvDT(t_yuWRXEiEAlU!KW{mQYJCp`XmP+#Q|-CH3!yKxg09@9WsrTw$-noadi2|FhQ6#QVJK4*RM; z{_fLHim6RBTZTi4T|q3@N;R zSRcA+0F_0@%S5`PWF2)|261w-r+Vzc234@M%X^&sF$DTrd^jeRE1Kl_Kh_kLntHj& zXeD@YV~jtO+gIu&a6?sO=@4j3)uG<;YVeXh>*(L3zwEwDhapSe=aG5;sug##t;L1* z2Xr6Wq?TF7Q-MUDNp7lXo7%w!rMx1?oyZRx!M-a<_r8WwuW=Hrk8+u@%#+ktw_ESJ znu@JU0WitVl2Dn8n1bissnSgK!(I@)bV0m31Ot0P z5zuI&^l=Hs5}9*_tkNh|m!3?(R_!)n=1I5b;-We@vOqQ#PJ1g@@=@ zRz*(T-m8MZJ=u7b{idy3Tuwvb8rWaI^nJ9qytu*Vh^1M~l$Wy9YRsj^_fbim)f&=RF5TE!A8ZTttt)P)2 zvKiQ$&SE%M!h4AIZyDCv^=aD?Xm2XHuF@Zw@EydsM}YlWR%^CH%gi)zd=)S$a4;=`H#&S?%XhRlRO&pg+bXnG#T zB9iy6l|mWl@Fi%w9`7P-FFv{YX zyZg3JZ1QQClk@&@;M?Nlc0G`GByMQP`SU|CASnR^2u2(jKM#Ra>PnJ7Sek;51&tKa zszhDcthFX7TR(~~v4g;Z>({(eT#-rE2_w6s2CF5CTT~)buDuq^@!7k^M;=hIRXpzD z#OcS!fBVQc_ecaL3my#eFdiW?=xIpZ5sRJecMv>Kvqh1be=&vrfsDU8{|n!upDU=a1zSIh9q(~k{f$cgd~-* zZPKvvOZ+PNu80`*B0|zbQP7#{aOnbrCmbzdP^kGJ3v9{#u~+#rud+I$D)(UyE1t?( za%pjj!Et9}ak2)gpog4?Dx(Yqd5RZQ)!mT;$`|4ts{MW3S70eX5z0gG9Ssx*+RrER zxKU*8SST6%HRfiMe~zUA#UFa^jllz;+~clUl!cixj2QlIxAL)@3RLb{Y zN9C1eZYLEG_UwK%!klvwb5VcP0sN`>b>j`w8L07aX+Xqv5D^Asg#AzkJLGMdRJiVg zdxa)c zSWSY~k{ufvdZ9`JkJzi23(GHcGf*{nCk$J%MCd@%NfMa(F4{yIG2SsRWZ9k`*$O;e znpdzpB{QSdh*WTV5bW^S)aBAvy9mBfA_y`6Ia1G6s&`UZDQRS-h?FAoe|rwRvBxqXmnjfFD*kd50(HzGgJ??T8tC*7xIuROilINK#wxQbJ{QwP2T! zO8`+QqA9-PKRKJyc|zb~1NGvBuL|7M;K2iT0_F@Yj4iZ$>6qJW9Bk${{PCEH4WD2-n9q{KfxW?cE ziemUnV(_s{MdK>D3Snx`wt{ueA5{brLi;7Tg-1 zZoCAVNYkOyrVD3$V!43}=dPv{T9_w;pPiD&;(WJq{Uo(}YI%Iaxm)#rD4ouabD*j% zH;U_}E2wQM^_70p#5wVv%b7VhG63QtZ&fOZ#I}!F@w{v1kJICBT9ey5fmc2kn#^<> zsn7l#E6%pp4;Dd5RTW=#XFT0iR{_7?J)`#*%HSkuP&GXz41_yX#y}}Ek1t+DhGC%V zB?&E+6ynCMpa!OYqloqsQz(Jhn8Sg3N)C8RozD=0CK9~-soKzCRvdcca16RdfsaC# zhk-z&%niGOv^zBrC9r624*3-o5r41cYSvLQhI{nrwe|=q%*3i_Jm_t9RAjBS+p;%t zoEv$*{5XH$*DIT<`}7XD|NBFp>_1jVVdOKGTh@o+$Ie_|QPp&KeftvvclzU5#=f=v zcdM=UTAY`-j&Rv2FYvpGYR%$o;LA3j%Yt~28|J>i^6dlDkT-uE^R5Ku%uyrCV#YxP zR)Ki=b;g7vOdGkt`q^89qK=X5Pc`zYJobo`nOd@xX6HT1>|Gmxj#?Q7oo~c+{Ka*M z&6N`hQGMeY(`t0;MmFXI1{J-i)>N4gdp0{oMk-HsS1hDxcr@V5lQgYHHv1--AJK1@4FzBJtTGeBr`uMWFc>A1CE;K+xZpO`}fqnfQdRTWtt7>c~YFV;cEA+db214$~g4r@w{@uaU*%dhytGaQt+5I%Hg-QQGt1 zw>m?X1By2F{({|aU$$6n{?^9A!{JZkDFpVuHNyyZ+E_*tsZ46zdgK!~Gap*oD#TxXVexi7{mGL(O8v1`^L)M%)PWf8ea@9gU*9I2E0n#h`fq^ z9GdUs$H>RhA)v^-e#X)64rS> zu6VxLPO;a+!;l@&`-l>f?xn{DNUN{|7`SnY`Peq3AO$9>ZHo)A3oVulLaa8ZORF_9 zSPNREQZ{TNRTcybexv4PtJq%7s6gDGKeLdqftzl9U7vp+U*CQE@@`M9+8+5G(nZJb zw`}cU^Z!srt?BCO5-A|L#)QiD%WCOSU)uVqi;lq!;t4gS6y{QJNUw9GGA*Zd zI=-Mk=C)_xyPySyc=K1t^>96WhqH{+Hlk%}yV2lmRf?oE*xJY|<-AUzOMz>B0S^-0 zHq_N_qC|{if1qEH{%kf|>?`x%+FTLiS?^>jdEx0~WZu5Acja75c~2Drn;F{`ysWOl z*HM{xb}Mb4=7d>s@P9+TV;Kp@oM94=i-5W%gw{5gw?*-M0+F+@efS9oA{^ea4|4n{ zQUn+Mos0_Oyp(&9Of}9)4_MzQjc3JH$_B5-CLW(%g+RL$i)P^_9+`aiW-ZHT$X#RD zG50K~qOJp6E6$SjJ+~j>eyHu1zNf0y45d%3d-k!KaqE4FV*g7J*b-+=w{T{?PE!&z z1MZeoHX812V_EIl;pRd@v!$V2HeAME*rvFq7z=?p1y!m*nO<#^a5Y;&a_6CTXN}4Pqfdc>tZ#1| z)Q}M!hFv1vnR#gw5qzI1=xZAdYzPj;NnTsnt||weCLnipI`cRz7mBTu+r+SfVf7CV zBzV$`LXcO4lr^G$R?-gN=|Cu*AH&m*t?_ z>Zw_zb+@II^EnHA7toS<(V+q?vOCinUMs@SHJ&FjC_%q{R!NrPQbnS3L|sY3;SLZu z3xVuT_h%rQ;0=Igv!KxraZIA(V62p)WLcm}c-G*fP>0;0zd?uCD3hc1xgt;t2OvC! zAyN+{a~tJgBL_mJU4bgVWdW5H!2m(Ea8=DyJcolIdy~Mt0QmkQ%Yww6U%H30tl_w+iL#_)cnf2IJ7win}%DPNW_-o6|&}-2}KQErGO+@2&p817F~3gbQl;L zJoken0UBfb7X0fDixR=m9lB$pINu~-g7s=~iTPMb<#hc)rAlg}?1rw_LC3nTgI-`? zfL${UIJmKs(#5*ySBc74bEdetx;xpXpSjUI!deth{K;YDW=4~6HUoq6v@y3{yl8T zDue!vI?Ai6fRFgoQ|Q8k0G*g;i_*GM=|}XdpzD6LN*rTR$8FrC1&G?YZNN;EuwzEMxSp=)wgD0`beWj{lZpiKP*zbe(HTX~ejB zhIY7pyJ7rnf;IOU^WgOXE34#Kg{!F}%w{{D1TUcvY5mny%}>J$TLz}4>YJ_%oJVK? zwVO?e5YNYqYy?zV!oA(q`t+qQ=ivz)i#d8>%Gqs|uO_9{?{!3msvCxc-qZI(`NYT> zcq0LSL~#`YT5v>K+&VL+`8z@AlooBwqmA2MPppw5$wc`;KLvOboZR-Y`YE`B=}+tL zy@L4I{KM?*@ygT?X!jc9)5zc0Sa3Z5C1Kp0AUB(WHLOy)BtNsCFz@_Hb&MRxCAn1n z-9vg)@5bLqLwiHT446C{R*v5F$XfgLf7ez&K`p|Vh}803Mzh+idgZy57FL|ZoI14$ zj!AF?JM`{p4{_cA<@EQ=FkcNxn6Y%LTZA5tCL4XiHU^=bKP^u0)Mz$ztJpDU$oo!3 zNf+CTjeLn053hdY(~e2yYhux|>I0e6Quc0mK`8Bv#VNAfpyR@OE(v?i^Wi@O$T2k} zPaKFJngMX8aUF?HdZu;$gbuTl%xRsfpnvH-M1U5hFj>a~gLD(Mk@k!|^{mU>_w=xP z1uG+3EGc-2e)8-^RLsGq$?(l5M#gj?ZiI2(Jns1CaW7mEb%*m>sF$oMZ$OIR**wVW zQ~CTOCX`kK>UXugC%)Y-YOPHtt!f;%cnyD`F!mmk6FRrj5~5?TuXbh65e{n}^DBB& zV8k0ZK!!k;flp{e5uudW(6rwI)Ca#rJ^~l86~9f$p`HA0zMdfP6Z`_eGa(j%d?CQK zAms;4V?2BTO9xCsHL%OV>AbfmsFnXriru?<2^h6tie4dEI#ffuB2cJ(=C!=n| zmFS!@FhT*aIZ7`n)Njlg#Jyi{6@6(9RkYvfwzS2DjUA=QV(P<+n*OB;8=%upX#?yc zqk0pOU$X54O|XffjQQ$=c|~JYyNR~wSZU)V(?U3;ULzoFxUHr4{JGZeFgnICV%exj zuJ?))bO!x}r0?tJza^&kS+_aaS(gO2b6d}#pNW+_wV$*^lo)R!S6dw&z(Y!llc@_bybbxZj{<#|{{ zj^WN{K%Edxe;Q}WfJwQx#Jxwn?!@1?i;PsX5qi>H`OU~wa5;bY2Q=(CV0@j zfqe*cJh~VZXAHMfpO5=Ieuvb|zCKH_yA0+_JnYog51)t6Zzt`zyM~V5&3JRYg43Al zWI6jf84)lm?y)e3J?y1pkLVZogXyqyjL|u6`z_oeQQGwE+w_0%Rt_(%f2?5Yn9Kuk zi*mU*?-B+`#L-y+IC*!KkNYw{ zsl|d zNwbDP#+9W?R*9l2%(X=ksv@*?XoopCJA$E3O1u$-OVyV|I-{P)^UU5Yb-lU%K)+OM zIx*StquD5QcaaEjqT(flt8*otxsc6LY7-Oinh0SRXVEV@1C{R#l5eS~)?Lfgw#M93 zrRUf}(GL7`rJphdT5M&D#&~}6%F2%HKA4S`aHM27p9D7o-(Yo*|6PM4m!cMZw|In= zyMUMUC0JI?P#WfMO_j!B{^*CcKOg`E;P>HwNG$$WL}(UPR>uDqSo~)K`(Js*D>WMh zCMrtkD~88goXo2sRZ)eZg~{1I2Ktz&UBF1fbvrPR)74HsATg|+z{jv-a{)ME=c1p$K=LOcjU z^PfUtD3Ho)KV@Y4{lOYntk@=J+5GiX1NR&U2F5@{M}vpDw*_L>$cKnbXbpt@Cj*<* zM@=TS6E}AgkUuSmpB3b5xpT_sYQKHVv6$XI{g65Q_5Y2kRyP2t?QcW*kmZ2-6Vfo& z%zW{P0W$=G<6fG!CNPNW7kR?uJb(h@m?*bE9C^ioLyn%1H}r*Pj7QN(al>~8aJx8x z%K!ohv7{J{SNNz=!8{*p20uV&KE6GPv$W1?%2nfF<@^*Ly5MZe|LuB$;1ixQj9Hjx zBtGl2-`TA}zZ&(-QwI^OhBf%ue8zXY04r#6t7E|NyEf@;(tRFw9#=r%1pkX?%=gDa zgnpGdmGbdiO4wZw?HytFLHmn+SBhA(f;80V^AFZ`o14Jq($><>N{83lEH3WW7O~B~ z0>gZ#?33NM(p2iqjBHFV*lQ`4x=V@^ZB;czlh$-8P!XYg-O|a4IR&74c!*J;4r-E9 zr3Q)8kO!K$;1{Ey44MLpo-HvnoUz3=yKPXZt7Wy<+ zv;5f9K4f+y)$LBT0 zUzGrePPt}eBz(Xia%sP8I!J1zn&lqN`XzG@lrj|hB!CTtgVXbd1{!qQ=>`#)9-PyX zk3lgS|9~#^Fj6gHtZnNoufN#OJQbRryGL`nR|zpbb0yFum4yXkp{xDr_#b{-JgaI$ z!9I!KC^97)jOpbn^@Je;BxCIfR%VS$kq=L(B+ik^S)wsJc3Mp}tCc@c!0VoVTrrMf z+{CIsOoPF5@)aB?CmmsOBxn;r2mLDP4uIXsi*=8F-${sPxFe3EBtVuDs+1&gk)!A| zU*IDrm4s^;jaY-XA{l96xAZhkU0=*Tj+DqT%E?Rcb0OoL&gn8VQj1k#w>AaBpu15G zZ8?Kc7fPyIbBkzvI4;@@L!{+Eg^6$c0tYZ+?c!ZgK==-#i}9MDzp*;wF_+1=QSUT` z#$a;Hql~$x6`Xkwf)ofoaQn1HEtJCZi*t7Jnh`BQgJf@sQUgdN=^MW>=jca%vW zOiti163wK2=&)SG>8MrBQ(IA(i!-c*RND&Wx$daRv#c~%N}>e-I79bB@49k`o$?zg z+e2`tk0NdHQ*{yf2ru&rAw-2MroFMKH)mGl#mXytbRIieEb{%Dv_-{|2{H;HjbG)Cdv?IW_(@n=FSKWw#0~ZY({JYqP?tzq_#4S&w`xz*~ zJP3X~aWU@PkuE8-yM94yZNq?p6;UtzY_?!nJ*86`+#L+foa00P zt?u2OuJ&oOMN4&KWx?OmM^7m!8&%b6C99@XcV0fO_M84y{2uZi?!OEQ8}&}t0mNbO zwr75)&xNXeUmL@(g`}zMH7Cl4ZMX9t^Fg4~{4-GqmeB-yUS4Je{Ac?d zFOJUpl+JHs4%qPLdYPQ^yrtBKsPyN_QqwSLB$txUvn7o#+Ri7}o_q`m`WUy_6oBDE z%`3~JFUv5FZGX^s>iDGfkLQed=8N?S9fKZ?Tnj7uU~1@V=yeH&yz% zC|NwLa=rPB$O_yGi4nq;(miRwsuF(UO+k5>U@iJB(xhQUn*OJvUQ1t|(o`~8A_kVn zvSL>JZ(BssM8#p4EBj3G?#qfQ3!3UDZ*N=+XBSwn$4Sf-tjO!Q&;!>e)#R^6*J-0> zoXhcj6vLEZ^(9zCbu&EFI5}u>zQ5MzbLWDglJyPv2fb7kTY1G5OrF!t46NihdVD{T zeSkor2n-p4p@|bL#y~mXJ(8#*Mqq3TsrROafdRT3DsEKd6+_o`JUkNH_2zKS&Z?YS zWsX5v&6e7Wc$xO6u=V%8+}L2;&D9mW&~6rh3-|XDH)qFb_i65_&)nyIcG9*()$@qw z37Xw{!HPLlGbD4lP=jdQ*e(u_+wtmi!A-y$c%lz0DR`ToE1gL|`X9>N_OH>Jg}*^{ zH!7uvg=;ij{bNw}&iL?XqlXK4K$jM*3)$J!VJ!B064>e0ZSrq=UM?l^@&!CKSNP zQSS{yQx6QB1@qwp_!p^Zu%v9t>&vVD=GA(Obb^Dc+wR}BUZjvVo32#pr^tkJ2|XLRj`G-;4L~>IErGuac+^KL4_-thnPG*?x9c=qhA!C z$Pmu`OtE6qUCb|Md({N<>fLZLUQ@74?QZ-rPe6VyK=XAvm;S5ewkbyA7+}Ymt&&@= zBbGQ%J!~j^IOT9QzYJeJCb+ZyaZLfyp$+KHG_JQYr%ET5eGw>_I3SAso-u%t|K<`R zz_%4ztBZ}*>*>Wn|R$0qpAsKzc`2faa6{bqwL4$dIu?*P&7^yV`xA zokCHm|Dz0)kz&;XQ9?mN-kaNF_n7gx%dPDjJaZP_r*2!ZQg%B{P5-;ImbE_7z;2hC z%Axl3=2T|2c6ilYWYs%>E*aWyr&B3JwMAbr0%K5*AVWxI%JELaH6RF?i`f0>-YJ~q zGhV2AtZiAc=iZZmRkseM;nA-HZ-6g~VAfKskX1C;42?R;)LiSF@<#fgR0ip+*)SRl z7Ub*04-^L&V`6HFd@5DoTXig9;S}KOCtLGseI5}wP1_|+;e_WV_74U zq}VpKQK*z{)<&UUT(dLOwK#y)`~iDIgqRG;r%D9#oK~73$w(gv8%XP?k+Dl~14Z#5 z6{WBt30EV7_gqtRqvU2+SD=weI>BU&Yxlj82Hq+o`^w9TqVF9*MlK-DdL)FXC~O<> zi-6W~B$XjUH88E^T7wUR2~=%=M3&y{`5|DC0`;Y_>-2PVd;c%`;cCQatD|XYeT`U1 z6x2)srUG{CE5W?nvmz=-q`It#Vt{0##%j%E3W*}5xwu5Td?@Z4ciJN^g8NI!mtF15 zNiYmZh>B_t6`8;o9W91bkuImfMvubf50kN+>Vg6&A+8uuaUL{-t_#~%*1cl}=m6Ms zPjA06iR3y$47sHS9gY}}I@lw?MxzQuBFqZCR!OzqWZx#GRYG7m6pNdZxBb0;%zUde zxxKbBj#r&B1%Yfgu>VFatJ{StY_SysR60MJ`|fliN9pDlV!Z4WpHIK-cY*lV@BIA3 znU(%0S+Dp9Y*#YhP{9zikiACe&v5^huqR`{<3m!=FX-z?-QE(zrex?m+XLpNcxu73 z@Kz|)1f%iDuLzhU*e0BDKYK!;`@an(1+0xEZ)JWVHbJljIq$Gt(0AtKu)2US`65dt zu$ReroK@lFJ(d|UvE^90qPTgYzY$*dG`?caM-Z5V%ty)(>64|_%Wf5~75s}>ov}A% zc1wMwzX|oc;Hbb&(C~nC41iED8T@tEp+cmCwfl0D`85;YLqq+Tt*9rf$85vI++4vp z^G<=Ja?9WxxaH6;g=A+gMZPLfPI&R{9-o9^GZxM-EpE;(Y%OlDX`4K{H^1Npv}oqf z$SQF^Ye`AO}lKe zG)|W*DCbZ{WRKA{%KoY~NvkuuxwzHjbai%2|9c>fvfr! z(F;sz<7RI%1Gw73qTPb5DcYH74cZ>*(lmLLaca&`a-8Y9yyB5zW9{4!%Su({(g4q} zujYa{T{miTg8N460DpOET-;JOLLmwtOWpD*)l&)N)pc%eQ z6I@RotVqExA|{-U+G$b{szB3>fJB+xByXB#s%~~JK2K=V!~rE7XxgEf7!p`XP=N<2 z2O_CGj~)$5$z~3fsDa=WNGuo_sNu`+j}24=SO~MXqXTdXz6k^mgaUO0J_*zSkYo9v z{Vn$!?l(wJ_2~4&<`?I;Ot1BFh{!MIo04ZN>VxslfnVW!rx@0+78W>#oyMiZH$nElo!7QxB|q-2?Vrg3@6v6DSoHAAImD|akv znpr0J74S~py;!|xVoFKR#>~S;>>D~j43n#0pUB8aB5EkNPszOB5$;jfLl~HX$YvO$ zU_FfDASNfulR%Dm;%iJPRQ^Z5e5Q-Y8-6z&myzp6aSoo_kP>#x=uN7+UGnV|OWSZd z1>-D`qt5`x_W|G^T79 zVrXC>>3g)LV_?|5p8p*P@=M^uZX|#)8QgGG(4w3vovI#jGn!xtqn|8LgR~@CpDrHU zzpx6}{wqTO6DQ;UpA4}xu(JMtp3Og;nVPl& z_9-ggZ{K2Ve0z9SKO!)7-N=YeFd{(^YO^4Ea0Ie(e|7&l5&;c+DPilSG*(w`dyc1Z zTLrHTSCX6_*Aibd^L1tJ?B2_WY))7+DZOl1r_Y28_tNw-$r4+!oKiFIucZOZp>gR9 zF#Ns2@6PXbpVMq#lw97I5){-vl0CuPG&wqfeBV$?2B(wObkh-n|MmZ2?3`jmi@G&i zwr$(C?NhdG+qP}nwsGo|ZQHiH{-kr$H+?(lhrOS7R`$bObAEG-JSXVU;|FgA6n{NF z*Zt4zGa^6e{6aYYD#^0Mrj!YC832`!*>difz;2%dM#K5zs~r+%8b}DUKQ_^RQT0?$7$Oj_ z#On>d^Rc||g_)iXmAMT)I6(C4p5_y45;y-Y>YmRNuQq@!V?vng`2(CBWou*R6b0dk z>xDR6l|N7ZY=??JhU3i3!&TA@Uaf$w#`v-+bhm=kT zE?*{BR_Z~CX=T!tDkOOGCn$)dh_r517zwr|vu#bDbF_^r$!<$#r-{&c4C-qUg^@1o zL`fVLWkOW4|A~o5L0>}k@e|m|I(I3Bz)XYY9kzGjBB>-H{Drh;IFn^V7<5-pVI>Dr zT3JCG*RXA_+n2FPL2Jyfia)~Iz`U4Jsz<78rZ|NqHJ#hbK!#=0scEMP%Ey)53#!Z- zMT}yawo{pE*_zeTuK$|sv^l7!$l$4|(nQK&(5H=iYg5^N`@<48p5Jv#>W)%22|@-f z8iV@6;Os~UOP8(EhNh?p-OY}6O(Yf)?rlD(tEnmNb7YHkH-HUmhD@&f}Y1f&>XT`2usWHECg%f-ygsz5Y}K~ z<0v|#_DWSjR3s)bbSuem4BLn8$q>hZjT?&79ih9|H`e6lJQkpH5X?A~#Sy|3@uw-8 zoGf()IipUTw@Nww*&qo5De3kw6T?tdu`gQqb_x(JDA)>47ue*+PRZ!%cDf3fU8!LA0e{mbD`u4s zz+8O;Vr}K%D@%rdiC|-l)s4p>APi0AL3tXPdb7PIxME(|1M}D^6O%={FvdvGTcj5< zs%gy71|yv5qljUrO^XpnZWi}&mFYP0%+AL3!(n2c+gf)=%lN4is2i$fYNKT+UU?Np zsEedh6TdmQzm_a$5cpjU98y_NLfpBM!kda<;jBq?MMxF#%azY3kjBv~RVkP1){A|~ z;2As!=ua}V`x_9zHR#PmG!|{`Do^%Q_%_w!2<=!+6%|m8p!Q|0DcD#rj6@{&e4^-* z1Z}`fXtsfWas4Jg^A?ys=o|?7x1|vWknX8G(pO%^j_4<@DP1(||5C6!vWmYAum3!5 zwKT$I3Zh@pZRZwDoSJ~PT~dU94@>o0_gH@ArZnC2AkvUQ7a%}@jC=C%Dk)K8#Jf+F zfTj66VE_B0gkEOl*vIkA)NoZYVI|9MhZH*r3@WKrBBu%IS{{PcpUU>8;t>7>Tdjl0!*|L$o)4)hAuM!m+!u;zMtsej^Z zL*!Og)?g!Z*~rcB%*bZXsf z6}sq|+&Qf{11GbiCG3}{Wog065U=;-a`H`!0+YRg52vp+5W?R9@{TrL3_xXED4yPLt1ui2F5{zZt20*wW>KPKTkK z`Dqc~PSsh&9lxCK;iEI?hO7H$7qvSx>j~GtEGzu?(C6^hfPGCnX~w@M4fHF$4qsv7 z(w|lO2ipexpf|m*6HH$n_WLe1lrIfusMoOB8h~`Oy#0rZ_I8~y>wN{!xb8L!c4I*I zy{>uR5?#_h1arEVZ&Y%hc*+SwyQG{DiLCbdIw!(NJjN$!C3?N^(EG!3H5e}xiAfIW8m1h=2 z5JL~sgHVyJR8$d!3n1O~gz;a%UCD7MR+omjZ%q0_s-%P^XRb+4QH4N+WUFLewWJ?Q zPs95WL6BeI@9^!OT6DP=Gzfomy_s)5_-2@Ax-*81?S`B`ntYC z@OaQ9QRykbKizBqbCjgqn|BXHfu^D)xk>!PO|-V9F!r1()r#SlfloqzPxUs=bN{g2 zOGygv5vt}$HP-Oev8Kx;t#WVt38zsepfNFBZcOHpwfUz4q(nfDk}}&+yp&9tDFcTH znPzkpOv3RJ&BG-8P{XM&0zT6Kxu|q=xQ49SOXX(xK#X_f*S>S9!gF2bcD~oneNJUN zb!FZm??8AxPAAtc`m%Tw4lGJ;Uw*c9}(xfsiTB42(<;6OP?D$JCyQh{0h5z?6Ry zrCEl*B>OH{Gy8H57PG|cLZfotuUZJF*z>z}fD0_L?w_>}>!}mHP-O^zg~DwPjz_?F zht)%*Tbd@48yHTpS1>gM2|voivbr-N{BH;z56->(9^pXTeRGM{RY7i8`FUiFawIJM zkN4O~IRC!cr-|Pd|J|Dr|0ClE<7yZ0WiW9$Xk5r6;>(2s*Qp{J@G9)JNfFfy4aldh z|LNfVCSm`{+f@(mVxA26*II|&=C`k(BOh)#qL@tX%6KOo#9$(tC}(7NZWtMZsNQ@q zw6F$$+v$laZ=qQTrJ3V!As_)kDo~Xf$$9h_=*elImFD5K);n=OKobbX)c;+vbN+ux zxR@9?IR0yv%f`UM{@*HgH63e|71UptmS^{CnQl;lt(v)M#wu%d4yhGXaJ%~|zcrix z%7ua%EF<%CEn{UsN=$-q(kf+qd(v$CUChM?X6wmxEbWG);!%N+3J3Gcwo~te(@e+9^yGC&K?00&KL+4f@;v4l)9sI|eU;?5ZvN?9{9gG* zyPAPoLhfXT%eGd4Sw3S3UDv?h#tVjM@OGG@Cpguqto1KWM*bCI0|_7c14>$3Zx#GU z+7qpl5Nu`uQj05;wn1#?Dw@$+oR4@~!91V{+mcJZ3H??6ZYD4p-4yx~`<6q1!s9LzUVNB9+frISiArggvQJ*WAMDpuvd9 zpauw*gcw=VV$f)iHD*Pt@(W`(t3ab&LY3Z6(8@2VP>7{s>cUhw1f9>BP3S{YP-Ob( zKaN}PuG&VUQn-Da6^>no6EPNp;T$(a2d^$i9B_ZTZ>&d}PG)5l>aE6Eb39ZJN}Ngx z4H`Bz7k(7T4eUz%GZEZbo?(g$$%}RO?oEjuRF4}KVW4U`nmBWty~oPA<38l+^XmZ% z?IWrwo=W0EmT_(jE;s2Jul%wuLo(o||7t*!o~{=oMKbXP4I1HABO|CTo-X>gjHG`* z4(_KBl@3R=?2+o<)IFSHBJ{-spN?%B{`BU}leU7Ud@33cL;hGuBV6}FD-ZmQQUtcL zslIHz)Nbmn(X?+%!Pl#zFw{X0x7c{6+fjk2w$poYE7mg^>{--i=O1VKSCJ@TztiPR zCWfFWQ?6$2^BQ113k=O6lwMfK43KofGFg5O05IcbAfwo}i^H~>Y_k8vOF{uPrFX*KR1>|qKjeZ z2~&1MBb`!2HW!Om6P9a^)OW=r z#ME*E@ines?#3$K94~g;2Rwa@-aV9zN(sD`Tc+Vj?rP-~hU>`1A6GAm17;$Y{lFB5s7gOd8An{ z`y)@UkPe@e?gRj2VDC-tqjw1U=y8|pAVhV;5fp=J@<^(;9Oei?MjWBL9Ip+q2HAWV z!7wBV+~7mA!G5|-_E=&FtOgQMxKUxTA93&*K0z799=7cj%ub%hvpDac1=)`Uw@&6e zx1*pf(10!VXCvsYlIJgOtRuZXloYTbCX`-uv^mfoq!%gqk6RJA^B}Qmb;Tvr;W^XA zq%D1=Y^jhp@$Zw(#ze2Ow6r=aXsneXeKe%V7LNH&1v-i# zTCcNgl+NZ=kDuo9nR$Kee}Eqjzj*>YTztKC%WK9H%IZ#RkIdQFGm4Blv~3y5-5tA} zP>#8d8=aDz+D@dOD_pnTV89>FmQZ+rs-jIatp;`CSefP zOz7b!mYLqnEpRJ~V9d!W4fq8Nj;*pN_yH^&F0-7albw|PEj_)aB$7?=QX=Uu*-(Nn zrHIBVYBqBAPTt1zVUXIvAU&t($i`dgO~PBymFp{x=|ZV^B5fpX*QkQ?Y#!GSQAKjL zpsSQn8KAc~8epnnp|B)@$RtS&l(>#GRv_U_h>keym9ULC?3CC>kW9fqsPIynt$`G* zgtSBE(RxE_6d=<`zGlafNLS+qd>o z^pj4{+rg6>(a3!8w;#W`!8~>jSP1va2)%;aLtKoGj$Q@xrg0TbC*~dE)jlEj?LQvf zo)PbdFitsy*&Nr~c)Shb2Q7RDDf!K3;nLdy_`QWg}P4RQ3mBGdVr`z#+erApO zdK=Eb_&*T{gs>;cm3}|gopSWY8kH}m3X19ajZQ#RGCP&coIWxEoxMh!9nMmJNCTdC zOR!Iq&YXU%j3Cy>k)O=}z~pj8ur#pq`|U4U==dTJ^nZ>u*Xrp7@%4z{jAUtx>W8vN zz+xOB=ou40*jEC72q@u7PUtPA0w)d$MH)LFh7w@mRD(5Eh7( z_d;J7;J%oyN!s_wULjk)#bLiSg4zI=3)d^X!jF2DleMzxKBdsgE9hG;mE7@D2_bLx zUvWRdw*B#U!-r^J0eoS%;scR2IdcIpL*;+48NeY|;a7IK?V&>JL8an9z&_F53*dD_ z(f1HfMdk2$Yj5mFtgcADYv%A@9E1MeHDOv8Jg1@2p@_KDWtz`03Y7W*Wq8&SJJ(FEEiwCZpxY0eu?f*<$P|(t4 z#eii6;}v@lDYaAyUO8fuu$?_WhMFxQ81fvcIPewkZ8Q#dgwpH^sM*efsM?n}@FS3h zG{S#GLDQrMcK$;;$o3xviSSUM1Go5rV6i zLd#(p7jtG5?|73#XYbU_QbPy#L-Ws3e)XTkMyjaj$lBj}uRg&|m`8P16q<#l(n)D#ci8 z0r4GI)k9U>6JyoM0^;NLD}TnsTSjN%6M4;&hG$l3s%T1C_2|v{%qtsU z(8%6?no&qo_l+uyE7|RM3nPctL57SH(FjWEs4i%907=DU6T`=~`PROK6@xkck{9)Q zud#DN<^)BrhQ^cPU5WxzaZgn;kldB83kq}sC!fL9cyMG4ssO*JRg?k@HI19)D?<7n z9fWa8<`}^-80;$gsL@ueT{q51a!ekv{SWxSBd6f^$}Fb z5DB{&UQ2=xhZW=DpTx8O3xGwcFR5>^*5pVB^?p7_HpL7jjU5q*k!XZ}AVKuTxcijB zg2ZkEwyG|RIi%QX$jA+kb;LQF9?6DKk|>7`Qp`0q7!|gC<+U`JIyN$s(rJ(>lS=Uo;K)gG74~oP# z`<=G;XykJ7r=wOpgpC%jV1BOW;iuNlq2NkBjynp&i3NUf*273>{7wL-6)t9u2{gaC zd?R7S$rX68jMr9WP`Du?>Od0|W(dhZ*W7!ryCu)s z#Nb$>)KhR;81f^~+^5S@A`T=;4=JvBBV0D!=>y2VlmvVuVK_SUm>0wdh##M8+F0wE zCpkI90RTfZU(jT3IWr6hfBuLL3_QWhqAjSH2T$y`$&$Ll+f-9MbX8fNbB$|t*z2?# z=y^mVUkry9eGA&=TZYPM&MLz(MLIj`> zkkWu=kc!XlX*wPc7BHxIENe@lOo?#^)fbmT6m+y>>{$^W*ZQxFgE+aBbZ|B!X$It` z9M6i(Nd0k=NMFT7BgBtYhZ;jxhD26h)gDd%6+||TR7Rk@g=iXak(bwkZdyCgW2Q3)Tr?E);_LohG?yUaaYBVjGE8 z(`fdWdC6tkXfpoZhhww+C zZ|=rzmM-mv$Z5m?LJQ+mB>OPY?UOM5BxnzZm4TH1np z+7BUzqz-`B5dO%{J+nhbuk~=*&PXHPhSISE;duGSGsl4C5Z|z2D>gmF+R(%058umR z4tJF-GMr3X{r+YPHA!`F@DdqBO?5ofWBl0OCTga+u8k0?cXOpYSS{*9Pne}k^P)bj zr52}nFBQ4&ebZVbAdSFeEv0WmohD=41l~r3VIN2pe0xW1+>-#a&xH z8@N{w-7^opTCqYMzlo}`aLjnjDS5h~ihS2T6$)+>9n+!8dIKH9p~%(Q!ZTH@2EdOz zoy7t32H);N0cm@>@oDjs!Zq){*`V(9B&JV7DN`$=wUf_RBt&mK)26eZa>kT>3Ci0T z{MbXYa-0YJ6uZR@n}?ZnP@lSz*(NS(E^Cpnnl2dzWINtnMa#~=VSZiu_M$LY zz}uP_1q^1DXp~25w8|qQ9uz$Aaw+hDzTFujtRCo9 zKmQGHaQ68akun~u-#ltk>y+Ze?aqZ%QH+x|HbVv!P#0Xhfj@ZD7P0Nm0(YYQ=&-0b z12P*Cxnj&>>7usYmokjtvlh%2NUI=O0^sXNNl+?vRm_NFmfy~$lND){5waeg!a9cl zv8!GZo1ygq2?m2}1iDI3FNU+`n-+&YUKycqn=gk*E(ZE&}jN@$B{-ePe1!hUa zVaAYxXrEPkv%v@%AaDN~fUWd{v&zPk-s5%}1McH919t+}>vMGbrCi8{8Q0h4GxMh2 zTuP_F-{SP~v5209-plv1J(wdKq$S>JJt#{~zdM;arPap!YJYI0hnu6-N7q*5H8G=l z`SC~33Uw)N>trg|=18n!af`sxmcK<*MyJjkG`Y2M(#C;8@?_>9CWe#8^$<%yHkia_ znIop%hs~;0+*ifKEcspLk)it`XK=qJ)Q($re3)|s=$Jti3M$T7eK}JDyvg3lX}y{V zeGQb*8A0wA;dIJj;fAQ{5X83R?|YH{UvI!S;~3Kn>}O(LSP-=?Z3m0xsN9jY17g;8@68VaqFZ65I;+8fK%BP0jb;;A8YOc*q1|git>+4TvIjHJE zyO$n1Y3i+dBFP%=n znwXlu()0$n@>5_WieZ@x;EMszJ)u3cm8X;Y`~X#yF;+ddM1LH0CGf(M?L-VF9Sq09 z-6o~o6+)i|?<{De4Hp4Wxl~C#dQy^zviJlYZAPUz$}arzdrrlv;s^~tztiPfJc$zG zJ0Pv8jzyyW!i2Y{r-eKi(cA~F9>Ix+trEJ$W16D~cqDS3&PH$vi5F3Fp~=osYG0T? zs=JxUZkM}FgF&alK2RAmXS5})krbo)$QQz*@ql4*SRV-f(N(28N+qY)y@};VQN=W) zQljM-9xlY7V9<;@`6`PRHW2V7ZVg>Ab*U_64-<>!$VnyNG}y$L!x~p@QFdz-<3vQw zIv+fU;r+0*GOC2aULc{#)?mkrEA`aU4C4jsu~-^!Wv#oEc<#6|tmxh86kVD2+K2O5 z)7(z6gjIRDWy@Q;!1Q|m*9Z4nsR0|H*Cw(lgvQgsMtpoR(K@nmxDjuK|7=F^5uj+l ztC}^2*xZ2&D^jD{DvE0r4rmyRLF^32t`7m0udlBk15_vTRvhZm^>%=9A_$XAFw2|E zG<4Fe_*3tIrI7^>yFl2?Bm05bcbfK<^PS!I&)2^=fiWJ(vvf5diJv5@5wLUueDL(2>PD#De;eUNk7;C{5IZ^Py7A|Rl@R!=CVnRdJI zuL{d>4PqI+0TYZBd7vnmW;?te3u=vYvjv-ZC<{O1m4&ieZqtrE0b+hnA(%aLw3MSh ziW-d^mc|a}B^Vtp{qbe~B1+o^XQ3s~M|9YjJys1A_RGUrqT1{}qMT+h!i`A#!1o|a zV5B(bZ>2h*mnzz!gqJ+F3W$sKMD0i+xZom1H%Ezpz8(h!LRXs1(Mc_xa^hGEiFSw- zL-iWvBu_qzYygy*rNRN>8R^Zar%M{QzM%;9oDMy!{-FE}eerN)iac;|VSq(BAUT=< z6$E7lRWSl4(D>bG{9_xcOC`XTTC$SM+(x9Ba?m66yTTBic!dWOz*Ry#5a2xfSiPKx ztw6zDi5(=Hz@BO&7=CK2#)5Y})Ru^)y!mETAU3zQ&M z2-Z}JKH$%rP=SVo0K+FDsA0YTPogLdWW^@q4WFuL>IqQNn(uReNVyO zj!5Ou!;Dv@_lH-WXTx6bobh#H7+gi~=9A?gt&OFtptO7vRf&kPvP||IYl#*f&S*E1 zzd=hC@V-^$Q_20*-vD=-z5Lj<@gT!>4Zt{06PC0BR3= z-VIWLY~X8Y;gzZ&RCcSy%gKS6%@I9v>5Votz>jvh6HGiu0W$nl2wSTpYVYA4Twg7< zRv)yQcbH%Gj{S-2^S%|e19ne-nB;@E5`US=mERqIl#KtOKF01!u9ZKZ_eFuAxN%JF}6OLxUMe`8yY>;vmXzwzQHowjVR;@BHp}V~}pkF2ym_eyd zbgRhHsd6&?vNC8s_+^6JIgT@2^LoKFz_&zs*Lt`Z?7=w^uzk~*TM@pjveGfx7r*MQhAN=CEEl{*QpBi|UL|Ltj5=Giy60}*CFMcSa5-T6h(o!oj|C5TF+shdl7ZnNb zNzG$U&$|!w)v%-zajZ*^3e4jr98PE1n~AV=6lx~{Yd+-Vf>g89rN1B0tl2$6F)fij z(ZRIdsO5E=#l8*IvR#NTrLzbKU8FK7pD|!GBIP;6b@mD(&nrVRL}CaToBa&yM&!xJ zX-+cAq`kR{tk~qb zVPx@M77DV$QNJ%??qd6K)?dT=`~J-x{e&wD$;Z)nyeB`qf&|4|?|Ji*?#KW7Jo|bY zc@)(5aZFm;b00TBT=F@eummg}3-hP9+G1!$g14{3_ZmwwAxRV5>ey&neRvX_Gc=%-v-%K5J0iGEKB&4jutm&mqUbuYrkMYI9kC*TZcIfDZ zK*BdO_1m){WNd07{f6PqpRClc^x=6}X4cgvb{=P()*0$l&7y7jbOs=gUQYC%a4r6N zg)eX!Uq&+Ulu^Ka%m%aF*`AO=^hPr7L>MpP=y}2YuRhgVtFeWqmVAR3*$R;R;&b$p znv3`@!HiV{9R-({r+oykNuv?VS0BlzxAexz-aJ?unm~8>Mm!m$ip2)$*YyHZJrH^{ zAkQ8IW+{Tm9t7;bwCDs+mR14HvN*2Cm_;l66TE7yqUi5oPz%qcsc$*eXJqPD%6CJ_mg3ieSeU=IzO{|nZ4Ng<@Ry6p$)J1J#YIx1EVvKN z+`JWL;N;6zfFt{diQz!EzrBaF!V);QF$G80a5+TlHF4!|RMH*skaQHN`AwWp^y6uA z|MaN&##RMZQgq(J>#=*Zxx!*4DfNV*nd13cWvZHgQtEsJn%aftzfs+yruL!+4tRco zQrd$}67~@XoG%Mh$GGrR7Cusr2dr6gU3gL%Q&#j|Zyq??IK+x0?1=|CZ=jVNd4kAh zTax~|3eoigv?Xgm64=dkKrJ(&Rq7s4H9Hp~m9KTM(9nz`Tbv+}0N|NW2VwD0R1BOo zT(&8Z9IP0g6=Y~vuHkq}r*e~tDCFrF%HwP%gT*#{$>LTzwpX^1^g8Mn5Bw}i^wx?T zV%#EZs=g_dZaGG?H2Uf+BfKwRvt5w~5w!Zkq&#}3FUUGS6ng94Gb(<&4Wds3+nCdHilPVu zof3iYtCplC57*`SKNH+N-q?!g*0c% zc-m6~E9KZk>0dU~zlLcoOySPVS{iKR{4E+${OPad`%0TkY6_Tgsv2aB_rSfTK(zlh z_wBfJxLLn}g4+L%fDr!-bl0&wpg(ncUw52j&v3qUr@dSSMs&f@xqj^BHMb_=O&CXd zWULvQT$`)3TS~jNy{mj#g^K+)_F^(EeCho*9;-VfcPD&U`wOIY)^lg!$xn@?+ceIS zLEBu#vIDN&GhL@+BH<<%4e{T$7y!U`89)dD2s`U8LlzK%n(VO~PbuFc3-%)ntILN1%XX=Q zp*F8>XkUkLvA-n>N;<9=HA?79H}3A6VfhO@JqvN^ePw7c&B$^LaxyYtita8k$3MIk zE&Zyq=)TDLA8P2Rk< z7fp;AZPw~dcs|6=K?)tqS5M)E2rPBFo4rwX)q!u8m0C4Pgg94_ z3x$WNd=MLczC>mr4$_=vZYVzd6MxCIa&YcpBBA5vVs=ww^-%6PvsANvgQ@y;qS8uU zxm`vWw0vCA3m{3-(p;R5kVIVQ&f}1+N&K@|v?tQot!o&TI(u2n7U>*}tJ+v7hWDg$ z?I2?GMcWS$UvvQfKMdZP2p9D?F5y7 zrzaxMV>R}Q17onKV-<2(QX-ojaEGha0SC`vpT(6RCTDeE4WbxU{!~*?FFMmT(8gR# zFmqAXaK8D<6NVObLF}yaR~EohfxP}*sZ4ei2ijbd!DTVbz4PRfnV-!2EvUrVvD35T z@iWc2(=(l57F(JRA_oY)e<)*!cK^tylQbG@?~&?_Eby~Zu?EcS(aQpy-|4fv8&To4 zv#brwKn~!XHeVq!{~5HQscaK;W$pNvxevq%|;>Xnl< zSV6RrjS+s%M~bGl5Y_uGvPa6J5`VuAkoHs{uDsqw9_;9q#UD{d9?-O&z$`?nUJ$h! znA`CJ@wbV}+*T0W5fSw+bZw*^^_X$-k5;K#M77XnI-(<5Sx8~*IE;%8aNA+6GIO6 zj8B3~lj}0bAA`~J{vjDg9~$U{pU(Z?lpx-M(fbPu$WKw|tp|~5-zNr0Uib1h>l=T8 zHphwX`^mhxeC7xCw@>27N0HcLI$zMZlb^>T0w28yUw_*tnz>^hk0nW5;w-*^Eb^i~itC+QNJcr$_?NCDp9CdSsf0a`$KB7?=C~w@><8%p zqqAuK>mhfIo?5k2*)uHd_@y(4s?i)}@<~(4EjS{(bS^))R6touS?UHjKO#!l;3D6= zoD-u)7|$d1#7Z^AiH3HINX%(Rjg_a#iwCgu@Rc-@5Mx6>WkclCWP`7a$uv@LROCwMw?0>y?Q0{aY6f!o2sJT+;gNRcB38lbItq_mCT_dz@a zY@*?J_gq6xZu&tGruhncmKi4ogCE9l*(b(`2&Ji~z`sl~tYuJ{CNJ&%3kq)s<1REd zNpiCGuymKb-ki5WyyOkjufxWfe8?5iyAMYnXc1C{@a%>{6-#+r>%q?v9B7QP8wjyd zvV+yeXx$#bDE7`^3&IL(q7F%uJxIgksPq+MH%09neq`4Zz{L&0_K!C9Cw!Bwj?dJ# z<{=m(gc@EB6mouKnc0bKf3GBY@|3g}r=<;HHqem^D==~r_2b$6!q40}i!MW2c=dG{ zN>i$EvFOHE*D!L>pxObpLG0kEU^wV9N|2wP?G+5e0x?Y$XijZaaE#T(?cyud&)2b= z9~k-mzy}zsF`#mjOhu}Lq0ktOpS;PKdsso4GoSo?7tz8d7xpS35rc=t zHLK4z#C<(3j2>WU440exE6LC=8j_5FdlURNUmi_GEKtS#s2is#(?gRPS229IOWEbFyCSDuIrD8?TeBST>?ZP zx*9_kQ6)GFjZ>e2(x-TpZziQxm21Zs5vnRum{D-$b@f)}wp3|vsK*lWnah-94~GlpOP>7dOPOxfJwWaa)X*Zd6I)0(u2 zt_Y%P5W!xoP!_47oJRoT!HcV?s)*u3U`Mp{Z~>jMlw88la1+q(B#TA-vN(SJno_Gp zNS&OsuIY%&fOtSuo>M<6mCwip)e1+k7&y>1FR-#|8Y)zTWSwqZes*<>YMI}6hGM0P zT06HjAaY^Ou`>zV{uEL&G`h%LKPc1VW#nSluX%s^+;lTyn-C~@8?-v1H^^mBeG(Rt ztrE(|3YOZ~WeXjpAgGQa^1x0w9e@hW%M_w&B?%t!L^J;yarB(DWvsH)THnw_44ktj zozd<5?1@6B*X!lrW@q;@t3CX?RCUwq^>iL{8}gvnQ~&t!fNmZWgRvH!fJ+cAW)tJm z6HrfBK9^Zj00rEoUEVNZe!jlGITso-2h-9bM@pGWv#39ilA;O);I(JXnH(MMcC(&? z!RJ)Xd6n*Y&%Nc-l{93gXAcM3F#u-g=5rEid6I6%qGN&QjO*HLTV5;sN@glG$-!rT zj5bF57l;j^pHLNJLW~AGv_*5-SV1iYLG@2rY&?%`_Hkgqw11t7*skluNY$c^GZq@L zYf%v`KfGhFHczwL=h@=jvCTC3Mh^1R&6X8T{nUG|z4%|Ff&m|Iv!aH=8TGrO685$> zRynpV>~)GvecOZvhL?PlKLef(lg5~UJ$Q@_BbH#s1ml9I{T`IU0t~1SgXSZqg!#MW z?5Vk5<73A`H`eDH`nDCljSGJ_b$@jm-LLa2RR6rPUQ6^U7jNSJ%zIc5oYxsVp?Mxl zjf*{MvMT>GspE2z>Y)v}K2ZMGf_p&T`#9f37}s|3;T2{DG!}mlvm%#!B>eg0JRjVm zZyh?K2~&^97Jg(>Z(FQfR?89>Unrzz0T#D8cZ9MmRUQ40l55@EZLDs*YIGeQhnMRr z^0r8tKFnLzi@Hr5sEY`e_C&7Nz1EbtVTV0&|E_uCsVqk+en#fnPzALfu5!e2!`_0@ z3U98G8irV&!X{uEIqHL@X=G6AsF}t!$<8Hlrw0GR{rfPY?5F+_c1ge8K!1XJyO+pt zy?6SRe!PmWwc;Xj2mXW81FluidUS67770c&f)Q>85Lx6Log4$1d{xq&m633GBtR9C zh9tOH$3kd64h5AVhKpP#Qnt&YsuHTrPx-RQDD$+m@;rQ9c7uiG)y^6#P%5NAb(Q;N z&0tMgWj*G4rGx$?`-A)B`?}?5@^bPLedF0RHS>!I@6~EF&tm&<(#5Tti_c+P z%MUB^%20fUYsD^mJM=`mtMdgrqN%#HqH5)`?cz)J%8MJQ#`Y2i2WN7>SN39rN=KCT zP!d6(RftAfp+j47{K6wODI1Rd#5h1uS+x<$wIBc&nh*okt5xiyh`iWV;{3AZ2|EnV zgn#(nT1oiXCOip3=8^7=S6?l9+}MY4#v+9%Hd|x{4WMGj7_7BK=*qP1c6cr~w8^-% z>0wXOyTx;B=%ai$4eWEi2ny3T&_4NuRkS-)2|h}yKL&J#$2Mn8*QyPy=!fI}g+BJP z6A$NJw=ehWasYVN2>6dLh-dS^*ML-V^*Mi_CBQaI9*EK%up*&tGMiA2sB%p@R1a*s z{VBwrS|Y_^ggp$R_@%ZUPjlY zq{lza*(rB{WLdJHB{as=Q`$kOHkC@i6`MG1wS}(b@$@OpcF;iCXvkc?TBZSPD(Fj? zRv#HYa54_|k#qv_ZFxxo*WEKA*Ik4;;H-7yFRI@1c3JV3O~>$JlX8qYRCy{F{CW(V zm@9;UGPwEp&Ey^^&sE$zzDxZpKU-Q^keWHIaU#>CYi!#Z9%R3bnj=RSj#8`hE}-54 zAH|jP*x7I&VK=Xfe*!)?ZtJuqU7{bAOcSxRHH1k8I*-3UqoV0rhtCQgw7amQo)LKm zfSXf^HA77#1X}KBq?|NsJ>yFmK5uuYx9BRn7msb#h9x=%yZgOe*tWUzRjSeGx|DTy z!Te$abx0L^Enk-T#I|?h{#J4@rlW64mxsRmKSp45L;${AVi?Z4msW1SpF>G3uxB2> zkD`s%&d!=SG9{I2M#tT@cG8ckRDlPy?vp*AREPW(fbp9EUAUT*8mw#ZUp=6c6un}0 ze!Al9%yr1$q}s2KxRj<_`L?yoQopxm`nRv`9Ynql6y4yUxCDTRC&*Ju!E1PT-BE{R z-RZ65DKRGjJ(IvtOO|(WD4Uqtq}mf5xUgNi7e2)amJLdu6QP@3`;Xg%(~##o2L=bI zIO9JD8DTGXYnKp1gYjBneLz}du4$(M+U43LAgZ1h6fd0^WFB^~B5EHXckX;|^*3QB z&tL7`jNLt#cQqHX%F@jmOFNHI!jHB%KP+tOJ49|dPMXd$f!xk zw^eLmTw^wi0<8rx!-1CJ=%BZH3b<>qOHeN0|4=#D;o~Kw^82E!A5l?^nbeJTK<^+H zXXIh8g+Trnac=@oRr3aplO;siDx^AuuI$&f+_cztB}qcd#luvxK>F zhgL@Zi5oaSseOif zu~(^{?o8L4B~pH}MtzNR2CN%!aPolJqpuVX;B^LuWUKq0-jH^zPxZlvQ`ZONr>7N3 zL`VEOKkC`m3wsh@raju6n74j<-f)YY%CYQCT6?svX}t?pygblTak^Vel;XmK$mo>~ z*EzHMKG<~D(A+=on3YqleW$qecz2JiqV!`*t@p&&4u9*OUW7JPpJqx&q}oYe;?yfqBnnZmHVa@8g5CW`#L>f=v|ni8l%5%!a>n@ zD!VdQtSBA2Z_I<%bMEyPO&1!~Z!gXtnIE@r$YROkfj;fGC$D^ea$z515edbs`hUo( zn094VYMk{cOISQ^>!AyqXoiW9^&vggM0g1Ao6oJ6<{;sE=N{n@E`>@ibmmmyW_nA%3Jvb~lEGV-QeUuq;Io+U0eT^0J&rlL&%IM;X%br1(qH$~w(SWY zlS{*{OpFYq^NU!G7Qjc}}uC6R#AGYcv=NerQT6k^aEmQYHH)T;_#<5yNb5#0MPR=k_bq zP_pxUO>)!pn6iphzFTK~e0da9M`-DrFzyrr-A_mYQ;{gy9Gdg}3F z5WhC=VTXV1tIZloyKYWVr;5y8U4O^Z=+Y)BtRK6**HrhF4N{ zf!pvyafjMPR@^bWar-Y9?KvfJVqE9>VG6GODmkOvOLqhQr))kAT{+=Fa}=@pb>ol9 zZ>evO7OJ;*R2`LfwcAiE(-^6q*QVXsG;`YCtdet|^V@d!9=&>-UW@h3saFms>x67) z-c=sCRx!z>YDwnD+UL#bQl(eh;u3-#)Wf!%d?t2arT9!=*^nzn>AKoq?v6aW^7zhV z-m&M#QtidjALi{^$yg>~@IB0Xy0OmvdAnYeW^j+Y?XbQK+E*9!?QP|%q_U_z4|EEb zf5_5q@tC$F(xzJbZQ+;i)B9MDtgW(XV$ZL*`TlVIxg{sgOp!bwpLg{8FO3T+ntNO9 zo{ajKuN~ppRU^wEKMt;hYiV2~)9&$S#{@C*P zW@bs#xKsTPZ>~4yezAY`t$#Y1`xO!og^v&>9c0-NQ*iJ3*Pksbj|BEeZe9c}hxmcKGGmfqhpU zF*>O2HusS&$6ewv)W`wX@8mHo_bOv@$T5; z{fXd(i3ayp-?dtloc(He;|8eWV%<08hmuAYMBe;V88@(@#ZENo>DpDq zve&=%oVB(7(f{gRk;`EVPtMwGGxyY*J=S$W%RAhx54XnN_PBdLee)-_-|QW_i5q3@ z(>`9%*D3rSb6wV_^4q4@(xcu~k9y-XRekkG`D$;)^A!e(!{0u5#xk7DsY|_cZq352 zb+Je9Of4qj2lk&b+oHH6{;=Civ%4ope6RZSb^Z2wr9nq)B;+paa$RAXSG(WV5gYkbEcW~2c5>B)zIls8tXJB^21K%Zk-1X+)o?i4cyDH$|_KX6j z^M@TDhbcQONKaHAZRZm=BU$I$~M8zb3h%EpwA9nMR&mZL8>_5xB zMNhd04^L2@p1umSz~0WAj0KD+9WXJo{2!En$u>0?Xu-dEZUEi2meYB=^R-A{n_zw* zS0q>jendO(ikuTs?2CT-!~cU66&01$R0j-DRU0x;RYOC4$gm;9H1yFgLsL^zLya-E z@H57~`;VxyfOT{o)%G%64@fMMNC9fL{vevmqM@3YS97_QBe`mUcJ$HsUHc^ zUSi^sy``jO`iR0y5eW(UjfhAuaS>553G$`92)q;(8JI43jT(|K6%>_}`wtkXqN=8$ zIm|>$TW2^!cLdXvWoB++$sTEAYiIA^=;Z9;I>BqA_avXmzEk`-fkDCCkkByR%-PW~ zv2pPUa}wt+PEJWpTe5UndPa86>fAMJ*R9`>x2<4%VNr3(j?%LI2g>2|XNN0~9IZNY zw)))p3m0oH)z#lB?_MN6jEstBDJZ)=#_WbR;_a8bwe)|07>o*02u!zW*pnpS| z!r0{hf0R3$L}bMPZG~P6B4b6CiKuK6>EkFVqG~*2hUjWZNfD8X88bxun6OD37iGbX zL_QQrO7`xoMb%~3GZ!yjB%-3ac#*8^qKlG}Gi39Vn}*A0yA<*K`ik$?%yD#dsoW!F zp|Qc()|SUKB?zdYqj26uz}<=Yc0^CoJ#82Y=_S10Q#d%2BcDeC2BE|z>!D6d^u zFRfLomEoXuFQfmZc8?n>o)@K=y#^}hIeAa$-75>4WEk!&)RH>9$ z)J0boWm?-xt1Pp1*g&jTyCM=IA|fl>ud|NA79&5SmyWFL68Azcy}}$RgWb*(mJq3_ zRURW13rh_g45tssjwIQ$00WS8T$Q zuDkALBFi<$S*zY9@W~P7WVvU$WyYsB^Yxm6vq?dg+>n3Z)UYh{#&^zB@o)amxg4iXiEvRrHJ zWRmNL>lde<(6!Nb077IrYi7AA*eJs{%DfdByDf-&$$FtuC$*QmxmDyeERM}+46aX4 z)|Ic*YDiroKU2L>=LT<^a&79O+O!c4SMt;{bj9-=bh4*vO;xDeVCj7+$InGGD=Yud zL1)Wy-$khni|m~=H#$2zONvO&Sk+mNSQ;!cBSb_@Ok_q)ikO&AlWvirdwP-P+9GM~ zOD^K_wzkO(gTwh5@(ps;@_ch8KZojU7Y_w%t>|986yZPRoL>FwMQSvaY)!-#OFd=f z`K|VN)|}&3Ya_0x8_0FpljR?2qdcIoc8_Mt>`Qv%(zGsa;RS}cr$=-BrXrbRXbpPc z?d5TCd(`l=gVJjh-BVXvWU)QGDi%*r&$MO^S~)ze)zJl0wrVR*KW)uhqO{Gx*>Ls9X{%lDuB~+;Kqsn= zOT;%QmFl^>%=OU8avS)uVxX?Lr?cS%eq5x#!|^KR)J2)hVe%WDbpm?#U00~2806}! z>65Z)wVy)-FGA~H^Pvpmv&rU2E&?`sH5}ARW@sLDvCvGeXIShe;2}~iwNHxuO6xE? zW>}7hm~rpU8_Ptq(@$TLGFWdjQ;i!TCT8rHCvm+%M|AO`Sdo$IRpng7HHsBmcPD|s zo}KDhm{)7VlPDEkO)OKCld>-=^mO12X!VSG0UyanaFV=GWt{m$L6N- z#0N{e*oHc5OBrYlo-jYh`EX&jqiu$UuIoB!R!+d$!a6sv*8QK|6vKAI3mca8{VSU8 zPQ&sFJ*lm>s04V%Po|5CNdl}vmLZ5Dso&jQ_Y4t*(HnIA_x{i5UGk;S$SDm zS!XiA3NGzzz}x|qkxcdCX(?7`*oZHWW@u*Uj<7dwj4YD&bI{4qE3ucqvO(eE`FdSx zHF-_<4E`{A1!qMMj}UdqIvcCiBc<{)!d&tXHCJT$=Z!1~*VfI}T348DqnQ(>HNnq8 z>tHIQC_UPHLrz78Lme=UrNZm>GhL3T z6pv9{zT~}G^-LG7dY;7{d4DPn9qwzCn(0FsiT%08Pt3U?3a$YT^vu+hqJQ3+;Xf@W)DqNnXmC+=%`|5xdF3P)!EQbiq$wf#YQVB`)FwvM`;|U8S z6CLKnI!%m)+#tMgLNCx)oxM<&5zs=FnbRR%X-tBI2NQU}RnQwIVPYb9V@j~75iqB- z;Dw-;8Nous^)mAI22f0M>K-65$#j9Yw}~;qLLa9?bxceMQ?f1GGYJ+s!-soQ!o-y9 z&D$G#Hl-Uwxu7w0%%aQ92tgHd!jzn$d3#$BCT1j_-rkmkDUA&qiZKQ-bkAsh&_r&m zzmccCqmegvPAr)iwVO(3MS(6Z5yp^i#VET(m=NY9NS6qN7*z^*p$ViH)CIK2{#_!> z2$C{m;K#^|k4R4#lQ~yU$i9vlgM0Tn5 zCu7F8Ftjj%ZG4spL7=&rp_wuKK;Ua&Vra=?gESGAOmjmP8-6S-h@c1=JRp0%%mf)* zZy78iL6CXI{}C}kkzHM3CKBEuGHgRcJCGQ-nz0B=V~|r8;T<8vAauQF%Ai-q1lg7p zBGky-kWIG2H_(h_ZfIhTT8#n(O~*h(Bm&ScR5ms=H%7$t4yIumLLI_8h%f-nFlG|o z36M!Q#XN*M{tSCv7@rBj;Kb@08?xa_ObnxnxZGIXsot&#IsM}Po$0zo2d2IN3A zN4**05g3|bVf{<@fJg#N?U^hzAl&_U)R!s2uyes(K`GUNiJ>_b|Dh%3gsGV!(*)TnL_%BwvI#Z=s|gf?eL;E!Sr-sXfm$&Q znN%MPJAPDRG+y@!V49hb5J;npKp^DJ;U9~-T2SavJuvi%@zI>1a4rGFH{wSVu!@C2 zFgPJ0yl@_vr5H3m5;KMo`OY&gFq{|ERqo&|Gh2pbX>Mo+M&8_zX<-Q{8=9M$5|&^L zm_#&JW-<{8b$VJTT*=fDj~~37p$Rrc<^&1L7<>$y1Zcr#nX@PZWkO&BHQ{%7VBsu~ zEn_2*MBdWe&;rJ7W^N7^4+sd*O~B1!FS9IFO2zfbBVgkL)^pF}4f3Kf@Dj4cIq6d4ZuYk@iNCkFjWE@JRG1 zC+HV+d4w(tLE#cH+@LtJZ8WkrSl0n0SOMGwtWYAsiHYIH#L!IyT~VgooE$|L5qpvc zR!j|zO+hTXh9S^3hy)M`g#8$zrYYDD(vJyKlac{MO(7lcK}{1wka?1Wc8CpFV!*qR z5X}G{0w6fJ0rCYgUYChl*a6+(;(}NJ z^@$*=0Y5T?s)?x$uR_VTKvcRDATDl1*8p>vKtiQU=o(=}kA5bShSS6XREi=4l5z+t zFz#TSpc}x&1l@$|8knLh7ocFEdIRr3l%WqMx(SN_ihuwD z&F~B8$`qCNbcV=VpvX?xhEsB7zyc)9**N5~02L!0r9eIZlR#m_yQ^oHjQKO107*n( z7&vAD0cc`M!%hQW3cNy!({7T z7zvv`a9wcd%g_P`;}|0l4jh0Q0PCTDFxh|-{3dM@GV|~di7XPSq@=bG45X)6`$1oj z?h77hy@ysv>xEij@s|5iz zF+S z2sh=^Z{m8k;YZSSNSlwxB``&J%3=V{)da?hOeAUH{Ats|g-DyUEuo-wfIYG#Z~=kE zS28G|Ob(R85I}i>2y^ImQ~~`s7d9_Z5W^@?bo>C#us#5(=-PBuh##nq>3)%6B+VjR zDC>o2(AAc15yT~sJ%nl?tR$UjumTJa0H^=}Fuer^m2N=+pwXkoWY|M#nQTJ~vz}hW zQYb(Zh!eym34{SvANmAKg66$0RR6({{-KBjl)xy_&xjJigbj%=2oyFgq+o&lA|C|| z_n?>&2?+@b=Pt-2G4?Q5q3jA6aw>v_D4Y#)AY|FG&qT^W$NAp*iCIZ7$H34kJS zl7LSofdHX*bR|?kF!WJHunj~gUCxh-qU++9Pzetf_PkL*Y2awQ2qgWCMve<00HPfs zHVr^Ej8_<4Gm=QeK^QJYl1QQ*$w36i_rEdK)Xy5f_BE`R43gt{A3*7BN#*|X|3S4XJ2G!3v|G2f(kTT0W=ybNM<5FK^4IOuy8;D-5)_C1A2mkQh-ZZ zR4`L?0o@U94CUk~0gBKlX@Gym7V6SKXp{ul3Soc|2Mq8O0jv{g!i5?O>e54`yCcmt z<%Pgnz)T#b#lSUzjiwccJ3Ee+Z$S}qC7^y--LYKLD$-NFVYbhr;%C8(N?5!FT2I<6 zvO1D(+Ebt$7jPPgNU{-b0GqDqA3P_L^BTCr{G+EC_==PpSH|RqDu0)92spc0SLpR0 zU9=Y!=mnEg4$vU%e8`CbyaO(9QK*dzFa@CsrW0Ie(Kj%4MYPDE%BJwftGy9p4G>m%b=f}D~8w4SxWVUTrjchE=x zpR&IQH+rNL7#caa(nvsV4);V47}QySF!hQPN>`=|Lc74xSdr!!;0oZ-Xz{y*niMBX zLo-+#5Eklg<_6E*a3F{xeykaA#RGvWM1~k$j1fFT|M;2gAGnL%2S!4uHR*4J3$O}8 z0mc%pG(50ad^AHaqq+u&xNCU+TN8dH{RT4_fRO?w)E$iv>@ufs=?(+w8@e(5+!HgJ z5;TCGO3gHb+-bMD8Tff&tp;Bul*}-o>LazLoR$xn+~LK5^Fl#YAlMUh4d=yzGlIKB zvf%I93R7y+|H&tLP+cI+08&Td!NUzQWvFYad@kiz1a=aLK>^!EvE_h7YKNH~cMQ!&etxq?WU3_DS77YKs!K?aSB=62XJ({+JVwEPP)$oCf>BYFCLqC$B#c!>lIO*kMuiFFEYX;}J5jZypmVVWXngJhTn7>48!K|*?fu03-? zkZ^+~Rx-#p5R6v9QEK&(1^yJ*ffNPMAK<`}92iK@1x#k76aQ((ji-muP$!r}mI>;RyGP~REo5As9vG!!uco(WDo2bEFeL?TBaf;u=VfESoFs48~%a1%`9q)*{U z#SI7urW@SQb!i|pX0-Q5U~pUvo`bF{7!q9&Di{Et9)VyebRD52WOuzq$wGWw2N~W! z*dZ)Eu)fx1hX8l%2#`Mk8HRB)$(S04*4VE=F^7z_QLY1?=r#mdiqd{vb?BE=6QRT= z783&&%q)#znOMj|A&mmYAyR;xB2|Ycq$(tBp)8D4HbiV>G0}T$5(M>-2xIIiMePDd za6%~s5QrJs4-tvf5?X-_0HaB;vk24^6q3KmNgd#UW}H|gdulEd;yijU!+(k~$ofcg z1<^c?+0hh`jv29|#@q*kh@}XwnE7xG#5{r8fk z#?S^viu<7m4WD3~`Rb|EWF zy%AXTo_cXelW_s z!l2;_+cmDB&tdCG?=AVACFCeDJAV!7>FHSfS9J^2$O>026U{U|(Pof*l^7 zbKq@zlykzH67aa87RVg6S?9O)A`5W#-J}k8-E(3h)HT2)%>^vLBcOjk6-*F4ef4L+ zZZ*UiaLu?STrpYTN|)1N7nwSN7eX-*Adj0tLHL7#%RtZ3Mv;weIYK1`9BSLjznuHz1uM)W8gZD?LamT>~Y8=u8kq3i|)+ zP9bPUqxL&sN_as+$UH0)%sFhMfl&+QbU5t{nuIo1z=aCL;>ag#E>S=hDo{5p%h)8N za%4WcTA?i$@B~VUuh=NUGuo*E7YZiTM9?1&J4qRaeIgJU;r-r7zCjjYS5}wmkwFo; z*$+1UA+K%7f|22ke^|JBY#M^M)Q(NqVglr5QJd9ZW=k-f<7oMybPX9N3`(d+ylE7S z1+uPPOM|eF@-JAJSU}8+wy#6l0=BE82@Kl(3>(#8Z)FJDto{GURKw_DzcXnPLG-Yo zqo^0(fXLx1AC^SuG9*&Cu&0rRrJg^mw}2rL${eF{2zI~tV8I33h;}w$>&fqFtq78F z0*ZFUcYs4rbJb&8iz%#^!=wTmdq*;!0DBBBll0kePfm2;28M)<7aAu*g|^#p6*NpF z$i-@mFQ4+%P=WOCa1-{M5Ba0NKu!MUF90^yJ?t;g>=~R4+UiZZ8Tu94o`?NU7@0$W z+Ov9k7uedr9WM^3FhapUs}j2btm2L%;~v~Ms7?3c7awz5>sd^?Hw10{UE%6Ng9s-DT3i$ z)_*p<-3Mq1ai1VPiFV%rHGnaAA(*~Wn|WgJL=gC7WP}nZP_g?3yem$E<1972MOkVg zXw)OU(~+*-V?QMg8b#O`i69E8vGJoxcn;)cE^PhA-MNv^?&M_-4j2H*IUE}jNe@bd z1QxD~FHGs z*!beD{t!AdVZ#^8(h@cc(!2Z7fgw1vBfQP9yGHi}Y-ULU_J<=3k&(2`$2twlL@OL# z5eK^ml8b|Dx;zYJ+>wt5jL6eUU7ZW}1gFakO-*20!=(EoZQZ{PggO#}r5}4O>^=~g z@C~8?>=7pqWxx=0A+LZe6yDSx9!}_WM-EP8P+RxAgMniL5CoVC!9v^f=|dynuc+CF zncz^8;JgV14Fz)x$myZL*3;zr14&?)J$QA@A(RwBQq~pzBiTc1a}dap?{JI` z>x$Hr1=INK*+m|%L%2AfBFwZ9tA*)soR*{G8=Sm%)$z&EIY3EL2& zSak4)Hjx5@BshIT1*cdtv6Jr(2Fx>L6}lk#quC{SdI1)!v1>AcDr;Fj)LMNN`m>lAYSf53333CrNR2^577qBvQs&71QyM}K=a^2&BrLuPF-e^ z?+_kPg=#>(i$G!trAA~OsuYa`3cGiK#sh_9eA0zK&`%+C>|ZC0LZ90v{miAj9#8B#nP^DZfTzWWA7g-0G2G~QZm=QY9mb0xg84yl5wKuGzX#%?$%vt6T0(HT_NPv=&{lI*J-b|024B|;J4>2u9pGXMf;*Pj;qCje5 z(0P$)PIx%;zv<183M2ro7gMn@GR(IqQz z1f%(9`D4Mc+@9lsIE<9PC{8p;TwFLOnpOfsVlqg16gP+$!VALG4CciIg>!fjn6+@0 zm_ifDEYen}8cPJo0qbLt!U}l(k2(S0Qs{vb+D}4yUs~l!MU3QQJw%7I;QP1m4TW%C zC`{CZB?`jdZr~tA0&WGJ;9FGe^mwK zu)y5+7zUgJr>qU820fOZDjmT|M9PlTIGPJ~2{KezeBqnEoXD669=JIywV+J_a>!mq zV4PaUEwkUSP3ReU#CI%RU1G+9(Bt%(D_?&|U1b*-x z61o}P>pzjg6pmmBK|$WYSYWG2_X1~C;Al`7Cx&7N42Kg3#yFZc7dQaL(P&?NG~5H} zkW+|`3rCJ31V1=(gSi26V036~{z(-$!5FAoBx}-=SFbV-L1-=clCWZsw0zjtX-&rG!jKD60b2%~K8vsHKKOEUr0+$5q z6R`J<7cQU?=|2G{eqbzz7YS}#&?7h`8Z^@wGV$mTB?KXqAkvu4mSI}L_XW%d*q7Wb zP7<^Q{|zaRzl23hIMa^&F65K`(wq%pBk=vtQPp3Y|EAkelY}D(qq;u0K)AxzCv04z zxuLw6Sj-1dyEAu%3Xqe%FGcMO5JDxf0J=f4iIE6@R} z(!G0t&WomvH7_1SBO#I-9rH(Kv5X-~hF`*w6OGS5V1uL^(o#a|Mw83}rr~4&hCXKw zvI9Pmyz}LveGm{;31f@!{0kMyR(5<)xhQb;NKwexaiXVC>_dA!HD4aVW5W1L@!`;A#_%zC3A}T~j;?W~h z?GhOTMDVbOPk=Y6`;=;D+q9H(J5zGJ}7WjGmam5kAURjgJDa;1mrf6Ail{0lBD;W}$rr zbYoLkp|N0t2R0Ej$B95HeTP5c(&N)DG)M?}|2D@o#;IN=tbBnb1SY^5EnY7K(}_wT ziHjzlc=p-jEhrxK7VtvL^FobD4*ab#yoJ0l^_FP{aX6me(p?M96wM&PVF^|keLMx` zyD;ZQ)}F=?Pmjr$xLEid%-7Mh2{k0A&t1*1TkL8E`SC88fEwKlAqL-y5qb;p0PMj) z&*eLW{%H17r-qcm>IHdkm)@A?QHg0unsJaU~!IKsAN9 zlZif`0pA0IM|44t=0FYr)x98G1}qF>7F7YBVed1j6DokuZ4vMY-y4QUSZ@Ms;n9p~ zf*)DXEC^K>F2L<^0gMD@8|bT9`_06FMK0NA}CTqf+#pZ9@9 zcXJ>l8)%BS4v%IQ@BtQ*c(4bY&BV(Qc--JO09X70GSjZ_`OH9ncuY$T^++j9IKOw1wvG*tl?UIP4g%V}1Ym%xG6&_Q>!1?YK8f=Bm@AM!hG#@#cr=BLHt3NBpCUrf7VzZ&0NSI3 z1cB=yi361)OPH`T6%F1PN>I0GVL(6(3#5C1Iz=u7wR_3`1+OR)8nZ2d%9sW$b2e~* zWEQK7SxiXtm_UY~?mYq`G^9ygB}_hyrRfsYJx=#$*VB0%xGTy z{vk@VZ1b;w9vIlx^$~gJ^nfgznbpR!4xh)QturL#mVtfV&fKjPfF=$ICScf`{AqW zdwsr}Gy8Q|W*N`=)bh&U=7$}vj~9g&@n2?(c|?6X{wcKfXI{O(cT4TE8AzgG-~+gd73$vr9E{ho8jKZS?I-mI zCTK?n&764e!uM-6pC2k*+I=Ob&B2DfpYr=9XqGVHUicJT+YDPX95VSHAk8w9#Xe z)bcCqtM2TZ-S|~h@$|#0u_@(}$+K-QB?qy zTN3qzAXm@ARoC*|*^HLr>(}jm3+BI^!Wr4QE{wCA_p9#5^lkRXmX7Ur(8wpRE+#P}cjngJth7*viv~%T z`TI_N^~tMoP1m}xatJ%AePi!6D?eTQ_4eeU6Z7JiPUFeF&JkO%HKC;S&i?x+B3`Ur z`}FF@0Ha&%S!IJ?oQq51Za5d<=jH92wKbHfX6brbRsPBPe4h*6b_Z2t8%_K(w+}m6 ztuRp{w&rq>w?^?&>C3~kGhZ&y_qychx;(pDzp`p-n{uy${A=GFIC<)_dOJ=%8@N4r zuG6j0?MJuyS-95jyK7=6<^AcK#G2~VMI*Mp_K*l%uxp*}h>rA=!JN%X%ru7`1GW`6 zE=y7MDo<&b*)1J@)$^he=SJD4Ve;d5d_UuQnqPi*`_X<$a}92`PW;f}cgEzrs$n11 zHuvW%c&4%EXD(L?)Lh^^;fSS9QKj{Wk4I;gPO@0GAnxp)QO54HAXNQ#6A5TnwD+UQzBN5qRW9EWc=EqizFx_UDh67Y}Sn zzBK8=$YXQwm~L@TU$8L#K~w)p@3(87iqXW6Wd$Xz^$pCeGW+)gtbH!?Mb$_nE8}aq_!I+^T}e_NO#va>XME3>Hn+`v=ec`K zxN96yq;+)Cm=L#zUtbPT-Z*tlLFN1j6I>jptg|ma%IRBD{=)S6l*&UF3I-Ru-*cJVfHP5R1H^Bvy=jvY^Celf#kb5Ttla6< zl&?m);p}maOY=?@u2mhpeA9ssqt^JD=P5K1;yJ&x#n<&Wdn)y`Z1jfV+RZQPc zu}bM9-*(z!;C$uF?S_r#Ty4_kCu{1Q+p#Rvxv6B|!Tl#1zYoe-w(YHr!<+cmxfMp` z2j*PXTzkX&`B^c>t)>BU%kCbFomVG2M)I)XY139X&&%PTw_xqX;hswi`-jvte z7SG?TG0kF;nw0ZrYkWo3z~C=)=7A4_1HNxPENEySBT6Icx>4-^MA2whZ6< zzNTuf+_QHxp7!_F*hM_Jt+{X6j1|jrs=o*Mjz|lWnZK)9QPw8EcG;=sg&uEu^-lEs zu{d2tB%plHoo`EYmfvsL=l^m=>!ly#m&N=VaN>JWQTDX+>Lu~3h7>Mb)Qi#kgVB}I zjzOG$xr^FXwvC&gGJEPro${&sayLv1zjvG$bg=T8_p}i0lkW~YOO(!;b?ozBR9B}K=X-*wraJVoy+I!OKYpQ zy?$+%zV_0vXBqdiFTT#s@U?Suvva?ZuYTlP)=ue*W22O|De=o=2fUIg&63YQv8hVr z+{1T26rOF4xoL6RAaP^fM*V8D?{7Fqi@&x%G1|EAn%}N+kG*z7_m2!uI{dTg#PlHs zabp*0zJBwvU)BTdF{;7WAN2e5({X2BXE|r(_de(Q&#(A7`U4IfQ_I&KsXF3i1xQp}bnh!M{ z+BRqMbf)5)u~XUxx4R|vH;P>(J5M7u=CF;yN{s-AfgLuAnmaz8b=hGTE;3sB$6+(+ z(NQuVEzi$ib7iltPrb~wt@F|oJm%;$=~(hwibj6*4;_^FY;OJ}^XbF4->UhTe{t*k zDPJB1n{|$3R!vvcO!+B&^1-afclQiAF*0h+>OFg=8cjbD_UKLVvfSwJT-`|%jgFlk z{W#+BCf2kM2lQ9$J$QMYq3e%X0~LQrT=}u!z>+srfwz);#-wl8+w$;nd#9sQveD?b z+r{1te&|{x_B#LG;u%_-9-f`1H(jm8E>^QJZHID`?q#nXb5qo9dtB3 zwpXluO8k7>akV4h+l`8MH(099O4a(tQ^vZ?w-{b?T5GWjCugOH;+E2ntH0~qtl8N4 zXj^9DM#%!p*Pl177l{}=qef9%G4TDv=Q@%g(KBjlt=Xl#qK6vuveezSJQuNj?xk2W zlt>t3y2<)|f0NwOuad7Uq=xx_kbC&Da8vV%&z(OX+!*u#{?P1ZgYvsC`94P)d;OG+ zUJ({NZHb&+gT(7|fg@@Mx-&S3QuREgRnmR)HD-Jtkv46lOWn9fY3ppQKHhMcsm8Oq z?=i{mPIThZp>NlZPmEhP?_S%Ruc?zKs|WU#+#3_#Dl7ZcRpQAPSa99hAC_t__a>o&!N9n^srr}oN;62 zhIc$RE*`q1q~Tf{d(33^ZFcUF)j`8o9h^1pEpKOx%=n8z-+dDsAnz}h1c`z0p!3BP=BU;NgF9WGgObB-t7Ts`CR+LzAd+EWvW2Q}FN zt}k4hU0DnJ4{RxrS!XiqiS zUfAn|Ngv*}FRk&7IrU)DS=&KPuX{f>j#Uqp7k|9}L#M>b^Tz7p*NO+ORhN8GFnDm& z;M|3FY3kw6LtaLf1w69ef0bb|V5YildS2t1BRi``$~3t@U%BnX`G@FF$qnD`^M^m2 ziLze*9{HLI{mm+vZg^gvdDd9|_zS&H>(!HA7N!l!%r8_<3iEpYNi3N6N@k|Zt|uv- zCuivv)=C)2ewb15{@%%oX6>vu%I-_0CEE-hsSjXEjb3?e`8TP?4Y78K8(o|b+c?ci{k10DVWZ&nT-s}t^K601JB&q-`Rxssi!*k0N)B%}_i!I#mAzVQ&MeEMVEy8+hdy0rT+a_MSGCH%eCiRi zIW;tJb^7P&KOb-P{AF^fv~-y1g#({ftQYeuS*a8KYtVGjhsm;x1uCjGVsG}T5KmbB zTm2aE@4c5lCxZPx4XP)R=fRww9) zlto#);Ti2{g(nV-D@mDyIV{oMGt}q%f3P~WY?h2<5RPZ%G9fY@!lf|1nErfG?OeMrqZBN5 zCA~_^KM=pybW`sFcmDaqKi)h!C9?I%iml_Boql}#e$U1PU-}VqLL+I~vg1p~e|__I z?5p7~Rs^4LmUZekip?BVFpC#%peF zX#X6!dw1#kN{hM-Cw1)s<>?mfed7E)7W~`X%`pe$C*4cExkYpC%DwND%eMqJuU?<#6SjM|f~|Mfz!Yy^;`==9RwD_XebzeV z1&7b<9G!7``@`r*eKlIwOUW?PWi;4HNt&t|k|xtG&=o07}@C&bq7sm?Kbb-*WGTRnLFqvWhIm*GZ+ z>p85W=Tu7G-QK6QGq6&(R7QLC^lStF)|qO#JIDXJxmbI6tD2f@jXy*3Mf1k-)~&q` zZ;+{3B~o>xXyLBL>S(nUcYi1tuU)gAuhcYoj&=Al`4=%qRMz(CqnTMiT>s=cWy+!n zZD#T({56>axobNz&Y7RqFV|c9;}aup|Ae%HBQL(B+HD!!f99-x-!DBm-{)2GuJ`s% z7j$kX=w}yJ%{avWnWHb6tq^p?&#rW&(YFf)zSTC3OQyMes@FY|dWbvNQ)8d1`peb1 z21g>IU5?4t?Z0PuXOIjtz?PvZ7b1GVw_@_#K}j11l}c89RT|2&PJNX1>XoJPc!ut| z3s0O1u32umKHDbxXs}80tL2`$3Y>`rAxFMR7RTtSu9@n4SM5#zQ1G0)m9(yvX6)l_ zvz2$7w zz0AD>ulM+dc(J;ZB@8Z#UU4{PF>d8Y&2=gX?YAwheB4J^ zj5)I7v2kWW;KW!dW`~rbN3GO3Q>{pgLI&N^G zCctXQ>9+&gF1hzlT&LM~Zl&4NYyHc!8tPu3)LQNyBWmLue`%4EPxaE6V+S=p|5)klN0%&+Dj@M zH}E8;w6Brpv-lVNjUBhN1aQJdd8A$Od$C+y%JdSMM-w-n}O3a%ZIeYf&HxC!d6=Yi^sD2!=FF|3F zhIo?O$MBmGF?U%NXCCvz!aHuRYZ^7gZ`=Mgx95Lc5ilzH{nD{R=RUsOK4f9Zycyxa zJ7zw(KJEUGjfX?`yiPb3@^tvpeuK@*^;t0+1KJq3*XS49Y@gOgJH?(`xp07A_Enob zZ&XLdv13E>^==>kdikoslimCU_stTfjr{6+XVWYDyW2iU%l9@%mLE}BsWU09vF%;dCgslOmj`ay%0BU9c}q=MWar0U$vX?19-WN-^>TSh z$daYYci9gr-4itFFi~MVuDVy>y0E$zA43*+PRiF75iNQtGHAv1Vy*q2ZepJ%&EmPd zQBlb#+W0DN)Jopnx{`GdGyK@TFBmj z4cwilPHo*f?@=22kl|LRK$XE8{9ET|wk-+SeDeCs0iL`~u;tOmZcZ!1o5CL^E?@X~X#J@nAFiE>p1rML)0NUb`vxv}8KD$<{hHfk z5YaVZmWZaqQ{10;|}?&YBv{J?%h($*kk-_{+n0h$|GAM6=&K7&FSN&9h^N?ry&n9~`Ne0B zB__P^zrXij{0Byx#h%XGkx|c1oE^Kzkb5KiR%7FhQzjihq~jw;YX*FNd9C@xH-{Ht zJ3^I`f9(H$=jX*Q_hX-JecEthZqy5l&d6Vx)gm9|<|sUzwO8rQ!lk<&d`p;T**V1H zOJ-!H$IJ@F*cKi8DgCZad~1HPkIlLRF3Vb!!p^>Ve*I4Gw>ocP6Qo{ss4r%J>Hn+1 zZEBUv@fG8z40`c_$*S7&N=7ABqc3~Jlf@ku;>Y!!8X0j?#ChKvhczrM+j~xj)_oJL z)o@|6JT>G@@+8ivF4etgx1^G{Z-!Avik!psf-|yrWJf33PrR`|R>NY1Huk2kvn!OMmWrbJxg8&%V`aDCla*xGvs!W664-yAD5ljTkuB%jL<3L!VmD z9M`|{wSJVSPuF0wdTFa#`TU)EVVyLU?nd8Zkulak#)mEopzQipK zIFnL(%fTQ`H^cdpYQgkZit}gMXMVcYabQ*Wlq zpPM)Df4A)f$CPs+BEFIFY^!Q$$M_ZO6RpcL#A0rbINW|U+Lxa*DDKqD8}s!?*uEb( znsGy0!)@fH{H2AJ)oQ(>Q?7A~KWxqRdsRG?|ES=@0{3I*h7P^4Y035rg9DDxZ+Lb-*)DfKZ6-)Y9~$h(nUv*7yPsV_X2nq7!WBtAyz$DheKp*|#Z%DI+Z zR-vIm19Eyf^QXK{-eTQ%k5XO4oj&?GC3?qH8vC68u*mmr`a*FP5#0rxJ-^RM&>84| zpOdgH*@E>8OEXKMzg*><{?ccD_(U`(8GRxCWzy}HuPoQEYP;8@wPLmPCL^MHRkit7 zk-*{C-m5zY4WAulUSBNEh~1qZ#4XiT%q)l~>fBXUUC3+tu*jgl*SfmMiHD2o3&-vF zzSGN!w@^PnvgmoC!kc?->oV=PegD$i$H?l>prwm-|X&g zvvR?O#`gWgY*%VOkTCugm-PH$@Jb_hu`vGNQL%wPQl=ieCg!Uo^3B4lrh5HHr_i^@ zHTtbko5;9$hktwV-JsH%VHYMXP&sV3bc>ot?umoV%YX2*`CHu8Cx76#&Q{vu?yl3> z@qO#5WuqK^U22$k!^!(6KWcSx-{F(Kdpr@j#}LaH>L`()cGy=|#anx)Za-FK%&g}k zU;1wvurAWWYIN&Z;>^$B(_DM^G|$wMKx17mQ{Q~?U6<}i#xo>(=jz@YDIVWD_MQRb z;nUfwwSx|9Z8>^*&z<6zQ;V;g|LlFFGodNvM4u}8my;{!S8D2Yq&zoE-T9(V%geL@ z0kbBkn622iaqtm-bV>gy;+n18*0%j8Pwkw_Up(Tr=(M*6^CHjP6gRuaat~fwKK=3h z`+QoZ9n6VRV60$Fg6e=` ze9!%Jo_p7iRdcPfQDclbYra!Pkx-7k!t-aD@Ovx;<4=PYaXbz823{HwUGwqnUHI@l zJ@$%TSBb;*2W4S#Re8xDNBz7L?csg;d46<$e7b}O1F^E|9P+x5LC4)-V_|J>SyW#9 zQ`L1XYWi9Rp>$bU+mvPZ#A$^GeiHc-!i2CAob7^G@>SDA4S zVKp>UTp&>m>^X?RL1mL@z7J*VgpgUR8fBnJC4WiYDvQ3FDEOSo+AZEz@+CZy3_+YJ zOQ4X2K)SG#EUk1`@X{L=S`ieyo$&xC1`+DsNvo@FLW zXO_6WGuJPQ9$va(Ko#U^E?o3e|30A-r?Uvt@CPaZwoJ7JamsfefeIT12@FtIBvkYA z?y*G8I=Q~;VCaRwVA91Is%6Pldk9LTB{=e5r2QgJaph-BePSvM&1_g-n*6_T;ST{D zR+|dDqk1kQGT-^$lpr1x4cHF-bjA&(NKPCW*psn4!1|H3kHRpC@g2R>8w3vluUNYW7JpiRW4 znK1GZ4Qv1o5t0eVcW0Z3BtyR#pujZ34O9@e3`GzOtRkEyjZkO{>Z|HAH)vPgUtJe# zCGm@8vbv)Wso1ptwQrQ+9^35P2K-57q9BF(**f5}F}G?lcha1Yrd;dO3@wuisBiRn zJg|)hGQotgRQs>zz{@+)PterK{_CU&L=>Zv~^=w!ilD{tFw zG!iF3*7LbnRL}a8bjTU%ky9IS%wQO}bdm&sZ;#SbhF9VG`3~_MgQVf=IQDi>Qkjevv+(9IltH=&eTL)}StwOC6smFETl! zUSw0%4=#;JQH~A>_IKSG4K;!vIE;&Js+=j9Et1I#?{Ae0lHANj@cLn6-{=F0ho(D= z43E{t|CzhfsC4p_sa3~V4Ue<)f$NICV{*O2qpOdA5~p;6OFdyh88R8F_a z4MAG+kgt~P^63+FM?Bj>7J;Cuza+P|hD;#%2okU|T+Bd-;sh$pHsHSgM}ww+sZjgPAp~ z3^P~iJa+Gms#R!bret4?VQ@V_zV%%KHlaDMxb+N0(fZ5>ud!V-0P=Nl` zaOPHF++gGRrDwr3v*O(-H>=*D@|PqAF5Hvj^$YU~#w5p7sc&r$#}k36)8!q<5NvUS z$m8(B1_sPjlpj9spJWUBRO^$QzjEP1(Wwngi(A(rWIg<1&pf(rw0hE$^KvsS8~u7- z5ND#JQ_(z^3{KO(ggdzoj9L~1uWyH3hC|76C|M3FT&qkrx~WF3Evv`SKa4~sq6Au+ z_*~+;Bfry~Cq~hxu(-K>R3Ts`cQj#YDp%KX{ydC1kz_+W;b9!ho__82*5-k0pE7J! zRsy!rEn2-a{aJlT3-a2D>^rbJwUy5uX4sROaoV_%+RXKmzFK?Gv)+sRtOJD{&&y!{ zg{cS0{MMk?^g=OFV#dkXf&+7*3Ewik2rU`u^6dI*x4VY_D#AH)RZV&z$e5UM7 zNJX`D0Wl4Faj6_4X*o((E?#vi^Jt9(-(|H#`14nSiv5hz8q8N>ZBCLXV-|#!3X?M| z(t>4HgVqb5&f5=uxcqp0Ip;k15rw}of*P8+xVEyUoUK$7cBs^Wi}02|r)$Zr?Q(?T z>FRnhi=7dLZ)SEe?k?X*pr;W%s;Ia{MV}zU^b0-?P5_3*c{g2iSR_KHSS8gzjq>#) zA|8BH5at{*cYD@4kE83c=TFefvO0F74be;v|246CoXwsEEB%4p8%k4F$42$4CfTKtd3feR+Dgf;ueZhV6IfSlpwooa0+|J=O z5UaO+pgBiPoSKW#Wlr#eAD<3fz$8aDKA2}?eFC+#H+A8tBMAytu}vJIk$9s0S7}+DV#xW2y!DV&x8hPciDL(Os{T%k(h+3tF8O3njh)#0v1e~ z9V2P`s-PdI9W`dizlhX^0ZtK>3fZkpm<{9Z16C#kc?IA0DKm}aX->BU*rF9xTuCnloN>#+ycCXpS?s3lv0U8bg=Fp+NAH(=+S2(UHFZjza zM6wxmGgFJwh2{~BB+|$8=T$%!-|>g)pw;pxVyo`jPTz{tARXQeI@{|jlIn{9D6e35 zvYHKpMTrfAi>l8be`5G?fDV}QO{~(lPNX->6Ey@ikB+RJP7*|sb#VW}p*G11A`OH; zUgiVJ%EK=mLL=9pV2n~YS}yO_nBGEh-e*lN&N;_kS^0H>IPlH&7q82l;?6cOxj69k88Q3?vah=Wr4ws*hl4%resZlB!*$EiIjfKPampg+xj~ zrV)wMA@#j{C4WH{(@%_X_rbiti)|W5x0Q5dP_VNWJE!$ zY6#{rYZ%EAt%oZU>lQCMRJMeJHR~zG?gh~=~)Eu}KGW=LPboy3VQblF>l(Y-> zXj8xhDNLl&=WBRI0XdA!(t`7LLwnS1^PG?PhT1hc_3`zE6NR)edPrf?d3w)g&S5g* z7sSS5=lAR7im#r=TqA|;3D2vQCC^$kte)VjYPylvNeXP7$a|SL4KN$RYViD+A=gka zewy(cb8IXnPMi-z^6`jnqi!~G@tyNZ10J?HmE0py9w%<>3l$Ug=Vx^{Qj7_Ovo5o9 z34u>$gl2N?RO8gNRHm&dE7H>`$~+>NO2u=cp&CjNRFbhiyV6XVYm&$8u~Wf$1*AA~ z#<91jT!sq-WlD?ggTJ=9!YXabXUFTgEgU`JwJoN6)}JhBI~wXmFG#=eFvew9fEl7x zB?C?3kOHScLy>NlmWGwq*`YsBujzm%VOf>)sTYv4;ph1*DTZ73+#E>%UIu=h2b(UuF8CIysa z`wSb#BtHRex~EXC9oClacEqAGhPskpiPip?H&Is2?bEBY@-1}eC)tCgbV^K-6qob( z<~7*<8xCf`EU!hl@=U{k5nJ8N$anxo(S6+4s8k2W+Et;DgIt=9Zt#Zk1t`{B9_C*$ zAMlX;{{ZvZSy=v#`GA$U|M}LV1pxE$-m)Ba#GZrC`rO>(Pqa_LVmC=A`~(u$2AnOg zDgE^=tgv$QEHn`R#k!L2Wd&&v<8gj6JutE{p{vCi|sS(!H$OD!VK=YCBN z{Q1B{ms?PmhqCmPWx-7h)nfJ%jc9x7aPipb^)}f4b8DCc`C}K0Eg?cw00m+Fx2UJ` zt-PQ|GzoIxTXr#upOFQoJ5b*4b{9SeVvR{_9Ux!Ued{LbUOaHEkF?Fg7D%$`o4yp85&$;#8Ke9LH2z%$?!*R0;;4r zz~+Er=w0HSxjA|wh3h3+dXi^g@b%|@1{%h_?LvdAA<4+yfw_RfB|3=K?RvJRu%T%q zJkOYdJ~tYr#{xmDn^g!u&kIv8R;og`$_gmV=6lq$kFB*c<{EG2fX6!kOBFxQ;g{x< zy7)q7$90IgRJi=sN*}ejbLYxCLIcz>A9zVg*P_*Y22@$os)jwWs5zXO&uvF>#r~0; zzjyL%7qc|t@XCFNiHu*z3My)Zm|#cgmFQ`*aYbC!BIGQGcM|UW2P+}(`eJLI$x}mN zODh+51H|(gUuEH$M0NdM+PD@QyA=TVT>z(Qv@To=&;=G@Wf--?MTTC1%_8uN^Ojo_G@b zg3Y^ObP%qSwQ5}NA?hHFO@k~@U(CeU`dCz1hdG3sgRV&0{ynA~9tViNKqyB3)(kyP zZiXHtlxxSR_*^%v8Xb^n736rcV2KJN(nmSwVMoy#OMH~mGL;VbUmh%)q;iN?DhcXe z_fEPPM%+>y0s{l{PVpoAz$)2Q8u=tJ+Fg-)kF>vDnPVOYeM;`*Qw_wIaE3;$Q8AUG zBJ?xiU0S4}A~$1RK8_(`NpFbN;bZ9Sf6^zifg!vhyA{9i<#yxM9R$qiIS9URLE4+$ z-#NZAni(qV;?zWJdPZKyj?;$;(tehYCKg;E>!z*jjNCev6z+#{XqDs68)I7JsB06p z(vEh5#rEXZ^=~jnORm;|8RlA97?bLQz-A4PUHDRn{w;bFHxmfeZfp*DKa0}^M9y%%meg75LYY0^t(fM$Q-hsV`u=7Z)1B-S%WBikW( z+Q*1ZNA&3H&~6(oO-Km|L&0!-+I9}v8!#`wZLC#0JjITVw=OKqw*gOxwb4v0kYl>r z1Zq%QV&YXX?G$2&^LgsiV%F#Tj?U#_FjgDw4CQHA3dd1H%$J^Ke=;*^!`<=2|7TTK z+T%}kS3XW&w6HLJ%O1>7YvXVJia&_++2~AaWH`8Rm(?5u%Ue+x{@*^uJe`-NaV;d z_bWpswyM!JHF#DXu#vf%53lTQhz5z3C{#<8)76TZ^sDu(s@eY3_BqAQE#)Ex$;MQp zidK-IT@kGEepsI|ejs}Ad7b1Fk$h2q*8S&coGu>-xTJYf*sl6b&7ulBty7Gkb^S`R z4JmEXgpjDCh}J|+cMK?&ZHDbEJp?Pqq+!y-Y$xcull8|4oAL1+?F7qw-F}LZ@o3oc z@_E*PJ{jfR9-NS^4Z9l`kcTJ`5|9@^`eDJe?LhJ7~H zX4xj{&@oylF65EZR37$1qJ@h%-z-%MYZb({+BEtfI&Ui$`N=#!SM20AGlIVmDSh;( zzl@v>O*_cX3D(r)%(p9#Iy*&>d@je3%(!!chd*EO?eQ#BqEtE1f?cbJcdW9s8J(;U z$D}xhlssu&Jj3I!vibBDC3}GJwvQR~0}eyoxNLt1b+R))r~s6IzY5r4s`tZmK7uI- zwF(<1AqzK#0>&QeqJ=+$BZ=uR+B?-OEOKT2uTSThmppTQFEN*lbMj1S(`ov zoipJGV zCGyy|N@R9r##=Ti%=cStfr($xxTO<&Gc`n(Rt-x^5`+bv%slJQ8flw#YcemH_L)6T zSd9E?-D1ec$oYlOod%P`FE0rd9k!3J1BXkUXKD5?PBM6VIFJo@f!EYh=|QyM9=;(2 za7h)*8s|_|^a(^i!27hkUnUf^;5lD@S;DKM^Q0W;`J3KbXX_*iM{Tz(su}?f))ckDG zT=Ygfvzfq@dOMrRKphA!RRYIhyb-g?J3_m7;LI_Wq4j=pqW!w(VXJR-`P*dRc`D*h z3;x{t{>Y0=PFD68ZI@AUC43F`{a3`jdCb{4^np$XYpv|(qbz8W4{ek%;sLQ?Lp59O zYL_t1IfS|;#BV)hqimuvfcq77mPM%HG%M8~;{sL_8_d{dYG~6&6A%45EHyU!EpNcr z;yjji^*omRoHyFhcKjGxn-4NCCOJDVxHld<92|7}SyQV!2=re{QYe|SAvD*ILw|88 zS@goRt2-QqK#Q#aCx5$jpoqWPe+H?QiqeYfH?0k>$QDm=zNfcFKA+B#l>Qj^S#>*R zIh<)0I9zI>_6MK(((Sp2ise1<;*r~+HT~OcUhBzqaq(Hay2jbJr=xp+f+A|K)G@~@ zvn+el4X}VVzKwzp6AEY4DOY3L4g*u-C$27Uo`ac-;d67-H@Md1=Xb$LVKMCAEF6z& zuC<5SifWFL5oe2xw~yyTZkU-5#6(4}t)*pjI{8?gdQlMqda&PyI9uRh;^T@0vOHMC z;tKM(a>0~CV1p&s`8=<*jZ}>KyO#u&1rNUO09;M%)s+6&Qf#m>&BPc4tm}sA@exBJZ!$P^7~B`RpJir=@sKj2 z+0A8@<}Azn>}V9xC6{!HQlY)SEQLw-lX&9UuqgH`Y_~NVdiAFz2uM}S)D6pf3PxeyytD&B- z6UeD#KR-^G4GgT-It0}6Mb`Jf*m2=}j+m|I@NuXZD>`;n;KdnS`QxBU*A6%b|f+m zgHq=eLmE?1HN-HZAB;tE8_karJoOrkDyL;B<^vxEYdRz;p3(&5itojA2F%Ofkl&+Y5fR7Tb~WO>}wZx`m~I2JQv zeIXk|Q{0|0l61k5Fry>k<6836$3#Ss)#iBiA$|$3ICcW{Gh>amKL3%p1PnYS-x2n` zI~|5pPc(2>IlxE! zEbR8foU;*J*=KIW+1^BQpWew?p9wuCORFkAq-DHn!mxMjYS*g6j1CFx#65(k8 z@U7M7U>;vOScz01)H|~WK2LfCQpkBvFsZDA`B zVZ3yXL-B{c<~Lj>70_?>67R}*j(+a#G~-u4mQ0k45AJZ8G;z5&o{!}XId@%*JX_^M zU0uOmM^Wg_*(^+m9FMB^GM}Yjw^n}(S%|7c#&R^=KY%0w{oP=7KFYVlYr-c(zrQe6E zwx>y|%UXmREbzQRzv(N(`Q_+UPlR){{sDCc%Mhl->|4tG~i!oYhEo1mb;3bggbLLE@ z=1+`K-H&-L(-~x%Ogi?ode>t$8AznHalrT*;GZWVMi-YaY{2+!>`CdQtf} zHP%%aD=R^?-geuS?Tts(Y#pSo)Z#wn>^riat3kTB9_n}&e%#UG0saQ}+?kW!+zA4%jRdjc}tEi1ruBbLuWh8~LG}aII zV$)R&*~PvMw=sYvdd3lD#d2#T_i@c5@!q+?p3;TeL0Ml>yVv~=T;Hb~7n;uRMJL^i z*n)WAX1$vT8V%&(=2gla6pS(`H7gz!QdwwlexcNg;Ir02`HkC28?e3ktH=z`8+rTH zWD5{)ByiU%^FalBTYF=}3!5_Z#U;V;$-qU;^P{Ts;bK6^Zy)(rO zsTMR2v=G9-8E%+xCX20)g*=wNK}VS$CP^-?VRpoft1yQ1?7Qga#i1Pu>8}f4f6i$L z@~81iFd=V0H%0COY52XG~kue?A z-%J^zFHC9~Y;GHYg&?{8W6Cs`F9kL@Z&s|(Y?TGMaCnWyY;OT)mc8&Oa%~TnZg(gF z*Nw!5S*%~%B9hNQnmmgwlDyLpS3;J{uzCl|jk1bI1Jjnm0%U%;#+&3QyG9*HJ+TZ% znS2yD7(KTVSdL$`E!#?!x!JxK>d!2Frc%^>`?S{;?vd<&M zAylx&B`J|&m!|kYHq$?$8%rx?N*9A(TOC`vKe^jUfMf6e0{cFxZ)RYSf*j$}dDGh~ zoe(HED(WUu9fHf2!gHkoox>+{ZJ%=>EOZa}b%6K%Dm+K9^uGxf00?RPKR71=#0mNP z({`MI#hd==oJ7?^8s|M)0K$?nTs5TS&ZZ30{s06M9$n*}SNxRh^7VaWS=(ipr;%^H_c>&9kUi)0vW$L;{t0@m7_2NJ;il zYZBIKkMkwM;GtJjnk$m#u{F+%n+%8Za89>pWe^xW7%+KJitV^)ozCt1!=pI+M6x8{ zvikuFL|MbfTr_X9^Gzv}!Nzv%2Yhdm$Y07#$OI0a&qn#|FL)8Dv6MqAqq=Ks6cnW0qJwo__KFUXMYqbEDVd|O1s z4PH1TvTLLF^`7}2UIXpo>lA1=*(Baa5WFdgLB>|egDRy;LH1wxfjU#k%^95Zu3+35 zC?LKm_~=+NCJ0kDCJ3{TOA%Rt0Nr;R)kt;-hIf5f4>ZTa?YC)hqvoCW%IAf#U!| z8%Nt)0Fl*&fY;}X%=K31^TXvIct^*|y?AGnG&xpTHcx8{3yJ&R2f7khQYAZWm}xe4 zoyDECVpM3Wl4Ty zC{$DG#jj*HAIk0xE=c2YtVNdM>tpP#<56;8cCuSQAgMm?VPwPDs5}zF%~14BmHaA_ zRB}g+u~4e}Iu$`iar*&7_0Bx7+x=G}3KH*ziHZF&s=%e?D*+AJReIlUtrtl8E*X72 z^j#PWA)9dUom)HZ=xrGY$xWZx^`}q{ZZiY=M1dj=4%~!0Ke{(>b3kSq=&y=ROXSl@_aWz(x=1x39oM8J~}_ z3}v1OntD?X=CpFzQhsACh=@2z)6Zn&$=a#ezdDvgTg5ceBpxa3J9VGOlRjW&`k<@6 zO0p0(&}LsdNo+AkBK%keR)&m7o2r+X4qga&9#8brNw`UJ zvjPt}iv4)JV$yqeSa0P1DAB0;lv2GXe*8w=RKo(HNKzGb%LqsfY%UXT_Z#a{am znJ6MGfr+64*~8_y2zLL+z+ky)x|1rg1$AE$>`Wq~r~!+ecDDW1*-3ZzAQpp_W+kR7 z-_c{OL`P1^LOfR>?o!?`X4VIKzt8$4QAMqo^Y$Y>?!T0Hm`1_DIOoejf1lALZU?SC zt%hW=FJPP0=$uRUn=mVp6l04>$dpv?s^SMZMHQ%bF6=XI-kBZnGTb=!PknNSSh29U z+?nO;9SZn?9iV+kFmvgVJBkTWhb_61_k7zLr%w3oRM{<@{Xm-~B~;{b8Um9Ig&`NU z0p4+>VI0YvdQK$Kbg{fFWAu|Y{>X@ow)H?Y5~c=i;pepRHEo5-W0eYP%RYI0)_p~d zBoEd;94$p!vyY;kiCr(qI@AFxXd|v|MqJ7u0q)OkZ{Y2)AjvtGEg`$WVAkN)^Sqex zZLyOyZYRU+GaF>ANB2kTL5jQ?5Fq0ZVGm+W{(Rd`_PD}O<9S~Vrk0;yq>`9Y$}%PE zKz2ag5|STKNkvGbgKqH!B#NqAfZs~H$^^V54lb#D<*2BFlZE^Bqk_rf#K#hOU~`aQ z0z$R4Ko3CYt-0ldef?Ej$H@e{rEzUg7Nd@5V4Xf)oEJJEmi}<{E2F?+w8k8054EEs z^m$qLh00lgV#;v?Ek!GH;lv{+|Cpcp0q0oK_B@sznNHyCRm`F2Wy>5I1*Bwk!KR74lWX`eWsaebBoh0z0F}eR<&|;qEJF zc9&_?W;zQUj`)!_dZ}y3UREs)AAm@3GV*ahQ=Tk31*pZmfEa`ulI%PUQ>*5B=L!U2V50Bnq13+znzo^ zmX3j8Yh{-dUP4HNO+PYT(rBLD zqNa1gj-b7NI+4Xi5NW8p!1__z!L;O=&*a+lQ+x9fkL2ryXS=(r%d+ELZ3ojnbsTDI zFGhAD4HzzNcoXuokaIyYp_lsOLC^*ETl_dYz$kF-Fa|KWAJ)aOl4qDWBZn6=h{uJ6b&JZFkARErA7=NR z0w+1MUN{@7uMS|5P&fv>WtvtvHnp=o8T+)ySVPX%#08TL%_t#IQu8HX@XSzAWLPYf zio?`OPqExgXRy1W&LYF=G=%or@myyNzk}lek z4%#km@bxDi_}$KVFYp8F;gQ^dpvZDq6h?7S>wxPOeZo;d-r#{+Nmjwk$3QrA;F9P$ zhkJnev!AYaCM)1iow=Rek7-;|O6fCXr?%!6E6DC`EKN)Jv;De^G{qZs)u<&uDbJAs zUT^>1_QSX(10dTOVl&$$3X6WasrCk8*?iGaJ82G2g|D&+R?Q! z6t&@nyS{B1@uFH>pYJ8MkRk0>A7=xK0O0Tpkpf50Z;z`gtr~!48TcSg-j^as}e``5Xp=ds%gR zH9XG?(LRBLBDbMkWOIb+M}DAWRN~Gk#5D>LLWO5l&h{l{h)yk%y)1nYqb2v#- zooM--1LSOVRt{8|$)u`(1PC|AMdYWsY(w)bZmqJvSz%K;k)te7g^HIi&e2-dxhu8hIM4e&-GF6NCH3Om1YYf8lOJ=;=`Qb3Y>X~6DX-Sc+jS6!tRWbrhDz4V6R@S@&O!p@o(9^m@$rm)?G z`227biSvqLpU~Q*0~oSv%Ydq3486^Vp&L*Nt6m0oDmZ7>H#%8D4FdM0V8==lZeYbD zS@?VT5G1aM6VROVF%Y!<YJ%>|M^%kE#kFgKqv|1sh+46B?R4tI>FR% z$1av7=uaC0dB~K`%WZ9UU$a7RwT$qQHM%Z~?QT(nzWAjl4iz>p6M((OOm!aw$6U1} zXR8#S#4~}*xt7J&`ASY5jTuUkeKUIC!M*rcz{VBlXl#-Ilij#)*Gu+DNP~y&nIseKz8Maz#9U%_ADEOdVFk|kA;rq`>;OJem^2So#1 z_~git-jpK3bhHRqFnt%Io|`~ik!orD=?i85qNX4VQ}t;vnM(BamHVhO-lqC$?c31B z<@rPV&o;}on!2f(m0o>Sc*Zn%MYs5$O4tnT%<}Nkeqn^!NKv{ZgI~lk4}$4vFvD^L{S>76yial^4wAuuZSNFT5-i84-6%n z#-GuJv#;bGZuD%d)+0QJ{655Bipo$Tx)Tf?0hMx1>tZ?O#T5bl6skhGb^FkM{=Myc z$Ir-$iT1N~3fQ%rip@6?y*uZrYseyuuUdJrdm#GDmY`;jLy?lx&dLGKeu?JFpa;hS zYP^SLqI9N+hnGbBFxfAMKwPx+Gz{sJ1tKKqBr+uF9I;xPocHF8=r-pScZb&7K4}le zGUR8KXotnJGJ>Q(;W`(Z9*k`pJ zP(sgd-I7LkoNgC9dalTL;6B zLMS9n(&1km^6BgudUAp}^`q7zhfqR$(6_!{3b>NeHU{tU?nmHUI}33Rnbc; z8k2uaMWPUYT=ZR~V1%$g9bda?eF@d3_RiPmwM-<6iLQ(N0 z0}aqGCQ$q`^n)m5x0sGFpFTj+&D*$MAT$hX1T1Qb-8&|N4@5RqKjY%H^DV=go7vZn zB}(2-F(uo2331vEY7eR7Q&HeT+O}I0ltO?O;Km(=7)IxoLB}SipBg8%IJ@!vx%YbW zSLc(T$;fj0j>HBZ^~GzkNtn-R)CjVBYnJ`KwhTI(#aPYKB^GifD*c50Y7DWim*(hK zt}y0pZt0s7wFT|xQ;LPYVCHj##way4TiXKkDL#Pewx%f5!H%wFTWS;WiYEFM;h3+` zExB7=7unGGl|%Vn=Wv!?Z+e>39Nx z(9lHRvXaJd{~C$;>3EmTXXuYWveQxJ|K|SRd%)tqz1b>c=I9`AWDi(X!Pdt5eLW!# zhEFz@Hug%kdIm-ee*_d4v)6M2Y#P`Y8fgLI#1k^of7D?RHM0anRc8?Xr2Iz?gSe5I ziK*lJI)rQt@1fYO9T@-(8yMNXuTS#(A3$(=OFhT;sP;}qf4j3t2#Bi7$sh}e@6Vvl zpyZ_Q=w@rgAYr9vV#J{QzNs#!Zw^?CgF(&A5U{EW3+Laj_q{E>odY2V8rtX^0T}|l zf8JJsJ^`U1ATS_P(Bo0?3Nw(?v++p^vvBYU3kawP2nhdAK5y$lU_g*>T|lrH>1M2vuJi1&OH zR5Wx9Of2jV-Iv59q-5k2lvLDAfRNT~>>Qk2fm3i)YLUJ_4Ex4 zjf_o9&CKoW9UPsUU0mJVeSH1=0|JABLqcO>eJiQAIbC|$;=>tV8AIUr*K@wI>x6V7^e_QzDzr{b2f31xwMDPZvE(7IH z>d*f+XB$EU1^DN^2|#DRD@%6!z5Ttq#C!IC*ZZGUKm9|+_x9fFp$gCZA=!)_%l8lp zQX<6n{@-)|LHz%!0YKjGVW%oh{7v*&q~C&54oLJc{|Dj!CV{_k&>x!fCk^^71+)zN zdn?3dO5cNikDrnPN&?F3ZO#sBSlIM?2~w)5@Jv;)8wD6y^CZ6 zHs$}%V?h-*Aj4q%txL*&q#T*|7RY2%kpN1G*H0&WFa6sdsqYF67J(8%`eR_9{y`yR zA0!Po0fzY}gY^7i5NIK0nLk?a{lg?^hrd-rObJi|K&Qm-rUEDxAU&Xd{H!F4qAX*q zeE6)_+ky>e4pMfkDWJfj4e69WF)~1ie{>E>Kp!)9q(o5Rim^6-$RoV*+d|NyRO7$J zp~{7-`tm*|8EMz}Q|wuQA{T9g^V5mmO*&=!-9h<%gwr-ug<$X2{TEjy!;;|u6!^!H z{mojwf0IQx>mNLgm{HO}=G|9<2P8xjP-NbXWrbA;1@IsgK*4!Cfc^fXnf`1D;CXf| zza9Jcm;j^x&s{E6$?FfVjeVCQBnJhcz5f$`|93-w*T=sZ_y2hB22}s=_G>_q|9p)9 zZomA$P)^B&cb}H|=OU`?Qe%gj4Xr%IK2J0qDsoWoAQ6VJ$?)L|Gb=%b}dn5e?Pv3j6;PR`j?@pV=9FK zW*ew+r2JXb2x^6V;oSsuwAh08!c#W(vMFeXlH&fTUVte>Iz8H7gmQ+s#|tnCVaXu< z%}0W}0b4=uvycd2OtmAObx@oPwH4nvN9G`L2Uh1z!@h9LW;OIKat;Pyz(W_Yz5{ zobP}+aQWYm!appW@L!SwAz-nOkA#ZGrJe7ezM za;m4dE+NoKn1vMI>E}23kdou^C$8A$vc1H&R?|i7wr7SI{%6~f052# zpz{~!AOl1O1_lQMjrns#05yPup%5`D5DV(r0fha7(f&lVf8n#g@a!)-`wPzg687(G z_FqWb{a=#V*Q5T-nFBsbT0b+B9fi*;Ovhq)&RR zt%>zDT;M`!-v`J@Rq8R)l_sflqb26i`=uLwr78|aKNn$-qP|VvQjCm6Q>Rf^acN1K0&9?k#BaBq8BUM#%*)C}tv35*SH$7wPM3WjfWGB_ zo2j!RrS8j8`_uB)N{iX*X<1kB*Ia9Ps>gZwE^VL}!U9~Z zjcpsC9%;|k4F@xpVeSTj;Ww(oD%1<05=VbR*a1O#d+~1J$bgyAj|p}^)OMYZc%Gn1naUqP%vGpYj~1<=62qB4 zY}KjkmhX-Ee?fhlb3VYFOMnu9@$(I!j0N;H@8~Vw4W*1r8qjN9rxVYX8k*_5vm2bz zln09Vw%}MBfhK6?Ha@9I#y0dsQxP$0vaKTTka5lkZO2NcDkjG%{XJLQ|84P>CmbJE zf)zW_a+u9|d&ViQuQfWAnsJQjYr2~;XMr4{#`BH&q0mq<0C4XDgphqnkg2xA@`Of6 zC2);O(KAO_T9d=!_}`}QjKdPi@|fMsi3dAKDKV&~AwgAOlmX+Oam$Oa&fS8drBZFuR$$4icoj23TaS z%(G5{DB^pE8?JU;4QtNT*qU@en4nR4kAB|q z0mE@2U~s5+t1L)*=Qws%i`LDTGtHPHK~IK~W-VQ7V>H-cu4lR;fX^>}&6;Eb>{E*i z_>w`!aT9Cd##AHHshgXm1^VjhHtg}oVi^_7sE8HI%-Gl$n$cl(W_NbK|9*ep2jP)->$&IL z^UnF5d+(0vx<&k42w6MTT2Kt6>5Q)zgg+M;EbH-ma{MYnMWFMTzG;1)x3mNdC@NRMU-|lp zfz!Ah6b(l@*qX65p#KF%A||~o?Rw#>>f#f>?G!RNFN`nA_l4A~gLXb&hhJ2EF8_U_ zIDHLZ!iV>57cSB9Ura4%P3WeQ_Q5;~?upzo(p)5LD~_L8d{I%&r+y0tEcSxI?vkShVtuNLZONJzk&tAwbU!kUv5G+4}J&TLuNcPJTD zsK#invOCu;=}~ul$)HDgnZu?|oX925q#kZ?8)LTN#q32Ak%`}{S#6PF;$_Gu&7)dH zo?Q{rY3p37c`i!7y%DGNBl)ETUugHy$G^<>j@*>t-WGXtx<-a<R1@|3@CU)9`{Veu;z)r-G%!Sk#0$e`$%ZLyVR=i_hR!7hoDy_lUXEG=3e z85*;%>1Jol+Q=npOH{RndPA1m95e`U-Q(e^`7*+Vz}V=wsKwbmtj;o{`hha|2=Y0ZzU0f zXKXE21?KN-XBWlhy*g!d0di=teaZR0>0CEz7F?K?Ur@u$sLt5BlR0}v4x7~F(M_3o zeAkRaFQ?G>#W)w2GWp(XiWxm~hP&HjUrgTUyO^7%eY&;^z~)V%XUNC zM)&o@z23@G?^5mtxmffD;KFC?LYvTrF&>F>L;0GX>0yaHpP*{8oScWq~VROZcVlRVX<1-l5@iGFwuCvpffc0$yJA)%wT#3 z%9^eBsB{}0&IJ0}$KTtSHdS<1TVWs0d@1Yb=HQviFz@Cv$^06ts_bX^@hj1 zv)Fe3M|w>!P$n94O?~PB|k6e2_^*nJ~xJ|x?g%y2eW_=1UyDm0=wBUBW%rlurletMkWXH7Wp0dn%N6q-4 z`;g0CnAsPCfEM*E3R`3AKq%>q)P!YNIFyBJ@3XNUZw>)gIFpAMm!vR9f_65xezgFOJ=W1HLJ4qx9w(9%ns zKF{>@llLt-os8Cn;2o)Z$!MrkwX} zixc1UX{rbu6?o5Ir@JMBh%@&*FtmGc0Bm~NxV388B`1w(JjJtQ(0Z?Yy_Bf-fCSPj z^@LO0=eJUXxxfhYy+RgwuFlzOs`gVg+vdoDnwjE)C^5b_3VP$Rmf7(qdd($#V~-Ed z0hJ<7RuXyXr01{RKG40_m%f9$@8ja<%+oT34z3&pcB zh@Ul*P^sQfidmX2GHV@TDpVGLEazz!L+<$PxZS0LO*tpZj99Y<7VQ$?1?fuZ)JZ)v zwR^bJY`#JnI7C~%1WR{-O?6-xV~vWyAdQXvwT{NJH_py6(pUA%Xr>{iP-|U_1}dl( z8VahVG=>peR$E((>J5kLs|2|AF+iFdkx>Ws1_)FA6;=&*VX$FNPw2X#>RzQ9Fr8G< zqg9j2h}8LzUzL%6+qXpg3-V%v`vgaiI+i4&?DK7G8v8ZjnQ$!qTfzfYhr>1C>S}Ne zZ7nr*HBEh#j*gB#Qdb|PuZuK97#bOkd>BctStFOk*F>-bu2C_B{JRB=h%b1=u>_h1 zn)an*2_z#wF2EyyA#&hxj2sLg=u@R1N_a44;O7VYQ(-HnhG~MTN@L3=Upy|M1sNSk^rUFAiGEg}3i#U>Tros|vf_fm7WHgfG z872Vh3NG8>EHi%Tu@DwNr*t`^Iz6b<K&Vg<)gVKgblGvgEoZ?mLbWEFVKE646rvjH zLM~L*4%AH4+c1Bt`xR|w3S`e>V}h%1RzUW>e!5fEatk-DU;X5-GSd_^ykzQk>-RW^ zwEOdhJ4s8OC5}mP9bW>#b46_t*3mLMcM(^^+&$6(m6ykf<*NR_c|M;9d7+;MWAQ@YmzMCa{n{tpxt(^_EBGfgSua zEsQ3}I_iuLFro!SJw=Dmx5R_YP@phOQznQysnklH=J8dj{m<(un@^JZf7&AZx}JhS zAc|Wi_#Sxo0bbYuwnt(KbZO4@K&MgbjAm0~YZVw~=@=y%HDS)A0wJ~U?N-%>(ae>GL zgtg6hh&{m?FpLmb%xFYC5K!+cjQ!;3i@MqF8ytNdqyEw2K^+Ggk_^wGE1_w35Bb)LTAalEXc0xIU}2wzX_M%Td1MibLHC8OPyQyJ-V6q;cEEh zn|lS!r$;?2tEb8sYzgVu{lmK%NYc?+Lq381C-jfz+=%p>KTT6LuV}#sXWdQ$&DXNh zfRuM|Q%C)q#pDu#G7^zfexh$Cw7k(@y+nLz_|iT9;{1WfZq~yX8-BH)dH%|r#${@E z%82J{W{9hZ!Fx~lglz}2nE`tTU+>=A0NLnTdGMC#@Vmj}a(c~-uI|EErK9>0TPk2? z_^TGX_>U8&CEq%h>nOOj%n>5%xbnuznM3>Q9p-2|{@y$%W7Tr;-~+ewHws_hJ?yiq ze{ShXImQNKfv`nuf9u^cwdLYiu_%l(+wKbeVHFH*Cwpnfs`4^2c=O3C!LP2$6$a&% z_kTP{yrUn}F+5~^>RHG3{gwJip5@J@fUqBU|NFW>hH&A&zOl+Evk=G6RYnjAzyu5| z0vTC-@kd^1@Vma~I#uPv)+97-d48Z}8ujPahF7Y!`a@nrMORSp!j+qmRX^wrIbZz9^m5I9<2y^ zYjPy-<6HY9?}dS!3kmj@RwU!h`zr4>qc8Z~ewH=ZyzAZ3#GmJF*cWGiD^eqBD|G4) zL(2j+rg^lPo`ZK}%?LC_Zgsz(e?8(|rs;-7+2}iS14;%5!+L)1JGoVU5&DC<+mz)N zA-~=XJWxSB(r}&3+2vdsT~?L3x)<(?IDx+is&h1Q%Kp^|=FB~K{ZaZMU#&~d4fUyu zADAi)^y_j1jva6n3YNUFeLH2c>eMeAcpgJF`L!wu_b@Q?74Z>R|oYWtv;?FHJf&B?_328tfzQ zL#}X5L>t~8e2jmx0{6@_v82rM^x5usT%2?t6o zH*)91MFIEAhuoMht zv=FJ3UzRb(zJIC|>9kVi07F3W;`722*c`t7C~JDK*a$CxwY*{yA}zUbw&>5&NaYP@ zQzCf$SeDS96(1kNWwRt4BuQPr!>1A|&KSSR&>*xFCEv>;yhnn1pcVuwnqIcZlM! zqk(6>LRMTjYb2RdOcIBWz*`Zm!g=gOTl8ohpVvM5?dMGz>C%_2mkhm!2Zh07CrFsm zg<+qNzzwJ1iDV+j2G6!+hY<;uBs>9UNg~;>Es53hmjc?w6C)YPgB%R31FWB=fSEIip(V9iYixT4C&`8jV;eM# znfl{yAtFKI75Zm}J`U@R@v5!sTzV1RVd0JG`t_o_`DW`nkb<1KR_eKc51HpvnIA+g zue!r#&lUkohKvgo-%ipZsW`ZAw+L&4`C5|}w1-Sh#i)yJpX5Ikrjg4nU~u}6M>CTn$Y+9-SY@l(!Hbw6z0vY0P`)ZM)(5fokPTJsO+{KA1FtFP2Xz| zBVSINPtOpZ$`-v8ovAj&bA`8i#j?fTI@k8CS+YIuNBzJR4J(^!>#lXKt}(C=Uf1vS zwAjIpJQ#VUSZBpF&X%_y;|k}OdjH@*4Nr02#^*ZE3G_Y=oFq@VG<)$RWRMDV8XXKT z7C%;CYb)7nBOx|UfFPp1_?&PqTgc-BOWEx0$G6vz9zPdGuq~NDcOv8HcpDnlf#68M z(lG=Y&51~&Ino`0fARLVBnJl?mWE?6a5NhN4F^1C*f=?nNq8rMqXW&6XdePZLq+fq z1WB8G#+d<&!=in7JRyQGx{lA6yNrV%SdVf?fDb1EJwF(Wz$36BpN#XUn_*!fu!&P^ z&w!#kbq#KvqO;6_9-7hW8JXetKFWsSbyA#fnj?Jr$?NXDgQCc%P|f7fKueW29vHR5 zk7{%Qi_xvhO41ErsI=cyI_NmPJq|M10lkiscdwTTd5w-XzoMkL@m}V}TQ0trUa3`W j03(_}TioDF|43lq#hfopttj@qYD$!0cExJes=|7q?a?s!BENMz*rMt<>Jr#gwzu_i z#h!2@_XEG(}7CR#bFL%HOE~N&#Yr*0n4KMu`+eUM~ItEC;x|P=| z{gtM1TI_@(k!aC#oCSyo8m*`gQRlcb7`ZI<>)X6FmZT4L4-?Zh-3}=ao!aH++ng7- zm;2rKw;H)lSFPT}n=$U1hp&P76t$cW}{ zbk{d*5Y2+?1=q8i5FThYV*I0lTkbFJh2K&waf&78CZYURw)1~;Zep$_Z6PlYMDtgM z0s;X>0RsIi0sq~BBCLVH{v`teQT%QHmMJ+L2=Z@>^7l|G1o>|*h*u%#f6Jf&{}>9Z zib_lWZB)Lh=vM|K9#RPIFJ||6y`){jae82FUo2 zhLM?piShpi16W)9KVbi8{tf$AT>qxy`^OoNlC`I~owk^@{okzq9hv|$6BiTTzj*!+ z)&Gq2-%xc|a~DxZ`@cwl!2i_czrg>g{Qm?0#i{iloZKw`AI|?!{Ri})Ab1pAtpCy( z|C2=lWGnGR(!Z&mu}$VN1!1ShG|Eu~?nDJVk$4vb&rHtzz7)6+f?q8UMMf5?gf}fI zV&#rEXp|iVU;Z<&M$b$-z1BcubNBW0&s^{0%Z-g@dLz8?-t3Lf>n^qB+?VCe?4SIs zu7-=&Wrdu^D;5y!pjaUZBGN?UNhmY0UuYn0spaSAwB=|vCM5U$)zvgPSUHW=*)+I> zxE)dV&^1*x_no8C2S@G)(vMf~lI*&!qH))_SZx~kw$(L!yPb#XvU74bjE+C8U$3y6 zpnrGKjgcorEjrg&SF*2*TF<9kt>tY2bO&q)HR!BV{4GM^<6?DFp7N%U5m5Gi{&XblvM(@IQcsl6 z9t8HCjBp9X%@9}x@3qq-R;k0HJX~8_+hCpZj|RNbG<{_Aoa;L7fchbiC8X9?SL@u{ z*jWM0WVC!#Yo6g>bVWr=_+QS{r)^a-sFB^2RrO0AY83iHmqjfHAX2g~F0_~9Vq<^i z-}JRNH0Vw+OjMLLO+i3F+M7VQO&V7I$S)G1(tH(im6JfvkP-wr= zv^oK8)n<7wBtYb~ozLvw8m zu#=Og+vz#p(^@xjb8}l;-m`tSG4$!UZpIb#Z;PvnkFM9T2iDZov=tQzc1xuSin#IXD>T=62n7a3Jj` zwZ5@o92XZC&FZktiYU;zAt4c7*Vni6Yrf#tItlrj^!P9PM!(-@CtVLXEQXe@uI_ub z?@$T{oI~yrCk6lO)rP5`U&<@VgRYK_UdFFq7V`<6T=82TSB=7H#CoQxDfBv>3pQ$s z&VN3CS9HD|ko=KiU1mOXIu41|X*((oC?%ycJCfvXci8#m=?tGAgUQ(J{mjZ`hPHEd zRyl)!2L-zmbI+B~I@U=&P#2De=eDx3p`EUrDy~=WlIcXFB z5M7=GOG%?!dTnd%jMp~ zk#)v)#AWZd-(!Q2NEPil{pa; zIiAOoC6qCg-*kRHI`Pg^+pBJW)jk>ru1Q0P5cmLdZ%(u79b z1Z=y?&tL65w7RD70CJO~Xz)(GRp%cl(A3r@Z{OBao1+Na7?8chS;fD+YrT&8 zahG>lb>o>({bh(d*vOf`}~XlB{p6g_yg=IX9$B0xvNmf zZ-}yuUEV8esG1u3R)n!jLY$VJ-#CF}1IlsDj#k_8x3wKL>(AK^(wMTQxIcGHkA`9U z@L7}K*R{PD-XuOF(95S$TkglJQsc`m(vO^OjYwvffH`TjE%N}?anydgsxis(k&R`- z!NA$L5z`JB#)oHdYH11=-tbZnjX_Doj$o-)!aY2y>;!=9n_fGTB(R_@yLg4+DI?-J zxd*9R{OEW%nzLm=Hln-5XRVF8;^R8D6+%(i(|a(4~OzL36p#>Lc< zKg2ycnL=k(r%6jc7kQHa7WuesTN_TC zRAOiWt_*T?1*(jvgmxXMdyZ*#uA7Zzb9$W43_61=XGr$WW#pT!o^^B71P<}j4lUn##7PQJp5u(>{dJ;b zXl-ju;bT6$bLk$_(>ZFegoyew*>q2x!%*5^F@z5>l8uEsX!v3&E)rc-y2rQ=A_2qE zTtb0FqsJi%!kMBKQiSWrzyzt>!_nPDymurBqfwqk%MPnYM2H^Kj8dMHQGCU{eSLlH zqN7+K=%9MYj+1C^v36fW;iN7LDUbNP?%wZ_phGp9pQ8hjpdZQQQg@Z6kq&30O>aed zop+*=0YivL5dpNl`Oh=$m$=#PEIs*XwoiWU2wQ}XTt!U%hi~UPj z#htI$tA2W#_LTFEjmjsSwfCtQbNBi9zuP>sL^P)d%4`?h;pBg6&*1p^Hl)-aw<(09 zj{E1Tq3>GPjs+OY_9gW6d`Ot5Vs()ITHRV-dwzSv_e_qDX#c(@2}p)Mi1m#EB{qk{ z$GopiH!!&ERzDk1?R{cWoKP!!0N4?>9OMJvekRHbj*5=pd+b`{KW<*%jUakp8yF_f z_sRQMSrrQ6cHG=J3@{}3wzq5Wz8|O9|Hx)Hm>)ga#asK$mQvDC+tA=j0&QK|;pph7 z+OybMDUk0H7Sj1+85HhlKT=?O@4P<+E{!wp_tWP}-cr?f74LWi#}popnjoWz=MiFn zktDubYR8ZAa*NB$>lR1<&z=-A#KuZ1fxuII@Iq#Y+@$8?^E^!g40bdK4!7~8)7$zjBgtu+4yjTHAu~IzxPvost#dSnokjBPdISDES$9d-JhzMG zN?Z#H$n&kb&O{ZQO9kZNHg6WKJx+%nF{K)G1=1R1>^kdOSx=`9U}P^DOP9Jda+TRI zjC8sbKEFylh1`=kaWvQz%}l6DF`GhyCh%qnr6D$% z^IjU)c__#A@Q7%w6}!Gl6o827ZNk6N<(i>;Cz22uvWj4WC=8c{9PUtrX%7@E^?fF0 z&}uy=I>D6?5!`4XvTwB<8WH3ABy4ep&vGYg#s=Rzf|J=*UbkQY;qz&Kd1ruH=CTA< zCF6%=w&G~}XLz1a$PKXZq)2WezGqN#PyS%m+h_XPh`*<7DcKsOXN5NkHS`8EL|fU= z@3f6juxCaOP!N5?;1-gvq)2LV%1ird|2flpTi9^C@BGgw;_}3hF;w8&~PL!$}010O)p>9e9qf zJS8>^>q2E{lfO_Dv$=D1C~DmgB=ChAu{!i7*6JurQC(Mk4P08iQWI=%Ti?PbD{u~O zf|4{GxcPR&QI)WJe=s+=Me2>i<@Clil`G?4;5ZCI4uLYCU}tCFM3%&J@Yr_F5FB0f zaM_zbJ`*L*NTi3dh}#rM*By7<#C?VKz~@<{!ZTEd@Z*ht@?Ef;_ABcAzN>wT#XU=4 zHgB+?whE!l_bjf{t72Aiu~o}&(D&IPn*vo63bi``(b5!IR~Rl9;gf(iO8b)v4)6Xj zTxE7x<8jrRu+z9P$KSqO=V-j~2%!N2-`s5LG<$O`qiCXrGACUQ6lDuIzsaChRd=6m zwxEo8wn?4W>Ki=ju5ML{O( zzxdgNwG!u@;lPrM3W_f(h?AY2uUULVDc9(`HaUGds?hC)GlgU$Ey=VXxE!Sp7YY-! zjpuqSLpaMXmxgsLF?6GYt1Fh7lcF9mUK6_Ya)UyRj;(YWVv3UijBmS{{2udVft3Lc zi9Zw}Aqr~hf+&b5KjT=bva^31rv=8iZ3o6UT%~v{65RN}WIiLbR6~6_8PPeK_2XT> zN{BAf2y$_xp&ui9SvROE7ktZXKfsZ%p$|1?~K!S+(F?)Ol zAkN~Wk1)ka8_K3uKE8uy8RGW3-E5oLVhLeVZL3cJ#0Y1_$3LZpSPxPmelxetaMx4i zcrqKIj;qnC_8>{$r4r4PJ`f`y$ZjZEdq-Xpd5((urxHJqDR4cM#_dBTu(A08rxuv-dePjs5Z z_6F4013W4aRV{>(7Rjd#S3teA^eb(lCc;?P%0|lSRe~?q^JZ>`agt zBL9kdHyKPSxsACW<9}i=-6+6y*s&OJd*ZW2H7?mw@ep!-5+FWg#$effnTiCOD&ZkA zj$mK^X^>Ro_PJt6{F+^NhlvR55 zwtApivl;CdM44nxEN_f?tnpQ!u7>oa$sxwYUK1e7!;`=ptAPQV|LiQ}n7JiVoh{U) zse};WOC=^n*+jo%@}hAaI277e*Q+XWdOBpJTpn>6NElZZG2sckRaJ_>ZGz3gMzBh; z6nr={#f7dVQH)trf0nzP!C`9^u8Y+i`F^wgJd>h1)8L`#HwskE>@^ zDj}8_qf3#0)Lmn@SmISF=qdtzcq~B-jWFLaugdV1Yc*jxY?88;leBY2gVE&9H{!r@ z0@*??n$Gka=Ot|PE}^-E;2gLo4KtUO2%`juz(>0U?s+LKSFDt+KpH*_zYEp5G;_#g zafSPfrc^jEcy+Qn%3;Vz5uJ!ZXlV+=^(rfRl3wJl8$WLGPRH&-ehlwRnIl>=y^fQR z509^@I1k&>6wwt+sb)yZ4i~uQExRejWfqxUIXj#ag~jLKxu4)YCXEwZ&<;` zbI-o;b?z(|!D?_ml!S;>a2!ZV;^D(NPu?2g-=7m~6?;{OgH%rMlTX!U7DnB5<3bq6(2S zg9_b=irZ2l{!JKg0eJURl3K9~5pT|P`KW{e56AgL^auNMNr>Ly1k20G1Q7vThsBJx z(4Xe~5&{@}Pz2wdB=yJW-N+Ee6p9e=bS|GS*KV}v>$R?j2Pu5R;=9hH1BT~Gq5{Yn z=N6OP8j!=oNu17^Ao`t7K}Y&4jE7@Mt*t@+QzJ=?VtfQJ!;DV*Jkt}ugP)ylcNr$| zv{MUSgz=FWwQDJv;q|$K2_>aW-be?|bZl_1gAVw;xpH!|M`R@T=9|d~SS(!x%xRB6 z?ul$^w6q-!W7f*aiL%u%_G-xSEx z$xeTgv6aoJYUuv`!aLLL?hg2PliwOD`cwH3hSjY&We6N^c~%jl6i0LtH)L{wV{r@F zX(`L1r7;4^{7Q+?H~d^lDBgh2>+#ct-udmtV?a>)fkcJuuB6deUt8_t42g`~4XNKr zbr_mg!gfvJrm_P+d-Lo5!_R%T*n(0CDBM8Se69?6&Q@WqRXR;fDBI>rn0*uS39z51 zNZsgj#86{j&xkn8w*eQ`YrlHBJ(5jkXr8_Vr*mL)0!?kQ*=_(oLhlRn%R1x%2|f5V zi_pGpb*9xy=bP_b2&xNOM5Dz4fg?!>XRD0$5{4Jx_xvHC&7fk5k6)IPE8A=x*=oUr z{d2?Kjm4+J_k>aKd-%N^?mUuwp0lMBZZbGu0+ZpziY>E3;Fol}vT6f!WlKK{wZqyf zG)oh}ImRbf1*3{@wK?!bD`qWgkty@R6le(D%^A_}hg3Jo9Z~#lrtG~E=u)HIuF2(6 zHcz>^p7VRil$_T)yod;Nu$fpEve))Q+FD^ydqpd9nF1%Di_{3=$w8#73m#quu(Ltc zv-k15H~+J8J#HRo9!5NmC;|R!Rs#1AOgo=JVgIyCFP*PJuc|fd8)SsKYS@QcjB_6< zJe4UjCG%K^>K3>BJpWnKtDw9be#$5pmRz&4hnZi+#T3Oy-qZ?O!q$eloIh;a_z~^Y zDeEa`gH$4Fe4UJ)M}{RJNyT^e2BJ?N?&3RB9avC+q30`4S2${FRo9rH@IrjK0Az$~ zW%*U$qe#YI!|3x}w?r^@#fAAv=rQkoyJ=L1ih>dqQhYq$nf1qbG4u8MIutNaol$ibR6r&{-R_bN{{ARq56feCucH)#h}x6`z?E|?t{pQY<|iq7+MtD!|?bs zpstd5(;dR|MdFK0*C+TH)6zK7dv3~vsRz}9DR0#Va=28V_vEtdWW3foKcDG$A3{-Y z{dVclj=2F?43x(dMxdLCK`lh<7D8 zF`02BmAYnkX$4&)3|wwe{KncT`UBc)l5RBhsL++|$&tl$!#e|P_09vPi?|sJ1=o1( zW!c20KR!CvuI`!pRgcVLpzI>zWmE`MmE+7+=t8Pj-#+B&mr3wW$ML5~_gr=_$oOwj z5RSQ98yM>h0Yl`?6>I{!5(cl=Z8Y+xExSk&^@?0aa9hphw%B_s9MxvxH_h&b1s<83 z1)dP^sXNDBaTgR%#Rg|SR`RyY#+#(NHX{;X$8O%@3TKmPNvaq8u+^zaeDQWDL!a9^nk>l){mzM&*!{{v(`!= zw+eP29;K5{WuP0K1m4K$XE4|?SjXdW3yMpLt?lOz@a1)4sZ)9-*CJQt9;1@Wps1z~GzM(7(L2x!|XKI#JW#51aj2v$WJ5W#8w_MnZf#H=9ZJ4Rj zc{XFF&%EA$AtZ4^;VUAe#VB?%(1Y+hF!LTRp(40w&&qtUZ++Ctdw=_?HlXs)&b4C0 zg?C)xwAUYqJ$yk&JT0xRpPz?2ySC$iGe8lXzLgXTB3Eq-Q(#BdY>3xBR8)ygZe?;H z;hme8DYsciJ8t#sM>Y@i25TK{-RHSON z=T93hMcK|iUfVy~ofnfUJS{+OOSUP1d25weqi3Q${PbMhW$C(n5aLlpEOD?LHr7&n zs+}mrZ*Qd1FiWFe%fdUUKyPwK@#4defQ{L9KpwYR+9x!F5p)_Yo_M<3KT8zkN+iJ3 z8i-VHGd761?sZI|*Y8_$-|k=@C0tsBq<|T<%s#5h@s2{E3dTMr_FVqN9rj^!b3aCw zoOVfX^ms1|MJ5~``k<}PS~K;adX-*Ga-7y}tMWvmokYWD!zYVZz+5_5cDry=%_O+U zoTE#MOBBu*xRYUc#g1pfGdG@YJd+|+^?wt^NklvdHgZz%WJb6bahzMk?lLYKMZ^b* zm@K$t9?O%)5Q}qJif^Qmz%e`ML_ir$vQ~tmwI-Mjg3e^IQpmuyUd*Ucjig;ehG2Xe zLk?esr?t~E0sZ^fx{R#%(`cyPmh4^#s7M0Q38JBrbcwX3H)~=_p9F{)_hH5;4&e+N zkuZ^ONx?%|BR({RPy-!`&^{t4qx-Iz>R#W6;+B3~jZR&_-DO3KX|qE7kIvq;m?U_y zq-7PN|Mvc|>NXd~hh4g{*p|!{ntgR)f)SiKYPjGajj`6c$y)5CK~p!SRdt8BW0qAt zPDg?5J2Dxtq`=v}X#+vKrx0TbCBP=Izt{L${Qw0jotd?6#GP8(cRrUuYH2_Ns z?J;wo?C+d5pioCJbCxCmvp9~|!IXLKt@^$j-l*d^TmC#oPc`A;B+R z1?L4=H*O=<;v0oPRU7G)%hi!2WtMo@L}!dO><*$4#LYWGl#O{EsgXWMpG)&vL8tA~D%klS`1WlIk49SeLwY#6@}shdZ6kB3Z(eDp(3}3@0?4(TOWN^pVElQcN!W;lzdyrs67J`Q zOtIJj;_Z3ml8%e_DE}G+M&))B>LNvujD-J&AAV{qo2ip0b5KmE6|PlZffv?Ca4%bL z%>@igw>PrZy^2K?hbS#>{P;yOpEYc|(Mz1XS!iwNF75FQNV}}YBEvYjYyoBC+wNSOV2Eytfi_82d@qvhdYVk$V4ajxVPVC8O5 zh5rVah)?_;YMo-1B)r}|o20}$&%}^d#nCZh44zP>WjG`WQEW}QJI(Gysx20!a5f2n z94(PTfg-h6wm6p5p%aCJIcNlGzKLMMd%s?@NbVQF2%)UyVlfgzh{WUxg^SN`xWSD- z8)4Qw`j(1B(GIUQX z0eu&FYl3*V8zjO%p()StSICXj%vsU4ZvnFx9gr_NKHNIg&m^ zKJL>ni?7m2cKz`-b%ll4Q0sBZd>(Eux<;=O9n%~vYXs~cn{z~->q#^b_m-)XeF4ET zWi%!K12h|ZQ42ntYm?e-y7dH26J{bIBHrg#-!?(;IrV`btcVl_EUC=uO!*4&?2|b7 zN&iXx%7WkS-9`IpE%g(4joNfb0?8gpGN)Lu+_zTMJs_`Vxk>8KqzmqxIA3ofQ^EJb zsz05b$h6Vy$1j4CIMf00?VyNvKkrC=*LlCFWA=I-wR)jig~VEC`5!W*kUZ>zrHFfc zNkBjdWj)|GEl&gm@6Gi)H88(ihf%a)*!*CPO^7K#(PIRikp$c!4y>GN@v+qUJFcbH z_#R@SEg@~>kWHmajh}0XSSmNpWj)PhFB-|l*XNyMTluJku$%(XzCo8TVF{O;=$lLL z0l-5clWw;0gpZt4SPKE|(p%eUlnv$^l(xr+ViL<7u4&TWiR$w~vD_20ayn@d_?>J* zdmGe(IP})Nq$M}9-Oi@2tlZeCoN-2r!QujS;WsEbYq@DSaQ@|d<(5pHW_FVQL1Cp`gv(wAI2w^CSfkg&>HvC&BuidiN}1hf?P7D_q7(LGWzE{A+L zYgRVFZK6tJ!sz*$&~FE=7KUz#XJ)0^22@pUj<5H|+Hp^E!7j4;d&cd_O^o(YK}pbp(VG-7v*>x~$fI~Nn* zAE{k9-EXpJ8KsYcd|E9v0wGb4u75d-){})@PJ1EbsYozgagMm46;{tkXSBkT!2BpO zz<091x)ZoAX1CEYXC@d6JP3C9*vm?8Fc{-9WTqL5wv^GfOVT@{wq9LK_}*$Y7Tbx; zfbnHZr+<`<`iLg}DYi#NQZ}QNu80l76e>xI&=q|w9z$5Kqi>z#CShL7@pIb(Q-(tYikUkuR&g%+Hfz<|@ltbj(NVUK%q2d#@ zOPJ!fo}oZ}b%FcDb)|EfPq+Zi@4=v^o#&+9Y{=(8g@fa>9;;7g4QKpJ@6cgPM2Z|v z$98qf{K|eRY{9{}e&Rk!$7X}1AxilJ3g5+`7q$T5iXFe#J{v*PcA@oJ$uVY!2W#8a zk&<|=LTl3-GFZ(U+ut%rZ8yjt93MPO<4Yi$c9VCnb25tK5yuo;%sdEIq+101+korK z{M`EI$Zew)I36kza3_%BnV%cMKvJ@5Ot#)mihA|0Rf+yA*VrpX;`D@8(o zGD1umuLY9Q;PYN6w`raY6D3S&(l%n~l2eX6f|9DTkVN5vv`*aPiSK_F>1!s`+=);e z=AW9!Lfqmx0A3Z{iD$ZrwUJ23<1rdUuffH^Bi{*N)H;? ztD|EtPD@Vyw(r<+ki_>&y*WTw?=ox{ItT*e9z%?JiQ-z+u!^vjbZBG5w!)Cs^ZDa_ zxypr$0J2WRAk^N9d}F(2_W%L)bv8llW;{7~2#Nf3A{LEw4deBlZ1&*?lp4cCkQ&1n z2WbmsQUJgkCz_Z^wAD;+@1P|{hYmVmZR}Z(N)t3sZAXVZ%a0i>Nf{Smt!wseRXiBe>53BW#H~d{S!)^6(7k!l?Ns_^ZM_}rt?oD#8mKfU%@o7c> ztjcb$(*zydX>};5Tge_IvMGBxGCsTRs3@*CD7QxWZCqp;?V80A_vZ6tB^532F3)1# zF*ChRF+5qL{ni$X!M=7$fY+L|gbJa-yC(#UoK`y+j!E279vmLVX8AZA$>p5#PzvI{ zJ*beKM7{IVtL%QQf<1jQTQWN{IP?mgo&}BW>7@6J2wd*EOQ8%13I?NZEIazjVj}Om zw**ku=~3<;P0aXpBn26&P-Yg7`3&bEzOGhNw^s%cB^Vn13Vx3^%tP`pL5#?v5qk+- z#<-TDj8L9i!Y8M%Kq;D3UJ1$aX~rK5K#m~ggnl>Kw5%h@6H;6k&@BePfDKhHp>zK( zRFy$9>w4os4<_Q9On5;%A%PpvlAK_Vp9{+AlsL|63(!I#R;w+us&`B__xi)GYy?&$ z%Q$YqZn9KxxiAw(xF6$zBJ+c~-axheljF9vY=Y3-Ho&E4;LlVON%38lh}zw91Upfy zKEwbKbZ<(v6+7@&v4P&>npb}O`PuNnJSC6O!_E158>%AL5U(H<`0ZRwJUq+TM-`S_ zj0;zS_peC3!+Yq%pa8fvWKJ`&>=iFt>Zqk7OzY@-YSBc58{*m^J=SYz23GDvV{#Bx zz~Hb(YE=F~Fdtgf(i00RrxP^y+3XXO^9YC}-|&5mo5vUrQSVviwB97GTq|vXbzyNx zuZjR&o7St-WVziL9@l4|!9&bbkY(us4#@n7+L<9-%v-8+g#ptKc7#K0T#ao}L*e?A zwgh*9jfKT14%E_AwlSxAA9FYJ5@hEnPJX^}fM^62qxC(keu+IY;e?L_=cPK0kK__d z(19Q5xjp)Yzzz<^QSP)9VPMc0VIvl%*^ujH!5uK@xZu;FDqE{vGI_lrtAQo`=_+&n zbtGHyH#j7I9p2 zf>j=IsAg2t=a8EQF1Ka~4M!SF-zu68=RErtQ&9?r{YUcxHt=q`Wm7R{!dO zC9H@NzY^K3UTKVL5YpgO87^u9vgH2t4B;t4$zBZpUYCT=EwS9=Iweb08zF+4yAusc znc}B=7^IHFv_nW~?MlNuvJ1~G^)6@P{(c9%~2&+u&;h@nUQYJ(wyW5YTdr@ft( zTXg9X=VidOceKAlwfe}$&U|XvhUuyl^{!%D%j;u@T}wqi*B&iokzF$p+zd$$KgLY3 z$Vya>DPTgH310IZ zHk^%CRGOXr(I6lnNx6}eCNByy;0pktAZ1tG5lgA^(8rh24648)T}L%>+?NB|ZK5l7A1zCkN& zd6G72r%!=DfkZ&(O6O`Ix+4X*7En_&F{So$s>n|XZ_Hpk70PPZ>GS2zD?~>aYlpoYy8yV7l-w1 zI{FAB`+P)>?MLy7x9QHaqc`ylRZq-4bsmsX)Scq+!`V*XXA1Atd zq>d;*V19f0L2HmP5z&)Xb>6^YbD2r{Ct-fS6|DmzZgyYMKn{NcYTu8j3AyF)MN@}$ z)FW>yMui2;A~BmM_SIq~y+)!TheCkD>&HBu6|_STu!I!YJ znIV|k7Z;0uWzx||;Lg2WT0FK9KI;MhL zrIK0<?{v4<|d(wmywQN!x1CrH2@LR$zFNiL`Mnk4cOb9QAk~ z&CD3JEPuP(u4sCKNO0AGAA;&0Yp^>Do0!7R7>4@ibaT|xu;W;Xa2i%y;R1k={!|hV zDyA49w@jfKE&F_?+9xbXPXWT4a+DEBbhB8XT<=Mhhf>fyy~w$U!6f9=(EYr$eAmdk z;kfv#IBo%AxwRguC6ZWH-ZRnUn(8;(QS2!-_v{kbqA2F=$ZEp9gNDK7kyc^ku$G~u z;ei`5-?pygjjVqgL_jR6+=;hN0`t2#p=d74RLwGM%*F;trD^S0iU}Lu-hn6&5IE#o z=OW4R;jd>{KYLYDUdt-?pVJTI8?4=0tU~({{Vj_Gu39;YAuJIIy44x%_3LUk7VHR= zp4FZWg~@!W<6ZeSR=sS_A^9f$vdit)HjTBQe5#@BeJo=oIvI4aTip@%$d2HYb!Prg z0USN#&Qbmp_Da7TcDH|sEb_2_|L|!ukRf~8#rNx<3kpJS;kca-d2&0q)b~^oMp$l# zdUo^db}y#zMTtV~LJqG=Rv7`rMK*M%0&~`em3{+?akC!^Ne{ku&%fs01x}`o<_O>A zIx>@rwH4_SiK?mbIH8-r3=((oFz0m(3)YqpDA|)a>ZCzUaY%BI%XICxz->EYUCild@Rc(BCEtVI%$U$U7c9V!e}~)=(wqUsK*8ix~Q>2 zM=T{3$Q)7b_dGSi@WjXOQUw3BW}J5 zzh1iio!{-!cD*E#@)H`DdNF~LgO2e2vrTydIpQ<9z~X2;!9`rl2nQ5(06O-$v8Zgy z<0psBg#9`Ny_!Z&=8aU!+Qv0u_%|`@k~98V*PX0+zJ_y|(D1PH+!LK`{n;J1S<^04 z9}deMX+kFjJ-)+zx7GXbz*#2+UwrABQAzwswz zhNpwcL5L)o5S_kS4A^Nmf_stOr`7{Pd$aO4WXp0=a|@tfA)tu0<@d%$@$E?GBTG=m zWp(=td58}pkY?kpycn}YiEonKkukA{UiaSK-=PPQd&Ss6x*qlGw}xj!rEH|XI4c@0 zY9pJBqGMHD-40c8B+2NY>3w;PQwPGCKkNMi_gBhDo|DfVo2kSpu}yJQTVsdLMknI1 zE)uv6iClhG74UzB`OErC9r=z{*)BSm|IwCe8%XA}pk#Ve!T>-h8a#ruf5|{1&>n+s z5>4?sHL*0`2jh2Zz37-@b!n%M^mxRK5~T*DrZP1B{lBP003kVJKr)@wd%5cT%#BLK zTjbgVcLg;4RJ%Lkw}|1kBT^At$uE8TL)0a1ywO@N(oxuMFVBMvTQeY65D7qmKpMhW zM1f}q!AUvepbM0-Zl6t>;H3S}yFg1&iB7A5+@pzz)~V+CpA4Xp4;CZj$7uXSQHjD6 z+DGE0q7u&8uahGQiET)*yrYgwB)Sw{0{Xf(Z)`XM2t3J7!v%~`1a!O37za)ih6owh z`eNr~eY;>8?XoTT_J1lAhZC+=QUlix?3ZYj-n5&YDy&(@+;nm{CsD(`eN#pNerOv} zsqvyVLbxB}Z1y#;+Eq!VZ2{6a4Jz6+BokXhO~=AagP#h&^Y@xI;g3fZzVDYLRE!lU z2m}Mdv$6`TjE|&jLioHiHaH0vXo=9)<$rD?C9;Y;(G&pgSj}mX6F@2vd|d25yTuUVsI_}V(NJe?R1{N=y)(TrypP`Ckka@v#mo^%vDvENy;3qJ1|)NA<*YL z>QqxdO-P1|wu$kh1JYsbmgOSKO>H2AYll0YHF3a%Z%a%t8@7~JwAo~2Ss{CCnFgeD89I|pqzPVbosb5V6gC(xMEJoc2S# zU5-@)g>&rwTg#&K4DAhHZ+xb>20e<~OSo^Rl-(h=zmrYkycaF)OWOt27S^=aBulxO zuiR&fJM=i^6rUu1ZS&_ZKBFeNlAi%_3O5uqL*|8C4(>emdpjM^&fA`s!4o5!UOv3Y5nro z`+EgJIMUFG5wn_DHfOb6UtZ|> zBAu%;X@QUMU@Fnzg}pN1;HNQUZRxW^;@Zvxs-3;Do+-O(KWH_bo|6YeU2axqlB|J@ z;Ys0WNd=)%;Gy_Cp*^|HN+8;9`ar!k6?H^KKr48dQI|8j#+~_|BRTenn!DKiVg-ea z&wtkR?qpN;-5rt7RRL$C_6Kx2~z=yCVY}B~m9CA3A?;^C& zXj8`Sld>f8$Ao*ME>1n3-6L^Ud1ulHrEH&a-$@v2iu8i6Rwsqq%DCMr?Cls|ibL(WumvglALHOc|5o!?uT1w(VwuurOCfQ*%-+UX2IA&B!n-HlG= zG%Md~2%U~JSGZh0ed<9+aBM>Oh6Ew+W#8cUN~%9_NS=9ji?7miWSRR=urUUyA|=Q1 zykqx+h>knpfC?57f!V3&l-M_^zoKG&Ze>PpC=`JnVz(IUa4fRyWLYd;Wa=ZSPwmd+~6C~qp0&ooT~x!Agbrh8zKLfG$O|0eF>`K zhgP9f#A>aS4(Xrdw}+rkqquKt*02l7lOnsxlHPk5RGC0LfwP&yQCqxXJScKFSj`&u zk0e12S}5gI#-~V9YpDcqM)x+8EHixNNpmCct@C)6mO^|u5dkfd9;$)No1$SW$TN9< zl?WuOKWA=~az~Fvd_mC7i!DFh7s3?nehDk;A?XiL`G(a`9^h%0BL0cwS>7Cm0*yd; zrnK$m=)!D>>9HGAt_@PavRSSR#n@*FkAjP@eYSTI!n+8+n{fH zPNELYNXEdEPSSJ?6(SkgDGGu3^~O}<-Wf~Mn;iDK=3P)Lk7?ZW_(2_O90V*`>t~k? zKu|se-<7}$9;JUH26yKF4BIvL2r+wHwu!~l`ugy=T1KfDr9bP-V>0~aOl<9rKp#sXcVSCKC@$qkE@+u!#Msibz_?zC+VzzX$VQf-F8J=7~qn;P}~ zikhTp`y-h$fPDFH^*H3h1M>!$0ZND>9+Am6CC%=M0t;$;QdM$+o6p3AlS((LL9gqp zTeWsJB;ajsvtPz%XoYO_j2;oZtSHGD;NR0+@q2EDa~6=1BKNbV=9_6FB|iS;*k584 zn?x~JHDq=*ci_M=9CBzOOC~eCeZp5_Eo%~I(6&F+VsZ$5pZ{V&6@hPlMx1iL-wFt7bO$*HCz`==ga{KL=l;= zi_rJHzl1&eohlQpnOz=vLd*p`d(o=j89vNzCn0{CTW-q3$ZPP~WPp(e^CbSFHZFYA z<2-&nk=UCsLQ!UVs%e_??@vk+&gYwJK;D>#RocHZ!P6t(QR6ch7WJ8Yp39qj#TZ@T z3-Qy-g=f4nnMVe~mp&5YZ461XoF+*-0)}%I7T$Qgon=UI=e1C{uAXjiI#X~0 zUt|6l{0|GD%=@WJIiL_E%P9gS}{P0VE9Zx*w0pqwDp@Jc^{14>INxWDdWwI4C)#HGZ`9>J*!bJXt<^ zxfcfAjXVTg$l071m?QuLF&;t0(qmg5#uxq0%=2+h z$l($Z?^~NKOGK{Or2Nlz{iZ;$$*RHHz+MNNNqh8se970$hf4F8pV3Uh zadYtxdedPAHgB8UkPEe3NW`XTl5~K?xf)|^3lD0rSFF&zM$zR`*%1Gw$0AJF#Xyd7 z?vb16@ky-b-n&QaGBU&P3%=Ba9Dw;uZqlQu#&#L6U)^)uYA9oM$! zBf|fIEBuGGU{1mI@n)|i=8aw2znKgFMKCzto2RZ4~lrCjaL#b$Semwc46V`J74dKQIscEWz(i`8!Ch@&5PL ze_xvPioxk+8s9%2I9iDj_;8D;&?%!tr*YJHtV>bU7K6jmZkh5w%s9JwfIFJ?j6n>i<9A>i3Elgb|Su zh(lJmHQ2Rt>;{F%uDK$wsF?Tbb_8sFov8ixjWND%yK&ih6$Cor4f!t-qe5{mBx~};d(aLrB#Nz2CCRE6zWwz19z%8Z&)3B7EhH1K8 z*l`&+!1ZfDV4}l;?jAFpkQGK5pCX~O0f;ec{Z`Ixrmn88Vl`{iO6UAx$GOmai+h&$ zJJPRh-%BfN#u+*W#rT9J8ge|oEy*UdF?HN3I^E1FRdj%J#&RCK+A7CZb0BtKwfRMx zb^ODHf4`y(j%N2mW3f^i$E7>o2FSj&#Xluk&#YoynsI?;*wKMopjJtgV2eRGpB>hW^w617sO)lzzgTuKY(?(>Rw}=4L9bOz+Ty%_HZl zfe|TO9^5~=;^(fVlcU3uh;Dm%x?=lfOoG%uO&$9t*HU?{U8c3~#uXQS!3xQg!pgHY zp#08kD{{jlSuLdEWyS(e2Sl10mtAX?JD?D8*D4amKcda!oxY)~{+L%T^{oT*tL^=I zSssq!Fy@@w?{gFsMrT9u4J~Qy(=BVa4D(m4Ikmwhl5^j_C8?jFM6e|`-hqjpREEc6Qi+6~^6Lv)f$wDsvfxSnI)Cr@pyLZ!q^XB@q~ z=|m-ER1Iuv*tDKi*pH~o9PcgNz@bCn!8Dfw%pPxzb5e$A9fQapp!qn3vS8UY!ET^m~7CU5r-ROyqcoC_~v!s+Bz2@jj~`u zBD2qDmnP>cTAJThY+ssMkHkq1_q=Ur{u3;)W>c|YC5GjJ8gi$XVBwv$XxHW;*wIyU zjo#6UzL}*JgfFKhJf>t2@{=JHgVB>3SEw-@h+=_U}TK8u}*o z%R;@Ox_7GjXYx-e7fauHO@Tn~+MnXGv|D8kHL!hICgvwzvk}At3XA*B0a~0jR3()i zm4vHdvGJ;=-gR>e@`!#2f_Fn=twi1De2M*wcZHs@amFd@qk7KDaYsg@@)k$Ay~5kRCCKNh>{Z^TqRKQmrW1ij`q&cE>bbJ%fR z@~s$?6sxaqj9~>@8cUx(aq=_Q)_Ax*(4coTACIY<%f9BU%fa<-Lv{{OU3J-3O3Xec zpZpgGPU^(WN4b(RC9IU+8zOLI3g6kJTg}bQg>+6u!|-eTa*_pEh36FXW6? z-#BDY(y1Fite%YG)Fa>5)nj+=v8a&`8F$)Ogn60jR+Ld^bfxD8@I+khmu{B!r<81} z+rxaca*h|u-~a9W-?LQW0E^RsSwP-P%s}T7N~U>GtTOPkw@41BH9pBe@hYGKGKSPx z>o>bD0j&)2EQii0vz%zmfzJ<(>IWl)J7@jfuA{u$ajWxJ;{wjvV&2En9eI?Ua3M&j zrp$!K>jRbfr_f-RtNB+d5`Eq#&@5etv9(&tz}ZGAvUp9R z_;bhnrfWQ%vS>J)05F|k$f10KyOgm|sg4f1WNr!d9`@f#9+vw%k+aO*Y{~>ytO}|b zpEc+krxv>~9kxK`VXm)HzD!fI2OAfbzwb29!NLLOdm=DoTIbAu2U>mkxP-xYnQ6_H z@^<2~T(Pj!)Ec2s(b-e+8cT?Km*%rvn(Vw@`wDhL*|sp=e(DL@Ngl7+pMb(70#8Ht z-j6Ia9Q|BjY(O`f>2&q9f>@531FcGOYzDHf37KwscMt>qk35l09gY=n+!syqG@>sW zrOV4MeNMt(53{O7|IK4lL^%lV*u-iJo=1qNZx!m|FSYUgDcMRoqZ`N zpD`wDdf3v(yyRm=C)2`*n(Yue-Rt3>`W0StwBN>=ooe?PNoh#4s7Sr_r{z1Abe|IF zmSlloy<@N7Chk<`+lNS)s8zGEM16;>PPyXFm*x)BvY7)7#*A;#vRh}_(<1h>v-8c5 zAOX(jK_?@m-ZTy|eoEPWzL_&m>Or8ES4@Dr^*=V>RLbhqU67OOXaDQSc))W%HfMMUbpN~ zNMGTUb;3Fxq!wS@OFgmXDxcnt-zO~wsWFM9aLlwfG{C5|7k%>-!A3a?Mzz9U&dpuS zZ1k=BzF^O1G@GKi{OF7int%TTXgBId$mXXrrt8@;*c|ka^MBW+JO5HZ1=*f_|JUOG z7F^$-{!5lr-<#+g`(Ig-`~0set9rgKp7#77vgn@tUs-go?AT=GAF}BGt4^bDkg(zJ z(S5igzr!GK>3+74*R_Y-?DQssYxu_?Ls?~WFr8iU&QJ=BZB1b-mJPB zXF)G8)b6#oVQ!w|=(aM2{5silJ;nZOj;lHLrkzgL_8DgS7nXNZZAGUoB~;?^HwlmzMPzs)!!W@fey z%!CNg3oBJ(xJ=`JDB1Ye1X1O(Eyc98FOU){+r_q04$WjxW#fdO`!w$5s2?kss8!Bi z8R~(`V*_SH1b*skRRmj^O8@PF;$ASD5<0meRJBr>s+O^APPJu9j%Jg)RxI@s^E+ui zBI`t5|ES~e?70qG%IQd^1v8_Vzmb7hwd<0zP;}f1_W~h{Ny}p=n!m4}yJpbte=X3! zhL;y5Gx+EMY1;0b7dyzjyZ3=p68=H+Oi!Q@YEPvP0CymuqmLLd{x6Gpr4h1R-C%>ns>?$4)q_cq8x2+0-1> z9<4s6c`Qepq1yvHf{2kPX6#~xwDSXqch&NrPtr?IGInf8P;-6P_=ZO=N9Y=bmq_5D z>vW-eq2a3>x;fOz_M!0JFuh-iB<&A5%UEZdA2^P?!f}D`PsyO&`{f;lO_eExF3M3C z8vOv~)Dr35qQ_LT)R;fj^!>z8=a^o3fsPZE0TnW~T8{gW z>!|)!w$J+PcpJtGJO!w#j$iqCkszC8;91d*lY+WV7*9#-+UjNqNgquhrsJV&(wd~5xbe0fVEbdLXRC-i_$4|;WGzYdFx65|CHHPGv}TeBrOnK zeh{I#D4=272ECHKo?V)9!+ul$yyB+cx$f))`2HgPP2pe3ci2QX(YVmDvw zx?1$#O${p9gbfgEPA_%mTOEGiUvA2YByXy*{g--w*xgRU-f=sv6+VcshchsSt9^I|q{DEu)yB;@6@{pp)gF6Q z*6wtoJDoA&M~#5Dv$F=qxlE1|3%F6eHLs#}ROW`_=$gyIk*X#SF`@l}CNh~pdT6^s zdScCEjs?78-027~$+mWU+PWVC0W%I;SH#kfs?jpn9svJ~7{qC-{xY49cj|EcOyE^b3^M%)SI~|LpQzq}Y%>tk zC(Ec{Zo~l}t)b_B33126O``%NC@L9d#vzm>I3r%!*j;o z*}^~HHw6?Nx+Rp~?TX|~Mxv8Fcw913)MMUioG;4@lGF2jJlq9=db@dYD%ldZ3sM6t z&|k!e0kUi>+->p!lFUsSt`U8r*JQo3!~oke>zoR_(zk>CZg8tB$;1+)5?jG`ZrrV| z)vu%v{7}OaYp$^q7&~;IdQO8+$G(a21HKpOQkP?_e>rRyE}}9nwAg;12Y1Kxj6v7~ zB&(@m0(GseRGi`EoLfyv=cy;^H!a*A-m&e`YOd?Vhmr%Ym#x_?tlYjtAIy9i=eHOq zn$32u3J|qcE!=H}TH(%5H;U=p|6-P=REA)NwdEQy$GaxNl0Bv;mq$%9QdY7_X5bLu zak2iAo5(xOI<(FH39e5VaP&$0mJamGc+KQH9HV`EPg3EWUhw!ZpmB6qPr2zc`S{}s z&tRd_EXUY%@pX}d5e(K6yq$A9vWdZ>V#o|$ExC7IO0=FbnSI+@^WF8p)_#+!-7|8Y z>MmB&v;G1aBzdED75bgiBUL$>_JvB%x~`6;G8OkT=Dx6deZ_YbRYoyb$2xJ!6R7^gchoR~dR(a+^+idZqo8fCp&PGNg{_ zz{omW6~vu8W^EUU3f{p41Kmf&>gYP%Z~-x8)t}jqaO}FEM^YQEE+D=(9 z60@Hvf5om@v39PL)ymbwPA0&OQlR2qvWc1znR6cg=EjAi6&Emt?5&&aEH_|#U32Ls zie=e-jH_;T#7%W5I`m4?xc>K4V<4vZw+EXP<)6TvwX5@GMAK=?PB7k>1#v9i2Of2G zIqP-J>>)<(V#2;h$x2kT_GH4!%u2i(`RWFj$}ttLANHyjWBJ}nvdKDfM;SXa|y z_2dzIh_f?%O&BO71DGTihsnO_@lf*bzBO2XCyVN?{j}omGOC;*N>ij(q$a_0li{4C zu}{So`FbK=a%+(1X^>S5NP=cq;?4RQx%hpLXiA6LjOaI8Pds)~QPGzsJRv0!kZeI4 z5njW$#p}=gbX#GjK7CG^50)ZCmYmEk>6XPGm5P$HA3+O%pc(osks5g5fiWUvsr*^C zhF+*X(30WtOSkA0rA^BPBub`dA4Cbtg0-U+#6k!;zE#cu%H?(| zuTiw3qBR#O>q%JUKq#_o%MprVuFMN(04^QWhiJ&shxB5v$Ghv1l?O-&&ObEytrK8X z*mpcS^2^U-6ZFOzYj|*>QsnTTlS4cO1?h^6r6lt{U z+$RDdOd`0_knff7BnW;455DoGc@%tT-q&6EMVXe6>pftdizZobEp?i=Vni$8)4K%j z=_kogZ?AjqrQ1KyS8*IpbaM`TB7>~95hV^2E{+RjlPzTfZoW5`*!M~ry;fug^^!8| zJbn^FrS*8gdPeOg54f4C`e#a;aZ9P+RBY&t8#ZJmzYMD;94^Zsp5e7cl59#Bpl8VG zwtR^wFlz?rUjCwaZaMPpvU?{dVfx~BR2sAuZ^JtfYq&6%Qzs%_JyGR2;g{WRz9;BZ zD)}~`VeyfO?-!wr`dp>19)P3EOwzn{3oGVk3stMRqBrf?Vo)I-u!XBjG^9tM4}X(Q z)Pg$me*T!Q{OtpTEC`+^RC#N%Lenr)dunYP$IR^rt-zx+JLuo>ic*Is?z!LY-HhqCYJ z)o{ih(pSc&ZlFhwEs^3Aox=TT!iykRQa?;;gegfZ0h>sTp2+;Ftch}bD5v`vHG#f} z085++O`@7k?j(nH(c{5nrzYqgQ*^qsr?Q252HBekLh<+KFMX9&{Ha-5uDQ7ihvEZ( z-#+opRBDu|V(*Y+L-)({tTrwn%2^QVjnbyIa z+h2Ep@mXtH|LSD_~XjKBD>}5od_3?EXa)VdU6NB@l)jr@eSm&RkuE{)SAKi<{b`Ku@)be9Usvgf?K%NO-lHK8A5& zq~f}~{r92{BHZjzQ<_QZlT@YFrcQs^0tlwcOwy3m=Hq}f{1Wb<8Bo3tL2e)+2Vkk# zPKhw)5-225YHJ<0QnfZRbP2#uc2Viq$BrKKIzmU*+!x+FT8@&+X&_?^uuuQyZ`q2u zk`k#I$nmTJy1TTDe0u7ChN~M9_N~EO$AU}xWxD24(3svj#1QcX9(Qnq-6C4dR0hm^ zh-F2$o{j5)J6Eu1eEPuOpe10AUs?OEpIg&`lHJ3fZ;$FGBrm-H*lt|)ntotjK>P}L zPH`TUI)YHt^lfQJp#`sbTc(-t^s-$TpdKYs2M6!dE@3=r*iqq(tw2H5V^34Ry0gY1 zbS3gd>u)z13po0Q2}<5tdpYAu0p`@+p67L=VP`d}+MaK+zma(B6g-pS8$0kM3()sR zvRL(rRa7IFKk<)WZ;8ECr5!L#N!MyjY)LkhekL4`Jcb6CcO;(RLiD3KptqLa<~I(= zo_`YzcitHIyn**d8Ih2ch(+p94zC{CKHns9y;&=RdbX@9)28ye|kqr zoy}RK&SSCT^($KcM`eie+NX+6uuCn!)^bO|k-0#}&nI#Y3u{(B*D-IKmVr*7G?+%H zkm+E`Vbu(?EraPv%il!oyV;#{PUc@)xi*pdqpp2_8dU+Foz4&jY%&nHhXXXDk9&6( zTdUeevln1aK9Juchz5O^Z-Rv&y3ReDs)qR0=dSUPqaCENTcE0gl6(8u!pywuYLL#F z=750c+HquK%Q>e6AMf}g@5%NMu;dR=S_7=xJ70!mZ8f#T1@^@_d#fkbi`1V*!vyYW_maUAk?cFf5#0W~e)j?6NsRGZM1EW?0 zrm)IN2{;x5i(ksg0^B(H*vrBnLN0N5n==G#cEa@tqi10b(=S~DPGS)G zRdI_%IUU0t#{-(es~m`ZNEzhDWumSzn{`>q6g%JDFZ}5ezNBV$Vu5y_GepHzLDqz& zc=l@zId+0hCo!0s_(g^$=H7!WN8<`tuP(+Mj4*nwB?CdG17gtBd1WSTN%F=q0S6%%ZJSp$}ewK z4H{p!{N289&c50jDB^fxp#G#orj9zF`%aoIv zMil1Kic%n6&Rvb`bWP&P((tcXJx<0g9&J?^$gN%UpCLCT)G09+45*yin5^c8_&T+< z^V=c)&R)p-Mw&G{eaJd&`c2thNxYc_uDf!*k!R7#G*A^kPu95A7C1C4ZVdo=M;0pm zHdwTQT>(&yosz3(6%sp_NZmG;V&n;GU&cS=mdzo)t93==Mhe`}34N!x;?&{z>d@}T zRQ<6&Zn+YCimO@3e6g&7jO0a~@4dSK{g@GAA=4QVjV_RWu`8oxQ)YHnBI=B%>hx?m zz-7;lXXw}X1!(6ECh6zGVJEm})-3b&h6>14DHL`S3c|!*PNW}j>=}al50Fd?*bLwe zxJ=FEM|BVIQS4f4|KSoP?(2(m|IUS7EW}!wWqw8T;E6I*`TB)|4rmLtB;_Qg0i6H1 z!+=~hn@S226|VO|G)<|g@noN^oM(5DFTj*4*Ang(pigMsu-`j-TTz(~NJp=jie?@m z>YCv8#sUHA(63s`fsPDEkl6OxgLnjZp{?QFx?OyZJPRKoo7FoJxwWJVl@$2^j$-y9 zV*eEBaw}Su_pejJ$4IGo$7_sF~*rwn+UHs{RNMGb;;pK0YloGCX&53=O z+22(zOqh$vOWE(h`YwaN#L$PEDN<$LmgvP;$|VJ}CSBx`#Y;e=!CWKpSfg8g3p1cR z@W`}`5s~I>ig@ST$H0v(xt}QCp{VrLs)Eg?JD7E<3olX-^swakL8O%B7t zx+`5-&ZGC=S8E`Ro|lsaY*&AxyvRn!eD=2n-0F8&USgUE=a(*ypfykeBFBtf^3iCJ!&hhZx^ArYlF%HPM~<6xxMV?*Z3gfxRULGaVHR*ab1`#~E}iwm zRHQhTCqDeg*4|#T@PblnmRI*5(OzEj_ngE7m_`f~HGZe7GXDl==L4U2_J5M_MoyWH zD6y1Hu^NL%gin;p+8)K0AM}BYWSW{zVUMI+(;@F3mZ&I<(K&^aN;!y1E=e8U;pT&b zPhD(#KHQ&AwhRv7t>xx&XUnrKhTsn@jYl zG{Qx5nq)L@-6)@gN#R;)CaI;gspF3Iyid3HBrHj`?oid@JyF4b5Sl`m;6<_c`dq8W zVqhYH=r~x0g(BReja|^sxGN!)W(?2Jq%|(7@Zj~Ot2mx~Y(6OCX*~?<6PX9XnsT`G zT*9A&t)d$`F<lwPe4wDFA89HAsaI4>zjfva7qu4cVod}fD^;`noQgyGFM?s1;8#_Dt9@m6} z7Vu%7-ZtKKbtWT`xfNomg!&VUA;Yeq2Yh6#y{dbJ!Ia~;T&F!y5=da5Y0Y>80j zOBXD?9{d2A$oBVtYu~=tWY!Q3uQZ{S{1GcQZ~FD>I}SSfxl!||%{@)^rW4Y)(Rdy$ zyfgxwce-REhvs~+Dw!~Oj~L(LFM4#aL_i@Vp0Lj^jrZjqzJVd|bwcw_bZyuDW4Vy3 zhXgJ)wtn07pVUPz_pgD(tPv8P3lvI894(uaZ#Rj5I97d%wUgK8%es?mq5LHx1yAZc zI#=IN&$%`J&@N}Kd>UpXidxI32XCz!Et{{#P_vK;l)7>YumURrA%95e^M~Wa+>!oR~Rj>356^ z!uLX7%5WDJp5uP93pB|P%?y#mfWpDX`ygE&R!z0P^xOK-)II75d;ZTnH>?pOPo_{RFONl_CY5$i1V1(r5M z;F(5&mfco*_gLx%< z+3XGi0Av^x3$`B5a@BE^sCJ>#l!69+4Kz4vNfzht6W91)rt93I`=VyNiD8+Q5*LPa zzcbkw(n}CceAqCu^oygg?N6S8O+#dlWw@L;KVs}sbAFxHuj905*S;wke1u%JkzQAF zrX8cpl7XrhQ&YhMQXglA*RWZXGOrWd*o89cq^Ou%Pa51b!(*^_!26 ziJo(FPA#2ZWZ=&|dv}sE4$r+ebi`kObJD`B6vQO!?ZSQu7Y?bCcR=&x6sl*x~ z`iqqum;bpJ&oGnY*&jiC!^GI{!c9K#vIZHfQ-^xSj3xOPfy&e!`Kb=I$Xgq(d&caP zCWbZ*kEJH+ zGX9UFSL`KWEI!}Rn5Htj_t@o%+_fO@U|k+~@r3yEga^VIB#PdA1r5kBn6Zv=y$;6&+?tj>Vm;|;P@P&7 za`wbzjjU8&lj-^7#Z;AIyRkb0k4drt6$$gITPxDztd--erRQ-wMSAm_IDo1YMkk!r zD7pHXz^;nl^CI~seJIl}ZKfBz6d2JXA0jZeGIuCp6{-oiEFoSj>A-om-l(0H+t&__ zFl5^@c=_h)>xs8FbqM0w{)`-Zaz6w=+j97qeo_HAi26;>Gm06SO2YJLtmJW|g)*Ly z%=-}k6*AI}ymkfQ(>Gk&f+~jeo(Y!j^6Cg~i#+oxW$OEXvFp!9cMSxy zHWNL=k}6x?>Lu=q=;%2>lwup5ned{dZHtD9QFyY{d2J9IJwb6r3Aed+l+Df8i+z~} zbF0QQovfc%A%V$3I$v_Gid_X;jtTK*SpBJxEo>OiJNWL0rQk6#76rdB4M%wug0VmAF=xr=Wn9(0`_vUqok zpkwz=0zO`W{)D@5H*3+YzJ%RuOiwn+v83M`p&>;)h1qCxjC5^ovh-_|fJmJ*K}(~a zIzDxI!^qe|am@;QmJY$uQvaPY#0>4tGAY>A!Y;u5Gjk1^muXR7CtWqV!gBJi*vHM{ zFFz6@DaC1qwLX^ZH+fJjTHFsV3_CEQ7npl`l)2Ps++LjVosP!HpK^=qerQ8cOJslV zop&MXY79+T3s1D(eajcRH%3DnSDP_mOCqmPCS&T#Q#G8-EwV;eVs?<6s}wjF=-r18 z)SD-LT=jDj`l%9SHgfhL1@#<^72pBg?Y}q?{KN&inG?9&?gO3rV0IT z{fec=wS2NmtcyCktb5dOJH00NtKVlVf58mr)8oVkbjN2>c2J*^k-cLi{Z9ax8)x)a zdXvXj??rxoqDQ=N`)FgjB?10(&XM%HmEipPLih=^$RnkBEzW5#(WnH~U~b!4hxpdh zcwf7A0@Fn5^pzGDrBS)Um6;Rf`f zRylzE@l;&!%Uv?i)P&W9?b?_VFAmgt!^%?On~mvva&*Ph+reRfPl+)Ydq*g=MUW$ zvhBS%`Rs#Y&Anis34Do=$A4@ji_OFIk4o;iQE7Lv64?_8DZD^ZBUqQ+-5G*L8$t71k&ik_^zL_l zYxQ0V2OZp9UetRss%Uz=W%F$X(%-&%Tbnm7jylV0-CFld9e7fHxc!WV5T)UAmJ;KT z?v_e7UXrYH0gWHF-fAd-xibdDD>O}>Wg&Z`f1xcC6C1i<-kO@pCM)2tS+)*L!x z<-gcLR#7H@Ku~SxeP+<25BGAgkI5nichN8fN!vg&;J?^`(aOxt+pR9Wfsz0N_i;-> zK<=xFusk$u%MR+g1^ukOvwPs&B@L+9+#$KQ(^Hv?oo5A6*msCQR1eC#2sEtU+`S?S zz_)m#oSw#=OYmp?Dd!IL`S&M*Q!|$ML~AeoMtKuBHSnKOl_*vjP+Y&Eyl{wgIwYF- z!hfPB-A0|A_H*L6M4r7Rf)RBRTPjC&K^@u<*krKwyds)B`_&xtZ0m|Nx`rINob$*w zgYuB;c*H)?H0Gt)t0gcQ6Eac%9B?)keu^S(*{u1SbzS491}m>E?G}3sGs{beSRMz& zHMuzh`o|Zp$6B3jWFB<{ul@~?gGOwbmd7|EmsrJEY~e`w1poGEEh?fVm!Wj#h)PG( z-#6#vm@ZuUH{V5b@QT$B#hAFP$l9|OQ>_vr5ij=$gotT_0vPGjH_Md4u9Q0Dj}n1Zlma;e(6#~RZ9iZYvN(+ z##9WV4!99K*JiG7f-AAsrx-)GVDAH7Lys0x17BJVlHB8?!P1%4k%FNE63AC&QcvBa zx0pba6Wg#uhBb%ytmaUxRd26Ih$rGwW)=Px_AdPQV!P+$rq-o-e3SRaf=A~E?#FJF zGUs>D*4}l2egVrMncGs6oCfH=d0@azoJfV&`myDb8`Te==c?W!d4emQlfzi1Q<#JO#8-p)J*-0lYYTG~| zm6&SVdgg}_L3LudC5D#r$?}>Vp7v7K?}g#0-iudWH5GwReFQ-?CX%OjmaRUnwEBi^ z7mVvlT^wBRAm++@%w}j`Eh}nHkkSC89ZhR^OpSNbVzL{Y0vqp99eq#Fd}=LzA`9NF z$DC(@o6tyX_a)ej>2yhEalQ#|(|O}%@;47i_rg;b(zT3ZYWvF6`WXZVD7yJkppH$>8i zNBbTpM4aJ8UQ5ZcxfPLo%Ol@Y@N<2;xLj|RfpOd+5-T>VV7~s52O3}FK%&9%wQffZ z%@8QO2Gm>0;i9FODD})GZ}quDBL;zMx08Wvx}b;tCJy!U*ugfx#)Rwlo#N$37O(QH zzk#pqE7f@E=g8R+L0!Uh{M>?dJH-d2^SGMk#zKbtgTJn|Zw)QimanLO*!DcLJDAYI zq?o_f7eR#dQ-6F^85{N0pR=jvQeaJB(`pK|?6QEJRuiGCBqyY&G|4kB(p*~;k9&*; z1mf71A@TCau%9ny9Sup}v@IP%_Nmchsqr@^C0cGNNNjrnvg=NqiH0e}KgIhNW&{e5G=^HT#Ew4+GN9Sn^5*jL4@(jfz5>cB)#%-Q3hu??EJbDQ@?lHQQrG zR5sJbkB}{3XiiCIn-rMY0WN;%3#hZ=2^ptbTEU*S9@T?|+c^~WC|UAT=YMIWE&YJE zOO|ll0R6*(klVYUj4pKj(3_x=)1IS7uBL!~tjCpb<7LHapY(DsMcZYchJ~!2y*>eD z=dHooTH#BW$OR$#Mw~Wzr(xZ03uZq)&*0NgfP4qO{IlV4a++UT_PSE5sxbTVLV#H| zN?&(v(X(kLu!V-xzWJnO8Hqh`9bWS3%?5Qx4Zuj@fZUPp=*kJXR*A>O%_RdYRY&_& z#<%Blpv63ycblJUCro9gSRVO?x_s=?ZFV65+^k%P^WJKe++cwce}bxDQITRxhVqx1 z>&MQ$rf} z6?1G^;kf;kiK4>}K$f81PX;FFpEIWwKRn7Rnn^<2EA}A5q7-VqFzyeL`q8!c4ZP)q zxtt|=f>7tAN0A(S^5k#g!~!afq7G@V7MHh32>&4OZJqHx_a`sl5hQrBzzA$;?VPnW zMw!}PxID@*Y-t#C;jde2P!w}PX=g|`{n{2PYhtg65c-mhGT5ZLo4eKo0$22^@>n>C;_0SJCF+69gKm-+GR&W>VWKp;s04!B`viGl5Y^KHW@`dbLPhTDpt2ly z8Gj`Etpd<;=Dq2p_SfYPBDEu+iN)MuTX0FobY(y@%vO-U$#%VX{i~D1e17!3WeaPw z<+nP?{x*gB?%{YEWhPPJlDyTV{8}oS@NoM3j7<%%l#LrE^VtSNnv!UQhDpdo(sxSM z*!0N&#}k-cyGz((MX;9Q5KVnUX>nX%k`2dzfs=R6WXYs_D!zx`l>QC9nY1;zwN=4n zOQ{#7e>k3>|8oabp#&rISiz@zZ_&TZ>_$>cc4am=UBg|NH9oxyizbADQ$%E1J7Cz#{~Q& z^$(*|bsVG>S4r%ks}L)0@8|9`bTwOZ&3(C$X6z(iM_wV=^rWZMMH%;;sY2ZM4xLDq zqLyB1U|4GF>2QPnmV&rz7iddG=9>`ze6-P?){35O4E?zN$_9OYrGZGF?g0B%dA_1y zghkN+pl%1Y&UKG5?%6I!P#UM+1uXNj+;^04Vv0*Knii0-S4V2-yN;r;l-pt7u*60oPzAG87&Krwtcc^@%z_vAXMe@sMWJWq=-BC7UnsL74 zDBx0nU&JWwQioN%KsEfiKwTj~%V!%IMqoY`385~2_7`>A6KyLl2=Nc#-ebgX2ys9&NRZHLwT{7)vnE&P#;G)y6$-mfH8#)QmcYbs zO9+vlO|nSYhRm&Aindx0`XHm?NKXaQ64w5011-Uzfie9u|9D6`odK!)$>#dH2~IA$ z>o59)dnt>;cN4EUfzbLl*{>ie_|CdJ#iCZFp^rD|K9|j7-|tn3ILb^bi;kR>9|>1( zpB<+(=xy}UglcwdXJK&}7j^m{>~8>PE^g#?5vMLfzvLq)Y7Ndd<%+w@ACMlCxZa+o zd_^6bVIAsZ3^+|azQ!R}AsY2N5v>8@k5Vn=SPb7Hpn2ElbsE1A8^Yp`A`I^^v ze93xRc1=YmU^k?voEef54{jb9ok-7Uj1v!HZUw>~n5sUhI?nckZOk>infdFGcV={3 z##v+(^So}5cDNh$ADGiiGvo_#sCQq{mNr=-{q8kAUW+mw>zzhUkFJc*5ij~)|Kb?H zX#4f(eK|hHH{d);*njf=Jt?8*U`%??t%U9Vlvsx#u}s8A72%*ie@n;{vyTT)AR}xW zEXAAvv4;XjM*X%T-y0-q)@Ls>oDq+|1^*8V05%#v&nuEa-#U!eqiYL7BB#I39S5&G zZ~WQVcj)`u0gZMN4W-A2r6=>anZ5n2D>yhae4kD~K3GC%l;mTYY*5myd=I-HRcNvH zXGOk`tTos64}cZHimdyuJkPteURbti{%WjMW0&=4oA@Abo?_5EIhKHuX?XLBo)^9} z-iGxJkDThYMe2i*>KCBlqX{$VbM;rcGv%`cKZx#45a7}Cu>^}GQ8IIza-9%k8}1uZ z?VH@M>+Y?5c+UZjG(1e(zODrs{!;t(7ssqCXN{hG4ysISqBf=yr_N zJ|JJykG6;-MwnpM;VPAg3E}bUqf42F!H1BjU45#2jc1!N)Pq(s#(ICF)#-UDo7GuH zyVtc`AI>+6Kel=;t}=XAVCu~e4|pf#7k+y_(^1t;kScalmbQH6U&7b$#xZ!7K%g#2 zo?#jCOf=T&#|C`@t!bFt5cj3*W7~}D|3lVWKSbF@UBfeUgOW;vN{2{ygCN}?CDIJd z5JLoTQPWn^yN?I`1wBfB#k9~xj^RD*wU;HZBDzpk(td*MByNOtfU4BoJHNKdbRllxaUfaRy z_v8~*{4Vn|6gWpUgLG6py}4M^kHnmBK`V*5t%33e_*nxbNh+*nS*P{MHViuO^G$fb zo`q?xghkmVEyI+9J}(`^7U4*hA|zRt>VJbgTt;|B)kYVb^h48a1rT3HDzOwpvw>Fl zH@wC+&d>k#c-+~#E_ifI*;14e#R6IF#i%ZQSKtU>KOWY19{$Udcd|1wy0?WSsu>;$ zI=jUt*e(6c5n5vCk{6#ytn+*=EpYNl;%KITXkp7|xZ3>b8l_Z{B?zw#V}}IHVz#P7 zFxd+D?pFmX9{od`U=Wiqwc*LEN|Y}6T3=3)9IqlK2;8|+WASe7yMe(g1L1*rvoPE&-W{2SvR*oJZVzBL`Rf>n$<{>&bi4%0@HGGer?!wEpz#$T<%wVihQs&t zorGbZnryJj^8TGG^Ncpe@<#c=cq58=pjr2wv z_zJq%7%G)|Hi;K23YklWMq_tq`_0+tW0coHIjv1>l%2I#;frMOd`jZTcVmN$!YiVX zjVs;7Zx*KT6+%l3ZnaW3cgDpJ04AbpWSe-!lL+Vb;{n`~&3d&CCt@Pi-xLR*u;ig8 zO-Uevkj{z*(xZ1D1B}`cwcjN#nXR%d_ADM7y+_hcI5KEvl;E=%Io>+X#+2Uf{-|L4 z64Hd7_&<2^2l=1#(w4^rXyK4Vl8nc{Q$%N=K_gD3n_piE6^6D0r1dd)TYhu3ef|k} zYZ$Oj!5sAM49>UV(1Tamy5WZ>_d2JnN!^t&Rw^r;F#6Y{nf!53@6LiAeK{u9AP3zrIw`QeJ>f&c$CH#sEh{h`aQCs)|O2Y*a`}k5R|S+;Z+$ zO^VGe}4Chzrv<@s>_6D%L6J^a`dUMN)IG3eh zU!cSGdYjB!Fp^^TEKqPPTz!C1JKpT+YjG!e+xayyDX2Wtc56*_(IrfnTlRkX`h9p@ zF0PDP7LIPr-P9GR>^KL7DUI2oV{#7jyk>ncD%qY z_Uv=nJ?ewYJ9T0eD)KT5r+pyao4fo)KH1t(g>5<-N_+CrtY)j=`p?Y*Pwi@3=-rV8 zo$#&qQwbNZT{+LG@G$sD-!?DfZ;Oz@rZLKlsHiUIKUWxc93c|VR~Cuzgr&2J0DtAZ zD3X2l)IhXF39_G0%cWk^Z<3;BY?TZrz%R59YQ0bnt) zwAy|11^hDBN&}5}*sXN4Mrjv}d|U>e&#jHseu~GqH$3ybTa?DHA3q$KEoA}Czv~Ntqo&FQa2-H zi9o1piViI~V?95If25Dk?+9!Gmyls z?@f=*A&=Kwj|Itgqfd8w6mza1DKCqw8I4||6o+wQ0ij++(G=X;0xp z2;A=VX*L(E%l*HP*FS&MyOu@qPhC@sHqYaFi!HNXY7~54vhF>$nCt6e7SFp{@W5I> zxcv?4{0ORnX_aQn=8#X)G|IeUuc4V1dF`@K`HFRs$)5=R!*zfWkCz=K>7UjE@qr^7 zk@N|?C#x;C-bmL$J@9HwV=>Z{=C^Dyfw^&>#}36Mn>IO&yxRZE2#sbj5GWgGhrMJy z?`lSII~Tj~Ov%0u=>$67hFAxwpGiwmstfKUhV3#IZV5{+&~&@IuD~Gmemo!dptWDP z)N#wm{*-)$jQz~Yh@#F<3sT>mH9PK3x|)&EORBL%OUM=r8aVqD*G(M2uL5YyH2;xO zu)cT@5u{i4(WLm>Uwft#4ZLftcY9%B7JsOHf_0cKM|!$|3LT?L)5E|}dwtkCXbkSBq?@lQ@H9gPMDrB?4Z%FBdFF47pKlX;eD16BYu+ERGm5z5$y5)kYwX}q0(eLVU|oZ~vMU3=dS%kUmbjDuzlC^P3@gqk z$1FCl$r@)HW@?sXDT)|ZI6B^$u5gGYLaaU3QEn7KbG_$$`@#t-o*Tp+O9~8_V*S>+ z@xy-S0%;zfXx<^+=(Br0ZtI8p9u5Qqf-jz>(#BsZHT7BfvdiCJy``8IQk5Q?&JKJ- zBNf4RsI6n%+-qmq9Aslbh!~`821n7X=|(yfaCDX_HwntrBOI#BlX5}^3eu}^i}_r> zk2$?&s04O$!yHSpO<&0rA<)h?JsUu!sj5oEjS9E?r?8$HurloSBsQ}|%kwh`&&_?0 z-Nub3%UXL*JY?=ykKyhD_Tnx)qXsLv@~klY)744V^xD21wuwZyy-@EgS2dyGyB{oL zgDAL#U$M!9<_r>3E$>$#0gskka%Czp4#5juwYd5@jDy6b)x(i3-DU@A`TyYc(*<)| z6B`u{XIL~cO1n6Ywm5Sd{>AX_w!_ zf#SlUSWEytuk}>8pnYj^)4*FK@1*ax!auP_|J z4O$?*E@P-V%G0UgcI%=SOD|VAb^l}*aJ@BA1wKwoVVH<~i=cLg-{i;7q=6}HF-U_Y z&R)BG zLE*GJZp*<#X-HfawrCVBJIa^4x0(PBRC8IQBAo?V6^^f$2d2ki#KFq+$Nh|2k@5#} zN4TS`)izb%)%t5o&|Jc}s&$JA%aaNXfL%WlwU|YR`UbDB{I6j-xc8M*3Wu)oTFlC{ zSaKl!s(33LqrI}a*ZSk7`Vy`07pQYSOpdOc>VG4R)G(N%mURBjX}u7ao6CCl*O?ZO z@E7XbEmWAtC}H;)ACuMzb3~(uBQ+5#PdwzeYpkrADlOFa>f4oBa>5olFRiadJKqVo zruIA+7?=nU#qST!uU@yfgc4^wNGz(Z&eVlE)e|P`l&mzrNEHaOIQa)aW{_0Jz-6u) zn0##6B4GwevX-J_ET7M@8f68O;(RYR%emJ>=$(xn>f_GmlvOG5-NCnzlRHfQT7~9| zvT8_vX;Xd)adQ>SVxk1xv+|UvdqXWcBi1{Trr%k_pW=B?(17h#nVOm051zc031a_n z_NMagu1Vf@^2Q9=kZijCZ0X{-15*j+C5=^$PW;UBDh1NhjruS_6qDlBGeT;Z1UVr$ z2I-o%E*>vAjn>G!T{ERL)^_Z=Wa)qUbJ(zAt4S?0-?v}A;90J~`@jgv4jLYtjQb}` zuLc;km*?S55n)a(aiMgrhhS0&EazcqjejDh#^N&~y9F3Vqu$ad3OYgyRo#n!OJE?z zs1L}W{p5G}LDbbAO9=nWv6QkKPp|cX-6^S>woW}{qFsUncc#2jH%9yzBRVyH7Aw9F zVaI|gfDb*Xluj%zj6hTextMS9gm|jpzlaq_nuI}W|ZiIGlpW;d_}+(6N1eKC#h-3rMu6e_z?D)7 zS#nRB(P%BtAzO{qb#G_Sy_Q+<#j(a?a3m8qsoia;<;R}|$py#Z+eNW(ROYqnV-MoI9x4W%zK@0C>{;G?W!H-yOy~{0k*d*O`)nut>-^vVbbacYw z@X6hb*0B?@QY7E!oPJ+e?ej0MgF3@GOnh%6pR}lziHmM0(2x_){C=&%$yecLtLD9B zBfDj|*ZmG6A$U$DgX`&JK=CPp++#eJ&udny*VAiuM^K>qr1|+uV`|EKi$#>D6TitTvEhgqbDlt>-xDS+H*CF&^E$=edQ`B3CX)5r9R zog%pW+R7AEJj(Tnv_)5S>Dr_QQVgJrxZyWTXL)lYV{Nrtyx z**Spw{VLF8K{bNgtiDZD*i-V&^0h`ENbRIz6E=x^{mY61b9L5hv~GgJlTOj>cLhVO zcdu~k>HF(*3^#5~rKp!yR6hbB4mZZ5%)j=FD3U5r6%gZ}&`Gxa86XRlSo^FqW%7%N zJy-IVAyMQDi=^Lg%KlY*P-Rm)CtmNxc>i+_|KGkwI`NzcH}bVV+C?V*;O;xGK*Nfz zfxF8|PXSTI$__BmTgL?W2bMykEa{jg`#K6sHktyubTm-fUht zlt=_d@}CtdM}|By|y7J(6#&!i>DH#zs#s&2Zf`J*00)rn@+bQEN3x zd^$!PBm$XbEWg*$>kl0{^xnzhS!r2RY}xxmc8S#gPycJR3Li|mb39bvk8``>59^p5g=+n(UxuS>1w8jP+zc-mB~Fl?@|-@Y=qkMKH^ zC#IKPMiYS7;vbJ}ih%qjBIHP`R{5?QGbll{S2>l|j0?}iF#C9i%Z8Z)4~3z&L}V+T zxtLq3nVMgkA(U0KDxtlzW_tRUkoyZA$UFW7?Nu_=gA=W z>@4F(1YBvi5P?c*i>tuff09}`M9qndP!;=ZG%MU%XMMQuV&&^sEgFC#=$!V`o4}tK zhw91cjW+NaTFbt~KoufUK80)!5RpcA4)Zw?nnV|iaR)-vwZ$0e37li31k^Ww^hSY6 zvhx%%!x;VgxE~{pL1nER2sNr=(X~bA{4!<&w~u%7r9tk9NBg=fd^`ANDO>Nx#IYV? zjKzv0aq`YL`WI&xv8IjwtSM)iDSiCC5}DT? zXGFF8Xk-neF%Y1r#sug0l;Hz&q^lnh1%gCEa3{gyLP9)_GQ}TnIIT42H5GI${}fH0 zkZ6Dxs3BG@`gvT|!0srvx}JoonT3;-OPEm5rD|(#6qJ=#fRn{KS|SqN{k-WyKu+t}j zK6#G59?C21#b!^IRwI)}%(IC>*s3Wi<-uWL0$8?gzsH>1sG(%BMtt`0D%bVdms{JX zB9PNUt8pujZ>B~4f)ZV;YJ?v=?M^tWA1t9ohjxD9x>z$h9J}TXyKRBYYXZx)#uaB5 z+fil|T3AM(QZC)R@d3oQqSIP`? z@p+IEQ)EcsoOga*4VI$Wm-o*A09XqcBQPFx2;~DMGnEkA6JKbf;Q_;FDL(CnquJaM z<~Cs<6Qb0;xMmf@vQ(nG1?y;-W@!S>*>M$L$5Q42C!Aj`qB?uZa-88DC|;6ntc%nA zgf#MMMS8!B8I5LoYJO19?Izy#4@M~?>#VAdBkYQ|NY{sN{K3gGLP!NB^0Un}dutG0 z4^HA#Dg@(d)T=^F4{WffXXf$|8EtTnKWI$1%B{#$aezkW3hQ0ty_h=51lJr-;OH~j z<4Sr3@fcfjQ>Su3(?1~oLrU)49r7ZtU46(tkCt9%b~kv~U&-=i!2q++9)1}hdrhBR zFrocCw43-Ss$f*;kE*6VvLe38j%yQO1QY+f!#|=usz7HkPGn(w_5NqX(PfcskdXJl zXK=fNnyanl_n!y{zCQIR%r=My#HTbq(CK?DcCr=kqb3%43*e-*; zQB~vC%-gG(H~fcnJ!uDDseSsIF4DH-C@Nomv`grqwcAnNbf6j_Ua|F-i(nudkxFVPha*1_Rmb{UUSXGJe`j!FnK-*fp2i;y z41}YLLwMIX%9Chs3oj}*Xe`3|M5X16M0wL7SFwCH%3TjJg;NnR`xP?tmS)j$m&Cm5j>5o51v7M`U?Htu%V4n+ymfU$4fBUe( z7?4-1hDnfs+(jez^aj`t4Dl6>8Vnj8Y7eHCkYNqR*%{>vg1(DuhiK@lFpS1qVL}TT z2Ra)QgRIV8ToC&{Y0eLNpzmn^dAoZ?-CZG_&gV;Dz`HQkpuN56)H%B&bDl#nmGwQ| zD1wK7O)Q*4{1iz?6wqv=l{7Id9oD$@YEl_gR~AL&OZS+IWgxtUoqE@!byIx|n~B3i z({Mi>_EC0@vI0NkII?5R z+|FX}Bd<=klqWb(;-VGfFVXaLHUn@lNO+BE@#HADW6T`<)C3>=s3TnAk&t{Ho#r%P z30|kI0>KUF=E@AxlZIR;U=}we=|7@!r+kW5tiKm?a<9BiVq!_v%`{@c1L7k7b(cgF z#ef2`MTI@(i~o`6HbG zcyN;9r07H%gkN#=56ZeF0m1`n!>1psanJei5CTu;HyggU0S1}%tx7J0@xl`V+Hg8kR5F-zpFbIcb+yH2fa$h*$<)*5>6s|a|3UUW(|Y?(&w@q;CU{T zP}sRY3p~V#ald~v#L}g1pWgJdb;)?P)EP~)Ghy{v#TM~S3e(1WR->5dKEIsjBs~}n zZZO;R`01zum39BuSWBhVp+}hoTyz-WE2`Nu&tCHge`!&Srn=9Bl1ei7W;oB$baz*Zs%KwC3QH>(B&?+eBxZ3+I6(Oo%j#q+baOx4$cTdcLFGk8) zo{s6&ee9qq5kCs?Fzz?T$GV_FJABcwKs*~d6btGTy;Z@n5y30vlE{+UdrG$soQH)! z*PCIbHCd)Q_XBmntYSt+v`S{$87q*Lihz~;#otPnw#2QVC7oKK3 z6mG4*)fe2Eqc*}Lus!fMh-(ekl>6#&3r{KcFOic8yRzl3#}mmi#xj%ahi{P0{nnCo zyo=V)r!Er?8YtR}_rkb#J!4|rb-Dbt7HgY3mA{~hb5)t#8Z8k!?;Zbu9>Jv`8B0csA44Ds!?XJWDo237k$p6{;KO5m*Y=C@wi{_u6Zjjx?+blP3q@n<@2 z8~2hhtdN5IsHMYA3-Url!Tfu$mBuv7Zrdp62^xMlW02Y!mZ0+}FF&;}If~!GDC4OA zvy^UqjDHtUvh;f5{al|!>)J3DXrC2rp#C1kR|{2kSv7kVNZYBA<<)ii8F;0)E?@fG zZ^in1t_?iz6Lk^{ZoGmsK+hheKL3bp;dWbV2pHGylu>Po^}6_7BA$0Ni96S&Nc~Ck z{o!iv%}b3`C|tb#h)Yq4S$ZF=Q^{Coks)!El7bywUe9g0VK|GIFsmN?p4+Eg*QOAr z3m(#w}8K ztTE49OpZY`CIb{tPiMtsj1(NDDAN&x#(l;B2)O$O>9vAddB1(RF%0IREWcod(Ae<+ zLkabs+aF`exf*Vf4K7lbAGeN9wo9B!caqbtByhn)2_W;OMJb-Q+TY8R)X18*CtBrC zUB(^w^0cB=%rC4tPv7U-ri&HmVgS5)y01k+6c(ni7k-M!kn};X^mSC?Vn2T4+0OJ( zIm5;Iix*Hm3h{jHaVe%x4Ut~(_Tm|G<8^`$>uHkrG12{si_IVI9-Jw#X=53T#{>IP zDJ-9eo&*z$@rpRRmU*<3pu9s2x6Q)Fwqjx7LrEs6LYjrsV#38=bMm~@+NLtdBT8@o zwXcYg(q10V)djx&YoUO)H*lhznSDWMN-6mQ*#mFyV0SrPbeBEbX{Ha|_;IL8ubcs@ z5D_E$Jvo*bKbNETXO6g@mT0nrOt~{`GaD~vd*j) zRj{Ozm`hqVzdiAba7nh^U;qhq-xrZGkL;4>gK90FnwXfu|LEVm&}HZQ6Bl=3tG$X% zM=MQ_*7HhNUlwnCe9Xdb_-CIU+TQ2~=|L7F8*O7nm#~gMz~7Mmd_ZNyxR1n0xV|?O zh}M5kfPd1U=A8`vUc{2_T$Sc_rUyIp?jIO&e=esha6upCxDsnT=|^JBUp5zMzOP|z zZQ7mBxe*YXgq{JUR+~Dj-Ex$2)FHua4$oW($2pN^VTj*$WXv~C4S&zr>#2G zJXQ`;R7(A$5XEl)8Pfmvg*spUtYN6m*@2VH%VS|Yv#n$3>19qrR-L#E?^9SvFP<|H zK0Lg>o!oQ&Q@Z;8w8u-*MS3LKG3~fcH+14&!&V{zh+{G-_X6|OJ;t@SDD7Yv9_}KiS;>}hmDhg%^+oGy~0|$ zabu|lpGeB3F!``#welwZ)H=|7$fNh^?&yNM*38#x_osD4=^UUn71iq6plU*!1HY5+ zi65@YDvUVN);c0lSI_Nnr}H1j{p!-&<2m2JBxC6s7dD%-JJ%DNUc-}q+pJ%R{JK6D z&=c%6*;4V`4&L$JysFt_ou0!aPB$_XG0$!;Vf!^tzxW7|S@cCEv!v@{8RFOc({MC& z9XyxROK!c&2j(IDdf}((nXa@oJ@PzES4X46@2^dW$kod(%xh=T?G6 zLBazYWs_=KO{A=H>fOf1Mr0>Ww-c#9e>Gci0|u|%w3^a+9v;H_uTbaB%%49hb$kG? zHM1?G-P;+#gs)(N_3kAusih^68Ed8rK+9JwC3JuGw zE%1)WQ(4bQI&y(7+xxB)@WK|__n)iJc#Rin5=TlYp53-zzs}~hdviZ!_a4=Js+B)S z{-$II3MRkn{9dN*g?l}5v-=N4z4yq>e`ZU^+h2Oqdm`c*b8jAxE(GbEsXT#7`*8(JT zp|7z+dg80asLJ!Rfo4CQpzn&s-;4MXVFWn3%WRF&90U2Q`}ok`(?!t@TQoo|o)5**Zw@CRiyN$XDG_X(VV~*2tjRv9YZS zz|{HWh8!7;)j(4{2$+VizKHB2GVJ6~qV>V6aD4>Mvp$(;@`f-8nGOc;?d|c zeAyv?G`$4ccf`7WhXhbfIpg=ZkDiVbefPwsN^%|V8RU9)j;$KPB6nbua==|wYKNtl z@R2sRrL>!ok-$?YOD%bt`z}$-)Fx?%LhFXLCO@A$W!2yt+jpkpY1j%(8+j~=*s9(v zs~-;BGL{JbG-_T`R*C%EJJ|akuL{Dhmn(38>tPZ9bvYHw3c`rgcetWM$P!JV_8&V< zR7{r&717OK6b+Tpa0(z?PDT?Q5{f{&4C~SRlPX_Tg=0O<7S(rY0UHN*%9+$--z?4nnv@VMCGPX;eJL< zVUJrJA`hIO3Q3WUS=?N4mnt;3ue50aPM8AQhOt^`41rDJZUdH-|9$}@a+WoUPZ^8b z7RZ2g6@+jqtPf9{rie%M?cV~B4%KPUZ(~G5aYy|aef6A0MrxdJ)BOf?jxQO`ThMcR z6rybNEiPBZa1Xp{nq2vZo$)`6L@S*(u>xxqBj6Og5eFB@9zZ~b7`KN%c47a4 z6?jVM>YK}z$ob?r!GEE@C;w4zlW~toR zSc*j=+ijguo(Z)6v-`S$EHt`ppVQu-=XC1jNw5&-=0q zg9gBKv+qK4%ih2tZ1>Om=J1QCju!a#EY&*Ii(>7?1YI}NAP)?QUMx!7sg1BG!Yq;n z(#U=MLbixJ1SgMt!>xX?*2dhPOjV{`L@M{ml-u=b1D<}_(a3FkDS97}{e@jp9wYkC zxq-aQHlh4Ae%|;tAZLTOSci_k6zCzN$v(Cc7o8D@TLo zaciJGlFfK3lDpFW7_&PtqTGrpk6Ii9jwDu(S+BIrb+tzUt(n`4KO2UNqc4cR9qo%1 z$=J&7rBqcii1O*OMEy5lBQHIw%y6U7^#y>fIA)MFxlRDrH}oKi&qD>9$wfa%&IBoz zCkqfhOYgT)YZlHq=+t~HC{_ZLe<#-Jw`Vwt7Q07;SO5!)&gR2kicU*wNH%%WUheR3J5AmcGg6RaE>z%ZO zuE*Ai+W{|QrT&^IXwR$tb`EvZ$n4V2NE>IGTzd&~?b!=azM~PsJ_b(g5`cT0BjD;b zxPrn3gC#Fo%R));*zR9iW^p_+nbHzdx4R^60FW#<`jG6kpmRDY3FA_Mq#x(Z#K#P! z`ohgHD(7qjQT5yMbxkdi(H*NnDU|oGNU4HpXzJIlR99Fxdl&&uRe}c4B+Z0E8}!bW zZ^`)|aF<4CLisQVo)iB}Zl_seti>a8o?>Dkq_|CueeyGK_=TIO5h;OxMZaO6vgqKa z>+qK(1eyk!7hDQKOv9a4O+0kN!eh?*+87*H?`g3PYfsrtK%ENB6`}t6Kxi(B!W*X% z-R`~@G_ce9o3ttPrz#qQ$7jr}vj2xZ|FDC#sWPRZC{SNe&x_S1faQkG(t`a=P~|N> zwSywY>_E2cP*`Ug0NrT&R`drhn{95Lv!Qz2b((x4@*7z!qk>pvX^>4#e-F3Wo-#7& z2bm&ey_!L3lQb^O6J3Ngm7?W??UMV8I7?V@>E~m1^JveTy$ZorlRZ(gS@NOy{SV zxY+|%0Wv)1MRg^(RUP)fbRt=n@@pc%Yno`OsCZmFjKoZyaYQQoAaY;Ac08(WWoo$W z-hfJ<6GPNZ>6b=jW#N|JG8?uv2-wzHMW&M6r?7+tlbKO&8|!jx9#T8faMdHhycx}7 zF8x;CY9Z@>j{Ex|otfPD3Y<@ToN!# zdjh5PI)6ZG9MB1 z11I7;YGi_JZ7BW7YcaCI(1ifq(8O8Bs9!-A1+|(B_fpNpj&u32tKSZcg^62SmQVVB zzLgA>l+^65x(T%5I?^IZS>$>VsY1N~BpH{%j+YVf?eCmB^@xHjH9{))`cONw(xd$f zMu-*bK*||{+;4J%2Bi(YdbZc+d>=E&JL{tMpI{9X9jaDBKZ#u;-R;T3t)M7TW`%9< zHemF8;JK9E_7xuZ`S2-~s7(gL9T^@y$@T?f95<8cuq0_VV#RqaC=>s3S zUct%6+Fgtq0jzs#Ykp08#~4N0F4*3ZbvhsB2i2=Jm^dm+j$eq!6`--!vSSYLg>p~_ zHg?T90&Mz3m1ezP~c=U*Ok`XnKi8C1y~S0Y;_k=!4m!dyz40u=m67IA`TF z{^9mPtM?#~T9J_OF}AhkS(Z{;$PU^Mtd+k+rZ_TFF4`D_k{$Io?e~(+zdYLmaf5@# zm?wyvD*|a#a8(2bZVPe@n0>!^Y_IiHNJ>n$tI_Fvl_A|i`~{)bS!-7=mv?42{iO{$ zq`aU1Hfe(pcnN$X=ueM%d(s-Vkj=Jk3eaO#BVoAOBJ6Qege3j1uwn|q+7h_-!Ou6N zk*b%R((m1p>|DJ#lBO<=Qc|frGMC#qKp3@-o5_0ClP5l;JTUhhj{=EaRp1VFfs>PG zA!B!HzE)a&p4fGv8%F+OLPwf#4un_N9*euf)04O-b-5g(5+Q?RCl*obOYF{n_?ZU) z9#Arbw7TFJB8L7jaucr~@zAbI?6ED@ev$qhVPlnQdPy0ycQi_D1h0Pcj1;Rt z_$y0Y2B2_U=>AW0!Gl?MGqO7dB+h+395@JYPL`C$`<7Xlr|>tY8*d&)WE>5dg$jxy zj{)7_UmQ?Qkje)IdSl}m#+3^Jr8@ANr?p{F&cf}?0!N43l%|PEvmC+vgiYh)@$tN- z>IdG}oSKPofkKu^t--r2VL1FfykINklJWG>N+)faS$wZ-(7<0l^YpQ_N08UwN#p*D zrA28<06$fPQ{=mw0r%Ak$`;;}NvH3(Z?>m?hWkG*jqbz5P@<*zUdsf1wHySFav@zl zP}Jiz_FX27&l<-=0uxmGn5ya0uX+9hmjMJmSpff~?c@U+@*8mOnGyiUZIGSwPjfxT zfNv#RCl+jftp@shvUkh-5r6&qA>uvdmj&1(%OCcl(Q`fP2n4IrhSoj zecFXWrWtNt4P4fQAo%xwca*Oi3SF)73^9~n&Lw?*?og>G7!#IV=TARXvFHx1qaR@j zb5G}hZpwjQfK7Epi*CS8u3zz0h-iQed>q6Ny`v$SNz~qnEyG|37fLRgiMc@?XR` z$ZdgWMB|(9A7bd()C$*i+!sQNY20$5arriC@Pit(9?^(BQcNSQ6Q|u!Z6g)KGL32@ za?uZ&uXVh3Og2HWzKESO=Ki%S{kjJU7>s(y%eP$ImUk(d20EsMc?<3mroN>=xS;x8 zYE_y`7$LdDcyd044={(7q;VRHKtgqIGNfs3<&lRy7#G z*d5INq??vfVHpP}ZBOC8&$)zNj~7bkA5hTw@&6dN|5sfxvaCT>l4Fz@-1a%YFv(h3 z*j5IW7phrM!zcPo0Ho|eJedg9&`)hf5+<>waN8RCjQbXntnA#W>%Vinq$@t6(C%Vz ziN!1&q;e{Jy#uK_j$&&u+TM=m{_Sj{mjFU@A-4e(YBFg(4xCp4()Y%)jSXKjIah@? zYE1>%9?vlAFK!Dlu`$(PU|;>zT72iO+a1Q5TfQmDdx3k2inPolo!)6MQYB;8Bm%^8 zS(UG!9TD=zF`_oCMIZE2*z?axzoA9>7Gi%Cy|>rrDbw_G$wZc{jKYQd^2g&Y9;xrR zOO{l%3|(Yk%u5AgEVx^p_+N&QKxALne*+-YF$wF$zoC(ooWsB*?s^SHyYa;s>o@+b zuNSpmbCC=Ug(NSj)l`Y++Dw%hYHN?Jy!);y5PNc62tXHhw+1R(S?T8Gj zTCE9fc`Rve$e6C-b}23`Inj9IpIqs zm7hEU$lz@lR6WG_NDp{x4%l-52H7md05ZzR%jv8*RPn-rLC{omJ5XI0*-xiAjI-5t zro#i`aEDd2rw=j>8;GN0Kwu`sQuQ6o=X2teEPCTG{WzW9iR1rU-s(`|O_O6YL<4z# z@NKo5{}}7W%tDZK{6wLlJ8_lHFtUwh#XzOwFm0Uc7l~%<2)Bp53<=_n=%^ltGZgxS zs5ayMz@`9Oe2*P2aW1b+tr1P(@CclCTmCyddt1CYl~Laa4+9SKQ#AWuh0t{5dWJx?VLyc0eyB z9EPr)i`VQCalX{tXz$x(^tQu>kYr$zyUHvEU}qMs)#z5y@!LWcRxG|EG@Z_)rA~{N z!mY7ciO^v%4Rnl_$;KA6YjQCjJa}vKSt9MKUvJ|_ro^=&j`!jJw76EeZk_fY{h0Nk)ijG8ts z&B;ny)Z5{9m}oK^4*H4^kd5!Q^6`&5U+|X^lYxDFCy#@VS6f$8bSc+N{{dPRG87RN zm8v5aQb%(cvx~R8x2tEfor!Sd@H@nPDvF{F46!=k9JJA~@ki2RW9U1xJ{_Hg+erPQ z)XJ^*Nrs!}5fWNS8HllDTX>)9TkBM_SL+ntyZwcipCLrkh)RuhFx3{fQ1b%i2g6FD zc5XhZFQ!IxmK=mM*$-p1i_>I)CJT!gIcLk34s_pw`YRiZP`*#v-EBSYPBzES0Rr;E z{c}4rM_a?Zq?vqFaMJ1>7w^&ugrIk z-AS{;gzjixyfq%(CP)5XKeS2|sgZshh$;xAf);v41HPg$ybjW=&-n(${q<^d0LT`H zxx&3&1>H>lJgP0-9!;v=qV(*$&g!zb4JyL3k5`W?DxtA1EULL);MYY1CT!bcf~baL z z)Q@*Te6Cjt5y`Z3HrQ`B@|47)a&a#H&Lwr4*4;$G*-x@Ah&(@HQ1AxxwuKW{LO`8fv`cs(7dl_`V}&S%u0Z!|0VNuswTQe-U>f{V3W?2x&xHL4>e)YSw9np}R4M1R*?ZPBc_ zg6WEm+bWz_*92zi`q3Pw8*o$yI}xfUEreT)(>?qBYO%ghuLP`kcKbYhw#33e&e8&j#Ty~^r@^* zzq&uRysd7i{fzl>4;7Eph3yq@Wf96^S$w?JT9Q43$2Mg1R~Q=APdNOFwFs84>06wM zw}G^_@gOD`=Jo`Y;UeUXGU_EjP^~An`4B~;%pmn%UMMd0VSRN>GaI#YeXb4JG1xp% zYh1|VvI6g)7B4(*Qux2p@2xHXYd@LHPwp&keHg<&PHzcsz3)}ep)^~p{AMI1pG*{? zR~APL$Fw9lOe>oZ_C6&-6AgdZB{n$xcw}MPK=WdIftUr>aI;bo3X~|;=&aR&DXNK@ zEJRjXw(n+dE2Ah;G>j?2t3NmMW?+{kA{GGDySkM@ifT|iI}_tmW#4nBTRCkI+2ZQJcaf#R|&`6p~Yz8|KsW%*ehGsw(Z!q%?>)YI!1SF+qP}n zcE?G_HfC(ww)Lf-z1H6E@%@20YmBNG8lA)SmtBIlJ-SZOgqDNPPDQ zY|odpoirC1bq_>7o9ePV-tb5uiev8R@InS9nx)BHynaMIg|<;2K8S5B-Kgm103B7D ze9R_6#o~!Vxv|IALamiUKu1-*o2LWFjI-I!R0?S*1Nz)P+yw3&-}@*IF@>uTS`$3M zb!iDc0NW8kYD4EG*fN){7wv^~{Pkjg1ePJqb(X}lwn5#i!}+R4bl?TG0$O@CX|Za6 zNZfR`#)1B*4iu*ji0_W9B+6>F9$YgkxL%^C_glYzZ2ZoQu2*pAz(5|){S;lNe%J0F zC_(qDuZunJ({{0z)W50sPE9~WzzDz)KnT#LS29z5dI6-*zOtzrm^_NE16SYd5NSb8 z^FzXT-0JGf!MA06OCL`7lw077$E1aNm|g{M)yWYIeGHCC@=p!vLblIW3EQpN|@a=i+Q;6 z9OFjFHY03>V(b9A&I5LE`JyMcDpWRN`O@ zZJ?+_E@3}RgkK-nAfAcl7wWaLP*5|m6x=F_un*zB4D%&$5oGz6(Fl=_k<3K!ZWj$8 z6C5#4j>OP>hZ9mF_*CepzM#YTO;xzJC$=wg6bqrmy80T!2VX5FBIX{Gr-E1;yYcLS zI;oHs_V`vyre#52?;6Q!%H>e}Hsu>uJc*Iug$vr6wN1UIm; z#0`e8++vD+AS;DgR8Vl;G@;jeYyA)p?};Aa-nBh%>ArL5d&Fcg_ebGdMTrjv1mNMW zB=zC@zfy>g3|81NH1+@%*)%c;%6st#X_dSYLYmEB((N51*fCTHo-VizuE_;2r~(iQ z10|$`cZ$70dH`0P7cp3ogeErz*Amg-ZM!yDI~4o%irr`rKqDLpw?BAC7gZI#!?70s zMF{tf8KfLESx5_Pe2HH-;UQle!52p~i9K4+AcQMKZv|8kR2)XwO%4RR{`6s&KK9hv zK|@$k*r$33yG~-SKhcNa)_v#i_VA=Q%lE(Sp&rO~E4Q1{bvtzX321Jhzq0`dOm?RM zi|yXcGcnAF6iY+~%l`KeGE%q|5oq_02*Jp^a(6yrPyA4aYK+Cf>3%E)NVLZpm6S%b zbrm@;aIWdl^f)n#c7WC#aD6)+p+ESrem*UV>3E3IafA?!6A55D$?*tvZX_eb1(`1P z>?ZE0v74`(E

_A$x82XzEA?oW|EbJ6|LY37D$|-B6g5vD$>-3ofTkvi?tOSD3&8 zeIwI_unm>nwmp#DE}e1X%OnjANb)G{#t$LiYnfX!X)b}bm?jj*MmY!NMhNyE_x+~Z zkFJgkGN3Za6`O}!4P^kNJcqeeh#9Tu^O3IK?n(9khnL zBjr2-_FgM03?LAzO4Y$cC1{6oBCjuby_k34H=Uc!o9S!sZw=viu(@-MQ}^-}BB>$dAxiR5baRp%?jBJQt^pgCz?jI6ux zIXU}f&tlK9iq40jL2OVu4*;oN856Jb+RMRkic|6< zWW69&9C9lXZ{Fuw*+4$!5l|Bb_L^(Z72Ae_RAp9?By-gh_x+#~NLDVL>6D6icY4IR(TbX@^vtzWX+U1P8Zh6$cljM4M8dWwvZ^QEB*ezKAp@A!uZN){ zWkx_hRh|lFnkLwbqx!P7^IeGVSkDdqpBow|tS^Xf@OS#Hc8hQU5H?>6WW}8wSg~v< zo$mC4umJIXGy!r<5^y3rhUr+ko`?j@8!u@>tOM%gD61howYyMXOegwTY5ZqxK7r9u zQyX@w0JtIHW*r8AML)pfc)Eyo^7ErmP*twryW*u{C0zqwrhDo`j4+f=|KTpWJS`1a&A z*w)sV-Jl<|0Ejsczx%c4HTX6^5DI_;uBB;2Z}4yg9L!M3U;b^cbM!6?6?R+;GDLMxA*Y|WiZdRFUfX*p@7u}P`x504y)v)`EJufU=VC?G z9HsW&r_VzbC~a9m1VQ>zY(AB!2(2)f1{fOH8HJ>r9OLwoevBxp6q;22bZ9=~c}#~0 zDr-1$K|Zx}jX}P6EoP*@KN`*ZyUWJes+KNtjehEOfS1k2SQfX5u?ynk#F`%enR-u{ z7Be;=CVmoG*6~0w_B0NceF34ooQ$H2h4ROZ3ppic1p_4s zP72kifngw}C<6!fc7I?30!2U^Vq<4y($-u+n_!Yj9k&v>7zLlCKV}5CG3xiC;ICv`i2x0UUaN^AnFps zNT&hEzqir=r*{Bw(@(3uW>hw8@;p{KB7xZiQpZz;-9%kyAqvL%LmrBPrr=qR>kqdP zFRo9oy7F3mg~$NN@48|+m!$R93Liw5-cUF^0bg1ki(0=*LX>%lnVecB5`*caAH|{V<|Xs0*0XWjH;zv_ zmSbGs37w=LnqpFq?#h#(E^x%~M%C*%rNaLw$Rb+Ze1zJ>l0wkh^_P?1P8rZTT1eCC zK(^#i1X+Pzg-Fv!XP22>YfD3Gr$K0wBqvFpQ!uo+UTgo8y-4RL$*jaNVv}K=d<*Jg zM3Vju=Yu4ERJ7-q{UR-|%d-k)a&~7#_J3dhRvMD7uu#SYqh2H}V;j1bK#X%q9UVw` zP;^!azzlkm^P2*RzG4~*KSUHNjy1KRJ?HptVR#FBnyfLfK?aekK3O;_uCbiKxxExl z6Zs8~a`f?+MHCpW0jstO)06Pk+emS8NnT)~l^}~|R9*KJ1v|`u+uu#C7?o0X%zwCQ z??y3a#4v0`4X8BmfAk?VTp#)H65>Ej61F2-o3|df3l0+HIRt`+ zWZ-PjADF(BjK72_DRat23JvKG6ul_h5x!>zI;zB%nJxhHfps8yk&2yAJb{Y&9m((M z*O9S2f;(L&SO;^ChyL!D(a7&VBlVbKsMq~1nbay#mEd(m*@{6IgV*RDCuK;AxtFY3 z${;cvU?Cn8%*NE)2bD~cz^hkcUekZmTomn<%%DAI+#Xoctf=T-YDP-Z>>ERe+AB}3gYjsrQo`k$(eqD& z^2s8Hj%GX&i0YBO8c$_^UOkBn#X8T8x?-CO#IqEB16E0!Z(d~IX>c@rxMfP1b%dtE z`D0~Q2D4wfYAjsf5G$j7Qw?9Lzrl{=Daaj89UjfGA|apsA+}==cD@J!53{QI_R@*R z%X|1_$-=m2Q-cDmHm2Wvl-8%WK`l>-J3{lCx6@50?n4gfIC+SeJ-$_4>OH{@?fF%4 z>*(1-_Nlb}d%fwWX414?Lr#V>s&o%!dyHx%wMIZiboi@L zxfyf}9?saFjE9t9;1AtYG>xPsiG>ClHFt&J!Iy}_gl*yWCF5%$y7x`&$Sc;U$@sW| zKYISus&~<_RllNmD{-*7!?$&J5u?X&$};(ybHEH0%6-!!*pVMYH>?#Qt0pVz*!lYk zAyREg2vEZnMA|GD=!C_J%@5msPgMd({j3G@EGiQb#`YA10=9?A2R<{>gRgPi|%Z1UiDLG#v|dqjP(ZQ3-sS z@e#^X59}4av3+U`0cmmcG)Xmzq@=@!G>;TDVwRU$Pw#5t98GqBGOvM35hwLbAaqg}sG({&9Q4FrYOu zR>q6`7;WexrV%x{NyW%!yPT3}5en)t{;P;`l*29vA*glN~$HeX|n4;l2$2 zOTtU8>Y*w(^%CzCuo2{Y_}x}5Rry5%EMN9&&XtLgP-!H$x~CV~v4uxog$N<7&K$0& z6Q4lrjyJ`r*rNUXwDrD7)D4sN__W6Z()|+-XH55?17hh!rN$z>EW3a~jThs7%FYPPE0J%4|8YpBr~4%f$#s{> z-(B_EPVTg{b-2|p_T&CG=CLI!wb;5Za3!cz4qGp)? zvU>L@5CO+hQ3}COOnKv3r3*XLylMU}YQtm|qO<7!L!$rMcO(7LllzV~?>>+-dGVZXGA-S7aTC&s$9NYIkTcyz>rp*x5*?2sG`H){_WnKHr?DPvmvr1? zvX~NM)Zx{x=ax=I=VUtz9Wpj+6fQQ(V|DQN0iD{El7pHHcesAhzEYkj46pwCL18p9 zsb~z^YLcMb5>1mnFR$pD{{S?CO;j6eQgWJMk(P8TOERN!FfvDDXUuU=g=J(-tx7TD zDYVP)gJLC3pK*SiHTS{S?iJlIjrpYm1W`onmR+!zBqNo#dRS2~*2JGZLe!)C3|`B@ z2-fEYFE{;RgegNt7B|mH#T8|e)LztDWZ%8{lP#k|+HANL|J(>vKkOr6v=g2c$gf=E zzgV#hv^T?DWb<5u_Fc_$hOYoKMl@JAJ;% zkT=Q2lTIKS5l+o-&%d=%g!0LaVbdl$8OCzC=C^Jen9~HmZV{h74Gw0*-akZn zDJaPics=6`ms*2y*f=h_Y3I{tcc`S+B(=%XJAxRZ=Xk}>^|B1Vaf)Et@QL~cpdu7b zZ>+Dri`+rNQOH@_XGdZ^G6u%l*Z!VfU=sn{R(D}ku(O1^QWHzFWW3u?aKoPhw-=Mp^t2zizaN} z`NJk%+n|-JRh*c5LXTcmDU>c2;el-aX;1Rg6G=qPS54N9-66f8ZB=388J^t7IG-D) zyR0^J?wfI3d{-QcPFYpl{m*B7{#_xw@iAe5UoFG4857@29IER$p5ARI2-&LN61_n} zP+|2s5{o5)|7`Vsjt}hN?odQedS@kmz{N-3l>7x6otf%0^qPr|pT(4!8~xX*ETjM$ zUr?^Y%s-U!%*S58c^gSPPOTfgzQu6xY5_G$Kx6k+4+Kl)EM(klv1YlcwOBDJx@9nF zycSerck203BhUq{(|s3uj3!!NFA=Xwg{&>Vdk#JMFJM~@_V;+~Rh`sxn18qxBWfDHNx$Cz3v4{#+)-ekMiBL>WKXo00grWfO&N_*)+yN~ zK5j16T{5nHiV3saL0U$Y$Hauxhmg~(UGaLd-eAsYc)`W-wVZ>5;{eJHmw>!;9)kO% zu=NbumshY^L!^a<{A#bt6~GZL5k#s{XOWVfu}AvSdredG)3DAss{WCCiE&z(@3`%C!a5P0wXg-R}>48pCH_7%ll=>d4GPAufIUOCea|8 z;pwo639-!X1T_UZu2vU(a-y<=uV|$LZQ%CMG>V6d)-GEIeEY}6HXTE zVb+X6`L{w@vy`R*I*&*u z^R?b~UQq(Kww5T|cJB)w5yWc%GL;BRipFr=j37g+JGMO~cCY@DyJ69L)P8vkX}O*c zm`^G6qNFMe4kM~&) zTc*j@vIH?(st$^kRu^H5m{xKAX4F-57n2`5bI<#-Hp4N^={2ysr&tANNjg(aEts95 z;U(X-*vCS>#~9hDz}@t`E5hbf_^?ATZ9G>fpGf3M@Htz}F6{Bia34ZMSHIg>ty z{cy17vP2-V)IQIb>p5{YOYg`RnCsx<_^jkrAZes~&9>4_;4%#r_=xSU#Phb;mdB|) z^ZVn{V-IEKB-e^~|2V8Cfw|;7{%brpz0uM84HpI1gkq!;&OD7)l--*wd#-O%M%a!&Yem}rhCZau z(X*X!jwE2f|G{V(g+mV0R>!1EGhwvvRZtsZnKfw+M$Xb7o0ik#WA9Tx)*5~E&87#m zq}KJuywf`pptaPB4SBJe`wQ1W^U0}25;FT!%pO~@fk{|!jQr%1RDJOd9)s{(zkPqY zO3_(h+m-b=MDO7>e;=PH~PqZbbY9SFqdU3vhL}zE576rOfrP0Z5y; zy`koIb9!$MCE$w-Ry!pX{_i~Ttg=luy6Su0M=gyrQE_ZN6Vf7rJakJ{`p^#cbA&q0 zc&`L?&klr?n4Te8m0b!gBgY2k+8k`L4I{bTT;FP7JVv-eHgCq?Z=0zmSK-LkI#fcz zW*k01EL$ZOZ20-z+6z)3N*98r#U5JtYa=U?xDJ15^V~KjqK5>mM$h1lx3EQ5xPEtRNhp^F!F9OF_e=<*<;5HjF{Hu3(+2NA z6^Zl;6MxUI_QRzM;cPK1>wwn=gnhFKHr2qUceoCKy16Qc+}0#eZ}+3 z1ANp~9$Qp+*@U-5Ju}@*9A|W~zCiO2Ues&qeZu<{tJ_*x$?u^mRbCMnZI#+1M*E?n zo8;x$9ZHHH8cjP=Pv7ULSjjH;PVPB0|1gU>HBIBNOIMxftOkq^>D#`cVsfd(7N^C5 zzA<;y4tAl=2$m#7gx#RgjD#O!@whWSjM???>qVE{&@rC#I224{YQ!1Fo-#~wkv2R2 zm~_VujUs2tQ_U)Cj|##)$ldotlubG|;wLy0oTM?G3a$BX(zBtU76BsG)?ya+cG~@d$M>ngh>#*FLUexZ2AnAC?V*Fc0ecP zHPUVNy(Ic~soq@@^pbf{!~odR!}dP@Fc=&OSFEx_(j$ME!{M6(yR%s`=$?y?HSmOX z!l%96m@??GUtn|f`OK@%t#kRlXaK{5Ugo#i%z|*`XIc3x2W$rH<}tboLA(8UKbs!M zkoZJ7FSw6#(`qms zEkndDJ1{ydn3K#*w4Ro7YcGLYJq)uynr)7K=#{tSp3fV?Lm@ zMX`l6({{yF;il-e3X!_CV=jqJqd@ZI+-Z15Ly<&^^eTw0@fJ+U$j0pOq&K`1JibEi zg#2iH<|;hAWn8!)=~;{_{WaPNRqGVUtd`)n^0lP3b`M%!oTH7u$rv)?ztHval}8kK zkMBLUd-uiEu;&>AzkdVbzW2zkw8~K4!V7pU1=(D6C+J`RY@@l6mdzZbCp^DsssgGX4f2IMx^XFwjA67k2QP^O}sB=)H8%PomS{P$E~Si&O1M+f_4p)${Q? z`loA{{PL-Xb+91tsw-t$rYSLADZ0^SzA5|NHLLeB9H{OL=NhQc`vXH}_kp!=NSVd-wHo zW?Yp%vR{q<`H_p}`1$M-*HS|XuAB8$bRl-s{q-%w-3jGh@8ASxNM^+UH@jewDEboO zR~i2LI6*Q$Ux6(V5?LPmUgz+G22EbXbF|m=;4Q}At&X!uE&eO}Oo^>)0|5NSG1dxI zxE9YM#UFJrqm!3abQQs_A1qK%QX8|m5ACOhS%F}R$a{vxnq`BscOv%EG+AGkM5 z(@t4aC$gZlZxlcV>p5Pd13sXb)39HEn_CKnW<5evR+u6ey*zMJ?XgS8Y+qvKL6e$& z+*oC1czXy?7obSEq*_RxSe^UO;Aokne`l%=BEK}s*GgZ_Z!o>3U+-<7iR^JW_W1KHid(pq3}(-4EW-zj4fcS4$*{rA*DW8HQMHig zVo+&iQlrbZl*O?2sxDvn8p)MfZZ5neo{A0$>0jV4V23nSk)i;FU#`Wly`w0*T+sut zk55jqz4rLXT-;vZ{^ix^CMblaHnR3x7eCQ{rIp5Q=l+?9NPOeAM@}61zrO=5>O0N! z(bw0^pp7xmuAI>6Dl!XcNkCFnW;|@&be$b;6WZpjr0)N@k9`%YV6)W zTf_&fXx4}Q&{;pdB&!t;mT6T5{aBlqmUcp2!~sU!T{7$b?Yle`Lb_0A?w`pne32a~ zOPRq*h>idony4XX`KKX0P?(<6 zQie=sC6L11UgixkC8FN~-)^Pi`gVwaWZH zguHZ%JHMZR2Sq`D;A36`*=hKQ);!djilFDwyAZ%?sCM-G(9glAyhS|yx?;Q>`o#96 zu*z}HjF_cDmXH}*ye0g-H>uZ`);*3a~QqFUxjl9*vgPfO?)&*`4@vJvcVSF>GD8qQ&6d zo>DBmI1m~i6IkS61L|&ZqG%qFCRc`d#0`0!M45#Sn4lzI)E!Df-iwx^Q2A<=?oc}T zZaIs(30d6@HGu!?F=CQ8cVos*1(ho|UNgtAbZv6EZgdXg9MUn@Iqg*Km3B<5x!#CG z^BY&e<4l0#R9pO!=0w1szhrr42n8Wvam342|I=PiP}M0brqofS_y(Y9T_JOsU;c~S zS_05oh$_X^j82`md2MgsMLV5%H#xR%t};lLyw_P|@0U$_8eEwy#r)Ut=qdf+z!T@z z5zq+tHbjQw{TlH2)WWjj$X@kC<t4h81Jfsk zfB4-H(a34;C*YsiGGCq7Hx;lWhM!y^_hM-iY zQA9mvTNa3w)Zf>iU)X$MP48BowIn%uW(?HXx{608(d~ESw(QS`iik2$_TLAwFqeP% zc=bA>GudjwUK9x@00m~BH`h`2RO!$oC_5p-Yu;D+#2bs#$M>?&+H{aFf`O7o>mM{- zmdpBmiMh3_$qMhpb!;#RlE1)3ZC)NU%YJ^i9F3-z1CuNyYb_u4Q}dG2U8bDRKoMTv z=UBY!zc4xPELSJ4=Ripr4`F%+t#i(|15qi5KWIb&76bEZJ#||I0dcoADi$7z$V>ID z#BVOR;;)a#(nGpRGF(zxNss0o#uUQ#Y)U1xvgFDPgvT4DNX#4@y|$bdy_3VURSHjb zCO%Laip$?|jV!MGEaUq?Je~-DBp1pcn90Xd4lx9Gl?uM+i+cc%N*qh$$q_+mi6E!G zfgBm1k~D845tY<;0&q!s`IC@8P*ECp)w3R?*IW4V9?Pnn)a=0Rmm4PC$72i(T$@nP z70E$bOUfH3-X)#lqTHgi43yhVc96pwQO zP6&tnSjUWR-fgD&eA3Xtzo`8-@DSj$>{+Tyu{`;%z)CMkcx2WKZ8jYrFoWMh)NrUK z#zfF80*I|0oei;?mLFVTj8Chuh^)wP?=-y+8AtxL!}P3ba&Sr5U~f@Lu#gYWcA@~n@uNTjZdzWc!=94nU+E=Z+=A?|4VJ$Ra>1? zw$6`kJfQ3LPKPzv9DAh|KyoajynW-?3E3>I8E$@YMC+2}XkHxD18!Ey-cfA{A<;zu zQ|Q+7l1VF(rz38ot}dCJEmf#`9Bi(A7PlD_UThhStD?w9X^lzc!u zp!?(-gX8CYa!QRH3;o?%D*OJNVu**ALQTPic>w%WJB$#Rqe-{Q;yu1I4>*@i=hBIn z!}9=o4nHIQY*A--I0S;9gBiRVLXeGbzP2YPvv?3UcfX^66(I5+I?th^WrS`f@SpxH zw_$DP*UC#e(|rM5;=e#QXFM%{^RTSwuZRk@&a-2dLYf9#29+RIB7pIg3mzPogD%1Q@k$*B8bTK~q5=kW(O-|AdZIH%2j zw@1&_;0&pr2PN3xvB369mh9FNUcZ*s}OLg z?YeI{9A90Krw{2asTGlwzQnxWVTA9&?AtSd&TYoDay_y7C9k*j_YtqzA9H*>uOGpc zLn%FR^@CCE`HAuO7hA*OB2eLar_oeKTK%ovznT?iF%Xi~h5h)I-i<7*mGzaU$XSl3 zaRYcVWv};eJZY=544A5Pzu=lW_7}j~FGEmhc5Mgm`?Ja*hF&JZ^+=f<^q$eSq_80o z7A9;NrKeVeqLvhGu>BQQVSPuYw=erRYg1b`4ShG>X28OY4t>qZQ1L~bPNuJeMr$vL zhpKeLBtME7!EY>NCfsiU&?jp(Wo@kvq~Qh9!;olKv*eL}U^qD!He$8$fNGz1TW7>_W z8aGW)(7HO@O6_B>@2vm-1DX6Oa4MV9HJs&E>~TKk|3@oD@Bfch zLf2oy=+KK zb*wE?!r6EW_sr2RxG)>POK%uo9rViY6ag!yvlsBfGIsG=xd)Y9LjjN8-N9j1HFz&{ z|FA6veR{5fH8Jun zfaAFVj2u!D4KW>jDmY0;g}7d;AC{YeVqN8ZX>rkA6LKAvUpL-VhpvVnB+%7U}ndMoTwh`Pay?T($vRK{CkaAX{%oTp)!*XzCcEl3NlVz#yA{C0BV29QrC?gmj^?6hq%L%}xbyNNFNy}3LmF%f~c@#w0176nvsuSvAQ zyr)J)Y{{XyXUYrSV;dQ>;gm9M?so3n)(Ic_*`9Ua@&;=9KS zFb_2|d6e7R)3612(t3{fW%Y8$g9-cJ+>g`CTmG({7e%*1RG;$vF{NE&EUtWFX+~I^ zi0{Z+x_ABlnhsYI2w_gcbln5RXk*+%qb>fI) z49>*FQp~MHHFE<^E_Z@+A=`9mk6~g6O*Ie$0=s*74y|Z7N|^y`X9QMEVC)YjLanI) zkt_gtm@AB$k8r!@9nDgEX*bO7n-r&f{wq1O-`?i+W0^+{zHtbypAOOXc~7ZXF5<`> zd=w_WP_;--ccgM|@@X4#N267M12fG`=eIJJG6mc3aOnltE2vjld+|pu5c0--KYXF_0&6IQ5M_62}?9(9Q zC@o!!U(pMyl?d2#BIjX#!(4AjMhY?(yhte^eku{ZL~hj>KGUuL5RpV-FuY9Ja~dDZ zXLmUDIsTw47ycmO(=*H4sy_;j>|U_%0`^*dw{ zQC({Ero%@;(=RDK=EdjU78L(wUM3vZ!DO938hl2wisy;{jKBA=MZ`jQH}Z1Dw_u;^ zHCqdv?+*;DIHcehk{+CZ7j}kK&!B3e`e=s(3v7EZ%B5ZThfw(~!UEr3*ls#QbWkD& zjb{oSH7E^y5y$Yp zN?l4boDe?bL!({ag>^hqKxbzs^#8abx>NszKPmhOpL+Jmoe30JQp1{F5rl2uo=+28 zUGyEl0v6VX*F8dqVkb#4di4x0UTBc`N;t`oNxTSKO!5C(6W_s&r$hf;6F6XZr}?cG zUcM8KRrCG+AchpA_`)llIwYuM@Ca$HXgBE6=dFSEUKo8Q@+Rjs=Zc%?_v@8;m|iH* zX(`A#`tURn!fP-QWbyY%G54BNS6LA0zwmxDHhTr^xEOB=t#}#ZgWVbU45Srh#F_F! z5m;dCQD{NHUmZ+kQ&l60g_pWhw!)n}c*Fj_h1?O2gtz2km3sfPMDfaU;$8#=75^x?jT!ZCu=npD-QB_z z;_Y2F-R}J+rmC+xnp#X~+-)v>+d?Tffn(nhnb}>^0@vSY&_?!{toGDV)ATg#c30&3 zGa7|im*L+qNlKgqr;aX1pv(KgSp$2xQMVT6F%Sh0NGfz_&OW|jjo>H{tMql^n`^A~ zG(@e&WqaZ+P9rq3#n@hQflp7YMRa+v^k5JoHfX3ks#3dO2;LE@#CqLP)v33HAu+c0 zxc_eP-|J9p7BTqG-t~3X$`b3YLq{FF1!?nF|3D2HYHlzmZ3;94H59V|jXHWey?@o6 zYvvr=zz;n^L?AKlp~tE>2lK-4xMcR}U%L!OuvpAZ(-4BuuabmdtHEi^)NC2UKMOny z7`2OQac@ZQ<2~t|#e$IIwsjw|PV}107*V zGlIV$A-{oHz9Asm-LP6wy(W0DGQ?$~)!lfuNd% z*htIlZc&1C`_y+K_8h}QYxoR)7V1)S& z_xzuLQ?%!l2~sYp_s^tw8tt!B?C*KA)gVapSfv;!JuqS5vE59KG~X22pB+1DZ$nZ% z8Kiw4z=0blxJL(-XW&7B2Sus1UF12gna>78mK#ALkJPk;M&UOT z?F&SASaj1^%GkQ@DgY-eiOc@+JB{uX8vM|s;9Df)5_bL(JM;k!pI~VjVw-!QMb?=f z5a=R8Y2zCTpgAFkQHPXdH;Je_nw18f`irZagSvzjvojY-FqqMehqiy0VB{|Rt%Y;N zqnJqB=1F}nGfX6oQfT1tMiw4fsPyrd4t0PXF3T6f)MtJr*6fDA7mh!Ar$DHbes4J4 z%sxq#c-SqG2(ZYIUrw9Z-eSbztVw=L9!v5BtVnum7%0hqBrUiv#KG~VNH`9+Q;=uI zDnGc)AJLvl*BxHOM@QOJkFeV%zJQ5HrpcomFa9*2`cyD$Hc(31C^Jb*aeUO7O>ai| z*D~myCABq5x?8-vpXn<}Au{I^1HQOc!YOVsjU; zAXmTDNXS;A)prp0K3(pG;jeNbiie6#7)jhL);~1`p_I1AXX?y8hA7@Y z5lA?dJ**z=-ap~Qly|*T7e@UEuPhcZI>mdefBp7U`43gW^E&%B!|cS6@3{{|^YqjR zGH5Ag`v!Ek+!CiHH`QFCNEAs!$4T&vm?d(QhSSU;4qq^@y>spTtjryF2F_>f& zIU@Wk>C*~29?k~Zz5~5}i4HDHjt7#OFsd`v;lH&2#?B6dM;CaFw-bD1#smu1ro&-? zxNxamE=k&!6qkVx);EWMMr~*;ECr{*G)yY-X9k5RH+w_ z2xV$s;X5~cAk<68Busj2F9{@zya%?S)y-ffE15=k?AXz2UPI0_#H_S9!2QS@L(U8> zfK5(FngYH!$a{YEp;xA9<+4!t>tOzCj(yNTCE~=Fhy@-#QPMNa%m!rtCmO*R00pP< z3X8EMrpIE1yI5fILdPd2%%(OS>>W`vd9qWg!`u@6AFCQKvjj|Eet*;GG~Ig?h|J|Q z@*qfcddYD5_9#dWq2w!^ONnEQTZ9vR>ueRf@pGfU!Cv}mbib@iTrL7P6@N$i2k-U++2Y6)3fR za`;=*okJwF?(-jx4-c0BMP+q~&JI99`>wFJ@9 z5q$p7vryE^S(b+X3gEJvCoGP<>Gb`Y1fh~6q(Km3#Q)w^)^Q2+RSYJNY|KPBgXSD^ zVzLu%@v@4ADu!Qdh_?3j$OM<$Tk||4r8Ew9BgPT8x$C6}{DBN9;eB}Km)l{rwdRCXp_JTL*POazK~e8d+aymVxS=z zYnA-3o?^wt;67;@h@wMIe{_vx1u~UILA;ixjow@wwk}092OW?x#hMfsS7!|Hs?d7M z@Ao!BOD1vs^lh+RH((Og-Sl9mT0VhUK8?XKo)>0-h0vR$H6sn~H0}(8=`9NO1bjuR zNhSYDloH?rgFES&=>c&}Jsp)meno!Gg*ZE>`^_tq8U+`;IV_mYW*R+cA(LxIJfM5w zYt9PTQTE#(lNz*sAUvg^kc=wKUt3$NZsVW#~A7U{QqL4?ac^8aT!v}1wY$@d{~y7O8O z@dX;5gC35|>KbSfi1P-A{@%4CP9|ZVYN=e%p%sC>%__UMNs=8XhlT6&F7kb}nYJ@> zm@c$al4rnOHt8Jtz_y4LtUV<^ecU2oz zZKZVw;pS$$lG03AEe|-^#q1rYz&Lby_lJFS?{<*aD7;Mf_mX-jo0zGTTxiJ|=1TEs zc#QZVAx`)E%WGb5Aa?=^)c!|I$;Km>2B|v;O|A|sHohk2 zvRn;VsGLFK{wfjo6C&53TOhFjN%c2-<#x>jLp#qOJG&Es%+Pk3toEpk48$Kku1M~c zpAb&+J|ahN{JKokU>jZ;z@qqD&8&EQPSRUTG8wiS%f3Bqs-6$nRlT^@{Feb@Mjt(szs;TaQw?@2K9&HyYx1eQ4b)LL=;&M~^uZE4#b+jhq` zI<{@wwr$%T+qP}n9kXLQ`O^FBz0Y~SF@LVH)_B%@YRsy->aLoGI{f^O6uRcpa*~w2 z{NBp22bC6cMWG?0GM!QDw_#_4D?LRDK)!wYi{|~6eiOcPkX4-7L*?lvhOI`e&}#s$xHsKWY2loVLeuDDnnv0%U3mM zmr^SrJ!{8I5z0hx1`N~j6Dv3)8yP(ZLRdVX2yHBD_oKa{5u{9tOx&l{SWQfLfSi>i zord!i0swrqr1q0V{L|Oj!$@!iP97&Gcrl?nTR?-mAu53Kx&6i=ZvbUpgh{bjq!7NV zp8H&6^Tf{KB)8_8+co8dukoO`&p?<|;UIY9NX)fbcp8H~4>zNCE>gqFj-%2ybxJ{T zBaQ&rr=<}Ns^O^gw-O>e{F_5Db@>`(~2V9>1Fj#G!M$%<#gZCT_K%sBk; z(xj12e`PhO-WE;Jj*%}CLt&+4+YkOm2)`OeHa~}QSbOZp@tiv77dE$HIDH*&7MwL}|9`VNu0W6C^9qzgDl^;UD^Ah@SS4;${=R;bbH&rrf>ne!}3kCG@`-~9- zW-5Ak$GclrgrYys<{KyGxm-4lAMv{#(>)I7MvWFMO-6?yf%K0Tgs6W4X8v{ysmz1S zW@kA7@J(BFP$GL?52DufUFX!_-Xq0yn+@M4-$)6*qH~3E$XPZBMCiT~Ehhk!=}6 zY7RXk(imFuYe6$lfq+m8PfXW$5U=zAj%4Gm3ku&)TopU;cY&2ooE zP#E6hKLhH?;jZXb4M&vWV;Q!9}Aiy%&`}r zhviZDZ8$nz`1@&sU)^cjv0r>+Q0S>jn6K?}m-wB~`ac`KMi_gJ8k%)_)OT~2@^tF3 zXdJvR!0NGp9EFM#e7Qe00&zXOqqW@lk`{H=&$BBjuHv|I4c7)1DReKg92fsHsG`4n zJ8dvzpJMZ0&lRr_SErBN*H>{A|U^jvlCZ`I#$(#HdzfxPU6nXQ6ANSI}ky zR7?w+gMAlT)7tlN-j?VCiw0P{`xl}M{n0j!|K2vY#+k(7J`CadU?$CM-s8SRwLo7N zaK4W~$Ls}0&3z_H`7G$32@g+n>4Zt0`==28M=F*`^*02|iAOSLuKgw-9~bBLZAZZP z`&1X!Z;kYx93wDQ46eRk_4FfC`JLWp)vWc7jEI$By#|wj3vAp-9LaAmw^Lb$2o>RF zm0w*IuZW0*(c4@3wIg=NVZu_Bgs<8ZYPV!3O1`zFwZdh75RsJTY$uYFdXf+QkX2bF zT;^DBOI0Dmd4=W#C8Z^raf@*kJ~rwbgOxR+byo-&QJioAT?V=eViHyInjOiezyqQG z#{f@*eZ4nO>PEz7;L-ziUluc=b+4v?TYf?FK0UO8Lp_6{tVs$omY)ii%P*LW-n1Fh zwcP*MO&D>q)cGljwRr!A=k8utT-wqp;Q|G6cu4H;28Fqjn`{A-@#zIZ)1iTL5N)^} z1!1#KO?;sP1Pnat0Rt*lLiYE$Q4I&kws_h%Aqpo(JsKrZwFan_@fU)^-t3Q$?XY8q zwNVYw&~_^Az$kkH>+i3uE1LfahJf3EA@+FTf9^+J?REoLHP(NIv*yT8L~H#FXsCQ6 zXyL$zru}V(R(x0oP6a|hb6V2&iZL##X!_hayvXcvGWjdC%gB~GO6k2A;#PK~2Yx_Fi77TQ|y zV>Whn@tvI=Vr9PE)W6N|OQi<^IN?rmDV?O!JxXzfQ-l-SY6tFY%{qBo@jlb=z?T7I z6d292G1hLl6|gy1TlTB*h0dG-o0=3RB&k#%!GNe5jbFfK+{t&W<`~OY*-KMS*~7)E z>dnX2=>+=?$JtL*+eq<3{Nh)yc7ro5OpLQsZx^vgobfwqSz#7&UJ6L55$VE*2b}(> z6V<5@hqZ^aGvBT!k5hXGPo^*9)?d`U>KbrymPKfokoVd_hMe(IL@6aFUV~{lz%K+ zl@Y!B_wfG?Y6!xQ?SRq4o8aaAJ<69Fl>QKe|1J-lLJ%)f>)i)v``s1`S3y?91X9zC zFlbzEaC(v>!tgWOlvLq91+dLj@NX9e3`mUlSB+q)Q?QIAk%Akra9Atd3zVLc-xMtY z0f&|`6wHaqDL5d7Q0Sp6;OT%8A?1g-(e*VIKa7H6`W>44c_^=qv!@h-c__i(R{I}C zYIp?im*nPGgb?ISG1G8{oh z?$rIO2s2}I&j!k*II`uRrbrvxSstoA?YA)bKEz(a}wGz?(>*%+6qW^ku8GiL9W2_E$&C1h0!7h5=I1QHt7G{5K zd0^`;Pf?N9H-XxLd%YDmbWFu?-hGpg(AG_8>C^s$`VVLV@1bj>UgT7H0*h@aO^pvq z`(PVFs9)GCE@mQjLH4nB56Gh}0UUA5B`EArw)@Mr59S5d+O)4Wnf5W%9H0)(Bt$7o z2p?StNBjcUspcodIJx=8AA**O6gZl{;F-xNT1EfeYFBS?&4IyL>e|6#h^9OA5K3g{ zYSoi7{=laeeVeL!_XuJ>WN+y|m2DG!zdBGyQHM=r4-l#eVhOgQi;~MJXT;i^*w5|5 z9Y(>evOSo`ue8NYom*a*_8u;<`!Y~heLZD}qSgU&l~UrRQEsq{LMt|Crjf()IM(z% z-G^|80i={jo7)D5bjO;u3 zM}6|LW=~CMtDzi$EC+D0(L9KI9U2=>)eSo$ktF?)GUYm)B zbb&cj0E*h-NJvC^x5(%K{OXTb_({TyBfRoDvaLc6wO!nui&ay@xTKma5AS93DWn7C zKLCBd&S(^xWJyYQRnx z)>P72JP`@Sfin2|i-pux=91edfvDLl2U(#NrHFn&UOtaCg z2etVx1KnmL;Kfbb?l~V}DG5lUhOxUHF+!gaZnGxD`tEchQnojCob6T(V#-qoGd71& z|DRxQwYAPjE_V{SCGxfq9CGb>pSkYA?{?p;CKtw|&NIKLWVsX28We{Qvr*|iL9PU; z3sK}J_M(d<)GPYpwK+-2?jlIAUN-^vV(c1vNRc!e!uvVu4XW7*|Iu2}{`@t}2Kp~J zlT^|YFxt-rX8FXJUMcV~T&9Qxfc@ z4s9mJHWdgh8-bWu?_4ebVWGqFrI=c7wiri;Rsk2jTv=V$-1U4jF}Y*fUAc?N$#ahxxQTG9c=}d0nU<8)&UDARxQD=$7@OKr!L5N-DOXbD0@vK=W4c88;dydhsyc#> z7)NKi*m_ZQLVO*r7~C>kVv{R}1il2UXiOo;+<6a;eC#FZ+yOL2xx%nTe4>*$J4X&% zmnV5>Qm`59P!fO&CIm7L7{)nQ$ZEEu`s~Y5lM6p(Kc~4ytv-y%wF|mq?d!;#@ z&8WifHgG4hs(D3|at;L=+bRUU_KX`IWfD8A@FVJ{}X`NSP9+(HGIf>$_ToH!OxeZJj6OueBP z79^TXk&Mw_Z-VGZoDg`;g#KgT>Xn+`udR-E3&qsp#6<{ilfj$rM3ps zVM#`~o6zijQbgYB<_zcQ)ePR;+>}+@nlBS4p4OvtC$J~TNEhsW&tVP-SCIOvyWl@< zFXRH>FBs$*h>t_0`03s$#6Azn*1HyD)62vlN4AoyMfMG4-lk-J7CO* zmjR;aT8_=ml*L`j^Gm75JV8IMAeIsf*g3Ja)(z7JTAaSvTdsSe2nI`kMb`5W5hMR) z0Jy+q%K<;*aO2fM^NtLu%jFOG+$J^0I@^(dprn<6iMu&Wt`E>(6xjHSU7%bu3G6=i$H4?8fwf5Tbw29C&|wdn^r598!QC9BUIj9p=r7%fEdLZ zHuy|tDEV~OIu>~k7gg3qnZ+-TM*B@kuh4jqAlL~uirkXTTqI60H+adQXej3P^bO;2 zAx@oq#e!mPj?3}%X;qk0zU&}g?5AV4v2I9O)e@!_x%pb8O9bI`hJ%f6rzCdIQ2rDz~Zw8;Pf z3r5CgxQsVlGJ+{Y>!L~7=_t*S@Q>Zb5%A;MAh(^J8}4}m6-1D~0q2*HI$M}`Rg2PP zF48#x^foiE)w!x}k2>V`R}O1Lxx~@-Wet>|FGarna+oR0O2lQA(xvL87j{ucd-CWH z`#`5#)dAcuP2PCzgTVY6m>o+Zg4kNzdL5GaXD3+g#J$An<)&@(;CW5LKB!SCz}d@E z-yn>~6W4jL(*_gFVfj#*^EU?^Et1CG&eDMA3-z+3y$^u2fe(LCwu>_JBlAnhG@L%r zr4sX$U=BISke3q1IjGfkWdfEasxn76C^er8KKntJ?G9I(Ob{QL#`H(TvF>+R$p;&e z4sjKXW_8E9gcng+kaX!UF8w8suH2d70+HiGID?hHZ=;jxplBaH@KB##(Y?`RGLt+- z5u!i@l$MtMLPDalVf_EbV}GPK+IYa|qevHP%O)LxMgQlM@W?MsicqjP^1o*P$5~&! z{Ame0WmM)@_}A3__yZx~FAhZ@Kn(eB)c+@kclG*{)8AuI=9d1OeEgBa5`3u^wBvIB z=Y7S3`PD-q?Cynkwtw{ePmG9_qM{GiUbHpo*InM1S<_b9!qtsLd$boaUrXhAbDDuG z_k^rtdBTl;WIs4csh?d(-Z922Vwu&XjWk>xsw7m~_lJbpMt-~!*GcP(zmLsWTodPI zS=cbz8C9uRw@#N*lRp`RPi^AyolsdTA}D-K3PW!-FqTwDpiCUlXQ%U0XU?8i{q6-9 ztk}SJxxFq^9#%pM?>dQ4!aMBD?0250+hD3s@<=@IPR3r94ni5wf$u3LXEkSYe5`cI zeCc3)Ul^W5E^B|$k+&)4ND>@ZS_=Lsr`QuNS9KT5`9gqcu8rXC?q0U#Zu-N8$MtxW zfIxXp)W3=QI(^$l=cX&*mxL#mcXYAzHo0VNL>S1w6{u{Hth`l4Cn-dYFvNt2d4r(E?G8>DfgRqT(khW?KLC_xLr&JfRr#@C4%P zVlg*RR7|J^W#6`1yDXVe^VV6}bAc#IMRVhp2?X)DBSqa7=0^Ds0?M-fYHuQlA}LvO zqR(3iqX`?nPAbk!6Lr?a@XHvGm2@tv8ms4TPdbWqw`I|kjC9i`wxNoip5Vc&qtVZd z2~h6TrE;_kZ01Vu8yEq>t6rJ9Z|wyAWeKKdGUk3)bzC-Tf@t9FUtK{Mr_q|Js7dr| z@!kBI{DH(ACnDdJPZ{^~WvPHN)2YO&G_E>b*HIOlrW!Ml-Cei)ZDwaOu-pB zsIg9$59bi5ffNJJvzAo`{5!_$v)+Z+mbpml&8MAMLcJk8K9o z!IlWRJSgK~y$QMjRS1At9ag zW@9Sf*-641t`0`FPSge|Gr5CApcH1YjlX_|u4d=k!89hh@&-W2w~(H02tRe={m$v0 zBu<_HU+PtKtRxx!9gBf!7yq4=YxG=lxlR>+_)O6H?D+4 zTtx!G#aHbqt$qW&VP{OA1Q`6Bed5-w3dJ?R!;aB_6RD&JCl9Y|)AmNfBBA1oT$fJ9 z731h@VuY8#HwiSdOHFVA-@=wChmCUAfW|WP+aGXL)b0!{QE3g0jy8!Qyz}U-*8}e; z*75I`3)d6%Qcvy1$p<1hVO9X(JA+!u6yxpV=dkOH{LTWJa6`KNCdac<62bo3#;G0L zrP9I^6tc+8*CIO=a^TNM#nM-TLAKffl8YgydWsYpk_C1x`2-K5L9Agf?v2L{Dz&TLuDhzV4P_ zYzcm)g!}h^1fL6;MKca(Y(MU;ZH8-7#-d>>N?Qdru3bpxC?op(XVRVeR?dodPtxDk zk~yvFfh~GJckNKVu3amqO9|;eS}?1quMb|HCE8UWJ?YRNTIjyL# z*pun;yaY1;Wb+bS$*rAsg^uH-ENirZi#nbZzj~4~<`&I@61PQhk)UQoh;cs?cHXdW ziOdY$NyD7Ea`>8h<-Es|n~=Uc*1tWM(|1aQ~|{IA`gR9(|zw+o2O zFjsmi6>yy=()^6doA;vQP{?;ta9fseQxA%GoyLUd_ZW4|h(zPcn5DkQuWG~!IS`l#ZCbkexq{#<7?d!c~b%rI|n>xa-CAfD!bap=y_396=k@gI~a3&kbNU z6^Kt6%2nzOI7-jAil%9Mo>AtRRSZ-4MxueiDK!s4T_ZhjUz=c7Q?9cU6FPLu4LY&m zo)<#wtnhJk9645(>Y%fj=;~nifDy3>`ZRRtL5${lU%@V7@wqev>AH&bT0UMerkE(< zt~v7QEh-g`Id^^$f+cM(eGW)1BXJJZ2W(X>YUkkf=SHeHrR%yMa6mZ!eut-|I-5h< zy1MNK{CIRZvPFRN;$dA}pJsCY{fAefDiM80rC~;@?Ok2i@K?3enlCB0GydTo#BFhy z;v;^-Gj>AdV4Advi=KL7Lpj;i^jiqN*X-FwHTZZQTz-D@4pZPy9!+;NV0DlRzo2N) zL07Fv>#4MnFqyoVatYV?Cq&zyA=Xt^dMjIy)ekm8W4|g~O6A3Hxt}i9>CRT@SsOe8 zCSWA&9GUt89qhR+@*2@&=cIEhX^?piH1b$aB&gWaIP9>i0 zfk>#??8*%v6ARd<|CT+JA-IkAIP1R6dnXab3vYIet;yj#0FH8ysOg*4KTuqOwieWvztalWX!yybK26j3dR zX%PGv_{^}T7~B-oD}%Q=Y~Da^UpVHdTT(q?eDc1AkgTSUS?*-=BIQ%JrZOi^Idve* zK>egDCRNYK8B!V%Bx%s1(=ZSmlpW`-nvvMx!`ci!b}gG)9na2v*KEP#%F-GzvyF$~ zt_@~AbtgAe=pw+o4neJT+`qG_1U`mKP~L-05@mlCsmv7U8uX*1s^;dGugtP*Ld~t7 z7&sRblZ9ZKp@h0I9>lM3Lr!)t05!hNP>BZL!Qx5)E05Gh8{ozP3t8huLaWv@3f#A> zaPf4#nsZ%2g>e9u_wyWOR}h)q@!V1Y?9wH4nDkiC?2AUH%fK5B9zuK)0d)`rz%G`0 zfIOOpiS#*zE(Avr=n%14W+I$7pz3Fs+|okW+*V4-Un%uXq1FH)1?i%$hB!~0yG)x` zR=R9`Kh0-N#<6ZeMk2eS#>@}ILOGg3P_T_cV|gsO5uLrLWl=pqr!lC_y#X2Sh5Mr$ z{Sv3gGL=Mflp)*}+ov^WgZ*+zfWzQowY>3oK3zeHCzkmJy#jI2dU{=GP-)O3Xw=9> zr{WNj6P1MQi4tU=VIf@>UlyGnu*Alj4W zZ^+IWwY!Md2{lQL@z;)gDgrmd%+sc)EcbR{9LB5?6sCJ>Oc!vs6j z+TRmromsl0Z|H>t4jklBsyr3gxJBGBX$Fjy4~kmzSyPaJ5AOJsgzFO}84W3{2ys9=|S))^?JR_lowU4{g;D3Mp!7^6uc z;COzcm%^FJPg1h7ja=8&~6G9$t5x?|Q?Es>ZIRJ8?#` zI7{gF!Nu*a)DS#Gol`CsHrMw`CQ8^v#Swue@Uu`{#aT^RiT>n%B82QaBev;j1P>h% zU^-LC1i-KQbHQxYLNXfUbS_mm1CnusY|0CDlnW~}yb|UCHF$p-Q zq)t?#s8A4|QL}rUQP#k{O`Fn^&?q6dA0`VqdsW&()LrsOcc1L4Wyuz1eS`===BKaTYoC@hUKdVmKv00;g2Mf(dUe%WaID%mZdCMRL zIUC8O=e3s;FJx-&}sPn{%paVqVj^#ZPW@SZbvgHIdYs>;tI{eBss<%4T-?7Ep0ni8|P(Eo&Bu5gYfrI7VaxDze9- zMIKAPBjB90O;e*dyW#rH(HzX)&x6NoMmCf8eL#Gz4#V$$oIQLfFu859t)d5~6tjh$ z=b2R5tlqT=DJjxK1|2rbfAys}EZa%9^PE_dot`}+*jBXx0RWVAX1#{S@hcz8(ZYd1 z8S_b+Nro0_rN0MnC8k+de9lnRW^50n7(asMsS=I#vO7@D9=Ecjw>8Dme02KiZ>hau zF5k97Jlek%n=&osC_QF+!%Xl_Z=mTP1>Q?Hcr;|XT3pXQVQYL*jXNl|tm~&E%=Gxe2ucKsW4hUVvm&h{w|E+j@o4-rM_cXTfta#r!L?T$CF;;f z)uj;r$t6}Ss*IiYT<24|A+bsbFw;*sM5Bec!!tKfa#lwSy$7pN^fl=7q#!bCL>|xZ z8#&Ftlvx;EUi0}8@usVC_)}y>YFt1xjgx{LUOVkQOjhd=Zvl?4#nyk7wC~`WcB|P$ z(_1f?&Z@SY&M`KIjy|SoG;CU6s1li*60JX>N#ZF)L}llvLd;1YrQXL$UTvwMVq7476+N3uR$}Y81ReILt+J}{lpS1?V(1KeV0zYWS*+E4ozq8=Lx#)v#vOGr_>suzfX^DS;>q`}QGa2)g_2E;XCg2l8~wUa(&mjKTV)!P7Mj!!P5h zN@d}tPa|?IQ3=6~UaX~!eN zI+3%BNJ<>jNi0Q!4)E0u!=5B7HI+>!K#8n!y@;TdAia~8``dc2(09YA&5Li4zXK)HZNlbKt0Mr

RJF80V=sBl(A`JI)9XqTUGFFrpCH|)>1xBxX@u>t>g;b8z+w>}U8jVTS|_x#Vg zlHv2!sCs84MCe3R=Cs#sdw9t%71Cr;qak}0DTyu91#BG$PW@y}vTuB=hJPw~EAStQ zXG|?A+$M~=Pd^0w9B5{HRhBC*8y{PfPiihYJy5AFDdcu#ex|G_ebcyr=NZ@ ze)HwQy9)J;nvr~l;GwLpFh}QZyIonxEHc`MzMkjGMj*!-!cB~{cHoyfHhUx(3>cne z_|)4Ky%UBXtzs~ULP@eF2J{TpEn0^t8I|f4x~Ur;Nl0p$wz^O8)gzp%p4UR{Q|P-J zp0~ViwaPU`nUY) zmz;9Y{GSoRkeL<=3*T_x%~+@MucY=n+c`lzz*a(o1d;BbyGZ-l*;?w1S<`Nrj=crY zVK)4M#To$IXW-14aY>=Pdu^#zp0=U}U#z7D?$P^*yRTt=>W5S4D!B#R6n@q(v&~v9D}cl(Dm|51Xr0L52z#7|G=ts za96r-{Dg(XA`u%^wK0j{zQD;T>@{_tOMIk15=V(bwZ1yG6rxS!*=I^Xv>N>)r7gA+ z9TpKxqR~aacJyqh=H~V_%gRDXe^Vm<=T66Ivrs5p ztAvK6Y=+drlIJA~o^If(A(p`Q%j1NE(nv${2^&s&GSTe^aMVFec#J~)K)$Wv_ff-5 z#K}%hu$38mNw`n`!voQ zGm;A4r9@M>Cryp{=bN*r8Yr{_Wv5Nkne#Tir|L$8Jk*5L+LE;UcE zpdwuhWu)s2Qh9Aea5`ese<%HvQ1mKoETcbA1FL2?@M(P25IB0cG9-TqJrG%_w>yfS z3M~WR86$+w98{dergx`enIIW4W6;0rHm->QxtO%E=ic`joI%silBN0w?ldItRW4pl zu5JMtJlAZk=I{MPen+XbC=H8^T(PtceHKxU$uUl;l~2cPg2o`-9_HYxHgpcNZ&-Q3 zDNd*W8g=x^Fc%+~*SF{7Og|-ekG4If@vx^mzI|?FC*EEEVc>lof~0}q;c{0BHv1dY zNu|6Wvhz=Waa?z~e_5xBD^87URdtMUW&h3`!xf_qe$}}PJh-%8#x`)Whz4QmZfP(a zd2e)1!dG=S2C=QK6b5ttm?`x=k?8#OrbPyMh#wnJ3IY~$HobhYJ^8Cl5+N2NxBC&x zOEivmT`$*UPx6)zRp6DxGtzV2(%X~%Ai@b7Y0|eXj^fv>lt9iK1ENQ3r z15PIxfEg!JmzFSKf!cHF^>`s>#g-~`a|VIBZ8mV^B@!r2lp*qZvY%qXhD*(#xnK|M z3?Ed_=HKO90l~(mfZ_Z?@ z*4g<$##Md=-r-*cVeKq}+pZBWC5hQGL*Ysw`^*~x*FujxhDtBHJ__Id1$pbn>M5N$ z#Li*iiX)|;Z8axt5BBK|{6wv5I)BXdN*-oG=_W0EwnE#t-Dr~uIXrr))>(G8pM81! zt-36;J3h6w?54a;8grst0OtdMBR~n^X<56PnLjHQaFR!9IUu)U*w)Dk{Uk0g!oRwH zbPZ^JLy-RZiS2bKmrtDyMg*AKQ_QXI>iY?KMUiAk3P7jjVtVi5C_lTpSp7cw+45O#}xsC zdGTeVq~RsWMFKG6uGf&mKq3EyE-D_9y%7cN2i$bw0&SO$1X>un}v$~V*rs_OcdWQ zQ;ahl$)oZYD;1vp&`r?vzy-YEAVF9w?Rh|L=ntAKA=M#=*604F*Y8OF6{u8O%)tO{ z@nBwEf~PdNgjrV*4-d>qbF$K&$)sH(e(vRy7zZ7B`X4Hs0)4-XQ=4qzuf4n)ZZHD8 zF;wjEg&L)ZVunNXnrZI*#Gk<)1GF#?V!Tu{c^sh2XN?OaOH%HFUJw4HFe-$y7J-~u zx!h^VM*`n16l6dA11Wn(d;uxOiz;;JCGx1@N%T4wE~*fp{Q(h05{s9qyAaKm(JRyG zbOu!zsY@@^kFyFAg7{7|z0;%GfcdQ7zt6-N*9~wp*cRf9|AO z5evTP@!Vy&h9-mXP%Wx74`xU-Be1msVG`jDm_A}Ocv9ED70FuNbF<6BG9P379<%s{ zGS<0X8sDYfoj!d3+i|s1BOzY%w^jL$?H5B_Javjsd`jrPpD~}MH~gfB%8ZRn$OkoW zTnQ*+Z+{3dN#Fp7`9R1$a@szWmMHc}<7-1e(jEg|*rj$AxhdgP#U`+v577o3u8%S~|ltx;C(= z`LXY}UeeMjx8_~4g=r{mmT*a1O^12yEnN|%QL=@|DUDW*jiNn-(``+F)zK?};F7Ke zASa3vb4_K)oacFnpX9}?sA!=A&yA<2kJZ*MV6t<4dTamS8x&N_+$^BpL3cB)A~xLz z<_)X++f`AxNH}p}E@lr?fFt4(X!b~3h+;1J9$_7}N#r=y&GpTHD5%%vKcyv@posE1 zO2uOZYW7NIe%#~2lf`|=H_}Vw^|3guN&g^Komr@PP!(!C<)}^)XqeN4cR6r=>)Cxl zu7(DdknQ8I@lgD-ZWPiPEi_ufyJ~8^+OiNrDVYfm4Dx z?!L`vb`lToiX8y9=aK%7f9-L6l0UGYsr{%45q0<+H>94fEZk!ZE>Zg+BC>Y05a6ka z0vKp;8axpe;tRc@And0RcgMLqN6Wsj&>NhN3cSq9N{qlruYi9vr za_{wa{u)Mw35@d7RoGK`bY*lB7kDySCwJXe3|nLM0VBQT{!($%sD+z>pCFfo4LPgZ zQt-BqFcgwq5WA4-XD`)v$gK2~-Ud2AmF{;0Hxv}I7`D*isG_{(TE^qeO7xR)w6F1Z zWI}c$%Pn`e_?#(_vD4*^9^6BiRr%}*Q!Nk^Dpi3(?^!jU7ZS(Eo}k0ubeKZf6dgEd zwsc4Q{g@&&@(&KnuQ9nsnf+x;>-<%BWxHBXbo{~+Qe!IA4wE#^U zzM{da|;F_v{_9vn)I~E^LNpW@a}l42+(^Yt!F0gHs;?sK>}Ji3F`q2b(N1+^gD; z;kUMA`@J&qcY$wpOLdu3xDxZV<(9vflJabvBbEDD3ruNrzvOhO_>iI!Ug(D#R?Rqz z^Z;HHR?hW3$y58WfXx;1#1fCx^56J#k&t~%4*i67R|p1+sscM$DuI1OcFk9-&MGSz zYSItaHg4sVo-OgFSW>Q4An5vK*$t(2d**#NRnM?4S1=*F z1$va|ki-vS(A<|}l!;0h)p6f=UWXTLjbB&3DX#~q)_HKdmyC0Rr8*Od!C9^S-rFSb zxOONfe#p`c%EIBUp2|i6B)(lm1qx~EbB-U|Yrb9o{5lL#T8GIb36s+0BZrSlex z0bOYyeqCvRH%%zL2eWFe9&IbEbu8dAV2l1$z#@u)5q@{i)mB5ak7tyF*ZKDDJVX}3 z6>x-dK;|QdM?wfHAVbtomOF5Deh~7=JL--%K&)QV;K#D}cLgr?VmiK5tz;gWeeJjJ zv+l}$GsxvEIp-Q15^2+>ueOd$-XOT}FVO_;>u>%ZK@7yFu`}eT&L0ZRFradZ;t=@h${xqSvyR2LPVA!NXH`N_>9QEl>xQpMlDJ0Jk!KYh=MN_XpGG$1>=|1aAi$_?{eZ9czLi&*qNROn)*9 z?j%sjv7Gp5q0>SKl&{)lT)#r3LB+(ANNR)!G;E2lHFDg++AQP1Ak~&jDW9Q z`rM6%>G^6vVTSKx3>I#5&RVoDeM5R2wTm#mc!VhFq~$T?7%2=Mo|B`a=;<<`FblhA z^cw^mJ8iI1h_mVPhswY?l%U%Yn{ByRk3o)?#4~Pz(uDC^3JSxPndr!omM7rJs^e@) zCvkWda=$OaZ^Iz!qAW+Hq_Ee@vR~7nyq9;J1t&TqP4pHl}F(%D?5s`ERDL~-syD7M0I0&0qkfXNz0{qbXOP;n6pgi1Q zY0tzM5<$6{!bEB@VMD(Lha-O$_1)_cA>_97!tBg*rUjnrSUwHeeT{w#a z_Bv|$*HyrWH=Kxbkw?INZF<=8&RT}QaPYaXmyIW6Yf3$W;`btq?9&FI8R&>86Sa9GT^@;US8YXi~$WgR2QJlC)owHmk! zBHnddqr5`L*RYhH%5SgUwJEKUQ8c~N@gDoZ%zU5C>2}lIk*@jp59wtE-o)|S1>(*# z65e4n%$5YM-Y2UPij^Q@pKhZGES*MfprhscnEk%7(uoCEKRNR@esDaq85qdPT!NAK z|G0Vw_ez>ZdwZgZZQHhO+qRvFZQFJ-v2EKEYsc2a{PLXVeb4XuPW3;~SMBbq-D}-z z716Z`pUk`1V191LGY_(-ap)Xp1pivS1g97BFlnj9!cIa}kLe@i8zI<<^l8<4plWvLc1;MRj_zbaWj1fZ5HsL=P$+96fmlpPk-%B zzrOCE-u;xnz-{ZJfcNZ63L3SRUQu8*DdTLgQ<@fS%d6kPtJ<-vY$9(gKD;->JEAwggM4ZNS)sY3ghlVLP(f^a zmL8;3%D#j9X37AeSU9Gj566!wW|oGEpuhtR6B8EEzgIp6+pWk{ay~(m-0}tGvhpm9 zmIR{3Y`7Pz^&r`@dbU`OHMRehyuWZjC9>T11dQ*sm@|3EoFasG_lf#e59*yBN2^mS zV}$+x_sTZ|1$D>sMeq3Vast+y7I1X?0tL>FePIysL|_8{Fk4cv?F%*cLSBkZ=olyoE#v^@-?!9VKcKS>|6IwHLRHiOxc$g@%Dg z9(`2JJpDS@%R8OSqof9x$5aA&4H|tFP44W^@m2waa){kS&hqeyQ;4+IO^I~0egj_8 z6(?M+pzGOC6lGd|p6a`it}w#sEy?89{-pim-1-#;!9hQ4uHTjr$4lo3@qYc!{lJf; z3gNeJM1ZB3*f=oM4#$dpMSd!CwCys^-SNGD(kqo1({TGrF~9$%V;bO(Ga^oEv|a1% z*cUEIQ0EJ_03>l#>2e`YgU1!{+c#;sVxSjqUrOJeEC@zF;n8>7H_`p{xb5xJ6kJ8* zYY%>5_9=OxNfRd!^tefeCsbA`z4&?L`BG>;q}&y~26SH1tGpEHCh_Nlc3{oEH}Lea z^C0zAH;K-ZOS@oT2*s8a%E1-)5-Zw3i(Y6VNr_`kOF-FFb;5DVFCpShG-kdiCUqi_ zb=y7R;do+2gVQbP`$yaT!VOp_KA4AI_*Y|&(2GYKtRwvmk$?WL5Itq}eY&2XzqGKd zBHm@qP3Lp;$TKY7Rbd*Ad{B4IydNR(8}}gh-cK;4*3jv+EC&GEpW)&=lnYz~VyanY z!P#9De<5O@bGePvwKQkwd$=B9Me4%3zMgt-K1JBVuS59y&f0=<-Y`mzzBw&l`14Ly z#5Bg>=}iYV8s&>@y*aerXV%wigIZlpW*r&(fAo8yg3Sp%vhwT9;S>IoRG&FutdtO(Lbds)+X{D zoGRy3x!`>2U$Y7K4U+kHfMg|Wro0txuY6nrK@hSxL{ zM}i~*7k9lF#B01=@D6*`7zo!7Tq@VS!C*^8B_IvVs}itabfQm6G4w4)n}4V2OPFYc)|%X2ycqk&NSqu4ca*%v4x)f9gBYX3rahhpZlv z%Ycncq~vJPB{d^YWOj>L7x0$~f|jDMCGOs`ARJTjz6IoEG)%FI+5Sq2{up4e>1!i& z*v1DfsI16M1PijLK_fO`dup&P?-uk{D`sAeI%|5zWyBSSV8{GFhPVMjIj<1juhf5G zW8qK+Xn@`CZ^_j+(n%Atc}j%mtR8#qn@uj-hI6htT9|BvaO|;KMRY-$MG6G)ejwq* zmM%Q3gy-?&@Ri9$={HGAJo~bi#@dO|b_qh!9?L|#iG=&>jhL#}W#icC!={H345E&i z1y+myA2PgzBX1zB%hP9}d?>$*1}NYRF}?9G6z>76Vf!x3#Hy!RzR6#-;O$S;f2H@6 znK`q65Mqp;cD_K++TT~s=?>N)YB=1n&3pmwCmsm1!Ep{w?&4n?D&;&mVD?VfH5^tm<_~1Od;0a6LG*QMT9dJPry6% zU+Mg@`EG)$&8Hr}l|rG5%=^j4%?p_q67X0uw=k43_172ry+B|`0@ zWrk?}XaFHrdb1b2Qtw}pw`Yvt(jBqB6)%Sg*9r-O&4ZZFS_$G3F?_n1j31*f?(u45 zNPSGq@jCB6HEW!2O`g!7HwQ3E$Wk$O*+HPET?`maaU;>;f^C%vkrpy6ra3ued?%T* zJB=ZbM*FE@NhL_Y9Ey9UzDiuLO_j`lDS4~p+<^i zi47{3e}rnGu*J-;{yG8o`zi=l*PbF@K_+Y|k?>FiN2Nn{co|cA{!OZkJ2hIsp;|sL zk3lc_JT=E8wDMcf{azNIrAPKTK4?q3v&E<-m7ETDBjhh}G$KA;*wV8?^ve}cChb>l z@Fl*Zt&@1U@=)OYh|rK9a`5kvn&-<-N(|Ex+8Fyf{ICwmQ{jFQ0MVXZm!vFAp`EBWX$ov765g0z;Zs7b(PzfdX&GbDp zT|@2z(&_tC92}C{-ENrx=f~=J;1`G zR5zw42PVc6?vjD$W|N|gQoQ{;J(HPmnVwAaJ~yRiRK;Ib#*id4+mFWQQE2)UYN z1RG8N`AXore^h%WcPcVTZWL&j)%?92LH6M5Ds>HPdPdJ{!G3fPLG4a zK`hN!!7GDlV>5{0&S_1Am#t?#6#F?mWMmb|y%VatH?be87rlG!N?L~=^v%zRNJ^xs z#!XWaGn%lS>jm9QAiY>%s4KvEV>RNy+7r;kFsI8h+j%L`2xN#w;fxG6cc4=XJwW=` z5qqRNM4OTAL7U{g#tUuZ4p6j#AK8=|iI`Ei4g*IKIU4;5=G(y4P++Q={Y*eg4QGYb z8EnDw%m}sSVI@9O5ur-o>TP~s7v=hK+1?#9Z`&G!VS)?5!ZKn^UMn$tL)7% z-9;xoNV}l5UU8T(A{TVBAS5WnRFlyXh%L&6Kt{IL)q*jYy1k+>+;Nfnmj*iKRTAnoNT6 zJDF4o^b`tpe-*{|*Nk9sib9BI-+^)`5ppnN*VKfH@gId}Bf=~^s!CM?(7jUCEg`RM z#n8z*J;|rqU9c09xbp??1fyN^0tVYf-M99r6H?>u$P zDIC0+F$~l5u>a>s}6E$vl00GgJJ(!`nE{A ztC;7pGE+KJN;BOK?kKqxmv_h~n0))1&$`r|Rl+fE?;CaPdSpuJvthhllKcRDkwv| zI{8UYHkC|**sY#>I`ENoDFWVj(1p%k<|0z?iyDKRUjP`)mS1uu?}GvPZ>U?qFEuE- zLw13UQWUmGBgi`GCK8Pnqstwa2)bOARU1j>oPvb@N>*WF>U^nSc}SqCS|l9QU{kUD zZo$C)vRY-tq!rNZEMJlJ1c7&!4*ssG$Xoxtkh4>kcw{~N;=cf%F7^(EPWt`Bd zC->25l!t;hQH-v~>Yxyn^QypPzw<+jNOkT$=+*^N{M@hQ*iWC23R59Hvcgj^HMyv! ze?;xVPU?=81P{#cQNgXgAFn2pO&?>hkCAmLtQX93hLaIxE}uW2;=W?B4?MC)se=gA zt8NXQmxZORogrecgf-y0F(#D}UEhH+C-sW%{=-)vS_VZ(ry9*Ga37GDBB)9!&6wJh z9gdFF$ThKu<$3)-?;_*kP;x2s2V9SHy+gl-O9A>4tS&UB=eVHPo@(}VEr@VZ7{u1E z*ygoP9Nb!iq%z4S_Ti7qFF^`nuK~sj9({0L9hww`hn}>vzP^0CD|}vw7CTakE}SS( zSGh{TSq1pBz_2#)%*L>{N5CevSiBhnUzE8n|7fA;U%;P&Y?d%inp5bX~Q6%NhBsy>LODhIePdstKs z3d{N>n*{n>+OsInic?;y_{i&Z_SVtrh~I>^1Pmc_JcTH$%GS{#IS7#SiuaF&h z(QtO7c-X_kjkdhcU{IO`rPkCo`;zlC-@#P(`AUS2;sl~MRpOkZ6QiQ2_i%>Mq{5{Is6HJ{&HbL!6riB^QK*TeRVS7YQPUhHFsxNcTDvTIeV?CI z)8LvAa$67K^9}4|U?ayg(p#`kMvb<;GsH|-7nDfzd!K3q)9&O9;hu`2Gkf0-#u*i) zBHCp1Zb@LgFdj9w>2JdS6QJbB3s@&TNJ)~NrZU&MVhMc{mGf?CLva^JxY1**!A6d!Ty)L9KIFo<3>Nos7aCM2y`;vd568U6B zoEW9qXzyC4Qij6Re^198QWsJc_h6yb`=f>NJPYyrh1HKOAn}6lQ(!`SD$b;lOS*{l z5iN02_VTNGtu(GJ0z3BO-Xpe#px!Btx+_#)xh(j+ky_lwMn^J|Bo_C<O-^qd``ZCw$j3&VlHX31dxxsyF&U>NDi( zt)f?fXkw>Sk*`rtSc!PZ4F9{Tfd~Etyc9rU{WQAzNomy1>}5MHMM7tI_4KXL z)~iI3945#DEN~1@e~CP|L{U(7hFc4BE9i-5!=;lAjCrBv9_v?z4o{wtLO{Q#oJfs; z@Pp&vaY4sTY*UmVp7QU(Y{Wv-*=Wa{Fy=o z2*#J!k--j@XO|DdQw~OCdv7V4vL)=8aS~g5y$$a&0p8eZ?APZ)Y_*i^ULb`SMDvCU z_6sR0(<*v8`fcIv#%{z;QZyd>tImX0GCc+dS+w4f)wAGlK};PDSEvQjb~D>YbS&4c z1RRWr>sPhIFS83dRAfl+w_X7e2z<8A)@;!B;w=I|)UR2m((0-xTD>9B5JtynEa91|nFh%x9h1;Po5>*Z&Z>;C@ z9f4{_W*`1(KCK43=yD2^{GsKwzCrU91WhvfVc~uJ3ifA$_e|W;%2C37ZdtKx4{-!n zQs6Fsr}|44Z7Yl&LsG3lk__8D@VPP=8|SxnkTb(diT3)O z)4_uK=3DqC29F7Nmf>nX^Twm0+cgu1#SlmQUO3U0FZB8Pn#;VRH&E;`sy%`pI(zp( zyVjX+bmTcfKYxOr2~GaywoPOVRBWA5sC19mORJuwV18wz`X_NFniW2!Yk1a! z^C2(NR}j>GqSYyAVJWx%x0E)&NbNiKBhO(C`xLz!> zw!J`HH#ru%?=T3&6=HQWk1D&wTPyIuGX{0mqy42W?KS#keohnoaFP`#%=Ma&T+!cu z0dOlJ0UC;khB>mB*`q#AW7wJxEdLW_?D;-hM9Z(xcz>eb!Jxcap=o5@Jtr(rjCOV# zQ5#W04wK$LaL{N1z=#bbm0t0~ckqITSk@tyVi{W%H$jE42A(%ed@6x#*Gb`#j;7Sb z2XGE1=i^wOthmaB2XL~Q?iJLRwIp30ay~0f`9y%)vz4N9;}~8mIsf>F==9rkv|sUPcTqaPf!!PH1ZQ+6aQj+56h~bP9IqHH)lfy z`BnqAAcNBuf{Hi>+w!$|9AbUCY5c+b+Y}p8YZrZ?s5vNtYxh<}K`j|p!BJte1JZ5C zFiR~B%Weaazumb3^GQi_C#SJ0RrDC1`omQ|`KXCL0zE5jdCP7e$; zIeU#ZWF8-R4aFv#Jl{8gOL^kAs`C_rZoLymkl)FC}+ zE}3kZ!Xj5rx-K~)B!Lv0Vl>_;$AZSoC1U4`x;yP_ z)7MX7VPYL$naqv~(L{%0T-C?de4|`I+>g##Te`b+&xV#aXZmxd;>D)7bY^(OHT$0^ zz|AKF1Ghxk;?EH9Ija>UQ@8!$PHF8y&n8Tz$2`Q#Vp4usuIcT32HE1@l`fi~>f3SQ z1zYWf#c^UqEBPA~WmNc{2gI>!x)WMU^G8v1%;$jh*QCAIrTlqcrjDsR7-ZZCRaLNw zePIXVbF%eQUG$$HTm|n>%wsFBFmT$yCf=9hM_ynBvA8s4bYkS@%v}-NBXr>A2?QkV z+iPnOYkN6EG}R(eTLqL9UlUnd5(7GwF1Lbj_d(%hF{IHgb=xQ1C;S!l7+LN}Y@+vE z(^jGhkw<%sw1<%sj9CgDMC4;pTfe9Dib)TsXe1PRx*?C#uEl(l5}FiEel}fSRfrYk zXrkD1|lbsfhpUmD^eG%SzST~ul*_~_-BgWZ1l+-f zV%LucH-+0rw#8Ya!YB81pA&CSFX*o;9G00K*VAZ#q5Nm2Z%oRaFh5H78MyPP?BhsUKp7<$DYpF0-0xrq3yo$yHh+rJn6 z>`SYJG4k1e7LYc;73_qOIN9)6MpHCpR~X?h{oIE$gK6r5SNGFA(iyIC+{&LOCZC_u zcgAPqieR{qUNQx}xC7_l>u)~mX~BL+Hi`Mxm3gh}6c~Q&%r=vU&8MKu1Kg$(Gmyp3 zjkb~W)CI$u)FRV(=38k8#`<4EtN}8FuAe0;MYCJZPMCExE8Ge;KMs9V&sZ#(>ecmgYUc$OGJe9|1~kfjfLNB1`7CM z5-__UE>}bgNqp%undvLY9W^>tF52_({G;cRBhomYE_K>KeWBwFjn~4AuESXtf|ChY zt}eIL6aT3?`do!G}A;>*MG3Mx#JDfwZL$Y>8e4?6-R4 zP^O|nyV(iQ473i2*j>7wIVC~Cf$7qPH|_reRGd}sWc(!r5XJ<7UhCZ zlvRtt-6Spwq>xzvBHBe%U-Ud6PDKra9Ss%uSy0{}<&$+(?{hoao@LIZ4XjE)EDGw4jB zMkP9(jwokiZ7Au?GT2BO1rx6)gNY5KHp}dL8wRaYX;j z74bkO@-g-r#o!X#u-xi_e7QsYLi2;j!@VkdX>!}wWK;20qa$q@FSkbko+h99|ON^FN3 zUMx8O@z-_+52KZC{?3liF`^fxc~knzG5Q}7xSY~dFk^e-fy~kG!wAt&zCu+N$F1{X z)PIsmkyi^r4c~TmFJQt7x%I_CUXJj=9~n;VVKUslAfij8fSvs|BaJ_>c0Gqwi$}tYrrhA?Y+jz+ zT}&{&u~~zYswtU-0vRc#aQE53_UB6x>r}0O2-6Z`qy28H!|U*AM4in}Vyw~9gjS4} zL&H(@mSxqpj?|=1N^Y?X;F2A)N6PaiddTtD55FqA9NCjP(ebvljAmM(b9MK@r4EAI zciZ@VFZ2b(zhSmFnS-8?CF#f;rB7JDW}(B^fZ}U4zUmzT%E*@R)n32PD3ml`%rpF* z0x?m+j%6x9NKsE!cjKCB9qg)nK^S=xzWxE3kOoaaa-8+;^d%}N1#{@LUO+$%b{lVe z=VVA`(o}^sT)`$Ob2t9@d;Cw3ra~LzFh;y_negJm?b%zEYm+`cp8#T5LO5j0EP9vO z5YlMVRjK{I#Yx5O1c0Qxpz`7w2sD%e1{;Da<_F0pS2AJ;9y?x~<`IHo3MioE1I3>I z8!w@t>D~Ha0fq^QQ zlW5AQ_g_YRv^9_5W)_cA$7*Y#o?YD;+O+?{`{bVyhX)w}P{qWYo9`JTlJZ2hZ{EM? z24B6WfZ7~=D!4Z%^jE!OUJXM7_Kc*px{NkIX|c-I;f6jFE{6t)n8~#UIX+2BgI7kg zyS>6|(T$NpB(!`&MpD$n%kRxJy4~2XW~}1|@a1=PuIU{^pJ^A@;5D;&ZeDlwXjU-$ zpWsbSDl z;M5j(6$t2e6cUTwI4tRnKyi<9qjTbAbqBuU7uy^-wk$Z`!En^~tYYK8uh8zihuV=F zSkcN`P7H5zvdIc-E9146+cjkxHPy-Y=NJQ#mUtA&Ij>oCfu`r|wZvo+xUctwMY+B? zM>EJs2)_)zGC&^w3N~|@;dcZU$LprQwV?)Tc=rnWhnT63qQqiM(W9*zy=|l3T<=EL z>pmzHJVnUx_YQw5#yYgQt^^dgRKVD>{PpX2Rlc zKqt^DryGN(O6k9L&0G{8BTB!=C1Ts1^6E{LqZ|%Sw_L^#%8d0B=5~C~6AL2QGQP-P zEEePYSa?q_I0={7^XNCm2i;Y1Ev3LX5aU7n$)xFKdTBiq%nnhy1E^q3=&sn2<41kd zxVI{|(PohB4#C&KyvW@1(7NF>B++MKy#h0fI78=ahH+`M_b>7VwIz}PhZ)cH zk>mg4v%RNvpZiDco$P(>3&d|LCL0MNBE&=n<{L$e_0_B*N!v&+Jr5&EFKHN6&68kt zj%XMGSzmMq=&BS`QRPEO(Np>Kwt9JeAXG6L9zO+bY-D--J>qZdwBPAs@}wM{s&XkwGMmc!>C8Wh9i%8Bsc{>cU~6-g!0W3!zmvVF-t`_Z64`Sb9N_C(%6Qhj z?m0hC>xDAAz4fR64)o-GE6gF~6*%YaXZxZex<-$mD=L!^^p)Ar4iM%Kr3GYP+e8KO z&bKKWMK^7_gFe-zg<;%;mx{9=1VYIRX1Ac`oq-bM;@ws~rAcFfJ*d!-u3=fc3{-R` zVU=Rtr;r?!?kBWhR_P@chFP-Ws>iMLzqcy`9zP5;US!4Q$bKtGOd-Jk#-#DHp%n9+ zalRrARjXApbaG0_a!$CLUci5fg1bjvoR4LxK%@1Un@K;~s^PMc5QvkZE36tzBqGYh zM9G>Ya3RfH#Mj2)AR-FM={dq+T1fRjl6DM%Y+D0ub z4>rnPDwpC_bardQp1nfz&*`~wl3*5B%9FUt)zeLwziq#af_~Du=quCceCk`f*q;gj z=Qf@6Pl4$Z zyc)vTTxJ^ERQ5xhX=<-0+)xq_5ZvS219gb)UaD?=i7k<3tL{+!YmTImJ=IaG!y57GtR(_tq3SQT8!e zd@0UsDWASPe_T~8gfV`BwO}_%Cq?@@hx(1hYW7(XnQ1q-QgL*=0!H=*U&&gy% z5FaH>WT^wUxWcE$4!ZVi%||~{-#rYflmbZD)e4Ut%hokIE8}dIn%LX~I7}Y(<4U}@ zFX~%o!<$aaZyOr^opgO17#D`Tu0syE-w?`Qfbe*t#~FtDK2O%j3WnL!%bZoMYME$! z4ns|=$yN|J%h468uz?u??VbJ6G&8=g6h73aleI=}0N<;1;vj_8d^J5hL25wtr*&A< z5l0QCx^OpEu`S{;!I>i3+CI)OJ>h9KBU2fy4CBEGkg8!p!S_?g-<*AO`eWx6iqdw% zMtuO%R+B_#nbt>c9b_T0Zao!gA=v>q4;E+htWZ#iBXFN`M$w2OH59F|GY{G+LY^Aw z&cYeIiUC^`(jocn;HBSrbIlDYj+cKhnGzXswHza%UcQ8%%DbV(>l=hL1lG^v+Vrqp z7i%KO>ip9=&~{xiPhL-64HPPu6H3XONyPk$D3g5|-{A$FV}ALrNAPHau~0pw`1cX0 zYWL#VZeON2l7pxv#Cj04D!n&u$gCl1qYf<0+P!Z@5|J5fSp{BNkB;RqsuKBwX8n`I z9IeIH5qL(&1b;I#lCG*s!lJYud}}I2J^r!(wnFMW_ovJ_U8EGG{xGB=Ac&9oeOGK--J#@@4Rr4{C7q21N-Y_^cA#Yo(%&% zrdE-o9EO@sDi2NiP$$H=*>TCm094fJoZuxE+FZK>nwOJCj3MEbVxQW2)5@m8B(NN- z()Z`4>Okuc_}J`0$Rw_t>ViVT<;{+%My=w0>FJ^qW1J5jQ2ZXsjNU}@HiYRNkO`aV zubadcrdK8`q|F%zGXfWUMz-Xx=ZMwY-;a4^(THo;c-_fR%AdaRdUp`qabk<-hA*Ns z;Fd_;TL3)NKz@9c5?U?no?B!Q@!vc*F}MKBv`E==`NTy`)yatdiIA-N@pt3*<$jc> z=Pl^RUua@3`YN4ifBcc%=-Xpa0T)oyBM;%7Z8$Fwp{$p4OVf}w5yuQs&DTXcHMpd( zT<8$7q|fv;oaPSB{c;TY_{B0%E0k=2(9K;L4csZ4(YoJB^tiv%O`@0P%TvC+m z1(m$El#akCoFppd_y$K<8&2yic6_AvBl1x-Mn=0own46}?|TTSigHwp%|URl0Lei? zC;;yzunF~aVnmhsUE`@6x)J>yxUl_nUiV#oP-^W+NdwwKc6Vt{3dOvHdI;)8?)2!f z+38?x53WcT9me)1@>DqMp;|s#4YqRd(aOeMv4KX*W1sRy4{l%LjoO-|p98)z{6lKI z4t*1lYSH0ShckvsAk0oqbK>0|zcK19SUOp3R_iCuevq{tSRm=LwZX$_Ty_o zEE|6Ahc>e|NoJ8zuhU^XjmqEfapNo#fh=iH8=U=I&t0nVkKa9r+K#a|NY>Tfz7-Nv zbbFb~i3M8asHDcy*N8kicvh&~Kxo>;3pw%CHoRU74j!g;z-+`10qPzbd4RKhfIB+jyl#`e0yjlj5b)uwVdoOBD)|f> zI1a}U9{m+UUuH{JBRXh)Gb{_n5)?$Tu?UZBG<&@6%CzT9pZ%+=12sH| zDqkDzh7iw!r2rY^yR_VdY__8N+Fm~Klz23LuwF*z_-(K|ZX1MOri;j2)s+K!W6NmC zJKc{zY}QpTdPmEUlYD>r8P^l5|JVYP@k|Nv_~9ci`j~lI3wM0gTbskY4?>@s7IjI! z`TN21#|(90)j0w5g7^)@DEX^4#7$tOuvS~OR&7u(5n0aMl zdi2?{Cy|en;)55qH7q%u3>AUe4-g`XjUzAVhbT&2;fyBX|-Kr>*=&F?!FdKa@9QJ_QTqPW_MfeE5k_9H#aJY=#VMcrzc$A3{5B2ESQ4G{T0D`I$bu~zUuCVNQa|B}`~ziC#^ zZIWWGyhax^8FzfEX25-i2qu}J`Ifcl;abj8A?!YKecbZD*C^8k1s+A55)uA z4OWr)w8{Fod^rzwa$=ZExNfpIz-)<$9QPzBrMf)_D38?dhSX?CqF=rOv+)z!XA40Pz-WYz3;Hhkj2-_fkaKwI&w2OEB5(Fs0Jk0%lxMX;grUob zm4CQ4IV)ep;fM*f5^uj-H)+38Mxw!wv|}b2b{WEEPGg0W?|>&59D$X=#W@}}@KwCd zf`q859NX^6H3bHe#Vw*WaGJ;(A}fU00I36#E@mC}c8N{2YJ~dqcCXs#9eicDAhneZ zd|VhI-81TPy&-5bSclG4HD;lOoY{#v8%cxD?@vv4I}oQE-vSFA1Lki<8+T#nia5gy zm!svdVT}`#P-96TRPeHR3`f8~|2y>11EM+|*^8j2K=_1zIdLJdp9vRKL@PL*k|air zy#!p;7N}zX>3SRV*++Frvbs z;n5xRs4m=Z<8t|#sM}Fk(~USpyIznv<6OKGt9C_V^7FA4CP-7888{s@i;UBD7BTD^!7dpVA$p#w|C z3Nt3g8Z@F9S$JWyu$$38HWRu3M~ocycPny93~3(ya5I$)rATsr#A?b*5H<(!LHvdvj7M=>lyWQOow7j=re%mCx>EvuB3 zCRE%?+;d}DTD0Ska&;Bqkp5^c7dVpHJhAuTB*_Y{S>&Rrb#@lD0_hicJ1FX4Rs#iG zz=82)u@Mep0{=Tge+UcKJzQK+s=Vr=DD~MZ;E}LFxCy!fVGui?q_mQc*hdbWO_k=^M=j~=g8JsgY|-7{`=_+sA*G`7W#_~c*XKo zZ6Q0Pot_8{W6=9v-~KZ=flIo69Q^^2J4zlt*wvSqp%WRe#%)8+fFF$2H6VudAg-pi zr{$!Y7WK7bgbX&DLoOqZ+7o9Q6BdlcqtW&htUdVojSdN$MUXt-wOeKpmQD#+9h-{| zT8{j{(9wxHZ_P!rUAEj8$I0r637&>^X6ABSF{)ZB?g_bQe4O8#3q(r8 zahB|AH{2!qmjB0)2ZYrNQi|)E$Vr;_rVcMiF6UPKM^2g$+Y;V@P}`=ak)rU*8S z-YbaN#GPU4qTI74Wd0TnDTVb>@PyMYsn zL9>zT0f~Ti4I@DQqza6tLq=eq5Xk9TYq(=OlJZc(Jqki-b)p2tEd`XjH%`I(0+b1s zKV$^p(bT$#iU!sOU_FEWn^;Kc9@3)D`|^hMIYy$ z+Z(EA(T_O9+WrSJH?ax748Su)&brNYQpm)C<0$oO(2Mt*~ zKQm%LjHp+)DwMjcLghxLa`3{P5 z=fZAE%LmlF{p8+==PzDBy8Qz~>lYpdoi8#WHEjPP<&Vm94k;j2?S^tGBSyE?>o(5! zQKsNgBNCf0NW3&12O~!UFk+vr=Jb%HC^RFu5@_zrr=LJn&NW7xUvdRkiMJS(8*J{n zxvQ>7{jF~R63hgodT6rRtmo7d>2W23<3Z_N?=c|qG_Z>A3MMPc*l7kFVyBe+fa*qeAP=9}w}FICZhKS3*!oSskD{d-z^(|?=f2WEVZ z_+rM0`+-{?6I}5C^*NB7N1Slr7c`AtH&`X5KCLz$D~`W7F-*Ptd>(|Hx1hb_GDP|x zd{#g0SXN9?10nOGR$uwmYMw~)=D&_i?TE`y6GQRDu}A>%fTtbG#?fL?Y3aYC5)Rm(iYnLHFAPwC_m^KW^Y_a`<{T zi+*{4nNB&VW|`c;mP;l(8w%xTyc8f=b+c6~f4|k%uF~}m#MT}UAC`EK9fWH$94B8M znq-{PDH@P|poqq=6Rw{9?!tpgM|^bl9dcp^akVO^h)apsiM!g5GZuBRrZA$#yqR{DG+H1_$fGEm{jFhtvaftZ3c_dCTP=$5r0;`k*W-F)kD=2e{Oe;d{DrqJB;+ld%?rH%6D6BvRr`YTw(MA$l>h2>V;0*jX&?K zH@a&jjvTL)PoI~XCIV>{y^Br!a#9lhxfWFtZz(!K|Xcrx4dPvIq7B3%Pqa#rsUOSpz zm=4g?SFtQB9UL4KC`=;7K%Tc-VURlPQxj|;H6jLY;VjH;L6HW$rLK2*8@&QM#yKhe z>B1x%U!GCjJa+dEAX%?~++cvoO49# zgKsz+&0NlP&+h)l-9@HYuvSTwUq|^_A^TL;XsEJ?@kA#E zPz)<*+ns^JDzN|%i~ugkNxXT4an-SBW@5h^hamRPFsudI9q1WPID5#~F{Anq4)z#x z+zN~(6QHPa9Vlf715AuvFaY5CkuOOGg>gKQzfHtF9MT*;9M*J_UhWxYK^Ggq#p(ux zMIe?<+l>1!9!dHR_fhgVx-xZtv269=52~RX)%kfXEQeF%D$&%eaTx;H)-%ly=B`T)vDSLKrQ-JCrxviC5VhPMFXb@r=GE_ z92=r4tBt`Al@d)p2aC2RUdON$(i{Q7PA5XpBkY%Ld|W|+huQw>P%k^&k`Kf3cKyDO=x3ulx{cB+)w0{Q$WV$sq@vQ> zN1`0^e-<22P(4_n$l+1Xm4!To&+orPab$6W&zwrmW6a{e4+vvfFdr_PC5vu>&B%Tx zhUq{;N=TB{v3b`h4lZ#V!qJ(i1*9-$%_&gLtrhkxO-9NX)Qa%|QI~6w@*g$(*(iud zFpTE1%S#R5(o(mnnOm9=(E;69T8MunRpYhijApFI&q>5>CX(nxQWXvXmKpBwLW`U| z3yf#LWYSyU`Z;G&Sz?g*lytHI!*~6$fP`>)4!Xm6EG|j;cv}-tYRuZDZX?}csV#*UL+xNH~eFl-B-gS(0j@^Y#to$>p;TT2*Z zRvIYt+391+PX|a52se1nN!*aFRxX~nOc?OMRKv?{Oh2phe;<955QK&So(_uIn|jny6U9F zANjzzh%*WF|D)<17&Ggdt=;Yz9ox3;q+{FY*tTsu9oyC&+qP}nPQEaQAy?R6@DIS2MfmhPjnPqb2keE^)-S^lwf~BZOOBa8M=P-7 zh)@sN<>;9hA5IA@z!u^eC2Xq-Na@Kw!Yw%`#OFVmBw`=~_$_^k13VS@NB*vnb`F`P ziQ(^opsURFn%4nz1$vAAVfVu{ywuM&=VQccou{en_9qO#);({cva!tf5AYib&`(-G z3yc^GQp8_$gM2xi5i5x#vdy+PaHTggrtwcWRRZf9y(|9cGfFhKwojMU;y{)Q0}4mY z0@QFDcD7Z}s=^AqT4PCb9quVthGqyP8q zC%sBfc=&xQvUXxZTA9g|*(V6d$m=gS{Q7Y_A4bY2gd&wzji-jg21i+j>?WEqPZ#JF zQxfu@Nr*H1^1^qQ4S_0PhPpWEXom|qlrQQl75{>rxA4#Kg|Rjl2s1s~`a9502*QS& zM$MB|C^Ljl_>4lASI|?UjBiZm%kwn2Q7EW$xgbf3n=Yw#2Z2cS5)>K3gyBm8W$zF4 z2w~)3BqJzyfMLcDs_=#+Vul`XRUATe(Rv>z+hGIyUm=PLAi)36dZxpda|`6I1r~|K z3(pdbC1(T6Ev@repi%beHo8^);wkITEgq154OH8*xPXAUA_Jw0hC^ow zZp05TJcDms*t@Nn#{~Ad6IAo}LRW&txV?LXf!K_xuMOSDiwis2;BnjU3!d7>3^Gnr z(UGw|Kv>5U=F6d_X1bQRZO8-)lP;{0Iua?IW}3GKB~3>oh!mLODqjrFjm0AGuMtub z2SdCm1Im!IAK}PR%_Kc>3F22-dxa&%;&O4ia~#-tVST2kz#mdaIJ)h_;DNlYK8+N{ zDy(*`wNgDpLFZt^HW?KzvK0wq&^t==JB5mhk;F=zS+Fr?zkO=t7qMM-ep0ZCZZbDJ zxuKHbDzFT(a%|yNp0GzXLfyJm8Sn(-lounWP&k~vn{w!#(!J14549zfT!`;A46n;1 z<7j*_wvGVUhA`@O#R{t9wZs~pSzl>knG7lF0+VMI6oH0}!Zondaq2t$b}wgX=|BhP z^4QrYSOs&fKHvzlIf>4^Z;zG_pBrMli5_~_9(uXtEN3QAGLO?GM*dC`e&Gc8#C6r^ zG6Iznp}!Bc13ejlV>*}(GhMCNhwqpTQDN!Wfsv%uDJg~6P-M|yds`$QW(rRn`Rno zBqoxVxZd3=ZSMd{Paz`3&of0NL{d~5naty^NwluGaRp?pKn6v4ICz@t z!F)s70EO(-_o5fT@GI6KJXEd6C6p3NLwxH7@t^x|yw z+z4LtHPQu34|}^7|Bd6e2Civ$aug+2&4POIs2%LnMViKDG0?Dcy~l9BiWjZz5im1M zh^&fw-tExdeTTz@@cQ)U*as&v>ptDX%8lN8owOJr3@*29hrxNl7bVMyiElKc3IWLy zIF~_DA`eZ#G2SlX2Y? zTUoR>q*x0ND_&WYM?em~uCI zL$uUFwwa}_h*$#G7RD5+@_fwIl`EzWIh7p3ns{9f-m@{3eA{zz=ELyr5#coEOjM(| zZ2HMenj=NqI6>8a_n6)gC4rQR3Mq(WrrGD7)oe7lXReD^i1^p4$Kt_>$?nJwkt>0- z@CEN?fknNqS@vcPLNOu7KB@%FM2@JePm#!J|_wU_$WNQDur?}`sObPQ>Nga@Wt@K9@4ngGv4f~{sX-;#N^zQVkF!<6M*}EU? z&Z0gZa@q3j(?{a2^t8kf*%#yRuNOv>ht3O5$g2A_i;<#tF?!|x4Eg4X9Z#4{~7DCG>?H2&tMN)3`i-!mi-pGpzvDU8^7*tcWAUiqiU4a48B<(&3 z*_(tg%TS5v7_(zMr4nl1&TY_)1B1vxhO1R4T zH{Ta!T&#I?$t<`P$6S!g9*xkNr;s!8;Rqjes2at$6-Eqcz^ofF4jWUjD~O1}|9n;K znsRuq(D#YAL<2GGjZ1(+6=7vbc)e&!z$uq8z0r82t_+GpJhU$VhIj`8Q+MBwE&9f9fCj5Ha89tj2Z)cd7352G{K>l{#yB|&6Rvpr#;MkE04MuL^h zJ+VeasIdRmZ9qUqg?%lz3H{+4?J10C+`$G5D9n8}fJHQq@H4m-M=X4?f3OnduyHUC zb8C%AE_Co=`fy;vCVIzGh4nyuWMRYITIyY7#1zL7|B45U*MZGc*QQ2jWH+Pva<(RVs-qr5Q~fpeyNMQ;O@GT02HeUMpr$*G}t8!R805`ey5 z+EuXY2V=P*zk8xcDVAd7x{+H;PqrP2nw$MYIGVy75OTa?_V zk7~VA$oa$k!YH2{ONG!^R3Y>>X@@BnTSafs70D9UPnmZZ?=M;)KI)EUNgLr5^c+0} zr5{T$lToB&h<=n{#jqE9$oX6WSeo^o7dP0*q;KT~GPzAel#TX&1M5CXLsd6nOv39fBo+h4Tm z>^+vqcV-|;)3`G*skU%_-!VU{J%5?&PslJ>urL!*YR9yqu&#RpCO%8d&pYuJSgIC% zP?7pE)-)t{$mPS8<@5Qi8L7@&!rcJ&d8|8Fle`o*8(ACGE{9r%4EZN!zIZ{@USPi~ z_*{GurTIh9z!DB9`SQbS88tyC6-R@S+}Yv{*-Q*3RZOxerpEG$CL;mzl+3W}G6HK% zm;4ofjx-M)XRHoQ;IKr}k?Ih|#LT7qaj7b}4eOpf$JlGQxj6@<>KsTo!-TkES{NrI zaK(HWW*k1ATZxyaqcj`7iWxge;IOQQdZgf~YETE5is||pYCU2kKuAvnooRT)P6%dz z;<4Nj6MAp@psa2~@E{8ry-(!(7U=|sJveamqgPpvK=x-D-)Ok`5^9@p`tPKBegEK) z@aHqXGS{ag36M0KzI{y!Rb5Pp)sVEVs|lt?c{`<^?#aY9kJA^*tESwQVgwpc4Th(~ zagIzj>FF3hT=}7xVio!JV2!Jv5*Uj)d2@%W!E?Ea7sIVbY=sV|+W618K9OAZhbk(>RX?t&R33=!C%Gz~WCtUakiH$)JJ`j&z_P zm+&7{TS>{X2Yre>our~t=A5`@={@051B!lm7AN7Xct*On%Qm{3l@#k9zXb8)_h}?? ziEbN#MLuVe>aI_EP9vsv*gP;M*Dt^gil9y(&Lf=vKI*nM1X}}8L>fyW_xyhVkfwU) z0L%pkgG9|C9n|C`+`K&-uZinZEl3Lupy62N$2zNCKX>(Ub2pQj5KKqFsvLc*m!Q`* zzleAjAb)c&L!1`bisu7ZEoZ7?x^waR{`N{Aa;@d*$};aB1DK%_#0Kf~5=I-Q->b1X z&7+v-yAocJTVmMqnifPlId3rDLZeC6f(gHe=)XAe$9xaw96^QiNpyG56YjN)#5DK) zom>Qg{Y7C8uopQ!7eBUHMY@D()3*oScGciiV0#E+`LGjS!-BKqEo_t=Gou99U)A@tJ*%+ZT&zZ&PbZ)pL$D~UsF1kPP{?)rWN8peRi<8yRB>`L-RL;s57 z)Zz~Un*`{=&?Zvw&aVR`mRVaq4s203_LsBavWy$@kBXhu2w}nfsx#0`Yx(#xM=$OP zWWqtpouU)TU5b8dO~24su6QdPT5ViB8yUq9Ro5)4Ai4K+RE22$d=P zpCpY1*CF=k)_YqJqIBWga6Ue|2;MqO=*+Io`51&7_%#G#(dk~=7&8NDgScr|X)#|_ z0eIBH#^$JGlXg7C?@_h+blnC|UU_H%0~4lukH9ojXPyyr!iDe4Oy6D_6jKx{SW($g z)2tRZi4;G~teWo#n{43YJ-^Ev3}WjXP*xPKMJI_ouI`@Hg-_7~e%>3?KC;{k3t(nX zzuie7FY@5W&saKutkmP0-W4u0k|gu;_SOiJ8^+RAm*gq;*8GZ*skC9hO`s>%Yeio3 zC=s!g?|wqin&mWJIu{-Bdrh_{o|v`i9WTMy#ofwXuAs!wZlq6JUe8>$q*0zFaTW9G zFuDDNJBZS3d4lp}5+1VdBsbOp65^yk`D8nlhhMo=E;B_>cjPIH^@7P79gr@JaCvF~ z;qaO4o(?_4zu*(QBWs%RbjkdDqu_f6CL4+rm6{y7-b56cgfjX530Eeb`ob1%+Q_>% zvMIlAG0+Lq;?1)8fD%PL7u4&vcO)bW*VbgsQ$Ks1rqrwEu~2K{=tLa2rBbxk_7GLD zAlF_yXhJl9clh2n0=TRW`Z_yyV_5Z2ruKSJq;LNeK}KD(!if1}c5a%^fC-n(N&9?Ux}mY|36Z0RGBX?sQ;f9d@7M4w}7wKgu+O6yc7!H zmHHZQ;D_j?syq2yRu{uqL+<10A}*&$Z8Sx-f>089^^X{Q-y-1KU%p~UJ|M2Se_Ajb zC6bAiNbdc&)kaV%r+EsK#9e_>S?@_ir)j$zY0yQr~*6Vs&S5?G2qG z=Ft_3YniGn@Ws)*52ON}mWZJpgFP%>{|F-6^DFbLE8k7Ipaw#!u zP?8xKZB;(ARydz>L8bo3sI3-a1Xov;AZdrhVm3X{f|Qs6j6=#pI+%;gAMP~cvj9$HQn=HaPAPk;sZ%HywiFewj0KT4)agw3*9h( z+?l%{b|!XS@1P^!_Q+hbab(hd{*PcdIP7}Cn55r6+*$CKIy-KbmS$e{98f)>vJL79 z=4-O0!O#2OIJ_`-m|6u^vY5~f+3}m0iXs{Y4pfpU&YLh1jSHiCd6C)W4Md#I?7h|` zP0ui|n-3#ifei~)zwK^?uLjxZN2_Rx`U@;9@$Jt72IjE#%wtwF9>vNBr~~iXe*I># zrafPJ7PMRd2CvA_9SFsj;R+Fl887MNJ)Mvo2o(;HJ3E(Zme;q9i>4w?e(ays%Nk9Q z`_mM(B&U(v7{z>B=2$1-P&6&@6WR?uH9XoT)RGEk-7}G=ny}#}N~CFr>7OX#mj|!t zE({iYaAGT3TEaY(>Pss*4Cppi&fO?Q@&ur4-7hSijhli!1j{P#DRv?+JE=W3FQ7kR zg#A}{Eu<1)*SD(Swt>ngGM_ob&eV=uNkr8Qn--i3{fJ-ZO$TE@beeWpozWte^L?>>*N{dPntwp( zT^>oEvjh{?Gje(Ao5@9IIr~>PzIQ4v_l|7dAZ=}EzdOa$jZ91i4;5`)2_?wDuW@XA z(J-7lIHq4N>lqyFrbtL#?Nmt2wybx}YPmfh5947~S>s^=H-P&prY3M!J%5qUe(p&L zBL!5?-X*$Nc9vmmy7-j9t2PEQxIucUN65od6X_J3EgJ$fKC_YCRWO&+fpxLiwi$7s zB+uJuM1?f&Y;e^qJ#Bh3sl!q4@kyDBVZU7hMNeC197!{t{H@lJ%-`&vSWF(pR{D(L z*-TTPm_kmVL(oPQeB(A1o~mxlZg?fJG&LmuNS<)vryGOe%&2xl+G0s%v5GpO?Ycf} zBQ1raVZIAiu1FwK*&y}L$ehi}Vs#18s+*`Qmg!(D#s6mb=Bz5V9np7OwOX-+u!F=q+!ksRaeWraQ?Vm{dS23R;1=3Sc=&@6@9 zJIR3kb$)SN5YEG*SxJmb;WIwa&~?>2eMQts0O^j79yQQ`%nkThOLxluv5GcVN2> z&06w*xM5ieIj8st<~6u-j)fFZsXo^NW$zOl<~Ig>%PAJsmH98k+{WYot%di{i37&8 z{`-8&;`!S-dU%}`d}jxg{+J0A1_#D<5efyQi7@Oj0$|m;AE$|k5_~?Zk8G4MeXxn@ z43JK*b>h`W8WH4qZyFDUY#rqg&>wf*~jQHeg|U5`oll|T8{{WcUEyT!4@iy z%xd8zI2Ua_?Op?!?6U$)yH8*Sj|cuC@Q%^Ds;!w?q$8?C6W0HMlPko8qt4|oW}*hy zz}cFhTE$_-K}N{I9PA1uN?4Aw?>ZAy+7u(uhUSWEm%d6B{e+i_lRF1Rh_4TGSM{e& zrRVg2ap!l9Nh0v~uANYYc4*2qSv>z*Q-H%)ob8RXzsiid))^DnjWA;Mi9&YJF-Iv; z{|ei+?t&}?bXY*6hp5sNXGFgc@Uqk=k~ZlP!Z!o-@&OBmuHgO&gNU|0y_k;uq40)a z+VyUMzNHa9$Ha;s0dR~A13#5b6ZPAwRQ4rH?-H~?XmASQMrX7FPWSo1;;#2m$>l&+ z7Esw6q!iya6yJj4&qNA9c>UleK3eHr<-n6AqKHK@LrT9)f&MnK-`kDX-4*^nT*z6n z>VpLI+ER8+?D-)FZ@O54@y);lQ(^r6)f)T{dGl)u{6V#^ynC@qxSoynL;j8<)Kk*8 z6E}5fKVU*BXAhX5YN0$&<^%xNB4Be(Tk_V>L0ReJ_OV-@qOi0J+zh7eZ_oqzi^Wms zil-e_Sfha*Dx%{wZ|1%Hwt{YUYjeP4*m52zwMUtObtC;AsRdgbR!0ssbICE;Godr6 z@gE$K1m-6}z3+AG@SfJ2JzFztYqucgig{x17b2YJeqZAWVLbJfGX&W*h0x^S-+QHU zb(LG%e-v_G2$Fin8?uv=NeqJOjZX)JdF_TJ(CKXO3-7el@41azxOC$^y$sr_dY)ur zCfk95qk+jgeL8ZsxFckD4qV5s6iDZ(RY^;=zuJP$^8(ZVYl7>^J8=H#N8EJK_lMdY z67u^1;dXY?K%xG$y+#qnYH1^Bd~og$`mU+iQIzh65ojT1-rRsoZD~D~P800vBv;h@ zE>()wlJ=~Od|Nk8o5B2MX4;8jMsE3@rU02POnh8!j__!~o=6RjkH7V;;Z*M6kU?Oe zSiLgeP{%`ne1yGqI5{x5=1unrNk~L{;mxf71OS_v zsz=SBOc?C1CUnEQ`^icw)G~X6?%T4*d1n!q>BEW~Y&bEth{uQPR`v76>7|_= zC_-~Fwt|HtEt0+!GdpF4%(}*7+s+ zD8Ip#^+py>mijnTvpL$5i5O3Ad!?ZNv><)q0)3;mvGq1g$-38FM|p~rys?y>QD`QN zR@26~TlFHa+`9&nlmtgwihzqV&Oh$;y45R`4fj|3Fu;4%GU{navfXhfbarAflp7oMm4eDyL% z_QE2qi53l}|I-Z3&yso+nz9@zrCo~5*XOXsBBrlkTQcDlneL<12`Ubk^KfRwbDt^Y1Uc#@ zyE15#F0Nk`x9VQ1i1!I!e@2Z%JMiNC)uq;OSShekJ)(G=Y5heZFuOA+qi5j$n#BFc zAWiqrDG&Ckw*R(pvThRt)QSi1Q2hZ_4O0;JrsiFxMTy7x0lMKpQN1dxo_*)|$6z_gOFY3}gA2~DGB4o>>S79WGM=pRQs z(P)p^$M5#{+Ep<@rHTJoJO{69`M+3t@7x{|k|3!bd4&Y2)SFhBaUX&2^ehW6tE(0K zOjf(+a7B+u<0P_mi9BSOTnoFq8`PK3Fv$>`5MBJ6OAISMG*UlSL>{5Ly|)Kuwc40e z%>q`KY|@Rh19h~2c7lnX{_JN|n@7toa)0D)RJC*ikt;t>CB28lb#d=!04lL3oH@ z;~3JvKUk%QE3=Da+IWFN zynks*r2W}iK?Rkc2~A+791$@ON3EbH-&DX5)@%bk)L9LIL`|lj39|2#V8MlY5SBuj zKbt|jpcV%fW1h3$6NeUbvl0$A?c67Pzz7y(2(xbo;7pgfp$Kg{cMp&J(G%7K$>@B> z_7*?yJLlNHKcA`9v^ciktAaG>`sSi0dlW$sP_43@91mc<3pydq^r=T z>U5|0kU|@7l(f7r4f)=tgRCD}3uzV!kv^`ucHcXDrPx`enK$8;B&Z|>Q*ZGkM6=E+?mxt&L~3Si>Sf&Q|^>GxD4sAD@$v1X%x%&fGw!_@l9FZWnV>$CO(%BO_o z!0$J-BYqSVQg@p0co{+Bv-dM0Qj+NY#w27X{-TQUlu5XO;nuUr&?9+4S1Z*oxWH^g zYQnv`QTWtTDu5{nqtaGyx7O_4QhQC!*Q21rqkO})^o?XCBeLL-p)u&F8!!rBC&^IrGz(R0a$MQ9(-|RnOj?QD*nJwcXonu7)K-~ zpwkLQAkk3Y^xE+cJ&d)e$^V-_pjoJcpl`UPmdjGX%g2NQ@IyHfFS(4aHyZyG*+%)VJAjWS(Ua;AmkqVh$1 z;~B9Y(NJ98y;KYQAqjb<(jnR2ex$KDc&+~iZ+-#0%Oj4U6a%QNyZVfC-*j#iJfjJ< z4V-9F#FfF->YZV($SPSQ@{rw@8B=KZPim|EFpp-%vakL|TdS0RkfQkSB87}@Gxk%? zH6o`c)ZXMqgVLCfkocW>`kz#XSNZN!b}oIW*i}0}b&Bne%O6!2T`JQspLMN1nbG13 zNz6BSeNieVlvk}X!p38j=Zm(ehrui#s_0iZ9&?CUG6C+ly%Rkb(ka5xROHbE!4F5e z3!@PrV~n)9DM*xO(sn#Gj!t?;g)!&#{1C0;8gvVJ2xoOeC97I{PsMDue;d}M+Cnpn z>$VT(QuMDS7qf3M^R2p%%OS+`EAQ+hc>mBr-N~LYeNUA*Xx(2*34SD$kJ~>G+(TCs z2UbUMake4j8UQlXX$=)yFd=>eGMKagD4E(W?fl`4KcPIM1AwYg%63rn01Nt~U2;$Wud9jY~*d&F>3tfba0))W9qDtdVn zFSSPo+U7v|#hNYmL7G?8i1_df?(%NzYHO1ps1H{sUiAL3_6d?N3fEsCmPoZ#XVJUe*ux#orT0dA22G(D{SpmA>GWmHM8ihc9co^;&N2FD8g)80Xm7{O zxw!ylCLKi`s(5FPzPd-)ySy5-Xn@n87mu$ez1+mty&OYogC3!C)o5Dzvhdwz6^7-S zzgH3?$czQbN4jZIt4?w7bQCuD6+amZhGTy)% z_x-R3&d7wV1#54f{>F3U*iEs$A!-%_ieA%#94qJNFc-0=bQ_#g7-uolHPw3och+iv z18H#Nm!(jr6$2$pjYGQ;C+gcAi|#VEM;~UCF1R8zv`+GB1_Xe{xPWUA^AG^1jQtA` zy^gA#-!GjOL5n?IC;w8$6V31SY7ieVJ#JcW>uW-_=V+^JW*)T`#Tl9)g{I04QfxSDZf&N z1;9%d9J4THT|9b58NY~f#_f>Vl3W)OS%6}D>AMLbaGH) z52dV~=ey#5Nz-B8ZZe{D{0~{lK_vRE0qEH>_qQeg+xV!Q1~~a-`Wk;kHjfPl`8aDBR7K88!F$5ll;?#$Q&x2>7G>XU%5Y zPe{vEK;=h`LpeoR6dq_tp#w!y8tpGlg^b}b0%A&EuZ z9@_lk$WXmQ#Phu2e6g1aGu~0q{8bU<^j|sMulmvj&iB*cX5Ozog~r;GRrjd!aC+LH z^!6>Ogx}Ba44{h$WBU}#=Wo3xm#*LHHvYs9L(g+3Xf$tfzc-gZBQUb$S6F_@7j*45 z+JT?{2&^_CfedNs5AZogYI3RvfB53l*(8IT{9t6(v&bs$BZm;0lHw_d@C zR(JUHu4sj5y^rf*O~xa)#Bp?_kUeMR^nvB=^qRI@{GBIUM98Uadn$(&>E_}ZWjcTnLyzpyW4y}? znLS&(r5()_0h?2^$LP4(@v9*oZg0>IdQ`Fv*?zTu>XXRyax#q+A)B+)6t&%NPvn4z3U59 zdh=~S^H};{ey0=h1Ja#TgjkECx7N!ml>9tF90oWP*LWNB%%Z^jkcQR2Dwox4Qln?F zi|G6v1zh_-g3{W?YV}m)y+o&8ir%{bzP;9wCEJT8pv;xi@4~doHyd_WgKPa}!`HY! zLgJJHuyKSKUHGzOIcf5I-_?=RA3z6`9MArlLjXKXH%B-6qm^`@JbvJ5_>S&Or*g~k zo6bY4=50(H8hiB?VxF&0AozqebiG9~ht~b=?codb#ozxB?1tX>R|~2n0%Cf`Y=~lA z@d|wcdqLjo519A;NS=$UcPG$Sf$a-mX&`5w(FatR5))BiG)#qvbx6m70` z1Ew~u<2BMi#2OyyxNeX+Ad!p8kBNKTn*~wxe-B+4MFnnc5`7DHpKyCnTM_>&FfZAM zsL?Ej_Rm@H!D+pB=${K(Ldfnm(BHzf=9|%ZbXr$u2W?uk=}S1Q+=QpcLg$iu&MB}& zK8(|8SXuKt*OW9RYudN^+Kg4sebE&CT{Gfw77GRP@34nYB#3<@d(HH`0(L{HU{aa` zP|_28<*uWGF-565C*&>@6NMrS8YKpXAaX8DS;Q=Up%3K!?4AX>V1oBY#qI)zQ`b3X zdRZMInk?aUr7$Md&|b@+8i{okbHaE*1K)F7Vv$$_@EhgWVmL_!@YAGkb{lUsOr2}B zyLM)4y-LYh^ovdc;FM!w2~k-9Pds>}&{6LiFKs7_{8IdS>n*Lzi1Jy_v0Wf8kezvo?TXh}_gB*N#^W>WW%qw~j?n11nJDJ5ML(|>0Hz!NtL ziCIp_2uufw!GkD!6ujP=TbPm1(5)g$nmtr{HYgXCQ9{7v+9buAhGw4EqKPvJo+GMX zx?E;nOpa$-I=fw7C68x%WFK)Ky-&Ga@;GE2XhC3wF3M*elqfpmwv@oh8{A937exNn zRcAU&6zZf$Lih>HV0^?g%9HWze_TTxjCY6Im3o!8Wh$%ipf{6Qr?n|yzmKs18gMnh z>UV7D@xx?qSbPr-+GM%i8&oyAq$z8$%CRFXeP+y7|H5Xt@J;a$&@W4IM^^)lgR>72O1HmT$ zD{F=@{9VlF*e4)Mb1dxrcqha#)NZd{U<#q;uHxxo&I0p`0gHPN{mbi4_c*ZD`Tk0X_vM!07422uO; zyU~_p{0FWs_p7oqv;BN8U}*r+ZeS)O2s#iQJW#ujs#~yyV&9JW2kGF;D)b5-wU($} z53>&-Q9k~;6*t9m+eQ!kmAL1Kw!l$Qr#m0ksBW7{c>W>ZvuY`pzJu-bcI#v+Zwsmb zo3lX1C{ea+_(Si2>(__oeBqmu?gC%NEFl7e#9f0yds8E>PSfjhWviUGGk4>8b+qpf zlN79Latj9Z9ZyV32^1&q3pJE#ZmX@A&;!NLRBAei+%LKZG7yM%v;CGoq-lffGa#F@ zs~<<~`m&`V2vCYO0E_STb4Ctqlm6*fy3wW6^FZxZ2yWw5WvHw3>D znHAD_EDv3=DQ+QQ9Mz-DX|%AfK@`WI90#jft!|z|BGeYpd`=ooj=2*}o?N+&L1>3X zP{7baelbO%PNLk=kUdg5;7M5oQWHt3C%0Gm zt=#J8zfM;&)ryZA$ER1&WvhG0h0N!)Fm63CL{Wb&toSZ=lDF<&l}yP(-dZqJpZVwN zcosCOBDu$r=i^JShig_}k%E;)L5$p=9r!E{2jCO-^$+IkuJpkHN9# zh^2TdD;Z}NYQKR3pAYIERc12)8rcp9FBL~r(L?0ER@fC>A?{Y226D{uXNthSvD1v&Jzf_;av&fOSolld#wICL4{p(`3clQ=cCM|AYJ*ggx`fi4iA+L zw8gQR{|bie!&I#`kO!%1M+07s!W|Gj%&EVH3k*8aRnns6K!%IG4U|4`o-b~yV+%siLd8IMj-PY{U_41eBMd1;oxRv#6@&oM12s`} zqeF`KeQ>ylElP!kJ!*%`fNoelFbrtX46joF0Nq~PLb5?Q^W#dWF^*SA5r4Pu<`PYH z8_Og0)qps7O!=v-znZ@LNz>D!L2V0{A~OqjD#C@Z{3e}H^XP%bh$!vR4Cx5+?B47) zz>=-J$H*)A(;;8Ullko#L3+ZWg#IV=5KZq3LAq_`H&GDeD*sh;ZJX-EN>+>JOiUZ3 zc@eklNeAoTwJAShav4=~O!u1z=RThjXAM=hC$`80zU2Hq|EFw z`=3begixX+gG)SOq%T1u`F#~mz@yRYJ#Bm62;k55+t4c-_ERW_rgC-X`i;PgMAQk< z_kOQo>tZVyL(5iceu_Mv)rDwMac-8CVysconiqga`cMN#t=Ut1LPT7wv!F1axlVAz zpKO<@xZcgOA#LgkD4Jke<5VN!BSAT0RIsh+GaZLCrCrBEo5z8&_ndtuzBW(2AB{M< zITBuq^ISwt5CDU4STnrPnz=Y!P%umDJt5`eEVF8ggX#*fV}BMi&$B|ftik|-=2bZ0 z0Y8GaAqXMeA8jr(e=pCq*5pz<`Xh7;D(xsuRz>iBGyMi^dA;T#6=Sz4I%P4qGttzf8-u-tsmZBfQMz8zdMF{ z8pERJFl9ZY<@woS!8HGL&)i(JhRk15G$2tt=cpH`F8!C+u#RxO-7Z24WFxmP^l^od ztHmP|o5xLgl>aZM44yP+n8q!s7QAK#SLKSIbJ^k@*b}1r^ zQGz7Vg-#wY5$sw8(_{o`m~S?`Z#6UgNheV1S+a0vftzKkB;DPT| zyZ}ktk#tOoYC*;6(Faxn&L!b>+pc|;e@>Pn8DIdMTc|JY`QT2v62mYhpaXw1YLjSe zNd)$oqng!;zT>Q1N2B;`I)bw0PuSL=+a|3G2}ehka`UI|*_*?W^kICqF^4O6q68ey zH2AsXIg^NMDR=3nSDe?@aeq zr`YbgL#8CD6OzcYcpJ^#FUfh>^Mm2mx#09*oGjQSHJIa5)@8Ou{dDO%HjXI=7ic|Y z>dp--94lBx$!wkP(ktBjon02qOhWzV(-4W7oQ_ZPBO@!ErJmgGh<6f)G{2|Huc8%) z<~k!rcd!pAP$N3}_M-jFEW~Ka1?{2OogAocVy=rQLW^frYZ-;G>iDA`;Olytezqvc!#!zB(5tm^d!5SXzV4Yy_E!o z_K8OvC&@3Ip)<`CL+8aj)ve0(jT1GSn>VJK3CE?ZUc(mV7^4Of0AdfA-@FLBQmx~d*qSD;zzLZN{QiGBQi39wI)S$wdc2(hv;z57I6dD z*N|WVzjRK?&Dl^wI50c+*4kf?MCL7FhG3iETV7qR&)S;-YUkwUa2 z9Lx0|_~ES{`5ww~y1P)u5BSwCNRSqdWk;}KHkjFH@=6Cqwk$F9ldvS=*fDNnGd^e>3>==la4`+4DXS|Z-C0@YauTTfV+KX75lh%<`9VG7VkJNpI ze61})QPs`6w*pWSu$lYZ2O~$%FLvy$(0cQg<4|cI$aj+%0d_Th`fFgjVZr%kpC*n{ zsFjNz?zj08Ogx$bJ4XGa)9cJ5`IN#F7Wf8hq-jejvJuaSu@%tzee1J`FlLjRqm`>P zN+%)WKR?iCgk+S3#w@-RIP+M7dwZUmj7?k!GqPoixg(YhlL~t}D?vJA0y*1x%ugk6 zDo86o$VcPp65B| z{N8`7x~uzBy?fVQ*ZQt&TUKHCN;HrJ#Wb3r9-Br@5;>glq+^%#Z9fvvXL8kv>`$eo zYsk~06j}RkPp1T1$?ENoxNW-&J;5z?Bj`c2=|PBjLegO*OlD^huJN#;%b+p!nQe#0 z?sTiMj|ELcQ-<}4l#OCO7fgA?ax^ikt1Qn^Uv>(2>T=%*@0rg3(Glcj{UoVO0-s2z~lXiU9}V zAsdXOsjJHJmukTWcQ!>a#KSFh2+NdQyaDIIN+<9!xA5zLgQ76&u%u`Y0tc>(O@@r$@4M+7zJFepi4aNvdUnuI<|t-1RL<^uF^utKJ&Uc zd1~jkS!TLbmZ6t-{9>(uRz&6(Gg<*9Bi3nQv&R}S(b&_6VW%Og0u{@h`M#rc)2}gX zm6w#`d9?l$5pEHi*wcpa8{=!i;!(D*)az}KMb#0>{O4tVPXVT7KX&&? zaMuOOzwiI&gnvmmU|P+lY>Q<3KZg$k_(+_uXKKghMQrJ+4naN=tnScUV(f+PYBfij z+%FT1w$-ObHY0LZjF;#x)Gx1zS3*BeMAZM@J$5gIF|TLUfTn>Xzc%6%gSx-DVVZxgnaCZM6q5#@OUNKb!ZDHuI~F{TB`B zduDGRs&*Bc^z$W&ra|KHf;D{xXR4&<7x(Nk5e3a-XKLn_A=^bBSj+^)u{ZBUwC_OX z^EW9a_=!2p611v0=9TJ?J@goIe8O}hs}^hxGOOExbR}@q>6N56fi4EIcoJv9@HVc` z0#|w>?y~E>g3>}SU6pP&F}N3v6f$@T_#y)E4+gHZ%8$&Akrl9k{DzQCGlG^^60&fF*_fkHhq`m` zPq&rV0Lkm+`HWy7d*w3RnJW!wd_3V2`LM8(7I`X7H)1JaBR1?Z@nx}(;e_sPg$_fH z6^+yOEi$ix`)d1m)2ZwX=5BDcWttyOC+Owen&`Br?uOV6{lVS`#L<_=2F(UvQKIpM zGIP@>0!NAGn3AM3RD{L2hC-Pa$y>!4izHrOrx<}1wBXvCZABp}gO)Lv!1yOt=6==03_sb&*n zx88u_dF-c09lF!l4W6g5%kKj!^yYW6_UO@isZUUlR(%63wO9;1v=AOCLv{UKJDY(w zmqxcx;xK4ahP)-XPE|XCaMf#5EmJ57bW!4yrG(|;v013dV=TH6y*5~oM+bb1Wxo01 zVwjDXLVX>g*N%)>BPeFSKA`JDTaYP`hNKWKGRAIzrgX_aLfjt7dmO@9 z5mHG=kIsxBnRW6IOAr1r$=kK|XmqNE;!kza4{_hW=-ysN_s-m-^43M3+;#e2eZTKq z9@_m#s*S*u*JOrlqfq28?ak&*R7F-D7kkDa68bU;qn>uh`mfYeW`}=3s^PNw8eGQe z#WIt#vT&CZSg+pPe0F`iUcFePsrfCI8?fw&YpqqyQ5|nn zt5(1}j3v3EDH#xH9AL0tISO`jAt6wv6F(J>tuIWAm#XvpJUZ(Y7T=R8NPtH-mdTJ~ zjfjsDB?Ah3^GY{-f`^*oa{8scmES(0#%r03jDqvKHRRJ8Vz0LUXRp}$y_?pRo>dxT z-t30{Lj13M(Z{hd0O6POfnJ+-5o(mL`vlTjpi!Q=VjJA@)aG>qv&SMYQkJ;23v1L! z^A(5bdM(IsR#Yv+2T@{Qa0y=FWF+8vNktPH50|2HsC~Pig~KS3>Rv5mnhkF%^Bh%Q zOU`vnE6J}OQei1Oz#*7(jm|fEn7;vGX#>-L7Nnl(cVwi)6w3%@(vSTxW7A9=mkjFxe_+MGwdfMxR6r2o2ygU8;s>)uZMZDb${XxVN z&Mev*n|Js2@8?en_Xd4+p?ggsdH)D>eY zRg7oTo?D7}4tK@nm(_a1pEn~=S&3gbec#US?h-rQ+FO9HGM&CU|I&n>j3k{4!S-bD zwwjmr{$c#6;!-IY+X-`4L-;vY%>w2sq3aPSeAOwagg|oaxA;RM$FMpfI34a=%%gyw z(CwOh{f$LnpMbZ;*{wQze_CKcLA-MkW|IZX*$x{{^a2&Cc85PYWZ8MZY^}tDyPpQ&u8A$;%`z7H?W9Cphbq4g~ z*}X|L3Db;6s#qM}NQ2hoHmMp)--J8Ao&s8mAI6j=TJhk1%2!1BltQRu?S!Xi!@V;x zk1N$6DISz*+FAO+&N!X4!KdrT=hoZ4JJYdQU>KOFgna3W=+X6uUV+TUwg2| z)tFScOvKS&TvQV=RaYXox?J?+2+LgBD}J*G0j}z1L||}4S*v4=t0YHi;OFO*lw>M& zH=}CGo@%vu6c*V}&sq<&^Px?+rZz~Bd@8arp&{6W{j0`=t|myw_rs%ye`tq{Lg+RJ z*tzks8?oxSDylv%%`+M08Elf+C#T2sCsad8j$#chHHICC?C;)hgAzvoD=4Um|4FNJ z^c!7<7>jt$Fp?TJcky=xp5iR-)5GS~_M`v&Tt1r?WBH5Z@A zlUD}uS2WAve#~_KBbuklZE}Jh1u^&54)rGQ1IUlhVd=<3#g{pdWHhv3_xz@0rT)l{ z>jOj`$~p^I;jO7!@JE%k<}sh%-ebgjaJo} zfE$yr^q(z-n4L*2z}~ozT!f3~1?-&?IMK2U-^pZ46*_$5)lx*?ubBrW7y(OSR8hWX zSXFxuIy-6XTl_h=!GQI^AoTdibl0xO{@HE&Z>faN^($jNxHs{_$mP)0L?pW$1_4iC z2=!BXW7K2Xx7fd4N%b_^rH{;~G1lSJyCtgv8jkj?+%!t_eXQSGzaV3C3+*`3sa@Xw z)un4yE$LYU81#-zRw_?DQalix`!2DL>Fk;VIF1_$S2tGJeUD2D^(NFZ8tUDdI>)5& zSlNup)fg__bqEWz{HS*XX{JS-dIRt`)6!jeXs4-7X!UhfiGwgoX8FVX>LuixHWG+{OB;Dz^C5 z+s39Gj#p+YkNy5~R%9)uz@({Bpp*8VVR{ocME}p}1m!BJx2k=P=yzS#z{-rU1b;i2TV{(J25oW@MGGJS9NxA?RogaiZLD#ev`H}(ygwwn~6A);Pf8(9>2!5~00{uP6ORR}v#7oq#4I#8wie+A{| zNm*#1btwOmdEkQ4|NU}5g3B>PJ(&&0kW6MkN56lrL&pPLFX253qb&e^UM<-^=U>0t^9Z4gHGr;5KcG({0Fa(ZV#`uY)%a z{|?i2NgL_rMZY5`Uo7)G4H89MDJC$oVXU=j0k^K(Epp%+nP#D~00vsY@LXAPW4mY* z^OQ#08HnkXQ*G7fwC1hf6NHhx=1a`?QvkOK_()^NxSF3fZ7FMmoLDvv_Co_Y*fY;_ zQ0i!;^;nD)I{U6E^xN-Fn0&VBkkT}bjXF$W|_{ja_bf>Vk28E30CFBc_!ZC;SJt_%OM^0gc!O-dO!F%vlB$s_j zyxnpKQk-+e-ET1D}iU1rEWB3P&V6@Kl@n$0>mAP#qvl%FWfA zy`|J~$f5l}y$h@SD(*5c4o7X` zus^!wNY{04+Y$&4O5iG=Ln?wXpcoOiFG`bYO_zK|0{G0cGP9-toBq`oGTAVsNx1B` zfw70i$f7c(#3+Svkmac{er@dL-SrXrR^IvsKCRzTp();hFUVa)Gld_MbDZ0+Q%5DV2 zYENsY2v@m2w(AMVb_It<1FwjcLi{)$5-SP#kUf0*^DGFiRMZ$?9;&axgs%!{`bW3c z<t)#V-I%bh_GB0eD+`w!gF};Bo_gr>(#%@-34Z+vV#%U^GsxRI= zbR{$#H;coS>3O&^1w-UZ)1Iitt!Q-YnRe|M*(Na^X~s`qdQ|NxmU_q|{B(+aXy-ol z?k%H&T%e5Q=94F)Qftt0NS56O9#N0ayg?xv-*YeV2Yl2Xcj_(C*QKcb2~A!@GizHk z#6*!qZDWWwB|t2lEGFKmDgC$Voj^p!k5|;~P_8%Zo*qYfi6P~eFXA~)16gNOwWkYq z%6LORh*EdOF0yN4YSnn)*Lp;HIK5 z7IhZEH+jSFl~~5Mk7NUUr0B{k%sojLUrZkHHG|!!Q_PO^(`i3!W|&aC-hmGK z6*Wj0Np@y*2C@3NcRG0)LYv47w(E;An7ehGz%%5t{xxFB(QTQ-_x2&5{EX#@*Zglb zjN*G0N3$M@KXTf?{&Ewjikod?{Q9q7vsbyPx#7_B-@OiD_=Jsco76q^_07Ix~gW%u>ZTx8~o960B@ zNASG6V%4&j38XYRMXYGvZ+OQx?~rke(RybqvzO_2%m*H<@@0M3&Y&J;lgg@d9~6Y- zjkw2*IZfkzzpir19O*Yj2ZS&WVl<_0(#Wl|Sr*fl>b7XQ?x4f>-hMogww3%c zmKba>-R2Tv_mT9j_B*{G8q$RAA@-%{2<6ynf_D?2$1y4j{u{LYgY6W2An~@BYj4x{=MNrb!$Mu@jPjK19os)Sv1QEu+Ye730jpQ{e^ftHW-xL2KV~bk?J)W^ zEXA>RN|hjT5-dC{e(>V_W`#P3#8AGtpbB^ukhh*AJ>1n3YivBFpk57pIXQ)BxtJST8u#tLxK^_Tp zneHV^*-#a*dv8mAMzPGzo%P@v+J=qtU)MPH3_xA2iQTrlpwyuP4st{eWcnQlbYcUH=YfJcHh9=3go}rWB-AtZvs*O@2lexO)OTVDfr4&Vh zp3HRkxq5=fSSU;EGOfJEw~A=25e^1!aj_)OY0kWkij-+r-w4AEAso}@de`O$ zZTgASA?Y@L#WB+wFAR(Ec9P>CkGR8hcb+mJVz=XV7PAvg72vHi4$QDwqr-agka@}_ z?-Z(*-E#!Pu#{}OjcArnP_$C-S!*XMk$F>?l5Feo^D^iN#_fEy2`^jA#m70g(=#>~ zA3mel@!XAmw1GVAA5vcPfI^<2nKsRZhXO0nPWo7WKZ&6zS8o8-VQP{(QgeI>^X2(- zPi}E?7{dyG)|b!AFxBYmdpo`s)sOPza(5p1>)U0YaHSKdW$t)vwcVplhs8)w7D(#J zQ5a^rlHb8k`mGSQwe3yFOyFVO$l!u7OxPqi4$@2LfY0JMXy5oTzs?0I(t?%p~Kz1lP+vC1)j!g35boKa!jV+8aRT|vQ| z1zuAW=N>*w+2z1 zXSOZuf#(^tZH#x3s%Y3Xnmp5*P~Xk> z4C8r#YvgYl`S~**!)Jz?-?8MC2pc-_nti2Xr)vQYn{8JTY?g71<9t%|BIfl^J3CfH zDf(+mc7CUKgX>u#(JO5$w_7*A`mW)|56yHt5+xdf9THi^p3EUw@b&bEDdzOyx_DUu zmesVc948LE%Pg(Z6rCyc?4APh6f*o@K^ZACs&|!R`+acKELXL&%)y&zu%?r44PM5- zp(b7a)Qx4pFRftOV%3c4*HN&rGwzlIopZX8Nny?~oL9Y!<5V~+uddsgb>KTtwIYlx zmL%;Rr^Z%Zb~CL~5&5v=uaNs9*n_DW{eR6VQ2`rf zxr>8KsLWrPJC#;>VOh_tc#$(w;1pnMgR6SG5wK6MtO;P0hpE@D)H$RH=s93k@*V1C zaOrnLo{n6;r53Zz{dkjr%lY{N%5%_ms1sdqX!x0YQGSg2V7k{A;_H%G{>3JJ0D6pF-0bGWuZ~YFuQ}bxSw{nrmfPK zU0G{TaKo(o)(i}sLV!X=&{4`f7gY>btK5+uGLmDxkk$8`fk0p0V_WLiJwdR5GkJ9E zv`MktdBqw0{H&`?LIUx)o<+Qmc*;!GnCMb~Qok6iXLrzrh(&23Y`y6c#IvezHKTf= zjs1`{2Kb)K<3G3dHxW0%nnI{kV+0q1+iW4wJWgoP5#>A%K6FSkJPx*MzJ88VbTA;a zVNZFc?#KTnRsrfW5MhhRJ;_971Gy(MPXAvW>p$Z6#hUnR$^Cs+5>xDU-SW0;&1n2! zMYvw}L}@88eM2URJ!EtK8}Bj5idF|TrlyVl1IEf}hm^6d(*Ch6itRQBVrQXw4f2gw z&Vj=VrfCoodYRDS*l>l=h)Mn@9ShLVe8PxZj1!Screg60vjRM_G{*K@`@@KP$am6h9k$*xe_5w6ond>m%V56Ar(S4}lMWuXVTK6x@!ViD2g zg0ryJEXCz!Z{{#GQmqkvkA}xlzlAY1sX6o0Mg(5;9t*ef&qYK%egQY}XMDv4$ zcBGhH6cIC0%11qjjnoLi!*QmoR2FKs8S&=Ne)!ln5TvJ%aXd9+pnbu{9?6nAD`jBY z$JFmLwRLcH!>w|D>^HK2As38mplMJSTb-2KI9Pd8nW4Nsu&UbKYTI{x2s03J})dS{$mmnly=aDVb9KP0XH z53jk5YjBy6A;gAP%7MZ)u#^Yz0p`=__X$&k#&S|L6YjooW9yptkj~p*MO+q}*l*-n zYvFsV&FzjfK4u#rK0TUGls=mEn9LnAz$tgQ8b8vw`_43h$sf5I5f5> zbQo;dCm3IJ&B4>@Nh#1KeSrDHp5%^?ZBq2ka^pZ&{TMoO0s$+(clMHff}5u5iV7v5 z*Zp8u+I*sBj=2j5$XmtiC}P8{>=! zGMTPN?jj+I4212cTjcNTU5rJfRMp>_Mlbjc5?W{(mWVXVoQn?A7|yztQZqT!We&KD zl5Re)cpHV|J(F57Gs7}}Fim~hC6Z7rZWbhR8iK&%*xf~n`)L1LfayZ;7afv*!Sg{w znZM2spuSs8@SMW}0^yjV91yWPjSq4^v*c6Z{=(Vn(X)Rqy|?y~g{Cmi2g2j(YJoKo zHgurrBywrBa^lF3fkrJRyd~x99Gu^p=q{4C!c#hIciNT`*4&%o-*`5)(3TeqBrfz- z*&*pMk3p*pCu`KEqtYpC_Ff)ny4gPj*bYVDdqgNGUFXF^^>Nbg}0p&^MqtT6X zFtt2XOKO~46&UnLt=|%N%5kG9m%ie-+{xxdFu<cM1PddDlH#c2W5Cp4fXVIWdlIX5l zHocnRK$ZOZgHO)-LcupEIfi*Y@C4oQ`W9O6Vjm$&e{gc~##$0w z%4a0JRBy#YF+IEWW$A7W4!^)D-w?D^vyIXGSydSqrK);3p2bPI#ywo=%Q!i->d(8u z&eXMJzNpy-ZZe*IgRsd}$@W>x3|K77V>+)`#Qn|s;<9If_(8DBbEuWx)*W?bNjAme zia9)8uEYhIAG-Q;Hbyh&x!H=`a zBoZ#6L)YO2mGyU@dA5bS`Q_w;K@M;6}t{rbnA%lt@DnTimBLW#;+f@xzmcY z=!`Axd=+w$xPPd`bNfF$yNqMu#xzUsWLw%%U)T?I)}!g$d+fzG?bpkj4!qD#cO3#b zplEGIb+u$RKANu@+UD+a2}p}hxWsXDCOF5&t=6?jz;(H8@D^9r{2kBMm;)Rtnk&RJ3PASN(3jD(|IQsF6qbCQBv!dB^%6C~6Jy zh+A)*fI8a+SCh3T6d4=tD|8*lh1De;zwUNXnFmFYy`*+}MP%c*xQyjBd22sP(fpNE zi1X7QKDRyiqt+^1grJeO&(bD58=iA^wMncR+p#!y8w#uB(URia6H3VG9 zQXaveRhg)xbJh#xV9}lE+WU{XHPxypwzCNBz7m1j2yEMz^ydv@f76Y$78N@g;L%+| z4)?XQ(wOE0F470t@Rj}MokSrU+XX;qmRSZHl9o-zf=puEHNo6d+?DVxG!_l#8-Gq= zLZx)3uQjht|GbcVD~CIL=F>o7LdkT@h`J(c*Q)>0G7_yN&M3*+y*XayL^sO!e%?#i zEUuY^+N$bOE4j*D(l%J5@XSR{4sY8RR@JCXx$a@)6KSM63|en~U71NA(3KsQ4>YHF zft%it#ou~{d&H90FTCd5hgZ=BLmR?!HHyJ}`+R)eZ_Gbao(H+#?68`2ZUf$wg|_T7 z+rYIBe(+W8K8C8|6dYE#ZgeujuvPSUR_}cfu4yxZqJbzX&7`>s%7}|MN7x9uKOhl; zFCPIfRGo)zS9SU9aDi%EpR8F^*t2;TCL_|{G(x}}gIPlTIAm9w#S<+XlH1$*wEG!d z+SA3j>t#D74)g1!;e1l(def`s`(kzO5D;8Z7VQL4NlWB@+r@GX(k;y*{3wSlsI2=- z_4{D(>A(MP_9B;774<$Kq@al;4Wu(!SGsqG0bbCfzHi&*l^fd*q_vltIwXEh(y**R z5M=!?VUm{isJTizZF3mD@#J|Gf!J8q6KEt#*;Ad*v7pZs4SpH66hTj0%4t$1k(*={ z@TawppQ<64NjqRD>+lLL|ElxcN6p+Fx~~50cyHaiDp35l!crVA`L7DTjhd>`?Q%0S zb^IVG4H}a)XvTC-MPOxXZW(()fyG6ohX#%g=)vNc8kRSfpKK=}86EbalfKaK3dRtx zx7KQu?=v$AVYdVQ;)cn1axfUvXidv7&NqNs+)qO@nMR7EwiHwo@(a0RJ#!!K`m^v` zF9P@pjfo{l!CVGHJ}RD+_b^ULs)$oGGfau!g;c~gu=SAZk+Z1fqm)VD{t}F2bPt2> z5E2d`!drZCtj#GvBmh{Qd`$+~#2lFXBZUndcW8f9c@2pqk`5$KA)L$X4e=fwrDAnh z*g;HPC&eW92u*rK`9=g;sTT(;8Sq`3rLkS!*-A3i;tQOJWUK8BtxWx0FDacasT#gA z33| zg2SH`Lx^|dl(40vvq$D}byoJ@d!*S%+J-()y3D74#gKmrpdH`t9^?pp1-N^AhL~C% zs(6w4;22gkt_^|1-NkVfB^?pV_E#F9rcV}JhyvQ|W&}EPr90%xtXvIX(j&!n&)|HS zm;j<(bRpnMkJ&&hnkxuBG>?eMOknG}IQ=QrmF(TL_2&#y6kHP*-!1eOge-RSV%g{z zVefb3We}%WHu#WM6HseL%Z$QHda*^KS9_(Jig|GeQ3_f_>DaNyqTG;SMv--luJFDC z3-C?;I~ogw_GdAJ*ikfrs@(!oo^JKSy3bYAqI*)Q$-%8e99r? z!V^)E{d#orUu-@|*46apKoegRx!9LcOsu61imm(i!k9YYrIHT;(Txid6%*FK80}UV zVE3%dwr3DBgMTglRF(bIZb_Z+qgQB`DWmwuZJD3qNtIp?5o?1p9yR!L6RWS8?6vBW{#0OaUNL^pwyc1=|6M2VJA{^ zM3Yq2b4UV67;TM3=jNyUsbMYcLbvg?5s^ z;@8&>T^H(c&ZBL$erq_H(ahVbE4GQ*;(G#}M`fi=XJvhX2egHp(5SriD73mi_R@ll z{*CZ<4gN8dJH`?l#kK@a3XU3Y!o8R0qw;l{ni|(V)ra)Xu^_+AKwQ3}8H#iI1ZA=x zKVA5ZFILq4z?X6H!sq;e5FY(m-y@|Kq?+K;ap>BU!iF=NYuRpLVzzY%9n%^$#k+ME zzt0-BY$(J;^28jZ%pBML0dVTP&H6XU15gh=dTQwaf*uQqr$5y~xSg~YWRli;{d;>8 z<%zI1dgM}kq`|%oXhUgc28FHfha5@ckaxEzdr3~+49+_Q2#?R=CiDFC*P?bmdhdbg6;q$)Whpq=K}#I8mxhiID7zcg!kebIEgf+CL#`{dmJE1CJAfLO?6p-^3-{twtL84V!VbsWGL?*9)SFGkRn$wi^G z#QcBw20C`&v0=|))S)HQ|GBUq!M7m5H45eQ7ypaVe|~b?9t1tv1&Qi6!_Vm7f4_+z z3g8+E0zuk_|N9b`@kD?REHq53fW<+_^Bq>E==OO%tVx+CTZY>@x~+;;chk4A$QI&v z2_ul>0M?odDb+DWA-wrL1I-(U)YN5)Tgu}?bxkEveMv5`$`m+uCP}QCD1v#+?P=8~ z#r;)A!^^~A-3k6a5}|iw0u#9U3vklFa4W(BJVV;p)+Cx>K~<{UuA|+%Lhtq!G4A(6 zxpI*I^a7~XciSw28&<`xLKf*+4=kix*eBep!VFtU#47EfyGNJIH64>yzoPP+BFp}D za}yb)%1YML)rR~dfGZmw8`Y*^r{%k>wtRDpq z4Jgk0@3PrZP;IGr60;nl&OVGLMob0sMC2|ZMJ6*qI{<6$MlqYpWqL!^mYm1&qilcT z?xjC2baREJ;WGjnu6Gg~wB*tEs zP@k|=YY>2$H!gFR8zzmGfH<@+{&qacK7%1g{H-u5N+$VKce*p0SKkTya4}lhPy<}0 z;|8&UcHdl)gQuFlqQ+G_g*kBF71QZLqlu*J>aN@ zr=?W-T?cgDhCljsb8qSq8NPS!5s~+;H%^P3^cEpaskrJn#4l)d@KG_1EbqlKvGrF| zl~$+n&<~`~fcP-w)catmR^xT9|Ib2k+dJ~s%ydfD|GLmWH1ieO)^<0$!0V4#NYomo`Dlku(i;@EYCy|R4RARFCg`Opvt zkX{2a5mirEzfUac6lwnCj;M9&dZ|sv*WWpzTp@!hdSvPIi`ha&oOF#7i=%|**KLDY zyiBkK&sx7uA%2n5V6WYVyaK-{O{-x?b~`$K)P3Z6uMCIz&@JygUe5el0!$7^a+FOF zl$PJo%bPJFvGho!&6!@;!-njwal1B~Xq*F>lDeRyKHUh3IRR7$+Va~0fM35BeH;@B z-~t+aYyqii8s*k-+z3Lu{dNqL*aS5%BRCEyI*x3@`PKg*sRPgen=-Hz2=MChzwPgFg%BrpE8OCI(A z32YDKRN3l>zH-D*z6BUwiN@uK%A8MII{6^Mes${pS%h8mo!&O48zjBVm_q1$!tAxW z760o-XjiK52iT%DI;fU_gQ|hh693L%;4X!oMesB7!uA}n?xlDKKB$j)|UA-C}U?C7#oSabcNuuCgUZNY-Y z)u<#)PmnNn;a%`Qm_-Wxdgua@(7J3_k9~xl&k(8BA+5pT)C6T46ujip4jxzjdv3_p z@YCZ%3>nGO=5^^86ZMkVrFU$t-Cu~ayFc_M!2t15Pe*vM-dbhn}|`jfBL`*E?)s;Rpi8D~mQ6cnoiNHQ`ew4QUWeu4SJtr|NCh2gFEg3Ih93Fd=@!b|W>= z6Ga&tnbOt=>h^g$L5*CKd&ec3gTtMGa(TQ*y=9NhzXrZN`f>Mk*%u1)GBKH71NGw4 zK{s=AFPGQHU~~x>b4W(=?Oel%OD+O*Paz(LB_vsUr{lEwwEGn!0!?OoWlB)9j+soJZ zB!>WpGyRL@`7RZ#3Jvr}i@y{Gc(({OO{;+z9n}s$g|#d?Ua~<`8|V5|sBhL;IB1FD zFpnKAbol84Fzw;hz~B$9Zb9X(rG^|*^?GTrgXWb15xZwiVjVSb~fufO7Kpze37}^yl2~Nm{;oGQ%xqfN0Nt+FmI_~1C{v` z%#Ta4@W-h_2Q!na%_|_t@B}aETBZ6#YzM2&Cm?R=n`2hx)~49f%geR+sicqy#e@<{ zsD!E>JyGOe?X%BSIbp?9eBZShA7PIJ3w+-Ld1+ZhKfbVPt-K)n$eIbzg%pz*ZcVG+ zU2ENd5I%GUa>`~8srb1)f#9Jf3|B+2}y2?-xAQ&D#&ER;1w|mG)2T!Gz<5h9}CV5Ftft) z=mzmve?xj1K`4y`EXS&qe)0+pMDyCO?`i`O}PzUqq=nekqlBtg0iww+$_pV8VYToL#wzl3c+X4HAH?AW>=h5=hVGZPv-~W+@=!Kbj_BTscTZby z@0EBtySqsgvDH;exXgq&&emZ#C321NCQUf8N6&QkLg5j5|%gqH0!=gSX&^RVa7$NlBXt_6Aq7F_4$(87lnGm=5;u=KO!5m&vJa-dm2+Oed z<7EvjGV2%SyR+g;V1s3G9+(}&Mz+mp9^%De?|n&bWcQpc*U)Dl8=F|E%wjMG*(B!iA+QcW{aEBCJgMW*S38V zqVTv*h)X)Y>~b5(09`g*3`loRtSxF2I~$GTOe<-f-Ccn>rd3mzNd?6I|gY{bBk z&lHS~19Ca@#Se4dF;P~37n-H&z02hm*{xpAG?%^H1{)aJ>gZC9pSUfaEd0nG;!QeX?+3^0d0f;vLK?6jS2HFuh$^blj@5H}yJyr2m(pBxh6^15b zx5q1mN@ocr{Xg|EXdh2#j_t>P!cVfw?9G}(MmoQSTwL^2NW!)wk#<6Osc)0nO3vME z1_yILEt@g`6xB1gQ5dG+}v@RC!C>3BUSZC>ewY zYx|O(1H8!dTfKrW23*L|KQbSTUb$Ake&=ZvGW-lbl%4k4r+yy@GH6AVBpBeUyA<%w zAyoQXw&1^Q!|@I!Gls(cj{W*%xFbKiCf?Hd?DZ`wq0t*_1$7nnu6qi5z3c*WrMdA( zcbI;TO7)}lC3Vx(cfBxgV}L9hiSip;UQPp)5!8ND{epr4;s#A@MZA4hHS6#MKj0`Q z9X(k$)zz^FbtBXJr@kQ08MP&h!Vdnu0GzP?%>f7Ae*VM$PH5R%{gRyDter<2q^W7L zXKRjs3Hh1Hp2{EJB?6!c$ z7GFtw{iUe`zUyFkbK2zf_oFGmbY(E3q{TQLr4yGuHs}VzDX0|7KtIdF6&kfys@Gvp z*Atc|k_*dh3t{VYq1G57XQkk7qj~m@5Y&IuySvxCtSPMyC#Q(nqS6Jw>uqP=P;>k$ z97LhE(opuCjuXx3@(FAIr@h#@NXAdf4~FuR2XZkTplXgpuphqWb9Y@vKCHfH{B)?M zWVcxBn&TPe>jDya1G>JWO~@9SfP%oWG~$P|-aaRO?QtX)pktU{NHEW)NI;$%+k>_D za-mypO8q~~y=8SzpEC-Y)Q#$ue&3;>QSehi)pNh;_Wk#FrHzvI>DRCneLyswcKTb# za|lryx=y4qAn8qZb$!StVb)2q#CQG=FkUSBs~#irl8NUf@R(lmtr~B#{3TsF?}_27 z+k$iV6djMk?Cu>pkrARlBAzeN!zap5U`p)dfE3Pbczf%U7(aNjDgt9;lp}OXk&W+@ z!-Tw4Dg?Ci|8e$B(Uq)SyXhny+jhrx$F^AyW!8LLK( z%3HN+Rn13p@``3+`9Mq`=C%VQB#)lt)*LKF=zDFb zT{d4a1ub0#wz{p$eX9znG2iWBd0$)zGSd57knCso3RyftF37Y|u|{XX?|N`Z<_3Hb zaF;~U4;DqDzf^W=F1Etw>MPpjyc>t^2dyNepCFFVp9`=);wJVK7yrCN3jR_lHc+jz zRKiA839!CxSJ@p6$hY7`d-w(`Ppnz^SrauNl}bu9IS;c>&97_x%Tr)0M zj|)~nvYiOmbN)`u&=iYMcX8Uo45c1lu=@k3DN%LrnohKQ%O}KozcRZ!freeC6WO_f zAca-%Dk7U$d$jx&jLqOPx(e&a?oqb2FiPP49D?Tyamt(dd+8Ua9}Xi=f-5S#L5V@B z+!8Fq7Cs-(PhnB;hhF?dFHmqMhg)Ey@a%~K=vJ;bnw`xQ|G+r6S0bA#xW07g-6K83 z2m_PdY3(EVgK^4t{+RSQ&C+ezEDRx;3b|NDws14yn0NHKny~uOu*;jNonl~RmmJEQ zTsf3_VkNIXs5e{4Zw7Pa*<7=+nsEfV}x+*SdR>76Gw!hzGWlPeSi7>FXAyZek&d2NB@;H z*fOlyqRdk00m37d849dLDD;pgDh*+B9K0`NJ07x!5ARd1wYZUafR?icG5IS*AHx#i z*^0Y}e^lZXp}d;J?^k{GuNb`Mdt}U405Qavb~vIwxcq-@`Nv;^bOff%m~3!?ztY2v z979mxy(DNFDiy`7zF<)zv@xo}hO^wjclWpqfN!Ip_t#|k1-|Jk#)X}*`3|M7(mVqR}yOl zj2Jj|nyV+^wd-ZrMWx|k2dfY|9^3`7H34ZWl#)v08~&$_qWAO_WOqm%Zi~I?_y)Uz z0ZOdU*mzc%peqsT{@GmzydKn%@WA}WOQ~}$4F7e*LV2ORwtFWCVcPKJUREf`NV4Q1 z?vgr|t;yKg<7-->n_){6>gHi) zkvLz&@A{Nlv|gdpOFI0oyJN;4BvK-?8`BJ&tn$UUcQZSQ(GnlqLbHa<_)4+oZ`{g7 z`4`|i8_2rv7_wff0<4dubnJcwE5^qyl~`!uxihYN^ddU@Js`#(l{`xYagBRyK?ksL zgPf#?gfc%VFBX<`J>%L8ha4xGw~1FqM`}~9`m!-#rJk>_xV_4~N(Fa0DemoIOeRLs zO>VEWEfTA1?HT(UsE*_wN6R-P5Y4QZGeEzLk@Yv+P&h7H{d#4+<-F|Ct9f65sy|-D z#9hoD2d2$d+uP_ZoE=>D-p38eFS~KNcpiG^yP)k}B;fwg+{IaPfN>wf3pcI5*|Y5U zH!?DA!ch;cMz+^x^gv$9thS;yfBQbr!$<55qJ)d$e+iOJUPJ5j!6OP?@r%3(E0T7; zL!x`|7c-Q^P3%75lMX4F;D|>U zjHM9NeI4jGhg_UzL_Rk2FXYKdsF@Z)h*D##n zK9hDz+C1o{=PBrC)3n#1o>S%KyMm5NkZzR%Z61ro=F#d$)2nlN@gsb@*2YcKYk0UP_idwMJc`bK&!;C zGUenKiOO?aEVnkwie>>lC8qf<_5PN&X#V|@_|S|iaZ_b3i}#ZRH}{UcB`s;xuNVSR zbWrIRhzI4h^0uD$IPS&0He*xvV@%H`@}xBIRF z64b)8f#BQs7y34~fgDrOgazt30dr8ai8JNmjMDjvfjz28yO?wpB#t|8>P_xY^pO?L^6f*Ki~aiIYj`1$&dj^|f^Xqb=aG3TQd)l{9r}>*k<;yWohwY^Sg-R1clw2os zv~P-s65LF|{U~vj3un(2hBIK^Z^z8P68D-B2`#Lp z^g@38>DF6%c?Jb3%3vGlN^n*qj$+G->IwGP--}z$T%x=hlJ_$@S<600uRXQYI=E&m zU|qDTZ+z5^`N2M!cScDqgsael6HHinWiU~4M|NSI=WGau>xcO`eh%}8!frD1uodlZ zm{B}%X5S~FDP+V<#OSeR92?tAznDUo0TT9Kz#lBoQ>f&e~8WyB0BIqGI*&@@=kqBFT0h6&{u17P%VW9xqpxJEd?}GAhvuITdDfOpX;$U%#lYClCWt z6$*#xRg_pwY~>Rpxb-J>HkQi=si(CvhpH7hH(xnG$X8GazY(vioa^ewQf)%YOz|mu=tqr^p3K5lV+bXxr3!v%TP!*bBmC~N zm?iZ@9;Eaq_~D^TRLioJUvg=ng0TiKM(;)^Ru%4A01f(G(;;wrnu!UZHQ)1%dCjs zUpvO`Vz1hiniDJJJtn~w0n2AxDwScVuk-RPJWXF{DRe917rp`aEZDU*-Pm5%r@fOK zK)d@Dqm(iOuUqg1azj5$2$E$0^Le;}I&$!d+1;=LG|-3{{>Xu>zm4y8KXVj}^3i+e zw->Rb?h8=6wG|JaeX;JQ&M)qq{ZUe9`BYr`jw9(VWI4ZEdtry?jytw)xdmiS<U;LFn)QKe+kA^{vX!^DZ7TfN*4y-1mx;UiS^6N%HRm~I1 z)Ud|Rme7##1;!xQQ%oImu}&q!E9{a94ui!JEx@ybfb9h-1`ylv{~QNOb+~^qRva=; zw&bjsag{Ev?Tl5P+gguxZ*9pVZub5}#`_uVf5gX@=MI#i&fQz3p1UW4SS74t&KbH! zZ@Y=oUZ-n#blIa%ttRa;<7@*TnXzmpy$SQKP0ipaVfj7p_X^z1Iwu~d4|nvhKc;cZ zT`3VlL$S=TZ?hz=&6Ir?HQ+=%voO)5v4O$WztFtWHTI<)^G|ewS==KEM#~9DEph_y z!*wX>tVd60^B;YMmILfwn%nuQW_xfYSmE-WBWOtI+|ztW8pU}JEj28U1CFK9gESklJk?ISx@A(w->e5hJsZWwGbB7=*fEYU9uJ$SUl<`iQjpMxz`3nPj;pMx~oIvCTn z7*buGXpj1if-#R)7DJg_Kbk9LXoKH2hY~6l^Uy>~Fc0buIcnMmQRQEemP4`(kJZbI z$Tk+Q^%XuW?GFERAH;;^+G|bXOo^Uc}&#oR25hWXVD&x6A5=shAG^c_4-Mt@!l04p2fR07ty_$!(+zR%kT~vot z8zq?+9H=Fa)iSjuzjn2hb@e`=g_cUUQ@8*(UU~nacpkdBvAyKNyks*m61D%PU73F| zXK&1r#!h)UT0u3NsMEQ9JOn+K&kkpFfzVC-lypf$e>ycQnA#X8(IejT6+ZGMyW@G* z7tNbdke{vbDtW?LQ+4iMY@dJODYxk=-7mevS+zF8NPA94+zZi}4C?k4GgR&E{dg-W zvAdOV962E zuEFaquGxiW2~m&rIQ>HU7mDPP*9#t|TO(YRr>Ix)6C|sQGV}Fj!=>SGeNc>VBHJ`% zy0TqO+?`2!;3Z7BHpx&zn4S*&#F4n zfG0;iX)w|e{?FdDe{Jn}4KyEs_}7krKfRWOy-}UZ0XND)T*K)U)`W9UBBSGUdQ^Pm3Qkr{iLAiaSwFiY5{`u$h zz#0(r#In$7zP#yMbd{V!my-I-9(f3~())J|JTK@2!OCUQ>6wUn92lC=FWlz3kFC+! zJ-8xGGm7MD>!Ah#X6&7BlIt2EHih7pkm#lPSsDpZdo3t$Nx1(#M*?Cw_o&Wu3@O(t zQO~jPLa@W)mi>JF$GJ>4Yn-uY76g&_;Qu<92ap-r% z9?T^(teqRf-nCiqizJ+*nv0dccvDQ#{3Bn1Lqr5Y_r%$4(SqDX>BbyVzS!KkfsLIp zB=`9lssQ)MND(9+!^b5RA*dxKPax*+%Cc+6A5GEjJo>zpNSEw98#%qr?n30@L z-kF*ZcoQVAv*TF?LKV=I~|ho!6Dzu;j~Z^S{b#EMWVZC3)rEunTn;x^7<@ zD*kf#_=?m0XKKY?3^X6m9qAN8z}oXjNV2SC&w8n#L4Ol zTU}ENs(YA4FE=$@u=rRjB{rG|pr=(EggC{Rm{jfH{>?-1-TwZ_^`lFPoNPvb!~~S& zS4v#GTQTDB^f9EP1k%sezIA3*!YV8)5g3scPE)(aW_ZkG3U;j2;H)G|a$I_pF6oH; zYD1_w{%`dc9}L}r#S+2e_{nS5rXUjm*hY;eW^v^+Ha`%9HPR`K_jr>&3){5Iz?ZWs z#H7Ug(@Q=WhK`%HUeMJe%-)OHZUCE^@;V<)v- z{(g|;Mf=^t_;s(dTPb9f&#FkVWD78GG`+^qkjWqP^Yj3oQp2Nx^Pqz!LWcD;q3i3U zd3$BQnPD}fwCwRdzHY%)jbNduW$}n)Ze=O(O25B*whX2Vp4}`*ha4jw$7F&p@9}AI zGm=|&@fE`pbn9NfzkASPJeWHU4qXZ^JZ38CVjn9|IOF!@r{%vVr}8cse@5Diow*3< z=5~aA_)t~<^bO;|g+6(g#W6nvxq=F^oo6r$?DoDd8g}~^4vO91>`5){l>j`}dp#uy zZd_ro@t{+=*^W19hi@KL84L#D*>$s`uDI8FtC}#mH!=szEtqNI$4Xjv07MxbIK$&$ zkfCdGtLT#p7BND7bn z0f6z2@gv1J!b;5`BEPeOw>N1=0W~+v1-1ZAoBy1-M+2aKbk zJrzTJ_FyZf`zdXk!xcTaYrwV9f*vZ7MbY&mE8|H2>=#HLq;`URWT#nw1UrR~c3QI~ z^bzmZ;A8XV^{qwh6gW}c>@YGe^{A&>ykKglKa?}Xg&12=qo!K79@*j>=!qq(o~}3B z^IBShsx6R4Rc`e5nKi<`xDIXdEfQ|BEuV!&(!M~JX3R;&JfAq(gA0`eGanO;6sjZS zQGk~8g$1xJKD5=JI8ZiQIyVJhoDDm$XfLg?k*9aTq!-?IEc0k%%xRL4=ie6?wz_*S z-__v&Z>h3I(AGv~ty6m7hM-kACO2;uG;IY1JAgHfs9lujtOtGwvO&MzgBb1)kKau4 zVlBZQg+qUa{+}zdiIfWj{;6JE-R!o=Mm@)Nw7|(GM|xII0$S9Y3F{nv4f38K5%*z! zux^qqFk-sP(gUWDdXmRf#4>t+3B&#H`dGvEKnlPJfI#aq3`2C^5FJASgj0l2pF?Fc zXk>T~gL(<3Xd*7OduC~kPz zfgJD1IAdvvW!Jmkbw@*@YD&C{_vNFQ&wA@iteYMcOC;=wbsSkb!ni|7P&)U5T_^P);#ekA1nP7(WP zD8PMcYN&dji5_9=O7iVKX;P=AEZhut z38h8!3rK9D;&{qMTpXG6T3%q+Pws1tc^s&&TC%Bc=Qw($s?uUqXt$O+e7B>Qf}lU^ zLKUpN`{pLd2psI~ccyZl98FyEM}X+W~oHPP{V#!{w|(9SnG5kbq{182r(& z&APKCs_e4#?ZjNFd_l6lU+`sxJ$>w-!>_8FO3$US2L&kN0Al#J!~-$iZVv0{bNr`R103x-0yHiDDFR5{{(tx0 z6#1)M#P$q68T{{oqk5^3^h7qPfQ^PQ|F=BFhNLIHvOY&GLH^%m)QI_Ey4OI&p_=|v z#r|E)Zd;Q83eJ`~)ijy^b0$RJO!m8o_*Am~^VWTW;OgxX)~>C3BGIDrcxp7oQjG$v zpK>_-z~G+)mMMWkU9&%e55n05T7RRdty&f<+DB83>P`N!f{hRq*#b?K@+Ey3ksU0? z&nCE#{fG`Aql241GnM=nA4nmOyT-=Vv~3~%_YbbE{sskuR^S6ILgmXv!*3hS%Ryn` zfTG+V3Zbcuv5;BAsa-pndktiw*FU)+DG?W}n5Bt(~jXaQf$0C>Jy$-g|Z^WeklR z%>&V`#A)7T)Wh|SSA=E*FXFfz%XxI{QHmCE1@P-d%=l5^X1wH-wU64hnzAOAn4q%W2-Fy;0o~`7^WlCGN==xI5 z``j~vO_!0gC&;czBEB@%6_6+Gh_vu2V!V>4PY(?scX*I-TM=Jsy6;DS;zGR#GzQH3 z+P<_BRaFQanSiCh4K4HcS#QU0DM|7`+jamx#}(GjH6};MTLV?YB1`QsA);5)AdUf6 zL9J(Wk;Uu2^L=2uv3Lx!9@+q(bzA$k0Qg5#i*e1w6F8!Gtr@!0%?isw>_4xYz`Vcv zbyUC1Q>GL!{ZoI)C3yKqRg2W#-z8zVt$`+!Y`-4vxy>1Hyu0KIwm>#)ul4*mXclb1 z?+#wv$+dedpshT#4d_s0wF$1`Gl2w0yai|+Nci5T(FG(77E|g_ZyIf*VcekwAd>cv z|D#jP+b4(`-$u$gTNN$z?x8XYHGMmqF@5rBZ6W7>-0ZpLvlzZnH4c@zlqWft^|yIC zIDRk(|CI^H$o@OqVpg0&qG|DIn@1>cX)o~d;bz~LGcLIa{zw&1Fn-$W`HBY)f2865 z1=I<=inwjciS84XZFQjr=1ub^71P~Tn9WRq2)p#?Nf0@{dvN=>4kvs_HVzL9$gmHB zka!?FXR;oDkE3|;HQlVIAg4#2osePj4U`5d_v#6+U*`)R!eV?+9zZJ+<(!DEPaH-f)Va- zmG{R|C=Z|GWh9nS2#A=BQazaKkQ!u|P+L*)TgFy(mp%wyO;qg{33m{E46MK22gCt- z$DcF`NlpwkyedGb<@~5{@u;T$a&Lk!HZavdcjIw<$wQ zThHLoSR`0yMPJey(L6bH%wee4>ko^ft8hA%3xR;%GC4+>k5@@&V&e7@*)VMewel|{ zRQGyEk!@{)yfc`y&kOmBTLB?(r@@_LBgRZ4QHlt>xYc4?ct=m{1$!H*5DhpeiDLNv zVP`!ft;DEmtTF=&ut2Q$eGQ778)J!txKDT8@>Cg8S$t)Sr8w_AO+7q3Tg=dlZ`#VY z$;La=K^*_m6oOt+YEtFA;U~&#&|oaFAioME%}y z*Ww3w`011&N7NV|iQ(^rY8sf8XUfqLtCUNfJKSrkz(x+r_M+krk4EaJHE=>_?FkK{ z#v>}A#8Ujsyt#!y?W)J8k3z*?VA;u)_pCVFAxnp}{!^C^8gbzX&6CB|(Z|mYiDxaC( ztzm8>_({&FjK}>>_gGq4SKuJG`>2D{0o=AO=4P7m=Zvsi#yP)6*zex(+5ebhv4Xh< zwGphtYjbi$>#S=`#rq^&$wLY!JD z&iY>QP`lKL${9gLlcAfd8vR<1o`AsqiA=^(iFB{B5PG$Yi&^)~;6(X~J&G~M9^EC} zUhIc#%ikLu{4DZ>UHrL6mbcOe(FqIcgsU+i^h9a%{(=rj+};pi?ykQ$iINiz&>+X! zei1*U&vrHL939g>mEaD~XWYmAU={#>Wf=>jlJIB$fvXP5)`uBCTSWXOV`fnfhv}ds zvW&>eJCc8OIdRO^MPO5S1+*LnVY<`Jqn5I6SFn`E$r?va2kqTmOVSY+ zZ!l&(^W0ul3-aDkBAj#>?rc59r@g{|T2NJ%lOv?0djsQ?ospX+v9#hDrB!(9oNwTbYPze2DzqRuKq}VV+ z+PsB)9tQ=5xP)8yN>W%qcLmDq(%pPpPPZG8kdQ!0$$0`QxN<1>iF>8`BoqfRS(cMu zITh5xf}hOxDIz%u0>YzHK0w-z8j1>}!UvNOHj*wo&nvI&U&Uni!qT%0_Yk0T>0G9e zw*zl;EVmXfLE9Skcn(fDGx^SNDl!>iw%wZk6V5pLXNze6hZ0yUc)b$DVE}SAGKT&f zj&A?0eA^U|8p}O6QEE8TDd&}{ftzEpC^tL{rR~`i>Q9e`)!VA+>a^tTSGh4_aa%K= z#_pOeQVXUM4&?*kJ|7lk@kghmO{{YcV$bv*1;#Kw5W6$^es-p&-rnLcxI0@40o@aE znpui2d2wP2!~ZLcFOmN`YXe(^tY;YSb11Se(SENSIm6p5HlZuAmW~vDIDo1LNcIzl z^r7UWztWR!!Q~R@AK`#{>YcaZoC5c;4>M%-Z^t;E z*+`vNyS`0n4X+IrT=@||J&qP7=s^1iS`4W4sTXAokKH!8e|{-OWy_UN{!#3%p1WhrbgwqIlYM` zy1QZ$7+%I9DAM7NW<)oQe;~X9=v!#jK58n8BQ-v`XN)aC(U#nxI%G?GotGu3IiA@z zc+y}4eY-xFRsFGK+swRg=N5&;$G!LEG`QW{Ps1@ghpBt38MX-N4$)ySnZu&4_t+WN zLKx>3Zq|NcByY#i>_$Q$)gbBE`0H3o{d9-4R;?PUOXFo2jm3kQsuZ#c;Z&(v@ka)b z7lw1x)Fs8^52W~m7eBJ|?~Cs*e#O~RAT0|MPM9+JaNeT3z?}zAV5jygDoaP_J}eyE zogFYAE+(m=vi3ESjvP(bw=esABi8sv(mnn5bF%^6jhRr-JUI%;y==`l5dJuKZl@E` zn@3*aTQ?`%&=BssN2d#Rz&PXYH+-yQ?}7#nyXa0(00l(l;VDT+%L)5w(~lp$Fzyw} zr_LjemRCZiLCqPCRzF?elWR63uZZ>KQdKGC{?HW3x8*+<<#SIIkz0xIwJd$mu*>4| zsf(9xUbFUq=t|Pd8{E_oewhj}4f%nsja;$L)Vjo*_Gdg)hEEJtxV)Skd+iVRk z->YO6)G#F{;13LIy%nsIul-mDC3pJwA zu!kyeiP&K^p)`@g2acU|(u!D(EwciT%J>Q0*QFho`3`Tf#umix08)H+hL%h8u;Ol1 zjH5E<3MuM>JFGn&i-^Mo%TE(I)=_aTxv=qRVP;}mOvHM7EpiLS7 z2TsZ10RT_3sOUNix8?miHyFJ6g|hs+K?a)gZI>C9vdk+J$@dNk^gr`T_+P9AF}x{W z^AS4BEogJjT!-5Q>gb@cHGvO2CiIYDLKiV;2cup$l0--HYEP1y;@PiwYI+$J7!p=*&sCu!4z(4Lg;9 z?}coV{6eu0Jj$XLlSxv#d)JaaVi0EZXr{0QWGdQT)$OJL1wN)?;bUwBqsfRj zB;9#K(5_raJ|W~T!BOp8#G36Y^iP#360hjNr{rh4PH%koMqxg?WrI_BtG0pKoz0i9YmeZR`TAUHiRolx)MV)BLhv%sL*{{h?p zeWr$E`ZElIXxitV#el`BzitCQW1`-redUr(6KmuDU}S#@K>%(} zE~!u#{4dDPV?@*w(J?-?UQ+olN-tvuAa_;s_6(M!f1_qSP)cOLjrIR^NPj3Kw}^`M zlK%NoKBR+T6QmfcHR;zj{b^G5ugg*f;XkRJ#>It3>uKY+ z7h&&f?YnUP@Y93?L*az1wb_F`BkX>R-Xa3NpRTazng9Sj<1zdk0xxya36I#n-Mm7f zlG*m9_NWX6M46I&ff0GC$zuqAADCW2MvnROL(qyF7#mxWTckG20YX?l7g|J%D4mT_ zu$06db8V?EDA@=4xoSgJm3A+*`BTlw8TR#MvNwa`BB*|7RQR6W6@ar+$#?1TN?T3I zqu+6c1zYm{CWLpRR8X+Ja~4`zLgyFEHU@aZj%gw5C>SsOR>Oa`B4R;MRjd`ILcH4G z_sh=6_ZO(;rzgxK?N@*B-pgJKCAEr~T{Y)e&lnE7vGWwJEDo86K@bGSvaw=6^*Kb? z(lDu@uB#7*dN@^yzWmBNS)R3Mss(ihkT!~@{R)&I{<}^m(#43c!hbyL(4g7w#!+>Z zTX!hk2~pz3bAB!6j7Clqv|@fhDD8`XD8CBICx4x4Sxfz`0sgQr(;Ys$len0f!>=J} zxJ5nOmD#lmMNC`lOTem$)VSc96_I^Sbhl+9^|r?yKyv8&AvHW-gGP9p?y-H??+K3B zUI3AZe0xoBD#@$_gJC`Y9hqaR7yTRY&F_Le`iqlbkMvN4_IfN#AK7^1C73gxtsrGZ zLHiG6#>-KJjiq@BOVOnLb-n$e#1-_%@0c<)4Bmgf`u@^}!qxo{{qeu8KW?k(Q^w%8 z2m$4<@01n^YU?U^`9_sth95&;-nXSuR0_=$&Efv zu|sA_(Gi)Vq{Go{gD$t2yF)}z1gohtEUw%9J=4sM|D-AO6>(!{4KZv2KUiEaB8L40 zGcWKID5Z-^A>7(y_`_!*m+$40$is{(`Ru%q6mZGsg$|-i4)pP_>Qg!SA=94 zYn-lao>Q|`+=?T%>ihqeJk`9%i9YD4w`?Qgij=JCwmuUob0B5sP#Fz$KqubjTs^Aj zO_EH9G^$td{hg^)4vQV*RSCW5EnwCk>0}<1Lf4P`uHDRWw?YDJ1LoIfrqGx3>DjQK zgrc_>Dmi8*;U0xs;@m#+GYAH>>X>sG07bQ&EJJ7xY{(@~WKp_KSxzkkEf2FbMR#bW zC^&t-j`9N59XK9YuE<6g(aNeiKRnWam@Iu1%6IW8{8jHTf>Nwg^kfydg# zFmh{P(T3XqZEgXTW(?7h6#*q%phvFu@WDo3J7;^cS}B)*_X40hjEW;MsK~0*1VtYSr<5*&W>K|=$Ea-!ragzV($P|EwE@tE1bhFno+}g ze(t`Pi91aUAPbKWJ&2bpdKvDi+iHK>35TndwZJQ?WQ&+TQg~gN(y;&;+gz7I&4U^t zxafvYp0g)=p%d`fBSCgv4l$(7PX3zY#^*%;{p;1xy`M0dG4;eZqVhf$%juq!ER3Dd5q4E+%=S-q5HjpoN<=y5Ev#njX}mx7mPUE=)L{x1W5xtIQF-L0nSb zwzi#aASdmuB4`tRQ)`h*coz;xZuRPAQ*SI-u|k8LSun$*rP1>Kqx*`oi3C%C^BHTy z`&OYl5DRpb_H0` z(Y!mmSNEHx@XR@=L% zWHV(eSNO0={%q4b3^1$babLQv)j@VN?|h~Xp~vTgY-SmM)8hcsfJINnxe+3oY#LWu z5&r`Z#13g9rnxUAfOCa2>8ZEtSRa%QUvscZOZ*A?GvpP;obxL*$zU^XKDfM%!n-Rm zUgI59Rk2!dx(~1U&{=7%90d7JW6tX-K7;5a6@9U&{=igZbK<_WA6Q{5HY>sXo)L*9 z$vsLjf4+9q3$EU6kIn?cMoJ^f`bbr8#guFZ%{|)&ST>IS589DHkHQ#wNa06lUe7o0 z__55nQd5vY5!`%iDV`}I+`$1Kf3rqXq2fscp)qvOd06RXNX4m*QVu-AoQ*pwbYVjC z5nG4}Y(HY*Vxy=WkuXI#7uu-ai@I4SrfoS74p5h{k$_m$K0EV*BCA{&DLB{>v}CWU z`Y(awTWXl_{1dot+<7fRYSr1_B2p6AL6J3t9JQdD=(z#|&f?6A3>dM0@iLqYr?=?W z)gMS#RuMtl&Ut^wELid*4Z1`Dj*qb-@!xFQ4Lr$B zT0#Tn)@ADt!o0J9nyKq~)du}`bB2^$4}u?piHr;rGq&n1)JVMf4x#266fll1lI!^k z`1|Uxt+BQ7O!j}}9^T&XqXE7NwV=YG1zIe8(R$v&si;DTrW#mG$2vETw|V|oxCrJ{~^#4wIs2gu+|@m3x0bbvLUcs0q|F8Ezo<=rI{&J6Wf*R9N87g{g%9S; z%XiK09rQCZ?=V#~xRKG|sn)kPaQ|Dhkap` zIxN?lfy4*RvDtAUwZO(s>hyS<&BE?O`g$1=)x1^xild^A{v{u)icLG z%HO-IH>?_4J{Q2enhsIYrJS-LM~-$t%<6tcKE6+P-NO9k?D>9&S+&DyPRa__vDb&< zp%IDU$8j&qK1weBQ!b+6cj&H`o*>~^wKtWPZgxdVjn!!{gpI$p{vr)nT`>Nxcs&Ha z?wf$Aa#{#uFhl~D0MVtbkkgs}W=oI?u#FG-!+p?5Ra+YUFOC2lz;Ma~;)SQWP`67b z7{-%8wBMdYt?M9G<2~V3T~*_xs2g7TcxHuJ(_6T>8b^A=Md4+O6W?h(Vnq;MZiW61 zJ@B2eR`xzvzy}&RMqSMS4F~_3RZoT4Jhw8c82bV`aoK07e=6K`Kl{ln}Zu5;vDdUI~{FCNkAWkJN=i`O1RLE z(Y9Q8LpnNxpPK&0c?Bc~fF|~3+D0Z4F-ZHNPr*JlBx9mj#OiJLl17ASlXJ}BI)~)F zt5y#T$$uv~I*LgG*&~@Up)Sh71=ZX*1zn2=Bl9!65b;l3N2L2&^ngdKPMDRmmyY$O zu`BTNTJ8iYW4dA}kN`w)=X=N5%(PcFbMW}h2eEA^bNZK}1A4eBmj3${_X(*D#2sSb zto7wIdj=1}@a+wM3+*OrJR=(u72g(|wB2~V)%kIV$tIAKH`(MhYO`l?ZzJHm5*s%GH{CX?Vhn?ObBMoZu%k#+IWYhVS zna|$1WoCJc_ip*eL_?ce87!*ieq?U{aU!uo7DxxncsCPto6kC2c z!90!9ngZ&4qont$m2yVXxFzY$mo=FWdXl`DPPk+B!lNq&w`WgvBwy0`rlCtA80GeT z2UFP)R@tFNB zOR;4`{0gkwe^W;z&;1|^bDJ4fwaWY;?=PtR$#x%Ds_CC#%M%&Hk9~hpNXFnH?7ZVT ziKWlP6W~7&ikd>#;0-K&QJt-Lm@ckSVxVAQQFE&HGlWituBtYQQeBf?{8GH+#95VC zI@wIhbM9U;96b#mxnI+(=2ow$4k~#N=^DEIAgAK!CclM3x7iwCmVbV>*kFN3BKfG` zu&hefc3Xy+sSh6VfxbD<6o=S{efNDMxOy*`kKES0Y`pHN0!^Go1}NtfQ6PWwY{>7^ znK|ob@67E76JqjohL40Pv|k9Kyl){ec!)H7O#uLAs-XVmq@`4h+XZj6nboeV0e!;t zP6t6_x%P}4DpUQ}0Wwwl{Mb5!Lnm%?Ol~Zd|GNi_k9|eE)uK2yHxtuBNs|y&b1u3Q zjWmx?JG?^&gs2Gz4ad@@e*D0kc^?0#e0kFBK7z?zE5=HFr$7ZD5H&y&4}Br3*?z+l3L09T3ITWleC^qLSXCl z#avVH+CGNa@ss0%?0s(@rC_L$hStE+VyJlrFLtQ`auAC<(ipR_kxulIx=mk7q=IZs z=ePl(x1)gcvxnw{;!l7H($tydXDGoj38S+owN`gBKP*Hj4WKD-Y?Mgmv{TfkwW*dN7WG2)MZtdK;5PmBsBH!_e$N9a;}|Il)|QT{ybZ(UaM+PVcLm0FdxRrQXR3uVvP-DRt&1UnKol|N?& zlI%7QX6kz3jx^IA2mn=!eG%c#O~AT;?dieix;rZn)x&;GP!0Z_rhbrA$2WZ?4EW42`iF*g zZ%_!Xt__GHe>j#Mv`&Ov!=LBg4Fu8wxc*9a)acXlA0?#(2eUpNnlZ0(Zt)~ZOSL~{ zC0Tw^i;kCWEf|?e=Q-1M4eQsBs%j|q=oT@Q@`vQ0n^dO9l&pjG zCMNu#Iy#p&7N{)atmkzpu7AimZ?$ZJVjcfTAN zIf=)xz46;5zl?qC(KIkL0S$OYHv~w2|1$2pLxXB*Yp*(8^zH4wiYbH4Z` z!2+RXxTOtzkEG#hsgFM$6~P?vSnOmmWUH>=GTQH`OrBz;&OqQon*mdyXQdKs-9@r9 zt)`_WoRs{M1>hmup48X>#X~kCk46nGL9@)>N-!4$eUL?t8#K>(Oie^Es9KZmuwNXg zeOzskWClQIj+X9Ponx*EX)&ZwWBRX->}TdrJZU7`0?9B~eDDNO3HP>QGGJMEYil>} z{OpNu@AoM|8hU9tSJzUz$X08sp(n0!c;dC>{>M(_Cj#79dXQtLg~JZc3w~fYv=-UO zMB=_@e)bRrmS}gf55ug*sfy*8y!)&AB9@~OID*NpRJ!kqh-M|rU|NSia~8j1Fd_Tf z1a8H(;h)u3>9_c5R?a9?h9g7GivwWG@A+LY9x z;KdbhYI%a*C@xln|5);sfrrYUz1=A<#Afhx{Ba3Borw+1eH9S9oUPUiu{DnEp%_#j zj?G_K{)Qz$o1z2 zioE=h+@LKUEshu05`y`p@)~l|(uB3=qm+mAhpamF>i1{Q=da}C3N{4IE2`nh1H*+& z0q?bm*@xI!GnOkhYG4{<<5cQ4ld(w>^Ol0zq@AQ)(!3=kW5B5Q+K7W^k~v1?8v z_H4%-brSq`_Ns8~@{ipZV0%*pC8s@abkW>#H6Vn>ew1w=84GWF5VL zG34O@{g}V%R)8RO_VD3l&OiS4es=8)pk|2harr(UQ4d%iM{WzDcgnA5qWAx@I%OS0 z+Hp!Gr1t%(=YH2d6WITx@QLga2sXDCc}8IVizgEW?W=W0e`aeE8o71~mr2i@9Uupq z2xc245!Z4c8NOjGY7ZBR2Dq9?=LA8<@14IQ1iZOP1sQ>y-(L$w4Gq6%zr;!0ZJQer z#P^+566h*Gzvce(L(c05RnuC5Dm1`UKVSRufic4S2TYF@b1&o&=x0#f8>Z%O)mx~M z_yAWQ0|MqS16jD>2&@jIGEQngr0|n+;P|n%wX0swj7auEuCR=TLJfD0`EJ){7yADn zS>GHTY1Vz6j&0j!$4)v{$F|*J$F|dPI(E_>+qP}nw!g|u&&=;#-(R)Xt*WQ0Zr$hJ zea_zdoP*j1j`irZg{7cE3@5@oRYO23fGD>Lv(epY+xzqt$&3gFFCq99W{+^_km7ea zBtlMGK;w6t2!tY#F+1X|hgwpRkEr%%m*XliuOv}aYhci^nJmX8I;hqIphppJ(BE1K zmN2tS4xN2;Hw|SIjDK$w(G6B)J^sdWq&=z7&z4c}r4EdSQ^GSxyME}cV!1Yw@Bpzu z?nCTx994n=a8$RGtRHYlK19A3lR51wa!nNsT^{46MX?Kvgst}HIu80 z@(Q`dEjTN~fIPvWyTmF)ii2h3kJlP280awZRW5dVjbNKwZOZj;!|_7%!(u=DR^v3& zKpuhy%Xugk{AUsc5sv49e|BI-;PM0@_sgx?Ee|Mt)CkX^K`9QtIYC0=cIX^0%0IiF#C8J5~kCTsKMI#XqLm6~4brvsp#$%FLDH z{|O{77!U#Iu^s3(P*{N@r6}E?A@XM!)^umR; z3ZCe&vbloLH8ych@Tx&?bC-3j>zhGXEUd>-Jc?GL+TON+Ig<-Y#P z?F(jS=QQF>Rq~zx5cTl**x#n5VyJkGIa;*!X08b?<0hmeXH@*WdVSA4%R*)5E6ZP+ z0Bs@XEDQtU+zEgYeBjqbxW#74%QFaV7Fp!7ibP^#LG4!5T4k%XdSw-P=a6)VrY=36 zvx$PLbWMS-uJQg5v%ZNmprLqXwq>nN?CXBB&4^rq(%rsp%QP5dFSRYGue~syzDyPp zv`hP=&KAmGMREkNfom@$pwTw}(VdgvDK&R8&-y@?ZglJ055j5+;u*q+@z!yg_xcmv zfP`P{D0|>luX9Yi69ypf9Sgr_i_Hd8jUh@jIg)f#@_(3E<$p0u$?1UHA1G%Oc;lx*P-8JI?P3?XzVINhXN=2jmt@4F?2;X+ zV+)h--b!1t=%;9WwYonc^eAu`ZnJ0BxB)u##eV~-4ny<#w)2E$9}#JTlxYeZKqS3o zr*0kAl^R0PxJfX$Ec3WX=>|+YA?!h?A;sP(UD=L{Eexzj%d4a_aWlb93N0(7+aU%c zs7!3aN-{g^UtOp*oHPpVh6NrF>@`H*Dz*#KwzH*0uclW*37S|1F5nRC04i6Za;M`Z zB>Hfq;4D_4V8s3?kI15od0v~2y4Fq*J?zz5n`}%A)*+#%{H(~Cd2xv4Y~4lxQSYkd z7gS6e`msa$I!6mIIeX8_m38i@LAn8+!4_zAPSJyW2%& zTQ;0)Yd~g_rIFq%xk*IPY(Ves(xai--5YKVIR#|z5YVM~dQRx7=B1Nvzj z+2Rowsc_W(@8{RPRpoe%3k>$IJnnkh?VkqJ+}{2l#zxnxwFdQ9bmak?)TxK}3zid# z5&PfSCCNH?E)X>xqfAjZN<|PT>mm(n#;|?QGYVt#_8jdB+jv8&v1wO@OJR;GmA7hSZ1pRti-Qxl*=w#UdnUC19myIt`cRGuHR@Bg@ox&d@e@!M1E-&om{rK zeIY_-Y#}D51)?xg-tp8q2$C5s59%zz!j{Eius)U}XfxPr(N5x&vJlGVC)eIG0_Gtv z^FtL+>x`cOg2CGZShlUPWOY7;*wGNL1VHr@m%rbzwgxy>&3>=$5 zS=7OvCLcWc1|De^Q;B*g&x@M*-FMP;IyV`(;oycj0pYcgzS@l?wbngS8DL8dHwPT~ z_KX6I^>31OwOgo>;=PQPvbLQdhl2PX}DPY_` z^OTD^z1{+N`n6-jLDD}G`xXjNmSEOqh<0-jxm#|VgA{K+#ey(~;#SG-!5Hv zld4=IsvSW@C3^>E07Tn{kob`}AyLnK{@Ig=R?3Wb!a-2U+iJ>HWwL7h_q;(bDtOgi z8iBi>HrvY=9uLI_9qKp23x8V`;hOk$U-V@?K+2 zC@@+)o0Q!m!zl4hoI?WCdTcO7PqY@oq*)tuIP64v@#wSjRq6AGItSADXX? z@A5N#mHZ*)+hGa29Q1|EC+slAsaJKVC7|xuv$bPni_B!; zH+`uKV5_usF!1g!J1TRVf zZJ&o83DOH|nyAhQ6O{wZ40>}aSKSol+y1KnA!=in#VLQ-mJGJ;N{VxYo8nFXjreEB zO@b4=Dd`-kZ9X-6%4+gTA=%feN9GXL@TVZn zfj927_OZmZy13&gUul7^xl@E>8!8V68$yOCcx+YQOxeiwKcw%?XD5+%S6zh&9mAnq z#BzCm4^jsIRAY>Yi|T{{l%=0OA!mG;b>}>FcXg^48keGiKt~=oM6R6qYbDUbJ8&+& zUZhT5>zihGhKl! zX)JyDY`h&fB9X1_^_o9|x`S3oLM(76&~>jE>)1hwEgqkDP^oA%WyJzN>@=q;ofKt# z`<4);o{fHM*Bwn3xy=CZFbBRB1e1G7<7yXegeLMRVZpCQAs^W|58qulmr7+!$X;rm zp#2Wr=gy0;Ii|m`u~5Hz-Q4EI0h{1(*9O$(hFr|7j}{<{)PBDE4my3H{E_4`K9GlP zODFLJ6%twh;FMKrtaL=P3O+~MQ9ELz{~SlkXlek+s+r80>e6+6^)u7+76Ru7DFH(4 z!#WO(rv%A1M%+_=&{sIhv`8JAo5Mw*N_nvZEEWQfqKx2I;7K!?5XqmtA+fJOiqgyJ zmr@%#hKzMQVS)e+`R4`v?a*_{mCesctD9W^TZ7AohD%yD44{I4&iG>Zw;=psq5ft@ zy}^pJPG>1_Vpkm#IgV!1TZ4vYr4m@*6~s2LD1IkRGz7&~G+&0DB9PeQdYt;vzQREt z^jmZ!`Vl2B-j~kmU!zTnArj{PwwJ8J5Q%!nTZ(24^q~g4@O_3l!6RC%kHE{OB7cPK zs7pV?-rVmcGU7=Te{gh*WP9c#_VWe|cM40^msgB16j=4F_FPnX<*|(qX!{Cg_YY3c zBN;V`>I#jm-`m=?5%7-M2>J5RSI|p~mCH-agW1DwG||JQxxfIANj~{bfA5NCz7M@7 z>4~1~9O_k_aJ8uks{1iQ)J?W6Vun{sbBE59i!Iu!7w~I$0ByjA^kU1 z#e}2eHk~7~Up0uWoR&`uT&}<#s`1WrLVwBLTd6!b%k__;2D`wvg3J1Cpf1s|o>2JW zfO9y0@}&c00=nR@qMyG#lnJVMaG*!Qla7OrJC~-NPs4B{P8C<)JPYBs@it$!-@QTB zOrUnFOOeq&u99{b%(tb!_SL8m1JWpDxM(l779edJ4q;xu2ktmgqQ<)!lq<68tj2$! zo={)nA42HW&r4guI`#YiRnzN7&+9c*=dB-(IHxVRX)1zC4-KOjUgZV^0xZ@z*Gl} z*wdNz<(Usz@m-!$<)cCtYIF<_b>4gJ7SGNBN0!hrZb=#o(z-`IaMCeH*IY3j&o}Fi z0Qq&jyVz?+=i)%CggRZC2ORbzHr2s-XdS*gM25^L!Rs%V+7{nkQk4Beih-BcKqeMP z{#JXp^7lEL0d0Q+@N4&q>nUZ!GOh! z90{y>FI*n9q)0wbL$1;Xx0hag@%(gctx{Evv51nnonU3{Y$TQaoxS<~ZZ!2iY**Y9 zo?sCvtSDD}?^$7b=IB^LSJ}GcWMgWhk`MyR84jmuw$RlWdYnv5Uf`-JpZ%~Azl-aJ zUasr<*cS7e3Aj|elc^@K+}V&9F2B%48b7p(F{m+#T`S<0NW0`_xL${esTf`3y6;mh z+G5i+!x`k(_@co{Jl_vR%b(T3j1*x|=6Io3d&fsKpJx!y2$n&(5i`87n!CojmfzvT zIi}|$(%s<@i(nfqxvztORCFvs)ikQ1iF9`DtzU{@Bdj=~?mb>77KcFHsgAW;p`K%! z8j88zaWUSo_Kf4MR0Z19T4p6Fn{EThm}eJSp0-JzkwO+4;gaH3F7j3Bcr;22BY%5g z@e#1S;zGnFW>u$P09ta~JsB66J#zXB^jf&ot_btgclMB&PI}!kaG>6DgFnak;Z{RW znrEmr+vC6kd_D9~ij|1Uj(zlUXDc!aHdI^l!6e=H2rrHo3|0g)7?r7sT~fVWDEzk( znfFre2C0SG9{4PobEXpWqHr3Q99YdcyQbD`tv_0XFUUCHNHp+*26 ziM^+-x^p9d33m5&=48LY3_KUDbwj6avMyQcn?kc8+1fUT9F5QZ83%`|kAsvk`25cE zB8e?^nd60~&` z^x&6d#VZ9C({s{IunlBGM7j%VA|pAND~&~tCX?a=lH`DkQ)rini~y>*;4JMYu(Ze} zF+<0`f$~CPjt)4^(0To{8F5o-ED4C3qx9ZRJP6zAV_r}Q@6ZkvFr&^XtiS-Q+3dH= zeV$GOin!glt*ol3-v{FSk+%lF^L_>$bni=W4t2Cy$55Uez!0cnG-NLO{M?)$z)g$z zZb?FPe;Y(XRlk%k7ZYf88h6v0cRlqxNJRzEpv8u!K0_tb>q%`!nG9lYZXsJ?hRf_m1;z5%3MaSbTN@JM_4lolQm zov2#)b1y;NaJ&TjWeHM9@s zr`SVGI9Vp^5^6I?jD0dI5W|zYL_Lp1_MA#8cx5nOb2@glX*1@qnLatyz^bOR0rzx% zyJ1;%!zRS;s466AIhz%`ufpbmp+EVO4b?BYrR< z7@yh$(^FJNS+}k{x%I?E5k>%cut~>kNTPqF7Gr*qE*09@kz2oREKMtu)g*TZR-vf7 zB%6-eb~b^cuSutnR`RTGpB98y@JWT$rQVD)R^Tmvjq1>35#FA9L^jz|6e&)^_ryXQ z(B?HSGmJ;5qhfZQ18!Ly21iMuo1Z+WY{f5nga{qE~xy5C1r$oq9=9%3CLC!YqU zezIrYy^A})$%iAskarzVn01b3hwVG2CARx-R7O@Xbbwbm4a>FqlfWLX(KTXPZkB0P zS=+P1^tC=Fk^YL1Ea)oxt80~S5}*wE=x8Lj>($Qip8xGQq6;t5Mv{;D&n6tY`4PEb zc^BT`Cyi)o2L{nP?Eq2tdc&Y_BcTCHUNbh1kIu%*q8+QN+NVdi)Y1NzV}Df#&maKy zSco?X*LxafNFG9M*$-yU9RWNO&keZgRnLBW_5<`U0TS~0Qvh6t9=L@p`f;aK3#(%7 ze;Q=*V1Opa-fQU@3;)k>i`K`m{iSK^N2m9HujN7y$w+qI*fA9Hr!o59AK}vYF}%C= z?si8nBlqqW^&|45U76lrow3mHKNajKyCAhj!LD_H^RvT37Ak?pmwpco9!2qkZI9YE zH8cRckQxv8G1&HV78=|5I)vxuFcL4?W-Ax*k*&(3;B^h(a5;tOFF)dr_?9I4WFuN9 zhu&qcQay_uf2>edJC8FUmKZE~a7bpgdmUdFzHs5K@(UZSxG{OB;1u3U;#YY3Qalx{ zaT|Ezhj;^2kNMm;P0X`>!Wq^pOut4HH>%^=o2~|-c+X0f?*~kd+!k1F#ZOi%2sE)( zG00Oeb6z05*T`>_-{*+=DagD>MK=X9lI01#I6X!pMB0A6hvY6ybYlp*%aX8kK+$J< z28S@;Cn!)h_`tPl#eX-JnIzjG-0gSK`jQFO;9!Q{GE?I!EjgrqITbj9`7uX2te`CM zW!w$58+2Asn9=d3o+Fsw{oEJSVUt(j!1vJ&oy!H%B+#y2sA4XE!o8=*T%5{1ABx9Z zp`&d0uD1XByeFB;({q~nQW>a z0Db}4Ux+vq1s>eo)Hdf4kOXovEHa=d5aZT|+eKU5&J0$Dagyho$SItYpy3E~JueL! zoN}>U@k~2N3WB=6iy2ae6uD7m(Z~e-T8Y*A71^7cftcKg$B)@vznvJPo;^w!kBJw< zbi*%{NnH{T-B*Be%1z=bl7MjpGx^HczFxAeQ_#IpKS% zEECBSn>NkV^uD=OX8WgK1Sf)R&~aBo^!GNqgG(Q)x10|6vzrR<3NwDQ8-OhtLUH%v z3Rvly=D^qqwdOzl!bRnuEm)n!af8;C7nYW_AfHOrjl^jUl39s`!JkP?9f{m~a`7F? zlRcDJHKeOrs(cB+5Q9wBdd9Rss^rT0v}x)Vyx`fxHu5M7h=)fLfT=%F%j+2<=uPupYg% zIeF$9B2xr@9Yj9ReuYuiYbxYKfln1Yo-&MNAz!2@M2M}gj{8*p-tc(@Vg$UZ;hxF z)DG*0)lM8i2U8H^9#K-d{(M(k%M`n!+$f`1GT9(Zcq7AC19|uy-RKoK3rMqu`-ZaR^c)owKfP-U zu7F(YuRB=peG(eUB8o30@q=HuojcITH@XU6?T8a~A173$^%pxKW<_?ZJ9gm~)OKKQ zjFMD0%QvTEbSRq^E=Dcqf`sQgW5-=s z^i1HBoanaZb~xF^@1z8*O{HOp8N(*O8jjKEqG|qpwgUn8h z{304FfBBT%Vx#}UR>G%-mhO2%`aLf=+ScoNz2Wc{-_O5YSg#nkiqb@!ro!;A!&2@H z($*xAk*OiL#37V2d(%f{O)vuI4i51EAQwK^}XXm6w>#z+cn$ z=_%TZVMm^gzS0Vnd^^aSER1+c#(K{JRVcWC)Cof@PIpoK=BFX}tUsGWJ!|d57Z==R zl0X2v^J#&sJ~%C|6SM9BZzDo6m)Bg?Izl{-)~;h+6GL9fQ2P?n{ng;zUNe$zNc=SS)KIhkMCu0xGDv-(Weq zU%s>-wZ@T^gdN>k4F@YXsF<4;XK~`#i7t6j?dY)M2dxjD{QOI74~47-9R`9oLf4$m z>cD4HpkjQRnA#r<-zW5Z_-W4qi0vPMcapEh)krW~nDNi(s_ZsVY&297pDv&xXWltL zDD(%>YaEw5nm?tNBcw8AW_jI>b96jE#=PrU{l38}cYl@s-H4Arqg~+-9r6!aGXgV; ztnB#%WBy>E3tGsA=H{g7rM2ptv8BK8-G4xfhaGgm{?x%g5$W$=`_Fr>05`(gaCgS- z2Soe#JsXWg064P`PDk>;!@D2DNx{6wKmWy0fD3gv2m$t$aX1apk{|qMu1BP|*?@CPn4?4sI9)|-gE?#ysEdBo(WV{}?pt${egH9iS=iMD5Y5dW8(wGd8f1 z!)X}dR(2Y)z{VA5X{yQaf2dM)l?-2&-D7ydVS%C+)5_?AYu0iCU`|!15jB`UU!n*U za>bGr&kh$N>doH!FucWjTYlZ0Z7l!1OFXqK8Oa+;jKWDoMhB_nFwide8!#9~MRroS z0%r|Dw7({wU+BJ-LdVq)N+@ZLoV4>BIMsyk7y8#o3X6SC5j{wUXMB5VOCB>Tl zqyrDo?aZ(3o)8wbj?~c8as;Oje(3HiU^B7?7J0i0A4ekKX%&(W-`M5GQDuwxvTQ1^ zK-2m13sT4kuq*xm-uC_TKT_iYo0yt*DOc>M|EN8MwYbBLgwmqyL&ywdCK&DZw#XD7 z_P75Yz$GI`(C6tvw z#K9w~(S6B*qc}nk47^j95s1>b&p56}VM6+>KfO|~hg$<)SlECT?Te>O30h;K8@Lt8 z^lytJ-=rXcN-_qB%NAn8gOHe9jSaZ~T$12=(S$Twqm_4*?IUIX-GlcnK?5EG)Sr3& zoZXWXh>3VD6Du7RGcW7T9yq@A_ACxnB(*X@U%16wbm5RtN2xzGZ){r1?%yT_&sk3n zO3cF009uwoL%1?4)75F7f%?~Y%t`GL#+lv|#7;I3j z`iKks!BqclhtWt~t*a>rqo9A4q&OKk7z5rfX$8@^So}w;~hvx9ZugEmOqffmSo{)?5xBU%NRB8n-8(wjVmkb%fX7h-NEj-DTW}(!)3~JI@auKom=R1Fp(@6!;uclfYk|czW~82xsrce6AKD)EmBkqG-UrT$-jn#2*j`!rzPLR!l`-E8l!i zT7y3cf=;&B5l(ZAFCr`Q@Pg;)&Y81#6=`N|SfaV#m`)|UnK52@+Ap-jKMBM}l)8Cn zA=#YF^B87qNPy1Rpy_a~?JXGU50Mxk6N+rgjaIM3%_g3_%)n=7XG{3m z5d}y%+E6>U5 zd~iVrm8@@hr;Vp^!|^Zp(X2)sN~@#3k1T&+s_7(^IBxYYy)H$Ao>5`PB<6N+A2tZeBm2DhlU4f3@(oGqeRc}tFV(-hU8FJPvudIYlZoCk5`58l{`G8{mg zU=@t)bePy%QVhN9%`o$6gCZp|U*NB;_vN>Ryh^;{5n3_1j}J#lxpeia#iSiAxm%j;qFx z_72eqifMq-17*(ceZr4UZf6SSF4DYS=?Fh9O|~*Z;T(oV?;2ji;|2^@n>8sBE~mX9 ze?OgahW%}qpgV_j&H6XZVb%NpIsB9;L8-H2opI{-zIUR_!=^prm>o?6h0v+f2Z_xS z`k}UX=xlDI;Vayp<(qWEzRJ@aX=>2Y(SKg)NKn?#%M0w}-=yg@rFWf_R4cy|+N+@w zr}Y5Ae^2)pt*oweeiOyjHJ1$21JngwEMj{ABy4wpQ46-$Y7ND;s^AYF;d|e_*y*95 zwd`!RVo!gISFQCDZ}({{Nwt3EbIWURy6{za&DlL1eBK{AIZ82_KsUWXDmL2hu{^QvoeIU5oS#t#wemcpQ5sVgVb zQ7EVYHVk_qn_PX|USXc_>R6iPcq6#LE5nFvx}@+;B_DqTJGpbCsj)(9Xmwcht=2oh zSPAQ`XYl?&R{3XLzv}m2vUZ{0HYW?Bk?bfC;XIzY*BY@b*odXHBtO%8+!BSkIf{9< z1I;LFUJ3)F<84f|eVQ7~Nyd6+hmAs31TUTFNJUl6=IKaJ@U%@U3Hz-;c8dIMI_#Ud zwXJdwnV$BVLjVhZetzyzrsw}jOkKPn6$MCUKr3;UEY}Bqq7n<7XV|1ymH95XUtKgP z?zp;y#$JEYyGr9t^48Btdh!f(9>LHU36C@j1>)RLrU^y?BXjWlh%2CQqrSrXLNj*u z28IDq-p4%*pVhfJD&C45jpIEcIz-SCXiKMYIb3n{W&21j)$9 z`Dv&q8)o`9&r@17s{LM($jg_roFRBXN_%P1@5*eCBYE2YWx@McT_H#_Q_Di!O9P*D z-|Z5yQ5|(#z71C3^#bpI7Y1PC$sy_Us|7S(x9aUTVrx3uErG7kZ{kw5#AQx zBe@38ar}Zzr6P~?t?evRs8%!D_%yG64dk`mTR;T4EGz?;(rL11->?ePzu6|3GbNra ztKsG2A%;Bb1L zh_!*HirX{9JefHMP5fBiL~?bmM;L0IzTXaO@F z{CuiwZ#Had4dbU48J=djxAjF1O;g6>tYiet1IhnSEr0@+!*DdD z>&dZSbUY*C>VJdjFMIsxy4=^x_xM{=OZsNS%)}ZpmwPE{sQK@{d?vG?OQNTyBz0Lp z&hVptNk5s=9l9_I@nb>01H*b^3j_VER{3W$z!0^pRBl zh=k^mKNa64zvy%K2&aoaF)&{W?h&Sqdiz`(;%^WC=r-G(2393OFc5PDwlI0~Kj;pw zh^xYDl@HDd(P0&eHe|QuQ;WLgCqOa?hsIoe0@>!55|q<|Z)kvWx#bV1J-=3VGq*OZT3~@s>?(9G@6s^P19}{UAWPC|?hbL0L(>GQ^x7}nI zX=hWD`x@TG2WUI%Ik}uXZg&9nppYb^^i(gL%%8|m_g2S z|D9#Yd{2LBIwPGLP$YDahS{j((;wKX^c57^PE+uZ5ifnyObu@|?L_WJa)8v@+Ce;K zWW}`dv`i{@%q?#k(UI-RM1#NE|degDMi0=t5Q z*N}Vfj%la`bwwogc?sjfq!>Isy?LmZT-@2_t933yUVz%-E{675ymxPIP-}ej0kTl& zbWH|U`hi?4%00RsKw8qGvGShD8LPgn>GPXRHnnlrhmjUtO<&PSDGGBanZZKY6ZBgo z!P|g1+u!^~<0YW#RvDefFhMy6C75Vrn1Z!*aOi}-5@yl}sPqtnF2Ts_*J7ty%!Q{# zv(u&MT||-ELNV(%U9k(#umtax(o$Y2AbReEskqP1e=#yuH?ND+fLESf*l+&=2>jon z`R4w~2k5ARj*N|=(i(hr1#+rO3nB>O>@-+#EU9{eD~+(|&^K15g**c{WDyqAg_ya% z4XSn)dq}AhHnmXz&r~{s?U^!mQaiW!^z#^5N%Mh~9PFvv^H@(Q0ipkE=i3~jXPXDc z?A}9%z#CDNI*+yBG$Q&}c*gTKWcGV6;N}s^5l9W65MaAFe@|0DU?6ZaIK3uf5S|V2 zvz--|F~(x$+*R-oP{^+Dg@C8r2E9d{F>fH9IdH#3$$bmkL5}3f0+L79S#y)=n9wi4( zjZ4a^)*n>qh2}!-n`;;L=^cDd0;<~k_s}X5{}(k+{fC+v!ODq44+5_gn)078hLDdV z{@dk!O}}&uVO+}==)Wd>)6vExXUk)k&1XE@u|pjX{7_xe1-z1KlrFDQg&Ucybg*IuY#Vb{H)g@ zRVv}JlzV;bn!u^MgYeQDKkx%)M1rQ&1R>L2{*FRV-~<-9Rz|lxRn7@|x=JR%Wciu}aZAbMuQi%)cPo$Q2Jz+OmD^VKcQ;KA5ZMlURq+70nz+`FP2&a?_;synf z(VH8$tlL!>(NL$XYFWiMrU8uMX96>grJ2M=%X}QwYI%+!^9^v)w0 zKbhL3A*JDuAVCQ>+#0kLhja>-m~ehby)pn+t!N8o@Vmw<@p}Mb!oDpu{HBR9 z$TL8;yQlg9bDfZ>%gaPUEhFc`bJQNV=@mZ|lDUsB#OVBmfy~6<%k7rFDIph^{DZ}h z2i}aesMwTgEe}I8ReA8CXF)ofjM$84u+U*CK}~AS-4`zHA4P@j-dPjLsmxU6X7Mfr z{YSqDq^fdFMGP?e8s?GC>AJ$FWX;vewv&ocii?rQVLFQ5%t=GbVb-%fXB|>MkH9bp zlk<8BV`simS;M)dTuK}r;^SBPW{`l9jpN<&B$0=DPciSbsdTx$J)-DzF`uVBE$W-> z1dgkm%WXMY;yo=ObeAo^_X16;9IUOzWCRz7IJd2IlzY*I?19Y=EK&d#zML;&k&>j2 zy6t##EddeDXGYSnSTP3#r2BmK9ibroEG}YaB-BaONi*JjdwDC-@;E6*hkcQr01scV ztDj$TOz5d0Rr`YVMhVsp2Tz^t7~4ZoN4JyDVk1wl*$Hp`dE@zlgeET!YK8v5Ng~Majm!b3$7F#wHgfCFq<&>D zD~%SbOR|i4c0A6HlsUYOL9CU}==NRA`%y;n+5v_l*YHP@J2(;(`@sW&+T9^k=FWGr zhPy5h=iP$d`G;JJyL%`VPfR%rOU%rJXUfb9 zo(B9cg(aQYEtuM_W6Qz)Hz2wxt`4p*vJFhmWa!Q8U#@?|4QTTt<%-^tdtq;{u6i3} zr=kFN$C|Z#+e)_RFudfFcoOp)ShG@*gVRf^8~d1}y+wI-!sl%l2H!8^$}6bT73iUM+s0nI z#)IjiGshI&ZV)glTDZ_D@uyn&e2`2N_14CYxn9!=+Ch@wg`STS)x&fw=*$tX=Ye83=ov^SUg_Xzi@+3$HB{IFi}tx1RBu(< zt_MbVA-v-B5IfGJ<-|m3>zi(#zLOvM;&+07dms*yRp19fZ>Q@CJ81oD8QaJ;nGUqr z_R!&$cMh}D&(3a7a3W^nEl=fC(i+7g7jku1zV;Xx8$3UoR^A`q>$&SebR8PQ9!^3= zT10eYM1B{qL;)Ne9m8T-3RJG2bG;d>U0K}>*#a8hv3YPAL0^xLyf?5k8?zKstxB-p zp$bOTL)9!HBu9yrt;Aiv@-o#adio%XHM6)xJnRe)jO2NE;;iKhkKQ<)a^of0mv7pq zqnkN@C+Uk!3&IMQ6*`;5UTga*SCSmjS^b5Pq7j@+lSg!~mBuK&lITr(vvCJt>8mCz z+?kqk(@~iMoegZLFW}G5LVBidh>S=B9^jDFz`LMt(!lcL_Qt2sgza^F7xl>|35q^} z6q%7H<)`wkS+nCsHplK>8OEXS%TI1`J2cyhi*;}0fU48?Y-rdcA)-RMw7X@}w*uMZ zV7mO|;i08}kylyt6kE|tRb|^6C@D$@Xc$g2I-&T)Jd;=-PBJg@nrhi}B@H04@tx7iWs}(@weTgHsje#>@w0x!?>p3Ca_1wA8g4l}JRf+GfV(rS zq3wxm46y4N&;G@b?^^kP^W^Rli1{ShU)Db1;ik~6nYV*>trwB9>Yi0Bh)W!05_)4c zX1U7n(jc3^;!Z8A4h?p;sulg|>i3Y**?iT(TXXheW-jj$%yoE4G8rn|TZY^^DG3Vn z=dZlJfI&>2qRMGY+I>Ft^(MSX9Ei}GENkSf$CnIZeqC-* zoXt*K-gxd^?PWKOdFtt&h5*c=gAbe_IY^^ZmQNgVYH0+hgp!Li<&B*)eW&LK51_bp{$=B(v)t$w07;9Y1m1LWamk$K`d(Cts)M{ZcjzBtT&QYZ z+UR`{>cwXG^f6$X^{7N*cA9EW$~q)c#op{yK7od}DeD#Ujd)zMbm}o~PbFEL8Bsp-|>VxGA6WqhK?33DS-ysYyv%*R_LP>2R1ic4DfGY+3r zopU0N2Px1xYJnFpl!lsy$cb5RYIc8AEwb=_vb6QLdXv^2*in7V8NU`4wy3g2>L)C7 zokUKKj@K3Nk)4EYKcf;&9EmwW0++#3J#i`fe}#>5Q&)7d<<#n~zc)P=&L6m$5uBs& zL_9J~_p;=09waM!DyaPgjNxLdMq;f zU;eb>k8(yaXk|6MJ|%f{Wd^-1r!4LGTU||&3(FlKtEscJbb+S7`=4p3qi``^M$XPw zBimuLCG=IP?4J75uSsdD2f$3vLGN*zEB$nH^1I0T2)W|4&@$vQc-Zsd%JsI7K+I}W zwBSI&u8{AdEugFuMka=!YX=K$cju<3`W&rF9&stfvrQ$4p}}Al%uBSeWbO(1ZSrYA zb|^f|nBPK}#rDUvC7GP@5BYFz_=Kt)U7^|`VLZoqO63nc=tg|~RG@+6^OGj*4pdDHGfHPVn));BGdd1Vi?)zdImLAJ(1_b)|}QJ8Z!A}g1Q8Y#Dd1W7fi#h z0)=)2Jr0|y?8W#4LN93r-~KBXL~WnQ{c1$d^9Cr4nxd9$IfA!0drCccg}sx&cJfc# z1gvb8@>8>?<8!sS#d=hSLh<{>ta~hlyhrIRSBW}d2Ef{5)p3JA;WiXF_GT=T$H0bZ zJ&EnYHhV^#r{gA>IR0M8F%M7(d3V0&I=Q%*q0wi+6>`qwH?KMO@7eKhe6^s2Z(mQ0 z@AylHrcK89KB0Jok#ljPaB@CO6T7zX=;eO$NT*RTa(QF3FDB=Xz~ziv?|oIsg@@#M zKw0+HJvHi)&6mTS6WdPko6#VQ@J_sJOxiV2G@GX|di$|UgDH;_)NRv7M~0EWsEw5G zJ1%dINudri=*r5YDANS^D~hRiT!~L?Vg?RWC|1DB>ea`jSEh46O7q zw3D~w<*8~M=Pe~njP3Q<=k4Oi6_7J<=UW=xZ`Ty-4)tjIT1uHwO6-bpOWPrZGyJ)E zOgA`Zi2~h`%dJ#lQkn1M_x%g!jcNT5jVNztD`hfvxD;0o5B(A=Wf?jvZ>y?3ZQo#S zg{x5hl?Q(;b-)1*ectn&*(y~*DDj-B14 z`OANz4+s67a31pW$!7H!c(OBgbg0_F%2C+|6L+;_>3g!UUZH}KA+nN0EZOJl+WMX; zP}^?=q;6$pGdCUCid^_(u?-351++Y{({4_$JJ)v_BD z;fFIfLe+5b#r(ygIKz&rPZ8fa0fok*L3t=WDA{bkr!V;Y3W&;HB4ZhGE#xtQXp94p zmS!r^e!tG&N=AibT+dw{HhUO{OFc!zx>uKwllg+8U3Sb{>2bnuMa^ErxqMtFD>RWl zb*Y0iyqJAFA0bx^qHRw=vXXR>IBh~022IVg1v9<3^6#PilAd6!rH~c*{1Tn)V%Cm{ z)k{o`Y*$)_y@%bU3j=-*4KHQ1C=ZlKODsi>bfSZ%8$&hh5LJ%>{xhk|7yoA7nj**HJWAVPV?vM)wXE9Jk14=#x<%5;433VzraY6YD45A^3baN$|QsslO4J zrIIlRC}U~RHWxry!OQx%{WW6t?TM~X4CEa=VO!o_(ooy+8r%$lXsskss0F)#xIOX_ z^%7fDCAA{d|D<<{Fd=7xM=`Gi$KJ3YKr@>FQd~NHv6POAwx>Na#ts5>=PyW98X&IW zsk7W(Lk=kK0`j~G2*n&nT`pf%#Ju44rt^{0BZ= zGD3)=iM^xSZT+hN4aYp2(a#7!{o}O?>kd>NR+sWa-w54mURQN<(ZiOGcWigy zjU7e{D*2gx#ay4id#!4cMQp@yiJjB%&moJdwH3y(UL_?moZ9ClHu%~9Kd#<^xzecX z*6xmN+qP|VY+D^09otSi){d=?ZKq?~ww;{a&-=XReD(c;yLRnWtL7SWTw|cTQT4ke zk!ndq5-aW?F`bH?P@1Hn*YrUjF8mCq_NZxkA4~8un{`nc<9{QoNpw1|&5|lIep7%{ z}`B3Hz74KKN0G#L`vP1M%$`P{0(gkrb!O*H3(8E zo8v7?iu2{e=6%nUiMSz(fETy{o!`+aE(q$bp#e_(L80@9Flc=rS{HHIKPvN-o=4jdfCS&q{f zz-^;k^hZ(g69T7~x;=Z`b=uHH+FJJS?hlMX$cmz9=akxjvkC%hL_5!Yx%`v?daJWO zSM1wRE)3r4v(tK!^~(IDtI%N2BqQqT`m>0kNs2M1!8dwU|P->uB5KL`uLPNa+xh=G9J*E*5<{ebb5$o z`cNklF6&!^U@{QNCrr@wK2>OFeGx+CcQZ1sof7~G()uwULr$m`bSd!k$=;c*jzJ=O zKit4Q4_z^SS=uQ~ybxW)2`=UUAmbd)J~F~J7q;nev@N!sFV}yy-D$<)*^zrIIL8Ap zpMtTRZ$00Ayp*Q+izbkKraq!@mHH*KRK~ckEN25UQ648$u3r8&Y&GmVikn{!-Q*1w zYG(2{6I5A8nH*kaR!PGhwqR(Ui5!bnXP@ftUtvZ)wNA8(k9`-Pm?v!qwBULI zR6NKi1$Ve5lokeV?ruIlHTw7;HK~^_K?jb~(3iZAO@a4M4(ol|z=g&%5qpkLxq1HM zo%9#bq&4%E@|8UKMzV%ri3bl)0k&_}#t9 z&t-S4=JYS&1HTqo-PS)!oa|Fa20QsAoX)>-Tc<(UlEr=jc!i}yZ>Gi9%P%Lm#`I`u zcqm)?j}{#}!Em@$uZUC893xf4Cbn%(A*tU+1chBPP_p;dJ*%3O_z;b$rTIoeZlueW zF>C0gJv3sZ6dl5SRZx|X(UPI%$gkRRx-MY_k;XiC<3iGZ1O@gpJX#HmhJDJz)PyU| zO|=HS9JPoOxN;rD30Gf}u8$;r1t=qR(GR}9j1ijimiswmXRG1(P+EaQQ4b997W zQ)(3_{IZ){_}6kIaxW4^-r;Qy!SQz{2TJnn*?Q<@wF}-5y;B8amm%7?i{GWvh6nz= z0YgHPZ|Pysa`L_C)_cb!xfAS07L*AE9dTy8`gx8fXieX;Zf`1n3o&p z$*P2B)<8d5n%roW zDxM!ouvIGD6&7|)@*QC3)5ASx1FvWI8K~=5y#wuPb{8?A7@2@@=8bOTnNo=1*eWIR-?uK(uPsSl@Tq4FLhTi}%y#>1e>J^voZ>ta1)>nm zMi#OdPd!|uD#e)RIywPAqImtf(kK&et`qR{!g(Ue1Zpa@4+rnKc;YyTlxE`54_aIw zg_hdvj7468T9OGurb~yQ&ZWvWO(Ei&?IAHm6D_wc9olh%N(-&q?s$lyF`s?a?u1u< z5Bd4r-K7|IES463=GXX6z7*~<-#H!6V_>{*)`E;Zz0TM(y-o2&yRx7kHazl^Yp5*p zQOTQ)K(c>=FMP4W8t^Cy=^*zfUU?)}Cf#$5jaE8O4dExOV@g;0RF+$_5PcM<=-hN> zRE8wTs)wIft~IpKV-TZji;9KGm{Bqs`4*LGpLkK5?i@l1#nt%K~Mdl zt#~~C3T0wdNe*3U z!Vk!)TM+voM4RTR4)M1fu#p9A5+{f*mn((_R+TZXCnq=T6U_;vk> z)K@>erCrUI%It2&4OTp9r&g!lu$6NdIe4hEJt+1Dy=}|)PeP;fY z-%l)JO=RKhzK;I|xAmrP0_vu|=xy_Y!ON(EsqfcWq2}Edy9$=9@FNnOS+vtngKp zioADR>UR89j{0v=(WmTuz*bg-4KS7|ViEzJiZN1tA2S$Nm{H?AJzR)~o!MO)^}lQK zCcy0dGY(^WP(+s|#!)Lra9j;Sp^Am01;Oe!$;RM>pn@F7C`-QvF0g1rGd1|5e&6A( zbdMJ2bE@4CeBuQ*vjE8-0xlV3G}?7wJRNxCwxg<_76@+e(Ung79!yEQk<1ribB z-?N!-&&r?>97N@J!A~{nscvX33E0&%ie0_%wF3_-;_1S)`V zj$)5OB|PREu{Nr;isikU28+{70E?CYb=I$iDi3efG|Q!>g#O1b;xhkcOQ2?TCHp?h zj<81&N?fp=ILVJ*qqx>J?~{DFOMEMx;w+f7lp9y{%dELi8sEx z5M_#1CwWoYl9YahJCR-Q%Xy3d!wD9PhJl#)j)B2;JscFV@F^t8!ZPmVO>T?zkMBwj zanVKW!apr{3^QQt;J1dxa&V)T9uVF}VVpY39Bu?l)*`7sW})X9*ftF7V=h zGEL&wCcgQ=&1beJ&U>6bOw+cCOZk__X>Kplhudi6E$y}|pc$-N^#RY}%YTjR+1tvt z1L@GUqqruujd3C1^97so)jmUby`vzIX-uUR#2%e3e1D?+@VQo%J*K5CG~#$cAWzWs3i9qIo--)kVx z{u3U+$M4K2a4VSTu{{Lt%bJ>rPQdtlkKs(WS!1;_lbqh5w|z(_kN_kE8J}= zqNZ$ux+sIz;2HU{A#!Vp7(Cqz*37f~#ATdkss|12krDAs~K^QKLWOH$iAposdgS__DArpst%jX71t*$!MP=a@S34M;-06fh!qRy{h?U0+j}=@RF209{Qq?ja6^$FM4jha7 zGl*2$19gqfxLnW$0(+cnHZhGOkVJbEHZwttJK@EgA+qTMbNFIq|INcp@;Q=ua+ncT zq*JX}vw6q4cw3F^WWh14`|1fxqlRV(+IuDMZoTZ7PU$-BoF=gcixDnB11>pX3}Nwt713qW&U}{eOeg#a1aMT%6@x31t6fP7;^}}O+-uSHP3bJ zXCF7|6r)7}c9pMUQ!>yt7mR-n^v&(L2$NtmTEoV1sJqA`q)K@O%Q>VjB8Z}EMj4Ciy49jPf^` z+XQ<~;es|cRIgJFp~lT4CU zjD<$T++QY#lHm)c-8TOizvi$acm9mmRESl-L)i2FL9|N05;Oh%gK2M_+UEFx7XqJm6s{&rNM%|VK&=J-DmuA5N*)~zjxnRRnd2uhO4Sd2R+^#Al zBNLPs8AzbO;yj^`#2qtm5;vzDvsBGU{Nxl-R~znVkQ~vUg*)>T5V2Yy9ms_1-)cQV zQZ^%0moS?Nb;68}Q;Iis2SKg58jgj1A}Yw(*KUXQD-JbzH>ZY*EMU^_ z$k!SM{Q!|eCh&z3FO2>;*uecfb>Kzwb6g_G!e&F=g52yMGniCNieR%bxaKAB!H*Fc zB#168ft%=`NnT&9k9Y7vZ5!4LIGNQnt$7^EQ{#15q(m~A7r1D}@vh-t1p}J-DA5>< zhZj{{U}eb3pJ+HBr}`;i0!;sdxipafJ~Sz0$BV0%?2>RknsQ(RpdFMdWm5pKVy4L`G(5_*(4QFWNdA)7xkZ@td`QDw5EdOVc z`Hyu77$qGqN*sLoB_)uyV95R2?H)e@iNonHdUbitWEXxI+nBVE{$+?w_@0B90w|82 z9OJix`4XTvoc@a(3&E1MPvsCrXT~sLMTIVR)OLOChq_z`9o2L$p69Gmgfga5$OIH8 ze@NJW#a=&NfeprGBI!9~g3M#~&dfll0pn(L4a)XMN7Mj_iI?lS^gOF;xveUCnl2WI zVZ+906v*GOsgSxjw)z@>{uio2m#7j2h0d25rHq8%td2ywmFevuYDQ;2J0{t`mRCJKU=h74m;7dcRt{sia zgdAm1UpHKQebw9Y&qwjj%H(yCNO#Di5kDB*e`ska8y=s7dHqbKspq4KOB@c%anD}7 zfi*^2kAA1%GbinmHJ+k0h$Lvc$nOpaiVkd_u{g|WC9Ii%tY@g z!CbuF^hiJ6(LXx~lMaxA%V!so$9tq(p2kBSt$z&s+s*6-sqkmU8>Hd=TZe4$`2K36 z52ech2ZZm`9{QX`uNq0@i_LhVpt*XPoUrg#{vtP%Sp@s|rC95nt&Hy0`LW&Q%2YlU zW>ON1QfgzUTT&B@@zQlO1!7|EVq*`_=8GDjUrr~4h=kfj*c@i3`ikWAtG(C> z-p#lr-pDP$6z>;qf+4c`1K)1UcNdvq(hpLC#e@xhv~Of5duP5Ka{X)kZC?uXWi3~s z`{y#|G}0j;_>OssdM>KU!EVYwKy%TKPhIOHR9%97yS9!70}NQLQy6Ku!d;O>Pcw0; zeetc-Y_lX$RYYip1(l`*LOVcKMy|2YjnUB?IJKKsJ+%PU9tCW1Y>&U)0~ZCr^d#~jWk3|2BGaHknCeST$9?*a1i%6XmgO>Tfta76=2)f8v?&R z&$z3bDS5Pd%xZk&D)NvO+Y8&K_TE|VYnV&Mxa`MFpcInDrA%n{@MuwM%!=gNncJJu zfAORY*r#I|CIfgu(9-z4L4abC{nsw{(|Wooeh1J_zICZB9oA5tsk>Zdvd;|BO>Snb z-8jFPfSaf%`OZ+9^L%-3B$k!8!S796kt_Mp%(Olw?0kfnejhi5pSylR#v0^$g&xk> zqSlcax%nFHSt;TP-0-z8sWc@oh^Mk+Cb_(PnVwjx%QezQZuU?#m2k))OD%F5Nn$97 zE(bhlZcrdbXzm&nH1#>|0D1?aE59L589Kf}7z>u;Yvr%-{qtodFoJcfSPwv~c9M@~ zN|()Hyl_WcB(;|pa(fAX*Yyd;*W%-NM_|^T9EqOAQAtDyrJZ$l{Fj~q+um48f06de zVa)x1ty(Guf5TUc#3cjeUV%{^9pd?zl^+n14XT;_YFfN=by@dgudsc z-k*kT|0P(?+g4FWC(3ksnLSroAQDW69c&*q{Z9x7{nxZ|%=~P5&hPsahGdz4Za$-f zJWcnoI3oF6{ai?|QRQfXm$KHx%a*-^HF)QrkUc3+gsVtUs8e5t=HY~uTOOHod-(?% zW*)m$I5A#{aC6}}2hFa|gSevYkx!yGe7h+9OrgWsHH_~O>QDh;B@cqQo@V69=KVt! z#$UcSS&>}V_a35UFwJq-YFj3J2LJfzk;36SwOxM3Y*IGFk3%97Rt=IUO@6L-(7_BM z=wcLWZx^UGp9evrpE$Z6GMoLuD2GrJer0fA=f{ME;krjT8hU7gjh7$ppNA=v^chk1 z)hiLM{NBh7PizMZwlL!oPIA7iamRe5@h!T0IW%i9K^Sr8XZ6HLU#M+9ci&WkyfEH? zL4xFqr|iPHw{%OlAf%A;ZI{9Jq?pto*uQV{O%2tQds2qL_hr!GqK`TIS3dnNg=oor@My zSflk+-_eW*Umy!Xz_@DBU$O0_l_86Rw92{aQKH@@w!xwJ&n`mp)#>d zqGo!KGueUMcE6ypK3_w6j`JsuyDQ@W^HTzo4uCd6tHeTz8A28~&=8`wCD+>2pDokL zTMWwjYUFwq7j!PK4yZu?V8Mo?PW-ru_y1@(2jhCW!H84wrLux zH;~)>QN}hRrmCz{skBZB$lT;&{97P;2!?30F;a$WStM_f_F`t|wFDc)Tziu}E z=z+Gy+c=%8B%i6^F1KV7*Y1b~j&B;y+CvM97arIYT3X%Ut*YB_^)f|aH=9N3!l*E+ z712u^rldj-YgH4}k0J)ARS{CQ9H+qaIN^hPofgt^o@~)+;{@#-eAq1wp|T#C9xOHb z)KQ+Y*x9|i?8^W2{xdDqRs&e8)gF9q-8}y;z{5;{C|V3W=S_T*OC2SuAAhDW!~Dm& z@c2JaA-JV-G8wCXEvkV3NA4W~1`k|i7~n(UvbvYGWL ze-~AIQUWCPN6aE-kHANaA&RtC=UJ| z@r5FRu$`2M2!fFx<44If-Rvx#GI)5`r<=Tf(vckgD z@j!o4%rlTbvFxhMpTe51v)gR{@*Vw;Q4hufQ#Bzqbumr*%y4-n&|<4yB;`AllA)ti5G(Y*H1v|8*ezPEsI3UmZQE{FPae( zSILwYK)T0x$J60=yHNB+acznViloe6Dl^y8G+qEJrfSju)|@pxr%cDb`vp&B-Ay&JM)wrW z<@;IOn>L$b{*SinnG?+o#P&Dv8FBa(&kudZ)OYMbR!rxM~i~n+O11 zZaesu1$`PLucgB*b)+OcM8c?jpmwMfyuMI>ukSxlWMS|V-}XB>j_jiQw-;Y1VZO!} z-x}kIq$#$XOpq*6L_|L-J_?)%OIjNdQg|kB6K9wirvdlgiqSn$zkO^ca>mrlTu!CC zETIWBOOxzz}?Y&w<4_(N+4tnd_(SQq0qf&;7DKu!cL_cDnG|il@Sv zmUx`NSJ;69#5OgFB6CbfrKl!>BMkie$96$okg^X##6C7}vmO59#-ZQz6^ZM(zV01% z==5|P@_Ji%huG?g?A`2cmfnu5D{qP|I={5;tkS^Gfw@Od_6|{jfrhgF839uG5@R=F zmT`C!f$Z4n?>QrK(gi1?qr&>x&~|S(lhLM;*7tQk=UUKJ%dHv~tw1@l3ORp{8i^C2 z@g}3sOPMEVB}Fz0o(l&oI+_@PCd(o0s@u+1E+wiKj#}kx+TS!HZ66i3DkU4Ea0}u8 ziFMy!a@-If3qVC7Ri!I#s29c89IkT?3edV^z@tpIsS@qjXT38T30 zAr~98q=2EGrnEN%Ak@X~cH<^y5mojI5GfFY*`!3z>0n=ud&vD ziW=oDdwRCC(p*MGNUgQm#7I2BFRaoJ%ZBen-mc6}SyaK8Vldtq^Reh;QDeJpbzZ)6 zqxC5bQywDN>T1F~d`WF6nV}voc5Kx~SL?BzuDC7n&}BeLL*%h=p1G!q z82^o+&P3pMM*@s^UT;+5NKLYh$L*1IM7_el^Moy&yNl&fo@yb@NKmh%SdO*u&BmG= zv;C+WM(xWnP1hW=vv(=*>=){kD1>AWw8JZ6QXX(WKl?35X{6;+@YvK%$-bjUuh1|pS-eaQC(qslpv;9NURU6(O*0~x`)l0*#fyR;*U`tBxYdsKew9G z4m2Pe&0OmsIz+okJauj&%VBIJE(7$&$5t1k1x9n(XSNnISZ;k5P^l8i&d7sZEC~6L zA4Nt8=wVc&u8t55atnx51m?eoDQL{`h!s83iz;Yw(Y``Plr15l_t|Ub%L$T}m@K~k zV99Abkhb5-+jwd?JeR{d12i>Vs+6lpWx%VnWe!oY(Py|2fb(t!@Q;qpdU4TLJ>%>Q zJy7XutY*csrJNC8`;&HQv7tR)+V7Q+;}0+^X`h9P=4}&_mrRxc^v4c!2S`dZ!|WXVpDw z+w#%8^TZ-5*{K*_H~Ag~rP_f+!`Re0={bz#{)nu&7-9fWZ^05l&49VBhM?W7S6$~D)>n18Pc0EQ&tgSc6IjY8<=UQ^$T$oMsU+76dwFtI9BuwvBSd?EUFyNmXt z-ncsA{(O;fb8C+oCJuuCp%A69c-b8)g#DtQTw9QRESKPuje6UCyT$8b7n+G?>koMS zrN~yy6?BxKcpjo9dUwNIRfb`lwRmaz%rDcdzGHBPV_munY&h$PB(+{t`L9k+#Ry`y z?}aYMYOVLFanqjWyf9{tAdfyf9>@bB^MRB5n$~!4j2c&)Xsg+EQNHt(c7E$LFvbi< zfCcPh;Ab+e1o>a-`xt8E$ZMi+I%ID9S&!3*RWDg7?7FS@X`+Q$HZSzr8;3fi^;Mp_mbgFp^tQIeGaT$Dh^lIT$ z6m6{+u4IWze5-zJ7aIN`Ti8!5JnGR0omi_jk~nPx$z$j&J{WsMU=`3A|Kug+c`w#k zaWM<~uMeZO*bg{{$W@zlK|0?`0?};)31D+t9Q?IN7UCIr2ol{R$|9I&hJXX1j*dhy zi?1kP)t;n7NZ=zy=>+n*`~(&7wzypb{cv#$I-NkB(E$&DXtO$A6x!%vbV(;xbRk$1 zgz1w(tJJbt3Rx|P2Dt~_Q#EN37HlnqioPo^DVh6~PF7nj+m7fM5%rE}rFs!#hW+GV za!0oOq#auaS}=xX)Q4zCD;qvRD~RdVg*E>|&eh5hf^L7!eNQRyTwCw)L%t2#pj*8t z_@yPPVFHk6KbPU@E%7N)wn5b|Q;iGaO~_&ceW2=l{7SY)Z~szItPaRPKx0kBy03b_ zPD|SNP+5|MU7A&PN}oqz99bX-WoXdChxg5JB#L%~hL_^+tkxZhMQ0wb_}?smgwNwT z8ab-c?$4|+xJNJit0da0d@w?{G2p+-#}B+Vm`tVorE_zzqSbuD-|EbrnSYSuwc61t zIEJj_U!IpI=&DeKoQ?GytUnBVDfcYKuKyiqM|&VnU1QDPsg{z(A}`W`KB{g8V|+%6ZHh ztFJ=d64$l6U(zKc)}%6;HvQJjc2Z1i^nh?#HT2MeQQ)_`3wwgGMOhP?Wi?QrXU zMPne{)Ow~6dPyj3nErCa)DN1Fk5!|E(5uaXzAyHq<-qu-wF|LAs31*BL-LzgNgUdb zWS1-L9V0s{6G{e)S%*ojg5M%S3p&i}swEJ*XHD|D@cK)#4h*}uq=MTS>Nop=Uzp-) z*I^lNXF@a@19y2Y2OX>P3ETaSxasPSA7qIN}~r*NA*DUPT{pxx9NWx>M=a z>u(8$t2k5sOy}GPDt#r(Njl=X>lGW0aL=^2fF`KGzqwsuq~dVv)QD!>XrtT+jGBGp z)ZJF1)gbNi*nIJ?|7qdyQy*CGqRLr7@Hhl#!^6MevB}6CL!ZMZaSO(j-|2SZ+jd41B zg>Vfa1Hm-I85fbg9oH=C3V9#t;^MtQrQ3Lm$wA!xrG4oH2fv2c=qT9M8AdOO5dgld66AYmkM`$*v9Dq~LK+9dw^l!V5vzG+*>y!!z~{3;he94?aQ`Ie_i8+Z z!7Sw4Kn~2B)31st65$ahoLC(9!Q{B(O8?M1eC@&kYC$UHM@$Asw1 z=i0zi@vsrYlTAafTy9?0GA4nZA#n+qo_<&aV#rB1ewLiyvEEy z3mYsLHYvLG8Nl4^Z*BEnZQ-dMZzFP_(0_UMTV{V!i{A;e_7+;m)JSk|#Ib^`8Q`9c zD;v|K+sMkd&1SjF?pa6l6P-x^>VN&kWBr`ZrJs%G7<5#ShwAC$6?*?kI=|YQqwIbm zVX>{D$ncsuBng7C_?3B#KddB8%t5sYnP3%Zt>KO$!@Gp~nlRS^CJ6yA^kWg1%lDeM zW5=q>zP*xFJ|>t<0F$j~=hhEC`*n)>d~Jo0`89^Ug_S=AWRhY|vm9P6o2Dh+J7r(_ z+i;CM4zL-Hf8f?6-uN=%4@gmsAWzPRaHxdbHs9#`BRm>htdP>I;`!xQfRvt~l!G<{ z@XVn(-AMP5+->rwbNG~VhEzo1X906+cdGyedJFoR8NL{}5HI0NdKHFKNsjK6t)x31 z3Y?1?rn*AP#ykghzSwsRriz58Mpuzr#0eBF7^uj@Vf$2kfz;gHJ9iW27I<aL-ra2Xe?>5w(=x(Y1=1)ox^q*}_O*M?G2HIiJ zCO-`q^HCK&)<|e+aZlMr2l&cASsgz&!O6ZH(T0zS`Bg^jwb3VdyQ5c&E)N8NBd`sc z#kfW7{YyxxZ!7osAv+c-vz3!bhz%p5Q-biZk4a3)9Rink3FXGgfzu$77DSfrBMN75 zPcM+~UG1aRltI0vix;yVLOYD96uShGWY2-mzZlkgS3|Xq{RQ52Vxy3C?PLodwa=#O zW*v+19_RV}Kvk|>V$NIrhg4S}1n95{oqY?Mo~W`n^Li#HiOD4y!oZT`QEW`WtL^kC zKW@b6%E(3&x}Td5;@k%rw>Y>73HJE=3*O*68vvz=Sg^mZ3R!$$%XVaok(P@>d>eXOMa}~SF!`|3>amcCnKC6r}nS`ih=zGhUCcRppYkl98_^=%V4YrrmZHU%S#}FZ~`Os#$8z zbE=Aq5)2-nE(MRhKQsN^l_pS5PB)UqTy;iHi}ZN~Sw8tg|CG+R$G&t0q;1)d2L8~RN0r39UnZjt7bD0~11>IcNfY3e&L z_{;(n8UX(75tsPAh9pwdb`HscmR4HbWK-FZ9Y!oowUc4}BU;pB>UGcE0`@QmQb%ka z3hxl;iY6k8R~QTJgjLG883ller=nh#++T6qW{aKBpM2yjW4kgIq*C?X zWMu1M06>_gdfg_Bsly4s-^2E$e#ls;$)`Ex%+rNX#IKYNw|i2*b<4nGZVVP)MV`VO zf_qUNSjm`|v#V$s<}k-rV*9_q`Ys%V^KPk7a%|Xr*YO(%apzfeV5{ZKGnL(C=%I8~ zz^V|N0KDR47|&ZyFM8*&GFysA!BNuixJ8y5gyklyu*wbrVqC$RHP)j3_ad zEt&2!jb$gbk)5{2D@sDda++$tV`9@c1jk{sGp%EnqPjdg%W7UVdCq~~_teOyhDSL| z$NH|P{kFYnYOT`I6VY4DQk?Da(c*}W6xIJv6Xv${Di934J=1Lrn*}x5w2f$4&JJI9 zLG}sK-W!UmXQt@NPK%{=q+YciPkFI43dbHtQ>HMk1kO8B#EM4Id<@($30ihocPB2v z2-jkEv*`0qws5WkJZ+PVp%ho60jMKRj-g8n7n)5Ekq-2(Gw@l5Q$C3 zgWpH{XQEBfB1K*UI*B(Awi0o3dTtN?)Xl}zgkc za(odL-}6*-$6=hdrQMUp_^yr+(N7kg5O|JP>y_YjXy>I@1W9d`{fhHdwF3Jexe^l0 zQ#^Hqx5vx6A&j2qxt+-MMc1*Hzs|w^(hF-!VTJ)K0;3Cm`twx%?7oo8K!+-=MV z5TT+aP-4?dOHPh6cIBvxQvP$eSHv|tjUCHAk294}j2~e%th7?`aGqPY{icjRp?8tc zc4}SOa2k8#Gcs4gD+Zc)=qpYd-7P=YtTY3|qTFfrEF%Js?qNT_KQr1E+7H_`V1M#{ z_}wvbb+Hlq6l2SurvyipW>e3^6zUqHJdiUOOaoyH#}F7|W_yb)@T=^nDC~}S8=l`$ z;*iNG?s)#6aEz*%{w>UjSgZROQzwUmE3S*<2!Dzrbu zQ2X7e_!>v;qjk$zYDt#+p-#i~LlUEmk{*=Q22?;zG{(W07ojaJECFqQmsWr5YpFbs z3_%_jT~<56(dgQ#v<$wOLPfBBw>*@MqC(u-I<}@$q93wDQqfG`Y09Li)t~~p4D-@L za)($vBm;BK9PYaa<3Kb7kCxQgiHkU~JDTm;vLdaEMRoVP73TM;5qfh)+0ggZ7hFe^ zYX`6+{a$J>bC&B9@Gyz`UYXEoim$0iQv>)HNDjmP(aif!mhRsa#oSgOPJbm2<Qg2Cin2#7U_CW)v&MYuv_xQzR+N@+w4@faMsx^$Q|5K&F+KA4+X3Q`y@r?wP^sR6uY|I7{<`3%ZnCuqlWZAj!G=MwieQr zjvk%X1}5G5gnkF54%UYwmeCB3U+#;TnEkL(lUI?rsKFC(vARz=Rl)Ggd=Rhj6d5rf zs}lq_GA*(1eXiQI3f8>f9%~~HHS=vJ!yi84;35S_L)Wv9@}h^*53x@M0l|8 zc+jf4C++o_dL=-cZX^(94}bx(4h`zE^~gW!xCewN20(2CM+WWKs-qzv&hq!%>S zd48l+joU-b;5D3xG?zte=?eR)_Z>!n;^?v1s4zlaJU17|@cI34(P(=KJB7(CvvX|t zRPH_zb}Iw-)LR3_`ULXp#L=n^S(04ivb5{0dDJaUdSbW{8z{HjES^;!JBfE|NeMQ znnYJTjZ4_)>WhCKna-dUHS~LbZ^Cu>36#{8AWqUETll(id!F~lZne>yN?o=+UixP;W{^NI>XvlMJx z-DKu-?@y`0__O&P!fh9BDF0f$lD#(BJ9S{-(r?2|xRHVyzwp1?gfnOGzy5&lG8_BC z;H6fJ;zEu(#Zb-&6ujt?7*!qp9F{tH+nAO&e43gTQpZ#KLt{Mwynw4GrrBw(2Ggp^d6eVx$`LRIxFftzB?^+RUFIc%}z^0dA4f4)bPSEsdZi0()f7neX!(EbEm#17|yx2ZX#@ztnv6>b@z|R#H%vURGi;y`UvWHJAtA zK;-cDYd7OU=eWz0;xtPuuE6!DhaB z+Y*-m52w%QlF?$R9BZZfqQ_?|wlu{VNn=+f-tT~brujbDtv$m??y-vGKawwz*`nls zC0}QQfc)A*aZIk|&7rCdKa%le=Z92f2~1 zn$+h_eg8lwH#Eq{GC`jZlp=bdKKff`wNFY>zxzM@;9sa_NnB5e-Vd3Uh%x?EVYM?5 zGz|Lb^Rug&HcQup=4DM(0&Z9hw#TZVqzk{i!Ua{X`QmTy9O_A^j$A-16M@akGtaw3 zjD4e;<%U6(wnRhC&TUD8A{l|WdKV;&G+Ag~6OIo}Bz5f@(BJLo1@GqS^9_aqfZQAh za?2*k8uyx*c;1jt+{5RAF1K6R{oimsMR~AW2OoV*8}BcjbtlAtDO>@?E)HmYdgpkK z8BE+acjGrk=${s9LGXfRGR*8})8_2U{YL9z%SZ42J|8+t8-`h3-a5)lAQ%)4tTPS{ zNLEK-q@MR6``Q{QNhNdIjiaDxBKm_$T*(&@OT-&x*`5~5e;VWWW9w~0JmFVD;Y6ot z7CA9Qii}6!RxWI3S)LoT;|NNgwjIqj-Q9TKO0)jd^2SAO|E`=8|AbVN+&8pc!~v7J z-4+<-0N`D;b3J{uyB}Nt5(I8F_P@B|qhZ|m?x1uLh7AC8{;O9y_ddg^a!UetAYLqR zx5TP6@sw9IK>ga-VgG?L=#W)78S!EUHqs5yzusO%o#`E(%4x*!L<-~ZMSPm6O!oj| z|5xkPNPU)Gs=a7&dVL=rSDKgOs^z7xu3;Ql3bHj_@|X$5m|KQ~55MPPc$i85AFdkSZBztB-6%yNiYK&O1WbnmpqMt~9ItD)XO_wuCY-Z?xVzu6Z^+C2o zhKkH;gRxgpAFj-kOQ(*o8&SVoX+}I*zZ&)hSOj1eCs?KmW8V!{nPBs2!?QvA>OSXUPw$F}f?*kI&p7bOvXR3)gIHYVioj`2ZUD4ht zv3(_@cK?)$io*M#uM4hAShh;!N{vjlbW&ict;P)h`eT0YJ#Hi>*i($PKD$KC6KOet zH}LsCi->$9`mE-j>DsN4Z$*S($w6cnzOkmnI1A`DgqyPaHPmrc!3+o0F+6224CA6* z@r;W}O$`daWNX(6yKz3UB#m@7r?6};qP`S)YTUax#hG7yueVGDMeEBu|Iqm|VgMHs zOfG%274ijSv=AztI2P3loJpOr_Mc(D_iag7b6WP}jrHqUCE%>73v?oqcq*~5Wem_C z@{2J;?e@JUOTuxZQ_+$}^z#-XKuG!5B3h_7?qA7{t91EyNBuERz2?1R0w!^LJeIj< z@zo@3MI2|98|truH#;tyyfg|#-^cqMI-}RzB<(4^_&H4H@2h4Y$620}0%t}4zFE^q zjz&cx%o$7Hu|o>9IZE?MpNyVD*NArfvPvQ->0v~||0)ned_N%XKw3Mf*d4XqtZQSSeTt1H#du{Cn|8Q`p5VI;k(r{;G zXgyzR6OzN9IezT__(Bra8{u>M|u*Mz``ZC)|TQDTA25g}G;D{K}6Xt68Cd902osQ8r^Xe3pv-*0NG+ zgRGcHnJ1#GydhmeI`PpNS&H-IjGh=jo});`OTcF_>Ehq+0J!RiNjs$aiE*SV{+lLJ zL58eQeYRLKpG_}mS9Zk(tyx%Z>3LpL?Rj2xDa1u$x>$41DMFuCkEiT?1d%J5bZX9) z!R(Gumk(fGdJV<7P{v%;D$P_$TbSyEqKtE*Qeo*yBF8UYRzbo+8A%;Q#h)=!pQaw6 zu;da~ZgECP%|{wF6EJ7s?1XjgIv6xO4w&V>*oh25v+=f~yy*z&hg_f3X>VyRe^c@- zVMd7AMJ7}(RHpQ%hd~~F@bsj&vYWyE3m{k-JE*Z_{OO?^g5})~2a0T|< z6D49^QYQhIu|wK>#MI9cVpu$#+EgHK=rb=Sdof}e)4Lurq`PggHue#W(K0}WsE@b> zi1BRp^t3aGnsQWyY0X)#%*eN4_;{RJbgvk*c!sxonY3U`$9s&)H|!&Fsr(su#wJrm zjXZ-bf|fZ>TvFoIZv1NP0}EER*p~fM&F0@Y(I4xB-Aic-U^R>C?Pun^fN|}f^`e=h zf8w63F|DPvblgsoM!bu^ zn9qQV-#8tNHQnOO>WG#=xNz+lO#ZdVu*~P(bV(jgI{7=2x--z9L5kK>ji=Z+rS#^A zW%}ksPOtzHvojzU>H@#~SXTxQ(X3t_Cy2m-#P(4|bmRa6Z#E%uY6S}N1R5zW`e^p6 zA6BODW24>Q0^mtR_H$w?3A8oy6O_h4N01Ij>%j*8cg+hz^80q@%?6eMr$!bXnU?}_ zL$ta2@eKkqE?4zfr-460R$IteId-7KInMUR6*n=r$e{sa;{_c3q(SgS;*?f*3}#Ht9+>m=Ed!E(SsTH1cr3GW$KIL)%A^cz-u)@s`%XP zxolzQ(dzf4Y#AA3+$kPya|7CMZ_$9|I`mf6zFCGtoLWn*{AC#Mb-Rjh*C38W+6z2c z@lps|>WvC0Cc~~UCT4s$6Ew4R@wk6T!n#1-en!AZJaENk8UXYCq#Y?m1BlGWxr8Zx z1Px=U3Q>J{#GoWRF zpbD!1klUpy_+;BlYgz@KNR7n{uagS)V#7Sp*Ywo|g)ft#ei7X>+$erK&k5iD!wmc2 zQd;Py(_@;!f)wpc%)80U4C5TuE&M!DN<5}!zq|St)88p$7NNm`!BgU1usRBsDHp`W zgZCXZ7W@r$fWUkT=6{Hv_OHEoPqId4MNm%%k`7@cYvV{=ySG61=!wDYHZ6ru(IFf0 zenkjejZCFQuc0|U$Tf5?Xp$!Z&+^#9?a3Am=`8gFBc=EVon2_`PJ7y%c>Bdrhg0K2 zYg~{PCPCYcEYJGJdpuG6SK1|J+wb_u9>Y}QzvHKYIxtCseBKjAn*}s-2nPoDOmF>e zABH6Bi9ALW52x)vzT&Yh%c2hl-8%D%m$QD-7FYfV#j?Vg{Boi^*?S?i)j@8f5-QAA z&~F&C>=pB;)pa>6!0E6L5kJn)WJynH6Rp_gz+Q6~i-xmKYxb-iKpxq|M$~gs%n0+T zwSBKB)x6^WLg@)wCoUwaYg4C74u6;m1h3lbtNW|~x@m(>l+m+)MuGDi0o8`Y&g^B+u{H1TasZ4eb z-t2m~1TLyGE0ytINuyKRqdMDk$BJeV*?%Lqh?xwzV+4YBj0rrB@PH7;9Q;N|84JOq zRbAh~9!C1*(jLOX4&LbZm(-|udt@snf|%y886B5<6TFri=rk0R%bwrYgBn~pI9+d(velmMzn9r=d{2A1Xi5}M~F#M$J_~ewvWa8p~ zFr1u8285GrZ9RWMf3Q8dDCO_mSma*X&44^9X?V#MrdHXI0fjd^h!0QviqY|&oF(V+ z)OM_Dc~!m)d$bgx5|x);Je26X8ZwutkWP)mjw!>{1!q132VS_ZOk4t?Io!_43&%5~ z8x!YC>SuhD=?h@=Les>6cSG!x`fPl$Usnm1?T{EJ_7R8MGNz*t==TYKB0)|d6uuEo z0(pQpZ##=}G}E+)4fDABM1u1huT-#WB-%aN-wnnJ-rP-Foj|abL-+@nerYU8&)FGs zlL7e=n?%q&jH^)t`z4t+?G|h?D3;5{lr{vk7AYwC~71TRn5)8OX zV>g!X8#+#A;z5FR1cJcTMmKvq*O?^+c4(bTQlNJdPh(elN9V~WH7zv!Y;dI8yubqz zXW=P?KKguwVgba1O5;hvdJil3VjQ|Dn8tv_ba^u$k5`M~@DocaXt;I?BI6Y|=k_ir zD*@L1b(LRCI5-Elccarc zcgqEV&FrM%Ady;_lt|hpR=LDb(<>G0aAqw*{Ze&{Saqgm{}Q_U(WY!MeCiy+@~pp5czw&x@eAVx=K$3a3jr;sC=`9+>^; z?37xMlsf7|)BjCW%i)%!dp?QMtNfp^5Lm8`(hk$u}=KQF&sZv%0LN|U4A4(fvDqJafD zi8vUH7=Kbqc(7<6z_ML1#;%h~Q#r9tWO10*sGIwBg@D+Qj_lnH%-tjfoQGoStjmtB zaeEYuUQu?_h%_GKgi&+XsWZuej8iM=NRp{}l83+cHIexsInF>8W%*B}{#M90SsP|8 z&g1^*#g_A4j}|3ek-i96_!S(gFWN`5>CB2#!e1(bN5h`O(OOs#ndLdjeki>Q32Y%c zoT~czZ9>d7Q?M{(Zq5mUd*I)#a9*Hv+4&z@Ql-n2r*iAZaKLr?(U-V=hEksJiqP;cqt0?M z1(VNzH_iTwKKl(F!V5a;e9b=+?eKq^RDV7jy(xiFjduggKbD355nOa2k_mL8hX(@a zACfOf4(pQV&}JA*13o+9Cgu*NvC9v|19(fwrP_Kb6*NGSW0Y+SCSCtMk|6?Xmn|OJ zVjAqo2(a`Ug|A}$ikjZz^$(JVr>LGHOGWQ-{4FM^R2nzYpT7VmU!b4XA5$5F^-@Q= zYK9h3rLb0hzui>Pjc*%#;$dGOnaUS3Xl-}7M<}Eb9m!y#sJRMnh|Y$B>2vjK6SNX> z9c%Qy{~-j4trq@u(vyJ$N4^DRFQyzj2lS|V;HiW1c{;?jxv+JXus|pMAe?z{e5vLn zk;tF(;$Dcj5}*a`-9%83;m@#D`sjo%`MMyh;{o^Jc^0Lfrkp%OM(I7?x6aDM1;W?u zh!RFGFqS#zf`KNDAB6T0X0tn(f{}IyCXI?l;5PnkZcT4YqA_3dlNv)n)DhNVW8_Ox zY5%PuS&iZ+xVQgpIP?ginM&FYLLM(x62A3ia!G7j&Y!tVzy_R0q^Gx?XgtYecuD6Jyq8Lq?a7oKGj}Fs=?Aq#)Ao}4JHkOjvHwjL zc#qx2_u?O*I^B^@TiM3pF&vYpvtZ(E6ia?hX6n#2BO^Rhowhw@h5ayM)WHmmkt>O%5_xPBBOif`iqbD6w}yDS#SGJZ5|y7T{7 z$o!Hx!VH1AONh`Y`b_iZskDSwC_05`LEM*#}SmoCXABLi3KK zT*MNkaAZV8+^Rj}3VMLU9g4poN?LnFq_=tQYh={nNz1RbMWa(U%Q5`m5wmb^c>zTB zYT}=I(z&9F*h<`XLumst+XFf#T?d7d>K(p{ElvJoLhXkaj?$ViZ(J!q#U=vp0NOUC zg$~DzWLJ09b`l5x2_}#S%hDW~V}cTke4_6{$q5xi?krmcT`)9-Yc&+8Fg~IBd#J>E za^NG+!=#Dm8^w;YCqG6&Pmg^n30t>`1Bf-9{%8{N6G3`={qBC9Qf4zu;!?No>{6)& z5sp)S^;tJ$=A$o|egXLY?sO4T1JOT^WZR^`^;ByaQ(raH*B`&To2r;R=F&Iz4qLZJ z_S%7)8PD^scaB=;l9k}Jo30Lhm*K;o^Eg+e=O0SD%CbUq__=zanf~G#AJ_=|DGkYz zlMKhyqw(=~g(!`0s3gYF{E%q}@$@0%E*X2Fr+G>{*SjW!`WI!;0|W6J$h zFpf&Q-bj@f9ZSbKgsWM@g1i+6?pVnpbBLNsJt009@OBNG3 z?Z-<2ySWHI;k&FiC^77Er7>m6?<5XL+UMgR9z~zUO;954&|6XTi^e&>GFBvWCXHZO z71%0oTdDoJ>@gN6{qd_dr(ATl5SBMguCBW00=@pAuAI^N>-Mrim7hEjRn8cpLTA6^ z8Ws!A+n|RQJ1qB`ww2pn<9R^#^9qcB_#6(Cy7r_a%00}R;77(GahbUmdAlqH!537L zU7>9@YCXH$S9XP4eemt}Nn^p+-yZz43N?dKF=0x*MX?>>=HJg-^^_@t``~7lZ%e@PelC{>+1i;rvhV>nF2*=XklR}hECrA%xVJ_`d~nncEGnmjXZLCo?W0jG}MLXH`EChcBa zq;hpcULyw14_5<$UMzHQER$*Eat`Fmj2Yp8wTfXI$+ zoDnbbHd|qT7FINO(pWf4qJ|(Tgkukaa}MIxd0Xi2FyZCexT0TQdd4ShR!Ih*5+AMA ztr$4!{r$+$C?It_L)YsP7-^zVAYzC|aIAkR{YD3A zG~O;nhSEPYJRuOn4$V^aMsy(3U>@{o$cHxL8QB!3pW($LUEILfT;9lLqGm!J{KWOf zvIp!t$Wxs>G081LcFaUsXF+z0?vN{gthG7r)4<)qM^YNVs;l+Iv2T4M&MAd%_|r%Bwk*F@*CvRCH|%UHavE@Cl59Q`98 zInx9M!lORv)YaC0Dl7gAT~lcc!%v(vlQ*v$jMvqFsHXTy`R-lU3ljP|%V3szmE|Wr zS!L|L{>(m)%*K{eHQ$~?+;pi<;3S*N?@N&z?FpZXgBg6CMU2vugS}6{4CdQQqagcs zN^W<=Xlz_ZN&_<(pcL$I+A8;OJ}+2&_CZ-k=172W?ra%av#bq@zOL?+_pO}bwu@4u z03daH?865uL+HNBW~1v|w1H&hN9F#enWM#wDsbq(9TtCbRYO77Jy4}-ksSGX_cYk~ zyY;^0KPZoUcM72uuN1Xc@fDkp_`G-g`Hzdl-J0D{W_lipi27Fb0gr(_E30xfOf<+WGBI8Rh*4CUQrW15X|7a&+k-PzP z09&v02)gTY-VHi6?3!C`^{)e{?7p1xJmxAd0t1!-zr^@8e_0}nanCKsN&y{|aK3YlH2!Ph zyo=YSW3(oa;+wM1vYt}dkDt6!K1`^WsQ9wy!7$s2v}Xe1LLqntrB4?IZ}S@;vrB)* z4SXBdCi7xifvd~#qz0F`o;DT6o~lE{cvRs&Q>|2H>*gn$4QiSaKwj((>pQb8lhTwl zKdBcDy=sGqB5RPP@WF+cv4r92-?E2LtBF6X=8vukZVWFqX-RI0d8)XX0*&IRjjw8- ztu7muJaXus!5Vt|xy-IbG``ZG;fp}=%fG?eRmel}oT2??F`@m$E9d|q5S0Hy7|(Yc zwo3}Rws(`?Utc`xwWy$j^mbtv_e@Sv4*8`vch<#2T8DpE|qft#)lgD%;v{%0_*?yG_&g8 zCFPfV+fk4_O{me;LoK!)3}Fp#e0altRzJTO7r%OJlb=1tS_$Tm5edlcevd;zT%nFo zlA|YRD&EEgd@q#3jl9P+5tT)kAd8M0n}BmLUY`L-k-}7lX_rrp%>$hTI|QSI_qK_$ zS@ZXOdbyy;)r{i2bUy8yb8e#1Pb_d(r^IzT)i&CA?r$p)1C7h4?5?k3Oudd_6Z(S- z$iJ>qOeEAV5ImlyXcM=ugnrZojTJA<2)E$SKxSb?yr zo2ZjL7#%l@56^i!$-*-}*>NS}R7QT`Asv>|%DUf4ouu^-^bFrx5ZViAv+x~Xz&*B3 zJW64u9y_Jnnz{m>tFrSm6`gWa^DZc+jsxQxEKw?to08aNcKPRtAV!PdnC%@{xkw2YR zCz<{bie>9wI3%mDq11_Y(?3>#JxhPKR{sC$T9R;1?f+E!0ggNSqZB^1#2ad#g*!NZ z-?6~xeR4+j`WHUMiNbGB3)GUvyq#^SS{Rb@8d+A-f-x_rDvWusk#N>1Xot$CJlI9! zE*rmAo2e$@z2?0g|Eh42ms9-;xe8vDOj(dg*EjlQB-n%75kCH@x)u05)kdJCrkuR7 zBZKPmBG7HrMs|u`)D5P7?hc{w*od#|quG+W`$DSG;GE=b&LLW>AVNTY8aUBkc(PT=eKIMk~i9vy0G~N7yH$`IF@chcr&Q)?p{&x2a`4$a%5o#78hk6gMm8~Y+0YT|!1rcmV z*P71gabAzWxS(&Pa7p_(+?sE6!0`jkqNmtdEac#o!Vbm{+SYL#&3f40I$3J5X~aWO znV|5VF)jbf4ll_%3|s}68_byK2ln?sPlQn!oFpug_NP25LfCPssmqX-po5)0e>opN z6YbosGKQlaOJ!()D`b~PU^CpYjbR)hQQ#fOtGWV7xIz2h+`y>znglDdH>dx|3`(XN z;#m?28_~E{BSAY6ihr<>Oc4;2*PeF$!AP#CcAgK;*~;!n?lxLVD&XDI!`X|j#pz>k zxAI99Kbrv z-D{yok5@F{WS_y?-4r2j_}v*${2!a$&+sWe4`ZPrbOWDgEiDKH(7~|2>F>W@|C_o6 zD&Xw`(4zIJz4!}z__y)x6oKr>#a9c&`{Dok?oWlc{ZA2oD5V#!{T~V8&yM@NpT4vG zFCnP9f8!H>kMq~NIgvxIb)j&`2C#{}yjDbJ=tFn+MQk4Nn7#_(IY!!xB*>-d#9y6E zyQx%z>z9xBW6j2PQ4uvNa|U*b#`Tz$)J=l(ZRt96YjD{u;`@^-C4RqxAwb~3jqzar zeo$quM~%OTZa+8x6lcA`YOUL%+U3`N>07PagS3~}Hqj+_rMiE*dGr#t3B~{zq1rVX zdZb{PoD}aqx$=A&_o7Nz^Luz!O{5B-guG=$u72otQ`0r&Y(&rZ!le7LiP@DSbIyXO zrGpaurfnF)WEAY}OCPhgOb5C8T;DUmeO|rW_O)5r9oR^?vG?Gz@w;Dm_f?EtHun`I z!86G2p27QkD@H#@q2A@aU9r6jC@AkH=!GroyX%cX?ljak@&N&tcA9H23z^&2gYNs1 z;GK--L|pwM=!;{1^tcN|5vhH4tA)Sq_Ak~0RAIR(S1a=mVxVtd6&D*TGnkj?^{D_C zS-l0ARZ!=aXAECRJKZL|X*8|fdoAm%CVv2<4h~U>_vOOD2EZUeg^C@%Z^O~8EB;L( zXjLs^kJ4Mphti4T*3*H|{2+_z=z**%XOD;tj|*lm8CK#mY524FZhZal(bN3{S7+G_ zw16)!?})6B$&NQkad;@~3CyG6HVv+ip4%buo^~+qzVpfjbTxRyqH0i9FBcfNM+Du} znpb40L&rBvSjzyQ=$GsZv#MC|hQ_0Dre2Duh96o#0$HI{CAp`Dw9D*f-enCT_zKzd z+I*_aMnY}HvKgJtT%Yv!CXnMdm*%J1Bz@}NKG6)1vSU9;a55?kOo&2{gF7j5yAo<+ z1>cY8Jfp@;oDN_O+5u@{YGPHo{j%`XV%6wZii|XU2 zCmv)pcFGmvX}T|#j9owcz%V1}W@Nv+;C*>oHa+Qr(zyQ?-n~#UU1wwmNuylDTunSZ zw?&ZK`_6;-Hzq_M{ECQdr)k_x;6y52&gz}3H9GaNe&5{YfhSF>Bvc`+DC=y)@-8;y zL%;)c_`x2ax2jaUI2C%L`kUa&qu#bS6e+0Yh`WLKUG-gCqYi?qHpmeZQE< zN0aVi(=qTRReP#c7^UF>oigxU@Z9B_)BMl$Fg3sW(S|MB2cvqEQrd~Zd;xwRisrE< z{TH;>s>~2}Bc<=xL6-u+ED!(g}3&d_=(-`$f!n zc#H|6P-+HRKi87dRa2z?S=M}opUcU3+_zK?zl`&7=~c=dQHK1*y73?P zSbPbL%nCkh1sv-7K!!JJ^N4|t$l*=ubG+?vF%32YSyP1&+PzUnDAloCa>5&O;CM^; z?_!CqxowQxS~N1HP|eV8i85WEXE@@J&7dY}>H$t}5$gE}G0)}f$(W{H$tU>L;N)sC zi18CYF4Jcpbr!I@aQXBYMAPuoQ8YBYsL=PswYG>k8z^@=SD@TbMxL`3Pcxn{INgn- zCsvjtWsO~Goz*So6^>MyR4C?{!K5YUE(Ek=Qk(q#MWi#hT&XFuLR(j(T;WE}VWi?+ z%ine~z)0NXrkToY?NApI)|^4OeEkp~00gX$cv06|5=&@ybp6odcFkrPum<*fqy#Av z7Yp7j{V+N=Gt}^4( z(YCkrdPzeIyAGn6cz1kZ>x|0CEgI=4fr?#k=wUa3I$pYv$D6ui_LJR-PiEFGXK*Mp z&PapVfeZ%FFlUPpH8C&8`^O}a!WZ2U-Mw_hnHD9_U2I%voBkfbivig?@v{%3!x+e$ zaM*M4gzTR5P&{tF0{^#W2pUG44qvaG zcc8@~#0JJFZUMLwX)T~;w2kVzn{NVBNDntRun`U74YJFrfMJO9_1^P4!kQ;9@M1~G zgbtvI8B}s*HtkUFrWRq!jqCo(sgsj2k1&EhGP3*V;%Yst zlXNuOD=5uJWaQVY=$FRF1LKmg7}JJ?gFBVyMXCZ>kM*}BE=Gnu$sp83kACLS$=RaK zF*1Jho_jbT+=?N{_XXU{b?NlBR8-1!@I!FumM!68_}DkT9;d^+L9G$5O2F{gjX*3;JB;P%IQDAN@k^-m%n{WRPmDCGeIl^1&5QpWttyq9Esil`lwB7W!RND zLfBI36_#vTCOC=y>tEj*mMUq)MwpfwBiYonqKh}eU2 zCZgd^EVqr3SC9lu9ToWxgi@i+aBoW-(B%VKvUkCLML@=Y|($ zqpP${KK~^L_PoNZb-D}b)2czAThl}cEsiTVnK8buEM=Px8N#UDU}CMYht_!+h(FE% zM!2<6K*+;ml3sSr-_jg*ehxoZyBF6rfN8k&mkRm~V^w{-9H$8HFHiKuxUrPz>%S1( zD-1irzOCK5KlpTUXZ{QZe3(7!E!Y4`K z5oo_j*zw{HIX z6gy4c_!T?K#xtBOx@^L)`$e<_Hpxc*a9$$<6;Whs?=k?)KtZ=D3kJBq!EI;1CL?E! zJCoBaNUmX#u^v#&M`NN@Y-SR0f~Qq&amLFgU?JPf=iY+GRuiBpBBOx3u$RHNYlEz- zjT2%Fs4if^@xQln9zDdYSod2w4c@uyHObJVSZTiISvz4xnSgt0ejUbUwPlz2HmT~G zyh`fBJp?~Hoviu}GmsKS8vWc!!yNg@ldta9TSDl9?BIS* zzz~B=gY>6dM)v~t+))yd{J(6aF##2!hLv!#BIN@4S65wOpF~A5_uH3n zJYQxrqwlw`qqq7BVTBiGut$CiDnk7Q*fT5#!&jA0Rt9r_aoXF1e1YKP|Ovh`Y z!SxSdR}9z1CWug9V#aYfN2SN4{~DbZ;`6j^KiM1~S7dV2M3aw|`w{dB#n2G2NQ#qv zvM)gk9aNk4J$sqAzP=;FC%*Lv8Q8N7%2ly!>-5>AG)ZH79*mZ2vd?*vX8T-%eO9<*y=`tu? zRE2-(Y6LthrH2ktnK}o#2b;(T<#`BWAL zkDD^(p6Yfqiiag8-2$Ae4C8nf^@q1l`nuxWT^#SOzi&OT`3~LeZ^n4(mIt`vUy{(Q zC_4|=l9z&d25ht|Tbv?-bk3??ZFSc&v=c_=E@EGNna8bmAYHj0$hs)bEn{&ug(t)D zowiwr%(cPlmf+#@Q&W?v?4%OuE~%&*Ou}uy<(ezq4^xtW$C4zRjfXYgP>u58)c#lv zzewwy9`NA|igg6DfE5{C=-q01ieI{D{m5w%!2R0!%P7ggLx*${`~N1>ke{%-IQ%2P z_?Ik-pBwJP-@8~U#r_%#kQ7N)PiNgPDF%xI9qePdfA)m9FNHF&8jnK!_)45pRc#)% z4Ef6M{9f%%DYG;F^Zn*-gYG=c2Da<^(IxP!BM74pKNFPKVg)p@%f;3^JKDIhKwC9V zK)`;&%H+T?0YlqE_!Z(4_-9TNfAYFgdu}OkT8x`9b91fksqou@O$5clmooFe2^ipm z`R&^D-l8%dVeeYHXDM8uPdK93Xc_UwthFcYQ2E%;q^zjNWEWwHLW{r485-~?`jn6q zwD6!elzfm@ll}{OS_qIibW@rk&8S=xe_EToL0#bc^%>5(_cO0FHUj+)v>ZnXq=%pB z%c{bJtPR$#NFdT751$sgy}|x*N}2Kwsfdh-q#XfGQf#@gq(fc_2^I^ru4(w2Es+*G zEi_(Yy-D{B?yNZ2&T5moMDV{53v&DJ2sj?guepC%oWZhxL#hs`tE|$o{-7tL?3{+* zoq9-AD92h(CVWVXEeZG+k>lI z0t=>z0W>Tr{v|(T3-E3q9}nYlI7&MCWc;IG{H_b;C2(+0gqPD-`VIdWasJK& z;*9&VIRyn;|G#k=zw`cxDk8m6^M?Oz5J`g1%|<^d!+-oYttBe(3j+WTv@74>s^%8? zYXUb^Mo^`ME-Ek=9V_5jKwby+zZ}$=?la&?7!UK;`58w}lQI|CibtgXUyHirzdU5g z(yvBJXX6_Ppo0$K1|*;)S}*+n6zr~h!YHIv2^e<&VDWFE;azZ{$J4UjH@Y6O4-LvC z8Wtmx)*vo)o7taIK3l#t5LxX^j zN5+V(SHx%fLj#q?xa@shgG>tqEnObUpHtNs6V>?q6H4&l8NtHCCH4e9=_mgY+?bL= zM&Kv*UhRK=CFi^@?$!lz(u{qz7U%5`kNQt+$d|~r0K%`cbS@jzYejRDCrc8>ukr){ z!p*)6rcHhIuzuOH&o$3ySNF~*n8-knUpS=<6F;gaQZC*Wj;C{aS?wjcd-yUL;g|E(6dn%+ogi zWtDLb^0mJESZ#xEE*<%R-^veEy-rq=FvEIi^Ffmm#Juo#smKj$~DQI~p zT~oVAp=dhz0t6oF>-U}hSMQD2M2AN6w>`3td9JM4unVq3&O^4zhc}#Uw=BB}F3e`S zhP;bu{}Ie@5kk@(fZq2(4uk*%$*L8=B?kr3gWTc;Zn+GDJIJrj15|G0I^?%@4H&%7 z=;)ePi3FdhBm~-Hw{QTJVqasFwe4P+v&;2-yVUG`PL_p!xH>D!egcCY`hwZvAUNrE z_s#|x1Hk*jCdWnnYTXW^n0(mJz0h>gb9}oze7V1mz|{c$oWYFgGd_&+4$N12{kKIH zGsfJ60QYGNR4OPdCw7UpI*jQF*sp#PYWsAEz>ke8tO|;e5n9oQ!&nx;f38lQeD}*@mYcw-mmyxU~5nJD6qPOGpE( z!l~ujDJBK?8~eRzrA@rvME0rblvkWS``Ej>vY$*C@2{FcRZ^=3b1kbvz<2s6V2~IB zVq810M~TjnDlHyaAHrki+puG7tXK{zMg{8(&!_VFU>VK!?p0D4`?kfeH2tN@zps`N zjj^+`rQ`>KlI2AO-eo&s{vac{g;m5mVis4F~-PHnZwM*B}Kl6N%JWk z4tiunj8_~?VRpe0Qx}NgJ0p}9I=>BWBAIpxV?mz6i_IsXdAw z`kil`zF0DAf?rn|Jn+ay&o*HqL^I274ZWescUI>yGz(?0-R@lWM~7?6{HLd$27Y3N zk6qULgeqUK1PYTw3VY1Z$+EdvFP_WY=lB%}*v^16WNcc(M()-H3d<>-P7f@g1QM6T ztGgS)+rs%JoIH)DMBgcaLxj__&p3uvTIDB3G&@LeKRjdDItljfeoCk$f!ux4k_r{) zBgo$SLQ9BZ0KzHydEgrG5X@lruFMT&l}gTe=qQU`k;Tu855`m&!9kLtClrk*1D=aH zH|#tSuh7bQdPEeg1ocQOGTzV2u!RXi-r+~3OG-Pw38EXPmUmE(446p;7hSyu;$$+| zyPML5cz%NyBt9S5n(5z~`VirSg6nQ5S_)VXfGjQ#f1lR|d$8gbMpr&9S|ayCjJfcO zJTLn_*F->`YN~^Z9`S-j1M;}i+o|UgpV*&Z0J`d=2*<48oTunB>ar)guFON=vh~fL z>@vi5ySq8vFf=xjI2r-jU%P7sDr>T}_uvs<)XNS5>@j7#6es1TLIJE$Sw`Q=QT1_` znz|cSsXGae2H6pmv^{}A6OU~B2!bId@>E2cuq>8EQo!;{0%wf%UU~Y1kC_?>^=4v` zhlfONxi%XS2!2m(K%1=1**C@)Y%m=F1=dHpcpN9&$-Ea#p%Qzf<-|w>;zIH39p*1a ztZ@86S3MC18sqdfJt_Oxdx#-N3!iDf5uGI4=Y|VO6_#=`_!*v-1-?wR^Orl(IgUAP zC-$XwY7!7G*U-F@U`N!N0^;^7;UaO?)vm~kfw10Pxn+&_9a{L`#b*Vt|K zM77t;+?r@LJk*6>K*_Sve3}W{Y_4=M>tD|LlJw?obP%K*1T{y2W8d7XfuIQ{oNuJLm4F) zZVO>0)kTK@+|>o)q9)3wg30#*O=&~|hpMC9;`lDo z$OvPtY>l5j_vZ*X@+;6EB}TR^vY!IozSC6*@?pOZRk5LfJ6y)|z`!(H%8u z_Zu0cj<`yn97OdEYq$g*ohoX)G_gnxEHpKH04=r`-mGUqlRae!KW(Nk7-fE^Qjn0_ zkIV@?DtxTrv3gW%Z+J9cwhwbpEq$8y1e~ zPzA0~0vYBA|1Ud`N4sFH4Qz^{6I(Q(Wiw^$~YTLzu{ zKl|w10!sqIJHs%){X6Xco(d@0|9&f82;aR#T)ql`PufjWCS0B z;oncAFQB1l!R<&;VWY~?87awK(E-FiJ;-|~vTGe(dXDu)A-ht#!qZ35czq+d*07m; zDmpwm@8I?IV_L1i$5K0iNtGAfPvcXTIAVg|cPT?jNxKF0t5@bwh|}u({N6ZZ%b!lk zF80i;=|5KU{Xy0^Jb>@v@p*&K))JPNm&q2+6yvRJhBXbxtdjRI?Jnt=|9M6-K&7j9 zf+(FT3&@val!qpHkHywA{SxpC&jnxDbd#Lu#oG% zAD@z(EfI{%1rt*w{kuuk?)=%T>s(;Qhl^~v1{=?O-T!x%QqDlzrODzCLg!(IuE2AN zhAnnykkI92lcduRBTExV1AjUS(x^Ea7WeV^^RQHApk-T-DTl`JymWxgbmE$FkDO9;AMes!9$hv)aX7I9 z1;J?)tjP_nhxW|L@wO+%K~&=Fg=13eRy1*5OnxMqa|dow8YzT4fxhu<1c!q~Am|vW z*<%ALhWUT~BHE!k*VRvS+A<9bwl>FLN9LQy+M7!XX}(#lvEO#ZX-k0&=sOoJ~iWFO+!qMo28Fk7K%FkdaZC>HTv+86a#&djQNMNyuM54U3o)E#0Iu`k~RvN$hF%y~#; zte>C6wp9CO*x#uwX8_wY+x1b`dS_s(4LW0m(+?;pt2x&|F&|9`TFn~BYSVpZnXH`* zmq=dp;-XhyhVVaJkyk$gEL#`?g2r zBzJ7`;W6?YMUxsvto|^hBC}JQBBS+!T&ed^nxOKw3ag@YC6ID>{Iz%BnhR9n8v;#S zWjJ`vRpujX`T1D`WK1l|u@~juQKnSFiL>=BOENLZ@4hh@OuA|7^R=(bs;aaJHzXt^ zD_Qw&PBHCXEN3SyLN@r?M4axyOOSawsvGbIgOY--<}fo&R)Ip8Rwy@s0SC6wB##rP zX6Yw9xB`j83;8Z9WS3TEZgwaW4o{z_)AKFap^}XuGi5{?WZ6-1pedrhUAZk#qQh6R zO9soJ-UV%^(&eQ#yX~F;F96HjQf?Gms2BiVCxZD>cP+O!*mdQxHeS$xypU?un~EW5 zHzLsDYP*vo%F06r>O=uIQhPS^IT$fyyhB?gFK2W6u;PZUVrWxchKSRsmii3Wc{yY6i#8#4^rpAfJ9a9x)el+Eq^$VmRnsHCvTW@;;gTCUaETdDkA(arpJ3)-qI?V>{Xj1aYJp@-q-;IXz0 z0e=gEFjOC|Y8Wxg86pCLw|A+*c5Iry(bh)EruD0|+JxtwN8Ha}9GT4oH%Mra%V6=2 z@j_C%NbQ(kyEwc>MgkWbb>@ae-kJ)*L6-%Ysbc+s-GT|wyaxqQXwuvLcS>T*elm+6}t{6wYVj0~jqzIofGq6MpU zz$ic4iww1`*H;b44g6LkQ7^z^Sx`c4vInBaALuq)B3*Gw>ck(C?^$SOI)+|jw}C0B zW%$Biw}e8YHCLI{%t^?EinV`R%c+=tH^}xY>x1w?#O@tu=RC9Pg7o5bQzhGQJe40+ z{#LcdbY7UQ%&&^~JcQuN#7}yi;&~+=;az?bBF6P+c_C=`rZQ5MFsAb508_qCs>Yd~+Vayd7{!>NXxj>2kn)Xv|lL5z(A zQBS{#BzGI#tS^PE;2j3B$tl$MptQaw1*7vJ(7F23>^ik5BYaWjcC}OT*5>TTLV;n} znG`p&NPRCm;7= z`BL~$FNMO2BA24sWK>?CYq=m0=Un z#7>f)Ko{6K(Cz8aBD{|69G7eA%bBhSNE;AeVqXo_>+nL`u4{vGVUn1jLn3JGn&mw` zWpyqK9y!KtZiXUt)8v7Op{|s15qJz=D!yySL8K9kEGXcNJUjOg9F+4D9C!DS*JOmU zP8fU=ySCm`-cc;@k^l+54|_-W0lHf3G%uV+HPhrpke)h;!g2@Kq!gMsLKhQHSt(^g zkmZaJ5a=8g!tJTywa88D&dPg-5dRvxi$=QHGH;)S3ZbQB+BaY~ zCsaTnSWIFnxh2&jU%E$2WAl}x2x5m*k#l@>cE#aB3Gz-9+Ff5ofSuscmCsJ?+JWt* z<&OKQ;g0#N8bP&@h>d#5!#?}YZ7itJ#f#wy#3t`@5DpeN-| zWMn}#aq&+4f(+A?_}9uIhOmzT|67`d;Sw;{d&-~;w|%n38#pP|*1Xs#u9>PJ!p;V^ zpEG+Zv%RBBHdjoP$7tRe66sg#t-8j}zw9?!LDdmgs<42!{5<7(`fGHx_4T60lT|7? z(7a5cbPqxr?SguC;$j{>uQirHX?`z|sVmfn^>wF6REu){Udo6e)7(H3zc&O_G2-qtO)M*w9u~AIC|F^_{ev( zptj`Aj-XaQy_oA>kHo5gT}u zTBD+1L%a~!)L&VlY4g5*uj0A~q;;tR6&yyzXgC{+j~UMu`g@oHu;X5bik9e%y&5|+ zEt$E4mKH>?`$)tXaTZ)KXqX+-@Vb`jirsa|8S(!Wan*5AJzrb85hRt8kPblvq#IO9 zk%pxNmImqWE@4SQ5LN*}SVDT~Zt32omk<_KI+mC3`!nvJcjlgF=1hFYswvlnSQN{d)wl^hz~ z=mPs+tHj1Pm6(BQ@L1ez+)mr5`}E@RU00Lb_=~L?iG(nD5Ir1NhQvODB(*tDC9OC@ zp5jU+M{IQtK3?$@Y%5}w{%)F}R71nO?ef%N7e*>GwH?g3Ay0B)4VIj`=AT~`q9!rD zYdY83WGbEz2(zqwTcC{=*)gf{YYNLlTt#NcTu}ionlo$@y>>=AE~KJd-5eMoD_XdDfa~LNkM5hg>xbZI}v7qNPZy4^s?G%nEugNT9H#&eIQo9x^MpIu`N)t zodD4*8rjgo_f_ufVj=)274XQ8(xY#85S4~WDSJL+xHf&*se10qQjUZZxT$dXz$32W zOVm)-u|sE3s#0$EYB6-Qeje9G-!SXfX`oH-U%Mei$u?1M?0;U(p;Gtd^e0R3vb>qi zN9rngcd;@6*JN(nm}>HvX@pj34?c4|VsZKYh763#fNjbC}X%?-||x>XLkyZ!STq%kPwX) z!Ef?0^@2=*oA8_VFmFWoe$d)fTpEWgthz05!S#LDYDPCLM$h|Q@@fb#CsLBhTuBhG zNLYQL*!Hs>F#gj~;7GcGmQ$SGI72>H#XD4G=T z)t6*vR2cv`gfnROcK6sd@KD1_N+(*w9mXQPZk>LE)$YZ z{^P5i+5W^mCV|D6K?svtuN8DpAI9Fv`4=7 z`L|3*97Ui?C+HbJ_S#F$sPAFk_4!g<)?Btf-|a6JF}yx$YmVg?r}p`a4b6UugRc*f zHJ(VhO7TW^IMxsE)!-se~DH(Osds_sLH8qs4=5%OWwy|dF;1P&Rh2=#=z-Jh~ z0)dZ$^0q)vXGc5vT;yfCV}<*>&@8nphis83_D4@4CKo6DdOTiUVzqWyQMOOaA3?4M zV`KXDG+05<*H(k*m|)kk*Q2U1(``}hXN^K&qLPscrNbU3i{W|=)%z&0q&LE%B`&yU zf_R^VE`L)L^rNhjiv1$}v3>@qY#Bpih(4TozDr|T8_7!SFGcM)!z9PM-eY9)d)m?}VAX=cwqvtH{@^MQF{ji@qF?{4j z`+HUrVy6qvkZHI^?@FyRc>3^8stPMiB&&@x zq@(nyP5b)OyKGFv3ct9*UJYD%&GjHFKIe0N3nl6?(^5LGr3LI09qqf|iZCP0ULh^d z&h#z2%e(7+j&Rj_9<2HnbiPLce*yHuKNzzD-nUruc9-B#L8M)q!J$WH)M+lN>7#Xb@%$B|64~AY&bq$jwsvF6FEv z(p<~+nAh<0j^?HfM@-*)eDb_|JmvPgPl_)qJuVX7?TpWWE@Z=T2F0tMC|Yzqb>$OB zJZK7UVqxP{Q{ zn`*_vLZa@zH{>?nOiBvDDoq*yHF(a#&2I1jK5Xk(s2UF~T~Ov?9W441X%Cqz zeYO@V$3&Z|J@IQ$tCH#5bK8U{ zNltcu68*tc+OW4q_g}QGhwsz6*Mp59n~|JX>aXqnL%2<21gZQ=NIHv^HEvJ`>w0lN z&j>%>^){bh-^Z_*%riu1h-MG-7|RBBzl4CLGeryfCjuB=t<<=1{eOlGdMCuN#xCSJ zj40SD?N3@wYdMcnD@Bs@%N0nfE#OaXO*Vvvt&I(d(_UrxC+y03ph*a=Fj8CJh`)Jj zyeRr7=|-tl6D-niDPOo_8QlKod$Vv%NfZ0(L#)JPBPD6eXhv3$VSv52d~?Z5rUH%539Z zX5b~%=;JE=wvZ?w^D_)!8K|sf$5QT;o5(DMy9}xcQB6*Y6wT3;s-X{P^6Fi1_EIPs z6cLFw8>tX}c0PzFl-kg7~Gbz*5!U^~`hMrAC%4?NPldZ#SC&wWIHvi~fYB4iVI zRm)Tmm@*1psv?TgfGICF%aEZs$>oB&I=+Oqq1%yWeat+kTih`9h7(!NbzRd zn40D?sduhU*}|KFgmg%Z=*BiLzbp<-ZYR`!VMV;-R2JD>lwlFPEdc!GLspUsjeALx zw6+?iQV;bY5g91Lt=IV#vDQhXFXi=&l&v1@f90e2)DFAJgs0*R_|2&qH5r!qQoq%` z!IQ4{P6&uDu(zgjp@OxCd}=U5cJ=FUW}PR^2m?vf+Je;B&^c*3@fE2q6R}dKpTw_* za)}EG&xp)?jYocqORdy0N=6+PQwUn$K4P65h{f8t)Vy@@z7tV`+BkoiQ3y`91}m&t zj0NEz#Xz;we) z*pK5gnlA`?%`tb?Uv_NFCoYQEo`R*Ot;QRGywd!0Bu@YWc%U{u+B6aDL%haShf&wF z&IM9E%a;Y|9{8K((CGN+&a*uYUMHAHgsGc~u>m74vMPBtTkHNF@2FXer)iqjn4Gj; z7RCRT;<7WD{&ygGtNcbxVqK`~Y$2ogOuDJC!!~i=x3aBi4~7&Tn-$rNz_UQ4U3{hw zridrUf!ryi(z5;S5Q%iuBZZ7Ljdc;|>5@UcXes8UO!@M3p}?4rpHRtVq1oxh;EznD zwGI*t1c+kHqerl-i>;tOgT^?OqsLexsks(VAxRniz;9%ECO>SfZVW4jNKbiw-4eV5 zjTJ4SR`{XB16|3N8?tvCWBE$}6!B14tk=Fg|z|DdA-=3GG~YQ$!8rD_fagA%T8yXQB~N>-^vaax1fcFL;$q$QETDn~8CDxmL z)b;QcDCF|jMgE-V0y)&06M()FT~akx^WGOh4r1F4F5AxX<^enpJMTVr9HlQaY0Q2) zK3?Skw&n=xnK57x9CGu+m`O8i657al`(5|IQ>4A&eRe$!D0nsZa8?+|8yM>yJi8S& zkJw=0Ar<8}=^6g@atskhRnNiXsJ+-MIUqg{u2-=V=C==V)7xi$so!tYCf{$D>PP0)0i5%r5*$pt_Bfh0bCFUg?=2MT zy@0*G_+2?)cWTHk=dtl9g+;WFAQln=t7!F<`U|YuUdxuGP zk~W`@2K=<(e2{tG7`{-~+{lQ^WR+9_Lwi=I4R;`jq`Gcp2Gom-m>Pe?U|y z`czI>xTFaRb<_JiOGB(TzFB>BSIn8utyA|Gs=A&x^Um`cQ<6?#-Fp=}?c|a)QjGW< zZ`f@HUzOs7LsASTj!=?wF1KN!f zqjjTZ$LVpeWgqgi6OUNEYzLo|0=M;W8K2tc7ko^h-_r&PSG*t9oO}y!&tj@u^Nx-2 z$7RtP@5b45LKi!w#dvEszy|P!Kh!9-5p)5#vR0LTs1L0UtG?4-UV-u$abQw zaAv$nubL2;ZXsNWZe;NNgy6yOW>ZfU(f?p13-%V?3Qd;sEwBNPpVzJs|K189gjbHH z`4->3wtU@t77wEiUR;aJF8{jIngL97VvZZzDbrDf>M%T6=w7)@#`>{Y!ByaUeHZSY z*j@WBkHvOVHMRYo zE|w(C1GuTxsc-JwP?@gAtIdsDtgYj}5ppu|duX&3!p^t)qt)oHgDPK)5dWNu6O1+x zAP32Zvs!eT5Q};(vwBzx`RV&lZ2bdH zHGX<%h+k2*j@|2d5Q_?iwwazJ0W-lg8Cpjx;5_MUKadH!>KF-El9XqJDJ=KwstPUM z-8Wk+00BkJ*j{j5PEFxz-<+ITyx{<9hI90X?^Uk=n+1ty;yjYMOxQ&H$A~VSGQl@O zGC43l84^yAjnuXv(H`6&iZ`i!RzfNF!%W%A4cD#o<@U!h$Uyc|zj~rb6QTS02K=EZ z*!gp?|EArLqw&kC$fP<7UaJ%j#0%n~W~r6$yV{ckPI0E<=N+|By4a=J$RrpbYMw6R z6U36RV8U_PAtPZnnpP3Q7`mU#cWBkwlqn%e-#jubE1{<{ThzNdFju&u;Y~=N7O=H6 zvFh@Km)e>Uc2F^aSbw$`^CIO7ubHWGxpr;yg;s653A^-mbTgNx3j3fD(NJtB*qo~%sZeMdPt_xJ@AXcD>)knx+N$@> z{E69hWX`+%+AVJldN6b=ars}E2>A>z^kA}o#Uvf6?fWs4#TZo~k>yf5+O?O4IRmaAoTyU0)2_MM$)kfAVu`fH^sOH1 z=CXLCT*kcu9BMf^Op;eptbUz(E{c z;tMX09zOz3?{gOda@bW=)2;`e!$ml*`*O$ARTT}=6)PtlZg2hVyI@>D%9o@rm{=F` zDKU;wsb%&uO@B7`wOkjS_gl!fi0QF2IVRO~GWk_|)FftJl#4;RX)Oe@ThAVTg^m$)Mtat${(}|9W}5IIgNO>H9Bjt{c4mfyra%+OZ|E zdJA;rrv0-@!+!AQmMASq@cgId{olHxJX^p?#b{idsKK#EY?;WBkNlxKvLQE#ZBL}8 z<741KMV51~|5%^od+*GKM5?Z$6U8T&9>wSWYl%k)3#8w&>SV^%0P7z>5q7K^>WIXm zswiXmufme@4Edj%o)AY6)HDw~v1tRIImLnJgKx>T|CaF{j-8Gd|~U5mY}! z9wcd%G5X=Vl>Ipk9kqSYU!Uwy->N_N(Kbha#)&pRSm^Aej?IU@`$-2ljQP*pImn|v z8+^`40ljg*sXqK$`>Sle*9>>1v^wfU*eZT9!TeAC+kveK_GHtvHE$0uTlR0~%>CYC zb{_gG$m25f*!7p29xy5sT4)FB! zl#VO7S6PsbSP-+>G#H?+mCE=Fh(RdXD!Z?mYfcsM2pGZlWKsDBZ9BL<`0F;N|6AIs zwTz_UJnD%HjWKLL@Az;iY(=<`IQVCJ+*U#dVyG8sd<<6xbA8`LJYP(8OuaaQMCkI; z?CkQ}!3R7wOTZP4#|vAgL_A=KkUfZ-1$BBi=!UbmD-L}P crnkAlOJfRA_BDD*edqRhuB4$@E^ik4f0|>Qt^fc4 diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 deleted file mode 100644 index fe6e1cb159..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512 +++ /dev/null @@ -1 +0,0 @@ -9b2462f19fdf0ee4449cbc3041dcafa8f3f7ecfe1ef4264d287e1e5a825a39fc73438d423c553f66d032f241e62b56a4734c6e408527cdd898dd55356eb7a606 oci-security-health-check-standard-260708.zip diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256 b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256 deleted file mode 100644 index 127d40c95e..0000000000 --- a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.sha512256 +++ /dev/null @@ -1 +0,0 @@ -9a5884623afc638ba86265343727b556394c75ef7fce53817d8ac32b51388091 oci-security-health-check-standard-260708.zip diff --git a/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip b/oci-and-db/foundation/ciso/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-260708.zip deleted file mode 100644 index 0298edfd652fe6a7075f4f140f79dcde2729a9a7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 104440 zcmbrFV~{SqpQhWkZQHhOTTkP(dD^FK+qP}nJZ;;y_x;ao&1}`|R_*MjD*AoMojV^= z$yJGxEGQTZ(7zIH=!xFHHU4Ko1B3@;Z)!#F3@~+dvU2gDw*(m5xLDGgS^`Y1>78AS z?aYjw%;;G-m^hiZ7}eFFfk2y4<$oFf$p3P6hXn!#dj;}G^Kwu{#8Q(sp_8S z=}Qk;s{hk7{wMSNw=|ppj;>Zt09$~ai!+0ZyUV|6DvZeeGWoBX_~X0?enfCUbKRlD z0rPEr`byYRuWD5Bo}Tk}M^8#0`h4vsk90{|Kwn9Liny?tyf}lc z*}pj`LzDky`d=Mf@mV_`w8ihd(K4~BW9w3?u;yGE%y6bBtvs8l*Z=l5ojqo51_+ap z5mP{i5RqHgUiTXQ2Hh1cu;tIHFiWhi*53fb`4SNX?lQ?$2))z^0x(39e;C}hrPVK{ zL*1;_E`(jI{b{@i7*zBanjzJeO7`3?6{op3eWpG}O(RKkOji`Y_7IHF8}u`Ed%Vj0 z@qWN{Lz3~yjFdYPkE37P^ftc*Wln-pVIrAbe>Ef>6IpKMKmUGU2V^oDrH2ET$66*V~!tK@`Cmc~P?Ck&&E zL;xv!4$l-Jm@=S}eU=PBj}WK(6%%P`Pr>?S_i2`}B2R>)AtzG9pUy{cBbxRrn5s+I zq$xPnM0UYNvS7l?xkSs<&Z^-sg1RLztce``uHQ$VbYf2(GXVXL!t|bMp7U{oNlOhj z5;XYb7ME&8vq&A+YnICr59;uGdCSjP_3*JpYJ^LF33dyEih66(gDNMFLXa{aRBqTn3Oz zX!{flibet2E|efZ#+o~3xc=m=YK2!d5{-NN0(-*K@OQ$#B4lI1*yEj1ofaL)Dpd-% z|3qnEJuW+wgFW;$FTyL3;Js&UKMFM1U=kYhb|gB?ytZ(M3(|!M zd0|CkTJcxb1*I^)`0|J)H5l6-Env+sqEFewbcu*tRfcbk3A_+<7_&yRj@>*_5_-1G zJ8p$weqHmrx-gKwD;kWvSSDMB;eb;nLS-h8W<>v%@T?T>{74kB1_2Q6tbV7uV#k7H z_*17|a*jw8+iPQ;xB-$OwIGBnGJ z-@y~BAaHqUg=4q}iW4H_ePwg2Z0n_(lO_J0LY}|<(1pJt1S;6gPFQ`aVCm~1G z@hsp1L-p8Dn-ykuso_UlC)`x>UOKTYoolcwtjMDpj@fal2xa0%as$ca;%bx8q4{$i z&R8m!bCTE~#eNnE{VsI^MweP(S|Py`sazLmQhknv>-bi;l7$>%yoo1!aslrIp8$99 z4hOC3C4w6*xR6$*{D`~CWOP`|NNQsb1BJ3Blpi{hieDl`70$vkPqFJoeSAp_l%G7d7w!nXB6C$=*| z;diXL;j9|=0fW9F3VrEln&Cm9wciLRq;O=0fVo}a<&*eQdLa0~{MOle>iBZQ?HL>ochQ{kPFiU(3s z8;+W#-^`d5&m616V7wx77y)1OsUMpSPzg#DoJ}Kq37aM8ll}pg--JVMKt?7|rJPjI zC=(i_eLp|Zab~MzuNDN(eOM?j^YLk>{hz%qV3_KNFRcx5hh`HQ-R+R1>1ph`o4MSD z0Xk~qiWKw6U0^EwPUYajQZ09tOJW`h6~R_Vr+;Jf#N8-jQPWPOR*nB(q{sT zZ4FlY%5*|Yu(^QDzLTlAA@5t}4d()#C1TN(6nv~ye~EhITEyQ%C@I8zt)n#(@T9Z7 zCUYVI^^yLd1zNv^$2a8KsDdZ8dYST9Y2CoLBR9fO;6I|Fk@;?Bjao$&;^BP6o)&Qq zWZ^QoWW_+R!&M=&czD8zBE+kAg?7W_oz=~epuG-zfdjr^X@D5#1(gWUh%M(H)L9{n z9b$l4Ji=z-A^-LjDPY?0v_}N8856s+g(HA#JWxdq8)D!&we1D*sez>%lj%^`Oei&e z#0e(|1~FkEF(8X8n1qTQUsz0Lh3b<~xr++=^0)+?+6^$`TN#fQVY2iD<^z;GG-8)xhFS#lk-ER@NkGu8Dnf9m5Lb zfPi6~x3n+@GEwyuj`$;iBT%OZ#S^g2*>MI9uRIK!;#>L=k(dsuy>Y?{w3HC=JuQmx zjox3=WW+17VVDZuSA(!6XzIv~q_!1&m}05Pf-2I$$ec1z(fuZv0+y5;EMRO~-2|RM z?%8P~mHtAQ(a0sUe@$e1T8E!HlNY+0M1}AT*VPRYXF$Ga-XJV;UPL7at-E}|BcqarLGu9I#|u+xx=N>9(!nE`Rgzj@EjC&U@MykDk^d zd-LNG?VOiyfqnFYZ?q~Vsh5L7w#$0 zh0-JV_T)J@L+km@ZQXy6@5(cwORklGub^{-#>@CzW!BOHuLtyN}3_(Kxju@C{bv0 zzDI~@MV;Z8X+iD7KzNRS!{uIrJiaNB%;cKA4#(x0S{m2o9;c+RKf>xX`WoaJEWv$P z3om!PtEdVlk8pFd3wyKy_^%1{&@!&Q2b8aOpZp#CxSH&evk%W~9hy!h+(vv2jjm9k z&87hTeHF`zKa5?T`IH{LF3hi~{NB+ZqAwk*RtBmnTI$px^`(MHcH-#=Nz%uRs8AE~ z>P%Gz8!8lLnU2v8V=nH5RcCDM*{?NFKdrI=LXhr@7Q2COXEX0uH$?31(7hcL%9;+N zdHddPNr90d02mQ8Znuh7r~PB3)lx7YZ%dm>MAX4u%tUVq(%{m;4hgJWCOwYeaHssdJQ~(O#`7%-y|i zK0tiSNLLR7@aof#nD`D;udHzO5vjJG#jRll%rnPTSZiHCNITkS9D~CezpQaJ)0B0B zG}$^Eoyv^*ylPFCyKVBZ?EXDzv|dA0WLR4|SBCdG%%@SW$vHCmTQox}JGU8maUwwB za#^%d^Qc{T=X9B`?-^2b`nE`XZh>?Xa(o+jfx_lBSAufsVISB5B|9bQ7&@W?v90VU zS)~K+exu)4gAghO5Y;x#SlEQ!u5-3H4?gy(^H$;mw?y zLl3>WFQ5J|7k)nD6`-oubVlHL?9aGZvMD|6e<_%YW};DJo=V_JKW}CP3hJAGuE@WM zyN4RF>>p5d&6uiEX%qFlUwIRf9FcJ56haM(%?x67tUFg3A%xbRjPD zJSZOLtbc#artGE=m40^9a{$S}7oy0s_Et>n-#sgt^ZD8;3dT>z&;gmooz|tcYZ<%I zY%c=IN@*b9@_sdz@*^( zneGzk3$M;Z=%lN2lr^!~Rb-=c3+XiGHMMxnLF=ZiIZ5U+3fv+$m~r!jx!Qjxq9@jBPhsCo5BSp6~K13^{1K~Vo(~EXt?04>4u0^n-63i-f1qq zS5LR^c5yQ%;S8Tb&W#JkQR&>9Ddnv1n_g>pu4aUp4s-ZmFMbd~{Tgy!u!wH`$e<$Acu?>b`7ZU6UnLrPFI^h0wmn=s`-3 zwX5`L|Fg%>yIiaDZ^KB;*28-W+3%Ty&W1htgjaUB@0qoiWAFe8fYDLkANZB*cg|kr zerC=AoPJ8;1!M!@>|;L1Qx4>kH>R?u@_=U7>^yi+@=?hns#Py*0o|jWEnF= z>=oZKj4g@d@`RDX$r&Eu1!v@vGL0L>4MYppn&~YURf1?4W2avopwY}(S0fs6#0#{j z%C4sD6TSM4X5KK;y1VMCc1f84$URRC{~mgIjZ{3blFD#MuI+zL?(At&3KY9g^%K_R z=SyZ!2-X5`?oy=1)>^-O@uu7R_(m9s|%>IPmo zQ!y!Mz|0!4RPCI^^Vn#koMb2-T#;*1C^^NK@vaiEcD8&u#&~Nfm#8Lt$7il#Bv>#|2caDOrd0mP;OhtnPAN)OHH#CHsNI zz3E&btjT)2@6qo$en|yOov>(9CwqnOxdE4UUgswwxFboa#Gc4GJzh%CA{CmaMi-?B z$H;2M?@7I)w7zKtW!+~$}oZ?V}l?#`+>AXe9(T+mwwbAnn50DMNgN<%$`tMq@D<)q?fX`P#6p2 zi310?Y~s=+%S!T;oFYmM>L%^6U_$UdW5OkThZ^KF3-3lt-TF`h3*H`jNI`^~v-0h}Xn-i@62~twH$}wSy^t(bV@C7j4rMHY z>if76_ifj;nnA=6JVCU1sl;!P@~70nns)Htr~xMR6fD4bp%B;RGYd%xzaMO$pww{S zZ_lWk=27cLQ3%g~klcL1-jKH*fj)bSP&m1<0%sg*L!fv~) zfiK&!a&mqgdPw&uK$@!M7k9R?fr?&1x`z|I1odvTB}w{$kNc-~ftm7h`E^%j zmsuB%=EE9MdJm55O>|>51?ByWg2M)~1IRZbh|iL97fF~iWsWD65D59kj|7JwLysKo zLAp)Oy4W{6IaqpQu;Td$3YbIgMTAZ^BLk2rJU_P~A!tUs=m~7Ix`uU=!9X>&p(_7o zOI~V_0w#WWc|lMo7hZOtIsB~hdjEcJ0*>WA#I(FmQwZbT#}i{F)FD7s#b|=));D}K z!MM|cq0HzD7MvH0$;0-cS%p4x7kI-ZoOky;3HnTrM1Bj88KtX9R5%4T(kB>=T9*DT z#(z(Y8~`qy{h7Yaa!;}A9knIQ0Lnuo$oywhai2I+{cAoo|yxQ=gy%x(rK3 zQjlnY*CfHG=#HtN-stQ%qMX9}!KD{ld~a!P`$Z|?4{^!Uty~)I^+IfqS^Xg&QpdCt zm=YdqtVRDSkCUu$!){g+8-H%#7r(@-OGMJJXz^Eq0sG+!81NQP??o% z)Gc$eavymUVHL7q{*|QvR4R0$BU}H4aZ>8nbJfE^=*;kw3j8=a2R(3Cw*M?hE#>Eq zHskGR&!+#3>&PQ;?WLWq4;R1Sm0s?%K(=q2K&Ln2tX*q%%HrmB$NSN7>EuiIMXTV6 z{Xli9t;HX&i-V<&nd!3)g6|Pr%-uwJ{Mwe*mSwA@*|5>~aV6b5Pw-xTpNG3qIL26b z7j<4!=1q1VuDRex&QIvqx>QeKz6@WN21MfCoi$e?An?Bc-uvHzc(*I3lry85*LK1P zDL2sAfq1XoiI`V?!N9(&YrfyI2XAe6o1Grti{lTGi6<)?ovO?*$=O|Xm>ZO4AK(>r z$98Q46=P7JC?pI+y0;9+)r~NhK=_p|?#|2LnNl{S8fSbNvA1q2kT3Ajc z7|v(XbPQlQ$mZ)c_P4xHIln_tSS+~YLs@Db@9LvmMUp0UMgE`hu?jw6feaOQRzlV& zx?9G@p~M2|QVOOrAE^N($q>e2w?Ea%*?Frq_gm}98Z`btxY5Y4BrHG*Ovhu$@AK>4=WGTwsmfJ1atijIJTU>re<^HM0=YeFuttCAHTyeg(Zd@585~AXO z<`?+pO*Ykubv|#bcq;2v($rivSxj0jpR)p*uNv~0S{#l_@YRO#x#a0F)$n7ty42cMUYxORfE!vU<*crti&Phv|gX zfiV=*tXo)hO&kM7=WNPrs$?47`{SKI;inr`|6p((k7cegRf0~1+m9|WydYh>?bEYZjU!~eLtg=kKjU%)|xox6k9dFHC<;t;P;#?U< z`SiA5ZTy?R`o=&f^au3BvYjb(R+rw>&7p$No_XzvK%mt*^|&E9cVm2_zR-`?E#ra2 zrcomv@YKx>8Y>^N)UT0bTue?oQRg`o!BS;cUjSEmRZBHE!TL{}60;JfzGJ;Yr0Tn+ z0x7cE+^x1iys_H`jw`pHI^rIqZIN!kNg&XI?x09rSiLew-t(N1p1wZq@or*O*T$2a zc!e`Hx`h6II@4U6OpEf@-BnC04&mi$m5x|LuJ`mn(+{y&X zmCQ72VgMqww&6eG8y@v;&5 zNb0@*b`buy|A=$@l{;hS`5@{-MZ>f7$C>_25lhwDtqnC%<)EvJSDi^ekRCgtuU- zdx=7xv==hf1$E>xUkd;n3-Oi}99aebI%(=(#B14I%c{tLh05AT}cJMA65~>i^22dR zh2TmVx@erWanB&>$jk6(#VqI$dIr%u;kOmnSPIWHabSD|)V7jpF_oEK5B3o*hu?-0 zn|q5f|4I7`t!S1sW+3QjpI&8gw;r2L>%li(BgTyTil~~C{FU}Wf*otccV>(uwsmRY ze+I*8PA5h!MVQ1sDh)*+DEmmjoB;khL6cUD$)SKNuB!2FV8DRK%~C=NQWT(lE%g#yNa{jn<+oq8BMxl01Zx zO}K`Jf>iYDX0MMnRWTS_C2QJS`w5xGlIx7mayDv?sXfBag!1lVaX z#(MpW)kBJ#DYSGrv`7+9!1Y6Lo6sJ{Se}q`^8bvAw4uu(5zC<@(iP?N&SSmrCZX{K z!kOlX;f9pxhm>?vSgvze<^>eQ1hlciwUc=kvVj(;(mkR{;U&d$X`!M(HpYb+t-H(` zXJFm+K^8OLz!Ve^m3?qw2buXG}1yBWs1 z86|zgSS12Xt$~5@YgWShl(GE_*@+#R=s=h-w#%CWFD0gog0}0n87Dn^^%A!kZ9NUU zE{wkE+`S1OIGOChOvzD@xAuZaijnw?u;Fkyz7AM`My)}1S0R9Y$?#}eaLuEUg_MYb zv88e4*b+TtDm=VTw9XI%6P%~*!$-lc*3?%6m+A9$%85phfllK50xZSn8(B>AyF$$ zWH2MGL+8UpXO83#KxJMO1j*A<4yFBB<5z9T(;sj(UH~=S3ES?sb&>?#QFTq9@+?>p zC_foi+{HpSSk=R1wpmXnHfIZAsvej!T8aH<*}*jS&ZSA=GJXkz!h^>@OrsXm^tgfM zxTotv`xJoG^s-8#gU#@i*-;qGQc%v68iaSIfkGMu3`Yx6$k-bS#WJK+5&L$@d*0ja6NP$CBwyLQHaAC8 zGj}T2wWQvH(703P)amp2Yf+|kQYIC09gx%#Q=aEimYYpeyR7s*>+&kB{c@kz5p}(M z_fX#_?jysaUYvt7B?6JHh&mG6e!u6QZ%!2y* zO4d}SuIDO1i`^kovN$_6Eupw9;)O zQsZN|GXP&{lml_-XnERI23oCSFj({^`>r5(sQdg|a&Gu7ca&n(aeMWr`DZVsrXA-= z^CNCT1m;9|=pS%IpS0;|$1BiI?$W^gBGK-@1tq+B*HKorYq$EP1=S4&fI@xs`2zUg zOC88P_rS9zGVJO8>D3BE{dOsQ0sZ*FkwvwL6z7wE{*w+1tTQyhx3jnCh?yfr`Xfa) zCzU29hPpH$z|S?#XbG!w9*xpR>Qgt~u3%nbgL|l0!@}5pEWifnK(yEfAbzydF^i;S ziV%Iq|3o4G6(ux)1Cl#u2U0A4Ro1>^+0j>bqDfYH7ILFJL82%tDT+UYWB9p zyW4F@>7}n}aUx-oDCq&YS6tg`gl`q5XD6@I|J~_9cytj`3o``BIs%BQ7E{&rh=t|hO`r8{eVD$9#UNh_#=6#Y;kfnIN&vx*CuWr z-y;QVl2lg^mqd)B9<-4{pi|qV1FZepT?V5SZ)wnK8+KY*V0I+#r`{C^s;Q2FmbCi7 zlv(sf({G?Im?B{ADs5h>;X;$&0p;vg62hF_c`uWE&Hc@b-LD>+^nh|3SbHA-BI7i_ zMw@K`8t=M>vsM-&4T&-X9gBq|#*ZJMyTf%G_}OrD9%G+}`ho$Z%-G_vY5Rk)6L%z` zE0+pUrEHPqe)H(PIcoCS(oxGup`z|(D%S%#swOR13}QyyfHT`>F*I_YG)!<*rxRF0 z8bBvHM`AUuWw-J4ymGYGZP4Ji3zmx;Z2VtvehThYu~mT*d*g?1i-} zQ1eu8L5KBHi~iNtbJn)c3FvR>UIRtNsnz71`f61)7G#w6S=7fTlw)7Dpuq;zIplzG z@&=z6nU0N=kq2)q_xm8qMHksLLgN`MG!?nKaF&CZh!OiWA}xa-ZEmJvR4HoaEM`Tm z#*XwB!w1Ser{O7G*oxAf5{pi&z3H&mMtISWXX&$oj=K~_ zH~wpY3@qCuNc>C_oRB<#n2il;jRmr_Gy#Yo)6jyRqy}khLGE_=FNmV>zBn>7rgkd# zDiFm;8E*zX_KWEwPw={w!pX1q;e&H=@B%%)t(2M6pB};=zn@%b7IQYV2X*0Ob&9O3 zE`scHqad>dMMA2cXdy=Y)!n?-C8#%w;xpIg5C(cG^~=9)uhgn z7FG(eNZaL;(ZKj0a|%s*)mC@Ljp5oJJk#;|k6qHlWy>|F1UTkzLlnm!{MC~HzM_1O z#vo~vk>9398vWfewL_RBh~Bn%8d`Wx@Wfi(@%V_tC9Lh6phw?ih#@0ITG-ouF!=Qy6yJiJE4mQ$inV=<%Gd7Qyu;O(hx9eys^`k`6pn!|&I z%#w`~4!2*gO!WiMkus&(I*{y%%$C$9m4=*@tyDTf0_x?UP^YLmC4c#Iq z54SLEdi^2yt{^hvx}HH*)N|tT*&`JRH7=5zJh0&Ecs3zewkI1)pmQ69Nmp}z#;aE; za?1qnx5@o9PST&Muu6w4SOl& zX$f7LV4qo(7yL{Pi@a`HW%SCL#XZ~k|2wWi?KEpFPtG&%{!!866O{qXP;N3gQ7A%l&$X=xQZ zH((iR=Pk6A$LMJLYH(ELSivL}k6eI;y0$^Vk0BhZC}yDzNQ`Gj(5Jnl!3T`E&{fA^ zluso9nUd4M8qSAw>|wY9#L|KD5_lYiC5@OYhkvv7?$PjESY%@-ha)S3DB=q*KsWel zit?|{t-~h}jg3zcYTYQR@oCOv6rjJh%Jp+1);r->iiX^rb40V?JoeXG;#FRXBmTg^ zI8|He*pMTbUDw*cLkb?ReNhpv)HED?4ND}76tcojvMa#Z{@>3+-H^2pIr^N60X){>nZqE}5_m23B2(Gnh3fSjD zKrP{)NsE-tXlg5f<^oP8=k=y&F>leW@TOJ8Gudj<54Ck)f&#_8+WQCGR8$U694f_> zw`Loqo|9tGVy26?18;ClGSW@pms<7vZUY5oUEt;$b0?(-%R&?ZlXxzxeZA|%eHL|ezALII_;NBD8L@4_1|c(OWq`qJ)b{>T zzL38zf!5rB%E36-q54n>U0l}Okg-xR$XCcnq(u)<)G}7U$gN^fW093Z%QQA@ELnhh zgz4e1aM*|_1^$-NQ10iRt9UNCj%f;Zik(97=dUYjgwCB87hlg=hj1r@@~vbCLbp?V?5M*Xs3L37ebbvAS^ z*%(G=%?^$tSqo&z^$u%J@Fd8DDODTSxc(Vk@;Er}S2;LW--~8Dvtecab1-+?e0E{w zkOZ>|I#V&tr>-4k>d^^5A!2cUGJM8qQG8TaVZ{^RX-(7->Oq*GV;KE3Hm1(;Lqr?! zM;qqT?+7DurbwX9w1dzZuU?zcFkpS5l@UNL*E}7V<-(tSl3&pTT~A^&M}#vkkl6FV zJq44H{SvY-iqtg%P~&4y-mbo4$g%GOdrDzW&Zy?Fth+-ZHX%z9MOYB>x~1u=#UGp_ z;87P^iwQ4!wFDvsnj-n0-tMhwjV6UHy!~m1iD@t&&q+BFMaX`R^0FUwTkxeUtINLj;<9|;B{l&@4qgI1v= z72bE1OoRzkzhL}$^o%S9Dh{DJ-(0T`x{gqj=T=sQL0^4;qe+3@C>MB!Yy0PqvT?mfX|R% zwOcvxk8V%nF)_({7i42|w&WpJD3D^c%wGpTHG#@*A!Y@jD$!~z)M1=Rs|)B1yepf)os?(w;n z?ju=Vy#(lE6s<%fRIP4JvoV97G>#IbC3JH+pv*j?2<|xcpjbOXh)|gz!oq}5Wph~f zCmbRm*R$@&g#!hx3kVg*qYy)au~8#iAc)%<`==G|IMWH*7?K=kimJ9Qkl-8^Pa`-| zv5sI{ex)lQAZN3h5#+9J4<5%L3uY1CeFF(mz%$jOF(Zl9Q*a8UmD*wjEwhv~B`NnK7|NB)Nv7MLrmYN5`P5P?$(I zDGuD0F#OoWZDk-7oV_bJ=GBS%xicipYZK}(h^4vSFPKmxt(CRwA8}8HyurL1rwkJJ z4yJNB($sGfDIQKy1nG826TfC3Bu#e!8-sZxHaA`hcIO#mm1U)Jp|d`fRi6+VLwZ$- z=sumAea?iAcOD9&p$1i69rG+lX~0)ya9RVk;i0Rw;t(wxsMF4kgMOru4#|MX7579p z;}|k%u!Q4)^#R=tys#wkhOjDSrcv$-Rj4e9)st~(?N3W41SO9Wk1~EN?aS83I|2F$ zUe#>Fuj9W=l#ws;yhZ32AaMwNh?n4WS3}etgOI^sBIDWJeTdM3-N`1?0x$;R2aS7Y zd;X;$1M?pxAtyx?1($BEvxy{yw^H2*E(sZk1yW;OLw)U90sm$uw~JY@ z&4?<56X3su_z{;xd(F8L=lpahQr4qM8jQ$di!cU(#qdkeqDesr=EW9omD>mxxNp-~ z{KOIIol>@@xJIn@@7jS#lB^>))K`wsNoaNcmG6W+REL}wAHUbuN z@Q?F%NF*(cdF_JZ&Tap4v$$HRcqEPDa!WoWH*$)Cu)T>j;UmhzTLST)z|1!+G{Gir zg?8qwyL7u-(6i-TqGBcD%6@JR9;quk;F>`A4xV}|{WteK_z0PR>)~}60A0%T0lKo; z)Zos(1VKzYLYT<2PH~O^p6QX4^*cg|0h*EbO;D&sNp<*B_LYLXyq&n7>8czse?~TS zj>$VfY!Kfn5$C%92rx#rmOMsil8dQdj!u_DN3C^xI->_I@o^>vgV+Fbf{nd8$b6Zl z9z&&Ai0;|ESrrLE6;X~yX+#EHj?^6lW`L6K(d2EWuskHv(PHHYR0^y(-1z zV^@qK9MD^By4FeJk+AcHmJ~FQfVa7 z0bcDAjSeeKr5$kv8NI5qPqj@WJ{({cW^}+Aj9}NJ<9fIeoNrnEQ+r`<7;=kCkHU%S}Xufz2>{hO>NcRlx5AKuxfmu{&WPhT-3S?7+jj8h;+hy`FAx}=jU z0!e@ff+J;iFIL2pP%kwqJjn(*KtP|KyGVKp9S2<@nn0IOv?|02{oMpt{9wrJFLJ6> z5?47&H2n|^r`i}i$=aU!))78uX%t@I3M%F|^-2@5FjYAyhd#*P9juRpK37iHkz?feFF>swGQS0(w?t zvKV0C8zlH$g`zj{^az=(Um<7`q(yBnDxlyk`xj}cgF^(YJt3M~eX12tBZBfT#A!tb z=IG=)q0-<^I{Yv`(AM@{@Q&$mpo937FpyJ7x(xx{%!DG5jOSsc_Fq$Z%XU_Z-7ReN zDqXihb3Tbg`b+X`5QtDr>ad2EY*(aIz8InULEJzj77oNtgok?pSYuWWsGV;3&TCpc)OsU0yUFb4xsB? zZ{5c{$c)!DJz_u{pbiI%T&;?1fy4!8h9%O`0~kF91JMRBIdIxuH8M9wT=C60mU252 zVRFjW=RS}@ z6%&wD-EHI#@!3sAME_z2c_~S88Y(^XWFA3l!p*rs{PS@HiW0OAWBz^^NuJ$k<8TUJ zM)j8hiw?RZ=YXr4eNZJK?wa|FB<-Nx&`fOjd4F$oC`{`3FH7SnH593lx~IN7I*%y4 zyU5?5ZPv`_U+B!E^L!mZ7lXl{oc+WNS-BnXtw+hg!6ty(KQWJ2{gZ+C3)vjxrgnD!_G z;IQx6w~b5#k6f|F5U5NRtkog{MW}*<5f({La9)LpCB@Af!9&fbBN}PYk?O4pjB}MI zp1A?1Z<%J>dhE#h`P!+Np|b!HLN#Qq=mE!KzYd;n>v6Iss%i?h*8Q$|iH>iVPA1)W zE}fjlw8Vha_DohRTr5HZQ2o3HxkH)$P5u_eF5RvMj_wNd-p&I`KWgcWImJOHygAHz zJSDzD@&$23?agsCq-Ss%Zfrs1BN+1iy7PBjI(@$VlZ^ar?xyOa;pmBhKHy`gwSO+= z=CTGaOD^JFR#4UEV{vK*L2s<9O@@K3V2;gPhFdU<@9mcqNq=|K#~YSj(KL0aRh9dp z`}j8m_QluySWb(NV1Zoyhg!p2l>a^_Fv7^#cV$~w4t0-278yO!ZZb*$y(QA7O0*%O zdU_?QriOtrHfx^Ukh5w!E{WVdDNh|117>{@0SOe)at3mIMX+QkZv7G5QG2Ia&WS>> z04YuK*r={>{Sg7_Hw1m7qwG?l`uMT@{sl5#Py<@BADX5|D&dFNKdgh=*w%|IyW=w- z_ng#u4k2PMdToKFb(HZObj(4N43%bTfKA59S{Z6!%v~Lfh_Vy?Vwq`eEh`qyk#Rmo zMa@n5egQ4JhYAZmTNxP5DqSmYmLUUv&0IG5=sCw5iZ?1cu7w4#WpdwIf8~319ECVC zhy$!{**V~s)1xyEt-LWIGJ$-}gRQ9g>ATk&%aEO$kPs}0)_b$aufk0bl84l`JWtRX ziq9fUM6=!4; zi)m$)99YrV4+wP!uk5&+`X)Y?Ak=g={oQ;N{l<)$_T)08EEtimGW3)s%;rW1e5C>u ze`){sISy43G$`4Zbn&sIkoUMo^!a>GiT&U8&r0Ky+N;acmszU(*cMC?g?DvBv`!tB zvo}6T-B>6D#-}xKN_rkt0APBXeA2&?mtV-pJ!)@Ja5O}h(4jUGshT$Y(yHHFIlgEF z{#2BClrQQ8QFt{bM+H#27-loL#0dTD$VDk+y8awRuga^Aq~1KY00g_7 zuS3+1evrg;3RSDanJp(pk7+`LP%za^dpU76&@OnP7h|xiCis0T$igta>oaqO&qY3( zuFZ%=bCxDrM^H;`X~_YBcc%l(H6R>V5@@}$y~_L?^4BfsCbG-UMxP$b3Ha zVo=GeBC0SdCp0PWtfJt2ZOuyV#o#&2-O?~(o?ud%;1sSB+1q|t-+YYXYB{NuOyV>zb)}&#ED+5F78N7)#HH zUo9epcg?z`k{w%p>!&gj`UhxT=cHbXDJm=CA@dAvK?}E0!IG7S_#$GAlBz|tWAr{=9N*86t%1^$zzHDo z_8-9LpCl6M$`4aBp_?$Ghmd$c_ExKx?I%p{=EINzt;0q(Q%X&Q%76FN{dxiItz>0s zpumo0egysfPB?S7Y^xq7?}*yUBZMb&6NJa74qBPc4&a0kJ$MXvnmQjeklBe*L6q2c zy1tKRVID&r;VkjrGG zWi@^6**^{TOIqi}SD5GE6MS85Z4@+W#TY|0q*0Rs}s!b$?+`qgP4*?Q&h$aRZv1ya<$v%3K#7l`LLr5DiI#d0LxS8#a*{=j{`9K-0i+?DO}Vnocz#e@ZE_ z`|e-JKkN?koye&X)L==W#BW+1YY{qFXeK<-Mtw$^G`bP5U;HSZjv*1UY|uGDv!zUi zr247#?%FgBG!otytl^yL2@>>G@|%5njT5oMufY}-+>r|dk*4_N5P`kWj8+6(vZ!I* z2n}G@)%2LYHL@JmRfWIL)8iv76sV*4okhy^@pf9Czr4eWR}g|4)=WJAidlQ8oi6TY zp~V_sPg%;lcV-gq$%%wv67jpd`6oD4oHi>RyQe{y zbj6D7%G&5I*@KH2V3zR}0r)t}LpTo1#@$ zmly^o8}Msr=@Xlm6|oU{P1 zBrx8@;RA+jndU;?q4UqXml`TeY0#+Wyvuqzk;}q`#639?v~hzuAH6@lMgS2^uS03F zbH`em8#dg|*>9aiht&>c2IG=VwFvWgWnL(x57Yvbt(*0gj={TYlcoQHhw?5sZCD)s z+1O@g?484}?B>^++Ni2UBoz3HX&yB{JJ-Q6#rF`Ljw%zVRL;>lZ&wrFPYMektUJ1+ ziooY;2s!0giB|@`J{Y%wj%N~%U@mn|n5UZu;jK`sO)hPG@aHQF_)K*d1^F9S?t;AB zfoxupbxGZsBhKmQq8pL|eKNr70gBZU1|KXtM&3GpLnED$ue|pbA9V=PmNRwF%Yzed z^eACHWb#PE%`b4kf%bR}T)$D5(p}sv^A|!Bzck=i*J@RN3k-h%TvDIugg5c3-&pzK zO*At3DO|1@d)NRF25sBr2oMvnm;*~gGBA9?6nJ@5@VrZ73jBvh^ym31(`~Sq$&iJb zpYfw+30DCacJY<)1~o`C&od z5s=DU+6Bfm=5L0K?-}wxjd~07?~J+nzWmY)vzm}54AFgGbAL0;Fqr-a06sv$zY&S* zJ*7J3C%*zE8%&kiR7<0WmO>p$U=AV^>7L7Kc7vrY4CJThX=PAbu86*CM~R#{nsGZ% zFFI2Yg0=mXaC&ugwR~HPawI%(=>{V!2e?gnoWox~Z`W6{uXW+)K5Q7Z=PrhKppZ)V zl?_g{^3DZiuSvNh?2L;DnJ0YD{fE1`O7A#+56qC6@e~Rg87JYeC``Lx!Ednd#A3YM zJ^3PcTL&n>pWr3H1y7G&y{%=uo?Z#$M{~;djVtcYC_%`vzultJ)t z@l*7$>L(&Pq*jK~q+qfLr9rIfC`{Keu}XrGFu|K3lL1CloXN|t0#6Za#4{$NMq8}R zFw#eoMpt1v9P=2T+&`#j9Z*Iogs2X=Q1G;9*BDI&{AXEDPLEUvYl?X+y&z(`p-jD{ zbL648=PROHiFJd-jhpcrup|S$ z`^Z?d-9gkZ?iF&^@}XPz(W}sXC$pt~VJ{`=KoCF*o-J%tDO{dn*g1U*30`1eBQ#4w@m zC9ZgIJT{+T{~|RupEb*rQS?`ue6fHj*xOKyrjc=8h3>Y^^P8RM3Zl#p+U7gbCNG50 z;*O4QUNygT8Vt|Sy3q_4D-m%8?ZV8!glm-M<+Y)arm{0Jkq}W2do(c%L11FVZyXx& zN$BDPE^rz3miVl=@>H)<_=Vc#eD9DgzB|@_#ux3zn?td?WrJ`mlT-=5NaLWrLHGhv zqzoBKi!NxxZ9~W(pr-MH)$wUIPWbgYk>Z<4EUckKB*K$Dg4tlR)}g6`$wjH9Q*27b zHo}oIE!c8vLMLfH1Ri&n2mT0EB>wPoZ!FzD>ut}&loQ{vk zzn9-33R5d@_8@CH3au|oGG#jr#a2Fj_#5TZhfVo3&p(n=CKMhg5#7PWwPj5DAfxB1 zEkIHdhymV=*&jA#_J;RLd}j2dmKIZw|Ri0-uQC4TnNYkQefOgNFR7)}6Vp z9R9ra6~B15f+v(C@dW2|w{GL`_}SL^Cf*R7U<5*WK@i-RAw!K&Etx_^*OEl&TE5tb zg4kw|Lv&FkY-tWR9RUqR+Cj0+&$lTA9^}{AMrB|qvwnj zkK=zw!OQ3>9NY!3qCAB4E|mmfC&_}1(^tpmH@lk@(`%j$A_kk^bDAYNzv_Q}e)hb` znR>yL#$*gRCpiIHd zUI#*WP=Hu(@n!%H0|Q9_l@8K1 z{NWrYG{%#p5d`tJOdSqJq@ly3Rop!kozd(*0||}p$!ta;nG(2us)mBV*-DfCT%8~u z-i2C@C)}hpVZeE2V6E}$t%t`hqI?OFKq{RJ=s_*yp_GVMie>jGmeB+)#S~pmUicIC zV170y!Qn9<)EbBLDP&)1=5#6HC`>=r%r;7VKS`L!{5U+LiSJNSMwkj0=?cHi6WBZe z)jVBBQA3ic%%!7r={?))fQjwVQE@VJo_ICdH?$Bq7z3zc?a3|>zuNOkmuh9_6^-oH zGG$K}@M{R&1wk@p2ax=^d)>1{W)c~S#7&uQOzuMwIJyy6_INlux$?!mR8|gyG++pF znFNZx{TS!SF~naKK}l&s=5|Lw>3oVSx{qlFaoWu$u|HW?8wDjP;!JB8Ut!W|8TMD4 z7f^j*&rnA;3=8WzVsr^?Nyc-9tWRjYFM}&`rdfIiaf)P6$UL0PaL49xzA!c_&!3b- z#!5s090Bu0nMF6Tlk$uV951-3j161(jqnlRUWc{-%05J+v7@4pWHCw^j*`cdE*IuO z39)2H?He{$oTsau!3}mk)#nFIha!j;n~irT&rdhrP3fre*g>y(&oH>+<5zNTYp6e7--D(fn?83nh6aV05GtH15MAMvGNMV^p5xT2{Ad69J znDTatt0%|Y6dCv&Ou{h^1upV(@)zliI53k*v7YHU-7=8jSHE{f@grG|f9UaR&9aLWq zN>Ad9v5t@^F5bQptC>n-yi8)(K-Hx8aoct>&oMfN0to7}#@cFIf|1RqV(f&ZBv60* zNFo;+4JG4(GP*pTFef67y!hgP92h#Q$&;%q*wY|Eo0MCmuK<@Zn6S*UPB<}r%MF@q%+4|zcksy7oz)nZKNv821_sT-LLjg(RIA4azy~|uA;^KEC7Yi0~k1WrQ zk80-k$kWV3&e+1olkHNJ{Vcc*?-a>4L<3h56em)0|FhAtxta8zP&^K%@qnc%I7n^+my#WnHt>|u1H1qDdaAuRH80M_|SYK*iQeit)szYMM|cFpPOOPmyhf1F?O}C|opzuwo%=$tt+JUYLn6 zHxPpg0>cPjHIK;!_d3*F8QO|tu@SiHV@!8JthpMUOawCH&Ez8ABw5<=qQp44s#7*D z5T(f1#Zes{L}Ljuctyfiic`~vs}@6K7k$7cH|aHtNu3IfNG_(lm`02t&Q>^~7UuU@ z%rA=5Me<>qXc|C>C3%1)BrTYbA6x(NISwaX9vdticfro~<;NDSUaSKFU)Tni&(Y!W zkUXMLg(@^FC`<(dOd+1#o2@z`H&*0*2 z=Ie*$v2kcrCo@bWQ}57Wk34N(uOWl2bPg@DT2C;UIIQ|9TYnR{#(^R9G`A&{N8o&D zZm#I6h8c2Ub+D=7mNUHA00%UXSa$%Yf#P_8f(mzoSJ+%s#FfS1#Bmrzub7n334XY^ zc*|s|x2#NhJcpC+^D)FcQX(ro=K*zPu)5$pnUF^a8<28Q3_;3pwRqr>PC`|d&F1}r zBDldV1_h7JYecNZ<$`C8Z>Z+nnJVaK7@L6~5Wm}_yU>@h$z<^81~|X)a+!cDFuyUO ztN-`KM9_nKSlSIR#wX=aR*4N~bq0qn$&`+U`0jx5-v2oRyy8bp+4YZ(wJ&TP#_ ziGB+KP>r6burzrDYmxvr4m(m7ptE=ip}*vXg4J<_GPMwgQVDc~0r3V=jN6KGHp9p; zx7Y4Bw#@{mSmA0rBS+5nD>5Nosgm+ z4?_oL(k&9c0ED=TizWszA`}tI)pk*Wl40F`oW4>B6c!v1Dd!!6ufb7Sxl@!MJ{r$p z>}t|>rJ8nWbjBFUZ;%(_vOALTU^!DfA+lHF*cNimsgfv#OoGHSL7xbY8ME9P!u3*J zI4VsMlav2{Tw(86zHS9Fk=oEvnFLNLNgfUauEfrcN1nO_!*+BkhXR?>N0Rdm{!TnJ zua4HaG^@^(aHs|AMNVBFI49p)#_Sg?;64~L&pz^sZKRA4e#vaQUR_kR<|{C-PL;DT zU3*tReZxg}xpxC?8E4Uw4~xuLFEh51%^ZrpX#{>P{L&@QE-$#!f>aq-@kS9* ziQ;~A0 z%0aO(Sb8(HciHb|!&+`uD3iJ(%1Kq|pH3Y!SiO>o?W$Z(z7VRUd_fG3zc^A?P3h}7 zE**s{-Z!Vh+#yRlWjuqjx54JW?3}B7*wHpV_N!Cdb1_G z4*5G*T7)aX1=Tu+v?xE~^DZV&<4Dl1%8=mqmS)%zCB71Gf#!W#%XeRkwLk!Zh&+OR z-3;YS9jLG_iMz-n?%)f7T~qQIcJW*`ymKD=&zrkwNUrBH7&S%h+P(Ro{X97gP2B~0 zt$htnqqgtT150H%S5n{W+{vu*mAI6HOzT~scfJS9~*6l_m$ z;dPG7lrtzLh=h%q`SUNM8=i7frbtS>=f81Ars46curj>|E@oya#o3wuMQ3Q`T3?B! z>Cv=(MX+7JOC4)qXs(#_zh=%R;z~)PG0y!=7ALN(2~H;JABEs}r^bO7F;a>fRNj2f z)hSPr?RRdcaXULUCC=`X?K!&Q;(t}eIU{rw(K%uToUbhHG5i&sBm5Dq*Rx5#8x3n< zlcK{f7~*cjyIO<2UIBDk({REV(iukV zyHdVL1j;v*!24}PQHP56IM%}p`Q}%_!Hek_U@k$_BGRnj*kD={mx~2rW#EHz;rl8y z><)KXX4TGlq{QhKkIY`=QfbW6WiNj>@-4&5B^tkm@OpgqLgT^kyI{EVOB^r2uR|FW zpj6HHq{2`>72r&Upu5=FJ_?Yfk99yT`;nEOXkBoZ;D^vB)1j+W(V>cVY`bK^$@Hz! zcrP%azAxG=K`FOn=q4JsHMEoRH$MJn(N#RHEP)uZeHT5oeIsHiLWbGl*Ow`e`fG{? zLLs>l`&6w^;CDd@EaD*0?@8w79p)hBjE<3Zac}y-Z9u*MEI?%Xo{}qaBWT;obj7VNgr?=WNh5v13*CuWRzL1 z-arrsxDLt-k7L%8yCM+@67gUA>G$xzXLsUWa>p16h6Z5ma4LMb6AWR0VVKoB(dDiK zfL4l(a>q6jh~oialp~C}329m&OrzgUM*$$7Lr-2pPd3PV3y3n?1iEsaLGs)`o67Y? zc@0$FELS9|F5^CUU-epvGsT+Z8Iod(y@7#Pg=-Rg71x4R#|cmrLk7U46fp%?Jle7E zUBq3#J1>N^7xR#oIOgqPGMvJ63P(8%H8Fy}+eADF3Jv6vmY@~Xu#(Qmo(cwKU$CvXWIuG$2*kU1GthdBFq zrzH5{0}>(5GS%bgp2Ts=hox}HvR7tbhGlBPchGSU@qLB();twyN8_3iClE#yb9D)5 zSEkblB9K7UlnFZg`Uxpg8kww+nW)5~g^|=}+(p~)o|8^J%kjH-@r!3UVn+rQ>1~=Y zGMQAy=vmZ~qWSbu)4Vyus4|Q*hQLe+UPQ+~>&t_`E+$uH8Rwx zUM}M*KAU)rAB#Bw<&Mu(CpeQUNPUl0kL60+QkMR&*G1gMd+PUrMj0=yF3azWe7oR4 zh?)lkZNa$wN}#%r(H&pkT0TQw0%Ea+dDsp9$#g^z6h*8+0iK8F0iOzVaV2m`p>sj# zJOq_orQz(FO$P8DwwaH+!CTZ}AeJk*I0675DFlIm<}+iVP-0!#v;G|hw}C)QJOa3n zca+)+<5_cTTxrf|gj6519gG4+J*MTHM*X{TjDFYyAl6ril^H9EZctExSoUD&wUcAP zf;?9Dc|rSXk9z;Ng?Ur0OQ)6)rzYY#XIpA{!`8Xo@i$vDXkXmrdJU6sGkH&NC4oY3k?P zTyP6<{1iI{`wMSI(R+}UBXA=Tk&;NyN68>$d&1yj3&Z8vbc%F#T9A8zvoi95Do zJ+o~Dggw;6xK&z)OB@C5x9=|69rn+gbNH7rtM>89%ae@lf>Gok;5|`q zNcS(eU-8en!$Yv zkPw4D8~VrKY8+-+p`zfvDLDdHj)XoM0fB2l@Hn5kHx*;+m#JdN**lM~rf;T=)Qoa0 z5I9n#Sct%y;_0teiJ-GeyhWxb606~GkGs2`;hPV|#(;5A86U;$3S3@b&7!LzSI+qk zFYFivnTS}bJY1WKLV3g`&50DAI-=OykSGZ_D$NIHm9PhjoWn^WFL6H!l(Jx^6oCVN za-qtZQ9Ti0`XW6t#9K#J0f|n05-0M=^7H8^$|>y|#1=->jBFB~nmwQoL$G57;drhT7%j=OMcA$$f=I0P-A(fBViF$lqMe)M9sJ0Xs))?x(%|B%1L@- zfaTtqaP0xtM4u-Z0vZHR)l9& zM2nm_w4KB8Pm#dkeF1YAr?>?f6c0Ch=wyN$1VuD;sV0jwf4DQ`@kHjZqR%lztH7*y z;1jECjm38eV*@%PQ>D?~LCV=wDIu>M2!khAmXi`{La9%SQBt26SjbkBdR+Z3fI0Rh z$ucoiW5F{ap!pT?%2B~9yPP|TlSkyAMNu|7Mj?n@Oo+ylgNhRul7iT;B5?x&rAX$S zW*MXB=^w;Fi>vP<Y#s_e{Y)K?yL+CBK-GDIHM!LoI)-^w$!VN& zxC7B<`pofEM}kIp$|GHl0le}a2>4W)4C=)}1>YA)vsZH{b+ulSAuWW&41HA;qO2yN zB@Aw7eWw}b=B*|}`Z!R z%Sl70%P1x5GjEjp$xlmsz$wAWL)34^VV0|U6nNYPPG-P08VdiFs3}kZ6ar6Qhy9&i(TtenAq0SjE8ng55;{_jBD`3VK}m-U6_HZd;2w!N1j=MI-W+ZY&R1 zpd&no1gxe7YvcL(xoZ4_d*$<`ZYn;cHgGS z@aMwsX-33wab|w2Y+px(xGq7Ab(Ooo6VE+BDi?_S`3x6m#l|2n!4qX>+I^o6B<^PO z9cOmu6FNOk#zV{uMpfxPiQ+yE)>>o&!f0GDQY~*NzxSZr$p|*g7B}fuBV2sK8%4+_ z<;ito$=JXtk~_=C+(NDDH{vAZNbL+II^&00{A^ezA~Bk<5BpHVR7^L{$760drL2vi zp162JWTKQ|V>-zCLFHqA3N4YEn#x!Onohe(lVYA4WA<_|qHe%I* zDaiq4UJ_??O<89FwOp~G$wj6C*4L}d0ZZ3raPjF23(usqm8S>;!XuQ;EHO-VU{H#r zCxsP}#}fFDc7wO$a6q@_45BFEh>?7R`M!rST-(O9zy^Dw^#c=})LvE8R;{fUK)PB7 zlziYe-iWk_j>t?!n9j#xDo9mCqjK`g>QyK@7ZwOaKb}(GxOd()?;ts$syhUiUwOCC zWl4+x*^+?omAOmELoo8j;ul%E%Du(ndY+3^&2{^S;xGB$yJYu%{|zBvNq!h?Rd!kX|pD_ zpxD+fxYKjT!!}&bU@yTv5ge0S?9)Y@k0YqTpy*zPG6Op~XF@DWs2fjtsul3m$N)N} z9%nEv(m7)oZOH7#pu?NX4;}0a|Fd&dF-_iuT(Kv+reryU0R|T*9Oliv;c%q}<;5#USD=3Ws%gc-#;V z;J^CIK?CsMGjSJ28UD*d#(uvuhHe}6S%k_7awm$10y6z~bSY*>H=rMPkI`pU!5sPS68?2ShV9uL?Wh4C4_U@62B(fM4Wq_qE-lIAk{lK>5^I7sS zvLMLZPU;ZEU{PRXfG0!f9j1fp7>vt|obH92Tr;5{gDz}w?Wu~7D5yAndmasXOnaEp zkWH=%C^0veI+P&HK!M4X>)RyA=j`S9K3R=UB;W*j6GykFZ`pY2$b@jyzcNKPz=^rh zEQph5FW!n^qd#Mupk1?v_xPD83vPb~Mvl(kmKZO4_ew*78Vx`?){4x-c;Dw9QGn|4 z7DnaS#?!5BkdU|NfQu=swRjNm3@n&1d2A&nW+K7|(!&|toPUYOUq|8yi|x=q#8=l} zA336{cHBVF61>h8Wxdx?nD$OS&EnMDqL0ol%9Ns1)$yc!z%%a9zW~7x_EhRjGMhK%lz{^nI`iIMBqH;=Q}z{96ysEz*mcD zL4zoGHOJ#0)`oF0eT{1jSuJC)3>hKz8allt4yCqXWko4d1lZ?cKkIMvD|1`OS(@pil@Uvx_gG9RI+@XV(!loxo_!WGt;Il=q;&HjYvAg zaJx5fV+z|~v^|_9F~tL+vo({p-ygmH?V$hk@Kx_TpX9x>B*__-&!@RE2d7{)d}>U9 zmK>M|5-Ggxbd^>(R>j7V6*wO#VN35(NEf}|CRc&U)g?U8^nMU!?PxTOuZy7Zjxr_FnGOo~7^g(_zLLH81>=-q12EWonG8NAa}$$$JBwqI zLk>9P;4x)_S*HcA0$X90-6rW!h}qlNY0w$p@-JIr@$|BYX;$K`s6eV!%;9YflSvp) zIaU#y%8{@5>p>74ot`7A;OO@Zk4~9L3mj7^^r-uU0`KJfbTxzk$AeG=EYems`p9T; z%dg>5ELGHxm3zHGob?1qeAq# zZq2a1TWnYuj}J4lVOnR++h;)}70?#O)lwh`WeSKI%weMHMNua#PN1Ey0(mODh0(Vp z5JI2^qz;95706YOTQPP`tMU-x{V~f{bro)9%w_x9^zUvRSo0m>0cvdCI@y779WdO-J+T0BmsL))xF-oNWw?Ga6a5 zt6o!yht{?nxxT{jcuVU*sR$P15qG=AMan-OJbQQax08z=C2^qclncFi_PI$9w z+^v`S5VD7TI`wYNs$Bp%;2n>q`^8z9%e9e;$c1{XY}0xqQW z^~csc#=hTDS%NP*ZO|wrqcXLtT7b63c*sZ3X58I%L#Xcq-AJt)uzgi7u>zmHd2`XT zLUni2JxsmHiedJ{!N>Wm7EpbUAVSZUC(w$q+O~@=5xW_$%CC6y@F88Ftz(&;!++!O zW*bXx8$LAq)iw>^J!82o!ync6v0<#HH;Zl;E8Q&?SaHqwilw)T73~xaHVUsbx5{l| zRlCGGHi^nTqNG2Gn^(`{F$5<%Dr-_~f9Ns&2Le0vQcN**5L|w4!=H!3-K2f``sn4m z;}h^0f$(6-AQ{7JRu^8)hqE^`aZQRllEfKB(*_q7emRi#prd%0%3@ZQBc65^PG;a3 zeg`@t@Q0h!xhCRdQ62Yp*!zJv}8BM9q`{tFuTc08DryEaSX1dP+{%?|sS4~!yT z?3_?MPTZ7HW5JA$h4xMt|8IMT6)vHyjDX6H*|B58fdye&Pc#f!5L77a3b|cy|7Fdq zhC8JQ-{u3XZ+=CSK@TkwJ-YVfU9gv-1CyhCl3^-~Y!(h8YZ2)vLq1!*VLZsmTgHII z?LfR7EDPtmSL%`Dm%WgJl%Djw z>&4SiLdA^lEM6wg*;K3Paf6)SBJF#Es7onq2O$YvhDH1&k}N&7$Xat zA2F^+kK|%^DTsPeTL`kr^!ni#u$1;Fo|7nT8>U)1O4B5D7Y=7}j~_JD0#?hKU{w)N zxl(JND0NHas*ZKsYB_m1*G42F9I2hyMCuaTm_P>ZiBQJY0uUIjvIOXhJ#G}~@d%-| zPQIs22t0x@FsmImH)5+QqvPWw>tQ%l8}u`)6EKh1WG6kwC5!Lnae;3!FCe4^bJ4#( z56h>8$4Wn?X^45M9!PXft6(qeY4~N^77}MxMJS9UGDWiqo;4G8G z@Jf<|QiU!<24-=(3uz}k9=Z02wudBjNpS;FpzIob0*lEi!{Rb4Hw2x;n-~SmJH&adVRYD z?ws+194-+-2q4H~1rk&N={mXX@%Sbi?B9NpMF*g^Y|0{7b))s;6d`4B1Ev*xLw(5L zRS&?j^_p&)9h7PS{ZX38_zF^%9R&18N$O3LPasy~zv_^lvAvyVBa1QiBZ%UR(4pTH z6dMK$;lvo;XA0`$5q$#*mo1|xns(B)}z1g07P1d>^Cw;j2aPsWk3;7a%u@(@D+5)99V^DFM#^ABUqac>( zyx?$odZ!N}mPKI*tSDm=dI^;n&62DurFY$oX~K+{I;~A794yG!oZzK|HMMjZI8G_XBLffjJSIE>-%_J#G=x$VIJvIQwCP|S+s6gA(NZD=wqP>c-~k%} zTY(#{?r&~x79_!gK%U?~telR=G=%7}XOMbhx3;MjqPljq>gOHN#3$)Py?781?_gT2#tB*fbogc^UrO(Pu1Qh za9{LMJqTVzIW9%j%z^?85dmIgwjrW0y_o%ByRP_J#seYXvc(IuK5TYNEfgebf(CxU zNl6zxoCp_zcjF;%$Vqb$FE^?uyysy&rXXBbkn>WI1MFexglFf2&4`hH)MbKiwrP@; zhJUyi$MgJwxT4rKA;f~ta_2=cc&MTw>rJCi7AoCH`v2-G$yzaB z9eW47Nz6)&$)~$HGy_poMN$MCbpk97rXVoKj&Bg06WKbM^STO2m+J9d?+0Z}m{*MRH@48EaH&Br z%L~PZsCMFy2IXJ2=|lU&zEQsfPr*$JK>)A~Lc(UH?wlvX z@UESKT3cnUW%f&H#5C26Ce)n4BFK3uj9cGvzujqqbO z`wCOf*)YdbNtU)AuePB$)Vv7AL;46T^XHoG919CiZGSuw(!fw+5nk==w~%O2 z=#&~5Z@R2~l{&A8wIt7HN@P?N{uD8`WI;p`x(J2AA#9+yt}(WAu32l|0y5vNO&+${ zyC7_cFruiCHl4e#;ho^KN?8@TK4Iz0`Wwa~SWF8k?efb=qm7pZ~4&?Xo%`>)k144Z#AxJB?{HE;S5xb73ea&rRZ{K zJ?ux-qk}ydOCJQ{&kFbuj^z0!p>i`GZ=lynR_45P4ZG^$$h}o_@4-20fQpg}7h^I>c{+*0$Kjwz2ef z%LYg|U3tTj(Xg!GxNns&Fe+{brF&R;gXGn!AeSVIO4w}$HkIEl3EfbKy9?BHlsi}R z9c7!>vUgPVGN^-#4hIF;!bjHyTXj%q2D}pPD656WifpUi@^(PeB8-0xyrSeb_?}gQ z)1A*6K<0mL;W5y3xHX92p6E6Qx5b^=>}`j`eqBq$J_MAsS5Mf2-gESBRy$G!4*2*vcnCW8H6YB{bW3ps zv;##?wA$rErMA&w%?<}V)`0)jLE@fm@b6X?!$jwzI$*+!bo(P)(d3Tg;5=krtN}OA zh&|$|f@3bP$P26vl$s2I`;EB(3U{$4AVnR=5}Rh(ymtAkVGXynQ%E~hE^JEYpxXY5 zf?L<~{NbH`#59Ho93=zvtqf}+%)T(z_i z$`3nebm^)S7|8EyyRG?N4e{9O6@?%ynE)o?3_0gGMrKUTG>il`n40=vWzQcT1kdI% z(@u_LQ$>$f*bEG87=dK&92bmRu{S)hcF91J0*Hrl1Vy2!DC#L^!2GmHE$;@_otO

jqewHq7o_QZVB72S`TG#<6+1 zQ*yAx#!Y|+fiJ*a0;nCB^3q_VGXdz@3lydZv1)o$dD;V?)U2faXgauNxmCfh(JLZK4pl`55J}{w0MlyApEiN_sI2ZPN zqm_MrMN(Z_^R+lo@ZqXv_n50LU3lT>O}J{&6j;t@m1ecgp~BmhHU;U~(h^$( zKN73y0VX8(Y932=F`cf~Furfts&?hqqiv;p7jHk|}uF= zI{0wl#~_8>w<~Y{>LU&ZO%r!J2*2I_2RS1P>S7oznV#fEQv>lLWC|cmip%@TT*!9^IxD?xvraPzouf+`2(0 zXkiubs0M$d%`X;ISKg}_n5rJ)FGJl2T`~sAcuacoz8p=&M?ffCv5xnEd_=JauXrZD zw_$j$CO2D0yQEvjquw;hIoS_;ke*LHXXH92C_{>#$8~a4k^XoPw0O6b4nI#)7(;7K z7z1@sS(3_?a~|WY7CXKan zI-FjJ)&10i7O!|t`IKJ3-SX#nD=+vV8qc_%zOrVDiG*`aa2fB#S<<6>fSk-3dse29 zyK}OahRY;TzcP9J4X_FTak;a<``ridP9K9)W-DlQS{K5uvEl(e2wo=PP@SP{jm$!r zAJA~9wrP^Tyqx^DF!?C-Xc(R>l&%NBC>fRHzU1!Ge&A?(-?&g^YyF#pCA{r@JV+g$ z_G%}}#$0`23e#_uqrF}OZUiy4EKef}(oimMIOQJ*mweqgY~0NyI(!}R9X6TXFtLcN ziQ%p3ehSYb%+7n(#T997%5f_pR9*;roUx*(syN(G{JRj85qv9S|57iKh{S z7{c75YJK&Sb8ymkqh(f>UmSHujO2mUBYdN__RVzVScvR`^+p0YLrKWn0+@UI;-Rwn{8O`=x_K@bVcY=>=A!KyL*Q zMABYKUZZQZN(H_+nX4Z5@KRq)WLAeYXs=&=uH1go-EA`-eUaqhm~m#Vo+wRhn#>Q5 z$RPZY#@24H853p&T&G`2)f-c{N*bm^uX#L0FAa#(Pfs{NQA3<{`i1BSY3xoy@`nNhj()vU^3Q>D5UoT|j7jLJ2P%EF{t zw$Yh<$Xck(Y^=o$eqt@tlqqNoLHp{wx2kf25>+BIFsRxZEv8bxGnTv%aC0tXGTBF1 z3&zoO!?K1qH^Dnj6H5$1RHzZRO@i<)Y1^A}jSE&86 zEnpJJqr%v(dP#^YOI^J*Kc?9D(JH%=efvOiY;#my(5+?L97-vDR&o>n4T zH=n3LEZ#{rqMJMLXOse?hGqR+wpllZZ618Af=;#08L)A}4Z!Zow6kFyaGA8mtSV6s z-v<>y);Zm31%D29cXn(aN7XaVC-@j<2g3V&R@(Z~stD2N786Y3;X5lo5utZLL@pWv z=KJH+JSp*>5iRC@)ieA>>eRA&3C}u|YTR4oqHWZX-;F zW$Mtu#wES`V9d4yCt`P_pN>r!L-A3s7^)nQ_AP^;NYJX1y*Q|UG3japiQo@q(yCO~ zS4Uy$4zfnA^95cly)RvpF0z*ImkEM~t&DmkHn0n01GD*o+u8_}&9n&V;@Z8f%dfr- zpfG2QCmB$wbZ}+#LfM3?*}}4YBc@=qaoJYc0|a$6n~de!cNmDRF&iumfdpQHZj~`*gs`=)kka)>p1kUM^Ehk2gH{do=^*?HCu_Jhkd52W7y zVDUSGhuF-B@tHGVT%QGhQLwSO`Gq3~C}%Zu3=dGuRXPKpN^9=>b(|D`%Om~{N!H5- z@r3>7I+}!8kAea9&=wbcV$vswkwmZbU-fte_KoEsQY=WkHQ5NiNEHmXHHc~kl<3pC zK0ER&Po5_z)OGFbq=vG-K{($yy=39xLa}QD z&^&vqbVGRRLqWn*oZC1?=!ymjkA6Hx6%>mXT(q^$jQ5R1TaS9-bl6h}4Ypav4$6X~ zU0{Sq7lpoB5LYfKIqcZgj%B4vmT0T+PzI(b99;9Isu;4EhI_>o1$c$u+nKV6OVFB# zG!CWPI*GNiO@&OOkiu6sTtVnLzEu^S^0s67I1h@48ew%v>T=9IJbeBqGqy0ekozx4 z@QG4-d|pgZ~tPLcihdbon&@&R_1Azx<+jg-$BX_(t_?>BQPGT5=P4Q=DkbN)}o(+*5{(amsSxuQF5603^pM)sAPtf^c-U9N;H9AU#jFL790LWFF)dEq95+Eyr zbT;4*l!^o3%Ql-JHE&0mTR3L3U$px74fmd86y*z9_{QH(h?B<0K#Vu zk{Oc`F^w4n0L_y$BC274Otzss~g7Ue5%ykc>*RBKxo%wVWV6YV4W*QTQL}l{@2~iM= z*QrIX>3wYnuvqUVO5;%+4J|Z}CMFhq`q!M`X$x#_@x(m*~#Iz#$U}Y6x zkND8ylPkg2B7rqK8HGK(;k@Kn01noLKX?w#CB`7Y)egb1NQ)8BrR{3YggjzVe~8Ms3_qLXv$YS}Y~+523i@6zlL{XsXro)IQML|=61_k9v?10`E{mk$)<(pyycFnY*cB}jsj=Z;=&R?pu->%vTftM(e~&L%X-xh zmu=pWVql*O|AIo(HJk?))fT^4khCmmE8GHKG;--Qje_z34@erx0}>|xExMEBR#@YW zvDtkh1o=qm^@GJ^D7zx$P;$Qj%pVkUU<%u&F|notii}y)2U&7sRgGJPqUv5)s;sO# zB1pd!73(@vs-SeGaZk!woEj5p_A#bRa2kmk?f|Qz)>2f3I?}4G;3S9InvR*X)_Xvv zR^7%5*GkENN_T=G<+;V!3Xg7Z73|UGX7qq@jp-oFWjsEJ&Bt4T)bmO+avK;Yeb%`i zx8_16>#@3d`LD3i!recrj92}>X>`$#lRAxzpK$5pEfYu+PXupDE}g!^J^p<&^t&_E zhEF81Hkm5yooRIf3JlV25JGI^cAu&p;ePPBW~RP$C~nGrp!i0(W0hcw<~?d20H$p% zTtp3c2kZmSv26F3c?as|;7hwA$XC+~*QJG58BIYv%U-3%t~UsPV9v6Pf?zadhC}cf zp;v4Kb>No31{SbYgDwY5STTHxqEH5JiKGy6$EjqrZ;PrxyotOd-er{H&4j9Zd}0kF z5{h*Pc3wZ%gAxdyYmG^uJ_W1(Io$49;xdo5qAkKqfiTabNb&fdLW;-3i=K`b>h!u= z$9d(*ug<~RcJNo{s;-^a)w|m-ab)M=Yi~WZtB<9vRBwJ}CM%cE&U`A^56I-(IuKrG zVd7H_Fym|t+^?i=E7#>LO>W{Ls?s8sGlqmiqs()r!bUaz9?qjH^Ll0I^{s8Wt9iETvZh;GGYi+P?ZwU5_NuUI>Xu8D z*;qUtmxIb?WM`d`xJRgn`o{I1YRhQBoq@k$)ypmIh zOY3OIWxJAmjr_6Y$w%4750bKC7$jANQ27BpcD4bh|y@2;@;N!V3+p9rmU%NayzyOrb_d0T%CuIPD$3ZkA@8u(vdU7 zVV=52j~P_t6efudAYE!te;Iezho4)vKCI;sxeQrCc`1-@x*TY0+qF0|>}^twF80;JVYR{l4gIvb`<@ zl1MJH__I73N*b%^u0B>+JeMD$#fW{+x>CU-v$9|8}A*@?(RX> zuUYRU!C!FN{bJQPdCR4C`Fa#g=aV<1WA<$W_}Oj;j<=&dHN-gfhUZg+k6?(uLe7Sf zXu_L>$-oGmvdsd4Y~4fvxo?=G7#m0M!T0#@?!L(d6f(vB>}_E=*tiUWweQzz-Q6u3 zie9%E*J`Jbi1KvG5Ric)4i|`_eeB9+Ctxf|`wdK{mxhcfXB)7&Zw8a_6HZdEALX|Z z6Mi*T{UA8Qu`%E;xyKCbvOFf(=T^}o83M#F;Cj4i_#poN@@1Wf&@z4VL8@I6y&!7i zB|0Sx9DHZ^YN{XMTDGKJ8}Q9C=_$3pFSTYDa`5W+kWz>gtw4qd_75;iJVY5r<2>8| zXa^=(`);d@yV$Ti=TLUZW$2+rU`{|W5_ji!H~lB4dZ4sE%X;Aw_7|j!G=x(JeX;+)-e^!($d?wpIQtNyb36VAlu1{Fcc*z|H}{y4P+x zpUUk=9To0FbJ%1z^uh8S2=^Ox==;i81qOhNGc)arTIWug#Y~KKc5Tl zP9;aw;d~h9!OP?-Q-vcE5W3witL1itQ3vC(=adsv)iiEt8S}NH_6IF@#NT)mHdD@P zxYj82B8L-^%P|L@3hO_JJXwSRIh58f+Xf{_os|D(pDWyO;86iySb0 z?oJZMh_Wupb%4BMDq0O&fseF!pb=(mRn*gvUJn$$<5!Il^nqlSwN>J*NA%Sj#nE_( z*?JZ5kQw3+!9WEFik@v2Cz3&(Ffw}KA_+~IFZP+8F zW8G{%nS|+Gm-t=}BR{aMc&GaCkX8o<C%NWeYR%3Aw$im;KN%6iLz4>Cm?!RetsUNAs~g&I0bM1>zxWcp>9;0-PQgJ-*-u71#nGp&EC9oPnCU z`-t?Vc%1ghWIT8z&KC^;$(6iwL(yT`0B!G#Zg(c zqP`y-!FS~xO5u}y3F9R#JWu*u@+1AStsE+Cf99R~(l$Dzd9By=2s(mhURb9RqOz;- z=EW>9gkkS~Y}xwPLk7@0oeswHVbnXH_Z8n*^%zW@Q^>{0Sq4mrrNM84R;v~KKY`Bl z)N8H>K^uyEqoWb)wNc#Gt704Z>9D9*8jPs?{{*y0#s7{ddfUck(7y|u{I?UhzTqaI zL>pgVwz!S!?}#>>G8K_3do9eRLeJo4TEd`Lm`-hz6Yy9wroyu zp@Kn*7pDzCm9_$Veq!4rdRoX`4Js==Ik@!9+5=BX^WA-DLHq*K%MYp{;~l@PfoUj1 z2--&|+z-T^5(BxL`l5BF&O}(KKNtXP*&9ojIqKPR9scQ_M@d<<*e3mE5(gv#^r4I1 zhmLqDXrgUiBXQgm(J)oq+E^k}W_@PNq9zE&Rzz6SA%nMZvBpbc3onK0#JUXbirdQ^ z5{OWI6mej34`y+z|6OA*7$vrgwp>DMt5T#r9;2q-YCf)d1k%NfrpO24-i8`l; z2$mrYQm?Vl@ix|9=8P=R(ntzLp@ZCR5(X zBf)d3g_=|pzvuJ%Vh6IG*f%<_SC~!Fin_)59@ty3qJ3Wah+XMv`IH^1uXz7e_k7`Q z9+0~^^5L(u`P&@dn@Rx|7(XXzz|y_-O9jnu9W{PdBOX{f>LVw(km{5dxI3Jy-a=Bt zdL81_zzAPgXwX`TKF#7Z%E}&i{6jC9I=t{KxUah{;yTr{fU2%*muD)L=2w$z{8#RB z0?tAUV&S#0E+NNBn)VNi(q$7mykFtT*vjork4;1gcoh-_{_em9F&p2|%TzWIr`Xb+BmiCuAtTYNwlD#IUmA8&q;&@Is_Tx)bL zIcm}S&jQ{TC1IVgSC7XKOa?F#j-P{XY8JE%D7V*98mWQrPKUuC4+815Gzq8SRWxLi z7-l^^KHish0jwY_;g3KrzML^hY#1KFc{(4ku0})hhY^0k%IN2P}wIhbc{)0V7IrU2BC@Nb7+|Vhm0XUj=WI zaXg3_MckLNDSW(;=KvWFBKl7lKj`&pQIWpqf`A@|E* z>>^hSt=Idu0jx4Hn+-pX4(SZ7=$iiCQCU^UWX(`AT)`hMwQ!IQ@3fW?XRrWhd~j69 zZ$h*9DivR%*yOYy&Jj3?CXvaRUYT^ z_FdJ2TLcukW0;5sJTTv4Fl}4rkl^x&eZCv!thkg`4N!}_&ffFL^1^VsV1W6B4$W5( zn_M58*y7h{ixmw@xq&C=U5h6LU`FoxfNi0gOw9b*MuE`WQ8OhrnF0_2v=0CQ}=@^pU0i@LV`S??6n16$6nxUEwf5Rb@}QV>)ER@RGx75J-f(gY^4km2WCl+in4=cb2?wjswV5_xhpcdp`E9G5o zo>j%KFr>auEy-Qn`4H_(++Du;D)dvXbbwsN(uMO%B}=crG6$U+lC0NyJSiK22>Nyg z1Z$!}nJtv`CpkZ1mMy1D9o{f~d`xlOWp<_2sZt?;=g@_Wv#15q2CJ|_9x7jD#;zjP zN49T};L5^)H0rJ3g0;PcIWM|rJ1N$z=eE|68!Wds8m+kQdRQ7?Y%_G7_?oY4_>vcL zIG?i41e<<8BJQwri+17l>nlVSjA!L1N2($%>r?ms5(Xk zDo0>q6D7GD@JK3L9TYJHq!JqllJbg=l~ zF*uwP%Lws(P5siDmfcJqnaP8%NyI zSzz6YPVxwb(Q+GF-O<1JOmZIXlaZ%kSgA&Ax-OZW&YC@31Y|{(JJ+_NaapfE=^V9o z^IeF=u7*Qdm4Pk8yF4alWlTz2Z;SIO z(%{z4t3*iMLYmjr5kGSxZ;b2b98RSHv2V1sSRyP{TQ$_R6?-r|8z+O0!TV%9pDf}D zsHl~FfYiG|NW90&n|f2*$`nN2pud7hqqiuCRT`p#H`ck4RZYARpS3|vNZsgu-mZh0Snij8b+tyjRzeRVa!`fZF z?83*Pdb#jPFeTxDLun)&Wbwa|{;&F3_2{7B>GZ`jr$1l`<*Y`?Wx=rQy+Vb}xwl5`K3)xkbHI{dD*1!o7S`{~|1!=YR3dQLf zF?H4Ab&}+(k**maz1PKydz7u!RvVnauv-2?HXg7P?cgbk*=#czTCL5`DT-G=2RYi_ zoo2h13S-?{m#eL22N(*F70cEt=p_Yg6_g=myMQ#=Fzb-8s0i){cX2sfgTJgWt^!-1 zM6R~7uvo59{t|}{3Yg!Zfc`V#cPl;$_+8%qUEVgHYI$3cOI9FmE6{|rtw^7CVcS}H zmC|;V*t%j_`}z6#QX=*!z$32SF(5$y4{X8B==eT%$C20m8LrG-|2+mN6K(%8Onkt{AcL-pUF$o#8jeQOY{9h~gvA^|rR{H-j;uad%1JSvz>q+Xae zxyEl*o*%_XpX8%ND$ep^y#*+j?m-sBO9PO0GKfniM*}9R=6C#--x}{vOsPd0s`!!d=Ea59bUrTI<@q!?>gX|(L8(b*@fGA|!%G!M z1;@zvECsJ90NXuiDbwt#fttc6Ma&6KiJyPXOXDiZ>+=^GMC_x0hE@%Sbqz)$d)P?D z;d240?nu*NV5}m~&0q>5I9^%cmA1qLis%O|UVmXt$wML_X+Uqq&D+ZR4Ak@$ZB01> z>iWqMi^&is{0bSuA`w7sZ)L~au%YsbREicOl>*llv{V7Y-0=XCr_gKeu834Gal6^J z*+Le_3SZiTEqt-(EN9&z=D75YPnD@uJSHelVH!5)|SxiB08Qy;nXmPd42}b>&@sb+#OpdE~$A zE*_*wo(z()s3v}UDIcN|{qoaS)R|FU)#-VI5^9xK&6Gr{y+S+Id|2w7@~UI!Lh!h~ z?jHn)sKJ0B7Mvm9W}+DTQDfD(Y$Ly5ELdnj1sAZZS6WM~4Pf0tGC~QkO6zh+)5~jK z4!~Uda_AkEK1~jYOR8Wc3oCs(n3b!4-o&~xmCRHd^&Tv!KpKQf+M?(KVWQg0jchguo#1>IvE3Lph4ki3}tAU;Q**N1j%POrXsae z)7iOzfK%u6>cXnprKFks&s^Q?*ytet69 zwY^TRRnhKR*;YlnYvx-OEw7ky*`>FFbH&8Ds_i(M>bR6e2bHuHM2EEl<^~;I(`{zQ zK{#K}jDyYJyZvU~pF%u}uVcQU#_!Kdmp9nJ^nw+9j4n?1STw0180@LigXIs22wLqq z5pR?XBvfT#%LvkalVhM#gA2KCiIFyTIvvErlrD!VP%QX@a(J(`d1xmNwNdnj;dQZL zX;7@$rLN_cIDhj7n%#e7qSJNUkMkZ61Qs(|W6WzB530K? z>b=Ekr?WTH_pDBBuMr`=93qC*(lVC4fTA9xtnG~qbXE;p6o<|1bm(!}5<&Hp0QoiW z@e{>#eodJ*8XXmK&?^mHCe4(!TR|P9X4HMtkg^T%ldy&qHTbW>dLk@YO$l}rCv&oj z8UPwNxi96UzSyzu5JP=)`2up{(qFJ%oYhSEm!yNbSZod4;@2X+tVDY8KiBb>T2?5r ztX5iCT2fh)l(LkBav##kDkT$(R8r;m?v^wvYb`G~+@s8}7I|Tfvcg*Bg!Re@tC0`Z zC>yL*E@*h}YTO=i99G)iHs4Vjnz{&}>9j;|TSiwMRxT=h|K=@jV7h0!*88K^U&*M& zR?~fkNoDKXKSb)$Yu^j!3@%1I<=~f-^B9yBh-{?a$jr<1Na=Dy$BBTJRDq;oAo_0s$qK73yWq=4mC&^LVL-` zEXN3E=N{Nt*(H0Rx}q~kJZE94CiGWuxXg?99j8|X{(X3#))i@ugOdy=%C0(sg zcFw561U+tp)iLZ&jy9A+$chy}4koP4=xTB}!{c=;(I6+cc4=g)RDQba7{;4}*5Sp) z;n5E##}%d^1ry+>#Ol0!X^((Xb*ZsTujaC5QxmF#a-Mzb7!u@TOjzTiaDc(nO>5A) z@G~Bw-I)EkReVAFu~8TcHa-2W41@)b=kYi^WNa?=%E!M~x1pL?@ILJ&V2jvPE1Il1 zwW2n0qAXp<_Z|SGY0CgW?>&1^Hbp}6@N$pzaz5jWKFyMp7z9;j2+GsAKS#f3S6g+p zd|HMGGid^epJ-39P?%A|18CX8Y`|=ELX98=M=fH`7$A)T4M5uH!hq(t%tR&b4q5}! z(=*gOsx+WBII=`=`mv=+yxzx`2+OcW8^Bh0a*eGuJ}|{v9+AD^ai5!-Quy!e{C9R< z2mN<;UI%jB?7S{sm{!9x=ONblogMSm*36EbpQXh}S2Dn4WU3vNjxDv4xnZ3#l($PO z>-yl6P!*nLyUIdc(SwWK`v@NdM_@*A1j&KNX=eH6AlUV`&AFhEMb01zuM-0U(7oB? zOf=lHA?`k{Z})g8aL?AX--r$E-VJ9fw3cyOmhF?(l-10BCFW~+OVwf)rw76FC?Ajw z?%nJv4Tn(xQrX;o0Slhmt#D3odISg0PpW4PreCkLK?5S(cWXM-Y}q7?j21_`T=XXQ=Wb^>Y85l~mX8e;{UfaPv-gE$?`#{c-dx}^7lqSRbJh!VkI|j1nPGlTghX8=dBXJa=f+5sa-r(H_bp5Ity=u zW0#%5g&Jco4vi z1JEL0FrvB*@4W3!_iAjqUkj7)je8zu`4MsC`!YCZmwUEC85{Y1S)@viU2o6cygxlZee?R{*e(N? zNlzmwZ)=uP%b0N3r!mIV~LzH*5=Oe20!|Cug9_H7*>^hu9 zwjtPx_&~mz^}^wVF)5jtPz9=g^@NAFT{E^F15voZmJ4}8pI~U`2~Xr_KrKFcLaXa$ z(;k-d6)FH5%j4t#AeQ2UNnDIsWF}N=As^^-w%tymv=?Sm6Q=U12_z&KH#Gj)1L744 zWMv!{AAGzl7)9iBlUd+PKOc?$XxL-BKT`oqEJypekZz@dYp!D@X$Zyb7}q~~K%1q> zO*~{%WMM7Zw;bwK9Cz@#4`2zM;~Z(mwyIVK|Vz$J21X_ z>7b)1jizikj6qo#Yw5d>a;=CEQpeSSUisPJQ&Q1-vxE)n&V-_U^nfNNj=K`6u+&e@ zEfgxGRa+`7on6o=RRyt}twR%Mei8O$c%)O3Dl+GZ_7m>ixlJnfVU_+}wDmK$mW5aE zYE~K5yS65Sde>U0xqA{Q{raK{jLqs4f{Ir?O#t+&A%#7^(x!0dRjYZjW2{z^)x2t% zGFh`qn((z)RYks948UTQn_#vq3wc$ui9CL8#WuOduSrvm@v3FWD_(UPCcLIPOSo41 z9*rr|gXbiz;B2I-tdI9{ouJ?X(9~^NwftS$72f-CTK4HkW0&PcM%Uz|X9Ens8*v_` zd6JB??%+C%r%b|4COvowJl;GFQoGb8gYw2EK9s_{IR5ZE6;k2d+v$*UVsfvCM5k{d zD0^@uPwel_DLKaMu!^t1JsuU6+x8D$a{87btiYFV_!4RoI_YTKzP2m5kHhLuUL9ob zr^fCvpm?dlYEExzJiPk4<6&Exsf*=1m~jz|*R=-zocY8}mY4A=Ah9wYkV-lQhuB1& zctArNCj-`gF>MMk%h!cK%B(GJxIXD&%c466*enXSDg1CCi$^3DG_}r%#N?_~m*WkK zPUn+8Ae3tK<`5Nf#}7OezDVa$2PX40hkQpl`x(rqkZ2}24cHim0TYCSB)^W*TekBx z>J3w%8gz$BQ-6HBV~<=^^rzkkRpoEV~p$s(7kKEIbSDk*#gs3zkV{X67E&Aq9XnFtZeMa97HqoBLP}uXSOuwVSU8*Ze~+$)b!i4a{Mvs-9%|d z3|Sz&c7@^6tmsHa>VnaE!b3@-&=gW6Jngn9(>` zM*&apshx0s{CX-~I zp?#$XFj`o_J($e4uy@2p#R>7(2`&&xcl=9+HvgmUC)KqIPL z!;KyoyKZ5$wY0S5b z>GPALe;&O&>78FN=GD76IeT^b8rWE8MUYNkzgQO3yVr;B4^LknK6`l*e5ltz-Pt7= z;;PlKqWZ#VCSYGl z!j9VagxSThTE?h{uUi9*Hqi?zz;Y4aCeKz1`8HThr-Q`>Y^&U>b_s@}bT}BrVU%`9@0yjHV1xF{`xp#O2S?m@rRyDc5cSV!SdskfGHfB+;;L6_hmgl@4)+BhUxv$ugY-(kd3D3{o zWCbhEloi{Fv?5d)oUFi>JW*E7Pn!8<1=sW}_M*dSIKImP{0gi^q3CXSuhyclskKNB zdOfxx%}x|Hw-c?~Mij2wMiiPhqEI0GD_Dp^!$K5#S%_Q~ny_S{3756dtUkh_(I=m~ z?_7{nE3Px}OQ|8h_~h9jjggm{eN{gBjJCpb6RyN`Q*J`&{XX!^A3UQrm5oK=62>B% z8XYd9Mz^8~8(xoz3-Kr(gtmz+m+*-z!DOU)3esh6!c#sq2%5p|KPn*Qlg~tiOiqmR zyV4Z!_g=^!MAIy?5{~+ypOOvt}ntvpe%>3!iS*@Rk$!n?Mi4GH69FQ zNUKyQRsHO~qQ0Empu)5c;G}g%*Z>U-|L&#paU}K6dr&|{51?89xGsp8GgikpqDwJ2 z=v=8$M=D3V9>Z&s3R3`HJZ_7}=2vFyO2fXgDOgy7_6}(83`78^<=@5Rda|0VwyEJ08L7hrZAsVd^j%(~4A$Qw`#!Pls1@uhNy`0)S_Hv1ZCy z3s!2)ZDFps1x_PO#SLC}FfC|!Wx=Y9a|^+U^|K3Tv06=)$cEzz8?icT*My|vtdBFj zY~LMq7M`W}UTYg#z~EEtkHuY00ellfn2kR+H&mCo*}a6XH{0>Cj>$p#<)Kk!VyxvM z49nVOp%_3kH`}WOE`TVnJRxwCl&I}#yJi9>kSRp3nx|p02X@OJnwz=+&RPuMj=iDT zt{_2{cZa5#Gc5Z<<1`+8hX`s_7x7g4d3ZUcdliBw9x1HnvY@vQ=$3zea`yi8=%j_> zyi%@htc5le_wwOaAGK+UuEt5SXYe<;b446ZDP-`wg<9pp`G5`LDoO7g4GF&jUTT?^ zSce(M%cC@_ZmTG_Ol!(b{_5tGf=jhWmin5usE~I%4}v%Se?k2BEKkz#Dhm4Z!N(|P zN@fZsyF52s;2FMt&Cs?*E6uwFV-=JK!-zY;f4;!hQy+qM-M#qvQO#l$ zvkl`ypW4&}6G$Y(K z6YbX}*k25>){A0Gi}gUN&%>B0+HmB|)X*$~9`EY}1$H`L-e(W{10aI^zy#U}T3E29 zM*Z>cee2Jy;LpL+ohEgPE;MTCLGzY8bReYxIh4vu3r=|5q`=ur)2U!86T(5~5Jo&8 zOTT1dbj<-HSCH7kYs)aYb#u~i)U_m7Iy*0oJ*XJG40jL5xphIqcwfY300*cma8Odg zaSx@J!bJzYa}1T`0f%d_KBH~jl}T-5NnfTCW>hEKx_$D#yq(^M^Kl;hExKE$YtzRG zcjWrW+A(j0at+ofwI7^PDiuhNQcP>aY=aWGvEAyLzX8b*W z8Pa_`rfy({GPqw*8T*&D4PBL8urrDR7+x`DrLFEmSPWu*m)o*7j^&~G0{%jICF|yr zsFimUTgEs0aA>5`0B)!LNfFsP@-zkK=qk7(~&Kv9~MN zh>Wp_zSfV4Nz=BFpgI%}AWb7miUzD+C-jkAPShsiAtXs@>{_CNXcA--yfO~7%8I*2 zUAoIfo_RVxFc9O1d!UoHUo3xGYnS*B)F{9#K$*`Vng$T$-(H;uN4Nm|R~4VREWTpc zS9l-(_N&$9zcBBM7v1q9bh1=5O27STH6?W$;@OljObV94S0E(5pM=x!DuToO?%yWa zEBT9%yFooT(E8J9Zj4;yA&ehr_+R}Ju(r%^zKJ`5+L|m7CcoP@An_E(1hX{xgi_jMl z9yyKMhggWO{zUFSL_DQlLR@D&4n%atMfZ;;mDGyxwyre}c%sU2wJo9_F?A0;iH#vN z7yF>w?x6SVt9!1Bs!cb0wPu_#ejh_F1y$Jeo&i|38!8aL{z9xX#Csae#_<3=gO+Q) z1kJA>3x>1TKxp!|yV?4r)uRRIU*(`ashjK6P+%QAKW|X5je2Fe-ZZ-Ewg>YxWy5Bb z-cuc~Uck(WHWuMGr5#HFSf4js^nhvGI_L0{QI)m?2v5w^!}rJ?F1jEnztm1o^)$y7 zrS!O&8~PIDgj;`>jppO=U2v7;Yo{x}V?}p|Ung1@`_UkrXOyM~#AhP6wXTQ;Giu-W zB`TU9XLw8SfFs^5O^#=Ub=)Y4RI7*Yb*!@peyZSAitz?lXmpI>Db#szInq(&X-13!NV@an>wD z*n|?OM^@h=r^4$zbkXp0UneYYj!uJT^C4TH+4@dc`q%&sj{dHXy!k*oBH^_FQF$~C zr-Qp783p0=E+}~c^P=LUWARIv`nk#_|9PEEBL0ra5`1L(WlY|K@`h~$jpPvdfUI}z zayI!9MbHQivR)vRB20WM7a1{|w6EU#^+7#xnHbQPFi zdIqo~6qvy+Hu0KlBIqyYWk-ix<){72y|HlV03_3_V9qGSJ^u~&X^02%J~=av%Rbw= zvOX1;AIkf^Lzm`QA!S-NQmS2ZeHH@NKp5-{wvg7o0HnUPAV26@~d|XS9!i5rV0TaWVuSan@Ke8d2ml4$G^!qp8v*Vh+>i9vC|bJWKp?FNb3P?f}Mk6-+#qD?q4k9ThnT zcg?=_b2TV^6v|6ywJYESW)%l#G;be^I?G=`Cdjz)_@>&3Ucd#5_!~xdC>5~8 zY`|o(PzBS)7QE5UvxTle1q+`j{B1e(kZxC;i-YGC+lD|yQDrOj;h5ta?F!tFI3(_Q z#G9>@X!}Oj)*#Ya1i$+fZ2vw_@^FoE?N0z7M`wz&4}!nHgSPS3Y%(3AIX%CQ0uWvT z;2#?8pP3!K~Y72I5pvmV&;6rGUdQrGhvkPf5Fnk z1^`7x)8&=v5Ll=R$t(DGg*Cr%&&@tGmV=Pjo84OFrfb4>G0f5iL>0X@9?tiX$IF`P zj^Mq4Q&qqH+XyH@RqI1al)^|*MUOxdMR=jcbW+|E%7?%l3N5Bejt`F?*C$|nnG(CR z+>F!t{!ay0gl7$Gzu++U#qB9C$cuT%)*?e#e;iHL$oFwS8$gr2D`*lF0&LRU23kr~ zsk10gf!AgbJTSe}y3Fe%FN9qpjb;g5Lm?_F=yi}xZ$KysqHu7Hn;d3z0+AyOnApwm z|3Ci&2ao^rKf%UL9I{{Lk>vmUPeCDYVFjWruwGHS8F!WZpZ^gaOO|2&&;N9-LmY^( zR0W4NmXHdKyo$PVti{sON^!-$BC;Us^^COoS&aQdwF7*iAwvepf_|nCggSPo38s{o5Lt` z8^=C9xDq(!o3%Vh=7;iPqi!kR#G$yOUkji97Vx=z#RZiziYu0ZE76k&N3Bc5?c^}_ zq})3CxyQN_MldRF7t!WY9KJ-VQi#Ee0qM!82xeEgRSs`$wpJxQV%X$fBy5IHEf8G z3~BV!JO<$*4Bm!!FA~_0z}gzH3N3>#i92(-X@P6q^WDz+bieM`D>kkX3)HmCWkoD?^?-J2}5NJ3YE! z80`p0)?6qS>f^^6dEX1ZSKw>Yau?h<$s1h<0=fJMiGBvwvnf<0=sTp_lMO9!@2Q}I zi=sg$(|&|CJBVkIJ7!+3zZ^GS>!z>OkqjEfv59)WF5VSJH}qFsG$_79I?MR`2A2_0 z>44%CuQ?17uImTk834CzIO3q2#J@FdIUIz4d{FZwO91eWpSzfG&C*OwDAbbmiGyem z$F!wlxfZi!8ym0LD1t5r!wMI9urxTuml{CXUB-B%F?!`?O?6@^^5~b>SKrnE;H#i8 zoGZvIe`^SgAH6xi)dveU57z{s)kXKUrM6RB@k?sgil^668iUQZf2ST!7IWI8{m@ko zWEPdFftOfq0xsj2TWv`BvKVMl!ys>hu76y%foPB?X^(G?&X%-NOEpO*9LP3a*=DJj zqfuv@?t4uSf>VeL3qnHw&XBU)Tcl-!=VHpGb&sK|5g4|`3DYL*esd7)`rTCXxTF>o zemrR4R#gZtAPJ`)lJqQlh~~&68GWs1rd_R5b_!KxTU$55f3?YJg=I#{#v$rb{n>>D znBEyr@8#u`(MI!QQA3nzYSMZ);AbqFz3$7pl;cx8Q_SyJC$j7oWW~41I3C=sPdAQv zi=;bojP+)``Q8khcPq!T`Y@S<@l?huwpv#l&~4JUPJ*tAvPzZt^nyFD8Yt~{yRFTN z6OP(G`xpl$dNlngoafi@p7M$c9M@Y2^%Dj|8S+?#Y}#6{ll+i1pQQ1>qv4yB{d~^o zoUIy&YJ$XFUb)SuPn!x@@rS78Q*bRl4Oly-cq;jIoJlWZxfY{wbOVx8z|@3Ej2E!8 z?&|r$8v1A0;q3nUHCZ{mR%ZFIS3>t$LF;k^N<*duF|sJK=Vl_HAKgAVpZBG3xz0dC z3_9U2QyX+f9I_WLLKN-?RiTGg7B+}&1Uah7(xY6r1(GoeobhI+AW}2zf zVhKfL!dE<;T$rrMQI z%CX+cs?(|I(5upml?+W#)z`}OpyZ{5wUt*LRt8yT3<(p1)7KXjT`7aAcXz^?A~p!G zWxJ(Sgb%5JGfR^^86@KhIHE`;oIIJug94p4I9LR3jWx<#3efyhmKydysJvj(IH4Ga2$=`cHO-x z7U316er&SIJv61K(oyRyN%G*R;8DR=@Mb#J8M4~k+ApM)g?xT)R`j8{OOs93S6|U- z6Q%%E8}fGHRofTG7iNMz4BNq8ZwcsSJC&C&E=7Zw+RaA#8HXW3@cl~uwj`{DNXo5-%3G!9L}?u5P_aOR znwhUur`jW;R2<|2+aR4#YJ$=DdLNMHV)mx~SlsXzC_`Ac>p*pjb?2}8L8t{*-PK9Z8E1oa4E=4;QZq zB9(zuyLc&S0A)a$zZOJ=;%0Gu67sgLhP3yU4mQq3-j*@_OQ6&*o`7s1YP{zvVjxM8 z!Q8AbZQFq26JP_@Fql=NUCFi`Hrti%Z#P=SE>ysRo~Ko#h^PlvV5`wZpr&?V=)W3_P`=oh@w3#wQ$X>jB&nWjelH8(YNITR(5#}Tos4$l_f3Bq}vOp{46&!86&y}lDDfAy(+(dpp!I!YrI>!;AmcB_cmP}rk^ zg4->l|J-!W!O8x^!SqU6slc#d<(N;|j*-p>kQI8^!)|Qge-#_yN-Q{zTRZ3258xrt z3Y*uUnAfzH(A7s71|OUtJvhaX<{bLg#hd6^_gq$@jvUi|M<_V35Sz_`My!ja4^5E& z7{(ETF6|@cDztAEycFNP4;-km*F~c8I9q|ob+H8I5~zTPL&Z;35Tokze?uMx@SdV5 ziNILF%Xh$b6l*J3c@kU6Cu<{WmNW^nj3E8k-1{JY^}xlM!VbIynI*_{oPYJg=dL{ zEkQI};If+ULKjbUo>(M-L7XuKWj-B}^IoqXO$XPLF#Xtj*xR{mKk4qZKU}sik~|z2 z7L_KsD;G&y$&?l!=`A>&vgO2ti8n{5$1O7&G@!RCr>DqW>?bMiYmMzwyklyjy}6K^ zyiedCcrE8tuU-2O!eFg{P5x7j;sa$(|j zG#+LF1oxqx1eLk@AX>YgLYtI!-wh|E6KL-`fwps0dDn=2bHt_f&l;dF${g|;V!ZoM zqT)GXLO1ZPLT1#u@3HL}TiyafKnbKG69^x+?l(0&#suP>aJNF zI2ujlrEKzpBPcj}@-ZBGcgfx(zurJYAK-STZa=Z@GPJE!lY&Q@y!#Y;TnpOmQq@of zDr46r`0$n$dB>7`+yG@8uhvOjWGX{gBfAEdt|JN%%|u=@O|ClJBkwy8+LNTIoyP%7#69wQ!`)V)}fuG^&k~k1;e@;Rghdr*L@LJ}qd{!_p)k z4qR0Bt-3%iwj~B4Q0<4>uRNbM2lXCEx1A6a$M3pap+0`nnW!%!p_<}KZKw-T(y4>H zUHdCHl$zkL76dx|``xY7hp8>p`n4VDLjz<@!wbBqYT?0;cq8_%2f;=7k!fqC_p9v_ z$&wU`N5+otffR53DTu^jmdxEhC7ad}ZV$Mh)Wn0IAnxk00 zEo4`tGOh6H+WWTL3P>VVFxRML{2dLFU>O=jDUTgcQmNKQCTgR6X(?}FVeYSvUMUAuyjNOt?p`f#<%Gu| zai#l)xl_fLn_!Gvz3Ks(TfY&rBM?yG)b7@P2AC$xRj&bA9VL+L0zz>s1oNihvJ3MKt<^Rp3EikHp{!G+ld+#(#*=vEX^%C#v2bV}V@o|? zlJUQ-sUVaiR9BTE@>9!lW}ww0HbQ^mcG8>h9NXGPue2`Ye#p+M^|l4tW${p0WQG;yx!qXQ1q)4gg1=OhJ99FMwT=u2`K{fDJwZsGhD+^p_St{R?dVLYg&a< zl|Z`~)qyrdXO&{;2MQK^h0HQ3IBQz)dSJt~TUIUX-FEY|5Gd4vbJ?YMQCYLV0M;vh zR@R!cEfC8)NHM}EcirJ>^0uf8IL6-4PcE-U8Y&wr-BJHem-T+#}h z>tNG9eeuY>bh;89Zv6z2EBjvwgoz>UQZSvhE3AxX&z85TpS4nPK`MUbB@r$-Fgx9O zjHni34QYhwO&U#5Gcbu z1+qXp{1kIyXY4x@vlBWrfSHTJ45G7fqbd8mzC+wObg(z2-r>oXY4_s+!>5#}kKh3cwJ5?hm5)0{hRRwk@!O--3g9P z&x13}W4J!@qdbW{xIYPm}%%~Wr5)xWAO2S zFRZGP<~ph>Yx*%)0?tE>aLFia*qbENILB+#RW&kJB)p2MiZCQWnpdHka+er8vRxOX z9t6AH-QWl*bc_BKSO0mw5{&D_(^y=GO!P=2bckhgP@cwvoKDw5v7Kp@&p{M)C;C(N zs*%k=X{yHK+y*$aE$KUj7utDE`O>Z@z}e@0U$msIma5!OrDZ7zu%XLlRbOb(C4EZntlO%;yBjMEAZ|Lq_ zG7pByw4Dc&2(A)BQipWzusr$PAZK&}H^|R1lQJ5io`>UXX?V{$Qz<-b32%0bPoIfm zAOE0H?;cU@FO2Ts0U~jc9=g!+8%fK+UziA&nAg1()5)HlPMqTw1f-G4L&@Y`g?GU% zj2zh3a9FS|+Nc*HBt{Viq8W7{qQ%vLHhHD71}Bovz-3^TO}60j{1$&@A-4sol=o|+ z0jUx}dQqLpH*1QsAwXfaRoC%U0^EQN1MH0!jW4U~2aYg6iJ_(_dnzuHf@@T-n3Myh zK6jhKAX*h}F%OE(HWr*6lJ1D;TjOx0o9hg|U+?D(Xl9P`acs6ek?xUr=Xw!?z*4XG7fov2> z+|-%0bOl$kEG$~{7#uxWtvF$Ln6|zw7=%;U6o=6` z(j2}SPrBo~Nmpru^6IJAg2DD#8rsigvt}a%r_$;~n@jBIq~NO|x2=q9_pu8A$3SDL zz;~yI(xQWvC2P3G@;fXa>4N(tJome+@&2x7X9I$`6!Y?drm5=Wtau;_$GZBo#W}?m zt~9NO9-A*b(j~OUj92igX`*I-1s2X(5${XkcA#?!hYy1J)Jg>Kn8F_=T!brA=bUvC z>$#0{7RLfO_->DbV9#;#de^44-45G#K?+L?cVkzTtL9mEkmyG;)jl%I` z4;j?7cb5+h45K%gfgVX&)yOW-lTreQ0neGhaOULUs6V3MjgfS=DOhrf-*Rg9cr?1;@zSBGJ77pog)*3rzy1z;s;XF>p4k zyuw-#L2Q&ms2ayU+o(rr1QLf|Kc>nG#K2`thGUY!-D-Nmm$YA37(?JZfOc7zCD;>0 zrP}BTBlxS87pYH!MPA;0g*&DVaJ3+@l4ch{v5RmQMYjuH@I7#8(nXHfqq&#pXabcUVr=#zWS&Kvq8q-g?KQ zDz&2_HY*QzS1Bs$3P_{zR;pPICwXn-tyZ`ijrYlF#`|Qg<29j|^bGCC1EFDp$zKSp zoG+v0?xJ+ds{xsn)Jsz&UI4INZ(RZ4Cw_pfiZMCJS(M>#r84|788D^(9iEHdZYRO3 z=ZD(S3V=|Q2ZUHsWI;iOFPCi?O*F)q7sEC;5Ym@HIEC7fy(~+{k=#YusGty>z!Weh zqp%ka^7uxD!vPtI2Nx&!Z@s)#8o=`ORDoe^x{NE|>b4b{m?aD<-&)BBr%~6LpGuNA ze0v)FExOAB2rm;I&v`?c^;P)rJj1bK_M!LYU&ATTLln|H4tka6^IMj9Z;h65^bpK3rl$#EDu89M8Kaof!s&|w4jIe0iVI@B$lS3NCw)zO@(K@-Lr z&LcLk+`+OI9DfMa+H8CiY#nQukj+AoH;efLY} zZB6)^ZlUAVbgSLU7~`*xvH1YtHY^Q*c(+E*_??|IHer6>t)KaQ=gs_fcQo#IIM1(H z>mQ@(!i+CuAbL51@RQ%F%X8TG$L1JnKxeR%Hh2NG505TR-=DOXWr({w&HN^R;Vf}g z9IZ8svOyYSTmaF!@~WPXwG7VJT9hGLvfMAi5X~I(O(Z?u5taM3tQ@gE13j!jSr>k+ zlZ_JXuTjEed`)s$R7qFFS*ha&YjyS-d9L0;24YuZxyR4sVX{)R#F%y=*TSFvx%H>X z)}MwKfBIqnPp|g>bl&~b=)YTwa%zz`yf~NeV%UDwcuT(+@pRY!sv11MOfH=aeldJ{ z1zeFczpbKuaqyX}m$^A^DZ2TW!Mk?X#JhG~VxbMDMONGk4snO13xFB!sBN$8lt;#6hAs_*+2U5`1vpXj zNDCRpu0p47Rxt}A#_PtxO_WjqW!10mXG7om$%k@!QiWsnWCapZr4Xh;%SXm=0giE1 zK;*#-hXcs!5wf8Dh3Co zm6rl|+C~4H08fIKtjE+6aGlTfc>F@i`@&C3ty-*oargpNJ3sy6hU1(yI~QGn8qHs5qkC?G(u&)=)x1lmugOdoygNU!^r!++b!XDeB$(zs=lq;_y`}389xU!jLGG`s zDBpk{LotX(4E~0^WV=Jd+^jlDHyo1fbK>ZS1&IqRCD`Bg#S$XL*rfXfpprAagj>>R z9Zj^G@Bm!MZ)huKEtLuFOMB@?1c?;Q*e1hl2yV8P$sQ8-St?r$LDI4T*y|3GnHucM zD8<%BsVR!}UV7~YVe1zHv3*!nOmuiomX&q?>spn5bxmNb{<@aco6aToK3U^+ExUJ` z5Pi$C@3(;&GC)QoN#GI|YAoD3!B+?7q@3P~P?Zq;6o!Dp@WQ8C`ZfSe7jBD}7$`V( zyJF2(sGgZDE2m!D=F=L66_Akshnu-2e>!$8?i4!UUH5B{}Ur zGD-KC>IE+-0uh)3V4KE40GY}FfgSvLG*0G23~>o|cQPZu`{z7HErz8+0TW-#02#F= z3*LVb2`N$+7IZ30cxuMXDsX#-nm&oDa8kaPLLDa1U|Hw}aJF1>Hq?*-@_%4%=Q5f z9&?^1<1NF>Svb9Nn)={DJq)6C95e!mS6VBM771+lsX5s2Qw`XxmqKC4jsX8|h!J#( zM!yMm-IgPU)4e?kEG2<0e<^XVK?K+Z;FcLzHm)2ZEQK`;(m#CZ0&trRlEU5EzEqn# zG05Y^(c9n+Q6udA(>YwCf^cJl@q7q^C&p1rb9dmGbr8kc2x1+Rd(RV#64Am8md&Sw z#Xi8z@+~i($%s;%6oyDD0JxeYR!t6TA%#_w!CFY56vny`a-@i$2|DL5msE=P904co z0z*U4_VAMq&?S+m2pXNm-3qsPK8f}jihh$5RN{OO5x09vP%@FDNurHwwhL*73nVPU@UomwVEUmdRj^)A zX{rdi^gzq|u0pdtWD_+CfT9KZgM(;mJ_=wHh~cMSr0(bE&b1)ihHDKTMxI|oJFJg? zvIN{R8Y)Nmi%<`n(almcQ;Do~Oz(Y9EpF!vvfZDFdgxCM>mh|zlfimOpi)7682l#+ z4Vsek`uqim3H+#W8AZ|V$LbIt8p5_4*j=zo0@IV?)b&jo4w#&BI?b6dNy#kfWOd`s z>CvV*L4~AOdY&>)+dhY?3{Y`KioV~xqXIe#N4PThVQV3o0Y{~50ua?36h=)ni;Hf{ z1afL{PRnP9%ebv*kyMfq*(_m2dc!CW<1sihEUIhP2Zm}0%X81S4bb#x!-&t#@L*5t zr7%){hPwj%t{TVd!Lu9J4mM;s6v1j)3IB0~y0R^aGKcuK#33-dXdVwT$sZ2=`2)B{ z45QgNxnu9Zj>D)T4Bj8T)>d;Uny{_q^2hQ@E|;;8SbjHCQ@FvN{`TFom#0UTZC!8& zFTj#^yO{V1m=$=L&a$Ow*)OhELwIFcE|1U}rLw%ZmqX1j05i^2UWqb&jT=r{Z0W3K zjoTfxEK8-l!k?P{S7Mz@52oP!I!q(g$75hsefa+H^yT5RmnUWL<@0-Si_U^|a^YudLehhD+}FTZ_^o8*wz)KTlDH4( zu0UDMG2Qo4yxl*vT?2R)-d-L%*$ zrH9?!;1!b^@Q%khPb_=0CsIDx7I@Jg@t0!$78iKIo}c6!Rb?;RY=h~IqpNUm*NZ2^ zOv*6~$8m=3I~TtH1)R@CAN1qSFTpU0GDtbiTMJHK9iQLqE)l)^;fmb}9=hBK?3yJ! zHM6}(XEjmqEMcS*`OGpySq@h=;hO6xzN(t!Qc=7=i*}Nz*Jmw?j34(iuhdvT?FZ2Q zQggdnFN}vSFN}rf_90ufgY*v97jT7(G@NF!=PZxIIqRO!N;XU49M5jp)QZO8%3n^6 zf0YT3G&Jy@EH(A3H3L6%nSpB*9AMV^EtKVzn}-fh8v)wU5i@YdDmr5K%c<#z86RO4 z9kH8~Wk;;rejZ+3ffqiLXnT`n8s`bPs@wglX~8~Xv$@6p2AM#3++2iL82{u9IP?*d zCc-p_)SV^cZzN5>IaC=Z3FeCeSpV@k4kuj*KRk$M;kXM6<%=ePuqul1!G1AmAKNdh zYV6}>8)ZU%eq)7h@sRPs_M_64>An{D$fSRUDuK2oCj60O38+XhJ0zxXPn$v>qUd#! z%g`;T;+)U>GWe7>3rxdNW+79GSsb?J{l-xt{f2LDY%5Hs_Q>gLIPVt>xpe8WKrhWa zcPmu!v&?+kIgN&XYmYM4rH8CDk05dpOzb1bE6D$NTCqUkC^EW%%)odEBTEt&!7n|q z-SqNg77u#YVb&7?A?N)K`X1taJJZV9YPGcAyr0wm*}CgPxua(Mc-IgK-2w7(ig)u@6*icC{Xy@gCqN z3jUH)$f5JoJY>Xuhxs$8o#+!dE_N%2i`J-t*y=SzLB}uc2Pag5hbq9oFTh$&R%$lV zHk}_UrTA#u4k?DFEgr)Ca9b_=QPHTV2krHYd6(#eh$%!F8=}I2_@hEi=RR$J{_~#& zV^SATfGdQO2LjqCwIBXzP4dRTR5-s8RaM-aLt9fF+Fb|!D2M_Dg5Hf5BgtRMOc`d` zd_v~YJ`-8(UM8+S^7pz-M=R5RLiXu4-`4k_XN;@Y=vmPbI!?LMR*P##fTgAb-qPw_ zwnS%IxGiYJr57}#$I`w|D_8I98(<2zaTaN4s$P_Qx+Q8#v!P+Uw4Qx%VO`etGX#wh z0qqrN+EmeGt!$!>0GR08bfOO)#}ZY^(M^w8{BsHzs}#h4rBoEMR{;(ke@A~M44Q|_+%99J$|wuv}KjH zFe4g3HsWs74KSDa^h$mYaLE@56={F4XQQ)B20B%|n1|_*D;Xk)i<}1T1f`ZdL(>$@ z;hCOi+xDQiBSry0dRG91+eGCw02>DNp;ZyFK?AD~SYglQM!Ko!Fvp>18;jD`&xC5K z^*$t<>g!Qy{FnsmHi$pdWAXbuUx`TzAn%xJ2{Kt!g>~YWmTrFJ&WKB{mA;d+;E*z}rDr z@VCpD4TiDzN3VnDOlW_ZT=BygrSywvN>(uxxDvEzP9gKq>9J}N^Sw<8?TnMFtl+-T z9q5Q6BXfO{HDkM5M(yipy%|i&kV9WD+w{T+fnk;VihZB)_a62Q<=+wSXq9xCU$~Oo2clw-NmiqOaoxwFnS8ou}bw#5P+r z0$lEVKzTufciDy=At&Z8Jw$1sY@Hra;pbTPjNhwfb5<>8INIM`P5YIa98eeAKKc=m z8k;FNb_@FR9Iu0AWRDhI2>1-#!et1u4NYUi;2Y-~L@DIYn55$Lc@0-kTWs~{U zYy)*H+#+SeE#sAQe*k)KvbK}+vtBID_HhX7;rU*mzcRxo+^vq?dyV;bUjI9<|DD(C zPhFyzhJ1kaEk}fbjnmEzI(*hcVL)BNZ@3XA*MLD!Blj{xQQ_F^VXdylox1X(y6b)s z8PG?qcjU^=)>j&Z!$5<=BN>d6bU$FzhtR%sf1HAS{4F@5MIyq%T{4H;ibFUr#)UkK zQasQGqjJzTpl@*&ibsIl=b_@vT{vObBA)Xxs!`5;hO~wew7V@!boAwdcYg)Kwn3g` zkP&9oE)Y9Q6TCDFC;U<_G*~ye%SgIuSCHYPGAxUA>e)P-24)lpT9Op@q2E?JyJ=6C zzOQtm!(Cv}WX{H#FXHH26D@_HyS#CCAAz^CaxQM(Eb&h`Wgf%Rff!7Q^H7`TMpyDf zRh_f*(&$=v@)~Z%9vkk3o*1i)g}+$p5ernq*~`E?1(K1MT0Y8*iw~bXE+4R<7{iZP zwCuP_)-8^=kCP0u#+1CrWF{}T+mps{U4h*Q^Omuq!W}Ho4bfdhVH>UO`~c4 zx9ILYV|(D5c`rG;AJrvES_Wvt=yJ|1%Jp-=?|A*naZz&KgO|VFA!|QMjKtVeAXims zFKOCiTUu`yD}#tPZ~Fg=26=GKM4Ir5hfijTTUO1=`t!j@*!sXtf;M)cflb1XQ6SO> z@w~^kX$&XL(M>dln$bth5Sdx_4*e)0!Mt0y7qYV?UIjUnP>}->auk$3b4Vlps{Z*zf0GTWU&zh-yG=E zTd`a$Lf|vL5*8H#?cr>+u9(*wIgQxwGoD9u1Ltvfm-mhPA~jghnvmkR3LtpJY~CNo zgC51o=}8}BDsNphVqsWnQkdx1$y@w%h+iCcQhYGY(6Qop021N?i=l)%Ar{2LI+SUA zMya+8pMaq_t_FIq>xJ8N3*G`bHzZB6j``A)QUmFz#Y1Q~BFFpow`siLRp7|3+gn)_ zQe+1ai~qGMtxNGMN%KyIwGauc44Pe|cJTFrQ|Lrd6D!uu*&l=Jcsx{z zDFZ4B)ia|mk2 zTCnxAw`DT?NVf`Xt(B>c1IB;85tOS9nSC-wTJ(Wmc!%0+qK(sOoX6of{x{=`Z=StX zxzCE*qS;RRGqzmg+`M#Wiv>wVdiuePxHbicGv@6pUIf}Oz+V=yU{!xE%~R_TPLf;u zmQVOu9MYlPv={Qi$Q|r4YmFK_2L~J^BAd!;YO4gnie7$jloNN-uuQ4QmvXJv`=i(H zVe)g%)wcLwU_0%RuIp}^D~79W`YZ~EU#DfB0jzhFOsBB7-^BTyy9>kg%D;U_89LV$ zbXD%;AMC&WApf)C1^)mU%Cq?pHyV=A*2`E(%<5x{CPUH14=R&61P%JCSy{1ogV-um zmAypgUx@Q~H)-dJkL<3VtgjK?6vz)b-j3Z2U}NtzLDrqMX$c{tQ|wb{)E*FDg7;9m@zs)ky~2rzi5 zalrNv3v5+DR2mVu@8}0|lL!OaGbtJg#4ti{w|Q#BcLqKoo3}&(Q}gm@(ZJMNe0yfh zb7;Ggfn!D61ddN_j;%CqwQ$|#s0^I+Ko8eM>bqtI60Z6XuZPt83tAtP|Ce(2Vw|Uv z)?Xz8P^UeEp%K1#4Hz=!fy43|dV9zsdZ%1BI-mCy@GVi)L&~u0d@AB)IHb!qHVUlT zqSM(~|JvFtX@z?G6=ZN8W0Hhi#0ya;`Zfx(>txPmHyjR2Bm&k?p307#fGOA$2A$9f zLPQ^tI?~w_x^wokpK6uN(aXeYig6Kn$I4ROLSr+e-1q3E1G!_gjyQT=n;1L~f{W{j z(as>8Ld?-g@$JhYZd35P3ve3;r=tApc1b@dVqNs@{|a>wT5+Bsa=B7 z$2U;M?s|u80UVLE;5e)D7%TXCid4~tV8G#E=a%777U5@cyntWp@k?Nl6PCu@K)U_y41am&CSir9lP$FMuQ|B zT91gtLzmfjAE|x2MIHXr(_xYFeYK+99(3f973N^cv)1NB}z>Qb#;IW3h@y-pafnqEaI z>k#C?Xn8KAR#m~$vZ*X>tdE+q>Qdl0pZ!U{5_Xx$tBV`NTv@nGww1*V@~kYoI3+#^ zUaNs6a2FcRXJgF73Q;OX;2gz+ywc7E^k|`Ipq!r2&l+tq1d{(&tz2rLU{OfC>ntwa z6|%-=S<>gymOh^5he4hl5OM~Mu2!TNYa#{obCqI+uGIZ5TKq0r{4QGjE?WF9S~!dU zE?N}N@1lh?9(*OKLNi>H1d8T95~ZjqP2k9OP3H(Dc1p=3qCpp_o24#h3jztPjMEi)EmsRJefpk zFS(r}U#RLGcfRy$(o(!pWBE0(D$k~j!i^eAqimK;hpaH8fOr-;{E3~#7i_G^t5&X| z;OecY(lNFdNSyG@b0JX_mH7 zJPj_pEV(aO^ojD4lTIL<`YTeaEZ_VhP-F)seetQU3L;7;El^B7?pt4bd|*_vD{88T zQ zZ(g08)%eIR-c4fxd**FI&xBfRqubNz#XnbqXbVgId7-$T=dTpG7eAbx9A2ylwZ<0m zb3<(P4p)QLg&AIHv#U&f;_kf#P91tz!9N>yzh*AmVlI~>vpVs?bAcdsnCw87J?wEb z8bzdQDs7b0wz`JRN_O>%OwHC1aPt1-^#!G^#?m}2a+fKsJV@ixRBjWGYA{j(jr75$ zv{TB%=_)g;P`x z_-gU0bGB{VSgurWQJ(FgJPUWc*bZ%Y9oSp>gVITRi3S%J?0wLb>oU@6qklDPt$aXW zYf_uhS(>nQH*s)C{VJ`J|q;q?XvyD>5CuQo%Ye$>BZ^M;mgL3Bw7cpocFD<_XAmk0bS`LY;x{`nuU_L@O;$tGR6;D@ym=mGxo~KRxFDP-^zT3pvbJ9TYF1fSKVDS3#+KGiJcNMYvMm~<$bFhH^#16z zLlAtRc`qNIz2Mm$C{rsWf>5nBaXERt2km@w5bQd#)_C^+^zHe{QSaj2>(?hQy#@ki zB~~dKC`$)N)=%>5AfK~$<1CoZ>}SOgb7Yo91C^}G%gQVwXSwoDtyzmnWz-u+NOc1L zgWyGy4B5Z}V`TAkzz7ydhUN{{1UkpVzi2jtE1$v9+mq^S>b~m}XS51X#X{|_wbahbK9%G+fqZWDaLyDjt%e3YXoyHv42WZ(W! zuddo~C(gl)4v=c&r45#9R$lIFzdd{N{`CCx&1*R0z>KkGeWZ*CQ%YE`2flmjX(HhZ z_WcnuPq|2m65$%{`y-l268w;Di5&_`c)z54u-KJ+E5Z+G`z0;|Q+O)A8q&PCz3efFq&#Ejq@SAd5xaI#YM!#h2C2 zk}Jofe&y1rukSjExvvE5=n_)LWL1*E=VEy=L*nyjYr z@Gq7`UW;slYwI4{40XA=tmeTEiuc(Cl>|IMB;DgMrVU>zJLo-5;U;Hf9F| zUS2B;Mrkq$j^oiN!e~K~`K@kN?5c>E6NeD+o0yJ@!-=Kam0<}>}CS7|*bK+FTh@I1<;QPX^wPh=c z3)uID>?(WiDiF@#-!r0li*_1T&InDXxVrSUhD;_{_n=FHj7=rTO2%kle15lqn6UsZZv3>Ut$y+1336He$xv_3>EDUo6Zcl zuuD*e2XMc(CWu|&K9oXNS?_ferahvrvdb1LxT-+Em91J_w@OXd+d;jkPhC`u?PH#H zAVtWvn~VZ6KNMvP<_At|XsTTYR4X60Y@voBdIE3aSyutj$u^sM@A8pPXqJOmNt=sLhN9cwAb8Af328J8t~_yuFNTNQ;b1<(pN46TD+ zur6iucE@!z2euiE6^{iVu4Etx$Zr%kgQ?#rs@ek}HCOjo5nNsHuhR__%wqO+WuYex zuLW2!jkR}EnxPbjcuAwMgch0owbXj-xl#Ra8}@q4c`ba z3WZG=P7^#_g+%Wcoja>fu?dR4F?n}z?H64@9}zGz^-aeeoZR6cqjaWeH`EUJH0@$> zE_~pz0Nnd1^|6A?n@3d!AKDKJ{R<(oAPh$U<+0v(>e|=n*^2E!l;o1aDwRVvnVqtP zBv$u72RY$4v0RFn8G587lhN@uEtHJGEx;a99S*8NtCdkO7!G>R8JmMZ7+07FyE6O+ zoLFf{*@U#&J9bi$yhy8Yx$~hrNM?5%c3KoiJjAq6@Rx%U?`kW`>tk9~eksg0EN!0U zYBlGgDo^QRSgwp*W>Bx4g!C@0m|#~zI^xcoPB)9hnzgl9R++_Q>By|poIM(7pwc>_ ztx9M1X8synY;5lj02f^&b$iTgFRu`(-pAW)522`Tci5s#-R zO3C05kHFVDswi6w>K5}GD)@Fw*Pskwal1O8%`>Zz+p%5gth1ZC zkbZAnbAEVG^7EtR+s=xVBG6`xw10l|1OLF=4E~dn-Oy-QA<9OQ!4HDw6(f$az4`F+jZ2iyPcZ9ezA z`z&o4^5p!@4M;}6mop-*q?f<%J&W)xCA0S0wjQ!N|C0Beg|PI%aO4tg1?MMc?@y0T zf|qYzyf}UR!bqMph^BcOj^lqvLut`Sqgj#`NVpG!pL45qTK=enod?i2!AmdOG}S$R zwIixB1M-GzZERGoiH(hS=4;#7DvWF#Z3|k`)F}kBhdX9(1G;c6h2P2ImqHfG40=+< zgMb_MSO*eh^C6{Kd+xCx}7L?n0w2^S;*#VYqrAXtF=JZub(eU-OS8^Q_FxBLaMdl z8cRAYn)4{fjh{@ET(=W7n;F|{I?>b^ZUt8|w=4E`j#Q^z*_xM8wrWsxtVq@4Xb zFnEXavB6KYjE!p<+)9Z+$wbVDpdzpNVMW~#^oW!NrJ>p`to1Dx!hGD%YlP z5jbU=3f$X(47nhfb^_gc1ixiQCicTfuf*OIk!#tnTIZ{vbdbhCXtp2z8)H{>z&^;) z(;M=b<9^L(34=QP_ZTkTPLg3fis`ME>WTf7YQR*wnjKS|9hkGEa>E4YSHQT0FO6cuNX)J zo>78QaXR0)M>x~`3jCF6Ji zd6cLCtyKsleVe4>D_f|nfzMwo-MMVTot=2f{!ZcMf0*ZBgQe*%;1gI!(M>B{j{JgK z*dUe)c}MiRY=`rl4LOeoa=zzNfG1f$G`LY|D6sUA-?#(^a@=4cq>Q`xX7Ifce-)ml z_k$XZsN~viMbd-d6@hT;Kro~ z$PJZvoc#~}dJsHrN-_%#=s{3NVSxNWILqfLSjaKfWfu42FZn5XN;_6aAdBiwT#bDhPvU&Fneehms?}qFUUDjAScLvt6eR3S z*}0Iw*tk1s=b~a3T%lHxLezk1@O0--!EF>|*U5a0r=1Z-5P*o;Q$T`M&Id@BZLQ^A zc*8h*Nb8>)9ev7ue_#$|p0jWNru0l$Wf22AhlMleuoNQfl_?G77B${sY0Ttk3lFHN zHMIn)(p*x%pdCYBWw+!~ZoY^QkDo1I?vN8?uHA6hw>ki`_o~AV+dHSpB$;P;W4j+_ zW|RSLVq?`XOYtNhXG&z1o)GODqmd1__v+&1xt-=&b4%}EY6}{Tmw-cPY8YQM9i(?C zoPegnnS=F95lNYsk~pd?3Gt`joE;v$Jn6kUe0})hv(Sw)~dEIeoj{5$f%f23kOJ4;j`=FAGOSG6xja&rV*Po?o1t zHIAKy{W@kq&l$}1j$Uo0dSy6AFT))&UXX_a`-y%%p~=c?C1<6T3YuPR^c`sUHxza! zXehll+Z%CT3=XfDL zFyno`K{J$@gMO1#Un9bhQb>AzVNL}HjKbVDj>1uInhf!F_vIia)q0@a#5Y@@rGr6) zV%joU*`o6w^tA{rpc!Abq|@sx%)x{7QnyGB$O)L$(G5xvJEN3X==M4uN7U)UL{?rE z(2@)q6I%@Ud_)IQM<^2K+1FT~sWu-=U#RbP9Ul07si2tT@l+la0liD%wHtI>H===n__2*pJpe z{$n}Q(y078j?yq4T;H|!gLbgB^?lIp{)y0Q{42Zy zMv;@lt9Xt1u9?a^9(HxuDg#mV&>7p2i$)HD6j=Di2DbL+UEnaA+a=~x5{CVtduYU9 z@1&8k!liZ>ut%LkW#I9>A4EUc&-v8TG6m0qmaxi}Yt3(sbm#^HUG+eg)Uf>!wZ=}D zQ?GIowXSi-Z$^pRi;>oEDLwrXOV_oqcry87!8+JwX?Nj4psnn)^}%DsE7xAm3qZU- zt^L*XqhOL1%the9ldY_#XC8dXk2cR(*PC#nh8{SMc2;xXUpt89JG!J9-Zk``m9HHQ>2F$*q;Rs+z=QQ&!#h65&+K7(u(Z$-9>;H zVrneIiekElTJ?C#XEIe71v_xX_n+o$JF6^FtK3%9wRx^=uFX=w_H?#pAo)iIL1y9D zc05+{bR3IUa99RDy*wtac?XQY<{i-WW^VcFpfoUHb4<+BFFvI+M2HUTvi*{$ z?*8im4cz84f(RQir5torxaiWBN-BMurO_z<^o8{(_-r)L%6K}b4_|tvZ~E`v16HW* z(Z2Df%YKi;LA22dTAiTPYi$;9y6|R8ebd|O@lwGzL908+Zdx|Wfr%%vCD|C4~u`dUNdR#aK>H_zz?Hg z4_|K|+B)bmTH4!h)~4OB3Lfy;0lyb_33xW(8kvqh@(82At?00J`C&8I3S0%H$R)~F zC+OUE0y0|sbHFCt32Jjw+=24|^?k5|(-7<+RsYG7LaZ)D-kHv29<(5X7&s7qX*pbu zTjw%Un@OI0(K}PuA=hc`OSdZvM{;FnJQ6g;s+Z^sOn&COKbDD}aD~+DXhmi(*bg?K zljV6(MRC_$X=RE@VtlH0bPywcl5rH-AoIAxcEZ&==Vb%3lx-szV-9zi60pkR)lDRDwZ*pq zTVdA{dd_!09J;uQJi}rHkgEb&XIJc_n*3a9fiXv-Dp9<=Y>eflvOSg1`oS% zj->-pHVH~-*?v8rv|&g;<}fDW(vYj!m<0T;Fk+>O#IyPm*+d{-(M!HQOI>)-X8YoI zJ9=bx^**sS{g$g_auPGbBNLF&xB-r77>feEOR<#hk1QiN*pAmXOcEjJo2bFatFRI! z+^ghuV(}#5$wNgQbKfPRLL@n416ftb?h@11jwnc%-_`qQ@^f8toZDLga&BuH^^2H< z2I78eXi?TT=Se`%=Q`(OT+gwv;VLOqD0F4a#K$Tqi&!iT;9QxmORArGT#Kq>dM$ma zu{Zh)N5g_6mzuOB^^gjrDEzO?bV2v&In-LP>kDrqE*vFx$+bFy3cvOK2nIz_#*`N|^XeX$6Os+ec? z5eH^;(~ksJGOzBrHG8$WChM>i(1jAf*VcL*#Q3@$Bx49F0GBHtJUV*1_xK2|Qa(8P z_R*7vkGKjW%F0|Bs`StS(M}N^jXDIM;my?q{CTo-d~$qZZB5jyXb@lIK`3n+2B1vj z-c}80?NfgB6lv^mFo4@qufi##5A^IQ6hS2kuKE@_G>2R3#Va0&8zH_*rZFQoqtZDK zH>tcj%reFjm6q|-rZ$36GR<$J`05(0hV6bb9=1#05z#&F?F7YcuOXW9nrO9$X9dMZ zvc5A4y&ZloA=LX$kb_j&35Zw@!2H{R^sJ0*H~}4?#-qA6j`J>_QEgzRoK5Y+D88Df z5fiCR5mf2!-N|lA=lF|y%TXnb7x@ko6uV{zW(aKger?;CCv?Yyk=P8^Xv9LsM>Hbn|;N~>7rosPG>%NCQeTsAbE6z_F#7*j)_!*Jnj46vw$LoQd)7OGBt zNX#3Yqzm8&jz-xWhQou0;6bB-$(U%xD0o9zC22U#$dB~^ya?8{g_+A$h@$t!9z=UC zHo>=op29ACIK#Ezy*u4U1?9w7Y%P4^%O{)nXX7N#3f8f^1H1zk(;X8i4$v_+WxGr? zR3L*3T#KzsVL>wpj{d3J57X<7yI_m=ZF|og+@*zeT<(1M(BU=s zvOchI4OUD^R)}r&aJ6mBkmNvwJJ{NNVg*qmaUV){4ey&^LyT|JYk<3c1Kj<317yu1 zO98`nFPU!8_GEr;%n2CVJZO)jQQj`Wy31p5d%3fJAU0|zyT&7nr#FzA_AdMst6mqx z+rU#J1bKD?`YCxl0_Q)lGyNpblZkkx{`&c_xeC+3`gmQHJ%Sh>*~p0TfnyJ-JstEk zQ8Sb(;R=c~*J(2CxxVDRLb%pG83t+0scUMhPK)qAqs(FwF8c7zL9ko4p}Gys+lLl# zM&~UsZ3p%`GPFv@hJz*t#Tp}yT1j1mO9319NojXyOgAWbCK=+cr8QO+OrM5PxHwT{ z^4O*9dq*Ei$H2!2Zqrv$B#*(;cb&xQTTZvJV`YszCS z@dxoN!h0Mjsc54riAM!b(#9Z7v+~WRd-`Ny?X6ZN+*zv9;H9;LQ3 z9}iY1QCAAH^?>#nENDs^pgti0Sd*3riF_U~mX`sPQ83<)LAplMGY{zvSkoDpAn*mr zA28A`IcJ3E1tPpjB8X9$CqWbru7hEWT#q48tHV@Di2lmBJQUb~vw}_#eagWdA7PNd zj#ic)#=Ok()a9)QTp1t;mi)o&A4a|b&);!)1#SdjvxM8sZ;nonDeUYIVRlW4*3)Rn z`T*FQm@_0#2B8GUnQflnb2RJ~V=Vj9s9mOVHNo&d+Y_xRm+AqW_4d5_Ff8`4-2-yE zWPhUXkJ}Lvk8$7_f+Gf;cDt~ZFa!!;iewPO|As(2d6YtC7~YN>ZZrwwaUI|+W(+6l zVObxbW@p(xQ)lvR zO$W(PDYUuSy^cN&wis@aSPGg=01?d~&F-SQ4 zrDaj@wO}+@=4AX7X%t7}VP^0yc!lRFC7+T`pr5e_VT=8F9OXa(W(o)7?P#Ka;|AD_ z88@i(x!O|qXL7vKecTZf2}9t9WTc&7!Y1*cecRrINO#yMe6+>ql2;6J6tsv1m&!>H zU5u!|(f%vE2?paZ%MM!qVr|55Qh0|XHMj=LTrkM8E3ii6b;|UrAF@4YD^KQ(KlhVQ zjOK>PE#r&Vc|HTbI@XCWxZT}_GzfRCV9a0~w4&+OyYtrfe}!&+-!7Ae*{@OiuZZ36 zKNpz(^4D#8=TX1aDtnjz6~Z?M*J(65__2k(-QV86y}j)wc%`e$h+;d06RGXnsK3od zy`8XETQ|E~5P7M~Ui{c%;~TTuS$;Q;7|)OLA6wtAupxr0H8o@ZB;k<#4l~g*`;koH zEqei5Qx}T1i%zw%0LFxMmsmx=*?PQ9l3_K1nsodx_uX>~#_zlD(xdicfD~*2o*H0fVp<}#TAKIH;5a&0<-MNj;&o^NjgcwA6 zFvsvS6s7)TjE(>sZR%%x^Dki+TRa$n9gY2hp8v-Ntgg*2lNVFgK0_ZXhzpJk;IG-P z*^Q@Jl;+PMl6|xhc2I`j{L7ckzx;>VkN*%&X`RQvSxdH_V>{HRJe^0>uG%ZSm)mA< z+SnZXf22Dn)iHG^3}7m@AY9)KLn_3?V#C`4ZYFynz~-_+#tg9+)l|1UTLU3VXQs>EYhGTixAzYBbBVWN?l>|%cP$uHA-%Y z_glBuOb=k%!W8rgs=tjILAf{mWO&Eb64w9S-GKe?<_R#;VSJ;0xZSnybFk@u|6u-b z=W{X(2XTJ4zZ?89o`BxPw7kDi8nk`>Z3C{{ZmQpBNfu)u^b8Jf@BWe}v;CbfL6-r% zdHA^>4nAICG?@Jd55tE~9`5~x4&L`4@60~^1@g#_#>wsebvztK)4%kYI?RR-Fdol7 z1(-%O5Ec1HI_oWew^(jqRMYUL1OMhpGR{61LDPAYqNi9EXe#)Oeo6bgd%LWIytBch zN9+erDX|~KQ}AEf8jYh*fBDy(4SaOB#V2w;s17%$WINU&A9l@?#9$<*r*xlRf?Cw5h|J&*8bobO19DHFS z7cv10a}Wn?Ai=U;0mI@Ph5ZU><;=o)25dA<#=zYA;dBbDO=m!?=Z9qSb{7Q!J&nUHbS7cNen=*f*%jJizW*y*TxzrGLSEmkMLjizrhZ^=Wjav?e*?% z_sIY&z$^IN;hzUP9rk{UzY&#wVE+qV?d^6MsYW{lR)fLE|0pI*h&f4+)`brbPj_sMQ&_q*=nz3bh_-MvTSt*70c$6LD(Uw*gO zdARe#Q}*)P@$SadPvGan$rCmu4?FPZd$x$5UbDB~?!Djpw!8Zz-0Ob(q=Wz2!T;+%ecah& zFP?r!|Dm^g-JPf1r{7-hJsC5w-|fzHv#v^ujcm?*7we-W|o%gJN zthwFyj8q=|@a?1SlgDg4Pj@@`9~uu()|0&-9zSJ8UVi(S%|EO3l#Tc0w|m`34+;Da z-#&h|%PKtu1TlSS_i+e6pLFQIyy30A?^t6$U_s+MwT9m(j541-MdbVd6YwO24qz`t zmza*izFxC}kF}4x2nRp1?l5#dhR*JO+kNs7Q1gfbWnZ2=DpxF^e)|}TKjoN2Ko$LE zn0|_L`_SwuTXuU-w%E+DWwlXR%9dZ0&S+_JW;FRzNP$ZN?$le?$3~`d_|ZRO}?&fIjH&GERs8 zz1ax{Y=70*JAQx2w~N;It(GM|hs6?py$8Izg@*ke6CzuxRlJC3vjz9u{&PAEv+KXK zHre)fy|=Kbd}Ra2E%=}%1Wu5QicNki232K0n5W|n4B5VqFSePE@)xkFJ$clL-#>eE zcDwVp7gxz4dtRTvyFPh$b$Iyfhrh$`)1$+GvVV^LnLN1~!Hc7RJUjibf4pLUWf$x} zFHdey4kxo)D0F!EkJsmCJEwMA!`S*7W@ZLA)@6MjR z|KaM{x9@j<_}7cG|9+o7yuRrV{`*Pz@_am>{*?ao@zd2${j=K_*OTi{SD#)aCx5?v zboxBI{pbHW?LVK~J$m^({M+B3y^rtyesc8c@Bc{Rv&ozBtp8-5{*>lV|2zE0+xYO` zH=}PyMO#Mdz8FCe)`SZA6|d+%{SjgPrqZ&w-0Y`jz`1qzRh+% zO>ZB4yZ!B}|N6&Xw*B|Je?~vOe)f;Q-CVyKee>V(^}{D`-)xT_51%~z|Fie5ORgGO zqu~GZ6m`ncV|(arKnMigryU`L5D1B@K!We<*uhN*#Qi3L!x8fi^AzVb&ZEqe4Cqp& zs#4W1`?Dv`L|6`QsUUOZ%9WYxmYHiQLt;Ygh=rF6G7!>im5C6qZSs^d49>_>wb_F8 zfyz=N3m1pO3al*vkj0%4*p1Jj2#ICdq=Z0YAfg*LXjQ3gfBqg|{K*3w~&jqhKrwTeqf4EKu^f$m;@wjp!M?=IB8VEhB%pU&=mj z#F~XN)Aa~47tJO`IZR;$5EV5dYjY`Fd8ncNr0!h?O+9)jm=Ts98Y!wr7 zQ(72;*yv2%?!iK3fL0WFKU`%cWm`kAUi9S*8_Y(oxC3nYeE(Q%by>39)OHbGR!lT4ZedR*Z2v?Kt0RWq7tMYBVV z5sZli)m$=Q2tHO0wXU`*v}qhRZ%`*;#5gRhK?`BAax6p!o&^U{a~BS|)YDwZl_3wb zilDei1*HSgf@dIt@rxV*=wUc3YZVVPVhfBA1RIG4Uj%VUPn&6DFNi4vaV>nP;Y?X( z+_DOB-XD&J5Z$cv0fa`@&LL)KFoewwL&&oV!ZMhQ5Is@7VNz;F1!Z%aKIFy-o-Go0 z<)^Abt5sNRSZ$J6Y%|c-8Es~z7iv9}N@h{oI#m(5Xb;7UOXV^fR27ch|?^AQ41Mw@IE@8r$4((-b_VQ#gm z%|VT1PMG@W5bs?dJcAu9j#?a~A+Z3DJ`63u(lK`;AmDWHI)}jt5uZIeVXpT~CMs7RMI#Bab&ChF1%fod7t#?XB0BgXD(Q)Dm+Gf4b z!4+mAVYOGVa>KD5M&ig_v)~G7rGAw1h6M}yigJYzqASw;{-%(CZkYCsQn!GeR)R=;R>7=+ya3`W2+=NrwCJLHIWOOiE$`I{jd>|!;$6Y%V>hwsphWA zxnJtD;d%v`jIXJr1IMh!RikK!+r~<<8kvEcn5v5e$p9tQQ*IPatSG^=a29MxH=G>V z@x(GM%i3>)!Ui~2R?>pvmJm76GH;y>RTDU_xkWIY3)xW}EKwz1mOFj0k#%?>ST430 zhx9Z#P@%P9%w1WH1<%_18=j1LpTTo^D6ujzDYe31ANqw*R`ZS>dVGU{Re_NRcz>$Dikc%)7504QGu18xZ z9FQw`GVv!Ru+)q}4uC=<*?USf(}LSij|XWgVA>EgHioeCq(ie$rC{DTc5WNh4w>xg zikKQ@GBXAv(jAVc%NWRbzzpW7ww}TQk!~wlh{0mDZvt$GVv^1`!MU{*PtzEfa|hMU>C-5WAzZ&EDqhs z1H-H7uAP7)g+O?&0gOg25fdA%_S(P*R>K21J^+)=bc(cg%d6B_(f69WN3by;rE9F@ z>czTEoO$AyGom4#qs<^%N&}&YOwB}Tw)GA|$@thzC^NwtXtkt|`)upi3nLyPGF;kd zlvN7>g0}5wE~5UF>1Z+Ln4vw|+vrAbrM=`bJKtxZF(b?m!eqatwsWYE-EDx*RD%Po zMq3^>*>X!z-jJ*axMLa&U3ucv%q2IMw(x4_(7F)XTCvkboK%nKhU-PqnzV{lkjxWE z*7amLnRE86)$oB{bsCm1s#+f-%&|;KQZn-f^L!RJY z9>eWip{-RDV**E7^IFQ=LFrP-R)|$jWL7zZh!mf#OyXE>L84W+8wJn}nvybVLr>Wn zJ2dP_D+-c?7VB}PtVU|qay6uzjAFtQZ;;A>19Lb$B&NF!wG{+S_Pt|9DP+CX2yo!m zt*b|1(z4S4-GP-!<(#=fB*h9FZ-YXjx&v`dHJP}u?PZI!`6gwKfW1-75>3P=3WM#= zW65F-9#(TL)8wPUB#uRpBgh{PwhMrgh4C5`j__c;KU9!ijh}d6El#)TNN+p-2xzg{ z4%|UbqeiXnY7pec`|%-i#M})>R!MCuaj^!Y0YCum zepJq#g%6Tr(@xQRI>EfwRk?#C%*RYPni+IDVW$Ze6!cKFC5n_*RW=k!VLHxReabY_ zq+u5cG)9MlR>N>jxzNO;X|hTQf*x2f5oN3~DP*c-ctl6MDjaLfY=$F_j&rw~>o5e`n>ZpyhdFcH0XC|Kha;qd8+S^nIJ=`L z37bK#Gh1U}!gwudQK)EmN4#35*+|!iPR)hGNHjP>7-O)HuFNS|R7YH0C1gDEK;AZD zY;zd@N^DUMhFHYy zCae>4T-Xc=-sh*~R!hdKV`mE^(E;zw5DeS4lgw+`&B0iX1a}Uunq%B-2RJSRaT$n{ z0-S6Etd$yj?Q4QAu0wVP4w^>tw{WK#H;egt6qz$W;&sVNlLH(f5wI~Q&1}DOe0x8h z9Naaq+EBBaqa-%u!8}A2d^<^UFIhw7eliXQYin^FFQDPla)3B;QBWS1o0g}Rgaj3N z11?+yBIGdLIB=cJatB7GIW76ZaY@$naK~y}71N`j;z)94&&;)5ZMLbg3}}%-kORA^ zwh+h?BDo9)LI&HZs>%BTA55@XCKjU=H)7b~RB8iuVH-0dWp}Pi2jh)06S+wgD#DcC zfwo#OZrC12}jA%lgHf@mBS;cq|sovn{u&G zE(+ekJ0+hqJ5DijQK^`f_O9&MEqQ5);wyhpruZK06b5CwY7KU>1c}2& znLwa7+GtbEM+ao>0l0_;43Ki5 zgo+O4rj!&cL8hV%X%!w8jIYXgvK|S-VlgdcnlGDp#^z*ZiYp9JXc(YFB}L4oysT1| z-3ydIcBPS_CJ;Y~mXWM?L#WK16ey=tA%u7(DWPh9EWD|e9?;GR7ro=Y2qO$EEoPcP zm|~&@B4DVNPVKP{?8gG=SfQX!q%f_5-N1=M7xUL(2&@yC&F8{|hmDbG%r}`g@N$_H zWxi=9{xDWX?u;zcbrvs5JO{A#ZZqiw%Nm()r42zEQ&Yi7VF~girgZba;vpsu65-f{ ziwe@HBGi12pY6HIEmQ&yz1hAR3j2^fs!*COXV!tii)E?o@yNWowBUv7FoTsvAlOC1lfW!$iurH@O?AYstXQaEZmbC_ zu$CHpi`c{zKmb%u%?M&vNhfNAt?f%PRrs(F&gM+akVy_8MO?MWnnwJbDmd0BmVt(? zt4#~z>w`0zRfDLKk7l?pF<#uRd%0X}!h-V!zV?Pq2&SadAT`M7GbOAP;p%u#jp4kQ7>8qNvUZHvfP&opI znp+2{Wu?SOws_ndla;7w3c64Xv0=?hprcD5c_<<(TMrn!S!N zbyURhP9DqtX2~reNbUHTQ1T0lWig)b43dyxtjyR^ldWb6xM7v}4z}Fq+X29^2eehkc4i>BcfburpHB|{qJg4uW9Lat zDfFadN9W5)!TVzPt)RJ*nod>Kge1CQLyyD2%2IS}PX&stF$@+%cEVG; zobzEUT^WtWA%koV4Y1C;>Q+_jyGzuPAepwkYZuqbm zuBu|rtocwVw<|Jis8DYX6tYtfVAe_2U0;NAb>41Qrc$qXn7zI5 za{#QM777PM%*n}8l!che4D+y>vMKDZ$cB=9U2T9^Gh#X%g5{dlHo37}%(ipTYL5)& z4wm=|Ktf*}f_^SqtqMm&AYaLKHfn2bSITO8DCaRTY!PC;Y)XP2w|Xt7F_5+lzfYK{ z!$mu01diiWiWl&HN|87k4Q+Nb*pBoXM=H6qxrLo5i#wIlS7@Eqvo=6F9+2_jF0sq) zRv$DBIl};8x`Ag#7}N?HnpLgNC1$LQn@%>%D}0Ay^mtgdf_@z0DioTfPnH^Nyt1${t%c>w($hz&=*Lnm+&{!|BPLRf&AUejD%T2ao9SQf#U^0<(nH|~7 zL6c4JVP`2WL&BiBY(U{at`UY*Ww}t*6jT7zP8>I`o)vA8gJjCW>Uy)mmvm0fIdyH4 zOL6JomN(LU7aNvUvNn#N2*q=q6f?!kH<>O|e7OjE;^g zbO!FgkdE56Q5OoUx|3ll!1&6~xr5z~C25-NnL6*3EU{A<@`a;|n8c)>K$DNILhxPD5l#X@MjVz7M-SKDILon5{II+cKjZ-H<_)4hXCHO?1poAarFR4^Rv<#2EM6D2dL_z=>S zC=5q%fHg5d+RB1lp}@=yv#eW)%vjZ@@L0p3<-r+F9ici_%xHqInK7_cq(8X zZu{O^J>r8@2IY$9i`f7roraVlMv$wGSmhQ8+cThu1G7_cbv}ezYBib*%i)TS(TVSI zBg&-?rswkbo&u3Yl)?Z?v~vtQ6oAx1h@ncgK@j|Ik45t=Wz%8+m(}24NaSi(=I}0q z_ywNKR?~XcSWmX<6f99aAjFa2$T6=0TR&rh04-_8mobwY4{Bq{xC5RWjAH6Ile`qw zS4<&b+&;2A+Y}X?>nuLcW0a;VY!06gdb?U%$NaxXErLfDrJ*g6bt#En| zrHB=dqINuCTO{??vRP@^PSQuyEr=ZeR*6Ro2@gig+|ki=EX2Fc!kI+7H96)jyoGn0 z#biQ4E4XUqs8VN*pc9EZP7|zN$pqFmqmeg1ZiPuOkwan59uz{_ zSIgy?bcvM%0IfT<7ZYiKLr8ucDB1B~snJ^4%)r9ZQ<>h7(~|SqQ4l+Hg<1%^l{dsV zuHET)p&Uv`u(wDzSrl4bE+_3c9Jx_8!&_x4jcw$>Q~6TYkj$fY66xuO>5|TLcP`tk zn$Y8Y*Nc2LlDMG{wKJ}5%sm5U)V4_1I4lzyNlqjtOZ?j8n{cy&QkA5Jhn;8~I}s9+ z%nIU{oCkICa{-y5IAc9yrPv}?PileaNF{_8giQ7^-BhmKajZQMNGqaIImSqBC}SvS zW^ZLLFsQPsVM#0S;ex404z*FjRvTmEP%-80uqFu?TUKgF&tl3O`^QpBu({miN(+_& zS?$Lnx(gd|h=KCzxTE)T!HA4_Mboo}9*}stMr$U|s%>3C$Y83=ipYQn&+Ab-1JZ#l zB2>f*_4MG0&7RTl(4zoE+F{c{JrRWxY?w@jFmyJSY>uI-d>e=aieww7V*tLLb}MW` zj2#+H=}pe8l&rSKBB6UrZq&%Bwg_yDj1T$9+jml6!`F;8tmjg>Ht8$|+RZ-Rt_Bse z0l)!gZ?~E+Ehd!1OEg+gu;V`+V)bCnDiA&_i?1gV=-o*|$r3eYOBwp+TH>eR}&X$8`qBS1KNC+(~} zYIJCf0!56d+$!UoYdNW{W-U2}R8EiQJRo5XJ@lB2R%%6&$d0F4>7D}=!L3bkJN6=? z25r1Hcyu2a8#s`FL1v>f-7g(>ByQ$Ah+(8O-3+5tm~6xaEbyWw=*}?HjwmzRp)&1= z4Y5Af4Ly`4gA1+oQL%ir%*x}?qb-pa(!(eVCg$At^42WqBOffpCSNKPgj4B!-FVU% zAUeeg_qI&l?y6+B9tM7lG`tHLUcFjs*;<=Bgc79*5XI_L^7svG&JRA6g%zGJnSEj> zY^s&JRIl4)MnNssbYzp~DWgt^HAgdCQ*`WO8A2A31@Yv7d(?htISxP_7oAMt81!h= z6T}bdCO8=GMo;pZNA=@$pt2%{dO|T}qOx#^f`K7Z9cxo*I$x*^G24|Px2FWM=ITv? zjdymVcq)6eWO5#3LADcXYc>Z)a!w8gG&jXPdZLSad?y$h%xW^29#$emf@_u=k5wMX z2|Bk$v4nOD2;o=d65;@2)NdD|#c(}W*dv~gCw#Ig2_YWE@Vu~fqRRO}M5so_@jNTQ z2C=Hruu~0EDsKaJqNvbuA!FWhfddRMETS!}EPTGj@MAqF7Q~XAFV}j~0xUBrym6xC z2ZSQUM)yM5PSXjwYv@f=Dw}5MggEY^aVc`VLaY)#ii06onYzAh2e#Ez3k_b*6oF5d z+az+>q20~hfjFKYr_*^F=_1q`QaECBZJe7)%>=e*t65aSl^Z~foFV0Gc_>AEN~|*k z3bx9~5K1@56nhMV3rqH_a)x({ot`>4w;JZ+RwL}ya2>1=F4M(WMkU6=+IGBv1GL6w zU@~J@oaUx7Yw?vhoRHpT;efQTn+h~uFB-j$$5~v~Yi2rXy-r68M|JFD^}rPiUWip* zS}u-(GtY(;+%krs1yEUXiIPjjXpG}F)~O08I^dJWgJ9BZb42^>Jc3zm$;$O9g=T>##?ZZSUYn5}}CDmYsnSx;(lbRqb&PPO0CA+NQG zP>kb)S_f#JKu)xVk48G28jG6P3F>4OXj6~v<|Ys<@&#+ho;8dR4jJO5;fMtk@i+R> z%qHe_&wqx%#NQe%h>I4;R&MhEMkq9-s#l`rAKm zE*gBv-PAS9Q}(3p`^)k1&p!6~2HdC5fewGZrlaM}$op>lr@t3UTSym#)i z4~cXR^mB=n(?`2;-xSMFVK(~c8vg;kjXZN3WT!9qAK%|T`TpNer%}IO_0cmPJ{Rg? zhyFah;6!y`x{lpK{q;dzO}bv8pE=F?{p-QIQ|DW0F`g;L#&%da?n8g3)=JFWxm)f| zk3O0pZ|BC~=?+Qv?sUwz`^vljouB`QA9<(S+K=z%+Wh)9w?%);@9Cz%BM$xTdR61} zyFc_?-VMX?PH%oU9xrojdzWXH4mn%xA^WlC`eiClzU#j&t$gcO29{YUOwR^gGbh>Et_}x={x692U zyUI^7W*_^@?~e~B931!fug7j)KLyb_AEXcc--F6c+uh&K&Hwx&^T8j~f^!b<^Z4^6 z&d(nNwqu}4mD_FySib)JZJ@y_{M^i5`0-mN{>?dkkx2c&9YZ=@FSw!fZ=KgCIJZ2k zlR(cIEMJCODo*n0+_nE|JD;lmVb9-+=|2+ud#b>1ZR4hXat`lw{`ykb-TVvvj;;Ru zw$PUY{7Lv{n6D}idRcV3o!xWeJ8(|f2zKWvrG0Fz_j3RCmutVCy4%Of!jQkc&F$QO z{65UyDWd2LmE!#XX(xE)?pfvddQmwpxdh%1^wwWt_2cU8y6HcsXr~uU-b4!fD30pO ze!}QG{k(<$9ChqB0ERvR_!`0NH-H_y3-+VPte+m)lFFk7um$}?W7P!w!pF^m1O7e5K*;DY))p^;S17p6E#r*{a z=U90D@%;#nc^@|I;{cAgp@zHSFM{vht}tyzXB8 zXZ((){PD`T-_8l}M?lL{lGFiJqWzxLMsAIsO0h zFMVv!Q|dJ-e!j``{6`{pn`ipJisC6N;O|53 zbkp`ZD8=K;p?T=U`ad7ftK_3(;J^MUjSrw#jo(WY{+pZrOv~uC+kLw6rv`q@@NA#P z=XuCa!}K)R?*Mv3;7j!39>T{7*?)Y#8~q>s-RQ@g2mgNk;QRA~yC}RO^IHV&CT#!1 zntz8+z3KIbWPAt6E6hIxQQvg@`)l6$d+99uPbU`YlQ8~B`rKuW41)5%OCP|u{{GMS&LsLnyaZ=s_QWV&`eptIZ@~-S z&R-sbzdQzic?|Bu|I1_Wzpck0e!;{3|Kv4z;|%!Ffc|hTyy(SKLV)|m{5uBl3l~Q2 zI`?PCUrvY5xARS>!}i+w=OpF#$L0@lOnlQR(WjgGrtWyf`|V14iO5^u#`faZ=+@2aec69L{^cO~l#%}Ggx`smJe?o;Bb*=?>3UN0<3G_MGWgh=aAVdynImV* z-F?q?d6n7pg%NOn8gKiemn?$)*|F_&>a4HUHFefkucrqOml&B3{S)s=T{s_{d|ySrYF+bQTjFU`2>_*C;??_7J|Q@a1JUR4yhW$a7TquUC&)kF%i;On z=S;=k&N(X`x1iseI!}$9Uwxaz{pa&!enzOrhfhA&#+@0RcA|fK{Pp3N=e5xxoZe^P zza7_J%0EMXb_xEEGM*+4ZcQ|e|$dfcoj1h z3_W!J*H|anVza(^e1KnssDE6Vy*oHbN;kik$KytH^_2%N-PZjhdkX`tBh|?t$u;OUAGA8v!gI@iJ$|)9 zGu~gK{J#kD--#F3t~$~;r}*$sG7=O{(f_}8Q=oDle}0>a@;MXb(+SkyhlP{a#ci$u zHwKF&tWGi;?9ls?*#4JiyiNo@rTpzr*QR08JeUusKDd2S$dj(nc9NpgE6nmCa^12x zsTh3^?kCdhMew<|52xP#nf>YeawYhelT7N*R=?W36ZB6Bqqg)sGSyMdZ!F{A7FKRH2n1MD~34i zt%>}pNXLG^%~xUgEu%&sPH&)>{95Ulf2Z?qlh4Pmf4;)d0sPV@2`f%19?u>8JyZ@| z&kR93Nt?XCOmdk4|LcD~{Bk4ge!YzP6Dcp0>j`o%%Kyc<>|veFfERsB``w04g7+f! zAHC`DoZ9@SuumQI!(i~^uMc0o{Cs)YC)oJ)6@k8cPz%?2u$l)o?K303Y~qrm{i*iz zTld&6=7;I&t6#Nd@$gE=$<0ncJeT<4aoQ&$J#Q7=$xDBJ_>YIj2jHX5Q&vuo}DzJ z&O&>lX#eVZo#}$%iygV|9u&JjT>Eg&<9^~Xz2H(VdwlXsJNYzuzMgY3|M1u|;S;wK zpSac42DzCp=Lz@yq{Gxp^5*+)pdSCTJpb2^+T-N;X3pu=>FWyU;oW|koh5o(k$g5R!yTAFvqu#5Xok8^yjh7bbD(?*I-Y$4}A)(w4R6K{MC1=w-jGDdSiM1_~}XlDfZ=me8oEYl0a)SrwMn_4|DO=5nT0&Ie} zq_diC16_Hy=pq-WpPWHdp0*4MOh7oS|$md@A7<7%Dda<_i&S9Mpf zkR1$Po(ARHd3FlD7Nyv!Zdw;5Q!c=VLw|cUQ@Y*saC6&I&oETVRJ9A7%}L2If14?| zz6YKB+?hCE`G3E4tZnUkvh~j@K8BiSLA)o8^g6Kopsl`fgKu>LaIrr=n%Mtb_d2I+ zUy89A{$@QF?ea(`+Ma*jOK>z! z)6;nR8NB*9yl2e}vi!Qds;Rzv{M#u9Jr$2O7T?R9Kmz&X+!~YUuPWRv&W;TIikf|1 z3Dg|!_qcHBuBI!gS48q^yEv|;NfdU8Ygd`_{@s&%;>xTpO?6+Qo7@m;W##LJa=vXX{K)uu=3eaOtqqz9Zzq4&b*-V= z>U#TZozz)1+*p74mVH=dhVR7D)ltU=6z5Rl9sCR9tznd`cfH? zM(14F?4jCLJI1Hoxl*A<-Za|d3gD24rTwGS#&q}LT)Ey%yo7~RQM{2g8UP~Mo zaid!p-*qzIQqOyScDnJai{M-DHs*HYUfYt#`d*Y8KI|Q~>Q|xZY&zY?-e+;QJo6KA zuTi|p`gz&)CWR4x!YOPE+tE3#-s>7e%YqNlK0G<>A!+o_{9k>(w{M;blAhp;4-2j5 zsj|28>e_G#Bw0E6q_40sZr|%N<Z;45pv~!4GdupWsBB=U z+{>^+$k>56t zL)fyh34D_Z%$?RbJYy#X@XO}B5ae;od8e-)-DYW7VM^$9H4R*U@{>kZ?6jUcwq5*g zF7kP|Hzc!?8q&D4d7R+UXSMALb+)zS?mStJVvt{#i*Fn{KJcU1yy)Xuh z|F-Ak@%|hxji_{XyMxH;P8@_ih7MY3JsbY|UbiWkxpSUQhoV1wO@GFs{=Q)e_hLHZ zzj>j`$>&x1tc@*4`~LCWt?LoE4AI+b-x2!>Jl)7?_ES3b+5BxE`P+H9%%2VR{QmqH z-WB*93-l2^$_3g3dQ$xB3ve9k`}HQt*RAxKd+_021=3qMa9w4WxL0`W+g;v%>+e|s z-3z^R_2!l>ETNLU(rJR$ihRDaxeDNU>Rd*KCg*u#^W93PH=EGr+}$YjjOX83s~6B# zpOQ=6W5v(2!!Vj#r32fVTUdM1y`|Td={Ku#yAc%ED)}X|?xylNiXJ*36Z3idlx+K?eLpj)w(OPE+UlBjshzh)sh)@SQN`ir`*wqK8MBP;df_C6pI#e>uD3xO za?8GoC#PFqxGUG|lGOd@S(VyvIjj}5ryaq|>R9m$GIRHDOM}vPWZsp|=$_xkiNsU0 z-`ZsSs?`%(pOe)s%V}Aybk6Sb2{y&9Z5vx^u2{k8TC1I|is$8=x5yb6-mDv?&+M-k z)55E6Z=n6Xb+_>E!`=7IPwzC(x6@`@eebSbzX6#LWx*QzYR~GahbQi;#Gf0E`cc=? zZV5Z~WZ_L~5(QLJuA0$buUBXSfWTxN>eaIGFc6@qVaIxP8dvm_*xRh~t3LCxda)B+ zi3BNVBP;VcfKjDbXsgq;fzK{K#*Gd5t)B}Oj_yDD>2*=aCctV>ES$p2b^}_N-{>rJ z8$yDymE#sOOXt~(XOkYQfX>CrOB86o6v#_v6pn$yUsREkK(}T62>!x2FEqMSeb>xbDb$3m9qe_J^nQ})R;J^=V^IMSx@cy=EaYXAc z`Mt-|dP2XxW$)0({^42K$U8^bOsczfWi6;Y2ma^&OL60iDPLHYf>PM`5AvumNn_?d z%bhT6ZmswfX{7o6-9S(Ny=TjG4fPH|K>Uj(@PWkKe-l`EJk%z+vY5vH9ULjpqCX=9 z`r-r`%e7hC%K`gLXp>Cz87S?614+4sd!ZwyGd-DE|7Casy=U!g))dv_%WznGq@lKb zgG44)v3X=?-rkZX_X*wP<*t&h?{WJadN)>~pO^f7KO6uXAPFyH+dvz5=sCil;u(?;BkXkbgZXN+#^ znDM879ev|K360>`);=|G6=;w=6lo;Vx*IPH)QuqzYmly(DXGd!Uk{NqtFSz$%;#)h zN~*?_-cA`8@SYD_=JWY0JP!M#3F&iI{}g$V9Sd24B5@1bEI-e3rU?4~Nvz1wChSiP z&`5++ta!GctsOrT9Dqe>K6h^mab!5q=S%Y9vz&S|cbiJ#oL9P5Z9BwEzs<_jMqe!Q zHL4@1l_~&-l7ayf#EW=a3^ws3VIhZ;fxMW`p*#zfR@Yx^A=gybr2{kSG`*p2hX^Nu zX2>X}VESfdK~FrJhssmqezQO!)ceg^Evpwm-=h3MPjh}i=y>p0_WwVU_>9T`5t{Jj(LFo&6Z7kM z>?=x5zOV&e5_vhUo0qfF+Az4Q$~lhA7ahC-aL%fGQh~OCMHPm>TW`W3U3Pi-fd35v zgp%OJPeU$J?9J0Y)gvEP(f#Xr6Oj6Du#>-P_H80) zA8-J=jPEC*1qai=q;l8&!x!FftpM#C6cenP`{U^QaL+cEYsoc-cCq-n>OJ*f(@Y>k z`Rq}N70hgLA#nQMFjfjWET^C5Z4T?))j)+La9r#u-kUh?*-{=3;^0qs_qcrbN|y9X zj+$w=01(aKX^j-8_sO;Y&kOu(GwJiVJWe-j_PVme*SR2`qeD{3TOUX5QB2)#s=S)j+O>1Bp@OUx)H#`Bf9h z5+3(PZ0HxoNe@nM^ABfOAf{=05(Se(bK`M0@8JEAuSV<@I444kXiee$G$Hn#@nb}f z8BTwyoBzrmxhz0Sq@{{IPiEiWdy%N1N;hV5KVBPWTLS+&&Cr92?F8_G%X|^s%O>^< zw@-_V7Pf58IB1AcGV}2R)jJsvrM;kukq*!wKN6U=xG0I}cVR67e-KXGv>!%rpZ1kT zwcmlF$^8S{=h~yiVT0YkA{zX{imd$0C*A!=J+N7`pwpzN)7#fPzcoK!yq9fuDBS1o znsoGHOk?ZbR!@%zw6O>fTr9y^oOuFz8m7vnE4gB)sO@`jp|0v^%%ZIy?nQngjnL%B z{+c-i1s^)BpRuD`7xl1GW5zDf+gr4Eq{c&Uxy_zLdHUuW6+fcNRjIk`>_hhXmVE`j zx81$xs^6bHpCK&t0So@J$DL+Yte)TFr|b3m`O!SDeV!&?h{HSGnR!cS=S5si0DfqB zTUYTwGsh8pSE$fU z-U+jIbB=$tgQygn)wqGCT_c=u7Hf{KpJNjScc>(v+@_Hk-zyKGNM~BXEH|Y!w7nkRNTTEl2M_FrDh$Z19DJS^tRemKB)4Zgt^tp>1^mw>b zxX!pU_a$=~2V0y3Z)vJ3&g!eftc}sLl60#oyVj^+t)R@F`HKGI-oc z(1l`3UAsajCILsVi8)g6XqpUXFH*8eShOh*WAwEPt87Rp4RNJ9JydyrHmg^(GM#;h z=dgXafD5<(%~}W%#PdCGd8#uPowo5s-qLSqN91J7!NDsDBgfyx{Z8)T;`GJN0xdHm zR|g{zvGdCozofF$qy@-7q98bi&L|DEd6ucCIn9Tw_DooeFzRF8s0!Z8AprSX`d17- zVUD0$=P@#>ibQdws}GM^bCCubyW9PKfRrF%TudnH!W}?vGRR&P34lT_m+yS^acI`# zqKF(vR&N|%057WeoJ%;IN2ry{nL}oht!YfDbJm~;E)Y&@7FbgtkV3t|WC*(c{m+(V z`QE1{8H(7B7-_eoID6i{*`AM%OW za1s+kM-+|u22CfZXwYV~rrk~t*PF9<0$v^to;FU7xAlm_3r=(Fz+g2}-{6x_t@{_spD_({8&+>#P>vYnN^kvZ<*={lLZxkculOzvL2k|^mHV=yny?3r4%;%l!v-Yk$3V&&yMMzN{QcamgBv6jxSaw=e<2ny_0@l z``!L3_`-rDI2kHt51QH9i@%uVbMs{Lby|}n{SQ>^)2Yc|qtPq)$NioGu505pGO(z3 za5NWv#}+MJh0euCS}(wl*u4IbU~y+&jsz~U=MiUJ+O*?j$goAe2J`vhmNS~$v=0TL zp{>q3{1Wi!gB=SbwW@>V{K&EMPn>ywLJ6^5&$e*2!uXc9S^#4lp_y&7%*Vz7I)ppg z@}JeBg|1YollVWyAVr_>50opKwXYhNbwb2q*vyN+>rK6urL8{}MHUZqI>RIb9{M(D z`6@wR5`{d&>c;DMG|?9!NgK**9$=m!q2M zs`UyXh5guYAgT*OsKf=ao}8hjzA$(X{XdpZJn$BGWw-sUwI#nG{KWh+-aW0I?r zFWU8-m|YGbSB1S;;7od>A}W$HV(Ue*&Mvy|#6^CLf}i^_m_kaPOQ6Fi=lj8(Krcg( z*i#&FRH*nMZ90c6Lxk4i-vrJyj2ly-(E0|E%3T4KKLZW+5>@Ilc37=F7T}<<4Fdd@ zC>E9=lqAN2Xm@h*Heq=k{V9puoIP)bfQ5ix+qbdG;ku_(DNVuUb}#v-g`iH4Rt=T+ z450_m6bkBbxhiv)kKZ60OL*72z;H z)Io^{{NK&Yhk5?!BN{GSaD79mdx}=4KFH84TC-*v=i4N!eYzCA<`Z=(v3R}F!_f<& zRKn5gR0gtQde!O<1M1*&Y<(V9`F75rz>X;3jDZ>GtfnQ}G439bLtwS-*YmwR}1p^jwbYj!P2aTou zVJjGW2H*G|qjRMsZ(k34PY|HfzwR7i9w3h{0F6PMAId3&atq?=~WSywwD z9CBpwP})VEE0>Up`YEKKu(Qw3opa^G{_ut$3#jVE=_}w~4Ijd=8)(b~;JzGq^R#K3 zKGLOG?Ok@u08iVp)pK>v#$2MwtV+_KY+-wsA=TjzH#`_`leCCM<>Wh!Es>fjsw;@C z*mz*u`xC-Af5hkLKUM%yy3n`xqw_gD_z-#dQveI-C)OxRR4flfdCF5Vi&BaY5JAS$ zw-itT%f^c7g1p$U1jq-Y)>Lm|2D5dWMhQGn7D9Mc^GS4%S4 zGl;cjMKW3>-I}mDkc))efv*>0R8y~+-n%4m5k6vv(ne)s;SfYCbFlLSsu<~vo8a~S z0^6VBR%|n!*%h((<%1|txdvWh3RM5I`^>3T?F;v>=C20IY;leofGbV)!mLc5=O2v? zwG2ZME97fN9Vv#-hlWRlPf{w}F0MQH2uh7W9R?2YDku{crUI&T;@oyiV##!fsc@@6 zh0`uw+Mo_UH^C(P@yl~TxN9GF)aP)gkTSR2VD^SoUX~s8BV$VZ*$j4Fv~8-QorhyR zw8?|BtcE>uRIjsV-RJ?>hS<3ZuBIoY+VG$RJ;izwGq&}}k3Hf5#GCA^9VP<}P$akl z;RB7R_o6;XlVkul1i-dTPC~^$x8K6Lbo3_*G%y;pZs>P}V?n}fFi-(7ELOBkpPV0v z6_%gACZ^!tZPlhlY`V0C6segcO>J)1nP@D%EaA4_qJypG6+095PIF|QTgDx}Ie`w+>Hd#{w5BU6$kTy7Mb*j{`|>g5E4S6`aKGfbwEYF03| zMMd$J5{V1yZEb)V+;8&uBJM<;5`|ulL9E9BCwdH14(lDA(oq)PHRRf7=Bbm+2d(`} zS-qK@l!%QT(viyFS zC#Mm0kS$hvPlUH1E(6-hsnJFB~dQ$X(z#nMMcM;P268 z)4=t;kMh*~O^nvNPvoY1olX98{w@ygm$U2L{ud%g^96Bs0UiJ(-FH5^L0{^@z`YCD zl3kRsnhjEVBS&;ix&gEN)9EVW@z{DKimILGZxYRkTHMw1+j)0sQRhoBQs0xY zYn?w}^@@=w+DVU+C^(@UJ!4r{!{z&V6dcm9cMcm5P2Rw#>n!b88SdCv~ zxp0TLl}O}UtO{?8H=HM&Oi`%3D5GAmOSM`XB7M7!36p)tF>fTXb;w<9I$mvtk-x22)*S)#Wvb1>i&!( z_Ql}rD#IN|MGHAgXs-Nrt?X1tb;=F0z7Imh8`dJS-_IcPKnBGEi_u~$XdeFuR$dAi z1O)&900ICf{8YQn+syS85dfe`3IKo^00+R%$b#0%#K^_b!r6n?+{D1z*__tM+{DO= z*2&qx*4V(&n3j>1o{gTJPEkZaSVrWJv%9m3G9&;jfIPi#s#`Ajk_K0KotI z$~BIa(_za!mmlb#jEJi$@$Gew4hgQ<>m%-ZrQCt|WRPM(fwd=F>W9k*^C7{$s6_~4< z$-hrsS?YB%FXMt=0FO+Ws*%xV`v(@%f+;5v!SzG{-hr!E$`|zejKey+OBns^Tf}?j za}&tAKvyU|j5$&Avc=))Q|17)>UZ=3_{b_ESKL`B+G!%FsVan;;b&k;gi0C>5Ni%C z`c5iaq>*AYbW74iCa`x(x(^Jig7E8*dpaqB-_8~5x(X&4Q>At9pk7%~K>CArtI#@; z&VJ_hiW=jj^l3RJN^gFJQ}D~`C>a!p1Yef(zvqrKfRk1!%EC1H0hN-aWYS?&=x;*r z7;ZpP>~DIdl1Jg0(#8}X2jv4!`5xx#fY!zh&Ot6IMbiDQqtI+08(%SRP5>alQ=nSq zkujiGAZSW7$8Le~mCSjXFo1<{&>3k%MaqH_R z^p7ts)WwdSL?JChAC&5S+1RKi`p@WYKFDImqMV}dgm$)_DiITl{3 ziw-N8>u|!jSt*G93eo|JwSZd`==EncLe$4dtyJHuM&`#Kg~d`T>R*9LCEUp9f-r() z?0nsPM;-6??Ou6s7t@`qE`d@B)cYGq_@~c-5{<*w0=HPnTJ_9-#6VGmg3n&tAs9@b z_I_|zyyLmNIc)yHm;1KM*a<};A1skb%V#%6v7ruX@C;z9@>E0Q%6hhl ztYA{V2yC^!5{Wzb61tG}2}5gso?woj3;{)c($V@V3996FsRn8j}Bebz%4un*dZFvUa-uzRT@k_skYy{TfN1e+)WP zNgEaVRL?%+4843CehqaE&sK+Dd5vwP%WJ1LKVC={55h-yegO+t(AkY$N(5?OaPu1< zM{LiPXq3a+vad9x($QYqz{%JLF!UR{Ax*9Pol-gifnEH*G7@OEnLjTz`L{FG#A1Je z{h4(|YgiB~3{E;lSPQVqh~QEH)FO3@Y^VHfeg!CrC#ZNkXx zbeR1SE~%U_8{B^$G5T8{7?5X!$Y1&}lany^;Z+holEX6&bapJ2U`Xpw7&xv31n~_C z%{3w1Kl!V0whaD2qeQFBbJJzpMDaj6oFwOM5txh)@I7u*{jfy4070H>R*jBeaHup8 zcQ8<6^73{^kS7?C=FU3Jr`@ZeyI}pEUB~j!O2#mbg+ebdy}&S!c*vFFw4L{+i((^T z^w9xAfI^YS;h;kCia>dD0dmJp`8ohpr-;?DQ#>l=Ss*AN< zv=OdfEbcP)l6;l>K8lmmVy+MnM`Eriap9y9Bzg!XD1JULw2i$c12Cl`H(H68{SOe> zSFjKE`&o-Ls<=jWd z^2EMcRS6TBqb`{4-GyUW+!1aK5V*3*A3`yY%*YF}3nSQl<|qGahFycfegWQC@dCPY zr;Hn_*{8a73J7>Ta=*z>WrhssO%Pp0<^^?7XLHrBp@L|d`%NJWo0%B^&>^ABKY57f z-7n+~w1cyBQR}kaSkvH6Z=zbt?$^?}fgLHw%$n_?+}BIX$6SLo9x35B5_6t*PGV|! z`e}BWXtUtW4mtn)rSqiCmu_2v$7XAP|WdeZjtlco>qzQEOK z&MgX<-+D=v>7x#X#`2#&>5lX|orr?b(D~#>`yKr7~n-TRf=B`Qo<%} zFFpaSVp)Gjy(#FUDqr?je|(9SgXO(gT5D(j<)9EK3Pw9fHn?Zl&soXplY3_ z8mow7%cz4tf~KCrU7w)7Ki0P)=2LPC*f7!>h2 z*(7)Do;4Jd!P~|%9@At=Ail*U$~uj+pqYpB7hAI3Yxuk_tQ+4o{1r{&BwZkG6e@xP z1_;iPlFD$prMJgQbiB8K%6HMhv5XlKKF0Af{MudDYXW-}IPv?I*%(-<31JwigpvB@ zFQ1069&TrtQgxMq1jG$c9YHGW6@zvovMMPo*@XA=#LMJY+14FTvzIWYirM#3)w@1y`P*B*I;UR3U6a#nZ15p% z!>0;0b2^!}C(-SFzEM1Nin$;$B_R6Vv{&J(i}HDV@PXd2Oh;q%gHpQo86^GBYDzcw z9Pm|q;mHmdwLEZ!m~jy1*`;l_nTy6B#hara<7^O$IHQ!^+W{fyEKQEd|f6fCE)J*RKzu^Ke{ zvLTcDx#Kwg?F{G&MKpM8W9VNmAY~)GxK)c>wg!VYkxd>HFy4?<8Ak(9)C0A^FV+q^Qqm%Yr z|9Q8ndYgn&AtkIcE zZoZ?@3t}zcYc-yAK<~VbiIu%iW!)C=9t|DSOPAc54Qp7>qRg3t5RtOu-zEid@bp>0fqkIQp&Xzk{=VccHzq+F#BNk z+3eFFpLSETPAGctBA6MT?N>`3E{(1tIbB0jRuHDgf?Iz*eq?02SP(Q|+zvM4;~1ab zTh|BUGWAWEv2Czt1WqU=n({}~C?n=-H?Vdio})umAFuCud8$=(SEdyhABqy7jdi*g zzFI*ILZ z)z(9u$QsiIdrfO}S*B@&yx8|gyv~lYUh< z&B?}=BdbJzITG1Hu~hTf{+gmuH_V%W3e|;Tk?0Ri*(FAvpg6Mob29d^>AFB$u86*Q zqod1d_m~ThLv4zzi${#OESWwTeQSG5)psZsZwsceGn@Edn;oLD3qLe+zWKj=j4vO1 zcZ>NbuO_2&;XSV26jR{02p+0QV2}W@qFgDF8aMq?KsFmZhfX#LOb~Quxp;Sy3CU`nC8&}Y78h(yrC6=PEED*U8)kwRU zp!b$eaesp-d@LhDtCpH@@ts}Pe`0K-&eo0wbu7oY?F8CyB-zI8opes?M;StOA8ST0 z_m)-VaI3j><$HMILThl<_>}>zgMO%T4oj{6a8H4kis_J>vF_N7#Zd0MFF*))iuuO{~br)>9 zfvtPxY^{#rnO&t_M(Le>C)6vtmCp3hCR_nS)Fb?LlqhA~EeOjrOxewS#rz}$Hf?nJ z+y7d85ae_nNVmHC4KPar3P}Lktoc&+I&v4QGLdv51Dr5zT)-&lh%|f+BxQERsjF=hqFedjbiEv8rr4tskv zY>?PJ@NO8?^5UV2OKK8{ysjO396i`>#W z6KN+0H%~Vg)WTR-a}D8_V;)HZ+}k0}W~mg5jX^|;e_(qDjpjfHV`kGf3~842 z%%57zKOM3aZqv)prJm3DWt<8u7201L8pGb#@#XMYLw+Z1b9b5CA!n``yw?}odWQ`G%hW(`b$~*84RDTbN0-#@e<#Pu599IM$diSmj&RH<9vU zao*4jPCk=-R-ONbLm>Ni0@Wn!B6|vAs98>#mQOfzL6sdaBokt@Q+nmVZI>)M~!b*QJ&9e4vd}8 zJO-9|8DiG`l2hSQq(Zv`+6UFL4g2AqQw_3YLeJ+CgFy1~5kj)J-JW}gRO5|MYx-tj z0avWak_q}*+E1Ln40Y&V88?y>l0G^7dx`#dIN)VJU-^)`0q^oJCEelrP*qEnqkRpo zY#;2V$@?npFcDO^x$7)idRym>eO?~~lPkQm!-l?6~`b9d9j zO)X%J2wN}pP9U#V;;k30UUt~7B3d}97cG+|Av&I2{j;4b0Y z1TQZFtZi{S!``UUeVL!f5hC%g$7VSj9D(i%c!8aXn+59E$3wPsMLbbX{L=pUSq<)p zk-WY1^IF#0y}yE6Gu+`fhc3qOd7)JZ5IErY%D&D*x>pMtj;nVduhvkCEiqMt%sbWz z;xOp-;}xl{m{n#7=z#`*twZ}X94R3&{Nh7Q18m4S_BU$TrGH`XtA{d5@-flQbrSo4 zW_C^DAg65JIppa=bur1#Fe(3Jbh>?DWKm$ht3uBP5lr3z$)8=I`iRM71~v^@!t24V zXtgksDGR@`R}I7fU)VKfSvC&!LY?GPsXD`$LUa&i>p>C&s(<6(ykdL&>^6D5Yyl7Yt+fEo=W`T!_)K_Tm-dZSN! z%k4t>1^Q1t`EN*la-Gu@hywtyWBz}wC;uN>|8X+^-zfDGx0Tz5cthS`?HK}Nx-^OP z!y2yH7!KOuP$!%{tSc+FSyRK3KbfH7Q=JUXOY3f>Z}pM6_v&nBPs=L%8#|J|gF$hV)A{n8kIgrriDKu@WPM%w);X(^V-x5_xPm zM+SS1(FpSb5zH!Q1xV@K|urgT3{99z?zL_uVxO9e$VFv_U)+}F? zb6#Sl)-Mkw{fJD7y$e6yTK{ZWq}i{#co=Ob!5u|2-;`h_tbxv`o%J*0IlETfn_rXP z+7vdkoSBLQ)}A@|C$p6K&DexXH*d!cru^?=fyuL;YnNXJPQTTfiFcVC_f+lr_InFU z)^50p&FBi2NAK0VKg<_0xN!?}_odTwT^2Jk2xz;G%9cHmL2!fjiyT<)glZ4%tD=zi~uyDEU!s(g_|(* zmCalxHSiqU6(8_{L4+=b_ddF%aWi+ z^sG2^r3GR}gH8VF=CuMhR3N-;N?6D;Q8^sXNp0Uic|u{L*J$%SeQ^}_@*q}jCe(Gt z1m+kY1qSb|Hmklyv@^lpB+V*Z^Q8>yBNBdFT$isSqGg-cF{0N# zFRlm5sVR{%wTTvzl;ECApPTR4h4XYr`2g@}o8&Glhw)1i*AYNb4jXkj@tXB<$WsG8 z5CjH^Ir9+V^s%xtsncUnIRLIUcv1jFD01S>Zmz8CTqI&ZM}bSj;hYAai&?x~PnFaM zwmIoI;*oc~3a?kj?51n>0#f#a2gj7kV6+PIG4Wu&ZO9oDlHwZ_O!>1em1SgD((VhyFm1i&=Na z+kxLYaMhg3H&^4IM)##Sl5R!-Qu&MBBm)35R}_Oo&-LX7umUS#jR;4>-Qx#XEfNqoL?jyl*{GK`ER%goz0*G zn<=JI?z**32UwYty%dwdC%Rh0Cg;8xEGJQdsaJ=A(=}}Ky zsl%=voGM1DFx`NCAgzA(B+scva!hkJK=vSHTfS*vbsTP#2NNkop}Q1FzFxSqMjz?7 zboVua`lkIp&HdN}4Z^Myx=E8QG*wEmBRj#t>tO%;Lkzz?aXe3!?9>qGCDf05v+iBZ z#j+?Ql?s?!22Usgz(_AxTvU3?H35ja5@2PxMdvI-HAXkfX@FE7)WO9@^$Z4B{Y3M5 z+X<@l3;2Ar86`yF`n^)J(c1uc%q0>(SV63eLr}m3DCNT`nPdX>No*|-AK3CEDWH+{ z3R*q0j}o1l@uA=@1b3jXe*;SQ+Cv5clo@ZYSm-23s6_g|1{z zc+(&drWs{JcK^9Aw?nvJ4blvja6}Mh5}T|{hp5#gJvbrB$w_M5IKuiiW!|Ni(?TiG^HoboykD7ki>NPd!9hK#Y zU;BT714f0A8e@^Fc}?%~B~HFA&hEbXHJ>Oc{^ccYRxK*5M*sR3@H&o%=!v_638`2( z&S(1%&4J0biHn3kLg|XzPL%e#h<2yV#uVwg*@N6)qYAUpYiKT#3m!Bc@Vc zAKc#?eMd;M>0hh{*8SiV>CEMl``}>5T*PffU!t8+!$?g}Qc7HX~5)r2^?ae~4eXES0Iv z(mm*)K1-}uQU9hg;DSnyJ(O|SgTdJEObCSYG^y9|42Q4aHdjcBu zX=_u6{z#1^of)egu2PWe93LKTTpUcm2n{5F6IhjBnd-#?a*jBzjx6)g)T$C!si~?F7MJPn zLd#=|d{clOOwmCI8P0KhZ_BV1pzh&D;BgAe=pqPPJoR3JrQq>>0if^dZ3ZFd+yG(# z*)&9!a2?BcMe^p^2UzY7e`YSW3UIJt~~lafgUZ`7%6 zF4^z_#J7_AGS0dVpM#C<=M;i!cw-3tKB!i%&fRndu5%LfdslUOU`Yxbux&S$b(qgr zhZHr`)|K&txn-dXq^ad)_@w}zEGub+@!87M0DpJ9ENBWWbUfU6NV>4pZ&i=n46t!p zOwA!fHxx25#+v8Igq=2^ls&=*T0`*rdc}K>TCbF_rKnu~V%|}Mr`Ay31d6JK&Vpyn zE#Km+mIa$c?b+hb>q_*Lq8=Stm!gD z6SFqP&A^6%CeBmoXrLzTlh4Z7gngz|ZG{x)H+(wt;UBY$56g|TU_%a|qxr8l3Ad|` zh94Pw=mG(5Kg))+^f5PV(#(R{18`*yr~pKBn5?P@E{>FvOb3nT2B@9J70upXpVMl; z1;0i(#I_e#;A_k?W5HaqN)pZ9CKatc`+0YSv zcD&}Q>bcwZjTp>8ZN?Xi@;!NG)cUqGJl_Sv&4`@w0EmHhu%gTt?fL9lQPu|SwE(M< zEr@J=mCRr>nWPZbGb)UHW0Z#<4zlDtJ zoe05vhkRA=Ob(1zX%m}abe!$t36`uG%iv4TsF?5lVdkHeXL$~q3ix|xa+MJe+fsg? zS9kW*Vfv5;VTV|my|;Z!Tc7lVxvm~-4-l{X(P?aTuI%%B#kpvvIGVbbUZ2ex$lb@U zQ+@B!QhVq!5g0(66W$=VV72+cE<}LW67&gyp#@NVSt}t#C=qB$F3T!MTODMTzFSU` zl`@pWiM`E9jQECQNB*m{vy7^0?e_SlYXbs;fV6;gcL+$AfUtqBbc5tZ=|)mQ=}m`p zN_U6ACX|xyX49z~eDQehJ;(dL=iYP1U2Cj0=BM?Wb3XIK8e{$c>&Y{ttk|Q&%ifw@ zM@m{9z(Ik{8D~#a)1IRXKHxKzU~6ZNwgm|aB||lMMugkjrNxMXLymSvv(8o+P77Hn z{o<`dzPi!_h*3dLI>POVYb^*R4HC5^?m+eM`4}wfbY$6JO)iv+eYD38 z#Z2o*c124Opy~FOEFund(dn*eei`o5pLP*eS0Z-D@kQJ1AMJAZO3b0LQ5g8BgVc_U zIAmPyddWd-taSV78EJXFpOqf#sM?VW^}E0&?K)9$hVPGs?_EEQ9#YTn0mas!18kQ zMEJWd$)J%;%ZE<%33O!B_5s$rsq77e%3{#Ww3RzcG^<@U1sk!*iJ$AP#B0-0(+&!# zGi4rsQFu!=5?I0^$!{3X(VJ(C8$(;KWRR$uY1>=$WLgM)A(yooRyHb#e5_*sP-c)P zrixqNz9fb#()98j0Vgtx*6>_4qM*R(FcySGjX;GB2Drsh!}8qXw3#M9742g?RBY_J zVS!Zh5i()$*yp@a($#EB%Fknhe3&k)fI?4O0B8(sEW5%j#o z)6fR;X2@|R8e?h%)X+$j9%q-2^|5<(nqnYSKsFXB>n?c-Jx(ya;E_ z#cmtTn1FzlZ4tb^;f+Nq*ffhvP|Yx+ihH1@O^9 zv%cWw`QRp^CMZg?m(xi*c4J>rKvL-)mu!st*$(LI$z3d6-nRsG_DivHg-S}4;*ZdB z>(h^)#f`4Z2wb^iKOu)E3}BKz5`#xXV^|*Wl+<7EDzC1etVAe5pYd?=rY`c%0ZXSD z0f_5pze|k;mgedBrpMR~37huMY6V*4yjB8Nyua?flU3xJ*#>~5d$$3^}-%K$>m;Vit1tVskHG871=>u zm!6y1rc2y0ucUh@46%wcJWxqXkDDHs9V{=C=XvtuBC=SuReBb)D@V_}3OSNW19OvA z^!7w9;N7`bMM;c!`NR&!O!8VEFhR-B^n7U_+-`iM25Z*UQ?@j88GB4Mp(pAMMl*nW z%PQ1g+A%z!LmDubQGL6>{5GN3Ps|frG|`qS{VX`GDxG^P!^a5RbOyGtK$w3j3{SKY z_=<8!WsrUncw>gMwKARQ>0e~C@fGMBYRVcds(_yycA%zg$-EU4#KlKeQfg)SO7 z9N^CmNQhujbg2~LH=w?bhlZC9H!xeyLHcGVuk5GK3g_chjKm`mDw77V>b}i+(WkeQdXS7OueI}&u<#3+^x5H$a%@eJ?U>n(O++bxmphq4{9@8)iv0{qKXPs0=8#pFR)H?`|L6lLNpn0?XUd1 z9vHrLBuI**12+|1qT|kXPIBd*jb3lT+CfY`%Ce%G<(RPRV-2 zab)GS8j>;XbVSn-u+?Vpkubjfq^tC8_;?$cH%TG$jU^UWjvt25dd=(V){3WcFfL+N zxa0gSDh!g86uJKqkA)bS*AKn0+l=G(oCgWUN z)S*uWTG|$cgCKBu~O8=!hMBV1>{q5>;akj+GP&pV<8f z&v|aX?^9Qb4#3hPProG(2b$Kk^9F-*%!6Wm;zWU>_-s*}9J!YLtLgqr6s9-6r(c0E zjeJo7^v%^}VUykTGm%v)KgtZf)1`|%OWfFQB!^0u>Mg!5Y9mKUo;3kAxvptG zo2mztkU~*6j4`rRUN<#ooNVngyoMc!pE{F2X$7*Z3T&>r{HU?O&TY&icQ2ZgLThcO zFibvyJ<&JkakRyBYD0MBl*I(YDmykVA>M`0zzrW7(QD9Kw9mcedYKH!(GP;q_In+< z$f+|BRr>suaAKnhWwMuIe*X9F8W7Ctj6KJIzE9XW>1TGl8mzN;$SCm%1}*7Fa2>ks z9`|u&Vt9{}xz=M0l^3ra)lIG#2739j9|z9oJq%bo=sE_p)ry<2N&VEjo|+Hs?-Z%vIURkOl6+5Y?0hTQb2z@LYuL+=w9N*bD69x;2ZUfX||-zQ{Vy zXCV_R$-k_-nB`3%^<%>$Ey z4@~5h&21XrPF-0p7uS%NV^7_%xMNibZt zK(^{?aY+C9i~I6-ead`#Ds|cXt>ziC@cHxT`2;Igjr#eRkw6MBrXzDfHQ|a}Uk{+p zDZ&n5LRUE`6(B>TO zET~v5&UmZ`_gFa&_Ar04=FV3&rt+(_(*AJARO8@}7C<@S^S(l2a-H(2iPRi^Z{1n3yFqaj7G`bI z-Q0DH=1rbiZtuAV+~7vo(=!H~Q~ceFYomN%?isnK6!gh!NNH6$_}r;s^-)7?0UwwV zNpv%?bDkBJ*Jne*MnU(2#Jv&Y>1p`g>l}cm>I1W`24Qd>Xrc~*x09aAo3^yru;C%{ zVlI|qVGlRHnuW|3?K~YE%03QFL;@wY<0jWq;Qn*!7lz(^O^@!|A=oZKYY!rtpT@sg zHC0N_d#zFgeQ3$qU}w~MME07^AbgIh5Z!^Cz3?Ea+LwR+THZjnzsQjU8;Yro~lFf>!m@Yl4d@cGO@YX4K z_*LZ>|7~8IN2S_T@I(T8@f4e=!NJ`Tuua<_onqZS&wR7)!M4^^NjI*43+Ly|WR4Cu z5;>`bVFBhx;o{_NY-KKIg;~_6sJ@)N7H^4$X!n@Ah?8 zBKT6bT+q_M41;>HEIi{POYCKFf59 zus}i;ekr55kQT8>24$(H=^<;**CN0`iqxw(F+d&#hUO;8T{{=X1;kT~D_A8+BqvSE zSpu;;CvF;NdcMG-7b85pn)x}66`tPbp?};M$NNaO1#dr)c09v)|IAX?|GT;2_ocjb z@sK?Ok(K9mH|fh`jq6d8>*K@0l1cG~Z9+!`v;Eh%;e#+bL?WGS* zXuzUC%spn>CO}deySRytT$d=GJwIpO4|c`47ej-{!-~y=Zb~0vLJxNK2pxM_a>v~# zjOtaA_J?e5oN8Y)RjD%Sc>#UiILL2x@y{wcRlm*|ql?FcKa}vE3PiPcQqy_3-TuDT z?rieRA%^x_ZZ~y!heMABL8SZ5jmEauAeVNSP@Db;l1)Q|kZCHuuVk;1yPk!qY4-3C z;JO3OyqBmpum>-h2G!!qJP{BtI z@3-Lh8w-H+_vj7)F7+e)`z{@j78(GhhUnjXIX`(neLz1X8~TdfR-oG_8{b|czw>TA zJb?H9X8(u>F?V`p4KcSfw}0vU(;IZl|DodeAHJYJ^M8Ee^_nzR;UWY8!c+kO-e36a zw`u(SdVhB%*_r)T_zzRke+2(*^pC=CtNZVR=a)tg5d9Odvnj;d@uf58Z`{8u_&;+W z{lXQvU6sFI@PBblt(^@a=8g`K|1*a_79FPW=;;R~B!I9I20-PPrkDM{bNEv}9FFe) zdslvD^zU}GpJV@X4A%{j{y|s%Y)-o!z`vY>KYH=2X6esl5y(Fw|Ds^}d$a$myx|Wt g+&|pqpP+vcJN#AEXy`x29qabAL